diff --git a/.github/actions/install-node-dependencies/action.yml b/.github/actions/install-node-dependencies/action.yml
index 30c98070f312..7bf1d8cd43b6 100644
--- a/.github/actions/install-node-dependencies/action.yml
+++ b/.github/actions/install-node-dependencies/action.yml
@@ -2,6 +2,10 @@ name: Install Node dependencies
 description: Installs the Node toolchain and repository dependencies for CI jobs, with optional Electron archive caching.
 
 inputs:
+  cache-pnpm-verification:
+    description: Restore pnpm's policy-checked lockfile verification record on Linux.
+    required: false
+    default: 'true'
   native-runtime:
     description: Native runtime to prepare after the script-free install (none, node, or electron).
     required: false
@@ -24,6 +28,15 @@ inputs:
     default: 'false'
 
 outputs:
+  verification-cache-hit:
+    description: Whether pnpm's verification record was restored.
+    value: ${{ steps.verification-cache-restore.outputs.cache-hit }}
+  verification-cache-path:
+    description: The small pnpm-owned verification record, without registry metadata.
+    value: ${{ steps.verification-cache.outputs.path }}
+  verification-cache-key:
+    description: Exact verification record key, also used by the isolated PR benchmark.
+    value: ${{ steps.verification-cache.outputs.key }}
   node-version:
     description: Resolved Node.js version used for the install.
     value: ${{ steps.requested-node.outputs.node-version || steps.default-node.outputs.node-version }}
@@ -50,8 +63,9 @@ runs:
       uses: actions/setup-node@v6
       with:
         node-version-file: package.json
-        cache: pnpm
+        cache: ${{ github.event_name != 'pull_request' && 'pnpm' || '' }}
         cache-dependency-path: ${{ inputs.cache-dependency-path }}
+        package-manager-cache: false
 
     - name: Setup requested Node.js
       id: requested-node
@@ -59,8 +73,50 @@ runs:
       uses: actions/setup-node@v6
       with:
         node-version: ${{ inputs.node-version }}
-        cache: pnpm
+        cache: ${{ github.event_name != 'pull_request' && 'pnpm' || '' }}
         cache-dependency-path: ${{ inputs.cache-dependency-path }}
+        package-manager-cache: false
+
+    # PR-local stores compete with reusable build caches for the repository quota.
+    - name: Resolve pnpm download store
+      id: pnpm-store
+      if: github.event_name == 'pull_request'
+      shell: bash
+      env:
+        LOCKFILE_HASH: ${{ hashFiles(inputs.cache-dependency-path) }}
+      run: |
+        test -n "$LOCKFILE_HASH"
+        cache_path="$(pnpm store path --silent)"
+        test -n "$cache_path"
+        printf 'path=%s\n' "$cache_path" >> "$GITHUB_OUTPUT"
+        printf 'arch=%s\n' "$(node -p 'require("node:os").arch()')" >> "$GITHUB_OUTPUT"
+
+    # Match setup-node's key and path so existing default-branch stores remain reusable.
+    - name: Restore pnpm download store without saving
+      if: github.event_name == 'pull_request'
+      uses: actions/cache/restore@v5
+      with:
+        path: ${{ steps.pnpm-store.outputs.path }}
+        key: node-cache-${{ runner.os }}-${{ steps.pnpm-store.outputs.arch }}-pnpm-${{ hashFiles(inputs.cache-dependency-path) }}
+
+    - name: Resolve pnpm verification cache
+      id: verification-cache
+      if: runner.os == 'Linux' && inputs.cache-pnpm-verification == 'true'
+      shell: bash
+      env:
+        POLICY_HASH: ${{ hashFiles('pnpm-lock.yaml', 'pnpm-workspace.yaml', '.npmrc') }}
+      run: |
+        printf 'path=%s/lockfile-verified.jsonl\n' "$(pnpm cache path)" >> "$GITHUB_OUTPUT"
+        printf 'key=pnpm-verification-v1-%s-%s-%s-%s\n' "$RUNNER_OS" "$RUNNER_ARCH" "$(pnpm --version)" "$POLICY_HASH" >> "$GITHUB_OUTPUT"
+
+    - name: Restore pnpm verification record
+      id: verification-cache-restore
+      if: steps.verification-cache.outputs.key != ''
+      continue-on-error: true
+      uses: actions/cache/restore@v5
+      with:
+        path: ${{ steps.verification-cache.outputs.path }}
+        key: ${{ steps.verification-cache.outputs.key }}
 
     - name: Validate native runtime
       shell: bash
@@ -96,6 +152,15 @@ runs:
           git -C "$GITHUB_WORKSPACE" diff --exit-code -- package.json pnpm-lock.yaml pnpm-workspace.yaml
         fi
 
+    # pnpm checks the cached record's policy and validity; never bypass verification.
+    - name: Save pnpm verification record on main
+      if: github.ref == 'refs/heads/main' && github.event_name != 'pull_request' && steps.verification-cache.outputs.key != '' && steps.verification-cache-restore.outputs.cache-hit != 'true'
+      continue-on-error: true
+      uses: actions/cache/save@v5
+      with:
+        path: ${{ steps.verification-cache.outputs.path }}
+        key: ${{ steps.verification-cache.outputs.key }}
+
     - name: Resolve Electron package cache
       id: electron-package-cache
       if: inputs.native-runtime == 'electron' || inputs.cache-electron-package == 'true'
@@ -116,12 +181,19 @@ runs:
         printf 'version=%s\n' "$(node -p "require('./node_modules/electron/package.json').version")" >> "$GITHUB_OUTPUT"
 
     - name: Cache Electron package archive
-      if: inputs.native-runtime == 'electron' || inputs.cache-electron-package == 'true'
+      if: (github.event_name != 'pull_request' || runner.os != 'Linux') && steps.electron-package-cache.outputs.version != ''
       uses: actions/cache@v5
       with:
         path: ${{ steps.electron-package-cache.outputs.cache-root }}
         key: electron-package-${{ runner.os }}-${{ runner.arch }}-${{ steps.electron-package-cache.outputs.version }}
 
+    - name: Restore Electron package archive without saving
+      if: github.event_name == 'pull_request' && runner.os == 'Linux' && steps.electron-package-cache.outputs.version != ''
+      uses: actions/cache/restore@v5
+      with:
+        path: ${{ steps.electron-package-cache.outputs.cache-root }}
+        key: electron-package-${{ runner.os }}-${{ runner.arch }}-${{ steps.electron-package-cache.outputs.version }}
+
     # Why cached: `--ignore-scripts` leaves node-pty without build/Release, so
     # ensure-native-runtime node-gyp-compiles it in every job that asks for a runtime.
     # The artifacts are ABI-bound, so the key carries the target runtime, the resolved
diff --git a/.github/actions/prepare-git-compatibility/action.yml b/.github/actions/prepare-git-compatibility/action.yml
new file mode 100644
index 000000000000..058d31a064c7
--- /dev/null
+++ b/.github/actions/prepare-git-compatibility/action.yml
@@ -0,0 +1,32 @@
+name: Prepare baseline Git compatibility binary
+description: Restore or build the pinned Linux Git binary for the compatibility contract.
+
+runs:
+  using: composite
+  steps:
+    # The default-branch warmer shares this key across PRs; a PR save is private to its merge ref.
+    # Cache eviction remains possible, so keep the checksum-verified cold build below.
+    - name: Cache baseline Git build
+      uses: actions/cache@v5
+      with:
+        path: ~/.cache/orca-git-compat/git-2.25.5
+        key: git-compat-baseline-${{ runner.os }}-${{ runner.arch }}-2.25.5
+
+    # Finish the CPU-heavy build before any timed compatibility lanes start.
+    - name: Build the baseline Git binary
+      shell: bash
+      run: |
+        archive="$RUNNER_TEMP/git-2.25.5.tar.gz"
+        source="$HOME/.cache/orca-git-compat/git-2.25.5"
+        if [ -x "$source/git" ]; then
+          exit 0
+        fi
+        curl -fsSL https://www.kernel.org/pub/software/scm/git/git-2.25.5.tar.gz -o "$archive"
+        echo "41662c52fc16fec4963bfc41075e71f8ead6b5e386797eb6f9a1111ff95a8ddf  $archive" \
+          | sha256sum --check
+        mkdir -p "$source"
+        tar -xzf "$archive" -C "$source" --strip-components=1
+        make -C "$source" -j"$(nproc)" \
+          NO_GETTEXT=YesPlease NO_TCLTK=YesPlease NO_PYTHON=YesPlease git
+        # Object files are no longer needed after linking the cached binary.
+        find "$source" -name '*.o' -delete
diff --git a/.github/actions/prepare-linux-package-fixture/action.yml b/.github/actions/prepare-linux-package-fixture/action.yml
new file mode 100644
index 000000000000..a84568b3e062
--- /dev/null
+++ b/.github/actions/prepare-linux-package-fixture/action.yml
@@ -0,0 +1,63 @@
+name: Prepare cached Linux package fixture
+description: Restore Docker build layers; only the main warmer builds and saves missing images.
+inputs:
+  fixture:
+    description: Directory name below config/docker.
+    required: true
+  save-cache:
+    description: Build and save a missing fixture on the default branch.
+    default: 'false'
+outputs:
+  image:
+    description: Loaded image to use as a Docker build cache, or empty on a cache miss.
+    value: ${{ steps.image.outputs.image }}
+runs:
+  using: composite
+  steps:
+    - name: Restore fixture image
+      id: cache
+      uses: actions/cache/restore@v5
+      continue-on-error: true
+      with:
+        path: ${{ runner.temp }}/orca-package-fixtures/${{ inputs.fixture }}.tar
+        key: linux-package-fixture-v1-${{ runner.os }}-${{ runner.arch }}-linux-amd64-${{ inputs.fixture }}-${{ hashFiles(format('config/docker/{0}/**', inputs.fixture), '.github/actions/prepare-linux-package-fixture/action.yml') }}
+
+    - name: Load or seed fixture build cache
+      id: image
+      shell: bash
+      env:
+        FIXTURE: ${{ inputs.fixture }}
+        SAVE_CACHE: ${{ inputs.save-cache }}
+        CACHE_HIT: ${{ steps.cache.outputs.cache-hit }}
+      run: |
+        set -euo pipefail
+        case "$FIXTURE" in
+          headless-serve-shutdown|cli-launch-contract) ;;
+          *) echo "Unsupported package fixture: $FIXTURE" >&2; exit 1 ;;
+        esac
+        archive="$RUNNER_TEMP/orca-package-fixtures/$FIXTURE.tar"
+        image="orca-package-fixture-$FIXTURE:cache"
+        if [[ "$CACHE_HIT" == true ]] && docker load --input "$archive"; then
+          if docker image inspect "$image" > /dev/null; then
+            echo "image=$image" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+        fi
+        if [[ "$SAVE_CACHE" != true ]]; then
+          echo 'No usable fixture cache; the package runner will build normally.'
+          exit 0
+        fi
+        docker build --platform linux/amd64 --build-arg BUILDKIT_INLINE_CACHE=1 \
+          --tag "$image" --file "config/docker/$FIXTURE/Dockerfile" "config/docker/$FIXTURE"
+        mkdir -p "$(dirname "$archive")"
+        docker save --output "$archive" "$image"
+        echo "image=$image" >> "$GITHUB_OUTPUT"
+        echo 'built=true' >> "$GITHUB_OUTPUT"
+
+    - name: Save fixture image
+      if: inputs.save-cache == 'true' && steps.cache.outputs.cache-hit != 'true' && steps.image.outputs.built == 'true'
+      uses: actions/cache/save@v5
+      continue-on-error: true
+      with:
+        path: ${{ runner.temp }}/orca-package-fixtures/${{ inputs.fixture }}.tar
+        key: ${{ steps.cache.outputs.cache-primary-key }}
diff --git a/.github/actions/prepare-xterm-dependencies/action.yml b/.github/actions/prepare-xterm-dependencies/action.yml
new file mode 100644
index 000000000000..8fa54bd85ae4
--- /dev/null
+++ b/.github/actions/prepare-xterm-dependencies/action.yml
@@ -0,0 +1,33 @@
+name: Restore xterm build dependencies
+description: Reuse installed dependencies for the pinned upstream checkout.
+outputs:
+  cache-key:
+    description: Exact dependency cache key.
+    value: ${{ steps.restore.outputs.cache-primary-key }}
+  cache-hit:
+    description: Whether the exact installed dependency cache was restored.
+    value: ${{ steps.restore.outputs.cache-hit }}
+runs:
+  using: composite
+  steps:
+    - id: runtime
+      shell: bash
+      run: |
+        . /etc/os-release
+        echo "image=$ID-$VERSION_ID" >> "$GITHUB_OUTPUT"
+        echo "node=$(node --version)" >> "$GITHUB_OUTPUT"
+    - id: restore
+      uses: actions/cache/restore@v5
+      with:
+        path: |
+          ${{ runner.temp }}/xterm-patch-build/upstream/.git
+          ${{ runner.temp }}/xterm-patch-build/upstream/node_modules
+        key: xterm-dependencies-v1-${{ runner.os }}-${{ steps.runtime.outputs.image }}-${{ runner.arch }}-${{ steps.runtime.outputs.node }}-${{ hashFiles('config/patches/xterm-upstream.json', 'config/scripts/regenerate-xterm-patches.mjs', 'config/scripts/xterm-patch-text.mjs', '.github/actions/prepare-xterm-dependencies/action.yml') }}
+    - name: Restore download cache on an installed-dependency miss
+      if: steps.restore.outputs.cache-hit != 'true'
+      uses: actions/cache/restore@v5
+      with:
+        path: |
+          ~/.npm
+          ${{ runner.temp }}/xterm-patch-build/upstream/.git
+        key: xterm-upstream-${{ hashFiles('config/patches/xterm-upstream.json') }}
diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md
index 9d7a73a6b88a..326de25e1531 100644
--- a/.github/pull_request_template.md
+++ b/.github/pull_request_template.md
@@ -12,7 +12,8 @@
 
 ## Linked Issue
 
-<!-- Link the issue this PR addresses, there should ALWAYS be one -->
+<!-- Link the issue this PR addresses, there should ALWAYS be one (for outside contributors) -->
+<!-- SPECIAL CASE: If you are a maintainer (member of stablyai org) AVOID opening needless issues. Only attach pre-existing ones -->
 
 Fixes #
 
diff --git a/.github/workflows/bun-profile-tests.yml b/.github/workflows/bun-profile-tests.yml
new file mode 100644
index 000000000000..5fae18f2f84e
--- /dev/null
+++ b/.github/workflows/bun-profile-tests.yml
@@ -0,0 +1,149 @@
+name: Bun profile persistence
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+    paths:
+      - 'src/**'
+      - 'config/**'
+      - 'native/**'
+      - 'tests/**'
+      - 'resources/**'
+      - 'package.json'
+      - 'pnpm-lock.yaml'
+      - 'pnpm-workspace.yaml'
+      - 'tsconfig.json'
+      - '.npmrc'
+      - '.pnpmfile.cjs'
+      - '.github/actions/install-node-dependencies/**'
+      - '.github/workflows/bun-profile-tests.yml'
+  workflow_dispatch:
+  schedule:
+    - cron: '30 11 * * *'
+
+permissions:
+  contents: read
+
+concurrency:
+  group: bun-profile-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  changes:
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    outputs:
+      should_run: ${{ steps.scope.outputs.should_run }}
+      qualification: ${{ steps.scope.outputs.qualification }}
+      runners: ${{ steps.scope.outputs.runners }}
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 2
+          persist-credentials: false
+      - uses: ./.github/actions/install-node-dependencies
+      - name: Detect Bun build and test inputs
+        id: scope
+        shell: bash
+        run: |
+          # Compare the tested merge with its base, retaining both sides of renames.
+          if git diff --name-only --no-renames -z HEAD^1 HEAD > "$RUNNER_TEMP/bun-changes"; then
+            node config/scripts/bun-profile-change-scope.mjs "$RUNNER_TEMP/bun-changes"
+          else
+            echo 'should_run=true' >> "$GITHUB_OUTPUT"
+          fi
+
+  persistence:
+    needs: changes
+    # Missing/failed detection runs the full matrix; manual runs remain unconditional.
+    if: ${{ !cancelled() && needs.changes.outputs.should_run != 'false' }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: ${{ fromJSON(needs.changes.outputs.runners || '["ubuntu-22.04","ubuntu-24.04-arm","macos-14","macos-15-intel","windows-2022","windows-11-arm"]') }}
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 20
+    env:
+      ORCA_BACKGROUND_LAUNCH: '1'
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/install-node-dependencies
+        with:
+          native-runtime: ${{ runner.os == 'Windows' && 'node' || 'none' }}
+      # build:orcad reuses the host addon validated by native-runtime preparation.
+      - run: pnpm build:orcad
+      - run: pnpm test:bun:profile --artifact
+      - uses: actions/setup-node@v6
+        if: runner.arch == 'X64'
+        with:
+          node-version: '18'
+      - name: Verify Node 18 loads and hands off to bundled Bun
+        if: runner.arch == 'X64'
+        run: |
+          node out/orcad/orcad.js --orcad-smoke-load-check
+          node out/orcad/orcad.js --orcad-profile-state-preflight 00000000-0000-4000-8000-000000000018
+
+  linux_glibc_floor:
+    needs: [changes, persistence]
+    # A failed smoke already blocks qualification; missing scope still selects every platform.
+    if: >-
+      ${{ !cancelled() && needs.persistence.result == 'success' &&
+      needs.changes.outputs.should_run != 'false' &&
+      needs.changes.outputs.qualification != 'false' }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-22.04, ubuntu-24.04-arm]
+    runs-on: ${{ matrix.os }}
+    container: ubuntu:20.04
+    timeout-minutes: 20
+    env:
+      ORCA_BACKGROUND_LAUNCH: '1'
+    steps:
+      - name: Install Ubuntu 20.04 prerequisites
+        run: apt-get update && apt-get install -y build-essential ca-certificates git python3 unzip
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+      - name: Trust the checked-out workspace
+        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
+      - uses: ./.github/actions/install-node-dependencies
+      - run: pnpm build:orcad
+      - run: pnpm test:bun:profile --artifact
+
+  linux_musl:
+    needs: [changes, persistence]
+    # A failed smoke already blocks qualification; missing scope still selects every platform.
+    if: >-
+      ${{ !cancelled() && needs.persistence.result == 'success' &&
+      needs.changes.outputs.should_run != 'false' &&
+      needs.changes.outputs.qualification != 'false' }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-22.04, ubuntu-24.04-arm]
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 20
+    env:
+      ORCA_BACKGROUND_LAUNCH: '1'
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+      - name: Verify native Alpine artifact and persistence
+        run: |
+          docker run --rm --init -i \
+            -e ORCA_BACKGROUND_LAUNCH=1 \
+            -v "$GITHUB_WORKSPACE:/work" -w /work \
+            node:24-alpine3.23 sh -s <<'BUN_QUALIFICATION'
+          set -eu
+          apk add --no-cache bash git libstdc++ python3 make g++
+          git config --global --add safe.directory /work
+          npm install -g "$(node -p "require('./package.json').packageManager.split('+')[0]")"
+          pnpm install --frozen-lockfile --ignore-scripts
+          pnpm build:orcad
+          pnpm test:bun:profile --artifact
+          BUN_QUALIFICATION
diff --git a/.github/workflows/ci-cache-warmup.yml b/.github/workflows/ci-cache-warmup.yml
new file mode 100644
index 000000000000..7309f7e39123
--- /dev/null
+++ b/.github/workflows/ci-cache-warmup.yml
@@ -0,0 +1,131 @@
+name: Warm shared CI caches
+
+on:
+  schedule:
+    - cron: '41 * * * *'
+  workflow_dispatch:
+  push:
+    branches: [main]
+    paths:
+      - '.github/workflows/ci-cache-warmup.yml'
+      - '.github/actions/install-node-dependencies/**'
+      - '.github/actions/prepare-git-compatibility/**'
+      - '.github/actions/prepare-linux-package-fixture/**'
+      - 'config/docker/headless-serve-shutdown/**'
+      - 'config/docker/cli-launch-contract/**'
+      - 'package.json'
+      - 'pnpm-lock.yaml'
+      - 'pnpm-workspace.yaml'
+      - 'config/tsconfig*.json'
+      - 'config/scripts/ensure-native-runtime.mjs'
+      - 'config/scripts/rebuild-native-deps.mjs'
+      - 'config/patches/node-pty@1.1.0.patch'
+      - 'config/patches/@vscode__windows-process-tree@0.8.0.patch'
+      - 'native/windows-registry/**'
+  pull_request:
+    paths:
+      - '.github/workflows/ci-cache-warmup.yml'
+      - '.github/actions/prepare-git-compatibility/**'
+      - '.github/actions/prepare-linux-package-fixture/**'
+      - 'config/docker/headless-serve-shutdown/**'
+      - 'config/docker/cli-launch-contract/**'
+      - 'config/scripts/ci-cache-warmup-workflow.test.mjs'
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-cache-warmup-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  warm:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    env:
+      ORCA_BACKGROUND_LAUNCH: '1'
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+
+      # Default-branch caches can be restored by every PR; PR caches cannot.
+      - uses: ./.github/actions/install-node-dependencies
+        with:
+          native-runtime: node
+          node-version: '24'
+          cache-electron-package: 'true'
+
+      - name: Populate shared Electron archive
+        run: node config/scripts/install-electron-package-binary.mjs
+
+      - uses: ./.github/actions/prepare-git-compatibility
+
+      - name: Cache TypeScript incremental state
+        id: typecheck-cache
+        uses: actions/cache@v5
+        with:
+          path: config/*.tsbuildinfo
+          key: tsbuildinfo-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml', 'config/tsconfig*.json') }}-${{ github.sha }}
+          restore-keys: |
+            tsbuildinfo-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml', 'config/tsconfig*.json') }}-
+
+      - name: Refresh TypeScript state for this commit
+        if: steps.typecheck-cache.outputs.cache-hit != 'true'
+        run: pnpm run typecheck
+
+  warm-linux-arm:
+    runs-on: ubuntu-24.04-arm
+    timeout-minutes: 10
+    env:
+      ORCA_BACKGROUND_LAUNCH: '1'
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/install-node-dependencies
+        with:
+          native-runtime: node
+          node-version: '24'
+          cache-electron-package: 'true'
+      - name: Populate shared Electron archive
+        run: node config/scripts/install-electron-package-binary.mjs
+      - name: Verify native cache is usable
+        run: node config/scripts/ensure-native-runtime.mjs --check-only
+
+  warm-windows:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [windows-2022, windows-11-arm]
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 20
+    env:
+      ORCA_BACKGROUND_LAUNCH: '1'
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/install-node-dependencies
+        with:
+          native-runtime: node
+      - name: Verify native cache is usable
+        run: node config/scripts/ensure-native-runtime.mjs --check-only
+
+  warm-linux-package-fixtures:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    env:
+      ORCA_BACKGROUND_LAUNCH: '1'
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/prepare-linux-package-fixture
+        with:
+          fixture: headless-serve-shutdown
+          save-cache: ${{ github.event_name != 'pull_request' }}
+      - uses: ./.github/actions/prepare-linux-package-fixture
+        with:
+          fixture: cli-launch-contract
+          save-cache: ${{ github.event_name != 'pull_request' }}
diff --git a/.github/workflows/ci-closed-pr-caches.yml b/.github/workflows/ci-closed-pr-caches.yml
new file mode 100644
index 000000000000..38cf5803a146
--- /dev/null
+++ b/.github/workflows/ci-closed-pr-caches.yml
@@ -0,0 +1,33 @@
+name: Clean closed PR caches
+
+on:
+  pull_request_target:
+    types: [closed]
+
+permissions:
+  actions: write
+
+jobs:
+  clean:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      # No checkout: this runs trusted default-branch code, including for fork PRs.
+      - uses: actions/github-script@v8
+        with:
+          script: |
+            const ref = `refs/pull/${context.payload.pull_request.number}/merge`
+            const caches = await github.paginate(github.rest.actions.getActionsCacheList, {
+              ...context.repo, ref, per_page: 100
+            })
+            for (const cache of caches) {
+              if (cache.ref !== ref) throw new Error(`Unexpected cache ref: ${cache.ref}`)
+              try {
+                await github.rest.actions.deleteActionsCacheById({
+                  ...context.repo, cache_id: cache.id
+                })
+              } catch (error) {
+                if (error.status !== 404) throw error
+              }
+            }
+            core.info(`Removed ${caches.length} caches scoped to ${ref}`)
diff --git a/.github/workflows/ci-pnpm-verification-pilot.yml b/.github/workflows/ci-pnpm-verification-pilot.yml
new file mode 100644
index 000000000000..2a35a52fcd0e
--- /dev/null
+++ b/.github/workflows/ci-pnpm-verification-pilot.yml
@@ -0,0 +1,65 @@
+name: pnpm verification cache pilot
+
+on:
+  pull_request:
+    paths: ['.github/workflows/ci-pnpm-verification-pilot.yml']
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: pnpm-verification-pilot-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+env:
+  ORCA_BACKGROUND_LAUNCH: '1'
+
+jobs:
+  seed:
+    strategy:
+      matrix:
+        runner: [ubuntu-latest, ubuntu-24.04-arm]
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/install-node-dependencies
+        id: deps
+      # PR caches are scoped to the PR merge ref; main never restores them.
+      - uses: actions/cache/save@v5
+        if: steps.deps.outputs.verification-cache-hit != 'true'
+        with:
+          path: ${{ steps.deps.outputs.verification-cache-path }}
+          key: ${{ steps.deps.outputs.verification-cache-key }}
+
+  measure:
+    needs: seed
+    name: measure ${{ matrix.runner }} sample ${{ matrix.sample }} cache ${{ matrix.cache }}
+    strategy:
+      fail-fast: false
+      max-parallel: 4
+      matrix:
+        runner: [ubuntu-latest, ubuntu-24.04-arm]
+        sample: [1, 2, 3]
+        cache: ['false', 'true']
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/install-node-dependencies
+        id: deps
+        with:
+          cache-pnpm-verification: ${{ matrix.cache }}
+      - name: Validate treatment and frozen install
+        env:
+          CACHE_ENABLED: ${{ matrix.cache }}
+          CACHE_HIT: ${{ steps.deps.outputs.verification-cache-hit }}
+        run: |
+          if [ "$CACHE_ENABLED" = true ]; then test "$CACHE_HIT" = true; fi
+          git diff --exit-code -- package.json pnpm-lock.yaml pnpm-workspace.yaml
+          node -e "require.resolve('vitest'); require.resolve('electron')"
diff --git a/.github/workflows/ci-runner-demand.yml b/.github/workflows/ci-runner-demand.yml
new file mode 100644
index 000000000000..966813a65e40
--- /dev/null
+++ b/.github/workflows/ci-runner-demand.yml
@@ -0,0 +1,33 @@
+name: CI runner demand
+
+on:
+  schedule:
+    - cron: '23 4 * * *'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  actions: read
+
+concurrency:
+  group: ci-runner-demand
+  cancel-in-progress: false
+
+jobs:
+  report:
+    runs-on: ubuntu-slim
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          sparse-checkout: config/scripts
+          persist-credentials: false
+      - name: Measure the previous complete 24 hours
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: node config/scripts/ci-runner-demand.mjs
+      - uses: actions/upload-artifact@v7
+        with:
+          name: ci-runner-demand-${{ github.run_id }}
+          path: ci-demand/
+          retention-days: 30
diff --git a/.github/workflows/ci-xterm-cache.yml b/.github/workflows/ci-xterm-cache.yml
new file mode 100644
index 000000000000..fada7ea8cab4
--- /dev/null
+++ b/.github/workflows/ci-xterm-cache.yml
@@ -0,0 +1,55 @@
+name: Shared xterm dependency cache
+on:
+  push:
+    branches: [main]
+    paths:
+      - '.github/workflows/ci-xterm-cache.yml'
+      - '.github/actions/prepare-xterm-dependencies/**'
+      - 'config/patches/xterm-upstream.json'
+      - 'config/scripts/regenerate-xterm-patches.mjs'
+      - 'config/scripts/xterm-patch-text.mjs'
+      - 'package.json'
+  # Refresh after Node patch releases or cache eviction without rebuilding on hits.
+  schedule:
+    - cron: '17 5 * * *'
+  workflow_dispatch:
+permissions:
+  contents: read
+concurrency:
+  group: xterm-cache-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+env:
+  ORCA_BACKGROUND_LAUNCH: '1'
+jobs:
+  seed:
+    if: github.ref == 'refs/heads/main'
+    runs-on: ubuntu-24.04-arm
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@v6
+        with:
+          node-version-file: package.json
+          package-manager-cache: false
+      - uses: ./.github/actions/prepare-xterm-dependencies
+        id: cache
+      - name: Verify and populate dependencies
+        if: steps.cache.outputs.cache-hit != 'true'
+        run: node config/scripts/regenerate-xterm-patches.mjs --check --work-dir="$RUNNER_TEMP/xterm-patch-build"
+      - uses: actions/cache/save@v5
+        if: steps.cache.outputs.cache-hit != 'true'
+        with:
+          path: |
+            ${{ runner.temp }}/xterm-patch-build/upstream/.git
+            ${{ runner.temp }}/xterm-patch-build/upstream/node_modules
+          key: ${{ steps.cache.outputs.cache-key }}
+      - name: Preserve fallback downloads
+        if: steps.cache.outputs.cache-hit != 'true'
+        uses: actions/cache/save@v5
+        with:
+          path: |
+            ~/.npm
+            ${{ runner.temp }}/xterm-patch-build/upstream/.git
+          key: xterm-upstream-${{ hashFiles('config/patches/xterm-upstream.json') }}
diff --git a/.github/workflows/cloud-verify.yml b/.github/workflows/cloud-verify.yml
index 6191552dab9a..6c4cb9a53a12 100644
--- a/.github/workflows/cloud-verify.yml
+++ b/.github/workflows/cloud-verify.yml
@@ -32,9 +32,30 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with:
-          fetch-depth: 0
+          fetch-depth: 1
+
+      - name: Pull Gitleaks image
+        id: gitleaks-image
+        background: true
+        run: docker pull zricethezav/gitleaks@sha256:cdbb7c955abce02001a9f6c9f602fb195b7fadc1e812065883f695d1eeaba854
+
+      - name: Pull TruffleHog image
+        id: trufflehog-image
+        background: true
+        run: docker pull trufflesecurity/trufflehog@sha256:5dc064868ba7933601b5cbaea6954954d524ddd5dc6222a9667acea70068bf7d
+
+      # Scan every ancestor of HEAD without downloading unrelated branch/tag histories.
+      - name: Fetch complete scan history
+        working-directory: .
+        run: |
+          git fetch --no-tags --unshallow origin "$GITHUB_SHA"
+          test "$(git rev-parse --is-shallow-repository)" = false
+
+      - wait: [gitleaks-image, trufflehog-image]
 
       - name: Scan Cloud history reachable from HEAD with Gitleaks
+        id: history-scan
+        background: true
         run: >-
           docker run --rm
           --volume "${GITHUB_WORKSPACE}:/repo:ro"
@@ -51,6 +72,8 @@ jobs:
           --include-paths=/repo/cloud/.trufflehog-include-paths.txt
           --exclude-paths=/repo/cloud/.trufflehog-exclude-paths.txt
 
+      - wait: history-scan
+
   # Compiles the workspace. No Postgres service: nothing here reaches a
   # database, and the service container costs ~13s of startup.
   build:
diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
index f42d1184ce93..4177b141d8a4 100644
--- a/.github/workflows/e2e.yml
+++ b/.github/workflows/e2e.yml
@@ -32,9 +32,8 @@ on:
         required: false
         type: string
   schedule:
-    # Why: GitHub cron uses UTC; these slots map to 10am and 3pm
-    # America/Phoenix for the default-branch E2E run.
-    - cron: '0 17,22 * * *'
+    # One complete daily reference run; targeted PR coverage remains unchanged.
+    - cron: '0 17 * * *'
 
 jobs:
   build:
@@ -62,11 +61,26 @@ jobs:
           status=0
           pnpm run build:relay &
           relay_pid=$!
-          npx electron-vite build --mode e2e || status=1
-          pnpm run build:web-from-renderer || status=1
+          pnpm run build:electron-vite:parallel --mode e2e || status=1
           wait "$relay_pid" || status=1
           exit "$status"
 
+      # The CLI emits into out/main too; start only after Electron finishes clearing that tree.
+      - name: Build shared E2E CLI
+        id: e2e-cli
+        background: true
+        run: |
+          if node -e 'process.exit(require("./package.json").scripts["prepare:cli-output"] ? 0 : 1)'; then
+            pnpm run build:cli
+          else
+            echo "Older ref: let each consumer build and install its CLI."
+          fi
+
+      - name: Project shared E2E web client
+        run: pnpm run build:web-from-renderer
+
+      - wait: e2e-cli
+
       - name: Upload E2E build output
         uses: actions/upload-artifact@v7
         with:
@@ -186,7 +200,14 @@ jobs:
           node config/scripts/ci-e2e-shard-plan.mjs --verify ci-shards/assignment.json ci-shards/selected-discovery.json
 
       - name: Run E2E tests (${{ matrix.shard_name }})
-        run: xvfb-run --auto-servernum bash .github/scripts/e2e-with-window-manager.sh env SKIP_BUILD=1 ORCA_E2E_FORWARD_APP_LOGS=1 ORCA_E2E_WEB_CLIENT=1 ORCA_RELAY_PATH="$GITHUB_WORKSPACE/out/relay" pnpm run test:e2e --test-list=ci-shards/selected.txt
+        env:
+          PLAYWRIGHT_JSON_OUTPUT_FILE: ci-shards/results.json
+        run: xvfb-run --auto-servernum bash .github/scripts/e2e-with-window-manager.sh env SKIP_BUILD=1 ORCA_E2E_FORWARD_APP_LOGS=1 ORCA_E2E_WEB_CLIENT=1 ORCA_RELAY_PATH="$GITHUB_WORKSPACE/out/relay" pnpm run test:e2e --test-list=ci-shards/selected.txt --reporter=list,json
+
+      - name: Summarize E2E failures
+        if: always()
+        continue-on-error: true
+        run: node config/scripts/ci-e2e-failure-summary.mjs ci-shards/results.json
 
       - name: Upload E2E shard assignment
         if: always()
@@ -221,8 +242,6 @@ jobs:
     needs: [build, prepare-native-cache]
     if: inputs.test_files != ''
     runs-on: ubuntu-latest
-    # Why 45: pr.yml now maps SSH source edits onto Docker-backed specs, so this lane can
-    # pay a container image build plus ~22 serial SSH tests on top of the changed specs.
     timeout-minutes: 45
 
     steps:
@@ -256,14 +275,38 @@ jobs:
           # ORCA_E2E_NATIVE_IBUS_HANGUL, which this lane cannot set because it has no ibus
           # session. Running it here reported a green skip as coverage.
           mapfile -t TEST_FILES < <(jq -r '.[] | select(
+            . != "tests/e2e/local-ssh-browser-routing.spec.ts" and
+            . != "tests/e2e/ssh-client-hosted-browser-drop-reconnect.spec.ts" and
+            . != "tests/e2e/pty-input-write-queue-ssh.spec.ts" and
+            . != "tests/e2e/ssh-ai-vault-session-history.spec.ts" and
+            . != "tests/e2e/ssh-codex-display-artifacts-repro.spec.ts" and
+            . != "tests/e2e/ssh-cold-activation-restore.spec.ts" and
+            . != "tests/e2e/ssh-cold-hydration-gap-tab-seeding.spec.ts" and
+            . != "tests/e2e/ssh-docker-five-pane-input-under-flood.spec.ts" and
+            . != "tests/e2e/ssh-docker-bulk-open-freeze-repro.spec.ts" and
+            . != "tests/e2e/ssh-docker-half-open-link.spec.ts" and
+            . != "tests/e2e/ssh-docker-quick-open-large-listing.spec.ts" and
+            . != "tests/e2e/ssh-docker-reconnect-pane-restore.spec.ts" and
+            . != "tests/e2e/ssh-docker-relay-stall-credential.spec.ts" and
+            . != "tests/e2e/ssh-docker-resource-accumulation.spec.ts" and
+            . != "tests/e2e/ssh-docker-transport-drop-recovery.spec.ts" and
+            . != "tests/e2e/ssh-external-image-preview.spec.ts" and
+            . != "tests/e2e/ssh-lost-kill-tab-resurrection.spec.ts" and
+            . != "tests/e2e/ssh-pi-compatible-agent-title.spec.ts" and
+            . != "tests/e2e/ssh-port-forward-lifecycle.spec.ts" and
+            . != "tests/e2e/ssh-reconnect-tab-destruction.spec.ts" and
+            . != "tests/e2e/ssh-restart-tab-accumulation.spec.ts" and
+            . != "tests/e2e/ssh-skill-installation.spec.ts" and
+            . != "tests/e2e/ssh-stale-resume-execution-host-scope.spec.ts" and
+            . != "tests/e2e/ssh-terminal-window-wake-stale-grid-repro.spec.ts" and
+            . != "tests/e2e/terminal-inline-images-ssh.spec.ts" and
+            . != "tests/e2e/ssh-docker-watcher-isolation.spec.ts" and
+            . != "tests/e2e/ssh-terminal-parking.spec.ts" and
+            . != "tests/e2e/terminal-retention-budget.spec.ts" and
             . != "tests/e2e/ssh-startup-exec-readiness.spec.ts" and
             . != "tests/e2e/paired-startup-exec-readiness.spec.ts" and
-            . != "tests/e2e/ssh-docker-five-pane-input-under-flood.spec.ts" and
-            . != "tests/e2e/local-ssh-browser-routing.spec.ts" and
             . != "tests/e2e/ssh-browser-network-execution-route.docker.unit.test.ts" and
             . != "tests/e2e/ssh-localhost.spec.ts" and
-            . != "tests/e2e/ssh-client-hosted-browser-drop-reconnect.spec.ts" and
-            . != "tests/e2e/ssh-docker-bulk-open-freeze-repro.spec.ts" and
             . != "tests/e2e/terminal-ibus-hangul-native.spec.ts"
           )' <<<"$TEST_FILES_JSON")
           if [ "${#TEST_FILES[@]}" -eq 0 ]; then
@@ -295,25 +338,47 @@ jobs:
           if-no-files-found: ignore
 
   ssh-docker-watcher-isolation:
-    name: ssh docker watcher isolation
+    name: ssh docker watcher isolation (${{ matrix.shard }}/4)
     needs: [build, prepare-native-cache]
-    # effect of one route listing a startup-readiness spec — pruning that spec would have
-    # silently retired the whole lane. The signal is now derived from the SSH routes directly.
-    # The explicit spec clauses stay for their honest purpose: changed-e2e hands these specs to this
-    # lane, so editing one must still run it here.
+    # Each excluded changed spec must trigger its dedicated owner.
     if: >-
       inputs.test_files == '' ||
       inputs.ssh_source_changed == 'true' ||
-      contains(inputs.test_files, 'tests/e2e/ssh-docker-five-pane-input-under-flood.spec.ts') ||
       contains(inputs.test_files, 'tests/e2e/local-ssh-browser-routing.spec.ts') ||
       contains(inputs.test_files, 'tests/e2e/ssh-client-hosted-browser-drop-reconnect.spec.ts') ||
-      contains(inputs.test_files, 'tests/e2e/ssh-startup-exec-readiness.spec.ts') ||
+      contains(inputs.test_files, 'tests/e2e/pty-input-write-queue-ssh.spec.ts') ||
+      contains(inputs.test_files, 'tests/e2e/ssh-ai-vault-session-history.spec.ts') ||
+      contains(inputs.test_files, 'tests/e2e/ssh-codex-display-artifacts-repro.spec.ts') ||
+      contains(inputs.test_files, 'tests/e2e/ssh-cold-activation-restore.spec.ts') ||
+      contains(inputs.test_files, 'tests/e2e/ssh-cold-hydration-gap-tab-seeding.spec.ts') ||
+      contains(inputs.test_files, 'tests/e2e/ssh-docker-five-pane-input-under-flood.spec.ts') ||
       contains(inputs.test_files, 'tests/e2e/ssh-docker-bulk-open-freeze-repro.spec.ts') ||
+      contains(inputs.test_files, 'tests/e2e/ssh-docker-half-open-link.spec.ts') ||
+      contains(inputs.test_files, 'tests/e2e/ssh-docker-quick-open-large-listing.spec.ts') ||
+      contains(inputs.test_files, 'tests/e2e/ssh-docker-reconnect-pane-restore.spec.ts') ||
+      contains(inputs.test_files, 'tests/e2e/ssh-docker-relay-stall-credential.spec.ts') ||
+      contains(inputs.test_files, 'tests/e2e/ssh-docker-resource-accumulation.spec.ts') ||
+      contains(inputs.test_files, 'tests/e2e/ssh-docker-transport-drop-recovery.spec.ts') ||
+      contains(inputs.test_files, 'tests/e2e/ssh-external-image-preview.spec.ts') ||
+      contains(inputs.test_files, 'tests/e2e/ssh-lost-kill-tab-resurrection.spec.ts') ||
+      contains(inputs.test_files, 'tests/e2e/ssh-pi-compatible-agent-title.spec.ts') ||
+      contains(inputs.test_files, 'tests/e2e/ssh-port-forward-lifecycle.spec.ts') ||
+      contains(inputs.test_files, 'tests/e2e/ssh-reconnect-tab-destruction.spec.ts') ||
+      contains(inputs.test_files, 'tests/e2e/ssh-restart-tab-accumulation.spec.ts') ||
+      contains(inputs.test_files, 'tests/e2e/ssh-skill-installation.spec.ts') ||
+      contains(inputs.test_files, 'tests/e2e/ssh-stale-resume-execution-host-scope.spec.ts') ||
+      contains(inputs.test_files, 'tests/e2e/ssh-terminal-window-wake-stale-grid-repro.spec.ts') ||
+      contains(inputs.test_files, 'tests/e2e/terminal-inline-images-ssh.spec.ts') ||
+      contains(inputs.test_files, 'tests/e2e/ssh-docker-watcher-isolation.spec.ts') ||
+      contains(inputs.test_files, 'tests/e2e/ssh-terminal-parking.spec.ts') ||
+      contains(inputs.test_files, 'tests/e2e/terminal-retention-budget.spec.ts') ||
+      contains(inputs.test_files, 'tests/e2e/ssh-startup-exec-readiness.spec.ts') ||
       contains(inputs.test_files, 'tests/e2e/paired-startup-exec-readiness.spec.ts')
     runs-on: ubuntu-latest
-    # Why 60: this lane now also runs the remaining Docker-SSH specs serially. They average
-    # ~18s but several budget 4-10 minutes per test, so a slow run lands far above the old 35
-    # — and the sharded lanes already show that a lane which times out is a lane nobody trusts.
+    strategy:
+      fail-fast: false
+      matrix:
+        shard: [1, 2, 3, 4]
     timeout-minutes: 60
 
     steps:
@@ -338,13 +403,14 @@ jobs:
       # Why: this is the release-path proof that the deployed Linux relay keeps
       # its PTY and explorer live across a real watcher SIGSEGV.
       - name: Run Docker SSH watcher isolation E2E
+        if: matrix.shard == 1
         run: xvfb-run --auto-servernum bash .github/scripts/e2e-with-window-manager.sh env SKIP_BUILD=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm run test:e2e:ssh-docker-watcher-isolation
 
       # Why: Playwright empties test-results/ when it starts, so each step here used to
       # destroy the previous step's traces. Only the last lane's failure was ever
       # diagnosable from the artifact; set each lane aside before the next one runs.
       - name: Keep watcher-isolation traces
-        if: always()
+        if: always() && matrix.shard == 1
         run: |
           if [ -d test-results ]; then
             mkdir -p e2e-traces
@@ -354,24 +420,21 @@ jobs:
       # Why always(): this lane gates SSH parking/retention plus startup-exec
       # readiness across live SSH, headed paired, and headless serve topologies.
       - name: Run Docker SSH terminal parking + startup readiness E2E
-        if: always()
+        if: always() && matrix.shard == 1
         run: xvfb-run --auto-servernum bash .github/scripts/e2e-with-window-manager.sh env SKIP_BUILD=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm run test:e2e:ssh-docker-terminal-parking
 
       - name: Keep terminal-parking traces
-        if: always()
+        if: always() && matrix.shard == 1
         run: |
           if [ -d test-results ]; then
             mkdir -p e2e-traces
             mv test-results "e2e-traces/terminal-parking"
           fi
 
-      # Why here rather than the sharded lanes: the shards set no ORCA_E2E_SSH_DOCKER, so every
-      # spec below skipped itself while the shard still reported green. Running them on this one
-      # VM pays the fixture image build once instead of ten times, and keeps an SSH regression
-      # legible as an SSH-named failure.
+      # Separate VMs isolate destructive SSH fixtures while keeping one worker per shard.
       - name: Run remaining Docker SSH E2E
         if: always()
-        run: xvfb-run --auto-servernum bash .github/scripts/e2e-with-window-manager.sh env SKIP_BUILD=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm run test:e2e:ssh-docker
+        run: xvfb-run --auto-servernum bash .github/scripts/e2e-with-window-manager.sh env SKIP_BUILD=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm run test:e2e:ssh-docker --shard=${{ matrix.shard }}/4
 
       - name: Keep remaining-ssh-docker traces
         if: always()
@@ -385,7 +448,7 @@ jobs:
         if: failure()
         uses: actions/upload-artifact@v7
         with:
-          name: playwright-traces-ssh-docker-watcher-isolation
+          name: playwright-traces-ssh-docker-watcher-isolation-${{ matrix.shard }}
           path: e2e-traces/
           retention-days: 7
           if-no-files-found: ignore
diff --git a/.github/workflows/git-command-termination-runtime.yml b/.github/workflows/git-command-termination-runtime.yml
index 1602bae956a9..6b49177ed560 100644
--- a/.github/workflows/git-command-termination-runtime.yml
+++ b/.github/workflows/git-command-termination-runtime.yml
@@ -7,6 +7,9 @@ on:
   workflow_dispatch:
 permissions:
   contents: read
+concurrency:
+  group: git-command-termination-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 jobs:
   windows-exit:
     runs-on: windows-latest
diff --git a/.github/workflows/golden-e2e-experiment.yml b/.github/workflows/golden-e2e-experiment.yml
index 11cfa866c676..0b80662d7166 100644
--- a/.github/workflows/golden-e2e-experiment.yml
+++ b/.github/workflows/golden-e2e-experiment.yml
@@ -66,10 +66,10 @@ jobs:
       - name: Run golden E2E tests on Linux
         if: runner.os == 'Linux'
         run: |
-          xvfb-run --auto-servernum env SKIP_BUILD=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm run test:e2e -- tests/e2e/golden-core-flows.spec.ts
+          xvfb-run --auto-servernum env SKIP_BUILD=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm run test:e2e tests/e2e/golden-core-flows.spec.ts
           xvfb-run --auto-servernum env SKIP_BUILD=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm run --if-present test:e2e:workspace-session-golden
           if [ -f tests/e2e/golden-fresh-profile-terminal.spec.ts ]; then
-            xvfb-run --auto-servernum env SKIP_BUILD=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm run test:e2e -- tests/e2e/golden-fresh-profile-terminal.spec.ts tests/e2e/golden-shell-command.spec.ts
+            xvfb-run --auto-servernum env SKIP_BUILD=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm run test:e2e tests/e2e/golden-fresh-profile-terminal.spec.ts tests/e2e/golden-shell-command.spec.ts
           fi
           xvfb-run --auto-servernum env SKIP_BUILD=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm run test:e2e:terminal-rendering-golden
           xvfb-run --auto-servernum env SKIP_BUILD=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm run --if-present test:e2e:posix-profile-index-golden
@@ -80,10 +80,10 @@ jobs:
       - name: Run golden E2E tests on macOS
         if: runner.os == 'macOS'
         run: |
-          env SKIP_BUILD=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm run test:e2e -- tests/e2e/golden-core-flows.spec.ts
+          env SKIP_BUILD=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm run test:e2e tests/e2e/golden-core-flows.spec.ts
           env SKIP_BUILD=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm run --if-present test:e2e:workspace-session-golden
           if [ -f tests/e2e/golden-fresh-profile-terminal.spec.ts ]; then
-            env SKIP_BUILD=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm run test:e2e -- tests/e2e/golden-fresh-profile-terminal.spec.ts tests/e2e/golden-shell-command.spec.ts
+            env SKIP_BUILD=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm run test:e2e tests/e2e/golden-fresh-profile-terminal.spec.ts tests/e2e/golden-shell-command.spec.ts
           fi
           env SKIP_BUILD=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm run test:e2e:terminal-rendering-golden
           env SKIP_BUILD=1 ORCA_E2E_FORWARD_APP_LOGS=1 pnpm run --if-present test:e2e:posix-profile-index-golden
@@ -104,7 +104,7 @@ jobs:
           pnpm run --if-present test:e2e:tab-bar-agent-launch-golden
           if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
           if (Test-Path tests/e2e/golden-fresh-profile-terminal.spec.ts) {
-            pnpm run test:e2e -- tests/e2e/golden-fresh-profile-terminal.spec.ts tests/e2e/golden-shell-command.spec.ts
+            pnpm run test:e2e tests/e2e/golden-fresh-profile-terminal.spec.ts tests/e2e/golden-shell-command.spec.ts
             if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
           }
           pnpm run --if-present test:e2e:source-control-golden
diff --git a/.github/workflows/issue-os-labeler.yaml b/.github/workflows/issue-os-labeler.yaml
index c437db7f21a5..cf0ee59a8425 100644
--- a/.github/workflows/issue-os-labeler.yaml
+++ b/.github/workflows/issue-os-labeler.yaml
@@ -12,7 +12,7 @@ permissions:
 
 jobs:
   apply-os-label:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
     timeout-minutes: 5
     steps:
       - name: Apply OS label from issue form
diff --git a/.github/workflows/mobile.yml b/.github/workflows/mobile.yml
index aae50234bf94..7ec322b02036 100644
--- a/.github/workflows/mobile.yml
+++ b/.github/workflows/mobile.yml
@@ -6,7 +6,6 @@ on:
       - opened
       - synchronize
       - reopened
-      - ready_for_review
     paths:
       - 'mobile/**'
       # Mobile launch contracts exercise the real host dispatcher and durable receipt store.
@@ -38,6 +37,10 @@ on:
       - '.github/workflows/mobile.yml'
       - '.github/actions/install-node-dependencies/**'
       - '.github/workflows/mobile-ios-release.yml'
+      - 'config/scripts/mobile-release-check-scope*'
+      - 'config/scripts/mobile-test-change-scope*'
+      - 'config/scripts/pr-code-change-scope.mjs'
+      - 'config/scripts/mobile-recording-pin-checkout.test.mjs'
   # Why main too: a behaviour-change branch legitimately pins its own last fenced commit, and that
   # commit only stops being reachable when the branch squash-merges. The pull_request run cannot
   # see that; this one is where the pin guard finds it.
@@ -58,7 +61,10 @@ concurrency:
 jobs:
   verify:
     if: github.event_name == 'pull_request'
-    runs-on: ubuntu-latest
+    # Why ARM: 209s of this job is Vitest and nothing here needs x86: no Android SDK, emulator, gradle,
+    # Hermes or Watchman, no docker, and no artifacts. The Gemfile.lock lists the generic `ruby`
+    # platform, so frozen bundler installs without an aarch64-linux entry.
+    runs-on: ubuntu-24.04-arm
 
     env:
       # Why: an unfrozen bundler silently re-resolves when Gemfile.lock drifts
@@ -73,6 +79,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v6
+        with:
+          fetch-depth: 2
 
       - uses: ./.github/actions/install-node-dependencies
         with:
@@ -80,10 +88,23 @@ jobs:
             pnpm-lock.yaml
             mobile/pnpm-lock.yaml
 
+      - name: Detect Ruby release inputs
+        id: ruby-scope
+        shell: bash
+        working-directory: .
+        run: |
+          # Keep deletions when release files move into an application directory.
+          if ! git diff --name-only --no-renames -z HEAD^1 HEAD > "$RUNNER_TEMP/mobile-release-changes"; then
+            echo 'should_run=true' >> "$GITHUB_OUTPUT"
+          elif ! node config/scripts/mobile-release-check-scope.mjs "$RUNNER_TEMP/mobile-release-changes"; then
+            echo 'should_run=true' >> "$GITHUB_OUTPUT"
+          fi
+
       # bundler-cache installs mobile/Gemfile.lock, so this job is also what
       # proves the pinned fastlane the release workflow depends on still
       # resolves — before a release run finds out.
       - name: Setup Ruby and fastlane
+        if: steps.ruby-scope.outputs.should_run != 'false'
         uses: ruby/setup-ruby@v1
         with:
           ruby-version: '3.3'
@@ -93,7 +114,10 @@ jobs:
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
+      # Both compilers are read-only; finish them before starting the test workers.
       - name: Typecheck
+        id: production-types
+        background: true
         run: pnpm typecheck
 
       # Why a ratchet and not the raw typecheck: mobile/tsconfig.json excludes test files, so until
@@ -103,19 +127,37 @@ jobs:
       - name: Typecheck tests (ratchet)
         run: pnpm run check:tests-typecheck
 
+      - wait: production-types
+
       # This includes the bridged replay of the whole recording corpus, which used to be a second
       # step of its own behind RPC_FOUNDATION_BRIDGE=1. A gate nobody can forget to set is the point:
       # it fails when a divergence class grows, when a divergence lands in no class at all, or when
       # one of the 103 goldens inside the C1 page closure changes the verdict it is pinned to. It is
       # ~3 min of test time on its own, and Vitest runs it on a worker beside the rest of the suite,
       # so folding it in costs a fraction of that in wall time and one step less to skip.
+      - name: Detect mobile test inputs
+        id: test-scope
+        shell: bash
+        working-directory: .
+        run: |
+          if ! git diff --name-only --no-renames -z HEAD^1 HEAD > "$RUNNER_TEMP/mobile-test-changes"; then
+            echo 'should_run=true' >> "$GITHUB_OUTPUT"
+          elif ! node config/scripts/mobile-test-change-scope.mjs "$RUNNER_TEMP/mobile-test-changes"; then
+            echo 'should_run=true' >> "$GITHUB_OUTPUT"
+          fi
+
       - name: Test
+        if: steps.test-scope.outputs.should_run != 'false'
+        env:
+          ORCA_BACKGROUND_LAUNCH: '1'
         run: pnpm test
 
       - name: Test iOS release version resolution
+        if: steps.ruby-scope.outputs.should_run != 'false'
         run: ruby fastlane/ios_release_version_test.rb
 
       - name: Test TestFlight lane arguments
+        if: steps.ruby-scope.outputs.should_run != 'false'
         run: ruby fastlane/fastfile_testflight_arguments_test.rb
 
       # Why: nothing else in CI loads the Fastfile, so a syntax error, a broken
@@ -124,6 +166,7 @@ jobs:
       # loads and lists, so it needs no App Store Connect credentials and makes
       # no network calls to Apple.
       - name: Smoke-check the Fastfile
+        if: steps.ruby-scope.outputs.should_run != 'false'
         env:
           FASTLANE_SKIP_UPDATE_CHECK: '1'
           FASTLANE_OPT_OUT_USAGE: '1'
@@ -137,7 +180,8 @@ jobs:
 
   recording-pin:
     name: RPC recording pin
-    runs-on: ubuntu-latest
+    # Why ARM: pure Node plus git; the golden comparison masks `platform`.
+    runs-on: ubuntu-24.04-arm
 
     defaults:
       run:
@@ -152,6 +196,8 @@ jobs:
           # answer at all rather than reporting a pass it has no evidence for -- and the pinned tree
           # below has to be checkable out.
           fetch-depth: 0
+          # Ancestry needs commits; the pinned worktree fetches its historical blobs on demand.
+          filter: blob:none
 
       - uses: ./.github/actions/install-node-dependencies
         with:
diff --git a/.github/workflows/node-next-compat.yml b/.github/workflows/node-next-compat.yml
index 43556c864dc1..cb0d303f8c5d 100644
--- a/.github/workflows/node-next-compat.yml
+++ b/.github/workflows/node-next-compat.yml
@@ -1,8 +1,8 @@
-name: Node next compatibility
+name: Scheduled x86 unit compatibility
 
 on:
   schedule:
-    # Full future-runtime coverage is useful, but not worth doubling every PR matrix.
+    # Keep current and future Node coverage on x86 while PR unit shards use ARM.
     - cron: '0 10 * * *'
   workflow_dispatch:
 
@@ -14,9 +14,13 @@ permissions:
   contents: read
 
 jobs:
-  # A cold cache would otherwise make all eight Node 26 shards compile the same native addons.
+  # Prime each Node ABI before its shards restore native modules.
   test_native_cache:
-    name: prepare test native cache node 26
+    name: prepare test native cache node ${{ matrix.node }}
+    strategy:
+      fail-fast: false
+      matrix:
+        node: ['24', '26']
     runs-on: ubuntu-latest
 
     steps:
@@ -28,10 +32,10 @@ jobs:
       - uses: ./.github/actions/install-node-dependencies
         with:
           native-runtime: node
-          node-version: '26'
+          node-version: ${{ matrix.node }}
 
   test:
     needs: [test_native_cache]
     uses: ./.github/workflows/unit-tests.yml
     with:
-      node_versions: '["26"]'
+      node_versions: '["24", "26"]'
diff --git a/.github/workflows/packaged-browser-e2e.yml b/.github/workflows/packaged-browser-e2e.yml
index 2a23ac58988c..7d36e7fd1b13 100644
--- a/.github/workflows/packaged-browser-e2e.yml
+++ b/.github/workflows/packaged-browser-e2e.yml
@@ -39,7 +39,11 @@ jobs:
           root=pathlib.Path(os.environ['RUNNER_TEMP'])/'old-orca'
           package=root/'orca-ide_1.4.188_amd64.deb'
           expected='uGONFUDfinYggxcT9ac72wnnlofLQaqasDDeP0HWOSqarBwTi1Ax3khmzKUY3vUnvuYOpSCEmsH4InzLZ2vg6g=='
-          assert base64.b64encode(hashlib.sha512(package.read_bytes()).digest()).decode()==expected
+          digest=hashlib.sha512()
+          with package.open('rb') as archive:
+              for block in iter(lambda: archive.read(1024*1024), b''):
+                  digest.update(block)
+          assert base64.b64encode(digest.digest()).decode()==expected
           extracted=root/'extracted'
           subprocess.run(['dpkg-deb','-x',str(package),str(extracted)],check=True)
           executable=extracted/'opt'/'Orca'/'orca-ide'
diff --git a/.github/workflows/pi-owner-runtime.yml b/.github/workflows/pi-owner-runtime.yml
index 9f9df4f9b0b5..592bc75bb5e8 100644
--- a/.github/workflows/pi-owner-runtime.yml
+++ b/.github/workflows/pi-owner-runtime.yml
@@ -9,6 +9,9 @@ on:
   workflow_dispatch:
 permissions:
   contents: read
+concurrency:
+  group: pi-owner-runtime-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 jobs:
   runtime:
     strategy:
diff --git a/.github/workflows/pi-provider-runtime.yml b/.github/workflows/pi-provider-runtime.yml
index 837c38baf9a8..310467374994 100644
--- a/.github/workflows/pi-provider-runtime.yml
+++ b/.github/workflows/pi-provider-runtime.yml
@@ -7,6 +7,9 @@ on:
       - '.github/workflows/pi-provider-runtime.yml'
 permissions:
   contents: read
+concurrency:
+  group: pi-provider-runtime-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 jobs:
   runtime:
     strategy:
diff --git a/.github/workflows/pr-test-loc.yml b/.github/workflows/pr-test-loc.yml
index a884aedc6361..340c6c7b70d1 100644
--- a/.github/workflows/pr-test-loc.yml
+++ b/.github/workflows/pr-test-loc.yml
@@ -6,7 +6,6 @@ on:
       - opened
       - synchronize
       - reopened
-      - ready_for_review
 
 concurrency:
   group: pr-test-loc-${{ github.event.pull_request.number }}
@@ -19,7 +18,8 @@ permissions:
 jobs:
   loc:
     name: test vs non-test LoC
-    runs-on: ubuntu-latest
+    # API calls and a small Node script fit the free single-CPU container runner.
+    runs-on: ubuntu-slim
     timeout-minutes: 2
     steps:
       # Why no checkout: the Files API already has per-file additions/deletions.
diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index 1b52aac7571d..27fc5215044d 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -1,4 +1,5 @@
 name: PR Checks
+run-name: "PR ${{ github.event.pull_request.number }} | source ${{ github.sha }} | workflow ${{ github.workflow_sha }} | unit ${{ github.event.pull_request.draft && vars.ORCA_UNIT_SELECTION_MODE == 'selected' && 'selected' || 'full' }}"
 
 on:
   pull_request:
@@ -23,25 +24,32 @@ jobs:
   # Per-job outputs also skip git-compat/xterm/packaging/shell when those
   # inputs are unchanged; empty diffs fail closed and run everything.
   code_paths:
-    name: detect code-relevant changes
-    runs-on: ubuntu-latest
+    name: detect changes and check repository guards
+    # Reuse one lightweight checkout for detection and the always-required guards.
+    runs-on: ubuntu-slim
+    timeout-minutes: 5
+    permissions:
+      contents: read
+      actions: read
     outputs:
       should_run: ${{ steps.filter.outputs.should_run }}
-      native_cache_changed: ${{ steps.filter.outputs.native_cache_changed }}
+      reused_run_id: ${{ steps.readiness.outputs.run_id }}
+      # A proven success masks required work only; advisory routing still uses the full diff.
+      native_cache_changed: ${{ steps.readiness.outputs.reused != 'true' && steps.filter.outputs.native_cache_changed }}
       mobile_dependencies: ${{ steps.filter.outputs.mobile_dependencies }}
-      mobile_web_app: ${{ steps.filter.outputs.mobile_web_app }}
-      static_analysis: ${{ steps.filter.outputs.static_analysis }}
-      typecheck: ${{ steps.filter.outputs.typecheck }}
-      git_compatibility: ${{ steps.filter.outputs.git_compatibility }}
-      codex_index_heal_contract: ${{ steps.filter.outputs.codex_index_heal_contract }}
-      xterm_patch_sync: ${{ steps.filter.outputs.xterm_patch_sync }}
-      shell_contracts: ${{ steps.filter.outputs.shell_contracts }}
-      test: ${{ steps.filter.outputs.test }}
-      orcad_browser: ${{ steps.filter.outputs.orcad_browser }}
-      cross-version-wire: ${{ steps.filter.outputs.cross-version-wire }}
-      managed_hook_node18: ${{ steps.filter.outputs.managed_hook_node18 }}
-      package: ${{ steps.filter.outputs.package }}
-      package_windows: ${{ steps.filter.outputs.package_windows }}
+      mobile_web_app: ${{ steps.readiness.outputs.reused != 'true' && steps.filter.outputs.mobile_web_app }}
+      static_analysis: ${{ steps.readiness.outputs.reused != 'true' && steps.filter.outputs.static_analysis }}
+      typecheck: ${{ steps.readiness.outputs.reused != 'true' && steps.filter.outputs.typecheck }}
+      git_compatibility: ${{ steps.readiness.outputs.reused != 'true' && steps.filter.outputs.git_compatibility }}
+      codex_index_heal_contract: ${{ steps.readiness.outputs.reused != 'true' && steps.filter.outputs.codex_index_heal_contract }}
+      xterm_patch_sync: ${{ steps.readiness.outputs.reused != 'true' && steps.filter.outputs.xterm_patch_sync }}
+      shell_contracts: ${{ steps.readiness.outputs.reused != 'true' && steps.filter.outputs.shell_contracts }}
+      test: ${{ steps.readiness.outputs.reused != 'true' && steps.filter.outputs.test }}
+      orcad_browser: ${{ steps.readiness.outputs.reused != 'true' && steps.filter.outputs.orcad_browser }}
+      cross-version-wire: ${{ steps.readiness.outputs.reused != 'true' && steps.filter.outputs.cross-version-wire }}
+      managed_hook_node18: ${{ steps.readiness.outputs.reused != 'true' && steps.filter.outputs.managed_hook_node18 }}
+      package: ${{ steps.readiness.outputs.reused != 'true' && steps.filter.outputs.package }}
+      package_windows: ${{ steps.readiness.outputs.reused != 'true' && steps.filter.outputs.package_windows }}
       e2e_should_run: ${{ steps.e2e_filter.outputs.should_run }}
       test_files: ${{ steps.e2e_filter.outputs.test_files }}
       ssh_source_changed: ${{ steps.e2e_filter.outputs.ssh_source_changed }}
@@ -51,23 +59,59 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v6
         with:
-          # Why blob:none: full history is needed for the merge-base diff, but historical
-          # file contents are not. Blobs are ~89% of this repo's pack, and Git fetches the
-          # few this job actually reads on demand.
-          fetch-depth: 0
+          # Why depth 50 and not 0: every diff below resolves to HEAD^1, so only the merge commit
+          # and a little slack are needed. Fetching all 8127 refs' commit graph cost ~20s here and
+          # is charged to the start of all 22 jobs, since they all need this one.
+          # Why blob:none stays: the sparse tree below is ~7 files, so there are no blobs to
+          # materialize and no promisor refetch. Measured 9.5s -> 1.6s against 20.7s today.
+          fetch-depth: 50
           filter: blob:none
+          sparse-checkout: |
+            /config/scripts/git-pull-request-diff-base.mjs
+            /package.json
+            /README.md
+            /docs/readme/
+            /.github/scripts/check-root-directory-entries.mjs
+            /config/scripts/check-readme-local-links.mjs
+            /config/scripts/pr-code-change-scope.mjs
+            /config/scripts/pr-e2e-source-routing.mjs
+            /config/scripts/pr-ready-check-reuse.mjs
+          sparse-checkout-cone-mode: false
           persist-credentials: false
 
+      - name: Reject new root-level files and folders
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+        run: |
+          DIFF_BASE="$(node config/scripts/git-pull-request-diff-base.mjs "$BASE_SHA")"
+          node .github/scripts/check-root-directory-entries.mjs "$DIFF_BASE" HEAD
+
+      # The full Git index retains link targets outside the sparse working tree.
+      - name: Check README local links
+        run: node config/scripts/check-readme-local-links.mjs
+
+      # Readiness changes eligibility for advisory tests, not the already-tested source.
+      - name: Find identical successful required checks
+        id: readiness
+        if: github.event.action == 'ready_for_review'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PR_CHECK_WORKFLOW_SHA: ${{ github.workflow_sha }}
+        run: node config/scripts/pr-ready-check-reuse.mjs
+
       - name: Classify changed paths
         id: filter
         env:
           BASE_SHA: ${{ github.event.pull_request.base.sha }}
-          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
         run: |
           set -euo pipefail
+          # Why HEAD^1 and not --merge-base: HEAD is the pull request merge commit, so its first
+          # parent is the base side already. Computing a merge base instead would require the
+          # payload base SHA to be in the graph, which is what forced a full-history checkout.
+          DIFF_BASE="$(node config/scripts/git-pull-request-diff-base.mjs "$BASE_SHA")"
           # Why --no-renames: name-only rename detection can report only the destination.
           # A code file moved under docs/ must still expose its code-side deletion.
-          CHANGED="$(git diff --name-only --no-renames --diff-filter=ACDMR --merge-base "$BASE_SHA" "$HEAD_SHA")"
+          CHANGED="$(git diff --name-only --no-renames --diff-filter=ACDMR "$DIFF_BASE" HEAD)"
           echo "Changed paths:"
           printf '%s\n' "$CHANGED"
           printf '%s\n' "$CHANGED" | node config/scripts/pr-code-change-scope.mjs | tee -a "$GITHUB_OUTPUT"
@@ -79,8 +123,8 @@ jobs:
         run: |
           set -euo pipefail
           BASE="${{ github.event.pull_request.base.sha }}"
-          HEAD="${{ github.event.pull_request.head.sha }}"
-          CHANGED="$(git diff --name-only --diff-filter=AMCR --merge-base "$BASE" "$HEAD")"
+          DIFF_BASE="$(node config/scripts/git-pull-request-diff-base.mjs "$BASE")"
+          CHANGED="$(git diff --name-only --diff-filter=AMCR "$DIFF_BASE" HEAD)"
           # Source routes are executable contracts so a test can prove exact
           # authorities, exclusions, and sentinels without evaluating workflow shell.
           TEST_FILES_JSON="$(printf '%s\n' "$CHANGED" | node config/scripts/pr-e2e-source-routing.mjs)"
@@ -94,7 +138,7 @@ jobs:
           # trigger on IME source rather than on a spec name in some route's list.
           NATIVE_IME_SOURCE_CHANGED="$(printf '%s\n' "$CHANGED" | node config/scripts/pr-e2e-source-routing.mjs --native-ime-source)"
           echo "native_ime_source_changed=$NATIVE_IME_SOURCE_CHANGED" >> "$GITHUB_OUTPUT"
-          WSL_CHANGED="$(git diff --name-only --no-renames --diff-filter=ACDMR --merge-base "$BASE" "$HEAD")"
+          WSL_CHANGED="$(git diff --name-only --no-renames --diff-filter=ACDMR "$DIFF_BASE" HEAD)"
           WSL_SOURCE_CHANGED="$(printf '%s\n' "$WSL_CHANGED" | node config/scripts/pr-e2e-source-routing.mjs --wsl-source)"
           echo "wsl_source_changed=$WSL_SOURCE_CHANGED" >> "$GITHUB_OUTPUT"
           echo "Native IME source changed: $NATIVE_IME_SOURCE_CHANGED"
@@ -111,38 +155,63 @@ jobs:
     name: static analysis
     needs: [code_paths]
     if: needs.code_paths.outputs.static_analysis == 'true'
-    runs-on: ubuntu-latest
+    # Why ARM: measured 128s against 172s on ubuntu-latest, with every compute step faster --
+    # type-aware 24s->15s, anti-slop 28->19s, localization extraction 67->46s, the orcad smoke
+    # 39->14s. Both lint engines ship linux-arm64 and the Bun target follows process.arch, so
+    # the whole toolchain resolves. Free for public repositories, same as the typecheck job.
+    runs-on: ubuntu-24.04-arm
 
     steps:
       - name: Checkout
         uses: actions/checkout@v6
         with:
-          # Why blob:none: full history is needed for the merge-base diff, but historical
-          # file contents are not. Blobs are ~89% of this repo's pack, and Git fetches the
-          # few this job actually reads on demand.
-          fetch-depth: 0
-          filter: blob:none
+          # Why depth 50: the gates below diff against HEAD^1, so no merge base is computed and
+          # the payload base SHA need not be in the graph.
+          # Why no blob:none here, unlike code_paths: this job checks out all 30,226 files, and
+          # the filter then forces a second promisor fetch of nearly every blob. Measured 23s
+          # blobless against ~11s without it.
+          fetch-depth: 50
           persist-credentials: false
 
+      # Why two guarded installs: the mixed root+mobile store entry is 537 MB against
+      # 321 MB for root alone, and restoring it costs 8.6s against 4.6s. Most PRs skip the
+      # mobile install below, so they were paying 216 MB for packages they never link. The
+      # root-only key is also the one the hourly warmer reseeds. Only one of these runs.
       - uses: ./.github/actions/install-node-dependencies
+        if: needs.code_paths.outputs.mobile_dependencies != 'true'
+        with:
+          native-runtime: node
+
+      - uses: ./.github/actions/install-node-dependencies
+        if: needs.code_paths.outputs.mobile_dependencies == 'true'
         with:
           native-runtime: node
           cache-dependency-path: |
             pnpm-lock.yaml
             mobile/pnpm-lock.yaml
 
+      # Keep each check in its own log while sharing this runner.
       - name: Lint
+        id: root-lint
+        background: true
         run: pnpm exec oxlint --format github
 
       - name: Reject low-evidence patterns
         run: pnpm run audit:anti-slop
 
+      - wait: root-lint
+
       - name: Enforce focused code-quality plugins
+        id: native-code-quality
+        background: true
         run: pnpm run audit:code-quality:native
 
       - name: Enforce type-aware code-quality baseline
         run: pnpm run audit:code-quality:type-aware
 
+      # Mobile installation changes import resolution for the native cycle check.
+      - wait: native-code-quality
+
       # Why here: the changed-code gate lints mobile files too, and its type-aware pass
       # resolves types from mobile/node_modules. Without the install every mobile type
       # degrades to an `error` type — reported as phantom findings against the changed lines.
@@ -150,11 +219,15 @@ jobs:
         if: needs.code_paths.outputs.mobile_dependencies == 'true'
 
       - name: Enforce changed-code quality
+        id: changed-code-quality
+        background: true
         run: pnpm run check:code-quality:changed -- "${{ github.event.pull_request.base.sha }}"
 
       - name: Enforce React Doctor on changed lines
         run: pnpm run check:react-doctor:changed -- "${{ github.event.pull_request.base.sha }}"
 
+      - wait: changed-code-quality
+
       - name: Check Zustand selector fan-out budget
         run: pnpm run check:zustand-selector-fanout
 
@@ -167,9 +240,9 @@ jobs:
       - name: Check VM runtime rollback compatibility
         env:
           BASE_SHA: ${{ github.event.pull_request.base.sha }}
-          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
         run: |
-          if git diff --quiet --merge-base "$BASE_SHA" "$HEAD_SHA" -- \
+          DIFF_BASE="$(node config/scripts/git-pull-request-diff-base.mjs "$BASE_SHA")"
+          if git diff --quiet "$DIFF_BASE" HEAD -- \
             src/shared/ephemeral-vm-runtime-store.ts \
             src/shared/ephemeral-vm-runtime-feature-store.ts \
             src/shared/ephemeral-vm-runtime-rollback-projection.ts \
@@ -194,11 +267,39 @@ jobs:
       - name: Enforce runtime Electron-import ratchet
         run: pnpm run check:runtime-electron-ratchet
 
+      # Why: extraction writes sorted evidence to an isolated temporary path,
+      # so feature PRs need one normalized AST pass rather than a three-OS matrix.
+      - name: Verify localization extraction
+        id: localization-extraction
+        background: true
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+        run: |
+          # Detection failures run the full check; renames retain the removed input path.
+          DIFF_BASE="$(node config/scripts/git-pull-request-diff-base.mjs "$BASE_SHA")"
+          if git diff --name-only --no-renames -z "$DIFF_BASE" HEAD > "$RUNNER_TEMP/localization-changes" &&
+            scope="$(node config/scripts/localization-extraction-change-scope.mjs "$RUNNER_TEMP/localization-changes")" && [ "$scope" = false ]; then
+            echo "Localization extraction inputs are unchanged."
+          else
+            pnpm run verify:localization-extraction
+          fi
+
       # Why both: the ratchet proves nothing reachable from the runtime imports electron,
       # which is a property of the import graph. This proves the Node artifact it enables
       # actually boots, pairs, creates a worktree and round-trips a real PTY.
       - name: Boot orcad and round-trip a terminal
-        run: pnpm run smoke:orcad-terminal
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          ORCA_BACKGROUND_LAUNCH: '1'
+        run: |
+          # Detection failures run the smoke; renames retain the removed input path.
+          DIFF_BASE="$(node config/scripts/git-pull-request-diff-base.mjs "$BASE_SHA")"
+          if git diff --name-only --no-renames -z "$DIFF_BASE" HEAD > "$RUNNER_TEMP/orcad-smoke-changes" &&
+            scope="$(node config/scripts/orcad-terminal-smoke-change-scope.mjs "$RUNNER_TEMP/orcad-smoke-changes")" && [ "$scope" = false ]; then
+            echo "Orcad terminal smoke inputs are unchanged."
+          else
+            pnpm run smoke:orcad-terminal
+          fi
 
       - name: Verify the generated RPC params catalog
         run: pnpm run verify:rpc-params-catalog
@@ -209,23 +310,16 @@ jobs:
       - name: Verify skill freshness manifest
         run: pnpm run verify:skill-bundle-manifest
 
-      - name: Verify localization catalog
-        run: pnpm run verify:localization-catalog
-
-      # Why: the renderer ships only the English entries i18next cannot rebuild
-      # from each call site's inline default, so the generated subset has to
-      # track en.json and those defaults.
-      - name: Verify runtime-required localization catalog
-        run: pnpm run verify:localization-runtime-catalog
-
-      # Why: extraction writes sorted evidence to an isolated temporary path,
-      # so feature PRs need one normalized AST pass rather than a three-OS matrix.
-      - name: Verify localization extraction
-        run: pnpm run verify:localization-extraction
+      - name: Verify localization catalogs
+        id: localization-catalogs
+        background: true
+        run: pnpm run verify:localization-catalogs
 
       - name: Verify localization coverage
         run: pnpm run verify:localization-coverage
 
+      - wait: [localization-catalogs, localization-extraction]
+
       # Why: project-owned type declarations must live in .ts so tsc
       # actually checks them. TypeScript's skipLibCheck: true (inherited
       # from @electron-toolkit/tsconfig) silently widens unresolved names
@@ -249,37 +343,11 @@ jobs:
       - name: Verify macOS entitlements
         run: pnpm verify:macos-entitlements
 
-  root_directory_guard:
-    name: root directory guard
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-        with:
-          # Why blob:none: full history is needed for the merge-base diff, but historical
-          # file contents are not. Blobs are ~89% of this repo's pack, and Git fetches the
-          # few this job actually reads on demand.
-          fetch-depth: 0
-          filter: blob:none
-          persist-credentials: false
-
-      - name: Reject new root-level files and folders
-        env:
-          BASE_SHA: ${{ github.event.pull_request.base.sha }}
-          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
-        run: node .github/scripts/check-root-directory-entries.mjs "$BASE_SHA" "$HEAD_SHA"
-
-      # Why here: the READMEs embed media owned by docs/site and resources/onboarding,
-      # and the classifier skips static_analysis for docs-only diffs. This job runs
-      # on every PR and needs no install.
-      - name: Check README local links
-        run: node config/scripts/check-readme-local-links.mjs
-
   typecheck:
     needs: [code_paths]
     if: needs.code_paths.outputs.typecheck == 'true'
-    runs-on: ubuntu-latest
+    # Typechecking uses no native runtime, so it can use the free public ARM runner.
+    runs-on: ubuntu-24.04-arm
 
     steps:
       - name: Checkout
@@ -317,39 +385,7 @@ jobs:
 
       - uses: ./.github/actions/install-node-dependencies
 
-      # Why: the 2.25.5 lane is a source build of a pinned tarball, so it produced the
-      # same binary on every PR for minutes of runner time. The key carries the version
-      # because that is the only input; the sha256 assertion below still guards the
-      # tarball on the miss path that actually builds. Only this PR's own later pushes
-      # can restore it — GitHub scopes a cache written from a pull_request run to that
-      # ref — so a first push always takes the build path below.
-      - name: Cache baseline Git build
-        uses: actions/cache@v5
-        with:
-          path: ~/.cache/orca-git-compat/git-2.25.5
-          key: git-compat-baseline-${{ runner.os }}-${{ runner.arch }}-2.25.5
-
-      # Why its own step: this is `make -j$(nproc)` on every core, and the lanes below
-      # spend their wall clock waiting on container starts, not on Git. Sharing a runner
-      # with the build stretched one ~1.5s boundary case past Vitest's 30s timeout, so
-      # the build has to finish before anything timed starts.
-      - name: Build the baseline Git binary
-        run: |
-          archive="$RUNNER_TEMP/git-2.25.5.tar.gz"
-          source="$HOME/.cache/orca-git-compat/git-2.25.5"
-          if [ -x "$source/git" ]; then
-            exit 0
-          fi
-          curl -fsSL https://www.kernel.org/pub/software/scm/git/git-2.25.5.tar.gz -o "$archive"
-          echo "41662c52fc16fec4963bfc41075e71f8ead6b5e386797eb6f9a1111ff95a8ddf  $archive" \
-            | sha256sum --check
-          mkdir -p "$source"
-          tar -xzf "$archive" -C "$source" --strip-components=1
-          make -C "$source" -j"$(nproc)" \
-            NO_GETTEXT=YesPlease NO_TCLTK=YesPlease NO_PYTHON=YesPlease git
-          # Why: the linked binaries are what the next run needs; the objects that
-          # produced them are most of the tree and would bloat the cache entry.
-          find "$source" -name '*.o' -delete
+      - uses: ./.github/actions/prepare-git-compatibility
 
       - name: Verify Git binary compatibility matrix
         run: |
@@ -399,7 +435,8 @@ jobs:
     name: Codex index-heal contract
     needs: [code_paths]
     if: needs.code_paths.outputs.codex_index_heal_contract == 'true'
-    runs-on: ubuntu-latest
+    # Why ARM: @openai/codex ships @openai/codex-linux-arm64.
+    runs-on: ubuntu-24.04-arm
     env:
       CODEX_CLI_VERSION: '0.150.1'
 
@@ -434,7 +471,10 @@ jobs:
     name: xterm patch sync
     needs: [code_paths]
     if: needs.code_paths.outputs.xterm_patch_sync == 'true'
-    runs-on: ubuntu-latest
+    # Why ARM: the patch check rebuilds 4 packages x 2 builds and byte-compares against the
+    # checked-in bundles. Those were generated on Linux x64 and reproduce byte-for-byte on
+    # darwin-arm64, so the output is neither host-arch nor host-OS dependent.
+    runs-on: ubuntu-24.04-arm
 
     steps:
       - name: Checkout
@@ -442,21 +482,14 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: ./.github/actions/install-node-dependencies
-
-      # Why: the check rebuilds every package in the manifest from a pinned upstream
-      # commit — @xterm/xterm and its three addons, each built twice (once unmodified to
-      # prove the toolchain still reproduces the published bundles, once patched). Caching
-      # the npm metadata and the shallow clone keeps the repeated cost to the builds
-      # themselves; the key is the manifest, so a commit, package or toolchain bump
-      # invalidates it.
-      - name: Restore upstream xterm build inputs
-        uses: actions/cache@v5
+      # The generator uses Node built-ins and installs its own upstream toolchain.
+      - uses: actions/setup-node@v6
         with:
-          path: |
-            ~/.npm
-            ${{ runner.temp }}/xterm-patch-build/upstream/.git
-          key: xterm-upstream-${{ hashFiles('config/patches/xterm-upstream.json') }}
+          node-version-file: package.json
+          package-manager-cache: false
+
+      # Rebuild both pristine and patched bundles; reuse only the pinned toolchain.
+      - uses: ./.github/actions/prepare-xterm-dependencies
 
       - name: Verify xterm patches match the pinned upstream build
         env:
@@ -467,7 +500,8 @@ jobs:
     name: shell contracts
     needs: [code_paths]
     if: needs.code_paths.outputs.shell_contracts == 'true'
-    runs-on: ubuntu-latest
+    # Why ARM: fish 4.x is published for noble/arm64 and zsh is in the arm64 archive.
+    runs-on: ubuntu-24.04-arm
     # Why: this job's cost is almost entirely package download, and a stalled mirror has
     # no wall-clock bound of its own. A successful run finishes in ~4.5 minutes, so this
     # is generous; it exists so a wedge fails the job instead of holding the whole run
@@ -493,6 +527,8 @@ jobs:
       # fish-color-scheme-child-stdin.node-pty.test.ts (#9993) needs it. Noble ships
       # 3.7, so the PPA is what makes that lane real.
       - name: Install zsh and fish
+        id: shells
+        background: true
         run: |
           # Why the update/PPA/fish steps are tolerant: a repo the runner image already
           # ships can lack a Release file for this suite, and a failed add-apt-repository
@@ -541,6 +577,12 @@ jobs:
           # first install command in this step to prove the lane really installs them.
           timeout 300 sudo apt-get install -y zsh fish
 
+      - uses: ./.github/actions/install-node-dependencies
+        with:
+          native-runtime: node
+
+      - wait: shells
+
       # Separate from the install so the failure names the contract, not an apt error.
       # ORCA_REQUIRE_FISH re-checks this at test time; this step just fails in seconds
       # instead of after a full dependency install.
@@ -556,10 +598,6 @@ jobs:
             exit 1
           fi
 
-      - uses: ./.github/actions/install-node-dependencies
-        with:
-          native-runtime: node
-
       - name: Test real shell contracts
         run: |
           pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 \
@@ -588,7 +626,7 @@ jobs:
     name: prepare test native cache node 24
     needs: [code_paths]
     if: needs.code_paths.outputs.native_cache_changed == 'true'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04-arm
 
     steps:
       - name: Checkout
@@ -602,14 +640,19 @@ jobs:
           node-version: '24'
 
   test:
-    needs: [code_paths, test_native_cache]
+    needs: [code_paths, test_native_cache, static_analysis, typecheck]
+    # Honor cancellation while allowing the optional native-cache primer to skip.
     if: >-
-      always() &&
+      !cancelled() &&
       needs.code_paths.outputs.test == 'true' &&
+      needs.static_analysis.result == 'success' &&
+      needs.typecheck.result == 'success' &&
       (needs.test_native_cache.result == 'success' || needs.test_native_cache.result == 'skipped')
     uses: ./.github/workflows/unit-tests.yml
     with:
       node_versions: '["24"]'
+      runner: ubuntu-24.04-arm
+      selection_mode: ${{ vars.ORCA_UNIT_SELECTION_MODE || 'shadow' }}
 
   # Why a separate job: the test needs a real Chrome, and the sharded `test` matrix
   # would pay for it on every shard to run one file in whichever shard it landed in.
@@ -673,9 +716,22 @@ jobs:
             pnpm-lock.yaml
             mobile/pnpm-lock.yaml
 
+      # The drawer check runs on WebKit as well as Chrome, because the shell's iOS WebView is
+      # WebKit and the Chrome above cannot stand in for it. Downloaded rather than resolved from
+      # the runner: Ubuntu ships no WebKit build to point at.
+      - name: Install WebKit for the drawer check
+        id: webkit
+        background: true
+        run: pnpm exec playwright install --with-deps webkit
+
       # The entry lives in mobile/ so one React resolves; without this every RN import is nothing.
       - uses: ./.github/actions/install-mobile-dependencies
 
+      - name: Prepare mobile route snapshot
+        id: mobile-routes
+        background: true
+        run: node config/scripts/run-mobile-web-app-checks.mjs --prepare-route-snapshot "$RUNNER_TEMP/mobile-routes.json"
+
       # Why the runner's Google Chrome and not a downloaded chromium: same reason as the orcad
       # browser job -- Ubuntu 24.04 only ships an AppArmor userns profile for the Chrome .deb.
       # Why fail instead of skip: a silently skipped render check is the failure this job exists
@@ -691,15 +747,12 @@ jobs:
           "$chrome" --version
           echo "ORCA_MOBILE_WEB_RENDER_BROWSER=$chrome" >> "$GITHUB_ENV"
 
-      # The drawer check runs on WebKit as well as Chrome, because the shell's iOS WebView is
-      # WebKit and the Chrome above cannot stand in for it. Downloaded rather than resolved from
-      # the runner: Ubuntu ships no WebKit build to point at.
-      - name: Install WebKit for the drawer check
-        run: pnpm exec playwright install --with-deps webkit
-
       - name: Build and verify the app bundle
         run: pnpm run build:mobile-web
 
+      # Browser checks must observe both a finished install and the built bundle.
+      - wait: [webkit, mobile-routes]
+
       # The bundling tests skip themselves where mobile dependencies are absent, which is how they
       # stay green in the sharded `test` job. This is the job that installs them, so here a missing
       # install has to fail rather than skip everything the job exists to run.
@@ -709,23 +762,20 @@ jobs:
       # one `pr-code-change-scope.mjs` fires this job on, so naming a test into the family is all
       # it takes to have it run. Quoted because these are vitest filename filters, matched as
       # substrings against the discovered files, and the shell must not touch them.
-      #
-      # Cost: 18 files in 25-30s wall, of which the frame-budget sweep is 2.5s. That sweep encodes
-      # 111 noise JPEGs in Chromium, so it is the one step here whose cost grows with its viewport
-      # set; adding rows to that set is a decision about this job's runtime.
+      # Route censuses share fresh dependency lists for this invocation; scratch builds stay independent.
       - name: Builder, override census and render checks
         env:
           ORCA_MOBILE_WEB_APP_DEPS_REQUIRED: '1'
+          ORCA_MOBILE_WEB_PREPARED_ROUTE_SNAPSHOT: ${{ runner.temp }}/mobile-routes.json
         run: |
-          pnpm exec vitest run --config config/vitest.config.ts \
-            'config/scripts/mobile-web-app-' \
-            'config/scripts/build-mobile-web-app-bundle.test.mjs'
+          node config/scripts/run-mobile-web-app-checks.mjs
 
   cross-version-wire:
     name: cross-version wire compatibility
     needs: [code_paths]
     if: needs.code_paths.outputs.cross-version-wire == 'true'
-    runs-on: ubuntu-latest
+    # Why ARM: source-only: tagged checkout plus in-process vitest, no docker or browser.
+    runs-on: ubuntu-24.04-arm
 
     steps:
       # Why fetch-depth 0: the harness extracts the newest release tag to skew
@@ -757,12 +807,16 @@ jobs:
           tests/e2e/cross-version-wire/cross-version-agent-session-wire.unit.test.ts
           tests/e2e/cross-version-wire/cross-version-worktree-identity-downgrade.unit.test.ts
           tests/e2e/cross-version-wire/cross-version-session-tabs-retirement-proof.unit.test.ts
+          tests/e2e/cross-version-wire/agent-session-resume-marker-downgrade.unit.test.ts
+          tests/e2e/cross-version-wire/agent-session-unproven-release-downgrade.unit.test.ts
+          tests/e2e/cross-version-wire/cross-version-worktree-ps-verdict.unit.test.ts
 
   managed_hook_node18:
     name: managed hooks on Node 18
     needs: [code_paths]
     if: needs.code_paths.outputs.managed_hook_node18 == 'true'
-    runs-on: ubuntu-latest
+    # Why ARM: Node 18 publishes linux-arm64; the per-platform runtime files are read as data.
+    runs-on: ubuntu-24.04-arm
 
     steps:
       - name: Checkout
@@ -785,7 +839,7 @@ jobs:
 
   package:
     name: package
-    needs: [code_paths]
+    needs: [code_paths, static_analysis, typecheck]
     if: needs.code_paths.outputs.package == 'true'
     runs-on: ubuntu-latest
     # Let the serial Docker gates reach their own deadlines and report cleanup failures.
@@ -798,7 +852,7 @@ jobs:
           persist-credentials: false
 
       - name: Cache electron-builder downloads
-        uses: actions/cache@v5
+        uses: actions/cache/restore@v5
         with:
           path: ~/.cache/electron-builder
           key: electron-builder-linux-${{ hashFiles('pnpm-lock.yaml') }}
@@ -835,6 +889,24 @@ jobs:
           src/main/browser/browser-route-h3-egress.electron.test.ts
           src/main/browser/browser-route-dns-prefetch.electron.test.ts
 
+      # Restore independent fixtures during builds; keep native lifecycle probes serial.
+      - uses: ./.github/actions/prepare-linux-package-fixture
+        id: shutdown-fixture-cache
+        background: true
+        with:
+          fixture: headless-serve-shutdown
+
+      - uses: ./.github/actions/prepare-linux-package-fixture
+        id: cli-fixture-cache
+        background: true
+        with:
+          fixture: cli-launch-contract
+
+      - name: Install Linux package tooling
+        id: linux-package-tools
+        background: true
+        run: sudo apt-get update && sudo apt-get install -y cpio rpm
+
       - name: Build package inputs
         run: |
           status=0
@@ -853,6 +925,8 @@ jobs:
           exit "$status"
 
       - name: Project web client from renderer build
+        id: web-client
+        background: true
         run: pnpm run build:web-from-renderer
 
       # Why here and not inside "Build package inputs": this job assembles packaging inputs step by
@@ -864,17 +938,16 @@ jobs:
       - name: Build native components
         run: pnpm run build:native
 
-      - name: Install Linux package tooling
-        run: sudo apt-get update && sudo apt-get install -y cpio rpm
+      - wait: [linux-package-tools, web-client]
 
       - name: Package unpacked app
         env:
+          ORCA_BACKGROUND_LAUNCH: '1'
           ORCA_REUSE_PREPARED_NATIVE_RUNTIME: '1'
-        # PR artifacts are only inspected locally; gzip avoids release-size xz compression.
-        run: >-
-          pnpm exec electron-builder --config config/electron-builder.config.cjs
-          --linux AppImage deb rpm --x64 --publish never
-          --config.deb.compression=gz --config.rpm.compression=gzip
+        # Prepare once with every hook, then isolate the format-specific mutations.
+        run: |
+          pnpm exec electron-builder --config config/electron-builder.config.cjs --linux dir --x64 --publish never
+          node config/scripts/package-linux-formats.mjs
 
       - name: Verify root-package marker payloads
         run: |
@@ -889,13 +962,21 @@ jobs:
           [[ "$deb_marker" == deb ]] || { echo "Expected deb marker, got: $deb_marker"; exit 1; }
           [[ "$rpm_marker" == rpm ]] || { echo "Expected rpm marker, got: $rpm_marker"; exit 1; }
 
+      - wait: shutdown-fixture-cache
+
       - name: Verify headless serve signal shutdown
+        env:
+          ORCA_SHUTDOWN_FIXTURE_CACHE_IMAGE: ${{ steps.shutdown-fixture-cache.outputs.image }}
         run: >-
           node config/scripts/run-headless-serve-shutdown-docker.mjs
           --appimage dist/orca-linux.AppImage --all-entrypoints
 
       # A default container reproduces the hostile AppImage launch environment.
+      - wait: cli-fixture-cache
+
       - name: Verify Linux CLI launch contract
+        env:
+          ORCA_CLI_FIXTURE_CACHE_IMAGE: ${{ steps.cli-fixture-cache.outputs.image }}
         run: node config/scripts/run-linux-cli-launch-contract-docker.mjs --appimage dist/orca-linux.AppImage
 
       - name: Smoke packaged CLI
@@ -906,7 +987,7 @@ jobs:
 
   package_windows:
     name: package (windows)
-    needs: [code_paths]
+    needs: [code_paths, static_analysis, typecheck]
     if: needs.code_paths.outputs.package_windows == 'true'
     runs-on: windows-2022
     timeout-minutes: 30
@@ -918,14 +999,15 @@ jobs:
           persist-credentials: false
 
       - name: Cache electron-builder downloads
-        uses: actions/cache@v5
+        uses: actions/cache/restore@v5
         with:
           path: |
             ~\AppData\Local\electron\Cache
             ~\AppData\Local\electron-builder\Cache
-          key: electron-builder-windows-${{ hashFiles('pnpm-lock.yaml') }}
+          # Release builds seed this exact path set; PR-local copies cannot serve other PRs.
+          key: electron-builder-win-${{ hashFiles('pnpm-lock.yaml') }}
           restore-keys: |
-            electron-builder-windows-
+            electron-builder-win-
 
       # Why persist-native-cache false: this job later rebuilds the same path for
       # Electron. A post-job save would store the Electron ABI under the Node key.
@@ -954,6 +1036,12 @@ jobs:
 
       # vitest runs here directly rather than through `pnpm test`, so the addon
       # assertions only hold once install-node-dependencies has rebuilt natives.
+      - name: Test Windows installer process probe
+        # Keep cold CIM startup out of the concurrent Electron/native process workload.
+        run: >-
+          pnpm exec vitest run --config config/vitest.config.ts
+          config/scripts/nsis-process-check.test.mjs
+
       - name: Test Windows-specific boundaries
         run: >-
           pnpm exec vitest run --config config/vitest.config.ts
@@ -989,6 +1077,7 @@ jobs:
           src/main/windows/windows-host-job.win32.test.ts
           src/main/windows/windows-process-tree-command-line-patch.test.ts
           src/main/windows/windows-process-table-native-addon.win32.test.ts
+          src/main/persistence/profile-state/profile-state-access-windows-native.win32.test.ts
           src/main/windows-live-tree-kill.win32.test.ts
           src/main/wsl/wsl-runner.test.ts
           src/main/wsl/wsl-guest-environment.test.ts
@@ -1088,11 +1177,10 @@ jobs:
       ref: ${{ github.event.pull_request.head.sha }}
 
   verify:
-    if: always()
+    if: ${{ !cancelled() }}
     needs:
       - code_paths
       - static_analysis
-      - root_directory_guard
       - typecheck
       - git_compatibility
       - codex_index_heal_contract
@@ -1105,7 +1193,9 @@ jobs:
       - managed_hook_node18
       - package
       - package_windows
-    runs-on: ubuntu-latest
+    # Evaluating job results only needs the lightweight container runner.
+    runs-on: ubuntu-slim
+    timeout-minutes: 5
 
     steps:
       # Why: e2e is deliberately absent from needs. The suite is currently red on
@@ -1122,7 +1212,6 @@ jobs:
           SHOULD_RUN: ${{ needs.code_paths.outputs.should_run }}
           STATIC_ANALYSIS: ${{ needs.static_analysis.result }}
           STATIC_ANALYSIS_SHOULD_RUN: ${{ needs.code_paths.outputs.static_analysis }}
-          ROOT_DIRECTORY_GUARD: ${{ needs.root_directory_guard.result }}
           TYPECHECK: ${{ needs.typecheck.result }}
           TYPECHECK_SHOULD_RUN: ${{ needs.code_paths.outputs.typecheck }}
           GIT_COMPATIBILITY: ${{ needs.git_compatibility.result }}
@@ -1151,9 +1240,6 @@ jobs:
           if [ "$CODE_PATHS" != "success" ]; then
             exit 1
           fi
-          if [ "$ROOT_DIRECTORY_GUARD" != "success" ]; then
-            exit 1
-          fi
           if [ "$SHOULD_RUN" != "true" ]; then
             echo "Docs-only change; expensive PR checks skipped."
           fi
diff --git a/.github/workflows/pullfrog.yml b/.github/workflows/pullfrog.yml
index d5030252f88d..2fc81c887bba 100644
--- a/.github/workflows/pullfrog.yml
+++ b/.github/workflows/pullfrog.yml
@@ -1,6 +1,6 @@
-# PULLFROG ACTION — DO NOT EDIT EXCEPT WHERE INDICATED
+# Explicit review identities share workflow concurrency; legacy names use ordered cancellation.
 name: Pullfrog
-run-name: ${{ inputs.name || github.workflow }}
+run-name: ${{ inputs.name || github.workflow }}${{ inputs.pull_request_number && format(' | PR {0}', inputs.pull_request_number) || '' }}
 on:
   workflow_dispatch:
     inputs:
@@ -11,21 +11,71 @@ on:
         type: string
         description: Run name
 
+      pull_request_number:
+        type: string
+        description: Optional PR identity for cancelling superseded reviews
+      head_sha:
+        type: string
+        description: Optional expected PR head; stale reviews are skipped
+
 permissions:
   contents: read
+  pull-requests: read
+
+concurrency:
+  group: ${{ inputs.pull_request_number && format('pullfrog-pr-{0}', inputs.pull_request_number) || format('pullfrog-run-{0}', github.run_id) }}
+  cancel-in-progress: true
 
 jobs:
+  review_scope:
+    runs-on: ubuntu-slim
+    permissions:
+      contents: read
+      pull-requests: read
+      actions: write
+    outputs:
+      current: ${{ steps.scope.outputs.current }}
+      number: ${{ steps.scope.outputs.number }}
+      head: ${{ steps.scope.outputs.head }}
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          sparse-checkout: config/scripts/pullfrog-review-scope.cjs
+          sparse-checkout-cone-mode: false
+          persist-credentials: false
+      - uses: actions/github-script@v8
+        id: scope
+        with:
+          script: |
+            const { reviewScope } = require('./config/scripts/pullfrog-review-scope.cjs')
+            await reviewScope({ github, context, core })
+
   pullfrog:
+    needs: review_scope
+    if: needs.review_scope.outputs.current == 'true'
     runs-on: ubuntu-latest
     permissions:
       id-token: write
       contents: read
+      pull-requests: read
     steps:
       - name: Checkout code
         uses: actions/checkout@v6
         with:
           fetch-depth: 1
+      - name: Recheck review head before starting agent
+        id: freshness
+        if: needs.review_scope.outputs.number != ''
+        uses: actions/github-script@v8
+        env:
+          REVIEW_NUMBER: ${{ needs.review_scope.outputs.number }}
+          REVIEW_HEAD: ${{ needs.review_scope.outputs.head }}
+        with:
+          script: |
+            const { data: pr } = await github.rest.pulls.get({ ...context.repo, pull_number: Number(process.env.REVIEW_NUMBER) })
+            core.setOutput('current', pr.state === 'open' && pr.head.sha === process.env.REVIEW_HEAD)
       - name: Run agent
+        if: needs.review_scope.outputs.number == '' || steps.freshness.outputs.current == 'true'
         uses: pullfrog/pullfrog@v0
         with:
           prompt: ${{ inputs.prompt }}
diff --git a/.github/workflows/release-cut.yml b/.github/workflows/release-cut.yml
index b2ac03e2b085..2490d39af39b 100644
--- a/.github/workflows/release-cut.yml
+++ b/.github/workflows/release-cut.yml
@@ -1314,6 +1314,16 @@ jobs:
           restore-keys: |
             electron-builder-${{ matrix.platform }}-
 
+      # PRs cache tools separately from Electron; identical paths preserve their cache version.
+      - name: Seed shared Linux packaging downloads
+        if: matrix.platform == 'linux-x64' && github.ref == 'refs/heads/main'
+        uses: actions/cache@v5
+        with:
+          path: ~/.cache/electron-builder
+          key: electron-builder-linux-${{ hashFiles('pnpm-lock.yaml') }}
+          # The release cache above restores the same tools, so this only needs to save on a miss.
+          lookup-only: true
+
       # Why: pnpm install triggers electron's postinstall, which downloads the
       # Electron binary from GitHub release assets. GitHub's download CDN
       # occasionally returns 504s that fail the whole release. Retry on
diff --git a/.github/workflows/release-policy.yml b/.github/workflows/release-policy.yml
index 8014145939ba..e6ab98f0d0d2 100644
--- a/.github/workflows/release-policy.yml
+++ b/.github/workflows/release-policy.yml
@@ -16,7 +16,7 @@ concurrency:
 jobs:
   enforce:
     if: github.repository == 'stablyai/orca'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
     timeout-minutes: 5
     steps:
       - name: Enforce release policy
diff --git a/.github/workflows/terminal-ime-e2e.yml b/.github/workflows/terminal-ime-e2e.yml
index bd6be26bd272..168280f9ac2f 100644
--- a/.github/workflows/terminal-ime-e2e.yml
+++ b/.github/workflows/terminal-ime-e2e.yml
@@ -49,7 +49,7 @@ jobs:
         run: >-
           xvfb-run --auto-servernum
           env SKIP_BUILD=1 ORCA_E2E_FORWARD_APP_LOGS=1
-          pnpm run test:e2e --
+          pnpm run test:e2e
           tests/e2e/terminal-ime-exact-byte.spec.ts
           --workers=1
 
diff --git a/.github/workflows/track-community-prs.yaml b/.github/workflows/track-community-prs.yaml
index 5a5dcb670c2d..7a588663fb20 100644
--- a/.github/workflows/track-community-prs.yaml
+++ b/.github/workflows/track-community-prs.yaml
@@ -15,7 +15,8 @@ permissions:
 
 jobs:
   track-community-pr:
-    runs-on: ubuntu-latest
+    # API-only bookkeeping fits the free single-CPU container runner.
+    runs-on: ubuntu-slim
     timeout-minutes: 5
     steps:
       - name: Generate bufo-bot token
diff --git a/.github/workflows/unit-tests.yml b/.github/workflows/unit-tests.yml
index 4ed5063e318a..2691f4907bcc 100644
--- a/.github/workflows/unit-tests.yml
+++ b/.github/workflows/unit-tests.yml
@@ -8,19 +8,54 @@ on:
         required: true
         type: string
 
+      runner:
+        description: Hosted runner for the unit shards; relay integration keeps its x86 host.
+        required: false
+        default: ubuntu-latest
+        type: string
+
+      selection_mode:
+        description: Shadow validates selection; selected applies it only to draft PRs.
+        required: false
+        default: shadow
+        type: string
+
 permissions:
   contents: read
 
 jobs:
-  test:
-    name: tests node ${{ matrix.node }} ${{ matrix.shard }}/${{ matrix.shard_total }}
+  plan:
     runs-on: ubuntu-latest
+    timeout-minutes: 5
+    outputs:
+      shards: ${{ steps.plan.outputs.shards }}
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 2
+          persist-credentials: false
+      - uses: ./.github/actions/install-node-dependencies
+      - name: Plan unit selection
+        id: plan
+        env:
+          ORCA_UNIT_SELECTION_MODE: ${{ inputs.selection_mode }}
+        run: node config/scripts/ci-unit-plan.mjs
+      - uses: actions/upload-artifact@v7
+        continue-on-error: true
+        with:
+          name: unit-selection-attempt-${{ github.run_attempt }}
+          path: ci-shards/unit-selection.json
+          retention-days: 14
+
+  test:
+    needs: plan
+    name: tests node ${{ matrix.node }} ${{ matrix.shard.index }}/${{ matrix.shard.count }}
+    runs-on: ${{ inputs.runner }}
     strategy:
       fail-fast: false
       matrix:
         node: ${{ fromJSON(inputs.node_versions) }}
-        shard: [1, 2, 3, 4, 5, 6, 7, 8]
-        shard_total: [8]
+        shard: ${{ fromJSON(needs.plan.outputs.shards) }}
 
     steps:
       - name: Checkout
@@ -33,13 +68,16 @@ jobs:
           native-runtime: node
           node-version: ${{ matrix.node }}
           cache-electron-package: 'true'
-          cache-dependency-path: |
-            pnpm-lock.yaml
-            cloud/pnpm-lock.yaml
 
       - name: Install Electron package binary for tests
         run: node config/scripts/install-electron-package-binary.mjs
 
+      - uses: actions/download-artifact@v8
+        continue-on-error: true
+        with:
+          name: unit-selection-attempt-${{ github.run_attempt }}
+          path: ci-shards/
+
       - name: Test shard
         env:
           ORCA_BALANCE_UNIT_SHARDS: '1'
@@ -47,27 +85,7 @@ jobs:
         run: |
           export ORCA_SHARD_SOURCE_SHA="$(git rev-parse HEAD)"
           pnpm exec vitest run --config config/vitest.config.ts \
-            --exclude=src/main/daemon/repro-13767-shell-ready-marker-lost-to-exec.test.ts \
-            --exclude=src/main/daemon/shell-ready.test.ts \
-            --exclude=src/main/daemon/node-pty-fd-leak.test.ts \
-            --exclude=src/main/providers/local-pty-shell-ready-zsh-launch-environment.test.ts \
-            --exclude=src/main/providers/__tests__/shell-ready-framework-example.test.ts \
-            --exclude=src/main/pty/omp-shell-wrapper-alias-safety.test.ts \
-            --exclude=src/main/pty/omp-shell-wrapper.node-pty.test.ts \
-            --exclude=src/main/shell-startup-feature-channel.test.ts \
-            --exclude=src/main/terminal-history-fish-session.node-pty.test.ts \
-            --exclude=src/main/zsh-scoped-histfile.live-shell.test.ts \
-            --exclude=src/main/zsh-startup-hook-user-config-equivalence.live-shell.test.ts \
-            --exclude=src/main/zsh-wrapper-version-mismatch.live-shell.test.ts \
-            --exclude=src/renderer/src/components/terminal-pane/fish-color-scheme-child-stdin.node-pty.test.ts \
-            --exclude=src/shared/fish-query-reply-child-stdin.node-pty.test.ts \
-            --exclude=src/shared/pty-reply-echo-shapes.node-pty.test.ts \
-            --exclude=src/shared/startup-shell-portability.live-shell.test.ts \
-            --exclude=src/shared/posix-command-path-lookup.test.ts \
-            --exclude=tests/e2e/relay-region-compatibility.unit.test.ts \
-            --exclude=tests/e2e/relay-region-correction.unit.test.ts \
-            --exclude=tests/e2e/cross-version-wire/** \
-            --shard=${{ matrix.shard }}/${{ matrix.shard_total }}
+            --shard=${{ matrix.shard.index }}/${{ matrix.shard.count }}
 
       - name: Upload unit shard assignment
         if: always()
@@ -75,13 +93,46 @@ jobs:
         continue-on-error: true
         uses: actions/upload-artifact@v7
         with:
-          name: unit-shard-node-${{ matrix.node }}-${{ matrix.shard }}-attempt-${{ github.run_attempt }}
+          name: unit-shard-node-${{ matrix.node }}-${{ matrix.shard.index }}-attempt-${{ github.run_attempt }}
           path: ci-shards/
           retention-days: 14
           if-no-files-found: warn
 
+  selection_evidence:
+    needs: test
+    if: ${{ !cancelled() }}
+    continue-on-error: true
+    runs-on: ubuntu-slim
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          sparse-checkout: config/scripts/ci-unit-selection-review.mjs
+          sparse-checkout-cone-mode: false
+          persist-credentials: false
+      - uses: actions/setup-node@v6
+        with:
+          node-version: '24'
+      - uses: actions/download-artifact@v8
+        with:
+          pattern: unit-shard-node-*-attempt-${{ github.run_attempt }}
+          path: unit-evidence/
+      - name: Compare selection with full results
+        continue-on-error: true
+        run: node config/scripts/ci-unit-selection-review.mjs unit-evidence
+      - uses: actions/upload-artifact@v7
+        if: always()
+        continue-on-error: true
+        with:
+          name: unit-selection-review-attempt-${{ github.run_attempt }}
+          path: unit-evidence/selection-review.json
+          retention-days: 30
+
   relay_integration:
-    name: relay integration node ${{ fromJSON(inputs.node_versions)[0] }}
+    name: relay integration node ${{ matrix.node }}
+    strategy:
+      fail-fast: false
+      matrix:
+        node: ${{ fromJSON(inputs.node_versions) }}
     runs-on: ubuntu-latest
 
     steps:
@@ -93,7 +144,7 @@ jobs:
       - uses: ./.github/actions/install-node-dependencies
         with:
           native-runtime: node
-          node-version: ${{ fromJSON(inputs.node_versions)[0] }}
+          node-version: ${{ matrix.node }}
           cache-electron-package: 'true'
           cache-dependency-path: |
             pnpm-lock.yaml
diff --git a/.github/workflows/win-crash-survival-e2e.yml b/.github/workflows/win-crash-survival-e2e.yml
index e0d7b80d0473..53c231111dbf 100644
--- a/.github/workflows/win-crash-survival-e2e.yml
+++ b/.github/workflows/win-crash-survival-e2e.yml
@@ -35,6 +35,7 @@ jobs:
     timeout-minutes: 50
     env:
       EXPECT: ${{ inputs.expect || 'survival' }}
+      ORCA_BACKGROUND_LAUNCH: '1'
 
     steps:
       - name: Checkout
diff --git a/.github/workflows/win-update-survival-e2e.yml b/.github/workflows/win-update-survival-e2e.yml
index 50c38f2e3ad5..b709f82b7885 100644
--- a/.github/workflows/win-update-survival-e2e.yml
+++ b/.github/workflows/win-update-survival-e2e.yml
@@ -29,6 +29,21 @@ on:
         options:
           - survival
           - cold-restore
+      trace_installer:
+        description: Trace installer process checks in this disposable build
+        type: boolean
+        default: false
+      policy:
+        description: Execution policy inherited by harness child processes
+        type: choice
+        default: inherited
+        options:
+          - inherited
+          - Restricted
+      from_release:
+        description: Optional base release tag; blank uses this branch build
+        type: string
+        default: ''
 
 permissions:
   contents: read
@@ -39,7 +54,7 @@ concurrency:
 
 jobs:
   survival:
-    name: survival (branch build over itself)
+    name: update ${{ inputs.from_release || 'branch' }} to branch (${{ inputs.expect || 'survival' }}, policy=${{ inputs.policy || 'inherited' }})
     runs-on: windows-2022
     timeout-minutes: 50
     env:
@@ -62,18 +77,23 @@ jobs:
         with:
           install: false
 
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-
       # Why: cache the built installer keyed on the inputs that affect it, so a
       # harness-only edit skips the ~20 min electron-builder build. The daemon
       # relocation code lives under src/, so changing it correctly rebuilds.
+      # Hash before installation creates native build artifacts under native/.
       - name: Cache branch installer
         id: cache-installer
-        uses: actions/cache@v4
+        uses: actions/cache/restore@v4
         with:
           path: dist/orca-windows-setup.exe
-          key: branch-installer-${{ hashFiles('src/**', 'config/**', 'native/**', 'resources/win32/**', 'package.json', 'pnpm-lock.yaml') }}
+          key: branch-installer-${{ inputs.trace_installer && format('trace-{0}-', hashFiles('tests/tools/win-update-e2e/trace-installer-branches.mjs')) || '' }}${{ hashFiles('src/**', 'config/**', 'native/**', 'resources/**', 'mobile/**', 'patches/**', 'package.json', 'pnpm-lock.yaml', 'pnpm-workspace.yaml') }}
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Instrument disposable installer and uninstaller
+        if: inputs.trace_installer && steps.cache-installer.outputs.cache-hit != 'true'
+        run: node tests/tools/win-update-e2e/trace-installer-branches.mjs
 
       # Why here: electron-builder's beforePack requires out/mobile-web, and the bundle
       # build resolves React Native and Expo from mobile/node_modules. Gated with the
@@ -88,26 +108,46 @@ jobs:
           pnpm run build:desktop
           pnpm exec electron-builder --config config/electron-builder.config.cjs --win --publish never
 
-      # Why: install the branch build, open a terminal, update the SAME build
-      # over it, and assert the relocated daemon survives. Same build on both
-      # sides isolates the survival mechanism (NSIS kill sweep + userData daemon
-      # + adoption) from cross-version staleness policy. No --install-dir: a CI
-      # runner has no real Orca to protect.
+      - name: Cache successfully built installer before survival verification
+        if: steps.cache-installer.outputs.cache-hit != 'true'
+        uses: actions/cache/save@v4
+        with:
+          path: dist/orca-windows-setup.exe
+          key: ${{ steps.cache-installer.outputs.cache-primary-key }}
+
+      # A released base also exercises its old uninstaller; default runs isolate this branch.
       - name: Run survival harness
         id: harness
         shell: pwsh
         env:
           ORCA_E2E_DIAG_DIR: artifacts/diag
+          ORCA_BACKGROUND_LAUNCH: '1'
+          DEBUG: 'pw:browser'
+          ORCA_E2E_NSIS_TRACE: ${{ github.workspace }}\artifacts\nsis-process-trace.log
+          ORCA_E2E_PROCESS_POLICY: ${{ inputs.policy || 'inherited' }}
+          FROM_RELEASE: ${{ inputs.from_release }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           New-Item -ItemType Directory -Force artifacts | Out-Null
           $exe = "dist/orca-windows-setup.exe"
           if (-not (Test-Path $exe)) { throw "Installer not found at $exe" }
           $log = "artifacts/survival-output.log"
-          node tests/tools/win-update-e2e/run.mjs `
-            --from "$exe" `
-            --to "$exe" `
-            --expect "$env:EXPECT" `
-            --soak-seconds 60 2>&1 | Tee-Object -FilePath $log
+          $harnessArgs = @('--to', $exe, '--expect', $env:EXPECT, '--soak-seconds', '60')
+          if ($env:FROM_RELEASE) {
+            $harnessArgs += @('--from-release', $env:FROM_RELEASE)
+          } else {
+            $harnessArgs += @('--from', $exe)
+          }
+          # Only the harness and its children inherit the test policy.
+          $launch = @'
+          if (process.env.ORCA_E2E_PROCESS_POLICY === 'Restricted') {
+            process.env.PSExecutionPolicyPreference = 'Restricted'
+          }
+          console.log('Harness child process policy: ' + (process.env.PSExecutionPolicyPreference || 'inherited'))
+          process.argv.splice(1, 0, 'tests/tools/win-update-e2e/run.mjs')
+          await import('./tests/tools/win-update-e2e/run.mjs')
+          '@
+          node --input-type=module -e $launch -- @harnessArgs 2>&1 | Tee-Object -FilePath $log
           exit $LASTEXITCODE
 
       - name: Upload survival output
@@ -117,6 +157,7 @@ jobs:
           name: win-update-survival-output
           path: |
             artifacts/survival-output.log
+            artifacts/nsis-process-trace.log
             artifacts/diag/**
           retention-days: 7
           if-no-files-found: warn
diff --git a/.github/workflows/windows-terminal-restart-e2e.yml b/.github/workflows/windows-terminal-restart-e2e.yml
index abb8dc89aa81..d576ee650499 100644
--- a/.github/workflows/windows-terminal-restart-e2e.yml
+++ b/.github/workflows/windows-terminal-restart-e2e.yml
@@ -22,6 +22,7 @@ jobs:
     timeout-minutes: 30
     env:
       NODE_OPTIONS: --max-old-space-size=4096
+      ORCA_BACKGROUND_LAUNCH: '1'
 
     steps:
       - name: Checkout
diff --git a/.oxfmtrc.json b/.oxfmtrc.json
index 86931f1f9ec6..0a6625f6fe7e 100644
--- a/.oxfmtrc.json
+++ b/.oxfmtrc.json
@@ -6,6 +6,7 @@
   "trailingComma": "none",
   "ignorePatterns": [
     "cloud/**",
+    "resources/licenses/**",
     ".github/actions/cloud-sql-rollout-lease/**",
     ".anti-slop-plugin/**"
   ]
diff --git a/.oxlintrc.json b/.oxlintrc.json
index 7de99d4461ef..7a0753c06e27 100644
--- a/.oxlintrc.json
+++ b/.oxlintrc.json
@@ -143,7 +143,26 @@
     {
       "files": ["src/renderer/src/**/*.{ts,tsx}"],
       "rules": {
-        "renderer-scrollbar-style/require-styled-vertical-scrollbar": "error"
+        "renderer-scrollbar-style/require-styled-vertical-scrollbar": "error",
+        "no-restricted-properties": [
+          "error",
+          {
+            "property": "randomUUID",
+            "message": "crypto.randomUUID is missing in non-secure contexts (Remote Web over plain HTTP), which white-screens the app. Use createBrowserUuid() from '@/lib/browser-uuid'."
+          }
+        ]
+      }
+    },
+    {
+      "files": ["src/shared/**/*.ts"],
+      "rules": {
+        "no-restricted-properties": [
+          "error",
+          {
+            "property": "randomUUID",
+            "message": "src/shared is compiled into the web bundle, where crypto.randomUUID is missing in non-secure contexts (Remote Web over plain HTTP). Use createNonSecureContextUuid() from './non-secure-context-uuid', or import randomUUID from 'node:crypto' in main-only code."
+          }
+        ]
       }
     },
     {
diff --git a/Casks/orca.rb b/Casks/orca.rb
index 6b97b27d52e6..1abc9b3a9124 100644
--- a/Casks/orca.rb
+++ b/Casks/orca.rb
@@ -5,8 +5,7 @@
   sha256 arm:   "fc707f290ff3b631b7b7947bf339885b61a43d2e89475997c125b61268ed4966",
          intel: "5f677c13a08f7a5740442e29d388285a86488c8c1f7aa5f10a8721a2c6ede8e4"
 
-  url "https://github.com/stablyai/orca/releases/download/v#{version}/orca-macos-#{arch}.dmg",
-      verified: "github.com/stablyai/orca/"
+  url "https://github.com/stablyai/orca/releases/download/v#{version}/orca-macos-#{arch}.dmg"
   name "Orca"
   desc "IDE for orchestrating AI coding agents across terminals and worktrees"
   homepage "https://onorca.dev/"
diff --git a/Casks/orca@rc.rb b/Casks/orca@rc.rb
index 63bc843b6407..08eaeeca459f 100644
--- a/Casks/orca@rc.rb
+++ b/Casks/orca@rc.rb
@@ -5,8 +5,7 @@
   sha256 arm:   "563b6b14323fc9d5489299c82442d514bc12cabffc9d06d3964ed572af4b3955",
          intel: "457088c7021f07de1a419197f7b2bd00092741ad4727d4fef3d86af38a6831e7"
 
-  url "https://github.com/stablyai/orca/releases/download/v#{version}/orca-macos-#{arch}.dmg",
-      verified: "github.com/stablyai/orca/"
+  url "https://github.com/stablyai/orca/releases/download/v#{version}/orca-macos-#{arch}.dmg"
   name "Orca RC"
   desc "IDE for orchestrating AI coding agents across terminals and worktrees"
   homepage "https://onorca.dev/"
diff --git a/README.md b/README.md
index 98efc301c2f9..e8722108c200 100644
--- a/README.md
+++ b/README.md
@@ -179,6 +179,7 @@ Works with **any CLI agent** — if it runs in a terminal, it runs in Orca.
   <a href="https://cursor.com/cli"><kbd><img src="https://www.google.com/s2/favicons?domain=cursor.com&sz=64" alt="Cursor logo" width="16" valign="middle" /> Cursor</kbd></a> &nbsp;
   <a href="https://docs.github.com/en/copilot/how-tos/set-up/install-copilot-cli"><kbd><img src="https://www.google.com/s2/favicons?domain=github.com&sz=64" alt="GitHub Copilot logo" width="16" valign="middle" /> GitHub Copilot</kbd></a> &nbsp;
   <a href="https://dev.meta.ai/docs/muse-code"><kbd><img src="src/shared/agent-icons/muse.png" alt="Muse logo" width="16" valign="middle" /> Muse</kbd></a> &nbsp;
+  <a href="https://deepseek-harness.github.io/deepseek-harness/"><kbd><img src="src/shared/agent-icons/dsh.png" alt="DeepSeek Harness logo" width="16" valign="middle" /> DeepSeek Harness</kbd></a> &nbsp;
   <a href="https://zcode.z.ai/en/docs"><kbd><img src="src/shared/agent-icons/zcode.png" alt="ZCode logo" width="16" valign="middle" /> ZCode</kbd></a> &nbsp;
   <a href="https://opencode.ai/docs/cli/"><kbd><img src="https://www.google.com/s2/favicons?domain=opencode.ai&sz=64" alt="OpenCode logo" width="16" valign="middle" /> OpenCode</kbd></a> &nbsp;
   <a href="https://mimo.xiaomi.com/coder"><kbd><img src="https://www.google.com/s2/favicons?domain=mimo.xiaomi.com&sz=64" alt="MiMo Code logo" width="16" valign="middle" /> MiMo Code</kbd></a> &nbsp;
@@ -195,6 +196,7 @@ Works with **any CLI agent** — if it runs in a terminal, it runs in Orca.
   <a href="https://github.com/charmbracelet/crush"><kbd><img src="https://www.google.com/s2/favicons?domain=charm.sh&sz=64" alt="Charm logo" width="16" valign="middle" /> Charm</kbd></a> &nbsp;
   <a href="https://docs.cline.bot/cline-cli/overview"><kbd><img src="https://www.google.com/s2/favicons?domain=cline.bot&sz=64" alt="Cline logo" width="16" valign="middle" /> Cline</kbd></a> &nbsp;
   <a href="https://www.codebuff.com/docs/help/quick-start"><kbd><img src="https://www.google.com/s2/favicons?domain=codebuff.com&sz=64" alt="Codebuff logo" width="16" valign="middle" /> Codebuff</kbd></a> &nbsp;
+  <a href="https://freebuff.com"><kbd><img src="src/shared/agent-icons/freebuff.png" alt="Freebuff logo" width="16" valign="middle" /> Freebuff</kbd></a> &nbsp;
   <a href="https://commandcode.ai/docs/quickstart"><kbd><img src="https://www.google.com/s2/favicons?domain=commandcode.ai&sz=64" alt="Command Code logo" width="16" valign="middle" /> Command Code</kbd></a> &nbsp;
   <a href="https://docs.continue.dev/guides/cli"><kbd><img src="https://www.google.com/s2/favicons?domain=continue.dev&sz=64" alt="Continue logo" width="16" valign="middle" /> Continue</kbd></a> &nbsp;
   <a href="https://docs.factory.ai/cli/getting-started/quickstart"><kbd><img src="docs/assets/droid-logo.svg" alt="Droid logo" width="16" valign="middle" /> Droid</kbd></a> &nbsp;
diff --git a/cloud/apps/push/src/durable-push-claim.test.ts b/cloud/apps/push/src/durable-push-claim.test.ts
index f43588bd2c3d..c7a228a05595 100644
--- a/cloud/apps/push/src/durable-push-claim.test.ts
+++ b/cloud/apps/push/src/durable-push-claim.test.ts
@@ -157,7 +157,7 @@ it('keeps claim, exclusion and prune correct without the queue index', async ()
   for (const claim of leased) await store.finish(claim)
   expect((await store.claim())?.notification.notificationSeq).toBe(2)
   advance(10 * 60_000)
-  expect(await store.prune()).toBe(1)
+  expect(await store.prune()).toEqual({ deleted: 1, saturated: false })
   expect(await batchCount(db)).toBe(0)
 })
 
@@ -211,11 +211,11 @@ it('prunes a large backlog in bounded calls without touching live or leased work
     [JSON.stringify(notification(9)), now - 1, now - 1, now + 1000, now - 1]
   )
   await store.accept('host', 'phone-live', notification(1))
-  expect(await store.prune()).toBe(perCall)
-  expect(await store.prune()).toBe(500)
-  expect(await store.prune()).toBe(0)
+  expect(await store.prune()).toEqual({ deleted: perCall, saturated: true })
+  expect(await store.prune()).toEqual({ deleted: 500, saturated: false })
+  expect(await store.prune()).toEqual({ deleted: 0, saturated: false })
   advance(1000)
-  expect(await store.prune()).toBe(1)
+  expect(await store.prune()).toEqual({ deleted: 1, saturated: false })
   expect(await batchCount(db)).toBe(1)
   expect(await store.pendingCount('phone-live')).toBe(1)
 })
diff --git a/cloud/apps/push/src/durable-push-store.ts b/cloud/apps/push/src/durable-push-store.ts
index 61fed2350184..02d26f20b3e1 100644
--- a/cloud/apps/push/src/durable-push-store.ts
+++ b/cloud/apps/push/src/durable-push-store.ts
@@ -12,6 +12,8 @@ const CLAIM_CANDIDATE_ATTEMPTS = 4
 export const PRUNE_BATCH_ROWS = 2_000
 export const PRUNE_MAX_BATCHES = 50
 export const DELIVERY_LEASE_MS = 30_000
+// `saturated` means the batch budget ran out with rows still matching, so a backlog remains.
+export type PushPruneSweep = { deleted: number; saturated: boolean }
 export type QueuedPushDelivery = {
   id: string
   registrationId: string
@@ -200,10 +202,10 @@ export class DurablePushStore {
   }
 
   // Bounded per call and per statement, so it drains any backlog on its own without holding locks.
-  async prune(): Promise<number> {
+  async prune(): Promise<PushPruneSweep> {
     const now = this.now()
     // Also clears terminal rows older revisions kept, since each carries a past expires_at.
-    let deleted = await this.deleteInBatches(
+    let { deleted, saturated } = await this.deleteInBatches(
       'push_delivery_batches',
       'batch_id',
       'expires_at <= ? AND lease_until <= ?',
@@ -215,9 +217,11 @@ export class DurablePushStore {
       ['push_event_recipients', 'event_id, registration_id'],
       ['push_events', 'event_id']
     ] as const) {
-      deleted += await this.deleteInBatches(table, key, 'created_at < ?', [now - RETENTION_MS])
+      const sweep = await this.deleteInBatches(table, key, 'created_at < ?', [now - RETENTION_MS])
+      deleted += sweep.deleted
+      saturated ||= sweep.saturated
     }
-    return deleted
+    return { deleted, saturated }
   }
 
   private async deleteInBatches(
@@ -225,7 +229,7 @@ export class DurablePushStore {
     key: string,
     where: string,
     params: unknown[]
-  ): Promise<number> {
+  ): Promise<PushPruneSweep> {
     const lockRows = this.background.dialect === 'postgres' ? ' FOR UPDATE SKIP LOCKED' : ''
     let total = 0
     for (let batch = 0; batch < PRUNE_MAX_BATCHES; batch++) {
@@ -235,8 +239,9 @@ export class DurablePushStore {
       )
       const changes = Number(result?.changes ?? 0)
       total += changes
-      if (changes < PRUNE_BATCH_ROWS) break
+      // A short batch drained the predicate; only a full last batch leaves rows behind.
+      if (changes < PRUNE_BATCH_ROWS) return { deleted: total, saturated: false }
     }
-    return total
+    return { deleted: total, saturated: true }
   }
 }
diff --git a/cloud/apps/push/src/push-background.test.ts b/cloud/apps/push/src/push-background.test.ts
new file mode 100644
index 000000000000..21598ef67a21
--- /dev/null
+++ b/cloud/apps/push/src/push-background.test.ts
@@ -0,0 +1,174 @@
+import { afterEach, expect, it, vi } from 'vitest'
+import { startPushBackground } from './push-background.js'
+import { createPushServerHarness } from './push-server-harness.test-fixture.js'
+import { reserveRequestConnection } from './push-background-database.js'
+import { DurablePushStore, PRUNE_BATCH_ROWS, type PushPruneSweep } from './durable-push-store.js'
+import type { PushDatabase } from './push-database.js'
+
+const cleanups: (() => Promise<void>)[] = []
+afterEach(async () => {
+  for (const cleanup of cleanups.splice(0)) await cleanup()
+  vi.useRealTimers()
+  vi.restoreAllMocks()
+})
+
+async function fixture(mode: 'active' | 'validation' = 'active') {
+  const harness = await createPushServerHarness()
+  const runtime = harness.server
+  const challenges = vi.spyOn(runtime.challenges, 'pruneExpired').mockResolvedValue(0)
+  const sessions = vi.spyOn(runtime.sessions, 'pruneExpired').mockResolvedValue(0)
+  const deliveries = vi
+    .spyOn(runtime.deliveryStore, 'prune')
+    .mockResolvedValue({ deleted: 0, saturated: false })
+  vi.spyOn(runtime.worker, 'start').mockImplementation(() => {})
+  const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+  vi.useFakeTimers()
+  const stop = startPushBackground({ mode }, runtime)
+  cleanups.push(async () => {
+    await stop()
+    await harness.close()
+  })
+  return { stop, challenges, sessions, deliveries, warn }
+}
+
+it('keeps one slow sweep per store while other stores keep their cadence', async () => {
+  const h = await fixture()
+  let finish!: (sweep: PushPruneSweep) => void
+  h.deliveries.mockImplementationOnce(
+    () => new Promise<PushPruneSweep>((resolve) => (finish = resolve))
+  )
+  try {
+    await vi.advanceTimersByTimeAsync(10 * 60_000)
+    expect(h.deliveries).toHaveBeenCalledTimes(1)
+    expect(h.challenges).toHaveBeenCalledTimes(10)
+    expect(h.sessions).toHaveBeenCalledTimes(1)
+  } finally {
+    finish({ deleted: 100_000, saturated: false })
+  }
+  await vi.advanceTimersByTimeAsync(60_000)
+  expect(h.deliveries).toHaveBeenCalledTimes(2)
+  await h.stop()
+  await vi.advanceTimersByTimeAsync(10 * 60_000)
+  expect(h.deliveries).toHaveBeenCalledTimes(2)
+  expect(h.challenges).toHaveBeenCalledTimes(11)
+  expect(h.sessions).toHaveBeenCalledTimes(1)
+})
+
+it('reports a sweep that is still running a full interval after it started', async () => {
+  const h = await fixture()
+  let finish!: (sweep: PushPruneSweep) => void
+  h.deliveries.mockImplementationOnce(
+    () => new Promise<PushPruneSweep>((resolve) => (finish = resolve))
+  )
+  try {
+    await vi.advanceTimersByTimeAsync(119_999)
+    expect(h.warn).not.toHaveBeenCalled()
+    await vi.advanceTimersByTimeAsync(1)
+    expect(h.warn).toHaveBeenCalledWith(
+      JSON.stringify({ event: 'orca_push_prune_overdue', target: 'deliveries' })
+    )
+  } finally {
+    finish({ deleted: 0, saturated: false })
+  }
+  // One report per sweep: the settled sweep clears its own watchdog.
+  await vi.advanceTimersByTimeAsync(10 * 60_000)
+  expect(h.warn).toHaveBeenCalledTimes(1)
+})
+
+it('releases a failed sweep so the next scheduled sweep can recover', async () => {
+  const h = await fixture()
+  h.deliveries.mockRejectedValueOnce(new Error('database unavailable'))
+  await vi.advanceTimersByTimeAsync(60_000)
+  expect(h.deliveries).toHaveBeenCalledTimes(1)
+  expect(h.warn).toHaveBeenCalledWith(
+    JSON.stringify({ event: 'orca_push_prune_failed', target: 'deliveries', error: 'Error' })
+  )
+  await vi.advanceTimersByTimeAsync(60_000)
+  expect(h.deliveries).toHaveBeenCalledTimes(2)
+  expect(h.warn).toHaveBeenCalledTimes(1)
+})
+
+it('resumes a saturated sweep at once rather than waiting out the interval', async () => {
+  const h = await fixture()
+  let backlogSweeps = 3
+  h.deliveries.mockImplementation(async () => {
+    const saturated = backlogSweeps-- > 0
+    return { deleted: saturated ? PRUNE_BATCH_ROWS : 0, saturated }
+  })
+  await vi.advanceTimersByTimeAsync(60_000)
+  expect(h.deliveries).toHaveBeenCalledTimes(1)
+  // Three saturated sweeps resume within milliseconds instead of costing an interval each.
+  await vi.advanceTimersByTimeAsync(10)
+  expect(h.deliveries).toHaveBeenCalledTimes(4)
+  await vi.advanceTimersByTimeAsync(59_000)
+  expect(h.deliveries).toHaveBeenCalledTimes(4)
+  await vi.advanceTimersByTimeAsync(1_000)
+  expect(h.deliveries).toHaveBeenCalledTimes(5)
+})
+
+it('keeps a delivery claim behind one statement while a backlog drains back to back', async () => {
+  const h = await fixture()
+  let backlog = true
+  let finishedDeletes = 0
+  const database: PushDatabase = {
+    dialect: 'postgres',
+    query: async (sql) => {
+      if (!sql.startsWith('DELETE')) return []
+      await new Promise((resolve) => setTimeout(resolve, 4_000))
+      finishedDeletes++
+      // Only deliveries hold a backlog, so each sweep spends its whole budget there and returns.
+      if (!backlog || !sql.includes('push_delivery_batches')) return [{ changes: 0 }]
+      return [{ changes: PRUNE_BATCH_ROWS }]
+    },
+    transaction: (operation) => operation(database),
+    lockQuotaScope: async () => {},
+    tryLockScope: async () => true,
+    tryLockSharedScope: async () => true,
+    close: async () => {}
+  }
+  const store = new DurablePushStore(database, Date.now, reserveRequestConnection(database, 2))
+  const sweeps: Promise<PushPruneSweep>[] = []
+  let inFlight = 0
+  let concurrentSweeps = 0
+  h.deliveries.mockImplementation(() => {
+    concurrentSweeps = Math.max(concurrentSweeps, ++inFlight)
+    const sweep = store.prune().finally(() => void inFlight--)
+    sweeps.push(sweep)
+    return sweep
+  })
+  try {
+    await vi.advanceTimersByTimeAsync(10 * 60_000)
+    const queuedAt = finishedDeletes
+    const startedAt = Date.now()
+    let statementsAhead: number | undefined
+    let claimDelay: number | undefined
+    const claim = store.claim().then(() => {
+      statementsAhead = finishedDeletes - queuedAt
+      claimDelay = Date.now() - startedAt
+    })
+    await vi.advanceTimersByTimeAsync(44_000)
+    await claim
+    // Sweeping serially parks one statement ahead of the claim no matter how long the drain runs.
+    expect({ statementsAhead, concurrentSweeps }).toEqual({
+      statementsAhead: 1,
+      concurrentSweeps: 1
+    })
+    expect(claimDelay).toBeLessThanOrEqual(4_000)
+    // Each sweep exhausts its 50-batch budget, so the drain continues instead of idling out the tick.
+    expect(sweeps.length).toBeGreaterThan(1)
+  } finally {
+    await h.stop()
+    backlog = false
+    await vi.advanceTimersByTimeAsync(10 * 60_000)
+    await Promise.all(sweeps)
+  }
+})
+
+it('keeps validation mode free of sweeps and timers', async () => {
+  const h = await fixture('validation')
+  await vi.advanceTimersByTimeAsync(20 * 60_000)
+  expect(h.challenges).not.toHaveBeenCalled()
+  expect(h.sessions).not.toHaveBeenCalled()
+  expect(h.deliveries).not.toHaveBeenCalled()
+  expect(vi.getTimerCount()).toBe(0)
+})
diff --git a/cloud/apps/push/src/push-background.ts b/cloud/apps/push/src/push-background.ts
index 8925fd41fedd..9fad4700e7b5 100644
--- a/cloud/apps/push/src/push-background.ts
+++ b/cloud/apps/push/src/push-background.ts
@@ -1,26 +1,55 @@
 import type { PushConfig } from './config.js'
+import type { PushPruneSweep } from './durable-push-store.js'
 import type { createPushServer } from './push-server.js'
 
 const CHALLENGE_PRUNE_INTERVAL_MS = 60_000
 const SESSION_PRUNE_INTERVAL_MS = 10 * 60_000
 const DELIVERY_PRUNE_INTERVAL_MS = 60_000
 
-function prune(label: string, run: () => Promise<number>, intervalMs: number): NodeJS.Timeout {
-  const timer = setInterval(() => {
-    void run().catch((error: unknown) => {
-      console.warn(
-        JSON.stringify({
-          event: 'orca_push_prune_failed',
-          target: label,
-          error: error instanceof Error ? error.name : 'unknown'
-        })
-      )
-    })
-  }, intervalMs)
-  timer.unref()
-  return timer
+// Chained rather than periodic, so a sweep spanning many bounded statements never overlaps itself and
+// one that exhausted its batch budget resumes at once instead of idling out the rest of the interval.
+function prune(label: string, run: () => Promise<PushPruneSweep>, intervalMs: number): () => void {
+  let timer: NodeJS.Timeout | undefined
+  let overdue: NodeJS.Timeout | undefined
+  let stopped = false
+  function schedule(delayMs: number): void {
+    if (stopped) return
+    timer = setTimeout(tick, delayMs)
+    timer.unref()
+  }
+  function tick(): void {
+    // Admission waits are untimed, so a lost slot release would otherwise stall retention silently.
+    overdue = setTimeout(() => {
+      console.warn(JSON.stringify({ event: 'orca_push_prune_overdue', target: label }))
+    }, intervalMs)
+    overdue.unref()
+    void run()
+      .then((sweep) => schedule(sweep.saturated ? 0 : intervalMs))
+      .catch((error: unknown) => {
+        console.warn(
+          JSON.stringify({
+            event: 'orca_push_prune_failed',
+            target: label,
+            error: error instanceof Error ? error.name : 'unknown'
+          })
+        )
+        schedule(intervalMs)
+      })
+      .finally(() => clearTimeout(overdue))
+  }
+  schedule(intervalMs)
+  return () => {
+    stopped = true
+    clearTimeout(timer)
+    clearTimeout(overdue)
+  }
 }
 
+// One DELETE under a statement timeout: there is no batch budget for it to exhaust.
+const unbatchedSweep =
+  (run: () => Promise<number>) =>
+  async (): Promise<PushPruneSweep> => ({ deleted: await run(), saturated: false })
+
 export function startPushBackground(
   config: Pick<PushConfig, 'mode'>,
   runtime: Pick<
@@ -30,14 +59,22 @@ export function startPushBackground(
 ): () => Promise<void> {
   if (config.mode === 'validation') return async () => {}
   const { challenges, sessions, deliveryStore, worker } = runtime
-  const timers = [
-    prune('challenges', () => challenges.pruneExpired(), CHALLENGE_PRUNE_INTERVAL_MS),
-    prune('sessions', () => sessions.pruneExpired(), SESSION_PRUNE_INTERVAL_MS),
+  const stops = [
+    prune(
+      'challenges',
+      unbatchedSweep(() => challenges.pruneExpired()),
+      CHALLENGE_PRUNE_INTERVAL_MS
+    ),
+    prune(
+      'sessions',
+      unbatchedSweep(() => sessions.pruneExpired()),
+      SESSION_PRUNE_INTERVAL_MS
+    ),
     prune('deliveries', () => deliveryStore.prune(), DELIVERY_PRUNE_INTERVAL_MS)
   ]
   worker.start()
   return async () => {
-    for (const timer of timers) clearInterval(timer)
+    for (const stop of stops) stop()
     await worker.stop()
   }
 }
diff --git a/cloud/apps/push/src/push-database.ts b/cloud/apps/push/src/push-database.ts
index b1a7415297b1..9957a7c28b52 100644
--- a/cloud/apps/push/src/push-database.ts
+++ b/cloud/apps/push/src/push-database.ts
@@ -85,15 +85,17 @@ class SqliteDatabase extends SqliteTransaction {
     let release!: () => void
     this.tail = new Promise((resolve) => (release = resolve))
     await previous
-    this.database.exec('BEGIN IMMEDIATE')
-    const transaction = new SqliteTransaction(this.database)
     try {
-      const result = await operation(transaction)
-      this.database.exec('COMMIT')
-      return result
-    } catch (error) {
-      this.database.exec('ROLLBACK')
-      throw error
+      this.database.exec('BEGIN IMMEDIATE')
+      const transaction = new SqliteTransaction(this.database)
+      try {
+        const result = await operation(transaction)
+        this.database.exec('COMMIT')
+        return result
+      } catch (error) {
+        this.database.exec('ROLLBACK')
+        throw error
+      }
     } finally {
       release()
     }
diff --git a/cloud/apps/push/src/sqlite-transaction-queue.test.ts b/cloud/apps/push/src/sqlite-transaction-queue.test.ts
new file mode 100644
index 000000000000..1ee5e8b3d52a
--- /dev/null
+++ b/cloud/apps/push/src/sqlite-transaction-queue.test.ts
@@ -0,0 +1,101 @@
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { DatabaseSync } from 'node:sqlite'
+import { setImmediate } from 'node:timers/promises'
+import { expect, it, vi } from 'vitest'
+import { openPushDatabase } from './push-database.js'
+
+it('releases queued work and close after a SQLite transaction cannot acquire its lock', async () => {
+  const dataDir = mkdtempSync(join(tmpdir(), 'orca-push-sqlite-queue-'))
+  let connection: DatabaseSync | undefined
+  const prepare = DatabaseSync.prototype.prepare
+  // Keep the native handle reachable for cleanup even if a queue regression strands close().
+  const capture = vi
+    .spyOn(DatabaseSync.prototype, 'prepare')
+    .mockImplementation(function (this: DatabaseSync, sql) {
+      connection = this
+      return prepare.call(this, sql)
+    })
+  const database = await openPushDatabase({ dataDir })
+  capture.mockRestore()
+  const blocker = new DatabaseSync(join(dataDir, 'orca-push.sqlite'))
+  try {
+    await database.query('CREATE TABLE queue_progress (value INTEGER)')
+    await database.query('INSERT INTO queue_progress VALUES (0)')
+    blocker.exec('BEGIN IMMEDIATE')
+    const operation = vi.fn(async () => undefined)
+    await expect(database.transaction(operation)).rejects.toThrow('database is locked')
+    let lockFailures = 0
+    const blocked = Array.from({ length: 5 }, () =>
+      database.transaction(operation).catch(() => {
+        lockFailures += 1
+      })
+    )
+    await setImmediate()
+    expect(lockFailures).toBe(5)
+    await Promise.all(blocked)
+    expect(operation).not.toHaveBeenCalled()
+    blocker.exec('ROLLBACK')
+    let completed = 0
+    const pending = Array.from({ length: 100 }, () =>
+      database.transaction(async (transaction) => {
+        await transaction.query('UPDATE queue_progress SET value = value + 1')
+        completed += 1
+      })
+    )
+    for (const request of pending) void request.catch(() => undefined)
+    await setImmediate()
+    expect(completed).toBe(100)
+    await Promise.all(pending)
+    expect(await database.query('SELECT value FROM queue_progress')).toEqual([{ value: 100 }])
+    let closed = false
+    const closing = database.close().then(() => {
+      closed = true
+    })
+    await setImmediate()
+    expect(closed).toBe(true)
+    await closing
+  } finally {
+    capture.mockRestore()
+    blocker.close()
+    if (connection?.isOpen) connection.close()
+    rmSync(dataDir, { recursive: true, force: true })
+  }
+})
+
+it('does not roll back a transaction when BEGIN failed before taking ownership', async () => {
+  const dataDir = mkdtempSync(join(tmpdir(), 'orca-push-sqlite-owner-'))
+  let connection: DatabaseSync | undefined
+  const prepare = DatabaseSync.prototype.prepare
+  const capture = vi
+    .spyOn(DatabaseSync.prototype, 'prepare')
+    .mockImplementation(function (this: DatabaseSync, sql) {
+      connection = this
+      return prepare.call(this, sql)
+    })
+  const database = await openPushDatabase({ dataDir })
+  capture.mockRestore()
+  try {
+    await database.query('CREATE TABLE queue_owner (value INTEGER)')
+    await database.query('BEGIN IMMEDIATE')
+    await database.query('INSERT INTO queue_owner VALUES (7)')
+    await expect(database.transaction(async () => undefined)).rejects.toThrow(
+      'cannot start a transaction within a transaction'
+    )
+    expect(connection?.isTransaction).toBe(true)
+    let rows: unknown
+    void database.query('SELECT value FROM queue_owner').then((result) => {
+      rows = result
+    })
+    await setImmediate()
+    expect(rows).toEqual([{ value: 7 }])
+    await database.query('ROLLBACK')
+    expect(await database.query('SELECT value FROM queue_owner')).toEqual([])
+    await database.close()
+  } finally {
+    capture.mockRestore()
+    if (connection?.isOpen) connection.close()
+    rmSync(dataDir, { recursive: true, force: true })
+  }
+})
diff --git a/cloud/apps/relay/src/assignment-headroom-scope.test.ts b/cloud/apps/relay/src/assignment-headroom-scope.test.ts
new file mode 100644
index 000000000000..9862849d8e0e
--- /dev/null
+++ b/cloud/apps/relay/src/assignment-headroom-scope.test.ts
@@ -0,0 +1,129 @@
+import { afterEach, describe, expect, it } from 'vitest'
+import { RelayAssignmentStore } from './assignment-store.js'
+import { openInMemoryRelayDatabase, type RelayDatabase } from './database.js'
+
+const NOW = 100_000
+const CELL_COUNT = 32
+const identity = { userId: 'headroom-user', relayHostId: 'headroomhost0001' }
+
+function observeHeadroom(database: RelayDatabase, rowCounts: number[]): RelayDatabase {
+  return {
+    dialect: database.dialect,
+    async query(sql, params) {
+      const rows = await database.query(sql, params)
+      if (sql.includes('FROM relay_cell_connection_limits limits')) rowCounts.push(rows.length)
+      return rows
+    },
+    queryLocked: (sql, params, options) => database.queryLocked(sql, params, options),
+    transaction: (operation, options) =>
+      database.transaction((transaction) => operation(observeHeadroom(transaction, rowCounts)), options),
+    close: () => database.close()
+  }
+}
+
+describe('assignment headroom query scope', () => {
+  let database: RelayDatabase | undefined
+  afterEach(async () => await database?.close())
+
+  async function setup() {
+    database = await openInMemoryRelayDatabase()
+    const rowCounts: number[] = []
+    const store = new RelayAssignmentStore(observeHeadroom(database, rowCounts), () => NOW, {
+      requireLiveCells: true,
+      heartbeatTtlMs: 45_000
+    })
+    const cells = Array.from({ length: CELL_COUNT }, (_, index) => ({
+      id: `cell-${String(index).padStart(2, '0')}`,
+      url: `https://cell-${index}.example.com`,
+      capacityRequests: 1_000,
+      connectionHardCap: 600 as const,
+      connectionUnobservedBound: 50
+    }))
+    await store.reconcileCells(cells)
+    for (const cell of cells) {
+      await store.recordCellHeartbeat({
+        cellId: cell.id,
+        cellUrl: cell.url,
+        cellIncarnation: '11111111-1111-4111-8111-111111111111',
+        startedAt: NOW - 10,
+        ready: true,
+        observedRequests: 0,
+        totalConnections: 0,
+        inFlightConnections: 0,
+        reservedConnectionUnits: 0,
+        enforcedConnectionUnits: 0,
+        connectionHardCap: 600,
+        connectionUnobservedBound: 50
+      })
+    }
+    await database.query(
+      `INSERT INTO relay_assignments
+       (user_id, relay_host_id, cell_id, assignment_epoch, lease_expires_at,
+        last_activity_at, reserved_controls, reserved_splices, reserved_invites,
+        pending_installs, pending_confirmations, migration_leases)
+       VALUES (?, ?, 'cell-00', 1, ?, ?, 0, 0, 0, 0, 0, 0)`,
+      [identity.userId, identity.relayHostId, NOW + 90_000, NOW]
+    )
+    await store.acquireActivity(identity, {
+      activityId: 'existing-splice',
+      kind: 'splice',
+      cellId: 'cell-00'
+    })
+    rowCounts.length = 0
+    return { store, rowCounts, database }
+  }
+
+  it('reads one cell for a sticky assignment even when the capped fleet grows', async () => {
+    const { store, rowCounts } = await setup()
+    await expect(store.assign(identity)).resolves.toMatchObject({
+      ...identity,
+      cellId: 'cell-00',
+      assignmentEpoch: 1
+    })
+    console.info('sticky headroom rows', { fleetCells: CELL_COUNT, rowCounts })
+    expect(rowCounts).toEqual([1])
+  })
+
+  it('still considers the full fleet for a new placement', async () => {
+    const { store, rowCounts } = await setup()
+    await expect(
+      store.assign({ userId: 'new-user', relayHostId: 'newheadroomhost1' })
+    ).resolves.toMatchObject({ cellId: 'cell-01', assignmentEpoch: 1 })
+    expect(rowCounts).toEqual([CELL_COUNT])
+  })
+
+  it.each([
+    ['missing snapshot', `DELETE FROM relay_cell_connection_snapshots WHERE cell_id = 'cell-00'`],
+    ['expired snapshot', `UPDATE relay_cell_connection_snapshots SET snapshot_at = ${NOW - 45_000} WHERE cell_id = 'cell-00'`],
+    ['old incarnation', `UPDATE relay_cell_connection_snapshots SET cell_incarnation = 'old' WHERE cell_id = 'cell-00'`],
+    ['capacity boundary', `UPDATE relay_cell_connection_snapshots SET enforced_connection_units = 450 WHERE cell_id = 'cell-00'`]
+  ])('rejects the pinned active host with %s', async (_name, sql) => {
+    const { store, database } = await setup()
+    await database.query(sql)
+    await expect(store.assign(identity)).rejects.toThrow('relay_connection_headroom_exhausted')
+  })
+
+  it('preserves admission for cells without a connection limit', async () => {
+    const { store, rowCounts, database } = await setup()
+    await database.query(`DELETE FROM relay_cell_connection_limits WHERE cell_id = 'cell-00'`)
+    await expect(store.assign(identity)).resolves.toMatchObject({ cellId: 'cell-00' })
+    expect(rowCounts).toEqual([0])
+  })
+
+  it('counts outstanding reservations at the admission boundary', async () => {
+    const { store, database } = await setup()
+    await database.query(
+      `UPDATE relay_cell_connection_snapshots SET enforced_connection_units = 449
+       WHERE cell_id = 'cell-00'`
+    )
+    await database.query(
+      `INSERT INTO relay_control_connection_reservations
+       (reservation_id, idempotency_key, user_id, relay_host_id, assignment_epoch,
+        cell_id, state, created_at, timeout_at, updated_at)
+       VALUES ('pending', 'pending', 'other-user', 'other-host', 1,
+        'cell-00', 'reserved', ?, ?, ?)`,
+      [NOW, NOW + 90_000, NOW]
+    )
+    await expect(store.assign(identity)).rejects.toThrow('relay_connection_headroom_exhausted')
+  })
+})
diff --git a/cloud/apps/relay/src/assignment-store.ts b/cloud/apps/relay/src/assignment-store.ts
index 3cb5dcfeee9f..3572a69299cc 100644
--- a/cloud/apps/relay/src/assignment-store.ts
+++ b/cloud/apps/relay/src/assignment-store.ts
@@ -7466,10 +7466,16 @@ export class RelayAssignmentStore {
   }
 
   private async connectionHeadroomByCell(
-    database: RelayDatabase
+    database: RelayDatabase,
+    cellId?: string
   ): Promise<Map<string, boolean>> {
     const now = this.now()
-    const rows = await database.query(ASSIGNMENT_CONNECTION_HEADROOM_QUERY)
+    const rows = await database.query(
+      cellId === undefined
+        ? ASSIGNMENT_CONNECTION_HEADROOM_QUERY
+        : `${ASSIGNMENT_CONNECTION_HEADROOM_QUERY} WHERE limits.cell_id = ?`,
+      cellId === undefined ? [] : [cellId]
+    )
     return new Map(
       rows.map((row) => {
         const heartbeat = optionalInteger(row, 'last_heartbeat_at')
@@ -7503,7 +7509,7 @@ export class RelayAssignmentStore {
     database: RelayDatabase,
     cellId: string
   ): Promise<boolean> {
-    return (await this.connectionHeadroomByCell(database)).get(cellId) !== false
+    return (await this.connectionHeadroomByCell(database, cellId)).get(cellId) !== false
   }
 
   private async cellIsLive(
diff --git a/cloud/apps/relay/src/database.ts b/cloud/apps/relay/src/database.ts
index db1203bc45cb..6a8a1fc202ab 100644
--- a/cloud/apps/relay/src/database.ts
+++ b/cloud/apps/relay/src/database.ts
@@ -852,16 +852,18 @@ class SqliteDatabase extends SqliteTransaction {
     let release!: () => void
     this.tail = new Promise((resolve) => (release = resolve))
     await previous
-    this.database.exec('BEGIN IMMEDIATE')
-    const transaction = new SqliteTransaction(this.database)
     try {
-      const result = await operation(transaction)
-      this.database.exec('COMMIT')
-      recordMeasuredHold(this.holds, transaction)
-      return result
-    } catch (error) {
-      this.database.exec('ROLLBACK')
-      throw error
+      this.database.exec('BEGIN IMMEDIATE')
+      const transaction = new SqliteTransaction(this.database)
+      try {
+        const result = await operation(transaction)
+        this.database.exec('COMMIT')
+        recordMeasuredHold(this.holds, transaction)
+        return result
+      } catch (error) {
+        this.database.exec('ROLLBACK')
+        throw error
+      }
     } finally {
       release()
     }
diff --git a/cloud/apps/relay/src/host-session-registry.test.ts b/cloud/apps/relay/src/host-session-registry.test.ts
index 69697cce60e4..fcf73695b40a 100644
--- a/cloud/apps/relay/src/host-session-registry.test.ts
+++ b/cloud/apps/relay/src/host-session-registry.test.ts
@@ -535,6 +535,8 @@ describe('host session cleanup races', () => {
     const socket = new FakeSocket()
 
     const activation = activate(socket as unknown as WebSocket, identity, null, 1, false, 1)
+    await vi.advanceTimersByTimeAsync(0)
+    expect(activateControl).toHaveBeenCalledOnce()
     socket.close()
     blocked.resolve('control:production-gce-c3:1')
     await activation
@@ -560,6 +562,8 @@ describe('host session cleanup races', () => {
 
     const rebindSocket = new FakeSocket()
     const rebinding = activate(rebindSocket as unknown as WebSocket, identity, original, 1, true, 1)
+    await vi.advanceTimersByTimeAsync(0)
+    expect(activateControl).toHaveBeenCalledTimes(2)
     rebindSocket.close()
     blocked.resolve('control:production-gce-c3:1')
     await rebinding
@@ -574,6 +578,49 @@ describe('host session cleanup races', () => {
     )
   })
 
+  it('skips a closed queued control so its live retry avoids abandoned database work', async () => {
+    const stalled = deferred<string>()
+    const activateControl = vi
+      .fn<RelayAssignmentStore['activateControl']>()
+      .mockReturnValueOnce(stalled.promise)
+      .mockImplementation(async () => {
+        await new Promise<void>((resolve) => setTimeout(resolve, 4_000))
+        return 'control:production-gce-c3:1'
+      })
+    const { registry, activate, releaseActivity } = createRegistry(activateControl)
+    const firstSocket = new FakeSocket()
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: FakeSocket implements the registry's WebSocket event and lifecycle surface.
+    const first = activate(firstSocket as unknown as WebSocket, identity, null, 1, false, 1)
+    await vi.advanceTimersByTimeAsync(0)
+    expect(activateControl).toHaveBeenCalledOnce()
+    const abandonedSocket = new FakeSocket()
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: FakeSocket implements the registry's WebSocket event and lifecycle surface.
+    const abandoned = activate(abandonedSocket as unknown as WebSocket, identity, null, 1, false, 1)
+    const liveSocket = new FakeSocket()
+    const startedAt = Date.now()
+    let liveCompletedAt: number | undefined
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: FakeSocket implements the registry's WebSocket event and lifecycle surface.
+    const live = activate(liveSocket as unknown as WebSocket, identity, null, 1, false, 1)
+      .then(() => { liveCompletedAt = Date.now() })
+    firstSocket.close()
+    abandonedSocket.close()
+    stalled.resolve('control:production-gce-c3:1')
+    await vi.advanceTimersByTimeAsync(8_000)
+    await Promise.all([first, abandoned, live])
+
+    console.log(JSON.stringify({
+      scenario: 'closed queued control before a live retry',
+      activationCalls: activateControl.mock.calls.length,
+      activityReleases: releaseActivity.mock.calls.length,
+      liveReadyMs: liveCompletedAt === undefined ? null : liveCompletedAt - startedAt
+    }))
+    expect(activateControl).toHaveBeenCalledTimes(2)
+    expect(releaseActivity).toHaveBeenCalledOnce()
+    expect(liveCompletedAt! - startedAt).toBe(4_000)
+    expect(registry.get({ userId: identity.sub, relayHostId: identity.relayHostId })?.socket)
+      .toBe(liveSocket)
+  })
+
   it('rejects client lookup when the indexed control socket is not open', async () => {
     const reservation = {
       userId: identity.sub,
diff --git a/cloud/apps/relay/src/host-session-registry.ts b/cloud/apps/relay/src/host-session-registry.ts
index 380ccfbc9c65..4e3372ce6923 100644
--- a/cloud/apps/relay/src/host-session-registry.ts
+++ b/cloud/apps/relay/src/host-session-registry.ts
@@ -1103,7 +1103,7 @@ export class HostSessionRegistry {
       .catch(() => undefined)
       .then(async () => {
         clearTimeout(queueWaitTimer)
-        if (queueWaitExpired) return
+        if (queueWaitExpired || socket.readyState !== socket.OPEN) return
         if ((this.sessions.get(key) ?? null) !== existing) {
           socket.close(RELAY_CLOSE_CODE.PEER_DROPPED, 'control activation superseded')
           return
diff --git a/cloud/apps/relay/src/relay-first-frame-close.blackbox.test.ts b/cloud/apps/relay/src/relay-first-frame-close.blackbox.test.ts
new file mode 100644
index 000000000000..8a3d797cdfb9
--- /dev/null
+++ b/cloud/apps/relay/src/relay-first-frame-close.blackbox.test.ts
@@ -0,0 +1,272 @@
+import { connect, type Socket } from 'node:net'
+import { afterEach, expect, it, vi } from 'vitest'
+import { RELAY_CLOSE_CODE, RELAY_PROTOCOL_LIMITS } from '@orca-cloud/relay-contract'
+import { loadRelayConfig } from './config.js'
+import type { RelayDatabase } from './database.js'
+import { createRelayServer } from './relay-server.js'
+
+const cleanups: (() => Promise<void> | void)[] = []
+afterEach(async () => {
+  for (const cleanup of cleanups.splice(0).reverse()) await cleanup()
+  vi.restoreAllMocks()
+})
+
+const IDLE_LEDGER = {
+  physicalConnections: 0,
+  inFlightConnections: 0,
+  reservedConnectionUnits: 0,
+  enforcedConnectionUnits: 0
+}
+
+async function fixture(
+  options: { role?: 'cell' | 'director'; hardCap?: number } = {}
+) {
+  const role = options.role ?? 'cell'
+  const database: RelayDatabase = {
+    query: vi.fn(async () => []),
+    queryLocked: vi.fn(async () => []),
+    transaction: (operation) => operation(database),
+    close: async () => {}
+  }
+  const config = loadRelayConfig({
+    ORCA_RELAY_PUBLIC_URL: 'http://127.0.0.1',
+    ORCA_RELAY_CELL_URL: 'http://127.0.0.1',
+    ORCA_RELAY_AUTH_ISSUER: 'https://auth.example.test',
+    ORCA_RELAY_JWKS_URL: 'https://auth.example.test/jwks',
+    ORCA_RELAY_ASSIGNMENT_SIGNING_KEY: 'synthetic-assignment-key-for-test-only',
+    ORCA_RELAY_ROLE: role,
+    ORCA_RELAY_ADMIN_AUDIENCE: 'https://auth.example.test/admin',
+    ORCA_RELAY_DEPLOY_SERVICE_ACCOUNT: 'deploy@example.test',
+    ORCA_RELAY_CELL_CONNECTION_HARD_CAP: '600',
+    ORCA_RELAY_CELL_CONNECTION_UNOBSERVED_BOUND: '60',
+    ...(role === 'director'
+      ? {
+          ORCA_RELAY_CELLS_JSON: JSON.stringify([
+            { id: 'cell-1', url: 'https://cell-1.example.test', capacityRequests: 900 }
+          ])
+        }
+      : {})
+  })
+  const relay = createRelayServer(config, database, {
+    connectionLedgerLimits: { hardCap: options.hardCap ?? 3, controlReserve: 1 }
+  })
+  await new Promise<void>((resolve) => relay.server.listen(0, '127.0.0.1', resolve))
+  cleanups.push(() => new Promise<void>((resolve) => relay.server.close(() => resolve())))
+  const address = relay.server.address()
+  if (!address || typeof address === 'string') throw new Error('missing test port')
+  return { relay, port: address.port, database }
+}
+
+type RawPeer = {
+  socket: Socket
+  received: () => Buffer
+  transport: () => { ended: boolean; error: string | null }
+}
+
+async function silentUpgrade(port: number, target: string): Promise<RawPeer> {
+  const socket = connect(port, '127.0.0.1')
+  cleanups.push(() => {
+    socket.destroy()
+  })
+  await new Promise<void>((resolve, reject) => {
+    let header = ''
+    socket.once('error', reject)
+    socket.once('connect', () => {
+      socket.write(
+        `GET ${target} HTTP/1.1\r\nHost: 127.0.0.1\r\nConnection: Upgrade\r\n` +
+          'Upgrade: websocket\r\nSec-WebSocket-Version: 13\r\n' +
+          // RFC 6455 example nonce, matching the existing raw-upgrade fixture.
+          'Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==\r\n\r\n'
+      )
+    })
+    const readHeader = (chunk: Buffer): void => {
+      header += chunk.toString()
+      if (!header.includes('\r\n\r\n')) return
+      socket.off('data', readHeader)
+      if (header.startsWith('HTTP/1.1 101 ')) resolve()
+      else reject(new Error(header.split('\r\n')[0]))
+    }
+    socket.on('data', readHeader)
+  })
+  socket.removeAllListeners('error')
+  // This raw peer reads frames without answering the server's close handshake.
+  const chunks: Buffer[] = []
+  let ended = false
+  let error: string | null = null
+  socket.on('data', (chunk: Buffer) => chunks.push(chunk))
+  socket.on('end', () => {
+    ended = true
+  })
+  socket.on('error', (caught: Error) => {
+    error = caught.message
+  })
+  return {
+    socket,
+    received: () => Buffer.concat(chunks),
+    transport: () => ({ ended, error })
+  }
+}
+
+// A 43-character base64url credential is the shortest value RelayAuthSchema accepts.
+const WELL_FORMED_CREDENTIAL = 'abcdefghijklmnopqrstuvwxyzABCDEFGH012345678'
+
+function maskedTextFrame(payload: string): Buffer {
+  const body = Buffer.from(payload)
+  const mask = Buffer.from([1, 2, 3, 4])
+  const masked = Buffer.from(body.map((byte, index) => byte ^ mask[index % 4]!))
+  return Buffer.concat([Buffer.from([0x81, 0x80 | body.length]), mask, masked])
+}
+
+function relayAuthFrame(): Buffer {
+  return maskedTextFrame(
+    JSON.stringify({
+      type: 'relay-auth',
+      v: 1,
+      mode: 'connect',
+      credential: WELL_FORMED_CREDENTIAL
+    })
+  )
+}
+
+// The close frame is the last unmasked frame a rejected peer receives: 0x88, length,
+// then a big-endian status code followed by the UTF-8 reason.
+function readCloseFrame(received: Buffer): { code: number; reason: string } | null {
+  const start = received.lastIndexOf(0x88)
+  if (start < 0 || received.length < start + 4) return null
+  const length = received[start + 1]!
+  return {
+    code: received.readUInt16BE(start + 2),
+    reason: received.subarray(start + 4, start + 2 + length).toString('utf8')
+  }
+}
+
+async function expectIdleLedger(
+  relay: Awaited<ReturnType<typeof fixture>>['relay'],
+  timeout: number
+): Promise<void> {
+  await vi.waitFor(() => expect(relay.connectionSnapshot()).toMatchObject(IDLE_LEDGER), { timeout })
+}
+
+const PHONE_TARGET = '/v1/connect/abcdefghijklmnop'
+
+it.each([
+  { label: 'first-frame timeout', target: PHONE_TARGET, opcode: undefined },
+  { label: 'binary first frame', target: PHONE_TARGET, opcode: 0x82 },
+  { label: 'invalid phone auth', target: PHONE_TARGET, opcode: 0x81 },
+  { label: 'invalid host-data auth', target: '/v1/host/data/connection-1', opcode: 0x81 }
+])(
+  'releases admission after $label even when the peer ignores close',
+  async ({ target, opcode }) => {
+    const { relay, port, database } = await fixture()
+    const peer = await silentUpgrade(port, target)
+    const firstFrameDeadline = opcode === undefined ? RELAY_PROTOCOL_LIMITS.firstFrameDeadlineMs : 0
+    if (opcode !== undefined) peer.socket.write(Buffer.from([opcode, 0x80, 0, 0, 0, 0]))
+    await expectIdleLedger(relay, firstFrameDeadline + 2_000)
+    expect(relay.runtimeCounts().preAuthConnections).toBe(0)
+    expect(database.query).not.toHaveBeenCalled()
+    expect(database.queryLocked).not.toHaveBeenCalled()
+    await silentUpgrade(port, PHONE_TARGET)
+    expect(relay.connectionSnapshot()?.enforcedConnectionUnits).toBe(2)
+  }
+)
+
+it('releases admission after a rejected director invite when the peer ignores close', async () => {
+  const { relay, port } = await fixture({ role: 'director' })
+  const peer = await silentUpgrade(port, PHONE_TARGET)
+  peer.socket.write(relayAuthFrame())
+  await expectIdleLedger(relay, 2_000)
+  expect(readCloseFrame(peer.received())).toEqual({
+    code: RELAY_CLOSE_CODE.BAD_OUTER_CREDENTIAL,
+    reason: 'invalid invite'
+  })
+  expect(relay.runtimeCounts().preAuthConnections).toBe(0)
+  await silentUpgrade(port, PHONE_TARGET)
+  expect(relay.connectionSnapshot()?.enforcedConnectionUnits).toBe(2)
+})
+
+it('releases admission after a director move redirect when the peer ignores close', async () => {
+  const { relay, port } = await fixture({ role: 'director' })
+  const identity = { userId: 'user-1', relayHostId: 'abcdefghijklmnop' }
+  vi.spyOn(relay.store, 'resolveInviteForMove').mockResolvedValue({
+    userId: identity.userId,
+    relayDeviceId: 'device-1'
+  })
+  vi.spyOn(relay.assignments, 'resolve').mockResolvedValue({
+    ...identity,
+    cellId: 'cell-1',
+    cellUrl: 'https://cell-1.example.test',
+    assignmentEpoch: 1,
+    leaseExpiresAt: Date.now() + 60_000
+  })
+  const peer = await silentUpgrade(port, PHONE_TARGET)
+  peer.socket.write(relayAuthFrame())
+  await expectIdleLedger(relay, 2_000)
+  expect(peer.received().toString('utf8')).toContain('"type":"relay-moved"')
+  expect(readCloseFrame(peer.received())).toEqual({
+    code: RELAY_CLOSE_CODE.DRAINING,
+    reason: 'connect to assigned cell'
+  })
+  await silentUpgrade(port, PHONE_TARGET)
+  expect(relay.connectionSnapshot()?.enforcedConnectionUnits).toBe(2)
+})
+
+// A peer that keeps draining its socket does get the rejection: the close frame is written
+// before the force-close timer can fire, and TCP delivers those bytes ahead of the FIN.
+//
+// Scope, deliberately narrow: this peer reads every byte as it arrives, so the assertion below
+// speaks only for a responsive peer. It is not evidence that delivery survives backpressure —
+// `terminate()` destroys the socket a second later, and a frame still queued in the kernel or in
+// `ws`'s own buffer goes unsent. Treat the rejection as best effort; the bound on the close is
+// what the trade-off actually buys.
+it('delivers the rejection code and a graceful FIN to a peer that keeps reading', async () => {
+  const { relay, port } = await fixture()
+  const peer = await silentUpgrade(port, PHONE_TARGET)
+  peer.socket.write(maskedTextFrame(JSON.stringify({ type: 'relay-auth', v: 1, mode: 'wrong' })))
+  await vi.waitFor(() => expect(peer.transport().ended).toBe(true), { timeout: 3_000 })
+  expect(peer.received().toString('utf8')).toContain('"code":4401')
+  expect(readCloseFrame(peer.received())).toEqual({
+    code: RELAY_CLOSE_CODE.BAD_OUTER_CREDENTIAL,
+    reason: 'invalid relay auth'
+  })
+  expect(peer.transport().error).toBeNull()
+  await expectIdleLedger(relay, 2_000)
+})
+
+const BINARY_FIRST_FRAME = Buffer.from([0x82, 0x80, 0, 0, 0, 0])
+// maxPreAuthPerSource caps how many unauthenticated sockets one source may hold at once.
+const CONCURRENT_PEERS_PER_SOURCE = 4
+
+it('returns capacity to its exact baseline after repeated bursts of rejections', async () => {
+  const { relay, port } = await fixture({ hardCap: 2 * CONCURRENT_PEERS_PER_SOURCE + 1 })
+  for (let wave = 0; wave < 3; wave++) {
+    const peers = await Promise.all(
+      Array.from({ length: CONCURRENT_PEERS_PER_SOURCE }, () =>
+        silentUpgrade(port, PHONE_TARGET)
+      )
+    )
+    expect(relay.connectionSnapshot()).toMatchObject({
+      enforcedConnectionUnits: 2 * CONCURRENT_PEERS_PER_SOURCE
+    })
+    for (const peer of peers) peer.socket.write(BINARY_FIRST_FRAME)
+    await expectIdleLedger(relay, 3_000)
+    expect(relay.runtimeCounts().preAuthConnections).toBe(0)
+  }
+})
+
+// A rejection racing the peer's own disconnect must release once, not twice: the ledger
+// does not clamp at zero, so a double release shows up as a negative count here.
+it('releases exactly once when a rejected peer disconnects at the same moment', async () => {
+  const { relay, port } = await fixture({ hardCap: 2 * CONCURRENT_PEERS_PER_SOURCE + 1 })
+  const peers = await Promise.all(
+    Array.from({ length: CONCURRENT_PEERS_PER_SOURCE }, () => silentUpgrade(port, PHONE_TARGET))
+  )
+  for (const peer of peers) {
+    peer.socket.write(BINARY_FIRST_FRAME)
+    peer.socket.destroy()
+  }
+  await expectIdleLedger(relay, 3_000)
+  expect(relay.connectionSnapshot()).toMatchObject(IDLE_LEDGER)
+  expect(relay.runtimeCounts().preAuthConnections).toBe(0)
+  await silentUpgrade(port, PHONE_TARGET)
+  expect(relay.connectionSnapshot()?.enforcedConnectionUnits).toBe(2)
+})
diff --git a/cloud/apps/relay/src/relay-readiness-coalescing.test.ts b/cloud/apps/relay/src/relay-readiness-coalescing.test.ts
new file mode 100644
index 000000000000..2dc8ca0af224
--- /dev/null
+++ b/cloud/apps/relay/src/relay-readiness-coalescing.test.ts
@@ -0,0 +1,106 @@
+import { expect, it, vi } from 'vitest'
+import type { RelayDatabase } from './database.js'
+import { createRelayReadiness } from './relay-readiness.js'
+
+function database(query: RelayDatabase['query']): RelayDatabase {
+  return {
+    query,
+    queryLocked: query,
+    transaction: (operation) => operation(database(query)),
+    close: async () => {}
+  }
+}
+
+function gate() {
+  let release!: () => void
+  const wait = new Promise<void>((resolve) => (release = resolve))
+  return { wait, release }
+}
+
+it('shares both dependency probes and caches from completion for concurrent callers', async () => {
+  const sql = gate()
+  let now = 1_000
+  const query = vi.fn(async () => {
+    await sql.wait
+    return [{ ready: 1 }]
+  })
+  const fetchImpl = vi.fn(async () => new Response('{}'))
+  const observe = vi.fn()
+  const readiness = createRelayReadiness(database(query), 'https://jwks.example.test', {
+    fetch: fetchImpl,
+    now: () => now,
+    observe
+  })
+  const checks = Array.from({ length: 100 }, () => readiness.check())
+  try {
+    expect({ sql: query.mock.calls.length, jwks: fetchImpl.mock.calls.length }).toEqual({
+      sql: 1,
+      jwks: 1
+    })
+    expect(observe).not.toHaveBeenCalled()
+    now = 5_000
+  } finally {
+    sql.release()
+  }
+  expect(await Promise.all(checks)).toEqual(Array(100).fill(true))
+  expect(observe).toHaveBeenCalledTimes(1)
+  now = 14_999
+  expect(await readiness.check()).toBe(true)
+  expect(query).toHaveBeenCalledTimes(1)
+  now = 15_000
+  expect(await Promise.all(Array.from({ length: 100 }, () => readiness.check()))).toEqual(
+    Array(100).fill(true)
+  )
+  expect(query).toHaveBeenCalledTimes(2)
+  expect(fetchImpl).toHaveBeenCalledTimes(2)
+})
+
+it('shares failures, retains the failure cache, and retries after expiry', async () => {
+  let healthy = false
+  let now = 1_000
+  const query = vi.fn(async () => {
+    if (!healthy) throw new Error('offline')
+    return [{ ready: 1 }]
+  })
+  const fetchImpl = vi.fn(async () => new Response('{}', { status: healthy ? 200 : 503 }))
+  const observe = vi.fn()
+  const readiness = createRelayReadiness(database(query), 'https://jwks.example.test', {
+    fetch: fetchImpl,
+    now: () => now,
+    observe
+  })
+  expect(await Promise.all(Array.from({ length: 100 }, () => readiness.check()))).toEqual(
+    Array(100).fill(false)
+  )
+  expect(query).toHaveBeenCalledTimes(1)
+  expect(fetchImpl).toHaveBeenCalledTimes(1)
+  expect(observe).toHaveBeenCalledTimes(1)
+  expect(readiness.degradedDependencies()).toEqual([])
+  healthy = true
+  now = 10_999
+  expect(await readiness.check()).toBe(false)
+  expect(query).toHaveBeenCalledTimes(1)
+  now = 11_000
+  expect(await Promise.all(Array.from({ length: 100 }, () => readiness.check()))).toEqual(
+    Array(100).fill(true)
+  )
+  expect(query).toHaveBeenCalledTimes(2)
+  expect(fetchImpl).toHaveBeenCalledTimes(2)
+  expect(observe).toHaveBeenCalledTimes(2)
+})
+
+it('keeps separate readiness owners independent', async () => {
+  const query = vi.fn(async () => [{ ready: 1 }])
+  const fetchImpl = vi.fn(async () => new Response('{}'))
+  const first = createRelayReadiness(database(query), 'https://one.example.test', {
+    fetch: fetchImpl
+  })
+  const second = createRelayReadiness(database(query), 'https://two.example.test', {
+    fetch: fetchImpl
+  })
+  expect(await Promise.all([first.check(), first.check(), second.check(), second.check()])).toEqual(
+    [true, true, true, true]
+  )
+  expect(query).toHaveBeenCalledTimes(2)
+  expect(fetchImpl).toHaveBeenCalledTimes(2)
+})
diff --git a/cloud/apps/relay/src/relay-readiness.ts b/cloud/apps/relay/src/relay-readiness.ts
index 973a827e1048..72d3cd5c4713 100644
--- a/cloud/apps/relay/src/relay-readiness.ts
+++ b/cloud/apps/relay/src/relay-readiness.ts
@@ -131,6 +131,7 @@ export function createRelayReadiness(
   const settleSql = createDependencyGrace('sql', options.sqlGraceMs ?? RELAY_READINESS_SQL_GRACE_MS)
   let cachedAt = Number.NEGATIVE_INFINITY
   let cached = false
+  let pending: Promise<boolean> | null = null
   let lastObservedReady: boolean | undefined
   let degraded: RelayReadinessDependency[] = []
 
@@ -153,8 +154,7 @@ export function createRelayReadiness(
     }
   }
 
-  const check = async (): Promise<boolean> => {
-    if (now() - cachedAt < cacheMs) return cached
+  const probe = async (): Promise<boolean> => {
     const startedAt = now()
     const [jwks, sql] = await Promise.all([timed(now, probeJwks), timed(now, probeSql)])
     const completedAt = now()
@@ -185,5 +185,13 @@ export function createRelayReadiness(
     return cached
   }
 
+  const check = async (): Promise<boolean> => {
+    if (now() - cachedAt < cacheMs) return cached
+    pending ??= probe().finally(() => {
+      pending = null
+    })
+    return pending
+  }
+
   return { check, degradedDependencies: () => [...degraded] }
 }
diff --git a/cloud/apps/relay/src/relay-server.ts b/cloud/apps/relay/src/relay-server.ts
index e9a08398da9f..b90c322d1c24 100644
--- a/cloud/apps/relay/src/relay-server.ts
+++ b/cloud/apps/relay/src/relay-server.ts
@@ -276,7 +276,7 @@ export function createRelayServer(
       finished = true
       authenticated(source)
       observability.recordAuth(false)
-      socket.close(RELAY_CLOSE_CODE.BAD_OUTER_CREDENTIAL, 'first frame timeout')
+      closeRelayWebSocket(socket, RELAY_CLOSE_CODE.BAD_OUTER_CREDENTIAL, 'first frame timeout')
     }, RELAY_PROTOCOL_LIMITS.firstFrameDeadlineMs)
     socket.once('message', (raw, binary) => {
       if (finished) return
@@ -285,7 +285,11 @@ export function createRelayServer(
       authenticated(source)
       if (binary) {
         observability.recordAuth(false)
-        socket.close(RELAY_CLOSE_CODE.BAD_OUTER_CREDENTIAL, 'first frame must be text')
+        closeRelayWebSocket(
+          socket,
+          RELAY_CLOSE_CODE.BAD_OUTER_CREDENTIAL,
+          'first frame must be text'
+        )
         return
       }
       void callback(raw).catch((error: unknown) => {
@@ -356,7 +360,11 @@ export function createRelayServer(
               webSocket.send(
                 JSON.stringify({ type: 'relay-hello', ok: false, code: RELAY_CLOSE_CODE.BAD_OUTER_CREDENTIAL })
               )
-              webSocket.close(RELAY_CLOSE_CODE.BAD_OUTER_CREDENTIAL, 'invalid relay auth')
+              closeRelayWebSocket(
+                webSocket,
+                RELAY_CLOSE_CODE.BAD_OUTER_CREDENTIAL,
+                'invalid relay auth'
+              )
               return
             }
             if (config.role === 'director') {
@@ -376,7 +384,11 @@ export function createRelayServer(
                     code: RELAY_CLOSE_CODE.BAD_OUTER_CREDENTIAL
                   })
                 )
-                webSocket.close(RELAY_CLOSE_CODE.BAD_OUTER_CREDENTIAL, 'invalid invite')
+                closeRelayWebSocket(
+                  webSocket,
+                  RELAY_CLOSE_CODE.BAD_OUTER_CREDENTIAL,
+                  'invalid invite'
+                )
                 return
               }
               phoneAdmission?.hostData.release()
@@ -389,7 +401,7 @@ export function createRelayServer(
                   assignmentEpoch: assignment.assignmentEpoch
                 })
               )
-              webSocket.close(RELAY_CLOSE_CODE.DRAINING, 'connect to assigned cell')
+              closeRelayWebSocket(webSocket, RELAY_CLOSE_CODE.DRAINING, 'connect to assigned cell')
               return
             }
             await sessions.acceptClient(
@@ -442,7 +454,11 @@ export function createRelayServer(
             const auth = HostDataAuthSchema.safeParse(firstPayload(raw, 'host-data-auth'))
             if (!auth.success) {
               observability.recordAuth(false)
-              webSocket.close(RELAY_CLOSE_CODE.BAD_OUTER_CREDENTIAL, 'invalid host data auth')
+              closeRelayWebSocket(
+                webSocket,
+                RELAY_CLOSE_CODE.BAD_OUTER_CREDENTIAL,
+                'invalid host data auth'
+              )
               return
             }
             const accepted = await sessions.acceptHostData(
@@ -566,8 +582,3 @@ export function createRelayServer(
     cellIncarnation
   }
 }
-
-export function closeWithDrain(socket: WebSocket, graceMs: number): void {
-  socket.send(JSON.stringify({ type: 'drain', graceMs, recovery: 'resolve-director' }))
-  socket.close(RELAY_CLOSE_CODE.DRAINING, 'resolve configured director')
-}
diff --git a/cloud/apps/relay/src/relay-websocket-close.ts b/cloud/apps/relay/src/relay-websocket-close.ts
index d4a7f61a3ee2..4b0517c3e531 100644
--- a/cloud/apps/relay/src/relay-websocket-close.ts
+++ b/cloud/apps/relay/src/relay-websocket-close.ts
@@ -3,6 +3,14 @@ import type WebSocket from 'ws'
 const RELAY_WEBSOCKET_FORCE_CLOSE_MS = 1_000
 const forceCloseTimers = new WeakMap<WebSocket, ReturnType<typeof setTimeout>>()
 
+// Delivering the rejection is best effort, and deliberately so. The close frame carrying the
+// code and reason is written before the timer can fire, so a peer reading normally gets its
+// rejection ahead of the FIN — that much is asserted in relay-first-frame-close.blackbox.test.ts.
+// It is not a delivery guarantee: `ws` writes the frame to the socket, and `terminate()` destroys
+// the socket a second later, so under backpressure the frame (and any `relay-moved` message queued
+// before it) can still be dropped unsent even though the peer never stopped reading. Bounding the
+// close is what keeps a stalled peer from holding admission, and no finite grace makes delivery
+// certain. Keep the close write ahead of any new wait added here.
 export function closeRelayWebSocket(socket: WebSocket, code: number, reason: string): void {
   if (socket.readyState === socket.CLOSED) return
   if (!forceCloseTimers.has(socket)) {
diff --git a/cloud/apps/relay/src/sqlite-transaction-queue.test.ts b/cloud/apps/relay/src/sqlite-transaction-queue.test.ts
new file mode 100644
index 000000000000..99fb311ae25e
--- /dev/null
+++ b/cloud/apps/relay/src/sqlite-transaction-queue.test.ts
@@ -0,0 +1,101 @@
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { DatabaseSync } from 'node:sqlite'
+import { setImmediate } from 'node:timers/promises'
+import { expect, it, vi } from 'vitest'
+import { openRelayDatabase } from './database.js'
+
+it('releases queued work and close after a SQLite transaction cannot acquire its lock', async () => {
+  const dataDir = mkdtempSync(join(tmpdir(), 'orca-relay-sqlite-queue-'))
+  let connection: DatabaseSync | undefined
+  const prepare = DatabaseSync.prototype.prepare
+  // Keep the native handle reachable for cleanup even if a queue regression strands close().
+  const capture = vi
+    .spyOn(DatabaseSync.prototype, 'prepare')
+    .mockImplementation(function (this: DatabaseSync, sql) {
+      connection = this
+      return prepare.call(this, sql)
+    })
+  const database = await openRelayDatabase({ dataDir })
+  capture.mockRestore()
+  const blocker = new DatabaseSync(join(dataDir, 'orca-relay.sqlite'))
+  try {
+    await database.query('CREATE TABLE queue_progress (value INTEGER)')
+    await database.query('INSERT INTO queue_progress VALUES (0)')
+    blocker.exec('BEGIN IMMEDIATE')
+    const operation = vi.fn(async () => undefined)
+    await expect(database.transaction(operation)).rejects.toThrow('database is locked')
+    let lockFailures = 0
+    const blocked = Array.from({ length: 5 }, () =>
+      database.transaction(operation).catch(() => {
+        lockFailures += 1
+      })
+    )
+    await setImmediate()
+    expect(lockFailures).toBe(5)
+    await Promise.all(blocked)
+    expect(operation).not.toHaveBeenCalled()
+    blocker.exec('ROLLBACK')
+    let completed = 0
+    const pending = Array.from({ length: 100 }, () =>
+      database.transaction(async (transaction) => {
+        await transaction.query('UPDATE queue_progress SET value = value + 1')
+        completed += 1
+      })
+    )
+    for (const request of pending) void request.catch(() => undefined)
+    await setImmediate()
+    expect(completed).toBe(100)
+    await Promise.all(pending)
+    expect(await database.query('SELECT value FROM queue_progress')).toEqual([{ value: 100 }])
+    let closed = false
+    const closing = database.close().then(() => {
+      closed = true
+    })
+    await setImmediate()
+    expect(closed).toBe(true)
+    await closing
+  } finally {
+    capture.mockRestore()
+    blocker.close()
+    if (connection?.isOpen) connection.close()
+    rmSync(dataDir, { recursive: true, force: true })
+  }
+})
+
+it('does not roll back a transaction when BEGIN failed before taking ownership', async () => {
+  const dataDir = mkdtempSync(join(tmpdir(), 'orca-relay-sqlite-owner-'))
+  let connection: DatabaseSync | undefined
+  const prepare = DatabaseSync.prototype.prepare
+  const capture = vi
+    .spyOn(DatabaseSync.prototype, 'prepare')
+    .mockImplementation(function (this: DatabaseSync, sql) {
+      connection = this
+      return prepare.call(this, sql)
+    })
+  const database = await openRelayDatabase({ dataDir })
+  capture.mockRestore()
+  try {
+    await database.query('CREATE TABLE queue_owner (value INTEGER)')
+    await database.query('BEGIN IMMEDIATE')
+    await database.query('INSERT INTO queue_owner VALUES (7)')
+    await expect(database.transaction(async () => undefined)).rejects.toThrow(
+      'cannot start a transaction within a transaction'
+    )
+    expect(connection?.isTransaction).toBe(true)
+    let rows: unknown
+    void database.query('SELECT value FROM queue_owner').then((result) => {
+      rows = result
+    })
+    await setImmediate()
+    expect(rows).toEqual([{ value: 7 }])
+    await database.query('ROLLBACK')
+    expect(await database.query('SELECT value FROM queue_owner')).toEqual([])
+    await database.close()
+  } finally {
+    capture.mockRestore()
+    if (connection?.isOpen) connection.close()
+    rmSync(dataDir, { recursive: true, force: true })
+  }
+})
diff --git a/cloud/dev/scripts/relay-load-control-peer.mjs b/cloud/dev/scripts/relay-load-control-peer.mjs
index a075d6bf4e70..26d0ca6a69b0 100644
--- a/cloud/dev/scripts/relay-load-control-peer.mjs
+++ b/cloud/dev/scripts/relay-load-control-peer.mjs
@@ -860,11 +860,12 @@ export class RelayLoadControlPeer {
 
   scheduleRefresh(delayMs) {
     if (this.stopped) return
+    const socket = this.socket
+    const reschedule = () => {
+      if (this.socket === socket) this.scheduleRefresh(this.phase.refreshIntervalMs)
+    }
     this.refreshTimer = setTimeout(() => {
-      void this.refresh().then(
-        () => this.scheduleRefresh(this.phase.refreshIntervalMs),
-        () => this.scheduleRefresh(this.phase.refreshIntervalMs)
-      )
+      void this.refresh().then(reschedule, reschedule)
     }, delayMs)
   }
 
diff --git a/cloud/dev/scripts/relay-load-control-peer.test.mjs b/cloud/dev/scripts/relay-load-control-peer.test.mjs
index 95ebd89e1ef6..08bb3291a11f 100644
--- a/cloud/dev/scripts/relay-load-control-peer.test.mjs
+++ b/cloud/dev/scripts/relay-load-control-peer.test.mjs
@@ -901,3 +901,105 @@ test('shutdown closes both splice legs and waits for the in-flight splice', asyn
   assert.equal(observations.at(-1).type, 'shutdown')
   assert.equal(observations.at(-1).detail.activeSpliceSockets, 0)
 })
+
+function trackRefreshTimers(context) {
+  const schedule = global.setTimeout
+  const cancel = global.clearTimeout
+  const timers = new Map()
+  context.mock.method(global, 'setTimeout', (callback, milliseconds, ...args) => {
+    const timer = schedule(() => {
+      timers.delete(timer)
+      callback(...args)
+    }, milliseconds)
+    timers.set(timer, milliseconds)
+    return timer
+  })
+  context.mock.method(global, 'clearTimeout', (timer) => {
+    timers.delete(timer)
+    cancel(timer)
+  })
+  context.after(() => {
+    for (const timer of timers.keys()) cancel(timer)
+  })
+  return () => [...timers.values()].filter((milliseconds) => milliseconds >= 180_000).length
+}
+
+function reconnectingPeer(context, observations) {
+  const peer = new RelayLoadControlPeer(
+    0,
+    peerOptions({
+      directorOrigin: undefined,
+      targetOrigin: 'https://cell.test',
+      accessToken: 'test-access-token'
+    }),
+    (type) => observations.push(type)
+  )
+  peer.phase.refreshOffsetMs = 180_000
+  peer.phase.refreshIntervalMs = 200_000
+  peer.createSocket = () => {
+    const socket = fakeHandshakeSocket()
+    socket.send = (raw) => {
+      const message = JSON.parse(raw)
+      if (message.type === 'host-hello') {
+        queueMicrotask(() => socket.message(validChallenge(peer)))
+      } else if (message.type === 'host-challenge-ack') {
+        queueMicrotask(() =>
+          socket.message({
+            type: 'host-hello-ack',
+            generation: 1,
+            controlResumeSecret: 'test-secret'
+          })
+        )
+      }
+    }
+    return openOnNextTurn(socket)
+  }
+  context.after(() => peer.shutdown())
+  return peer
+}
+
+for (const outcome of ['success', 'failure']) {
+  for (const owner of ['current connection', 'replacement connection', 'shutdown']) {
+    test(`refresh ${outcome} respects its ${owner} ownership`, async (context) => {
+      const refreshTimers = trackRefreshTimers(context)
+      const observations = []
+      const peer = reconnectingPeer(context, observations)
+      const pendingResponse = deferred()
+      const requestStarted = deferred()
+      let delayResponse = false
+      context.mock.method(global, 'fetch', async () => {
+        if (delayResponse) {
+          requestStarted.resolve()
+          return await pendingResponse.promise
+        }
+        return response({ relayToken: 'test-relay-token' })
+      })
+      await peer.connect()
+      assert.equal(refreshTimers(), 1)
+      clearTimeout(peer.refreshTimer)
+      delayResponse = true
+      peer.scheduleRefresh(0)
+      await requestStarted.promise
+      delayResponse = false
+      if (owner !== 'current connection') {
+        peer.socket.close(1006)
+        await new Promise((resolve) => setImmediate(resolve))
+        await peer.connect()
+        assert.equal(refreshTimers(), 1)
+      }
+      const shutdown = owner === 'shutdown' ? peer.shutdown() : undefined
+      if (outcome === 'success') pendingResponse.resolve(response({ relayToken: 'fresh-token' }))
+      else pendingResponse.reject(new Error('token request failed'))
+      await new Promise((resolve) => setImmediate(resolve))
+      const timersAfterCompletion = refreshTimers()
+      await (shutdown ?? peer.shutdown())
+
+      assert.equal(timersAfterCompletion, owner === 'shutdown' ? 0 : 1)
+      assert.equal(refreshTimers(), 0)
+      assert.equal(
+        observations.filter((type) => type === 'refresh').length,
+        owner === 'current connection' && outcome === 'success' ? 1 : 0
+      )
+    })
+  }
+}
diff --git a/cloud/package.json b/cloud/package.json
index 545f5387bcfc..0dd2a5466999 100644
--- a/cloud/package.json
+++ b/cloud/package.json
@@ -26,7 +26,7 @@
   },
   "devDependencies": {
     "@types/node": "^24.10.0",
-    "tsx": "^4.21.0",
+    "tsx": "^4.23.15",
     "typescript": "^5.9.3",
     "vitest": "^4.1.11"
   }
diff --git a/cloud/pnpm-lock.yaml b/cloud/pnpm-lock.yaml
index 4849a4ecea66..6042ee85cd45 100644
--- a/cloud/pnpm-lock.yaml
+++ b/cloud/pnpm-lock.yaml
@@ -12,14 +12,14 @@ importers:
         specifier: ^24.10.0
         version: 24.13.2
       tsx:
-        specifier: ^4.21.0
-        version: 4.22.4
+        specifier: ^4.23.15
+        version: 4.23.15
       typescript:
         specifier: ^5.9.3
         version: 5.9.3
       vitest:
         specifier: ^4.1.11
-        version: 4.1.11(@types/node@24.13.2)(vite@8.0.16(@types/node@24.13.2)(esbuild@0.28.1)(tsx@4.22.4))
+        version: 4.1.11(@types/node@24.13.2)(vite@8.0.16(@types/node@24.13.2)(esbuild@0.28.2)(tsx@4.23.15))
 
   apps/push:
     dependencies:
@@ -65,7 +65,7 @@ importers:
         version: 5.9.3
       vitest:
         specifier: ^4.1.11
-        version: 4.1.11(@types/node@24.13.2)(vite@8.0.16(@types/node@24.13.2)(esbuild@0.28.1)(tsx@4.22.4))
+        version: 4.1.11(@types/node@24.13.2)(vite@8.0.16(@types/node@24.13.2)(esbuild@0.28.2)(tsx@4.22.4))
 
   apps/relay:
     dependencies:
@@ -114,7 +114,7 @@ importers:
         version: 5.9.3
       vitest:
         specifier: ^4.1.11
-        version: 4.1.11(@types/node@24.13.2)(vite@8.0.16(@types/node@24.13.2)(esbuild@0.28.1)(tsx@4.22.4))
+        version: 4.1.11(@types/node@24.13.2)(vite@8.0.16(@types/node@24.13.2)(esbuild@0.28.2)(tsx@4.22.4))
 
   apps/relay-fence-broker:
     dependencies:
@@ -139,7 +139,7 @@ importers:
         version: 5.9.3
       vitest:
         specifier: ^4.1.11
-        version: 4.1.11(@types/node@24.13.2)(vite@8.0.16(@types/node@24.13.2)(esbuild@0.28.1)(tsx@4.22.4))
+        version: 4.1.11(@types/node@24.13.2)(vite@8.0.16(@types/node@24.13.2)(esbuild@0.28.2)(tsx@4.22.4))
 
   apps/relay-ops:
     dependencies:
@@ -164,7 +164,7 @@ importers:
         version: 5.9.3
       vitest:
         specifier: ^4.1.11
-        version: 4.1.11(@types/node@24.13.2)(vite@8.0.16(@types/node@24.13.2)(esbuild@0.28.1)(tsx@4.22.4))
+        version: 4.1.11(@types/node@24.13.2)(vite@8.0.16(@types/node@24.13.2)(esbuild@0.28.2)(tsx@4.22.4))
 
   packages/postgres-schema:
     devDependencies:
@@ -176,7 +176,7 @@ importers:
         version: 5.9.3
       vitest:
         specifier: ^4.1.11
-        version: 4.1.11(@types/node@24.13.2)(vite@8.0.16(@types/node@24.13.2)(esbuild@0.28.1)(tsx@4.22.4))
+        version: 4.1.11(@types/node@24.13.2)(vite@8.0.16(@types/node@24.13.2)(esbuild@0.28.2)(tsx@4.23.15))
 
   packages/push-contract:
     dependencies:
@@ -192,7 +192,7 @@ importers:
         version: 5.9.3
       vitest:
         specifier: ^4.1.11
-        version: 4.1.11(@types/node@24.13.2)(vite@8.0.16(@types/node@24.13.2)(esbuild@0.28.1)(tsx@4.22.4))
+        version: 4.1.11(@types/node@24.13.2)(vite@8.0.16(@types/node@24.13.2)(esbuild@0.28.2)(tsx@4.23.15))
 
   packages/relay-contract:
     dependencies:
@@ -208,7 +208,7 @@ importers:
         version: 5.9.3
       vitest:
         specifier: ^4.1.11
-        version: 4.1.11(@types/node@24.13.2)(vite@8.0.16(@types/node@24.13.2)(esbuild@0.28.1)(tsx@4.22.4))
+        version: 4.1.11(@types/node@24.13.2)(vite@8.0.16(@types/node@24.13.2)(esbuild@0.28.2)(tsx@4.23.15))
 
 packages:
 
@@ -227,156 +227,312 @@ packages:
     cpu: [ppc64]
     os: [aix]
 
+  '@esbuild/aix-ppc64@0.28.2':
+    resolution: {integrity: sha512-XExcO+dvLKvVtNTibSTBej1NCAbaGhWn9Ww1ZPx80qsahhPFe/8jgWP0IchNe0F3HwkU7n8ejhH8bjonqht8mQ==}
+    engines: {node: '>=18'}
+    cpu: [ppc64]
+    os: [aix]
+
   '@esbuild/android-arm64@0.28.1':
     resolution: {integrity: sha512-34EGEbCIAgosYz6goLcopX6Mo7NyGv9tfwEM2/7Ce2VcVRk568iSvniGWcUXIy7wEDR1wzolcxcriFVrWYcwBg==}
     engines: {node: '>=18'}
     cpu: [arm64]
     os: [android]
 
+  '@esbuild/android-arm64@0.28.2':
+    resolution: {integrity: sha512-5YfKeeI8qWfBZIX+u2xZC3Zlb3Os/gLS2sbEKM+I4ZOcsWmHS2WLysCcQZDAFRslDUU5Oiq44gf6PYN1vGwG5A==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [android]
+
   '@esbuild/android-arm@0.28.1':
     resolution: {integrity: sha512-0k2F129Xdio1TdJfzJ8sy1Q47vUD2NnwdhiAf7drUN1EBTfPf4hsFCtmMgu/6m8JSzsBrlmVjudMBQqOfG8usQ==}
     engines: {node: '>=18'}
     cpu: [arm]
     os: [android]
 
+  '@esbuild/android-arm@0.28.2':
+    resolution: {integrity: sha512-kXXoiPVVGQcnIYGOeaovwOURpniDBpSq4A03qkQ+BMQqtGG6HYap3xne9C1O1yo4TR3qxlCX5IqqmX6fFo2Lqg==}
+    engines: {node: '>=18'}
+    cpu: [arm]
+    os: [android]
+
   '@esbuild/android-x64@0.28.1':
     resolution: {integrity: sha512-dbwY7ltSMDWsRatcRpCnES4F+im88OCUgGZjy52shC7GqHRE/cYlxNbB4Z4UpJswpcc4Qxd2oE/ufM0p61IKng==}
     engines: {node: '>=18'}
     cpu: [x64]
     os: [android]
 
+  '@esbuild/android-x64@0.28.2':
+    resolution: {integrity: sha512-O387ite7SzUyCcy3JQX4P4bLtEA7bLLkx+esve5JHnyYfNTxcVpXZo9jhdB0lTKN44gztELTdU7nS8Nr16Fs1Q==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [android]
+
   '@esbuild/darwin-arm64@0.28.1':
     resolution: {integrity: sha512-TZbWkQY7kvTAXbXUT7uVACR5cMHsDiSz9z7ZKAX/RTq/WJEk3QyRr0wZpNhBDX+/0CtdqUIJlOiodQcta6tY3Q==}
     engines: {node: '>=18'}
     cpu: [arm64]
     os: [darwin]
 
+  '@esbuild/darwin-arm64@0.28.2':
+    resolution: {integrity: sha512-n4KqkOQrraxHJcgjM1RvwbigfQKIKJVpM7xp+KsxiyUSrRdIXnt73VhrPAx0fV44hgfmIVKjxMN9J1t5jySVkw==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [darwin]
+
   '@esbuild/darwin-x64@0.28.1':
     resolution: {integrity: sha512-zfdzgK9ACBNZLI/CyHTOx81SyNbM6YXn7rxSgX97VjyiPl9W1i4Ka4fgKECEoFCKGpvBj5qArWIGgQjOwkgskQ==}
     engines: {node: '>=18'}
     cpu: [x64]
     os: [darwin]
 
+  '@esbuild/darwin-x64@0.28.2':
+    resolution: {integrity: sha512-uq6suIWYP37qzGddBKPw5QEQPi6HiLGsO7UmkpfyaYNQ3D+rN6w6WfwH+nuqcGXWvawGwxOEroO4YGnFh95azw==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [darwin]
+
   '@esbuild/freebsd-arm64@0.28.1':
     resolution: {integrity: sha512-wG2EA8ENdEI0qhkSZMjfqrdY+ziCYCPMmtZjjIwOmXFjmyzEHn+UUxk5of+SYsjtfs3VpnlC7QLzSI5hY/rOAw==}
     engines: {node: '>=18'}
     cpu: [arm64]
     os: [freebsd]
 
+  '@esbuild/freebsd-arm64@0.28.2':
+    resolution: {integrity: sha512-n+I0BTSRIoy+d6RPKnEVwql5UwBJolytvY4mAOIEJorKlqgPII8ix6slVVrfZ5Tnj7glIZvloylbB/EJPMWEXw==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [freebsd]
+
   '@esbuild/freebsd-x64@0.28.1':
     resolution: {integrity: sha512-i7dZ9vQgnvSCzi/rYCXNgtF/U+eKZNJBzu3eTQbRgHnM7tNSizLOkRFAl3qzVc/Op/u5YkHHa4pf/3DOYHthLQ==}
     engines: {node: '>=18'}
     cpu: [x64]
     os: [freebsd]
 
+  '@esbuild/freebsd-x64@0.28.2':
+    resolution: {integrity: sha512-78XJTJkvPs0kz2w61301PJjXl4g7q3JqiYMZ/M/yVI73EHBrCRTgkhu9oqG7vPqq+a/yadEW8aD+agKlk5xrmg==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [freebsd]
+
   '@esbuild/linux-arm64@0.28.1':
     resolution: {integrity: sha512-yHs+0uc8+nvEAfAfxrWQKK5peSNzBc4PegcMO0EJ2hT71uA7vB8Ihg2e77R2P7SG5uYjPbHlLLmve4LLLRCf0g==}
     engines: {node: '>=18'}
     cpu: [arm64]
     os: [linux]
 
+  '@esbuild/linux-arm64@0.28.2':
+    resolution: {integrity: sha512-pW4AC0P3it8c7do9MVM4p51FzHzdM/TZrerurgRcHJ2WTa1VQ1CIq18xncfpBJw4ojkiZZrKW2yIBWBP92j6Ug==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [linux]
+
   '@esbuild/linux-arm@0.28.1':
     resolution: {integrity: sha512-qVXBOHQS+d5Y722GwJzJUtOLlX7km3CraOaGormF1pDtPd2C/l1SHRPgjLunLGe51Sh5YYWKMFDyV4SxgMQYTQ==}
     engines: {node: '>=18'}
     cpu: [arm]
     os: [linux]
 
+  '@esbuild/linux-arm@0.28.2':
+    resolution: {integrity: sha512-XlDnu2q5yoqems+xay6wSAcg9DDD7K9RLKZEBOMZm3ckNpJBvOX20tSfby8KfrrhINDyv9V2YVZKY/SpoGJI8w==}
+    engines: {node: '>=18'}
+    cpu: [arm]
+    os: [linux]
+
   '@esbuild/linux-ia32@0.28.1':
     resolution: {integrity: sha512-d1z4ZuP0ajrfz/FhGT4vv278rX8KnPPJx8i5+AtK7TYbx9Le9F1hyzurZpkEyjkGa9dUGhQow4C1NmeGvqxN2w==}
     engines: {node: '>=18'}
     cpu: [ia32]
     os: [linux]
 
+  '@esbuild/linux-ia32@0.28.2':
+    resolution: {integrity: sha512-CYbnj78HsIeA+DhgUKgFCfvNsTHFhMMrinUrMZpDXJXKN8T3XViTZ/+wtHeVxEWY8ewSzTFN+nRmSwO2tZaLUQ==}
+    engines: {node: '>=18'}
+    cpu: [ia32]
+    os: [linux]
+
   '@esbuild/linux-loong64@0.28.1':
     resolution: {integrity: sha512-M5sRjUVZrkm1OAPR3dlOYzNmN+loZKGVi1VUQGrwuqLcbR6qeAz+famMhjASeH3YVKvZz+zT1jlh/keC3Rj/lg==}
     engines: {node: '>=18'}
     cpu: [loong64]
     os: [linux]
 
+  '@esbuild/linux-loong64@0.28.2':
+    resolution: {integrity: sha512-buwkd8nsph4R+ajRvw0qM5Hja/TXQow3ptzWO2EbG/cqcIkHloRrdlBtQlshyYGTNFvfkfJ5tpPLVkY4DtsPfQ==}
+    engines: {node: '>=18'}
+    cpu: [loong64]
+    os: [linux]
+
   '@esbuild/linux-mips64el@0.28.1':
     resolution: {integrity: sha512-mRObBZeHh2OxcBFPWE/FjylkRgZdYuiTR3vaTozquCGOH14iP9oN4x4Ge81CoIDYQrXmIxpFumJBu5MtZpnQJQ==}
     engines: {node: '>=18'}
     cpu: [mips64el]
     os: [linux]
 
+  '@esbuild/linux-mips64el@0.28.2':
+    resolution: {integrity: sha512-ZVykbDyk7519VwiNb9Lcj9m8XM6v5V9uKPvrEMkkEedVewf+0itkhahp4HDpgERXhwLRpWFypsGbG/J8s0QjJA==}
+    engines: {node: '>=18'}
+    cpu: [mips64el]
+    os: [linux]
+
   '@esbuild/linux-ppc64@0.28.1':
     resolution: {integrity: sha512-slScBsMAb3GFDcdrCgLwZtPYRoH2H/youv10QiZyRjmsP48fznoveWytSgCI/R0ZcUgpc0ZhIUEx6LHts8yrfQ==}
     engines: {node: '>=18'}
     cpu: [ppc64]
     os: [linux]
 
+  '@esbuild/linux-ppc64@0.28.2':
+    resolution: {integrity: sha512-CAXl+Dtd9UUuJd8pKKdwh6MLm3MUMiqMPmhZ3tTSXPqfyQ3vDl6R5hZdZ/kYojK4ofXtdfSv1tFq8XzWx3heNQ==}
+    engines: {node: '>=18'}
+    cpu: [ppc64]
+    os: [linux]
+
   '@esbuild/linux-riscv64@0.28.1':
     resolution: {integrity: sha512-kw0owk1o0GFETUJyW0jc0G4Yzs0BHZn0JDZ8JRT088vjJYX777BAs1fDGxAC+q831qOs2DTC96mNsG2opdfyyQ==}
     engines: {node: '>=18'}
     cpu: [riscv64]
     os: [linux]
 
+  '@esbuild/linux-riscv64@0.28.2':
+    resolution: {integrity: sha512-GeXCej4IQtU1B+QlDV8W/RRvbzI3O/Stss+/bCXv4lZls5WGRtu2a+3JkA3i4qIUlMXpcHebWpF8AkJhATowuA==}
+    engines: {node: '>=18'}
+    cpu: [riscv64]
+    os: [linux]
+
   '@esbuild/linux-s390x@0.28.1':
     resolution: {integrity: sha512-/lAIjX8aYFRByhh6L5rYtPEDRqa9de/4V/juOXcta5frjvzXO4/sqEtyytse0g3zZFuWu5cDN0MkLz2qRDD2Ag==}
     engines: {node: '>=18'}
     cpu: [s390x]
     os: [linux]
 
+  '@esbuild/linux-s390x@0.28.2':
+    resolution: {integrity: sha512-3H1weTYZPxt/WOhByszQZybS9w5lKzUn1FDMsgEChbHWQwHYQQRfBxgCcZvPhjHfKyJjIievvMmEUawJrdY9Dg==}
+    engines: {node: '>=18'}
+    cpu: [s390x]
+    os: [linux]
+
   '@esbuild/linux-x64@0.28.1':
     resolution: {integrity: sha512-u/anNYF2mmVOEDwLtnQ1wOr3EZ9sTNGLWrsYGYwHWzGA3Si84IOkHXlbWTD1NB+9/1lcnweYKO54uhxZydNzfA==}
     engines: {node: '>=18'}
     cpu: [x64]
     os: [linux]
 
+  '@esbuild/linux-x64@0.28.2':
+    resolution: {integrity: sha512-4xTZr1FUmSoQW4XIWmit3tzQrUTZM+N3P0XV8xROKYF50XfI7xeO90+1bZvNwxIufQ9hDQVRJH5YhgPVF8A/HQ==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [linux]
+
   '@esbuild/netbsd-arm64@0.28.1':
     resolution: {integrity: sha512-oks0DYbLwWMmaakTsCb+zL4E+aHRVLom9IJZOAthMQEPiQmydXHkziYEsGYRx0uNV/IjEKGAV941JzH02pflqw==}
     engines: {node: '>=18'}
     cpu: [arm64]
     os: [netbsd]
 
+  '@esbuild/netbsd-arm64@0.28.2':
+    resolution: {integrity: sha512-sSATRjPeDBg3pdgHoQfoYBob11Kk1FGa9lui5RIHZCoCkJa9QKlvl3/vKz2usCmYYjs7ymJR/2Nnsqe+Hjt5nw==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [netbsd]
+
   '@esbuild/netbsd-x64@0.28.1':
     resolution: {integrity: sha512-aeL6lAnN89Hz43Mlh1G8ARasbuoYvSITDEx0tHh5b7jJnHcssqgjy9Yx430GDpmCa6OyrKoS0aNRjKundRizGg==}
     engines: {node: '>=18'}
     cpu: [x64]
     os: [netbsd]
 
+  '@esbuild/netbsd-x64@0.28.2':
+    resolution: {integrity: sha512-lqnzCV+mM0gIADaKihiCg6ifgfU2L3h5E33rNQBN1Y4MaVGnzryzmvvf7UHxprpQdE8hpqLolJ9Rl+SkIRDpyw==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [netbsd]
+
   '@esbuild/openbsd-arm64@0.28.1':
     resolution: {integrity: sha512-MEFJe5C3R8pwXdZ5Y21oo6m7ePiS0d9pWucn99O/wvyJZChoIQKrQDxKrGeW8F5+T0okTHesAmDeiHDTIq0V/Q==}
     engines: {node: '>=18'}
     cpu: [arm64]
     os: [openbsd]
 
+  '@esbuild/openbsd-arm64@0.28.2':
+    resolution: {integrity: sha512-AL2qJILH7lNjrDmCQDvdxMfAUIv8KMNZOvrwAQ8i8//ntL9FflhOyMJ8OZSMBb8/AWXe3/5v5S20y3zCoZWKoQ==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [openbsd]
+
   '@esbuild/openbsd-x64@0.28.1':
     resolution: {integrity: sha512-i/ZLIOafE0Z8cI/XANJAixoJL/uRAoS2xOA3rb0xN+KK0K177cMAsQYkzHtBrtMXAKuAc7HGgcWiZ/sRC1Nxgw==}
     engines: {node: '>=18'}
     cpu: [x64]
     os: [openbsd]
 
+  '@esbuild/openbsd-x64@0.28.2':
+    resolution: {integrity: sha512-QtiuPytchRyC4rwUKhexJdQKvDuZ6hWloi3igqPQNUJCS1/v9EiO3UTOXR6A3FoMo4fnAKbWJdqaIwhOzh8qEw==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [openbsd]
+
   '@esbuild/openharmony-arm64@0.28.1':
     resolution: {integrity: sha512-ge+Z7EXFNt2BO1oAMsVpiQ8EwndV9i1xXerAeTIK7AtPs3bKFXQM7nlRxDSIUIMeueR1CNXxqztLzdNeReKBJg==}
     engines: {node: '>=18'}
     cpu: [arm64]
     os: [openharmony]
 
+  '@esbuild/openharmony-arm64@0.28.2':
+    resolution: {integrity: sha512-WkhYDmpTjLvGlScA1rwjRUmhl4k8oXR3cIbtqWmELgU/dFeHHlEllxDvdWcNJV9rbzCexB5vz8gtNewWLgCT7Q==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [openharmony]
+
   '@esbuild/sunos-x64@0.28.1':
     resolution: {integrity: sha512-BEjgtECkL3vY+SaSQ6nzVfiALUeFxpawyp8Jmf5PtYhf1Ug40N1h/hxlhts+f1FvSvarEigdxS3BlSMI2PJLcQ==}
     engines: {node: '>=18'}
     cpu: [x64]
     os: [sunos]
 
+  '@esbuild/sunos-x64@0.28.2':
+    resolution: {integrity: sha512-GPMSkTOtMnv2U2F8gxe4Io6qmVs+YKyp832Etqqxr0hFngmXQ3rzwytelm3GIn7T4VviRUlf3sOgBOiTdvaf7g==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [sunos]
+
   '@esbuild/win32-arm64@0.28.1':
     resolution: {integrity: sha512-lCv9eK/H6ZJWbE7bh2nw54CZ9M2nupBxJcTsdk/QQnWkdSjKGuxmmH8/GWrlT1eMmZfn4dGcCjRte397WqfQXA==}
     engines: {node: '>=18'}
     cpu: [arm64]
     os: [win32]
 
+  '@esbuild/win32-arm64@0.28.2':
+    resolution: {integrity: sha512-PIhhEkE9uPBleRBrQEJpUn7MBnibZzbGzYWPmY3x+YoVg/95zbjB4CxPPOQ8l5tYYM4mMaCthF8/1DIfBQQyWQ==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [win32]
+
   '@esbuild/win32-ia32@0.28.1':
     resolution: {integrity: sha512-zvb/mB2bSCoJOpoCBgYKKpX6YM6mJBlBUVUtVj41DlZJVEB6/0CKlRYxP5wWl1C1ILiCoAU5wZZ4q1P3qeS6Eg==}
     engines: {node: '>=18'}
     cpu: [ia32]
     os: [win32]
 
+  '@esbuild/win32-ia32@0.28.2':
+    resolution: {integrity: sha512-YmJbfTlvU7Sdn9BB+4PRES4oB6pxgS37MAONj+hBr/cpXS1aBPKXxNnDbu+QCWPj0o9dgyxeq79g6c5P8KeuYA==}
+    engines: {node: '>=18'}
+    cpu: [ia32]
+    os: [win32]
+
   '@esbuild/win32-x64@0.28.1':
     resolution: {integrity: sha512-bm4Mowrv+GXMlpWX++EcXw/iLyd1o3+bJkC2DkWXYVvgZCqD/bSj9ctZeAMC3cIxgjRVR2Dufaiu4YPxr5gW1A==}
     engines: {node: '>=18'}
     cpu: [x64]
     os: [win32]
 
+  '@esbuild/win32-x64@0.28.2':
+    resolution: {integrity: sha512-5ebpxr3nWMzrL/rnUI755Jkuee0bHL/Gq0WTF9lvcpv73wAp5eu8MfBUgWK9bhWvZjj7yX8etf/8tI8Ney695g==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [win32]
+
   '@hono/node-server@1.19.17':
     resolution: {integrity: sha512-dSneS5qhiauZWGDCeK4o695Xd9nUNjviSZCMQrj10eetr8Uln1ucn6bbphOM6UynAMMtNIzZNSpL9vnASJwrPQ==}
     engines: {node: '>=18.14.1'}
@@ -593,6 +749,11 @@ packages:
     engines: {node: '>=18'}
     hasBin: true
 
+  esbuild@0.28.2:
+    resolution: {integrity: sha512-HKVLS8dvII+xoKW9kmqxbRKrnWEXfJJr/FZhhJmiqIB0e053QNYFqOBouTMO/k5sID4MvCiUCvv8b9M4h32wIA==}
+    engines: {node: '>=18'}
+    hasBin: true
+
   estree-walker@3.0.3:
     resolution: {integrity: sha512-7RUKfXgSMMkzt6ZuXmqapOurLGPPfgj6l9uRZ7lRGolvk0y2yocc35LdcxKC5PQZdn2DMqioAQ2NoWcrTKmm6g==}
 
@@ -871,6 +1032,11 @@ packages:
     engines: {node: '>=18.0.0'}
     hasBin: true
 
+  tsx@4.23.15:
+    resolution: {integrity: sha512-Yiex1Ovn8z2xPpOWckIiysV1SSyRMY9BkLF++q0yKiDxCqRhosKfMg3janKkiLBwZ5c/YryloKwGZcrEmtwxKw==}
+    engines: {node: '>=18.0.0'}
+    hasBin: true
+
   tweetnacl@1.0.3:
     resolution: {integrity: sha512-6rt+RN7aOi1nGMyC4Xa5DdYiukl2UWCbcJft7YhxReBGQD7OAM8Pbxw6YMo4r2diNEA8FEmu32YOn9rhaiE5yw==}
 
@@ -1015,81 +1181,159 @@ snapshots:
   '@esbuild/aix-ppc64@0.28.1':
     optional: true
 
+  '@esbuild/aix-ppc64@0.28.2':
+    optional: true
+
   '@esbuild/android-arm64@0.28.1':
     optional: true
 
+  '@esbuild/android-arm64@0.28.2':
+    optional: true
+
   '@esbuild/android-arm@0.28.1':
     optional: true
 
+  '@esbuild/android-arm@0.28.2':
+    optional: true
+
   '@esbuild/android-x64@0.28.1':
     optional: true
 
+  '@esbuild/android-x64@0.28.2':
+    optional: true
+
   '@esbuild/darwin-arm64@0.28.1':
     optional: true
 
+  '@esbuild/darwin-arm64@0.28.2':
+    optional: true
+
   '@esbuild/darwin-x64@0.28.1':
     optional: true
 
+  '@esbuild/darwin-x64@0.28.2':
+    optional: true
+
   '@esbuild/freebsd-arm64@0.28.1':
     optional: true
 
+  '@esbuild/freebsd-arm64@0.28.2':
+    optional: true
+
   '@esbuild/freebsd-x64@0.28.1':
     optional: true
 
+  '@esbuild/freebsd-x64@0.28.2':
+    optional: true
+
   '@esbuild/linux-arm64@0.28.1':
     optional: true
 
+  '@esbuild/linux-arm64@0.28.2':
+    optional: true
+
   '@esbuild/linux-arm@0.28.1':
     optional: true
 
+  '@esbuild/linux-arm@0.28.2':
+    optional: true
+
   '@esbuild/linux-ia32@0.28.1':
     optional: true
 
+  '@esbuild/linux-ia32@0.28.2':
+    optional: true
+
   '@esbuild/linux-loong64@0.28.1':
     optional: true
 
+  '@esbuild/linux-loong64@0.28.2':
+    optional: true
+
   '@esbuild/linux-mips64el@0.28.1':
     optional: true
 
+  '@esbuild/linux-mips64el@0.28.2':
+    optional: true
+
   '@esbuild/linux-ppc64@0.28.1':
     optional: true
 
+  '@esbuild/linux-ppc64@0.28.2':
+    optional: true
+
   '@esbuild/linux-riscv64@0.28.1':
     optional: true
 
+  '@esbuild/linux-riscv64@0.28.2':
+    optional: true
+
   '@esbuild/linux-s390x@0.28.1':
     optional: true
 
+  '@esbuild/linux-s390x@0.28.2':
+    optional: true
+
   '@esbuild/linux-x64@0.28.1':
     optional: true
 
+  '@esbuild/linux-x64@0.28.2':
+    optional: true
+
   '@esbuild/netbsd-arm64@0.28.1':
     optional: true
 
+  '@esbuild/netbsd-arm64@0.28.2':
+    optional: true
+
   '@esbuild/netbsd-x64@0.28.1':
     optional: true
 
+  '@esbuild/netbsd-x64@0.28.2':
+    optional: true
+
   '@esbuild/openbsd-arm64@0.28.1':
     optional: true
 
+  '@esbuild/openbsd-arm64@0.28.2':
+    optional: true
+
   '@esbuild/openbsd-x64@0.28.1':
     optional: true
 
+  '@esbuild/openbsd-x64@0.28.2':
+    optional: true
+
   '@esbuild/openharmony-arm64@0.28.1':
     optional: true
 
+  '@esbuild/openharmony-arm64@0.28.2':
+    optional: true
+
   '@esbuild/sunos-x64@0.28.1':
     optional: true
 
+  '@esbuild/sunos-x64@0.28.2':
+    optional: true
+
   '@esbuild/win32-arm64@0.28.1':
     optional: true
 
+  '@esbuild/win32-arm64@0.28.2':
+    optional: true
+
   '@esbuild/win32-ia32@0.28.1':
     optional: true
 
+  '@esbuild/win32-ia32@0.28.2':
+    optional: true
+
   '@esbuild/win32-x64@0.28.1':
     optional: true
 
+  '@esbuild/win32-x64@0.28.2':
+    optional: true
+
   '@hono/node-server@1.19.17(hono@4.13.7)':
     dependencies:
       hono: 4.13.7
@@ -1195,13 +1439,21 @@ snapshots:
       chai: 6.2.2
       tinyrainbow: 3.1.0
 
-  '@vitest/mocker@4.1.11(vite@8.0.16(@types/node@24.13.2)(esbuild@0.28.1)(tsx@4.22.4))':
+  '@vitest/mocker@4.1.11(vite@8.0.16(@types/node@24.13.2)(esbuild@0.28.2)(tsx@4.22.4))':
     dependencies:
       '@vitest/spy': 4.1.11
       estree-walker: 3.0.3
       magic-string: 0.30.21
     optionalDependencies:
-      vite: 8.0.16(@types/node@24.13.2)(esbuild@0.28.1)(tsx@4.22.4)
+      vite: 8.0.16(@types/node@24.13.2)(esbuild@0.28.2)(tsx@4.22.4)
+
+  '@vitest/mocker@4.1.11(vite@8.0.16(@types/node@24.13.2)(esbuild@0.28.2)(tsx@4.23.15))':
+    dependencies:
+      '@vitest/spy': 4.1.11
+      estree-walker: 3.0.3
+      magic-string: 0.30.21
+    optionalDependencies:
+      vite: 8.0.16(@types/node@24.13.2)(esbuild@0.28.2)(tsx@4.23.15)
 
   '@vitest/pretty-format@4.1.11':
     dependencies:
@@ -1284,6 +1536,35 @@ snapshots:
       '@esbuild/win32-ia32': 0.28.1
       '@esbuild/win32-x64': 0.28.1
 
+  esbuild@0.28.2:
+    optionalDependencies:
+      '@esbuild/aix-ppc64': 0.28.2
+      '@esbuild/android-arm': 0.28.2
+      '@esbuild/android-arm64': 0.28.2
+      '@esbuild/android-x64': 0.28.2
+      '@esbuild/darwin-arm64': 0.28.2
+      '@esbuild/darwin-x64': 0.28.2
+      '@esbuild/freebsd-arm64': 0.28.2
+      '@esbuild/freebsd-x64': 0.28.2
+      '@esbuild/linux-arm': 0.28.2
+      '@esbuild/linux-arm64': 0.28.2
+      '@esbuild/linux-ia32': 0.28.2
+      '@esbuild/linux-loong64': 0.28.2
+      '@esbuild/linux-mips64el': 0.28.2
+      '@esbuild/linux-ppc64': 0.28.2
+      '@esbuild/linux-riscv64': 0.28.2
+      '@esbuild/linux-s390x': 0.28.2
+      '@esbuild/linux-x64': 0.28.2
+      '@esbuild/netbsd-arm64': 0.28.2
+      '@esbuild/netbsd-x64': 0.28.2
+      '@esbuild/openbsd-arm64': 0.28.2
+      '@esbuild/openbsd-x64': 0.28.2
+      '@esbuild/openharmony-arm64': 0.28.2
+      '@esbuild/sunos-x64': 0.28.2
+      '@esbuild/win32-arm64': 0.28.2
+      '@esbuild/win32-ia32': 0.28.2
+      '@esbuild/win32-x64': 0.28.2
+
   estree-walker@3.0.3:
     dependencies:
       '@types/estree': 1.0.9
@@ -1542,13 +1823,19 @@ snapshots:
     optionalDependencies:
       fsevents: 2.3.3
 
+  tsx@4.23.15:
+    dependencies:
+      esbuild: 0.28.2
+    optionalDependencies:
+      fsevents: 2.3.3
+
   tweetnacl@1.0.3: {}
 
   typescript@5.9.3: {}
 
   undici-types@7.18.2: {}
 
-  vite@8.0.16(@types/node@24.13.2)(esbuild@0.28.1)(tsx@4.22.4):
+  vite@8.0.16(@types/node@24.13.2)(esbuild@0.28.2)(tsx@4.22.4):
     dependencies:
       lightningcss: 1.33.0
       picomatch: 4.0.7
@@ -1557,14 +1844,54 @@ snapshots:
       tinyglobby: 0.2.17
     optionalDependencies:
       '@types/node': 24.13.2
-      esbuild: 0.28.1
+      esbuild: 0.28.2
       fsevents: 2.3.3
       tsx: 4.22.4
 
-  vitest@4.1.11(@types/node@24.13.2)(vite@8.0.16(@types/node@24.13.2)(esbuild@0.28.1)(tsx@4.22.4)):
+  vite@8.0.16(@types/node@24.13.2)(esbuild@0.28.2)(tsx@4.23.15):
+    dependencies:
+      lightningcss: 1.33.0
+      picomatch: 4.0.7
+      postcss: 8.5.28
+      rolldown: 1.0.3
+      tinyglobby: 0.2.17
+    optionalDependencies:
+      '@types/node': 24.13.2
+      esbuild: 0.28.2
+      fsevents: 2.3.3
+      tsx: 4.23.15
+
+  vitest@4.1.11(@types/node@24.13.2)(vite@8.0.16(@types/node@24.13.2)(esbuild@0.28.2)(tsx@4.22.4)):
+    dependencies:
+      '@vitest/expect': 4.1.11
+      '@vitest/mocker': 4.1.11(vite@8.0.16(@types/node@24.13.2)(esbuild@0.28.2)(tsx@4.22.4))
+      '@vitest/pretty-format': 4.1.11
+      '@vitest/runner': 4.1.11
+      '@vitest/snapshot': 4.1.11
+      '@vitest/spy': 4.1.11
+      '@vitest/utils': 4.1.11
+      es-module-lexer: 2.1.0
+      expect-type: 1.3.0
+      magic-string: 0.30.21
+      obug: 2.1.3
+      pathe: 2.0.3
+      picomatch: 4.0.4
+      std-env: 4.1.0
+      tinybench: 2.9.0
+      tinyexec: 1.2.4
+      tinyglobby: 0.2.17
+      tinyrainbow: 3.1.0
+      vite: 8.0.16(@types/node@24.13.2)(esbuild@0.28.2)(tsx@4.22.4)
+      why-is-node-running: 2.3.0
+    optionalDependencies:
+      '@types/node': 24.13.2
+    transitivePeerDependencies:
+      - msw
+
+  vitest@4.1.11(@types/node@24.13.2)(vite@8.0.16(@types/node@24.13.2)(esbuild@0.28.2)(tsx@4.23.15)):
     dependencies:
       '@vitest/expect': 4.1.11
-      '@vitest/mocker': 4.1.11(vite@8.0.16(@types/node@24.13.2)(esbuild@0.28.1)(tsx@4.22.4))
+      '@vitest/mocker': 4.1.11(vite@8.0.16(@types/node@24.13.2)(esbuild@0.28.2)(tsx@4.23.15))
       '@vitest/pretty-format': 4.1.11
       '@vitest/runner': 4.1.11
       '@vitest/snapshot': 4.1.11
@@ -1581,7 +1908,7 @@ snapshots:
       tinyexec: 1.2.4
       tinyglobby: 0.2.17
       tinyrainbow: 3.1.0
-      vite: 8.0.16(@types/node@24.13.2)(esbuild@0.28.1)(tsx@4.22.4)
+      vite: 8.0.16(@types/node@24.13.2)(esbuild@0.28.2)(tsx@4.23.15)
       why-is-node-running: 2.3.0
     optionalDependencies:
       '@types/node': 24.13.2
diff --git a/config/build-plugins/pdfjs-viewer-assets.ts b/config/build-plugins/pdfjs-viewer-assets.ts
index c212194ec71e..a632a7aa2d61 100644
--- a/config/build-plugins/pdfjs-viewer-assets.ts
+++ b/config/build-plugins/pdfjs-viewer-assets.ts
@@ -76,6 +76,9 @@ export function createPdfjsViewerAssetsPlugin(root = pdfjsRoot()): Plugin {
           next()
           return
         }
+        if (response.destroyed) {
+          return
+        }
         response.statusCode = 200
         response.setHeader('Content-Length', size)
         response.setHeader(
@@ -86,7 +89,18 @@ export function createPdfjsViewerAssetsPlugin(root = pdfjsRoot()): Plugin {
           response.end()
           return
         }
-        createReadStream(filePath).pipe(response)
+        const stream = createReadStream(filePath)
+        const stopReading = (): void => {
+          stream.destroy()
+        }
+        response.once('close', stopReading)
+        response.once('error', stopReading)
+        stream.once('close', () => {
+          response.off('close', stopReading)
+          response.off('error', stopReading)
+        })
+        stream.once('error', () => response.destroy())
+        stream.pipe(response)
       })
     },
     writeBundle(options) {
diff --git a/config/build-plugins/plain-node-entry-guard.ts b/config/build-plugins/plain-node-entry-guard.ts
index 7dc017b9c981..c4f58fa521ce 100644
--- a/config/build-plugins/plain-node-entry-guard.ts
+++ b/config/build-plugins/plain-node-entry-guard.ts
@@ -16,15 +16,34 @@ type OutputChunk = Rollup.OutputChunk
 // electron, and smoke-loads daemon-entry under plain Node to prove its module
 // graph still resolves.
 
-// Entries executed as plain Node (ELECTRON_RUN_AS_NODE / no electron runtime):
-// forked daemon, parcel-watcher, WSL filesystem and computer sidecars, and the CLI-run
-// agent-hooks entry. require("electron") throws MODULE_NOT_FOUND in all of them.
+// The CLI loads these paths after electron-vite replaces out/main.
+export const CLI_MAIN_ENTRY_NAMES = [
+  'agent-hooks/managed-agent-hook-controls',
+  'orca-profiles/profile-index-store',
+  'codex/managed-home-shell-preflight',
+  'claude-accounts/keychain',
+  ...[
+    'access',
+    'active-location',
+    'storage-classification',
+    'offline-settings',
+    'backup-path',
+    'database-recovery',
+    'domain-reader',
+    'recovery-command'
+  ].map((module) => `persistence/profile-state/profile-state-${module}`),
+  'persistence/profile-state/legacy-json/profile-state-export-path',
+  'persistence/profile-state/legacy-json/profile-state-recovery',
+  'startup/http1-compatibility-marker'
+] as const
+
+// Plain-Node processes and CLI modules cannot load Electron's API.
 const PLAIN_NODE_ENTRY_NAMES = [
   'daemon-entry',
   'parcel-watcher-process-entry',
   'computer-sidecar',
   'wsl-transcript-fs-process-entry',
-  'agent-hooks/managed-agent-hook-controls'
+  ...CLI_MAIN_ENTRY_NAMES
 ] as const
 
 // Entries executed as worker threads of the main process. Electron's module is
@@ -41,7 +60,9 @@ const WORKER_THREAD_ENTRY_NAMES = [
   'session-scanner-worker-entry',
   'main-thread-hang-watchdog-entry',
   'port-scan-command-worker-entry',
-  'usage-scan-worker-entry'
+  'usage-scan-worker-entry',
+  'profile-state-backup-worker-entry',
+  'profile-state-writer-worker-entry'
 ] as const
 
 export const GUARDED_ENTRY_NAMES = [
diff --git a/config/docker/cli-launch-contract/Dockerfile b/config/docker/cli-launch-contract/Dockerfile
index c90cbcd979c7..bc9ba2947f4d 100644
--- a/config/docker/cli-launch-contract/Dockerfile
+++ b/config/docker/cli-launch-contract/Dockerfile
@@ -1,4 +1,4 @@
-ARG BASE_IMAGE=ubuntu:24.04
+ARG BASE_IMAGE=ubuntu@sha256:4fbb8e6a8395de5a7550b33509421a2bafbc0aab6c06ba2cef9ebffbc7092d90
 FROM ${BASE_IMAGE}
 
 ARG LIBASOUND_PACKAGE=libasound2t64
diff --git a/config/e2e-failure-tracking.json b/config/e2e-failure-tracking.json
new file mode 100644
index 000000000000..fe51488c7066
--- /dev/null
+++ b/config/e2e-failure-tracking.json
@@ -0,0 +1 @@
+[]
diff --git a/config/electron-builder-pr-linux.config.cjs b/config/electron-builder-pr-linux.config.cjs
new file mode 100644
index 000000000000..54056e809965
--- /dev/null
+++ b/config/electron-builder-pr-linux.config.cjs
@@ -0,0 +1,8 @@
+const release = require('./electron-builder.config.cjs')
+
+// CI discards these packages after smoke tests; keep release compression unchanged.
+module.exports = {
+  ...release,
+  deb: { ...release.deb, fpm: [...(release.deb.fpm ?? []), '--deb-compression-level=1'] },
+  rpm: { ...release.rpm, fpm: [...(release.rpm.fpm ?? []), '--rpm-compression-level=1'] }
+}
diff --git a/config/electron-builder.config.cjs b/config/electron-builder.config.cjs
index 5703faf96894..01527ad8693f 100644
--- a/config/electron-builder.config.cjs
+++ b/config/electron-builder.config.cjs
@@ -188,6 +188,9 @@ module.exports = {
     // Why: these repo-only inputs are either bundled into out/ or copied via
     // extraResources. Shipping them in app.asar bloats the desktop bundle.
     '!src{,/**/*}',
+    '!out/orcad{,/**/*}',
+    '!out/orcad-template{,/**/*}',
+    '!out/.orcad-*{,/**/*}',
     '!config{,/**/*}',
     '!docs{,/**/*}',
     '!mobile{,/**/*}',
@@ -207,6 +210,8 @@ module.exports = {
     // it is gitignored, but exclude it defensively so a stray local capture at
     // package time never bloats app.asar.
     '!pr-evidence{,/**/*}',
+    // Local build logs and rollback copies are never application resources.
+    '!notes{,/**/*}',
     // Why: local agent/tooling directories may contain worktree symlink loops;
     // they are never runtime inputs and must not be traversed by electron-builder.
     '!{.claude,.grok,.agents,.codex}{,/**/*}',
@@ -281,6 +286,9 @@ module.exports = {
     'out/main/gemini/**',
     'out/main/grok/**',
     'out/main/hermes/**',
+    'out/main/orca-profiles/profile-index-store.js',
+    'out/main/persistence/profile-state/**',
+    'out/main/startup/http1-compatibility-marker.js',
     'out/main/daemon-entry.js',
     'out/main/session-scanner-service-entry.js',
     'out/main/wsl-transcript-fs-process-entry.js',
diff --git a/config/nsis/orca-installer-hooks.nsh b/config/nsis/orca-installer-hooks.nsh
index d89439073abd..a6fb31f9aec9 100644
--- a/config/nsis/orca-installer-hooks.nsh
+++ b/config/nsis/orca-installer-hooks.nsh
@@ -3,6 +3,8 @@
 ; electron-builder accepts exactly ONE `nsis.include` file, so every customInstall /
 ; customUnInstall hook Orca needs lives here.
 
+!include "${__FILEDIR__}\orca-process-check.nsh"
+
 ; ---------------------------------------------------------------------------
 ; Markdown "Open with Orca" (issue #10138)
 ;
diff --git a/config/nsis/orca-process-check.nsh b/config/nsis/orca-process-check.nsh
new file mode 100644
index 000000000000..4acedf5afc8e
--- /dev/null
+++ b/config/nsis/orca-process-check.nsh
@@ -0,0 +1,17 @@
+; Defining the hook suppresses electron-builder's process-info declarations.
+!include "getProcessInfo.nsh"
+Var pid
+Var /GLOBAL IsPowerShellAvailable
+
+!macro customCheckAppRunning
+  ; Restricted permits inline commands; test the process query rather than script-file policy.
+  ; Match upstream FIND/KILL's profile behavior so the probe cannot skip a failing profile.
+  nsExec::Exec `"$PowerShellPath" -Command "try { Get-CimInstance -ClassName Win32_Process -ErrorAction Stop | Out-Null; exit 0 } catch { exit 1 }"`
+  Pop $0
+  ; Launch errors, timeouts, and failed queries retain upstream's image-name fallback.
+  StrCpy $IsPowerShellAvailable 1
+  ${if} $0 == 0
+    StrCpy $IsPowerShellAvailable 0
+  ${endIf}
+  !insertmacro _CHECK_APP_RUNNING
+!macroend
diff --git a/config/patches/@vscode__windows-process-tree@0.8.0.patch b/config/patches/@vscode__windows-process-tree@0.8.0.patch
index 7c930a5fca56..3855e187ec68 100644
--- a/config/patches/@vscode__windows-process-tree@0.8.0.patch
+++ b/config/patches/@vscode__windows-process-tree@0.8.0.patch
@@ -28,13 +28,14 @@ index 855bd4b86f0a3c18c7594212c0e42b6e35bc4001..0bb2af7923b6e6f1f0da40cae8067304
                  "/guard:cf",
                  "/sdl",
 diff --git a/lib/index.js b/lib/index.js
-index 9747a7402600cd252859144d32580ed45c8c93f7..001e81fa8bc89091971d06aaf9d051ba20906615 100644
+index e586cd6ead522a4ff060f5338201f45e3467d639..0ee62c35558ff40e2298c464fdf6e9485f9d181d 100644
 --- a/lib/index.js
 +++ b/lib/index.js
-@@ -7,11 +7,13 @@ Object.defineProperty(exports, "__esModule", { value: true });
+@@ -7,11 +7,14 @@
  exports.getAllProcesses = exports.getProcessTree = exports.getProcessCpuUsage = exports.getProcessList = exports.filterProcessList = exports.buildProcessTree = exports.ProcessDataFlag = void 0;
  const util_1 = require("util");
  const native = process.platform === 'win32' ? require('../build/Release/windows_process_tree.node') : undefined;
++exports.getProcessCreationTime = native === undefined ? undefined : native.getProcessCreationTime;
 +exports.supportedProcessDataFlags = native === undefined ? undefined : native.supportedProcessDataFlags;
  var ProcessDataFlag;
  (function (ProcessDataFlag) {
@@ -45,7 +46,7 @@ index 9747a7402600cd252859144d32580ed45c8c93f7..001e81fa8bc89091971d06aaf9d051ba
  })(ProcessDataFlag = exports.ProcessDataFlag || (exports.ProcessDataFlag = {}));
  // requestInProgress is used for any function that uses CreateToolhelp32Snapshot, as multiple calls
  // to this cannot be done at the same time.
-@@ -66,11 +68,12 @@ function buildProcessTree(rootPid, processList, maxDepth = MAX_FILTER_DEPTH) {
+@@ -66,11 +69,12 @@
      // • the properties are inlined/splatted
      // • the 'ppid' field is omitted
      // • the depth of the tree is limited by `maxDepth`
@@ -60,13 +61,14 @@ index 9747a7402600cd252859144d32580ed45c8c93f7..001e81fa8bc89091971d06aaf9d051ba
      });
      return buildNode(root, maxDepth);
 diff --git a/lib/index.ts b/lib/index.ts
-index f9aa005d9ced9e42885b8a976de5eb5bd61899ee..1b509af0b9065918bcb5cb75f2d7f23821d4a56a 100644
+index 7b53aad05c3682a5c7d814d81a39c3f391ae97e3..284dae185b56241244b4d6bcab9e08f7530b8cf3 100644
 --- a/lib/index.ts
 +++ b/lib/index.ts
-@@ -6,12 +6,15 @@
+@@ -6,12 +6,16 @@
  import { promisify } from 'util';
  
  const native = process.platform === 'win32' ? require('../build/Release/windows_process_tree.node') : undefined;
++export const getProcessCreationTime: ((pid: number) => number | undefined) | undefined = native?.getProcessCreationTime;
 +/** The flag bits this compiled addon reports; undefined off win32. */
 +export const supportedProcessDataFlags: number | undefined = native?.supportedProcessDataFlags;
  import { IProcessInfo, IProcessTreeNode, IProcessCpuInfo } from '@vscode/windows-process-tree';
@@ -80,7 +82,7 @@ index f9aa005d9ced9e42885b8a976de5eb5bd61899ee..1b509af0b9065918bcb5cb75f2d7f238
  }
  
  type RequestCallback = (processList: IProcessInfo[]) => void;
-@@ -81,11 +84,12 @@ export function buildProcessTree(rootPid: number, processList: Iterable<IProcess
+@@ -81,11 +85,12 @@
    // • the properties are inlined/splatted
    // • the 'ppid' field is omitted
    // • the depth of the tree is limited by `maxDepth`
@@ -95,11 +97,33 @@ index f9aa005d9ced9e42885b8a976de5eb5bd61899ee..1b509af0b9065918bcb5cb75f2d7f238
    });
  
 diff --git a/src/addon.cc b/src/addon.cc
-index 9214aff281251e797a70ecb9f6e0b52932a0503f..722edd42ddb4740296bfc47582a181bd6d00c464 100644
+index 5253960ad97496b53c4a02572b64b270302af22f..a801526e20af72b6442c769a8ba1640386c23f46 100644
 --- a/src/addon.cc
 +++ b/src/addon.cc
-@@ -53,6 +53,10 @@ void GetProcessCpuUsage(const Napi::CallbackInfo& args) {
+@@ -50,9 +50,32 @@
+   worker->Queue();
+ }
+
++Napi::Value ReadProcessCreationTime(const Napi::CallbackInfo& args) {
++  Napi::Env env(args.Env());
++  if (args.Length() != 1 || !args[0].IsNumber()) {
++    return env.Undefined();
++  }
++  const double pid = args[0].As<Napi::Number>().DoubleValue();
++  if (!(pid >= 1 && pid <= MAXDWORD) || pid != static_cast<DWORD>(pid)) {
++    return env.Undefined();
++  }
++  ProcessInfo pinfo{};
++  pinfo.pid = static_cast<DWORD>(pid);
++  GetProcessCreationTime(pinfo);
++  if (pinfo.creationTimeMs == 0) {
++    return env.Undefined();
++  }
++  return Napi::Number::New(env, static_cast<double>(pinfo.creationTimeMs));
++}
++
  Napi::Object Init(Napi::Env env, Napi::Object exports) {
++  exports.Set("getProcessCreationTime", Napi::Function::New(env, ReadProcessCreationTime));
    exports.Set("getProcessList", Napi::Function::New(env, GetProcessList));
    exports.Set("getProcessCpuUsage", Napi::Function::New(env, GetProcessCpuUsage));
 +  // Lets a caller prove THIS BINARY understands CREATIONTIME. The JS enum is
@@ -398,10 +422,10 @@ index c9e3457a759c1acaa2644231a4917d45aed951f8..3f26a354477f062b34bd31fbd17be529
    }
  
 diff --git a/typings/windows-process-tree.d.ts b/typings/windows-process-tree.d.ts
-index 08bdac2fdc5ead6f0fcfb5ee5a021e2298c7d523..458981566fc45c0084badff566b1e3791ec1b629 100644
+index 70e242b123e76d43c452007be1ce92a6d224c8bb..b1d0a53c0c18cc16531b394c19bb256bdbaf782f 100644
 --- a/typings/windows-process-tree.d.ts
 +++ b/typings/windows-process-tree.d.ts
-@@ -7,9 +7,17 @@ declare module '@vscode/windows-process-tree' {
+@@ -7,8 +7,17 @@
    export enum ProcessDataFlag {
      None = 0,
      Memory = 1,
@@ -409,18 +433,18 @@ index 08bdac2fdc5ead6f0fcfb5ee5a021e2298c7d523..458981566fc45c0084badff566b1e379
 +    CommandLine = 2,
 +    CreationTime = 4
    }
- 
++
 +  /**
 +   * The flag bits the compiled addon actually understands, or undefined off
 +   * win32. `ProcessDataFlag` above is source; this is what the binary reports,
 +   * so it is the only way to tell a patched build from a stale prebuilt.
 +   */
 +  export const supportedProcessDataFlags: number | undefined;
-+
++  export const getProcessCreationTime: ((pid: number) => number | undefined) | undefined;
+
    export interface IProcessInfo {
      pid: number;
-     ppid: number;
-@@ -24,6 +32,9 @@ declare module '@vscode/windows-process-tree' {
+@@ -24,6 +33,9 @@
       * The string returned is at most 512 chars, strings exceeding this length are truncated.
       */
      commandLine?: string;
@@ -430,7 +454,7 @@ index 08bdac2fdc5ead6f0fcfb5ee5a021e2298c7d523..458981566fc45c0084badff566b1e379
    }
  
    export interface IProcessCpuInfo extends IProcessInfo {
-@@ -35,6 +46,7 @@ declare module '@vscode/windows-process-tree' {
+@@ -35,6 +47,7 @@
      name: string;
      memory?: number;
      commandLine?: string;
diff --git a/config/patches/node-pty@1.1.0.patch b/config/patches/node-pty@1.1.0.patch
index d36bf36b63f5..40b240f3296c 100644
--- a/config/patches/node-pty@1.1.0.patch
+++ b/config/patches/node-pty@1.1.0.patch
@@ -707,7 +707,7 @@ index 98733dc0cd752b554bd94e45904ca341ad141bba..3dd5ad9b3124dbd5ba7f76679b26650d
            // Stop processing immediately on unexpected error and log
            this._writeQueue.length = 0;
 diff --git a/src/win/conpty.cc b/src/win/conpty.cc
-index 7b286d3d644c26141df516929703aa6e129df4b2..4b06d18576c807c3d1181a7bd714140c6678cf86 100644
+index 7b286d3d64..5239ba4e40 100644
 --- a/src/win/conpty.cc
 +++ b/src/win/conpty.cc
 @@ -18,6 +18,7 @@
@@ -718,7 +718,7 @@ index 7b286d3d644c26141df516929703aa6e129df4b2..4b06d18576c807c3d1181a7bd714140c
  #include <vector>
  #include <Windows.h>
  #include <strsafe.h>
-@@ -44,12 +45,40 @@ struct pty_baton {
+@@ -44,15 +45,37 @@ struct pty_baton {
    HANDLE hOut;
    HPCON hpc;
  
@@ -749,18 +749,25 @@ index 7b286d3d644c26141df516929703aa6e129df4b2..4b06d18576c807c3d1181a7bd714140c
  };
  
  static std::vector<std::unique_ptr<pty_baton>> ptyHandles;
-+// Orca: guards the job accessors below, and PtyKill, against the exit watcher
-+// thread. It does NOT make the whole table safe -- PtyResize and PtyClear still
-+// read it unlocked, as they always have -- but it closes the window this patch
-+// opened, where the watcher can close hShell/hJob and free the baton between a
-+// lookup and its use.
-+// Handle VALUES are recycled aggressively, so an unguarded read could pass the
-+// shell-pid check against an unrelated process and terminate the wrong job.
++// Orca: every table access shares the exit watcher's lock; handles can be recycled.
 +static std::mutex ptyJobMutex;
  static volatile LONG ptyCounter;
  
- static pty_baton* get_pty_baton(int id) {
-@@ -102,8 +131,31 @@ void SetupExitCallback(Napi::Env env, Napi::Function cb, pty_baton* baton) {
+-static pty_baton* get_pty_baton(int id) {
++static pty_baton* get_pty_baton_locked(int id) {
+   auto it = std::find_if(ptyHandles.begin(), ptyHandles.end(), [id](const auto& ptyHandle) {
+     return ptyHandle->id == id;
+   });
+@@ -62,7 +85,7 @@ static pty_baton* get_pty_baton(int id) {
+   return nullptr;
+ }
+ 
+-static bool remove_pty_baton(int id) {
++static bool remove_pty_baton_locked(int id) {
+   auto it = std::remove_if(ptyHandles.begin(), ptyHandles.end(), [id](const auto& ptyHandle) {
+     return ptyHandle->id == id;
+   });
+@@ -102,8 +125,31 @@ void SetupExitCallback(Napi::Env env, Napi::Function cb, pty_baton* baton) {
      // Get process exit code.
      GetExitCodeProcess(baton->hShell, (LPDWORD)(&exit_event->exit_code));
      // Clean up handles
@@ -782,7 +789,7 @@ index 7b286d3d644c26141df516929703aa6e129df4b2..4b06d18576c807c3d1181a7bd714140c
 +      // NDEBUG would compile the call away and leak every baton.
 +      baton->shellExited = true;
 +      if (baton->consoleClosed) {
-+        const bool removed = remove_pty_baton(baton->id);
++        const bool removed = remove_pty_baton_locked(baton->id);
 +        assert(removed);
 +        (void)removed;
 +      }
@@ -794,7 +801,7 @@ index 7b286d3d644c26141df516929703aa6e129df4b2..4b06d18576c807c3d1181a7bd714140c
  
      auto status = tsfn.BlockingCall(exit_event, callback); // In main thread
      switch (status) {
-@@ -242,6 +294,20 @@
+@@ -242,6 +288,20 @@ HRESULT CreateNamedPipesAndPseudoConsole(const Napi::CallbackInfo& info,
    return HRESULT_FROM_WIN32(GetLastError());
  }
  
@@ -815,15 +822,40 @@ index 7b286d3d644c26141df516929703aa6e129df4b2..4b06d18576c807c3d1181a7bd714140c
  static Napi::Value PtyStartProcess(const Napi::CallbackInfo& info) {
    Napi::Env env(info.Env());
    Napi::HandleScope scope(env);
-@@ -303,6 +369,7 @@
+@@ -301,8 +361,10 @@ static Napi::Value PtyStartProcess(const Napi::CallbackInfo& info) {
+     // We were able to instantiate a conpty
+     const int ptyId = InterlockedIncrement(&ptyCounter);
      marshal.Set("pty", Napi::Number::New(env, ptyId));
-     ptyHandles.emplace_back(
-         std::make_unique<pty_baton>(ptyId, hIn, hOut, hpc));
-+    ptyHandles.back()->allowJobBreakaway = !usesCygwinRuntime(shellpath);
+-    ptyHandles.emplace_back(
+-        std::make_unique<pty_baton>(ptyId, hIn, hOut, hpc));
++    auto baton = std::make_unique<pty_baton>(ptyId, hIn, hOut, hpc);
++    baton->allowJobBreakaway = !usesCygwinRuntime(shellpath);
++    std::lock_guard<std::mutex> guard(ptyJobMutex);
++    ptyHandles.emplace_back(std::move(baton));
    } else {
      throw Napi::Error::New(env, "Cannot launch conpty");
    }
-@@ -409,6 +476,15 @@ static Napi::Value PtyConnect(const Napi::CallbackInfo& info) {
+@@ -350,11 +412,15 @@ static Napi::Value PtyConnect(const Napi::CallbackInfo& info) {
+   const bool useConptyDll = info[4].As<Napi::Boolean>().Value();
+   Napi::Function exitCallback = info[5].As<Napi::Function>();
+ 
+-  // Fetch pty handle from ID and start process
+-  pty_baton* handle = get_pty_baton(id);
+-  if (!handle) {
+-    throw Napi::Error::New(env, "Invalid pty handle");
++  pty_baton* handle;
++  {
++    std::lock_guard<std::mutex> guard(ptyJobMutex);
++    handle = get_pty_baton_locked(id);
++    if (!handle || handle->consoleClosed) {
++      throw Napi::Error::New(env, "Invalid pty handle");
++    }
+   }
++  // No watcher exists for this baton until SetupExitCallback below; pipe waits stay unlocked.
+ 
+   // Prepare command line
+   std::unique_ptr<wchar_t[]> mutableCommandline = std::make_unique<wchar_t[]>(cmdline.length() + 1);
+@@ -409,6 +475,15 @@ static Napi::Value PtyConnect(const Napi::CallbackInfo& info) {
      throw errorWithCode(info, "UpdateProcThreadAttribute failed");
    }
  
@@ -839,7 +871,7 @@ index 7b286d3d644c26141df516929703aa6e129df4b2..4b06d18576c807c3d1181a7bd714140c
    PROCESS_INFORMATION piClient{};
    fSuccess = !!CreateProcessW(
        nullptr,
-@@ -416,7 +492,10 @@ static Napi::Value PtyConnect(const Napi::CallbackInfo& info) {
+@@ -416,7 +491,10 @@ static Napi::Value PtyConnect(const Napi::CallbackInfo& info) {
        nullptr,                      // lpProcessAttributes
        nullptr,                      // lpThreadAttributes
        false,                        // bInheritHandles VERY IMPORTANT that this is false
@@ -851,7 +883,7 @@ index 7b286d3d644c26141df516929703aa6e129df4b2..4b06d18576c807c3d1181a7bd714140c
        envArg,                       // lpEnvironment
        mutableCwd.get(),             // lpCurrentDirectory
        &siEx.StartupInfo,            // lpStartupInfo
-@@ -426,8 +505,48 @@ static Napi::Value PtyConnect(const Napi::CallbackInfo& info) {
+@@ -426,8 +504,48 @@ static Napi::Value PtyConnect(const Napi::CallbackInfo& info) {
      throw errorWithCode(info, "Cannot create process");
    }
  
@@ -902,25 +934,52 @@ index 7b286d3d644c26141df516929703aa6e129df4b2..4b06d18576c807c3d1181a7bd714140c
    if (useConptyDll && fLoadedDll)
    {
      PFNRELEASEPSEUDOCONSOLE const pfnReleasePseudoConsole = (PFNRELEASEPSEUDOCONSOLE)GetProcAddress(
-@@ -440,6 +559,8 @@ static Napi::Value PtyConnect(const Napi::CallbackInfo& info) {
+@@ -438,8 +556,12 @@ static Napi::Value PtyConnect(const Napi::CallbackInfo& info) {
+     }
+   }
  
-   // Update handle
-   handle->hShell = piClient.hProcess;
-+  handle->shellPid = piClient.dwProcessId;
-+  handle->hJob = hJob;
+-  // Update handle
+-  handle->hShell = piClient.hProcess;
++  {
++    std::lock_guard<std::mutex> guard(ptyJobMutex);
++    handle->hShell = piClient.hProcess;
++    handle->shellPid = piClient.dwProcessId;
++    handle->hJob = hJob;
++  }
  
    // Close the thread handle to avoid resource leak
    CloseHandle(piClient.hThread);
-@@ -544,27 +665,213 @@ static Napi::Value PtyKill(const Napi::CallbackInfo& info) {
+@@ -472,9 +594,10 @@ static Napi::Value PtyResize(const Napi::CallbackInfo& info) {
+   SHORT rows = static_cast<SHORT>(info[2].As<Napi::Number>().Uint32Value());
+   const bool useConptyDll = info[3].As<Napi::Boolean>().Value();
+ 
+-  const pty_baton* handle = get_pty_baton(id);
++  std::lock_guard<std::mutex> guard(ptyJobMutex);
++  const pty_baton* handle = get_pty_baton_locked(id);
+ 
+-  if (handle != nullptr) {
++  if (handle != nullptr && !handle->consoleClosed) {
+     HANDLE hLibrary = LoadConptyDll(info, useConptyDll);
+     bool fLoadedDll = hLibrary != nullptr;
+     if (fLoadedDll)
+@@ -513,9 +636,10 @@ static Napi::Value PtyClear(const Napi::CallbackInfo& info) {
+     return env.Undefined();
+   }
+ 
+-  const pty_baton* handle = get_pty_baton(id);
++  std::lock_guard<std::mutex> guard(ptyJobMutex);
++  const pty_baton* handle = get_pty_baton_locked(id);
+ 
+-  if (handle != nullptr) {
++  if (handle != nullptr && !handle->consoleClosed) {
+     HANDLE hLibrary = LoadConptyDll(info, useConptyDll);
+     bool fLoadedDll = hLibrary != nullptr;
+     if (fLoadedDll)
+@@ -544,29 +668,215 @@ static Napi::Value PtyKill(const Napi::CallbackInfo& info) {
    int id = info[0].As<Napi::Number>().Int32Value();
    const bool useConptyDll = info[1].As<Napi::Boolean>().Value();
  
 -  const pty_baton* handle = get_pty_baton(id);
--
--  if (handle != nullptr) {
--    HANDLE hLibrary = LoadConptyDll(info, useConptyDll);
--    bool fLoadedDll = hLibrary != nullptr;
--    if (fLoadedDll)
 +  // Orca: resolve the DLL BEFORE touching any baton state, for the same reason
 +  // PtyConnect does it before creating anything. LoadConptyDll throws when
 +  // conpty.dll is missing, and a throw after consoleClosed was set would strand
@@ -934,7 +993,18 @@ index 7b286d3d644c26141df516929703aa6e129df4b2..4b06d18576c807c3d1181a7bd714140c
 +      (HMODULE)hLibrary,
 +      useConptyDll ? "ConptyClosePseudoConsole" : "ClosePseudoConsole");
 +  }
-+
+ 
+-  if (handle != nullptr) {
+-    HANDLE hLibrary = LoadConptyDll(info, useConptyDll);
+-    bool fLoadedDll = hLibrary != nullptr;
+-    if (fLoadedDll)
+-    {
+-      PFNCLOSEPSEUDOCONSOLE const pfnClosePseudoConsole = (PFNCLOSEPSEUDOCONSOLE)GetProcAddress(
+-        (HMODULE)hLibrary,
+-        useConptyDll ? "ConptyClosePseudoConsole" : "ClosePseudoConsole");
+-      if (pfnClosePseudoConsole)
+-      {
+-        pfnClosePseudoConsole(handle->hpc);
 +  // Orca: the baton now outlives the shell, so this runs on a self-exited pty
 +  // too -- that is the whole point. Take what we need under the lock: the
 +  // watcher thread nulls hShell the moment the shell dies, and TerminateProcess
@@ -945,7 +1015,7 @@ index 7b286d3d644c26141df516929703aa6e129df4b2..4b06d18576c807c3d1181a7bd714140c
 +  bool owed = false;
 +  {
 +    std::lock_guard<std::mutex> guard(ptyJobMutex);
-+    pty_baton* handle = get_pty_baton(id);
++    pty_baton* handle = get_pty_baton_locked(id);
 +    // Why the consoleClosed check: a second kill() would otherwise close the
 +    // same pseudoconsole twice. Upstream relied on the baton being gone.
 +    if (handle != nullptr && !handle->consoleClosed) {
@@ -965,9 +1035,9 @@ index 7b286d3d644c26141df516929703aa6e129df4b2..4b06d18576c807c3d1181a7bd714140c
 +          hShellDup = nullptr;
 +          TerminateProcess(handle->hShell, 1);
 +        }
-+      }
+       }
 +      if (handle->shellExited) {
-+        const bool removed = remove_pty_baton(id);
++        const bool removed = remove_pty_baton_locked(id);
 +        assert(removed);
 +        (void)removed;
 +      }
@@ -979,19 +1049,11 @@ index 7b286d3d644c26141df516929703aa6e129df4b2..4b06d18576c807c3d1181a7bd714140c
 +  // drained, and the watcher must be able to take the lock while it does.
 +  if (owed) {
 +    if (pfnClosePseudoConsole)
-     {
--      PFNCLOSEPSEUDOCONSOLE const pfnClosePseudoConsole = (PFNCLOSEPSEUDOCONSOLE)GetProcAddress(
--        (HMODULE)hLibrary,
--        useConptyDll ? "ConptyClosePseudoConsole" : "ClosePseudoConsole");
--      if (pfnClosePseudoConsole)
--      {
--        pfnClosePseudoConsole(handle->hpc);
--      }
--    }
++    {
++      pfnClosePseudoConsole(hpc);
+     }
 -    if (useConptyDll) {
 -      TerminateProcess(handle->hShell, 1);
-+      pfnClosePseudoConsole(hpc);
-+    }
 +    if (hShellDup != nullptr) {
 +      TerminateProcess(hShellDup, 1);
 +      CloseHandle(hShellDup);
@@ -999,8 +1061,8 @@ index 7b286d3d644c26141df516929703aa6e129df4b2..4b06d18576c807c3d1181a7bd714140c
    }
  
    return env.Undefined();
-+}
-+
+ }
+ 
 +/**
 + * Orca: confirm a baton really is the pty the caller means.
 + *
@@ -1032,7 +1094,7 @@ index 7b286d3d644c26141df516929703aa6e129df4b2..4b06d18576c807c3d1181a7bd714140c
 +  // Held across the lookup AND the Win32 call: the watcher thread can otherwise
 +  // close these handles and free the baton in between.
 +  std::lock_guard<std::mutex> guard(ptyJobMutex);
-+  const pty_baton* handle = get_pty_baton(info[0].As<Napi::Number>().Int32Value());
++  const pty_baton* handle = get_pty_baton_locked(info[0].As<Napi::Number>().Int32Value());
 +  if (!ownsShell(handle, info[1].As<Napi::Number>().Uint32Value())) {
 +    return Napi::Boolean::New(env, false);
 +  }
@@ -1064,7 +1126,7 @@ index 7b286d3d644c26141df516929703aa6e129df4b2..4b06d18576c807c3d1181a7bd714140c
 +  // Held across the lookup AND the Win32 call: the watcher thread can otherwise
 +  // close these handles and free the baton in between.
 +  std::lock_guard<std::mutex> guard(ptyJobMutex);
-+  const pty_baton* handle = get_pty_baton(info[0].As<Napi::Number>().Int32Value());
++  const pty_baton* handle = get_pty_baton_locked(info[0].As<Napi::Number>().Int32Value());
 +  if (!ownsShell(handle, info[1].As<Napi::Number>().Uint32Value())) {
 +    return env.Null();
 +  }
@@ -1138,10 +1200,12 @@ index 7b286d3d644c26141df516929703aa6e129df4b2..4b06d18576c807c3d1181a7bd714140c
 +  }
 +  hHostJob = job;
 +  return Napi::Boolean::New(env, true);
- }
- 
++}
++
  /**
-@@ -577,6 +884,9 @@ Napi::Object init(Napi::Env env, Napi::Object exports) {
+ * Init
+ */
+@@ -577,6 +887,9 @@ Napi::Object init(Napi::Env env, Napi::Object exports) {
    exports.Set("resize", Napi::Function::New(env, PtyResize));
    exports.Set("clear", Napi::Function::New(env, PtyClear));
    exports.Set("kill", Napi::Function::New(env, PtyKill));
diff --git a/config/reliability-gates.jsonc b/config/reliability-gates.jsonc
index a236145dd943..e100d54e17a7 100644
--- a/config/reliability-gates.jsonc
+++ b/config/reliability-gates.jsonc
@@ -10,6 +10,623 @@
     }
   },
   "gates": [
+    {
+      "id": "terminal-preview.connection-settings-ownership",
+      "title": "Terminal preview connections survive unrelated settings updates",
+      "maturity": "experimental",
+      "protection": "partial",
+      "owner": "terminal-runtime",
+      "layer": "renderer-unit",
+      "surfaces": [
+        "dashboard terminal preview connection",
+        "preview settings updates",
+        "preview box fit and grid claim"
+      ],
+      "platforms": ["macos", "linux", "windows"],
+      "providers": ["local", "daemon", "ssh", "wsl", "remote-runtime"],
+      "coveredPlatforms": ["macos"],
+      "coveredProviders": ["local", "remote-runtime"],
+      "coverageNotes": "Mounted production component and real settings action with cloned IPC replies, inert xterm/input adapters, and simulated metrics. Local/remote-qualified renderer identities covered; no physical provider, native geometry, focus, IME or rendered app claim. Subsequent hidden/offscreen Electron component proof uses real xterm and synthetic snapshots, preserving the rendered terminal across unrelated updates and measuring equivalent fallback scale/fit requests after a font-size change.",
+      "motivatingLinks": [
+        "https://github.com/stablyai/orca/blob/main/src/renderer/src/components/dashboard-popout/AgentTerminalPreview.tsx",
+        "https://github.com/stablyai/orca/pull/23099"
+      ],
+      "invariant": "Equal composed theme with unchanged PTY, mode, contrast and font/shaping settings keeps the current preview owner. Relevant changes replace it once, preserve explicit fit/grid negotiation, and reject retired pending completions.",
+      "oracle": "Ten unrelated settings replies produce one connect and xterm construction, no pre-unmount teardown, then one final cleanup. Changed colors/mode/contrast/font/shaping replace owners; pending retired connections never construct and obsolete grid claims are canceled.",
+      "commands": [
+        "ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/dashboard-popout/AgentTerminalPreview.settings-lifetime.test.tsx src/renderer/src/components/dashboard-popout/AgentTerminalPreview.settings-geometry.test.tsx src/renderer/src/components/dashboard-popout/AgentTerminalPreview.test.tsx src/renderer/src/components/dashboard-popout/AgentTerminalPreview.option-dead-key.test.tsx src/renderer/src/components/dashboard-popout/AgentTerminalPreview.clipboard-routes.test.tsx"
+      ],
+      "testFiles": [
+        "src/renderer/src/components/dashboard-popout/AgentTerminalPreview.settings-lifetime.test.tsx",
+        "src/renderer/src/components/dashboard-popout/AgentTerminalPreview.settings-geometry.test.tsx",
+        "src/renderer/src/components/dashboard-popout/AgentTerminalPreview.test.tsx",
+        "src/renderer/src/components/dashboard-popout/AgentTerminalPreview.option-dead-key.test.tsx",
+        "src/renderer/src/components/dashboard-popout/AgentTerminalPreview.clipboard-routes.test.tsx"
+      ],
+      "assertionRefs": [
+        {
+          "file": "src/renderer/src/components/dashboard-popout/AgentTerminalPreview.settings-lifetime.test.tsx",
+          "assertions": [
+            "keeps one preview connection across ten unrelated settings snapshots",
+            "ignores an old pending connection after a relevant theme change",
+            "does not install a terminal after unmounting a pending connection"
+          ]
+        },
+        {
+          "file": "src/renderer/src/components/dashboard-popout/AgentTerminalPreview.settings-geometry.test.tsx",
+          "assertions": [
+            "ignores a pending connection retired by a metric change",
+            "cancels an obsolete metric owner grid claim before the next change"
+          ]
+        }
+      ],
+      "evidenceRuns": [
+        {
+          "date": "2026-09-25",
+          "runner": "local",
+          "platform": "macos",
+          "command": "ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/dashboard-popout/AgentTerminalPreview.settings-lifetime.test.tsx src/renderer/src/components/dashboard-popout/AgentTerminalPreview.settings-geometry.test.tsx src/renderer/src/components/dashboard-popout/AgentTerminalPreview.test.tsx src/renderer/src/components/dashboard-popout/AgentTerminalPreview.option-dead-key.test.tsx src/renderer/src/components/dashboard-popout/AgentTerminalPreview.clipboard-routes.test.tsx",
+          "result": "passed",
+          "durationSeconds": 2.23,
+          "summary": "63 tests /5 suites pass. Lifetime regressions: original 7 fail/7 pass, candidate14 pass; all8 metric/shaping cases pass both original and corrected candidate."
+        }
+      ],
+      "runtimeBudget": {
+        "p95Seconds": 15,
+        "scope": "Focused deterministic suites; local elapsed recorded, p95 not established."
+      },
+      "flakeHistory": {
+        "status": "not-started",
+        "evidence": "Local checks and independent adverse review only; no CI soak."
+      },
+      "redGreenEvidence": {
+        "status": "complete",
+        "evidence": "Original reconnects/reconstructs11 times for10 unrelated updates; candidate1. Seven of14 lifetime cases fail original. Original and corrected candidate both pass all8 geometry preservation cases."
+      },
+      "performanceBudget": {
+        "required": true,
+        "evidence": "Ten unrelated settings replies: connect/constructor11 to1, pre-unmount unsubscribe/dispose10 to0. One previous-theme ref and shallow comparison added; CPU/heap overhead unmeasured. No timer/polling/subprocess/subscriber added; broad settings render/composition work remains."
+      },
+      "knownGaps": [
+        "No full-dashboard interaction, native focus/input/IME, ligature shaping or physical PTY validation. Hidden Electron component rendering and one font-size transition were checked; fit endpoint was inert.",
+        "No live SSH/WSL/relay or Linux/Windows run. Provider/wire ownership and folder/git workspace paths unchanged.",
+        "Selection/buffer/input state now persists across unrelated and live cursor/scroll updates instead of incidental resets. Small comparison/ref overhead unmeasured.",
+        "No CI soak, heap, main snapshot serialization or frame latency claim."
+      ],
+      "promotionCriteria": [
+        "Retain count, stale-owner and explicit metric fit/grid oracles; add rendered native and provider/platform evidence plus CI soak."
+      ],
+      "demotionRule": "Keep experimental until soak; investigate failures without weakening owner counts, changed-theme behavior, fit/grid claims or late-disposal assertions."
+    },
+    {
+      "id": "workspace-hooks.execution-host-ownership",
+      "title": "Hook reads and writes use the stored repository execution owner",
+      "maturity": "experimental",
+      "protection": "partial",
+      "owner": "workspace-runtime",
+      "layer": "cross-layer-unit",
+      "surfaces": [
+        "desktop worktree hook IPC",
+        "runtime repository hooks",
+        "issue-command read and write",
+        "hosted-review own-store host resolution"
+      ],
+      "platforms": ["macos", "linux", "windows"],
+      "providers": ["local", "ssh", "wsl", "remote-runtime"],
+      "coveredPlatforms": ["macos"],
+      "coveredProviders": [],
+      "coverageNotes": "Actual hydration and authoritative desktop owner selection with mocked filesystem, Git, inspection and provider boundaries; synthetic local/SSH/runtime rows. No physical provider or native platform certification.",
+      "motivatingLinks": [
+        "https://github.com/stablyai/orca/blob/main/src/main/ipc/hooks/register-worktree-hook-file-handlers.ts"
+      ],
+      "invariant": "Hook file operations follow the authoritative repository row in this process Store: canonical SSH selects its target, explicit local and self-addressed runtime rows use registered local files, and missing SSH providers never substitute local I/O.",
+      "oracle": "Nine desktop/runtime operations never use local I/O for canonical SSH or dial a stale legacy target; legacy SSH/local/runtime controls retain behavior, folder skips remain, missing providers do not gain local fallback.",
+      "commands": [
+        "ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/hooks/worktree-hook-execution-host.test.ts"
+      ],
+      "testFiles": ["src/main/ipc/hooks/worktree-hook-execution-host.test.ts"],
+      "assertionRefs": [
+        {
+          "file": "src/main/ipc/hooks/worktree-hook-execution-host.test.ts",
+          "assertions": [
+            "routes %s to the stored owner",
+            "refuses an unreachable canonical SSH write without touching local files"
+          ]
+        }
+      ],
+      "evidenceRuns": [
+        {
+          "date": "2026-09-26",
+          "runner": "local",
+          "platform": "macos",
+          "command": "ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/hooks/worktree-hook-execution-host.test.ts",
+          "result": "passed",
+          "durationSeconds": 0.739,
+          "summary": "Independent68pass/original37fail31controls. Eleven additional authority/unavailable-provider/encoded-ID/folder controls pass; author102unique permanent tests across four suites."
+        }
+      ],
+      "runtimeBudget": {
+        "p95Seconds": 10,
+        "scope": "Focused renderer-unit suites, p95 not established."
+      },
+      "flakeHistory": {
+        "status": "not-started",
+        "evidence": "Author and independent local evidence only; no CI soak."
+      },
+      "redGreenEvidence": {
+        "status": "complete",
+        "evidence": "Frozen permanent suite68pass; original sources37fail31controls; independently reproduced with eleven extra controls."
+      },
+      "performanceBudget": {
+        "required": true,
+        "evidence": "Incorrect local/stale-target routes9to0 for each of four changed identity shapes. This is correctness evidence only, no latency/CPU/heap gain. Existing host resolver reused, no polling, cache or inventory/subprocess fanout added."
+      },
+      "knownGaps": [
+        "CI soak pending.",
+        "Physical SSH/WSL/remote-runtime, native Linux/Windows, mobile and mixed-version integration untested. Local/daemon PTY data, identity and liveness unchanged.",
+        "Runtime absent-provider issue-command write still returns ok:true without a write; this preexisting convention is not a completion claim.",
+        "Only own-store rows use the generalized helper; generic runtime dispatch still rejects hosts this process does not execute.",
+        "No actual filesystem writes, provider operations, native UI or packaged app validation in routing fixtures."
+      ],
+      "promotionCriteria": [
+        "Retain exact route, no-local-fallback and authority oracles; obtain CI soak and physical host evidence before promotion."
+      ],
+      "demotionRule": "Keep experimental until soak; investigate authority/routing failures without replacing exact-target or no-local-I/O assertions."
+    },
+    {
+      "id": "runtime-files.renderer-document-watch-ownership",
+      "title": "Filesystem watches stay owned by their renderer document",
+      "maturity": "experimental",
+      "protection": "partial",
+      "owner": "runtime-platform",
+      "layer": "ipc-contract",
+      "surfaces": [
+        "desktop file explorer watchers",
+        "desktop editor file watchers",
+        "direct SSH file watchers"
+      ],
+      "platforms": ["macos", "linux", "windows"],
+      "providers": ["local", "ssh", "wsl"],
+      "coveredPlatforms": ["macos"],
+      "coveredProviders": ["local", "ssh", "wsl"],
+      "coverageNotes": "Actual desktop local/WSL subscription and SSH watcher controller logic under mocked filesystem/provider handles on macOS. Document events use an EventEmitter sender. Live remote/native Windows/Linux/WSL and rendered reload reattachment are unproved; PTY/process liveness and wire formats are unaffected.",
+      "motivatingLinks": [
+        "https://github.com/stablyai/orca/blob/main/src/main/ipc/filesystem-watcher-listener-lifecycle.ts"
+      ],
+      "invariant": "A replaced or crashed renderer document retains no file watches or pending ownership and cannot recreate them from an old asynchronous continuation. Shared roots retain live sibling owners; blocked and same-document navigation retain the current document. Shutdown removes registered lifecycle listeners.",
+      "oracle": "Run repeated reloads/crash, pending local/SSH installation cancellation with late success, aborted-install joiners, reconnect retry snapshots, failed-removal restoration and shutdown/reopen. Require zero obsolete roots/intent/listeners, no stale setup/retry, physical handle disposal and preservation of sibling notifications and same-tick remote handoff.",
+      "commands": [
+        "ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/filesystem-watcher-document-lifetime.test.ts src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem-watcher-remote-cancellation.test.ts src/main/ipc/filesystem-watcher-native-capacity.test.ts --reporter=dot"
+      ],
+      "testFiles": [
+        "src/main/ipc/filesystem-watcher-document-lifetime.test.ts",
+        "src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts",
+        "src/main/ipc/filesystem-watcher-remote-cancellation.test.ts",
+        "src/main/ipc/filesystem-watcher-native-capacity.test.ts"
+      ],
+      "assertionRefs": [
+        {
+          "file": "src/main/ipc/filesystem-watcher-document-lifetime.test.ts",
+          "assertions": [
+            "retains zero roots and listeners across 15 reloads and a renderer crash",
+            "does not revive a cancelled %s setup for a joiner whose document reloaded",
+            "does not re-arm an old provider snapshot into the same WebContents after replacement",
+            "does not restore a replaced sibling document after an awaited %s removal recovery",
+            "keeps same-document and blocked navigations alive, and removes lifecycle listeners at shutdown"
+          ]
+        }
+      ],
+      "evidenceRuns": [
+        {
+          "date": "2026-09-25",
+          "runner": "local",
+          "platform": "macos",
+          "command": "ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/filesystem-watcher-document-lifetime.test.ts src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts src/main/ipc/filesystem-watcher-remote-cancellation.test.ts src/main/ipc/filesystem-watcher-native-capacity.test.ts --reporter=dot",
+          "result": "passed",
+          "durationSeconds": 1.08,
+          "summary": "45 tests across four focused suites pass. Broader watcher suite passes 146 plus one existing skipped; isolated publication without sibling #22995 passes 145 plus one existing skipped."
+        }
+      ],
+      "runtimeBudget": {
+        "p95Seconds": 15,
+        "scope": "Focused deterministic IPC-contract suites; p95 not established."
+      },
+      "flakeHistory": {
+        "status": "not-started",
+        "evidence": "Local validation only; no CI soak."
+      },
+      "redGreenEvidence": {
+        "status": "complete",
+        "evidence": "Seven permanent regressions fail with HEAD source substituted: cancelled joiner resurrection for local and SSH, restoration into replaced local/SSH documents, stale provider retry, shutdown listener retention, and root retention. All 13 document ownership cases pass after the change."
+      },
+      "performanceBudget": {
+        "required": true,
+        "evidence": "15 reloads plus crash: retained local/SSH/desired roots 16→0 each; pending setup aborted; sender lifecycle listeners 1→0. Actual ownership modules with synthetic handles; no native process/heap/latency claim. No new timer, polling, process scan or provider fanout; existing root cleanup runs at document end."
+      },
+      "knownGaps": [
+        "No native Windows/Linux/WSL or live SSH execution.",
+        "No rendered Electron reload-reattachment/paint run or CI soak; broader watcher process isolation is a separate gate."
+      ],
+      "promotionCriteria": [
+        "Retain lifecycle, count and sibling-delivery assertions and add cross-platform and rendered reload evidence before promotion."
+      ],
+      "demotionRule": "Keep experimental until soak evidence; investigate lifecycle failures without suppressing assertions or retrying unexplained failures."
+    },
+    {
+      "id": "ephemeral-vm-recipe.output-tail-parity",
+      "title": "Recipe output capture preserves UTF-8 tails and releases settled storage",
+      "maturity": "experimental",
+      "protection": "partial",
+      "owner": "ephemeral-vm-runtime-store",
+      "layer": "shared-node-process-contract",
+      "surfaces": ["VM recipe stdout and stderr", "recipe cancellation and process errors"],
+      "platforms": ["macos", "linux", "windows"],
+      "providers": ["local"],
+      "coveredPlatforms": ["macos"],
+      "coveredProviders": ["local"],
+      "coverageNotes": "Actual recipe capture with synthetic child streams and real forced GC, plus real macOS shell output and descendant cancellation. Linux and Windows native execution, live VM providers and remote lifecycle journeys remain untested. Local/daemon PTY, SSH ownership, WSL launch, mobile and relay wire behavior are unaffected.",
+      "motivatingLinks": [
+        "https://github.com/stablyai/orca/blob/01ce5edf1aeec8a4b5cf06f531434be7d7c0cbcd/src/shared/ephemeral-vm-recipe-process.ts"
+      ],
+      "invariant": "Decoded stdout and stderr callback contents and order remain unchanged, final tails are the last capped run of raw output bytes with any leading partial UTF-8 sequence dropped, and success or failure releases capture storage without recapturing late output.",
+      "oracle": "Compare byte-bounded tails against the old per-chunk model and an independent code-point model across compaction, growth, oversized chunks and mid-character splits. Feed split and malformed UTF-8 through actual stream decoding. Require at most 5 MiB moved through the capture for 4 MiB of output with zero encoding, collectible backing buffers after close and error, zero late capture work with preserved callbacks, one decode per stream, unchanged tails on forced cancellation or synchronous kill-close, and every capture limit clamped to a bounded byte count.",
+      "commands": [
+        "ORCA_BACKGROUND_LAUNCH=1 pnpm test src/shared/ephemeral-vm-recipe-process.test.ts src/shared/ephemeral-vm-recipe-output-capture.test.ts src/shared/growing-byte-buffer.test.ts src/main/ephemeral-vm-recipe-runner.test.ts"
+      ],
+      "testFiles": [
+        "src/shared/ephemeral-vm-recipe-process.test.ts",
+        "src/shared/ephemeral-vm-recipe-output-capture.test.ts",
+        "src/shared/growing-byte-buffer.test.ts",
+        "src/main/ephemeral-vm-recipe-runner.test.ts"
+      ],
+      "assertionRefs": [
+        {
+          "file": "src/shared/ephemeral-vm-recipe-output-capture.test.ts",
+          "assertions": [
+            "matches the old per-chunk UTF-8 tail for limit %s across varied chunk boundaries",
+            "retains the same code-point tail for limit %s wherever byte boundaries fall",
+            "preserves stream decoding, callback boundaries and independent tails",
+            "moves at most 5 MiB through the capture for 4 MiB of output",
+            "releases capture storage after %s while preserving late callbacks",
+            "decodes once per stream when force-kill closes synchronously",
+            "clamps a $limit capture limit to a bounded byte count"
+          ]
+        },
+        {
+          "file": "src/shared/growing-byte-buffer.test.ts",
+          "assertions": [
+            "reads and writes correctly after the head offset has advanced",
+            "keeps a bounded suffix stable across many small appends without unbounded growth"
+          ]
+        }
+      ],
+      "evidenceRuns": [
+        {
+          "date": "2026-09-26",
+          "runner": "local",
+          "platform": "macos",
+          "command": "ORCA_BACKGROUND_LAUNCH=1 pnpm test src/shared/ephemeral-vm-recipe-process.test.ts src/shared/ephemeral-vm-recipe-output-capture.test.ts src/shared/growing-byte-buffer.test.ts src/main/ephemeral-vm-recipe-runner.test.ts",
+          "result": "passed",
+          "durationSeconds": 0.48,
+          "summary": "60 tests across four suites passed, including forced-GC lifetime, synchronous SIGKILL-close and the shared byte buffer's head-offset cases."
+        }
+      ],
+      "runtimeBudget": {
+        "p95Seconds": 15,
+        "scope": "focused Node process and capture contracts with forced GC"
+      },
+      "flakeHistory": {
+        "status": "unknown",
+        "evidence": "Author and independent local runs pass; no CI or soak history collected."
+      },
+      "redGreenEvidence": {
+        "status": "complete",
+        "evidence": "Baseline moves 943,194,112 bytes for 4 MiB output and fails the permanent 5 MiB budget. An earlier ring prototype retained two backing buffers after error and encoded late output after close; both permanent lifetime cases fail there and pass after cleanup correction. Dropping the head offset from GrowingByteBuffer keeps the byte budget but takes 12.36 ms instead of 0.25 ms."
+      },
+      "performanceBudget": {
+        "required": true,
+        "evidence": "4 MiB in 4 KiB chunks, seven paired samples, macOS: the old per-chunk re-encode moves 943,194,112 bytes in 265.78 ms median; raw-byte capture into GrowingByteBuffer moves 4,194,304 appended plus 1,048,576 decoded bytes, encodes nothing, and takes 0.25 ms. End to end through runRecipeCommand is 0.26 ms with no output callback and 0.78 ms with one (the callback decoder is the work setEncoding already did). A 64-byte one-shot is 0.075 to 0.206 microseconds; retained storage reserves spare capacity and can exceed a string. No new polling, timers, subprocesses, wire fields or deadline changes."
+      },
+      "promotionCriteria": [
+        "Collect 100 consecutive CI passes or 14 days of soak history.",
+        "Exercise native Windows and Linux recipe output and cancellation."
+      ],
+      "knownGaps": [
+        "Synthetic output timings do not establish typical recipe prevalence, end-to-end provisioning gains or UI latency.",
+        "Retained storage reserves spare capacity and can use more memory than a string; CJK bytes can exceed UTF-16 storage. Tiny output is slower, and an oversized single chunk still copies its capped tail.",
+        "Malformed UTF-8 now yields a different tail than the old policy: replacement characters no longer inflate the byte count, so a malformed tail keeps more real output. No production override of the cap was found, and odd caps are clamped rather than coerced per chunk.",
+        "Live VM providers, SSH lifecycle journeys, and native Windows or Linux termination were not run."
+      ],
+      "demotionRule": "Keep experimental or demote if output differs, discarded bytes return, settled capture remains reachable, cancellation loses its tail, or the deterministic encoding budget regresses. Never weaken the oracle or increase retries to obtain a pass."
+    },
+    {
+      "id": "agent-session.trust-preflight-completion",
+      "title": "Agent launch preflight waits for its trust owner to settle",
+      "maturity": "experimental",
+      "protection": "partial",
+      "owner": "agent-session-runtime",
+      "layer": "cross-layer-unit",
+      "surfaces": [
+        "agent trust IPC",
+        "remote (SSH) agent workspace trust writer",
+        "renderer agent preflight",
+        "Codex continuation launch admission",
+        "main-process worktree startup trust",
+        "Codex launch and resume preparation"
+      ],
+      "platforms": ["macos", "linux", "windows"],
+      "providers": ["local", "daemon", "ssh", "wsl", "remote-runtime"],
+      "coveredPlatforms": ["macos"],
+      "coveredProviders": ["local", "ssh"],
+      "coverageNotes": "Actual main IPC handler, renderer preflight, session-continuation caller and config mutation queue with fake Electron bridge, config writer, launch and remote owner, plus the actual main-process worktree-startup, Codex quick-launch-prep and Codex resume-prep modules with mocked trust writer, runtime home and hook service. Counts prove admission ordering and the per-call trust-write bound only; no native PTY/CLI, actual config mutation or live provider evidence. Because codexHookService and ensureRealHomeCodexHookState are both mocked and isHostSystemDefaultRealHomeSelected defaults to false, no suite drives either config.toml lane the two launch-prep sites re-enter after the trust write, so nothing here speaks to whether a launch as a whole is bounded. The remote-preset suite calls markRemoteAgentWorkspaceTrusted directly and asserts its artifact shapes plus its unresolvable-home bail-out; nothing exercises markRemoteWorktreeTrusted, the unbounded caller that wraps it on the launch paths, so the SSH side of the bound is unmeasured here.",
+      "motivatingLinks": ["https://github.com/stablyai/orca/blob/main/src/main/ipc/agent-trust.ts"],
+      "invariant": "Every local Codex trust write a launch waits on - the five markCodexProjectTrusted call sites - settles before that launch proceeds, or is abandoned at a bounded deadline; rejected, abandoned and SSH-unreachable writes leave the workspace untrusted and never fall back to local trust. Two limits sit outside that claim and are not asserted. First, the deadline bounds the write, not the whole launch: a caller whose next step re-enters the same config.toml lane can still wait on that lane after its own write is abandoned. Second, one Codex trust write a launch waits on is not bounded at all - the remote write reached through markRemoteWorktreeTrusted in runtime/runtime-worktree-agent-startup.ts, which derives preset 'codex' from TUI_AGENT_CONFIG the same way the local path does and is awaited ahead of the agent spawn on every SSH launch path. Only the agentTrust:markTrusted handler's remote write is capped.",
+      "oracle": "Held local write or actual queue predecessor yields zero continuation launch calls until release, then exactly one; delayed local rejection settles successfully afterward. SSH awaits its remote writer and never invokes local trust. A never-settling local or SSH write resolves the handler at the deadline with a named warning, no leaked timer and no local fallback, and a rejection arriving after the deadline stays handled. An already-complete write admits the launch on microtasks with zero timers. Two concurrent launches for one workspace settle independently. In the main-process worktree-startup, Codex quick-launch-prep and Codex resume-prep modules a never-settling write resolves the caller at the deadline, still yields the launch home or resume outcome, leaks no timer, and writes no other preset artifact; the write stays ordered before the runtime-home and hook-repair steps the spawn waits on. Those three module cases mock codexHookService, so they establish that the write is abandoned at the deadline, not that the launch around it is bounded. No case drives markRemoteWorktreeTrusted, so nothing here bounds the remote Codex write that fronts an SSH launch; the remote-preset suite checks only what markRemoteAgentWorkspaceTrusted writes and when it bails out, never how long it may take.",
+      "commands": [
+        "ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts tests/e2e/agent-trust-completion.unit.test.ts src/renderer/src/lib/agent-trust-preflight.test.ts src/renderer/src/lib/launch-agent-session-continuation.test.ts src/main/remote-agent-trust-presets.test.ts src/main/startup/codex-launch-trust-write-deadline.test.ts src/main/runtime/runtime-worktree-agent-startup.test.ts"
+      ],
+      "testFiles": [
+        "tests/e2e/agent-trust-completion.unit.test.ts",
+        "src/renderer/src/lib/agent-trust-preflight.test.ts",
+        "src/renderer/src/lib/launch-agent-session-continuation.test.ts",
+        "src/main/remote-agent-trust-presets.test.ts",
+        "src/main/startup/codex-launch-trust-write-deadline.test.ts",
+        "src/main/runtime/runtime-worktree-agent-startup.test.ts"
+      ],
+      "assertionRefs": [
+        {
+          "file": "tests/e2e/agent-trust-completion.unit.test.ts",
+          "assertions": [
+            "holds the actual session-continuation launch call until the local write settles",
+            "keeps renderer preflight pending behind the actual config mutation queue",
+            "settles best-effort only after a queued local trust failure",
+            "bounds a never-settling local write and continues untrusted",
+            "admits an already-complete write without waiting for any timer",
+            "absorbs a local rejection that arrives after the deadline",
+            "bounds a never-settling SSH trust write without a local fallback",
+            "settles two concurrent launches for the same workspace independently",
+            "keeps remote failures best-effort without a local fallback"
+          ]
+        },
+        {
+          "file": "src/main/startup/codex-launch-trust-write-deadline.test.ts",
+          "assertions": [
+            "bounds a never-settling write in quick-launch prep and still returns the launch home",
+            "keeps the quick-launch trust write ahead of the home the spawn waits on",
+            "bounds a never-settling write in resume prep and still resolves the resume home",
+            "keeps the resume trust write ahead of the hook repair that precedes the spawn",
+            "contains a rejected resume trust write without trusting the workspace elsewhere"
+          ]
+        },
+        {
+          "file": "src/main/runtime/runtime-worktree-agent-startup.test.ts",
+          "assertions": [
+            "waits for the Codex trust write before resolving",
+            "bounds a never-settling Codex trust write instead of holding the launch open"
+          ]
+        }
+      ],
+      "evidenceRuns": [
+        {
+          "date": "2026-09-27",
+          "runner": "local",
+          "platform": "macos",
+          "command": "ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts tests/e2e/agent-trust-completion.unit.test.ts src/renderer/src/lib/agent-trust-preflight.test.ts src/renderer/src/lib/launch-agent-session-continuation.test.ts src/main/remote-agent-trust-presets.test.ts src/main/startup/codex-launch-trust-write-deadline.test.ts src/main/runtime/runtime-worktree-agent-startup.test.ts",
+          "result": "passed",
+          "durationSeconds": 0.413,
+          "summary": "53 tests across six suites pass: 15 trust-completion (four deadline cases), 8 renderer preflight, 7 continuation-launch, 6 remote-preset, 5 Codex launch/resume prep deadline and 12 worktree-startup tests. Six of those are the bound and ordering cases this candidate adds. No native launch, PTY or actual config write."
+        }
+      ],
+      "runtimeBudget": {
+        "p95Seconds": 10,
+        "scope": "Focused mocked preflight/continuation/remote trust suites; p95 not established."
+      },
+      "flakeHistory": {
+        "status": "not-started",
+        "evidence": "Author and independent local mocked evidence; CI soak and native platform evidence pending."
+      },
+      "redGreenEvidence": {
+        "status": "complete",
+        "evidence": "Trust-completion suite, re-run at the earlier head. Pre-await implementation: 5 fail/10 pass - the three launch-admission orderings plus the never-settling local and SSH cases, the SSH one only by exhausting the test timeout. Unbounded-await implementation: 3 fail/12 pass - never-settling local write, post-deadline rejection and never-settling SSH write all hang to the test timeout. The already-complete-write case passes unbounded too, so it is a timer control, not a red. Launch-prep and worktree-startup suites, this head: with the three call sites reverted to a bare await, 3 fail/14 pass - the quick-launch, resume and worktree-startup never-settling cases each hang to the 30s vitest timeout; restored, 17 pass. Whole gate at this head: 53 pass across six suites."
+      },
+      "performanceBudget": {
+        "required": true,
+        "evidence": "No new subprocess, polling, retry or trust operation. Each of the five markCodexProjectTrusted call sites a launch awaits is capped by one per-call deadline timer, cleared on settlement, so none of those five can hold its caller indefinitely; the five share that one timer shape and no site gained a second write or a retry. The cap covers the local Codex writes only - the remote write through markRemoteWorktreeTrusted is still awaited with no timer, so an SSH launch can still be held open by a trust write. It also bounds the trust write, not the launch. At startup/codex-launch-preparation.ts the first awaited step after the write is ensureRealHomeHooksIfSelected, not codexHookService.prepareRuntimeHomeForLaunch: when the host system-default real home is selected it calls ensureRealHomeCodexHookState, which acquires runExclusivelyForCodexTrustConfig directly on ~/.codex/config.toml, the same lane the abandoned write still holds a queue slot for. When the real home is not selected that call returns without awaiting the lane and runtimeHome.prepareForCodexLaunchAsync is synchronous on this non-WSL path, so the first re-entry is prepareRuntimeHomeForLaunch through runExclusivelyForRuntimeAndSystemTrustConfig. At startup/codex-session-resume-launch.ts the first awaited step is the hook branch: ensureRealHomeCodexHookState when the resume home is ~/.codex, otherwise installForLaunchPrep or refreshRuntimeUserHooksForLaunchPrep through runExclusivelyForRuntimeAndSystemTrustConfig, whose inner acquire is that same ~/.codex/config.toml. Either way a wedged lane still stalls those two launches one step after the write is abandoned, and the earliest such step is the real-home ensure, not the hook-service call the gate used to name. Only markLocalWorktreeTrusted in runtime/runtime-worktree-agent-startup.ts has nothing after its Codex branch, so only it has an end-to-end bounded launch path. Reliability fix, no performance gain claim."
+      },
+      "knownGaps": [
+        "CI soak pending.",
+        "No live Codex CLI, PTY, trust prompt, native Electron app or actual trust-config mutation was exercised.",
+        "Windows/Linux/WSL/daemon/remote-runtime behavior was not executed; remote owner is mocked. No routing/wire/PTY ownership change.",
+        "Abandoning a write at the deadline does not cancel it; a legitimate slow write (WSL grant sessions run to 30s) can land after the launch already started, restoring the pre-fix ordering for that case only.",
+        "The deadline value is a reasoned cap over observed lane holders, not a measured p95.",
+        "All five awaited local Codex trust writes (markCodexProjectTrusted) are now bounded by the same helper: the agentTrust:markTrusted IPC handler, ipc/worktree-remote.ts, runtime/runtime-worktree-agent-startup.ts, startup/codex-launch-preparation.ts and startup/codex-session-resume-launch.ts. Four have a test in these suites; the ipc/worktree-remote.ts site is bounded but still has no test here. A sixth awaited Codex trust write - the remote one through markRemoteWorktreeTrusted - is not bounded at all; see the remote gap below.",
+        "Bounding the trust write does not bound the launch at two of the three new sites, and on both the first unbounded re-entry is earlier than the hook-service call. In startup/codex-launch-preparation.ts the next awaited call after the abandoned write is ensureRealHomeHooksIfSelected, which is conditional: only when the target is not WSL and runtimeHome.isHostSystemDefaultRealHomeSelected(launchEnv) is true does it call ensureRealHomeCodexHookState, which chains behind that module's own serial ensure promise and then acquires runExclusivelyForCodexTrustConfig on ~/.codex/config.toml (it skips the lane only when hooks are enabled, the lane is already unavailable and its retry backoff has not elapsed). When the real home is not selected that call returns without awaiting the lane, runtimeHome.prepareForCodexLaunchAsync is synchronous on the non-WSL path, and the first re-entry is codexHookService.prepareRuntimeHomeForLaunch. In startup/codex-session-resume-launch.ts the next awaited call is the hook branch: ensureRealHomeCodexHookState when the resume home is ~/.codex, otherwise installForLaunchPrep or refreshRuntimeUserHooksForLaunchPrep. All of those reach the same unbounded per-config.toml serial queue (runExclusivelyForCodexTrustConfig, FIFO with no depth cap and no timeout) on ~/.codex/config.toml; the runExclusivelyForRuntimeAndSystemTrustConfig wrapper takes the runtime home's config.toml first, and markCodexProjectTrusted itself takes both. A wedged lane therefore still stalls a quick-launch or a resume one step after the write is abandoned, and the abandoned write keeps its queue slot ahead of that step. The new launch-prep tests mock codexHookService and ensureRealHomeCodexHookState wholesale and default the real-home selection to false, so no test in these suites can catch this residual stall. Only markLocalWorktreeTrusted in runtime/runtime-worktree-agent-startup.ts, which has nothing after its Codex branch, is bounded end to end.",
+        "The cap remains per call site, not global. Two launches racing the same wedged lane each wait their own deadline, so the worst case a user can see is one deadline per launch, not one shared cap.",
+        "The remote (SSH) trust write reached through markRemoteWorktreeTrusted in runtime/runtime-worktree-agent-startup.ts is still awaited unbounded; only the agentTrust:markTrusted handler's remote write is capped. It is a Codex trust write a launch waits on, not merely an adjacent one: it reads TUI_AGENT_CONFIG[agent].preflightTrust, which is 'codex' for the codex agent, and markRemoteAgentWorkspaceTrusted then branches into markRemoteCodexProjectTrusted. Its only production caller is markRemoteWorkspaceTrustedForAgent in runtime/orca-runtime-activate-managed-worktree.ts, reached with a connectionId from seven launch entry points. On orca-runtime-create-agent-session.ts, orca-runtime-get-agent-session-execution-namespace.ts, orca-runtime-terminal-create-deduplication.ts, runtime-remote-managed-worktree-create.ts and runtime-folder-worktree-create.ts (wired in by orca-runtime-create-managed-worktree.ts) the await sits directly before the createTerminal that spawns the agent; on orca-runtime-resolve-mobile-session-terminal-command.ts and orca-runtime-resolve-worktree-removal-target.ts it instead gates the launch command those functions return for their caller to spawn, so the launch still waits on it. It chains a session.resolveHome multiplexer round trip, an SFTP realpath, a read, a createDir and a write, none with a timeout, over a link that may be half-open - so an SSH Codex launch can still hang with nothing happening, the same failure this branch bounds locally. Deliberately left out of scope here, and deliberately left out of the invariant."
+      ],
+      "promotionCriteria": [
+        "Retain pending-write/queue/launch-boundary red-green evidence and remote owner assertions; obtain actual platform/session evidence and CI soak before promotion."
+      ],
+      "demotionRule": "Remain experimental until repeated independent/CI evidence; investigate ordering or unbounded-wait regressions without weakening completion or deadline assertions."
+    },
+    {
+      "id": "settings.general-section-lifetime",
+      "title": "General settings search preserves matching section state",
+      "maturity": "experimental",
+      "protection": "partial",
+      "owner": "renderer-settings",
+      "layer": "renderer-unit",
+      "surfaces": [
+        "General settings search",
+        "app version and remote update display",
+        "autosave settings draft"
+      ],
+      "platforms": [
+        "macos",
+        "linux",
+        "windows"
+      ],
+      "providers": [
+        "local",
+        "remote-runtime",
+        "ssh",
+        "wsl"
+      ],
+      "coveredPlatforms": [
+        "macos"
+      ],
+      "coveredProviders": [],
+      "coverageNotes": "Actual GeneralPane, update/version and remote-status components with mocked store/API; actual autosave form. Windows runtime on/off simulated. No physical updater, paired host, settings write or native input.",
+      "motivatingLinks": [
+        "https://github.com/stablyai/orca/blob/main/src/renderer/src/components/settings/GeneralPane.tsx"
+      ],
+      "invariant": "A matching General settings section retains its owner and state as preceding search results disappear; an actually removed section releases its owner and reloads when shown again.",
+      "oracle": "Across 14 matching searches the Updates section keeps the same DOM node and the version-read and remote-refresh counts do not grow, instead of six each. Store-published remote update state still reaches the retained section. Explicit refresh and genuine hide/reopen still read; drafts yield to externally changed saved settings; a removed owner cannot publish its late version.",
+      "commands": [
+        "ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/settings/GeneralPane.section-lifetime.test.tsx"
+      ],
+      "testFiles": [
+        "src/renderer/src/components/settings/GeneralPane.section-lifetime.test.tsx"
+      ],
+      "assertionRefs": [
+        {
+          "file": "src/renderer/src/components/settings/GeneralPane.section-lifetime.test.tsx",
+          "assertions": [
+            "keeps showing store-published remote update state without a remount",
+            "keeps explicit remote refresh and true hide/reopen reads",
+            "preserves an autosave draft until external settings change or the section hides",
+            "does not publish a version result from a genuinely unmounted section"
+          ]
+        }
+      ],
+      "evidenceRuns": [
+        {
+          "date": "2026-09-26",
+          "runner": "local",
+          "platform": "macos",
+          "command": "ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/settings/GeneralPane.section-lifetime.test.tsx",
+          "result": "passed",
+          "durationSeconds": 1.89,
+          "summary": "7 tests/1 suite pass after the shared SettingsSectionStack adoption. Read-count oracles restated as node identity plus non-growing counts; original main fails both retained-section cases, the draft, the release-picker reveal and the late-version publish."
+        }
+      ],
+      "runtimeBudget": {
+        "p95Seconds": 10,
+        "scope": "Focused renderer-unit suites, p95 not established."
+      },
+      "flakeHistory": {
+        "status": "not-started",
+        "evidence": "Author and independent local evidence only; no CI soak."
+      },
+      "redGreenEvidence": {
+        "status": "complete",
+        "evidence": "Candidate permanent6pass versus original4fail2controls. Additional independent pending-version/error-context/store-refresh3pass versus original2fail1control."
+      },
+      "performanceBudget": {
+        "required": true,
+        "evidence": "Actual version and remote-refresh admissions 6 to 1 across 14 matching queries, which also stops one paired-host update probe per keystroke. Section map now lives in the shared SettingsSectionStack; no added poll, cache, listener or subprocess. No packaged CPU/frame/heap claim."
+      },
+      "knownGaps": [
+        "CI soak pending.",
+        "Physical updater/install, local/daemon PTYs and mobile are unaffected; no execution-host routing, process authority or wire change.",
+        "Native Linux/Windows, SSH/WSL and paired remote-runtime behavior not exercised; synthetic runtime flags cover renderer branches only.",
+        "Matching search no longer incidentally refreshes version/remote-status/CLI discovery; explicit checks and real hide/reopen remain. The installed version cannot change in-process and remote update entries are store-published, so neither goes stale without a signal.",
+        "Retained drafts, release reveal and pending/error context last until a real hide or their own transition; programmatic-query draft test does not reproduce ordinary mouse-search blur/commit.",
+        "Hidden Electron actual-form proof is separate; no packaged latency, heap or native focus evidence."
+      ],
+      "promotionCriteria": [
+        "Retain count, draft, owner cleanup and refresh controls; collect CI soak and relevant full-app/provider evidence before promotion."
+      ],
+      "demotionRule": "Keep experimental until soak; investigate state or cleanup regressions without weakening owner, read-count or draft assertions."
+    },
+    {
+      "id": "settings.accounts-section-lifetime",
+      "title": "Accounts search preserves matching account section owners",
+      "maturity": "experimental",
+      "protection": "partial",
+      "owner": "renderer-settings",
+      "layer": "renderer-unit",
+      "surfaces": [
+        "Accounts settings search",
+        "Grok and Cursor account status",
+        "Codex pending sign-in link"
+      ],
+      "platforms": [
+        "macos",
+        "linux",
+        "windows"
+      ],
+      "providers": [
+        "local",
+        "remote-runtime",
+        "ssh",
+        "wsl"
+      ],
+      "coveredPlatforms": [
+        "macos"
+      ],
+      "coveredProviders": [],
+      "coverageNotes": "Actual AccountsPane, Grok, Cursor and Codex login components; synthetic APIs/store with Windows account support enabled/disabled. No real account, keychain or provider action.",
+      "motivatingLinks": [
+        "https://github.com/stablyai/orca/blob/main/src/renderer/src/components/settings/AccountsPane.tsx"
+      ],
+      "invariant": "Matching sections retain their owners as earlier search results disappear; genuine removal releases the Codex subscription and reopens fresh status reads.",
+      "oracle": "Across nine matching Grok, ten matching Cursor and eleven matching Codex queries each matched section keeps the same DOM node and its status-read, watcher and subscription counts do not grow, against four to six reads each before. Explicit refresh, store-published usage updates, pushed login URLs and genuine removal all still reach the retained section.",
+      "commands": [
+        "ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/settings/AccountsPane.section-lifetime.test.tsx"
+      ],
+      "testFiles": [
+        "src/renderer/src/components/settings/AccountsPane.section-lifetime.test.tsx"
+      ],
+      "assertionRefs": [
+        {
+          "file": "src/renderer/src/components/settings/AccountsPane.section-lifetime.test.tsx",
+          "assertions": [
+            "preserves explicit Grok refresh and real hide/reopen status reads",
+            "keeps the login subscription until Codex genuinely hides",
+            "keeps Cursor refresh driven by usage updates and genuine reopen"
+          ]
+        }
+      ],
+      "evidenceRuns": [
+        {
+          "date": "2026-09-26",
+          "runner": "local",
+          "platform": "macos",
+          "command": "ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/settings/AccountsPane.section-lifetime.test.tsx",
+          "result": "passed",
+          "durationSeconds": 1.84,
+          "summary": "10 tests/1 suite pass after the shared SettingsSectionStack adoption. Read-count oracles restated as node identity plus non-growing counts; original main fails the three retained-section cases and the retained Codex subscription, and passes the explicit-refresh, usage-driven and genuine-removal controls."
+        }
+      ],
+      "runtimeBudget": {
+        "p95Seconds": 10,
+        "scope": "Focused renderer-unit suites, p95 not established."
+      },
+      "flakeHistory": {
+        "status": "not-started",
+        "evidence": "Author and independent local evidence only; no CI soak."
+      },
+      "redGreenEvidence": {
+        "status": "complete",
+        "evidence": "Candidate ten pass; current-main original seven fail and three controls pass."
+      },
+      "performanceBudget": {
+        "required": true,
+        "evidence": "Actual renderer status-read/subscription admissions counted; the section map now lives in the shared SettingsSectionStack and no cache, poll, listener or process is added. No CPU, latency or heap claim. Matching sections retain local state and lose only the incidental search-driven refresh that duplicated an existing subscription."
+      },
+      "knownGaps": [
+        "CI soak pending.",
+        "No native Linux/Windows or live SSH/WSL/paired provider behavior; platform flags are simulated.",
+        "Hidden Electron Grok proof uses the original audit baseline and synthetic status; current-main Cursor addition has unit evidence only.",
+        "Matching search no longer incidentally refreshes Grok/Cursor status or pending Codex URLs. Every one of those surfaces is store-subscribed or push-subscribed, so the retained section still tracks usage updates, pushed login URLs, explicit refresh and true hide/reopen; there is no bounded automatic freshness deadline and none of them relied on one before.",
+        "Child drafts, errors, copied feedback and timers remain until their own transition or real removal."
+      ],
+      "promotionCriteria": [
+        "Retain read/subscription counts and genuine-removal controls; collect CI soak and relevant full-app provider evidence."
+      ],
+      "demotionRule": "Keep experimental until soak; investigate owner and refresh regressions without weakening assertions or adding retries."
+    },
     {
       "id": "agent-session.journal-streaming-replay",
       "title": "Journal replay bounds obsolete revision memory without changing recovery",
@@ -79,8 +696,83 @@
         "No Windows/Linux runtime execution or real remote-host validation.",
         "Latest live message bodies still require memory proportional to their total size; this removes superseded-history retention, not live-history storage."
       ],
-      "promotionCriteria": ["Retain red/green heap and value assertions and complete CI soak."],
-      "demotionRule": "Keep experimental until cross-platform and soak evidence; investigate failures without weakening content or memory assertions."
+      "promotionCriteria": ["Retain red/green heap and value assertions and complete CI soak."],
+      "demotionRule": "Keep experimental until cross-platform and soak evidence; investigate failures without weakening content or memory assertions."
+    },
+    {
+      "id": "relay-performance.ai-vault-ready-ownership",
+      "title": "AI Vault readiness releases canceled request owners",
+      "maturity": "experimental",
+      "protection": "partial",
+      "owner": "desktop-runtime",
+      "layer": "relay-service-client-contract",
+      "surfaces": ["AI Vault sidecar startup", "SSH title lookup cancellation"],
+      "platforms": ["macos", "linux", "windows"],
+      "providers": ["ssh"],
+      "coveredPlatforms": ["macos"],
+      "coveredProviders": ["ssh"],
+      "coverageNotes": "Production relay client with synthetic child events and real forced GC. Native remote process execution and live SSH remain untested. Local/daemon PTY, WSL shell selection and mobile terminal stream are unaffected.",
+      "motivatingLinks": ["https://github.com/stablyai/orca/issues/23024"],
+      "invariant": "Canceled unsent calls release request payloads before sidecar readiness, disposal releases all pending readiness owners, and live calls still start exactly once through cancellation and startup failures.",
+      "oracle": "Hold ready and cancel 1,000 title calls; require zero retained request arrays after GC and one child. Dispose before ready and require uncanceled payload collection and zero timers. Race ready with abort and spawn failure with a second lane; require only live calls delivered and successful results. Preserve existing restart and cancel-ack behavior.",
+      "commands": [
+        "ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/relay/ai-vault-service-ready-retention.test.ts src/relay/ai-vault-service-client.test.ts src/relay/ai-vault-service-restart-policy.test.ts src/relay/ai-vault-service-spawn.test.ts src/relay/ai-vault-handler.test.ts src/shared/promise-settlement-waiters.test.ts"
+      ],
+      "testFiles": [
+        "src/relay/ai-vault-service-ready-retention.test.ts",
+        "src/relay/ai-vault-service-client.test.ts",
+        "src/relay/ai-vault-service-restart-policy.test.ts",
+        "src/relay/ai-vault-service-spawn.test.ts",
+        "src/relay/ai-vault-handler.test.ts",
+        "src/shared/promise-settlement-waiters.test.ts"
+      ],
+      "assertionRefs": [
+        {
+          "file": "src/relay/ai-vault-service-ready-retention.test.ts",
+          "assertions": [
+            "releases canceled request payloads while readiness remains pending",
+            "releases uncanceled readiness payloads when the client is disposed",
+            "does not send a call canceled in the turn that readiness arrives",
+            "retries an unsent lane after spawn fails while the other lane starts a child"
+          ]
+        }
+      ],
+      "evidenceRuns": [
+        {
+          "date": "2026-09-25",
+          "runner": "local",
+          "platform": "macos",
+          "command": "ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/relay/ai-vault-service-ready-retention.test.ts src/relay/ai-vault-service-client.test.ts src/relay/ai-vault-service-restart-policy.test.ts src/relay/ai-vault-service-spawn.test.ts src/relay/ai-vault-handler.test.ts src/shared/promise-settlement-waiters.test.ts",
+          "result": "passed",
+          "durationSeconds": 0.616,
+          "summary": "38 tests across six suites passed, including real forced-GC retention and startup/cancel races."
+        }
+      ],
+      "runtimeBudget": {
+        "p95Seconds": 10,
+        "scope": "focused Node contract tests with forced GC"
+      },
+      "flakeHistory": {
+        "status": "unknown",
+        "evidence": "Local runs passed; CI/soak history not collected."
+      },
+      "redGreenEvidence": {
+        "status": "complete",
+        "evidence": "Baseline retains all 1,000 canceled arrays and the disposed uncanceled payload; both permanent regressions fail there and pass after the fix. Independent spawn-failure race failed on the initial prototype, passed on baseline and passes after correction."
+      },
+      "performanceBudget": {
+        "required": true,
+        "evidence": "Synthetic cold-start churn retains 1,000 to zero canceled arrays; incremental heap 34,771,464 to 492,504 bytes. One shared startup reaction, no new polling, timers, process starts, timeout changes or wire fields."
+      },
+      "promotionCriteria": [
+        "Collect 100 consecutive CI passes or 14 days of soak history.",
+        "Exercise real SSH sidecar cancellation and restart on Linux and Windows."
+      ],
+      "knownGaps": [
+        "Synthetic churn does not measure typical user frequency or UI latency.",
+        "Physical sidecar/native Windows/Linux and live SSH paths were not exercised."
+      ],
+      "demotionRule": "Keep experimental or demote if canceled payloads survive GC, disposal retains startup owners, or live lanes stall/duplicate after startup failure."
     },
     {
       "id": "runtime.connection-owned-host-status",
@@ -8925,6 +9617,77 @@
       ],
       "demotionRule": "Demote if discovery and launch can resolve different authorities, a scoped Floating probe overwrites the active-project inventory, or local context selection adds recurring scans or retained in-flight entries."
     },
+    {
+      "id": "agent-session.opencode2-hook-cleanup",
+      "title": "OpenCode 2 setup releases acquired hook owners after failure",
+      "maturity": "experimental",
+      "protection": "partial",
+      "owner": "agent-integrations",
+      "layer": "main-unit",
+      "surfaces": ["OpenCode 2 generated plugin setup and unload"],
+      "platforms": ["macos", "linux", "windows"],
+      "providers": ["local", "ssh", "wsl", "remote-runtime"],
+      "coveredPlatforms": ["macos"],
+      "coveredProviders": [],
+      "coverageNotes": "Actual generated wrapper with synthetic factories, prompt registrations and event iterators. Supporting generated-module tests cover both OpenCode variants; no native provider execution.",
+      "motivatingLinks": [
+        "https://github.com/stablyai/orca/blob/main/src/main/opencode2/status-plugin-setup-source.ts"
+      ],
+      "invariant": "After a hook factory is acquired, prompt registration failure or a throwing/rejecting prompt disposer cannot skip hook disposal. Unload waits for in-flight event delivery before disposing the hook factory and remains fail-open.",
+      "oracle": "Fault-injected setup and unload each call hook disposal once. The ordered control completes delivery and subscription before hook cleanup. Normal unload disposes both owners once.",
+      "commands": [
+        "ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/main/opencode2/status-plugin-setup-lifetime.test.ts"
+      ],
+      "testFiles": ["src/main/opencode2/status-plugin-setup-lifetime.test.ts"],
+      "assertionRefs": [
+        {
+          "file": "src/main/opencode2/status-plugin-setup-lifetime.test.ts",
+          "assertions": [
+            "disposes the factory after prompt registration %s",
+            "disposes the factory after prompt cleanup %s",
+            "waits for in-flight delivery before factory cleanup after a prompt cleanup failure"
+          ]
+        }
+      ],
+      "evidenceRuns": [
+        {
+          "date": "2026-09-26",
+          "runner": "local",
+          "platform": "macos",
+          "command": "ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/main/opencode2/status-plugin-setup-lifetime.test.ts",
+          "result": "passed",
+          "durationSeconds": 0.125,
+          "summary": "10 permanent cases pass; baseline seven fail and three controls pass. Fresh-main run including existing setup/lineage suites: 59 pass."
+        }
+      ],
+      "runtimeBudget": {
+        "p95Seconds": 10,
+        "scope": "Synthetic wrapper unit suite; p95 not established."
+      },
+      "flakeHistory": {
+        "status": "not-started",
+        "evidence": "Local deterministic validation only; no CI soak."
+      },
+      "redGreenEvidence": {
+        "status": "complete",
+        "evidence": "Baseline seven failures and three controls; candidate ten passed. Hook disposal after prompt registration/cleanup failure changes from zero to one."
+      },
+      "performanceBudget": {
+        "required": true,
+        "evidence": "No new polling, scans, subprocesses or successful-startup awaits. Failure paths now await the existing hook disposer; teardown retains event-delivery ordering. No latency or heap improvement claimed."
+      },
+      "knownGaps": [
+        "Native Linux/Windows, SSH/WSL and remote-runtime plugin execution not run.",
+        "Local/daemon PTY and mobile/relay transport behavior is unaffected.",
+        "Pending non-abortable registration, event delivery or disposal promises can still delay cleanup; no timeout or cancellation redesign.",
+        "Malformed form normalization remains a separate defect.",
+        "CI soak pending."
+      ],
+      "promotionCriteria": [
+        "Retain cleanup-count and delivery-order oracles; add provider/platform execution and CI soak."
+      ],
+      "demotionRule": "Keep experimental until soak; investigate failures without weakening cleanup or delivery-order assertions."
+    },
     {
       "id": "agent-session.provider-ownership",
       "title": "Provider sessions are resumed once per workspace ownership claim",
@@ -9937,6 +10700,83 @@
       ],
       "demotionRule": "Cannot promote without deterministic oracle and runtime history."
     },
+    {
+      "id": "worktree-listing.execution-host-ownership",
+      "title": "Worktree listings keep canonical SSH ownership and mutation fencing",
+      "maturity": "experimental",
+      "protection": "partial",
+      "owner": "worktree-listing",
+      "layer": "main-unit",
+      "surfaces": [
+        "detected worktree listing",
+        "known worktree catalog",
+        "worktree list and listAll"
+      ],
+      "platforms": ["macos", "linux", "windows"],
+      "providers": ["local", "ssh", "wsl", "remote-runtime"],
+      "coveredPlatforms": ["macos"],
+      "coveredProviders": [],
+      "coverageNotes": "Actual handlers, hydration, ownership, scan cache and provider authority with mocked providers/Git/store/IPC. Independent controls use real lineage pruning and an in-memory map. No physical SSH or native Git.",
+      "motivatingLinks": [
+        "https://github.com/stablyai/orca/blob/main/src/main/ipc/worktrees/listing/register-worktree-catalog-handlers.ts"
+      ],
+      "invariant": "Canonical SSH listings use the owning provider and cannot register remote roots locally or reuse local cache authority. A listing overtaken by a mutation or root revision cannot prune newer lineage.",
+      "oracle": "Both SSH owner spellings reach five read forms without local Git/root registration; disconnection and authority rotation invalidate detected answers. Both catalog channels suppress side effects after mutation/root revision. Two direct canonical scans require two provider listings instead of one cached listing.",
+      "commands": [
+        "ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/worktrees-canonical-ssh-listing.test.ts"
+      ],
+      "testFiles": ["src/main/ipc/worktrees-canonical-ssh-listing.test.ts"],
+      "assertionRefs": [
+        {
+          "file": "src/main/ipc/worktrees-canonical-ssh-listing.test.ts",
+          "assertions": [
+            "keeps %s on the direct SSH boundary",
+            "reports disconnection without replaying an authoritative local-cache answer",
+            "preserves lineage when %s is overtaken by a %s"
+          ]
+        }
+      ],
+      "evidenceRuns": [
+        {
+          "date": "2026-09-26",
+          "runner": "local",
+          "platform": "macos",
+          "command": "ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/main/ipc/worktrees-canonical-ssh-listing.test.ts",
+          "result": "passed",
+          "durationSeconds": 0.884,
+          "summary": "26 permanent cases pass on isolated current main. Separate independent run40pass;8current-main related suites61pass. Author64scoped pass on shared checkout. Original permanent13fail/13controls. Initial candidate lineage regression repaired and revalidated."
+        }
+      ],
+      "runtimeBudget": {
+        "p95Seconds": 10,
+        "scope": "Focused mocked-provider unit suites; p95 not established."
+      },
+      "flakeHistory": {
+        "status": "not-started",
+        "evidence": "Local author/independent/current-main validation only; no CI soak."
+      },
+      "redGreenEvidence": {
+        "status": "complete",
+        "evidence": "Original permanent13fail13controls; repaired26pass. Initial candidate lost actual lineage in2independent races; repaired40pass includes these controls."
+      },
+      "performanceBudget": {
+        "required": true,
+        "evidence": "No added polling or concurrency; listAll remains bounded at8. Canonical SSH roots avoid local cache/registration. Trade-off:2connected direct scans use2provider listings instead of1cached result. No CPU/latency/heap improvement claim."
+      },
+      "knownGaps": [
+        "CI soak pending.",
+        "Local and daemon PTY, terminal output and mobile wire are unaffected.",
+        "Native Linux/Windows, live SSH/WSL and paired runtime-host integrations not executed. Generic runtime rows retain refusal.",
+        "Catalog list/listAll may still return a superseded plain-array snapshot; this gate prevents stale lineage side effects, not all response staleness.",
+        "Canonical forgetRemovedForExecutionHost remains outside scope; no new destructive authorization.",
+        "Filesystem classifier and registry defects are separate repairs; this gate only prevents listing-induced local-root admission.",
+        "Canonical SSH bypasses the improper5second local cache, increasing provider calls. No replacement cache or physical cancellation claim."
+      ],
+      "promotionCriteria": [
+        "Retain exact-owner, no-local-I/O, cache-admission and overtaken-lineage controls; collect CI soak and real provider coverage."
+      ],
+      "demotionRule": "Keep experimental until soak; investigate host/lineage regressions without weakening ownership assertions or adding blind retries."
+    },
     {
       "id": "xterm-addon.boundary-containment",
       "title": "xterm addon failures stay pane-scoped and input survives",
@@ -17477,6 +18317,86 @@
       ],
       "demotionRule": "Demote or quarantine if the gate flakes once without a product bug or harness bug filed to the owner."
     },
+    {
+      "id": "runtime-events.renderer-subscription-ownership",
+      "title": "Runtime events stay owned by their renderer subscription",
+      "maturity": "experimental",
+      "protection": "partial",
+      "owner": "runtime-platform",
+      "layer": "ipc-contract",
+      "surfaces": [
+        "renderer runtime events",
+        "remote runtime reconnect replay",
+        "renderer Linear refresh"
+      ],
+      "platforms": ["macos", "linux", "windows"],
+      "providers": ["remote-runtime"],
+      "coveredPlatforms": ["macos"],
+      "coveredProviders": ["remote-runtime"],
+      "coverageNotes": "Actual renderer manager, bridge, store actions, adapter and preload dispatcher with synthetic IPC boundaries on macOS. No rendered/native lifecycle, live peer or real provider network claim.",
+      "motivatingLinks": [
+        "https://github.com/stablyai/orca/blob/main/src/renderer/src/hooks/runtime-client-events-sync.ts"
+      ],
+      "invariant": "Only the current subscription attempt can cause renderer event work or reconnect recovery. Current early frames and other hosts survive; canceled late setup handles dispose.",
+      "oracle": "Hold setup, clean up the bridge, deliver100 events and a replay, and require zero provider read dispatches/cache publications/recovery/re-subscriptions. Require initial/live delivery, same-ID replacement, rekey, stop during synchronous setup, sibling host survival and late disposal.",
+      "commands": [
+        "ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/hooks/runtime-client-events-sync-ownership.test.ts src/renderer/src/hooks/ipc-events/runtime-client-ipc-bridge-ownership.test.ts src/renderer/src/hooks/runtime-client-events-sync.test.ts src/renderer/src/hooks/ipc-events/runtime-reconnect-host-status.test.ts src/renderer/src/runtime/runtime-client-events.test.ts src/preload/runtime-environment-subscriptions.test.ts"
+      ],
+      "testFiles": [
+        "src/renderer/src/hooks/runtime-client-events-sync-ownership.test.ts",
+        "src/renderer/src/hooks/ipc-events/runtime-client-ipc-bridge-ownership.test.ts",
+        "src/renderer/src/hooks/runtime-client-events-sync.test.ts",
+        "src/renderer/src/hooks/ipc-events/runtime-reconnect-host-status.test.ts",
+        "src/renderer/src/runtime/runtime-client-events.test.ts",
+        "src/preload/runtime-environment-subscriptions.test.ts"
+      ],
+      "assertionRefs": [
+        {
+          "file": "src/renderer/src/hooks/ipc-events/runtime-client-ipc-bridge-ownership.test.ts",
+          "assertions": [
+            "does no Linear read dispatch or cache publication after cleanup while setup is pending",
+            "does no replay recovery or resubscription after cleanup",
+            "accepts a fresh bridge early frame while rejecting the previous bridge frame"
+          ]
+        }
+      ],
+      "evidenceRuns": [
+        {
+          "date": "2026-09-25",
+          "runner": "local",
+          "platform": "macos",
+          "command": "ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/hooks/runtime-client-events-sync-ownership.test.ts src/renderer/src/hooks/ipc-events/runtime-client-ipc-bridge-ownership.test.ts src/renderer/src/hooks/runtime-client-events-sync.test.ts src/renderer/src/hooks/ipc-events/runtime-reconnect-host-status.test.ts src/renderer/src/runtime/runtime-client-events.test.ts src/preload/runtime-environment-subscriptions.test.ts",
+          "result": "passed",
+          "durationSeconds": 2.12,
+          "summary": "41 tests /6 suites pass;13 new regressions have12 failures /1 pass against original production source."
+        }
+      ],
+      "runtimeBudget": {
+        "p95Seconds": 15,
+        "scope": "Focused deterministic renderer/preload suites; p95 not established."
+      },
+      "flakeHistory": {
+        "status": "not-started",
+        "evidence": "Local validation only; no CI soak."
+      },
+      "redGreenEvidence": {
+        "status": "complete",
+        "evidence": "12/13 new tests fail original source; candidate41 tests pass.100 stale dispatches/publications become0 each."
+      },
+      "performanceBudget": {
+        "required": true,
+        "evidence": "No new timers, scans or IPC. Per-event O(1) owner guard adds paired median0.026ms/10k pending events and0.062ms/10k settled events. Each benchmark delivers2.2million events with no per-event desired/key reads. Synthetic timing, no rendered latency claim."
+      },
+      "knownGaps": [
+        "No native Windows/Linux/WSL, live SSH/remote or rendered app lifecycle test.",
+        "Already-admitted asynchronous handlers are not canceled; physical listener cleanup still waits for setup settlement.",
+        "No CI soak or mounted render/network/heap measurement."
+      ],
+      "promotionCriteria": [
+        "Retain actual composed dispatch/publication and late-disposal oracles; add CI soak and cross-platform lifecycle evidence before promotion."
+      ],
+      "demotionRule": "Keep experimental until soak; investigate failures without suppressing ownership assertions or unexplained retries."
+    },
     {
       "id": "runtime-files.watcher-process-isolation",
       "title": "Runtime and SSH relay watcher faults stay process-isolated without disrupting host services",
@@ -20275,6 +21195,236 @@
         "Default config paths are shared with GNOME on a disposable hosted CI runner; nested mode refuses non-GitHub-Actions execution."
       ],
       "demotionRule": "Keep experimental on unexplained failures; retain exact bytes and participation checks without retries, skips, or longer deadlines."
+    },
+    {
+      "id": "relay.control-activation-ownership",
+      "title": "Closed queued controls leave persistence for the live retry",
+      "maturity": "experimental",
+      "protection": "partial",
+      "owner": "relay",
+      "layer": "registry-unit-and-local-websocket",
+      "surfaces": ["relay host control activation"],
+      "platforms": ["macos", "linux", "windows"],
+      "providers": ["relay"],
+      "coveredPlatforms": ["macos"],
+      "coveredProviders": ["relay"],
+      "coverageNotes": "Actual registry queue with controlled store latency plus local WebSocket proof and connection-capacity suites on macOS. No PostgreSQL or live remote host run. PTY, daemon, SSH process state, WSL execution and folder/git workspace behavior are unaffected.",
+      "motivatingLinks": [
+        "https://github.com/stablyai/orca/blob/main/cloud/apps/relay/src/host-session-registry.ts"
+      ],
+      "invariant": "A closed queued transport starts no durable activation; an already-started activation retains cleanup, and a live successor becomes the indexed control without concurrent same-host activation.",
+      "oracle": "Queue a closed control before a live retry behind stalled persistence. With controlled 4s store calls, require two total activations, one release for the already-started closed control, and live readiness at 4s. Existing tests retain cleanup when closure happens during I/O.",
+      "commands": [
+        "ORCA_BACKGROUND_LAUNCH=1 pnpm --dir cloud/apps/relay exec vitest run ../../../cloud/apps/relay/src/host-session-registry.test.ts ../../../cloud/apps/relay/src/host-session-client-accept.test.ts ../../../cloud/apps/relay/src/relay-host-proof-failure.blackbox.test.ts ../../../cloud/apps/relay/src/relay-connection-hard-cap.blackbox.test.ts --silent=false"
+      ],
+      "testFiles": [
+        "cloud/apps/relay/src/host-session-registry.test.ts",
+        "cloud/apps/relay/src/host-session-client-accept.test.ts",
+        "cloud/apps/relay/src/relay-host-proof-failure.blackbox.test.ts",
+        "cloud/apps/relay/src/relay-connection-hard-cap.blackbox.test.ts"
+      ],
+      "assertionRefs": [
+        {
+          "file": "cloud/apps/relay/src/host-session-registry.test.ts",
+          "assertions": [
+            "skips a closed queued control so its live retry avoids abandoned database work",
+            "does not publish a control that closes during activation",
+            "does not rebind a control that closes during activation",
+            "fails a control waiting behind a stalled activation without breaking serialization"
+          ]
+        }
+      ],
+      "evidenceRuns": [
+        {
+          "date": "2026-09-25",
+          "runner": "local",
+          "platform": "macos",
+          "command": "ORCA_BACKGROUND_LAUNCH=1 pnpm --dir cloud/apps/relay exec vitest run ../../../cloud/apps/relay/src/host-session-registry.test.ts ../../../cloud/apps/relay/src/host-session-client-accept.test.ts ../../../cloud/apps/relay/src/relay-host-proof-failure.blackbox.test.ts ../../../cloud/apps/relay/src/relay-connection-hard-cap.blackbox.test.ts --silent=false",
+          "result": "passed",
+          "durationSeconds": 0.407,
+          "summary": "88 tests across four files passed; relay typecheck passed separately."
+        }
+      ],
+      "runtimeBudget": {
+        "p95Seconds": 30,
+        "scope": "Focused unit and local socket suites; p95 not established."
+      },
+      "flakeHistory": {
+        "status": "not-started",
+        "evidence": "Local validation only; no CI soak."
+      },
+      "redGreenEvidence": {
+        "status": "complete",
+        "evidence": "Baseline regression failed: three activation calls, two releases, live ready at 8s. Guarded registry passed with two calls, one release, live ready at 4s under controlled store latency."
+      },
+      "performanceBudget": {
+        "required": true,
+        "evidence": "Deletes abandoned persistence before it starts. No new timer, polling, queue, provider call or wire change; existing FIFO and post-I/O cleanup remain."
+      },
+      "knownGaps": [
+        "No real PostgreSQL contention benchmark or live remote host/physical mobile run.",
+        "Windows/Linux execution and CI soak are not recorded; queue cleanup after a never-settling predecessor remains unchanged."
+      ],
+      "promotionCriteria": [
+        "Retain red/green count and latency assertions; collect cross-platform and CI soak evidence."
+      ],
+      "demotionRule": "Keep experimental until soak evidence; investigate lifecycle failures without retries or weakening count, identity or cleanup assertions."
+    },
+    {
+      "id": "relay.assignment-headroom-scope",
+      "title": "Single-cell admission preserves capacity with bounded headroom reads",
+      "maturity": "experimental",
+      "protection": "partial",
+      "owner": "relay",
+      "layer": "sqlite-store-integration",
+      "surfaces": ["relay assignment admission", "relay migration target capacity"],
+      "platforms": ["macos", "linux", "windows"],
+      "providers": ["relay"],
+      "coveredPlatforms": ["macos"],
+      "coveredProviders": ["relay"],
+      "coverageNotes": "Actual assignment store and SQLite tests on macOS. No real PostgreSQL or live remote host/physical phone run. Local/daemon PTY, SSH execution ownership, WSL, folder/git workspace behavior and transport framing are unaffected.",
+      "motivatingLinks": ["https://github.com/stablyai/orca/issues/23035"],
+      "invariant": "A single-cell capacity check reads only that cell while retaining snapshot freshness, incarnation, outstanding reservation and missing-limit policy; new placement retains the full fleet inventory.",
+      "oracle": "With 32 capped cells, an existing active host stays on its pinned cell and reads one headroom row; new placement reads all 32. Missing, expired or prior-incarnation snapshots, capacity exhaustion and outstanding debt still refuse the active pinned host; an uncapped cell remains admissible.",
+      "commands": [
+        "ORCA_BACKGROUND_LAUNCH=1 pnpm --dir cloud/apps/relay exec vitest run ../../../cloud/apps/relay/src/assignment-headroom-scope.test.ts ../../../cloud/apps/relay/src/assignment-connection-headroom.test.ts ../../../cloud/apps/relay/src/assignment-store.test.ts ../../../cloud/apps/relay/src/assignment-store-lock-order.test.ts ../../../cloud/apps/relay/src/cell-inventory-lock-contention.test.ts ../../../cloud/apps/relay/src/assignment-isolated-cell-replacement.test.ts ../../../cloud/apps/relay/src/regional-rehome-target-selection.test.ts --silent=false"
+      ],
+      "testFiles": [
+        "cloud/apps/relay/src/assignment-headroom-scope.test.ts",
+        "cloud/apps/relay/src/assignment-connection-headroom.test.ts",
+        "cloud/apps/relay/src/assignment-store.test.ts",
+        "cloud/apps/relay/src/assignment-store-lock-order.test.ts",
+        "cloud/apps/relay/src/cell-inventory-lock-contention.test.ts",
+        "cloud/apps/relay/src/assignment-isolated-cell-replacement.test.ts",
+        "cloud/apps/relay/src/regional-rehome-target-selection.test.ts"
+      ],
+      "assertionRefs": [
+        {
+          "file": "cloud/apps/relay/src/assignment-headroom-scope.test.ts",
+          "assertions": [
+            "reads one cell for a sticky assignment even when the capped fleet grows",
+            "still considers the full fleet for a new placement",
+            "rejects the pinned active host with %s",
+            "preserves admission for cells without a connection limit",
+            "counts outstanding reservations at the admission boundary"
+          ]
+        }
+      ],
+      "evidenceRuns": [
+        {
+          "date": "2026-09-25",
+          "runner": "local",
+          "platform": "macos",
+          "command": "ORCA_BACKGROUND_LAUNCH=1 pnpm --dir cloud/apps/relay exec vitest run ../../../cloud/apps/relay/src/assignment-headroom-scope.test.ts ../../../cloud/apps/relay/src/assignment-connection-headroom.test.ts ../../../cloud/apps/relay/src/assignment-store.test.ts ../../../cloud/apps/relay/src/assignment-store-lock-order.test.ts ../../../cloud/apps/relay/src/cell-inventory-lock-contention.test.ts ../../../cloud/apps/relay/src/assignment-isolated-cell-replacement.test.ts ../../../cloud/apps/relay/src/regional-rehome-target-selection.test.ts --silent=false",
+          "result": "passed",
+          "durationSeconds": 0.513,
+          "summary": "189 tests across seven files passed; independent root rerun also passed189 tests. Relay typecheck passed separately."
+        }
+      ],
+      "runtimeBudget": {
+        "p95Seconds": 30,
+        "scope": "Focused SQLite store/capacity/lock-order suites; p95 not established."
+      },
+      "flakeHistory": {
+        "status": "not-started",
+        "evidence": "Local validation only; no CI soak."
+      },
+      "redGreenEvidence": {
+        "status": "complete",
+        "evidence": "Baseline two count regressions failed: sticky headroom 32 rows instead of 1 and uncapped target 31 unrelated rows instead of 0. Narrowed query passes all eight regression cases."
+      },
+      "performanceBudget": {
+        "required": true,
+        "evidence": "Actual sticky path result rows 32 to 1; no new timer, polling, queue, cache or provider call. Supplemental SQLite query benchmark with 32 cells and 400 active reservations each measured median per-query 0.285ms to 0.022ms; not a production PostgreSQL latency claim."
+      },
+      "knownGaps": [
+        "Real PostgreSQL query plan and concurrent admission not rerun for the scoped variant.",
+        "Windows/Linux execution, live remote host/mobile flows and CI soak are not recorded."
+      ],
+      "promotionCriteria": [
+        "Retain red/green row budget and semantic admission cases; collect PostgreSQL, cross-platform and CI soak evidence."
+      ],
+      "demotionRule": "Keep experimental until soak evidence; investigate admission/ownership regressions without weakening row or capacity assertions."
+    },
+    {
+      "id": "terminal-history.tombstone-rescan-ownership",
+      "title": "Shell-history cleanup reuses one directory listing while preserving deletion ownership",
+      "maturity": "experimental",
+      "protection": "partial",
+      "owner": "desktop-runtime",
+      "layer": "main-filesystem-contract",
+      "surfaces": ["shell-history tombstone cleanup", "native and WSL history deletion"],
+      "platforms": ["macos", "linux", "windows"],
+      "providers": ["local", "wsl"],
+      "coveredPlatforms": ["macos"],
+      "coveredProviders": ["local", "wsl"],
+      "coverageNotes": "Actual macOS temp-filesystem deletion and fake WSL cleanup ownership. Live Windows, Linux and WSL execution untested; SSH and daemon replay unaffected because every path here is host-local.",
+      "motivatingLinks": ["https://github.com/stablyai/orca/issues/23030"],
+      "invariant": "Only renamed tombstones are recursively removed, active plus retry admissions stay at 64, retries retain their delays and exhaustion behavior, a root displaced at the cap is admitted from another root's freed slot, and no tombstone is handed to removal twice per listing.",
+      "oracle": "Drain 1,024 real directory entries in controlled batches using at most 8 directory listings and 64 active removals. Exercise late arrivals discovered after the listing, both roots draining under one shared cap, a failing listing mid-drain, delayed failure retries, exhausted attempt budgets, and cancellation of an in-flight listing.",
+      "commands": [
+        "ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/main/terminal-history-tombstone-scan-cost.test.ts src/main/terminal-history-async-delete.test.ts src/main/terminal-history-tombstone-retry.test.ts src/main/terminal-history-gc-fs-call-count.test.ts src/main/terminal-history-gc.test.ts src/main/terminal-history.test.ts"
+      ],
+      "testFiles": [
+        "src/main/terminal-history-tombstone-scan-cost.test.ts",
+        "src/main/terminal-history-async-delete.test.ts",
+        "src/main/terminal-history-tombstone-retry.test.ts",
+        "src/main/terminal-history-gc-fs-call-count.test.ts",
+        "src/main/terminal-history-gc.test.ts",
+        "src/main/terminal-history.test.ts"
+      ],
+      "assertionRefs": [
+        {
+          "file": "src/main/terminal-history-tombstone-scan-cost.test.ts",
+          "assertions": [
+            "drains 1024 tombstones without re-reading the directory per completion",
+            "picks up a tombstone created after the queued names were read",
+            "drains both roots within the shared admission cap without per-completion reads",
+            "keeps draining after a directory read fails mid-drain",
+            "drops an in-flight refill during fixture cleanup",
+            "preserves delayed failure retries while successful removals replenish the queue",
+            "does not retry a tombstone past its attempt budget when another root frees slots"
+          ]
+        }
+      ],
+      "evidenceRuns": [
+        {
+          "date": "2026-09-26",
+          "runner": "local",
+          "platform": "macos",
+          "command": "ORCA_BACKGROUND_LAUNCH=1 pnpm exec vitest run --config config/vitest.config.ts src/main/terminal-history-tombstone-scan-cost.test.ts src/main/terminal-history-async-delete.test.ts src/main/terminal-history-tombstone-retry.test.ts src/main/terminal-history-gc-fs-call-count.test.ts src/main/terminal-history-gc.test.ts src/main/terminal-history.test.ts",
+          "result": "passed",
+          "durationSeconds": 1.95,
+          "summary": "86 tests across six suites passed, repeated three times with no flakes."
+        }
+      ],
+      "runtimeBudget": {
+        "p95Seconds": 15,
+        "scope": "focused temp-filesystem history tests"
+      },
+      "flakeHistory": {
+        "status": "unknown",
+        "evidence": "Local author and independent runs pass; CI/soak history not collected."
+      },
+      "redGreenEvidence": {
+        "status": "complete",
+        "evidence": "Pre-change main lists the tombstone directory 1,026 times for 1,024 tombstones and fails the bounded-listing oracle. Reusing one listing reduces it to 6 while still removing every entry."
+      },
+      "performanceBudget": {
+        "required": true,
+        "evidence": "Five real-filesystem samples per version, 1,024 tombstone directories each holding a meta.json, macOS arm64 / Node 24, identical harness. Median directory listings 1,026 to 6, names enumerated 494,348 to 1,077, blocking main-thread time in the rescan path 820 to 7 ms (the listings themselves 266 to 2.7 ms, and now off-thread), total drain 886 to 75 ms. The remaining ~70 ms is the recursive rm itself and is unchanged. Average concurrent removals 62 of 64, restored from the 46 an event-loop-deferred refill left idle. No polling, no new timers, and no work deferred past process exit."
+      },
+      "promotionCriteria": [
+        "Collect 100 consecutive CI passes or 14 days of soak history.",
+        "Run native Windows and WSL history cleanup on real filesystems."
+      ],
+      "knownGaps": [
+        "No rendered UI latency measurement or physical Windows/Linux/WSL run.",
+        "One listing is retained per root while it drains, about 160 KB per 1,024 tombstones, shrinking as names are consumed.",
+        "A small backlog still costs roughly one listing per completion batch, of a directory that is nearly empty by then.",
+        "A tombstone that exhausts its retries stays on disk until the next startup, unchanged from before."
+      ],
+      "demotionRule": "Keep experimental or demote if the reused listing strands a displaced root, crosses the admission cap, rearms an exhausted retry through another root, hands one tombstone to removal twice, or touches a recreated live history path."
     }
   ]
 }
diff --git a/config/scripts/audit-localization-coverage.mjs b/config/scripts/audit-localization-coverage.mjs
index e25a7bc222e1..c5f27a664228 100644
--- a/config/scripts/audit-localization-coverage.mjs
+++ b/config/scripts/audit-localization-coverage.mjs
@@ -7,9 +7,9 @@ import process from 'node:process'
 import ts from 'typescript-api'
 
 const SOURCE_EXTENSIONS = new Set(['.ts', '.tsx', '.js', '.jsx', '.mts', '.cts'])
-// Why: test-only modules live beside their spec as `*-test-harness.ts` / `*-fixtures.ts` here, not under `__tests__/`.
+// Why: test-only modules live beside their spec as `*-test-harness.ts` / `*-test-rig.ts` / `*-fixtures.ts` here, not under `__tests__/`.
 const TEST_SUPPORT_FILE_PATTERN =
-  /[.-](?:test-harness|test-fixtures?|test-state|test-support|fixtures?)\.[cm]?[jt]sx?$/
+  /[.-](?:test-harness|test-rig|test-fixtures?|test-state|test-support|fixtures?)\.[cm]?[jt]sx?$/
 const SKIP_PATH_PARTS = new Set(['.git', 'dist', 'node_modules', 'out', '__snapshots__', 'assets'])
 const LOCALIZATION_CALL_NAMES = new Set(['t', 'translate'])
 const USER_VISIBLE_JSX_ATTRIBUTES = new Set([
diff --git a/config/scripts/audit-localization-coverage.test.mjs b/config/scripts/audit-localization-coverage.test.mjs
index 477054f2e8fa..6460dc9f36d3 100644
--- a/config/scripts/audit-localization-coverage.test.mjs
+++ b/config/scripts/audit-localization-coverage.test.mjs
@@ -50,6 +50,7 @@ describe('localization coverage file skipping', () => {
 
   it('skips test-only modules that sit beside their spec', () => {
     expect(skipped('src/renderer/src/components/browser-pane/stream-test-harness.ts')).toBe(true)
+    expect(skipped('src/renderer/src/runtime/browser-tab-creation-test-rig.ts')).toBe(true)
     expect(skipped('src/renderer/src/hooks/ipc-events-test-fixtures.ts')).toBe(true)
     expect(skipped('src/renderer/src/lib/session-test-state.ts')).toBe(true)
     expect(skipped('src/renderer/src/store/slices/routing-fixture.ts')).toBe(true)
diff --git a/config/scripts/build-mobile-web-app-bundle.mjs b/config/scripts/build-mobile-web-app-bundle.mjs
index 51178e9bed5f..1bfad89b6e73 100644
--- a/config/scripts/build-mobile-web-app-bundle.mjs
+++ b/config/scripts/build-mobile-web-app-bundle.mjs
@@ -1,4 +1,5 @@
 import { readFile } from 'node:fs/promises'
+import { readRouteSnapshot } from './mobile-web-app-route-snapshot.mjs'
 import { realpathSync } from 'node:fs'
 import { basename, extname, join, resolve } from 'node:path'
 import { createRequire } from 'node:module'
@@ -466,7 +467,10 @@ const isScriptOutput = (path) => path.endsWith('.js')
  * wrap every route, and their imports are part of the page as surely as the route module's.
  */
 export async function mobileWebAppRouteClosure(routeModule) {
-  return await mobileWebAppModuleClosure(['app/_layout', 'app/h/_layout', routeModule])
+  return (
+    readRouteSnapshot(routeModule) ??
+    (await mobileWebAppModuleClosure(['app/_layout', 'app/h/_layout', routeModule]))
+  )
 }
 
 /**
diff --git a/config/scripts/build-mobile-web-app-bundle.test.mjs b/config/scripts/build-mobile-web-app-bundle.test.mjs
index cd56aa98c0ab..baa18b6b39d2 100644
--- a/config/scripts/build-mobile-web-app-bundle.test.mjs
+++ b/config/scripts/build-mobile-web-app-bundle.test.mjs
@@ -1,8 +1,13 @@
-import { mkdir, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'
-import { tmpdir } from 'node:os'
+import { mkdir, readFile, writeFile } from 'node:fs/promises'
 import { join, relative } from 'node:path'
 import { fileURLToPath } from 'node:url'
 import { describe, expect, it } from 'vitest'
+import {
+  withScratch,
+  readAppBundle,
+  readWrittenBundle,
+  copyWrittenBundle
+} from './mobile-web-app-bundle-test-fixture.mjs'
 import {
   MOBILE_WEB_APP_NATIVE_PARITY_STYLE,
   MOBILE_WEB_APP_ROOT_RESET,
@@ -65,15 +70,6 @@ function allScriptSource({ script, chunks }) {
   return [script, ...chunks.map((chunk) => chunk.bytes)].map((bytes) => bytes.toString('utf8'))
 }
 
-async function withScratch(run) {
-  const scratch = await mkdtemp(join(tmpdir(), 'orca-mobile-web-app-test-'))
-  try {
-    return await run(scratch)
-  } finally {
-    await rm(scratch, { recursive: true, force: true })
-  }
-}
-
 describe('the CRLF pin', () => {
   it('exempts the same extensions in .gitattributes as the CRLF scan skips', async () => {
     const attributes = await readFile(join(projectDir, '.gitattributes'), 'utf8')
@@ -91,8 +87,36 @@ describe('the CRLF pin', () => {
 })
 
 describeBundling('the app bundle', () => {
+  it('isolates read-only fixture consumers from mutations in another assertion', async () => {
+    const first = await readAppBundle()
+    const original = first.script[0]
+    first.script[0] ^= 255
+    first.chunks.length = 0
+    first.routeKeys.length = 0
+    const next = await readAppBundle()
+    expect(next.script[0]).toBe(original)
+    expect(next.chunks.length).toBeGreaterThan(0)
+    expect(next.routeKeys.length).toBeGreaterThan(0)
+    const written = await readWrittenBundle()
+    written.manifest.assets.length = 0
+    expect((await readWrittenBundle()).manifest.assets.length).toBeGreaterThan(0)
+    const originalByte = written.files[0].bytes[0]
+    written.files[0].bytes[0] ^= 255
+    expect((await readWrittenBundle()).files[0].bytes[0]).toBe(originalByte)
+    await withScratch(async (scratch) => {
+      const firstDir = join(scratch, 'first')
+      await copyWrittenBundle(firstDir)
+      await writeFile(join(firstDir, 'manifest.json'), 'corrupted')
+      const secondDir = join(scratch, 'second')
+      const second = await copyWrittenBundle(secondDir)
+      for (const { file, bytes } of second.files) {
+        expect((await readFile(join(secondDir, file))).equals(bytes), file).toBe(true)
+      }
+    })
+  }, 120_000)
+
   it('resolves react-native to react-native-web and leaves no require.context', async () => {
-    const sources = allScriptSource(await bundleMobileWebApp())
+    const sources = allScriptSource(await readAppBundle())
     for (const source of sources) {
       expect(source).not.toContain('require.context')
     }
@@ -101,7 +125,7 @@ describeBundling('the app bundle', () => {
   }, 120_000)
 
   it('cuts the routes into chunks the entry does not load', async () => {
-    const { script, chunks, entryStaticBytes } = await bundleMobileWebApp()
+    const { script, chunks, entryStaticBytes } = await readAppBundle()
     expect(chunks.length).toBeGreaterThan(1)
     // The entry's own bytes plus the chunks it imports statically, which is what the browser
     // parses before any route paints. Every route chunk is outside it.
@@ -112,7 +136,7 @@ describeBundling('the app bundle', () => {
   }, 120_000)
 
   it('names the chunk each route lands in', async () => {
-    const { chunks, routeChunks, routeKeys } = await bundleMobileWebApp()
+    const { chunks, routeChunks, routeKeys } = await readAppBundle()
     expect(Object.keys(routeChunks).sort()).toEqual([...routeKeys].sort())
     const emitted = new Set(chunks.map((chunk) => chunk.name))
     for (const [key, name] of Object.entries(routeChunks)) {
@@ -202,7 +226,7 @@ describeBundling('the app bundle', () => {
   )
 
   it('bundles every route module', async () => {
-    const { routeKeys } = await bundleMobileWebApp()
+    const { routeKeys } = await readAppBundle()
     expect(routeKeys).toEqual(await collectMobileWebAppRouteKeys(appDir))
   }, 120_000)
 
@@ -274,7 +298,7 @@ describeBundling('the app bundle', () => {
   }, 240_000)
 
   it("names an output the same way the manifest's own asset hash does", async () => {
-    const { script, chunks } = await bundleMobileWebApp()
+    const { script, chunks } = await readAppBundle()
     // The name is embedded in the importer, so it cannot be recomputed later; this is what says
     // the name inside the bytes and the manifest's sha256 of those bytes are the same string.
     expect(hashedAsset(script, 'js').path).toBe(`assets/${sha256Hex(script)}.js`)
@@ -330,7 +354,7 @@ describeBundling('the app bundle', () => {
     // once per call. The file explorer calls triggerSelection on every row tap, and C1.9 already
     // traced a swallowed long press on the worktree list to that stray click. `haptics.web.ts` is
     // what keeps the whole shim out of the bundle, so this reads the bytes rather than the import.
-    for (const source of allScriptSource(await bundleMobileWebApp())) {
+    for (const source of allScriptSource(await readAppBundle())) {
       // The shim's own fingerprint, not `navigator.vibrate`: react-native-web's Vibration export
       // calls that too, and it touches no DOM until something invokes it.
       expect(source).not.toContain('ariaHidden')
@@ -340,7 +364,7 @@ describeBundling('the app bundle', () => {
   }, 120_000)
 
   it("ships react-native-web's hairline at one device pixel, whichever of its builds resolves", async () => {
-    const sources = allScriptSource(await bundleMobileWebApp())
+    const sources = allScriptSource(await readAppBundle())
     // Minified, so the assignment reads `<name>.hairlineWidth=`; RNW's own value is the literal 1.
     const assignments = sources.flatMap(
       (source) => source.match(/\.hairlineWidth=[^;]{0,120}/g) ?? []
@@ -354,7 +378,7 @@ describeBundling('the app bundle', () => {
   it('embeds no absolute path from this checkout', async () => {
     // Every chunk, not only the entry: the route manifest names each route by absolute path, and
     // the chunk that import resolves to is where such a path would survive.
-    for (const source of allScriptSource(await bundleMobileWebApp())) {
+    for (const source of allScriptSource(await readAppBundle())) {
       expect(source).not.toContain(projectDir)
     }
   }, 120_000)
@@ -370,76 +394,56 @@ describeBundling('the app bundle', () => {
   }, 120_000)
 
   it('loads the entry as a module, so its route imports resolve', async () => {
-    await withScratch(async (scratch) => {
-      const outDir = join(scratch, 'module-tag')
-      const { manifest } = await buildMobileWebAppBundle({ outDir })
-      const html = await readFile(join(outDir, 'index.html'), 'utf8')
-      // import() in a classic script is a syntax error, so the tag and the format are one fact.
-      expect(html).toContain('<script type="module" src="/assets/')
-      const entry = html.match(/src="\/(assets\/[^"]+)"/)?.[1]
-      expect(manifest.assets.map((asset) => asset.path)).toContain(entry)
-    })
+    const { manifest, html } = await readWrittenBundle()
+    // import() in a classic script is a syntax error, so the tag and the format are one fact.
+    expect(html).toContain('<script type="module" src="/assets/')
+    const entry = html.match(/src="\/(assets\/[^"]+)"/)?.[1]
+    expect(manifest.assets.map((asset) => asset.path)).toContain(entry)
   }, 120_000)
 
   it('declares an icon, so no browser asks the shell for one', async () => {
-    await withScratch(async (scratch) => {
-      const outDir = join(scratch, 'icon')
-      const { manifest } = await buildMobileWebAppBundle({ outDir })
-      const html = await readFile(join(outDir, 'index.html'), 'utf8')
-      // Undeclared, a browser asks the origin for /favicon.ico on its own, and the shell's asset
-      // server answers 403 because the path is in no manifest — repeatedly, on the emulator run.
-      expect(html).toContain('<link rel="icon" href="data:," />')
-      // And the empty URI rather than an asset: the bundle carries no icon, so a declaration
-      // naming one would point at a route image whose name changes with its bytes.
-      expect(manifest.assets.map((asset) => asset.path)).not.toContain('favicon.ico')
-    })
+    const { manifest, html } = await readWrittenBundle()
+    // Undeclared, a browser asks the origin for /favicon.ico on its own, and the shell's asset
+    // server answers 403 because the path is in no manifest — repeatedly, on the emulator run.
+    expect(html).toContain('<link rel="icon" href="data:," />')
+    // And the empty URI rather than an asset: the bundle carries no icon, so a declaration
+    // naming one would point at a route image whose name changes with its bytes.
+    expect(manifest.assets.map((asset) => asset.path)).not.toContain('favicon.ico')
   }, 120_000)
 
   it('declares no viewport-fit, because the shell owns the safe area', async () => {
-    await withScratch(async (scratch) => {
-      const outDir = join(scratch, 'viewport')
-      await buildMobileWebAppBundle({ outDir })
-      const html = await readFile(join(outDir, 'index.html'), 'utf8')
-      // The shell pads the WebView out of the system bars, so the page has nothing to extend
-      // under; asking to would invite a second pad from every page-side SafeAreaView.
-      expect(html).toContain(
-        '<meta name="viewport" content="width=device-width, initial-scale=1" />'
-      )
-      expect(html).not.toContain('viewport-fit')
-    })
+    const { html } = await readWrittenBundle()
+    // The shell pads the WebView out of the system bars, so the page has nothing to extend
+    // under; asking to would invite a second pad from every page-side SafeAreaView.
+    expect(html).toContain('<meta name="viewport" content="width=device-width, initial-scale=1" />')
+    expect(html).not.toContain('viewport-fit')
   }, 120_000)
 
   it('carries the root reset, so the mounted tree has a height to be 1 of', async () => {
-    await withScratch(async (scratch) => {
-      const outDir = join(scratch, 'root-reset')
-      await buildMobileWebAppBundle({ outDir })
-      const html = await readFile(join(outDir, 'index.html'), 'utf8')
-      expect(html).toContain(MOBILE_WEB_APP_ROOT_RESET)
-      expect(html).toContain(MOBILE_WEB_APP_NATIVE_PARITY_STYLE)
-      // Literals rather than substrings taken off the constant, which would read it back against
-      // itself and follow any rule dropped from it. Every rule, because the chain is only as
-      // definite as its weakest link: a height on #root alone resolves against a body that has
-      // none, and percent of auto is auto. Named one by one so a failure says which rule went.
-      for (const rule of [
-        'html,body{height:100%}',
-        'body{overflow:hidden}',
-        '#root{display:flex;height:100%;flex:1}'
-      ]) {
-        expect(MOBILE_WEB_APP_ROOT_RESET, rule).toContain(rule)
-      }
-      // The id travels with the rules: it is what marks this block as the template's reset rather
-      // than something the page grew its own copy of.
-      expect(MOBILE_WEB_APP_ROOT_RESET).toContain('<style id="expo-reset">')
-      // In the document itself, not a linked asset: the CSP that allows it is the one already
-      // relaxed for react-native-web's runtime sheet.
-      expect(html).not.toContain('<link rel="stylesheet"')
-    })
+    const { html } = await readWrittenBundle()
+    expect(html).toContain(MOBILE_WEB_APP_ROOT_RESET)
+    expect(html).toContain(MOBILE_WEB_APP_NATIVE_PARITY_STYLE)
+    // Literals rather than substrings taken off the constant, which would read it back against
+    // itself and follow any rule dropped from it. Every rule, because the chain is only as
+    // definite as its weakest link: a height on #root alone resolves against a body that has
+    // none, and percent of auto is auto. Named one by one so a failure says which rule went.
+    for (const rule of [
+      'html,body{height:100%}',
+      'body{overflow:hidden}',
+      '#root{display:flex;height:100%;flex:1}'
+    ]) {
+      expect(MOBILE_WEB_APP_ROOT_RESET, rule).toContain(rule)
+    }
+    // The id travels with the rules: it is what marks this block as the template's reset rather
+    // than something the page grew its own copy of.
+    expect(MOBILE_WEB_APP_ROOT_RESET).toContain('<style id="expo-reset">')
+    // In the document itself, not a linked asset: the CSP that allows it is the one already
+    // relaxed for react-native-web's runtime sheet.
+    expect(html).not.toContain('<link rel="stylesheet"')
   }, 120_000)
 
   it('writes the manifest shape the packaging contract reads', async () => {
-    const { manifest } = await withScratch((scratch) =>
-      buildMobileWebAppBundle({ outDir: join(scratch, 'c') })
-    )
+    const { manifest } = await readWrittenBundle()
     expect(manifest.schemaVersion).toBe(1)
     expect(manifest.entrypoint).toBe('index.html')
     expect(manifest.assets.map((asset) => asset.path)).toContain('index.html')
@@ -457,9 +461,8 @@ describe('the Phase C budget', () => {
   itBundling(
     'is not already exceeded by the current bundle',
     async () => {
-      const { manifest, chunkCount, entryStaticBytes, imageCount, routeKeys } = await withScratch(
-        (scratch) => buildMobileWebAppBundle({ outDir: join(scratch, 'd') })
-      )
+      const { manifest, chunkCount, entryStaticBytes, imageCount, routeKeys } =
+        await readWrittenBundle()
       expect(manifest.totalBytes).toBeLessThanOrEqual(MOBILE_WEB_APP_BUNDLE_MAX_TOTAL_BYTES)
       expect(manifest.assets.length).toBeLessThanOrEqual(
         mobileWebAppBundleMaxAssets(routeKeys.length, imageCount)
@@ -596,9 +599,7 @@ describe('the Phase C budget', () => {
   itBundling(
     'keeps the derived ceiling under the map the phone actually holds',
     async () => {
-      const { manifest, routeKeys, imageCount } = await withScratch((scratch) =>
-        buildMobileWebAppBundle({ outDir: join(scratch, 'e') })
-      )
+      const { manifest, routeKeys, imageCount } = await readWrittenBundle()
       const ceiling = mobileWebAppBundleMaxAssets(routeKeys.length, imageCount)
       expect(manifest.assets.length).toBeLessThanOrEqual(ceiling)
       // The native side refuses a manifest past this, so the derived ceiling has to stay inside it.
@@ -630,7 +631,7 @@ describe('the verifier', () => {
     async () => {
       await withScratch(async (scratch) => {
         const outDir = join(scratch, 'mobile-web')
-        await buildMobileWebAppBundle({ outDir })
+        await copyWrittenBundle(outDir)
         await expect(verifyMobileWebAppBundle({ bundleDir: outDir })).resolves.toBeDefined()
       })
     },
@@ -642,7 +643,7 @@ describe('the verifier', () => {
     async () => {
       await withScratch(async (scratch) => {
         const outDir = join(scratch, 'mobile-web')
-        await buildMobileWebAppBundle({ outDir })
+        await copyWrittenBundle(outDir)
         const manifestPath = join(outDir, 'manifest.json')
         const manifest = JSON.parse(await readFile(manifestPath, 'utf8'))
         manifest.buildId = 'f'.repeat(64)
@@ -660,7 +661,7 @@ describe('the verifier', () => {
     async () => {
       await withScratch(async (scratch) => {
         const outDir = join(scratch, 'mobile-web')
-        const { manifest } = await buildMobileWebAppBundle({ outDir })
+        const { manifest } = await copyWrittenBundle(outDir)
         // What a stale out/ actually looks like: every digest agrees with its bytes and the
         // buildId derives from the asset list, but the source has moved on. Only the two fresh
         // builds the verifier runs can tell, which is the check this covers.
diff --git a/config/scripts/build-orcad-bun.mjs b/config/scripts/build-orcad-bun.mjs
new file mode 100644
index 000000000000..cddd766e6cc9
--- /dev/null
+++ b/config/scripts/build-orcad-bun.mjs
@@ -0,0 +1,176 @@
+#!/usr/bin/env node
+
+import { createHash } from 'node:crypto'
+import {
+  chmodSync,
+  copyFileSync,
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  readdirSync,
+  rmSync,
+  writeFileSync
+} from 'node:fs'
+import { tmpdir } from 'node:os'
+import { basename, join, resolve } from 'node:path'
+import { orcadBunRuntimeFilename } from '../../src/shared/orcad-artifacts.ts'
+import {
+  ORCAD_BUN_RELEASE_ASSETS,
+  ORCAD_BUN_VERSION,
+  orcadBunReleaseUrl
+} from '../../src/shared/orcad-bun-runtime.ts'
+import { runProcessSync } from './script-child-process.mjs'
+import { getZipExtractorCommand } from './zip-extractor-command.mjs'
+
+const root = resolve(import.meta.dirname, '../..')
+const cacheRoot = join(root, 'out', '.orcad-bun-runtime', `v${ORCAD_BUN_VERSION}`)
+
+export function currentTarget() {
+  if (process.platform === 'darwin') {
+    return `darwin-${process.arch}`
+  }
+  if (process.platform === 'win32') {
+    return `win32-${process.arch}`
+  }
+  if (process.platform !== 'linux') {
+    throw new Error(`Unsupported Bun platform: ${process.platform}`)
+  }
+  const glibc = process.report?.getReport()?.header?.glibcVersionRuntime
+  return `linux-${process.arch}-${glibc ? 'glibc' : 'musl'}`
+}
+
+function argument(name) {
+  const index = process.argv.indexOf(name)
+  return index === -1 ? null : process.argv[index + 1]
+}
+
+async function download(url, destination) {
+  const response = await fetch(url, { redirect: 'follow', signal: AbortSignal.timeout(120_000) })
+  if (!response.ok) {
+    await response.body?.cancel()
+    throw new Error(`Bun download failed: ${response.status} ${response.statusText}`)
+  }
+  writeFileSync(destination, new Uint8Array(await response.arrayBuffer()))
+}
+
+function sha256(path) {
+  return createHash('sha256').update(readFileSync(path)).digest('hex')
+}
+
+export function bunExecutableName(target) {
+  return target.startsWith('win32-') ? 'bun.exe' : 'bun'
+}
+
+export function findBunExecutable(rootDir, target) {
+  const expected = bunExecutableName(target)
+  const entries = readdirSync(rootDir, { recursive: true, withFileTypes: true })
+  const entry = entries.find((candidate) => candidate.isFile() && candidate.name === expected)
+  if (!entry) {
+    throw new Error(`Downloaded archive contained no ${expected}`)
+  }
+  return join(entry.parentPath, entry.name)
+}
+
+function verifyRuntime(path) {
+  const result = runProcessSync({ program: path, args: ['--version'] })
+  if (result.code !== 0 || result.stdout.trim() !== ORCAD_BUN_VERSION) {
+    throw new Error(
+      `Expected Bun ${ORCAD_BUN_VERSION} at ${path}, got ${result.stdout.trim() || result.stderr.trim()}`
+    )
+  }
+}
+
+async function materializeRuntime(target, outputPath) {
+  const asset = ORCAD_BUN_RELEASE_ASSETS[target]
+  if (!asset) {
+    throw new Error(`Unsupported Bun target: ${target}`)
+  }
+  const cached = join(cacheRoot, target, orcadBunRuntimeFilename(target))
+  if (existsSync(cached) && sha256(cached) !== asset.executableSha256) {
+    rmSync(cached, { force: true })
+  }
+  if (!existsSync(cached)) {
+    const temporary = mkdtempSync(join(tmpdir(), 'orca-bun-download-'))
+    try {
+      const zipPath = join(temporary, basename(asset.filename))
+      await download(orcadBunReleaseUrl(asset), zipPath)
+      const actual = sha256(zipPath)
+      if (actual !== asset.sha256) {
+        throw new Error(`Bun checksum mismatch for ${asset.filename}: ${actual}`)
+      }
+      const extracted = join(temporary, 'extracted')
+      mkdirSync(extracted)
+      // Node 24.16 can leave extract-zip's stream promise unsettled with no active handles.
+      const command = getZipExtractorCommand(zipPath, extracted)
+      const result = runProcessSync({
+        program: command.file,
+        args: command.args,
+        timeoutMs: 120_000
+      })
+      if (result.code !== 0) {
+        throw new Error(
+          `Bun archive extraction failed with exit ${result.code}: ${result.stderr || result.stdout}`
+        )
+      }
+      mkdirSync(join(cacheRoot, target), { recursive: true })
+      copyFileSync(findBunExecutable(extracted, target), cached)
+      if (!target.startsWith('win32-')) {
+        chmodSync(cached, 0o755)
+      }
+    } finally {
+      rmSync(temporary, { recursive: true, force: true })
+    }
+  }
+  const executableHash = sha256(cached)
+  if (executableHash !== asset.executableSha256) {
+    throw new Error(`Bun executable checksum mismatch for ${target}: ${executableHash}`)
+  }
+  if (target === currentTarget()) {
+    verifyRuntime(cached)
+  }
+  mkdirSync(resolve(outputPath, '..'), { recursive: true })
+  if (resolve(cached) !== resolve(outputPath)) {
+    copyFileSync(cached, outputPath)
+  }
+  if (!target.startsWith('win32-')) {
+    chmodSync(outputPath, 0o755)
+  }
+}
+
+async function main() {
+  const target = argument('--target') ?? currentTarget()
+  const outputDir = argument('--out-dir')
+  const cachedRuntimePath = join(cacheRoot, target, orcadBunRuntimeFilename(target))
+  const runtimePath =
+    process.argv.includes('--runtime-only') && outputDir
+      ? join(resolve(outputDir), orcadBunRuntimeFilename(target))
+      : cachedRuntimePath
+  await materializeRuntime(target, runtimePath)
+
+  if (process.argv.includes('--runtime-only')) {
+    process.stdout.write(`${runtimePath}\n`)
+    return
+  }
+  const result = runProcessSync({
+    program: process.execPath,
+    args: [join(root, 'config/scripts/build-orcad.mjs')],
+    cwd: root,
+    env: {
+      ...process.env,
+      ORCAD_BUILD_TARGET: target,
+      ORCAD_BUILD_TARGET_IS_CURRENT: target === currentTarget() ? '1' : '0',
+      ORCAD_BUN_RUNTIME_PATH: runtimePath,
+      ...(outputDir ? { ORCAD_OUT_DIR: resolve(outputDir) } : {})
+    },
+    stdio: 'inherit',
+    timeoutMs: null
+  })
+  if (result.code !== 0) {
+    process.exit(result.code ?? 1)
+  }
+}
+
+if (process.argv[1]?.endsWith('build-orcad-bun.mjs')) {
+  await main()
+}
diff --git a/config/scripts/build-orcad-bun.test.mjs b/config/scripts/build-orcad-bun.test.mjs
new file mode 100644
index 000000000000..bb3f06bc0794
--- /dev/null
+++ b/config/scripts/build-orcad-bun.test.mjs
@@ -0,0 +1,39 @@
+import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { tmpdir } from 'node:os'
+import { afterEach, describe, expect, it } from 'vitest'
+import { bunExecutableName, findBunExecutable } from './build-orcad-bun.mjs'
+
+const temporaryDirs = []
+
+afterEach(() => {
+  for (const dir of temporaryDirs.splice(0)) {
+    rmSync(dir, { recursive: true, force: true })
+  }
+})
+
+function archiveTree(filename) {
+  const root = mkdtempSync(join(tmpdir(), 'orcad-bun-archive-'))
+  temporaryDirs.push(root)
+  const nested = join(root, 'bun-release')
+  mkdirSync(nested)
+  writeFileSync(join(nested, filename), '')
+  return root
+}
+
+describe('orcad Bun archive extraction', () => {
+  it('selects bun.exe for a Windows target on a non-Windows builder', () => {
+    const root = archiveTree('bun.exe')
+    expect(findBunExecutable(root, 'win32-x64')).toBe(join(root, 'bun-release', 'bun.exe'))
+  })
+
+  it('selects bun for a POSIX target', () => {
+    const root = archiveTree('bun')
+    expect(findBunExecutable(root, 'linux-x64-glibc')).toBe(join(root, 'bun-release', 'bun'))
+  })
+
+  it('derives executable names from the target rather than the builder host', () => {
+    expect(bunExecutableName('win32-arm64')).toBe('bun.exe')
+    expect(bunExecutableName('darwin-arm64')).toBe('bun')
+  })
+})
diff --git a/config/scripts/build-orcad-template.mjs b/config/scripts/build-orcad-template.mjs
new file mode 100644
index 000000000000..a69a6ee8485e
--- /dev/null
+++ b/config/scripts/build-orcad-template.mjs
@@ -0,0 +1,122 @@
+#!/usr/bin/env node
+
+import { createHash } from 'node:crypto'
+import {
+  chmodSync,
+  copyFileSync,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  rmSync,
+  writeFileSync
+} from 'node:fs'
+import { dirname, join, resolve } from 'node:path'
+import {
+  ORCAD_BUILD_TARGET_FILENAME,
+  ORCAD_TEMPLATE_MANIFEST_FILENAME,
+  ORCAD_TEMPLATE_TARGETS_DIR,
+  ORCAD_RIPGREP_ARTIFACTS,
+  orcadTemplateCommonFilenames
+} from '../../src/shared/orcad-artifacts.ts'
+import { orcadAgentBrowserNativeName } from '../../src/shared/orcad-agent-browser-name.ts'
+import { ORCAD_TEMPLATE_TARGETS } from '../../src/shared/orcad-bun-runtime.ts'
+import { runProcessSync } from './script-child-process.mjs'
+import { materializeWatcherPackage } from './orcad-watcher-package.mjs'
+import { verifyPackagedOrcadTemplate } from './verify-packaged-orcad-template.cjs'
+
+const root = resolve(import.meta.dirname, '../..')
+const outputDir = join(root, 'out', 'orcad-template')
+const buildDir = join(root, 'out', '.orcad-template-build')
+const commonArtifacts = orcadTemplateCommonFilenames()
+
+function copy(source, destination, executable = false) {
+  mkdirSync(dirname(destination), { recursive: true })
+  copyFileSync(source, destination)
+  if (executable && process.platform !== 'win32') {
+    chmodSync(destination, 0o755)
+  }
+}
+
+function sha256(path) {
+  return createHash('sha256').update(readFileSync(path)).digest('hex')
+}
+
+function targetPlatform(target) {
+  return target.split('-')[0]
+}
+
+function targetArch(target) {
+  return target.split('-')[1]
+}
+
+function buildCommonArtifacts() {
+  rmSync(buildDir, { recursive: true, force: true })
+  const result = runProcessSync({
+    program: process.execPath,
+    args: [join(root, 'config/scripts/build-orcad-bun.mjs'), '--out-dir', buildDir],
+    cwd: root,
+    stdio: 'inherit',
+    timeoutMs: null
+  })
+  if (result.code !== 0) {
+    throw new Error(`Common orcad artifact build failed with exit ${result.code ?? 'unknown'}`)
+  }
+}
+
+async function stageTarget(target) {
+  const destination = join(outputDir, ORCAD_TEMPLATE_TARGETS_DIR, target)
+  const targetIdentity = join(destination, ORCAD_BUILD_TARGET_FILENAME)
+  mkdirSync(destination, { recursive: true })
+  writeFileSync(targetIdentity, `${target}\n`)
+  const watcherSource = await materializeWatcherPackage(target)
+  const watcherDestination = join(destination, 'watcher.node')
+  copy(watcherSource, watcherDestination)
+
+  const browserName = orcadAgentBrowserNativeName(
+    targetPlatform(target),
+    targetArch(target),
+    target.endsWith('-musl') ? 'musl' : 'glibc'
+  )
+  const browserSource = join(root, 'node_modules', 'agent-browser', 'bin', browserName)
+  const browserDestination = join(destination, browserName)
+  if (existsSync(browserSource)) {
+    copy(browserSource, browserDestination, true)
+  }
+  return {
+    targetSha256: sha256(targetIdentity),
+    watcherSha256: sha256(watcherDestination),
+    ...(existsSync(browserDestination)
+      ? { browserName, browserSha256: sha256(browserDestination) }
+      : {})
+  }
+}
+
+async function main() {
+  buildCommonArtifacts()
+  rmSync(outputDir, { recursive: true, force: true })
+  mkdirSync(outputDir, { recursive: true })
+  for (const filename of commonArtifacts) {
+    copy(
+      join(buildDir, filename),
+      join(outputDir, filename),
+      ORCAD_RIPGREP_ARTIFACTS.some((artifact) => artifact === filename && artifact.endsWith('/rg'))
+    )
+  }
+  const targets = Object.fromEntries(
+    await Promise.all(
+      ORCAD_TEMPLATE_TARGETS.map(async (target) => [target, await stageTarget(target)])
+    )
+  )
+  const commonSha256 = Object.fromEntries(
+    commonArtifacts.map((filename) => [filename, sha256(join(outputDir, filename))])
+  )
+  writeFileSync(
+    join(outputDir, ORCAD_TEMPLATE_MANIFEST_FILENAME),
+    `${JSON.stringify({ schemaVersion: 2, commonSha256, targets }, null, 2)}\n`
+  )
+  verifyPackagedOrcadTemplate(join(root, 'out'))
+  rmSync(buildDir, { recursive: true, force: true })
+  process.stdout.write(`[build-orcad-template] ok — ${ORCAD_TEMPLATE_TARGETS.length} targets\n`)
+}
+
+await main()
diff --git a/config/scripts/build-orcad.mjs b/config/scripts/build-orcad.mjs
index 99a53fa09815..b015f52ea2e6 100644
--- a/config/scripts/build-orcad.mjs
+++ b/config/scripts/build-orcad.mjs
@@ -1,85 +1,137 @@
 #!/usr/bin/env node
-/**
- * Bundle `orcad` — the Orca runtime served from plain Node, no Electron.
- *
- * Variant B (see docs/design/node-only-runtime-backend.html): the browser-pane and
- * speech clusters are excluded. That is not a size optimisation — those modules are
- * the only ones that statically import `node:sqlite`, so dropping them is what keeps
- * the host Node floor at 18 instead of 22.5+.
- */
+// Ship Bun with orcad; keep module loading compatible with legacy Node launchers.
 import { fork, spawnSync } from 'node:child_process'
 import { build } from 'esbuild'
+import {
+  buildOrcadEntry,
+  externalNativeAddons,
+  ORCAD_EXTERNAL_MODULES,
+  ORCAD_CHILD_ENTRY_POINTS
+} from './orcad-entry-build.mjs'
+import { createRequire } from 'node:module'
 import {
   chmodSync,
   copyFileSync,
   cpSync,
+  existsSync,
   mkdirSync,
   mkdtempSync,
   rmSync,
   writeFileSync
 } from 'node:fs'
-import { arch, platform, tmpdir } from 'node:os'
-import { join } from 'node:path'
+import { tmpdir } from 'node:os'
+import { dirname, join, resolve } from 'node:path'
 import process from 'node:process'
+import { smokeProfileStateWorkers } from './profile-state-worker-smoke.mjs'
+import { materializeWatcherPackage } from './orcad-watcher-package.mjs'
+import { stageOrcadWindowsProcessTree } from './orcad-windows-process-tree.mjs'
 import {
+  ORCAD_BUILD_TARGET_FILENAME,
+  ORCAD_EMOJI_SHORTCODE_DATASET,
+  orcadBunRuntimeFilename,
+  ORCAD_PARCEL_WATCHER_ENTRY,
+  ORCAD_PARCEL_WATCHER_NATIVE,
   ORCAD_VERSION_FILENAME,
   ORCAD_RIPGREP_ARTIFACTS
 } from '../../src/shared/orcad-artifacts.ts'
 import { computeOrcadFullVersion } from './orcad-artifact-version.mjs'
+import { ORCAD_BUN_VERSION } from '../../src/shared/orcad-bun-runtime.ts'
+import { orcadAgentBrowserNativeName } from '../../src/shared/orcad-agent-browser-name.ts'
 
 const ROOT = join(import.meta.dirname, '..', '..')
-const OUT_DIR = join(ROOT, 'out', 'orcad')
-const ENTRY = join(ROOT, 'src/main/orcad/main.ts')
+const OUT_DIR = process.env.ORCAD_OUT_DIR
+  ? resolve(process.env.ORCAD_OUT_DIR)
+  : join(ROOT, 'out', 'orcad')
 // Why beside orcad.js: the watcher runs in a forked child so a native @parcel/watcher
 // fault crashes that child instead of the server, and `resolveWatcherProcessEntryPath`
 // looks for it in the app root. A deployment has no desktop out/main to fall back to.
-const WATCHER_ENTRY = join(ROOT, 'src/main/ipc/parcel-watcher-process-entry.ts')
+const WATCHER_ENTRY = join(ROOT, ORCAD_CHILD_ENTRY_POINTS.watcher)
 const WATCHER_OUT_FILE = join(OUT_DIR, 'parcel-watcher-process-entry.js')
 // Why beside orcad.js: orcad forks the terminal daemon so PTYs outlive the runtime process,
 // and `getDaemonEntryPath()` probes the app root for this exact filename. Without it every
 // orcad restart would SIGKILL every running terminal.
-const DAEMON_ENTRY = join(ROOT, 'src/main/daemon/daemon-entry.ts')
+const DAEMON_ENTRY = join(ROOT, ORCAD_CHILD_ENTRY_POINTS.daemon)
 const DAEMON_OUT_FILE = join(OUT_DIR, 'daemon-entry.js')
-const AGENT_BROWSER_NAME = `agent-browser-${platform()}-${arch()}${process.platform === 'win32' ? '.exe' : ''}`
+const PTY_GATE_ENTRY = join(ROOT, ORCAD_CHILD_ENTRY_POINTS.ptyGate)
+const PTY_GATE_OUT_FILE = join(OUT_DIR, 'windows-bun-pty-gate-entry.js')
 const OUT_FILE = join(OUT_DIR, 'orcad.js')
+const BUILD_TARGET = process.env.ORCAD_BUILD_TARGET
+if (!BUILD_TARGET) {
+  throw new Error('ORCAD_BUILD_TARGET is required; run `pnpm build:orcad`')
+}
+const [targetPlatform, targetArch] = BUILD_TARGET.split('-')
+const targetIsWindows = targetPlatform === 'win32'
+const targetIsCurrent = process.env.ORCAD_BUILD_TARGET_IS_CURRENT === '1'
+const AGENT_BROWSER_NAME = orcadAgentBrowserNativeName(
+  targetPlatform,
+  targetArch,
+  BUILD_TARGET.endsWith('-musl') ? 'musl' : 'glibc'
+)
 const AGENT_BROWSER_SOURCE = join(ROOT, 'node_modules', 'agent-browser', 'bin', AGENT_BROWSER_NAME)
 const AGENT_BROWSER_OUTPUT = join(OUT_DIR, AGENT_BROWSER_NAME)
+const WATCHER_MODULE_DIR = join(OUT_DIR, 'node_modules', '@parcel', 'watcher')
 
-// Native addons must exist on the host; they cannot be bundled.
-// `electron` is external so a residual import fails loudly at require() time rather
-// than silently bundling the npm package's installer shim, which is what happened the
-// first time and made the bundle look clean while it was not.
-// Why only these: measured, not guessed. `node-pty` is a hard `require.resolve` — orcad
-// exits at startup without it. `@parcel/watcher` is a guarded dynamic import, so the
-// server boots without it but every watch install fails. `fsevents` is macOS-only and
-// optional upstream. better-sqlite3 / keytar / cpu-features were externalized here
-// defensively and appear nowhere in the graph; listing them implied a shipping burden
-// that does not exist.
-const EXTERNAL = ['electron', 'node-pty', '@parcel/watcher', 'fsevents']
-
-/** Why: the UMD build's relative dynamic requires do not bundle. Same fix build-relay.mjs uses. */
-const jsoncParserEsm = {
-  name: 'jsonc-parser-esm',
-  setup(pluginBuild) {
-    pluginBuild.onResolve({ filter: /^jsonc-parser$/ }, () => ({
-      path: join(ROOT, 'node_modules', 'jsonc-parser', 'lib', 'esm', 'main.js')
-    }))
-  }
-}
-
-/** Why: optional native deps reference prebuilt .node files that may not exist here. */
-const externalNativeAddons = {
-  name: 'external-native-addons',
-  setup(pluginBuild) {
-    pluginBuild.onResolve({ filter: /\.node$/ }, (args) => ({ path: args.path, external: true }))
-  }
+async function stageParcelWatcher(target) {
+  const requireFromWatcher = createRequire(
+    join(ROOT, 'node_modules', '@parcel', 'watcher', 'index.js')
+  )
+  const nativeSource = await materializeWatcherPackage(target)
+  const wrapperSource = requireFromWatcher.resolve('@parcel/watcher/wrapper.js')
+  mkdirSync(WATCHER_MODULE_DIR, { recursive: true })
+  await build({
+    stdin: {
+      contents:
+        `const {createWrapper}=require(${JSON.stringify(wrapperSource)});` +
+        `module.exports=createWrapper(require('./watcher.node'));`,
+      resolveDir: ROOT,
+      sourcefile: 'orcad-parcel-watcher-entry.js'
+    },
+    bundle: true,
+    platform: 'node',
+    target: 'node18',
+    format: 'cjs',
+    outfile: join(OUT_DIR, ORCAD_PARCEL_WATCHER_ENTRY),
+    external: ['./watcher.node'],
+    minify: true,
+    sourcemap: false,
+    logLevel: 'error'
+  })
+  copyFileSync(nativeSource, join(OUT_DIR, ORCAD_PARCEL_WATCHER_NATIVE))
 }
 
 rmSync(OUT_DIR, { recursive: true, force: true })
 mkdirSync(OUT_DIR, { recursive: true })
-copyFileSync(AGENT_BROWSER_SOURCE, AGENT_BROWSER_OUTPUT)
-if (process.platform !== 'win32') {
-  chmodSync(AGENT_BROWSER_OUTPUT, 0o755)
+const bunRuntimeSource = process.env.ORCAD_BUN_RUNTIME_PATH
+if (!bunRuntimeSource) {
+  throw new Error('ORCAD_BUN_RUNTIME_PATH is required; run `pnpm build:orcad`')
+}
+if (targetIsCurrent) {
+  const version = spawnSync(bunRuntimeSource, ['--version'], { encoding: 'utf8' })
+  if (version.status !== 0 || version.stdout.trim() !== ORCAD_BUN_VERSION) {
+    throw new Error(
+      `ORCAD_BUN_RUNTIME_PATH must be Bun ${ORCAD_BUN_VERSION}; got ${version.stdout.trim() || version.stderr.trim()}`
+    )
+  }
+}
+const bunRuntimeOutput = join(OUT_DIR, orcadBunRuntimeFilename(BUILD_TARGET))
+copyFileSync(bunRuntimeSource, bunRuntimeOutput)
+writeFileSync(join(OUT_DIR, ORCAD_BUILD_TARGET_FILENAME), `${BUILD_TARGET}\n`)
+if (!targetIsWindows) {
+  chmodSync(bunRuntimeOutput, 0o755)
+}
+await stageParcelWatcher(BUILD_TARGET)
+stageOrcadWindowsProcessTree(ROOT, OUT_DIR, BUILD_TARGET)
+const emojiDatasetOutput = join(OUT_DIR, ORCAD_EMOJI_SHORTCODE_DATASET)
+mkdirSync(dirname(emojiDatasetOutput), { recursive: true })
+copyFileSync(
+  createRequire(import.meta.url).resolve('emojibase-data/en/shortcodes/emojibase.json'),
+  emojiDatasetOutput
+)
+if (existsSync(AGENT_BROWSER_SOURCE)) {
+  copyFileSync(AGENT_BROWSER_SOURCE, AGENT_BROWSER_OUTPUT)
+  if (!targetIsWindows) {
+    chmodSync(AGENT_BROWSER_OUTPUT, 0o755)
+  }
 }
 // Why every platform: an SSH deployment can target a different host than the build machine.
 for (const artifact of ORCAD_RIPGREP_ARTIFACTS) {
@@ -110,36 +162,31 @@ function buildForkedChild(entryPoint, outfile) {
     target: 'node18',
     format: 'cjs',
     outfile,
-    external: EXTERNAL,
+    external: ORCAD_EXTERNAL_MODULES,
     plugins: [externalNativeAddons],
     metafile: true,
     minify: true,
     sourcemap: false,
-    define: { 'process.env.NODE_ENV': '"production"' },
+    define: {
+      'process.env.NODE_ENV': '"production"'
+    },
     logLevel: 'error'
   })
 }
 
 const childResults = await Promise.all([
   buildForkedChild(WATCHER_ENTRY, WATCHER_OUT_FILE),
-  buildForkedChild(DAEMON_ENTRY, DAEMON_OUT_FILE)
+  buildForkedChild(DAEMON_ENTRY, DAEMON_OUT_FILE),
+  buildForkedChild(PTY_GATE_ENTRY, PTY_GATE_OUT_FILE),
+  ...['writer', 'backup'].map((role) =>
+    buildForkedChild(
+      join(ROOT, ORCAD_CHILD_ENTRY_POINTS[role]),
+      join(OUT_DIR, `profile-state-${role}-worker-entry.js`)
+    )
+  )
 ])
 
-const result = await build({
-  entryPoints: [ENTRY],
-  bundle: true,
-  platform: 'node',
-  target: 'node18',
-  format: 'cjs',
-  outfile: OUT_FILE,
-  external: EXTERNAL,
-  plugins: [jsoncParserEsm, externalNativeAddons],
-  metafile: true,
-  minify: true,
-  sourcemap: false,
-  define: { 'process.env.NODE_ENV': '"production"' },
-  logLevel: 'error'
-})
+const result = await buildOrcadEntry(OUT_FILE)
 
 const output = Object.values(result.metafile.outputs).find(
   (o) => o.entryPoint === 'src/main/orcad/main.ts'
@@ -147,8 +194,8 @@ const output = Object.values(result.metafile.outputs).find(
 // Why check `original` and not just `path`: when electron is bundleable, esbuild
 // rewrites `path` to the resolved file under node_modules and the naive check passes
 // while the package is very much in the bundle.
-// Why both metafiles: the forked children ship in the same deployment and run under the
-// same plain Node. A daemon-entry that reached electron would fail at fork time, on the
+// Why both metafiles: the forked children ship in the same deployment and runtime. A
+// daemon-entry that reached electron would fail at fork time, on the
 // path whose whole point is that terminals survive.
 function collectImporters(metafiles, matches) {
   const importers = new Set()
@@ -196,7 +243,7 @@ if (graphErrors.length > 0) {
   process.exitCode = 1
 } else {
   // Why smoke-load and not just read the metafile: the import scan proves no module
-  // *names* electron, but a graph can still fail to resolve under plain Node — a
+  // *names* electron, but the rollback graph can still fail to resolve under plain Node — a
   // dynamic require, a missing native, a top-level throw. The plain-node-entry-guard
   // smoke-loads its entries for exactly this reason, and orcad cannot join that guard
   // because it is an esbuild artifact rather than a rollup input.
@@ -211,7 +258,7 @@ if (graphErrors.length > 0) {
   const smokeOutput = `${smoke.stdout ?? ''}${smoke.stderr ?? ''}`
   if (smoke.error || smoke.signal || smoke.status !== 0) {
     console.error(
-      `[build-orcad] the bundle did not load under plain Node.\n` +
+      `[build-orcad] the bundle lost Node load compatibility.\n` +
         `Expected a clean load-check exit, got status=${smoke.status ?? 'none'} ` +
         `signal=${smoke.signal ?? 'none'} ` +
         `error=${smoke.error?.message ?? 'none'}\n${smokeOutput.slice(0, 2000)}`
@@ -240,47 +287,57 @@ if (graphErrors.length > 0) {
   const daemonSmokeOutput = `${daemonSmoke.stdout ?? ''}${daemonSmoke.stderr ?? ''}`
   if (daemonSmoke.error || daemonSmoke.signal || daemonSmoke.status !== 0) {
     console.error(
-      `[build-orcad] the daemon child did not load under plain Node.\n` +
+      `[build-orcad] the daemon child lost Node load compatibility.\n` +
         `Expected a clean load check, got status=${daemonSmoke.status ?? 'none'} ` +
         `signal=${daemonSmoke.signal ?? 'none'} ` +
         `error=${daemonSmoke.error?.message ?? 'none'}\n${daemonSmokeOutput.slice(0, 2000)}`
     )
     process.exitCode = 1
   }
-  const watcherFailure = await smokeLoadWatcherChild()
+  const watcherFailure = targetIsCurrent ? await smokeLoadWatcherChild(bunRuntimeOutput) : null
   if (watcherFailure) {
     console.error(
-      `[build-orcad] the watcher child did not run under plain Node.\n${watcherFailure}`
+      `[build-orcad] the watcher child failed under the bundled runtime.\n${watcherFailure}`
     )
     process.exitCode = 1
   }
 }
 
+try {
+  await smokeProfileStateWorkers(OUT_DIR)
+  if (targetIsCurrent) {
+    await smokeProfileStateWorkers(OUT_DIR, { runtimePath: bunRuntimeOutput })
+  }
+} catch (error) {
+  console.error('[build-orcad] profile state worker check failed:', error)
+  process.exitCode = 1
+}
+
 // Why a content hash and not ORCAD_VERSION alone: the remote install directory is keyed on
 // this string, so two different builds carrying one version would share a directory — and an
 // already-`.install-complete` dir is never re-uploaded. The deploy would silently run stale
 // bytes while reporting the new version.
 if (process.exitCode !== 1) {
-  const fullVersion = computeOrcadFullVersion(OUT_DIR)
+  const fullVersion = computeOrcadFullVersion(OUT_DIR, {
+    target: BUILD_TARGET,
+    agentBrowserFilename: AGENT_BROWSER_NAME
+  })
   writeFileSync(join(OUT_DIR, ORCAD_VERSION_FILENAME), fullVersion)
   console.log(
-    `[build-orcad] ok — ${fullVersion}, ${(output.bytes / 1024 / 1024).toFixed(2)} MB, ${Object.keys(output.inputs).length} modules, zero electron and node:sqlite imports.`
+    `[build-orcad] ok — ${fullVersion}, ${(output.bytes / 1024 / 1024).toFixed(2)} MB, ${Object.keys(output.inputs).length} modules, zero electron and node:sqlite imports, Bun ${ORCAD_BUN_VERSION} included.`
   )
 }
 
-/**
- * Fork the shipped watcher child and drive one message through it.
- *
- * Why a real fork and not existsSync: the file being present says nothing about whether
- * its graph resolves under plain Node, and this child is only ever reached through
- * `fork()` at runtime — a broken one degrades silently to in-process watching.
- * `subscribe-started` is acked before the native module is touched, so this passes on a
- * build machine with no compiled @parcel/watcher.
- */
-async function smokeLoadWatcherChild() {
+// Verify the shipped native watcher actually subscribes under the bundled runtime.
+async function smokeLoadWatcherChild(runtimePath) {
   const probeDir = mkdtempSync(join(tmpdir(), 'orcad-watcher-smoke-'))
-  const child = fork(WATCHER_OUT_FILE, [], { stdio: ['ignore', 'ignore', 'pipe', 'ipc'] })
+  const child = fork(WATCHER_OUT_FILE, [], {
+    execPath: runtimePath,
+    stdio: ['ignore', 'ignore', 'pipe', 'ipc'],
+    windowsHide: true
+  })
   let stderr = ''
+  let subscribed = false
   child.stderr?.on('data', (chunk) => {
     stderr += String(chunk)
   })
@@ -288,14 +345,15 @@ async function smokeLoadWatcherChild() {
     return await new Promise((resolve) => {
       const timer = setTimeout(() => {
         child.kill('SIGKILL')
-        resolve(`No 'subscribe-started' ack within 30s.\n${stderr.slice(0, 2000)}`)
+        resolve(`Watcher did not complete its subscription within 30s.\n${stderr.slice(0, 2000)}`)
       }, 30_000)
       const settle = (failure) => {
         clearTimeout(timer)
         resolve(failure)
       }
       child.on('message', (message) => {
-        if (message?.op === 'subscribe-started') {
+        subscribed ||= message?.op === 'subscribed'
+        if (message?.op === 'subscribed' || message?.op === 'subscribe-failed') {
           child.disconnect()
         }
       })
@@ -303,7 +361,11 @@ async function smokeLoadWatcherChild() {
       // Why exit and not disconnect: the child exits 0 on disconnect, so a non-zero code
       // or a signal here is a load failure rather than a clean teardown.
       child.on('exit', (code, signal) =>
-        settle(code === 0 ? null : `exit code=${code} signal=${signal}\n${stderr.slice(0, 2000)}`)
+        settle(
+          code === 0 && subscribed
+            ? null
+            : `subscribed=${subscribed} exit code=${code} signal=${signal}\n${stderr.slice(0, 2000)}`
+        )
       )
       child.send({ op: 'subscribe', id: 1, dir: probeDir, opts: {} })
     })
diff --git a/config/scripts/build-relay.mjs b/config/scripts/build-relay.mjs
index 4d408712f978..c67ece1dca84 100644
--- a/config/scripts/build-relay.mjs
+++ b/config/scripts/build-relay.mjs
@@ -24,6 +24,7 @@ import {
   RELAY_BUILD_PLATFORMS,
   RELAY_VERSION_FILENAME,
   RELAY_WINDOWS_PROCESS_TREE_FILENAME,
+  RELAY_OPENCODE_SQLITE_READER_FILENAME,
   relayOptionalArtifactFilenames,
   isWindowsRelayPlatform,
   relayArtifactFilenames
@@ -35,6 +36,13 @@ const ROOT = join(__dirname, '..', '..')
 const RELAY_ENTRY = join(ROOT, 'src', 'relay', 'relay.ts')
 const WATCHER_ENTRY = join(ROOT, 'src', 'main', 'ipc', 'parcel-watcher-process-entry.ts')
 const AI_VAULT_SERVICE_ENTRY = join(ROOT, 'src', 'relay', 'ai-vault-service-entry.ts')
+const OPENCODE_SQLITE_READER_ENTRY = join(
+  ROOT,
+  'src',
+  'main',
+  'ai-vault',
+  'session-scanner-opencode-sqlite-process-entry.ts'
+)
 const WSL_TRANSCRIPT_FS_PROCESS_ENTRY = join(
   ROOT,
   'src',
@@ -180,6 +188,19 @@ for (const platform of RELAY_BUILD_PLATFORMS) {
     }
   })
 
+  await build({
+    entryPoints: [OPENCODE_SQLITE_READER_ENTRY],
+    bundle: true,
+    platform: 'node',
+    target: 'node18',
+    format: 'cjs',
+    outfile: join(outDir, RELAY_OPENCODE_SQLITE_READER_FILENAME),
+    external: ['electron', 'bun:sqlite'],
+    sourcemap: false,
+    minify: true,
+    define: { 'process.env.NODE_ENV': '"production"' }
+  })
+
   // Why beside the service: the spawn resolves this child next to its own
   // bundle, and a relay host has no desktop out/main to fall back to.
   await build({
diff --git a/config/scripts/build-windows-process-tree-relay-addon.mjs b/config/scripts/build-windows-process-tree-relay-addon.mjs
index 526400be8f27..cc2472587a04 100644
--- a/config/scripts/build-windows-process-tree-relay-addon.mjs
+++ b/config/scripts/build-windows-process-tree-relay-addon.mjs
@@ -100,17 +100,21 @@ function assertPatchApplied() {
     ['src/process.cc', 'GetProcessTimes(hProcess, &creationTime'],
     ['src/process_worker.cc', 'object.Set("creationTimeMs"'],
     ['src/addon.cc', 'exports.Set("supportedProcessDataFlags"'],
+    ['src/addon.cc', 'exports.Set("getProcessCreationTime"'],
     ['lib/index.js', '["CreationTime"] = 4'],
     ['lib/index.js', 'exports.supportedProcessDataFlags'],
+    ['lib/index.js', 'exports.getProcessCreationTime'],
     ['lib/index.js', 'creationTimeMs,'],
     ['lib/index.ts', 'CreationTime = 4'],
     ['lib/index.ts', 'export const supportedProcessDataFlags'],
+    ['lib/index.ts', 'export const getProcessCreationTime'],
     ['lib/index.ts', 'creationTimeMs,'],
     ['typings/windows-process-tree.d.ts', 'creationTimeMs?: number'],
     // A regex because IProcessInfo declares the same field: only the tree node
     // is followed by `children`, and that is the one buildNode fills.
     ['typings/windows-process-tree.d.ts', /creationTimeMs\?: number;\r?\n\s*children:/],
-    ['typings/windows-process-tree.d.ts', 'export const supportedProcessDataFlags']
+    ['typings/windows-process-tree.d.ts', 'export const supportedProcessDataFlags'],
+    ['typings/windows-process-tree.d.ts', 'export const getProcessCreationTime']
   ]
   for (const [relativePath, expected] of requiredCreationTimeSources) {
     const source = readFileSync(join(PACKAGE_DIR, relativePath), 'utf8')
@@ -220,10 +224,41 @@ function repairCreationTimeSources() {
   })
 
   rewrite('src/addon.cc', (source, eol) => {
-    if (source.includes('exports.Set("supportedProcessDataFlags"')) {
-      return source
+    let next = source
+    if (!next.includes('Napi::Value ReadProcessCreationTime(')) {
+      const getter = [
+        'Napi::Value ReadProcessCreationTime(const Napi::CallbackInfo& args) {',
+        '  Napi::Env env(args.Env());',
+        '  if (args.Length() != 1 || !args[0].IsNumber()) {',
+        '    return env.Undefined();',
+        '  }',
+        '  const double pid = args[0].As<Napi::Number>().DoubleValue();',
+        '  if (!(pid >= 1 && pid <= MAXDWORD) || pid != static_cast<DWORD>(pid)) {',
+        '    return env.Undefined();',
+        '  }',
+        '  ProcessInfo pinfo{};',
+        '  pinfo.pid = static_cast<DWORD>(pid);',
+        '  GetProcessCreationTime(pinfo);',
+        '  if (pinfo.creationTimeMs == 0) {',
+        '    return env.Undefined();',
+        '  }',
+        '  return Napi::Number::New(env, static_cast<double>(pinfo.creationTimeMs));',
+        '}',
+        ''
+      ].join(eol)
+      next = next.replace('Napi::Object Init(', `${getter}${eol}Napi::Object Init(`)
     }
-    return source.replace(
+    if (!next.includes('exports.Set("getProcessCreationTime"')) {
+      next = next.replace(
+        '  exports.Set("getProcessList",',
+        `  exports.Set("getProcessCreationTime", Napi::Function::New(env, ReadProcessCreationTime));${eol}` +
+          '  exports.Set("getProcessList",'
+      )
+    }
+    if (next.includes('exports.Set("supportedProcessDataFlags"')) {
+      return next
+    }
+    return next.replace(
       /(  exports\.Set\("getProcessCpuUsage", Napi::Function::New\(env, GetProcessCpuUsage\)\);\r?\n)/,
       `$1  exports.Set("supportedProcessDataFlags",${eol}` +
         `              Napi::Number::New(env, MEMORY | COMMANDLINE | CREATIONTIME));${eol}`
@@ -254,6 +289,12 @@ function repairCreationTimeSources() {
           : 'exports.supportedProcessDataFlags = native === undefined ? undefined : native.supportedProcessDataFlags;'
         next = next.replace(NATIVE_CONST, `${NATIVE_CONST}${eol}${reExport}`)
       }
+      if (!next.includes('getProcessCreationTime')) {
+        const reExport = isTs
+          ? 'export const getProcessCreationTime: ((pid: number) => number | undefined) | undefined = native?.getProcessCreationTime;'
+          : 'exports.getProcessCreationTime = native === undefined ? undefined : native.getProcessCreationTime;'
+        next = next.replace(NATIVE_CONST, `${NATIVE_CONST}${eol}${reExport}`)
+      }
       // buildNode drops any field it does not name, so the destructure and the
       // splat have to move together.
       next = next.replace(/(memory, commandLine)( \}, children \})/, '$1, creationTimeMs$2')
@@ -279,6 +320,13 @@ function repairCreationTimeSources() {
           `  export const supportedProcessDataFlags: number | undefined;${eol}`
       )
     }
+    if (!next.includes('export const getProcessCreationTime')) {
+      next = next.replace(
+        '  export const supportedProcessDataFlags: number | undefined;',
+        '  export const supportedProcessDataFlags: number | undefined;' +
+          `${eol}  export const getProcessCreationTime: ((pid: number) => number | undefined) | undefined;`
+      )
+    }
     if (!next.includes('creationTimeMs?: number')) {
       next = next.replace(
         /    commandLine\?: string;\r?\n/,
diff --git a/config/scripts/bun-profile-change-scope.mjs b/config/scripts/bun-profile-change-scope.mjs
new file mode 100644
index 000000000000..7b8b47b69aa4
--- /dev/null
+++ b/config/scripts/bun-profile-change-scope.mjs
@@ -0,0 +1,141 @@
+import { build } from 'esbuild'
+import { appendFileSync, globSync, readFileSync } from 'node:fs'
+import { resolve } from 'node:path'
+import { pathToFileURL } from 'node:url'
+import {
+  externalNativeAddons,
+  ORCAD_CHILD_ENTRY_POINTS,
+  ORCAD_ENTRY_POINT
+} from './orcad-entry-build.mjs'
+import { bunProfileTestPaths } from './bun-profile-test-paths.mjs'
+import { bunProfileQualification } from './bun-profile-qualification.mjs'
+
+const ROOT = resolve(import.meta.dirname, '../..')
+const BUILD_SCRIPTS = [
+  'config/scripts/build-orcad-bun.mjs',
+  'config/scripts/build-orcad.mjs',
+  'config/scripts/build-windows-process-tree-relay-addon.mjs',
+  'config/scripts/run-bun-profile-tests.mjs',
+  'config/vitest.config.ts',
+  'config/scripts/happy-dom-offscreen-canvas.ts',
+  'config/scripts/happy-dom-mutation-observer-retention.ts',
+  'config/scripts/vitest-host-ports-setup.ts'
+]
+const ALWAYS_FILES = new Set([
+  'package.json',
+  'pnpm-lock.yaml',
+  'pnpm-workspace.yaml',
+  '.npmrc',
+  '.pnpmfile.cjs',
+  'tsconfig.json',
+  '.github/workflows/bun-profile-tests.yml',
+  'config/scripts/bun-profile-change-scope.mjs',
+  'config/scripts/bun-profile-change-scope.test.mjs',
+  'config/scripts/bun-profile-qualification.mjs',
+  'config/scripts/bun-profile-qualification.test.mjs'
+])
+const ALWAYS_PREFIXES = [
+  '.github/actions/install-node-dependencies/',
+  // These areas also contain worker paths and fixtures opened without an import.
+  'src/main/persistence/',
+  'src/main/sqlite/',
+  'src/main/orcad/',
+  'src/main/daemon/pty-subprocess/',
+  'src/main/providers/',
+  'config/patches/',
+  'config/tsconfig',
+  'native/',
+  'resources/licenses/ripgrep/'
+]
+
+export function discoverBunProfileTests(root = ROOT) {
+  const selectors = bunProfileTestPaths({ artifact: true })
+  return globSync(
+    ['src/**/*.test.{ts,tsx}', 'config/scripts/**/*.test.{ts,mjs}', 'tests/e2e/**/*.unit.test.ts'],
+    { cwd: root }
+  )
+    .map((file) => file.replaceAll('\\', '/'))
+    .filter((file) => selectors.some((selector) => file.includes(selector)))
+    .sort()
+}
+
+export async function collectBunProfileInputs({ root = ROOT, entryPoints } = {}) {
+  const entries = entryPoints ?? [
+    ORCAD_ENTRY_POINT,
+    ...Object.values(ORCAD_CHILD_ENTRY_POINTS),
+    ...BUILD_SCRIPTS,
+    ...discoverBunProfileTests(root)
+  ]
+  const result = await build({
+    absWorkingDir: root,
+    entryPoints: entries,
+    bundle: true,
+    write: false,
+    outdir: resolve(root, '.bun-profile-scope'),
+    platform: 'node',
+    format: 'esm',
+    splitting: true,
+    packages: 'external',
+    loader: { '.svg': 'empty', '.png': 'empty', '.webp': 'empty', '.css': 'empty' },
+    plugins: [externalNativeAddons],
+    metafile: true,
+    logLevel: 'silent'
+  })
+  if (result.warnings.length > 0) {
+    throw new Error(result.warnings.map((warning) => warning.text).join('\n'))
+  }
+  return new Set(
+    Object.keys(result.metafile.inputs).map((file) =>
+      file.replaceAll('\\', '/').replace(/\?.*$/, '')
+    )
+  )
+}
+
+export async function classifyBunProfileChanges(changedFiles, collect = collectBunProfileInputs) {
+  if (changedFiles.length === 0) {
+    return { shouldRun: true, reason: 'No complete changed-file evidence' }
+  }
+  const selectors = bunProfileTestPaths({ artifact: true })
+  const forced = changedFiles.find(
+    (file) =>
+      ALWAYS_FILES.has(file) ||
+      ALWAYS_PREFIXES.some((prefix) => file.startsWith(prefix)) ||
+      selectors.some((selector) => file.includes(selector))
+  )
+  if (forced) {
+    return { shouldRun: true, reason: `Build or CI input changed: ${forced}` }
+  }
+  try {
+    const inputs = await collect()
+    const matched = changedFiles.find((file) => inputs.has(file))
+    return {
+      shouldRun: Boolean(matched),
+      reason: matched ? `Runtime or test dependency changed: ${matched}` : 'No Bun inputs changed'
+    }
+  } catch (error) {
+    return {
+      shouldRun: true,
+      graphUnavailable: true,
+      reason: `Dependency graph unavailable: ${String(error)}`
+    }
+  }
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  const changedFiles = readFileSync(process.argv[2], 'utf8').split('\0').filter(Boolean)
+  const result = await classifyBunProfileChanges(changedFiles)
+  console.log(result.reason)
+  let event = {}
+  try {
+    event = JSON.parse(readFileSync(process.env.GITHUB_EVENT_PATH, 'utf8'))
+  } catch {
+    // Missing event evidence retains full qualification.
+  }
+  const policy = bunProfileQualification(changedFiles, result, event)
+  const output = `should_run=${result.shouldRun}\nqualification=${policy.qualification}\nrunners=${JSON.stringify(policy.runners)}\n`
+  if (process.env.GITHUB_OUTPUT) {
+    appendFileSync(process.env.GITHUB_OUTPUT, output)
+  } else {
+    process.stdout.write(output)
+  }
+}
diff --git a/config/scripts/bun-profile-change-scope.test.mjs b/config/scripts/bun-profile-change-scope.test.mjs
new file mode 100644
index 000000000000..e813be936214
--- /dev/null
+++ b/config/scripts/bun-profile-change-scope.test.mjs
@@ -0,0 +1,155 @@
+import { mkdtempSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { tmpdir } from 'node:os'
+import { afterEach, beforeAll, describe, expect, it } from 'vitest'
+import { parse } from 'yaml'
+import {
+  classifyBunProfileChanges,
+  collectBunProfileInputs,
+  discoverBunProfileTests
+} from './bun-profile-change-scope.mjs'
+import { bunProfileTestPaths } from './bun-profile-test-paths.mjs'
+import { ORCAD_CHILD_ENTRY_POINTS } from './orcad-entry-build.mjs'
+
+const temporaryDirs = []
+afterEach(() => {
+  for (const root of temporaryDirs.splice(0)) {
+    rmSync(root, { recursive: true, force: true })
+  }
+})
+
+function moduleTree(files) {
+  const root = mkdtempSync(join(tmpdir(), 'bun-profile-scope-'))
+  temporaryDirs.push(root)
+  for (const [file, source] of Object.entries(files)) {
+    const path = join(root, file)
+    mkdirSync(join(path, '..'), { recursive: true })
+    writeFileSync(path, source)
+  }
+  return root
+}
+
+it('follows static imports, re-exports, dynamic imports and require without executing source', async () => {
+  const root = moduleTree({
+    'entry.ts': `import './first'; export * from './exports'; import('./dynamic'); require('./required'); throw Error('never execute')`,
+    'first.ts': `import './nested/leaf'`,
+    'exports.ts': 'export const value = 1',
+    'dynamic.ts': 'export const value = 2',
+    'required.ts': 'module.exports = 3',
+    'nested/leaf.ts': 'export const value = 4',
+    'unrelated.ts': 'throw Error("unrelated")'
+  })
+  const inputs = await collectBunProfileInputs({ root, entryPoints: ['entry.ts'] })
+  expect([...inputs].sort()).toEqual([
+    'dynamic.ts',
+    'entry.ts',
+    'exports.ts',
+    'first.ts',
+    'nested/leaf.ts',
+    'required.ts'
+  ])
+})
+
+it('runs the matrix when a dependency is deleted or graph analysis fails', async () => {
+  const root = moduleTree({ 'entry.ts': `import './deleted'` })
+  const result = await classifyBunProfileChanges(['deleted.ts'], () =>
+    collectBunProfileInputs({ root, entryPoints: ['entry.ts'] })
+  )
+  expect(result.shouldRun).toBe(true)
+  expect(result.reason).toContain('Dependency graph unavailable')
+  expect((await classifyBunProfileChanges([])).shouldRun).toBe(true)
+})
+
+it.each([
+  ['tests/e2e/daemon-running-work-probe.unit.test.ts'],
+  ['config/scripts/zip-extractor-command.test.mjs'],
+  ['config/scripts/zip-extractor-command.test.mjs', 'config/scripts/renamed-command.test.mjs']
+])(
+  'runs deleted or renamed selected tests even when absent from the graph: %j',
+  async (...files) => {
+    expect((await classifyBunProfileChanges(files, async () => new Set())).shouldRun).toBe(true)
+  }
+)
+
+it.each([
+  'package.json',
+  'pnpm-lock.yaml',
+  'pnpm-workspace.yaml',
+  '.npmrc',
+  'tsconfig.json',
+  'config/tsconfig.node.json',
+  'config/scripts/bun-profile-qualification.mjs',
+  'config/patches/node-pty@1.1.0.patch',
+  'native/windows-registry/src/addon.cc',
+  '.github/actions/install-node-dependencies/action.yml',
+  '.github/workflows/bun-profile-tests.yml',
+  'src/main/persistence/profile-state/new-worker.ts'
+])('always selects build, native and dynamically opened inputs: %s', async (file) => {
+  expect((await classifyBunProfileChanges([file], async () => new Set())).shouldRun).toBe(true)
+})
+
+describe('the actual Bun build and profile-test dependency graph', () => {
+  let inputs
+  beforeAll(async () => {
+    inputs = await collectBunProfileInputs()
+  }, 60_000)
+
+  it.each([
+    'config/scripts/ci-shard-timings.json',
+    'config/scripts/mobile-web-app-terminal-render.test.mjs',
+    'src/main/ssh/ssh-relay-upload-stage-commands.test.ts',
+    'src/main/menu/register-app-menu.ts'
+  ])('skips unrelated work: %s', async (file) => {
+    expect((await classifyBunProfileChanges([file], async () => inputs)).shouldRun).toBe(false)
+  })
+
+  it.each([
+    ...Object.values(ORCAD_CHILD_ENTRY_POINTS),
+    'src/shared/keybindings/definitions-core-1.ts',
+    'src/main/runtime/orca-runtime.ts',
+    'src/main/windows/windows-process-table.ts',
+    'src/main/worker-thread-entry-path.ts',
+    'config/scripts/zip-extractor-command.mjs',
+    'config/scripts/windows-process-tree-gyp-rebuild.mjs',
+    'config/scripts/profile-state-worker-smoke.mjs',
+    'config/scripts/vitest-host-ports-setup.ts',
+    'tests/e2e/daemon-running-work-probe.unit.test.ts'
+  ])('retains the full matrix for a real runtime, worker or test input: %s', async (file) => {
+    expect(inputs.has(file)).toBe(true)
+    expect((await classifyBunProfileChanges([file], async () => inputs)).shouldRun).toBe(true)
+  })
+
+  it('retains all selected tests and uses the same selectors as the Bun runner', () => {
+    const tests = discoverBunProfileTests()
+    expect(tests.length).toBeGreaterThan(80)
+    expect(tests.every((file) => inputs.has(file))).toBe(true)
+    expect(
+      bunProfileTestPaths().every((selector) => tests.some((file) => file.includes(selector)))
+    ).toBe(true)
+    const runner = readFileSync(new URL('./run-bun-profile-tests.mjs', import.meta.url), 'utf8')
+    expect(runner).toContain('testArgs.length > 0 ? testArgs : bunProfileTestPaths({ artifact })')
+  })
+})
+
+it('keeps all ten platform jobs and runs them when detection is skipped or fails', () => {
+  const workflow = parse(
+    readFileSync(new URL('../../.github/workflows/bun-profile-tests.yml', import.meta.url), 'utf8')
+  )
+  expect(workflow.on).toHaveProperty('workflow_dispatch')
+  expect(workflow.jobs.changes.if).toBe("github.event_name == 'pull_request'")
+  expect(workflow.jobs.changes.steps[0].with['fetch-depth']).toBe(2)
+  expect(workflow.jobs.changes.steps[0].with['persist-credentials']).toBe(false)
+  const detect = workflow.jobs.changes.steps.find((step) => step.id === 'scope')
+  expect(detect.run).toContain('git diff --name-only --no-renames -z HEAD^1 HEAD')
+  expect(workflow.on.pull_request.types).toContain('ready_for_review')
+  expect(workflow.on.schedule).toHaveLength(1)
+  expect(workflow.jobs.persistence.strategy.matrix.os).toContain('needs.changes.outputs.runners')
+  for (const jobName of ['linux_glibc_floor', 'linux_musl']) {
+    const job = workflow.jobs[jobName]
+    expect(job.needs).toEqual(['changes', 'persistence'])
+    expect(job.if).toContain("needs.persistence.result == 'success'")
+    expect(job.if).toContain("needs.changes.outputs.qualification != 'false'")
+    expect(job.if).toContain("needs.changes.outputs.should_run != 'false'")
+    expect(job.strategy.matrix.os).toEqual(['ubuntu-22.04', 'ubuntu-24.04-arm'])
+  }
+})
diff --git a/config/scripts/bun-profile-qualification.mjs b/config/scripts/bun-profile-qualification.mjs
new file mode 100644
index 000000000000..799f459ff852
--- /dev/null
+++ b/config/scripts/bun-profile-qualification.mjs
@@ -0,0 +1,42 @@
+export const BUN_PERSISTENCE_RUNNERS = [
+  'ubuntu-22.04',
+  'ubuntu-24.04-arm',
+  'macos-14',
+  'macos-15-intel',
+  'windows-2022',
+  'windows-11-arm'
+]
+
+const QUALIFICATION_PREFIXES = [
+  'config/',
+  'native/',
+  'resources/',
+  '.github/',
+  'src/main/persistence/',
+  'src/main/sqlite/',
+  'src/main/orcad/',
+  'src/main/providers/',
+  'src/main/daemon/',
+  'src/main/ssh/',
+  'src/relay/',
+  'src/shared/child-process/'
+]
+
+export function bunProfileQualification(changedFiles, scope, event = {}) {
+  const sensitive = changedFiles.some(
+    (file) =>
+      !file.includes('/') ||
+      QUALIFICATION_PREFIXES.some((prefix) => file.startsWith(prefix)) ||
+      /(?:^|[/.-])(?:windows|win32|wsl|macos|darwin|linux|posix|bun)(?:[/.-]|$)/i.test(file)
+  )
+  // Only a proven unrelated platform change in a draft may defer qualification.
+  const full =
+    event.pull_request?.draft !== true ||
+    changedFiles.length === 0 ||
+    scope.graphUnavailable === true ||
+    sensitive
+  return {
+    qualification: full,
+    runners: full ? BUN_PERSISTENCE_RUNNERS : ['ubuntu-22.04']
+  }
+}
diff --git a/config/scripts/bun-profile-qualification.test.mjs b/config/scripts/bun-profile-qualification.test.mjs
new file mode 100644
index 000000000000..9ebc5e437e1f
--- /dev/null
+++ b/config/scripts/bun-profile-qualification.test.mjs
@@ -0,0 +1,47 @@
+import { expect, it } from 'vitest'
+import { BUN_PERSISTENCE_RUNNERS, bunProfileQualification } from './bun-profile-qualification.mjs'
+
+const draft = { pull_request: { draft: true } }
+const scope = { shouldRun: true }
+
+it('defers only platform qualification for ordinary draft runtime changes', () => {
+  expect(
+    bunProfileQualification(['src/main/runtime/rpc/methods/example.ts'], scope, draft)
+  ).toEqual({
+    qualification: false,
+    runners: ['ubuntu-22.04']
+  })
+})
+
+it.each([
+  'package.json',
+  'native/windows-registry/src/addon.cc',
+  'config/vitest.config.ts',
+  'src/main/ssh/ssh-provider.ts',
+  'src/main/providers/local-pty-provider.ts',
+  'src/shared/child-process/run-process.ts',
+  'src/main/persistence/profile-state/store.ts',
+  'src/main/sqlite/database.ts',
+  'src/main/orcad/entry.ts',
+  'src/main/runtime/windows-terminal.ts',
+  'src/shared/linux-glibc.ts',
+  'src/main/daemon/entry.ts',
+  'src/relay/index.ts',
+  'src/main/wsl/runner.ts'
+])('retains all platforms for sensitive input %s', (file) => {
+  expect(bunProfileQualification([file], scope, draft)).toEqual({
+    qualification: true,
+    runners: BUN_PERSISTENCE_RUNNERS
+  })
+})
+
+it('qualifies every ready commit, scheduled/manual runs and incomplete evidence', () => {
+  const paths = ['src/main/runtime/rpc/methods/example.ts']
+  for (const event of [{}, { pull_request: { draft: false } }]) {
+    expect(bunProfileQualification(paths, scope, event).qualification).toBe(true)
+  }
+  expect(bunProfileQualification([], scope, draft).qualification).toBe(true)
+  expect(
+    bunProfileQualification(paths, { ...scope, graphUnavailable: true }, draft).qualification
+  ).toBe(true)
+})
diff --git a/config/scripts/bun-profile-test-paths.mjs b/config/scripts/bun-profile-test-paths.mjs
new file mode 100644
index 000000000000..23c8f423acd2
--- /dev/null
+++ b/config/scripts/bun-profile-test-paths.mjs
@@ -0,0 +1,24 @@
+export function bunProfileTestPaths({ artifact = false } = {}) {
+  return [
+    'src/main/persistence/profile-state',
+    'src/main/persistence/loading-store/profile-state',
+    'src/main/sqlite',
+    'src/main/orcad/orcad-entry.test.ts',
+    'src/main/orcad/orcad-push-startup.test.ts',
+    ...(artifact
+      ? [
+          'src/main/daemon/pty-subprocess/bun-pty-process.integration.test.ts',
+          'src/main/daemon/pty-subprocess/bun-pty-job-control.integration.test.ts',
+          'src/main/daemon/pty-subprocess/bun-pty-process-suspension.test.ts',
+          'src/main/daemon/pty-subprocess-spawn-file-foreground.test.ts',
+          'src/main/daemon/pty-subprocess/spawn-file-foreground-rejected-agents.test.ts',
+          'tests/e2e/daemon-running-work-probe.unit.test.ts',
+          'src/main/daemon/pty-subprocess/windows-bun-pty-gate.integration.test.ts',
+          'src/main/providers/local-pty-bun-artifact.integration.test.ts',
+          'src/main/providers/agent-foreground-process-git-bash.win32.test.ts',
+          'src/main/orcad/orcad-bun-launcher.integration.test.ts',
+          'config/scripts/zip-extractor-command.test.mjs'
+        ]
+      : [])
+  ]
+}
diff --git a/config/scripts/check-changed-code-quality.mjs b/config/scripts/check-changed-code-quality.mjs
index a49ad1ddb51f..71a512ad4070 100644
--- a/config/scripts/check-changed-code-quality.mjs
+++ b/config/scripts/check-changed-code-quality.mjs
@@ -136,9 +136,14 @@ function resolveBase(root, requestedBase) {
 }
 
 export function collectAddedLineRanges(root, requestedBase) {
-  const base = resolveBase(root, requestedBase)
-  const mergeBase = runGit(root, ['merge-base', base, 'HEAD']).trim()
-  const comparisonBase = resolvePullRequestDiffBase(root, mergeBase)
+  // On a pull_request checkout HEAD is the merge commit, so its first parent is the base side and
+  // no merge base has to be computed. Resolving it first is what lets CI checkout shallowly: the
+  // payload base SHA can lag HEAD^1 by any number of commits and need not be in the graph at all.
+  // Off that ref (local runs) the requested base is an arbitrary branch tip, so the merge base is
+  // still what isolates this branch's own lines.
+  const comparisonBase =
+    resolvePullRequestDiffBase(root, null) ??
+    runGit(root, ['merge-base', resolveBase(root, requestedBase), 'HEAD']).trim()
   const changedFiles = splitNullDelimited(
     runGit(root, ['diff', '--name-only', '-z', '--diff-filter=ACMRTUB', comparisonBase, '--'])
   )
@@ -174,7 +179,7 @@ export function collectAddedLineRanges(root, requestedBase) {
     const lineCount = readFileSync(absolutePath, 'utf8').split(/\r?\n/).length
     rangesByFile.set(file, [{ start: 1, end: lineCount }])
   }
-  return { base, comparisonBase, rangesByFile }
+  return { comparisonBase, rangesByFile }
 }
 
 function parseOxlintOutput(stdout, label) {
@@ -414,10 +419,12 @@ export function main(
   root = process.cwd(),
   requestedBase = process.argv.slice(2).find((argument) => argument !== '--')
 ) {
-  const { base, comparisonBase, rangesByFile } = collectAddedLineRanges(root, requestedBase)
+  const { comparisonBase, rangesByFile } = collectAddedLineRanges(root, requestedBase)
   const files = [...rangesByFile.keys()]
   if (files.length === 0) {
-    console.log(`Changed-code quality gate: no changed JavaScript or TypeScript since ${base}.`)
+    console.log(
+      `Changed-code quality gate: no changed JavaScript or TypeScript since ${comparisonBase.slice(0, 12)}.`
+    )
     return 0
   }
 
diff --git a/config/scripts/check-readme-local-links.test.mjs b/config/scripts/check-readme-local-links.test.mjs
index 2f7cfc76c92b..e1d69723ee52 100644
--- a/config/scripts/check-readme-local-links.test.mjs
+++ b/config/scripts/check-readme-local-links.test.mjs
@@ -1,5 +1,5 @@
 import { execFileSync } from 'node:child_process'
-import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import path from 'node:path'
 import { afterEach, describe, expect, it, vi } from 'vitest'
@@ -75,6 +75,25 @@ describe('README local link check', () => {
     expect(findBrokenReadmeLinks(makeFixture(validReadmes))).toEqual([])
   })
 
+  it('checks tracked media outside the detector sparse checkout', () => {
+    const root = makeFixture(validReadmes)
+    const workflow = parse(readFileSync(path.join(projectDir, '.github/workflows/pr.yml'), 'utf8'))
+    const checkout = workflow.jobs.code_paths.steps.find((step) =>
+      step.uses?.startsWith('actions/checkout@')
+    )
+    const patterns = checkout.with['sparse-checkout'].trim().split('\n')
+    expect(checkout.with['sparse-checkout-cone-mode']).toBe(false)
+    git(root, ['sparse-checkout', 'set', '--no-cone', ...patterns])
+
+    expect(existsSync(path.join(root, 'resources/build/icon.png'))).toBe(false)
+    expect(findBrokenReadmeLinks(root)).toEqual([])
+    git(root, ['update-index', '--force-remove', 'resources/build/icon.png'])
+    expect(findBrokenReadmeLinks(root).map((link) => link.resolved)).toEqual([
+      'resources/build/icon.png',
+      'resources/build/icon.png'
+    ])
+  })
+
   it('reports a deleted media file for the root and translated READMEs', () => {
     const { 'docs/site/public/docs/tab-split.gif': _gif, ...files } = validReadmes
     vi.spyOn(console, 'error').mockImplementation(() => {})
@@ -139,14 +158,15 @@ describe('README local link check', () => {
 
   // Why the ungated job: static_analysis is skipped for docs-only diffs, which is
   // exactly the kind of PR that deletes a docs-site GIF the README embeds.
-  it('runs on every PR through the ungated guard job and in the lint script', () => {
+  it('runs on every PR through the ungated detector and in the lint script', () => {
     const { scripts } = JSON.parse(readFileSync(path.join(projectDir, 'package.json'), 'utf8'))
     const workflow = parse(readFileSync(path.join(projectDir, '.github/workflows/pr.yml'), 'utf8'))
-    const guardJob = workflow.jobs.root_directory_guard
+    const guardJob = workflow.jobs.code_paths
     const step = guardJob.steps.find((candidate) => candidate.name === 'Check README local links')
 
     expect(guardJob.if).toBeUndefined()
     expect(guardJob.needs).toBeUndefined()
+    expect(step.if).toBeUndefined()
     expect(step.run).toBe('node config/scripts/check-readme-local-links.mjs')
     expect(scripts['check:readme-local-links']).toBe(
       'node config/scripts/check-readme-local-links.mjs'
diff --git a/config/scripts/check-root-directory-entries.test.mjs b/config/scripts/check-root-directory-entries.test.mjs
index dcc5596771b3..6de07a053c71 100644
--- a/config/scripts/check-root-directory-entries.test.mjs
+++ b/config/scripts/check-root-directory-entries.test.mjs
@@ -221,14 +221,21 @@ describe('root directory guard', () => {
 
   it('is wired into the PR verify gate', () => {
     const workflow = parse(readFileSync(join(projectDir, '.github/workflows/pr.yml'), 'utf8'))
-    const guardJob = workflow.jobs.root_directory_guard
+    const guardJob = workflow.jobs.code_paths
     const guardStep = guardJob.steps.find(
       (step) => step.name === 'Reject new root-level files and folders'
     )
 
-    expect(guardJob.name).toBe('root directory guard')
-    expect(guardJob.steps[0].with['fetch-depth']).toBe(0)
+    expect(guardJob.if).toBeUndefined()
+    expect(guardStep.if).toBeUndefined()
+    // Why >= 2 rather than 0: the guard compares the merge commit's first parent against the
+    // merged tree, so it needs both parents present but no history beyond them. Depth 1 would
+    // leave HEAD^1 unreachable and the guard would fail closed on every run.
+    expect(guardJob.steps[0].with['fetch-depth']).toBeGreaterThanOrEqual(2)
     expect(guardStep.run).toContain('node .github/scripts/check-root-directory-entries.mjs')
-    expect(workflow.jobs.verify.needs).toContain('root_directory_guard')
+    // The base side must come from the merge ref, not the event payload, or a shallow checkout
+    // cannot resolve it.
+    expect(guardStep.run).toContain('git-pull-request-diff-base.mjs')
+    expect(workflow.jobs.verify.needs).toContain('code_paths')
   })
 })
diff --git a/config/scripts/ci-background-step-barriers.test.mjs b/config/scripts/ci-background-step-barriers.test.mjs
new file mode 100644
index 000000000000..f731d9d08cb3
--- /dev/null
+++ b/config/scripts/ci-background-step-barriers.test.mjs
@@ -0,0 +1,148 @@
+import { readFileSync } from 'node:fs'
+import { parse } from 'yaml'
+import { describe, expect, it } from 'vitest'
+
+const pr = parse(readFileSync('.github/workflows/pr.yml', 'utf8'))
+const mobile = parse(readFileSync('.github/workflows/mobile.yml', 'utf8'))
+const cloud = parse(readFileSync('.github/workflows/cloud-verify.yml', 'utf8'))
+
+function assertJoinedBefore(steps, id, consumer) {
+  const start = steps.findIndex((step) => step.id === id)
+  const join = steps.findIndex((step) => [step.wait].flat().includes(id))
+  const end = steps.findIndex(consumer)
+  expect(start).toBeGreaterThanOrEqual(0)
+  expect(steps[start].background).toBe(true)
+  expect(join).toBeGreaterThan(start)
+  expect(end).toBeGreaterThan(join)
+}
+
+describe('CI background step barriers', () => {
+  it('joins every background check without suppressing failures', () => {
+    for (const job of [
+      pr.jobs.static_analysis,
+      pr.jobs.mobile_web_app,
+      pr.jobs.package,
+      pr.jobs.shell_contracts,
+      mobile.jobs.verify,
+      cloud.jobs.security
+    ]) {
+      const pending = new Set()
+      for (const step of job.steps) {
+        if (step.background) {
+          expect(step.id).toBeTruthy()
+          expect(pending.has(step.id)).toBe(false)
+          expect(step['continue-on-error']).toBeUndefined()
+          pending.add(step.id)
+        }
+        if (step.wait) {
+          expect(step.if).toBeUndefined()
+          expect(step['continue-on-error']).toBeUndefined()
+          for (const id of [step.wait].flat()) {
+            expect(pending.delete(id), `missing background step ${id}`).toBe(true)
+          }
+        }
+        expect(pending.size).toBeLessThanOrEqual(job === pr.jobs.package ? 4 : 3)
+      }
+      expect([...pending]).toEqual([])
+    }
+  })
+
+  it('finishes native import-cycle analysis before mobile installation changes resolution', () => {
+    const steps = pr.jobs.static_analysis.steps
+    assertJoinedBefore(steps, 'native-code-quality', (step) =>
+      step.uses?.endsWith('/install-mobile-dependencies')
+    )
+    const install = steps.findIndex((step) => step.uses?.endsWith('/install-mobile-dependencies'))
+    expect(steps[install].background).toBeUndefined()
+    expect(steps.findIndex((step) => step.id === 'changed-code-quality')).toBeGreaterThan(install)
+  })
+
+  it('finishes both mobile typechecks before allocating test workers', () => {
+    const steps = mobile.jobs.verify.steps
+    assertJoinedBefore(steps, 'production-types', (step) => step.name === 'Test')
+    const ratchet = steps.findIndex((step) => step.name === 'Typecheck tests (ratchet)')
+    const join = steps.findIndex((step) => step.wait === 'production-types')
+    expect(steps[ratchet].background).toBeUndefined()
+    expect(ratchet).toBeLessThan(join)
+  })
+
+  it('waits for WebKit and the bundle before any browser tests', () => {
+    const steps = pr.jobs.mobile_web_app.steps
+    assertJoinedBefore(
+      steps,
+      'webkit',
+      (step) => step.name === 'Builder, override census and render checks'
+    )
+    const build = steps.findIndex((step) => step.name === 'Build and verify the app bundle')
+    expect(steps[build].background).toBeUndefined()
+    expect(build).toBeLessThan(steps.findIndex((step) => [step.wait].flat().includes('webkit')))
+    expect(steps.findIndex((step) => step.id === 'webkit')).toBeLessThan(build)
+  })
+
+  it('joins shell installation before checking fish and running live shell tests', () => {
+    const steps = pr.jobs.shell_contracts.steps
+    assertJoinedBefore(steps, 'shells', (step) => step.name === 'Require fish 4+')
+    assertJoinedBefore(steps, 'shells', (step) => step.name === 'Test real shell contracts')
+    const install = steps.findIndex((step) => step.uses?.endsWith('/install-node-dependencies'))
+    expect(install).toBeGreaterThan(steps.findIndex((step) => step.id === 'shells'))
+    expect(install).toBeLessThan(steps.findIndex((step) => step.wait === 'shells'))
+  })
+
+  it('prepares fresh mobile routes after dependencies and before the browser tests', () => {
+    const steps = pr.jobs.mobile_web_app.steps
+    assertJoinedBefore(
+      steps,
+      'mobile-routes',
+      (step) => step.name === 'Builder, override census and render checks'
+    )
+    const prepare = steps.findIndex((step) => step.id === 'mobile-routes')
+    expect(prepare).toBeGreaterThan(
+      steps.findIndex((step) => step.uses?.endsWith('/install-mobile-dependencies'))
+    )
+    expect(prepare).toBeLessThan(
+      steps.findIndex((step) => step.name === 'Build and verify the app bundle')
+    )
+  })
+
+  it('joins package setup before reading outputs and preserves isolated native probes', () => {
+    const steps = pr.jobs.package.steps
+    // Parallel composites must not race to download their shared cache action on first use.
+    const cacheAction = steps.findIndex((step) => step.uses === 'actions/cache/restore@v5')
+    expect(cacheAction).toBeGreaterThanOrEqual(0)
+    expect(cacheAction).toBeLessThan(
+      steps.findIndex((step) => step.id === 'shutdown-fixture-cache')
+    )
+    for (const [id, consumer] of [
+      ['linux-package-tools', 'Package unpacked app'],
+      ['web-client', 'Package unpacked app'],
+      ['shutdown-fixture-cache', 'Verify headless serve signal shutdown'],
+      ['cli-fixture-cache', 'Verify Linux CLI launch contract']
+    ]) {
+      assertJoinedBefore(steps, id, (step) => step.name === consumer)
+      expect(steps.findIndex((step) => step.id === id)).toBeGreaterThan(
+        steps.findIndex((step) => step.name === 'Test Linux Electron lifecycle boundary')
+      )
+    }
+  })
+
+  it('joins digest-pinned scanner downloads and the history scan without hiding failures', () => {
+    const steps = cloud.jobs.security.steps
+    const history = steps.findIndex((step) => step.name === 'Fetch complete scan history')
+    for (const [id, imageName] of [
+      ['gitleaks-image', 'gitleaks'],
+      ['trufflehog-image', 'trufflehog']
+    ]) {
+      const download = steps.find((step) => step.id === id)
+      const scan = steps.find(
+        (step) => step.run?.includes('docker run') && step.run.includes(imageName)
+      )
+      const digestImage = scan.run.match(/\S+@sha256:[a-f0-9]{64}/)[0]
+      expect(download.run).toBe(`docker pull ${digestImage}`)
+      expect(steps.indexOf(download)).toBeLessThan(history)
+      assertJoinedBefore(steps, id, (step) => step === scan)
+      expect(steps.indexOf(scan)).toBeGreaterThan(history)
+      expect(scan.run).toContain('/repo:ro')
+    }
+    expect(steps.at(-1).wait).toBe('history-scan')
+  })
+})
diff --git a/config/scripts/ci-cache-warmup-workflow.test.mjs b/config/scripts/ci-cache-warmup-workflow.test.mjs
new file mode 100644
index 000000000000..322cf982d828
--- /dev/null
+++ b/config/scripts/ci-cache-warmup-workflow.test.mjs
@@ -0,0 +1,81 @@
+import { readFileSync } from 'node:fs'
+import { expect, it } from 'vitest'
+import { parse } from 'yaml'
+import { BUN_PERSISTENCE_RUNNERS } from './bun-profile-qualification.mjs'
+
+const readWorkflow = (name) =>
+  parse(readFileSync(new URL(`../../.github/workflows/${name}.yml`, import.meta.url), 'utf8'))
+const workflow = readWorkflow('ci-cache-warmup')
+const steps = workflow.jobs.warm.steps
+
+it('warms the same Linux Node runtime the PR shards restore', () => {
+  const arm = workflow.jobs['warm-linux-arm']
+  const install = arm.steps.find(
+    (step) => step.uses === './.github/actions/install-node-dependencies'
+  )
+  const primer = readWorkflow('pr').jobs.test_native_cache
+  expect(arm['runs-on']).toBe(primer['runs-on'])
+  expect(arm.steps.at(-1).run).toBe('node config/scripts/ensure-native-runtime.mjs --check-only')
+  expect(install.with).toMatchObject(primer.steps.find((step) => step.uses === install.uses).with)
+})
+
+it('populates shared Electron archives on both Linux architectures without changing the Node ABI', () => {
+  for (const name of ['warm', 'warm-linux-arm']) {
+    const steps = workflow.jobs[name].steps
+    const install = steps.find(
+      (step) => step.uses === './.github/actions/install-node-dependencies'
+    )
+    expect(install.with['native-runtime']).toBe('node')
+    expect(install.with['cache-electron-package']).toBe('true')
+    const populate = steps.find((step) => step.name === 'Populate shared Electron archive')
+    expect(populate.run).toBe('node config/scripts/install-electron-package-binary.mjs')
+    expect(steps.indexOf(populate)).toBeGreaterThan(steps.indexOf(install))
+  }
+})
+
+it('publishes incremental state under a key and prefix that new PRs restore', () => {
+  const cache = steps.find((step) => step.id === 'typecheck-cache')
+  const prCache = readWorkflow('pr').jobs.typecheck.steps.find((step) => step.name === cache.name)
+  expect(cache.with.path).toBe(prCache.with.path)
+  expect(cache.with['restore-keys']).toBe(prCache.with['restore-keys'])
+  expect(cache.with.key).toBe(
+    prCache.with.key.replace('github.event.pull_request.base.sha', 'github.sha')
+  )
+  const check = steps.find((step) => step.run === 'pnpm run typecheck')
+  expect(check.if).toBe("steps.typecheck-cache.outputs.cache-hit != 'true'")
+  expect(steps.indexOf(check)).toBeGreaterThan(steps.indexOf(cache))
+})
+
+it('bounds warming to the required platforms and validates changes without granting writes', () => {
+  expect(Object.keys(workflow.jobs)).toEqual([
+    'warm',
+    'warm-linux-arm',
+    'warm-windows',
+    'warm-linux-package-fixtures'
+  ])
+  expect(workflow.jobs.warm['timeout-minutes']).toBeLessThanOrEqual(10)
+  expect(workflow.permissions).toEqual({ contents: 'read' })
+  expect(workflow.on.push.branches).toEqual(['main'])
+  expect(workflow.on.schedule).toEqual([{ cron: '41 * * * *' }])
+  expect(workflow.on.pull_request.paths).toContain('.github/workflows/ci-cache-warmup.yml')
+  expect(workflow.concurrency['cancel-in-progress']).toBe(true)
+  expect(workflow.concurrency.group).toContain('github.event.pull_request.number || github.ref')
+  expect(steps[0].with['persist-credentials']).toBe(false)
+})
+
+it('warms and probes both Windows images with the persistence job runtime', () => {
+  const job = workflow.jobs['warm-windows']
+  expect(job.strategy.matrix.os).toEqual(
+    BUN_PERSISTENCE_RUNNERS.filter((os) => os.startsWith('windows-'))
+  )
+  expect(job['runs-on']).toBe('${{ matrix.os }}')
+  expect(job.strategy['fail-fast']).toBe(false)
+  expect(job['timeout-minutes']).toBeLessThanOrEqual(20)
+  expect(job.env.ORCA_BACKGROUND_LAUNCH).toBe('1')
+  expect(job.steps[0].with['persist-credentials']).toBe(false)
+  const install = job.steps.find(
+    (step) => step.uses === './.github/actions/install-node-dependencies'
+  )
+  expect(install.with).toEqual({ 'native-runtime': 'node' })
+  expect(job.steps.at(-1).run).toBe('node config/scripts/ensure-native-runtime.mjs --check-only')
+})
diff --git a/config/scripts/ci-closed-pr-caches.test.mjs b/config/scripts/ci-closed-pr-caches.test.mjs
new file mode 100644
index 000000000000..44edb5e48df7
--- /dev/null
+++ b/config/scripts/ci-closed-pr-caches.test.mjs
@@ -0,0 +1,57 @@
+import { readFileSync } from 'node:fs'
+import { runInNewContext } from 'node:vm'
+import { expect, it, vi } from 'vitest'
+import { parse } from 'yaml'
+
+const workflow = parse(readFileSync('.github/workflows/ci-closed-pr-caches.yml', 'utf8'))
+const script = workflow.jobs.clean.steps[0].with.script
+const ref = 'refs/pull/123/merge'
+
+function run(caches, remove = vi.fn().mockResolvedValue(undefined)) {
+  const list = vi.fn()
+  const paginate = vi.fn().mockResolvedValue(caches)
+  const result = runInNewContext(`(async () => { ${script} })()`, {
+    context: { repo: { owner: 'owner', repo: 'repo' }, payload: { pull_request: { number: 123 } } },
+    github: {
+      paginate,
+      rest: { actions: { getActionsCacheList: list, deleteActionsCacheById: remove } }
+    },
+    core: { info: vi.fn() }
+  })
+  return { result, remove, paginate, list }
+}
+
+it('uses default-branch code without checking out a closed PR', () => {
+  expect(workflow.on).toEqual({ pull_request_target: { types: ['closed'] } })
+  expect(workflow.permissions).toEqual({ actions: 'write' })
+  expect(workflow.jobs.clean.steps).toHaveLength(1)
+  expect(workflow.jobs.clean.steps[0].uses).toBe('actions/github-script@v8')
+})
+
+it('lists and deletes only caches scoped to the closed merge ref', async () => {
+  const { result, paginate, list, remove } = run([
+    { id: 12, ref },
+    { id: 13, ref }
+  ])
+  await result
+  expect(paginate).toHaveBeenCalledWith(list, { owner: 'owner', repo: 'repo', ref, per_page: 100 })
+  expect(remove.mock.calls).toEqual([
+    [{ owner: 'owner', repo: 'repo', cache_id: 12 }],
+    [{ owner: 'owner', repo: 'repo', cache_id: 13 }]
+  ])
+})
+
+it('refuses a default-branch cache even if the API returns one', async () => {
+  const { result, remove } = run([{ id: 12, ref: 'refs/heads/main' }])
+  await expect(result).rejects.toThrow('Unexpected cache ref')
+  expect(remove).not.toHaveBeenCalled()
+})
+
+it('tolerates an eviction race but surfaces permission failures', async () => {
+  await expect(
+    run([{ id: 12, ref }], vi.fn().mockRejectedValue({ status: 404 })).result
+  ).resolves.toBeUndefined()
+  await expect(
+    run([{ id: 12, ref }], vi.fn().mockRejectedValue({ status: 403 })).result
+  ).rejects.toEqual({ status: 403 })
+})
diff --git a/config/scripts/ci-dependency-download-cache.test.mjs b/config/scripts/ci-dependency-download-cache.test.mjs
index 0860b53ebca5..ce628cc7c45b 100644
--- a/config/scripts/ci-dependency-download-cache.test.mjs
+++ b/config/scripts/ci-dependency-download-cache.test.mjs
@@ -10,8 +10,9 @@ describe('CI dependency download caches', () => {
   it('scopes desktop stores to the root lockfile and lets mixed installs opt in', () => {
     expect(action.inputs['cache-dependency-path'].default).toBe('pnpm-lock.yaml')
     for (const step of action.runs.steps.filter((step) => step.uses === 'actions/setup-node@v6')) {
-      expect(step.with.cache).toBe('pnpm')
+      expect(step.with.cache).toBe("${{ github.event_name != 'pull_request' && 'pnpm' || '' }}")
       expect(step.with['cache-dependency-path']).toBe('${{ inputs.cache-dependency-path }}')
+      expect(step.with['package-manager-cache']).toBe(false)
     }
     const install = action.runs.steps.find((step) => step.name === 'Install dependencies')
     expect(install.if).toBeUndefined()
@@ -27,6 +28,103 @@ describe('CI dependency download caches', () => {
       'mobile/pnpm-lock.yaml'
     ])
   })
+
+  it('restores PR stores with setup-node keys without registering a post-job save', () => {
+    const resolve = action.runs.steps.find((step) => step.id === 'pnpm-store')
+    const restore = action.runs.steps.find(
+      (step) => step.name === 'Restore pnpm download store without saving'
+    )
+    expect(resolve.if).toBe("github.event_name == 'pull_request'")
+    expect(restore.if).toBe(resolve.if)
+    expect(restore.uses).toBe('actions/cache/restore@v5')
+    expect(restore.with.path).toBe('${{ steps.pnpm-store.outputs.path }}')
+    expect(restore.with.key).toBe(
+      'node-cache-${{ runner.os }}-${{ steps.pnpm-store.outputs.arch }}-pnpm-${{ hashFiles(inputs.cache-dependency-path) }}'
+    )
+    expect(restore.with['restore-keys']).toBeUndefined()
+    expect(resolve.env.LOCKFILE_HASH).toBe('${{ hashFiles(inputs.cache-dependency-path) }}')
+    expect(action.runs.steps.indexOf(resolve)).toBeLessThan(action.runs.steps.indexOf(restore))
+    expect(action.runs.steps.indexOf(restore)).toBeLessThan(
+      action.runs.steps.findIndex((step) => step.name === 'Install dependencies')
+    )
+    const saves = action.runs.steps.filter((step) => step.uses === 'actions/cache/save@v5')
+    expect(saves).toHaveLength(1)
+    expect(saves[0].name).toBe('Save pnpm verification record on main')
+    expect(saves[0].if).toContain("github.ref == 'refs/heads/main'")
+    expect(saves[0].if).toContain("github.event_name != 'pull_request'")
+    expect(saves[0].with.path).toBe('${{ steps.verification-cache.outputs.path }}')
+  })
+
+  it('restores Windows packaging downloads from the release cache without a PR upload', () => {
+    const packaging = workflow('pr').jobs.package_windows
+    const restore = packaging.steps.find((step) => step.name === 'Cache electron-builder downloads')
+    const release = workflow('release-cut').jobs.build
+    const windows = release.strategy.matrix.include.find((entry) => entry.platform === 'win')
+    const save = release.steps.find((step) => step.name === 'Cache electron-builder downloads')
+
+    expect(packaging['runs-on']).toBe(windows.os)
+    expect(restore.uses).toBe('actions/cache/restore@v5')
+    // Cache versions include the path list, so matching key strings alone cannot prove reuse.
+    expect(restore.with.path).toBe(windows.eb_cache_path)
+    expect(restore.with.key).toBe(save.with.key.replace('${{ matrix.platform }}', 'win'))
+    expect(restore.with['restore-keys']).toBe(
+      save.with['restore-keys'].replace('${{ matrix.platform }}', 'win')
+    )
+    expect(save.uses).toBe('actions/cache@v5')
+    expect(save.with.path).toBe('${{ matrix.eb_cache_path }}')
+    for (const name of ['dev-channel-win-build', 'windows-signing-rehearsal']) {
+      const writer = Object.values(workflow(name).jobs)
+        .flatMap((job) => job.steps ?? [])
+        .find((step) => step.name === 'Cache electron-builder downloads')
+      expect(writer.uses, name).toBe('actions/cache@v5')
+      expect(writer.with.path, name).toBe(restore.with.path)
+      expect(writer.with.key, name).toBe(restore.with.key)
+      expect(writer.with['restore-keys'], name).toBe(restore.with['restore-keys'])
+    }
+  })
+
+  it('seeds the existing Linux PR tool cache from successful main x64 release builds', () => {
+    const packaging = workflow('pr').jobs.package
+    const consumer = packaging.steps.find(
+      (step) => step.name === 'Cache electron-builder downloads'
+    )
+    const release = workflow('release-cut').jobs.build
+    const combined = release.steps.find((step) => step.name === 'Cache electron-builder downloads')
+    const writer = release.steps.find(
+      (step) => step.name === 'Seed shared Linux packaging downloads'
+    )
+    const linux = release.strategy.matrix.include.find((entry) => entry.platform === 'linux-x64')
+
+    expect(packaging['runs-on']).toBe(linux.os)
+    expect(writer.if).toBe("matrix.platform == 'linux-x64' && github.ref == 'refs/heads/main'")
+    expect(writer.uses).toBe('actions/cache@v5')
+    expect(writer.with.path).toBe(consumer.with.path)
+    expect(writer.with.key).toBe(consumer.with.key)
+    expect(writer.with['restore-keys']).toBeUndefined()
+    expect(writer.with['lookup-only']).toBe(true)
+    expect(release.steps.indexOf(writer)).toBeGreaterThan(release.steps.indexOf(combined))
+    expect(consumer.uses).toBe('actions/cache/restore@v5')
+    expect(consumer.with['restore-keys'].trim()).toBe('electron-builder-linux-')
+    expect(combined.uses).toBe('actions/cache@v5')
+    expect(linux.eb_cache_path.trim().split('\n')).toEqual([
+      '~/.cache/electron',
+      '~/.cache/electron-builder'
+    ])
+  })
+})
+
+it('shares Electron archives with PRs without uploading PR-local copies', () => {
+  const save = action.runs.steps.find((step) => step.name === 'Cache Electron package archive')
+  const restore = action.runs.steps.find(
+    (step) => step.name === 'Restore Electron package archive without saving'
+  )
+  expect(save.if).toContain("github.event_name != 'pull_request' || runner.os != 'Linux'")
+  expect(restore.if).toContain("github.event_name == 'pull_request' && runner.os == 'Linux'")
+  expect(save.if).toContain("steps.electron-package-cache.outputs.version != ''")
+  expect(restore.if).toContain("steps.electron-package-cache.outputs.version != ''")
+  expect(save.uses).toBe('actions/cache@v5')
+  expect(restore.uses).toBe('actions/cache/restore@v5')
+  expect(restore.with).toEqual(save.with)
 })
 
 describe('release install targets', () => {
diff --git a/config/scripts/ci-e2e-failure-summary.mjs b/config/scripts/ci-e2e-failure-summary.mjs
new file mode 100644
index 000000000000..f95fed20dac0
--- /dev/null
+++ b/config/scripts/ci-e2e-failure-summary.mjs
@@ -0,0 +1,92 @@
+import { appendFileSync, readFileSync } from 'node:fs'
+import { pathToFileURL } from 'node:url'
+import { trackE2eFailures } from './ci-e2e-failure-tracking.mjs'
+
+export function e2eFailureSummary(report) {
+  const failures = []
+  let passed = 0
+  let skipped = 0
+  function visit(suite, parents = [], parentFile) {
+    const titles = [...parents, suite.title].filter(Boolean)
+    const file = suite.file ?? parentFile
+    for (const spec of suite.specs ?? []) {
+      for (const test of spec.tests ?? []) {
+        if (test.status === 'expected') {
+          passed++
+          continue
+        }
+        if (test.status === 'skipped') {
+          skipped++
+          continue
+        }
+        const errors = test.results.flatMap((result) => result.errors ?? [])
+        failures.push({
+          file: spec.file ?? file,
+          title: [...titles, spec.title].join(' › '),
+          project: test.projectName,
+          status: test.status,
+          message: errors
+            .map((error) => error.message ?? error.value ?? '')
+            .join('\n')
+            .slice(0, 2000)
+        })
+      }
+    }
+    for (const child of suite.suites ?? []) {
+      visit(child, titles, file)
+    }
+  }
+  for (const suite of report.suites ?? []) {
+    visit(suite)
+  }
+  return { passed, skipped, failures, errors: report.errors ?? [] }
+}
+
+export function renderE2eFailures(summary, records = [], now = new Date()) {
+  const escape = (value) =>
+    String(value ?? '')
+      .replaceAll('&', '&amp;')
+      .replaceAll('<', '&lt;')
+      .replaceAll('>', '&gt;')
+  const tracked = trackE2eFailures(summary.failures, records, now)
+  const details = (failure) =>
+    `<details><summary>${escape(failure.status)}: ${escape(failure.file)} — ${escape(failure.title)}</summary><pre>${escape(failure.message)}</pre></details>`
+  return [
+    '## E2E results',
+    '',
+    `${summary.passed} expected results; ${summary.skipped} skipped; ${summary.failures.length} unexpected/flaky results; ${summary.errors.length} run errors.`,
+    '',
+    `### Untracked failures (${tracked.untracked.length})`,
+    '',
+    ...tracked.untracked.map(details),
+    '',
+    `### Tracked failures (${tracked.known.length})`,
+    '',
+    ...tracked.known.flatMap((failure) => [
+      details(failure),
+      `Owner: ${escape(failure.tracking.owner)}; ${escape(failure.tracking.issue)}; expires ${escape(failure.tracking.expires)}.`
+    ]),
+    ...(tracked.invalid.length
+      ? [`${tracked.invalid.length} invalid/expired tracking entries were not used.`]
+      : []),
+    ...summary.errors.map((error) => `<pre>${escape(error.message ?? error.value)}</pre>`),
+    '',
+    'Failures retain their original verdict. Repeated failures need a tracked owner, reproduction and review date; do not treat a red baseline as passing.',
+    ''
+  ].join('\n')
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  try {
+    const summary = e2eFailureSummary(JSON.parse(readFileSync(process.argv[2], 'utf8')))
+    const records = JSON.parse(
+      readFileSync(new URL('../e2e-failure-tracking.json', import.meta.url), 'utf8')
+    )
+    appendFileSync(process.env.GITHUB_STEP_SUMMARY, renderE2eFailures(summary, records))
+  } catch (error) {
+    appendFileSync(
+      process.env.GITHUB_STEP_SUMMARY,
+      `E2E report unavailable (${error.code ?? 'invalid report'}); inspect the failing step and traces.\n`
+    )
+  }
+}
diff --git a/config/scripts/ci-e2e-failure-summary.test.mjs b/config/scripts/ci-e2e-failure-summary.test.mjs
new file mode 100644
index 000000000000..5594e4faa565
--- /dev/null
+++ b/config/scripts/ci-e2e-failure-summary.test.mjs
@@ -0,0 +1,79 @@
+import { expect, it } from 'vitest'
+import { e2eFailureSummary, renderE2eFailures } from './ci-e2e-failure-summary.mjs'
+import { trackE2eFailures } from './ci-e2e-failure-tracking.mjs'
+
+it('requires exact failures with an owner, issue and unexpired review date', () => {
+  const failure = {
+    file: 'test.spec.ts',
+    title: 'case',
+    project: 'electron',
+    message: 'expected focus failed'
+  }
+  const record = {
+    ...failure,
+    message: 'expected focus',
+    owner: '@owner',
+    issue: 'https://github.com/stablyai/orca/issues/123',
+    expires: '2026-10-01'
+  }
+  const now = new Date('2026-09-28')
+  expect(trackE2eFailures([failure], [null, record], now)).toMatchObject({
+    known: [{ ...failure, tracking: record }],
+    invalid: [null]
+  })
+  expect(trackE2eFailures([failure], null, now).untracked).toEqual([failure])
+  for (const change of [
+    { expires: '2026-09-27' },
+    { expires: '2026-09-31' },
+    { owner: '' },
+    { issue: '' },
+    { title: 'different' },
+    { message: 'different' },
+    { project: 'other' }
+  ]) {
+    expect(trackE2eFailures([failure], [{ ...record, ...change }], now).untracked).toEqual([
+      failure
+    ])
+  }
+})
+
+it('keeps failure, flaky, skipped and startup-error evidence separate', () => {
+  const report = {
+    errors: [{ message: 'startup failed' }],
+    suites: [
+      {
+        title: 'file',
+        file: 'tests/e2e/test.spec.ts',
+        suites: [
+          {
+            title: 'feature',
+            specs: [
+              {
+                title: 'case',
+                tests: [
+                  { status: 'expected' },
+                  { status: 'skipped' },
+                  {
+                    status: 'unexpected',
+                    projectName: 'electron-headless',
+                    results: [{ errors: [{ message: '<timeout>' }] }]
+                  },
+                  {
+                    status: 'flaky',
+                    results: [{ errors: [{ message: 'first try' }] }, { errors: [] }]
+                  }
+                ]
+              }
+            ]
+          }
+        ]
+      }
+    ]
+  }
+  const summary = e2eFailureSummary(report)
+  expect(summary).toMatchObject({ passed: 1, skipped: 1, errors: report.errors })
+  expect(summary.failures).toHaveLength(2)
+  expect(summary.failures[0].title).toBe('file › feature › case')
+  expect(renderE2eFailures(summary)).toContain('&lt;timeout&gt;')
+  expect(renderE2eFailures(summary)).toContain('startup failed')
+})
diff --git a/config/scripts/ci-e2e-failure-tracking.mjs b/config/scripts/ci-e2e-failure-tracking.mjs
new file mode 100644
index 000000000000..3415c023ad56
--- /dev/null
+++ b/config/scripts/ci-e2e-failure-tracking.mjs
@@ -0,0 +1,42 @@
+export function trackE2eFailures(failures, records, now = new Date()) {
+  const known = []
+  const untracked = []
+  const invalid = []
+  const active = (Array.isArray(records) ? records : [records]).filter((record) => {
+    if (!record || typeof record !== 'object' || Array.isArray(record)) {
+      invalid.push(record)
+      return false
+    }
+    const expiry = new Date(`${record.expires}T23:59:59Z`)
+    const valid =
+      typeof record.file === 'string' &&
+      typeof record.title === 'string' &&
+      typeof record.message === 'string' &&
+      record.message.length > 0 &&
+      /^@[\w-]+(?:\/[\w-]+)?$/.test(record.owner ?? '') &&
+      /^https:\/\/github\.com\/stablyai\/orca\/issues\/\d+$/.test(record.issue ?? '') &&
+      /^\d{4}-\d{2}-\d{2}$/.test(record.expires ?? '') &&
+      Number.isFinite(expiry.getTime()) &&
+      expiry.toISOString().slice(0, 10) === record.expires &&
+      expiry.getTime() >= now.getTime()
+    if (!valid) {
+      invalid.push(record)
+    }
+    return valid
+  })
+  for (const failure of failures) {
+    const record = active.find(
+      (entry) =>
+        entry.file === failure.file &&
+        entry.title === failure.title &&
+        entry.project === failure.project &&
+        failure.message.includes(entry.message)
+    )
+    if (record) {
+      known.push({ ...failure, tracking: record })
+    } else {
+      untracked.push(failure)
+    }
+  }
+  return { known, untracked, invalid }
+}
diff --git a/config/scripts/ci-pnpm-store-benchmark.mjs b/config/scripts/ci-pnpm-store-benchmark.mjs
new file mode 100644
index 000000000000..8536eafe1d59
--- /dev/null
+++ b/config/scripts/ci-pnpm-store-benchmark.mjs
@@ -0,0 +1,154 @@
+import assert from 'node:assert/strict'
+import { createHash } from 'node:crypto'
+import {
+  cpSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  rmSync,
+  statSync,
+  writeFileSync
+} from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join, resolve } from 'node:path'
+import { performance } from 'node:perf_hooks'
+import { parseArgs } from 'node:util'
+import { resolvePnpmCliInvocation } from './pnpm-cli-invocation.mjs'
+import { runProcessSync } from './script-child-process.mjs'
+
+const { values } = parseArgs({
+  options: { samples: { type: 'string', default: '3' }, output: { type: 'string' } }
+})
+const samples = Number(values.samples)
+assert(Number.isInteger(samples) && samples > 0 && samples <= 10, '--samples must be 1–10')
+const repository = resolve(import.meta.dirname, '../..')
+const temporary = mkdtempSync(join(tmpdir(), 'orca-ci-pnpm-store-'))
+const checkout = join(temporary, 'checkout')
+const store = join(temporary, 'store')
+const archive = join(temporary, 'store.tar.zst')
+const uncompressed = join(temporary, 'store.tar')
+const manifests = ['package.json', 'pnpm-lock.yaml', 'pnpm-workspace.yaml']
+const pnpm = resolvePnpmCliInvocation()
+const results = []
+
+function command(program, args, cwd = checkout) {
+  const start = performance.now()
+  const result = runProcessSync({
+    program,
+    args,
+    cwd,
+    env: { ...process.env, CI: 'true', ORCA_BACKGROUND_LAUNCH: '1' },
+    timeoutMs: 300_000
+  })
+  assert.equal(result.code, 0, `${program}: ${result.stdout}\n${result.stderr}`)
+  return { milliseconds: performance.now() - start, stdout: result.stdout.trim() }
+}
+
+function pnpmCommand(args) {
+  return command(pnpm.command, [...pnpm.prefixArgs, ...args])
+}
+
+function digest() {
+  const hash = createHash('sha256')
+  for (const file of manifests) {
+    hash.update(readFileSync(join(checkout, file)))
+  }
+  return hash.digest('hex')
+}
+
+function install() {
+  return pnpmCommand(['install', '--frozen-lockfile', '--ignore-scripts', '--store-dir', store])
+    .milliseconds
+}
+
+function transferArchive(restore) {
+  const start = performance.now()
+  // Windows BSD tar needs a separate zstd process, as in the Actions cache toolkit.
+  if (process.platform === 'win32') {
+    if (restore) {
+      command('zstd', ['-d', '-f', 'store.tar.zst', '-o', 'store.tar'], temporary)
+      command('tar', ['-xf', 'store.tar', '-C', store], temporary)
+    } else {
+      command('tar', ['--format=posix', '-cf', 'store.tar', '-C', store, '.'], temporary)
+      command('zstd', ['-T0', '-f', 'store.tar', '-o', 'store.tar.zst'], temporary)
+    }
+    rmSync(uncompressed)
+  } else {
+    command(
+      'tar',
+      restore
+        ? ['-xf', archive, '--use-compress-program', 'zstd -d', '-C', store]
+        : ['--format=posix', '-cf', archive, '--use-compress-program', 'zstd -T0', '-C', store, '.']
+    )
+  }
+  return performance.now() - start
+}
+
+try {
+  mkdirSync(checkout)
+  for (const file of [...manifests, 'native/windows-registry/package.json', 'config/patches']) {
+    const target = join(checkout, file)
+    mkdirSync(resolve(target, '..'), { recursive: true })
+    cpSync(join(repository, file), target, { recursive: true })
+  }
+  const sourceDigest = digest()
+  const pnpmVersion = pnpmCommand(['--version']).stdout
+  const zstdVersion = command('zstd', ['--version']).stdout
+  const tarVersion = command('tar', ['--version']).stdout
+
+  for (let sample = 0; sample < samples; sample++) {
+    const policies = sample % 2 === 0 ? ['save', 'restore-only'] : ['restore-only', 'save']
+    for (const policy of policies) {
+      rmSync(join(checkout, 'node_modules'), { recursive: true, force: true })
+      rmSync(store, { recursive: true, force: true })
+      const installMs = install()
+      assert.equal(digest(), sourceDigest, 'frozen install changed a manifest')
+      let archiveMs = 0
+      let archiveBytes = 0
+      if (policy === 'save') {
+        archiveMs = transferArchive(false)
+        archiveBytes = statSync(archive).size
+      }
+      const result = {
+        sample,
+        policy,
+        installMs,
+        archiveMs,
+        archiveBytes,
+        totalMs: installMs + archiveMs
+      }
+      results.push(result)
+      console.error(JSON.stringify(result))
+    }
+  }
+
+  // Both policies restore identical bytes on a hit; measure that common cost separately.
+  rmSync(join(checkout, 'node_modules'), { recursive: true, force: true })
+  rmSync(store, { recursive: true, force: true })
+  mkdirSync(store)
+  const restoreMs = transferArchive(true)
+  const hitInstallMs = install()
+  assert.equal(digest(), sourceDigest)
+  const report = {
+    platform: process.platform,
+    arch: process.arch,
+    node: process.version,
+    pnpm: pnpmVersion,
+    tar: tarVersion,
+    zstd: zstdVersion,
+    sourceDigest,
+    results,
+    hit: { restoreMs, installMs: hitInstallMs, totalMs: restoreMs + hitInstallMs },
+    scope:
+      'Desktop script-free frozen install, fresh isolated store per miss; alternating policy order.',
+    limit:
+      'Measures local install/archive CPU and disk. Excludes GitHub cache transfer and remote service time.'
+  }
+  const json = `${JSON.stringify(report, null, 2)}\n`
+  if (values.output) {
+    writeFileSync(resolve(values.output), json)
+  }
+  console.log(json)
+} finally {
+  rmSync(temporary, { recursive: true, force: true })
+}
diff --git a/config/scripts/ci-runner-demand.mjs b/config/scripts/ci-runner-demand.mjs
new file mode 100644
index 000000000000..7690ea358db6
--- /dev/null
+++ b/config/scripts/ci-runner-demand.mjs
@@ -0,0 +1,100 @@
+import { appendFileSync, mkdirSync, writeFileSync } from 'node:fs'
+import { pathToFileURL } from 'node:url'
+import { runnerDemand, sampleWorkflowRuns } from './ci-runner-metrics.mjs'
+
+async function api(path, env) {
+  const response = await fetch(
+    `${env.GITHUB_API_URL ?? 'https://api.github.com'}/repos/${env.GITHUB_REPOSITORY}/${path}`,
+    {
+      headers: {
+        Authorization: `Bearer ${env.GH_TOKEN}`,
+        Accept: 'application/vnd.github+json',
+        'X-GitHub-Api-Version': '2022-11-28'
+      },
+      signal: AbortSignal.timeout(30_000)
+    }
+  )
+  if (!response.ok) {
+    throw new Error(`Actions API: ${response.status}`)
+  }
+  return response.json()
+}
+
+export async function collectRunnerDemand(env = process.env, request = (path) => api(path, env)) {
+  const end = new Date(env.CI_METRICS_END ?? Date.now())
+  end.setUTCMinutes(0, 0, 0)
+  if (!Number.isFinite(end.getTime())) {
+    throw new Error('Invalid window end')
+  }
+  const runs = []
+  for (let hour = 0; hour < 24; hour++) {
+    const until = new Date(end.getTime() - hour * 3_600_000 - 1000)
+    const since = new Date(end.getTime() - (hour + 1) * 3_600_000)
+    const range = `${since.toISOString()}..${until.toISOString()}`
+    const path = `actions/runs?per_page=100&created=${encodeURIComponent(range)}`
+    const first = await request(path)
+    if (first.total_count > 1000) {
+      throw new Error('Hourly run inventory exceeds API limit; split the interval')
+    }
+    runs.push(...first.workflow_runs)
+    for (let page = 2; page <= Math.ceil(first.total_count / 100); page++) {
+      runs.push(...(await request(`${path}&page=${page}`)).workflow_runs)
+    }
+  }
+  const samples = sampleWorkflowRuns(runs)
+  // Bound API concurrency and preserve every selected observation, including zero-job runs.
+  for (let index = 0; index < samples.length; index += 4) {
+    await Promise.all(
+      samples.slice(index, index + 4).map(async (sample) => {
+        const path = `actions/runs/${sample.run.id}/jobs?per_page=100`
+        const first = await request(path)
+        sample.jobs = first.jobs
+        for (let page = 2; page <= Math.ceil(first.total_count / 100); page++) {
+          sample.jobs.push(...(await request(`${path}&page=${page}`)).jobs)
+        }
+      })
+    )
+  }
+  const report = {
+    start: new Date(end.getTime() - 86_400_000).toISOString(),
+    end: end.toISOString(),
+    method:
+      'Stratified by workflow/conclusion, six sampled runs per stratum; latest attempts only; incomplete jobs excluded',
+    ...runnerDemand(runs, samples)
+  }
+  return { report, runs, samples }
+}
+
+export function demandMarkdown(report) {
+  return [
+    `## CI demand: ${report.start} to ${report.end}`,
+    '',
+    `Estimated full job duration for runs created in this window (not window-clipped occupancy); ${report.sampledRuns}/${report.populationRuns} runs sampled. ${report.method}.`,
+    '',
+    '| Workflow | Runs | Runner hours | Cancelled-run hours | Minutes/completed PR run |',
+    '| --- | ---: | ---: | ---: | ---: |',
+    ...report.workflows.map(
+      (row) =>
+        `| ${row.workflow} | ${row.runs} | ${(row.runnerMinutes / 60).toFixed(1)} | ${(row.cancelledRunnerMinutes / 60).toFixed(1)} | ${row.runnerMinutesPerCompletedPrRun?.toFixed(1) ?? '—'} |`
+    ),
+    '',
+    '| Runner labels | Hours | Queue/provisioning p95 minutes |',
+    '| --- | ---: | ---: |',
+    ...report.pools.map(
+      (pool) =>
+        `| ${pool.label} | ${(pool.runnerMinutes / 60).toFixed(1)} | ${pool.queueP95Minutes?.toFixed(1) ?? '—'} |`
+    ),
+    ''
+  ].join('\n')
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  const evidence = await collectRunnerDemand()
+  mkdirSync('ci-demand', { recursive: true })
+  writeFileSync('ci-demand/evidence.json', JSON.stringify(evidence))
+  const markdown = demandMarkdown(evidence.report)
+  writeFileSync('ci-demand/report.md', markdown)
+  if (process.env.GITHUB_STEP_SUMMARY) {
+    appendFileSync(process.env.GITHUB_STEP_SUMMARY, markdown)
+  }
+}
diff --git a/config/scripts/ci-runner-metrics.mjs b/config/scripts/ci-runner-metrics.mjs
new file mode 100644
index 000000000000..d01ae3d0153c
--- /dev/null
+++ b/config/scripts/ci-runner-metrics.mjs
@@ -0,0 +1,110 @@
+const minutesBetween = (start, end) => {
+  const value = (Date.parse(end) - Date.parse(start)) / 60_000
+  return Number.isFinite(value) ? Math.max(0, value) : 0
+}
+
+const workflowPath = (run) => run.path.split('@')[0]
+const workflowKey = (run) => run.workflow_id ?? workflowPath(run)
+
+export function weightedPercentile(values, percentile) {
+  const sorted = [...values].sort((a, b) => a.value - b.value)
+  const target = sorted.reduce((sum, item) => sum + item.weight, 0) * percentile
+  let seen = 0
+  for (const item of sorted) {
+    seen += item.weight
+    if (seen >= target) {
+      return item.value
+    }
+  }
+  return null
+}
+
+export function runnerDemand(runs, samples) {
+  const workflows = new Map()
+  const pools = new Map()
+  for (const run of runs) {
+    if (!workflows.has(workflowKey(run))) {
+      workflows.set(workflowKey(run), {
+        workflow: workflowPath(run),
+        runs: 0,
+        sampledRuns: 0,
+        runnerMinutes: 0,
+        cancelledRunnerMinutes: 0,
+        completedPrRuns: 0,
+        completedPrRunnerMinutes: 0
+      })
+    }
+    workflows.get(workflowKey(run)).runs++
+  }
+  let incompleteJobs = 0
+  for (const { run, jobs, weight } of samples) {
+    const row = workflows.get(workflowKey(run))
+    row.sampledRuns++
+    for (const job of jobs) {
+      if (!job.runner_name || !job.started_at) {
+        continue
+      }
+      if (!job.completed_at) {
+        incompleteJobs++
+        continue
+      }
+      const duration = minutesBetween(job.started_at, job.completed_at)
+      const weighted = duration * weight
+      row.runnerMinutes += weighted
+      if (run.conclusion === 'cancelled') {
+        row.cancelledRunnerMinutes += weighted
+      }
+      if (run.event === 'pull_request' && ['success', 'failure'].includes(run.conclusion)) {
+        row.completedPrRunnerMinutes += weighted
+      }
+      const label = [...job.labels].sort().join(', ') || 'unknown'
+      if (!pools.has(label)) {
+        pools.set(label, { label, runnerMinutes: 0, waits: [] })
+      }
+      const pool = pools.get(label)
+      pool.runnerMinutes += weighted
+      if (job.created_at) {
+        pool.waits.push({ value: minutesBetween(job.created_at, job.started_at), weight })
+      }
+    }
+    if (run.event === 'pull_request' && ['success', 'failure'].includes(run.conclusion)) {
+      row.completedPrRuns += weight
+    }
+  }
+  return {
+    populationRuns: runs.length,
+    sampledRuns: samples.length,
+    incompleteJobs,
+    workflows: [...workflows.values()]
+      .map((row) => ({
+        ...row,
+        runnerMinutesPerCompletedPrRun: row.completedPrRuns
+          ? row.completedPrRunnerMinutes / row.completedPrRuns
+          : null
+      }))
+      .sort((a, b) => b.runnerMinutes - a.runnerMinutes),
+    pools: [...pools.values()]
+      .map(({ waits, ...pool }) => ({ ...pool, queueP95Minutes: weightedPercentile(waits, 0.95) }))
+      .sort((a, b) => b.runnerMinutes - a.runnerMinutes)
+  }
+}
+
+export function sampleWorkflowRuns(runs, perStratum = 6, random = Math.random) {
+  const groups = new Map()
+  for (const run of runs) {
+    const key = `${workflowKey(run)}:${run.conclusion ?? run.status}`
+    if (!groups.has(key)) {
+      groups.set(key, [])
+    }
+    groups.get(key).push(run)
+  }
+  return [...groups.values()].flatMap((group) => {
+    const shuffled = [...group]
+    for (let index = shuffled.length - 1; index > 0; index--) {
+      const target = Math.floor(random() * (index + 1))
+      ;[shuffled[index], shuffled[target]] = [shuffled[target], shuffled[index]]
+    }
+    const selected = shuffled.slice(0, perStratum)
+    return selected.map((run) => ({ run, weight: group.length / selected.length }))
+  })
+}
diff --git a/config/scripts/ci-runner-metrics.test.mjs b/config/scripts/ci-runner-metrics.test.mjs
new file mode 100644
index 000000000000..ebf45cc7c357
--- /dev/null
+++ b/config/scripts/ci-runner-metrics.test.mjs
@@ -0,0 +1,95 @@
+import { expect, it } from 'vitest'
+import { runnerDemand, sampleWorkflowRuns } from './ci-runner-metrics.mjs'
+import { collectRunnerDemand } from './ci-runner-demand.mjs'
+
+const run = {
+  id: 1,
+  path: '.github/workflows/pr.yml',
+  event: 'pull_request',
+  conclusion: 'success'
+}
+const job = {
+  runner_name: 'hosted',
+  labels: ['ubuntu-latest'],
+  created_at: '2026-09-27T00:00:00Z',
+  started_at: '2026-09-27T00:03:00Z',
+  completed_at: '2026-09-27T00:08:00Z'
+}
+
+it('separates occupancy, queueing, cancellations and zero-job observations', () => {
+  const cancelled = { ...run, id: 2, conclusion: 'cancelled' }
+  const report = runnerDemand(
+    [run, cancelled],
+    [
+      { run, weight: 2, jobs: [job, { ...job, runner_name: null }] },
+      { run: cancelled, weight: 3, jobs: [job, { ...job, completed_at: null }] }
+    ]
+  )
+  expect(report.workflows[0]).toMatchObject({
+    runnerMinutes: 25,
+    cancelledRunnerMinutes: 15,
+    runnerMinutesPerCompletedPrRun: 5
+  })
+  expect(report.pools[0].queueP95Minutes).toBe(3)
+  expect(report.incompleteJobs).toBe(1)
+  expect(runnerDemand([run], [{ run, weight: 1, jobs: [] }]).workflows[0].runnerMinutes).toBe(0)
+})
+
+it('weights each workflow/outcome stratum back to the full inventory', () => {
+  const runs = Array.from({ length: 20 }, (_, index) => ({
+    ...run,
+    id: index,
+    conclusion: index < 10 ? 'success' : 'failure'
+  }))
+  const sample = sampleWorkflowRuns(runs, 2, () => 0.5)
+  expect(sample).toHaveLength(4)
+  expect(sample.reduce((sum, row) => sum + row.weight, 0)).toBe(20)
+  expect(new Set(sample.map((row) => row.run.id)).size).toBe(4)
+})
+
+it('paginates jobs and bounds run discovery to 24 complete hours', async () => {
+  const requests = []
+  const result = await collectRunnerDemand(
+    { CI_METRICS_END: '2026-09-28T04:59:00Z' },
+    async (path) => {
+      requests.push(path)
+      if (path.includes('/jobs')) {
+        return {
+          total_count: 101,
+          jobs: path.includes('page=2') ? [job] : Array.from({ length: 100 }, () => job)
+        }
+      }
+      return {
+        total_count: requests.length === 1 ? 1 : 0,
+        workflow_runs: requests.length === 1 ? [run] : []
+      }
+    }
+  )
+  expect(result.report.start).toBe('2026-09-27T04:00:00.000Z')
+  expect(result.report.end).toBe('2026-09-28T04:00:00.000Z')
+  expect(requests.filter((path) => path.startsWith('actions/runs?'))).toHaveLength(24)
+  expect(result.samples[0].jobs).toHaveLength(101)
+  expect(result.report.workflows[0].runnerMinutes).toBe(505)
+})
+
+it('refuses to publish a silently truncated inventory', async () => {
+  await expect(
+    collectRunnerDemand({}, async () => ({ total_count: 1001, workflow_runs: [] }))
+  ).rejects.toThrow('API limit')
+})
+
+it('groups ref-qualified paths under the stable workflow ID', () => {
+  const runs = [
+    { ...run, id: 1, workflow_id: 42, path: '.github/workflows/pr.yml@main' },
+    { ...run, id: 2, workflow_id: 42, path: '.github/workflows/pr.yml@feature' }
+  ]
+  const sample = sampleWorkflowRuns(runs, 1, () => 0.5)
+  expect(sample).toHaveLength(1)
+  expect(sample[0].weight).toBe(2)
+  expect(
+    runnerDemand(
+      runs,
+      sample.map((row) => ({ ...row, jobs: [job] }))
+    ).workflows
+  ).toMatchObject([{ workflow: '.github/workflows/pr.yml', runs: 2, runnerMinutes: 10 }])
+})
diff --git a/config/scripts/ci-shard-timings.json b/config/scripts/ci-shard-timings.json
index 4b4b08f97b2e..2ca7094bdd24 100644
--- a/config/scripts/ci-shard-timings.json
+++ b/config/scripts/ci-shard-timings.json
@@ -1,8476 +1,9859 @@
 {
   "unit": {
-    "runId": "34675583768",
-    "jobIds": [
-      "103505449197",
-      "103505449205",
-      "103505449211",
-      "103505449212",
-      "103505449228",
-      "103505449235",
-      "103505449248",
-      "103505449256"
-    ],
-    "overheadMs": 526,
+    "runId": "36294142683",
+    "runAttempt": "1",
+    "sourceSha": "cc35c1b422e9c20197bc59aa27a71019ffc18b5b",
+    "nodeVersion": "24.21.0",
+    "metric": "module-duration-v1",
+    "overheadMs": 0,
     "timings": {
-      "config/scripts/adhoc-build-version.test.mjs": 31,
-      "config/scripts/agent-status-hot-path-benchmark.test.ts": 2277,
-      "config/scripts/app-store-performance-plugin.test.mjs": 912,
-      "config/scripts/audit-localization-coverage.test.mjs": 23,
-      "config/scripts/benchmark-artifact-comparison.test.mjs": 132,
-      "config/scripts/benchmark-sample-summary.test.mjs": 8,
-      "config/scripts/build-linux-local.test.mjs": 15,
-      "config/scripts/build-mac-local.test.mjs": 5,
-      "config/scripts/build-orcad-prebuilds.test.mjs": 27,
-      "config/scripts/build-windows-cli-launcher.test.mjs": 39,
-      "config/scripts/check-changed-code-quality.test.mjs": 7,
-      "config/scripts/check-max-lines-ratchet.test.mjs": 10,
-      "config/scripts/check-react-doctor-changed.test.mjs": 189,
-      "config/scripts/check-reliability-gates.test.mjs": 171,
-      "config/scripts/check-root-directory-entries.test.mjs": 880,
-      "config/scripts/check-runtime-electron-ratchet.test.mjs": 1931,
-      "config/scripts/check-terminal-perf-report-budgets.test.mjs": 398,
-      "config/scripts/check-ts-nocheck-ratchet.test.mjs": 5,
-      "config/scripts/ci-native-toolchain.test.mjs": 38,
-      "config/scripts/client-hosted-browser-package-coverage.test.mjs": 81,
-      "config/scripts/codex-index-heal-contract-workflow.test.mjs": 10,
-      "config/scripts/codex-primary-home-tripwire.test.ts": 421,
-      "config/scripts/computer-e2e-workflow.test.mjs": 132,
-      "config/scripts/computer-use-modifier-safety.test.mjs": 5,
-      "config/scripts/computer-use-mouse-button-routing.test.mjs": 9,
-      "config/scripts/computer-use-skill-guidance.test.mjs": 15,
-      "config/scripts/computer-use-smoke.test.mjs": 471,
-      "config/scripts/computer-use-windows-horizontal-scroll.test.mjs": 3,
-      "config/scripts/counterbalanced-benchmark-schedule.test.mjs": 10,
-      "config/scripts/create-draft-release.test.mjs": 18,
-      "config/scripts/daily-build-version.test.mjs": 36,
-      "config/scripts/daily-e2e-dispatch-contract.test.mjs": 6,
-      "config/scripts/dev-channel-base-version.test.mjs": 8,
-      "config/scripts/dev-channel-windows-workflow-contract.test.mjs": 218,
-      "config/scripts/dev-cli-terminal-wrapper.test.mjs": 9,
-      "config/scripts/dev-electron-bundle-cache.test.ts": 10,
-      "config/scripts/dev-electron-bundle-identity.test.ts": 7,
-      "config/scripts/electron-builder-config.test.mjs": 155,
-      "config/scripts/electron-builder-mac-channel-config.test.mjs": 577,
-      "config/scripts/electron-builder-markdown-associations.test.mjs": 14,
-      "config/scripts/electron-builder-native-rebuild.test.mjs": 11,
-      "config/scripts/electron-builder-runtime-resources.test.mjs": 393,
-      "config/scripts/electron-builder-speech-config.test.mjs": 16,
-      "config/scripts/electron-runtime-floor.test.ts": 5,
-      "config/scripts/electron-vite-output-contract.test.ts": 13,
-      "config/scripts/ensure-native-runtime-job-ownership.test.mjs": 10,
-      "config/scripts/ensure-native-runtime.test.mjs": 422,
-      "config/scripts/generate-bundled-skill-guides.test.mjs": 293,
-      "config/scripts/generate-runtime-required-english-catalog.test.mjs": 8,
-      "config/scripts/generate-skill-bundle-manifest.test.mjs": 448,
-      "config/scripts/generate-terminal-perf-html-report.test.mjs": 19,
-      "config/scripts/git-binary-compatibility-workflow.test.mjs": 98,
-      "config/scripts/git-pull-request-diff-base.test.mjs": 4,
-      "config/scripts/hang-watchdog-process-metrics.test.mjs": 6,
-      "config/scripts/happy-dom-mutation-observer-retention.test.ts": 100,
-      "config/scripts/happy-dom-offscreen-canvas.test.ts": 42,
-      "config/scripts/headless-serve-shutdown-workflow.test.mjs": 15,
-      "config/scripts/hourly-build-version.test.mjs": 27,
-      "config/scripts/hourly-preflight-workflow.test.mjs": 33,
-      "config/scripts/idle-cpu-process-sampling.test.mjs": 5,
-      "config/scripts/install-electron-package-binary.test.mjs": 2145,
-      "config/scripts/install-node-dependencies-action.test.mjs": 140,
-      "config/scripts/latest-stable-release.test.mjs": 10,
-      "config/scripts/lint-staged-worktree-backup.test.mjs": 276,
-      "config/scripts/linux-package-maintainer-scripts.test.mjs": 6,
-      "config/scripts/live-freeze-bounded-history.test.mjs": 6,
-      "config/scripts/live-remote-bulk-open-freeze-metrics.test.mjs": 17,
-      "config/scripts/live-remote-freeze-rpc.test.mjs": 5,
-      "config/scripts/live-remote-status-watchdog.test.mjs": 248,
-      "config/scripts/locale-count-fragment-separator.test.mjs": 17,
-      "config/scripts/locale-generic-ui-terms.test.mjs": 20,
-      "config/scripts/locale-ko-frozen-terminal-search-keywords.test.mjs": 35,
-      "config/scripts/locale-ko-key-overrides.test.mjs": 38,
-      "config/scripts/locale-repair-catalog-missing-leaves.test.mjs": 14,
-      "config/scripts/locale-translation-policy-ko-round5.test.mjs": 12,
-      "config/scripts/locale-translation-policy.es-pr.test.mjs": 13,
-      "config/scripts/locale-translation-policy.es-round5.test.mjs": 9,
-      "config/scripts/locale-translation-policy.ja-relocalization.test.mjs": 17,
-      "config/scripts/locale-translation-policy.ja-round5.test.mjs": 13,
-      "config/scripts/locale-translation-policy.test.mjs": 38,
-      "config/scripts/locale-translation-policy.zh-round5.test.mjs": 14,
-      "config/scripts/locale-translation-policy.zh-status-bar-usage.test.mjs": 24,
-      "config/scripts/localization-package-contract.test.mjs": 8,
-      "config/scripts/mac-build-compatibility.test.mjs": 8,
-      "config/scripts/macos-computer-helper-owner-loss-group-recovery.test.mjs": 10,
-      "config/scripts/macos-tcc-prompt-localization.test.mjs": 75,
-      "config/scripts/mobile-pairing-qrcode-import-plugin.test.mjs": 450,
-      "config/scripts/node-old-space-limit.test.mjs": 6,
-      "config/scripts/node-pty-console-list-agent-patch.test.mjs": 7,
-      "config/scripts/node-pty-master-cloexec-patch.test.mjs": 22,
-      "config/scripts/node-pty-windows-pty-teardown-patch.test.mjs": 59,
-      "config/scripts/orca-cli-skill-guidance.test.mjs": 14,
-      "config/scripts/orca-dev-bin.test.mjs": 68,
-      "config/scripts/orca-linear-skill-guidance.test.mjs": 15,
-      "config/scripts/orcad-operations-restart-safety.test.mjs": 5,
-      "config/scripts/orchestration-guide-command-contract.test.mjs": 11,
-      "config/scripts/orchestration-skill-guidance.test.mjs": 23,
-      "config/scripts/oxc-cli-invocation.test.mjs": 128,
-      "config/scripts/oxlint-cli-invocation.test.mjs": 46,
-      "config/scripts/package-electron-runtime-contract.test.mjs": 360,
-      "config/scripts/packaged-browser-lane-contract.test.mjs": 7,
-      "config/scripts/packaged-hang-watchdog-worker-contract.test.mjs": 55,
-      "config/scripts/packaged-node-pty-prebuild-prune.test.mjs": 25,
-      "config/scripts/packaged-source-map-prune.test.mjs": 53,
-      "config/scripts/patched-dependencies-frozen-install.test.mjs": 451,
-      "config/scripts/plain-node-entry-guard.test.ts": 610,
-      "config/scripts/pnpm-cli-invocation.test.mjs": 6,
-      "config/scripts/pr-code-change-scope.test.mjs": 346,
-      "config/scripts/pr-e2e-gate-contract.test.mjs": 108,
-      "config/scripts/pr-e2e-native-only-routing.test.mjs": 19,
-      "config/scripts/pr-test-loc-summary.test.mjs": 89,
-      "config/scripts/pr-workflow-lint-parity.test.mjs": 53,
-      "config/scripts/pr-workflow-parallelism.test.mjs": 898,
-      "config/scripts/project-renderer-web-client.test.mjs": 213,
-      "config/scripts/pty-transcript-secret-scan.test.mjs": 14,
-      "config/scripts/publish-complete-draft-releases.test.mjs": 168,
-      "config/scripts/quadratic-buffer-concat-plugin.test.mjs": 2010,
-      "config/scripts/rebuild-native-deps-node-pty.test.mjs": 2338,
-      "config/scripts/rebuild-native-deps.test.mjs": 831,
-      "config/scripts/reclaim-dev-electron-bundles.test.ts": 35,
-      "config/scripts/regenerate-xterm-patches.test.mjs": 300,
-      "config/scripts/relay-artifact-manifest.test.mjs": 3554,
-      "config/scripts/relay-asset-line-ending-pin.test.mjs": 74,
-      "config/scripts/release-blocker-fixes.test.mjs": 39,
-      "config/scripts/release-cut-signpath-slack.test.mjs": 72,
-      "config/scripts/release-cut-sourcemap-publish.test.mjs": 11,
-      "config/scripts/release-cut-token-permissions.test.mjs": 19,
-      "config/scripts/release-e2e-dispatch-contract.test.mjs": 8,
-      "config/scripts/release-mac-build-workflow-dispatch.test.mjs": 10,
-      "config/scripts/release-rc-history.test.mjs": 166,
-      "config/scripts/renderer-boot-graph.test.mjs": 54,
-      "config/scripts/renderer-scrollbar-style-plugin.test.mjs": 2888,
-      "config/scripts/replace-cached-nsis-elevate.test.mjs": 1880,
-      "config/scripts/resolve-7za-path.test.mjs": 1412,
-      "config/scripts/run-codex-real-account-validation.test.ts": 3652,
-      "config/scripts/run-internal-dev-setup.test.mjs": 10,
-      "config/scripts/run-linux-packaged-node-pty-floor-smoke.test.mjs": 10,
-      "config/scripts/run-terminal-scale-perf-report-gate.test.mjs": 17,
-      "config/scripts/shared-electron-dist-cache.test.ts": 44,
-      "config/scripts/shebang-script-line-ending-pin.test.mjs": 77,
-      "config/scripts/skill-critical-guidance.test.mjs": 6,
-      "config/scripts/skill-description-length.test.mjs": 26,
-      "config/scripts/skill-recipe-shell.test.mjs": 43,
-      "config/scripts/skill-sharing-release-workflow.test.mjs": 12,
-      "config/scripts/skill-update-roundtrip-workflow.test.mjs": 5,
-      "config/scripts/skills-cli-package-workflow.test.mjs": 8,
-      "config/scripts/sort-comparator-performance-plugin.test.mjs": 269,
-      "config/scripts/space-sharing-copy.test.ts": 40,
-      "config/scripts/ssh-browser-e2e-routing.test.mjs": 23,
-      "config/scripts/ssh-localhost-e2e-routing.test.mjs": 28,
-      "config/scripts/static-appimage-package-contract.test.mjs": 42,
-      "config/scripts/summarize-terminal-perf-report.test.mjs": 52,
-      "config/scripts/telemetry-bundle-constant-patterns.test.mjs": 4,
-      "config/scripts/terminal-ime-e2e-workflow.test.mjs": 9,
-      "config/scripts/terminal-ime-engagement-receipt.test.mjs": 11,
-      "config/scripts/terminal-perf-report-annotations.test.mjs": 4,
-      "config/scripts/trim-windows-icon-source.test.mjs": 121,
-      "config/scripts/verify-cli-bin.test.mjs": 64,
-      "config/scripts/verify-dev-channel-packaging.test.mjs": 666,
-      "config/scripts/verify-linux-glibc-floor.test.mjs": 118,
-      "config/scripts/verify-localization-catalog.test.mjs": 46,
-      "config/scripts/verify-localization-extraction.test.mjs": 5,
-      "config/scripts/verify-packaged-browser-participation.test.mjs": 10,
-      "config/scripts/verify-packaged-daemon-entry.test.mjs": 111,
-      "config/scripts/verify-packaged-node-pty-job-ownership.test.mjs": 10,
-      "config/scripts/verify-packaged-plugin-resources.test.mjs": 67,
-      "config/scripts/verify-release-required-assets.test.mjs": 8,
-      "config/scripts/verify-skills-cli-runtime.test.mjs": 141,
-      "config/scripts/verify-windows-inner-signature.test.mjs": 20,
-      "config/scripts/verify-wsl-e2e-participation.test.mjs": 9,
-      "config/scripts/websocket-server-loopback-bind.test.ts": 5,
-      "config/scripts/win-crash-survival-e2e.test.mjs": 12,
-      "config/scripts/win32-test-lane-registration.test.mjs": 22,
-      "config/scripts/windows-cmd-shim-spawn-boundary.test.mjs": 6,
-      "config/scripts/windows-process-tree-gyp-path.test.mjs": 42,
-      "config/scripts/windows-process-tree-gyp-rebuild.test.mjs": 49,
-      "config/scripts/windows-process-tree-patch-contract.test.mjs": 530,
-      "config/scripts/windows-pty-native-capability-workflow.test.mjs": 7,
-      "config/scripts/windows-signing-gate-toolset.test.mjs": 53,
-      "config/scripts/windows-signing-workflow-contract.test.mjs": 531,
-      "config/scripts/windows-uninstaller-signing.test.mjs": 17,
-      "config/scripts/workflow-ref-mirror-case-safety.test.mjs": 74,
-      "config/scripts/workflow-ref-reachability.test.mjs": 592,
-      "config/scripts/wsl-e2e-lane-contract.test.mjs": 76,
-      "config/scripts/xterm-webgl-runtime-contract.test.mjs": 19,
-      "src/cli/agent-context.test.ts": 16,
-      "src/cli/args.test.ts": 36,
-      "src/cli/automation-format.test.ts": 16,
-      "src/cli/automation-owner-conflict-recovery.test.ts": 12,
-      "src/cli/base64-payload-byte-count.test.ts": 3,
-      "src/cli/browser-cookie-credentials-empty-value.test.ts": 58,
-      "src/cli/browser-storage-empty-value.test.ts": 48,
-      "src/cli/browser.test.ts": 109,
-      "src/cli/cli-command-name-parity.test.ts": 7,
-      "src/cli/cli-version.test.ts": 13,
-      "src/cli/codex-command-classification.test.ts": 11,
-      "src/cli/command-suggestion-budget.test.ts": 25,
-      "src/cli/command-suggestion.test.ts": 20,
-      "src/cli/computer-format.test.ts": 3,
-      "src/cli/emulator-logcat-format.test.ts": 4,
-      "src/cli/execution-host-flag.test.ts": 21,
-      "src/cli/flags.test.ts": 4,
-      "src/cli/format-recovery.test.ts": 10,
-      "src/cli/format.test.ts": 29,
-      "src/cli/handler-group-manifest.test.ts": 638,
-      "src/cli/handlers/account.test.ts": 558,
-      "src/cli/handlers/agent-hooks.test.ts": 83,
-      "src/cli/handlers/artifacts.test.ts": 36,
-      "src/cli/handlers/automation-destination-fencing.test.ts": 17,
-      "src/cli/handlers/automation-owner-fencing.test.ts": 16,
-      "src/cli/handlers/computer-action-routing.test.ts": 69,
-      "src/cli/handlers/computer-action-validation.test.ts": 86,
-      "src/cli/handlers/computer-state-formatting.test.ts": 65,
-      "src/cli/handlers/computer.test.ts": 103,
-      "src/cli/handlers/core.test.ts": 7,
-      "src/cli/handlers/emulator.test.ts": 37,
-      "src/cli/handlers/file-absolute-paths.test.ts": 60,
-      "src/cli/handlers/file.test.ts": 46,
-      "src/cli/handlers/interactive-login-interruption.test.ts": 12,
-      "src/cli/handlers/linear.test.ts": 131,
-      "src/cli/handlers/orchestration-caller-identity-cli.test.ts": 18,
-      "src/cli/handlers/orchestration-check-identity.test.ts": 12,
-      "src/cli/handlers/orchestration-federated-legacy-settlement.test.ts": 8,
-      "src/cli/handlers/orchestration-gate-cli.test.ts": 99,
-      "src/cli/handlers/orchestration-legacy-read-only.test.ts": 9,
-      "src/cli/handlers/orchestration-lifecycle-json-rejection.test.ts": 15,
-      "src/cli/handlers/orchestration-lifecycle-rejection.test.ts": 12,
-      "src/cli/handlers/orchestration-migration.test.ts": 12,
-      "src/cli/handlers/orchestration-module-boundaries.test.ts": 11,
-      "src/cli/handlers/orchestration-request-show-cli.test.ts": 7,
-      "src/cli/handlers/orchestration-run-cli.test.ts": 22,
-      "src/cli/handlers/orchestration-send-receipt-warnings.test.ts": 7,
-      "src/cli/handlers/orchestration-task-create-cli.test.ts": 8,
-      "src/cli/handlers/orchestration-task-list-brief.test.ts": 12,
-      "src/cli/handlers/orchestration-timeout-cli.test.ts": 29,
-      "src/cli/handlers/orchestration-timeout.test.ts": 26,
-      "src/cli/handlers/orchestration-windows-ask-cli.test.ts": 11,
-      "src/cli/handlers/orchestration-worker-cli.test.ts": 32,
-      "src/cli/handlers/orchestration-worker-show-wait-cli.test.ts": 9,
-      "src/cli/handlers/orchestration.test.ts": 31,
-      "src/cli/handlers/orchestration/worker-list-run-scope.test.ts": 13,
-      "src/cli/handlers/orchestration/worker-output.test.ts": 13,
-      "src/cli/handlers/skill-sharing.test.ts": 16,
-      "src/cli/handlers/terminal.test.ts": 29,
-      "src/cli/host-selector-alternatives.test.ts": 14,
-      "src/cli/index-automation-identifiers.test.ts": 42,
-      "src/cli/index-automation-schedule.test.ts": 64,
-      "src/cli/index-automation-session-reuse.test.ts": 54,
-      "src/cli/index-automation-source-context.test.ts": 75,
-      "src/cli/index-automation-target.test.ts": 89,
-      "src/cli/index-device-commands.test.ts": 57,
-      "src/cli/index-environment-commands.test.ts": 103,
-      "src/cli/index-local-command-routing-flags.test.ts": 141,
-      "src/cli/index-memory-diagnostics.test.ts": 54,
-      "src/cli/index-omitted-host-scope-selectors.test.ts": 54,
-      "src/cli/index-orchestration.test.ts": 72,
-      "src/cli/index-project-setup.test.ts": 95,
-      "src/cli/index-serve-command.test.ts": 121,
-      "src/cli/index-terminal-commands.test.ts": 78,
-      "src/cli/index-terminal-list-host-scope.test.ts": 92,
-      "src/cli/index-vm-recipe-doctor.test.ts": 125,
-      "src/cli/index-worktree-create-agent.test.ts": 64,
-      "src/cli/index-worktree-create-linear.test.ts": 44,
-      "src/cli/index-worktree-create-parent.test.ts": 118,
-      "src/cli/index-worktree-create-target.test.ts": 65,
-      "src/cli/index-worktree-selector-resolution.test.ts": 185,
-      "src/cli/index-worktree-set.test.ts": 83,
-      "src/cli/index.test.ts": 263,
-      "src/cli/linear-format.test.ts": 9,
-      "src/cli/main-module-bundle-parity.test.ts": 14,
-      "src/cli/orchestration-dispatch-refusal-format.test.ts": 8,
-      "src/cli/orchestration-mutation-recovery.test.ts": 52,
-      "src/cli/orchestration-structured-sender-identity.test.ts": 93,
-      "src/cli/orchestration-structured-session-no-identity.test.ts": 11,
-      "src/cli/quote-stripped-json-flag.test.ts": 8,
-      "src/cli/registry-parity.test.ts": 7,
-      "src/cli/retry-request-flag.test.ts": 9,
-      "src/cli/runtime-client-deferral.test.ts": 486,
-      "src/cli/runtime-client.test.ts": 110,
-      "src/cli/runtime/client-recovery.test.ts": 250,
-      "src/cli/runtime/client-timeout-policy.test.ts": 13,
-      "src/cli/runtime/envelope-schema.test.ts": 33,
-      "src/cli/runtime/environments.test.ts": 27,
-      "src/cli/runtime/launch.test.ts": 53,
-      "src/cli/runtime/orchestration-recovery-command.test.ts": 5,
-      "src/cli/runtime/serve-signal-exit-diagnostic.test.ts": 28,
-      "src/cli/runtime/status.test.ts": 19,
-      "src/cli/runtime/transport-framing.test.ts": 78,
-      "src/cli/runtime/transport.test.ts": 533,
-      "src/cli/runtime/types.test.ts": 5,
-      "src/cli/runtime/websocket-transport-error.test.ts": 8,
-      "src/cli/runtime/websocket-transport.test.ts": 176,
-      "src/cli/serve-electron-flag-parity.test.ts": 8,
-      "src/cli/shell-command-quote.test.ts": 8,
-      "src/cli/skill-guide-cli-parity.test.ts": 14,
-      "src/cli/skills-reference-selector.test.ts": 28,
-      "src/cli/skills.test.ts": 963,
-      "src/cli/specs/account.test.ts": 6,
-      "src/cli/specs/bundled-guide-flags.test.ts": 40,
-      "src/cli/specs/computer.test.ts": 9,
-      "src/cli/specs/orchestration.test.ts": 16,
-      "src/cli/specs/skills.test.ts": 6,
-      "src/cli/terminal-format-draft.test.ts": 6,
-      "src/cli/terminal-format.test.ts": 12,
-      "src/cli/terminal-list-host-scope-format.test.ts": 8,
-      "src/cli/terminal-read-screen.test.ts": 68,
-      "src/cli/vocabulary-policy.test.ts": 8,
-      "src/cli/worktree-selector-wsl-posix-path.test.ts": 11,
-      "src/main/active-view-persistence-boundary.test.ts": 725,
-      "src/main/active-view-preference-sync-flush-veto.test.ts": 777,
-      "src/main/active-view-preference.test.ts": 20,
-      "src/main/agent-auth-restart-preservation.test.ts": 16,
-      "src/main/agent-awake-service-platform-assertions.test.ts": 10,
-      "src/main/agent-awake-service.test.ts": 29,
-      "src/main/agent-hooks/branch-rename-failure-output.test.ts": 7,
-      "src/main/agent-hooks/ended-process-reconciliation.test.ts": 34,
-      "src/main/agent-hooks/first-work-branch-rename.test.ts": 140,
-      "src/main/agent-hooks/first-work-folder-rename.test.ts": 13,
-      "src/main/agent-hooks/hook-script-outside-orca.test.ts": 32,
-      "src/main/agent-hooks/hook-status-session-tabs-republish.test.ts": 22,
-      "src/main/agent-hooks/install-telemetry.test.ts": 10,
-      "src/main/agent-hooks/installer-utils-remote.test.ts": 14,
-      "src/main/agent-hooks/installer-utils.test.ts": 66,
-      "src/main/agent-hooks/local-agent-cli-presence.test.ts": 11,
-      "src/main/agent-hooks/managed-agent-hook-controls.test.ts": 76,
-      "src/main/agent-hooks/managed-hook-detection-commands.test.ts": 5,
-      "src/main/agent-hooks/managed-hook-install-lock.test.ts": 263,
-      "src/main/agent-hooks/managed-hook-local-filesystem.test.ts": 147,
-      "src/main/agent-hooks/managed-hook-owner-identity.test.ts": 33,
-      "src/main/agent-hooks/managed-hook-runtime.test.ts": 41,
-      "src/main/agent-hooks/managed-hook-script-refresh-main-thread.test.ts": 27,
-      "src/main/agent-hooks/managed-hook-script-refresh.test.ts": 108,
-      "src/main/agent-hooks/managed-hook-stdin-lifecycle.test.ts": 1979,
-      "src/main/agent-hooks/managed-hook-timeout.test.ts": 1585,
-      "src/main/agent-hooks/managed-toml-ownership.test.ts": 12,
-      "src/main/agent-hooks/manual-compact-hook-stream.test.ts": 119,
-      "src/main/agent-hooks/manual-compact-status-cleanup.test.ts": 6,
-      "src/main/agent-hooks/migration-unsupported-pty-state.test.ts": 8,
-      "src/main/agent-hooks/opencode-message-part-flood-bench.test.ts": 1234,
-      "src/main/agent-hooks/remote-hook-service-installers.test.ts": 89,
-      "src/main/agent-hooks/restored-subagent-liveness-sweep.test.ts": 75,
-      "src/main/agent-hooks/server-ai-vault-liveness.test.ts": 34,
-      "src/main/agent-hooks/server-amp-normalization.test.ts": 13,
-      "src/main/agent-hooks/server-authority-evidence.test.ts": 21,
-      "src/main/agent-hooks/server-claude-child-permission-lifecycle.test.ts": 213,
-      "src/main/agent-hooks/server-claude-normalization.test.ts": 36,
-      "src/main/agent-hooks/server-claude-permission-visibility.test.ts": 114,
-      "src/main/agent-hooks/server-claude-statusline.test.ts": 41,
-      "src/main/agent-hooks/server-closed-tab-suppression.test.ts": 167,
-      "src/main/agent-hooks/server-codex-normalization.test.ts": 14,
-      "src/main/agent-hooks/server-codex-subagent-transcript.test.ts": 4092,
-      "src/main/agent-hooks/server-copilot-normalization.test.ts": 416,
-      "src/main/agent-hooks/server-cursor-normalization.test.ts": 13,
-      "src/main/agent-hooks/server-droid-normalization.test.ts": 10,
-      "src/main/agent-hooks/server-endpoint-file-lifecycle.test.ts": 35,
-      "src/main/agent-hooks/server-gemini-normalization.test.ts": 13,
-      "src/main/agent-hooks/server-grok-discovery.test.ts": 513,
-      "src/main/agent-hooks/server-hook-http-ingest.test.ts": 94,
-      "src/main/agent-hooks/server-ingest-remote.test.ts": 45,
-      "src/main/agent-hooks/server-ingest-structured-status.test.ts": 34,
-      "src/main/agent-hooks/server-ingest-terminal-status.test.ts": 18,
-      "src/main/agent-hooks/server-interrupt-inference-guards.test.ts": 76,
-      "src/main/agent-hooks/server-interrupt-inference-resurrection.test.ts": 35,
-      "src/main/agent-hooks/server-interrupt-inference-validation.test.ts": 24,
-      "src/main/agent-hooks/server-last-status-hydrate-confirmation.test.ts": 75,
-      "src/main/agent-hooks/server-last-status-hydrate-validation.test.ts": 83,
-      "src/main/agent-hooks/server-last-status-lead-boundary.test.ts": 172,
-      "src/main/agent-hooks/server-last-status-restored-children.test.ts": 596,
-      "src/main/agent-hooks/server-last-status-write.test.ts": 125,
-      "src/main/agent-hooks/server-observation-provenance.test.ts": 27,
-      "src/main/agent-hooks/server-opencode-lifecycle.test.ts": 228,
-      "src/main/agent-hooks/server-opencode-normalization.test.ts": 15,
-      "src/main/agent-hooks/server-pane-authority.test.ts": 254,
-      "src/main/agent-hooks/server-pi-normalization.test.ts": 14,
-      "src/main/agent-hooks/server-prompt-sent-telemetry.test.ts": 59,
-      "src/main/agent-hooks/server-relay-listener-replay.test.ts": 25,
-      "src/main/agent-hooks/server-reminted-pane-key.test.ts": 112,
-      "src/main/agent-hooks/server-replay-evidence-clock.test.ts": 28,
-      "src/main/agent-hooks/server-retired-pane-new-turn.test.ts": 21,
-      "src/main/agent-hooks/server-start-failure-lifecycle.test.ts": 32,
-      "src/main/agent-hooks/server-status-listener-fanout.test.ts": 84,
-      "src/main/agent-hooks/server-transport-interference.test.ts": 5826,
-      "src/main/agent-hooks/server.claude-interactive-question.test.ts": 21,
-      "src/main/agent-hooks/spool.test.ts": 134,
-      "src/main/agent-hooks/terminal-handle-row-identity.test.ts": 40,
-      "src/main/agent-hooks/windows-direct-cmd-hook-command.test.ts": 8,
-      "src/main/agent-hooks/windows-hook-payload-delivery.test.ts": 8,
-      "src/main/agent-hooks/windows-hook-post-interpreter.test.ts": 83,
-      "src/main/agent-hooks/windows-powershell-hook-launcher.test.ts": 5,
-      "src/main/agent-hooks/wsl-guest-plugin-install.test.ts": 9,
-      "src/main/agent-hooks/wsl-hook-relay-launch.test.ts": 7,
-      "src/main/agent-hooks/wsl-hook-relay-live.integration.test.ts": 2716,
-      "src/main/agent-hooks/wsl-hook-relay-manager.test.ts": 1110,
-      "src/main/agent-hooks/wsl-hook-relay-reattach.test.ts": 6,
-      "src/main/agent-hooks/wsl-hook-relay-recovery.test.ts": 2323,
-      "src/main/agent-hooks/wsl-hook-relay-sentinel.test.ts": 17,
-      "src/main/agent-state-file-reader.test.ts": 39,
-      "src/main/agent-trust-presets.test.ts": 33,
-      "src/main/ai-vault-search/session-search-content-hash.test.ts": 5,
-      "src/main/ai-vault-search/session-search-cwd-key.test.ts": 9,
-      "src/main/ai-vault-search/session-search-deleted-sources.test.ts": 176,
-      "src/main/ai-vault-search/session-search-directory-listings.test.ts": 10,
-      "src/main/ai-vault-search/session-search-engine.test.ts": 1166,
-      "src/main/ai-vault-search/session-search-file-write.test.ts": 423,
-      "src/main/ai-vault-search/session-search-fts5-contract.test.ts": 62,
-      "src/main/ai-vault-search/session-search-hit-ranking.test.ts": 13,
-      "src/main/ai-vault-search/session-search-identifier-split.test.ts": 8,
-      "src/main/ai-vault-search/session-search-index-consumer.test.ts": 172,
-      "src/main/ai-vault-search/session-search-index-generation.test.ts": 111,
-      "src/main/ai-vault-search/session-search-index-pass.test.ts": 134,
-      "src/main/ai-vault-search/session-search-index-writer.test.ts": 114,
-      "src/main/ai-vault-search/session-search-indexer.test.ts": 2283,
-      "src/main/ai-vault-search/session-search-lifecycle-matrix.test.ts": 4538,
-      "src/main/ai-vault-search/session-search-live-transcript.test.ts": 83,
-      "src/main/ai-vault-search/session-search-merged-roots.test.ts": 111,
-      "src/main/ai-vault-search/session-search-message-rows.test.ts": 787,
-      "src/main/ai-vault-search/session-search-native-chat-indexing.test.ts": 211,
-      "src/main/ai-vault-search/session-search-opencode-decline.test.ts": 218,
-      "src/main/ai-vault-search/session-search-orphan-rows.test.ts": 179,
-      "src/main/ai-vault-search/session-search-paging.test.ts": 497,
-      "src/main/ai-vault-search/session-search-query-planner.test.ts": 14,
-      "src/main/ai-vault-search/session-search-read-decision.test.ts": 4,
-      "src/main/ai-vault-search/session-search-retention-delete.test.ts": 108,
-      "src/main/ai-vault-search/session-search-retention-policy.test.ts": 4,
-      "src/main/ai-vault-search/session-search-row-filter.test.ts": 194,
-      "src/main/ai-vault-search/session-search-row-identity.test.ts": 52,
-      "src/main/ai-vault-search/session-search-scan-roots.test.ts": 5,
-      "src/main/ai-vault-search/session-search-schema.test.ts": 322,
-      "src/main/ai-vault-search/session-search-sidebar-parity.test.ts": 213,
-      "src/main/ai-vault-search/session-search-snippet-marks.test.ts": 118,
-      "src/main/ai-vault-search/session-search-store-is-memory.test.ts": 305,
-      "src/main/ai-vault-search/session-search-synthetic-corpus.test.ts": 188,
-      "src/main/ai-vault-search/session-search-typo-policy.test.ts": 556,
-      "src/main/ai-vault-search/session-search-typo-scope.test.ts": 47,
-      "src/main/ai-vault/ai-vault-scan-cancellation.test.ts": 5,
-      "src/main/ai-vault/ai-vault-scan-coordinator.test.ts": 16,
-      "src/main/ai-vault/cached-session-list.test.ts": 10,
-      "src/main/ai-vault/claude-project-dir-encoding.test.ts": 10,
-      "src/main/ai-vault/codex-session-collection.test.ts": 32,
-      "src/main/ai-vault/codex-session-root-dedup.test.ts": 13,
-      "src/main/ai-vault/local-log-tail-reader.test.ts": 25,
-      "src/main/ai-vault/remote-session-parse-cache.test.ts": 26,
-      "src/main/ai-vault/remote-session-scan-batching.test.ts": 6,
-      "src/main/ai-vault/remote-session-scanner-omp-subagents.test.ts": 29,
-      "src/main/ai-vault/remote-session-scanner.test.ts": 37,
-      "src/main/ai-vault/remote-session-sidecar-observation.test.ts": 31,
-      "src/main/ai-vault/runtime-session-scanner.test.ts": 16,
-      "src/main/ai-vault/session-delete-target.test.ts": 20,
-      "src/main/ai-vault/session-delete.test.ts": 22,
-      "src/main/ai-vault/session-first-user-prompt-read.test.ts": 28,
-      "src/main/ai-vault/session-list-result-validation.test.ts": 27,
-      "src/main/ai-vault/session-list-results.test.ts": 12,
-      "src/main/ai-vault/session-newest-files.test.ts": 121,
-      "src/main/ai-vault/session-parse-cache-persistence.test.ts": 73,
-      "src/main/ai-vault/session-scanner-antigravity-parser.test.ts": 9,
-      "src/main/ai-vault/session-scanner-antigravity-source.test.ts": 57,
-      "src/main/ai-vault/session-scanner-background.test.ts": 8,
-      "src/main/ai-vault/session-scanner-claude-cwd-drift.test.ts": 23,
-      "src/main/ai-vault/session-scanner-claude-subagent-prune.test.ts": 21,
-      "src/main/ai-vault/session-scanner-claude-subagents.test.ts": 71,
-      "src/main/ai-vault/session-scanner-claude-title.test.ts": 32,
-      "src/main/ai-vault/session-scanner-claude-unicode-scope.test.ts": 43,
-      "src/main/ai-vault/session-scanner-cline-parser.test.ts": 32,
-      "src/main/ai-vault/session-scanner-codex-dual-root.test.ts": 51,
-      "src/main/ai-vault/session-scanner-codex-fast-path.test.ts": 180,
-      "src/main/ai-vault/session-scanner-codex-parser.test.ts": 47,
-      "src/main/ai-vault/session-scanner-codex-title-index.test.ts": 175,
-      "src/main/ai-vault/session-scanner-codex-tool-records.test.ts": 16,
-      "src/main/ai-vault/session-scanner-codex-workers.test.ts": 36,
-      "src/main/ai-vault/session-scanner-core-parser-wsl-stall.test.ts": 45,
-      "src/main/ai-vault/session-scanner-cursor-chat-meta.test.ts": 154,
-      "src/main/ai-vault/session-scanner-dedup-batches.test.ts": 228,
-      "src/main/ai-vault/session-scanner-devin-parser.test.ts": 13,
-      "src/main/ai-vault/session-scanner-directory-reader.test.ts": 15,
-      "src/main/ai-vault/session-scanner-discovery-wsl-gate.test.ts": 16,
-      "src/main/ai-vault/session-scanner-first-user-prompt.test.ts": 9,
-      "src/main/ai-vault/session-scanner-fs-import-guard.test.ts": 28,
-      "src/main/ai-vault/session-scanner-graph-parsers.test.ts": 6,
-      "src/main/ai-vault/session-scanner-grok-parser.test.ts": 26,
-      "src/main/ai-vault/session-scanner-grok-user-text.test.ts": 6,
-      "src/main/ai-vault/session-scanner-index-cache-wsl-stall.test.ts": 25,
-      "src/main/ai-vault/session-scanner-injected-title.test.ts": 29,
-      "src/main/ai-vault/session-scanner-jsonl-reader.test.ts": 84,
-      "src/main/ai-vault/session-scanner-kimi-index-cache.test.ts": 31,
-      "src/main/ai-vault/session-scanner-kimi-parser.test.ts": 153,
-      "src/main/ai-vault/session-scanner-omp-subagent-listing.test.ts": 24,
-      "src/main/ai-vault/session-scanner-omp-subagent-prune.test.ts": 38,
-      "src/main/ai-vault/session-scanner-omp-subagent-transcripts.test.ts": 15,
-      "src/main/ai-vault/session-scanner-opencode-parser.test.ts": 25,
-      "src/main/ai-vault/session-scanner-opencode-sources-wsl-stall.test.ts": 23,
-      "src/main/ai-vault/session-scanner-opencode-sources.test.ts": 9,
-      "src/main/ai-vault/session-scanner-opencode-sqlite-bounds.test.ts": 539,
-      "src/main/ai-vault/session-scanner-opencode-sqlite-coexistence.test.ts": 58,
-      "src/main/ai-vault/session-scanner-opencode-sqlite-open.test.ts": 4131,
-      "src/main/ai-vault/session-scanner-opencode-sqlite-paths.test.ts": 9,
-      "src/main/ai-vault/session-scanner-opencode-sqlite-worker-client.test.ts": 23,
-      "src/main/ai-vault/session-scanner-opencode-sqlite-worker-spawn.test.ts": 6,
-      "src/main/ai-vault/session-scanner-opencode-sqlite.test.ts": 225,
-      "src/main/ai-vault/session-scanner-parse-cache-agents.test.ts": 198,
-      "src/main/ai-vault/session-scanner-parse-cache.test.ts": 57,
-      "src/main/ai-vault/session-scanner-parse-wsl-stall.test.ts": 31,
-      "src/main/ai-vault/session-scanner-parser-stream-cleanup.test.ts": 21,
-      "src/main/ai-vault/session-scanner-preview-window-truncation.test.ts": 6,
-      "src/main/ai-vault/session-scanner-recoverable-empty.test.ts": 57,
-      "src/main/ai-vault/session-scanner-roots.test.ts": 7,
-      "src/main/ai-vault/session-scanner-scope.test.ts": 82,
-      "src/main/ai-vault/session-scanner-service-client.test.ts": 178,
-      "src/main/ai-vault/session-scanner-service-entry-path.test.ts": 5,
-      "src/main/ai-vault/session-scanner-service-entry.test.ts": 486,
-      "src/main/ai-vault/session-scanner-service-env.test.ts": 8,
-      "src/main/ai-vault/session-scanner-service-restart-policy.test.ts": 6,
-      "src/main/ai-vault/session-scanner-service-spawn.test.ts": 6,
-      "src/main/ai-vault/session-scanner-values.test.ts": 21,
-      "src/main/ai-vault/session-scanner-worker-client.test.ts": 17,
-      "src/main/ai-vault/session-scanner.test.ts": 109,
-      "src/main/ai-vault/session-sidecar-stat.test.ts": 9,
-      "src/main/ai-vault/session-title-file-reader-wsl-stall.test.ts": 22,
-      "src/main/ai-vault/session-title-file-reader.test.ts": 15,
-      "src/main/ai-vault/session-transcript-consumers.test.ts": 107,
-      "src/main/ai-vault/session-transcript-message-content.test.ts": 10,
-      "src/main/ai-vault/ssh-session-list.test.ts": 87,
-      "src/main/ai-vault/structured-session-ownership.test.ts": 18,
-      "src/main/amp/hook-service.test.ts": 13,
-      "src/main/antigravity/hook-service.test.ts": 61,
-      "src/main/antigravity/windows-hook-payload-delivery.test.ts": 10,
-      "src/main/app-icon.test.ts": 24,
-      "src/main/app-relaunch.test.ts": 7,
-      "src/main/appimage-runtime-identity.test.ts": 36,
-      "src/main/appkit-scene-mutation.test.ts": 9,
-      "src/main/artifacts/artifact-cloud-config.test.ts": 6,
-      "src/main/artifacts/artifact-cloud-recovery.test.ts": 132,
-      "src/main/artifacts/artifact-cloud-service-races.test.ts": 219,
-      "src/main/artifacts/artifact-cloud-service.test.ts": 725,
-      "src/main/artifacts/artifact-create-intent-store.test.ts": 339,
-      "src/main/artifacts/artifact-recovery-directory-fsync.test.ts": 14,
-      "src/main/artifacts/artifact-share-record-store.test.ts": 310,
-      "src/main/asar-transparent-fs.test.ts": 9,
-      "src/main/automations/automation-dispatch-host-fence.test.ts": 1300,
-      "src/main/automations/automation-owner-fencing.test.ts": 1874,
-      "src/main/automations/automation-owner-migration.test.ts": 17,
-      "src/main/automations/automation-run-terminal-surface.test.ts": 34,
-      "src/main/automations/automation-run-writer.test.ts": 7,
-      "src/main/automations/automation-skip-coalescing.test.ts": 1783,
-      "src/main/automations/automation-ssh-readoption-migration.test.ts": 9,
-      "src/main/automations/automation-update-host-retarget.test.ts": 1187,
-      "src/main/automations/automation-workspace-host-attribution.test.ts": 757,
-      "src/main/automations/external-automation-manager-cache.test.ts": 12,
-      "src/main/automations/external-automation-owner-guard.test.ts": 8,
-      "src/main/automations/external-automation-probe-scheduler.test.ts": 123,
-      "src/main/automations/external-job-run-sorting.test.ts": 170,
-      "src/main/automations/external-manager-scoped.test.ts": 23,
-      "src/main/automations/external-manager.test.ts": 15,
-      "src/main/automations/headless-workspace-create.test.ts": 9,
-      "src/main/automations/hermes-cron-output.test.ts": 73,
-      "src/main/automations/precheck-runner.test.ts": 1066,
-      "src/main/automations/refused-manual-run.test.ts": 2290,
-      "src/main/automations/retained-run-reconciliation.test.ts": 491,
-      "src/main/automations/run-completion-watcher.test.ts": 1046,
-      "src/main/automations/run-target-resolution.test.ts": 6,
-      "src/main/automations/runtime-terminal-run-observer.test.ts": 54,
-      "src/main/automations/service-precheck.test.ts": 931,
-      "src/main/automations/service.test.ts": 1218,
-      "src/main/azure-devops/azure-devops-api-request.test.ts": 61,
-      "src/main/azure-devops/client.test.ts": 84,
-      "src/main/azure-devops/pull-request-creation.test.ts": 74,
-      "src/main/azure-devops/pull-request-mappers.test.ts": 5,
-      "src/main/azure-devops/repository-ref.test.ts": 33,
-      "src/main/bitbucket/client.test.ts": 102,
-      "src/main/bitbucket/credential-connection.test.ts": 151,
-      "src/main/bitbucket/credential-store.test.ts": 146,
-      "src/main/bitbucket/pull-request-creation.test.ts": 70,
-      "src/main/bitbucket/pull-request-mappers.test.ts": 7,
-      "src/main/bitbucket/repository-ref.test.ts": 24,
-      "src/main/bitbucket/status-no-decrypt.test.ts": 171,
-      "src/main/browser/agent-browser-bridge-capture-paint-hold.test.ts": 91,
-      "src/main/browser/agent-browser-bridge-command-transport.test.ts": 102,
-      "src/main/browser/agent-browser-bridge-mouse-input.test.ts": 24,
-      "src/main/browser/agent-browser-bridge-navigation.test.ts": 156,
-      "src/main/browser/agent-browser-bridge-session-lifecycle.test.ts": 244,
-      "src/main/browser/agent-browser-bridge-tab-routing.test.ts": 89,
-      "src/main/browser/agent-browser-bridge-text-input.test.ts": 104,
-      "src/main/browser/agent-browser-orphan-sweep.test.ts": 14,
-      "src/main/browser/agent-browser-process-environment.test.ts": 9,
-      "src/main/browser/agent-browser-session-reset.test.ts": 9,
-      "src/main/browser/browser-certificate-trust-controller.test.ts": 186,
-      "src/main/browser/browser-clicked-link-routing.test.ts": 111,
-      "src/main/browser/browser-client-download-relay.test.ts": 39,
-      "src/main/browser/browser-client-download-routing.test.ts": 12,
-      "src/main/browser/browser-client-file-channel-negotiation.test.ts": 13,
-      "src/main/browser/browser-client-file-channel-reconnect.test.ts": 317,
-      "src/main/browser/browser-client-host-attach-request.test.ts": 13,
-      "src/main/browser/browser-client-host-authority-replacement.test.ts": 20,
-      "src/main/browser/browser-client-host-command-dispatcher.test.ts": 26,
-      "src/main/browser/browser-client-host-id.test.ts": 37,
-      "src/main/browser/browser-client-host-placement-preparation.test.ts": 17,
-      "src/main/browser/browser-client-host-published-url-wiring.test.ts": 451,
-      "src/main/browser/browser-client-host-reconciliation-command-order.test.ts": 19,
-      "src/main/browser/browser-client-network-route-registry.test.ts": 45,
-      "src/main/browser/browser-client-page-automation-runtime.test.ts": 15,
-      "src/main/browser/browser-client-page-command-executor-fencing.test.ts": 25,
-      "src/main/browser/browser-client-page-command-executor.test.ts": 33,
-      "src/main/browser/browser-client-page-command-integration.test.ts": 21,
-      "src/main/browser/browser-client-page-execution-host-supersession.test.ts": 12,
-      "src/main/browser/browser-client-page-inventory.test.ts": 68,
-      "src/main/browser/browser-client-page-metadata-transport.test.ts": 21,
-      "src/main/browser/browser-client-page-published-url.test.ts": 12,
-      "src/main/browser/browser-client-page-reconciliation-adapters.test.ts": 28,
-      "src/main/browser/browser-client-page-renderer-bridge.test.ts": 35,
-      "src/main/browser/browser-client-page-renderer-lifecycle.electron.test.ts": 1571,
-      "src/main/browser/browser-client-page-renderer-runtime.test.ts": 12,
-      "src/main/browser/browser-client-page-unavailability.test.ts": 13,
-      "src/main/browser/browser-client-page-upload-routing.test.ts": 60,
-      "src/main/browser/browser-client-route-cookie-import-partition-parity.test.ts": 20,
-      "src/main/browser/browser-client-route-cookie-import.test.ts": 14,
-      "src/main/browser/browser-client-upload-command.test.ts": 34,
-      "src/main/browser/browser-client-upload-staging.test.ts": 57,
-      "src/main/browser/browser-client-upload-transfer.test.ts": 3444,
-      "src/main/browser/browser-cookie-clear-preserve.test.ts": 71,
-      "src/main/browser/browser-cookie-clear-store-lifecycle.test.ts": 11,
-      "src/main/browser/browser-cookie-clear-store.test.ts": 25,
-      "src/main/browser/browser-cookie-import-app-bound-prefix.test.ts": 7,
-      "src/main/browser/browser-cookie-import-clear-atomicity.test.ts": 15,
-      "src/main/browser/browser-cookie-import-concurrency.test.ts": 113,
-      "src/main/browser/browser-cookie-import-google-exclusion.test.ts": 135,
-      "src/main/browser/browser-cookie-import-partition-fidelity.test.ts": 502,
-      "src/main/browser/browser-cookie-import-partition-reland.electron.test.ts": 2913,
-      "src/main/browser/browser-cookie-import-partition-rollback.electron.test.ts": 4236,
-      "src/main/browser/browser-cookie-import-partition-success.electron.test.ts": 513,
-      "src/main/browser/browser-cookie-import-partition.electron.test.ts": 606,
-      "src/main/browser/browser-cookie-import-plan-writes.test.ts": 19,
-      "src/main/browser/browser-cookie-import-policy.test.ts": 127,
-      "src/main/browser/browser-cookie-import-replace-partition-rollback.electron.test.ts": 1412,
-      "src/main/browser/browser-cookie-import-replacement.test.ts": 72,
-      "src/main/browser/browser-cookie-import-route-partition-staging.test.ts": 51,
-      "src/main/browser/browser-cookie-import-scope.test.ts": 72,
-      "src/main/browser/browser-cookie-import-undecryptable.test.ts": 285,
-      "src/main/browser/browser-cookie-import-validated-partition.electron.test.ts": 594,
-      "src/main/browser/browser-cookie-import-write.test.ts": 11,
-      "src/main/browser/browser-cookie-import.comet.test.ts": 427,
-      "src/main/browser/browser-cookie-import.helium.test.ts": 358,
-      "src/main/browser/browser-cookie-import.test.ts": 1644,
-      "src/main/browser/browser-cookie-registrable-family.test.ts": 19,
-      "src/main/browser/browser-cookie-samesite.electron.test.ts": 714,
-      "src/main/browser/browser-cookie-source-partition.test.ts": 8,
-      "src/main/browser/browser-cookie-validation.test.ts": 7,
-      "src/main/browser/browser-download-destination.test.ts": 15,
-      "src/main/browser/browser-execution-host-storage-identity.test.ts": 10,
-      "src/main/browser/browser-google-auth-ua.test.ts": 7,
-      "src/main/browser/browser-grab-payload.test.ts": 13,
-      "src/main/browser/browser-guest-shortcut-forwarding.test.ts": 31,
-      "src/main/browser/browser-guest-wheel-zoom-scroll.test.ts": 6,
-      "src/main/browser/browser-host-client-identity.test.ts": 30,
-      "src/main/browser/browser-host-lease-reconnect-delay.test.ts": 6,
-      "src/main/browser/browser-manager-annotation-bridge.test.ts": 16,
-      "src/main/browser/browser-manager-auth-user-agent.test.ts": 19,
-      "src/main/browser/browser-manager-client-hosted-downloads.test.ts": 135,
-      "src/main/browser/browser-manager-downloads.test.ts": 40,
-      "src/main/browser/browser-manager-grab-capture.test.ts": 13,
-      "src/main/browser/browser-manager-grab-mode.test.ts": 16,
-      "src/main/browser/browser-manager-grab-selection.test.ts": 37,
-      "src/main/browser/browser-manager-grab-shortcuts.test.ts": 14,
-      "src/main/browser/browser-manager-guest-lifecycle.test.ts": 33,
-      "src/main/browser/browser-manager-guest-policy-profile.test.ts": 11,
-      "src/main/browser/browser-manager-guest-shortcuts.test.ts": 26,
-      "src/main/browser/browser-manager-guest-visibility.test.ts": 16,
-      "src/main/browser/browser-manager-load-failure-replay.test.ts": 29,
-      "src/main/browser/browser-manager-popup-child.test.ts": 19,
-      "src/main/browser/browser-manager-popup-routing.test.ts": 77,
-      "src/main/browser/browser-manager-viewport-override.test.ts": 45,
-      "src/main/browser/browser-manager-viewport-partial-failure.test.ts": 13,
-      "src/main/browser/browser-network-deferred-socket.test.ts": 6,
-      "src/main/browser/browser-network-execution-route.test.ts": 14,
-      "src/main/browser/browser-network-tunnel-client-memory-budget.test.ts": 13,
-      "src/main/browser/browser-network-tunnel-client.test.ts": 36,
-      "src/main/browser/browser-network-tunnel-conformance.test.ts": 56,
-      "src/main/browser/browser-network-tunnel-outbound-memory-budget.test.ts": 7,
-      "src/main/browser/browser-network-tunnel-session-aggregate-memory.test.ts": 6,
-      "src/main/browser/browser-network-tunnel-session-stream-scoped-failure.test.ts": 26,
-      "src/main/browser/browser-network-tunnel-session.test.ts": 57,
-      "src/main/browser/browser-page-initiated-tab-budget.test.ts": 5,
-      "src/main/browser/browser-route-dns-prefetch.electron.test.ts": 4337,
-      "src/main/browser/browser-route-guest-popups.test.ts": 14,
-      "src/main/browser/browser-route-h3-egress.electron.test.ts": 13849,
-      "src/main/browser/browser-route-identity.test.ts": 8,
-      "src/main/browser/browser-route-partition-binding-capacity.test.ts": 27,
-      "src/main/browser/browser-route-partition-binding-store.test.ts": 42,
-      "src/main/browser/browser-route-partition-migration.test.ts": 261,
-      "src/main/browser/browser-route-partition-stability.test.ts": 30,
-      "src/main/browser/browser-route-partition-storage-lifecycle.test.ts": 33,
-      "src/main/browser/browser-route-partition-storage-retirement.test.ts": 14,
-      "src/main/browser/browser-route-partition-storage-runtime.test.ts": 10,
-      "src/main/browser/browser-route-persisted-worker-egress.electron.test.ts": 1471,
-      "src/main/browser/browser-route-prepared-page-rekey.test.ts": 9,
-      "src/main/browser/browser-route-session-registry.test.ts": 30,
-      "src/main/browser/browser-route-tcp-egress.electron.test.ts": 1082,
-      "src/main/browser/browser-route-webcontents-registry.test.ts": 43,
-      "src/main/browser/browser-route-webrtc-egress.electron.test.ts": 8203,
-      "src/main/browser/browser-screencast-lifecycle.test.ts": 16,
-      "src/main/browser/browser-screencast-snapshot-scaling.test.ts": 116,
-      "src/main/browser/browser-screencast-stream.test.ts": 549,
-      "src/main/browser/browser-session-cookie-staging.scoped.test.ts": 105,
-      "src/main/browser/browser-session-cookie-staging.test.ts": 8,
-      "src/main/browser/browser-session-partition-policies.test.ts": 36,
-      "src/main/browser/browser-session-partition-proxy-install.test.ts": 222,
-      "src/main/browser/browser-session-proxy.test.ts": 171,
-      "src/main/browser/browser-session-registry.persistence.test.ts": 550,
-      "src/main/browser/browser-session-registry.test.ts": 497,
-      "src/main/browser/browser-session-startup.test.ts": 33,
-      "src/main/browser/browser-session-ua-wire-identity.electron.test.ts": 2126,
-      "src/main/browser/browser-text-insertion.test.ts": 19,
-      "src/main/browser/browser-viewport-user-agent.test.ts": 9,
-      "src/main/browser/browser-webauthn-access.test.ts": 7,
-      "src/main/browser/browser-webauthn-account-picker.test.ts": 15,
-      "src/main/browser/browser-webauthn-profile-delete.test.ts": 64,
-      "src/main/browser/cdp-bridge-integration.test.ts": 3216,
-      "src/main/browser/cdp-bridge-state.test.ts": 26,
-      "src/main/browser/cdp-print-to-pdf.test.ts": 22,
-      "src/main/browser/cdp-screenshot.test.ts": 16,
-      "src/main/browser/cdp-ws-proxy-focus-replay.test.ts": 199,
-      "src/main/browser/cdp-ws-proxy.test.ts": 2405,
-      "src/main/browser/chromium-cookie-snapshot.test.ts": 279,
-      "src/main/browser/client-route-cookie-import-source-store.test.ts": 51,
-      "src/main/browser/doc-preview-download-block-notice.test.ts": 15,
-      "src/main/browser/doc-preview-failure-notice.test.ts": 7,
-      "src/main/browser/doc-preview-file-reader.test.ts": 31,
-      "src/main/browser/doc-preview-grant-registry.test.ts": 12,
-      "src/main/browser/doc-preview-guest-policy.test.ts": 46,
-      "src/main/browser/doc-preview-protocol.test.ts": 48,
-      "src/main/browser/electron-debugger-lease.test.ts": 4,
-      "src/main/browser/electron-probe-display-launch.test.ts": 8,
-      "src/main/browser/execution-route-socket-duplex.test.ts": 42,
-      "src/main/browser/grab-guest-script.test.ts": 29,
-      "src/main/browser/local-ssh-browser-partition-identity.test.ts": 11,
-      "src/main/browser/local-ssh-browser-partitions.probe-cache.test.ts": 7,
-      "src/main/browser/local-ssh-browser-route.test.ts": 40,
-      "src/main/browser/offscreen-browser-backend-lifecycle.test.ts": 67,
-      "src/main/browser/offscreen-browser-backend.web-preferences.test.ts": 7,
-      "src/main/browser/paired-runtime-browser-client-host-composition.test.ts": 51,
-      "src/main/browser/paired-runtime-browser-client-host-identity-wiring.test.ts": 732,
-      "src/main/browser/paired-runtime-browser-client-host-reconnect.test.ts": 274,
-      "src/main/browser/paired-runtime-browser-client-host-registry.test.ts": 13,
-      "src/main/browser/paired-runtime-browser-client-host-route-identity.test.ts": 60,
-      "src/main/browser/paired-runtime-browser-client-host-runtime.test.ts": 7,
-      "src/main/browser/paired-runtime-browser-client-host.test.ts": 95,
-      "src/main/browser/paired-runtime-browser-host-command-admission.test.ts": 24,
-      "src/main/browser/paired-runtime-browser-host-lease-reconnect.test.ts": 708,
-      "src/main/browser/paired-runtime-browser-host-lease.test.ts": 692,
-      "src/main/browser/paired-runtime-browser-host-reconciliation-negotiation.test.ts": 66,
-      "src/main/browser/paired-runtime-browser-network-route.test.ts": 1007,
-      "src/main/browser/popup-origin-bar-window.test.ts": 19,
-      "src/main/browser/remote-browser-socks-buffering.test.ts": 1148,
-      "src/main/browser/remote-browser-socks-server.test.ts": 296,
-      "src/main/browser/snapshot-engine.test.ts": 13,
-      "src/main/browser/ssh-browser-network-execution-route.test.ts": 175,
-      "src/main/browser/system-ssh-socks-client-socket.test.ts": 16,
-      "src/main/browser/wsl-browser-network-execution-route.test.ts": 128,
-      "src/main/browser/wsl-browser-network-relay-launch.test.ts": 23,
-      "src/main/claude-accounts/claude-account-service-account-selection.test.ts": 134,
-      "src/main/claude-accounts/claude-account-service-add-account.test.ts": 91,
-      "src/main/claude-accounts/claude-account-service-api-parity.test.ts": 65,
-      "src/main/claude-accounts/claude-account-service-config-dir-capture.test.ts": 157,
-      "src/main/claude-accounts/claude-account-service-credential-capture.test.ts": 94,
-      "src/main/claude-accounts/claude-account-service-login-process.test.ts": 480,
-      "src/main/claude-accounts/claude-account-service-reauth-rollback.test.ts": 193,
-      "src/main/claude-accounts/claude-duplicate-account.test.ts": 4,
-      "src/main/claude-accounts/claude-login-completion.oracle.test.ts": 105,
-      "src/main/claude-accounts/claude-structured-auth-policy.test.ts": 8,
-      "src/main/claude-accounts/claude-windows-interactive-login.test.ts": 75,
-      "src/main/claude-accounts/keychain.test.ts": 13,
-      "src/main/claude-accounts/live-pty-gate.test.ts": 13,
-      "src/main/claude-accounts/oauth-refresh.test.ts": 20,
-      "src/main/claude-accounts/runtime-auth-service-account-switching.test.ts": 147,
-      "src/main/claude-accounts/runtime-auth-service-deselect-restore.test.ts": 284,
-      "src/main/claude-accounts/runtime-auth-service-keychain-snapshots.test.ts": 431,
-      "src/main/claude-accounts/runtime-auth-service-launch-refresh.test.ts": 159,
-      "src/main/claude-accounts/runtime-auth-service-materialization.test.ts": 226,
-      "src/main/claude-accounts/runtime-auth-service-readback-identity.test.ts": 298,
-      "src/main/claude-accounts/runtime-auth-service-snapshot-validation.test.ts": 319,
-      "src/main/claude-accounts/runtime-auth-service-wsl-runtime.test.ts": 197,
-      "src/main/claude-accounts/runtime-selection.test.ts": 4,
-      "src/main/claude-accounts/windows-command-invocation.test.ts": 8,
-      "src/main/claude-usage/claude-model-pricing.test.ts": 12,
-      "src/main/claude-usage/claude-usage-report-aggregation.test.ts": 6,
-      "src/main/claude-usage/scanner-large-directory.test.ts": 530,
-      "src/main/claude-usage/scanner-scan.test.ts": 114,
-      "src/main/claude-usage/scanner.test.ts": 31,
-      "src/main/claude-usage/store.test.ts": 35,
-      "src/main/claude-usage/transcript-record-parser-prefilter.test.ts": 5,
-      "src/main/claude-usage/worktree-attribution-scaling.test.ts": 13,
-      "src/main/claude/claude-agent-sdk-contract-pins.test.ts": 2683,
-      "src/main/claude/claude-agent-sdk-control-requests.test.ts": 10,
-      "src/main/claude/claude-agent-sdk-exit-proof-identity.test.ts": 7,
-      "src/main/claude/claude-agent-sdk-exit-proof.test.ts": 12842,
-      "src/main/claude/claude-agent-sdk-import-boundary.test.ts": 951,
-      "src/main/claude/claude-agent-sdk-process-spawn.test.ts": 13,
-      "src/main/claude/claude-agent-sdk-root-kill-fallback.test.ts": 15,
-      "src/main/claude/claude-agent-sdk-user-message-queue.test.ts": 109,
-      "src/main/claude/claude-background-task-resume.test.ts": 14,
-      "src/main/claude/claude-background-task-tracker.test.ts": 93,
-      "src/main/claude/claude-child-process-environment.test.ts": 4,
-      "src/main/claude/claude-command-lifecycle-frames.test.ts": 7,
-      "src/main/claude/claude-config-dir-pin.test.ts": 6,
-      "src/main/claude/claude-descendant-escalation-boundary.test.ts": 462,
-      "src/main/claude/claude-slash-command-catalog.test.ts": 10,
-      "src/main/claude/claude-stream-json-connection-close.test.ts": 140,
-      "src/main/claude/claude-stream-json-connection.test.ts": 22607,
-      "src/main/claude/claude-streamed-text-checkpoints.test.ts": 9,
-      "src/main/claude/claude-structured-auth-parity.test.ts": 100,
-      "src/main/claude/claude-structured-compaction.test.ts": 10,
-      "src/main/claude/claude-structured-content-parts.test.ts": 18,
-      "src/main/claude/claude-structured-control-actions.test.ts": 12,
-      "src/main/claude/claude-structured-dispatch-admission.test.ts": 15,
-      "src/main/claude/claude-structured-dispatch-content.test.ts": 10,
-      "src/main/claude/claude-structured-dispatch.test.ts": 1411,
-      "src/main/claude/claude-structured-effort-reporting.test.ts": 27,
-      "src/main/claude/claude-structured-inbound-control.test.ts": 15,
-      "src/main/claude/claude-structured-journal-translation-subagents.test.ts": 23,
-      "src/main/claude/claude-structured-journal-translation-turn-timing.test.ts": 22,
-      "src/main/claude/claude-structured-journal-translation.test.ts": 63,
-      "src/main/claude/claude-structured-launch-resolution.test.ts": 28,
-      "src/main/claude/claude-structured-location-support.test.ts": 6,
-      "src/main/claude/claude-structured-model-confirmation.test.ts": 18,
-      "src/main/claude/claude-structured-option-confirmation.test.ts": 16,
-      "src/main/claude/claude-structured-options.test.ts": 8,
-      "src/main/claude/claude-structured-owner-identity.test.ts": 10,
-      "src/main/claude/claude-structured-prompt-items.test.ts": 11,
-      "src/main/claude/claude-structured-provider-fallback.test.ts": 25,
-      "src/main/claude/claude-structured-rewind.test.ts": 25,
-      "src/main/claude/claude-structured-session-acquisition-processless.test.ts": 8,
-      "src/main/claude/claude-structured-session-adapter-turns.test.ts": 25,
-      "src/main/claude/claude-structured-session-adapter.test.ts": 63,
-      "src/main/claude/claude-structured-session-close.test.ts": 26,
-      "src/main/claude/claude-structured-session-commands.test.ts": 10,
-      "src/main/claude/claude-structured-session-recovery.test.ts": 47,
-      "src/main/claude/claude-subagent-group-row.test.ts": 6,
-      "src/main/claude/claude-subagent-id-aliases.test.ts": 7,
-      "src/main/claude/claude-subagent-roster.test.ts": 22,
-      "src/main/claude/claude-subagent-task-frames.test.ts": 12,
-      "src/main/claude/claude-transcript-rewind-proof.test.ts": 10,
-      "src/main/claude/claude-tui-exit.test.ts": 18,
-      "src/main/claude/claude-tui-resume-launch.test.ts": 10,
-      "src/main/claude/claude-tui-resume-proof.test.ts": 9,
-      "src/main/claude/compact-status-registration.test.ts": 27,
-      "src/main/claude/hook-service.test.ts": 58,
-      "src/main/claude/statusline-script.test.ts": 186,
-      "src/main/cli/appimage-extracted-root.test.ts": 148,
-      "src/main/cli/appimage-extraction-pruning.test.ts": 37,
-      "src/main/cli/appimage-payload-removal.reentrancy.test.ts": 12,
-      "src/main/cli/appimage-payload-removal.test.ts": 13,
-      "src/main/cli/appimage-registration-lock.test.ts": 31,
-      "src/main/cli/appimage-stable-launcher.test.ts": 158,
-      "src/main/cli/cli-command-installation-races.test.ts": 78,
-      "src/main/cli/cli-installer-appimage-ownership.test.ts": 104,
-      "src/main/cli/cli-installer-appimage-removal.test.ts": 93,
-      "src/main/cli/cli-installer-command-conflicts.test.ts": 65,
-      "src/main/cli/cli-installer-macos-command-path.test.ts": 84,
-      "src/main/cli/cli-installer-windows-path.test.ts": 59,
-      "src/main/cli/cli-installer.test.ts": 153,
-      "src/main/cli/cli-privileged-processes.test.ts": 10,
-      "src/main/cli/keyed-promise-queue.test.ts": 8,
-      "src/main/cli/legacy-appimage-cli-wrapper.test.ts": 5,
-      "src/main/cli/linux-bare-orca-dispatcher.test.ts": 51,
-      "src/main/cli/linux-terminal-orca-cli-shim.test.ts": 75,
-      "src/main/cli/orca-cli-child-path.test.ts": 14,
-      "src/main/cli/packaged-cli-assets.test.ts": 492,
-      "src/main/cli/windows-launcher-asset.test.ts": 7,
-      "src/main/cli/windows-user-path-registry.test.ts": 10,
-      "src/main/cli/wsl-cli-installer.test.ts": 52,
-      "src/main/cli/wsl-cli-powershell-boundary.test.ts": 6,
-      "src/main/cli/wsl-cli-registration-operation.test.ts": 63,
-      "src/main/cli/wsl-cli-registration-reconciliation.test.ts": 13,
-      "src/main/cli/wsl-cli-registration-registry.test.ts": 84,
-      "src/main/codex-accounts/codex-account-identity-api-key-guard.test.ts": 7,
-      "src/main/codex-accounts/codex-auth-workspace-identity.test.ts": 15,
-      "src/main/codex-accounts/codex-credential-absence-grace.test.ts": 9,
-      "src/main/codex-accounts/codex-windows-interactive-login.test.ts": 234,
-      "src/main/codex-accounts/fs-utils.test.ts": 69,
-      "src/main/codex-accounts/host-codex-managed-home-ownership.test.ts": 12,
-      "src/main/codex-accounts/legacy-shared-auth-migration.test.ts": 62,
-      "src/main/codex-accounts/legacy-shared-config-compatibility.test.ts": 20,
-      "src/main/codex-accounts/legacy-wsl-runtime-auth-drain-apply-script.test.ts": 11759,
-      "src/main/codex-accounts/legacy-wsl-runtime-auth-drain-rollback-script.test.ts": 400,
-      "src/main/codex-accounts/legacy-wsl-runtime-auth-drain.test.ts": 23,
-      "src/main/codex-accounts/managed-codex-auth-readiness.test.ts": 36,
-      "src/main/codex-accounts/runtime-home-legacy-migration.test.ts": 381,
-      "src/main/codex-accounts/runtime-home-managed-auth-recovery.test.ts": 217,
-      "src/main/codex-accounts/runtime-home-mirrored-status-home.test.ts": 163,
-      "src/main/codex-accounts/runtime-home-per-account-homes.test.ts": 440,
-      "src/main/codex-accounts/runtime-home-real-home-lane-routing.test.ts": 278,
-      "src/main/codex-accounts/runtime-home-resume-selection-gate.test.ts": 119,
-      "src/main/codex-accounts/runtime-home-retained-auth-provenance.test.ts": 657,
-      "src/main/codex-accounts/runtime-home-service-per-account-migration.test.ts": 278,
-      "src/main/codex-accounts/runtime-home-session-migration-pass.test.ts": 282,
-      "src/main/codex-accounts/runtime-home-system-default-mirror-readback.test.ts": 709,
-      "src/main/codex-accounts/runtime-home-system-default-snapshot.test.ts": 618,
-      "src/main/codex-accounts/runtime-home-system-resource-materialization.test.ts": 216,
-      "src/main/codex-accounts/runtime-home-windows-profile-ownership.test.ts": 3,
-      "src/main/codex-accounts/runtime-home-wsl-managed-accounts.test.ts": 742,
-      "src/main/codex-accounts/runtime-home-wsl-session-bridge.test.ts": 393,
-      "src/main/codex-accounts/runtime-home-wsl-system-default.test.ts": 408,
-      "src/main/codex-accounts/runtime-selection.test.ts": 6,
-      "src/main/codex-accounts/service-account-add-login.test.ts": 289,
-      "src/main/codex-accounts/service-account-selection-and-removal.test.ts": 614,
-      "src/main/codex-accounts/service-add-account-from-home.test.ts": 177,
-      "src/main/codex-accounts/service-login-process-teardown.test.ts": 166,
-      "src/main/codex-accounts/service-managed-home-removal-retries.test.ts": 165,
-      "src/main/codex-accounts/service-quota-refresh-decoupling.test.ts": 174,
-      "src/main/codex-accounts/service-reauthenticate-activation.test.ts": 129,
-      "src/main/codex-accounts/service-reset-credit-durability.test.ts": 449,
-      "src/main/codex-accounts/service-reset-credit-home-ownership.test.ts": 175,
-      "src/main/codex-accounts/service-reset-credit-target-routing.test.ts": 339,
-      "src/main/codex-accounts/service-system-default-identity.test.ts": 207,
-      "src/main/codex-accounts/service-wsl-accounts.test.ts": 298,
-      "src/main/codex-accounts/service.test.ts": 181,
-      "src/main/codex-accounts/sta-4422-transient-ownership-error.test.ts": 209,
-      "src/main/codex-accounts/sta-4734-login-rollback-deletes-authenticated-home.test.ts": 376,
-      "src/main/codex-accounts/sta-4735-unreadable-host-lane-writes.test.ts": 145,
-      "src/main/codex-accounts/wsl-codex-command.test.ts": 8,
-      "src/main/codex-cli/codex-home-process-lock.test.ts": 15,
-      "src/main/codex-cli/command.test.ts": 39,
-      "src/main/codex-usage/scanner-large-directory.test.ts": 1093,
-      "src/main/codex-usage/scanner-paths.test.ts": 64,
-      "src/main/codex-usage/scanner.test.ts": 10,
-      "src/main/codex-usage/store-automation-usage.test.ts": 12,
-      "src/main/codex-usage/store-model-pricing.test.ts": 17,
-      "src/main/codex-usage/store-orca-scope.test.ts": 17,
-      "src/main/codex-usage/store-persistence.test.ts": 20,
-      "src/main/codex-usage/store-snapshot.benchmark.test.ts": 152,
-      "src/main/codex/codex-account-session-bridge.test.ts": 47,
-      "src/main/codex/codex-ai-vault-session-resume.test.ts": 14,
-      "src/main/codex/codex-app-server-capability-cache.test.ts": 11,
-      "src/main/codex/codex-app-server-client.test.ts": 1418,
-      "src/main/codex/codex-app-server-connection.test.ts": 5017,
-      "src/main/codex/codex-app-server-posix-supervisor.test.ts": 9,
-      "src/main/codex/codex-app-server-process-teardown.test.ts": 26,
-      "src/main/codex/codex-app-server-session.test.ts": 116,
-      "src/main/codex/codex-app-server-teardown.integration.test.ts": 17565,
-      "src/main/codex/codex-background-command-tracker.test.ts": 19,
-      "src/main/codex/codex-background-task-tracker.test.ts": 38,
-      "src/main/codex/codex-config-mirror.test.ts": 96,
-      "src/main/codex/codex-config-settings-removal.test.ts": 5,
-      "src/main/codex/codex-goal-journal-rows.test.ts": 14,
-      "src/main/codex/codex-home-paths.test.ts": 31,
-      "src/main/codex/codex-hook-legacy-profile-block.test.ts": 8,
-      "src/main/codex/codex-hook-trust-grant.test.ts": 241,
-      "src/main/codex/codex-hooks-read-denial-followup.test.ts": 116,
-      "src/main/codex/codex-legacy-session-resume.test.ts": 69,
-      "src/main/codex/codex-model-provider-config.test.ts": 9,
-      "src/main/codex/codex-notice-item-translation.test.ts": 13,
-      "src/main/codex/codex-pane-account-registry-mutations.test.ts": 14,
-      "src/main/codex/codex-pane-launch-account.test.ts": 8,
-      "src/main/codex/codex-persistent-command-retention.test.ts": 226,
-      "src/main/codex/codex-real-home-hook-install.test.ts": 70,
-      "src/main/codex/codex-real-home-path.test.ts": 7,
-      "src/main/codex/codex-requested-close-turn-timing.test.ts": 15,
-      "src/main/codex/codex-resume-process-proof.test.ts": 20,
-      "src/main/codex/codex-rollout-session-meta.test.ts": 21,
-      "src/main/codex/codex-server-request-disposition.test.ts": 21,
-      "src/main/codex/codex-session-backfill-marker.test.ts": 29,
-      "src/main/codex/codex-session-backfill-scan-dates.test.ts": 27,
-      "src/main/codex/codex-session-backfill.test.ts": 408,
-      "src/main/codex/codex-session-bridge.test.ts": 66,
-      "src/main/codex/codex-session-index-heal-state.test.ts": 369,
-      "src/main/codex/codex-session-index-heal.test.ts": 1379,
-      "src/main/codex/codex-session-migration-recent-exits.test.ts": 13,
-      "src/main/codex/codex-session-migration-scheduler.test.ts": 369,
-      "src/main/codex/codex-session-resume-home.test.ts": 22,
-      "src/main/codex/codex-session-resume-preparation.test.ts": 13,
-      "src/main/codex/codex-session-resume-wrong-account.test.ts": 24,
-      "src/main/codex/codex-session-source-home.test.ts": 5,
-      "src/main/codex/codex-stale-pane-accounts.test.ts": 95,
-      "src/main/codex/codex-state-db-backfill-recovery.test.ts": 147,
-      "src/main/codex/codex-state-db.test.ts": 27,
-      "src/main/codex/codex-structured-acquisition-exit-proof.test.ts": 11,
-      "src/main/codex/codex-structured-app-server-args.test.ts": 7,
-      "src/main/codex/codex-structured-child-environment.test.ts": 8,
-      "src/main/codex/codex-structured-item-translation.test.ts": 50,
-      "src/main/codex/codex-structured-journal-compactions.test.ts": 16,
-      "src/main/codex/codex-structured-journal-goal-admission.test.ts": 33,
-      "src/main/codex/codex-structured-journal-goal-resume.test.ts": 125,
-      "src/main/codex/codex-structured-journal-goal-rows.test.ts": 16,
-      "src/main/codex/codex-structured-journal-translation-settlement.test.ts": 843,
-      "src/main/codex/codex-structured-journal-translation-streams.test.ts": 85,
-      "src/main/codex/codex-structured-journal-translation-subagents.test.ts": 26,
-      "src/main/codex/codex-structured-journal-translation-turn-lifecycle.test.ts": 60,
-      "src/main/codex/codex-structured-journal-translation-turn-state.test.ts": 12,
-      "src/main/codex/codex-structured-journal-translation.test.ts": 96,
-      "src/main/codex/codex-structured-launch-resolution.test.ts": 17,
-      "src/main/codex/codex-structured-location-support.test.ts": 3,
-      "src/main/codex/codex-structured-owner-identity.test.ts": 9,
-      "src/main/codex/codex-structured-prompt-items.test.ts": 39,
-      "src/main/codex/codex-structured-prompt-replies.test.ts": 40,
-      "src/main/codex/codex-structured-rewind.test.ts": 34,
-      "src/main/codex/codex-structured-session-adapter-lifecycle.test.ts": 19,
-      "src/main/codex/codex-structured-session-adapter.test.ts": 37,
-      "src/main/codex/codex-structured-session-background-tasks.test.ts": 76,
-      "src/main/codex/codex-structured-session-cancel.test.ts": 164,
-      "src/main/codex/codex-structured-session-close.test.ts": 20,
-      "src/main/codex/codex-structured-session-options.test.ts": 12,
-      "src/main/codex/codex-structured-session-shutdown.test.ts": 62,
-      "src/main/codex/codex-structured-thread-open.test.ts": 19,
-      "src/main/codex/codex-structured-turn-processes.integration.test.ts": 85,
-      "src/main/codex/codex-subagent-execution-projection.test.ts": 16,
-      "src/main/codex/codex-subagent-executions.test.ts": 21,
-      "src/main/codex/codex-subagent-roster.test.ts": 40,
-      "src/main/codex/codex-tool-identity-translation.test.ts": 14,
-      "src/main/codex/codex-trust-config-concurrent-launch.test.ts": 70,
-      "src/main/codex/codex-trust-config-mutation-queue.test.ts": 10,
-      "src/main/codex/codex-trust-config-rollback.test.ts": 16,
-      "src/main/codex/codex-trust-grant-host.test.ts": 12,
-      "src/main/codex/codex-trust-grant-ledger.test.ts": 8,
-      "src/main/codex/codex-trust-grant-main-thread-boundary.test.ts": 15,
-      "src/main/codex/codex-trust-grant-telemetry.test.ts": 8,
-      "src/main/codex/codex-tui-rollout-proof.test.ts": 33,
-      "src/main/codex/codex-turn-ordinals.test.ts": 45,
-      "src/main/codex/codex-user-hook-trust-rebase-client.test.ts": 13,
-      "src/main/codex/codex-user-hook-trust-rebase.test.ts": 17,
-      "src/main/codex/codex-wsl-hook-install-plan.test.ts": 11,
-      "src/main/codex/config-plugin-registration-promotion.test.ts": 193,
-      "src/main/codex/config-settings-baseline-upgrade.test.ts": 61,
-      "src/main/codex/config-settings-promotion.test.ts": 227,
-      "src/main/codex/config-sync-stall.test.ts": 47,
-      "src/main/codex/config-toml-hook-trust-scaling.test.ts": 38,
-      "src/main/codex/config-toml-trust-api-parity.test.ts": 13,
-      "src/main/codex/config-toml-trust-hash.test.ts": 7,
-      "src/main/codex/config-toml-trust-hook-read.test.ts": 16,
-      "src/main/codex/config-toml-trust-hook-removal.test.ts": 26,
-      "src/main/codex/config-toml-trust-hook-upsert.test.ts": 44,
-      "src/main/codex/config-toml-trust-key.test.ts": 10,
-      "src/main/codex/config-toml-trust-paths.test.ts": 10,
-      "src/main/codex/config-toml-trust-project.test.ts": 27,
-      "src/main/codex/hook-service-concurrent-launch-install.test.ts": 618,
-      "src/main/codex/hook-service-legacy-cleanup.test.ts": 601,
-      "src/main/codex/hook-service-managed-install.test.ts": 99,
-      "src/main/codex/hook-service-runtime-trust-repair.test.ts": 117,
-      "src/main/codex/hook-service-trust-grant.test.ts": 123,
-      "src/main/codex/hook-service-user-hook-mirroring.test.ts": 186,
-      "src/main/codex/hook-service-wsl-runtime.test.ts": 113,
-      "src/main/codex/hook-trust-promotion.test.ts": 225,
-      "src/main/codex/managed-home-shell-preflight.test.ts": 28,
-      "src/main/codex/retained-codex-hook-state.test.ts": 8,
-      "src/main/codex/sta-4735-hook-trust-provenance-overwrite.test.ts": 12,
-      "src/main/codex/sta-4737-unreadable-is-not-absent.test.ts": 58,
-      "src/main/codex/sta-4823-shared-state-survives-a-failed-read.test.ts": 94,
-      "src/main/codex/wsl-codex-session-bridge.test.ts": 82,
-      "src/main/command-code/hook-service.test.ts": 239,
-      "src/main/computer/computer-action-verification-normalization.test.ts": 4,
-      "src/main/computer/computer-provider-lifecycle.test.ts": 5,
-      "src/main/computer/computer-provider-unavailable-message.test.ts": 3,
-      "src/main/computer/computer-sidecar-diagnostics.test.ts": 8,
-      "src/main/computer/desktop-script-provider-action-errors.test.ts": 68,
-      "src/main/computer/desktop-script-provider-actions.test.ts": 131,
-      "src/main/computer/desktop-script-provider-bridge.test.ts": 6,
-      "src/main/computer/desktop-script-provider-cache-lifecycle.test.ts": 96,
-      "src/main/computer/desktop-script-provider-cache.test.ts": 115,
-      "src/main/computer/desktop-script-provider-client.test.ts": 154,
-      "src/main/computer/desktop-script-provider-errors.test.ts": 161,
-      "src/main/computer/desktop-script-provider-paste-validation.test.ts": 105,
-      "src/main/computer/desktop-script-provider-runtime-host-routing.test.ts": 44,
-      "src/main/computer/desktop-script-runtime-host.test.ts": 106,
-      "src/main/computer/desktop-script-serve-channel.test.ts": 9,
-      "src/main/computer/macos-computer-use-permission-status.test.ts": 38,
-      "src/main/computer/macos-computer-use-permissions.test.ts": 24,
-      "src/main/computer/macos-native-provider-client.test.ts": 557,
-      "src/main/computer/macos-native-provider-paste-validation.test.ts": 99,
-      "src/main/computer/macos-native-provider-socket.test.ts": 14,
-      "src/main/computer/sidecar-client.test.ts": 28,
-      "src/main/computer/windows-powershell-execution-policy.test.ts": 7,
-      "src/main/copilot/hook-service.test.ts": 83,
-      "src/main/crash-reporting/crash-breadcrumb-renderer-attribution.test.ts": 29,
-      "src/main/crash-reporting/crash-breadcrumb-store-leak.test.ts": 60,
-      "src/main/crash-reporting/crash-breadcrumb-store-orphan-cleanup.test.ts": 45,
-      "src/main/crash-reporting/crash-breadcrumb-store.test.ts": 34,
-      "src/main/crash-reporting/crash-report-copy-text.test.ts": 8,
-      "src/main/crash-reporting/crash-report-store.test.ts": 351,
-      "src/main/crash-reporting/crashpad-capture.test.ts": 60,
-      "src/main/crash-reporting/durable-crash-breadcrumb.test.ts": 11,
-      "src/main/crash-reporting/expected-teardown-state.test.ts": 9,
-      "src/main/crash-reporting/gpu-crash-diagnostics.test.ts": 14,
-      "src/main/crash-reporting/gpu-crash-fallback-decision.test.ts": 13,
-      "src/main/crash-reporting/gpu-crash-fallback-field-sessions.test.ts": 9,
-      "src/main/crash-reporting/gpu-fallback-engagement.test.ts": 14,
-      "src/main/crash-reporting/gpu-fallback-recovered-launch.test.ts": 10,
-      "src/main/crash-reporting/gpu-fallback-restart-prompt.test.ts": 8,
-      "src/main/crash-reporting/main-process-lifecycle-identity.test.ts": 6,
-      "src/main/crash-reporting/minidump-crash-signature.test.ts": 30,
-      "src/main/crash-reporting/pre-gone-host-memory.test.ts": 18,
-      "src/main/crash-reporting/process-gone-classification.test.ts": 12,
-      "src/main/crash-reporting/process-gone-dedupe.test.ts": 6,
-      "src/main/crash-reporting/process-gone-diagnostics.test.ts": 19,
-      "src/main/crash-reporting/process-gone-killed-one-ordering.test.ts": 40,
-      "src/main/crash-reporting/process-gone-recorder.test.ts": 599,
-      "src/main/crash-reporting/process-gone-sibling-correlation.test.ts": 514,
-      "src/main/crash-reporting/renderer-recovery-circuit-breaker.test.ts": 10,
-      "src/main/crash-reporting/self-initiated-tree-kill-log.test.ts": 26,
-      "src/main/crash-reporting/suppressed-process-gone-breadcrumb.test.ts": 5,
-      "src/main/cursor/hook-service.test.ts": 173,
-      "src/main/daemon/agent-startup-prompt-latency.node-pty.test.ts": 1916,
-      "src/main/daemon/bash-prompt-command-composition.test.ts": 3541,
-      "src/main/daemon/client.test.ts": 392,
-      "src/main/daemon/cold-restore-payload-cache.test.ts": 9,
-      "src/main/daemon/daemon-adoption-telemetry-event.test.ts": 18,
-      "src/main/daemon/daemon-audit-eligibility-event.test.ts": 30,
-      "src/main/daemon/daemon-authenticated-client-activity.test.ts": 16,
-      "src/main/daemon/daemon-background-transient-facts.test.ts": 12,
-      "src/main/daemon/daemon-bundle-staleness.test.ts": 347,
-      "src/main/daemon/daemon-checkpoint-session-queue.test.ts": 204,
-      "src/main/daemon/daemon-client-notify-settlement.test.ts": 10,
-      "src/main/daemon/daemon-client-rpc-request.test.ts": 20,
-      "src/main/daemon/daemon-durable-history-ownership-seed.test.ts": 25,
-      "src/main/daemon/daemon-endpoint-ownership.test.ts": 26,
-      "src/main/daemon/daemon-endpoint-publish.test.ts": 92,
-      "src/main/daemon/daemon-endpoint-windows.test.ts": 8,
-      "src/main/daemon/daemon-entry-path-layouts.test.ts": 319,
-      "src/main/daemon/daemon-entry.test.ts": 15,
-      "src/main/daemon/daemon-errors.test.ts": 7,
-      "src/main/daemon/daemon-file-log.test.ts": 25,
-      "src/main/daemon/daemon-foreground-confirmation-protocol.test.ts": 7,
-      "src/main/daemon/daemon-health-endpoint-entry.test.ts": 9,
-      "src/main/daemon/daemon-health-socket-cleanup.test.ts": 16,
-      "src/main/daemon/daemon-health.test.ts": 3195,
-      "src/main/daemon/daemon-host-relocation.test.ts": 140,
-      "src/main/daemon/daemon-idle-shutdown.test.ts": 204,
-      "src/main/daemon/daemon-incarnation-evidence-main-thread.test.ts": 13,
-      "src/main/daemon/daemon-incarnation-evidence.test.ts": 23,
-      "src/main/daemon/daemon-init-child-readiness.test.ts": 406,
-      "src/main/daemon/daemon-init-child-startup-failure.test.ts": 406,
-      "src/main/daemon/daemon-init-endpoint-adoption.test.ts": 868,
-      "src/main/daemon/daemon-init-live-session-preservation.test.ts": 541,
-      "src/main/daemon/daemon-init-packaged-bundle-staleness.test.ts": 353,
-      "src/main/daemon/daemon-init-provider-installation.test.ts": 398,
-      "src/main/daemon/daemon-init-replacement-reporting.test.ts": 247,
-      "src/main/daemon/daemon-init-restart-sequence.test.ts": 576,
-      "src/main/daemon/daemon-init-wedged-daemon-grace.test.ts": 284,
-      "src/main/daemon/daemon-lifecycle-event.test.ts": 8,
-      "src/main/daemon/daemon-main.test.ts": 43,
-      "src/main/daemon/daemon-native-pty-exception.test.ts": 12,
-      "src/main/daemon/daemon-pid-file-parse.test.ts": 9,
-      "src/main/daemon/daemon-preflight-client-replacement.test.ts": 234,
-      "src/main/daemon/daemon-process-inspection.test.ts": 22,
-      "src/main/daemon/daemon-protocol-version.test.ts": 9,
-      "src/main/daemon/daemon-pty-adapter-cold-restore-reanchor.test.ts": 489,
-      "src/main/daemon/daemon-pty-adapter-cold-restore-seed.test.ts": 297,
-      "src/main/daemon/daemon-pty-adapter-concurrent-recovery.test.ts": 142,
-      "src/main/daemon/daemon-pty-adapter-daemon-recovery.test.ts": 505,
-      "src/main/daemon/daemon-pty-adapter-history-checkpoints.test.ts": 775,
-      "src/main/daemon/daemon-pty-adapter-history-recovery.test.ts": 580,
-      "src/main/daemon/daemon-pty-adapter-inventory-respawn.test.ts": 87,
-      "src/main/daemon/daemon-pty-adapter-protocol-compatibility.test.ts": 73,
-      "src/main/daemon/daemon-pty-adapter-replacement-exit-race.test.ts": 53,
-      "src/main/daemon/daemon-pty-adapter-session-adoption.test.ts": 557,
-      "src/main/daemon/daemon-pty-adapter-steady-state-compat.test.ts": 7,
-      "src/main/daemon/daemon-pty-adapter.test.ts": 873,
-      "src/main/daemon/daemon-pty-router-history-handoff.test.ts": 575,
-      "src/main/daemon/daemon-pty-router.test.ts": 445,
-      "src/main/daemon/daemon-pty-startup-delivery.test.ts": 1989,
-      "src/main/daemon/daemon-pty-upgrade-adoption.test.ts": 120,
-      "src/main/daemon/daemon-pty-write-settlement-recovery.test.ts": 11,
-      "src/main/daemon/daemon-ready-identity.test.ts": 8,
-      "src/main/daemon/daemon-reattach-checkpoint-isolation.test.ts": 10265,
-      "src/main/daemon/daemon-respawn-throttle.test.ts": 9,
-      "src/main/daemon/daemon-restore-scrollback-depth.test.ts": 2078,
-      "src/main/daemon/daemon-self-retirement-respawn.test.ts": 148,
-      "src/main/daemon/daemon-server-async-spawn-cancellation.test.ts": 354,
-      "src/main/daemon/daemon-server-attach-only.test.ts": 59,
-      "src/main/daemon/daemon-server-attachment-lifecycle.test.ts": 214,
-      "src/main/daemon/daemon-server-error-handling.test.ts": 179,
-      "src/main/daemon/daemon-server-kill-attribution.test.ts": 20,
-      "src/main/daemon/daemon-server.test.ts": 702,
-      "src/main/daemon/daemon-session-owner-resolution.test.ts": 22,
-      "src/main/daemon/daemon-session-scrollback-window.test.ts": 54,
-      "src/main/daemon/daemon-shutdown-final-checkpoint-caller-deadline.test.ts": 1702,
-      "src/main/daemon/daemon-spawner.test.ts": 74,
-      "src/main/daemon/daemon-stream-data-batcher.test.ts": 108,
-      "src/main/daemon/daemon-stream-droppability-lifecycle.test.ts": 46,
-      "src/main/daemon/daemon-stream-droppable-membership.test.ts": 40,
-      "src/main/daemon/daemon-tcc-attribution-main-thread.test.ts": 14,
-      "src/main/daemon/daemon-tcc-attribution.test.ts": 8,
-      "src/main/daemon/daemon-transport-attachment-release.test.ts": 114,
-      "src/main/daemon/degraded-daemon-pty-provider.test.ts": 58,
-      "src/main/daemon/hangul-cell-width-agreement.test.ts": 37,
-      "src/main/daemon/headless-emulator-fidelity.fuzz.test.ts": 17026,
-      "src/main/daemon/headless-emulator-restored-osc-links.test.ts": 50,
-      "src/main/daemon/headless-emulator-unicode-width.test.ts": 15,
-      "src/main/daemon/headless-emulator-wide-char-repaint.test.ts": 1773,
-      "src/main/daemon/headless-emulator-wide-char-snapshot.test.ts": 186,
-      "src/main/daemon/headless-emulator.test.ts": 114,
-      "src/main/daemon/headless-osc-link-ranges.test.ts": 119,
-      "src/main/daemon/hibernation-cold-restore-repro.test.ts": 73,
-      "src/main/daemon/history-manager-disabled-sessions-leak.test.ts": 58,
-      "src/main/daemon/history-manager.test.ts": 326,
-      "src/main/daemon/history-reader-memory.test.ts": 332,
-      "src/main/daemon/history-reader.test.ts": 85,
-      "src/main/daemon/issue-6814-daemon-failure-classification.test.ts": 6043,
-      "src/main/daemon/macos-login-session-death-watch.test.ts": 13,
-      "src/main/daemon/ndjson.test.ts": 173,
-      "src/main/daemon/node-pty-error-hints.test.ts": 6,
-      "src/main/daemon/osc7-file-uri.test.ts": 8,
-      "src/main/daemon/osc7-uri-extraction.test.ts": 8,
-      "src/main/daemon/post-ready-flush-gate.test.ts": 16,
-      "src/main/daemon/pty-session-id.test.ts": 16,
-      "src/main/daemon/pty-subprocess-cwd-cancel-identity.test.ts": 12,
-      "src/main/daemon/pty-subprocess-env-inheritance.test.ts": 58,
-      "src/main/daemon/pty-subprocess-foreground-degraded-scan.test.ts": 64,
-      "src/main/daemon/pty-subprocess-foreground-identity.test.ts": 303,
-      "src/main/daemon/pty-subprocess-foreground-scan-cadence.test.ts": 42,
-      "src/main/daemon/pty-subprocess-git-credential-guard.test.ts": 32,
-      "src/main/daemon/pty-subprocess-handle-lifecycle.test.ts": 138,
-      "src/main/daemon/pty-subprocess-io-failure-cleanup.test.ts": 3575,
-      "src/main/daemon/pty-subprocess-io-failure-native.test.ts": 2227,
-      "src/main/daemon/pty-subprocess-managed-agent-env.test.ts": 81,
-      "src/main/daemon/pty-subprocess-windows-shell-launch.test.ts": 66,
-      "src/main/daemon/pty-subprocess-wsl-launch.test.ts": 52,
-      "src/main/daemon/pty-subprocess.test.ts": 58,
-      "src/main/daemon/reattach-snapshot.test.ts": 649,
-      "src/main/daemon/repro-12101-mouse-tracking-survives-agent-death.test.ts": 61,
-      "src/main/daemon/repro-7329-remote-snapshot-corruption.test.ts": 57,
-      "src/main/daemon/session-pending-output.test.ts": 145,
-      "src/main/daemon/session-shell-recovery.test.ts": 122,
-      "src/main/daemon/session-terminal-control.test.ts": 46,
-      "src/main/daemon/session.test.ts": 279,
-      "src/main/daemon/shell-ready-bash-wrapper.test.ts": 338,
-      "src/main/daemon/slow-daemon-session-verification.test.ts": 13535,
-      "src/main/daemon/startup-device-attributes-responder.test.ts": 14,
-      "src/main/daemon/terminal-checkpoint-serializer.test.ts": 37,
-      "src/main/daemon/terminal-checkpoint-writer-bounds.test.ts": 91,
-      "src/main/daemon/terminal-cursor-line-context.test.ts": 26,
-      "src/main/daemon/terminal-history-incremental-restore.test.ts": 316,
-      "src/main/daemon/terminal-history-large-checkpoint-cold-restore.test.ts": 9348,
-      "src/main/daemon/terminal-history-log.test.ts": 13,
-      "src/main/daemon/terminal-history-permissions.test.ts": 87,
-      "src/main/daemon/terminal-history-restorable-retention.test.ts": 7,
-      "src/main/daemon/terminal-history-seed-chunks.test.ts": 7,
-      "src/main/daemon/terminal-history-seed-segments.test.ts": 22,
-      "src/main/daemon/terminal-history-seed-transfer-registry.test.ts": 8,
-      "src/main/daemon/terminal-history-session-tombstone-retry.test.ts": 10,
-      "src/main/daemon/terminal-host-agent-session.test.ts": 36,
-      "src/main/daemon/terminal-host-attach-only.test.ts": 28,
-      "src/main/daemon/terminal-host-cheap-tier-ps-scan-volume.test.ts": 59,
-      "src/main/daemon/terminal-host-concurrent-create.test.ts": 53,
-      "src/main/daemon/terminal-host-cwd-readability.test.ts": 30,
-      "src/main/daemon/terminal-host-non-agent-foreground.test.ts": 17,
-      "src/main/daemon/terminal-host-process-inspection-cheap-tier.test.ts": 29,
-      "src/main/daemon/terminal-host-process-inspection.test.ts": 18,
-      "src/main/daemon/terminal-host-pty-owner-backend.test.ts": 19,
-      "src/main/daemon/terminal-host-readiness-reporting.test.ts": 23,
-      "src/main/daemon/terminal-host-session-reaping-leak.test.ts": 30,
-      "src/main/daemon/terminal-host-startup.test.ts": 45,
-      "src/main/daemon/terminal-host-teardown-recreate.test.ts": 185,
-      "src/main/daemon/terminal-host-wsl-context.test.ts": 45,
-      "src/main/daemon/terminal-host.test.ts": 152,
-      "src/main/daemon/terminal-session-teardown.test.ts": 16,
-      "src/main/daemon/terminal-shell-lifecycle-scanner.test.ts": 21,
-      "src/main/daemon/terminal-shell-recovery-barrier.test.ts": 703,
-      "src/main/daemon/terminal-shell-recovery-clean-exit-retirement.test.ts": 26,
-      "src/main/daemon/terminal-snapshot-color-parity.test.ts": 109,
-      "src/main/daemon/terminal-snapshot-osc8-roundtrip.test.ts": 57,
-      "src/main/daemon/terminal-snapshot-serialize-roundtrip.test.ts": 130,
-      "src/main/daemon/windows-conpty-warmup.test.ts": 12,
-      "src/main/daemon/wsl-cold-restore-cwd.test.ts": 7,
-      "src/main/destination-serialized-local-rename.test.ts": 330,
-      "src/main/devin/hook-config-json.test.ts": 11,
-      "src/main/devin/hook-service.test.ts": 43,
-      "src/main/diagnostics/main-thread-churn-probe.test.ts": 13,
-      "src/main/dock/unread-badge.test.ts": 9,
-      "src/main/droid/hook-service.test.ts": 81,
-      "src/main/durable-file-write-syscall-proof.test.ts": 125,
-      "src/main/durable-file-write.test.ts": 89,
-      "src/main/emulator/android/adb-devices.test.ts": 10,
-      "src/main/emulator/android/android-app-control.test.ts": 7,
-      "src/main/emulator/android/android-capability-operations.test.ts": 10,
-      "src/main/emulator/android/android-device-inventory.test.ts": 12,
-      "src/main/emulator/android/android-input-commands.test.ts": 5,
-      "src/main/emulator/android/android-input-mapping.test.ts": 9,
-      "src/main/emulator/android/android-logcat.test.ts": 5,
-      "src/main/emulator/android/android-permissions.test.ts": 8,
-      "src/main/emulator/android/android-sdk-discovery.test.ts": 7,
-      "src/main/emulator/android/avd-manager.test.ts": 11,
-      "src/main/emulator/android/scrcpy-server-deploy.test.ts": 7,
-      "src/main/emulator/android/scrcpy-video-frame-parser.test.ts": 11,
-      "src/main/emulator/android/uiautomator-tree.test.ts": 12,
-      "src/main/emulator/backends/android-emulator-backend.test.ts": 24,
-      "src/main/emulator/backends/ios-emulator-backend.test.ts": 88,
-      "src/main/emulator/emulator-availability.test.ts": 7,
-      "src/main/emulator/emulator-bridge.test.ts": 122,
-      "src/main/emulator/emulator-gesture-sender.test.ts": 131,
-      "src/main/emulator/emulator-session-registry.test.ts": 5,
-      "src/main/emulator/emulator-start-lease-registry.test.ts": 62,
-      "src/main/emulator/mjpeg-frame-parser.test.ts": 8,
-      "src/main/emulator/mjpeg-frame-stream.test.ts": 34,
-      "src/main/emulator/scrcpy-video-registry.test.ts": 11,
-      "src/main/emulator/serve-sim-accessibility-tree.test.ts": 90,
-      "src/main/emulator/serve-sim-ax-normalization.test.ts": 12,
-      "src/main/emulator/serve-sim-detached-session.test.ts": 11,
-      "src/main/emulator/serve-sim-execution.test.ts": 25,
-      "src/main/emulator/serve-sim-helper-processes.test.ts": 8,
-      "src/main/emulator/serve-sim-runtime-materializer.test.ts": 49,
-      "src/main/emulator/simctl-simulator-devices.test.ts": 11,
-      "src/main/ephemeral-vm-recipe-runner.test.ts": 296,
-      "src/main/ephemeral-vm-resume-integrity.test.ts": 11,
-      "src/main/ephemeral-vm-runtime-service.test.ts": 522,
-      "src/main/ephemeral-vm-runtime-ssh-cleanup.test.ts": 36,
-      "src/main/external-editor-launch.test.ts": 19,
-      "src/main/fish-history-session.test.ts": 22,
-      "src/main/gemini/hook-service.test.ts": 15,
-      "src/main/ghostty/discovery.test.ts": 14,
-      "src/main/ghostty/index.test.ts": 20,
-      "src/main/ghostty/mapper-extended.test.ts": 11,
-      "src/main/ghostty/mapper.test.ts": 11,
-      "src/main/ghostty/parser.test.ts": 8,
-      "src/main/ghostty/theme-import.test.ts": 14,
-      "src/main/ghostty/theme-resolution.test.ts": 10,
-      "src/main/git-bash.test.ts": 13,
-      "src/main/git/add-sparse-worktree.test.ts": 22,
-      "src/main/git/admission-tier-plumbing.test.ts": 10,
-      "src/main/git/branch-rename.test.ts": 8,
-      "src/main/git/canonical-repo-key.test.ts": 6,
-      "src/main/git/check-ignored-paths.test.ts": 15,
-      "src/main/git/coalesced-probe.test.ts": 9,
-      "src/main/git/command-runner/gh-exec-file-deadline.test.ts": 20,
-      "src/main/git/command-runner/gh-spawn-boundary.test.ts": 566,
-      "src/main/git/command-runner/git-admission-output-parity.test.ts": 120,
-      "src/main/git/command-runner/git-admission-span.test.ts": 175,
-      "src/main/git/command-runner/git-admission-storm-measurement.test.ts": 25859,
-      "src/main/git/command-runner/git-command-timeout-behavior.test.ts": 1728,
-      "src/main/git/command-runner/git-command-timeout.test.ts": 8,
-      "src/main/git/command-runner/git-exec-admission-lifetime.test.ts": 375,
-      "src/main/git/command-runner/git-spawn-admission-lifetime.test.ts": 15,
-      "src/main/git/command-runner/git-stream-admission-lifetime.test.ts": 120,
-      "src/main/git/command-runner/git-subprocess-admission.test.ts": 448,
-      "src/main/git/command-runner/hosted-cli-deadline-log.test.ts": 22,
-      "src/main/git/command-runner/wsl-host-failure.test.ts": 17,
-      "src/main/git/commit-object-ref.test.ts": 8,
-      "src/main/git/commit.test.ts": 6,
-      "src/main/git/exact-ref-probe.test.ts": 17,
-      "src/main/git/fetch-error-classification.test.ts": 9,
-      "src/main/git/fork-remote-refspec.test.ts": 14,
-      "src/main/git/fork-remote-stale-branch-refspec.test.ts": 10,
-      "src/main/git/gh-rate-limit-breaker.test.ts": 20,
-      "src/main/git/git-capability-state.test.ts": 14,
-      "src/main/git/git-status-read-lease-owner.test.ts": 15,
-      "src/main/git/git-upstream-status-read-owner.test.ts": 18,
-      "src/main/git/hosted-remote-url.test.ts": 6,
-      "src/main/git/huge-folder-ignore.test.ts": 20,
-      "src/main/git/local-repo-ref-maintenance.test.ts": 98,
-      "src/main/git/pack-refs-lock-ownership.test.ts": 36,
-      "src/main/git/porcelain-v1-records.test.ts": 140,
-      "src/main/git/remote-ref-probe-cache.test.ts": 13,
-      "src/main/git/remote-url-probe.test.ts": 9,
-      "src/main/git/remote.test.ts": 51,
-      "src/main/git/remove-worktree-branch-cleanup.test.ts": 16,
-      "src/main/git/remove-worktree-clean-preflight.test.ts": 14,
-      "src/main/git/remove-worktree.test.ts": 35,
-      "src/main/git/repo-api-parity.test.ts": 6,
-      "src/main/git/repo-branch-conflict-batched-probe.test.ts": 11,
-      "src/main/git/repo-branch-conflict-real-git.test.ts": 157,
-      "src/main/git/repo-branch-conflict.test.ts": 20,
-      "src/main/git/repo-clone-path.test.ts": 6,
-      "src/main/git/repo-default-base-timeout.test.ts": 11,
-      "src/main/git/repo-default-remote.test.ts": 11,
-      "src/main/git/repo-detection.test.ts": 348,
-      "src/main/git/repo-ref-maintenance-real-git.test.ts": 1092,
-      "src/main/git/repo-remote-drift-real.test.ts": 103,
-      "src/main/git/repo-remote-drift.test.ts": 8,
-      "src/main/git/repo-search-ref-compat.test.ts": 10,
-      "src/main/git/repo-username.test.ts": 30,
-      "src/main/git/repo.test.ts": 2330,
-      "src/main/git/runner-command-exec.test.ts": 530,
-      "src/main/git/runner-gh-host-args.test.ts": 8,
-      "src/main/git/runner-gh-rate-limit-breaker.test.ts": 32,
-      "src/main/git/runner-windows-host-environment.test.ts": 88,
-      "src/main/git/runner-wsl-direct-read.test.ts": 1710,
-      "src/main/git/runner-wsl-gh-fallback.test.ts": 857,
-      "src/main/git/runner-wsl-linked-gitdir-timeout.test.ts": 20,
-      "src/main/git/runner-wsl-login-shell-capture.test.ts": 18,
-      "src/main/git/runner-wsl-read-routing.test.ts": 15,
-      "src/main/git/runner.test.ts": 32,
-      "src/main/git/settled-diff-cache-bounds.test.ts": 7,
-      "src/main/git/source-control/bulk-pathspec-command-line-budget.test.ts": 128,
-      "src/main/git/source-control/resolve-git-dir.test.ts": 6,
-      "src/main/git/source-control/wsl-tracked-pathspec-banner.test.ts": 20,
-      "src/main/git/status-branch-compare-real-ref.test.ts": 137,
-      "src/main/git/status-branch-compare.test.ts": 19,
-      "src/main/git/status-branch-line-total-exec-contract.test.ts": 751,
-      "src/main/git/status-branch-line-total-real-git.test.ts": 728,
-      "src/main/git/status-branch-line-total-relay-parity.test.ts": 301,
-      "src/main/git/status-conflict-operations.test.ts": 19,
-      "src/main/git/status-conflict-overlap.bench.test.ts": 25,
-      "src/main/git/status-cquoted-paths.test.ts": 79,
-      "src/main/git/status-diff-settled-cache.test.ts": 152,
-      "src/main/git/status-diff.test.ts": 37,
-      "src/main/git/status-discard-and-bulk-staging.test.ts": 73,
-      "src/main/git/status-discard-symlink.test.ts": 429,
-      "src/main/git/status-line-stats-host-paths.test.ts": 14,
-      "src/main/git/status-pathspec-literals.test.ts": 352,
-      "src/main/git/status-porcelain-parser.test.ts": 7,
-      "src/main/git/status-read-coalescing.test.ts": 37,
-      "src/main/git/status-shared-symlinks.test.ts": 825,
-      "src/main/git/status-submodule-path-cache.test.ts": 894,
-      "src/main/git/status-submodule.test.ts": 45,
-      "src/main/git/status-symlink-probe-budget.test.ts": 44,
-      "src/main/git/status-upstream-negative-cache.test.ts": 990,
-      "src/main/git/status-upstream-probe-churn.test.ts": 42,
-      "src/main/git/status-upstream-ref.test.ts": 13,
-      "src/main/git/status-wsl-pathspecs.test.ts": 14,
-      "src/main/git/status.test.ts": 72,
-      "src/main/git/upstream-deferred-fork-remote-real.test.ts": 49,
-      "src/main/git/upstream.test.ts": 179,
-      "src/main/git/worktree-add-creation-config.test.ts": 38,
-      "src/main/git/worktree-add-local-base-refresh.test.ts": 16,
-      "src/main/git/worktree-add-local-base-suggestion.test.ts": 15,
-      "src/main/git/worktree-add-timeout-override.test.ts": 12,
-      "src/main/git/worktree-base-divergence-real-git.test.ts": 1158,
-      "src/main/git/worktree-base-divergence.test.ts": 39,
-      "src/main/git/worktree-base-ref-probe.test.ts": 16,
-      "src/main/git/worktree-common-dir-comparison.test.ts": 6,
-      "src/main/git/worktree-configured-paths-concurrency.test.ts": 27,
-      "src/main/git/worktree-create-preparation-real-git.test.ts": 1004,
-      "src/main/git/worktree-created-description-real-git.test.ts": 1472,
-      "src/main/git/worktree-deferred-removal-real-git.test.ts": 269,
-      "src/main/git/worktree-diff-stamp-guest-gitdir.test.ts": 6,
-      "src/main/git/worktree-diff-stamp-host-paths.test.ts": 8,
-      "src/main/git/worktree-git-capabilities.test.ts": 13,
-      "src/main/git/worktree-graph-listing.test.ts": 13,
-      "src/main/git/worktree-include-file.test.ts": 83,
-      "src/main/git/worktree-list-paths.test.ts": 228,
-      "src/main/git/worktree-list-porcelain.test.ts": 26,
-      "src/main/git/worktree-listing-created-sparse-distro.test.ts": 9,
-      "src/main/git/worktree-listing-sparse-distro.test.ts": 8,
-      "src/main/git/worktree-move.test.ts": 12,
-      "src/main/git/worktree-mutation-route-invalidation.test.ts": 25,
-      "src/main/git/worktree-porcelain-parsing.test.ts": 14,
-      "src/main/git/worktree-preparation-base-oid.test.ts": 14,
-      "src/main/git/worktree-remove-branch-deletion.test.ts": 17,
-      "src/main/git/worktree-scan-cache-annotation-reuse.test.ts": 8,
-      "src/main/git/worktree-scan-cache-sharing.test.ts": 52,
-      "src/main/git/worktree-separate-git-dir.test.ts": 350,
-      "src/main/git/worktree-shared-directories.test.ts": 726,
-      "src/main/git/worktree-sparse-checkout-cache.test.ts": 31,
-      "src/main/git/worktree-sparse-checkout.test.ts": 276,
-      "src/main/git/worktree-sparse-state-host-paths.test.ts": 5,
-      "src/main/git/worktree-symlink-detection.test.ts": 11,
-      "src/main/git/wsl-direct-git-read-commands.test.ts": 8,
-      "src/main/git/wsl-linked-worktree-git-route-invalidation.test.ts": 9,
-      "src/main/git/wsl-linked-worktree-git-routing.test.ts": 57,
-      "src/main/git/wsl-process-group-termination.test.ts": 8,
-      "src/main/gitea/client.test.ts": 145,
-      "src/main/gitea/pull-request-creation.test.ts": 82,
-      "src/main/gitea/pull-request-mappers.test.ts": 5,
-      "src/main/gitea/repository-ref.test.ts": 19,
-      "src/main/github/auth-diagnose.test.ts": 10,
-      "src/main/github/client-create-pr.test.ts": 39,
-      "src/main/github/client-file-viewed.test.ts": 10,
-      "src/main/github/client-issue-origin-preference.test.ts": 17,
-      "src/main/github/client-issue-source.test.ts": 28,
-      "src/main/github/client-merge-queue-auto-merge.test.ts": 70,
-      "src/main/github/client-merged-pr-visibility.test.ts": 19,
-      "src/main/github/client-pr-branch-discovery.test.ts": 16,
-      "src/main/github/client-pr-check-details.test.ts": 36,
-      "src/main/github/client-pr-checks.test.ts": 42,
-      "src/main/github/client-pr-comment-reactions.test.ts": 13,
-      "src/main/github/client-pr-conflict-summary.test.ts": 26,
-      "src/main/github/client-pr-fallback-number.test.ts": 23,
-      "src/main/github/client-pr-linked-lookup.test.ts": 18,
-      "src/main/github/client-pr-local-runtime.test.ts": 32,
-      "src/main/github/client-pr-push-target.test.ts": 24,
-      "src/main/github/client-pr-state.test.ts": 10,
-      "src/main/github/client-rate-limit-block.test.ts": 12,
-      "src/main/github/client-ssh-provider-execution-boundary.test.ts": 23,
-      "src/main/github/client-stack-merge-guard.test.ts": 32,
-      "src/main/github/client-starred.test.ts": 12,
-      "src/main/github/client-tracked-upstream-fork-owner.test.ts": 21,
-      "src/main/github/client-tracked-upstream-snapshot.test.ts": 232,
-      "src/main/github/client-work-item-check-summary.test.ts": 12,
-      "src/main/github/client-work-items-query-paging.test.ts": 35,
-      "src/main/github/client-work-items.test.ts": 18,
-      "src/main/github/comment-reactions.test.ts": 3,
-      "src/main/github/conflict-summary.test.ts": 33,
-      "src/main/github/default-branch-stale-pr.test.ts": 11,
-      "src/main/github/gh-utils-concurrency.test.ts": 6,
-      "src/main/github/gh-utils.test.ts": 88,
-      "src/main/github/github-api-repository.test.ts": 113,
-      "src/main/github/github-enterprise-repository.test.ts": 36,
-      "src/main/github/github-pr-stack.test.ts": 46,
-      "src/main/github/github-remote-identity-parsing.test.ts": 9,
-      "src/main/github/github-repository-identity.fork-owner-repo.test.ts": 13,
-      "src/main/github/github-repository-identity.signed-cache.test.ts": 9,
-      "src/main/github/github-repository-identity.ssh-host-alias.test.ts": 33,
-      "src/main/github/issues.test.ts": 18,
-      "src/main/github/pr-head-tracking-ref.test.ts": 13,
-      "src/main/github/pr-refresh-coordinator-active-burst-pacing.test.ts": 271,
-      "src/main/github/pr-refresh-coordinator-active-visible-priority.test.ts": 192,
-      "src/main/github/pr-refresh-coordinator-alias-coalescing.test.ts": 175,
-      "src/main/github/pr-refresh-coordinator-rate-limit-budget.test.ts": 223,
-      "src/main/github/pr-refresh-coordinator-refresh-events.test.ts": 185,
-      "src/main/github/pr-refresh-coordinator-visible-follow-up.test.ts": 163,
-      "src/main/github/pr-refresh-error-classification.test.ts": 8,
-      "src/main/github/pr-refresh-queue-growth-bound.test.ts": 439,
-      "src/main/github/pr-refresh-validation-backoff.test.ts": 14,
-      "src/main/github/pr-review-comment-lines.test.ts": 6,
-      "src/main/github/pr-start-point-compare-base.test.ts": 15,
-      "src/main/github/pr-start-point.test.ts": 20,
-      "src/main/github/project-view-host-auth.test.ts": 16,
-      "src/main/github/project-view.test.ts": 22,
-      "src/main/github/project-view/mutations.test.ts": 14,
-      "src/main/github/project-view/project-field-mutations.test.ts": 6,
-      "src/main/github/project-view/project-view-table.test.ts": 11,
-      "src/main/github/project-view/repository-field-options.test.ts": 5,
-      "src/main/github/rate-limit.test.ts": 19,
-      "src/main/github/review-head-remote.test.ts": 11,
-      "src/main/github/stacked-pr-creation.test.ts": 23,
-      "src/main/github/work-item-details-api-parity.test.ts": 7,
-      "src/main/github/work-item-details-concurrency.test.ts": 7,
-      "src/main/github/work-item-details-enterprise-host.test.ts": 20,
-      "src/main/github/work-item-details-file-viewed.test.ts": 18,
-      "src/main/github/work-item-details-pr-files.test.ts": 22,
-      "src/main/github/work-item-details.test.ts": 29,
-      "src/main/gitlab/client-mr-auth-rate-limit.test.ts": 14,
-      "src/main/gitlab/client-mr-branch-lookup.test.ts": 27,
-      "src/main/gitlab/client-mr-job-ci.test.ts": 12,
-      "src/main/gitlab/client-mr-listing.test.ts": 15,
-      "src/main/gitlab/client-mr-review-actions.test.ts": 11,
-      "src/main/gitlab/client-work-items.test.ts": 16,
-      "src/main/gitlab/client.test.ts": 19,
-      "src/main/gitlab/gitlab-known-host-probe-wsl-fallback.test.ts": 15,
-      "src/main/gitlab/gitlab-known-host-probe.test.ts": 23,
-      "src/main/gitlab/gl-utils.test.ts": 41,
-      "src/main/gitlab/issues.test.ts": 23,
-      "src/main/gitlab/mappers-workitem.test.ts": 5,
-      "src/main/gitlab/mappers.test.ts": 23,
-      "src/main/gitlab/merge-request-creation.test.ts": 11,
-      "src/main/gitlab/mr-head-tracking-ref.test.ts": 10,
-      "src/main/gitlab/project-ref-parser.test.ts": 12,
-      "src/main/gitlab/work-item-details.test.ts": 31,
-      "src/main/global-fetch-call-site-audit.test.ts": 135,
-      "src/main/grok-accounts/status.test.ts": 6,
-      "src/main/grok/grok-hook-config-file.test.ts": 99,
-      "src/main/grok/grok-hook-owners.test.ts": 26,
-      "src/main/grok/grok-hook-remnant-removal.test.ts": 15,
-      "src/main/grok/hook-service.test.ts": 38,
-      "src/main/grok/windows-grok-hook-script.test.ts": 9,
-      "src/main/grok/windows-hook-launcher-chain.test.ts": 9,
-      "src/main/hang-watchdog/hang-detection-marker.test.ts": 7,
-      "src/main/hang-watchdog/hang-watchdog-detection-loop.test.ts": 11,
-      "src/main/hang-watchdog/hang-watchdog-worker-path.test.ts": 8,
-      "src/main/hang-watchdog/main-thread-hang-telemetry.test.ts": 6,
-      "src/main/hang-watchdog/main-thread-hang-watchdog-entry.test.ts": 19,
-      "src/main/hang-watchdog/main-thread-hang-watchdog.test.ts": 26,
-      "src/main/headless-automation-dispatcher-source-boundary.test.ts": 4,
-      "src/main/hermes/hook-service.test.ts": 196,
-      "src/main/hooks-effective-hook-resolution.test.ts": 173,
-      "src/main/hooks-issue-command.test.ts": 237,
-      "src/main/hooks-orca-yaml-parsing.test.ts": 37,
-      "src/main/hooks-runner.test.ts": 103,
-      "src/main/hooks-setup-runner-script.test.ts": 171,
-      "src/main/hooks.test.ts": 316,
-      "src/main/host-tree-removal-asar.electron.test.ts": 285,
-      "src/main/host/deferred-secret-protection-report.test.ts": 16,
-      "src/main/host/electron-secret-store.test.ts": 11,
-      "src/main/host/secret-protection-report.test.ts": 13,
-      "src/main/i18n/main-i18n-lazy-locale.test.ts": 270,
-      "src/main/ipc/agent-hooks.test.ts": 472,
-      "src/main/ipc/agent-pane-authority-ownership.test.ts": 4,
-      "src/main/ipc/ai-vault-scan-coalescing.test.ts": 322,
-      "src/main/ipc/ai-vault.test.ts": 159,
-      "src/main/ipc/app.test.ts": 24,
-      "src/main/ipc/automations-external-scope.test.ts": 110,
-      "src/main/ipc/bounded-warning-dedupe.test.ts": 8,
-      "src/main/ipc/browser-client-page-metadata-ipc.test.ts": 19,
-      "src/main/ipc/browser-preview-tool-authorization.test.ts": 81,
-      "src/main/ipc/browser-session-profile-ipc.test.ts": 10,
-      "src/main/ipc/browser-tab-registration-wait.test.ts": 12,
-      "src/main/ipc/browser.test.ts": 83,
-      "src/main/ipc/cli-appimage-stale-registration.test.ts": 214,
-      "src/main/ipc/cli.test.ts": 62,
-      "src/main/ipc/codex-config-sync.test.ts": 13,
-      "src/main/ipc/command-path-resolver.test.ts": 13,
-      "src/main/ipc/computer-use-permissions.test.ts": 9,
-      "src/main/ipc/crash-reporting-renderer-breadcrumbs.test.ts": 39,
-      "src/main/ipc/crash-reporting-renderer-error-report-attribution.test.ts": 12,
-      "src/main/ipc/crash-reporting-replay-guard-wedge-burst.test.ts": 24,
-      "src/main/ipc/crash-reporting.test.ts": 43,
-      "src/main/ipc/created-worktree-reconciliation.test.ts": 72,
-      "src/main/ipc/created-worktree-root-prune.test.ts": 19,
-      "src/main/ipc/dashboard-payload-validation.test.ts": 74,
-      "src/main/ipc/dashboard-popout.test.ts": 13,
-      "src/main/ipc/deferred-emoji-shortcode-dataset.test.ts": 65,
-      "src/main/ipc/developer-permissions.test.ts": 17,
-      "src/main/ipc/diagnostics.test.ts": 20,
-      "src/main/ipc/doc-preview-grant-ipc.test.ts": 10,
-      "src/main/ipc/dropped-path-resolution.test.ts": 19,
-      "src/main/ipc/emulator-stream-listener-cleanup.test.ts": 12,
-      "src/main/ipc/ephemeral-vm-provision-cancel.test.ts": 58,
-      "src/main/ipc/ephemeral-vm-provisioned-root-ref.test.ts": 447,
-      "src/main/ipc/ephemeral-vm-runtime-handler-cleanup.test.ts": 94,
-      "src/main/ipc/ephemeral-vm.test.ts": 595,
-      "src/main/ipc/feedback-image-attachments.test.ts": 67,
-      "src/main/ipc/feedback.test.ts": 132,
-      "src/main/ipc/filesystem-allowed-roots.test.ts": 334,
-      "src/main/ipc/filesystem-auth.test.ts": 678,
-      "src/main/ipc/filesystem-branch-compare-diff.test.ts": 24,
-      "src/main/ipc/filesystem-commit-message-generation.test.ts": 32,
-      "src/main/ipc/filesystem-commit-message-model-discovery.test.ts": 25,
-      "src/main/ipc/filesystem-conflict-operation-routing.test.ts": 14,
-      "src/main/ipc/filesystem-download-transfers.test.ts": 106,
-      "src/main/ipc/filesystem-git-commit-dispatch.test.ts": 18,
-      "src/main/ipc/filesystem-git-status-staging.test.ts": 82,
-      "src/main/ipc/filesystem-import-ssh-ops.test.ts": 23,
-      "src/main/ipc/filesystem-import-ssh-path-safety.test.ts": 18,
-      "src/main/ipc/filesystem-import-ssh.test.ts": 31,
-      "src/main/ipc/filesystem-import.test.ts": 64,
-      "src/main/ipc/filesystem-list-files-git-directory-expansion.test.ts": 325,
-      "src/main/ipc/filesystem-list-files-git-fallback-real.test.ts": 271,
-      "src/main/ipc/filesystem-list-files-install-rg.test.ts": 23,
-      "src/main/ipc/filesystem-list-files.test.ts": 253,
-      "src/main/ipc/filesystem-markdown-document-listing.test.ts": 17,
-      "src/main/ipc/filesystem-mutations.test.ts": 49,
-      "src/main/ipc/filesystem-path-containment-remote-enoent.test.ts": 8,
-      "src/main/ipc/filesystem-pull-request-field-generation.test.ts": 18,
-      "src/main/ipc/filesystem-search-file-paths.test.ts": 257,
-      "src/main/ipc/filesystem-search-git.test.ts": 150,
-      "src/main/ipc/filesystem-search-rg-timeout.test.ts": 50,
-      "src/main/ipc/filesystem-watcher-canonical-root-paths.test.ts": 320,
-      "src/main/ipc/filesystem-watcher-dormant-rearm.test.ts": 170,
-      "src/main/ipc/filesystem-watcher-event-batch.test.ts": 9,
-      "src/main/ipc/filesystem-watcher-ignore.test.ts": 7,
-      "src/main/ipc/filesystem-watcher-large-batch.test.ts": 150,
-      "src/main/ipc/filesystem-watcher-local-events.test.ts": 240,
-      "src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts": 818,
-      "src/main/ipc/filesystem-watcher-native-capacity.test.ts": 67,
-      "src/main/ipc/filesystem-watcher-real.test.ts": 488,
-      "src/main/ipc/filesystem-watcher-remote-batch.test.ts": 27,
-      "src/main/ipc/filesystem-watcher-remote-cancellation.test.ts": 324,
-      "src/main/ipc/filesystem-watcher-remote-capacity.test.ts": 31,
-      "src/main/ipc/filesystem-watcher-remote-rearm.test.ts": 20,
-      "src/main/ipc/filesystem-watcher-removal-deadline.test.ts": 129,
-      "src/main/ipc/filesystem-watcher-terminal-resync.test.ts": 21,
-      "src/main/ipc/filesystem-watcher-unwatchable-roots.test.ts": 24,
-      "src/main/ipc/filesystem-watcher-wsl.test.ts": 35,
-      "src/main/ipc/filesystem-watcher.test.ts": 1789,
-      "src/main/ipc/filesystem.test.ts": 70,
-      "src/main/ipc/floating-workspace-directory.test.ts": 23,
-      "src/main/ipc/folder-repo-git-upgrade.test.ts": 2257,
-      "src/main/ipc/git-status-upstream-ref-watch-request.test.ts": 13,
-      "src/main/ipc/github-ipc-channel-parity.test.ts": 13,
-      "src/main/ipc/github-issue-source-preference.test.ts": 16,
-      "src/main/ipc/github-pr-refresh-routing.test.ts": 31,
-      "src/main/ipc/github-repo-access-guards.test.ts": 24,
-      "src/main/ipc/github-ssh-connection-routing.test.ts": 10,
-      "src/main/ipc/github-star-telemetry.test.ts": 17,
-      "src/main/ipc/github-work-item-args.test.ts": 12,
-      "src/main/ipc/github-wsl-runtime-routing.test.ts": 21,
-      "src/main/ipc/gitlab-repo-access.test.ts": 6,
-      "src/main/ipc/gitlab.test.ts": 27,
-      "src/main/ipc/hosted-review.test.ts": 23,
-      "src/main/ipc/jira-cancellable-requests.test.ts": 12,
-      "src/main/ipc/keybindings.test.ts": 8,
-      "src/main/ipc/linear.test.ts": 9,
-      "src/main/ipc/local-log-tail.test.ts": 9,
-      "src/main/ipc/local-network-connection-test.test.ts": 84,
-      "src/main/ipc/local-worktree-runtime-options.test.ts": 10,
-      "src/main/ipc/macos-keyboard-layout-change-notifications.test.ts": 13,
-      "src/main/ipc/macos-keyboard-layout-snapshot.test.ts": 7,
-      "src/main/ipc/markdown-documents.test.ts": 5,
-      "src/main/ipc/minimax-credentials.test.ts": 17,
-      "src/main/ipc/mobile.test.ts": 66,
-      "src/main/ipc/native-chat-subscribe-lifecycle.test.ts": 18,
-      "src/main/ipc/native-chat.test.ts": 1703,
-      "src/main/ipc/notebook.test.ts": 13,
-      "src/main/ipc/notifications-custom-sound.test.ts": 13,
-      "src/main/ipc/notifications-delivery-gating.test.ts": 19,
-      "src/main/ipc/notifications-message-formatting.test.ts": 32,
-      "src/main/ipc/notifications-mobile-fanout.test.ts": 17,
-      "src/main/ipc/notifications-permission-onboarding.test.ts": 27,
-      "src/main/ipc/notifications-retention-lifecycle.test.ts": 27,
-      "src/main/ipc/orca-profile-auth-handlers.test.ts": 16,
-      "src/main/ipc/orca-profile-org-members-handlers.test.ts": 10,
-      "src/main/ipc/orca-profiles.test.ts": 28,
-      "src/main/ipc/parcel-watcher-child-launch.test.ts": 14,
-      "src/main/ipc/parcel-watcher-child-registry.test.ts": 60,
-      "src/main/ipc/parcel-watcher-crash-fuse.test.ts": 4,
-      "src/main/ipc/parcel-watcher-disconnect-termination.test.ts": 46,
-      "src/main/ipc/parcel-watcher-entry-path.test.ts": 8,
-      "src/main/ipc/parcel-watcher-event-cancellation.test.ts": 12,
-      "src/main/ipc/parcel-watcher-event-delivery.test.ts": 8,
-      "src/main/ipc/parcel-watcher-process-entry.test.ts": 83,
-      "src/main/ipc/parcel-watcher-process.test.ts": 395,
-      "src/main/ipc/parcel-watcher-root-path-rewrite.test.ts": 19,
-      "src/main/ipc/parcel-watcher-shallow-subscription.test.ts": 11,
-      "src/main/ipc/parcel-watcher-supervisor-capacity-wait.test.ts": 340,
-      "src/main/ipc/parcel-watcher-supervisor-capacity.test.ts": 134,
-      "src/main/ipc/parcel-watcher-unsubscribe-timeout.test.ts": 38,
-      "src/main/ipc/pet-bundle.test.ts": 6,
-      "src/main/ipc/pet.test.ts": 35,
-      "src/main/ipc/plugin-marketplaces.test.ts": 13,
-      "src/main/ipc/plugins.test.ts": 18,
-      "src/main/ipc/preflight-agent-detection-no-subprocess.test.ts": 22,
-      "src/main/ipc/preflight-agent-detection.test.ts": 42,
-      "src/main/ipc/preflight-agent-refresh.test.ts": 21,
-      "src/main/ipc/preflight-command-exec.test.ts": 8,
-      "src/main/ipc/preflight-host-cli-status.test.ts": 27,
-      "src/main/ipc/preflight-remote-ssh.test.ts": 16,
-      "src/main/ipc/preflight-wsl-agent-detection.test.ts": 55,
-      "src/main/ipc/preflight-wsl-command.test.ts": 17,
-      "src/main/ipc/pty-activation-inventory-scope.test.ts": 23,
-      "src/main/ipc/pty-agent-session-write-gate.test.ts": 141,
-      "src/main/ipc/pty-applied-size-reporting.test.ts": 48,
-      "src/main/ipc/pty-buffer-snapshot-dispatch.test.ts": 64,
-      "src/main/ipc/pty-codex-account-attribution.test.ts": 46,
-      "src/main/ipc/pty-controller-owner-recovery.test.ts": 53,
-      "src/main/ipc/pty-controller-ownership-routing.test.ts": 37,
-      "src/main/ipc/pty-controller-process-inventory.test.ts": 17,
-      "src/main/ipc/pty-controller-spawn-admission.test.ts": 49,
-      "src/main/ipc/pty-cumulative-ack-accounting.test.ts": 95,
-      "src/main/ipc/pty-daemon-controller-teardown.test.ts": 44,
-      "src/main/ipc/pty-daemon-spawn-agent-home-env.test.ts": 72,
-      "src/main/ipc/pty-daemon-spawn-codex-auth.test.ts": 82,
-      "src/main/ipc/pty-daemon-spawn-session-identity.test.ts": 60,
-      "src/main/ipc/pty-daemon-spawn-wsl-runtime.test.ts": 67,
-      "src/main/ipc/pty-daemon-ssh-lease-lifecycle.test.ts": 48,
-      "src/main/ipc/pty-dead-owner-respawn.test.ts": 44,
-      "src/main/ipc/pty-delivery-health-heal.test.ts": 117,
-      "src/main/ipc/pty-dispatcher-handshake-osc-answers.test.ts": 83,
-      "src/main/ipc/pty-encoding.test.ts": 7,
-      "src/main/ipc/pty-global-renderer-credit.test.ts": 134,
-      "src/main/ipc/pty-hidden-at-spawn-mark.test.ts": 120,
-      "src/main/ipc/pty-hidden-delivery-gate.test.ts": 8,
-      "src/main/ipc/pty-ipc-hidden-delivery-gate.test.ts": 67,
-      "src/main/ipc/pty-ipc-producer-flow-control.test.ts": 57,
-      "src/main/ipc/pty-listener-teardown-and-orphans.test.ts": 99,
-      "src/main/ipc/pty-login-shell-startup-commands.test.ts": 113,
-      "src/main/ipc/pty-management.test.ts": 46,
-      "src/main/ipc/pty-output-batching-drain.test.ts": 66,
-      "src/main/ipc/pty-output-drain-rounds.test.ts": 110,
-      "src/main/ipc/pty-pane-claim-arbitration.test.ts": 137,
-      "src/main/ipc/pty-pane-materialization-race.test.ts": 501,
-      "src/main/ipc/pty-pane-reservation-settlement.test.ts": 71,
-      "src/main/ipc/pty-pending-data-drain-queue-differential.test.ts": 955,
-      "src/main/ipc/pty-pending-data-drain-queue.test.ts": 19,
-      "src/main/ipc/pty-pending-data-drain-scheduler-differential.test.ts": 19,
-      "src/main/ipc/pty-pending-output-cap.test.ts": 97,
-      "src/main/ipc/pty-pending-projection-admissions.test.ts": 86,
-      "src/main/ipc/pty-persisted-incarnation-repair.test.ts": 38,
-      "src/main/ipc/pty-producer-flow-control.test.ts": 16,
-      "src/main/ipc/pty-renderer-inflight-credit.test.ts": 156,
-      "src/main/ipc/pty-renderer-lifecycle-delivery-reset.test.ts": 77,
-      "src/main/ipc/pty-renderer-liveness-guard.test.ts": 82,
-      "src/main/ipc/pty-renderer-send-failure-recovery.test.ts": 51,
-      "src/main/ipc/pty-restore-record-seeding.test.ts": 156,
-      "src/main/ipc/pty-restored-appimage-cli-shim-refresh.test.ts": 14,
-      "src/main/ipc/pty-runtime-kill-and-exit.test.ts": 105,
-      "src/main/ipc/pty-runtime-ssh-binding-persistence.test.ts": 40,
-      "src/main/ipc/pty-serializer-settlement-mapping.test.ts": 146,
-      "src/main/ipc/pty-session-liveness-and-ownership.test.ts": 42,
-      "src/main/ipc/pty-spawn-codex-home-unavailable.test.ts": 43,
-      "src/main/ipc/pty-spawn-cwd-fallback.test.ts": 69,
-      "src/main/ipc/pty-spawn-env-agent-overlays.test.ts": 116,
-      "src/main/ipc/pty-spawn-env-codex-home-routing.test.ts": 132,
-      "src/main/ipc/pty-spawn-env-codex-resume-provenance.test.ts": 118,
-      "src/main/ipc/pty-spawn-env-terminal-basics.test.ts": 1128,
-      "src/main/ipc/pty-spawn-runtime-handle-binding.test.ts": 135,
-      "src/main/ipc/pty-ssh-stop-verdict.test.ts": 92,
-      "src/main/ipc/pty-ssh-undelivered-kill.test.ts": 149,
-      "src/main/ipc/pty-startup-barrier-and-listing.test.ts": 60,
-      "src/main/ipc/pty-startup-barrier-ordering.test.ts": 3,
-      "src/main/ipc/pty-startup-swap-window-presence.test.ts": 81,
-      "src/main/ipc/pty-windows-shell-selection.test.ts": 131,
-      "src/main/ipc/pty-write-ipc-validation.test.ts": 125,
-      "src/main/ipc/pty-wsl-cwd-validation.test.ts": 75,
-      "src/main/ipc/pty/delivery/attached-pty-size.test.ts": 13,
-      "src/main/ipc/pty/ipc/spawn-commit-ssh-lease-cardinality.test.ts": 111,
-      "src/main/ipc/pty/ipc/spawn-push-target-materialization-real-git.test.ts": 258,
-      "src/main/ipc/pty/ipc/spawn-push-target-materialization.test.ts": 11,
-      "src/main/ipc/pty/ipc/spawn-reattach-size-cache.test.ts": 14,
-      "src/main/ipc/pty/ipc/write-input-chunk-yield.test.ts": 25,
-      "src/main/ipc/pty/pane/launch-authority.test.ts": 9,
-      "src/main/ipc/pty/pane/stable-pane-absence-death-certificate.test.ts": 26,
-      "src/main/ipc/pty/pane/stable-pane-relay-absence-respawn.test.ts": 14,
-      "src/main/ipc/pty/register-headless-runtime.test.ts": 6,
-      "src/main/ipc/pty/runtime/queried-host-kinds.test.ts": 8,
-      "src/main/ipc/pty/runtime/spawn-commit-pty-size.test.ts": 7,
-      "src/main/ipc/rate-limits.test.ts": 7,
-      "src/main/ipc/readdir-error-diagnostics.test.ts": 10,
-      "src/main/ipc/register-core-handlers/register-core-handlers.test.ts": 20,
-      "src/main/ipc/remote-watcher-event-batch.test.ts": 29,
-      "src/main/ipc/remote-workspace-cache.test.ts": 9,
-      "src/main/ipc/remote-workspace-patch-queue.test.ts": 173,
-      "src/main/ipc/remote-workspace-snapshot-normalization.test.ts": 10,
-      "src/main/ipc/remote-workspace-stale-resync.test.ts": 162,
-      "src/main/ipc/remote-workspace.test.ts": 29,
-      "src/main/ipc/renderer-shutdown-checkpoint.test.ts": 18,
-      "src/main/ipc/renderer-terminal-serializer-readiness.test.ts": 11,
-      "src/main/ipc/repos-add-linked-worktree.test.ts": 46,
-      "src/main/ipc/repos-create.test.ts": 34,
-      "src/main/ipc/repos-execution-host-catalog.test.ts": 22,
-      "src/main/ipc/repos-local-add-and-project-setup.test.ts": 54,
-      "src/main/ipc/repos-local-clone-lifecycle.test.ts": 245,
-      "src/main/ipc/repos-nested-import.test.ts": 51,
-      "src/main/ipc/repos-nested-scan.test.ts": 36,
-      "src/main/ipc/repos-picker.test.ts": 8,
-      "src/main/ipc/repos-remote-base-ref-queries.test.ts": 30,
-      "src/main/ipc/repos-remote-client-events.test.ts": 1415,
-      "src/main/ipc/repos-remote-git-username.test.ts": 6,
-      "src/main/ipc/repos-remote.test.ts": 66,
-      "src/main/ipc/repos-sparse-presets.test.ts": 27,
-      "src/main/ipc/repos/remote-repo-registration.test.ts": 7,
-      "src/main/ipc/rg-availability.test.ts": 9,
-      "src/main/ipc/runtime-environment-browser-client-host-handler.test.ts": 14,
-      "src/main/ipc/runtime-environment-capability-evidence.test.ts": 9,
-      "src/main/ipc/runtime-environment-diagnostics-broadcast.test.ts": 4,
-      "src/main/ipc/runtime-environment-federated-read-routing.test.ts": 34,
-      "src/main/ipc/runtime-environment-federated-read-transport.bench.test.ts": 10,
-      "src/main/ipc/runtime-environment-removal-storage.test.ts": 565,
-      "src/main/ipc/runtime-environment-request-connections.test.ts": 1282,
-      "src/main/ipc/runtime-environment-revision-guard.test.ts": 7,
-      "src/main/ipc/runtime-environment-status-connection.test.ts": 441,
-      "src/main/ipc/runtime-environment-status-recovery.test.ts": 23,
-      "src/main/ipc/runtime-environment-support-routing.test.ts": 62,
-      "src/main/ipc/runtime-environment-transport-routing-tailscale-hint.test.ts": 853,
-      "src/main/ipc/runtime-environments-call-routing.test.ts": 187,
-      "src/main/ipc/runtime-environments-capability-cache.test.ts": 129,
-      "src/main/ipc/runtime-environments-pairing.test.ts": 66,
-      "src/main/ipc/runtime-environments-status-diagnostics.test.ts": 37,
-      "src/main/ipc/runtime-environments-subscription-lifecycle.test.ts": 35,
-      "src/main/ipc/runtime-environments-subscription-routing.test.ts": 26,
-      "src/main/ipc/runtime-environments-subscription-teardown.test.ts": 38,
-      "src/main/ipc/runtime-subscribe-lifecycle.test.ts": 10,
-      "src/main/ipc/runtime-watcher-pending-assignment.test.ts": 281,
-      "src/main/ipc/runtime-watcher-process-pool.test.ts": 46,
-      "src/main/ipc/runtime.test.ts": 23,
-      "src/main/ipc/settings.test.ts": 30,
-      "src/main/ipc/shallow-watch-delivery-probe.test.ts": 28,
-      "src/main/ipc/shell.test.ts": 47,
-      "src/main/ipc/skill-cloud-install-ipc-schemas.test.ts": 13,
-      "src/main/ipc/skill-cloud-ipc-handlers.test.ts": 12,
-      "src/main/ipc/skill-install-management-ipc-handlers.test.ts": 19,
-      "src/main/ipc/skill-install-progress-ipc.test.ts": 7,
-      "src/main/ipc/skill-ipc-main-window.test.ts": 9,
-      "src/main/ipc/skills.test.ts": 17,
-      "src/main/ipc/source-control-ai-linked-issue.test.ts": 14,
-      "src/main/ipc/speech.test.ts": 12,
-      "src/main/ipc/ssh-app-shutdown.test.ts": 45,
-      "src/main/ipc/ssh-browse.test.ts": 586,
-      "src/main/ipc/ssh-disconnect-cancellation.test.ts": 1118,
-      "src/main/ipc/ssh-handler-reregistration.test.ts": 49,
-      "src/main/ipc/ssh-passphrase.test.ts": 6,
-      "src/main/ipc/ssh-pty-closed-generation-ranges.test.ts": 46,
-      "src/main/ipc/ssh-pty-consumer-identity.test.ts": 175,
-      "src/main/ipc/ssh-pty-legacy-projection.test.ts": 18,
-      "src/main/ipc/ssh-pty-model-admission-generation-scope.test.ts": 16,
-      "src/main/ipc/ssh-pty-model-admission.test.ts": 15,
-      "src/main/ipc/ssh-pty-output-exit-deadline.test.ts": 23,
-      "src/main/ipc/ssh-pty-output-generation-guard.test.ts": 10,
-      "src/main/ipc/ssh-pty-output-intake.test.ts": 57,
-      "src/main/ipc/ssh-pty-output-model-migration.test.ts": 25,
-      "src/main/ipc/ssh-pty-remote-source-range-consumers.test.ts": 20,
-      "src/main/ipc/ssh-pty-source-ack-coalescer.test.ts": 14,
-      "src/main/ipc/ssh-pty-source-ack-session-contract.test.ts": 13,
-      "src/main/ipc/ssh-pty-source-obligation-coordinator.test.ts": 14,
-      "src/main/ipc/ssh-pty-source-obligation-ledger.test.ts": 82,
-      "src/main/ipc/ssh-relay-reset-resume.test.ts": 908,
-      "src/main/ipc/ssh-state-broadcast-fanout.test.ts": 25,
-      "src/main/ipc/ssh-target-registry.test.ts": 1633,
-      "src/main/ipc/ssh-terminate-sessions.test.ts": 144,
-      "src/main/ipc/ssh.test.ts": 61,
-      "src/main/ipc/telemetry.test.ts": 13,
-      "src/main/ipc/terminal-git-credential-guard.test.ts": 13,
-      "src/main/ipc/terminal-preview-output-stream.test.ts": 9,
-      "src/main/ipc/terminal-preview.test.ts": 155,
-      "src/main/ipc/terminal-render-desync-evidence.test.ts": 35,
-      "src/main/ipc/tui-agent-detection-commands.test.ts": 5,
-      "src/main/ipc/ui.test.ts": 12,
-      "src/main/ipc/usage-provider-handlers.test.ts": 6,
-      "src/main/ipc/watched-worktree-catalog-notification.test.ts": 7,
-      "src/main/ipc/watcher-event-root-path-rewrite.test.ts": 18,
-      "src/main/ipc/watcher-removal-gate.test.ts": 12,
-      "src/main/ipc/workspace-cleanup-activity.test.ts": 33,
-      "src/main/ipc/workspace-cleanup-broad-scan.test.ts": 55,
-      "src/main/ipc/workspace-cleanup-execution-host-routing.test.ts": 28,
-      "src/main/ipc/workspace-cleanup-local-git-routing.test.ts": 9,
-      "src/main/ipc/workspace-cleanup-snapshot-ipc.test.ts": 33,
-      "src/main/ipc/workspace-cleanup.test.ts": 4276,
-      "src/main/ipc/workspace-create-error-classifier.test.ts": 10,
-      "src/main/ipc/workspace-ports.test.ts": 21,
-      "src/main/ipc/workspace-space.test.ts": 18,
-      "src/main/ipc/worktree-base-directory-change-collector.test.ts": 8,
-      "src/main/ipc/worktree-base-directory-event-filter.test.ts": 18,
-      "src/main/ipc/worktree-base-directory-poller-marker-fanout.test.ts": 142,
-      "src/main/ipc/worktree-base-directory-poller.test.ts": 2628,
-      "src/main/ipc/worktree-base-directory-watch-targets.test.ts": 319,
-      "src/main/ipc/worktree-base-directory-watcher.test.ts": 109,
-      "src/main/ipc/worktree-create-lineage.test.ts": 16,
-      "src/main/ipc/worktree-folder-rename-target.test.ts": 8,
-      "src/main/ipc/worktree-git-common-polling.test.ts": 1088,
-      "src/main/ipc/worktree-git-common-watch.test.ts": 2677,
-      "src/main/ipc/worktree-git-status-ref-watch.test.ts": 10,
-      "src/main/ipc/worktree-head-identity-reader-concurrency.test.ts": 29,
-      "src/main/ipc/worktree-head-identity-reader-incremental.test.ts": 104,
-      "src/main/ipc/worktree-head-identity-reader.test.ts": 38,
-      "src/main/ipc/worktree-head-identity-refresh.test.ts": 28,
-      "src/main/ipc/worktree-include-copy-budget.test.ts": 53,
-      "src/main/ipc/worktree-logic-created-agent.test.ts": 5,
-      "src/main/ipc/worktree-logic-wsl.test.ts": 21,
-      "src/main/ipc/worktree-logic.test.ts": 53,
-      "src/main/ipc/worktree-metadata-merge.test.ts": 5,
-      "src/main/ipc/worktree-path-deduplication.test.ts": 34,
-      "src/main/ipc/worktree-push-target-cleanup.test.ts": 20,
-      "src/main/ipc/worktree-push-target-reconciliation-real-git.test.ts": 930,
-      "src/main/ipc/worktree-push-target-reconciliation.test.ts": 19,
-      "src/main/ipc/worktree-push-target-refspec-migration.test.ts": 11,
-      "src/main/ipc/worktree-push-target-refspec-real-git.test.ts": 2112,
-      "src/main/ipc/worktree-push-target-remote-scan.test.ts": 14,
-      "src/main/ipc/worktree-push-target-setup.test.ts": 16,
-      "src/main/ipc/worktree-remote-push-target-materialization.test.ts": 31,
-      "src/main/ipc/worktree-remote-ssh-branch-conflict.test.ts": 11,
-      "src/main/ipc/worktree-symlink-reconciliation.real.test.ts": 49,
-      "src/main/ipc/worktree-symlinks.test.ts": 123,
-      "src/main/ipc/worktree-watcher-removal-binding.test.ts": 78,
-      "src/main/ipc/worktrees-authoritative-local-metadata-pruning.test.ts": 210,
-      "src/main/ipc/worktrees-create-execution-host-routing.test.ts": 45,
-      "src/main/ipc/worktrees-create-metadata-persistence.test.ts": 60,
-      "src/main/ipc/worktrees-delete-pty-teardown.test.ts": 53,
-      "src/main/ipc/worktrees-detected-scan-cache.test.ts": 97,
-      "src/main/ipc/worktrees-discovery-metadata-backfill.test.ts": 51,
-      "src/main/ipc/worktrees-existing-branch-checkout.test.ts": 71,
-      "src/main/ipc/worktrees-forget-local.test.ts": 39,
-      "src/main/ipc/worktrees-issue-command-overrides.test.ts": 25,
-      "src/main/ipc/worktrees-lineage-hydration.test.ts": 33,
-      "src/main/ipc/worktrees-listing-fallback-rows.test.ts": 39,
-      "src/main/ipc/worktrees-local-base-ref-resolution.test.ts": 82,
-      "src/main/ipc/worktrees-local-create-flow.test.ts": 76,
-      "src/main/ipc/worktrees-orphan-directory-cleanup.test.ts": 35,
-      "src/main/ipc/worktrees-preserved-branch-fork-remote.test.ts": 28,
-      "src/main/ipc/worktrees-removal-recovery.test.ts": 75,
-      "src/main/ipc/worktrees-remove-archive-hooks.test.ts": 35,
-      "src/main/ipc/worktrees-remove-host-disambiguation.test.ts": 32,
-      "src/main/ipc/worktrees-remove-preflight.test.ts": 33,
-      "src/main/ipc/worktrees-setup-launch-sparse-checkout.test.ts": 57,
-      "src/main/ipc/worktrees-ssh-base-ref-resolution.test.ts": 61,
-      "src/main/ipc/worktrees-ssh-branch-conflict-suffixing.test.ts": 51,
-      "src/main/ipc/worktrees-ssh-create-base-prefetch.test.ts": 124,
-      "src/main/ipc/worktrees-ssh-fork-push-target-remote.test.ts": 73,
-      "src/main/ipc/worktrees-ssh-local-base-refresh.test.ts": 86,
-      "src/main/ipc/worktrees-ssh-pr-head-fetch.test.ts": 43,
-      "src/main/ipc/worktrees-ssh-provider-authority.test.ts": 35,
-      "src/main/ipc/worktrees-ssh-repo-owner-resolution.test.ts": 42,
-      "src/main/ipc/worktrees-ssh-setup-launch.test.ts": 48,
-      "src/main/ipc/worktrees-windows.test.ts": 72,
-      "src/main/ipc/worktrees-wsl-runtime-routing.test.ts": 84,
-      "src/main/ipc/worktrees/listing/detected-provider-listing-meta-index.test.ts": 19,
-      "src/main/ipc/worktrees/listing/detected-scan-failure-authority.test.ts": 29,
-      "src/main/ipc/worktrees/listing/detected-worktree-classification.test.ts": 21,
-      "src/main/ipc/worktrees/listing/detected-worktree-scan-hygiene-gate.test.ts": 13,
-      "src/main/ipc/worktrees/listing/register-sparse-checkout-cache-invalidation.test.ts": 9,
-      "src/main/jira/adf-markdown.test.ts": 10,
-      "src/main/jira/attachment-image-cache-generation.test.ts": 11,
-      "src/main/jira/attachment-image-cache.test.ts": 9,
-      "src/main/jira/attachment-images.test.ts": 31,
-      "src/main/jira/client.test.ts": 302,
-      "src/main/jira/issues.test.ts": 62,
-      "src/main/jira/jira-issue-mutations.test.ts": 29,
-      "src/main/jira/jira-issue-summary-timeout.test.ts": 33,
-      "src/main/jira/jira-search-abort.test.ts": 24,
-      "src/main/keybindings/keybinding-file.test.ts": 53,
-      "src/main/keybindings/keybinding-service.test.ts": 39,
-      "src/main/kimi/hook-service.test.ts": 8,
-      "src/main/kimi/kimi-hook-config-toml.test.ts": 25,
-      "src/main/kimi/kimi-runtime-home.test.ts": 15,
-      "src/main/lib/unread-response-body.test.ts": 51,
-      "src/main/line-editor-ready-output-scanner.test.ts": 7,
-      "src/main/linear/client.test.ts": 97,
-      "src/main/linear/issue-context-client.test.ts": 23,
-      "src/main/linear/issue-context-current.test.ts": 6,
-      "src/main/linear/issue-context-errors.test.ts": 6,
-      "src/main/linear/issue-context-includes.test.ts": 27,
-      "src/main/linear/issue-context-inline-media.test.ts": 6,
-      "src/main/linear/issue-context-relations.test.ts": 10,
-      "src/main/linear/issue-context.test.ts": 16,
-      "src/main/linear/issue-list-filter.test.ts": 8,
-      "src/main/linear/issue-relation-write.test.ts": 19,
-      "src/main/linear/issue-search-summary.test.ts": 6,
-      "src/main/linear/issues.test.ts": 41,
-      "src/main/linear/mappers.test.ts": 8,
-      "src/main/linear/mcp-issue-list-pagination.test.ts": 56,
-      "src/main/linear/mcp-issue-list.test.ts": 93,
-      "src/main/linear/projects.test.ts": 306,
-      "src/main/linear/teams.test.ts": 20,
-      "src/main/linux-lid-sleep-assertion.test.ts": 14,
-      "src/main/linux-package-install-command.test.ts": 36,
-      "src/main/linux-package-install-diagnostic.test.ts": 17,
-      "src/main/linux-package-update-recovery.test.ts": 178,
-      "src/main/linux-update-package-type.test.ts": 86,
-      "src/main/local-builds/local-build-candidate.test.ts": 107,
-      "src/main/local-builds/local-build-compatibility-contract.test.ts": 6,
-      "src/main/local-builds/local-build-feed-server.test.ts": 68,
-      "src/main/local-downloaded-folder-promotion.test.ts": 101,
-      "src/main/local-worktree-filesystem.test.ts": 269,
-      "src/main/local-worktree-metadata-prune-gate.test.ts": 9,
-      "src/main/local-worktree-path-presence.test.ts": 18,
-      "src/main/local-worktree-removal-recovery.test.ts": 22,
-      "src/main/localhost-worktree-label-proxy.test.ts": 72,
-      "src/main/macos-full-disk-access-status.test.ts": 8,
-      "src/main/macos-press-and-hold-default.test.ts": 13,
-      "src/main/macos-system-sleep-assertion.test.ts": 20,
-      "src/main/macos-tcc-prompt-notice.test.ts": 16,
-      "src/main/macos-tcc-prompt-watch.test.ts": 22,
-      "src/main/main-process-tree-kill-gate.test.ts": 7,
-      "src/main/memory/collector-windows-sweep.test.ts": 198,
-      "src/main/memory/collector.test.ts": 239,
-      "src/main/memory/host-memory.test.ts": 21,
-      "src/main/memory/hydrate-local-pty-registry.test.ts": 873,
-      "src/main/memory/process-memory-metric.test.ts": 6,
-      "src/main/memory/windows-process-sample-parsing.test.ts": 86,
-      "src/main/menu/gpu-acceleration-about-panel.test.ts": 9,
-      "src/main/menu/register-app-menu.test.ts": 21,
-      "src/main/mimo/hook-service.test.ts": 11,
-      "src/main/minimax/minimax-api-key-store.test.ts": 30,
-      "src/main/minimax/minimax-cookie-store.test.ts": 38,
-      "src/main/native-chat/agent-session-journal/journal-corruption-repair.test.ts": 293,
-      "src/main/native-chat/agent-session-journal/journal-crash-boundary.test.ts": 97,
-      "src/main/native-chat/agent-session-journal/journal-cursor.test.ts": 9,
-      "src/main/native-chat/agent-session-journal/journal-database.test.ts": 95,
-      "src/main/native-chat/agent-session-journal/journal-epoch-replacement.test.ts": 38,
-      "src/main/native-chat/agent-session-journal/journal-file-format-remnant.test.ts": 94,
-      "src/main/native-chat/agent-session-journal/journal-handle-ownership.test.ts": 7709,
-      "src/main/native-chat/agent-session-journal/journal-item-identity.test.ts": 10,
-      "src/main/native-chat/agent-session-journal/journal-legacy-import.test.ts": 181,
-      "src/main/native-chat/agent-session-journal/journal-reducer.test.ts": 45,
-      "src/main/native-chat/agent-session-journal/journal-row-schema-version.test.ts": 28,
-      "src/main/native-chat/agent-session-journal/journal-row-schema.test.ts": 32,
-      "src/main/native-chat/agent-session-journal/journal-row-writer.test.ts": 28,
-      "src/main/native-chat/agent-session-journal/journal-store-close.test.ts": 85,
-      "src/main/native-chat/agent-session-journal/journal-store-schema.test.ts": 85,
-      "src/main/native-chat/agent-session-journal/journal-store.test.ts": 290,
-      "src/main/native-chat/agent-session-journal/journal-subagent-liveness.test.ts": 835,
-      "src/main/native-chat/agent-session-wire/agent-session-delta-coalescer-protected.test.ts": 46,
-      "src/main/native-chat/agent-session-wire/agent-session-delta-coalescer.test.ts": 20,
-      "src/main/native-chat/agent-session-wire/agent-session-history-forward-read-budget.test.ts": 477,
-      "src/main/native-chat/agent-session-wire/agent-session-history-page-grouping-parity.test.ts": 253,
-      "src/main/native-chat/agent-session-wire/agent-session-history-page-scaling.test.ts": 17,
-      "src/main/native-chat/agent-session-wire/agent-session-history-page.test.ts": 1870,
-      "src/main/native-chat/agent-session-wire/agent-session-journal-recovery.test.ts": 178,
-      "src/main/native-chat/agent-session-wire/provider-frame-activity.test.ts": 10,
-      "src/main/native-chat/agent-session-wire/provider-frame-disposition.test.ts": 15,
-      "src/main/native-chat/agent-session-wire/provider-turn-activity-routing.test.ts": 22,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-acquisition-options.test.ts": 564,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-adapter-router.test.ts": 15,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-adapter.test.ts": 14,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-adopted-import.test.ts": 165,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-claude-options-round-trip.test.ts": 248,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-close-retry.test.ts": 52,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-command-publication.test.ts": 45,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-event-sink.test.ts": 24,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-eviction.test.ts": 16,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-forget-status.test.ts": 30,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-grouped-prompt.test.ts": 68,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-handoff-flow-runner.test.ts": 99,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-handoff-operation-guard.test.ts": 144,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-handoff-options.test.ts": 587,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-handoff-owner-close.test.ts": 5,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-handoff-reverse.test.ts": 6,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-handoff.test.ts": 207,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-holds.test.ts": 215,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-host-handoff.test.ts": 103,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-host-runtime-state.test.ts": 7,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-host.test.ts": 1194,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-journal-handles.test.ts": 66,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-late-settlement.test.ts": 832,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-launch-env.test.ts": 7,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-lease-renewer.test.ts": 156,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-live-tui-restart-survival.test.ts": 431,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-option-settlement.test.ts": 189,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-processless-reservation.test.ts": 115,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-proven-dead-retry.test.ts": 130,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-provider-restore.test.ts": 288,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-read-restore.test.ts": 290,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-readable-restorer.test.ts": 7,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-recovery-exits.test.ts": 361,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-recovery-resolution.test.ts": 180,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-refusal-retry.test.ts": 8912,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-restart-reconcile.test.ts": 6,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-restart-restore-gate.test.ts": 6,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-restart-restore.test.ts": 59,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-restart-status-publication.test.ts": 137,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-reveal.test.ts": 19,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-rewind.test.ts": 1652,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-send-idempotency.test.ts": 34,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-send-settlement.test.ts": 20,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-send.test.ts": 515,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-settled-attach-retry.test.ts": 304,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-stale-turn-verdict.test.ts": 13,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-status-feed.test.ts": 581,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-subscribers.test.ts": 314,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-surface-lifetime.test.ts": 1169,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-task-queue.test.ts": 64,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-teardown-handoff-drain.test.ts": 251,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-turns.test.ts": 47,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-unexpected-exit.test.ts": 15,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-wedged-profile-migration.test.ts": 985,
-      "src/main/native-chat/agent-session-wire/structured-agent-session-wire-admission.test.ts": 569,
-      "src/main/native-chat/agent-session-wire/structured-conversation-command-admission.test.ts": 6,
-      "src/main/native-chat/agent-session-wire/structured-conversation-command.test.ts": 831,
-      "src/main/native-chat/agent-session-wire/structured-conversation-replacements.test.ts": 8,
-      "src/main/native-chat/agent-session-wire/structured-rewind-claude-proof.test.ts": 9,
-      "src/main/native-chat/agent-session-wire/structured-rewind-journal-body.test.ts": 16,
-      "src/main/native-chat/agent-session-wire/structured-session-compaction.test.ts": 21,
-      "src/main/native-chat/agent-session-wire/structured-tui-transcript-catchup.test.ts": 420,
-      "src/main/native-chat/agent-session-wire/unhandled-provider-frame.test.ts": 21,
-      "src/main/native-chat/claude-structured-managed-account-support.test.ts": 11,
-      "src/main/native-chat/host-readable-transcript-path-fs-gate.test.ts": 213,
-      "src/main/native-chat/host-readable-transcript-path.test.ts": 20,
-      "src/main/native-chat/native-chat-file-provenance.test.ts": 10,
-      "src/main/native-chat/session-file-resolver-claude-roots.test.ts": 6,
-      "src/main/native-chat/session-file-resolver-codex-roots.test.ts": 4,
-      "src/main/native-chat/session-file-resolver-wsl-scan-gate.test.ts": 21,
-      "src/main/native-chat/session-file-resolver-wsl.test.ts": 21,
-      "src/main/native-chat/session-file-resolver.test.ts": 87,
-      "src/main/native-chat/structured-agent-session-create-support.test.ts": 8,
-      "src/main/native-chat/structured-agent-session-history-adoption.test.ts": 9,
-      "src/main/native-chat/subagent-entry-id-bounds.test.ts": 7,
-      "src/main/native-chat/transcript-fallback-id.test.ts": 6,
-      "src/main/native-chat/transcript-interruption-message.test.ts": 7,
-      "src/main/native-chat/transcript-line-decoders-claude-control-bytes.test.ts": 7,
-      "src/main/native-chat/transcript-line-decoders-claude-image-companion.test.ts": 6,
-      "src/main/native-chat/transcript-line-decoders-codex-skill-context.test.ts": 12,
-      "src/main/native-chat/transcript-line-decoders.grok.test.ts": 13,
-      "src/main/native-chat/transcript-line-decoders.omp.test.ts": 21,
-      "src/main/native-chat/transcript-read-cache-refusal-recovery.test.ts": 31,
-      "src/main/native-chat/transcript-read-cache-wsl-stall.test.ts": 14,
-      "src/main/native-chat/transcript-read-cache.test.ts": 55,
-      "src/main/native-chat/transcript-reader-codex-history-mode.test.ts": 21,
-      "src/main/native-chat/transcript-reader-wsl-stall.test.ts": 20,
-      "src/main/native-chat/transcript-reader.test.ts": 31,
-      "src/main/native-chat/transcript-stream-lines.test.ts": 8,
-      "src/main/native-chat/transcript-tail-reader-cancellation.test.ts": 115,
-      "src/main/native-chat/transcript-tail-reader-wsl-gate.test.ts": 17,
-      "src/main/native-chat/transcript-turn-lifecycle.test.ts": 11,
-      "src/main/native-chat/transcript-watch-engine-wsl-lifecycle.test.ts": 71,
-      "src/main/native-chat/transcript-watch-error.test.ts": 2068,
-      "src/main/native-chat/transcript-watch-liveness.test.ts": 639,
-      "src/main/native-chat/transcript-watch-resolve-poll.test.ts": 82,
-      "src/main/native-chat/transcript-watch-unflushed-settle.test.ts": 94,
-      "src/main/native-chat/transcript-watch-unsubscribe-race.test.ts": 26,
-      "src/main/native-chat/transcript-watch-wsl-exact-path.test.ts": 21,
-      "src/main/native-chat/transcript-watch-wsl-stall.test.ts": 21,
-      "src/main/native-chat/transcript-watch.test.ts": 3183,
-      "src/main/native-chat/transcript-window-tool-attribution.test.ts": 13,
-      "src/main/native-chat/wsl-codex-session-path-scan.test.ts": 24,
-      "src/main/native-chat/wsl-transcript-fs-access.test.ts": 29,
-      "src/main/native-chat/wsl-transcript-fs-gate.test.ts": 463,
-      "src/main/native-chat/wsl-transcript-fs-process-client.test.ts": 33,
-      "src/main/native-chat/wsl-transcript-fs-process-operations.test.ts": 5,
-      "src/main/native-chat/wsl-transcript-fs-route-quarantine.test.ts": 22,
-      "src/main/native-chat/wsl-transcript-fs-route.test.ts": 6,
-      "src/main/native-chat/wsl-transcript-running-observer.test.ts": 65,
-      "src/main/network/electron-proxy-request-guard.test.ts": 314,
-      "src/main/network/macos-system-resolver-health.test.ts": 18,
-      "src/main/network/macos-tailscale-dns-diagnostic.test.ts": 8,
-      "src/main/network/proxy-settings-session.test.ts": 779,
-      "src/main/network/proxy-settings.test.ts": 67,
-      "src/main/notifications/desktop-away-state.test.ts": 6,
-      "src/main/observability/architecture.test.ts": 10,
-      "src/main/observability/bundle.test.ts": 294,
-      "src/main/observability/diagnostic-upload-http.test.ts": 8,
-      "src/main/observability/instrumentation.test.ts": 252,
-      "src/main/observability/local-file-sink-memory.test.ts": 126,
-      "src/main/observability/local-file-sink.test.ts": 27,
-      "src/main/observability/redactor-environment-lines.test.ts": 486,
-      "src/main/observability/redactor.test.ts": 27,
-      "src/main/observability/tracer.test.ts": 27,
-      "src/main/opencode-usage/scanner-windows-data-directory.test.ts": 23,
-      "src/main/opencode-usage/scanner-wsl-gate.test.ts": 18,
-      "src/main/opencode-usage/scanner.test.ts": 224,
-      "src/main/opencode-usage/store.test.ts": 28,
-      "src/main/opencode/hook-plugin-background-child-completion.test.ts": 197,
-      "src/main/opencode/hook-plugin-child-attention.test.ts": 421,
-      "src/main/opencode/hook-plugin-fail-open-ownership.test.ts": 460,
-      "src/main/opencode/hook-plugin-lifecycle-delivery.test.ts": 591,
-      "src/main/opencode/hook-plugin-message-part-throttle.test.ts": 137,
-      "src/main/opencode/hook-plugin-module-contract.test.ts": 146,
-      "src/main/opencode/hook-service.test.ts": 50,
-      "src/main/opencode/opencode-data-directory.test.ts": 6,
-      "src/main/orca-profiles/profile-artifact-cloud-cleanup.test.ts": 142,
-      "src/main/orca-profiles/profile-cloud-auth-config.test.ts": 7,
-      "src/main/orca-profiles/profile-cloud-auth-status.test.ts": 7,
-      "src/main/orca-profiles/profile-cloud-client.test.ts": 73,
-      "src/main/orca-profiles/profile-cloud-dev-service.test.ts": 52,
-      "src/main/orca-profiles/profile-cloud-org-members-client.test.ts": 9,
-      "src/main/orca-profiles/profile-cloud-org-members-service.test.ts": 33,
-      "src/main/orca-profiles/profile-cloud-pkce.test.ts": 184,
-      "src/main/orca-profiles/profile-cloud-service-auth-retry.test.ts": 42,
-      "src/main/orca-profiles/profile-cloud-service-refresh.test.ts": 148,
-      "src/main/orca-profiles/profile-cloud-service.test.ts": 45,
-      "src/main/orca-profiles/profile-cloud-session-mutation.test.ts": 14,
-      "src/main/orca-profiles/profile-cloud-session-refresh.test.ts": 12,
-      "src/main/orca-profiles/profile-cloud-session-store.test.ts": 71,
-      "src/main/orca-profiles/profile-index-store.test.ts": 188,
-      "src/main/orca-profiles/profile-project-presence.test.ts": 59,
-      "src/main/orca-profiles/profile-project-session-field-disposition.test.ts": 9,
-      "src/main/orca-profiles/profile-project-session-state.test.ts": 13,
-      "src/main/orca-profiles/profile-project-state-file.test.ts": 7,
-      "src/main/orca-profiles/profile-project-transfer.test.ts": 238,
-      "src/main/orca-profiles/profile-ui-scope.test.ts": 4,
-      "src/main/orcad/electron-serve-browser-process.test.ts": 2342,
-      "src/main/orcad/electron-serve-provider-selection.test.ts": 427,
-      "src/main/orcad/electron-sidecar-method-routing.test.ts": 7,
-      "src/main/orcad/electron-sidecar-tab-registry.test.ts": 12,
-      "src/main/orcad/external-chromium-browser-session.test.ts": 16,
-      "src/main/orcad/main-preflight-order.test.ts": 8,
-      "src/main/orcad/native-host-abi.test.ts": 15,
-      "src/main/orcad/node-pty-prebuilt-slot.test.ts": 12,
-      "src/main/orcad/node-pty-precondition.test.ts": 290,
-      "src/main/orcad/orcad-app-paths.test.ts": 10,
-      "src/main/orcad/orcad-bind-address.test.ts": 11,
-      "src/main/orcad/orcad-browser-provider.test.ts": 53,
-      "src/main/orcad/orcad-bundle-native-load-order.test.ts": 3283,
-      "src/main/orcad/orcad-daemon-supervision.test.ts": 10,
-      "src/main/orcad/orcad-forked-child-paths.test.ts": 8,
-      "src/main/orcad/orcad-health.test.ts": 10,
-      "src/main/orcad/orcad-instance-lock.test.ts": 15,
-      "src/main/orcad/orcad-launch-contract.test.ts": 13,
-      "src/main/orcad/orcad-native-preflight.test.ts": 6,
-      "src/main/orcad/orcad-push-startup.test.ts": 704,
-      "src/main/own-chromium-tree-kill-guard.test.ts": 20,
-      "src/main/persistence-async-write-syscalls.test.ts": 5455,
-      "src/main/persistence-automations.test.ts": 593,
-      "src/main/persistence-clipboard-selection-migration.test.ts": 65,
-      "src/main/persistence-cohort-and-identity-migration.test.ts": 67,
-      "src/main/persistence-cross-host-pane-identity.test.ts": 36,
-      "src/main/persistence-deregistered-repo-residue.test.ts": 132,
-      "src/main/persistence-duplicate-repo-id-host-scope.test.ts": 792,
-      "src/main/persistence-feature-interaction-broadcast.benchmark.test.ts": 126,
-      "src/main/persistence-floating-terminal-trust.test.ts": 91,
-      "src/main/persistence-flush-and-save-scheduling.test.ts": 226,
-      "src/main/persistence-folder-workspace-notes.test.ts": 124,
-      "src/main/persistence-host-admitted-terminal-membership.test.ts": 32,
-      "src/main/persistence-host-partitioned-sessions.test.ts": 173,
-      "src/main/persistence-host-partitioned-ssh-pty-bindings.test.ts": 31,
-      "src/main/persistence-initial-load.test.ts": 171,
-      "src/main/persistence-layout-binding-recovery.test.ts": 46,
-      "src/main/persistence-load-repair-durability.test.ts": 65,
-      "src/main/persistence-loading-store-extraction.test.ts": 93,
-      "src/main/persistence-loading-store-write-risks.test.ts": 34,
-      "src/main/persistence-native-chat-tab-view-mode.test.ts": 17,
-      "src/main/persistence-pane-identity-migration.test.ts": 27776,
-      "src/main/persistence-protected-secret-fail-closed.test.ts": 2755,
-      "src/main/persistence-protected-secret-write-race.test.ts": 698,
-      "src/main/persistence-proxy-secret-recovery.test.ts": 1089,
-      "src/main/persistence-pty-binding-leaf-tab-resolution.test.ts": 33,
-      "src/main/persistence-pty-binding-reconciliation.test.ts": 54,
-      "src/main/persistence-remote-session-startup.test.ts": 58,
-      "src/main/persistence-repo-lifecycle.test.ts": 807,
-      "src/main/persistence-right-sidebar-tab.test.ts": 7,
-      "src/main/persistence-settings-ui-defaults.test.ts": 137,
-      "src/main/persistence-settings-update.test.ts": 124,
-      "src/main/persistence-single-serialize.test.ts": 1727,
-      "src/main/persistence-source-control-ai-migration.test.ts": 108,
-      "src/main/persistence-split-pane-incarnation.test.ts": 65,
-      "src/main/persistence-ssh-lease-reattach-reclaim.test.ts": 46,
-      "src/main/persistence-ssh-lease-tombstone-retention.test.ts": 44,
-      "src/main/persistence-ssh-pending-pty-kill.test.ts": 570,
-      "src/main/persistence-ssh-readoption-automation-migration.test.ts": 1520,
-      "src/main/persistence-ssh-remote-pty-binding-replay.test.ts": 41,
-      "src/main/persistence-ssh-remote-pty-leases.test.ts": 129,
-      "src/main/persistence-ssh-targets-and-pane-keys.test.ts": 72,
-      "src/main/persistence-terminal-option-key-migration.test.ts": 47,
-      "src/main/persistence-ui-state.test.ts": 3109,
-      "src/main/persistence-update-repo.test.ts": 252,
-      "src/main/persistence-workspace-pinned-automation-fence.test.ts": 1660,
-      "src/main/persistence-workspace-repin-automation-owner.test.ts": 1100,
-      "src/main/persistence-workspace-session-scrollback.test.ts": 101,
-      "src/main/persistence-workspace-status-workflow.test.ts": 67,
-      "src/main/persistence-worktree-card-properties.test.ts": 43,
-      "src/main/persistence-worktree-deletion-fencing.test.ts": 88,
-      "src/main/persistence-worktree-lineage-and-backups.test.ts": 499,
-      "src/main/persistence-worktree-meta-and-folder-workspaces.test.ts": 83,
-      "src/main/persistence-worktree-name-retirement.test.ts": 3387,
-      "src/main/persistence-worktree-visibility.test.ts": 100,
-      "src/main/persistence/applying-settings/settings-update-terminal-contrast.test.ts": 8,
-      "src/main/persistence/applying-settings/terminal-settings-migrations.test.ts": 4,
-      "src/main/persistence/leasing-ssh-ptys/ssh-pty-binding-cleanup.test.ts": 22,
-      "src/main/persistence/loading-store/metadata-lineage-batch-pruning.test.ts": 46,
-      "src/main/persistence/loading-store/normalize-loaded-global-settings.test.ts": 17,
-      "src/main/persistence/loading-store/normalize-loaded-project-catalog.test.ts": 12,
-      "src/main/persistence/loading-store/persisted-state-redundancy.test.ts": 461,
-      "src/main/persistence/loading-store/secret-sentinel-substitution.test.ts": 14,
-      "src/main/persistence/loading-store/state-write-round-trip.test.ts": 72,
-      "src/main/persistence/loading-store/store-prune-gate-signals.test.ts": 32,
-      "src/main/persistence/loading-store/store-runtime-authored-session-writes.test.ts": 29,
-      "src/main/persistence/loading-store/workspace-session-partitions.test.ts": 16,
-      "src/main/persistence/loading-store/workspace-session-terminal-binding-replay.test.ts": 13,
-      "src/main/persistence/loading-store/worktree-meta-alias-projection.test.ts": 345,
-      "src/main/persistence/loading-store/worktree-meta-write-normalization.test.ts": 8,
-      "src/main/persistence/restoring-sessions/pane-alias-normalization-scaling.test.ts": 11,
-      "src/main/persistence/restoring-sessions/pane-alias-normalization.test.ts": 6,
-      "src/main/persistence/restoring-sessions/pane-key-remapping.test.ts": 9,
-      "src/main/persistence/restoring-sessions/session-owner-fields.test.ts": 10,
-      "src/main/persistence/restoring-sessions/session-worktree-ownership.test.ts": 21,
-      "src/main/persistence/restoring-sessions/terminal-layout-normalization.test.ts": 6,
-      "src/main/persistence/restoring-sessions/workspace-pane-normalization-index.test.ts": 10,
-      "src/main/persistence/runtime-authored-workspace-session-fields.test.ts": 5,
-      "src/main/persistence/scheduling-automations/automation-run-operations.test.ts": 16,
-      "src/main/persistence/tracking-repos/local-worktree-metadata-scan-expectation.test.ts": 21,
-      "src/main/persistence/tracking-repos/missing-local-worktree-metadata-pruning.test.ts": 107,
-      "src/main/persistence/tracking-repos/probeable-local-worktree-metadata-candidates.test.ts": 13,
-      "src/main/persistence/tracking-repos/project-host-compatibility.test.ts": 11,
-      "src/main/persistence/tracking-repos/worktree-metadata-normalization.test.ts": 9,
-      "src/main/pi/agent-status-extension-omp-lifecycle.test.ts": 839,
-      "src/main/pi/agent-status-extension-source.test.ts": 1483,
-      "src/main/pi/agent-status-omp-approval-forwarding.test.ts": 487,
-      "src/main/pi/agent-status-owner-recovery.test.ts": 432,
-      "src/main/pi/agent-status-ui-prompt.test.ts": 623,
-      "src/main/pi/titlebar-extension-overlay-path.test.ts": 9,
-      "src/main/pi/titlebar-extension-service.test.ts": 147,
-      "src/main/pi/titlebar-extension-source.test.ts": 618,
-      "src/main/plugins/plugin-atomic-file-write.test.ts": 1988,
-      "src/main/plugins/plugin-audit-log-scaling.test.ts": 412,
-      "src/main/plugins/plugin-audit-log.test.ts": 17,
-      "src/main/plugins/plugin-bundled-bootstrap-coordinator.test.ts": 62,
-      "src/main/plugins/plugin-bundled-bootstrap.test.ts": 104,
-      "src/main/plugins/plugin-command-registry.test.ts": 32,
-      "src/main/plugins/plugin-content-pack-registry.test.ts": 30,
-      "src/main/plugins/plugin-content-safety.test.ts": 66,
-      "src/main/plugins/plugin-dev-watcher.test.ts": 106,
-      "src/main/plugins/plugin-discovery.test.ts": 40,
-      "src/main/plugins/plugin-enablement.test.ts": 14,
-      "src/main/plugins/plugin-host-conformance.test.ts": 30,
-      "src/main/plugins/plugin-host-methods.test.ts": 22,
-      "src/main/plugins/plugin-host-process.test.ts": 13,
-      "src/main/plugins/plugin-host-runtime.test.ts": 11,
-      "src/main/plugins/plugin-install-trust.test.ts": 51,
-      "src/main/plugins/plugin-install.test.ts": 334,
-      "src/main/plugins/plugin-kill-list-content-revocation.test.ts": 52,
-      "src/main/plugins/plugin-kill-list-service.test.ts": 68,
-      "src/main/plugins/plugin-language-pack-registry.test.ts": 22,
-      "src/main/plugins/plugin-launch-content.test.ts": 84,
-      "src/main/plugins/plugin-list-projection.test.ts": 15,
-      "src/main/plugins/plugin-marketplace-installer.test.ts": 98,
-      "src/main/plugins/plugin-marketplace-service.test.ts": 136,
-      "src/main/plugins/plugin-marketplace-store.test.ts": 241,
-      "src/main/plugins/plugin-panel-controller.test.ts": 25,
-      "src/main/plugins/plugin-panel-navigation-guard.test.ts": 7,
-      "src/main/plugins/plugin-panel-owner-lifecycle.test.ts": 4,
-      "src/main/plugins/plugin-panel-sessions.test.ts": 7,
-      "src/main/plugins/plugin-private-marketplace.integration.test.ts": 321,
-      "src/main/plugins/plugin-secrets-store.test.ts": 33,
-      "src/main/plugins/plugin-service-integrity.test.ts": 70,
-      "src/main/plugins/plugin-service-reconciliation.test.ts": 314,
-      "src/main/plugins/plugin-startup-budget.test.ts": 373,
-      "src/main/plugins/plugin-storage-store.test.ts": 8,
-      "src/main/plugins/plugin-vm-recipe-registry.test.ts": 40,
-      "src/main/plugins/plugin-worker-controller.test.ts": 77,
-      "src/main/plugins/plugin-worker-env.test.ts": 6,
-      "src/main/plugins/plugin-worker-manager.test.ts": 17,
-      "src/main/plugins/plugin-worker-output-buffer.test.ts": 12,
-      "src/main/plugins/plugin-worker-supervision.integration.test.ts": 8191,
-      "src/main/ports/advertised-url-watcher-pid-validation.test.ts": 10,
-      "src/main/ports/advertised-url-watcher.test.ts": 22,
-      "src/main/ports/local-workspace-port-scanner.test.ts": 44,
-      "src/main/ports/port-scan-command-client.test.ts": 1741,
-      "src/main/ports/port-scan-command-execution.test.ts": 5223,
-      "src/main/ports/port-scan-command-import-boundary.test.ts": 6,
-      "src/main/ports/ssh-advertised-url-enrichment.test.ts": 13,
-      "src/main/ports/workspace-port-ownership.test.ts": 9,
-      "src/main/powershell-osc133-bootstrap.test.ts": 14,
-      "src/main/project-groups/folder-workspace-path-status.test.ts": 19,
-      "src/main/project-groups/nested-repo-discovery.test.ts": 103,
-      "src/main/project-groups/nested-repo-import-target.test.ts": 10,
-      "src/main/project-groups/nested-repo-import.test.ts": 17,
-      "src/main/project-runtime-git-options.test.ts": 15,
-      "src/main/protected-secret-persistence.test.ts": 20,
-      "src/main/providers/agent-foreground-process-batch.test.ts": 15,
-      "src/main/providers/agent-foreground-process-pi.test.ts": 12,
-      "src/main/providers/agent-foreground-process-ps-scan-volume.test.ts": 24,
-      "src/main/providers/agent-foreground-process-real-rows.test.ts": 13,
-      "src/main/providers/agent-foreground-process-remote-evidence.test.ts": 11,
-      "src/main/providers/agent-foreground-process-windows-job-rejection.test.ts": 4,
-      "src/main/providers/agent-foreground-process.test.ts": 30,
-      "src/main/providers/execution-host-provider-dispatch.test.ts": 12,
-      "src/main/providers/local-pty-foreground-inspection-cheap-tier.test.ts": 10,
-      "src/main/providers/local-pty-provider-foreground-process.test.ts": 110,
-      "src/main/providers/local-pty-provider-io-events.test.ts": 31,
-      "src/main/providers/local-pty-provider-session-inventory.test.ts": 29,
-      "src/main/providers/local-pty-provider-shell-readiness.test.ts": 39,
-      "src/main/providers/local-pty-provider-shutdown.test.ts": 351,
-      "src/main/providers/local-pty-provider-spawn-cwd-safety.test.ts": 21,
-      "src/main/providers/local-pty-provider-spawn-env.test.ts": 40,
-      "src/main/providers/local-pty-provider-spawn-session.test.ts": 33,
-      "src/main/providers/local-pty-provider-windows-shell-launch.test.ts": 72,
-      "src/main/providers/local-pty-shell-ready-marker-scan.test.ts": 8,
-      "src/main/providers/local-pty-shell-ready-startup-command.test.ts": 11,
-      "src/main/providers/local-pty-shell-ready-wrapper-generation.test.ts": 411,
-      "src/main/providers/local-pty-shell-startup-command.node-pty.test.ts": 52,
-      "src/main/providers/local-pty-utils-windows-fallback.test.ts": 9,
-      "src/main/providers/local-pty-utils.test.ts": 12,
-      "src/main/providers/macos-login-session-pty-probe.test.ts": 12,
-      "src/main/providers/macos-tcc-login-shell.test.ts": 77,
-      "src/main/providers/posix-pane-foreground-fingerprint.test.ts": 9,
-      "src/main/providers/process-cwd.test.ts": 100,
-      "src/main/providers/provider-dispatch.test.ts": 38,
-      "src/main/providers/pty-default-cwd.test.ts": 9,
-      "src/main/providers/pty-process-inspection.test.ts": 15,
-      "src/main/providers/pty-process-list-admission.test.ts": 76,
-      "src/main/providers/pty-repaint-wide-char-buffer.node-pty.test.ts": 1855,
-      "src/main/providers/settled-pty-writer-census.test.ts": 79,
-      "src/main/providers/ssh-filesystem-dispatch.test.ts": 9,
-      "src/main/providers/ssh-filesystem-doc-preview.test.ts": 7,
-      "src/main/providers/ssh-filesystem-download.test.ts": 145,
-      "src/main/providers/ssh-filesystem-provider-capabilities.test.ts": 15,
-      "src/main/providers/ssh-filesystem-provider-download-folder.test.ts": 22,
-      "src/main/providers/ssh-filesystem-provider-range.test.ts": 13,
-      "src/main/providers/ssh-filesystem-provider-stream.test.ts": 52,
-      "src/main/providers/ssh-filesystem-provider-watch-waiters.test.ts": 437,
-      "src/main/providers/ssh-filesystem-provider.test.ts": 59,
-      "src/main/providers/ssh-filesystem-watch-notifications.test.ts": 11,
-      "src/main/providers/ssh-git-dispatch.test.ts": 4,
-      "src/main/providers/ssh-git-provider-api.test.ts": 8,
-      "src/main/providers/ssh-git-provider-commit-message.test.ts": 18,
-      "src/main/providers/ssh-git-provider-diff.test.ts": 32,
-      "src/main/providers/ssh-git-provider-exec.test.ts": 26,
-      "src/main/providers/ssh-git-provider-merge.test.ts": 9,
-      "src/main/providers/ssh-git-provider-remote-sync.test.ts": 21,
-      "src/main/providers/ssh-git-provider-staging.test.ts": 16,
-      "src/main/providers/ssh-git-provider-status-lease.test.ts": 24,
-      "src/main/providers/ssh-git-provider-status.test.ts": 22,
-      "src/main/providers/ssh-git-provider-upstream-lease.test.ts": 16,
-      "src/main/providers/ssh-git-provider-worktree.test.ts": 29,
-      "src/main/providers/ssh-git-worktree-list-dedupe.test.ts": 32,
-      "src/main/providers/ssh-pty-inspect-observation-identity.test.ts": 6,
-      "src/main/providers/ssh-pty-live-source-restore-respawn.test.ts": 15,
-      "src/main/providers/ssh-pty-notification-rejection-routing.test.ts": 162,
-      "src/main/providers/ssh-pty-notification-routing.test.ts": 22,
-      "src/main/providers/ssh-pty-provider-agent-session-create-operation.test.ts": 35,
-      "src/main/providers/ssh-pty-provider-claim-incarnation.test.ts": 7,
-      "src/main/providers/ssh-pty-provider-exit-race.test.ts": 19,
-      "src/main/providers/ssh-pty-provider-process-events.test.ts": 18,
-      "src/main/providers/ssh-pty-provider-reattach-incarnation.test.ts": 9,
-      "src/main/providers/ssh-pty-provider-spawn.test.ts": 33,
-      "src/main/providers/ssh-pty-provider-terminal-repair.test.ts": 36,
-      "src/main/providers/ssh-pty-provider.test.ts": 31,
-      "src/main/providers/ssh-pty-reattach-absence-discrimination.test.ts": 23,
-      "src/main/providers/ssh-pty-relay-absence-verdict.test.ts": 19,
-      "src/main/providers/ssh-pty-source-delivery-ledger.test.ts": 14,
-      "src/main/providers/ssh-pty-write.test.ts": 25,
-      "src/main/providers/ssh-worktree-catalog-authority.test.ts": 29,
-      "src/main/providers/stable-foreground-process.test.ts": 5,
-      "src/main/providers/windows-agent-foreground-process-scan-volume.test.ts": 37,
-      "src/main/providers/windows-cached-agent-revalidation.test.ts": 11,
-      "src/main/providers/windows-conpty-wide-char-duplication.node-pty.test.ts": 7,
-      "src/main/providers/windows-console-attached-processes.test.ts": 16,
-      "src/main/providers/windows-foreground-process-inspection-cost.test.ts": 15,
-      "src/main/providers/windows-foreground-process-rows.test.ts": 13,
-      "src/main/providers/windows-powershell-executable.test.ts": 18,
-      "src/main/providers/windows-powershell.test.ts": 8,
-      "src/main/providers/windows-pty-job-membership.test.ts": 13,
-      "src/main/providers/windows-shell-args.test.ts": 48,
-      "src/main/providers/windows-shell-fallback-chain.test.ts": 10,
-      "src/main/providers/working-directory-validation.test.ts": 45,
-      "src/main/provisioned-root-ssh-adoption.test.ts": 140,
-      "src/main/proxy-guarded-fetch-call-site-audit.test.ts": 76,
-      "src/main/pty-descendant-termination-job-coverage.test.ts": 5,
-      "src/main/pty-descendant-termination.test.ts": 59,
-      "src/main/pty/appimage-terminal-env.test.ts": 6,
-      "src/main/pty/build-mode-env.test.ts": 6,
-      "src/main/pty/codex-home-wsl-env.test.ts": 5,
-      "src/main/pty/codex-preflight-profile-path-rewrite.test.ts": 134,
-      "src/main/pty/codex-shell-launch-preflight.test.ts": 4086,
-      "src/main/pty/conda-activation-env.test.ts": 8,
-      "src/main/pty/legacy-terminal-shim-dir.test.ts": 1197,
-      "src/main/pty/legacy-terminal-windows-tombstone.test.ts": 21,
-      "src/main/pty/node-pty-master-fd-retirement.test.ts": 5158,
-      "src/main/pty/node-pty-self-exit-pseudoconsole-close.test.ts": 6,
-      "src/main/pty/omp-shell-wrapper-alias-safety.test.ts": 16,
-      "src/main/pty/omp-sqlite-overlay.test.ts": 5,
-      "src/main/pty/overlay-mirror.test.ts": 17,
-      "src/main/pty/posix-pty-foreground-group.test.ts": 9,
-      "src/main/pty/posix-pty-process-groups.integration.test.ts": 106,
-      "src/main/pty/posix-pty-process-groups.test.ts": 10,
-      "src/main/pty/shell-startup-env.test.ts": 19,
-      "src/main/pty/terminal-color-env.test.ts": 8,
-      "src/main/pty/windows-environment-path-main-loop.test.ts": 367,
-      "src/main/pty/windows-environment-path.test.ts": 17,
-      "src/main/pty/windows-path-registry-change.test.ts": 6,
-      "src/main/pty/windows-path-registry-fallback.test.ts": 7,
-      "src/main/pty/windows-path-registry-reader.test.ts": 9,
-      "src/main/pty/wsl-orca-env.test.ts": 20,
-      "src/main/pwsh.test.ts": 24,
-      "src/main/quit-path-durable-write-blocking.test.ts": 1453,
-      "src/main/quit-teardown-agent-browser-daemons.test.ts": 6,
-      "src/main/quit-teardown-deadline.test.ts": 11,
-      "src/main/quit-teardown-start-gate.test.ts": 8,
-      "src/main/rate-limits/account-runtime-target-sync.test.ts": 12,
-      "src/main/rate-limits/antigravity-usage-mirror.test.ts": 7,
-      "src/main/rate-limits/auth-filesystem-operation.test.ts": 11,
-      "src/main/rate-limits/claude-fetcher-cli-fallback.test.ts": 86,
-      "src/main/rate-limits/claude-fetcher-fable-usage.test.ts": 65,
-      "src/main/rate-limits/claude-fetcher-keychain-credentials.test.ts": 100,
-      "src/main/rate-limits/claude-fetcher-managed-account-usage.test.ts": 50,
-      "src/main/rate-limits/claude-oauth-usage-error.test.ts": 44,
-      "src/main/rate-limits/claude-pty.test.ts": 64,
-      "src/main/rate-limits/claude-usage-error-classification.test.ts": 9,
-      "src/main/rate-limits/claude-usage-refresh-plan.test.ts": 7,
-      "src/main/rate-limits/codex-auth-presence.test.ts": 17,
-      "src/main/rate-limits/codex-fetcher-auth-errors.test.ts": 15,
-      "src/main/rate-limits/codex-fetcher-backend.test.ts": 76,
-      "src/main/rate-limits/codex-fetcher-probe-shutdown.test.ts": 38,
-      "src/main/rate-limits/codex-fetcher-process-contract.test.ts": 43,
-      "src/main/rate-limits/codex-fetcher-pty-settle.test.ts": 38,
-      "src/main/rate-limits/codex-fetcher-rpc-exit-diagnostics.test.ts": 175,
-      "src/main/rate-limits/codex-fetcher-runtime-pairing.test.ts": 17,
-      "src/main/rate-limits/codex-fetcher-session-supplement.test.ts": 20,
-      "src/main/rate-limits/codex-fetcher.test.ts": 86,
-      "src/main/rate-limits/codex-probe-termination.test.ts": 16,
-      "src/main/rate-limits/codex-pty-rate-limit-probe.test.ts": 10,
-      "src/main/rate-limits/codex-pty-status-parser.test.ts": 7,
-      "src/main/rate-limits/codex-rate-limit-window-classification.test.ts": 11,
-      "src/main/rate-limits/codex-rpc-rate-limit-probe.test.ts": 60,
-      "src/main/rate-limits/gemini-bucket-formatting.test.ts": 6,
-      "src/main/rate-limits/gemini-usage-fetcher.fallback.test.ts": 10,
-      "src/main/rate-limits/gemini-usage-fetcher.test.ts": 19,
-      "src/main/rate-limits/grok-auth.test.ts": 41,
-      "src/main/rate-limits/grok-fetcher.test.ts": 27,
-      "src/main/rate-limits/hidden-pty-cleanup.test.ts": 12,
-      "src/main/rate-limits/initial-account-rate-limit-target.test.ts": 14,
-      "src/main/rate-limits/kimi-fetcher-wsl-home.test.ts": 12,
-      "src/main/rate-limits/kimi-fetcher.test.ts": 34,
-      "src/main/rate-limits/minimax/minimax-fetcher.test.ts": 46,
-      "src/main/rate-limits/minimax/minimax-request-context.test.ts": 26,
-      "src/main/rate-limits/opencode-go-usage-fetcher.test.ts": 34,
-      "src/main/rate-limits/service-account-target-selection.test.ts": 142,
-      "src/main/rate-limits/service-antigravity-usage.test.ts": 11,
-      "src/main/rate-limits/service-inactive-account-previews.test.ts": 27,
-      "src/main/rate-limits/service-live-claude-usage.test.ts": 37,
-      "src/main/rate-limits/service-minimax-usage.test.ts": 17,
-      "src/main/rate-limits/service-refresh-orchestration.test.ts": 29,
-      "src/main/rate-limits/service-window-activation.test.ts": 22,
-      "src/main/refused-tree-kill-root-termination.test.ts": 24,
-      "src/main/remote-agent-trust-presets.test.ts": 13,
-      "src/main/remote-worktree-history-cleanup.test.ts": 12,
-      "src/main/repo-git-remote-identity-enrichment.test.ts": 22,
-      "src/main/repo-git-remote-identity.test.ts": 23,
-      "src/main/repo-git-username-enrichment.test.ts": 11,
-      "src/main/repo-icon-autodetect.test.ts": 242,
-      "src/main/repo-icon-file-detection.test.ts": 70,
-      "src/main/repo-icon-source-href.test.ts": 73,
-      "src/main/repo-maintenance-idle-gate.test.ts": 5,
-      "src/main/repo-worktrees.test.ts": 20,
-      "src/main/runtime/agent-prompt-receipt-correlation.test.ts": 65,
-      "src/main/runtime/agent-prompt-request-correlation.test.ts": 9,
-      "src/main/runtime/agent-prompt-submission-runtime.test.ts": 1762,
-      "src/main/runtime/agent-prompt-submission-verification.test.ts": 125,
-      "src/main/runtime/agent-prompt-submission-windows-submit-delay.test.ts": 192,
-      "src/main/runtime/agent-session-backup-recovery.test.ts": 116,
-      "src/main/runtime/agent-session-claim-identity.test.ts": 12,
-      "src/main/runtime/agent-session-conversation-name-store.test.ts": 76,
-      "src/main/runtime/agent-session-eviction-settlement-latch.test.ts": 9,
-      "src/main/runtime/agent-session-handoff-lease-transitions.test.ts": 8,
-      "src/main/runtime/agent-session-launch-env-admission.test.ts": 165,
-      "src/main/runtime/agent-session-launch-env-backfill.test.ts": 40,
-      "src/main/runtime/agent-session-lease-renewal.test.ts": 221,
-      "src/main/runtime/agent-session-orphan-child-reaper.test.ts": 12,
-      "src/main/runtime/agent-session-process-identity-probe-windows-batch.test.ts": 5,
-      "src/main/runtime/agent-session-process-identity-probe.test.ts": 17,
-      "src/main/runtime/agent-session-provider-handle-transition.test.ts": 7,
-      "src/main/runtime/agent-session-pty-write-enforcement.test.ts": 2113,
-      "src/main/runtime/agent-session-pty-write-gate.test.ts": 15,
-      "src/main/runtime/agent-session-record-conversation-name.test.ts": 14,
-      "src/main/runtime/agent-session-record-options.test.ts": 33,
-      "src/main/runtime/agent-session-record-store-security.test.ts": 23,
-      "src/main/runtime/agent-session-record-store.test.ts": 744,
-      "src/main/runtime/agent-session-record-unsupported-schema.test.ts": 26,
-      "src/main/runtime/agent-session-recovery-publish-fault.test.ts": 25,
-      "src/main/runtime/agent-session-reservation-admission.test.ts": 9,
-      "src/main/runtime/agent-session-restart-handoff-adjudication.test.ts": 13,
-      "src/main/runtime/agent-session-resume-args.test.ts": 5,
-      "src/main/runtime/agent-session-spawn-token-process-scan.test.ts": 8,
-      "src/main/runtime/agent-session-spawn-token-readback.test.ts": 9,
-      "src/main/runtime/agent-session-unreadable-record-salvage.test.ts": 68,
-      "src/main/runtime/agent-terminal-launch-trust-host.test.ts": 27,
-      "src/main/runtime/antigravity-readiness-transcripts.test.ts": 9380,
-      "src/main/runtime/automation-change-publication.test.ts": 4436,
-      "src/main/runtime/browser-client-download-transfers.test.ts": 80,
-      "src/main/runtime/browser-execution-host-key-resolution.test.ts": 25,
-      "src/main/runtime/browser-host-capability-selection.test.ts": 12,
-      "src/main/runtime/browser-host-client-page-adoption-grants.test.ts": 9,
-      "src/main/runtime/browser-host-client-page-adoption.test.ts": 9,
-      "src/main/runtime/browser-host-client-page-creation.test.ts": 28,
-      "src/main/runtime/browser-host-command-ledger-capacity.test.ts": 14,
-      "src/main/runtime/browser-host-command-ledger.test.ts": 30,
-      "src/main/runtime/browser-host-file-channel-admission.test.ts": 7,
-      "src/main/runtime/browser-host-lease-download-transfer-cleanup.test.ts": 114,
-      "src/main/runtime/browser-host-lease-fenced-page-release.test.ts": 30,
-      "src/main/runtime/browser-host-lease-placement-retirement.test.ts": 33,
-      "src/main/runtime/browser-host-lease-registry.test.ts": 47,
-      "src/main/runtime/browser-host-page-placement-replacement.test.ts": 11,
-      "src/main/runtime/browser-host-page-placement.test.ts": 16,
-      "src/main/runtime/browser-host-page-reconciliation-executor.test.ts": 44,
-      "src/main/runtime/browser-host-page-reconciliation-orchestration.test.ts": 245,
-      "src/main/runtime/browser-host-page-reconciliation-plan.test.ts": 22,
-      "src/main/runtime/browser-host-page-reconciliation-preconditions.test.ts": 7,
-      "src/main/runtime/browser-host-page-retirement.test.ts": 9,
-      "src/main/runtime/browser-network-tunnel-paired-runtime.integration.test.ts": 411,
-      "src/main/runtime/browser-screencast-driver-attribution.test.ts": 503,
-      "src/main/runtime/browser-screencast-driver-scope.test.ts": 5,
-      "src/main/runtime/browser-screencast-ghost-subscriber-eviction.test.ts": 14,
-      "src/main/runtime/browser-screencast-remote-viewer-retention.test.ts": 379,
-      "src/main/runtime/browser-session-tab-selection-snapshot.test.ts": 12,
-      "src/main/runtime/browser-tab-create-caller-navigation.test.ts": 641,
-      "src/main/runtime/browser-tab-create-publication.test.ts": 998,
-      "src/main/runtime/claude-agent-teams-pty-exit-leak.test.ts": 23,
-      "src/main/runtime/claude-agent-teams-service.test.ts": 29,
-      "src/main/runtime/claude-agent-teams-shim-env.test.ts": 41,
-      "src/main/runtime/claude-structured-session-integration.test.ts": 943,
-      "src/main/runtime/cli-terminal-create-host-session-binding.test.ts": 22,
-      "src/main/runtime/client-hosted-browser-page-persistence.integration.test.ts": 39,
-      "src/main/runtime/client-hosted-browser-page-persistence.test.ts": 24,
-      "src/main/runtime/client-hosted-browser-row-hydration-census.test.ts": 427,
-      "src/main/runtime/client-hosted-browser-row-projection.test.ts": 9,
-      "src/main/runtime/client-hosted-browser-row-publication.test.ts": 30,
-      "src/main/runtime/client-hosted-browser-row-push.integration.test.ts": 41,
-      "src/main/runtime/client-hosted-page-reconciliation-hold.integration.test.ts": 16,
-      "src/main/runtime/client-hosted-page-reconciliation-window.test.ts": 23,
-      "src/main/runtime/client-session-tab-selection.test.ts": 11,
-      "src/main/runtime/decorative-title-fact-emission.test.ts": 4,
-      "src/main/runtime/exit-provenance-audit.test.ts": 394,
-      "src/main/runtime/expired-ssh-lease-pane-candidacy.test.ts": 22,
-      "src/main/runtime/external-worktree-paired-client-discovery.integration.test.ts": 203,
-      "src/main/runtime/fetch-remote-cache.test.ts": 271,
-      "src/main/runtime/file-watcher-host.test.ts": 600,
-      "src/main/runtime/fit-override-integration.test.ts": 56,
-      "src/main/runtime/folder-workspace-pty-identity.test.ts": 54,
-      "src/main/runtime/graph-sync-deletion-fence.test.ts": 43,
-      "src/main/runtime/graph-sync-live-daemon-pty-tab-preservation.test.ts": 95,
-      "src/main/runtime/graph-sync-mobile-snapshot-gating.test.ts": 94,
-      "src/main/runtime/graph-sync-payload-partition.test.ts": 33,
-      "src/main/runtime/headless-tab-group-split-layout.test.ts": 15,
-      "src/main/runtime/headless-tab-order-stability.test.ts": 29,
-      "src/main/runtime/headless-terminal-dispose-write-ordering.test.ts": 25,
-      "src/main/runtime/headless-terminal-query-reply-policy.test.ts": 4,
-      "src/main/runtime/headless-terminal-split-layout.test.ts": 9,
-      "src/main/runtime/hidden-output-restored-provider-snapshot.test.ts": 74,
-      "src/main/runtime/host-terminal-close-persistence-durability.test.ts": 59,
-      "src/main/runtime/linear-save-issue.test.ts": 34,
-      "src/main/runtime/managed-worktree-create-execution-host.test.ts": 24,
-      "src/main/runtime/missing-worktree-terminal-reconciliation.test.ts": 14,
-      "src/main/runtime/mobile-agent-status-permission-renewal.test.ts": 34,
-      "src/main/runtime/mobile-notification-dismissal-read-failure.test.ts": 4,
-      "src/main/runtime/mobile-notification-dismissal-store.test.ts": 12,
-      "src/main/runtime/mobile-notification-replay.test.ts": 11,
-      "src/main/runtime/mobile-pairing-qr.test.ts": 1086,
-      "src/main/runtime/mobile-pairing-userdata-path.test.ts": 1112,
-      "src/main/runtime/mobile-presence-lock.test.ts": 230,
-      "src/main/runtime/mobile-rpc-allowlist.test.ts": 84,
-      "src/main/runtime/mobile-session-tabs-agent-status-heartbeat.test.ts": 21,
-      "src/main/runtime/mobile-session-tabs-churn-coalescing.test.ts": 26,
-      "src/main/runtime/mobile-session-tabs-notify-coalescer.test.ts": 17,
-      "src/main/runtime/mobile-session-terminal-persistence-retirement.test.ts": 19,
-      "src/main/runtime/mobile-session-terminal-retirement-proof.test.ts": 5,
-      "src/main/runtime/mobile-session-terminal-retirement.test.ts": 12,
-      "src/main/runtime/mobile-subscribe-integration.test.ts": 303,
-      "src/main/runtime/multi-client-navigation-isolation.integration.test.ts": 551,
-      "src/main/runtime/opencode-finished-session-authority.test.ts": 356,
-      "src/main/runtime/orca-runtime-agent-session-operation.test.ts": 84,
-      "src/main/runtime/orca-runtime-agent-skill-share.test.ts": 224,
-      "src/main/runtime/orca-runtime-automations.test.ts": 35,
-      "src/main/runtime/orca-runtime-browser-client-hosted.test.ts": 778,
-      "src/main/runtime/orca-runtime-browser-ghost-session-row-close.test.ts": 416,
-      "src/main/runtime/orca-runtime-browser-headless.test.ts": 450,
-      "src/main/runtime/orca-runtime-browser-screencast-fanout.test.ts": 316,
-      "src/main/runtime/orca-runtime-browser.test.ts": 604,
-      "src/main/runtime/orca-runtime-create-base-prefetch.test.ts": 27,
-      "src/main/runtime/orca-runtime-emulator-folder-workspace.test.ts": 76,
-      "src/main/runtime/orca-runtime-exact-worker-provider-session.test.ts": 8,
-      "src/main/runtime/orca-runtime-files-mobile-explorer-reads.test.ts": 15,
-      "src/main/runtime/orca-runtime-files-preview-budget.test.ts": 104,
-      "src/main/runtime/orca-runtime-files-rename-authority.test.ts": 29,
-      "src/main/runtime/orca-runtime-files-search.test.ts": 25,
-      "src/main/runtime/orca-runtime-files-ssh-chunk-reads.test.ts": 68,
-      "src/main/runtime/orca-runtime-files-ssh-rearm.test.ts": 60,
-      "src/main/runtime/orca-runtime-files-terminal-artifact-grants.test.ts": 62,
-      "src/main/runtime/orca-runtime-files-terminal-artifact-io.test.ts": 99,
-      "src/main/runtime/orca-runtime-files-terminal-link-host-translation.test.ts": 30,
-      "src/main/runtime/orca-runtime-files-terminal-path-resolution.test.ts": 22,
-      "src/main/runtime/orca-runtime-files-watch-host-scope.test.ts": 15,
-      "src/main/runtime/orca-runtime-files-watch.test.ts": 106,
-      "src/main/runtime/orca-runtime-git-branch-diff.test.ts": 9,
-      "src/main/runtime/orca-runtime-git-diff-budget.test.ts": 25,
-      "src/main/runtime/orca-runtime-git.test.ts": 31,
-      "src/main/runtime/orca-runtime-headless-hydration-repo-gate.test.ts": 32,
-      "src/main/runtime/orca-runtime-hook-agent-status-projection.test.ts": 297,
-      "src/main/runtime/orca-runtime-linked-issue-live-meta.integration.test.ts": 17,
-      "src/main/runtime/orca-runtime-mobile-agent-status-title-truthfulness.test.ts": 44,
-      "src/main/runtime/orca-runtime-mobile-close-preserved-resurrection.test.ts": 191,
-      "src/main/runtime/orca-runtime-module-size.test.ts": 20,
-      "src/main/runtime/orca-runtime-path-candidate-history.test.ts": 16,
-      "src/main/runtime/orca-runtime-process-incarnation-liveness.test.ts": 27,
-      "src/main/runtime/orca-runtime-provider-reattach-launch-identity.test.ts": 21,
-      "src/main/runtime/orca-runtime-skill-recovery.test.ts": 20,
-      "src/main/runtime/orca-runtime-structured-agent-session-create-intent.test.ts": 21,
-      "src/main/runtime/orca-runtime-structured-agent-session-launch-args.test.ts": 20,
-      "src/main/runtime/orca-runtime-structured-claude-account-gate.test.ts": 17,
-      "src/main/runtime/orca-runtime-structured-claude-gate-wiring.test.ts": 19,
-      "src/main/runtime/orca-runtime-structured-native-chat-settings.test.ts": 13,
-      "src/main/runtime/orca-runtime-structured-session-restore.test.ts": 59,
-      "src/main/runtime/orca-runtime-structured-status-sink-wiring.test.ts": 26,
-      "src/main/runtime/orca-runtime-structured-tui-tab-binding.test.ts": 302,
-      "src/main/runtime/orca-runtime-tab-id-collision.test.ts": 18,
-      "src/main/runtime/orca-runtime-tail-wait-memo.test.ts": 89,
-      "src/main/runtime/orca-runtime-terminal-close-continuity.test.ts": 231,
-      "src/main/runtime/orca-runtime-terminal-create-idempotency.test.ts": 77,
-      "src/main/runtime/orca-runtime-terminal-cwd.test.ts": 62,
-      "src/main/runtime/orca-runtime-terminal-handle-incarnation.test.ts": 78,
-      "src/main/runtime/orca-runtime-terminal-retirement-host-partition.test.ts": 54,
-      "src/main/runtime/orca-runtime-terminal-retirement.test.ts": 255,
-      "src/main/runtime/orca-runtime-terminal-split-authority.test.ts": 384,
-      "src/main/runtime/orca-runtime-test-fragment-coverage.test.ts": 5,
-      "src/main/runtime/orca-runtime.test.ts": 12320,
-      "src/main/runtime/orchestration-codex-completion-title.test.ts": 664,
-      "src/main/runtime/orchestration-compatibility-authority.test.ts": 42,
-      "src/main/runtime/orchestration-dispatch-mailbox-delivery.test.ts": 190,
-      "src/main/runtime/orchestration-mailbox-cold-park-idle.test.ts": 119,
-      "src/main/runtime/orchestration-mailbox-crash-recovery.test.ts": 155,
-      "src/main/runtime/orchestration-mailbox-detached-routing.test.ts": 534,
-      "src/main/runtime/orchestration-mailbox-filtered-waiters.test.ts": 270,
-      "src/main/runtime/orchestration-mailbox-notification-consistency.test.ts": 1187,
-      "src/main/runtime/orchestration-mailbox-pointer-cli-command.test.ts": 107,
-      "src/main/runtime/orchestration-mailbox-pty-write-gate.test.ts": 162,
-      "src/main/runtime/orchestration-mailbox-routing-races.test.ts": 642,
-      "src/main/runtime/orchestration-mailbox-transport-settlement.test.ts": 224,
-      "src/main/runtime/orchestration-message-delivery-identity.test.ts": 244,
-      "src/main/runtime/orchestration-messages-fake-parity.test.ts": 55,
-      "src/main/runtime/orchestration-structured-chat-lease.test.ts": 8461,
-      "src/main/runtime/orchestration-worker-workspace-resolution.test.ts": 57,
-      "src/main/runtime/orchestration/adopted-structured-pointer-delivery.test.ts": 13,
-      "src/main/runtime/orchestration/cli-command.test.ts": 7,
-      "src/main/runtime/orchestration/coordinator-decision-gates.test.ts": 62,
-      "src/main/runtime/orchestration/coordinator-dispatch-unobserved-prompt.test.ts": 59,
-      "src/main/runtime/orchestration/coordinator-drift-probe-coalescing.test.ts": 186,
-      "src/main/runtime/orchestration/coordinator-escalation-triage.test.ts": 28,
-      "src/main/runtime/orchestration/coordinator-stale-base-flag.test.ts": 9,
-      "src/main/runtime/orchestration/coordinator.test.ts": 3333,
-      "src/main/runtime/orchestration/db-empty-dispatch-shortcircuit.benchmark.test.ts": 64,
-      "src/main/runtime/orchestration/db-heartbeat-straggler-guard.test.ts": 31,
-      "src/main/runtime/orchestration/db-message-timestamp.test.ts": 18,
-      "src/main/runtime/orchestration/db-messages.test.ts": 115,
-      "src/main/runtime/orchestration/db-stopping-worker-task-guard.test.ts": 97,
-      "src/main/runtime/orchestration/db-task-create-readiness.test.ts": 174,
-      "src/main/runtime/orchestration/db-task-dispatch-invariant.test.ts": 521,
-      "src/main/runtime/orchestration/db-task-dispatch-lifecycle-guards.test.ts": 716,
-      "src/main/runtime/orchestration/db-task-dispatch-races.test.ts": 172,
-      "src/main/runtime/orchestration/db-undelivered-mailboxes.test.ts": 44,
-      "src/main/runtime/orchestration/db.test.ts": 836,
-      "src/main/runtime/orchestration/db/attempt-outcome-projection.test.ts": 285,
-      "src/main/runtime/orchestration/db/decision-gate-lifecycle.test.ts": 46,
-      "src/main/runtime/orchestration/db/dispatch-context/dispatch-capability.test.ts": 51,
-      "src/main/runtime/orchestration/db/dispatch-depth.test.ts": 320,
-      "src/main/runtime/orchestration/db/dispatch-mailbox-consumer-fencing.test.ts": 107,
-      "src/main/runtime/orchestration/db/dispatch-row-writer-boundary.test.ts": 587,
-      "src/main/runtime/orchestration/db/federated-worker-report-outcome.test.ts": 8,
-      "src/main/runtime/orchestration/db/federation/federated-dispatch-observation-fence.test.ts": 28,
-      "src/main/runtime/orchestration/db/federation/remote-dispatch-attachment-release.test.ts": 75,
-      "src/main/runtime/orchestration/db/hot-path-statement-compilation.test.ts": 74,
-      "src/main/runtime/orchestration/db/legacy-question-identity.test.ts": 7,
-      "src/main/runtime/orchestration/db/lifecycle-rejection-marker.test.ts": 8,
-      "src/main/runtime/orchestration/db/lifecycle-transition-boundary.test.ts": 6,
-      "src/main/runtime/orchestration/db/lifecycle-transition.test.ts": 76,
-      "src/main/runtime/orchestration/db/pane-key-match.test.ts": 5,
-      "src/main/runtime/orchestration/db/row-column-lists.test.ts": 72,
-      "src/main/runtime/orchestration/db/run-list-cursor.test.ts": 5,
-      "src/main/runtime/orchestration/db/schema/federated-home-run-migration.test.ts": 128,
-      "src/main/runtime/orchestration/db/schema/structured-pointer-schema-migration.test.ts": 60,
-      "src/main/runtime/orchestration/db/writer-run-required.test.ts": 54,
-      "src/main/runtime/orchestration/dispatch-consumer-generation-migration.test.ts": 143,
-      "src/main/runtime/orchestration/dispatch-creator-identity-migration.test.ts": 416,
-      "src/main/runtime/orchestration/dispatch-failure-idempotency.test.ts": 48,
-      "src/main/runtime/orchestration/federation-ack-checkpoints.test.ts": 6,
-      "src/main/runtime/orchestration/federation-acknowledgment-integrity.test.ts": 74,
-      "src/main/runtime/orchestration/federation-acknowledgment-migration.test.ts": 67,
-      "src/main/runtime/orchestration/federation-lifecycle-settlement.test.ts": 4,
-      "src/main/runtime/orchestration/federation-sync.test.ts": 196,
-      "src/main/runtime/orchestration/federation-terminal-recovery.test.ts": 31,
-      "src/main/runtime/orchestration/formatter.test.ts": 10,
-      "src/main/runtime/orchestration/groups.test.ts": 8,
-      "src/main/runtime/orchestration/lifecycle-caller-edges.test.ts": 76,
-      "src/main/runtime/orchestration/lifecycle-reconciliation.test.ts": 237,
-      "src/main/runtime/orchestration/lightweight-run-worker-exit-escalation.test.ts": 182,
-      "src/main/runtime/orchestration/mailbox-pointer-eligibility.test.ts": 67,
-      "src/main/runtime/orchestration/mailbox-pointer-release-query.test.ts": 120,
-      "src/main/runtime/orchestration/mailbox-pointer-stage.test.ts": 129,
-      "src/main/runtime/orchestration/mailbox-pointer-submit.test.ts": 447,
-      "src/main/runtime/orchestration/message-batch-atomicity.test.ts": 107,
-      "src/main/runtime/orchestration/mutation-receipt-capacity.test.ts": 155,
-      "src/main/runtime/orchestration/nested-worker-depth-migration.test.ts": 233,
-      "src/main/runtime/orchestration/orchestration-adopted-run-binding.test.ts": 643,
-      "src/main/runtime/orchestration/orchestration-all-start-versions-migration.test.ts": 1759,
-      "src/main/runtime/orchestration/orchestration-creator-authority-performance.test.ts": 517,
-      "src/main/runtime/orchestration/orchestration-db-permissions.test.ts": 37,
-      "src/main/runtime/orchestration/orchestration-db-retention-pagination.test.ts": 408,
-      "src/main/runtime/orchestration/orchestration-federated-legacy-probe.test.ts": 309,
-      "src/main/runtime/orchestration/orchestration-legacy-coordinator-authority-db.test.ts": 371,
-      "src/main/runtime/orchestration/orchestration-legacy-question-migration-db.test.ts": 445,
-      "src/main/runtime/orchestration/orchestration-legacy-storage-db.test.ts": 1251,
-      "src/main/runtime/orchestration/orchestration-legacy-worker-terminal-recovery.test.ts": 6,
-      "src/main/runtime/orchestration/orchestration-mutation-question-db.test.ts": 75,
-      "src/main/runtime/orchestration/orchestration-peer-capability-cache.test.ts": 11,
-      "src/main/runtime/orchestration/orchestration-reset-db.test.ts": 84,
-      "src/main/runtime/orchestration/orchestration-run-delivery-db.test.ts": 184,
-      "src/main/runtime/orchestration/orchestration-run-list-compatibility.test.ts": 32,
-      "src/main/runtime/orchestration/orchestration-version-skew-migration.test.ts": 539,
-      "src/main/runtime/orchestration/orchestration-worker-dispatch-db.test.ts": 352,
-      "src/main/runtime/orchestration/preamble.test.ts": 75,
-      "src/main/runtime/orchestration/r1-identity-migration.test.ts": 109,
-      "src/main/runtime/orchestration/run-coordinator-handle-migration.test.ts": 148,
-      "src/main/runtime/orchestration/settled-question-threads-migration.test.ts": 51,
-      "src/main/runtime/orchestration/setup-completion-signal.test.ts": 10,
-      "src/main/runtime/orchestration/structured-mailbox-pointer-delivery.test.ts": 44,
-      "src/main/runtime/orchestration/structured-mailbox-pointer-host.test.ts": 14,
-      "src/main/runtime/orchestration/structured-pointer-operation-id.test.ts": 13,
-      "src/main/runtime/orchestration/structured-session-pointer-delivery.test.ts": 14,
-      "src/main/runtime/orchestration/structured-worker-direct-mailbox-target.test.ts": 9,
-      "src/main/runtime/orchestration/structured-worker-group-addressing.test.ts": 17,
-      "src/main/runtime/orchestration/structured-worker-journal-archive.test.ts": 32,
-      "src/main/runtime/orchestration/task-deps-flag.test.ts": 15,
-      "src/main/runtime/orchestration/worker-attention-context.test.ts": 10,
-      "src/main/runtime/orchestration/worker-output-archive-bounding.test.ts": 58,
-      "src/main/runtime/orchestration/worker-output-archive.test.ts": 18,
-      "src/main/runtime/orchestration/worker-output-cursor.test.ts": 8,
-      "src/main/runtime/orchestration/worker-provider-session.test.ts": 7,
-      "src/main/runtime/orchestration/worker-start-unobserved-prompt-settlement.test.ts": 63,
-      "src/main/runtime/orchestration/worker-transcript-payload.test.ts": 15,
-      "src/main/runtime/orchestration/worker-transcript-read.test.ts": 58,
-      "src/main/runtime/orchestration/worker-transcript-remote-read.test.ts": 60,
-      "src/main/runtime/pairing-endpoint.test.ts": 24,
-      "src/main/runtime/pty-exit-agent-status-reconciliation.test.ts": 35,
-      "src/main/runtime/pty-exit-per-pty-map-reaper-ratchet.test.ts": 13,
-      "src/main/runtime/pty-inventory-liveness-verdict.test.ts": 58,
-      "src/main/runtime/pty-inventory-partial-relay-liveness.test.ts": 31,
-      "src/main/runtime/pty-shell-ownership-mirror.test.ts": 1507,
-      "src/main/runtime/pty-transcript-prune-wait-cache.test.ts": 24,
-      "src/main/runtime/pty-waiver-source-invariant.test.ts": 9,
-      "src/main/runtime/public-ssh-state.test.ts": 7,
-      "src/main/runtime/push/desktop-push-service-unreadable-outbox.test.ts": 32,
-      "src/main/runtime/push/desktop-push-service.test.ts": 79,
-      "src/main/runtime/push/push-agent-state.test.ts": 9,
-      "src/main/runtime/push/push-cleanup-auth-expiry.test.ts": 50,
-      "src/main/runtime/push/push-delivery-policy.test.ts": 9,
-      "src/main/runtime/push/push-device-registration-persistence.test.ts": 20,
-      "src/main/runtime/push/push-dispatcher.test.ts": 13,
-      "src/main/runtime/push/push-gateway-client.test.ts": 149,
-      "src/main/runtime/push/push-gateway-session.test.ts": 136,
-      "src/main/runtime/push/push-host-proof-vector.test.ts": 19,
-      "src/main/runtime/push/push-host-proof.test.ts": 100,
-      "src/main/runtime/push/push-outcome-counters.test.ts": 6,
-      "src/main/runtime/push/push-policy-pipeline.integration.test.ts": 38,
-      "src/main/runtime/push/push-preferences.test.ts": 10,
-      "src/main/runtime/push/push-registration-races.test.ts": 65,
-      "src/main/runtime/push/push-registration-rpc.test.ts": 45,
-      "src/main/runtime/push/push-unpair-persistence.test.ts": 37,
-      "src/main/runtime/push/push-unregister-outbox.test.ts": 12,
-      "src/main/runtime/quarter-circle-title-send-authorization.test.ts": 16463,
-      "src/main/runtime/recent-pty-output-buffer.test.ts": 63,
-      "src/main/runtime/relay/desktop-relay-service-broker-liveness.test.ts": 10,
-      "src/main/runtime/relay/desktop-relay-service.test.ts": 12,
-      "src/main/runtime/relay/mobile-relay-e2ee.integration.test.ts": 83,
-      "src/main/runtime/relay/relay-auth-coordinator-recovery.test.ts": 18,
-      "src/main/runtime/relay/relay-auth-coordinator.test.ts": 1169,
-      "src/main/runtime/relay/relay-auth-host-close-reason.test.ts": 67,
-      "src/main/runtime/relay/relay-control-client.test.ts": 287,
-      "src/main/runtime/relay/relay-control-close-reason.test.ts": 40,
-      "src/main/runtime/relay/relay-control-origin.test.ts": 22,
-      "src/main/runtime/relay/relay-control-request-retirement.test.ts": 23,
-      "src/main/runtime/relay/relay-demand-ledger.test.ts": 12,
-      "src/main/runtime/relay/relay-host-proof.test.ts": 40,
-      "src/main/runtime/relay/relay-http-client.test.ts": 86,
-      "src/main/runtime/relay/relay-region-correction.test.ts": 89,
-      "src/main/runtime/relay/relay-region-preference.test.ts": 90,
-      "src/main/runtime/relay/relay-region-probe-log.test.ts": 79,
-      "src/main/runtime/relay/relay-region-refresh.test.ts": 17,
-      "src/main/runtime/relay/relay-renewal-jitter.test.ts": 506,
-      "src/main/runtime/relay/relay-revoke-outbox.test.ts": 13,
-      "src/main/runtime/relay/relay-session-broker.test.ts": 405,
-      "src/main/runtime/remote-agent-session-host-authority.integration.test.ts": 138,
-      "src/main/runtime/remote-browser-screencast-frame-admission.test.ts": 47,
-      "src/main/runtime/remote-desktop-driver.test.ts": 99,
-      "src/main/runtime/remote-runtime-close-intent.integration.test.ts": 90,
-      "src/main/runtime/remote-runtime-request-connection.integration.test.ts": 260,
-      "src/main/runtime/remote-server-updater.test.ts": 9,
-      "src/main/runtime/renderer-browser-session-reconciliation.test.ts": 11,
-      "src/main/runtime/repo-icon-fork-backfill.test.ts": 16,
-      "src/main/runtime/repo-worktree-admin-fingerprint.test.ts": 835,
-      "src/main/runtime/repo-worktree-resolution-scan.test.ts": 4,
-      "src/main/runtime/repo-worktree-row-resolution.test.ts": 16,
-      "src/main/runtime/retained-tail-redraw-window.equivalence.test.ts": 329,
-      "src/main/runtime/rpc/core-typed-method-contract.test.ts": 9,
-      "src/main/runtime/rpc/dispatcher-browser-client-automation.test.ts": 23,
-      "src/main/runtime/rpc/dispatcher-computer-errors.test.ts": 20,
-      "src/main/runtime/rpc/dispatcher-feature-interactions.test.ts": 17,
-      "src/main/runtime/rpc/dispatcher-request-parsing.test.ts": 18,
-      "src/main/runtime/rpc/e2ee-channel-text-backpressure.test.ts": 55,
-      "src/main/runtime/rpc/e2ee-channel-v2.test.ts": 81,
-      "src/main/runtime/rpc/e2ee-channel.test.ts": 196,
-      "src/main/runtime/rpc/e2ee-crypto.test.ts": 41,
-      "src/main/runtime/rpc/e2ee-integration.test.ts": 57,
-      "src/main/runtime/rpc/errors.test.ts": 22,
-      "src/main/runtime/rpc/methods/accounts.test.ts": 21,
-      "src/main/runtime/rpc/methods/agent-hooks.test.ts": 12,
-      "src/main/runtime/rpc/methods/agent-session.test.ts": 38,
-      "src/main/runtime/rpc/methods/agent-skill-sharing-capability-grant.test.ts": 25,
-      "src/main/runtime/rpc/methods/ai-vault.test.ts": 156,
-      "src/main/runtime/rpc/methods/artifact-sharing-capability-grant.test.ts": 28,
-      "src/main/runtime/rpc/methods/artifacts.test.ts": 280,
-      "src/main/runtime/rpc/methods/automation-scoped-list-methods.test.ts": 31,
-      "src/main/runtime/rpc/methods/automations.test.ts": 45,
-      "src/main/runtime/rpc/methods/browser-client-host-attach-adoption.test.ts": 236,
-      "src/main/runtime/rpc/methods/browser-client-host-reconciliation.test.ts": 26,
-      "src/main/runtime/rpc/methods/browser-client-host.test.ts": 30,
-      "src/main/runtime/rpc/methods/browser-client-page-metadata.test.ts": 20,
-      "src/main/runtime/rpc/methods/browser-network-tunnel.test.ts": 233,
-      "src/main/runtime/rpc/methods/browser-tab-create-schema.test.ts": 12,
-      "src/main/runtime/rpc/methods/browser.test.ts": 58,
-      "src/main/runtime/rpc/methods/client-events.test.ts": 7,
-      "src/main/runtime/rpc/methods/client-native-chat-settings.test.ts": 22,
-      "src/main/runtime/rpc/methods/client-ui-pairing-local-fields.test.ts": 41,
-      "src/main/runtime/rpc/methods/client-ui-task-resume-state.test.ts": 26,
-      "src/main/runtime/rpc/methods/client-ui.test.ts": 96,
-      "src/main/runtime/rpc/methods/clipboard.test.ts": 44,
-      "src/main/runtime/rpc/methods/computer-actions.test.ts": 15,
-      "src/main/runtime/rpc/methods/computer.test.ts": 33,
-      "src/main/runtime/rpc/methods/diagnostics.test.ts": 8,
-      "src/main/runtime/rpc/methods/file-watch-event-batcher.test.ts": 26,
-      "src/main/runtime/rpc/methods/files-doc-preview.test.ts": 13,
-      "src/main/runtime/rpc/methods/files-list-all-page-size.test.ts": 17,
-      "src/main/runtime/rpc/methods/files-path-search.test.ts": 150,
-      "src/main/runtime/rpc/methods/files-preview-transport-budget.test.ts": 17,
-      "src/main/runtime/rpc/methods/files-terminal-path-resolution.test.ts": 20,
-      "src/main/runtime/rpc/methods/files-watch-cancellation.test.ts": 68,
-      "src/main/runtime/rpc/methods/files-watch-cleanup.test.ts": 64,
-      "src/main/runtime/rpc/methods/files.test.ts": 196,
-      "src/main/runtime/rpc/methods/git-diff-transport-budget.test.ts": 50,
-      "src/main/runtime/rpc/methods/git.test.ts": 72,
-      "src/main/runtime/rpc/methods/github-pr-refresh-reason.test.ts": 14,
-      "src/main/runtime/rpc/methods/github.test.ts": 65,
-      "src/main/runtime/rpc/methods/gitlab.test.ts": 58,
-      "src/main/runtime/rpc/methods/host-capabilities.test.ts": 10,
-      "src/main/runtime/rpc/methods/hosted-review.test.ts": 25,
-      "src/main/runtime/rpc/methods/jira.test.ts": 34,
-      "src/main/runtime/rpc/methods/linear-agent-access.test.ts": 77,
-      "src/main/runtime/rpc/methods/linear-agent-project-access.test.ts": 708,
-      "src/main/runtime/rpc/methods/linear.test.ts": 47,
-      "src/main/runtime/rpc/methods/native-chat-rpc-block-sanitize.test.ts": 6,
-      "src/main/runtime/rpc/methods/native-chat.test.ts": 29,
-      "src/main/runtime/rpc/methods/notification-preferences.test.ts": 6,
-      "src/main/runtime/rpc/methods/notification-reconnect-cooldown.test.ts": 10,
-      "src/main/runtime/rpc/methods/orchestration-dispatch-error-codes.test.ts": 105,
-      "src/main/runtime/rpc/methods/orchestration-structured-worker-abandon.test.ts": 69,
-      "src/main/runtime/rpc/methods/orchestration-structured-worker-lifecycle.test.ts": 14,
-      "src/main/runtime/rpc/methods/orchestration-structured-worker-redrive.test.ts": 88,
-      "src/main/runtime/rpc/methods/orchestration-structured-worker-session.test.ts": 16,
-      "src/main/runtime/rpc/methods/orchestration-structured-worker-start-failure.test.ts": 13,
-      "src/main/runtime/rpc/methods/orchestration-worker-mode-opacity.test.ts": 89,
-      "src/main/runtime/rpc/methods/orchestration-worker-start-mode-selection.test.ts": 188,
-      "src/main/runtime/rpc/methods/orchestration-worker-start-mode.test.ts": 9,
-      "src/main/runtime/rpc/methods/orchestration-worker-support-unknown.test.ts": 8,
-      "src/main/runtime/rpc/methods/orchestration/cli-runtime-boundary.test.ts": 96,
-      "src/main/runtime/rpc/methods/orchestration/federation/federated-attach-receipt.test.ts": 5,
-      "src/main/runtime/rpc/methods/orchestration/federation/federated-fleet-snapshot.test.ts": 30,
-      "src/main/runtime/rpc/methods/orchestration/federation/federated-message-targeting.test.ts": 68,
-      "src/main/runtime/rpc/methods/orchestration/federation/federated-release-safety.test.ts": 105,
-      "src/main/runtime/rpc/methods/orchestration/federation/federated-transport-safety.test.ts": 31,
-      "src/main/runtime/rpc/methods/orchestration/federation/federated-worker-start-receipt.test.ts": 50,
-      "src/main/runtime/rpc/methods/orchestration/federation/federation-agent-launch.test.ts": 60,
-      "src/main/runtime/rpc/methods/orchestration/federation/federation-control-mail.test.ts": 281,
-      "src/main/runtime/rpc/methods/orchestration/federation/federation-effects.test.ts": 4,
-      "src/main/runtime/rpc/methods/orchestration/federation/federation-folder-placement.test.ts": 35,
-      "src/main/runtime/rpc/methods/orchestration/federation/federation-lifecycle-settlement.test.ts": 1435,
-      "src/main/runtime/rpc/methods/orchestration/federation/federation-liveness-verdict.test.ts": 279,
-      "src/main/runtime/rpc/methods/orchestration/federation/federation-output.test.ts": 755,
-      "src/main/runtime/rpc/methods/orchestration/federation/federation-setup.test.ts": 129,
-      "src/main/runtime/rpc/methods/orchestration/federation/federation-start-prompt-budget.test.ts": 31,
-      "src/main/runtime/rpc/methods/orchestration/federation/federation-start-schema.test.ts": 11,
-      "src/main/runtime/rpc/methods/orchestration/federation/federation.test.ts": 1549,
-      "src/main/runtime/rpc/methods/orchestration/gates/gate-run-authorization.test.ts": 676,
-      "src/main/runtime/rpc/methods/orchestration/gates/gates.test.ts": 164,
-      "src/main/runtime/rpc/methods/orchestration/messaging/ask.test.ts": 430,
-      "src/main/runtime/rpc/methods/orchestration/messaging/check-superseded-terminal.test.ts": 136,
-      "src/main/runtime/rpc/methods/orchestration/messaging/check-worker-consumer-fencing.test.ts": 242,
-      "src/main/runtime/rpc/methods/orchestration/messaging/check-worker-federated-attachment.test.ts": 453,
-      "src/main/runtime/rpc/methods/orchestration/messaging/check.test.ts": 473,
-      "src/main/runtime/rpc/methods/orchestration/messaging/recipient-routing.test.ts": 238,
-      "src/main/runtime/rpc/methods/orchestration/messaging/send-dispatch-authority.test.ts": 138,
-      "src/main/runtime/rpc/methods/orchestration/messaging/send-group.test.ts": 387,
-      "src/main/runtime/rpc/methods/orchestration/messaging/send-invalid-type.test.ts": 55,
-      "src/main/runtime/rpc/methods/orchestration/messaging/send-receipt-plumbing.test.ts": 64,
-      "src/main/runtime/rpc/methods/orchestration/messaging/send-unbound-terminals.test.ts": 49,
-      "src/main/runtime/rpc/methods/orchestration/messaging/send.test.ts": 570,
-      "src/main/runtime/rpc/methods/orchestration/messaging/settled-dispatch-mail.test.ts": 100,
-      "src/main/runtime/rpc/methods/orchestration/runs/migration-behavior.test.ts": 156,
-      "src/main/runtime/rpc/methods/orchestration/runs/run-receipt.test.ts": 7,
-      "src/main/runtime/rpc/methods/orchestration/runs/runs.test.ts": 329,
-      "src/main/runtime/rpc/methods/orchestration/runs/tasks-dispatch.test.ts": 394,
-      "src/main/runtime/rpc/methods/orchestration/worker/agent-status-producer-census.test.ts": 1032,
-      "src/main/runtime/rpc/methods/orchestration/worker/composed-workers.test.ts": 364,
-      "src/main/runtime/rpc/methods/orchestration/worker/context-only-dispatch-retry.test.ts": 84,
-      "src/main/runtime/rpc/methods/orchestration/worker/fleet-status-observed-identity.test.ts": 15,
-      "src/main/runtime/rpc/methods/orchestration/worker/fleet-status-terminal-identity.test.ts": 9,
-      "src/main/runtime/rpc/methods/orchestration/worker/legacy-dispatch-projection.test.ts": 154,
-      "src/main/runtime/rpc/methods/orchestration/worker/manual-dispatch-observation.test.ts": 133,
-      "src/main/runtime/rpc/methods/orchestration/worker/manual-dispatch-release.test.ts": 105,
-      "src/main/runtime/rpc/methods/orchestration/worker/self-dispatch-nesting-depth.test.ts": 55,
-      "src/main/runtime/rpc/methods/orchestration/worker/structured-worker-launch-seed-options.test.ts": 10,
-      "src/main/runtime/rpc/methods/orchestration/worker/worker-interactive-wait.test.ts": 111,
-      "src/main/runtime/rpc/methods/orchestration/worker/worker-launch-preferences.test.ts": 32,
-      "src/main/runtime/rpc/methods/orchestration/worker/worker-list-pagination.test.ts": 215,
-      "src/main/runtime/rpc/methods/orchestration/worker/worker-list-run-scope-rpc.test.ts": 81,
-      "src/main/runtime/rpc/methods/orchestration/worker/worker-observation.test.ts": 16,
-      "src/main/runtime/rpc/methods/orchestration/worker/worker-output.test.ts": 36,
-      "src/main/runtime/rpc/methods/orchestration/worker/worker-read-projection.test.ts": 60,
-      "src/main/runtime/rpc/methods/orchestration/worker/worker-release-archive.test.ts": 213,
-      "src/main/runtime/rpc/methods/orchestration/worker/worker-release-inventory.test.ts": 285,
-      "src/main/runtime/rpc/methods/orchestration/worker/worker-release-liveness-verdict.test.ts": 17,
-      "src/main/runtime/rpc/methods/orchestration/worker/worker-release-mobile-report.test.ts": 283,
-      "src/main/runtime/rpc/methods/orchestration/worker/worker-release-ownership-guard.test.ts": 151,
-      "src/main/runtime/rpc/methods/orchestration/worker/worker-release-recovery.test.ts": 390,
-      "src/main/runtime/rpc/methods/orchestration/worker/worker-release.test.ts": 651,
-      "src/main/runtime/rpc/methods/orchestration/worker/worker-start-budgets.test.ts": 5,
-      "src/main/runtime/rpc/methods/orchestration/worker/worker-start-outcome-classification.test.ts": 8,
-      "src/main/runtime/rpc/methods/orchestration/worker/worker-start-prompt-budget.test.ts": 70,
-      "src/main/runtime/rpc/methods/orchestration/worker/worker-start-prompt-contract.test.ts": 355,
-      "src/main/runtime/rpc/methods/orchestration/worker/worker-start-terminal-target.test.ts": 106,
-      "src/main/runtime/rpc/methods/orchestration/worker/worker-start-turn-observation.test.ts": 10,
-      "src/main/runtime/rpc/methods/orchestration/worker/worker-stop-capability.test.ts": 14,
-      "src/main/runtime/rpc/methods/orchestration/worker/worker-stop-exit-race.test.ts": 109,
-      "src/main/runtime/rpc/methods/orchestration/worker/worker-stop-liveness-verdict.test.ts": 136,
-      "src/main/runtime/rpc/methods/orchestration/worker/worker-terminal-custody-at-creation.test.ts": 505,
-      "src/main/runtime/rpc/methods/orchestration/worker/workers-new-worktree.test.ts": 735,
-      "src/main/runtime/rpc/methods/orchestration/worker/workers-recovery.test.ts": 238,
-      "src/main/runtime/rpc/methods/paired-caller-host-id.test.ts": 8,
-      "src/main/runtime/rpc/methods/pairing.test.ts": 29,
-      "src/main/runtime/rpc/methods/plugins.test.ts": 13,
-      "src/main/runtime/rpc/methods/preflight.test.ts": 14,
-      "src/main/runtime/rpc/methods/project-host-setup-self-host-stamp.test.ts": 16,
-      "src/main/runtime/rpc/methods/repo-badge-color.test.ts": 14,
-      "src/main/runtime/rpc/methods/repo.test.ts": 48,
-      "src/main/runtime/rpc/methods/runtime-client-capabilities.test.ts": 14,
-      "src/main/runtime/rpc/methods/session-tab-agent-capability-mutations.test.ts": 25,
-      "src/main/runtime/rpc/methods/session-tab-agent-status-projection.test.ts": 14,
-      "src/main/runtime/rpc/methods/session-tab-browser-placement-mutations.test.ts": 18,
-      "src/main/runtime/rpc/methods/session-tab-browser-placement-projection.test.ts": 14,
-      "src/main/runtime/rpc/methods/session-tabs-inventory-census-race.test.ts": 239,
-      "src/main/runtime/rpc/methods/session-tabs-inventory-rpc.test.ts": 41,
-      "src/main/runtime/rpc/methods/session-tabs-move-validation.test.ts": 41,
-      "src/main/runtime/rpc/methods/session-tabs-retirement-proof-delta.test.ts": 20,
-      "src/main/runtime/rpc/methods/session-tabs-schemas.test.ts": 18,
-      "src/main/runtime/rpc/methods/session-tabs-structured-restore.test.ts": 13,
-      "src/main/runtime/rpc/methods/session-tabs-unsubscribe.test.ts": 16,
-      "src/main/runtime/rpc/methods/session-tabs.test.ts": 37,
-      "src/main/runtime/rpc/methods/skills.test.ts": 26,
-      "src/main/runtime/rpc/methods/speech.test.ts": 20,
-      "src/main/runtime/rpc/methods/ssh.test.ts": 17,
-      "src/main/runtime/rpc/methods/structured-agent-session-admission.test.ts": 47,
-      "src/main/runtime/rpc/methods/structured-agent-session-adoption-replay.test.ts": 87,
-      "src/main/runtime/rpc/methods/structured-agent-session-background-task-capability.test.ts": 24,
-      "src/main/runtime/rpc/methods/structured-agent-session-hold.test.ts": 954,
-      "src/main/runtime/rpc/methods/structured-agent-session-policy.test.ts": 6,
-      "src/main/runtime/rpc/methods/structured-agent-session-precommit-refusal.test.ts": 23,
-      "src/main/runtime/rpc/methods/structured-agent-session-turn-item-capability.test.ts": 20,
-      "src/main/runtime/rpc/methods/structured-agent-session.test.ts": 127,
-      "src/main/runtime/rpc/methods/structured-worker-read-cursor.test.ts": 10,
-      "src/main/runtime/rpc/methods/structured-worker-stop-receipt.test.ts": 56,
-      "src/main/runtime/rpc/methods/structured-worker-tab-retirement.test.ts": 37,
-      "src/main/runtime/rpc/methods/terminal-create-idempotency.test.ts": 14,
-      "src/main/runtime/rpc/methods/terminal-legacy-stream-id-characterization.test.ts": 165,
-      "src/main/runtime/rpc/methods/terminal-manifest-characterization.test.ts": 40,
-      "src/main/runtime/rpc/methods/terminal-navigation.test.ts": 15,
-      "src/main/runtime/rpc/methods/terminal-read-screen-cursor.test.ts": 10,
-      "src/main/runtime/rpc/methods/terminal-stream-extraction-characterization.test.ts": 20,
-      "src/main/runtime/rpc/methods/terminal/terminal-inspect-process-params.test.ts": 7,
-      "src/main/runtime/rpc/methods/updater.test.ts": 7,
-      "src/main/runtime/rpc/methods/workspace-cleanup-ui-schema.test.ts": 17,
-      "src/main/runtime/rpc/methods/workspace-ports.test.ts": 19,
-      "src/main/runtime/rpc/methods/worktree-catalog-snapshot-method.test.ts": 17,
-      "src/main/runtime/rpc/methods/worktree-create-args.test.ts": 14,
-      "src/main/runtime/rpc/methods/worktree-create-navigation.test.ts": 26,
-      "src/main/runtime/rpc/methods/worktree-github-pr-suppression.test.ts": 20,
-      "src/main/runtime/rpc/methods/worktree-missing-terminal-teardown.test.ts": 13,
-      "src/main/runtime/rpc/methods/worktree-retired-names.test.ts": 12,
-      "src/main/runtime/rpc/methods/worktree-rm-host-qualification.test.ts": 26,
-      "src/main/runtime/rpc/methods/worktree-rm-pty-waiver.test.ts": 10,
-      "src/main/runtime/rpc/methods/worktree-schemas.test.ts": 16,
-      "src/main/runtime/rpc/methods/worktree.test.ts": 70,
-      "src/main/runtime/rpc/mobile-auth-acl-critical-path.test.ts": 419,
-      "src/main/runtime/rpc/mobile-clipboard-image-provenance.test.ts": 25,
-      "src/main/runtime/rpc/mobile-e2ee-outbound-memory-budget.test.ts": 7,
-      "src/main/runtime/rpc/mobile-e2ee-v2-desktop-session.test.ts": 33,
-      "src/main/runtime/rpc/mobile-e2ee-v2-key-schedule.test.ts": 46,
-      "src/main/runtime/rpc/mobile-socket-wiring.test.ts": 117,
-      "src/main/runtime/rpc/orchestration-11745-regression-verification.test.ts": 1475,
-      "src/main/runtime/rpc/orchestration-commit-notify-characterization.test.ts": 326,
-      "src/main/runtime/rpc/orchestration-contract-fence.test.ts": 121,
-      "src/main/runtime/rpc/orchestration-current-authority-precedence.test.ts": 657,
-      "src/main/runtime/rpc/orchestration-legacy-compatibility-dispatcher.test.ts": 3011,
-      "src/main/runtime/rpc/orchestration-legacy-coordinator-race.test.ts": 963,
-      "src/main/runtime/rpc/orchestration-legacy-fence-jurisdiction.test.ts": 3247,
-      "src/main/runtime/rpc/orchestration-legacy-question-takeover.test.ts": 293,
-      "src/main/runtime/rpc/orchestration-legacy-run-routing.test.ts": 363,
-      "src/main/runtime/rpc/orchestration-legacy-takeover-current-authority.test.ts": 152,
-      "src/main/runtime/rpc/orchestration-legacy-takeover-delivery.test.ts": 199,
-      "src/main/runtime/rpc/orchestration-legacy-takeover-dispatcher.test.ts": 498,
-      "src/main/runtime/rpc/orchestration-mutation-executor.test.ts": 186,
-      "src/main/runtime/rpc/orchestration-mutation-ledger.test.ts": 304,
-      "src/main/runtime/rpc/orchestration-mutation-request-show-legacy.test.ts": 94,
-      "src/main/runtime/rpc/orchestration-mutation-request-show.test.ts": 158,
-      "src/main/runtime/rpc/orchestration-runtime-update-settlement.test.ts": 293,
-      "src/main/runtime/rpc/orchestration-task-dispatch-invariant.test.ts": 332,
-      "src/main/runtime/rpc/relay-transport.test.ts": 146,
-      "src/main/runtime/rpc/remote-runtime-server-heartbeat-missed-probe-tolerance.test.ts": 23,
-      "src/main/runtime/rpc/remote-runtime-server-heartbeat.test.ts": 9,
-      "src/main/runtime/rpc/runtime-client-capabilities.test.ts": 6,
-      "src/main/runtime/rpc/runtime-close-attribution-topology.test.ts": 33,
-      "src/main/runtime/rpc/runtime-close-attribution.test.ts": 19,
-      "src/main/runtime/rpc/schemas.test.ts": 38,
-      "src/main/runtime/rpc/streaming.test.ts": 16,
-      "src/main/runtime/rpc/terminal-agent-prompt-send.test.ts": 20,
-      "src/main/runtime/rpc/terminal-agent-send-guard.test.ts": 39,
-      "src/main/runtime/rpc/terminal-geometry-stale-handle.test.ts": 22,
-      "src/main/runtime/rpc/terminal-lease-stale-handle-survival.test.ts": 168,
-      "src/main/runtime/rpc/terminal-list-host-scope-transport.test.ts": 11,
-      "src/main/runtime/rpc/terminal-multiplex-ack-output-budget.test.ts": 563,
-      "src/main/runtime/rpc/terminal-multiplex-ack-overflow-recovery.test.ts": 1720,
-      "src/main/runtime/rpc/terminal-multiplex-desktop-resize-routing.test.ts": 695,
-      "src/main/runtime/rpc/terminal-multiplex-end-verdict.test.ts": 328,
-      "src/main/runtime/rpc/terminal-multiplex-escape-tail.test.ts": 27,
-      "src/main/runtime/rpc/terminal-multiplex-flow-control.bench.test.ts": 22,
-      "src/main/runtime/rpc/terminal-multiplex-initial-snapshot-buffering.test.ts": 294,
-      "src/main/runtime/rpc/terminal-multiplex-input-write-rejection.test.ts": 809,
-      "src/main/runtime/rpc/terminal-multiplex-output-pause-and-viewport.test.ts": 455,
-      "src/main/runtime/rpc/terminal-multiplex-pty-wait-capacity.test.ts": 446,
-      "src/main/runtime/rpc/terminal-multiplex-resync-replay-trim.test.ts": 16,
-      "src/main/runtime/rpc/terminal-multiplex-round-robin.test.ts": 6,
-      "src/main/runtime/rpc/terminal-multiplex-snapshot-serialization.test.ts": 644,
-      "src/main/runtime/rpc/terminal-multiplex-source-range-admission.test.ts": 799,
-      "src/main/runtime/rpc/terminal-multiplex-subscribe-slot-recovery.test.ts": 177,
-      "src/main/runtime/rpc/terminal-opencode-send-guard.integration.test.ts": 42,
-      "src/main/runtime/rpc/terminal-output-batching.test.ts": 366,
-      "src/main/runtime/rpc/terminal-output-frame-chunks-equivalence.test.ts": 14856,
-      "src/main/runtime/rpc/terminal-output-frame-source-ranges.test.ts": 11,
-      "src/main/runtime/rpc/terminal-prompt-delivery-receipt.test.ts": 318,
-      "src/main/runtime/rpc/terminal-provider-snapshot-sequence.test.ts": 220,
-      "src/main/runtime/rpc/terminal-requested-snapshot-unavailability.test.ts": 531,
-      "src/main/runtime/rpc/terminal-send-agent-session-lease.test.ts": 27,
-      "src/main/runtime/rpc/terminal-send-launch-draft-resolution.test.ts": 18,
-      "src/main/runtime/rpc/terminal-send.test.ts": 284,
-      "src/main/runtime/rpc/terminal-source-range-ledger.test.ts": 11,
-      "src/main/runtime/rpc/terminal-stream-byte-length.test.ts": 5718,
-      "src/main/runtime/rpc/terminal-subscribe-blank-mount.test.ts": 66,
-      "src/main/runtime/rpc/terminal-subscribe-buffer.test.ts": 605,
-      "src/main/runtime/rpc/terminal-subscribe-lease-only.test.ts": 66,
-      "src/main/runtime/rpc/terminal-subscribe-mount-replay.test.ts": 226,
-      "src/main/runtime/rpc/terminal-subscribe-ownership.test.ts": 226,
-      "src/main/runtime/rpc/terminal-subscribe-reconnect-rebind.test.ts": 139,
-      "src/main/runtime/rpc/terminal-subscribe-relay-drop-lease-survival.test.ts": 178,
-      "src/main/runtime/rpc/terminal-subscribe-renderer-recovery-output.test.ts": 66,
-      "src/main/runtime/rpc/unix-socket-transport.test.ts": 8,
-      "src/main/runtime/rpc/unpaired-device-auth-throttle.test.ts": 9,
-      "src/main/runtime/rpc/worktree-catalog-snapshot.test.ts": 8,
-      "src/main/runtime/rpc/ws-fallback-port-store.test.ts": 4,
-      "src/main/runtime/rpc/ws-transport-accept-order.test.ts": 17,
-      "src/main/runtime/rpc/ws-transport-static-web.test.ts": 6055,
-      "src/main/runtime/rpc/ws-transport-transient-packet-loss.test.ts": 635,
-      "src/main/runtime/rpc/ws-transport.test.ts": 976,
-      "src/main/runtime/runtime-binary-message-router.test.ts": 4,
-      "src/main/runtime/runtime-browser-client-automation.test.ts": 19,
-      "src/main/runtime/runtime-browser-client-page-adoption.test.ts": 32,
-      "src/main/runtime/runtime-browser-client-page-creation.test.ts": 20,
-      "src/main/runtime/runtime-browser-client-page-recovery.test.ts": 28,
-      "src/main/runtime/runtime-browser-client-page-restored-recovery.test.ts": 14,
-      "src/main/runtime/runtime-browser-network-execution-host.test.ts": 7,
-      "src/main/runtime/runtime-browser-page-registry.test.ts": 13,
-      "src/main/runtime/runtime-client-settings-minimax-projection.test.ts": 7,
-      "src/main/runtime/runtime-extraction-regressions.test.ts": 20,
-      "src/main/runtime/runtime-file-target-connection-field-ratchet.test.ts": 11,
-      "src/main/runtime/runtime-file-target-execution-host.test.ts": 33,
-      "src/main/runtime/runtime-folder-workspace.test.ts": 10,
-      "src/main/runtime/runtime-git-api-contract.test.ts": 7,
-      "src/main/runtime/runtime-git-branch-compare-admission.test.ts": 7,
-      "src/main/runtime/runtime-git-command-target.test.ts": 8,
-      "src/main/runtime/runtime-git-conflict-operation-routing.test.ts": 11,
-      "src/main/runtime/runtime-git-execution-host-ownership.test.ts": 10,
-      "src/main/runtime/runtime-git-generation-admission.test.ts": 11,
-      "src/main/runtime/runtime-git-status-admission.test.ts": 14,
-      "src/main/runtime/runtime-git-sync-commands.test.ts": 10,
-      "src/main/runtime/runtime-git-target-execution-host.test.ts": 33,
-      "src/main/runtime/runtime-graph-reload-lifecycle.test.ts": 10,
-      "src/main/runtime/runtime-hook-agent-row-selection.test.ts": 11,
-      "src/main/runtime/runtime-linear-read-commands.test.ts": 9,
-      "src/main/runtime/runtime-local-worktree-materialization.test.ts": 7,
-      "src/main/runtime/runtime-local-worktree-terminal-startup.test.ts": 6,
-      "src/main/runtime/runtime-managed-worktree-metadata-sweep.test.ts": 29,
-      "src/main/runtime/runtime-managed-worktree-metadata.test.ts": 7,
-      "src/main/runtime/runtime-managed-worktree-queries.test.ts": 22,
-      "src/main/runtime/runtime-metadata-ownership-watch.test.ts": 32,
-      "src/main/runtime/runtime-metadata.test.ts": 38,
-      "src/main/runtime/runtime-mobile-agent-status-builder.test.ts": 5,
-      "src/main/runtime/runtime-mobile-file-path-search.test.ts": 15,
-      "src/main/runtime/runtime-owned-terminal-publication-lineage.test.ts": 28,
-      "src/main/runtime/runtime-project-group-controller-folder-delete.test.ts": 7,
-      "src/main/runtime/runtime-project-host-setup-controller.test.ts": 16,
-      "src/main/runtime/runtime-remote-fetch-ref-maintenance.test.ts": 63,
-      "src/main/runtime/runtime-remove-project-host-scope.test.ts": 23,
-      "src/main/runtime/runtime-resolved-worktree-cache.test.ts": 6,
-      "src/main/runtime/runtime-rpc-browser-host-admission.test.ts": 31,
-      "src/main/runtime/runtime-rpc-device-revocation.test.ts": 99,
-      "src/main/runtime/runtime-rpc-long-poll-transport.test.ts": 1931,
-      "src/main/runtime/runtime-rpc-metadata-lifecycle.test.ts": 29,
-      "src/main/runtime/runtime-rpc-mobile-method-allowlist.test.ts": 53,
-      "src/main/runtime/runtime-rpc-mobile-native-chat-settings.test.ts": 5,
-      "src/main/runtime/runtime-rpc-mobile-terminal-streaming.test.ts": 575,
-      "src/main/runtime/runtime-rpc-orchestration-db-migration.test.ts": 56,
-      "src/main/runtime/runtime-rpc-pairing-mode-persistence.test.ts": 139,
-      "src/main/runtime/runtime-rpc-pairing-offer.test.ts": 71,
-      "src/main/runtime/runtime-rpc-relay-pairing.test.ts": 431,
-      "src/main/runtime/runtime-rpc-request-authorization.test.ts": 83,
-      "src/main/runtime/runtime-rpc-startup-failure.test.ts": 19,
-      "src/main/runtime/runtime-rpc-terminal-list.test.ts": 641,
-      "src/main/runtime/runtime-rpc-websocket-bind-host.test.ts": 104,
-      "src/main/runtime/runtime-rpc-websocket-long-poll-caps.test.ts": 67,
-      "src/main/runtime/runtime-rpc-worktree-queries.test.ts": 73,
-      "src/main/runtime/runtime-search-line-fragments.test.ts": 9,
-      "src/main/runtime/runtime-skill-install-authority.test.ts": 4,
-      "src/main/runtime/runtime-skill-install-commands.test.ts": 8,
-      "src/main/runtime/runtime-skill-install-queries.test.ts": 15,
-      "src/main/runtime/runtime-socket-sweep.test.ts": 8,
-      "src/main/runtime/runtime-terminal-idle-polls.test.ts": 14,
-      "src/main/runtime/runtime-terminal-orphan-topology-validation.test.ts": 17,
-      "src/main/runtime/runtime-terminal-spawn-push-target-materialization.test.ts": 9,
-      "src/main/runtime/runtime-worktree-agent-rows-structured.test.ts": 13,
-      "src/main/runtime/runtime-worktree-agent-sources.test.ts": 8,
-      "src/main/runtime/runtime-worktree-agent-startup.test.ts": 11,
-      "src/main/runtime/runtime-worktree-ps-summaries.test.ts": 7,
-      "src/main/runtime/runtime-worktree-selection.test.ts": 8,
-      "src/main/runtime/runtime-worktree-structured-agent-rows-liveness.test.ts": 87,
-      "src/main/runtime/saved-structured-agent-session-restoration.test.ts": 5,
-      "src/main/runtime/selected-review-branch.test.ts": 11,
-      "src/main/runtime/session-tabs-inventory-publication.test.ts": 47,
-      "src/main/runtime/settled-worker-process-replacement.test.ts": 96,
-      "src/main/runtime/structured-agent-session-close.test.ts": 10,
-      "src/main/runtime/structured-agent-session-integration-replay.test.ts": 400,
-      "src/main/runtime/structured-agent-session-integration.test.ts": 816,
-      "src/main/runtime/structured-agent-session-pty-binding.test.ts": 16,
-      "src/main/runtime/structured-agent-session-rollback-compatibility.test.ts": 39,
-      "src/main/runtime/structured-agent-session-runtime-exit.test.ts": 348,
-      "src/main/runtime/structured-agent-session-runtime.test.ts": 33,
-      "src/main/runtime/structured-agent-session-support-probe.test.ts": 25,
-      "src/main/runtime/structured-claude-auth-policy-wiring.test.ts": 8,
-      "src/main/runtime/structured-conversation-tab-replacement.test.ts": 6,
-      "src/main/runtime/structured-session-worktree-teardown.test.ts": 2436,
-      "src/main/runtime/structured-tui-exit-proof.test.ts": 14,
-      "src/main/runtime/structured-tui-idle-evidence.test.ts": 5,
-      "src/main/runtime/structured-tui-process-identity.test.ts": 26,
-      "src/main/runtime/structured-tui-recovery-claim-match.test.ts": 13,
-      "src/main/runtime/structured-worker-agent-presence.test.ts": 6,
-      "src/main/runtime/structured-worker-authority.test.ts": 7,
-      "src/main/runtime/structured-worker-child-identity-env.test.ts": 6,
-      "src/main/runtime/structured-worker-hook-attestation.test.ts": 7,
-      "src/main/runtime/structured-worker-identity.test.ts": 17,
-      "src/main/runtime/structured-worker-mail-routing.test.ts": 9,
-      "src/main/runtime/structured-worker-takeover-pane-key.test.ts": 6,
-      "src/main/runtime/structured-worker-terminal-read.test.ts": 14,
-      "src/main/runtime/structured-worker-terminal-refusal.test.ts": 8,
-      "src/main/runtime/terminal-ansi-pending-retention.test.ts": 464,
-      "src/main/runtime/terminal-focus-navigation-coalescer.test.ts": 21,
-      "src/main/runtime/terminal-identity-probe.test.ts": 8,
-      "src/main/runtime/terminal-interactive-wait-visibility.test.ts": 6198,
-      "src/main/runtime/terminal-leaf-tab-resolution.test.ts": 6,
-      "src/main/runtime/terminal-list-execution-host-scope.test.ts": 3128,
-      "src/main/runtime/terminal-list-payload-size.test.ts": 172,
-      "src/main/runtime/terminal-list-stale-leaf-liveness.test.ts": 42,
-      "src/main/runtime/terminal-mobile-subscribe-tab-mount.test.ts": 26,
-      "src/main/runtime/terminal-model-query-authority.test.ts": 9,
-      "src/main/runtime/terminal-orphan-owner.test.ts": 7,
-      "src/main/runtime/terminal-orphan-topology.test.ts": 12,
-      "src/main/runtime/terminal-pane-recovery-liveness-gate.test.ts": 46,
-      "src/main/runtime/terminal-projection.test.ts": 6,
-      "src/main/runtime/terminal-pty-exit-waiter.test.ts": 28,
-      "src/main/runtime/terminal-query-responder.test.ts": 178,
-      "src/main/runtime/terminal-restore-record-seed.test.ts": 69,
-      "src/main/runtime/terminal-retirement-proof-emitted-frame.test.ts": 23,
-      "src/main/runtime/terminal-retirement-proof-publication.test.ts": 77,
-      "src/main/runtime/terminal-send-stale-leaf-liveness.test.ts": 180,
-      "src/main/runtime/terminal-subscribe-exit-waiter-leak.test.ts": 24,
-      "src/main/runtime/terminal-subscriber-driven-daemon-attach.test.ts": 870,
-      "src/main/runtime/terminal-tail-buffer.test.ts": 5851,
-      "src/main/runtime/terminal-tail-row-retention.test.ts": 167,
-      "src/main/runtime/terminal-tail-sentinel-index.test.ts": 4042,
-      "src/main/runtime/terminal-tail-whitespace.test.ts": 11,
-      "src/main/runtime/terminal-vertical-control-scan.test.ts": 8,
-      "src/main/runtime/terminal-wait-detection.test.ts": 20,
-      "src/main/runtime/terminal-wait-results.test.ts": 6,
-      "src/main/runtime/wait-blocked-check-state.test.ts": 112,
-      "src/main/runtime/wait-blocked-keyword-carry-retention.test.ts": 12,
-      "src/main/runtime/windows-default-route-interfaces.test.ts": 9,
-      "src/main/runtime/windows-drive-listing.test.ts": 12,
-      "src/main/runtime/windows-firewall-remote-scope.test.ts": 19,
-      "src/main/runtime/windows-mobile-firewall.test.ts": 14,
-      "src/main/runtime/workspace-session-membership-scaling.test.ts": 13,
-      "src/main/runtime/worktree-launch-host-repo.test.ts": 10,
-      "src/main/runtime/worktree-list-host-scope.test.ts": 32,
-      "src/main/runtime/worktree-path-selector-wsl-posix.test.ts": 46,
-      "src/main/runtime/worktree-ps-degraded-repo-scan.test.ts": 94,
-      "src/main/runtime/worktree-ps-host-scope.test.ts": 40,
-      "src/main/runtime/worktree-rm-id-selector-path-spelling.test.ts": 47,
-      "src/main/runtime/worktree-scan-admin-fingerprint-gate.test.ts": 531,
-      "src/main/runtime/worktree-scan-execution-host-routing.test.ts": 33,
-      "src/main/runtime/worktree-teardown-unstopped-pty.test.ts": 204,
-      "src/main/runtime/worktree-teardown.test.ts": 235,
-      "src/main/runtime/worktree-terminal-mutation-lock.test.ts": 13,
-      "src/main/serve-update-handoff.app-environment.test.ts": 907,
-      "src/main/serve-update-handoff.test.ts": 8,
-      "src/main/server/serve-readiness.test.ts": 10,
-      "src/main/server/serve-stdout-boundary.test.ts": 8,
-      "src/main/shell-prompt-readiness-probe.test.ts": 28,
-      "src/main/shell-startup-identity-scanner.test.ts": 6,
-      "src/main/shell-startup-output-scanner.test.ts": 24,
-      "src/main/shell-wrapper-content-address.test.ts": 9,
-      "src/main/shell-wrapper-generated-file-snapshot.test.ts": 40,
-      "src/main/skills/agent-skill-selection.test.ts": 22,
-      "src/main/skills/claude-plugin-skill-sources-wsl.test.ts": 6,
-      "src/main/skills/claude-plugin-skill-sources.test.ts": 7,
-      "src/main/skills/discovery.test.ts": 108,
-      "src/main/skills/skill-bundle-artifacts.test.ts": 39,
-      "src/main/skills/skill-bundle-creation.test.ts": 628,
-      "src/main/skills/skill-bundle-install-service.test.ts": 196,
-      "src/main/skills/skill-bundle-observability-summary.test.ts": 4,
-      "src/main/skills/skill-bundle-ssh-relay-service.test.ts": 105,
-      "src/main/skills/skill-candidate-concurrency.test.ts": 29,
-      "src/main/skills/skill-client-mediated-transfer-cancellation.test.ts": 20,
-      "src/main/skills/skill-client-mediated-transfer.test.ts": 29,
-      "src/main/skills/skill-cloud-direct-upload.test.ts": 125,
-      "src/main/skills/skill-cloud-grant-installation.test.ts": 15,
-      "src/main/skills/skill-cloud-install-target.test.ts": 6,
-      "src/main/skills/skill-cloud-request.test.ts": 58,
-      "src/main/skills/skill-cloud-service.test.ts": 73,
-      "src/main/skills/skill-delete/plan.test.ts": 102,
-      "src/main/skills/skill-delete/recovery.test.ts": 86,
-      "src/main/skills/skill-delete/service.test.ts": 618,
-      "src/main/skills/skill-delete/staging-visibility.test.ts": 21,
-      "src/main/skills/skill-delete/wsl-enumeration-protocol.test.ts": 12,
-      "src/main/skills/skill-discovery-concurrency.test.ts": 88,
-      "src/main/skills/skill-discovery-order.test.ts": 286,
-      "src/main/skills/skill-discovery-target.test.ts": 21,
-      "src/main/skills/skill-discovery-wsl-plugins.test.ts": 22,
-      "src/main/skills/skill-discovery-wsl-script-roundtrip.test.ts": 49,
-      "src/main/skills/skill-discovery-wsl.test.ts": 40,
-      "src/main/skills/skill-freshness-eligibility.test.ts": 10,
-      "src/main/skills/skill-freshness-inventory-limits.test.ts": 6,
-      "src/main/skills/skill-freshness-inventory.test.ts": 2182,
-      "src/main/skills/skill-git-tree-identity.test.ts": 40,
-      "src/main/skills/skill-install-destinations.test.ts": 26,
-      "src/main/skills/skill-install-discovery-verification.test.ts": 17,
-      "src/main/skills/skill-install-lock-release.test.ts": 7,
-      "src/main/skills/skill-install-lock.test.ts": 241,
-      "src/main/skills/skill-install-management-service.test.ts": 39,
-      "src/main/skills/skill-install-provenance.test.ts": 19,
-      "src/main/skills/skill-install-recovery.test.ts": 304,
-      "src/main/skills/skill-install-request-service.test.ts": 299,
-      "src/main/skills/skill-install-service.test.ts": 944,
-      "src/main/skills/skill-install-transaction.test.ts": 949,
-      "src/main/skills/skill-operation-observability.test.ts": 92,
-      "src/main/skills/skill-package-creation.test.ts": 312,
-      "src/main/skills/skill-package-deterministic-gzip.test.ts": 527,
-      "src/main/skills/skill-package-download.test.ts": 107,
-      "src/main/skills/skill-package-identity.test.ts": 86,
-      "src/main/skills/skill-package-tar.test.ts": 259,
-      "src/main/skills/skill-placement-alias-repair.test.ts": 43,
-      "src/main/skills/skill-placement-copy-drift.test.ts": 38,
-      "src/main/skills/skill-placement-reconciliation.test.ts": 74,
-      "src/main/skills/skill-placement-transaction.test.ts": 97,
-      "src/main/skills/skill-plugin-cache-scan.test.ts": 599,
-      "src/main/skills/skill-provider-destinations.test.ts": 8,
-      "src/main/skills/skill-provider-runtime-roots.test.ts": 9,
-      "src/main/skills/skill-remote-error-category-parity.test.ts": 15,
-      "src/main/skills/skill-remote-install-cancellation.test.ts": 4,
-      "src/main/skills/skill-remote-install-service.test.ts": 32,
-      "src/main/skills/skill-remove-transaction.test.ts": 577,
-      "src/main/skills/skill-root-file-walk.test.ts": 27,
-      "src/main/skills/skill-runtime-capability.test.ts": 9,
-      "src/main/skills/skill-scan-coalescer.test.ts": 12,
-      "src/main/skills/skill-share-preparation-service.test.ts": 237,
-      "src/main/skills/skill-ssh-relay-service.test.ts": 61,
-      "src/main/skills/skill-transaction-startup-recovery.test.ts": 206,
-      "src/main/skills/skill-update-convergence.test.ts": 32,
-      "src/main/skills/skill-update-outcome.test.ts": 49,
-      "src/main/skills/skill-update-registration.test.ts": 14,
-      "src/main/skills/skill-update-run.test.ts": 28,
-      "src/main/skills/skill-upload-session-admission-regression.test.ts": 24,
-      "src/main/skills/skill-upload-session-service.test.ts": 157,
-      "src/main/skills/skill-wsl-install-filesystem.test.ts": 9,
-      "src/main/skills/skill-wsl-provider-detection.test.ts": 10,
-      "src/main/source-control/forge-provider.test.ts": 52,
-      "src/main/source-control/hosted-review-azure-devops.integration.test.ts": 153,
-      "src/main/source-control/hosted-review-base-ref-suffix.test.ts": 12,
-      "src/main/source-control/hosted-review-bitbucket.integration.test.ts": 368,
-      "src/main/source-control/hosted-review-branch-cache.test.ts": 186,
-      "src/main/source-control/hosted-review-creation-eligibility.test.ts": 26,
-      "src/main/source-control/hosted-review-creation-gitlab-self-hosted.test.ts": 14,
-      "src/main/source-control/hosted-review-creation-shared-symlinks.test.ts": 17,
-      "src/main/source-control/hosted-review-creation.test.ts": 29,
-      "src/main/source-control/hosted-review-dirty-preflight-wsl-paths.test.ts": 5,
-      "src/main/source-control/hosted-review-execution-host-routing.test.ts": 35,
-      "src/main/source-control/hosted-review-gitea.integration.test.ts": 321,
-      "src/main/source-control/hosted-review.test.ts": 14,
-      "src/main/source-control/pull-request-linked-issue.test.ts": 10,
-      "src/main/source-control/repo-default-branch.test.ts": 18,
-      "src/main/source-control/stacked-hosted-review-creation.test.ts": 7,
-      "src/main/speech/model-catalog.test.ts": 5,
-      "src/main/speech/model-manager-download-error.test.ts": 17,
-      "src/main/speech/model-manager-download-resume.test.ts": 3020,
-      "src/main/speech/model-manager-progress-callback.test.ts": 9,
-      "src/main/speech/model-manager-stream-cleanup.test.ts": 30,
-      "src/main/speech/model-manager-windows-path.test.ts": 584,
-      "src/main/speech/model-manager.test.ts": 45,
-      "src/main/speech/openai-api-key-store.test.ts": 18,
-      "src/main/speech/openai-transcription-client.test.ts": 5,
-      "src/main/speech/speech-model-deletion.test.ts": 8,
-      "src/main/speech/speech-model-download-response.test.ts": 7,
-      "src/main/speech/stt-offline-audio-chunker.test.ts": 164,
-      "src/main/speech/stt-service.test.ts": 24,
-      "src/main/speech/stt-worker-model-config.test.ts": 8,
-      "src/main/speech/stt-worker.test.ts": 7,
-      "src/main/sqlite/sqlite-read-failure.test.ts": 16,
-      "src/main/sqlite/sync-database.test.ts": 1184,
-      "src/main/ssh-expired-lease-pane-readoption.test.ts": 58,
-      "src/main/ssh-reattach-pane-cardinality.test.ts": 181,
-      "src/main/ssh/orcad-activation-gate.test.ts": 8,
-      "src/main/ssh/orcad-activation-record.test.ts": 9,
-      "src/main/ssh/orcad-remote-deploy.test.ts": 63,
-      "src/main/ssh/orcad-remote-gc.test.ts": 11,
-      "src/main/ssh/orcad-remote-launch.test.ts": 15,
-      "src/main/ssh/orcad-remote-rollback.test.ts": 61,
-      "src/main/ssh/orcad-remote-shell-commands.integration.test.ts": 1254,
-      "src/main/ssh/orcad-state-snapshot.test.ts": 7,
-      "src/main/ssh/orcad-update-plan.test.ts": 10,
-      "src/main/ssh/relay-native-dependency-coverage.test.ts": 333,
-      "src/main/ssh/relay-protocol-backpressure.test.ts": 31,
-      "src/main/ssh/relay-protocol.test.ts": 79,
-      "src/main/ssh/relay-socket-path-limit-shell.integration.test.ts": 77,
-      "src/main/ssh/relay-socket-path-limit.test.ts": 17,
-      "src/main/ssh/remote-install-coexistence.test.ts": 22,
-      "src/main/ssh/remote-install-model.test.ts": 13,
-      "src/main/ssh/removed-ssh-target-tombstone-retention.test.ts": 7,
-      "src/main/ssh/sftp-namespace-resolution.test.ts": 36,
-      "src/main/ssh/sftp-stream-late-error.test.ts": 27,
-      "src/main/ssh/sftp-upload.test.ts": 139,
-      "src/main/ssh/ssh-agent-identity-filter.test.ts": 14,
-      "src/main/ssh/ssh-channel-multiplexer-backpressure.test.ts": 41,
-      "src/main/ssh/ssh-channel-multiplexer-saturation-wedge.test.ts": 14,
-      "src/main/ssh/ssh-channel-multiplexer-settlement.test.ts": 8,
-      "src/main/ssh/ssh-channel-multiplexer.test.ts": 52,
-      "src/main/ssh/ssh-config-alias-claim.test.ts": 12,
-      "src/main/ssh/ssh-config-host-picker.test.ts": 199,
-      "src/main/ssh/ssh-config-loader-regression.test.ts": 80,
-      "src/main/ssh/ssh-config-loader.test.ts": 77,
-      "src/main/ssh/ssh-config-parser-host-patterns.test.ts": 7,
-      "src/main/ssh/ssh-config-parser.test.ts": 262,
-      "src/main/ssh/ssh-config-resolver.test.ts": 12,
-      "src/main/ssh/ssh-connect-attempt-cancellation.test.ts": 7,
-      "src/main/ssh/ssh-connection-auth-fallback.test.ts": 125,
-      "src/main/ssh/ssh-connection-channel-open.test.ts": 746,
-      "src/main/ssh/ssh-connection-direct-startup.test.ts": 32,
-      "src/main/ssh/ssh-connection-file-transfer.test.ts": 17,
-      "src/main/ssh/ssh-connection-generation.test.ts": 9,
-      "src/main/ssh/ssh-connection-github-probe.test.ts": 16,
-      "src/main/ssh/ssh-connection-gssapi-fallback.test.ts": 127,
-      "src/main/ssh/ssh-connection-host-key-store-wiring.test.ts": 246,
-      "src/main/ssh/ssh-connection-host-key-verification.test.ts": 66,
-      "src/main/ssh/ssh-connection-manager-registry.test.ts": 67,
-      "src/main/ssh/ssh-connection-manager.test.ts": 9,
-      "src/main/ssh/ssh-connection-reconnect-ladder.test.ts": 335,
-      "src/main/ssh/ssh-connection-sftp-namespace.test.ts": 834,
-      "src/main/ssh/ssh-connection-sftp-wire.test.ts": 2413,
-      "src/main/ssh/ssh-connection-store.test.ts": 36,
-      "src/main/ssh/ssh-connection-system-transport.test.ts": 58,
-      "src/main/ssh/ssh-connection-utils.test.ts": 83,
-      "src/main/ssh/ssh-connection.test.ts": 72,
-      "src/main/ssh/ssh-control-socket.test.ts": 15,
-      "src/main/ssh/ssh-file-stream-inactivity-deadline.test.ts": 17,
-      "src/main/ssh/ssh-file-transfer-abort.test.ts": 16,
-      "src/main/ssh/ssh-g-config-resolution.test.ts": 67,
-      "src/main/ssh/ssh-git-response-stream-reader.test.ts": 11,
-      "src/main/ssh/ssh-git-stream-idle-timer.test.ts": 52,
-      "src/main/ssh/ssh-host-key-decision.test.ts": 19,
-      "src/main/ssh/ssh-host-key-store.test.ts": 134,
-      "src/main/ssh/ssh-host-key-verifier.test.ts": 21,
-      "src/main/ssh/ssh-known-hosts-source.test.ts": 57,
-      "src/main/ssh/ssh-known-hosts.test.ts": 23,
-      "src/main/ssh/ssh-multi-factor-authentication.test.ts": 1247,
-      "src/main/ssh/ssh-multi-key-authentication.test.ts": 30,
-      "src/main/ssh/ssh-multiplexer-transport-writer.test.ts": 26,
-      "src/main/ssh/ssh-orphan-relay-pty-sweep.test.ts": 21,
-      "src/main/ssh/ssh-orphan-sweep-pane-state-verdicts.test.ts": 21,
-      "src/main/ssh/ssh-owner-recovery-retry.test.ts": 15,
-      "src/main/ssh/ssh-pending-pty-kill-replay.test.ts": 13,
-      "src/main/ssh/ssh-port-forward.test.ts": 25,
-      "src/main/ssh/ssh-port-scanner.test.ts": 31,
-      "src/main/ssh/ssh-posix-command-wrapper.test.ts": 27,
-      "src/main/ssh/ssh-provider-authority.test.ts": 18,
-      "src/main/ssh/ssh-proxy-command.test.ts": 15,
-      "src/main/ssh/ssh-pty-consumer-recovery.test.ts": 10,
-      "src/main/ssh/ssh-pty-consumer-session.test.ts": 13,
-      "src/main/ssh/ssh-pty-recovery-retention-budget.test.ts": 4,
-      "src/main/ssh/ssh-pty-retired-source-deliveries.test.ts": 11,
-      "src/main/ssh/ssh-reconnect-error-classification.test.ts": 10,
-      "src/main/ssh/ssh-reconnect-ladder.test.ts": 8,
-      "src/main/ssh/ssh-relay-build-toolchain.test.ts": 12,
-      "src/main/ssh/ssh-relay-cross-version-isolation.test.ts": 72,
-      "src/main/ssh/ssh-relay-deploy-helpers.test.ts": 296,
-      "src/main/ssh/ssh-relay-deploy-incumbent-verdict.test.ts": 16,
-      "src/main/ssh/ssh-relay-deploy-staged-upload.test.ts": 166,
-      "src/main/ssh/ssh-relay-deploy.test.ts": 209,
-      "src/main/ssh/ssh-relay-endpoint-incumbent-shell.integration.test.ts": 2169,
-      "src/main/ssh/ssh-relay-endpoint-incumbent.test.ts": 15,
-      "src/main/ssh/ssh-relay-endpoint-takeover.test.ts": 15,
-      "src/main/ssh/ssh-relay-gc-retry.test.ts": 82,
-      "src/main/ssh/ssh-relay-install-lock.test.ts": 4,
-      "src/main/ssh/ssh-relay-install-namespace.test.ts": 16,
-      "src/main/ssh/ssh-relay-native-deps-cache-deploy.test.ts": 1273,
-      "src/main/ssh/ssh-relay-native-deps-cache-shell.test.ts": 323,
-      "src/main/ssh/ssh-relay-native-deps-cache.test.ts": 24,
-      "src/main/ssh/ssh-relay-native-deps-install-staged-upload.test.ts": 659,
-      "src/main/ssh/ssh-relay-native-deps-install.test.ts": 13644,
-      "src/main/ssh/ssh-relay-native-deps-probe-verdict.test.ts": 254,
-      "src/main/ssh/ssh-relay-node-headers.test.ts": 2346,
-      "src/main/ssh/ssh-relay-node-pty-repair.test.ts": 15,
-      "src/main/ssh/ssh-relay-node-pty-spawn-repair.test.ts": 25,
-      "src/main/ssh/ssh-relay-orphan-abandon-paths.test.ts": 117,
-      "src/main/ssh/ssh-relay-pty-master-cloexec-install.test.ts": 1911,
-      "src/main/ssh/ssh-relay-reset.test.ts": 27,
-      "src/main/ssh/ssh-relay-sentinel-copy-budget.test.ts": 21,
-      "src/main/ssh/ssh-relay-session-agent-hooks.integration.test.ts": 596,
-      "src/main/ssh/ssh-relay-session-data-delivery.test.ts": 55,
-      "src/main/ssh/ssh-relay-session-incarnation.test.ts": 19,
-      "src/main/ssh/ssh-relay-session-managed-hooks.test.ts": 14,
-      "src/main/ssh/ssh-relay-session-model-migration.test.ts": 170,
-      "src/main/ssh/ssh-relay-session-orphan-sweep.test.ts": 43,
-      "src/main/ssh/ssh-relay-session-pending-kill-replay.test.ts": 14,
-      "src/main/ssh/ssh-relay-session-reconnect-incarnation.test.ts": 120,
-      "src/main/ssh/ssh-relay-session-recovery-durability.test.ts": 1066,
-      "src/main/ssh/ssh-relay-session-recovery-races.test.ts": 325,
-      "src/main/ssh/ssh-relay-session-rejected-delivery.test.ts": 793,
-      "src/main/ssh/ssh-relay-session-relay-loss.test.ts": 37,
-      "src/main/ssh/ssh-relay-session-terminal-error.test.ts": 29,
-      "src/main/ssh/ssh-relay-session.test.ts": 311,
-      "src/main/ssh/ssh-relay-sftp-namespace-install.test.ts": 198,
-      "src/main/ssh/ssh-relay-superseded-endpoints.test.ts": 17,
-      "src/main/ssh/ssh-relay-upload-stage-commands.test.ts": 39445,
-      "src/main/ssh/ssh-relay-versioned-install.test.ts": 85,
-      "src/main/ssh/ssh-remote-cli-dispatch-refusal-passthrough.test.ts": 16,
-      "src/main/ssh/ssh-remote-cli-format.test.ts": 7,
-      "src/main/ssh/ssh-remote-cli-host-passthrough.test.ts": 39,
-      "src/main/ssh/ssh-remote-cli-launcher.test.ts": 10,
-      "src/main/ssh/ssh-remote-cli-terminal-host-scope.test.ts": 20,
-      "src/main/ssh/ssh-remote-commands.test.ts": 11428,
-      "src/main/ssh/ssh-remote-linear-activity-output.test.ts": 4,
-      "src/main/ssh/ssh-remote-linear-cli.test.ts": 53,
-      "src/main/ssh/ssh-remote-linear-list-issues.test.ts": 14,
-      "src/main/ssh/ssh-remote-linear-relation-write.test.ts": 15,
-      "src/main/ssh/ssh-remote-linear-save-issue.test.ts": 24,
-      "src/main/ssh/ssh-remote-linear-truncation-output.test.ts": 7,
-      "src/main/ssh/ssh-remote-node-resolution.test.ts": 118,
-      "src/main/ssh/ssh-remote-node-toolchain-probe.test.ts": 8,
-      "src/main/ssh/ssh-remote-orca-cli.test.ts": 140,
-      "src/main/ssh/ssh-remote-orchestration-compatibility.test.ts": 289,
-      "src/main/ssh/ssh-remote-orchestration-send.test.ts": 8,
-      "src/main/ssh/ssh-remote-platform-detection.test.ts": 27,
-      "src/main/ssh/ssh-remote-platform.test.ts": 16,
-      "src/main/ssh/ssh-remote-powershell.test.ts": 72,
-      "src/main/ssh/ssh-remote-windows-command-line-limit.test.ts": 23,
-      "src/main/ssh/ssh-request-outcome-verdict.test.ts": 5,
-      "src/main/ssh/ssh-security-key-identity.test.ts": 41,
-      "src/main/ssh/ssh-session-limit-error.test.ts": 5,
-      "src/main/ssh/ssh-system-fallback.test.ts": 90,
-      "src/main/ssh/ssh-system-transport.integration.test.ts": 637,
-      "src/main/ssh/ssh-target-id-migration.test.ts": 6,
-      "src/main/ssh/ssh-target-readoption.test.ts": 10,
-      "src/main/ssh/system-ssh-binary.test.ts": 12,
-      "src/main/ssh/system-ssh-dynamic-forward-process.test.ts": 61,
-      "src/main/ssh/system-ssh-forward-process.test.ts": 40,
-      "src/main/ssh/system-ssh-sftp-args.test.ts": 8,
-      "src/main/ssh/system-ssh-sftp-path.test.ts": 11,
-      "src/main/ssh/system-ssh-windows-upload.test.ts": 112,
-      "src/main/ssh/system-ssh-windows-write-capabilities.test.ts": 8,
-      "src/main/ssh/vscode-ssh-authority.test.ts": 8,
-      "src/main/star-nag/service-direct-star.test.ts": 14,
-      "src/main/star-nag/service-force-show-races.test.ts": 17,
-      "src/main/star-nag/service-outcome-telemetry.test.ts": 11,
-      "src/main/star-nag/service-prompt-moments.test.ts": 18,
-      "src/main/star-nag/service-threshold-prompt.test.ts": 15,
-      "src/main/startup/bootstrap-fatal-exit-guard.test.ts": 6,
-      "src/main/startup/branch-rename-hook-structured-session.test.ts": 10,
-      "src/main/startup/cli-launch-redirect.test.ts": 11,
-      "src/main/startup/configure-process-dev-parent-shutdown.test.ts": 65,
-      "src/main/startup/configure-process.test.ts": 123,
-      "src/main/startup/desktop-startup-ordering.test.ts": 14,
-      "src/main/startup/dev-education-suppression.test.ts": 10,
-      "src/main/startup/dev-instance-identity.test.ts": 7,
-      "src/main/startup/ensure-virtual-display.test.ts": 5092,
-      "src/main/startup/first-window-startup-services.test.ts": 16,
-      "src/main/startup/gpu-fallback-marker.test.ts": 7,
-      "src/main/startup/gpu-fallback-switches.test.ts": 6,
-      "src/main/startup/gpu-lifecycle-install-dir-acl-guard.test.ts": 55,
-      "src/main/startup/headless-pty-hydration-ordering.test.ts": 10,
-      "src/main/startup/host-port-bootstrap-wiring.test.ts": 11,
-      "src/main/startup/hydrate-shell-path.test.ts": 228,
-      "src/main/startup/hydrate-shell-path.windows.test.ts": 284,
-      "src/main/startup/legacy-worker-renderer-recovery.test.ts": 16,
-      "src/main/startup/login-shell-environment.test.ts": 67,
-      "src/main/startup/main-process-error-guards.test.ts": 29,
-      "src/main/startup/main-process-ready-phase-ordering.test.ts": 9,
-      "src/main/startup/main-window-structured-status-filter.test.ts": 7,
-      "src/main/startup/os-opened-markdown-delivery.test.ts": 10,
-      "src/main/startup/os-opened-markdown-files.test.ts": 116,
-      "src/main/startup/os-opened-markdown-wiring.test.ts": 5,
-      "src/main/startup/pre-gone-crash-sampling-wiring.test.ts": 5,
-      "src/main/startup/renderer-heap-headroom.test.ts": 10,
-      "src/main/startup/run-electron-vite-dev-web.test.ts": 432,
-      "src/main/startup/run-electron-vite-dev.test.ts": 943,
-      "src/main/startup/secret-protection-report-deferral-wiring.test.ts": 6,
-      "src/main/startup/secure-dns-census.test.ts": 407,
-      "src/main/startup/serve-desktop-activation-wiring.test.ts": 9,
-      "src/main/startup/serve-desktop-activation.test.ts": 5,
-      "src/main/startup/serve-mode-argv-cli-redirect-order.test.ts": 9,
-      "src/main/startup/serve-mode-argv.test.ts": 32,
-      "src/main/startup/serve-options.test.ts": 20,
-      "src/main/startup/serve-signal-handlers.test.ts": 4,
-      "src/main/startup/single-instance-lock-exit.electron.test.ts": 275,
-      "src/main/startup/single-instance-lock-headless-exit.test.ts": 11,
-      "src/main/startup/single-instance-lock.test.ts": 19,
-      "src/main/startup/skill-share-deep-link-state.test.ts": 8,
-      "src/main/startup/startup-diagnostics.test.ts": 7,
-      "src/main/startup/window-all-closed-quit-policy.test.ts": 5,
-      "src/main/startup/windows-desktop-shell-path-startup.test.ts": 8,
-      "src/main/startup/windows-install-dir-acl-probe.test.ts": 20,
-      "src/main/startup/windows-install-dir-acl-recovery.test.ts": 460,
-      "src/main/startup/windows-install-dir-acl-startup-wiring.test.ts": 6,
-      "src/main/startup/windows-install-dir-package-acl-repair.test.ts": 43,
-      "src/main/startup/windows-shell-path-hydration.test.ts": 315,
-      "src/main/startup/windows-shell-path-ownership.test.ts": 10,
-      "src/main/startup/windows-user-data-acl.test.ts": 15,
-      "src/main/startup/wsl-cli-reconciliation-startup-barrier.test.ts": 9,
-      "src/main/stats/agent-session-transition-recorder.test.ts": 23,
-      "src/main/stats/collector-async-save.test.ts": 375,
-      "src/main/stats/stats-title-detection-independence.test.ts": 6,
-      "src/main/synthetic-title-frame-routing.test.ts": 4,
-      "src/main/synthetic-title-spinner.test.ts": 4,
-      "src/main/synthetic-title-visibility.test.ts": 5,
-      "src/main/system-fonts.test.ts": 16,
-      "src/main/system-power-lifecycle.test.ts": 8,
-      "src/main/system-resume-broadcast.test.ts": 24,
-      "src/main/telemetry/burst-cap.test.ts": 27,
-      "src/main/telemetry/classify-error.test.ts": 7,
-      "src/main/telemetry/client-lifecycle.test.ts": 17,
-      "src/main/telemetry/client.test.ts": 42,
-      "src/main/telemetry/cohort-classifier.test.ts": 13,
-      "src/main/telemetry/consent.test.ts": 15,
-      "src/main/telemetry/install-id.test.ts": 7,
-      "src/main/telemetry/onboarding-cohort-classifier.test.ts": 12,
-      "src/main/telemetry/onboarding-feature-setup-validator.test.ts": 18,
-      "src/main/telemetry/validator-warn-cache.test.ts": 30,
-      "src/main/telemetry/validator.test.ts": 20,
-      "src/main/terminal-history-async-delete.test.ts": 289,
-      "src/main/terminal-history-gc-fs-call-count.test.ts": 54,
-      "src/main/terminal-history-gc.test.ts": 877,
-      "src/main/terminal-history-tombstone-retry.test.ts": 4798,
-      "src/main/terminal-history.test.ts": 34,
-      "src/main/text-generation/agent-failure-output.test.ts": 11,
-      "src/main/text-generation/commit-message-agent-environment.test.ts": 31,
-      "src/main/text-generation/commit-message-command-backslash-mode.test.ts": 6,
-      "src/main/text-generation/commit-message-text-generation-branch-name.test.ts": 16,
-      "src/main/text-generation/commit-message-text-generation-cancellation.test.ts": 439,
-      "src/main/text-generation/commit-message-text-generation-failure-sanitization.test.ts": 15,
-      "src/main/text-generation/commit-message-text-generation-generated-output.test.ts": 15,
-      "src/main/text-generation/commit-message-text-generation-linked-issue.test.ts": 14,
-      "src/main/text-generation/commit-message-text-generation-local-subprocess.test.ts": 28,
-      "src/main/text-generation/commit-message-text-generation-model-discovery.test.ts": 48,
-      "src/main/text-generation/commit-message-text-generation-regression.test.ts": 10,
-      "src/main/text-generation/commit-message-text-generation-remote-execution.test.ts": 30,
-      "src/main/text-generation/commit-message-text-generation-settings.test.ts": 19,
-      "src/main/text-generation/pull-request-context-errors.test.ts": 25,
-      "src/main/text-generation/pull-request-context.test.ts": 30,
-      "src/main/tray/system-tray.test.ts": 92,
-      "src/main/tray/tray-attention-icon.test.ts": 13,
-      "src/main/tray/tray-dev-badge.test.ts": 11,
-      "src/main/update-install-exit-watchdog.test.ts": 12,
-      "src/main/updater-changelog.test.ts": 7,
-      "src/main/updater-events.test.ts": 204,
-      "src/main/updater-lifecycle-diagnostics.test.ts": 5,
-      "src/main/updater-linux-package-recovery-actions.test.ts": 2079,
-      "src/main/updater-nudge.test.ts": 12,
-      "src/main/updater-prerelease-feed-readiness.test.ts": 114,
-      "src/main/updater-prerelease-feed.test.ts": 148,
-      "src/main/updater-release-builds.test.ts": 30,
-      "src/main/updater-test-harness.leaked-timers.test.ts": 2596,
-      "src/main/updater-test-module-loader.test.ts": 508,
-      "src/main/updater.build-channel-selection.test.ts": 1674,
-      "src/main/updater.check-failure.test.ts": 1910,
-      "src/main/updater.check-preflight.test.ts": 2719,
-      "src/main/updater.check-settlement.test.ts": 2274,
-      "src/main/updater.fallback.test.ts": 22,
-      "src/main/updater.headless-serve-install.test.ts": 272,
-      "src/main/updater.install-failure-cause.test.ts": 2517,
-      "src/main/updater.linux-externally-managed.test.ts": 1400,
-      "src/main/updater.linux-root-package-install.test.ts": 1772,
-      "src/main/updater.nudge-campaign.test.ts": 1490,
-      "src/main/updater.prerelease-fallback.test.ts": 4396,
-      "src/main/updater.publishing-window-feed.test.ts": 3071,
-      "src/main/updater.quit-and-install.test.ts": 2199,
-      "src/main/updater.startup-scheduling.test.ts": 1573,
-      "src/main/usage-worktree-canonicalizer.test.ts": 10,
-      "src/main/usage-worktree-metadata.test.ts": 9,
-      "src/main/usage/highest-usage-key.test.ts": 14,
-      "src/main/usage/usage-breakdown-scaling.test.ts": 55,
-      "src/main/usage/usage-calendar-range.test.ts": 8,
-      "src/main/usage/usage-provider-store-lifecycle.test.ts": 293,
-      "src/main/usage/usage-worktree-refs.test.ts": 7,
-      "src/main/warp-themes/discovery.test.ts": 30,
-      "src/main/warp-themes/index.test.ts": 447,
-      "src/main/warp-themes/manual-warp-theme-files.test.ts": 36,
-      "src/main/warp-themes/parser-runner.test.ts": 9,
-      "src/main/warp-themes/parser.test.ts": 23,
-      "src/main/warp-themes/theme-file-scanner.test.ts": 22,
-      "src/main/win32-utils-async-acl.test.ts": 16,
-      "src/main/win32-utils.test.ts": 12,
-      "src/main/window/attach-main-window-services.test.ts": 195,
-      "src/main/window/clipboard-dashboard-popout-access.test.ts": 15,
-      "src/main/window/clipboard-file-copy.test.ts": 11,
-      "src/main/window/clipboard-image-temp-file.test.ts": 8,
-      "src/main/window/clipboard-image-thumbnail.test.ts": 8,
-      "src/main/window/clipboard-ipc-handlers.test.ts": 94,
-      "src/main/window/clipboard-remote-file-copy.test.ts": 18,
-      "src/main/window/clipboard-remote-file-staging-fs.test.ts": 23,
-      "src/main/window/clipboard-remote-file-staging.test.ts": 37,
-      "src/main/window/clipboard-runtime-owned-ssh-paste.test.ts": 15,
-      "src/main/window/clipboard-text-write-verify.test.ts": 8,
-      "src/main/window/clipboard-windows-image-file.test.ts": 17,
-      "src/main/window/createMainWindow-close-confirmation.test.ts": 29,
-      "src/main/window/createMainWindow-markdown-editor-focus.test.ts": 21,
-      "src/main/window/createMainWindow-recovery-reload-watchdog.test.ts": 48,
-      "src/main/window/createMainWindow-renderer-crash-recovery.test.ts": 51,
-      "src/main/window/createMainWindow-startup-reveal.test.ts": 35,
-      "src/main/window/createMainWindow-system-resume-relay.test.ts": 11,
-      "src/main/window/createMainWindow-terminal-focus-shortcuts.test.ts": 46,
-      "src/main/window/createMainWindow-tray-minimize-close.test.ts": 31,
-      "src/main/window/createMainWindow-zoom-and-tab-switch-shortcuts.test.ts": 17,
-      "src/main/window/createMainWindow.test.ts": 35,
-      "src/main/window/dashboard-popout-window.test.ts": 26,
-      "src/main/window/editable-context-menu.test.ts": 20,
-      "src/main/window/focus-existing-window.test.ts": 10,
-      "src/main/window/foreground-activation-policy.test.ts": 15,
-      "src/main/window/history-gc-profile-worktree-ids.test.ts": 13,
-      "src/main/window/history-gc-worktree-ids.test.ts": 8,
-      "src/main/window/macos-app-activation.test.ts": 5,
-      "src/main/window/macos-tahoe-release.test.ts": 6,
-      "src/main/window/main-window-visibility.test.ts": 5,
-      "src/main/window/main-window-webview-security.test.ts": 12,
-      "src/main/window/mobile-markdown-request-relay.test.ts": 26,
-      "src/main/window/privileged-window-navigation.test.ts": 14,
-      "src/main/window/renderer-document-navigation.test.ts": 9,
-      "src/main/window/renderer-publication-throttle.test.ts": 5,
-      "src/main/window/renderer-recovery-prompt.test.ts": 21,
-      "src/main/window/renderer-recovery-reload-watchdog.test.ts": 16,
-      "src/main/window/runtime-renderer-notification-sender.test.ts": 9,
-      "src/main/window/session-tab-close-request-relay.test.ts": 40,
-      "src/main/window/terminal-tab-close-request-relay.test.ts": 24,
-      "src/main/window/updater-package-recovery-ipc.test.ts": 14,
-      "src/main/window/window-close-decision.test.ts": 4,
-      "src/main/windows-descendant-exit-verification.test.ts": 17,
-      "src/main/windows-process-tree-kill.test.ts": 7,
-      "src/main/windows-pty-root-identity.test.ts": 13,
-      "src/main/windows/windows-command-line-recovery-health.test.ts": 10,
-      "src/main/windows/windows-process-table-cim-scan.test.ts": 6,
-      "src/main/windows/windows-process-table.test.ts": 64,
-      "src/main/windows/windows-process-tree-command-line-patch.test.ts": 11,
-      "src/main/windows/windows-pty-job.test.ts": 14,
-      "src/main/workspace-cleanup-removal-snapshot-prune.test.ts": 13,
-      "src/main/workspace-cleanup-scan-snapshot.test.ts": 88,
-      "src/main/workspace-space-analysis-capacity.test.ts": 38,
-      "src/main/workspace-space-analysis-du-timeout.test.ts": 236,
-      "src/main/workspace-space-analysis-snapshot.test.ts": 66,
-      "src/main/workspace-space-analysis.test.ts": 227,
-      "src/main/workspace-space-repo-scan.test.ts": 5,
-      "src/main/workspace-space-scan-control.test.ts": 36,
-      "src/main/worktree-create-base-prefetch.test.ts": 225,
-      "src/main/worktree-create-base.test.ts": 5,
-      "src/main/worktree-create-candidates.test.ts": 5,
-      "src/main/worktree-create-execution-host-route.test.ts": 10,
-      "src/main/worktree-create-preparation-cancellation.test.ts": 29,
-      "src/main/worktree-create-preparation-claim.test.ts": 8,
-      "src/main/worktree-create-preparation-wsl-root.test.ts": 13,
-      "src/main/worktree-create-preparation.test.ts": 110,
-      "src/main/worktree-create-timing.test.ts": 7,
-      "src/main/worktree-identity-persistence.test.ts": 207,
-      "src/main/worktree-lineage-pruning.test.ts": 12,
-      "src/main/worktree-metadata-ownership.test.ts": 4,
-      "src/main/worktree-name-retirement.test.ts": 18,
-      "src/main/worktree-removal-authority.test.ts": 10,
-      "src/main/worktree-removal-execution-host-route.test.ts": 6,
-      "src/main/worktree-removal-repo-owner.test.ts": 7,
-      "src/main/worktree-removal-safety.test.ts": 18,
-      "src/main/worktree-removal-session-partition-fencing.test.ts": 1223,
-      "src/main/worktree-retirement-backfill-scan.test.ts": 20,
-      "src/main/worktree-retirement-backfill-stall.test.ts": 15,
-      "src/main/worktree-retirement-discovery-wsl.test.ts": 32,
-      "src/main/worktree-retirement-discovery.test.ts": 37,
-      "src/main/worktree-retirement-namespace.test.ts": 28,
-      "src/main/worktree-root-preparation.test.ts": 11,
-      "src/main/worktree-trash.test.ts": 53,
-      "src/main/wsl-availability-missing-kernel.test.ts": 10,
-      "src/main/wsl-bash-command.test.ts": 4,
-      "src/main/wsl-distro-list-output.test.ts": 8,
-      "src/main/wsl-distro-list-single-flight.test.ts": 14,
-      "src/main/wsl-fish-history-cleanup.test.ts": 15,
-      "src/main/wsl-interop-spawn-directory.test.ts": 10,
-      "src/main/wsl-running-distros.test.ts": 125,
-      "src/main/wsl-unc-delete-symlink-repro.test.ts": 7,
-      "src/main/wsl-unc-delete.test.ts": 12,
-      "src/main/wsl.test.ts": 35,
-      "src/main/wsl/wsl-guest-environment.test.ts": 52,
-      "src/main/wsl/wsl-invocation-boundary.test.ts": 6,
-      "src/main/wsl/wsl-probe-failure-semantics.test.ts": 587,
-      "src/main/wsl/wsl-runner.test.ts": 32,
-      "src/main/wsl/wsl-w1-w3-contract.test.ts": 26,
-      "src/preload/api/platform-bridge.test.ts": 12,
-      "src/preload/app-restart-checkpoint-routing.test.ts": 651,
-      "src/preload/browser-client-page-renderer-requests.test.ts": 22,
-      "src/preload/browser-find-subscriptions.test.ts": 11,
-      "src/preload/browser-window-close.test.ts": 6,
-      "src/preload/close-active-tab-payload-admission.test.ts": 5,
-      "src/preload/doc-preview-link-interception.test.ts": 29,
-      "src/preload/pty-snapshot-capability-ipc.test.ts": 652,
-      "src/preload/renderer-heap-statistics-reader.test.ts": 5,
-      "src/preload/renderer-process-memory-reader.test.ts": 7,
-      "src/preload/renderer-restart-wiring.test.ts": 13,
-      "src/preload/runtime-environment-subscriptions.test.ts": 11,
-      "src/preload/ssh-authority-forwarding.test.ts": 682,
-      "src/preload/updater-package-recovery.test.ts": 273,
-      "src/preload/usage-provider-api.test.ts": 9,
-      "src/relay/agent-exec-handler-windows.test.ts": 11,
-      "src/relay/agent-exec-handler.test.ts": 28,
-      "src/relay/agent-hook-envelope-publication.test.ts": 215,
-      "src/relay/agent-hook-integration.test.ts": 116,
-      "src/relay/agent-hook-retired-pane-suppression.test.ts": 125,
-      "src/relay/agent-hook-server-codex-subagent-transcript.test.ts": 1068,
-      "src/relay/agent-hook-server.test.ts": 1481,
-      "src/relay/ai-vault-handler.test.ts": 208,
-      "src/relay/ai-vault-service-client.test.ts": 28,
-      "src/relay/ai-vault-service-restart-policy.test.ts": 10,
-      "src/relay/ai-vault-service-spawn.test.ts": 9,
-      "src/relay/context.test.ts": 5,
-      "src/relay/dispatcher-capacity-degradation.test.ts": 112,
-      "src/relay/dispatcher-client-close-cause.test.ts": 15,
-      "src/relay/dispatcher-client-writer.test.ts": 13,
-      "src/relay/dispatcher-frame-guard-regressions.test.ts": 7,
-      "src/relay/dispatcher-json-payload.test.ts": 51,
-      "src/relay/dispatcher-notification-ownership.test.ts": 5,
-      "src/relay/dispatcher-silent-client-reaper.test.ts": 19,
-      "src/relay/dispatcher-structured-error.test.ts": 10,
-      "src/relay/dispatcher-timeout.test.ts": 19,
-      "src/relay/dispatcher-writer-admission.test.ts": 94,
-      "src/relay/dispatcher.test.ts": 198,
-      "src/relay/external-automation-provider-catalog.test.ts": 27,
-      "src/relay/external-automations-handler-log-path.test.ts": 24,
-      "src/relay/external-automations-handler.test.ts": 21,
-      "src/relay/fs-handler-doc-preview.test.ts": 16,
-      "src/relay/fs-handler-file-range-dispatch.test.ts": 79,
-      "src/relay/fs-handler-file-range.test.ts": 61,
-      "src/relay/fs-handler-git-search.test.ts": 7,
-      "src/relay/fs-handler-install-rg.test.ts": 9,
-      "src/relay/fs-handler-list-files-cancel.test.ts": 28,
-      "src/relay/fs-handler-list-files-ignored.test.ts": 648,
-      "src/relay/fs-handler-list-files-result-limit.test.ts": 12,
-      "src/relay/fs-handler-readdir-fallback.test.ts": 8,
-      "src/relay/fs-handler-ripgrep-fallback.test.ts": 19,
-      "src/relay/fs-handler-stream.test.ts": 475,
-      "src/relay/fs-handler.test.ts": 172,
-      "src/relay/fs-list-files-cancel.integration.test.ts": 26,
-      "src/relay/fs-list-files-large-response.integration.test.ts": 87,
-      "src/relay/fs-list-files-scan-coordinator.test.ts": 14,
-      "src/relay/fs-path-metadata-requests.test.ts": 10,
-      "src/relay/fs-path-metadata-symlink-concurrency.test.ts": 11,
-      "src/relay/fs-search-line-fragments.test.ts": 84,
-      "src/relay/fs-stream-pty-echo-backpressure.integration.test.ts": 135,
-      "src/relay/git-branch-delete-refusal-parity.test.ts": 10,
-      "src/relay/git-exec-validator.test.ts": 18,
-      "src/relay/git-handler-blob-readers.test.ts": 9,
-      "src/relay/git-handler-branch-cleanup.test.ts": 19,
-      "src/relay/git-handler-branch-compare.test.ts": 58,
-      "src/relay/git-handler-branch-diff-equivalence.test.ts": 908,
-      "src/relay/git-handler-branch-diff.test.ts": 174,
-      "src/relay/git-handler-check-ignore.test.ts": 8,
-      "src/relay/git-handler-diff-read-coalescing.test.ts": 103,
-      "src/relay/git-handler-file-diff.test.ts": 1278,
-      "src/relay/git-handler-fork-remote-exec.test.ts": 75,
-      "src/relay/git-handler-pull-reconciliation.test.ts": 712,
-      "src/relay/git-handler-push-target.test.ts": 16,
-      "src/relay/git-handler-remote-sync.test.ts": 1241,
-      "src/relay/git-handler-staging.test.ts": 402,
-      "src/relay/git-handler-status-ops.test.ts": 63,
-      "src/relay/git-handler-submodule-cache-invalidation.test.ts": 8,
-      "src/relay/git-handler-submodule-ops.test.ts": 47,
-      "src/relay/git-handler-submodule-status-cancellation.test.ts": 11,
-      "src/relay/git-handler-termination.test.ts": 9,
-      "src/relay/git-handler-utils.test.ts": 4,
-      "src/relay/git-handler-working-tree-changes.test.ts": 1001,
-      "src/relay/git-handler-worktree-clean.test.ts": 9,
-      "src/relay/git-handler-worktree-git-capabilities.test.ts": 12,
-      "src/relay/git-handler-worktree-inspection.test.ts": 819,
-      "src/relay/git-handler-worktree-list-authority.test.ts": 12,
-      "src/relay/git-handler-worktree-list.test.ts": 11,
-      "src/relay/git-handler-worktree-ops.test.ts": 27,
-      "src/relay/git-handler-worktree-paths.test.ts": 5,
-      "src/relay/git-handler-worktree-provisioning.test.ts": 723,
-      "src/relay/git-handler.test.ts": 638,
-      "src/relay/git-porcelain-local-parity.test.ts": 21,
-      "src/relay/git-push-target-local-parity.test.ts": 21,
-      "src/relay/git-response-pty-echo-backpressure.integration.test.ts": 751,
-      "src/relay/git-response-stream-ownership.test.ts": 18,
-      "src/relay/git-status-branch-line-total.test.ts": 197,
-      "src/relay/git-status-upstream-negative-cache.test.ts": 260,
-      "src/relay/git-stdout-stream.test.ts": 21,
-      "src/relay/git-working-file-read.test.ts": 27,
-      "src/relay/hermes-run-correlation.test.ts": 8,
-      "src/relay/hermes-run-history.test.ts": 13,
-      "src/relay/integration.test.ts": 1222,
-      "src/relay/legacy-relay-publication-ledger.test.ts": 7,
-      "src/relay/managed-hook-installer.test.ts": 13,
-      "src/relay/node-pty-binding-survey.test.ts": 132,
-      "src/relay/node-pty-unavailable-diagnosis.test.ts": 13,
-      "src/relay/plugin-overlay-env.test.ts": 14,
-      "src/relay/plugin-overlay.test.ts": 24,
-      "src/relay/plugin-source-limit.test.ts": 8,
-      "src/relay/port-scan-handler.test.ts": 70,
-      "src/relay/preflight-handler.test.ts": 18,
-      "src/relay/protocol-backpressure.test.ts": 51,
-      "src/relay/protocol-handshake.test.ts": 7,
-      "src/relay/protocol-json-payload.test.ts": 178,
-      "src/relay/pty-handler-attach-replay.test.ts": 49,
-      "src/relay/pty-handler-dispose-lifecycle.test.ts": 37,
-      "src/relay/pty-handler-grace-timer.test.ts": 19,
-      "src/relay/pty-handler-inventory-process-evidence.test.ts": 30,
-      "src/relay/pty-handler-output-drain-differential.test.ts": 135,
-      "src/relay/pty-handler-output-streaming.test.ts": 420,
-      "src/relay/pty-handler-ownership-attestation.test.ts": 87,
-      "src/relay/pty-handler-resize-stale-pty.test.ts": 30,
-      "src/relay/pty-handler-retired-pane-surface.test.ts": 82,
-      "src/relay/pty-handler-revive.test.ts": 91,
-      "src/relay/pty-handler-shell-resolution.test.ts": 33,
-      "src/relay/pty-handler-shutdown-signals.test.ts": 54,
-      "src/relay/pty-handler-source-publication.test.ts": 260,
-      "src/relay/pty-handler-spawn-admission.test.ts": 127,
-      "src/relay/pty-handler-spawn-cwd.test.ts": 46,
-      "src/relay/pty-handler-spawn-environment.test.ts": 108,
-      "src/relay/pty-handler-startup-command-delivery.test.ts": 111,
-      "src/relay/pty-handler-windows-child-process-evidence.test.ts": 35,
-      "src/relay/pty-replay-buffer-equivalence.test.ts": 77,
-      "src/relay/pty-shell-launch.test.ts": 312,
-      "src/relay/pty-shell-utils.test.ts": 58,
-      "src/relay/pty-source-credit-ledger.test.ts": 122,
-      "src/relay/pty-source-credit-scheduler.test.ts": 12,
-      "src/relay/pty-source-sent-boundaries.test.ts": 88,
-      "src/relay/relay-command-env.test.ts": 14,
-      "src/relay/relay-daemon-fatal-reap.test.ts": 540,
-      "src/relay/relay-diagnostic-log.test.ts": 7,
-      "src/relay/relay-endpoint-credential-publication.test.ts": 2634,
-      "src/relay/relay-filesystem-watch-registry.test.ts": 128,
-      "src/relay/relay-grace-branch.test.ts": 7,
-      "src/relay/relay-handshake-roundtrip.test.ts": 317,
-      "src/relay/relay-launch-options.test.ts": 12,
-      "src/relay/relay-oversized-notification-survival.test.ts": 67,
-      "src/relay/relay-pty-consumer-owner-displacement.test.ts": 19,
-      "src/relay/relay-pty-publication-admission.test.ts": 26,
-      "src/relay/relay-pty-source-cancellation-exit.test.ts": 54,
-      "src/relay/relay-pty-source-exit-publication.test.ts": 27,
-      "src/relay/relay-pty-source-publication.test.ts": 69,
-      "src/relay/relay-pty-source-recovery-completion.test.ts": 9,
-      "src/relay/relay-pty-source-recovery-interleavings.test.ts": 25,
-      "src/relay/relay-pty-source-recovery-window.test.ts": 33,
-      "src/relay/relay-pty-source-restore-retry.test.ts": 15,
-      "src/relay/relay-pty-source-send-scheduler.test.ts": 9,
-      "src/relay/relay-pty-source-superseded-activation.test.ts": 21,
-      "src/relay/relay-reconnect-listener-credential-gate.test.ts": 28,
-      "src/relay/relay-watch-root-capacity.test.ts": 15,
-      "src/relay/relay-watcher-event-emitter.test.ts": 842,
-      "src/relay/relay-watcher-frame-chunking.test.ts": 632,
-      "src/relay/relay-watcher-parent-removal.test.ts": 20,
-      "src/relay/relay-watcher-pending-setup-waiters.test.ts": 233,
-      "src/relay/relay-watcher-setup-wait.test.ts": 320,
-      "src/relay/remote-artifact-cli-input.test.ts": 124,
-      "src/relay/remote-cli-env.test.ts": 5,
-      "src/relay/remote-cli-stdin.test.ts": 7,
-      "src/relay/remote-cli-timeout.test.ts": 9,
-      "src/relay/retired-pane-surfaces.test.ts": 7,
-      "src/relay/rotating-log-writer.test.ts": 33,
-      "src/relay/skill-install-handler.test.ts": 306,
-      "src/relay/skill-upload-multi-relay.integration.test.ts": 549,
-      "src/relay/ssh-pty-consumer-session-adapter.test.ts": 48,
-      "src/relay/ssh-pty-source-credit-adapter.test.ts": 29,
-      "src/relay/subprocess-tree-termination.test.ts": 6,
-      "src/relay/subprocess.test.ts": 22239,
-      "src/relay/terminal-history-wsl.test.ts": 11,
-      "src/relay/terminal-history.test.ts": 14,
-      "src/relay/windows-port-scan.test.ts": 66,
-      "src/relay/workspace-session-handler.test.ts": 12,
-      "src/relay/workspace-snapshot-publication.test.ts": 29,
-      "src/relay/workspace-space-scan-du-capacity.test.ts": 34,
-      "src/relay/workspace-space-scan.test.ts": 37,
-      "src/relay/wsl-agent-hook-relay.test.ts": 45,
-      "src/relay/wsl-hook-fs-bridge.test.ts": 11,
-      "src/relay/wsl-install-plugins-handler.test.ts": 20,
-      "src/renderer/src/app-shell/app-command-handlers-tab-rename.test.ts": 13,
-      "src/renderer/src/app-shell/app-command-handlers-workspace-delete.test.ts": 10,
-      "src/renderer/src/app-shell/app-root-surface-settings.test.tsx": 25,
-      "src/renderer/src/app-shell/reconcile-hydrated-workspace-tab-models.test.ts": 6,
-      "src/renderer/src/app-shell/remote-workspace-unplaced-upload-suppression.test.tsx": 92,
-      "src/renderer/src/app-shell/shutdown-checkpoint-persist.test.ts": 16,
-      "src/renderer/src/app-shell/shutdown-checkpoint-restart-lifecycle.test.ts": 20,
-      "src/renderer/src/app-shell/startup-actions-selector.test.ts": 56,
-      "src/renderer/src/app-shell/use-document-appearance.test.tsx": 33,
-      "src/renderer/src/app-shell/window-visibility-actions-selector.test.ts": 42,
-      "src/renderer/src/app-shell/workspace-view-cross-client-sync.test.tsx": 120,
-      "src/renderer/src/app-startup-routing.test.ts": 13,
-      "src/renderer/src/assets/mobile-page-qr-layout.test.ts": 5,
-      "src/renderer/src/assets/rich-markdown-task-list-style.test.ts": 4,
-      "src/renderer/src/assets/terminal-container-geometry.test.ts": 7,
-      "src/renderer/src/assets/terminal-scrollbar-style.test.ts": 4,
-      "src/renderer/src/assets/worktree-card-active-style.test.ts": 4,
-      "src/renderer/src/components/AgentStateDot.test.ts": 38,
-      "src/renderer/src/components/AgentWorkingSpinner.test.tsx": 43,
-      "src/renderer/src/components/LinuxPackageInstallRecoveryCard.test.tsx": 343,
-      "src/renderer/src/components/NewWorkspaceComposerCard.set-location-warm.test.tsx": 141,
-      "src/renderer/src/components/NewWorkspaceComposerCard.set-location.test.tsx": 229,
-      "src/renderer/src/components/NewWorkspaceComposerCard.test.tsx": 1044,
-      "src/renderer/src/components/QuickOpen.mount-gating.test.tsx": 647,
-      "src/renderer/src/components/SelectedTextCopyMenu.test.tsx": 49,
-      "src/renderer/src/components/StarNagCard.test.tsx": 60,
-      "src/renderer/src/components/StateIndicatorTooltip.test.tsx": 12,
-      "src/renderer/src/components/TerminalSearch.test.tsx": 106,
-      "src/renderer/src/components/TerminalTitlebarTabs.test.tsx": 28,
-      "src/renderer/src/components/TerminalWorkbenchContainer.test.tsx": 40,
-      "src/renderer/src/components/UpdateCard.error-card.test.tsx": 449,
-      "src/renderer/src/components/UpdateCard.test.ts": 60,
-      "src/renderer/src/components/WorktreeBaseFallbackDialog.test.tsx": 146,
-      "src/renderer/src/components/WorktreeJumpPalette.linear-url.test.tsx": 865,
-      "src/renderer/src/components/WorktreeJumpPalette.mount-gating.test.tsx": 489,
-      "src/renderer/src/components/WorktreeJumpPalette.recent-tabs.behavior.test.tsx": 466,
-      "src/renderer/src/components/WorktreeJumpPalette.recent-tabs.test.tsx": 907,
-      "src/renderer/src/components/WorktreeJumpPalette.test.tsx": 423,
-      "src/renderer/src/components/activity/ActivityPrototypePage.filter-focus-shortcut.test.ts": 8,
-      "src/renderer/src/components/activity/ActivityPrototypePage.test.ts": 21,
-      "src/renderer/src/components/activity/ActivityPrototypePage.thread-grouping.test.ts": 31,
-      "src/renderer/src/components/activity/ActivityThreadOptionsMenu.test.tsx": 388,
-      "src/renderer/src/components/activity/activity-auto-mark-read-loop.react185.test.tsx": 950,
-      "src/renderer/src/components/activity/activity-clear-completed.test.ts": 28,
-      "src/renderer/src/components/activity/activity-event-builder-agent-context.test.ts": 13,
-      "src/renderer/src/components/activity/activity-event-builder.bounded-history.test.ts": 12,
-      "src/renderer/src/components/activity/activity-event-builder.host-ownership.test.ts": 17,
-      "src/renderer/src/components/activity/activity-event-builder.identity-reuse.test.ts": 15,
-      "src/renderer/src/components/activity/activity-event-builder.live-cap.test.ts": 14,
-      "src/renderer/src/components/activity/activity-portal-churn-budget.test.ts": 8,
-      "src/renderer/src/components/activity/activity-portal-readiness-decay.react185.test.tsx": 33,
-      "src/renderer/src/components/activity/activity-portal-readiness-loop.react185.test.tsx": 144,
-      "src/renderer/src/components/activity/activity-portal-readiness-oscillation.test.ts": 5,
-      "src/renderer/src/components/activity/activity-portal-readiness-subscription-churn.react185.test.tsx": 131,
-      "src/renderer/src/components/activity/activity-portal-thread-reconciliation.test.ts": 9,
-      "src/renderer/src/components/activity/activity-scope-filter.test.ts": 9,
-      "src/renderer/src/components/activity/activity-terminal-portal-publication-loop.react185.test.tsx": 21,
-      "src/renderer/src/components/activity/activity-terminal-portal.test.tsx": 19,
-      "src/renderer/src/components/activity/activity-thread-actions.test.ts": 17,
-      "src/renderer/src/components/activity/activity-thread-child-agent.test.ts": 7,
-      "src/renderer/src/components/activity/activity-thread-grouping.search-cache.test.ts": 8,
-      "src/renderer/src/components/activity/activity-thread-grouping.status-order.test.ts": 17,
-      "src/renderer/src/components/activity/activity-thread-hover-card.test.tsx": 228,
-      "src/renderer/src/components/activity/activity-thread-list-pane-collapsible.test.tsx": 218,
-      "src/renderer/src/components/activity/activity-thread-list-pane.virtualization.test.tsx": 852,
-      "src/renderer/src/components/activity/activity-thread-presentation.test.ts": 9,
-      "src/renderer/src/components/activity/activity-thread-virtual-items.test.ts": 12,
-      "src/renderer/src/components/activity/dev-activity-fixture.test.ts": 7,
-      "src/renderer/src/components/activity/event-time-clock-refresh.test.tsx": 40,
-      "src/renderer/src/components/activity/use-activity-thread-action-bindings.test.tsx": 22,
-      "src/renderer/src/components/activity/useActivityUnreadCount.freshness.test.tsx": 42,
-      "src/renderer/src/components/activity/useActivityUnreadCount.test.ts": 7,
-      "src/renderer/src/components/agent-session-continuation/AgentSessionContinuationDialog.test.tsx": 42,
-      "src/renderer/src/components/agent-session-continuation/agent-session-continuation-selection.test.ts": 5,
-      "src/renderer/src/components/agent/AgentCombobox.test.tsx": 855,
-      "src/renderer/src/components/agent/AgentSettingsDialog.test.tsx": 68,
-      "src/renderer/src/components/agent/agent-combobox-command-state.test.ts": 6,
-      "src/renderer/src/components/artifacts/ArtifactCollection.test.tsx": 439,
-      "src/renderer/src/components/artifacts/ArtifactPreview.test.tsx": 69,
-      "src/renderer/src/components/artifacts/ArtifactPublishButton.test.tsx": 272,
-      "src/renderer/src/components/artifacts/ArtifactsPage.test.tsx": 1134,
-      "src/renderer/src/components/artifacts/artifact-display-labels.test.ts": 30,
-      "src/renderer/src/components/artifacts/artifact-list-search.test.ts": 11,
-      "src/renderer/src/components/artifacts/artifact-publish-flow.test.ts": 62,
-      "src/renderer/src/components/artifacts/artifact-published-link-client.test.ts": 13,
-      "src/renderer/src/components/automations/AutomationDestinationField.test.tsx": 285,
-      "src/renderer/src/components/automations/AutomationDetail.host.test.tsx": 104,
-      "src/renderer/src/components/automations/AutomationDetail.test.tsx": 81,
-      "src/renderer/src/components/automations/AutomationEditorPromptEditor.test.tsx": 35,
-      "src/renderer/src/components/automations/AutomationHostBadges.test.tsx": 191,
-      "src/renderer/src/components/automations/AutomationHostFilterNotice.test.tsx": 125,
-      "src/renderer/src/components/automations/AutomationListEmptyView.test.tsx": 53,
-      "src/renderer/src/components/automations/AutomationListHostGroups.test.tsx": 71,
-      "src/renderer/src/components/automations/AutomationListLocalRows.test.tsx": 298,
-      "src/renderer/src/components/automations/AutomationListSearchField.test.tsx": 74,
-      "src/renderer/src/components/automations/AutomationListTableHeader.test.tsx": 131,
-      "src/renderer/src/components/automations/AutomationOwnerConflictNotice.test.tsx": 60,
-      "src/renderer/src/components/automations/AutomationPromptDisclosure.test.tsx": 334,
-      "src/renderer/src/components/automations/AutomationRunHistory.test.tsx": 122,
-      "src/renderer/src/components/automations/AutomationRunsDashboardSurface.test.tsx": 23,
-      "src/renderer/src/components/automations/AutomationRunsTable.test.tsx": 60,
-      "src/renderer/src/components/automations/AutomationSchedulePicker.render.test.tsx": 915,
-      "src/renderer/src/components/automations/AutomationSchedulePicker.test.ts": 839,
-      "src/renderer/src/components/automations/AutomationTimeField.test.tsx": 248,
-      "src/renderer/src/components/automations/AutomationsDetailPane.run-count.test.tsx": 115,
-      "src/renderer/src/components/automations/AutomationsDetailPane.test.tsx": 178,
-      "src/renderer/src/components/automations/AutomationsListPanel.test.tsx": 271,
-      "src/renderer/src/components/automations/AutomationsPage.create-destination.test.tsx": 412,
-      "src/renderer/src/components/automations/AutomationsPage.cross-authority-actions.test.tsx": 137,
-      "src/renderer/src/components/automations/AutomationsPage.escape-precedence.test.tsx": 232,
-      "src/renderer/src/components/automations/AutomationsPage.external-scope.test.tsx": 212,
-      "src/renderer/src/components/automations/AutomationsPage.notice-recovery.test.tsx": 198,
-      "src/renderer/src/components/automations/AutomationsPage.refresh-selection.test.tsx": 376,
-      "src/renderer/src/components/automations/AutomationsPage.run-visibility.test.tsx": 133,
-      "src/renderer/src/components/automations/AutomationsPage.save-visibility.test.tsx": 195,
-      "src/renderer/src/components/automations/AutomationsPage.strict-mode-save-visibility.test.tsx": 233,
-      "src/renderer/src/components/automations/AutomationsPage.test.tsx": 644,
-      "src/renderer/src/components/automations/AutomationsPageBreadcrumb.test.tsx": 62,
-      "src/renderer/src/components/automations/CreateFromPicker.test.tsx": 75,
-      "src/renderer/src/components/automations/ExternalAutomationManagers.test.tsx": 247,
-      "src/renderer/src/components/automations/automation-authority-identity.test.ts": 8,
-      "src/renderer/src/components/automations/automation-captured-owner.test.ts": 8,
-      "src/renderer/src/components/automations/automation-create-destination.test.ts": 10,
-      "src/renderer/src/components/automations/automation-create-projects.test.ts": 6,
-      "src/renderer/src/components/automations/automation-detail-tab-navigation.test.ts": 16,
-      "src/renderer/src/components/automations/automation-editor-prompt-options.test.ts": 6,
-      "src/renderer/src/components/automations/automation-external-target-match.test.ts": 8,
-      "src/renderer/src/components/automations/automation-host-cache-controller.test.ts": 21,
-      "src/renderer/src/components/automations/automation-host-cache-health.test.ts": 9,
-      "src/renderer/src/components/automations/automation-host-cache.test.ts": 18,
-      "src/renderer/src/components/automations/automation-host-catalog-generation.test.ts": 14,
-      "src/renderer/src/components/automations/automation-host-catalog-order.test.ts": 19,
-      "src/renderer/src/components/automations/automation-host-catalog-source.test.ts": 11,
-      "src/renderer/src/components/automations/automation-host-catalog.test.ts": 64,
-      "src/renderer/src/components/automations/automation-host-client.test.ts": 7,
-      "src/renderer/src/components/automations/automation-host-detail-display.test.ts": 4,
-      "src/renderer/src/components/automations/automation-host-diagnostics.test.ts": 28,
-      "src/renderer/src/components/automations/automation-host-filter-resolution.test.ts": 28,
-      "src/renderer/src/components/automations/automation-host-health.test.ts": 7,
-      "src/renderer/src/components/automations/automation-host-invalidation-window-events.test.ts": 12,
-      "src/renderer/src/components/automations/automation-host-invalidation.test.ts": 17,
-      "src/renderer/src/components/automations/automation-host-list-rows.test.ts": 8,
-      "src/renderer/src/components/automations/automation-host-orphan-entry.test.ts": 22,
-      "src/renderer/src/components/automations/automation-host-picker-groups.test.ts": 19,
-      "src/renderer/src/components/automations/automation-host-recovery.test.ts": 5,
-      "src/renderer/src/components/automations/automation-host-scale-gates.test.ts": 195,
-      "src/renderer/src/components/automations/automation-host-scheduler.test.ts": 18,
-      "src/renderer/src/components/automations/automation-host-status-descriptors.test.ts": 24,
-      "src/renderer/src/components/automations/automation-list-empty-state.test.ts": 18,
-      "src/renderer/src/components/automations/automation-list-focus-recovery.test.ts": 7,
-      "src/renderer/src/components/automations/automation-list-keyboard-navigation.test.ts": 8,
-      "src/renderer/src/components/automations/automation-list-last-run.test.ts": 26,
-      "src/renderer/src/components/automations/automation-list-row-identity.test.ts": 7,
-      "src/renderer/src/components/automations/automation-list-search-rows.test.ts": 12,
-      "src/renderer/src/components/automations/automation-list-search.test.ts": 12,
-      "src/renderer/src/components/automations/automation-list-view-sort.test.ts": 175,
-      "src/renderer/src/components/automations/automation-list-view.test.ts": 15,
-      "src/renderer/src/components/automations/automation-project-groups.test.ts": 8,
-      "src/renderer/src/components/automations/automation-run-completion-evidence.test.ts": 7,
-      "src/renderer/src/components/automations/automation-run-context.test.ts": 5,
-      "src/renderer/src/components/automations/automation-run-history-keyboard-navigation.test.ts": 14,
-      "src/renderer/src/components/automations/automation-run-open-target.test.ts": 10,
-      "src/renderer/src/components/automations/automation-run-output-snapshot-equivalence.test.ts": 69,
-      "src/renderer/src/components/automations/automation-run-output-snapshot.test.ts": 47,
-      "src/renderer/src/components/automations/automation-run-view-state.test.ts": 11,
-      "src/renderer/src/components/automations/automation-runs-dashboard-model.test.ts": 6,
-      "src/renderer/src/components/automations/automation-scoped-list-client.test.ts": 76,
-      "src/renderer/src/components/automations/automation-setup-decision.test.ts": 8,
-      "src/renderer/src/components/automations/automation-source-display.test.ts": 10,
-      "src/renderer/src/components/automations/automation-target-availability.test.ts": 12,
-      "src/renderer/src/components/automations/automation-usage-model.test.ts": 6,
-      "src/renderer/src/components/automations/automation-write-invalidation.test.ts": 8,
-      "src/renderer/src/components/automations/external-automation-display.test.ts": 6,
-      "src/renderer/src/components/automations/external-automation-list-entries.test.ts": 7,
-      "src/renderer/src/components/automations/external-automation-run-table-state.test.ts": 9,
-      "src/renderer/src/components/automations/external-automation-scope-gating.test.ts": 11,
-      "src/renderer/src/components/automations/external-automation-scope-keys.test.ts": 7,
-      "src/renderer/src/components/automations/external-automation-source-availability.test.ts": 5,
-      "src/renderer/src/components/automations/hermes-cron-output-parse.test.ts": 27,
-      "src/renderer/src/components/automations/use-automation-host-catalog-readoption.test.tsx": 58,
-      "src/renderer/src/components/automations/use-automation-host-catalog.test.tsx": 56,
-      "src/renderer/src/components/automations/use-automation-list-focus-recovery.test.tsx": 26,
-      "src/renderer/src/components/automations/use-automation-list-search.test.tsx": 33,
-      "src/renderer/src/components/automations/use-automation-runs-dashboard.test.tsx": 53,
-      "src/renderer/src/components/automations/use-external-automation-scope-retention.test.tsx": 19,
-      "src/renderer/src/components/automations/use-selected-automation-run-history.test.tsx": 33,
-      "src/renderer/src/components/browser-cookie-import-google-disclosure.test.tsx": 99,
-      "src/renderer/src/components/browser-favicon.test.tsx": 55,
-      "src/renderer/src/components/browser-pane/ClientHostedBrowserPagePane.chrome-parity.test.tsx": 391,
-      "src/renderer/src/components/browser-pane/ClientHostedBrowserPagePane.dead-guest.test.tsx": 346,
-      "src/renderer/src/components/browser-pane/ClientHostedBrowserPagePane.download-notices.test.tsx": 295,
-      "src/renderer/src/components/browser-pane/ClientHostedBrowserPagePane.drag-focus.test.tsx": 551,
-      "src/renderer/src/components/browser-pane/ClientHostedBrowserPagePane.failure-remount.test.tsx": 274,
-      "src/renderer/src/components/browser-pane/ClientHostedBrowserPagePane.popup-notices.test.tsx": 111,
-      "src/renderer/src/components/browser-pane/ClientHostedBrowserPagePane.test.tsx": 370,
-      "src/renderer/src/components/browser-pane/ReopenBrowserPageOnServerButton.test.tsx": 102,
-      "src/renderer/src/components/browser-pane/annotate/BrowserAnnotationSendMenuContent.test.tsx": 10,
-      "src/renderer/src/components/browser-pane/annotate/GrabConfirmationSheet.test.ts": 7,
-      "src/renderer/src/components/browser-pane/annotate/browser-annotation-output.test.ts": 36,
-      "src/renderer/src/components/browser-pane/annotate/browser-page-annotation-tray.test.tsx": 326,
-      "src/renderer/src/components/browser-pane/annotate/markup-drawing-model.test.ts": 15,
-      "src/renderer/src/components/browser-pane/annotate/markup-screenshot-compose.test.ts": 8,
-      "src/renderer/src/components/browser-pane/annotate/markup-shape-render.test.ts": 7,
-      "src/renderer/src/components/browser-pane/annotate/use-markup-draw-hint.test.ts": 17,
-      "src/renderer/src/components/browser-pane/annotate/useGrabMode.test.ts": 369,
-      "src/renderer/src/components/browser-pane/annotate/useMarkupEditor.test.ts": 26,
-      "src/renderer/src/components/browser-pane/annotate/useMarkupPointerHandlers.test.ts": 18,
-      "src/renderer/src/components/browser-pane/assemble-chrome/BrowserAddressBar.test.tsx": 79,
-      "src/renderer/src/components/browser-pane/assemble-chrome/BrowserFind.test.tsx": 152,
-      "src/renderer/src/components/browser-pane/assemble-chrome/BrowserPane.remote-link-routing.test.ts": 6,
-      "src/renderer/src/components/browser-pane/assemble-chrome/BrowserPane.render-ipc.test.ts": 6,
-      "src/renderer/src/components/browser-pane/assemble-chrome/BrowserPane.webview-preferences.test.ts": 20,
-      "src/renderer/src/components/browser-pane/assemble-chrome/BrowserPaneOverlayLayer.test.tsx": 951,
-      "src/renderer/src/components/browser-pane/assemble-chrome/browser-address-bar-expansion.test.ts": 7,
-      "src/renderer/src/components/browser-pane/assemble-chrome/browser-address-bar-suggestions.test.ts": 23,
-      "src/renderer/src/components/browser-pane/assemble-chrome/browser-deferred-lifecycle.test.tsx": 139,
-      "src/renderer/src/components/browser-pane/assemble-chrome/browser-detected-browsers-summary.test.ts": 4,
-      "src/renderer/src/components/browser-pane/assemble-chrome/browser-egress-indicator.test.tsx": 234,
-      "src/renderer/src/components/browser-pane/assemble-chrome/browser-import-hint-visibility.test.ts": 4,
-      "src/renderer/src/components/browser-pane/assemble-chrome/browser-navigation-control-row.test.tsx": 57,
-      "src/renderer/src/components/browser-pane/assemble-chrome/browser-pane-page-selection.test.ts": 4,
-      "src/renderer/src/components/browser-pane/assemble-chrome/browser-workspace-pane.adoption-chrome.test.tsx": 1919,
-      "src/renderer/src/components/browser-pane/assemble-chrome/browser-workspace-pane.retention-props.test.tsx": 93,
-      "src/renderer/src/components/browser-pane/assemble-chrome/context-menu-positioning.test.ts": 10,
-      "src/renderer/src/components/browser-pane/assemble-chrome/ssh-routed-browser-page-gate.test.tsx": 175,
-      "src/renderer/src/components/browser-pane/assemble-chrome/use-browser-page-chrome-focus.test.tsx": 118,
-      "src/renderer/src/components/browser-pane/browser-client-page-metadata-publisher.test.ts": 262,
-      "src/renderer/src/components/browser-pane/browser-client-page-metadata-route-census.test.ts": 6,
-      "src/renderer/src/components/browser-pane/browser-client-page-position-driver.test.ts": 47,
-      "src/renderer/src/components/browser-pane/browser-client-page-renderer-installation.test.ts": 12,
-      "src/renderer/src/components/browser-pane/browser-client-page-retained-drag-passthrough.test.ts": 57,
-      "src/renderer/src/components/browser-pane/browser-client-page-retained-registry.test.ts": 52,
-      "src/renderer/src/components/browser-pane/browser-download-destination-toast.test.ts": 7,
-      "src/renderer/src/components/browser-pane/browser-reopen-on-server.test.ts": 13,
-      "src/renderer/src/components/browser-pane/describe-page/browser-annotation-geometry.test.ts": 8,
-      "src/renderer/src/components/browser-pane/describe-page/browser-artifact-upload.test.ts": 11,
-      "src/renderer/src/components/browser-pane/describe-page/browser-favicon-url.test.ts": 7,
-      "src/renderer/src/components/browser-pane/describe-page/browser-overlay-shortcut-target.test.ts": 7,
-      "src/renderer/src/components/browser-pane/describe-page/browser-page-url-display.test.ts": 15,
-      "src/renderer/src/components/browser-pane/describe-page/live-browser-url-registry.test.ts": 6,
-      "src/renderer/src/components/browser-pane/host-guest/browser-automation-visibility.test.ts": 16,
-      "src/renderer/src/components/browser-pane/host-guest/browser-focus.test.ts": 9,
-      "src/renderer/src/components/browser-pane/host-guest/browser-guest-eviction-veto.test.ts": 10,
-      "src/renderer/src/components/browser-pane/host-guest/browser-guest-page-id-identity.test.ts": 6,
-      "src/renderer/src/components/browser-pane/host-guest/browser-guest-paint-retention.test.ts": 33,
-      "src/renderer/src/components/browser-pane/host-guest/browser-guest-retention-site-census.test.ts": 592,
-      "src/renderer/src/components/browser-pane/host-guest/browser-guest-worktree-retention.test.ts": 15,
-      "src/renderer/src/components/browser-pane/host-guest/browser-keyboard.test.ts": 20,
-      "src/renderer/src/components/browser-pane/host-guest/browser-page-evicted-guest-recovery.test.ts": 105,
-      "src/renderer/src/components/browser-pane/host-guest/browser-page-favicon-retention.test.ts": 12,
-      "src/renderer/src/components/browser-pane/host-guest/browser-page-guest-recovery.test.ts": 338,
-      "src/renderer/src/components/browser-pane/host-guest/browser-page-paintability.test.ts": 5,
-      "src/renderer/src/components/browser-pane/host-guest/browser-page-viewport.test.ts": 28,
-      "src/renderer/src/components/browser-pane/host-guest/browser-page-webview-surface.test.ts": 21,
-      "src/renderer/src/components/browser-pane/host-guest/browser-page-webview.test.ts": 5,
-      "src/renderer/src/components/browser-pane/host-guest/browser-page-zoom.test.ts": 16,
-      "src/renderer/src/components/browser-pane/host-guest/browser-system-resume.test.ts": 14,
-      "src/renderer/src/components/browser-pane/host-guest/browser-worktree-surface-paintability.test.ts": 6,
-      "src/renderer/src/components/browser-pane/host-guest/use-browser-page-slot-viewport.test.ts": 21,
-      "src/renderer/src/components/browser-pane/host-guest/use-browser-page-viewport-scroll-reporting.test.tsx": 35,
-      "src/renderer/src/components/browser-pane/host-guest/use-webview-drag-passthrough-active.test.tsx": 35,
-      "src/renderer/src/components/browser-pane/host-guest/webview-registry.test.ts": 44,
-      "src/renderer/src/components/browser-pane/navigate/browser-address-bar-navigation.test.ts": 12,
-      "src/renderer/src/components/browser-pane/navigate/browser-download-progress.test.ts": 7,
-      "src/renderer/src/components/browser-pane/navigate/browser-load-failure-overlay.test.tsx": 150,
-      "src/renderer/src/components/browser-pane/navigate/browser-notices.test.ts": 19,
-      "src/renderer/src/components/browser-pane/navigate/browser-page-download-activity.test.ts": 16,
-      "src/renderer/src/components/browser-pane/navigate/browser-reload-action.test.ts": 9,
-      "src/renderer/src/components/browser-pane/navigate/browser-webview-load-failure.test.ts": 11,
-      "src/renderer/src/components/browser-pane/navigate/chromium-error-page-poll-visibility.test.ts": 40,
-      "src/renderer/src/components/browser-pane/navigate/chromium-error-page-polling.test.ts": 5,
-      "src/renderer/src/components/browser-pane/navigate/use-browser-page-reload-actions.test.tsx": 19,
-      "src/renderer/src/components/browser-pane/restored-client-hosted-recovery-window.test.tsx": 308,
-      "src/renderer/src/components/browser-pane/stream-remote/remote-browser-frame-style.test.ts": 7,
-      "src/renderer/src/components/browser-pane/stream-remote/remote-browser-keyboard.test.ts": 4,
-      "src/renderer/src/components/browser-pane/stream-remote/remote-browser-page-input-model.test.ts": 8,
-      "src/renderer/src/components/browser-pane/stream-remote/remote-browser-page-pane.address-bar.test.tsx": 293,
-      "src/renderer/src/components/browser-pane/stream-remote/remote-browser-page-pane.chrome-chords.test.tsx": 434,
-      "src/renderer/src/components/browser-pane/stream-remote/remote-browser-stream-errors.test.ts": 10,
-      "src/renderer/src/components/browser-pane/stream-remote/remote-browser-stream-lifecycle.test.ts": 61,
-      "src/renderer/src/components/browser-pane/stream-remote/remote-browser-stream-restart-scheduler.test.ts": 12,
-      "src/renderer/src/components/browser-pane/stream-remote/remote-browser-stream-status.test.ts": 6,
-      "src/renderer/src/components/browser-pane/stream-remote/use-remote-browser-page-navigation.test.ts": 37,
-      "src/renderer/src/components/browser-pane/stream-remote/use-remote-browser-stream-activation.test.ts": 54,
-      "src/renderer/src/components/browser-pane/workspace-doc/HtmlDocPreview.failure-message.test.tsx": 2857,
-      "src/renderer/src/components/browser-pane/workspace-doc/HtmlDocPreview.toolbar.test.tsx": 4032,
-      "src/renderer/src/components/browser-pane/workspace-doc/doc-preview-document-actions.test.ts": 28,
-      "src/renderer/src/components/browser-pane/workspace-doc/doc-preview-document-identity.test.ts": 8,
-      "src/renderer/src/components/browser-pane/workspace-doc/doc-preview-external-link-confirmation.test.ts": 67,
-      "src/renderer/src/components/browser-pane/workspace-doc/doc-preview-webview-attach.test.ts": 14,
-      "src/renderer/src/components/browser-pane/workspace-doc/use-doc-preview-guest-tools.lazy-ref.test.tsx": 29,
-      "src/renderer/src/components/browser-pane/workspace-doc/use-doc-preview-guest-tools.test.ts": 29,
-      "src/renderer/src/components/browser-pane/workspace-doc/workspace-doc-page-pane.test.tsx": 41,
-      "src/renderer/src/components/browser-profile-user-agent-option.test.tsx": 82,
-      "src/renderer/src/components/browser-webauthn-account-dialog.test.tsx": 166,
-      "src/renderer/src/components/cmd-j/palette-activation-focus-routing.test.ts": 7,
-      "src/renderer/src/components/cmd-j/palette-duplicate-key-ghost-rows.test.tsx": 26,
-      "src/renderer/src/components/cmd-j/palette-filter-option-list.test.ts": 15,
-      "src/renderer/src/components/cmd-j/palette-filter-options.test.ts": 23,
-      "src/renderer/src/components/cmd-j/palette-filter.test.ts": 12,
-      "src/renderer/src/components/cmd-j/palette-focus-restore-target.test.ts": 11,
-      "src/renderer/src/components/cmd-j/palette-host-badge.test.ts": 15,
-      "src/renderer/src/components/cmd-j/palette-list-entry-render-keys.test.ts": 6,
-      "src/renderer/src/components/cmd-j/palette-live-status.test.tsx": 183,
-      "src/renderer/src/components/cmd-j/palette-query-tokens.test.ts": 9,
-      "src/renderer/src/components/cmd-j/palette-results.test.ts": 42,
-      "src/renderer/src/components/cmd-j/palette-section-render-cap.test.ts": 12,
-      "src/renderer/src/components/cmd-j/palette-session-age.test.ts": 16,
-      "src/renderer/src/components/cmd-j/plugin-quick-actions.test.ts": 9,
-      "src/renderer/src/components/cmd-j/quick-action-context.test.ts": 20,
-      "src/renderer/src/components/cmd-j/worktree-checks-review-index.test.ts": 27,
-      "src/renderer/src/components/cmd-j/worktree-palette-cache-inputs.test.ts": 5,
-      "src/renderer/src/components/codex-restart-chip.test.tsx": 120,
-      "src/renderer/src/components/codex-restart-notice-key.test.ts": 4,
-      "src/renderer/src/components/comment-code-context-state.test.ts": 5,
-      "src/renderer/src/components/comment-reply-target-state.test.ts": 6,
-      "src/renderer/src/components/confirmation-dialog-refresh-boundary.test.ts": 44,
-      "src/renderer/src/components/confirmation-dialog.test.tsx": 445,
-      "src/renderer/src/components/confirmation-skip-preference.test.ts": 109,
-      "src/renderer/src/components/contextual-tours/ContextualTourControl.test.ts": 8,
-      "src/renderer/src/components/contextual-tours/ContextualTourOverlay.remeasure.test.tsx": 313,
-      "src/renderer/src/components/contextual-tours/ContextualTourOverlay.test.tsx": 136,
-      "src/renderer/src/components/contextual-tours/ContextualTourOverlay.visibility.test.tsx": 2421,
-      "src/renderer/src/components/contextual-tours/ContextualTourOverlaySurface.localization.test.tsx": 191,
-      "src/renderer/src/components/contextual-tours/contextual-tour-floating-position.test.ts": 1879,
-      "src/renderer/src/components/contextual-tours/contextual-tour-gate.test.ts": 14,
-      "src/renderer/src/components/contextual-tours/contextual-tour-overlay-measurement.test.ts": 91,
-      "src/renderer/src/components/contextual-tours/contextual-tour-step-actions.test.ts": 6,
-      "src/renderer/src/components/contextual-tours/request-contextual-tour-when-ready.test.ts": 15,
-      "src/renderer/src/components/contextual-tours/use-contextual-tour.test.ts": 8,
-      "src/renderer/src/components/contextual-tours/workspace-creation-tour-handoff.test.ts": 9,
-      "src/renderer/src/components/crash-report/CrashReportDialogSurface.overflow.test.tsx": 109,
-      "src/renderer/src/components/crash-report/crash-report-submit-notice.test.ts": 13,
-      "src/renderer/src/components/crash-report/use-crash-report-copy.test.tsx": 21,
-      "src/renderer/src/components/dashboard-popout/AgentKanbanBoard.test.tsx": 469,
-      "src/renderer/src/components/dashboard-popout/AgentKanbanCard.test.tsx": 393,
-      "src/renderer/src/components/dashboard-popout/AgentTerminalDialog.test.tsx": 234,
-      "src/renderer/src/components/dashboard-popout/AgentTerminalPreview.clipboard-routes.test.tsx": 1314,
-      "src/renderer/src/components/dashboard-popout/AgentTerminalPreview.option-dead-key.test.tsx": 149,
-      "src/renderer/src/components/dashboard-popout/AgentTerminalPreview.test.tsx": 1273,
-      "src/renderer/src/components/dashboard-popout/DashboardHostBadge.test.tsx": 64,
-      "src/renderer/src/components/dashboard-popout/DashboardPopoutRoot.test.tsx": 26,
-      "src/renderer/src/components/dashboard-popout/agent-board-filtering.test.ts": 8,
-      "src/renderer/src/components/dashboard-popout/dashboard-agent-status-patch.test.ts": 9,
-      "src/renderer/src/components/dashboard-popout/preview-grid-claim.test.ts": 18,
-      "src/renderer/src/components/dashboard-popout/preview-terminal-ime-bridge-kitty-bytes.test.ts": 228,
-      "src/renderer/src/components/dashboard-popout/preview-terminal-options.test.ts": 11,
-      "src/renderer/src/components/dashboard-popout/preview-terminal-right-click-paste.test.ts": 63,
-      "src/renderer/src/components/dashboard-popout/preview-terminal-shortcuts.test.ts": 13,
-      "src/renderer/src/components/dashboard-popout/preview-terminal-snapshot-replay.test.ts": 11,
-      "src/renderer/src/components/dashboard-popout/terminal-preview-unavailable-message.test.ts": 10,
-      "src/renderer/src/components/dashboard-popout/useDashboardSnapshot.test.tsx": 59,
-      "src/renderer/src/components/dashboard/AgentDashboardDrawer.test.tsx": 227,
-      "src/renderer/src/components/dashboard/AgentDashboardSettingsMenu.test.tsx": 68,
-      "src/renderer/src/components/dashboard/DashboardAgentRow.test.tsx": 97,
-      "src/renderer/src/components/dashboard/agent-dashboard-performance-isolation.test.ts": 6,
-      "src/renderer/src/components/dashboard/agent-finished-timestamp.test.ts": 5,
-      "src/renderer/src/components/dashboard/agent-row-lineage-model.test.ts": 6,
-      "src/renderer/src/components/dashboard/agent-row-pane-live-title.test.ts": 7,
-      "src/renderer/src/components/dashboard/build-dashboard-bucket-counts.allocation.test.ts": 97,
-      "src/renderer/src/components/dashboard/build-dashboard-bucket-counts.cache.test.ts": 11,
-      "src/renderer/src/components/dashboard/build-dashboard-bucket-counts.equivalence.test.ts": 40,
-      "src/renderer/src/components/dashboard/build-dashboard-snapshot-folder-workspace.test.ts": 21,
-      "src/renderer/src/components/dashboard/build-dashboard-snapshot-orchestration-routing.test.ts": 15,
-      "src/renderer/src/components/dashboard/build-dashboard-snapshot.rows-cache.test.ts": 30,
-      "src/renderer/src/components/dashboard/build-dashboard-snapshot.test.ts": 34,
-      "src/renderer/src/components/dashboard/dashboard-card-context.test.ts": 14,
-      "src/renderer/src/components/dashboard/dashboard-card-labels.test.ts": 5,
-      "src/renderer/src/components/dashboard/dashboard-card-terminal-input.test.ts": 11,
-      "src/renderer/src/components/dashboard/dashboard-worktree-launch-options.test.ts": 19,
-      "src/renderer/src/components/dashboard/launch-dashboard-agent.test.ts": 7,
-      "src/renderer/src/components/dashboard/use-agent-row-conversation-name.test.ts": 10,
-      "src/renderer/src/components/dashboard/useAgentBucketCounts.gate.test.ts": 46,
-      "src/renderer/src/components/dashboard/useAgentBucketCounts.test.tsx": 35,
-      "src/renderer/src/components/dashboard/useDashboardPopoutBridge.test.tsx": 57,
-      "src/renderer/src/components/dashboard/useLiveDashboardSnapshot.test.ts": 63,
-      "src/renderer/src/components/dashboard/useRetainedAgents.test.ts": 66,
-      "src/renderer/src/components/dashboard/useRetainedAgentsSync.test.ts": 6,
-      "src/renderer/src/components/dictation/DictationIndicator.localization.test.ts": 7,
-      "src/renderer/src/components/dictation/DictationIndicator.test.tsx": 86,
-      "src/renderer/src/components/dictation/dictation-audio-meter.test.ts": 5,
-      "src/renderer/src/components/dictation/dictation-final-segments.test.ts": 5,
-      "src/renderer/src/components/dictation/dictation-insertion-target.test.ts": 288,
-      "src/renderer/src/components/dictation/dictation-meter-store.test.tsx": 15,
-      "src/renderer/src/components/dictation/dictation-stopped-sessions.test.ts": 9,
-      "src/renderer/src/components/dictation/microphone-devices.test.ts": 16,
-      "src/renderer/src/components/dictation/use-hold-dictation-gesture.test.tsx": 43,
-      "src/renderer/src/components/diff-comments/DiffCommentCard.resize.test.tsx": 127,
-      "src/renderer/src/components/diff-comments/diff-comment-popover-outside-click.test.tsx": 59,
-      "src/renderer/src/components/diff-comments/diff-comment-popover-position.test.ts": 8,
-      "src/renderer/src/components/diff-comments/diff-comment-zone-mouse-events.test.ts": 5,
-      "src/renderer/src/components/diff-comments/useDiffCommentDecorator.commentable-lines.test.tsx": 43,
-      "src/renderer/src/components/diff-comments/useDiffCommentDecorator.model-lifecycle.test.tsx": 28,
-      "src/renderer/src/components/editor/ChangesModeView.test.tsx": 27,
-      "src/renderer/src/components/editor/CheckRunCopyButton.test.tsx": 70,
-      "src/renderer/src/components/editor/CheckRunDetailsPanel.copy.test.tsx": 116,
-      "src/renderer/src/components/editor/ConflictComponents.test.tsx": 4,
-      "src/renderer/src/components/editor/EditorContent.markdown-classification.test.tsx": 60,
-      "src/renderer/src/components/editor/EditorContent.monaco-lifecycle.test.tsx": 49,
-      "src/renderer/src/components/editor/EditorContent.test.tsx": 37,
-      "src/renderer/src/components/editor/EditorPanel.markdown-classification-memoization.test.tsx": 462,
-      "src/renderer/src/components/editor/EditorPanelHeader.test.tsx": 34,
-      "src/renderer/src/components/editor/EditorPanelMarkdownActionsMenu.test.tsx": 21,
-      "src/renderer/src/components/editor/EditorPanelShell.header.test.tsx": 18,
-      "src/renderer/src/components/editor/ExternalFileChangeBanner.test.tsx": 56,
-      "src/renderer/src/components/editor/ExternalFileChangeCompareDialog.test.tsx": 186,
-      "src/renderer/src/components/editor/ImageViewer.test.tsx": 105,
-      "src/renderer/src/components/editor/LargeDiffLoadPrompt.test.tsx": 42,
-      "src/renderer/src/components/editor/MarkdownPreview.link-routing.interaction.test.tsx": 106,
-      "src/renderer/src/components/editor/MarkdownPreview.test.ts": 9,
-      "src/renderer/src/components/editor/MarkdownPreview.toc-visibility-gate.test.tsx": 107,
-      "src/renderer/src/components/editor/MarkdownTableOfContentsPanel.test.tsx": 23,
-      "src/renderer/src/components/editor/MonacoEditor.content-owner.test.tsx": 56,
-      "src/renderer/src/components/editor/MonacoEditor.font-family.test.tsx": 46,
-      "src/renderer/src/components/editor/NotesSendMenu.test.tsx": 34,
-      "src/renderer/src/components/editor/ReviewNotesSendMenuContent.test.tsx": 30,
-      "src/renderer/src/components/editor/RichMarkdownErrorBoundary.lazy-chunk.test.tsx": 104,
-      "src/renderer/src/components/editor/RichMarkdownLinkBubble.render.test.tsx": 106,
-      "src/renderer/src/components/editor/RichMarkdownLinkBubble.test.ts": 3,
-      "src/renderer/src/components/editor/RichMarkdownSearchBar.ime-enter.test.tsx": 187,
-      "src/renderer/src/components/editor/RichMarkdownSlashMenu.test.tsx": 14,
-      "src/renderer/src/components/editor/RichMarkdownTableControls.test.tsx": 272,
-      "src/renderer/src/components/editor/check-annotation-open.test.ts": 9,
-      "src/renderer/src/components/editor/check-annotation-path.test.ts": 10,
-      "src/renderer/src/components/editor/check-job-step-status.test.ts": 5,
-      "src/renderer/src/components/editor/check-run-clipboard-text.test.ts": 8,
-      "src/renderer/src/components/editor/check-run-details-fix-with-ai.test.ts": 16,
-      "src/renderer/src/components/editor/check-run-details-tab.test.ts": 7,
-      "src/renderer/src/components/editor/closed-editor-tab-cache-sweep.test.ts": 10,
-      "src/renderer/src/components/editor/closed-editor-tab-disposal.test.ts": 48,
-      "src/renderer/src/components/editor/combined-diff-on-demand-load.test.ts": 9,
-      "src/renderer/src/components/editor/combined-diff/browse-files/combined-diff-file-tree-collapsed-work.test.tsx": 96,
-      "src/renderer/src/components/editor/combined-diff/browse-files/combined-diff-file-tree-render.test.tsx": 241,
-      "src/renderer/src/components/editor/combined-diff/browse-files/combined-diff-file-tree-windowing.test.tsx": 212,
-      "src/renderer/src/components/editor/combined-diff/browse-files/combined-diff-file-tree.test.ts": 13,
-      "src/renderer/src/components/editor/combined-diff/browse-files/use-combined-diff-file-tree-resize.test.tsx": 44,
-      "src/renderer/src/components/editor/combined-diff/browse-files/use-combined-diff-tree-navigation.test.ts": 17,
-      "src/renderer/src/components/editor/combined-diff/load-sections/combined-diff-initial-section-load.test.ts": 5,
-      "src/renderer/src/components/editor/combined-diff/load-sections/combined-diff-load-scheduler.test.ts": 7,
-      "src/renderer/src/components/editor/combined-diff/load-sections/combined-diff-section-connection.test.ts": 11,
-      "src/renderer/src/components/editor/combined-diff/load-sections/combined-diff-section-load-state.test.ts": 10,
-      "src/renderer/src/components/editor/combined-diff/remember-view/use-combined-diff-view-restore.test.tsx": 29,
-      "src/renderer/src/components/editor/combined-diff/resolve-changes/combined-diff-entries.test.ts": 12,
-      "src/renderer/src/components/editor/combined-diff/resolve-changes/combined-diff-section-cache-match.test.ts": 5,
-      "src/renderer/src/components/editor/combined-diff/resolve-changes/combined-diff-section-scaling.test.tsx": 157,
-      "src/renderer/src/components/editor/combined-diff/resolve-changes/use-combined-diff-section-index-map.test.tsx": 23,
-      "src/renderer/src/components/editor/combined-diff/review-controls/combined-diff-commit-message.test.ts": 17,
-      "src/renderer/src/components/editor/combined-diff/scroll-viewport/combined-diff-restore-signal-equivalence.test.tsx": 291,
-      "src/renderer/src/components/editor/combined-diff/scroll-viewport/combined-diff-scrollbar-drag.test.ts": 8,
-      "src/renderer/src/components/editor/csv-parse.test.ts": 38,
-      "src/renderer/src/components/editor/details-markdown-html.test.ts": 24,
-      "src/renderer/src/components/editor/diff-editor-line-number-options.test.ts": 8,
-      "src/renderer/src/components/editor/diff-editor-shift-wheel-scroll.test.ts": 14,
-      "src/renderer/src/components/editor/diff-editor-whitespace-options.test.ts": 6,
-      "src/renderer/src/components/editor/diff-editor-word-wrap-options.test.ts": 4,
-      "src/renderer/src/components/editor/diff-line-stats.test.ts": 10,
-      "src/renderer/src/components/editor/diff-model-swap-view-state.test.ts": 8,
-      "src/renderer/src/components/editor/diff-monaco-model-disposal.test.ts": 12,
-      "src/renderer/src/components/editor/diff-navigation-context.test.tsx": 45,
-      "src/renderer/src/components/editor/diff-section-layout.test.ts": 30,
-      "src/renderer/src/components/editor/diff-section-preview.test.ts": 9,
-      "src/renderer/src/components/editor/diff-viewer-large-diff-save-action.test.ts": 7,
-      "src/renderer/src/components/editor/editor-autosave-conflict-flow.test.ts": 37,
-      "src/renderer/src/components/editor/editor-autosave-controller.test.ts": 40,
-      "src/renderer/src/components/editor/editor-autosave.test.ts": 17,
-      "src/renderer/src/components/editor/editor-cmd-save-target.test.ts": 10,
-      "src/renderer/src/components/editor/editor-content-dirty-state.test.ts": 21,
-      "src/renderer/src/components/editor/editor-external-watch-path-index.test.ts": 9,
-      "src/renderer/src/components/editor/editor-file-save-attempt.test.ts": 11,
-      "src/renderer/src/components/editor/editor-header.test.ts": 8,
-      "src/renderer/src/components/editor/editor-labels.test.ts": 6,
-      "src/renderer/src/components/editor/editor-panel-diff-reload.test.ts": 8,
-      "src/renderer/src/components/editor/editor-panel-draft-selector.test.ts": 20,
-      "src/renderer/src/components/editor/editor-panel-git-entry-selector.test.ts": 24,
-      "src/renderer/src/components/editor/editor-panel-render-model.test.ts": 29,
-      "src/renderer/src/components/editor/editor-path-move-inflight.test.ts": 9,
-      "src/renderer/src/components/editor/editor-restored-tab-conflict-scan.test.ts": 38,
-      "src/renderer/src/components/editor/editor-self-write-registry.test.ts": 20,
-      "src/renderer/src/components/editor/editor-shortcuts.test.ts": 23,
-      "src/renderer/src/components/editor/export-active-markdown.test.ts": 7,
-      "src/renderer/src/components/editor/file-editor-word-wrap-options.test.ts": 4,
-      "src/renderer/src/components/editor/image-viewer-zoom.test.ts": 10,
-      "src/renderer/src/components/editor/ipynb-code-cell-lines.test.ts": 138,
-      "src/renderer/src/components/editor/ipynb-parse.test.ts": 26,
-      "src/renderer/src/components/editor/large-diff-render-limit.test.ts": 103,
-      "src/renderer/src/components/editor/line-copy-path.test.ts": 5,
-      "src/renderer/src/components/editor/local-log-tail-decoder.test.ts": 8,
-      "src/renderer/src/components/editor/markdown-artifact-upload.test.ts": 7,
-      "src/renderer/src/components/editor/markdown-dirty-state.test.ts": 154,
-      "src/renderer/src/components/editor/markdown-doc-completions.test.ts": 11,
-      "src/renderer/src/components/editor/markdown-doc-links.test.ts": 29,
-      "src/renderer/src/components/editor/markdown-document-list-request.test.ts": 14,
-      "src/renderer/src/components/editor/markdown-document-worktree-path-selector.test.ts": 758,
-      "src/renderer/src/components/editor/markdown-export-extract.test.ts": 21,
-      "src/renderer/src/components/editor/markdown-export-html.test.ts": 5,
-      "src/renderer/src/components/editor/markdown-frontmatter.test.ts": 7,
-      "src/renderer/src/components/editor/markdown-heading-slug.test.ts": 6,
-      "src/renderer/src/components/editor/markdown-internal-links.test.ts": 10,
-      "src/renderer/src/components/editor/markdown-preview-annotation-shortcut.test.ts": 25,
-      "src/renderer/src/components/editor/markdown-preview-controls.test.ts": 10,
-      "src/renderer/src/components/editor/markdown-preview-links.test.ts": 8,
-      "src/renderer/src/components/editor/markdown-preview-local-images.test.ts": 67,
-      "src/renderer/src/components/editor/markdown-preview-search-crash.test.tsx": 24,
-      "src/renderer/src/components/editor/markdown-preview-search.test.ts": 16,
-      "src/renderer/src/components/editor/markdown-preview-url-transform.test.ts": 14,
-      "src/renderer/src/components/editor/markdown-reference-link-normalization.test.ts": 25,
-      "src/renderer/src/components/editor/markdown-render-mode.test.ts": 5,
-      "src/renderer/src/components/editor/markdown-rich-mode-eligibility-cache.test.ts": 225,
-      "src/renderer/src/components/editor/markdown-rich-mode.test.ts": 276,
-      "src/renderer/src/components/editor/markdown-rich-size-limit.test.ts": 7,
-      "src/renderer/src/components/editor/markdown-round-trip.test.ts": 388,
-      "src/renderer/src/components/editor/markdown-table-of-contents.test.ts": 57,
-      "src/renderer/src/components/editor/markdown-toc-collapse-state.test.ts": 5,
-      "src/renderer/src/components/editor/markdown-toc-visibility-gate.test.ts": 18,
-      "src/renderer/src/components/editor/mermaid-config.test.ts": 6,
-      "src/renderer/src/components/editor/monaco-auto-height.test.ts": 42,
-      "src/renderer/src/components/editor/monaco-codebase-search.test.ts": 8,
-      "src/renderer/src/components/editor/monaco-conflict-decorations.test.ts": 12,
-      "src/renderer/src/components/editor/monaco-content-sync.test.ts": 14,
-      "src/renderer/src/components/editor/monaco-content-sync.undo-history.test.ts": 44,
-      "src/renderer/src/components/editor/monaco-context-menu-paste.test.ts": 59,
-      "src/renderer/src/components/editor/monaco-find-options.test.ts": 5,
-      "src/renderer/src/components/editor/monaco-find-widget.test.ts": 12,
-      "src/renderer/src/components/editor/monaco-large-text-paste.test.ts": 19,
-      "src/renderer/src/components/editor/monaco-markdown-doc-link-decorations.offset-scan.test.ts": 72,
-      "src/renderer/src/components/editor/monaco-markdown-doc-link-decorations.test.ts": 15,
-      "src/renderer/src/components/editor/monaco-markdown-selection-annotation.test.ts": 9,
-      "src/renderer/src/components/editor/monaco-programmatic-sync.test.ts": 5,
-      "src/renderer/src/components/editor/monaco-reveal-range.test.ts": 4,
-      "src/renderer/src/components/editor/monaco-view-state-persistence.test.ts": 5,
-      "src/renderer/src/components/editor/pdf-scale-preference.test.ts": 8,
-      "src/renderer/src/components/editor/pdf-view-position.test.ts": 19,
-      "src/renderer/src/components/editor/pending-editor-focus-request.test.ts": 6,
-      "src/renderer/src/components/editor/position-stable-node-view-update.test.ts": 7,
-      "src/renderer/src/components/editor/restored-editor-owner-save-lifecycle.test.ts": 321,
-      "src/renderer/src/components/editor/rich-markdown-auto-focus.test.ts": 12,
-      "src/renderer/src/components/editor/rich-markdown-code-block-languages.test.ts": 8,
-      "src/renderer/src/components/editor/rich-markdown-commands.test.ts": 95,
-      "src/renderer/src/components/editor/rich-markdown-context-command-routing.test.ts": 56,
-      "src/renderer/src/components/editor/rich-markdown-cut.test.ts": 142,
-      "src/renderer/src/components/editor/rich-markdown-details-keyboard.test.ts": 83,
-      "src/renderer/src/components/editor/rich-markdown-doc-link.test.ts": 7,
-      "src/renderer/src/components/editor/rich-markdown-editor-click-routing.test.ts": 13,
-      "src/renderer/src/components/editor/rich-markdown-editor-config.test.ts": 15,
-      "src/renderer/src/components/editor/rich-markdown-empty-paragraph-delete.test.ts": 57,
-      "src/renderer/src/components/editor/rich-markdown-html-superscript-link.test.ts": 581,
-      "src/renderer/src/components/editor/rich-markdown-image-insert-code-block.test.ts": 270,
-      "src/renderer/src/components/editor/rich-markdown-image-insert.test.ts": 54,
-      "src/renderer/src/components/editor/rich-markdown-inline-image-paragraph.test.ts": 90,
-      "src/renderer/src/components/editor/rich-markdown-key-handler.test.ts": 83,
-      "src/renderer/src/components/editor/rich-markdown-large-text-paste.test.ts": 17,
-      "src/renderer/src/components/editor/rich-markdown-link-clipboard.test.ts": 7,
-      "src/renderer/src/components/editor/rich-markdown-link-shortcut.test.ts": 96,
-      "src/renderer/src/components/editor/rich-markdown-list-continuation.test.ts": 35,
-      "src/renderer/src/components/editor/rich-markdown-list-tokenizers.test.ts": 11,
-      "src/renderer/src/components/editor/rich-markdown-local-image.test.ts": 128,
-      "src/renderer/src/components/editor/rich-markdown-lowlight-cache.test.ts": 80,
-      "src/renderer/src/components/editor/rich-markdown-lowlight.test.ts": 2575,
-      "src/renderer/src/components/editor/rich-markdown-normalize.test.ts": 43,
-      "src/renderer/src/components/editor/rich-markdown-paragraph.test.ts": 9,
-      "src/renderer/src/components/editor/rich-markdown-paste-handler.test.ts": 8,
-      "src/renderer/src/components/editor/rich-markdown-paste-image.test.ts": 11,
-      "src/renderer/src/components/editor/rich-markdown-range-bounds.test.ts": 66,
-      "src/renderer/src/components/editor/rich-markdown-review-annotations.test.ts": 15,
-      "src/renderer/src/components/editor/rich-markdown-review-note-layout.test.ts": 6,
-      "src/renderer/src/components/editor/rich-markdown-review-rail-blocks.test.ts": 203,
-      "src/renderer/src/components/editor/rich-markdown-review-text-ranges.test.ts": 26,
-      "src/renderer/src/components/editor/rich-markdown-search-matches-cache.test.ts": 38,
-      "src/renderer/src/components/editor/rich-markdown-search.test.ts": 10,
-      "src/renderer/src/components/editor/rich-markdown-serialization-commit.test.ts": 21,
-      "src/renderer/src/components/editor/rich-markdown-slash-command-filter.test.ts": 7,
-      "src/renderer/src/components/editor/rich-markdown-source-reconcile.test.ts": 332,
-      "src/renderer/src/components/editor/rich-markdown-tab-key-handler.test.ts": 130,
-      "src/renderer/src/components/editor/rich-markdown-table-actions.test.ts": 475,
-      "src/renderer/src/components/editor/rich-markdown-table-control-layout.test.ts": 4,
-      "src/renderer/src/components/editor/rich-markdown-table-keyboard.test.ts": 105,
-      "src/renderer/src/components/editor/rich-markdown-terminal-path-paste.test.ts": 11,
-      "src/renderer/src/components/editor/rich-markdown-toc-heading-target.test.ts": 11,
-      "src/renderer/src/components/editor/selection-copy.test.ts": 8,
-      "src/renderer/src/components/editor/setup-contextual-copy.test.ts": 10,
-      "src/renderer/src/components/editor/untitled-file-rename-path.test.ts": 6,
-      "src/renderer/src/components/editor/use-monaco-editor-decorations.doc-link-refresh.test.tsx": 42,
-      "src/renderer/src/components/editor/use-rich-markdown-table-context-menu.test.tsx": 86,
-      "src/renderer/src/components/editor/use-rich-markdown-table-control-target.test.tsx": 83,
-      "src/renderer/src/components/editor/useDiffViewerLargeDiffLifecycle.test.tsx": 16,
-      "src/renderer/src/components/editor/useEditorCmdSaveRequest.test.tsx": 34,
-      "src/renderer/src/components/editor/useEditorPanelContentState.test.tsx": 823,
-      "src/renderer/src/components/editor/useEditorPanelExternalContentEvents.test.tsx": 32,
-      "src/renderer/src/components/editor/useEditorPanelFileLoadRetry.test.tsx": 53,
-      "src/renderer/src/components/editor/useEditorPanelRemoteSiblingContentState.test.tsx": 25,
-      "src/renderer/src/components/editor/useEditorPanelVisibilityContentState.test.tsx": 151,
-      "src/renderer/src/components/editor/useIpynbCellExecution.test.tsx": 78,
-      "src/renderer/src/components/editor/useIpynbDocumentEditing.test.tsx": 29,
-      "src/renderer/src/components/editor/useLinkBubble.test.tsx": 37,
-      "src/renderer/src/components/editor/useLocalImageSrc.test.ts": 74,
-      "src/renderer/src/components/editor/useLocalLogTail.test.tsx": 234,
-      "src/renderer/src/components/editor/useMarkdownDocuments.test.ts": 9,
-      "src/renderer/src/components/editor/useRichMarkdownEditorInstance.integration.test.tsx": 71,
-      "src/renderer/src/components/editor/useRichMarkdownEditorInstance.test.tsx": 23,
-      "src/renderer/src/components/editor/useRichMarkdownPendingFocus.test.ts": 20,
-      "src/renderer/src/components/editor/useRichMarkdownProgrammaticSync.test.ts": 77,
-      "src/renderer/src/components/editor/useRichMarkdownReviewController.open-guard.test.ts": 17,
-      "src/renderer/src/components/editor/useRichMarkdownSearch.reuse.test.tsx": 55,
-      "src/renderer/src/components/editor/useRichMarkdownSearch.test.tsx": 31,
-      "src/renderer/src/components/emulator-pane/MobileEmulatorTabIntroCallout.test.tsx": 60,
-      "src/renderer/src/components/emulator-pane/emulator-device-frame-layout.test.ts": 10,
-      "src/renderer/src/components/emulator-pane/emulator-device-frame-visibility.test.tsx": 158,
-      "src/renderer/src/components/emulator-pane/emulator-device-frame.input.test.tsx": 188,
-      "src/renderer/src/components/emulator-pane/emulator-device-state.test.ts": 5,
-      "src/renderer/src/components/emulator-pane/emulator-keyboard-paste.test.ts": 16,
-      "src/renderer/src/components/emulator-pane/emulator-screen-gesture.test.ts": 11,
-      "src/renderer/src/components/emulator-pane/emulator-screen-stream-content.test.tsx": 43,
-      "src/renderer/src/components/emulator-pane/mobile-emulator-agent-setup-cli-state.test.ts": 6,
-      "src/renderer/src/components/emulator-pane/mobile-emulator-agent-setup-visibility.test.ts": 4,
-      "src/renderer/src/components/emulator-pane/mobile-emulator-hidden-toast.test.tsx": 10,
-      "src/renderer/src/components/emulator-pane/mobile-emulator-tab-intro-visibility.test.ts": 7,
-      "src/renderer/src/components/emulator-pane/use-emulator-pane-session.test.tsx": 53,
-      "src/renderer/src/components/emulator-pane/use-mobile-emulator-tab-intro-actions.test.tsx": 43,
-      "src/renderer/src/components/error-boundaries/RecoverableRenderErrorBoundary.lazy-chunk.test.tsx": 86,
-      "src/renderer/src/components/error-boundaries/RecoverableRenderErrorBoundary.never-landed-reload.test.tsx": 51,
-      "src/renderer/src/components/error-boundaries/react-185-bystander-attribution.test.tsx": 100,
-      "src/renderer/src/components/feature-interaction-writer-boundaries.test.ts": 16,
-      "src/renderer/src/components/feature-tips/CliSkillSetupTerminal.test.tsx": 33,
-      "src/renderer/src/components/feature-tips/CmdJPaletteFeatureTipVisual.test.tsx": 71,
-      "src/renderer/src/components/feature-tips/CmdJPaletteTipDialog.test.tsx": 35,
-      "src/renderer/src/components/feature-tips/VoiceDictationFeatureTipVisual.test.tsx": 72,
-      "src/renderer/src/components/feature-tips/VoiceDictationTipDialog.test.tsx": 44,
-      "src/renderer/src/components/feature-tips/feature-tip-cli-install-action.test.ts": 9,
-      "src/renderer/src/components/feature-tips/feature-tip-modal-state.test.ts": 10,
-      "src/renderer/src/components/feature-tips/feature-tip-startup-gate.test.ts": 12,
-      "src/renderer/src/components/feature-tips/feature-tip-telemetry.test.ts": 8,
-      "src/renderer/src/components/feature-wall/AgentCapabilitiesSetupAction.test.ts": 6,
-      "src/renderer/src/components/feature-wall/ConnectIntegrationsList.test.tsx": 181,
-      "src/renderer/src/components/feature-wall/FeatureWallSetupWorkflowActions.test.tsx": 74,
-      "src/renderer/src/components/feature-wall/FullDiskAccessSetupPrompt.test.ts": 113,
-      "src/renderer/src/components/feature-wall/KeepAwakeCard.test.tsx": 99,
-      "src/renderer/src/components/feature-wall/browser-animated-visual-sequence.test.ts": 6,
-      "src/renderer/src/components/feature-wall/feature-wall-animation-visibility.test.tsx": 163,
-      "src/renderer/src/components/feature-wall/feature-wall-rail-navigation.test.ts": 9,
-      "src/renderer/src/components/feature-wall/feature-wall-setup-checklist-localized-copy.test.ts": 9,
-      "src/renderer/src/components/feature-wall/feature-wall-setup-progress.test.ts": 12,
-      "src/renderer/src/components/feature-wall/feature-wall-shortcut-labels.test.tsx": 72,
-      "src/renderer/src/components/feature-wall/feature-wall-usage-tracking.test.ts": 13,
-      "src/renderer/src/components/feature-wall/use-feature-wall-completion.test.ts": 8,
-      "src/renderer/src/components/feature-wall/use-feature-wall-tour-telemetry.test.ts": 8,
-      "src/renderer/src/components/feature-wall/use-integration-connection-status.test.ts": 15,
-      "src/renderer/src/components/feature-wall/workbench-terminal-storyboard-sequence.test.ts": 9,
-      "src/renderer/src/components/file-path-cursor-tooltip.test.ts": 5,
-      "src/renderer/src/components/floating-terminal/FloatingBrowserSlot.test.tsx": 35,
-      "src/renderer/src/components/floating-terminal/FloatingTerminalOrchestrationDialog.freshness.test.tsx": 163,
-      "src/renderer/src/components/floating-terminal/FloatingTerminalPanel.bounds.test.tsx": 365,
-      "src/renderer/src/components/floating-terminal/FloatingTerminalPanel.empty-state.test.tsx": 526,
-      "src/renderer/src/components/floating-terminal/FloatingTerminalPanel.focus.test.tsx": 615,
-      "src/renderer/src/components/floating-terminal/FloatingTerminalPanel.markdown-editor.test.tsx": 782,
-      "src/renderer/src/components/floating-terminal/FloatingTerminalPanel.shortcuts.test.tsx": 878,
-      "src/renderer/src/components/floating-terminal/FloatingTerminalPanel.tab-lifecycle.test.tsx": 693,
-      "src/renderer/src/components/floating-terminal/FloatingTerminalToggleButton.test.tsx": 84,
-      "src/renderer/src/components/floating-terminal/FloatingTerminalWindowControls.test.tsx": 10,
-      "src/renderer/src/components/floating-terminal/floating-terminal-panel-bounds.test.ts": 17,
-      "src/renderer/src/components/floating-terminal/floating-terminal-panel-inputs.test.ts": 6,
-      "src/renderer/src/components/floating-terminal/floating-terminal-panel-view-state.test.ts": 9,
-      "src/renderer/src/components/floating-terminal/floating-terminal-trigger-position.test.ts": 17,
-      "src/renderer/src/components/floating-terminal/floating-workspace-tab-reorder.test.ts": 73,
-      "src/renderer/src/components/floating-terminal/terminal-pane-handle-registry.test.ts": 11,
-      "src/renderer/src/components/github-body-draft-state.test.ts": 5,
-      "src/renderer/src/components/github-checks-tab-state.test.ts": 11,
-      "src/renderer/src/components/github-enterprise-slug-routing-boundary.test.ts": 6,
-      "src/renderer/src/components/github-item-dialog-source-boundary.test.ts": 13,
-      "src/renderer/src/components/github-item-dialog/inspect-pull-request/pr-files-combined-diff-section-index.test.tsx": 49,
-      "src/renderer/src/components/github-link-copy-state.test.ts": 6,
-      "src/renderer/src/components/github-pr-merge-state.test.ts": 25,
-      "src/renderer/src/components/github-pr-reviewer-display.test.ts": 11,
-      "src/renderer/src/components/github-project/GhAuthErrorHelp.test.ts": 57,
-      "src/renderer/src/components/github-project/ProjectRoadmap.test.tsx": 257,
-      "src/renderer/src/components/github-project/github-project-picker-filter.test.ts": 10,
-      "src/renderer/src/components/github-project/group-sort.test.ts": 13,
-      "src/renderer/src/components/github-project/project-dialog-state.test.ts": 10,
-      "src/renderer/src/components/github-project/project-picker-browse-cache.test.ts": 14,
-      "src/renderer/src/components/github-project/project-picker-input.test.ts": 10,
-      "src/renderer/src/components/github-project/project-row-filtering.test.ts": 14,
-      "src/renderer/src/components/github-project/project-view-wrapper-source-context-boundary.test.ts": 11,
-      "src/renderer/src/components/github-project/project-visible-table-cache.test.ts": 6,
-      "src/renderer/src/components/github/PRFilterPickers.test.ts": 6,
-      "src/renderer/src/components/github/github-markdown-image-url.test.ts": 5,
-      "src/renderer/src/components/github/github-mention-option-filter.test.ts": 10,
-      "src/renderer/src/components/github/github-pr-reviewer-candidate-filter.test.ts": 18,
-      "src/renderer/src/components/github/github-user-avatar.test.tsx": 66,
-      "src/renderer/src/components/github/github-work-item-assignee-filter.test.ts": 10,
-      "src/renderer/src/components/github/github-work-item-label-filter.test.ts": 7,
-      "src/renderer/src/components/github/pr-comment-code-context.test.ts": 29,
-      "src/renderer/src/components/github/pr-file-content-size.test.ts": 5,
-      "src/renderer/src/components/github/repro-8784-ghe-avatar-fallback.test.ts": 13,
-      "src/renderer/src/components/github/use-image-input.test.ts": 186,
-      "src/renderer/src/components/hover-reveal-touch-action-visibility.test.ts": 12,
-      "src/renderer/src/components/jira-create-adf.test.ts": 10,
-      "src/renderer/src/components/jira-project-picker-filter.test.ts": 11,
-      "src/renderer/src/components/landing-preflight-dismissal.test.ts": 12,
-      "src/renderer/src/components/landing-preflight-issues.test.ts": 14,
-      "src/renderer/src/components/landing-preflight-runtime-boundary.test.ts": 59,
-      "src/renderer/src/components/linear-api-key-dialog-state.test.ts": 6,
-      "src/renderer/src/components/linear-issue-attribute-filter-coverage-agreement.test.ts": 1157,
-      "src/renderer/src/components/linear-issue-attribute-filter-dropdowns.test.tsx": 1107,
-      "src/renderer/src/components/linear-issue-attribute-filter-primary-team.test.ts": 21,
-      "src/renderer/src/components/linear-issue-attribute-filter-team-ids.test.ts": 22,
-      "src/renderer/src/components/linear-issue-project-selector.test.tsx": 88,
-      "src/renderer/src/components/linear-issue-text-draft-state.test.ts": 4,
-      "src/renderer/src/components/linear-issue-text-save-plan.test.ts": 6,
-      "src/renderer/src/components/linear-issue-view-storage.test.ts": 11,
-      "src/renderer/src/components/linear-issue-workspace-api-parity.test.ts": 9,
-      "src/renderer/src/components/linear-issue-workspace-detail-state.test.tsx": 47,
-      "src/renderer/src/components/linear-issue-workspace-header.test.ts": 5,
-      "src/renderer/src/components/linear-issue-workspace-text.test.ts": 7,
-      "src/renderer/src/components/linear-project-presentation.test.ts": 9,
-      "src/renderer/src/components/linear-project-search-query.test.ts": 5,
-      "src/renderer/src/components/linear-project-view-surfaces.test.tsx": 104,
-      "src/renderer/src/components/linear-scope-selector.test.ts": 8,
-      "src/renderer/src/components/link-actions/LinkActionPopover.test.tsx": 167,
-      "src/renderer/src/components/maintenance/update-card/update-card-error-model.test.ts": 13,
-      "src/renderer/src/components/mobile/MobileHero.test.tsx": 637,
-      "src/renderer/src/components/mobile/MobilePage.test.tsx": 685,
-      "src/renderer/src/components/mobile/MobilePageToolbar.test.tsx": 41,
-      "src/renderer/src/components/mobile/NetworkInterfacePicker.test.tsx": 77,
-      "src/renderer/src/components/mobile/WindowsFirewallNotice.test.tsx": 173,
-      "src/renderer/src/components/mobile/mobile-page-stage.test.ts": 4,
-      "src/renderer/src/components/mobile/paired-mobile-devices.test.ts": 5,
-      "src/renderer/src/components/mobile/use-mobile-page-paired-devices.test.ts": 85,
-      "src/renderer/src/components/mobile/use-mobile-pairing-address-preference.test.tsx": 35,
-      "src/renderer/src/components/native-chat/NativeChatAutocompleteMenus.test.tsx": 69,
-      "src/renderer/src/components/native-chat/NativeChatBackgroundTasksStatus.test.tsx": 142,
-      "src/renderer/src/components/native-chat/NativeChatComposer.test.tsx": 164,
-      "src/renderer/src/components/native-chat/NativeChatComposerActions.test.tsx": 64,
-      "src/renderer/src/components/native-chat/NativeChatImageAttachmentPreview.test.tsx": 72,
-      "src/renderer/src/components/native-chat/NativeChatInteractiveCard.test.tsx": 207,
-      "src/renderer/src/components/native-chat/NativeChatMessageList.provider-frame.test.tsx": 20,
-      "src/renderer/src/components/native-chat/NativeChatMessageList.stream-render.perf.test.tsx": 893,
-      "src/renderer/src/components/native-chat/NativeChatMessageList.task-list-frames.test.tsx": 515,
-      "src/renderer/src/components/native-chat/NativeChatMessageList.test.tsx": 376,
-      "src/renderer/src/components/native-chat/NativeChatMessageList.tool-stream-cost.test.tsx": 2900,
-      "src/renderer/src/components/native-chat/NativeChatMessageList.turn-history.test.tsx": 355,
-      "src/renderer/src/components/native-chat/NativeChatMessageList.turn-indicator.test.tsx": 374,
-      "src/renderer/src/components/native-chat/NativeChatMessageList.turn-timing.test.tsx": 126,
-      "src/renderer/src/components/native-chat/NativeChatMessageList.windowing.test.tsx": 3124,
-      "src/renderer/src/components/native-chat/NativeChatMessageRow.test.tsx": 180,
-      "src/renderer/src/components/native-chat/NativeChatMessageTimestamp.test.tsx": 359,
-      "src/renderer/src/components/native-chat/NativeChatNoticeRow.test.tsx": 192,
-      "src/renderer/src/components/native-chat/NativeChatPromptEditor.test.tsx": 137,
-      "src/renderer/src/components/native-chat/NativeChatQuestionCard.test.tsx": 153,
-      "src/renderer/src/components/native-chat/NativeChatResolutionReceipt.test.tsx": 268,
-      "src/renderer/src/components/native-chat/NativeChatSessionOptionPickers.test.tsx": 155,
-      "src/renderer/src/components/native-chat/NativeChatStructuredSession.test.tsx": 509,
-      "src/renderer/src/components/native-chat/NativeChatStructuredSession.transport-probe.test.tsx": 15241,
-      "src/renderer/src/components/native-chat/NativeChatStructuredSessionDelivery.test.tsx": 15300,
-      "src/renderer/src/components/native-chat/NativeChatSubagentRun.test.tsx": 187,
-      "src/renderer/src/components/native-chat/NativeChatTaskList.test.tsx": 175,
-      "src/renderer/src/components/native-chat/NativeChatToolRun.identity.test.tsx": 253,
-      "src/renderer/src/components/native-chat/NativeChatToolRun.test.tsx": 438,
-      "src/renderer/src/components/native-chat/NativeChatTranscriptChrome.test.tsx": 107,
-      "src/renderer/src/components/native-chat/NativeChatView.test.tsx": 58,
-      "src/renderer/src/components/native-chat/StructuredAgentSessionHandoffChrome.test.tsx": 65,
-      "src/renderer/src/components/native-chat/StructuredAgentSessionPaneOverlayLayer.test.tsx": 49,
-      "src/renderer/src/components/native-chat/StructuredAgentSessionStatusBridge.test.tsx": 410,
-      "src/renderer/src/components/native-chat/background-task-roster.test.ts": 21,
-      "src/renderer/src/components/native-chat/claude-model-switch-confirmation.test.ts": 14,
-      "src/renderer/src/components/native-chat/claude-terminal-session-options.test.ts": 13,
-      "src/renderer/src/components/native-chat/native-chat-assembler-merge-parity.test.ts": 8,
-      "src/renderer/src/components/native-chat/native-chat-attachment-upload.test.ts": 12,
-      "src/renderer/src/components/native-chat/native-chat-autoscroll.test.ts": 7,
-      "src/renderer/src/components/native-chat/native-chat-availability.test.ts": 9,
-      "src/renderer/src/components/native-chat/native-chat-composer-autogrow.test.tsx": 178,
-      "src/renderer/src/components/native-chat/native-chat-composer-composition.test.tsx": 469,
-      "src/renderer/src/components/native-chat/native-chat-composer-drop-scope.test.tsx": 153,
-      "src/renderer/src/components/native-chat/native-chat-composer-reveal-focus.test.tsx": 71,
-      "src/renderer/src/components/native-chat/native-chat-composer-scope-cache.test.ts": 5,
-      "src/renderer/src/components/native-chat/native-chat-composer-state.test.ts": 25,
-      "src/renderer/src/components/native-chat/native-chat-diff.test.ts": 13,
-      "src/renderer/src/components/native-chat/native-chat-dismiss-key.test.ts": 9,
-      "src/renderer/src/components/native-chat/native-chat-draft-cache.test.ts": 6,
-      "src/renderer/src/components/native-chat/native-chat-file-link.test.ts": 10,
-      "src/renderer/src/components/native-chat/native-chat-font-scale.test.ts": 11,
-      "src/renderer/src/components/native-chat/native-chat-http-link-source-owner.test.ts": 13,
-      "src/renderer/src/components/native-chat/native-chat-image-paste.test.ts": 9,
-      "src/renderer/src/components/native-chat/native-chat-image-runtime-context.test.ts": 8,
-      "src/renderer/src/components/native-chat/native-chat-incremental-assembler.test.ts": 9,
-      "src/renderer/src/components/native-chat/native-chat-interactive-prompt.test.ts": 17,
-      "src/renderer/src/components/native-chat/native-chat-launch-default-adoption.test.ts": 14,
-      "src/renderer/src/components/native-chat/native-chat-launch-draft-resolution.test.ts": 9,
-      "src/renderer/src/components/native-chat/native-chat-launch-draft-send.test.ts": 9,
-      "src/renderer/src/components/native-chat/native-chat-launch-session-options.test.ts": 5,
-      "src/renderer/src/components/native-chat/native-chat-layout-actions.test.ts": 6,
-      "src/renderer/src/components/native-chat/native-chat-leaf-routing.test.ts": 6,
-      "src/renderer/src/components/native-chat/native-chat-live-status.test.ts": 13,
-      "src/renderer/src/components/native-chat/native-chat-message-grouping.test.ts": 8,
-      "src/renderer/src/components/native-chat/native-chat-message-list-projection.test.ts": 11,
-      "src/renderer/src/components/native-chat/native-chat-noise.test.ts": 8,
-      "src/renderer/src/components/native-chat/native-chat-pagination.test.ts": 5,
-      "src/renderer/src/components/native-chat/native-chat-pane-resolution.test.ts": 15,
-      "src/renderer/src/components/native-chat/native-chat-pending-occurrence.test.ts": 9,
-      "src/renderer/src/components/native-chat/native-chat-pending.test.ts": 36,
-      "src/renderer/src/components/native-chat/native-chat-pinned-rows.test.ts": 6,
-      "src/renderer/src/components/native-chat/native-chat-preassembled-session-parity.test.ts": 267,
-      "src/renderer/src/components/native-chat/native-chat-pty-retired-model.test.ts": 12,
-      "src/renderer/src/components/native-chat/native-chat-pty-session-options.test.ts": 235,
-      "src/renderer/src/components/native-chat/native-chat-retire-persisted-model.test.ts": 88,
-      "src/renderer/src/components/native-chat/native-chat-row-height-estimate.test.ts": 9,
-      "src/renderer/src/components/native-chat/native-chat-runtime-owner.test.ts": 7,
-      "src/renderer/src/components/native-chat/native-chat-runtime-send-launch-draft.test.ts": 1210,
-      "src/renderer/src/components/native-chat/native-chat-runtime-send.test.ts": 187,
-      "src/renderer/src/components/native-chat/native-chat-scrape-fallback.test.ts": 11,
-      "src/renderer/src/components/native-chat/native-chat-send-eligibility.test.ts": 9,
-      "src/renderer/src/components/native-chat/native-chat-send.test.ts": 11,
-      "src/renderer/src/components/native-chat/native-chat-session-assembler.test.ts": 9,
-      "src/renderer/src/components/native-chat/native-chat-session-option-enrichment.test.ts": 325,
-      "src/renderer/src/components/native-chat/native-chat-session-option-labels.test.ts": 6,
-      "src/renderer/src/components/native-chat/native-chat-session-transport.test.ts": 49,
-      "src/renderer/src/components/native-chat/native-chat-shared-copy-matches-catalog.test.ts": 5,
-      "src/renderer/src/components/native-chat/native-chat-shortcut.test.ts": 7,
-      "src/renderer/src/components/native-chat/native-chat-split-shortcut.test.ts": 7,
-      "src/renderer/src/components/native-chat/native-chat-stop-layering.test.ts": 4,
-      "src/renderer/src/components/native-chat/native-chat-structured-send-composition-clear.test.tsx": 271,
-      "src/renderer/src/components/native-chat/native-chat-tab-agent-entry.test.ts": 7,
-      "src/renderer/src/components/native-chat/native-chat-task-list-history.test.ts": 10,
-      "src/renderer/src/components/native-chat/native-chat-task-list-state.test.ts": 13,
-      "src/renderer/src/components/native-chat/native-chat-tool-fold.test.ts": 12,
-      "src/renderer/src/components/native-chat/native-chat-tool-summary.test.ts": 11,
-      "src/renderer/src/components/native-chat/native-chat-transcript-slots.test.ts": 6,
-      "src/renderer/src/components/native-chat/native-chat-turn-diffs.test.ts": 25,
-      "src/renderer/src/components/native-chat/native-chat-typing-indicator.test.ts": 11,
-      "src/renderer/src/components/native-chat/native-chat-typing-redirect.test.ts": 5,
-      "src/renderer/src/components/native-chat/native-chat-view-state.test.ts": 9,
-      "src/renderer/src/components/native-chat/native-chat-web-link-actions.test.ts": 18,
-      "src/renderer/src/components/native-chat/native-chat-working-status-shared-clock.test.tsx": 55,
-      "src/renderer/src/components/native-chat/native-chat-working-suppression.test.ts": 8,
-      "src/renderer/src/components/native-chat/structured-agent-session-message-projection.test.ts": 8,
-      "src/renderer/src/components/native-chat/structured-agent-session-read-transport.test.ts": 24,
-      "src/renderer/src/components/native-chat/structured-session-takeover-report.test.tsx": 74,
-      "src/renderer/src/components/native-chat/use-native-chat-composer-app-menu-selection.test.tsx": 65,
-      "src/renderer/src/components/native-chat/use-native-chat-composer-attachments.test.tsx": 83,
-      "src/renderer/src/components/native-chat/use-native-chat-composer-catalog.test.tsx": 45,
-      "src/renderer/src/components/native-chat/use-native-chat-composer-keydown.test.tsx": 30,
-      "src/renderer/src/components/native-chat/use-native-chat-composer-paste.test.tsx": 27,
-      "src/renderer/src/components/native-chat/use-native-chat-context-menu.test.tsx": 45,
-      "src/renderer/src/components/native-chat/use-native-chat-external-attachments.test.tsx": 46,
-      "src/renderer/src/components/native-chat/use-native-chat-hook-status.test.ts": 4,
-      "src/renderer/src/components/native-chat/use-native-chat-interactive-send.test.tsx": 34,
-      "src/renderer/src/components/native-chat/use-native-chat-launch-draft-adoption.test.tsx": 51,
-      "src/renderer/src/components/native-chat/use-native-chat-link-actions.test.tsx": 320,
-      "src/renderer/src/components/native-chat/use-native-chat-live-session-pending.test.ts": 63,
-      "src/renderer/src/components/native-chat/use-native-chat-live-session-visibility.test.ts": 75,
-      "src/renderer/src/components/native-chat/use-native-chat-live-session.test.ts": 158,
-      "src/renderer/src/components/native-chat/use-native-chat-picker-command-dispatch.test.tsx": 26,
-      "src/renderer/src/components/native-chat/use-native-chat-retained-session.test.ts": 32,
-      "src/renderer/src/components/native-chat/use-native-chat-send-lifecycle.test.tsx": 17,
-      "src/renderer/src/components/native-chat/use-native-chat-session-option-command.test.tsx": 30,
-      "src/renderer/src/components/native-chat/use-native-chat-session-options.test.ts": 248,
-      "src/renderer/src/components/native-chat/use-native-chat-skills.react.test.tsx": 396,
-      "src/renderer/src/components/native-chat/use-native-chat-skills.test.ts": 8,
-      "src/renderer/src/components/native-chat/use-native-chat-structured-composer-send.test.tsx": 193,
-      "src/renderer/src/components/native-chat/use-native-chat-toggle-shortcut.test.ts": 10,
-      "src/renderer/src/components/native-chat/use-native-chat-transcript-window.options.test.tsx": 88,
-      "src/renderer/src/components/native-chat/use-structured-agent-session-hold.test.tsx": 199,
-      "src/renderer/src/components/native-chat/use-structured-agent-session-messages.test.tsx": 24,
-      "src/renderer/src/components/native-chat/use-structured-agent-session-outbox.test.tsx": 870,
-      "src/renderer/src/components/native-chat/use-structured-agent-session-read.test.tsx": 596,
-      "src/renderer/src/components/native-chat/use-structured-agent-session.test.tsx": 605,
-      "src/renderer/src/components/native-chat/use-structured-agent-turn-timing.test.tsx": 23,
-      "src/renderer/src/components/network/CustomAddressDialog.test.tsx": 72,
-      "src/renderer/src/components/new-workspace/ComposerParentWorktreePicker.test.tsx": 175,
-      "src/renderer/src/components/new-workspace/ProjectCombobox.dialog-handoff.test.tsx": 499,
-      "src/renderer/src/components/new-workspace/ProjectCombobox.test.tsx": 245,
-      "src/renderer/src/components/new-workspace/ProjectComboboxRow.test.tsx": 65,
-      "src/renderer/src/components/new-workspace/SetProjectLocationDialog.test.tsx": 999,
-      "src/renderer/src/components/new-workspace/SmartWorkspaceNameField-provider-boundaries.test.ts": 7,
-      "src/renderer/src/components/new-workspace/SmartWorkspaceNameField-repo-slug-routing.test.ts": 14,
-      "src/renderer/src/components/new-workspace/SmartWorkspaceNameField-source-boundaries.test.ts": 5,
-      "src/renderer/src/components/new-workspace/SmartWorkspaceNameField.ime-enter.test.tsx": 253,
-      "src/renderer/src/components/new-workspace/SmartWorkspaceNameField.jira-accessibility.test.tsx": 500,
-      "src/renderer/src/components/new-workspace/project-combobox-matching.test.ts": 29,
-      "src/renderer/src/components/new-workspace/smart-workspace-command-value.test.ts": 7,
-      "src/renderer/src/components/new-workspace/smart-workspace-localized-options.test.ts": 59,
-      "src/renderer/src/components/new-workspace/smart-workspace-source-popover-focus.test.ts": 17,
-      "src/renderer/src/components/new-workspace/smart-workspace-source-results.test.ts": 16,
-      "src/renderer/src/components/new-workspace/use-jira-source-connection.test.tsx": 46,
-      "src/renderer/src/components/new-workspace/use-jira-url-source.test.tsx": 39,
-      "src/renderer/src/components/new-workspace/use-recent-project-ids.test.ts": 6,
-      "src/renderer/src/components/onboarding/AgentStep.test.tsx": 78,
-      "src/renderer/src/components/onboarding/FeatureSetupInlineTerminal.test.tsx": 31,
-      "src/renderer/src/components/onboarding/NotificationStep.test.tsx": 61,
-      "src/renderer/src/components/onboarding/OnboardingFlow.test.tsx": 128,
-      "src/renderer/src/components/onboarding/OnboardingInlineCommandTerminal.command-finished.test.tsx": 47,
-      "src/renderer/src/components/onboarding/OnboardingInlineCommandTerminal.test.ts": 4,
-      "src/renderer/src/components/onboarding/ThemeStep.test.ts": 8,
-      "src/renderer/src/components/onboarding/WindowsTerminalStep.test.tsx": 51,
-      "src/renderer/src/components/onboarding/agent-picked-payload.test.ts": 10,
-      "src/renderer/src/components/onboarding/onboarding-dismiss-target.test.ts": 4,
-      "src/renderer/src/components/onboarding/onboarding-feature-setup.test.ts": 23,
-      "src/renderer/src/components/onboarding/onboarding-folder-agent-startup.test.ts": 10,
-      "src/renderer/src/components/onboarding/onboarding-settings-hydration.test.ts": 5,
-      "src/renderer/src/components/onboarding/use-onboarding-flow-persistence.test.ts": 34,
-      "src/renderer/src/components/onboarding/use-onboarding-flow.test.ts": 21,
-      "src/renderer/src/components/onboarding/windows-terminal-onboarding-telemetry.test.ts": 5,
-      "src/renderer/src/components/orca-profiles/OrcaProfileSignOutConfirmDialog.test.tsx": 21,
-      "src/renderer/src/components/pet/PetOverlay.frame-durations.test.tsx": 50,
-      "src/renderer/src/components/pet/PetOverlay.keyframes.test.tsx": 217,
-      "src/renderer/src/components/pet/PetOverlay.pet-switch.test.tsx": 37,
-      "src/renderer/src/components/pet/PetOverlay.pointer-interaction.test.tsx": 75,
-      "src/renderer/src/components/pet/PetOverlay.test.ts": 5,
-      "src/renderer/src/components/pet/pet-agent-state.test.ts": 14,
-      "src/renderer/src/components/pet/pet-blob-cache.test.ts": 12,
-      "src/renderer/src/components/pet/pet-overlay-hit-area.test.tsx": 49,
-      "src/renderer/src/components/pet/pet-overlay-position.test.ts": 6,
-      "src/renderer/src/components/pet/pet-overlay-visibility.test.ts": 6,
-      "src/renderer/src/components/pet/sprite-animation-css.test.ts": 9,
-      "src/renderer/src/components/pet/usePetPointerInteraction.test.ts": 23,
-      "src/renderer/src/components/pet/usePetUrl.test.tsx": 15,
-      "src/renderer/src/components/ports/WorkspacePortScanner.test.tsx": 215,
-      "src/renderer/src/components/pr-check-counts.test.ts": 11,
-      "src/renderer/src/components/pr-checks-fix-prompt.test.ts": 20,
-      "src/renderer/src/components/pr-comments-resolution-prompt.test.ts": 9,
-      "src/renderer/src/components/provider-check-classification-parity.test.ts": 14,
-      "src/renderer/src/components/pull-request-page-host-boundary.test.ts": 17,
-      "src/renderer/src/components/pull-request-page/cache/file-content.test.ts": 11,
-      "src/renderer/src/components/pull-request-page/files/combined-diff-section-index.test.tsx": 22,
-      "src/renderer/src/components/pull-request-page/mentions/options.test.ts": 4,
-      "src/renderer/src/components/pull-request-page/mentions/query.test.ts": 7,
-      "src/renderer/src/components/pull-request-page/presentation/state-badge.test.ts": 6,
-      "src/renderer/src/components/quick-open-file-list.react.test.tsx": 90,
-      "src/renderer/src/components/quick-open-file-list.test.ts": 9,
-      "src/renderer/src/components/quick-open-install-rg-guidance.render.test.tsx": 57,
-      "src/renderer/src/components/quick-open-install-rg-guidance.test.ts": 9,
-      "src/renderer/src/components/quick-open-search.test.ts": 248,
-      "src/renderer/src/components/repo/NestedRepoChecklist.test.tsx": 17,
-      "src/renderer/src/components/repo/NestedRepoScanLimitNotice.test.ts": 5,
-      "src/renderer/src/components/repo/repo-icon.emoji-centering.test.tsx": 45,
-      "src/renderer/src/components/repo/repo-icon.test.tsx": 61,
-      "src/renderer/src/components/right-sidebar/ActionButton.test.tsx": 17,
-      "src/renderer/src/components/right-sidebar/AiVaultSessionRow.test.tsx": 294,
-      "src/renderer/src/components/right-sidebar/AiVaultSessionSubagents.test.tsx": 67,
-      "src/renderer/src/components/right-sidebar/ChecksPanel.review-header.test.tsx": 28,
-      "src/renderer/src/components/right-sidebar/ChecksPanel.updated-at-metadata.test.tsx": 46,
-      "src/renderer/src/components/right-sidebar/CommitArea.chevron-spinner.test.tsx": 78,
-      "src/renderer/src/components/right-sidebar/CommitArea.generate.test.tsx": 87,
-      "src/renderer/src/components/right-sidebar/CommitArea.primary-icons.test.tsx": 92,
-      "src/renderer/src/components/right-sidebar/CommitArea.test.tsx": 373,
-      "src/renderer/src/components/right-sidebar/FileExplorerNameFilter.test.tsx": 12,
-      "src/renderer/src/components/right-sidebar/FileExplorerRow.actions.test.tsx": 19,
-      "src/renderer/src/components/right-sidebar/FileExplorerToolbar.test.tsx": 45,
-      "src/renderer/src/components/right-sidebar/FileExplorerViewSwitch.test.tsx": 10,
-      "src/renderer/src/components/right-sidebar/FileExplorerVirtualRows.row-handlers.test.tsx": 16,
-      "src/renderer/src/components/right-sidebar/FileExplorerVirtualRowsAddProject.test.tsx": 14,
-      "src/renderer/src/components/right-sidebar/FolderWorkspacePrChecksPanel.test.tsx": 300,
-      "src/renderer/src/components/right-sidebar/FolderWorkspacePrChecksRow.test.tsx": 72,
-      "src/renderer/src/components/right-sidebar/FolderWorkspaceWorktreesPanel.test.tsx": 69,
-      "src/renderer/src/components/right-sidebar/GitHistoryPanel.test.tsx": 60,
-      "src/renderer/src/components/right-sidebar/GitHubPRStackMap.test.tsx": 75,
-      "src/renderer/src/components/right-sidebar/HostedReviewActions.draft.test.tsx": 22,
-      "src/renderer/src/components/right-sidebar/PluginPanel.test.tsx": 220,
-      "src/renderer/src/components/right-sidebar/PortsPanel.test.tsx": 1028,
-      "src/renderer/src/components/right-sidebar/PullRequestComposer.generate-tooltip.test.tsx": 753,
-      "src/renderer/src/components/right-sidebar/SearchResultItems.test.tsx": 18,
-      "src/renderer/src/components/right-sidebar/SessionRowTrailingActions.test.tsx": 54,
-      "src/renderer/src/components/right-sidebar/SourceControl.branch-line-total.test.tsx": 774,
-      "src/renderer/src/components/right-sidebar/SourceControl.commit-drafts.test.ts": 18,
-      "src/renderer/src/components/right-sidebar/SourceControl.commit-failure-recovery.test.ts": 9,
-      "src/renderer/src/components/right-sidebar/SourceControl.commit-generation-records.test.ts": 8,
-      "src/renderer/src/components/right-sidebar/SourceControl.compare-summary.test.ts": 14,
-      "src/renderer/src/components/right-sidebar/SourceControl.host-context-boundary.test.ts": 8,
-      "src/renderer/src/components/right-sidebar/SourceControl.hosted-review-header-link.test.tsx": 19,
-      "src/renderer/src/components/right-sidebar/SourceControl.open-file-highlight.test.tsx": 546,
-      "src/renderer/src/components/right-sidebar/SourceControl.pr-generation-records.test.ts": 15,
-      "src/renderer/src/components/right-sidebar/SourceControl.preview-open.test.tsx": 833,
-      "src/renderer/src/components/right-sidebar/SourceControl.push-failure-recovery.test.ts": 8,
-      "src/renderer/src/components/right-sidebar/SourceControl.remote-action-errors.test.ts": 9,
-      "src/renderer/src/components/right-sidebar/SourceControl.resolve-conflicts-prompt.test.ts": 8,
-      "src/renderer/src/components/right-sidebar/SourceControl.virtual-file-list.test.tsx": 2498,
-      "src/renderer/src/components/right-sidebar/SourceControlAgentActionDialog.test.tsx": 425,
-      "src/renderer/src/components/right-sidebar/SourceControlAgentActionDialogForm.test.tsx": 74,
-      "src/renderer/src/components/right-sidebar/SourceControlTextGenerationDialog.test.ts": 94,
-      "src/renderer/src/components/right-sidebar/active-checks-status.test.ts": 9,
-      "src/renderer/src/components/right-sidebar/activity-bar-buttons.test.tsx": 59,
-      "src/renderer/src/components/right-sidebar/activity-bar-overflow.test.ts": 7,
-      "src/renderer/src/components/right-sidebar/ai-vault-first-prompt-card.test.tsx": 137,
-      "src/renderer/src/components/right-sidebar/ai-vault-host-scope.test.ts": 32,
-      "src/renderer/src/components/right-sidebar/ai-vault-original-pane-index.test.ts": 16,
-      "src/renderer/src/components/right-sidebar/ai-vault-original-pane.test.ts": 7,
-      "src/renderer/src/components/right-sidebar/ai-vault-scan-issue-state.test.ts": 8,
-      "src/renderer/src/components/right-sidebar/ai-vault-scope-paths.test.ts": 12,
-      "src/renderer/src/components/right-sidebar/ai-vault-scope-state.test.ts": 8,
-      "src/renderer/src/components/right-sidebar/ai-vault-session-continuation.test.ts": 7,
-      "src/renderer/src/components/right-sidebar/ai-vault-session-deletability.test.ts": 10,
-      "src/renderer/src/components/right-sidebar/ai-vault-session-display.test.ts": 13,
-      "src/renderer/src/components/right-sidebar/ai-vault-session-filters.test.ts": 19,
-      "src/renderer/src/components/right-sidebar/ai-vault-session-identity.test.ts": 9,
-      "src/renderer/src/components/right-sidebar/ai-vault-session-log-open.test.ts": 15,
-      "src/renderer/src/components/right-sidebar/ai-vault-session-path-actions.test.ts": 7,
-      "src/renderer/src/components/right-sidebar/ai-vault-session-projects.test.ts": 22,
-      "src/renderer/src/components/right-sidebar/ai-vault-session-publication-gate.test.ts": 17,
-      "src/renderer/src/components/right-sidebar/ai-vault-session-refresh.test.ts": 193,
-      "src/renderer/src/components/right-sidebar/ai-vault-session-resume-in-chat-launch.test.ts": 9,
-      "src/renderer/src/components/right-sidebar/ai-vault-session-resume-in-chat.test.ts": 10,
-      "src/renderer/src/components/right-sidebar/ai-vault-session-resume.test.ts": 19,
-      "src/renderer/src/components/right-sidebar/ai-vault-session-worktree-map.test.tsx": 61,
-      "src/renderer/src/components/right-sidebar/ai-vault-session-worktree.test.ts": 19,
-      "src/renderer/src/components/right-sidebar/ai-vault-view-defaults.test.ts": 10,
-      "src/renderer/src/components/right-sidebar/ai-vault-view-options-persistence.test.ts": 13,
-      "src/renderer/src/components/right-sidebar/branch-line-total-request-gate.test.ts": 6,
-      "src/renderer/src/components/right-sidebar/check-details-resize.test.ts": 4,
-      "src/renderer/src/components/right-sidebar/checks-entry-refresh.test.ts": 10,
-      "src/renderer/src/components/right-sidebar/checks-list-expanded-details.test.tsx": 327,
-      "src/renderer/src/components/right-sidebar/checks-panel-async-result-key.test.ts": 4,
-      "src/renderer/src/components/right-sidebar/checks-panel-content.test.tsx": 100,
-      "src/renderer/src/components/right-sidebar/checks-panel-empty-state.test.ts": 28,
-      "src/renderer/src/components/right-sidebar/checks-panel-git-status-snapshot.test.ts": 14,
-      "src/renderer/src/components/right-sidebar/checks-panel-hosted-review-click-routing.test.ts": 10,
-      "src/renderer/src/components/right-sidebar/checks-panel-pr-refresh-breadcrumb.test.ts": 11,
-      "src/renderer/src/components/right-sidebar/checks-panel-pr-refresh-request.test.ts": 9,
-      "src/renderer/src/components/right-sidebar/checks-panel-review-creation.test.ts": 16,
-      "src/renderer/src/components/right-sidebar/checks-panel-review-lookup-authority.test.ts": 11,
-      "src/renderer/src/components/right-sidebar/checks-panel-review.test.ts": 8,
-      "src/renderer/src/components/right-sidebar/checks-panel-terminal-worktree.test.ts": 12,
-      "src/renderer/src/components/right-sidebar/checks-panel/gitlab-review-client.test.ts": 9,
-      "src/renderer/src/components/right-sidebar/checks-panel/panel-content-rendering.test.tsx": 90,
-      "src/renderer/src/components/right-sidebar/checks-panel/use-checks-panel-check-and-review-actions.test.tsx": 33,
-      "src/renderer/src/components/right-sidebar/checks-panel/use-checks-panel-create-review.test.tsx": 22,
-      "src/renderer/src/components/right-sidebar/checks-panel/use-checks-panel-generation.test.tsx": 17,
-      "src/renderer/src/components/right-sidebar/checks-panel/use-checks-panel-git-status-effects.test.tsx": 37,
-      "src/renderer/src/components/right-sidebar/checks-panel/use-checks-panel-manual-refresh.test.tsx": 15,
-      "src/renderer/src/components/right-sidebar/checks-panel/use-checks-panel-polling.test.tsx": 38,
-      "src/renderer/src/components/right-sidebar/coalesced-poll-runner.test.ts": 18,
-      "src/renderer/src/components/right-sidebar/commit-failure-dialog-state.test.ts": 4,
-      "src/renderer/src/components/right-sidebar/commit-failure-summary.test.ts": 21,
-      "src/renderer/src/components/right-sidebar/create-review-draft-title.test.ts": 7,
-      "src/renderer/src/components/right-sidebar/diff-comments-clear-dialog-state.test.ts": 6,
-      "src/renderer/src/components/right-sidebar/discard-all-sequence.test.ts": 19,
-      "src/renderer/src/components/right-sidebar/file-explorer-add-project-action.test.ts": 7,
-      "src/renderer/src/components/right-sidebar/file-explorer-batch-deletion.test.ts": 140,
-      "src/renderer/src/components/right-sidebar/file-explorer-deferred-dir-toggle.test.ts": 42,
-      "src/renderer/src/components/right-sidebar/file-explorer-dir-load-tracker.test.ts": 4,
-      "src/renderer/src/components/right-sidebar/file-explorer-dir-toggle-timing.test.ts": 11,
-      "src/renderer/src/components/right-sidebar/file-explorer-directory-listing.test.ts": 5,
-      "src/renderer/src/components/right-sidebar/file-explorer-drag-scroll-marker.test.tsx": 56,
-      "src/renderer/src/components/right-sidebar/file-explorer-entries.test.ts": 9,
-      "src/renderer/src/components/right-sidebar/file-explorer-expanded-dirs-refresh.test.ts": 23,
-      "src/renderer/src/components/right-sidebar/file-explorer-inline-input-outside-click.test.tsx": 62,
-      "src/renderer/src/components/right-sidebar/file-explorer-inline-rename-flow.test.tsx": 113,
-      "src/renderer/src/components/right-sidebar/file-explorer-keyboard-navigation.test.ts": 11,
-      "src/renderer/src/components/right-sidebar/file-explorer-name-filter-projection.test.ts": 5,
-      "src/renderer/src/components/right-sidebar/file-explorer-operation-generation.test.ts": 35,
-      "src/renderer/src/components/right-sidebar/file-explorer-paths.test.ts": 5,
-      "src/renderer/src/components/right-sidebar/file-explorer-refresh-concurrency.test.ts": 4,
-      "src/renderer/src/components/right-sidebar/file-explorer-reset.test.ts": 5,
-      "src/renderer/src/components/right-sidebar/file-explorer-row-projection.test.ts": 8,
-      "src/renderer/src/components/right-sidebar/file-explorer-runtime-owner-boundary.test.ts": 9,
-      "src/renderer/src/components/right-sidebar/file-explorer-selection.test.ts": 8,
-      "src/renderer/src/components/right-sidebar/file-explorer-stale-dir-cache.test.ts": 5,
-      "src/renderer/src/components/right-sidebar/file-explorer-watch-drive-root.test.ts": 12,
-      "src/renderer/src/components/right-sidebar/file-explorer-watch-reconcile.test.ts": 193,
-      "src/renderer/src/components/right-sidebar/file-explorer-watch-refresh-scheduler.test.ts": 37,
-      "src/renderer/src/components/right-sidebar/file-search-include-pattern.test.ts": 8,
-      "src/renderer/src/components/right-sidebar/folder-workspace-attached-worktrees.test.ts": 16,
-      "src/renderer/src/components/right-sidebar/fork-push-target-label.test.ts": 6,
-      "src/renderer/src/components/right-sidebar/git-status-push-signal-refresh.test.ts": 32,
-      "src/renderer/src/components/right-sidebar/git-status-refresh-branch-line-total.test.ts": 19,
-      "src/renderer/src/components/right-sidebar/git-status-refresh-scheduler.test.ts": 23,
-      "src/renderer/src/components/right-sidebar/git-status-refresh.test.ts": 66,
-      "src/renderer/src/components/right-sidebar/github-pr-link-modal.test.ts": 9,
-      "src/renderer/src/components/right-sidebar/github-pr-stack-merge.test.ts": 12,
-      "src/renderer/src/components/right-sidebar/gitlab-mr-merge-state.test.ts": 10,
-      "src/renderer/src/components/right-sidebar/local-workspace-port-sections.test.ts": 8,
-      "src/renderer/src/components/right-sidebar/parent-pr-checks-projection-selector.test.ts": 77,
-      "src/renderer/src/components/right-sidebar/parent-pr-checks-refresh.test.ts": 32,
-      "src/renderer/src/components/right-sidebar/parent-pr-checks-rows.test.ts": 37,
-      "src/renderer/src/components/right-sidebar/plugin-panel-activity-items.test.ts": 5,
-      "src/renderer/src/components/right-sidebar/plugin-panel-bridge-host.test.ts": 45,
-      "src/renderer/src/components/right-sidebar/plugin-panel-watchdog-visibility.test.ts": 12,
-      "src/renderer/src/components/right-sidebar/plugin-panel-watchdog.test.ts": 12,
-      "src/renderer/src/components/right-sidebar/pr-comment-presentation.test.ts": 9,
-      "src/renderer/src/components/right-sidebar/pr-comment-snapshotted-thread-resolver.test.ts": 11,
-      "src/renderer/src/components/right-sidebar/pr-comment-thread-resolution.test.ts": 4,
-      "src/renderer/src/components/right-sidebar/pr-comments-ai-launch-ack.test.ts": 23,
-      "src/renderer/src/components/right-sidebar/pr-comments-list-selection.test.tsx": 791,
-      "src/renderer/src/components/right-sidebar/push-target-upstream-refresh-cache.test.ts": 11,
-      "src/renderer/src/components/right-sidebar/review-cache-entry-selection.test.ts": 11,
-      "src/renderer/src/components/right-sidebar/right-panel-comment-composer.ime-enter.test.tsx": 103,
-      "src/renderer/src/components/right-sidebar/right-panel-comment-focus-timers.test.ts": 8,
-      "src/renderer/src/components/right-sidebar/right-sidebar-activity-visibility.test.ts": 5,
-      "src/renderer/src/components/right-sidebar/right-sidebar-effective-tab.test.ts": 5,
-      "src/renderer/src/components/right-sidebar/right-sidebar-primary-action-layout.test.ts": 5,
-      "src/renderer/src/components/right-sidebar/right-sidebar-titlebar-drag-regions.render.test.tsx": 126,
-      "src/renderer/src/components/right-sidebar/right-sidebar-titlebar-drag-regions.test.ts": 5,
-      "src/renderer/src/components/right-sidebar/right-sidebar-width.test.ts": 5,
-      "src/renderer/src/components/right-sidebar/runSourceControlAgentActionStart.test.ts": 11,
-      "src/renderer/src/components/right-sidebar/search-match-open.test.ts": 12,
-      "src/renderer/src/components/right-sidebar/search-rows.test.ts": 6,
-      "src/renderer/src/components/right-sidebar/source-control-action-recipe-match.test.ts": 11,
-      "src/renderer/src/components/right-sidebar/source-control-actions.test.ts": 5,
-      "src/renderer/src/components/right-sidebar/source-control-active-open-file-keys.test.ts": 8,
-      "src/renderer/src/components/right-sidebar/source-control-agent-action-dialog-support.test.ts": 4,
-      "src/renderer/src/components/right-sidebar/source-control-branch-context-row.test.tsx": 147,
-      "src/renderer/src/components/right-sidebar/source-control-branch-context-stats.test.ts": 17,
-      "src/renderer/src/components/right-sidebar/source-control-branch-section-heading.test.tsx": 23,
-      "src/renderer/src/components/right-sidebar/source-control-commit-eligibility.test.ts": 7,
+      "config/scripts/adhoc-build-version.test.mjs": 90,
+      "config/scripts/agent-status-hot-path-benchmark.test.ts": 2954,
+      "config/scripts/app-store-performance-plugin.test.mjs": 1255,
+      "config/scripts/assert-github-release-is-draft.test.mjs": 348,
+      "config/scripts/audit-localization-coverage.test.mjs": 412,
+      "config/scripts/benchmark-artifact-comparison.test.mjs": 193,
+      "config/scripts/benchmark-sample-summary.test.mjs": 45,
+      "config/scripts/build-linux-local.test.mjs": 35,
+      "config/scripts/build-mac-local.test.mjs": 52,
+      "config/scripts/build-mobile-web-app-bundle.test.mjs": 213,
+      "config/scripts/build-native-for-platform.test.mjs": 42,
+      "config/scripts/build-orcad-bun.test.mjs": 122,
+      "config/scripts/build-orcad-prebuilds.test.mjs": 85,
+      "config/scripts/build-windows-cli-launcher.test.mjs": 84,
+      "config/scripts/bun-profile-change-scope.test.mjs": 3355,
+      "config/scripts/casting-code-quality.test.mjs": 874,
+      "config/scripts/check-changed-code-quality.test.mjs": 79,
+      "config/scripts/check-max-lines-ratchet.test.mjs": 945,
+      "config/scripts/check-react-doctor-changed.test.mjs": 300,
+      "config/scripts/check-readme-local-links.test.mjs": 520,
+      "config/scripts/check-reliability-gates.test.mjs": 175,
+      "config/scripts/check-root-directory-entries.test.mjs": 1241,
+      "config/scripts/check-runtime-electron-ratchet.test.mjs": 2494,
+      "config/scripts/check-terminal-perf-report-budgets.test.mjs": 2243,
+      "config/scripts/check-ts-nocheck-ratchet.test.mjs": 44,
+      "config/scripts/ci-cache-warmup-workflow.test.mjs": 110,
+      "config/scripts/ci-dependency-download-cache.test.mjs": 401,
+      "config/scripts/ci-e2e-shard-selection.test.mjs": 14257,
+      "config/scripts/ci-native-toolchain.test.mjs": 92,
+      "config/scripts/ci-shard-assignment.test.mjs": 308,
+      "config/scripts/ci-unit-timing-reporter.test.mjs": 62,
+      "config/scripts/cli-main-module-bundle-parity.test.ts": 594,
+      "config/scripts/client-hosted-browser-package-coverage.test.mjs": 124,
+      "config/scripts/cloud-security-history-workflow.test.mjs": 344,
+      "config/scripts/codex-index-heal-contract-workflow.test.mjs": 145,
+      "config/scripts/codex-primary-home-tripwire.test.ts": 344,
+      "config/scripts/computer-e2e-workflow.test.mjs": 159,
+      "config/scripts/computer-use-modifier-safety.test.mjs": 51,
+      "config/scripts/computer-use-mouse-button-routing.test.mjs": 43,
+      "config/scripts/computer-use-skill-guidance.test.mjs": 130,
+      "config/scripts/computer-use-smoke.test.mjs": 580,
+      "config/scripts/computer-use-windows-horizontal-scroll.test.mjs": 42,
+      "config/scripts/counterbalanced-benchmark-schedule.test.mjs": 47,
+      "config/scripts/create-draft-release.test.mjs": 72,
+      "config/scripts/daily-build-version.test.mjs": 87,
+      "config/scripts/daily-e2e-dispatch-contract.test.mjs": 168,
+      "config/scripts/dev-channel-base-version.test.mjs": 60,
+      "config/scripts/dev-channel-windows-workflow-contract.test.mjs": 141,
+      "config/scripts/dev-cli-terminal-wrapper.test.mjs": 34,
+      "config/scripts/dev-electron-bundle-cache.test.ts": 52,
+      "config/scripts/dev-electron-bundle-identity.test.ts": 82,
+      "config/scripts/electron-builder-config.test.mjs": 1072,
+      "config/scripts/electron-builder-mac-channel-config.test.mjs": 1002,
+      "config/scripts/electron-builder-markdown-associations.test.mjs": 269,
+      "config/scripts/electron-builder-native-rebuild.test.mjs": 41,
+      "config/scripts/electron-builder-runtime-resources.test.mjs": 1124,
+      "config/scripts/electron-builder-speech-config.test.mjs": 485,
+      "config/scripts/electron-runtime-floor.test.ts": 37,
+      "config/scripts/electron-vite-output-contract.test.ts": 1042,
+      "config/scripts/ensure-native-runtime-job-ownership.test.mjs": 35,
+      "config/scripts/ensure-native-runtime.test.mjs": 771,
+      "config/scripts/ephemeral-vm-runtime-store-cross-version.test.ts": 42,
+      "config/scripts/generate-bundled-skill-guides.test.mjs": 510,
+      "config/scripts/generate-runtime-required-english-catalog.test.mjs": 452,
+      "config/scripts/generate-skill-bundle-manifest.test.mjs": 721,
+      "config/scripts/generate-terminal-perf-html-report.test.mjs": 71,
+      "config/scripts/git-binary-compatibility-workflow.test.mjs": 153,
+      "config/scripts/git-pull-request-diff-base.test.mjs": 36,
+      "config/scripts/hang-watchdog-process-metrics.test.mjs": 34,
+      "config/scripts/happy-dom-mutation-observer-retention.test.ts": 384,
+      "config/scripts/happy-dom-offscreen-canvas.test.ts": 319,
+      "config/scripts/headless-serve-shutdown-matrix.test.mjs": 112,
+      "config/scripts/headless-serve-shutdown-workflow.test.mjs": 148,
+      "config/scripts/hourly-build-version.test.mjs": 136,
+      "config/scripts/hourly-preflight-workflow.test.mjs": 165,
+      "config/scripts/idle-cpu-process-sampling.test.mjs": 60,
+      "config/scripts/install-electron-package-binary.test.mjs": 3284,
+      "config/scripts/install-node-dependencies-action.test.mjs": 434,
+      "config/scripts/lag-probe-failures.test.mjs": 52,
+      "config/scripts/latest-stable-release.test.mjs": 60,
+      "config/scripts/lint-staged-worktree-backup.test.mjs": 436,
+      "config/scripts/linux-package-fixture-cache.test.mjs": 200,
+      "config/scripts/linux-package-maintainer-scripts.test.mjs": 19,
+      "config/scripts/live-freeze-bounded-history.test.mjs": 49,
+      "config/scripts/live-remote-bulk-open-freeze-metrics.test.mjs": 72,
+      "config/scripts/live-remote-freeze-rpc.test.mjs": 53,
+      "config/scripts/live-remote-status-watchdog.test.mjs": 285,
+      "config/scripts/locale-brand-prefilter.test.mjs": 263,
+      "config/scripts/locale-count-fragment-separator.test.mjs": 200,
+      "config/scripts/locale-generic-ui-terms.test.mjs": 111,
+      "config/scripts/locale-ko-frozen-terminal-search-keywords.test.mjs": 127,
+      "config/scripts/locale-ko-key-overrides.test.mjs": 95,
+      "config/scripts/locale-repair-catalog-missing-leaves.test.mjs": 124,
+      "config/scripts/locale-translation-policy-ko-round5.test.mjs": 249,
+      "config/scripts/locale-translation-policy.es-pr.test.mjs": 132,
+      "config/scripts/locale-translation-policy.es-round5.test.mjs": 118,
+      "config/scripts/locale-translation-policy.ja-relocalization.test.mjs": 207,
+      "config/scripts/locale-translation-policy.ja-round5.test.mjs": 137,
+      "config/scripts/locale-translation-policy.test.mjs": 283,
+      "config/scripts/locale-translation-policy.zh-round5.test.mjs": 290,
+      "config/scripts/locale-translation-policy.zh-status-bar-usage.test.mjs": 138,
+      "config/scripts/localization-extraction-change-scope.test.mjs": 133,
+      "config/scripts/localization-package-contract.test.mjs": 40,
+      "config/scripts/mac-build-compatibility.test.mjs": 41,
+      "config/scripts/macos-computer-helper-owner-loss-group-recovery.test.mjs": 33,
+      "config/scripts/macos-computer-helper-owner-loss-processes.test.mjs": 64,
+      "config/scripts/macos-tcc-prompt-localization.test.mjs": 213,
+      "config/scripts/mobile-launch-contract-workflow.test.mjs": 439,
+      "config/scripts/mobile-mirrored-storage-write-path.test.mjs": 136,
+      "config/scripts/mobile-pairing-qrcode-import-plugin.test.mjs": 421,
+      "config/scripts/mobile-recording-pin-checkout.test.mjs": 309,
+      "config/scripts/mobile-release-check-scope.test.mjs": 610,
+      "config/scripts/mobile-release-shell-switch-workflow.test.mjs": 227,
+      "config/scripts/mobile-set-native-props-web-siblings.test.mjs": 959,
+      "config/scripts/mobile-test-change-scope.test.mjs": 107,
+      "config/scripts/mobile-web-app-agent-history-render.test.mjs": 695,
+      "config/scripts/mobile-web-app-browser-pane-render.test.mjs": 416,
+      "config/scripts/mobile-web-app-browser-pane-text-inputs.test.mjs": 380,
+      "config/scripts/mobile-web-app-clipboard-image-resize-render.test.mjs": 544,
+      "config/scripts/mobile-web-app-drawer-render.test.mjs": 379,
+      "config/scripts/mobile-web-app-editable-host-font-size.test.mjs": 590,
+      "config/scripts/mobile-web-app-external-link-seam.test.mjs": 340,
+      "config/scripts/mobile-web-app-external-navigation-grant.test.mjs": 81,
+      "config/scripts/mobile-web-app-files-external-links.test.mjs": 383,
+      "config/scripts/mobile-web-app-files-render.test.mjs": 315,
+      "config/scripts/mobile-web-app-frame-budget-sweep.test.ts": 545,
+      "config/scripts/mobile-web-app-handoff-grants-render.test.mjs": 476,
+      "config/scripts/mobile-web-app-haptics-seam.test.mjs": 491,
+      "config/scripts/mobile-web-app-html-preview-render.test.mjs": 1035,
+      "config/scripts/mobile-web-app-mermaid-render.test.mjs": 567,
+      "config/scripts/mobile-web-app-native-parity-render.test.mjs": 554,
+      "config/scripts/mobile-web-app-page-closure-families.test.mjs": 75,
+      "config/scripts/mobile-web-app-page-grant-call-sites.test.mjs": 567,
+      "config/scripts/mobile-web-app-push-subsystem-closure.test.mjs": 70,
+      "config/scripts/mobile-web-app-render.test.mjs": 339,
+      "config/scripts/mobile-web-app-rich-markdown-render.test.mjs": 991,
+      "config/scripts/mobile-web-app-route-manifest.test.mjs": 220,
+      "config/scripts/mobile-web-app-route-snapshot.test.mjs": 95,
+      "config/scripts/mobile-web-app-safe-area-render.test.mjs": 503,
+      "config/scripts/mobile-web-app-screencast-lane-grant.test.mjs": 56,
+      "config/scripts/mobile-web-app-session-dictation-capture.test.mjs": 98,
+      "config/scripts/mobile-web-app-session-external-links.test.mjs": 210,
+      "config/scripts/mobile-web-app-session-media-picker.test.mjs": 375,
+      "config/scripts/mobile-web-app-session-render.test.mjs": 495,
+      "config/scripts/mobile-web-app-session-terminal-closure.test.mjs": 444,
+      "config/scripts/mobile-web-app-session-terminal-init.test.mjs": 529,
+      "config/scripts/mobile-web-app-session-text-inputs.test.mjs": 391,
+      "config/scripts/mobile-web-app-session-webview-consumers.test.mjs": 76,
+      "config/scripts/mobile-web-app-source-control-external-links.test.mjs": 317,
+      "config/scripts/mobile-web-app-source-control-keyboard.test.mjs": 59,
+      "config/scripts/mobile-web-app-source-control-render.test.mjs": 432,
+      "config/scripts/mobile-web-app-source-control-text-inputs.test.mjs": 295,
+      "config/scripts/mobile-web-app-tasks-external-links.test.mjs": 349,
+      "config/scripts/mobile-web-app-tasks-render.test.mjs": 356,
+      "config/scripts/mobile-web-app-terminal-live-input-render.test.mjs": 431,
+      "config/scripts/mobile-web-app-terminal-render-fixture.test.mjs": 548,
+      "config/scripts/mobile-web-app-terminal-render.test.mjs": 346,
+      "config/scripts/mobile-web-app-web-overrides.test.mjs": 69,
+      "config/scripts/mobile-web-bundle-manifest.test.mjs": 54,
+      "config/scripts/mobile-web-bundle-packaging-workflow-contract.test.mjs": 1102,
+      "config/scripts/mobile-web-bundle-serializer-parity.test.mjs": 138,
+      "config/scripts/mobile-web-page-route-hop-coverage.test.mjs": 4953,
+      "config/scripts/mobile-web-page-routes.test.mjs": 162,
+      "config/scripts/mobile-web-source-line-endings.test.mjs": 661,
+      "config/scripts/mobile-web-terminal-engine-closure.test.mjs": 79,
+      "config/scripts/node-old-space-limit.test.mjs": 32,
+      "config/scripts/node-pty-console-list-agent-patch.test.mjs": 46,
+      "config/scripts/node-pty-master-cloexec-patch.test.mjs": 114,
+      "config/scripts/node-pty-windows-pty-teardown-patch.test.mjs": 98,
+      "config/scripts/nsis-process-check.test.mjs": 62,
+      "config/scripts/orca-cli-skill-guidance.test.mjs": 62,
+      "config/scripts/orca-dev-bin.test.mjs": 79,
+      "config/scripts/orca-linear-skill-guidance.test.mjs": 50,
+      "config/scripts/orcad-artifact-version.test.mjs": 470,
+      "config/scripts/orcad-operations-restart-safety.test.mjs": 45,
+      "config/scripts/orcad-terminal-smoke-change-scope.test.mjs": 1510,
+      "config/scripts/orcad-watcher-package.test.mjs": 132,
+      "config/scripts/orcad-windows-process-tree.test.mjs": 63,
+      "config/scripts/orchestration-guide-command-contract.test.mjs": 44,
+      "config/scripts/orchestration-skill-guidance.test.mjs": 58,
+      "config/scripts/oxc-cli-invocation.test.mjs": 85,
+      "config/scripts/oxlint-cli-invocation.test.mjs": 106,
+      "config/scripts/package-electron-install-owner.test.mjs": 91,
+      "config/scripts/package-electron-runtime-contract.test.mjs": 447,
+      "config/scripts/package-linux-formats.test.mjs": 208,
+      "config/scripts/packaged-browser-lane-contract.test.mjs": 104,
+      "config/scripts/packaged-hang-watchdog-worker-contract.test.mjs": 161,
+      "config/scripts/packaged-node-pty-prebuild-prune.test.mjs": 93,
+      "config/scripts/packaged-source-map-prune.test.mjs": 117,
+      "config/scripts/patched-dependencies-frozen-install.test.mjs": 900,
+      "config/scripts/pdfjs-viewer-assets-stream.test.ts": 246,
+      "config/scripts/plain-node-entry-guard.test.ts": 728,
+      "config/scripts/playwright-focused-workflow-selection.test.mjs": 3690,
+      "config/scripts/pnpm-cli-invocation.test.mjs": 38,
+      "config/scripts/pr-code-change-scope.test.mjs": 638,
+      "config/scripts/pr-e2e-gate-contract.test.mjs": 409,
+      "config/scripts/pr-e2e-native-only-routing.test.mjs": 169,
+      "config/scripts/pr-e2e-pane-close-routing.test.mjs": 55,
+      "config/scripts/pr-ready-check-gate.test.mjs": 303,
+      "config/scripts/pr-ready-check-reuse.test.mjs": 190,
+      "config/scripts/pr-test-loc-summary.test.mjs": 178,
+      "config/scripts/pr-workflow-lint-parity.test.mjs": 81,
+      "config/scripts/pr-workflow-parallelism.test.mjs": 1324,
+      "config/scripts/profile-state-worker-smoke.test.mjs": 2754,
+      "config/scripts/project-renderer-web-client.test.mjs": 251,
+      "config/scripts/pty-transcript-secret-scan.test.mjs": 68,
+      "config/scripts/publish-complete-draft-releases.test.mjs": 230,
+      "config/scripts/quadratic-buffer-concat-plugin.test.mjs": 2182,
+      "config/scripts/rebuild-native-deps-node-pty.test.mjs": 4426,
+      "config/scripts/rebuild-native-deps-windows-process-tree.test.mjs": 40,
+      "config/scripts/rebuild-native-deps.test.mjs": 1467,
+      "config/scripts/reclaim-dev-electron-bundles.test.ts": 57,
+      "config/scripts/regenerate-xterm-patches.test.mjs": 432,
+      "config/scripts/relay-artifact-manifest.test.mjs": 4048,
+      "config/scripts/relay-asset-line-ending-pin.test.mjs": 110,
+      "config/scripts/release-blocker-fixes.test.mjs": 80,
+      "config/scripts/release-cut-signpath-slack.test.mjs": 95,
+      "config/scripts/release-cut-sourcemap-publish.test.mjs": 175,
+      "config/scripts/release-cut-token-permissions.test.mjs": 210,
+      "config/scripts/release-e2e-dispatch-contract.test.mjs": 184,
+      "config/scripts/release-mac-build-workflow-dispatch.test.mjs": 45,
+      "config/scripts/release-rc-history.test.mjs": 244,
+      "config/scripts/renderer-boot-graph.test.mjs": 98,
+      "config/scripts/renderer-scrollbar-style-plugin.test.mjs": 2119,
+      "config/scripts/replace-cached-nsis-elevate.test.mjs": 1919,
+      "config/scripts/resolve-7za-path.test.mjs": 1815,
+      "config/scripts/run-codex-real-account-validation.test.ts": 4165,
+      "config/scripts/run-internal-dev-setup.test.mjs": 54,
+      "config/scripts/run-linux-packaged-node-pty-floor-smoke.test.mjs": 71,
+      "config/scripts/run-terminal-scale-perf-report-gate.test.mjs": 73,
+      "config/scripts/run-typecheck-projects-in-parallel.test.mjs": 47,
+      "config/scripts/script-entry-detection.test.mjs": 72,
+      "config/scripts/script-module-dependencies.test.mjs": 57,
+      "config/scripts/shared-electron-dist-cache.test.ts": 90,
+      "config/scripts/shebang-script-line-ending-pin.test.mjs": 119,
+      "config/scripts/skill-critical-guidance.test.mjs": 37,
+      "config/scripts/skill-description-length.test.mjs": 83,
+      "config/scripts/skill-recipe-shell.test.mjs": 76,
+      "config/scripts/skill-sharing-release-workflow.test.mjs": 130,
+      "config/scripts/skill-update-roundtrip-workflow.test.mjs": 86,
+      "config/scripts/skills-cli-package-workflow.test.mjs": 137,
+      "config/scripts/sort-comparator-performance-plugin.test.mjs": 332,
+      "config/scripts/space-sharing-copy.test.ts": 110,
+      "config/scripts/ssh-browser-e2e-routing.test.mjs": 138,
+      "config/scripts/ssh-docker-ci-sharding.test.mjs": 7004,
+      "config/scripts/ssh-localhost-e2e-routing.test.mjs": 163,
+      "config/scripts/static-appimage-package-contract.test.mjs": 83,
+      "config/scripts/summarize-terminal-perf-report.test.mjs": 74,
+      "config/scripts/telemetry-bundle-constant-patterns.test.mjs": 45,
+      "config/scripts/terminal-ime-e2e-workflow.test.mjs": 79,
+      "config/scripts/terminal-ime-engagement-receipt.test.mjs": 37,
+      "config/scripts/terminal-perf-report-annotations.test.mjs": 60,
+      "config/scripts/trim-windows-icon-source.test.mjs": 289,
+      "config/scripts/verify-cli-bin.test.mjs": 102,
+      "config/scripts/verify-dev-channel-packaging.test.mjs": 655,
+      "config/scripts/verify-linux-glibc-floor.test.mjs": 142,
+      "config/scripts/verify-linux-glibc-payloads.test.mjs": 223,
+      "config/scripts/verify-localization-catalog.test.mjs": 671,
+      "config/scripts/verify-localization-extraction.test.mjs": 36,
+      "config/scripts/verify-packaged-browser-participation.test.mjs": 43,
+      "config/scripts/verify-packaged-daemon-entry.test.mjs": 135,
+      "config/scripts/verify-packaged-mobile-web-bundle.test.mjs": 439,
+      "config/scripts/verify-packaged-node-pty-job-ownership.test.mjs": 61,
+      "config/scripts/verify-packaged-orcad-template.test.mjs": 466,
+      "config/scripts/verify-packaged-plugin-resources.test.mjs": 68,
+      "config/scripts/verify-release-required-assets.test.mjs": 33,
+      "config/scripts/verify-skills-cli-runtime.test.mjs": 381,
+      "config/scripts/verify-windows-inner-signature.test.mjs": 46,
+      "config/scripts/verify-wsl-e2e-participation.test.mjs": 58,
+      "config/scripts/websocket-server-loopback-bind.test.ts": 898,
+      "config/scripts/win-crash-survival-e2e.test.mjs": 775,
+      "config/scripts/win32-test-lane-registration.test.mjs": 2421,
+      "config/scripts/windows-bin-spawn-predicate.test.mjs": 363,
+      "config/scripts/windows-cmd-shim-spawn-boundary.test.mjs": 2079,
+      "config/scripts/windows-pe-machine.test.mjs": 41,
+      "config/scripts/windows-process-tree-creation-time.test.mjs": 43,
+      "config/scripts/windows-process-tree-gyp-path.test.mjs": 47,
+      "config/scripts/windows-process-tree-gyp-rebuild.test.mjs": 104,
+      "config/scripts/windows-process-tree-patch-contract.test.mjs": 711,
+      "config/scripts/windows-pty-native-capability-workflow.test.mjs": 142,
+      "config/scripts/windows-signing-gate-toolset.test.mjs": 148,
+      "config/scripts/windows-signing-workflow-contract.test.mjs": 589,
+      "config/scripts/windows-uninstaller-signing.test.mjs": 65,
+      "config/scripts/workflow-ref-mirror-case-safety.test.mjs": 435,
+      "config/scripts/workflow-ref-reachability.test.mjs": 783,
+      "config/scripts/wsl-e2e-lane-contract.test.mjs": 208,
+      "config/scripts/xterm-image-lifecycle-contract.test.mjs": 458,
+      "config/scripts/xterm-image-memory-contract.test.mjs": 240,
+      "config/scripts/xterm-image-resize-contract.test.mjs": 69,
+      "config/scripts/xterm-webgl-runtime-contract.test.mjs": 51,
+      "config/scripts/zip-extractor-command.test.mjs": 83,
+      "src/cli/agent-context.test.ts": 56,
+      "src/cli/agent-session-search-format.test.ts": 56,
+      "src/cli/args-repeatable-flags.test.ts": 51,
+      "src/cli/args.test.ts": 259,
+      "src/cli/automation-format.test.ts": 48,
+      "src/cli/automation-owner-conflict-recovery.test.ts": 236,
+      "src/cli/base64-payload-byte-count.test.ts": 28,
+      "src/cli/browser-cookie-credentials-empty-value.test.ts": 190,
+      "src/cli/browser-storage-empty-value.test.ts": 97,
+      "src/cli/browser.test.ts": 279,
+      "src/cli/cli-command-name-parity.test.ts": 80,
+      "src/cli/cli-version.test.ts": 60,
+      "src/cli/codex-command-classification.test.ts": 44,
+      "src/cli/command-suggestion-budget.test.ts": 77,
+      "src/cli/command-suggestion.test.ts": 103,
+      "src/cli/computer-format.test.ts": 35,
+      "src/cli/emulator-logcat-format.test.ts": 41,
+      "src/cli/execution-host-flag.test.ts": 83,
+      "src/cli/flags.test.ts": 34,
+      "src/cli/format-recovery.test.ts": 275,
+      "src/cli/format.test.ts": 481,
+      "src/cli/handler-group-manifest.test.ts": 813,
+      "src/cli/handlers/account.test.ts": 957,
+      "src/cli/handlers/agent-hooks-load-boundary.test.ts": 282,
+      "src/cli/handlers/agent-hooks.test.ts": 998,
+      "src/cli/handlers/artifacts.test.ts": 201,
+      "src/cli/handlers/automation-destination-fencing.test.ts": 171,
+      "src/cli/handlers/automation-owner-fencing.test.ts": 306,
+      "src/cli/handlers/computer-action-routing.test.ts": 137,
+      "src/cli/handlers/computer-action-validation.test.ts": 204,
+      "src/cli/handlers/computer-state-formatting.test.ts": 94,
+      "src/cli/handlers/computer.test.ts": 204,
+      "src/cli/handlers/core.test.ts": 182,
+      "src/cli/handlers/emulator.test.ts": 192,
+      "src/cli/handlers/file-absolute-paths.test.ts": 94,
+      "src/cli/handlers/file.test.ts": 398,
+      "src/cli/handlers/interactive-login-interruption.test.ts": 37,
+      "src/cli/handlers/linear.test.ts": 207,
+      "src/cli/handlers/orchestration-caller-identity-cli.test.ts": 283,
+      "src/cli/handlers/orchestration-check-identity.test.ts": 294,
+      "src/cli/handlers/orchestration-federated-legacy-settlement.test.ts": 251,
+      "src/cli/handlers/orchestration-gate-cli.test.ts": 385,
+      "src/cli/handlers/orchestration-legacy-read-only.test.ts": 238,
+      "src/cli/handlers/orchestration-lifecycle-json-rejection.test.ts": 261,
+      "src/cli/handlers/orchestration-lifecycle-rejection.test.ts": 297,
+      "src/cli/handlers/orchestration-migration.test.ts": 312,
+      "src/cli/handlers/orchestration-module-boundaries.test.ts": 358,
+      "src/cli/handlers/orchestration-request-show-cli.test.ts": 293,
+      "src/cli/handlers/orchestration-run-cli.test.ts": 200,
+      "src/cli/handlers/orchestration-send-receipt-warnings.test.ts": 284,
+      "src/cli/handlers/orchestration-task-create-cli.test.ts": 201,
+      "src/cli/handlers/orchestration-task-list-brief.test.ts": 155,
+      "src/cli/handlers/orchestration-timeout-cli.test.ts": 361,
+      "src/cli/handlers/orchestration-timeout.test.ts": 280,
+      "src/cli/handlers/orchestration-windows-ask-cli.test.ts": 160,
+      "src/cli/handlers/orchestration-worker-cli.test.ts": 527,
+      "src/cli/handlers/orchestration-worker-show-wait-cli.test.ts": 214,
+      "src/cli/handlers/orchestration.test.ts": 549,
+      "src/cli/handlers/orchestration/worker-list-run-scope.test.ts": 243,
+      "src/cli/handlers/orchestration/worker-output.test.ts": 56,
+      "src/cli/handlers/profile-state-recovery-admission.test.ts": 1544,
+      "src/cli/handlers/profile-state.test.ts": 783,
+      "src/cli/handlers/search.test.ts": 251,
+      "src/cli/handlers/skill-sharing.test.ts": 232,
+      "src/cli/handlers/terminal.test.ts": 318,
+      "src/cli/host-selector-alternatives.test.ts": 46,
+      "src/cli/index-automation-identifiers.test.ts": 189,
+      "src/cli/index-automation-schedule.test.ts": 151,
+      "src/cli/index-automation-session-reuse.test.ts": 162,
+      "src/cli/index-automation-source-context.test.ts": 103,
+      "src/cli/index-automation-target.test.ts": 197,
+      "src/cli/index-device-commands.test.ts": 170,
+      "src/cli/index-environment-commands.test.ts": 139,
+      "src/cli/index-local-command-routing-flags.test.ts": 430,
+      "src/cli/index-memory-diagnostics.test.ts": 160,
+      "src/cli/index-omitted-host-scope-selectors.test.ts": 230,
+      "src/cli/index-orchestration.test.ts": 201,
+      "src/cli/index-project-setup.test.ts": 143,
+      "src/cli/index-serve-command.test.ts": 193,
+      "src/cli/index-terminal-commands.test.ts": 344,
+      "src/cli/index-terminal-list-host-scope.test.ts": 161,
+      "src/cli/index-vm-recipe-doctor.test.ts": 408,
+      "src/cli/index-worktree-create-agent.test.ts": 143,
+      "src/cli/index-worktree-create-linear.test.ts": 94,
+      "src/cli/index-worktree-create-parent.test.ts": 386,
+      "src/cli/index-worktree-create-target.test.ts": 98,
+      "src/cli/index-worktree-selector-resolution.test.ts": 352,
+      "src/cli/index-worktree-set.test.ts": 184,
+      "src/cli/index.test.ts": 981,
+      "src/cli/linear-format.test.ts": 47,
+      "src/cli/orchestration-dispatch-refusal-format.test.ts": 75,
+      "src/cli/orchestration-mutation-recovery.test.ts": 212,
+      "src/cli/orchestration-structured-sender-identity.test.ts": 137,
+      "src/cli/orchestration-structured-session-no-identity.test.ts": 389,
+      "src/cli/quote-stripped-json-flag.test.ts": 29,
+      "src/cli/registry-parity.test.ts": 78,
+      "src/cli/retry-request-flag.test.ts": 367,
+      "src/cli/runtime-client-deferral.test.ts": 715,
+      "src/cli/runtime-client.test.ts": 424,
+      "src/cli/runtime/client-recovery.test.ts": 463,
+      "src/cli/runtime/client-timeout-policy.test.ts": 250,
+      "src/cli/runtime/envelope-schema.test.ts": 87,
+      "src/cli/runtime/environments.test.ts": 217,
+      "src/cli/runtime/launch.test.ts": 181,
+      "src/cli/runtime/orchestration-recovery-command.test.ts": 60,
+      "src/cli/runtime/profile-state-recovery-launch.test.ts": 185,
+      "src/cli/runtime/runtime-access-denied.test.ts": 122,
+      "src/cli/runtime/serve-signal-exit-diagnostic.test.ts": 66,
+      "src/cli/runtime/status.test.ts": 233,
+      "src/cli/runtime/transport-framing.test.ts": 222,
+      "src/cli/runtime/transport.test.ts": 656,
+      "src/cli/runtime/types.test.ts": 38,
+      "src/cli/runtime/websocket-transport-error.test.ts": 243,
+      "src/cli/runtime/websocket-transport.test.ts": 355,
+      "src/cli/search-command-arguments.test.ts": 275,
+      "src/cli/serve-electron-flag-parity.test.ts": 58,
+      "src/cli/shell-command-quote.test.ts": 38,
+      "src/cli/skill-guide-cli-parity.test.ts": 106,
+      "src/cli/skills-reference-selector.test.ts": 194,
+      "src/cli/skills.test.ts": 1332,
+      "src/cli/specs/account.test.ts": 50,
+      "src/cli/specs/bundled-guide-flags.test.ts": 262,
+      "src/cli/specs/computer.test.ts": 44,
+      "src/cli/specs/orchestration.test.ts": 33,
+      "src/cli/specs/profile-state.test.ts": 43,
+      "src/cli/specs/search.test.ts": 121,
+      "src/cli/specs/skills.test.ts": 50,
+      "src/cli/terminal-format-draft.test.ts": 50,
+      "src/cli/terminal-format.test.ts": 44,
+      "src/cli/terminal-list-host-scope-format.test.ts": 71,
+      "src/cli/terminal-read-screen.test.ts": 126,
+      "src/cli/vocabulary-policy.test.ts": 67,
+      "src/cli/worktree-selector-wsl-posix-path.test.ts": 49,
+      "src/main/active-view-persistence-boundary.test.ts": 783,
+      "src/main/active-view-preference-sync-flush-veto.test.ts": 788,
+      "src/main/active-view-preference.test.ts": 64,
+      "src/main/agent-auth-restart-preservation.test.ts": 71,
+      "src/main/agent-awake-service-platform-assertions.test.ts": 99,
+      "src/main/agent-awake-service.test.ts": 106,
+      "src/main/agent-hooks/branch-rename-failure-output.test.ts": 26,
+      "src/main/agent-hooks/ended-process-reconciliation.test.ts": 510,
+      "src/main/agent-hooks/first-work-branch-rename.test.ts": 365,
+      "src/main/agent-hooks/first-work-folder-rename.test.ts": 87,
+      "src/main/agent-hooks/grok-replay-guard.test.ts": 101,
+      "src/main/agent-hooks/hook-script-outside-orca.test.ts": 210,
+      "src/main/agent-hooks/hook-status-session-tabs-republish.test.ts": 578,
+      "src/main/agent-hooks/install-telemetry.test.ts": 58,
+      "src/main/agent-hooks/installer-utils-remote.test.ts": 66,
+      "src/main/agent-hooks/installer-utils.test.ts": 180,
+      "src/main/agent-hooks/local-agent-cli-presence.test.ts": 76,
+      "src/main/agent-hooks/managed-agent-hook-controls.test.ts": 261,
+      "src/main/agent-hooks/managed-hook-command-contract.test.ts": 309,
+      "src/main/agent-hooks/managed-hook-detection-commands.test.ts": 64,
+      "src/main/agent-hooks/managed-hook-install-lock.test.ts": 388,
+      "src/main/agent-hooks/managed-hook-local-filesystem.test.ts": 327,
+      "src/main/agent-hooks/managed-hook-owner-identity.test.ts": 84,
+      "src/main/agent-hooks/managed-hook-runtime.test.ts": 409,
+      "src/main/agent-hooks/managed-hook-script-refresh-main-thread.test.ts": 330,
+      "src/main/agent-hooks/managed-hook-script-refresh.test.ts": 471,
+      "src/main/agent-hooks/managed-hook-stdin-lifecycle.test.ts": 2177,
+      "src/main/agent-hooks/managed-hook-timeout.test.ts": 1803,
+      "src/main/agent-hooks/managed-toml-ownership.test.ts": 50,
+      "src/main/agent-hooks/manual-compact-hook-stream.test.ts": 582,
+      "src/main/agent-hooks/manual-compact-status-cleanup.test.ts": 553,
+      "src/main/agent-hooks/migration-unsupported-pty-state.test.ts": 31,
+      "src/main/agent-hooks/opencode-message-part-flood-bench.test.ts": 1229,
+      "src/main/agent-hooks/posix-hook-json-stdin-reader.test.ts": 3494,
+      "src/main/agent-hooks/remote-hook-service-installers.test.ts": 367,
+      "src/main/agent-hooks/remote-hook-service-registry-coverage.test.ts": 238,
+      "src/main/agent-hooks/restored-subagent-liveness-sweep.test.ts": 930,
+      "src/main/agent-hooks/server-ai-vault-liveness.test.ts": 606,
+      "src/main/agent-hooks/server-amp-normalization.test.ts": 570,
+      "src/main/agent-hooks/server-authority-evidence.test.ts": 639,
+      "src/main/agent-hooks/server-claude-cancel-captures.test.ts": 856,
+      "src/main/agent-hooks/server-claude-child-permission-lifecycle.test.ts": 508,
+      "src/main/agent-hooks/server-claude-normalization.test.ts": 497,
+      "src/main/agent-hooks/server-claude-permission-visibility.test.ts": 836,
+      "src/main/agent-hooks/server-claude-statusline.test.ts": 592,
+      "src/main/agent-hooks/server-closed-tab-suppression.test.ts": 614,
+      "src/main/agent-hooks/server-codex-normalization.test.ts": 575,
+      "src/main/agent-hooks/server-codex-subagent-transcript.test.ts": 4597,
+      "src/main/agent-hooks/server-copilot-normalization.test.ts": 1055,
+      "src/main/agent-hooks/server-cursor-normalization.test.ts": 550,
+      "src/main/agent-hooks/server-droid-normalization.test.ts": 592,
+      "src/main/agent-hooks/server-endpoint-file-lifecycle.test.ts": 568,
+      "src/main/agent-hooks/server-escape-navigation-inference.test.ts": 739,
+      "src/main/agent-hooks/server-gemini-normalization.test.ts": 565,
+      "src/main/agent-hooks/server-grok-background-status.test.ts": 760,
+      "src/main/agent-hooks/server-grok-cancel.test.ts": 610,
+      "src/main/agent-hooks/server-grok-discovery.test.ts": 1077,
+      "src/main/agent-hooks/server-hook-http-ingest.test.ts": 388,
+      "src/main/agent-hooks/server-ingest-remote.test.ts": 449,
+      "src/main/agent-hooks/server-ingest-structured-children.test.ts": 590,
+      "src/main/agent-hooks/server-ingest-structured-state-clock.test.ts": 630,
+      "src/main/agent-hooks/server-ingest-structured-status.test.ts": 585,
+      "src/main/agent-hooks/server-ingest-terminal-status.test.ts": 382,
+      "src/main/agent-hooks/server-interrupt-inference-guards.test.ts": 693,
+      "src/main/agent-hooks/server-interrupt-inference-resurrection.test.ts": 646,
+      "src/main/agent-hooks/server-interrupt-inference-validation.test.ts": 419,
+      "src/main/agent-hooks/server-last-status-child-held-main-agent.test.ts": 713,
+      "src/main/agent-hooks/server-last-status-hydrate-confirmation.test.ts": 389,
+      "src/main/agent-hooks/server-last-status-hydrate-validation.test.ts": 488,
+      "src/main/agent-hooks/server-last-status-lead-boundary.test.ts": 647,
+      "src/main/agent-hooks/server-last-status-main-agent-fact.test.ts": 584,
+      "src/main/agent-hooks/server-last-status-restored-children.test.ts": 766,
+      "src/main/agent-hooks/server-last-status-write.test.ts": 699,
+      "src/main/agent-hooks/server-main-agent-turn-verdicts.test.ts": 702,
+      "src/main/agent-hooks/server-muse-session-log-poll.test.ts": 2487,
+      "src/main/agent-hooks/server-observation-provenance.test.ts": 625,
+      "src/main/agent-hooks/server-omp-retired-ingress.test.ts": 610,
+      "src/main/agent-hooks/server-omp-retirement-ack.test.ts": 557,
+      "src/main/agent-hooks/server-opencode-binder.test.ts": 652,
+      "src/main/agent-hooks/server-opencode-lifecycle.test.ts": 765,
+      "src/main/agent-hooks/server-opencode-normalization.test.ts": 380,
+      "src/main/agent-hooks/server-pane-authority.test.ts": 655,
+      "src/main/agent-hooks/server-pi-normalization.test.ts": 557,
+      "src/main/agent-hooks/server-prompt-sent-telemetry.test.ts": 643,
+      "src/main/agent-hooks/server-relay-listener-replay.test.ts": 551,
+      "src/main/agent-hooks/server-relayed-claude-cancel.test.ts": 678,
+      "src/main/agent-hooks/server-reminted-pane-key.test.ts": 672,
+      "src/main/agent-hooks/server-replay-evidence-clock.test.ts": 552,
+      "src/main/agent-hooks/server-retired-pane-new-turn.test.ts": 383,
+      "src/main/agent-hooks/server-start-failure-lifecycle.test.ts": 597,
+      "src/main/agent-hooks/server-status-listener-fanout.test.ts": 739,
+      "src/main/agent-hooks/server-structured-canonical-status.test.ts": 408,
+      "src/main/agent-hooks/server-transport-interference.test.ts": 6270,
+      "src/main/agent-hooks/server.claude-interactive-question.test.ts": 396,
+      "src/main/agent-hooks/spool.test.ts": 891,
+      "src/main/agent-hooks/terminal-handle-row-identity.test.ts": 367,
+      "src/main/agent-hooks/windows-direct-cmd-hook-command.test.ts": 69,
+      "src/main/agent-hooks/windows-hook-payload-delivery.test.ts": 151,
+      "src/main/agent-hooks/windows-hook-post-interpreter.test.ts": 330,
+      "src/main/agent-hooks/windows-powershell-hook-launcher.test.ts": 49,
+      "src/main/agent-hooks/wsl-guest-plugin-install.test.ts": 68,
+      "src/main/agent-hooks/wsl-hook-relay-launch.test.ts": 90,
+      "src/main/agent-hooks/wsl-hook-relay-live.integration.test.ts": 4381,
+      "src/main/agent-hooks/wsl-hook-relay-manager.test.ts": 1974,
+      "src/main/agent-hooks/wsl-hook-relay-reattach.test.ts": 713,
+      "src/main/agent-hooks/wsl-hook-relay-recovery.test.ts": 2365,
+      "src/main/agent-hooks/wsl-hook-relay-sentinel.test.ts": 37,
+      "src/main/agent-launch/agent-launch-executor.test.ts": 330,
+      "src/main/agent-state-file-reader.test.ts": 97,
+      "src/main/agent-trust-presets.test.ts": 137,
+      "src/main/ai-vault-search/session-search-child-service.test.ts": 338,
+      "src/main/ai-vault-search/session-search-content-hash.test.ts": 71,
+      "src/main/ai-vault-search/session-search-cwd-key.test.ts": 78,
+      "src/main/ai-vault-search/session-search-deleted-sources.test.ts": 377,
+      "src/main/ai-vault-search/session-search-directory-listings.test.ts": 50,
+      "src/main/ai-vault-search/session-search-engine.test.ts": 3299,
+      "src/main/ai-vault-search/session-search-file-id.test.ts": 211,
+      "src/main/ai-vault-search/session-search-file-write.test.ts": 622,
+      "src/main/ai-vault-search/session-search-fts5-contract.test.ts": 144,
+      "src/main/ai-vault-search/session-search-hit-ranking.test.ts": 90,
+      "src/main/ai-vault-search/session-search-host-registration.test.ts": 993,
+      "src/main/ai-vault-search/session-search-identifier-split.test.ts": 39,
+      "src/main/ai-vault-search/session-search-index-consumer.test.ts": 255,
+      "src/main/ai-vault-search/session-search-index-generation.test.ts": 579,
+      "src/main/ai-vault-search/session-search-index-pass.test.ts": 419,
+      "src/main/ai-vault-search/session-search-index-writer.test.ts": 480,
+      "src/main/ai-vault-search/session-search-indexer.test.ts": 4288,
+      "src/main/ai-vault-search/session-search-instance.test.ts": 869,
+      "src/main/ai-vault-search/session-search-lifecycle-matrix.test.ts": 3013,
+      "src/main/ai-vault-search/session-search-live-transcript.test.ts": 289,
+      "src/main/ai-vault-search/session-search-merged-roots.test.ts": 409,
+      "src/main/ai-vault-search/session-search-message-rows.test.ts": 420,
+      "src/main/ai-vault-search/session-search-native-chat-indexing.test.ts": 332,
+      "src/main/ai-vault-search/session-search-opencode-index.test.ts": 955,
+      "src/main/ai-vault-search/session-search-orphan-rows.test.ts": 302,
+      "src/main/ai-vault-search/session-search-paging.test.ts": 540,
+      "src/main/ai-vault-search/session-search-query-planner.test.ts": 29,
+      "src/main/ai-vault-search/session-search-read-decision.test.ts": 55,
+      "src/main/ai-vault-search/session-search-retention-delete.test.ts": 171,
+      "src/main/ai-vault-search/session-search-retention-policy.test.ts": 76,
+      "src/main/ai-vault-search/session-search-root-refresh.test.ts": 503,
+      "src/main/ai-vault-search/session-search-row-filter.test.ts": 190,
+      "src/main/ai-vault-search/session-search-row-identity.test.ts": 105,
+      "src/main/ai-vault-search/session-search-scan-roots.test.ts": 195,
+      "src/main/ai-vault-search/session-search-schema.test.ts": 458,
+      "src/main/ai-vault-search/session-search-scope-entry-points.test.ts": 3912,
+      "src/main/ai-vault-search/session-search-scope-resolution.test.ts": 121,
+      "src/main/ai-vault-search/session-search-scope-service.test.ts": 179,
+      "src/main/ai-vault-search/session-search-service-registry.test.ts": 217,
+      "src/main/ai-vault-search/session-search-service.test.ts": 197,
+      "src/main/ai-vault-search/session-search-sidebar-parity.test.ts": 288,
+      "src/main/ai-vault-search/session-search-snippet-marks.test.ts": 213,
+      "src/main/ai-vault-search/session-search-store-is-memory.test.ts": 604,
+      "src/main/ai-vault-search/session-search-store-scope-catalog.test.ts": 40,
+      "src/main/ai-vault-search/session-search-synthetic-corpus.test.ts": 252,
+      "src/main/ai-vault-search/session-search-typo-policy.test.ts": 148,
+      "src/main/ai-vault-search/session-search-typo-scope.test.ts": 162,
+      "src/main/ai-vault-search/session-search-write-lifetime.test.ts": 246,
+      "src/main/ai-vault/ai-vault-scan-cancellation.test.ts": 49,
+      "src/main/ai-vault/ai-vault-scan-coordinator.test.ts": 81,
+      "src/main/ai-vault/cached-session-list-wsl-probe.test.ts": 209,
+      "src/main/ai-vault/cached-session-list.test.ts": 447,
+      "src/main/ai-vault/claude-project-dir-encoding.test.ts": 28,
+      "src/main/ai-vault/codex-session-collection.test.ts": 127,
+      "src/main/ai-vault/codex-session-root-dedup.test.ts": 116,
+      "src/main/ai-vault/local-log-tail-reader.test.ts": 35,
+      "src/main/ai-vault/omp-session-root.test.ts": 159,
+      "src/main/ai-vault/opencode-wsl-runtime-preparation.test.ts": 917,
+      "src/main/ai-vault/remote-session-content-lines.test.ts": 74,
+      "src/main/ai-vault/remote-session-large-transcripts.test.ts": 2163,
+      "src/main/ai-vault/remote-session-parse-cache.test.ts": 229,
+      "src/main/ai-vault/remote-session-scan-batching.test.ts": 32,
+      "src/main/ai-vault/remote-session-scanner-muse.test.ts": 167,
+      "src/main/ai-vault/remote-session-scanner-omp-subagents.test.ts": 172,
+      "src/main/ai-vault/remote-session-scanner-opencode.test.ts": 238,
+      "src/main/ai-vault/remote-session-scanner-sources.test.ts": 118,
+      "src/main/ai-vault/remote-session-scanner.test.ts": 289,
+      "src/main/ai-vault/remote-session-sidecar-observation.test.ts": 134,
+      "src/main/ai-vault/remote-session-stream-lifecycle.test.ts": 74,
+      "src/main/ai-vault/runtime-session-scanner.test.ts": 87,
+      "src/main/ai-vault/runtime-session-search-call.test.ts": 57,
+      "src/main/ai-vault/session-cwd-bucket-layouts.test.ts": 26,
+      "src/main/ai-vault/session-delete-target.test.ts": 112,
+      "src/main/ai-vault/session-delete.test.ts": 215,
+      "src/main/ai-vault/session-document-stream-boundaries.test.ts": 140,
+      "src/main/ai-vault/session-document-stream-parity.test.ts": 115,
+      "src/main/ai-vault/session-document-stream-projection.test.ts": 100,
+      "src/main/ai-vault/session-first-user-prompt-opencode.test.ts": 155,
+      "src/main/ai-vault/session-first-user-prompt-read.test.ts": 110,
+      "src/main/ai-vault/session-list-result-validation.test.ts": 155,
+      "src/main/ai-vault/session-list-results.test.ts": 90,
+      "src/main/ai-vault/session-newest-files.test.ts": 126,
+      "src/main/ai-vault/session-parse-cache-devin-upgrade.test.ts": 214,
+      "src/main/ai-vault/session-parse-cache-persistence.test.ts": 568,
+      "src/main/ai-vault/session-scan-cutoff.test.ts": 68,
+      "src/main/ai-vault/session-scanner-agent-root-overrides.test.ts": 1121,
+      "src/main/ai-vault/session-scanner-antigravity-parser.test.ts": 72,
+      "src/main/ai-vault/session-scanner-antigravity-source.test.ts": 330,
+      "src/main/ai-vault/session-scanner-background.test.ts": 354,
+      "src/main/ai-vault/session-scanner-claude-cwd-drift.test.ts": 245,
+      "src/main/ai-vault/session-scanner-claude-subagent-prune.test.ts": 170,
+      "src/main/ai-vault/session-scanner-claude-subagents.test.ts": 137,
+      "src/main/ai-vault/session-scanner-claude-title.test.ts": 235,
+      "src/main/ai-vault/session-scanner-claude-unicode-scope.test.ts": 176,
+      "src/main/ai-vault/session-scanner-cline-parser.test.ts": 247,
+      "src/main/ai-vault/session-scanner-codex-dual-root.test.ts": 317,
+      "src/main/ai-vault/session-scanner-codex-fast-path.test.ts": 404,
+      "src/main/ai-vault/session-scanner-codex-non-user-origin.test.ts": 41,
+      "src/main/ai-vault/session-scanner-codex-parser.test.ts": 127,
+      "src/main/ai-vault/session-scanner-codex-title-index.test.ts": 213,
+      "src/main/ai-vault/session-scanner-codex-tool-records.test.ts": 75,
+      "src/main/ai-vault/session-scanner-codex-workers.test.ts": 273,
+      "src/main/ai-vault/session-scanner-core-parser-wsl-stall.test.ts": 204,
+      "src/main/ai-vault/session-scanner-cursor-chat-meta.test.ts": 493,
+      "src/main/ai-vault/session-scanner-cutoff.test.ts": 340,
+      "src/main/ai-vault/session-scanner-dedup-batches.test.ts": 320,
+      "src/main/ai-vault/session-scanner-devin-contention.test.ts": 265,
+      "src/main/ai-vault/session-scanner-devin-db.test.ts": 385,
+      "src/main/ai-vault/session-scanner-devin-dedup.test.ts": 305,
+      "src/main/ai-vault/session-scanner-devin-parser.test.ts": 115,
+      "src/main/ai-vault/session-scanner-directory-reader.test.ts": 66,
+      "src/main/ai-vault/session-scanner-discovery-wsl-gate.test.ts": 101,
+      "src/main/ai-vault/session-scanner-first-user-prompt.test.ts": 60,
+      "src/main/ai-vault/session-scanner-fs-import-guard.test.ts": 109,
+      "src/main/ai-vault/session-scanner-graph-parsers.test.ts": 223,
+      "src/main/ai-vault/session-scanner-grok-parser.test.ts": 111,
+      "src/main/ai-vault/session-scanner-grok-user-text.test.ts": 47,
+      "src/main/ai-vault/session-scanner-index-cache-wsl-stall.test.ts": 73,
+      "src/main/ai-vault/session-scanner-injected-title.test.ts": 265,
+      "src/main/ai-vault/session-scanner-jsonl-reader.test.ts": 355,
+      "src/main/ai-vault/session-scanner-kimi-index-cache.test.ts": 103,
+      "src/main/ai-vault/session-scanner-kimi-parser.test.ts": 152,
+      "src/main/ai-vault/session-scanner-muse.test.ts": 250,
+      "src/main/ai-vault/session-scanner-omp-subagent-listing.test.ts": 94,
+      "src/main/ai-vault/session-scanner-omp-subagent-prune.test.ts": 234,
+      "src/main/ai-vault/session-scanner-omp-subagent-transcripts.test.ts": 91,
+      "src/main/ai-vault/session-scanner-omp-title.test.ts": 105,
+      "src/main/ai-vault/session-scanner-opencode-cancellation.test.ts": 393,
+      "src/main/ai-vault/session-scanner-opencode-parser.test.ts": 112,
+      "src/main/ai-vault/session-scanner-opencode-process-admission.test.ts": 264,
+      "src/main/ai-vault/session-scanner-opencode-sources-wsl-stall.test.ts": 103,
+      "src/main/ai-vault/session-scanner-opencode-sources.test.ts": 65,
+      "src/main/ai-vault/session-scanner-opencode-sqlite-bounds.test.ts": 656,
+      "src/main/ai-vault/session-scanner-opencode-sqlite-coexistence.test.ts": 373,
+      "src/main/ai-vault/session-scanner-opencode-sqlite-open.test.ts": 3466,
+      "src/main/ai-vault/session-scanner-opencode-sqlite-paths.test.ts": 35,
+      "src/main/ai-vault/session-scanner-opencode-sqlite-process.test.ts": 3607,
+      "src/main/ai-vault/session-scanner-opencode-sqlite-worker-client.test.ts": 87,
+      "src/main/ai-vault/session-scanner-opencode-sqlite-worker-spawn.test.ts": 103,
+      "src/main/ai-vault/session-scanner-opencode-sqlite.test.ts": 207,
+      "src/main/ai-vault/session-scanner-opencode-wsl-client.test.ts": 80,
+      "src/main/ai-vault/session-scanner-opencode-wsl-routing.test.ts": 129,
+      "src/main/ai-vault/session-scanner-opencode2-message.test.ts": 47,
+      "src/main/ai-vault/session-scanner-opencode2-sqlite.test.ts": 139,
+      "src/main/ai-vault/session-scanner-parse-cache-agents.test.ts": 663,
+      "src/main/ai-vault/session-scanner-parse-cache.test.ts": 294,
+      "src/main/ai-vault/session-scanner-parse-wsl-stall.test.ts": 230,
+      "src/main/ai-vault/session-scanner-parser-stream-cleanup.test.ts": 115,
+      "src/main/ai-vault/session-scanner-pi-scope.test.ts": 310,
+      "src/main/ai-vault/session-scanner-preview-window-truncation.test.ts": 55,
+      "src/main/ai-vault/session-scanner-record-budget.test.ts": 443,
+      "src/main/ai-vault/session-scanner-recoverable-empty.test.ts": 316,
+      "src/main/ai-vault/session-scanner-roots.test.ts": 79,
+      "src/main/ai-vault/session-scanner-scope.test.ts": 200,
+      "src/main/ai-vault/session-scanner-service-cancellation.test.ts": 203,
+      "src/main/ai-vault/session-scanner-service-client.test.ts": 502,
+      "src/main/ai-vault/session-scanner-service-entry-path.test.ts": 43,
+      "src/main/ai-vault/session-scanner-service-entry.test.ts": 541,
+      "src/main/ai-vault/session-scanner-service-env.test.ts": 63,
+      "src/main/ai-vault/session-scanner-service-restart-policy.test.ts": 47,
+      "src/main/ai-vault/session-scanner-service-root-request.test.ts": 31,
+      "src/main/ai-vault/session-scanner-service-root-response.test.ts": 228,
+      "src/main/ai-vault/session-scanner-service-search-roots.test.ts": 577,
+      "src/main/ai-vault/session-scanner-service-search.test.ts": 1214,
+      "src/main/ai-vault/session-scanner-service-spawn.test.ts": 435,
+      "src/main/ai-vault/session-scanner-timeline.test.ts": 75,
+      "src/main/ai-vault/session-scanner-unlimited-dedup.test.ts": 3562,
+      "src/main/ai-vault/session-scanner-values.test.ts": 92,
+      "src/main/ai-vault/session-scanner-worker-client.test.ts": 48,
+      "src/main/ai-vault/session-scanner.test.ts": 343,
+      "src/main/ai-vault/session-sidecar-stat.test.ts": 25,
+      "src/main/ai-vault/session-title-file-reader-wsl-stall.test.ts": 173,
+      "src/main/ai-vault/session-title-file-reader.test.ts": 130,
+      "src/main/ai-vault/session-transcript-consumers.test.ts": 384,
+      "src/main/ai-vault/session-transcript-every-agent-capture.test.ts": 551,
+      "src/main/ai-vault/session-transcript-message-content.test.ts": 48,
+      "src/main/ai-vault/session-transcript-record-budget.test.ts": 63,
+      "src/main/ai-vault/ssh-session-list.test.ts": 288,
+      "src/main/ai-vault/structured-session-ownership.test.ts": 106,
+      "src/main/amp/hook-service.test.ts": 83,
+      "src/main/antigravity/hook-service.test.ts": 144,
+      "src/main/antigravity/windows-hook-payload-delivery.test.ts": 84,
+      "src/main/app-icon.test.ts": 79,
+      "src/main/app-relaunch.test.ts": 60,
+      "src/main/appimage-runtime-identity.test.ts": 91,
+      "src/main/appkit-scene-mutation.test.ts": 28,
+      "src/main/artifacts/artifact-cloud-config.test.ts": 54,
+      "src/main/artifacts/artifact-cloud-recovery.test.ts": 477,
+      "src/main/artifacts/artifact-cloud-service-races.test.ts": 642,
+      "src/main/artifacts/artifact-cloud-service.test.ts": 1148,
+      "src/main/artifacts/artifact-create-intent-store.test.ts": 411,
+      "src/main/artifacts/artifact-recovery-directory-fsync.test.ts": 76,
+      "src/main/artifacts/artifact-share-record-allocation.test.ts": 181,
+      "src/main/artifacts/artifact-share-record-store.test.ts": 300,
+      "src/main/asar-transparent-fs.test.ts": 58,
+      "src/main/automations/automation-dispatch-host-fence.test.ts": 5212,
+      "src/main/automations/automation-owner-fencing.test.ts": 3123,
+      "src/main/automations/automation-owner-migration.test.ts": 64,
+      "src/main/automations/automation-run-terminal-surface.test.ts": 3148,
+      "src/main/automations/automation-run-writer.test.ts": 190,
+      "src/main/automations/automation-skip-coalescing.test.ts": 5292,
+      "src/main/automations/automation-ssh-readoption-migration.test.ts": 63,
+      "src/main/automations/automation-update-host-retarget.test.ts": 2563,
+      "src/main/automations/automation-worker-durability.test.ts": 4821,
+      "src/main/automations/automation-workspace-host-attribution.test.ts": 4398,
+      "src/main/automations/automation-zero-grace-tick-latency.test.ts": 4426,
+      "src/main/automations/dispatch-refusal.test.ts": 64,
+      "src/main/automations/dispatch-tokens.test.ts": 62,
+      "src/main/automations/external-automation-manager-cache.test.ts": 111,
+      "src/main/automations/external-automation-owner-guard.test.ts": 73,
+      "src/main/automations/external-automation-probe-scheduler.test.ts": 150,
+      "src/main/automations/external-job-run-sorting.test.ts": 136,
+      "src/main/automations/external-manager-scoped.test.ts": 90,
+      "src/main/automations/external-manager.test.ts": 157,
+      "src/main/automations/headless-dispatch-durability.test.ts": 348,
+      "src/main/automations/headless-workspace-create.test.ts": 55,
+      "src/main/automations/hermes-cron-output.test.ts": 196,
+      "src/main/automations/precheck-runner.test.ts": 1128,
+      "src/main/automations/refused-manual-run.test.ts": 3358,
+      "src/main/automations/retained-run-reconciliation.test.ts": 4350,
+      "src/main/automations/run-completion-watcher.test.ts": 4513,
+      "src/main/automations/run-target-resolution.test.ts": 51,
+      "src/main/automations/runtime-terminal-run-observer.test.ts": 51,
+      "src/main/automations/schedule-drift-report.test.ts": 62,
+      "src/main/automations/service-precheck.test.ts": 1864,
+      "src/main/automations/service.test.ts": 10184,
+      "src/main/azure-devops/azure-devops-api-request.test.ts": 93,
+      "src/main/azure-devops/client.test.ts": 232,
+      "src/main/azure-devops/pull-request-creation.test.ts": 167,
+      "src/main/azure-devops/pull-request-mappers.test.ts": 39,
+      "src/main/azure-devops/repository-ref.test.ts": 57,
+      "src/main/bitbucket/client.test.ts": 248,
+      "src/main/bitbucket/credential-connection.test.ts": 186,
+      "src/main/bitbucket/credential-store.test.ts": 147,
+      "src/main/bitbucket/pull-request-creation.test.ts": 163,
+      "src/main/bitbucket/pull-request-mappers.test.ts": 43,
+      "src/main/bitbucket/repository-ref.test.ts": 47,
+      "src/main/bitbucket/status-no-decrypt.test.ts": 188,
+      "src/main/browser/agent-browser-bridge-capture-paint-hold.test.ts": 263,
+      "src/main/browser/agent-browser-bridge-command-transport.test.ts": 550,
+      "src/main/browser/agent-browser-bridge-keypress-input.test.ts": 246,
+      "src/main/browser/agent-browser-bridge-mouse-input.test.ts": 323,
+      "src/main/browser/agent-browser-bridge-navigation.test.ts": 484,
+      "src/main/browser/agent-browser-bridge-pointer-input.test.ts": 342,
+      "src/main/browser/agent-browser-bridge-session-lifecycle.test.ts": 608,
+      "src/main/browser/agent-browser-bridge-tab-routing.test.ts": 501,
+      "src/main/browser/agent-browser-bridge-text-input.test.ts": 609,
+      "src/main/browser/agent-browser-orphan-sweep.test.ts": 63,
+      "src/main/browser/agent-browser-process-environment.test.ts": 55,
+      "src/main/browser/agent-browser-session-reset.test.ts": 66,
+      "src/main/browser/browser-certificate-trust-controller.test.ts": 382,
+      "src/main/browser/browser-clicked-link-routing.test.ts": 565,
+      "src/main/browser/browser-client-download-relay.test.ts": 168,
+      "src/main/browser/browser-client-download-routing.test.ts": 185,
+      "src/main/browser/browser-client-file-channel-negotiation.test.ts": 185,
+      "src/main/browser/browser-client-file-channel-reconnect.test.ts": 486,
+      "src/main/browser/browser-client-host-attach-request.test.ts": 153,
+      "src/main/browser/browser-client-host-authority-replacement.test.ts": 138,
+      "src/main/browser/browser-client-host-command-dispatcher.test.ts": 154,
+      "src/main/browser/browser-client-host-command-retention.test.ts": 436,
+      "src/main/browser/browser-client-host-id.test.ts": 85,
+      "src/main/browser/browser-client-host-placement-preparation.test.ts": 93,
+      "src/main/browser/browser-client-host-published-url-wiring.test.ts": 592,
+      "src/main/browser/browser-client-host-reconciliation-command-order.test.ts": 214,
+      "src/main/browser/browser-client-network-route-registry.test.ts": 118,
+      "src/main/browser/browser-client-page-automation-runtime.test.ts": 52,
+      "src/main/browser/browser-client-page-command-executor-fencing.test.ts": 284,
+      "src/main/browser/browser-client-page-command-executor.test.ts": 216,
+      "src/main/browser/browser-client-page-command-integration.test.ts": 231,
+      "src/main/browser/browser-client-page-execution-host-supersession.test.ts": 203,
+      "src/main/browser/browser-client-page-inventory.test.ts": 212,
+      "src/main/browser/browser-client-page-metadata-transport.test.ts": 147,
+      "src/main/browser/browser-client-page-published-url.test.ts": 118,
+      "src/main/browser/browser-client-page-reconciliation-adapters.test.ts": 239,
+      "src/main/browser/browser-client-page-renderer-bridge.test.ts": 109,
+      "src/main/browser/browser-client-page-renderer-lifecycle.electron.test.ts": 843,
+      "src/main/browser/browser-client-page-renderer-runtime.test.ts": 161,
+      "src/main/browser/browser-client-page-unavailability.test.ts": 212,
+      "src/main/browser/browser-client-page-upload-routing.test.ts": 273,
+      "src/main/browser/browser-client-route-cookie-import-partition-parity.test.ts": 220,
+      "src/main/browser/browser-client-route-cookie-import.test.ts": 68,
+      "src/main/browser/browser-client-upload-command.test.ts": 139,
+      "src/main/browser/browser-client-upload-staging.test.ts": 346,
+      "src/main/browser/browser-client-upload-transfer.test.ts": 7621,
+      "src/main/browser/browser-cookie-clear-preserve.test.ts": 125,
+      "src/main/browser/browser-cookie-clear-store-lifecycle.test.ts": 89,
+      "src/main/browser/browser-cookie-clear-store.test.ts": 68,
+      "src/main/browser/browser-cookie-decryption.test.ts": 74,
+      "src/main/browser/browser-cookie-import-app-bound-prefix.test.ts": 400,
+      "src/main/browser/browser-cookie-import-clear-atomicity.test.ts": 71,
+      "src/main/browser/browser-cookie-import-concurrency.test.ts": 490,
+      "src/main/browser/browser-cookie-import-google-exclusion.test.ts": 358,
+      "src/main/browser/browser-cookie-import-partition-fidelity.test.ts": 482,
+      "src/main/browser/browser-cookie-import-partition-reland.electron.test.ts": 2260,
+      "src/main/browser/browser-cookie-import-partition-rollback.electron.test.ts": 675,
+      "src/main/browser/browser-cookie-import-partition-success.electron.test.ts": 893,
+      "src/main/browser/browser-cookie-import-partition.electron.test.ts": 814,
+      "src/main/browser/browser-cookie-import-plan-writes.test.ts": 74,
+      "src/main/browser/browser-cookie-import-policy.test.ts": 248,
+      "src/main/browser/browser-cookie-import-replace-partition-rollback.electron.test.ts": 1224,
+      "src/main/browser/browser-cookie-import-replacement.test.ts": 204,
+      "src/main/browser/browser-cookie-import-route-partition-staging.test.ts": 314,
+      "src/main/browser/browser-cookie-import-scope.test.ts": 285,
+      "src/main/browser/browser-cookie-import-undecryptable.test.ts": 443,
+      "src/main/browser/browser-cookie-import-validated-partition.electron.test.ts": 1035,
+      "src/main/browser/browser-cookie-import-write.test.ts": 38,
+      "src/main/browser/browser-cookie-import.comet.test.ts": 737,
+      "src/main/browser/browser-cookie-import.helium.test.ts": 567,
+      "src/main/browser/browser-cookie-import.test.ts": 3476,
+      "src/main/browser/browser-cookie-public-suffix-scope.test.ts": 42,
+      "src/main/browser/browser-cookie-registrable-family.test.ts": 57,
+      "src/main/browser/browser-cookie-samesite.electron.test.ts": 898,
+      "src/main/browser/browser-cookie-source-partition.test.ts": 42,
+      "src/main/browser/browser-cookie-validation.test.ts": 40,
+      "src/main/browser/browser-download-destination.test.ts": 55,
+      "src/main/browser/browser-execution-host-storage-identity.test.ts": 146,
+      "src/main/browser/browser-google-auth-ua.test.ts": 32,
+      "src/main/browser/browser-grab-payload.test.ts": 39,
+      "src/main/browser/browser-guest-shortcut-forwarding.test.ts": 333,
+      "src/main/browser/browser-guest-wheel-zoom-scroll.test.ts": 34,
+      "src/main/browser/browser-host-client-identity.test.ts": 97,
+      "src/main/browser/browser-host-lease-reconnect-delay.test.ts": 34,
+      "src/main/browser/browser-identity-mode-record.test.ts": 82,
+      "src/main/browser/browser-identity-mode-store.test.ts": 100,
+      "src/main/browser/browser-manager-annotation-bridge.test.ts": 214,
+      "src/main/browser/browser-manager-auth-user-agent.test.ts": 263,
+      "src/main/browser/browser-manager-client-hosted-downloads.test.ts": 366,
+      "src/main/browser/browser-manager-destroyed-guest-downloads.test.ts": 165,
+      "src/main/browser/browser-manager-destroyed-guest.test.ts": 445,
+      "src/main/browser/browser-manager-downloads.test.ts": 320,
+      "src/main/browser/browser-manager-grab-capture.test.ts": 216,
+      "src/main/browser/browser-manager-grab-mode.test.ts": 305,
+      "src/main/browser/browser-manager-grab-selection.test.ts": 169,
+      "src/main/browser/browser-manager-grab-shortcuts.test.ts": 249,
+      "src/main/browser/browser-manager-guest-lifecycle.test.ts": 412,
+      "src/main/browser/browser-manager-guest-policy-profile.test.ts": 279,
+      "src/main/browser/browser-manager-guest-shortcuts.test.ts": 329,
+      "src/main/browser/browser-manager-guest-visibility.test.ts": 178,
+      "src/main/browser/browser-manager-load-failure-replay.test.ts": 280,
+      "src/main/browser/browser-manager-popup-child.test.ts": 189,
+      "src/main/browser/browser-manager-popup-routing.test.ts": 552,
+      "src/main/browser/browser-manager-viewport-override.test.ts": 1098,
+      "src/main/browser/browser-manager-viewport-ownership.test.ts": 298,
+      "src/main/browser/browser-manager-viewport-partial-failure.test.ts": 249,
+      "src/main/browser/browser-manager-worker-request-user-agent.test.ts": 208,
+      "src/main/browser/browser-network-deferred-socket.test.ts": 71,
+      "src/main/browser/browser-network-execution-route.test.ts": 102,
+      "src/main/browser/browser-network-tunnel-client-memory-budget.test.ts": 77,
+      "src/main/browser/browser-network-tunnel-client.test.ts": 107,
+      "src/main/browser/browser-network-tunnel-conformance.test.ts": 162,
+      "src/main/browser/browser-network-tunnel-outbound-memory-budget.test.ts": 71,
+      "src/main/browser/browser-network-tunnel-session-aggregate-memory.test.ts": 32,
+      "src/main/browser/browser-network-tunnel-session-stream-scoped-failure.test.ts": 47,
+      "src/main/browser/browser-network-tunnel-session.test.ts": 93,
+      "src/main/browser/browser-page-initiated-tab-budget.test.ts": 44,
+      "src/main/browser/browser-process-user-agent.test.ts": 40,
+      "src/main/browser/browser-route-dns-prefetch.electron.test.ts": 4575,
+      "src/main/browser/browser-route-guest-popups.test.ts": 126,
+      "src/main/browser/browser-route-h3-egress.electron.test.ts": 14983,
+      "src/main/browser/browser-route-identity.test.ts": 57,
+      "src/main/browser/browser-route-partition-binding-capacity.test.ts": 70,
+      "src/main/browser/browser-route-partition-binding-store.test.ts": 93,
+      "src/main/browser/browser-route-partition-migration.test.ts": 112,
+      "src/main/browser/browser-route-partition-stability.test.ts": 188,
+      "src/main/browser/browser-route-partition-storage-lifecycle.test.ts": 80,
+      "src/main/browser/browser-route-partition-storage-retirement.test.ts": 151,
+      "src/main/browser/browser-route-partition-storage-runtime.test.ts": 57,
+      "src/main/browser/browser-route-persisted-worker-egress.electron.test.ts": 3440,
+      "src/main/browser/browser-route-prepared-page-rekey.test.ts": 45,
+      "src/main/browser/browser-route-session-registry.test.ts": 147,
+      "src/main/browser/browser-route-tcp-egress.electron.test.ts": 1248,
+      "src/main/browser/browser-route-webcontents-registry.test.ts": 264,
+      "src/main/browser/browser-route-webrtc-egress.electron.test.ts": 10714,
+      "src/main/browser/browser-screencast-dialog-settlement.test.ts": 116,
+      "src/main/browser/browser-screencast-lifecycle.test.ts": 69,
+      "src/main/browser/browser-screencast-snapshot-scaling.test.ts": 192,
+      "src/main/browser/browser-screencast-stream.test.ts": 729,
+      "src/main/browser/browser-session-cookie-staging.scoped.test.ts": 370,
+      "src/main/browser/browser-session-cookie-staging.test.ts": 204,
+      "src/main/browser/browser-session-partition-policies.test.ts": 102,
+      "src/main/browser/browser-session-partition-proxy-install.test.ts": 327,
+      "src/main/browser/browser-session-proxy.test.ts": 205,
+      "src/main/browser/browser-session-registry-identity.persistence.test.ts": 400,
+      "src/main/browser/browser-session-registry-import-boundary.test.ts": 33,
+      "src/main/browser/browser-session-registry.persistence.test.ts": 353,
+      "src/main/browser/browser-session-registry.test.ts": 745,
+      "src/main/browser/browser-session-startup.test.ts": 77,
+      "src/main/browser/browser-session-ua-cloudflare-live.electron.test.ts": 657,
+      "src/main/browser/browser-session-ua-wire-identity-cross-context.electron.test.ts": 6292,
+      "src/main/browser/browser-session-ua-wire-identity.electron.test.ts": 9753,
+      "src/main/browser/browser-session-user-agent-migration-inspection.test.ts": 131,
+      "src/main/browser/browser-text-insertion.test.ts": 76,
+      "src/main/browser/browser-viewport-user-agent.test.ts": 43,
+      "src/main/browser/browser-webauthn-access.test.ts": 29,
+      "src/main/browser/browser-webauthn-account-picker.test.ts": 74,
+      "src/main/browser/browser-webauthn-profile-delete.test.ts": 305,
+      "src/main/browser/cdp-bridge-integration.test.ts": 7871,
+      "src/main/browser/cdp-bridge-state.test.ts": 86,
+      "src/main/browser/cdp-client-response-writer.test.ts": 856,
+      "src/main/browser/cdp-keyboard-us-layout.test.ts": 64,
+      "src/main/browser/cdp-print-to-pdf.test.ts": 63,
+      "src/main/browser/cdp-screenshot.test.ts": 105,
+      "src/main/browser/cdp-ws-proxy-focus-replay.test.ts": 336,
+      "src/main/browser/cdp-ws-proxy.test.ts": 2626,
+      "src/main/browser/chromium-cookie-snapshot.test.ts": 889,
+      "src/main/browser/client-route-cookie-import-source-store.test.ts": 103,
+      "src/main/browser/doc-preview-download-block-notice.test.ts": 47,
+      "src/main/browser/doc-preview-failure-notice.test.ts": 42,
+      "src/main/browser/doc-preview-file-reader.test.ts": 107,
+      "src/main/browser/doc-preview-grant-registry.test.ts": 101,
+      "src/main/browser/doc-preview-guest-policy.test.ts": 277,
+      "src/main/browser/doc-preview-protocol.test.ts": 171,
+      "src/main/browser/electron-debugger-lease.test.ts": 37,
+      "src/main/browser/electron-probe-display-launch.test.ts": 57,
+      "src/main/browser/execution-route-socket-duplex.test.ts": 103,
+      "src/main/browser/grab-guest-script.test.ts": 107,
+      "src/main/browser/local-ssh-browser-partition-identity.test.ts": 321,
+      "src/main/browser/local-ssh-browser-partitions.probe-cache.test.ts": 60,
+      "src/main/browser/local-ssh-browser-route.test.ts": 104,
+      "src/main/browser/offscreen-browser-backend-lifecycle.test.ts": 259,
+      "src/main/browser/offscreen-browser-backend.web-preferences.test.ts": 45,
+      "src/main/browser/paired-runtime-browser-client-host-composition.test.ts": 143,
+      "src/main/browser/paired-runtime-browser-client-host-identity-wiring.test.ts": 583,
+      "src/main/browser/paired-runtime-browser-client-host-reconnect.test.ts": 482,
+      "src/main/browser/paired-runtime-browser-client-host-registry.test.ts": 33,
+      "src/main/browser/paired-runtime-browser-client-host-route-identity.test.ts": 503,
+      "src/main/browser/paired-runtime-browser-client-host-runtime.test.ts": 766,
+      "src/main/browser/paired-runtime-browser-client-host.test.ts": 294,
+      "src/main/browser/paired-runtime-browser-host-command-admission.test.ts": 260,
+      "src/main/browser/paired-runtime-browser-host-lease-reconnect.test.ts": 880,
+      "src/main/browser/paired-runtime-browser-host-lease.test.ts": 856,
+      "src/main/browser/paired-runtime-browser-host-reconciliation-negotiation.test.ts": 269,
+      "src/main/browser/paired-runtime-browser-network-route.test.ts": 1212,
+      "src/main/browser/popup-origin-bar-window.test.ts": 96,
+      "src/main/browser/remote-browser-socks-buffering.test.ts": 1704,
+      "src/main/browser/remote-browser-socks-server.test.ts": 290,
+      "src/main/browser/snapshot-engine-iframe-sessions.test.ts": 92,
+      "src/main/browser/snapshot-engine.test.ts": 45,
+      "src/main/browser/ssh-browser-network-execution-route.test.ts": 532,
+      "src/main/browser/system-ssh-socks-client-socket.test.ts": 49,
+      "src/main/browser/wsl-browser-network-execution-route.test.ts": 269,
+      "src/main/browser/wsl-browser-network-relay-launch.test.ts": 65,
+      "src/main/claude-accounts/claude-account-service-account-selection.test.ts": 175,
+      "src/main/claude-accounts/claude-account-service-add-account.test.ts": 190,
+      "src/main/claude-accounts/claude-account-service-api-parity.test.ts": 206,
+      "src/main/claude-accounts/claude-account-service-config-dir-capture.test.ts": 235,
+      "src/main/claude-accounts/claude-account-service-credential-capture.test.ts": 214,
+      "src/main/claude-accounts/claude-account-service-login-process.test.ts": 499,
+      "src/main/claude-accounts/claude-account-service-reauth-rollback.test.ts": 165,
+      "src/main/claude-accounts/claude-duplicate-account.test.ts": 27,
+      "src/main/claude-accounts/claude-login-completion.oracle.test.ts": 162,
+      "src/main/claude-accounts/claude-structured-auth-policy.test.ts": 57,
+      "src/main/claude-accounts/claude-windows-interactive-login.test.ts": 238,
+      "src/main/claude-accounts/keychain-config-directory-aliases.test.ts": 98,
+      "src/main/claude-accounts/keychain.test.ts": 108,
+      "src/main/claude-accounts/live-pty-gate.test.ts": 42,
+      "src/main/claude-accounts/oauth-refresh.test.ts": 95,
+      "src/main/claude-accounts/runtime-auth-path-materialization.test.ts": 294,
+      "src/main/claude-accounts/runtime-auth-service-account-switching.test.ts": 447,
+      "src/main/claude-accounts/runtime-auth-service-deselect-restore.test.ts": 472,
+      "src/main/claude-accounts/runtime-auth-service-keychain-snapshots.test.ts": 695,
+      "src/main/claude-accounts/runtime-auth-service-launch-refresh.test.ts": 255,
+      "src/main/claude-accounts/runtime-auth-service-materialization.test.ts": 355,
+      "src/main/claude-accounts/runtime-auth-service-readback-identity.test.ts": 598,
+      "src/main/claude-accounts/runtime-auth-service-snapshot-validation.test.ts": 278,
+      "src/main/claude-accounts/runtime-auth-service-wsl-runtime.test.ts": 427,
+      "src/main/claude-accounts/runtime-paths.test.ts": 48,
+      "src/main/claude-accounts/runtime-selection.test.ts": 39,
+      "src/main/claude-accounts/windows-command-invocation.test.ts": 39,
+      "src/main/claude-usage/claude-model-pricing.test.ts": 47,
+      "src/main/claude-usage/claude-usage-report-aggregation.test.ts": 57,
+      "src/main/claude-usage/scanner-large-directory.test.ts": 480,
+      "src/main/claude-usage/scanner-scan.test.ts": 128,
+      "src/main/claude-usage/scanner.test.ts": 61,
+      "src/main/claude-usage/store.test.ts": 157,
+      "src/main/claude-usage/transcript-record-parser-prefilter.test.ts": 62,
+      "src/main/claude-usage/worktree-attribution-scaling.test.ts": 63,
+      "src/main/claude/claude-agent-sdk-contract-pins.test.ts": 3181,
+      "src/main/claude/claude-agent-sdk-control-requests.test.ts": 28,
+      "src/main/claude/claude-agent-sdk-exit-proof-identity.test.ts": 125,
+      "src/main/claude/claude-agent-sdk-exit-proof.test.ts": 12835,
+      "src/main/claude/claude-agent-sdk-import-boundary.test.ts": 1974,
+      "src/main/claude/claude-agent-sdk-process-spawn.test.ts": 87,
+      "src/main/claude/claude-agent-sdk-root-kill-fallback.test.ts": 137,
+      "src/main/claude/claude-agent-sdk-user-message-queue.test.ts": 133,
+      "src/main/claude/claude-background-task-resume.test.ts": 66,
+      "src/main/claude/claude-background-task-retention.test.ts": 585,
+      "src/main/claude/claude-background-task-row-journal.test.ts": 142,
+      "src/main/claude/claude-background-task-rows.test.ts": 316,
+      "src/main/claude/claude-background-task-terminal-frames.test.ts": 64,
+      "src/main/claude/claude-background-task-tracker.test.ts": 147,
+      "src/main/claude/claude-background-task-turn-resumption.test.ts": 108,
+      "src/main/claude/claude-child-process-environment.test.ts": 41,
+      "src/main/claude/claude-child-work-decoder.test.ts": 46,
+      "src/main/claude/claude-command-lifecycle-frames.test.ts": 109,
+      "src/main/claude/claude-config-dir-pin.test.ts": 40,
+      "src/main/claude/claude-context-model-switch.test.ts": 165,
+      "src/main/claude/claude-context-usage-restart.test.ts": 376,
+      "src/main/claude/claude-context-usage-unloaded-turn.test.ts": 1419,
+      "src/main/claude/claude-context-usage.test.ts": 124,
+      "src/main/claude/claude-context-window-hint.test.ts": 185,
+      "src/main/claude/claude-descendant-escalation-boundary.test.ts": 514,
+      "src/main/claude/claude-history-window-source-budget.test.ts": 610,
+      "src/main/claude/claude-model-catalog-probe.test.ts": 293,
+      "src/main/claude/claude-provisional-row-corrections.test.ts": 39,
+      "src/main/claude/claude-session-end-hook-capability.test.ts": 33,
+      "src/main/claude/claude-session-end-install.test.ts": 73,
+      "src/main/claude/claude-slash-command-catalog.test.ts": 64,
+      "src/main/claude/claude-stream-json-connection-close.test.ts": 462,
+      "src/main/claude/claude-stream-json-connection.test.ts": 24821,
+      "src/main/claude/claude-streamed-text-checkpoints.test.ts": 41,
+      "src/main/claude/claude-structured-applied-options.test.ts": 472,
+      "src/main/claude/claude-structured-auth-parity.test.ts": 638,
+      "src/main/claude/claude-structured-child-work-captures.test.ts": 755,
+      "src/main/claude/claude-structured-child-work-producer.test.ts": 835,
+      "src/main/claude/claude-structured-compaction.test.ts": 382,
+      "src/main/claude/claude-structured-content-parts.test.ts": 124,
+      "src/main/claude/claude-structured-control-actions.test.ts": 443,
+      "src/main/claude/claude-structured-dispatch-admission.test.ts": 405,
+      "src/main/claude/claude-structured-dispatch-boundary.test.ts": 459,
+      "src/main/claude/claude-structured-dispatch-content.test.ts": 46,
+      "src/main/claude/claude-structured-dispatch-queue-boundary.test.ts": 473,
+      "src/main/claude/claude-structured-dispatch.test.ts": 1776,
+      "src/main/claude/claude-structured-effort-reporting.test.ts": 496,
+      "src/main/claude/claude-structured-history-window.test.ts": 211,
+      "src/main/claude/claude-structured-inbound-control.test.ts": 78,
+      "src/main/claude/claude-structured-journal-prompt-retry.test.ts": 157,
+      "src/main/claude/claude-structured-journal-translation-background-tasks.test.ts": 346,
+      "src/main/claude/claude-structured-journal-translation-context-usage.test.ts": 417,
+      "src/main/claude/claude-structured-journal-translation-subagents.test.ts": 589,
+      "src/main/claude/claude-structured-journal-translation-turn-timing.test.ts": 524,
+      "src/main/claude/claude-structured-journal-translation.plan.test.ts": 87,
+      "src/main/claude/claude-structured-journal-translation.test.ts": 369,
+      "src/main/claude/claude-structured-launch-resolution.test.ts": 396,
+      "src/main/claude/claude-structured-location-support.test.ts": 65,
+      "src/main/claude/claude-structured-model-confirmation.test.ts": 332,
+      "src/main/claude/claude-structured-model-preflight.test.ts": 125,
+      "src/main/claude/claude-structured-option-confirmation.test.ts": 379,
+      "src/main/claude/claude-structured-options-context-window.test.ts": 452,
+      "src/main/claude/claude-structured-options.test.ts": 296,
+      "src/main/claude/claude-structured-owner-identity.test.ts": 64,
+      "src/main/claude/claude-structured-permission-mode.test.ts": 57,
+      "src/main/claude/claude-structured-prompt-items.test.ts": 157,
+      "src/main/claude/claude-structured-prompt-ownership.test.ts": 592,
+      "src/main/claude/claude-structured-provider-fallback.test.ts": 338,
+      "src/main/claude/claude-structured-real-cli.test.ts": 257,
+      "src/main/claude/claude-structured-resume-point.test.ts": 426,
+      "src/main/claude/claude-structured-session-acquisition-processless.test.ts": 471,
+      "src/main/claude/claude-structured-session-adapter-turns.test.ts": 333,
+      "src/main/claude/claude-structured-session-adapter.test.ts": 1001,
+      "src/main/claude/claude-structured-session-close.test.ts": 504,
+      "src/main/claude/claude-structured-session-commands.test.ts": 263,
+      "src/main/claude/claude-structured-session-reading-control.test.ts": 446,
+      "src/main/claude/claude-structured-session-recovery.test.ts": 282,
+      "src/main/claude/claude-structured-session-startup.test.ts": 309,
+      "src/main/claude/claude-structured-turn-resume-point.test.ts": 390,
+      "src/main/claude/claude-subagent-group-row.test.ts": 37,
+      "src/main/claude/claude-subagent-id-aliases.test.ts": 45,
+      "src/main/claude/claude-subagent-roster.test.ts": 105,
+      "src/main/claude/claude-subagent-task-frames.test.ts": 55,
+      "src/main/claude/claude-transcript-branch-graph.test.ts": 60,
+      "src/main/claude/claude-transcript-branch-streaming.test.ts": 224,
+      "src/main/claude/claude-transcript-entry-uuid.test.ts": 36,
+      "src/main/claude/claude-transcript-marker-branch-proof.test.ts": 86,
+      "src/main/claude/claude-transcript-rewind-proof.test.ts": 56,
+      "src/main/claude/claude-turn-outcome.test.ts": 121,
+      "src/main/claude/claude-turn-ownership.test.ts": 3385,
+      "src/main/claude/claude-turn-resumption.test.ts": 185,
+      "src/main/claude/compact-status-registration.test.ts": 175,
+      "src/main/claude/hook-service.test.ts": 401,
+      "src/main/claude/statusline-script.test.ts": 207,
+      "src/main/cli/appimage-extracted-root.test.ts": 198,
+      "src/main/cli/appimage-extraction-pruning.test.ts": 90,
+      "src/main/cli/appimage-payload-removal.reentrancy.test.ts": 49,
+      "src/main/cli/appimage-payload-removal.test.ts": 66,
+      "src/main/cli/appimage-registration-lock.test.ts": 57,
+      "src/main/cli/appimage-stable-launcher.test.ts": 231,
+      "src/main/cli/cli-command-installation-races.test.ts": 187,
+      "src/main/cli/cli-command-privileged-transaction.test.ts": 133,
+      "src/main/cli/cli-installer-appimage-ownership.test.ts": 206,
+      "src/main/cli/cli-installer-appimage-removal.test.ts": 281,
+      "src/main/cli/cli-installer-command-conflicts.test.ts": 230,
+      "src/main/cli/cli-installer-macos-command-path.test.ts": 250,
+      "src/main/cli/cli-installer-windows-path.test.ts": 148,
+      "src/main/cli/cli-installer.test.ts": 323,
+      "src/main/cli/cli-privileged-processes.test.ts": 51,
+      "src/main/cli/keyed-promise-queue.test.ts": 33,
+      "src/main/cli/legacy-appimage-cli-wrapper.test.ts": 57,
+      "src/main/cli/linux-bare-orca-dispatcher.test.ts": 173,
+      "src/main/cli/linux-terminal-orca-cli-shim.test.ts": 154,
+      "src/main/cli/native-cli-powershell-argv-boundary.test.ts": 54,
+      "src/main/cli/orca-cli-child-path.test.ts": 71,
+      "src/main/cli/packaged-cli-assets.test.ts": 863,
+      "src/main/cli/windows-launcher-asset.test.ts": 42,
+      "src/main/cli/windows-user-path-registry.test.ts": 63,
+      "src/main/cli/wsl-cli-installer.test.ts": 298,
+      "src/main/cli/wsl-cli-powershell-boundary.test.ts": 104,
+      "src/main/cli/wsl-cli-registration-operation.test.ts": 90,
+      "src/main/cli/wsl-cli-registration-reconciliation.test.ts": 264,
+      "src/main/cli/wsl-cli-registration-registry.test.ts": 174,
+      "src/main/cli/wsl-managed-cli.test.ts": 51,
+      "src/main/cli/wsl-managed-cli.wsl.test.ts": 93,
+      "src/main/codex-accounts/async-file-rename.test.ts": 1055,
+      "src/main/codex-accounts/codex-account-identity-api-key-guard.test.ts": 49,
+      "src/main/codex-accounts/codex-auth-workspace-identity.test.ts": 57,
+      "src/main/codex-accounts/codex-config-mirror.test.ts": 218,
+      "src/main/codex-accounts/codex-credential-absence-grace.test.ts": 138,
+      "src/main/codex-accounts/codex-login-auth-url.test.ts": 49,
+      "src/main/codex-accounts/codex-reset-credit-ledger.test.ts": 274,
+      "src/main/codex-accounts/codex-windows-interactive-login.test.ts": 343,
+      "src/main/codex-accounts/fs-utils.test.ts": 174,
+      "src/main/codex-accounts/host-codex-managed-home-ownership.test.ts": 40,
+      "src/main/codex-accounts/legacy-shared-auth-migration.test.ts": 121,
+      "src/main/codex-accounts/legacy-shared-config-compatibility.test.ts": 124,
+      "src/main/codex-accounts/legacy-wsl-runtime-auth-drain-apply-script.test.ts": 17191,
+      "src/main/codex-accounts/legacy-wsl-runtime-auth-drain-rollback-script.test.ts": 622,
+      "src/main/codex-accounts/legacy-wsl-runtime-auth-drain.test.ts": 77,
+      "src/main/codex-accounts/managed-codex-auth-readiness.test.ts": 76,
+      "src/main/codex-accounts/runtime-home-legacy-migration.test.ts": 608,
+      "src/main/codex-accounts/runtime-home-managed-auth-recovery.test.ts": 326,
+      "src/main/codex-accounts/runtime-home-mirrored-status-home.test.ts": 224,
+      "src/main/codex-accounts/runtime-home-per-account-homes.test.ts": 722,
+      "src/main/codex-accounts/runtime-home-read-only-launch-resolution.test.ts": 848,
+      "src/main/codex-accounts/runtime-home-real-home-lane-routing.test.ts": 445,
+      "src/main/codex-accounts/runtime-home-resume-selection-gate.test.ts": 295,
+      "src/main/codex-accounts/runtime-home-retained-auth-provenance.test.ts": 1201,
+      "src/main/codex-accounts/runtime-home-service-per-account-migration.test.ts": 482,
+      "src/main/codex-accounts/runtime-home-session-migration-pass.test.ts": 408,
+      "src/main/codex-accounts/runtime-home-system-default-mirror-readback.test.ts": 1006,
+      "src/main/codex-accounts/runtime-home-system-default-snapshot.test.ts": 740,
+      "src/main/codex-accounts/runtime-home-system-resource-materialization.test.ts": 490,
+      "src/main/codex-accounts/runtime-home-windows-profile-ownership.test.ts": 136,
+      "src/main/codex-accounts/runtime-home-wsl-managed-accounts.test.ts": 1054,
+      "src/main/codex-accounts/runtime-home-wsl-session-bridge.test.ts": 890,
+      "src/main/codex-accounts/runtime-home-wsl-system-default.test.ts": 503,
+      "src/main/codex-accounts/runtime-selection.test.ts": 73,
+      "src/main/codex-accounts/service-abandoned-login-supersede.test.ts": 861,
+      "src/main/codex-accounts/service-account-add-login.test.ts": 509,
+      "src/main/codex-accounts/service-account-selection-and-removal.test.ts": 846,
+      "src/main/codex-accounts/service-add-account-from-home.test.ts": 444,
+      "src/main/codex-accounts/service-login-process-teardown.test.ts": 426,
+      "src/main/codex-accounts/service-managed-home-removal-retries.test.ts": 186,
+      "src/main/codex-accounts/service-quota-refresh-decoupling.test.ts": 280,
+      "src/main/codex-accounts/service-reauthenticate-activation.test.ts": 268,
+      "src/main/codex-accounts/service-reset-credit-durability.test.ts": 703,
+      "src/main/codex-accounts/service-reset-credit-home-ownership.test.ts": 473,
+      "src/main/codex-accounts/service-reset-credit-target-routing.test.ts": 580,
+      "src/main/codex-accounts/service-system-default-identity.test.ts": 490,
+      "src/main/codex-accounts/service-wsl-accounts.test.ts": 660,
+      "src/main/codex-accounts/service.test.ts": 260,
+      "src/main/codex-accounts/sta-4422-transient-ownership-error.test.ts": 409,
+      "src/main/codex-accounts/sta-4734-login-rollback-deletes-authenticated-home.test.ts": 292,
+      "src/main/codex-accounts/sta-4735-unreadable-host-lane-writes.test.ts": 392,
+      "src/main/codex-accounts/wsl-codex-command.test.ts": 40,
+      "src/main/codex-cli/codex-home-process-lock.test.ts": 54,
+      "src/main/codex-cli/command.test.ts": 88,
+      "src/main/codex-usage/codex-rollout-resume-state.test.ts": 67,
+      "src/main/codex-usage/codex-usage-cost-estimate.test.ts": 46,
+      "src/main/codex-usage/codex-usage-long-context-billing.test.ts": 242,
+      "src/main/codex-usage/scanner-attribution-memo.test.ts": 170,
+      "src/main/codex-usage/scanner-file-identity.test.ts": 211,
+      "src/main/codex-usage/scanner-incremental-append.test.ts": 1002,
+      "src/main/codex-usage/scanner-large-directory.test.ts": 1168,
+      "src/main/codex-usage/scanner-paths.test.ts": 340,
+      "src/main/codex-usage/scanner.test.ts": 158,
+      "src/main/codex-usage/store-automation-usage.test.ts": 117,
+      "src/main/codex-usage/store-model-pricing.test.ts": 215,
+      "src/main/codex-usage/store-orca-scope.test.ts": 185,
+      "src/main/codex-usage/store-persistence.test.ts": 125,
+      "src/main/codex-usage/store-snapshot.benchmark.test.ts": 310,
+      "src/main/codex/codex-account-session-bridge.test.ts": 77,
+      "src/main/codex/codex-ai-vault-session-resume.test.ts": 127,
+      "src/main/codex/codex-app-server-capability-cache.test.ts": 64,
+      "src/main/codex/codex-app-server-client.test.ts": 1502,
+      "src/main/codex/codex-app-server-connection.test.ts": 5199,
+      "src/main/codex/codex-app-server-posix-supervisor.test.ts": 38,
+      "src/main/codex/codex-app-server-process-teardown.test.ts": 71,
+      "src/main/codex/codex-app-server-session.test.ts": 129,
+      "src/main/codex/codex-app-server-teardown.integration.test.ts": 21677,
+      "src/main/codex/codex-background-command-tracker.test.ts": 221,
+      "src/main/codex/codex-background-task-tracker.test.ts": 163,
+      "src/main/codex/codex-config-mirror-mcp-ownership.test.ts": 138,
+      "src/main/codex/codex-config-mirror.test.ts": 181,
+      "src/main/codex/codex-config-settings-removal.test.ts": 49,
+      "src/main/codex/codex-configured-launch-defaults.test.ts": 30,
+      "src/main/codex/codex-daemon-socket-path-guard.test.ts": 153,
+      "src/main/codex/codex-goal-journal-rows.test.ts": 90,
+      "src/main/codex/codex-home-paths.test.ts": 76,
+      "src/main/codex/codex-hook-legacy-profile-block.test.ts": 132,
+      "src/main/codex/codex-hook-trust-grant.test.ts": 1397,
+      "src/main/codex/codex-hooks-read-denial-followup.test.ts": 179,
+      "src/main/codex/codex-index-heal-binary-contract.test.ts": 49,
+      "src/main/codex/codex-legacy-session-resume.test.ts": 208,
+      "src/main/codex/codex-model-catalog-probe.test.ts": 3179,
+      "src/main/codex/codex-model-provider-config.test.ts": 32,
+      "src/main/codex/codex-notice-item-translation.test.ts": 226,
+      "src/main/codex/codex-pane-account-registry-mutations.test.ts": 50,
+      "src/main/codex/codex-pane-launch-account.test.ts": 64,
+      "src/main/codex/codex-persistent-command-retention.test.ts": 276,
+      "src/main/codex/codex-pinned-rollout-proof.test.ts": 53,
+      "src/main/codex/codex-prompt-registry-retention.test.ts": 376,
+      "src/main/codex/codex-real-home-hook-install.test.ts": 339,
+      "src/main/codex/codex-real-home-path.test.ts": 57,
+      "src/main/codex/codex-requested-close-turn-timing.test.ts": 134,
+      "src/main/codex/codex-rollout-session-meta.test.ts": 81,
+      "src/main/codex/codex-server-request-disposition.test.ts": 112,
+      "src/main/codex/codex-session-backfill-marker.test.ts": 89,
+      "src/main/codex/codex-session-backfill-scan-dates.test.ts": 83,
+      "src/main/codex/codex-session-backfill.test.ts": 647,
+      "src/main/codex/codex-session-bridge.test.ts": 112,
+      "src/main/codex/codex-session-index-heal-state.test.ts": 345,
+      "src/main/codex/codex-session-index-heal.test.ts": 1408,
+      "src/main/codex/codex-session-migration-recent-exits.test.ts": 61,
+      "src/main/codex/codex-session-migration-scheduler.test.ts": 401,
+      "src/main/codex/codex-session-resume-home.test.ts": 66,
+      "src/main/codex/codex-session-resume-preparation.test.ts": 65,
+      "src/main/codex/codex-session-resume-windows.test.ts": 59,
+      "src/main/codex/codex-session-resume-wrong-account.test.ts": 60,
+      "src/main/codex/codex-session-source-home.test.ts": 30,
+      "src/main/codex/codex-stale-pane-accounts.test.ts": 130,
+      "src/main/codex/codex-state-db-backfill-recovery.test.ts": 307,
+      "src/main/codex/codex-state-db.test.ts": 70,
+      "src/main/codex/codex-structured-acquisition-exit-proof.test.ts": 417,
+      "src/main/codex/codex-structured-child-environment.test.ts": 134,
+      "src/main/codex/codex-structured-dispatch-admission.test.ts": 507,
+      "src/main/codex/codex-structured-dispatch-boundary.test.ts": 414,
+      "src/main/codex/codex-structured-dispatch-echo.test.ts": 57,
+      "src/main/codex/codex-structured-fast-mode.test.ts": 320,
+      "src/main/codex/codex-structured-item-translation.test.ts": 161,
+      "src/main/codex/codex-structured-journal-compactions.test.ts": 267,
+      "src/main/codex/codex-structured-journal-goal-admission.test.ts": 258,
+      "src/main/codex/codex-structured-journal-goal-resume.test.ts": 327,
+      "src/main/codex/codex-structured-journal-goal-revision.test.ts": 242,
+      "src/main/codex/codex-structured-journal-goal-rows.test.ts": 107,
+      "src/main/codex/codex-structured-journal-subagent-readers.test.ts": 292,
+      "src/main/codex/codex-structured-journal-translation-settlement.test.ts": 1118,
+      "src/main/codex/codex-structured-journal-translation-streams.test.ts": 275,
+      "src/main/codex/codex-structured-journal-translation-subagent-linkage.test.ts": 245,
+      "src/main/codex/codex-structured-journal-translation-subagents.test.ts": 186,
+      "src/main/codex/codex-structured-journal-translation-turn-lifecycle.test.ts": 398,
+      "src/main/codex/codex-structured-journal-translation-turn-state.test.ts": 35,
+      "src/main/codex/codex-structured-journal-translation.test.ts": 282,
+      "src/main/codex/codex-structured-launch-resolution.test.ts": 102,
+      "src/main/codex/codex-structured-location-support.test.ts": 46,
+      "src/main/codex/codex-structured-owner-identity.test.ts": 45,
+      "src/main/codex/codex-structured-permission-policy.test.ts": 63,
+      "src/main/codex/codex-structured-prompt-items.test.ts": 224,
+      "src/main/codex/codex-structured-prompt-ownership.test.ts": 512,
+      "src/main/codex/codex-structured-prompt-replies.test.ts": 165,
+      "src/main/codex/codex-structured-rewind.test.ts": 306,
+      "src/main/codex/codex-structured-session-adapter-lifecycle.test.ts": 367,
+      "src/main/codex/codex-structured-session-adapter.test.ts": 318,
+      "src/main/codex/codex-structured-session-background-tasks.test.ts": 502,
+      "src/main/codex/codex-structured-session-cancel.test.ts": 456,
+      "src/main/codex/codex-structured-session-close.test.ts": 420,
+      "src/main/codex/codex-structured-session-options-catalog.test.ts": 246,
+      "src/main/codex/codex-structured-session-options.test.ts": 356,
+      "src/main/codex/codex-structured-session-shutdown.test.ts": 471,
+      "src/main/codex/codex-structured-thread-goal.test.ts": 73,
+      "src/main/codex/codex-structured-thread-open.test.ts": 300,
+      "src/main/codex/codex-structured-turn-processes.integration.test.ts": 194,
+      "src/main/codex/codex-subagent-execution-projection.test.ts": 202,
+      "src/main/codex/codex-subagent-executions.test.ts": 71,
+      "src/main/codex/codex-subagent-roster.test.ts": 118,
+      "src/main/codex/codex-tool-identity-translation.test.ts": 117,
+      "src/main/codex/codex-trust-config-concurrent-launch.test.ts": 225,
+      "src/main/codex/codex-trust-config-mutation-queue.test.ts": 45,
+      "src/main/codex/codex-trust-config-rollback.test.ts": 76,
+      "src/main/codex/codex-trust-grant-host.test.ts": 94,
+      "src/main/codex/codex-trust-grant-ledger.test.ts": 54,
+      "src/main/codex/codex-trust-grant-main-thread-boundary.test.ts": 43,
+      "src/main/codex/codex-trust-grant-telemetry.test.ts": 70,
+      "src/main/codex/codex-turn-ordinals.test.ts": 96,
+      "src/main/codex/codex-user-hook-trust-rebase-client.test.ts": 104,
+      "src/main/codex/codex-user-hook-trust-rebase.test.ts": 127,
+      "src/main/codex/codex-wsl-hook-install-plan.test.ts": 51,
+      "src/main/codex/config-plugin-registration-promotion.test.ts": 370,
+      "src/main/codex/config-settings-baseline-upgrade.test.ts": 104,
+      "src/main/codex/config-settings-promotion.test.ts": 508,
+      "src/main/codex/config-sync-stall.test.ts": 161,
+      "src/main/codex/config-toml-hook-trust-scaling.test.ts": 126,
+      "src/main/codex/config-toml-mcp-servers.test.ts": 37,
+      "src/main/codex/config-toml-trust-api-parity.test.ts": 91,
+      "src/main/codex/config-toml-trust-hash.test.ts": 44,
+      "src/main/codex/config-toml-trust-hook-read.test.ts": 125,
+      "src/main/codex/config-toml-trust-hook-removal.test.ts": 108,
+      "src/main/codex/config-toml-trust-hook-upsert.test.ts": 163,
+      "src/main/codex/config-toml-trust-key.test.ts": 54,
+      "src/main/codex/config-toml-trust-paths.test.ts": 86,
+      "src/main/codex/config-toml-trust-project.test.ts": 105,
+      "src/main/codex/hook-service-concurrent-launch-install.test.ts": 749,
+      "src/main/codex/hook-service-legacy-cleanup.test.ts": 1004,
+      "src/main/codex/hook-service-managed-install.test.ts": 286,
+      "src/main/codex/hook-service-runtime-trust-repair.test.ts": 330,
+      "src/main/codex/hook-service-trust-grant.test.ts": 355,
+      "src/main/codex/hook-service-user-hook-mirroring.test.ts": 371,
+      "src/main/codex/hook-service-wsl-runtime.test.ts": 389,
+      "src/main/codex/hook-trust-promotion.test.ts": 569,
+      "src/main/codex/managed-home-shell-preflight.test.ts": 161,
+      "src/main/codex/retained-codex-hook-state.test.ts": 41,
+      "src/main/codex/sta-4735-hook-trust-provenance-overwrite.test.ts": 82,
+      "src/main/codex/sta-4737-unreadable-is-not-absent.test.ts": 179,
+      "src/main/codex/sta-4823-shared-state-survives-a-failed-read.test.ts": 226,
+      "src/main/codex/windows-hook-command.test.ts": 161,
+      "src/main/codex/windows-hook-upgrade.test.ts": 122,
+      "src/main/codex/wsl-codex-session-bridge.test.ts": 133,
+      "src/main/command-code/hook-service.test.ts": 407,
+      "src/main/computer/computer-action-verification-normalization.test.ts": 37,
+      "src/main/computer/computer-provider-lifecycle.test.ts": 159,
+      "src/main/computer/computer-provider-unavailable-message.test.ts": 40,
+      "src/main/computer/computer-sidecar-diagnostics.test.ts": 37,
+      "src/main/computer/desktop-script-provider-action-errors.test.ts": 162,
+      "src/main/computer/desktop-script-provider-actions.test.ts": 167,
+      "src/main/computer/desktop-script-provider-bridge.test.ts": 45,
+      "src/main/computer/desktop-script-provider-cache-lifecycle.test.ts": 114,
+      "src/main/computer/desktop-script-provider-cache.test.ts": 191,
+      "src/main/computer/desktop-script-provider-client.test.ts": 205,
+      "src/main/computer/desktop-script-provider-errors.test.ts": 205,
+      "src/main/computer/desktop-script-provider-paste-validation.test.ts": 107,
+      "src/main/computer/desktop-script-provider-runtime-host-routing.test.ts": 204,
+      "src/main/computer/desktop-script-runtime-host.test.ts": 199,
+      "src/main/computer/desktop-script-runtime-host.win32.test.ts": 94,
+      "src/main/computer/desktop-script-serve-channel.test.ts": 170,
+      "src/main/computer/macos-computer-use-permission-status.test.ts": 97,
+      "src/main/computer/macos-computer-use-permissions.test.ts": 90,
+      "src/main/computer/macos-native-provider-client.test.ts": 1206,
+      "src/main/computer/macos-native-provider-line-buffer.test.ts": 62,
+      "src/main/computer/macos-native-provider-paste-validation.test.ts": 192,
+      "src/main/computer/macos-native-provider-process-reaping.test.ts": 94,
+      "src/main/computer/macos-native-provider-reaping.integration.test.ts": 4215,
+      "src/main/computer/macos-native-provider-socket.test.ts": 71,
+      "src/main/computer/macos-native-provider-startup-cleanup.test.ts": 73,
+      "src/main/computer/sidecar-client.test.ts": 96,
+      "src/main/computer/sidecar-provider-reaping.integration.test.ts": 313,
+      "src/main/computer/windows-powershell-execution-policy.test.ts": 62,
+      "src/main/copilot/hook-service.test.ts": 164,
+      "src/main/crash-reporting/crash-breadcrumb-renderer-attribution.test.ts": 34,
+      "src/main/crash-reporting/crash-breadcrumb-store-leak.test.ts": 111,
+      "src/main/crash-reporting/crash-breadcrumb-store-orphan-cleanup.test.ts": 108,
+      "src/main/crash-reporting/crash-breadcrumb-store.test.ts": 166,
+      "src/main/crash-reporting/crash-report-copy-text.test.ts": 56,
+      "src/main/crash-reporting/crash-report-store.test.ts": 453,
+      "src/main/crash-reporting/crashpad-capture-read-limit.test.ts": 267,
+      "src/main/crash-reporting/crashpad-capture.test.ts": 94,
+      "src/main/crash-reporting/durable-crash-breadcrumb.test.ts": 71,
+      "src/main/crash-reporting/expected-teardown-state.test.ts": 38,
+      "src/main/crash-reporting/gpu-crash-diagnostics.test.ts": 49,
+      "src/main/crash-reporting/gpu-crash-fallback-decision.test.ts": 38,
+      "src/main/crash-reporting/gpu-crash-fallback-field-sessions.test.ts": 40,
+      "src/main/crash-reporting/gpu-fallback-engagement.test.ts": 60,
+      "src/main/crash-reporting/gpu-fallback-recovered-launch.test.ts": 69,
+      "src/main/crash-reporting/gpu-fallback-restart-prompt.test.ts": 39,
+      "src/main/crash-reporting/main-process-lifecycle-identity.test.ts": 68,
+      "src/main/crash-reporting/minidump-crash-signature.test.ts": 59,
+      "src/main/crash-reporting/minidump-file-source.test.ts": 200,
+      "src/main/crash-reporting/pre-gone-host-memory.test.ts": 96,
+      "src/main/crash-reporting/process-gone-classification.test.ts": 51,
+      "src/main/crash-reporting/process-gone-dedupe.test.ts": 33,
+      "src/main/crash-reporting/process-gone-diagnostics.test.ts": 114,
+      "src/main/crash-reporting/process-gone-killed-one-ordering.test.ts": 108,
+      "src/main/crash-reporting/process-gone-recorder.test.ts": 967,
+      "src/main/crash-reporting/process-gone-sibling-correlation.test.ts": 686,
+      "src/main/crash-reporting/renderer-recovery-circuit-breaker.test.ts": 48,
+      "src/main/crash-reporting/self-initiated-tree-kill-log.test.ts": 296,
+      "src/main/crash-reporting/suppressed-process-gone-breadcrumb.test.ts": 24,
+      "src/main/cursor/hook-service.test.ts": 281,
+      "src/main/daemon/agent-startup-prompt-latency.node-pty.test.ts": 2349,
+      "src/main/daemon/bash-prompt-command-composition.test.ts": 2955,
+      "src/main/daemon/client.test.ts": 523,
+      "src/main/daemon/cold-restore-payload-cache.test.ts": 34,
+      "src/main/daemon/daemon-adoption-telemetry-event.test.ts": 269,
+      "src/main/daemon/daemon-audit-eligibility-event.test.ts": 807,
+      "src/main/daemon/daemon-authenticated-client-activity.test.ts": 408,
+      "src/main/daemon/daemon-background-transient-facts.test.ts": 89,
+      "src/main/daemon/daemon-bundle-staleness.test.ts": 461,
+      "src/main/daemon/daemon-cgroup-scope.test.ts": 87,
+      "src/main/daemon/daemon-checkpoint-session-queue.test.ts": 243,
+      "src/main/daemon/daemon-client-notify-settlement.test.ts": 66,
+      "src/main/daemon/daemon-client-rpc-request.test.ts": 97,
+      "src/main/daemon/daemon-client-stream-keepalive.test.ts": 43,
+      "src/main/daemon/daemon-durable-checkpoint-live-rebase.test.ts": 1035,
+      "src/main/daemon/daemon-endpoint-ownership.test.ts": 525,
+      "src/main/daemon/daemon-endpoint-publish.test.ts": 114,
+      "src/main/daemon/daemon-endpoint-windows.test.ts": 50,
+      "src/main/daemon/daemon-entry-path-layouts.test.ts": 353,
+      "src/main/daemon/daemon-entry.test.ts": 517,
+      "src/main/daemon/daemon-errors.test.ts": 159,
+      "src/main/daemon/daemon-file-log.test.ts": 63,
+      "src/main/daemon/daemon-folder-access-mismatch.test.ts": 241,
+      "src/main/daemon/daemon-folder-access-probe-script.test.ts": 198,
+      "src/main/daemon/daemon-folder-access-probe.test.ts": 68,
+      "src/main/daemon/daemon-folder-access-reset.test.ts": 215,
+      "src/main/daemon/daemon-foreground-confirmation-protocol.test.ts": 50,
+      "src/main/daemon/daemon-health-endpoint-entry.test.ts": 78,
+      "src/main/daemon/daemon-health-socket-cleanup.test.ts": 83,
+      "src/main/daemon/daemon-health.test.ts": 3556,
+      "src/main/daemon/daemon-host-relocation.test.ts": 486,
+      "src/main/daemon/daemon-idle-shutdown.test.ts": 1312,
+      "src/main/daemon/daemon-incarnation-evidence-main-thread.test.ts": 52,
+      "src/main/daemon/daemon-incarnation-evidence.test.ts": 62,
+      "src/main/daemon/daemon-init-child-readiness.test.ts": 488,
+      "src/main/daemon/daemon-init-child-startup-failure.test.ts": 630,
+      "src/main/daemon/daemon-init-endpoint-adoption.test.ts": 1191,
+      "src/main/daemon/daemon-init-live-session-preservation.test.ts": 667,
+      "src/main/daemon/daemon-init-packaged-bundle-staleness.test.ts": 303,
+      "src/main/daemon/daemon-init-provider-installation.test.ts": 493,
+      "src/main/daemon/daemon-init-replacement-reporting.test.ts": 568,
+      "src/main/daemon/daemon-init-restart-sequence.test.ts": 865,
+      "src/main/daemon/daemon-init-wedged-daemon-grace.test.ts": 452,
+      "src/main/daemon/daemon-launched-child-identity.test.ts": 119,
+      "src/main/daemon/daemon-launched-child-spawn.test.ts": 64,
+      "src/main/daemon/daemon-lifecycle-event.test.ts": 196,
+      "src/main/daemon/daemon-mac-code-identity.test.ts": 76,
+      "src/main/daemon/daemon-main.test.ts": 421,
+      "src/main/daemon/daemon-native-pty-exception.test.ts": 39,
+      "src/main/daemon/daemon-pid-file-parse.test.ts": 41,
+      "src/main/daemon/daemon-preflight-client-replacement.test.ts": 704,
+      "src/main/daemon/daemon-process-identity-time-zone.test.ts": 90,
+      "src/main/daemon/daemon-process-inspection.test.ts": 63,
+      "src/main/daemon/daemon-protocol-version.test.ts": 34,
+      "src/main/daemon/daemon-pty-adapter-cold-restore-reanchor.test.ts": 1246,
+      "src/main/daemon/daemon-pty-adapter-cold-restore-seed.test.ts": 1188,
+      "src/main/daemon/daemon-pty-adapter-concurrent-recovery.test.ts": 887,
+      "src/main/daemon/daemon-pty-adapter-daemon-recovery.test.ts": 1496,
+      "src/main/daemon/daemon-pty-adapter-history-checkpoints.test.ts": 2334,
+      "src/main/daemon/daemon-pty-adapter-history-recovery.test.ts": 1236,
+      "src/main/daemon/daemon-pty-adapter-inventory-respawn.test.ts": 593,
+      "src/main/daemon/daemon-pty-adapter-live-rebased-checkpoint.test.ts": 1713,
+      "src/main/daemon/daemon-pty-adapter-protocol-compatibility.test.ts": 2069,
+      "src/main/daemon/daemon-pty-adapter-replacement-exit-race.test.ts": 767,
+      "src/main/daemon/daemon-pty-adapter-session-adoption.test.ts": 1235,
+      "src/main/daemon/daemon-pty-adapter-steady-state-compat.test.ts": 468,
+      "src/main/daemon/daemon-pty-adapter.test.ts": 4255,
+      "src/main/daemon/daemon-pty-router-history-handoff.test.ts": 1329,
+      "src/main/daemon/daemon-pty-router.test.ts": 658,
+      "src/main/daemon/daemon-pty-startup-delivery.test.ts": 2827,
+      "src/main/daemon/daemon-pty-upgrade-adoption.test.ts": 679,
+      "src/main/daemon/daemon-pty-write-settlement-recovery.test.ts": 410,
+      "src/main/daemon/daemon-ready-identity.test.ts": 55,
+      "src/main/daemon/daemon-reattach-checkpoint-isolation.test.ts": 10993,
+      "src/main/daemon/daemon-respawn-throttle.test.ts": 58,
+      "src/main/daemon/daemon-restore-scrollback-depth.test.ts": 3415,
+      "src/main/daemon/daemon-scope-death-watch.test.ts": 70,
+      "src/main/daemon/daemon-self-retirement-respawn.test.ts": 786,
+      "src/main/daemon/daemon-server-async-spawn-cancellation.test.ts": 1078,
+      "src/main/daemon/daemon-server-attach-only.test.ts": 466,
+      "src/main/daemon/daemon-server-attachment-lifecycle.test.ts": 631,
+      "src/main/daemon/daemon-server-error-handling.test.ts": 457,
+      "src/main/daemon/daemon-server-kill-attribution.test.ts": 256,
+      "src/main/daemon/daemon-server.test.ts": 2072,
+      "src/main/daemon/daemon-session-owner-resolution.test.ts": 60,
+      "src/main/daemon/daemon-session-scrollback-window.test.ts": 408,
+      "src/main/daemon/daemon-shared-owner-incarnation-retention.test.ts": 667,
+      "src/main/daemon/daemon-shutdown-final-checkpoint-caller-deadline.test.ts": 2293,
+      "src/main/daemon/daemon-spawner.test.ts": 472,
+      "src/main/daemon/daemon-stream-backpressure-socket.test.ts": 305,
+      "src/main/daemon/daemon-stream-backpressure.test.ts": 42,
+      "src/main/daemon/daemon-stream-data-batcher.test.ts": 196,
+      "src/main/daemon/daemon-stream-data-split.test.ts": 1339,
+      "src/main/daemon/daemon-stream-droppability-lifecycle.test.ts": 485,
+      "src/main/daemon/daemon-stream-droppable-membership.test.ts": 127,
+      "src/main/daemon/daemon-stream-producer-stall-watchdog.test.ts": 74,
+      "src/main/daemon/daemon-tcc-attribution-main-thread.test.ts": 91,
+      "src/main/daemon/daemon-tcc-attribution.test.ts": 75,
+      "src/main/daemon/daemon-transport-attachment-release.test.ts": 791,
+      "src/main/daemon/degraded-daemon-pty-provider.test.ts": 151,
+      "src/main/daemon/hangul-cell-width-agreement.test.ts": 91,
+      "src/main/daemon/headless-emulator-fidelity.fuzz.test.ts": 18873,
+      "src/main/daemon/headless-emulator-restored-osc-links.test.ts": 124,
+      "src/main/daemon/headless-emulator-shrink-snapshot.test.ts": 177,
+      "src/main/daemon/headless-emulator-snapshot-cost.bench.test.ts": 53,
+      "src/main/daemon/headless-emulator-unicode-width.test.ts": 108,
+      "src/main/daemon/headless-emulator-wide-char-repaint.test.ts": 1505,
+      "src/main/daemon/headless-emulator-wide-char-snapshot.test.ts": 265,
+      "src/main/daemon/headless-emulator.test.ts": 232,
+      "src/main/daemon/headless-osc-link-ranges.test.ts": 141,
+      "src/main/daemon/hibernation-cold-restore-repro.test.ts": 202,
+      "src/main/daemon/history-manager-disabled-sessions-leak.test.ts": 150,
+      "src/main/daemon/history-manager.test.ts": 437,
+      "src/main/daemon/history-reader-memory.test.ts": 366,
+      "src/main/daemon/history-reader.test.ts": 306,
+      "src/main/daemon/issue-6814-daemon-failure-classification.test.ts": 6483,
+      "src/main/daemon/macos-login-session-death-watch.test.ts": 93,
+      "src/main/daemon/ndjson.test.ts": 180,
+      "src/main/daemon/node-pty-error-hints.test.ts": 46,
+      "src/main/daemon/node-pty-windows-input-error.win32.test.ts": 37,
+      "src/main/daemon/osc7-file-uri.test.ts": 48,
+      "src/main/daemon/osc7-uri-extraction.test.ts": 34,
+      "src/main/daemon/post-ready-flush-gate.test.ts": 43,
+      "src/main/daemon/process-boundary-ground.test.ts": 256,
+      "src/main/daemon/process-boundary-host-focus.test.ts": 314,
+      "src/main/daemon/pty-session-id.test.ts": 54,
+      "src/main/daemon/pty-subprocess-cwd-cancel-identity.test.ts": 277,
+      "src/main/daemon/pty-subprocess-env-inheritance.test.ts": 312,
+      "src/main/daemon/pty-subprocess-env-retention.test.ts": 248,
+      "src/main/daemon/pty-subprocess-foreground-degraded-scan.test.ts": 235,
+      "src/main/daemon/pty-subprocess-foreground-identity.test.ts": 589,
+      "src/main/daemon/pty-subprocess-foreground-scan-cadence.test.ts": 336,
+      "src/main/daemon/pty-subprocess-git-credential-guard.test.ts": 249,
+      "src/main/daemon/pty-subprocess-handle-lifecycle.test.ts": 413,
+      "src/main/daemon/pty-subprocess-io-failure-cleanup.test.ts": 10411,
+      "src/main/daemon/pty-subprocess-io-failure-native.test.ts": 2523,
+      "src/main/daemon/pty-subprocess-managed-agent-env.test.ts": 337,
+      "src/main/daemon/pty-subprocess-spawn-file-foreground.test.ts": 440,
+      "src/main/daemon/pty-subprocess-windows-shell-launch.test.ts": 310,
+      "src/main/daemon/pty-subprocess-wsl-launch.test.ts": 370,
+      "src/main/daemon/pty-subprocess.test.ts": 269,
+      "src/main/daemon/pty-subprocess/bun-pty-job-control.integration.test.ts": 27,
+      "src/main/daemon/pty-subprocess/bun-pty-process-flow-control.test.ts": 111,
+      "src/main/daemon/pty-subprocess/bun-pty-process-pause-retry.test.ts": 80,
+      "src/main/daemon/pty-subprocess/bun-pty-process-suspension.test.ts": 118,
+      "src/main/daemon/pty-subprocess/bun-pty-process.integration.test.ts": 49,
+      "src/main/daemon/pty-subprocess/bun-pty-process.test.ts": 352,
+      "src/main/daemon/pty-subprocess/native-pty-spawn-bun.test.ts": 70,
+      "src/main/daemon/pty-subprocess/native-pty-spawn-windows.test.ts": 83,
+      "src/main/daemon/pty-subprocess/spawn-file-foreground-rejected-agents.test.ts": 102,
+      "src/main/daemon/pty-subprocess/spawn-preflight-bun.test.ts": 91,
+      "src/main/daemon/pty-subprocess/windows-bun-pty-gate.integration.test.ts": 80,
+      "src/main/daemon/pty-subprocess/windows-bun-pty-gate.test.ts": 68,
+      "src/main/daemon/pty-subprocess/windows-bun-pty-job.test.ts": 53,
+      "src/main/daemon/pty-subprocess/windows-bun-pty-launch.test.ts": 70,
+      "src/main/daemon/pty-subprocess/windows-bun-pty-native.test.ts": 30,
+      "src/main/daemon/pty-subprocess/windows-bun-pty-spawn-receipt.test.ts": 70,
+      "src/main/daemon/reattach-snapshot.test.ts": 878,
+      "src/main/daemon/repro-12101-mouse-tracking-survives-agent-death.test.ts": 156,
+      "src/main/daemon/repro-7329-remote-snapshot-corruption.test.ts": 122,
+      "src/main/daemon/serialize-addon-edge-cases.test.ts": 71,
+      "src/main/daemon/serialize-grid-transcript-replay.test.ts": 14365,
+      "src/main/daemon/serialize-grid.differential.fuzz.test.ts": 582,
+      "src/main/daemon/session-ingest-throughput.bench.test.ts": 191,
+      "src/main/daemon/session-pending-output.test.ts": 426,
+      "src/main/daemon/session-producer-pause.test.ts": 33,
+      "src/main/daemon/session-shell-recovery.test.ts": 338,
+      "src/main/daemon/session-terminal-control.test.ts": 245,
+      "src/main/daemon/session.test.ts": 626,
+      "src/main/daemon/shell-ready-bash-wrapper.test.ts": 337,
+      "src/main/daemon/slow-daemon-session-verification.test.ts": 14043,
+      "src/main/daemon/startup-device-attributes-responder.test.ts": 38,
+      "src/main/daemon/terminal-attach-cancellation.test.ts": 24,
+      "src/main/daemon/terminal-checkpoint-serializer.test.ts": 127,
+      "src/main/daemon/terminal-checkpoint-writer-bounds.test.ts": 237,
+      "src/main/daemon/terminal-cursor-line-context.test.ts": 124,
+      "src/main/daemon/terminal-descendant-shutdown.test.ts": 97,
+      "src/main/daemon/terminal-history-incremental-restore.test.ts": 505,
+      "src/main/daemon/terminal-history-large-checkpoint-cold-restore.test.ts": 7048,
+      "src/main/daemon/terminal-history-log-encode-allocation.test.ts": 96,
+      "src/main/daemon/terminal-history-log.test.ts": 54,
+      "src/main/daemon/terminal-history-permissions.test.ts": 202,
+      "src/main/daemon/terminal-history-restorable-retention.test.ts": 34,
+      "src/main/daemon/terminal-history-seed-chunks.test.ts": 64,
+      "src/main/daemon/terminal-history-seed-segments.test.ts": 78,
+      "src/main/daemon/terminal-history-seed-transfer-registry.test.ts": 62,
+      "src/main/daemon/terminal-history-session-tombstone-retry.test.ts": 68,
+      "src/main/daemon/terminal-host-agent-session.test.ts": 227,
+      "src/main/daemon/terminal-host-attach-only.test.ts": 297,
+      "src/main/daemon/terminal-host-cheap-tier-ps-scan-volume.test.ts": 196,
+      "src/main/daemon/terminal-host-concurrent-create.test.ts": 240,
+      "src/main/daemon/terminal-host-cwd-readability.test.ts": 261,
+      "src/main/daemon/terminal-host-non-agent-foreground.test.ts": 189,
+      "src/main/daemon/terminal-host-process-inspection-cheap-tier.test.ts": 163,
+      "src/main/daemon/terminal-host-process-inspection.test.ts": 236,
+      "src/main/daemon/terminal-host-pty-owner-backend.test.ts": 324,
+      "src/main/daemon/terminal-host-readiness-reporting.test.ts": 317,
+      "src/main/daemon/terminal-host-session-reaping-leak.test.ts": 460,
+      "src/main/daemon/terminal-host-spawn-input-retention.test.ts": 543,
+      "src/main/daemon/terminal-host-startup.test.ts": 299,
+      "src/main/daemon/terminal-host-teardown-recreate.test.ts": 484,
+      "src/main/daemon/terminal-host-wsl-context.test.ts": 249,
+      "src/main/daemon/terminal-host.test.ts": 691,
+      "src/main/daemon/terminal-mouse-tail-retention.test.ts": 171,
+      "src/main/daemon/terminal-session-teardown.test.ts": 95,
+      "src/main/daemon/terminal-shell-armed-input-mode-recovery.test.ts": 215,
+      "src/main/daemon/terminal-shell-lifecycle-scanner.test.ts": 56,
+      "src/main/daemon/terminal-shell-recovery-barrier.test.ts": 748,
+      "src/main/daemon/terminal-shell-recovery-clean-exit-retirement.test.ts": 61,
+      "src/main/daemon/terminal-snapshot-color-parity.test.ts": 147,
+      "src/main/daemon/terminal-snapshot-osc8-roundtrip.test.ts": 102,
+      "src/main/daemon/terminal-snapshot-serialize-roundtrip.test.ts": 286,
+      "src/main/daemon/windows-conpty-warmup.test.ts": 113,
+      "src/main/daemon/wsl-cold-restore-cwd.test.ts": 54,
+      "src/main/destination-serialized-local-rename.test.ts": 3857,
+      "src/main/devin/hook-config-json.test.ts": 89,
+      "src/main/devin/hook-service.test.ts": 138,
+      "src/main/diagnostics/main-thread-churn-probe.test.ts": 63,
+      "src/main/dock/unread-badge.test.ts": 59,
+      "src/main/droid/hook-service.test.ts": 53,
+      "src/main/durable-file-write-syscall-proof.test.ts": 72,
+      "src/main/durable-file-write.test.ts": 167,
+      "src/main/emulator/android/adb-devices.test.ts": 54,
+      "src/main/emulator/android/android-app-control.test.ts": 53,
+      "src/main/emulator/android/android-capability-operations.test.ts": 82,
+      "src/main/emulator/android/android-device-inventory.test.ts": 48,
+      "src/main/emulator/android/android-input-commands.test.ts": 47,
+      "src/main/emulator/android/android-input-mapping.test.ts": 63,
+      "src/main/emulator/android/android-logcat.test.ts": 35,
+      "src/main/emulator/android/android-permissions.test.ts": 32,
+      "src/main/emulator/android/android-sdk-discovery.test.ts": 58,
+      "src/main/emulator/android/avd-manager.test.ts": 51,
+      "src/main/emulator/android/scrcpy-server-deploy.test.ts": 31,
+      "src/main/emulator/android/scrcpy-stream-session.test.ts": 2989,
+      "src/main/emulator/android/scrcpy-video-frame-parser.test.ts": 238,
+      "src/main/emulator/android/uiautomator-tree.test.ts": 33,
+      "src/main/emulator/backends/android-emulator-backend.test.ts": 176,
+      "src/main/emulator/backends/ios-emulator-backend.test.ts": 162,
+      "src/main/emulator/emulator-availability.test.ts": 52,
+      "src/main/emulator/emulator-bridge.test.ts": 417,
+      "src/main/emulator/emulator-gesture-sender.test.ts": 194,
+      "src/main/emulator/emulator-session-registry.test.ts": 38,
+      "src/main/emulator/emulator-start-lease-registry.test.ts": 116,
+      "src/main/emulator/mjpeg-frame-parser.test.ts": 50,
+      "src/main/emulator/mjpeg-frame-stream.test.ts": 143,
+      "src/main/emulator/scrcpy-video-registry.test.ts": 43,
+      "src/main/emulator/serve-sim-accessibility-tree.test.ts": 134,
+      "src/main/emulator/serve-sim-ax-normalization.test.ts": 50,
+      "src/main/emulator/serve-sim-detached-session.test.ts": 32,
+      "src/main/emulator/serve-sim-execution.test.ts": 100,
+      "src/main/emulator/serve-sim-helper-processes.test.ts": 64,
+      "src/main/emulator/serve-sim-runtime-materializer.test.ts": 98,
+      "src/main/emulator/simctl-simulator-devices.test.ts": 61,
+      "src/main/ephemeral-vm-recipe-runner.test.ts": 516,
+      "src/main/ephemeral-vm-resume-integrity.test.ts": 163,
+      "src/main/ephemeral-vm-runtime-service.test.ts": 944,
+      "src/main/ephemeral-vm-runtime-ssh-cleanup.test.ts": 133,
+      "src/main/external-editor-launch.test.ts": 58,
+      "src/main/fish-history-session.test.ts": 91,
+      "src/main/folder-upgrade-worktree-path.test.ts": 45,
+      "src/main/gemini/hook-service.test.ts": 59,
+      "src/main/ghostty/discovery.test.ts": 79,
+      "src/main/ghostty/index.test.ts": 89,
+      "src/main/ghostty/mapper-extended.test.ts": 56,
+      "src/main/ghostty/mapper.test.ts": 74,
+      "src/main/ghostty/parser.test.ts": 40,
+      "src/main/ghostty/theme-import.test.ts": 100,
+      "src/main/ghostty/theme-resolution.test.ts": 75,
+      "src/main/git-bash.test.ts": 49,
+      "src/main/git/add-sparse-worktree.test.ts": 166,
+      "src/main/git/admission-tier-plumbing.test.ts": 38,
+      "src/main/git/branch-rename.test.ts": 50,
+      "src/main/git/canonical-repo-key.test.ts": 112,
+      "src/main/git/check-ignored-paths.test.ts": 45,
+      "src/main/git/coalesced-probe.test.ts": 54,
+      "src/main/git/command-runner/gh-exec-file-deadline.test.ts": 135,
+      "src/main/git/command-runner/gh-spawn-boundary.test.ts": 802,
+      "src/main/git/command-runner/git-admission-output-parity.test.ts": 246,
+      "src/main/git/command-runner/git-admission-span.test.ts": 324,
+      "src/main/git/command-runner/git-admission-storm-measurement.test.ts": 26034,
+      "src/main/git/command-runner/git-command-timeout-behavior.test.ts": 1860,
+      "src/main/git/command-runner/git-command-timeout.test.ts": 55,
+      "src/main/git/command-runner/git-exec-admission-lifetime.test.ts": 485,
+      "src/main/git/command-runner/git-operation-executor.test.ts": 86,
+      "src/main/git/command-runner/git-spawn-admission-lifetime.test.ts": 108,
+      "src/main/git/command-runner/git-stream-admission-lifetime.test.ts": 224,
+      "src/main/git/command-runner/git-subprocess-admission.test.ts": 364,
+      "src/main/git/command-runner/hosted-cli-deadline-log.test.ts": 103,
+      "src/main/git/command-runner/spawned-command-tree-kill.test.ts": 43,
+      "src/main/git/command-runner/wsl-command-resolution-windows-binary.test.ts": 95,
+      "src/main/git/command-runner/wsl-host-failure.test.ts": 155,
+      "src/main/git/commit-object-ref.test.ts": 46,
+      "src/main/git/commit.test.ts": 129,
+      "src/main/git/exact-ref-probe.test.ts": 45,
+      "src/main/git/fetch-error-classification.test.ts": 43,
+      "src/main/git/fork-remote-refspec.test.ts": 50,
+      "src/main/git/fork-remote-stale-branch-refspec.test.ts": 54,
+      "src/main/git/gh-rate-limit-breaker.test.ts": 80,
+      "src/main/git/git-capability-state.test.ts": 51,
+      "src/main/git/git-status-read-lease-owner.test.ts": 33,
+      "src/main/git/git-upstream-status-read-owner.test.ts": 40,
+      "src/main/git/git-username.test.ts": 173,
+      "src/main/git/hosted-remote-url.test.ts": 44,
+      "src/main/git/huge-folder-ignore.test.ts": 59,
+      "src/main/git/local-repo-ref-maintenance.test.ts": 298,
+      "src/main/git/pack-refs-lock-ownership.test.ts": 80,
+      "src/main/git/porcelain-v1-records.test.ts": 197,
+      "src/main/git/remote-name-listing.test.ts": 59,
+      "src/main/git/remote-ref-probe-cache.test.ts": 46,
+      "src/main/git/remote-url-probe.test.ts": 73,
+      "src/main/git/remote.test.ts": 564,
+      "src/main/git/remove-worktree-branch-cleanup.test.ts": 163,
+      "src/main/git/remove-worktree-clean-preflight.test.ts": 125,
+      "src/main/git/remove-worktree.test.ts": 159,
+      "src/main/git/repo-api-parity.test.ts": 194,
+      "src/main/git/repo-branch-conflict-batched-probe.test.ts": 73,
+      "src/main/git/repo-branch-conflict-real-git.test.ts": 351,
+      "src/main/git/repo-branch-conflict.test.ts": 214,
+      "src/main/git/repo-clone-path.test.ts": 50,
+      "src/main/git/repo-default-base-timeout.test.ts": 66,
+      "src/main/git/repo-default-remote.test.ts": 73,
+      "src/main/git/repo-detection.test.ts": 697,
+      "src/main/git/repo-ref-maintenance-real-git.test.ts": 1124,
+      "src/main/git/repo-remote-drift-real.test.ts": 320,
+      "src/main/git/repo-remote-drift.test.ts": 190,
+      "src/main/git/repo-search-ref-compat.test.ts": 93,
+      "src/main/git/repo-username.test.ts": 190,
+      "src/main/git/repo.test.ts": 2242,
+      "src/main/git/runner-command-exec.test.ts": 708,
+      "src/main/git/runner-gh-account-binding.test.ts": 199,
+      "src/main/git/runner-gh-host-args.test.ts": 184,
+      "src/main/git/runner-gh-rate-limit-breaker.test.ts": 204,
+      "src/main/git/runner-windows-host-environment.test.ts": 285,
+      "src/main/git/runner-wsl-direct-read.test.ts": 1893,
+      "src/main/git/runner-wsl-gh-fallback.test.ts": 924,
+      "src/main/git/runner-wsl-linked-gitdir-timeout.test.ts": 175,
+      "src/main/git/runner-wsl-linked-gitdir-windows.test.ts": 292,
+      "src/main/git/runner-wsl-login-shell-capture.test.ts": 125,
+      "src/main/git/runner-wsl-read-routing.test.ts": 169,
+      "src/main/git/runner.test.ts": 120,
+      "src/main/git/settled-diff-cache-bounds.test.ts": 66,
+      "src/main/git/source-control/bulk-pathspec-command-line-budget.test.ts": 218,
+      "src/main/git/source-control/resolve-git-dir.test.ts": 42,
+      "src/main/git/source-control/wsl-tracked-pathspec-banner.test.ts": 171,
+      "src/main/git/status-branch-compare-real-ref.test.ts": 229,
+      "src/main/git/status-branch-compare.test.ts": 157,
+      "src/main/git/status-branch-line-total-exec-contract.test.ts": 1673,
+      "src/main/git/status-branch-line-total-real-git.test.ts": 1107,
+      "src/main/git/status-branch-line-total-relay-parity.test.ts": 590,
+      "src/main/git/status-conflict-operations.test.ts": 216,
+      "src/main/git/status-conflict-overlap.bench.test.ts": 272,
+      "src/main/git/status-cquoted-paths.test.ts": 237,
+      "src/main/git/status-diff-settled-cache.test.ts": 426,
+      "src/main/git/status-diff.test.ts": 235,
+      "src/main/git/status-discard-and-bulk-staging.test.ts": 300,
+      "src/main/git/status-discard-symlink.test.ts": 661,
+      "src/main/git/status-line-stats-host-paths.test.ts": 78,
+      "src/main/git/status-pathspec-literals.test.ts": 464,
+      "src/main/git/status-porcelain-parser.test.ts": 47,
+      "src/main/git/status-read-coalescing.test.ts": 223,
+      "src/main/git/status-shared-symlinks.test.ts": 803,
+      "src/main/git/status-submodule-path-cache.test.ts": 895,
+      "src/main/git/status-submodule.test.ts": 231,
+      "src/main/git/status-symlink-probe-budget.test.ts": 145,
+      "src/main/git/status-upstream-negative-cache.test.ts": 1303,
+      "src/main/git/status-upstream-probe-churn.test.ts": 169,
+      "src/main/git/status-upstream-ref.test.ts": 42,
+      "src/main/git/status-wsl-pathspecs.test.ts": 132,
+      "src/main/git/status.test.ts": 212,
+      "src/main/git/upstream-deferred-fork-remote-real.test.ts": 217,
+      "src/main/git/upstream.test.ts": 388,
+      "src/main/git/worktree-add-creation-config.test.ts": 237,
+      "src/main/git/worktree-add-local-base-refresh.test.ts": 281,
+      "src/main/git/worktree-add-local-base-suggestion.test.ts": 178,
+      "src/main/git/worktree-add-timeout-override.test.ts": 199,
+      "src/main/git/worktree-base-divergence-real-git.test.ts": 1614,
+      "src/main/git/worktree-base-divergence.test.ts": 93,
+      "src/main/git/worktree-base-ref-probe.test.ts": 38,
+      "src/main/git/worktree-common-dir-comparison.test.ts": 177,
+      "src/main/git/worktree-configured-paths-concurrency.test.ts": 86,
+      "src/main/git/worktree-create-admission-tier.test.ts": 245,
+      "src/main/git/worktree-create-git-executor-real-git.test.ts": 356,
+      "src/main/git/worktree-create-preparation-real-git.test.ts": 1406,
+      "src/main/git/worktree-create-preparation-real-wsl.test.ts": 271,
+      "src/main/git/worktree-created-description-real-git.test.ts": 1340,
+      "src/main/git/worktree-created-disk-witness.test.ts": 149,
+      "src/main/git/worktree-deferred-removal-real-git.test.ts": 587,
+      "src/main/git/worktree-diff-stamp-guest-gitdir.test.ts": 40,
+      "src/main/git/worktree-diff-stamp-host-paths.test.ts": 55,
+      "src/main/git/worktree-git-capabilities.test.ts": 248,
+      "src/main/git/worktree-graph-listing.test.ts": 205,
+      "src/main/git/worktree-include-file.test.ts": 104,
+      "src/main/git/worktree-list-paths.test.ts": 571,
+      "src/main/git/worktree-list-porcelain.test.ts": 163,
+      "src/main/git/worktree-listing-created-sparse-distro.test.ts": 291,
+      "src/main/git/worktree-listing-sparse-distro.test.ts": 188,
+      "src/main/git/worktree-move.test.ts": 195,
+      "src/main/git/worktree-mutation-route-invalidation.test.ts": 145,
+      "src/main/git/worktree-porcelain-parsing.test.ts": 210,
+      "src/main/git/worktree-posix-path-case-sensitivity.test.ts": 134,
+      "src/main/git/worktree-preparation-base-oid.test.ts": 99,
+      "src/main/git/worktree-preparation-cancel-latency.bench.test.ts": 248,
+      "src/main/git/worktree-removal-large-tree.bench.test.ts": 291,
+      "src/main/git/worktree-remove-branch-deletion.test.ts": 194,
+      "src/main/git/worktree-scan-cache-annotation-reuse.test.ts": 241,
+      "src/main/git/worktree-scan-cache-sharing.test.ts": 284,
+      "src/main/git/worktree-separate-git-dir.test.ts": 614,
+      "src/main/git/worktree-shared-directories.test.ts": 1301,
+      "src/main/git/worktree-sparse-checkout-cache.test.ts": 234,
+      "src/main/git/worktree-sparse-checkout.test.ts": 675,
+      "src/main/git/worktree-sparse-state-host-paths.test.ts": 252,
+      "src/main/git/worktree-symlink-detection.test.ts": 55,
+      "src/main/git/wsl-direct-git-read-commands.test.ts": 54,
+      "src/main/git/wsl-linked-worktree-git-route-invalidation.test.ts": 81,
+      "src/main/git/wsl-linked-worktree-git-routing.test.ts": 105,
+      "src/main/git/wsl-process-group-termination.test.ts": 44,
+      "src/main/gitea/client-scan-invalidation.test.ts": 181,
+      "src/main/gitea/client.test.ts": 192,
+      "src/main/gitea/pull-request-creation.test.ts": 228,
+      "src/main/gitea/pull-request-mappers.test.ts": 56,
+      "src/main/gitea/repository-ref.test.ts": 71,
+      "src/main/github/auth-diagnose.test.ts": 51,
+      "src/main/github/client-create-pr.test.ts": 356,
+      "src/main/github/client-file-viewed.test.ts": 430,
+      "src/main/github/client-issue-origin-preference.test.ts": 247,
+      "src/main/github/client-issue-source.test.ts": 1603,
+      "src/main/github/client-merge-queue-auto-merge.test.ts": 342,
+      "src/main/github/client-merged-pr-visibility.test.ts": 343,
+      "src/main/github/client-pr-branch-discovery.test.ts": 352,
+      "src/main/github/client-pr-check-details.test.ts": 228,
+      "src/main/github/client-pr-checks.test.ts": 383,
+      "src/main/github/client-pr-comment-reactions.test.ts": 281,
+      "src/main/github/client-pr-conflict-summary.test.ts": 374,
+      "src/main/github/client-pr-fallback-number.test.ts": 347,
+      "src/main/github/client-pr-linked-lookup.test.ts": 310,
+      "src/main/github/client-pr-local-runtime.test.ts": 291,
+      "src/main/github/client-pr-push-target.test.ts": 222,
+      "src/main/github/client-pr-state.test.ts": 355,
+      "src/main/github/client-rate-limit-block.test.ts": 298,
+      "src/main/github/client-ssh-provider-execution-boundary.test.ts": 341,
+      "src/main/github/client-stack-merge-guard.test.ts": 422,
+      "src/main/github/client-starred.test.ts": 335,
+      "src/main/github/client-tracked-upstream-fork-owner.test.ts": 366,
+      "src/main/github/client-tracked-upstream-snapshot.test.ts": 618,
+      "src/main/github/client-work-item-check-summary.test.ts": 193,
+      "src/main/github/client-work-items-query-paging.test.ts": 354,
+      "src/main/github/client-work-items.test.ts": 235,
+      "src/main/github/comment-reactions.test.ts": 28,
+      "src/main/github/conflict-summary.test.ts": 50,
+      "src/main/github/default-branch-stale-pr.test.ts": 295,
+      "src/main/github/gh-account-token.test.ts": 66,
+      "src/main/github/gh-capability-state.test.ts": 37,
+      "src/main/github/gh-utils-concurrency.test.ts": 95,
+      "src/main/github/gh-utils.test.ts": 172,
+      "src/main/github/github-api-repository-validation.test.ts": 33,
+      "src/main/github/github-api-repository.test.ts": 276,
+      "src/main/github/github-enterprise-repository.test.ts": 144,
+      "src/main/github/github-pr-stack.test.ts": 79,
+      "src/main/github/github-remote-identity-parsing.test.ts": 40,
+      "src/main/github/github-repository-identity.fork-owner-repo.test.ts": 404,
+      "src/main/github/github-repository-identity.gh-account.test.ts": 164,
+      "src/main/github/github-repository-identity.signed-cache.test.ts": 171,
+      "src/main/github/github-repository-identity.ssh-host-alias.test.ts": 171,
+      "src/main/github/issues.test.ts": 109,
+      "src/main/github/pr-head-tracking-ref.test.ts": 74,
+      "src/main/github/pr-refresh-coordinator-active-burst-pacing.test.ts": 202,
+      "src/main/github/pr-refresh-coordinator-active-visible-priority.test.ts": 297,
+      "src/main/github/pr-refresh-coordinator-alias-coalescing.test.ts": 329,
+      "src/main/github/pr-refresh-coordinator-rate-limit-budget.test.ts": 302,
+      "src/main/github/pr-refresh-coordinator-refresh-events.test.ts": 331,
+      "src/main/github/pr-refresh-coordinator-visible-follow-up.test.ts": 280,
+      "src/main/github/pr-refresh-error-classification.test.ts": 45,
+      "src/main/github/pr-refresh-queue-growth-bound.test.ts": 623,
+      "src/main/github/pr-refresh-validation-backoff.test.ts": 58,
+      "src/main/github/pr-review-comment-lines.test.ts": 36,
+      "src/main/github/pr-start-point-compare-base.test.ts": 76,
+      "src/main/github/pr-start-point.test.ts": 95,
+      "src/main/github/project-view-host-auth.test.ts": 116,
+      "src/main/github/project-view.test.ts": 113,
+      "src/main/github/project-view/mutations.test.ts": 57,
+      "src/main/github/project-view/project-field-mutations.test.ts": 58,
+      "src/main/github/project-view/project-view-table.test.ts": 175,
+      "src/main/github/project-view/repository-field-options.test.ts": 44,
+      "src/main/github/rate-limit.test.ts": 68,
+      "src/main/github/review-head-remote.test.ts": 54,
+      "src/main/github/stacked-pr-creation.test.ts": 62,
+      "src/main/github/work-item-details-api-parity.test.ts": 295,
+      "src/main/github/work-item-details-concurrency.test.ts": 50,
+      "src/main/github/work-item-details-enterprise-host.test.ts": 203,
+      "src/main/github/work-item-details-file-viewed.test.ts": 236,
+      "src/main/github/work-item-details-pr-files.test.ts": 225,
+      "src/main/github/work-item-details.test.ts": 249,
+      "src/main/github/work-item-search-fallback-environment.test.ts": 208,
+      "src/main/github/work-item-search-freshness.test.ts": 1026,
+      "src/main/github/work-item-search-isolation.test.ts": 434,
+      "src/main/github/work-item-search-pagination.test.ts": 284,
+      "src/main/github/work-item-search-semantics.test.ts": 372,
+      "src/main/gitlab/client-mr-auth-rate-limit.test.ts": 142,
+      "src/main/gitlab/client-mr-branch-lookup.test.ts": 184,
+      "src/main/gitlab/client-mr-job-ci.test.ts": 83,
+      "src/main/gitlab/client-mr-listing.test.ts": 138,
+      "src/main/gitlab/client-mr-review-actions.test.ts": 154,
+      "src/main/gitlab/client-work-items.test.ts": 230,
+      "src/main/gitlab/client.test.ts": 260,
+      "src/main/gitlab/gitlab-known-host-probe-wsl-fallback.test.ts": 180,
+      "src/main/gitlab/gitlab-known-host-probe.test.ts": 71,
+      "src/main/gitlab/gitlab-known-host-retirement.test.ts": 235,
+      "src/main/gitlab/gl-utils.test.ts": 120,
+      "src/main/gitlab/issues.test.ts": 257,
+      "src/main/gitlab/mappers-workitem.test.ts": 62,
+      "src/main/gitlab/mappers.test.ts": 68,
+      "src/main/gitlab/merge-request-creation.test.ts": 70,
+      "src/main/gitlab/mr-head-tracking-ref.test.ts": 75,
+      "src/main/gitlab/project-ref-parser.test.ts": 58,
+      "src/main/gitlab/work-item-details.test.ts": 114,
+      "src/main/global-fetch-call-site-audit.test.ts": 314,
+      "src/main/grok-accounts/status.test.ts": 56,
+      "src/main/grok/grok-hook-config-file.test.ts": 123,
+      "src/main/grok/grok-hook-owners.test.ts": 97,
+      "src/main/grok/grok-hook-remnant-removal.test.ts": 116,
+      "src/main/grok/grok-hook-stdin-no-eof.test.ts": 472,
+      "src/main/grok/hook-service.test.ts": 174,
+      "src/main/grok/windows-grok-hook-script.test.ts": 133,
+      "src/main/grok/windows-hook-launcher-chain.test.ts": 97,
+      "src/main/hang-watchdog/hang-detection-marker.test.ts": 43,
+      "src/main/hang-watchdog/hang-watchdog-detection-loop.test.ts": 61,
+      "src/main/hang-watchdog/hang-watchdog-worker-path.test.ts": 59,
+      "src/main/hang-watchdog/main-thread-hang-telemetry.test.ts": 175,
+      "src/main/hang-watchdog/main-thread-hang-watchdog-entry.test.ts": 58,
+      "src/main/hang-watchdog/main-thread-hang-watchdog.test.ts": 78,
+      "src/main/headless-automation-dispatcher-source-boundary.test.ts": 39,
+      "src/main/hermes/hook-service.test.ts": 434,
+      "src/main/hook-archive-timeout-observation.test.ts": 1092,
+      "src/main/hook-termination-real-process.test.ts": 8201,
+      "src/main/hooks-archive-exit-observation.test.ts": 187,
+      "src/main/hooks-effective-hook-resolution.test.ts": 209,
+      "src/main/hooks-issue-command.test.ts": 340,
+      "src/main/hooks-orca-yaml-parsing.test.ts": 201,
+      "src/main/hooks-runner.test.ts": 197,
+      "src/main/hooks-setup-runner-script.test.ts": 219,
+      "src/main/hooks.test.ts": 344,
+      "src/main/host-tree-removal-asar.electron.test.ts": 359,
+      "src/main/host/deferred-secret-protection-report.test.ts": 51,
+      "src/main/host/electron-secret-store.test.ts": 66,
+      "src/main/host/secret-protection-report.test.ts": 74,
+      "src/main/i18n/main-i18n-lazy-locale.test.ts": 323,
+      "src/main/ipc/agent-hooks.test.ts": 661,
+      "src/main/ipc/agent-pane-authority-ownership.test.ts": 31,
+      "src/main/ipc/agent-pane-retirement-ipc.test.ts": 74,
+      "src/main/ipc/ai-vault-scan-coalescing.test.ts": 824,
+      "src/main/ipc/ai-vault-search-all-hosts-real-index.test.ts": 1337,
+      "src/main/ipc/ai-vault-search-all-hosts.test.ts": 194,
+      "src/main/ipc/ai-vault-search-merged-cursor.test.ts": 135,
+      "src/main/ipc/ai-vault-search.test.ts": 517,
+      "src/main/ipc/ai-vault.test.ts": 1998,
+      "src/main/ipc/app.test.ts": 458,
+      "src/main/ipc/automations-external-scope.test.ts": 184,
+      "src/main/ipc/bounded-warning-dedupe.test.ts": 35,
+      "src/main/ipc/browser-client-page-metadata-ipc.test.ts": 144,
+      "src/main/ipc/browser-preview-tool-authorization.test.ts": 582,
+      "src/main/ipc/browser-session-profile-ipc.test.ts": 227,
+      "src/main/ipc/browser-tab-registration-wait.test.ts": 133,
+      "src/main/ipc/browser.test.ts": 824,
+      "src/main/ipc/cli-appimage-stale-registration.test.ts": 285,
+      "src/main/ipc/cli.test.ts": 162,
+      "src/main/ipc/codex-config-sync.test.ts": 46,
+      "src/main/ipc/command-path-resolver.test.ts": 39,
+      "src/main/ipc/computer-use-permissions.test.ts": 73,
+      "src/main/ipc/crash-reporting-renderer-breadcrumbs.test.ts": 100,
+      "src/main/ipc/crash-reporting-renderer-error-report-attribution.test.ts": 67,
+      "src/main/ipc/crash-reporting-replay-guard-wedge-burst.test.ts": 56,
+      "src/main/ipc/crash-reporting.test.ts": 155,
+      "src/main/ipc/created-worktree-reconciliation.test.ts": 118,
+      "src/main/ipc/created-worktree-root-prune.test.ts": 307,
+      "src/main/ipc/dashboard-payload-validation.test.ts": 241,
+      "src/main/ipc/dashboard-popout.test.ts": 97,
+      "src/main/ipc/deferred-emoji-shortcode-dataset.test.ts": 94,
+      "src/main/ipc/desktop-renderer-runtime-capabilities.test.ts": 597,
+      "src/main/ipc/developer-permissions.test.ts": 132,
+      "src/main/ipc/diagnostics.test.ts": 78,
+      "src/main/ipc/doc-preview-grant-ipc.test.ts": 92,
+      "src/main/ipc/dropped-path-resolution.test.ts": 81,
+      "src/main/ipc/emulator-frame-stream-socket-lifetime.test.ts": 139,
+      "src/main/ipc/emulator-renderer-lifetime.test.ts": 113,
+      "src/main/ipc/emulator-stream-listener-cleanup.test.ts": 52,
+      "src/main/ipc/ephemeral-vm-provision-cancel.test.ts": 2605,
+      "src/main/ipc/ephemeral-vm-provisioned-root-ref.test.ts": 1162,
+      "src/main/ipc/ephemeral-vm-runtime-handler-cleanup.test.ts": 816,
+      "src/main/ipc/ephemeral-vm.test.ts": 1095,
+      "src/main/ipc/feedback-image-attachments.test.ts": 78,
+      "src/main/ipc/feedback.test.ts": 175,
+      "src/main/ipc/filesystem-allowed-roots.test.ts": 437,
+      "src/main/ipc/filesystem-auth.test.ts": 1145,
+      "src/main/ipc/filesystem-branch-compare-diff.test.ts": 2519,
+      "src/main/ipc/filesystem-commit-message-generation.test.ts": 3728,
+      "src/main/ipc/filesystem-commit-message-model-discovery.test.ts": 4612,
+      "src/main/ipc/filesystem-conflict-operation-routing.test.ts": 3748,
+      "src/main/ipc/filesystem-download-lifetime.test.ts": 673,
+      "src/main/ipc/filesystem-download-transfers.test.ts": 4793,
+      "src/main/ipc/filesystem-git-commit-dispatch.test.ts": 2595,
+      "src/main/ipc/filesystem-git-status-staging.test.ts": 3013,
+      "src/main/ipc/filesystem-import-local-rollback.test.ts": 86,
+      "src/main/ipc/filesystem-import-ssh-ops.test.ts": 545,
+      "src/main/ipc/filesystem-import-ssh-path-safety.test.ts": 94,
+      "src/main/ipc/filesystem-import-ssh.test.ts": 490,
+      "src/main/ipc/filesystem-import.test.ts": 6057,
+      "src/main/ipc/filesystem-list-files-handler-name-filter.test.ts": 3031,
+      "src/main/ipc/filesystem-list-files-name-filter.test.ts": 314,
+      "src/main/ipc/filesystem-list-files.test.ts": 320,
+      "src/main/ipc/filesystem-markdown-document-listing.test.ts": 3120,
+      "src/main/ipc/filesystem-mutations-runtime-upload.test.ts": 2064,
+      "src/main/ipc/filesystem-mutations.test.ts": 3581,
+      "src/main/ipc/filesystem-path-containment-remote-enoent.test.ts": 32,
+      "src/main/ipc/filesystem-path-containment-unicode-normalization.test.ts": 218,
+      "src/main/ipc/filesystem-pull-request-field-generation.test.ts": 3228,
+      "src/main/ipc/filesystem-pull-request-linked-issue-lifetime.test.ts": 2896,
+      "src/main/ipc/filesystem-runtime-upload-staging.test.ts": 140,
+      "src/main/ipc/filesystem-search-file-paths.test.ts": 426,
+      "src/main/ipc/filesystem-search-rg-timeout.test.ts": 1022,
+      "src/main/ipc/filesystem-watcher-canonical-root-paths.test.ts": 435,
+      "src/main/ipc/filesystem-watcher-document-lifetime.test.ts": 309,
+      "src/main/ipc/filesystem-watcher-dormant-rearm.test.ts": 188,
+      "src/main/ipc/filesystem-watcher-event-batch.test.ts": 38,
+      "src/main/ipc/filesystem-watcher-ignore.test.ts": 53,
+      "src/main/ipc/filesystem-watcher-large-batch.test.ts": 423,
+      "src/main/ipc/filesystem-watcher-local-events.test.ts": 482,
+      "src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts": 1128,
+      "src/main/ipc/filesystem-watcher-native-capacity.test.ts": 198,
+      "src/main/ipc/filesystem-watcher-real.test.ts": 699,
+      "src/main/ipc/filesystem-watcher-remote-batch.test.ts": 127,
+      "src/main/ipc/filesystem-watcher-remote-cancellation.test.ts": 457,
+      "src/main/ipc/filesystem-watcher-remote-capacity.test.ts": 188,
+      "src/main/ipc/filesystem-watcher-remote-rearm.test.ts": 133,
+      "src/main/ipc/filesystem-watcher-removal-deadline.test.ts": 397,
+      "src/main/ipc/filesystem-watcher-terminal-resync.test.ts": 353,
+      "src/main/ipc/filesystem-watcher-unwatchable-roots.test.ts": 125,
+      "src/main/ipc/filesystem-watcher-wsl.test.ts": 90,
+      "src/main/ipc/filesystem-watcher.test.ts": 2230,
+      "src/main/ipc/filesystem.test.ts": 2871,
+      "src/main/ipc/floating-workspace-directory.test.ts": 82,
+      "src/main/ipc/folder-repo-git-upgrade-lifetime.test.ts": 103,
+      "src/main/ipc/folder-repo-git-upgrade.test.ts": 2578,
+      "src/main/ipc/git-status-upstream-ref-watch-request.test.ts": 58,
+      "src/main/ipc/github-ipc-channel-parity.test.ts": 396,
+      "src/main/ipc/github-issue-source-preference.test.ts": 273,
+      "src/main/ipc/github-pr-refresh-routing.test.ts": 206,
+      "src/main/ipc/github-repo-access-guards.test.ts": 398,
+      "src/main/ipc/github-ssh-connection-routing.test.ts": 340,
+      "src/main/ipc/github-star-telemetry.test.ts": 319,
+      "src/main/ipc/github-work-item-args.test.ts": 36,
+      "src/main/ipc/github-wsl-runtime-routing.test.ts": 360,
+      "src/main/ipc/gitlab-repo-access.test.ts": 84,
+      "src/main/ipc/gitlab.test.ts": 122,
+      "src/main/ipc/hooks/worktree-hook-execution-host.test.ts": 516,
+      "src/main/ipc/hosted-review.test.ts": 419,
+      "src/main/ipc/jira-cancellable-requests.test.ts": 55,
+      "src/main/ipc/keybindings.test.ts": 46,
+      "src/main/ipc/linear.test.ts": 72,
+      "src/main/ipc/local-log-tail-lifetime.test.ts": 78,
+      "src/main/ipc/local-log-tail.test.ts": 63,
+      "src/main/ipc/local-network-connection-test.test.ts": 221,
+      "src/main/ipc/local-worktree-runtime-options.test.ts": 46,
+      "src/main/ipc/macos-keyboard-layout-change-notifications.test.ts": 46,
+      "src/main/ipc/macos-keyboard-layout-snapshot.test.ts": 50,
+      "src/main/ipc/markdown-documents.test.ts": 34,
+      "src/main/ipc/minimax-credentials.test.ts": 94,
+      "src/main/ipc/mobile.test.ts": 15914,
+      "src/main/ipc/native-chat-renderer-lifetime.test.ts": 57,
+      "src/main/ipc/native-chat-renderer-watcher-cleanup.test.ts": 327,
+      "src/main/ipc/native-chat-subscribe-lifecycle.test.ts": 209,
+      "src/main/ipc/native-chat.test.ts": 1810,
+      "src/main/ipc/notebook.test.ts": 102,
+      "src/main/ipc/notifications-custom-sound.test.ts": 167,
+      "src/main/ipc/notifications-delivery-gating.test.ts": 226,
+      "src/main/ipc/notifications-message-formatting.test.ts": 81,
+      "src/main/ipc/notifications-mobile-fanout.test.ts": 141,
+      "src/main/ipc/notifications-permission-onboarding.test.ts": 216,
+      "src/main/ipc/notifications-retention-lifecycle.test.ts": 378,
+      "src/main/ipc/notifications-subject-retirement.test.ts": 56,
+      "src/main/ipc/orca-profile-auth-handlers.test.ts": 461,
+      "src/main/ipc/orca-profile-org-members-handlers.test.ts": 57,
+      "src/main/ipc/orca-profiles-switch-persistence.test.ts": 1121,
+      "src/main/ipc/orca-profiles.test.ts": 419,
+      "src/main/ipc/parcel-watcher-child-launch.test.ts": 73,
+      "src/main/ipc/parcel-watcher-child-registry.test.ts": 91,
+      "src/main/ipc/parcel-watcher-crash-fuse.test.ts": 42,
+      "src/main/ipc/parcel-watcher-disconnect-termination.test.ts": 97,
+      "src/main/ipc/parcel-watcher-entry-path.test.ts": 36,
+      "src/main/ipc/parcel-watcher-event-cancellation.test.ts": 61,
+      "src/main/ipc/parcel-watcher-event-delivery.test.ts": 37,
+      "src/main/ipc/parcel-watcher-module-loader.test.ts": 39,
+      "src/main/ipc/parcel-watcher-process-entry.test.ts": 234,
+      "src/main/ipc/parcel-watcher-process.test.ts": 678,
+      "src/main/ipc/parcel-watcher-root-path-rewrite.test.ts": 88,
+      "src/main/ipc/parcel-watcher-shallow-subscription.test.ts": 54,
+      "src/main/ipc/parcel-watcher-supervisor-capacity-wait.test.ts": 254,
+      "src/main/ipc/parcel-watcher-supervisor-capacity.test.ts": 244,
+      "src/main/ipc/parcel-watcher-unsubscribe-timeout.test.ts": 113,
+      "src/main/ipc/pet-bundle.test.ts": 60,
+      "src/main/ipc/pet.test.ts": 252,
+      "src/main/ipc/plugin-marketplaces.test.ts": 227,
+      "src/main/ipc/plugins.test.ts": 258,
+      "src/main/ipc/preflight-agent-detection-no-subprocess.test.ts": 249,
+      "src/main/ipc/preflight-agent-detection.test.ts": 212,
+      "src/main/ipc/preflight-agent-refresh.test.ts": 190,
+      "src/main/ipc/preflight-command-exec.test.ts": 59,
+      "src/main/ipc/preflight-host-cli-status.test.ts": 311,
+      "src/main/ipc/preflight-remote-ssh.test.ts": 137,
+      "src/main/ipc/preflight-windows-path-refresh.repro.test.ts": 69,
+      "src/main/ipc/preflight-wsl-agent-detection.test.ts": 151,
+      "src/main/ipc/preflight-wsl-command.test.ts": 43,
+      "src/main/ipc/pty-activation-inventory-scope.test.ts": 1650,
+      "src/main/ipc/pty-applied-size-reporting.test.ts": 1519,
+      "src/main/ipc/pty-buffer-snapshot-dispatch.test.ts": 1738,
+      "src/main/ipc/pty-codex-account-attribution.test.ts": 1477,
+      "src/main/ipc/pty-controller-owner-recovery.test.ts": 1749,
+      "src/main/ipc/pty-controller-ownership-routing.test.ts": 1531,
+      "src/main/ipc/pty-controller-process-inventory.test.ts": 1860,
+      "src/main/ipc/pty-controller-spawn-admission.test.ts": 3580,
+      "src/main/ipc/pty-cumulative-ack-accounting.test.ts": 1219,
+      "src/main/ipc/pty-daemon-controller-teardown.test.ts": 2798,
+      "src/main/ipc/pty-daemon-spawn-agent-home-env.test.ts": 2463,
+      "src/main/ipc/pty-daemon-spawn-codex-auth.test.ts": 1802,
+      "src/main/ipc/pty-daemon-spawn-session-identity.test.ts": 2434,
+      "src/main/ipc/pty-daemon-spawn-wsl-runtime.test.ts": 2656,
+      "src/main/ipc/pty-daemon-ssh-lease-lifecycle.test.ts": 2110,
+      "src/main/ipc/pty-dead-owner-respawn.test.ts": 1289,
+      "src/main/ipc/pty-delivery-health-heal.test.ts": 1942,
+      "src/main/ipc/pty-dispatcher-handshake-osc-answers.test.ts": 1892,
+      "src/main/ipc/pty-encoding.test.ts": 26,
+      "src/main/ipc/pty-global-renderer-credit.test.ts": 1376,
+      "src/main/ipc/pty-hidden-at-spawn-mark.test.ts": 3652,
+      "src/main/ipc/pty-hidden-delivery-gate.test.ts": 57,
+      "src/main/ipc/pty-ipc-hidden-delivery-gate.test.ts": 3043,
+      "src/main/ipc/pty-ipc-producer-flow-control.test.ts": 1520,
+      "src/main/ipc/pty-listener-teardown-and-orphans.test.ts": 3968,
+      "src/main/ipc/pty-login-shell-startup-commands.test.ts": 1723,
+      "src/main/ipc/pty-management.test.ts": 102,
+      "src/main/ipc/pty-output-batching-drain.test.ts": 1696,
+      "src/main/ipc/pty-output-drain-rounds.test.ts": 1804,
+      "src/main/ipc/pty-pane-claim-arbitration.test.ts": 4553,
+      "src/main/ipc/pty-pane-materialization-race.test.ts": 2447,
+      "src/main/ipc/pty-pane-reservation-settlement.test.ts": 1450,
+      "src/main/ipc/pty-pane-restart-replace.test.ts": 1575,
+      "src/main/ipc/pty-pending-data-drain-queue-differential.test.ts": 2040,
+      "src/main/ipc/pty-pending-data-drain-queue.test.ts": 59,
+      "src/main/ipc/pty-pending-data-drain-scheduler-differential.test.ts": 99,
+      "src/main/ipc/pty-pending-output-cap.test.ts": 1823,
+      "src/main/ipc/pty-pending-projection-admissions.test.ts": 95,
+      "src/main/ipc/pty-persisted-incarnation-repair.test.ts": 940,
+      "src/main/ipc/pty-producer-flow-control.test.ts": 44,
+      "src/main/ipc/pty-renderer-inflight-credit.test.ts": 1965,
+      "src/main/ipc/pty-renderer-lifecycle-delivery-reset.test.ts": 1732,
+      "src/main/ipc/pty-renderer-liveness-guard.test.ts": 1889,
+      "src/main/ipc/pty-renderer-send-failure-recovery.test.ts": 1697,
+      "src/main/ipc/pty-restore-record-seeding.test.ts": 4503,
+      "src/main/ipc/pty-restored-appimage-cli-shim-refresh.test.ts": 1001,
+      "src/main/ipc/pty-runtime-hidden-at-spawn-mark.test.ts": 2902,
+      "src/main/ipc/pty-runtime-kill-and-exit.test.ts": 1637,
+      "src/main/ipc/pty-runtime-ssh-binding-persistence.test.ts": 1369,
+      "src/main/ipc/pty-serializer-settlement-mapping.test.ts": 4239,
+      "src/main/ipc/pty-session-liveness-and-ownership.test.ts": 1832,
+      "src/main/ipc/pty-spawn-codex-home-unavailable.test.ts": 880,
+      "src/main/ipc/pty-spawn-cwd-fallback.test.ts": 2294,
+      "src/main/ipc/pty-spawn-env-agent-overlays.test.ts": 1925,
+      "src/main/ipc/pty-spawn-env-codex-home-routing.test.ts": 1578,
+      "src/main/ipc/pty-spawn-env-codex-resume-provenance.test.ts": 1188,
+      "src/main/ipc/pty-spawn-env-terminal-basics.test.ts": 2674,
+      "src/main/ipc/pty-spawn-pi-owner-env.test.ts": 2317,
+      "src/main/ipc/pty-spawn-runtime-handle-binding.test.ts": 2425,
+      "src/main/ipc/pty-spawn-timing.test.ts": 74,
+      "src/main/ipc/pty-ssh-stop-verdict.test.ts": 1688,
+      "src/main/ipc/pty-ssh-undelivered-kill.test.ts": 1930,
+      "src/main/ipc/pty-startup-barrier-and-listing.test.ts": 1269,
+      "src/main/ipc/pty-startup-barrier-ordering.test.ts": 32,
+      "src/main/ipc/pty-startup-swap-window-presence.test.ts": 1724,
+      "src/main/ipc/pty-windows-shell-selection.test.ts": 1559,
+      "src/main/ipc/pty-write-ipc-validation.test.ts": 1475,
+      "src/main/ipc/pty-wsl-cwd-validation.test.ts": 1804,
+      "src/main/ipc/pty/configured-terminal-shell-args.test.ts": 52,
+      "src/main/ipc/pty/daemon-late-exit.test.ts": 3152,
+      "src/main/ipc/pty/delivery/attached-pty-size.test.ts": 36,
+      "src/main/ipc/pty/host-env/omp-launch-environment.test.ts": 84,
+      "src/main/ipc/pty/ipc/spawn-commit-ssh-lease-cardinality.test.ts": 1617,
+      "src/main/ipc/pty/ipc/spawn-options-terminal-shell-args.test.ts": 672,
+      "src/main/ipc/pty/ipc/spawn-push-target-materialization-real-git.test.ts": 811,
+      "src/main/ipc/pty/ipc/spawn-push-target-materialization.test.ts": 67,
+      "src/main/ipc/pty/ipc/spawn-reattach-size-cache.test.ts": 814,
+      "src/main/ipc/pty/ipc/write-input-chunk-yield.test.ts": 66,
+      "src/main/ipc/pty/pane/launch-authority.test.ts": 82,
+      "src/main/ipc/pty/pane/stable-pane-absence-death-certificate.test.ts": 2925,
+      "src/main/ipc/pty/pane/stable-pane-relay-absence-respawn.test.ts": 692,
+      "src/main/ipc/pty/pty-spawn-shell-override-parity.test.ts": 127,
+      "src/main/ipc/pty/register-headless-runtime.test.ts": 43,
+      "src/main/ipc/pty/register-without-renderer.test.ts": 3683,
+      "src/main/ipc/pty/runtime/queried-host-kinds.test.ts": 212,
+      "src/main/ipc/pty/runtime/spawn-commit-pty-size.test.ts": 1027,
+      "src/main/ipc/pty/runtime/spawn-preflight-requested-shell.test.ts": 970,
+      "src/main/ipc/rate-limits.test.ts": 73,
+      "src/main/ipc/readdir-error-diagnostics.test.ts": 27,
+      "src/main/ipc/register-core-handlers/register-core-handlers.test.ts": 1578,
+      "src/main/ipc/registered-worktree-root-ownership.test.ts": 366,
+      "src/main/ipc/registered-worktree-root-refresh.test.ts": 122,
+      "src/main/ipc/remote-watcher-event-batch.test.ts": 49,
+      "src/main/ipc/remote-workspace-cache.test.ts": 2439,
+      "src/main/ipc/remote-workspace-connected-clients.test.ts": 70,
+      "src/main/ipc/remote-workspace-patch-queue.test.ts": 474,
+      "src/main/ipc/remote-workspace-snapshot-normalization.test.ts": 43,
+      "src/main/ipc/remote-workspace-stale-resync.test.ts": 1371,
+      "src/main/ipc/remote-workspace.test.ts": 292,
+      "src/main/ipc/renderer-lifetime-abort.test.ts": 53,
+      "src/main/ipc/renderer-shutdown-checkpoint.test.ts": 62,
+      "src/main/ipc/renderer-terminal-serializer-readiness.test.ts": 59,
+      "src/main/ipc/repos-add-linked-worktree.test.ts": 1070,
+      "src/main/ipc/repos-create.test.ts": 966,
+      "src/main/ipc/repos-execution-host-catalog.test.ts": 943,
+      "src/main/ipc/repos-local-add-and-project-setup.test.ts": 1193,
+      "src/main/ipc/repos-local-clone-lifecycle.test.ts": 1467,
+      "src/main/ipc/repos-nested-import.test.ts": 1374,
+      "src/main/ipc/repos-nested-scan.test.ts": 586,
+      "src/main/ipc/repos-picker.test.ts": 1130,
+      "src/main/ipc/repos-remote-base-ref-queries.test.ts": 1008,
+      "src/main/ipc/repos-remote-client-events.test.ts": 1549,
+      "src/main/ipc/repos-remote-git-username.test.ts": 940,
+      "src/main/ipc/repos-remote.test.ts": 958,
+      "src/main/ipc/repos-sparse-presets.test.ts": 1305,
+      "src/main/ipc/repos/remote-repo-registration.test.ts": 230,
+      "src/main/ipc/repos/repo-creation-git-availability.test.ts": 150,
+      "src/main/ipc/runtime-agent-launch-capability.test.ts": 2099,
+      "src/main/ipc/runtime-environment-browser-client-host-handler.test.ts": 179,
+      "src/main/ipc/runtime-environment-capability-evidence.test.ts": 31,
+      "src/main/ipc/runtime-environment-cli-removal-routing.test.ts": 212,
+      "src/main/ipc/runtime-environment-diagnostics-broadcast.test.ts": 42,
+      "src/main/ipc/runtime-environment-federated-read-routing.test.ts": 233,
+      "src/main/ipc/runtime-environment-federated-read-transport.bench.test.ts": 163,
+      "src/main/ipc/runtime-environment-removal-storage.test.ts": 810,
+      "src/main/ipc/runtime-environment-request-connections.test.ts": 1502,
+      "src/main/ipc/runtime-environment-revision-guard.test.ts": 48,
+      "src/main/ipc/runtime-environment-status-connection.test.ts": 637,
+      "src/main/ipc/runtime-environment-status-recovery.test.ts": 246,
+      "src/main/ipc/runtime-environment-support-routing.test.ts": 361,
+      "src/main/ipc/runtime-environment-transport-generation.test.ts": 45,
+      "src/main/ipc/runtime-environment-transport-routing-tailscale-hint.test.ts": 1055,
+      "src/main/ipc/runtime-environments-call-routing.test.ts": 626,
+      "src/main/ipc/runtime-environments-capability-cache.test.ts": 482,
+      "src/main/ipc/runtime-environments-pairing.test.ts": 1362,
+      "src/main/ipc/runtime-environments-status-diagnostics.test.ts": 637,
+      "src/main/ipc/runtime-environments-subscription-lifecycle.test.ts": 989,
+      "src/main/ipc/runtime-environments-subscription-routing.test.ts": 524,
+      "src/main/ipc/runtime-environments-subscription-teardown.test.ts": 324,
+      "src/main/ipc/runtime-import-limits.test.ts": 46,
+      "src/main/ipc/runtime-subscribe-lifecycle.test.ts": 2028,
+      "src/main/ipc/runtime-upload-file-stream.test.ts": 167,
+      "src/main/ipc/runtime-upload-slice-boundaries.test.ts": 352,
+      "src/main/ipc/runtime-upload-temp-sweep.test.ts": 1063,
+      "src/main/ipc/runtime-watcher-pending-assignment.test.ts": 307,
+      "src/main/ipc/runtime-watcher-process-pool.test.ts": 143,
+      "src/main/ipc/runtime.test.ts": 2155,
+      "src/main/ipc/sender-scoped-request-cancellation.test.ts": 99,
+      "src/main/ipc/settings.test.ts": 4454,
+      "src/main/ipc/shallow-watch-delivery-probe-lifetime.test.ts": 58,
+      "src/main/ipc/shallow-watch-delivery-probe.test.ts": 161,
+      "src/main/ipc/shell.test.ts": 91,
+      "src/main/ipc/skill-cloud-install-ipc-schemas.test.ts": 91,
+      "src/main/ipc/skill-cloud-ipc-handlers.test.ts": 220,
+      "src/main/ipc/skill-install-management-ipc-handlers.test.ts": 178,
+      "src/main/ipc/skill-install-progress-ipc.test.ts": 35,
+      "src/main/ipc/skill-ipc-main-window.test.ts": 61,
+      "src/main/ipc/skills.test.ts": 543,
+      "src/main/ipc/source-control-ai-linked-issue.test.ts": 51,
+      "src/main/ipc/speech-worker-exit-lifetime.test.ts": 337,
+      "src/main/ipc/speech.test.ts": 75,
+      "src/main/ipc/ssh-active-relay-sessions.test.ts": 41,
+      "src/main/ipc/ssh-app-shutdown.test.ts": 1719,
+      "src/main/ipc/ssh-browse.test.ts": 737,
+      "src/main/ipc/ssh-disconnect-cancellation.test.ts": 3816,
+      "src/main/ipc/ssh-handler-reregistration.test.ts": 2634,
+      "src/main/ipc/ssh-host-partition-session-export.test.ts": 1162,
+      "src/main/ipc/ssh-passphrase.test.ts": 137,
+      "src/main/ipc/ssh-pty-closed-generation-ranges.test.ts": 67,
+      "src/main/ipc/ssh-pty-consumer-identity.test.ts": 3105,
+      "src/main/ipc/ssh-pty-legacy-projection.test.ts": 62,
+      "src/main/ipc/ssh-pty-model-admission-generation-scope.test.ts": 58,
+      "src/main/ipc/ssh-pty-model-admission.test.ts": 76,
+      "src/main/ipc/ssh-pty-output-exit-deadline.test.ts": 83,
+      "src/main/ipc/ssh-pty-output-generation-guard.test.ts": 48,
+      "src/main/ipc/ssh-pty-output-intake.test.ts": 165,
+      "src/main/ipc/ssh-pty-output-model-migration.test.ts": 109,
+      "src/main/ipc/ssh-pty-remote-source-range-consumers.test.ts": 85,
+      "src/main/ipc/ssh-pty-source-ack-coalescer.test.ts": 48,
+      "src/main/ipc/ssh-pty-source-ack-session-contract.test.ts": 62,
+      "src/main/ipc/ssh-pty-source-obligation-coordinator.test.ts": 45,
+      "src/main/ipc/ssh-pty-source-obligation-ledger.test.ts": 170,
+      "src/main/ipc/ssh-relay-reset-resume.test.ts": 3804,
+      "src/main/ipc/ssh-state-broadcast-fanout.test.ts": 2574,
+      "src/main/ipc/ssh-target-registry.test.ts": 3704,
+      "src/main/ipc/ssh-terminate-sessions.test.ts": 3008,
+      "src/main/ipc/ssh.test.ts": 2028,
+      "src/main/ipc/telemetry.test.ts": 230,
+      "src/main/ipc/terminal-git-credential-guard.test.ts": 82,
+      "src/main/ipc/terminal-preview-output-stream.test.ts": 28,
+      "src/main/ipc/terminal-preview.test.ts": 242,
+      "src/main/ipc/terminal-render-desync-evidence.test.ts": 63,
+      "src/main/ipc/terminal-startup-color-query-replies.test.ts": 138,
+      "src/main/ipc/tui-agent-detection-commands.test.ts": 44,
+      "src/main/ipc/ui.test.ts": 84,
+      "src/main/ipc/usage-provider-handlers.test.ts": 44,
+      "src/main/ipc/watched-worktree-catalog-notification.test.ts": 71,
+      "src/main/ipc/watcher-event-root-path-rewrite.test.ts": 61,
+      "src/main/ipc/watcher-removal-gate.test.ts": 37,
+      "src/main/ipc/workspace-cleanup-activity.test.ts": 80,
+      "src/main/ipc/workspace-cleanup-broad-scan.test.ts": 531,
+      "src/main/ipc/workspace-cleanup-execution-host-routing.test.ts": 305,
+      "src/main/ipc/workspace-cleanup-local-git-routing.test.ts": 461,
+      "src/main/ipc/workspace-cleanup-snapshot-ipc.test.ts": 114,
+      "src/main/ipc/workspace-cleanup.test.ts": 4644,
+      "src/main/ipc/workspace-create-error-classifier.test.ts": 52,
+      "src/main/ipc/workspace-ports.test.ts": 103,
+      "src/main/ipc/workspace-space.test.ts": 63,
+      "src/main/ipc/worktree-base-directory-change-collector.test.ts": 42,
+      "src/main/ipc/worktree-base-directory-event-filter.test.ts": 61,
+      "src/main/ipc/worktree-base-directory-poller-marker-fanout.test.ts": 219,
+      "src/main/ipc/worktree-base-directory-poller.test.ts": 2702,
+      "src/main/ipc/worktree-base-directory-watch-targets.test.ts": 388,
+      "src/main/ipc/worktree-base-directory-watcher.test.ts": 454,
+      "src/main/ipc/worktree-create-lineage.test.ts": 570,
+      "src/main/ipc/worktree-folder-rename-target.test.ts": 65,
+      "src/main/ipc/worktree-git-common-polling.test.ts": 1240,
+      "src/main/ipc/worktree-git-common-watch.test.ts": 2604,
+      "src/main/ipc/worktree-git-status-ref-watch.test.ts": 40,
+      "src/main/ipc/worktree-head-identity-reader-concurrency.test.ts": 72,
+      "src/main/ipc/worktree-head-identity-reader-incremental.test.ts": 255,
+      "src/main/ipc/worktree-head-identity-reader.test.ts": 99,
+      "src/main/ipc/worktree-head-identity-refresh.test.ts": 84,
+      "src/main/ipc/worktree-head-identity-retirement.test.ts": 80,
+      "src/main/ipc/worktree-include-copy-budget.test.ts": 119,
+      "src/main/ipc/worktree-logic-created-agent.test.ts": 82,
+      "src/main/ipc/worktree-logic-wsl.test.ts": 102,
+      "src/main/ipc/worktree-logic.test.ts": 185,
+      "src/main/ipc/worktree-metadata-merge.test.ts": 60,
+      "src/main/ipc/worktree-path-deduplication.test.ts": 69,
+      "src/main/ipc/worktree-push-target-cleanup.test.ts": 182,
+      "src/main/ipc/worktree-push-target-reconciliation-real-git.test.ts": 862,
+      "src/main/ipc/worktree-push-target-reconciliation.test.ts": 305,
+      "src/main/ipc/worktree-push-target-refspec-migration.test.ts": 178,
+      "src/main/ipc/worktree-push-target-refspec-real-git.test.ts": 2471,
+      "src/main/ipc/worktree-push-target-remote-scan.test.ts": 135,
+      "src/main/ipc/worktree-push-target-setup.test.ts": 223,
+      "src/main/ipc/worktree-remote-push-target-materialization.test.ts": 717,
+      "src/main/ipc/worktree-remote-ssh-branch-conflict.test.ts": 500,
+      "src/main/ipc/worktree-symlink-reconciliation.real.test.ts": 239,
+      "src/main/ipc/worktree-symlinks.test.ts": 136,
+      "src/main/ipc/worktree-watcher-removal-binding.test.ts": 150,
+      "src/main/ipc/worktrees-authoritative-local-metadata-pruning.test.ts": 1279,
+      "src/main/ipc/worktrees-canonical-ssh-listing.test.ts": 577,
+      "src/main/ipc/worktrees-create-execution-host-routing.test.ts": 588,
+      "src/main/ipc/worktrees-create-metadata-persistence.test.ts": 1369,
+      "src/main/ipc/worktrees-delete-pty-teardown.test.ts": 536,
+      "src/main/ipc/worktrees-detected-scan-cache.test.ts": 1356,
+      "src/main/ipc/worktrees-discovery-metadata-backfill.test.ts": 452,
+      "src/main/ipc/worktrees-existing-branch-checkout.test.ts": 1249,
+      "src/main/ipc/worktrees-forget-local.test.ts": 638,
+      "src/main/ipc/worktrees-issue-command-overrides.test.ts": 430,
+      "src/main/ipc/worktrees-lineage-hydration.test.ts": 886,
+      "src/main/ipc/worktrees-listing-fallback-rows.test.ts": 778,
+      "src/main/ipc/worktrees-local-base-ref-resolution.test.ts": 872,
+      "src/main/ipc/worktrees-local-create-flow.test.ts": 922,
+      "src/main/ipc/worktrees-mutation-scan-generation-order.test.ts": 971,
+      "src/main/ipc/worktrees-orphan-directory-cleanup.test.ts": 933,
+      "src/main/ipc/worktrees-preserved-branch-fork-remote.test.ts": 816,
+      "src/main/ipc/worktrees-removal-recovery.test.ts": 1234,
+      "src/main/ipc/worktrees-remove-archive-hooks.test.ts": 1347,
+      "src/main/ipc/worktrees-remove-host-disambiguation.test.ts": 868,
+      "src/main/ipc/worktrees-remove-preflight.test.ts": 840,
+      "src/main/ipc/worktrees-setup-launch-sparse-checkout.test.ts": 664,
+      "src/main/ipc/worktrees-ssh-base-ref-resolution.test.ts": 917,
+      "src/main/ipc/worktrees-ssh-branch-conflict-suffixing.test.ts": 925,
+      "src/main/ipc/worktrees-ssh-create-base-prefetch.test.ts": 717,
+      "src/main/ipc/worktrees-ssh-fork-push-target-remote.test.ts": 914,
+      "src/main/ipc/worktrees-ssh-local-base-refresh.test.ts": 906,
+      "src/main/ipc/worktrees-ssh-pr-head-fetch.test.ts": 768,
+      "src/main/ipc/worktrees-ssh-provider-authority.test.ts": 895,
+      "src/main/ipc/worktrees-ssh-repo-owner-resolution.test.ts": 1245,
+      "src/main/ipc/worktrees-ssh-setup-launch.test.ts": 927,
+      "src/main/ipc/worktrees-windows.test.ts": 1052,
+      "src/main/ipc/worktrees-wsl-runtime-routing.test.ts": 812,
+      "src/main/ipc/worktrees/listing/detected-provider-listing-catalog-version.test.ts": 107,
+      "src/main/ipc/worktrees/listing/detected-provider-listing-meta-index.test.ts": 358,
+      "src/main/ipc/worktrees/listing/detected-provider-listing-overtaken-scan.test.ts": 127,
+      "src/main/ipc/worktrees/listing/detected-scan-failure-authority.test.ts": 431,
+      "src/main/ipc/worktrees/listing/detected-worktree-classification.test.ts": 148,
+      "src/main/ipc/worktrees/listing/detected-worktree-scan-hygiene-gate.test.ts": 55,
+      "src/main/ipc/worktrees/listing/detected-worktree-scan-superseded.test.ts": 89,
+      "src/main/ipc/worktrees/listing/register-sparse-checkout-cache-invalidation.test.ts": 168,
+      "src/main/ipc/worktrees/metadata/workspace-lineage-candidate-scan.test.ts": 54,
+      "src/main/ipc/worktrees/removal/remove-unregistered-worktree-host-home.test.ts": 99,
+      "src/main/ipc/worktrees/removal/worktree-archive-hook.test.ts": 211,
+      "src/main/issue-command-ignore.test.ts": 395,
+      "src/main/jira/adf-markdown.test.ts": 58,
+      "src/main/jira/attachment-image-cache-generation.test.ts": 46,
+      "src/main/jira/attachment-image-cache.test.ts": 47,
+      "src/main/jira/attachment-images.test.ts": 82,
+      "src/main/jira/client.test.ts": 304,
+      "src/main/jira/issues.test.ts": 172,
+      "src/main/jira/jira-issue-mutations.test.ts": 56,
+      "src/main/jira/jira-issue-summary-timeout.test.ts": 78,
+      "src/main/jira/jira-search-abort.test.ts": 42,
+      "src/main/keybindings/keybinding-file.test.ts": 119,
+      "src/main/keybindings/keybinding-service.test.ts": 140,
+      "src/main/kimi/hook-service-config-delete-race.test.ts": 124,
+      "src/main/kimi/hook-service-mode-read-failure.test.ts": 86,
+      "src/main/kimi/hook-service.test.ts": 161,
+      "src/main/kimi/kimi-hook-config-toml.test.ts": 94,
+      "src/main/kimi/kimi-runtime-home.test.ts": 62,
+      "src/main/lib/unread-response-body.test.ts": 92,
+      "src/main/line-editor-ready-output-scanner.test.ts": 55,
+      "src/main/linear/client.test.ts": 107,
+      "src/main/linear/issue-context-client.test.ts": 61,
+      "src/main/linear/issue-context-current.test.ts": 63,
+      "src/main/linear/issue-context-errors.test.ts": 52,
+      "src/main/linear/issue-context-includes.test.ts": 66,
+      "src/main/linear/issue-context-inline-media.test.ts": 76,
+      "src/main/linear/issue-context-relations.test.ts": 37,
+      "src/main/linear/issue-context.test.ts": 66,
+      "src/main/linear/issue-list-filter.test.ts": 44,
+      "src/main/linear/issue-relation-write.test.ts": 79,
+      "src/main/linear/issue-search-summary.test.ts": 50,
+      "src/main/linear/issues.test.ts": 114,
+      "src/main/linear/linear-workspace-registry.test.ts": 39,
+      "src/main/linear/mappers.test.ts": 53,
+      "src/main/linear/mcp-issue-list-pagination.test.ts": 93,
+      "src/main/linear/mcp-issue-list.test.ts": 105,
+      "src/main/linear/projects.test.ts": 369,
+      "src/main/linear/teams.test.ts": 84,
+      "src/main/linux-lid-sleep-assertion.test.ts": 93,
+      "src/main/linux-package-install-command.test.ts": 46,
+      "src/main/linux-package-install-diagnostic.test.ts": 79,
+      "src/main/linux-package-update-recovery.test.ts": 361,
+      "src/main/linux-update-package-type.test.ts": 98,
+      "src/main/local-builds/local-build-candidate.test.ts": 265,
+      "src/main/local-builds/local-build-compatibility-contract.test.ts": 162,
+      "src/main/local-builds/local-build-feed-server.test.ts": 191,
+      "src/main/local-downloaded-folder-promotion.test.ts": 185,
+      "src/main/local-worktree-filesystem-wsl-banner.wsl.test.ts": 54,
+      "src/main/local-worktree-filesystem.test.ts": 348,
+      "src/main/local-worktree-metadata-prune-gate.test.ts": 60,
+      "src/main/local-worktree-path-presence.test.ts": 77,
+      "src/main/local-worktree-removal-recovery-live.test.ts": 198,
+      "src/main/local-worktree-removal-recovery.test.ts": 123,
+      "src/main/localhost-worktree-label-proxy.test.ts": 141,
+      "src/main/macos-full-disk-access-status.test.ts": 54,
+      "src/main/macos-keychain/generic-password.test.ts": 61,
+      "src/main/macos-press-and-hold-default.defaults-domain.test.ts": 51,
+      "src/main/macos-press-and-hold-default.test.ts": 95,
+      "src/main/macos-system-sleep-assertion.test.ts": 73,
+      "src/main/macos-tcc-prompt-notice.test.ts": 61,
+      "src/main/macos-tcc-prompt-watch.test.ts": 66,
+      "src/main/macos-tcc-reset.test.ts": 41,
+      "src/main/main-process-tree-kill-gate.test.ts": 378,
+      "src/main/memory/collector-windows-sweep.test.ts": 455,
+      "src/main/memory/collector.test.ts": 333,
+      "src/main/memory/host-memory.test.ts": 78,
+      "src/main/memory/hydrate-local-pty-registry.test.ts": 774,
+      "src/main/memory/memory-snapshot-buckets.test.ts": 56,
+      "src/main/memory/process-memory-metric.test.ts": 49,
+      "src/main/memory/windows-process-sample-parsing.test.ts": 95,
+      "src/main/menu/gpu-acceleration-about-panel.test.ts": 30,
+      "src/main/menu/register-app-menu.test.ts": 65,
+      "src/main/mimo/hook-service.test.ts": 66,
+      "src/main/minimax/minimax-api-key-store.test.ts": 88,
+      "src/main/minimax/minimax-cookie-store.test.ts": 71,
+      "src/main/muse-usage/scanner.test.ts": 162,
+      "src/main/muse-usage/snapshot-rollups.test.ts": 49,
+      "src/main/muse-usage/store-snapshot-filtering.test.ts": 475,
+      "src/main/muse/hook-config-json.test.ts": 85,
+      "src/main/muse/hook-service.test.ts": 134,
+      "src/main/native-chat/agent-model-catalog/agent-model-catalog-service.test.ts": 59,
+      "src/main/native-chat/agent-model-catalog/agent-model-catalog-store.test.ts": 550,
+      "src/main/native-chat/agent-model-catalog/agent-project-model-override.test.ts": 52,
+      "src/main/native-chat/agent-session-journal/journal-corruption-repair.test.ts": 355,
+      "src/main/native-chat/agent-session-journal/journal-crash-boundary.test.ts": 346,
+      "src/main/native-chat/agent-session-journal/journal-cursor.test.ts": 54,
+      "src/main/native-chat/agent-session-journal/journal-database.test.ts": 177,
+      "src/main/native-chat/agent-session-journal/journal-dispatch-observation.test.ts": 45,
+      "src/main/native-chat/agent-session-journal/journal-dispatch-reason-bound.test.ts": 246,
+      "src/main/native-chat/agent-session-journal/journal-epoch-replacement.test.ts": 234,
+      "src/main/native-chat/agent-session-journal/journal-file-format-remnant.test.ts": 269,
+      "src/main/native-chat/agent-session-journal/journal-handle-ownership.test.ts": 5325,
+      "src/main/native-chat/agent-session-journal/journal-item-identity.test.ts": 64,
+      "src/main/native-chat/agent-session-journal/journal-legacy-import-source-bound.test.ts": 236,
+      "src/main/native-chat/agent-session-journal/journal-legacy-import.test.ts": 451,
+      "src/main/native-chat/agent-session-journal/journal-producer-inheritance.test.ts": 238,
+      "src/main/native-chat/agent-session-journal/journal-reducer.test.ts": 155,
+      "src/main/native-chat/agent-session-journal/journal-restart-reconciliation.test.ts": 324,
+      "src/main/native-chat/agent-session-journal/journal-row-context-usage.test.ts": 232,
+      "src/main/native-chat/agent-session-journal/journal-row-schema-version.test.ts": 248,
+      "src/main/native-chat/agent-session-journal/journal-row-schema.test.ts": 127,
+      "src/main/native-chat/agent-session-journal/journal-row-writer.test.ts": 187,
+      "src/main/native-chat/agent-session-journal/journal-store-close.test.ts": 249,
+      "src/main/native-chat/agent-session-journal/journal-store-schema.test.ts": 222,
+      "src/main/native-chat/agent-session-journal/journal-store.test.ts": 401,
+      "src/main/native-chat/agent-session-journal/journal-streaming-replay.test.ts": 1019,
+      "src/main/native-chat/agent-session-journal/journal-subagent-liveness.test.ts": 243,
+      "src/main/native-chat/agent-session-wire/agent-session-conversation-outline.test.ts": 200,
+      "src/main/native-chat/agent-session-wire/agent-session-delta-coalescer-protected.test.ts": 40,
+      "src/main/native-chat/agent-session-wire/agent-session-delta-coalescer.test.ts": 41,
+      "src/main/native-chat/agent-session-wire/agent-session-empty-delta-retention.test.ts": 173,
+      "src/main/native-chat/agent-session-wire/agent-session-history-byte-accounting.test.ts": 497,
+      "src/main/native-chat/agent-session-wire/agent-session-history-forward-read-budget.test.ts": 1663,
+      "src/main/native-chat/agent-session-wire/agent-session-history-page-grouping-parity.test.ts": 309,
+      "src/main/native-chat/agent-session-wire/agent-session-history-page-scaling.test.ts": 75,
+      "src/main/native-chat/agent-session-wire/agent-session-history-page.test.ts": 2331,
+      "src/main/native-chat/agent-session-wire/agent-session-journal-recovery.test.ts": 427,
+      "src/main/native-chat/agent-session-wire/agent-session-retired-provider-exit-copy-ratchet.test.ts": 1719,
+      "src/main/native-chat/agent-session-wire/provider-frame-activity.test.ts": 52,
+      "src/main/native-chat/agent-session-wire/provider-frame-disposition.test.ts": 97,
+      "src/main/native-chat/agent-session-wire/provider-turn-activity-routing.test.ts": 210,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-acquisition-options.test.ts": 1113,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-adapter-router.test.ts": 83,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-adapter.test.ts": 47,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-adopted-import.test.ts": 386,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-append-delivery.test.ts": 626,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-attach-reconciliation.test.ts": 393,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-claude-option-queue.test.ts": 687,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-claude-root-exit.test.ts": 674,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-close-retry.test.ts": 404,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-command-publication.test.ts": 556,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-conversations.test.ts": 297,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-crash-mid-start.test.ts": 1198,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-dead-generation-settlement.test.ts": 409,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-event-sink.test.ts": 259,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-eviction.test.ts": 255,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-failed-create-owner-verdict.test.ts": 514,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-failed-create-sink-release.test.ts": 766,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-forget-status.test.ts": 780,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-grouped-prompt.test.ts": 448,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-hold-resume-race.test.ts": 72,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-holds.test.ts": 300,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-host-runtime-state.test.ts": 170,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-host-teardown.test.ts": 369,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-host.test.ts": 1870,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-journal-handles.test.ts": 442,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-late-settlement.test.ts": 736,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-launch-env.test.ts": 301,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-launch-send-after-create.test.ts": 423,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-lease-renewer.test.ts": 389,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-legacy-handoff-record.test.ts": 809,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-operation-settlement.test.ts": 600,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-option-settlement.test.ts": 718,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-owed-work-release.test.ts": 1713,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-processless-reservation.test.ts": 477,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-prompt-cancel.test.ts": 255,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-provider-restore.test.ts": 558,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-provider-started.test.ts": 972,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-read-restore.test.ts": 370,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-readable-restorer.test.ts": 51,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-recovered-turn-clock.test.ts": 816,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-recovery-exits.test.ts": 739,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-recovery-resolution.test.ts": 297,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-refusal-retry.test.ts": 3078,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-resolved-append.test.ts": 48,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-restart-child-work.test.ts": 785,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-restart-continuation.test.ts": 330,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-restart-failure-filing.test.ts": 1273,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-restart-offer-after-reattach.test.ts": 829,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-restart-offer-endings.test.ts": 711,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-restart-ownership.test.ts": 3393,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-restart-reconcile.test.ts": 320,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-restart-restore-gate.test.ts": 48,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-restart-restore.test.ts": 131,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-restart-resume.test.ts": 354,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-restart-status-publication.test.ts": 613,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-restart-teardown.test.ts": 900,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-reveal.test.ts": 351,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-rewind.test.ts": 1675,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-send-idempotency.test.ts": 225,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-send-preparation.test.ts": 2117,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-send-restarts-failed-start.test.ts": 871,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-send-settlement.test.ts": 42,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-send.test.ts": 1405,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-settled-attach-retry.test.ts": 812,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-shown-work.test.ts": 358,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-stale-turn-verdict.test.ts": 271,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-startup-failure-exit.test.ts": 168,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-status-feed-child-work.test.ts": 288,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-status-feed-clock.test.ts": 311,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-status-feed.test.ts": 699,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-status-ownership.test.ts": 99,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-status-reentry.test.ts": 791,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-subagent-recency.test.ts": 1004,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-subscribers.test.ts": 551,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-surface-lifetime.test.ts": 2023,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-task-queue.test.ts": 89,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-thread-goal.test.ts": 284,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-turn-completion-feed.test.ts": 67,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-turns.test.ts": 295,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-unanswered-dispatch-release.test.ts": 405,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-unexpected-exit.test.ts": 127,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-wedged-profile-migration.test.ts": 2947,
+      "src/main/native-chat/agent-session-wire/structured-agent-session-wire-admission.test.ts": 643,
+      "src/main/native-chat/agent-session-wire/structured-conversation-command-admission.test.ts": 57,
+      "src/main/native-chat/agent-session-wire/structured-conversation-command.test.ts": 1455,
+      "src/main/native-chat/agent-session-wire/structured-conversation-replacements.test.ts": 330,
+      "src/main/native-chat/agent-session-wire/structured-rewind-journal-body.test.ts": 123,
+      "src/main/native-chat/agent-session-wire/structured-session-compaction.test.ts": 36,
+      "src/main/native-chat/agent-session-wire/unhandled-provider-frame.test.ts": 64,
+      "src/main/native-chat/claude-structured-managed-account-support.test.ts": 37,
+      "src/main/native-chat/host-readable-transcript-path-fs-gate.test.ts": 257,
+      "src/main/native-chat/host-readable-transcript-path.test.ts": 89,
+      "src/main/native-chat/native-chat-file-provenance.test.ts": 134,
+      "src/main/native-chat/session-file-resolver-claude-roots.test.ts": 131,
+      "src/main/native-chat/session-file-resolver-codex-roots.test.ts": 66,
+      "src/main/native-chat/session-file-resolver-wsl-scan-gate.test.ts": 95,
+      "src/main/native-chat/session-file-resolver-wsl.test.ts": 92,
+      "src/main/native-chat/session-file-resolver.test.ts": 108,
+      "src/main/native-chat/structured-agent-session-create-support.test.ts": 39,
+      "src/main/native-chat/structured-agent-session-history-adoption.test.ts": 141,
+      "src/main/native-chat/subagent-entry-id-bounds.test.ts": 37,
+      "src/main/native-chat/transcript-fallback-id.test.ts": 47,
+      "src/main/native-chat/transcript-interruption-message.test.ts": 50,
+      "src/main/native-chat/transcript-line-decoders-claude-control-bytes.test.ts": 51,
+      "src/main/native-chat/transcript-line-decoders-claude-image-companion.test.ts": 81,
+      "src/main/native-chat/transcript-line-decoders-codex-skill-context.test.ts": 48,
+      "src/main/native-chat/transcript-line-decoders.grok.test.ts": 64,
+      "src/main/native-chat/transcript-line-decoders.omp.test.ts": 95,
+      "src/main/native-chat/transcript-read-cache-inflight.test.ts": 512,
+      "src/main/native-chat/transcript-read-cache-refusal-recovery.test.ts": 135,
+      "src/main/native-chat/transcript-read-cache-wsl-stall.test.ts": 58,
+      "src/main/native-chat/transcript-read-cache.test.ts": 193,
+      "src/main/native-chat/transcript-reader-codex-history-mode.test.ts": 132,
+      "src/main/native-chat/transcript-reader-wsl-stall.test.ts": 114,
+      "src/main/native-chat/transcript-reader.test.ts": 176,
+      "src/main/native-chat/transcript-stream-lines.test.ts": 83,
+      "src/main/native-chat/transcript-tail-reader-cancellation.test.ts": 210,
+      "src/main/native-chat/transcript-tail-reader-wsl-gate.test.ts": 91,
+      "src/main/native-chat/transcript-turn-lifecycle.test.ts": 95,
+      "src/main/native-chat/transcript-watch-engine-wsl-lifecycle.test.ts": 217,
+      "src/main/native-chat/transcript-watch-error.test.ts": 2170,
+      "src/main/native-chat/transcript-watch-liveness.test.ts": 762,
+      "src/main/native-chat/transcript-watch-resolve-poll.test.ts": 203,
+      "src/main/native-chat/transcript-watch-unflushed-settle.test.ts": 201,
+      "src/main/native-chat/transcript-watch-unsubscribe-race.test.ts": 133,
+      "src/main/native-chat/transcript-watch-wsl-exact-path.test.ts": 105,
+      "src/main/native-chat/transcript-watch-wsl-stall.test.ts": 170,
+      "src/main/native-chat/transcript-watch.test.ts": 3388,
+      "src/main/native-chat/transcript-window-tool-attribution.test.ts": 146,
+      "src/main/native-chat/wsl-codex-session-path-scan.test.ts": 100,
+      "src/main/native-chat/wsl-transcript-fs-access.test.ts": 147,
+      "src/main/native-chat/wsl-transcript-fs-gate.test.ts": 538,
+      "src/main/native-chat/wsl-transcript-fs-process-client.test.ts": 79,
+      "src/main/native-chat/wsl-transcript-fs-process-operations.test.ts": 38,
+      "src/main/native-chat/wsl-transcript-fs-route-quarantine.test.ts": 76,
+      "src/main/native-chat/wsl-transcript-fs-route.test.ts": 44,
+      "src/main/native-chat/wsl-transcript-running-observer.test.ts": 119,
+      "src/main/network/electron-proxy-request-guard.test.ts": 351,
+      "src/main/network/macos-system-resolver-health.test.ts": 74,
+      "src/main/network/macos-tailscale-dns-diagnostic.test.ts": 47,
+      "src/main/network/proxy-settings-session.test.ts": 837,
+      "src/main/network/proxy-settings.test.ts": 90,
+      "src/main/notebook/notebook-kernel.test.ts": 160,
+      "src/main/notebook/python-environments.test.ts": 82,
+      "src/main/notifications/announced-notification-registry.test.ts": 38,
+      "src/main/notifications/desktop-away-state.test.ts": 54,
+      "src/main/notifications/notification-delivery-service.test.ts": 69,
+      "src/main/observability/architecture.test.ts": 56,
+      "src/main/observability/bundle.test.ts": 471,
+      "src/main/observability/diagnostic-upload-http.test.ts": 50,
+      "src/main/observability/instrumentation.test.ts": 472,
+      "src/main/observability/local-file-sink-memory.test.ts": 149,
+      "src/main/observability/local-file-sink.test.ts": 84,
+      "src/main/observability/redactor-environment-lines.test.ts": 546,
+      "src/main/observability/redactor.test.ts": 74,
+      "src/main/observability/tracer.test.ts": 74,
+      "src/main/opencode-usage/cache-read-reproduction.test.ts": 173,
+      "src/main/opencode-usage/opencode2-session-usage.test.ts": 528,
+      "src/main/opencode-usage/scanner-windows-data-directory.test.ts": 164,
+      "src/main/opencode-usage/scanner-wsl-gate.test.ts": 49,
+      "src/main/opencode-usage/scanner.test.ts": 182,
+      "src/main/opencode-usage/store.test.ts": 141,
+      "src/main/opencode/hook-plugin-background-child-completion.test.ts": 405,
+      "src/main/opencode/hook-plugin-child-attention.test.ts": 698,
+      "src/main/opencode/hook-plugin-fail-open-ownership.test.ts": 519,
+      "src/main/opencode/hook-plugin-lifecycle-delivery.test.ts": 1151,
+      "src/main/opencode/hook-plugin-message-part-throttle.test.ts": 306,
+      "src/main/opencode/hook-plugin-module-contract.test.ts": 601,
+      "src/main/opencode/hook-plugin-opencode2-session-lineage.test.ts": 1056,
+      "src/main/opencode/hook-plugin-opencode2-setup.test.ts": 1712,
+      "src/main/opencode/hook-service.test.ts": 275,
+      "src/main/opencode/opencode-client-sweep.test.ts": 66,
+      "src/main/opencode/opencode-data-directory.test.ts": 51,
+      "src/main/opencode/opencode-session-binder.test.ts": 118,
+      "src/main/opencode2/status-plugin-setup-lifetime.test.ts": 51,
+      "src/main/orca-profiles/profile-active-transfer-worker.test.ts": 2219,
+      "src/main/orca-profiles/profile-active-transfer.test.ts": 1956,
+      "src/main/orca-profiles/profile-artifact-cloud-cleanup.test.ts": 371,
+      "src/main/orca-profiles/profile-cloud-auth-config.test.ts": 57,
+      "src/main/orca-profiles/profile-cloud-auth-status.test.ts": 66,
+      "src/main/orca-profiles/profile-cloud-client.test.ts": 127,
+      "src/main/orca-profiles/profile-cloud-dev-service.test.ts": 328,
+      "src/main/orca-profiles/profile-cloud-org-members-client.test.ts": 68,
+      "src/main/orca-profiles/profile-cloud-org-members-service.test.ts": 197,
+      "src/main/orca-profiles/profile-cloud-pkce.test.ts": 620,
+      "src/main/orca-profiles/profile-cloud-refresh-replay-guard.test.ts": 53,
+      "src/main/orca-profiles/profile-cloud-service-auth-retry.test.ts": 296,
+      "src/main/orca-profiles/profile-cloud-service-connect-overlap.test.ts": 311,
+      "src/main/orca-profiles/profile-cloud-service-refresh.test.ts": 315,
+      "src/main/orca-profiles/profile-cloud-service-sign-out-connect-race.test.ts": 378,
+      "src/main/orca-profiles/profile-cloud-service.test.ts": 445,
+      "src/main/orca-profiles/profile-cloud-session-mutation.test.ts": 95,
+      "src/main/orca-profiles/profile-cloud-session-refresh.test.ts": 97,
+      "src/main/orca-profiles/profile-cloud-session-store.test.ts": 130,
+      "src/main/orca-profiles/profile-index-store.test.ts": 700,
+      "src/main/orca-profiles/profile-persistence-deadline.test.ts": 39,
+      "src/main/orca-profiles/profile-project-domain-transfer.test.ts": 1889,
+      "src/main/orca-profiles/profile-project-presence.test.ts": 408,
+      "src/main/orca-profiles/profile-project-session-field-disposition.test.ts": 190,
+      "src/main/orca-profiles/profile-project-session-state.test.ts": 175,
+      "src/main/orca-profiles/profile-project-state-file.test.ts": 264,
+      "src/main/orca-profiles/profile-project-transfer-migration.test.ts": 1155,
+      "src/main/orca-profiles/profile-project-transfer.test.ts": 1755,
+      "src/main/orca-profiles/profile-telemetry-consent-seed.test.ts": 221,
+      "src/main/orca-profiles/profile-ui-scope.test.ts": 28,
+      "src/main/orcad/electron-serve-browser-process.test.ts": 2507,
+      "src/main/orcad/electron-serve-provider-selection.test.ts": 696,
+      "src/main/orcad/electron-sidecar-method-routing.test.ts": 105,
+      "src/main/orcad/electron-sidecar-tab-registry.test.ts": 78,
+      "src/main/orcad/external-chromium-browser-process.integration.test.ts": 233,
+      "src/main/orcad/external-chromium-browser-session.test.ts": 172,
+      "src/main/orcad/main-preflight-order.test.ts": 106,
+      "src/main/orcad/native-host-abi.test.ts": 58,
+      "src/main/orcad/node-pty-prebuilt-slot.test.ts": 64,
+      "src/main/orcad/node-pty-precondition.test.ts": 310,
+      "src/main/orcad/orcad-app-paths.test.ts": 73,
+      "src/main/orcad/orcad-artifact-preflight.test.ts": 377,
+      "src/main/orcad/orcad-bind-address.test.ts": 57,
+      "src/main/orcad/orcad-browser-provider.test.ts": 336,
+      "src/main/orcad/orcad-bun-launcher.integration.test.ts": 50,
+      "src/main/orcad/orcad-bun-native-preflight.test.ts": 113,
+      "src/main/orcad/orcad-bundle-native-load-order.test.ts": 2639,
+      "src/main/orcad/orcad-bundled-runtime.integration.test.ts": 5450,
+      "src/main/orcad/orcad-bundled-runtime.test.ts": 90,
+      "src/main/orcad/orcad-daemon-supervision.test.ts": 35,
+      "src/main/orcad/orcad-entry.test.ts": 287,
+      "src/main/orcad/orcad-forked-child-paths.test.ts": 352,
+      "src/main/orcad/orcad-health.test.ts": 49,
+      "src/main/orcad/orcad-instance-lock.test.ts": 91,
+      "src/main/orcad/orcad-launch-contract.test.ts": 405,
+      "src/main/orcad/orcad-native-preflight.test.ts": 71,
+      "src/main/orcad/orcad-profile-preflight.test.ts": 246,
+      "src/main/orcad/orcad-profile-state-startup.test.ts": 55,
+      "src/main/orcad/orcad-profile-state-telemetry.test.ts": 36,
+      "src/main/orcad/orcad-push-startup.test.ts": 1287,
+      "src/main/orcad/orcad-sidecar-runtime-client.test.ts": 211,
+      "src/main/own-chromium-tree-kill-guard.test.ts": 99,
+      "src/main/persistence-async-write-syscalls.test.ts": 3167,
+      "src/main/persistence-automations.test.ts": 2205,
+      "src/main/persistence-clipboard-selection-migration.test.ts": 1235,
+      "src/main/persistence-cohort-and-identity-migration.test.ts": 1307,
+      "src/main/persistence-cross-host-pane-identity.test.ts": 1023,
+      "src/main/persistence-deregistered-repo-residue.test.ts": 1319,
+      "src/main/persistence-duplicate-repo-id-host-scope.test.ts": 1500,
+      "src/main/persistence-feature-interaction-broadcast.benchmark.test.ts": 1424,
+      "src/main/persistence-floating-terminal-trust.test.ts": 1342,
+      "src/main/persistence-flush-and-save-scheduling.test.ts": 3251,
+      "src/main/persistence-folder-workspace-notes.test.ts": 1466,
+      "src/main/persistence-host-admitted-terminal-membership.test.ts": 1200,
+      "src/main/persistence-host-partitioned-sessions.test.ts": 1016,
+      "src/main/persistence-host-partitioned-ssh-pty-bindings.test.ts": 1205,
+      "src/main/persistence-initial-load.test.ts": 1188,
+      "src/main/persistence-layout-binding-recovery.test.ts": 1127,
+      "src/main/persistence-load-repair-durability.test.ts": 693,
+      "src/main/persistence-loading-store-extraction.test.ts": 1319,
+      "src/main/persistence-loading-store-write-risks.test.ts": 1386,
+      "src/main/persistence-native-chat-tab-view-mode.test.ts": 1121,
+      "src/main/persistence-pane-identity-migration.test.ts": 28713,
+      "src/main/persistence-protected-secret-fail-closed.test.ts": 5578,
+      "src/main/persistence-protected-secret-write-race.test.ts": 1294,
+      "src/main/persistence-proxy-secret-recovery.test.ts": 1954,
+      "src/main/persistence-pty-binding-leaf-tab-resolution.test.ts": 938,
+      "src/main/persistence-pty-binding-reconciliation.test.ts": 1174,
+      "src/main/persistence-remote-session-startup.test.ts": 1128,
+      "src/main/persistence-repo-lifecycle.test.ts": 3659,
+      "src/main/persistence-right-sidebar-tab.test.ts": 1040,
+      "src/main/persistence-settings-ui-defaults.test.ts": 1660,
+      "src/main/persistence-settings-update.test.ts": 1245,
+      "src/main/persistence-single-serialize.test.ts": 2736,
+      "src/main/persistence-source-control-ai-migration.test.ts": 683,
+      "src/main/persistence-split-pane-incarnation.test.ts": 1213,
+      "src/main/persistence-ssh-lease-reattach-reclaim.test.ts": 1164,
+      "src/main/persistence-ssh-lease-tombstone-retention.test.ts": 1178,
+      "src/main/persistence-ssh-pending-pty-kill.test.ts": 1764,
+      "src/main/persistence-ssh-readoption-automation-migration.test.ts": 1863,
+      "src/main/persistence-ssh-remote-pty-binding-replay.test.ts": 799,
+      "src/main/persistence-ssh-remote-pty-leases.test.ts": 1111,
+      "src/main/persistence-ssh-targets-and-pane-keys.test.ts": 1001,
+      "src/main/persistence-terminal-option-key-migration.test.ts": 1316,
+      "src/main/persistence-ui-state.test.ts": 3909,
+      "src/main/persistence-update-repo.test.ts": 1077,
+      "src/main/persistence-workspace-pinned-automation-fence.test.ts": 1833,
+      "src/main/persistence-workspace-repin-automation-owner.test.ts": 1750,
+      "src/main/persistence-workspace-session-scrollback.test.ts": 1387,
+      "src/main/persistence-workspace-status-workflow.test.ts": 1055,
+      "src/main/persistence-worktree-card-properties.test.ts": 576,
+      "src/main/persistence-worktree-deletion-fencing.test.ts": 1370,
+      "src/main/persistence-worktree-lineage-and-backups.test.ts": 1778,
+      "src/main/persistence-worktree-meta-and-folder-workspaces.test.ts": 818,
+      "src/main/persistence-worktree-name-retirement.test.ts": 6044,
+      "src/main/persistence-worktree-visibility.test.ts": 1446,
+      "src/main/persistence/applying-settings/settings-update-machine-name.test.ts": 235,
+      "src/main/persistence/applying-settings/settings-update-terminal-contrast.test.ts": 177,
+      "src/main/persistence/applying-settings/terminal-settings-migrations.test.ts": 55,
+      "src/main/persistence/leasing-ssh-ptys/ssh-pty-binding-cleanup.test.ts": 221,
+      "src/main/persistence/loading-store/metadata-lineage-batch-pruning.test.ts": 356,
+      "src/main/persistence/loading-store/normalize-loaded-global-settings.test.ts": 261,
+      "src/main/persistence/loading-store/normalize-loaded-project-catalog.test.ts": 228,
+      "src/main/persistence/loading-store/persisted-state-redundancy.test.ts": 1195,
+      "src/main/persistence/loading-store/profile-state-caller-cancellation.test.ts": 1418,
+      "src/main/persistence/loading-store/profile-state-checkpoints.test.ts": 1468,
+      "src/main/persistence/loading-store/profile-state-direct-flush.test.ts": 776,
+      "src/main/persistence/loading-store/profile-state-import-lifetime.test.ts": 882,
+      "src/main/persistence/loading-store/profile-state-maintenance-compatibility.test.ts": 2555,
+      "src/main/persistence/loading-store/profile-state-maintenance-final-failure.test.ts": 1334,
+      "src/main/persistence/loading-store/profile-state-maintenance-recovery.test.ts": 1797,
+      "src/main/persistence/loading-store/profile-state-maintenance.test.ts": 2795,
+      "src/main/persistence/loading-store/profile-state-pty-retirement-finalization.test.ts": 3208,
+      "src/main/persistence/loading-store/profile-state-selective-serialization.test.ts": 216,
+      "src/main/persistence/loading-store/profile-state-settings-writes.test.ts": 1551,
+      "src/main/persistence/loading-store/profile-state-sqlite-authority.test.ts": 8170,
+      "src/main/persistence/loading-store/profile-state-store-backups.test.ts": 3107,
+      "src/main/persistence/loading-store/profile-state-temp-cleanup-lifetime.test.ts": 1081,
+      "src/main/persistence/loading-store/profile-state-update-quit.test.ts": 1347,
+      "src/main/persistence/loading-store/profile-state-worker-coordination.test.ts": 1583,
+      "src/main/persistence/loading-store/profile-state-worker-secret-retention.test.ts": 1293,
+      "src/main/persistence/loading-store/profile-state-write-batching.test.ts": 1364,
+      "src/main/persistence/loading-store/pty-binding-async-durability.test.ts": 1459,
+      "src/main/persistence/loading-store/pty-binding-created-surface-rollback.test.ts": 806,
+      "src/main/persistence/loading-store/pty-binding-fast-lane.test.ts": 168,
+      "src/main/persistence/loading-store/pty-binding-span.test.ts": 104,
+      "src/main/persistence/loading-store/pty-reattach-failure-routing.test.ts": 3450,
+      "src/main/persistence/loading-store/pty-retirement-async-durability.test.ts": 893,
+      "src/main/persistence/loading-store/pty-retirement-publication-during-read.test.ts": 2239,
+      "src/main/persistence/loading-store/pty-spawn-exit-durability.test.ts": 4488,
+      "src/main/persistence/loading-store/pty-spawn-handle-publication.test.ts": 3961,
+      "src/main/persistence/loading-store/pty-spawn-replacement-durability.test.ts": 4045,
+      "src/main/persistence/loading-store/pty-spawn-restore-durability.test.ts": 4185,
+      "src/main/persistence/loading-store/secret-sentinel-substitution.test.ts": 92,
+      "src/main/persistence/loading-store/ssh-lease-async-durability.test.ts": 914,
+      "src/main/persistence/loading-store/state-write-round-trip.test.ts": 1233,
+      "src/main/persistence/loading-store/store-prune-gate-signals.test.ts": 1151,
+      "src/main/persistence/loading-store/store-runtime-authored-session-writes.test.ts": 1062,
+      "src/main/persistence/loading-store/terminal-tab-pty-ownership.test.ts": 35,
+      "src/main/persistence/loading-store/workspace-session-partitions.test.ts": 252,
+      "src/main/persistence/loading-store/workspace-session-terminal-binding-replay.test.ts": 68,
+      "src/main/persistence/loading-store/worktree-meta-alias-projection.test.ts": 1809,
+      "src/main/persistence/loading-store/worktree-meta-write-normalization.test.ts": 68,
+      "src/main/persistence/profile-state-cutover-fixture.test.ts": 1259,
+      "src/main/persistence/profile-state-cutover-soak.test.ts": 1782,
+      "src/main/persistence/profile-state/legacy-json/profile-state-versioned-export.test.ts": 122,
+      "src/main/persistence/profile-state/profile-state-access-identity.test.ts": 125,
+      "src/main/persistence/profile-state/profile-state-access-process.test.ts": 706,
+      "src/main/persistence/profile-state/profile-state-access-windows-native.win32.test.ts": 50,
+      "src/main/persistence/profile-state/profile-state-access-windows.test.ts": 181,
+      "src/main/persistence/profile-state/profile-state-access.test.ts": 218,
+      "src/main/persistence/profile-state/profile-state-authority-bootstrap.test.ts": 2390,
+      "src/main/persistence/profile-state/profile-state-authority-export-fencing.test.ts": 187,
+      "src/main/persistence/profile-state/profile-state-automation-runs-equality.test.ts": 206,
+      "src/main/persistence/profile-state/profile-state-automation-runs-serialization.test.ts": 225,
+      "src/main/persistence/profile-state/profile-state-automation-storage-upgrade.test.ts": 2866,
+      "src/main/persistence/profile-state/profile-state-backup-path.test.ts": 40,
+      "src/main/persistence/profile-state/profile-state-backup-rotation.test.ts": 519,
+      "src/main/persistence/profile-state/profile-state-backup-temporary-files.test.ts": 76,
+      "src/main/persistence/profile-state/profile-state-backup-worker.test.ts": 2514,
+      "src/main/persistence/profile-state/profile-state-bootstrap-publication-race.test.ts": 1143,
+      "src/main/persistence/profile-state/profile-state-complete-domain-writes.test.ts": 324,
+      "src/main/persistence/profile-state/profile-state-crash-recovery.test.ts": 442,
+      "src/main/persistence/profile-state/profile-state-current-json-command.test.ts": 2724,
+      "src/main/persistence/profile-state/profile-state-current-sqlite-command.test.ts": 1546,
+      "src/main/persistence/profile-state/profile-state-database-export-crash.test.ts": 221,
+      "src/main/persistence/profile-state/profile-state-database-recovery.test.ts": 1228,
+      "src/main/persistence/profile-state/profile-state-database-rollback-export.test.ts": 1283,
+      "src/main/persistence/profile-state/profile-state-database-snapshot.test.ts": 1947,
+      "src/main/persistence/profile-state/profile-state-database.test.ts": 1004,
+      "src/main/persistence/profile-state/profile-state-documents.test.ts": 758,
+      "src/main/persistence/profile-state/profile-state-domain-equality.test.ts": 197,
+      "src/main/persistence/profile-state/profile-state-domain-reader.test.ts": 134,
+      "src/main/persistence/profile-state/profile-state-domain-writes.test.ts": 354,
+      "src/main/persistence/profile-state/profile-state-fragment-validation.test.ts": 978,
+      "src/main/persistence/profile-state/profile-state-json-compatibility-recovery.test.ts": 1250,
+      "src/main/persistence/profile-state/profile-state-large-recovery-crash.test.ts": 3070,
+      "src/main/persistence/profile-state/profile-state-live-store-factory.test.ts": 1747,
+      "src/main/persistence/profile-state/profile-state-offline-settings.test.ts": 286,
+      "src/main/persistence/profile-state/profile-state-parsed-snapshot.test.ts": 367,
+      "src/main/persistence/profile-state/profile-state-read-concurrency.test.ts": 112,
+      "src/main/persistence/profile-state/profile-state-recovery-batch.test.ts": 142,
+      "src/main/persistence/profile-state/profile-state-recovery-copy.test.ts": 92,
+      "src/main/persistence/profile-state/profile-state-recovery-crash-boundaries.test.ts": 34081,
+      "src/main/persistence/profile-state/profile-state-runtime-preflight.test.ts": 567,
+      "src/main/persistence/profile-state/profile-state-startup-authority.test.ts": 2198,
+      "src/main/persistence/profile-state/profile-state-startup-failure.test.ts": 1080,
+      "src/main/persistence/profile-state/profile-state-startup-recovery-dialog.test.ts": 95,
+      "src/main/persistence/profile-state/profile-state-startup-secrets.test.ts": 1403,
+      "src/main/persistence/profile-state/profile-state-startup-snapshot.test.ts": 1390,
+      "src/main/persistence/profile-state/profile-state-store-factory.test.ts": 2255,
+      "src/main/persistence/profile-state/profile-state-streaming-validation.test.ts": 246,
+      "src/main/persistence/profile-state/profile-state-worker-authority.test.ts": 1304,
+      "src/main/persistence/profile-state/profile-state-worker-export-failures.test.ts": 905,
+      "src/main/persistence/profile-state/profile-state-write-transaction.test.ts": 42,
+      "src/main/persistence/profile-state/profile-state-writer-protocol-faults.test.ts": 2015,
+      "src/main/persistence/profile-state/profile-state-writer-worker.test.ts": 1074,
+      "src/main/persistence/restoring-sessions/pane-alias-normalization-scaling.test.ts": 70,
+      "src/main/persistence/restoring-sessions/pane-alias-normalization.test.ts": 399,
+      "src/main/persistence/restoring-sessions/pane-key-remapping.test.ts": 26,
+      "src/main/persistence/restoring-sessions/session-owner-fields.test.ts": 141,
+      "src/main/persistence/restoring-sessions/session-worktree-ownership.test.ts": 205,
+      "src/main/persistence/restoring-sessions/terminal-layout-normalization.test.ts": 53,
+      "src/main/persistence/restoring-sessions/workspace-pane-normalization-index.test.ts": 69,
+      "src/main/persistence/runtime-authored-workspace-session-fields.test.ts": 51,
+      "src/main/persistence/scheduling-automations/automation-run-operations.test.ts": 62,
+      "src/main/persistence/tracking-repos/local-worktree-metadata-batch-pruning.bench.test.ts": 248,
+      "src/main/persistence/tracking-repos/local-worktree-metadata-scan-expectation.test.ts": 152,
+      "src/main/persistence/tracking-repos/missing-local-worktree-metadata-pruning.test.ts": 301,
+      "src/main/persistence/tracking-repos/probeable-local-worktree-metadata-candidates.test.ts": 218,
+      "src/main/persistence/tracking-repos/project-host-compatibility.test.ts": 36,
+      "src/main/persistence/tracking-repos/worktree-identity-migration-field-coverage.test.ts": 147,
+      "src/main/persistence/tracking-repos/worktree-metadata-normalization.test.ts": 182,
+      "src/main/pi/agent-status-completion-delivery.test.ts": 899,
+      "src/main/pi/agent-status-extension-async-subagents.test.ts": 1070,
+      "src/main/pi/agent-status-extension-nested-run-settlement.test.ts": 588,
+      "src/main/pi/agent-status-extension-omp-lifecycle.test.ts": 2513,
+      "src/main/pi/agent-status-extension-omp-model.test.ts": 1180,
+      "src/main/pi/agent-status-extension-omp-prefill.test.ts": 615,
+      "src/main/pi/agent-status-extension-source.test.ts": 2899,
+      "src/main/pi/agent-status-input-redaction.test.ts": 1930,
+      "src/main/pi/agent-status-omp-approval-forwarding.test.ts": 1049,
+      "src/main/pi/agent-status-owner-recovery.test.ts": 1135,
+      "src/main/pi/agent-status-ui-prompt.test.ts": 1344,
+      "src/main/pi/omp-model-command-source.test.ts": 619,
+      "src/main/pi/omp-session-status-owner.test.ts": 780,
+      "src/main/pi/omp-transcript-metadata.test.ts": 1593,
+      "src/main/pi/prefill-extension-source.test.ts": 36,
+      "src/main/pi/titlebar-extension-overlay-path.test.ts": 92,
+      "src/main/pi/titlebar-extension-service.test.ts": 524,
+      "src/main/pi/titlebar-extension-source.test.ts": 1416,
+      "src/main/plugins/plugin-agent-status-event.test.ts": 86,
+      "src/main/plugins/plugin-atomic-file-write.test.ts": 2056,
+      "src/main/plugins/plugin-audit-log-scaling.test.ts": 497,
+      "src/main/plugins/plugin-audit-log.test.ts": 73,
+      "src/main/plugins/plugin-bundled-bootstrap-coordinator.test.ts": 364,
+      "src/main/plugins/plugin-bundled-bootstrap.test.ts": 468,
+      "src/main/plugins/plugin-command-registry.test.ts": 271,
+      "src/main/plugins/plugin-content-pack-registry.test.ts": 303,
+      "src/main/plugins/plugin-content-safety.test.ts": 716,
+      "src/main/plugins/plugin-dev-watcher.test.ts": 165,
+      "src/main/plugins/plugin-discovery.test.ts": 193,
+      "src/main/plugins/plugin-enablement.test.ts": 194,
+      "src/main/plugins/plugin-host-conformance.test.ts": 202,
+      "src/main/plugins/plugin-host-methods.test.ts": 173,
+      "src/main/plugins/plugin-host-process.test.ts": 208,
+      "src/main/plugins/plugin-host-runtime.test.ts": 193,
+      "src/main/plugins/plugin-install-trust.test.ts": 378,
+      "src/main/plugins/plugin-install.test.ts": 787,
+      "src/main/plugins/plugin-kill-list-content-revocation.test.ts": 321,
+      "src/main/plugins/plugin-kill-list-service.test.ts": 239,
+      "src/main/plugins/plugin-language-pack-registry.test.ts": 179,
+      "src/main/plugins/plugin-launch-content.test.ts": 470,
+      "src/main/plugins/plugin-list-projection.test.ts": 145,
+      "src/main/plugins/plugin-marketplace-installer.test.ts": 480,
+      "src/main/plugins/plugin-marketplace-service.test.ts": 369,
+      "src/main/plugins/plugin-marketplace-store.test.ts": 135,
+      "src/main/plugins/plugin-panel-controller.test.ts": 210,
+      "src/main/plugins/plugin-panel-navigation-guard.test.ts": 140,
+      "src/main/plugins/plugin-panel-owner-lifecycle.test.ts": 54,
+      "src/main/plugins/plugin-panel-sessions.test.ts": 50,
+      "src/main/plugins/plugin-private-marketplace.integration.test.ts": 685,
+      "src/main/plugins/plugin-secrets-store.test.ts": 219,
+      "src/main/plugins/plugin-service-integrity.test.ts": 408,
+      "src/main/plugins/plugin-service-reconciliation.test.ts": 597,
+      "src/main/plugins/plugin-startup-budget.test.ts": 768,
+      "src/main/plugins/plugin-storage-store.test.ts": 198,
+      "src/main/plugins/plugin-uninstall-lifecycle.test.ts": 740,
+      "src/main/plugins/plugin-uninstall-log-retention.test.ts": 974,
+      "src/main/plugins/plugin-uninstall-ordering.test.ts": 967,
+      "src/main/plugins/plugin-vm-recipe-registry.test.ts": 236,
+      "src/main/plugins/plugin-worker-controller.test.ts": 393,
+      "src/main/plugins/plugin-worker-env.test.ts": 35,
+      "src/main/plugins/plugin-worker-manager.test.ts": 165,
+      "src/main/plugins/plugin-worker-output-buffer.test.ts": 54,
+      "src/main/plugins/plugin-worker-output-retention.test.ts": 229,
+      "src/main/plugins/plugin-worker-supervision.integration.test.ts": 8081,
+      "src/main/ports/advertised-url-retention.test.ts": 163,
+      "src/main/ports/advertised-url-watcher-pid-validation.test.ts": 53,
+      "src/main/ports/advertised-url-watcher.test.ts": 59,
+      "src/main/ports/local-workspace-port-scanner.test.ts": 119,
+      "src/main/ports/port-scan-command-client.test.ts": 1765,
+      "src/main/ports/port-scan-command-execution.test.ts": 5284,
+      "src/main/ports/port-scan-command-import-boundary.test.ts": 39,
+      "src/main/ports/ssh-advertised-url-enrichment.test.ts": 96,
+      "src/main/ports/workspace-port-ownership.test.ts": 36,
+      "src/main/powershell-osc133-bootstrap-windows-clm.test.ts": 84,
+      "src/main/powershell-osc133-bootstrap.test.ts": 81,
+      "src/main/project-groups/folder-workspace-path-status.test.ts": 72,
+      "src/main/project-groups/nested-repo-discovery-queue.test.ts": 201,
+      "src/main/project-groups/nested-repo-discovery.test.ts": 177,
+      "src/main/project-groups/nested-repo-glob-budget.test.ts": 841,
+      "src/main/project-groups/nested-repo-import-target.test.ts": 58,
+      "src/main/project-groups/nested-repo-import.test.ts": 58,
+      "src/main/project-groups/nested-repo-scan-rules.test.ts": 31,
+      "src/main/project-runtime-git-options.test.ts": 73,
+      "src/main/protected-secret-persistence-concurrency.test.ts": 68,
+      "src/main/protected-secret-persistence.test.ts": 50,
+      "src/main/providers/agent-foreground-process-batch.test.ts": 91,
+      "src/main/providers/agent-foreground-process-git-bash-launcher.test.ts": 87,
+      "src/main/providers/agent-foreground-process-git-bash.win32.test.ts": 196,
+      "src/main/providers/agent-foreground-process-pi.test.ts": 82,
+      "src/main/providers/agent-foreground-process-ps-scan-volume.test.ts": 105,
+      "src/main/providers/agent-foreground-process-real-rows.test.ts": 105,
+      "src/main/providers/agent-foreground-process-remote-evidence.test.ts": 81,
+      "src/main/providers/agent-foreground-process-shell-path.test.ts": 76,
+      "src/main/providers/agent-foreground-process-windows-job-rejection.test.ts": 48,
+      "src/main/providers/agent-foreground-process-wsl-shell-proof.test.ts": 108,
+      "src/main/providers/agent-foreground-process.test.ts": 149,
+      "src/main/providers/execution-host-provider-dispatch.test.ts": 33,
+      "src/main/providers/local-pty-bun-artifact.integration.test.ts": 50,
+      "src/main/providers/local-pty-bun-posix-inspection.test.ts": 238,
+      "src/main/providers/local-pty-bun-windows-identity.test.ts": 132,
+      "src/main/providers/local-pty-child-process-verdict.test.ts": 280,
+      "src/main/providers/local-pty-default-shell.test.ts": 124,
+      "src/main/providers/local-pty-foreground-inspection-cheap-tier.test.ts": 140,
+      "src/main/providers/local-pty-pending-native-spawn.test.ts": 281,
+      "src/main/providers/local-pty-pi-owner-env.test.ts": 108,
+      "src/main/providers/local-pty-provider-foreground-process.test.ts": 413,
+      "src/main/providers/local-pty-provider-io-events.test.ts": 295,
+      "src/main/providers/local-pty-provider-session-inventory.test.ts": 323,
+      "src/main/providers/local-pty-provider-shell-readiness.test.ts": 240,
+      "src/main/providers/local-pty-provider-shutdown.test.ts": 652,
+      "src/main/providers/local-pty-provider-spawn-cwd-safety.test.ts": 305,
+      "src/main/providers/local-pty-provider-spawn-env.test.ts": 308,
+      "src/main/providers/local-pty-provider-spawn-session.test.ts": 410,
+      "src/main/providers/local-pty-provider-windows-shell-launch.test.ts": 301,
+      "src/main/providers/local-pty-shell-ready-marker-scan.test.ts": 61,
+      "src/main/providers/local-pty-shell-ready-startup-command.test.ts": 66,
+      "src/main/providers/local-pty-shell-ready-wrapper-generation.test.ts": 544,
+      "src/main/providers/local-pty-shell-startup-command.node-pty.test.ts": 253,
+      "src/main/providers/local-pty-utils-windows-fallback.test.ts": 81,
+      "src/main/providers/local-pty-utils.test.ts": 81,
+      "src/main/providers/macos-login-session-pty-probe.test.ts": 42,
+      "src/main/providers/macos-tcc-login-shell.test.ts": 146,
+      "src/main/providers/posix-pane-foreground-fingerprint.test.ts": 42,
+      "src/main/providers/process-cwd.test.ts": 141,
+      "src/main/providers/provider-dispatch.test.ts": 1559,
+      "src/main/providers/pty-default-cwd.test.ts": 58,
+      "src/main/providers/pty-process-inspection.test.ts": 54,
+      "src/main/providers/pty-process-list-admission.test.ts": 108,
+      "src/main/providers/pty-repaint-wide-char-buffer.node-pty.test.ts": 1943,
+      "src/main/providers/settled-pty-writer-census.test.ts": 646,
+      "src/main/providers/ssh-filesystem-dispatch.test.ts": 41,
+      "src/main/providers/ssh-filesystem-doc-preview.test.ts": 61,
+      "src/main/providers/ssh-filesystem-download.test.ts": 183,
+      "src/main/providers/ssh-filesystem-provider-capabilities.test.ts": 74,
+      "src/main/providers/ssh-filesystem-provider-download-folder.test.ts": 79,
+      "src/main/providers/ssh-filesystem-provider-range.test.ts": 84,
+      "src/main/providers/ssh-filesystem-provider-stream.test.ts": 164,
+      "src/main/providers/ssh-filesystem-provider-watch-waiters.test.ts": 617,
+      "src/main/providers/ssh-filesystem-provider.test.ts": 323,
+      "src/main/providers/ssh-filesystem-watch-notifications.test.ts": 53,
+      "src/main/providers/ssh-git-dispatch.test.ts": 55,
+      "src/main/providers/ssh-git-provider-api.test.ts": 54,
+      "src/main/providers/ssh-git-provider-commit-message.test.ts": 68,
+      "src/main/providers/ssh-git-provider-diff.test.ts": 141,
+      "src/main/providers/ssh-git-provider-exec.test.ts": 104,
+      "src/main/providers/ssh-git-provider-merge.test.ts": 95,
+      "src/main/providers/ssh-git-provider-remote-sync.test.ts": 99,
+      "src/main/providers/ssh-git-provider-staging.test.ts": 112,
+      "src/main/providers/ssh-git-provider-status-lease.test.ts": 79,
+      "src/main/providers/ssh-git-provider-status.test.ts": 106,
+      "src/main/providers/ssh-git-provider-upstream-lease.test.ts": 78,
+      "src/main/providers/ssh-git-provider-worktree.test.ts": 140,
+      "src/main/providers/ssh-git-worktree-list-dedupe.test.ts": 103,
+      "src/main/providers/ssh-pty-inspect-observation-identity.test.ts": 54,
+      "src/main/providers/ssh-pty-live-source-restore-respawn.test.ts": 207,
+      "src/main/providers/ssh-pty-notification-rejection-routing.test.ts": 196,
+      "src/main/providers/ssh-pty-notification-routing.test.ts": 92,
+      "src/main/providers/ssh-pty-provider-agent-session-create-operation.test.ts": 123,
+      "src/main/providers/ssh-pty-provider-claim-incarnation.test.ts": 109,
+      "src/main/providers/ssh-pty-provider-exit-race.test.ts": 200,
+      "src/main/providers/ssh-pty-provider-process-events.test.ts": 157,
+      "src/main/providers/ssh-pty-provider-reattach-incarnation.test.ts": 138,
+      "src/main/providers/ssh-pty-provider-spawn.test.ts": 124,
+      "src/main/providers/ssh-pty-provider-terminal-repair.test.ts": 213,
+      "src/main/providers/ssh-pty-provider.test.ts": 232,
+      "src/main/providers/ssh-pty-reattach-absence-discrimination.test.ts": 69,
+      "src/main/providers/ssh-pty-relay-absence-verdict.test.ts": 157,
+      "src/main/providers/ssh-pty-source-delivery-ledger.test.ts": 49,
+      "src/main/providers/ssh-pty-write.test.ts": 182,
+      "src/main/providers/ssh-worktree-catalog-authority.test.ts": 429,
+      "src/main/providers/stable-foreground-process.test.ts": 68,
+      "src/main/providers/terminal-path-existence-batch.integration.test.ts": 171,
+      "src/main/providers/windows-agent-foreground-process-scan-volume.test.ts": 70,
+      "src/main/providers/windows-cached-agent-revalidation.test.ts": 56,
+      "src/main/providers/windows-conpty-wide-char-duplication.node-pty.test.ts": 34,
+      "src/main/providers/windows-console-attached-processes.test.ts": 69,
+      "src/main/providers/windows-foreground-process-inspection-cost.test.ts": 88,
+      "src/main/providers/windows-foreground-process-rows.test.ts": 40,
+      "src/main/providers/windows-powershell-executable.test.ts": 67,
+      "src/main/providers/windows-powershell.test.ts": 53,
+      "src/main/providers/windows-pty-job-membership.test.ts": 95,
+      "src/main/providers/windows-shell-args.test.ts": 131,
+      "src/main/providers/windows-shell-fallback-chain.test.ts": 124,
+      "src/main/providers/windows-shell-preflight-runtime.windows.test.ts": 123,
+      "src/main/providers/working-directory-validation-retention.test.ts": 125,
+      "src/main/providers/working-directory-validation.test.ts": 111,
+      "src/main/provisioned-root-ssh-adoption.test.ts": 285,
+      "src/main/proxy-guarded-fetch-call-site-audit.test.ts": 266,
+      "src/main/pty-descendant-exit-verification.test.ts": 83,
+      "src/main/pty-descendant-termination-job-coverage.test.ts": 303,
+      "src/main/pty-descendant-termination.test.ts": 205,
+      "src/main/pty/appimage-terminal-env.test.ts": 42,
+      "src/main/pty/build-mode-env.test.ts": 42,
+      "src/main/pty/codex-home-wsl-env.test.ts": 33,
+      "src/main/pty/codex-preflight-profile-path-rewrite.test.ts": 168,
+      "src/main/pty/codex-shell-launch-preflight.test.ts": 2210,
+      "src/main/pty/conda-activation-env.test.ts": 36,
+      "src/main/pty/legacy-terminal-shim-dir.test.ts": 444,
+      "src/main/pty/legacy-terminal-windows-tombstone.test.ts": 59,
+      "src/main/pty/node-pty-master-fd-retirement.test.ts": 5222,
+      "src/main/pty/node-pty-self-exit-pseudoconsole-close.test.ts": 42,
+      "src/main/pty/omp-sqlite-overlay.test.ts": 43,
+      "src/main/pty/overlay-mirror.test.ts": 41,
+      "src/main/pty/pi-process-owner-env.test.ts": 929,
+      "src/main/pty/posix-pty-foreground-group.test.ts": 60,
+      "src/main/pty/posix-pty-process-groups.integration.test.ts": 123,
+      "src/main/pty/posix-pty-process-groups.test.ts": 78,
+      "src/main/pty/shell-startup-env.test.ts": 116,
+      "src/main/pty/terminal-color-env.test.ts": 49,
+      "src/main/pty/windows-environment-path-main-loop.test.ts": 414,
+      "src/main/pty/windows-environment-path.test.ts": 72,
+      "src/main/pty/windows-path-registry-change.test.ts": 37,
+      "src/main/pty/windows-path-registry-fallback.test.ts": 66,
+      "src/main/pty/windows-path-registry-reader.test.ts": 61,
+      "src/main/pty/wsl-orca-env.test.ts": 85,
+      "src/main/pwsh.test.ts": 74,
+      "src/main/quit-path-durable-write-blocking.test.ts": 2121,
+      "src/main/quit-teardown-agent-browser-daemons.test.ts": 27,
+      "src/main/quit-teardown-deadline.test.ts": 52,
+      "src/main/quit-teardown-start-gate.test.ts": 45,
+      "src/main/rate-limits/account-runtime-target-sync.test.ts": 205,
+      "src/main/rate-limits/antigravity-usage-mirror.test.ts": 38,
+      "src/main/rate-limits/auth-filesystem-operation-retention.test.ts": 132,
+      "src/main/rate-limits/auth-filesystem-operation.test.ts": 56,
+      "src/main/rate-limits/claude-fetcher-cli-fallback.test.ts": 183,
+      "src/main/rate-limits/claude-fetcher-fable-usage.test.ts": 251,
+      "src/main/rate-limits/claude-fetcher-keychain-credentials.test.ts": 273,
+      "src/main/rate-limits/claude-fetcher-managed-account-usage.test.ts": 167,
+      "src/main/rate-limits/claude-oauth-usage-error.test.ts": 102,
+      "src/main/rate-limits/claude-pty.test.ts": 178,
+      "src/main/rate-limits/claude-usage-error-classification.test.ts": 70,
+      "src/main/rate-limits/claude-usage-refresh-plan.test.ts": 33,
+      "src/main/rate-limits/codex-auth-presence.test.ts": 45,
+      "src/main/rate-limits/codex-fetcher-auth-errors.test.ts": 152,
+      "src/main/rate-limits/codex-fetcher-backend.test.ts": 251,
+      "src/main/rate-limits/codex-fetcher-probe-shutdown.test.ts": 223,
+      "src/main/rate-limits/codex-fetcher-process-contract.test.ts": 190,
+      "src/main/rate-limits/codex-fetcher-pty-settle.test.ts": 271,
+      "src/main/rate-limits/codex-fetcher-rpc-exit-diagnostics.test.ts": 465,
+      "src/main/rate-limits/codex-fetcher-runtime-pairing.test.ts": 108,
+      "src/main/rate-limits/codex-fetcher-session-supplement.test.ts": 186,
+      "src/main/rate-limits/codex-fetcher.test.ts": 339,
+      "src/main/rate-limits/codex-probe-termination.test.ts": 63,
+      "src/main/rate-limits/codex-pty-rate-limit-probe.test.ts": 70,
+      "src/main/rate-limits/codex-pty-status-parser.test.ts": 47,
+      "src/main/rate-limits/codex-rate-limit-window-classification.test.ts": 26,
+      "src/main/rate-limits/codex-rpc-rate-limit-probe.test.ts": 109,
+      "src/main/rate-limits/cursor-auth.test.ts": 133,
+      "src/main/rate-limits/cursor-fetcher.test.ts": 173,
+      "src/main/rate-limits/cursor-session-token.test.ts": 71,
+      "src/main/rate-limits/cursor-usage-mapping.test.ts": 97,
+      "src/main/rate-limits/gemini-bucket-formatting.test.ts": 37,
+      "src/main/rate-limits/gemini-usage-fetcher.fallback.test.ts": 113,
+      "src/main/rate-limits/gemini-usage-fetcher.test.ts": 100,
+      "src/main/rate-limits/grok-auth.test.ts": 101,
+      "src/main/rate-limits/grok-fetcher.test.ts": 152,
+      "src/main/rate-limits/hidden-pty-cleanup.test.ts": 53,
+      "src/main/rate-limits/initial-account-rate-limit-target.test.ts": 233,
+      "src/main/rate-limits/kimi-fetcher-wsl-home.test.ts": 92,
+      "src/main/rate-limits/kimi-fetcher.test.ts": 129,
+      "src/main/rate-limits/minimax/minimax-fetcher.test.ts": 109,
+      "src/main/rate-limits/minimax/minimax-request-context.test.ts": 89,
+      "src/main/rate-limits/opencode-go-api-key-source.test.ts": 73,
+      "src/main/rate-limits/opencode-go-status-parsing.test.ts": 63,
+      "src/main/rate-limits/opencode-go-usage-api.test.ts": 109,
+      "src/main/rate-limits/opencode-go-usage-fetcher.test.ts": 79,
+      "src/main/rate-limits/opencode-go-usage-source-selection.test.ts": 104,
+      "src/main/rate-limits/service-account-target-selection.test.ts": 780,
+      "src/main/rate-limits/service-antigravity-usage.test.ts": 123,
+      "src/main/rate-limits/service-cursor-usage.test.ts": 229,
+      "src/main/rate-limits/service-inactive-account-previews.test.ts": 187,
+      "src/main/rate-limits/service-live-claude-usage.test.ts": 173,
+      "src/main/rate-limits/service-minimax-usage.test.ts": 91,
+      "src/main/rate-limits/service-refresh-orchestration.test.ts": 243,
+      "src/main/rate-limits/service-window-activation.test.ts": 321,
+      "src/main/refused-tree-kill-root-termination.test.ts": 2628,
+      "src/main/remote-agent-trust-presets.test.ts": 166,
+      "src/main/remote-worktree-history-cleanup.test.ts": 59,
+      "src/main/repo-git-remote-avatar-refresh.test.ts": 108,
+      "src/main/repo-git-remote-identity-enrichment.test.ts": 91,
+      "src/main/repo-git-remote-identity.test.ts": 71,
+      "src/main/repo-git-username-enrichment.test.ts": 43,
+      "src/main/repo-icon-autodetect.test.ts": 606,
+      "src/main/repo-icon-file-detection.test.ts": 92,
+      "src/main/repo-icon-source-href.test.ts": 109,
+      "src/main/repo-maintenance-idle-gate.test.ts": 53,
+      "src/main/repo-worktrees.test.ts": 104,
+      "src/main/ripgrep/bare-ripgrep-spawn-boundary.test.ts": 1021,
+      "src/main/ripgrep/bundled-ripgrep-path.test.ts": 104,
+      "src/main/ripgrep/bundled-ripgrep-real.test.ts": 150,
+      "src/main/ripgrep/bundled-ripgrep-spawn.test.ts": 67,
+      "src/main/ripgrep/fd-exhausted-spawn.test.ts": 68,
+      "src/main/ripgrep/synchronous-spawn-failure.test.ts": 63,
+      "src/main/ripgrep/wsl-missing-cwd-exit.test.ts": 92,
+      "src/main/runtime/acknowledged-terminal-tab-retirement.test.ts": 3317,
+      "src/main/runtime/agent-prompt-line-settle.test.ts": 2927,
+      "src/main/runtime/agent-prompt-receipt-correlation.test.ts": 3413,
+      "src/main/runtime/agent-prompt-request-correlation.test.ts": 46,
+      "src/main/runtime/agent-prompt-submission-runtime-hook-and-generation.test.ts": 3872,
+      "src/main/runtime/agent-prompt-submission-runtime.test.ts": 4515,
+      "src/main/runtime/agent-prompt-submission-verification.test.ts": 193,
+      "src/main/runtime/agent-prompt-submission-windows-submit-delay.test.ts": 2931,
+      "src/main/runtime/agent-session-backup-recovery.test.ts": 422,
+      "src/main/runtime/agent-session-claim-identity.test.ts": 71,
+      "src/main/runtime/agent-session-conversation-name-store.test.ts": 302,
+      "src/main/runtime/agent-session-launch-env-admission.test.ts": 253,
+      "src/main/runtime/agent-session-launch-env-backfill.test.ts": 264,
+      "src/main/runtime/agent-session-lease-renewal.test.ts": 242,
+      "src/main/runtime/agent-session-operation-admission.test.ts": 165,
+      "src/main/runtime/agent-session-orphan-child-reaper.test.ts": 90,
+      "src/main/runtime/agent-session-process-identity-probe-windows-batch.test.ts": 47,
+      "src/main/runtime/agent-session-process-identity-probe.test.ts": 78,
+      "src/main/runtime/agent-session-provider-handle-transition.test.ts": 104,
+      "src/main/runtime/agent-session-record-conversation-name.test.ts": 164,
+      "src/main/runtime/agent-session-record-options.test.ts": 203,
+      "src/main/runtime/agent-session-record-store-legacy-handoff-lease.test.ts": 303,
+      "src/main/runtime/agent-session-record-store-security.test.ts": 156,
+      "src/main/runtime/agent-session-record-store-tab-table.test.ts": 420,
+      "src/main/runtime/agent-session-record-store.test.ts": 4639,
+      "src/main/runtime/agent-session-record-unsupported-schema.test.ts": 255,
+      "src/main/runtime/agent-session-recovery-capsule.test.ts": 642,
+      "src/main/runtime/agent-session-recovery-publish-fault.test.ts": 252,
+      "src/main/runtime/agent-session-released-reservation-replay.test.ts": 351,
+      "src/main/runtime/agent-session-reservation-admission.test.ts": 150,
+      "src/main/runtime/agent-session-spawn-token-process-scan.test.ts": 54,
+      "src/main/runtime/agent-session-spawn-token-readback.test.ts": 52,
+      "src/main/runtime/agent-session-surface-release-transition.test.ts": 167,
+      "src/main/runtime/agent-session-unreadable-record-salvage.test.ts": 310,
+      "src/main/runtime/agent-session-unsaved-creation-supersession.test.ts": 363,
+      "src/main/runtime/agent-startup-input-assembly-census.test.ts": 41,
+      "src/main/runtime/agent-terminal-launch-trust-host.test.ts": 3780,
+      "src/main/runtime/agent-terminal-startup-prompt.test.ts": 2169,
+      "src/main/runtime/antigravity-readiness-transcripts.test.ts": 6110,
+      "src/main/runtime/antigravity-terminal-readiness.test.ts": 78,
+      "src/main/runtime/automation-change-publication.test.ts": 8897,
+      "src/main/runtime/browser-client-download-transfers.test.ts": 201,
+      "src/main/runtime/browser-dialog-settlement.test.ts": 359,
+      "src/main/runtime/browser-execution-host-key-resolution.test.ts": 1993,
+      "src/main/runtime/browser-host-capability-selection.test.ts": 172,
+      "src/main/runtime/browser-host-client-page-adoption-grants.test.ts": 46,
+      "src/main/runtime/browser-host-client-page-adoption.test.ts": 36,
+      "src/main/runtime/browser-host-client-page-creation.test.ts": 133,
+      "src/main/runtime/browser-host-command-ledger-capacity.test.ts": 157,
+      "src/main/runtime/browser-host-command-ledger.test.ts": 138,
+      "src/main/runtime/browser-host-file-channel-admission.test.ts": 154,
+      "src/main/runtime/browser-host-lease-download-transfer-cleanup.test.ts": 319,
+      "src/main/runtime/browser-host-lease-fenced-page-release.test.ts": 206,
+      "src/main/runtime/browser-host-lease-placement-retirement.test.ts": 189,
+      "src/main/runtime/browser-host-lease-registry.test.ts": 243,
+      "src/main/runtime/browser-host-page-placement-replacement.test.ts": 169,
+      "src/main/runtime/browser-host-page-placement.test.ts": 156,
+      "src/main/runtime/browser-host-page-reconciliation-executor.test.ts": 64,
+      "src/main/runtime/browser-host-page-reconciliation-orchestration.test.ts": 369,
+      "src/main/runtime/browser-host-page-reconciliation-plan.test.ts": 74,
+      "src/main/runtime/browser-host-page-reconciliation-preconditions.test.ts": 166,
+      "src/main/runtime/browser-host-page-retirement.test.ts": 32,
+      "src/main/runtime/browser-network-tunnel-paired-runtime.integration.test.ts": 2930,
+      "src/main/runtime/browser-screencast-driver-attribution.test.ts": 4314,
+      "src/main/runtime/browser-screencast-driver-scope.test.ts": 38,
+      "src/main/runtime/browser-screencast-ghost-subscriber-eviction.test.ts": 59,
+      "src/main/runtime/browser-screencast-remote-viewer-retention.test.ts": 3782,
+      "src/main/runtime/browser-session-tab-selection-snapshot.test.ts": 57,
+      "src/main/runtime/browser-tab-create-caller-navigation.test.ts": 3696,
+      "src/main/runtime/browser-tab-create-publication.test.ts": 775,
+      "src/main/runtime/claude-agent-teams-pty-exit-leak.test.ts": 3509,
+      "src/main/runtime/claude-agent-teams-service.test.ts": 86,
+      "src/main/runtime/claude-agent-teams-shim-env.test.ts": 102,
+      "src/main/runtime/claude-structured-failed-start-resume.test.ts": 1167,
+      "src/main/runtime/claude-structured-resumed-start-failure.test.ts": 1250,
+      "src/main/runtime/claude-structured-send-held-for-startup.test.ts": 1153,
+      "src/main/runtime/claude-structured-send-restart-dies-before-dispatch.test.ts": 1691,
+      "src/main/runtime/claude-structured-session-integration.test.ts": 4718,
+      "src/main/runtime/claude-structured-startup-unanswered-control-request.test.ts": 1435,
+      "src/main/runtime/cli-terminal-create-host-session-binding.test.ts": 1988,
+      "src/main/runtime/client-hosted-browser-page-persistence.integration.test.ts": 3289,
+      "src/main/runtime/client-hosted-browser-page-persistence.test.ts": 233,
+      "src/main/runtime/client-hosted-browser-row-hydration-census.test.ts": 485,
+      "src/main/runtime/client-hosted-browser-row-projection.test.ts": 57,
+      "src/main/runtime/client-hosted-browser-row-publication.test.ts": 59,
+      "src/main/runtime/client-hosted-browser-row-push.integration.test.ts": 2544,
+      "src/main/runtime/client-hosted-page-reconciliation-hold.integration.test.ts": 3363,
+      "src/main/runtime/client-hosted-page-reconciliation-window.test.ts": 57,
+      "src/main/runtime/client-session-tab-selection.test.ts": 57,
+      "src/main/runtime/decorative-title-fact-emission.test.ts": 33,
+      "src/main/runtime/exit-provenance-audit.test.ts": 3844,
+      "src/main/runtime/expired-ssh-lease-pane-candidacy.test.ts": 2958,
+      "src/main/runtime/external-worktree-paired-client-discovery.integration.test.ts": 4448,
+      "src/main/runtime/fetch-remote-cache.test.ts": 3566,
+      "src/main/runtime/file-watcher-host.test.ts": 816,
+      "src/main/runtime/fit-override-integration.test.ts": 3341,
+      "src/main/runtime/folder-workspace-pty-identity.test.ts": 2999,
+      "src/main/runtime/graph-sync-deletion-fence.test.ts": 3314,
+      "src/main/runtime/graph-sync-live-daemon-pty-tab-preservation.test.ts": 3308,
+      "src/main/runtime/graph-sync-mobile-snapshot-gating.test.ts": 9743,
+      "src/main/runtime/graph-sync-payload-partition.test.ts": 2285,
+      "src/main/runtime/headless-close-keeps-publication-epoch.test.ts": 2149,
+      "src/main/runtime/headless-hydration-ownership.test.ts": 4098,
+      "src/main/runtime/headless-placeholder-graph-surface-standing.test.ts": 2838,
+      "src/main/runtime/headless-seed-ownership.test.ts": 4790,
+      "src/main/runtime/headless-tab-group-split-layout.test.ts": 55,
+      "src/main/runtime/headless-tab-order-stability.test.ts": 2511,
+      "src/main/runtime/headless-terminal-dispose-write-ordering.test.ts": 3202,
+      "src/main/runtime/headless-terminal-query-reply-policy.test.ts": 49,
+      "src/main/runtime/headless-terminal-split-layout.test.ts": 34,
+      "src/main/runtime/hidden-output-restored-provider-snapshot.test.ts": 3364,
+      "src/main/runtime/host-terminal-close-persistence-durability.test.ts": 838,
+      "src/main/runtime/leaf-pty-verdict-expiry.test.ts": 3418,
+      "src/main/runtime/linear-save-issue.test.ts": 3157,
+      "src/main/runtime/managed-worktree-create-execution-host.test.ts": 2508,
+      "src/main/runtime/missing-worktree-terminal-reconciliation.test.ts": 197,
+      "src/main/runtime/mobile-agent-status-permission-renewal.test.ts": 3290,
+      "src/main/runtime/mobile-notification-dismissal-read-failure.test.ts": 78,
+      "src/main/runtime/mobile-notification-dismissal-store.test.ts": 73,
+      "src/main/runtime/mobile-notification-replay.test.ts": 77,
+      "src/main/runtime/mobile-pairing-qr.test.ts": 973,
+      "src/main/runtime/mobile-pairing-userdata-path.test.ts": 2117,
+      "src/main/runtime/mobile-presence-lock.test.ts": 15604,
+      "src/main/runtime/mobile-rpc-allowlist.test.ts": 1726,
+      "src/main/runtime/mobile-session-tab-close-refusal-message.test.ts": 54,
+      "src/main/runtime/mobile-session-tabs-agent-status-heartbeat.test.ts": 44,
+      "src/main/runtime/mobile-session-tabs-churn-coalescing.test.ts": 2760,
+      "src/main/runtime/mobile-session-tabs-notify-coalescer.test.ts": 35,
+      "src/main/runtime/mobile-session-terminal-persistence-retirement.test.ts": 179,
+      "src/main/runtime/mobile-session-terminal-retirement-proof.test.ts": 37,
+      "src/main/runtime/mobile-session-terminal-retirement.test.ts": 153,
+      "src/main/runtime/mobile-subscribe-integration.test.ts": 18419,
+      "src/main/runtime/multi-client-navigation-isolation.integration.test.ts": 4776,
+      "src/main/runtime/muse-readiness-transcript.test.ts": 6923,
+      "src/main/runtime/opencode-finished-session-authority.test.ts": 3824,
+      "src/main/runtime/orca-runtime-agent-session-operation.test.ts": 2429,
+      "src/main/runtime/orca-runtime-agent-skill-share.test.ts": 2486,
+      "src/main/runtime/orca-runtime-automations.test.ts": 3439,
+      "src/main/runtime/orca-runtime-browser-client-hosted.test.ts": 425,
+      "src/main/runtime/orca-runtime-browser-ghost-session-row-close.test.ts": 373,
+      "src/main/runtime/orca-runtime-browser-headless.test.ts": 784,
+      "src/main/runtime/orca-runtime-browser-screencast-fanout.test.ts": 429,
+      "src/main/runtime/orca-runtime-browser.test.ts": 747,
+      "src/main/runtime/orca-runtime-create-base-prefetch.test.ts": 3300,
+      "src/main/runtime/orca-runtime-emulator-folder-workspace.test.ts": 2993,
+      "src/main/runtime/orca-runtime-exact-worker-provider-session.test.ts": 2563,
+      "src/main/runtime/orca-runtime-files-mobile-explorer-reads.test.ts": 439,
+      "src/main/runtime/orca-runtime-files-preview-budget.test.ts": 346,
+      "src/main/runtime/orca-runtime-files-rename-authority.test.ts": 469,
+      "src/main/runtime/orca-runtime-files-search.test.ts": 325,
+      "src/main/runtime/orca-runtime-files-ssh-chunk-reads.test.ts": 436,
+      "src/main/runtime/orca-runtime-files-ssh-rearm.test.ts": 273,
+      "src/main/runtime/orca-runtime-files-terminal-artifact-grants.test.ts": 400,
+      "src/main/runtime/orca-runtime-files-terminal-artifact-io.test.ts": 554,
+      "src/main/runtime/orca-runtime-files-terminal-artifact-swap-detection.test.ts": 501,
+      "src/main/runtime/orca-runtime-files-terminal-link-host-translation.test.ts": 547,
+      "src/main/runtime/orca-runtime-files-terminal-path-resolution.test.ts": 362,
+      "src/main/runtime/orca-runtime-files-watch-host-scope.test.ts": 484,
+      "src/main/runtime/orca-runtime-files-watch.test.ts": 517,
+      "src/main/runtime/orca-runtime-git-branch-diff.test.ts": 732,
+      "src/main/runtime/orca-runtime-git-diff-budget.test.ts": 871,
+      "src/main/runtime/orca-runtime-git.test.ts": 464,
+      "src/main/runtime/orca-runtime-headless-hydration-repo-gate.test.ts": 3261,
+      "src/main/runtime/orca-runtime-hook-agent-status-projection.test.ts": 2257,
+      "src/main/runtime/orca-runtime-linked-issue-live-meta.integration.test.ts": 2750,
+      "src/main/runtime/orca-runtime-mobile-agent-status-title-truthfulness.test.ts": 3103,
+      "src/main/runtime/orca-runtime-mobile-close-preserved-resurrection.test.ts": 3435,
+      "src/main/runtime/orca-runtime-module-size.test.ts": 31,
+      "src/main/runtime/orca-runtime-path-candidate-history.test.ts": 50,
+      "src/main/runtime/orca-runtime-process-incarnation-liveness.test.ts": 1851,
+      "src/main/runtime/orca-runtime-provider-reattach-launch-identity.test.ts": 3259,
+      "src/main/runtime/orca-runtime-skill-recovery.test.ts": 2176,
+      "src/main/runtime/orca-runtime-structured-agent-session-create-intent.test.ts": 2913,
+      "src/main/runtime/orca-runtime-structured-claude-account-gate.test.ts": 2897,
+      "src/main/runtime/orca-runtime-structured-claude-gate-wiring.test.ts": 2908,
+      "src/main/runtime/orca-runtime-structured-native-chat-settings.test.ts": 2429,
+      "src/main/runtime/orca-runtime-structured-session-restore.test.ts": 3480,
+      "src/main/runtime/orca-runtime-structured-status-sink-wiring.test.ts": 2007,
+      "src/main/runtime/orca-runtime-tab-id-collision.test.ts": 3392,
+      "src/main/runtime/orca-runtime-tail-wait-memo.test.ts": 2831,
+      "src/main/runtime/orca-runtime-terminal-close-continuity.test.ts": 2299,
+      "src/main/runtime/orca-runtime-terminal-create-idempotency.test.ts": 3332,
+      "src/main/runtime/orca-runtime-terminal-cwd.test.ts": 3470,
+      "src/main/runtime/orca-runtime-terminal-handle-incarnation.test.ts": 2155,
+      "src/main/runtime/orca-runtime-terminal-rename-retention.test.ts": 2085,
+      "src/main/runtime/orca-runtime-terminal-retirement-host-partition.test.ts": 3504,
+      "src/main/runtime/orca-runtime-terminal-retirement.test.ts": 3035,
+      "src/main/runtime/orca-runtime-terminal-split-authority.test.ts": 4293,
+      "src/main/runtime/orca-runtime-test-fragment-coverage.test.ts": 54,
+      "src/main/runtime/orca-runtime-worktree-change-invalidation.test.ts": 3002,
+      "src/main/runtime/orca-runtime.test.ts": 20016,
+      "src/main/runtime/orchestration-cli-subprocess.test.ts": 4022,
+      "src/main/runtime/orchestration-codex-completion-title.test.ts": 4864,
+      "src/main/runtime/orchestration-codex-real-pty.integration.test.ts": 3073,
+      "src/main/runtime/orchestration-compatibility-authority.test.ts": 3514,
+      "src/main/runtime/orchestration-dispatch-mailbox-delivery.test.ts": 4228,
+      "src/main/runtime/orchestration-mailbox-cold-park-idle.test.ts": 4102,
+      "src/main/runtime/orchestration-mailbox-crash-recovery.test.ts": 3847,
+      "src/main/runtime/orchestration-mailbox-detached-routing.test.ts": 3792,
+      "src/main/runtime/orchestration-mailbox-filtered-waiters.test.ts": 2765,
+      "src/main/runtime/orchestration-mailbox-notification-consistency.test.ts": 15860,
+      "src/main/runtime/orchestration-mailbox-pointer-cli-command.test.ts": 3401,
+      "src/main/runtime/orchestration-mailbox-routing-races.test.ts": 4303,
+      "src/main/runtime/orchestration-mailbox-transport-settlement.test.ts": 3583,
+      "src/main/runtime/orchestration-message-delivery-identity.test.ts": 4561,
+      "src/main/runtime/orchestration-messages-fake-parity.test.ts": 237,
+      "src/main/runtime/orchestration-worker-workspace-resolution.test.ts": 3441,
+      "src/main/runtime/orchestration/cli-command.test.ts": 45,
+      "src/main/runtime/orchestration/coordinator-decision-gates.test.ts": 435,
+      "src/main/runtime/orchestration/coordinator-dispatch-unobserved-prompt.test.ts": 419,
+      "src/main/runtime/orchestration/coordinator-drift-probe-coalescing.test.ts": 503,
+      "src/main/runtime/orchestration/coordinator-escalation-triage.test.ts": 388,
+      "src/main/runtime/orchestration/coordinator-stale-base-flag.test.ts": 31,
+      "src/main/runtime/orchestration/coordinator-terminal-census-unavailable.test.ts": 245,
+      "src/main/runtime/orchestration/coordinator.test.ts": 3812,
+      "src/main/runtime/orchestration/db-empty-dispatch-shortcircuit.benchmark.test.ts": 355,
+      "src/main/runtime/orchestration/db-heartbeat-straggler-guard.test.ts": 433,
+      "src/main/runtime/orchestration/db-message-timestamp.test.ts": 322,
+      "src/main/runtime/orchestration/db-messages.test.ts": 277,
+      "src/main/runtime/orchestration/db-stopping-worker-task-guard.test.ts": 391,
+      "src/main/runtime/orchestration/db-task-create-readiness.test.ts": 412,
+      "src/main/runtime/orchestration/db-task-dispatch-invariant.test.ts": 954,
+      "src/main/runtime/orchestration/db-task-dispatch-lifecycle-guards.test.ts": 948,
+      "src/main/runtime/orchestration/db-task-dispatch-races.test.ts": 595,
+      "src/main/runtime/orchestration/db-undelivered-mailboxes.test.ts": 291,
+      "src/main/runtime/orchestration/db.test.ts": 1046,
+      "src/main/runtime/orchestration/db/attempt-outcome-projection.test.ts": 489,
+      "src/main/runtime/orchestration/db/decision-gate-lifecycle.test.ts": 216,
+      "src/main/runtime/orchestration/db/dispatch-context/dispatch-capability.test.ts": 405,
+      "src/main/runtime/orchestration/db/dispatch-depth.test.ts": 608,
+      "src/main/runtime/orchestration/db/dispatch-mailbox-consumer-fencing.test.ts": 367,
+      "src/main/runtime/orchestration/db/dispatch-row-writer-boundary.test.ts": 592,
+      "src/main/runtime/orchestration/db/federated-worker-report-outcome.test.ts": 45,
+      "src/main/runtime/orchestration/db/federation/federated-dispatch-observation-fence.test.ts": 275,
+      "src/main/runtime/orchestration/db/federation/remote-dispatch-attachment-release.test.ts": 382,
+      "src/main/runtime/orchestration/db/hot-path-statement-compilation.test.ts": 425,
+      "src/main/runtime/orchestration/db/legacy-question-identity.test.ts": 43,
+      "src/main/runtime/orchestration/db/lifecycle-rejection-marker.test.ts": 27,
+      "src/main/runtime/orchestration/db/lifecycle-transition-boundary.test.ts": 47,
+      "src/main/runtime/orchestration/db/lifecycle-transition.test.ts": 355,
+      "src/main/runtime/orchestration/db/messages/mailbox-consumer-lifecycle-fencing.test.ts": 732,
+      "src/main/runtime/orchestration/db/pane-key-match.test.ts": 33,
+      "src/main/runtime/orchestration/db/row-column-lists.test.ts": 397,
+      "src/main/runtime/orchestration/db/run-list-cursor.test.ts": 30,
+      "src/main/runtime/orchestration/db/runs/run-coordinator-orca-session-binding.test.ts": 408,
+      "src/main/runtime/orchestration/db/schema/derived-delivery-migration.test.ts": 669,
+      "src/main/runtime/orchestration/db/schema/federated-home-run-migration.test.ts": 348,
+      "src/main/runtime/orchestration/db/schema/structured-pointer-schema-migration.test.ts": 440,
+      "src/main/runtime/orchestration/db/schema/structured-worker-orca-session-backfill.test.ts": 361,
+      "src/main/runtime/orchestration/db/worker-dispatch/worker-dispatch-assignee-orca-session.test.ts": 261,
+      "src/main/runtime/orchestration/db/writer-run-required.test.ts": 365,
+      "src/main/runtime/orchestration/dispatch-consumer-generation-migration.test.ts": 498,
+      "src/main/runtime/orchestration/dispatch-creator-identity-migration.test.ts": 480,
+      "src/main/runtime/orchestration/dispatch-failure-idempotency.test.ts": 434,
+      "src/main/runtime/orchestration/federation-ack-checkpoints.test.ts": 33,
+      "src/main/runtime/orchestration/federation-acknowledgment-integrity.test.ts": 277,
+      "src/main/runtime/orchestration/federation-acknowledgment-migration.test.ts": 373,
+      "src/main/runtime/orchestration/federation-lifecycle-settlement.test.ts": 23,
+      "src/main/runtime/orchestration/federation-sync.test.ts": 2820,
+      "src/main/runtime/orchestration/federation-terminal-recovery.test.ts": 3474,
+      "src/main/runtime/orchestration/formatter.test.ts": 61,
+      "src/main/runtime/orchestration/groups.test.ts": 42,
+      "src/main/runtime/orchestration/lifecycle-caller-edges.test.ts": 352,
+      "src/main/runtime/orchestration/lifecycle-reconciliation.test.ts": 786,
+      "src/main/runtime/orchestration/lightweight-run-worker-exit-escalation.test.ts": 3611,
+      "src/main/runtime/orchestration/mailbox-pointer-eligibility.test.ts": 343,
+      "src/main/runtime/orchestration/mailbox-pointer-release-query.test.ts": 339,
+      "src/main/runtime/orchestration/mailbox-pointer-stage.test.ts": 504,
+      "src/main/runtime/orchestration/mailbox-pointer-submit.test.ts": 696,
+      "src/main/runtime/orchestration/message-batch-atomicity.test.ts": 395,
+      "src/main/runtime/orchestration/mutation-receipt-capacity.test.ts": 400,
+      "src/main/runtime/orchestration/nested-worker-depth-migration.test.ts": 579,
+      "src/main/runtime/orchestration/orchestration-adopted-run-binding.test.ts": 1024,
+      "src/main/runtime/orchestration/orchestration-all-start-versions-migration.test.ts": 1741,
+      "src/main/runtime/orchestration/orchestration-creator-authority-performance.test.ts": 1165,
+      "src/main/runtime/orchestration/orchestration-db-permissions.test.ts": 240,
+      "src/main/runtime/orchestration/orchestration-db-retention-pagination.test.ts": 706,
+      "src/main/runtime/orchestration/orchestration-delivery-consumption.test.ts": 464,
+      "src/main/runtime/orchestration/orchestration-derived-delivery.test.ts": 327,
+      "src/main/runtime/orchestration/orchestration-federated-legacy-probe.test.ts": 500,
+      "src/main/runtime/orchestration/orchestration-legacy-coordinator-authority-db.test.ts": 712,
+      "src/main/runtime/orchestration/orchestration-legacy-question-migration-db.test.ts": 751,
+      "src/main/runtime/orchestration/orchestration-legacy-storage-db.test.ts": 1661,
+      "src/main/runtime/orchestration/orchestration-legacy-worker-terminal-recovery.test.ts": 192,
+      "src/main/runtime/orchestration/orchestration-mutation-question-db.test.ts": 289,
+      "src/main/runtime/orchestration/orchestration-orca-session-column-migration.test.ts": 641,
+      "src/main/runtime/orchestration/orchestration-peer-capability-cache.test.ts": 74,
+      "src/main/runtime/orchestration/orchestration-reset-db.test.ts": 323,
+      "src/main/runtime/orchestration/orchestration-run-delivery-db.test.ts": 532,
+      "src/main/runtime/orchestration/orchestration-run-list-compatibility.test.ts": 364,
+      "src/main/runtime/orchestration/orchestration-version-skew-migration.test.ts": 1040,
+      "src/main/runtime/orchestration/orchestration-worker-dispatch-db.test.ts": 712,
+      "src/main/runtime/orchestration/preamble.test.ts": 144,
+      "src/main/runtime/orchestration/r1-identity-migration.test.ts": 407,
+      "src/main/runtime/orchestration/run-coordinator-handle-migration.test.ts": 520,
+      "src/main/runtime/orchestration/run-coordinator-orca-session-address.test.ts": 557,
+      "src/main/runtime/orchestration/settled-question-threads-migration.test.ts": 297,
+      "src/main/runtime/orchestration/setup-completion-signal.test.ts": 28,
+      "src/main/runtime/orchestration/structured-mailbox-pointer-delivery.test.ts": 431,
+      "src/main/runtime/orchestration/structured-mailbox-pointer-host.test.ts": 224,
+      "src/main/runtime/orchestration/structured-pointer-operation-id.test.ts": 84,
+      "src/main/runtime/orchestration/structured-session-pointer-delivery.test.ts": 73,
+      "src/main/runtime/orchestration/structured-worker-direct-mailbox-target.test.ts": 3260,
+      "src/main/runtime/orchestration/structured-worker-group-addressing.test.ts": 337,
+      "src/main/runtime/orchestration/structured-worker-journal-archive.test.ts": 91,
+      "src/main/runtime/orchestration/task-deps-flag.test.ts": 84,
+      "src/main/runtime/orchestration/worker-attention-context.test.ts": 58,
+      "src/main/runtime/orchestration/worker-output-archive-bounding.test.ts": 460,
+      "src/main/runtime/orchestration/worker-output-archive.test.ts": 386,
+      "src/main/runtime/orchestration/worker-output-cursor.test.ts": 65,
+      "src/main/runtime/orchestration/worker-provider-session.test.ts": 60,
+      "src/main/runtime/orchestration/worker-start-unobserved-prompt-settlement.test.ts": 394,
+      "src/main/runtime/orchestration/worker-transcript-payload.test.ts": 83,
+      "src/main/runtime/orchestration/worker-transcript-read.test.ts": 267,
+      "src/main/runtime/orchestration/worker-transcript-remote-read.test.ts": 201,
+      "src/main/runtime/paired-close-retirement-proof-publication-order.test.ts": 3296,
+      "src/main/runtime/pairing-endpoint.test.ts": 170,
+      "src/main/runtime/proven-absent-leaf-pty-verdicts.test.ts": 34,
+      "src/main/runtime/pty-exit-agent-status-reconciliation.test.ts": 3395,
+      "src/main/runtime/pty-exit-per-pty-map-reaper-ratchet.test.ts": 3330,
+      "src/main/runtime/pty-inventory-lifecycle-admission.test.ts": 2868,
+      "src/main/runtime/pty-inventory-lifecycle-scope.test.ts": 2608,
+      "src/main/runtime/pty-inventory-liveness-verdict.test.ts": 3469,
+      "src/main/runtime/pty-inventory-partial-relay-liveness.test.ts": 3435,
+      "src/main/runtime/pty-recorded-surface-topology.test.ts": 46,
+      "src/main/runtime/pty-shell-ownership-mirror.test.ts": 1555,
+      "src/main/runtime/pty-transcript-prune-wait-cache.test.ts": 3233,
+      "src/main/runtime/pty-waiver-source-invariant.test.ts": 50,
+      "src/main/runtime/public-ssh-state.test.ts": 27,
+      "src/main/runtime/push/desktop-push-service-unreadable-outbox.test.ts": 223,
+      "src/main/runtime/push/desktop-push-service.test.ts": 391,
+      "src/main/runtime/push/push-agent-state.test.ts": 54,
+      "src/main/runtime/push/push-cleanup-auth-expiry.test.ts": 219,
+      "src/main/runtime/push/push-delivery-policy.test.ts": 47,
+      "src/main/runtime/push/push-device-registration-persistence.test.ts": 85,
+      "src/main/runtime/push/push-dispatcher.test.ts": 73,
+      "src/main/runtime/push/push-gateway-client.test.ts": 230,
+      "src/main/runtime/push/push-gateway-session.test.ts": 312,
+      "src/main/runtime/push/push-host-proof-vector.test.ts": 84,
+      "src/main/runtime/push/push-host-proof.test.ts": 142,
+      "src/main/runtime/push/push-outcome-counters.test.ts": 34,
+      "src/main/runtime/push/push-policy-pipeline.integration.test.ts": 226,
+      "src/main/runtime/push/push-preferences.test.ts": 59,
+      "src/main/runtime/push/push-registration-races.test.ts": 320,
+      "src/main/runtime/push/push-registration-rpc.test.ts": 2997,
+      "src/main/runtime/push/push-unpair-persistence.test.ts": 4171,
+      "src/main/runtime/push/push-unregister-outbox.test.ts": 83,
+      "src/main/runtime/quarter-circle-title-send-authorization.test.ts": 19888,
+      "src/main/runtime/queued-terminal-graph-exit.test.ts": 3355,
+      "src/main/runtime/recent-pty-output-buffer.test.ts": 118,
+      "src/main/runtime/recent-pty-output-retention.test.ts": 101,
+      "src/main/runtime/relay/desktop-relay-service-broker-liveness.test.ts": 215,
+      "src/main/runtime/relay/desktop-relay-service.test.ts": 667,
+      "src/main/runtime/relay/mobile-relay-e2ee.integration.test.ts": 281,
+      "src/main/runtime/relay/relay-auth-coordinator-recovery.test.ts": 166,
+      "src/main/runtime/relay/relay-auth-coordinator.test.ts": 1240,
+      "src/main/runtime/relay/relay-auth-host-close-reason.test.ts": 184,
+      "src/main/runtime/relay/relay-control-client.test.ts": 602,
+      "src/main/runtime/relay/relay-control-close-reason.test.ts": 293,
+      "src/main/runtime/relay/relay-control-origin.test.ts": 138,
+      "src/main/runtime/relay/relay-control-request-retirement.test.ts": 160,
+      "src/main/runtime/relay/relay-control-timeout-classification.test.ts": 159,
+      "src/main/runtime/relay/relay-demand-ledger.test.ts": 100,
+      "src/main/runtime/relay/relay-host-proof.test.ts": 131,
+      "src/main/runtime/relay/relay-http-client.test.ts": 341,
+      "src/main/runtime/relay/relay-region-correction.test.ts": 297,
+      "src/main/runtime/relay/relay-region-preference.test.ts": 180,
+      "src/main/runtime/relay/relay-region-probe-log.test.ts": 297,
+      "src/main/runtime/relay/relay-region-refresh.test.ts": 188,
+      "src/main/runtime/relay/relay-renewal-jitter.test.ts": 969,
+      "src/main/runtime/relay/relay-revoke-outbox.test.ts": 79,
+      "src/main/runtime/relay/relay-session-broker.test.ts": 667,
+      "src/main/runtime/remote-agent-session-host-authority.integration.test.ts": 3521,
+      "src/main/runtime/remote-browser-screencast-frame-admission.test.ts": 360,
+      "src/main/runtime/remote-desktop-driver.test.ts": 2835,
+      "src/main/runtime/remote-runtime-close-intent.integration.test.ts": 1447,
+      "src/main/runtime/remote-runtime-request-connection.integration.test.ts": 2224,
+      "src/main/runtime/remote-server-updater.test.ts": 39,
+      "src/main/runtime/renderer-browser-session-reconciliation.test.ts": 2331,
+      "src/main/runtime/repo-icon-fork-backfill.test.ts": 3128,
+      "src/main/runtime/repo-worktree-admin-fingerprint.test.ts": 856,
+      "src/main/runtime/repo-worktree-resolution-scan.test.ts": 54,
+      "src/main/runtime/repo-worktree-row-resolution.test.ts": 221,
+      "src/main/runtime/retained-tail-redraw-window.equivalence.test.ts": 3753,
+      "src/main/runtime/rpc/core-typed-method-contract.test.ts": 107,
+      "src/main/runtime/rpc/dispatcher-browser-client-automation.test.ts": 1502,
+      "src/main/runtime/rpc/dispatcher-computer-errors.test.ts": 2001,
+      "src/main/runtime/rpc/dispatcher-feature-interactions.test.ts": 1855,
+      "src/main/runtime/rpc/dispatcher-request-parsing.test.ts": 143,
+      "src/main/runtime/rpc/e2ee-channel-text-backpressure.test.ts": 183,
+      "src/main/runtime/rpc/e2ee-channel-v2.test.ts": 226,
+      "src/main/runtime/rpc/e2ee-channel.test.ts": 490,
+      "src/main/runtime/rpc/e2ee-crypto.test.ts": 99,
+      "src/main/runtime/rpc/e2ee-integration.test.ts": 267,
+      "src/main/runtime/rpc/errors.test.ts": 190,
+      "src/main/runtime/rpc/methods/accounts.test.ts": 152,
+      "src/main/runtime/rpc/methods/agent-hooks.test.ts": 138,
+      "src/main/runtime/rpc/methods/agent-launch-floating-workspace.test.ts": 2274,
+      "src/main/runtime/rpc/methods/agent-launch-pane-reservation.test.ts": 1814,
+      "src/main/runtime/rpc/methods/agent-launch-replay.test.ts": 2245,
+      "src/main/runtime/rpc/methods/agent-launch-session-reservation.test.ts": 925,
+      "src/main/runtime/rpc/methods/agent-launch-structured-prompt.test.ts": 72,
+      "src/main/runtime/rpc/methods/agent-launch-terminal-identity.test.ts": 349,
+      "src/main/runtime/rpc/methods/agent-launch-terminal-preferences.test.ts": 301,
+      "src/main/runtime/rpc/methods/agent-launch-terminal-prompt.test.ts": 93,
+      "src/main/runtime/rpc/methods/agent-launch.test.ts": 545,
+      "src/main/runtime/rpc/methods/agent-session.test.ts": 1701,
+      "src/main/runtime/rpc/methods/agent-skill-sharing-capability-grant.test.ts": 2731,
+      "src/main/runtime/rpc/methods/ai-vault-search.test.ts": 3943,
+      "src/main/runtime/rpc/methods/ai-vault.test.ts": 3245,
+      "src/main/runtime/rpc/methods/artifact-sharing-capability-grant.test.ts": 2728,
+      "src/main/runtime/rpc/methods/artifacts.test.ts": 419,
+      "src/main/runtime/rpc/methods/automation-scoped-list-methods.test.ts": 2331,
+      "src/main/runtime/rpc/methods/automations.test.ts": 1969,
+      "src/main/runtime/rpc/methods/browser-client-host-attach-adoption.test.ts": 1420,
+      "src/main/runtime/rpc/methods/browser-client-host-reconciliation.test.ts": 1886,
+      "src/main/runtime/rpc/methods/browser-client-host.test.ts": 1978,
+      "src/main/runtime/rpc/methods/browser-client-page-metadata.test.ts": 2040,
+      "src/main/runtime/rpc/methods/browser-identity-rpc.test.ts": 2038,
+      "src/main/runtime/rpc/methods/browser-network-tunnel.test.ts": 2142,
+      "src/main/runtime/rpc/methods/browser-tab-create-schema.test.ts": 75,
+      "src/main/runtime/rpc/methods/browser.test.ts": 2100,
+      "src/main/runtime/rpc/methods/client-events.test.ts": 1168,
+      "src/main/runtime/rpc/methods/client-native-chat-settings.test.ts": 2581,
+      "src/main/runtime/rpc/methods/client-ui-pairing-local-fields.test.ts": 2057,
+      "src/main/runtime/rpc/methods/client-ui-task-resume-state.test.ts": 1201,
+      "src/main/runtime/rpc/methods/client-ui.test.ts": 5509,
+      "src/main/runtime/rpc/methods/clipboard.test.ts": 1919,
+      "src/main/runtime/rpc/methods/computer-actions.test.ts": 203,
+      "src/main/runtime/rpc/methods/computer.test.ts": 185,
+      "src/main/runtime/rpc/methods/diagnostics.test.ts": 2205,
+      "src/main/runtime/rpc/methods/file-watch-event-batcher.test.ts": 78,
+      "src/main/runtime/rpc/methods/files-base64-padding.test.ts": 1950,
+      "src/main/runtime/rpc/methods/files-doc-preview.test.ts": 2034,
+      "src/main/runtime/rpc/methods/files-list-all-page-size.test.ts": 2043,
+      "src/main/runtime/rpc/methods/files-path-search.test.ts": 1362,
+      "src/main/runtime/rpc/methods/files-preview-transport-budget.test.ts": 1828,
+      "src/main/runtime/rpc/methods/files-terminal-path-resolution.test.ts": 2031,
+      "src/main/runtime/rpc/methods/files-watch-cancellation.test.ts": 2085,
+      "src/main/runtime/rpc/methods/files-watch-cleanup.test.ts": 2050,
+      "src/main/runtime/rpc/methods/files.test.ts": 2096,
+      "src/main/runtime/rpc/methods/git-diff-transport-budget.test.ts": 1619,
+      "src/main/runtime/rpc/methods/git.test.ts": 1380,
+      "src/main/runtime/rpc/methods/github-pr-refresh-reason.test.ts": 1972,
+      "src/main/runtime/rpc/methods/github.test.ts": 1972,
+      "src/main/runtime/rpc/methods/gitlab.test.ts": 2078,
+      "src/main/runtime/rpc/methods/host-capabilities.test.ts": 2054,
+      "src/main/runtime/rpc/methods/hosted-review.test.ts": 1980,
+      "src/main/runtime/rpc/methods/jira.test.ts": 1754,
+      "src/main/runtime/rpc/methods/linear-agent-access.test.ts": 3679,
+      "src/main/runtime/rpc/methods/linear-agent-project-access.test.ts": 4428,
+      "src/main/runtime/rpc/methods/linear.test.ts": 2000,
+      "src/main/runtime/rpc/methods/mobile-web-bundle-range.test.ts": 2006,
+      "src/main/runtime/rpc/methods/mobile-web-bundle-read-concurrency.test.ts": 1627,
+      "src/main/runtime/rpc/methods/mobile-web-bundle-window-refusals.test.ts": 1956,
+      "src/main/runtime/rpc/methods/mobile-web-bundle.test.ts": 2278,
+      "src/main/runtime/rpc/methods/native-chat-rpc-block-sanitize.test.ts": 59,
+      "src/main/runtime/rpc/methods/native-chat.test.ts": 205,
+      "src/main/runtime/rpc/methods/notification-preferences.test.ts": 187,
+      "src/main/runtime/rpc/methods/notification-reconnect-cooldown.test.ts": 125,
+      "src/main/runtime/rpc/methods/orchestration-dispatch-error-codes.test.ts": 3127,
+      "src/main/runtime/rpc/methods/orchestration-structured-worker-abandon.test.ts": 3454,
+      "src/main/runtime/rpc/methods/orchestration-structured-worker-lifecycle.test.ts": 177,
+      "src/main/runtime/rpc/methods/orchestration-structured-worker-redrive.test.ts": 2861,
+      "src/main/runtime/rpc/methods/orchestration-structured-worker-session.test.ts": 202,
+      "src/main/runtime/rpc/methods/orchestration-structured-worker-start-failure.test.ts": 257,
+      "src/main/runtime/rpc/methods/orchestration-worker-mode-opacity.test.ts": 3575,
+      "src/main/runtime/rpc/methods/orchestration-worker-start-mode-selection.test.ts": 3617,
+      "src/main/runtime/rpc/methods/orchestration-worker-start-mode.test.ts": 221,
+      "src/main/runtime/rpc/methods/orchestration-worker-start-receipt-wording.test.ts": 181,
+      "src/main/runtime/rpc/methods/orchestration-worker-support-unknown.test.ts": 146,
+      "src/main/runtime/rpc/methods/orchestration/cli-runtime-boundary.test.ts": 2942,
+      "src/main/runtime/rpc/methods/orchestration/federation/federated-attach-receipt.test.ts": 59,
+      "src/main/runtime/rpc/methods/orchestration/federation/federated-fleet-snapshot.test.ts": 306,
+      "src/main/runtime/rpc/methods/orchestration/federation/federated-message-targeting.test.ts": 3006,
+      "src/main/runtime/rpc/methods/orchestration/federation/federated-release-safety.test.ts": 3590,
+      "src/main/runtime/rpc/methods/orchestration/federation/federated-transport-safety.test.ts": 3305,
+      "src/main/runtime/rpc/methods/orchestration/federation/federated-worker-start-receipt.test.ts": 3044,
+      "src/main/runtime/rpc/methods/orchestration/federation/federation-agent-launch.test.ts": 3886,
+      "src/main/runtime/rpc/methods/orchestration/federation/federation-control-mail.test.ts": 2200,
+      "src/main/runtime/rpc/methods/orchestration/federation/federation-effects.test.ts": 48,
+      "src/main/runtime/rpc/methods/orchestration/federation/federation-folder-placement.test.ts": 3459,
+      "src/main/runtime/rpc/methods/orchestration/federation/federation-lifecycle-settlement.test.ts": 8330,
+      "src/main/runtime/rpc/methods/orchestration/federation/federation-liveness-verdict.test.ts": 3459,
+      "src/main/runtime/rpc/methods/orchestration/federation/federation-output.test.ts": 5069,
+      "src/main/runtime/rpc/methods/orchestration/federation/federation-setup.test.ts": 3127,
+      "src/main/runtime/rpc/methods/orchestration/federation/federation-start-prompt-budget.test.ts": 3354,
+      "src/main/runtime/rpc/methods/orchestration/federation/federation-start-schema.test.ts": 135,
+      "src/main/runtime/rpc/methods/orchestration/federation/federation.test.ts": 5899,
+      "src/main/runtime/rpc/methods/orchestration/gates/gate-run-authorization.test.ts": 4327,
+      "src/main/runtime/rpc/methods/orchestration/gates/gates.test.ts": 4254,
+      "src/main/runtime/rpc/methods/orchestration/messaging/ask.test.ts": 3642,
+      "src/main/runtime/rpc/methods/orchestration/messaging/check-delivery-history.test.ts": 3832,
+      "src/main/runtime/rpc/methods/orchestration/messaging/check-superseded-terminal.test.ts": 2154,
+      "src/main/runtime/rpc/methods/orchestration/messaging/check-worker-consumer-fencing.test.ts": 3774,
+      "src/main/runtime/rpc/methods/orchestration/messaging/check-worker-federated-attachment.test.ts": 2399,
+      "src/main/runtime/rpc/methods/orchestration/messaging/check.test.ts": 4320,
+      "src/main/runtime/rpc/methods/orchestration/messaging/recipient-routing.test.ts": 3153,
+      "src/main/runtime/rpc/methods/orchestration/messaging/send-dispatch-authority.test.ts": 3500,
+      "src/main/runtime/rpc/methods/orchestration/messaging/send-group.test.ts": 1944,
+      "src/main/runtime/rpc/methods/orchestration/messaging/send-invalid-type.test.ts": 3325,
+      "src/main/runtime/rpc/methods/orchestration/messaging/send-receipt-plumbing.test.ts": 3305,
+      "src/main/runtime/rpc/methods/orchestration/messaging/send-unbound-terminals.test.ts": 3760,
+      "src/main/runtime/rpc/methods/orchestration/messaging/send.test.ts": 3572,
+      "src/main/runtime/rpc/methods/orchestration/messaging/settled-dispatch-mail.test.ts": 3495,
+      "src/main/runtime/rpc/methods/orchestration/runs/migration-behavior.test.ts": 3989,
+      "src/main/runtime/rpc/methods/orchestration/runs/run-receipt.test.ts": 170,
+      "src/main/runtime/rpc/methods/orchestration/runs/runs.test.ts": 3653,
+      "src/main/runtime/rpc/methods/orchestration/runs/tasks-dispatch.test.ts": 3767,
+      "src/main/runtime/rpc/methods/orchestration/worker/agent-status-producer-census.test.ts": 5044,
+      "src/main/runtime/rpc/methods/orchestration/worker/antigravity-worker-lifecycle.test.ts": 3631,
+      "src/main/runtime/rpc/methods/orchestration/worker/composed-workers.test.ts": 3335,
+      "src/main/runtime/rpc/methods/orchestration/worker/context-only-dispatch-retry.test.ts": 3459,
+      "src/main/runtime/rpc/methods/orchestration/worker/fleet-status-observed-identity.test.ts": 2831,
+      "src/main/runtime/rpc/methods/orchestration/worker/fleet-status-terminal-identity.test.ts": 2477,
+      "src/main/runtime/rpc/methods/orchestration/worker/legacy-dispatch-projection.test.ts": 3377,
+      "src/main/runtime/rpc/methods/orchestration/worker/manual-dispatch-observation.test.ts": 3653,
+      "src/main/runtime/rpc/methods/orchestration/worker/manual-dispatch-release.test.ts": 2997,
+      "src/main/runtime/rpc/methods/orchestration/worker/self-dispatch-nesting-depth.test.ts": 3581,
+      "src/main/runtime/rpc/methods/orchestration/worker/structured-worker-launch-seed-options.test.ts": 301,
+      "src/main/runtime/rpc/methods/orchestration/worker/worker-interactive-wait.test.ts": 2671,
+      "src/main/runtime/rpc/methods/orchestration/worker/worker-launch-preferences.test.ts": 185,
+      "src/main/runtime/rpc/methods/orchestration/worker/worker-list-pagination.test.ts": 2921,
+      "src/main/runtime/rpc/methods/orchestration/worker/worker-list-run-scope-rpc.test.ts": 3483,
+      "src/main/runtime/rpc/methods/orchestration/worker/worker-observation.test.ts": 226,
+      "src/main/runtime/rpc/methods/orchestration/worker/worker-output.test.ts": 189,
+      "src/main/runtime/rpc/methods/orchestration/worker/worker-read-projection.test.ts": 2982,
+      "src/main/runtime/rpc/methods/orchestration/worker/worker-release-archive.test.ts": 2904,
+      "src/main/runtime/rpc/methods/orchestration/worker/worker-release-inventory.test.ts": 3642,
+      "src/main/runtime/rpc/methods/orchestration/worker/worker-release-liveness-verdict.test.ts": 386,
+      "src/main/runtime/rpc/methods/orchestration/worker/worker-release-mobile-report.test.ts": 2795,
+      "src/main/runtime/rpc/methods/orchestration/worker/worker-release-ownership-guard.test.ts": 3055,
+      "src/main/runtime/rpc/methods/orchestration/worker/worker-release-recovery.test.ts": 3085,
+      "src/main/runtime/rpc/methods/orchestration/worker/worker-release.test.ts": 3192,
+      "src/main/runtime/rpc/methods/orchestration/worker/worker-start-budgets.test.ts": 37,
+      "src/main/runtime/rpc/methods/orchestration/worker/worker-start-outcome-classification.test.ts": 306,
+      "src/main/runtime/rpc/methods/orchestration/worker/worker-start-prompt-budget.test.ts": 103,
+      "src/main/runtime/rpc/methods/orchestration/worker/worker-start-prompt-contract.test.ts": 3639,
+      "src/main/runtime/rpc/methods/orchestration/worker/worker-start-terminal-target.test.ts": 3746,
+      "src/main/runtime/rpc/methods/orchestration/worker/worker-start-turn-observation.test.ts": 47,
+      "src/main/runtime/rpc/methods/orchestration/worker/worker-stop-capability.test.ts": 394,
+      "src/main/runtime/rpc/methods/orchestration/worker/worker-stop-exit-race.test.ts": 2902,
+      "src/main/runtime/rpc/methods/orchestration/worker/worker-stop-liveness-verdict.test.ts": 2444,
+      "src/main/runtime/rpc/methods/orchestration/worker/worker-terminal-custody-at-creation.test.ts": 3618,
+      "src/main/runtime/rpc/methods/orchestration/worker/workers-new-worktree.test.ts": 4522,
+      "src/main/runtime/rpc/methods/orchestration/worker/workers-recovery.test.ts": 2613,
+      "src/main/runtime/rpc/methods/paired-caller-host-id.test.ts": 57,
+      "src/main/runtime/rpc/methods/pairing.test.ts": 4021,
+      "src/main/runtime/rpc/methods/plugins.test.ts": 357,
+      "src/main/runtime/rpc/methods/preflight.test.ts": 1474,
+      "src/main/runtime/rpc/methods/project-host-setup-self-host-stamp.test.ts": 147,
+      "src/main/runtime/rpc/methods/repo-badge-color.test.ts": 1628,
+      "src/main/runtime/rpc/methods/repo.test.ts": 3091,
+      "src/main/runtime/rpc/methods/runtime-client-capabilities.test.ts": 2076,
+      "src/main/runtime/rpc/methods/session-tab-agent-capability-mutations.test.ts": 1544,
+      "src/main/runtime/rpc/methods/session-tab-agent-status-projection.test.ts": 72,
+      "src/main/runtime/rpc/methods/session-tab-browser-placement-mutations.test.ts": 1954,
+      "src/main/runtime/rpc/methods/session-tab-browser-placement-projection.test.ts": 43,
+      "src/main/runtime/rpc/methods/session-tabs-inventory-census-race.test.ts": 7364,
+      "src/main/runtime/rpc/methods/session-tabs-inventory-rpc.test.ts": 3424,
+      "src/main/runtime/rpc/methods/session-tabs-move-validation.test.ts": 3387,
+      "src/main/runtime/rpc/methods/session-tabs-retirement-proof-delta.test.ts": 1812,
+      "src/main/runtime/rpc/methods/session-tabs-schemas.test.ts": 214,
+      "src/main/runtime/rpc/methods/session-tabs-structured-restore.test.ts": 1499,
+      "src/main/runtime/rpc/methods/session-tabs-unsubscribe.test.ts": 1741,
+      "src/main/runtime/rpc/methods/session-tabs.test.ts": 2523,
+      "src/main/runtime/rpc/methods/skills.test.ts": 145,
+      "src/main/runtime/rpc/methods/speech.test.ts": 2115,
+      "src/main/runtime/rpc/methods/ssh.test.ts": 2113,
+      "src/main/runtime/rpc/methods/status-machine-name-publish-budget.test.ts": 4507,
+      "src/main/runtime/rpc/methods/status.test.ts": 3576,
+      "src/main/runtime/rpc/methods/structured-agent-session-admission.test.ts": 1748,
+      "src/main/runtime/rpc/methods/structured-agent-session-adoption-replay.test.ts": 3622,
+      "src/main/runtime/rpc/methods/structured-agent-session-background-task-capability.test.ts": 1976,
+      "src/main/runtime/rpc/methods/structured-agent-session-conversation-outline.test.ts": 2085,
+      "src/main/runtime/rpc/methods/structured-agent-session-hold.test.ts": 5554,
+      "src/main/runtime/rpc/methods/structured-agent-session-options-read.test.ts": 1458,
+      "src/main/runtime/rpc/methods/structured-agent-session-policy.test.ts": 56,
+      "src/main/runtime/rpc/methods/structured-agent-session-precommit-refusal.test.ts": 2074,
+      "src/main/runtime/rpc/methods/structured-agent-session-respond-params.test.ts": 2079,
+      "src/main/runtime/rpc/methods/structured-agent-session-turn-item-capability.test.ts": 1973,
+      "src/main/runtime/rpc/methods/structured-agent-session.test.ts": 3566,
+      "src/main/runtime/rpc/methods/structured-chat-tab-table.test.ts": 4222,
+      "src/main/runtime/rpc/methods/structured-worker-read-cursor.test.ts": 278,
+      "src/main/runtime/rpc/methods/structured-worker-stop-receipt.test.ts": 3571,
+      "src/main/runtime/rpc/methods/structured-worker-tab-retirement.test.ts": 3424,
+      "src/main/runtime/rpc/methods/task-provider-identity.test.ts": 199,
+      "src/main/runtime/rpc/methods/terminal-create-idempotency.test.ts": 243,
+      "src/main/runtime/rpc/methods/terminal-legacy-stream-id-characterization.test.ts": 1363,
+      "src/main/runtime/rpc/methods/terminal-manifest-characterization.test.ts": 218,
+      "src/main/runtime/rpc/methods/terminal-navigation.test.ts": 1906,
+      "src/main/runtime/rpc/methods/terminal-read-screen-cursor.test.ts": 257,
+      "src/main/runtime/rpc/methods/terminal-stream-extraction-characterization.test.ts": 99,
+      "src/main/runtime/rpc/methods/terminal/terminal-inspect-process-params.test.ts": 171,
+      "src/main/runtime/rpc/methods/terminal/terminal-output-batcher.test.ts": 56,
+      "src/main/runtime/rpc/methods/terminal/terminal-snapshot-json-byte-budget.test.ts": 440,
+      "src/main/runtime/rpc/methods/updater.test.ts": 96,
+      "src/main/runtime/rpc/methods/workspace-cleanup-ui-schema.test.ts": 174,
+      "src/main/runtime/rpc/methods/workspace-ports.test.ts": 1990,
+      "src/main/runtime/rpc/methods/worktree-catalog-snapshot-method.test.ts": 1995,
+      "src/main/runtime/rpc/methods/worktree-catalog-version-stamp.test.ts": 1225,
+      "src/main/runtime/rpc/methods/worktree-create-args.test.ts": 229,
+      "src/main/runtime/rpc/methods/worktree-create-navigation.test.ts": 2179,
+      "src/main/runtime/rpc/methods/worktree-github-pr-suppression.test.ts": 1632,
+      "src/main/runtime/rpc/methods/worktree-missing-terminal-teardown.test.ts": 2053,
+      "src/main/runtime/rpc/methods/worktree-retired-names.test.ts": 2044,
+      "src/main/runtime/rpc/methods/worktree-rm-host-qualification.test.ts": 1170,
+      "src/main/runtime/rpc/methods/worktree-rm-pty-waiver.test.ts": 1653,
+      "src/main/runtime/rpc/methods/worktree-schemas.test.ts": 213,
+      "src/main/runtime/rpc/methods/worktree.test.ts": 1890,
+      "src/main/runtime/rpc/mobile-auth-acl-critical-path.test.ts": 738,
+      "src/main/runtime/rpc/mobile-clipboard-image-provenance.test.ts": 75,
+      "src/main/runtime/rpc/mobile-e2ee-outbound-memory-budget.test.ts": 39,
+      "src/main/runtime/rpc/mobile-e2ee-v2-desktop-session.test.ts": 88,
+      "src/main/runtime/rpc/mobile-e2ee-v2-key-schedule.test.ts": 58,
+      "src/main/runtime/rpc/mobile-socket-wiring.test.ts": 407,
+      "src/main/runtime/rpc/orchestration-11745-regression-verification.test.ts": 6095,
+      "src/main/runtime/rpc/orchestration-commit-notify-characterization.test.ts": 4449,
+      "src/main/runtime/rpc/orchestration-contract-fence.test.ts": 3677,
+      "src/main/runtime/rpc/orchestration-current-authority-precedence.test.ts": 4165,
+      "src/main/runtime/rpc/orchestration-legacy-compatibility-dispatcher.test.ts": 4292,
+      "src/main/runtime/rpc/orchestration-legacy-coordinator-race.test.ts": 5243,
+      "src/main/runtime/rpc/orchestration-legacy-fence-jurisdiction.test.ts": 4116,
+      "src/main/runtime/rpc/orchestration-legacy-question-takeover.test.ts": 4209,
+      "src/main/runtime/rpc/orchestration-legacy-run-routing.test.ts": 4083,
+      "src/main/runtime/rpc/orchestration-legacy-takeover-current-authority.test.ts": 3570,
+      "src/main/runtime/rpc/orchestration-legacy-takeover-delivery.test.ts": 3472,
+      "src/main/runtime/rpc/orchestration-legacy-takeover-dispatcher.test.ts": 3978,
+      "src/main/runtime/rpc/orchestration-mutation-executor.test.ts": 2234,
+      "src/main/runtime/rpc/orchestration-mutation-ledger.test.ts": 4386,
+      "src/main/runtime/rpc/orchestration-mutation-request-show-legacy.test.ts": 3422,
+      "src/main/runtime/rpc/orchestration-mutation-request-show.test.ts": 3415,
+      "src/main/runtime/rpc/orchestration-party-addressing.test.ts": 2984,
+      "src/main/runtime/rpc/orchestration-party-agreement.test.ts": 4332,
+      "src/main/runtime/rpc/orchestration-runtime-update-settlement.test.ts": 3707,
+      "src/main/runtime/rpc/orchestration-session-caller.test.ts": 3095,
+      "src/main/runtime/rpc/orchestration-session-coordinator.test.ts": 4617,
+      "src/main/runtime/rpc/orchestration-session-recipient.test.ts": 3497,
+      "src/main/runtime/rpc/orchestration-task-dispatch-invariant.test.ts": 4509,
+      "src/main/runtime/rpc/relay-transport.test.ts": 232,
+      "src/main/runtime/rpc/remote-runtime-server-heartbeat-missed-probe-tolerance.test.ts": 66,
+      "src/main/runtime/rpc/remote-runtime-server-heartbeat.test.ts": 66,
+      "src/main/runtime/rpc/runtime-client-capabilities.test.ts": 51,
+      "src/main/runtime/rpc/runtime-close-attribution-topology.test.ts": 1449,
+      "src/main/runtime/rpc/runtime-close-attribution.test.ts": 1499,
+      "src/main/runtime/rpc/schemas.test.ts": 342,
+      "src/main/runtime/rpc/static-web-client-handler-stream.test.ts": 4560,
+      "src/main/runtime/rpc/streaming.test.ts": 2073,
+      "src/main/runtime/rpc/terminal-agent-prompt-send.test.ts": 1690,
+      "src/main/runtime/rpc/terminal-agent-send-guard.test.ts": 2687,
+      "src/main/runtime/rpc/terminal-geometry-stale-handle.test.ts": 1909,
+      "src/main/runtime/rpc/terminal-lease-stale-handle-survival.test.ts": 1995,
+      "src/main/runtime/rpc/terminal-list-host-scope-transport.test.ts": 1877,
+      "src/main/runtime/rpc/terminal-multiplex-ack-output-budget.test.ts": 2532,
+      "src/main/runtime/rpc/terminal-multiplex-ack-overflow-recovery.test.ts": 3965,
+      "src/main/runtime/rpc/terminal-multiplex-desktop-resize-routing.test.ts": 1743,
+      "src/main/runtime/rpc/terminal-multiplex-end-verdict.test.ts": 2073,
+      "src/main/runtime/rpc/terminal-multiplex-escape-tail.test.ts": 1942,
+      "src/main/runtime/rpc/terminal-multiplex-flow-control.bench.test.ts": 42,
+      "src/main/runtime/rpc/terminal-multiplex-initial-snapshot-buffering.test.ts": 2257,
+      "src/main/runtime/rpc/terminal-multiplex-input-write-rejection.test.ts": 2087,
+      "src/main/runtime/rpc/terminal-multiplex-output-pause-and-viewport.test.ts": 2541,
+      "src/main/runtime/rpc/terminal-multiplex-pty-wait-capacity.test.ts": 2115,
+      "src/main/runtime/rpc/terminal-multiplex-resync-replay-trim.test.ts": 2070,
+      "src/main/runtime/rpc/terminal-multiplex-round-robin.test.ts": 53,
+      "src/main/runtime/rpc/terminal-multiplex-snapshot-serialization.test.ts": 2326,
+      "src/main/runtime/rpc/terminal-multiplex-source-range-admission.test.ts": 2706,
+      "src/main/runtime/rpc/terminal-multiplex-subscribe-slot-recovery.test.ts": 1321,
+      "src/main/runtime/rpc/terminal-opencode-send-guard.integration.test.ts": 4114,
+      "src/main/runtime/rpc/terminal-output-batching.test.ts": 1858,
+      "src/main/runtime/rpc/terminal-output-frame-chunks-equivalence.test.ts": 24855,
+      "src/main/runtime/rpc/terminal-output-frame-source-ranges.test.ts": 48,
+      "src/main/runtime/rpc/terminal-prompt-delivery-receipt.test.ts": 2576,
+      "src/main/runtime/rpc/terminal-provider-snapshot-sequence.test.ts": 2196,
+      "src/main/runtime/rpc/terminal-requested-snapshot-unavailability.test.ts": 2186,
+      "src/main/runtime/rpc/terminal-send-launch-draft-resolution.test.ts": 1892,
+      "src/main/runtime/rpc/terminal-send.test.ts": 2332,
+      "src/main/runtime/rpc/terminal-source-range-ledger.test.ts": 56,
+      "src/main/runtime/rpc/terminal-stream-byte-length.test.ts": 6429,
+      "src/main/runtime/rpc/terminal-subscribe-blank-mount.test.ts": 1622,
+      "src/main/runtime/rpc/terminal-subscribe-buffer.test.ts": 8969,
+      "src/main/runtime/rpc/terminal-subscribe-lease-only.test.ts": 2041,
+      "src/main/runtime/rpc/terminal-subscribe-mount-replay.test.ts": 1193,
+      "src/main/runtime/rpc/terminal-subscribe-ownership.test.ts": 2029,
+      "src/main/runtime/rpc/terminal-subscribe-reconnect-rebind.test.ts": 1967,
+      "src/main/runtime/rpc/terminal-subscribe-relay-drop-lease-survival.test.ts": 3468,
+      "src/main/runtime/rpc/terminal-subscribe-renderer-recovery-output.test.ts": 1930,
+      "src/main/runtime/rpc/unix-socket-transport.test.ts": 88,
+      "src/main/runtime/rpc/unpaired-device-auth-throttle.test.ts": 37,
+      "src/main/runtime/rpc/worktree-catalog-snapshot.test.ts": 65,
+      "src/main/runtime/rpc/ws-fallback-port-store.test.ts": 43,
+      "src/main/runtime/rpc/ws-transport-accept-order.test.ts": 157,
+      "src/main/runtime/rpc/ws-transport-static-web.test.ts": 218,
+      "src/main/runtime/rpc/ws-transport-transient-packet-loss.test.ts": 721,
+      "src/main/runtime/rpc/ws-transport.test.ts": 1076,
+      "src/main/runtime/runtime-agent-row-main-agent-projection.test.ts": 51,
+      "src/main/runtime/runtime-binary-message-router.test.ts": 36,
+      "src/main/runtime/runtime-browser-client-automation.test.ts": 181,
+      "src/main/runtime/runtime-browser-client-page-adoption.test.ts": 210,
+      "src/main/runtime/runtime-browser-client-page-creation.test.ts": 126,
+      "src/main/runtime/runtime-browser-client-page-recovery.test.ts": 250,
+      "src/main/runtime/runtime-browser-client-page-restored-recovery.test.ts": 116,
+      "src/main/runtime/runtime-browser-network-execution-host.test.ts": 43,
+      "src/main/runtime/runtime-browser-page-registry.test.ts": 57,
+      "src/main/runtime/runtime-client-settings-linear-team-projection.test.ts": 453,
+      "src/main/runtime/runtime-client-settings-minimax-projection.test.ts": 289,
+      "src/main/runtime/runtime-client-settings-terminal-copy-projection.test.ts": 429,
+      "src/main/runtime/runtime-extraction-regressions.test.ts": 3371,
+      "src/main/runtime/runtime-file-path-existence.test.ts": 1374,
+      "src/main/runtime/runtime-file-target-connection-field-ratchet.test.ts": 37,
+      "src/main/runtime/runtime-file-target-execution-host.test.ts": 3281,
+      "src/main/runtime/runtime-file-upload-decode.test.ts": 3770,
+      "src/main/runtime/runtime-folder-workspace.test.ts": 50,
+      "src/main/runtime/runtime-folder-worktree-create.test.ts": 71,
+      "src/main/runtime/runtime-git-api-contract.test.ts": 722,
+      "src/main/runtime/runtime-git-branch-compare-admission.test.ts": 66,
+      "src/main/runtime/runtime-git-command-target.test.ts": 34,
+      "src/main/runtime/runtime-git-conflict-operation-routing.test.ts": 501,
+      "src/main/runtime/runtime-git-execution-host-ownership.test.ts": 819,
+      "src/main/runtime/runtime-git-generation-admission.test.ts": 132,
+      "src/main/runtime/runtime-git-status-admission.test.ts": 2074,
+      "src/main/runtime/runtime-git-sync-commands.test.ts": 795,
+      "src/main/runtime/runtime-git-target-execution-host.test.ts": 2543,
+      "src/main/runtime/runtime-graph-reload-lifecycle.test.ts": 39,
+      "src/main/runtime/runtime-hook-agent-row-selection.test.ts": 91,
+      "src/main/runtime/runtime-legacy-worker-terminal-recovery-retry.test.ts": 40,
+      "src/main/runtime/runtime-linear-read-commands.test.ts": 118,
+      "src/main/runtime/runtime-local-create-rearm-ordering.test.ts": 3195,
+      "src/main/runtime/runtime-local-worktree-create.test.ts": 258,
+      "src/main/runtime/runtime-local-worktree-materialization.test.ts": 71,
+      "src/main/runtime/runtime-local-worktree-terminal-startup.test.ts": 46,
+      "src/main/runtime/runtime-machine-name.test.ts": 76,
+      "src/main/runtime/runtime-managed-worktree-metadata-sweep.test.ts": 1074,
+      "src/main/runtime/runtime-managed-worktree-metadata.test.ts": 75,
+      "src/main/runtime/runtime-managed-worktree-queries.test.ts": 275,
+      "src/main/runtime/runtime-metadata-ownership-watch.test.ts": 119,
+      "src/main/runtime/runtime-metadata.test.ts": 168,
+      "src/main/runtime/runtime-mobile-agent-status-builder.test.ts": 62,
+      "src/main/runtime/runtime-mobile-file-path-search.test.ts": 32,
+      "src/main/runtime/runtime-owned-terminal-publication-lineage.test.ts": 3962,
+      "src/main/runtime/runtime-project-group-controller-folder-delete.test.ts": 53,
+      "src/main/runtime/runtime-project-host-setup-controller.test.ts": 328,
+      "src/main/runtime/runtime-remote-fetch-ref-maintenance.test.ts": 292,
+      "src/main/runtime/runtime-remote-managed-worktree-create.test.ts": 42,
+      "src/main/runtime/runtime-remove-project-host-scope.test.ts": 2613,
+      "src/main/runtime/runtime-repository-issue-command.test.ts": 280,
+      "src/main/runtime/runtime-resolved-worktree-cache.test.ts": 54,
+      "src/main/runtime/runtime-rpc-browser-host-admission.test.ts": 4251,
+      "src/main/runtime/runtime-rpc-device-revocation.test.ts": 4197,
+      "src/main/runtime/runtime-rpc-long-poll-transport.test.ts": 6862,
+      "src/main/runtime/runtime-rpc-metadata-lifecycle.test.ts": 3056,
+      "src/main/runtime/runtime-rpc-mobile-method-allowlist.test.ts": 1796,
+      "src/main/runtime/runtime-rpc-mobile-native-chat-settings.test.ts": 29,
+      "src/main/runtime/runtime-rpc-mobile-terminal-streaming.test.ts": 4788,
+      "src/main/runtime/runtime-rpc-mobile-unknown-method-scope-refusal.test.ts": 1513,
+      "src/main/runtime/runtime-rpc-orchestration-db-migration.test.ts": 424,
+      "src/main/runtime/runtime-rpc-pairing-mode-persistence.test.ts": 3549,
+      "src/main/runtime/runtime-rpc-pairing-offer.test.ts": 4433,
+      "src/main/runtime/runtime-rpc-relay-pairing.test.ts": 4084,
+      "src/main/runtime/runtime-rpc-request-authorization.test.ts": 4122,
+      "src/main/runtime/runtime-rpc-startup-failure.test.ts": 66,
+      "src/main/runtime/runtime-rpc-terminal-list.test.ts": 4158,
+      "src/main/runtime/runtime-rpc-websocket-bind-host.test.ts": 4774,
+      "src/main/runtime/runtime-rpc-websocket-long-poll-caps.test.ts": 4036,
+      "src/main/runtime/runtime-rpc-worktree-queries.test.ts": 4031,
+      "src/main/runtime/runtime-search-line-fragments.test.ts": 264,
+      "src/main/runtime/runtime-server-git-availability.test.ts": 60,
+      "src/main/runtime/runtime-session-search-settings.test.ts": 66,
+      "src/main/runtime/runtime-skill-install-authority.test.ts": 64,
+      "src/main/runtime/runtime-skill-install-commands.test.ts": 428,
+      "src/main/runtime/runtime-skill-install-queries.test.ts": 263,
+      "src/main/runtime/runtime-socket-sweep.test.ts": 2436,
+      "src/main/runtime/runtime-subscription-registry.test.ts": 30,
+      "src/main/runtime/runtime-terminal-idle-polls.test.ts": 62,
+      "src/main/runtime/runtime-terminal-orphan-topology-validation.test.ts": 44,
+      "src/main/runtime/runtime-terminal-spawn-push-target-materialization.test.ts": 93,
+      "src/main/runtime/runtime-unregistered-worktree-removal-host-home.test.ts": 617,
+      "src/main/runtime/runtime-worktree-agent-rows-structured.test.ts": 473,
+      "src/main/runtime/runtime-worktree-agent-sources.test.ts": 49,
+      "src/main/runtime/runtime-worktree-agent-startup.test.ts": 166,
+      "src/main/runtime/runtime-worktree-ps-summaries.test.ts": 40,
+      "src/main/runtime/runtime-worktree-selection.test.ts": 53,
+      "src/main/runtime/runtime-worktree-structured-agent-rows-liveness.test.ts": 663,
+      "src/main/runtime/saved-structured-agent-session-restoration.test.ts": 24,
+      "src/main/runtime/selected-review-branch.test.ts": 44,
+      "src/main/runtime/session-tabs-inventory-publication.test.ts": 3283,
+      "src/main/runtime/settled-worker-process-replacement.test.ts": 2400,
+      "src/main/runtime/structured-agent-session-close.test.ts": 115,
+      "src/main/runtime/structured-agent-session-integration-replay.test.ts": 2654,
+      "src/main/runtime/structured-agent-session-integration.test.ts": 11330,
+      "src/main/runtime/structured-agent-session-rollback-compatibility.test.ts": 352,
+      "src/main/runtime/structured-agent-session-runtime-exit.test.ts": 1281,
+      "src/main/runtime/structured-agent-session-runtime-provider-started.test.ts": 1074,
+      "src/main/runtime/structured-agent-session-runtime.test.ts": 861,
+      "src/main/runtime/structured-agent-session-support-probe.test.ts": 3514,
+      "src/main/runtime/structured-agent-shell-environment.test.ts": 57,
+      "src/main/runtime/structured-claude-auth-policy-wiring.test.ts": 777,
+      "src/main/runtime/structured-claude-pending-rewind.test.ts": 1026,
+      "src/main/runtime/structured-conversation-tab-replacement.test.ts": 30,
+      "src/main/runtime/structured-session-worktree-teardown.test.ts": 3171,
+      "src/main/runtime/structured-worker-agent-presence.test.ts": 89,
+      "src/main/runtime/structured-worker-authority.test.ts": 207,
+      "src/main/runtime/structured-worker-child-identity-env.test.ts": 213,
+      "src/main/runtime/structured-worker-hook-attestation.test.ts": 1582,
+      "src/main/runtime/structured-worker-identity.test.ts": 263,
+      "src/main/runtime/structured-worker-mail-routing.test.ts": 1584,
+      "src/main/runtime/structured-worker-takeover-pane-key.test.ts": 3936,
+      "src/main/runtime/structured-worker-terminal-read.test.ts": 1912,
+      "src/main/runtime/structured-worker-terminal-refusal.test.ts": 170,
+      "src/main/runtime/terminal-ansi-pending-retention.test.ts": 524,
+      "src/main/runtime/terminal-chat-owner-persistence.test.ts": 4208,
+      "src/main/runtime/terminal-close-observed-exit.test.ts": 3596,
+      "src/main/runtime/terminal-close-slow-agent-exit.test.ts": 5694,
+      "src/main/runtime/terminal-focus-navigation-coalescer.test.ts": 64,
+      "src/main/runtime/terminal-identity-probe.test.ts": 31,
+      "src/main/runtime/terminal-interactive-wait-visibility.test.ts": 9863,
+      "src/main/runtime/terminal-leaf-tab-resolution.test.ts": 70,
+      "src/main/runtime/terminal-list-execution-host-scope.test.ts": 6496,
+      "src/main/runtime/terminal-list-payload-size.test.ts": 3401,
+      "src/main/runtime/terminal-list-pending-pty-registration.test.ts": 3228,
+      "src/main/runtime/terminal-list-stale-leaf-liveness.test.ts": 3332,
+      "src/main/runtime/terminal-list-surface-lost-orphan.test.ts": 3567,
+      "src/main/runtime/terminal-mobile-subscribe-tab-mount.test.ts": 3510,
+      "src/main/runtime/terminal-model-query-authority.test.ts": 64,
+      "src/main/runtime/terminal-orphan-owner.test.ts": 28,
+      "src/main/runtime/terminal-orphan-topology.test.ts": 52,
+      "src/main/runtime/terminal-pane-recovery-liveness-gate.test.ts": 2841,
+      "src/main/runtime/terminal-projection.test.ts": 3216,
+      "src/main/runtime/terminal-pty-exit-waiter.test.ts": 2056,
+      "src/main/runtime/terminal-query-responder.test.ts": 13500,
+      "src/main/runtime/terminal-restore-record-seed.test.ts": 3311,
+      "src/main/runtime/terminal-retirement-async-durability.test.ts": 3860,
+      "src/main/runtime/terminal-retirement-proof-emitted-frame.test.ts": 3415,
+      "src/main/runtime/terminal-retirement-proof-publication.test.ts": 3354,
+      "src/main/runtime/terminal-send-stale-leaf-liveness.test.ts": 3416,
+      "src/main/runtime/terminal-shell-override-host-support.test.ts": 42,
+      "src/main/runtime/terminal-subscribe-exit-waiter-leak.test.ts": 1849,
+      "src/main/runtime/terminal-subscriber-driven-daemon-attach.test.ts": 4855,
+      "src/main/runtime/terminal-tail-buffer.test.ts": 5683,
+      "src/main/runtime/terminal-tail-row-retention.test.ts": 314,
+      "src/main/runtime/terminal-tail-sentinel-index.test.ts": 2880,
+      "src/main/runtime/terminal-tail-whitespace.test.ts": 80,
+      "src/main/runtime/terminal-vertical-control-scan.test.ts": 74,
+      "src/main/runtime/terminal-wait-detection.test.ts": 84,
+      "src/main/runtime/terminal-wait-name-only-idle.test.ts": 7790,
+      "src/main/runtime/terminal-wait-results.test.ts": 36,
+      "src/main/runtime/terminal-wait-tail-window.test.ts": 173,
+      "src/main/runtime/tui-idle-delivery-and-quiescence.test.ts": 5355,
+      "src/main/runtime/tui-idle-evidence.test.ts": 75,
+      "src/main/runtime/tui-idle-name-only-real-pty.integration.test.ts": 20972,
+      "src/main/runtime/unreadable-secret-store-preservation.win32.test.ts": 38,
+      "src/main/runtime/wait-blocked-check-state.test.ts": 93,
+      "src/main/runtime/wait-blocked-keyword-carry-retention.test.ts": 2640,
+      "src/main/runtime/windows-default-route-interfaces.test.ts": 43,
+      "src/main/runtime/windows-drive-listing.test.ts": 65,
+      "src/main/runtime/windows-firewall-remote-scope.test.ts": 53,
+      "src/main/runtime/windows-mobile-firewall.test.ts": 101,
+      "src/main/runtime/workspace-session-membership-scaling.test.ts": 47,
+      "src/main/runtime/workspace-session-worktree-id.test.ts": 124,
+      "src/main/runtime/worktree-launch-host-repo.test.ts": 42,
+      "src/main/runtime/worktree-list-host-scope.test.ts": 479,
+      "src/main/runtime/worktree-path-selector-wsl-posix.test.ts": 2032,
+      "src/main/runtime/worktree-ps-degraded-repo-scan.test.ts": 2660,
+      "src/main/runtime/worktree-ps-host-scope.test.ts": 3244,
+      "src/main/runtime/worktree-rm-id-selector-path-spelling.test.ts": 3632,
+      "src/main/runtime/worktree-scan-admin-fingerprint-gate.test.ts": 2610,
+      "src/main/runtime/worktree-scan-execution-host-routing.test.ts": 2961,
+      "src/main/runtime/worktree-teardown-unstopped-pty.test.ts": 436,
+      "src/main/runtime/worktree-teardown.test.ts": 1806,
+      "src/main/runtime/worktree-terminal-mutation-lock.test.ts": 104,
+      "src/main/runtime/zcode-readiness-transcript.test.ts": 3116,
+      "src/main/serve-update-handoff.app-environment.test.ts": 860,
+      "src/main/serve-update-handoff.test.ts": 42,
+      "src/main/server/serve-readiness.test.ts": 67,
+      "src/main/server/serve-stdout-boundary.test.ts": 39,
+      "src/main/shell-prompt-readiness-probe.test.ts": 55,
+      "src/main/shell-startup-identity-scanner.test.ts": 39,
+      "src/main/shell-startup-output-scanner.test.ts": 67,
+      "src/main/shell-wrapper-content-address.test.ts": 67,
+      "src/main/shell-wrapper-generated-file-snapshot.test.ts": 111,
+      "src/main/sidecar-snapshot-file.test.ts": 52,
+      "src/main/skills/agent-skill-selection.test.ts": 142,
+      "src/main/skills/claude-plugin-skill-sources-wsl.test.ts": 85,
+      "src/main/skills/claude-plugin-skill-sources.test.ts": 42,
+      "src/main/skills/discovery-filter-sharing.test.ts": 275,
+      "src/main/skills/discovery-source-filter-order.test.ts": 127,
+      "src/main/skills/discovery.test.ts": 199,
+      "src/main/skills/skill-bundle-artifacts.test.ts": 114,
+      "src/main/skills/skill-bundle-creation.test.ts": 456,
+      "src/main/skills/skill-bundle-install-service.test.ts": 533,
+      "src/main/skills/skill-bundle-observability-summary.test.ts": 47,
+      "src/main/skills/skill-bundle-process-termination-child.test.ts": 248,
+      "src/main/skills/skill-bundle-process-termination.integration.test.ts": 205,
+      "src/main/skills/skill-bundle-ssh-relay-service.test.ts": 339,
+      "src/main/skills/skill-candidate-concurrency.test.ts": 84,
+      "src/main/skills/skill-client-mediated-transfer-cancellation.test.ts": 105,
+      "src/main/skills/skill-client-mediated-transfer.test.ts": 197,
+      "src/main/skills/skill-cloud-direct-upload.test.ts": 182,
+      "src/main/skills/skill-cloud-grant-installation.test.ts": 172,
+      "src/main/skills/skill-cloud-install-target.test.ts": 28,
+      "src/main/skills/skill-cloud-request.test.ts": 152,
+      "src/main/skills/skill-cloud-service.test.ts": 377,
+      "src/main/skills/skill-delete/plan.test.ts": 272,
+      "src/main/skills/skill-delete/recovery.test.ts": 253,
+      "src/main/skills/skill-delete/roots.test.ts": 71,
+      "src/main/skills/skill-delete/service.test.ts": 549,
+      "src/main/skills/skill-delete/staging-visibility.test.ts": 96,
+      "src/main/skills/skill-delete/wsl-enumeration-protocol.test.ts": 44,
+      "src/main/skills/skill-discovery-concurrency.test.ts": 194,
+      "src/main/skills/skill-discovery-order.test.ts": 565,
+      "src/main/skills/skill-discovery-source-filter.test.ts": 43,
+      "src/main/skills/skill-discovery-target.test.ts": 116,
+      "src/main/skills/skill-discovery-wsl-alias-sharing.test.ts": 108,
+      "src/main/skills/skill-discovery-wsl-bash-filter.test.ts": 3445,
+      "src/main/skills/skill-discovery-wsl-plugins.test.ts": 87,
+      "src/main/skills/skill-discovery-wsl-script-roundtrip.test.ts": 115,
+      "src/main/skills/skill-discovery-wsl.test.ts": 106,
+      "src/main/skills/skill-freshness-eligibility.test.ts": 92,
+      "src/main/skills/skill-freshness-inventory-limits.test.ts": 174,
+      "src/main/skills/skill-freshness-inventory.test.ts": 1854,
+      "src/main/skills/skill-git-tree-identity.test.ts": 122,
+      "src/main/skills/skill-install-destinations.test.ts": 75,
+      "src/main/skills/skill-install-discovery-verification.test.ts": 87,
+      "src/main/skills/skill-install-lock-release.test.ts": 70,
+      "src/main/skills/skill-install-lock.test.ts": 398,
+      "src/main/skills/skill-install-management-service.test.ts": 327,
+      "src/main/skills/skill-install-provenance.test.ts": 61,
+      "src/main/skills/skill-install-recovery.test.ts": 479,
+      "src/main/skills/skill-install-request-service.test.ts": 421,
+      "src/main/skills/skill-install-service.test.ts": 1067,
+      "src/main/skills/skill-install-transaction.test.ts": 2836,
+      "src/main/skills/skill-operation-observability.test.ts": 316,
+      "src/main/skills/skill-package-creation.test.ts": 427,
+      "src/main/skills/skill-package-deterministic-gzip.test.ts": 1123,
+      "src/main/skills/skill-package-download.test.ts": 270,
+      "src/main/skills/skill-package-identity.test.ts": 196,
+      "src/main/skills/skill-package-tar.test.ts": 429,
+      "src/main/skills/skill-placement-alias-repair.test.ts": 192,
+      "src/main/skills/skill-placement-copy-drift.test.ts": 110,
+      "src/main/skills/skill-placement-reconciliation.test.ts": 233,
+      "src/main/skills/skill-placement-transaction.test.ts": 233,
+      "src/main/skills/skill-plugin-cache-scan.test.ts": 766,
+      "src/main/skills/skill-process-contention-child.test.ts": 236,
+      "src/main/skills/skill-process-contention.integration.test.ts": 125,
+      "src/main/skills/skill-process-termination-child.test.ts": 228,
+      "src/main/skills/skill-process-termination.integration.test.ts": 169,
+      "src/main/skills/skill-provider-destinations.test.ts": 39,
+      "src/main/skills/skill-provider-runtime-roots.test.ts": 38,
+      "src/main/skills/skill-remote-error-category-parity.test.ts": 228,
+      "src/main/skills/skill-remote-install-cancellation.test.ts": 28,
+      "src/main/skills/skill-remote-install-service.test.ts": 220,
+      "src/main/skills/skill-remove-transaction.test.ts": 494,
+      "src/main/skills/skill-root-file-walk.test.ts": 87,
+      "src/main/skills/skill-runtime-capability.test.ts": 59,
+      "src/main/skills/skill-scan-coalescer.test.ts": 34,
+      "src/main/skills/skill-share-preparation-service.test.ts": 305,
+      "src/main/skills/skill-ssh-relay-service.test.ts": 312,
+      "src/main/skills/skill-transaction-startup-recovery.test.ts": 332,
+      "src/main/skills/skill-update-convergence.test.ts": 76,
+      "src/main/skills/skill-update-outcome.test.ts": 306,
+      "src/main/skills/skill-update-registration.test.ts": 30,
+      "src/main/skills/skill-update-run.test.ts": 157,
+      "src/main/skills/skill-upload-process-restart-child.test.ts": 158,
+      "src/main/skills/skill-upload-process-restart.integration.test.ts": 155,
+      "src/main/skills/skill-upload-session-admission-regression.test.ts": 199,
+      "src/main/skills/skill-upload-session-service.test.ts": 240,
+      "src/main/skills/skill-windows-rename-contention.integration.test.ts": 43,
+      "src/main/skills/skill-windows-workspace.integration.test.ts": 180,
+      "src/main/skills/skill-wsl-delete.integration.test.ts": 55,
+      "src/main/skills/skill-wsl-install-filesystem.test.ts": 63,
+      "src/main/skills/skill-wsl-install-transaction.integration.test.ts": 256,
+      "src/main/skills/skill-wsl-posix-semantics.integration.test.ts": 225,
+      "src/main/skills/skill-wsl-provider-detection.test.ts": 46,
+      "src/main/source-control/forge-provider.test.ts": 259,
+      "src/main/source-control/hosted-review-azure-devops.integration.test.ts": 548,
+      "src/main/source-control/hosted-review-base-ref-suffix.test.ts": 210,
+      "src/main/source-control/hosted-review-bitbucket.integration.test.ts": 1294,
+      "src/main/source-control/hosted-review-branch-cache.test.ts": 669,
+      "src/main/source-control/hosted-review-creation-eligibility.test.ts": 325,
+      "src/main/source-control/hosted-review-creation-gitlab-self-hosted.test.ts": 194,
+      "src/main/source-control/hosted-review-creation-shared-symlinks.test.ts": 192,
+      "src/main/source-control/hosted-review-creation.test.ts": 230,
+      "src/main/source-control/hosted-review-dirty-preflight-wsl-paths.test.ts": 222,
+      "src/main/source-control/hosted-review-execution-host-routing.test.ts": 101,
+      "src/main/source-control/hosted-review-gitea.integration.test.ts": 850,
+      "src/main/source-control/hosted-review.test.ts": 112,
+      "src/main/source-control/pull-request-linked-issue.test.ts": 54,
+      "src/main/source-control/repo-default-branch.test.ts": 88,
+      "src/main/source-control/stacked-hosted-review-creation.test.ts": 44,
+      "src/main/speech/model-catalog.test.ts": 41,
+      "src/main/speech/model-manager-download-error.test.ts": 83,
+      "src/main/speech/model-manager-download-resume.test.ts": 3099,
+      "src/main/speech/model-manager-progress-callback.test.ts": 64,
+      "src/main/speech/model-manager-stream-cleanup.test.ts": 77,
+      "src/main/speech/model-manager-windows-path.test.ts": 242,
+      "src/main/speech/model-manager.test.ts": 140,
+      "src/main/speech/openai-api-key-store.test.ts": 53,
+      "src/main/speech/openai-transcription-client.test.ts": 51,
+      "src/main/speech/speech-model-deletion.test.ts": 158,
+      "src/main/speech/speech-model-download-response.test.ts": 62,
+      "src/main/speech/stt-offline-audio-chunker.test.ts": 155,
+      "src/main/speech/stt-service.test.ts": 86,
+      "src/main/speech/stt-worker-model-config.test.ts": 48,
+      "src/main/speech/stt-worker.test.ts": 38,
+      "src/main/sqlite/bun-readonly-wal.test.ts": 137,
+      "src/main/sqlite/sqlite-read-failure.test.ts": 60,
+      "src/main/sqlite/sync-database-concurrent-backup.test.ts": 815,
+      "src/main/sqlite/sync-database-portability.test.ts": 108,
+      "src/main/sqlite/sync-database.test.ts": 806,
+      "src/main/ssh-expired-lease-pane-readoption.test.ts": 1542,
+      "src/main/ssh-reattach-pane-cardinality.test.ts": 1109,
+      "src/main/ssh/orcad-activation-gate.test.ts": 56,
+      "src/main/ssh/orcad-activation-record.test.ts": 44,
+      "src/main/ssh/orcad-artifact-materializer.test.ts": 681,
+      "src/main/ssh/orcad-bun-runtime-materializer.test.ts": 357,
+      "src/main/ssh/orcad-deployment-target.test.ts": 195,
+      "src/main/ssh/orcad-remote-deploy.test.ts": 479,
+      "src/main/ssh/orcad-remote-gc.test.ts": 161,
+      "src/main/ssh/orcad-remote-install-termination.test.ts": 201,
+      "src/main/ssh/orcad-remote-launch.test.ts": 169,
+      "src/main/ssh/orcad-remote-rollback.test.ts": 254,
+      "src/main/ssh/orcad-remote-runtime.test.ts": 228,
+      "src/main/ssh/orcad-remote-shell-commands.integration.test.ts": 4806,
+      "src/main/ssh/orcad-state-snapshot.test.ts": 135,
+      "src/main/ssh/orcad-update-plan.test.ts": 62,
+      "src/main/ssh/relay-native-dependency-coverage.test.ts": 504,
+      "src/main/ssh/relay-protocol-backpressure.test.ts": 103,
+      "src/main/ssh/relay-protocol.test.ts": 70,
+      "src/main/ssh/relay-socket-path-limit-shell.integration.test.ts": 95,
+      "src/main/ssh/relay-socket-path-limit.test.ts": 194,
+      "src/main/ssh/remote-install-coexistence.test.ts": 50,
+      "src/main/ssh/remote-install-gc-termination.test.ts": 195,
+      "src/main/ssh/remote-install-model.test.ts": 224,
+      "src/main/ssh/removed-ssh-target-tombstone-retention.test.ts": 59,
+      "src/main/ssh/sftp-namespace-resolution.test.ts": 94,
+      "src/main/ssh/sftp-stream-late-error.test.ts": 177,
+      "src/main/ssh/sftp-upload.test.ts": 175,
+      "src/main/ssh/ssh-agent-identity-filter.test.ts": 47,
+      "src/main/ssh/ssh-channel-multiplexer-backpressure.test.ts": 98,
+      "src/main/ssh/ssh-channel-multiplexer-saturation-wedge.test.ts": 73,
+      "src/main/ssh/ssh-channel-multiplexer-settlement.test.ts": 77,
+      "src/main/ssh/ssh-channel-multiplexer.test.ts": 63,
+      "src/main/ssh/ssh-config-alias-claim.test.ts": 74,
+      "src/main/ssh/ssh-config-host-picker.test.ts": 318,
+      "src/main/ssh/ssh-config-loader-regression.test.ts": 156,
+      "src/main/ssh/ssh-config-loader.test.ts": 95,
+      "src/main/ssh/ssh-config-parser-host-patterns.test.ts": 51,
+      "src/main/ssh/ssh-config-parser.test.ts": 392,
+      "src/main/ssh/ssh-config-resolver.test.ts": 55,
+      "src/main/ssh/ssh-connect-attempt-cancellation.test.ts": 784,
+      "src/main/ssh/ssh-connection-auth-fallback.test.ts": 232,
+      "src/main/ssh/ssh-connection-channel-open.test.ts": 877,
+      "src/main/ssh/ssh-connection-direct-startup.test.ts": 192,
+      "src/main/ssh/ssh-connection-file-transfer.test.ts": 130,
+      "src/main/ssh/ssh-connection-generation.test.ts": 62,
+      "src/main/ssh/ssh-connection-github-probe.test.ts": 123,
+      "src/main/ssh/ssh-connection-gssapi-fallback.test.ts": 259,
+      "src/main/ssh/ssh-connection-host-key-store-wiring.test.ts": 462,
+      "src/main/ssh/ssh-connection-host-key-verification.test.ts": 157,
+      "src/main/ssh/ssh-connection-manager-registry.test.ts": 163,
+      "src/main/ssh/ssh-connection-manager.test.ts": 60,
+      "src/main/ssh/ssh-connection-reconnect-ladder.test.ts": 420,
+      "src/main/ssh/ssh-connection-sftp-namespace.test.ts": 901,
+      "src/main/ssh/ssh-connection-sftp-wire.test.ts": 2538,
+      "src/main/ssh/ssh-connection-store.test.ts": 100,
+      "src/main/ssh/ssh-connection-system-transport.test.ts": 252,
+      "src/main/ssh/ssh-connection-utils.test.ts": 213,
+      "src/main/ssh/ssh-connection.test.ts": 395,
+      "src/main/ssh/ssh-control-socket.test.ts": 47,
+      "src/main/ssh/ssh-file-stream-inactivity-deadline.test.ts": 68,
+      "src/main/ssh/ssh-file-transfer-abort.test.ts": 109,
+      "src/main/ssh/ssh-filesystem-stream-retention.test.ts": 122,
+      "src/main/ssh/ssh-g-config-resolution.test.ts": 82,
+      "src/main/ssh/ssh-git-response-stream-reader.test.ts": 61,
+      "src/main/ssh/ssh-git-stream-idle-timer.test.ts": 63,
+      "src/main/ssh/ssh-host-key-decision.test.ts": 60,
+      "src/main/ssh/ssh-host-key-store.test.ts": 238,
+      "src/main/ssh/ssh-host-key-verifier.test.ts": 70,
+      "src/main/ssh/ssh-known-hosts-source.test.ts": 104,
+      "src/main/ssh/ssh-known-hosts.test.ts": 106,
+      "src/main/ssh/ssh-multi-factor-authentication.test.ts": 1337,
+      "src/main/ssh/ssh-multi-key-authentication.test.ts": 161,
+      "src/main/ssh/ssh-multiplexer-transport-writer.test.ts": 77,
+      "src/main/ssh/ssh-multiplexer-writer-retention.test.ts": 538,
+      "src/main/ssh/ssh-orphan-relay-pty-sweep.test.ts": 72,
+      "src/main/ssh/ssh-orphan-sweep-pane-state-verdicts.test.ts": 95,
+      "src/main/ssh/ssh-owner-recovery-retry.test.ts": 69,
+      "src/main/ssh/ssh-pending-pty-kill-replay.test.ts": 78,
+      "src/main/ssh/ssh-port-forward.test.ts": 221,
+      "src/main/ssh/ssh-port-scanner.test.ts": 80,
+      "src/main/ssh/ssh-posix-command-wrapper.test.ts": 124,
+      "src/main/ssh/ssh-provider-authority.test.ts": 44,
+      "src/main/ssh/ssh-proxy-command.test.ts": 148,
+      "src/main/ssh/ssh-pty-consumer-recovery.test.ts": 61,
+      "src/main/ssh/ssh-pty-consumer-session.test.ts": 70,
+      "src/main/ssh/ssh-pty-recovery-retention-budget.test.ts": 34,
+      "src/main/ssh/ssh-pty-retired-source-deliveries.test.ts": 46,
+      "src/main/ssh/ssh-reconnect-error-classification.test.ts": 86,
+      "src/main/ssh/ssh-reconnect-ladder.test.ts": 153,
+      "src/main/ssh/ssh-relay-build-toolchain.test.ts": 154,
+      "src/main/ssh/ssh-relay-bundled-ripgrep.docker.test.ts": 318,
+      "src/main/ssh/ssh-relay-cross-version-isolation.test.ts": 265,
+      "src/main/ssh/ssh-relay-deploy-helpers.test.ts": 313,
+      "src/main/ssh/ssh-relay-deploy-incumbent-verdict.test.ts": 260,
+      "src/main/ssh/ssh-relay-deploy-staged-upload.test.ts": 502,
+      "src/main/ssh/ssh-relay-deploy-windows-pipe.test.ts": 207,
+      "src/main/ssh/ssh-relay-deploy.test.ts": 690,
+      "src/main/ssh/ssh-relay-endpoint-incumbent-shell.integration.test.ts": 2168,
+      "src/main/ssh/ssh-relay-endpoint-incumbent.test.ts": 99,
+      "src/main/ssh/ssh-relay-endpoint-takeover.test.ts": 116,
+      "src/main/ssh/ssh-relay-gc-claim-termination.test.ts": 174,
+      "src/main/ssh/ssh-relay-gc-retry.test.ts": 332,
+      "src/main/ssh/ssh-relay-incumbent-process.test.ts": 15877,
+      "src/main/ssh/ssh-relay-install-lock-termination.test.ts": 229,
+      "src/main/ssh/ssh-relay-install-lock.test.ts": 203,
+      "src/main/ssh/ssh-relay-install-namespace.test.ts": 186,
+      "src/main/ssh/ssh-relay-live-connect.test.ts": 214,
+      "src/main/ssh/ssh-relay-native-deps-cache-deploy.test.ts": 1792,
+      "src/main/ssh/ssh-relay-native-deps-cache-gc-real.test.ts": 1158,
+      "src/main/ssh/ssh-relay-native-deps-cache-shell.test.ts": 525,
+      "src/main/ssh/ssh-relay-native-deps-cache.test.ts": 236,
+      "src/main/ssh/ssh-relay-native-deps-install-staged-upload.test.ts": 255,
+      "src/main/ssh/ssh-relay-native-deps-install.test.ts": 14222,
+      "src/main/ssh/ssh-relay-native-deps-probe-verdict.test.ts": 418,
+      "src/main/ssh/ssh-relay-node-headers.test.ts": 1899,
+      "src/main/ssh/ssh-relay-node-pty-repair.test.ts": 124,
+      "src/main/ssh/ssh-relay-node-pty-spawn-repair.test.ts": 215,
+      "src/main/ssh/ssh-relay-offline-node-headers.docker.test.ts": 302,
+      "src/main/ssh/ssh-relay-opencode-runtime-commands.test.ts": 588,
+      "src/main/ssh/ssh-relay-opencode-runtime-retry.test.ts": 77,
+      "src/main/ssh/ssh-relay-opencode-runtime.test.ts": 392,
+      "src/main/ssh/ssh-relay-orphan-abandon-paths.test.ts": 2554,
+      "src/main/ssh/ssh-relay-pty-master-cloexec-install.test.ts": 2127,
+      "src/main/ssh/ssh-relay-repair-lock-termination.test.ts": 237,
+      "src/main/ssh/ssh-relay-reset.test.ts": 133,
+      "src/main/ssh/ssh-relay-ripgrep-cache-gc-real.test.ts": 521,
+      "src/main/ssh/ssh-relay-ripgrep-cache-gc.test.ts": 131,
+      "src/main/ssh/ssh-relay-ripgrep-install.test.ts": 389,
+      "src/main/ssh/ssh-relay-sentinel-copy-budget.test.ts": 115,
+      "src/main/ssh/ssh-relay-session-agent-hooks.integration.test.ts": 4019,
+      "src/main/ssh/ssh-relay-session-data-delivery.test.ts": 2680,
+      "src/main/ssh/ssh-relay-session-incarnation.test.ts": 2776,
+      "src/main/ssh/ssh-relay-session-managed-hooks.test.ts": 2737,
+      "src/main/ssh/ssh-relay-session-model-migration.test.ts": 3018,
+      "src/main/ssh/ssh-relay-session-orphan-sweep.test.ts": 2684,
+      "src/main/ssh/ssh-relay-session-pending-kill-replay.test.ts": 2344,
+      "src/main/ssh/ssh-relay-session-reconnect-incarnation.test.ts": 3189,
+      "src/main/ssh/ssh-relay-session-recovery-durability.test.ts": 4088,
+      "src/main/ssh/ssh-relay-session-recovery-races.test.ts": 3683,
+      "src/main/ssh/ssh-relay-session-rejected-delivery.test.ts": 3066,
+      "src/main/ssh/ssh-relay-session-relay-loss.test.ts": 2301,
+      "src/main/ssh/ssh-relay-session-terminal-error.test.ts": 2096,
+      "src/main/ssh/ssh-relay-session.test.ts": 10932,
+      "src/main/ssh/ssh-relay-sftp-namespace-install.test.ts": 475,
+      "src/main/ssh/ssh-relay-superseded-endpoints.test.ts": 197,
+      "src/main/ssh/ssh-relay-upload-cancel.docker.test.ts": 357,
+      "src/main/ssh/ssh-relay-upload-stage-commands.test.ts": 27518,
+      "src/main/ssh/ssh-relay-versioned-install-termination.test.ts": 155,
+      "src/main/ssh/ssh-relay-versioned-install.test.ts": 549,
+      "src/main/ssh/ssh-remote-cli-dispatch-refusal-passthrough.test.ts": 4113,
+      "src/main/ssh/ssh-remote-cli-format.test.ts": 54,
+      "src/main/ssh/ssh-remote-cli-host-passthrough.test.ts": 200,
+      "src/main/ssh/ssh-remote-cli-launcher.test.ts": 80,
+      "src/main/ssh/ssh-remote-cli-terminal-host-scope.test.ts": 3331,
+      "src/main/ssh/ssh-remote-commands.test.ts": 15974,
+      "src/main/ssh/ssh-remote-linear-activity-output.test.ts": 36,
+      "src/main/ssh/ssh-remote-linear-cli.test.ts": 4061,
+      "src/main/ssh/ssh-remote-linear-list-issues.test.ts": 61,
+      "src/main/ssh/ssh-remote-linear-relation-write.test.ts": 1192,
+      "src/main/ssh/ssh-remote-linear-save-issue.test.ts": 2067,
+      "src/main/ssh/ssh-remote-linear-truncation-output.test.ts": 39,
+      "src/main/ssh/ssh-remote-node-resolution.test.ts": 273,
+      "src/main/ssh/ssh-remote-node-toolchain-probe.test.ts": 241,
+      "src/main/ssh/ssh-remote-orca-cli.test.ts": 3176,
+      "src/main/ssh/ssh-remote-orchestration-compatibility.test.ts": 3146,
+      "src/main/ssh/ssh-remote-orchestration-send.test.ts": 29,
+      "src/main/ssh/ssh-remote-platform-detection.test.ts": 130,
+      "src/main/ssh/ssh-remote-platform.test.ts": 190,
+      "src/main/ssh/ssh-remote-powershell.test.ts": 238,
+      "src/main/ssh/ssh-remote-windows-command-line-limit.test.ts": 222,
+      "src/main/ssh/ssh-request-outcome-verdict.test.ts": 40,
+      "src/main/ssh/ssh-security-key-identity.test.ts": 179,
+      "src/main/ssh/ssh-session-limit-error.test.ts": 27,
+      "src/main/ssh/ssh-system-fallback.test.ts": 556,
+      "src/main/ssh/ssh-system-transport.integration.test.ts": 878,
+      "src/main/ssh/ssh-target-id-migration.test.ts": 41,
+      "src/main/ssh/ssh-target-readoption.test.ts": 64,
+      "src/main/ssh/system-ssh-binary.test.ts": 59,
+      "src/main/ssh/system-ssh-dynamic-forward-process.test.ts": 237,
+      "src/main/ssh/system-ssh-forward-process.test.ts": 233,
+      "src/main/ssh/system-ssh-sftp-args.test.ts": 38,
+      "src/main/ssh/system-ssh-sftp-path.test.ts": 54,
+      "src/main/ssh/system-ssh-windows-upload.test.ts": 415,
+      "src/main/ssh/system-ssh-windows-write-capabilities.test.ts": 56,
+      "src/main/ssh/vscode-ssh-authority.test.ts": 73,
+      "src/main/star-nag/service-direct-star.test.ts": 171,
+      "src/main/star-nag/service-force-show-races.test.ts": 260,
+      "src/main/star-nag/service-outcome-telemetry.test.ts": 189,
+      "src/main/star-nag/service-prompt-moments.test.ts": 229,
+      "src/main/star-nag/service-threshold-prompt.test.ts": 214,
+      "src/main/startup/bootstrap-fatal-exit-guard.test.ts": 26,
+      "src/main/startup/branch-rename-hook-structured-session.test.ts": 91,
+      "src/main/startup/browser-process-user-agent-ordering.test.ts": 3534,
+      "src/main/startup/cli-launch-redirect.test.ts": 77,
+      "src/main/startup/configure-process-dev-parent-shutdown.test.ts": 138,
+      "src/main/startup/configure-process-profile-state.test.ts": 86,
+      "src/main/startup/configure-process.test.ts": 457,
+      "src/main/startup/desktop-startup-ordering.test.ts": 54,
+      "src/main/startup/dev-education-suppression.test.ts": 195,
+      "src/main/startup/dev-instance-identity.test.ts": 49,
+      "src/main/startup/ensure-virtual-display.test.ts": 5118,
+      "src/main/startup/first-window-startup-services.test.ts": 59,
+      "src/main/startup/gpu-fallback-marker.test.ts": 51,
+      "src/main/startup/gpu-fallback-switches.test.ts": 61,
+      "src/main/startup/gpu-lifecycle-install-dir-acl-guard.test.ts": 549,
+      "src/main/startup/headless-pty-hydration-ordering.test.ts": 42,
+      "src/main/startup/host-port-bootstrap-wiring.test.ts": 37,
+      "src/main/startup/http1-compatibility-profile-state.test.ts": 65,
+      "src/main/startup/hydrate-shell-path.test.ts": 258,
+      "src/main/startup/hydrate-shell-path.windows.test.ts": 319,
+      "src/main/startup/legacy-worker-renderer-recovery.test.ts": 59,
+      "src/main/startup/login-shell-environment-cache.test.ts": 87,
+      "src/main/startup/login-shell-environment.test.ts": 112,
+      "src/main/startup/main-process-error-guards.test.ts": 73,
+      "src/main/startup/main-process-ready-activation-failure.test.ts": 351,
+      "src/main/startup/main-process-ready-identity-write.test.ts": 356,
+      "src/main/startup/main-process-ready-persistence-cleanup.test.ts": 216,
+      "src/main/startup/main-process-ready-phase-ordering.test.ts": 230,
+      "src/main/startup/main-process-runtime-launch-activation.test.ts": 356,
+      "src/main/startup/main-window-core-services.test.ts": 39,
+      "src/main/startup/main-window-structured-status-filter.test.ts": 347,
+      "src/main/startup/os-opened-markdown-delivery.test.ts": 218,
+      "src/main/startup/os-opened-markdown-files.test.ts": 130,
+      "src/main/startup/os-opened-markdown-wiring.test.ts": 48,
+      "src/main/startup/pre-gone-crash-sampling-wiring.test.ts": 36,
+      "src/main/startup/profile-state-recovery-preflight.test.ts": 556,
+      "src/main/startup/profile-state-write-failure.test.ts": 112,
+      "src/main/startup/renderer-heap-headroom.test.ts": 55,
+      "src/main/startup/run-electron-vite-dev-web.test.ts": 588,
+      "src/main/startup/run-electron-vite-dev.test.ts": 968,
+      "src/main/startup/secret-protection-report-deferral-wiring.test.ts": 58,
+      "src/main/startup/secure-dns-census.test.ts": 789,
+      "src/main/startup/serve-desktop-activation-wiring.test.ts": 30,
+      "src/main/startup/serve-desktop-activation.test.ts": 40,
+      "src/main/startup/serve-mode-argv-cli-redirect-order.test.ts": 53,
+      "src/main/startup/serve-mode-argv.test.ts": 85,
+      "src/main/startup/serve-options.test.ts": 67,
+      "src/main/startup/serve-signal-handlers.test.ts": 52,
+      "src/main/startup/single-instance-lock-exit.electron.test.ts": 622,
+      "src/main/startup/single-instance-lock-headless-exit.test.ts": 44,
+      "src/main/startup/single-instance-lock.test.ts": 59,
+      "src/main/startup/skill-share-deep-link-state.test.ts": 44,
+      "src/main/startup/startup-diagnostics.test.ts": 61,
+      "src/main/startup/window-all-closed-quit-policy.test.ts": 32,
+      "src/main/startup/windows-desktop-shell-path-startup.test.ts": 44,
+      "src/main/startup/windows-install-dir-acl-probe.test.ts": 147,
+      "src/main/startup/windows-install-dir-acl-recovery.test.ts": 887,
+      "src/main/startup/windows-install-dir-acl-repair.win32.test.ts": 78,
+      "src/main/startup/windows-install-dir-acl-startup-wiring.test.ts": 42,
+      "src/main/startup/windows-install-dir-package-acl-repair.test.ts": 112,
+      "src/main/startup/windows-shell-path-hydration.test.ts": 383,
+      "src/main/startup/windows-shell-path-ownership.test.ts": 62,
+      "src/main/startup/windows-shell-path-restoration.windows.test.ts": 51,
+      "src/main/startup/windows-user-data-acl.test.ts": 69,
+      "src/main/startup/wsl-cli-reconciliation-startup-barrier.test.ts": 34,
+      "src/main/stats/agent-session-transition-recorder.test.ts": 665,
+      "src/main/stats/collector-async-save.test.ts": 1081,
+      "src/main/stats/stats-title-detection-independence.test.ts": 45,
+      "src/main/synthetic-title-frame-routing.test.ts": 27,
+      "src/main/synthetic-title-spinner.test.ts": 52,
+      "src/main/synthetic-title-visibility.test.ts": 24,
+      "src/main/system-fonts.test.ts": 80,
+      "src/main/system-power-lifecycle.test.ts": 54,
+      "src/main/system-resume-broadcast.test.ts": 84,
+      "src/main/telemetry/burst-cap.test.ts": 206,
+      "src/main/telemetry/classify-error.test.ts": 43,
+      "src/main/telemetry/client-lifecycle.test.ts": 155,
+      "src/main/telemetry/client.test.ts": 258,
+      "src/main/telemetry/cohort-classifier.test.ts": 59,
+      "src/main/telemetry/consent.test.ts": 31,
+      "src/main/telemetry/install-id.test.ts": 65,
+      "src/main/telemetry/onboarding-cohort-classifier.test.ts": 171,
+      "src/main/telemetry/onboarding-feature-setup-validator.test.ts": 172,
+      "src/main/telemetry/validator-warn-cache.test.ts": 168,
+      "src/main/telemetry/validator.test.ts": 128,
+      "src/main/terminal-history-async-delete.test.ts": 569,
+      "src/main/terminal-history-gc-fs-call-count.test.ts": 181,
+      "src/main/terminal-history-gc.test.ts": 951,
+      "src/main/terminal-history-tombstone-retry.test.ts": 982,
+      "src/main/terminal-history-tombstone-scan-cost.test.ts": 428,
+      "src/main/terminal-history.test.ts": 92,
+      "src/main/text-generation/agent-failure-output.test.ts": 31,
+      "src/main/text-generation/command-environment-process.test.ts": 562,
+      "src/main/text-generation/command-environment-wsl.test.ts": 56,
+      "src/main/text-generation/commit-message-agent-environment.test.ts": 50,
+      "src/main/text-generation/commit-message-command-backslash-mode.test.ts": 182,
+      "src/main/text-generation/commit-message-text-generation-branch-name.test.ts": 172,
+      "src/main/text-generation/commit-message-text-generation-cancellation.test.ts": 672,
+      "src/main/text-generation/commit-message-text-generation-failure-sanitization.test.ts": 127,
+      "src/main/text-generation/commit-message-text-generation-generated-output.test.ts": 149,
+      "src/main/text-generation/commit-message-text-generation-linked-issue.test.ts": 216,
+      "src/main/text-generation/commit-message-text-generation-local-subprocess.test.ts": 228,
+      "src/main/text-generation/commit-message-text-generation-model-discovery.test.ts": 214,
+      "src/main/text-generation/commit-message-text-generation-regression.test.ts": 223,
+      "src/main/text-generation/commit-message-text-generation-remote-execution.test.ts": 215,
+      "src/main/text-generation/commit-message-text-generation-settings.test.ts": 299,
+      "src/main/text-generation/omp-model-discovery-policy.test.ts": 112,
+      "src/main/text-generation/pull-request-context-errors.test.ts": 61,
+      "src/main/text-generation/pull-request-context.test.ts": 58,
+      "src/main/tray/system-tray.test.ts": 134,
+      "src/main/tray/tray-attention-icon.test.ts": 58,
+      "src/main/tray/tray-dev-badge.test.ts": 60,
+      "src/main/update-install-exit-watchdog.test.ts": 64,
+      "src/main/updater-changelog.test.ts": 79,
+      "src/main/updater-events.test.ts": 205,
+      "src/main/updater-lifecycle-diagnostics.test.ts": 56,
+      "src/main/updater-linux-package-recovery-actions.test.ts": 2071,
+      "src/main/updater-nudge.test.ts": 74,
+      "src/main/updater-prerelease-feed-readiness.test.ts": 204,
+      "src/main/updater-prerelease-feed.test.ts": 210,
+      "src/main/updater-release-api-token.test.ts": 62,
+      "src/main/updater-release-build-cache.test.ts": 38,
+      "src/main/updater-release-builds.test.ts": 164,
+      "src/main/updater-test-harness.leaked-timers.test.ts": 2646,
+      "src/main/updater-test-module-loader.test.ts": 540,
+      "src/main/updater.build-channel-selection.test.ts": 2969,
+      "src/main/updater.check-failure.test.ts": 2612,
+      "src/main/updater.check-preflight.test.ts": 2566,
+      "src/main/updater.check-settlement.test.ts": 2937,
+      "src/main/updater.fallback.test.ts": 51,
+      "src/main/updater.feed-attempt-lifetime.test.ts": 1577,
+      "src/main/updater.headless-serve-install.test.ts": 315,
+      "src/main/updater.install-failure-cause.test.ts": 3143,
+      "src/main/updater.linux-externally-managed.test.ts": 2828,
+      "src/main/updater.linux-root-package-install.test.ts": 2144,
+      "src/main/updater.mac-install.test.ts": 54,
+      "src/main/updater.nudge-campaign.test.ts": 1952,
+      "src/main/updater.prerelease-fallback.test.ts": 4132,
+      "src/main/updater.publishing-window-feed.test.ts": 2272,
+      "src/main/updater.quit-and-install.test.ts": 2406,
+      "src/main/updater.startup-scheduling.test.ts": 2192,
+      "src/main/usage-worktree-canonicalizer.test.ts": 38,
+      "src/main/usage-worktree-metadata.test.ts": 57,
+      "src/main/usage/highest-usage-key.test.ts": 68,
+      "src/main/usage/jsonl-line-offsets.test.ts": 64,
+      "src/main/usage/usage-breakdown-scaling.test.ts": 109,
+      "src/main/usage/usage-calendar-range.test.ts": 62,
+      "src/main/usage/usage-provider-store-lifecycle.test.ts": 245,
+      "src/main/usage/usage-scan-worker-client.test.ts": 70,
+      "src/main/usage/usage-scan-worker-event-loop.test.ts": 3290,
+      "src/main/usage/usage-worktree-refs.test.ts": 45,
+      "src/main/usage/usage-worktree-resolver.test.ts": 114,
+      "src/main/warp-themes/discovery.test.ts": 98,
+      "src/main/warp-themes/index.test.ts": 679,
+      "src/main/warp-themes/manual-warp-theme-files.test.ts": 106,
+      "src/main/warp-themes/parser-runner.test.ts": 65,
+      "src/main/warp-themes/parser.test.ts": 55,
+      "src/main/warp-themes/theme-file-scanner.test.ts": 66,
+      "src/main/win32-utils-async-acl.test.ts": 49,
+      "src/main/win32-utils.test.ts": 73,
+      "src/main/window/attach-main-window-services.test.ts": 13208,
+      "src/main/window/clipboard-dashboard-popout-access.test.ts": 330,
+      "src/main/window/clipboard-file-copy.test.ts": 38,
+      "src/main/window/clipboard-image-temp-file.test.ts": 46,
+      "src/main/window/clipboard-image-thumbnail.test.ts": 35,
+      "src/main/window/clipboard-ipc-handlers.test.ts": 188,
+      "src/main/window/clipboard-remote-file-cleanup.bench.test.ts": 30,
+      "src/main/window/clipboard-remote-file-copy.test.ts": 70,
+      "src/main/window/clipboard-remote-file-staging-fs.test.ts": 56,
+      "src/main/window/clipboard-remote-file-staging.test.ts": 141,
+      "src/main/window/clipboard-runtime-owned-ssh-paste.test.ts": 99,
+      "src/main/window/clipboard-text-write-verify.test.ts": 37,
+      "src/main/window/clipboard-windows-image-file.test.ts": 57,
+      "src/main/window/createMainWindow-close-confirmation.test.ts": 1201,
+      "src/main/window/createMainWindow-markdown-editor-focus.test.ts": 1169,
+      "src/main/window/createMainWindow-recovery-reload-watchdog.test.ts": 1850,
+      "src/main/window/createMainWindow-renderer-crash-recovery.test.ts": 1634,
+      "src/main/window/createMainWindow-startup-reveal.test.ts": 1360,
+      "src/main/window/createMainWindow-system-resume-relay.test.ts": 1385,
+      "src/main/window/createMainWindow-terminal-focus-shortcuts.test.ts": 1341,
+      "src/main/window/createMainWindow-tray-minimize-close.test.ts": 876,
+      "src/main/window/createMainWindow-zoom-and-tab-switch-shortcuts.test.ts": 1287,
+      "src/main/window/createMainWindow.test.ts": 2476,
+      "src/main/window/dashboard-popout-window.test.ts": 162,
+      "src/main/window/editable-context-menu.test.ts": 89,
+      "src/main/window/focus-existing-window.test.ts": 75,
+      "src/main/window/foreground-activation-policy.test.ts": 36,
+      "src/main/window/history-gc-profile-worktree-ids.test.ts": 246,
+      "src/main/window/history-gc-worktree-ids.test.ts": 319,
+      "src/main/window/macos-app-activation.test.ts": 40,
+      "src/main/window/macos-tahoe-release.test.ts": 39,
+      "src/main/window/main-window-mouse-shortcuts.test.ts": 1533,
+      "src/main/window/main-window-visibility.test.ts": 38,
+      "src/main/window/main-window-webview-security.test.ts": 165,
+      "src/main/window/mobile-markdown-request-relay.test.ts": 57,
+      "src/main/window/privileged-window-navigation.test.ts": 178,
+      "src/main/window/renderer-document-navigation.test.ts": 40,
+      "src/main/window/renderer-publication-throttle.test.ts": 40,
+      "src/main/window/renderer-recovery-prompt.test.ts": 100,
+      "src/main/window/renderer-recovery-reload-watchdog.test.ts": 86,
+      "src/main/window/runtime-renderer-notification-sender.test.ts": 44,
+      "src/main/window/session-tab-close-request-relay.test.ts": 82,
+      "src/main/window/terminal-tab-close-request-relay.test.ts": 55,
+      "src/main/window/updater-package-recovery-ipc.test.ts": 4430,
+      "src/main/window/window-close-decision.test.ts": 41,
+      "src/main/windows-descendant-exit-verification.test.ts": 100,
+      "src/main/windows-live-tree-kill.win32.test.ts": 46,
+      "src/main/windows-process-tree-kill.test.ts": 61,
+      "src/main/windows-pty-root-identity.test.ts": 94,
+      "src/main/windows-registry-addon.test.ts": 33,
+      "src/main/windows/windows-command-line-recovery-health.test.ts": 49,
+      "src/main/windows/windows-host-job.win32.test.ts": 31,
+      "src/main/windows/windows-msys-job.win32.test.ts": 65,
+      "src/main/windows/windows-process-creation-time.test.ts": 51,
+      "src/main/windows/windows-process-table-cim-scan.test.ts": 51,
+      "src/main/windows/windows-process-table-native-addon.win32.test.ts": 37,
+      "src/main/windows/windows-process-table.test.ts": 261,
+      "src/main/windows/windows-process-tree-command-line-patch.test.ts": 37,
+      "src/main/windows/windows-pty-job.test.ts": 46,
+      "src/main/windows/windows-pty-job.win32.test.ts": 57,
+      "src/main/worker-thread-request-queue.test.ts": 75,
+      "src/main/workspace-cleanup-removal-snapshot-prune.test.ts": 70,
+      "src/main/workspace-cleanup-scan-snapshot.test.ts": 174,
+      "src/main/workspace-snapshot-pruning.bench.test.ts": 38,
+      "src/main/workspace-space-analysis-capacity.test.ts": 176,
+      "src/main/workspace-space-analysis-du-timeout.test.ts": 358,
+      "src/main/workspace-space-analysis-snapshot.test.ts": 134,
+      "src/main/workspace-space-analysis.test.ts": 359,
+      "src/main/workspace-space-repo-scan.test.ts": 330,
+      "src/main/workspace-space-scan-control.test.ts": 52,
+      "src/main/worktree-archive-hook-cannot-run.test.ts": 55,
+      "src/main/worktree-create-base-prefetch.test.ts": 287,
+      "src/main/worktree-create-base.test.ts": 37,
+      "src/main/worktree-create-candidates.test.ts": 38,
+      "src/main/worktree-create-execution-host-route.test.ts": 35,
+      "src/main/worktree-create-preparation-cancellation.test.ts": 148,
+      "src/main/worktree-create-preparation-claim.test.ts": 58,
+      "src/main/worktree-create-preparation-contention.test.ts": 95,
+      "src/main/worktree-create-preparation-timing.test.ts": 72,
+      "src/main/worktree-create-preparation-wsl-root.test.ts": 149,
+      "src/main/worktree-create-preparation.test.ts": 545,
+      "src/main/worktree-create-timing.test.ts": 39,
+      "src/main/worktree-identity-persistence.test.ts": 1325,
+      "src/main/worktree-lineage-pruning.test.ts": 81,
+      "src/main/worktree-metadata-ownership.test.ts": 39,
+      "src/main/worktree-name-retirement.test.ts": 115,
+      "src/main/worktree-prunable-git-file.test.ts": 58,
+      "src/main/worktree-removal-authority.test.ts": 64,
+      "src/main/worktree-removal-execution-host-route.test.ts": 52,
+      "src/main/worktree-removal-home-guard.test.ts": 88,
+      "src/main/worktree-removal-repo-owner.test.ts": 64,
+      "src/main/worktree-removal-safety.test.ts": 115,
+      "src/main/worktree-removal-session-partition-fencing.test.ts": 1523,
+      "src/main/worktree-retirement-backfill-scan.test.ts": 44,
+      "src/main/worktree-retirement-backfill-stall.test.ts": 141,
+      "src/main/worktree-retirement-discovery-wsl.test.ts": 148,
+      "src/main/worktree-retirement-discovery.test.ts": 121,
+      "src/main/worktree-retirement-namespace.test.ts": 80,
+      "src/main/worktree-root-preparation.test.ts": 106,
+      "src/main/worktree-trash.test.ts": 203,
+      "src/main/wsl-approved-root-race.wsl.test.ts": 68,
+      "src/main/wsl-availability-missing-kernel.test.ts": 74,
+      "src/main/wsl-bash-command.test.ts": 25,
+      "src/main/wsl-distro-list-output.test.ts": 35,
+      "src/main/wsl-distro-list-single-flight.test.ts": 81,
+      "src/main/wsl-fish-history-cleanup.test.ts": 55,
+      "src/main/wsl-interop-spawn-directory.test.ts": 56,
+      "src/main/wsl-managed-cli-path-restore.test.ts": 57,
+      "src/main/wsl-running-distros.test.ts": 242,
+      "src/main/wsl-running-path-filter.test.ts": 47,
+      "src/main/wsl-unc-delete-symlink-repro.test.ts": 61,
+      "src/main/wsl-unc-delete.test.ts": 111,
+      "src/main/wsl-unc-delete.wsl.test.ts": 88,
+      "src/main/wsl.test.ts": 128,
+      "src/main/wsl/wsl-executable-path.win32.test.ts": 34,
+      "src/main/wsl/wsl-guest-environment.test.ts": 110,
+      "src/main/wsl/wsl-invocation-boundary.test.ts": 10984,
+      "src/main/wsl/wsl-probe-failure-semantics.test.ts": 357,
+      "src/main/wsl/wsl-runner.test.ts": 58,
+      "src/main/wsl/wsl-runner.wsl.test.ts": 64,
+      "src/main/wsl/wsl-w1-w3-contract.test.ts": 42,
+      "src/main/zcode/hook-service.test.ts": 89,
+      "src/main/zcode/interactive-capability.live.test.ts": 45,
+      "src/preload/api/platform-bridge.test.ts": 46,
+      "src/preload/app-restart-checkpoint-routing.test.ts": 934,
+      "src/preload/browser-client-page-renderer-requests.test.ts": 158,
+      "src/preload/browser-find-subscriptions.test.ts": 45,
+      "src/preload/browser-window-close.test.ts": 39,
+      "src/preload/close-active-tab-payload-admission.test.ts": 51,
+      "src/preload/doc-preview-link-interception.test.ts": 446,
+      "src/preload/pty-snapshot-capability-ipc.test.ts": 678,
+      "src/preload/renderer-heap-statistics-reader.test.ts": 30,
+      "src/preload/renderer-process-memory-reader.test.ts": 53,
+      "src/preload/renderer-restart-wiring.test.ts": 44,
+      "src/preload/runtime-environment-subscriptions.test.ts": 66,
+      "src/preload/ssh-authority-forwarding.test.ts": 604,
+      "src/preload/updater-package-recovery.test.ts": 534,
+      "src/preload/usage-provider-api.test.ts": 47,
+      "src/relay/agent-exec-handler-windows.test.ts": 71,
+      "src/relay/agent-exec-handler.test.ts": 157,
+      "src/relay/agent-hook-envelope-publication.test.ts": 351,
+      "src/relay/agent-hook-integration.test.ts": 848,
+      "src/relay/agent-hook-retired-pane-suppression.test.ts": 451,
+      "src/relay/agent-hook-server-codex-subagent-transcript.test.ts": 1327,
+      "src/relay/agent-hook-server.test.ts": 1396,
+      "src/relay/agent-status-store-relay-context.test.ts": 144,
+      "src/relay/ai-vault-handler.test.ts": 689,
+      "src/relay/ai-vault-opencode-reader.test.ts": 405,
+      "src/relay/ai-vault-service-client.test.ts": 89,
+      "src/relay/ai-vault-service-ready-retention.test.ts": 195,
+      "src/relay/ai-vault-service-restart-policy.test.ts": 69,
+      "src/relay/ai-vault-service-spawn.test.ts": 54,
+      "src/relay/context.test.ts": 39,
+      "src/relay/dispatcher-capacity-degradation.test.ts": 194,
+      "src/relay/dispatcher-client-close-cause.test.ts": 194,
+      "src/relay/dispatcher-client-writer.test.ts": 92,
+      "src/relay/dispatcher-frame-guard-regressions.test.ts": 169,
+      "src/relay/dispatcher-json-payload.test.ts": 122,
+      "src/relay/dispatcher-notification-ownership.test.ts": 140,
+      "src/relay/dispatcher-per-connection-state-baseline.test.ts": 146,
+      "src/relay/dispatcher-rpc-cancel-id-coercion.test.ts": 134,
+      "src/relay/dispatcher-silent-client-reaper.test.ts": 213,
+      "src/relay/dispatcher-structured-error.test.ts": 136,
+      "src/relay/dispatcher-timeout.test.ts": 210,
+      "src/relay/dispatcher-writer-admission.test.ts": 161,
+      "src/relay/dispatcher.test.ts": 306,
+      "src/relay/external-automation-provider-catalog.test.ts": 59,
+      "src/relay/external-automations-handler-log-path.test.ts": 46,
+      "src/relay/external-automations-handler.test.ts": 77,
+      "src/relay/fs-handler-doc-preview.test.ts": 302,
+      "src/relay/fs-handler-file-range-dispatch.test.ts": 303,
+      "src/relay/fs-handler-file-range.test.ts": 201,
+      "src/relay/fs-handler-git-search.test.ts": 102,
+      "src/relay/fs-handler-list-files-cancel.test.ts": 83,
+      "src/relay/fs-handler-list-files-ignored.test.ts": 816,
+      "src/relay/fs-handler-list-files-result-limit.test.ts": 334,
+      "src/relay/fs-handler-readdir-fallback.test.ts": 88,
+      "src/relay/fs-handler-ripgrep-fallback.test.ts": 260,
+      "src/relay/fs-handler-stream.test.ts": 660,
+      "src/relay/fs-handler.test.ts": 805,
+      "src/relay/fs-list-files-cancel.integration.test.ts": 320,
+      "src/relay/fs-list-files-large-response.integration.test.ts": 596,
+      "src/relay/fs-list-files-scan-coordinator.test.ts": 42,
+      "src/relay/fs-path-metadata-requests.test.ts": 93,
+      "src/relay/fs-path-metadata-symlink-concurrency.test.ts": 79,
+      "src/relay/fs-search-cancellation.test.ts": 399,
+      "src/relay/fs-search-diagnosis-cancellation.test.ts": 165,
+      "src/relay/fs-search-line-fragments.test.ts": 204,
+      "src/relay/fs-stream-pty-echo-backpressure.integration.test.ts": 547,
+      "src/relay/git-branch-delete-refusal-parity.test.ts": 177,
+      "src/relay/git-exec-validator.test.ts": 41,
+      "src/relay/git-handler-blob-readers.test.ts": 45,
+      "src/relay/git-handler-branch-cleanup.test.ts": 95,
+      "src/relay/git-handler-branch-compare.test.ts": 98,
+      "src/relay/git-handler-branch-diff-equivalence.test.ts": 1189,
+      "src/relay/git-handler-branch-diff.test.ts": 348,
+      "src/relay/git-handler-check-ignore.test.ts": 39,
+      "src/relay/git-handler-diff-read-coalescing.test.ts": 448,
+      "src/relay/git-handler-file-diff.test.ts": 1263,
+      "src/relay/git-handler-fork-remote-exec.test.ts": 222,
+      "src/relay/git-handler-pull-reconciliation.test.ts": 1652,
+      "src/relay/git-handler-push-target.test.ts": 70,
+      "src/relay/git-handler-remote-sync.test.ts": 1894,
+      "src/relay/git-handler-staging.test.ts": 381,
+      "src/relay/git-handler-status-ops.test.ts": 101,
+      "src/relay/git-handler-submodule-cache-invalidation.test.ts": 181,
+      "src/relay/git-handler-submodule-ops.test.ts": 126,
+      "src/relay/git-handler-submodule-status-cancellation.test.ts": 141,
+      "src/relay/git-handler-termination.test.ts": 144,
+      "src/relay/git-handler-utils.test.ts": 25,
+      "src/relay/git-handler-working-tree-changes.test.ts": 1110,
+      "src/relay/git-handler-worktree-clean.test.ts": 41,
+      "src/relay/git-handler-worktree-git-capabilities.test.ts": 118,
+      "src/relay/git-handler-worktree-inspection.test.ts": 429,
+      "src/relay/git-handler-worktree-list-authority.test.ts": 110,
+      "src/relay/git-handler-worktree-list.test.ts": 41,
+      "src/relay/git-handler-worktree-ops.test.ts": 145,
+      "src/relay/git-handler-worktree-paths.test.ts": 63,
+      "src/relay/git-handler-worktree-provisioning.test.ts": 886,
+      "src/relay/git-handler.test.ts": 797,
+      "src/relay/git-porcelain-local-parity.test.ts": 314,
+      "src/relay/git-push-target-local-parity.test.ts": 192,
+      "src/relay/git-response-pty-echo-backpressure.integration.test.ts": 1021,
+      "src/relay/git-response-stream-ownership.test.ts": 61,
+      "src/relay/git-status-branch-line-total.test.ts": 362,
+      "src/relay/git-status-upstream-negative-cache.test.ts": 344,
+      "src/relay/git-stdout-stream.test.ts": 46,
+      "src/relay/git-working-file-read.test.ts": 58,
+      "src/relay/hermes-run-correlation.test.ts": 44,
+      "src/relay/hermes-run-history.test.ts": 85,
+      "src/relay/integration.test.ts": 1877,
+      "src/relay/legacy-relay-publication-ledger.test.ts": 36,
+      "src/relay/managed-hook-installer.test.ts": 117,
+      "src/relay/node-pty-binding-survey.test.ts": 246,
+      "src/relay/node-pty-unavailable-diagnosis.test.ts": 185,
+      "src/relay/omp-config-root.test.ts": 152,
+      "src/relay/omp-fresh-launch-environment.test.ts": 600,
+      "src/relay/plugin-overlay-env.test.ts": 60,
+      "src/relay/plugin-overlay.test.ts": 164,
+      "src/relay/plugin-source-limit.test.ts": 41,
+      "src/relay/port-scan-handler.test.ts": 190,
+      "src/relay/preflight-handler.test.ts": 97,
+      "src/relay/protocol-backpressure.test.ts": 87,
+      "src/relay/protocol-handshake.test.ts": 63,
+      "src/relay/protocol-json-payload.test.ts": 188,
+      "src/relay/pty-handler-attach-replay.test.ts": 414,
+      "src/relay/pty-handler-dispose-lifecycle.test.ts": 481,
+      "src/relay/pty-handler-grace-timer.test.ts": 346,
+      "src/relay/pty-handler-immediate-descendants.test.ts": 353,
+      "src/relay/pty-handler-inventory-process-evidence.test.ts": 324,
+      "src/relay/pty-handler-output-drain-differential.test.ts": 359,
+      "src/relay/pty-handler-output-streaming.test.ts": 1038,
+      "src/relay/pty-handler-ownership-attestation.test.ts": 450,
+      "src/relay/pty-handler-pi-owner-env.test.ts": 243,
+      "src/relay/pty-handler-resize-stale-pty.test.ts": 213,
+      "src/relay/pty-handler-retired-pane-surface.test.ts": 599,
+      "src/relay/pty-handler-revive.test.ts": 526,
+      "src/relay/pty-handler-shell-resolution.test.ts": 378,
+      "src/relay/pty-handler-shutdown-signals.test.ts": 373,
+      "src/relay/pty-handler-source-publication.test.ts": 1048,
+      "src/relay/pty-handler-spawn-admission.test.ts": 560,
+      "src/relay/pty-handler-spawn-cwd.test.ts": 328,
+      "src/relay/pty-handler-spawn-environment.test.ts": 555,
+      "src/relay/pty-handler-startup-command-delivery.test.ts": 381,
+      "src/relay/pty-handler-windows-child-process-evidence.test.ts": 208,
+      "src/relay/pty-replay-buffer-equivalence.test.ts": 356,
+      "src/relay/pty-shell-launch.test.ts": 229,
+      "src/relay/pty-shell-utils-process-cycles.test.ts": 122,
+      "src/relay/pty-shell-utils.test.ts": 195,
+      "src/relay/pty-source-credit-ledger.test.ts": 265,
+      "src/relay/pty-source-credit-scheduler.test.ts": 106,
+      "src/relay/pty-source-sent-boundaries.test.ts": 181,
+      "src/relay/relay-bundled-ripgrep.test.ts": 151,
+      "src/relay/relay-command-env.test.ts": 96,
+      "src/relay/relay-daemon-fatal-reap.test.ts": 1107,
+      "src/relay/relay-diagnostic-log.test.ts": 62,
+      "src/relay/relay-endpoint-credential-publication.test.ts": 2995,
+      "src/relay/relay-filesystem-watch-registry.test.ts": 344,
+      "src/relay/relay-grace-branch.test.ts": 52,
+      "src/relay/relay-handshake-roundtrip.test.ts": 495,
+      "src/relay/relay-hot-path-operation-counts.test.ts": 211,
+      "src/relay/relay-launch-options.test.ts": 48,
+      "src/relay/relay-oversized-notification-survival.test.ts": 335,
+      "src/relay/relay-primary-channel.test.ts": 104,
+      "src/relay/relay-pty-consumer-owner-displacement.test.ts": 199,
+      "src/relay/relay-pty-publication-admission.test.ts": 373,
+      "src/relay/relay-pty-source-cancellation-exit.test.ts": 238,
+      "src/relay/relay-pty-source-exit-publication.test.ts": 70,
+      "src/relay/relay-pty-source-publication.test.ts": 395,
+      "src/relay/relay-pty-source-recovery-completion.test.ts": 30,
+      "src/relay/relay-pty-source-recovery-interleavings.test.ts": 192,
+      "src/relay/relay-pty-source-recovery-window.test.ts": 220,
+      "src/relay/relay-pty-source-restore-retry.test.ts": 226,
+      "src/relay/relay-pty-source-send-scheduler.test.ts": 44,
+      "src/relay/relay-pty-source-superseded-activation.test.ts": 193,
+      "src/relay/relay-reconnect-listener-credential-gate.test.ts": 95,
+      "src/relay/relay-ripgrep-cwd-env.test.ts": 99,
+      "src/relay/relay-watch-root-capacity.test.ts": 208,
+      "src/relay/relay-watcher-event-emitter.test.ts": 673,
+      "src/relay/relay-watcher-frame-chunking.test.ts": 708,
+      "src/relay/relay-watcher-parent-removal.test.ts": 110,
+      "src/relay/relay-watcher-pending-setup-waiters.test.ts": 467,
+      "src/relay/relay-watcher-setup-wait.test.ts": 394,
+      "src/relay/relay-windows-path-ripgrep.test.ts": 68,
+      "src/relay/remote-artifact-cli-input.test.ts": 111,
+      "src/relay/remote-cli-env.test.ts": 31,
+      "src/relay/remote-cli-stdin.test.ts": 30,
+      "src/relay/remote-cli-timeout.test.ts": 61,
+      "src/relay/retired-pane-surfaces.test.ts": 29,
+      "src/relay/rotating-log-writer.test.ts": 68,
+      "src/relay/session-search-transport.test.ts": 172,
+      "src/relay/skill-install-handler.test.ts": 589,
+      "src/relay/skill-upload-multi-relay.integration.test.ts": 667,
+      "src/relay/ssh-pty-consumer-session-adapter.test.ts": 304,
+      "src/relay/ssh-pty-source-credit-adapter.test.ts": 124,
+      "src/relay/subprocess-tree-termination.test.ts": 41,
+      "src/relay/subprocess.test.ts": 26565,
+      "src/relay/terminal-history-wsl.test.ts": 77,
+      "src/relay/terminal-history.test.ts": 63,
+      "src/relay/windows-port-scan.test.ts": 107,
+      "src/relay/windows-port-scan.win32.test.ts": 71,
+      "src/relay/workspace-session-handler.test.ts": 87,
+      "src/relay/workspace-snapshot-publication.test.ts": 126,
+      "src/relay/workspace-space-scan-du-capacity.test.ts": 110,
+      "src/relay/workspace-space-scan.test.ts": 66,
+      "src/relay/wsl-agent-hook-relay.test.ts": 317,
+      "src/relay/wsl-hook-fs-bridge.test.ts": 39,
+      "src/relay/wsl-install-plugins-handler.test.ts": 161,
+      "src/renderer/src/app-shell/app-command-handlers-tab-rename.test.ts": 1093,
+      "src/renderer/src/app-shell/app-command-handlers-workspace-delete.test.ts": 97,
+      "src/renderer/src/app-shell/app-root-surface-settings.test.tsx": 721,
+      "src/renderer/src/app-shell/reconcile-hydrated-workspace-tab-models.test.ts": 35,
+      "src/renderer/src/app-shell/remote-workspace-unplaced-upload-suppression.test.tsx": 2317,
+      "src/renderer/src/app-shell/shutdown-checkpoint-persist.test.ts": 65,
+      "src/renderer/src/app-shell/shutdown-checkpoint-restart-lifecycle.test.ts": 401,
+      "src/renderer/src/app-shell/startup-actions-selector.test.ts": 127,
+      "src/renderer/src/app-shell/use-document-appearance.test.tsx": 2017,
+      "src/renderer/src/app-shell/window-visibility-actions-selector.test.ts": 697,
+      "src/renderer/src/app-shell/workspace-view-cross-client-sync.test.tsx": 1163,
+      "src/renderer/src/app-startup-routing.test.ts": 76,
+      "src/renderer/src/assets/diff-comment-draft-card-shadow-style.test.ts": 54,
+      "src/renderer/src/assets/mobile-page-qr-layout.test.ts": 39,
+      "src/renderer/src/assets/rich-markdown-task-list-style.test.ts": 48,
+      "src/renderer/src/assets/terminal-container-geometry.test.ts": 28,
+      "src/renderer/src/assets/terminal-scrollbar-style.test.ts": 27,
+      "src/renderer/src/assets/theme-utility-generation.test.ts": 45,
+      "src/renderer/src/assets/worktree-card-active-style.test.ts": 37,
+      "src/renderer/src/attention/agent-attention-policy.test.ts": 60,
+      "src/renderer/src/components/AgentStateDot.test.ts": 245,
+      "src/renderer/src/components/AgentWorkingSpinner.test.tsx": 531,
+      "src/renderer/src/components/LinuxPackageInstallRecoveryCard.test.tsx": 1570,
+      "src/renderer/src/components/NativeChatResumeOnRestartModal.test.tsx": 2709,
+      "src/renderer/src/components/NewWorkspaceComposerCard.set-location-warm.test.tsx": 1009,
+      "src/renderer/src/components/NewWorkspaceComposerCard.set-location.test.tsx": 1670,
+      "src/renderer/src/components/NewWorkspaceComposerCard.start-from.test.tsx": 1503,
+      "src/renderer/src/components/NewWorkspaceComposerCard.test.tsx": 3004,
+      "src/renderer/src/components/QuickOpen.mount-gating.test.tsx": 2554,
+      "src/renderer/src/components/SelectedTextCopyMenu.test.tsx": 725,
+      "src/renderer/src/components/StarNagCard.test.tsx": 617,
+      "src/renderer/src/components/StateIndicatorTooltip.test.tsx": 96,
+      "src/renderer/src/components/TerminalSearch.test.tsx": 663,
+      "src/renderer/src/components/TerminalTitlebarTabs.test.tsx": 583,
+      "src/renderer/src/components/TerminalWorkbenchContainer.test.tsx": 640,
+      "src/renderer/src/components/UpdateCard.error-card.test.tsx": 2112,
+      "src/renderer/src/components/UpdateCard.test.ts": 1299,
+      "src/renderer/src/components/WorktreeBaseFallbackDialog.test.tsx": 2306,
+      "src/renderer/src/components/WorktreeJumpPalette.linear-url.test.tsx": 5178,
+      "src/renderer/src/components/WorktreeJumpPalette.mount-gating.test.tsx": 2600,
+      "src/renderer/src/components/WorktreeJumpPalette.recent-tabs.behavior.test.tsx": 2441,
+      "src/renderer/src/components/WorktreeJumpPalette.recent-tabs.test.tsx": 8351,
+      "src/renderer/src/components/WorktreeJumpPalette.test.tsx": 4265,
+      "src/renderer/src/components/activity/ActivityPrototypePage.filter-focus-shortcut.test.ts": 1835,
+      "src/renderer/src/components/activity/ActivityPrototypePage.test.ts": 2064,
+      "src/renderer/src/components/activity/ActivityPrototypePage.thread-grouping.test.ts": 2740,
+      "src/renderer/src/components/activity/ActivityThreadOptionsMenu.test.tsx": 3734,
+      "src/renderer/src/components/activity/activity-answered-ask-timeline.test.tsx": 1929,
+      "src/renderer/src/components/activity/activity-auto-mark-read-loop.react185.test.tsx": 2221,
+      "src/renderer/src/components/activity/activity-clear-completed-hmr.test.ts": 2023,
+      "src/renderer/src/components/activity/activity-clear-completed.test.ts": 1835,
+      "src/renderer/src/components/activity/activity-event-builder-agent-context.test.ts": 1527,
+      "src/renderer/src/components/activity/activity-event-builder.bounded-history.test.ts": 2432,
+      "src/renderer/src/components/activity/activity-event-builder.host-ownership.test.ts": 2802,
+      "src/renderer/src/components/activity/activity-event-builder.identity-reuse.test.ts": 3038,
+      "src/renderer/src/components/activity/activity-event-builder.live-cap.test.ts": 2280,
+      "src/renderer/src/components/activity/activity-portal-churn-budget.test.ts": 53,
+      "src/renderer/src/components/activity/activity-portal-readiness-decay.react185.test.tsx": 2960,
+      "src/renderer/src/components/activity/activity-portal-readiness-loop.react185.test.tsx": 3091,
+      "src/renderer/src/components/activity/activity-portal-readiness-oscillation.test.ts": 47,
+      "src/renderer/src/components/activity/activity-portal-readiness-subscription-churn.react185.test.tsx": 3186,
+      "src/renderer/src/components/activity/activity-portal-thread-reconciliation.test.ts": 45,
+      "src/renderer/src/components/activity/activity-scope-filter.test.ts": 2628,
+      "src/renderer/src/components/activity/activity-terminal-portal-publication-loop.react185.test.tsx": 288,
+      "src/renderer/src/components/activity/activity-terminal-portal.test.tsx": 451,
+      "src/renderer/src/components/activity/activity-thread-actions.test.ts": 1194,
+      "src/renderer/src/components/activity/activity-thread-child-agent.test.ts": 1802,
+      "src/renderer/src/components/activity/activity-thread-grouping.search-cache.test.ts": 1360,
+      "src/renderer/src/components/activity/activity-thread-grouping.status-order.test.ts": 3981,
+      "src/renderer/src/components/activity/activity-thread-hover-card.test.tsx": 2877,
+      "src/renderer/src/components/activity/activity-thread-list-pane-collapsible.test.tsx": 3116,
+      "src/renderer/src/components/activity/activity-thread-list-pane.virtualization.test.tsx": 2331,
+      "src/renderer/src/components/activity/activity-thread-presentation.test.ts": 2334,
+      "src/renderer/src/components/activity/activity-thread-virtual-items.test.ts": 2318,
+      "src/renderer/src/components/activity/dev-activity-fixture.test.ts": 45,
+      "src/renderer/src/components/activity/event-time-clock-refresh.test.tsx": 1277,
+      "src/renderer/src/components/activity/use-activity-thread-action-bindings.test.tsx": 858,
+      "src/renderer/src/components/activity/useActivityUnreadCount.freshness.test.tsx": 1349,
+      "src/renderer/src/components/activity/useActivityUnreadCount.test.ts": 1568,
+      "src/renderer/src/components/agent-session-continuation/AgentSessionContinuationDialog.test.tsx": 567,
+      "src/renderer/src/components/agent-session-continuation/agent-session-continuation-selection.test.ts": 59,
+      "src/renderer/src/components/agent/AgentCombobox.test.tsx": 1607,
+      "src/renderer/src/components/agent/AgentSettingsDialog.test.tsx": 627,
+      "src/renderer/src/components/agent/agent-combobox-command-state.test.ts": 38,
+      "src/renderer/src/components/artifacts/ArtifactCollection.test.tsx": 2261,
+      "src/renderer/src/components/artifacts/ArtifactPreview.test.tsx": 778,
+      "src/renderer/src/components/artifacts/ArtifactPublishButton.test.tsx": 842,
+      "src/renderer/src/components/artifacts/ArtifactsPage.test.tsx": 1366,
+      "src/renderer/src/components/artifacts/artifact-display-labels.test.ts": 106,
+      "src/renderer/src/components/artifacts/artifact-list-search.test.ts": 120,
+      "src/renderer/src/components/artifacts/artifact-list-windowing.test.tsx": 6815,
+      "src/renderer/src/components/artifacts/artifact-publish-flow.test.ts": 77,
+      "src/renderer/src/components/artifacts/artifact-published-link-client.test.ts": 52,
+      "src/renderer/src/components/automations/AutomationDestinationField.test.tsx": 1082,
+      "src/renderer/src/components/automations/AutomationDetail.host.test.tsx": 647,
+      "src/renderer/src/components/automations/AutomationDetail.test.tsx": 780,
+      "src/renderer/src/components/automations/AutomationEditorPromptEditor.test.tsx": 454,
+      "src/renderer/src/components/automations/AutomationHostBadges.test.tsx": 695,
+      "src/renderer/src/components/automations/AutomationHostFilterNotice.test.tsx": 1055,
+      "src/renderer/src/components/automations/AutomationListEmptyView.test.tsx": 798,
+      "src/renderer/src/components/automations/AutomationListHostGroups.test.tsx": 926,
+      "src/renderer/src/components/automations/AutomationListLocalRows.test.tsx": 955,
+      "src/renderer/src/components/automations/AutomationListSearchField.test.tsx": 511,
+      "src/renderer/src/components/automations/AutomationListTableHeader.test.tsx": 928,
+      "src/renderer/src/components/automations/AutomationOwnerConflictNotice.test.tsx": 892,
+      "src/renderer/src/components/automations/AutomationPromptDisclosure.test.tsx": 1140,
+      "src/renderer/src/components/automations/AutomationRunHistory.test.tsx": 1578,
+      "src/renderer/src/components/automations/AutomationRunsDashboardSurface.test.tsx": 623,
+      "src/renderer/src/components/automations/AutomationRunsTable.test.tsx": 1058,
+      "src/renderer/src/components/automations/AutomationSchedulePicker.render.test.tsx": 1285,
+      "src/renderer/src/components/automations/AutomationSchedulePicker.test.ts": 1456,
+      "src/renderer/src/components/automations/AutomationTimeField.test.tsx": 1061,
+      "src/renderer/src/components/automations/AutomationsDetailPane.run-count.test.tsx": 1899,
+      "src/renderer/src/components/automations/AutomationsDetailPane.test.tsx": 2085,
+      "src/renderer/src/components/automations/AutomationsListPanel.test.tsx": 1538,
+      "src/renderer/src/components/automations/AutomationsPage.create-destination.test.tsx": 2720,
+      "src/renderer/src/components/automations/AutomationsPage.cross-authority-actions.test.tsx": 1339,
+      "src/renderer/src/components/automations/AutomationsPage.escape-precedence.test.tsx": 2204,
+      "src/renderer/src/components/automations/AutomationsPage.external-scope.test.tsx": 1221,
+      "src/renderer/src/components/automations/AutomationsPage.notice-recovery.test.tsx": 1235,
+      "src/renderer/src/components/automations/AutomationsPage.refresh-selection.test.tsx": 1796,
+      "src/renderer/src/components/automations/AutomationsPage.run-visibility.test.tsx": 1594,
+      "src/renderer/src/components/automations/AutomationsPage.save-visibility.test.tsx": 1106,
+      "src/renderer/src/components/automations/AutomationsPage.strict-mode-save-visibility.test.tsx": 1789,
+      "src/renderer/src/components/automations/AutomationsPage.test.tsx": 3102,
+      "src/renderer/src/components/automations/AutomationsPageBreadcrumb.test.tsx": 708,
+      "src/renderer/src/components/automations/ExternalAutomationManagers.test.tsx": 922,
+      "src/renderer/src/components/automations/automation-authority-identity.test.ts": 54,
+      "src/renderer/src/components/automations/automation-captured-owner.test.ts": 107,
+      "src/renderer/src/components/automations/automation-create-destination.test.ts": 85,
+      "src/renderer/src/components/automations/automation-create-projects.test.ts": 35,
+      "src/renderer/src/components/automations/automation-detail-tab-navigation.test.ts": 300,
+      "src/renderer/src/components/automations/automation-editor-prompt-options.test.ts": 52,
+      "src/renderer/src/components/automations/automation-external-target-match.test.ts": 58,
+      "src/renderer/src/components/automations/automation-host-cache-controller.test.ts": 139,
+      "src/renderer/src/components/automations/automation-host-cache-health.test.ts": 56,
+      "src/renderer/src/components/automations/automation-host-cache.test.ts": 83,
+      "src/renderer/src/components/automations/automation-host-catalog-generation.test.ts": 84,
+      "src/renderer/src/components/automations/automation-host-catalog-order.test.ts": 51,
+      "src/renderer/src/components/automations/automation-host-catalog-source.test.ts": 64,
+      "src/renderer/src/components/automations/automation-host-catalog.test.ts": 140,
+      "src/renderer/src/components/automations/automation-host-client.test.ts": 70,
+      "src/renderer/src/components/automations/automation-host-detail-display.test.ts": 47,
+      "src/renderer/src/components/automations/automation-host-diagnostics.test.ts": 141,
+      "src/renderer/src/components/automations/automation-host-filter-resolution.test.ts": 84,
+      "src/renderer/src/components/automations/automation-host-health.test.ts": 26,
+      "src/renderer/src/components/automations/automation-host-invalidation-window-events.test.ts": 69,
+      "src/renderer/src/components/automations/automation-host-invalidation.test.ts": 50,
+      "src/renderer/src/components/automations/automation-host-list-rows.test.ts": 140,
+      "src/renderer/src/components/automations/automation-host-orphan-entry.test.ts": 160,
+      "src/renderer/src/components/automations/automation-host-picker-groups.test.ts": 58,
+      "src/renderer/src/components/automations/automation-host-recovery.test.ts": 56,
+      "src/renderer/src/components/automations/automation-host-scale-gates.test.ts": 400,
+      "src/renderer/src/components/automations/automation-host-scheduler.test.ts": 147,
+      "src/renderer/src/components/automations/automation-host-status-descriptors.test.ts": 90,
+      "src/renderer/src/components/automations/automation-legacy-schedule-editing.test.ts": 1751,
+      "src/renderer/src/components/automations/automation-list-empty-state.test.ts": 144,
+      "src/renderer/src/components/automations/automation-list-focus-recovery.test.ts": 43,
+      "src/renderer/src/components/automations/automation-list-keyboard-navigation.test.ts": 38,
+      "src/renderer/src/components/automations/automation-list-last-run.test.ts": 146,
+      "src/renderer/src/components/automations/automation-list-row-identity.test.ts": 377,
+      "src/renderer/src/components/automations/automation-list-search-rows.test.ts": 318,
+      "src/renderer/src/components/automations/automation-list-search.test.ts": 75,
+      "src/renderer/src/components/automations/automation-list-view-sort.test.ts": 458,
+      "src/renderer/src/components/automations/automation-list-view.test.ts": 99,
+      "src/renderer/src/components/automations/automation-project-groups.test.ts": 62,
+      "src/renderer/src/components/automations/automation-run-completion-evidence.test.ts": 58,
+      "src/renderer/src/components/automations/automation-run-context.test.ts": 36,
+      "src/renderer/src/components/automations/automation-run-history-keyboard-navigation.test.ts": 400,
+      "src/renderer/src/components/automations/automation-run-open-target.test.ts": 54,
+      "src/renderer/src/components/automations/automation-run-output-snapshot-equivalence.test.ts": 135,
+      "src/renderer/src/components/automations/automation-run-output-snapshot.test.ts": 78,
+      "src/renderer/src/components/automations/automation-run-view-state.test.ts": 40,
+      "src/renderer/src/components/automations/automation-runs-dashboard-model.test.ts": 38,
+      "src/renderer/src/components/automations/automation-scoped-list-client.test.ts": 127,
+      "src/renderer/src/components/automations/automation-setup-decision.test.ts": 1515,
+      "src/renderer/src/components/automations/automation-source-display.test.ts": 41,
+      "src/renderer/src/components/automations/automation-target-availability.test.ts": 60,
+      "src/renderer/src/components/automations/automation-usage-model.test.ts": 65,
+      "src/renderer/src/components/automations/automation-write-invalidation.test.ts": 53,
+      "src/renderer/src/components/automations/external-automation-display.test.ts": 66,
+      "src/renderer/src/components/automations/external-automation-list-entries.test.ts": 43,
+      "src/renderer/src/components/automations/external-automation-run-table-state.test.ts": 43,
+      "src/renderer/src/components/automations/external-automation-scope-gating.test.ts": 66,
+      "src/renderer/src/components/automations/external-automation-scope-keys.test.ts": 58,
+      "src/renderer/src/components/automations/external-automation-source-availability.test.ts": 55,
+      "src/renderer/src/components/automations/hermes-cron-output-parse.test.ts": 65,
+      "src/renderer/src/components/automations/use-automation-host-catalog-readoption.test.tsx": 810,
+      "src/renderer/src/components/automations/use-automation-host-catalog.test.tsx": 602,
+      "src/renderer/src/components/automations/use-automation-list-focus-recovery.test.tsx": 556,
+      "src/renderer/src/components/automations/use-automation-list-search.test.tsx": 673,
+      "src/renderer/src/components/automations/use-automation-runs-dashboard.test.tsx": 805,
+      "src/renderer/src/components/automations/use-external-automation-scope-retention.test.tsx": 329,
+      "src/renderer/src/components/automations/use-selected-automation-run-history.test.tsx": 747,
+      "src/renderer/src/components/browser-cookie-import-google-disclosure.test.tsx": 1424,
+      "src/renderer/src/components/browser-favicon.test.tsx": 631,
+      "src/renderer/src/components/browser-pane/ClientHostedBrowserPagePane.chrome-parity.test.tsx": 2176,
+      "src/renderer/src/components/browser-pane/ClientHostedBrowserPagePane.dead-guest.test.tsx": 2978,
+      "src/renderer/src/components/browser-pane/ClientHostedBrowserPagePane.download-notices.test.tsx": 2775,
+      "src/renderer/src/components/browser-pane/ClientHostedBrowserPagePane.drag-focus.test.tsx": 2007,
+      "src/renderer/src/components/browser-pane/ClientHostedBrowserPagePane.failure-remount.test.tsx": 2651,
+      "src/renderer/src/components/browser-pane/ClientHostedBrowserPagePane.markup.test.tsx": 2864,
+      "src/renderer/src/components/browser-pane/ClientHostedBrowserPagePane.popup-notices.test.tsx": 1804,
+      "src/renderer/src/components/browser-pane/ClientHostedBrowserPagePane.test.tsx": 1822,
+      "src/renderer/src/components/browser-pane/ReopenBrowserPageOnServerButton.test.tsx": 986,
+      "src/renderer/src/components/browser-pane/annotate/BrowserAnnotationSendMenuContent.test.tsx": 69,
+      "src/renderer/src/components/browser-pane/annotate/GrabConfirmationSheet.test.ts": 400,
+      "src/renderer/src/components/browser-pane/annotate/browser-annotation-output.test.ts": 95,
+      "src/renderer/src/components/browser-pane/annotate/browser-page-annotation-tray.test.tsx": 2934,
+      "src/renderer/src/components/browser-pane/annotate/markup-drawing-model.test.ts": 55,
+      "src/renderer/src/components/browser-pane/annotate/markup-screenshot-compose.test.ts": 70,
+      "src/renderer/src/components/browser-pane/annotate/markup-shape-render.test.ts": 69,
+      "src/renderer/src/components/browser-pane/annotate/use-browser-page-annotation-send.test.tsx": 1194,
+      "src/renderer/src/components/browser-pane/annotate/use-markup-draw-hint.test.ts": 587,
+      "src/renderer/src/components/browser-pane/annotate/useGrabMode.test.ts": 823,
+      "src/renderer/src/components/browser-pane/annotate/useMarkupEditor.test.ts": 590,
+      "src/renderer/src/components/browser-pane/annotate/useMarkupPointerHandlers.test.ts": 455,
+      "src/renderer/src/components/browser-pane/assemble-chrome/BrowserAddressBar.test.tsx": 651,
+      "src/renderer/src/components/browser-pane/assemble-chrome/BrowserFind.test.tsx": 996,
+      "src/renderer/src/components/browser-pane/assemble-chrome/BrowserPane.remote-link-routing.test.ts": 70,
+      "src/renderer/src/components/browser-pane/assemble-chrome/BrowserPane.render-ipc.test.ts": 35,
+      "src/renderer/src/components/browser-pane/assemble-chrome/BrowserPane.webview-preferences.test.ts": 607,
+      "src/renderer/src/components/browser-pane/assemble-chrome/BrowserPaneOverlayLayer.test.tsx": 830,
+      "src/renderer/src/components/browser-pane/assemble-chrome/browser-address-bar-expansion.test.ts": 39,
+      "src/renderer/src/components/browser-pane/assemble-chrome/browser-address-bar-suggestions.test.ts": 155,
+      "src/renderer/src/components/browser-pane/assemble-chrome/browser-chrome-folded-tools.test.tsx": 529,
+      "src/renderer/src/components/browser-pane/assemble-chrome/browser-chrome-toolbar.test.tsx": 1087,
+      "src/renderer/src/components/browser-pane/assemble-chrome/browser-deferred-lifecycle.test.tsx": 2498,
+      "src/renderer/src/components/browser-pane/assemble-chrome/browser-detected-browsers-summary.test.ts": 30,
+      "src/renderer/src/components/browser-pane/assemble-chrome/browser-egress-indicator.test.tsx": 1863,
+      "src/renderer/src/components/browser-pane/assemble-chrome/browser-import-hint-visibility.test.ts": 51,
+      "src/renderer/src/components/browser-pane/assemble-chrome/browser-navigation-control-row.test.tsx": 1001,
+      "src/renderer/src/components/browser-pane/assemble-chrome/browser-page-zoom-indicator.test.tsx": 652,
+      "src/renderer/src/components/browser-pane/assemble-chrome/browser-pane-page-selection.test.ts": 48,
+      "src/renderer/src/components/browser-pane/assemble-chrome/browser-workspace-pane.adoption-chrome.test.tsx": 11725,
+      "src/renderer/src/components/browser-pane/assemble-chrome/browser-workspace-pane.retention-props.test.tsx": 2366,
+      "src/renderer/src/components/browser-pane/assemble-chrome/context-menu-positioning.test.ts": 29,
+      "src/renderer/src/components/browser-pane/assemble-chrome/ssh-routed-browser-page-gate.test.tsx": 2237,
+      "src/renderer/src/components/browser-pane/assemble-chrome/use-browser-chrome-tool-fold.test.tsx": 439,
+      "src/renderer/src/components/browser-pane/assemble-chrome/use-browser-page-chrome-focus.test.tsx": 2365,
+      "src/renderer/src/components/browser-pane/assemble-chrome/use-browser-page-find-shortcuts.test.tsx": 1627,
+      "src/renderer/src/components/browser-pane/browser-client-page-metadata-publisher.test.ts": 302,
+      "src/renderer/src/components/browser-pane/browser-client-page-metadata-route-census.test.ts": 39,
+      "src/renderer/src/components/browser-pane/browser-client-page-position-driver.test.ts": 369,
+      "src/renderer/src/components/browser-pane/browser-client-page-renderer-installation.test.ts": 502,
+      "src/renderer/src/components/browser-pane/browser-client-page-retained-drag-passthrough.test.ts": 538,
+      "src/renderer/src/components/browser-pane/browser-client-page-retained-registry.test.ts": 441,
+      "src/renderer/src/components/browser-pane/browser-download-destination-toast.test.ts": 47,
+      "src/renderer/src/components/browser-pane/browser-reopen-on-server.test.ts": 150,
+      "src/renderer/src/components/browser-pane/describe-page/browser-annotation-geometry.test.ts": 197,
+      "src/renderer/src/components/browser-pane/describe-page/browser-artifact-upload.test.ts": 1993,
+      "src/renderer/src/components/browser-pane/describe-page/browser-favicon-url.test.ts": 31,
+      "src/renderer/src/components/browser-pane/describe-page/browser-overlay-shortcut-target.test.ts": 1253,
+      "src/renderer/src/components/browser-pane/describe-page/browser-page-url-display.test.ts": 1564,
+      "src/renderer/src/components/browser-pane/describe-page/live-browser-url-registry.test.ts": 44,
+      "src/renderer/src/components/browser-pane/host-guest/browser-automation-visibility.test.ts": 32,
+      "src/renderer/src/components/browser-pane/host-guest/browser-focus.test.ts": 304,
+      "src/renderer/src/components/browser-pane/host-guest/browser-guest-eviction-veto.test.ts": 1550,
+      "src/renderer/src/components/browser-pane/host-guest/browser-guest-page-id-identity.test.ts": 1555,
+      "src/renderer/src/components/browser-pane/host-guest/browser-guest-paint-retention.test.ts": 1611,
+      "src/renderer/src/components/browser-pane/host-guest/browser-guest-retention-site-census.test.ts": 743,
+      "src/renderer/src/components/browser-pane/host-guest/browser-guest-worktree-retention.test.ts": 1570,
+      "src/renderer/src/components/browser-pane/host-guest/browser-keyboard.test.ts": 483,
+      "src/renderer/src/components/browser-pane/host-guest/browser-page-evicted-guest-recovery.test.ts": 592,
+      "src/renderer/src/components/browser-pane/host-guest/browser-page-favicon-retention.test.ts": 875,
+      "src/renderer/src/components/browser-pane/host-guest/browser-page-guest-recovery.test.ts": 829,
+      "src/renderer/src/components/browser-pane/host-guest/browser-page-paintability.test.ts": 35,
+      "src/renderer/src/components/browser-pane/host-guest/browser-page-registration-ownership.test.ts": 994,
+      "src/renderer/src/components/browser-pane/host-guest/browser-page-viewport.test.ts": 389,
+      "src/renderer/src/components/browser-pane/host-guest/browser-page-webview-surface.test.ts": 554,
+      "src/renderer/src/components/browser-pane/host-guest/browser-page-webview.test.ts": 316,
+      "src/renderer/src/components/browser-pane/host-guest/browser-page-zoom.test.ts": 83,
+      "src/renderer/src/components/browser-pane/host-guest/browser-system-resume.test.ts": 314,
+      "src/renderer/src/components/browser-pane/host-guest/browser-worktree-surface-paintability.test.ts": 45,
+      "src/renderer/src/components/browser-pane/host-guest/use-browser-page-keyboard-shortcuts.split.test.tsx": 2091,
+      "src/renderer/src/components/browser-pane/host-guest/use-browser-page-slot-viewport.test.ts": 517,
+      "src/renderer/src/components/browser-pane/host-guest/use-browser-page-viewport-scroll-reporting.test.tsx": 605,
+      "src/renderer/src/components/browser-pane/host-guest/use-webview-drag-passthrough-active.test.tsx": 365,
+      "src/renderer/src/components/browser-pane/host-guest/webview-registry.test.ts": 73,
+      "src/renderer/src/components/browser-pane/navigate/browser-address-bar-navigation.test.ts": 206,
+      "src/renderer/src/components/browser-pane/navigate/browser-download-progress.test.ts": 59,
+      "src/renderer/src/components/browser-pane/navigate/browser-load-failure-overlay.test.tsx": 670,
+      "src/renderer/src/components/browser-pane/navigate/browser-notices.test.ts": 114,
+      "src/renderer/src/components/browser-pane/navigate/browser-page-download-activity.test.ts": 39,
+      "src/renderer/src/components/browser-pane/navigate/browser-reload-action.test.ts": 60,
+      "src/renderer/src/components/browser-pane/navigate/browser-webview-load-failure.test.ts": 143,
+      "src/renderer/src/components/browser-pane/navigate/chromium-error-page-poll-visibility.test.ts": 1983,
+      "src/renderer/src/components/browser-pane/navigate/chromium-error-page-polling.test.ts": 40,
+      "src/renderer/src/components/browser-pane/navigate/use-browser-page-reload-actions.test.tsx": 2074,
+      "src/renderer/src/components/browser-pane/restored-client-hosted-recovery-window.test.tsx": 2926,
+      "src/renderer/src/components/browser-pane/stream-remote/remote-browser-frame-style.test.ts": 30,
+      "src/renderer/src/components/browser-pane/stream-remote/remote-browser-keyboard.test.ts": 51,
+      "src/renderer/src/components/browser-pane/stream-remote/remote-browser-page-input-model.test.ts": 32,
+      "src/renderer/src/components/browser-pane/stream-remote/remote-browser-page-pane.address-bar.test.tsx": 2538,
+      "src/renderer/src/components/browser-pane/stream-remote/remote-browser-page-pane.chrome-chords.test.tsx": 1822,
+      "src/renderer/src/components/browser-pane/stream-remote/remote-browser-stream-errors.test.ts": 97,
+      "src/renderer/src/components/browser-pane/stream-remote/remote-browser-stream-lifecycle.test.ts": 349,
+      "src/renderer/src/components/browser-pane/stream-remote/remote-browser-stream-restart-scheduler.test.ts": 60,
+      "src/renderer/src/components/browser-pane/stream-remote/remote-browser-stream-status.test.ts": 104,
+      "src/renderer/src/components/browser-pane/stream-remote/use-remote-browser-page-navigation.test.ts": 2231,
+      "src/renderer/src/components/browser-pane/stream-remote/use-remote-browser-stream-activation.test.ts": 542,
+      "src/renderer/src/components/browser-pane/workspace-doc/HtmlDocPreview.failure-message.test.tsx": 3716,
+      "src/renderer/src/components/browser-pane/workspace-doc/HtmlDocPreview.toolbar.test.tsx": 3550,
+      "src/renderer/src/components/browser-pane/workspace-doc/doc-preview-document-actions.test.ts": 365,
+      "src/renderer/src/components/browser-pane/workspace-doc/doc-preview-document-identity.test.ts": 52,
+      "src/renderer/src/components/browser-pane/workspace-doc/doc-preview-external-link-confirmation.test.ts": 168,
+      "src/renderer/src/components/browser-pane/workspace-doc/doc-preview-webview-attach.test.ts": 433,
+      "src/renderer/src/components/browser-pane/workspace-doc/use-doc-preview-guest-tools.lazy-ref.test.tsx": 513,
+      "src/renderer/src/components/browser-pane/workspace-doc/use-doc-preview-guest-tools.test.ts": 414,
+      "src/renderer/src/components/browser-pane/workspace-doc/workspace-doc-page-pane.test.tsx": 390,
+      "src/renderer/src/components/browser-webauthn-account-dialog.test.tsx": 813,
+      "src/renderer/src/components/cmd-j/palette-activation-focus-routing.test.ts": 57,
+      "src/renderer/src/components/cmd-j/palette-duplicate-key-ghost-rows.test.tsx": 467,
+      "src/renderer/src/components/cmd-j/palette-filter-option-list.test.ts": 33,
+      "src/renderer/src/components/cmd-j/palette-filter-options.test.ts": 107,
+      "src/renderer/src/components/cmd-j/palette-filter.test.ts": 73,
+      "src/renderer/src/components/cmd-j/palette-focus-restore-target.test.ts": 491,
+      "src/renderer/src/components/cmd-j/palette-host-badge.test.ts": 126,
+      "src/renderer/src/components/cmd-j/palette-list-entry-render-keys.test.ts": 45,
+      "src/renderer/src/components/cmd-j/palette-live-status.test.tsx": 1777,
+      "src/renderer/src/components/cmd-j/palette-query-tokens.test.ts": 65,
+      "src/renderer/src/components/cmd-j/palette-results.test.ts": 271,
+      "src/renderer/src/components/cmd-j/palette-section-render-cap.test.ts": 53,
+      "src/renderer/src/components/cmd-j/palette-session-age.test.ts": 69,
+      "src/renderer/src/components/cmd-j/plugin-quick-actions.test.ts": 150,
+      "src/renderer/src/components/cmd-j/quick-action-context.test.ts": 1653,
+      "src/renderer/src/components/cmd-j/worktree-checks-review-index.test.ts": 104,
+      "src/renderer/src/components/cmd-j/worktree-palette-cache-inputs.test.ts": 41,
+      "src/renderer/src/components/codex-restart-chip.test.tsx": 2063,
+      "src/renderer/src/components/codex-restart-notice-key.test.ts": 63,
+      "src/renderer/src/components/comment-code-context-state.test.ts": 34,
+      "src/renderer/src/components/comment-reply-target-state.test.ts": 51,
+      "src/renderer/src/components/confirmation-dialog-refresh-boundary.test.ts": 1586,
+      "src/renderer/src/components/confirmation-dialog.test.tsx": 1122,
+      "src/renderer/src/components/confirmation-skip-preference.test.ts": 157,
+      "src/renderer/src/components/connect-dialog-outside-dismiss.test.tsx": 1677,
+      "src/renderer/src/components/contextual-tours/ContextualTourControl.test.ts": 1553,
+      "src/renderer/src/components/contextual-tours/ContextualTourOverlay.remeasure.test.tsx": 2477,
+      "src/renderer/src/components/contextual-tours/ContextualTourOverlay.test.tsx": 2265,
+      "src/renderer/src/components/contextual-tours/ContextualTourOverlay.visibility.test.tsx": 4465,
+      "src/renderer/src/components/contextual-tours/ContextualTourOverlaySurface.localization.test.tsx": 1925,
+      "src/renderer/src/components/contextual-tours/contextual-tour-floating-position.test.ts": 2237,
+      "src/renderer/src/components/contextual-tours/contextual-tour-gate.test.ts": 52,
+      "src/renderer/src/components/contextual-tours/contextual-tour-overlay-measurement.test.ts": 2147,
+      "src/renderer/src/components/contextual-tours/contextual-tour-step-actions.test.ts": 55,
+      "src/renderer/src/components/contextual-tours/request-contextual-tour-when-ready.test.ts": 1567,
+      "src/renderer/src/components/contextual-tours/use-contextual-tour.test.ts": 1611,
+      "src/renderer/src/components/contextual-tours/workspace-creation-tour-handoff.test.ts": 1626,
+      "src/renderer/src/components/crash-report/CrashReportDialogSurface.overflow.test.tsx": 1063,
+      "src/renderer/src/components/crash-report/crash-report-submit-notice.test.ts": 99,
+      "src/renderer/src/components/crash-report/use-crash-report-copy.test.tsx": 469,
+      "src/renderer/src/components/dashboard-popout/AgentKanbanBoard.test.tsx": 1770,
+      "src/renderer/src/components/dashboard-popout/AgentKanbanCard.test.tsx": 1455,
+      "src/renderer/src/components/dashboard-popout/AgentTerminalDialog.test.tsx": 1261,
+      "src/renderer/src/components/dashboard-popout/AgentTerminalPreview.clipboard-routes.test.tsx": 2804,
+      "src/renderer/src/components/dashboard-popout/AgentTerminalPreview.option-dead-key.test.tsx": 1099,
+      "src/renderer/src/components/dashboard-popout/AgentTerminalPreview.settings-geometry.test.tsx": 2141,
+      "src/renderer/src/components/dashboard-popout/AgentTerminalPreview.settings-lifetime.test.tsx": 1461,
+      "src/renderer/src/components/dashboard-popout/AgentTerminalPreview.test.tsx": 2518,
+      "src/renderer/src/components/dashboard-popout/DashboardHostBadge.test.tsx": 824,
+      "src/renderer/src/components/dashboard-popout/DashboardPopoutRoot.test.tsx": 406,
+      "src/renderer/src/components/dashboard-popout/agent-board-filtering.test.ts": 45,
+      "src/renderer/src/components/dashboard-popout/dashboard-agent-status-patch.test.ts": 42,
+      "src/renderer/src/components/dashboard-popout/preview-grid-claim.test.ts": 467,
+      "src/renderer/src/components/dashboard-popout/preview-terminal-ime-bridge-kitty-bytes.test.ts": 611,
+      "src/renderer/src/components/dashboard-popout/preview-terminal-options.test.ts": 450,
+      "src/renderer/src/components/dashboard-popout/preview-terminal-right-click-paste.test.ts": 1921,
+      "src/renderer/src/components/dashboard-popout/preview-terminal-shortcuts.test.ts": 391,
+      "src/renderer/src/components/dashboard-popout/preview-terminal-snapshot-replay.test.ts": 54,
+      "src/renderer/src/components/dashboard-popout/terminal-preview-unavailable-message.test.ts": 77,
+      "src/renderer/src/components/dashboard-popout/useDashboardSnapshot.test.tsx": 381,
+      "src/renderer/src/components/dashboard/AgentDashboardDrawer.test.tsx": 2133,
+      "src/renderer/src/components/dashboard/AgentDashboardSettingsMenu.test.tsx": 1129,
+      "src/renderer/src/components/dashboard/DashboardAgentRow.test.tsx": 1861,
+      "src/renderer/src/components/dashboard/agent-dashboard-performance-isolation.test.ts": 46,
+      "src/renderer/src/components/dashboard/agent-finished-timestamp.test.ts": 56,
+      "src/renderer/src/components/dashboard/agent-row-lineage-model.test.ts": 117,
+      "src/renderer/src/components/dashboard/agent-row-pane-live-title.test.ts": 34,
+      "src/renderer/src/components/dashboard/build-dashboard-bucket-counts.allocation.test.ts": 192,
+      "src/renderer/src/components/dashboard/build-dashboard-bucket-counts.cache.test.ts": 213,
+      "src/renderer/src/components/dashboard/build-dashboard-bucket-counts.equivalence.test.ts": 129,
+      "src/renderer/src/components/dashboard/build-dashboard-snapshot-folder-workspace.test.ts": 1728,
+      "src/renderer/src/components/dashboard/build-dashboard-snapshot-orchestration-routing.test.ts": 1618,
+      "src/renderer/src/components/dashboard/build-dashboard-snapshot.rows-cache.test.ts": 907,
+      "src/renderer/src/components/dashboard/build-dashboard-snapshot.test.ts": 1818,
+      "src/renderer/src/components/dashboard/dashboard-card-context.test.ts": 60,
+      "src/renderer/src/components/dashboard/dashboard-card-labels.test.ts": 43,
+      "src/renderer/src/components/dashboard/dashboard-card-terminal-input.test.ts": 1383,
+      "src/renderer/src/components/dashboard/dashboard-worktree-launch-options.test.ts": 75,
+      "src/renderer/src/components/dashboard/launch-dashboard-agent.test.ts": 53,
+      "src/renderer/src/components/dashboard/use-agent-row-conversation-name.test.ts": 90,
+      "src/renderer/src/components/dashboard/useAgentBucketCounts.gate.test.ts": 218,
+      "src/renderer/src/components/dashboard/useAgentBucketCounts.test.tsx": 594,
+      "src/renderer/src/components/dashboard/useDashboardPopoutBridge.test.tsx": 824,
+      "src/renderer/src/components/dashboard/useLiveDashboardSnapshot.test.ts": 2326,
+      "src/renderer/src/components/dashboard/useRetainedAgents.test.ts": 1992,
+      "src/renderer/src/components/dashboard/useRetainedAgentsSync.test.ts": 971,
+      "src/renderer/src/components/dictation/DictationIndicator.localization.test.ts": 394,
+      "src/renderer/src/components/dictation/DictationIndicator.test.tsx": 761,
+      "src/renderer/src/components/dictation/dictation-audio-meter.test.ts": 37,
+      "src/renderer/src/components/dictation/dictation-final-segments.test.ts": 53,
+      "src/renderer/src/components/dictation/dictation-insertion-target.test.ts": 535,
+      "src/renderer/src/components/dictation/dictation-meter-store.test.tsx": 356,
+      "src/renderer/src/components/dictation/dictation-stopped-sessions.test.ts": 39,
+      "src/renderer/src/components/dictation/microphone-devices.test.ts": 225,
+      "src/renderer/src/components/dictation/use-hold-dictation-gesture.test.tsx": 436,
+      "src/renderer/src/components/diff-comments/DiffCommentCard.resize.test.tsx": 833,
+      "src/renderer/src/components/diff-comments/DiffCommentDraftCard.test.tsx": 2221,
+      "src/renderer/src/components/diff-comments/diff-comment-draft-zone.test.tsx": 2636,
+      "src/renderer/src/components/diff-comments/diff-comment-drag-auto-scroll.test.ts": 35,
+      "src/renderer/src/components/diff-comments/diff-comment-line-range.test.ts": 45,
+      "src/renderer/src/components/diff-comments/diff-comment-popover-outside-click.test.tsx": 1653,
+      "src/renderer/src/components/diff-comments/diff-comment-popover-position.test.ts": 51,
+      "src/renderer/src/components/diff-comments/diff-comment-range-drag.test.ts": 4994,
+      "src/renderer/src/components/diff-comments/diff-comment-zone-mouse-events.test.ts": 75,
+      "src/renderer/src/components/diff-comments/useDiffCommentDecorator.commentable-lines.test.tsx": 2302,
+      "src/renderer/src/components/diff-comments/useDiffCommentDecorator.model-lifecycle.test.tsx": 10560,
+      "src/renderer/src/components/diff-comments/useDiffCommentDecorator.range-selection.test.tsx": 9340,
+      "src/renderer/src/components/editor/ChangesModeView.test.tsx": 732,
+      "src/renderer/src/components/editor/CheckRunCopyButton.test.tsx": 913,
+      "src/renderer/src/components/editor/CheckRunDetailsPanel.copy.test.tsx": 2524,
+      "src/renderer/src/components/editor/ConflictComponents.test.tsx": 456,
+      "src/renderer/src/components/editor/EditorContent.markdown-classification.test.tsx": 2582,
+      "src/renderer/src/components/editor/EditorContent.monaco-lifecycle.test.tsx": 2668,
+      "src/renderer/src/components/editor/EditorContent.test.tsx": 2479,
+      "src/renderer/src/components/editor/EditorEditFileSurface.monaco-containment.test.tsx": 2094,
+      "src/renderer/src/components/editor/EditorFileLoadErrorView.test.tsx": 931,
+      "src/renderer/src/components/editor/EditorPanel.markdown-classification-memoization.test.tsx": 3127,
+      "src/renderer/src/components/editor/EditorPanelHeader.test.tsx": 1141,
+      "src/renderer/src/components/editor/EditorPanelHeaderPath.test.tsx": 3424,
+      "src/renderer/src/components/editor/EditorPanelMarkdownActionsMenu.test.tsx": 234,
+      "src/renderer/src/components/editor/EditorPanelShell.header.test.tsx": 157,
+      "src/renderer/src/components/editor/ExternalFileChangeBanner.test.tsx": 261,
+      "src/renderer/src/components/editor/ExternalFileChangeCompareDialog.test.tsx": 671,
+      "src/renderer/src/components/editor/ImageViewer.test.tsx": 132,
+      "src/renderer/src/components/editor/IpynbKernelToolbar.test.tsx": 1349,
+      "src/renderer/src/components/editor/IpynbRendering.test.tsx": 2742,
+      "src/renderer/src/components/editor/LargeDiffLoadPrompt.test.tsx": 657,
+      "src/renderer/src/components/editor/MarkdownPreview.link-routing.interaction.test.tsx": 1262,
+      "src/renderer/src/components/editor/MarkdownPreview.test.ts": 2737,
+      "src/renderer/src/components/editor/MarkdownPreview.toc-visibility-gate.test.tsx": 1364,
+      "src/renderer/src/components/editor/MarkdownPreviewBody.test.tsx": 579,
+      "src/renderer/src/components/editor/MarkdownTableOfContentsPanel.test.tsx": 1063,
+      "src/renderer/src/components/editor/MonacoEditor.content-owner.test.tsx": 6383,
+      "src/renderer/src/components/editor/MonacoEditor.font-family.test.tsx": 2152,
+      "src/renderer/src/components/editor/NotesSendMenu.test.tsx": 302,
+      "src/renderer/src/components/editor/PdfFind.test.tsx": 881,
+      "src/renderer/src/components/editor/ReviewNotesSendMenuContent.test.tsx": 156,
+      "src/renderer/src/components/editor/RichMarkdownErrorBoundary.lazy-chunk.test.tsx": 640,
+      "src/renderer/src/components/editor/RichMarkdownLinkBubble.render.test.tsx": 1046,
+      "src/renderer/src/components/editor/RichMarkdownLinkBubble.test.ts": 437,
+      "src/renderer/src/components/editor/RichMarkdownSearchBar.ime-enter.test.tsx": 1007,
+      "src/renderer/src/components/editor/RichMarkdownSlashMenu.test.tsx": 326,
+      "src/renderer/src/components/editor/RichMarkdownTableControls.test.tsx": 2235,
+      "src/renderer/src/components/editor/check-annotation-open.test.ts": 84,
+      "src/renderer/src/components/editor/check-annotation-path.test.ts": 39,
+      "src/renderer/src/components/editor/check-job-step-status.test.ts": 34,
+      "src/renderer/src/components/editor/check-run-clipboard-text.test.ts": 42,
+      "src/renderer/src/components/editor/check-run-details-fix-with-ai.test.ts": 542,
+      "src/renderer/src/components/editor/check-run-details-tab.test.ts": 33,
+      "src/renderer/src/components/editor/closed-editor-model-lifetime.test.ts": 2002,
+      "src/renderer/src/components/editor/closed-editor-model-reentrancy.test.ts": 7076,
+      "src/renderer/src/components/editor/closed-editor-model-registry.test.ts": 8037,
+      "src/renderer/src/components/editor/closed-editor-model-shell.test.tsx": 4841,
+      "src/renderer/src/components/editor/closed-editor-tab-cache-sweep.test.ts": 55,
+      "src/renderer/src/components/editor/closed-editor-tab-disposal.test.ts": 219,
+      "src/renderer/src/components/editor/closed-editor-view-state-retention.test.ts": 4770,
+      "src/renderer/src/components/editor/combined-diff-on-demand-load.test.ts": 49,
+      "src/renderer/src/components/editor/combined-diff/browse-files/combined-diff-file-tree-collapsed-work.test.tsx": 780,
+      "src/renderer/src/components/editor/combined-diff/browse-files/combined-diff-file-tree-render.test.tsx": 1657,
+      "src/renderer/src/components/editor/combined-diff/browse-files/combined-diff-file-tree-row-drag.test.tsx": 501,
+      "src/renderer/src/components/editor/combined-diff/browse-files/combined-diff-file-tree-windowing.test.tsx": 970,
+      "src/renderer/src/components/editor/combined-diff/browse-files/combined-diff-file-tree.test.ts": 86,
+      "src/renderer/src/components/editor/combined-diff/browse-files/use-combined-diff-file-tree-resize.test.tsx": 368,
+      "src/renderer/src/components/editor/combined-diff/browse-files/use-combined-diff-tree-navigation.test.ts": 591,
+      "src/renderer/src/components/editor/combined-diff/load-sections/combined-diff-initial-section-load.test.ts": 46,
+      "src/renderer/src/components/editor/combined-diff/load-sections/combined-diff-load-scheduler.test.ts": 53,
+      "src/renderer/src/components/editor/combined-diff/load-sections/combined-diff-section-connection.test.ts": 1433,
+      "src/renderer/src/components/editor/combined-diff/load-sections/combined-diff-section-load-state.test.ts": 38,
+      "src/renderer/src/components/editor/combined-diff/remember-view/use-combined-diff-view-restore.test.tsx": 560,
+      "src/renderer/src/components/editor/combined-diff/resolve-changes/combined-diff-entries.test.ts": 50,
+      "src/renderer/src/components/editor/combined-diff/resolve-changes/combined-diff-section-cache-match.test.ts": 55,
+      "src/renderer/src/components/editor/combined-diff/resolve-changes/combined-diff-section-scaling.test.tsx": 602,
+      "src/renderer/src/components/editor/combined-diff/resolve-changes/use-combined-diff-section-index-map.test.tsx": 664,
+      "src/renderer/src/components/editor/combined-diff/review-controls/combined-diff-commit-message.test.ts": 48,
+      "src/renderer/src/components/editor/combined-diff/scroll-viewport/combined-diff-restore-signal-equivalence.test.tsx": 552,
+      "src/renderer/src/components/editor/combined-diff/scroll-viewport/combined-diff-scrollbar-drag.test.ts": 59,
+      "src/renderer/src/components/editor/conflict-review-file-tree-windowing.test.tsx": 2238,
+      "src/renderer/src/components/editor/csv-parse.test.ts": 122,
+      "src/renderer/src/components/editor/details-markdown-html.test.ts": 99,
+      "src/renderer/src/components/editor/diff-editor-hide-unchanged-options.test.ts": 35,
+      "src/renderer/src/components/editor/diff-editor-line-number-options.test.ts": 48,
+      "src/renderer/src/components/editor/diff-editor-shift-wheel-scroll.test.ts": 484,
+      "src/renderer/src/components/editor/diff-editor-whitespace-options.test.ts": 30,
+      "src/renderer/src/components/editor/diff-editor-word-wrap-options.test.ts": 43,
+      "src/renderer/src/components/editor/diff-line-stats.test.ts": 56,
+      "src/renderer/src/components/editor/diff-model-swap-view-state.test.ts": 524,
+      "src/renderer/src/components/editor/diff-monaco-model-disposal.test.ts": 67,
+      "src/renderer/src/components/editor/diff-navigation-context.test.tsx": 1956,
+      "src/renderer/src/components/editor/diff-section-comment-submit.test.ts": 114,
+      "src/renderer/src/components/editor/diff-section-layout.test.ts": 68,
+      "src/renderer/src/components/editor/diff-section-preview.test.ts": 1595,
+      "src/renderer/src/components/editor/diff-viewer-large-diff-save-action.test.ts": 112,
+      "src/renderer/src/components/editor/editor-autosave-conflict-flow.test.ts": 574,
+      "src/renderer/src/components/editor/editor-autosave-controller.test.ts": 500,
+      "src/renderer/src/components/editor/editor-autosave.test.ts": 152,
+      "src/renderer/src/components/editor/editor-cmd-save-target.test.ts": 225,
+      "src/renderer/src/components/editor/editor-content-dirty-state.test.ts": 62,
+      "src/renderer/src/components/editor/editor-external-watch-path-index.test.ts": 1558,
+      "src/renderer/src/components/editor/editor-file-save-attempt.test.ts": 70,
+      "src/renderer/src/components/editor/editor-header-file-rename.test.ts": 608,
+      "src/renderer/src/components/editor/editor-header.test.ts": 37,
+      "src/renderer/src/components/editor/editor-labels.test.ts": 37,
+      "src/renderer/src/components/editor/editor-model-uri.test.ts": 127,
+      "src/renderer/src/components/editor/editor-panel-diff-reload.test.ts": 26,
+      "src/renderer/src/components/editor/editor-panel-draft-selector.test.ts": 38,
+      "src/renderer/src/components/editor/editor-panel-git-entry-selector.test.ts": 63,
+      "src/renderer/src/components/editor/editor-panel-render-model.test.ts": 2036,
+      "src/renderer/src/components/editor/editor-path-display.test.ts": 38,
+      "src/renderer/src/components/editor/editor-path-move-inflight.test.ts": 60,
+      "src/renderer/src/components/editor/editor-restored-tab-conflict-scan.test.ts": 445,
+      "src/renderer/src/components/editor/editor-self-write-registry.test.ts": 69,
+      "src/renderer/src/components/editor/editor-shortcuts.test.ts": 526,
+      "src/renderer/src/components/editor/export-active-markdown.test.ts": 396,
+      "src/renderer/src/components/editor/file-editor-word-wrap-options.test.ts": 46,
+      "src/renderer/src/components/editor/image-viewer-zoom.test.ts": 55,
+      "src/renderer/src/components/editor/ipynb-ansi.test.ts": 54,
+      "src/renderer/src/components/editor/ipynb-code-cell-lines.test.ts": 121,
+      "src/renderer/src/components/editor/ipynb-kernel-outputs.test.ts": 33,
+      "src/renderer/src/components/editor/ipynb-kernel-session.test.ts": 183,
+      "src/renderer/src/components/editor/ipynb-kernel-setup-commands.test.ts": 54,
+      "src/renderer/src/components/editor/ipynb-parse.test.ts": 77,
+      "src/renderer/src/components/editor/large-diff-render-limit.test.ts": 171,
+      "src/renderer/src/components/editor/line-copy-path.test.ts": 34,
+      "src/renderer/src/components/editor/local-log-tail-decoder.test.ts": 47,
+      "src/renderer/src/components/editor/markdown-artifact-upload.test.ts": 64,
+      "src/renderer/src/components/editor/markdown-dirty-state.test.ts": 317,
+      "src/renderer/src/components/editor/markdown-doc-completions.test.ts": 57,
+      "src/renderer/src/components/editor/markdown-doc-links.test.ts": 173,
+      "src/renderer/src/components/editor/markdown-document-list-request.test.ts": 308,
+      "src/renderer/src/components/editor/markdown-document-worktree-path-selector.test.ts": 1467,
+      "src/renderer/src/components/editor/markdown-export-extract.test.ts": 606,
+      "src/renderer/src/components/editor/markdown-export-html.test.ts": 47,
+      "src/renderer/src/components/editor/markdown-frontmatter.test.ts": 49,
+      "src/renderer/src/components/editor/markdown-heading-slug.test.ts": 48,
+      "src/renderer/src/components/editor/markdown-internal-links.test.ts": 54,
+      "src/renderer/src/components/editor/markdown-preview-annotation-shortcut.test.ts": 458,
+      "src/renderer/src/components/editor/markdown-preview-controls.test.ts": 45,
+      "src/renderer/src/components/editor/markdown-preview-links.test.ts": 74,
+      "src/renderer/src/components/editor/markdown-preview-local-images.test.ts": 458,
+      "src/renderer/src/components/editor/markdown-preview-search-crash.test.tsx": 408,
+      "src/renderer/src/components/editor/markdown-preview-search.test.ts": 87,
+      "src/renderer/src/components/editor/markdown-preview-url-transform.test.ts": 151,
+      "src/renderer/src/components/editor/markdown-reference-link-normalization.test.ts": 64,
+      "src/renderer/src/components/editor/markdown-render-mode.test.ts": 53,
+      "src/renderer/src/components/editor/markdown-rich-comment-scan.test.ts": 191,
+      "src/renderer/src/components/editor/markdown-rich-line-scan.test.ts": 1513,
+      "src/renderer/src/components/editor/markdown-rich-mode-eligibility-cache.test.ts": 1351,
+      "src/renderer/src/components/editor/markdown-rich-mode.test.ts": 2072,
+      "src/renderer/src/components/editor/markdown-rich-size-limit.test.ts": 117,
+      "src/renderer/src/components/editor/markdown-round-trip.test.ts": 2234,
+      "src/renderer/src/components/editor/markdown-scanner-boundaries.test.ts": 121,
+      "src/renderer/src/components/editor/markdown-table-of-contents.test.ts": 275,
+      "src/renderer/src/components/editor/markdown-toc-collapse-state.test.ts": 56,
+      "src/renderer/src/components/editor/markdown-toc-visibility-gate.test.ts": 229,
+      "src/renderer/src/components/editor/markdown-tokenizer-start.test.ts": 80,
+      "src/renderer/src/components/editor/mermaid-config.test.ts": 27,
+      "src/renderer/src/components/editor/monaco-auto-height.test.ts": 97,
+      "src/renderer/src/components/editor/monaco-codebase-search.test.ts": 71,
+      "src/renderer/src/components/editor/monaco-conflict-decorations.test.ts": 83,
+      "src/renderer/src/components/editor/monaco-content-sync.test.ts": 53,
+      "src/renderer/src/components/editor/monaco-content-sync.undo-history.test.ts": 1055,
+      "src/renderer/src/components/editor/monaco-context-menu-paste.test.ts": 547,
+      "src/renderer/src/components/editor/monaco-cursor-line-lifetime.test.ts": 552,
+      "src/renderer/src/components/editor/monaco-find-options.test.ts": 36,
+      "src/renderer/src/components/editor/monaco-find-widget.test.ts": 492,
+      "src/renderer/src/components/editor/monaco-large-text-paste.test.ts": 282,
+      "src/renderer/src/components/editor/monaco-markdown-doc-link-decorations.offset-scan.test.ts": 169,
+      "src/renderer/src/components/editor/monaco-markdown-doc-link-decorations.test.ts": 74,
+      "src/renderer/src/components/editor/monaco-markdown-selection-annotation.test.ts": 41,
+      "src/renderer/src/components/editor/monaco-programmatic-sync.test.ts": 35,
+      "src/renderer/src/components/editor/monaco-reveal-range.test.ts": 53,
+      "src/renderer/src/components/editor/monaco-view-state-persistence.test.ts": 31,
+      "src/renderer/src/components/editor/pdf-js-document-options.test.ts": 34,
+      "src/renderer/src/components/editor/pdf-scale-preference-storage.test.ts": 42,
+      "src/renderer/src/components/editor/pdf-scale-preference.test.ts": 67,
+      "src/renderer/src/components/editor/pdf-view-position.test.ts": 51,
+      "src/renderer/src/components/editor/pending-editor-focus-request.test.ts": 23,
+      "src/renderer/src/components/editor/position-stable-node-view-update.test.ts": 49,
+      "src/renderer/src/components/editor/raw-markdown-comment-scan.test.ts": 88,
+      "src/renderer/src/components/editor/raw-markdown-html.blank-run.test.ts": 302,
+      "src/renderer/src/components/editor/restored-editor-owner-save-lifecycle.test.ts": 2399,
+      "src/renderer/src/components/editor/rich-markdown-auto-focus.test.ts": 425,
+      "src/renderer/src/components/editor/rich-markdown-block-source-work.test.ts": 2647,
+      "src/renderer/src/components/editor/rich-markdown-code-block-languages.test.ts": 135,
+      "src/renderer/src/components/editor/rich-markdown-commands.test.ts": 1938,
+      "src/renderer/src/components/editor/rich-markdown-context-command-routing.test.ts": 2415,
+      "src/renderer/src/components/editor/rich-markdown-cut.test.ts": 794,
+      "src/renderer/src/components/editor/rich-markdown-details-case.test.ts": 1964,
+      "src/renderer/src/components/editor/rich-markdown-details-keyboard.test.ts": 2040,
+      "src/renderer/src/components/editor/rich-markdown-doc-link.test.ts": 40,
+      "src/renderer/src/components/editor/rich-markdown-document-fidelity.test.ts": 2200,
+      "src/renderer/src/components/editor/rich-markdown-editor-click-routing.test.ts": 145,
+      "src/renderer/src/components/editor/rich-markdown-editor-config.test.ts": 1687,
+      "src/renderer/src/components/editor/rich-markdown-empty-paragraph-delete.test.ts": 277,
+      "src/renderer/src/components/editor/rich-markdown-escape-fidelity.test.ts": 2267,
+      "src/renderer/src/components/editor/rich-markdown-extension.test.ts": 278,
+      "src/renderer/src/components/editor/rich-markdown-html-superscript-link.test.ts": 2950,
+      "src/renderer/src/components/editor/rich-markdown-image-insert-code-block.test.ts": 1229,
+      "src/renderer/src/components/editor/rich-markdown-image-insert.test.ts": 1296,
+      "src/renderer/src/components/editor/rich-markdown-inline-image-paragraph.test.ts": 1666,
+      "src/renderer/src/components/editor/rich-markdown-inline-source-tokenization.test.ts": 1619,
+      "src/renderer/src/components/editor/rich-markdown-key-handler.test.ts": 2540,
+      "src/renderer/src/components/editor/rich-markdown-large-text-paste.test.ts": 435,
+      "src/renderer/src/components/editor/rich-markdown-link-clipboard.test.ts": 346,
+      "src/renderer/src/components/editor/rich-markdown-link-shortcut.test.ts": 2061,
+      "src/renderer/src/components/editor/rich-markdown-list-continuation.test.ts": 337,
+      "src/renderer/src/components/editor/rich-markdown-list-tokenizers.test.ts": 94,
+      "src/renderer/src/components/editor/rich-markdown-literal-serialization.test.ts": 189,
+      "src/renderer/src/components/editor/rich-markdown-local-image.test.ts": 1442,
+      "src/renderer/src/components/editor/rich-markdown-lowlight-cache.test.ts": 173,
+      "src/renderer/src/components/editor/rich-markdown-lowlight.test.ts": 3282,
+      "src/renderer/src/components/editor/rich-markdown-normalize.test.ts": 217,
+      "src/renderer/src/components/editor/rich-markdown-paragraph.test.ts": 72,
+      "src/renderer/src/components/editor/rich-markdown-paste-handler.test.ts": 71,
+      "src/renderer/src/components/editor/rich-markdown-paste-image.test.ts": 290,
+      "src/renderer/src/components/editor/rich-markdown-range-bounds.test.ts": 77,
+      "src/renderer/src/components/editor/rich-markdown-review-annotations.test.ts": 62,
+      "src/renderer/src/components/editor/rich-markdown-review-note-layout.test.ts": 69,
+      "src/renderer/src/components/editor/rich-markdown-review-rail-benchmark.test.ts": 1569,
+      "src/renderer/src/components/editor/rich-markdown-review-rail-blocks.test.ts": 2656,
+      "src/renderer/src/components/editor/rich-markdown-review-text-ranges.test.ts": 70,
+      "src/renderer/src/components/editor/rich-markdown-save-benchmark.test.ts": 1966,
+      "src/renderer/src/components/editor/rich-markdown-search-matches-cache.test.ts": 98,
+      "src/renderer/src/components/editor/rich-markdown-search.test.ts": 84,
+      "src/renderer/src/components/editor/rich-markdown-serialization-commit.test.ts": 1584,
+      "src/renderer/src/components/editor/rich-markdown-slash-command-filter.test.ts": 59,
+      "src/renderer/src/components/editor/rich-markdown-source-reconcile.test.ts": 2386,
+      "src/renderer/src/components/editor/rich-markdown-tab-key-handler.test.ts": 2323,
+      "src/renderer/src/components/editor/rich-markdown-table-actions.test.ts": 2946,
+      "src/renderer/src/components/editor/rich-markdown-table-control-layout.test.ts": 54,
+      "src/renderer/src/components/editor/rich-markdown-table-keyboard.test.ts": 2006,
+      "src/renderer/src/components/editor/rich-markdown-table.test.ts": 108,
+      "src/renderer/src/components/editor/rich-markdown-terminal-path-paste.test.ts": 333,
+      "src/renderer/src/components/editor/rich-markdown-toc-heading-target.test.ts": 261,
+      "src/renderer/src/components/editor/rich-markdown-trailing-paragraph.test.ts": 1766,
+      "src/renderer/src/components/editor/selection-copy.test.ts": 56,
+      "src/renderer/src/components/editor/setup-contextual-copy.test.ts": 93,
+      "src/renderer/src/components/editor/untitled-file-rename-path.test.ts": 49,
+      "src/renderer/src/components/editor/use-monaco-editor-decorations.doc-link-refresh.test.tsx": 398,
+      "src/renderer/src/components/editor/use-monaco-editor-mount.cursor-owner.test.tsx": 1210,
+      "src/renderer/src/components/editor/use-rich-markdown-table-context-menu.test.tsx": 1455,
+      "src/renderer/src/components/editor/use-rich-markdown-table-control-target.test.tsx": 2651,
+      "src/renderer/src/components/editor/useDiffViewerLargeDiffLifecycle.test.tsx": 628,
+      "src/renderer/src/components/editor/useEditorCmdSaveRequest.test.tsx": 494,
+      "src/renderer/src/components/editor/useEditorPanelContentState.test.tsx": 2597,
+      "src/renderer/src/components/editor/useEditorPanelExternalContentEvents.test.tsx": 567,
+      "src/renderer/src/components/editor/useEditorPanelFileLoadRetry.test.tsx": 600,
+      "src/renderer/src/components/editor/useEditorPanelHostUnresolvedContentState.test.tsx": 550,
+      "src/renderer/src/components/editor/useEditorPanelRemoteSiblingContentState.test.tsx": 556,
+      "src/renderer/src/components/editor/useEditorPanelVisibilityContentState.test.tsx": 791,
+      "src/renderer/src/components/editor/useIpynbCellExecution.test.tsx": 768,
+      "src/renderer/src/components/editor/useIpynbDocumentEditing.test.tsx": 359,
+      "src/renderer/src/components/editor/useLinkBubble.test.tsx": 638,
+      "src/renderer/src/components/editor/useLocalImageSrc.test.ts": 819,
+      "src/renderer/src/components/editor/useLocalLogTail.test.tsx": 506,
+      "src/renderer/src/components/editor/useMarkdownDocuments.navigation.test.ts": 674,
+      "src/renderer/src/components/editor/useMarkdownDocuments.test.ts": 964,
+      "src/renderer/src/components/editor/useRichMarkdownEditorInstance.integration.test.tsx": 384,
+      "src/renderer/src/components/editor/useRichMarkdownEditorInstance.test.tsx": 589,
+      "src/renderer/src/components/editor/useRichMarkdownPendingFocus.test.ts": 532,
+      "src/renderer/src/components/editor/useRichMarkdownProgrammaticSync.test.ts": 2348,
+      "src/renderer/src/components/editor/useRichMarkdownReviewController.open-guard.test.ts": 673,
+      "src/renderer/src/components/editor/useRichMarkdownSearch.reuse.test.tsx": 500,
+      "src/renderer/src/components/editor/useRichMarkdownSearch.test.tsx": 1658,
+      "src/renderer/src/components/emulator-pane/MobileEmulatorTabIntroCallout.test.tsx": 939,
+      "src/renderer/src/components/emulator-pane/emulator-device-frame-layout.test.ts": 32,
+      "src/renderer/src/components/emulator-pane/emulator-device-frame-visibility.test.tsx": 951,
+      "src/renderer/src/components/emulator-pane/emulator-device-frame.input.test.tsx": 761,
+      "src/renderer/src/components/emulator-pane/emulator-device-state.test.ts": 29,
+      "src/renderer/src/components/emulator-pane/emulator-keyboard-paste.test.ts": 325,
+      "src/renderer/src/components/emulator-pane/emulator-screen-gesture.test.ts": 66,
+      "src/renderer/src/components/emulator-pane/emulator-screen-stream-content.test.tsx": 754,
+      "src/renderer/src/components/emulator-pane/mobile-emulator-agent-setup-cli-state.test.ts": 60,
+      "src/renderer/src/components/emulator-pane/mobile-emulator-agent-setup-visibility.test.ts": 37,
+      "src/renderer/src/components/emulator-pane/mobile-emulator-hidden-toast.test.tsx": 525,
+      "src/renderer/src/components/emulator-pane/mobile-emulator-tab-intro-visibility.test.ts": 37,
+      "src/renderer/src/components/emulator-pane/use-emulator-pane-session.test.tsx": 2088,
+      "src/renderer/src/components/emulator-pane/use-mobile-emulator-tab-intro-actions.test.tsx": 1609,
+      "src/renderer/src/components/error-boundaries/RecoverableRenderErrorBoundary.lazy-chunk.test.tsx": 1006,
+      "src/renderer/src/components/error-boundaries/RecoverableRenderErrorBoundary.never-landed-reload.test.tsx": 524,
+      "src/renderer/src/components/error-boundaries/react-185-bystander-attribution.test.tsx": 542,
+      "src/renderer/src/components/feature-interaction-writer-boundaries.test.ts": 51,
+      "src/renderer/src/components/feature-tips/CliSkillSetupTerminal.test.tsx": 1232,
+      "src/renderer/src/components/feature-tips/CmdJPaletteFeatureTipVisual.test.tsx": 812,
+      "src/renderer/src/components/feature-tips/CmdJPaletteTipDialog.test.tsx": 264,
+      "src/renderer/src/components/feature-tips/SessionSearchTipDialog.test.tsx": 601,
+      "src/renderer/src/components/feature-tips/VoiceDictationFeatureTipVisual.test.tsx": 557,
+      "src/renderer/src/components/feature-tips/VoiceDictationTipDialog.test.tsx": 875,
+      "src/renderer/src/components/feature-tips/feature-tip-cli-install-action.test.ts": 52,
+      "src/renderer/src/components/feature-tips/feature-tip-modal-state.test.ts": 179,
+      "src/renderer/src/components/feature-tips/feature-tip-startup-gate.test.ts": 218,
+      "src/renderer/src/components/feature-tips/feature-tip-telemetry.test.ts": 57,
+      "src/renderer/src/components/feature-tips/use-session-search-tip-setup.test.tsx": 702,
+      "src/renderer/src/components/feature-wall/AgentCapabilitiesSetupAction.test.ts": 1578,
+      "src/renderer/src/components/feature-wall/ConnectIntegrationsList.test.tsx": 658,
+      "src/renderer/src/components/feature-wall/FeatureWallSetupWorkflowActions.test.tsx": 1337,
+      "src/renderer/src/components/feature-wall/FullDiskAccessSetupPrompt.test.ts": 881,
+      "src/renderer/src/components/feature-wall/KeepAwakeCard.test.tsx": 1030,
+      "src/renderer/src/components/feature-wall/agents-orchestration/UsageAccountsCard.test.tsx": 711,
+      "src/renderer/src/components/feature-wall/browser-animated-visual-sequence.test.ts": 62,
+      "src/renderer/src/components/feature-wall/feature-wall-animation-visibility.test.tsx": 729,
+      "src/renderer/src/components/feature-wall/feature-wall-rail-navigation.test.ts": 62,
+      "src/renderer/src/components/feature-wall/feature-wall-setup-checklist-localized-copy.test.ts": 233,
+      "src/renderer/src/components/feature-wall/feature-wall-setup-progress.test.ts": 69,
+      "src/renderer/src/components/feature-wall/feature-wall-shortcut-labels.test.tsx": 2097,
+      "src/renderer/src/components/feature-wall/feature-wall-usage-tracking.test.ts": 104,
+      "src/renderer/src/components/feature-wall/use-feature-wall-completion.test.ts": 44,
+      "src/renderer/src/components/feature-wall/use-feature-wall-tour-telemetry.test.ts": 69,
+      "src/renderer/src/components/feature-wall/use-integration-connection-status.test.ts": 1530,
+      "src/renderer/src/components/feature-wall/workbench-terminal-storyboard-sequence.test.ts": 58,
+      "src/renderer/src/components/file-path-cursor-tooltip.test.ts": 428,
+      "src/renderer/src/components/floating-terminal/FloatingBrowserSlot.test.tsx": 379,
+      "src/renderer/src/components/floating-terminal/FloatingTerminalOrchestrationDialog.freshness.test.tsx": 624,
+      "src/renderer/src/components/floating-terminal/FloatingTerminalPanel.bounds.test.tsx": 740,
+      "src/renderer/src/components/floating-terminal/FloatingTerminalPanel.empty-state.test.tsx": 576,
+      "src/renderer/src/components/floating-terminal/FloatingTerminalPanel.focus.test.tsx": 1034,
+      "src/renderer/src/components/floating-terminal/FloatingTerminalPanel.markdown-editor.test.tsx": 428,
+      "src/renderer/src/components/floating-terminal/FloatingTerminalPanel.shortcuts.test.tsx": 904,
+      "src/renderer/src/components/floating-terminal/FloatingTerminalPanel.tab-lifecycle.test.tsx": 1123,
+      "src/renderer/src/components/floating-terminal/FloatingTerminalToggleButton.test.tsx": 152,
+      "src/renderer/src/components/floating-terminal/FloatingTerminalWindowControls.test.tsx": 238,
+      "src/renderer/src/components/floating-terminal/floating-terminal-panel-bounds.test.ts": 44,
+      "src/renderer/src/components/floating-terminal/floating-terminal-panel-inputs.test.ts": 102,
+      "src/renderer/src/components/floating-terminal/floating-terminal-panel-view-state.test.ts": 242,
+      "src/renderer/src/components/floating-terminal/floating-terminal-trigger-position.test.ts": 69,
+      "src/renderer/src/components/floating-terminal/floating-workspace-tab-reorder.test.ts": 1642,
+      "src/renderer/src/components/floating-terminal/terminal-pane-handle-registry.test.ts": 59,
+      "src/renderer/src/components/floating-terminal/use-floating-terminal-create-actions.test.ts": 1592,
+      "src/renderer/src/components/github-body-draft-state.test.ts": 61,
+      "src/renderer/src/components/github-checks-tab-state.test.ts": 51,
+      "src/renderer/src/components/github-enterprise-slug-routing-boundary.test.ts": 50,
+      "src/renderer/src/components/github-item-dialog-source-boundary.test.ts": 47,
+      "src/renderer/src/components/github-item-dialog/inspect-pull-request/pr-files-combined-diff-section-index.test.tsx": 647,
+      "src/renderer/src/components/github-link-copy-state.test.ts": 56,
+      "src/renderer/src/components/github-pr-merge-state.test.ts": 94,
+      "src/renderer/src/components/github-pr-reviewer-display.test.ts": 57,
+      "src/renderer/src/components/github-project/GhAuthErrorHelp.test.ts": 414,
+      "src/renderer/src/components/github-project/ProjectRoadmap.test.tsx": 2001,
+      "src/renderer/src/components/github-project/ProjectViewStates.test.tsx": 757,
+      "src/renderer/src/components/github-project/github-project-picker-filter.test.ts": 62,
+      "src/renderer/src/components/github-project/group-sort.test.ts": 40,
+      "src/renderer/src/components/github-project/project-dialog-state.test.ts": 55,
+      "src/renderer/src/components/github-project/project-picker-browse-cache.test.ts": 51,
+      "src/renderer/src/components/github-project/project-picker-input.test.ts": 918,
+      "src/renderer/src/components/github-project/project-row-filtering.test.ts": 51,
+      "src/renderer/src/components/github-project/project-view-wrapper-source-context-boundary.test.ts": 44,
+      "src/renderer/src/components/github-project/project-visible-table-cache.test.ts": 49,
+      "src/renderer/src/components/github/PRFilterPickers.test.ts": 310,
+      "src/renderer/src/components/github/github-markdown-image-url.test.ts": 33,
+      "src/renderer/src/components/github/github-mention-option-filter.test.ts": 34,
+      "src/renderer/src/components/github/github-pr-reviewer-candidate-filter.test.ts": 74,
+      "src/renderer/src/components/github/github-user-avatar.test.tsx": 560,
+      "src/renderer/src/components/github/github-work-item-assignee-filter.test.ts": 61,
+      "src/renderer/src/components/github/github-work-item-label-filter.test.ts": 42,
+      "src/renderer/src/components/github/pr-comment-code-context.test.ts": 73,
+      "src/renderer/src/components/github/pr-file-content-size.test.ts": 36,
+      "src/renderer/src/components/github/repro-8784-ghe-avatar-fallback.test.ts": 63,
+      "src/renderer/src/components/github/use-image-input.test.ts": 2130,
+      "src/renderer/src/components/hover-reveal-touch-action-visibility.test.ts": 40,
+      "src/renderer/src/components/jira-create-adf.test.ts": 61,
+      "src/renderer/src/components/jira-project-picker-filter.test.ts": 40,
+      "src/renderer/src/components/landing-preflight-dismissal.test.ts": 67,
+      "src/renderer/src/components/landing-preflight-issues.test.ts": 123,
+      "src/renderer/src/components/landing-preflight-runtime-boundary.test.ts": 1359,
+      "src/renderer/src/components/landing-preflight-unverifiable-host.test.tsx": 2022,
+      "src/renderer/src/components/linear-api-key-dialog-state.test.ts": 51,
+      "src/renderer/src/components/linear-issue-attribute-filter-coverage-agreement.test.ts": 1177,
+      "src/renderer/src/components/linear-issue-attribute-filter-dropdowns.test.tsx": 1616,
+      "src/renderer/src/components/linear-issue-attribute-filter-primary-team.test.ts": 64,
+      "src/renderer/src/components/linear-issue-attribute-filter-team-ids.test.ts": 86,
+      "src/renderer/src/components/linear-issue-project-selector.test.tsx": 766,
+      "src/renderer/src/components/linear-issue-text-draft-state.test.ts": 54,
+      "src/renderer/src/components/linear-issue-text-save-plan.test.ts": 32,
+      "src/renderer/src/components/linear-issue-view-storage.test.ts": 528,
+      "src/renderer/src/components/linear-issue-workspace-api-parity.test.ts": 27,
+      "src/renderer/src/components/linear-issue-workspace-detail-state.test.tsx": 393,
+      "src/renderer/src/components/linear-issue-workspace-header.test.ts": 50,
+      "src/renderer/src/components/linear-issue-workspace-text.test.ts": 127,
+      "src/renderer/src/components/linear-project-presentation.test.ts": 44,
+      "src/renderer/src/components/linear-project-search-query.test.ts": 50,
+      "src/renderer/src/components/linear-project-view-surfaces.test.tsx": 1038,
+      "src/renderer/src/components/linear-scope-selector.test.ts": 450,
+      "src/renderer/src/components/link-actions/LinkActionPopover.test.tsx": 804,
+      "src/renderer/src/components/maintenance/update-card/update-card-error-model.test.ts": 116,
+      "src/renderer/src/components/mobile/MobileHero.test.tsx": 2957,
+      "src/renderer/src/components/mobile/MobilePage.test.tsx": 1990,
+      "src/renderer/src/components/mobile/MobilePageToolbar.test.tsx": 606,
+      "src/renderer/src/components/mobile/NetworkInterfacePicker.test.tsx": 1041,
+      "src/renderer/src/components/mobile/WindowsFirewallNotice.test.tsx": 827,
+      "src/renderer/src/components/mobile/mobile-page-stage.test.ts": 45,
+      "src/renderer/src/components/mobile/paired-mobile-devices.test.ts": 481,
+      "src/renderer/src/components/mobile/use-mobile-page-paired-devices.test.ts": 361,
+      "src/renderer/src/components/mobile/use-mobile-pairing-address-preference.test.tsx": 623,
+      "src/renderer/src/components/native-chat-restart-action-notifications.test.ts": 113,
+      "src/renderer/src/components/native-chat-resume-activity-label.test.ts": 108,
+      "src/renderer/src/components/native-chat-resume-failed-chat-watch.test.ts": 1229,
+      "src/renderer/src/components/native-chat-resume-failure-guidance.test.ts": 84,
+      "src/renderer/src/components/native-chat-resume-on-restart-grouping.test.ts": 56,
+      "src/renderer/src/components/native-chat/NativeChatApprovalCard.test.tsx": 1564,
+      "src/renderer/src/components/native-chat/NativeChatAutocompleteMenus.test.tsx": 872,
+      "src/renderer/src/components/native-chat/NativeChatBackgroundTaskRun.test.tsx": 990,
+      "src/renderer/src/components/native-chat/NativeChatBackgroundTasksStatus.test.tsx": 1274,
+      "src/renderer/src/components/native-chat/NativeChatCodeBlock.test.tsx": 874,
+      "src/renderer/src/components/native-chat/NativeChatComposer.test.tsx": 1457,
+      "src/renderer/src/components/native-chat/NativeChatComposerActions.test.tsx": 565,
+      "src/renderer/src/components/native-chat/NativeChatContextUsageRing.test.tsx": 750,
+      "src/renderer/src/components/native-chat/NativeChatImageAttachmentPreview.test.tsx": 688,
+      "src/renderer/src/components/native-chat/NativeChatInteractiveCard.test.tsx": 986,
+      "src/renderer/src/components/native-chat/NativeChatMessageList.growth-windowing.test.tsx": 3718,
+      "src/renderer/src/components/native-chat/NativeChatMessageList.message-rail-windowing.test.tsx": 4072,
+      "src/renderer/src/components/native-chat/NativeChatMessageList.older-history.test.tsx": 4416,
+      "src/renderer/src/components/native-chat/NativeChatMessageList.provider-frame.test.tsx": 2482,
+      "src/renderer/src/components/native-chat/NativeChatMessageList.rail-history-jump.test.tsx": 11804,
+      "src/renderer/src/components/native-chat/NativeChatMessageList.stream-render.perf.test.tsx": 3611,
+      "src/renderer/src/components/native-chat/NativeChatMessageList.task-list-frames.test.tsx": 3017,
+      "src/renderer/src/components/native-chat/NativeChatMessageList.test.tsx": 3343,
+      "src/renderer/src/components/native-chat/NativeChatMessageList.tool-stream-cost.test.tsx": 4901,
+      "src/renderer/src/components/native-chat/NativeChatMessageList.turn-fold.test.tsx": 2633,
+      "src/renderer/src/components/native-chat/NativeChatMessageList.turn-history.test.tsx": 2349,
+      "src/renderer/src/components/native-chat/NativeChatMessageList.turn-indicator.test.tsx": 3391,
+      "src/renderer/src/components/native-chat/NativeChatMessageList.turn-timing.test.tsx": 1597,
+      "src/renderer/src/components/native-chat/NativeChatMessageList.windowing.test.tsx": 5207,
+      "src/renderer/src/components/native-chat/NativeChatMessageRail.test.tsx": 1294,
+      "src/renderer/src/components/native-chat/NativeChatMessageRow.test.tsx": 2046,
+      "src/renderer/src/components/native-chat/NativeChatMessageTimestamp.test.tsx": 752,
+      "src/renderer/src/components/native-chat/NativeChatNoticeRow.test.tsx": 2656,
+      "src/renderer/src/components/native-chat/NativeChatPromptEditor.test.tsx": 1266,
+      "src/renderer/src/components/native-chat/NativeChatQuestionCard.test.tsx": 947,
+      "src/renderer/src/components/native-chat/NativeChatResolutionReceipt.test.tsx": 1217,
+      "src/renderer/src/components/native-chat/NativeChatSessionOptionPickers.test.tsx": 950,
+      "src/renderer/src/components/native-chat/NativeChatStructuredSession.goal-dock.test.tsx": 2046,
+      "src/renderer/src/components/native-chat/NativeChatStructuredSession.launch-lifecycle.test.tsx": 2769,
+      "src/renderer/src/components/native-chat/NativeChatStructuredSession.test.tsx": 1475,
+      "src/renderer/src/components/native-chat/NativeChatStructuredSession.transport-probe.test.tsx": 16705,
+      "src/renderer/src/components/native-chat/NativeChatStructuredSessionDelivery.test.tsx": 17563,
+      "src/renderer/src/components/native-chat/NativeChatStructuredSessionStatus.test.tsx": 979,
+      "src/renderer/src/components/native-chat/NativeChatSubagentRun.test.tsx": 1078,
+      "src/renderer/src/components/native-chat/NativeChatTaskList.test.tsx": 1027,
+      "src/renderer/src/components/native-chat/NativeChatThreadGoalBanner.test.tsx": 1215,
+      "src/renderer/src/components/native-chat/NativeChatToolRun.ask-row.test.tsx": 868,
+      "src/renderer/src/components/native-chat/NativeChatToolRun.identity.test.tsx": 898,
+      "src/renderer/src/components/native-chat/NativeChatToolRun.test.tsx": 967,
+      "src/renderer/src/components/native-chat/NativeChatTranscriptChrome.test.tsx": 1191,
+      "src/renderer/src/components/native-chat/NativeChatView.test.tsx": 586,
+      "src/renderer/src/components/native-chat/StructuredAgentSessionAttentionBridge.test.tsx": 1682,
+      "src/renderer/src/components/native-chat/StructuredAgentSessionPaneOverlayLayer.test.tsx": 419,
+      "src/renderer/src/components/native-chat/StructuredAgentSessionStatusBridge.test.tsx": 5346,
+      "src/renderer/src/components/native-chat/background-task-roster.test.ts": 98,
+      "src/renderer/src/components/native-chat/claude-model-switch-confirmation.test.ts": 1924,
+      "src/renderer/src/components/native-chat/claude-terminal-session-options.test.ts": 124,
+      "src/renderer/src/components/native-chat/native-chat-active-rail-item.test.ts": 45,
+      "src/renderer/src/components/native-chat/native-chat-assembler-merge-parity.test.ts": 95,
+      "src/renderer/src/components/native-chat/native-chat-attachment-upload.test.ts": 1516,
+      "src/renderer/src/components/native-chat/native-chat-autoscroll.test.ts": 33,
+      "src/renderer/src/components/native-chat/native-chat-availability.test.ts": 39,
+      "src/renderer/src/components/native-chat/native-chat-composer-autogrow.test.tsx": 2042,
+      "src/renderer/src/components/native-chat/native-chat-composer-composition.test.tsx": 2490,
+      "src/renderer/src/components/native-chat/native-chat-composer-containment.test.ts": 38,
+      "src/renderer/src/components/native-chat/native-chat-composer-drop-scope.test.tsx": 1320,
+      "src/renderer/src/components/native-chat/native-chat-composer-reveal-focus.test.tsx": 622,
+      "src/renderer/src/components/native-chat/native-chat-composer-scope-cache.test.ts": 47,
+      "src/renderer/src/components/native-chat/native-chat-composer-state.test.ts": 98,
+      "src/renderer/src/components/native-chat/native-chat-composer-workspace-file-drop.test.tsx": 1742,
+      "src/renderer/src/components/native-chat/native-chat-context-usage-summary.test.ts": 54,
+      "src/renderer/src/components/native-chat/native-chat-diff.test.ts": 53,
+      "src/renderer/src/components/native-chat/native-chat-dismiss-key.test.ts": 56,
+      "src/renderer/src/components/native-chat/native-chat-draft-cache.test.ts": 53,
+      "src/renderer/src/components/native-chat/native-chat-file-link.test.ts": 161,
+      "src/renderer/src/components/native-chat/native-chat-font-scale.test.ts": 60,
+      "src/renderer/src/components/native-chat/native-chat-http-link-source-owner.test.ts": 69,
+      "src/renderer/src/components/native-chat/native-chat-image-paste.test.ts": 40,
+      "src/renderer/src/components/native-chat/native-chat-image-runtime-context.test.ts": 1250,
+      "src/renderer/src/components/native-chat/native-chat-incremental-assembler.test.ts": 96,
+      "src/renderer/src/components/native-chat/native-chat-interactive-prompt.test.ts": 148,
+      "src/renderer/src/components/native-chat/native-chat-launch-default-adoption.test.ts": 117,
+      "src/renderer/src/components/native-chat/native-chat-launch-draft-resolution.test.ts": 52,
+      "src/renderer/src/components/native-chat/native-chat-launch-draft-send.test.ts": 75,
+      "src/renderer/src/components/native-chat/native-chat-launch-session-options.test.ts": 74,
+      "src/renderer/src/components/native-chat/native-chat-layout-actions.test.ts": 1739,
+      "src/renderer/src/components/native-chat/native-chat-leaf-routing.test.ts": 44,
+      "src/renderer/src/components/native-chat/native-chat-live-status.test.ts": 83,
+      "src/renderer/src/components/native-chat/native-chat-message-grouping.test.ts": 73,
+      "src/renderer/src/components/native-chat/native-chat-message-list-projection.test.ts": 83,
+      "src/renderer/src/components/native-chat/native-chat-message-rail-items.test.ts": 102,
+      "src/renderer/src/components/native-chat/native-chat-noise.test.ts": 32,
+      "src/renderer/src/components/native-chat/native-chat-pagination.test.ts": 62,
+      "src/renderer/src/components/native-chat/native-chat-pane-file-drop.test.tsx": 558,
+      "src/renderer/src/components/native-chat/native-chat-pane-resolution.test.ts": 48,
+      "src/renderer/src/components/native-chat/native-chat-pending-occurrence.test.ts": 66,
+      "src/renderer/src/components/native-chat/native-chat-pending.test.ts": 86,
+      "src/renderer/src/components/native-chat/native-chat-pinned-rows.test.ts": 34,
+      "src/renderer/src/components/native-chat/native-chat-preassembled-session-parity.test.ts": 189,
+      "src/renderer/src/components/native-chat/native-chat-pty-retired-model.test.ts": 157,
+      "src/renderer/src/components/native-chat/native-chat-pty-session-options.test.ts": 375,
+      "src/renderer/src/components/native-chat/native-chat-rail-outline-parity.test.ts": 110,
+      "src/renderer/src/components/native-chat/native-chat-resolved-path-ownership.test.ts": 57,
+      "src/renderer/src/components/native-chat/native-chat-retire-persisted-model.test.ts": 455,
+      "src/renderer/src/components/native-chat/native-chat-row-height-estimate.test.ts": 39,
+      "src/renderer/src/components/native-chat/native-chat-runtime-owner.test.ts": 231,
+      "src/renderer/src/components/native-chat/native-chat-runtime-send-launch-draft.test.ts": 1274,
+      "src/renderer/src/components/native-chat/native-chat-runtime-send.test.ts": 306,
+      "src/renderer/src/components/native-chat/native-chat-scrape-fallback.test.ts": 69,
+      "src/renderer/src/components/native-chat/native-chat-send-eligibility.test.ts": 50,
+      "src/renderer/src/components/native-chat/native-chat-send.test.ts": 52,
+      "src/renderer/src/components/native-chat/native-chat-session-assembler.test.ts": 107,
+      "src/renderer/src/components/native-chat/native-chat-session-option-enrichment.test.ts": 1585,
+      "src/renderer/src/components/native-chat/native-chat-session-option-labels.test.ts": 55,
+      "src/renderer/src/components/native-chat/native-chat-session-transport.test.ts": 88,
+      "src/renderer/src/components/native-chat/native-chat-shared-copy-matches-catalog.test.ts": 411,
+      "src/renderer/src/components/native-chat/native-chat-shortcut.test.ts": 44,
+      "src/renderer/src/components/native-chat/native-chat-split-shortcut.test.ts": 68,
+      "src/renderer/src/components/native-chat/native-chat-stop-layering.test.ts": 31,
+      "src/renderer/src/components/native-chat/native-chat-structured-send-composition-clear.test.tsx": 1959,
+      "src/renderer/src/components/native-chat/native-chat-tab-agent-entry.test.ts": 31,
+      "src/renderer/src/components/native-chat/native-chat-task-list-history.test.ts": 57,
+      "src/renderer/src/components/native-chat/native-chat-task-list-state.test.ts": 45,
+      "src/renderer/src/components/native-chat/native-chat-thread-goal-rows.test.ts": 56,
+      "src/renderer/src/components/native-chat/native-chat-tool-fold.test.ts": 69,
+      "src/renderer/src/components/native-chat/native-chat-tool-summary.test.ts": 58,
+      "src/renderer/src/components/native-chat/native-chat-transcript-slots.test.ts": 76,
+      "src/renderer/src/components/native-chat/native-chat-turn-diffs.test.ts": 99,
+      "src/renderer/src/components/native-chat/native-chat-typing-indicator.test.ts": 91,
+      "src/renderer/src/components/native-chat/native-chat-typing-redirect.test.ts": 66,
+      "src/renderer/src/components/native-chat/native-chat-view-file-drop.test.tsx": 806,
+      "src/renderer/src/components/native-chat/native-chat-view-state.test.ts": 57,
+      "src/renderer/src/components/native-chat/native-chat-web-link-actions.test.ts": 135,
+      "src/renderer/src/components/native-chat/native-chat-working-status-shared-clock.test.tsx": 680,
+      "src/renderer/src/components/native-chat/native-chat-working-suppression.test.ts": 53,
+      "src/renderer/src/components/native-chat/omp-model-switch-capability.test.ts": 84,
+      "src/renderer/src/components/native-chat/serialized-screen-background-rows.test.ts": 134,
+      "src/renderer/src/components/native-chat/structured-agent-question-projection.test.ts": 97,
+      "src/renderer/src/components/native-chat/structured-agent-session-message-projection.test.ts": 77,
+      "src/renderer/src/components/native-chat/structured-agent-session-outbox-storage.test.ts": 437,
+      "src/renderer/src/components/native-chat/structured-agent-session-rail-outline.test.ts": 36,
+      "src/renderer/src/components/native-chat/structured-agent-session-read-transport.test.ts": 246,
+      "src/renderer/src/components/native-chat/structured-agent-session-status-bridge-clock.test.tsx": 2216,
+      "src/renderer/src/components/native-chat/structured-attention-dispatch.test.ts": 1416,
+      "src/renderer/src/components/native-chat/structured-attention-surface.test.ts": 994,
+      "src/renderer/src/components/native-chat/structured-session-takeover-report.test.tsx": 697,
+      "src/renderer/src/components/native-chat/use-native-chat-composer-app-menu-selection.test.tsx": 528,
+      "src/renderer/src/components/native-chat/use-native-chat-composer-attachments.test.tsx": 718,
+      "src/renderer/src/components/native-chat/use-native-chat-composer-catalog.test.tsx": 631,
+      "src/renderer/src/components/native-chat/use-native-chat-composer-keydown.test.tsx": 580,
+      "src/renderer/src/components/native-chat/use-native-chat-composer-paste.test.tsx": 564,
+      "src/renderer/src/components/native-chat/use-native-chat-composer-submit.test.tsx": 708,
+      "src/renderer/src/components/native-chat/use-native-chat-context-menu.test.tsx": 493,
+      "src/renderer/src/components/native-chat/use-native-chat-external-attachments.test.tsx": 578,
+      "src/renderer/src/components/native-chat/use-native-chat-file-link-click.test.tsx": 1460,
+      "src/renderer/src/components/native-chat/use-native-chat-hook-status.test.ts": 1638,
+      "src/renderer/src/components/native-chat/use-native-chat-interactive-send.test.tsx": 620,
+      "src/renderer/src/components/native-chat/use-native-chat-launch-draft-adoption.test.tsx": 567,
+      "src/renderer/src/components/native-chat/use-native-chat-link-actions.test.tsx": 1582,
+      "src/renderer/src/components/native-chat/use-native-chat-live-session-pending.test.ts": 1421,
+      "src/renderer/src/components/native-chat/use-native-chat-live-session-visibility.test.ts": 2357,
+      "src/renderer/src/components/native-chat/use-native-chat-live-session.test.ts": 5417,
+      "src/renderer/src/components/native-chat/use-native-chat-message-rail.test.ts": 790,
+      "src/renderer/src/components/native-chat/use-native-chat-picker-command-dispatch.test.tsx": 2127,
+      "src/renderer/src/components/native-chat/use-native-chat-provisional-launch.test.tsx": 1713,
+      "src/renderer/src/components/native-chat/use-native-chat-rail-history-jump.test.ts": 665,
+      "src/renderer/src/components/native-chat/use-native-chat-retained-session.test.ts": 563,
+      "src/renderer/src/components/native-chat/use-native-chat-send-lifecycle.test.tsx": 346,
+      "src/renderer/src/components/native-chat/use-native-chat-session-option-command.test.tsx": 2103,
+      "src/renderer/src/components/native-chat/use-native-chat-session-options.test.ts": 792,
+      "src/renderer/src/components/native-chat/use-native-chat-skills.react.test.tsx": 862,
+      "src/renderer/src/components/native-chat/use-native-chat-skills.test.ts": 835,
+      "src/renderer/src/components/native-chat/use-native-chat-structured-composer-send.test.tsx": 746,
+      "src/renderer/src/components/native-chat/use-native-chat-toggle-shortcut.test.ts": 1599,
+      "src/renderer/src/components/native-chat/use-native-chat-transcript-scroll.test.tsx": 556,
+      "src/renderer/src/components/native-chat/use-native-chat-transcript-window.options.test.tsx": 660,
+      "src/renderer/src/components/native-chat/use-structured-agent-session-context-usage.test.tsx": 2782,
+      "src/renderer/src/components/native-chat/use-structured-agent-session-hold.test.tsx": 935,
+      "src/renderer/src/components/native-chat/use-structured-agent-session-messages.test.tsx": 448,
+      "src/renderer/src/components/native-chat/use-structured-agent-session-options.test.tsx": 1272,
+      "src/renderer/src/components/native-chat/use-structured-agent-session-outbox-admission.test.tsx": 1393,
+      "src/renderer/src/components/native-chat/use-structured-agent-session-outbox-rejection-cause.test.tsx": 608,
+      "src/renderer/src/components/native-chat/use-structured-agent-session-outbox.test.tsx": 1632,
+      "src/renderer/src/components/native-chat/use-structured-agent-session-prompt-cancel.test.tsx": 2498,
+      "src/renderer/src/components/native-chat/use-structured-agent-session-prompt-state.test.tsx": 2251,
+      "src/renderer/src/components/native-chat/use-structured-agent-session-provisional.test.tsx": 2510,
+      "src/renderer/src/components/native-chat/use-structured-agent-session-question-answers.test.tsx": 2546,
+      "src/renderer/src/components/native-chat/use-structured-agent-session-rail-outline.test.tsx": 707,
+      "src/renderer/src/components/native-chat/use-structured-agent-session-read.test.tsx": 1321,
+      "src/renderer/src/components/native-chat/use-structured-agent-session-thread-goal.test.tsx": 570,
+      "src/renderer/src/components/native-chat/use-structured-agent-session-transport.test.tsx": 605,
+      "src/renderer/src/components/native-chat/use-structured-agent-session.test.tsx": 2591,
+      "src/renderer/src/components/native-chat/use-structured-agent-turn-timing.test.tsx": 481,
+      "src/renderer/src/components/network/CustomAddressDialog.test.tsx": 584,
+      "src/renderer/src/components/new-workspace/ComposerParentWorktreePicker.test.tsx": 1181,
+      "src/renderer/src/components/new-workspace/ProjectCombobox.dialog-handoff.test.tsx": 936,
+      "src/renderer/src/components/new-workspace/ProjectCombobox.test.tsx": 1046,
+      "src/renderer/src/components/new-workspace/ProjectComboboxRow.test.tsx": 407,
+      "src/renderer/src/components/new-workspace/SetProjectLocationDialog.test.tsx": 1539,
+      "src/renderer/src/components/new-workspace/SmartWorkspaceNameField-provider-boundaries.test.ts": 1258,
+      "src/renderer/src/components/new-workspace/SmartWorkspaceNameField-repo-slug-routing.test.ts": 1446,
+      "src/renderer/src/components/new-workspace/SmartWorkspaceNameField-source-boundaries.test.ts": 42,
+      "src/renderer/src/components/new-workspace/SmartWorkspaceNameField.ime-enter.test.tsx": 1142,
+      "src/renderer/src/components/new-workspace/SmartWorkspaceNameField.jira-accessibility.test.tsx": 1292,
+      "src/renderer/src/components/new-workspace/base-ref-picker-visibility.test.ts": 49,
+      "src/renderer/src/components/new-workspace/project-combobox-matching.test.ts": 89,
+      "src/renderer/src/components/new-workspace/smart-workspace-command-value.test.ts": 33,
+      "src/renderer/src/components/new-workspace/smart-workspace-localized-options.test.ts": 247,
+      "src/renderer/src/components/new-workspace/smart-workspace-source-popover-focus.test.ts": 503,
+      "src/renderer/src/components/new-workspace/smart-workspace-source-results.test.ts": 116,
+      "src/renderer/src/components/new-workspace/use-jira-source-connection.test.tsx": 629,
+      "src/renderer/src/components/new-workspace/use-jira-url-source.test.tsx": 454,
+      "src/renderer/src/components/new-workspace/use-recent-project-ids.test.ts": 966,
+      "src/renderer/src/components/onboarding/AgentStep.test.tsx": 408,
+      "src/renderer/src/components/onboarding/FeatureSetupInlineTerminal.test.tsx": 1399,
+      "src/renderer/src/components/onboarding/NotificationStep.test.tsx": 1357,
+      "src/renderer/src/components/onboarding/OnboardingFlow.test.tsx": 5689,
+      "src/renderer/src/components/onboarding/OnboardingInlineCommandTerminal.command-finished.test.tsx": 579,
+      "src/renderer/src/components/onboarding/OnboardingInlineCommandTerminal.test.ts": 2643,
+      "src/renderer/src/components/onboarding/ThemeStep.test.ts": 271,
+      "src/renderer/src/components/onboarding/WindowsTerminalStep.test.tsx": 673,
+      "src/renderer/src/components/onboarding/agent-picked-payload.test.ts": 55,
+      "src/renderer/src/components/onboarding/onboarding-dismiss-target.test.ts": 37,
+      "src/renderer/src/components/onboarding/onboarding-feature-setup.test.ts": 1585,
+      "src/renderer/src/components/onboarding/onboarding-folder-agent-startup.test.ts": 281,
+      "src/renderer/src/components/onboarding/onboarding-settings-hydration.test.ts": 65,
+      "src/renderer/src/components/onboarding/use-onboarding-flow-persistence.test.ts": 1229,
+      "src/renderer/src/components/onboarding/use-onboarding-flow.test.ts": 284,
+      "src/renderer/src/components/onboarding/windows-terminal-onboarding-telemetry.test.ts": 37,
+      "src/renderer/src/components/orca-profiles/OrcaProfileSignOutConfirmDialog.test.tsx": 515,
+      "src/renderer/src/components/pet/PetOverlay.frame-durations.test.tsx": 430,
+      "src/renderer/src/components/pet/PetOverlay.keyframes.test.tsx": 447,
+      "src/renderer/src/components/pet/PetOverlay.pet-switch.test.tsx": 622,
+      "src/renderer/src/components/pet/PetOverlay.pointer-interaction.test.tsx": 654,
+      "src/renderer/src/components/pet/PetOverlay.test.ts": 1580,
+      "src/renderer/src/components/pet/pet-agent-state.test.ts": 55,
+      "src/renderer/src/components/pet/pet-blob-cache.test.ts": 65,
+      "src/renderer/src/components/pet/pet-overlay-hit-area.test.tsx": 743,
+      "src/renderer/src/components/pet/pet-overlay-position.test.ts": 1053,
+      "src/renderer/src/components/pet/pet-overlay-visibility.test.ts": 39,
+      "src/renderer/src/components/pet/sprite-animation-css.test.ts": 38,
+      "src/renderer/src/components/pet/usePetPointerInteraction.test.ts": 328,
+      "src/renderer/src/components/pet/usePetUrl.test.tsx": 651,
+      "src/renderer/src/components/ports/WorkspacePortScanner.test.tsx": 3020,
+      "src/renderer/src/components/pr-check-counts.test.ts": 107,
+      "src/renderer/src/components/pr-checks-fix-prompt.test.ts": 56,
+      "src/renderer/src/components/pr-comments-resolution-prompt.test.ts": 40,
+      "src/renderer/src/components/provider-check-classification-parity.test.ts": 112,
+      "src/renderer/src/components/pull-request-page-host-boundary.test.ts": 60,
+      "src/renderer/src/components/pull-request-page/cache/file-content.test.ts": 61,
+      "src/renderer/src/components/pull-request-page/files/combined-diff-section-index.test.tsx": 898,
+      "src/renderer/src/components/pull-request-page/mentions/options.test.ts": 53,
+      "src/renderer/src/components/pull-request-page/mentions/query.test.ts": 46,
+      "src/renderer/src/components/pull-request-page/presentation/state-badge.test.ts": 241,
+      "src/renderer/src/components/quick-open-file-list-host-name-filter.react.test.tsx": 2090,
+      "src/renderer/src/components/quick-open-file-list.react.test.tsx": 1637,
+      "src/renderer/src/components/quick-open-file-list.test.ts": 1005,
+      "src/renderer/src/components/quick-open-install-rg-guidance.render.test.tsx": 799,
+      "src/renderer/src/components/quick-open-install-rg-guidance.test.ts": 254,
+      "src/renderer/src/components/quick-open-search.test.ts": 259,
+      "src/renderer/src/components/repo/CreateFromPicker.test.tsx": 1041,
+      "src/renderer/src/components/repo/NestedRepoChecklist.test.tsx": 274,
+      "src/renderer/src/components/repo/NestedRepoScanLimitNotice.test.ts": 414,
+      "src/renderer/src/components/repo/repo-icon.emoji-centering.test.tsx": 469,
+      "src/renderer/src/components/repo/repo-icon.test.tsx": 554,
+      "src/renderer/src/components/right-sidebar/ActionButton.test.tsx": 3109,
+      "src/renderer/src/components/right-sidebar/AiVaultPanel.legacy-filter.test.tsx": 3107,
+      "src/renderer/src/components/right-sidebar/AiVaultPanelHeader.focus.test.tsx": 837,
+      "src/renderer/src/components/right-sidebar/AiVaultPanelSearch.test.tsx": 1050,
+      "src/renderer/src/components/right-sidebar/AiVaultSearchEvidence.test.tsx": 2126,
+      "src/renderer/src/components/right-sidebar/AiVaultSessionListBar.test.tsx": 1195,
+      "src/renderer/src/components/right-sidebar/AiVaultSessionRow.test.tsx": 1968,
+      "src/renderer/src/components/right-sidebar/AiVaultSessionSubagents.test.tsx": 2633,
+      "src/renderer/src/components/right-sidebar/AiVaultShowMoreSessionsRow.test.tsx": 851,
+      "src/renderer/src/components/right-sidebar/AiVaultVirtualRow.test.tsx": 2132,
+      "src/renderer/src/components/right-sidebar/ChecksPanel.review-header.test.tsx": 2283,
+      "src/renderer/src/components/right-sidebar/ChecksPanel.updated-at-metadata.test.tsx": 566,
+      "src/renderer/src/components/right-sidebar/CommitArea.chevron-spinner.test.tsx": 2283,
+      "src/renderer/src/components/right-sidebar/CommitArea.generate.test.tsx": 2862,
+      "src/renderer/src/components/right-sidebar/CommitArea.primary-icons.test.tsx": 3772,
+      "src/renderer/src/components/right-sidebar/CommitArea.test.tsx": 9563,
+      "src/renderer/src/components/right-sidebar/FileExplorerNameFilter.test.tsx": 442,
+      "src/renderer/src/components/right-sidebar/FileExplorerRow.actions.test.tsx": 251,
+      "src/renderer/src/components/right-sidebar/FileExplorerToolbar.test.tsx": 1137,
+      "src/renderer/src/components/right-sidebar/FileExplorerViewSwitch.test.tsx": 286,
+      "src/renderer/src/components/right-sidebar/FileExplorerVirtualRows.row-handlers.test.tsx": 1865,
+      "src/renderer/src/components/right-sidebar/FileExplorerVirtualRowsAddProject.test.tsx": 1859,
+      "src/renderer/src/components/right-sidebar/FolderWorkspacePrChecksPanel.test.tsx": 756,
+      "src/renderer/src/components/right-sidebar/FolderWorkspacePrChecksRow.test.tsx": 540,
+      "src/renderer/src/components/right-sidebar/FolderWorkspaceWorktreesPanel.test.tsx": 713,
+      "src/renderer/src/components/right-sidebar/GitHistoryPanel.test.tsx": 1252,
+      "src/renderer/src/components/right-sidebar/GitHubPRStackMap.test.tsx": 916,
+      "src/renderer/src/components/right-sidebar/HostedReviewActions.draft.test.tsx": 922,
+      "src/renderer/src/components/right-sidebar/PluginPanel.test.tsx": 883,
+      "src/renderer/src/components/right-sidebar/PortsPanel.test.tsx": 2949,
+      "src/renderer/src/components/right-sidebar/PullRequestComposer.generate-tooltip.test.tsx": 1959,
+      "src/renderer/src/components/right-sidebar/SearchResultItems.test.tsx": 526,
+      "src/renderer/src/components/right-sidebar/SessionRowTrailingActions.test.tsx": 565,
+      "src/renderer/src/components/right-sidebar/SourceControl.branch-line-total.test.tsx": 1480,
+      "src/renderer/src/components/right-sidebar/SourceControl.commit-drafts.test.ts": 3776,
+      "src/renderer/src/components/right-sidebar/SourceControl.commit-failure-recovery.test.ts": 48,
+      "src/renderer/src/components/right-sidebar/SourceControl.commit-generation-records.test.ts": 47,
+      "src/renderer/src/components/right-sidebar/SourceControl.compare-summary.test.ts": 3689,
+      "src/renderer/src/components/right-sidebar/SourceControl.host-context-boundary.test.ts": 24,
+      "src/renderer/src/components/right-sidebar/SourceControl.hosted-review-header-link.test.tsx": 134,
+      "src/renderer/src/components/right-sidebar/SourceControl.open-file-highlight.test.tsx": 4632,
+      "src/renderer/src/components/right-sidebar/SourceControl.pr-generation-records.test.ts": 56,
+      "src/renderer/src/components/right-sidebar/SourceControl.preview-open.test.tsx": 4125,
+      "src/renderer/src/components/right-sidebar/SourceControl.push-failure-recovery.test.ts": 53,
+      "src/renderer/src/components/right-sidebar/SourceControl.remote-action-errors.test.ts": 2135,
+      "src/renderer/src/components/right-sidebar/SourceControl.resolve-conflicts-prompt.test.ts": 2081,
+      "src/renderer/src/components/right-sidebar/SourceControl.virtual-file-list.test.tsx": 3225,
+      "src/renderer/src/components/right-sidebar/SourceControlAgentActionDialog.test.tsx": 2339,
+      "src/renderer/src/components/right-sidebar/SourceControlAgentActionDialogForm.test.tsx": 361,
+      "src/renderer/src/components/right-sidebar/SourceControlTextGenerationDialog.test.ts": 551,
+      "src/renderer/src/components/right-sidebar/active-checks-status.test.ts": 1236,
+      "src/renderer/src/components/right-sidebar/activity-bar-buttons.test.tsx": 599,
+      "src/renderer/src/components/right-sidebar/activity-bar-overflow.test.ts": 49,
+      "src/renderer/src/components/right-sidebar/ai-vault-first-prompt-card.test.tsx": 997,
+      "src/renderer/src/components/right-sidebar/ai-vault-host-scope.test.ts": 531,
+      "src/renderer/src/components/right-sidebar/ai-vault-original-pane-index.test.ts": 67,
+      "src/renderer/src/components/right-sidebar/ai-vault-original-pane.test.ts": 49,
+      "src/renderer/src/components/right-sidebar/ai-vault-scan-issue-state.test.ts": 29,
+      "src/renderer/src/components/right-sidebar/ai-vault-scope-paths.test.ts": 47,
+      "src/renderer/src/components/right-sidebar/ai-vault-scope-state.test.ts": 43,
+      "src/renderer/src/components/right-sidebar/ai-vault-search-scope-identity.test.tsx": 731,
+      "src/renderer/src/components/right-sidebar/ai-vault-search-session.test.ts": 142,
+      "src/renderer/src/components/right-sidebar/ai-vault-session-continuation.test.ts": 38,
+      "src/renderer/src/components/right-sidebar/ai-vault-session-deletability.test.ts": 127,
+      "src/renderer/src/components/right-sidebar/ai-vault-session-display.test.ts": 58,
+      "src/renderer/src/components/right-sidebar/ai-vault-session-filters.test.ts": 64,
+      "src/renderer/src/components/right-sidebar/ai-vault-session-identity.test.ts": 42,
+      "src/renderer/src/components/right-sidebar/ai-vault-session-log-open.test.ts": 81,
+      "src/renderer/src/components/right-sidebar/ai-vault-session-path-actions.test.ts": 52,
+      "src/renderer/src/components/right-sidebar/ai-vault-session-projects.test.ts": 112,
+      "src/renderer/src/components/right-sidebar/ai-vault-session-publication-gate.test.ts": 531,
+      "src/renderer/src/components/right-sidebar/ai-vault-session-refresh.test.ts": 5506,
+      "src/renderer/src/components/right-sidebar/ai-vault-session-resume-in-chat-launch.test.ts": 575,
+      "src/renderer/src/components/right-sidebar/ai-vault-session-resume-in-chat.test.ts": 66,
+      "src/renderer/src/components/right-sidebar/ai-vault-session-resume.test.ts": 169,
+      "src/renderer/src/components/right-sidebar/ai-vault-session-worktree-map.test.tsx": 705,
+      "src/renderer/src/components/right-sidebar/ai-vault-session-worktree.test.ts": 95,
+      "src/renderer/src/components/right-sidebar/ai-vault-view-defaults.test.ts": 45,
+      "src/renderer/src/components/right-sidebar/ai-vault-view-options-persistence.test.ts": 49,
+      "src/renderer/src/components/right-sidebar/branch-line-total-request-gate.test.ts": 48,
+      "src/renderer/src/components/right-sidebar/check-details-resize.test.ts": 30,
+      "src/renderer/src/components/right-sidebar/checks-entry-refresh.test.ts": 58,
+      "src/renderer/src/components/right-sidebar/checks-list-expanded-details.test.tsx": 1439,
+      "src/renderer/src/components/right-sidebar/checks-panel-async-result-key.test.ts": 46,
+      "src/renderer/src/components/right-sidebar/checks-panel-content.test.tsx": 1497,
+      "src/renderer/src/components/right-sidebar/checks-panel-empty-state.test.ts": 113,
+      "src/renderer/src/components/right-sidebar/checks-panel-git-status-snapshot.test.ts": 59,
+      "src/renderer/src/components/right-sidebar/checks-panel-hosted-review-click-routing.test.ts": 65,
+      "src/renderer/src/components/right-sidebar/checks-panel-pr-refresh-breadcrumb.test.ts": 51,
+      "src/renderer/src/components/right-sidebar/checks-panel-pr-refresh-request.test.ts": 31,
+      "src/renderer/src/components/right-sidebar/checks-panel-review-creation.test.ts": 85,
+      "src/renderer/src/components/right-sidebar/checks-panel-review-lookup-authority.test.ts": 52,
+      "src/renderer/src/components/right-sidebar/checks-panel-review.test.ts": 44,
+      "src/renderer/src/components/right-sidebar/checks-panel-terminal-worktree.test.ts": 79,
+      "src/renderer/src/components/right-sidebar/checks-panel/gitlab-review-client.test.ts": 40,
+      "src/renderer/src/components/right-sidebar/checks-panel/panel-content-rendering.test.tsx": 4868,
+      "src/renderer/src/components/right-sidebar/checks-panel/use-checks-panel-check-and-review-actions.test.tsx": 2604,
+      "src/renderer/src/components/right-sidebar/checks-panel/use-checks-panel-create-review.test.tsx": 597,
+      "src/renderer/src/components/right-sidebar/checks-panel/use-checks-panel-generation.test.tsx": 2098,
+      "src/renderer/src/components/right-sidebar/checks-panel/use-checks-panel-git-status-effects.test.tsx": 471,
+      "src/renderer/src/components/right-sidebar/checks-panel/use-checks-panel-manual-refresh.test.tsx": 2233,
+      "src/renderer/src/components/right-sidebar/checks-panel/use-checks-panel-polling.test.tsx": 678,
+      "src/renderer/src/components/right-sidebar/coalesced-poll-runner.test.ts": 69,
+      "src/renderer/src/components/right-sidebar/commit-failure-dialog-state.test.ts": 40,
+      "src/renderer/src/components/right-sidebar/commit-failure-summary.test.ts": 43,
+      "src/renderer/src/components/right-sidebar/create-review-draft-title.test.ts": 38,
+      "src/renderer/src/components/right-sidebar/diff-comments-clear-dialog-state.test.ts": 37,
+      "src/renderer/src/components/right-sidebar/discard-all-sequence.test.ts": 66,
+      "src/renderer/src/components/right-sidebar/file-explorer-add-project-action.test.ts": 41,
+      "src/renderer/src/components/right-sidebar/file-explorer-batch-deletion.test.ts": 147,
+      "src/renderer/src/components/right-sidebar/file-explorer-dir-load-tracker.test.ts": 40,
+      "src/renderer/src/components/right-sidebar/file-explorer-dir-toggle-timing.test.ts": 239,
+      "src/renderer/src/components/right-sidebar/file-explorer-directory-listing.test.ts": 87,
+      "src/renderer/src/components/right-sidebar/file-explorer-drag-scroll-marker.test.tsx": 2626,
+      "src/renderer/src/components/right-sidebar/file-explorer-entries.test.ts": 29,
+      "src/renderer/src/components/right-sidebar/file-explorer-expanded-dirs-refresh.test.ts": 1574,
+      "src/renderer/src/components/right-sidebar/file-explorer-inline-input-outside-click.test.tsx": 842,
+      "src/renderer/src/components/right-sidebar/file-explorer-inline-rename-flow.test.tsx": 646,
+      "src/renderer/src/components/right-sidebar/file-explorer-instant-dir-toggle.test.ts": 677,
+      "src/renderer/src/components/right-sidebar/file-explorer-keyboard-navigation.test.ts": 66,
+      "src/renderer/src/components/right-sidebar/file-explorer-name-filter-projection.test.ts": 51,
+      "src/renderer/src/components/right-sidebar/file-explorer-operation-generation.test.ts": 1352,
+      "src/renderer/src/components/right-sidebar/file-explorer-paths.test.ts": 58,
+      "src/renderer/src/components/right-sidebar/file-explorer-refresh-concurrency.test.ts": 42,
+      "src/renderer/src/components/right-sidebar/file-explorer-reset.test.ts": 40,
+      "src/renderer/src/components/right-sidebar/file-explorer-row-projection.test.ts": 41,
+      "src/renderer/src/components/right-sidebar/file-explorer-runtime-owner-boundary.test.ts": 28,
+      "src/renderer/src/components/right-sidebar/file-explorer-selection.test.ts": 51,
+      "src/renderer/src/components/right-sidebar/file-explorer-stale-dir-cache.test.ts": 64,
+      "src/renderer/src/components/right-sidebar/file-explorer-watch-drive-root.test.ts": 1568,
+      "src/renderer/src/components/right-sidebar/file-explorer-watch-reconcile.test.ts": 2028,
+      "src/renderer/src/components/right-sidebar/file-explorer-watch-refresh-scheduler.test.ts": 58,
+      "src/renderer/src/components/right-sidebar/file-search-include-pattern.test.ts": 54,
+      "src/renderer/src/components/right-sidebar/folder-workspace-attached-worktrees.test.ts": 67,
+      "src/renderer/src/components/right-sidebar/fork-push-target-label.test.ts": 47,
+      "src/renderer/src/components/right-sidebar/git-status-push-signal-refresh.test.ts": 60,
+      "src/renderer/src/components/right-sidebar/git-status-refresh-branch-line-total.test.ts": 247,
+      "src/renderer/src/components/right-sidebar/git-status-refresh-scheduler.test.ts": 40,
+      "src/renderer/src/components/right-sidebar/git-status-refresh.test.ts": 173,
+      "src/renderer/src/components/right-sidebar/github-pr-link-modal.test.ts": 42,
+      "src/renderer/src/components/right-sidebar/github-pr-stack-merge.test.ts": 58,
+      "src/renderer/src/components/right-sidebar/gitlab-mr-merge-state.test.ts": 91,
+      "src/renderer/src/components/right-sidebar/local-workspace-port-sections.test.ts": 57,
+      "src/renderer/src/components/right-sidebar/parent-pr-checks-projection-selector.test.ts": 294,
+      "src/renderer/src/components/right-sidebar/parent-pr-checks-refresh.test.ts": 176,
+      "src/renderer/src/components/right-sidebar/parent-pr-checks-rows.test.ts": 172,
+      "src/renderer/src/components/right-sidebar/plugin-panel-activity-items.test.ts": 145,
+      "src/renderer/src/components/right-sidebar/plugin-panel-bridge-host.test.ts": 256,
+      "src/renderer/src/components/right-sidebar/plugin-panel-watchdog-visibility.test.ts": 585,
+      "src/renderer/src/components/right-sidebar/plugin-panel-watchdog.test.ts": 189,
+      "src/renderer/src/components/right-sidebar/pr-comment-ack-summary.test.ts": 40,
+      "src/renderer/src/components/right-sidebar/pr-comment-presentation.test.ts": 516,
+      "src/renderer/src/components/right-sidebar/pr-comment-snapshotted-thread-resolver.test.ts": 46,
+      "src/renderer/src/components/right-sidebar/pr-comment-thread-resolution.test.ts": 73,
+      "src/renderer/src/components/right-sidebar/pr-comments-ai-launch-ack.test.ts": 70,
+      "src/renderer/src/components/right-sidebar/pr-comments-list-selection.test.tsx": 3795,
+      "src/renderer/src/components/right-sidebar/push-target-upstream-refresh-cache.test.ts": 203,
+      "src/renderer/src/components/right-sidebar/review-cache-entry-selection.test.ts": 52,
+      "src/renderer/src/components/right-sidebar/right-panel-comment-composer.ime-enter.test.tsx": 679,
+      "src/renderer/src/components/right-sidebar/right-panel-comment-focus-timers.test.ts": 39,
+      "src/renderer/src/components/right-sidebar/right-sidebar-activity-visibility.test.ts": 143,
+      "src/renderer/src/components/right-sidebar/right-sidebar-effective-tab.test.ts": 30,
+      "src/renderer/src/components/right-sidebar/right-sidebar-primary-action-layout.test.ts": 42,
+      "src/renderer/src/components/right-sidebar/right-sidebar-titlebar-drag-regions.render.test.tsx": 1020,
+      "src/renderer/src/components/right-sidebar/right-sidebar-titlebar-drag-regions.test.ts": 55,
+      "src/renderer/src/components/right-sidebar/right-sidebar-width.test.ts": 44,
+      "src/renderer/src/components/right-sidebar/runSourceControlAgentActionStart.test.ts": 203,
+      "src/renderer/src/components/right-sidebar/search-match-open.test.ts": 51,
+      "src/renderer/src/components/right-sidebar/search-rows.test.ts": 32,
+      "src/renderer/src/components/right-sidebar/source-control-action-recipe-match.test.ts": 154,
+      "src/renderer/src/components/right-sidebar/source-control-actions.test.ts": 51,
+      "src/renderer/src/components/right-sidebar/source-control-active-open-file-keys.test.ts": 33,
+      "src/renderer/src/components/right-sidebar/source-control-agent-action-dialog-support.test.ts": 143,
+      "src/renderer/src/components/right-sidebar/source-control-branch-context-row.test.tsx": 732,
+      "src/renderer/src/components/right-sidebar/source-control-branch-context-stats.test.ts": 120,
+      "src/renderer/src/components/right-sidebar/source-control-branch-section-heading.test.tsx": 1334,
+      "src/renderer/src/components/right-sidebar/source-control-commit-eligibility.test.ts": 49,
       "src/renderer/src/components/right-sidebar/source-control-commit-message-rows.test.ts": 99,
-      "src/renderer/src/components/right-sidebar/source-control-create-pr-intent-flow.test.ts": 18,
-      "src/renderer/src/components/right-sidebar/source-control-create-pr-intent-state.test.ts": 7,
-      "src/renderer/src/components/right-sidebar/source-control-create-review-blocked-action.test.ts": 10,
-      "src/renderer/src/components/right-sidebar/source-control-created-review-link.test.ts": 6,
-      "src/renderer/src/components/right-sidebar/source-control-discard-confirmation.test.ts": 17,
-      "src/renderer/src/components/right-sidebar/source-control-discard-dialog.test.tsx": 168,
-      "src/renderer/src/components/right-sidebar/source-control-dropdown-items.create-pr-intent.test.ts": 24,
-      "src/renderer/src/components/right-sidebar/source-control-dropdown-items.test.ts": 34,
-      "src/renderer/src/components/right-sidebar/source-control-entry-actions.test.ts": 5,
-      "src/renderer/src/components/right-sidebar/source-control-entry-context-menu.test.tsx": 17,
-      "src/renderer/src/components/right-sidebar/source-control-file-filter.test.ts": 6,
-      "src/renderer/src/components/right-sidebar/source-control-header-toolbar-identity.test.tsx": 100,
-      "src/renderer/src/components/right-sidebar/source-control-header-toolbar.test.ts": 6,
-      "src/renderer/src/components/right-sidebar/source-control-hosted-review-creation-eligibility-snapshot.test.ts": 17,
-      "src/renderer/src/components/right-sidebar/source-control-hosted-review-push-target.test.ts": 6,
-      "src/renderer/src/components/right-sidebar/source-control-huge-repo-warning-dismissals.test.ts": 237,
-      "src/renderer/src/components/right-sidebar/source-control-manual-review-url.test.ts": 13,
-      "src/renderer/src/components/right-sidebar/source-control-primary-action.create-pr-intent.test.ts": 29,
-      "src/renderer/src/components/right-sidebar/source-control-primary-action.test.ts": 34,
-      "src/renderer/src/components/right-sidebar/source-control-push-recovery.test.ts": 8,
-      "src/renderer/src/components/right-sidebar/source-control-section-order.test.ts": 9,
-      "src/renderer/src/components/right-sidebar/source-control-split-open.test.ts": 7,
-      "src/renderer/src/components/right-sidebar/source-control-status-sort.test.ts": 8,
-      "src/renderer/src/components/right-sidebar/source-control-submodule-expansion.test.ts": 16,
-      "src/renderer/src/components/right-sidebar/source-control-text-generation-defaults.test.ts": 8,
-      "src/renderer/src/components/right-sidebar/source-control-too-many-changes-banner.test.tsx": 87,
-      "src/renderer/src/components/right-sidebar/source-control-tree.test.ts": 13,
-      "src/renderer/src/components/right-sidebar/source-control-virtual-file-list.test.tsx": 148,
-      "src/renderer/src/components/right-sidebar/source-control/listing/use-file-projection-work.test.tsx": 31,
-      "src/renderer/src/components/right-sidebar/source-control/listing/use-store-actions.store-subscriptions.test.tsx": 50,
-      "src/renderer/src/components/right-sidebar/source-control/review/suppressed-github-pr.test.ts": 10,
-      "src/renderer/src/components/right-sidebar/source-control/review/use-action-model.test.tsx": 20,
-      "src/renderer/src/components/right-sidebar/source-control/review/use-hosted-review-state.test.tsx": 38,
-      "src/renderer/src/components/right-sidebar/status-display.test.ts": 4,
-      "src/renderer/src/components/right-sidebar/use-checks-panel-terminal-worktree.test.ts": 87,
-      "src/renderer/src/components/right-sidebar/use-git-status-upstream-ref-watch.test.ts": 11,
-      "src/renderer/src/components/right-sidebar/use-hosted-review-actions.test.tsx": 47,
-      "src/renderer/src/components/right-sidebar/use-installed-plugin-route-reconciliation.test.tsx": 23,
-      "src/renderer/src/components/right-sidebar/use-persisted-ai-vault-view-options.test.tsx": 34,
-      "src/renderer/src/components/right-sidebar/use-plugin-panel-theme-revision.test.tsx": 47,
-      "src/renderer/src/components/right-sidebar/use-source-control-ai.test.ts": 6,
-      "src/renderer/src/components/right-sidebar/use-source-control-branch-compare.test.tsx": 64,
-      "src/renderer/src/components/right-sidebar/use-source-control-git-history.test.tsx": 45,
-      "src/renderer/src/components/right-sidebar/useCreatePullRequestDialogFields.repo-default.test.ts": 28,
-      "src/renderer/src/components/right-sidebar/useCreatePullRequestDialogFields.test.ts": 48,
-      "src/renderer/src/components/right-sidebar/useFileExplorerDragDrop.test.ts": 5,
-      "src/renderer/src/components/right-sidebar/useFileExplorerHandlers.test.ts": 14,
-      "src/renderer/src/components/right-sidebar/useFileExplorerKeys.test.ts": 4,
-      "src/renderer/src/components/right-sidebar/useFileExplorerRowDrag.test.ts": 20,
-      "src/renderer/src/components/right-sidebar/useFileExplorerTree.refresh-projection-churn.test.tsx": 35,
-      "src/renderer/src/components/right-sidebar/useFileExplorerTree.stale-dirs.test.tsx": 37,
-      "src/renderer/src/components/right-sidebar/useFileExplorerVisibleRowProjection.debounce.test.tsx": 110,
-      "src/renderer/src/components/right-sidebar/useFileExplorerVisibleRowProjection.test.ts": 12,
-      "src/renderer/src/components/right-sidebar/useFileExplorerWatch.pending-refresh.test.tsx": 27,
-      "src/renderer/src/components/right-sidebar/useFileExplorerWatch.test.ts": 12,
-      "src/renderer/src/components/right-sidebar/useFileSearchRunner.test.tsx": 27,
-      "src/renderer/src/components/right-sidebar/useGitStatusPolling.rerender.test.ts": 57,
-      "src/renderer/src/components/right-sidebar/useGitStatusPolling.test.ts": 585,
-      "src/renderer/src/components/right-sidebar/useHostedReviewStackParent.test.tsx": 33,
-      "src/renderer/src/components/right-sidebar/useSourceControlSelection.test.ts": 9,
-      "src/renderer/src/components/right-sidebar/useSourceControlSubmoduleStatus.test.tsx": 39,
-      "src/renderer/src/components/settings/AccountsPane.test.tsx": 508,
-      "src/renderer/src/components/settings/AdvancedNetworkSettingsSection.test.ts": 9,
-      "src/renderer/src/components/settings/AdvancedPane.test.tsx": 37,
-      "src/renderer/src/components/settings/AgentSkillSetupPanel.freshness.test.tsx": 63,
-      "src/renderer/src/components/settings/AgentSkillSetupPanel.test.tsx": 479,
-      "src/renderer/src/components/settings/AgentsPane.test.tsx": 445,
-      "src/renderer/src/components/settings/AppearancePane.test.tsx": 694,
-      "src/renderer/src/components/settings/ArtifactsSettingsPane.test.tsx": 358,
-      "src/renderer/src/components/settings/AutomationsSettingsPane.test.tsx": 117,
-      "src/renderer/src/components/settings/BranchPrefixFeedback.test.tsx": 16,
-      "src/renderer/src/components/settings/BrowserClientHostedRemoteSetting.test.tsx": 116,
-      "src/renderer/src/components/settings/BrowserPane.test.ts": 6,
-      "src/renderer/src/components/settings/BrowserSshWorkspaceRoutingSetting.test.tsx": 111,
-      "src/renderer/src/components/settings/BrowserUseSkillStep.test.tsx": 11,
-      "src/renderer/src/components/settings/CliSection.install-failure.test.tsx": 197,
-      "src/renderer/src/components/settings/CliSection.test.tsx": 87,
-      "src/renderer/src/components/settings/CliSkillRuntimeSetup.test.tsx": 60,
-      "src/renderer/src/components/settings/CloudVmSetupGuide.test.tsx": 28,
-      "src/renderer/src/components/settings/CommitMessageAiPane.test.tsx": 532,
-      "src/renderer/src/components/settings/DefaultWindowsProjectRuntimeSetting.test.tsx": 28,
-      "src/renderer/src/components/settings/DeveloperPermissionsPane.test.tsx": 283,
-      "src/renderer/src/components/settings/DiffShowWhitespaceSetting.test.tsx": 57,
-      "src/renderer/src/components/settings/EditorWordWrapSetting.test.tsx": 74,
-      "src/renderer/src/components/settings/EphemeralVmRuntimesSection.test.tsx": 128,
-      "src/renderer/src/components/settings/EphemeralVmsPane.test.tsx": 103,
-      "src/renderer/src/components/settings/ExperimentalPane.test.tsx": 797,
-      "src/renderer/src/components/settings/FloatingWorkspacePane.test.tsx": 6,
-      "src/renderer/src/components/settings/GeneralPane.test.ts": 11,
-      "src/renderer/src/components/settings/GeneralRemoteServerUpdates.test.tsx": 55,
-      "src/renderer/src/components/settings/GeneralUpdateSettingsSection.test.tsx": 79,
-      "src/renderer/src/components/settings/GeneralWorkspaceSettingsSection.test.tsx": 308,
-      "src/renderer/src/components/settings/GhosttyImportModal.test.ts": 17,
-      "src/renderer/src/components/settings/GitPane.test.ts": 54,
-      "src/renderer/src/components/settings/GitPane.test.tsx": 109,
-      "src/renderer/src/components/settings/GrokAccountsSection.test.tsx": 61,
-      "src/renderer/src/components/settings/HiddenExperimentalGroup.test.tsx": 85,
-      "src/renderer/src/components/settings/KagiSessionLinkForm.test.ts": 5,
-      "src/renderer/src/components/settings/LinearAgentSkillGuide.test.tsx": 49,
-      "src/renderer/src/components/settings/LinearAgentSkillNotes.test.tsx": 27,
-      "src/renderer/src/components/settings/LinearAgentSkillPane.test.tsx": 152,
-      "src/renderer/src/components/settings/LocalNetworkConnectionTest.test.tsx": 227,
-      "src/renderer/src/components/settings/MobileEmulatorAgentControlRow.test.tsx": 40,
-      "src/renderer/src/components/settings/MobilePairingConnectionOptions.test.tsx": 243,
-      "src/renderer/src/components/settings/MobilePairingQrSection.test.tsx": 203,
-      "src/renderer/src/components/settings/MobilePairingSetupSection.test.tsx": 748,
-      "src/renderer/src/components/settings/MobilePane.test.tsx": 885,
-      "src/renderer/src/components/settings/MobilePaneAddressSearch.test.tsx": 31,
-      "src/renderer/src/components/settings/NativeChatSupportedAgents.test.tsx": 114,
-      "src/renderer/src/components/settings/NotificationsPane.test.tsx": 55,
-      "src/renderer/src/components/settings/OpenInMenuSetting.test.ts": 23,
-      "src/renderer/src/components/settings/OrcaAccountSettingsPane.test.tsx": 140,
-      "src/renderer/src/components/settings/OrchestrationPane.test.tsx": 266,
-      "src/renderer/src/components/settings/OrchestrationSkillAgentCoverage.test.tsx": 26,
-      "src/renderer/src/components/settings/PluginConsentDialog.test.tsx": 450,
-      "src/renderer/src/components/settings/PluginInstallDialog.test.tsx": 165,
-      "src/renderer/src/components/settings/PluginKeybindingConsentPreview.test.ts": 7,
-      "src/renderer/src/components/settings/PluginMarketplaceBrowser.test.tsx": 397,
-      "src/renderer/src/components/settings/PluginMarketplaceSourceDialog.test.tsx": 195,
-      "src/renderer/src/components/settings/PluginSettingsRow.test.tsx": 75,
-      "src/renderer/src/components/settings/PluginsSettingsSection.lifecycle.test.tsx": 748,
-      "src/renderer/src/components/settings/PrivacyPane.test.ts": 47,
-      "src/renderer/src/components/settings/ProjectWindowsRuntimeSetting.test.tsx": 159,
-      "src/renderer/src/components/settings/QuickCommandsList.test.tsx": 122,
-      "src/renderer/src/components/settings/QuickCommandsPane.test.ts": 8,
-      "src/renderer/src/components/settings/RemoteServerUpdateDialog.test.tsx": 69,
-      "src/renderer/src/components/settings/RepositoryForkSyncSection.test.tsx": 62,
-      "src/renderer/src/components/settings/RepositoryHooksSection.test.ts": 120,
-      "src/renderer/src/components/settings/RepositoryHostSetupsSection.test.tsx": 354,
-      "src/renderer/src/components/settings/RepositoryHostSetupsSection.workspace-window.test.tsx": 71,
-      "src/renderer/src/components/settings/RepositoryIconEmojiPicker.test.tsx": 37,
-      "src/renderer/src/components/settings/RepositoryIconPicker.github-avatar-refresh.test.tsx": 47,
-      "src/renderer/src/components/settings/RepositoryPane.test.ts": 837,
-      "src/renderer/src/components/settings/RepositoryPaneDraftInput.test.tsx": 74,
-      "src/renderer/src/components/settings/RepositorySourceControlAiSection.test.ts": 73,
-      "src/renderer/src/components/settings/RepositoryWorktreeDefaultsSection.test.tsx": 130,
-      "src/renderer/src/components/settings/RuntimeEnvironmentsPane.test.ts": 17,
-      "src/renderer/src/components/settings/RuntimeHostAccessForm.test.tsx": 75,
-      "src/renderer/src/components/settings/RuntimePairingGeneratorForm.test.tsx": 41,
-      "src/renderer/src/components/settings/RuntimePairingUrlGenerator.test.tsx": 88,
-      "src/renderer/src/components/settings/Settings.load-performance.test.ts": 7,
-      "src/renderer/src/components/settings/SettingsConstants.test.ts": 9,
-      "src/renderer/src/components/settings/SettingsFormControls.font-autocomplete.test.tsx": 359,
-      "src/renderer/src/components/settings/SettingsFormControls.number-field.test.tsx": 66,
-      "src/renderer/src/components/settings/SettingsFormControls.segmented-control.test.tsx": 69,
-      "src/renderer/src/components/settings/SettingsSidebar.test.tsx": 79,
-      "src/renderer/src/components/settings/ShareSkillsSettingsPane.test.tsx": 192,
-      "src/renderer/src/components/settings/ShortcutCommandBlock.test.tsx": 76,
-      "src/renderer/src/components/settings/ShortcutFilterRail.test.ts": 10,
-      "src/renderer/src/components/settings/SourceControlActionRepoOverrideNote.test.tsx": 137,
-      "src/renderer/src/components/settings/SparsePresetSettingsSection.test.tsx": 28,
-      "src/renderer/src/components/settings/SshTargetCard.test.tsx": 89,
-      "src/renderer/src/components/settings/SshTargetForm.test.tsx": 363,
-      "src/renderer/src/components/settings/TaskSourceLinearSetup.test.tsx": 77,
-      "src/renderer/src/components/settings/TaskSourceProviderCard.test.tsx": 72,
-      "src/renderer/src/components/settings/TaskSourceShowInTasksStep.test.tsx": 32,
-      "src/renderer/src/components/settings/TaskSourceSimpleSetup.test.tsx": 40,
-      "src/renderer/src/components/settings/TasksPane.test.tsx": 282,
-      "src/renderer/src/components/settings/TerminalAdvancedSection.test.tsx": 85,
-      "src/renderer/src/components/settings/TerminalAppearanceSection.ghostty.test.ts": 48,
-      "src/renderer/src/components/settings/TerminalContrastSetting.test.tsx": 128,
-      "src/renderer/src/components/settings/TerminalFontSizeSetting.test.tsx": 62,
-      "src/renderer/src/components/settings/TerminalPane.pwsh.test.ts": 38,
-      "src/renderer/src/components/settings/TerminalSettingsPreview.lifecycle.test.tsx": 19,
-      "src/renderer/src/components/settings/TerminalTccAttributionNotice.test.tsx": 89,
-      "src/renderer/src/components/settings/TerminalThemeSections.lifecycle.test.ts": 51,
-      "src/renderer/src/components/settings/VoicePane.test.tsx": 443,
-      "src/renderer/src/components/settings/VoiceSpeechModelSection.test.tsx": 85,
-      "src/renderer/src/components/settings/WorkspaceDirectorySetting.test.tsx": 104,
-      "src/renderer/src/components/settings/accounts-search.test.ts": 7,
-      "src/renderer/src/components/settings/agent-availability-settings.test.ts": 19,
-      "src/renderer/src/components/settings/agent-default-env-draft.test.ts": 9,
-      "src/renderer/src/components/settings/agent-skill-installed-command-callers.test.ts": 103,
-      "src/renderer/src/components/settings/appearance-interface-summary.test.ts": 7,
-      "src/renderer/src/components/settings/appearance-search.test.ts": 315,
-      "src/renderer/src/components/settings/appearance-status-bar-search.test.ts": 8,
-      "src/renderer/src/components/settings/appearance-usage-percentage-search.test.ts": 3,
-      "src/renderer/src/components/settings/browser-cookie-import-label.test.ts": 9,
-      "src/renderer/src/components/settings/browser-link-routing-localization.test.ts": 222,
-      "src/renderer/src/components/settings/browser-search.test.ts": 60,
-      "src/renderer/src/components/settings/browser-session-host-selection.test.ts": 4,
-      "src/renderer/src/components/settings/cli-install-failure.test.ts": 7,
-      "src/renderer/src/components/settings/cli-source-control-integration-cards.test.tsx": 41,
-      "src/renderer/src/components/settings/codex-account-auth-warning.test.ts": 11,
-      "src/renderer/src/components/settings/codex-config-sync-warning.test.ts": 7,
-      "src/renderer/src/components/settings/codex-session-source-home-control.test.tsx": 10,
-      "src/renderer/src/components/settings/developer-permissions-search.test.ts": 280,
-      "src/renderer/src/components/settings/host-scoped-setting-scope.test.ts": 9,
-      "src/renderer/src/components/settings/integrations-pane-status.test.ts": 10,
-      "src/renderer/src/components/settings/jira-integration-card.test.tsx": 71,
-      "src/renderer/src/components/settings/linear-agent-skill-install-cta.test.tsx": 126,
-      "src/renderer/src/components/settings/mobile-network-interface-selection.test.ts": 9,
-      "src/renderer/src/components/settings/mobile-pairing-device-polling.test.ts": 6,
-      "src/renderer/src/components/settings/mobile-pane-search.test.ts": 9,
-      "src/renderer/src/components/settings/native-chat-experimental-search-entry.test.ts": 11,
-      "src/renderer/src/components/settings/osc52-clipboard-copy.test.ts": 7,
-      "src/renderer/src/components/settings/plugin-install-source.test.ts": 9,
-      "src/renderer/src/components/settings/provider-account-scope.test.ts": 12,
-      "src/renderer/src/components/settings/provider-account-visibility.test.ts": 5,
-      "src/renderer/src/components/settings/provider-rate-limit-scope-panels.test.tsx": 31,
-      "src/renderer/src/components/settings/repository-hook-settings-draft.test.ts": 7,
-      "src/renderer/src/components/settings/repository-host-setup-options.test.ts": 6,
-      "src/renderer/src/components/settings/repository-icon-github.test.ts": 8,
-      "src/renderer/src/components/settings/repository-source-control-ai-global-ux.test.ts": 52,
-      "src/renderer/src/components/settings/repository-source-control-ai-persist-queue.test.ts": 10,
-      "src/renderer/src/components/settings/setting-ownership.test.ts": 13,
-      "src/renderer/src/components/settings/settings-deep-link-target-watcher.test.ts": 18,
-      "src/renderer/src/components/settings/settings-form-option-filter.test.ts": 13,
-      "src/renderer/src/components/settings/settings-project-list.test.ts": 21,
-      "src/renderer/src/components/settings/settings-search-keywords.test.ts": 122,
-      "src/renderer/src/components/settings/settings-search.test.ts": 9,
-      "src/renderer/src/components/settings/settings-setup-guide-progress-hook.test.tsx": 12,
-      "src/renderer/src/components/settings/settings-setup-guide-progress.test.ts": 5,
-      "src/renderer/src/components/settings/shortcut-binding-list-mutations.test.ts": 10,
-      "src/renderer/src/components/settings/shortcut-definition-catalog.test.ts": 269,
-      "src/renderer/src/components/settings/shortcut-groups.test.ts": 14,
-      "src/renderer/src/components/settings/shortcut-recording-state.test.ts": 5,
-      "src/renderer/src/components/settings/shortcut-row-visibility.test.ts": 14,
-      "src/renderer/src/components/settings/sparse-preset-date.test.ts": 26,
-      "src/renderer/src/components/settings/sparse-preset-operation-error.test.ts": 3,
-      "src/renderer/src/components/settings/ssh-target-action-state.test.ts": 4,
-      "src/renderer/src/components/settings/ssh-target-draft.test.ts": 17,
-      "src/renderer/src/components/settings/ssh-target-remove.test.ts": 10,
-      "src/renderer/src/components/settings/ssh-target-save-payload.test.ts": 10,
-      "src/renderer/src/components/settings/task-source-setup-state.test.ts": 11,
-      "src/renderer/src/components/settings/task-tracker-integration-cards.test.tsx": 134,
-      "src/renderer/src/components/settings/terminal-preview-content.test.ts": 7,
-      "src/renderer/src/components/settings/terminal-search.test.ts": 56,
-      "src/renderer/src/components/settings/use-debounced-settings-text-draft.test.ts": 35,
-      "src/renderer/src/components/settings/use-mac-captured-digit-chords.test.ts": 393,
-      "src/renderer/src/components/settings/use-repository-hook-settings-draft.test.tsx": 34,
-      "src/renderer/src/components/settings/use-task-source-provider-readiness.test.tsx": 25,
-      "src/renderer/src/components/settings/useGhosttyImport.test.ts": 17,
-      "src/renderer/src/components/settings/useWarpThemeImport.test.ts": 31,
-      "src/renderer/src/components/settings/worktree-symlink-path-filter.test.ts": 11,
-      "src/renderer/src/components/setup-guide/SetupGuideModal.mount-gating.test.tsx": 1073,
-      "src/renderer/src/components/setup-guide/use-setup-guide-progress.test.ts": 10,
-      "src/renderer/src/components/setup-guide/use-setup-guide-telemetry.test.ts": 10,
-      "src/renderer/src/components/shared/kill-all-terminal-surfaces.test.ts": 184,
-      "src/renderer/src/components/shared/useDaemonActions.test.tsx": 27,
-      "src/renderer/src/components/sidebar/AddProjectFromFolderDialog.test.tsx": 198,
-      "src/renderer/src/components/sidebar/AddRemoteHostDialog.config-picker.test.tsx": 603,
-      "src/renderer/src/components/sidebar/AddRemoteHostFields.test.tsx": 39,
-      "src/renderer/src/components/sidebar/AddRepoCreateStep.test.tsx": 54,
-      "src/renderer/src/components/sidebar/AddRepoDialog.default-checkout.test.ts": 8,
-      "src/renderer/src/components/sidebar/AddRepoDialogStepContent.test.tsx": 71,
-      "src/renderer/src/components/sidebar/AddRepoHostSelector.test.tsx": 43,
-      "src/renderer/src/components/sidebar/AddRepoNestedImportStep.test.tsx": 146,
-      "src/renderer/src/components/sidebar/AddRepoStartSteps.test.tsx": 283,
-      "src/renderer/src/components/sidebar/AddRepoSteps.default-checkout.test.ts": 103,
-      "src/renderer/src/components/sidebar/AgentDashboardSidebarHost.test.tsx": 40,
-      "src/renderer/src/components/sidebar/AutoRenameFailedDialog.test.tsx": 229,
-      "src/renderer/src/components/sidebar/CacheTimer.test.tsx": 15,
-      "src/renderer/src/components/sidebar/CommentMarkdown.github-attachment-image.test.tsx": 68,
-      "src/renderer/src/components/sidebar/CommentMarkdown.link-click.test.tsx": 134,
-      "src/renderer/src/components/sidebar/CommentMarkdown.test.tsx": 309,
-      "src/renderer/src/components/sidebar/DeleteWorktreeDialog.host-context-boundary.test.ts": 7,
-      "src/renderer/src/components/sidebar/DeleteWorktreeDialog.test.tsx": 523,
-      "src/renderer/src/components/sidebar/DeleteWorktreeTargetPreview.test.tsx": 105,
-      "src/renderer/src/components/sidebar/FilterToggleRow.test.tsx": 30,
-      "src/renderer/src/components/sidebar/ImportedWorktreesVisibilityLine.test.tsx": 34,
-      "src/renderer/src/components/sidebar/LinearAgentSkillSetupPrompt.reminder-toast.test.tsx": 214,
-      "src/renderer/src/components/sidebar/LinearAgentSkillSetupPrompt.test.tsx": 820,
-      "src/renderer/src/components/sidebar/LinearAgentSkillSetupPrompt.update-command.test.tsx": 242,
-      "src/renderer/src/components/sidebar/MarkdownImageLightbox.test.tsx": 265,
-      "src/renderer/src/components/sidebar/NewExternalWorktreesInboxLine.test.tsx": 109,
-      "src/renderer/src/components/sidebar/NonGitFolderDialog.test.tsx": 80,
-      "src/renderer/src/components/sidebar/NoticeHostGlyph.test.tsx": 59,
-      "src/renderer/src/components/sidebar/OrcaYamlTrustDialog.test.tsx": 24,
-      "src/renderer/src/components/sidebar/ProjectAddedDialog.test.tsx": 37,
-      "src/renderer/src/components/sidebar/ProjectGroupDeleteDialog.test.tsx": 194,
-      "src/renderer/src/components/sidebar/ProjectHeaderActions.test.tsx": 17,
-      "src/renderer/src/components/sidebar/RemoteFileBrowser.paste.test.tsx": 145,
-      "src/renderer/src/components/sidebar/RemoveFolderDialog.test.tsx": 15,
-      "src/renderer/src/components/sidebar/SetupGuideSidebarEntry.test.tsx": 65,
-      "src/renderer/src/components/sidebar/SetupScriptPromptCard.test.ts": 8,
-      "src/renderer/src/components/sidebar/SetupScriptPromptCardShell.test.tsx": 57,
-      "src/renderer/src/components/sidebar/Sidebar.test.tsx": 80,
-      "src/renderer/src/components/sidebar/SidebarAgentsList.test.tsx": 205,
-      "src/renderer/src/components/sidebar/SidebarFeedbackDialog.test.tsx": 312,
-      "src/renderer/src/components/sidebar/SidebarGroupByToggle.test.tsx": 62,
-      "src/renderer/src/components/sidebar/SidebarHeader.test.tsx": 200,
-      "src/renderer/src/components/sidebar/SidebarNav.test.tsx": 749,
-      "src/renderer/src/components/sidebar/SidebarRepositoryFilterSection.test.tsx": 507,
-      "src/renderer/src/components/sidebar/SidebarSettingsHelpMenu.test.tsx": 280,
-      "src/renderer/src/components/sidebar/SidebarToolbar.test.tsx": 129,
-      "src/renderer/src/components/sidebar/SidebarWorkspaceFilterSection.test.tsx": 123,
-      "src/renderer/src/components/sidebar/StatusIndicator.test.ts": 32,
-      "src/renderer/src/components/sidebar/WorkspaceKanbanCard.host-identity.test.tsx": 30,
-      "src/renderer/src/components/sidebar/WorkspaceKanbanDrawer.mount-gating.test.tsx": 522,
-      "src/renderer/src/components/sidebar/WorkspaceKanbanDrawer.search.test.tsx": 179,
-      "src/renderer/src/components/sidebar/WorkspaceKanbanDrawer.task-status-sync.test.tsx": 128,
-      "src/renderer/src/components/sidebar/WorkspaceKanbanDrawerHeader.test.tsx": 14,
-      "src/renderer/src/components/sidebar/WorkspaceKanbanLaneCardList.test.tsx": 70,
-      "src/renderer/src/components/sidebar/WorkspaceKanbanLaneGrid.test.tsx": 78,
-      "src/renderer/src/components/sidebar/WorkspaceKanbanSearchField.test.tsx": 80,
-      "src/renderer/src/components/sidebar/WorkspaceKanbanSettingsMenu.test.tsx": 211,
-      "src/renderer/src/components/sidebar/WorkspaceKanbanStatusLane.test.tsx": 55,
-      "src/renderer/src/components/sidebar/WorktreeCard.affiliate-list-mode.test.tsx": 80,
-      "src/renderer/src/components/sidebar/WorktreeCard.compact-hover.test.tsx": 3366,
-      "src/renderer/src/components/sidebar/WorktreeCard.compact-ports-hover-independence.test.tsx": 1185,
-      "src/renderer/src/components/sidebar/WorktreeCard.hosted-review-refresh.test.tsx": 1294,
-      "src/renderer/src/components/sidebar/WorktreeCard.lineage.test.tsx": 1219,
-      "src/renderer/src/components/sidebar/WorktreeCard.merged-pr-display.test.tsx": 1041,
-      "src/renderer/src/components/sidebar/WorktreeCard.pinned-repo-icon.test.tsx": 1063,
-      "src/renderer/src/components/sidebar/WorktreeCard.pr-display.test.tsx": 1918,
-      "src/renderer/src/components/sidebar/WorktreeCard.quick-actions.test.tsx": 1401,
-      "src/renderer/src/components/sidebar/WorktreeCard.ssh-reconnect-prompt.test.tsx": 762,
-      "src/renderer/src/components/sidebar/WorktreeCard.test.ts": 9,
-      "src/renderer/src/components/sidebar/WorktreeCardAgents.activation.test.tsx": 523,
-      "src/renderer/src/components/sidebar/WorktreeCardAgents.expansion-remount.test.tsx": 470,
-      "src/renderer/src/components/sidebar/WorktreeCardAgents.send-target.test.tsx": 808,
-      "src/renderer/src/components/sidebar/WorktreeCardAgents.test.tsx": 673,
-      "src/renderer/src/components/sidebar/WorktreeCardAutomationDetailSection.test.tsx": 86,
-      "src/renderer/src/components/sidebar/WorktreeCardDisplayMenuSection.test.tsx": 76,
-      "src/renderer/src/components/sidebar/WorktreeCardMeta.interaction.test.tsx": 305,
-      "src/renderer/src/components/sidebar/WorktreeCardMeta.test.tsx": 99,
-      "src/renderer/src/components/sidebar/WorktreeCardPorts.test.tsx": 1109,
-      "src/renderer/src/components/sidebar/WorktreeCardSshHostControl.test.tsx": 281,
-      "src/renderer/src/components/sidebar/WorktreeCardStatusSlot.test.tsx": 53,
-      "src/renderer/src/components/sidebar/WorktreeContextMenu.delete-shortcut.test.tsx": 70,
-      "src/renderer/src/components/sidebar/WorktreeContextMenu.react185-bystander.test.tsx": 733,
-      "src/renderer/src/components/sidebar/WorktreeContextMenu.test.ts": 31,
-      "src/renderer/src/components/sidebar/WorktreeDeveloperMenu.test.tsx": 23,
-      "src/renderer/src/components/sidebar/WorktreeDeveloperMenuReveal.test.tsx": 73,
-      "src/renderer/src/components/sidebar/WorktreeList.card-memo-stability.test.tsx": 1046,
-      "src/renderer/src/components/sidebar/WorktreeList.empty-project-rows.test.ts": 1389,
-      "src/renderer/src/components/sidebar/WorktreeList.folder-workspace-rows.test.ts": 1843,
-      "src/renderer/src/components/sidebar/WorktreeList.group-headers.test.ts": 1975,
-      "src/renderer/src/components/sidebar/WorktreeList.lineage-agent-expansion-coupling.test.tsx": 2544,
-      "src/renderer/src/components/sidebar/WorktreeList.lineage-child-card.test.ts": 1842,
-      "src/renderer/src/components/sidebar/WorktreeList.lineage-child-real-card.test.tsx": 3279,
-      "src/renderer/src/components/sidebar/WorktreeList.status-lane-lineage-drop.test.tsx": 2529,
-      "src/renderer/src/components/sidebar/WorktreeMetaDialog.test.tsx": 1032,
-      "src/renderer/src/components/sidebar/WorktreeOpenInMenu.test.tsx": 30,
-      "src/renderer/src/components/sidebar/WorktreeParentPickerPopover.test.ts": 21,
-      "src/renderer/src/components/sidebar/WorktreeTitleInlineRename.begin-editing.test.tsx": 78,
-      "src/renderer/src/components/sidebar/WorktreeTitleInlineRename.editor-lifecycle.test.tsx": 147,
-      "src/renderer/src/components/sidebar/WorktreeTitleInlineRename.test.tsx": 24,
-      "src/renderer/src/components/sidebar/WorktreeVisibilityDialog.test.tsx": 2347,
-      "src/renderer/src/components/sidebar/WorktreeVisibilityHelpPopover.test.tsx": 496,
-      "src/renderer/src/components/sidebar/WorktreeVisibilitySourceList.test.tsx": 107,
-      "src/renderer/src/components/sidebar/active-worktree-focus-after-delete.test.ts": 13,
-      "src/renderer/src/components/sidebar/add-remote-host-ssh-actions.test.ts": 18,
-      "src/renderer/src/components/sidebar/add-repo-browse-authority.test.ts": 9,
-      "src/renderer/src/components/sidebar/add-repo-existing-workspaces-telemetry.test.ts": 15,
-      "src/renderer/src/components/sidebar/add-repo-skip-finalization.test.ts": 6,
-      "src/renderer/src/components/sidebar/clone-defaults.test.ts": 6,
-      "src/renderer/src/components/sidebar/create-project-defaults.test.ts": 7,
-      "src/renderer/src/components/sidebar/default-branch-visible-under-hide-sleeping.test.ts": 12,
-      "src/renderer/src/components/sidebar/delete-worktree-dirty-change-counts.test.ts": 3,
-      "src/renderer/src/components/sidebar/delete-worktree-failure-toast.test.tsx": 44,
-      "src/renderer/src/components/sidebar/delete-worktree-flow.test.ts": 284,
-      "src/renderer/src/components/sidebar/delete-worktree-parallel-flow.test.ts": 37,
-      "src/renderer/src/components/sidebar/delete-worktree-toast.test.ts": 8,
-      "src/renderer/src/components/sidebar/empty-project-placeholder-repos.test.ts": 10,
-      "src/renderer/src/components/sidebar/focused-agent-row-highlight.test.ts": 10,
-      "src/renderer/src/components/sidebar/folder-workspace-card-pr-display.test.ts": 18,
-      "src/renderer/src/components/sidebar/folder-workspace-composer-helpers.test.ts": 10,
-      "src/renderer/src/components/sidebar/folder-workspace-composer-path-status.test.tsx": 48,
-      "src/renderer/src/components/sidebar/folder-workspace-composer-submit.test.ts": 61,
-      "src/renderer/src/components/sidebar/folder-workspace-linked-startup-plan.test.ts": 6,
-      "src/renderer/src/components/sidebar/host-header-drag.test.tsx": 51,
-      "src/renderer/src/components/sidebar/host-header-menu-items.test.ts": 8,
-      "src/renderer/src/components/sidebar/host-rename-remove.test.ts": 8,
-      "src/renderer/src/components/sidebar/host-section-folder-workspace-counts.test.ts": 7,
-      "src/renderer/src/components/sidebar/host-section-order.test.ts": 5,
-      "src/renderer/src/components/sidebar/host-section-rows.test.ts": 12,
-      "src/renderer/src/components/sidebar/hovered-workspace-delete.test.ts": 115,
-      "src/renderer/src/components/sidebar/imported-worktrees-card-actions.test.ts": 13,
-      "src/renderer/src/components/sidebar/imported-worktrees-card-candidates.test.ts": 8,
-      "src/renderer/src/components/sidebar/linear-agent-skill-runtime.shell-override.test.ts": 5,
-      "src/renderer/src/components/sidebar/linear-agent-skill-setup-reminders.test.ts": 13,
-      "src/renderer/src/components/sidebar/local-base-ref-suggestion-toast.test.tsx": 52,
-      "src/renderer/src/components/sidebar/mobile-sidebar-onboarding-badge.test.ts": 34,
-      "src/renderer/src/components/sidebar/natural-worktree-ids.test.ts": 8,
-      "src/renderer/src/components/sidebar/new-external-worktrees-inbox-actions.test.ts": 10,
-      "src/renderer/src/components/sidebar/new-external-worktrees-inbox-candidates.test.ts": 7,
-      "src/renderer/src/components/sidebar/pinned-section-worktrees.test.ts": 363,
-      "src/renderer/src/components/sidebar/preserved-branch-batch-toast.test.tsx": 129,
-      "src/renderer/src/components/sidebar/preserved-branch-toast.test.tsx": 47,
-      "src/renderer/src/components/sidebar/project-added-default-checkout.test.ts": 22,
-      "src/renderer/src/components/sidebar/project-group-header-dom.test.ts": 6,
-      "src/renderer/src/components/sidebar/project-group-header-drag-commit.test.ts": 12,
-      "src/renderer/src/components/sidebar/project-group-header-drag-start.test.ts": 21,
-      "src/renderer/src/components/sidebar/project-group-header-drag.test.ts": 16,
-      "src/renderer/src/components/sidebar/project-group-header-drop.test.ts": 13,
-      "src/renderer/src/components/sidebar/project-header-action-selector-lockstep.test.ts": 7,
-      "src/renderer/src/components/sidebar/project-header-color.test.ts": 7,
-      "src/renderer/src/components/sidebar/project-header-drag-commit.test.ts": 12,
-      "src/renderer/src/components/sidebar/project-header-drag-start.test.ts": 11,
-      "src/renderer/src/components/sidebar/project-header-drag.test.ts": 14,
-      "src/renderer/src/components/sidebar/project-header-drop.test.ts": 7,
-      "src/renderer/src/components/sidebar/project-order-manual-default-notice-visibility.test.ts": 7,
-      "src/renderer/src/components/sidebar/prompt-cache-countdown-clock.test.ts": 11,
-      "src/renderer/src/components/sidebar/prompt-cache-timer-selection.test.ts": 5,
-      "src/renderer/src/components/sidebar/remote-file-browser-drive-paths.test.ts": 6,
-      "src/renderer/src/components/sidebar/remote-file-browser-helpers.test.ts": 39,
-      "src/renderer/src/components/sidebar/rendered-sidebar-worktree-order.test.ts": 42,
-      "src/renderer/src/components/sidebar/repo-header-create-state.test.ts": 10,
-      "src/renderer/src/components/sidebar/sidebar-empty-state-gate.test.ts": 4,
-      "src/renderer/src/components/sidebar/sidebar-filter-state.test.ts": 9,
-      "src/renderer/src/components/sidebar/sidebar-host-options.test.ts": 15,
-      "src/renderer/src/components/sidebar/sidebar-project-drop.test.ts": 10,
-      "src/renderer/src/components/sidebar/sidebar-resize-handle.test.ts": 8,
-      "src/renderer/src/components/sidebar/sidebar-workspace-option-items.test.ts": 9,
-      "src/renderer/src/components/sidebar/sleep-worktree-activation-race.test.ts": 17,
-      "src/renderer/src/components/sidebar/sleep-worktree-flow.test.ts": 19,
-      "src/renderer/src/components/sidebar/smart-attention.test.ts": 26,
-      "src/renderer/src/components/sidebar/smart-sort.test.ts": 17,
-      "src/renderer/src/components/sidebar/ssh-host-remove-resolution.test.ts": 10,
-      "src/renderer/src/components/sidebar/ssh-target-duplicate.test.ts": 8,
-      "src/renderer/src/components/sidebar/ssh-workspace-forget-resolution.test.ts": 5,
-      "src/renderer/src/components/sidebar/stale-agent-row-unverifiable.test.ts": 13,
-      "src/renderer/src/components/sidebar/truncated-sidebar-label.test.tsx": 63,
-      "src/renderer/src/components/sidebar/use-add-repo-host-selection.test.ts": 157,
-      "src/renderer/src/components/sidebar/use-add-repo-hosted-controller.test.ts": 5,
-      "src/renderer/src/components/sidebar/use-feedback-image-drop.test.tsx": 46,
-      "src/renderer/src/components/sidebar/use-visible-workspace-kanban-worktree-ids.test.tsx": 28,
-      "src/renderer/src/components/sidebar/use-workspace-kanban-card-pointer-drag.test.ts": 10,
-      "src/renderer/src/components/sidebar/use-workspace-kanban-drawer-lingering.test.tsx": 28,
-      "src/renderer/src/components/sidebar/use-workspace-kanban-outside-dismiss.test.ts": 7,
-      "src/renderer/src/components/sidebar/use-workspace-kanban-selection.test.tsx": 21,
-      "src/renderer/src/components/sidebar/use-workspace-reveal-body-redirect.test.tsx": 33,
-      "src/renderer/src/components/sidebar/use-workspace-status-drop.test.ts": 7,
-      "src/renderer/src/components/sidebar/use-worktree-activity-status.test.tsx": 23,
-      "src/renderer/src/components/sidebar/use-worktree-activity-statuses.test.ts": 7,
-      "src/renderer/src/components/sidebar/use-worktree-card-secondary-details.store-subscriptions.test.tsx": 30,
-      "src/renderer/src/components/sidebar/useAddRepoCloneFlow.test.ts": 114,
-      "src/renderer/src/components/sidebar/useAddRepoLocalFolderFlow.test.ts": 127,
-      "src/renderer/src/components/sidebar/useAddRepoNestedImportFlow.test.ts": 13,
-      "src/renderer/src/components/sidebar/useAddRepoServerPathFlow.test.ts": 54,
-      "src/renderer/src/components/sidebar/useCreateProjectDefaults.test.ts": 30,
-      "src/renderer/src/components/sidebar/useCreateRepo.default-checkout.test.ts": 105,
-      "src/renderer/src/components/sidebar/useRenderedSetupScriptPromptState.test.ts": 20,
-      "src/renderer/src/components/sidebar/useSetupScriptPromptRevalidation.test.tsx": 63,
-      "src/renderer/src/components/sidebar/useWorkspaceBoardPanel.test.tsx": 68,
-      "src/renderer/src/components/sidebar/useWorktreeAgentRows.test.ts": 21,
-      "src/renderer/src/components/sidebar/visible-worktree-activity-inputs.test.ts": 9,
-      "src/renderer/src/components/sidebar/visible-worktree-indexes.test.ts": 12,
-      "src/renderer/src/components/sidebar/visible-worktrees.test.ts": 22,
-      "src/renderer/src/components/sidebar/workspace-board-task-status-sync.test.ts": 26,
-      "src/renderer/src/components/sidebar/workspace-creator-visibility.test.ts": 6,
-      "src/renderer/src/components/sidebar/workspace-delete-lineage.test.ts": 9,
-      "src/renderer/src/components/sidebar/workspace-kanban-area-selection.test.ts": 13,
-      "src/renderer/src/components/sidebar/workspace-kanban-card-pointer-drag-dom.test.ts": 7,
-      "src/renderer/src/components/sidebar/workspace-kanban-filtered-drop-index.test.ts": 11,
-      "src/renderer/src/components/sidebar/workspace-kanban-search.test.ts": 23,
-      "src/renderer/src/components/sidebar/workspace-kanban-sidebar-drop.test.ts": 21,
-      "src/renderer/src/components/sidebar/workspace-kanban-virtual-lane-layout.test.ts": 13,
-      "src/renderer/src/components/sidebar/workspace-kanban-worktree-groups.test.ts": 16,
-      "src/renderer/src/components/sidebar/workspace-lineage-menu-actions.test.ts": 9,
-      "src/renderer/src/components/sidebar/workspace-status.test.ts": 11,
-      "src/renderer/src/components/sidebar/worktree-agent-activity-summary.test.ts": 25,
-      "src/renderer/src/components/sidebar/worktree-agent-freshness-selector.test.ts": 10,
-      "src/renderer/src/components/sidebar/worktree-agent-orchestration-batch.test.ts": 17,
-      "src/renderer/src/components/sidebar/worktree-agent-orchestration-index.test.ts": 103,
-      "src/renderer/src/components/sidebar/worktree-agent-row-selectors.test.ts": 26,
-      "src/renderer/src/components/sidebar/worktree-card-agent-ack-inputs.test.tsx": 20,
-      "src/renderer/src/components/sidebar/worktree-card-agent-summary.test.ts": 31,
-      "src/renderer/src/components/sidebar/worktree-card-compact-agent-row.stable-message.test.tsx": 84,
-      "src/renderer/src/components/sidebar/worktree-card-details-hover-state.test.tsx": 26,
-      "src/renderer/src/components/sidebar/worktree-card-dom-events.test.ts": 6,
-      "src/renderer/src/components/sidebar/worktree-card-jira-issue-display.test.ts": 6,
-      "src/renderer/src/components/sidebar/worktree-card-markdown-isolation.test.ts": 344,
-      "src/renderer/src/components/sidebar/worktree-card-pr-display.test.ts": 11,
-      "src/renderer/src/components/sidebar/worktree-card-send-target-inputs.test.ts": 7,
-      "src/renderer/src/components/sidebar/worktree-card-status-inputs.test.ts": 8,
-      "src/renderer/src/components/sidebar/worktree-card-title-display.test.ts": 10,
-      "src/renderer/src/components/sidebar/worktree-context-menu-delete-intent.test.ts": 11,
-      "src/renderer/src/components/sidebar/worktree-delete-host-qualification.test.ts": 173,
-      "src/renderer/src/components/sidebar/worktree-delete-position-scaling.test.ts": 35,
-      "src/renderer/src/components/sidebar/worktree-delete-request.test.ts": 9,
-      "src/renderer/src/components/sidebar/worktree-drag-units.test.ts": 10,
-      "src/renderer/src/components/sidebar/worktree-filter-visibility.test.ts": 8,
-      "src/renderer/src/components/sidebar/worktree-header-section-boundaries.test.ts": 6,
-      "src/renderer/src/components/sidebar/worktree-keyboard-cycle.test.ts": 7,
-      "src/renderer/src/components/sidebar/worktree-lineage-drag-drop.test.ts": 15,
-      "src/renderer/src/components/sidebar/worktree-lineage-expansion.performance.test.ts": 159,
-      "src/renderer/src/components/sidebar/worktree-lineage-projection.test.ts": 10,
-      "src/renderer/src/components/sidebar/worktree-lineage-toggle-handler-cache.test.ts": 10,
-      "src/renderer/src/components/sidebar/worktree-list-groups-host-collision.test.ts": 17,
-      "src/renderer/src/components/sidebar/worktree-list-groups-host-labels.test.ts": 23,
-      "src/renderer/src/components/sidebar/worktree-list-groups-imported-worktrees.test.ts": 22,
-      "src/renderer/src/components/sidebar/worktree-list-groups-lineage-nesting.test.ts": 17,
-      "src/renderer/src/components/sidebar/worktree-list-groups-nested-project-groups.test.ts": 16,
-      "src/renderer/src/components/sidebar/worktree-list-groups-notice-host-labels.test.ts": 16,
-      "src/renderer/src/components/sidebar/worktree-list-groups-pending-creations.test.ts": 13,
-      "src/renderer/src/components/sidebar/worktree-list-groups-pinned-host-labels.test.ts": 11,
-      "src/renderer/src/components/sidebar/worktree-list-groups-project-groups.test.ts": 16,
-      "src/renderer/src/components/sidebar/worktree-list-groups-project-host-setups.test.ts": 19,
-      "src/renderer/src/components/sidebar/worktree-list-groups-project-order.test.ts": 1284,
-      "src/renderer/src/components/sidebar/worktree-list-groups-section-label-disambiguation.test.ts": 12,
-      "src/renderer/src/components/sidebar/worktree-list/grouping/build-rows.folder-workspace-lanes.test.ts": 22,
-      "src/renderer/src/components/sidebar/worktree-list/grouping/build-rows.test.ts": 21,
-      "src/renderer/src/components/sidebar/worktree-list/grouping/host-labels.test.ts": 8,
-      "src/renderer/src/components/sidebar/worktree-list/grouping/imported-rows.test.ts": 9,
-      "src/renderer/src/components/sidebar/worktree-list/listing/host-filtering.test.ts": 9,
-      "src/renderer/src/components/sidebar/worktree-list/listing/pending-worktree-creation-keys.test.ts": 5,
-      "src/renderer/src/components/sidebar/worktree-list/listing/review-cache-inputs.test.ts": 6,
-      "src/renderer/src/components/sidebar/worktree-list/listing/use-visible-worktrees.test.tsx": 35,
-      "src/renderer/src/components/sidebar/worktree-list/navigation/active-descendant-option.test.ts": 5,
-      "src/renderer/src/components/sidebar/worktree-list/navigation/folder-reveal.test.ts": 9,
-      "src/renderer/src/components/sidebar/worktree-list/navigation/render-row-lookup.folder-workspace.test.ts": 5,
-      "src/renderer/src/components/sidebar/worktree-list/navigation/use-keyboard.host-identity.test.tsx": 24,
-      "src/renderer/src/components/sidebar/worktree-list/navigation/use-reveal-requests.test.tsx": 124,
-      "src/renderer/src/components/sidebar/worktree-list/navigation/use-selection-host-collision.test.tsx": 18,
-      "src/renderer/src/components/sidebar/worktree-list/rows/FolderPathStatusIndicator.test.tsx": 38,
-      "src/renderer/src/components/sidebar/worktree-list/rows/RepoScanUnavailableIndicator.test.tsx": 57,
-      "src/renderer/src/components/sidebar/worktree-list/rows/indentation.test.ts": 8,
-      "src/renderer/src/components/sidebar/worktree-list/rows/option-dom-host-collision.test.ts": 11,
-      "src/renderer/src/components/sidebar/worktree-list/rows/use-project-group-dialogs-owner-host.test.tsx": 39,
-      "src/renderer/src/components/sidebar/worktree-list/viewport/hard-scroll-up.test.ts": 14,
-      "src/renderer/src/components/sidebar/worktree-list/viewport/scroll-adjustment.test.ts": 15,
-      "src/renderer/src/components/sidebar/worktree-list/viewport/sticky-headers.test.ts": 26,
-      "src/renderer/src/components/sidebar/worktree-list/viewport/use-row-removal-animation.test.ts": 8,
-      "src/renderer/src/components/sidebar/worktree-list/viewport/use-scroll-to-top.test.ts": 45,
-      "src/renderer/src/components/sidebar/worktree-list/viewport/use-scroll-to-top.test.tsx": 21,
-      "src/renderer/src/components/sidebar/worktree-list/viewport/virtual-rows.test.ts": 8,
-      "src/renderer/src/components/sidebar/worktree-list/viewport/visible-refresh.test.ts": 8,
-      "src/renderer/src/components/sidebar/worktree-manual-order-catalog.test.ts": 16,
-      "src/renderer/src/components/sidebar/worktree-manual-order-store-write.test.ts": 22,
-      "src/renderer/src/components/sidebar/worktree-manual-order.test.ts": 315,
-      "src/renderer/src/components/sidebar/worktree-meta-updates.test.ts": 14,
-      "src/renderer/src/components/sidebar/worktree-multi-selection.test.ts": 8,
-      "src/renderer/src/components/sidebar/worktree-name-suggestions.test.ts": 73,
-      "src/renderer/src/components/sidebar/worktree-parent-eligibility.test.ts": 9,
-      "src/renderer/src/components/sidebar/worktree-review-helpers.test.tsx": 22,
-      "src/renderer/src/components/sidebar/worktree-scroll-to-current-button.test.ts": 4,
-      "src/renderer/src/components/sidebar/worktree-sidebar-drag-autoscroll.test.ts": 15,
-      "src/renderer/src/components/sidebar/worktree-sidebar-drag-geometry.test.ts": 27,
-      "src/renderer/src/components/sidebar/worktree-sidebar-drop-preview.test.ts": 13,
-      "src/renderer/src/components/sidebar/worktree-sidebar-pointer-drag-dom.test.ts": 7,
-      "src/renderer/src/components/sidebar/worktree-sidebar-reveal-scroll-settle.test.ts": 3,
-      "src/renderer/src/components/sidebar/worktree-sidebar-reveal.test.ts": 10,
-      "src/renderer/src/components/sidebar/worktree-sidebar-row-preference.test.ts": 7,
-      "src/renderer/src/components/sidebar/worktree-sort-label-ordering.test.ts": 180,
-      "src/renderer/src/components/sidebar/worktree-title-derived-agent-rows.test.ts": 20,
-      "src/renderer/src/components/sidebar/worktree-unambiguous-id-index.test.ts": 5,
-      "src/renderer/src/components/sidebar/worktree-unnest.test.ts": 19,
-      "src/renderer/src/components/sidebar/worktree-visibility-source-provenance.test.ts": 9,
-      "src/renderer/src/components/skills/SkillFreshnessNudge.test.tsx": 53,
-      "src/renderer/src/components/skills/SkillFreshnessStatusPill.test.tsx": 51,
-      "src/renderer/src/components/skills/SkillFreshnessUpdateDialog.test.tsx": 420,
-      "src/renderer/src/components/skills/SkillInstallAgentPicker.test.tsx": 226,
-      "src/renderer/src/components/skills/SkillInstallDialog.test.tsx": 1326,
-      "src/renderer/src/components/skills/SkillInstallManagementDialog.test.tsx": 1515,
-      "src/renderer/src/components/skills/SkillInstallTargetFields.test.tsx": 169,
-      "src/renderer/src/components/skills/SkillInstallWorkspaceCombobox.test.tsx": 537,
-      "src/renderer/src/components/skills/SkillShareDialog.test.tsx": 649,
-      "src/renderer/src/components/skills/SkillSharedLinkRow.test.tsx": 388,
-      "src/renderer/src/components/skills/SkillsPage.test.tsx": 1126,
-      "src/renderer/src/components/skills/skill-bundle-name.test.ts": 8,
-      "src/renderer/src/components/skills/skill-bundle-retry-selection.test.ts": 6,
-      "src/renderer/src/components/skills/skill-delete-copy.test.ts": 23,
-      "src/renderer/src/components/skills/skill-delete-selection.test.ts": 10,
-      "src/renderer/src/components/skills/skill-description-length.test.ts": 4,
-      "src/renderer/src/components/skills/skill-freshness-grouping.test.ts": 18,
-      "src/renderer/src/components/skills/skill-freshness-skipped-reason.test.ts": 11,
-      "src/renderer/src/components/skills/skill-install-progress-state.test.tsx": 23,
-      "src/renderer/src/components/skills/skill-install-provider-groups.test.ts": 11,
-      "src/renderer/src/components/skills/skill-install-workspace-choices.test.ts": 8,
-      "src/renderer/src/components/skills/skill-package-checklist-items.test.ts": 12,
-      "src/renderer/src/components/skills/skill-package-digest.test.ts": 5,
-      "src/renderer/src/components/skills/skill-package-install-risk.test.ts": 8,
-      "src/renderer/src/components/skills/skill-share-link.test.ts": 4,
-      "src/renderer/src/components/skills/skill-share-package-selection.test.ts": 5,
-      "src/renderer/src/components/skills/skill-share-preview-summary.test.ts": 21,
-      "src/renderer/src/components/skills/skill-share-selection.test.ts": 6,
-      "src/renderer/src/components/skills/skill-source-inventory.test.ts": 8,
-      "src/renderer/src/components/skills/skills-filter.test.ts": 5,
-      "src/renderer/src/components/source-control/SourceControlActionVariableChips.test.tsx": 56,
-      "src/renderer/src/components/star-nag/StarNagAgentValueMomentObserver.test.tsx": 86,
-      "src/renderer/src/components/star-nag/StarNagToastHost.test.tsx": 130,
-      "src/renderer/src/components/stats/GrokUsagePane.test.tsx": 106,
-      "src/renderer/src/components/stats/UsageBreakdownSection.test.tsx": 35,
-      "src/renderer/src/components/stats/UsageTrackingPaneShell.test.tsx": 230,
-      "src/renderer/src/components/stats/usage-daily-chart.test.tsx": 300,
-      "src/renderer/src/components/stats/usage-overview-model.test.ts": 202,
-      "src/renderer/src/components/status-bar/CaffeinateStatusSegment.localization.test.tsx": 645,
-      "src/renderer/src/components/status-bar/PetStatusSegment.layout.test.ts": 4,
-      "src/renderer/src/components/status-bar/PortsStatusSegment.host-routing.test.tsx": 100,
-      "src/renderer/src/components/status-bar/PortsStatusSegment.render-stability.test.tsx": 36,
-      "src/renderer/src/components/status-bar/ResourceUsageStatusSegment.rows.test.tsx": 62,
-      "src/renderer/src/components/status-bar/ResourceUsageStatusSegment.session-polling.test.ts": 6,
-      "src/renderer/src/components/status-bar/RuntimeHostStatusRow.test.tsx": 130,
-      "src/renderer/src/components/status-bar/SkillUpdateStatusSegment.test.tsx": 64,
-      "src/renderer/src/components/status-bar/SshStatusSegment.test.ts": 10,
-      "src/renderer/src/components/status-bar/UsagePercentageDisplayChangeNotice.test.tsx": 137,
-      "src/renderer/src/components/status-bar/UsageRosterPanel.test.tsx": 102,
-      "src/renderer/src/components/status-bar/codex-restart-status-summary.test.ts": 6,
-      "src/renderer/src/components/status-bar/codex-status-sign-in.test.tsx": 830,
-      "src/renderer/src/components/status-bar/icons.test.tsx": 16,
-      "src/renderer/src/components/status-bar/inline-usage-bars.test.tsx": 742,
-      "src/renderer/src/components/status-bar/mergeSnapshotAndSessions.test.ts": 29,
-      "src/renderer/src/components/status-bar/ports-status-popover-rows.test.tsx": 50,
-      "src/renderer/src/components/status-bar/provider-account-sync-key.test.ts": 6,
-      "src/renderer/src/components/status-bar/provider-segment-monthly-window.test.tsx": 672,
-      "src/renderer/src/components/status-bar/remote-host-connection-status.test.ts": 10,
-      "src/renderer/src/components/status-bar/resource-manager-terminal-copy.test.ts": 7,
-      "src/renderer/src/components/status-bar/resource-manager-worktree-target.test.ts": 5,
-      "src/renderer/src/components/status-bar/resource-memory-metric-copy.test.ts": 7,
-      "src/renderer/src/components/status-bar/resource-session-bindings.test.ts": 8,
-      "src/renderer/src/components/status-bar/resource-session-classification-parity.test.ts": 3,
-      "src/renderer/src/components/status-bar/resource-session-inventory.test.ts": 9,
-      "src/renderer/src/components/status-bar/resource-session-kill-confirmation.test.ts": 5,
-      "src/renderer/src/components/status-bar/resource-session-navigation.test.ts": 10,
-      "src/renderer/src/components/status-bar/resource-usage-open-slices.test.ts": 10,
-      "src/renderer/src/components/status-bar/resource-usage-space-scan-ready.test.ts": 7,
-      "src/renderer/src/components/status-bar/ssh-status-segment-copy.test.ts": 5,
-      "src/renderer/src/components/status-bar/status-bar-agent-gating.test.ts": 6,
-      "src/renderer/src/components/status-bar/status-bar-context-menu-policy.test.ts": 4,
-      "src/renderer/src/components/status-bar/status-bar-copy-localization.test.tsx": 310,
-      "src/renderer/src/components/status-bar/status-bar-provider-menu-focus.test.tsx": 773,
-      "src/renderer/src/components/status-bar/status-bar-provider-visibility.test.ts": 12,
-      "src/renderer/src/components/status-bar/status-bar-runtime-groups.test.ts": 12,
-      "src/renderer/src/components/status-bar/tooltip.test.ts": 51,
-      "src/renderer/src/components/status-bar/usage-error-copy.test.ts": 5,
-      "src/renderer/src/components/status-bar/usage-percentage-label.test.ts": 4,
-      "src/renderer/src/components/status-bar/usage-provider-settings-target.test.ts": 6,
-      "src/renderer/src/components/status-bar/usage-roster-formatting.test.ts": 6,
-      "src/renderer/src/components/status-bar/usage-roster-row-state.test.ts": 6,
-      "src/renderer/src/components/status-bar/use-resource-session-inventory.test.tsx": 677,
-      "src/renderer/src/components/status-bar/workspace-space-breakdown-list.test.tsx": 69,
-      "src/renderer/src/components/status-bar/workspace-space-delete-host-routing.test.ts": 8,
-      "src/renderer/src/components/status-bar/workspace-space-format.test.ts": 8,
-      "src/renderer/src/components/status-bar/workspace-space-layout.test.ts": 5,
-      "src/renderer/src/components/status-bar/workspace-space-manager-source-boundary.test.ts": 8,
-      "src/renderer/src/components/status-bar/workspace-space-presentation.test.ts": 133,
-      "src/renderer/src/components/tab-bar/BrowserTab.test.tsx": 1412,
-      "src/renderer/src/components/tab-bar/ClientHostedBrowserTabRows.test.tsx": 106,
-      "src/renderer/src/components/tab-bar/EditorFileTab.test.tsx": 840,
-      "src/renderer/src/components/tab-bar/EditorFileTabContextMenu.test.tsx": 505,
-      "src/renderer/src/components/tab-bar/QuickLaunchButton.test.ts": 37,
-      "src/renderer/src/components/tab-bar/RecentTabSwitcher.test.tsx": 46,
-      "src/renderer/src/components/tab-bar/SortableTab.rename-shortcut.test.tsx": 739,
-      "src/renderer/src/components/tab-bar/SortableTab.update-depth-probe.test.tsx": 113,
-      "src/renderer/src/components/tab-bar/SortableTabContextMenu.test.tsx": 121,
-      "src/renderer/src/components/tab-bar/TabBar.client-hosted-row-active-state.test.ts": 1116,
-      "src/renderer/src/components/tab-bar/TabBar.context-menu.test.ts": 2180,
-      "src/renderer/src/components/tab-bar/TabBar.windows-shell-launch.test.ts": 2043,
-      "src/renderer/src/components/tab-bar/TabBar.windows-shell-remote-runtime.test.ts": 1451,
-      "src/renderer/src/components/tab-bar/TabBar.windows-shell-ssh-host.test.ts": 1914,
-      "src/renderer/src/components/tab-bar/TabBar.worktree-write-gate.test.tsx": 1048,
-      "src/renderer/src/components/tab-bar/TabBar.worktree-write-gate.windows.test.tsx": 477,
-      "src/renderer/src/components/tab-bar/TabBarCreateEntry.history.test.tsx": 100,
-      "src/renderer/src/components/tab-bar/TabBarCreateEntry.keyboard.test.tsx": 166,
-      "src/renderer/src/components/tab-bar/TabBarCreateEntry.search.test.tsx": 199,
-      "src/renderer/src/components/tab-bar/TabBarCreateEntry.tab-results.test.tsx": 171,
-      "src/renderer/src/components/tab-bar/TabBarCreateEntryRow.test.tsx": 102,
-      "src/renderer/src/components/tab-bar/TabBarQuickCommandItem.test.tsx": 106,
-      "src/renderer/src/components/tab-bar/TabBarQuickCommandsMenu.keyboard.test.ts": 134,
-      "src/renderer/src/components/tab-bar/TabStripScrollIndicator.test.tsx": 63,
-      "src/renderer/src/components/tab-bar/TerminalTabLeadingIcon.test.tsx": 36,
-      "src/renderer/src/components/tab-bar/client-hosted-browser-row-strip-placement.test.ts": 6,
-      "src/renderer/src/components/tab-bar/drop-indicator.test.ts": 8,
-      "src/renderer/src/components/tab-bar/editor-tab-local-open-guard.test.ts": 5,
-      "src/renderer/src/components/tab-bar/group-tab-order.test.ts": 8,
-      "src/renderer/src/components/tab-bar/middle-button-default-guard.test.ts": 5,
-      "src/renderer/src/components/tab-bar/native-chat-tab-agent-evidence.test.ts": 9,
-      "src/renderer/src/components/tab-bar/open-tab-entry-dedupe.test.ts": 8,
-      "src/renderer/src/components/tab-bar/open-tab-search-retention.test.ts": 20,
-      "src/renderer/src/components/tab-bar/open-tab-search.test.ts": 35,
-      "src/renderer/src/components/tab-bar/open-tab-selection-routing.test.ts": 12,
-      "src/renderer/src/components/tab-bar/query-token-match.test.ts": 7,
-      "src/renderer/src/components/tab-bar/recent-tab-switching.test.ts": 8,
-      "src/renderer/src/components/tab-bar/reconcile-order.test.ts": 6,
-      "src/renderer/src/components/tab-bar/tab-agent-launch-options.test.ts": 15,
-      "src/renderer/src/components/tab-bar/tab-agent-types-by-tab-id.test.ts": 13,
-      "src/renderer/src/components/tab-bar/tab-bar-item-surface.client-hosted-active-state.test.tsx": 14,
-      "src/renderer/src/components/tab-bar/tab-context-menu-consistency.test.tsx": 8,
-      "src/renderer/src/components/tab-bar/tab-create-entry-action.test.ts": 35,
-      "src/renderer/src/components/tab-bar/tab-create-entry-classifier.test.ts": 50,
-      "src/renderer/src/components/tab-bar/tab-create-entry-file-matches.test.ts": 36,
-      "src/renderer/src/components/tab-bar/tab-create-entry-forced-search.test.ts": 4,
-      "src/renderer/src/components/tab-bar/tab-create-entry-history-placement.test.ts": 6,
-      "src/renderer/src/components/tab-bar/tab-create-entry-local-path.test.ts": 285,
-      "src/renderer/src/components/tab-bar/tab-create-menu-options.test.ts": 16,
-      "src/renderer/src/components/tab-bar/tab-move-to-pane-column.test.ts": 12,
-      "src/renderer/src/components/tab-bar/tab-strip-content-resize-observers.test.ts": 11,
-      "src/renderer/src/components/tab-bar/tab-strip-overflow-navigation.test.ts": 6,
-      "src/renderer/src/components/tab-bar/tab-strip-pointer-activation.test.tsx": 35,
-      "src/renderer/src/components/tab-bar/tab-strip-scroll-metrics.test.ts": 6,
-      "src/renderer/src/components/tab-bar/tab-title-tooltip.test.tsx": 28,
-      "src/renderer/src/components/tab-bar/terminal-tab-activity-status.test.ts": 46,
-      "src/renderer/src/components/tab-bar/terminal-tab-spinner-launch-agent.test.ts": 15,
-      "src/renderer/src/components/tab-bar/use-open-tab-search.test.ts": 221,
-      "src/renderer/src/components/tab-bar/use-tab-bar-quick-command-search-input.test.ts": 29,
-      "src/renderer/src/components/tab-bar/windows-shell-launch.test.ts": 5,
-      "src/renderer/src/components/tab-bar/windows-shell-menu-visibility.test.ts": 7,
-      "src/renderer/src/components/tab-group/RetainedPaneHost.test.tsx": 75,
-      "src/renderer/src/components/tab-group/TabGroupPanel.context-menu.test.ts": 7,
-      "src/renderer/src/components/tab-group/TabGroupSplitLayout.drag.test.tsx": 128,
-      "src/renderer/src/components/tab-group/TabGroupSplitLayout.test.ts": 10,
-      "src/renderer/src/components/tab-group/TabPaneColumnSplitDragOverlay.test.tsx": 7,
-      "src/renderer/src/components/tab-group/tab-drag-pointer.test.ts": 4,
-      "src/renderer/src/components/tab-group/tab-drag-preview-activation.test.ts": 10,
-      "src/renderer/src/components/tab-group/tab-drag-retained-guest-passthrough.test.tsx": 60,
-      "src/renderer/src/components/tab-group/tab-drop-zone.test.ts": 4,
-      "src/renderer/src/components/tab-group/tab-group-body-anchor.test.ts": 4,
-      "src/renderer/src/components/tab-group/tab-group-panel-split-target.test.ts": 18,
-      "src/renderer/src/components/tab-group/tab-insertion.test.ts": 7,
-      "src/renderer/src/components/tab-group/useTabDragSplit.test.ts": 78,
-      "src/renderer/src/components/tab-group/useTabGroupCreationCommands.local-shell.test.ts": 679,
-      "src/renderer/src/components/tab-group/useTabGroupTabCloseCommands.structured-session.test.ts": 269,
-      "src/renderer/src/components/tab-group/useTabGroupTabCloseCommands.test.tsx": 69,
-      "src/renderer/src/components/tab-group/useTabGroupWorkspaceModel.focus.test.ts": 1235,
-      "src/renderer/src/components/task-drawer-source-boundary.test.ts": 8,
-      "src/renderer/src/components/task-page-cache-selectors.test.ts": 11,
-      "src/renderer/src/components/task-page-checks-pill.test.ts": 5,
-      "src/renderer/src/components/task-page-default-repo-selection.test.ts": 18,
-      "src/renderer/src/components/task-page-empty-state.test.ts": 14,
-      "src/renderer/src/components/task-page-github-dialog-state-authority.test.ts": 10,
-      "src/renderer/src/components/task-page-github-issue-creation.test.ts": 5,
-      "src/renderer/src/components/task-page-github-list-scroll-restore.test.ts": 20,
-      "src/renderer/src/components/task-page-github-resume-cache.test.ts": 17,
-      "src/renderer/src/components/task-page-github-reviewer-suggestions.test.ts": 6,
-      "src/renderer/src/components/task-page-github-status-actions.test.ts": 7,
-      "src/renderer/src/components/task-page-github-status-state.test.ts": 7,
-      "src/renderer/src/components/task-page-github-task-kind.test.ts": 15,
-      "src/renderer/src/components/task-page-github-work-item-filter-membership.test.ts": 10,
-      "src/renderer/src/components/task-page-github-work-item-mutation-patches.test.ts": 13,
-      "src/renderer/src/components/task-page-github-work-item-mutation-regressions.test.ts": 22,
-      "src/renderer/src/components/task-page-github-work-item-mutations.test.ts": 24,
-      "src/renderer/src/components/task-page-github-work-item-status.test.ts": 9,
-      "src/renderer/src/components/task-page-gitlab-task-filters.test.ts": 5,
-      "src/renderer/src/components/task-page-initial-selection-scaling.test.tsx": 41,
-      "src/renderer/src/components/task-page-jira-cache-selectors.test.ts": 7,
-      "src/renderer/src/components/task-page-jira-create-fields.test.ts": 9,
-      "src/renderer/src/components/task-page-jira-grouping.test.ts": 194,
-      "src/renderer/src/components/task-page-jira-item-source-context.test.ts": 7,
-      "src/renderer/src/components/task-page-jira-load-state.test.ts": 7,
-      "src/renderer/src/components/task-page-jira-project-selection.test.ts": 8,
-      "src/renderer/src/components/task-page-jira-sort-controls.test.tsx": 186,
-      "src/renderer/src/components/task-page-jira-sorting.test.ts": 151,
-      "src/renderer/src/components/task-page-linear-in-orca-issues.test.ts": 14,
-      "src/renderer/src/components/task-page-linear-issue-dialog-popover-scroll.test.ts": 9,
-      "src/renderer/src/components/task-page-linear-issue-empty-state.test.ts": 6,
-      "src/renderer/src/components/task-page-linear-issue-grouping.test.ts": 11,
-      "src/renderer/src/components/task-page-linear-issue-request.test.ts": 6,
-      "src/renderer/src/components/task-page-linear-team-selection.test.ts": 9,
-      "src/renderer/src/components/task-page-list-chrome-visibility.test.ts": 7,
-      "src/renderer/src/components/task-page-localized-options.test.ts": 79,
-      "src/renderer/src/components/task-page-mutation-page-allocation.test.ts": 8,
-      "src/renderer/src/components/task-page-new-issue-draft.test.ts": 6,
-      "src/renderer/src/components/task-page-pagination-page-numbers.test.ts": 7,
-      "src/renderer/src/components/task-page-pr-check-summary.test.ts": 6,
-      "src/renderer/src/components/task-page-repo-source-context.test.ts": 10,
-      "src/renderer/src/components/task-page-repo-source-divergence.test.ts": 5,
-      "src/renderer/src/components/task-page-source-switch-boundary.test.ts": 9,
-      "src/renderer/src/components/task-page-task-creation-drafts.test.ts": 10,
-      "src/renderer/src/components/task-page-task-source-host-availability.test.ts": 11,
-      "src/renderer/src/components/task-page-work-item-pagination.test.ts": 18,
-      "src/renderer/src/components/task-page-workspace-composer-boundary.test.ts": 223,
-      "src/renderer/src/components/task-source-context-summary.test.ts": 17,
-      "src/renderer/src/components/task-source-provider-availability.test.ts": 10,
-      "src/renderer/src/components/terminal-pane/CloseTerminalDialog.test.tsx": 135,
-      "src/renderer/src/components/terminal-pane/MobileDriverOverlay.test.tsx": 12,
-      "src/renderer/src/components/terminal-pane/PinnedTabCloseDialog.test.tsx": 200,
-      "src/renderer/src/components/terminal-pane/RunningTerminalCloseDialog.test.tsx": 269,
-      "src/renderer/src/components/terminal-pane/SessionRestoredBanner.test.tsx": 33,
-      "src/renderer/src/components/terminal-pane/TerminalAgentSessionForkDialog.test.tsx": 207,
-      "src/renderer/src/components/terminal-pane/TerminalContextMenu.test.tsx": 58,
-      "src/renderer/src/components/terminal-pane/TerminalErrorToast.test.ts": 127,
-      "src/renderer/src/components/terminal-pane/TerminalPaneHeaderOverlay.test.tsx": 101,
-      "src/renderer/src/components/terminal-pane/TerminalPaneNativeChatPortal.test.tsx": 24,
-      "src/renderer/src/components/terminal-pane/TerminalPaneOverlayLayer.react185.test.tsx": 60,
-      "src/renderer/src/components/terminal-pane/TerminalProcessExitOverlay.test.tsx": 76,
-      "src/renderer/src/components/terminal-pane/TerminalRemoteRuntimeReconnectBanner.test.tsx": 70,
-      "src/renderer/src/components/terminal-pane/TerminalSshReconnectOverlay.test.tsx": 192,
-      "src/renderer/src/components/terminal-pane/agent-completion-coordinator-attention-dispatch.test.ts": 39,
-      "src/renderer/src/components/terminal-pane/agent-completion-coordinator-completion-replay-guard.test.ts": 20,
-      "src/renderer/src/components/terminal-pane/agent-completion-coordinator-dispose-leak.test.ts": 13,
-      "src/renderer/src/components/terminal-pane/agent-completion-coordinator-hook-done-quiet-window.test.ts": 28,
-      "src/renderer/src/components/terminal-pane/agent-completion-coordinator-hook-title-precedence.test.ts": 34,
-      "src/renderer/src/components/terminal-pane/agent-completion-coordinator-monitoring-turn-end.test.ts": 19,
-      "src/renderer/src/components/terminal-pane/agent-completion-coordinator-pending-title-inspection.test.ts": 18,
-      "src/renderer/src/components/terminal-pane/agent-completion-coordinator-process-cadence.test.ts": 44,
-      "src/renderer/src/components/terminal-pane/agent-completion-coordinator-queued-inspection-disposal.test.ts": 24,
-      "src/renderer/src/components/terminal-pane/agent-completion-coordinator-stamped-turn-boundary.test.ts": 20,
-      "src/renderer/src/components/terminal-pane/agent-completion-coordinator-stamped-turn-replay.test.ts": 23,
-      "src/renderer/src/components/terminal-pane/agent-completion-no-evidence-cadence.test.ts": 47,
-      "src/renderer/src/components/terminal-pane/agent-completion-poll-interval.test.ts": 185,
-      "src/renderer/src/components/terminal-pane/agent-completion-stale-evidence-backoff.test.ts": 6,
-      "src/renderer/src/components/terminal-pane/agent-completion-steady-state-opt-in.test.ts": 11,
-      "src/renderer/src/components/terminal-pane/agent-hook-terminal-lifecycle.test.ts": 11,
-      "src/renderer/src/components/terminal-pane/agent-interrupt-inference.test.ts": 30,
-      "src/renderer/src/components/terminal-pane/agent-process-inspection-queue-rejection-containment.test.ts": 14,
-      "src/renderer/src/components/terminal-pane/agent-process-inspection-round.test.ts": 18,
-      "src/renderer/src/components/terminal-pane/agent-question-answered-inference.test.ts": 14,
-      "src/renderer/src/components/terminal-pane/cache-timer-seeding.test.ts": 8,
-      "src/renderer/src/components/terminal-pane/codex-auto-approval-notification-suppression.test.ts": 112,
-      "src/renderer/src/components/terminal-pane/codex-backfill-error-detector.test.ts": 5,
-      "src/renderer/src/components/terminal-pane/codex-detached-pane-restart.test.ts": 305,
-      "src/renderer/src/components/terminal-pane/command-code-done-settle.test.ts": 18,
-      "src/renderer/src/components/terminal-pane/command-code-output-ownership.test.ts": 8,
-      "src/renderer/src/components/terminal-pane/compose-active-terminal-theme.test.ts": 7,
-      "src/renderer/src/components/terminal-pane/deferred-reattach-live-data-queue.test.ts": 173,
-      "src/renderer/src/components/terminal-pane/deferred-split-pane-handoff.test.ts": 15,
-      "src/renderer/src/components/terminal-pane/desktop-fit-fallback.test.ts": 9,
-      "src/renderer/src/components/terminal-pane/direct-ssh-hidden-output-restore-unavailable-banner.test.ts": 1045,
-      "src/renderer/src/components/terminal-pane/edge-wrapped-terminal-http-links.test.ts": 31,
-      "src/renderer/src/components/terminal-pane/expand-collapse-render-stability.test.ts": 26,
-      "src/renderer/src/components/terminal-pane/expand-collapse.test.ts": 8,
-      "src/renderer/src/components/terminal-pane/focus-terminal-pane-event.test.ts": 10,
-      "src/renderer/src/components/terminal-pane/focused-pane-rim-flash.test.ts": 7,
-      "src/renderer/src/components/terminal-pane/force-park-buffer-capture.test.ts": 5,
-      "src/renderer/src/components/terminal-pane/git-bash-console-capacity.test.ts": 12,
-      "src/renderer/src/components/terminal-pane/hard-wrapped-terminal-http-links.test.ts": 34,
-      "src/renderer/src/components/terminal-pane/hidden-output-restore-scheduler.test.ts": 16,
-      "src/renderer/src/components/terminal-pane/hidden-reveal-reconciliation.fuzz.test.ts": 7500,
-      "src/renderer/src/components/terminal-pane/issue-12112-agent-pane-startup-color-reply-leak.repro.test.ts": 21,
-      "src/renderer/src/components/terminal-pane/issue-4631-terminal-hover-link-provider.repro.test.ts": 177,
-      "src/renderer/src/components/terminal-pane/keyboard-handlers-ime-composing-chord.test.tsx": 48,
-      "src/renderer/src/components/terminal-pane/keyboard-handlers-ime-enter-keyup.test.tsx": 59,
-      "src/renderer/src/components/terminal-pane/keyboard-handlers-ime.test.tsx": 54,
-      "src/renderer/src/components/terminal-pane/keyboard-handlers.test.ts": 17,
-      "src/renderer/src/components/terminal-pane/layout-serialization.test.ts": 19,
-      "src/renderer/src/components/terminal-pane/manual-terminal-worktree-park-eligibility.test.ts": 8,
-      "src/renderer/src/components/terminal-pane/merge-captured-leaf-state.test.ts": 16,
-      "src/renderer/src/components/terminal-pane/mobile-driver-overlay-collapse.test.ts": 7,
-      "src/renderer/src/components/terminal-pane/mobile-driver-overlay-focus.test.ts": 5,
-      "src/renderer/src/components/terminal-pane/mobile-driver-overlay-visibility.test.ts": 6,
-      "src/renderer/src/components/terminal-pane/mouse-hide-while-typing.test.ts": 6,
-      "src/renderer/src/components/terminal-pane/native-chat-leaf-title-agent.test.ts": 13,
-      "src/renderer/src/components/terminal-pane/osc52-clipboard-default-on-notice.test.ts": 58,
-      "src/renderer/src/components/terminal-pane/osc52-clipboard-toast.test.ts": 69,
-      "src/renderer/src/components/terminal-pane/osc52-clipboard.test.ts": 122,
-      "src/renderer/src/components/terminal-pane/override-affected-panes.test.ts": 7,
-      "src/renderer/src/components/terminal-pane/paired-reconnect-multi-pane-materialization.test.ts": 1727,
-      "src/renderer/src/components/terminal-pane/pane-agent-session-id.test.ts": 5,
-      "src/renderer/src/components/terminal-pane/pane-foreground-agent-tracker.test.ts": 59,
-      "src/renderer/src/components/terminal-pane/pane-foreground-inspect-observation-identity.test.ts": 10,
-      "src/renderer/src/components/terminal-pane/pane-helpers.test.ts": 9,
-      "src/renderer/src/components/terminal-pane/pane-title-overlay-rects.test.ts": 6,
-      "src/renderer/src/components/terminal-pane/parked-terminal-byte-watcher.test.ts": 2029,
-      "src/renderer/src/components/terminal-pane/parked-terminal-command-status.test.ts": 56,
-      "src/renderer/src/components/terminal-pane/parse-osc7.test.ts": 5,
-      "src/renderer/src/components/terminal-pane/pty-buffer-serializer.test.ts": 19,
-      "src/renderer/src/components/terminal-pane/pty-connection-agent-session-resume.test.ts": 1727,
-      "src/renderer/src/components/terminal-pane/pty-connection-cold-restore-agent-resume.test.ts": 1162,
-      "src/renderer/src/components/terminal-pane/pty-connection-cold-restore-repaint.test.ts": 699,
-      "src/renderer/src/components/terminal-pane/pty-connection-cold-restore-resume-command.test.ts": 709,
-      "src/renderer/src/components/terminal-pane/pty-connection-command-finished-cleanup.test.ts": 1591,
-      "src/renderer/src/components/terminal-pane/pty-connection-daemon-snapshot-replay.test.ts": 3135,
-      "src/renderer/src/components/terminal-pane/pty-connection-deferred-reattach-live-output.test.ts": 1466,
-      "src/renderer/src/components/terminal-pane/pty-connection-deferred-ssh-passphrase.test.ts": 1225,
-      "src/renderer/src/components/terminal-pane/pty-connection-deliberate-sleep-guard.test.ts": 1131,
-      "src/renderer/src/components/terminal-pane/pty-connection-direct-ssh-reattach-retry.test.ts": 1727,
-      "src/renderer/src/components/terminal-pane/pty-connection-direct-ssh-spawn-retry.test.ts": 1570,
-      "src/renderer/src/components/terminal-pane/pty-connection-foreground-agent-routing.test.ts": 1216,
-      "src/renderer/src/components/terminal-pane/pty-connection-foreground-agent-sampling.test.ts": 1659,
-      "src/renderer/src/components/terminal-pane/pty-connection-foreground-routing-confirmation.test.ts": 624,
-      "src/renderer/src/components/terminal-pane/pty-connection-foreground-write-path.test.ts": 1254,
-      "src/renderer/src/components/terminal-pane/pty-connection-fresh-spawn-guards.test.ts": 1432,
-      "src/renderer/src/components/terminal-pane/pty-connection-hibernation-wake.test.ts": 1373,
-      "src/renderer/src/components/terminal-pane/pty-connection-hidden-atlas-recovery.test.ts": 1032,
-      "src/renderer/src/components/terminal-pane/pty-connection-hidden-backlog-reconciliation.test.ts": 939,
-      "src/renderer/src/components/terminal-pane/pty-connection-hidden-backlog-snapshot.test.ts": 3190,
-      "src/renderer/src/components/terminal-pane/pty-connection-hidden-codex-queries.test.ts": 1467,
-      "src/renderer/src/components/terminal-pane/pty-connection-hidden-delivery-gate.test.ts": 1677,
-      "src/renderer/src/components/terminal-pane/pty-connection-hidden-output-restore.test.ts": 597,
-      "src/renderer/src/components/terminal-pane/pty-connection-hidden-query-snapshot-restore.test.ts": 1298,
-      "src/renderer/src/components/terminal-pane/pty-connection-hidden-restore-fit-overflow.test.ts": 589,
-      "src/renderer/src/components/terminal-pane/pty-connection-hidden-snapshot-live-overlap.test.ts": 814,
-      "src/renderer/src/components/terminal-pane/pty-connection-hidden-snapshot-resize-signals.test.ts": 1012,
-      "src/renderer/src/components/terminal-pane/pty-connection-hidden-tui-snapshot-replay.test.ts": 835,
-      "src/renderer/src/components/terminal-pane/pty-connection-hook-completion-bell-arbitration.test.ts": 1536,
-      "src/renderer/src/components/terminal-pane/pty-connection-hook-completion-side-effects.test.ts": 1433,
-      "src/renderer/src/components/terminal-pane/pty-connection-hook-idle-arbitration.test.ts": 1039,
-      "src/renderer/src/components/terminal-pane/pty-connection-interrupt-inference.test.ts": 916,
-      "src/renderer/src/components/terminal-pane/pty-connection-main-side-effect-authority.test.ts": 922,
-      "src/renderer/src/components/terminal-pane/pty-connection-mode-2031-subscriptions.test.ts": 1134,
-      "src/renderer/src/components/terminal-pane/pty-connection-notification-settings-gating.test.ts": 869,
-      "src/renderer/src/components/terminal-pane/pty-connection-parked-ssh-snapshot.test.ts": 1744,
-      "src/renderer/src/components/terminal-pane/pty-connection-post-dispose-restore-termination.test.ts": 771,
-      "src/renderer/src/components/terminal-pane/pty-connection-pty-exit-teardown.test.ts": 3670,
-      "src/renderer/src/components/terminal-pane/pty-connection-queued-startup-consume.test.ts": 705,
-      "src/renderer/src/components/terminal-pane/pty-connection-reattach-binding.test.ts": 2385,
-      "src/renderer/src/components/terminal-pane/pty-connection-reattach-mode-reset.test.ts": 1987,
-      "src/renderer/src/components/terminal-pane/pty-connection-remote-runtime-attach.test.ts": 1224,
-      "src/renderer/src/components/terminal-pane/pty-connection-remote-snapshot-source-grid.test.ts": 807,
-      "src/renderer/src/components/terminal-pane/pty-connection-renderer-risk-repaint.test.ts": 1489,
-      "src/renderer/src/components/terminal-pane/pty-connection-replay-payload-handling.test.ts": 1203,
-      "src/renderer/src/components/terminal-pane/pty-connection-restored-baseline-shortfall.test.ts": 835,
-      "src/renderer/src/components/terminal-pane/pty-connection-runtime-owner-spawn-routing.test.ts": 925,
-      "src/renderer/src/components/terminal-pane/pty-connection-session-liveness.test.ts": 1912,
-      "src/renderer/src/components/terminal-pane/pty-connection-setup-split-spawn.test.ts": 1083,
-      "src/renderer/src/components/terminal-pane/pty-connection-sleeping-resume-banner.test.ts": 798,
-      "src/renderer/src/components/terminal-pane/pty-connection-spawn-left-pane-unbound.test.ts": 897,
-      "src/renderer/src/components/terminal-pane/pty-connection-split-cwd-resolution.test.ts": 47,
-      "src/renderer/src/components/terminal-pane/pty-connection-ssh-startup-draft-delivery.test.ts": 698,
-      "src/renderer/src/components/terminal-pane/pty-connection-stalled-hidden-restore.test.ts": 3547,
-      "src/renderer/src/components/terminal-pane/pty-connection-startup-command-delivery.test.ts": 876,
-      "src/renderer/src/components/terminal-pane/pty-connection-task-complete-dispatch.test.ts": 1186,
-      "src/renderer/src/components/terminal-pane/pty-connection-terminal-input-gating.test.ts": 4079,
-      "src/renderer/src/components/terminal-pane/pty-connection-typed-agent-identity.test.ts": 1778,
-      "src/renderer/src/components/terminal-pane/pty-connection-visibility-resume-size.test.ts": 1757,
-      "src/renderer/src/components/terminal-pane/pty-connection-visible-pane-output-pause-latch.test.ts": 860,
-      "src/renderer/src/components/terminal-pane/pty-connection-windows-cjk-repaint.test.ts": 1118,
-      "src/renderer/src/components/terminal-pane/pty-connection-windows-keyboard-reset.test.ts": 1660,
-      "src/renderer/src/components/terminal-pane/pty-connection/direct-ssh-reattach-recovery.test.ts": 8,
-      "src/renderer/src/components/terminal-pane/pty-connection/foreground-output-budgets.test.ts": 4,
-      "src/renderer/src/components/terminal-pane/pty-connection/pane-pty-layout-binding.test.ts": 6,
-      "src/renderer/src/components/terminal-pane/pty-connection/reattach-payload-context.test.ts": 7,
-      "src/renderer/src/components/terminal-pane/pty-connection/reattach-payload-ssh-reconnect-model-paint.test.ts": 16,
-      "src/renderer/src/components/terminal-pane/pty-connection/reattach-success-settle.test.ts": 12,
-      "src/renderer/src/components/terminal-pane/pty-connection/ssh-session-gone-verdict.test.ts": 5,
-      "src/renderer/src/components/terminal-pane/pty-connection/terminal-tab-id.test.ts": 6,
-      "src/renderer/src/components/terminal-pane/pty-connection/unbound-pane-spawn-recovery.test.ts": 12,
-      "src/renderer/src/components/terminal-pane/pty-dispatcher-delivery-interest.test.ts": 98,
-      "src/renderer/src/components/terminal-pane/pty-dispatcher-delivery-resync.test.ts": 56,
-      "src/renderer/src/components/terminal-pane/pty-dispatcher-pi-routing.test.ts": 317,
-      "src/renderer/src/components/terminal-pane/pty-dispatcher-push-reattach.test.ts": 89,
-      "src/renderer/src/components/terminal-pane/pty-input-write-queue.test.ts": 750,
-      "src/renderer/src/components/terminal-pane/pty-model-restore-channel.test.ts": 10,
-      "src/renderer/src/components/terminal-pane/pty-pre-handler-buffer-warn-eviction.test.ts": 17,
-      "src/renderer/src/components/terminal-pane/pty-pre-handler-buffer.test.ts": 47,
-      "src/renderer/src/components/terminal-pane/pty-preconnect-input-buffer.test.ts": 50,
-      "src/renderer/src/components/terminal-pane/pty-renderer-delivery-claims.test.ts": 10,
-      "src/renderer/src/components/terminal-pane/pty-shutdown-data-suspension.test.ts": 10,
-      "src/renderer/src/components/terminal-pane/pty-shutdown-exit-deferral.test.ts": 68,
-      "src/renderer/src/components/terminal-pane/pty-shutdown-output-queue.test.ts": 1985,
-      "src/renderer/src/components/terminal-pane/pty-side-effect-pending-census.test.ts": 161,
-      "src/renderer/src/components/terminal-pane/pty-size-reassertion.test.ts": 12,
-      "src/renderer/src/components/terminal-pane/pty-size-reconcile.test.ts": 14,
-      "src/renderer/src/components/terminal-pane/pty-transport-connect-spawn.test.ts": 383,
-      "src/renderer/src/components/terminal-pane/pty-transport-detach-attach-handoff.test.ts": 238,
-      "src/renderer/src/components/terminal-pane/pty-transport-eager-buffer-replay.test.ts": 321,
-      "src/renderer/src/components/terminal-pane/pty-transport-handler-suspension.test.ts": 311,
-      "src/renderer/src/components/terminal-pane/pty-transport-input-write.test.ts": 759,
-      "src/renderer/src/components/terminal-pane/pty-transport-output-side-effects.test.ts": 310,
-      "src/renderer/src/components/terminal-pane/pty-transport-pi-coalesce.test.ts": 169,
-      "src/renderer/src/components/terminal-pane/pty-transport-pi-spinner.test.ts": 165,
-      "src/renderer/src/components/terminal-pane/pty-transport-reattach-admission.test.ts": 298,
-      "src/renderer/src/components/terminal-pane/pty-transport-recycled-pty-incarnation.test.ts": 157,
-      "src/renderer/src/components/terminal-pane/pty-transport-spawn-errors.test.ts": 148,
-      "src/renderer/src/components/terminal-pane/regular-terminal-focus-ownership.test.ts": 22,
-      "src/renderer/src/components/terminal-pane/remote-desktop-viewport-claim.test.ts": 5,
-      "src/renderer/src/components/terminal-pane/remote-execution-host-pty.test.ts": 5,
-      "src/renderer/src/components/terminal-pane/remote-hidden-output-restore-outcomes.test.ts": 1241,
-      "src/renderer/src/components/terminal-pane/remote-hidden-output-restore-unavailable-banner.repro.test.ts": 1012,
-      "src/renderer/src/components/terminal-pane/remote-pane-layout-push.test.ts": 10,
-      "src/renderer/src/components/terminal-pane/remote-runtime-connect-failure-recovery.test.ts": 1731,
-      "src/renderer/src/components/terminal-pane/remote-runtime-error-surface-dismissal.test.ts": 1369,
-      "src/renderer/src/components/terminal-pane/remote-runtime-outage-toast-flood-and-stuck-reconnect.test.ts": 2153,
-      "src/renderer/src/components/terminal-pane/remote-runtime-pty-batching.test.ts": 72,
-      "src/renderer/src/components/terminal-pane/remote-runtime-pty-deadline-reattach.test.ts": 2204,
-      "src/renderer/src/components/terminal-pane/remote-runtime-pty-latched-pane-retention.test.ts": 4200,
-      "src/renderer/src/components/terminal-pane/remote-runtime-pty-query-reply-immediate.test.ts": 2087,
-      "src/renderer/src/components/terminal-pane/remote-runtime-pty-recovery-state.test.ts": 26,
-      "src/renderer/src/components/terminal-pane/remote-runtime-pty-snapshot-escape-tail.test.ts": 1389,
-      "src/renderer/src/components/terminal-pane/remote-runtime-pty-snapshot-source-grid.test.ts": 1605,
-      "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-activation-inventory-fallback.test.ts": 2053,
-      "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-attach-subscription.test.ts": 3506,
-      "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-create-handoff.test.ts": 2653,
-      "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-create-outcome-recovery.test.ts": 2166,
-      "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-end-verdict.test.ts": 1292,
-      "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-expired-pane-recovery.test.ts": 2463,
-      "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-host-session-launch.test.ts": 2411,
-      "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-host-surface-replacement.test.ts": 5095,
-      "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-input-coalescing.test.ts": 3404,
-      "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-input-fallback.test.ts": 2595,
-      "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-pane-handle-resolution.test.ts": 2613,
-      "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-pending-host-surface-attach.test.ts": 1727,
-      "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-snapshot-replay.test.ts": 1654,
-      "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-split-leaf-activation.test.ts": 2871,
-      "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-stale-handle-recovery.test.ts": 2313,
-      "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-sticky-replacement-policy.test.ts": 2038,
-      "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-stream-reconnect.test.ts": 3273,
-      "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-web-mirror-recovery.test.ts": 2711,
-      "src/renderer/src/components/terminal-pane/remote-runtime-resubscribe-failure-recovery-routing.test.ts": 1695,
-      "src/renderer/src/components/terminal-pane/renderer-owned-agent-status-registry.test.ts": 8,
-      "src/renderer/src/components/terminal-pane/replay-guard.test.ts": 37,
-      "src/renderer/src/components/terminal-pane/replayed-scrollback-store-release.test.ts": 5,
-      "src/renderer/src/components/terminal-pane/repro-8299-shift-space-input-source.test.ts": 14,
-      "src/renderer/src/components/terminal-pane/repro-8832-url-next-line.test.ts": 19,
-      "src/renderer/src/components/terminal-pane/resolve-split-cwd.test.ts": 13,
-      "src/renderer/src/components/terminal-pane/restored-snapshot-coverage.test.ts": 5,
-      "src/renderer/src/components/terminal-pane/session-restored-banner-pane-state.test.tsx": 64,
-      "src/renderer/src/components/terminal-pane/shell-ready-marker-scan.test.ts": 6,
-      "src/renderer/src/components/terminal-pane/shutdown-buffer-captures.test.ts": 9,
-      "src/renderer/src/components/terminal-pane/sleeping-record-park-exemption.test.ts": 7,
-      "src/renderer/src/components/terminal-pane/split-right-white-screen.test.ts": 8,
-      "src/renderer/src/components/terminal-pane/ssh-pane-connect-gate.test.ts": 9,
-      "src/renderer/src/components/terminal-pane/ssh-reattach-model-restore.test.ts": 16,
-      "src/renderer/src/components/terminal-pane/ssh-reconnect-model-paint-gate.test.ts": 7,
-      "src/renderer/src/components/terminal-pane/stale-document-visibility.test.ts": 34,
-      "src/renderer/src/components/terminal-pane/terminal-agent-paste-bracketing.test.ts": 15,
-      "src/renderer/src/components/terminal-pane/terminal-agent-session-continuation.test.ts": 13,
-      "src/renderer/src/components/terminal-pane/terminal-agent-session-fork.test.ts": 152,
-      "src/renderer/src/components/terminal-pane/terminal-alternate-screen-parse.test.ts": 30,
-      "src/renderer/src/components/terminal-pane/terminal-appearance.test.ts": 28,
-      "src/renderer/src/components/terminal-pane/terminal-bracketed-paste.test.ts": 16,
-      "src/renderer/src/components/terminal-pane/terminal-capability-replies.test.ts": 66,
-      "src/renderer/src/components/terminal-pane/terminal-captured-input-dispatch.test.ts": 16,
-      "src/renderer/src/components/terminal-pane/terminal-cjk-cursor-cell-placement.test.ts": 68,
-      "src/renderer/src/components/terminal-pane/terminal-clipboard-event-paste.test.ts": 10,
-      "src/renderer/src/components/terminal-pane/terminal-clipboard-paste.test.ts": 12,
-      "src/renderer/src/components/terminal-pane/terminal-cold-park-exempt-flip.react185.test.tsx": 37,
-      "src/renderer/src/components/terminal-pane/terminal-cold-park-pre-gate-loop.react185.test.tsx": 64,
-      "src/renderer/src/components/terminal-pane/terminal-cold-park-recheck-deadlines.test.ts": 12,
-      "src/renderer/src/components/terminal-pane/terminal-cold-park-subscription-narrowing.react185.test.tsx": 28,
-      "src/renderer/src/components/terminal-pane/terminal-cold-park-tab-model-identity.react185.test.tsx": 63,
-      "src/renderer/src/components/terminal-pane/terminal-cold-park-timer-rearm.test.tsx": 69,
-      "src/renderer/src/components/terminal-pane/terminal-cold-park-verdict-loop.test.tsx": 39,
-      "src/renderer/src/components/terminal-pane/terminal-cold-park-withheld-tabs.test.ts": 9,
-      "src/renderer/src/components/terminal-pane/terminal-command-lifecycle.test.ts": 8,
-      "src/renderer/src/components/terminal-pane/terminal-context-menu-dismiss.test.ts": 7,
-      "src/renderer/src/components/terminal-pane/terminal-copy-rejection-handling.test.ts": 11,
-      "src/renderer/src/components/terminal-pane/terminal-ctrl-arrow-conpty.test.ts": 10,
-      "src/renderer/src/components/terminal-pane/terminal-ctrl-enter.test.ts": 15,
-      "src/renderer/src/components/terminal-pane/terminal-cursor-appearance-precedence.test.ts": 88,
-      "src/renderer/src/components/terminal-pane/terminal-cursor-inactive-style.test.ts": 12,
-      "src/renderer/src/components/terminal-pane/terminal-dead-session-reconcile.test.ts": 16,
-      "src/renderer/src/components/terminal-pane/terminal-delivery-watchdog.test.ts": 50,
-      "src/renderer/src/components/terminal-pane/terminal-drop-handler.test.ts": 34,
-      "src/renderer/src/components/terminal-pane/terminal-drop-image-path.test.ts": 5,
-      "src/renderer/src/components/terminal-pane/terminal-drop-internal-handler.test.ts": 28,
-      "src/renderer/src/components/terminal-pane/terminal-drop-path-writer.test.ts": 21,
-      "src/renderer/src/components/terminal-pane/terminal-drop-runtime-owner.test.ts": 5,
-      "src/renderer/src/components/terminal-pane/terminal-drop-shell.test.ts": 6,
-      "src/renderer/src/components/terminal-pane/terminal-drop-upload-report.test.ts": 8,
-      "src/renderer/src/components/terminal-pane/terminal-drop-write-failure.test.ts": 6,
-      "src/renderer/src/components/terminal-pane/terminal-error-accumulation.test.ts": 15,
-      "src/renderer/src/components/terminal-pane/terminal-error-remote-closed-localization.test.ts": 6,
-      "src/renderer/src/components/terminal-pane/terminal-eviction-exempt-tabs.test.ts": 7,
-      "src/renderer/src/components/terminal-pane/terminal-file-link-actions.test.ts": 17,
-      "src/renderer/src/components/terminal-pane/terminal-fit-restore.test.ts": 16,
-      "src/renderer/src/components/terminal-pane/terminal-freeze-report.test.ts": 27,
-      "src/renderer/src/components/terminal-pane/terminal-handle-copy.test.ts": 11,
-      "src/renderer/src/components/terminal-pane/terminal-handle-links.test.ts": 36,
-      "src/renderer/src/components/terminal-pane/terminal-hidden-restore-scrollback.test.ts": 7,
-      "src/renderer/src/components/terminal-pane/terminal-hidden-view-parking.test.ts": 16,
-      "src/renderer/src/components/terminal-pane/terminal-hidden-worktree-retention.test.ts": 11,
-      "src/renderer/src/components/terminal-pane/terminal-http-link-activation.test.ts": 4,
-      "src/renderer/src/components/terminal-pane/terminal-http-link-source-owner.test.ts": 11,
-      "src/renderer/src/components/terminal-pane/terminal-http-url-extraction.test.ts": 8,
-      "src/renderer/src/components/terminal-pane/terminal-ime-candidate-key-release-guard.test.ts": 10,
-      "src/renderer/src/components/terminal-pane/terminal-ime-composer-placeholder-mask.test.ts": 687,
-      "src/renderer/src/components/terminal-pane/terminal-ime-composition-route.test.ts": 23,
-      "src/renderer/src/components/terminal-pane/terminal-ime-composition-tracker.test.ts": 16,
-      "src/renderer/src/components/terminal-pane/terminal-ime-composition-transaction-ownership.test.ts": 17,
-      "src/renderer/src/components/terminal-pane/terminal-ime-deferred-chord.test.ts": 10,
-      "src/renderer/src/components/terminal-pane/terminal-ime-deferred-newline.test.ts": 28,
-      "src/renderer/src/components/terminal-pane/terminal-ime-forwarder-space-claim.test.ts": 89,
-      "src/renderer/src/components/terminal-pane/terminal-ime-hangul-syllable-flush.test.ts": 261,
-      "src/renderer/src/components/terminal-pane/terminal-ime-hangul-terminating-digit.test.ts": 9,
-      "src/renderer/src/components/terminal-pane/terminal-ime-input-context-refresh.test.ts": 22,
-      "src/renderer/src/components/terminal-pane/terminal-ime-linux-candidate-state.test.ts": 14,
-      "src/renderer/src/components/terminal-pane/terminal-ime-macos-keybinding-dict-trace.test.ts": 134,
-      "src/renderer/src/components/terminal-pane/terminal-ime-native-text-forwarder.test.ts": 35,
-      "src/renderer/src/components/terminal-pane/terminal-ime-substituted-text-commit.test.ts": 160,
-      "src/renderer/src/components/terminal-pane/terminal-ime-won-composition-order.test.ts": 160,
-      "src/renderer/src/components/terminal-pane/terminal-ime-xterm-adversarial.test.ts": 1021,
-      "src/renderer/src/components/terminal-pane/terminal-ime-xterm-cancelled-preedit-visibility.test.ts": 152,
-      "src/renderer/src/components/terminal-pane/terminal-ime-xterm-composition-cancel.test.ts": 133,
-      "src/renderer/src/components/terminal-pane/terminal-ime-xterm-composition-deduplication.test.ts": 446,
-      "src/renderer/src/components/terminal-pane/terminal-ime-xterm-consumed-key-commit.test.ts": 157,
-      "src/renderer/src/components/terminal-pane/terminal-ime-xterm-korean-enter-commit-order.test.ts": 222,
-      "src/renderer/src/components/terminal-pane/terminal-ime-xterm-linux-native-trace-replay.test.ts": 2429,
-      "src/renderer/src/components/terminal-pane/terminal-ime-xterm-midline-preedit-tail.test.ts": 270,
-      "src/renderer/src/components/terminal-pane/terminal-ime-xterm-resumed-preedit-visibility.test.ts": 111,
-      "src/renderer/src/components/terminal-pane/terminal-ime-xterm-trailing-preedit-occlusion.test.ts": 206,
-      "src/renderer/src/components/terminal-pane/terminal-ime-xterm-transaction-events.test.ts": 277,
-      "src/renderer/src/components/terminal-pane/terminal-ime-xterm-windows-resumed-preedit-trace.test.ts": 273,
-      "src/renderer/src/components/terminal-pane/terminal-input-host-platform.test.ts": 10,
-      "src/renderer/src/components/terminal-pane/terminal-input-quarantine.test.ts": 13,
-      "src/renderer/src/components/terminal-pane/terminal-ios-hangul-preedit-coexistence.test.ts": 295,
-      "src/renderer/src/components/terminal-pane/terminal-ios-hangul-preedit-device-trace.test.ts": 302,
-      "src/renderer/src/components/terminal-pane/terminal-ios-hangul-preedit.test.ts": 353,
-      "src/renderer/src/components/terminal-pane/terminal-jis-yen-input.test.ts": 4,
-      "src/renderer/src/components/terminal-pane/terminal-keyboard-event-handlers-focus.test.ts": 17,
-      "src/renderer/src/components/terminal-pane/terminal-keyboard-pane-resolution.test.ts": 12,
-      "src/renderer/src/components/terminal-pane/terminal-keyboard-protocol-pane-agent.test.ts": 5,
-      "src/renderer/src/components/terminal-pane/terminal-kitty-csi-u-encoding.test.ts": 16,
-      "src/renderer/src/components/terminal-pane/terminal-layout-duplicate-pty-replay.test.ts": 12,
-      "src/renderer/src/components/terminal-pane/terminal-layout-leaf-detach.test.ts": 12,
-      "src/renderer/src/components/terminal-pane/terminal-layout-leaf-ids.test.ts": 11,
-      "src/renderer/src/components/terminal-pane/terminal-layout-overlay-focus.test.tsx": 27,
-      "src/renderer/src/components/terminal-pane/terminal-layout-pty-ownership-depth.test.ts": 67,
-      "src/renderer/src/components/terminal-pane/terminal-layout-pty-ownership.test.ts": 26,
-      "src/renderer/src/components/terminal-pane/terminal-link-action-routing.test.ts": 29,
-      "src/renderer/src/components/terminal-pane/terminal-link-activation.test.ts": 8,
-      "src/renderer/src/components/terminal-pane/terminal-link-click-fallback.test.ts": 66,
-      "src/renderer/src/components/terminal-pane/terminal-link-file-open-routing.test.ts": 52,
-      "src/renderer/src/components/terminal-pane/terminal-link-open-hints.test.ts": 8,
-      "src/renderer/src/components/terminal-pane/terminal-link-osc-file-targets.test.ts": 64,
-      "src/renderer/src/components/terminal-pane/terminal-link-osc-url-routing.test.ts": 27,
-      "src/renderer/src/components/terminal-pane/terminal-link-pointer-gesture.test.ts": 11,
-      "src/renderer/src/components/terminal-pane/terminal-link-provider-link-detection.test.ts": 91,
-      "src/renderer/src/components/terminal-pane/terminal-link-pty-mouse-suppression.test.ts": 35,
-      "src/renderer/src/components/terminal-pane/terminal-link-remote-runtime-ssh-open.test.ts": 32,
-      "src/renderer/src/components/terminal-pane/terminal-link-worktree-root-activation.test.ts": 40,
-      "src/renderer/src/components/terminal-pane/terminal-link-wsl-path-mapping.test.ts": 42,
-      "src/renderer/src/components/terminal-pane/terminal-linkifier-click-priming.test.ts": 10,
-      "src/renderer/src/components/terminal-pane/terminal-live-layout-reconciliation.test.ts": 19,
-      "src/renderer/src/components/terminal-pane/terminal-non-latin-control-chord.test.ts": 6,
-      "src/renderer/src/components/terminal-pane/terminal-option-kitty-release.test.ts": 9,
-      "src/renderer/src/components/terminal-pane/terminal-output-visibility.test.ts": 7,
-      "src/renderer/src/components/terminal-pane/terminal-pane-attention-subscriptions.test.ts": 6,
-      "src/renderer/src/components/terminal-pane/terminal-pane-close-identity.test.ts": 4,
-      "src/renderer/src/components/terminal-pane/terminal-pane-hook-order-parity.test.ts": 111,
-      "src/renderer/src/components/terminal-pane/terminal-pane-host-state-memo.test.ts": 21,
-      "src/renderer/src/components/terminal-pane/terminal-pane-host-state.test.ts": 13,
-      "src/renderer/src/components/terminal-pane/terminal-pane-listener-order-parity.test.ts": 196,
-      "src/renderer/src/components/terminal-pane/terminal-pane-recovery-unsettled-fallback.test.ts": 14,
-      "src/renderer/src/components/terminal-pane/terminal-pane-recovery.test.ts": 44,
-      "src/renderer/src/components/terminal-pane/terminal-pane-split-completion.test.ts": 9,
-      "src/renderer/src/components/terminal-pane/terminal-pane-split-request-routing.test.ts": 20,
-      "src/renderer/src/components/terminal-pane/terminal-pane-split-with-inherited-cwd.test.ts": 17,
-      "src/renderer/src/components/terminal-pane/terminal-pane-split-writer-paths.test.ts": 15,
-      "src/renderer/src/components/terminal-pane/terminal-pane-store-subscription-budget.test.tsx": 128,
-      "src/renderer/src/components/terminal-pane/terminal-pane-surface-ownership.test.ts": 23,
-      "src/renderer/src/components/terminal-pane/terminal-pane-tab-detach.test.ts": 25,
-      "src/renderer/src/components/terminal-pane/terminal-park-verdict-flip-telemetry.test.ts": 19,
-      "src/renderer/src/components/terminal-pane/terminal-park-verdict-worktree-driver-loop.test.tsx": 45,
-      "src/renderer/src/components/terminal-pane/terminal-parked-pane-candidates.test.ts": 7,
-      "src/renderer/src/components/terminal-pane/terminal-parked-tab-eviction-exemption.test.ts": 14,
-      "src/renderer/src/components/terminal-pane/terminal-parked-tab-watchers-batch-sync.test.ts": 92,
-      "src/renderer/src/components/terminal-pane/terminal-parked-tab-watchers.test.ts": 69,
-      "src/renderer/src/components/terminal-pane/terminal-parked-watcher-partial-reconciliation.test.ts": 8,
-      "src/renderer/src/components/terminal-pane/terminal-parked-watcher-reconciliation.test.ts": 5,
-      "src/renderer/src/components/terminal-pane/terminal-parked-watcher-registry.test.ts": 6,
-      "src/renderer/src/components/terminal-pane/terminal-parked-watcher-sleep-preserved-exit.test.ts": 13,
-      "src/renderer/src/components/terminal-pane/terminal-parked-watcher-sole-newborn-exit.test.ts": 10,
-      "src/renderer/src/components/terminal-pane/terminal-parking-e2e-overrides.test.ts": 2548,
-      "src/renderer/src/components/terminal-pane/terminal-parser-handler-guard.test.ts": 18,
-      "src/renderer/src/components/terminal-pane/terminal-paste-coordinator.test.ts": 39,
-      "src/renderer/src/components/terminal-pane/terminal-paste-executor-default-yield.test.ts": 7,
-      "src/renderer/src/components/terminal-pane/terminal-paste-multiline-policy.test.ts": 5,
-      "src/renderer/src/components/terminal-pane/terminal-paste-operation-order.test.ts": 30,
-      "src/renderer/src/components/terminal-pane/terminal-paste-payload-metadata.test.ts": 8,
-      "src/renderer/src/components/terminal-pane/terminal-paste-runtime.test.ts": 8,
-      "src/renderer/src/components/terminal-pane/terminal-paste-target-state.test.ts": 9,
-      "src/renderer/src/components/terminal-pane/terminal-process-exit-restart.test.ts": 7,
-      "src/renderer/src/components/terminal-pane/terminal-programmatic-text-paste.test.ts": 84,
-      "src/renderer/src/components/terminal-pane/terminal-pty-ack-gate.test.ts": 16,
-      "src/renderer/src/components/terminal-pane/terminal-pty-paste-writer.test.ts": 5,
-      "src/renderer/src/components/terminal-pane/terminal-quick-command-dispatch.test.ts": 14,
-      "src/renderer/src/components/terminal-pane/terminal-remote-runtime-recovery-ui-state.test.ts": 5,
-      "src/renderer/src/components/terminal-pane/terminal-render-desync-frame.test.ts": 4,
-      "src/renderer/src/components/terminal-pane/terminal-render-desync-sentinel.test.ts": 395,
-      "src/renderer/src/components/terminal-pane/terminal-render-desync-weight-probe.test.ts": 9,
-      "src/renderer/src/components/terminal-pane/terminal-renderer-policy.test.ts": 11,
-      "src/renderer/src/components/terminal-pane/terminal-replay-application-continuity.test.ts": 266,
-      "src/renderer/src/components/terminal-pane/terminal-replay-cursor-state.test.ts": 70,
-      "src/renderer/src/components/terminal-pane/terminal-restore-sgr-latch.test.ts": 62,
-      "src/renderer/src/components/terminal-pane/terminal-restored-viewport.test.ts": 25,
-      "src/renderer/src/components/terminal-pane/terminal-retention-exempt-growth.test.ts": 10,
-      "src/renderer/src/components/terminal-pane/terminal-runtime-host-link-routing.test.ts": 14,
-      "src/renderer/src/components/terminal-pane/terminal-selection-copy.test.ts": 10,
-      "src/renderer/src/components/terminal-pane/terminal-shortcut-ctrl-arrow.test.ts": 13,
-      "src/renderer/src/components/terminal-pane/terminal-shortcut-option-compose.test.ts": 29,
-      "src/renderer/src/components/terminal-pane/terminal-shortcut-policy.test.ts": 27,
-      "src/renderer/src/components/terminal-pane/terminal-shortcut-select-all.test.ts": 8,
-      "src/renderer/src/components/terminal-pane/terminal-shutdown-layout-capture.test.ts": 139,
-      "src/renderer/src/components/terminal-pane/terminal-side-effect-facts-handler.test.ts": 17,
-      "src/renderer/src/components/terminal-pane/terminal-snapshot-replay-paint.test.ts": 287,
-      "src/renderer/src/components/terminal-pane/terminal-startup-command-classifier.test.ts": 7,
-      "src/renderer/src/components/terminal-pane/terminal-startup-grid-settle.test.ts": 14,
-      "src/renderer/src/components/terminal-pane/terminal-tab-agent-type-index.test.ts": 5,
-      "src/renderer/src/components/terminal-pane/terminal-tab-lookup.test.ts": 8,
-      "src/renderer/src/components/terminal-pane/terminal-title-evidence.test.ts": 12,
-      "src/renderer/src/components/terminal-pane/terminal-title-tracker-parity.test.ts": 31,
-      "src/renderer/src/components/terminal-pane/terminal-unified-tab-lookup.test.ts": 16,
-      "src/renderer/src/components/terminal-pane/terminal-url-link-click.test.ts": 29,
-      "src/renderer/src/components/terminal-pane/terminal-url-link-hit-testing.test.ts": 14,
-      "src/renderer/src/components/terminal-pane/terminal-user-input-signal.test.ts": 15,
-      "src/renderer/src/components/terminal-pane/terminal-view-attributes-publisher.test.ts": 23,
-      "src/renderer/src/components/terminal-pane/terminal-visibility-resume.test.ts": 31,
-      "src/renderer/src/components/terminal-pane/terminal-webgl-atlas-recovery.test.ts": 8,
-      "src/renderer/src/components/terminal-pane/terminal-webgl-diagnostics-breadcrumbs.test.ts": 9,
-      "src/renderer/src/components/terminal-pane/terminal-windows-shift-enter.test.ts": 19,
-      "src/renderer/src/components/terminal-pane/terminal-worktree-path-link.test.ts": 6,
-      "src/renderer/src/components/terminal-pane/title-agent-identity.test.ts": 6,
-      "src/renderer/src/components/terminal-pane/use-manual-terminal-worktree-parking.test.ts": 3,
-      "src/renderer/src/components/terminal-pane/use-mobile-overlay-ticks.perf.test.tsx": 31,
-      "src/renderer/src/components/terminal-pane/use-notification-dispatch.test.ts": 44,
-      "src/renderer/src/components/terminal-pane/use-parked-terminal-watcher-synchronization.react185.test.tsx": 59,
-      "src/renderer/src/components/terminal-pane/use-system-prefers-dark.test.ts": 7,
-      "src/renderer/src/components/terminal-pane/use-terminal-pane-global-effects-active-pty-reporting.test.ts": 15,
-      "src/renderer/src/components/terminal-pane/use-terminal-pane-global-effects-file-drop.test.ts": 22,
-      "src/renderer/src/components/terminal-pane/use-terminal-pane-global-effects-paste-events.test.ts": 43,
-      "src/renderer/src/components/terminal-pane/use-terminal-pane-global-effects-sync-fit-registration.test.ts": 14,
-      "src/renderer/src/components/terminal-pane/use-terminal-pane-global-effects-visibility-resume.test.ts": 22,
-      "src/renderer/src/components/terminal-pane/use-terminal-pane-global-effects-window-focus-recovery.test.ts": 28,
-      "src/renderer/src/components/terminal-pane/use-terminal-pane-lifecycle.test.ts": 19,
-      "src/renderer/src/components/terminal-pane/use-terminal-park-mount-intent.react185.test.tsx": 26,
-      "src/renderer/src/components/terminal-pane/use-terminal-scroll-visibility-memory.test.ts": 9,
-      "src/renderer/src/components/terminal-pane/use-terminal-tab-cold-parking.test.ts": 99,
-      "src/renderer/src/components/terminal-pane/use-terminal-window-wake-recovery.test.ts": 55,
-      "src/renderer/src/components/terminal-pane/use-visible-terminal-tab-claim.test.ts": 5,
-      "src/renderer/src/components/terminal-pane/useSessionRestoredBannerDismiss.test.tsx": 29,
-      "src/renderer/src/components/terminal-pane/useTerminalFontZoom.test.ts": 10,
-      "src/renderer/src/components/terminal-pane/wrapped-terminal-link-ranges.test.ts": 25,
-      "src/renderer/src/components/terminal-pane/xterm-bypass-policy-interrupt.test.ts": 13,
-      "src/renderer/src/components/terminal-pane/xterm-bypass-policy-ios.test.ts": 14,
-      "src/renderer/src/components/terminal-pane/xterm-bypass-policy-non-mac.test.ts": 14,
-      "src/renderer/src/components/terminal-pane/xterm-bypass-policy.test.ts": 9,
-      "src/renderer/src/components/terminal-pane/xterm-write-buffer-stall.repro.test.ts": 24,
-      "src/renderer/src/components/terminal-parked-watcher-sync-entries.test.tsx": 37,
-      "src/renderer/src/components/terminal-quick-commands/TerminalQuickCommandDialog.test.tsx": 660,
-      "src/renderer/src/components/terminal-quick-commands/terminal-quick-command-agent-options.test.ts": 10,
-      "src/renderer/src/components/terminal-quick-commands/terminal-quick-command-dialog-draft.test.ts": 11,
-      "src/renderer/src/components/terminal-scrollback-decoration-eviction.test.ts": 414,
-      "src/renderer/src/components/terminal-search-decoration-leak.test.ts": 1942,
-      "src/renderer/src/components/terminal-search-long-wrapped-line.test.ts": 4994,
-      "src/renderer/src/components/terminal-search-safe-find.test.ts": 7,
-      "src/renderer/src/components/terminal-workspace-keydown.test.ts": 246,
-      "src/renderer/src/components/terminal-workspace-surface-ids.test.tsx": 87,
-      "src/renderer/src/components/terminal/activation-deferred-tab-admission.test.ts": 13,
-      "src/renderer/src/components/terminal/active-terminal-repair-loop.react185.test.tsx": 38,
-      "src/renderer/src/components/terminal/active-terminal-repair.test.ts": 6,
-      "src/renderer/src/components/terminal/background-terminal-worktree-mount.test.ts": 24,
-      "src/renderer/src/components/terminal/background-terminal-worktree-visibility.test.ts": 14,
-      "src/renderer/src/components/terminal/cold-activation-deferral-stranding.test.ts": 37,
-      "src/renderer/src/components/terminal/initial-terminal-structured-launch.test.tsx": 26,
-      "src/renderer/src/components/terminal/initial-terminal-wiring.test.ts": 4,
-      "src/renderer/src/components/terminal/initial-terminal.test.ts": 4,
-      "src/renderer/src/components/terminal/pty-running-work-probe-child-evidence.test.ts": 9,
-      "src/renderer/src/components/terminal/running-terminal-close-guard.test.ts": 18,
-      "src/renderer/src/components/terminal/split-group-mount.test.ts": 8,
-      "src/renderer/src/components/terminal/tab-type-cycle.test.ts": 9,
-      "src/renderer/src/components/terminal/terminal-close-confirm-keyboard-vs-mouse.test.ts": 12,
-      "src/renderer/src/components/terminal/terminal-close-copy-kind.test.ts": 8,
-      "src/renderer/src/components/terminal/terminal-close-incarnation.test.ts": 5,
-      "src/renderer/src/components/terminal/terminal-provider-snapshot-bound-pty-ids.test.ts": 74,
-      "src/renderer/src/components/terminal/terminal-provider-snapshot-capability-resettlement.test.ts": 15,
-      "src/renderer/src/components/terminal/terminal-provider-snapshot-capability.test.ts": 15,
-      "src/renderer/src/components/terminal/terminal-tab-actions-kill-all.test.ts": 15,
-      "src/renderer/src/components/terminal/terminal-tab-actions-structured-session.test.ts": 17,
-      "src/renderer/src/components/terminal/terminal-tab-actions-unified-close.test.ts": 32,
-      "src/renderer/src/components/terminal/terminal-tab-actions.test.ts": 32,
-      "src/renderer/src/components/terminal/terminal-tab-bulk-actions.test.ts": 12,
-      "src/renderer/src/components/terminal/terminal-tab-close-running-confirm.test.ts": 21,
-      "src/renderer/src/components/terminal/unsaved-close-queue.test.ts": 5,
-      "src/renderer/src/components/terminal/use-terminal-provider-snapshot-capability.test.tsx": 50,
-      "src/renderer/src/components/terminal/use-worktree-files.test.tsx": 52,
-      "src/renderer/src/components/terminal/window-close-running-work.test.ts": 23,
-      "src/renderer/src/components/ui/color-picker.test.tsx": 24,
-      "src/renderer/src/components/ui/popover-wheel-scroll.test.tsx": 243,
-      "src/renderer/src/components/ui/repo-multi-combobox.test.ts": 6,
-      "src/renderer/src/components/ui/scroll-area.test.tsx": 39,
-      "src/renderer/src/components/ui/slider.test.tsx": 111,
-      "src/renderer/src/components/ui/switch.test.tsx": 29,
-      "src/renderer/src/components/unexpected-signout/unexpected-signout-card.test.tsx": 206,
-      "src/renderer/src/components/unexpected-signout/unexpected-signout-visibility.test.ts": 9,
-      "src/renderer/src/components/use-github-task-search-commit.test.ts": 35,
-      "src/renderer/src/components/use-task-creation-draft-retention.test.ts": 25,
-      "src/renderer/src/components/use-terminal-create-actions.test.tsx": 22,
-      "src/renderer/src/components/use-terminal-editor-close-foundation.window-close.test.tsx": 28,
-      "src/renderer/src/components/use-terminal-window-lifecycle.lazy-ref.test.tsx": 16,
-      "src/renderer/src/components/use-worktree-jump-palette-browser-ownership.test.ts": 37,
-      "src/renderer/src/components/window-close-request-coordinator.test.ts": 19,
-      "src/renderer/src/components/workspace-cleanup/WorkspaceCleanupDialog.mount-gating.test.tsx": 100,
-      "src/renderer/src/components/workspace-cleanup/WorkspaceCleanupDialog.stale-while-revalidate.test.tsx": 1307,
-      "src/renderer/src/components/workspace-cleanup/use-workspace-cleanup-browse-state.test.tsx": 43,
-      "src/renderer/src/components/workspace-cleanup/use-workspace-cleanup-facet-rows.test.tsx": 58,
-      "src/renderer/src/components/workspace-cleanup/use-workspace-cleanup-git-evidence.test.tsx": 60,
-      "src/renderer/src/components/workspace-cleanup/use-workspace-cleanup-row-order.test.ts": 26,
-      "src/renderer/src/components/workspace-cleanup/workspace-cleanup-active-facets.test.ts": 11,
-      "src/renderer/src/components/workspace-cleanup/workspace-cleanup-background-removal-late-settlement.test.ts": 15,
-      "src/renderer/src/components/workspace-cleanup/workspace-cleanup-background-removal-snapshot-batch.test.ts": 63,
-      "src/renderer/src/components/workspace-cleanup/workspace-cleanup-background-removal.test.ts": 31,
-      "src/renderer/src/components/workspace-cleanup/workspace-cleanup-candidate-list.test.tsx": 47,
-      "src/renderer/src/components/workspace-cleanup/workspace-cleanup-candidate-row-data.test.ts": 6,
-      "src/renderer/src/components/workspace-cleanup/workspace-cleanup-candidate-row.test.tsx": 214,
-      "src/renderer/src/components/workspace-cleanup/workspace-cleanup-confirm-remove.test.tsx": 118,
-      "src/renderer/src/components/workspace-cleanup/workspace-cleanup-deletion-phases.test.ts": 9,
-      "src/renderer/src/components/workspace-cleanup/workspace-cleanup-dialog-notices.test.tsx": 59,
-      "src/renderer/src/components/workspace-cleanup/workspace-cleanup-facet-controls.test.tsx": 357,
-      "src/renderer/src/components/workspace-cleanup/workspace-cleanup-facet-filter.test.ts": 39,
-      "src/renderer/src/components/workspace-cleanup/workspace-cleanup-facet-sort.test.ts": 12,
-      "src/renderer/src/components/workspace-cleanup/workspace-cleanup-filter-bar.test.tsx": 237,
-      "src/renderer/src/components/workspace-cleanup/workspace-cleanup-flat-list.test.tsx": 280,
-      "src/renderer/src/components/workspace-cleanup/workspace-cleanup-git-evidence.test.ts": 16,
-      "src/renderer/src/components/workspace-cleanup/workspace-cleanup-presentation.test.ts": 27,
-      "src/renderer/src/components/workspace-cleanup/workspace-cleanup-removal-candidates.test.ts": 7,
-      "src/renderer/src/components/workspace-cleanup/workspace-cleanup-removal-settlement.test.ts": 9,
-      "src/renderer/src/components/workspace-cleanup/workspace-cleanup-removal-timeout-recovery.test.ts": 26,
-      "src/renderer/src/components/workspace-cleanup/workspace-cleanup-scanned-host-confirmation-removal.test.tsx": 470,
-      "src/renderer/src/components/workspace-cleanup/workspace-cleanup-sort-header.test.tsx": 82,
-      "src/renderer/src/components/workspace-emoji/WorkspaceEmojiSuggestionPopover.test.tsx": 83,
-      "src/renderer/src/components/workspace-emoji/useWorkspaceEmojiShortcodeInput.test.tsx": 122,
-      "src/renderer/src/components/workspace-surface-projection.test.ts": 39,
-      "src/renderer/src/components/worktree-creation/WorktreeCreationPanel.test.tsx": 74,
-      "src/renderer/src/components/worktree-jump-palette-interleaved-sections.test.tsx": 1645,
-      "src/renderer/src/components/worktree-jump-palette-primitives.test.tsx": 131,
-      "src/renderer/src/components/worktree-jump-palette-quick-action-availability.test.tsx": 20,
-      "src/renderer/src/components/worktree-jump-palette-sleeping-filter.test.ts": 9,
-      "src/renderer/src/components/worktree-jump-palette-source-context-boundary.test.ts": 4,
-      "src/renderer/src/components/worktree-jump-palette-status-inputs.test.ts": 6,
-      "src/renderer/src/hooks/agent-hook-completion-background-turn-notifications.test.ts": 134,
-      "src/renderer/src/hooks/agent-hook-completion-fresh-working.test.ts": 109,
-      "src/renderer/src/hooks/agent-hook-completion-notifications-import.test.ts": 92,
-      "src/renderer/src/hooks/agent-hook-completion-notifications.test.ts": 264,
-      "src/renderer/src/hooks/agent-hook-completion-store-sync.test.ts": 18,
-      "src/renderer/src/hooks/automation-agent-status-entry-change.test.ts": 7,
-      "src/renderer/src/hooks/automation-dispatch-unverifiable-loss.test.ts": 137,
-      "src/renderer/src/hooks/automations-changed-event-attribution.test.ts": 1424,
-      "src/renderer/src/hooks/composer-branch-selection.test.ts": 11,
-      "src/renderer/src/hooks/composer-drop-owner.test.ts": 4,
-      "src/renderer/src/hooks/composer-drop-upload-result.test.ts": 8,
-      "src/renderer/src/hooks/composer-native-file-drop.test.ts": 9,
-      "src/renderer/src/hooks/composer-state/composer-drop-listener.test.ts": 26,
-      "src/renderer/src/hooks/composer-state/draft-target-sync.test.ts": 24,
-      "src/renderer/src/hooks/composer-state/full-creation-execution.test.ts": 23,
-      "src/renderer/src/hooks/composer-state/full-creation-structured-launch.test.ts": 7,
-      "src/renderer/src/hooks/composer-state/full-submit-orchestration.test.ts": 22,
-      "src/renderer/src/hooks/composer-state/multiple-create-reset.test.ts": 29,
-      "src/renderer/src/hooks/composer-state/provider-runtime-sync.test.ts": 18,
-      "src/renderer/src/hooks/composer-state/quick-creation-request.test.ts": 10,
-      "src/renderer/src/hooks/direct-ssh-host-hydration.test.ts": 24,
-      "src/renderer/src/hooks/direct-ssh-reconnect-coordinator.test.ts": 30,
-      "src/renderer/src/hooks/direct-ssh-reconnect-rollout.test.ts": 11,
-      "src/renderer/src/hooks/direct-ssh-reconnect-tokens.test.ts": 6,
-      "src/renderer/src/hooks/direct-ssh-runtime-wake-isolation.test.tsx": 43,
-      "src/renderer/src/hooks/direct-ssh-state-routing.test.ts": 16,
-      "src/renderer/src/hooks/direct-ssh-worktree-refresh-scheduler.test.ts": 27,
-      "src/renderer/src/hooks/fork-push-warning.test.ts": 5,
-      "src/renderer/src/hooks/installed-agent-skill-discovery-cache.test.ts": 18,
-      "src/renderer/src/hooks/installed-agent-skill-discovery.test.ts": 9,
-      "src/renderer/src/hooks/ipc-events/agent-status-pane-routing-index.test.ts": 79,
-      "src/renderer/src/hooks/ipc-events/agent-status-pending-retry-gate.test.ts": 272,
-      "src/renderer/src/hooks/ipc-events/agent-status-terminal-title-tab-write.test.ts": 186,
-      "src/renderer/src/hooks/ipc-events/browser-automation-bootstrap-lease.test.ts": 10,
-      "src/renderer/src/hooks/ipc-events/browser-request-ipc-bridge.profile-switch.test.ts": 7,
-      "src/renderer/src/hooks/ipc-events/browser-state-open-link-profile.test.ts": 8,
-      "src/renderer/src/hooks/ipc-events/direct-ssh-hydration-fanout.test.ts": 12,
-      "src/renderer/src/hooks/ipc-events/direct-ssh-hydration-target-metadata.test.ts": 21,
-      "src/renderer/src/hooks/ipc-events/normalize-agent-status-event.test.ts": 6,
-      "src/renderer/src/hooks/ipc-events/orca-profile-auth-ipc-bridge.test.ts": 111,
-      "src/renderer/src/hooks/ipc-events/os-markdown-file-open-bridge.test.ts": 16,
-      "src/renderer/src/hooks/ipc-events/runtime-reconnect-host-status.test.ts": 32,
-      "src/renderer/src/hooks/ipc-events/terminal-ui-routing-ipc-bridge-split.test.ts": 15,
-      "src/renderer/src/hooks/ipc-events/updater-status-ipc-bridge.test.ts": 6,
-      "src/renderer/src/hooks/ipc-tab-switch-group-order-hydration.test.ts": 11,
-      "src/renderer/src/hooks/ipc-tab-switch-structured-tab-cycle.test.ts": 11,
-      "src/renderer/src/hooks/ipc-tab-switch.test.ts": 17,
-      "src/renderer/src/hooks/legacy-worker-terminal-recovery-event.test.ts": 15,
-      "src/renderer/src/hooks/macos-tcc-prompt-notice-subscription.test.ts": 23,
-      "src/renderer/src/hooks/metadata-request-cache.test.ts": 142,
-      "src/renderer/src/hooks/mobile-terminal-reveal-tab-adoption.test.ts": 2166,
-      "src/renderer/src/hooks/modal-return-focus-action.test.ts": 7,
-      "src/renderer/src/hooks/programmatic-scroll-marks.test.ts": 9,
-      "src/renderer/src/hooks/remote-workspace-deferred-placement-retry.test.ts": 14,
-      "src/renderer/src/hooks/remote-workspace-session-merge-close-tombstones.test.ts": 13,
-      "src/renderer/src/hooks/remote-workspace-session-merge-closed-terminal-tombstone.test.ts": 39,
-      "src/renderer/src/hooks/remote-workspace-session-merge-local-survival.test.ts": 12,
-      "src/renderer/src/hooks/remote-workspace-snapshot-apply-deferred-session-write.test.ts": 76,
-      "src/renderer/src/hooks/remote-workspace-snapshot-arrival-coordinator.test.ts": 8,
-      "src/renderer/src/hooks/remote-workspace-snapshot-duplicate-tab-repair.test.ts": 68,
-      "src/renderer/src/hooks/remote-workspace-snapshot-fresh-client-tab-seeding.test.ts": 19,
-      "src/renderer/src/hooks/remote-workspace-snapshot-local-tab-survival.test.ts": 108,
-      "src/renderer/src/hooks/remote-workspace-snapshot-unplaced-tab-adoption.test.ts": 80,
-      "src/renderer/src/hooks/remote-workspace-target-sync.test.ts": 45,
-      "src/renderer/src/hooks/runtime-client-events-sync.test.ts": 66,
-      "src/renderer/src/hooks/runtime-project-refresh-scheduler.test.ts": 51,
-      "src/renderer/src/hooks/shortcut-label-cache.test.tsx": 65,
-      "src/renderer/src/hooks/ssh-reconnect-pane-retry.test.ts": 7,
-      "src/renderer/src/hooks/structured-session-completion-focus.test.ts": 1364,
-      "src/renderer/src/hooks/unpaired-device-auth-notification.test.ts": 6,
-      "src/renderer/src/hooks/use-audio-capture.capture-loss.test.ts": 31,
-      "src/renderer/src/hooks/use-clipboard-text-copy-feedback.test.ts": 28,
-      "src/renderer/src/hooks/use-now.test.ts": 35,
-      "src/renderer/src/hooks/use-palette-search-evaluation-context.test.ts": 29,
-      "src/renderer/src/hooks/use-task-page-github-work-item-mutation-host.test.ts": 7,
-      "src/renderer/src/hooks/use-terminal-quick-command-hosts.test.ts": 59,
-      "src/renderer/src/hooks/use-window-stream-visibility.test.ts": 37,
-      "src/renderer/src/hooks/useActiveProjectSkillRuntime.test.tsx": 57,
-      "src/renderer/src/hooks/useAgentDetectionTarget.test.ts": 11,
-      "src/renderer/src/hooks/useAppMenuPaste.test.tsx": 29,
-      "src/renderer/src/hooks/useAppMenuSelectionActions.test.tsx": 13,
-      "src/renderer/src/hooks/useAutoAckViewedAgent.away.test.ts": 95,
-      "src/renderer/src/hooks/useAutoAckViewedAgent.clock-skew.test.ts": 55,
-      "src/renderer/src/hooks/useAutoAckViewedAgent.floating-panel.test.ts": 38,
-      "src/renderer/src/hooks/useAutoAckViewedAgent.test.ts": 63,
-      "src/renderer/src/hooks/useAutomationDispatchEvents.test.ts": 692,
-      "src/renderer/src/hooks/useComposerState-decisions.test.ts": 9,
-      "src/renderer/src/hooks/useComposerState-host-context-boundaries.test.ts": 21,
-      "src/renderer/src/hooks/useComposerState-host-retarget.test.ts": 7,
-      "src/renderer/src/hooks/useComposerState.integration.test.ts": 39,
-      "src/renderer/src/hooks/useDetectedAgents.test.tsx": 43,
-      "src/renderer/src/hooks/useEditorExternalWatch-complexity.test.ts": 6402,
-      "src/renderer/src/hooks/useEditorExternalWatch-self-move.test.ts": 27,
-      "src/renderer/src/hooks/useEditorExternalWatch-subscriptions.test.tsx": 24,
-      "src/renderer/src/hooks/useEditorExternalWatch-targets.test.ts": 21,
-      "src/renderer/src/hooks/useEditorExternalWatch-wsl-repro.test.ts": 21,
-      "src/renderer/src/hooks/useEditorExternalWatch.test.ts": 54,
-      "src/renderer/src/hooks/useEphemeralVmRecipeOptions.test.tsx": 33,
-      "src/renderer/src/hooks/useGitHubSlugMetadata.test.tsx": 47,
-      "src/renderer/src/hooks/useGlobalFileDrop.test.ts": 15,
-      "src/renderer/src/hooks/useInstalledAgentSkills.react.test.tsx": 90,
-      "src/renderer/src/hooks/useInstalledAgentSkills.test.ts": 17,
-      "src/renderer/src/hooks/useIpcEvents-agent-dashboard-shortcut.test.ts": 9,
-      "src/renderer/src/hooks/useIpcEvents-agent-status-batch-projection.test.ts": 1128,
-      "src/renderer/src/hooks/useIpcEvents-agent-status-connection-attribution.test.ts": 1955,
-      "src/renderer/src/hooks/useIpcEvents-agent-status-hook-titles.test.ts": 1349,
-      "src/renderer/src/hooks/useIpcEvents-agent-status-pane-teardown.test.ts": 2111,
-      "src/renderer/src/hooks/useIpcEvents-agent-status-queue-ordering.test.ts": 1997,
-      "src/renderer/src/hooks/useIpcEvents-agent-status-snapshot-hydration.test.ts": 2101,
-      "src/renderer/src/hooks/useIpcEvents-agent-status-snapshot-replay.test.ts": 1690,
-      "src/renderer/src/hooks/useIpcEvents-agent-status-ssh-authority.test.ts": 3444,
-      "src/renderer/src/hooks/useIpcEvents-agent-status-turn-completion.test.ts": 1433,
-      "src/renderer/src/hooks/useIpcEvents-browser-certificate-failure.test.ts": 1719,
-      "src/renderer/src/hooks/useIpcEvents-browser-navigation.test.ts": 1370,
-      "src/renderer/src/hooks/useIpcEvents-browser-tab-create.test.ts": 1568,
-      "src/renderer/src/hooks/useIpcEvents-cli-worktree-activation.test.ts": 1650,
-      "src/renderer/src/hooks/useIpcEvents-client-hosted-browser-rows.test.ts": 1604,
-      "src/renderer/src/hooks/useIpcEvents-close-routing-active-browser-tab.test.ts": 1787,
-      "src/renderer/src/hooks/useIpcEvents-close-routing-browser-pages.test.ts": 2510,
-      "src/renderer/src/hooks/useIpcEvents-close-routing-floating-guest.test.ts": 1438,
-      "src/renderer/src/hooks/useIpcEvents-close-routing-session-tabs.test.ts": 2721,
-      "src/renderer/src/hooks/useIpcEvents-cmd-j-digit-chord.test.ts": 1311,
-      "src/renderer/src/hooks/useIpcEvents-lifecycle.test.ts": 1102,
-      "src/renderer/src/hooks/useIpcEvents-new-workspace-shortcut.test.ts": 12,
-      "src/renderer/src/hooks/useIpcEvents-rate-limit-hydration.test.ts": 1455,
-      "src/renderer/src/hooks/useIpcEvents-repos-changed-catalogs.test.ts": 1275,
-      "src/renderer/src/hooks/useIpcEvents-runtime-environment-selectors.test.ts": 17,
-      "src/renderer/src/hooks/useIpcEvents-session-tab-close-request.test.ts": 1943,
-      "src/renderer/src/hooks/useIpcEvents-silent-terminal-adoption.test.ts": 1945,
-      "src/renderer/src/hooks/useIpcEvents-ssh-disconnect-cleanup.test.ts": 1453,
-      "src/renderer/src/hooks/useIpcEvents-terminal-create-surfacing.test.ts": 2086,
-      "src/renderer/src/hooks/useIpcEvents-updater-status.test.ts": 1582,
-      "src/renderer/src/hooks/useIpcEvents-zoom-routing.test.ts": 1559,
-      "src/renderer/src/hooks/useIssueMetadata.test.tsx": 27,
-      "src/renderer/src/hooks/useLinearProviderConnected.test.tsx": 19,
-      "src/renderer/src/hooks/useMacTccAttributionSeveredNotice.test.tsx": 320,
-      "src/renderer/src/hooks/useMacosTccPromptNotice.test.tsx": 207,
-      "src/renderer/src/hooks/useMetadataListRequest.test.tsx": 20,
-      "src/renderer/src/hooks/useModalReturnFocus.test.tsx": 64,
-      "src/renderer/src/hooks/usePrimarySelectionPaste.terminal-native-paste.test.tsx": 32,
-      "src/renderer/src/hooks/usePrimarySelectionPaste.test.tsx": 55,
-      "src/renderer/src/hooks/useResetCountdownClock.test.ts": 23,
-      "src/renderer/src/hooks/useRetiredWorktreeNames.test.ts": 344,
-      "src/renderer/src/hooks/useSettingsNavigationMetadata.capability-owner.test.tsx": 85,
-      "src/renderer/src/hooks/useSettingsNavigationMetadata.language-switch.test.tsx": 235,
-      "src/renderer/src/hooks/useSettingsNavigationMetadata.test.ts": 184,
-      "src/renderer/src/hooks/useSidebarResize.test.ts": 9,
-      "src/renderer/src/hooks/useSkillFreshness.test.tsx": 65,
-      "src/renderer/src/hooks/useUnreadDockBadge.test.ts": 128,
-      "src/renderer/src/hooks/useVirtualizedScrollAnchor.listener-deps.test.ts": 30,
-      "src/renderer/src/hooks/useVirtualizedScrollAnchor.marks-restore-signal.test.ts": 31,
-      "src/renderer/src/hooks/useVirtualizedScrollAnchor.test.ts": 8,
-      "src/renderer/src/hooks/useWindowsTerminalCapabilityOwnerKey.test.tsx": 46,
-      "src/renderer/src/hooks/viewport-size-change-listener.test.ts": 6,
-      "src/renderer/src/hooks/worktree-change-refresh-queue.test.ts": 14,
-      "src/renderer/src/hooks/worktree-head-identity-apply.test.ts": 10,
-      "src/renderer/src/i18n/I18nProvider.test.tsx": 36,
-      "src/renderer/src/i18n/integration-card-status-localization.test.ts": 7,
-      "src/renderer/src/i18n/intl-locale.test.ts": 121,
-      "src/renderer/src/i18n/ja-technical-literal-mistranslations.test.ts": 7,
-      "src/renderer/src/i18n/ko-ui-semantic-mistranslations.test.ts": 9,
-      "src/renderer/src/i18n/lazy-locale.test.ts": 109,
-      "src/renderer/src/i18n/locale-english-regression.test.ts": 22,
-      "src/renderer/src/i18n/native-chat-locales.test.ts": 10,
-      "src/renderer/src/i18n/no-top-level-translate.test.ts": 2294,
-      "src/renderer/src/i18n/plugin-chrome-allowlist.test.ts": 11,
-      "src/renderer/src/i18n/pseudo-localization.test.ts": 8,
-      "src/renderer/src/i18n/relative-time-format.test.ts": 27,
-      "src/renderer/src/i18n/runtime-required-catalog.test.ts": 335,
-      "src/renderer/src/i18n/settings-status-label-localization.test.ts": 9,
-      "src/renderer/src/i18n/smart-workspace-jira-locales.test.ts": 8,
-      "src/renderer/src/i18n/technical-literal-catalog-values.test.ts": 8,
-      "src/renderer/src/i18n/weekday-names.test.ts": 40,
-      "src/renderer/src/i18n/worktree-visibility-locales.test.ts": 8,
-      "src/renderer/src/i18n/zh-technical-literal-mistranslations.test.ts": 45,
-      "src/renderer/src/lazy-modal-mount-state.test.ts": 5,
-      "src/renderer/src/lazy-use-ref-ratchet.test.ts": 165,
-      "src/renderer/src/lib/activate-ai-vault-structured-session-reveal.test.ts": 11,
-      "src/renderer/src/lib/activate-ai-vault-structured-session.test.ts": 17,
-      "src/renderer/src/lib/activate-tab-and-focus-pane.test.ts": 11,
-      "src/renderer/src/lib/active-agent-note-send-explicit-target.test.ts": 385,
-      "src/renderer/src/lib/active-agent-note-send-focused-session.test.ts": 74,
-      "src/renderer/src/lib/active-agent-note-send-runtime-error-codes.test.ts": 6,
-      "src/renderer/src/lib/active-agent-note-send-target-detection.test.ts": 13,
-      "src/renderer/src/lib/active-view-persist.test.ts": 4,
-      "src/renderer/src/lib/activity-thread-display.test.ts": 10,
-      "src/renderer/src/lib/agent-background-session-launch-host.test.ts": 12,
-      "src/renderer/src/lib/agent-catalog-links.test.ts": 5,
-      "src/renderer/src/lib/agent-draft-readiness.test.ts": 8,
-      "src/renderer/src/lib/agent-followup-delivery.test.ts": 18659,
-      "src/renderer/src/lib/agent-hibernation-confirmation.test.ts": 4,
-      "src/renderer/src/lib/agent-hibernation-coordinator.test.ts": 163,
-      "src/renderer/src/lib/agent-hibernation-output-activity.test.ts": 6,
-      "src/renderer/src/lib/agent-hibernation-pane-age.test.ts": 9,
-      "src/renderer/src/lib/agent-hibernation-planner.test.ts": 30,
-      "src/renderer/src/lib/agent-hibernation-runtime-liveness-race.test.ts": 65,
-      "src/renderer/src/lib/agent-hibernation-visibility.test.ts": 5,
-      "src/renderer/src/lib/agent-launch-prompt-delivery.test.ts": 14,
-      "src/renderer/src/lib/agent-launch-route-connection-fallback.test.ts": 6,
-      "src/renderer/src/lib/agent-launch-route-input.test.ts": 16,
-      "src/renderer/src/lib/agent-launch-routing-caller-census.test.ts": 552,
-      "src/renderer/src/lib/agent-launch-routing.test.ts": 11,
-      "src/renderer/src/lib/agent-paste-draft-readiness-budget.test.ts": 13,
-      "src/renderer/src/lib/agent-paste-draft-submit-retry.test.ts": 48,
-      "src/renderer/src/lib/agent-paste-draft.test.ts": 178,
-      "src/renderer/src/lib/agent-picker-search.test.ts": 28,
-      "src/renderer/src/lib/agent-ready-wait.test.ts": 7,
-      "src/renderer/src/lib/agent-resume-launch-target.test.ts": 2472,
-      "src/renderer/src/lib/agent-row-primary-text.test.ts": 8,
-      "src/renderer/src/lib/agent-row-tool-preview.test.ts": 9,
-      "src/renderer/src/lib/agent-send-title-status.test.ts": 14,
-      "src/renderer/src/lib/agent-session-fork-context.test.ts": 47,
-      "src/renderer/src/lib/agent-session-launch-plan.test.ts": 10,
-      "src/renderer/src/lib/agent-skill-cli-prerequisite.test.ts": 68,
-      "src/renderer/src/lib/agent-skill-nav-install-status.test.ts": 5,
-      "src/renderer/src/lib/agent-startup-delayed-delivery-perf.test.ts": 85,
-      "src/renderer/src/lib/agent-status-connection-ownership.test.ts": 7,
-      "src/renderer/src/lib/agent-status-count.test.ts": 14,
-      "src/renderer/src/lib/agent-status-epoch-clock.test.ts": 12,
-      "src/renderer/src/lib/agent-status-evidence-clock.test.ts": 6,
-      "src/renderer/src/lib/agent-status-terminal-title.test.ts": 11,
-      "src/renderer/src/lib/agent-status-worktree-attribution.test.ts": 6,
-      "src/renderer/src/lib/agent-status.test.ts": 31,
-      "src/renderer/src/lib/agent-tab-shortcuts.test.ts": 7,
-      "src/renderer/src/lib/agent-trust-preflight.test.ts": 6,
-      "src/renderer/src/lib/ai-vault-omp-cold-resume.test.ts": 19,
-      "src/renderer/src/lib/ai-vault-resume-command.drop-repin.test.ts": 6,
-      "src/renderer/src/lib/ai-vault-resume-command.resumable-agent.test.ts": 9,
-      "src/renderer/src/lib/ai-vault-resume-command.test.ts": 31,
-      "src/renderer/src/lib/ai-vault-resume-shell.test.ts": 5,
-      "src/renderer/src/lib/ai-vault-resume-target.test.ts": 15,
-      "src/renderer/src/lib/ai-vault-session-drag.test.ts": 15,
-      "src/renderer/src/lib/ai-vault-session-resume-preparation.test.ts": 16,
-      "src/renderer/src/lib/ai-vault-tab-title-sync-inputs.test.ts": 38,
-      "src/renderer/src/lib/ai-vault-tab-title-sync.test.ts": 576,
-      "src/renderer/src/lib/app-command-dispatch.test.ts": 6,
-      "src/renderer/src/lib/app-font-family.test.ts": 4,
-      "src/renderer/src/lib/app-menu-paste.test.ts": 49,
-      "src/renderer/src/lib/app-menu-selection-actions.test.ts": 4,
-      "src/renderer/src/lib/automation-session-observer.test.ts": 58,
-      "src/renderer/src/lib/automation-session-reuse.test.ts": 7,
-      "src/renderer/src/lib/automation-terminal-ownership.test.ts": 9,
-      "src/renderer/src/lib/browser-cookie-import-toast.test.ts": 18,
-      "src/renderer/src/lib/browser-history-match.performance.test.ts": 17,
-      "src/renderer/src/lib/browser-history-match.test.ts": 34,
-      "src/renderer/src/lib/browser-page-conversion-history.test.ts": 8,
-      "src/renderer/src/lib/browser-page-palette-activation.test.ts": 59,
-      "src/renderer/src/lib/browser-palette-page-entries.test.ts": 145,
-      "src/renderer/src/lib/browser-palette-search.test.ts": 28,
-      "src/renderer/src/lib/browser-uuid.test.ts": 5,
-      "src/renderer/src/lib/browser-workspace-tab-activation.test.ts": 9,
-      "src/renderer/src/lib/client-creation-action-policy.test.ts": 12,
-      "src/renderer/src/lib/cmd-j-github-url-lookup.test.ts": 8,
-      "src/renderer/src/lib/cmd-j-host-qualified-candidate-ownership.test.ts": 30,
-      "src/renderer/src/lib/cmd-j-linear-issue-intent.test.ts": 7,
-      "src/renderer/src/lib/cmd-j-section-leadership.test.ts": 9,
-      "src/renderer/src/lib/codex-account-display-label.test.ts": 6,
-      "src/renderer/src/lib/codex-pane-restart-eligibility.test.ts": 8,
-      "src/renderer/src/lib/codex-pane-selection-lane.test.ts": 21,
-      "src/renderer/src/lib/codex-session-restart-route-recheck.test.ts": 13,
-      "src/renderer/src/lib/codex-session-restart-shell-flap.test.ts": 30,
-      "src/renderer/src/lib/codex-session-restart.test.ts": 93,
-      "src/renderer/src/lib/codex-stale-pane-account-identity.test.ts": 17,
-      "src/renderer/src/lib/codex-stale-pane-sweep.test.ts": 44,
-      "src/renderer/src/lib/comment-body-line-count.test.ts": 40,
-      "src/renderer/src/lib/comment-body-submit-state.test.ts": 31,
-      "src/renderer/src/lib/composer-issue-command.test.ts": 7,
-      "src/renderer/src/lib/composer-submit-cancellation.test.ts": 7,
-      "src/renderer/src/lib/connection-context.test.ts": 56,
-      "src/renderer/src/lib/crash-diagnostics.test.ts": 83,
-      "src/renderer/src/lib/create-untitled-markdown.test.ts": 13,
-      "src/renderer/src/lib/desktop-window-chrome.test.ts": 5,
-      "src/renderer/src/lib/diff-comment-compat.test.ts": 5,
-      "src/renderer/src/lib/diff-comments-format.test.ts": 7,
-      "src/renderer/src/lib/direct-ssh-reconnect-product-telemetry.test.ts": 11,
-      "src/renderer/src/lib/direct-ssh-target-scope.test.ts": 12,
-      "src/renderer/src/lib/doc-preview-grants.test.ts": 118,
-      "src/renderer/src/lib/document-theme.test.ts": 10,
-      "src/renderer/src/lib/editable-target.test.ts": 6,
-      "src/renderer/src/lib/editor-file-operation-owner.test.ts": 29,
-      "src/renderer/src/lib/editor-font-zoom.test.ts": 5,
-      "src/renderer/src/lib/ensure-hooks-confirmed.test.ts": 433,
-      "src/renderer/src/lib/ensure-simulator-tab-behavior.test.ts": 162,
-      "src/renderer/src/lib/ensure-simulator-tab.test.ts": 5,
-      "src/renderer/src/lib/ephemeral-vm-failed-create-cleanup.test.ts": 7,
-      "src/renderer/src/lib/ephemeral-vm-runtime-cleanup.test.ts": 16,
-      "src/renderer/src/lib/ephemeral-vm-workspace-target.integration.test.ts": 8,
-      "src/renderer/src/lib/ephemeral-vm-workspace-target.test.ts": 13,
-      "src/renderer/src/lib/ephemeral-vm-worktree-creation.test.ts": 8,
-      "src/renderer/src/lib/execute-open-editor-path-move.test.ts": 209,
-      "src/renderer/src/lib/external-editor-open-capability.test.ts": 5,
-      "src/renderer/src/lib/feature-education-telemetry.test.ts": 12,
-      "src/renderer/src/lib/feedback-image-attachments.test.ts": 28,
-      "src/renderer/src/lib/file-preview-action-visibility.test.tsx": 22,
-      "src/renderer/src/lib/file-preview.test.ts": 16,
-      "src/renderer/src/lib/file-search-result-owner.test.ts": 6,
-      "src/renderer/src/lib/file-search-selection.test.ts": 8,
-      "src/renderer/src/lib/file-type-icons.test.ts": 9,
-      "src/renderer/src/lib/find-query-bounds.test.ts": 4,
-      "src/renderer/src/lib/finished-agent-resume-resurrection.test.ts": 38,
-      "src/renderer/src/lib/fix-checks-agent-launch.test.ts": 262,
-      "src/renderer/src/lib/flatten-retained-slice.test.ts": 132,
-      "src/renderer/src/lib/floating-terminal.test.ts": 7,
-      "src/renderer/src/lib/floating-workspace-terminal-actions.test.ts": 26,
-      "src/renderer/src/lib/floating-workspace-tour-interaction-snapshot.test.ts": 9,
-      "src/renderer/src/lib/focus-terminal-tab-surface.test.ts": 16,
-      "src/renderer/src/lib/folder-workspace-path-status.test.ts": 8,
-      "src/renderer/src/lib/foreground-terminal-tabs.test.ts": 14,
-      "src/renderer/src/lib/github-links.test.ts": 11,
-      "src/renderer/src/lib/github-pr-start-point.test.ts": 11,
-      "src/renderer/src/lib/github-source-runtime-context.test.ts": 8,
-      "src/renderer/src/lib/github-work-item-source-lookup.test.ts": 8,
-      "src/renderer/src/lib/github-work-item-workspace-attachment.test.ts": 10,
-      "src/renderer/src/lib/gitlab-links.test.ts": 14,
-      "src/renderer/src/lib/gitlab-work-item-source-lookup.test.ts": 8,
-      "src/renderer/src/lib/hook-command-delayed-delivery-perf.test.ts": 121,
-      "src/renderer/src/lib/hook-command-delayed-delivery.test.ts": 11,
-      "src/renderer/src/lib/host-mirrored-pane-resume-replay.test.ts": 20,
-      "src/renderer/src/lib/http-link-destinations.test.ts": 14,
-      "src/renderer/src/lib/http-link-modifier-routing.test.ts": 12,
-      "src/renderer/src/lib/http-link-routing.test.ts": 25,
-      "src/renderer/src/lib/i18n-jsx-spacing-guard.test.ts": 23,
-      "src/renderer/src/lib/ime-composition-keyboard-event.test.ts": 30,
-      "src/renderer/src/lib/ios-web-platform.test.ts": 6,
-      "src/renderer/src/lib/jira-source-host.test.ts": 8,
-      "src/renderer/src/lib/keyboard-layout/detect-option-as-alt.test.ts": 11,
-      "src/renderer/src/lib/keyboard-layout/input-source-id.test.ts": 4,
-      "src/renderer/src/lib/keyboard-layout/layout-base-character.test.ts": 14,
-      "src/renderer/src/lib/keyboard-layout/option-as-alt-probe.test.ts": 20,
-      "src/renderer/src/lib/keyboard-layout/option-key-location-state.test.ts": 7,
-      "src/renderer/src/lib/language-detect.test.ts": 8,
-      "src/renderer/src/lib/large-text-control-paste.test.ts": 23,
-      "src/renderer/src/lib/launch-agent-background-session-remote.test.ts": 498,
-      "src/renderer/src/lib/launch-agent-background-session.test.ts": 360,
-      "src/renderer/src/lib/launch-agent-in-new-tab-cwd.test.ts": 653,
-      "src/renderer/src/lib/launch-agent-in-new-tab-host-resolution.test.ts": 553,
-      "src/renderer/src/lib/launch-agent-in-new-tab-structured.test.ts": 15,
-      "src/renderer/src/lib/launch-agent-in-new-tab-web-runtime.test.ts": 544,
-      "src/renderer/src/lib/launch-agent-in-new-tab-windows-quoting.test.ts": 760,
-      "src/renderer/src/lib/launch-agent-in-new-tab.test.ts": 1687,
-      "src/renderer/src/lib/launch-agent-session-continuation.test.ts": 27,
-      "src/renderer/src/lib/launch-agent-structured-chat-guard.test.ts": 945,
-      "src/renderer/src/lib/launch-ai-vault-session.test.ts": 10,
-      "src/renderer/src/lib/launch-structured-agent-session.test.ts": 726,
-      "src/renderer/src/lib/launch-work-item-direct-agent-routing.test.ts": 12,
-      "src/renderer/src/lib/launch-work-item-direct-agent.test.ts": 15,
-      "src/renderer/src/lib/launch-work-item-direct-messages.test.ts": 6,
-      "src/renderer/src/lib/launch-work-item-direct.test.ts": 51,
-      "src/renderer/src/lib/launch-worktree-background-terminals.test.ts": 305,
-      "src/renderer/src/lib/lazy-chunk-recovery-reload.test.ts": 61,
-      "src/renderer/src/lib/lazy-with-retry.never-landed-reload.test.ts": 10,
-      "src/renderer/src/lib/lazy-with-retry.right-sidebar-syntax-error.test.ts": 10,
-      "src/renderer/src/lib/lazy-with-retry.test.ts": 37,
-      "src/renderer/src/lib/left-sidebar-appearance.test.ts": 13,
-      "src/renderer/src/lib/linear-agent-skill-update-command.test.ts": 4,
-      "src/renderer/src/lib/linear-board-drag-payload.test.ts": 10,
-      "src/renderer/src/lib/linear-issue-context-snapshot.test.ts": 19,
-      "src/renderer/src/lib/linear-issue-url-lookup.test.ts": 10,
-      "src/renderer/src/lib/linear-issue-workspace-attachment.test.ts": 10,
-      "src/renderer/src/lib/linear-issue-workspace-open.test.ts": 10,
-      "src/renderer/src/lib/linear-linked-work-item.test.ts": 12,
-      "src/renderer/src/lib/linked-work-item-context.test.ts": 16,
-      "src/renderer/src/lib/linked-work-item-provider.test.ts": 5,
-      "src/renderer/src/lib/list-row-interaction.test.ts": 11,
-      "src/renderer/src/lib/local-path-open-guard.test.ts": 5,
-      "src/renderer/src/lib/local-preflight-context-cache.test.ts": 31,
-      "src/renderer/src/lib/local-preflight-context.test.ts": 18,
-      "src/renderer/src/lib/locale-text-collators.test.ts": 30,
-      "src/renderer/src/lib/manual-terminal-worktree-parking.test.ts": 7,
-      "src/renderer/src/lib/markdown-comment-blocks.test.ts": 6,
-      "src/renderer/src/lib/markdown-document-templates.test.ts": 9,
-      "src/renderer/src/lib/markdown-review-note-copy.test.ts": 5,
-      "src/renderer/src/lib/markdown-review-notes.test.ts": 26,
-      "src/renderer/src/lib/migration-unsupported-agent-entry.test.ts": 4,
-      "src/renderer/src/lib/mobile-terminal-tab-mount.test.ts": 7,
-      "src/renderer/src/lib/monaco-delayer-cancellation-guard.test.ts": 25,
-      "src/renderer/src/lib/monaco-diff-editor-disposal.test.ts": 13,
-      "src/renderer/src/lib/monaco-languages/monarch-embed-entry-recursion.test.ts": 388,
-      "src/renderer/src/lib/monaco-languages/monarch-upstream-mdx-recursion.test.ts": 61,
-      "src/renderer/src/lib/monaco-languages/register-astro.test.ts": 32,
-      "src/renderer/src/lib/monaco-languages/register-jsonl.test.ts": 27,
-      "src/renderer/src/lib/monaco-languages/register-nim.test.ts": 22,
-      "src/renderer/src/lib/monaco-languages/register-svelte.test.ts": 28,
-      "src/renderer/src/lib/monaco-languages/register-vue.test.ts": 20,
-      "src/renderer/src/lib/monaco-languages/textmate-language-registration.test.ts": 10,
-      "src/renderer/src/lib/monaco-languages/textmate-token-provider.test.ts": 123,
-      "src/renderer/src/lib/monaco-peek-preview-options.test.ts": 12,
-      "src/renderer/src/lib/native-chat-initial-view-mode.test.ts": 13,
-      "src/renderer/src/lib/native-chat-launch-draft-mirrorability.test.ts": 12,
-      "src/renderer/src/lib/native-chat-transcript-readability.test.ts": 4,
-      "src/renderer/src/lib/nested-repo-selected-paths.test.ts": 8,
-      "src/renderer/src/lib/new-workspace-composer-repo.test.ts": 7,
-      "src/renderer/src/lib/new-workspace-create-gates.test.ts": 4,
-      "src/renderer/src/lib/new-workspace-enter-guard.test.ts": 18,
-      "src/renderer/src/lib/new-workspace-project-options.test.ts": 21,
-      "src/renderer/src/lib/new-workspace-ssh-gate.test.ts": 6,
-      "src/renderer/src/lib/new-workspace.test.ts": 4395,
-      "src/renderer/src/lib/non-secure-context-crypto.repro.test.ts": 11,
-      "src/renderer/src/lib/notes-send-agent-targets.test.ts": 30,
-      "src/renderer/src/lib/onboarding-project-checklist.test.ts": 6,
-      "src/renderer/src/lib/open-markdown-in-floating-workspace.test.ts": 7,
-      "src/renderer/src/lib/open-mobile-emulator-tab.test.ts": 17,
-      "src/renderer/src/lib/open-tab-occupant-agent.test.ts": 16,
-      "src/renderer/src/lib/orca-hook-trust.test.ts": 9,
-      "src/renderer/src/lib/orca-yaml-trust-prompt-slot-eviction.test.ts": 278,
-      "src/renderer/src/lib/orchestration-setup-state.test.ts": 9,
-      "src/renderer/src/lib/orchestration-skill-coverage.test.ts": 20,
-      "src/renderer/src/lib/order-empty-query-worktrees.test.ts": 30,
-      "src/renderer/src/lib/palette-match/cmd-j-ranking-contract.test.ts": 15,
-      "src/renderer/src/lib/palette-match/match-field-allocation.test.ts": 49,
-      "src/renderer/src/lib/palette-match/palette-match-core.test.ts": 26,
-      "src/renderer/src/lib/palette-match/palette-match-performance.test.ts": 9461,
-      "src/renderer/src/lib/palette-match/palette-ranking.test.ts": 16,
-      "src/renderer/src/lib/palette-repo-resolution.test.ts": 9,
-      "src/renderer/src/lib/palette-type-alias-match.test.ts": 9,
-      "src/renderer/src/lib/pane-agent-evidence.test.ts": 23,
-      "src/renderer/src/lib/pane-manager/browser-mobile-driver-state.test.ts": 10,
-      "src/renderer/src/lib/pane-manager/browser-remote-viewer-state.test.ts": 5,
-      "src/renderer/src/lib/pane-manager/client-hosted-browser-row-ephemerality.test.ts": 22,
-      "src/renderer/src/lib/pane-manager/client-hosted-browser-row-state.test.ts": 16,
-      "src/renderer/src/lib/pane-manager/focus-follows-mouse.test.ts": 7,
-      "src/renderer/src/lib/pane-manager/mobile-driver-state.test.ts": 10,
-      "src/renderer/src/lib/pane-manager/mobile-fit-overrides-hydration.test.ts": 5,
-      "src/renderer/src/lib/pane-manager/mobile-fit-overrides.test.ts": 23,
-      "src/renderer/src/lib/pane-manager/pane-container-listener-lifecycle.test.ts": 10,
-      "src/renderer/src/lib/pane-manager/pane-cursor-blink-suspension.test.ts": 318,
-      "src/renderer/src/lib/pane-manager/pane-divider-capture-loss.test.ts": 6,
-      "src/renderer/src/lib/pane-manager/pane-divider-stray-touch.test.ts": 23,
-      "src/renderer/src/lib/pane-manager/pane-divider.test.ts": 13,
-      "src/renderer/src/lib/pane-manager/pane-dom-creation.test.ts": 20,
-      "src/renderer/src/lib/pane-manager/pane-drag-reorder.test.ts": 17,
-      "src/renderer/src/lib/pane-manager/pane-drop-no-op.test.ts": 12,
-      "src/renderer/src/lib/pane-manager/pane-fit-resize-observer.test.ts": 16,
-      "src/renderer/src/lib/pane-manager/pane-fit.test.ts": 61,
-      "src/renderer/src/lib/pane-manager/pane-initial-fit-lifecycle.test.ts": 10,
-      "src/renderer/src/lib/pane-manager/pane-key-resolution.test.ts": 9,
-      "src/renderer/src/lib/pane-manager/pane-lifecycle.test.ts": 52,
-      "src/renderer/src/lib/pane-manager/pane-manager-registry.test.ts": 26,
-      "src/renderer/src/lib/pane-manager/pane-metric-options-deferral.test.ts": 14,
-      "src/renderer/src/lib/pane-manager/pane-overlay-focus.test.ts": 44,
-      "src/renderer/src/lib/pane-manager/pane-pointer-focus.test.ts": 5,
-      "src/renderer/src/lib/pane-manager/pane-pty-resize-hold.test.ts": 8,
-      "src/renderer/src/lib/pane-manager/pane-reveal-fit.test.ts": 10,
-      "src/renderer/src/lib/pane-manager/pane-reveal-repaint.test.ts": 53,
-      "src/renderer/src/lib/pane-manager/pane-scroll.test.ts": 87,
-      "src/renderer/src/lib/pane-manager/pane-split-close.test.ts": 12,
-      "src/renderer/src/lib/pane-manager/pane-split-scroll.test.ts": 12,
-      "src/renderer/src/lib/pane-manager/pane-terminal-foreground-render-settle.test.ts": 8,
-      "src/renderer/src/lib/pane-manager/pane-terminal-gpu-acceleration.test.ts": 12,
-      "src/renderer/src/lib/pane-manager/pane-terminal-mouse-wheel.test.ts": 15,
-      "src/renderer/src/lib/pane-manager/pane-terminal-output-queue-chunks.test.ts": 5,
-      "src/renderer/src/lib/pane-manager/pane-terminal-output-scheduler-ack-credit.test.ts": 69,
-      "src/renderer/src/lib/pane-manager/pane-terminal-output-scheduler-backlog-cap.test.ts": 110,
-      "src/renderer/src/lib/pane-manager/pane-terminal-output-scheduler-disposed-writes.test.ts": 46,
-      "src/renderer/src/lib/pane-manager/pane-terminal-output-scheduler-foreground-refresh.test.ts": 68,
-      "src/renderer/src/lib/pane-manager/pane-terminal-output-scheduler-queue-retention.test.ts": 254,
-      "src/renderer/src/lib/pane-manager/pane-terminal-output-scheduler-synchronized-frames.test.ts": 65,
-      "src/renderer/src/lib/pane-manager/pane-terminal-output-scheduler-throughput.bench.test.ts": 256,
-      "src/renderer/src/lib/pane-manager/pane-terminal-output-scheduler.test.ts": 146,
-      "src/renderer/src/lib/pane-manager/pane-tree-equalization-parity.test.ts": 1130,
-      "src/renderer/src/lib/pane-manager/pane-tree-equalization-scaling.test.ts": 65,
-      "src/renderer/src/lib/pane-manager/pane-tree-ops.test.ts": 26,
-      "src/renderer/src/lib/pane-manager/pane-tree-reparent-frame.test.ts": 30,
-      "src/renderer/src/lib/pane-manager/pane-webgl-context-recovery.test.ts": 50,
-      "src/renderer/src/lib/pane-manager/pane-webgl-refresh-lifecycle.test.ts": 8,
-      "src/renderer/src/lib/pane-manager/pane-webgl-renderer.test.ts": 38,
-      "src/renderer/src/lib/pane-manager/terminal-arabic-shaping-joiner.test.ts": 16,
-      "src/renderer/src/lib/pane-manager/terminal-canvas-dpr-repair.test.ts": 11,
-      "src/renderer/src/lib/pane-manager/terminal-complex-script.test.ts": 15,
-      "src/renderer/src/lib/pane-manager/terminal-delivery-credit.test.ts": 12,
-      "src/renderer/src/lib/pane-manager/terminal-foreground-repair-convergence.test.ts": 183,
-      "src/renderer/src/lib/pane-manager/terminal-ime-anchor.test.ts": 11,
-      "src/renderer/src/lib/pane-manager/terminal-ime-candidate-anchor.test.ts": 41,
-      "src/renderer/src/lib/pane-manager/terminal-keyboard-protocol.test.ts": 12,
-      "src/renderer/src/lib/pane-manager/terminal-ligatures-addon.test.ts": 16,
-      "src/renderer/src/lib/pane-manager/terminal-link-provider-guard.test.ts": 12,
-      "src/renderer/src/lib/pane-manager/terminal-linkifier-hover-reset-on-mouseleave.test.ts": 14,
-      "src/renderer/src/lib/pane-manager/terminal-linkifier-hover-reset-on-write.test.ts": 13,
-      "src/renderer/src/lib/pane-manager/terminal-linkifier-hover-reset.test.ts": 5,
-      "src/renderer/src/lib/pane-manager/terminal-render-pause-release-parked-resize.test.ts": 10,
-      "src/renderer/src/lib/pane-manager/terminal-render-pause-release.test.ts": 12,
-      "src/renderer/src/lib/pane-manager/terminal-scroll-intent-input-resync.test.ts": 14,
-      "src/renderer/src/lib/pane-manager/terminal-scroll-intent-key-retention.test.ts": 55,
-      "src/renderer/src/lib/pane-manager/terminal-scroll-intent-structural-transitions.test.ts": 13,
-      "src/renderer/src/lib/pane-manager/terminal-scroll-intent.test.ts": 22,
-      "src/renderer/src/lib/pane-manager/terminal-structural-replay-coordinator.test.ts": 16,
-      "src/renderer/src/lib/pane-manager/terminal-webgl-auto-policy.test.ts": 13,
-      "src/renderer/src/lib/pane-manager/terminal-webgl-hidden-retention.test.ts": 19,
-      "src/renderer/src/lib/pane-manager/terminal-windows-ctrl-alt-chord-classification.test.ts": 16,
-      "src/renderer/src/lib/pane-manager/terminal-write-pipeline-health.test.ts": 19,
-      "src/renderer/src/lib/pane-manager/windows-pty-compatibility.test.ts": 20,
-      "src/renderer/src/lib/pane-manager/xterm-instance-disposed.test.ts": 10,
-      "src/renderer/src/lib/pane-manager/xterm-user-scrolling-contract.test.ts": 5037,
-      "src/renderer/src/lib/pane-manager/xterm-write-callback-guard.test.ts": 10,
-      "src/renderer/src/lib/parked-terminal-host-hydration.test.ts": 12,
-      "src/renderer/src/lib/passive-macos-app-data-access.test.ts": 6,
-      "src/renderer/src/lib/paste-payload-metadata.test.ts": 11,
-      "src/renderer/src/lib/path-head-elision.test.ts": 5,
-      "src/renderer/src/lib/path.test.ts": 6,
-      "src/renderer/src/lib/pending-worktree-creation.test.ts": 5,
-      "src/renderer/src/lib/pi-live-session-no-duplicate-tab.test.ts": 11,
-      "src/renderer/src/lib/pi-session-resume-wake.test.ts": 12,
-      "src/renderer/src/lib/plugin-command-execution.test.ts": 7,
-      "src/renderer/src/lib/plugin-command-keybindings.test.ts": 19,
-      "src/renderer/src/lib/pr-bot-author-overrides.test.ts": 213,
-      "src/renderer/src/lib/pr-comment-action-state.test.ts": 12,
-      "src/renderer/src/lib/pr-comment-reactions.test.ts": 6,
-      "src/renderer/src/lib/primary-selection-paste.test.ts": 79,
-      "src/renderer/src/lib/primary-selection.test.ts": 9,
-      "src/renderer/src/lib/project-clone-url-prefill.test.ts": 15,
-      "src/renderer/src/lib/project-host-clone-url.test.ts": 8,
-      "src/renderer/src/lib/project-host-setup-options.test.ts": 20,
-      "src/renderer/src/lib/project-host-workspace-target.test.ts": 17,
-      "src/renderer/src/lib/project-skill-runtime.test.ts": 8,
-      "src/renderer/src/lib/provisioned-root-create-options.test.ts": 8,
-      "src/renderer/src/lib/quick-workspace-agent-selection.test.ts": 7,
-      "src/renderer/src/lib/react-commit-cascade-install-order.test.ts": 8,
-      "src/renderer/src/lib/react-commit-cascade-observer.react185.test.tsx": 44,
-      "src/renderer/src/lib/react-commit-cascade-observer.test.ts": 150,
-      "src/renderer/src/lib/react-commit-cascade-store-write-samples.test.ts": 12,
-      "src/renderer/src/lib/react-commit-cascade-telemetry.test.ts": 108,
-      "src/renderer/src/lib/react-error-boundary-reporting.test.ts": 15,
-      "src/renderer/src/lib/react-grab-dev-gate.test.ts": 4,
-      "src/renderer/src/lib/react-renderer-root.test.ts": 6,
-      "src/renderer/src/lib/recent-workspace-tab-rows.test.ts": 19,
-      "src/renderer/src/lib/remap-open-editor-tabs-for-path-change.test.ts": 62,
-      "src/renderer/src/lib/renderer-agent-status-observation-ingress.test.ts": 36,
-      "src/renderer/src/lib/renderer-app-platform.test.ts": 34,
-      "src/renderer/src/lib/renderer-memory-profile.test.ts": 26,
-      "src/renderer/src/lib/repo-display-labels.test.ts": 6,
-      "src/renderer/src/lib/repo-runtime-owner.test.ts": 14,
-      "src/renderer/src/lib/repo-search.test.ts": 10,
-      "src/renderer/src/lib/repo-slug-cache.test.ts": 8,
-      "src/renderer/src/lib/repo-slug-index.test.ts": 515,
-      "src/renderer/src/lib/resolved-worktree-execution-host.test.ts": 7,
-      "src/renderer/src/lib/resume-sleeping-agent-session-direct-ssh-hydration-gap.test.ts": 22,
-      "src/renderer/src/lib/resume-sleeping-agent-session-provider-claim.test.ts": 13,
-      "src/renderer/src/lib/resume-sleeping-agent-session-remote-compat.test.ts": 25,
-      "src/renderer/src/lib/resume-sleeping-agent-session-replay.test.ts": 65,
-      "src/renderer/src/lib/resume-sleeping-agent-session-slept-pane-recovery.test.ts": 11,
-      "src/renderer/src/lib/resume-sleeping-agent-session-suppress-navigation.test.ts": 32,
-      "src/renderer/src/lib/resume-sleeping-agent-session.test.ts": 126,
-      "src/renderer/src/lib/resume-stale-structured-agent-session.test.ts": 9,
-      "src/renderer/src/lib/right-sidebar-visibility.test.ts": 8,
-      "src/renderer/src/lib/run-quick-command-in-new-tab.test.ts": 10,
-      "src/renderer/src/lib/running-agent-targets.test.ts": 12,
-      "src/renderer/src/lib/runtime-pane-title-leaf-id.test.ts": 9,
-      "src/renderer/src/lib/runtime-session-mirror-targets.test.ts": 6,
-      "src/renderer/src/lib/runtime-workspace-file-route.test.ts": 14,
-      "src/renderer/src/lib/screen-submit-shortcut.test.ts": 6,
-      "src/renderer/src/lib/script-textarea-rows.test.ts": 52,
-      "src/renderer/src/lib/scroll-cache.test.ts": 9,
-      "src/renderer/src/lib/serve-desktop-promotion-session-continuity.test.ts": 13,
-      "src/renderer/src/lib/session-write-subscriber-allocation.test.ts": 21,
-      "src/renderer/src/lib/session-write-subscriber-deferred-persist.test.ts": 21,
-      "src/renderer/src/lib/session-write-subscriber.test.ts": 107,
-      "src/renderer/src/lib/settled-worker-wake-policy.test.ts": 25,
-      "src/renderer/src/lib/setup-runner.test.ts": 4,
-      "src/renderer/src/lib/setup-script-prompt.test.ts": 20,
-      "src/renderer/src/lib/sha256.test.ts": 22,
-      "src/renderer/src/lib/shutdown-checkpoint-guard.test.ts": 26,
-      "src/renderer/src/lib/sidebar-worktree-activation.test.ts": 13,
-      "src/renderer/src/lib/simulator-launch-coordination.test.ts": 112,
-      "src/renderer/src/lib/simulator-palette-search.test.ts": 29,
-      "src/renderer/src/lib/simulator-pane-shutdown-scheduler.test.ts": 17,
-      "src/renderer/src/lib/simulator-tab-palette-activation.test.ts": 32,
-      "src/renderer/src/lib/skill-freshness-display-status.test.ts": 16,
-      "src/renderer/src/lib/sleeping-agent-session-launch-windows-quoting.test.ts": 290,
-      "src/renderer/src/lib/smart-github-submit.test.ts": 19,
-      "src/renderer/src/lib/source-control-agent-action-plan.test.ts": 15,
-      "src/renderer/src/lib/source-control-generation-plan.test.ts": 16,
-      "src/renderer/src/lib/source-control-launch-agent-selection.test.ts": 12,
-      "src/renderer/src/lib/source-control-launch-platform.test.ts": 10,
-      "src/renderer/src/lib/source-control-remote-error.test.ts": 27,
-      "src/renderer/src/lib/sparse-preset-draft.test.ts": 21,
-      "src/renderer/src/lib/ssh-background-startup-delivery.test.ts": 17,
-      "src/renderer/src/lib/ssh-mutation-expectation.test.ts": 7,
-      "src/renderer/src/lib/startup-ui-hydration.test.ts": 10,
-      "src/renderer/src/lib/state-collection-byte-estimate.test.ts": 46,
-      "src/renderer/src/lib/structured-agent-launch-settlement-caller-census.test.ts": 361,
-      "src/renderer/src/lib/structured-agent-launch-settlement.test.ts": 67,
-      "src/renderer/src/lib/structured-agent-session-launch-join-delivery.test.ts": 8,
-      "src/renderer/src/lib/structured-agent-session-launch-prompt.test.ts": 12,
-      "src/renderer/src/lib/structured-agent-session-launch-refusal-fallback.test.ts": 25,
-      "src/renderer/src/lib/structured-agent-session-launch-resume-identity.test.ts": 16,
-      "src/renderer/src/lib/structured-agent-session-launch.test.ts": 307,
-      "src/renderer/src/lib/structured-agent-session-tab-activation.test.ts": 7,
-      "src/renderer/src/lib/tab-agent-identity-decision-table.test.ts": 438,
-      "src/renderer/src/lib/tab-agent-status-index.test.ts": 162,
-      "src/renderer/src/lib/tab-agent.test.ts": 10,
-      "src/renderer/src/lib/tab-has-live-pty.test.ts": 7,
-      "src/renderer/src/lib/tab-number-shortcuts.test.ts": 9,
-      "src/renderer/src/lib/terminal-contrast-correction.test.ts": 13,
-      "src/renderer/src/lib/terminal-file-uri-link.test.ts": 8,
-      "src/renderer/src/lib/terminal-input-activity-coalescing.test.ts": 12,
-      "src/renderer/src/lib/terminal-links-redos.test.ts": 12,
-      "src/renderer/src/lib/terminal-links.test.ts": 331,
-      "src/renderer/src/lib/terminal-pane-title-sanitization.test.ts": 7,
-      "src/renderer/src/lib/terminal-quick-command-project-scope.test.ts": 7,
-      "src/renderer/src/lib/terminal-quick-command-search.test.ts": 11,
-      "src/renderer/src/lib/terminal-reveal-identity.test.ts": 10,
-      "src/renderer/src/lib/terminal-shortcut-capture-notification.test.tsx": 16,
-      "src/renderer/src/lib/terminal-tab-for-pty-id.test.ts": 10,
-      "src/renderer/src/lib/terminal-theme.test.ts": 22,
-      "src/renderer/src/lib/terminal-worktree-route.test.ts": 16,
-      "src/renderer/src/lib/text-control-paste-ownership.test.ts": 21,
-      "src/renderer/src/lib/text-control-paste.test.ts": 30,
-      "src/renderer/src/lib/titlebar-left-chrome.test.ts": 6,
-      "src/renderer/src/lib/titlebar-worktree-history-controls.test.ts": 4,
-      "src/renderer/src/lib/tui-agent-startup.test.ts": 18,
-      "src/renderer/src/lib/typing-latency/diagnostic-lifecycle.test.ts": 14,
-      "src/renderer/src/lib/typing-latency/diagnostic-summary.test.ts": 13,
-      "src/renderer/src/lib/typing-latency/echo-instrumentation.test.ts": 28,
-      "src/renderer/src/lib/typing-latency/input-events.test.ts": 7,
-      "src/renderer/src/lib/typing-latency/input-source.test.ts": 8,
-      "src/renderer/src/lib/typing-latency/sample-window.test.ts": 10,
-      "src/renderer/src/lib/unread-badge-count.test.ts": 4,
-      "src/renderer/src/lib/update-check-click-options.test.ts": 5,
-      "src/renderer/src/lib/updater-beforeunload.test.ts": 8,
-      "src/renderer/src/lib/use-tab-agent-observed-signal-dispatch.test.tsx": 63,
-      "src/renderer/src/lib/use-tab-agent-opencode-native-title.test.ts": 40,
-      "src/renderer/src/lib/use-tab-agent-pi-identity.test.ts": 27,
-      "src/renderer/src/lib/use-tab-agent-process-signals.test.ts": 48,
-      "src/renderer/src/lib/use-tab-agent-remote-pty-selector.test.ts": 30,
-      "src/renderer/src/lib/use-tab-agent-retained-identity.test.ts": 36,
-      "src/renderer/src/lib/use-tab-agent-sleeping-session.test.ts": 37,
-      "src/renderer/src/lib/use-tab-agent.test.ts": 112,
-      "src/renderer/src/lib/visible-overlay.test.ts": 15,
-      "src/renderer/src/lib/wake-sleeping-agents-in-background.test.ts": 19,
-      "src/renderer/src/lib/wake-sleeping-agents-live-done.test.ts": 10,
-      "src/renderer/src/lib/web-client-location.test.ts": 6,
-      "src/renderer/src/lib/window-label-formatter.test.ts": 13,
-      "src/renderer/src/lib/window-visibility-interval.test.ts": 15,
-      "src/renderer/src/lib/window-visibility-timeout-poller.test.ts": 10,
-      "src/renderer/src/lib/windows-terminal-capabilities-race.test.ts": 7,
-      "src/renderer/src/lib/windows-terminal-capabilities.test.ts": 64,
-      "src/renderer/src/lib/windows-terminal-capability-reprobe.test.ts": 25,
-      "src/renderer/src/lib/work-item-link-query-bounds.test.ts": 5,
-      "src/renderer/src/lib/work-item-lookup-text.test.ts": 8,
-      "src/renderer/src/lib/worker-terminal-takeover-report.test.ts": 257,
-      "src/renderer/src/lib/workspace-activation-path-gate.test.ts": 23,
-      "src/renderer/src/lib/workspace-activation-terminal-focus.test.ts": 270,
-      "src/renderer/src/lib/workspace-browser-tab-open.test.ts": 37,
-      "src/renderer/src/lib/workspace-composer-initial-focus.test.ts": 16,
-      "src/renderer/src/lib/workspace-create-error-format.test.ts": 9,
-      "src/renderer/src/lib/workspace-doc-address-input.test.ts": 12,
-      "src/renderer/src/lib/workspace-emoji-shortcodes.lazy.test.ts": 60,
-      "src/renderer/src/lib/workspace-emoji-shortcodes.test.ts": 29,
-      "src/renderer/src/lib/workspace-file-drag.test.ts": 7,
-      "src/renderer/src/lib/workspace-port-groups.test.ts": 5,
-      "src/renderer/src/lib/workspace-port-host-availability.test.ts": 12,
-      "src/renderer/src/lib/workspace-port-scan-debounce.test.ts": 12,
-      "src/renderer/src/lib/workspace-port-scan-publish.test.ts": 24,
-      "src/renderer/src/lib/workspace-session-browser-history.test.ts": 12,
-      "src/renderer/src/lib/workspace-session-closed-tab-tombstones.test.ts": 7,
-      "src/renderer/src/lib/workspace-session-editor-drafts.test.ts": 9,
-      "src/renderer/src/lib/workspace-session-host-contention.test.ts": 18,
-      "src/renderer/src/lib/workspace-session-host-persistence.test.ts": 22,
-      "src/renderer/src/lib/workspace-session-host-split.test.ts": 14,
-      "src/renderer/src/lib/workspace-session-hydration-keys.test.ts": 8,
-      "src/renderer/src/lib/workspace-session-liveness.test.ts": 8,
-      "src/renderer/src/lib/workspace-session-patch.test.ts": 12,
-      "src/renderer/src/lib/workspace-session-persistence-gate.test.ts": 8,
-      "src/renderer/src/lib/workspace-session-relevant-fields.test.ts": 6,
-      "src/renderer/src/lib/workspace-session-staged-browser-tabs.test.ts": 5,
-      "src/renderer/src/lib/workspace-session.test.ts": 20,
-      "src/renderer/src/lib/workspace-tab-agent-metadata.test.ts": 11,
-      "src/renderer/src/lib/workspace-tab-palette-activation.store.test.ts": 10,
-      "src/renderer/src/lib/workspace-tab-palette-activation.test.ts": 19,
-      "src/renderer/src/lib/workspace-tab-palette-results.test.ts": 19,
-      "src/renderer/src/lib/workspace-tab-palette-search.test.ts": 37,
-      "src/renderer/src/lib/workspace-terminal-host-authority.test.ts": 38,
-      "src/renderer/src/lib/worktree-activation-agent-startup.test.ts": 42,
-      "src/renderer/src/lib/worktree-activation-automation-filter.test.ts": 19,
-      "src/renderer/src/lib/worktree-activation-created-agent.test.ts": 72,
-      "src/renderer/src/lib/worktree-activation-default-tabs.test.ts": 33,
-      "src/renderer/src/lib/worktree-activation-emptied-workspace-reseed.test.ts": 71,
-      "src/renderer/src/lib/worktree-activation-empty-remote.test.ts": 63,
-      "src/renderer/src/lib/worktree-activation-issue-command.test.ts": 21,
-      "src/renderer/src/lib/worktree-activation-pty-inventory.test.ts": 18,
-      "src/renderer/src/lib/worktree-activation-reveal.test.ts": 18,
-      "src/renderer/src/lib/worktree-activation-setup-script.test.ts": 67,
-      "src/renderer/src/lib/worktree-activation-structured-chat-surface.test.ts": 43,
-      "src/renderer/src/lib/worktree-activation-surface-caller-wiring.test.ts": 366,
-      "src/renderer/src/lib/worktree-activation-web-runtime.test.ts": 198,
-      "src/renderer/src/lib/worktree-activity-state.test.ts": 8,
-      "src/renderer/src/lib/worktree-agent-activation-gate.test.ts": 36,
-      "src/renderer/src/lib/worktree-agent-activation-seam.test.ts": 37,
-      "src/renderer/src/lib/worktree-agent-structured-inventory.test.ts": 8,
-      "src/renderer/src/lib/worktree-attachment-label.test.ts": 6,
-      "src/renderer/src/lib/worktree-creation-agent-seeding.test.ts": 11,
-      "src/renderer/src/lib/worktree-creation-agent-seeds.test.ts": 107,
-      "src/renderer/src/lib/worktree-creation-chat-setup.test.ts": 23,
-      "src/renderer/src/lib/worktree-creation-flow-agent-trust-preflight.test.ts": 3,
-      "src/renderer/src/lib/worktree-creation-flow-dedupe.test.ts": 7,
-      "src/renderer/src/lib/worktree-creation-flow-stranded-surface.test.ts": 123,
-      "src/renderer/src/lib/worktree-creation-flow.test.ts": 879,
-      "src/renderer/src/lib/worktree-creation-structured-session.test.ts": 28,
-      "src/renderer/src/lib/worktree-creation-structured-unknown-outcome.test.ts": 9,
-      "src/renderer/src/lib/worktree-creation-surface.test.ts": 4,
-      "src/renderer/src/lib/worktree-default-display-name.test.ts": 11,
-      "src/renderer/src/lib/worktree-display-name-order.test.ts": 13,
-      "src/renderer/src/lib/worktree-draft-startup-view-mode.test.ts": 12,
-      "src/renderer/src/lib/worktree-git-identity-display.test.ts": 4,
-      "src/renderer/src/lib/worktree-jump-navigation.test.ts": 21,
-      "src/renderer/src/lib/worktree-live-terminal-surface-owners.test.ts": 13,
-      "src/renderer/src/lib/worktree-operation-generation.test.ts": 7,
-      "src/renderer/src/lib/worktree-operation-route.test.ts": 20,
-      "src/renderer/src/lib/worktree-palette-comment-snippet.test.ts": 13,
-      "src/renderer/src/lib/worktree-palette-create-action.test.ts": 7,
-      "src/renderer/src/lib/worktree-palette-multi-keyword.test.ts": 143,
-      "src/renderer/src/lib/worktree-palette-review-match.test.ts": 9,
-      "src/renderer/src/lib/worktree-palette-runtime-owner-identity.test.ts": 14,
-      "src/renderer/src/lib/worktree-palette-search.test.ts": 62,
-      "src/renderer/src/lib/worktree-palette-task-url-match.test.ts": 25,
-      "src/renderer/src/lib/worktree-reactivation-preserved-pane-replacement.test.ts": 53,
-      "src/renderer/src/lib/worktree-reactivation-runtime-owned-resume-deferral.test.ts": 30,
-      "src/renderer/src/lib/worktree-reactivation-tab-forkbomb.test.ts": 30,
-      "src/renderer/src/lib/worktree-runtime-owner-index.detected-perf.test.ts": 411,
-      "src/renderer/src/lib/worktree-runtime-owner-index.detected.test.ts": 80,
-      "src/renderer/src/lib/worktree-runtime-owner-index.test.ts": 7,
-      "src/renderer/src/lib/worktree-runtime-owner.test.ts": 64,
-      "src/renderer/src/lib/worktree-sort-order-host-split.test.ts": 5,
-      "src/renderer/src/lib/worktree-sort-order-persistence.test.ts": 29,
-      "src/renderer/src/lib/worktree-status-spinner-launch-agent.test.ts": 15,
-      "src/renderer/src/lib/worktree-status-terminal-layout-roots.test.ts": 4,
-      "src/renderer/src/lib/worktree-status.interrupted.test.ts": 8,
-      "src/renderer/src/lib/worktree-status.test.ts": 16,
-      "src/renderer/src/lib/worktree-visit-recency.test.ts": 6,
-      "src/renderer/src/renderer-node-builtin-boundary.test.ts": 1808,
-      "src/renderer/src/runtime/agent-resume-host-authority-capability.test.ts": 11,
-      "src/renderer/src/runtime/agent-session-operation-id.test.ts": 6,
-      "src/renderer/src/runtime/browser-client-host-identity.test.ts": 7,
-      "src/renderer/src/runtime/browser-workspace-tab-close-census.test.ts": 221,
-      "src/renderer/src/runtime/browser-workspace-tab-close-plan.test.ts": 11,
-      "src/renderer/src/runtime/browser-workspace-tab-close.test.ts": 21,
-      "src/renderer/src/runtime/client-hosted-browser-close-intent-replay.test.ts": 11,
-      "src/renderer/src/runtime/client-hosted-browser-close-intents.test.ts": 16,
-      "src/renderer/src/runtime/client-hosted-browser-row-close.test.ts": 13,
-      "src/renderer/src/runtime/close-mirrored-editor-tab.test.ts": 61,
-      "src/renderer/src/runtime/file-explorer-delete-owner-provenance.test.ts": 47,
-      "src/renderer/src/runtime/focus-runtime-terminal-surface-chat-view.test.ts": 13,
-      "src/renderer/src/runtime/github-check-details-timeout.test.ts": 14,
-      "src/renderer/src/runtime/gitlab-job-trace-client.test.ts": 25,
-      "src/renderer/src/runtime/host-session-mirror-empty-inventory-settle.test.ts": 37,
-      "src/renderer/src/runtime/host-session-mirror-hydration-frame-ordering.test.tsx": 120,
-      "src/renderer/src/runtime/host-session-mirror-settle-census.test.ts": 76,
-      "src/renderer/src/runtime/host-session-mirror-settle-receipt-frames.test.tsx": 165,
-      "src/renderer/src/runtime/host-session-snapshot-authority-client-hosted.test.ts": 4,
-      "src/renderer/src/runtime/local-runtime-capabilities.test.ts": 10,
-      "src/renderer/src/runtime/local-session-tab-close-owner.test.ts": 9,
-      "src/renderer/src/runtime/local-structured-session-empty-worktree-visibility.test.ts": 17,
-      "src/renderer/src/runtime/local-structured-session-retired-epoch-repair.test.ts": 21,
-      "src/renderer/src/runtime/local-structured-session-reveal-visibility.test.ts": 35,
-      "src/renderer/src/runtime/local-structured-session-tabs-host-isolation.test.ts": 28,
-      "src/renderer/src/runtime/local-structured-session-tabs-sync.test.ts": 210,
-      "src/renderer/src/runtime/local-structured-session-tabs-sync/retired-epoch-repair.test.ts": 16,
-      "src/renderer/src/runtime/mirrored-agent-status-clock-skew.test.ts": 51,
-      "src/renderer/src/runtime/mobile-markdown-bridge-save-guards.test.ts": 58,
-      "src/renderer/src/runtime/mobile-markdown-bridge.test.ts": 31,
-      "src/renderer/src/runtime/native-chat-launch-draft-runtime-resolution.test.ts": 6,
-      "src/renderer/src/runtime/paired-reconnect-sidebar-agent-count.test.ts": 146,
-      "src/renderer/src/runtime/remote-agent-row-last-assistant-message.test.ts": 98,
-      "src/renderer/src/runtime/remote-agent-session-launch.test.ts": 11,
-      "src/renderer/src/runtime/remote-host-file-delete-repro.test.ts": 30,
-      "src/renderer/src/runtime/remote-host-file-open-repro.test.ts": 16,
-      "src/renderer/src/runtime/remote-runtime-session-tabs-inflight.test.ts": 11,
-      "src/renderer/src/runtime/remote-runtime-snapshot-outcome.test.ts": 28,
-      "src/renderer/src/runtime/remote-runtime-terminal-end-verdict.test.ts": 49,
-      "src/renderer/src/runtime/remote-runtime-terminal-frame-drop-resync.test.ts": 47,
-      "src/renderer/src/runtime/remote-runtime-terminal-parse-backpressure.test.ts": 296,
-      "src/renderer/src/runtime/remote-runtime-terminal-snapshot-kitty-flags.test.ts": 17,
-      "src/renderer/src/runtime/remote-runtime-terminal-stale-stream-frames.test.ts": 9,
-      "src/renderer/src/runtime/remote-runtime-terminal-stall-recovery.test.ts": 145,
-      "src/renderer/src/runtime/remote-server-install-failure-probe.test.ts": 9,
-      "src/renderer/src/runtime/remote-server-parity.test.ts": 28,
-      "src/renderer/src/runtime/remote-server-restart-wait.test.ts": 7,
-      "src/renderer/src/runtime/remote-server-update-coordinator.test.ts": 24,
-      "src/renderer/src/runtime/remote-terminal-layout-resolution.test.ts": 14,
-      "src/renderer/src/runtime/remote-terminal-stream-watchdog.test.ts": 13,
-      "src/renderer/src/runtime/restored-client-hosted-browser-host-attach.test.ts": 16,
-      "src/renderer/src/runtime/restored-client-hosted-browser-host-restart-attach.test.ts": 15,
-      "src/renderer/src/runtime/runtime-client-events.test.ts": 9,
-      "src/renderer/src/runtime/runtime-environment-ssh-state.test.ts": 148,
-      "src/renderer/src/runtime/runtime-file-client-download.test.ts": 21,
-      "src/renderer/src/runtime/runtime-file-client-external-import.test.ts": 20,
-      "src/renderer/src/runtime/runtime-file-client-mutation-ownership.test.ts": 17,
-      "src/renderer/src/runtime/runtime-file-client-search-listing.test.ts": 129,
-      "src/renderer/src/runtime/runtime-file-client-watch.test.ts": 73,
-      "src/renderer/src/runtime/runtime-file-client.test.ts": 18,
-      "src/renderer/src/runtime/runtime-file-import-pairing-revision.test.ts": 22,
-      "src/renderer/src/runtime/runtime-file-search-bounds.test.ts": 7,
-      "src/renderer/src/runtime/runtime-git-client-api-contract.test.ts": 4,
-      "src/renderer/src/runtime/runtime-git-client-branch-line-total.test.ts": 13,
-      "src/renderer/src/runtime/runtime-git-client-merge.test.ts": 11,
-      "src/renderer/src/runtime/runtime-git-client.test.ts": 32,
-      "src/renderer/src/runtime/runtime-hooks-client.test.ts": 9,
-      "src/renderer/src/runtime/runtime-host-connection-state.test.ts": 7,
-      "src/renderer/src/runtime/runtime-jira-client.test.ts": 17,
-      "src/renderer/src/runtime/runtime-jira-payload-stream.test.ts": 10,
-      "src/renderer/src/runtime/runtime-linear-client.test.ts": 25,
-      "src/renderer/src/runtime/runtime-provider-accounts-client.test.ts": 37,
-      "src/renderer/src/runtime/runtime-provider-search-bounds.test.ts": 7,
-      "src/renderer/src/runtime/runtime-repo-client.test.ts": 7,
-      "src/renderer/src/runtime/runtime-repo-search-bounds.test.ts": 7,
-      "src/renderer/src/runtime/runtime-rpc-client-pairing-revision.test.ts": 7,
-      "src/renderer/src/runtime/runtime-rpc-client.test.ts": 22,
-      "src/renderer/src/runtime/runtime-rpc-result.test.ts": 9,
-      "src/renderer/src/runtime/runtime-server-directory-browser.test.ts": 9,
-      "src/renderer/src/runtime/runtime-skills-client.test.ts": 12,
-      "src/renderer/src/runtime/runtime-skills-delete-client.test.ts": 15,
-      "src/renderer/src/runtime/runtime-terminal-inspection.test.ts": 683,
-      "src/renderer/src/runtime/runtime-terminal-stream.test.ts": 286,
-      "src/renderer/src/runtime/runtime-worktree-selector.test.ts": 6,
-      "src/renderer/src/runtime/structured-agent-session-client.test.ts": 14,
-      "src/renderer/src/runtime/structured-agent-session-close.test.ts": 8,
-      "src/renderer/src/runtime/structured-agent-session-status-feed-lifecycle.test.ts": 11,
-      "src/renderer/src/runtime/structured-agent-session-status-feed.test.ts": 18,
-      "src/renderer/src/runtime/structured-conversation-tab-replacement.test.ts": 20,
-      "src/renderer/src/runtime/sync-runtime-graph-agent-status-projection-join.test.ts": 51,
-      "src/renderer/src/runtime/sync-runtime-graph-agent-status-projection.test.ts": 20,
-      "src/renderer/src/runtime/sync-runtime-graph-automation-leaf.test.ts": 16,
-      "src/renderer/src/runtime/sync-runtime-graph-browser.test.ts": 15,
-      "src/renderer/src/runtime/sync-runtime-graph-conversion-publish.test.ts": 83,
-      "src/renderer/src/runtime/sync-runtime-graph-editor-diff-tabs.test.ts": 19,
-      "src/renderer/src/runtime/sync-runtime-graph-key-reuse.test.ts": 19,
-      "src/renderer/src/runtime/sync-runtime-graph-parked-leaf.test.ts": 29,
-      "src/renderer/src/runtime/sync-runtime-graph-payload-partition.test.ts": 32,
-      "src/renderer/src/runtime/sync-runtime-graph-projection-hot-path.test.ts": 128,
-      "src/renderer/src/runtime/sync-runtime-graph-publication-cost.test.ts": 55,
-      "src/renderer/src/runtime/sync-runtime-graph-scheduling.test.ts": 24,
-      "src/renderer/src/runtime/sync-runtime-graph-terminal-layout.test.ts": 696,
-      "src/renderer/src/runtime/sync-runtime-graph-terminal-registration-ownership.test.ts": 13,
-      "src/renderer/src/runtime/sync-runtime-graph-terminal-surface-projection.test.ts": 30,
-      "src/renderer/src/runtime/sync-runtime-graph-workspace-publication.test.ts": 19,
-      "src/renderer/src/runtime/sync-runtime-graph.test.ts": 20,
-      "src/renderer/src/runtime/sync-runtime-graph/mobile-terminal-theme.test.ts": 4,
-      "src/renderer/src/runtime/use-remote-runtime-recovery-triggers.test.ts": 22,
-      "src/renderer/src/runtime/use-runtime-session-mirror-environment-key.test.ts": 78,
-      "src/renderer/src/runtime/use-worktree-runtime-target.test.ts": 58,
-      "src/renderer/src/runtime/web-runtime-browser-capability-cleanup.test.ts": 16,
-      "src/renderer/src/runtime/web-runtime-browser-materialization.test.ts": 4,
-      "src/renderer/src/runtime/web-runtime-browser-tab-staging-hosting-intent.test.ts": 9,
-      "src/renderer/src/runtime/web-runtime-session-browser-client-placement.test.ts": 81,
-      "src/renderer/src/runtime/web-runtime-session-browser-create-failure.test.ts": 112,
-      "src/renderer/src/runtime/web-runtime-session-browser-create-focus.test.ts": 283,
-      "src/renderer/src/runtime/web-runtime-session-browser-create-split-placement.test.ts": 231,
-      "src/renderer/src/runtime/web-runtime-session-browser-create-staged-focus.test.ts": 118,
-      "src/renderer/src/runtime/web-runtime-session-browser-create-staged-hosting-intent.test.ts": 32,
-      "src/renderer/src/runtime/web-runtime-session-browser-create-staging.test.ts": 320,
-      "src/renderer/src/runtime/web-runtime-session-browser-placement-staleness.test.ts": 22,
-      "src/renderer/src/runtime/web-runtime-session-tab-activate-close.test.ts": 27,
-      "src/renderer/src/runtime/web-runtime-session-tab-move.test.ts": 11,
-      "src/renderer/src/runtime/web-runtime-session-tab-props.test.ts": 116,
-      "src/renderer/src/runtime/web-runtime-session-terminal-host-authority.test.ts": 38,
-      "src/renderer/src/runtime/web-runtime-session-terminal-legacy-create.test.ts": 35,
-      "src/renderer/src/runtime/web-runtime-session-terminal-pane-delegation.test.ts": 590,
-      "src/renderer/src/runtime/web-runtime-session-terminal-workspace-routing.test.ts": 16,
-      "src/renderer/src/runtime/web-runtime-session.test.ts": 16,
-      "src/renderer/src/runtime/web-runtime-wake-terminal-respawn.test.ts": 4,
-      "src/renderer/src/runtime/web-session-browser-placement.test.ts": 8,
-      "src/renderer/src/runtime/web-session-close-intent.test.ts": 7,
-      "src/renderer/src/runtime/web-session-existing-tab-index.test.ts": 7,
-      "src/renderer/src/runtime/web-session-focus-intent-visible-tab.test.ts": 9,
-      "src/renderer/src/runtime/web-session-intent-owner.test.ts": 7,
-      "src/renderer/src/runtime/web-session-open-files-batch-equivalence.test.ts": 333,
-      "src/renderer/src/runtime/web-session-structured-tab-focus.test.ts": 11,
-      "src/renderer/src/runtime/web-session-tabs-agent-completion-notifications.test.ts": 40,
-      "src/renderer/src/runtime/web-session-tabs-sync-agent-handoff.test.ts": 15,
-      "src/renderer/src/runtime/web-session-tabs-sync-agent-status.test.ts": 19,
-      "src/renderer/src/runtime/web-session-tabs-sync-browser-tabs.test.ts": 29,
-      "src/renderer/src/runtime/web-session-tabs-sync-client-owned-page-content.test.ts": 22,
-      "src/renderer/src/runtime/web-session-tabs-sync-client-owned-placement.test.ts": 36,
-      "src/renderer/src/runtime/web-session-tabs-sync-diff-focus-steal.test.ts": 19,
-      "src/renderer/src/runtime/web-session-tabs-sync-editor-tabs.test.ts": 15,
-      "src/renderer/src/runtime/web-session-tabs-sync-focus-intent.test.ts": 26,
-      "src/renderer/src/runtime/web-session-tabs-sync-host-restart-browser-rows.test.ts": 22,
-      "src/renderer/src/runtime/web-session-tabs-sync-host-tab-retraction-ghost-rows.test.ts": 138,
-      "src/renderer/src/runtime/web-session-tabs-sync-html-preview-focus.test.ts": 21,
-      "src/renderer/src/runtime/web-session-tabs-sync-layout-duplicate-groups.test.ts": 15,
-      "src/renderer/src/runtime/web-session-tabs-sync-layout-groups.test.ts": 22,
-      "src/renderer/src/runtime/web-session-tabs-sync-mirror-identity.test.ts": 54,
-      "src/renderer/src/runtime/web-session-tabs-sync-remote-status-title-flap.test.ts": 109,
-      "src/renderer/src/runtime/web-session-tabs-sync-restored-browser-rows.test.ts": 17,
-      "src/renderer/src/runtime/web-session-tabs-sync-snapshot-batch.test.ts": 36,
-      "src/renderer/src/runtime/web-session-tabs-sync-staged-browser-adoption.test.ts": 15,
-      "src/renderer/src/runtime/web-session-tabs-sync-staged-browser-authority.test.ts": 12,
-      "src/renderer/src/runtime/web-session-tabs-sync-terminal-bootstrap.test.ts": 5,
-      "src/renderer/src/runtime/web-session-tabs-sync-terminal-mirroring.test.ts": 30,
-      "src/renderer/src/runtime/web-session-tabs-sync-tracking-teardown.test.ts": 18,
-      "src/renderer/src/runtime/web-session-tabs-sync-visibility-collision.test.tsx": 113,
-      "src/renderer/src/runtime/web-session-tabs-sync-window-visibility.test.tsx": 170,
-      "src/renderer/src/runtime/web-session-tabs-sync.test.ts": 29,
-      "src/renderer/src/runtime/web-session-tabs-sync/mirrored-agent-tab-label.test.ts": 7,
-      "src/renderer/src/runtime/web-session-tabs-sync/mirrored-terminal-recovery-ledger.test.ts": 9,
-      "src/renderer/src/runtime/web-session-terminal-handle-events.test.ts": 6,
-      "src/renderer/src/runtime/web-session-terminal-orphan-absence-across-republication.test.ts": 11,
-      "src/renderer/src/runtime/web-session-terminal-orphan-inventory-retry.test.ts": 43,
-      "src/renderer/src/runtime/web-session-terminal-orphan-mixed-version.test.ts": 49,
-      "src/renderer/src/runtime/web-session-terminal-orphan-recovery-adoption-regressions.test.ts": 179,
-      "src/renderer/src/runtime/web-session-terminal-orphan-recovery-host-scope-gate.test.ts": 10,
-      "src/renderer/src/runtime/web-session-terminal-orphan-recovery-prior-removal.test.ts": 15,
-      "src/renderer/src/runtime/web-session-terminal-orphan-recovery-regressions.test.ts": 295,
-      "src/renderer/src/runtime/web-session-terminal-orphan-recovery-topology-fence.test.ts": 168,
-      "src/renderer/src/runtime/web-session-terminal-orphan-recovery.test.ts": 122,
-      "src/renderer/src/runtime/web-session-terminal-pending-handle-recovery.test.ts": 33,
-      "src/renderer/src/runtime/web-session-terminal-recovery-snapshot-validation.test.ts": 155,
-      "src/renderer/src/runtime/web-session-terminal-retirement-proof-ledger.test.ts": 11,
-      "src/renderer/src/runtime/window-visibility-subscription-parking.test.ts": 26,
-      "src/renderer/src/runtime/worktree-create-base.test.ts": 4,
-      "src/renderer/src/ssh/ssh-connect-in-flight.test.ts": 21,
-      "src/renderer/src/ssh/ssh-connect-ui-timeout.test.ts": 15,
-      "src/renderer/src/ssh/ssh-connect-verb.test.ts": 7,
-      "src/renderer/src/ssh/ssh-connection-recoverability.test.ts": 6,
-      "src/renderer/src/startup/active-workspace-ssh-targets.test.ts": 7,
-      "src/renderer/src/startup/ssh-startup-reconnect.test.ts": 16,
-      "src/renderer/src/startup/startup-ssh-connection-restore.test.ts": 13,
-      "src/renderer/src/store/active-terminal-chrome-selector.test.ts": 17,
-      "src/renderer/src/store/always-mounted-selector-scan-cost.test.ts": 116,
-      "src/renderer/src/store/copy-on-write-record.test.ts": 6,
-      "src/renderer/src/store/folder-workspaces/folder-workspace-catalog.test.ts": 14,
-      "src/renderer/src/store/pinned-tab-close-guard.test.ts": 13,
-      "src/renderer/src/store/plugin-language-packs.test.ts": 21,
-      "src/renderer/src/store/plugin-panels.test.ts": 13,
-      "src/renderer/src/store/project-host-setup-selector.test.ts": 18,
-      "src/renderer/src/store/projects/project-catalog-null-field-ingest.test.ts": 12,
-      "src/renderer/src/store/projects/project-wsl-filesystem-boundary-advisory.test.ts": 13,
-      "src/renderer/src/store/react-commit-cascade-write-probe.test.ts": 5,
-      "src/renderer/src/store/repos/safe-auto-fork-sync.test.ts": 8,
-      "src/renderer/src/store/right-sidebar-route.test.ts": 6,
-      "src/renderer/src/store/running-terminal-close-confirm.test.ts": 7,
-      "src/renderer/src/store/selectors.test.ts": 44,
-      "src/renderer/src/store/slices/active-tab-owner-worktree.test.ts": 12,
-      "src/renderer/src/store/slices/activity-cleared-at.test.ts": 82,
-      "src/renderer/src/store/slices/agent-generated-tab-title.test.ts": 141,
-      "src/renderer/src/store/slices/agent-hibernation-live-anchor-e2e.test.ts": 53,
-      "src/renderer/src/store/slices/agent-pane-authority.test.ts": 110,
-      "src/renderer/src/store/slices/agent-status-ack-cleanup.test.ts": 99,
-      "src/renderer/src/store/slices/agent-status-batch.test.ts": 154,
-      "src/renderer/src/store/slices/agent-status-drop-ipc.test.ts": 705,
-      "src/renderer/src/store/slices/agent-status-drop.test.ts": 88,
-      "src/renderer/src/store/slices/agent-status-freshness-cache.test.ts": 10,
-      "src/renderer/src/store/slices/agent-status-freshness-scheduler.test.ts": 20,
-      "src/renderer/src/store/slices/agent-status-live-freshness-request.test.ts": 7,
-      "src/renderer/src/store/slices/agent-status-live-map-leak.test.ts": 10291,
-      "src/renderer/src/store/slices/agent-status-manual-sleep-capture.test.ts": 90,
-      "src/renderer/src/store/slices/agent-status-observation-neutrality.test.ts": 107,
-      "src/renderer/src/store/slices/agent-status-pane-keyed-records.test.ts": 26,
-      "src/renderer/src/store/slices/agent-status-pr-refresh-handoff.test.ts": 89,
-      "src/renderer/src/store/slices/agent-status-provider-session.test.ts": 117,
-      "src/renderer/src/store/slices/agent-status-quit-capture-resumable-agents.test.ts": 64,
-      "src/renderer/src/store/slices/agent-status-quit-capture.test.ts": 170,
-      "src/renderer/src/store/slices/agent-status-reminted-pane-key.test.ts": 41,
-      "src/renderer/src/store/slices/agent-status-retained-leak.test.ts": 846,
-      "src/renderer/src/store/slices/agent-status-retention-prefix-sweep.test.ts": 85,
-      "src/renderer/src/store/slices/agent-status-runtime-orchestration.test.ts": 96,
-      "src/renderer/src/store/slices/agent-status-session-boundary-done.test.ts": 60,
-      "src/renderer/src/store/slices/agent-status-ssh-connection-clear.test.ts": 64,
-      "src/renderer/src/store/slices/agent-status-tool-assistant-fields.test.ts": 128,
-      "src/renderer/src/store/slices/agent-status-worktree-purge-leak.test.ts": 50,
-      "src/renderer/src/store/slices/agent-status.test.ts": 54,
-      "src/renderer/src/store/slices/ambiguous-owner-warning-worktree-removal-leak.test.ts": 587,
-      "src/renderer/src/store/slices/browser-cleanup-close.test.ts": 151,
-      "src/renderer/src/store/slices/browser-page-close-intent-recording.test.ts": 191,
-      "src/renderer/src/store/slices/browser-page-conversion.test.ts": 125,
-      "src/renderer/src/store/slices/browser-remote-page-lifecycle.test.ts": 221,
-      "src/renderer/src/store/slices/browser-remote-tab-creation.test.ts": 42,
-      "src/renderer/src/store/slices/browser-session-host-selection.test.ts": 225,
-      "src/renderer/src/store/slices/browser-session-profiles.test.ts": 21,
-      "src/renderer/src/store/slices/browser-webview-cleanup.test.ts": 7,
-      "src/renderer/src/store/slices/browser-workspace-doc-location.test.ts": 171,
-      "src/renderer/src/store/slices/browser-workspace-host-ownership.test.ts": 18,
-      "src/renderer/src/store/slices/browser.test.ts": 43,
-      "src/renderer/src/store/slices/bulk-worktree-purge-terminal-maps-leak.test.ts": 89,
-      "src/renderer/src/store/slices/cmd-j-create-actions.test.ts": 90,
-      "src/renderer/src/store/slices/codex-restart-notice-lifecycle.test.ts": 48,
-      "src/renderer/src/store/slices/degraded-repo-hydration.test.ts": 81,
-      "src/renderer/src/store/slices/detected-agents-environment-prune-leak.test.ts": 55,
-      "src/renderer/src/store/slices/detected-agents.test.ts": 138,
-      "src/renderer/src/store/slices/detected-worktree-refresh-leases.test.ts": 11,
-      "src/renderer/src/store/slices/dictation-model-state-stabilisation.test.ts": 9,
-      "src/renderer/src/store/slices/diffComments.test.ts": 122,
-      "src/renderer/src/store/slices/direct-ssh-pane-detach-ledger.test.ts": 62,
-      "src/renderer/src/store/slices/direct-ssh-terminal-recovery.test.ts": 39,
-      "src/renderer/src/store/slices/direct-ssh-terminal-retry.test.ts": 147,
-      "src/renderer/src/store/slices/direct-ssh-terminal-workspace-scope.test.ts": 11,
-      "src/renderer/src/store/slices/editor-branch-diff-snapshots.test.ts": 19,
-      "src/renderer/src/store/slices/editor-branch-line-total.test.ts": 16,
-      "src/renderer/src/store/slices/editor-check-details-tabs.test.ts": 27,
-      "src/renderer/src/store/slices/editor-close-file-cleanup.test.ts": 255,
-      "src/renderer/src/store/slices/editor-git-status-reconciliation.test.ts": 31,
-      "src/renderer/src/store/slices/editor-hydration-scaling.test.ts": 85,
-      "src/renderer/src/store/slices/editor-markdown-link-activation.test.ts": 38,
-      "src/renderer/src/store/slices/editor-markdown-view-state.test.ts": 37,
-      "src/renderer/src/store/slices/editor-open-diff.test.ts": 42,
-      "src/renderer/src/store/slices/editor-read-only-tabs.test.ts": 16,
-      "src/renderer/src/store/slices/editor-recently-closed-tabs.test.ts": 40,
-      "src/renderer/src/store/slices/editor-rekey-open-files.test.ts": 75,
-      "src/renderer/src/store/slices/editor-remote-branch-actions.test.ts": 62,
-      "src/renderer/src/store/slices/editor-rich-markdown-size-override.test.ts": 14,
-      "src/renderer/src/store/slices/editor-right-sidebar-state.test.ts": 24,
-      "src/renderer/src/store/slices/editor-session-duplicate-restore.test.ts": 84,
-      "src/renderer/src/store/slices/editor-state-worktree-purge-leak.test.ts": 59,
-      "src/renderer/src/store/slices/editor-tab-placement.test.ts": 30,
-      "src/renderer/src/store/slices/editor/actions/markdown-preview-actions.test.ts": 9,
-      "src/renderer/src/store/slices/editor/file-ids/hydrated-editor-file-index.test.ts": 512,
-      "src/renderer/src/store/slices/editor/file-ids/hydrated-editor-projections.test.ts": 143,
-      "src/renderer/src/store/slices/editor/git/git-status-reconciliation.perf.test.ts": 36,
-      "src/renderer/src/store/slices/folder-workspace-activation-and-activity.test.ts": 144,
-      "src/renderer/src/store/slices/folder-workspace-diff-comments.test.ts": 388,
-      "src/renderer/src/store/slices/folder-workspace-owner-routed-mutations.test.ts": 188,
-      "src/renderer/src/store/slices/generation-records-worktree-removal-leak.test.ts": 75,
-      "src/renderer/src/store/slices/github-branch-mismatched-linked-pr.test.ts": 5,
-      "src/renderer/src/store/slices/github-cache-eviction-and-bounds.test.ts": 221,
-      "src/renderer/src/store/slices/github-checks-cache.test.ts": 46,
-      "src/renderer/src/store/slices/github-checks.test.ts": 9,
-      "src/renderer/src/store/slices/github-issue-source-indicator-suppression.test.ts": 45,
-      "src/renderer/src/store/slices/github-issue-state-machine.test.ts": 35,
-      "src/renderer/src/store/slices/github-pr-branch-coordinator-events.test.ts": 35,
-      "src/renderer/src/store/slices/github-pr-branch-direct-refresh-scope.test.ts": 20,
-      "src/renderer/src/store/slices/github-pr-branch-fallback-results.test.ts": 26,
-      "src/renderer/src/store/slices/github-pr-branch-hosted-review-cache.test.ts": 27,
-      "src/renderer/src/store/slices/github-pr-branch-linked-pr-divergence.test.ts": 33,
-      "src/renderer/src/store/slices/github-pr-checks-fetch.test.ts": 121,
-      "src/renderer/src/store/slices/github-pr-comments.test.ts": 89,
-      "src/renderer/src/store/slices/github-pr-refresh-host-guard.test.ts": 28,
-      "src/renderer/src/store/slices/github-pr-refresh-hosted-review-cache-leak.test.ts": 802,
-      "src/renderer/src/store/slices/github-pr-refresh-owner-routing.test.ts": 218,
-      "src/renderer/src/store/slices/github-pr-refresh-sequences-leak.test.ts": 16,
-      "src/renderer/src/store/slices/github-pr-refresh-states-leak.test.ts": 4478,
-      "src/renderer/src/store/slices/github-project-request-coordination.test.ts": 20,
-      "src/renderer/src/store/slices/github-project-row-owner.test.ts": 6,
-      "src/renderer/src/store/slices/github-project-view-tables.test.ts": 60,
-      "src/renderer/src/store/slices/github-provider-request-concurrency.test.ts": 19,
-      "src/renderer/src/store/slices/github-refresh-sweep.test.ts": 252,
-      "src/renderer/src/store/slices/github-repo-lookup-index.test.ts": 4,
-      "src/renderer/src/store/slices/github-review-thread-actions.test.ts": 24,
-      "src/renderer/src/store/slices/github-work-item-cache-identity.test.ts": 13,
-      "src/renderer/src/store/slices/github-work-items-error-envelope.test.ts": 43,
-      "src/renderer/src/store/slices/github-work-items-pagination.test.ts": 29,
-      "src/renderer/src/store/slices/github-work-items-query-bounds.test.ts": 10,
-      "src/renderer/src/store/slices/github-work-items-runtime-routing.test.ts": 218,
-      "src/renderer/src/store/slices/github-worktree-refresh-if-stale.test.ts": 85,
-      "src/renderer/src/store/slices/hosted-review-cache-race.test.ts": 15,
-      "src/renderer/src/store/slices/hosted-review-cache.test.ts": 69,
-      "src/renderer/src/store/slices/hosted-review.test.ts": 20,
-      "src/renderer/src/store/slices/jira.test.ts": 41,
-      "src/renderer/src/store/slices/linear-credential-error-recovery.test.ts": 31,
-      "src/renderer/src/store/slices/linear-invalidation.test.ts": 23,
-      "src/renderer/src/store/slices/linear-issue-cache-refresh.test.ts": 17,
-      "src/renderer/src/store/slices/linear-scoped-collection-cache.test.ts": 40,
-      "src/renderer/src/store/slices/linear-source-context-cache-scope.test.ts": 20,
-      "src/renderer/src/store/slices/linear.test.ts": 13,
-      "src/renderer/src/store/slices/local-detected-agent-state.test.ts": 12,
-      "src/renderer/src/store/slices/memory.test.ts": 7,
-      "src/renderer/src/store/slices/native-chat-launch-draft-teardown.test.ts": 84,
-      "src/renderer/src/store/slices/new-issue-draft.test.ts": 7,
-      "src/renderer/src/store/slices/new-markdown.test.ts": 23,
-      "src/renderer/src/store/slices/orca-profiles-auth-actions.test.ts": 80,
-      "src/renderer/src/store/slices/orca-profiles.test.ts": 89,
-      "src/renderer/src/store/slices/pane-column-split-drop-no-op.test.ts": 8,
-      "src/renderer/src/store/slices/pane-foreground-agent.test.ts": 57,
-      "src/renderer/src/store/slices/persisted-ui-write-baseline.test.ts": 9,
-      "src/renderer/src/store/slices/pinned-tab-close-confirm.test.ts": 9,
-      "src/renderer/src/store/slices/preflight.test.ts": 26,
-      "src/renderer/src/store/slices/project-group-removal-targets.test.ts": 8,
-      "src/renderer/src/store/slices/purge-stale-runtime-host-ownership.test.ts": 50,
-      "src/renderer/src/store/slices/purge-stale-runtime-host-state.test.ts": 137,
-      "src/renderer/src/store/slices/rate-limits.test.ts": 7,
-      "src/renderer/src/store/slices/readopted-ssh-worktree-rows.test.ts": 6,
-      "src/renderer/src/store/slices/recently-closed-tabs.test.ts": 211,
-      "src/renderer/src/store/slices/remote-server-updates.integration.test.ts": 15,
-      "src/renderer/src/store/slices/repo-identity-reconcile.test.ts": 12,
-      "src/renderer/src/store/slices/repo-owner-cache-identity.test.ts": 5,
-      "src/renderer/src/store/slices/repo-reorder-host-split.test.ts": 5,
-      "src/renderer/src/store/slices/repos-add-races.test.ts": 56,
-      "src/renderer/src/store/slices/repos-all-hosts-folder-workspaces.test.ts": 76,
-      "src/renderer/src/store/slices/repos-all-hosts-generation.test.ts": 114,
-      "src/renderer/src/store/slices/repos-all-hosts.test.ts": 148,
-      "src/renderer/src/store/slices/repos-catalog-merge-identity.test.ts": 88,
-      "src/renderer/src/store/slices/repos-cross-host-project-collisions.test.ts": 117,
-      "src/renderer/src/store/slices/repos-cross-host-refresh-identity.test.ts": 91,
-      "src/renderer/src/store/slices/repos-ephemeral-vm-cleanup-retention.test.ts": 32,
-      "src/renderer/src/store/slices/repos-host-identity-routing.test.ts": 191,
-      "src/renderer/src/store/slices/repos-manual-order-hydration.test.ts": 172,
-      "src/renderer/src/store/slices/repos-module-lifetime-coordinators.test.ts": 71,
-      "src/renderer/src/store/slices/repos-nested-import-refresh-failures.test.ts": 57,
-      "src/renderer/src/store/slices/repos-nested-ssh-projection.test.ts": 52,
-      "src/renderer/src/store/slices/repos-onboarding-folder-startup.test.ts": 349,
-      "src/renderer/src/store/slices/repos-paired-runtime-add.test.ts": 46,
-      "src/renderer/src/store/slices/repos-project-group-create-race.test.ts": 101,
-      "src/renderer/src/store/slices/repos-project-groups-delete.test.ts": 86,
-      "src/renderer/src/store/slices/repos-project-groups-owner-routing.test.ts": 73,
-      "src/renderer/src/store/slices/repos-project-groups.test.ts": 200,
-      "src/renderer/src/store/slices/repos-project-host-capability.test.ts": 93,
-      "src/renderer/src/store/slices/repos-project-host-lifecycle.test.ts": 50,
-      "src/renderer/src/store/slices/repos-project-runtime.test.ts": 77,
-      "src/renderer/src/store/slices/repos-refresh-identity.test.ts": 128,
-      "src/renderer/src/store/slices/repos-remove-missing-remote-project.test.ts": 57,
-      "src/renderer/src/store/slices/repos-remove-project-purge-leak.test.ts": 87,
-      "src/renderer/src/store/slices/repos-runtime-project-groups.test.ts": 56,
-      "src/renderer/src/store/slices/repos-runtime-visibility-defaults.test.ts": 43,
-      "src/renderer/src/store/slices/repos-selected-owner-routing.test.ts": 194,
-      "src/renderer/src/store/slices/repos-setup-script-dismissals.test.ts": 52,
-      "src/renderer/src/store/slices/repos-shared-project-badge-color.test.ts": 67,
-      "src/renderer/src/store/slices/repos-ssh-host-reconciliation.test.ts": 80,
-      "src/renderer/src/store/slices/repos-stale-fetch.test.ts": 93,
-      "src/renderer/src/store/slices/repos-update-serialization.test.ts": 52,
-      "src/renderer/src/store/slices/repos.runtime-fallback.test.ts": 73,
-      "src/renderer/src/store/slices/repos.test.ts": 185,
-      "src/renderer/src/store/slices/restored-editor-owner-reparent.test.ts": 106,
-      "src/renderer/src/store/slices/runtime-catalog-merge-removed-env-guard.test.ts": 45,
-      "src/renderer/src/store/slices/runtime-environment-ssh.test.ts": 93,
-      "src/renderer/src/store/slices/runtime-host-purge-session-partition-split.test.ts": 50,
-      "src/renderer/src/store/slices/runtime-pane-title-sort-epoch.test.ts": 189,
-      "src/renderer/src/store/slices/runtime-status-catalog-identity.test.ts": 94,
-      "src/renderer/src/store/slices/runtime-status-first-publication.test.ts": 6,
-      "src/renderer/src/store/slices/runtime-status-refresh-diagnostics.test.ts": 7,
-      "src/renderer/src/store/slices/runtime-status-restored-browser-host-attach.test.ts": 9,
-      "src/renderer/src/store/slices/runtime-status-snapshot.test.ts": 8,
-      "src/renderer/src/store/slices/runtime-status.test.ts": 187,
-      "src/renderer/src/store/slices/runtime-switch-settings-persistence.test.ts": 37,
-      "src/renderer/src/store/slices/selected-host-active-workspace-identity.test.ts": 13,
-      "src/renderer/src/store/slices/set-runtime-environments-purge-wiring.test.ts": 46,
-      "src/renderer/src/store/slices/settings-owner-hydration-write-fence.test.ts": 211,
-      "src/renderer/src/store/slices/settings-search-state.test.ts": 8,
-      "src/renderer/src/store/slices/settings.test.ts": 338,
-      "src/renderer/src/store/slices/sparse-presets-repo-removal-purge-leak.test.ts": 78,
-      "src/renderer/src/store/slices/sparse-presets.test.ts": 26,
-      "src/renderer/src/store/slices/ssh.test.ts": 89,
-      "src/renderer/src/store/slices/stale-runtime-host-rows.test.ts": 15,
-      "src/renderer/src/store/slices/store-active-worktree-selection.test.ts": 87,
-      "src/renderer/src/store/slices/store-active-worktree-split-groups.test.ts": 94,
-      "src/renderer/src/store/slices/store-active-worktree-tab-close.test.ts": 159,
-      "src/renderer/src/store/slices/store-active-worktree-terminal-creation.test.ts": 88,
-      "src/renderer/src/store/slices/store-create-tab-id-hint.test.ts": 57,
-      "src/renderer/src/store/slices/store-session-browser-hydration.test.ts": 117,
-      "src/renderer/src/store/slices/store-session-cascades.test.ts": 86,
-      "src/renderer/src/store/slices/store-session-editor-hydration.test.ts": 111,
-      "src/renderer/src/store/slices/store-session-terminal-activity.test.ts": 169,
-      "src/renderer/src/store/slices/store-session-terminal-reconnect.test.ts": 78,
-      "src/renderer/src/store/slices/store-session-workspace-hydration.test.ts": 84,
-      "src/renderer/src/store/slices/store-sleep-agent-status-retention.test.ts": 122,
-      "src/renderer/src/store/slices/store-sleep-exact-runtime-stop.test.ts": 147,
-      "src/renderer/src/store/slices/store-sleep-pane-hibernation.test.ts": 96,
-      "src/renderer/src/store/slices/store-sleep-runtime-convergence.test.ts": 448,
-      "src/renderer/src/store/slices/store-sleep-shutdown-order.test.ts": 49,
-      "src/renderer/src/store/slices/store-worktree-removal-cascade.test.ts": 141,
-      "src/renderer/src/store/slices/superseded-ssh-repo-rows.test.ts": 7,
-      "src/renderer/src/store/slices/tab-group-reference-repair.test.ts": 15,
-      "src/renderer/src/store/slices/tab-group-state.test.ts": 19,
-      "src/renderer/src/store/slices/tab-view-mode.test.ts": 86,
-      "src/renderer/src/store/slices/tab-worktree-orphan-map-purge-leak.test.ts": 27,
-      "src/renderer/src/store/slices/tabs-empty-split-activation.test.ts": 29,
-      "src/renderer/src/store/slices/tabs-hydration-generated-title.test.ts": 12,
-      "src/renderer/src/store/slices/tabs-hydration-group-validation.test.ts": 15,
-      "src/renderer/src/store/slices/tabs-hydration.test.ts": 12,
-      "src/renderer/src/store/slices/tabs-label-and-pin-state.test.ts": 68,
-      "src/renderer/src/store/slices/tabs-model-reconciliation.test.ts": 83,
-      "src/renderer/src/store/slices/tabs-open-close-lifecycle.test.ts": 185,
-      "src/renderer/src/store/slices/tabs-pane-layout-operations.test.ts": 88,
-      "src/renderer/src/store/slices/tabs-session-hydration.test.ts": 67,
-      "src/renderer/src/store/slices/tabs-unread-and-focus.test.ts": 71,
-      "src/renderer/src/store/slices/tabs/hydrated-workspace-reconciliation-batch.test.ts": 423,
-      "src/renderer/src/store/slices/tabs/tab-selection-contract.test.ts": 12,
-      "src/renderer/src/store/slices/tabs/tabs-reconciliation-batch-identity.test.ts": 49,
-      "src/renderer/src/store/slices/task-creation-drafts.test.ts": 6,
-      "src/renderer/src/store/slices/terminal-helpers.test.ts": 11,
-      "src/renderer/src/store/slices/terminal-input-activity-store-write.test.ts": 51,
-      "src/renderer/src/store/slices/terminal-layout-pty-ownership.test.ts": 63,
-      "src/renderer/src/store/slices/terminal-orphan-helpers.test.ts": 8,
-      "src/renderer/src/store/slices/terminal-pane-detach-agent-identity.test.ts": 33,
-      "src/renderer/src/store/slices/terminal-pane-detach-agent-retention.test.ts": 92,
-      "src/renderer/src/store/slices/terminal-pty-identity-replacement.test.ts": 36,
-      "src/renderer/src/store/slices/terminal-quick-command-hosts.test.ts": 132,
-      "src/renderer/src/store/slices/terminal-startup-command-retention.test.ts": 80,
-      "src/renderer/src/store/slices/terminal-tab-id-hydration.test.ts": 38,
-      "src/renderer/src/store/slices/terminal-tab-owner-index.test.ts": 6,
-      "src/renderer/src/store/slices/terminal-tab-recovery-remount.test.ts": 151,
-      "src/renderer/src/store/slices/terminal-tab-retirement-store.test.ts": 172,
-      "src/renderer/src/store/slices/terminal-tab-retirement.test.ts": 15,
-      "src/renderer/src/store/slices/terminal-tab-title-batch.test.ts": 147,
-      "src/renderer/src/store/slices/terminal-write-identity-bailouts.test.ts": 85,
-      "src/renderer/src/store/slices/terminals-explicit-empty-hydration.test.ts": 61,
-      "src/renderer/src/store/slices/terminals-hydration-canonical-pty-overlap.test.ts": 87,
-      "src/renderer/src/store/slices/terminals-hydration-canonical-rows.test.ts": 76,
-      "src/renderer/src/store/slices/terminals-hydration.test.ts": 145,
-      "src/renderer/src/store/slices/ui-acknowledge-agents-clock-skew.test.ts": 17,
-      "src/renderer/src/store/slices/ui-agent-send-target.test.ts": 58,
-      "src/renderer/src/store/slices/ui-contextual-tours.test.ts": 51,
-      "src/renderer/src/store/slices/ui-feature-interactions.test.ts": 31,
-      "src/renderer/src/store/slices/ui-hydration-view-layout.test.ts": 46,
-      "src/renderer/src/store/slices/ui-hydration-workspace-cleanup-browse.test.ts": 11,
-      "src/renderer/src/store/slices/ui-hydration-workspace-preferences.test.ts": 45,
-      "src/renderer/src/store/slices/ui-modal-slot-dismissal.test.ts": 184,
-      "src/renderer/src/store/slices/ui-new-workspace-draft.test.ts": 8,
-      "src/renderer/src/store/slices/ui-notice-dismissals.test.ts": 52,
-      "src/renderer/src/store/slices/ui-page-navigation.test.ts": 51,
-      "src/renderer/src/store/slices/usage-snapshot-refresh.benchmark.test.ts": 6,
-      "src/renderer/src/store/slices/usage-web-client-fallback.test.ts": 12,
-      "src/renderer/src/store/slices/workspace-cleanup-browse.test.ts": 21,
-      "src/renderer/src/store/slices/workspace-cleanup-cache-hydration.test.ts": 174,
-      "src/renderer/src/store/slices/workspace-cleanup-enrichment-performance.test.ts": 285,
-      "src/renderer/src/store/slices/workspace-cleanup-host-qualified-list-state.test.ts": 71,
-      "src/renderer/src/store/slices/workspace-cleanup-local-evidence-invariants.test.ts": 7,
-      "src/renderer/src/store/slices/workspace-cleanup-removal-preflight.test.ts": 62,
-      "src/renderer/src/store/slices/workspace-cleanup-scan-progress-boundary.test.ts": 5,
-      "src/renderer/src/store/slices/workspace-cleanup-scan-progress.test.ts": 584,
-      "src/renderer/src/store/slices/workspace-cleanup-unverified-removal-consent.test.ts": 44,
-      "src/renderer/src/store/slices/workspace-cleanup-wrong-host-removal-guard.test.ts": 99,
-      "src/renderer/src/store/slices/workspace-cleanup-wrong-host-removal.test.ts": 143,
-      "src/renderer/src/store/slices/workspace-document-title-refresh.test.ts": 48,
-      "src/renderer/src/store/slices/workspace-space.test.ts": 11,
-      "src/renderer/src/store/slices/worktree-by-id-index.test.ts": 6,
-      "src/renderer/src/store/slices/worktree-catalog-reconciliation.test.ts": 12,
-      "src/renderer/src/store/slices/worktree-helpers.test.ts": 6,
-      "src/renderer/src/store/slices/worktree-listing-branch-switch.test.ts": 11,
-      "src/renderer/src/store/slices/worktree-meta-update-application.test.ts": 8,
-      "src/renderer/src/store/slices/worktree-nav-history-view-entries.test.ts": 21,
-      "src/renderer/src/store/slices/worktree-nav-history.test.ts": 12,
-      "src/renderer/src/store/slices/worktree-removal-maps-leak.test.ts": 91,
-      "src/renderer/src/store/slices/worktree-sleep-intent-lifecycle.test.ts": 78,
-      "src/renderer/src/store/slices/worktree-terminal-removal-teardown.test.ts": 79,
-      "src/renderer/src/store/slices/worktree-visibility-owner-settings.test.ts": 14,
-      "src/renderer/src/store/slices/worktree-visibility-settings-write.test.ts": 32,
-      "src/renderer/src/store/slices/worktrees-activity-persistence.test.ts": 66,
-      "src/renderer/src/store/slices/worktrees-create-base-status.test.ts": 33,
-      "src/renderer/src/store/slices/worktrees-create-parent-pick.test.ts": 27,
-      "src/renderer/src/store/slices/worktrees-fetch-listing-merge.test.ts": 42,
-      "src/renderer/src/store/slices/worktrees-fetch-owner-routing.test.ts": 173,
-      "src/renderer/src/store/slices/worktrees-fetch-persisted-metadata-fallback.test.ts": 25,
-      "src/renderer/src/store/slices/worktrees-fetch-refresh-coalescing.test.ts": 40,
-      "src/renderer/src/store/slices/worktrees-fetch-remote-lineage.test.ts": 25,
-      "src/renderer/src/store/slices/worktrees-fetch-removal-purge.test.ts": 87,
-      "src/renderer/src/store/slices/worktrees-git-identity-branch-title.test.ts": 17,
-      "src/renderer/src/store/slices/worktrees-git-identity-review-clear-persistence.test.ts": 488,
-      "src/renderer/src/store/slices/worktrees-hydration-purge.test.ts": 59,
-      "src/renderer/src/store/slices/worktrees-identity-migration.test.ts": 292,
-      "src/renderer/src/store/slices/worktrees-lineage-state.test.ts": 41,
-      "src/renderer/src/store/slices/worktrees-linked-review-push-target.test.ts": 69,
-      "src/renderer/src/store/slices/worktrees-metadata-persistence.test.ts": 43,
-      "src/renderer/src/store/slices/worktrees-pending-creation-state.test.ts": 70,
-      "src/renderer/src/store/slices/worktrees-purge-terminal-state.test.ts": 11,
-      "src/renderer/src/store/slices/worktrees-remote-runtime-create.test.ts": 35,
-      "src/renderer/src/store/slices/worktrees-remote-runtime-removal.test.ts": 49,
-      "src/renderer/src/store/slices/worktrees-removal-state-cleanup.test.ts": 60,
-      "src/renderer/src/store/slices/worktrees-runtime-connection-generation-fence.test.ts": 81,
-      "src/renderer/src/store/slices/worktrees-runtime-host-metadata-retirement.test.ts": 25,
-      "src/renderer/src/store/slices/worktrees-terminal-pr-url-linking.test.ts": 15,
-      "src/renderer/src/store/slices/worktrees-unread-state.test.ts": 19,
-      "src/renderer/src/store/slices/worktrees-workspace-selection-state.test.ts": 27,
-      "src/renderer/src/store/slices/worktrees/listing/detected-worktree-meta.test.ts": 8,
-      "src/renderer/src/store/slices/worktrees/listing/detected-worktree-unavailable-reason.test.ts": 7,
-      "src/renderer/src/store/slices/worktrees/metadata/worktree-meta-persist.test.ts": 14,
-      "src/renderer/src/store/slices/worktrees/teardown/host-qualified-removal-refusal.test.ts": 6,
-      "src/renderer/src/store/slices/worktrees/teardown/record-key-omission.test.ts": 7,
-      "src/renderer/src/store/slices/worktrees/teardown/remove-worktree-map-identity.test.ts": 9,
-      "src/renderer/src/store/slices/worktrees/teardown/worktree-teardown-array-identity.test.ts": 9,
-      "src/renderer/src/store/store-identity-churn-probe.test.ts": 19,
-      "src/renderer/src/store/store-listener-census.test.ts": 7,
-      "src/renderer/src/store/terminals/restored-relay-session-identity.test.ts": 88,
-      "src/renderer/src/store/terminals/structured-chat-tab-rename.test.ts": 68,
-      "src/renderer/src/store/terminals/terminal-pane-expansion-write-bailout.test.tsx": 113,
-      "src/renderer/src/store/terminals/terminal-shutdown-guards-identity.test.ts": 5,
-      "src/renderer/src/store/terminals/terminal-shutdown-map-identity.test.ts": 7,
-      "src/renderer/src/store/terminals/terminal-tab-close-map-identity.test.ts": 68,
-      "src/renderer/src/store/terminals/terminal-tab-close-tombstone.test.ts": 86,
-      "src/renderer/src/store/terminals/terminal-workspace-routing.scale.test.ts": 9,
-      "src/renderer/src/store/terminals/workspace-terminal-placeholders.test.ts": 10,
-      "src/renderer/src/store/worktree-diff-comments-selector.test.ts": 53,
-      "src/renderer/src/store/worktree-host-collision-index.test.ts": 7,
-      "src/renderer/src/store/worktree-visibility-defaults-by-host.test.ts": 5,
-      "src/renderer/src/web/preload-api/web-gitlab-api.test.ts": 23,
-      "src/renderer/src/web/web-clipboard-copy-fallback.test.ts": 12,
-      "src/renderer/src/web/web-clipboard-copy-terminal-selection.test.ts": 12,
-      "src/renderer/src/web/web-file-mutation-methods.test.ts": 14,
-      "src/renderer/src/web/web-pairing.test.ts": 11,
-      "src/renderer/src/web/web-preload-api-agent-providers.test.ts": 341,
-      "src/renderer/src/web/web-preload-api-clipboard.test.ts": 1137,
-      "src/renderer/src/web/web-preload-api-composition.test.ts": 443,
-      "src/renderer/src/web/web-preload-api-filesystem.test.ts": 413,
-      "src/renderer/src/web/web-preload-api-git.test.ts": 391,
-      "src/renderer/src/web/web-preload-api-github.test.ts": 312,
-      "src/renderer/src/web/web-preload-api-gitlab.test.ts": 596,
-      "src/renderer/src/web/web-preload-api-keybindings.test.ts": 444,
-      "src/renderer/src/web/web-preload-api-runtime-calls.test.ts": 755,
-      "src/renderer/src/web/web-preload-api-runtime-environment.test.ts": 1195,
-      "src/renderer/src/web/web-preload-api-settings.test.ts": 1562,
-      "src/renderer/src/web/web-preload-api-ssh.test.ts": 640,
-      "src/renderer/src/web/web-preload-api-ui.test.ts": 901,
-      "src/renderer/src/web/web-preload-api-workspace-catalog.test.ts": 903,
-      "src/renderer/src/web/web-preload-updater-package-recovery.test.ts": 370,
-      "src/renderer/src/web/web-runtime-client-export-parity.test.ts": 6,
-      "src/renderer/src/web/web-runtime-client-file-watch-replay.test.ts": 64,
-      "src/renderer/src/web/web-runtime-client-heartbeat.test.ts": 42,
-      "src/renderer/src/web/web-runtime-client-timeout-budget.test.ts": 45,
-      "src/renderer/src/web/web-runtime-client.test.ts": 351,
-      "src/renderer/src/web/web-runtime-connection-frame-router.test.ts": 6,
-      "src/renderer/src/web/web-runtime-connection-heartbeat-unsendable-probe.test.ts": 55,
-      "src/renderer/src/web/web-runtime-status-owner.test.ts": 651,
-      "src/renderer/src/web/web-viewport-shell.test.ts": 8,
-      "src/renderer/src/web/web-workspace-session.test.ts": 8,
-      "src/shared/add-repo-existing-workspaces-telemetry.test.ts": 9,
-      "src/shared/agent-cli-flag-detection.test.ts": 7,
-      "src/shared/agent-cli-install-dir-fallback.test.ts": 26,
-      "src/shared/agent-decorative-title-signature.test.ts": 11,
-      "src/shared/agent-detection.test.ts": 57,
-      "src/shared/agent-feature-install-commands.test.ts": 13,
-      "src/shared/agent-hook-endpoint-file.test.ts": 5,
-      "src/shared/agent-hook-endpoint-temp-cleanup.test.ts": 14,
-      "src/shared/agent-hook-listener-antigravity.test.ts": 17,
-      "src/shared/agent-hook-listener-claude-compatible-vendors.test.ts": 20,
-      "src/shared/agent-hook-listener-claude-subagents.test.ts": 21,
-      "src/shared/agent-hook-listener-claude-turn-state.test.ts": 19,
-      "src/shared/agent-hook-listener-command-code-transcript.test.ts": 114,
-      "src/shared/agent-hook-listener-extraction-characterization.test.ts": 23,
-      "src/shared/agent-hook-listener-grok.test.ts": 32,
-      "src/shared/agent-hook-listener-hermes-codex-droid.test.ts": 13,
-      "src/shared/agent-hook-listener-interactive-prompts.test.ts": 17,
-      "src/shared/agent-hook-listener-pi-compatible.test.ts": 15,
-      "src/shared/agent-hook-listener-relay-dependency.test.ts": 22,
-      "src/shared/agent-hook-listener-roster-retention.test.ts": 54,
-      "src/shared/agent-hook-listener-session-replacement.test.ts": 15,
-      "src/shared/agent-hook-listener-startless-child-lifecycle.test.ts": 22,
-      "src/shared/agent-hook-listener-transport.test.ts": 49,
-      "src/shared/agent-hook-listener/transcript-reader.test.ts": 93,
-      "src/shared/agent-hook-relay.test.ts": 9,
-      "src/shared/agent-hook-request-body-memory.test.ts": 53,
-      "src/shared/agent-hook-spool-read.test.ts": 9,
-      "src/shared/agent-hook-status-cache.test.ts": 5,
-      "src/shared/agent-hook-transport-interference.test.ts": 9,
-      "src/shared/agent-kind.test.ts": 9,
-      "src/shared/agent-launch-remote.test.ts": 7,
-      "src/shared/agent-model-probe-spec.test.ts": 9,
-      "src/shared/agent-notification-id.test.ts": 8,
-      "src/shared/agent-process-recognition.test.ts": 20,
-      "src/shared/agent-prompt-injection.test.ts": 7,
-      "src/shared/agent-resume-argv-drop.test.ts": 11,
-      "src/shared/agent-resume-launch-command.test.ts": 63,
-      "src/shared/agent-row-conversation-name.test.ts": 10,
-      "src/shared/agent-scratch-worktrees.test.ts": 7,
-      "src/shared/agent-session-conversation-name.test.ts": 9,
-      "src/shared/agent-session-definitive-refusal.test.ts": 11,
-      "src/shared/agent-session-journal-schemas.test.ts": 35,
-      "src/shared/agent-session-lease-adjudication.test.ts": 16,
-      "src/shared/agent-session-mutation-envelope.test.ts": 10,
-      "src/shared/agent-session-operation-ledger.test.ts": 9,
-      "src/shared/agent-session-option-catalog-grok.test.ts": 12,
-      "src/shared/agent-session-option-catalog.test.ts": 10,
-      "src/shared/agent-session-provider-handle.test.ts": 21,
-      "src/shared/agent-session-pty-write-admission.test.ts": 8,
-      "src/shared/agent-session-question-answer.test.ts": 9,
-      "src/shared/agent-session-resume.test.ts": 9,
-      "src/shared/agent-session-turn-record.test.ts": 9,
-      "src/shared/agent-skill-sharing-contract.test.ts": 9,
-      "src/shared/agent-skill-sharing-gate.test.ts": 6,
-      "src/shared/agent-status-observation.test.ts": 13,
-      "src/shared/agent-status-osc-pending-retention.test.ts": 73,
-      "src/shared/agent-status-osc-scan-budget.test.ts": 195,
-      "src/shared/agent-status-osc-split-frame-scan-budget.test.ts": 96,
-      "src/shared/agent-status-osc.test.ts": 16,
-      "src/shared/agent-status-types.test.ts": 29,
-      "src/shared/agent-tab-title.test.ts": 14,
-      "src/shared/agent-terminal-status-equivalence.test.ts": 4,
-      "src/shared/agent-title-agy-gemini-collision.test.ts": 23,
-      "src/shared/agent-title-decoration.test.ts": 9,
-      "src/shared/agent-title-evidence.test.ts": 43,
-      "src/shared/agent-title-identity-characterization.test.ts": 11,
-      "src/shared/agent-tui-input-clear.test.ts": 13,
-      "src/shared/ai-vault-resume-command.test.ts": 7,
-      "src/shared/ai-vault-resume-preparation.test.ts": 5,
-      "src/shared/ai-vault-scan-error-message.test.ts": 14,
-      "src/shared/ai-vault-search-query-operators.test.ts": 10,
-      "src/shared/ai-vault-session-depth.test.ts": 17,
+      "src/renderer/src/components/right-sidebar/source-control-create-pr-intent-flow.test.ts": 72,
+      "src/renderer/src/components/right-sidebar/source-control-create-pr-intent-state.test.ts": 38,
+      "src/renderer/src/components/right-sidebar/source-control-create-review-blocked-action.test.ts": 115,
+      "src/renderer/src/components/right-sidebar/source-control-created-review-link.test.ts": 50,
+      "src/renderer/src/components/right-sidebar/source-control-discard-confirmation.test.ts": 109,
+      "src/renderer/src/components/right-sidebar/source-control-discard-dialog.test.tsx": 321,
+      "src/renderer/src/components/right-sidebar/source-control-dropdown-items.create-pr-intent.test.ts": 135,
+      "src/renderer/src/components/right-sidebar/source-control-dropdown-items.test.ts": 222,
+      "src/renderer/src/components/right-sidebar/source-control-entry-actions.test.ts": 27,
+      "src/renderer/src/components/right-sidebar/source-control-entry-context-menu.test.tsx": 179,
+      "src/renderer/src/components/right-sidebar/source-control-file-filter.test.ts": 53,
+      "src/renderer/src/components/right-sidebar/source-control-header-toolbar-identity.test.tsx": 602,
+      "src/renderer/src/components/right-sidebar/source-control-header-toolbar.test.ts": 416,
+      "src/renderer/src/components/right-sidebar/source-control-hosted-review-creation-eligibility-snapshot.test.ts": 99,
+      "src/renderer/src/components/right-sidebar/source-control-hosted-review-push-target.test.ts": 35,
+      "src/renderer/src/components/right-sidebar/source-control-huge-repo-warning-dismissals.test.ts": 153,
+      "src/renderer/src/components/right-sidebar/source-control-launch-agent-args-applicability.test.ts": 195,
+      "src/renderer/src/components/right-sidebar/source-control-manual-review-url.test.ts": 56,
+      "src/renderer/src/components/right-sidebar/source-control-primary-action-tooltip.test.ts": 224,
+      "src/renderer/src/components/right-sidebar/source-control-primary-action.create-pr-intent.test.ts": 97,
+      "src/renderer/src/components/right-sidebar/source-control-primary-action.test.ts": 172,
+      "src/renderer/src/components/right-sidebar/source-control-push-recovery.test.ts": 37,
+      "src/renderer/src/components/right-sidebar/source-control-section-order.test.ts": 44,
+      "src/renderer/src/components/right-sidebar/source-control-split-open.test.ts": 50,
+      "src/renderer/src/components/right-sidebar/source-control-status-sort.test.ts": 83,
+      "src/renderer/src/components/right-sidebar/source-control-submodule-expansion.test.ts": 62,
+      "src/renderer/src/components/right-sidebar/source-control-text-generation-defaults.test.ts": 153,
+      "src/renderer/src/components/right-sidebar/source-control-too-many-changes-banner.test.tsx": 2910,
+      "src/renderer/src/components/right-sidebar/source-control-tree.test.ts": 73,
+      "src/renderer/src/components/right-sidebar/source-control/commit/discard-all-failure-description.test.tsx": 1290,
+      "src/renderer/src/components/right-sidebar/source-control/commit/source-control-entry-failure-toast.test.ts": 238,
+      "src/renderer/src/components/right-sidebar/source-control/commit/source-control-entry-mutation-failures.test.tsx": 513,
+      "src/renderer/src/components/right-sidebar/source-control/listing/section-action-buttons.test.tsx": 1796,
+      "src/renderer/src/components/right-sidebar/source-control/listing/section-header.test.tsx": 559,
+      "src/renderer/src/components/right-sidebar/source-control/listing/use-file-projection-work.test.tsx": 766,
+      "src/renderer/src/components/right-sidebar/source-control/listing/use-store-actions.store-subscriptions.test.tsx": 1386,
+      "src/renderer/src/components/right-sidebar/source-control/notes/use-diff-comment-notes.test.tsx": 351,
+      "src/renderer/src/components/right-sidebar/source-control/review/suppressed-github-pr.test.ts": 35,
+      "src/renderer/src/components/right-sidebar/source-control/review/use-action-model.test.tsx": 369,
+      "src/renderer/src/components/right-sidebar/source-control/review/use-hosted-review-state.test.tsx": 657,
+      "src/renderer/src/components/right-sidebar/status-display.test.ts": 38,
+      "src/renderer/src/components/right-sidebar/use-ai-vault-search-focus-request.test.tsx": 1291,
+      "src/renderer/src/components/right-sidebar/use-ai-vault-search.test.tsx": 737,
+      "src/renderer/src/components/right-sidebar/use-checks-panel-terminal-worktree.test.ts": 1386,
+      "src/renderer/src/components/right-sidebar/use-file-explorer-name-filter.runtime-listing.test.tsx": 1514,
+      "src/renderer/src/components/right-sidebar/use-file-explorer-name-filter.test.ts": 1249,
+      "src/renderer/src/components/right-sidebar/use-git-status-upstream-ref-watch.test.ts": 63,
+      "src/renderer/src/components/right-sidebar/use-hosted-review-actions.test.tsx": 546,
+      "src/renderer/src/components/right-sidebar/use-installed-plugin-route-reconciliation.test.tsx": 487,
+      "src/renderer/src/components/right-sidebar/use-persisted-ai-vault-view-options.test.tsx": 625,
+      "src/renderer/src/components/right-sidebar/use-plugin-panel-theme-revision.test.tsx": 526,
+      "src/renderer/src/components/right-sidebar/use-source-control-ai.test.ts": 1472,
+      "src/renderer/src/components/right-sidebar/use-source-control-branch-compare.test.tsx": 790,
+      "src/renderer/src/components/right-sidebar/use-source-control-git-history.test.tsx": 608,
+      "src/renderer/src/components/right-sidebar/useCreatePullRequestDialogFields.repo-default.test.ts": 2037,
+      "src/renderer/src/components/right-sidebar/useCreatePullRequestDialogFields.test.ts": 1565,
+      "src/renderer/src/components/right-sidebar/useFileExplorerDragDrop.test.ts": 58,
+      "src/renderer/src/components/right-sidebar/useFileExplorerHandlers.test.ts": 1455,
+      "src/renderer/src/components/right-sidebar/useFileExplorerKeys.test.ts": 1591,
+      "src/renderer/src/components/right-sidebar/useFileExplorerRowDrag.test.ts": 52,
+      "src/renderer/src/components/right-sidebar/useFileExplorerTree.refresh-projection-churn.test.tsx": 2884,
+      "src/renderer/src/components/right-sidebar/useFileExplorerTree.stale-dirs.test.tsx": 2223,
+      "src/renderer/src/components/right-sidebar/useFileExplorerVisibleRowProjection.debounce.test.tsx": 2363,
+      "src/renderer/src/components/right-sidebar/useFileExplorerVisibleRowProjection.test.ts": 1640,
+      "src/renderer/src/components/right-sidebar/useFileExplorerWatch.pending-refresh.test.tsx": 745,
+      "src/renderer/src/components/right-sidebar/useFileExplorerWatch.test.ts": 2024,
+      "src/renderer/src/components/right-sidebar/useFileSearchRunner.test.tsx": 594,
+      "src/renderer/src/components/right-sidebar/useGitStatusPolling.rerender.test.ts": 2104,
+      "src/renderer/src/components/right-sidebar/useGitStatusPolling.test.ts": 1852,
+      "src/renderer/src/components/right-sidebar/useHostedReviewStackParent.test.tsx": 650,
+      "src/renderer/src/components/right-sidebar/useSourceControlSelection.test.ts": 64,
+      "src/renderer/src/components/right-sidebar/useSourceControlSubmoduleStatus.test.tsx": 558,
+      "src/renderer/src/components/settings/AccountsPane.test.tsx": 2350,
+      "src/renderer/src/components/settings/AdvancedNetworkSettingsSection.interaction.test.tsx": 2044,
+      "src/renderer/src/components/settings/AdvancedNetworkSettingsSection.test.ts": 1623,
+      "src/renderer/src/components/settings/AdvancedPane.test.tsx": 427,
+      "src/renderer/src/components/settings/AgentSkillSetupPanel.freshness.test.tsx": 2107,
+      "src/renderer/src/components/settings/AgentSkillSetupPanel.test.tsx": 2692,
+      "src/renderer/src/components/settings/AgentsPane.test.tsx": 2430,
+      "src/renderer/src/components/settings/AppearancePane.test.tsx": 2232,
+      "src/renderer/src/components/settings/ArtifactsSettingsPane.test.tsx": 1005,
+      "src/renderer/src/components/settings/AutomationsSettingsPane.test.tsx": 903,
+      "src/renderer/src/components/settings/BranchPrefixFeedback.test.tsx": 155,
+      "src/renderer/src/components/settings/BrowserClientHostedRemoteSetting.test.tsx": 1136,
+      "src/renderer/src/components/settings/BrowserPane.search-catalog.test.tsx": 710,
+      "src/renderer/src/components/settings/BrowserPane.test.ts": 54,
+      "src/renderer/src/components/settings/BrowserSshWorkspaceRoutingSetting.test.tsx": 801,
+      "src/renderer/src/components/settings/BrowserUseSkillStep.test.tsx": 178,
+      "src/renderer/src/components/settings/BrowserUserAgentSetting.test.tsx": 1325,
+      "src/renderer/src/components/settings/CliSection.install-failure.test.tsx": 2294,
+      "src/renderer/src/components/settings/CliSection.test.tsx": 2339,
+      "src/renderer/src/components/settings/CliSkillRuntimeSetup.test.tsx": 977,
+      "src/renderer/src/components/settings/CloudVmSetupGuide.test.tsx": 1314,
+      "src/renderer/src/components/settings/CodexLoginLinkNotice.test.tsx": 764,
+      "src/renderer/src/components/settings/CommitMessageAiPane.test.tsx": 1754,
+      "src/renderer/src/components/settings/DefaultWindowsProjectRuntimeSetting.test.tsx": 658,
+      "src/renderer/src/components/settings/DeveloperPermissionsPane.test.tsx": 1844,
+      "src/renderer/src/components/settings/DiffShowWhitespaceSetting.test.tsx": 1090,
+      "src/renderer/src/components/settings/EditorWordWrapSetting.test.tsx": 1118,
+      "src/renderer/src/components/settings/EphemeralVmRuntimesSection.test.tsx": 1144,
+      "src/renderer/src/components/settings/EphemeralVmsPane.test.tsx": 4524,
+      "src/renderer/src/components/settings/ExperimentalPane.test.tsx": 2064,
+      "src/renderer/src/components/settings/FloatingWorkspacePane.test.tsx": 1671,
+      "src/renderer/src/components/settings/GeneralPane.test.ts": 3742,
+      "src/renderer/src/components/settings/GeneralRemoteServerUpdates.test.tsx": 832,
+      "src/renderer/src/components/settings/GeneralUpdateSettingsSection.test.tsx": 1415,
+      "src/renderer/src/components/settings/GeneralWorkspaceSettingsSection.test.tsx": 1460,
+      "src/renderer/src/components/settings/GhosttyImportModal.test.ts": 268,
+      "src/renderer/src/components/settings/GitPane.test.ts": 1095,
+      "src/renderer/src/components/settings/GitPane.test.tsx": 1415,
+      "src/renderer/src/components/settings/GrokAccountsSection.test.tsx": 954,
+      "src/renderer/src/components/settings/HiddenExperimentalGroup.test.tsx": 513,
+      "src/renderer/src/components/settings/KagiSessionLinkForm.test.ts": 1135,
+      "src/renderer/src/components/settings/LinearAgentSkillGuide.test.tsx": 374,
+      "src/renderer/src/components/settings/LinearAgentSkillNotes.test.tsx": 163,
+      "src/renderer/src/components/settings/LinearAgentSkillPane.test.tsx": 1432,
+      "src/renderer/src/components/settings/LocalNetworkConnectionTest.test.tsx": 585,
+      "src/renderer/src/components/settings/MachineNameField.test.tsx": 561,
+      "src/renderer/src/components/settings/MobileEmulatorAgentControlRow.test.tsx": 1349,
+      "src/renderer/src/components/settings/MobilePairingConnectionOptions.test.tsx": 1228,
+      "src/renderer/src/components/settings/MobilePairingQrSection.test.tsx": 574,
+      "src/renderer/src/components/settings/MobilePairingSetupSection.test.tsx": 1897,
+      "src/renderer/src/components/settings/MobilePane.test.tsx": 1448,
+      "src/renderer/src/components/settings/MobilePaneAddressSearch.test.tsx": 1173,
+      "src/renderer/src/components/settings/NativeChatExperimentalSetting.test.tsx": 2849,
+      "src/renderer/src/components/settings/NativeChatSupportedAgents.test.tsx": 965,
+      "src/renderer/src/components/settings/NotificationsPane.test.tsx": 1611,
+      "src/renderer/src/components/settings/OpenInMenuSetting.test.ts": 483,
+      "src/renderer/src/components/settings/OrcaAccountSettingsPane.test.tsx": 660,
+      "src/renderer/src/components/settings/OrchestrationPane.test.tsx": 2500,
+      "src/renderer/src/components/settings/OrchestrationSkillAgentCoverage.test.tsx": 142,
+      "src/renderer/src/components/settings/PluginConsentDialog.test.tsx": 1603,
+      "src/renderer/src/components/settings/PluginInstallDialog.test.tsx": 1086,
+      "src/renderer/src/components/settings/PluginKeybindingConsentPreview.test.ts": 880,
+      "src/renderer/src/components/settings/PluginMarketplaceBrowser.test.tsx": 857,
+      "src/renderer/src/components/settings/PluginMarketplaceSourceDialog.test.tsx": 587,
+      "src/renderer/src/components/settings/PluginSettingsRow.test.tsx": 1082,
+      "src/renderer/src/components/settings/PluginsSettingsSection.lifecycle.test.tsx": 1906,
+      "src/renderer/src/components/settings/PrivacyPane.test.ts": 1541,
+      "src/renderer/src/components/settings/ProjectWindowsRuntimeSetting.test.tsx": 1249,
+      "src/renderer/src/components/settings/QuickCommandsList.test.tsx": 1098,
+      "src/renderer/src/components/settings/QuickCommandsPane.test.ts": 1711,
+      "src/renderer/src/components/settings/RemoteServerUpdateDialog.test.tsx": 935,
+      "src/renderer/src/components/settings/RepositoryForkSyncSection.test.tsx": 866,
+      "src/renderer/src/components/settings/RepositoryGitHubAccountSection.test.tsx": 989,
+      "src/renderer/src/components/settings/RepositoryHooksSection.test.ts": 838,
+      "src/renderer/src/components/settings/RepositoryHostSetupsSection.test.tsx": 2695,
+      "src/renderer/src/components/settings/RepositoryHostSetupsSection.workspace-window.test.tsx": 2705,
+      "src/renderer/src/components/settings/RepositoryIconEmojiPicker.test.tsx": 555,
+      "src/renderer/src/components/settings/RepositoryIconPicker.github-avatar-refresh.test.tsx": 1099,
+      "src/renderer/src/components/settings/RepositoryPane.test.ts": 3138,
+      "src/renderer/src/components/settings/RepositoryPaneDraftInput.test.tsx": 450,
+      "src/renderer/src/components/settings/RepositorySourceControlAiSection.test.ts": 593,
+      "src/renderer/src/components/settings/RepositoryWorktreeDefaultsSection.test.tsx": 532,
+      "src/renderer/src/components/settings/RuntimeEnvironmentsPane.test.ts": 1724,
+      "src/renderer/src/components/settings/RuntimeHostAccessForm.test.tsx": 589,
+      "src/renderer/src/components/settings/RuntimePairingGeneratorForm.test.tsx": 434,
+      "src/renderer/src/components/settings/RuntimePairingUrlGenerator.test.tsx": 935,
+      "src/renderer/src/components/settings/SessionHistoryComputerRow.test.tsx": 1157,
+      "src/renderer/src/components/settings/SessionHistorySettingsPane.test.tsx": 2196,
+      "src/renderer/src/components/settings/Settings.load-performance.test.ts": 36,
+      "src/renderer/src/components/settings/SettingsConstants.test.ts": 179,
+      "src/renderer/src/components/settings/SettingsFormControls.font-autocomplete.test.tsx": 1401,
+      "src/renderer/src/components/settings/SettingsFormControls.number-field.test.tsx": 816,
+      "src/renderer/src/components/settings/SettingsFormControls.segmented-control.test.tsx": 904,
+      "src/renderer/src/components/settings/SettingsSidebar.test.tsx": 2031,
+      "src/renderer/src/components/settings/ShareSkillsSettingsPane.test.tsx": 791,
+      "src/renderer/src/components/settings/ShortcutCommandBlock.test.tsx": 1722,
+      "src/renderer/src/components/settings/ShortcutFilterRail.test.ts": 463,
+      "src/renderer/src/components/settings/SourceControlActionRepoOverrideNote.test.tsx": 1006,
+      "src/renderer/src/components/settings/SparsePresetSettingsSection.test.tsx": 577,
+      "src/renderer/src/components/settings/SshTargetCard.test.tsx": 776,
+      "src/renderer/src/components/settings/SshTargetForm.test.tsx": 1083,
+      "src/renderer/src/components/settings/TaskSourceLinearSetup.test.tsx": 1195,
+      "src/renderer/src/components/settings/TaskSourceProviderCard.test.tsx": 592,
+      "src/renderer/src/components/settings/TaskSourceShowInTasksStep.test.tsx": 359,
+      "src/renderer/src/components/settings/TaskSourceSimpleSetup.test.tsx": 960,
+      "src/renderer/src/components/settings/TasksPane.test.tsx": 1403,
+      "src/renderer/src/components/settings/TerminalAdvancedSection.test.tsx": 1646,
+      "src/renderer/src/components/settings/TerminalAppearanceSection.ghostty.test.ts": 398,
+      "src/renderer/src/components/settings/TerminalContrastSetting.test.tsx": 1310,
+      "src/renderer/src/components/settings/TerminalFontSizeSetting.test.tsx": 1537,
+      "src/renderer/src/components/settings/TerminalPane.pwsh.test.ts": 765,
+      "src/renderer/src/components/settings/TerminalSettingsPreview.lifecycle.test.tsx": 664,
+      "src/renderer/src/components/settings/TerminalTccAttributionNotice.test.tsx": 885,
+      "src/renderer/src/components/settings/TerminalThemeSections.lifecycle.test.ts": 1380,
+      "src/renderer/src/components/settings/VoiceMicrophoneSetting.test.tsx": 1149,
+      "src/renderer/src/components/settings/VoicePane.test.tsx": 1609,
+      "src/renderer/src/components/settings/VoiceSpeechModelSection.test.tsx": 672,
+      "src/renderer/src/components/settings/WorkspaceDirectorySetting.test.tsx": 2196,
+      "src/renderer/src/components/settings/accounts-search.test.ts": 45,
+      "src/renderer/src/components/settings/agent-availability-settings.test.ts": 209,
+      "src/renderer/src/components/settings/agent-default-env-draft.test.ts": 41,
+      "src/renderer/src/components/settings/agent-skill-installed-command-callers.test.ts": 122,
+      "src/renderer/src/components/settings/appearance-interface-summary.test.ts": 170,
+      "src/renderer/src/components/settings/appearance-search.test.ts": 835,
+      "src/renderer/src/components/settings/appearance-status-bar-search.test.ts": 58,
+      "src/renderer/src/components/settings/appearance-usage-percentage-search.test.ts": 97,
+      "src/renderer/src/components/settings/bitbucket-integration-card.test.tsx": 882,
+      "src/renderer/src/components/settings/browser-cookie-import-label.test.ts": 115,
+      "src/renderer/src/components/settings/browser-link-routing-localization.test.ts": 422,
+      "src/renderer/src/components/settings/browser-search.test.ts": 394,
+      "src/renderer/src/components/settings/browser-session-host-selection.test.ts": 51,
+      "src/renderer/src/components/settings/cli-install-failure.test.ts": 41,
+      "src/renderer/src/components/settings/cli-source-control-integration-cards.test.tsx": 739,
+      "src/renderer/src/components/settings/codex-account-auth-warning.test.ts": 44,
+      "src/renderer/src/components/settings/codex-config-sync-warning.test.ts": 29,
+      "src/renderer/src/components/settings/codex-session-source-home-control.test.tsx": 389,
+      "src/renderer/src/components/settings/developer-permissions-search.test.ts": 410,
+      "src/renderer/src/components/settings/general-editor-search.test.ts": 109,
+      "src/renderer/src/components/settings/general-preview-tab-search.test.ts": 113,
+      "src/renderer/src/components/settings/host-scoped-setting-scope.test.ts": 40,
+      "src/renderer/src/components/settings/integrations-pane-status.test.ts": 56,
+      "src/renderer/src/components/settings/jira-integration-card.test.tsx": 546,
+      "src/renderer/src/components/settings/linear-agent-skill-install-cta.test.tsx": 1244,
+      "src/renderer/src/components/settings/mobile-network-interface-selection.test.ts": 87,
+      "src/renderer/src/components/settings/mobile-pairing-device-polling.test.ts": 48,
+      "src/renderer/src/components/settings/mobile-pane-search.test.ts": 87,
+      "src/renderer/src/components/settings/native-chat-experimental-search-entry.test.ts": 86,
+      "src/renderer/src/components/settings/osc52-clipboard-copy.test.ts": 365,
+      "src/renderer/src/components/settings/plugin-install-source.test.ts": 167,
+      "src/renderer/src/components/settings/provider-account-scope.test.ts": 110,
+      "src/renderer/src/components/settings/provider-account-visibility.test.ts": 53,
+      "src/renderer/src/components/settings/provider-rate-limit-scope-panels.test.tsx": 486,
+      "src/renderer/src/components/settings/repository-hook-settings-draft.test.ts": 201,
+      "src/renderer/src/components/settings/repository-host-setup-options.test.ts": 71,
+      "src/renderer/src/components/settings/repository-icon-github.test.ts": 56,
+      "src/renderer/src/components/settings/repository-source-control-ai-global-ux.test.ts": 689,
+      "src/renderer/src/components/settings/repository-source-control-ai-persist-queue.test.ts": 70,
+      "src/renderer/src/components/settings/runtime-server-row-unverifiable-host.test.tsx": 2289,
+      "src/renderer/src/components/settings/runtime-server-workflow-sections.test.tsx": 936,
+      "src/renderer/src/components/settings/session-history-status-copy.test.ts": 150,
+      "src/renderer/src/components/settings/session-search-computer-rollup.test.ts": 49,
+      "src/renderer/src/components/settings/setting-ownership.test.ts": 66,
+      "src/renderer/src/components/settings/settings-deep-link-target-watcher.test.ts": 479,
+      "src/renderer/src/components/settings/settings-form-option-filter.test.ts": 60,
+      "src/renderer/src/components/settings/settings-project-list.test.ts": 75,
+      "src/renderer/src/components/settings/settings-search-keywords.test.ts": 195,
+      "src/renderer/src/components/settings/settings-search.test.ts": 54,
+      "src/renderer/src/components/settings/settings-setup-guide-progress-hook.test.tsx": 90,
+      "src/renderer/src/components/settings/settings-setup-guide-progress.test.ts": 1590,
+      "src/renderer/src/components/settings/shortcut-binding-list-mutations.test.ts": 44,
+      "src/renderer/src/components/settings/shortcut-definition-catalog.test.ts": 537,
+      "src/renderer/src/components/settings/shortcut-groups.test.ts": 116,
+      "src/renderer/src/components/settings/shortcut-recording-state.test.ts": 39,
+      "src/renderer/src/components/settings/shortcut-row-visibility.test.ts": 485,
+      "src/renderer/src/components/settings/sparse-preset-date.test.ts": 64,
+      "src/renderer/src/components/settings/sparse-preset-operation-error.test.ts": 46,
+      "src/renderer/src/components/settings/ssh-target-action-state.test.ts": 35,
+      "src/renderer/src/components/settings/ssh-target-draft.test.ts": 67,
+      "src/renderer/src/components/settings/ssh-target-remove.test.ts": 110,
+      "src/renderer/src/components/settings/ssh-target-save-payload.test.ts": 118,
+      "src/renderer/src/components/settings/task-source-setup-state.test.ts": 79,
+      "src/renderer/src/components/settings/task-tracker-integration-cards.test.tsx": 892,
+      "src/renderer/src/components/settings/terminal-preview-content.test.ts": 56,
+      "src/renderer/src/components/settings/terminal-search.test.ts": 193,
+      "src/renderer/src/components/settings/use-debounced-settings-text-draft.test.ts": 578,
+      "src/renderer/src/components/settings/use-mac-captured-digit-chords.test.ts": 885,
+      "src/renderer/src/components/settings/use-published-machine-name.test.tsx": 593,
+      "src/renderer/src/components/settings/use-repository-hook-settings-draft.test.tsx": 412,
+      "src/renderer/src/components/settings/use-session-search-status.test.tsx": 462,
+      "src/renderer/src/components/settings/use-task-source-provider-readiness.test.tsx": 464,
+      "src/renderer/src/components/settings/useGhosttyImport.test.ts": 81,
+      "src/renderer/src/components/settings/useWarpThemeImport.test.ts": 96,
+      "src/renderer/src/components/settings/worktree-symlink-path-filter.scan-budget.test.ts": 125,
+      "src/renderer/src/components/settings/worktree-symlink-path-filter.test.ts": 45,
+      "src/renderer/src/components/setup-guide/SetupGuideModal.mount-gating.test.tsx": 1855,
+      "src/renderer/src/components/setup-guide/use-setup-guide-progress.test.ts": 1157,
+      "src/renderer/src/components/setup-guide/use-setup-guide-telemetry.test.ts": 40,
+      "src/renderer/src/components/shared/MacFolderAccessFixDialog.test.tsx": 1694,
+      "src/renderer/src/components/shared/kill-all-terminal-surfaces.test.ts": 1721,
+      "src/renderer/src/components/shared/useDaemonActions.test.tsx": 665,
+      "src/renderer/src/components/sidebar/AddProjectFromFolderDialog.test.tsx": 345,
+      "src/renderer/src/components/sidebar/AddRemoteHostDialog.config-picker.test.tsx": 1413,
+      "src/renderer/src/components/sidebar/AddRemoteHostFields.test.tsx": 411,
+      "src/renderer/src/components/sidebar/AddRepoCreateStep.test.tsx": 555,
+      "src/renderer/src/components/sidebar/AddRepoDialog.default-checkout.test.ts": 46,
+      "src/renderer/src/components/sidebar/AddRepoDialogStepContent.test.tsx": 748,
+      "src/renderer/src/components/sidebar/AddRepoHostSelector.test.tsx": 568,
+      "src/renderer/src/components/sidebar/AddRepoNestedImportStep.test.tsx": 891,
+      "src/renderer/src/components/sidebar/AddRepoStartSteps.test.tsx": 1413,
+      "src/renderer/src/components/sidebar/AddRepoSteps.default-checkout.test.ts": 158,
+      "src/renderer/src/components/sidebar/AgentDashboardSidebarHost.test.tsx": 2111,
+      "src/renderer/src/components/sidebar/AutoRenameFailedDialog.test.tsx": 534,
+      "src/renderer/src/components/sidebar/CacheTimer.test.tsx": 303,
+      "src/renderer/src/components/sidebar/CommentMarkdown.github-attachment-image.test.tsx": 1751,
+      "src/renderer/src/components/sidebar/CommentMarkdown.link-click.test.tsx": 2429,
+      "src/renderer/src/components/sidebar/CommentMarkdown.test.tsx": 2215,
+      "src/renderer/src/components/sidebar/DeleteWorktreeDialog.host-context-boundary.test.ts": 49,
+      "src/renderer/src/components/sidebar/DeleteWorktreeDialog.test.tsx": 1072,
+      "src/renderer/src/components/sidebar/DeleteWorktreeTargetPreview.test.tsx": 1045,
+      "src/renderer/src/components/sidebar/FilterToggleRow.test.tsx": 792,
+      "src/renderer/src/components/sidebar/ImportedWorktreesVisibilityLine.test.tsx": 1329,
+      "src/renderer/src/components/sidebar/LinearAgentSkillSetupPrompt.reminder-toast.test.tsx": 1307,
+      "src/renderer/src/components/sidebar/LinearAgentSkillSetupPrompt.test.tsx": 7136,
+      "src/renderer/src/components/sidebar/LinearAgentSkillSetupPrompt.update-command.test.tsx": 1428,
+      "src/renderer/src/components/sidebar/LocalGitToolchainScanBanner.test.tsx": 2144,
+      "src/renderer/src/components/sidebar/MarkdownImageLightbox.test.tsx": 1145,
+      "src/renderer/src/components/sidebar/NewExternalWorktreesInboxLine.test.tsx": 2102,
+      "src/renderer/src/components/sidebar/NonGitFolderDialog.test.tsx": 627,
+      "src/renderer/src/components/sidebar/NoticeHostGlyph.test.tsx": 1725,
+      "src/renderer/src/components/sidebar/OrcaYamlTrustDialog.test.tsx": 89,
+      "src/renderer/src/components/sidebar/ProjectAddedDialog.test.tsx": 59,
+      "src/renderer/src/components/sidebar/ProjectGroupDeleteDialog.test.tsx": 946,
+      "src/renderer/src/components/sidebar/ProjectHeaderActions.test.tsx": 455,
+      "src/renderer/src/components/sidebar/RemoteFileBrowser.paste.test.tsx": 1115,
+      "src/renderer/src/components/sidebar/RemoveFolderDialog.test.tsx": 90,
+      "src/renderer/src/components/sidebar/SetupGuideSidebarEntry.test.tsx": 589,
+      "src/renderer/src/components/sidebar/SetupScriptPromptCard.test.ts": 43,
+      "src/renderer/src/components/sidebar/SetupScriptPromptCardShell.test.tsx": 538,
+      "src/renderer/src/components/sidebar/Sidebar.test.tsx": 747,
+      "src/renderer/src/components/sidebar/SidebarAgentsList.test.tsx": 2134,
+      "src/renderer/src/components/sidebar/SidebarFeedbackDialog.test.tsx": 3073,
+      "src/renderer/src/components/sidebar/SidebarGroupByToggle.test.tsx": 522,
+      "src/renderer/src/components/sidebar/SidebarHeader.test.tsx": 1124,
+      "src/renderer/src/components/sidebar/SidebarNav.test.tsx": 1553,
+      "src/renderer/src/components/sidebar/SidebarRepositoryFilterSection.test.tsx": 1398,
+      "src/renderer/src/components/sidebar/SidebarSettingsHelpMenu.test.tsx": 1068,
+      "src/renderer/src/components/sidebar/SidebarToolbar.test.tsx": 1152,
+      "src/renderer/src/components/sidebar/SidebarWorkspaceFilterSection.test.tsx": 765,
+      "src/renderer/src/components/sidebar/StatusIndicator.test.ts": 312,
+      "src/renderer/src/components/sidebar/WorkspaceKanbanCard.host-identity.test.tsx": 1203,
+      "src/renderer/src/components/sidebar/WorkspaceKanbanDrawer.mount-gating.test.tsx": 2186,
+      "src/renderer/src/components/sidebar/WorkspaceKanbanDrawer.search.test.tsx": 2422,
+      "src/renderer/src/components/sidebar/WorkspaceKanbanDrawer.task-status-sync.test.tsx": 2043,
+      "src/renderer/src/components/sidebar/WorkspaceKanbanDrawerHeader.test.tsx": 1839,
+      "src/renderer/src/components/sidebar/WorkspaceKanbanLaneCardList.test.tsx": 1498,
+      "src/renderer/src/components/sidebar/WorkspaceKanbanLaneGrid.test.tsx": 686,
+      "src/renderer/src/components/sidebar/WorkspaceKanbanSearchField.test.tsx": 796,
+      "src/renderer/src/components/sidebar/WorkspaceKanbanSettingsMenu.test.tsx": 1013,
+      "src/renderer/src/components/sidebar/WorkspaceKanbanStatusLane.test.tsx": 969,
+      "src/renderer/src/components/sidebar/WorktreeCard.affiliate-list-mode.test.tsx": 1815,
+      "src/renderer/src/components/sidebar/WorktreeCard.compact-hover.test.tsx": 3499,
+      "src/renderer/src/components/sidebar/WorktreeCard.compact-ports-hover-independence.test.tsx": 1988,
+      "src/renderer/src/components/sidebar/WorktreeCard.hosted-review-refresh.test.tsx": 1492,
+      "src/renderer/src/components/sidebar/WorktreeCard.lineage.test.tsx": 1128,
+      "src/renderer/src/components/sidebar/WorktreeCard.merged-pr-display.test.tsx": 976,
+      "src/renderer/src/components/sidebar/WorktreeCard.pinned-repo-icon.test.tsx": 722,
+      "src/renderer/src/components/sidebar/WorktreeCard.pr-display.test.tsx": 1607,
+      "src/renderer/src/components/sidebar/WorktreeCard.quick-actions.test.tsx": 1815,
+      "src/renderer/src/components/sidebar/WorktreeCard.ssh-reconnect-prompt.test.tsx": 1253,
+      "src/renderer/src/components/sidebar/WorktreeCard.test.ts": 2003,
+      "src/renderer/src/components/sidebar/WorktreeCardAgents.activation.test.tsx": 1121,
+      "src/renderer/src/components/sidebar/WorktreeCardAgents.expansion-remount.test.tsx": 715,
+      "src/renderer/src/components/sidebar/WorktreeCardAgents.send-target.test.tsx": 951,
+      "src/renderer/src/components/sidebar/WorktreeCardAgents.test.tsx": 625,
+      "src/renderer/src/components/sidebar/WorktreeCardAutomationDetailSection.test.tsx": 608,
+      "src/renderer/src/components/sidebar/WorktreeCardDisplayMenuSection.test.tsx": 765,
+      "src/renderer/src/components/sidebar/WorktreeCardMeta.interaction.test.tsx": 3427,
+      "src/renderer/src/components/sidebar/WorktreeCardMeta.test.tsx": 2336,
+      "src/renderer/src/components/sidebar/WorktreeCardPorts.test.tsx": 997,
+      "src/renderer/src/components/sidebar/WorktreeCardSshHostControl.test.tsx": 2296,
+      "src/renderer/src/components/sidebar/WorktreeCardStatusSlot.test.tsx": 306,
+      "src/renderer/src/components/sidebar/WorktreeContextMenu.copy-worktree-name.test.tsx": 1296,
+      "src/renderer/src/components/sidebar/WorktreeContextMenu.delete-shortcut.test.tsx": 1521,
+      "src/renderer/src/components/sidebar/WorktreeContextMenu.react185-bystander.test.tsx": 2442,
+      "src/renderer/src/components/sidebar/WorktreeContextMenu.test.ts": 1831,
+      "src/renderer/src/components/sidebar/WorktreeDeveloperMenu.test.tsx": 156,
+      "src/renderer/src/components/sidebar/WorktreeDeveloperMenuReveal.test.tsx": 837,
+      "src/renderer/src/components/sidebar/WorktreeList.card-memo-stability.test.tsx": 1550,
+      "src/renderer/src/components/sidebar/WorktreeList.empty-project-rows.test.ts": 1867,
+      "src/renderer/src/components/sidebar/WorktreeList.folder-workspace-rows.test.ts": 1777,
+      "src/renderer/src/components/sidebar/WorktreeList.group-headers.test.ts": 2092,
+      "src/renderer/src/components/sidebar/WorktreeList.lineage-agent-expansion-coupling.test.tsx": 5067,
+      "src/renderer/src/components/sidebar/WorktreeList.lineage-child-card.test.ts": 1705,
+      "src/renderer/src/components/sidebar/WorktreeList.lineage-child-real-card.test.tsx": 3618,
+      "src/renderer/src/components/sidebar/WorktreeList.status-lane-lineage-drop.test.tsx": 1918,
+      "src/renderer/src/components/sidebar/WorktreeMetaDialog.test.tsx": 2111,
+      "src/renderer/src/components/sidebar/WorktreeOpenInMenu.test.tsx": 392,
+      "src/renderer/src/components/sidebar/WorktreeParentPickerPopover.test.ts": 1434,
+      "src/renderer/src/components/sidebar/WorktreeTitleInlineRename.begin-editing.test.tsx": 160,
+      "src/renderer/src/components/sidebar/WorktreeTitleInlineRename.editor-lifecycle.test.tsx": 537,
+      "src/renderer/src/components/sidebar/WorktreeTitleInlineRename.test.tsx": 476,
+      "src/renderer/src/components/sidebar/WorktreeVisibilityDialog.test.tsx": 1597,
+      "src/renderer/src/components/sidebar/WorktreeVisibilityHelpPopover.test.tsx": 917,
+      "src/renderer/src/components/sidebar/WorktreeVisibilitySourceList.test.tsx": 957,
+      "src/renderer/src/components/sidebar/active-worktree-focus-after-delete.test.ts": 109,
+      "src/renderer/src/components/sidebar/add-remote-host-ssh-actions.test.ts": 163,
+      "src/renderer/src/components/sidebar/add-repo-browse-authority.test.ts": 56,
+      "src/renderer/src/components/sidebar/add-repo-existing-workspaces-telemetry.test.ts": 60,
+      "src/renderer/src/components/sidebar/add-repo-skip-finalization.test.ts": 33,
+      "src/renderer/src/components/sidebar/clone-defaults.test.ts": 72,
+      "src/renderer/src/components/sidebar/create-project-defaults.test.ts": 33,
+      "src/renderer/src/components/sidebar/default-branch-folder-project-root.test.ts": 924,
+      "src/renderer/src/components/sidebar/default-branch-visible-under-hide-sleeping.test.ts": 1322,
+      "src/renderer/src/components/sidebar/delete-worktree-dirty-change-counts.test.ts": 46,
+      "src/renderer/src/components/sidebar/delete-worktree-failure-toast.test.tsx": 634,
+      "src/renderer/src/components/sidebar/delete-worktree-flow.test.ts": 799,
+      "src/renderer/src/components/sidebar/delete-worktree-parallel-flow.test.ts": 320,
+      "src/renderer/src/components/sidebar/delete-worktree-toast.test.ts": 89,
+      "src/renderer/src/components/sidebar/empty-project-placeholder-repos.test.ts": 65,
+      "src/renderer/src/components/sidebar/focused-agent-row-highlight.test.ts": 1580,
+      "src/renderer/src/components/sidebar/folder-workspace-card-pr-display.test.ts": 159,
+      "src/renderer/src/components/sidebar/folder-workspace-composer-expiry.test.tsx": 2105,
+      "src/renderer/src/components/sidebar/folder-workspace-composer-helpers.test.ts": 89,
+      "src/renderer/src/components/sidebar/folder-workspace-composer-path-status.test.tsx": 1905,
+      "src/renderer/src/components/sidebar/folder-workspace-composer-submit.test.ts": 3745,
+      "src/renderer/src/components/sidebar/folder-workspace-linked-startup-plan.test.ts": 1959,
+      "src/renderer/src/components/sidebar/host-header-drag.test.tsx": 386,
+      "src/renderer/src/components/sidebar/host-header-menu-items.test.ts": 49,
+      "src/renderer/src/components/sidebar/host-rename-remove.test.ts": 49,
+      "src/renderer/src/components/sidebar/host-section-folder-workspace-counts.test.ts": 51,
+      "src/renderer/src/components/sidebar/host-section-order.test.ts": 33,
+      "src/renderer/src/components/sidebar/host-section-rows.test.ts": 223,
+      "src/renderer/src/components/sidebar/hovered-workspace-delete.test.ts": 1960,
+      "src/renderer/src/components/sidebar/imported-worktrees-card-actions.test.ts": 54,
+      "src/renderer/src/components/sidebar/imported-worktrees-card-candidates.test.ts": 60,
+      "src/renderer/src/components/sidebar/linear-agent-skill-runtime.shell-override.test.ts": 66,
+      "src/renderer/src/components/sidebar/linear-agent-skill-setup-reminders.test.ts": 51,
+      "src/renderer/src/components/sidebar/local-base-ref-suggestion-toast.test.tsx": 727,
+      "src/renderer/src/components/sidebar/mobile-sidebar-onboarding-badge.test.ts": 447,
+      "src/renderer/src/components/sidebar/natural-worktree-ids.test.ts": 266,
+      "src/renderer/src/components/sidebar/new-external-worktrees-inbox-actions.test.ts": 80,
+      "src/renderer/src/components/sidebar/new-external-worktrees-inbox-candidates.test.ts": 42,
+      "src/renderer/src/components/sidebar/pinned-section-worktrees.test.ts": 535,
+      "src/renderer/src/components/sidebar/preserved-branch-batch-toast.test.tsx": 548,
+      "src/renderer/src/components/sidebar/preserved-branch-toast.test.tsx": 937,
+      "src/renderer/src/components/sidebar/project-added-default-checkout.test.ts": 134,
+      "src/renderer/src/components/sidebar/project-filter-reveal.test.ts": 49,
+      "src/renderer/src/components/sidebar/project-group-header-dom.test.ts": 33,
+      "src/renderer/src/components/sidebar/project-group-header-drag-commit.test.ts": 450,
+      "src/renderer/src/components/sidebar/project-group-header-drag-start.test.ts": 375,
+      "src/renderer/src/components/sidebar/project-group-header-drag.test.ts": 565,
+      "src/renderer/src/components/sidebar/project-group-header-drop.test.ts": 360,
+      "src/renderer/src/components/sidebar/project-header-action-selector-lockstep.test.ts": 394,
+      "src/renderer/src/components/sidebar/project-header-color.test.ts": 200,
+      "src/renderer/src/components/sidebar/project-header-drag-commit.test.ts": 356,
+      "src/renderer/src/components/sidebar/project-header-drag-start.test.ts": 478,
+      "src/renderer/src/components/sidebar/project-header-drag.test.ts": 465,
+      "src/renderer/src/components/sidebar/project-header-drop.test.ts": 226,
+      "src/renderer/src/components/sidebar/project-order-manual-default-notice-visibility.test.ts": 53,
+      "src/renderer/src/components/sidebar/prompt-cache-countdown-clock.test.ts": 65,
+      "src/renderer/src/components/sidebar/prompt-cache-timer-selection.test.ts": 55,
+      "src/renderer/src/components/sidebar/remote-file-browser-drive-paths.test.ts": 58,
+      "src/renderer/src/components/sidebar/remote-file-browser-helpers.test.ts": 155,
+      "src/renderer/src/components/sidebar/rendered-sidebar-worktree-order.test.ts": 1657,
+      "src/renderer/src/components/sidebar/repo-header-create-state.test.ts": 110,
+      "src/renderer/src/components/sidebar/sidebar-empty-state-gate.test.ts": 45,
+      "src/renderer/src/components/sidebar/sidebar-filter-state.test.ts": 1063,
+      "src/renderer/src/components/sidebar/sidebar-host-options.test.ts": 109,
+      "src/renderer/src/components/sidebar/sidebar-project-drop.test.ts": 93,
+      "src/renderer/src/components/sidebar/sidebar-resize-handle.test.ts": 4515,
+      "src/renderer/src/components/sidebar/sidebar-workspace-option-items.test.ts": 205,
+      "src/renderer/src/components/sidebar/sleep-worktree-activation-race.test.ts": 69,
+      "src/renderer/src/components/sidebar/sleep-worktree-flow.test.ts": 101,
+      "src/renderer/src/components/sidebar/smart-attention.test.ts": 142,
+      "src/renderer/src/components/sidebar/smart-sort.test.ts": 85,
+      "src/renderer/src/components/sidebar/ssh-host-remove-resolution.test.ts": 33,
+      "src/renderer/src/components/sidebar/ssh-target-duplicate.test.ts": 39,
+      "src/renderer/src/components/sidebar/ssh-workspace-forget-resolution.test.ts": 60,
+      "src/renderer/src/components/sidebar/stale-agent-row-unverifiable.test.ts": 1707,
+      "src/renderer/src/components/sidebar/truncated-sidebar-label.test.tsx": 396,
+      "src/renderer/src/components/sidebar/use-add-repo-host-selection.test.ts": 266,
+      "src/renderer/src/components/sidebar/use-add-repo-hosted-controller.test.ts": 63,
+      "src/renderer/src/components/sidebar/use-feedback-image-drop.test.tsx": 678,
+      "src/renderer/src/components/sidebar/use-sidebar-feedback-images.test.tsx": 560,
+      "src/renderer/src/components/sidebar/use-visible-workspace-kanban-worktree-ids.test.tsx": 2267,
+      "src/renderer/src/components/sidebar/use-workspace-kanban-card-pointer-drag.test.ts": 986,
+      "src/renderer/src/components/sidebar/use-workspace-kanban-drawer-lingering.test.tsx": 606,
+      "src/renderer/src/components/sidebar/use-workspace-kanban-outside-dismiss.test.ts": 34,
+      "src/renderer/src/components/sidebar/use-workspace-kanban-selection.test.tsx": 283,
+      "src/renderer/src/components/sidebar/use-workspace-reveal-body-redirect.test.tsx": 611,
+      "src/renderer/src/components/sidebar/use-workspace-status-drop.test.ts": 256,
+      "src/renderer/src/components/sidebar/use-worktree-activity-status.test.tsx": 140,
+      "src/renderer/src/components/sidebar/use-worktree-activity-statuses.test.ts": 1246,
+      "src/renderer/src/components/sidebar/use-worktree-card-secondary-details.store-subscriptions.test.tsx": 2448,
+      "src/renderer/src/components/sidebar/use-worktree-sleep-state.test.tsx": 79,
+      "src/renderer/src/components/sidebar/useAddRepoCloneFlow.test.ts": 145,
+      "src/renderer/src/components/sidebar/useAddRepoLocalFolderFlow.test.ts": 162,
+      "src/renderer/src/components/sidebar/useAddRepoNestedImportFlow.test.ts": 105,
+      "src/renderer/src/components/sidebar/useAddRepoServerPathFlow.test.ts": 95,
+      "src/renderer/src/components/sidebar/useCreateProjectDefaults.test.ts": 101,
+      "src/renderer/src/components/sidebar/useCreateRepo.default-checkout.test.ts": 147,
+      "src/renderer/src/components/sidebar/useRenderedSetupScriptPromptState.test.ts": 476,
+      "src/renderer/src/components/sidebar/useSetupScriptPromptRevalidation.test.tsx": 1585,
+      "src/renderer/src/components/sidebar/useWorkspaceBoardPanel.test.tsx": 556,
+      "src/renderer/src/components/sidebar/useWorktreeAgentRows.test.ts": 168,
+      "src/renderer/src/components/sidebar/visible-worktree-activity-inputs.test.ts": 32,
+      "src/renderer/src/components/sidebar/visible-worktree-indexes.test.ts": 1479,
+      "src/renderer/src/components/sidebar/visible-worktrees.test.ts": 3541,
+      "src/renderer/src/components/sidebar/workspace-board-task-status-sync.test.ts": 58,
+      "src/renderer/src/components/sidebar/workspace-creator-visibility.test.ts": 29,
+      "src/renderer/src/components/sidebar/workspace-delete-lineage.test.ts": 52,
+      "src/renderer/src/components/sidebar/workspace-kanban-area-selection.test.ts": 343,
+      "src/renderer/src/components/sidebar/workspace-kanban-card-pointer-drag-dom.test.ts": 69,
+      "src/renderer/src/components/sidebar/workspace-kanban-filtered-drop-index.test.ts": 54,
+      "src/renderer/src/components/sidebar/workspace-kanban-search.test.ts": 100,
+      "src/renderer/src/components/sidebar/workspace-kanban-sidebar-drop.test.ts": 253,
+      "src/renderer/src/components/sidebar/workspace-kanban-virtual-lane-layout.test.ts": 48,
+      "src/renderer/src/components/sidebar/workspace-kanban-worktree-groups.test.ts": 142,
+      "src/renderer/src/components/sidebar/workspace-lineage-menu-actions.test.ts": 41,
+      "src/renderer/src/components/sidebar/workspace-status.test.ts": 254,
+      "src/renderer/src/components/sidebar/worktree-agent-activity-summary.test.ts": 113,
+      "src/renderer/src/components/sidebar/worktree-agent-freshness-selector.test.ts": 82,
+      "src/renderer/src/components/sidebar/worktree-agent-host-attribution.test.ts": 36,
+      "src/renderer/src/components/sidebar/worktree-agent-orchestration-batch.test.ts": 75,
+      "src/renderer/src/components/sidebar/worktree-agent-orchestration-index.test.ts": 163,
+      "src/renderer/src/components/sidebar/worktree-agent-remote-attribution.test.ts": 613,
+      "src/renderer/src/components/sidebar/worktree-agent-row-selectors.test.ts": 98,
+      "src/renderer/src/components/sidebar/worktree-card-agent-ack-inputs.test.tsx": 455,
+      "src/renderer/src/components/sidebar/worktree-card-agent-summary.test.ts": 1674,
+      "src/renderer/src/components/sidebar/worktree-card-compact-agent-row.stable-message.test.tsx": 777,
+      "src/renderer/src/components/sidebar/worktree-card-details-hover-state.test.tsx": 292,
+      "src/renderer/src/components/sidebar/worktree-card-dom-events.test.ts": 428,
+      "src/renderer/src/components/sidebar/worktree-card-jira-issue-display.test.ts": 49,
+      "src/renderer/src/components/sidebar/worktree-card-markdown-isolation.test.ts": 555,
+      "src/renderer/src/components/sidebar/worktree-card-pr-display.test.ts": 35,
+      "src/renderer/src/components/sidebar/worktree-card-send-target-inputs.test.ts": 33,
+      "src/renderer/src/components/sidebar/worktree-card-status-inputs.test.ts": 51,
+      "src/renderer/src/components/sidebar/worktree-card-title-display.test.ts": 62,
+      "src/renderer/src/components/sidebar/worktree-context-menu-delete-intent.test.ts": 72,
+      "src/renderer/src/components/sidebar/worktree-delete-host-qualification.test.ts": 1795,
+      "src/renderer/src/components/sidebar/worktree-delete-position-scaling.test.ts": 669,
+      "src/renderer/src/components/sidebar/worktree-delete-request.test.ts": 46,
+      "src/renderer/src/components/sidebar/worktree-drag-units.test.ts": 194,
+      "src/renderer/src/components/sidebar/worktree-filter-visibility.test.ts": 466,
+      "src/renderer/src/components/sidebar/worktree-header-section-boundaries.test.ts": 206,
+      "src/renderer/src/components/sidebar/worktree-keyboard-cycle.test.ts": 286,
+      "src/renderer/src/components/sidebar/worktree-lineage-drag-drop.test.ts": 483,
+      "src/renderer/src/components/sidebar/worktree-lineage-expansion.performance.test.ts": 193,
+      "src/renderer/src/components/sidebar/worktree-lineage-projection.test.ts": 43,
+      "src/renderer/src/components/sidebar/worktree-lineage-toggle-handler-cache.test.ts": 56,
+      "src/renderer/src/components/sidebar/worktree-list-groups-host-collision.test.ts": 200,
+      "src/renderer/src/components/sidebar/worktree-list-groups-host-labels.test.ts": 238,
+      "src/renderer/src/components/sidebar/worktree-list-groups-imported-worktrees.test.ts": 243,
+      "src/renderer/src/components/sidebar/worktree-list-groups-lineage-nesting.test.ts": 173,
+      "src/renderer/src/components/sidebar/worktree-list-groups-nested-project-groups.test.ts": 187,
+      "src/renderer/src/components/sidebar/worktree-list-groups-notice-host-labels.test.ts": 208,
+      "src/renderer/src/components/sidebar/worktree-list-groups-pending-creations.test.ts": 365,
+      "src/renderer/src/components/sidebar/worktree-list-groups-pinned-host-labels.test.ts": 238,
+      "src/renderer/src/components/sidebar/worktree-list-groups-project-groups.test.ts": 226,
+      "src/renderer/src/components/sidebar/worktree-list-groups-project-host-setups.test.ts": 181,
+      "src/renderer/src/components/sidebar/worktree-list-groups-project-order.test.ts": 1153,
+      "src/renderer/src/components/sidebar/worktree-list-groups-section-label-disambiguation.test.ts": 221,
+      "src/renderer/src/components/sidebar/worktree-list/drag/pointer-flush.test.ts": 845,
+      "src/renderer/src/components/sidebar/worktree-list/drag/row-state.test.ts": 57,
+      "src/renderer/src/components/sidebar/worktree-list/grouping/build-rows.folder-workspace-lanes.test.ts": 240,
+      "src/renderer/src/components/sidebar/worktree-list/grouping/build-rows.test.ts": 319,
+      "src/renderer/src/components/sidebar/worktree-list/grouping/host-labels.test.ts": 58,
+      "src/renderer/src/components/sidebar/worktree-list/grouping/imported-rows.test.ts": 1449,
+      "src/renderer/src/components/sidebar/worktree-list/listing/host-filtering.test.ts": 37,
+      "src/renderer/src/components/sidebar/worktree-list/listing/pending-worktree-creation-keys.test.ts": 24,
+      "src/renderer/src/components/sidebar/worktree-list/listing/review-cache-inputs.test.ts": 54,
+      "src/renderer/src/components/sidebar/worktree-list/listing/use-visible-worktrees.test.tsx": 1710,
+      "src/renderer/src/components/sidebar/worktree-list/navigation/active-descendant-option.test.ts": 235,
+      "src/renderer/src/components/sidebar/worktree-list/navigation/folder-reveal.test.ts": 231,
+      "src/renderer/src/components/sidebar/worktree-list/navigation/render-row-lookup.folder-workspace.test.ts": 253,
+      "src/renderer/src/components/sidebar/worktree-list/navigation/use-keyboard.host-identity.test.tsx": 794,
+      "src/renderer/src/components/sidebar/worktree-list/navigation/use-reveal-requests.test.tsx": 883,
+      "src/renderer/src/components/sidebar/worktree-list/navigation/use-selection-host-collision.test.tsx": 2056,
+      "src/renderer/src/components/sidebar/worktree-list/rows/FolderPathStatusIndicator.test.tsx": 754,
+      "src/renderer/src/components/sidebar/worktree-list/rows/RepoScanUnavailableIndicator.test.tsx": 2106,
+      "src/renderer/src/components/sidebar/worktree-list/rows/indentation.test.ts": 65,
+      "src/renderer/src/components/sidebar/worktree-list/rows/option-dom-host-collision.test.ts": 475,
+      "src/renderer/src/components/sidebar/worktree-list/rows/use-project-group-dialogs-owner-host.test.tsx": 396,
+      "src/renderer/src/components/sidebar/worktree-list/viewport/hard-scroll-up.test.ts": 64,
+      "src/renderer/src/components/sidebar/worktree-list/viewport/scroll-adjustment.test.ts": 2365,
+      "src/renderer/src/components/sidebar/worktree-list/viewport/sticky-headers.test.ts": 303,
+      "src/renderer/src/components/sidebar/worktree-list/viewport/use-row-removal-animation.test.ts": 62,
+      "src/renderer/src/components/sidebar/worktree-list/viewport/use-scroll-to-top.test.ts": 496,
+      "src/renderer/src/components/sidebar/worktree-list/viewport/use-scroll-to-top.test.tsx": 401,
+      "src/renderer/src/components/sidebar/worktree-list/viewport/virtual-rows.test.ts": 254,
+      "src/renderer/src/components/sidebar/worktree-list/viewport/visible-refresh.test.ts": 1519,
+      "src/renderer/src/components/sidebar/worktree-manual-order-catalog.test.ts": 106,
+      "src/renderer/src/components/sidebar/worktree-manual-order-store-write.test.ts": 2148,
+      "src/renderer/src/components/sidebar/worktree-manual-order.test.ts": 386,
+      "src/renderer/src/components/sidebar/worktree-meta-updates.test.ts": 76,
+      "src/renderer/src/components/sidebar/worktree-multi-selection.test.ts": 27,
+      "src/renderer/src/components/sidebar/worktree-name-suggestions.test.ts": 168,
+      "src/renderer/src/components/sidebar/worktree-parent-eligibility.test.ts": 37,
+      "src/renderer/src/components/sidebar/worktree-review-helpers.test.tsx": 266,
+      "src/renderer/src/components/sidebar/worktree-scroll-to-current-button.test.ts": 254,
+      "src/renderer/src/components/sidebar/worktree-sidebar-drag-autoscroll.test.ts": 46,
+      "src/renderer/src/components/sidebar/worktree-sidebar-drag-geometry.test.ts": 77,
+      "src/renderer/src/components/sidebar/worktree-sidebar-drop-preview.test.ts": 56,
+      "src/renderer/src/components/sidebar/worktree-sidebar-pointer-drag-dom.test.ts": 337,
+      "src/renderer/src/components/sidebar/worktree-sidebar-reveal-scroll-settle.test.ts": 28,
+      "src/renderer/src/components/sidebar/worktree-sidebar-reveal.test.ts": 134,
+      "src/renderer/src/components/sidebar/worktree-sidebar-row-preference.test.ts": 152,
+      "src/renderer/src/components/sidebar/worktree-sort-label-ordering.test.ts": 172,
+      "src/renderer/src/components/sidebar/worktree-subagent-child-rows.test.ts": 47,
+      "src/renderer/src/components/sidebar/worktree-title-derived-agent-rows.test.ts": 164,
+      "src/renderer/src/components/sidebar/worktree-unambiguous-id-index.test.ts": 43,
+      "src/renderer/src/components/sidebar/worktree-unnest.test.ts": 103,
+      "src/renderer/src/components/sidebar/worktree-visibility-source-provenance.test.ts": 52,
+      "src/renderer/src/components/skills/SkillFreshnessNudge.test.tsx": 443,
+      "src/renderer/src/components/skills/SkillFreshnessStatusPill.test.tsx": 770,
+      "src/renderer/src/components/skills/SkillFreshnessUpdateDialog.test.tsx": 834,
+      "src/renderer/src/components/skills/SkillInstallAgentPicker.test.tsx": 869,
+      "src/renderer/src/components/skills/SkillInstallDialog.test.tsx": 4156,
+      "src/renderer/src/components/skills/SkillInstallManagementDialog.test.tsx": 3656,
+      "src/renderer/src/components/skills/SkillInstallTargetFields.test.tsx": 1232,
+      "src/renderer/src/components/skills/SkillInstallWorkspaceCombobox.test.tsx": 965,
+      "src/renderer/src/components/skills/SkillShareDialog.test.tsx": 2329,
+      "src/renderer/src/components/skills/SkillSharedLinkRow.test.tsx": 1251,
+      "src/renderer/src/components/skills/SkillsPage.test.tsx": 4219,
+      "src/renderer/src/components/skills/skill-agent-filter.test.ts": 202,
+      "src/renderer/src/components/skills/skill-bundle-name.test.ts": 122,
+      "src/renderer/src/components/skills/skill-bundle-retry-selection.test.ts": 47,
+      "src/renderer/src/components/skills/skill-delete-copy.test.ts": 69,
+      "src/renderer/src/components/skills/skill-delete-selection.test.ts": 229,
+      "src/renderer/src/components/skills/skill-description-length.test.ts": 52,
+      "src/renderer/src/components/skills/skill-freshness-grouping.test.ts": 67,
+      "src/renderer/src/components/skills/skill-freshness-skipped-reason.test.ts": 137,
+      "src/renderer/src/components/skills/skill-install-progress-state.test.tsx": 673,
+      "src/renderer/src/components/skills/skill-install-provider-groups.test.ts": 62,
+      "src/renderer/src/components/skills/skill-install-workspace-choices.test.ts": 25,
+      "src/renderer/src/components/skills/skill-package-checklist-items.test.ts": 81,
+      "src/renderer/src/components/skills/skill-package-digest.test.ts": 46,
+      "src/renderer/src/components/skills/skill-package-install-risk.test.ts": 55,
+      "src/renderer/src/components/skills/skill-share-link.test.ts": 36,
+      "src/renderer/src/components/skills/skill-share-package-selection.test.ts": 45,
+      "src/renderer/src/components/skills/skill-share-preview-summary.test.ts": 80,
+      "src/renderer/src/components/skills/skill-share-selection.test.ts": 91,
+      "src/renderer/src/components/skills/skill-source-inventory.test.ts": 61,
+      "src/renderer/src/components/skills/skills-filter.test.ts": 113,
+      "src/renderer/src/components/source-control/SourceControlActionVariableChips.test.tsx": 386,
+      "src/renderer/src/components/star-nag/StarNagAgentValueMomentObserver.test.tsx": 2099,
+      "src/renderer/src/components/star-nag/StarNagToastHost.test.tsx": 984,
+      "src/renderer/src/components/stats/CodexUsagePane.test.tsx": 840,
+      "src/renderer/src/components/stats/GrokUsagePane.test.tsx": 1024,
+      "src/renderer/src/components/stats/UsageBreakdownSection.test.tsx": 622,
+      "src/renderer/src/components/stats/UsageTrackingPaneShell.test.tsx": 858,
+      "src/renderer/src/components/stats/usage-daily-chart.test.tsx": 668,
+      "src/renderer/src/components/stats/usage-overview-model.test.ts": 531,
+      "src/renderer/src/components/status-bar/CaffeinateStatusSegment.localization.test.tsx": 1458,
+      "src/renderer/src/components/status-bar/NativeChatResumeStatusSegment.test.tsx": 2493,
+      "src/renderer/src/components/status-bar/PetStatusSegment.layout.test.ts": 40,
+      "src/renderer/src/components/status-bar/PortsStatusSegment.host-routing.test.tsx": 620,
+      "src/renderer/src/components/status-bar/PortsStatusSegment.render-stability.test.tsx": 1943,
+      "src/renderer/src/components/status-bar/ResourceUsageStatusSegment.rows.test.tsx": 1928,
+      "src/renderer/src/components/status-bar/ResourceUsageStatusSegment.session-polling.test.ts": 50,
+      "src/renderer/src/components/status-bar/RuntimeHostStatusRow.test.tsx": 809,
+      "src/renderer/src/components/status-bar/SkillUpdateStatusSegment.test.tsx": 485,
+      "src/renderer/src/components/status-bar/SshStatusSegment.test.ts": 1996,
+      "src/renderer/src/components/status-bar/UpdateStatusSegment.test.tsx": 2381,
+      "src/renderer/src/components/status-bar/UsagePercentageDisplayChangeNotice.test.tsx": 794,
+      "src/renderer/src/components/status-bar/UsageRosterPanel.test.tsx": 1073,
+      "src/renderer/src/components/status-bar/codex-restart-status-summary.test.ts": 47,
+      "src/renderer/src/components/status-bar/codex-status-sign-in.test.tsx": 1799,
+      "src/renderer/src/components/status-bar/icons.test.tsx": 92,
+      "src/renderer/src/components/status-bar/inline-usage-bars.test.tsx": 754,
+      "src/renderer/src/components/status-bar/mergeSnapshotAndSessions.test.ts": 79,
+      "src/renderer/src/components/status-bar/ports-status-popover-rows.test.tsx": 742,
+      "src/renderer/src/components/status-bar/provider-account-sync-key.test.ts": 53,
+      "src/renderer/src/components/status-bar/provider-segment-monthly-window.test.tsx": 1108,
+      "src/renderer/src/components/status-bar/remote-host-connection-status.test.ts": 71,
+      "src/renderer/src/components/status-bar/resource-manager-terminal-copy.test.ts": 62,
+      "src/renderer/src/components/status-bar/resource-manager-worktree-target.test.ts": 53,
+      "src/renderer/src/components/status-bar/resource-memory-metric-copy.test.ts": 27,
+      "src/renderer/src/components/status-bar/resource-session-bindings.test.ts": 43,
+      "src/renderer/src/components/status-bar/resource-session-classification-parity.test.ts": 42,
+      "src/renderer/src/components/status-bar/resource-session-inventory.test.ts": 33,
+      "src/renderer/src/components/status-bar/resource-session-kill-confirmation.test.ts": 65,
+      "src/renderer/src/components/status-bar/resource-session-navigation.test.ts": 60,
+      "src/renderer/src/components/status-bar/resource-usage-folder-merge.test.ts": 94,
+      "src/renderer/src/components/status-bar/resource-usage-open-slices.test.ts": 1536,
+      "src/renderer/src/components/status-bar/resource-usage-space-scan-ready.test.ts": 61,
+      "src/renderer/src/components/status-bar/ssh-status-segment-copy.test.ts": 40,
+      "src/renderer/src/components/status-bar/status-bar-agent-gating.test.ts": 45,
+      "src/renderer/src/components/status-bar/status-bar-context-menu-policy.test.ts": 35,
+      "src/renderer/src/components/status-bar/status-bar-copy-localization.test.tsx": 1540,
+      "src/renderer/src/components/status-bar/status-bar-cursor-segment.test.tsx": 757,
+      "src/renderer/src/components/status-bar/status-bar-provider-menu-focus.test.tsx": 1039,
+      "src/renderer/src/components/status-bar/status-bar-provider-visibility.test.ts": 35,
+      "src/renderer/src/components/status-bar/status-bar-runtime-groups.test.ts": 1341,
+      "src/renderer/src/components/status-bar/tooltip.test.ts": 139,
+      "src/renderer/src/components/status-bar/usage-error-copy.test.ts": 65,
+      "src/renderer/src/components/status-bar/usage-percentage-label.test.ts": 38,
+      "src/renderer/src/components/status-bar/usage-provider-settings-target.test.ts": 37,
+      "src/renderer/src/components/status-bar/usage-roster-formatting.test.ts": 27,
+      "src/renderer/src/components/status-bar/usage-roster-row-state.test.ts": 53,
+      "src/renderer/src/components/status-bar/use-resource-session-inventory.test.tsx": 1022,
+      "src/renderer/src/components/status-bar/use-resource-usage-actions.test.tsx": 472,
+      "src/renderer/src/components/status-bar/use-resource-usage-derived-model.test.tsx": 823,
+      "src/renderer/src/components/status-bar/workspace-space-breakdown-list.test.tsx": 448,
+      "src/renderer/src/components/status-bar/workspace-space-delete-host-routing.test.ts": 43,
+      "src/renderer/src/components/status-bar/workspace-space-format.test.ts": 97,
+      "src/renderer/src/components/status-bar/workspace-space-layout.test.ts": 51,
+      "src/renderer/src/components/status-bar/workspace-space-manager-source-boundary.test.ts": 64,
+      "src/renderer/src/components/status-bar/workspace-space-presentation.test.ts": 217,
+      "src/renderer/src/components/tab-bar/BrowserTab.test.tsx": 1511,
+      "src/renderer/src/components/tab-bar/ClientHostedBrowserTabRows.test.tsx": 1260,
+      "src/renderer/src/components/tab-bar/EditorFileTab.test.tsx": 1020,
+      "src/renderer/src/components/tab-bar/EditorFileTabContextMenu.test.tsx": 660,
+      "src/renderer/src/components/tab-bar/QuickLaunchButton.test.ts": 667,
+      "src/renderer/src/components/tab-bar/RecentTabSwitcher.test.tsx": 660,
+      "src/renderer/src/components/tab-bar/SortableTab.rename-shortcut.test.tsx": 831,
+      "src/renderer/src/components/tab-bar/SortableTab.update-depth-probe.test.tsx": 1389,
+      "src/renderer/src/components/tab-bar/SortableTabContextMenu.test.tsx": 1143,
+      "src/renderer/src/components/tab-bar/TabBar.client-hosted-row-active-state.test.ts": 1679,
+      "src/renderer/src/components/tab-bar/TabBar.context-menu.test.ts": 2690,
+      "src/renderer/src/components/tab-bar/TabBar.windows-shell-launch.test.ts": 1682,
+      "src/renderer/src/components/tab-bar/TabBar.windows-shell-remote-runtime.test.ts": 1585,
+      "src/renderer/src/components/tab-bar/TabBar.windows-shell-ssh-host.test.ts": 1937,
+      "src/renderer/src/components/tab-bar/TabBar.worktree-write-gate.test.tsx": 1156,
+      "src/renderer/src/components/tab-bar/TabBar.worktree-write-gate.windows.test.tsx": 1568,
+      "src/renderer/src/components/tab-bar/TabBarCreateEntry.history.test.tsx": 1865,
+      "src/renderer/src/components/tab-bar/TabBarCreateEntry.keyboard.test.tsx": 2588,
+      "src/renderer/src/components/tab-bar/TabBarCreateEntry.search.test.tsx": 2749,
+      "src/renderer/src/components/tab-bar/TabBarCreateEntry.tab-results.test.tsx": 1967,
+      "src/renderer/src/components/tab-bar/TabBarCreateEntryRow.test.tsx": 1179,
+      "src/renderer/src/components/tab-bar/TabBarQuickCommandItem.test.tsx": 983,
+      "src/renderer/src/components/tab-bar/TabBarQuickCommandsMenu.keyboard.test.ts": 100,
+      "src/renderer/src/components/tab-bar/TabStripScrollIndicator.test.tsx": 608,
+      "src/renderer/src/components/tab-bar/TerminalTabLeadingIcon.test.tsx": 313,
+      "src/renderer/src/components/tab-bar/client-hosted-browser-row-strip-placement.test.ts": 44,
+      "src/renderer/src/components/tab-bar/drop-indicator.test.ts": 50,
+      "src/renderer/src/components/tab-bar/editor-tab-local-open-guard.test.ts": 68,
+      "src/renderer/src/components/tab-bar/group-tab-order.test.ts": 1929,
+      "src/renderer/src/components/tab-bar/middle-button-default-guard.test.ts": 31,
+      "src/renderer/src/components/tab-bar/native-chat-tab-agent-evidence.test.ts": 52,
+      "src/renderer/src/components/tab-bar/open-tab-entry-dedupe.test.ts": 152,
+      "src/renderer/src/components/tab-bar/open-tab-search-retention.test.ts": 450,
+      "src/renderer/src/components/tab-bar/open-tab-search.test.ts": 353,
+      "src/renderer/src/components/tab-bar/open-tab-selection-routing.test.ts": 625,
+      "src/renderer/src/components/tab-bar/query-token-match.test.ts": 48,
+      "src/renderer/src/components/tab-bar/recent-tab-switching.test.ts": 59,
+      "src/renderer/src/components/tab-bar/reconcile-order.test.ts": 52,
+      "src/renderer/src/components/tab-bar/tab-agent-launch-options.test.ts": 99,
+      "src/renderer/src/components/tab-bar/tab-agent-types-by-tab-id.test.ts": 80,
+      "src/renderer/src/components/tab-bar/tab-bar-item-surface.client-hosted-active-state.test.tsx": 2562,
+      "src/renderer/src/components/tab-bar/tab-context-menu-consistency.test.tsx": 42,
+      "src/renderer/src/components/tab-bar/tab-create-entry-action.test.ts": 1242,
+      "src/renderer/src/components/tab-bar/tab-create-entry-classifier.runtime-listing.test.tsx": 2034,
+      "src/renderer/src/components/tab-bar/tab-create-entry-classifier.test.ts": 1823,
+      "src/renderer/src/components/tab-bar/tab-create-entry-file-matches.test.ts": 93,
+      "src/renderer/src/components/tab-bar/tab-create-entry-forced-search.test.ts": 33,
+      "src/renderer/src/components/tab-bar/tab-create-entry-history-placement.test.ts": 158,
+      "src/renderer/src/components/tab-bar/tab-create-entry-local-path.test.ts": 1887,
+      "src/renderer/src/components/tab-bar/tab-create-entry-url-classification.test.ts": 194,
+      "src/renderer/src/components/tab-bar/tab-create-menu-options.test.ts": 75,
+      "src/renderer/src/components/tab-bar/tab-move-to-pane-column.test.ts": 1424,
+      "src/renderer/src/components/tab-bar/tab-strip-content-resize-observers.test.ts": 236,
+      "src/renderer/src/components/tab-bar/tab-strip-overflow-navigation.test.ts": 73,
+      "src/renderer/src/components/tab-bar/tab-strip-pointer-activation.test.tsx": 1784,
+      "src/renderer/src/components/tab-bar/tab-strip-scroll-metrics.test.ts": 38,
+      "src/renderer/src/components/tab-bar/tab-title-tooltip.test.tsx": 1090,
+      "src/renderer/src/components/tab-bar/terminal-tab-activity-status.test.ts": 131,
+      "src/renderer/src/components/tab-bar/terminal-tab-spinner-launch-agent.test.ts": 53,
+      "src/renderer/src/components/tab-bar/use-open-tab-search.test.ts": 1977,
+      "src/renderer/src/components/tab-bar/use-tab-bar-quick-command-search-input.test.ts": 425,
+      "src/renderer/src/components/tab-bar/windows-shell-launch.test.ts": 29,
+      "src/renderer/src/components/tab-bar/windows-shell-menu-visibility.test.ts": 53,
+      "src/renderer/src/components/tab-group/RetainedPaneHost.test.tsx": 528,
+      "src/renderer/src/components/tab-group/TabGroupPanel.context-menu.test.ts": 35,
+      "src/renderer/src/components/tab-group/TabGroupSplitLayout.drag.test.tsx": 662,
+      "src/renderer/src/components/tab-group/TabGroupSplitLayout.test.ts": 319,
+      "src/renderer/src/components/tab-group/TabPaneColumnSplitDragOverlay.test.tsx": 110,
+      "src/renderer/src/components/tab-group/tab-drag-pointer-sensor.test.ts": 527,
+      "src/renderer/src/components/tab-group/tab-drag-pointer.test.ts": 41,
+      "src/renderer/src/components/tab-group/tab-drag-preview-activation.test.ts": 1253,
+      "src/renderer/src/components/tab-group/tab-drag-retained-guest-passthrough.test.tsx": 2070,
+      "src/renderer/src/components/tab-group/tab-drop-zone.test.ts": 38,
+      "src/renderer/src/components/tab-group/tab-group-body-anchor.test.ts": 38,
+      "src/renderer/src/components/tab-group/tab-group-panel-split-target.test.ts": 84,
+      "src/renderer/src/components/tab-group/tab-insertion.test.ts": 50,
+      "src/renderer/src/components/tab-group/useTabDragSplit.test.ts": 1851,
+      "src/renderer/src/components/tab-group/useTabGroupCreationCommands.local-shell.test.ts": 734,
+      "src/renderer/src/components/tab-group/useTabGroupTabCloseCommands.structured-session.test.ts": 263,
+      "src/renderer/src/components/tab-group/useTabGroupTabCloseCommands.test.tsx": 2028,
+      "src/renderer/src/components/tab-group/useTabGroupWorkspaceModel.focus.test.ts": 1358,
+      "src/renderer/src/components/task-drawer-source-boundary.test.ts": 40,
+      "src/renderer/src/components/task-page-cache-selectors.test.ts": 102,
+      "src/renderer/src/components/task-page-checks-pill.test.ts": 31,
+      "src/renderer/src/components/task-page-default-repo-selection.test.ts": 55,
+      "src/renderer/src/components/task-page-empty-state.test.ts": 95,
+      "src/renderer/src/components/task-page-github-dialog-state-authority.test.ts": 376,
+      "src/renderer/src/components/task-page-github-issue-creation.test.ts": 401,
+      "src/renderer/src/components/task-page-github-list-scroll-restore.test.ts": 277,
+      "src/renderer/src/components/task-page-github-resume-cache.test.ts": 52,
+      "src/renderer/src/components/task-page-github-reviewer-suggestions.test.ts": 50,
+      "src/renderer/src/components/task-page-github-status-actions.test.ts": 52,
+      "src/renderer/src/components/task-page-github-status-state.test.ts": 56,
+      "src/renderer/src/components/task-page-github-task-kind.test.ts": 56,
+      "src/renderer/src/components/task-page-github-work-item-filter-membership.test.ts": 51,
+      "src/renderer/src/components/task-page-github-work-item-mutation-patches.test.ts": 41,
+      "src/renderer/src/components/task-page-github-work-item-mutation-regressions.test.ts": 92,
+      "src/renderer/src/components/task-page-github-work-item-mutations.test.ts": 123,
+      "src/renderer/src/components/task-page-github-work-item-status.test.ts": 61,
+      "src/renderer/src/components/task-page-gitlab-task-filters.test.ts": 1702,
+      "src/renderer/src/components/task-page-initial-selection-scaling.test.tsx": 1727,
+      "src/renderer/src/components/task-page-jira-cache-selectors.test.ts": 56,
+      "src/renderer/src/components/task-page-jira-create-fields.test.ts": 51,
+      "src/renderer/src/components/task-page-jira-grouping.test.ts": 1262,
+      "src/renderer/src/components/task-page-jira-item-source-context.test.ts": 29,
+      "src/renderer/src/components/task-page-jira-load-state.test.ts": 55,
+      "src/renderer/src/components/task-page-jira-project-selection.test.ts": 57,
+      "src/renderer/src/components/task-page-jira-sort-controls.test.tsx": 932,
+      "src/renderer/src/components/task-page-jira-sorting.test.ts": 236,
+      "src/renderer/src/components/task-page-linear-in-orca-issues.test.ts": 79,
+      "src/renderer/src/components/task-page-linear-issue-dialog-popover-scroll.test.ts": 35,
+      "src/renderer/src/components/task-page-linear-issue-empty-state.test.ts": 45,
+      "src/renderer/src/components/task-page-linear-issue-grouping.test.ts": 966,
+      "src/renderer/src/components/task-page-linear-issue-request.test.ts": 52,
+      "src/renderer/src/components/task-page-linear-team-selection.test.ts": 45,
+      "src/renderer/src/components/task-page-list-chrome-visibility.test.ts": 41,
+      "src/renderer/src/components/task-page-localized-options.test.ts": 264,
+      "src/renderer/src/components/task-page-mutation-page-allocation.test.ts": 50,
+      "src/renderer/src/components/task-page-new-issue-draft.test.ts": 64,
+      "src/renderer/src/components/task-page-pagination-page-numbers.test.ts": 60,
+      "src/renderer/src/components/task-page-pr-check-summary.test.ts": 40,
+      "src/renderer/src/components/task-page-repo-source-context.test.ts": 1554,
+      "src/renderer/src/components/task-page-repo-source-divergence.test.ts": 1245,
+      "src/renderer/src/components/task-page-source-switch-boundary.test.ts": 258,
+      "src/renderer/src/components/task-page-task-creation-drafts.test.ts": 407,
+      "src/renderer/src/components/task-page-task-source-host-availability.test.ts": 1030,
+      "src/renderer/src/components/task-page-work-item-pagination.test.ts": 70,
+      "src/renderer/src/components/task-page-workspace-composer-boundary.test.ts": 463,
+      "src/renderer/src/components/task-source-context-summary.test.ts": 58,
+      "src/renderer/src/components/task-source-provider-availability.test.ts": 60,
+      "src/renderer/src/components/terminal-pane/CloseTerminalDialog.test.tsx": 1022,
+      "src/renderer/src/components/terminal-pane/MobileDriverOverlay.test.tsx": 466,
+      "src/renderer/src/components/terminal-pane/PinnedTabCloseDialog.test.tsx": 2509,
+      "src/renderer/src/components/terminal-pane/RunningTerminalCloseDialog.test.tsx": 1716,
+      "src/renderer/src/components/terminal-pane/SessionRestoredBanner.test.tsx": 306,
+      "src/renderer/src/components/terminal-pane/TerminalAgentSessionForkDialog.test.tsx": 220,
+      "src/renderer/src/components/terminal-pane/TerminalContextMenu.test.tsx": 1724,
+      "src/renderer/src/components/terminal-pane/TerminalErrorToast.test.ts": 911,
+      "src/renderer/src/components/terminal-pane/TerminalPaneHeaderOverlay.test.tsx": 1966,
+      "src/renderer/src/components/terminal-pane/TerminalPaneNativeChatPortal.test.tsx": 684,
+      "src/renderer/src/components/terminal-pane/TerminalPaneOverlayLayer.react185.test.tsx": 1403,
+      "src/renderer/src/components/terminal-pane/TerminalProcessExitOverlay.test.tsx": 513,
+      "src/renderer/src/components/terminal-pane/TerminalRemoteRuntimeReconnectBanner.test.tsx": 580,
+      "src/renderer/src/components/terminal-pane/TerminalSshReconnectOverlay.test.tsx": 1805,
+      "src/renderer/src/components/terminal-pane/agent-completion-coordinator-attention-dispatch.test.ts": 217,
+      "src/renderer/src/components/terminal-pane/agent-completion-coordinator-completion-replay-guard.test.ts": 147,
+      "src/renderer/src/components/terminal-pane/agent-completion-coordinator-dispose-leak.test.ts": 170,
+      "src/renderer/src/components/terminal-pane/agent-completion-coordinator-hook-done-quiet-window.test.ts": 104,
+      "src/renderer/src/components/terminal-pane/agent-completion-coordinator-hook-title-precedence.test.ts": 135,
+      "src/renderer/src/components/terminal-pane/agent-completion-coordinator-monitoring-turn-end.test.ts": 186,
+      "src/renderer/src/components/terminal-pane/agent-completion-coordinator-pending-title-inspection.test.ts": 168,
+      "src/renderer/src/components/terminal-pane/agent-completion-coordinator-process-cadence.test.ts": 170,
+      "src/renderer/src/components/terminal-pane/agent-completion-coordinator-queued-inspection-disposal.test.ts": 119,
+      "src/renderer/src/components/terminal-pane/agent-completion-coordinator-stamped-turn-boundary.test.ts": 102,
+      "src/renderer/src/components/terminal-pane/agent-completion-coordinator-stamped-turn-replay.test.ts": 181,
+      "src/renderer/src/components/terminal-pane/agent-completion-no-evidence-cadence.test.ts": 966,
+      "src/renderer/src/components/terminal-pane/agent-completion-poll-interval.test.ts": 217,
+      "src/renderer/src/components/terminal-pane/agent-completion-stale-evidence-backoff.test.ts": 112,
+      "src/renderer/src/components/terminal-pane/agent-completion-steady-state-opt-in.test.ts": 123,
+      "src/renderer/src/components/terminal-pane/agent-hook-terminal-lifecycle.test.ts": 50,
+      "src/renderer/src/components/terminal-pane/agent-interrupt-inference.test.ts": 135,
+      "src/renderer/src/components/terminal-pane/agent-process-inspection-queue-rejection-containment.test.ts": 46,
+      "src/renderer/src/components/terminal-pane/agent-process-inspection-round.test.ts": 48,
+      "src/renderer/src/components/terminal-pane/agent-question-answered-inference.test.ts": 52,
+      "src/renderer/src/components/terminal-pane/cache-timer-seeding.test.ts": 84,
+      "src/renderer/src/components/terminal-pane/codex-backfill-error-detector.test.ts": 24,
+      "src/renderer/src/components/terminal-pane/codex-detached-pane-restart.test.ts": 1008,
+      "src/renderer/src/components/terminal-pane/command-code-done-settle.test.ts": 66,
+      "src/renderer/src/components/terminal-pane/command-code-output-ownership.test.ts": 34,
+      "src/renderer/src/components/terminal-pane/compose-active-terminal-theme.test.ts": 93,
+      "src/renderer/src/components/terminal-pane/deferred-reattach-live-data-queue.test.ts": 144,
+      "src/renderer/src/components/terminal-pane/deferred-split-pane-handoff.test.ts": 50,
+      "src/renderer/src/components/terminal-pane/desktop-fit-fallback.test.ts": 61,
+      "src/renderer/src/components/terminal-pane/direct-ssh-hidden-output-restore-unavailable-banner.test.ts": 921,
+      "src/renderer/src/components/terminal-pane/edge-wrapped-terminal-http-links.test.ts": 1446,
+      "src/renderer/src/components/terminal-pane/expand-collapse-render-stability.test.ts": 2192,
+      "src/renderer/src/components/terminal-pane/expand-collapse.test.ts": 86,
+      "src/renderer/src/components/terminal-pane/focus-terminal-pane-event.test.ts": 43,
+      "src/renderer/src/components/terminal-pane/focused-pane-rim-flash.test.ts": 47,
+      "src/renderer/src/components/terminal-pane/git-bash-console-capacity.test.ts": 40,
+      "src/renderer/src/components/terminal-pane/hard-wrapped-terminal-http-links.test.ts": 69,
+      "src/renderer/src/components/terminal-pane/hidden-output-restore-scheduler.test.ts": 73,
+      "src/renderer/src/components/terminal-pane/hidden-reveal-reconciliation.fuzz.test.ts": 7285,
+      "src/renderer/src/components/terminal-pane/issue-12112-agent-pane-startup-color-reply-leak.repro.test.ts": 220,
+      "src/renderer/src/components/terminal-pane/issue-21762-tracking-mode-middle-click-double-paste.repro.test.ts": 657,
+      "src/renderer/src/components/terminal-pane/issue-4631-terminal-hover-link-provider.repro.test.ts": 769,
+      "src/renderer/src/components/terminal-pane/keyboard-handlers-ime-composing-chord.test.tsx": 2192,
+      "src/renderer/src/components/terminal-pane/keyboard-handlers-ime-enter-keyup.test.tsx": 2539,
+      "src/renderer/src/components/terminal-pane/keyboard-handlers-ime.test.tsx": 2043,
+      "src/renderer/src/components/terminal-pane/keyboard-handlers.test.ts": 1892,
+      "src/renderer/src/components/terminal-pane/layout-serialization.test.ts": 78,
+      "src/renderer/src/components/terminal-pane/leaf-scrollback-resolution.test.ts": 204,
+      "src/renderer/src/components/terminal-pane/manual-terminal-worktree-park-eligibility.test.ts": 1568,
+      "src/renderer/src/components/terminal-pane/merge-captured-leaf-state.test.ts": 39,
+      "src/renderer/src/components/terminal-pane/mobile-driver-overlay-collapse.test.ts": 29,
+      "src/renderer/src/components/terminal-pane/mobile-driver-overlay-focus.test.ts": 50,
+      "src/renderer/src/components/terminal-pane/mobile-driver-overlay-visibility.test.ts": 50,
+      "src/renderer/src/components/terminal-pane/mouse-hide-while-typing.test.ts": 53,
+      "src/renderer/src/components/terminal-pane/native-chat-leaf-title-agent.test.ts": 83,
+      "src/renderer/src/components/terminal-pane/osc52-clipboard-default-on-notice.test.ts": 389,
+      "src/renderer/src/components/terminal-pane/osc52-clipboard-toast.test.ts": 621,
+      "src/renderer/src/components/terminal-pane/osc52-clipboard.test.ts": 130,
+      "src/renderer/src/components/terminal-pane/override-affected-panes.test.ts": 49,
+      "src/renderer/src/components/terminal-pane/paired-parking-unverifiable-host.test.ts": 82,
+      "src/renderer/src/components/terminal-pane/paired-reconnect-multi-pane-materialization.test.ts": 2000,
+      "src/renderer/src/components/terminal-pane/pane-agent-session-id.test.ts": 28,
+      "src/renderer/src/components/terminal-pane/pane-foreground-agent-tracker.test.ts": 513,
+      "src/renderer/src/components/terminal-pane/pane-foreground-inspect-observation-identity.test.ts": 50,
+      "src/renderer/src/components/terminal-pane/pane-helpers.test.ts": 59,
+      "src/renderer/src/components/terminal-pane/pane-restart-transport-handoff.test.ts": 1459,
+      "src/renderer/src/components/terminal-pane/pane-title-overlay-rects.test.ts": 39,
+      "src/renderer/src/components/terminal-pane/pane-title-update-global-scan-budget.test.tsx": 3714,
+      "src/renderer/src/components/terminal-pane/parked-terminal-buffer-capture.test.ts": 183,
+      "src/renderer/src/components/terminal-pane/parked-terminal-byte-watcher.test.ts": 1531,
+      "src/renderer/src/components/terminal-pane/parked-terminal-command-status.test.ts": 130,
+      "src/renderer/src/components/terminal-pane/parked-terminal-tab-capture-episodes.test.ts": 150,
+      "src/renderer/src/components/terminal-pane/parse-osc7.test.ts": 56,
+      "src/renderer/src/components/terminal-pane/pending-pane-close-confirmation.test.ts": 1233,
+      "src/renderer/src/components/terminal-pane/pending-runtime-pane-close.test.ts": 1002,
+      "src/renderer/src/components/terminal-pane/pending-split-close.test.ts": 1013,
+      "src/renderer/src/components/terminal-pane/pty-buffer-serializer.test.ts": 32,
+      "src/renderer/src/components/terminal-pane/pty-connection-agent-session-resume.test.ts": 1595,
+      "src/renderer/src/components/terminal-pane/pty-connection-cold-restore-agent-resume.test.ts": 1581,
+      "src/renderer/src/components/terminal-pane/pty-connection-cold-restore-repaint.test.ts": 1145,
+      "src/renderer/src/components/terminal-pane/pty-connection-cold-restore-resume-command.test.ts": 1253,
+      "src/renderer/src/components/terminal-pane/pty-connection-command-finished-cleanup.test.ts": 7780,
+      "src/renderer/src/components/terminal-pane/pty-connection-daemon-snapshot-replay.test.ts": 1637,
+      "src/renderer/src/components/terminal-pane/pty-connection-deferred-reattach-live-output.test.ts": 1762,
+      "src/renderer/src/components/terminal-pane/pty-connection-deferred-ssh-passphrase.test.ts": 642,
+      "src/renderer/src/components/terminal-pane/pty-connection-deliberate-sleep-guard.test.ts": 1014,
+      "src/renderer/src/components/terminal-pane/pty-connection-direct-ssh-reattach-retry.test.ts": 1017,
+      "src/renderer/src/components/terminal-pane/pty-connection-direct-ssh-spawn-retry.test.ts": 1177,
+      "src/renderer/src/components/terminal-pane/pty-connection-foreground-agent-routing.test.ts": 960,
+      "src/renderer/src/components/terminal-pane/pty-connection-foreground-agent-sampling.test.ts": 1709,
+      "src/renderer/src/components/terminal-pane/pty-connection-foreground-routing-confirmation.test.ts": 994,
+      "src/renderer/src/components/terminal-pane/pty-connection-foreground-write-path.test.ts": 1595,
+      "src/renderer/src/components/terminal-pane/pty-connection-fresh-spawn-guards.test.ts": 1457,
+      "src/renderer/src/components/terminal-pane/pty-connection-hibernation-wake.test.ts": 1511,
+      "src/renderer/src/components/terminal-pane/pty-connection-hidden-atlas-recovery.test.ts": 1949,
+      "src/renderer/src/components/terminal-pane/pty-connection-hidden-backlog-reconciliation.test.ts": 2482,
+      "src/renderer/src/components/terminal-pane/pty-connection-hidden-backlog-snapshot.test.ts": 2106,
+      "src/renderer/src/components/terminal-pane/pty-connection-hidden-codex-queries.test.ts": 1397,
+      "src/renderer/src/components/terminal-pane/pty-connection-hidden-delivery-gate.test.ts": 1974,
+      "src/renderer/src/components/terminal-pane/pty-connection-hidden-output-restore.test.ts": 1212,
+      "src/renderer/src/components/terminal-pane/pty-connection-hidden-query-snapshot-restore.test.ts": 1575,
+      "src/renderer/src/components/terminal-pane/pty-connection-hidden-restore-fit-overflow.test.ts": 993,
+      "src/renderer/src/components/terminal-pane/pty-connection-hidden-snapshot-live-overlap.test.ts": 903,
+      "src/renderer/src/components/terminal-pane/pty-connection-hidden-snapshot-resize-signals.test.ts": 2255,
+      "src/renderer/src/components/terminal-pane/pty-connection-hidden-tui-snapshot-replay.test.ts": 796,
+      "src/renderer/src/components/terminal-pane/pty-connection-hook-completion-bell-arbitration.test.ts": 1097,
+      "src/renderer/src/components/terminal-pane/pty-connection-hook-completion-side-effects.test.ts": 1520,
+      "src/renderer/src/components/terminal-pane/pty-connection-hook-idle-arbitration.test.ts": 1109,
+      "src/renderer/src/components/terminal-pane/pty-connection-interrupt-inference.test.ts": 1194,
+      "src/renderer/src/components/terminal-pane/pty-connection-main-side-effect-authority.test.ts": 1194,
+      "src/renderer/src/components/terminal-pane/pty-connection-mode-2031-subscriptions.test.ts": 1082,
+      "src/renderer/src/components/terminal-pane/pty-connection-notification-settings-gating.test.ts": 1779,
+      "src/renderer/src/components/terminal-pane/pty-connection-parked-ssh-snapshot.test.ts": 1899,
+      "src/renderer/src/components/terminal-pane/pty-connection-pi-synchronized-input.test.ts": 595,
+      "src/renderer/src/components/terminal-pane/pty-connection-post-dispose-restore-termination.test.ts": 829,
+      "src/renderer/src/components/terminal-pane/pty-connection-pty-exit-teardown.test.ts": 6007,
+      "src/renderer/src/components/terminal-pane/pty-connection-queued-startup-consume.test.ts": 1073,
+      "src/renderer/src/components/terminal-pane/pty-connection-reattach-binding.test.ts": 4696,
+      "src/renderer/src/components/terminal-pane/pty-connection-reattach-mode-reset.test.ts": 4241,
+      "src/renderer/src/components/terminal-pane/pty-connection-remote-runtime-attach.test.ts": 2097,
+      "src/renderer/src/components/terminal-pane/pty-connection-remote-snapshot-source-grid.test.ts": 852,
+      "src/renderer/src/components/terminal-pane/pty-connection-renderer-risk-repaint.test.ts": 1509,
+      "src/renderer/src/components/terminal-pane/pty-connection-replay-payload-handling.test.ts": 1105,
+      "src/renderer/src/components/terminal-pane/pty-connection-restored-baseline-shortfall.test.ts": 676,
+      "src/renderer/src/components/terminal-pane/pty-connection-runtime-owner-spawn-routing.test.ts": 889,
+      "src/renderer/src/components/terminal-pane/pty-connection-session-liveness.test.ts": 1647,
+      "src/renderer/src/components/terminal-pane/pty-connection-setup-split-spawn.test.ts": 1562,
+      "src/renderer/src/components/terminal-pane/pty-connection-sleeping-resume-banner.test.ts": 1195,
+      "src/renderer/src/components/terminal-pane/pty-connection-spawn-left-pane-unbound.test.ts": 703,
+      "src/renderer/src/components/terminal-pane/pty-connection-split-cwd-resolution.test.ts": 729,
+      "src/renderer/src/components/terminal-pane/pty-connection-ssh-startup-draft-delivery.test.ts": 1351,
+      "src/renderer/src/components/terminal-pane/pty-connection-stalled-hidden-restore.test.ts": 2466,
+      "src/renderer/src/components/terminal-pane/pty-connection-startup-command-delivery.test.ts": 964,
+      "src/renderer/src/components/terminal-pane/pty-connection-task-complete-dispatch.test.ts": 1078,
+      "src/renderer/src/components/terminal-pane/pty-connection-terminal-input-gating.test.ts": 5951,
+      "src/renderer/src/components/terminal-pane/pty-connection-typed-agent-identity.test.ts": 1837,
+      "src/renderer/src/components/terminal-pane/pty-connection-visibility-resume-size.test.ts": 1270,
+      "src/renderer/src/components/terminal-pane/pty-connection-visible-pane-output-pause-latch.test.ts": 926,
+      "src/renderer/src/components/terminal-pane/pty-connection-windows-cjk-repaint.test.ts": 1272,
+      "src/renderer/src/components/terminal-pane/pty-connection-windows-keyboard-reset.test.ts": 1294,
+      "src/renderer/src/components/terminal-pane/pty-connection/direct-ssh-reattach-recovery.test.ts": 37,
+      "src/renderer/src/components/terminal-pane/pty-connection/disposed-spawn-retention.test.ts": 65,
+      "src/renderer/src/components/terminal-pane/pty-connection/foreground-output-budgets.test.ts": 52,
+      "src/renderer/src/components/terminal-pane/pty-connection/foreground-output-scan.test.ts": 63,
+      "src/renderer/src/components/terminal-pane/pty-connection/foreground-renderer-risk-scan-tail.test.ts": 74,
+      "src/renderer/src/components/terminal-pane/pty-connection/pane-pty-layout-binding.test.ts": 33,
+      "src/renderer/src/components/terminal-pane/pty-connection/park-reveal-snapshot-verdict.test.ts": 993,
+      "src/renderer/src/components/terminal-pane/pty-connection/reattach-payload-context.test.ts": 1537,
+      "src/renderer/src/components/terminal-pane/pty-connection/reattach-payload-ssh-reconnect-model-paint.test.ts": 1308,
+      "src/renderer/src/components/terminal-pane/pty-connection/reattach-result-handler-park-reveal-verdict.test.ts": 167,
+      "src/renderer/src/components/terminal-pane/pty-connection/reattach-success-settle.test.ts": 186,
+      "src/renderer/src/components/terminal-pane/pty-connection/ssh-session-gone-verdict.test.ts": 42,
+      "src/renderer/src/components/terminal-pane/pty-connection/terminal-tab-id.test.ts": 41,
+      "src/renderer/src/components/terminal-pane/pty-connection/unbound-pane-spawn-recovery.test.ts": 51,
+      "src/renderer/src/components/terminal-pane/pty-connection/write-pty-output-to-xterm-startup-callback.test.ts": 69,
+      "src/renderer/src/components/terminal-pane/pty-dispatcher-delivery-interest.test.ts": 196,
+      "src/renderer/src/components/terminal-pane/pty-dispatcher-delivery-resync.test.ts": 71,
+      "src/renderer/src/components/terminal-pane/pty-dispatcher-pi-routing.test.ts": 389,
+      "src/renderer/src/components/terminal-pane/pty-dispatcher-push-reattach.test.ts": 142,
+      "src/renderer/src/components/terminal-pane/pty-input-write-queue.test.ts": 877,
+      "src/renderer/src/components/terminal-pane/pty-model-restore-channel.test.ts": 33,
+      "src/renderer/src/components/terminal-pane/pty-pre-handler-buffer-warn-eviction.test.ts": 55,
+      "src/renderer/src/components/terminal-pane/pty-pre-handler-buffer.test.ts": 107,
+      "src/renderer/src/components/terminal-pane/pty-preconnect-input-buffer.test.ts": 56,
+      "src/renderer/src/components/terminal-pane/pty-renderer-delivery-claims.test.ts": 61,
+      "src/renderer/src/components/terminal-pane/pty-shutdown-data-suspension.test.ts": 42,
+      "src/renderer/src/components/terminal-pane/pty-shutdown-exit-deferral.test.ts": 133,
+      "src/renderer/src/components/terminal-pane/pty-shutdown-output-queue.test.ts": 2353,
+      "src/renderer/src/components/terminal-pane/pty-side-effect-pending-census.test.ts": 138,
+      "src/renderer/src/components/terminal-pane/pty-size-reassertion.test.ts": 49,
+      "src/renderer/src/components/terminal-pane/pty-size-reconcile.test.ts": 60,
+      "src/renderer/src/components/terminal-pane/pty-transport-connect-spawn.test.ts": 435,
+      "src/renderer/src/components/terminal-pane/pty-transport-detach-attach-handoff.test.ts": 310,
+      "src/renderer/src/components/terminal-pane/pty-transport-eager-buffer-replay.test.ts": 520,
+      "src/renderer/src/components/terminal-pane/pty-transport-handler-suspension.test.ts": 277,
+      "src/renderer/src/components/terminal-pane/pty-transport-input-write.test.ts": 1210,
+      "src/renderer/src/components/terminal-pane/pty-transport-output-side-effects.test.ts": 603,
+      "src/renderer/src/components/terminal-pane/pty-transport-pi-coalesce.test.ts": 229,
+      "src/renderer/src/components/terminal-pane/pty-transport-pi-spinner.test.ts": 233,
+      "src/renderer/src/components/terminal-pane/pty-transport-reattach-admission.test.ts": 363,
+      "src/renderer/src/components/terminal-pane/pty-transport-recycled-pty-incarnation.test.ts": 258,
+      "src/renderer/src/components/terminal-pane/pty-transport-spawn-errors.test.ts": 189,
+      "src/renderer/src/components/terminal-pane/regular-terminal-focus-ownership.test.ts": 459,
+      "src/renderer/src/components/terminal-pane/remote-desktop-viewport-claim.test.ts": 55,
+      "src/renderer/src/components/terminal-pane/remote-execution-host-pty.test.ts": 1028,
+      "src/renderer/src/components/terminal-pane/remote-hidden-output-restore-outcomes.test.ts": 1239,
+      "src/renderer/src/components/terminal-pane/remote-hidden-output-restore-unavailable-banner.repro.test.ts": 873,
+      "src/renderer/src/components/terminal-pane/remote-layout-scrollback-retention.test.ts": 43,
+      "src/renderer/src/components/terminal-pane/remote-pane-layout-push.test.ts": 66,
+      "src/renderer/src/components/terminal-pane/remote-park-reveal-unverifiable-retry.test.ts": 567,
+      "src/renderer/src/components/terminal-pane/remote-runtime-connect-failure-recovery.test.ts": 1496,
+      "src/renderer/src/components/terminal-pane/remote-runtime-error-surface-dismissal.test.ts": 1919,
+      "src/renderer/src/components/terminal-pane/remote-runtime-outage-toast-flood-and-stuck-reconnect.test.ts": 1098,
+      "src/renderer/src/components/terminal-pane/remote-runtime-pty-batching.test.ts": 119,
+      "src/renderer/src/components/terminal-pane/remote-runtime-pty-deadline-reattach.test.ts": 2442,
+      "src/renderer/src/components/terminal-pane/remote-runtime-pty-latched-pane-retention.test.ts": 5019,
+      "src/renderer/src/components/terminal-pane/remote-runtime-pty-query-reply-immediate.test.ts": 2214,
+      "src/renderer/src/components/terminal-pane/remote-runtime-pty-recovery-state.test.ts": 79,
+      "src/renderer/src/components/terminal-pane/remote-runtime-pty-snapshot-escape-tail.test.ts": 1574,
+      "src/renderer/src/components/terminal-pane/remote-runtime-pty-snapshot-source-grid.test.ts": 1311,
+      "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-activation-inventory-fallback.test.ts": 1933,
+      "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-attach-subscription.test.ts": 3688,
+      "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-create-handoff.test.ts": 2192,
+      "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-create-outcome-recovery.test.ts": 2020,
+      "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-end-verdict.test.ts": 1894,
+      "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-expired-pane-recovery.test.ts": 2760,
+      "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-host-absence-evidence.test.ts": 1849,
+      "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-host-session-launch.test.ts": 2998,
+      "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-host-surface-replacement.test.ts": 5439,
+      "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-input-coalescing.test.ts": 5313,
+      "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-input-fallback.test.ts": 1946,
+      "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-pane-handle-resolution.test.ts": 3291,
+      "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-pending-host-surface-attach.test.ts": 2620,
+      "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-snapshot-replay.test.ts": 2114,
+      "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-split-leaf-activation.test.ts": 3201,
+      "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-stale-handle-recovery.test.ts": 2981,
+      "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-sticky-replacement-policy.test.ts": 2126,
+      "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-stream-reconnect.test.ts": 4074,
+      "src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-web-mirror-recovery.test.ts": 2942,
+      "src/renderer/src/components/terminal-pane/remote-runtime-resubscribe-failure-recovery-routing.test.ts": 3115,
+      "src/renderer/src/components/terminal-pane/renderer-owned-agent-status-registry.test.ts": 34,
+      "src/renderer/src/components/terminal-pane/replay-guard.test.ts": 130,
+      "src/renderer/src/components/terminal-pane/replayed-scrollback-store-release.test.ts": 147,
+      "src/renderer/src/components/terminal-pane/repro-8299-shift-space-input-source.test.ts": 167,
+      "src/renderer/src/components/terminal-pane/repro-8832-url-next-line.test.ts": 1961,
+      "src/renderer/src/components/terminal-pane/resolve-split-cwd.test.ts": 1427,
+      "src/renderer/src/components/terminal-pane/restored-snapshot-coverage.test.ts": 91,
+      "src/renderer/src/components/terminal-pane/scan22-ssh-new-tab-disposed-spawn-kill.repro.test.ts": 176,
+      "src/renderer/src/components/terminal-pane/session-restored-banner-pane-state.test.tsx": 409,
+      "src/renderer/src/components/terminal-pane/shell-ready-marker-scan.test.ts": 39,
+      "src/renderer/src/components/terminal-pane/shutdown-buffer-captures.test.ts": 48,
+      "src/renderer/src/components/terminal-pane/sleeping-record-park-exemption.test.ts": 75,
+      "src/renderer/src/components/terminal-pane/split-right-white-screen.test.ts": 36,
+      "src/renderer/src/components/terminal-pane/ssh-pane-connect-gate.test.ts": 48,
+      "src/renderer/src/components/terminal-pane/ssh-reattach-model-restore.test.ts": 67,
+      "src/renderer/src/components/terminal-pane/ssh-reconnect-model-paint-gate.test.ts": 51,
+      "src/renderer/src/components/terminal-pane/stale-document-visibility.test.ts": 43,
+      "src/renderer/src/components/terminal-pane/terminal-agent-paste-bracketing.test.ts": 59,
+      "src/renderer/src/components/terminal-pane/terminal-agent-session-continuation.test.ts": 101,
+      "src/renderer/src/components/terminal-pane/terminal-agent-session-fork.test.ts": 599,
+      "src/renderer/src/components/terminal-pane/terminal-alternate-screen-parse.test.ts": 124,
+      "src/renderer/src/components/terminal-pane/terminal-appearance.test.ts": 303,
+      "src/renderer/src/components/terminal-pane/terminal-attention-surface.test.ts": 1639,
+      "src/renderer/src/components/terminal-pane/terminal-bracketed-paste.test.ts": 33,
+      "src/renderer/src/components/terminal-pane/terminal-capability-replies.test.ts": 144,
+      "src/renderer/src/components/terminal-pane/terminal-capped-buffer-retention.test.ts": 379,
+      "src/renderer/src/components/terminal-pane/terminal-captured-input-dispatch.test.ts": 39,
+      "src/renderer/src/components/terminal-pane/terminal-chat-ownership-lifecycle.test.tsx": 1028,
+      "src/renderer/src/components/terminal-pane/terminal-cjk-cursor-cell-placement.test.ts": 562,
+      "src/renderer/src/components/terminal-pane/terminal-clipboard-event-paste.test.ts": 57,
+      "src/renderer/src/components/terminal-pane/terminal-clipboard-paste.test.ts": 97,
+      "src/renderer/src/components/terminal-pane/terminal-clipboard-selection-text.test.ts": 63,
+      "src/renderer/src/components/terminal-pane/terminal-cold-park-exempt-flip.react185.test.tsx": 1585,
+      "src/renderer/src/components/terminal-pane/terminal-cold-park-pre-gate-loop.react185.test.tsx": 581,
+      "src/renderer/src/components/terminal-pane/terminal-cold-park-recheck-deadlines.test.ts": 1522,
+      "src/renderer/src/components/terminal-pane/terminal-cold-park-subscription-narrowing.react185.test.tsx": 729,
+      "src/renderer/src/components/terminal-pane/terminal-cold-park-tab-model-identity.react185.test.tsx": 946,
+      "src/renderer/src/components/terminal-pane/terminal-cold-park-timer-rearm.test.tsx": 704,
+      "src/renderer/src/components/terminal-pane/terminal-cold-park-verdict-loop.test.tsx": 587,
+      "src/renderer/src/components/terminal-pane/terminal-cold-park-withheld-tabs.test.ts": 54,
+      "src/renderer/src/components/terminal-pane/terminal-command-lifecycle.test.ts": 42,
+      "src/renderer/src/components/terminal-pane/terminal-context-menu-dismiss.test.ts": 31,
+      "src/renderer/src/components/terminal-pane/terminal-copy-rejection-handling.test.ts": 49,
+      "src/renderer/src/components/terminal-pane/terminal-ctrl-arrow-conpty.test.ts": 868,
+      "src/renderer/src/components/terminal-pane/terminal-ctrl-enter.test.ts": 86,
+      "src/renderer/src/components/terminal-pane/terminal-cursor-appearance-precedence.test.ts": 525,
+      "src/renderer/src/components/terminal-pane/terminal-cursor-inactive-style.test.ts": 205,
+      "src/renderer/src/components/terminal-pane/terminal-dead-session-reconcile.test.ts": 39,
+      "src/renderer/src/components/terminal-pane/terminal-delivery-watchdog.test.ts": 73,
+      "src/renderer/src/components/terminal-pane/terminal-drop-handler.test.ts": 346,
+      "src/renderer/src/components/terminal-pane/terminal-drop-image-path.test.ts": 56,
+      "src/renderer/src/components/terminal-pane/terminal-drop-internal-handler.test.ts": 411,
+      "src/renderer/src/components/terminal-pane/terminal-drop-path-writer.test.ts": 72,
+      "src/renderer/src/components/terminal-pane/terminal-drop-runtime-owner.test.ts": 115,
+      "src/renderer/src/components/terminal-pane/terminal-drop-shell.test.ts": 46,
+      "src/renderer/src/components/terminal-pane/terminal-drop-upload-report.test.ts": 52,
+      "src/renderer/src/components/terminal-pane/terminal-drop-write-failure.test.ts": 52,
+      "src/renderer/src/components/terminal-pane/terminal-error-accumulation.test.ts": 223,
+      "src/renderer/src/components/terminal-pane/terminal-error-remote-closed-localization.test.ts": 289,
+      "src/renderer/src/components/terminal-pane/terminal-eviction-exempt-tabs.test.ts": 809,
+      "src/renderer/src/components/terminal-pane/terminal-file-link-actions.test.ts": 195,
+      "src/renderer/src/components/terminal-pane/terminal-fit-restore.test.ts": 85,
+      "src/renderer/src/components/terminal-pane/terminal-freeze-report.test.ts": 73,
+      "src/renderer/src/components/terminal-pane/terminal-handle-copy.test.ts": 70,
+      "src/renderer/src/components/terminal-pane/terminal-handle-links.test.ts": 354,
+      "src/renderer/src/components/terminal-pane/terminal-hidden-restore-scrollback.test.ts": 23,
+      "src/renderer/src/components/terminal-pane/terminal-hidden-view-parking.test.ts": 966,
+      "src/renderer/src/components/terminal-pane/terminal-hidden-worktree-retention.test.ts": 851,
+      "src/renderer/src/components/terminal-pane/terminal-http-link-activation.test.ts": 173,
+      "src/renderer/src/components/terminal-pane/terminal-http-link-source-owner.test.ts": 76,
+      "src/renderer/src/components/terminal-pane/terminal-http-url-extraction.test.ts": 53,
+      "src/renderer/src/components/terminal-pane/terminal-ime-candidate-key-release-guard.test.ts": 57,
+      "src/renderer/src/components/terminal-pane/terminal-ime-composer-placeholder-mask.test.ts": 1182,
+      "src/renderer/src/components/terminal-pane/terminal-ime-composition-route.test.ts": 281,
+      "src/renderer/src/components/terminal-pane/terminal-ime-composition-tracker.test.ts": 479,
+      "src/renderer/src/components/terminal-pane/terminal-ime-composition-transaction-ownership.test.ts": 249,
+      "src/renderer/src/components/terminal-pane/terminal-ime-deferred-chord.test.ts": 324,
+      "src/renderer/src/components/terminal-pane/terminal-ime-deferred-newline.test.ts": 383,
+      "src/renderer/src/components/terminal-pane/terminal-ime-forwarder-space-claim.test.ts": 356,
+      "src/renderer/src/components/terminal-pane/terminal-ime-hangul-syllable-flush.test.ts": 1285,
+      "src/renderer/src/components/terminal-pane/terminal-ime-hangul-terminating-digit.test.ts": 268,
+      "src/renderer/src/components/terminal-pane/terminal-ime-input-context-refresh.test.ts": 395,
+      "src/renderer/src/components/terminal-pane/terminal-ime-linux-candidate-state.test.ts": 72,
+      "src/renderer/src/components/terminal-pane/terminal-ime-linux-claimed-preedit-release.test.ts": 546,
+      "src/renderer/src/components/terminal-pane/terminal-ime-linux-claimed-preedit-selector.test.ts": 104,
+      "src/renderer/src/components/terminal-pane/terminal-ime-macos-keybinding-dict-trace.test.ts": 482,
+      "src/renderer/src/components/terminal-pane/terminal-ime-native-text-forwarder.test.ts": 429,
+      "src/renderer/src/components/terminal-pane/terminal-ime-substituted-text-commit.test.ts": 703,
+      "src/renderer/src/components/terminal-pane/terminal-ime-won-composition-order.test.ts": 989,
+      "src/renderer/src/components/terminal-pane/terminal-ime-xterm-adversarial.test.ts": 4544,
+      "src/renderer/src/components/terminal-pane/terminal-ime-xterm-cancelled-preedit-visibility.test.ts": 606,
+      "src/renderer/src/components/terminal-pane/terminal-ime-xterm-composition-cancel.test.ts": 885,
+      "src/renderer/src/components/terminal-pane/terminal-ime-xterm-composition-deduplication.test.ts": 2544,
+      "src/renderer/src/components/terminal-pane/terminal-ime-xterm-consumed-key-commit.test.ts": 634,
+      "src/renderer/src/components/terminal-pane/terminal-ime-xterm-korean-enter-commit-order.test.ts": 670,
+      "src/renderer/src/components/terminal-pane/terminal-ime-xterm-linux-native-trace-replay.test.ts": 4862,
+      "src/renderer/src/components/terminal-pane/terminal-ime-xterm-midline-preedit-tail.test.ts": 1276,
+      "src/renderer/src/components/terminal-pane/terminal-ime-xterm-preedit-cell-grid.test.ts": 2107,
+      "src/renderer/src/components/terminal-pane/terminal-ime-xterm-resumed-preedit-visibility.test.ts": 897,
+      "src/renderer/src/components/terminal-pane/terminal-ime-xterm-trailing-preedit-occlusion.test.ts": 965,
+      "src/renderer/src/components/terminal-pane/terminal-ime-xterm-transaction-events.test.ts": 899,
+      "src/renderer/src/components/terminal-pane/terminal-ime-xterm-windows-resumed-preedit-trace.test.ts": 900,
+      "src/renderer/src/components/terminal-pane/terminal-inline-image-da1.test.ts": 118,
+      "src/renderer/src/components/terminal-pane/terminal-input-host-platform.test.ts": 1508,
+      "src/renderer/src/components/terminal-pane/terminal-input-quarantine.test.ts": 46,
+      "src/renderer/src/components/terminal-pane/terminal-ios-hangul-preedit-coexistence.test.ts": 869,
+      "src/renderer/src/components/terminal-pane/terminal-ios-hangul-preedit-device-trace.test.ts": 656,
+      "src/renderer/src/components/terminal-pane/terminal-ios-hangul-preedit.test.ts": 683,
+      "src/renderer/src/components/terminal-pane/terminal-jis-yen-input.test.ts": 40,
+      "src/renderer/src/components/terminal-pane/terminal-keyboard-event-handlers-focus.test.ts": 2134,
+      "src/renderer/src/components/terminal-pane/terminal-keyboard-pane-resolution.test.ts": 355,
+      "src/renderer/src/components/terminal-pane/terminal-keyboard-protocol-pane-agent.test.ts": 38,
+      "src/renderer/src/components/terminal-pane/terminal-keyboard-search-dispatch.test.ts": 1683,
+      "src/renderer/src/components/terminal-pane/terminal-kitty-csi-u-encoding.test.ts": 39,
+      "src/renderer/src/components/terminal-pane/terminal-layout-duplicate-pty-replay.test.ts": 73,
+      "src/renderer/src/components/terminal-pane/terminal-layout-leaf-detach.test.ts": 62,
+      "src/renderer/src/components/terminal-pane/terminal-layout-leaf-ids.test.ts": 39,
+      "src/renderer/src/components/terminal-pane/terminal-layout-overlay-focus.test.tsx": 328,
+      "src/renderer/src/components/terminal-pane/terminal-layout-pty-ownership-depth.test.ts": 103,
+      "src/renderer/src/components/terminal-pane/terminal-layout-pty-ownership.test.ts": 111,
+      "src/renderer/src/components/terminal-pane/terminal-link-action-routing.test.ts": 1448,
+      "src/renderer/src/components/terminal-pane/terminal-link-activation.test.ts": 226,
+      "src/renderer/src/components/terminal-pane/terminal-link-click-behavior.test.ts": 33,
+      "src/renderer/src/components/terminal-pane/terminal-link-click-fallback.test.ts": 902,
+      "src/renderer/src/components/terminal-pane/terminal-link-file-open-routing.test.ts": 549,
+      "src/renderer/src/components/terminal-pane/terminal-link-missing-file-open.test.ts": 398,
+      "src/renderer/src/components/terminal-pane/terminal-link-open-hints.test.ts": 263,
+      "src/renderer/src/components/terminal-pane/terminal-link-osc-file-targets.test.ts": 659,
+      "src/renderer/src/components/terminal-pane/terminal-link-osc-url-routing.test.ts": 384,
+      "src/renderer/src/components/terminal-pane/terminal-link-pointer-gesture.test.ts": 642,
+      "src/renderer/src/components/terminal-pane/terminal-link-provider-batching.test.ts": 478,
+      "src/renderer/src/components/terminal-pane/terminal-link-provider-link-detection.test.ts": 687,
+      "src/renderer/src/components/terminal-pane/terminal-link-pty-mouse-suppression.test.ts": 716,
+      "src/renderer/src/components/terminal-pane/terminal-link-remote-runtime-ssh-open.test.ts": 470,
+      "src/renderer/src/components/terminal-pane/terminal-link-worktree-root-activation.test.ts": 412,
+      "src/renderer/src/components/terminal-pane/terminal-link-wsl-path-mapping.test.ts": 497,
+      "src/renderer/src/components/terminal-pane/terminal-linkifier-click-priming.test.ts": 191,
+      "src/renderer/src/components/terminal-pane/terminal-live-layout-reconciliation.test.ts": 1437,
+      "src/renderer/src/components/terminal-pane/terminal-native-copy-gutter.test.ts": 296,
+      "src/renderer/src/components/terminal-pane/terminal-non-latin-control-chord.test.ts": 66,
+      "src/renderer/src/components/terminal-pane/terminal-notification-state.test.ts": 960,
+      "src/renderer/src/components/terminal-pane/terminal-option-kitty-release.test.ts": 47,
+      "src/renderer/src/components/terminal-pane/terminal-output-visibility.test.ts": 32,
+      "src/renderer/src/components/terminal-pane/terminal-pane-attention-subscriptions.test.ts": 64,
+      "src/renderer/src/components/terminal-pane/terminal-pane-close-identity.test.ts": 51,
+      "src/renderer/src/components/terminal-pane/terminal-pane-hook-order-parity.test.ts": 504,
+      "src/renderer/src/components/terminal-pane/terminal-pane-host-state-memo.test.ts": 1306,
+      "src/renderer/src/components/terminal-pane/terminal-pane-host-state.test.ts": 1222,
+      "src/renderer/src/components/terminal-pane/terminal-pane-listener-order-parity.test.ts": 491,
+      "src/renderer/src/components/terminal-pane/terminal-pane-recovery-unsettled-fallback.test.ts": 362,
+      "src/renderer/src/components/terminal-pane/terminal-pane-recovery.test.ts": 289,
+      "src/renderer/src/components/terminal-pane/terminal-pane-split-completion.test.ts": 38,
+      "src/renderer/src/components/terminal-pane/terminal-pane-split-request-routing.test.ts": 401,
+      "src/renderer/src/components/terminal-pane/terminal-pane-split-with-inherited-cwd.test.ts": 89,
+      "src/renderer/src/components/terminal-pane/terminal-pane-split-writer-paths.test.ts": 2320,
+      "src/renderer/src/components/terminal-pane/terminal-pane-store-subscription-budget.test.tsx": 5213,
+      "src/renderer/src/components/terminal-pane/terminal-pane-surface-ownership.test.ts": 254,
+      "src/renderer/src/components/terminal-pane/terminal-pane-tab-detach.test.ts": 119,
+      "src/renderer/src/components/terminal-pane/terminal-park-verdict-flip-telemetry.test.ts": 116,
+      "src/renderer/src/components/terminal-pane/terminal-park-verdict-worktree-driver-loop.test.tsx": 741,
+      "src/renderer/src/components/terminal-pane/terminal-parked-pane-candidates.test.ts": 1367,
+      "src/renderer/src/components/terminal-pane/terminal-parked-tab-eviction-exemption.test.ts": 298,
+      "src/renderer/src/components/terminal-pane/terminal-parked-tab-watchers-batch-sync.test.ts": 253,
+      "src/renderer/src/components/terminal-pane/terminal-parked-tab-watchers.test.ts": 1059,
+      "src/renderer/src/components/terminal-pane/terminal-parked-watcher-partial-reconciliation.test.ts": 262,
+      "src/renderer/src/components/terminal-pane/terminal-parked-watcher-reconciliation.test.ts": 161,
+      "src/renderer/src/components/terminal-pane/terminal-parked-watcher-registry.test.ts": 184,
+      "src/renderer/src/components/terminal-pane/terminal-parked-watcher-sleep-preserved-exit.test.ts": 189,
+      "src/renderer/src/components/terminal-pane/terminal-parked-watcher-sole-newborn-exit.test.ts": 316,
+      "src/renderer/src/components/terminal-pane/terminal-parking-e2e-overrides.test.ts": 2679,
+      "src/renderer/src/components/terminal-pane/terminal-parser-handler-guard.test.ts": 62,
+      "src/renderer/src/components/terminal-pane/terminal-paste-coordinator.test.ts": 105,
+      "src/renderer/src/components/terminal-pane/terminal-paste-executor-default-yield.test.ts": 52,
+      "src/renderer/src/components/terminal-pane/terminal-paste-multiline-policy.test.ts": 72,
+      "src/renderer/src/components/terminal-pane/terminal-paste-operation-order.test.ts": 1530,
+      "src/renderer/src/components/terminal-pane/terminal-paste-payload-metadata.test.ts": 45,
+      "src/renderer/src/components/terminal-pane/terminal-paste-runtime.test.ts": 39,
+      "src/renderer/src/components/terminal-pane/terminal-paste-target-state.test.ts": 52,
+      "src/renderer/src/components/terminal-pane/terminal-path-existence-batch.test.ts": 40,
+      "src/renderer/src/components/terminal-pane/terminal-process-exit-restart.test.ts": 49,
+      "src/renderer/src/components/terminal-pane/terminal-programmatic-text-paste.test.ts": 1734,
+      "src/renderer/src/components/terminal-pane/terminal-pty-ack-gate.test.ts": 335,
+      "src/renderer/src/components/terminal-pane/terminal-pty-paste-writer.test.ts": 28,
+      "src/renderer/src/components/terminal-pane/terminal-quick-command-dispatch.test.ts": 71,
+      "src/renderer/src/components/terminal-pane/terminal-remote-runtime-recovery-ui-state.test.ts": 42,
+      "src/renderer/src/components/terminal-pane/terminal-render-desync-evidence-persistence.test.ts": 67,
+      "src/renderer/src/components/terminal-pane/terminal-render-desync-frame.test.ts": 67,
+      "src/renderer/src/components/terminal-pane/terminal-render-desync-sentinel.test.ts": 430,
+      "src/renderer/src/components/terminal-pane/terminal-render-desync-weight-probe.test.ts": 52,
+      "src/renderer/src/components/terminal-pane/terminal-renderer-policy.test.ts": 115,
+      "src/renderer/src/components/terminal-pane/terminal-replay-application-continuity.test.ts": 363,
+      "src/renderer/src/components/terminal-pane/terminal-replay-cursor-state.test.ts": 117,
+      "src/renderer/src/components/terminal-pane/terminal-restore-sgr-latch.test.ts": 179,
+      "src/renderer/src/components/terminal-pane/terminal-restored-viewport.test.ts": 42,
+      "src/renderer/src/components/terminal-pane/terminal-retention-churn-pins.test.tsx": 569,
+      "src/renderer/src/components/terminal-pane/terminal-retention-exempt-growth.test.ts": 1509,
+      "src/renderer/src/components/terminal-pane/terminal-runtime-host-link-routing.test.ts": 2008,
+      "src/renderer/src/components/terminal-pane/terminal-selection-copy.test.ts": 980,
+      "src/renderer/src/components/terminal-pane/terminal-selection-fit-guard.test.ts": 37,
+      "src/renderer/src/components/terminal-pane/terminal-shortcut-ctrl-arrow.test.ts": 57,
+      "src/renderer/src/components/terminal-pane/terminal-shortcut-option-compose.test.ts": 120,
+      "src/renderer/src/components/terminal-pane/terminal-shortcut-policy.test.ts": 133,
+      "src/renderer/src/components/terminal-pane/terminal-shortcut-select-all.test.ts": 85,
+      "src/renderer/src/components/terminal-pane/terminal-shutdown-layout-capture.test.ts": 90,
+      "src/renderer/src/components/terminal-pane/terminal-side-effect-facts-handler.test.ts": 36,
+      "src/renderer/src/components/terminal-pane/terminal-snapshot-replay-paint.test.ts": 704,
+      "src/renderer/src/components/terminal-pane/terminal-startup-command-classifier.test.ts": 44,
+      "src/renderer/src/components/terminal-pane/terminal-startup-grid-settle.test.ts": 56,
+      "src/renderer/src/components/terminal-pane/terminal-startup-timing-scheduler.test.ts": 114,
+      "src/renderer/src/components/terminal-pane/terminal-startup-timing.test.ts": 62,
+      "src/renderer/src/components/terminal-pane/terminal-tab-agent-type-index.test.ts": 58,
+      "src/renderer/src/components/terminal-pane/terminal-tab-lookup.test.ts": 30,
+      "src/renderer/src/components/terminal-pane/terminal-title-evidence.test.ts": 84,
+      "src/renderer/src/components/terminal-pane/terminal-title-tracker-parity.test.ts": 263,
+      "src/renderer/src/components/terminal-pane/terminal-unified-tab-lookup.test.ts": 42,
+      "src/renderer/src/components/terminal-pane/terminal-url-link-click.test.ts": 1229,
+      "src/renderer/src/components/terminal-pane/terminal-url-link-hit-testing.test.ts": 1570,
+      "src/renderer/src/components/terminal-pane/terminal-user-input-signal.test.ts": 160,
+      "src/renderer/src/components/terminal-pane/terminal-view-attributes-publisher.test.ts": 274,
+      "src/renderer/src/components/terminal-pane/terminal-visibility-resume.test.ts": 1249,
+      "src/renderer/src/components/terminal-pane/terminal-webgl-atlas-recovery.test.ts": 41,
+      "src/renderer/src/components/terminal-pane/terminal-webgl-diagnostics-breadcrumbs.test.ts": 71,
+      "src/renderer/src/components/terminal-pane/terminal-windows-shift-enter.test.ts": 65,
+      "src/renderer/src/components/terminal-pane/terminal-worktree-path-link.test.ts": 1613,
+      "src/renderer/src/components/terminal-pane/title-agent-identity.test.ts": 35,
+      "src/renderer/src/components/terminal-pane/use-manual-terminal-worktree-parking.test.ts": 1809,
+      "src/renderer/src/components/terminal-pane/use-mobile-overlay-ticks.perf.test.tsx": 764,
+      "src/renderer/src/components/terminal-pane/use-notification-dispatch.test.ts": 291,
+      "src/renderer/src/components/terminal-pane/use-parked-terminal-watcher-synchronization.react185.test.tsx": 587,
+      "src/renderer/src/components/terminal-pane/use-system-prefers-dark.test.ts": 45,
+      "src/renderer/src/components/terminal-pane/use-terminal-pane-global-effects-active-pty-reporting.test.ts": 1301,
+      "src/renderer/src/components/terminal-pane/use-terminal-pane-global-effects-file-drop.test.ts": 1219,
+      "src/renderer/src/components/terminal-pane/use-terminal-pane-global-effects-paste-events.test.ts": 1149,
+      "src/renderer/src/components/terminal-pane/use-terminal-pane-global-effects-sync-fit-registration.test.ts": 1211,
+      "src/renderer/src/components/terminal-pane/use-terminal-pane-global-effects-visibility-resume.test.ts": 1904,
+      "src/renderer/src/components/terminal-pane/use-terminal-pane-global-effects-window-focus-recovery.test.ts": 1363,
+      "src/renderer/src/components/terminal-pane/use-terminal-pane-lifecycle.test.ts": 2216,
+      "src/renderer/src/components/terminal-pane/use-terminal-park-mount-intent.react185.test.tsx": 627,
+      "src/renderer/src/components/terminal-pane/use-terminal-scroll-visibility-memory.test.ts": 50,
+      "src/renderer/src/components/terminal-pane/use-terminal-tab-cold-parking.test.ts": 975,
+      "src/renderer/src/components/terminal-pane/use-terminal-window-wake-recovery.test.ts": 611,
+      "src/renderer/src/components/terminal-pane/use-visible-terminal-tab-claim.test.ts": 72,
+      "src/renderer/src/components/terminal-pane/useSessionRestoredBannerDismiss.test.tsx": 511,
+      "src/renderer/src/components/terminal-pane/useTerminalFontZoom.test.ts": 340,
+      "src/renderer/src/components/terminal-pane/wrapped-terminal-link-ranges.test.ts": 74,
+      "src/renderer/src/components/terminal-pane/xterm-bypass-policy-interrupt.test.ts": 77,
+      "src/renderer/src/components/terminal-pane/xterm-bypass-policy-ios.test.ts": 142,
+      "src/renderer/src/components/terminal-pane/xterm-bypass-policy-non-mac.test.ts": 52,
+      "src/renderer/src/components/terminal-pane/xterm-bypass-policy.test.ts": 62,
+      "src/renderer/src/components/terminal-pane/xterm-write-buffer-stall.repro.test.ts": 82,
+      "src/renderer/src/components/terminal-parked-watcher-sync-entries.test.tsx": 994,
+      "src/renderer/src/components/terminal-quick-commands/TerminalQuickCommandDialog.test.tsx": 1832,
+      "src/renderer/src/components/terminal-quick-commands/terminal-quick-command-agent-options.test.ts": 177,
+      "src/renderer/src/components/terminal-quick-commands/terminal-quick-command-dialog-draft.test.ts": 241,
+      "src/renderer/src/components/terminal-scrollback-decoration-eviction.test.ts": 1037,
+      "src/renderer/src/components/terminal-search-decoration-leak.test.ts": 2437,
+      "src/renderer/src/components/terminal-search-long-wrapped-line.test.ts": 5608,
+      "src/renderer/src/components/terminal-search-safe-find.test.ts": 51,
+      "src/renderer/src/components/terminal-workspace-keydown.test.ts": 822,
+      "src/renderer/src/components/terminal-workspace-surface-ids.test.tsx": 2751,
+      "src/renderer/src/components/terminal/activation-deferred-tab-admission.test.ts": 55,
+      "src/renderer/src/components/terminal/active-terminal-repair-loop.react185.test.tsx": 1990,
+      "src/renderer/src/components/terminal/active-terminal-repair.test.ts": 47,
+      "src/renderer/src/components/terminal/background-terminal-worktree-mount.test.ts": 1529,
+      "src/renderer/src/components/terminal/background-terminal-worktree-visibility.test.ts": 43,
+      "src/renderer/src/components/terminal/cold-activation-deferral-stranding.test.ts": 1885,
+      "src/renderer/src/components/terminal/initial-terminal-structured-launch.test.tsx": 556,
+      "src/renderer/src/components/terminal/initial-terminal-wiring.test.ts": 41,
+      "src/renderer/src/components/terminal/initial-terminal.test.ts": 48,
+      "src/renderer/src/components/terminal/pty-running-work-probe-child-evidence.test.ts": 33,
+      "src/renderer/src/components/terminal/running-terminal-close-guard.test.ts": 67,
+      "src/renderer/src/components/terminal/split-group-mount.test.ts": 30,
+      "src/renderer/src/components/terminal/tab-type-cycle.test.ts": 46,
+      "src/renderer/src/components/terminal/terminal-close-confirm-keyboard-vs-mouse.test.ts": 226,
+      "src/renderer/src/components/terminal/terminal-close-copy-kind.test.ts": 67,
+      "src/renderer/src/components/terminal/terminal-close-incarnation.test.ts": 70,
+      "src/renderer/src/components/terminal/terminal-provider-snapshot-bound-pty-ids.test.ts": 2039,
+      "src/renderer/src/components/terminal/terminal-provider-snapshot-capability-resettlement.test.ts": 1467,
+      "src/renderer/src/components/terminal/terminal-provider-snapshot-capability.test.ts": 65,
+      "src/renderer/src/components/terminal/terminal-tab-actions-kill-all.test.ts": 294,
+      "src/renderer/src/components/terminal/terminal-tab-actions-unified-close.test.ts": 1627,
+      "src/renderer/src/components/terminal/terminal-tab-actions.test.ts": 322,
+      "src/renderer/src/components/terminal/terminal-tab-close-running-confirm.test.ts": 178,
+      "src/renderer/src/components/terminal/unsaved-close-queue.test.ts": 49,
+      "src/renderer/src/components/terminal/use-terminal-provider-snapshot-capability.test.tsx": 750,
+      "src/renderer/src/components/terminal/use-worktree-files.test.tsx": 359,
+      "src/renderer/src/components/terminal/window-close-running-work.test.ts": 67,
+      "src/renderer/src/components/ui/color-picker.test.tsx": 537,
+      "src/renderer/src/components/ui/popover-wheel-scroll.test.tsx": 931,
+      "src/renderer/src/components/ui/repo-multi-combobox.test.ts": 461,
+      "src/renderer/src/components/ui/scroll-area.test.tsx": 420,
+      "src/renderer/src/components/ui/slider.test.tsx": 848,
+      "src/renderer/src/components/ui/switch.test.tsx": 180,
+      "src/renderer/src/components/unexpected-signout/unexpected-signout-card.test.tsx": 1887,
+      "src/renderer/src/components/unexpected-signout/unexpected-signout-visibility.test.ts": 59,
+      "src/renderer/src/components/use-github-task-search-commit.test.ts": 679,
+      "src/renderer/src/components/use-task-creation-draft-retention.test.ts": 550,
+      "src/renderer/src/components/use-task-page-jira-list-effects.test.ts": 2187,
+      "src/renderer/src/components/use-terminal-create-actions.test.tsx": 444,
+      "src/renderer/src/components/use-terminal-editor-close-foundation.window-close.test.tsx": 1796,
+      "src/renderer/src/components/use-terminal-window-lifecycle.lazy-ref.test.tsx": 381,
+      "src/renderer/src/components/use-worktree-jump-palette-browser-ownership.test.ts": 2178,
+      "src/renderer/src/components/virtualized-list.test.tsx": 788,
+      "src/renderer/src/components/window-close-request-coordinator.test.ts": 436,
+      "src/renderer/src/components/workspace-cleanup/WorkspaceCleanupDialog.mount-gating.test.tsx": 1869,
+      "src/renderer/src/components/workspace-cleanup/WorkspaceCleanupDialog.stale-while-revalidate.test.tsx": 2614,
+      "src/renderer/src/components/workspace-cleanup/use-workspace-cleanup-browse-state.test.tsx": 512,
+      "src/renderer/src/components/workspace-cleanup/use-workspace-cleanup-facet-rows.test.tsx": 758,
+      "src/renderer/src/components/workspace-cleanup/use-workspace-cleanup-git-evidence.test.tsx": 637,
+      "src/renderer/src/components/workspace-cleanup/use-workspace-cleanup-row-order.test.ts": 328,
+      "src/renderer/src/components/workspace-cleanup/workspace-cleanup-active-facets.test.ts": 92,
+      "src/renderer/src/components/workspace-cleanup/workspace-cleanup-background-removal-late-settlement.test.ts": 1640,
+      "src/renderer/src/components/workspace-cleanup/workspace-cleanup-background-removal-snapshot-batch.test.ts": 1286,
+      "src/renderer/src/components/workspace-cleanup/workspace-cleanup-background-removal.test.ts": 126,
+      "src/renderer/src/components/workspace-cleanup/workspace-cleanup-candidate-list.test.tsx": 2448,
+      "src/renderer/src/components/workspace-cleanup/workspace-cleanup-candidate-row-data.test.ts": 175,
+      "src/renderer/src/components/workspace-cleanup/workspace-cleanup-candidate-row.test.tsx": 2561,
+      "src/renderer/src/components/workspace-cleanup/workspace-cleanup-confirm-remove.test.tsx": 818,
+      "src/renderer/src/components/workspace-cleanup/workspace-cleanup-deletion-phases.test.ts": 103,
+      "src/renderer/src/components/workspace-cleanup/workspace-cleanup-dialog-notices.test.tsx": 972,
+      "src/renderer/src/components/workspace-cleanup/workspace-cleanup-facet-controls.test.tsx": 1353,
+      "src/renderer/src/components/workspace-cleanup/workspace-cleanup-facet-filter.test.ts": 115,
+      "src/renderer/src/components/workspace-cleanup/workspace-cleanup-facet-sort.test.ts": 68,
+      "src/renderer/src/components/workspace-cleanup/workspace-cleanup-filter-bar.test.tsx": 1202,
+      "src/renderer/src/components/workspace-cleanup/workspace-cleanup-flat-list.test.tsx": 2644,
+      "src/renderer/src/components/workspace-cleanup/workspace-cleanup-git-evidence.test.ts": 92,
+      "src/renderer/src/components/workspace-cleanup/workspace-cleanup-presentation.test.ts": 106,
+      "src/renderer/src/components/workspace-cleanup/workspace-cleanup-removal-candidates.test.ts": 116,
+      "src/renderer/src/components/workspace-cleanup/workspace-cleanup-removal-settlement.test.ts": 77,
+      "src/renderer/src/components/workspace-cleanup/workspace-cleanup-removal-timeout-recovery.test.ts": 1354,
+      "src/renderer/src/components/workspace-cleanup/workspace-cleanup-scanned-host-confirmation-removal.test.tsx": 1810,
+      "src/renderer/src/components/workspace-cleanup/workspace-cleanup-sort-header.test.tsx": 957,
+      "src/renderer/src/components/workspace-emoji/WorkspaceEmojiSuggestionPopover.test.tsx": 737,
+      "src/renderer/src/components/workspace-emoji/useWorkspaceEmojiShortcodeInput.test.tsx": 786,
+      "src/renderer/src/components/workspace-surface-projection.test.ts": 57,
+      "src/renderer/src/components/worktree-creation/WorktreeCreationPanel.test.tsx": 591,
+      "src/renderer/src/components/worktree-jump-palette-interleaved-sections.test.tsx": 5202,
+      "src/renderer/src/components/worktree-jump-palette-primitives.test.tsx": 836,
+      "src/renderer/src/components/worktree-jump-palette-quick-action-availability.test.tsx": 939,
+      "src/renderer/src/components/worktree-jump-palette-sleeping-filter.test.ts": 2023,
+      "src/renderer/src/components/worktree-jump-palette-source-context-boundary.test.ts": 52,
+      "src/renderer/src/components/worktree-jump-palette-status-inputs.test.ts": 62,
+      "src/renderer/src/hooks/agent-hook-completion-background-turn-notifications.test.ts": 334,
+      "src/renderer/src/hooks/agent-hook-completion-fresh-working.test.ts": 111,
+      "src/renderer/src/hooks/agent-hook-completion-grok-notifications.test.ts": 471,
+      "src/renderer/src/hooks/agent-hook-completion-notifications-import.test.ts": 148,
+      "src/renderer/src/hooks/agent-hook-completion-notifications.test.ts": 371,
+      "src/renderer/src/hooks/agent-hook-completion-store-sync.test.ts": 77,
+      "src/renderer/src/hooks/automation-agent-status-entry-change.test.ts": 45,
+      "src/renderer/src/hooks/automation-dispatch-unverifiable-loss.test.ts": 169,
+      "src/renderer/src/hooks/automations-changed-event-attribution.test.ts": 1405,
+      "src/renderer/src/hooks/composer-branch-selection.test.ts": 54,
+      "src/renderer/src/hooks/composer-drop-failure-toast.test.ts": 83,
+      "src/renderer/src/hooks/composer-drop-owner.test.ts": 32,
+      "src/renderer/src/hooks/composer-drop-result.test.ts": 33,
+      "src/renderer/src/hooks/composer-native-file-drop.test.ts": 57,
+      "src/renderer/src/hooks/composer-state/attachment-drop-failure.test.tsx": 668,
+      "src/renderer/src/hooks/composer-state/attachment-drop-lifetime.test.tsx": 1076,
+      "src/renderer/src/hooks/composer-state/branch-start-point-actions.test.ts": 560,
+      "src/renderer/src/hooks/composer-state/composer-drop-listener.test.ts": 663,
+      "src/renderer/src/hooks/composer-state/composer-name-source-selection.test.ts": 2276,
+      "src/renderer/src/hooks/composer-state/draft-target-sync.test.ts": 571,
+      "src/renderer/src/hooks/composer-state/full-creation-execution.test.ts": 1939,
+      "src/renderer/src/hooks/composer-state/full-creation-structured-launch.test.ts": 1517,
+      "src/renderer/src/hooks/composer-state/full-submit-orchestration.test.ts": 610,
+      "src/renderer/src/hooks/composer-state/multiple-create-reset.test.ts": 1387,
+      "src/renderer/src/hooks/composer-state/provider-runtime-sync.test.ts": 1981,
+      "src/renderer/src/hooks/composer-state/quick-creation-request.test.ts": 113,
+      "src/renderer/src/hooks/direct-ssh-host-hydration.test.ts": 113,
+      "src/renderer/src/hooks/direct-ssh-reconnect-coordinator.test.ts": 108,
+      "src/renderer/src/hooks/direct-ssh-reconnect-rollout.test.ts": 40,
+      "src/renderer/src/hooks/direct-ssh-reconnect-tokens.test.ts": 54,
+      "src/renderer/src/hooks/direct-ssh-runtime-wake-isolation.test.tsx": 1496,
+      "src/renderer/src/hooks/direct-ssh-state-routing.test.ts": 302,
+      "src/renderer/src/hooks/direct-ssh-worktree-refresh-scheduler.test.ts": 63,
+      "src/renderer/src/hooks/fork-push-warning.test.ts": 59,
+      "src/renderer/src/hooks/installed-agent-skill-discovery-cache.test.ts": 67,
+      "src/renderer/src/hooks/installed-agent-skill-discovery.test.ts": 70,
+      "src/renderer/src/hooks/installed-agent-skill-runtime-eviction.test.ts": 50,
+      "src/renderer/src/hooks/installed-agent-skill-verdict.test.ts": 927,
+      "src/renderer/src/hooks/ipc-events/agent-status-pane-routing-index.test.ts": 1777,
+      "src/renderer/src/hooks/ipc-events/agent-status-pending-retry-gate.test.ts": 339,
+      "src/renderer/src/hooks/ipc-events/agent-status-terminal-title-tab-write.test.ts": 1508,
+      "src/renderer/src/hooks/ipc-events/browser-automation-bootstrap-lease.test.ts": 461,
+      "src/renderer/src/hooks/ipc-events/browser-request-ipc-bridge.profile-switch.test.ts": 503,
+      "src/renderer/src/hooks/ipc-events/browser-state-capture-paint-hold.test.ts": 198,
+      "src/renderer/src/hooks/ipc-events/browser-state-open-link-profile.test.ts": 206,
+      "src/renderer/src/hooks/ipc-events/direct-ssh-connect-reply-routing.test.ts": 1662,
+      "src/renderer/src/hooks/ipc-events/direct-ssh-hydration-fanout.test.ts": 945,
+      "src/renderer/src/hooks/ipc-events/direct-ssh-hydration-target-metadata.test.ts": 1392,
+      "src/renderer/src/hooks/ipc-events/normalize-agent-status-event.test.ts": 30,
+      "src/renderer/src/hooks/ipc-events/orca-profile-auth-ipc-bridge.test.ts": 1618,
+      "src/renderer/src/hooks/ipc-events/os-markdown-file-open-bridge.test.ts": 207,
+      "src/renderer/src/hooks/ipc-events/runtime-client-ipc-bridge-ownership.test.ts": 1063,
+      "src/renderer/src/hooks/ipc-events/runtime-reconnect-host-status.test.ts": 1734,
+      "src/renderer/src/hooks/ipc-events/terminal-ui-routing-ipc-bridge-split.test.ts": 361,
+      "src/renderer/src/hooks/ipc-events/updater-status-ipc-bridge.test.ts": 57,
+      "src/renderer/src/hooks/ipc-tab-switch-group-order-hydration.test.ts": 69,
+      "src/renderer/src/hooks/ipc-tab-switch-structured-tab-cycle.test.ts": 57,
+      "src/renderer/src/hooks/ipc-tab-switch.test.ts": 98,
+      "src/renderer/src/hooks/legacy-worker-terminal-recovery-event.test.ts": 61,
+      "src/renderer/src/hooks/macos-tcc-prompt-notice-subscription.test.ts": 53,
+      "src/renderer/src/hooks/metadata-request-cache.test.ts": 179,
+      "src/renderer/src/hooks/mobile-terminal-reveal-tab-adoption.test.ts": 2329,
+      "src/renderer/src/hooks/modal-return-focus-action.test.ts": 27,
+      "src/renderer/src/hooks/programmatic-scroll-marks.test.ts": 46,
+      "src/renderer/src/hooks/remote-workspace-deferred-placement-retry.test.ts": 329,
+      "src/renderer/src/hooks/remote-workspace-session-merge-close-tombstones.test.ts": 102,
+      "src/renderer/src/hooks/remote-workspace-session-merge-closed-terminal-tombstone.test.ts": 1845,
+      "src/renderer/src/hooks/remote-workspace-session-merge-local-survival.test.ts": 94,
+      "src/renderer/src/hooks/remote-workspace-session-merge-parked-scrollback.test.ts": 159,
+      "src/renderer/src/hooks/remote-workspace-snapshot-apply-deferred-session-write.test.ts": 1341,
+      "src/renderer/src/hooks/remote-workspace-snapshot-arrival-coordinator.test.ts": 56,
+      "src/renderer/src/hooks/remote-workspace-snapshot-duplicate-tab-repair.test.ts": 1373,
+      "src/renderer/src/hooks/remote-workspace-snapshot-fresh-client-tab-seeding.test.ts": 1712,
+      "src/renderer/src/hooks/remote-workspace-snapshot-local-tab-survival.test.ts": 1572,
+      "src/renderer/src/hooks/remote-workspace-snapshot-unplaced-tab-adoption.test.ts": 1734,
+      "src/renderer/src/hooks/remote-workspace-target-sync.test.ts": 336,
+      "src/renderer/src/hooks/runtime-client-events-sync-ownership.test.ts": 78,
+      "src/renderer/src/hooks/runtime-client-events-sync.test.ts": 100,
+      "src/renderer/src/hooks/runtime-project-refresh-scheduler.test.ts": 93,
+      "src/renderer/src/hooks/shortcut-label-cache.test.tsx": 2047,
+      "src/renderer/src/hooks/ssh-reconnect-pane-retry.test.ts": 71,
+      "src/renderer/src/hooks/structured-session-completion-focus.test.ts": 1246,
+      "src/renderer/src/hooks/unpaired-device-auth-notification.test.ts": 49,
+      "src/renderer/src/hooks/use-audio-capture.capture-loss.test.ts": 393,
+      "src/renderer/src/hooks/use-clipboard-text-copy-feedback.test.ts": 420,
+      "src/renderer/src/hooks/use-now.test.ts": 318,
+      "src/renderer/src/hooks/use-palette-search-evaluation-context.test.ts": 586,
+      "src/renderer/src/hooks/use-task-page-github-work-item-mutation-host.test.ts": 1951,
+      "src/renderer/src/hooks/use-terminal-quick-command-hosts.test.ts": 675,
+      "src/renderer/src/hooks/use-window-stream-visibility.test.ts": 368,
+      "src/renderer/src/hooks/useActiveProjectSkillRuntime.test.tsx": 2208,
+      "src/renderer/src/hooks/useAgentDetectionTarget.test.ts": 1593,
+      "src/renderer/src/hooks/useAppMenuPaste.test.tsx": 525,
+      "src/renderer/src/hooks/useAppMenuSelectionActions.test.tsx": 561,
+      "src/renderer/src/hooks/useAutoAckViewedAgent.away.test.ts": 2063,
+      "src/renderer/src/hooks/useAutoAckViewedAgent.clock-skew.test.ts": 2020,
+      "src/renderer/src/hooks/useAutoAckViewedAgent.floating-panel.test.ts": 1984,
+      "src/renderer/src/hooks/useAutoAckViewedAgent.focus-group.test.ts": 1361,
+      "src/renderer/src/hooks/useAutoAckViewedAgent.mixed-workspace.test.ts": 1339,
+      "src/renderer/src/hooks/useAutoAckViewedAgent.test.ts": 1829,
+      "src/renderer/src/hooks/useAutomationDispatchEvents.test.ts": 716,
+      "src/renderer/src/hooks/useComposerState-decisions.test.ts": 2092,
+      "src/renderer/src/hooks/useComposerState-host-context-boundaries.test.ts": 7756,
+      "src/renderer/src/hooks/useComposerState-host-retarget.test.ts": 2531,
+      "src/renderer/src/hooks/useComposerState.integration.test.ts": 3242,
+      "src/renderer/src/hooks/useDetectedAgents.test.tsx": 1651,
+      "src/renderer/src/hooks/useEditorExternalWatch-complexity.test.ts": 5198,
+      "src/renderer/src/hooks/useEditorExternalWatch-self-move.test.ts": 533,
+      "src/renderer/src/hooks/useEditorExternalWatch-subscriptions.test.tsx": 404,
+      "src/renderer/src/hooks/useEditorExternalWatch-targets.test.ts": 324,
+      "src/renderer/src/hooks/useEditorExternalWatch-wsl-repro.test.ts": 307,
+      "src/renderer/src/hooks/useEditorExternalWatch.test.ts": 492,
+      "src/renderer/src/hooks/useEphemeralVmRecipeOptions.test.tsx": 420,
+      "src/renderer/src/hooks/useGitHubSlugMetadata.test.tsx": 556,
+      "src/renderer/src/hooks/useGlobalFileDrop.test.ts": 1582,
+      "src/renderer/src/hooks/useInstalledAgentSkills.react.test.tsx": 6914,
+      "src/renderer/src/hooks/useInstalledAgentSkills.test.ts": 1496,
+      "src/renderer/src/hooks/useIpcEvents-agent-dashboard-shortcut.test.ts": 50,
+      "src/renderer/src/hooks/useIpcEvents-agent-status-batch-projection.test.ts": 2975,
+      "src/renderer/src/hooks/useIpcEvents-agent-status-connection-attribution.test.ts": 2091,
+      "src/renderer/src/hooks/useIpcEvents-agent-status-hook-titles.test.ts": 3465,
+      "src/renderer/src/hooks/useIpcEvents-agent-status-pane-teardown.test.ts": 1791,
+      "src/renderer/src/hooks/useIpcEvents-agent-status-queue-ordering.test.ts": 1553,
+      "src/renderer/src/hooks/useIpcEvents-agent-status-snapshot-hydration.test.ts": 3794,
+      "src/renderer/src/hooks/useIpcEvents-agent-status-snapshot-replay.test.ts": 1645,
+      "src/renderer/src/hooks/useIpcEvents-agent-status-ssh-authority.test.ts": 2844,
+      "src/renderer/src/hooks/useIpcEvents-agent-status-turn-completion.test.ts": 1232,
+      "src/renderer/src/hooks/useIpcEvents-browser-certificate-failure.test.ts": 1339,
+      "src/renderer/src/hooks/useIpcEvents-browser-navigation.test.ts": 1691,
+      "src/renderer/src/hooks/useIpcEvents-browser-tab-create.test.ts": 1564,
+      "src/renderer/src/hooks/useIpcEvents-cli-worktree-activation.test.ts": 2045,
+      "src/renderer/src/hooks/useIpcEvents-client-hosted-browser-rows.test.ts": 2146,
+      "src/renderer/src/hooks/useIpcEvents-close-routing-active-browser-tab.test.ts": 2721,
+      "src/renderer/src/hooks/useIpcEvents-close-routing-browser-pages.test.ts": 3181,
+      "src/renderer/src/hooks/useIpcEvents-close-routing-floating-guest.test.ts": 1386,
+      "src/renderer/src/hooks/useIpcEvents-close-routing-session-tabs.test.ts": 3166,
+      "src/renderer/src/hooks/useIpcEvents-cmd-j-digit-chord.test.ts": 1969,
+      "src/renderer/src/hooks/useIpcEvents-lifecycle.test.ts": 1286,
+      "src/renderer/src/hooks/useIpcEvents-new-workspace-shortcut.test.ts": 63,
+      "src/renderer/src/hooks/useIpcEvents-rate-limit-hydration.test.ts": 1530,
+      "src/renderer/src/hooks/useIpcEvents-repos-changed-catalogs.test.ts": 1613,
+      "src/renderer/src/hooks/useIpcEvents-runtime-environment-selectors.test.ts": 344,
+      "src/renderer/src/hooks/useIpcEvents-session-tab-close-request.test.ts": 1973,
+      "src/renderer/src/hooks/useIpcEvents-silent-terminal-adoption.test.ts": 1127,
+      "src/renderer/src/hooks/useIpcEvents-ssh-disconnect-cleanup.test.ts": 1093,
+      "src/renderer/src/hooks/useIpcEvents-terminal-create-surfacing.test.ts": 2062,
+      "src/renderer/src/hooks/useIpcEvents-updater-status.test.ts": 1760,
+      "src/renderer/src/hooks/useIssueMetadata.test.tsx": 329,
+      "src/renderer/src/hooks/useLinearProviderConnected.test.tsx": 1480,
+      "src/renderer/src/hooks/useMacTccAttributionSeveredNotice.test.tsx": 2293,
+      "src/renderer/src/hooks/useMacosTccPromptNotice.test.tsx": 2393,
+      "src/renderer/src/hooks/useMetadataListRequest.test.tsx": 555,
+      "src/renderer/src/hooks/useModalReturnFocus.test.tsx": 1404,
+      "src/renderer/src/hooks/usePrimarySelectionPaste.terminal-native-paste.test.tsx": 342,
+      "src/renderer/src/hooks/usePrimarySelectionPaste.test.tsx": 582,
+      "src/renderer/src/hooks/useResetCountdownClock.test.ts": 380,
+      "src/renderer/src/hooks/useRetiredWorktreeNames.test.ts": 729,
+      "src/renderer/src/hooks/useSettingsNavigationMetadata.capability-owner.test.tsx": 1128,
+      "src/renderer/src/hooks/useSettingsNavigationMetadata.language-switch.test.tsx": 1648,
+      "src/renderer/src/hooks/useSettingsNavigationMetadata.test.ts": 1342,
+      "src/renderer/src/hooks/useSidebarResize.test.ts": 42,
+      "src/renderer/src/hooks/useSkillFreshness.test.tsx": 461,
+      "src/renderer/src/hooks/useUnreadDockBadge.test.ts": 2344,
+      "src/renderer/src/hooks/useVirtualizedScrollAnchor.listener-deps.test.ts": 71,
+      "src/renderer/src/hooks/useVirtualizedScrollAnchor.marks-restore-signal.test.ts": 56,
+      "src/renderer/src/hooks/useVirtualizedScrollAnchor.test.ts": 49,
+      "src/renderer/src/hooks/useWindowsTerminalCapabilityOwnerKey.test.tsx": 613,
+      "src/renderer/src/hooks/viewport-size-change-listener.test.ts": 46,
+      "src/renderer/src/hooks/worktree-change-refresh-queue.test.ts": 81,
+      "src/renderer/src/hooks/worktree-head-identity-apply.test.ts": 41,
+      "src/renderer/src/hooks/zoom-routing.test.ts": 195,
+      "src/renderer/src/i18n/I18nProvider.test.tsx": 2173,
+      "src/renderer/src/i18n/integration-card-status-localization.test.ts": 257,
+      "src/renderer/src/i18n/intl-locale.test.ts": 135,
+      "src/renderer/src/i18n/ja-technical-literal-mistranslations.test.ts": 158,
+      "src/renderer/src/i18n/ko-ui-semantic-mistranslations.test.ts": 214,
+      "src/renderer/src/i18n/lazy-locale.test.ts": 299,
+      "src/renderer/src/i18n/locale-english-regression.test.ts": 1231,
+      "src/renderer/src/i18n/native-chat-locales.test.ts": 461,
+      "src/renderer/src/i18n/no-top-level-translate.test.ts": 3326,
+      "src/renderer/src/i18n/plugin-chrome-allowlist.test.ts": 170,
+      "src/renderer/src/i18n/pseudo-localization.test.ts": 89,
+      "src/renderer/src/i18n/relative-duration-copy-localization.test.ts": 810,
+      "src/renderer/src/i18n/relative-time-format.test.ts": 112,
+      "src/renderer/src/i18n/runtime-required-catalog.test.ts": 544,
+      "src/renderer/src/i18n/settings-status-label-localization.test.ts": 1029,
+      "src/renderer/src/i18n/smart-workspace-jira-locales.test.ts": 598,
+      "src/renderer/src/i18n/technical-literal-catalog-values.test.ts": 829,
+      "src/renderer/src/i18n/weekday-names.test.ts": 94,
+      "src/renderer/src/i18n/worktree-visibility-locales.test.ts": 120,
+      "src/renderer/src/i18n/zh-technical-literal-mistranslations.test.ts": 317,
+      "src/renderer/src/lazy-modal-mount-state.test.ts": 37,
+      "src/renderer/src/lazy-use-ref-ratchet.test.ts": 260,
+      "src/renderer/src/lib/activate-ai-vault-structured-session-reveal.test.ts": 1763,
+      "src/renderer/src/lib/activate-ai-vault-structured-session.test.ts": 1827,
+      "src/renderer/src/lib/activate-tab-and-focus-pane.test.ts": 34,
+      "src/renderer/src/lib/active-agent-note-send-explicit-target.test.ts": 818,
+      "src/renderer/src/lib/active-agent-note-send-focused-session.test.ts": 297,
+      "src/renderer/src/lib/active-agent-note-send-runtime-error-codes.test.ts": 61,
+      "src/renderer/src/lib/active-agent-note-send-target-detection.test.ts": 339,
+      "src/renderer/src/lib/active-view-persist.test.ts": 42,
+      "src/renderer/src/lib/activity-thread-display.test.ts": 84,
+      "src/renderer/src/lib/agent-background-session-launch-host.test.ts": 980,
+      "src/renderer/src/lib/agent-catalog-links.test.ts": 113,
+      "src/renderer/src/lib/agent-draft-readiness.test.ts": 79,
+      "src/renderer/src/lib/agent-followup-delivery.test.ts": 18686,
+      "src/renderer/src/lib/agent-hibernation-confirmation.test.ts": 35,
+      "src/renderer/src/lib/agent-hibernation-coordinator.test.ts": 1424,
+      "src/renderer/src/lib/agent-hibernation-output-activity.test.ts": 53,
+      "src/renderer/src/lib/agent-hibernation-pane-age.test.ts": 43,
+      "src/renderer/src/lib/agent-hibernation-planner.test.ts": 154,
+      "src/renderer/src/lib/agent-hibernation-runtime-liveness-race.test.ts": 1670,
+      "src/renderer/src/lib/agent-hibernation-visibility.test.ts": 1583,
+      "src/renderer/src/lib/agent-launch-caller-permissions.test.ts": 1042,
+      "src/renderer/src/lib/agent-launch-caller-placement.test.ts": 615,
+      "src/renderer/src/lib/agent-launch-caller-profile-census.test.ts": 625,
+      "src/renderer/src/lib/agent-launch-caller-prompt-transport.test.ts": 735,
+      "src/renderer/src/lib/agent-launch-caller-routing.test.ts": 667,
+      "src/renderer/src/lib/agent-launch-prompt-delivery.test.ts": 72,
+      "src/renderer/src/lib/agent-launch-route-connection-fallback.test.ts": 1361,
+      "src/renderer/src/lib/agent-launch-route-input.test.ts": 200,
+      "src/renderer/src/lib/agent-launch-routing-caller-census.test.ts": 1308,
+      "src/renderer/src/lib/agent-launch-routing.test.ts": 64,
+      "src/renderer/src/lib/agent-paste-draft-readiness-budget.test.ts": 177,
+      "src/renderer/src/lib/agent-paste-draft-submit-retry.test.ts": 188,
+      "src/renderer/src/lib/agent-paste-draft.test.ts": 610,
+      "src/renderer/src/lib/agent-picker-search.test.ts": 180,
+      "src/renderer/src/lib/agent-ready-wait.test.ts": 68,
+      "src/renderer/src/lib/agent-resume-launch-target.test.ts": 2569,
+      "src/renderer/src/lib/agent-row-primary-text.test.ts": 65,
+      "src/renderer/src/lib/agent-row-tool-preview.test.ts": 61,
+      "src/renderer/src/lib/agent-send-title-status.test.ts": 70,
+      "src/renderer/src/lib/agent-session-fork-context.test.ts": 49,
+      "src/renderer/src/lib/agent-session-launch-plan.test.ts": 46,
+      "src/renderer/src/lib/agent-skill-cli-prerequisite.test.ts": 135,
+      "src/renderer/src/lib/agent-skill-nav-install-status.test.ts": 1277,
+      "src/renderer/src/lib/agent-startup-delayed-delivery-perf.test.ts": 1657,
+      "src/renderer/src/lib/agent-status-connection-ownership.test.ts": 53,
+      "src/renderer/src/lib/agent-status-count.test.ts": 86,
+      "src/renderer/src/lib/agent-status-epoch-clock.test.ts": 54,
+      "src/renderer/src/lib/agent-status-evidence-clock.test.ts": 68,
+      "src/renderer/src/lib/agent-status-terminal-title.test.ts": 92,
+      "src/renderer/src/lib/agent-status-worktree-attribution.test.ts": 43,
+      "src/renderer/src/lib/agent-status.test.ts": 1192,
+      "src/renderer/src/lib/agent-tab-shortcuts.test.ts": 77,
+      "src/renderer/src/lib/agent-trust-preflight.test.ts": 71,
+      "src/renderer/src/lib/ai-vault-omp-cold-resume.test.ts": 1575,
+      "src/renderer/src/lib/ai-vault-resume-command.drop-repin.test.ts": 226,
+      "src/renderer/src/lib/ai-vault-resume-command.resumable-agent.test.ts": 231,
+      "src/renderer/src/lib/ai-vault-resume-command.test.ts": 229,
+      "src/renderer/src/lib/ai-vault-resume-shell.test.ts": 214,
+      "src/renderer/src/lib/ai-vault-resume-target.test.ts": 59,
+      "src/renderer/src/lib/ai-vault-session-drag.test.ts": 58,
+      "src/renderer/src/lib/ai-vault-session-resume-preparation.test.ts": 58,
+      "src/renderer/src/lib/ai-vault-tab-title-sync-inputs.test.ts": 246,
+      "src/renderer/src/lib/ai-vault-tab-title-sync.test.ts": 763,
+      "src/renderer/src/lib/app-command-dispatch.test.ts": 53,
+      "src/renderer/src/lib/app-font-family.test.ts": 151,
+      "src/renderer/src/lib/app-menu-paste.test.ts": 494,
+      "src/renderer/src/lib/app-menu-selection-actions.test.ts": 465,
+      "src/renderer/src/lib/automation-session-observer.test.ts": 120,
+      "src/renderer/src/lib/automation-session-reuse.test.ts": 59,
+      "src/renderer/src/lib/automation-terminal-ownership.test.ts": 1270,
+      "src/renderer/src/lib/browser-cookie-import-toast.test.ts": 143,
+      "src/renderer/src/lib/browser-history-match.performance.test.ts": 185,
+      "src/renderer/src/lib/browser-history-match.test.ts": 175,
+      "src/renderer/src/lib/browser-page-conversion-history.test.ts": 64,
+      "src/renderer/src/lib/browser-page-palette-activation.test.ts": 1954,
+      "src/renderer/src/lib/browser-palette-page-entries.test.ts": 341,
+      "src/renderer/src/lib/browser-palette-search.test.ts": 193,
+      "src/renderer/src/lib/browser-uuid.test.ts": 48,
+      "src/renderer/src/lib/browser-workspace-tab-activation.test.ts": 2061,
+      "src/renderer/src/lib/client-creation-action-policy.test.ts": 199,
+      "src/renderer/src/lib/cmd-j-github-url-lookup.test.ts": 27,
+      "src/renderer/src/lib/cmd-j-host-qualified-candidate-ownership.test.ts": 231,
+      "src/renderer/src/lib/cmd-j-linear-issue-intent.test.ts": 38,
+      "src/renderer/src/lib/cmd-j-section-leadership.test.ts": 51,
+      "src/renderer/src/lib/codex-account-display-label.test.ts": 48,
+      "src/renderer/src/lib/codex-pane-restart-eligibility.test.ts": 82,
+      "src/renderer/src/lib/codex-pane-selection-lane.test.ts": 249,
+      "src/renderer/src/lib/codex-session-restart-route-recheck.test.ts": 1547,
+      "src/renderer/src/lib/codex-session-restart-shell-flap.test.ts": 1603,
+      "src/renderer/src/lib/codex-session-restart.test.ts": 6689,
+      "src/renderer/src/lib/codex-stale-pane-account-identity.test.ts": 1587,
+      "src/renderer/src/lib/codex-stale-pane-sweep.test.ts": 1143,
+      "src/renderer/src/lib/comment-body-line-count.test.ts": 78,
+      "src/renderer/src/lib/comment-body-submit-state.test.ts": 77,
+      "src/renderer/src/lib/composer-issue-command.test.ts": 1677,
+      "src/renderer/src/lib/composer-submit-cancellation.test.ts": 36,
+      "src/renderer/src/lib/connection-context.test.ts": 978,
+      "src/renderer/src/lib/crash-diagnostics.test.ts": 117,
+      "src/renderer/src/lib/create-untitled-markdown.test.ts": 332,
+      "src/renderer/src/lib/default-terminal-tabs-applied-persist.test.ts": 1574,
+      "src/renderer/src/lib/desktop-window-chrome.test.ts": 44,
+      "src/renderer/src/lib/diff-comment-compat.test.ts": 44,
+      "src/renderer/src/lib/diff-comments-format.test.ts": 64,
+      "src/renderer/src/lib/direct-ssh-reconnect-product-telemetry.test.ts": 33,
+      "src/renderer/src/lib/direct-ssh-target-scope.test.ts": 38,
+      "src/renderer/src/lib/doc-preview-grants.test.ts": 338,
+      "src/renderer/src/lib/document-theme.test.ts": 53,
+      "src/renderer/src/lib/editable-target.test.ts": 436,
+      "src/renderer/src/lib/editor-file-operation-owner.test.ts": 1407,
+      "src/renderer/src/lib/editor-font-zoom.test.ts": 67,
+      "src/renderer/src/lib/ensure-hooks-confirmed.test.ts": 508,
+      "src/renderer/src/lib/ensure-simulator-tab-behavior.test.ts": 287,
+      "src/renderer/src/lib/ensure-simulator-tab.test.ts": 32,
+      "src/renderer/src/lib/ephemeral-vm-failed-create-cleanup.test.ts": 29,
+      "src/renderer/src/lib/ephemeral-vm-runtime-cleanup.test.ts": 72,
+      "src/renderer/src/lib/ephemeral-vm-workspace-target.integration.test.ts": 238,
+      "src/renderer/src/lib/ephemeral-vm-workspace-target.test.ts": 241,
+      "src/renderer/src/lib/ephemeral-vm-worktree-creation.test.ts": 68,
+      "src/renderer/src/lib/execute-open-editor-path-move.test.ts": 1470,
+      "src/renderer/src/lib/external-editor-open-capability.test.ts": 40,
+      "src/renderer/src/lib/feature-education-telemetry.test.ts": 65,
+      "src/renderer/src/lib/feedback-image-attachments.test.ts": 598,
+      "src/renderer/src/lib/file-preview-action-visibility.test.tsx": 516,
+      "src/renderer/src/lib/file-preview.test.ts": 321,
+      "src/renderer/src/lib/file-search-result-owner.test.ts": 66,
+      "src/renderer/src/lib/file-search-selection.test.ts": 41,
+      "src/renderer/src/lib/file-type-icons.test.ts": 130,
+      "src/renderer/src/lib/find-query-bounds.test.ts": 29,
+      "src/renderer/src/lib/finished-agent-resume-resurrection.test.ts": 1379,
+      "src/renderer/src/lib/fix-checks-agent-launch.test.ts": 325,
+      "src/renderer/src/lib/flatten-retained-slice.test.ts": 163,
+      "src/renderer/src/lib/floating-terminal.test.ts": 43,
+      "src/renderer/src/lib/floating-workspace-terminal-actions.test.ts": 235,
+      "src/renderer/src/lib/floating-workspace-tour-interaction-snapshot.test.ts": 33,
+      "src/renderer/src/lib/focus-terminal-tab-surface.test.ts": 81,
+      "src/renderer/src/lib/folder-workspace-path-status.test.ts": 76,
+      "src/renderer/src/lib/foreground-terminal-tabs.test.ts": 57,
+      "src/renderer/src/lib/github-links.test.ts": 69,
+      "src/renderer/src/lib/github-pr-start-point.test.ts": 78,
+      "src/renderer/src/lib/github-source-runtime-context.test.ts": 63,
+      "src/renderer/src/lib/github-work-item-source-lookup.test.ts": 97,
+      "src/renderer/src/lib/github-work-item-workspace-attachment.test.ts": 31,
+      "src/renderer/src/lib/gitlab-links.test.ts": 71,
+      "src/renderer/src/lib/gitlab-work-item-source-lookup.test.ts": 84,
+      "src/renderer/src/lib/hook-command-delayed-delivery-perf.test.ts": 1720,
+      "src/renderer/src/lib/hook-command-delayed-delivery.test.ts": 1168,
+      "src/renderer/src/lib/host-mirror-handle-gap-drain.test.ts": 1659,
+      "src/renderer/src/lib/host-mirror-handle-gap-landed-handle.test.ts": 1250,
+      "src/renderer/src/lib/host-mirror-handle-gap-resume.test.ts": 4216,
+      "src/renderer/src/lib/host-mirror-handle-gap-subscription-lifetime.test.ts": 1642,
+      "src/renderer/src/lib/host-mirror-handle-gap-teardown.test.ts": 1351,
+      "src/renderer/src/lib/host-mirror-handle-gap-verdict-union.test.ts": 1927,
+      "src/renderer/src/lib/host-mirrored-pane-resume-replay.test.ts": 1687,
+      "src/renderer/src/lib/http-link-destinations.test.ts": 207,
+      "src/renderer/src/lib/http-link-modifier-routing.test.ts": 196,
+      "src/renderer/src/lib/http-link-routing.test.ts": 206,
+      "src/renderer/src/lib/i18n-jsx-spacing-guard.test.ts": 57,
+      "src/renderer/src/lib/ime-composition-keyboard-event.test.ts": 477,
+      "src/renderer/src/lib/ios-web-platform.test.ts": 45,
+      "src/renderer/src/lib/ipc-error.test.ts": 50,
+      "src/renderer/src/lib/jira-source-host.test.ts": 30,
+      "src/renderer/src/lib/keyboard-layout/detect-option-as-alt.test.ts": 62,
+      "src/renderer/src/lib/keyboard-layout/input-source-id.test.ts": 50,
+      "src/renderer/src/lib/keyboard-layout/layout-base-character.test.ts": 36,
+      "src/renderer/src/lib/keyboard-layout/option-as-alt-probe.test.ts": 87,
+      "src/renderer/src/lib/keyboard-layout/option-key-location-state.test.ts": 44,
+      "src/renderer/src/lib/language-detect.test.ts": 84,
+      "src/renderer/src/lib/large-text-control-paste.test.ts": 482,
+      "src/renderer/src/lib/launch-agent-background-session-remote.test.ts": 522,
+      "src/renderer/src/lib/launch-agent-background-session.test.ts": 367,
+      "src/renderer/src/lib/launch-agent-in-new-tab-cwd.test.ts": 596,
+      "src/renderer/src/lib/launch-agent-in-new-tab-host-resolution.test.ts": 777,
+      "src/renderer/src/lib/launch-agent-in-new-tab-main-surface.test.ts": 1850,
+      "src/renderer/src/lib/launch-agent-in-new-tab-placement.test.ts": 568,
+      "src/renderer/src/lib/launch-agent-in-new-tab-structured.test.ts": 1042,
+      "src/renderer/src/lib/launch-agent-in-new-tab-web-runtime.test.ts": 477,
+      "src/renderer/src/lib/launch-agent-in-new-tab-windows-quoting.test.ts": 719,
+      "src/renderer/src/lib/launch-agent-in-new-tab.test.ts": 1384,
+      "src/renderer/src/lib/launch-agent-session-continuation.test.ts": 93,
+      "src/renderer/src/lib/launch-agent-structured-chat-guard.test.ts": 1070,
+      "src/renderer/src/lib/launch-ai-vault-session.test.ts": 77,
+      "src/renderer/src/lib/launch-structured-agent-session.test.ts": 1925,
+      "src/renderer/src/lib/launch-work-item-direct-agent-routing.test.ts": 1859,
+      "src/renderer/src/lib/launch-work-item-direct-agent.test.ts": 102,
+      "src/renderer/src/lib/launch-work-item-direct-messages.test.ts": 67,
+      "src/renderer/src/lib/launch-work-item-direct.test.ts": 760,
+      "src/renderer/src/lib/launch-worktree-background-terminals.test.ts": 529,
+      "src/renderer/src/lib/lazy-chunk-recovery-reload.test.ts": 327,
+      "src/renderer/src/lib/lazy-with-retry.never-landed-reload.test.ts": 487,
+      "src/renderer/src/lib/lazy-with-retry.right-sidebar-syntax-error.test.ts": 400,
+      "src/renderer/src/lib/lazy-with-retry.test.ts": 342,
+      "src/renderer/src/lib/left-sidebar-appearance.test.ts": 135,
+      "src/renderer/src/lib/linear-agent-skill-update-command.test.ts": 949,
+      "src/renderer/src/lib/linear-board-drag-payload.test.ts": 64,
+      "src/renderer/src/lib/linear-issue-context-snapshot.test.ts": 95,
+      "src/renderer/src/lib/linear-issue-url-lookup.test.ts": 54,
+      "src/renderer/src/lib/linear-issue-workspace-attachment.test.ts": 34,
+      "src/renderer/src/lib/linear-issue-workspace-open.test.ts": 73,
+      "src/renderer/src/lib/linear-linked-work-item.test.ts": 58,
+      "src/renderer/src/lib/linked-work-item-context.test.ts": 1261,
+      "src/renderer/src/lib/linked-work-item-provider.test.ts": 1731,
+      "src/renderer/src/lib/list-row-interaction.test.ts": 249,
+      "src/renderer/src/lib/local-path-open-guard.test.ts": 96,
+      "src/renderer/src/lib/local-preflight-context-cache.test.ts": 204,
+      "src/renderer/src/lib/local-preflight-context.test.ts": 270,
+      "src/renderer/src/lib/locale-text-collators.test.ts": 108,
+      "src/renderer/src/lib/manual-terminal-worktree-parking.test.ts": 510,
+      "src/renderer/src/lib/markdown-comment-blocks.test.ts": 34,
+      "src/renderer/src/lib/markdown-document-templates.test.ts": 227,
+      "src/renderer/src/lib/markdown-review-note-copy.test.ts": 45,
+      "src/renderer/src/lib/markdown-review-notes.test.ts": 47,
+      "src/renderer/src/lib/migration-unsupported-agent-entry.test.ts": 44,
+      "src/renderer/src/lib/mobile-terminal-tab-mount.test.ts": 41,
+      "src/renderer/src/lib/monaco-delayer-cancellation-guard.test.ts": 182,
+      "src/renderer/src/lib/monaco-diff-editor-disposal.test.ts": 50,
+      "src/renderer/src/lib/monaco-languages/monarch-embed-entry-recursion.test.ts": 750,
+      "src/renderer/src/lib/monaco-languages/monarch-upstream-mdx-recursion.test.ts": 5097,
+      "src/renderer/src/lib/monaco-languages/register-astro.test.ts": 129,
+      "src/renderer/src/lib/monaco-languages/register-jsonl.test.ts": 248,
+      "src/renderer/src/lib/monaco-languages/register-nim.test.ts": 78,
+      "src/renderer/src/lib/monaco-languages/register-shell-markdown-aliases.test.ts": 42,
+      "src/renderer/src/lib/monaco-languages/register-svelte.test.ts": 285,
+      "src/renderer/src/lib/monaco-languages/register-vue.test.ts": 442,
+      "src/renderer/src/lib/monaco-languages/textmate-language-registration.test.ts": 64,
+      "src/renderer/src/lib/monaco-languages/textmate-token-provider.test.ts": 232,
+      "src/renderer/src/lib/monaco-peek-preview-options.test.ts": 988,
+      "src/renderer/src/lib/monaco-setup-steps.test.ts": 28,
+      "src/renderer/src/lib/monospace-font-family.test.ts": 53,
+      "src/renderer/src/lib/mouse-shortcut-dispatch.test.ts": 366,
+      "src/renderer/src/lib/native-chat-initial-view-mode.test.ts": 51,
+      "src/renderer/src/lib/native-chat-launch-draft-mirrorability.test.ts": 226,
+      "src/renderer/src/lib/native-chat-transcript-readability.test.ts": 49,
+      "src/renderer/src/lib/nested-repo-selected-paths.test.ts": 45,
+      "src/renderer/src/lib/new-workspace-composer-repo.test.ts": 38,
+      "src/renderer/src/lib/new-workspace-create-gates.test.ts": 43,
+      "src/renderer/src/lib/new-workspace-enter-guard.test.ts": 52,
+      "src/renderer/src/lib/new-workspace-project-options.test.ts": 72,
+      "src/renderer/src/lib/new-workspace-ssh-gate.test.ts": 72,
+      "src/renderer/src/lib/new-workspace.test.ts": 4497,
+      "src/renderer/src/lib/non-secure-context-crypto.repro.test.ts": 1038,
+      "src/renderer/src/lib/notes-send-agent-targets.test.ts": 155,
+      "src/renderer/src/lib/onboarding-project-checklist.test.ts": 114,
+      "src/renderer/src/lib/open-markdown-in-floating-workspace.test.ts": 138,
+      "src/renderer/src/lib/open-mobile-emulator-tab.test.ts": 297,
+      "src/renderer/src/lib/open-tab-occupant-agent.test.ts": 102,
+      "src/renderer/src/lib/orca-hook-trust.test.ts": 59,
+      "src/renderer/src/lib/orca-yaml-trust-prompt-slot-eviction.test.ts": 597,
+      "src/renderer/src/lib/orchestration-setup-state.test.ts": 61,
+      "src/renderer/src/lib/orchestration-skill-coverage.test.ts": 80,
+      "src/renderer/src/lib/order-empty-query-worktrees.test.ts": 38,
+      "src/renderer/src/lib/outside-dismiss-guard.test.ts": 61,
+      "src/renderer/src/lib/palette-match/cmd-j-ranking-contract.test.ts": 114,
+      "src/renderer/src/lib/palette-match/match-field-allocation.test.ts": 127,
+      "src/renderer/src/lib/palette-match/palette-match-core.test.ts": 115,
+      "src/renderer/src/lib/palette-match/palette-match-performance.test.ts": 10210,
+      "src/renderer/src/lib/palette-match/palette-phrase-placement.test.ts": 65,
+      "src/renderer/src/lib/palette-match/palette-ranking.test.ts": 39,
+      "src/renderer/src/lib/palette-repo-resolution.test.ts": 40,
+      "src/renderer/src/lib/palette-type-alias-match.test.ts": 29,
+      "src/renderer/src/lib/pane-agent-evidence.test.ts": 74,
+      "src/renderer/src/lib/pane-manager/browser-mobile-driver-state.test.ts": 64,
+      "src/renderer/src/lib/pane-manager/browser-remote-viewer-state.test.ts": 41,
+      "src/renderer/src/lib/pane-manager/client-hosted-browser-row-ephemerality.test.ts": 1735,
+      "src/renderer/src/lib/pane-manager/client-hosted-browser-row-state.test.ts": 69,
+      "src/renderer/src/lib/pane-manager/focus-follows-mouse.test.ts": 40,
+      "src/renderer/src/lib/pane-manager/mobile-driver-state.test.ts": 56,
+      "src/renderer/src/lib/pane-manager/mobile-fit-overrides-hydration.test.ts": 56,
+      "src/renderer/src/lib/pane-manager/mobile-fit-overrides.test.ts": 62,
+      "src/renderer/src/lib/pane-manager/pane-container-listener-lifecycle.test.ts": 230,
+      "src/renderer/src/lib/pane-manager/pane-cursor-blink-suspension.test.ts": 1047,
+      "src/renderer/src/lib/pane-manager/pane-divider-capture-loss.test.ts": 45,
+      "src/renderer/src/lib/pane-manager/pane-divider-stray-touch.test.ts": 60,
+      "src/renderer/src/lib/pane-manager/pane-divider.test.ts": 74,
+      "src/renderer/src/lib/pane-manager/pane-dom-creation.test.ts": 485,
+      "src/renderer/src/lib/pane-manager/pane-drag-reorder.test.ts": 81,
+      "src/renderer/src/lib/pane-manager/pane-drop-no-op.test.ts": 237,
+      "src/renderer/src/lib/pane-manager/pane-fit-resize-observer.test.ts": 79,
+      "src/renderer/src/lib/pane-manager/pane-fit.test.ts": 145,
+      "src/renderer/src/lib/pane-manager/pane-initial-fit-lifecycle.test.ts": 245,
+      "src/renderer/src/lib/pane-manager/pane-inline-image-recovery.test.ts": 67,
+      "src/renderer/src/lib/pane-manager/pane-inline-images.test.ts": 102,
+      "src/renderer/src/lib/pane-manager/pane-key-resolution.test.ts": 42,
+      "src/renderer/src/lib/pane-manager/pane-lifecycle.test.ts": 435,
+      "src/renderer/src/lib/pane-manager/pane-manager-registry.test.ts": 41,
+      "src/renderer/src/lib/pane-manager/pane-metric-options-deferral.test.ts": 60,
+      "src/renderer/src/lib/pane-manager/pane-overlay-focus.test.ts": 722,
+      "src/renderer/src/lib/pane-manager/pane-pointer-focus.test.ts": 45,
+      "src/renderer/src/lib/pane-manager/pane-pty-resize-hold.test.ts": 53,
+      "src/renderer/src/lib/pane-manager/pane-reveal-fit.test.ts": 64,
+      "src/renderer/src/lib/pane-manager/pane-reveal-repaint.test.ts": 394,
+      "src/renderer/src/lib/pane-manager/pane-scroll.test.ts": 118,
+      "src/renderer/src/lib/pane-manager/pane-split-close.test.ts": 65,
+      "src/renderer/src/lib/pane-manager/pane-split-scroll.test.ts": 62,
+      "src/renderer/src/lib/pane-manager/pane-terminal-foreground-render-settle.test.ts": 57,
+      "src/renderer/src/lib/pane-manager/pane-terminal-gpu-acceleration.test.ts": 107,
+      "src/renderer/src/lib/pane-manager/pane-terminal-mouse-wheel.test.ts": 65,
+      "src/renderer/src/lib/pane-manager/pane-terminal-output-queue-chunks.test.ts": 47,
+      "src/renderer/src/lib/pane-manager/pane-terminal-output-scheduler-ack-credit.test.ts": 95,
+      "src/renderer/src/lib/pane-manager/pane-terminal-output-scheduler-backlog-cap.test.ts": 118,
+      "src/renderer/src/lib/pane-manager/pane-terminal-output-scheduler-disposed-writes.test.ts": 79,
+      "src/renderer/src/lib/pane-manager/pane-terminal-output-scheduler-foreground-refresh.test.ts": 160,
+      "src/renderer/src/lib/pane-manager/pane-terminal-output-scheduler-queue-retention.test.ts": 266,
+      "src/renderer/src/lib/pane-manager/pane-terminal-output-scheduler-synchronized-frames.test.ts": 178,
+      "src/renderer/src/lib/pane-manager/pane-terminal-output-scheduler-throughput.bench.test.ts": 312,
+      "src/renderer/src/lib/pane-manager/pane-terminal-output-scheduler.test.ts": 181,
+      "src/renderer/src/lib/pane-manager/pane-tree-equalization-parity.test.ts": 1669,
+      "src/renderer/src/lib/pane-manager/pane-tree-equalization-scaling.test.ts": 411,
+      "src/renderer/src/lib/pane-manager/pane-tree-ops.test.ts": 140,
+      "src/renderer/src/lib/pane-manager/pane-tree-reparent-frame.test.ts": 53,
+      "src/renderer/src/lib/pane-manager/pane-webgl-context-recovery.test.ts": 173,
+      "src/renderer/src/lib/pane-manager/pane-webgl-refresh-lifecycle.test.ts": 382,
+      "src/renderer/src/lib/pane-manager/pane-webgl-renderer.test.ts": 423,
+      "src/renderer/src/lib/pane-manager/terminal-arabic-shaping-joiner.test.ts": 48,
+      "src/renderer/src/lib/pane-manager/terminal-canvas-dpr-repair.test.ts": 62,
+      "src/renderer/src/lib/pane-manager/terminal-complex-script.test.ts": 52,
+      "src/renderer/src/lib/pane-manager/terminal-delivery-credit.test.ts": 40,
+      "src/renderer/src/lib/pane-manager/terminal-foreground-repair-convergence.test.ts": 187,
+      "src/renderer/src/lib/pane-manager/terminal-ime-anchor.test.ts": 39,
+      "src/renderer/src/lib/pane-manager/terminal-ime-candidate-anchor.test.ts": 487,
+      "src/renderer/src/lib/pane-manager/terminal-keyboard-protocol.test.ts": 62,
+      "src/renderer/src/lib/pane-manager/terminal-ligatures-addon.test.ts": 66,
+      "src/renderer/src/lib/pane-manager/terminal-link-provider-guard.test.ts": 38,
+      "src/renderer/src/lib/pane-manager/terminal-linkifier-hover-reset-on-mouseleave.test.ts": 53,
+      "src/renderer/src/lib/pane-manager/terminal-linkifier-hover-reset-on-write.test.ts": 41,
+      "src/renderer/src/lib/pane-manager/terminal-linkifier-hover-reset.test.ts": 58,
+      "src/renderer/src/lib/pane-manager/terminal-render-pause-release-parked-resize.test.ts": 30,
+      "src/renderer/src/lib/pane-manager/terminal-render-pause-release.test.ts": 77,
+      "src/renderer/src/lib/pane-manager/terminal-scroll-intent-input-resync.test.ts": 78,
+      "src/renderer/src/lib/pane-manager/terminal-scroll-intent-key-retention.test.ts": 125,
+      "src/renderer/src/lib/pane-manager/terminal-scroll-intent-structural-transitions.test.ts": 51,
+      "src/renderer/src/lib/pane-manager/terminal-scroll-intent.test.ts": 117,
+      "src/renderer/src/lib/pane-manager/terminal-structural-replay-coordinator.test.ts": 62,
+      "src/renderer/src/lib/pane-manager/terminal-webgl-auto-policy.test.ts": 61,
+      "src/renderer/src/lib/pane-manager/terminal-webgl-hidden-retention.test.ts": 321,
+      "src/renderer/src/lib/pane-manager/terminal-windows-ctrl-alt-chord-classification.test.ts": 358,
+      "src/renderer/src/lib/pane-manager/terminal-write-pipeline-health.test.ts": 71,
+      "src/renderer/src/lib/pane-manager/windows-pty-compatibility.test.ts": 87,
+      "src/renderer/src/lib/pane-manager/xterm-instance-disposed.test.ts": 131,
+      "src/renderer/src/lib/pane-manager/xterm-user-scrolling-contract.test.ts": 4939,
+      "src/renderer/src/lib/pane-manager/xterm-write-callback-guard.test.ts": 72,
+      "src/renderer/src/lib/parked-terminal-host-hydration.test.ts": 187,
+      "src/renderer/src/lib/passive-macos-app-data-access.test.ts": 26,
+      "src/renderer/src/lib/paste-payload-metadata.test.ts": 51,
+      "src/renderer/src/lib/path-head-elision.test.ts": 45,
+      "src/renderer/src/lib/path.test.ts": 42,
+      "src/renderer/src/lib/pending-worktree-creation.test.ts": 46,
+      "src/renderer/src/lib/pi-live-session-no-duplicate-tab.test.ts": 1695,
+      "src/renderer/src/lib/pi-session-resume-wake.test.ts": 1680,
+      "src/renderer/src/lib/plugin-command-execution.test.ts": 480,
+      "src/renderer/src/lib/plugin-command-keybindings.test.ts": 100,
+      "src/renderer/src/lib/pr-bot-author-overrides.test.ts": 298,
+      "src/renderer/src/lib/pr-comment-action-state.test.ts": 46,
+      "src/renderer/src/lib/pr-comment-reactions.test.ts": 30,
+      "src/renderer/src/lib/primary-selection-paste.test.ts": 551,
+      "src/renderer/src/lib/primary-selection.test.ts": 67,
+      "src/renderer/src/lib/project-clone-url-prefill.test.ts": 63,
+      "src/renderer/src/lib/project-host-clone-url.test.ts": 39,
+      "src/renderer/src/lib/project-host-setup-options.test.ts": 182,
+      "src/renderer/src/lib/project-host-workspace-target.test.ts": 105,
+      "src/renderer/src/lib/project-skill-runtime.test.ts": 87,
+      "src/renderer/src/lib/provisioned-root-create-options.test.ts": 42,
+      "src/renderer/src/lib/quick-workspace-agent-selection.test.ts": 143,
+      "src/renderer/src/lib/react-commit-cascade-install-order.test.ts": 31,
+      "src/renderer/src/lib/react-commit-cascade-observer.react185.test.tsx": 465,
+      "src/renderer/src/lib/react-commit-cascade-observer.test.ts": 187,
+      "src/renderer/src/lib/react-commit-cascade-store-write-samples.test.ts": 55,
+      "src/renderer/src/lib/react-commit-cascade-telemetry.test.ts": 223,
+      "src/renderer/src/lib/react-error-boundary-reporting.test.ts": 43,
+      "src/renderer/src/lib/react-grab-dev-gate.test.ts": 39,
+      "src/renderer/src/lib/react-renderer-root.test.ts": 40,
+      "src/renderer/src/lib/recent-workspace-tab-rows.test.ts": 81,
+      "src/renderer/src/lib/remap-open-editor-tabs-for-path-change.test.ts": 1606,
+      "src/renderer/src/lib/renderer-agent-status-observation-ingress.test.ts": 136,
+      "src/renderer/src/lib/renderer-app-platform.test.ts": 338,
+      "src/renderer/src/lib/renderer-memory-profile.test.ts": 40,
+      "src/renderer/src/lib/repo-display-labels.test.ts": 55,
+      "src/renderer/src/lib/repo-runtime-owner.test.ts": 77,
+      "src/renderer/src/lib/repo-search.test.ts": 57,
+      "src/renderer/src/lib/repo-slug-cache.test.ts": 62,
+      "src/renderer/src/lib/repo-slug-index.test.ts": 2511,
+      "src/renderer/src/lib/resolved-worktree-execution-host.test.ts": 127,
+      "src/renderer/src/lib/resume-sleeping-agent-session-direct-ssh-hydration-gap.test.ts": 1502,
+      "src/renderer/src/lib/resume-sleeping-agent-session-execution-host-scope.test.ts": 1425,
+      "src/renderer/src/lib/resume-sleeping-agent-session-provider-claim.test.ts": 1617,
+      "src/renderer/src/lib/resume-sleeping-agent-session-remote-compat.test.ts": 1603,
+      "src/renderer/src/lib/resume-sleeping-agent-session-replay.test.ts": 1351,
+      "src/renderer/src/lib/resume-sleeping-agent-session-slept-pane-recovery.test.ts": 1692,
+      "src/renderer/src/lib/resume-sleeping-agent-session-suppress-navigation.test.ts": 1627,
+      "src/renderer/src/lib/resume-sleeping-agent-session.test.ts": 5799,
+      "src/renderer/src/lib/resume-stale-structured-agent-session.test.ts": 1670,
+      "src/renderer/src/lib/right-sidebar-visibility.test.ts": 30,
+      "src/renderer/src/lib/run-quick-command-in-new-tab.test.ts": 106,
+      "src/renderer/src/lib/running-agent-targets.test.ts": 61,
+      "src/renderer/src/lib/runtime-host-unverifiable-probe-readers.test.ts": 317,
+      "src/renderer/src/lib/runtime-pane-title-leaf-id.test.ts": 67,
+      "src/renderer/src/lib/runtime-session-mirror-targets.test.ts": 67,
+      "src/renderer/src/lib/runtime-session-mirror-unverifiable-host.test.ts": 64,
+      "src/renderer/src/lib/runtime-workspace-file-route.test.ts": 140,
+      "src/renderer/src/lib/screen-submit-shortcut.test.ts": 50,
+      "src/renderer/src/lib/script-textarea-rows.test.ts": 123,
+      "src/renderer/src/lib/scroll-cache.test.ts": 51,
+      "src/renderer/src/lib/serve-desktop-promotion-session-continuity.test.ts": 1709,
+      "src/renderer/src/lib/session-write-subscriber-allocation.test.ts": 215,
+      "src/renderer/src/lib/session-write-subscriber-deferred-persist.test.ts": 1599,
+      "src/renderer/src/lib/session-write-subscriber.test.ts": 1398,
+      "src/renderer/src/lib/settled-worker-wake-policy.test.ts": 1859,
+      "src/renderer/src/lib/setup-runner.test.ts": 39,
+      "src/renderer/src/lib/setup-script-prompt.test.ts": 215,
+      "src/renderer/src/lib/sha256.test.ts": 46,
+      "src/renderer/src/lib/shutdown-checkpoint-guard.test.ts": 523,
+      "src/renderer/src/lib/sidebar-worktree-activation.test.ts": 91,
+      "src/renderer/src/lib/simulator-launch-coordination.test.ts": 173,
+      "src/renderer/src/lib/simulator-palette-search.test.ts": 101,
+      "src/renderer/src/lib/simulator-pane-shutdown-scheduler.test.ts": 1567,
+      "src/renderer/src/lib/simulator-tab-palette-activation.test.ts": 2039,
+      "src/renderer/src/lib/skill-freshness-display-status.test.ts": 36,
+      "src/renderer/src/lib/sleeping-agent-session-launch-windows-quoting.test.ts": 283,
+      "src/renderer/src/lib/smart-github-submit.test.ts": 80,
+      "src/renderer/src/lib/source-control-agent-action-plan.test.ts": 954,
+      "src/renderer/src/lib/source-control-generation-plan.test.ts": 130,
+      "src/renderer/src/lib/source-control-launch-agent-selection.test.ts": 180,
+      "src/renderer/src/lib/source-control-launch-platform.test.ts": 73,
+      "src/renderer/src/lib/source-control-remote-error.test.ts": 50,
+      "src/renderer/src/lib/sparse-preset-draft.test.ts": 84,
+      "src/renderer/src/lib/ssh-background-startup-delivery.test.ts": 79,
+      "src/renderer/src/lib/ssh-failed-target-sleeping-agent-resume.test.ts": 1878,
+      "src/renderer/src/lib/ssh-mutation-expectation.test.ts": 46,
+      "src/renderer/src/lib/startup-ui-hydration.test.ts": 152,
+      "src/renderer/src/lib/state-collection-byte-estimate.test.ts": 84,
+      "src/renderer/src/lib/structured-agent-launch-no-terminal-fallback.test.ts": 272,
+      "src/renderer/src/lib/structured-agent-launch-settlement.test.ts": 81,
+      "src/renderer/src/lib/structured-agent-session-launch-cancellation.test.ts": 2166,
+      "src/renderer/src/lib/structured-agent-session-launch-exited-owner.test.ts": 948,
+      "src/renderer/src/lib/structured-agent-session-launch-join-delivery.test.ts": 378,
+      "src/renderer/src/lib/structured-agent-session-launch-options.test.ts": 660,
+      "src/renderer/src/lib/structured-agent-session-launch-persistence.test.ts": 449,
+      "src/renderer/src/lib/structured-agent-session-launch-prompt.test.ts": 357,
+      "src/renderer/src/lib/structured-agent-session-launch-reload.test.ts": 576,
+      "src/renderer/src/lib/structured-agent-session-launch-resume-identity.test.ts": 499,
+      "src/renderer/src/lib/structured-agent-session-launch.test.ts": 1259,
+      "src/renderer/src/lib/structured-agent-session-tab-activation.test.ts": 50,
+      "src/renderer/src/lib/structured-agent-startup-label-census.test.ts": 222,
+      "src/renderer/src/lib/tab-agent-identity-decision-table.test.ts": 420,
+      "src/renderer/src/lib/tab-agent-status-index.test.ts": 308,
+      "src/renderer/src/lib/tab-agent.test.ts": 74,
+      "src/renderer/src/lib/tab-has-live-pty.test.ts": 48,
+      "src/renderer/src/lib/tab-number-shortcuts.test.ts": 1493,
+      "src/renderer/src/lib/terminal-contrast-correction.test.ts": 44,
+      "src/renderer/src/lib/terminal-file-uri-link.test.ts": 33,
+      "src/renderer/src/lib/terminal-input-activity-coalescing.test.ts": 61,
+      "src/renderer/src/lib/terminal-links-redos.test.ts": 69,
+      "src/renderer/src/lib/terminal-links.test.ts": 274,
+      "src/renderer/src/lib/terminal-pane-title-sanitization.test.ts": 51,
+      "src/renderer/src/lib/terminal-quick-command-project-scope.test.ts": 76,
+      "src/renderer/src/lib/terminal-quick-command-score-budget.test.ts": 61,
+      "src/renderer/src/lib/terminal-quick-command-search.test.ts": 73,
+      "src/renderer/src/lib/terminal-reveal-identity.test.ts": 41,
+      "src/renderer/src/lib/terminal-shortcut-capture-notification.test.tsx": 1568,
+      "src/renderer/src/lib/terminal-tab-for-pty-id.test.ts": 31,
+      "src/renderer/src/lib/terminal-theme.test.ts": 80,
+      "src/renderer/src/lib/terminal-worktree-route.test.ts": 210,
+      "src/renderer/src/lib/text-control-paste-ownership.test.ts": 475,
+      "src/renderer/src/lib/text-control-paste.test.ts": 490,
+      "src/renderer/src/lib/titlebar-left-chrome.test.ts": 27,
+      "src/renderer/src/lib/titlebar-worktree-history-controls.test.ts": 50,
+      "src/renderer/src/lib/tui-agent-startup.test.ts": 103,
+      "src/renderer/src/lib/typing-latency/diagnostic-lifecycle.test.ts": 562,
+      "src/renderer/src/lib/typing-latency/diagnostic-summary.test.ts": 61,
+      "src/renderer/src/lib/typing-latency/echo-instrumentation.test.ts": 246,
+      "src/renderer/src/lib/typing-latency/input-events.test.ts": 385,
+      "src/renderer/src/lib/typing-latency/input-source.test.ts": 75,
+      "src/renderer/src/lib/typing-latency/sample-window.test.ts": 57,
+      "src/renderer/src/lib/ui-zoom.test.ts": 59,
+      "src/renderer/src/lib/unread-badge-count.test.ts": 51,
+      "src/renderer/src/lib/update-check-click-options.test.ts": 40,
+      "src/renderer/src/lib/updater-beforeunload.test.ts": 60,
+      "src/renderer/src/lib/use-tab-agent-observed-signal-dispatch.test.tsx": 1567,
+      "src/renderer/src/lib/use-tab-agent-opencode-native-title.test.ts": 1480,
+      "src/renderer/src/lib/use-tab-agent-pi-identity.test.ts": 92,
+      "src/renderer/src/lib/use-tab-agent-process-signals.test.ts": 2086,
+      "src/renderer/src/lib/use-tab-agent-remote-pty-selector.test.ts": 118,
+      "src/renderer/src/lib/use-tab-agent-retained-identity.test.ts": 1549,
+      "src/renderer/src/lib/use-tab-agent-sleeping-session.test.ts": 1948,
+      "src/renderer/src/lib/use-tab-agent.test.ts": 1893,
+      "src/renderer/src/lib/visible-overlay.test.ts": 464,
+      "src/renderer/src/lib/wake-sleeping-agents-in-background.test.ts": 276,
+      "src/renderer/src/lib/wake-sleeping-agents-live-done.test.ts": 437,
+      "src/renderer/src/lib/web-client-location.test.ts": 52,
+      "src/renderer/src/lib/window-label-formatter.test.ts": 27,
+      "src/renderer/src/lib/window-visibility-interval.test.ts": 70,
+      "src/renderer/src/lib/window-visibility-timeout-poller.test.ts": 67,
+      "src/renderer/src/lib/windows-terminal-capabilities-race.test.ts": 317,
+      "src/renderer/src/lib/windows-terminal-capabilities.test.ts": 401,
+      "src/renderer/src/lib/windows-terminal-capability-reprobe.test.ts": 432,
+      "src/renderer/src/lib/work-item-link-query-bounds.test.ts": 49,
+      "src/renderer/src/lib/work-item-lookup-text.test.ts": 55,
+      "src/renderer/src/lib/worker-terminal-takeover-report.test.ts": 314,
+      "src/renderer/src/lib/workspace-activation-path-gate.test.ts": 1954,
+      "src/renderer/src/lib/workspace-activation-terminal-focus.test.ts": 345,
+      "src/renderer/src/lib/workspace-browser-tab-open.test.ts": 325,
+      "src/renderer/src/lib/workspace-composer-initial-focus.test.ts": 351,
+      "src/renderer/src/lib/workspace-create-error-format.test.ts": 99,
+      "src/renderer/src/lib/workspace-doc-address-input.test.ts": 208,
+      "src/renderer/src/lib/workspace-emoji-shortcodes.lazy.test.ts": 103,
+      "src/renderer/src/lib/workspace-emoji-shortcodes.test.ts": 79,
+      "src/renderer/src/lib/workspace-file-drag.test.ts": 94,
+      "src/renderer/src/lib/workspace-port-groups.test.ts": 49,
+      "src/renderer/src/lib/workspace-port-host-availability.test.ts": 40,
+      "src/renderer/src/lib/workspace-port-scan-debounce.test.ts": 48,
+      "src/renderer/src/lib/workspace-port-scan-publish.test.ts": 672,
+      "src/renderer/src/lib/workspace-session-browser-history.test.ts": 196,
+      "src/renderer/src/lib/workspace-session-closed-tab-tombstones.test.ts": 146,
+      "src/renderer/src/lib/workspace-session-editor-drafts.test.ts": 156,
+      "src/renderer/src/lib/workspace-session-host-contention.test.ts": 236,
+      "src/renderer/src/lib/workspace-session-host-persistence.test.ts": 301,
+      "src/renderer/src/lib/workspace-session-host-split.test.ts": 128,
+      "src/renderer/src/lib/workspace-session-hydration-keys.test.ts": 36,
+      "src/renderer/src/lib/workspace-session-liveness.test.ts": 133,
+      "src/renderer/src/lib/workspace-session-patch.test.ts": 196,
+      "src/renderer/src/lib/workspace-session-persistence-gate.test.ts": 209,
+      "src/renderer/src/lib/workspace-session-relevant-fields.test.ts": 200,
+      "src/renderer/src/lib/workspace-session-ssh-partition-ownership.test.ts": 210,
+      "src/renderer/src/lib/workspace-session-ssh-partition-round-trip.test.ts": 235,
+      "src/renderer/src/lib/workspace-session-staged-browser-tabs.test.ts": 39,
+      "src/renderer/src/lib/workspace-session.test.ts": 150,
+      "src/renderer/src/lib/workspace-tab-agent-metadata.test.ts": 49,
+      "src/renderer/src/lib/workspace-tab-palette-activation.store.test.ts": 1538,
+      "src/renderer/src/lib/workspace-tab-palette-activation.test.ts": 73,
+      "src/renderer/src/lib/workspace-tab-palette-results.test.ts": 105,
+      "src/renderer/src/lib/workspace-tab-palette-search.test.ts": 216,
+      "src/renderer/src/lib/workspace-terminal-host-authority.test.ts": 1735,
+      "src/renderer/src/lib/worktree-activation-agent-startup.test.ts": 1648,
+      "src/renderer/src/lib/worktree-activation-automation-filter.test.ts": 1897,
+      "src/renderer/src/lib/worktree-activation-created-agent.test.ts": 1592,
+      "src/renderer/src/lib/worktree-activation-default-tabs.test.ts": 1319,
+      "src/renderer/src/lib/worktree-activation-emptied-workspace-reseed.test.ts": 2006,
+      "src/renderer/src/lib/worktree-activation-empty-remote.test.ts": 1783,
+      "src/renderer/src/lib/worktree-activation-issue-command.test.ts": 1036,
+      "src/renderer/src/lib/worktree-activation-pty-inventory.test.ts": 182,
+      "src/renderer/src/lib/worktree-activation-reveal.test.ts": 1804,
+      "src/renderer/src/lib/worktree-activation-setup-script.test.ts": 1979,
+      "src/renderer/src/lib/worktree-activation-structured-chat-surface.test.ts": 1880,
+      "src/renderer/src/lib/worktree-activation-surface-caller-wiring.test.ts": 290,
+      "src/renderer/src/lib/worktree-activation-web-runtime.test.ts": 1340,
+      "src/renderer/src/lib/worktree-activity-state.test.ts": 69,
+      "src/renderer/src/lib/worktree-agent-activation-gate.test.ts": 1546,
+      "src/renderer/src/lib/worktree-agent-activation-seam.test.ts": 1685,
+      "src/renderer/src/lib/worktree-agent-structured-inventory.test.ts": 132,
+      "src/renderer/src/lib/worktree-attachment-label.test.ts": 56,
+      "src/renderer/src/lib/worktree-creation-agent-seeding.test.ts": 622,
+      "src/renderer/src/lib/worktree-creation-agent-seeds.test.ts": 1725,
+      "src/renderer/src/lib/worktree-creation-chat-setup.test.ts": 1752,
+      "src/renderer/src/lib/worktree-creation-flow-agent-trust-preflight.test.ts": 34,
+      "src/renderer/src/lib/worktree-creation-flow-dedupe.test.ts": 887,
+      "src/renderer/src/lib/worktree-creation-flow-stranded-surface.test.ts": 1050,
+      "src/renderer/src/lib/worktree-creation-flow.test.ts": 2555,
+      "src/renderer/src/lib/worktree-creation-structured-session.test.ts": 922,
+      "src/renderer/src/lib/worktree-creation-surface.test.ts": 43,
+      "src/renderer/src/lib/worktree-default-display-name.test.ts": 67,
+      "src/renderer/src/lib/worktree-display-name-order.test.ts": 33,
+      "src/renderer/src/lib/worktree-draft-startup-view-mode.test.ts": 1565,
+      "src/renderer/src/lib/worktree-git-identity-display.test.ts": 78,
+      "src/renderer/src/lib/worktree-jump-navigation.test.ts": 231,
+      "src/renderer/src/lib/worktree-live-terminal-surface-owners.test.ts": 210,
+      "src/renderer/src/lib/worktree-operation-generation.test.ts": 319,
+      "src/renderer/src/lib/worktree-operation-route.test.ts": 63,
+      "src/renderer/src/lib/worktree-palette-comment-snippet.test.ts": 56,
+      "src/renderer/src/lib/worktree-palette-create-action.test.ts": 52,
+      "src/renderer/src/lib/worktree-palette-multi-keyword.test.ts": 216,
+      "src/renderer/src/lib/worktree-palette-review-match.test.ts": 96,
+      "src/renderer/src/lib/worktree-palette-runtime-owner-identity.test.ts": 81,
+      "src/renderer/src/lib/worktree-palette-search.test.ts": 166,
+      "src/renderer/src/lib/worktree-palette-task-url-match.test.ts": 118,
+      "src/renderer/src/lib/worktree-reactivation-preserved-pane-replacement.test.ts": 2149,
+      "src/renderer/src/lib/worktree-reactivation-runtime-owned-resume-deferral.test.ts": 1803,
+      "src/renderer/src/lib/worktree-reactivation-tab-forkbomb.test.ts": 1778,
+      "src/renderer/src/lib/worktree-runtime-owner-index.detected-perf.test.ts": 956,
+      "src/renderer/src/lib/worktree-runtime-owner-index.detected.test.ts": 184,
+      "src/renderer/src/lib/worktree-runtime-owner-index.test.ts": 37,
+      "src/renderer/src/lib/worktree-runtime-owner.test.ts": 233,
+      "src/renderer/src/lib/worktree-sort-order-host-split.test.ts": 150,
+      "src/renderer/src/lib/worktree-sort-order-persistence.test.ts": 179,
+      "src/renderer/src/lib/worktree-status-spinner-launch-agent.test.ts": 59,
+      "src/renderer/src/lib/worktree-status-terminal-layout-roots.test.ts": 58,
+      "src/renderer/src/lib/worktree-status.interrupted.test.ts": 74,
+      "src/renderer/src/lib/worktree-status.test.ts": 98,
+      "src/renderer/src/lib/worktree-visit-recency.test.ts": 37,
+      "src/renderer/src/renderer-node-builtin-boundary.test.ts": 1218,
+      "src/renderer/src/runtime/agent-resume-host-authority-capability.test.ts": 39,
+      "src/renderer/src/runtime/agent-session-keyboard-capability.test.ts": 66,
+      "src/renderer/src/runtime/agent-session-operation-id.test.ts": 64,
+      "src/renderer/src/runtime/antigravity-generation-compatibility.test.ts": 167,
+      "src/renderer/src/runtime/browser-client-host-identity.test.ts": 60,
+      "src/renderer/src/runtime/browser-workspace-tab-close-census.test.ts": 361,
+      "src/renderer/src/runtime/browser-workspace-tab-close-plan.test.ts": 33,
+      "src/renderer/src/runtime/browser-workspace-tab-close.test.ts": 92,
+      "src/renderer/src/runtime/client-hosted-browser-close-intent-replay.test.ts": 172,
+      "src/renderer/src/runtime/client-hosted-browser-close-intents.test.ts": 103,
+      "src/renderer/src/runtime/client-hosted-browser-row-close.test.ts": 216,
+      "src/renderer/src/runtime/close-mirrored-editor-tab.test.ts": 107,
+      "src/renderer/src/runtime/file-explorer-delete-owner-provenance.test.ts": 2077,
+      "src/renderer/src/runtime/focus-runtime-terminal-surface-chat-view.test.ts": 502,
+      "src/renderer/src/runtime/github-check-details-timeout.test.ts": 41,
+      "src/renderer/src/runtime/gitlab-job-trace-client.test.ts": 141,
+      "src/renderer/src/runtime/host-session-mirror-empty-inventory-settle.test.ts": 630,
+      "src/renderer/src/runtime/host-session-mirror-flap-hydration.test.ts": 197,
+      "src/renderer/src/runtime/host-session-mirror-hydration-drain.test.ts": 239,
+      "src/renderer/src/runtime/host-session-mirror-hydration-frame-ordering.test.tsx": 1759,
+      "src/renderer/src/runtime/host-session-mirror-settle-census.test.ts": 505,
+      "src/renderer/src/runtime/host-session-mirror-settle-receipt-frames.test.tsx": 1864,
+      "src/renderer/src/runtime/host-session-snapshot-authority-client-hosted.test.ts": 52,
+      "src/renderer/src/runtime/local-runtime-capabilities.test.ts": 473,
+      "src/renderer/src/runtime/local-session-tab-close-owner.test.ts": 58,
+      "src/renderer/src/runtime/local-structured-session-empty-worktree-visibility.test.ts": 1132,
+      "src/renderer/src/runtime/local-structured-session-retired-epoch-repair.test.ts": 1743,
+      "src/renderer/src/runtime/local-structured-session-reveal-visibility.test.ts": 1580,
+      "src/renderer/src/runtime/local-structured-session-tabs-host-isolation.test.ts": 779,
+      "src/renderer/src/runtime/local-structured-session-tabs-sync.test.ts": 2524,
+      "src/renderer/src/runtime/local-structured-session-tabs-sync/retired-epoch-repair.test.ts": 67,
+      "src/renderer/src/runtime/mirrored-agent-status-clock-skew.test.ts": 1299,
+      "src/renderer/src/runtime/mobile-markdown-bridge-save-guards.test.ts": 1242,
+      "src/renderer/src/runtime/mobile-markdown-bridge.test.ts": 1361,
+      "src/renderer/src/runtime/native-chat-launch-draft-runtime-resolution.test.ts": 38,
+      "src/renderer/src/runtime/paired-reconnect-sidebar-agent-count.test.ts": 1002,
+      "src/renderer/src/runtime/remote-agent-row-last-assistant-message.test.ts": 1196,
+      "src/renderer/src/runtime/remote-agent-session-launch.test.ts": 62,
+      "src/renderer/src/runtime/remote-host-file-delete-repro.test.ts": 2161,
+      "src/renderer/src/runtime/remote-host-file-open-repro.test.ts": 1628,
+      "src/renderer/src/runtime/remote-runtime-session-tabs-inflight.test.ts": 50,
+      "src/renderer/src/runtime/remote-runtime-snapshot-outcome.test.ts": 118,
+      "src/renderer/src/runtime/remote-runtime-terminal-end-verdict.test.ts": 86,
+      "src/renderer/src/runtime/remote-runtime-terminal-frame-drop-resync.test.ts": 109,
+      "src/renderer/src/runtime/remote-runtime-terminal-parse-backpressure.test.ts": 334,
+      "src/renderer/src/runtime/remote-runtime-terminal-snapshot-kitty-flags.test.ts": 96,
+      "src/renderer/src/runtime/remote-runtime-terminal-stale-stream-frames.test.ts": 87,
+      "src/renderer/src/runtime/remote-runtime-terminal-stall-recovery.test.ts": 263,
+      "src/renderer/src/runtime/remote-server-install-failure-probe.test.ts": 61,
+      "src/renderer/src/runtime/remote-server-parity.test.ts": 1760,
+      "src/renderer/src/runtime/remote-server-restart-wait.test.ts": 43,
+      "src/renderer/src/runtime/remote-server-update-coordinator.test.ts": 95,
+      "src/renderer/src/runtime/remote-terminal-layout-resolution.test.ts": 61,
+      "src/renderer/src/runtime/remote-terminal-stream-watchdog.test.ts": 52,
+      "src/renderer/src/runtime/restored-client-hosted-browser-host-attach.test.ts": 67,
+      "src/renderer/src/runtime/restored-client-hosted-browser-host-restart-attach.test.ts": 286,
+      "src/renderer/src/runtime/runtime-client-events.test.ts": 55,
+      "src/renderer/src/runtime/runtime-environment-ssh-state.test.ts": 1134,
+      "src/renderer/src/runtime/runtime-file-client-download.test.ts": 218,
+      "src/renderer/src/runtime/runtime-file-client-external-import.test.ts": 324,
+      "src/renderer/src/runtime/runtime-file-client-mutation-ownership.test.ts": 208,
+      "src/renderer/src/runtime/runtime-file-client-search-listing.test.ts": 276,
+      "src/renderer/src/runtime/runtime-file-client-watch.test.ts": 388,
+      "src/renderer/src/runtime/runtime-file-client.test.ts": 367,
+      "src/renderer/src/runtime/runtime-file-import-pairing-revision.test.ts": 311,
+      "src/renderer/src/runtime/runtime-file-search-bounds.test.ts": 38,
+      "src/renderer/src/runtime/runtime-git-client-api-contract.test.ts": 156,
+      "src/renderer/src/runtime/runtime-git-client-branch-line-total.test.ts": 182,
+      "src/renderer/src/runtime/runtime-git-client-merge.test.ts": 137,
+      "src/renderer/src/runtime/runtime-git-client.test.ts": 255,
+      "src/renderer/src/runtime/runtime-hooks-client.test.ts": 73,
+      "src/renderer/src/runtime/runtime-host-connection-state.test.ts": 50,
+      "src/renderer/src/runtime/runtime-host-contact-parity.test.ts": 81,
+      "src/renderer/src/runtime/runtime-jira-client.test.ts": 555,
+      "src/renderer/src/runtime/runtime-jira-payload-stream.test.ts": 242,
+      "src/renderer/src/runtime/runtime-linear-client.test.ts": 89,
+      "src/renderer/src/runtime/runtime-path-existence-batch.test.ts": 249,
+      "src/renderer/src/runtime/runtime-path-existence-error-parity.test.ts": 192,
+      "src/renderer/src/runtime/runtime-path-existence-pairing.test.ts": 236,
+      "src/renderer/src/runtime/runtime-path-existence-queue-pairing.test.ts": 252,
+      "src/renderer/src/runtime/runtime-provider-accounts-client.test.ts": 107,
+      "src/renderer/src/runtime/runtime-provider-search-bounds.test.ts": 44,
+      "src/renderer/src/runtime/runtime-repo-client.test.ts": 219,
+      "src/renderer/src/runtime/runtime-repo-search-bounds.test.ts": 38,
+      "src/renderer/src/runtime/runtime-rpc-client-pairing-revision.test.ts": 50,
+      "src/renderer/src/runtime/runtime-rpc-client.test.ts": 102,
+      "src/renderer/src/runtime/runtime-rpc-result.test.ts": 28,
+      "src/renderer/src/runtime/runtime-server-directory-browser.test.ts": 72,
+      "src/renderer/src/runtime/runtime-skills-client.test.ts": 78,
+      "src/renderer/src/runtime/runtime-skills-delete-client.test.ts": 61,
+      "src/renderer/src/runtime/runtime-terminal-inspection.test.ts": 1867,
+      "src/renderer/src/runtime/runtime-terminal-stream.test.ts": 341,
+      "src/renderer/src/runtime/runtime-worktree-selector.test.ts": 123,
+      "src/renderer/src/runtime/structured-agent-session-client.test.ts": 324,
+      "src/renderer/src/runtime/structured-agent-session-close.test.ts": 59,
+      "src/renderer/src/runtime/structured-agent-session-status-feed-lifecycle.test.ts": 37,
+      "src/renderer/src/runtime/structured-agent-session-status-feed.test.ts": 83,
+      "src/renderer/src/runtime/structured-agent-session-tab-retirement.test.ts": 55,
+      "src/renderer/src/runtime/structured-agent-session-turn-completion-feed.test.ts": 89,
+      "src/renderer/src/runtime/structured-conversation-tab-replacement.test.ts": 1641,
+      "src/renderer/src/runtime/sync-runtime-graph-agent-status-projection-join.test.ts": 422,
+      "src/renderer/src/runtime/sync-runtime-graph-agent-status-projection.test.ts": 334,
+      "src/renderer/src/runtime/sync-runtime-graph-automation-leaf.test.ts": 289,
+      "src/renderer/src/runtime/sync-runtime-graph-browser.test.ts": 244,
+      "src/renderer/src/runtime/sync-runtime-graph-conversion-publish.test.ts": 1365,
+      "src/renderer/src/runtime/sync-runtime-graph-editor-diff-tabs.test.ts": 332,
+      "src/renderer/src/runtime/sync-runtime-graph-key-reuse.test.ts": 358,
+      "src/renderer/src/runtime/sync-runtime-graph-parked-leaf.test.ts": 237,
+      "src/renderer/src/runtime/sync-runtime-graph-payload-partition.test.ts": 305,
+      "src/renderer/src/runtime/sync-runtime-graph-projection-hot-path.test.ts": 542,
+      "src/renderer/src/runtime/sync-runtime-graph-publication-cost.test.ts": 270,
+      "src/renderer/src/runtime/sync-runtime-graph-scheduling.test.ts": 264,
+      "src/renderer/src/runtime/sync-runtime-graph-terminal-layout.test.ts": 1061,
+      "src/renderer/src/runtime/sync-runtime-graph-terminal-registration-ownership.test.ts": 349,
+      "src/renderer/src/runtime/sync-runtime-graph-terminal-surface-projection.test.ts": 225,
+      "src/renderer/src/runtime/sync-runtime-graph-workspace-publication.test.ts": 369,
+      "src/renderer/src/runtime/sync-runtime-graph.test.ts": 342,
+      "src/renderer/src/runtime/sync-runtime-graph/mobile-terminal-theme.test.ts": 82,
+      "src/renderer/src/runtime/use-remote-runtime-recovery-triggers.test.ts": 555,
+      "src/renderer/src/runtime/use-runtime-session-mirror-environment-key.test.ts": 2476,
+      "src/renderer/src/runtime/use-worktree-runtime-target.test.ts": 2118,
+      "src/renderer/src/runtime/web-runtime-browser-capability-cleanup.test.ts": 230,
+      "src/renderer/src/runtime/web-runtime-browser-materialization.test.ts": 35,
+      "src/renderer/src/runtime/web-runtime-browser-tab-staging-hosting-intent.test.ts": 54,
+      "src/renderer/src/runtime/web-runtime-session-browser-client-placement.test.ts": 508,
+      "src/renderer/src/runtime/web-runtime-session-browser-create-failure.test.ts": 508,
+      "src/renderer/src/runtime/web-runtime-session-browser-create-focus.test.ts": 494,
+      "src/renderer/src/runtime/web-runtime-session-browser-create-split-placement.test.ts": 500,
+      "src/renderer/src/runtime/web-runtime-session-browser-create-staged-focus.test.ts": 530,
+      "src/renderer/src/runtime/web-runtime-session-browser-create-staged-hosting-intent.test.ts": 347,
+      "src/renderer/src/runtime/web-runtime-session-browser-create-staging.test.ts": 876,
+      "src/renderer/src/runtime/web-runtime-session-browser-placement-staleness.test.ts": 390,
+      "src/renderer/src/runtime/web-runtime-session-tab-activate-close.test.ts": 470,
+      "src/renderer/src/runtime/web-runtime-session-tab-move.test.ts": 317,
+      "src/renderer/src/runtime/web-runtime-session-tab-props.test.ts": 512,
+      "src/renderer/src/runtime/web-runtime-session-terminal-host-authority.test.ts": 461,
+      "src/renderer/src/runtime/web-runtime-session-terminal-legacy-create.test.ts": 336,
+      "src/renderer/src/runtime/web-runtime-session-terminal-pane-delegation.test.ts": 1290,
+      "src/renderer/src/runtime/web-runtime-session-terminal-workspace-routing.test.ts": 366,
+      "src/renderer/src/runtime/web-runtime-session.test.ts": 384,
+      "src/renderer/src/runtime/web-runtime-terminal-identity.test.ts": 57,
+      "src/renderer/src/runtime/web-runtime-wake-terminal-respawn.test.ts": 47,
+      "src/renderer/src/runtime/web-session-browser-placement.test.ts": 48,
+      "src/renderer/src/runtime/web-session-close-intent.test.ts": 53,
+      "src/renderer/src/runtime/web-session-existing-tab-index.test.ts": 35,
+      "src/renderer/src/runtime/web-session-focus-intent-visible-tab.test.ts": 1811,
+      "src/renderer/src/runtime/web-session-intent-owner.test.ts": 41,
+      "src/renderer/src/runtime/web-session-open-files-batch-equivalence.test.ts": 1150,
+      "src/renderer/src/runtime/web-session-structured-tab-focus.test.ts": 1370,
+      "src/renderer/src/runtime/web-session-tabs-agent-completion-notifications.test.ts": 1511,
+      "src/renderer/src/runtime/web-session-tabs-late-merged-predecessor-lockout.test.ts": 699,
+      "src/renderer/src/runtime/web-session-tabs-publisher-identity-lineage.test.ts": 472,
+      "src/renderer/src/runtime/web-session-tabs-removed-frame-retires-live-publisher.test.ts": 648,
+      "src/renderer/src/runtime/web-session-tabs-sync-agent-handoff.test.ts": 643,
+      "src/renderer/src/runtime/web-session-tabs-sync-agent-status.test.ts": 732,
+      "src/renderer/src/runtime/web-session-tabs-sync-browser-tabs.test.ts": 699,
+      "src/renderer/src/runtime/web-session-tabs-sync-client-owned-page-content.test.ts": 617,
+      "src/renderer/src/runtime/web-session-tabs-sync-client-owned-placement.test.ts": 727,
+      "src/renderer/src/runtime/web-session-tabs-sync-diff-focus-steal.test.ts": 468,
+      "src/renderer/src/runtime/web-session-tabs-sync-editor-tabs.test.ts": 668,
+      "src/renderer/src/runtime/web-session-tabs-sync-emptied-workspace-tombstone.test.ts": 817,
+      "src/renderer/src/runtime/web-session-tabs-sync-focus-intent.test.ts": 603,
+      "src/renderer/src/runtime/web-session-tabs-sync-host-restart-browser-rows.test.ts": 722,
+      "src/renderer/src/runtime/web-session-tabs-sync-host-tab-retraction-ghost-rows.test.ts": 2099,
+      "src/renderer/src/runtime/web-session-tabs-sync-html-preview-focus.test.ts": 659,
+      "src/renderer/src/runtime/web-session-tabs-sync-initial-terminal-relaunch.test.tsx": 2154,
+      "src/renderer/src/runtime/web-session-tabs-sync-layout-duplicate-groups.test.ts": 763,
+      "src/renderer/src/runtime/web-session-tabs-sync-layout-groups.test.ts": 671,
+      "src/renderer/src/runtime/web-session-tabs-sync-mirror-identity.test.ts": 1309,
+      "src/renderer/src/runtime/web-session-tabs-sync-mirrored-draft-close.test.ts": 2175,
+      "src/renderer/src/runtime/web-session-tabs-sync-reconnect-resubscribe.test.tsx": 2266,
+      "src/renderer/src/runtime/web-session-tabs-sync-remote-status-title-flap.test.ts": 1052,
+      "src/renderer/src/runtime/web-session-tabs-sync-restored-browser-rows.test.ts": 735,
+      "src/renderer/src/runtime/web-session-tabs-sync-snapshot-batch.test.ts": 666,
+      "src/renderer/src/runtime/web-session-tabs-sync-staged-browser-adoption.test.ts": 789,
+      "src/renderer/src/runtime/web-session-tabs-sync-staged-browser-authority.test.ts": 732,
+      "src/renderer/src/runtime/web-session-tabs-sync-terminal-bootstrap.test.ts": 603,
+      "src/renderer/src/runtime/web-session-tabs-sync-terminal-mirroring.test.ts": 756,
+      "src/renderer/src/runtime/web-session-tabs-sync-tracking-teardown.test.ts": 700,
+      "src/renderer/src/runtime/web-session-tabs-sync-unverifiable-host.test.tsx": 1481,
+      "src/renderer/src/runtime/web-session-tabs-sync-visibility-collision.test.tsx": 2322,
+      "src/renderer/src/runtime/web-session-tabs-sync-window-visibility.test.tsx": 6067,
+      "src/renderer/src/runtime/web-session-tabs-sync.test.ts": 610,
+      "src/renderer/src/runtime/web-session-tabs-sync/mirrored-agent-tab-label.test.ts": 1260,
+      "src/renderer/src/runtime/web-session-tabs-sync/mirrored-status-tab-retractions.test.ts": 1840,
+      "src/renderer/src/runtime/web-session-tabs-sync/mirrored-terminal-recovery-ledger.test.ts": 1252,
+      "src/renderer/src/runtime/web-session-tabs-sync/retraction-pane-ownership.test.ts": 1429,
+      "src/renderer/src/runtime/web-session-tabs-sync/tracking-lifecycle.test.ts": 1590,
+      "src/renderer/src/runtime/web-session-terminal-handle-events.test.ts": 29,
+      "src/renderer/src/runtime/web-session-terminal-orphan-absence-across-republication.test.ts": 313,
+      "src/renderer/src/runtime/web-session-terminal-orphan-inventory-retry.test.ts": 1303,
+      "src/renderer/src/runtime/web-session-terminal-orphan-mixed-version.test.ts": 607,
+      "src/renderer/src/runtime/web-session-terminal-orphan-recovery-adoption-regressions.test.ts": 754,
+      "src/renderer/src/runtime/web-session-terminal-orphan-recovery-host-scope-gate.test.ts": 306,
+      "src/renderer/src/runtime/web-session-terminal-orphan-recovery-prior-removal.test.ts": 328,
+      "src/renderer/src/runtime/web-session-terminal-orphan-recovery-regressions.test.ts": 607,
+      "src/renderer/src/runtime/web-session-terminal-orphan-recovery-topology-fence.test.ts": 370,
+      "src/renderer/src/runtime/web-session-terminal-orphan-recovery.test.ts": 327,
+      "src/renderer/src/runtime/web-session-terminal-pending-handle-recovery.test.ts": 229,
+      "src/renderer/src/runtime/web-session-terminal-recovery-snapshot-validation.test.ts": 444,
+      "src/renderer/src/runtime/web-session-terminal-retirement-proof-ledger.test.ts": 350,
+      "src/renderer/src/runtime/window-visibility-subscription-parking.test.ts": 524,
+      "src/renderer/src/runtime/worktree-create-base.test.ts": 45,
+      "src/renderer/src/ssh/ssh-connect-in-flight.test.ts": 69,
+      "src/renderer/src/ssh/ssh-connect-ui-timeout.test.ts": 51,
+      "src/renderer/src/ssh/ssh-connect-verb.test.ts": 35,
+      "src/renderer/src/ssh/ssh-connection-recoverability.test.ts": 50,
+      "src/renderer/src/startup/active-workspace-ssh-targets.test.ts": 68,
+      "src/renderer/src/startup/ssh-startup-reconnect.test.ts": 68,
+      "src/renderer/src/startup/startup-ssh-connection-restore.test.ts": 51,
+      "src/renderer/src/store/active-terminal-chrome-selector.test.ts": 44,
+      "src/renderer/src/store/always-mounted-selector-scan-cost.test.ts": 1670,
+      "src/renderer/src/store/copy-on-write-record.test.ts": 31,
+      "src/renderer/src/store/folder-workspaces/folder-workspace-catalog.test.ts": 51,
+      "src/renderer/src/store/github/cache-persistence.test.ts": 1363,
+      "src/renderer/src/store/github/refresh-event-noop-notification.test.ts": 1047,
+      "src/renderer/src/store/pinned-tab-close-guard.test.ts": 44,
+      "src/renderer/src/store/plugin-language-packs.test.ts": 321,
+      "src/renderer/src/store/plugin-panels.test.ts": 372,
+      "src/renderer/src/store/project-host-setup-selector.test.ts": 92,
+      "src/renderer/src/store/projects/project-catalog-null-field-ingest.test.ts": 57,
+      "src/renderer/src/store/projects/project-wsl-filesystem-boundary-advisory.test.ts": 64,
+      "src/renderer/src/store/react-commit-cascade-write-probe.test.ts": 56,
+      "src/renderer/src/store/repos/safe-auto-fork-sync.test.ts": 349,
+      "src/renderer/src/store/right-sidebar-route.test.ts": 48,
+      "src/renderer/src/store/running-terminal-close-confirm.test.ts": 64,
+      "src/renderer/src/store/selectors.test.ts": 855,
+      "src/renderer/src/store/slices/active-tab-owner-worktree.test.ts": 35,
+      "src/renderer/src/store/slices/activity-cleared-at.test.ts": 1576,
+      "src/renderer/src/store/slices/agent-generated-tab-title.test.ts": 1560,
+      "src/renderer/src/store/slices/agent-hibernation-live-anchor-e2e.test.ts": 1193,
+      "src/renderer/src/store/slices/agent-pane-authority.test.ts": 1347,
+      "src/renderer/src/store/slices/agent-status-ack-cleanup.test.ts": 1530,
+      "src/renderer/src/store/slices/agent-status-batch.test.ts": 1745,
+      "src/renderer/src/store/slices/agent-status-drop-ipc.test.ts": 2454,
+      "src/renderer/src/store/slices/agent-status-drop.test.ts": 1626,
+      "src/renderer/src/store/slices/agent-status-freshness-cache.test.ts": 53,
+      "src/renderer/src/store/slices/agent-status-freshness-scheduler.test.ts": 66,
+      "src/renderer/src/store/slices/agent-status-live-freshness-request.test.ts": 105,
+      "src/renderer/src/store/slices/agent-status-live-map-leak.test.ts": 14465,
+      "src/renderer/src/store/slices/agent-status-main-agent-fact.test.ts": 1154,
+      "src/renderer/src/store/slices/agent-status-manual-sleep-capture.test.ts": 1706,
+      "src/renderer/src/store/slices/agent-status-observation-neutrality.test.ts": 1545,
+      "src/renderer/src/store/slices/agent-status-pane-keyed-records.test.ts": 81,
+      "src/renderer/src/store/slices/agent-status-pr-refresh-handoff.test.ts": 1297,
+      "src/renderer/src/store/slices/agent-status-provider-session.test.ts": 1545,
+      "src/renderer/src/store/slices/agent-status-quit-capture-resumable-agents.test.ts": 1507,
+      "src/renderer/src/store/slices/agent-status-quit-capture.test.ts": 1864,
+      "src/renderer/src/store/slices/agent-status-reminted-pane-key.test.ts": 1189,
+      "src/renderer/src/store/slices/agent-status-retained-leak.test.ts": 1428,
+      "src/renderer/src/store/slices/agent-status-retention-prefix-sweep.test.ts": 1493,
+      "src/renderer/src/store/slices/agent-status-runtime-orchestration.test.ts": 1552,
+      "src/renderer/src/store/slices/agent-status-session-boundary-done.test.ts": 1464,
+      "src/renderer/src/store/slices/agent-status-ssh-connection-clear.test.ts": 1418,
+      "src/renderer/src/store/slices/agent-status-tool-assistant-fields.test.ts": 1612,
+      "src/renderer/src/store/slices/agent-status-worktree-purge-leak.test.ts": 1555,
+      "src/renderer/src/store/slices/agent-status.test.ts": 1634,
+      "src/renderer/src/store/slices/ambiguous-owner-warning-worktree-removal-leak.test.ts": 1263,
+      "src/renderer/src/store/slices/browser-cleanup-close.test.ts": 1227,
+      "src/renderer/src/store/slices/browser-page-close-intent-recording.test.ts": 1104,
+      "src/renderer/src/store/slices/browser-page-conversion.test.ts": 1151,
+      "src/renderer/src/store/slices/browser-remote-page-lifecycle.test.ts": 575,
+      "src/renderer/src/store/slices/browser-remote-tab-creation.test.ts": 381,
+      "src/renderer/src/store/slices/browser-session-host-selection.test.ts": 570,
+      "src/renderer/src/store/slices/browser-session-profiles.test.ts": 260,
+      "src/renderer/src/store/slices/browser-webview-cleanup.test.ts": 58,
+      "src/renderer/src/store/slices/browser-workspace-doc-location.test.ts": 1651,
+      "src/renderer/src/store/slices/browser-workspace-host-ownership.test.ts": 331,
+      "src/renderer/src/store/slices/browser.test.ts": 315,
+      "src/renderer/src/store/slices/bulk-worktree-purge-terminal-maps-leak.test.ts": 959,
+      "src/renderer/src/store/slices/cmd-j-create-actions.test.ts": 1073,
+      "src/renderer/src/store/slices/codex-restart-notice-lifecycle.test.ts": 1538,
+      "src/renderer/src/store/slices/degraded-repo-hydration.test.ts": 1492,
+      "src/renderer/src/store/slices/detected-agents-environment-prune-leak.test.ts": 998,
+      "src/renderer/src/store/slices/detected-agents.test.ts": 330,
+      "src/renderer/src/store/slices/detected-worktree-refresh-leases.test.ts": 66,
+      "src/renderer/src/store/slices/dictation-model-state-stabilisation.test.ts": 270,
+      "src/renderer/src/store/slices/diffComments.test.ts": 948,
+      "src/renderer/src/store/slices/direct-ssh-pane-detach-ledger.test.ts": 951,
+      "src/renderer/src/store/slices/direct-ssh-terminal-recovery.test.ts": 1210,
+      "src/renderer/src/store/slices/direct-ssh-terminal-retry.test.ts": 1067,
+      "src/renderer/src/store/slices/direct-ssh-terminal-workspace-scope.test.ts": 75,
+      "src/renderer/src/store/slices/editor-branch-diff-snapshots.test.ts": 600,
+      "src/renderer/src/store/slices/editor-branch-line-total.test.ts": 345,
+      "src/renderer/src/store/slices/editor-check-details-tabs.test.ts": 568,
+      "src/renderer/src/store/slices/editor-close-file-cleanup.test.ts": 563,
+      "src/renderer/src/store/slices/editor-git-status-reconciliation.test.ts": 392,
+      "src/renderer/src/store/slices/editor-hydration-scaling.test.ts": 1744,
+      "src/renderer/src/store/slices/editor-markdown-link-activation.test.ts": 432,
+      "src/renderer/src/store/slices/editor-markdown-view-state.test.ts": 273,
+      "src/renderer/src/store/slices/editor-open-diff.test.ts": 567,
+      "src/renderer/src/store/slices/editor-preview-tab-setting.test.ts": 318,
+      "src/renderer/src/store/slices/editor-read-only-tabs.test.ts": 391,
+      "src/renderer/src/store/slices/editor-recently-closed-tabs.test.ts": 635,
+      "src/renderer/src/store/slices/editor-rekey-open-files.test.ts": 918,
+      "src/renderer/src/store/slices/editor-remote-branch-actions.test.ts": 1644,
+      "src/renderer/src/store/slices/editor-rich-markdown-size-override.test.ts": 519,
+      "src/renderer/src/store/slices/editor-right-sidebar-state.test.ts": 451,
+      "src/renderer/src/store/slices/editor-session-duplicate-restore.test.ts": 1199,
+      "src/renderer/src/store/slices/editor-state-worktree-purge-leak.test.ts": 1615,
+      "src/renderer/src/store/slices/editor-tab-placement.test.ts": 440,
+      "src/renderer/src/store/slices/editor/actions/editor-cursor-line.test.ts": 537,
+      "src/renderer/src/store/slices/editor/actions/editor-draft-state.test.ts": 351,
+      "src/renderer/src/store/slices/editor/actions/markdown-preview-actions.test.ts": 121,
+      "src/renderer/src/store/slices/editor/file-ids/hydrated-editor-file-index.test.ts": 788,
+      "src/renderer/src/store/slices/editor/file-ids/hydrated-editor-projections.test.ts": 367,
+      "src/renderer/src/store/slices/editor/git/git-status-reconciliation.perf.test.ts": 71,
+      "src/renderer/src/store/slices/empty-update-notifications.test.ts": 1193,
+      "src/renderer/src/store/slices/folder-workspace-activation-and-activity.test.ts": 1724,
+      "src/renderer/src/store/slices/folder-workspace-diff-comments.test.ts": 540,
+      "src/renderer/src/store/slices/folder-workspace-owner-routed-mutations.test.ts": 1058,
+      "src/renderer/src/store/slices/generation-records-worktree-removal-leak.test.ts": 1546,
+      "src/renderer/src/store/slices/github-branch-mismatched-linked-pr.test.ts": 232,
+      "src/renderer/src/store/slices/github-cache-eviction-and-bounds.test.ts": 472,
+      "src/renderer/src/store/slices/github-checks-cache.test.ts": 227,
+      "src/renderer/src/store/slices/github-checks.test.ts": 49,
+      "src/renderer/src/store/slices/github-issue-source-indicator-suppression.test.ts": 261,
+      "src/renderer/src/store/slices/github-issue-state-machine.test.ts": 219,
+      "src/renderer/src/store/slices/github-pr-branch-coordinator-events.test.ts": 182,
+      "src/renderer/src/store/slices/github-pr-branch-direct-refresh-scope.test.ts": 183,
+      "src/renderer/src/store/slices/github-pr-branch-fallback-results.test.ts": 224,
+      "src/renderer/src/store/slices/github-pr-branch-hosted-review-cache.test.ts": 218,
+      "src/renderer/src/store/slices/github-pr-branch-linked-pr-divergence.test.ts": 195,
+      "src/renderer/src/store/slices/github-pr-checks-fetch.test.ts": 260,
+      "src/renderer/src/store/slices/github-pr-comments.test.ts": 338,
+      "src/renderer/src/store/slices/github-pr-refresh-host-guard.test.ts": 165,
+      "src/renderer/src/store/slices/github-pr-refresh-hosted-review-cache-leak.test.ts": 878,
+      "src/renderer/src/store/slices/github-pr-refresh-owner-routing.test.ts": 387,
+      "src/renderer/src/store/slices/github-pr-refresh-sequences-leak.test.ts": 132,
+      "src/renderer/src/store/slices/github-pr-refresh-states-leak.test.ts": 4096,
+      "src/renderer/src/store/slices/github-project-request-coordination.test.ts": 199,
+      "src/renderer/src/store/slices/github-project-row-owner.test.ts": 58,
+      "src/renderer/src/store/slices/github-project-view-tables.test.ts": 260,
+      "src/renderer/src/store/slices/github-provider-request-concurrency.test.ts": 214,
+      "src/renderer/src/store/slices/github-refresh-sweep.test.ts": 487,
+      "src/renderer/src/store/slices/github-repo-lookup-index.test.ts": 42,
+      "src/renderer/src/store/slices/github-review-thread-actions.test.ts": 105,
+      "src/renderer/src/store/slices/github-work-item-cache-identity.test.ts": 165,
+      "src/renderer/src/store/slices/github-work-items-error-envelope.test.ts": 211,
+      "src/renderer/src/store/slices/github-work-items-pagination.test.ts": 147,
+      "src/renderer/src/store/slices/github-work-items-query-bounds.test.ts": 43,
+      "src/renderer/src/store/slices/github-work-items-runtime-routing.test.ts": 433,
+      "src/renderer/src/store/slices/github-worktree-refresh-if-stale.test.ts": 251,
+      "src/renderer/src/store/slices/hosted-review-cache-race.test.ts": 63,
+      "src/renderer/src/store/slices/hosted-review-cache.test.ts": 112,
+      "src/renderer/src/store/slices/hosted-review.test.ts": 74,
+      "src/renderer/src/store/slices/jira.test.ts": 234,
+      "src/renderer/src/store/slices/linear-credential-error-recovery.test.ts": 124,
+      "src/renderer/src/store/slices/linear-invalidation.test.ts": 174,
+      "src/renderer/src/store/slices/linear-issue-cache-refresh.test.ts": 190,
+      "src/renderer/src/store/slices/linear-scoped-collection-cache.test.ts": 220,
+      "src/renderer/src/store/slices/linear-source-context-cache-scope.test.ts": 257,
+      "src/renderer/src/store/slices/linear.test.ts": 172,
+      "src/renderer/src/store/slices/local-detected-agent-state.test.ts": 217,
+      "src/renderer/src/store/slices/memory.test.ts": 44,
+      "src/renderer/src/store/slices/native-chat-launch-draft-teardown.test.ts": 1308,
+      "src/renderer/src/store/slices/new-issue-draft.test.ts": 32,
+      "src/renderer/src/store/slices/new-markdown.test.ts": 548,
+      "src/renderer/src/store/slices/orca-profiles-auth-actions-connect-overlap.test.ts": 1110,
+      "src/renderer/src/store/slices/orca-profiles-auth-actions.test.ts": 1336,
+      "src/renderer/src/store/slices/orca-profiles.test.ts": 1591,
+      "src/renderer/src/store/slices/pane-column-split-drop-no-op.test.ts": 36,
+      "src/renderer/src/store/slices/pane-foreground-agent.test.ts": 1584,
+      "src/renderer/src/store/slices/persisted-ui-write-baseline.test.ts": 31,
+      "src/renderer/src/store/slices/pinned-tab-close-confirm.test.ts": 46,
+      "src/renderer/src/store/slices/preflight.test.ts": 198,
+      "src/renderer/src/store/slices/project-group-removal-targets.test.ts": 73,
+      "src/renderer/src/store/slices/purge-stale-runtime-host-ownership.test.ts": 979,
+      "src/renderer/src/store/slices/purge-stale-runtime-host-state.test.ts": 1687,
+      "src/renderer/src/store/slices/rate-limits.test.ts": 40,
+      "src/renderer/src/store/slices/readopted-ssh-worktree-rows.test.ts": 55,
+      "src/renderer/src/store/slices/recently-closed-tabs.test.ts": 1723,
+      "src/renderer/src/store/slices/remote-server-updates.integration.test.ts": 239,
+      "src/renderer/src/store/slices/repo-identity-reconcile.test.ts": 55,
+      "src/renderer/src/store/slices/repo-owner-cache-identity.test.ts": 36,
+      "src/renderer/src/store/slices/repo-reorder-host-split.test.ts": 29,
+      "src/renderer/src/store/slices/repos-add-races.test.ts": 934,
+      "src/renderer/src/store/slices/repos-all-hosts-folder-workspaces.test.ts": 774,
+      "src/renderer/src/store/slices/repos-all-hosts-generation.test.ts": 1525,
+      "src/renderer/src/store/slices/repos-all-hosts.test.ts": 1100,
+      "src/renderer/src/store/slices/repos-catalog-merge-identity.test.ts": 1706,
+      "src/renderer/src/store/slices/repos-cross-host-project-collisions.test.ts": 1577,
+      "src/renderer/src/store/slices/repos-cross-host-refresh-identity.test.ts": 1132,
+      "src/renderer/src/store/slices/repos-ephemeral-vm-cleanup-retention.test.ts": 1217,
+      "src/renderer/src/store/slices/repos-host-identity-routing.test.ts": 1791,
+      "src/renderer/src/store/slices/repos-manual-order-hydration.test.ts": 1316,
+      "src/renderer/src/store/slices/repos-module-lifetime-coordinators.test.ts": 1062,
+      "src/renderer/src/store/slices/repos-nested-import-refresh-failures.test.ts": 1660,
+      "src/renderer/src/store/slices/repos-nested-ssh-projection.test.ts": 1438,
+      "src/renderer/src/store/slices/repos-onboarding-folder-startup.test.ts": 1911,
+      "src/renderer/src/store/slices/repos-paired-runtime-add.test.ts": 1182,
+      "src/renderer/src/store/slices/repos-project-group-create-race.test.ts": 1670,
+      "src/renderer/src/store/slices/repos-project-groups-delete.test.ts": 1213,
+      "src/renderer/src/store/slices/repos-project-groups-owner-routing.test.ts": 1649,
+      "src/renderer/src/store/slices/repos-project-groups.test.ts": 2702,
+      "src/renderer/src/store/slices/repos-project-host-capability.test.ts": 1491,
+      "src/renderer/src/store/slices/repos-project-host-lifecycle.test.ts": 1516,
+      "src/renderer/src/store/slices/repos-project-runtime.test.ts": 1510,
+      "src/renderer/src/store/slices/repos-refresh-identity.test.ts": 1727,
+      "src/renderer/src/store/slices/repos-remove-missing-remote-project.test.ts": 1182,
+      "src/renderer/src/store/slices/repos-remove-project-purge-leak.test.ts": 1574,
+      "src/renderer/src/store/slices/repos-runtime-project-groups.test.ts": 1141,
+      "src/renderer/src/store/slices/repos-runtime-visibility-defaults.test.ts": 1266,
+      "src/renderer/src/store/slices/repos-selected-owner-routing.test.ts": 1652,
+      "src/renderer/src/store/slices/repos-setup-script-dismissals.test.ts": 1196,
+      "src/renderer/src/store/slices/repos-shared-project-badge-color.test.ts": 1489,
+      "src/renderer/src/store/slices/repos-ssh-host-reconciliation.test.ts": 1869,
+      "src/renderer/src/store/slices/repos-stale-fetch.test.ts": 1671,
+      "src/renderer/src/store/slices/repos-update-serialization.test.ts": 1181,
+      "src/renderer/src/store/slices/repos.runtime-fallback.test.ts": 1080,
+      "src/renderer/src/store/slices/repos.test.ts": 1828,
+      "src/renderer/src/store/slices/restored-editor-owner-reparent.test.ts": 2296,
+      "src/renderer/src/store/slices/runtime-catalog-merge-removed-env-guard.test.ts": 964,
+      "src/renderer/src/store/slices/runtime-environment-ssh.test.ts": 1253,
+      "src/renderer/src/store/slices/runtime-host-purge-session-partition-split.test.ts": 1218,
+      "src/renderer/src/store/slices/runtime-host-status-entry-parity.test.ts": 27,
+      "src/renderer/src/store/slices/runtime-pane-title-sort-epoch.test.ts": 1555,
+      "src/renderer/src/store/slices/runtime-status-catalog-identity.test.ts": 1572,
+      "src/renderer/src/store/slices/runtime-status-first-publication.test.ts": 231,
+      "src/renderer/src/store/slices/runtime-status-reconnect-connection-generation.test.ts": 940,
+      "src/renderer/src/store/slices/runtime-status-refresh-diagnostics.test.ts": 43,
+      "src/renderer/src/store/slices/runtime-status-restored-browser-host-attach.test.ts": 85,
+      "src/renderer/src/store/slices/runtime-status-skill-cache-eviction.test.ts": 1361,
+      "src/renderer/src/store/slices/runtime-status-snapshot.test.ts": 159,
+      "src/renderer/src/store/slices/runtime-status.test.ts": 744,
+      "src/renderer/src/store/slices/runtime-switch-settings-persistence.test.ts": 1535,
+      "src/renderer/src/store/slices/selected-host-active-workspace-identity.test.ts": 1441,
+      "src/renderer/src/store/slices/set-runtime-environments-purge-wiring.test.ts": 1292,
+      "src/renderer/src/store/slices/settings-owner-hydration-write-fence.test.ts": 1693,
+      "src/renderer/src/store/slices/settings-search-state.test.ts": 28,
+      "src/renderer/src/store/slices/settings.test.ts": 1774,
+      "src/renderer/src/store/slices/sparse-presets-repo-removal-purge-leak.test.ts": 1003,
+      "src/renderer/src/store/slices/sparse-presets.test.ts": 154,
+      "src/renderer/src/store/slices/ssh-target-cleanup.test.ts": 1183,
+      "src/renderer/src/store/slices/ssh.test.ts": 1594,
+      "src/renderer/src/store/slices/stale-runtime-host-rows.test.ts": 66,
+      "src/renderer/src/store/slices/store-active-worktree-selection.test.ts": 1363,
+      "src/renderer/src/store/slices/store-active-worktree-split-groups.test.ts": 936,
+      "src/renderer/src/store/slices/store-active-worktree-tab-close.test.ts": 1825,
+      "src/renderer/src/store/slices/store-active-worktree-terminal-creation.test.ts": 1764,
+      "src/renderer/src/store/slices/store-create-tab-id-hint.test.ts": 1193,
+      "src/renderer/src/store/slices/store-session-browser-hydration.test.ts": 1304,
+      "src/renderer/src/store/slices/store-session-cascades.test.ts": 1595,
+      "src/renderer/src/store/slices/store-session-editor-hydration.test.ts": 1660,
+      "src/renderer/src/store/slices/store-session-terminal-activity.test.ts": 1743,
+      "src/renderer/src/store/slices/store-session-terminal-reconnect.test.ts": 1259,
+      "src/renderer/src/store/slices/store-session-workspace-hydration.test.ts": 1696,
+      "src/renderer/src/store/slices/store-sleep-agent-status-retention.test.ts": 1821,
+      "src/renderer/src/store/slices/store-sleep-exact-runtime-stop.test.ts": 1576,
+      "src/renderer/src/store/slices/store-sleep-pane-hibernation.test.ts": 4925,
+      "src/renderer/src/store/slices/store-sleep-runtime-convergence.test.ts": 2006,
+      "src/renderer/src/store/slices/store-sleep-shutdown-order.test.ts": 1064,
+      "src/renderer/src/store/slices/store-worktree-removal-cascade.test.ts": 1619,
+      "src/renderer/src/store/slices/superseded-ssh-repo-rows.test.ts": 47,
+      "src/renderer/src/store/slices/tab-group-reference-repair.test.ts": 44,
+      "src/renderer/src/store/slices/tab-group-state.test.ts": 48,
+      "src/renderer/src/store/slices/tab-view-mode.test.ts": 1209,
+      "src/renderer/src/store/slices/tab-worktree-orphan-map-purge-leak.test.ts": 1020,
+      "src/renderer/src/store/slices/tabs-empty-split-activation.test.ts": 1261,
+      "src/renderer/src/store/slices/tabs-hydration-generated-title.test.ts": 30,
+      "src/renderer/src/store/slices/tabs-hydration-group-validation.test.ts": 74,
+      "src/renderer/src/store/slices/tabs-hydration.test.ts": 40,
+      "src/renderer/src/store/slices/tabs-label-and-pin-state.test.ts": 963,
+      "src/renderer/src/store/slices/tabs-model-reconciliation.test.ts": 1467,
+      "src/renderer/src/store/slices/tabs-open-close-lifecycle.test.ts": 1598,
+      "src/renderer/src/store/slices/tabs-pane-layout-operations.test.ts": 1646,
+      "src/renderer/src/store/slices/tabs-session-hydration.test.ts": 1685,
+      "src/renderer/src/store/slices/tabs-unread-and-focus.test.ts": 931,
+      "src/renderer/src/store/slices/tabs/hydrated-workspace-reconciliation-batch.test.ts": 1267,
+      "src/renderer/src/store/slices/tabs/tab-selection-contract.test.ts": 79,
+      "src/renderer/src/store/slices/tabs/tabs-reconciliation-batch-identity.test.ts": 1578,
+      "src/renderer/src/store/slices/task-creation-drafts.test.ts": 57,
+      "src/renderer/src/store/slices/terminal-helpers.test.ts": 83,
+      "src/renderer/src/store/slices/terminal-input-activity-store-write.test.ts": 1592,
+      "src/renderer/src/store/slices/terminal-layout-pty-ownership.test.ts": 1199,
+      "src/renderer/src/store/slices/terminal-orphan-helpers.test.ts": 157,
+      "src/renderer/src/store/slices/terminal-pane-detach-agent-identity.test.ts": 1531,
+      "src/renderer/src/store/slices/terminal-pane-detach-agent-retention.test.ts": 1305,
+      "src/renderer/src/store/slices/terminal-pane-retirement-ownership.test.ts": 187,
+      "src/renderer/src/store/slices/terminal-pty-identity-replacement.test.ts": 1171,
+      "src/renderer/src/store/slices/terminal-quick-command-hosts.test.ts": 1465,
+      "src/renderer/src/store/slices/terminal-startup-command-retention.test.ts": 1601,
+      "src/renderer/src/store/slices/terminal-tab-id-hydration.test.ts": 1215,
+      "src/renderer/src/store/slices/terminal-tab-owner-index.test.ts": 42,
+      "src/renderer/src/store/slices/terminal-tab-recovery-remount.test.ts": 1542,
+      "src/renderer/src/store/slices/terminal-tab-retirement-store.test.ts": 1666,
+      "src/renderer/src/store/slices/terminal-tab-retirement.test.ts": 195,
+      "src/renderer/src/store/slices/terminal-tab-title-batch.test.ts": 1100,
+      "src/renderer/src/store/slices/terminal-write-identity-bailouts.test.ts": 1607,
+      "src/renderer/src/store/slices/terminals-explicit-empty-hydration.test.ts": 1078,
+      "src/renderer/src/store/slices/terminals-hydration-canonical-pty-overlap.test.ts": 1366,
+      "src/renderer/src/store/slices/terminals-hydration-canonical-rows.test.ts": 1490,
+      "src/renderer/src/store/slices/terminals-hydration.test.ts": 2826,
+      "src/renderer/src/store/slices/ui-acknowledge-agents-clock-skew.test.ts": 355,
+      "src/renderer/src/store/slices/ui-agent-send-target.test.ts": 413,
+      "src/renderer/src/store/slices/ui-contextual-tours.test.ts": 211,
+      "src/renderer/src/store/slices/ui-feature-interactions.test.ts": 408,
+      "src/renderer/src/store/slices/ui-hydration-view-layout.test.ts": 224,
+      "src/renderer/src/store/slices/ui-hydration-workspace-cleanup-browse.test.ts": 284,
+      "src/renderer/src/store/slices/ui-hydration-workspace-preferences.test.ts": 462,
+      "src/renderer/src/store/slices/ui-modal-slot-dismissal.test.ts": 580,
+      "src/renderer/src/store/slices/ui-new-workspace-draft.test.ts": 247,
+      "src/renderer/src/store/slices/ui-notice-dismissals.test.ts": 465,
+      "src/renderer/src/store/slices/ui-page-navigation.test.ts": 403,
+      "src/renderer/src/store/slices/ui/ui-slice-surface-actions.test.ts": 1254,
+      "src/renderer/src/store/slices/usage-snapshot-refresh.benchmark.test.ts": 55,
+      "src/renderer/src/store/slices/usage-web-client-fallback.test.ts": 51,
+      "src/renderer/src/store/slices/workspace-cleanup-browse.test.ts": 62,
+      "src/renderer/src/store/slices/workspace-cleanup-cache-hydration.test.ts": 369,
+      "src/renderer/src/store/slices/workspace-cleanup-enrichment-performance.test.ts": 404,
+      "src/renderer/src/store/slices/workspace-cleanup-host-qualified-list-state.test.ts": 1418,
+      "src/renderer/src/store/slices/workspace-cleanup-local-evidence-invariants.test.ts": 196,
+      "src/renderer/src/store/slices/workspace-cleanup-removal-preflight.test.ts": 260,
+      "src/renderer/src/store/slices/workspace-cleanup-scan-progress-boundary.test.ts": 64,
+      "src/renderer/src/store/slices/workspace-cleanup-scan-progress.test.ts": 818,
+      "src/renderer/src/store/slices/workspace-cleanup-unverified-removal-consent.test.ts": 138,
+      "src/renderer/src/store/slices/workspace-cleanup-wrong-host-removal-guard.test.ts": 1879,
+      "src/renderer/src/store/slices/workspace-cleanup-wrong-host-removal.test.ts": 1391,
+      "src/renderer/src/store/slices/workspace-document-title-refresh.test.ts": 1426,
+      "src/renderer/src/store/slices/workspace-space.test.ts": 40,
+      "src/renderer/src/store/slices/worktree-by-id-index.test.ts": 52,
+      "src/renderer/src/store/slices/worktree-catalog-reconciliation.test.ts": 38,
+      "src/renderer/src/store/slices/worktree-helpers.test.ts": 55,
+      "src/renderer/src/store/slices/worktree-listing-branch-switch.test.ts": 52,
+      "src/renderer/src/store/slices/worktree-meta-update-application.test.ts": 71,
+      "src/renderer/src/store/slices/worktree-nav-history-view-entries.test.ts": 68,
+      "src/renderer/src/store/slices/worktree-nav-history.test.ts": 51,
+      "src/renderer/src/store/slices/worktree-removal-maps-leak.test.ts": 1074,
+      "src/renderer/src/store/slices/worktree-sleep-intent-lifecycle.test.ts": 1593,
+      "src/renderer/src/store/slices/worktree-terminal-removal-teardown.test.ts": 1486,
+      "src/renderer/src/store/slices/worktree-visibility-owner-settings.test.ts": 67,
+      "src/renderer/src/store/slices/worktree-visibility-settings-write.test.ts": 1508,
+      "src/renderer/src/store/slices/worktrees-activity-persistence.test.ts": 937,
+      "src/renderer/src/store/slices/worktrees-create-base-status.test.ts": 516,
+      "src/renderer/src/store/slices/worktrees-create-parent-pick.test.ts": 587,
+      "src/renderer/src/store/slices/worktrees-fetch-listing-merge.test.ts": 520,
+      "src/renderer/src/store/slices/worktrees-fetch-owner-routing.test.ts": 1805,
+      "src/renderer/src/store/slices/worktrees-fetch-persisted-metadata-fallback.test.ts": 566,
+      "src/renderer/src/store/slices/worktrees-fetch-refresh-coalescing.test.ts": 689,
+      "src/renderer/src/store/slices/worktrees-fetch-remote-lineage.test.ts": 377,
+      "src/renderer/src/store/slices/worktrees-fetch-removal-purge.test.ts": 920,
+      "src/renderer/src/store/slices/worktrees-fetch-stale-catalog-version.test.ts": 629,
+      "src/renderer/src/store/slices/worktrees-git-identity-branch-title.test.ts": 515,
+      "src/renderer/src/store/slices/worktrees-git-identity-review-clear-persistence.test.ts": 1035,
+      "src/renderer/src/store/slices/worktrees-hydration-purge.test.ts": 604,
+      "src/renderer/src/store/slices/worktrees-identity-migration.test.ts": 1146,
+      "src/renderer/src/store/slices/worktrees-lineage-state.test.ts": 642,
+      "src/renderer/src/store/slices/worktrees-linked-review-push-target.test.ts": 506,
+      "src/renderer/src/store/slices/worktrees-metadata-persistence.test.ts": 853,
+      "src/renderer/src/store/slices/worktrees-pending-creation-state.test.ts": 915,
+      "src/renderer/src/store/slices/worktrees-purge-terminal-state.test.ts": 442,
+      "src/renderer/src/store/slices/worktrees-remote-runtime-create.test.ts": 749,
+      "src/renderer/src/store/slices/worktrees-remote-runtime-removal.test.ts": 909,
+      "src/renderer/src/store/slices/worktrees-removal-state-cleanup.test.ts": 949,
+      "src/renderer/src/store/slices/worktrees-runtime-connection-generation-fence.test.ts": 1207,
+      "src/renderer/src/store/slices/worktrees-runtime-host-metadata-retirement.test.ts": 819,
+      "src/renderer/src/store/slices/worktrees-terminal-pr-url-linking.test.ts": 729,
+      "src/renderer/src/store/slices/worktrees-unread-state.test.ts": 663,
+      "src/renderer/src/store/slices/worktrees-workspace-selection-state.test.ts": 726,
+      "src/renderer/src/store/slices/worktrees/listing/detected-worktree-meta.test.ts": 102,
+      "src/renderer/src/store/slices/worktrees/listing/detected-worktree-unavailable-reason.test.ts": 52,
+      "src/renderer/src/store/slices/worktrees/listing/stale-listing-purges-created-worktree.test.ts": 1634,
+      "src/renderer/src/store/slices/worktrees/metadata/worktree-meta-persist.test.ts": 178,
+      "src/renderer/src/store/slices/worktrees/session/worktree-identity-rename-row-worktree-ids.test.ts": 842,
+      "src/renderer/src/store/slices/worktrees/session/worktree-no-op-notifications.test.ts": 839,
+      "src/renderer/src/store/slices/worktrees/teardown/host-qualified-removal-refusal.test.ts": 673,
+      "src/renderer/src/store/slices/worktrees/teardown/record-key-omission.test.ts": 39,
+      "src/renderer/src/store/slices/worktrees/teardown/remove-worktree-map-identity.test.ts": 340,
+      "src/renderer/src/store/slices/worktrees/teardown/worktree-teardown-array-identity.test.ts": 228,
+      "src/renderer/src/store/store-identity-churn-probe.test.ts": 73,
+      "src/renderer/src/store/store-listener-census.test.ts": 32,
+      "src/renderer/src/store/terminals/restored-relay-session-identity.test.ts": 1454,
+      "src/renderer/src/store/terminals/structured-chat-tab-rename.test.ts": 1252,
+      "src/renderer/src/store/terminals/terminal-no-op-subscriber.test.ts": 1508,
+      "src/renderer/src/store/terminals/terminal-pane-expansion-write-bailout.test.tsx": 1675,
+      "src/renderer/src/store/terminals/terminal-shutdown-guards-identity.test.ts": 39,
+      "src/renderer/src/store/terminals/terminal-shutdown-map-identity.test.ts": 213,
+      "src/renderer/src/store/terminals/terminal-tab-close-map-identity.test.ts": 2043,
+      "src/renderer/src/store/terminals/terminal-tab-close-tombstone.test.ts": 1822,
+      "src/renderer/src/store/terminals/terminal-workspace-routing.scale.test.ts": 182,
+      "src/renderer/src/store/terminals/workspace-terminal-placeholders.test.ts": 102,
+      "src/renderer/src/store/worktree-diff-comments-selector.test.ts": 86,
+      "src/renderer/src/store/worktree-host-collision-index.test.ts": 53,
+      "src/renderer/src/store/worktree-visibility-defaults-by-host.test.ts": 36,
+      "src/renderer/src/web/preload-api/web-ai-vault-search-compat.test.ts": 195,
+      "src/renderer/src/web/preload-api/web-gitlab-api.test.ts": 45,
+      "src/renderer/src/web/web-clipboard-copy-fallback.test.ts": 75,
+      "src/renderer/src/web/web-clipboard-copy-terminal-selection.test.ts": 443,
+      "src/renderer/src/web/web-file-mutation-methods.test.ts": 234,
+      "src/renderer/src/web/web-pairing.test.ts": 54,
+      "src/renderer/src/web/web-preload-api-agent-providers.test.ts": 494,
+      "src/renderer/src/web/web-preload-api-clipboard.test.ts": 940,
+      "src/renderer/src/web/web-preload-api-composition.test.ts": 532,
+      "src/renderer/src/web/web-preload-api-filesystem.test.ts": 519,
+      "src/renderer/src/web/web-preload-api-git.test.ts": 455,
+      "src/renderer/src/web/web-preload-api-github.test.ts": 506,
+      "src/renderer/src/web/web-preload-api-gitlab.test.ts": 962,
+      "src/renderer/src/web/web-preload-api-keybindings.test.ts": 505,
+      "src/renderer/src/web/web-preload-api-runtime-calls.test.ts": 554,
+      "src/renderer/src/web/web-preload-api-runtime-environment.test.ts": 1261,
+      "src/renderer/src/web/web-preload-api-settings.test.ts": 1773,
+      "src/renderer/src/web/web-preload-api-ssh.test.ts": 398,
+      "src/renderer/src/web/web-preload-api-ui.test.ts": 1867,
+      "src/renderer/src/web/web-preload-api-workspace-catalog.test.ts": 1039,
+      "src/renderer/src/web/web-preload-updater-package-recovery.test.ts": 292,
+      "src/renderer/src/web/web-runtime-client-export-parity.test.ts": 214,
+      "src/renderer/src/web/web-runtime-client-file-watch-replay.test.ts": 282,
+      "src/renderer/src/web/web-runtime-client-heartbeat.test.ts": 254,
+      "src/renderer/src/web/web-runtime-client-timeout-budget.test.ts": 217,
+      "src/renderer/src/web/web-runtime-client.test.ts": 593,
+      "src/renderer/src/web/web-runtime-connection-frame-router.test.ts": 140,
+      "src/renderer/src/web/web-runtime-connection-heartbeat-unsendable-probe.test.ts": 76,
+      "src/renderer/src/web/web-runtime-direct-proxy-live.integration.test.ts": 138,
+      "src/renderer/src/web/web-runtime-status-owner.test.ts": 882,
+      "src/renderer/src/web/web-shell-paths-exist.test.ts": 34,
+      "src/renderer/src/web/web-viewport-shell.test.ts": 48,
+      "src/renderer/src/web/web-workspace-session.test.ts": 169,
+      "src/shared/absolute-dir-override.test.ts": 80,
+      "src/shared/add-repo-existing-workspaces-telemetry.test.ts": 104,
+      "src/shared/agent-cli-flag-detection.test.ts": 40,
+      "src/shared/agent-cli-install-dir-fallback.test.ts": 65,
+      "src/shared/agent-decorative-title-signature.test.ts": 54,
+      "src/shared/agent-detection.test.ts": 112,
+      "src/shared/agent-feature-install-commands.test.ts": 48,
+      "src/shared/agent-hook-endpoint-file.test.ts": 36,
+      "src/shared/agent-hook-endpoint-temp-cleanup.test.ts": 53,
+      "src/shared/agent-hook-listener-antigravity.test.ts": 102,
+      "src/shared/agent-hook-listener-claude-compatible-vendors.test.ts": 174,
+      "src/shared/agent-hook-listener-claude-subagents.test.ts": 150,
+      "src/shared/agent-hook-listener-claude-turn-state.test.ts": 112,
+      "src/shared/agent-hook-listener-codex-approval-ownership.test.ts": 174,
+      "src/shared/agent-hook-listener-codex-main-agent.test.ts": 165,
+      "src/shared/agent-hook-listener-command-code-transcript.test.ts": 126,
+      "src/shared/agent-hook-listener-extraction-characterization.test.ts": 89,
+      "src/shared/agent-hook-listener-grok-completion.test.ts": 155,
+      "src/shared/agent-hook-listener-grok.test.ts": 160,
+      "src/shared/agent-hook-listener-hermes-codex-droid.test.ts": 206,
+      "src/shared/agent-hook-listener-interactive-prompts.test.ts": 207,
+      "src/shared/agent-hook-listener-omp-approval-ownership.test.ts": 166,
+      "src/shared/agent-hook-listener-opencode-reattribution.test.ts": 154,
+      "src/shared/agent-hook-listener-opencode-session-correlation.test.ts": 44,
+      "src/shared/agent-hook-listener-opencode-session-registry.test.ts": 38,
+      "src/shared/agent-hook-listener-pi-compatible.test.ts": 89,
+      "src/shared/agent-hook-listener-relay-dependency.test.ts": 33,
+      "src/shared/agent-hook-listener-roster-retention.test.ts": 177,
+      "src/shared/agent-hook-listener-session-replacement.test.ts": 130,
+      "src/shared/agent-hook-listener-startless-child-lifecycle.test.ts": 180,
+      "src/shared/agent-hook-listener-transport.test.ts": 151,
+      "src/shared/agent-hook-listener/providers/muse-events.test.ts": 192,
+      "src/shared/agent-hook-listener/providers/zcode-events.test.ts": 107,
+      "src/shared/agent-hook-listener/transcript-reader.test.ts": 170,
+      "src/shared/agent-hook-relay.test.ts": 34,
+      "src/shared/agent-hook-request-body-memory.test.ts": 63,
+      "src/shared/agent-hook-spool-read.test.ts": 72,
+      "src/shared/agent-hook-status-cache.test.ts": 60,
+      "src/shared/agent-hook-transport-interference.test.ts": 64,
+      "src/shared/agent-image-paste.test.ts": 34,
+      "src/shared/agent-kind.test.ts": 131,
+      "src/shared/agent-launch-operation.test.ts": 43,
+      "src/shared/agent-launch-preferences.test.ts": 47,
+      "src/shared/agent-launch-remote.test.ts": 45,
+      "src/shared/agent-lead-status-fold.test.ts": 93,
+      "src/shared/agent-model-probe-spec.test.ts": 61,
+      "src/shared/agent-notification-id.test.ts": 28,
+      "src/shared/agent-process-recognition.test.ts": 139,
+      "src/shared/agent-prompt-injection.test.ts": 59,
+      "src/shared/agent-resume-argv-drop.test.ts": 87,
+      "src/shared/agent-resume-launch-command.test.ts": 87,
+      "src/shared/agent-row-conversation-name.test.ts": 51,
+      "src/shared/agent-scratch-worktrees.test.ts": 67,
+      "src/shared/agent-session-conversation-name.test.ts": 32,
+      "src/shared/agent-session-definitive-refusal.test.ts": 100,
+      "src/shared/agent-session-fence-mint-boundary.test.ts": 2032,
+      "src/shared/agent-session-journal-producer.test.ts": 36,
+      "src/shared/agent-session-journal-schemas.test.ts": 184,
+      "src/shared/agent-session-lease-adjudication.test.ts": 40,
+      "src/shared/agent-session-legacy-handoff-lease.test.ts": 89,
+      "src/shared/agent-session-mutation-envelope.test.ts": 183,
+      "src/shared/agent-session-operation-ledger.test.ts": 115,
+      "src/shared/agent-session-option-catalog-grok.test.ts": 106,
+      "src/shared/agent-session-option-catalog-omp.test.ts": 86,
+      "src/shared/agent-session-option-catalog.test.ts": 94,
+      "src/shared/agent-session-provider-handle.test.ts": 75,
+      "src/shared/agent-session-question-answer.test.ts": 38,
+      "src/shared/agent-session-restart-continuation.test.ts": 32,
+      "src/shared/agent-session-resume.test.ts": 53,
+      "src/shared/agent-session-thread-goal.test.ts": 60,
+      "src/shared/agent-session-turn-record.test.ts": 58,
+      "src/shared/agent-skill-sharing-contract.test.ts": 67,
+      "src/shared/agent-skill-sharing-gate.test.ts": 138,
+      "src/shared/agent-startup-plan-inputs.test.ts": 84,
+      "src/shared/agent-status-child-work-admission-activity.test.ts": 304,
+      "src/shared/agent-status-child-work-admission-collision.test.ts": 163,
+      "src/shared/agent-status-child-work-admission-parse.test.ts": 418,
+      "src/shared/agent-status-child-work-admission-sparse.test.ts": 228,
+      "src/shared/agent-status-child-work-admission.test.ts": 295,
+      "src/shared/agent-status-child-work-codec-boundary.test.ts": 740,
+      "src/shared/agent-status-child-work-legacy-golden.test.ts": 57,
+      "src/shared/agent-status-child-work-legality.test.ts": 234,
+      "src/shared/agent-status-child-work-lifetime.test.ts": 216,
+      "src/shared/agent-status-child-work-liveness.test.ts": 28,
+      "src/shared/agent-status-child-work-projection.test.ts": 54,
+      "src/shared/agent-status-child-work-reconciliation.test.ts": 439,
+      "src/shared/agent-status-child-work-view.test.ts": 128,
+      "src/shared/agent-status-child-work.test.ts": 192,
+      "src/shared/agent-status-legacy-adapter.test.ts": 38,
+      "src/shared/agent-status-legacy-ingress-ratchet.test.ts": 5709,
+      "src/shared/agent-status-observation.test.ts": 55,
+      "src/shared/agent-status-osc-pending-retention.test.ts": 96,
+      "src/shared/agent-status-osc-scan-budget.test.ts": 340,
+      "src/shared/agent-status-osc-split-frame-scan-budget.test.ts": 170,
+      "src/shared/agent-status-osc.test.ts": 65,
+      "src/shared/agent-status-run-alias-index.test.ts": 245,
+      "src/shared/agent-status-run-capability.test.ts": 42,
+      "src/shared/agent-status-run.test.ts": 64,
+      "src/shared/agent-status-serving-readiness.test.ts": 32,
+      "src/shared/agent-status-store-bounds.test.ts": 2561,
+      "src/shared/agent-status-store-byte-budget.test.ts": 1188,
+      "src/shared/agent-status-store-in-place.test.ts": 40880,
+      "src/shared/agent-status-store-reopen.test.ts": 168,
+      "src/shared/agent-status-store-scaling.test.ts": 904,
+      "src/shared/agent-status-store.test.ts": 361,
+      "src/shared/agent-status-subject.test.ts": 174,
+      "src/shared/agent-status-transport-envelope.test.ts": 295,
+      "src/shared/agent-status-types.test.ts": 130,
+      "src/shared/agent-tab-title.test.ts": 76,
+      "src/shared/agent-terminal-status-equivalence.test.ts": 59,
+      "src/shared/agent-title-agy-gemini-collision.test.ts": 70,
+      "src/shared/agent-title-decoration.test.ts": 48,
+      "src/shared/agent-title-evidence.test.ts": 122,
+      "src/shared/agent-title-identity-characterization.test.ts": 73,
+      "src/shared/agent-tui-input-clear.test.ts": 39,
+      "src/shared/ai-vault-resume-command.test.ts": 68,
+      "src/shared/ai-vault-resume-preparation.test.ts": 49,
+      "src/shared/ai-vault-scan-error-message.test.ts": 26,
+      "src/shared/ai-vault-search-contract.test.ts": 138,
+      "src/shared/ai-vault-search-query-operators.test.ts": 70,
+      "src/shared/ai-vault-search-scope-contract.test.ts": 178,
+      "src/shared/ai-vault-search-settings.test.ts": 115,
+      "src/shared/ai-vault-session-depth.test.ts": 65,
       "src/shared/ai-vault-session-filters.test.ts": 172,
-      "src/shared/ai-vault-types.test.ts": 9,
-      "src/shared/app-version.test.ts": 12,
-      "src/shared/artifact-sharing-gate.test.ts": 9,
-      "src/shared/automation-execution-target.test.ts": 11,
-      "src/shared/automation-host-filter.test.ts": 5,
-      "src/shared/automation-legacy-list-partition.test.ts": 8,
-      "src/shared/automation-list-response.test.ts": 10,
-      "src/shared/automation-list-scope.test.ts": 19,
-      "src/shared/automation-owner-key.test.ts": 10,
-      "src/shared/automation-owner-precondition.test.ts": 11,
-      "src/shared/automation-run-identity.test.ts": 5,
-      "src/shared/automation-run-retention.test.ts": 19,
-      "src/shared/automation-schedules.test.ts": 183,
-      "src/shared/automation-usage-summary.test.ts": 9,
-      "src/shared/base-ref-search-result.test.ts": 6,
-      "src/shared/binary-file-extensions.test.ts": 4,
-      "src/shared/bounded-map.test.ts": 17,
-      "src/shared/branch-name-from-work.test.ts": 11,
-      "src/shared/branch-prefix.test.ts": 12,
-      "src/shared/browser-client-automation-protocol.test.ts": 12,
-      "src/shared/browser-client-host-id-argument.test.ts": 6,
-      "src/shared/browser-client-host-protocol.test.ts": 241,
-      "src/shared/browser-client-host-reconciliation-protocol.test.ts": 22,
-      "src/shared/browser-client-hosting-eligibility.test.ts": 9,
-      "src/shared/browser-cookie-import-sources.test.ts": 5,
-      "src/shared/browser-grab-types.test.ts": 11,
-      "src/shared/browser-network-capabilities.test.ts": 10,
-      "src/shared/browser-network-tunnel-protocol.test.ts": 11,
-      "src/shared/browser-network-tunnel-stream-framing.test.ts": 1908,
-      "src/shared/browser-screencast-protocol.test.ts": 7,
-      "src/shared/browser-url.test.ts": 14,
-      "src/shared/cheap-process-table-snapshot.test.ts": 10,
-      "src/shared/check-job-log-tail-slice.test.ts": 7,
-      "src/shared/child-process/child-process-import-boundary.test.ts": 9,
-      "src/shared/child-process/close-process-registry.test.ts": 8,
-      "src/shared/child-process/process-tree-termination.test.ts": 16,
-      "src/shared/child-process/retryable-process-exit-proof.test.ts": 8,
-      "src/shared/child-process/run-process-termination-failure.test.ts": 12,
-      "src/shared/child-process/run-process.test.ts": 7159,
-      "src/shared/child-process/windows-cmd-shim-resolution.test.ts": 15,
-      "src/shared/child-process/windows-command-line.test.ts": 14,
-      "src/shared/child-process/windows-console-visibility.test.ts": 7,
-      "src/shared/claimed-agent-pty-owner.test.ts": 33,
-      "src/shared/claude-agent-teams-tmux-compat.test.ts": 8,
-      "src/shared/claude-background-task-status.test.ts": 36,
-      "src/shared/claude-model-list-probe.test.ts": 14,
-      "src/shared/claude-statusline-rate-limits.test.ts": 7,
-      "src/shared/claude-subagent-roster.test.ts": 17,
-      "src/shared/claude-subagent-row-lifecycle.test.ts": 14,
-      "src/shared/cli-argument-boundary.test.ts": 5,
-      "src/shared/cli-runtime-pairing-boundary.test.ts": 182,
-      "src/shared/cli-workspace-provenance.test.ts": 6,
-      "src/shared/client-environment-info.test.ts": 10,
-      "src/shared/clipboard-image.test.ts": 9,
-      "src/shared/clipboard-text.test.ts": 29,
-      "src/shared/closed-terminal-tab-tombstones.test.ts": 12,
-      "src/shared/cloud-service-url.test.ts": 4,
-      "src/shared/codex-auth-errors.test.ts": 22,
-      "src/shared/codex-pet-sprite-defaults.test.ts": 12,
-      "src/shared/codex-reset-credit-attempt-ledger.test.ts": 16,
-      "src/shared/codex-reset-credit-scope.test.ts": 8,
-      "src/shared/codex-startup-delivery.test.ts": 8,
-      "src/shared/codex-subagent-poll-scheduler.test.ts": 14,
-      "src/shared/codex-subagent-rollout-lifecycle.test.ts": 18,
-      "src/shared/codex-subagent-roster.test.ts": 6,
-      "src/shared/codex-subagent-transcript.test.ts": 18,
-      "src/shared/combined-diff-file-tree-width.test.ts": 6,
-      "src/shared/command-code-output-status.test.ts": 155,
-      "src/shared/command-code-turn-boundary.test.ts": 6,
-      "src/shared/command-token-scanner.test.ts": 11,
-      "src/shared/commit-message-agent-spec.test.ts": 38,
-      "src/shared/commit-message-generation.test.ts": 12,
-      "src/shared/commit-message-plan.test.ts": 21,
-      "src/shared/commit-message-prompt.test.ts": 28,
-      "src/shared/computer-awake-mode.test.ts": 7,
-      "src/shared/computer-use-error-recovery.test.ts": 6,
-      "src/shared/computer-use-key-spec.test.ts": 7,
-      "src/shared/constants.test.ts": 15,
-      "src/shared/contextual-tours.test.ts": 16,
-      "src/shared/crash-reporting.test.ts": 18,
-      "src/shared/cross-platform-path-guards.test.ts": 1239,
-      "src/shared/cross-platform-path.test.ts": 17,
-      "src/shared/daemon-adoption-telemetry.test.ts": 10,
-      "src/shared/direct-ssh-reconnect-telemetry-schema.test.ts": 17,
-      "src/shared/doc-preview-file-access.test.ts": 36,
-      "src/shared/doc-preview-scheme.test.ts": 8,
-      "src/shared/draft-paste-ready-scanner-grok-trace-replay.test.ts": 7,
-      "src/shared/draft-paste-ready-scanner.test.ts": 19,
-      "src/shared/emoji-shortcode-catalog.lazy.test.ts": 42,
-      "src/shared/emulator-keyboard-frame.test.ts": 7,
-      "src/shared/emulator-touch-frame.test.ts": 5,
-      "src/shared/ephemeral-setup-terminal-worktree-id.test.ts": 6,
-      "src/shared/ephemeral-vm-recipe-checkout-mode.test.ts": 7,
-      "src/shared/ephemeral-vm-recipe-doctor.test.ts": 10,
-      "src/shared/ephemeral-vm-recipe-process.test.ts": 154,
-      "src/shared/ephemeral-vm-recipe-repo-url.test.ts": 7,
-      "src/shared/ephemeral-vm-recipes.test.ts": 23,
-      "src/shared/ephemeral-vm-runtime-feature-sorting.test.ts": 145,
-      "src/shared/ephemeral-vm-runtime-store-rollback.test.ts": 341,
-      "src/shared/ephemeral-vm-runtime-store.test.ts": 41,
-      "src/shared/event-loop-yield.test.ts": 28,
-      "src/shared/execution-host-registry.test.ts": 15,
-      "src/shared/execution-host.test.ts": 14,
-      "src/shared/export-let-function-initializer-ban.test.ts": 2085,
-      "src/shared/external-automation-jobs-file.test.ts": 48,
-      "src/shared/external-worktree-inbox.test.ts": 11,
-      "src/shared/feature-education-telemetry.test.ts": 5,
-      "src/shared/feature-interactions.test.ts": 1489,
-      "src/shared/feature-tips.test.ts": 7,
-      "src/shared/feature-wall-tour-depth.test.ts": 5,
-      "src/shared/file-link-location.test.ts": 7,
-      "src/shared/file-name-sort.test.ts": 6,
-      "src/shared/filesystem-directory-listing-limit.test.ts": 10,
-      "src/shared/fish-binary-requirement.test.ts": 14,
-      "src/shared/folder-workspace-execution-host.test.ts": 17,
-      "src/shared/folder-workspace-worktree.test.ts": 8,
-      "src/shared/folder-workspaces.test.ts": 6,
-      "src/shared/foreground-process-ancestry-parity.test.ts": 286,
-      "src/shared/foreground-process-selection.test.ts": 11,
-      "src/shared/foreground-wrapper-agent.test.ts": 7,
-      "src/shared/generated-code-path.test.ts": 10,
-      "src/shared/git-branch-cleanup.test.ts": 17,
-      "src/shared/git-branch-compare-head.test.ts": 6,
-      "src/shared/git-branch-line-total-soft-deadline.test.ts": 3529,
-      "src/shared/git-branch-line-total.test.ts": 39,
-      "src/shared/git-capability-cache.test.ts": 10,
-      "src/shared/git-check-ignore-stdio.test.ts": 8,
-      "src/shared/git-clone-failure-message.test.ts": 26,
-      "src/shared/git-config-snapshot-runner.test.ts": 13,
-      "src/shared/git-configured-branch-target.test.ts": 11,
-      "src/shared/git-cquoted-path.test.ts": 3,
-      "src/shared/git-diff-transport-budget.test.ts": 1152,
-      "src/shared/git-discard-path-safety.test.ts": 22,
-      "src/shared/git-exec-mutation.test.ts": 10,
-      "src/shared/git-fetch-head-capability.test.ts": 6,
-      "src/shared/git-fetch-head-lock-key-derivation.test.ts": 64,
-      "src/shared/git-fetch-head-lock.test.ts": 108,
-      "src/shared/git-fork-sync.test.ts": 21,
-      "src/shared/git-history-graph.test.ts": 10,
-      "src/shared/git-history-message-allocation.test.ts": 11,
-      "src/shared/git-history-ref-display.test.ts": 9,
-      "src/shared/git-history.test.ts": 18,
-      "src/shared/git-merge-tree-capability.test.ts": 9,
-      "src/shared/git-metadata-path.test.ts": 13,
-      "src/shared/git-push-target-validation.test.ts": 6,
-      "src/shared/git-remote-error.test.ts": 36,
-      "src/shared/git-remote-identity.test.ts": 10,
-      "src/shared/git-remote-url-index.test.ts": 11,
-      "src/shared/git-rev-list-output.test.ts": 8,
-      "src/shared/git-status-branch-line-total-cache.test.ts": 12,
-      "src/shared/git-status-conflict-entries.test.ts": 10,
-      "src/shared/git-status-limit.test.ts": 6,
-      "src/shared/git-status-line-stat-inputs.test.ts": 6,
-      "src/shared/git-status-line-stats-cache.test.ts": 10,
-      "src/shared/git-status-upstream-ref.test.ts": 6,
-      "src/shared/git-uncommitted-line-stats.test.ts": 54,
-      "src/shared/git-upstream-status.test.ts": 16,
-      "src/shared/git-worktree-operation-lock.test.ts": 16,
-      "src/shared/github/api-availability.test.ts": 6,
-      "src/shared/github/project-identity.test.ts": 5,
-      "src/shared/github/project-ref-input.test.ts": 11,
-      "src/shared/github/project-roadmap-timeline.test.ts": 11,
-      "src/shared/github/pull-request-auto-merge-availability.test.ts": 6,
-      "src/shared/github/pull-request-for-branch-outcome.test.ts": 7,
-      "src/shared/github/pull-request-merge-methods.test.ts": 8,
-      "src/shared/github/repository-identity-key.test.ts": 5,
-      "src/shared/github/work-items-query-bounds.test.ts": 9,
-      "src/shared/gitlab-job-log-excerpt.test.ts": 36,
-      "src/shared/gitlab-job-trace-check-details.test.ts": 17,
-      "src/shared/gitlab-pipeline-checks.test.ts": 6,
-      "src/shared/gitlab-projects.test.ts": 10,
-      "src/shared/grok-model-list-probe.test.ts": 14,
-      "src/shared/grok-session-paths.test.ts": 21,
-      "src/shared/growing-byte-buffer.test.ts": 89,
-      "src/shared/handled-wire-discriminant.test.ts": 4,
-      "src/shared/harness-injected-user-turns.test.ts": 8,
-      "src/shared/hermes-run-ref-retention.test.ts": 6,
-      "src/shared/hook-command-source-policy.test.ts": 12,
-      "src/shared/host-balanced-listing-scaling.test.ts": 13,
-      "src/shared/host-setting-overrides.test.ts": 10,
-      "src/shared/hosted-review-creation-providers.test.ts": 4,
-      "src/shared/hosted-review-github.test.ts": 8,
-      "src/shared/hosted-review-ready-capabilities.test.ts": 5,
-      "src/shared/hosted-review-refs.test.ts": 6,
-      "src/shared/image-data-uri.test.ts": 12,
-      "src/shared/image-paste-following-text.test.ts": 5,
-      "src/shared/in-flight-promise-dedupe.test.ts": 19,
-      "src/shared/issue-link-input.test.ts": 9,
-      "src/shared/jira-issue-url.test.ts": 8,
-      "src/shared/json-text-structure-limit.test.ts": 9,
-      "src/shared/keybindings-conflicts.test.ts": 32,
-      "src/shared/keybindings-default-bindings.test.ts": 32,
-      "src/shared/keybindings-digit-index.test.ts": 12,
-      "src/shared/keybindings-double-tap.test.ts": 14,
-      "src/shared/keybindings-keyboard-layout.test.ts": 8,
-      "src/shared/keybindings-parse-cache.test.ts": 43,
-      "src/shared/keybindings-parsing.test.ts": 12,
-      "src/shared/keybindings-terminal-context.test.ts": 7,
-      "src/shared/keybindings-unassigned-actions.test.ts": 12,
-      "src/shared/linear/inline-media.test.ts": 4,
-      "src/shared/linear/issue-attribute-filter.test.ts": 9,
-      "src/shared/linear/issue-view-resume-state.test.ts": 15,
-      "src/shared/linear/links.test.ts": 7,
-      "src/shared/linear/workspace-types.test.ts": 7,
-      "src/shared/linux-proc-port-scan-limits.test.ts": 12,
-      "src/shared/local-account-runtime.test.ts": 7,
-      "src/shared/local-build-compatibility.test.ts": 5,
-      "src/shared/localhost-worktree-labels.test.ts": 8,
-      "src/shared/loose-ref-count.test.ts": 247,
-      "src/shared/macos-symbolic-hotkeys.test.ts": 14,
-      "src/shared/managed-agent-command-token.test.ts": 9,
-      "src/shared/manual-repo-order.test.ts": 12,
-      "src/shared/map-settled-with-concurrency.test.ts": 20,
-      "src/shared/map-with-concurrency.test.ts": 58,
-      "src/shared/markdown-document-listing-limits.test.ts": 5,
-      "src/shared/markdown-toc-panel-width.test.ts": 7,
-      "src/shared/mcp-config.test.ts": 29,
-      "src/shared/mobile-e2ee-v2-contract.test.ts": 15,
-      "src/shared/mobile-e2ee-v2-framing.test.ts": 13,
-      "src/shared/mobile-file-directory-limit.test.ts": 11,
-      "src/shared/mobile-markdown-document.test.ts": 8,
-      "src/shared/mobile-pairing-connection-mode.test.ts": 9,
-      "src/shared/mobile-pairing-custom-address.test.ts": 13,
-      "src/shared/mobile-push-contract.test.ts": 5,
-      "src/shared/mobile-relay-close-codes.test.ts": 4,
-      "src/shared/mobile-relay-mint-failure.test.ts": 5,
-      "src/shared/mobile-relay-pairing-offer.test.ts": 22,
-      "src/shared/mobile-relay-phone-protocol.test.ts": 12,
-      "src/shared/model-id-label.test.ts": 4,
-      "src/shared/modifier-double-tap-detector.test.ts": 10,
-      "src/shared/native-chat-agent-profiles.test.ts": 17,
-      "src/shared/native-chat-agent-support.test.ts": 7,
-      "src/shared/native-chat-ask-fifo.test.ts": 186,
-      "src/shared/native-chat-ask.test.ts": 12,
-      "src/shared/native-chat-command-envelope.test.ts": 9,
-      "src/shared/native-chat-edit-normalize.test.ts": 35,
-      "src/shared/native-chat-href-routing.test.ts": 11,
-      "src/shared/native-chat-image-transcript-markers.test.ts": 19,
-      "src/shared/native-chat-session-option-commands.test.ts": 15,
-      "src/shared/native-chat-session-option-defaults.test.ts": 15,
-      "src/shared/native-chat-session-option-snapshot.test.ts": 15,
-      "src/shared/native-chat-session-option-state.test.ts": 10,
-      "src/shared/native-chat-slash-commands.test.ts": 31,
-      "src/shared/native-chat-stream-unsubscribe.test.ts": 3,
-      "src/shared/native-chat-streaming.test.ts": 9,
-      "src/shared/native-chat-subagent-summary.test.ts": 11,
-      "src/shared/native-chat-task-list.test.ts": 11,
-      "src/shared/native-chat-tool-activity.test.ts": 11,
-      "src/shared/native-chat-tool-attribution-allocation.test.ts": 20,
-      "src/shared/native-chat-tool-icon.test.ts": 19,
-      "src/shared/native-chat-tool-identity.test.ts": 14,
-      "src/shared/native-chat-tool-pair-limit.test.ts": 74,
-      "src/shared/native-chat-tool-summary.test.ts": 13,
-      "src/shared/native-chat-transcript-retention.test.ts": 5,
-      "src/shared/native-chat-turn-activity.test.ts": 9,
-      "src/shared/native-chat-turn-status.test.ts": 13,
-      "src/shared/native-chat-types.test.ts": 4,
-      "src/shared/native-chat-unverifiable-turn-status.test.ts": 8,
-      "src/shared/native-file-drop.test.ts": 28,
-      "src/shared/nested-repo-telemetry-schema.test.ts": 18,
-      "src/shared/nested-repo-telemetry.test.ts": 15,
-      "src/shared/nested-worker-depth.test.ts": 8,
-      "src/shared/network-proxy.test.ts": 9,
-      "src/shared/network/manual-address.test.ts": 13,
-      "src/shared/network/server-share-address.test.ts": 24,
-      "src/shared/new-workspace-dialog-repo.test.ts": 5,
-      "src/shared/new-workspace/smart-workspace-url-source-results.test.ts": 10,
-      "src/shared/new-workspace/work-item-lookup-text.test.ts": 8,
-      "src/shared/new-workspace/workspace-source.test.ts": 8,
-      "src/shared/new-workspace/worktree-create-retry-policy.test.ts": 7,
-      "src/shared/node-bounded-file-reader-sync.test.ts": 4,
-      "src/shared/node-bounded-file-reader.test.ts": 14,
-      "src/shared/node-bounded-json-stringify.test.ts": 24,
-      "src/shared/node-file-content-equality.test.ts": 15,
-      "src/shared/node-markdown-document-discovery.test.ts": 8,
-      "src/shared/node-pty-spawn-helper.test.ts": 7,
-      "src/shared/node-readable-text.test.ts": 14,
-      "src/shared/node-source-copy-content-equality.test.ts": 16,
-      "src/shared/nul-delimited-fields.test.ts": 5,
-      "src/shared/nvm-default-alias.test.ts": 38,
-      "src/shared/omp-pi-semantic-title-preservation.test.ts": 25,
-      "src/shared/onboarding-tour-telemetry-events.test.ts": 12,
-      "src/shared/open-in-applications.test.ts": 8,
-      "src/shared/opencode-permission-status.test.ts": 18,
-      "src/shared/opencode-terminal-title.test.ts": 4,
-      "src/shared/orca-yaml-alias-bounds.test.ts": 27,
-      "src/shared/orca-yaml-bounds.test.ts": 22,
-      "src/shared/orchestration-ask-timeout.test.ts": 5,
-      "src/shared/orchestration-check-output.test.ts": 7,
-      "src/shared/orchestration-compatibility-evidence.test.ts": 8,
-      "src/shared/orchestration-dispatch-refusal-contract.test.ts": 10,
-      "src/shared/orchestration-fleet-attention.test.ts": 6,
-      "src/shared/orchestration-fleet-evidence-clock.test.ts": 8,
-      "src/shared/orchestration-fleet-projection.test.ts": 12,
-      "src/shared/orchestration-rpc-contract.test.ts": 12,
-      "src/shared/orchestration-task-display.test.ts": 9,
-      "src/shared/orchestration-task-summary.test.ts": 9,
-      "src/shared/orchestration-timing-budgets.test.ts": 6,
-      "src/shared/osc-title-scan-tail-retention.test.ts": 34,
-      "src/shared/osc-title-scan-tail.test.ts": 4,
-      "src/shared/osc52-clipboard-settings.test.ts": 7,
-      "src/shared/own-retained-string.test.ts": 77,
-      "src/shared/pairing-address-auto-selection.test.ts": 5,
-      "src/shared/pairing-local-ui-fields.test.ts": 6,
-      "src/shared/pairing.test.ts": 14,
-      "src/shared/pane-agent-identity-adapter.test.ts": 21,
-      "src/shared/pane-agent-identity-inventory.test.ts": 782,
-      "src/shared/pane-agent-identity-resolver.test.ts": 15,
-      "src/shared/pane-agent-identity-surface-inventory.test.ts": 1226,
-      "src/shared/pane-agent-identity-title-corpus.test.ts": 17,
-      "src/shared/pane-agent-owner.test.ts": 8,
-      "src/shared/pane-key-alias.test.ts": 6,
-      "src/shared/physical-exit-tracker.test.ts": 11,
-      "src/shared/pi-agent-kind.test.ts": 4,
-      "src/shared/pi-overlay-ui-settings.test.ts": 7,
-      "src/shared/pi-state-title-marker.test.ts": 11,
-      "src/shared/plugins/plugin-consent-fingerprint.test.ts": 14,
-      "src/shared/plugins/plugin-consent-request.test.ts": 10,
-      "src/shared/plugins/plugin-content-pack-contributions.test.ts": 16,
-      "src/shared/plugins/plugin-demo-fixture.test.ts": 16,
-      "src/shared/plugins/plugin-hostile-fixture.test.ts": 4,
-      "src/shared/plugins/plugin-install-lockfile.test.ts": 10,
-      "src/shared/plugins/plugin-kill-list.test.ts": 47,
-      "src/shared/plugins/plugin-language-pack-artifact.test.ts": 134,
-      "src/shared/plugins/plugin-manifest.test.ts": 24,
-      "src/shared/plugins/plugin-marketplace.test.ts": 64,
-      "src/shared/plugins/plugin-panel-call-admission.test.ts": 6,
-      "src/shared/plugins/plugin-panel-message-budget.test.ts": 6,
-      "src/shared/plugins/plugin-panel-pong-frame.test.ts": 9,
-      "src/shared/plugins/plugin-panel-shell.test.ts": 7,
-      "src/shared/plugins/plugin-path-safety.test.ts": 15,
-      "src/shared/plugins/plugin-vm-recipe-artifact.test.ts": 18,
-      "src/shared/posix-wait-status.test.ts": 7,
-      "src/shared/powershell-native-argument.test.ts": 4,
-      "src/shared/pr-bot-author-overrides.test.ts": 11,
-      "src/shared/pr-check-severity-order.test.ts": 7,
-      "src/shared/pr-check-status.test.ts": 5,
-      "src/shared/pr-comment-audience.test.ts": 5,
-      "src/shared/pr-comment-groups.test.ts": 8,
-      "src/shared/pr-comment-time.test.ts": 7,
-      "src/shared/preferred-git-remote.test.ts": 6,
-      "src/shared/priority-semaphore.test.ts": 19,
-      "src/shared/process-output-field-scanner.test.ts": 6,
-      "src/shared/process-table-snapshot.test.ts": 72,
-      "src/shared/project-catalog-row-normalization.test.ts": 9,
-      "src/shared/project-execution-runtime.test.ts": 15,
-      "src/shared/project-groups.test.ts": 124,
-      "src/shared/project-host-setup-projection.test.ts": 30,
-      "src/shared/project-identity-succession.test.ts": 30,
-      "src/shared/promise-settlement-waiters.test.ts": 337,
-      "src/shared/protocol-compat.test.ts": 13,
-      "src/shared/pty-consumer-session.test.ts": 17,
-      "src/shared/pty-delivery-diagnostics.test.ts": 14,
-      "src/shared/pty-liveness-verdict.test.ts": 6,
-      "src/shared/pty-owner-backend.test.ts": 4,
-      "src/shared/pty-slave-line-discipline-echo.test.ts": 13,
-      "src/shared/pty-startup-ingress-live-query-reply.test.ts": 23,
-      "src/shared/pty-startup-ingress.test.ts": 60,
-      "src/shared/pty-startup-reply-echo-shapes.test.ts": 14,
-      "src/shared/published-pane-agent-identity.test.ts": 20,
-      "src/shared/pull-request-generation.test.ts": 11,
-      "src/shared/quick-open-directory-reader.test.ts": 11,
-      "src/shared/quick-open-expansion-paths.test.ts": 30,
-      "src/shared/quick-open-filter.renderer-safety.test.ts": 6,
-      "src/shared/quick-open-filter.test.ts": 15,
-      "src/shared/quick-open-git-directory-collapse.test.ts": 51,
-      "src/shared/quick-open-listing-limits.test.ts": 14,
-      "src/shared/quick-open-readdir-memory.test.ts": 38,
-      "src/shared/quick-open-readdir-walk.test.ts": 197,
-      "src/shared/quick-open-transport-budget.test.ts": 5,
-      "src/shared/raster-image-base64-preview.test.ts": 322,
-      "src/shared/raster-image-dimensions.test.ts": 17,
-      "src/shared/raster-image-preview-limits.test.ts": 7,
-      "src/shared/rate-limit-reset-format.test.ts": 9,
-      "src/shared/rate-limit-types.test.ts": 6,
-      "src/shared/react-update-depth-attribution.test.ts": 7,
-      "src/shared/reconnect-jitter.test.ts": 5,
-      "src/shared/relay-frame-buffer.test.ts": 393,
-      "src/shared/relay-optional-artifacts.test.ts": 5,
-      "src/shared/relay-version-marker.test.ts": 5,
-      "src/shared/release-channel.test.ts": 26,
-      "src/shared/remote-foreground-evidence.test.ts": 9,
-      "src/shared/remote-pairing-address.test.ts": 18,
-      "src/shared/remote-pairing-verification.test.ts": 7,
-      "src/shared/remote-rpc-content-budget.test.ts": 89,
-      "src/shared/remote-runtime-client-error-classification.test.ts": 8,
-      "src/shared/remote-runtime-client.test.ts": 4792,
-      "src/shared/remote-runtime-memory-limits.test.ts": 110,
-      "src/shared/remote-runtime-outbound-admission.test.ts": 903,
-      "src/shared/remote-runtime-request-connection-stale.test.ts": 141,
-      "src/shared/remote-runtime-request-connection.test.ts": 100,
-      "src/shared/remote-runtime-request-frames.test.ts": 9,
-      "src/shared/remote-runtime-request-response-router.test.ts": 12,
-      "src/shared/remote-runtime-request-websocket.test.ts": 32,
-      "src/shared/remote-runtime-shared-control-boundary.test.ts": 2634,
-      "src/shared/remote-runtime-shared-control-connection.test.ts": 3301,
-      "src/shared/remote-runtime-shared-control-keepalive-refresh.test.ts": 14,
-      "src/shared/remote-runtime-shared-control-reconnect.test.ts": 9,
-      "src/shared/remote-runtime-shared-control-retired-request-ids.test.ts": 8,
-      "src/shared/remote-runtime-shared-control-socket-generation.test.ts": 4,
-      "src/shared/remote-runtime-shared-control-standing-intent.test.ts": 615,
-      "src/shared/remote-runtime-shared-control-subscription-close.test.ts": 5,
-      "src/shared/remote-runtime-shared-control-subscriptions.test.ts": 12,
-      "src/shared/remote-runtime-socket-liveness.test.ts": 9,
-      "src/shared/remote-runtime-subscription-frame-router.test.ts": 7,
-      "src/shared/remote-runtime-subscription-request.test.ts": 295,
-      "src/shared/remote-runtime-tailscale-hint.test.ts": 7,
-      "src/shared/remote-runtime-transport-error-agreement.test.ts": 9,
-      "src/shared/remote-workspace-session-projection.test.ts": 9,
-      "src/shared/renderer-restart-preparation.test.ts": 10,
-      "src/shared/repo-badge-color.test.ts": 5,
-      "src/shared/repo-icon.test.ts": 23,
-      "src/shared/repo-ref-maintenance.test.ts": 316,
-      "src/shared/repo-search-limits.test.ts": 10,
-      "src/shared/repro-13889-claude-quarter-circle-busy-title.test.ts": 16,
-      "src/shared/repro-7732-gitlab-job-id-dropped.test.ts": 5,
-      "src/shared/repro-8478-opencode-native-title-icon.test.ts": 16,
-      "src/shared/require-tui-agent-config.test.ts": 4,
-      "src/shared/resolved-worktree-lineage.test.ts": 10,
-      "src/shared/retired-pty-incarnations.test.ts": 4,
-      "src/shared/review-head-tracking-ref.test.ts": 6,
-      "src/shared/ripgrep-process-availability.test.ts": 11,
-      "src/shared/runtime-client-export-parity.test.ts": 5,
-      "src/shared/runtime-environment-store.test.ts": 32,
-      "src/shared/runtime-host-status-owner.test.ts": 22,
-      "src/shared/runtime-listing-host-scope.test.ts": 10,
-      "src/shared/runtime-navigation.test.ts": 5,
-      "src/shared/runtime-rpc-call-queue.test.ts": 15,
-      "src/shared/runtime-workspace-file-owner.test.ts": 10,
-      "src/shared/runtime-workspace-window-availability.test.ts": 5,
-      "src/shared/search-match-count.test.ts": 7,
-      "src/shared/search-subprocess-lines.test.ts": 87,
-      "src/shared/secret-store.test.ts": 8,
-      "src/shared/secure-file-coarse-ctime.test.ts": 9,
-      "src/shared/secure-file-fsync-flags.test.ts": 13,
-      "src/shared/secure-file.test.ts": 602,
-      "src/shared/secure-path-hardening-cache.test.ts": 9,
-      "src/shared/secure-path-hardening-retry-budget.test.ts": 39,
-      "src/shared/serve-option-validation.test.ts": 12,
-      "src/shared/setup-agent-sequencing.test.ts": 6203,
-      "src/shared/setup-runner-command.test.ts": 16,
-      "src/shared/setup-script-imports.test.ts": 26,
-      "src/shared/setup-script-package-manager-suggestion.test.ts": 14,
-      "src/shared/setup-script-shebang.test.ts": 7,
-      "src/shared/setup-script-telemetry-events.test.ts": 10,
-      "src/shared/setup-script-telemetry.test.ts": 7,
-      "src/shared/shell-foreground-snapshot.test.ts": 118,
-      "src/shared/shell-process-readiness.test.ts": 20,
-      "src/shared/skill-bundle-install-contract.test.ts": 9,
-      "src/shared/skill-bundle-name.test.ts": 3,
-      "src/shared/skill-delete-contract.test.ts": 30,
-      "src/shared/skill-deletion-eligibility.test.ts": 6,
-      "src/shared/skill-install-contract.test.ts": 13,
-      "src/shared/skill-install-failure.test.ts": 11,
-      "src/shared/skill-metadata.test.ts": 6,
-      "src/shared/skill-package-manifest.test.ts": 78,
-      "src/shared/skill-path-containment.test.ts": 8,
-      "src/shared/skills-cli-agent-keys.test.ts": 10,
-      "src/shared/source-control-ai-action-recipes.test.ts": 11,
-      "src/shared/source-control-ai-action-variables.test.ts": 12,
-      "src/shared/source-control-ai-actions.test.ts": 11,
-      "src/shared/source-control-ai-policy-regression.test.ts": 12,
-      "src/shared/source-control-ai-recipe-save.test.ts": 15,
-      "src/shared/source-control-ai.test.ts": 18,
-      "src/shared/source-control-create-review-intent.test.ts": 12,
-      "src/shared/source-control-group-order.test.ts": 4,
-      "src/shared/source-control-primary-action-decision.test.ts": 5,
-      "src/shared/source-control-push-failure.test.ts": 12,
-      "src/shared/source-control-recovery-agent-command.test.ts": 7,
-      "src/shared/source-scan/source-tree-scan.test.ts": 37,
-      "src/shared/ssh-pending-pty-kill.test.ts": 9,
-      "src/shared/ssh-pty-id.test.ts": 8,
-      "src/shared/ssh-relay-pty-ownership-proof.test.ts": 44,
-      "src/shared/ssh-retained-payload-admission.test.ts": 20,
-      "src/shared/ssh-target-generation.test.ts": 11,
-      "src/shared/ssh-types.test.ts": 7,
-      "src/shared/stable-pane-id.test.ts": 13,
-      "src/shared/startup-command-submission.test.ts": 6,
-      "src/shared/status-bar-usage-mode.test.ts": 3,
-      "src/shared/string-chunk-compaction.test.ts": 19,
-      "src/shared/structural-value-equality.test.ts": 10,
-      "src/shared/structured-agent-session-coalescer.test.ts": 7,
-      "src/shared/structured-agent-session-composer.test.ts": 13,
-      "src/shared/structured-agent-session-create.test.ts": 16,
-      "src/shared/structured-agent-session-item-retention.test.ts": 460,
-      "src/shared/structured-agent-session-live-turn.test.ts": 4,
-      "src/shared/structured-agent-session-mutation.test.ts": 6,
-      "src/shared/structured-agent-session-option-picks.test.ts": 8,
-      "src/shared/structured-agent-session-options.test.ts": 12,
-      "src/shared/structured-agent-session-projection.test.ts": 14,
-      "src/shared/structured-agent-session-reducer.test.ts": 43,
-      "src/shared/structured-agent-session-turn-timing-retention.test.ts": 20,
-      "src/shared/structured-agent-session-turn-timing.test.ts": 15,
-      "src/shared/structured-native-chat-launch-route.test.ts": 8,
-      "src/shared/subprocess-stdin-write.test.ts": 4,
-      "src/shared/synthetic-agent-title.test.ts": 9,
-      "src/shared/tab-title-resolution.test.ts": 8,
-      "src/shared/tailnet-address.test.ts": 5,
-      "src/shared/task-providers.test.ts": 12,
-      "src/shared/task-query.test.ts": 24,
-      "src/shared/task-source-context.test.ts": 12,
-      "src/shared/telemetry-common-props.test.ts": 9,
-      "src/shared/telemetry-events-feature-education.test.ts": 12,
-      "src/shared/telemetry-events.test.ts": 37,
-      "src/shared/telemetry-feature-wall-events.test.ts": 11,
-      "src/shared/telemetry-orca-cli-feature-tip.test.ts": 6,
-      "src/shared/terminal-bell-detector.test.ts": 7,
-      "src/shared/terminal-color-scheme-protocol.test.ts": 7,
-      "src/shared/terminal-composer-draft.test.ts": 13,
-      "src/shared/terminal-custom-themes.test.ts": 10,
-      "src/shared/terminal-escape-introducer.test.ts": 16,
-      "src/shared/terminal-exit-cause.test.ts": 8,
-      "src/shared/terminal-file-url-target.test.ts": 3,
-      "src/shared/terminal-fonts.test.ts": 7,
-      "src/shared/terminal-github-pr-link-detector.test.ts": 14,
-      "src/shared/terminal-input.test.ts": 40,
-      "src/shared/terminal-kitty-keyboard-mode-tracker.test.ts": 19,
-      "src/shared/terminal-line-height-settings.test.ts": 4,
-      "src/shared/terminal-mode-2031-final-state.test.ts": 10,
-      "src/shared/terminal-mode-reset-profiles.test.ts": 13,
-      "src/shared/terminal-osc-color-reply.test.ts": 7,
-      "src/shared/terminal-output-side-effects.test.ts": 14,
-      "src/shared/terminal-partial-escape-tail-ground-scan.test.ts": 12,
-      "src/shared/terminal-partial-escape-tail.fuzz.test.ts": 986,
-      "src/shared/terminal-partial-escape-tail.test.ts": 13,
-      "src/shared/terminal-query-reply.test.ts": 23,
-      "src/shared/terminal-quick-commands.test.ts": 10,
-      "src/shared/terminal-reply-query-scan.test.ts": 5,
-      "src/shared/terminal-scrollback-policy.test.ts": 11,
-      "src/shared/terminal-startup-cwd.test.ts": 11,
-      "src/shared/terminal-stream-protocol.test.ts": 10,
-      "src/shared/terminal-title-agent-type.test.ts": 27,
-      "src/shared/terminal-title-classification-corpus.test.ts": 34,
-      "src/shared/terminal-title-classification-memo.test.ts": 20,
-      "src/shared/terminal-view-attributes.test.ts": 15,
-      "src/shared/terminal-wait-blocked-reason-legacy-alias.test.ts": 9,
-      "src/shared/terminal-zero-dimensions-diagnostic.test.ts": 5,
-      "src/shared/test-code-path.test.ts": 10,
-      "src/shared/text-search.test.ts": 53,
-      "src/shared/timer-delay.test.ts": 9,
-      "src/shared/tui-agent-config.test.ts": 9,
-      "src/shared/tui-agent-permissions.test.ts": 10,
-      "src/shared/tui-agent-selection.test.ts": 10,
-      "src/shared/tui-agent-startup-copilot-resume.test.ts": 5,
-      "src/shared/tui-agent-startup-hermes.test.ts": 26,
-      "src/shared/tui-agent-startup-session-options.test.ts": 13,
-      "src/shared/tui-agent-startup-shell.test.ts": 23,
-      "src/shared/tui-agent-startup.test.ts": 29,
-      "src/shared/ui-language.test.ts": 8,
-      "src/shared/ui-locale.test.ts": 14,
-      "src/shared/ui-zoom-level.test.ts": 7,
-      "src/shared/updated-at-order.test.ts": 82,
-      "src/shared/updater-windows-signature-check.test.ts": 6,
-      "src/shared/usage-percentage-display-change-notice.test.ts": 6,
-      "src/shared/usage-percentage-display.test.ts": 8,
-      "src/shared/utf8-byte-limits.test.ts": 70,
-      "src/shared/vscode-remote-ssh-launcher.test.ts": 7,
-      "src/shared/window-shortcut-policy-agent-dashboard.test.ts": 7,
-      "src/shared/window-shortcut-policy.test.ts": 25,
-      "src/shared/windows-cmd-runner-delayed-launch.test.ts": 5,
-      "src/shared/windows-command-line-budget.test.ts": 1102,
-      "src/shared/windows-console-input.test.ts": 12,
-      "src/shared/windows-environment-expansion.test.ts": 48,
-      "src/shared/windows-interactive-login-spawn.test.ts": 13,
-      "src/shared/windows-lane-tree-removal-boundary.test.ts": 19,
-      "src/shared/windows-long-path-git-args.test.ts": 4,
-      "src/shared/windows-security-descriptor.test.ts": 13,
-      "src/shared/windows-terminal-shell.test.ts": 9,
-      "src/shared/windows-transient-lock-removal.test.ts": 1176,
-      "src/shared/worker-terminal-host-scope.test.ts": 15,
-      "src/shared/worker-transcript-text-scaling.test.ts": 7,
-      "src/shared/workspace-cleanup-applied-filters.test.ts": 15,
-      "src/shared/workspace-cleanup-browse-state-persistence.test.ts": 18,
-      "src/shared/workspace-cleanup-ui-state.test.ts": 7,
-      "src/shared/workspace-cleanup.test.ts": 10,
-      "src/shared/workspace-doc-history.test.ts": 34,
-      "src/shared/workspace-linked-item-equality.test.ts": 7,
-      "src/shared/workspace-linked-item-source-context.test.ts": 8,
-      "src/shared/workspace-name.test.ts": 25,
-      "src/shared/workspace-session-browser-history.test.ts": 25,
-      "src/shared/workspace-session-partition-owner.test.ts": 4,
-      "src/shared/workspace-session-salvage-equivalence.test.ts": 95,
-      "src/shared/workspace-session-salvage.test.ts": 1522,
-      "src/shared/workspace-session-schema-field-coverage.test.ts": 15,
-      "src/shared/workspace-session-schema.sleeping-agent.test.ts": 22,
-      "src/shared/workspace-session-schema.test.ts": 23,
-      "src/shared/workspace-session-tab-focus-schema.test.ts": 19,
-      "src/shared/workspace-session-terminal-buffers.test.ts": 28,
-      "src/shared/workspace-session-terminal-schema.test.ts": 12,
-      "src/shared/workspace-session-terminal-tab-close.test.ts": 43,
-      "src/shared/workspace-session-validation-work.test.ts": 108,
-      "src/shared/workspace-space-compaction.test.ts": 15,
-      "src/shared/workspace-space-entry-traversal.test.ts": 1132,
-      "src/shared/workspace-space-scan-budget.test.ts": 32,
-      "src/shared/workspace-statuses.test.ts": 24,
-      "src/shared/worktree-execution-host-resolution.test.ts": 15,
-      "src/shared/worktree-name-suggestion.test.ts": 29,
-      "src/shared/worktree/base-ref.test.ts": 11,
-      "src/shared/worktree/card-properties.test.ts": 6,
-      "src/shared/worktree/create-preparation.test.ts": 6,
-      "src/shared/worktree/github-pr-suppression.test.ts": 8,
-      "src/shared/worktree/host-context-labels.test.ts": 8,
-      "src/shared/worktree/host-qualified-identity.test.ts": 8,
-      "src/shared/worktree/id.test.ts": 13,
-      "src/shared/worktree/identity.test.ts": 7,
-      "src/shared/worktree/ownership-configured-base-visibility.test.ts": 22,
-      "src/shared/worktree/ownership-worktree-base-path.test.ts": 8,
-      "src/shared/worktree/ownership.test.ts": 284,
-      "src/shared/worktree/removal-fence-error.test.ts": 7,
-      "src/shared/worktree/removal-force-classification.test.ts": 5,
-      "src/shared/worktree/retired-name-cache.test.ts": 15,
-      "src/shared/worktree/retired-name-registry.test.ts": 185,
-      "src/shared/worktree/sort-order-update.test.ts": 7,
-      "src/shared/worktree/submodule-removal.test.ts": 7,
-      "src/shared/worktree/visibility-sources.test.ts": 18,
-      "src/shared/ws-outbound-backpressure-queue.test.ts": 31,
-      "src/shared/wsl-exec-mode-separator.test.ts": 2451,
-      "src/shared/wsl-login-shell-command.test.ts": 66,
-      "src/shared/wsl-paths.test.ts": 18,
-      "src/shared/zod-salvage-absence.test.ts": 21,
-      "tests/e2e/alternate-screen-fixture-script.unit.test.ts": 8,
-      "tests/e2e/completed-worker-retirement-resume.unit.test.ts": 128,
-      "tests/e2e/global-teardown.unit.test.ts": 55,
-      "tests/e2e/helpers/alt-screen-frame.unit.test.ts": 40,
-      "tests/e2e/helpers/client-hosted-browser-fixture.unit.test.ts": 13,
-      "tests/e2e/helpers/electron-crashpad-cleanup.unit.test.ts": 11,
-      "tests/e2e/helpers/electron-home-isolation.unit.test.ts": 7,
-      "tests/e2e/helpers/electron-launch-args.unit.test.ts": 9,
-      "tests/e2e/helpers/electron-main-evaluate-retry.unit.test.ts": 1209,
-      "tests/e2e/helpers/electron-process-shutdown.unit.test.ts": 11,
-      "tests/e2e/helpers/fake-agent-command-override.unit.test.ts": 3,
-      "tests/e2e/helpers/fake-agent-paste-end-scanner.unit.test.ts": 16,
-      "tests/e2e/helpers/git-status-retry-barrier.unit.test.ts": 7,
-      "tests/e2e/helpers/golden-source-control.unit.test.ts": 11,
-      "tests/e2e/helpers/headless-paired-runtime-serve-readiness.unit.test.ts": 18,
-      "tests/e2e/helpers/nested-runtime-proxy-jump-fixture.unit.test.ts": 5,
-      "tests/e2e/helpers/paired-client-runtime-environment.unit.test.ts": 12,
-      "tests/e2e/helpers/paired-client-window-reveal.unit.test.ts": 10,
-      "tests/e2e/helpers/remote-skill-cloud-fixture.unit.test.ts": 138,
-      "tests/e2e/helpers/remote-terminal-source-range-contract-fixture.unit.test.ts": 7,
-      "tests/e2e/helpers/ssh-port-forward-snapshot-barrier.unit.test.ts": 57,
-      "tests/e2e/helpers/streaming-terminal-cleanup.unit.test.ts": 10,
-      "tests/e2e/host-cold-park-remote-subscriber.unit.test.ts": 518,
-      "tests/e2e/host-guest-paint-retention-remote-viewer.unit.test.ts": 278,
-      "tests/e2e/orca-restart-navigation.unit.test.ts": 9,
-      "tests/e2e/orchestration-run-pagination.unit.test.ts": 9,
-      "tests/e2e/paired-runtime-rejected-input-remount.unit.test.ts": 935,
-      "tests/e2e/relay-region-compatibility.unit.test.ts": 56,
-      "tests/e2e/relay-region-correction.unit.test.ts": 5935,
-      "tests/e2e/remote-agent-completion-authority.unit.test.ts": 20,
-      "tests/e2e/remote-terminal-tab-retirement.unit.test.ts": 53,
-      "tests/e2e/restored-terminal-input-readiness.unit.test.ts": 17,
-      "tests/e2e/session-tabs-decorative-title-fanout.unit.test.ts": 460,
-      "tests/e2e/session-tabs-empty-inventory-daemon-oracle.unit.test.ts": 33,
-      "tests/e2e/session-tabs-rich-status-boundaries.unit.test.ts": 82,
-      "tests/e2e/ssh-codex-replay-reply-probe.unit.test.ts": 9,
-      "tests/e2e/structured-native-chat-routing-authority.unit.test.ts": 67,
-      "tests/e2e/terminal-foreground-confirmation.unit.test.ts": 19,
-      "tests/e2e/terminal-probe-input-sequence.unit.test.ts": 9,
-      "tests/e2e/terminal-split-activation-latency-artifact.unit.test.ts": 11,
-      "tests/e2e/terminal-split-activation-latency-report.unit.test.ts": 13,
-      "tests/tools/relay-bench/phone-e2ee-desktop-parity.test.mjs": 48,
-      "tests/tools/relay-bench/region-probe-replay.test.mjs": 26,
-      "tests/tools/relay-bench/relay-bench-invocation.test.mjs": 16,
-      "tests/tools/relay-bench/relay-bench-state-file.test.mjs": 13,
-      "tests/tools/relay-bench/relay-phone-connect-bench.test.mjs": 27,
-      "tests/tools/win-update-e2e/app-driver.test.mjs": 23,
-      "tests/tools/windows-pty-native-capability-smoke/packaged-node-pty-capability-oracle.test.mjs": 8,
-      "tests/tools/windows-pty-native-capability-smoke/packaged-node-pty-capability-probe.test.mjs": 40,
-      "tests/tools/windows-pty-native-capability-smoke/run.test.mjs": 11
+      "src/shared/ai-vault-types.test.ts": 52,
+      "src/shared/antigravity-source-control.test.ts": 165,
+      "src/shared/app-version.test.ts": 44,
+      "src/shared/artifact-sharing-gate.test.ts": 149,
+      "src/shared/automation-cron-dialect.test.ts": 50,
+      "src/shared/automation-cron-input-validation.test.ts": 78,
+      "src/shared/automation-execution-target.test.ts": 54,
+      "src/shared/automation-host-filter.test.ts": 53,
+      "src/shared/automation-legacy-list-partition.test.ts": 33,
+      "src/shared/automation-list-response.test.ts": 44,
+      "src/shared/automation-list-scope.test.ts": 51,
+      "src/shared/automation-owner-key.test.ts": 43,
+      "src/shared/automation-owner-precondition.test.ts": 75,
+      "src/shared/automation-run-identity.test.ts": 47,
+      "src/shared/automation-run-retention.test.ts": 45,
+      "src/shared/automation-schedule-drift.test.ts": 87,
+      "src/shared/automation-schedules.test.ts": 199,
+      "src/shared/automation-usage-summary.test.ts": 64,
+      "src/shared/base-ref-search-result.test.ts": 40,
+      "src/shared/binary-file-extensions.test.ts": 54,
+      "src/shared/bounded-map.test.ts": 68,
+      "src/shared/branch-name-from-work.test.ts": 59,
+      "src/shared/branch-prefix.test.ts": 55,
+      "src/shared/browser-client-automation-protocol.test.ts": 145,
+      "src/shared/browser-client-host-id-argument.test.ts": 51,
+      "src/shared/browser-client-host-protocol.test.ts": 255,
+      "src/shared/browser-client-host-reconciliation-protocol.test.ts": 81,
+      "src/shared/browser-client-hosting-eligibility.test.ts": 39,
+      "src/shared/browser-cookie-import-sources.test.ts": 31,
+      "src/shared/browser-grab-types.test.ts": 49,
+      "src/shared/browser-network-capabilities.test.ts": 28,
+      "src/shared/browser-network-tunnel-protocol.test.ts": 86,
+      "src/shared/browser-network-tunnel-stream-framing.test.ts": 1565,
+      "src/shared/browser-screencast-protocol.test.ts": 48,
+      "src/shared/browser-url.test.ts": 128,
+      "src/shared/bundled-ripgrep.test.ts": 24,
+      "src/shared/cheap-process-table-snapshot.test.ts": 55,
+      "src/shared/check-job-log-byte-cap.test.ts": 77,
+      "src/shared/check-job-log-retention.test.ts": 186,
+      "src/shared/check-job-log-tail-slice.test.ts": 55,
+      "src/shared/child-process/bounded-output-sink.test.ts": 48,
+      "src/shared/child-process/child-process-import-boundary.test.ts": 1004,
+      "src/shared/child-process/close-process-registry.test.ts": 40,
+      "src/shared/child-process/posix-lsof-probe.test.ts": 4289,
+      "src/shared/child-process/process-tree-termination.test.ts": 68,
+      "src/shared/child-process/retryable-process-exit-proof.test.ts": 38,
+      "src/shared/child-process/run-process-termination-failure.test.ts": 49,
+      "src/shared/child-process/run-process.test.ts": 7245,
+      "src/shared/child-process/windows-cmd-shim-resolution.test.ts": 57,
+      "src/shared/child-process/windows-cmd-shim-resolution.win32.test.ts": 42,
+      "src/shared/child-process/windows-command-line.test.ts": 55,
+      "src/shared/child-process/windows-command-line.win32.test.ts": 39,
+      "src/shared/child-process/windows-console-visibility.test.ts": 3436,
+      "src/shared/claimed-agent-pty-owner.test.ts": 94,
+      "src/shared/claude-agent-teams-tmux-compat.test.ts": 57,
+      "src/shared/claude-background-task-kind.test.ts": 26,
+      "src/shared/claude-background-task-status.test.ts": 168,
+      "src/shared/claude-model-list-probe.test.ts": 50,
+      "src/shared/claude-statusline-rate-limits.test.ts": 54,
+      "src/shared/claude-subagent-roster.test.ts": 65,
+      "src/shared/claude-subagent-row-lifecycle.test.ts": 193,
+      "src/shared/cli-argument-boundary.test.ts": 35,
+      "src/shared/cli-runtime-pairing-boundary.test.ts": 201,
+      "src/shared/cli-workspace-provenance.test.ts": 35,
+      "src/shared/client-environment-info.test.ts": 55,
+      "src/shared/clipboard-image.test.ts": 36,
+      "src/shared/clipboard-text.test.ts": 75,
+      "src/shared/closed-terminal-tab-tombstones.test.ts": 125,
+      "src/shared/cloud-service-url.test.ts": 38,
+      "src/shared/codex-auth-errors.test.ts": 51,
+      "src/shared/codex-pet-sprite-defaults.test.ts": 62,
+      "src/shared/codex-reset-credit-attempt-ledger.test.ts": 129,
+      "src/shared/codex-reset-credit-scope.test.ts": 48,
+      "src/shared/codex-startup-delivery.test.ts": 43,
+      "src/shared/codex-subagent-poll-scheduler.test.ts": 54,
+      "src/shared/codex-subagent-rollout-lifecycle.test.ts": 109,
+      "src/shared/codex-subagent-roster.test.ts": 75,
+      "src/shared/codex-subagent-transcript.test.ts": 72,
+      "src/shared/combined-diff-file-tree-width.test.ts": 49,
+      "src/shared/command-code-output-retention.test.ts": 64,
+      "src/shared/command-code-output-status.test.ts": 214,
+      "src/shared/command-code-turn-boundary.test.ts": 48,
+      "src/shared/command-environment.test.ts": 69,
+      "src/shared/command-token-scanner.test.ts": 48,
+      "src/shared/commit-message-agent-spec.test.ts": 122,
+      "src/shared/commit-message-generation.test.ts": 57,
+      "src/shared/commit-message-omp.test.ts": 239,
+      "src/shared/commit-message-plan.test.ts": 51,
+      "src/shared/commit-message-prompt.test.ts": 60,
+      "src/shared/computer-awake-mode.test.ts": 36,
+      "src/shared/computer-use-error-recovery.test.ts": 50,
+      "src/shared/computer-use-key-spec.test.ts": 27,
+      "src/shared/constants.test.ts": 193,
+      "src/shared/contextual-tours.test.ts": 63,
+      "src/shared/crash-reporting.test.ts": 45,
+      "src/shared/cross-platform-path-guards.test.ts": 1653,
+      "src/shared/cross-platform-path.test.ts": 47,
+      "src/shared/daemon-adoption-telemetry.test.ts": 168,
+      "src/shared/direct-ssh-reconnect-telemetry-schema.test.ts": 152,
+      "src/shared/doc-preview-file-access.test.ts": 80,
+      "src/shared/doc-preview-scheme.test.ts": 46,
+      "src/shared/draft-paste-ready-scanner-grok-trace-replay.test.ts": 98,
+      "src/shared/draft-paste-ready-scanner.test.ts": 46,
+      "src/shared/emoji-shortcode-catalog.lazy.test.ts": 116,
+      "src/shared/emulator-keyboard-frame.test.ts": 53,
+      "src/shared/emulator-touch-frame.test.ts": 36,
+      "src/shared/ephemeral-setup-terminal-worktree-id.test.ts": 50,
+      "src/shared/ephemeral-vm-recipe-checkout-mode.test.ts": 130,
+      "src/shared/ephemeral-vm-recipe-doctor.test.ts": 47,
+      "src/shared/ephemeral-vm-recipe-output-capture.test.ts": 223,
+      "src/shared/ephemeral-vm-recipe-process.test.ts": 237,
+      "src/shared/ephemeral-vm-recipe-repo-url.test.ts": 51,
+      "src/shared/ephemeral-vm-recipes.test.ts": 122,
+      "src/shared/ephemeral-vm-runtime-feature-sorting.test.ts": 285,
+      "src/shared/ephemeral-vm-runtime-store-rollback.test.ts": 661,
+      "src/shared/ephemeral-vm-runtime-store.test.ts": 213,
+      "src/shared/event-loop-yield.test.ts": 68,
+      "src/shared/execution-host-registry.test.ts": 70,
+      "src/shared/execution-host.test.ts": 66,
+      "src/shared/export-let-function-initializer-ban.test.ts": 3945,
+      "src/shared/external-automation-jobs-file.test.ts": 95,
+      "src/shared/external-worktree-inbox.test.ts": 35,
+      "src/shared/feature-education-telemetry.test.ts": 38,
+      "src/shared/feature-interactions.test.ts": 2141,
+      "src/shared/feature-tips.test.ts": 68,
+      "src/shared/feature-wall-tour-depth.test.ts": 27,
+      "src/shared/feedback-image-limits.test.ts": 49,
+      "src/shared/file-link-location.test.ts": 51,
+      "src/shared/file-name-sort.test.ts": 48,
+      "src/shared/filesystem-directory-listing-limit.test.ts": 53,
+      "src/shared/fish-binary-requirement.test.ts": 45,
+      "src/shared/folder-workspace-execution-host.test.ts": 79,
+      "src/shared/folder-workspace-worktree.test.ts": 46,
+      "src/shared/folder-workspaces.test.ts": 33,
+      "src/shared/foreground-process-ancestry-parity.test.ts": 379,
+      "src/shared/foreground-process-selection.test.ts": 96,
+      "src/shared/foreground-wrapper-agent.test.ts": 51,
+      "src/shared/generated-code-path.test.ts": 46,
+      "src/shared/git-binary-compatibility.test.ts": 52,
+      "src/shared/git-branch-cleanup.test.ts": 62,
+      "src/shared/git-branch-compare-head.test.ts": 30,
+      "src/shared/git-branch-line-total-soft-deadline.test.ts": 3579,
+      "src/shared/git-branch-line-total.test.ts": 60,
+      "src/shared/git-capability-cache.test.ts": 58,
+      "src/shared/git-check-ignore-stdio.test.ts": 54,
+      "src/shared/git-clone-failure-message.test.ts": 74,
+      "src/shared/git-config-snapshot-runner.test.ts": 67,
+      "src/shared/git-configured-branch-target.test.ts": 60,
+      "src/shared/git-cquoted-path.test.ts": 29,
+      "src/shared/git-diff-transport-budget.test.ts": 2035,
+      "src/shared/git-discard-path-safety.test.ts": 40,
+      "src/shared/git-exec-mutation.test.ts": 53,
+      "src/shared/git-fetch-head-capability.test.ts": 39,
+      "src/shared/git-fetch-head-lock-key-derivation.test.ts": 133,
+      "src/shared/git-fetch-head-lock.test.ts": 169,
+      "src/shared/git-fork-sync.test.ts": 54,
+      "src/shared/git-history-graph.test.ts": 95,
+      "src/shared/git-history-message-allocation.test.ts": 45,
+      "src/shared/git-history-ref-display.test.ts": 65,
+      "src/shared/git-history.test.ts": 68,
+      "src/shared/git-merge-tree-capability.test.ts": 31,
+      "src/shared/git-metadata-path.test.ts": 63,
+      "src/shared/git-push-target-validation.test.ts": 44,
+      "src/shared/git-remote-error.test.ts": 73,
+      "src/shared/git-remote-identity.test.ts": 56,
+      "src/shared/git-remote-url-index.test.ts": 53,
+      "src/shared/git-rev-list-output.test.ts": 43,
+      "src/shared/git-status-branch-line-total-cache.test.ts": 55,
+      "src/shared/git-status-conflict-entries.test.ts": 33,
+      "src/shared/git-status-limit.test.ts": 37,
+      "src/shared/git-status-line-stat-inputs.test.ts": 32,
+      "src/shared/git-status-line-stats-cache.test.ts": 67,
+      "src/shared/git-status-upstream-ref.test.ts": 59,
+      "src/shared/git-tracked-pathspecs.test.ts": 207,
+      "src/shared/git-uncommitted-line-stats.test.ts": 85,
+      "src/shared/git-upstream-status.test.ts": 33,
+      "src/shared/git-worktree-operation-lock.test.ts": 32,
+      "src/shared/github/account-binding.test.ts": 41,
+      "src/shared/github/api-availability.test.ts": 38,
+      "src/shared/github/owner-slug.test.ts": 40,
+      "src/shared/github/project-identity.test.ts": 25,
+      "src/shared/github/project-ref-input.test.ts": 39,
+      "src/shared/github/project-roadmap-timeline.test.ts": 77,
+      "src/shared/github/pull-request-auto-merge-availability.test.ts": 64,
+      "src/shared/github/pull-request-for-branch-outcome.test.ts": 45,
+      "src/shared/github/pull-request-merge-methods.test.ts": 50,
+      "src/shared/github/repository-identity-key.test.ts": 49,
+      "src/shared/github/work-items-query-bounds.test.ts": 58,
+      "src/shared/gitlab-job-log-excerpt.test.ts": 91,
+      "src/shared/gitlab-job-trace-check-details.test.ts": 32,
+      "src/shared/gitlab-pipeline-checks.test.ts": 34,
+      "src/shared/gitlab-projects.test.ts": 40,
+      "src/shared/grok-model-list-probe.test.ts": 49,
+      "src/shared/grok-session-paths.test.ts": 87,
+      "src/shared/growing-byte-buffer.test.ts": 96,
+      "src/shared/handled-wire-discriminant.test.ts": 36,
+      "src/shared/harness-injected-user-turns.test.ts": 42,
+      "src/shared/hermes-run-ref-retention.test.ts": 29,
+      "src/shared/hermes-session-run-index.test.ts": 692,
+      "src/shared/hermes-startup-query.windows.test.ts": 41,
+      "src/shared/hook-command-source-policy.test.ts": 52,
+      "src/shared/host-balanced-listing-scaling.test.ts": 56,
+      "src/shared/host-display-resolution.test.ts": 33,
+      "src/shared/host-setting-overrides.test.ts": 37,
+      "src/shared/hosted-review-creation-providers.test.ts": 52,
+      "src/shared/hosted-review-github.test.ts": 48,
+      "src/shared/hosted-review-ready-capabilities.test.ts": 37,
+      "src/shared/hosted-review-refs.test.ts": 109,
+      "src/shared/image-data-uri.test.ts": 41,
+      "src/shared/image-paste-following-text.test.ts": 68,
+      "src/shared/in-flight-promise-dedupe.test.ts": 61,
+      "src/shared/issue-link-input.test.ts": 60,
+      "src/shared/jira-issue-url.test.ts": 57,
+      "src/shared/json-text-structure-limit.test.ts": 40,
+      "src/shared/keybindings-conflicts.test.ts": 94,
+      "src/shared/keybindings-default-bindings.test.ts": 109,
+      "src/shared/keybindings-digit-index.test.ts": 110,
+      "src/shared/keybindings-double-tap.test.ts": 85,
+      "src/shared/keybindings-keyboard-layout.test.ts": 56,
+      "src/shared/keybindings-mouse.test.ts": 44,
+      "src/shared/keybindings-parse-cache.test.ts": 142,
+      "src/shared/keybindings-parsing.test.ts": 47,
+      "src/shared/keybindings-terminal-context.test.ts": 49,
+      "src/shared/keybindings-unassigned-actions.test.ts": 61,
+      "src/shared/linear/inline-media.test.ts": 36,
+      "src/shared/linear/issue-attribute-filter.test.ts": 58,
+      "src/shared/linear/issue-view-resume-state.test.ts": 67,
+      "src/shared/linear/links.test.ts": 74,
+      "src/shared/linear/workspace-types.test.ts": 25,
+      "src/shared/linux-proc-port-scan-limits.test.ts": 42,
+      "src/shared/local-account-runtime.test.ts": 93,
+      "src/shared/local-build-compatibility.test.ts": 34,
+      "src/shared/localhost-worktree-labels.test.ts": 52,
+      "src/shared/loose-ref-count.test.ts": 358,
+      "src/shared/machine-name.test.ts": 35,
+      "src/shared/macos-symbolic-hotkeys.test.ts": 100,
+      "src/shared/main-agent-status-parity.test.ts": 206,
+      "src/shared/managed-agent-command-token.test.ts": 26,
+      "src/shared/manual-repo-order.test.ts": 36,
+      "src/shared/map-settled-with-concurrency.test.ts": 60,
+      "src/shared/map-with-concurrency.test.ts": 82,
+      "src/shared/markdown-document-listing-limits.test.ts": 47,
+      "src/shared/markdown-toc-panel-width.test.ts": 53,
+      "src/shared/mcp-config.test.ts": 128,
+      "src/shared/mobile-e2ee-v2-contract.test.ts": 41,
+      "src/shared/mobile-e2ee-v2-framing.test.ts": 55,
+      "src/shared/mobile-file-directory-limit.test.ts": 49,
+      "src/shared/mobile-markdown-document.test.ts": 40,
+      "src/shared/mobile-pairing-connection-mode.test.ts": 49,
+      "src/shared/mobile-pairing-custom-address.test.ts": 57,
+      "src/shared/mobile-push-contract.test.ts": 44,
+      "src/shared/mobile-relay-close-codes.test.ts": 49,
+      "src/shared/mobile-relay-mint-failure.test.ts": 33,
+      "src/shared/mobile-relay-pairing-offer.test.ts": 151,
+      "src/shared/mobile-relay-phone-protocol.test.ts": 109,
+      "src/shared/mobile-web-bundle/bundle-range-rpc-contract.test.ts": 108,
+      "src/shared/mobile-web-bundle/bundle-rpc-contract.test.ts": 153,
+      "src/shared/mobile-web-bundle/manifest-contract.test.ts": 204,
+      "src/shared/model-id-label.test.ts": 45,
+      "src/shared/modifier-double-tap-detector.test.ts": 47,
+      "src/shared/mouse-shortcut-input.test.ts": 49,
+      "src/shared/muse-session-log.test.ts": 63,
+      "src/shared/native-chat-activity-tail-line.test.ts": 155,
+      "src/shared/native-chat-agent-profiles.test.ts": 68,
+      "src/shared/native-chat-agent-support.test.ts": 52,
+      "src/shared/native-chat-ask-fifo.test.ts": 386,
+      "src/shared/native-chat-ask-row.test.ts": 41,
+      "src/shared/native-chat-ask.test.ts": 41,
+      "src/shared/native-chat-background-task-row.test.ts": 61,
+      "src/shared/native-chat-command-envelope.test.ts": 45,
+      "src/shared/native-chat-edit-normalize.test.ts": 189,
+      "src/shared/native-chat-href-routing.test.ts": 32,
+      "src/shared/native-chat-image-transcript-markers.test.ts": 45,
+      "src/shared/native-chat-session-option-commands.test.ts": 61,
+      "src/shared/native-chat-session-option-defaults.test.ts": 59,
+      "src/shared/native-chat-session-option-snapshot.test.ts": 107,
+      "src/shared/native-chat-session-option-state.test.ts": 31,
+      "src/shared/native-chat-shell-environment.test.ts": 39,
+      "src/shared/native-chat-slash-commands.omp.test.ts": 152,
+      "src/shared/native-chat-slash-commands.test.ts": 47,
+      "src/shared/native-chat-stream-unsubscribe.test.ts": 52,
+      "src/shared/native-chat-streaming.test.ts": 53,
+      "src/shared/native-chat-subagent-summary.test.ts": 42,
+      "src/shared/native-chat-task-list.test.ts": 40,
+      "src/shared/native-chat-tool-activity.test.ts": 30,
+      "src/shared/native-chat-tool-attribution-allocation.test.ts": 79,
+      "src/shared/native-chat-tool-icon.test.ts": 70,
+      "src/shared/native-chat-tool-identity.test.ts": 150,
+      "src/shared/native-chat-tool-pair-limit.test.ts": 119,
+      "src/shared/native-chat-tool-pairing.test.ts": 56,
+      "src/shared/native-chat-tool-preview-prefix.test.ts": 60,
+      "src/shared/native-chat-tool-preview-scan.test.ts": 40,
+      "src/shared/native-chat-tool-run-outcome.test.ts": 59,
+      "src/shared/native-chat-tool-run-sentence.test.ts": 66,
+      "src/shared/native-chat-tool-summary.test.ts": 55,
+      "src/shared/native-chat-transcript-retention.test.ts": 43,
+      "src/shared/native-chat-turn-activity.test.ts": 74,
+      "src/shared/native-chat-turn-fold.test.ts": 29,
+      "src/shared/native-chat-turn-status.test.ts": 65,
+      "src/shared/native-chat-types.test.ts": 46,
+      "src/shared/native-chat-unverifiable-turn-status.test.ts": 44,
+      "src/shared/native-file-drop.test.ts": 73,
+      "src/shared/nested-repo-telemetry-schema.test.ts": 152,
+      "src/shared/nested-repo-telemetry.test.ts": 50,
+      "src/shared/nested-worker-depth.test.ts": 37,
+      "src/shared/network-proxy.test.ts": 52,
+      "src/shared/network/manual-address.test.ts": 82,
+      "src/shared/network/server-share-address.test.ts": 30,
+      "src/shared/new-workspace-dialog-repo.test.ts": 25,
+      "src/shared/new-workspace/smart-workspace-url-source-results.test.ts": 92,
+      "src/shared/new-workspace/work-item-lookup-text.test.ts": 26,
+      "src/shared/new-workspace/workspace-source.test.ts": 51,
+      "src/shared/new-workspace/worktree-create-retry-policy.test.ts": 38,
+      "src/shared/node-bounded-file-reader-sync.test.ts": 36,
+      "src/shared/node-bounded-file-reader.test.ts": 35,
+      "src/shared/node-bounded-json-stringify.test.ts": 73,
+      "src/shared/node-file-content-equality.test.ts": 55,
+      "src/shared/node-markdown-document-discovery.test.ts": 57,
+      "src/shared/node-pty-spawn-helper.test.ts": 34,
+      "src/shared/node-readable-text.test.ts": 54,
+      "src/shared/node-source-copy-content-equality.test.ts": 69,
+      "src/shared/notebook-venv-location.test.ts": 44,
+      "src/shared/nul-delimited-fields.test.ts": 30,
+      "src/shared/nvm-default-alias.test.ts": 56,
+      "src/shared/omp-draft-launch-shell.test.ts": 173,
+      "src/shared/omp-draft-launch-windows.test.ts": 86,
+      "src/shared/omp-fresh-launch-shell.test.ts": 134,
+      "src/shared/omp-fresh-launch.test.ts": 102,
+      "src/shared/omp-owner-state-title.test.ts": 88,
+      "src/shared/omp-pi-semantic-title-preservation.test.ts": 49,
+      "src/shared/omp-source-control-discovery.test.ts": 150,
+      "src/shared/onboarding-tour-telemetry-events.test.ts": 165,
+      "src/shared/open-in-applications.test.ts": 36,
+      "src/shared/opencode-launch-command.test.ts": 52,
+      "src/shared/opencode-permission-status.test.ts": 154,
+      "src/shared/opencode-terminal-title.test.ts": 41,
+      "src/shared/orca-session-address.test.ts": 189,
+      "src/shared/orca-yaml-alias-bounds.test.ts": 102,
+      "src/shared/orca-yaml-bounds.test.ts": 64,
+      "src/shared/orcad-artifacts.test.ts": 27,
+      "src/shared/orcad-profile-preflight.test.ts": 135,
+      "src/shared/orchestration-ask-timeout.test.ts": 46,
+      "src/shared/orchestration-check-output.test.ts": 50,
+      "src/shared/orchestration-compatibility-evidence.test.ts": 41,
+      "src/shared/orchestration-dispatch-refusal-contract.test.ts": 71,
+      "src/shared/orchestration-fleet-attention.test.ts": 38,
+      "src/shared/orchestration-fleet-evidence-clock.test.ts": 39,
+      "src/shared/orchestration-fleet-projection.test.ts": 64,
+      "src/shared/orchestration-rpc-contract.test.ts": 34,
+      "src/shared/orchestration-task-display.test.ts": 38,
+      "src/shared/orchestration-task-summary.test.ts": 45,
+      "src/shared/orchestration-timing-budgets.test.ts": 38,
+      "src/shared/osc-title-scan-tail-retention.test.ts": 59,
+      "src/shared/osc-title-scan-tail.test.ts": 36,
+      "src/shared/osc52-clipboard-settings.test.ts": 40,
+      "src/shared/own-retained-string.test.ts": 115,
+      "src/shared/pairing-address-auto-selection.test.ts": 58,
+      "src/shared/pairing-local-ui-fields.test.ts": 29,
+      "src/shared/pairing.test.ts": 112,
+      "src/shared/pane-agent-identity-adapter.test.ts": 83,
+      "src/shared/pane-agent-identity-inventory.test.ts": 1015,
+      "src/shared/pane-agent-identity-resolver.test.ts": 90,
+      "src/shared/pane-agent-identity-surface-inventory.test.ts": 2736,
+      "src/shared/pane-agent-identity-title-corpus.test.ts": 95,
+      "src/shared/pane-agent-owner.test.ts": 53,
+      "src/shared/pane-key-alias.test.ts": 69,
+      "src/shared/physical-exit-tracker.test.ts": 45,
+      "src/shared/pi-agent-kind.test.ts": 58,
+      "src/shared/pi-overlay-ui-settings.test.ts": 50,
+      "src/shared/pi-state-title-marker.test.ts": 72,
+      "src/shared/plugins/plugin-consent-fingerprint.test.ts": 159,
+      "src/shared/plugins/plugin-consent-request.test.ts": 84,
+      "src/shared/plugins/plugin-content-pack-contributions.test.ts": 136,
+      "src/shared/plugins/plugin-demo-fixture.test.ts": 177,
+      "src/shared/plugins/plugin-hostile-fixture.test.ts": 53,
+      "src/shared/plugins/plugin-install-lockfile.test.ts": 134,
+      "src/shared/plugins/plugin-kill-list.test.ts": 208,
+      "src/shared/plugins/plugin-language-pack-artifact.test.ts": 176,
+      "src/shared/plugins/plugin-manifest.test.ts": 145,
+      "src/shared/plugins/plugin-marketplace.test.ts": 224,
+      "src/shared/plugins/plugin-panel-call-admission.test.ts": 139,
+      "src/shared/plugins/plugin-panel-message-budget-traversal.test.ts": 196,
+      "src/shared/plugins/plugin-panel-message-budget.test.ts": 140,
+      "src/shared/plugins/plugin-panel-pong-frame.test.ts": 134,
+      "src/shared/plugins/plugin-panel-shell.test.ts": 566,
+      "src/shared/plugins/plugin-path-safety.test.ts": 161,
+      "src/shared/plugins/plugin-vm-recipe-artifact.test.ts": 172,
+      "src/shared/posix-wait-status.test.ts": 61,
+      "src/shared/powershell-native-argument.test.ts": 23,
+      "src/shared/pr-bot-author-overrides.test.ts": 36,
+      "src/shared/pr-check-severity-order.test.ts": 36,
+      "src/shared/pr-check-status.test.ts": 50,
+      "src/shared/pr-comment-audience.test.ts": 52,
+      "src/shared/pr-comment-groups.test.ts": 33,
+      "src/shared/pr-comment-time.test.ts": 49,
+      "src/shared/preferred-git-remote.test.ts": 27,
+      "src/shared/priority-semaphore.test.ts": 38,
+      "src/shared/process-output-field-scanner.test.ts": 49,
+      "src/shared/process-table-index.test.ts": 152,
+      "src/shared/process-table-snapshot.test.ts": 174,
+      "src/shared/profile-state-recovery-command.test.ts": 156,
+      "src/shared/profile-state-telemetry-schema.test.ts": 187,
+      "src/shared/project-catalog-row-normalization.test.ts": 64,
+      "src/shared/project-execution-runtime.test.ts": 47,
+      "src/shared/project-groups.test.ts": 141,
+      "src/shared/project-host-setup-projection.test.ts": 45,
+      "src/shared/project-identity-succession.test.ts": 54,
+      "src/shared/promise-settlement-waiters.test.ts": 305,
+      "src/shared/protocol-compat.test.ts": 43,
+      "src/shared/pty-consumer-session.test.ts": 34,
+      "src/shared/pty-delivery-diagnostics.test.ts": 46,
+      "src/shared/pty-liveness-verdict.test.ts": 27,
+      "src/shared/pty-owner-backend.test.ts": 25,
+      "src/shared/pty-slave-line-discipline-echo.test.ts": 42,
+      "src/shared/pty-startup-ingress-kitty.test.ts": 67,
+      "src/shared/pty-startup-ingress-live-query-reply.test.ts": 54,
+      "src/shared/pty-startup-ingress.test.ts": 148,
+      "src/shared/pty-startup-reply-echo-shapes.test.ts": 67,
+      "src/shared/published-pane-agent-identity.test.ts": 82,
+      "src/shared/pull-request-generation.test.ts": 79,
+      "src/shared/quick-open-directory-reader.test.ts": 64,
+      "src/shared/quick-open-expansion-paths.test.ts": 60,
+      "src/shared/quick-open-filter.renderer-safety.test.ts": 53,
+      "src/shared/quick-open-filter.test.ts": 66,
+      "src/shared/quick-open-fuzzy-scan.test.ts": 1098,
+      "src/shared/quick-open-git-directory-collapse.test.ts": 140,
+      "src/shared/quick-open-install-rg.test.ts": 27,
+      "src/shared/quick-open-listing-limits.test.ts": 45,
+      "src/shared/quick-open-readdir-memory.test.ts": 73,
+      "src/shared/quick-open-readdir-walk.test.ts": 445,
+      "src/shared/quick-open-transport-budget.test.ts": 43,
+      "src/shared/raster-image-base64-preview.test.ts": 501,
+      "src/shared/raster-image-dimensions.test.ts": 53,
+      "src/shared/raster-image-preview-limits.test.ts": 57,
+      "src/shared/rate-limit-reset-format.test.ts": 50,
+      "src/shared/rate-limit-types.test.ts": 32,
+      "src/shared/react-update-depth-attribution.test.ts": 48,
+      "src/shared/reconnect-jitter.test.ts": 34,
+      "src/shared/relay-frame-buffer.test.ts": 517,
+      "src/shared/relay-optional-artifacts.test.ts": 42,
+      "src/shared/relay-version-marker.test.ts": 42,
+      "src/shared/release-channel.test.ts": 36,
+      "src/shared/remote-foreground-evidence.test.ts": 30,
+      "src/shared/remote-pairing-address.test.ts": 143,
+      "src/shared/remote-pairing-verification.test.ts": 52,
+      "src/shared/remote-rpc-content-budget.test.ts": 93,
+      "src/shared/remote-runtime-client-error-classification.test.ts": 70,
+      "src/shared/remote-runtime-client.test.ts": 4934,
+      "src/shared/remote-runtime-connect-bound.test.ts": 387,
+      "src/shared/remote-runtime-memory-limits.test.ts": 159,
+      "src/shared/remote-runtime-outbound-admission.test.ts": 1513,
+      "src/shared/remote-runtime-request-connection-stale.test.ts": 297,
+      "src/shared/remote-runtime-request-connection.test.ts": 349,
+      "src/shared/remote-runtime-request-frames.test.ts": 99,
+      "src/shared/remote-runtime-request-response-router.test.ts": 174,
+      "src/shared/remote-runtime-request-websocket.test.ts": 180,
+      "src/shared/remote-runtime-shared-control-boundary.test.ts": 3236,
+      "src/shared/remote-runtime-shared-control-connection.test.ts": 3372,
+      "src/shared/remote-runtime-shared-control-keepalive-refresh.test.ts": 150,
+      "src/shared/remote-runtime-shared-control-reconnect.test.ts": 176,
+      "src/shared/remote-runtime-shared-control-retired-request-ids.test.ts": 47,
+      "src/shared/remote-runtime-shared-control-socket-generation.test.ts": 111,
+      "src/shared/remote-runtime-shared-control-standing-intent.test.ts": 883,
+      "src/shared/remote-runtime-shared-control-subscription-close.test.ts": 128,
+      "src/shared/remote-runtime-shared-control-subscriptions.test.ts": 161,
+      "src/shared/remote-runtime-socket-liveness.test.ts": 33,
+      "src/shared/remote-runtime-subscription-connect-bound.test.ts": 293,
+      "src/shared/remote-runtime-subscription-frame-router.test.ts": 89,
+      "src/shared/remote-runtime-subscription-request.test.ts": 526,
+      "src/shared/remote-runtime-tailscale-hint.test.ts": 41,
+      "src/shared/remote-runtime-transport-error-agreement.test.ts": 353,
+      "src/shared/remote-workspace-session-projection.test.ts": 156,
+      "src/shared/renderer-restart-preparation.test.ts": 537,
+      "src/shared/repo-badge-color.test.ts": 181,
+      "src/shared/repo-icon.test.ts": 68,
+      "src/shared/repo-ref-maintenance.test.ts": 861,
+      "src/shared/repo-search-limits.test.ts": 41,
+      "src/shared/repro-13889-claude-quarter-circle-busy-title.test.ts": 82,
+      "src/shared/repro-7732-gitlab-job-id-dropped.test.ts": 52,
+      "src/shared/repro-8478-opencode-native-title-icon.test.ts": 69,
+      "src/shared/require-tui-agent-config.test.ts": 51,
+      "src/shared/resolved-worktree-lineage.test.ts": 38,
+      "src/shared/retired-pty-incarnations.test.ts": 44,
+      "src/shared/review-head-tracking-ref.test.ts": 56,
+      "src/shared/ripgrep-process-availability.test.ts": 70,
+      "src/shared/rpc-contract/agent-launch-params.test.ts": 167,
+      "src/shared/rpc-contract/terminal-create-shell-param.test.ts": 156,
+      "src/shared/runtime-client-export-parity.test.ts": 136,
+      "src/shared/runtime-environment-store.test.ts": 259,
+      "src/shared/runtime-host-status-owner.test.ts": 40,
+      "src/shared/runtime-listing-host-scope.test.ts": 38,
+      "src/shared/runtime-navigation.test.ts": 49,
+      "src/shared/runtime-rpc-call-queue-retention.test.ts": 215,
+      "src/shared/runtime-rpc-call-queue.test.ts": 77,
+      "src/shared/runtime-workspace-file-owner.test.ts": 45,
+      "src/shared/runtime-workspace-window-availability.test.ts": 57,
+      "src/shared/search-match-count.test.ts": 48,
+      "src/shared/search-subprocess-lines.test.ts": 117,
+      "src/shared/secret-store.test.ts": 39,
+      "src/shared/secure-file-coarse-ctime.test.ts": 51,
+      "src/shared/secure-file-fsync-flags.test.ts": 93,
+      "src/shared/secure-file.test.ts": 713,
+      "src/shared/secure-path-hardening-cache.test.ts": 37,
+      "src/shared/secure-path-hardening-retry-budget.test.ts": 65,
+      "src/shared/secure-path-windows-acl.win32.test.ts": 84,
+      "src/shared/serve-option-validation.test.ts": 65,
+      "src/shared/session-tab-placement.test.ts": 40,
+      "src/shared/setup-agent-sequencing.test.ts": 4298,
+      "src/shared/setup-agent-sequencing.windows.test.ts": 39,
+      "src/shared/setup-runner-command.test.ts": 58,
+      "src/shared/setup-script-imports.test.ts": 101,
+      "src/shared/setup-script-package-manager-suggestion.test.ts": 37,
+      "src/shared/setup-script-shebang.test.ts": 53,
+      "src/shared/setup-script-telemetry-events.test.ts": 153,
+      "src/shared/setup-script-telemetry.test.ts": 63,
+      "src/shared/sha256.test.ts": 75,
+      "src/shared/shell-foreground-snapshot.test.ts": 157,
+      "src/shared/shell-process-readiness.test.ts": 66,
+      "src/shared/skill-bundle-install-contract.test.ts": 123,
+      "src/shared/skill-bundle-name.test.ts": 37,
+      "src/shared/skill-delete-contract.test.ts": 127,
+      "src/shared/skill-deletion-eligibility.test.ts": 62,
+      "src/shared/skill-install-contract.test.ts": 145,
+      "src/shared/skill-install-failure.test.ts": 88,
+      "src/shared/skill-metadata.test.ts": 40,
+      "src/shared/skill-package-manifest.test.ts": 233,
+      "src/shared/skill-path-containment.test.ts": 35,
+      "src/shared/skills-cli-agent-keys.test.ts": 40,
+      "src/shared/source-control-ai-action-recipes.test.ts": 176,
+      "src/shared/source-control-ai-action-variables.test.ts": 52,
+      "src/shared/source-control-ai-actions.test.ts": 65,
+      "src/shared/source-control-ai-policy-regression.test.ts": 220,
+      "src/shared/source-control-ai-recipe-save.test.ts": 179,
+      "src/shared/source-control-ai.test.ts": 148,
+      "src/shared/source-control-create-review-intent.test.ts": 37,
+      "src/shared/source-control-group-order.test.ts": 52,
+      "src/shared/source-control-primary-action-decision.test.ts": 55,
+      "src/shared/source-control-push-failure.test.ts": 60,
+      "src/shared/source-control-recovery-agent-command.test.ts": 62,
+      "src/shared/source-scan/source-tree-scan.test.ts": 80,
+      "src/shared/source-scan/source-tree-walk.test.ts": 58,
+      "src/shared/ssh-pending-pty-kill.test.ts": 47,
+      "src/shared/ssh-pty-id.test.ts": 56,
+      "src/shared/ssh-relay-pty-ownership-proof.test.ts": 53,
+      "src/shared/ssh-retained-payload-admission.test.ts": 68,
+      "src/shared/ssh-target-generation.test.ts": 50,
+      "src/shared/ssh-types.test.ts": 61,
+      "src/shared/stable-pane-id.test.ts": 37,
+      "src/shared/startup-command-submission.test.ts": 35,
+      "src/shared/status-bar-usage-mode.test.ts": 40,
+      "src/shared/string-chunk-compaction.test.ts": 44,
+      "src/shared/structural-value-equality.test.ts": 47,
+      "src/shared/structured-agent-session-agent-status.test.ts": 67,
+      "src/shared/structured-agent-session-coalescer.test.ts": 49,
+      "src/shared/structured-agent-session-composer.test.ts": 50,
+      "src/shared/structured-agent-session-context-usage.test.ts": 44,
+      "src/shared/structured-agent-session-create.test.ts": 64,
+      "src/shared/structured-agent-session-item-retention.test.ts": 937,
+      "src/shared/structured-agent-session-live-turn.test.ts": 117,
+      "src/shared/structured-agent-session-model-catalog-application.test.ts": 61,
+      "src/shared/structured-agent-session-mutation.test.ts": 49,
+      "src/shared/structured-agent-session-option-codec.test.ts": 25,
+      "src/shared/structured-agent-session-option-picks.test.ts": 79,
+      "src/shared/structured-agent-session-options.test.ts": 81,
+      "src/shared/structured-agent-session-projection.test.ts": 83,
+      "src/shared/structured-agent-session-reducer.test.ts": 146,
+      "src/shared/structured-agent-session-send-disposition.test.ts": 54,
+      "src/shared/structured-agent-session-status-started-at.test.ts": 94,
+      "src/shared/structured-agent-session-status-tool-line.test.ts": 77,
+      "src/shared/structured-agent-session-turn-timing-retention.test.ts": 185,
+      "src/shared/structured-agent-session-turn-timing.test.ts": 95,
+      "src/shared/structured-agent-turn-clock-anchor.test.ts": 36,
+      "src/shared/structured-native-chat-launch-route.test.ts": 38,
+      "src/shared/subprocess-stdin-write.test.ts": 54,
+      "src/shared/synthetic-agent-title.test.ts": 35,
+      "src/shared/tab-title-resolution.test.ts": 32,
+      "src/shared/tailnet-address.test.ts": 44,
+      "src/shared/task-providers.test.ts": 41,
+      "src/shared/task-query.test.ts": 51,
+      "src/shared/task-source-context.test.ts": 93,
+      "src/shared/telemetry-common-props.test.ts": 183,
+      "src/shared/telemetry-events-feature-education.test.ts": 198,
+      "src/shared/telemetry-events.test.ts": 189,
+      "src/shared/telemetry-feature-wall-events.test.ts": 175,
+      "src/shared/telemetry-orca-cli-feature-tip.test.ts": 182,
+      "src/shared/terminal-bell-detector.test.ts": 42,
+      "src/shared/terminal-color-scheme-protocol.test.ts": 50,
+      "src/shared/terminal-composer-draft.test.ts": 49,
+      "src/shared/terminal-custom-themes.test.ts": 42,
+      "src/shared/terminal-escape-introducer.test.ts": 61,
+      "src/shared/terminal-exit-cause.test.ts": 30,
+      "src/shared/terminal-file-url-target.test.ts": 36,
+      "src/shared/terminal-fonts.test.ts": 28,
+      "src/shared/terminal-github-pr-link-detector.test.ts": 73,
+      "src/shared/terminal-input.test.ts": 68,
+      "src/shared/terminal-kitty-keyboard-mode-tracker.test.ts": 61,
+      "src/shared/terminal-kitty-keyboard-tail-retention.test.ts": 180,
+      "src/shared/terminal-line-height-settings.test.ts": 51,
+      "src/shared/terminal-mode-2031-final-state.test.ts": 90,
+      "src/shared/terminal-mode-reset-profiles.test.ts": 95,
+      "src/shared/terminal-osc-color-reply.test.ts": 28,
+      "src/shared/terminal-osc133-carry-retention.test.ts": 266,
+      "src/shared/terminal-output-side-effects.test.ts": 79,
+      "src/shared/terminal-partial-escape-tail-ground-scan.test.ts": 41,
+      "src/shared/terminal-partial-escape-tail.fuzz.test.ts": 1380,
+      "src/shared/terminal-partial-escape-tail.test.ts": 61,
+      "src/shared/terminal-query-reply.test.ts": 86,
+      "src/shared/terminal-quick-commands.test.ts": 33,
+      "src/shared/terminal-reply-query-scan.test.ts": 43,
+      "src/shared/terminal-scrollback-policy.test.ts": 53,
+      "src/shared/terminal-selection-gutter.test.ts": 50,
+      "src/shared/terminal-startup-cwd.test.ts": 220,
+      "src/shared/terminal-stream-json-byte-length.test.ts": 41,
+      "src/shared/terminal-stream-protocol.test.ts": 55,
+      "src/shared/terminal-title-agent-type.test.ts": 62,
+      "src/shared/terminal-title-classification-corpus.test.ts": 94,
+      "src/shared/terminal-title-classification-memo.test.ts": 49,
+      "src/shared/terminal-view-attributes.test.ts": 35,
+      "src/shared/terminal-wait-blocked-reason-legacy-alias.test.ts": 33,
+      "src/shared/terminal-zero-dimensions-diagnostic.test.ts": 45,
+      "src/shared/test-code-path.test.ts": 41,
+      "src/shared/text-search.test.ts": 114,
+      "src/shared/timer-delay.test.ts": 52,
+      "src/shared/tui-agent-config.test.ts": 65,
+      "src/shared/tui-agent-launch-defaults.test.ts": 61,
+      "src/shared/tui-agent-permissions.test.ts": 41,
+      "src/shared/tui-agent-prompt-transport.test.ts": 94,
+      "src/shared/tui-agent-selection.test.ts": 47,
+      "src/shared/tui-agent-startup-copilot-resume.test.ts": 53,
+      "src/shared/tui-agent-startup-hermes.test.ts": 139,
+      "src/shared/tui-agent-startup-session-options.test.ts": 88,
+      "src/shared/tui-agent-startup-shell.test.ts": 108,
+      "src/shared/tui-agent-startup.test.ts": 119,
+      "src/shared/ui-language.test.ts": 36,
+      "src/shared/ui-locale.test.ts": 48,
+      "src/shared/ui-zoom-level.test.ts": 45,
+      "src/shared/updated-at-order.test.ts": 93,
+      "src/shared/updater-windows-signature-check.test.ts": 39,
+      "src/shared/usage-percentage-display-change-notice.test.ts": 94,
+      "src/shared/usage-percentage-display.test.ts": 40,
+      "src/shared/utf8-byte-limits.test.ts": 117,
+      "src/shared/uuid-v4.test.ts": 56,
+      "src/shared/vscode-remote-ssh-launcher.test.ts": 27,
+      "src/shared/window-shortcut-policy-agent-dashboard.test.ts": 48,
+      "src/shared/window-shortcut-policy.test.ts": 78,
+      "src/shared/windows-cmd-runner-delayed-launch.test.ts": 60,
+      "src/shared/windows-command-line-budget.test.ts": 1127,
+      "src/shared/windows-console-input.test.ts": 41,
+      "src/shared/windows-environment-expansion.test.ts": 132,
+      "src/shared/windows-interactive-login-spawn.test.ts": 42,
+      "src/shared/windows-lane-tree-removal-boundary.test.ts": 57,
+      "src/shared/windows-long-path-git-args.test.ts": 41,
+      "src/shared/windows-security-descriptor.test.ts": 33,
+      "src/shared/windows-terminal-shell.test.ts": 60,
+      "src/shared/windows-transient-lock-removal.test.ts": 1028,
+      "src/shared/worker-terminal-host-scope.test.ts": 65,
+      "src/shared/worker-transcript-background-task-text.test.ts": 56,
+      "src/shared/worker-transcript-text-scaling.test.ts": 46,
+      "src/shared/workspace-cleanup-applied-filters.test.ts": 60,
+      "src/shared/workspace-cleanup-browse-state-persistence.test.ts": 65,
+      "src/shared/workspace-cleanup-ui-state.test.ts": 39,
+      "src/shared/workspace-cleanup.test.ts": 40,
+      "src/shared/workspace-doc-history.test.ts": 59,
+      "src/shared/workspace-linked-item-equality.test.ts": 32,
+      "src/shared/workspace-linked-item-source-context.test.ts": 55,
+      "src/shared/workspace-name.test.ts": 55,
+      "src/shared/workspace-session-browser-history.test.ts": 173,
+      "src/shared/workspace-session-partition-owner.test.ts": 38,
+      "src/shared/workspace-session-salvage-equivalence.test.ts": 226,
+      "src/shared/workspace-session-salvage.test.ts": 1142,
+      "src/shared/workspace-session-schema-field-coverage.test.ts": 205,
+      "src/shared/workspace-session-schema.sleeping-agent.test.ts": 247,
+      "src/shared/workspace-session-schema.test.ts": 289,
+      "src/shared/workspace-session-tab-focus-schema.test.ts": 174,
+      "src/shared/workspace-session-terminal-buffers.test.ts": 276,
+      "src/shared/workspace-session-terminal-schema.test.ts": 155,
+      "src/shared/workspace-session-terminal-tab-close.test.ts": 242,
+      "src/shared/workspace-session-validation-work.test.ts": 279,
+      "src/shared/workspace-space-compaction.test.ts": 49,
+      "src/shared/workspace-space-entry-traversal.test.ts": 1467,
+      "src/shared/workspace-space-scan-budget.test.ts": 80,
+      "src/shared/workspace-statuses.test.ts": 70,
+      "src/shared/worktree-execution-host-resolution.test.ts": 48,
+      "src/shared/worktree-name-suggestion.test.ts": 39,
+      "src/shared/worktree-scan-failure.test.ts": 39,
+      "src/shared/worktree/archive-failure-blocking-capability.test.ts": 31,
+      "src/shared/worktree/base-ref.test.ts": 43,
+      "src/shared/worktree/card-properties.test.ts": 56,
+      "src/shared/worktree/catalog-version.test.ts": 29,
+      "src/shared/worktree/create-preparation.test.ts": 35,
+      "src/shared/worktree/github-pr-suppression.test.ts": 57,
+      "src/shared/worktree/host-context-labels.test.ts": 59,
+      "src/shared/worktree/host-qualified-identity.test.ts": 61,
+      "src/shared/worktree/id.test.ts": 58,
+      "src/shared/worktree/identity.test.ts": 38,
+      "src/shared/worktree/ownership-configured-base-visibility.test.ts": 77,
+      "src/shared/worktree/ownership-worktree-base-path.test.ts": 57,
+      "src/shared/worktree/ownership.test.ts": 264,
+      "src/shared/worktree/removal-fence-error.test.ts": 27,
+      "src/shared/worktree/removal-force-classification.test.ts": 30,
+      "src/shared/worktree/retired-name-cache.test.ts": 52,
+      "src/shared/worktree/retired-name-registry.test.ts": 289,
+      "src/shared/worktree/sort-order-update.test.ts": 43,
+      "src/shared/worktree/submodule-removal.test.ts": 48,
+      "src/shared/worktree/visibility-sources.test.ts": 87,
+      "src/shared/ws-outbound-backpressure-queue.test.ts": 67,
+      "src/shared/wsl-exec-mode-separator.test.ts": 1946,
+      "src/shared/wsl-login-shell-command.test.ts": 140,
+      "src/shared/wsl-paths.test.ts": 93,
+      "src/shared/zcode-missing-tui.test.ts": 43,
+      "src/shared/zcode-orchestration-contract.test.ts": 98,
+      "src/shared/zod-salvage-absence.test.ts": 106,
+      "tests/e2e/accumulated-workspace-state-builder.unit.test.ts": 88,
+      "tests/e2e/alternate-screen-fixture-script.unit.test.ts": 55,
+      "tests/e2e/codex-child-approval-activity-row.unit.test.ts": 4306,
+      "tests/e2e/completed-worker-retirement-resume.unit.test.ts": 5834,
+      "tests/e2e/daemon-running-work-probe.unit.test.ts": 311,
+      "tests/e2e/direct-ssh-snapshot-parking.unit.test.ts": 2238,
+      "tests/e2e/e2e-worker-env-isolation.unit.test.ts": 84,
+      "tests/e2e/folder-upgrade-identity-persistence.unit.test.ts": 1410,
+      "tests/e2e/github-work-item-search-burst.unit.test.ts": 1152,
+      "tests/e2e/global-teardown.unit.test.ts": 136,
+      "tests/e2e/helpers/alt-screen-frame.unit.test.ts": 110,
+      "tests/e2e/helpers/client-hosted-browser-fixture.unit.test.ts": 753,
+      "tests/e2e/helpers/electron-crashpad-cleanup.unit.test.ts": 50,
+      "tests/e2e/helpers/electron-home-isolation.unit.test.ts": 37,
+      "tests/e2e/helpers/electron-launch-args.unit.test.ts": 52,
+      "tests/e2e/helpers/electron-main-evaluate-retry.unit.test.ts": 2464,
+      "tests/e2e/helpers/electron-process-shutdown.unit.test.ts": 60,
+      "tests/e2e/helpers/fake-agent-command-override.unit.test.ts": 35,
+      "tests/e2e/helpers/fake-agent-paste-end-scanner.unit.test.ts": 79,
+      "tests/e2e/helpers/git-status-retry-barrier.unit.test.ts": 57,
+      "tests/e2e/helpers/golden-source-control.unit.test.ts": 640,
+      "tests/e2e/helpers/headless-paired-runtime-serve-readiness.unit.test.ts": 59,
+      "tests/e2e/helpers/nested-runtime-proxy-jump-fixture.unit.test.ts": 30,
+      "tests/e2e/helpers/paired-client-runtime-environment.unit.test.ts": 82,
+      "tests/e2e/helpers/paired-client-window-reveal.unit.test.ts": 67,
+      "tests/e2e/helpers/persisted-profile-state.unit.test.ts": 356,
+      "tests/e2e/helpers/remote-skill-cloud-fixture.unit.test.ts": 328,
+      "tests/e2e/helpers/remote-terminal-source-range-contract-fixture.unit.test.ts": 46,
+      "tests/e2e/helpers/ssh-port-forward-snapshot-barrier.unit.test.ts": 107,
+      "tests/e2e/helpers/streaming-terminal-cleanup.unit.test.ts": 51,
+      "tests/e2e/host-cold-park-remote-subscriber.unit.test.ts": 5055,
+      "tests/e2e/host-guest-paint-retention-remote-viewer.unit.test.ts": 3075,
+      "tests/e2e/omp-child-session-recovery.unit.test.ts": 1630,
+      "tests/e2e/omp-retired-host-renderer.unit.test.ts": 2215,
+      "tests/e2e/omp-risk-remote-review.unit.test.ts": 816,
+      "tests/e2e/orca-restart-navigation.unit.test.ts": 622,
+      "tests/e2e/orchestration-run-pagination.unit.test.ts": 52,
+      "tests/e2e/paced-terminal-typing.unit.test.ts": 656,
+      "tests/e2e/paired-runtime-rejected-input-remount.unit.test.ts": 2375,
+      "tests/e2e/remote-agent-completion-authority.unit.test.ts": 1540,
+      "tests/e2e/remote-terminal-tab-retirement.unit.test.ts": 4050,
+      "tests/e2e/restored-terminal-input-readiness.unit.test.ts": 57,
+      "tests/e2e/runtime-graph-publication-probe.unit.test.ts": 40,
+      "tests/e2e/session-tabs-decorative-title-fanout.unit.test.ts": 3808,
+      "tests/e2e/session-tabs-empty-inventory-daemon-oracle.unit.test.ts": 775,
+      "tests/e2e/session-tabs-rich-status-boundaries.unit.test.ts": 1914,
+      "tests/e2e/ssh-browser-network-execution-route.docker.unit.test.ts": 287,
+      "tests/e2e/ssh-codex-replay-reply-probe.unit.test.ts": 53,
+      "tests/e2e/structured-agent-session-read-owner.unit.test.ts": 739,
+      "tests/e2e/structured-chat-owner-status-activation.unit.test.ts": 1707,
+      "tests/e2e/structured-native-chat-routing-authority.unit.test.ts": 214,
+      "tests/e2e/sustained-agent-typing-load-scripts.unit.test.ts": 2194,
+      "tests/e2e/terminal-binding-crash-hydration.unit.test.ts": 920,
+      "tests/e2e/terminal-foreground-confirmation.unit.test.ts": 196,
+      "tests/e2e/terminal-perf-presentation.unit.test.ts": 44,
+      "tests/e2e/terminal-probe-input-sequence.unit.test.ts": 53,
+      "tests/e2e/terminal-split-activation-latency-artifact.unit.test.ts": 53,
+      "tests/e2e/terminal-split-activation-latency-report.unit.test.ts": 68,
+      "tests/tools/omp-close-lifecycle.test.mjs": 255,
+      "tests/tools/omp-config-root-local-shell.test.mjs": 196,
+      "tests/tools/omp-config-root-relay-shell.test.mjs": 169,
+      "tests/tools/omp-relay-close-lifecycle.test.mjs": 329,
+      "tests/tools/relay-bench/phone-e2ee-desktop-parity.test.mjs": 126,
+      "tests/tools/relay-bench/region-probe-replay.test.mjs": 134,
+      "tests/tools/relay-bench/relay-bench-invocation.test.mjs": 94,
+      "tests/tools/relay-bench/relay-bench-state-file.test.mjs": 52,
+      "tests/tools/relay-bench/relay-phone-connect-bench.test.mjs": 134,
+      "tests/tools/win-update-e2e/app-driver.test.mjs": 671,
+      "tests/tools/win-update-e2e/app-shutdown.test.mjs": 656,
+      "tests/tools/windows-pty-native-capability-smoke/packaged-node-pty-capability-oracle.test.mjs": 46,
+      "tests/tools/windows-pty-native-capability-smoke/packaged-node-pty-capability-probe.test.mjs": 89,
+      "tests/tools/windows-pty-native-capability-smoke/run.test.mjs": 32
     }
   },
   "e2e": {
diff --git a/config/scripts/ci-shard-timings.md b/config/scripts/ci-shard-timings.md
index f6e846cfd6d2..db79660a1837 100644
--- a/config/scripts/ci-shard-timings.md
+++ b/config/scripts/ci-shard-timings.md
@@ -4,8 +4,9 @@ The eight unit shards and fourteen general E2E shards use longest-processing-tim
 assignment of whole files to the currently lightest shard. Ties use file path and
 then shard index, independent of filesystem enumeration and locale. Unknown,
 zero, or invalid durations use the baseline's positive median (1 second when no
-positive evidence exists). Deleted files never enter discovery. Unit weights add
-526ms per file for measured transform/setup/import/environment overhead.
+positive evidence exists). Deleted files never enter discovery. Unit weights
+include measured environment startup, preparation, setup, imports and test execution;
+no uniform overhead is added.
 
 Unit assignment runs inside Vitest's sequencer after discovery and CLI exclusions;
 Vitest's default sort, workers and isolation remain intact. It is enabled only by
@@ -17,9 +18,10 @@ Dedicated SSH, native IME, WSL and first-paint lanes are unchanged.
 
 ## Evidence and limits
 
-`ci-shard-timings.json` records run IDs and every contributing job ID:
+`ci-shard-timings.json` records source runs. Unit report provenance and contributing
+job IDs for the current refresh appear below; E2E job IDs remain in the JSON.
 
-- Unit run **34675583768**, Node 24, all eight successful shards: 8,484 completed
+- Original unit run **34675583768**, Node 24, all eight successful shards: 8,484 completed
   file durations. The summed transform/setup/import/environment durations divided
   by measured file count give a rounded-up **526ms** per-file overhead allowance.
   The original shard weighted loads were **764–849 worker-seconds**, versus
@@ -30,20 +32,88 @@ Dedicated SSH, native IME, WSL and first-paint lanes are unchanged.
   counted. Original completed test loads were **540–1,727 seconds**, versus
   **1,083–1,093** after whole-file balancing on the same measured files. The longest
   measured file is **528 seconds**, below the balanced shard load.
-- Current checkout discovery at validation contained **8,553 unit files** after the
+- Original checkout discovery at validation contained **8,553 unit files** after the
   workflow's exact exclusions and **733 headless E2E tests in 340 files**. New and
   unmeasured files remain selected. Projected current loads were about **797
   worker-seconds** per unit shard (1,068–1,070 files) and **1,190–1,200 seconds** per
   E2E shard (22–25 files).
 
 These are scheduling projections, not measured post-change wall-clock gains.
-Unit durations overlap across workers and the overhead allowance is an average,
-not a per-file import profile. E2E evidence includes failed shards and can omit
+Unit durations overlap across workers. The original average overhead has now been
+replaced by per-file module measurements. E2E evidence includes failed shards and can omit
 unfinished tests; unknowns receive a deterministic estimate. Historical timings
 age as specs change. Full CI runs on the existing runner classes are required to
 measure elapsed-time and occupancy improvements, including discovery overhead.
 No retries, assertions, coverage exclusions, runner classes or shard counts changed.
 
+## Current unit refresh: September 27, 2026
+
+The baseline imports every successful Node 24 shard from
+[run 36294142683, attempt 1](https://github.com/stablyai/orca/actions/runs/36294142683/attempts/1).
+The recorded checkout was `cc35c1b422e9c20197bc59aa27a71019ffc18b5b`, with Node
+24.21.0 and unchanged Linux workers. All 9,847 report entries match their saved
+assignments and current discovery exactly once, with no unhandled errors. The old
+baseline lacked 165 files and retained one deleted path. The E2E weights are unchanged.
+
+Using these measurements for both assignments, the maximum projected load falls
+from 1,043.811 to 919.695 worker-seconds (11.9%); each shard selects 1,230–1,231 files.
+Observed source-run test steps ranged from 282 to 429 seconds. The fastest runner's
+common-file durations were broadly lower than its prior measurements, so runner
+variation may contribute to that spread. The projection does not establish a
+hosted wall-clock improvement. No worker, shard-count, or algorithm change is made.
+
+## Previous unit refresh: September 26, 2026
+
+The previous baseline imported all eight successful unit shards from
+[run 36221874572, attempt 1](https://github.com/stablyai/orca/actions/runs/36221874572/attempts/1).
+They ran Node **24.21.0** on `ubuntu-latest` with Vitest's default Linux worker
+count and isolation. The checked-out merge was
+`f68ecf8c4aeb396795a8f0f9dbd8ef58fd634d43`, whose second parent is the run's PR
+head `5a26cfa83d7542f9f4545b7a7c4c4174ff213b18`. The workflow failed in another
+lane; every contributing unit job and test step succeeded. No failed reports or
+four-worker trial measurements contributed.
+
+| Shard | Job ID       | Completed files | Measured worker-seconds | Test step seconds | Job seconds |
+| ----- | ------------ | --------------- | ----------------------- | ----------------- | ----------- |
+| 1     | 108348885240 | 1,209           | 1,019.941               | 420               | 446         |
+| 2     | 108348885231 | 1,210           | 1,000.547               | 413               | 447         |
+| 3     | 108348885289 | 1,211           | 933.332                 | 386               | 419         |
+| 4     | 108348885241 | 1,211           | 1,022.838               | 418               | 453         |
+| 5     | 108348885283 | 1,211           | 1,016.000               | 417               | 448         |
+| 6     | 108348885237 | 1,211           | 980.988                 | 407               | 440         |
+| 7     | 108348885275 | 1,210           | 810.367                 | 326               | 355         |
+| 8     | 108348885261 | 1,210           | 973.722                 | 407               | 445         |
+
+All reports have `status: passed`, zero unhandled errors and identical source,
+run, attempt, Node version and shard count. Each report's file keys exactly match
+its selected assignment; all eight assignments describe the same plan, with no
+missing or duplicate files across **9,683** measurements. Replaying the old
+baseline reproduces that complete plan. Its SHA-256 is
+`9042d8f1d2420b301ee5d9e56d768ad7d38530897dce0d641f362333aa194ad8`.
+The importer sets overhead to zero; the E2E baseline is unchanged.
+
+Discovery at checkout `80ff6c4e3e66de46e41c75856fd1fb6d77d515de`, using the unit
+workflow's exact exclusions, contains **9,732 files**. All 9,683 measurements
+still apply; the **49** unmeasured files receive the new **230ms** median. Both
+plans select every current file exactly once. To compare assignments fairly,
+the following loads evaluate both plans using the same new measurements and
+fallback, rather than comparing two different timing metrics:
+
+| Current discovery projection | Previous assignment | Refreshed assignment  |
+| ---------------------------- | ------------------- | --------------------- |
+| Files per shard              | 1,216–1,217         | 1,215–1,217           |
+| Worker-seconds per shard     | 816.045–1,049.604   | 971.124–971.126       |
+| Largest load                 | 1,049.604           | 971.126 (7.48% lower) |
+
+The combined projected work is unchanged at **7,769.005 worker-seconds**.
+Reassignment redistributes measured work; it does not itself reduce test work.
+These are projections from one successful unit run, not a measured wall-clock
+improvement. The source test steps took **326–420 seconds**, totaling **3,194
+seconds (53.233 runner-minutes)**. Full unit jobs took **355–453 seconds**, totaling
+**3,453 seconds (57.550 runner-minutes)**. These durations exclude queue time;
+hosted before/after runs are needed to measure the refreshed assignment's elapsed
+time and occupancy.
+
 ## Reproduction and refresh
 
 Every shard uploads an artifact named with its shard, Node version where relevant,
@@ -53,13 +123,38 @@ E2E also retains both discovery reports and `selected.txt`. Artifacts live for
 14 days. A rerun of the same source uses the same checked-in baseline rather than
 mutable timing caches; a GitHub job rerun therefore keeps its assignment.
 
+Unit artifacts also contain `unit-timings.json`, measured through Vitest's reporter
+API. Each file's weight includes environment startup, test harness preparation,
+setup files, imports and test execution. Imports are often more expensive than the
+assertions: run **36212793136**, shard 4, spent **535 worker-seconds importing**
+and **357 running tests**. The refreshed baseline replaces the old uniform import
+allowance with the complete successful measurements described above.
+
 For E2E reproduction, check out the recorded source and pass the saved list to the
 existing command: `pnpm run test:e2e --test-list=/path/to/selected.txt` with the same
 CI environment/build inputs. For unit reproduction, use the unchanged workflow
 command and exclusions with `ORCA_BALANCE_UNIT_SHARDS=1` and the recorded
 `--shard=INDEX/8`. Direct test-file reruns remain supported.
 
-To refresh the baseline, download `log-JOB_ID.txt` files into one directory from
+To refresh unit weights, download all `unit-shard-node-*` artifacts from one
+complete successful unit shard set, run attempt and Node version into a directory,
+preserving their shard subdirectories. An unrelated workflow lane may fail;
+every contributing unit job and report must pass. Check the attempt-specific jobs
+API, source workflow/config, report provenance and exact file coverage against the
+saved assignments, then run:
+
+```sh
+node config/scripts/ci-unit-timing-import.mjs ARTIFACT_DIRECTORY config/scripts/ci-shard-timings.json
+```
+
+The importer rejects missing or duplicate shards, duplicate files, failed unit reports,
+unhandled errors and mixed source revisions, run attempts or Node versions. It
+preserves E2E weights and sets unit overhead to zero because the per-file measurements
+already include it. Timing artifacts remain diagnostic; failed or interrupted unit runs
+are retained for investigation but cannot replace the scheduling baseline.
+
+For older unit runs without reporter artifacts, and E2E refreshes, download
+`log-JOB_ID.txt` files into one directory from
 exactly one eight-shard unit run and one fourteen-shard general E2E run. Use the
 job IDs from the Actions jobs API and fetch each with
 `gh api repos/stablyai/orca/actions/jobs/JOB_ID/logs`. Do not include dedicated
@@ -71,7 +166,7 @@ node config/scripts/ci-shard-timing-import.mjs LOG_DIRECTORY UNIT_RUN_ID E2E_RUN
 
 The initial source logs are in `/tmp/orca-ci-shard-logs`; two were reused from
 `/tmp/orca-ci-audit`, and the remaining twenty were fetched read-only. Reimporting
-those logs reproduced the checked-in JSON byte-for-byte. Review file-count and
+those logs reproduced the original baseline byte-for-byte. Review file-count and
 load projections before adopting a new baseline; no network access is needed to
 plan or run shards.
 
@@ -88,6 +183,11 @@ plan or run shards.
   Vitest shard executed successfully and persisted its manifest.
 - Focused TypeScript checking of `config/vitest.config.ts` and imported modules,
   oxlint, formatting and baseline reimport checks passed.
+- The September 26 refresh matched all eight reports to their saved assignments,
+  checked successful attempt-specific job results and source worker settings,
+  reproduced the old assignment, and preserved the E2E baseline exactly. All 12
+  importer/reporter and shard-assignment tests passed; importing the artifacts
+  reproduced the refreshed JSON byte-for-byte.
 
 All local tests used `ORCA_BACKGROUND_LAUNCH=1` in background tool sessions. No app
 windows or full E2E test bodies were launched.
diff --git a/config/scripts/ci-unit-dependency-graph.mjs b/config/scripts/ci-unit-dependency-graph.mjs
new file mode 100644
index 000000000000..f491c1749ded
--- /dev/null
+++ b/config/scripts/ci-unit-dependency-graph.mjs
@@ -0,0 +1,84 @@
+import { globSync, readFileSync } from 'node:fs'
+import { posix, join } from 'node:path'
+import ts from 'typescript-api'
+
+const EXTENSIONS = [
+  '',
+  '.ts',
+  '.tsx',
+  '.mjs',
+  '.js',
+  '.cjs',
+  '.json',
+  '/index.ts',
+  '/index.tsx',
+  '/index.js'
+]
+const INDIRECT_INPUT =
+  /\b(?:readFile\w*|readdir\w*|glob\w*|spawn\w*|execFile\w*|execSync|runProcess\w*|fork|Worker)\b|\bimport\s*\(\s*[^'"\s]|\brequire\s*\(\s*[^'"\s]|\bnew\s+URL\s*\(/
+
+function localPath(file, specifier) {
+  if (specifier.startsWith('.')) {
+    return posix.join(posix.dirname(file), specifier)
+  }
+  if (specifier.startsWith('@renderer/')) {
+    return `src/renderer/src/${specifier.slice(10)}`
+  }
+  if (specifier.startsWith('@/')) {
+    return `src/renderer/src/${specifier.slice(2)}`
+  }
+  return null
+}
+
+export function buildUnitDependencyGraph(sources) {
+  const reverse = new Map()
+  const opaque = new Set()
+  for (const [file, source] of sources) {
+    if (INDIRECT_INPUT.test(source) || file.startsWith('config/') || file.startsWith('tests/')) {
+      opaque.add(file)
+    }
+    for (const imported of ts.preProcessFile(source, true, true).importedFiles) {
+      const path = localPath(file, imported.fileName)
+      if (path === null) {
+        continue
+      }
+      const resolved = EXTENSIONS.map((extension) => path + extension).find((candidate) =>
+        sources.has(candidate)
+      )
+      if (!resolved) {
+        opaque.add(file)
+        continue
+      }
+      if (!reverse.has(resolved)) {
+        reverse.set(resolved, new Set())
+      }
+      reverse.get(resolved).add(file)
+    }
+  }
+  return { reverse, opaque }
+}
+
+export function collectUnitDependencyGraph(root = process.cwd()) {
+  const files = globSync(
+    [
+      'src/**/*.{ts,tsx,js,mjs,cjs,json}',
+      'config/**/*.{ts,tsx,js,mjs,cjs,json}',
+      'tests/**/*.{ts,tsx,js,mjs,cjs,json}'
+    ],
+    { cwd: root }
+  )
+  const sources = new Map(
+    files.map((file) => [file.replaceAll('\\', '/'), readFileSync(join(root, file), 'utf8')])
+  )
+  return { ...buildUnitDependencyGraph(sources), files: new Set(sources.keys()) }
+}
+
+export function unitConsumers(seeds, reverse) {
+  const result = new Set(seeds)
+  for (const file of result) {
+    for (const consumer of reverse.get(file) ?? []) {
+      result.add(consumer)
+    }
+  }
+  return result
+}
diff --git a/config/scripts/ci-unit-files.mjs b/config/scripts/ci-unit-files.mjs
new file mode 100644
index 000000000000..ec7101b6ee30
--- /dev/null
+++ b/config/scripts/ci-unit-files.mjs
@@ -0,0 +1,41 @@
+import { globSync } from 'node:fs'
+import { defaultExclude } from 'vitest/config'
+
+export const UNIT_INCLUDE = [
+  'src/**/*.test.ts',
+  'src/**/*.test.tsx',
+  'config/scripts/**/*.test.ts',
+  'config/scripts/**/*.test.mjs',
+  'tests/tools/**/*.test.mjs',
+  'tests/e2e/**/*.unit.test.ts'
+]
+
+export const UNIT_EXCLUDE = [
+  ...defaultExclude,
+  'src/main/daemon/repro-13767-shell-ready-marker-lost-to-exec.test.ts',
+  'src/main/daemon/shell-ready.test.ts',
+  'src/main/daemon/node-pty-fd-leak.test.ts',
+  'src/main/providers/local-pty-shell-ready-zsh-launch-environment.test.ts',
+  'src/main/providers/__tests__/shell-ready-framework-example.test.ts',
+  'src/main/pty/omp-shell-wrapper-alias-safety.test.ts',
+  'src/main/pty/omp-shell-wrapper.node-pty.test.ts',
+  'src/main/shell-startup-feature-channel.test.ts',
+  'src/main/terminal-history-fish-session.node-pty.test.ts',
+  'src/main/zsh-scoped-histfile.live-shell.test.ts',
+  'src/main/zsh-startup-hook-user-config-equivalence.live-shell.test.ts',
+  'src/main/zsh-wrapper-version-mismatch.live-shell.test.ts',
+  'src/renderer/src/components/terminal-pane/fish-color-scheme-child-stdin.node-pty.test.ts',
+  'src/shared/fish-query-reply-child-stdin.node-pty.test.ts',
+  'src/shared/pty-reply-echo-shapes.node-pty.test.ts',
+  'src/shared/startup-shell-portability.live-shell.test.ts',
+  'src/shared/posix-command-path-lookup.test.ts',
+  'tests/e2e/relay-region-compatibility.unit.test.ts',
+  'tests/e2e/relay-region-correction.unit.test.ts',
+  'tests/e2e/cross-version-wire/**'
+]
+
+export function discoverUnitFiles(root = process.cwd()) {
+  return globSync(UNIT_INCLUDE, { cwd: root, exclude: UNIT_EXCLUDE })
+    .map((file) => file.replaceAll('\\', '/'))
+    .sort()
+}
diff --git a/config/scripts/ci-unit-plan.mjs b/config/scripts/ci-unit-plan.mjs
new file mode 100644
index 000000000000..28eed60f8e89
--- /dev/null
+++ b/config/scripts/ci-unit-plan.mjs
@@ -0,0 +1,60 @@
+import { appendFileSync, readFileSync } from 'node:fs'
+import { pathToFileURL } from 'node:url'
+import { runProcessSync } from './script-child-process.mjs'
+import { collectUnitDependencyGraph } from './ci-unit-dependency-graph.mjs'
+import { discoverUnitFiles } from './ci-unit-files.mjs'
+import { planUnitSelection } from './ci-unit-selection.mjs'
+import { readTimingBaseline, writeAssignment } from './ci-shard-assignment.mjs'
+
+export function prepareUnitPlan(env = process.env) {
+  const files = discoverUnitFiles()
+  let plan
+  try {
+    const event = JSON.parse(readFileSync(env.GITHUB_EVENT_PATH, 'utf8'))
+    if (env.GITHUB_EVENT_NAME !== 'pull_request') {
+      throw new Error('Full reference run')
+    }
+    const diff = runProcessSync({
+      program: 'git',
+      args: ['diff', '--name-only', '--no-renames', '-z', 'HEAD^1', 'HEAD'],
+      maxOutputBytes: 16 * 1024 * 1024
+    })
+    if (diff.code !== 0 || diff.timedOut) {
+      throw new Error('Changed paths unavailable')
+    }
+    plan = planUnitSelection({
+      files,
+      changed: diff.stdout.split('\0').filter(Boolean),
+      graph: collectUnitDependencyGraph(),
+      timings: readTimingBaseline('unit').timings,
+      event,
+      mode: env.ORCA_UNIT_SELECTION_MODE
+    })
+  } catch (error) {
+    plan = {
+      version: 1,
+      mode: 'shadow',
+      selectionAvailable: false,
+      reason: String(error),
+      files,
+      candidateFiles: files,
+      executionFiles: files,
+      shards: Array.from({ length: 8 }, (_, index) => ({ index: index + 1, count: 8 }))
+    }
+  }
+  writeAssignment('ci-shards/unit-selection.json', plan)
+  if (env.GITHUB_OUTPUT) {
+    appendFileSync(env.GITHUB_OUTPUT, `shards=${JSON.stringify(plan.shards)}\n`)
+  }
+  if (env.GITHUB_STEP_SUMMARY) {
+    appendFileSync(
+      env.GITHUB_STEP_SUMMARY,
+      `Unit selection: **${plan.mode}**; ${plan.candidateFiles.length}/${files.length} candidate files; ${plan.shards.length} execution shards. ${plan.reason}\n`
+    )
+  }
+  return plan
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  prepareUnitPlan()
+}
diff --git a/config/scripts/ci-unit-plan.test.mjs b/config/scripts/ci-unit-plan.test.mjs
new file mode 100644
index 000000000000..1711582b64f8
--- /dev/null
+++ b/config/scripts/ci-unit-plan.test.mjs
@@ -0,0 +1,78 @@
+import { mkdtempSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { expect, it } from 'vitest'
+import { runProcessSync } from './script-child-process.mjs'
+
+it.each([true, false])(
+  'plans from a real Git diff, with parent evidence available: %s',
+  (withParent) => {
+    const root = mkdtempSync(join(tmpdir(), 'orca-unit-plan-'))
+    const git = (args) => {
+      const result = runProcessSync({ program: 'git', args, cwd: root })
+      expect(result.code, result.stderr).toBe(0)
+      return result.stdout.trim()
+    }
+    try {
+      mkdirSync(join(root, 'src'))
+      writeFileSync(join(root, 'src/value.ts'), 'export const value = 1')
+      writeFileSync(join(root, 'src/consumer.test.ts'), "import './value'")
+      writeFileSync(join(root, 'src/unrelated.test.ts'), 'export const unrelated = true')
+      git(['init', '--quiet'])
+      git(['add', 'src'])
+      const commit = [
+        '-c',
+        'user.name=CI Test',
+        '-c',
+        'user.email=ci-test@example.invalid',
+        '-c',
+        'commit.gpgsign=false',
+        'commit',
+        '--quiet',
+        '-m',
+        'fixture'
+      ]
+      git(commit)
+      if (withParent) {
+        writeFileSync(join(root, 'src/value.ts'), 'export const value = 2')
+        git(['add', 'src'])
+        git(commit)
+      }
+      const sourceSha = git(['rev-parse', 'HEAD'])
+      const eventPath = join(root, 'event.json')
+      writeFileSync(eventPath, JSON.stringify({ pull_request: { draft: true } }))
+      const result = runProcessSync({
+        program: process.execPath,
+        args: [fileURLToPath(new URL('./ci-unit-plan.mjs', import.meta.url))],
+        cwd: root,
+        env: {
+          ...process.env,
+          ORCA_BACKGROUND_LAUNCH: '1',
+          ORCA_UNIT_SELECTION_MODE: 'selected',
+          GITHUB_EVENT_NAME: 'pull_request',
+          GITHUB_EVENT_PATH: eventPath,
+          GITHUB_SHA: sourceSha,
+          ORCA_SHARD_SOURCE_SHA: sourceSha,
+          GITHUB_OUTPUT: join(root, 'outputs'),
+          GITHUB_STEP_SUMMARY: join(root, 'summary')
+        }
+      })
+      expect(result.code, result.stderr).toBe(0)
+      const plan = JSON.parse(readFileSync(join(root, 'ci-shards/unit-selection.json'), 'utf8'))
+      expect(plan.sourceSha).toBe(sourceSha)
+      expect(plan.mode).toBe(withParent ? 'selected' : 'shadow')
+      expect(plan.executionFiles).toEqual(
+        withParent ? ['src/consumer.test.ts'] : ['src/consumer.test.ts', 'src/unrelated.test.ts']
+      )
+      expect(plan.reason).toBe(
+        withParent
+          ? 'Transitive imports plus indirect-input consumers'
+          : 'Error: Changed paths unavailable'
+      )
+      expect(plan.shards).toHaveLength(withParent ? 1 : 8)
+    } finally {
+      rmSync(root, { recursive: true, force: true })
+    }
+  }
+)
diff --git a/config/scripts/ci-unit-selection-review.mjs b/config/scripts/ci-unit-selection-review.mjs
new file mode 100644
index 000000000000..ae976a064286
--- /dev/null
+++ b/config/scripts/ci-unit-selection-review.mjs
@@ -0,0 +1,113 @@
+import { appendFileSync, globSync, readFileSync, writeFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { pathToFileURL } from 'node:url'
+
+export function reviewUnitSelection(records) {
+  const groups = new Map()
+  for (const { plan, timing } of records) {
+    const key = JSON.stringify([
+      timing.sourceSha,
+      timing.runId,
+      timing.runAttempt,
+      timing.nodeVersion
+    ])
+    if (!groups.has(key)) {
+      groups.set(key, [])
+    }
+    groups.get(key).push({ plan, timing })
+  }
+  return [...groups.values()].map((group) => {
+    const { plan, timing: first } = group[0]
+    const selected = new Set(plan.candidateFiles)
+    const files = new Set()
+    const shards = new Set()
+    const missedFailures = []
+    let invalid = false
+    let omittedMs = 0
+    let totalMs = 0
+    for (const { plan: other, timing } of group) {
+      invalid ||=
+        JSON.stringify(other) !== JSON.stringify(plan) ||
+        !first.sourceSha ||
+        plan.sourceSha !== first.sourceSha ||
+        timing.unhandledErrors !== 0 ||
+        !['passed', 'failed'].includes(timing.status) ||
+        timing.shard.count !== first.shard.count ||
+        shards.has(timing.shard.index) ||
+        timing.shard.index < 1 ||
+        timing.shard.index > first.shard.count
+      shards.add(timing.shard.index)
+      for (const [file, duration] of Object.entries(timing.timings)) {
+        invalid ||=
+          files.has(file) ||
+          !Number.isFinite(duration) ||
+          duration <= 0 ||
+          !['passed', 'failed', 'skipped'].includes(timing.results?.[file])
+        files.add(file)
+        totalMs += duration
+        if (!selected.has(file)) {
+          omittedMs += duration
+          if (timing.results?.[file] === 'failed') {
+            missedFailures.push(file)
+          }
+        }
+      }
+    }
+    const complete =
+      !invalid &&
+      shards.size === first.shard.count &&
+      JSON.stringify([...files].sort()) === JSON.stringify([...plan.files].sort())
+    return {
+      sourceSha: first.sourceSha,
+      runId: first.runId,
+      runAttempt: first.runAttempt,
+      nodeVersion: first.nodeVersion,
+      mode: plan.mode,
+      completeFullRun: complete && plan.mode === 'shadow',
+      selectionEvaluated: complete && plan.mode === 'shadow' && plan.selectionAvailable === true,
+      reason: plan.reason,
+      missedFailures,
+      files: files.size,
+      candidateFiles: selected.size,
+      measuredWorkerMs: totalMs,
+      potentiallyOmittedWorkerMs: omittedMs
+    }
+  })
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  const directory = process.argv[2]
+  if (!directory) {
+    throw new Error('Usage: ci-unit-selection-review.mjs ARTIFACT_DIRECTORY')
+  }
+  const records = globSync('**/unit-timings.json', { cwd: directory }).map((file) => {
+    const timing = JSON.parse(readFileSync(join(directory, file), 'utf8'))
+    const plan = JSON.parse(
+      readFileSync(
+        join(directory, file.replace('unit-timings.json', 'unit-selection.json')),
+        'utf8'
+      )
+    )
+    return { timing, plan }
+  })
+  if (!records.length) {
+    throw new Error('No unit selection evidence')
+  }
+  const review = reviewUnitSelection(records)
+  writeFileSync(join(directory, 'selection-review.json'), `${JSON.stringify(review, null, 2)}\n`)
+  const summary = [
+    '## Unit selection evidence',
+    '',
+    ...review.map(
+      (row) =>
+        `- Node ${row.nodeVersion}: ${row.completeFullRun ? 'complete full reference' : 'incomplete or selected evidence'}; ${row.selectionEvaluated ? 'selection evaluated' : 'not selection-validation evidence'}; ${row.candidateFiles}/${row.files} candidate files; ${row.missedFailures.length} failures outside selection; ${(row.potentiallyOmittedWorkerMs / 60_000).toFixed(1)} potentially omitted worker-minutes. ${row.reason ?? ''}`
+    ),
+    '',
+    'Worker time overlaps across processes; it is not runner time. Promote only after representative complete references show no missed failures.',
+    ''
+  ].join('\n')
+  if (process.env.GITHUB_STEP_SUMMARY) {
+    appendFileSync(process.env.GITHUB_STEP_SUMMARY, summary)
+  }
+  console.log(summary)
+}
diff --git a/config/scripts/ci-unit-selection-review.test.mjs b/config/scripts/ci-unit-selection-review.test.mjs
new file mode 100644
index 000000000000..ff8f4c385687
--- /dev/null
+++ b/config/scripts/ci-unit-selection-review.test.mjs
@@ -0,0 +1,55 @@
+import { expect, it } from 'vitest'
+import { reviewUnitSelection } from './ci-unit-selection-review.mjs'
+
+const plan = {
+  sourceSha: 'sha',
+  mode: 'shadow',
+  selectionAvailable: true,
+  files: ['a', 'b'],
+  candidateFiles: ['a']
+}
+
+it('does not present full fallback runs as selection-validation evidence', () => {
+  const records = [record(1, 'a', 'passed'), record(2, 'b', 'passed')].map((row) => ({
+    ...row,
+    plan: { ...plan, selectionAvailable: false }
+  }))
+  expect(reviewUnitSelection(records)[0]).toMatchObject({
+    completeFullRun: true,
+    selectionEvaluated: false
+  })
+})
+const record = (index, file, state) => ({
+  plan,
+  timing: {
+    sourceSha: 'sha',
+    runId: '1',
+    runAttempt: '1',
+    nodeVersion: '24',
+    status: state,
+    unhandledErrors: 0,
+    shard: { index, count: 2 },
+    timings: { [file]: 100 },
+    results: { [file]: state }
+  }
+})
+
+it('finds omitted failures in a complete failing reference run', () => {
+  expect(
+    reviewUnitSelection([record(1, 'a', 'passed'), record(2, 'b', 'failed')])[0]
+  ).toMatchObject({ completeFullRun: true, missedFailures: ['b'], potentiallyOmittedWorkerMs: 100 })
+})
+
+it('does not call incomplete, duplicate, interrupted or selected evidence a full reference', () => {
+  const a = record(1, 'a', 'passed'),
+    b = record(2, 'b', 'passed')
+  for (const rows of [
+    [a],
+    [a, a],
+    [a, { ...b, timing: { ...b.timing, unhandledErrors: 1 } }],
+    [a, { ...b, timing: { ...b.timing, status: 'interrupted' } }],
+    [a, b].map((row) => ({ ...row, plan: { ...plan, mode: 'selected' } }))
+  ]) {
+    expect(reviewUnitSelection(rows).every((row) => !row.completeFullRun)).toBe(true)
+  }
+})
diff --git a/config/scripts/ci-unit-selection.mjs b/config/scripts/ci-unit-selection.mjs
new file mode 100644
index 000000000000..70894dde0a16
--- /dev/null
+++ b/config/scripts/ci-unit-selection.mjs
@@ -0,0 +1,62 @@
+import { unitConsumers } from './ci-unit-dependency-graph.mjs'
+import { balanceFiles } from './ci-shard-assignment.mjs'
+
+export function selectUnitFiles(files, changed, graph) {
+  const full = (reason) => ({ files, reason, full: true })
+  if (!changed.length) {
+    return full('Missing changed-path evidence')
+  }
+  if (changed.some((file) => !file.startsWith('src/') || !graph.files.has(file))) {
+    return full('Global, deleted, renamed or unknown input')
+  }
+  for (const file of changed) {
+    const consumers = unitConsumers([file], graph.reverse)
+    if (!files.some((test) => consumers.has(test))) {
+      return full('No proven test coverage for changed inputs')
+    }
+  }
+  const affected = unitConsumers([...changed, ...graph.opaque], graph.reverse)
+  const selected = files.filter((file) => affected.has(file))
+  if (!selected.length) {
+    return full('No proven test coverage for changed inputs')
+  }
+  return {
+    files: selected,
+    reason: 'Transitive imports plus indirect-input consumers',
+    full: false
+  }
+}
+
+export function planUnitSelection({ files, changed, graph, timings, event, mode = 'shadow' }) {
+  const candidate = selectUnitFiles(files, changed, graph)
+  const selected = mode === 'selected' && event?.pull_request?.draft === true && !candidate.full
+  const executionFiles = selected ? candidate.files : files
+  const totalMs = balanceFiles(executionFiles, 1, timings).shards[0].durationMs
+  const count = selected
+    ? Math.max(1, Math.min(8, Math.ceil(totalMs / 900_000), executionFiles.length))
+    : 8
+  return {
+    version: 1,
+    mode: selected ? 'selected' : 'shadow',
+    selectionAvailable: !candidate.full,
+    reason: candidate.reason,
+    files,
+    candidateFiles: candidate.files,
+    executionFiles,
+    shards: Array.from({ length: count }, (_, index) => ({ index: index + 1, count }))
+  }
+}
+
+export function auditUnitSelection(plan, results) {
+  const candidates = new Set(plan.candidateFiles)
+  const omittedFailures = Object.entries(results)
+    .filter(([file, state]) => state === 'failed' && !candidates.has(file))
+    .map(([file]) => file)
+  return {
+    mode: plan.mode,
+    discovered: plan.files.length,
+    candidate: candidates.size,
+    executed: Object.keys(results).length,
+    omittedFailures
+  }
+}
diff --git a/config/scripts/ci-unit-selection.test.mjs b/config/scripts/ci-unit-selection.test.mjs
new file mode 100644
index 000000000000..37338cbfc6de
--- /dev/null
+++ b/config/scripts/ci-unit-selection.test.mjs
@@ -0,0 +1,92 @@
+import { describe, expect, it } from 'vitest'
+import { buildUnitDependencyGraph } from './ci-unit-dependency-graph.mjs'
+import { auditUnitSelection, planUnitSelection, selectUnitFiles } from './ci-unit-selection.mjs'
+
+const sources = new Map(
+  Object.entries({
+    'src/leaf.ts': 'export const value = 1',
+    'src/forward.ts': `export * from './leaf'`,
+    'src/consumer.test.ts': `import './forward'`,
+    'src/dynamic.test.ts': `import('./leaf')`,
+    'src/require.test.ts': `require('./leaf')`,
+    'src/scan.test.ts': `import { readFileSync } from 'node:fs'; readFileSync('src/leaf.ts')`,
+    'src/indirect.ts': `import(pathFromSettings)`,
+    'src/indirect.test.ts': `import './indirect'`,
+    'src/unrelated.test.ts': 'export const test = 1',
+    'src/renderer/src/view.tsx': 'export const value = 1',
+    'src/view.test.ts': `import '@renderer/view'; import '@/view'`
+  })
+)
+const graph = { ...buildUnitDependencyGraph(sources), files: new Set(sources.keys()) }
+const files = [...sources.keys()].filter((file) => file.endsWith('.test.ts')).sort()
+
+describe('conservative unit selection', () => {
+  it('follows re-exports, literal dynamic imports and requires, retaining indirect readers', () => {
+    expect(selectUnitFiles(files, ['src/leaf.ts'], graph).files).toEqual([
+      'src/consumer.test.ts',
+      'src/dynamic.test.ts',
+      'src/indirect.test.ts',
+      'src/require.test.ts',
+      'src/scan.test.ts'
+    ])
+  })
+
+  it('resolves renderer aliases and changed tests without executing their source', () => {
+    expect(selectUnitFiles(files, ['src/renderer/src/view.tsx'], graph).files).toContain(
+      'src/view.test.ts'
+    )
+    expect(selectUnitFiles(files, ['src/unrelated.test.ts'], graph).files).toContain(
+      'src/unrelated.test.ts'
+    )
+  })
+
+  it('does not mistake unrelated opaque readers for coverage of a new entry point', () => {
+    const uncovered = { ...graph, files: new Set([...graph.files, 'src/entry.ts']) }
+    expect(selectUnitFiles(files, ['src/entry.ts'], uncovered)).toMatchObject({ full: true, files })
+  })
+
+  it.each(
+    [
+      [],
+      ['src/deleted.ts'],
+      ['src/deleted.ts', 'src/leaf.ts'],
+      ['pnpm-lock.yaml'],
+      ['config/vitest.config.ts']
+    ].map((changed) => ({ changed }))
+  )('runs everything for incomplete/global evidence: $changed', ({ changed }) => {
+    expect(selectUnitFiles(files, changed, graph)).toMatchObject({ files, full: true })
+  })
+
+  it('keeps full coverage by default and on every non-draft commit', () => {
+    const base = { files, changed: ['src/leaf.ts'], graph, timings: {} }
+    for (const event of [
+      {},
+      { pull_request: { draft: false } },
+      { pull_request: { draft: true } }
+    ]) {
+      expect(planUnitSelection({ ...base, event }).executionFiles).toEqual(files)
+    }
+    expect(
+      planUnitSelection({ ...base, mode: 'selected', event: { pull_request: { draft: false } } })
+        .executionFiles
+    ).toEqual(files)
+    const selected = planUnitSelection({
+      ...base,
+      mode: 'selected',
+      event: { pull_request: { draft: true } }
+    })
+    expect(selected.executionFiles).not.toContain('src/unrelated.test.ts')
+    expect(selected.shards).toEqual([{ index: 1, count: 1 }])
+  })
+
+  it('records failures that would have been missed while shadow runs remain full', () => {
+    const plan = planUnitSelection({ files, changed: ['src/leaf.ts'], graph, timings: {} })
+    expect(
+      auditUnitSelection(plan, {
+        'src/consumer.test.ts': 'failed',
+        'src/unrelated.test.ts': 'failed',
+        'src/view.test.ts': 'passed'
+      }).omittedFailures
+    ).toEqual(['src/unrelated.test.ts'])
+  })
+})
diff --git a/config/scripts/ci-unit-sequencer.mjs b/config/scripts/ci-unit-sequencer.mjs
index cd55b3343b26..6b580bdb0025 100644
--- a/config/scripts/ci-unit-sequencer.mjs
+++ b/config/scripts/ci-unit-sequencer.mjs
@@ -1,4 +1,5 @@
 import { relative } from 'node:path'
+import { readFileSync } from 'node:fs'
 import { BaseSequencer } from 'vitest/node'
 import { balanceFiles, readTimingBaseline, writeAssignment } from './ci-shard-assignment.mjs'
 
@@ -6,12 +7,46 @@ export default class TimingSequencer extends BaseSequencer {
   async shard(specs) {
     const { index, count } = this.ctx.config.shard
     const key = (spec) => relative(this.ctx.config.root, spec.moduleId).replaceAll('\\', '/')
+    let execution = specs
+    let selectionReason = 'Full suite: no verified selection plan'
+    try {
+      const plan = JSON.parse(
+        readFileSync(
+          process.env.ORCA_UNIT_SELECTION_PLAN ?? 'ci-shards/unit-selection.json',
+          'utf8'
+        )
+      )
+      if (
+        plan.version !== 1 ||
+        !plan.sourceSha ||
+        plan.sourceSha !== process.env.ORCA_SHARD_SOURCE_SHA ||
+        JSON.stringify([...plan.files].sort()) !== JSON.stringify(specs.map(key).sort()) ||
+        !Array.isArray(plan.executionFiles) ||
+        plan.executionFiles.some((file) => !plan.files.includes(file))
+      ) {
+        throw new Error('Selection provenance or discovery differs')
+      }
+      const allowed = new Set(plan.executionFiles)
+      if (allowed.size === 0) {
+        throw new Error('Empty execution selection')
+      }
+      execution = specs.filter((spec) => allowed.has(key(spec)))
+      selectionReason = plan.reason
+    } catch (error) {
+      console.log(`Running every discovered unit test: ${error.message}`)
+    }
     const baseline = readTimingBaseline('unit')
-    const assignment = balanceFiles(specs.map(key), count, baseline.timings, baseline.overheadMs)
+    const assignment = balanceFiles(
+      execution.map(key),
+      count,
+      baseline.timings,
+      baseline.overheadMs
+    )
     writeAssignment(process.env.ORCA_SHARD_MANIFEST ?? 'ci-shards/unit-assignment.json', {
       ...assignment,
       baselineSha256: baseline.baselineSha256,
-      selectedShard: index
+      selectedShard: index,
+      selectionReason
     })
     const selected = new Set(assignment.shards[index - 1].files)
     return specs.filter((spec) => selected.has(key(spec)))
diff --git a/config/scripts/ci-unit-sequencer.test.mjs b/config/scripts/ci-unit-sequencer.test.mjs
new file mode 100644
index 000000000000..931a3ccd1582
--- /dev/null
+++ b/config/scripts/ci-unit-sequencer.test.mjs
@@ -0,0 +1,44 @@
+import { mkdtempSync, writeFileSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, expect, it, vi } from 'vitest'
+import TimingSequencer from './ci-unit-sequencer.mjs'
+
+let root
+afterEach(() => {
+  vi.unstubAllEnvs()
+  if (root) {
+    rmSync(root, { recursive: true, force: true })
+  }
+})
+
+it.each(['valid', 'stale', 'missing-file', 'missing-artifact'])(
+  'preserves complete shard coverage with %s planning evidence',
+  async (kind) => {
+    root = mkdtempSync(join(tmpdir(), 'unit-sequencer-'))
+    const files = ['src/a.test.ts', 'src/b.test.ts', 'src/c.test.ts', 'src/d.test.ts']
+    const plan = {
+      version: 1,
+      sourceSha: kind === 'stale' ? 'old' : 'current',
+      files: kind === 'missing-file' ? files.slice(1) : files,
+      executionFiles: files.slice(0, 2)
+    }
+    const planPath = join(root, 'selection.json')
+    if (kind !== 'missing-artifact') {
+      writeFileSync(planPath, JSON.stringify(plan))
+    }
+    vi.stubEnv('ORCA_UNIT_SELECTION_PLAN', planPath)
+    vi.stubEnv('ORCA_SHARD_SOURCE_SHA', 'current')
+    vi.stubEnv('ORCA_SHARD_MANIFEST', join(root, 'assignment.json'))
+    const assigned = []
+    for (const index of [1, 2]) {
+      const sequencer = new TimingSequencer({ config: { root, shard: { index, count: 2 } } })
+      const specs = files.map((file) => ({ moduleId: join(root, file) }))
+      assigned.push(...(await sequencer.shard(specs)).map((spec) => spec.moduleId))
+    }
+    expect(assigned.sort()).toEqual(
+      (kind === 'valid' ? files.slice(0, 2) : files).map((file) => join(root, file)).sort()
+    )
+    expect(new Set(assigned).size).toBe(assigned.length)
+  }
+)
diff --git a/config/scripts/ci-unit-timing-import.mjs b/config/scripts/ci-unit-timing-import.mjs
new file mode 100644
index 000000000000..50a649816701
--- /dev/null
+++ b/config/scripts/ci-unit-timing-import.mjs
@@ -0,0 +1,69 @@
+import { readdirSync, readFileSync, writeFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { pathToFileURL } from 'node:url'
+import { compareIds } from './ci-shard-assignment.mjs'
+
+export function importUnitTimingReports(reports) {
+  const first = reports[0]
+  if (!first || first.shard.count !== reports.length) {
+    throw new Error('Expected exactly one complete unit shard set')
+  }
+  const provenance = (report) =>
+    JSON.stringify([
+      report.sourceSha,
+      report.runId,
+      report.runAttempt,
+      report.nodeVersion,
+      report.shard.count
+    ])
+  const indices = new Set()
+  const timings = {}
+  for (const report of reports) {
+    if (
+      report.metric !== 'module-duration-v1' ||
+      report.status !== 'passed' ||
+      report.unhandledErrors !== 0 ||
+      !report.sourceSha ||
+      provenance(report) !== provenance(first)
+    ) {
+      throw new Error('Unit timing reports must come from one successful source/run/Node version')
+    }
+    const { index, count } = report.shard
+    if (!Number.isInteger(index) || index < 1 || index > count || indices.has(index)) {
+      throw new Error('Duplicate or invalid unit shard index')
+    }
+    indices.add(index)
+    for (const [file, duration] of Object.entries(report.timings)) {
+      if (file in timings || !Number.isFinite(duration) || duration <= 0) {
+        throw new Error(`Duplicate or invalid unit timing: ${file}`)
+      }
+      timings[file] = duration
+    }
+  }
+  if (!Object.keys(timings).length) {
+    throw new Error('No unit timing evidence')
+  }
+  return {
+    runId: first.runId,
+    runAttempt: first.runAttempt,
+    sourceSha: first.sourceSha,
+    nodeVersion: first.nodeVersion,
+    metric: first.metric,
+    // Per-module measurements already include setup, imports and environment startup.
+    overheadMs: 0,
+    timings: Object.fromEntries(Object.entries(timings).sort(([a], [b]) => compareIds(a, b)))
+  }
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  const [directory, output] = process.argv.slice(2)
+  if (!directory || !output) {
+    throw new Error('Usage: ci-unit-timing-import.mjs ARTIFACT_DIRECTORY BASELINE_JSON')
+  }
+  const reports = readdirSync(directory, { recursive: true })
+    .filter((file) => file.endsWith('unit-timings.json'))
+    .map((file) => JSON.parse(readFileSync(join(directory, file), 'utf8')))
+  const baseline = JSON.parse(readFileSync(output, 'utf8'))
+  baseline.unit = importUnitTimingReports(reports)
+  writeFileSync(output, `${JSON.stringify(baseline, null, 2)}\n`)
+}
diff --git a/config/scripts/ci-unit-timing-reporter.mjs b/config/scripts/ci-unit-timing-reporter.mjs
new file mode 100644
index 000000000000..fa54aa1072af
--- /dev/null
+++ b/config/scripts/ci-unit-timing-reporter.mjs
@@ -0,0 +1,64 @@
+import { relative } from 'node:path'
+import { appendFileSync, readFileSync } from 'node:fs'
+import { writeAssignment } from './ci-shard-assignment.mjs'
+import { auditUnitSelection } from './ci-unit-selection.mjs'
+
+export function moduleDuration(diagnostic) {
+  return Math.max(
+    1,
+    Math.ceil(
+      diagnostic.environmentSetupDuration +
+        diagnostic.prepareDuration +
+        diagnostic.collectDuration +
+        diagnostic.setupDuration +
+        diagnostic.duration
+    )
+  )
+}
+
+export default class UnitTimingReporter {
+  onInit(ctx) {
+    this.ctx = ctx
+  }
+
+  onTestRunEnd(modules, errors, reason) {
+    const results = Object.fromEntries(
+      modules.map((module) => [
+        relative(this.ctx.config.root, module.moduleId).replaceAll('\\', '/'),
+        module.state?.() ?? 'unknown'
+      ])
+    )
+    writeAssignment(process.env.ORCA_UNIT_TIMING_REPORT ?? 'ci-shards/unit-timings.json', {
+      metric: 'module-duration-v1',
+      nodeVersion: process.versions.node,
+      shard: this.ctx.config.shard ?? { index: 1, count: 1 },
+      status: reason,
+      unhandledErrors: errors.length,
+      results,
+      timings: Object.fromEntries(
+        modules.map((module) => [
+          relative(this.ctx.config.root, module.moduleId).replaceAll('\\', '/'),
+          moduleDuration(module.diagnostic())
+        ])
+      )
+    })
+    try {
+      const plan = JSON.parse(
+        readFileSync(
+          process.env.ORCA_UNIT_SELECTION_PLAN ?? 'ci-shards/unit-selection.json',
+          'utf8'
+        )
+      )
+      const audit = auditUnitSelection(plan, results)
+      writeAssignment('ci-shards/unit-selection-audit.json', audit)
+      if (process.env.GITHUB_STEP_SUMMARY) {
+        appendFileSync(
+          process.env.GITHUB_STEP_SUMMARY,
+          `Unit selection (${audit.mode}): ${audit.candidate}/${audit.discovered} candidate files; ${audit.omittedFailures.length} failures outside selection.\n`
+        )
+      }
+    } catch {
+      // Timing evidence remains useful when selection planning was unavailable.
+    }
+  }
+}
diff --git a/config/scripts/ci-unit-timing-reporter.test.mjs b/config/scripts/ci-unit-timing-reporter.test.mjs
new file mode 100644
index 000000000000..5523b4943713
--- /dev/null
+++ b/config/scripts/ci-unit-timing-reporter.test.mjs
@@ -0,0 +1,104 @@
+import { mkdtempSync, readFileSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join, resolve } from 'node:path'
+import { describe, expect, it } from 'vitest'
+import { importUnitTimingReports } from './ci-unit-timing-import.mjs'
+import UnitTimingReporter, { moduleDuration } from './ci-unit-timing-reporter.mjs'
+
+const report = (index, timings) => ({
+  metric: 'module-duration-v1',
+  nodeVersion: '24.21.0',
+  sourceSha: 'source',
+  runId: 'run',
+  runAttempt: '1',
+  shard: { index, count: 2 },
+  status: 'passed',
+  unhandledErrors: 0,
+  timings
+})
+
+describe('unit worker timing evidence', () => {
+  it('counts each worker phase once, including imports of tests with cheap assertions', () => {
+    expect(
+      moduleDuration({
+        environmentSetupDuration: 11,
+        prepareDuration: 12,
+        collectDuration: 130,
+        setupDuration: 14,
+        duration: 0.2,
+        importDurations: { dependency: 100 }
+      })
+    ).toBe(168)
+  })
+
+  it('writes a real reporter result with source and shard provenance', () => {
+    const directory = mkdtempSync(join(tmpdir(), 'orca-unit-timing-'))
+    const previous = process.env.ORCA_UNIT_TIMING_REPORT
+    process.env.ORCA_UNIT_TIMING_REPORT = join(directory, 'unit-timings.json')
+    try {
+      const reporter = new UnitTimingReporter()
+      reporter.onInit({ config: { root: process.cwd(), shard: { index: 1, count: 8 } } })
+      reporter.onTestRunEnd(
+        [
+          {
+            moduleId: resolve('src/example.test.ts'),
+            diagnostic: () => ({
+              environmentSetupDuration: 0,
+              prepareDuration: 0,
+              collectDuration: 200,
+              setupDuration: 10,
+              duration: 5
+            })
+          }
+        ],
+        [],
+        'passed'
+      )
+      expect(JSON.parse(readFileSync(process.env.ORCA_UNIT_TIMING_REPORT, 'utf8'))).toMatchObject({
+        metric: 'module-duration-v1',
+        shard: { index: 1, count: 8 },
+        status: 'passed',
+        unhandledErrors: 0,
+        timings: { 'src/example.test.ts': 215 }
+      })
+    } finally {
+      if (previous === undefined) {
+        delete process.env.ORCA_UNIT_TIMING_REPORT
+      } else {
+        process.env.ORCA_UNIT_TIMING_REPORT = previous
+      }
+      rmSync(directory, { recursive: true, force: true })
+    }
+  })
+
+  it('imports all shards without adding the old average overhead again', () => {
+    expect(importUnitTimingReports([report(2, { b: 100 }), report(1, { a: 200 })])).toMatchObject({
+      sourceSha: 'source',
+      overheadMs: 0,
+      metric: 'module-duration-v1',
+      timings: { a: 200, b: 100 }
+    })
+  })
+
+  it('rejects incomplete, duplicate, mixed and failed evidence', () => {
+    const first = report(1, { a: 100 })
+    expect(() => importUnitTimingReports([first])).toThrow('complete')
+    expect(() => importUnitTimingReports([first, first])).toThrow('index')
+    expect(() => importUnitTimingReports([first, report(2, { a: 200 })])).toThrow('timing')
+    for (const change of [
+      { sourceSha: 'other' },
+      { runId: 'other' },
+      { runAttempt: '2' },
+      { nodeVersion: '26.6.0' },
+      { metric: 'test-duration' },
+      { status: 'failed' },
+      { status: 'interrupted' },
+      { unhandledErrors: 1 }
+    ]) {
+      expect(() =>
+        importUnitTimingReports([first, { ...report(2, { b: 200 }), ...change }])
+      ).toThrow('successful')
+    }
+    expect(() => importUnitTimingReports([first, report(2, { b: -1 })])).toThrow('timing')
+  })
+})
diff --git a/config/scripts/cli-main-module-bundle-parity.test.ts b/config/scripts/cli-main-module-bundle-parity.test.ts
new file mode 100644
index 000000000000..b545579facfe
--- /dev/null
+++ b/config/scripts/cli-main-module-bundle-parity.test.ts
@@ -0,0 +1,91 @@
+import { readFileSync, readdirSync } from 'node:fs'
+import { join, matchesGlob, resolve } from 'node:path'
+import { createRequire } from 'node:module'
+import { describe, expect, it } from 'vitest'
+import { electronViteConfig } from '../../electron.vite.config'
+import { GUARDED_ENTRY_NAMES } from '../build-plugins/plain-node-entry-guard'
+
+const REPO_ROOT = resolve(__dirname, '..', '..')
+const CLI_ROOT = join(REPO_ROOT, 'src', 'cli')
+const packaging = createRequire(import.meta.url)('../electron-builder.config.cjs')
+
+function listCliSourceFiles(dir: string): string[] {
+  return readdirSync(dir, { withFileTypes: true }).flatMap((entry) => {
+    const path = join(dir, entry.name)
+    if (entry.isDirectory()) {
+      return listCliSourceFiles(path)
+    }
+    return entry.isFile() && entry.name.endsWith('.ts') && !entry.name.endsWith('.test.ts')
+      ? [path]
+      : []
+  })
+}
+
+// Why: `import type` is erased by tsc, so it needs no emitted module at runtime.
+const VALUE_IMPORT_FROM_MAIN = /(?<!\btype\s)from '(?:\.\.\/)+main\/([^']+)'/g
+const DYNAMIC_IMPORT_FROM_MAIN = /import\(\s*['"](?:\.\.\/)+main\/([^'"]+)['"]\s*\)/g
+
+function findMainImports(): { file: string; module: string }[] {
+  return listCliSourceFiles(CLI_ROOT).flatMap((file) => {
+    const source = readFileSync(file, 'utf-8')
+    return [
+      ...source.matchAll(VALUE_IMPORT_FROM_MAIN),
+      ...source.matchAll(DYNAMIC_IMPORT_FROM_MAIN)
+    ].map((match) => ({
+      file: file.slice(REPO_ROOT.length + 1),
+      module: match[1].replace(/\.js$/, '')
+    }))
+  })
+}
+
+function findElectronViteMainEntries(): Record<string, string> {
+  const input = electronViteConfig.main?.build?.rollupOptions?.input
+  if (!input || typeof input !== 'object' || Array.isArray(input)) {
+    throw new Error('Expected named main-process inputs')
+  }
+  return input
+}
+
+describe('CLI imports of main-process modules', () => {
+  // Why: electron-vite cleans out/main and emits only its declared entries, so a
+  // `src/main/*` module the CLI imports but the config omits is deleted by the
+  // build that runs after `build:cli` — keep source-level feedback ahead of the
+  // final-artifact runtime verifier.
+  it('has an electron-vite entry for every main module the CLI imports', () => {
+    const entries = findElectronViteMainEntries()
+    const missing = findMainImports().filter(
+      ({ module }) => entries[module] !== join(REPO_ROOT, 'src', 'main', `${module}.ts`)
+    )
+
+    expect(missing).toEqual([])
+  })
+
+  it('guards every CLI main module against Electron imports', () => {
+    const guarded = new Set<string>(GUARDED_ENTRY_NAMES)
+    expect(findMainImports().filter(({ module }) => !guarded.has(module))).toEqual([])
+  })
+
+  it('unpacks every CLI main entry for plain Node outside Electron', () => {
+    const missing = findMainImports().filter(
+      ({ module }) =>
+        !packaging.asarUnpack.some((pattern: string) =>
+          matchesGlob(`out/main/${module}.js`, pattern)
+        )
+    )
+    expect(missing).toEqual([])
+  })
+
+  it('finds the imports it is meant to guard', () => {
+    // Why: a broken matcher would make the guard above vacuously pass.
+    expect(findMainImports()).toContainEqual({
+      file: join('src', 'cli', 'profile-state-location.ts'),
+      module: 'persistence/profile-state/profile-state-active-location'
+    })
+    expect(findMainImports()).toContainEqual({
+      file: join('src', 'cli', 'handlers', 'agent-hooks.ts'),
+      module: 'orca-profiles/profile-index-store'
+    })
+    expect(findMainImports().length).toBeGreaterThanOrEqual(2)
+    expect(Object.keys(findElectronViteMainEntries()).length).toBeGreaterThanOrEqual(2)
+  })
+})
diff --git a/config/scripts/client-hosted-browser-package-coverage.test.mjs b/config/scripts/client-hosted-browser-package-coverage.test.mjs
index 0520e9d6e4b8..f7f1ceb5995e 100644
--- a/config/scripts/client-hosted-browser-package-coverage.test.mjs
+++ b/config/scripts/client-hosted-browser-package-coverage.test.mjs
@@ -6,6 +6,19 @@ import { parse } from 'yaml'
 const projectDir = resolve(import.meta.dirname, '../..')
 
 describe('client-hosted browser package coverage', () => {
+  it('finishes the installer process probe before concurrent native boundaries', () => {
+    const workflow = parse(readFileSync(join(projectDir, '.github/workflows/pr.yml'), 'utf8'))
+    const steps = workflow.jobs.package_windows.steps
+    const probe = steps.findIndex((step) => step.name === 'Test Windows installer process probe')
+    const boundaries = steps.findIndex((step) => step.name === 'Test Windows-specific boundaries')
+    const file = 'config/scripts/nsis-process-check.test.mjs'
+    expect(probe).toBeGreaterThanOrEqual(0)
+    expect(probe).toBeLessThan(boundaries)
+    expect(steps[probe].background).toBeUndefined()
+    expect(steps[probe].run).toContain(file)
+    expect(steps[boundaries].run).not.toContain(file)
+  })
+
   it('bundles the WSL browser-network relay with its version stamp', () => {
     const relayBuild = readFileSync(join(projectDir, 'config/scripts/build-relay.mjs'), 'utf8')
 
diff --git a/config/scripts/cloud-security-history-workflow.test.mjs b/config/scripts/cloud-security-history-workflow.test.mjs
new file mode 100644
index 000000000000..fc28e55b9961
--- /dev/null
+++ b/config/scripts/cloud-security-history-workflow.test.mjs
@@ -0,0 +1,92 @@
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { pathToFileURL } from 'node:url'
+import { expect, it } from 'vitest'
+import { parse } from 'yaml'
+import { runProcessSync } from '../../src/shared/child-process/run-process'
+
+const workflow = parse(
+  readFileSync(new URL('../../.github/workflows/cloud-verify.yml', import.meta.url), 'utf8')
+)
+const steps = workflow.jobs.security.steps
+const history = steps.find((step) => step.name === 'Fetch complete scan history')
+
+it('fetches both merge parents and deleted content without unrelated branches or tags', () => {
+  const directory = mkdtempSync(join(tmpdir(), 'orca-cloud-history-'))
+  const source = join(directory, 'source')
+  const checkout = join(directory, 'checkout')
+  const run = (program, args, cwd, env = process.env) => {
+    const result = runProcessSync({ program, args, cwd, env })
+    expect(result.code, result.stderr).toBe(0)
+    return result.stdout.trim()
+  }
+  const git = (args, cwd = source) => run('git', args, cwd)
+  const commit = (message) => {
+    git(['add', '-A'])
+    git(['-c', 'commit.gpgsign=false', 'commit', '--quiet', '-m', message])
+    return git(['rev-parse', 'HEAD'])
+  }
+
+  try {
+    run('git', ['init', '--quiet', source], directory)
+    git(['checkout', '-b', 'main'])
+    git(['config', 'user.name', 'CI test'])
+    git(['config', 'user.email', 'ci@example.invalid'])
+    mkdirSync(join(source, 'cloud'))
+    writeFileSync(join(source, 'cloud', 'removed.txt'), 'historical-scan-marker\n')
+    const original = commit('historical content')
+    rmSync(join(source, 'cloud', 'removed.txt'))
+    writeFileSync(join(source, 'cloud', 'current.txt'), 'current\n')
+    commit('delete historical content')
+    git(['checkout', '-b', 'feature'])
+    writeFileSync(join(source, 'cloud', 'feature.txt'), 'feature-parent-marker\n')
+    commit('feature parent')
+    git(['checkout', 'main'])
+    writeFileSync(join(source, 'cloud', 'base.txt'), 'base-parent-marker\n')
+    commit('base parent')
+    git(['-c', 'commit.gpgsign=false', 'merge', '--no-ff', 'feature', '-m', 'PR merge'])
+    const sha = git(['rev-parse', 'HEAD'])
+    const expectedHistory = git(['rev-list', 'HEAD']).split('\n').sort()
+    const expectedPatch = git(['log', '--format=%H', '-p', 'HEAD', '--', 'cloud'])
+    git(['checkout', '-b', 'unrelated', original])
+    writeFileSync(join(source, 'unrelated.txt'), 'unrelated-object\n')
+    const unrelated = commit('unrelated branch')
+    git(['tag', 'unrelated-tag'])
+    git(['checkout', 'main'])
+
+    run(
+      'git',
+      ['clone', '--depth=1', '--no-tags', '--branch', 'main', pathToFileURL(source).href, checkout],
+      directory
+    )
+    expect(git(['rev-list', '--count', 'HEAD'], checkout)).toBe('1')
+    run('bash', ['-e', '-c', history.run], checkout, { ...process.env, GITHUB_SHA: sha })
+
+    expect(git(['rev-list', 'HEAD'], checkout).split('\n').sort()).toEqual(expectedHistory)
+    const actualPatch = git(['log', '--format=%H', '-p', 'HEAD', '--', 'cloud'], checkout)
+    expect(actualPatch).toBe(expectedPatch)
+    expect(actualPatch).toContain('historical-scan-marker')
+    expect(actualPatch).toContain('feature-parent-marker')
+    expect(actualPatch).toContain('base-parent-marker')
+    expect(git(['tag', '--list'], checkout)).toBe('')
+    expect(
+      runProcessSync({ program: 'git', args: ['cat-file', '-e', unrelated], cwd: checkout }).code
+    ).not.toBe(0)
+  } finally {
+    rmSync(directory, { recursive: true, force: true })
+  }
+})
+
+it('completes history before scanning the same HEAD and Cloud paths', () => {
+  expect(steps[0].with['fetch-depth']).toBe(1)
+  expect(history['working-directory']).toBe('.')
+  const scanIndex = steps.findIndex(
+    (step) => step.run?.includes('docker run') && step.run.includes('gitleaks@')
+  )
+  expect(steps.indexOf(history)).toBeLessThan(scanIndex)
+  expect(steps[scanIndex].run).toContain(
+    '--log-opts="HEAD -- cloud :(glob).github/workflows/cloud-*.yml .github/actions/cloud-sql-rollout-lease"'
+  )
+  expect(steps.some((step) => step.run?.includes('trufflehog@'))).toBe(true)
+})
diff --git a/config/scripts/e2e-cli-artifact-capability.test.mjs b/config/scripts/e2e-cli-artifact-capability.test.mjs
new file mode 100644
index 000000000000..af39b8da7536
--- /dev/null
+++ b/config/scripts/e2e-cli-artifact-capability.test.mjs
@@ -0,0 +1,56 @@
+import { chmodSync, existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { delimiter, join } from 'node:path'
+import { parse } from 'yaml'
+import { describe, expect, it } from 'vitest'
+import { runProcessSync } from '../../src/shared/child-process/run-process'
+
+const workflow = parse(readFileSync('.github/workflows/e2e.yml', 'utf8'))
+const build = workflow.jobs.build.steps.find((step) => step.id === 'e2e-cli')
+const scripts = JSON.parse(readFileSync('package.json', 'utf8')).scripts
+
+describe('shared E2E CLI capability', () => {
+  it('uses the same preparation for locally compiled and downloaded CLI output', () => {
+    expect(scripts['build:cli']).toContain('&& pnpm run prepare:cli-output')
+    expect(scripts['prepare:cli-output']).toBe(
+      'node config/scripts/verify-cli-bin.mjs --fix-executable --fix-package-json && node config/scripts/install-dev-cli.mjs'
+    )
+  })
+
+  it.skipIf(process.platform === 'win32').each([
+    [false, 0, 0],
+    [true, 0, 0],
+    [true, 7, 7]
+  ])('supported=%s build status=%s exits=%s', (supported, buildStatus, exitStatus) => {
+    const directory = mkdtempSync(join(tmpdir(), 'orca-e2e-cli-capability-'))
+    const marker = join(directory, 'build-requested')
+    try {
+      writeFileSync(
+        join(directory, 'package.json'),
+        JSON.stringify({ scripts: supported ? { 'prepare:cli-output': 'available' } : {} })
+      )
+      const pnpm = join(directory, 'pnpm')
+      writeFileSync(pnpm, '#!/bin/sh\nprintf "%s" "$*" > "$BUILD_MARKER"\nexit "$BUILD_STATUS"\n')
+      chmodSync(pnpm, 0o755)
+      const result = runProcessSync({
+        program: 'bash',
+        args: ['-e', '-o', 'pipefail', '-c', build.run],
+        cwd: directory,
+        env: {
+          ...process.env,
+          PATH: `${directory}${delimiter}${process.env.PATH}`,
+          BUILD_MARKER: marker,
+          BUILD_STATUS: String(buildStatus)
+        },
+        timeoutMs: 10_000
+      })
+      expect(result.code, JSON.stringify(result)).toBe(exitStatus)
+      expect(existsSync(marker)).toBe(supported)
+      if (supported) {
+        expect(readFileSync(marker, 'utf8')).toBe('run build:cli')
+      }
+    } finally {
+      rmSync(directory, { recursive: true, force: true })
+    }
+  })
+})
diff --git a/config/scripts/electron-builder-config.test.mjs b/config/scripts/electron-builder-config.test.mjs
index 430a5fae4c82..72ffc80ec2ce 100644
--- a/config/scripts/electron-builder-config.test.mjs
+++ b/config/scripts/electron-builder-config.test.mjs
@@ -1,8 +1,8 @@
 import { existsSync } from 'node:fs'
-import { chmod, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'
+import { chmod, lstat, mkdir, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'
 import { createRequire } from 'node:module'
 import { tmpdir } from 'node:os'
-import { join } from 'node:path'
+import { dirname, join } from 'node:path'
 import { afterAll, beforeAll, describe, expect, it } from 'vitest'
 import { writeMobileWebBundleFixtureTree } from './mobile-web-bundle-fixture-tree.mjs'
 
@@ -11,7 +11,7 @@ const SRC_MAIN_DIR = join(REPO_ROOT, 'src', 'main')
 
 const require = createRequire(import.meta.url)
 const electronBuilderConfig = require('../electron-builder.config.cjs')
-const { FileMatcher } = require('app-builder-lib/out/fileMatcher')
+const { copyFiles, FileMatcher } = require('app-builder-lib/out/fileMatcher')
 const FpmTarget = require('app-builder-lib/out/targets/FpmTarget').default
 const electronBuilderNativeRebuild = require('./electron-builder-native-rebuild.cjs')
 
@@ -37,6 +37,7 @@ describe('electron-builder config', () => {
         '!tests{,/**/*}',
         '!examples{,/**/*}',
         '!pr-evidence{,/**/*}',
+        '!notes{,/**/*}',
         '!{.claude,.grok,.agents,.codex}{,/**/*}',
         '!Casks{,/**/*}',
         '!{AGENTS.md,CLAUDE.md,DEVELOPING.md,bundle-size-progress.md,ORCHESTRATION_IMPLEMENTATION_CHECKLIST.md,ORCHESTRATION_STRUCTURED_OUTPUT_DESIGN.md}',
@@ -63,6 +64,62 @@ describe('electron-builder config', () => {
     expect(packs('out/main/index.js')).toBe(true)
   })
 
+  it.each(['file', 'directory'])('keeps a root notes %s out of app.asar', async (kind) => {
+    const root = await mkdtemp(join(tmpdir(), 'orca-packaging-notes-'))
+    const source = join(root, 'app')
+    const destination = join(root, 'selected')
+    const runtimePaths = [
+      'package.json',
+      'out/main/index.js',
+      'out/renderer/index.html',
+      'out/cli/index.js',
+      'out/shared/index.js',
+      'out/main/notes/index.js',
+      'out/renderer/assets/notes/help.md',
+      'resources/notes/help.md',
+      'notes.txt'
+    ]
+    const notesPaths =
+      kind === 'file'
+        ? ['notes']
+        : [
+            'notes/build.log',
+            'notes/installed-orca-backup/Orca.exe',
+            'notes/installed-orca-backup/resources/app.asar',
+            'notes/orca-windows-setup.exe',
+            'notes/.recovery/state.json'
+          ]
+    try {
+      for (const fixturePath of [...runtimePaths, ...notesPaths]) {
+        const file = join(source, fixturePath)
+        await mkdir(dirname(file), { recursive: true })
+        await writeFile(file, 'synthetic fixture\n')
+      }
+      if (kind === 'directory') {
+        await mkdir(join(source, 'notes', 'empty'))
+      }
+      const matcher = new FileMatcher(
+        source,
+        destination,
+        (value) => value,
+        electronBuilderConfig.files
+      )
+      // copyFiles adds the default include and prunes excluded directories during traversal.
+      await copyFiles([matcher])
+      for (const runtimePath of runtimePaths) {
+        expect(await readFile(join(destination, runtimePath), 'utf8')).toBe('synthetic fixture\n')
+      }
+      const isPacked = matcher.createFilter()
+      for (const notesPath of new Set(['notes', ...notesPaths])) {
+        const file = join(source, notesPath)
+        expect(isPacked(file, await lstat(file)), notesPath).toBe(false)
+      }
+      expect(existsSync(join(destination, 'notes'))).toBe(false)
+    } finally {
+      await rm(root, { recursive: true, force: true })
+    }
+  })
+
   // Why: `files` is an all-negation list, so electron-builder's default `**/*` packs
   // anything without an explicit `!` entry — examples/ landed without one and shipped
   // hostile-panel, the adversarial containment fixture, into 1.4.160-rc.3's app.asar.
diff --git a/config/scripts/electron-builder-runtime-resources.test.mjs b/config/scripts/electron-builder-runtime-resources.test.mjs
index 77f45f621131..f74c1c09e010 100644
--- a/config/scripts/electron-builder-runtime-resources.test.mjs
+++ b/config/scripts/electron-builder-runtime-resources.test.mjs
@@ -527,6 +527,8 @@ describe('packaged runtime resources', () => {
   )
 })
 
+const BUN_RUNTIME_BUILTINS = new Set(['bun:ffi', 'bun:sqlite'])
+
 // Why source-anchored: the bundler renames a createRequire()'d require, so
 // verifyPackagedMainRuntimeDeps' `require("x")` scan cannot see these specifiers — packaging
 // stays green while the packaged app throws MODULE_NOT_FOUND the first time the path runs.
@@ -555,7 +557,7 @@ function collectLazyRequireSpecifiers(directory, found = new Map()) {
       continue
     }
     for (const match of source.matchAll(/\brequire[A-Za-z0-9_]*\(\s*'([^']+)'\s*\)/g)) {
-      if (isPackagedExternalSpecifier(match[1])) {
+      if (!BUN_RUNTIME_BUILTINS.has(match[1]) && isPackagedExternalSpecifier(match[1])) {
         found.set(match[1], relative(projectRoot, entryPath).replaceAll('\\', '/'))
       }
     }
@@ -572,6 +574,26 @@ function packagedResourceDestinations(platform) {
 }
 
 describe('lazily required packages reach Resources/node_modules', () => {
+  it('excludes Bun runtime builtins while retaining ordinary lazy dependencies', async () => {
+    const sourceDir = await mkdtemp(join(tmpdir(), 'orca-lazy-bun-builtins-'))
+    try {
+      await writeFile(
+        join(sourceDir, 'runtime.ts'),
+        [
+          'const requireFromMain = createRequire(import.meta.url)',
+          "requireFromMain('node:fs')",
+          "requireFromMain('bun:ffi')",
+          "requireFromMain('bun:sqlite')",
+          "requireFromMain('zod')",
+          "requireFromMain('bun-sqlite')"
+        ].join('\n')
+      )
+      expect([...collectLazyRequireSpecifiers(sourceDir).keys()]).toEqual(['zod', 'bun-sqlite'])
+    } finally {
+      await removeTree(sourceDir)
+    }
+  })
+
   it('copies every createRequire specifier main uses into the packaged resource plan', () => {
     const specifiers = collectLazyRequireSpecifiers(join(projectRoot, 'src', 'main'))
     expect(specifiers.size).toBeGreaterThan(0)
diff --git a/config/scripts/electron-vite-output-contract.test.ts b/config/scripts/electron-vite-output-contract.test.ts
index 285b58f2ac76..958e461ffd94 100644
--- a/config/scripts/electron-vite-output-contract.test.ts
+++ b/config/scripts/electron-vite-output-contract.test.ts
@@ -73,9 +73,7 @@ function failBootstrapWithBanner(options: {
   return processMock
 }
 
-const electronBuilderConfig = createRequire(import.meta.url)('../electron-builder.config.cjs') as {
-  files: string[]
-}
+const electronBuilderConfig = createRequire(import.meta.url)('../electron-builder.config.cjs')
 
 describe('Electron Vite output contract', () => {
   it("minifies main and renderer with rolldown's in-process minifier", () => {
@@ -104,6 +102,37 @@ describe('Electron Vite output contract', () => {
     expect(output.chunkFileNames).toBe('chunks/[name]-[hash].js')
   })
 
+  it('keeps offline profile-state CLI imports unpacked at stable paths', () => {
+    const input = electronViteConfig.main?.build?.rollupOptions?.input
+    if (!input || typeof input !== 'object' || Array.isArray(input)) {
+      throw new Error('Expected named main-process inputs')
+    }
+
+    for (const name of [
+      'orca-profiles/profile-index-store',
+      'persistence/profile-state/profile-state-access',
+      'persistence/profile-state/profile-state-active-location',
+      'persistence/profile-state/profile-state-backup-path',
+      'persistence/profile-state/profile-state-database-recovery',
+      'persistence/profile-state/profile-state-domain-reader',
+      'persistence/profile-state/legacy-json/profile-state-export-path',
+      'persistence/profile-state/profile-state-offline-settings',
+      'persistence/profile-state/legacy-json/profile-state-recovery',
+      'persistence/profile-state/profile-state-recovery-command',
+      'persistence/profile-state/profile-state-storage-classification',
+      'startup/http1-compatibility-marker'
+    ]) {
+      expect(input).toHaveProperty(name)
+    }
+    expect(electronBuilderConfig.asarUnpack).toContain('out/main/persistence/profile-state/**')
+    expect(electronBuilderConfig.asarUnpack).toContain(
+      'out/main/orca-profiles/profile-index-store.js'
+    )
+    expect(electronBuilderConfig.asarUnpack).toContain(
+      'out/main/startup/http1-compatibility-marker.js'
+    )
+  })
+
   it('externalizes packaged dependencies but bundles self-contained main dependencies', () => {
     const external = electronViteConfig.main?.build?.rollupOptions?.external
     if (typeof external !== 'function') {
diff --git a/config/scripts/generate-monaco-associations.mjs b/config/scripts/generate-monaco-associations.mjs
new file mode 100644
index 000000000000..b5c2e99c00a6
--- /dev/null
+++ b/config/scripts/generate-monaco-associations.mjs
@@ -0,0 +1,79 @@
+import { readFileSync, writeFileSync } from 'node:fs'
+import { createRequire } from 'node:module'
+import { dirname, resolve } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import ts from 'typescript-api'
+
+const require = createRequire(import.meta.url)
+const editorEntry = require.resolve('monaco-editor/esm/vs/editor/editor.main.js')
+export const associationsPath = fileURLToPath(
+  new URL('../../src/renderer/src/lib/monaco-language-associations.json', import.meta.url)
+)
+
+// Read registration metadata without importing Monaco or executing its grammar loaders.
+export function readMonacoAssociations() {
+  const entry = ts.createSourceFile(
+    editorEntry,
+    readFileSync(editorEntry, 'utf8'),
+    ts.ScriptTarget.Latest
+  )
+  const files = entry.statements
+    .filter(ts.isImportDeclaration)
+    .map((node) => node.moduleSpecifier)
+    .filter(ts.isStringLiteral)
+    .map((node) => node.text)
+    .filter((path) => path.endsWith('.contribution.js'))
+  const registrations = []
+  for (const file of files) {
+    const path = resolve(dirname(editorEntry), file)
+    const source = ts.createSourceFile(path, readFileSync(path, 'utf8'), ts.ScriptTarget.Latest)
+    function visit(node) {
+      if (
+        ts.isCallExpression(node) &&
+        ['registerLanguage', 'languages.register'].includes(node.expression.getText(source))
+      ) {
+        const [argument] = node.arguments
+        if (!argument || !ts.isObjectLiteralExpression(argument)) {
+          throw new Error(`Unsupported Monaco registration in ${file}`)
+        }
+        const metadata = { id: '', extensions: [], filenames: [] }
+        for (const property of argument.properties) {
+          if (!ts.isPropertyAssignment(property)) {
+            continue
+          }
+          const key = property.name.getText(source)
+          if (!['id', 'extensions', 'filenames'].includes(key)) {
+            continue
+          }
+          const value = property.initializer
+          if (key === 'id' && ts.isStringLiteral(value)) {
+            metadata.id = value.text
+          } else if (key !== 'id' && ts.isArrayLiteralExpression(value)) {
+            metadata[key] = value.elements.map((element) => {
+              if (!ts.isStringLiteral(element)) {
+                throw new Error(`Nonliteral association in ${file}`)
+              }
+              return element.text
+            })
+          } else {
+            throw new Error(`Unsupported ${key} in ${file}`)
+          }
+        }
+        if (!metadata.id) {
+          throw new Error(`Missing language id in ${file}`)
+        }
+        registrations.push(metadata)
+      }
+      ts.forEachChild(node, visit)
+    }
+    visit(source)
+  }
+  if (registrations.length < 80) {
+    throw new Error('Monaco registration entry point changed')
+  }
+  return registrations
+}
+
+if (process.argv[1] && resolve(process.argv[1]) === import.meta.filename) {
+  writeFileSync(associationsPath, `${JSON.stringify(readMonacoAssociations(), null, 2)}\n`)
+}
diff --git a/config/scripts/generate-monaco-associations.test.mjs b/config/scripts/generate-monaco-associations.test.mjs
new file mode 100644
index 000000000000..0e7563cd49ad
--- /dev/null
+++ b/config/scripts/generate-monaco-associations.test.mjs
@@ -0,0 +1,12 @@
+import { readFileSync } from 'node:fs'
+import { describe, expect, it } from 'vitest'
+import { associationsPath, readMonacoAssociations } from './generate-monaco-associations.mjs'
+
+describe('Monaco filename associations', () => {
+  it('matches every registration shipped by the installed editor entry point', () => {
+    expect(
+      JSON.parse(readFileSync(associationsPath, 'utf8')),
+      'Run node config/scripts/generate-monaco-associations.mjs after upgrading Monaco'
+    ).toEqual(readMonacoAssociations())
+  })
+})
diff --git a/config/scripts/generate-runtime-required-english-catalog.mjs b/config/scripts/generate-runtime-required-english-catalog.mjs
index 67fb7cd4d449..93769b02bcc9 100644
--- a/config/scripts/generate-runtime-required-english-catalog.mjs
+++ b/config/scripts/generate-runtime-required-english-catalog.mjs
@@ -3,11 +3,7 @@ import path from 'node:path'
 import process from 'node:process'
 import { pathToFileURL } from 'node:url'
 
-import {
-  collectLocalizationKeyReferences,
-  collectSourceFiles,
-  LOCALIZATION_SOURCE_ROOTS
-} from './verify-localization-catalog.mjs'
+import { collectLocalizationReferences } from './verify-localization-catalog.mjs'
 
 export const EN_CATALOG_RELATIVE_PATH = path.join(
   'src',
@@ -103,19 +99,6 @@ export function buildRuntimeRequiredCatalog(catalogEntries, requiredKeys) {
   return catalog
 }
 
-async function collectReferences(root) {
-  const references = []
-  for (const sourceRoot of LOCALIZATION_SOURCE_ROOTS) {
-    const files = await collectSourceFiles(root, path.join(root, sourceRoot))
-    for (const filePath of files) {
-      references.push(
-        ...collectLocalizationKeyReferences(filePath, await fs.readFile(filePath, 'utf8'), root)
-      )
-    }
-  }
-  return references
-}
-
 /**
  * Why not a byte-for-byte comparison: the shipped subset only has to be *safe*,
  * and safety is "every required entry is present, and nothing it ships
@@ -144,12 +127,12 @@ function reportKeys(label, keys) {
   }
 }
 
-export async function main(root = process.cwd(), argv = process.argv.slice(2)) {
+export async function main(root = process.cwd(), argv = process.argv.slice(2), sharedReferences) {
   const fix = argv.includes('--fix')
   const catalogEntries = flattenCatalogEntries(
     JSON.parse(await fs.readFile(path.join(root, EN_CATALOG_RELATIVE_PATH), 'utf8'))
   )
-  const references = await collectReferences(root)
+  const references = sharedReferences ?? (await collectLocalizationReferences(root))
   const requiredKeys = collectRuntimeRequiredKeys(catalogEntries, references)
   const outputPath = path.join(root, RUNTIME_REQUIRED_RELATIVE_PATH)
 
diff --git a/config/scripts/git-binary-compatibility-workflow.test.mjs b/config/scripts/git-binary-compatibility-workflow.test.mjs
index 35d2b5c60dc4..c03c7973f6a8 100644
--- a/config/scripts/git-binary-compatibility-workflow.test.mjs
+++ b/config/scripts/git-binary-compatibility-workflow.test.mjs
@@ -3,6 +3,8 @@ import { parse } from 'yaml'
 import { describe, expect, it } from 'vitest'
 
 const BASELINE_DIR = '~/.cache/orca-git-compat/git-2.25.5'
+const BASELINE_ACTION = './.github/actions/prepare-git-compatibility'
+const baselineSteps = parse(readFileSync(`${BASELINE_ACTION}/action.yml`, 'utf8')).runs.steps
 
 const gateSteps = () =>
   parse(readFileSync('.github/workflows/pr.yml', 'utf8')).jobs.git_compatibility.steps
@@ -23,7 +25,7 @@ describe('Git binary compatibility PR gate', () => {
   })
 
   it('builds the pinned baseline tarball into the cached directory', () => {
-    const run = stepNamed('Build the baseline Git binary')?.run
+    const run = baselineSteps.find((step) => step.name === 'Build the baseline Git binary')?.run
 
     expect(run).toContain('git-2.25.5.tar.gz')
     // Why asserted: the sha256 check only runs on the build path, so a cached binary
@@ -31,6 +33,9 @@ describe('Git binary compatibility PR gate', () => {
     expect(run).toContain('if [ -x "$source/git" ]; then')
     expect(run).toContain('41662c52fc16fec4963bfc41075e71f8ead6b5e386797eb6f9a1111ff95a8ddf')
     expect(run).toContain('-j"$(nproc)"')
+    expect(run).toContain('NO_GETTEXT=YesPlease NO_TCLTK=YesPlease NO_PYTHON=YesPlease git')
+    expect(run).toContain('sha256sum --check')
+    expect(run).toContain('find "$source" -name \'*.o\' -delete')
     // The cached path and the build path must be the same directory or the guard
     // above would rebuild on every run while still reporting a cache hit.
     expect(run).toContain('source="$HOME/.cache/orca-git-compat/git-2.25.5"')
@@ -38,20 +43,33 @@ describe('Git binary compatibility PR gate', () => {
 
   it('finishes the baseline build before the timed lanes start', () => {
     const steps = gateSteps()
-    const names = steps.map((step) => step.name)
+    const names = baselineSteps.map((step) => step.name)
     const cacheIndex = names.indexOf('Cache baseline Git build')
     const buildIndex = names.indexOf('Build the baseline Git binary')
-    const matrixIndex = names.indexOf('Verify Git binary compatibility matrix')
+    const prepareIndex = steps.findIndex((step) => step.uses === BASELINE_ACTION)
+    const matrixIndex = steps.findIndex(
+      (step) => step.name === 'Verify Git binary compatibility matrix'
+    )
 
     expect(cacheIndex).toBeGreaterThanOrEqual(0)
     expect(cacheIndex).toBeLessThan(buildIndex)
-    expect(buildIndex).toBeLessThan(matrixIndex)
+    expect(prepareIndex).toBeGreaterThanOrEqual(0)
+    expect(prepareIndex).toBeLessThan(matrixIndex)
     // Why asserted: each lane is bounded by Vitest's per-test timeout while it waits on
     // container starts, so a `make -j$(nproc)` sharing the runner shows up as a timeout
     // in whichever boundary case is running rather than as a slow build.
     expect(steps[matrixIndex].run).not.toContain('make -C')
-    expect(steps[cacheIndex].with.path).toBe(BASELINE_DIR)
-    expect(steps[cacheIndex].with.key).toContain('2.25.5')
+    expect(baselineSteps[cacheIndex].with.path).toBe(BASELINE_DIR)
+    expect(baselineSteps[cacheIndex].with.key).toBe(
+      'git-compat-baseline-${{ runner.os }}-${{ runner.arch }}-2.25.5'
+    )
+  })
+
+  it('warms the same baseline on main so newly opened PRs can restore it', () => {
+    const warmer = parse(readFileSync('.github/workflows/ci-cache-warmup.yml', 'utf8'))
+    expect(warmer.jobs.warm.steps.some((step) => step.uses === BASELINE_ACTION)).toBe(true)
+    expect(warmer.on.push.paths).toContain('.github/actions/prepare-git-compatibility/**')
+    expect(warmer.on.pull_request.paths).toContain('.github/actions/prepare-git-compatibility/**')
   })
 
   it('pulls every matrix image before any lane runs', () => {
diff --git a/config/scripts/git-pull-request-diff-base.mjs b/config/scripts/git-pull-request-diff-base.mjs
index 3e2021a1eb14..0dd5b825ef78 100644
--- a/config/scripts/git-pull-request-diff-base.mjs
+++ b/config/scripts/git-pull-request-diff-base.mjs
@@ -1,5 +1,6 @@
 import { execFileSync } from 'node:child_process'
 import process from 'node:process'
+import { pathToFileURL } from 'node:url'
 
 export function selectPullRequestDiffBase(requestedBase, headParents, eventName) {
   if (eventName === 'pull_request' && headParents.length >= 2) {
@@ -21,3 +22,15 @@ export function resolvePullRequestDiffBase(
     .split(/\s+/)
   return selectPullRequestDiffBase(requestedBase, headParents, eventName)
 }
+
+// Why a CLI: the workflow's inline gates used `git diff --merge-base "$BASE_SHA" "$HEAD_SHA"`,
+// which needs the payload base to be reachable and so forced a full-history checkout. Printing
+// the resolved base lets those steps diff against `HEAD^1` with the same logic the Node gates
+// already use, instead of each one open-coding it.
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  const resolved = resolvePullRequestDiffBase(process.cwd(), process.argv[2])
+  if (!resolved) {
+    throw new Error('No diff base: pass the pull request base SHA, or run on a merge ref.')
+  }
+  process.stdout.write(`${resolved}\n`)
+}
diff --git a/config/scripts/headless-serve-shutdown-matrix.test.mjs b/config/scripts/headless-serve-shutdown-matrix.test.mjs
index 32878b219f58..fa9a9c6943fe 100644
--- a/config/scripts/headless-serve-shutdown-matrix.test.mjs
+++ b/config/scripts/headless-serve-shutdown-matrix.test.mjs
@@ -135,6 +135,23 @@ describe('packaged shutdown matrix', () => {
     ).toBe(true)
   })
 
+  it('uses a restored image only as a build cache and still runs every oracle', async () => {
+    vi.stubEnv('ORCA_SHUTDOWN_FIXTURE_CACHE_IMAGE', 'sha256:restored-fixture')
+    try {
+      await run('--all-entrypoints')
+      const builds = commands().filter((args) => args[0] === 'build')
+      expect(builds).toHaveLength(1)
+      expect(builds[0]).toContain('--cache-from')
+      expect(builds[0]).toContain('sha256:restored-fixture')
+      expect(builds[0]).toContain('--platform')
+      expect(builds[0]).toContain('linux/amd64')
+      expect(signalRuns()).toHaveLength(6)
+      expect(commands().filter((args) => args[0] === 'run')).toHaveLength(8)
+    } finally {
+      vi.unstubAllEnvs()
+    }
+  })
+
   it('rejects ambiguous matrix overrides before invoking Docker', async () => {
     await expect(run('--all-entrypoints', '--entrypoint', 'launcher')).rejects.toThrow(
       'cannot be combined'
diff --git a/config/scripts/headless-serve-shutdown-workflow.test.mjs b/config/scripts/headless-serve-shutdown-workflow.test.mjs
index e9f70ffc6abe..77b92b1d0c34 100644
--- a/config/scripts/headless-serve-shutdown-workflow.test.mjs
+++ b/config/scripts/headless-serve-shutdown-workflow.test.mjs
@@ -58,7 +58,8 @@ describe('headless serve shutdown PR gate', () => {
     const shutdownStep = steps.find((step) => step.name === 'Verify headless serve signal shutdown')
 
     expect(workflow.jobs.package['timeout-minutes']).toBe(90)
-    expect(packageStep.run).toContain('--linux AppImage deb rpm --x64 --publish never')
+    expect(packageStep.run).toContain('--linux dir --x64 --publish never')
+    expect(packageStep.run).toContain('node config/scripts/package-linux-formats.mjs')
     expect(markerStep.run).toContain('dpkg-deb --fsys-tarfile')
     expect(markerStep.run).toContain('rpm2cpio')
     expect(steps.indexOf(markerStep)).toBeGreaterThan(steps.indexOf(packageStep))
diff --git a/config/scripts/hourly-build-version.mjs b/config/scripts/hourly-build-version.mjs
index 9f6b9000844f..2af342065ba3 100644
--- a/config/scripts/hourly-build-version.mjs
+++ b/config/scripts/hourly-build-version.mjs
@@ -79,12 +79,16 @@ export function formatHourlyReleaseName(version, buildNumber, commit, date) {
 // base version, and the base is only known once the published tags have been
 // resolved just above. Computing it outside meant numbering against whatever
 // version the caller guessed.
-export function getHourlyBuildIdentity(now = new Date(), { publishedVersions, releaseNames } = {}) {
-  const packageJson = JSON.parse(readFileSync(resolve('package.json'), 'utf8'))
+export function getHourlyBuildIdentity(
+  now = new Date(),
+  { packageVersion, publishedVersions, releaseNames } = {}
+) {
+  const versionFromPackage =
+    packageVersion ?? JSON.parse(readFileSync(resolve('package.json'), 'utf8')).version
   const commit = execFileSync('git', ['rev-parse', '--short=12', 'HEAD'], {
     encoding: 'utf8'
   }).trim()
-  const base = resolveDevChannelBaseVersion(packageJson.version, publishedVersions ?? [])
+  const base = resolveDevChannelBaseVersion(versionFromPackage, publishedVersions ?? [])
   const version = createHourlyBuildVersion(base, now)
   const buildNumber = nextHourlyBuildNumber(base, releaseNames ?? [])
   return {
diff --git a/config/scripts/hourly-build-version.test.mjs b/config/scripts/hourly-build-version.test.mjs
index 7438b16acbd2..dfb88c373325 100644
--- a/config/scripts/hourly-build-version.test.mjs
+++ b/config/scripts/hourly-build-version.test.mjs
@@ -129,6 +129,7 @@ describe('getHourlyBuildIdentity', () => {
   // install it.
   it('stays on the already-shipped hourly base after a buggy main release is unpublished', () => {
     const identity = getHourlyBuildIdentity(new Date('2026-09-14T20:00:00Z'), {
+      packageVersion: '1.4.201',
       publishedVersions: [
         'v1.4.201',
         'v1.4.202',
@@ -143,4 +144,14 @@ describe('getHourlyBuildIdentity', () => {
     expect(identity.version).toBe('1.4.203-hourly.202609142000')
     expect(identity.buildNumber).toBe(5)
   })
+
+  it('keeps a newer package version as the hourly base floor', () => {
+    const identity = getHourlyBuildIdentity(new Date('2026-09-14T20:00:00Z'), {
+      packageVersion: '1.4.214',
+      publishedVersions: ['v1.4.202', 'v1.4.203-hourly.202609140417'],
+      releaseNames: ['1.4.203 • 04 • Sep 13, 9:17PM • 2ce252f']
+    })
+    expect(identity.version).toBe('1.4.214-hourly.202609142000')
+    expect(identity.buildNumber).toBe(1)
+  })
 })
diff --git a/config/scripts/install-electron-package-binary.mjs b/config/scripts/install-electron-package-binary.mjs
index 63f575f1d9a6..a9d2bd8c0007 100644
--- a/config/scripts/install-electron-package-binary.mjs
+++ b/config/scripts/install-electron-package-binary.mjs
@@ -16,6 +16,7 @@ import { createRequire } from 'node:module'
 import { platform as osPlatform, tmpdir } from 'node:os'
 import { join, resolve } from 'node:path'
 import { getElectronPlatformPath } from './electron-platform-path.mjs'
+import { getZipExtractorCommand } from './zip-extractor-command.mjs'
 import {
   shareElectronDistFromCache,
   hasAdoptedSharedElectronDist,
@@ -448,33 +449,7 @@ function getExtractorCommand(zipPath, extractDir) {
     }
   }
 
-  if (osPlatform() === 'win32') {
-    return {
-      file: process.env.ORCA_POWERSHELL_BIN || 'powershell',
-      args: [
-        '-NoProfile',
-        '-NonInteractive',
-        '-ExecutionPolicy',
-        'Bypass',
-        '-Command',
-        [
-          "$ErrorActionPreference = 'Stop'",
-          `Expand-Archive -LiteralPath ${quotePowerShellLiteral(zipPath)} -DestinationPath ${quotePowerShellLiteral(extractDir)} -Force`
-        ].join('; ')
-      ],
-      label: 'powershell Expand-Archive'
-    }
-  }
-
-  return {
-    file: process.env.ORCA_UNZIP_BIN || 'unzip',
-    args: ['-q', zipPath, '-d', extractDir],
-    label: 'unzip'
-  }
-}
-
-function quotePowerShellLiteral(value) {
-  return `'${String(value).replaceAll("'", "''")}'`
+  return getZipExtractorCommand(zipPath, extractDir)
 }
 
 function formatExtractorFailure(command, result) {
diff --git a/config/scripts/install-node-dependencies-action.test.mjs b/config/scripts/install-node-dependencies-action.test.mjs
index 3b20a0eb07e7..3006a0063da9 100644
--- a/config/scripts/install-node-dependencies-action.test.mjs
+++ b/config/scripts/install-node-dependencies-action.test.mjs
@@ -7,6 +7,7 @@ import { describe, expect, it } from 'vitest'
 
 const action = parse(readFileSync('.github/actions/install-node-dependencies/action.yml', 'utf8'))
 const installScript = action.runs.steps.find((step) => step.name === 'Install dependencies').run
+const storeScript = action.runs.steps.find((step) => step.id === 'pnpm-store').run
 
 function run(command, args, options = {}) {
   return spawnSync(command, args, { encoding: 'utf8', ...options })
@@ -35,7 +36,10 @@ function createFixture() {
   ).toBe(0)
 
   const pnpm = join(bin, 'pnpm')
-  writeFileSync(pnpm, '#!/bin/sh\nexit 0\n')
+  writeFileSync(
+    pnpm,
+    '#!/bin/sh\nif [ "$1" = store ]; then printf "%s\\n" "$PNPM_TEST_STORE_PATH"; fi\nexit 0\n'
+  )
   chmodSync(pnpm, 0o755)
   return { bin, detachedCwd, root, workspace }
 }
@@ -52,6 +56,50 @@ function executeInstallScript(fixture) {
 }
 
 describe('install-node-dependencies action', () => {
+  it.each(['/home/runner/pnpm store/v11', 'C:\\Users\\runner\\pnpm store\\v11'])(
+    'preserves setup-node store path %s and lowercase architecture',
+    (storePath) => {
+      const fixture = createFixture()
+      const output = join(fixture.root, 'github-output')
+      try {
+        const result = run('bash', ['-e', '-o', 'pipefail', '-c', storeScript], {
+          env: {
+            ...process.env,
+            GITHUB_OUTPUT: output,
+            LOCKFILE_HASH: 'lockfile-digest',
+            PNPM_TEST_STORE_PATH: storePath,
+            PATH: `${fixture.bin}${delimiter}${process.env.PATH}`
+          }
+        })
+        expect(result.status, result.stderr || result.stdout).toBe(0)
+        expect(readFileSync(output, 'utf8')).toBe(`path=${storePath}\narch=${process.arch}\n`)
+      } finally {
+        rmSync(fixture.root, { recursive: true, force: true })
+      }
+    }
+  )
+
+  it.each([
+    ['', 'store'],
+    ['lockfile-digest', '']
+  ])('rejects a missing lockfile hash or store path (%s, %s)', (hash, storePath) => {
+    const fixture = createFixture()
+    try {
+      const result = run('bash', ['-e', '-o', 'pipefail', '-c', storeScript], {
+        env: {
+          ...process.env,
+          GITHUB_OUTPUT: join(fixture.root, 'github-output'),
+          LOCKFILE_HASH: hash,
+          PNPM_TEST_STORE_PATH: storePath,
+          PATH: `${fixture.bin}${delimiter}${process.env.PATH}`
+        }
+      })
+      expect(result.status).toBe(1)
+    } finally {
+      rmSync(fixture.root, { recursive: true, force: true })
+    }
+  })
+
   it('skips the lockfile diff when a job container has no Git metadata', () => {
     const fixture = createFixture()
     try {
diff --git a/config/scripts/linux-package-fixture-cache.test.mjs b/config/scripts/linux-package-fixture-cache.test.mjs
new file mode 100644
index 000000000000..1247d70bbca2
--- /dev/null
+++ b/config/scripts/linux-package-fixture-cache.test.mjs
@@ -0,0 +1,120 @@
+import { chmodSync, mkdtempSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { delimiter, join } from 'node:path'
+import { afterEach, describe, expect, it } from 'vitest'
+import { parse } from 'yaml'
+import { runProcessSync } from '../../src/shared/child-process/run-process'
+
+const action = parse(
+  readFileSync('.github/actions/prepare-linux-package-fixture/action.yml', 'utf8')
+)
+const load = action.runs.steps.find((step) => step.id === 'image')
+const workflow = (name) => parse(readFileSync(`.github/workflows/${name}.yml`, 'utf8'))
+let directory
+
+afterEach(() => {
+  if (directory) {
+    rmSync(directory, { recursive: true, force: true })
+  }
+})
+
+function exercise({ hit = false, save = false, loadFails = false, inspectFails = false } = {}) {
+  directory = mkdtempSync(join(tmpdir(), 'orca-package-cache-'))
+  const bin = join(directory, 'bin')
+  mkdirSync(bin)
+  const commandLog = join(directory, 'commands')
+  const output = join(directory, 'output')
+  writeFileSync(commandLog, '')
+  writeFileSync(output, '')
+  const docker = join(bin, 'docker')
+  writeFileSync(
+    docker,
+    '#!/bin/bash\n' +
+      'echo "$*" >> "$COMMAND_LOG"\n' +
+      'if [[ "$1" == load && "$LOAD_FAILS" == true ]]; then exit 1; fi\n' +
+      'if [[ "$1 $2" == "image inspect" ]]; then\n' +
+      '  if [[ "$INSPECT_FAILS" == true ]]; then exit 1; fi\n' +
+      '  echo sha256:fixture-image\n' +
+      'fi\n'
+  )
+  chmodSync(docker, 0o755)
+  const result = runProcessSync({
+    program: 'bash',
+    args: ['-c', load.run],
+    env: {
+      ...process.env,
+      ORCA_BACKGROUND_LAUNCH: '1',
+      PATH: `${bin}${delimiter}${process.env.PATH ?? ''}`,
+      RUNNER_TEMP: directory,
+      GITHUB_OUTPUT: output,
+      COMMAND_LOG: commandLog,
+      FIXTURE: 'cli-launch-contract',
+      CACHE_HIT: String(hit),
+      SAVE_CACHE: String(save),
+      LOAD_FAILS: String(loadFails),
+      INSPECT_FAILS: String(inspectFails)
+    },
+    timeoutMs: 10_000
+  })
+  expect(result.code, result.stderr).toBe(0)
+  return { commands: readFileSync(commandLog, 'utf8'), output: readFileSync(output, 'utf8') }
+}
+
+describe.runIf(process.platform !== 'win32')('fixture cache fallbacks', () => {
+  it('leaves a PR cache miss to the existing runner without building or exporting', () => {
+    expect(exercise()).toEqual({ commands: '', output: '' })
+  })
+
+  it.each([{ loadFails: true }, { inspectFails: true }])(
+    'discards an unusable restored cache: %j',
+    (failure) => {
+      const result = exercise({ hit: true, ...failure })
+      expect(result.output).toBe('')
+      expect(result.commands).toContain('load --input')
+      expect(result.commands).not.toMatch(/(?:build|save) /)
+    }
+  )
+
+  it('returns the local image tag after a successful load', () => {
+    const result = exercise({ hit: true })
+    expect(result.output).toBe('image=orca-package-fixture-cli-launch-contract:cache\n')
+    expect(result.commands).not.toMatch(/(?:build|save) /)
+  })
+
+  it('builds and exports inline cache only when the warmer has no usable image', () => {
+    const result = exercise({ save: true })
+    expect(result.commands).toContain(
+      'build --platform linux/amd64 --build-arg BUILDKIT_INLINE_CACHE=1'
+    )
+    expect(result.commands).toContain(
+      '--file config/docker/cli-launch-contract/Dockerfile config/docker/cli-launch-contract'
+    )
+    expect(result.commands).toContain('save --output')
+    expect(result.output).toBe('image=orca-package-fixture-cli-launch-contract:cache\nbuilt=true\n')
+  })
+})
+
+it('uses exact context/platform keys and the same restore-only action in package checks', () => {
+  const cache = action.runs.steps.find((step) => step.id === 'cache')
+  expect(cache.with.key).toContain('linux-amd64')
+  expect(cache.with.key).toContain("format('config/docker/{0}/**', inputs.fixture)")
+  expect(cache.with.key).toContain('.github/actions/prepare-linux-package-fixture/action.yml')
+  expect(cache.with['restore-keys']).toBeUndefined()
+  expect(action.inputs['save-cache'].default).toBe('false')
+  const prepared = workflow('pr').jobs.package.steps.filter((step) =>
+    step.uses?.endsWith('/prepare-linux-package-fixture')
+  )
+  expect(prepared.map((step) => step.with)).toEqual([
+    { fixture: 'headless-serve-shutdown' },
+    { fixture: 'cli-launch-contract' }
+  ])
+  const warm = workflow('ci-cache-warmup').jobs['warm-linux-package-fixtures']
+  expect(warm.steps.slice(1).map((step) => step.with.fixture)).toEqual(
+    prepared.map((step) => step.with.fixture)
+  )
+  expect(
+    warm.steps
+      .slice(1)
+      .every((step) => step.with['save-cache'] === "${{ github.event_name != 'pull_request' }}")
+  ).toBe(true)
+})
diff --git a/config/scripts/locale-translation-policy.mjs b/config/scripts/locale-translation-policy.mjs
index af88805b8c4b..75f50d15ff62 100644
--- a/config/scripts/locale-translation-policy.mjs
+++ b/config/scripts/locale-translation-policy.mjs
@@ -38,6 +38,7 @@ export const NEVER_TRANSLATE_VALUES = new Set([
   'Claude Agent Teams',
   'Cline',
   'Codebuff',
+  'Freebuff',
   'Codex',
   'Command Code',
   'Cursor',
diff --git a/config/scripts/localization-extraction-change-scope.mjs b/config/scripts/localization-extraction-change-scope.mjs
new file mode 100644
index 000000000000..21fccd98d9bd
--- /dev/null
+++ b/config/scripts/localization-extraction-change-scope.mjs
@@ -0,0 +1,32 @@
+import { readFileSync } from 'node:fs'
+import { pathToFileURL } from 'node:url'
+
+const TOOLCHAIN_FILES = new Set([
+  'package.json',
+  'pnpm-lock.yaml',
+  'pnpm-workspace.yaml',
+  'tsconfig.json',
+  '.npmrc',
+  '.pnpmfile.cjs',
+  '.github/workflows/pr.yml'
+])
+
+export function affectsLocalizationExtraction(paths) {
+  return paths.some(
+    (path) =>
+      TOOLCHAIN_FILES.has(path) ||
+      // Include all source paths so catalog moves and future extractor inputs stay covered.
+      path.startsWith('src/') ||
+      path.startsWith('config/i18next.') ||
+      path.startsWith('config/tsconfig') ||
+      path.startsWith('config/patches/') ||
+      path.startsWith('config/scripts/localization-') ||
+      path.startsWith('config/scripts/verify-localization-') ||
+      path.startsWith('.github/actions/install-node-dependencies/')
+  )
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  const changed = readFileSync(process.argv[2], 'utf8').split('\0').filter(Boolean)
+  process.stdout.write(`${affectsLocalizationExtraction(changed)}\n`)
+}
diff --git a/config/scripts/localization-extraction-change-scope.test.mjs b/config/scripts/localization-extraction-change-scope.test.mjs
new file mode 100644
index 000000000000..8852965ad301
--- /dev/null
+++ b/config/scripts/localization-extraction-change-scope.test.mjs
@@ -0,0 +1,59 @@
+import { readFileSync } from 'node:fs'
+import { expect, it } from 'vitest'
+import { parse } from 'yaml'
+import { affectsLocalizationExtraction } from './localization-extraction-change-scope.mjs'
+
+it.each([
+  'src/renderer/src/components/Example.tsx',
+  'src/main/notifications.ts',
+  'src/renderer/src/i18n/locales/en.json',
+  'config/i18next.config.ts',
+  'config/scripts/verify-localization-extraction.mjs',
+  'config/scripts/localization-extraction-change-scope.mjs',
+  'config/patches/i18next-cli.patch',
+  'package.json',
+  'pnpm-lock.yaml',
+  'pnpm-workspace.yaml',
+  'tsconfig.json',
+  'config/tsconfig.web.json',
+  '.npmrc',
+  '.pnpmfile.cjs',
+  '.github/workflows/pr.yml',
+  '.github/actions/install-node-dependencies/action.yml'
+])('retains extraction when an input changes: %s', (path) => {
+  expect(affectsLocalizationExtraction([path])).toBe(true)
+})
+
+it('avoids extraction for unrelated CI, documentation, and native changes', () => {
+  expect(
+    affectsLocalizationExtraction([
+      '.github/workflows/e2e.yml',
+      'config/scripts/run-ssh-docker-e2e.mjs',
+      'docs/reference/ci-runner-efficiency.md',
+      'native/windows-registry/src/addon.cc'
+    ])
+  ).toBe(false)
+})
+
+it('preserves deleted and renamed inputs and falls back to extraction on detection failure', () => {
+  const workflow = parse(
+    readFileSync(new URL('../../.github/workflows/pr.yml', import.meta.url), 'utf8')
+  )
+  const step = workflow.jobs.static_analysis.steps.find(
+    (candidate) => candidate.name === 'Verify localization extraction'
+  )
+  expect(step.env).toEqual({
+    BASE_SHA: '${{ github.event.pull_request.base.sha }}'
+  })
+  // The base side comes from the merge ref's first parent, so the gate needs no merge base and
+  // works on a shallow checkout. The payload head SHA is no longer read: HEAD is the merged tree
+  // the gate is actually deciding about.
+  expect(step.run).toContain('node config/scripts/git-pull-request-diff-base.mjs "$BASE_SHA"')
+  expect(step.run).toContain('git diff --name-only --no-renames -z "$DIFF_BASE" HEAD')
+  expect(step.run).not.toContain('--diff-filter')
+  expect(step.run).toContain('&& [ "$scope" = false ]; then')
+  expect(step.run).toMatch(/else\s+pnpm run verify:localization-extraction\s+fi/)
+  expect(
+    affectsLocalizationExtraction(['src/old-translations.ts', 'docs/moved-translations.ts'])
+  ).toBe(true)
+})
diff --git a/config/scripts/localization-package-contract.test.mjs b/config/scripts/localization-package-contract.test.mjs
index 9e744939bfcc..2ede8365e9ed 100644
--- a/config/scripts/localization-package-contract.test.mjs
+++ b/config/scripts/localization-package-contract.test.mjs
@@ -14,7 +14,10 @@ describe('localization package scripts', () => {
   it('keeps the runtime-required English subset generated and checked', () => {
     expect(scripts['verify:localization-runtime-catalog']).toBeDefined()
     expect(scripts['sync:localization-runtime-catalog']).toBeDefined()
-    expect(scripts.lint).toContain('verify:localization-runtime-catalog')
+    expect(scripts['verify:localization-catalogs']).toBe(
+      'node config/scripts/verify-localization-catalogs.mjs'
+    )
+    expect(scripts.lint).toContain('verify:localization-catalogs')
   })
 
   it('does not expose whole-catalog translation and repair commands', () => {
diff --git a/config/scripts/mobile-recording-pin-checkout.test.mjs b/config/scripts/mobile-recording-pin-checkout.test.mjs
new file mode 100644
index 000000000000..f45db12bdbeb
--- /dev/null
+++ b/config/scripts/mobile-recording-pin-checkout.test.mjs
@@ -0,0 +1,93 @@
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { pathToFileURL } from 'node:url'
+import { expect, it } from 'vitest'
+import { parse } from 'yaml'
+import { runProcessSync } from './script-child-process.mjs'
+
+const workflow = parse(
+  readFileSync(new URL('../../.github/workflows/mobile.yml', import.meta.url), 'utf8')
+)
+
+it('keeps full ancestry and credentials for lazy pinned-tree reads', () => {
+  const job = workflow.jobs['recording-pin']
+  const checkout = job.steps.find((step) => step.uses?.startsWith('actions/checkout@'))
+  expect(checkout.with['fetch-depth']).toBe(0)
+  expect(checkout.with.filter).toBe('blob:none')
+  expect(checkout.with['persist-credentials']).not.toBe(false)
+  expect(job.if).toBeUndefined()
+  expect(workflow.on.push.branches).toEqual(['main'])
+  expect(workflow.concurrency.group).toContain('github.sha')
+  expect(job.steps.find((step) => step.name === 'Check the recording pin is reachable').run).toBe(
+    'pnpm exec tsx scripts/rpc-recording-pin-guard.mts ancestry'
+  )
+  const reproduce = job.steps.find(
+    (step) => step.name === 'Reproduce the corpus from the pinned tree'
+  )
+  expect(reproduce.run).toContain('reproduce --if-changed-since "$PIN_GUARD_BASE"')
+  expect(reproduce.run).toContain(
+    'else\n  pnpm exec tsx scripts/rpc-recording-pin-guard.mts reproduce\nfi'
+  )
+})
+
+it('retains ancestry while fetching a missing pinned blob for a detached worktree', () => {
+  const directory = mkdtempSync(join(tmpdir(), 'mobile-pin-checkout-'))
+  const source = join(directory, 'source')
+  const checkout = join(directory, 'checkout')
+  const pinnedTree = join(directory, 'pinned-tree')
+  const git = (cwd, ...args) => {
+    const result = runProcessSync({ program: 'git', args, cwd })
+    expect(result.code, result.stderr).toBe(0)
+    return result.stdout.trim()
+  }
+  try {
+    git(directory, 'init', '--quiet', source)
+    git(source, 'symbolic-ref', 'HEAD', 'refs/heads/main')
+    git(source, 'config', 'user.name', 'Pin checkout fixture')
+    git(source, 'config', 'user.email', 'pin-checkout@example.invalid')
+    git(source, 'config', 'uploadpack.allowFilter', 'true')
+    git(source, 'config', 'uploadpack.allowAnySHA1InWant', 'true')
+    const corpus = 'mobile/rpc-foundation/goldens/fixture.json'
+    mkdirSync(join(source, 'mobile/rpc-foundation/goldens'), { recursive: true })
+    const original = '{"baseline":"original historical recording"}\n'
+    const commit = () => {
+      git(source, 'add', '-A')
+      git(source, '-c', 'commit.gpgsign=false', 'commit', '--quiet', '-m', 'recording')
+      return git(source, 'rev-parse', 'HEAD')
+    }
+    writeFileSync(join(source, corpus), original)
+    const baseline = commit()
+    const oldBlob = git(source, 'rev-parse', `${baseline}:${corpus}`)
+    writeFileSync(join(source, corpus), '{"baseline":"current recording"}\n')
+    commit()
+    git(
+      directory,
+      'clone',
+      '--filter=blob:none',
+      '--no-checkout',
+      '--single-branch',
+      '--no-tags',
+      pathToFileURL(source).href,
+      checkout
+    )
+    git(checkout, 'checkout', '--quiet', '--force', 'main')
+
+    expect(git(checkout, 'rev-parse', '--is-shallow-repository')).toBe('false')
+    expect(git(checkout, 'rev-list', '--count', 'HEAD')).toBe('2')
+    git(checkout, 'merge-base', '--is-ancestor', baseline, 'HEAD')
+    expect(git(checkout, 'rev-list', '--objects', '--missing=print', 'HEAD')).toContain(
+      `?${oldBlob}`
+    )
+
+    git(checkout, 'worktree', 'add', '--detach', pinnedTree, baseline)
+
+    expect(readFileSync(join(pinnedTree, corpus), 'utf8')).toBe(original)
+    expect(git(checkout, 'rev-list', '--objects', '--missing=print', 'HEAD')).not.toContain(
+      `?${oldBlob}`
+    )
+    git(checkout, 'worktree', 'remove', '--force', pinnedTree)
+  } finally {
+    rmSync(directory, { recursive: true, force: true })
+  }
+})
diff --git a/config/scripts/mobile-release-check-scope.mjs b/config/scripts/mobile-release-check-scope.mjs
new file mode 100644
index 000000000000..435d3e6fccc5
--- /dev/null
+++ b/config/scripts/mobile-release-check-scope.mjs
@@ -0,0 +1,31 @@
+import { appendFileSync, readFileSync } from 'node:fs'
+import { pathToFileURL } from 'node:url'
+import { isDocsOnlyPath } from './pr-code-change-scope.mjs'
+
+const APPLICATION_PREFIXES = ['src/', 'mobile/app/', 'mobile/src/']
+
+export function shouldRunMobileReleaseChecks(files) {
+  return (
+    files.length === 0 ||
+    files.some(
+      (file) =>
+        !isDocsOnlyPath(file) &&
+        file !== 'mobile/README.md' &&
+        !file.startsWith('mobile/docs/') &&
+        !(
+          APPLICATION_PREFIXES.some((prefix) => file.startsWith(prefix)) &&
+          /\.(?:[cm]?[jt]sx?|css|md)$/.test(file)
+        )
+    )
+  )
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  const input = readFileSync(process.argv[2], 'utf8')
+  const files = input.endsWith('\0') ? input.slice(0, -1).split('\0') : []
+  const shouldRun = shouldRunMobileReleaseChecks(files)
+  console.log(
+    shouldRun ? 'Checking Ruby release inputs.' : 'Only application or documentation changed.'
+  )
+  appendFileSync(process.env.GITHUB_OUTPUT, `should_run=${shouldRun}\n`)
+}
diff --git a/config/scripts/mobile-release-check-scope.test.mjs b/config/scripts/mobile-release-check-scope.test.mjs
new file mode 100644
index 000000000000..cd7c204f8178
--- /dev/null
+++ b/config/scripts/mobile-release-check-scope.test.mjs
@@ -0,0 +1,215 @@
+import { copyFileSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { dirname, join, matchesGlob, resolve } from 'node:path'
+import { afterEach, describe, expect, it } from 'vitest'
+import { parse } from 'yaml'
+import { runProcessSync } from './script-child-process.mjs'
+import { shouldRunMobileReleaseChecks } from './mobile-release-check-scope.mjs'
+
+const root = resolve(import.meta.dirname, '../..')
+const workflow = parse(readFileSync(join(root, '.github/workflows/mobile.yml'), 'utf8'))
+const steps = workflow.jobs.verify.steps
+const detector = steps.find((step) => step.id === 'ruby-scope')
+const directories = []
+
+afterEach(() => {
+  for (const directory of directories.splice(0)) {
+    rmSync(directory, { recursive: true, force: true })
+  }
+})
+
+it.each([
+  'src/main/runtime/rpc/dispatcher.ts',
+  'src/shared/rpc-contract/params.ts',
+  'mobile/src/session/session.test.ts',
+  'mobile/app/index.tsx',
+  'mobile/src/theme.css',
+  'mobile/src/session/README.md',
+  'mobile/docs/release.md',
+  'mobile/README.md',
+  'docs/reference/mobile.md'
+])('skips Ruby checks for application/documentation-only changes: %s', (file) => {
+  expect(shouldRunMobileReleaseChecks([file])).toBe(false)
+})
+
+it.each([
+  'mobile/fastlane/Fastfile',
+  'mobile/fastlane/Appfile',
+  'mobile/fastlane/ios_release_version.rb',
+  'mobile/fastlane/ios_release_version_test.rb',
+  'mobile/Gemfile',
+  'mobile/Gemfile.lock',
+  'mobile/.ruby-version',
+  'mobile/.bundle/config',
+  'mobile/app.json',
+  'mobile/app.config.ts',
+  'mobile/ios/Podfile',
+  'mobile/package.json',
+  'mobile/pnpm-lock.yaml',
+  'mobile/scripts/release.mts',
+  'mobile/src/release.rb',
+  'mobile/src/release.json',
+  'mobile/new-toolchain/input',
+  'package.json',
+  'pnpm-lock.yaml',
+  '.github/workflows/mobile.yml',
+  '.github/workflows/mobile-ios-release.yml',
+  '.github/actions/install-node-dependencies/action.yml',
+  'config/scripts/mobile-release-check-scope.mjs',
+  'config/scripts/mobile-release-check-scope.test.mjs'
+])('retains Ruby release coverage for changed or unknown inputs: %s', (file) => {
+  expect(shouldRunMobileReleaseChecks([file])).toBe(true)
+  expect(shouldRunMobileReleaseChecks(['mobile/src/view.tsx', file])).toBe(true)
+})
+
+it('runs Ruby checks when the changed-file evidence is empty', () => {
+  expect(shouldRunMobileReleaseChecks([])).toBe(true)
+})
+
+it('gates Ruby independently and retains mobile static validation', () => {
+  expect(steps[0].with['fetch-depth']).toBe(2)
+  expect(detector['working-directory']).toBe('.')
+  expect(steps.indexOf(detector)).toBeGreaterThan(
+    steps.findIndex((step) => step.uses === './.github/actions/install-node-dependencies')
+  )
+  const gated = steps.filter((step) => step.if !== undefined && step.name !== 'Test')
+  expect(gated.map((step) => step.name)).toEqual([
+    'Setup Ruby and fastlane',
+    'Test iOS release version resolution',
+    'Test TestFlight lane arguments',
+    'Smoke-check the Fastfile'
+  ])
+  for (const step of gated) {
+    expect(step.if).toBe("steps.ruby-scope.outputs.should_run != 'false'")
+  }
+  for (const name of ['Typecheck', 'Typecheck tests (ratchet)', 'Lint', 'Check formatting']) {
+    expect(steps.find((step) => step.name === name)?.if).toBeUndefined()
+    expect(steps.some((step) => step.name === name)).toBe(true)
+  }
+  for (const file of [
+    'config/scripts/mobile-release-check-scope.mjs',
+    'config/scripts/mobile-release-check-scope.test.mjs',
+    'config/scripts/pr-code-change-scope.mjs'
+  ]) {
+    expect(workflow.on.pull_request.paths.some((pattern) => matchesGlob(file, pattern))).toBe(true)
+  }
+  expect(workflow.jobs.verify.env.BUNDLE_FROZEN).toBe('true')
+  expect(steps.find((step) => step.name === 'Setup Ruby and fastlane').with['bundler-cache']).toBe(
+    true
+  )
+  expect(steps.find((step) => step.name === 'Smoke-check the Fastfile').run).toBe(
+    'bundle exec fastlane lanes'
+  )
+})
+
+function fixture(detectorStep = detector) {
+  const directory = mkdtempSync(join(tmpdir(), 'mobile-release-scope-'))
+  directories.push(directory)
+  const git = (...args) => {
+    const result = runProcessSync({ program: 'git', args, cwd: directory })
+    expect(result.code, result.stderr).toBe(0)
+    return result.stdout.trim()
+  }
+  git('init', '--quiet')
+  git('symbolic-ref', 'HEAD', 'refs/heads/main')
+  git('config', 'user.name', 'Workflow fixture')
+  git('config', 'user.email', 'workflow@example.invalid')
+  const write = (file, content) => {
+    mkdirSync(dirname(join(directory, file)), { recursive: true })
+    writeFileSync(join(directory, file), content)
+  }
+  write('mobile/src/view.tsx', 'export const view = 1\n')
+  write('mobile/fastlane/Fastfile', 'default_platform(:ios)\n')
+  mkdirSync(join(directory, 'config/scripts'), { recursive: true })
+  for (const file of [
+    'package.json',
+    'config/scripts/pr-code-change-scope.mjs',
+    'config/scripts/mobile-release-check-scope.mjs',
+    'config/scripts/mobile-test-change-scope.mjs'
+  ]) {
+    copyFileSync(join(root, file), join(directory, file))
+  }
+  const commit = () => {
+    git('add', '-A')
+    git(
+      '-c',
+      'commit.gpgsign=false',
+      '-c',
+      'core.hooksPath=/dev/null',
+      'commit',
+      '--quiet',
+      '-m',
+      'fixture'
+    )
+  }
+  commit()
+  const detect = () => {
+    const output = join(directory, 'github-output')
+    const result = runProcessSync({
+      program: 'bash',
+      args: ['-e', '-c', detectorStep.run],
+      cwd: directory,
+      env: { ...process.env, GITHUB_OUTPUT: output, RUNNER_TEMP: directory }
+    })
+    expect(result.code, result.stderr).toBe(0)
+    return readFileSync(output, 'utf8')
+  }
+  return { directory, git, write, commit, detect }
+}
+
+describe.skipIf(process.platform === 'win32')('the Linux workflow detector command', () => {
+  it('skips Ruby after a source-only commit', () => {
+    const repo = fixture()
+    repo.write('mobile/src/view.tsx', 'export const view = 2\n')
+    repo.commit()
+    expect(repo.detect()).toBe('should_run=false\n')
+  })
+
+  it('keeps a deleted release input when a rename moves it into an excluded directory', () => {
+    const repo = fixture()
+    repo.git('mv', 'mobile/fastlane/Fastfile', 'mobile/src/old-release.md')
+    repo.commit()
+    expect(repo.detect()).toBe('should_run=true\n')
+  })
+
+  it('runs Ruby when the merge parent is unavailable', () => {
+    expect(fixture().detect()).toBe('should_run=true\n')
+  })
+
+  it('runs Ruby when the classifier cannot execute', () => {
+    const repo = fixture()
+    repo.write('mobile/src/view.tsx', 'export const view = 2\n')
+    repo.commit()
+    rmSync(join(repo.directory, 'config/scripts/mobile-release-check-scope.mjs'))
+    expect(repo.detect()).toBe('should_run=true\n')
+  })
+})
+
+describe.skipIf(process.platform === 'win32')('the mobile test detector command', () => {
+  const testDetector = steps.find((step) => step.id === 'test-scope')
+  it('skips release-only changes while retaining source changes', () => {
+    const repo = fixture(testDetector)
+    repo.write('mobile/fastlane/Fastfile', 'default_platform(:android)\n')
+    repo.commit()
+    expect(repo.detect()).toBe('should_run=false\n')
+    repo.write('mobile/src/view.tsx', 'export const view = 2\n')
+    repo.commit()
+    expect(repo.detect()).toBe('should_run=false\nshould_run=true\n')
+  })
+  it('retains tests after source moves into a documentation directory', () => {
+    const repo = fixture(testDetector)
+    repo.git('mv', 'mobile/src/view.tsx', 'mobile/README.md')
+    repo.commit()
+    expect(repo.detect()).toBe('should_run=true\n')
+  })
+  it('retains tests when the diff is unavailable', () => {
+    expect(fixture(testDetector).detect()).toBe('should_run=true\n')
+  })
+  it('retains tests when the classifier cannot execute', () => {
+    const repo = fixture(testDetector)
+    repo.write('mobile/fastlane/Fastfile', 'default_platform(:android)\n')
+    repo.commit()
+    rmSync(join(repo.directory, 'config/scripts/mobile-test-change-scope.mjs'))
+    expect(repo.detect()).toBe('should_run=true\n')
+  })
+})
diff --git a/config/scripts/mobile-release-shell-switch-workflow.test.mjs b/config/scripts/mobile-release-shell-switch-workflow.test.mjs
index 9e22d799cfb6..40cc20a95bab 100644
--- a/config/scripts/mobile-release-shell-switch-workflow.test.mjs
+++ b/config/scripts/mobile-release-shell-switch-workflow.test.mjs
@@ -116,8 +116,14 @@ it('leaves the switch out of every other workflow, so only a release can set it'
 const MOBILE_WORKFLOWS = ['mobile.yml', 'mobile-android-release.yml', 'mobile-ios-release.yml']
 /** Paths under which a Metro or Expo build cache lives, in the spellings a workflow would use. */
 const BUNDLER_CACHE_PATHS = ['metro-cache', '.expo', 'node_modules/.cache']
-/** The one restored path these workflows compute in a script, and so this test cannot read. */
-const REVIEWED_COMPUTED_PATH = '${{ steps.electron-package-cache.outputs.cache-root }}'
+/** Store/archive paths computed by scripts rather than declared in the workflows. */
+const REVIEWED_COMPUTED_PATHS = [
+  '${{ steps.electron-package-cache.outputs.cache-root }}',
+  '${{ steps.pnpm-store.outputs.path }}',
+  // Only pnpm's lockfile-verified.jsonl record, never Metro transforms.
+  '${{ steps.verification-cache.outputs.path }}',
+  "${{ github.event_name != 'pull_request' && 'pnpm' || '' }} store"
+]
 
 /** Every step a workflow runs, descending into the repository's own composite actions. */
 function stepsIncludingComposites(file) {
@@ -175,7 +181,7 @@ describe('what the mobile jobs restore from cache', () => {
   it('reads every restored path, rather than passing one it cannot evaluate', () => {
     const computed = MOBILE_CACHE_RESTORES.filter(({ paths }) => paths.includes('${{'))
 
-    expect(computed.map(({ paths }) => paths)).toEqual(computed.map(() => REVIEWED_COMPUTED_PATH))
+    expect(computed.filter(({ paths }) => !REVIEWED_COMPUTED_PATHS.includes(paths))).toEqual([])
   })
 
   it('restores no Metro or Expo build cache, which would decide the shell before the env does', () => {
diff --git a/config/scripts/mobile-test-change-scope.mjs b/config/scripts/mobile-test-change-scope.mjs
new file mode 100644
index 000000000000..cdd04d6edf50
--- /dev/null
+++ b/config/scripts/mobile-test-change-scope.mjs
@@ -0,0 +1,34 @@
+import { appendFileSync, readFileSync } from 'node:fs'
+import { pathToFileURL } from 'node:url'
+import { isDocsOnlyPath } from './pr-code-change-scope.mjs'
+
+const NON_TEST_FILES = new Set([
+  'mobile/Gemfile',
+  'mobile/Gemfile.lock',
+  'mobile/README.md',
+  '.github/workflows/mobile-ios-release.yml',
+  'config/scripts/pr-code-change-scope.mjs',
+  'config/scripts/pr-code-change-scope.test.mjs',
+  'config/scripts/mobile-release-check-scope.mjs',
+  'config/scripts/mobile-release-check-scope.test.mjs'
+])
+
+export function shouldRunMobileTests(files) {
+  return (
+    files.length === 0 ||
+    files.some(
+      (file) =>
+        file.split('/').includes('..') ||
+        (!isDocsOnlyPath(file) &&
+          !NON_TEST_FILES.has(file) &&
+          !file.startsWith('mobile/docs/') &&
+          !file.startsWith('mobile/fastlane/'))
+    )
+  )
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  const input = readFileSync(process.argv[2], 'utf8')
+  const files = input.endsWith('\0') ? input.slice(0, -1).split('\0') : []
+  appendFileSync(process.env.GITHUB_OUTPUT, `should_run=${shouldRunMobileTests(files)}\n`)
+}
diff --git a/config/scripts/mobile-test-change-scope.test.mjs b/config/scripts/mobile-test-change-scope.test.mjs
new file mode 100644
index 000000000000..8859daca4486
--- /dev/null
+++ b/config/scripts/mobile-test-change-scope.test.mjs
@@ -0,0 +1,60 @@
+import { readFileSync } from 'node:fs'
+import { parse } from 'yaml'
+import { expect, it } from 'vitest'
+import { shouldRunMobileTests } from './mobile-test-change-scope.mjs'
+
+it.each([
+  'docs/ci.md',
+  'mobile/docs/release.md',
+  'mobile/README.md',
+  'mobile/Gemfile.lock',
+  'mobile/fastlane/Fastfile',
+  '.github/workflows/mobile-ios-release.yml',
+  'config/scripts/pr-code-change-scope.mjs',
+  'config/scripts/mobile-release-check-scope.test.mjs'
+])('skips only known non-test inputs: %s', (file) => {
+  expect(shouldRunMobileTests([file])).toBe(false)
+  expect(shouldRunMobileTests([file, 'mobile/src/changed.ts'])).toBe(true)
+})
+
+it.each([
+  'mobile/src/view.tsx',
+  'mobile/app/_layout.tsx',
+  'mobile/scripts/check.ts',
+  'mobile/rpc-foundation/goldens/recording.json',
+  'mobile/vitest.config.ts',
+  'mobile/vitest.setup.ts',
+  'mobile/pnpm-lock.yaml',
+  'pnpm-lock.yaml',
+  'src/main/runtime/runtime-rpc.ts',
+  'src/shared/protocol-version.ts',
+  '.github/workflows/mobile.yml',
+  '.github/actions/install-node-dependencies/action.yml',
+  'config/scripts/mobile-test-change-scope.mjs',
+  'unknown-input',
+  'mobile/docs/../../src/source.ts'
+])('retains source, fixtures, toolchain, selector and unknown changes: %s', (file) => {
+  expect(shouldRunMobileTests([file])).toBe(true)
+})
+
+it('retains tests on missing evidence and a move out of the source tree', () => {
+  expect(shouldRunMobileTests([])).toBe(true)
+  expect(shouldRunMobileTests(['mobile/src/deleted.ts', 'mobile/docs/moved.ts'])).toBe(true)
+})
+
+it('skips only tests, after successful detection, and retains all other mobile gates', () => {
+  const workflow = parse(
+    readFileSync(new URL('../../.github/workflows/mobile.yml', import.meta.url), 'utf8')
+  )
+  const steps = workflow.jobs.verify.steps
+  expect(workflow.on.pull_request.paths).toContain('config/scripts/mobile-test-change-scope*')
+  const detector = steps.find((step) => step.id === 'test-scope')
+  expect(detector.run).toContain('git diff --name-only --no-renames -z HEAD^1 HEAD')
+  expect(detector.run.match(/should_run=true/g)).toHaveLength(2)
+  expect(steps.find((step) => step.name === 'Test').if).toBe(
+    "steps.test-scope.outputs.should_run != 'false'"
+  )
+  for (const name of ['Typecheck', 'Typecheck tests (ratchet)', 'Lint', 'Check formatting']) {
+    expect(steps.find((step) => step.name === name).if).toBeUndefined()
+  }
+})
diff --git a/config/scripts/mobile-web-app-agent-history-render.test.mjs b/config/scripts/mobile-web-app-agent-history-render.test.mjs
index 08ce37ea6c97..b1c69a880623 100644
--- a/config/scripts/mobile-web-app-agent-history-render.test.mjs
+++ b/config/scripts/mobile-web-app-agent-history-render.test.mjs
@@ -9,6 +9,7 @@ import {
   createBundleServer,
   installShellDouble,
   readBridgeFaultGrant,
+  readBridgePagePainted,
   readBridgeProtocolVersion,
   readShellCsp
 } from './mobile-web-app-render-harness.mjs'
@@ -110,6 +111,7 @@ let routeChunks = {}
 let cspHeader = null
 let bridgeVersion = null
 let faultGrant = null
+let paintName = null
 
 beforeAll(async () => {
   if (!bundles) {
@@ -118,6 +120,7 @@ beforeAll(async () => {
   cspHeader = await readShellCsp()
   bridgeVersion = await readBridgeProtocolVersion()
   faultGrant = await readBridgeFaultGrant()
+  paintName = await readBridgePagePainted()
   scratch = await mkdtemp(join(tmpdir(), 'orca-mobile-web-app-agent-history-'))
   const built = await buildMobileWebAppBundle({ outDir: join(scratch, 'bundle') })
   routeChunks = built.routeChunks
@@ -227,9 +230,11 @@ async function openRoute(route, awaitText, options = {}) {
   return opened
 }
 
-/** Every grant-gated notify the page posted, whole and in order, as the shell received them. */
-function readNotifies(page) {
-  return page.evaluate(() => globalThis.__orcaRenderCheckNotifies ?? [])
+/** Every grant-gated notify the page posted, whole and in order, as the shell received them. The
+ *  paint report is not one: every page posts it once its route screen has a frame. */
+async function readNotifies(page) {
+  const notifies = await page.evaluate(() => globalThis.__orcaRenderCheckNotifies ?? [])
+  return notifies.filter((frame) => frame.name !== paintName)
 }
 
 describeRender('the agent-history route in a real browser', () => {
diff --git a/config/scripts/mobile-web-app-bundle-test-fixture.mjs b/config/scripts/mobile-web-app-bundle-test-fixture.mjs
new file mode 100644
index 000000000000..3846cc4a54e8
--- /dev/null
+++ b/config/scripts/mobile-web-app-bundle-test-fixture.mjs
@@ -0,0 +1,49 @@
+import { mkdir, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { dirname, join } from 'node:path'
+import { deserialize, serialize } from 'node:v8'
+import { bundleMobileWebApp, buildMobileWebAppBundle } from './build-mobile-web-app-bundle.mjs'
+
+export async function withScratch(run) {
+  const scratch = await mkdtemp(join(tmpdir(), 'orca-mobile-web-app-test-'))
+  try {
+    return await run(scratch)
+  } finally {
+    await rm(scratch, { recursive: true, force: true })
+  }
+}
+
+// Snapshots preserve Buffer methods and give each assertion its own mutable copy.
+let appBundleSnapshot
+let writtenBundleSnapshot
+
+export async function readAppBundle() {
+  appBundleSnapshot ??= bundleMobileWebApp().then(serialize)
+  // Deserialized Buffers alias their snapshot, so copy it before exposing them.
+  return deserialize(Buffer.from(await appBundleSnapshot))
+}
+
+export async function readWrittenBundle() {
+  writtenBundleSnapshot ??= withScratch(async (scratch) => {
+    const { outDir, ...result } = await buildMobileWebAppBundle({ outDir: join(scratch, 'bundle') })
+    const html = await readFile(join(outDir, 'index.html'), 'utf8')
+    const files = await Promise.all(
+      ['manifest.json', ...result.manifest.assets.map((asset) => asset.path)].map(async (file) => ({
+        file,
+        bytes: await readFile(join(outDir, file))
+      }))
+    )
+    return serialize({ ...result, html, files })
+  })
+  return deserialize(Buffer.from(await writtenBundleSnapshot))
+}
+
+export async function copyWrittenBundle(outDir) {
+  const snapshot = await readWrittenBundle()
+  for (const { file, bytes } of snapshot.files) {
+    const destination = join(outDir, file)
+    await mkdir(dirname(destination), { recursive: true })
+    await writeFile(destination, bytes)
+  }
+  return { ...snapshot, outDir }
+}
diff --git a/config/scripts/mobile-web-app-drawer-render.test.mjs b/config/scripts/mobile-web-app-drawer-render.test.mjs
index 051072815a48..22d3b14a1d5d 100644
--- a/config/scripts/mobile-web-app-drawer-render.test.mjs
+++ b/config/scripts/mobile-web-app-drawer-render.test.mjs
@@ -302,9 +302,6 @@ describeDrawer('the device Back key reaching a sheet on the page', () => {
         host: SHELL_HOST,
         storage: {},
         faultGrant,
-        // What a shell that knows the lane offers, and the frame it would send. Without the first
-        // the page posts no claim at all, which is the older-shell arm the unit suites pin.
-        accepts: [backNames.claim],
         backFrame: backNames.frame
       })
       await page.goto(`${origin}/`, { waitUntil: 'load' })
diff --git a/config/scripts/mobile-web-app-haptics-seam.test.mjs b/config/scripts/mobile-web-app-haptics-seam.test.mjs
index 96c02c4b29b4..6f9c6c1afcf7 100644
--- a/config/scripts/mobile-web-app-haptics-seam.test.mjs
+++ b/config/scripts/mobile-web-app-haptics-seam.test.mjs
@@ -40,6 +40,14 @@ const read = (file) => readFileSync(join(mobileDir, file), 'utf8')
 /** The route module behind each declared page route, shared with the screencast-lane census. */
 const ROUTE_MODULES = PAGE_ROUTE_MODULES
 
+// These cases read the same source tree; keep each route's real closure once.
+const closures = new Map()
+async function closureOf(module) {
+  const built = closures.get(module) ?? mobileWebAppRouteClosure(module)
+  closures.set(module, built)
+  return structuredClone(await built)
+}
+
 const HAPTICS_GRANT = 'haptics'
 
 /** The shell's mapping from a notify kind to one of the app's own functions. */
@@ -222,7 +230,7 @@ describeClosure(
   'every page route closure and the haptics seam',
   () => {
     it.each([...ROUTE_MODULES])('resolves the seam to the web sibling: %s', async (_route, mod) => {
-      const closure = await mobileWebAppRouteClosure(mod)
+      const closure = await closureOf(mod)
       expect(closure.local).toContain(HAPTICS_SEAM)
       expect(closure.local).not.toContain(HAPTICS_NATIVE)
       // The precondition an assertion about a closure needs: the walk read a page, not nothing.
@@ -232,7 +240,7 @@ describeClosure(
     it.each([...ROUTE_MODULES])(
       'imports the seam from at least one module, so the grant is not idle: %s',
       async (_route, mod) => {
-        const closure = await mobileWebAppRouteClosure(mod)
+        const closure = await closureOf(mod)
         expect(hapticsSeamImporters(mobileDir, closure).length).toBeGreaterThan(0)
       }
     )
@@ -252,7 +260,7 @@ describeClosure(
     it('declares haptics on exactly the routes whose closure reaches the seam', async () => {
       const reaching = []
       for (const [route, mod] of ROUTE_MODULES) {
-        const closure = await mobileWebAppRouteClosure(mod)
+        const closure = await closureOf(mod)
         if (hapticsSeamImporters(mobileDir, closure).length > 0) {
           reaching.push(route)
         }
@@ -283,7 +291,7 @@ describeClosure(
      */
     it('adds one module to a page closure, and only the two haptics modules are in it', async () => {
       for (const mod of ROUTE_MODULES.values()) {
-        const closure = await mobileWebAppRouteClosure(mod)
+        const closure = await closureOf(mod)
         expect(closure.local.filter((file) => file.includes('haptics')).sort(), mod).toEqual([
           HAPTICS_KINDS_MODULE,
           HAPTICS_SEAM
diff --git a/config/scripts/mobile-web-app-page-grant-call-sites.mjs b/config/scripts/mobile-web-app-page-grant-call-sites.mjs
index af41a468363c..04e6ffcf6e57 100644
--- a/config/scripts/mobile-web-app-page-grant-call-sites.mjs
+++ b/config/scripts/mobile-web-app-page-grant-call-sites.mjs
@@ -84,6 +84,28 @@ function parse(source, fileName) {
   )
 }
 
+function grantReferences(source, fileName) {
+  const calls = new Set()
+  const imports = new Set()
+  const walk = (node) => {
+    if (ts.isCallExpression(node) && ts.isIdentifier(node.expression)) {
+      calls.add(node.expression.text)
+    }
+    if (ts.isImportDeclaration(node) && ts.isStringLiteral(node.moduleSpecifier)) {
+      imports.add(node.moduleSpecifier.text)
+    }
+    ts.forEachChild(node, walk)
+  }
+  walk(parse(source, fileName))
+  return { calls, imports }
+}
+
+function referencesReachRow(references, row) {
+  return row.kind === 'call'
+    ? references.calls.has(row.callee)
+    : row.kind === 'import' && references.imports.has(row.specifier)
+}
+
 /**
  * Whether this module reaches the row's seam: calls the function, or imports the substituted module.
  *
@@ -92,44 +114,36 @@ function parse(source, fileName) {
  * can never ask for it, which is the failure a hand-written list already had.
  */
 export function moduleReachesGrantRow(source, fileName, row) {
-  let reached = false
-  const walk = (node) => {
-    if (
-      row.kind === 'call' &&
-      ts.isCallExpression(node) &&
-      ts.isIdentifier(node.expression) &&
-      node.expression.text === row.callee
-    ) {
-      reached = true
-    }
-    if (
-      row.kind === 'import' &&
-      ts.isImportDeclaration(node) &&
-      ts.isStringLiteral(node.moduleSpecifier) &&
-      node.moduleSpecifier.text === row.specifier
-    ) {
-      reached = true
+  return referencesReachRow(grantReferences(source, fileName), row)
+}
+
+// One source version per file, scoped to a census; edits invalidate the parsed references.
+export function createGrantCallSiteReader() {
+  const files = new Map()
+  return (source, fileName, row) => {
+    let held = files.get(fileName)
+    if (held?.source !== source) {
+      held = { source, references: grantReferences(source, fileName) }
+      files.set(fileName, held)
     }
-    ts.forEachChild(node, walk)
+    return referencesReachRow(held.references, row)
   }
-  walk(parse(source, fileName))
-  return reached
 }
 
 /** Every module in the closure that reaches the row, the seam itself never counting as its own use. */
-export function grantCallSites(mobileDir, closure, row) {
+export function grantCallSites(mobileDir, closure, row, readModule = moduleReachesGrantRow) {
   return closure.local.filter((file) => {
     if (!/\.tsx?$/.test(file) || file === row.seam) {
       return false
     }
-    return moduleReachesGrantRow(readFileSync(join(mobileDir, file), 'utf8'), file, row)
+    return readModule(readFileSync(join(mobileDir, file), 'utf8'), file, row)
   })
 }
 
 /** Every grant this closure's own call sites need, in row order. */
-export function grantsNeeded(mobileDir, closure) {
+export function grantsNeeded(mobileDir, closure, readModule) {
   return PAGE_GRANT_CALL_SITES.filter(
-    (row) => grantCallSites(mobileDir, closure, row).length > 0
+    (row) => grantCallSites(mobileDir, closure, row, readModule).length > 0
   ).flatMap((row) => row.grants)
 }
 
@@ -141,11 +155,11 @@ export function grantsNeeded(mobileDir, closure) {
  * grant. A single whole-manifest check would red under every row at once and say only that
  * something was missing.
  */
-export async function grantsMissingForRow(mobileDir, routes, closureOf, row) {
+export async function grantsMissingForRow(mobileDir, routes, closureOf, row, readModule) {
   const missing = []
   for (const route of routes) {
     const closure = await closureOf(route.pathname)
-    if (grantCallSites(mobileDir, closure, row).length === 0) {
+    if (grantCallSites(mobileDir, closure, row, readModule).length === 0) {
       continue
     }
     for (const grant of row.grants) {
diff --git a/config/scripts/mobile-web-app-page-grant-call-sites.test.mjs b/config/scripts/mobile-web-app-page-grant-call-sites.test.mjs
index cbcf86956c7a..e70c7d49aad1 100644
--- a/config/scripts/mobile-web-app-page-grant-call-sites.test.mjs
+++ b/config/scripts/mobile-web-app-page-grant-call-sites.test.mjs
@@ -6,7 +6,8 @@
  * reddened nothing. Each row below gets its own named case, and each case's control is the same
  * rule driven over the entry that route would have had with the grant struck out.
  */
-import { readFile } from 'node:fs/promises'
+import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { fileURLToPath } from 'node:url'
 import { describe, expect, it } from 'vitest'
@@ -20,6 +21,7 @@ import { MOBILE_WEB_PAGE_ROUTES } from './mobile-web-page-routes.mjs'
 import { spelledCountsAgainstTables } from './spelled-count-census.mjs'
 import {
   PAGE_GRANT_CALL_SITES,
+  createGrantCallSiteReader,
   grantCallSites,
   grantsMissingForRow,
   grantsNeeded,
@@ -33,6 +35,7 @@ const SESSION = '/h/[hostId]/session/[worktreeId]'
 
 /** Memoised: every case below walks all eight, and a closure is a bundle the walk builds. */
 const closures = new Map()
+const readGrantModule = createGrantCallSiteReader()
 
 function closureOf(pathname) {
   const mod = PAGE_ROUTE_MODULES.get(pathname)
@@ -120,6 +123,27 @@ describe('the call-site reader', () => {
     }
   })
 
+  it('reuses parsed references across rows while observing source and row changes', async () => {
+    const directory = await mkdtemp(join(tmpdir(), 'orca-grant-reader-'))
+    const file = join(directory, 'route.tsx')
+    const readModule = createGrantCallSiteReader()
+    const closure = { local: ['route.tsx'] }
+    const source = 'export const view = <View />; useRouteHandoff()'
+    try {
+      await writeFile(file, source)
+      expect(grantCallSites(directory, closure, navigate, readModule)).toEqual(['route.tsx'])
+      expect(grantCallSites(directory, closure, storage, readModule)).toEqual([])
+      expect(readModule(source, 'route.tsx', { ...navigate, callee: 'absent' })).toBe(false)
+      await writeFile(file, 'export const view = <View />; // useRouteHandoff()')
+      expect(grantCallSites(directory, closure, navigate, readModule)).toEqual([])
+      await writeFile(file, "import storage from '@react-native-async-storage/async-storage'")
+      expect(grantCallSites(directory, closure, storage, readModule)).toEqual(['route.tsx'])
+      expect(grantCallSites(directory, closure, navigate, readModule)).toEqual([])
+    } finally {
+      await rm(directory, { recursive: true, force: true })
+    }
+  })
+
   it('counts a call and not an import that never calls it', () => {
     expect(
       moduleReachesGrantRow(
@@ -213,7 +237,13 @@ describeClosure(
       'declares %s on every registered route whose own call sites reach it',
       async (_name, row) => {
         expect(
-          await grantsMissingForRow(mobileDir, MOBILE_WEB_PAGE_ROUTES, closureOf, row)
+          await grantsMissingForRow(
+            mobileDir,
+            MOBILE_WEB_PAGE_ROUTES,
+            closureOf,
+            row,
+            readGrantModule
+          )
         ).toEqual([])
       }
     )
@@ -229,17 +259,19 @@ describeClosure(
     it.each(PAGE_GRANT_CALL_SITES.map((row) => [row.grants.join(' + '), row]))(
       'reds the session route when it is registered without %s',
       async (_name, row) => {
-        const needed = grantsNeeded(mobileDir, await closureOf(SESSION))
+        const needed = grantsNeeded(mobileDir, await closureOf(SESSION), readGrantModule)
         expect(needed, 'the session route reaches this row').toEqual(
           expect.arrayContaining(row.grants)
         )
         const entry = (grants) => [{ pathname: SESSION, grants }]
         // Declaring everything it reaches passes, so each case is a rule and not a wall.
-        expect(await grantsMissingForRow(mobileDir, entry(needed), closureOf, row)).toEqual([])
+        expect(
+          await grantsMissingForRow(mobileDir, entry(needed), closureOf, row, readGrantModule)
+        ).toEqual([])
         const without = needed.filter((grant) => !row.grants.includes(grant))
-        expect(await grantsMissingForRow(mobileDir, entry(without), closureOf, row)).toEqual(
-          row.grants.map((grant) => `${SESSION} needs ${grant}`)
-        )
+        expect(
+          await grantsMissingForRow(mobileDir, entry(without), closureOf, row, readGrantModule)
+        ).toEqual(row.grants.map((grant) => `${SESSION} needs ${grant}`))
       }
     )
 
@@ -247,12 +279,12 @@ describeClosure(
       const closure = await closureOf(SESSION)
       // The precondition an assertion about a closure needs: the walk read a page, not nothing.
       expect(closure.local.length).toBeGreaterThan(250)
-      expect(grantsNeeded(mobileDir, closure)).toEqual(
+      expect(grantsNeeded(mobileDir, closure, readGrantModule)).toEqual(
         PAGE_GRANT_CALL_SITES.flatMap((row) => row.grants)
       )
       for (const row of PAGE_GRANT_CALL_SITES) {
         expect(
-          grantCallSites(mobileDir, closure, row).length,
+          grantCallSites(mobileDir, closure, row, readGrantModule).length,
           row.grants.join(' + ')
         ).toBeGreaterThan(0)
       }
@@ -264,10 +296,10 @@ describeClosure(
       const reaching = { reader: [], media: [] }
       for (const pathname of PAGE_ROUTE_MODULES.keys()) {
         const closure = await closureOf(pathname)
-        if (grantCallSites(mobileDir, closure, readerRow).length > 0) {
+        if (grantCallSites(mobileDir, closure, readerRow, readGrantModule).length > 0) {
           reaching.reader.push(pathname)
         }
-        if (grantCallSites(mobileDir, closure, mediaRow).length > 0) {
+        if (grantCallSites(mobileDir, closure, mediaRow, readGrantModule).length > 0) {
           reaching.media.push(pathname)
         }
       }
diff --git a/config/scripts/mobile-web-app-render-harness.mjs b/config/scripts/mobile-web-app-render-harness.mjs
index ae38a2ef471d..f07e0c130a1a 100644
--- a/config/scripts/mobile-web-app-render-harness.mjs
+++ b/config/scripts/mobile-web-app-render-harness.mjs
@@ -164,9 +164,9 @@ export async function readBrowserFrameQuality() {
 }
 
 /**
- * The page's client-identity placeholder and the `init.accepts` name that unlocks it, read from
- * the module that declares both. A rig carrying its own copy would go on passing after the real
- * pair moved, which is the whole reason every other constant here is read rather than retyped.
+ * The page's client-identity placeholder, read from the module that declares it. A rig carrying its
+ * own copy would go on passing after the real one moved, which is the whole reason every other
+ * constant here is read rather than retyped.
  */
 export async function readBridgePageClientIdentity() {
   const source = await readFile(
@@ -180,10 +180,7 @@ export async function readBridgePageClientIdentity() {
     }
     return match[1]
   }
-  return {
-    placeholder: read('BRIDGE_PAGE_CLIENT_ID'),
-    accept: read('BRIDGE_PAGE_CLIENT_IDENTITY_ACCEPT')
-  }
+  return { placeholder: read('BRIDGE_PAGE_CLIENT_ID') }
 }
 
 /** The grant the shell offers every page, read from the same source for the same reason. */
@@ -264,7 +261,6 @@ export function installShellDouble({
   grants,
   pageRoutes = null,
   pageRouteGrants = null,
-  accepts = null,
   backFrame = null,
   replies,
   streams = [],
@@ -323,9 +319,6 @@ export function installShellDouble({
     // Omitted when the caller names none, which is the older-shell case the page falls back
     // on: an absent field is not an empty one, and the page reads the difference.
     ...(pageRouteGrants === null ? {} : { pageRouteGrants }),
-    // Omitted when a check names none, which is the shell that performs no swap and the
-    // state every other rig in this directory runs in.
-    ...(accepts === null ? {} : { accepts }),
     // Omitted for a shell too old to name one, which is the case the page has a panel for.
     ...(route === null ? {} : { route }),
     ...(host === null ? {} : { host }),
@@ -631,8 +624,27 @@ export function installPageErrorSentinel() {
  * say that there was something to leak before it says that nothing did.
  */
 export function installSchedulerRecorder() {
-  globalThis.__orcaScheduler = { watching: false, scheduled: [], leaked: [] }
+  globalThis.__orcaScheduler = { watching: false, scheduled: [], leaked: [], heldFrames: 0 }
   const state = globalThis.__orcaScheduler
+  const requestFrame = globalThis.requestAnimationFrame.bind(globalThis)
+  const cancelFrame = globalThis.cancelAnimationFrame.bind(globalThis)
+  const heldFrames = new Map()
+  let nextHeldFrame = -2
+  globalThis.__orcaReleaseFrames = () => {
+    state.holdFramesFrom = null
+    for (const callback of heldFrames.values()) {
+      requestFrame(callback)
+    }
+    heldFrames.clear()
+    state.heldFrames = 0
+  }
+  globalThis.cancelAnimationFrame = (id) => {
+    if (heldFrames.delete(id)) {
+      state.heldFrames--
+    } else {
+      cancelFrame(id)
+    }
+  }
   const wrap = (schedule, kind) =>
     function (callback, ...rest) {
       if (!state.watching || typeof callback !== 'function') {
@@ -646,21 +658,22 @@ export function installSchedulerRecorder() {
       // it was cancelled or is merely waiting, and cancelling never sets it.
       const entry = { kind, caller, owned: container !== null, fired: false }
       state.scheduled.push(entry)
-      return schedule(
-        (...args) => {
-          entry.fired = true
-          if (container !== null && !container.isConnected) {
-            state.leaked.push(`${kind} from ${caller}`)
-          }
-          return callback(...args)
-        },
-        ...rest
-      )
+      const recorded = (...args) => {
+        entry.fired = true
+        if (container !== null && !container.isConnected) {
+          state.leaked.push(`${kind} from ${caller}`)
+        }
+        return callback(...args)
+      }
+      if (kind === 'frame' && state.holdFramesFrom && caller.includes(state.holdFramesFrom)) {
+        const id = nextHeldFrame--
+        heldFrames.set(id, recorded)
+        state.heldFrames++
+        return id
+      }
+      return schedule(recorded, ...rest)
     }
-  globalThis.requestAnimationFrame = wrap(
-    globalThis.requestAnimationFrame.bind(globalThis),
-    'frame'
-  )
+  globalThis.requestAnimationFrame = wrap(requestFrame, 'frame')
   globalThis.setTimeout = wrap(globalThis.setTimeout.bind(globalThis), 'timer')
   globalThis.setInterval = wrap(globalThis.setInterval.bind(globalThis), 'interval')
 }
diff --git a/config/scripts/mobile-web-app-render.test.mjs b/config/scripts/mobile-web-app-render.test.mjs
index 1cd797d26007..84d3164c7cb3 100644
--- a/config/scripts/mobile-web-app-render.test.mjs
+++ b/config/scripts/mobile-web-app-render.test.mjs
@@ -135,8 +135,7 @@ async function openPage({
   shellHost = SHELL_HOST,
   shellStorage = {},
   shellGrants,
-  shellPageRoutes = null,
-  shellAccepts = null
+  shellPageRoutes = null
 } = {}) {
   const page = await browser.newPage({ viewport: { width: 390, height: 844 } })
   if (shellRoute !== undefined) {
@@ -151,8 +150,7 @@ async function openPage({
       storage: shellStorage,
       faultGrant,
       grants: shellGrants ?? [faultGrant],
-      pageRoutes: shellPageRoutes,
-      accepts: shellAccepts
+      pageRoutes: shellPageRoutes
     })
   }
   const errors = []
@@ -587,11 +585,7 @@ describeRender('the Route A page in a real browser', () => {
       })
     )
     try {
-      // The one case that advertises the report, because it is the only one asserting on it.
-      const opened = await openPage({
-        shellRoute: { pathname: HOST_ROUTE },
-        shellAccepts: [paintName]
-      })
+      const opened = await openPage({ shellRoute: { pathname: HOST_ROUTE } })
       await opened.page.goto(`${origin}/`, { waitUntil: 'load' })
       await opened.page.waitForFunction(
         () => document.documentElement.dataset.orcaWebEntry === 'mounted',
@@ -639,7 +633,6 @@ describeRender('the Route A page in a real browser', () => {
       const route = `${HOST_ROUTE}/pr/render-check-tree`
       const opened = await openPage({
         shellRoute: { pathname: route },
-        shellAccepts: [paintName],
         shellPageRoutes: [HOST_ROUTE_PATTERN, '/h/[hostId]/pr/[worktreeId]']
       })
       await opened.page.goto(`${origin}/`, { waitUntil: 'load' })
diff --git a/config/scripts/mobile-web-app-rich-markdown-render.test.mjs b/config/scripts/mobile-web-app-rich-markdown-render.test.mjs
index b9c93dbc5c94..d1133bce1437 100644
--- a/config/scripts/mobile-web-app-rich-markdown-render.test.mjs
+++ b/config/scripts/mobile-web-app-rich-markdown-render.test.mjs
@@ -583,13 +583,16 @@ describeEditor(
                 { timeout: 15_000 }
               )
             }
-            // The inserted image painted: `naturalWidth` is 0 for an element the browser refused
-            // or never fetched, which is what a policy that did not admit it would leave.
-            expect(
-              await page.evaluate(
-                () => document.querySelector('#first-surface #editor img')?.naturalWidth ?? 0
+            // Insertion precedes image loading; a refused image must still fail this paint check.
+            await expect
+              .poll(
+                () =>
+                  page.evaluate(
+                    () => document.querySelector('#first-surface #editor img')?.naturalWidth ?? 0
+                  ),
+                { timeout: 15_000 }
               )
-            ).toBeGreaterThan(0)
+              .toBeGreaterThan(0)
             expect(await page.evaluate(() => globalThis.__orcaCspViolations)).toEqual([])
             expect(consoleErrors).toEqual([])
           } finally {
diff --git a/config/scripts/mobile-web-app-route-snapshot.mjs b/config/scripts/mobile-web-app-route-snapshot.mjs
new file mode 100644
index 000000000000..248481ee0d40
--- /dev/null
+++ b/config/scripts/mobile-web-app-route-snapshot.mjs
@@ -0,0 +1,25 @@
+import { readFileSync } from 'node:fs'
+
+export function readRouteSnapshot(route, file = process.env.ORCA_MOBILE_WEB_ROUTE_SNAPSHOT) {
+  if (!file) {
+    return undefined
+  }
+  // The test runner creates this file for one immutable checkout and deletes it on exit.
+  const snapshot = JSON.parse(readFileSync(file, 'utf8'))
+  if (snapshot.version !== 1 || !Array.isArray(snapshot.routes)) {
+    throw new Error('Invalid mobile route snapshot')
+  }
+  const entry = snapshot.routes.find((item) => item.route === route)
+  if (!entry) {
+    return undefined
+  }
+  if (
+    !Array.isArray(entry.closure?.modules) ||
+    !Array.isArray(entry.closure?.local) ||
+    !entry.closure.modules.every((item) => typeof item === 'string') ||
+    !entry.closure.local.every((item) => typeof item === 'string')
+  ) {
+    throw new Error(`Invalid mobile route closure: ${route}`)
+  }
+  return entry.closure
+}
diff --git a/config/scripts/mobile-web-app-route-snapshot.test.mjs b/config/scripts/mobile-web-app-route-snapshot.test.mjs
new file mode 100644
index 000000000000..a4dc897271e0
--- /dev/null
+++ b/config/scripts/mobile-web-app-route-snapshot.test.mjs
@@ -0,0 +1,112 @@
+import { existsSync, writeFileSync } from 'node:fs'
+import { describe, expect, it } from 'vitest'
+import { readRouteSnapshot } from './mobile-web-app-route-snapshot.mjs'
+import {
+  prepareRouteSnapshot,
+  withPreparedRouteSnapshot,
+  withRouteSnapshot
+} from './run-mobile-web-app-checks.mjs'
+import { PAGE_ROUTE_MODULES } from './mobile-web-app-page-route-modules.mjs'
+
+const collect = async (entries) => ({
+  modules: [...entries, 'node_modules/react/index.js'],
+  local: entries
+})
+
+it('collects each real route once and shares isolated results for one invocation', async () => {
+  const collected = []
+  let snapshotFile
+  await withRouteSnapshot(
+    async (file) => {
+      snapshotFile = file
+      for (const route of PAGE_ROUTE_MODULES.values()) {
+        const expected = await collect(['app/_layout', 'app/h/_layout', route])
+        expect(readRouteSnapshot(route, file)).toEqual(expected)
+        readRouteSnapshot(route, file).local.length = 0
+        expect(readRouteSnapshot(route, file)).toEqual(expected)
+      }
+      expect(readRouteSnapshot('new-route', file)).toBeUndefined()
+    },
+    async (entries) => {
+      collected.push(entries[2])
+      return collect(entries)
+    }
+  )
+  expect(collected).toEqual([...new Set(PAGE_ROUTE_MODULES.values())])
+  expect(existsSync(snapshotFile)).toBe(false)
+})
+
+it('removes the snapshot after a failed suite and propagates the failure', async () => {
+  let snapshotFile
+  await expect(
+    withRouteSnapshot(async (file) => {
+      snapshotFile = file
+      throw new Error('failed assertion')
+    }, collect)
+  ).rejects.toThrow('failed assertion')
+  expect(existsSync(snapshotFile)).toBe(false)
+})
+
+it('never launches tests after dependency collection fails', async () => {
+  await expect(
+    withRouteSnapshot(
+      () => {
+        throw new Error('must not launch')
+      },
+      async () => {
+        throw new Error('unresolved import')
+      }
+    )
+  ).rejects.toThrow('unresolved import')
+})
+
+describe('snapshot validation', () => {
+  it('leaves ordinary builds and scratch routes uncached', () => {
+    expect(readRouteSnapshot('any', '')).toBeUndefined()
+  })
+  it.each(['{}', '{', '{"version":1,"routes":[{"route":"bad","closure":{}}]}'])(
+    'rejects damaged snapshots: %s',
+    async (bytes) => {
+      await withRouteSnapshot(async (file) => {
+        writeFileSync(file, bytes)
+        expect(() => readRouteSnapshot('bad', file)).toThrow()
+      }, collect)
+    }
+  )
+})
+
+it('consumes a separately prepared snapshot and removes it after success', async () => {
+  await withRouteSnapshot(async (file) => {
+    const result = await withPreparedRouteSnapshot(file, async (prepared) => {
+      expect(prepared).toBe(file)
+      return 'verified'
+    })
+    expect(result).toBe('verified')
+    expect(existsSync(file)).toBe(false)
+  }, collect)
+})
+
+it('rejects incomplete prepared snapshots before launching tests', async () => {
+  await withRouteSnapshot(async (file) => {
+    writeFileSync(file, JSON.stringify({ version: 1, routes: [] }))
+    let launched = false
+    await expect(
+      withPreparedRouteSnapshot(file, async () => {
+        launched = true
+      })
+    ).rejects.toThrow('missing')
+    expect(launched).toBe(false)
+    expect(existsSync(file)).toBe(false)
+  }, collect)
+})
+
+it('removes previous evidence before a failed preparation', async () => {
+  await withRouteSnapshot(async (file) => {
+    await expect(
+      prepareRouteSnapshot(file, async () => {
+        throw new Error('unresolved import')
+      })
+    ).rejects.toThrow('unresolved import')
+    expect(existsSync(file)).toBe(false)
+  }, collect)
+})
diff --git a/config/scripts/mobile-web-app-session-terminal-init.test.mjs b/config/scripts/mobile-web-app-session-terminal-init.test.mjs
index 199c0f15f799..2d46fdb15c81 100644
--- a/config/scripts/mobile-web-app-session-terminal-init.test.mjs
+++ b/config/scripts/mobile-web-app-session-terminal-init.test.mjs
@@ -148,8 +148,6 @@ async function openSessionWithTerminalTab() {
     faultGrant,
     grants: [faultGrant, ...sessionGrants()],
     pageRoutes: PAGE_ROUTE_PATTERNS,
-    // The page claims an identity only against a shell that says it swaps one in.
-    accepts: [pageClientIdentity.accept],
     streams: ['session.tabs.subscribe', 'terminal.subscribe'],
     replies: {
       'worktree.show': { worktree: { id: WORKTREE, name: WORKTREE, path: `/tmp/${WORKTREE}` } },
@@ -257,8 +255,17 @@ describeRender(
       // `.xterm-screen` does: it is created by `term.open()`, which only ever runs from the
       // document's `init`. The emulator run had the surface with zero children inside a correctly
       // sized container, which is this element missing.
+      // Then the grid readable: xterm sizes its one-cell helper textarea only on a cursor move or
+      // resize, so a read the moment the screen exists can land before the replay has drained.
       await page.waitForFunction(
-        () => document.querySelector('.xterm-screen') !== null,
+        () => {
+          const cell = document.querySelector('#terminal-surface .xterm-helper-textarea')
+          return (
+            document.querySelector('.xterm-screen') !== null &&
+            cell !== null &&
+            cell.getBoundingClientRect().width > 0
+          )
+        },
         undefined,
         {
           timeout: 60_000,
diff --git a/config/scripts/mobile-web-app-terminal-live-input-render.test.mjs b/config/scripts/mobile-web-app-terminal-live-input-render.test.mjs
index 210e828af8fb..b1821fd0683e 100644
--- a/config/scripts/mobile-web-app-terminal-live-input-render.test.mjs
+++ b/config/scripts/mobile-web-app-terminal-live-input-render.test.mjs
@@ -112,8 +112,11 @@ afterAll(async () => {
  * Settled is "the probe registered" or "the page reported a fault", because those are the two
  * outcomes and waiting only for the first turns the defect into a 60s timeout that names nothing.
  */
-async function openProbe() {
-  const page = await browser.newPage({ viewport: { width: 390, height: 844 } })
+async function openProbe({ userAgent } = {}) {
+  const page = await browser.newPage({
+    viewport: { width: 390, height: 844 },
+    ...(userAgent ? { userAgent } : {})
+  })
   await page.addInitScript(installShellDouble, {
     version: bridgeVersion,
     sessionId: 'live-input-session',
@@ -322,6 +325,104 @@ describeRender(
       await page.close()
     }, 300_000)
 
+    describe('under an Android keyboard, which composes every word it types', () => {
+      // The OTA shell's WebView. Its keyboards hold a composing region over the Latin word being
+      // typed, so every input event mid-word says `isComposing: true`; native Android reports no
+      // range at all, and there each ASCII keystroke reaches the terminal as it is typed.
+      const ANDROID_WEBVIEW_USER_AGENT =
+        'Mozilla/5.0 (Linux; Android 16; Pixel 9 Pro Build/BP2A; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/140.0.0.0 Mobile Safari/537.36'
+      const sent = (page) => page.evaluate(() => globalThis.__orcaLiveInputProbe.sent())
+
+      /** One composition step through the browser's own IME path, which fires the DOM composition events. */
+      async function compose(input, text) {
+        await input.send('Input.imeSetComposition', {
+          text,
+          selectionStart: text.length,
+          selectionEnd: text.length
+        })
+      }
+
+      async function waitForField(page, value) {
+        await page.waitForFunction(
+          ([id, expected]) => document.getElementById(id)?.value === expected,
+          [LIVE_INPUT_FIELD_ID, value],
+          { timeout: 30_000, polling: 50 }
+        )
+      }
+
+      it('sends each letter of a composed word after a slash as it is typed', async () => {
+        // The reported shape: `/tui` in a Codex terminal, where the `/` arrived and `tui` did not
+        // until Enter. The keyboard commits `/` outright and opens a composition for the letters.
+        const { errors, page } = await openProbe({ userAgent: ANDROID_WEBVIEW_USER_AGENT })
+        await page.focus(`#${LIVE_INPUT_FIELD_ID}`)
+        const input = await page.context().newCDPSession(page)
+        await page.keyboard.type('/')
+        await waitForField(page, '/')
+
+        const afterEachStep = []
+        for (const text of ['t', 'tu', 'tui']) {
+          await compose(input, text)
+          await waitForField(page, `/${text}`)
+          afterEachStep.push(await sent(page))
+        }
+        await input.send('Input.insertText', { text: 'tui' })
+        await waitForField(page, '/tui')
+
+        expect(afterEachStep).toEqual([
+          ['/', 't'],
+          ['/', 't', 'u'],
+          ['/', 't', 'u', 'i']
+        ])
+        expect(await sent(page)).toEqual(['/', 't', 'u', 'i'])
+        expect(errors).toEqual([])
+        await page.close()
+      }, 300_000)
+
+      it('erases and retypes a word the keyboard corrects when it commits', async () => {
+        const { errors, page } = await openProbe({ userAgent: ANDROID_WEBVIEW_USER_AGENT })
+        await page.focus(`#${LIVE_INPUT_FIELD_ID}`)
+        const input = await page.context().newCDPSession(page)
+        for (const text of ['t', 'te', 'teh']) {
+          await compose(input, text)
+          await waitForField(page, text)
+        }
+
+        await input.send('Input.insertText', { text: 'the' })
+        await waitForField(page, 'the')
+
+        await page.waitForFunction(
+          () => globalThis.__orcaLiveInputProbe.sent().length === 4,
+          undefined,
+          {
+            timeout: 30_000,
+            polling: 50
+          }
+        )
+        expect(await sent(page)).toEqual(['t', 'e', 'h', '\u007f\u007fhe'])
+        expect(errors).toEqual([])
+        await page.close()
+      }, 300_000)
+
+      it("still holds a composition off Android, where it is the text system's marked text", async () => {
+        // The guard: an iOS WebView composes only what native iOS marks, pinyin before conversion
+        // among it, and that is not text yet on either side of the bridge.
+        const { errors, page } = await openProbe({
+          userAgent:
+            'Mozilla/5.0 (iPhone; CPU iPhone OS 19_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148'
+        })
+        await page.focus(`#${LIVE_INPUT_FIELD_ID}`)
+        const input = await page.context().newCDPSession(page)
+        for (const text of ['n', 'ni']) {
+          await compose(input, text)
+          await waitForField(page, text)
+        }
+
+        expect(await sent(page)).toEqual([])
+        expect(errors).toEqual([])
+        await page.close()
+      }, 300_000)
+    })
+
     describe('in buffered mode, where the field holds the draft until Enter', () => {
       const bufferedValue = (page) =>
         page.evaluate((id) => document.getElementById(id)?.value ?? null, BUFFERED_FIELD_ID)
diff --git a/config/scripts/mobile-web-app-terminal-probe-route.mjs b/config/scripts/mobile-web-app-terminal-probe-route.mjs
index 5572fc976974..799969745455 100644
--- a/config/scripts/mobile-web-app-terminal-probe-route.mjs
+++ b/config/scripts/mobile-web-app-terminal-probe-route.mjs
@@ -57,6 +57,8 @@ import { TerminalWebView } from ${JSON.stringify(componentPath)}
 
 export default function TerminalProbeRoute() {
   const handleRef = useRef(null)
+  // The terminal frame as React Native laid it out, which is what the session fits.
+  const frameRef = useRef({ width: 0, height: 0 })
   const [mounted, setMounted] = useState(true)
   const onSelectionCopy = useCallback((text) => {
     globalThis.__orcaTerminalCopied = text
@@ -71,13 +73,12 @@ export default function TerminalProbeRoute() {
     globalThis.__orcaTerminalEngineErrors = globalThis.__orcaTerminalEngineErrors ?? []
     globalThis.__orcaTerminalBeforeInput = []
     globalThis.__orcaTerminalProbe = {
-      init: (cols, rows, data) => handleRef.current?.init(cols, rows, data, false, []),
+      init: (cols, rows, initialData) =>
+        handleRef.current?.init({ cols, rows, initialData, oscLinks: [], frame: frameRef.current }),
       write: (data) => handleRef.current?.write(data),
       selectAll: () => handleRef.current?.doSelectAll(),
-      measure: () => handleRef.current?.measureFitDimensions(),
+      fit: () => handleRef.current?.fitDimensions(frameRef.current),
       awaitReady: () => handleRef.current?.awaitReady(),
-      // The handle itself, for a caller that has to keep it past the unmount that drops the ref.
-      handle: () => handleRef.current,
       setMounted: (next) => setMounted(next)
     }
     const onBeforeInput = (event) => {
@@ -92,14 +93,21 @@ export default function TerminalProbeRoute() {
   }, [])
   return (
     <View testID="terminal-probe" style={{ flex: 1 }}>
-      {mounted ? (
-        <TerminalWebView
-          ref={handleRef}
-          onWebReady={onWebReady}
-          onEngineError={onEngineError}
-          onSelectionCopy={onSelectionCopy}
-        />
-      ) : null}
+      <View
+        style={{ flex: 1 }}
+        onLayout={(event) => {
+          frameRef.current = event.nativeEvent.layout
+        }}
+      >
+        {mounted ? (
+          <TerminalWebView
+            ref={handleRef}
+            onWebReady={onWebReady}
+            onEngineError={onEngineError}
+            onSelectionCopy={onSelectionCopy}
+          />
+        ) : null}
+      </View>
       {/* The shape the terminal's live input takes on the page: xterm's own textarea is inert by
           the document's design, so this is where typed text arrives. */}
       <TextInput testID="terminal-live-input" style={{ fontSize: 16 }} />
diff --git a/config/scripts/mobile-web-app-terminal-render.test.mjs b/config/scripts/mobile-web-app-terminal-render.test.mjs
index 9b19ea4bb9be..4a08bcece531 100644
--- a/config/scripts/mobile-web-app-terminal-render.test.mjs
+++ b/config/scripts/mobile-web-app-terminal-render.test.mjs
@@ -452,119 +452,123 @@ describeRender(
       await page.close()
     }, 300_000)
 
-    it('takes back the frames it is owed, not only the timers', async () => {
-      // The timer case above is witnessed by a 550 ms timeout, which every module's own stop
-      // cancels by the handle the scope holds. A frame is the other shape: `applyFitScale` asks
-      // for one through the scope's registry and never holds its id, so `stopFitScale` can only
-      // bump the token it tests itself against — the frame still runs. Nothing but
-      // `cancelDocumentFrames` takes it back.
-      //
-      // Two things have to be pinned down for that to be readable, and the first version of this
-      // case had neither.
-      //
-      // The witness has to be owed whenever the dispose lands. A single refit is not: the retry
-      // loop commits on its first attempt whenever the grid still measures, so one resize buys
-      // one frame and a dispose after it owes nothing — which agrees with an empty leak list for
-      // exactly the reason under test, once in five runs. So the fit is asked for again from a
-      // frame of the test's own, which leaves the document owed a frame at the end of every frame
-      // the browser serves, and dispose cannot land inside one.
-      //
-      // Through the held handle, not a host resize: the box-driven refit skips an already-fitted
-      // box and a detached host has none, so neither reliably leaves a frame owed at dispose.
-      //
-      // And the leak has to be counted from the moment dispose returned, not from the moment the
-      // host element left the DOM. React unmounts in two steps: the mutation phase detaches the
-      // host, and the passive cleanup that calls `dispose` runs after it — 1 ms apart here, 20 to
-      // 35 ms apart with the CPU throttled 20x, which is the CI runner this failed on. A frame
-      // served in that gap runs with a detached container while the document is still live and
-      // has not been asked to stop, and no registry could take it back. It went through
-      // `scheduleDocumentFrame` like every other; the old oracle called it a leak because it
-      // judged by the container rather than by dispose. Only what runs after the last statement
-      // of `dispose` is the document keeping something it gave up; the frames owed at dispose are
-      // also checked directly, since one asked for in that gap has no container to judge by.
-      let documentChunk = null
-      const { page } = await openPage(PROBE_ROUTE, {
-        scheduler: true,
-        beforeNavigate: async (opened) => {
-          await opened.route('**/*.js', async (route) => {
-            const response = await route.fetch()
-            const body = await response.text()
-            if (body.includes('terminal runtime error')) {
-              documentChunk = new URL(route.request().url()).pathname
-            }
-            await route.fulfill({ response, body })
-          })
-        }
-      })
-      await page.waitForFunction(() => globalThis.__orcaTerminalReady === true, {
-        timeout: 60_000,
-        polling: 100
-      })
-      await openProbeTerminal(page)
-      expect(documentChunk, 'the document was served as its own chunk').not.toBe(null)
-
-      await page.evaluate((chunk) => {
-        const state = globalThis.__orcaScheduler
-        state.disposed = null
-        state.watching = true
-        // `dispose` empties the host and drops its class last, after `cancelDocumentFrames`, so
-        // the class going is the moment it returned. Observed on the element rather than on the
-        // tree because React may have detached it already.
-        const host = document.querySelector('.orca-terminal-document-host')
-        const observer = new MutationObserver(() => {
-          if (state.disposed !== null || host.classList.contains('orca-terminal-document-host')) {
-            return
-          }
-          state.disposed = {
-            // A cancelled frame never runs, so it is still owed here. That is the point.
-            owed: state.scheduled.flatMap((entry, at) =>
-              entry.kind === 'frame' && !entry.fired && entry.caller.includes(chunk) ? [at] : []
-            ),
-            leakedBefore: state.leaked.length
+    it.each([
+      { name: 'takes back the frames it is owed, not only the timers', cancelFrames: true },
+      { name: 'detects leaked frames when disposal cannot cancel them', cancelFrames: false }
+    ])(
+      '$name',
+      async ({ cancelFrames }) => {
+        // Hold a real refit frame across disposal; ResizeObserver delivery cannot race the witness.
+        let documentChunk = null
+        const { page } = await openPage(PROBE_ROUTE, {
+          scheduler: true,
+          beforeNavigate: async (opened) => {
+            await opened.route('**/*.js', async (route) => {
+              const response = await route.fetch()
+              const body = await response.text()
+              if (body.includes('terminal runtime error')) {
+                documentChunk = new URL(route.request().url()).pathname
+              }
+              await route.fulfill({ response, body })
+            })
           }
-          observer.disconnect()
         })
-        observer.observe(host, { attributes: true, attributeFilter: ['class'] })
-        const handle = globalThis.__orcaTerminalProbe.handle()
-        const pulse = () => {
-          if (state.disposed !== null) {
-            return
+        try {
+          await page.waitForFunction(() => globalThis.__orcaTerminalReady === true, {
+            timeout: 60_000,
+            polling: 100
+          })
+          await openProbeTerminal(page)
+          expect(documentChunk, 'the document was served as its own chunk').not.toBe(null)
+          // Ready is notified with the replay's fit still a frame away. Left pending, that fit
+          // commits the resized box below, the resize refit then has nothing to do, and there is no
+          // frame to hold; so the document settles first. Since the terminal is built before
+          // ready, the fixture returns fast enough to land inside that frame.
+          await page.evaluate(
+            () =>
+              new Promise((resolve) => requestAnimationFrame(() => requestAnimationFrame(resolve)))
+          )
+
+          await page.evaluate((chunk) => {
+            const state = globalThis.__orcaScheduler
+            state.disposed = null
+            state.watching = true
+            state.holdFramesFrom = chunk
+            const host = document.querySelector('.orca-terminal-document-host')
+            // Dispose drops this class after cancelling frames; DOM detachment precedes cleanup.
+            const observer = new MutationObserver(() => {
+              if (
+                state.disposed !== null ||
+                host.classList.contains('orca-terminal-document-host')
+              ) {
+                return
+              }
+              state.disposed = {
+                owed: state.scheduled.filter(
+                  (entry) => entry.kind === 'frame' && !entry.fired && entry.caller.includes(chunk)
+                ).length,
+                leakedBefore: state.leaked.length
+              }
+              observer.disconnect()
+            })
+            observer.observe(host, { attributes: true, attributeFilter: ['class'] })
+            host.style.width = '80%'
+          }, documentChunk)
+          await page.waitForFunction(() => globalThis.__orcaScheduler.heldFrames > 0, undefined, {
+            timeout: 30_000
+          })
+          await page.evaluate((cancelFrames) => {
+            globalThis.__orcaRestoreFrameCancellation = globalThis.cancelAnimationFrame
+            if (!cancelFrames) {
+              // The negative control must expose held callbacks after the real document disposes.
+              globalThis.cancelAnimationFrame = () => {}
+            }
+            globalThis.__orcaTerminalProbe.setMounted(false)
+          }, cancelFrames)
+          await page.locator('#terminal-container').waitFor({ state: 'detached', timeout: 30_000 })
+          await page.waitForFunction(() => globalThis.__orcaScheduler.disposed !== null)
+          await page.evaluate(() => {
+            globalThis.cancelAnimationFrame = globalThis.__orcaRestoreFrameCancellation
+            globalThis.__orcaScheduler.holdFramesFrom = null
+            globalThis.__orcaTerminalReady = false
+            globalThis.__orcaTerminalProbe.setMounted(true)
+          })
+          await page.waitForFunction(() => globalThis.__orcaTerminalReady === true, {
+            timeout: 60_000,
+            polling: 100
+          })
+          await openProbeTerminal(page)
+          // Uncancelled work must actually run against the replacement, so the hold cannot hide leaks.
+          await page.evaluate(
+            () =>
+              new Promise((resolve) => {
+                globalThis.__orcaReleaseFrames()
+                requestAnimationFrame(() => requestAnimationFrame(resolve))
+              })
+          )
+
+          const scheduler = await page.evaluate(() => globalThis.__orcaScheduler)
+          expect(
+            scheduler.disposed?.owed,
+            'the document owed a frame at the moment dispose returned'
+          ).toBeGreaterThan(0)
+          const leakedFrames = scheduler.leaked
+            .slice(scheduler.disposed.leakedBefore)
+            .filter((entry) => entry.startsWith('frame ') && entry.includes(documentChunk))
+          if (cancelFrames) {
+            expect(leakedFrames).toEqual([])
+          } else {
+            expect(
+              leakedFrames.length,
+              'the recorder must expose uncancelled work'
+            ).toBeGreaterThan(0)
           }
-          // Asked for before the next pulse is, so the fit's frame runs first in every frame and
-          // this one leaves another owed behind it.
-          handle.resetZoom()
-          requestAnimationFrame(pulse)
+        } finally {
+          await page.unrouteAll({ behavior: 'ignoreErrors' }).finally(() => page.close())
         }
-        requestAnimationFrame(pulse)
-        globalThis.setTimeout(() => globalThis.__orcaTerminalProbe.setMounted(false), 200)
-      }, documentChunk)
-      await page.locator('#terminal-container').waitFor({ state: 'detached', timeout: 30_000 })
-      await page.evaluate(() => {
-        globalThis.__orcaTerminalReady = false
-        globalThis.__orcaTerminalProbe.setMounted(true)
-      })
-      await page.waitForFunction(() => globalThis.__orcaTerminalReady === true, {
-        timeout: 60_000,
-        polling: 100
-      })
-      await openProbeTerminal(page)
-      await page.evaluate(() => new Promise((resolve) => globalThis.setTimeout(resolve, 3000)))
-
-      const scheduler = await page.evaluate(() => globalThis.__orcaScheduler)
-      expect(
-        scheduler.disposed?.owed.length,
-        'the document owed a frame at the moment dispose returned'
-      ).toBeGreaterThan(0)
-      // None of them ran, even one asked for after the detach, which the list below cannot see.
-      expect(scheduler.disposed.owed.filter((at) => scheduler.scheduled[at].fired)).toEqual([])
-      expect(
-        scheduler.leaked
-          .slice(scheduler.disposed.leakedBefore)
-          .filter((entry) => entry.startsWith('frame ') && entry.includes(documentChunk))
-      ).toEqual([])
-      await page.unrouteAll({ behavior: 'ignoreErrors' })
-      await page.close()
-    }, 300_000)
+      },
+      300_000
+    )
 
     it('styles what it owns, and only that', async () => {
       // The document's sheet says `*`, `html` and `body` because inside a WebView it owns the
@@ -631,14 +635,14 @@ describeRender(
       await page.close()
     }, 300_000)
 
-    it('measures a fit through the handle and records what beforeinput reports', async () => {
+    it('fits through the handle from the ready box and records what beforeinput reports', async () => {
       const { page } = await openTerminal()
       await openProbeTerminal(page)
 
-      // The handle's own round trip: a measure is a command in and a notify back, and on the page
-      // both halves are direct calls rather than a bridge. Null would mean the document answered
-      // nothing, or answered a grid too small to fit.
-      const fit = await page.evaluate(() => globalThis.__orcaTerminalProbe.measure())
+      // The fit is the app's own, from the cell box the document put in web-ready, against the
+      // frame React Native laid out, as the session's is. Null would mean the ready carried no box,
+      // or a grid too small to fit.
+      const fit = await page.evaluate(() => globalThis.__orcaTerminalProbe.fit())
       expect(fit).not.toBeNull()
       expect(fit.cols).toBeGreaterThanOrEqual(20)
       expect(fit.rows).toBeGreaterThanOrEqual(8)
diff --git a/config/scripts/mobile-web-bundle-manifest.mjs b/config/scripts/mobile-web-bundle-manifest.mjs
index b7efce25ca0e..2e9888f69c79 100644
--- a/config/scripts/mobile-web-bundle-manifest.mjs
+++ b/config/scripts/mobile-web-bundle-manifest.mjs
@@ -68,12 +68,10 @@ export function hashedAsset(bytes, extension) {
   }
 }
 
-function readIntegerConstant(source, name) {
+function readIntegerConstant(source, name, file = 'src/shared/protocol-version.ts') {
   const match = new RegExp(`export const ${name} = (\\d+)`).exec(source)
   if (!match) {
-    throw new Error(
-      `[mobile-web-bundle-manifest] ${name} not found in src/shared/protocol-version.ts`
-    )
+    throw new Error(`[mobile-web-bundle-manifest] ${name} not found in ${file}`)
   }
   return Number.parseInt(match[1], 10)
 }
@@ -94,6 +92,13 @@ export async function readProtocolWindow() {
   }
 }
 
+/** The page's build number, parsed for the same reason the protocol window is. */
+export async function readPageVersion() {
+  const file = join('src', 'shared', 'mobile-web-bundle', 'manifest-contract.ts')
+  const source = await readFile(join(projectDir, file), 'utf8')
+  return readIntegerConstant(source, 'MOBILE_WEB_PAGE_VERSION', file)
+}
+
 export async function readDesktopVersion() {
   const packageJson = JSON.parse(await readFile(join(projectDir, 'package.json'), 'utf8'))
   if (typeof packageJson.version !== 'string' || packageJson.version.length === 0) {
@@ -124,6 +129,7 @@ export async function writeMobileWebBundleTree({
     desktopVersion,
     minCompatibleRuntimeProtocolVersion: protocolWindow.minCompatibleRuntimeProtocolVersion,
     runtimeProtocolVersion: protocolWindow.runtimeProtocolVersion,
+    pageVersion: await readPageVersion(),
     entrypoint: MOBILE_WEB_BUNDLE_ENTRYPOINT,
     totalBytes: assets.reduce((total, asset) => total + asset.byteLength, 0),
     assets,
diff --git a/config/scripts/mobile-web-bundle-manifest.test.mjs b/config/scripts/mobile-web-bundle-manifest.test.mjs
index 3c4d35fd8a7f..81c447878a8a 100644
--- a/config/scripts/mobile-web-bundle-manifest.test.mjs
+++ b/config/scripts/mobile-web-bundle-manifest.test.mjs
@@ -1,10 +1,16 @@
+import { mkdtemp, readFile, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
 import { describe, expect, it } from 'vitest'
 import {
   computeMobileWebBundleBuildId,
   contentTypeForExtension,
   hashedAsset,
-  serializeMobileWebBundleAssets
+  serializeMobileWebBundleAssets,
+  sha256Hex,
+  writeMobileWebBundleTree
 } from './mobile-web-bundle-manifest.mjs'
+import { MobileWebBundleManifestSchema } from '../../src/shared/mobile-web-bundle/manifest-contract.js'
 
 describe('computeMobileWebBundleBuildId', () => {
   const assets = [
@@ -55,3 +61,30 @@ describe('hashedAsset', () => {
     expect(() => hashedAsset(Buffer.from('body'), 'wasm')).toThrow(/no content type registered/)
   })
 })
+
+describe('writeMobileWebBundleTree', () => {
+  it('stamps the page version the contract names, which the shell floors on', async () => {
+    const outDir = await mkdtemp(join(tmpdir(), 'mobile-web-bundle-manifest-'))
+    try {
+      const bytes = Buffer.from('<!doctype html>\n', 'utf8')
+      const entry = {
+        path: 'index.html',
+        bytes,
+        sha256: sha256Hex(bytes),
+        byteLength: bytes.byteLength,
+        contentType: contentTypeForExtension('html')
+      }
+      await writeMobileWebBundleTree({
+        outDir,
+        written: [entry],
+        desktopVersion: '1.0.0',
+        protocolWindow: { runtimeProtocolVersion: 3, minCompatibleRuntimeProtocolVersion: 3 }
+      })
+      const manifest = JSON.parse(await readFile(join(outDir, 'manifest.json'), 'utf8'))
+      expect(Number.isInteger(manifest.pageVersion)).toBe(true)
+      expect(MobileWebBundleManifestSchema.parse(manifest).pageVersion).toBe(manifest.pageVersion)
+    } finally {
+      await rm(outDir, { recursive: true, force: true })
+    }
+  })
+})
diff --git a/config/scripts/nsis-process-check.test.mjs b/config/scripts/nsis-process-check.test.mjs
new file mode 100644
index 000000000000..c469ffbc529b
--- /dev/null
+++ b/config/scripts/nsis-process-check.test.mjs
@@ -0,0 +1,124 @@
+import { readFileSync } from 'node:fs'
+import { createRequire } from 'node:module'
+import { dirname, join } from 'node:path'
+import { describe, expect, it } from 'vitest'
+import { runProcessSync } from '../../src/shared/child-process/run-process'
+
+const hooks = readFileSync(new URL('../nsis/orca-installer-hooks.nsh', import.meta.url), 'utf8')
+const processCheck = readFileSync(
+  new URL('../nsis/orca-process-check.nsh', import.meta.url),
+  'utf8'
+)
+const require = createRequire(import.meta.url)
+const builderRequire = createRequire(require.resolve('electron-builder/package.json'))
+const upstreamChecks = readFileSync(
+  join(
+    dirname(builderRequire.resolve('app-builder-lib/package.json')),
+    'templates/nsis/include/allowOnlyOneInstallerInstance.nsh'
+  ),
+  'utf8'
+)
+
+function readPowerShellProbe(source = processCheck) {
+  const match = source.match(/nsExec::Exec `"\$PowerShellPath"(.*?) -(?:C|Command) "([^"\n]+)"`/)
+  if (!match) {
+    throw new Error('The NSIS PowerShell invocation was not found')
+  }
+  return { args: match[1].trim().split(/\s+/).filter(Boolean), command: match[2] }
+}
+
+describe('NSIS process-check integration', () => {
+  it('loads the capability hook through the installer and uninstaller include', () => {
+    expect(hooks).toContain('!include "${__FILEDIR__}\\orca-process-check.nsh"')
+    expect(processCheck).toMatch(/!macro customCheckAppRunning\b/)
+    expect(processCheck).toContain('!include "getProcessInfo.nsh"')
+    expect(processCheck).toMatch(/^Var pid$/m)
+    expect(processCheck).toMatch(/^Var \/GLOBAL IsPowerShellAvailable$/m)
+  })
+
+  it('keeps upstream process selection, retries, and installation-mode handling', () => {
+    expect(processCheck).toContain('!insertmacro _CHECK_APP_RUNNING')
+    expect(processCheck).not.toMatch(/!macro (?:FIND_PROCESS|KILL_PROCESS|_CHECK_APP_RUNNING)\b/)
+    expect(processCheck).not.toMatch(/\b(?:Stop-Process|taskkill|Set-ExecutionPolicy)\b/)
+    const findProcess = upstreamChecks.match(/!macro FIND_PROCESS\b[\s\S]*?!macroend/)?.[0]
+    if (!findProcess) {
+      throw new Error('The upstream process finder was not found')
+    }
+    expect(readPowerShellProbe().args).toEqual(readPowerShellProbe(findProcess).args)
+  })
+})
+
+describe.runIf(process.platform === 'win32')(
+  'NSIS capability probe under Restricted policy',
+  () => {
+    const policyReceipt = 'orca-nsis: restricted policy verified'
+    const queryFailureReceipt = 'orca-nsis: injected query failure'
+    const policyCheck = [
+      'function Test-OrcaRestrictedPolicy { param([string]$Scope)',
+      "try { $parameters = @{ ErrorAction = 'Stop' };",
+      'if ($Scope) { $parameters.Scope = $Scope };',
+      "return ((Get-ExecutionPolicy @parameters) -eq 'Restricted')",
+      '} catch { return $false } };',
+      // A failed getter must not fall through to the query's successful exit.
+      "if ((Test-OrcaRestrictedPolicy '__orca_invalid_scope__') -ne $false) { exit 11 };",
+      "if ((Test-OrcaRestrictedPolicy 'Process') -ne $true) { exit 10 };",
+      'if ((Test-OrcaRestrictedPolicy) -ne $true) { exit 10 };',
+      `[Console]::Out.WriteLine('${policyReceipt}');`
+    ].join(' ')
+
+    // A watchdog against a wedged probe, not a latency budget: Windows PowerShell 5.1
+    // cold start under the packaged-CI process load has reached the former 20s cap. Matches
+    // the synchronous-probe ceiling in tests/tools/win-update-e2e/powershell-runner.mjs.
+    const PROBE_TIMEOUT_MS = 60_000
+    // Vitest's 30s default would otherwise cap the blocking spawn ahead of PROBE_TIMEOUT_MS.
+    const PROBE_TEST_TIMEOUT_MS = PROBE_TIMEOUT_MS + 15_000
+
+    function runProbe(arch, prefix = '') {
+      const { args, command } = readPowerShellProbe()
+      if (!process.env.SystemRoot) {
+        throw new Error('SystemRoot is required on Windows')
+      }
+      // The pwsh runner's module path points Windows PowerShell at incompatible PS7 modules.
+      const env = Object.fromEntries(
+        Object.entries(process.env).filter(([key]) => key.toLowerCase() !== 'psmodulepath')
+      )
+      return runProcessSync({
+        program: join(process.env.SystemRoot, arch, 'WindowsPowerShell', 'v1.0', 'powershell.exe'),
+        args: [...args, '-Command', `${policyCheck} ${prefix}${command}`],
+        env: {
+          ...env,
+          ORCA_BACKGROUND_LAUNCH: '1',
+          PSExecutionPolicyPreference: 'Restricted'
+        },
+        timeoutMs: PROBE_TIMEOUT_MS
+      })
+    }
+
+    it.each(['SysWOW64', 'System32'])(
+      '%s permits the real inline process query',
+      { timeout: PROBE_TEST_TIMEOUT_MS },
+      (arch) => {
+        const result = runProbe(arch)
+        expect(result.code, JSON.stringify(result)).toBe(0)
+        expect(result.timedOut).toBe(false)
+        expect(result.stdout).toContain(policyReceipt)
+      }
+    )
+
+    it.each(['SysWOW64', 'System32'])(
+      '%s rejects a failed process query',
+      { timeout: PROBE_TEST_TIMEOUT_MS },
+      (arch) => {
+        const result = runProbe(
+          arch,
+          'function Get-CimInstance { [CmdletBinding()] param([string]$ClassName); ' +
+            `[Console]::Out.WriteLine('${queryFailureReceipt}'); Write-Error 'CIM unavailable' }; `
+        )
+        expect(result.code, JSON.stringify(result)).toBe(1)
+        expect(result.timedOut).toBe(false)
+        expect(result.stdout).toContain(policyReceipt)
+        expect(result.stdout).toContain(queryFailureReceipt)
+      }
+    )
+  }
+)
diff --git a/config/scripts/orcad-artifact-version.mjs b/config/scripts/orcad-artifact-version.mjs
index ef85540bbaa5..e7f2284f59fe 100644
--- a/config/scripts/orcad-artifact-version.mjs
+++ b/config/scripts/orcad-artifact-version.mjs
@@ -1,11 +1,15 @@
 import { createHash } from 'node:crypto'
 import { existsSync, readFileSync } from 'node:fs'
 import { join } from 'node:path'
-import { ORCAD_VERSION, orcadArtifactFilenames } from '../../src/shared/orcad-artifacts.ts'
+import {
+  ORCAD_VERSION,
+  orcadArtifactFilenames,
+  orcadArtifactHashPrefix
+} from '../../src/shared/orcad-artifacts.ts'
 
-export function computeOrcadFullVersion(artifactDir) {
-  const hash = createHash('sha256')
-  for (const filename of orcadArtifactFilenames()) {
+export function computeOrcadFullVersion(artifactDir, { target = '', agentBrowserFilename } = {}) {
+  const hash = createHash('sha256').update(orcadArtifactHashPrefix(target))
+  for (const filename of orcadArtifactFilenames(target)) {
     const artifactPath = join(artifactDir, filename)
     if (!existsSync(artifactPath)) {
       throw new Error(
@@ -15,5 +19,8 @@ export function computeOrcadFullVersion(artifactDir) {
     }
     hash.update(readFileSync(artifactPath))
   }
+  if (agentBrowserFilename && existsSync(join(artifactDir, agentBrowserFilename))) {
+    hash.update(readFileSync(join(artifactDir, agentBrowserFilename)))
+  }
   return `${ORCAD_VERSION}+${hash.digest('hex').slice(0, 12)}`
 }
diff --git a/config/scripts/orcad-artifact-version.test.mjs b/config/scripts/orcad-artifact-version.test.mjs
index a6d316b7f41c..01c1ae3f8ff8 100644
--- a/config/scripts/orcad-artifact-version.test.mjs
+++ b/config/scripts/orcad-artifact-version.test.mjs
@@ -1,30 +1,67 @@
 import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { dirname, join } from 'node:path'
-import { describe, expect, it } from 'vitest'
+import { afterEach, describe, expect, it } from 'vitest'
 import {
+  ORCAD_BUILD_TARGET_FILENAME,
   ORCAD_RIPGREP_ARTIFACTS,
   orcadArtifactFilenames
 } from '../../src/shared/orcad-artifacts.ts'
+import { ORCAD_BUN_TARGETS } from '../../src/shared/orcad-bun-runtime.ts'
+import { orcadAgentBrowserNativeName } from '../../src/shared/orcad-agent-browser-name.ts'
+import { readOrcadArtifactIdentity } from '../../src/main/orcad/orcad-artifact-identity.ts'
 import { computeOrcadFullVersion } from './orcad-artifact-version.mjs'
 
+const directories = []
+afterEach(() => {
+  for (const directory of directories.splice(0)) {
+    rmSync(directory, { recursive: true, force: true })
+  }
+})
+
+function createArtifactDirectory(target = '') {
+  const directory = mkdtempSync(join(tmpdir(), 'orcad-version-'))
+  directories.push(directory)
+  for (const filename of orcadArtifactFilenames(target)) {
+    const path = join(directory, filename)
+    mkdirSync(dirname(path), { recursive: true })
+    writeFileSync(path, filename)
+  }
+  writeFileSync(join(directory, ORCAD_BUILD_TARGET_FILENAME), `${target}\n`)
+  return directory
+}
+
 describe('standalone runtime version', () => {
   it('changes when a shipped search binary changes and rejects a missing binary', () => {
-    const dir = mkdtempSync(join(tmpdir(), 'orcad-version-'))
-    try {
-      for (const filename of orcadArtifactFilenames()) {
-        const path = join(dir, filename)
-        mkdirSync(dirname(path), { recursive: true })
-        writeFileSync(path, filename)
-      }
-      const before = computeOrcadFullVersion(dir)
-      const binary = join(dir, ORCAD_RIPGREP_ARTIFACTS[0])
-      writeFileSync(binary, 'updated binary')
-      expect(computeOrcadFullVersion(dir)).not.toBe(before)
-      rmSync(binary)
-      expect(() => computeOrcadFullVersion(dir)).toThrow(ORCAD_RIPGREP_ARTIFACTS[0])
-    } finally {
-      rmSync(dir, { recursive: true, force: true })
-    }
+    const dir = createArtifactDirectory()
+    const before = computeOrcadFullVersion(dir)
+    const binary = join(dir, ORCAD_RIPGREP_ARTIFACTS[0])
+    writeFileSync(binary, 'updated binary')
+    expect(computeOrcadFullVersion(dir)).not.toBe(before)
+    rmSync(binary)
+    expect(() => computeOrcadFullVersion(dir)).toThrow(ORCAD_RIPGREP_ARTIFACTS[0])
   })
+
+  it.each(ORCAD_BUN_TARGETS)(
+    'matches the installed %s identity with and without its optional browser',
+    async (target) => {
+      const dir = createArtifactDirectory(target)
+      const [platform, arch] = target.split('-')
+      const agentBrowserFilename = orcadAgentBrowserNativeName(
+        platform,
+        arch,
+        target.endsWith('-musl') ? 'musl' : 'glibc'
+      )
+      const options = { target, agentBrowserFilename }
+      const withoutBrowser = computeOrcadFullVersion(dir, options)
+      expect(withoutBrowser).toBe(await readOrcadArtifactIdentity(dir))
+      writeFileSync(join(dir, agentBrowserFilename), 'browser')
+      const withBrowser = computeOrcadFullVersion(dir, options)
+      expect(withBrowser).not.toBe(withoutBrowser)
+      expect(withBrowser).toBe(await readOrcadArtifactIdentity(dir))
+      writeFileSync(join(dir, agentBrowserFilename), 'updated-browser')
+      expect(computeOrcadFullVersion(dir, options)).not.toBe(withBrowser)
+      expect(computeOrcadFullVersion(dir, options)).toBe(await readOrcadArtifactIdentity(dir))
+    }
+  )
 })
diff --git a/config/scripts/orcad-entry-build.mjs b/config/scripts/orcad-entry-build.mjs
new file mode 100644
index 000000000000..fa2c83050ac8
--- /dev/null
+++ b/config/scripts/orcad-entry-build.mjs
@@ -0,0 +1,58 @@
+import { build } from 'esbuild'
+import { join } from 'node:path'
+
+const root = join(import.meta.dirname, '..', '..')
+
+export const ORCAD_ENTRY_POINT = 'src/main/orcad/main.ts'
+export const ORCAD_CHILD_ENTRY_POINTS = {
+  watcher: 'src/main/ipc/parcel-watcher-process-entry.ts',
+  daemon: 'src/main/daemon/daemon-entry.ts',
+  ptyGate: 'src/main/daemon/pty-subprocess/windows-bun-pty-gate-entry.ts',
+  writer: 'src/main/persistence/profile-state/profile-state-writer-worker-entry.ts',
+  backup: 'src/main/persistence/profile-state/profile-state-backup-worker-entry.ts'
+}
+
+export const ORCAD_EXTERNAL_MODULES = [
+  'electron',
+  'node-pty',
+  '@parcel/watcher',
+  'fsevents',
+  'bun:ffi',
+  'bun:sqlite'
+]
+
+// Native binaries are staged separately from every JavaScript entry.
+export const externalNativeAddons = {
+  name: 'external-native-addons',
+  setup(pluginBuild) {
+    pluginBuild.onResolve({ filter: /\.node$/ }, (args) => ({ path: args.path, external: true }))
+  }
+}
+
+// The UMD build's relative dynamic requires cannot be bundled.
+const jsoncParserEsm = {
+  name: 'jsonc-parser-esm',
+  setup(pluginBuild) {
+    pluginBuild.onResolve({ filter: /^jsonc-parser$/ }, () => ({
+      path: join(root, 'node_modules', 'jsonc-parser', 'lib', 'esm', 'main.js')
+    }))
+  }
+}
+
+export function buildOrcadEntry(outfile) {
+  return build({
+    entryPoints: [join(root, ORCAD_ENTRY_POINT)],
+    bundle: true,
+    platform: 'node',
+    target: 'node18',
+    format: 'cjs',
+    outfile,
+    external: ORCAD_EXTERNAL_MODULES,
+    plugins: [jsoncParserEsm, externalNativeAddons],
+    metafile: true,
+    minify: true,
+    sourcemap: false,
+    define: { 'process.env.NODE_ENV': '"production"' },
+    logLevel: 'error'
+  })
+}
diff --git a/config/scripts/orcad-template-test-fixture.mjs b/config/scripts/orcad-template-test-fixture.mjs
new file mode 100644
index 000000000000..2f11a32e83f1
--- /dev/null
+++ b/config/scripts/orcad-template-test-fixture.mjs
@@ -0,0 +1,50 @@
+import { createHash } from 'node:crypto'
+import { mkdir, writeFile } from 'node:fs/promises'
+import { dirname, join } from 'node:path'
+import {
+  ORCAD_BUILD_TARGET_FILENAME,
+  ORCAD_TEMPLATE_MANIFEST_FILENAME,
+  ORCAD_TEMPLATE_TARGETS_DIR,
+  orcadTemplateCommonFilenames
+} from '../../src/shared/orcad-artifacts.ts'
+import { ORCAD_TEMPLATE_TARGETS } from '../../src/shared/orcad-bun-runtime.ts'
+
+async function write(path, contents) {
+  await mkdir(dirname(path), { recursive: true })
+  await writeFile(path, contents)
+  return createHash('sha256').update(contents).digest('hex')
+}
+
+export async function writeOrcadTemplateTestFixture(resourcesDir) {
+  const templateDir = join(resourcesDir, 'orcad-template')
+  const commonFilenames = orcadTemplateCommonFilenames()
+  const commonSha256 = {}
+  for (const filename of commonFilenames) {
+    commonSha256[filename] = await write(
+      join(templateDir, ...filename.split('/')),
+      Buffer.from(`common:${filename}`)
+    )
+  }
+  const targets = {}
+  for (const target of ORCAD_TEMPLATE_TARGETS) {
+    const targetDir = join(templateDir, ORCAD_TEMPLATE_TARGETS_DIR, target)
+    targets[target] = {
+      targetSha256: await write(join(targetDir, ORCAD_BUILD_TARGET_FILENAME), `${target}\n`),
+      watcherSha256: await write(join(targetDir, 'watcher.node'), `watcher:${target}`)
+    }
+  }
+  const browserName = 'agent-browser-linux-x64'
+  targets['linux-x64-glibc'] = {
+    ...targets['linux-x64-glibc'],
+    browserName,
+    browserSha256: await write(
+      join(templateDir, ORCAD_TEMPLATE_TARGETS_DIR, 'linux-x64-glibc', browserName),
+      'browser'
+    )
+  }
+  await writeFile(
+    join(templateDir, ORCAD_TEMPLATE_MANIFEST_FILENAME),
+    JSON.stringify({ schemaVersion: 2, commonSha256, targets })
+  )
+  return templateDir
+}
diff --git a/config/scripts/orcad-terminal-smoke-change-scope.mjs b/config/scripts/orcad-terminal-smoke-change-scope.mjs
new file mode 100644
index 000000000000..9dd58dab20ce
--- /dev/null
+++ b/config/scripts/orcad-terminal-smoke-change-scope.mjs
@@ -0,0 +1,54 @@
+import { readFileSync } from 'node:fs'
+import { pathToFileURL } from 'node:url'
+import { classifyBunProfileChanges, collectBunProfileInputs } from './bun-profile-change-scope.mjs'
+import { ORCAD_CHILD_ENTRY_POINTS, ORCAD_ENTRY_POINT } from './orcad-entry-build.mjs'
+
+const ENTRY_POINTS = [
+  ORCAD_ENTRY_POINT,
+  ...Object.values(ORCAD_CHILD_ENTRY_POINTS),
+  'src/cli/index.ts',
+  'config/scripts/build-orcad-bun.mjs',
+  'config/scripts/build-orcad.mjs',
+  'config/scripts/ensure-native-runtime.mjs',
+  'config/scripts/rebuild-native-deps.mjs',
+  'config/scripts/verify-cli-bin.mjs',
+  'config/scripts/install-dev-cli.mjs',
+  'config/scripts/orca-dev.mjs',
+  'config/scripts/runtime-serve-terminal-smoke.mjs',
+  'config/scripts/orcad-terminal-smoke-change-scope.mjs'
+]
+
+export function collectOrcadTerminalSmokeInputs() {
+  return collectBunProfileInputs({ entryPoints: ENTRY_POINTS })
+}
+
+export async function classifyOrcadTerminalSmokeChanges(
+  changedFiles,
+  collect = collectOrcadTerminalSmokeInputs
+) {
+  const forced = changedFiles.find(
+    (file) =>
+      ENTRY_POINTS.includes(file) ||
+      file === '.github/workflows/pr.yml' ||
+      file.startsWith('config/scripts/orcad-terminal-smoke-') ||
+      file.startsWith('config/scripts/runtime-serve-terminal-smoke') ||
+      // createRequire-loaded native probes are invisible to esbuild's import graph.
+      (file.startsWith('config/scripts/') && file.endsWith('.cjs')) ||
+      // CLI emit and runtime resources include files opened by path, outside the import graph.
+      file.startsWith('src/cli/') ||
+      file.startsWith('src/shared/') ||
+      file.startsWith('resources/')
+  )
+  if (forced) {
+    return { shouldRun: true, reason: `Smoke input changed: ${forced}` }
+  }
+  // Retain the Bun gate's native, worker, toolchain and failed-analysis safeguards.
+  return classifyBunProfileChanges(changedFiles, collect)
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  const changedFiles = readFileSync(process.argv[2], 'utf8').split('\0').filter(Boolean)
+  const result = await classifyOrcadTerminalSmokeChanges(changedFiles)
+  console.error(result.reason)
+  process.stdout.write(`${result.shouldRun}\n`)
+}
diff --git a/config/scripts/orcad-terminal-smoke-change-scope.test.mjs b/config/scripts/orcad-terminal-smoke-change-scope.test.mjs
new file mode 100644
index 000000000000..e0e978800fc7
--- /dev/null
+++ b/config/scripts/orcad-terminal-smoke-change-scope.test.mjs
@@ -0,0 +1,109 @@
+import { readFileSync } from 'node:fs'
+import { beforeAll, describe, expect, it } from 'vitest'
+import { parse } from 'yaml'
+import {
+  classifyOrcadTerminalSmokeChanges,
+  collectOrcadTerminalSmokeInputs
+} from './orcad-terminal-smoke-change-scope.mjs'
+import { ORCAD_CHILD_ENTRY_POINTS } from './orcad-entry-build.mjs'
+
+it.each([
+  'package.json',
+  'pnpm-lock.yaml',
+  'tsconfig.json',
+  'config/tsconfig.cli.json',
+  'config/patches/node-pty@1.1.0.patch',
+  'native/windows-registry/src/addon.cc',
+  'config/scripts/node-pty-job-ownership.cjs',
+  '.github/actions/install-node-dependencies/action.yml',
+  '.github/workflows/pr.yml',
+  'src/cli/deleted-command.ts',
+  'src/shared/deleted-contract.ts',
+  'src/main/persistence/profile-state/new-worker.ts',
+  'resources/licenses/ripgrep/COPYING',
+  'config/scripts/runtime-serve-terminal-smoke.test.mjs',
+  'config/scripts/orcad-terminal-smoke-change-scope.test.mjs'
+])('retains the smoke for build and dynamically opened input changes: %s', async (file) => {
+  expect((await classifyOrcadTerminalSmokeChanges([file], async () => new Set())).shouldRun).toBe(
+    true
+  )
+})
+
+it('retains smoke when changed-file evidence or dependency analysis is unavailable', async () => {
+  expect((await classifyOrcadTerminalSmokeChanges([])).shouldRun).toBe(true)
+  const result = await classifyOrcadTerminalSmokeChanges(['src/main/deleted.ts'], async () => {
+    throw new Error('Could not resolve deleted dependency')
+  })
+  expect(result.shouldRun).toBe(true)
+  expect(result.reason).toContain('Dependency graph unavailable')
+})
+
+describe('the actual terminal smoke dependency graph', () => {
+  let inputs
+  beforeAll(async () => {
+    inputs = await collectOrcadTerminalSmokeInputs()
+  }, 60_000)
+
+  it.each([
+    ...Object.values(ORCAD_CHILD_ENTRY_POINTS),
+    'src/main/runtime/orca-runtime.ts',
+    'src/main/windows/windows-process-table.ts',
+    'src/main/worker-thread-entry-path.ts',
+    'src/cli/index.ts',
+    'config/scripts/runtime-serve-terminal-smoke.mjs',
+    'config/scripts/build-orcad-bun.mjs',
+    'config/scripts/build-orcad.mjs',
+    'config/scripts/profile-state-worker-smoke.mjs',
+    'config/scripts/install-dev-cli.mjs',
+    'config/scripts/verify-cli-bin.mjs',
+    'config/scripts/bun-profile-change-scope.mjs'
+  ])('retains the runtime, CLI, build or smoke dependency: %s', async (file) => {
+    expect(inputs.has(file)).toBe(true)
+    expect((await classifyOrcadTerminalSmokeChanges([file], async () => inputs)).shouldRun).toBe(
+      true
+    )
+  })
+
+  it.each([
+    'src/renderer/src/components/Example.tsx',
+    'src/main/menu/register-app-menu.ts',
+    'config/scripts/ci-shard-timings.json',
+    '.github/workflows/e2e.yml',
+    'docs/reference/ci-runner-efficiency.md'
+  ])('skips unrelated inputs: %s', async (file) => {
+    expect((await classifyOrcadTerminalSmokeChanges([file], async () => inputs)).shouldRun).toBe(
+      false
+    )
+  })
+
+  it('retains a removed source path when a file is renamed outside the CLI tree', async () => {
+    expect(
+      (
+        await classifyOrcadTerminalSmokeChanges(
+          ['src/cli/deleted-command.ts', 'docs/moved-command.ts'],
+          async () => inputs
+        )
+      ).shouldRun
+    ).toBe(true)
+  })
+})
+
+it('only skips the unchanged smoke after a successful diff and dependency analysis', () => {
+  const workflow = parse(
+    readFileSync(new URL('../../.github/workflows/pr.yml', import.meta.url), 'utf8')
+  )
+  const step = workflow.jobs.static_analysis.steps.find(
+    (candidate) => candidate.name === 'Boot orcad and round-trip a terminal'
+  )
+  expect(step.env).toEqual({
+    BASE_SHA: '${{ github.event.pull_request.base.sha }}',
+    ORCA_BACKGROUND_LAUNCH: '1'
+  })
+  // See the localization gate: HEAD^1 removes the merge-base computation, so a shallow checkout
+  // is enough and the payload head SHA is unused.
+  expect(step.run).toContain('node config/scripts/git-pull-request-diff-base.mjs "$BASE_SHA"')
+  expect(step.run).toContain('git diff --name-only --no-renames -z "$DIFF_BASE" HEAD')
+  expect(step.run).not.toContain('--diff-filter')
+  expect(step.run).toContain('&& [ "$scope" = false ]; then')
+  expect(step.run).toMatch(/else\s+pnpm run smoke:orcad-terminal\s+fi/)
+})
diff --git a/config/scripts/orcad-watcher-package.mjs b/config/scripts/orcad-watcher-package.mjs
new file mode 100644
index 000000000000..5107d23fe58f
--- /dev/null
+++ b/config/scripts/orcad-watcher-package.mjs
@@ -0,0 +1,86 @@
+import { createHash } from 'node:crypto'
+import { mkdir, readFile, writeFile } from 'node:fs/promises'
+import { createRequire } from 'node:module'
+import { join, resolve } from 'node:path'
+import { x as extractTar } from 'tar'
+import { parseAllDocuments } from 'yaml'
+import { ORCAD_BUN_TARGETS } from '../../src/shared/orcad-bun-runtime.ts'
+
+const root = resolve(import.meta.dirname, '../..')
+const require = createRequire(import.meta.url)
+const archiveLimit = 16 * 1024 * 1024
+
+export function parseWatcherLockfile(contents) {
+  const packages = {}
+  for (const document of parseAllDocuments(contents)) {
+    if (document.errors.length) {
+      throw document.errors[0]
+    }
+    Object.assign(packages, document.toJS()?.packages)
+  }
+  return { packages }
+}
+
+export function watcherPackageIdentity(target, version, lockfile) {
+  if (!ORCAD_BUN_TARGETS.includes(target)) {
+    throw new Error(`Unsupported watcher target: ${target}`)
+  }
+  const name = `@parcel/watcher-${target}`
+  const integrity = lockfile.packages?.[`${name}@${version}`]?.resolution?.integrity
+  if (typeof integrity !== 'string' || !/^sha512-[A-Za-z0-9+/]+=*$/.test(integrity)) {
+    throw new Error(`The lockfile does not pin ${name}@${version}`)
+  }
+  return {
+    integrity,
+    url: `https://registry.npmjs.org/${name}/-/watcher-${target}-${version}.tgz`
+  }
+}
+
+export function verifyWatcherArchive(bytes, integrity) {
+  if (bytes.length > archiveLimit) {
+    throw new Error('Watcher archive exceeds the size limit')
+  }
+  if (`sha512-${createHash('sha512').update(bytes).digest('base64')}` !== integrity) {
+    throw new Error('Watcher archive does not match the lockfile integrity')
+  }
+}
+
+// Fetch only these small release assets; ordinary installs remain host-only.
+export async function materializeWatcherPackage(target) {
+  const { version } = require('@parcel/watcher/package.json')
+  const lockfile = parseWatcherLockfile(await readFile(join(root, 'pnpm-lock.yaml'), 'utf8'))
+  const { integrity, url } = watcherPackageIdentity(target, version, lockfile)
+  const cache = join(root, 'out', '.orcad-watchers', version, target)
+  const archivePath = join(cache, 'package.tgz')
+  await mkdir(cache, { recursive: true })
+  let bytes
+  try {
+    bytes = await readFile(archivePath)
+    verifyWatcherArchive(bytes, integrity)
+  } catch {
+    const response = await fetch(url, { signal: AbortSignal.timeout(60_000) })
+    if (!response.ok || !response.body) {
+      await response.body?.cancel()
+      throw new Error(`Watcher download failed: ${response.status} ${response.statusText}`)
+    }
+    const chunks = []
+    let length = 0
+    for await (const chunk of response.body) {
+      length += chunk.length
+      if (length > archiveLimit) {
+        throw new Error('Watcher archive exceeds the size limit')
+      }
+      chunks.push(chunk)
+    }
+    bytes = Buffer.concat(chunks)
+    verifyWatcherArchive(bytes, integrity)
+    await writeFile(archivePath, bytes)
+  }
+  await extractTar({
+    file: archivePath,
+    cwd: cache,
+    strict: true,
+    filter: (path, entry) => path === 'package/watcher.node' && entry.type === 'File'
+  })
+  return join(cache, 'package', 'watcher.node')
+}
diff --git a/config/scripts/orcad-watcher-package.test.mjs b/config/scripts/orcad-watcher-package.test.mjs
new file mode 100644
index 000000000000..9baaa71dc7ec
--- /dev/null
+++ b/config/scripts/orcad-watcher-package.test.mjs
@@ -0,0 +1,40 @@
+import { createHash } from 'node:crypto'
+import { describe, expect, it } from 'vitest'
+import {
+  parseWatcherLockfile,
+  verifyWatcherArchive,
+  watcherPackageIdentity
+} from './orcad-watcher-package.mjs'
+
+describe('locked watcher release assets', () => {
+  const archive = Buffer.from('archive')
+  const integrity = `sha512-${createHash('sha512').update(archive).digest('base64')}`
+
+  it('reads dependency pins after the package-manager document in pnpm 12 lockfiles', () => {
+    const lockfile = parseWatcherLockfile(
+      `---\npackages: {}\n---\npackages:\n  '@parcel/watcher-linux-x64-glibc@2.5.6':\n    resolution:\n      integrity: ${integrity}\n`
+    )
+    expect(watcherPackageIdentity('linux-x64-glibc', '2.5.6', lockfile).integrity).toBe(integrity)
+  })
+
+  it('resolves a target using the exact installed wrapper version and locked integrity', () => {
+    const lockfile = {
+      packages: { '@parcel/watcher-linux-x64-musl@2.5.6': { resolution: { integrity } } }
+    }
+    expect(watcherPackageIdentity('linux-x64-musl', '2.5.6', lockfile)).toEqual({
+      integrity,
+      url: 'https://registry.npmjs.org/@parcel/watcher-linux-x64-musl/-/watcher-linux-x64-musl-2.5.6.tgz'
+    })
+    expect(() => watcherPackageIdentity('linux-x64-glibc', '2.5.6', lockfile)).toThrow('lockfile')
+    expect(() => watcherPackageIdentity('linux-x64-musl', '2.5.7', lockfile)).toThrow('lockfile')
+  })
+
+  it('rejects missing, unknown and corrupted inputs before extraction', () => {
+    expect(() => watcherPackageIdentity('../x64', '2.5.6', {})).toThrow('Unsupported')
+    expect(() => verifyWatcherArchive(archive, integrity)).not.toThrow()
+    expect(() => verifyWatcherArchive(Buffer.from('tampered'), integrity)).toThrow('integrity')
+    expect(() => verifyWatcherArchive(Buffer.alloc(16 * 1024 * 1024 + 1), integrity)).toThrow(
+      'size limit'
+    )
+  })
+})
diff --git a/config/scripts/orcad-windows-process-tree.mjs b/config/scripts/orcad-windows-process-tree.mjs
new file mode 100644
index 000000000000..af1b3ceceecb
--- /dev/null
+++ b/config/scripts/orcad-windows-process-tree.mjs
@@ -0,0 +1,48 @@
+import { copyFileSync, lstatSync } from 'node:fs'
+import { createRequire } from 'node:module'
+import { join } from 'node:path'
+import { ORCAD_WINDOWS_PROCESS_TREE_FILENAME } from '../../src/shared/orcad-artifacts.ts'
+import {
+  inspectWindowsProcessTreeAddon,
+  windowsProcessTreeAddonPath
+} from './windows-process-tree-gyp-rebuild.mjs'
+
+const { PE_MACHINE, describePeMachine, readPeMachine } = createRequire(import.meta.url)(
+  './windows-pe-machine.cjs'
+)
+
+export function stageOrcadWindowsProcessTree(
+  root,
+  outputDir,
+  target,
+  host = { platform: process.platform, arch: process.arch }
+) {
+  if (!target.startsWith('win32-')) {
+    return
+  }
+  const arch = target.slice('win32-'.length)
+  let source = join(
+    root,
+    '.build',
+    'windows-process-tree',
+    arch,
+    ORCAD_WINDOWS_PROCESS_TREE_FILENAME
+  )
+  // Ordinary Windows installs already compile this N-API addon for the host.
+  if (target === `${host.platform}-${host.arch}` && !lstatSync(source, { throwIfNoEntry: false })) {
+    source = windowsProcessTreeAddonPath(
+      join(root, 'node_modules', '@vscode', 'windows-process-tree')
+    )
+  }
+  if (inspectWindowsProcessTreeAddon(source) !== 'clean') {
+    throw new Error(
+      `Orcad ${target} requires a patched process reader. On Windows, run: ` +
+        `node config/scripts/build-windows-process-tree-relay-addon.mjs --arch=${arch}`
+    )
+  }
+  const machine = readPeMachine(source)
+  if (machine !== PE_MACHINE[arch]) {
+    throw new Error(`Orcad ${target} process reader has ${describePeMachine(machine)}`)
+  }
+  copyFileSync(source, join(outputDir, ORCAD_WINDOWS_PROCESS_TREE_FILENAME))
+}
diff --git a/config/scripts/orcad-windows-process-tree.test.mjs b/config/scripts/orcad-windows-process-tree.test.mjs
new file mode 100644
index 000000000000..acc53f271941
--- /dev/null
+++ b/config/scripts/orcad-windows-process-tree.test.mjs
@@ -0,0 +1,109 @@
+import { mkdtempSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, expect, it } from 'vitest'
+import { stageOrcadWindowsProcessTree } from './orcad-windows-process-tree.mjs'
+import { windowsProcessTreeAddonPath } from './windows-process-tree-gyp-rebuild.mjs'
+
+const windowsHost = { platform: 'win32', arch: 'x64' }
+
+const roots = []
+afterEach(() => roots.splice(0).forEach((root) => rmSync(root, { recursive: true, force: true })))
+
+function fixture(machine = 0x8664, suffix = '') {
+  const root = mkdtempSync(join(tmpdir(), 'orcad-process-reader-'))
+  roots.push(root)
+  const source = join(root, '.build/windows-process-tree/x64')
+  const output = join(root, 'output')
+  mkdirSync(source, { recursive: true })
+  mkdirSync(output)
+  const bytes = Buffer.alloc(0x90)
+  bytes.write('MZ')
+  bytes.writeUInt32LE(0x80, 0x3c)
+  bytes.write('PE\0\0', 0x80)
+  bytes.writeUInt16LE(machine, 0x84)
+  const file = join(source, 'windows-process-tree.node')
+  writeFileSync(file, Buffer.concat([bytes, Buffer.from(suffix)]))
+  return { root, output, file }
+}
+
+function installedFixture(machine = 0x8664, suffix = '') {
+  const prepared = fixture(machine, suffix)
+  const packageDir = join(prepared.root, 'node_modules', '@vscode', 'windows-process-tree')
+  mkdirSync(join(packageDir, 'build', 'Release'), { recursive: true })
+  const installed = windowsProcessTreeAddonPath(packageDir)
+  writeFileSync(installed, readFileSync(prepared.file))
+  rmSync(prepared.file)
+  return { ...prepared, installed }
+}
+
+it('stages only a clean reader for the requested machine', () => {
+  const { root, output, file } = fixture()
+  stageOrcadWindowsProcessTree(root, output, 'win32-x64')
+  expect(readFileSync(join(output, 'windows-process-tree.node'))).toEqual(readFileSync(file))
+})
+
+it('rejects an unpatched reader even when its architecture matches', () => {
+  const { root, output } = fixture(0x8664, 'ReadProcessMemory')
+  expect(() => stageOrcadWindowsProcessTree(root, output, 'win32-x64')).toThrow(
+    'patched process reader'
+  )
+})
+
+it('rejects wrong architecture and absent artifacts', () => {
+  const { root, output } = fixture(0xaa64)
+  expect(() => stageOrcadWindowsProcessTree(root, output, 'win32-x64')).toThrow('machine 0xaa64')
+  expect(() => stageOrcadWindowsProcessTree(root, output, 'win32-arm64')).toThrow(
+    'patched process reader'
+  )
+})
+
+it('keeps POSIX builds independent of Windows build tools', () => {
+  expect(() => stageOrcadWindowsProcessTree('absent', 'absent', 'linux-x64-glibc')).not.toThrow()
+})
+
+it.each([
+  ['x64', 0x8664],
+  ['arm64', 0xaa64]
+])('reuses the checked native addon from a Windows %s host install', (arch, machine) => {
+  const { root, output, installed } = installedFixture(machine)
+  stageOrcadWindowsProcessTree(root, output, `win32-${arch}`, { platform: 'win32', arch })
+  expect(readFileSync(join(output, 'windows-process-tree.node'))).toEqual(readFileSync(installed))
+})
+
+it.each([
+  { platform: 'darwin', arch: 'x64' },
+  { platform: 'win32', arch: 'arm64' }
+])('does not reuse host installation for a different target: %j', (host) => {
+  const { root, output } = installedFixture()
+  expect(() => stageOrcadWindowsProcessTree(root, output, 'win32-x64', host)).toThrow(
+    'patched process reader'
+  )
+})
+
+it('requires the installed fallback to have the matching architecture and patch', () => {
+  const { root, output, installed } = installedFixture(0xaa64)
+  expect(() => stageOrcadWindowsProcessTree(root, output, 'win32-x64', windowsHost)).toThrow(
+    'machine 0xaa64'
+  )
+  writeFileSync(installed, 'ReadProcessMemory')
+  expect(() => stageOrcadWindowsProcessTree(root, output, 'win32-x64', windowsHost)).toThrow(
+    'patched process reader'
+  )
+  rmSync(installed)
+  expect(() => stageOrcadWindowsProcessTree(root, output, 'win32-x64', windowsHost)).toThrow(
+    'patched process reader'
+  )
+})
+
+it('prefers explicit architecture builds and refuses to mask a stale one', () => {
+  const { root, output, file, installed } = installedFixture()
+  const staged = Buffer.concat([readFileSync(installed), Buffer.from('staged')])
+  writeFileSync(file, staged)
+  stageOrcadWindowsProcessTree(root, output, 'win32-x64', windowsHost)
+  expect(readFileSync(join(output, 'windows-process-tree.node'))).toEqual(staged)
+  writeFileSync(file, 'ReadProcessMemory')
+  expect(() => stageOrcadWindowsProcessTree(root, output, 'win32-x64', windowsHost)).toThrow(
+    'patched process reader'
+  )
+})
diff --git a/config/scripts/package-linux-formats.mjs b/config/scripts/package-linux-formats.mjs
new file mode 100644
index 000000000000..56c5ed4562fd
--- /dev/null
+++ b/config/scripts/package-linux-formats.mjs
@@ -0,0 +1,139 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module'
+import {
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  readdirSync,
+  realpathSync,
+  renameSync,
+  rmSync,
+  statSync
+} from 'node:fs'
+import { join, resolve } from 'node:path'
+import { copyPrivateTree } from './space-sharing-copy.mjs'
+import { spawnProcess } from './script-child-process.mjs'
+
+const require = createRequire(import.meta.url)
+const formats = ['AppImage', 'deb', 'rpm']
+
+export function linuxFormatArguments({ format, appDirectory, outputDirectory }) {
+  if (!formats.includes(format)) {
+    throw new Error(`Unsupported Linux package format: ${format}`)
+  }
+  return [
+    '--config',
+    'config/electron-builder-pr-linux.config.cjs',
+    '--linux',
+    format,
+    '--x64',
+    '--publish',
+    'never',
+    '--prepackaged',
+    appDirectory,
+    '--config.directories.output',
+    outputDirectory,
+    '--config.deb.compression=gz',
+    '--config.rpm.compression=gzip'
+  ]
+}
+
+function runElectronBuilder(args) {
+  return new Promise((resolveBuild, reject) => {
+    const child = spawnProcess({
+      program: process.execPath,
+      args: [require.resolve('electron-builder/cli.js'), ...args],
+      env: { ...process.env, ORCA_BACKGROUND_LAUNCH: '1' },
+      stdio: 'inherit'
+    })
+    child.once('error', reject)
+    child.once('close', (code, signal) => {
+      if (code === 0 && signal === null) {
+        resolveBuild()
+      } else {
+        reject(new Error(`electron-builder failed (code=${code}, signal=${signal})`))
+      }
+    })
+  })
+}
+
+export async function packageLinuxFormats({
+  preparedDirectory = resolve('dist/linux-unpacked'),
+  outputDirectory = resolve('dist'),
+  runBuilder = runElectronBuilder
+} = {}) {
+  const marker = join(preparedDirectory, 'resources/package-type')
+  if (readFileSync(marker, 'utf8') !== 'AppImage') {
+    throw new Error('Expected a fresh Linux directory build with its AppImage package marker')
+  }
+  const startedAt = performance.now()
+  mkdirSync(outputDirectory, { recursive: true })
+  const staging = mkdtempSync(join(outputDirectory, '.linux-package-formats-'))
+  try {
+    const results = await Promise.allSettled(
+      formats.map(async (format) => {
+        const startedFormatAt = performance.now()
+        const appDirectory = join(staging, format, 'app')
+        const formatOutput = join(staging, format, 'artifacts')
+        mkdirSync(join(staging, format))
+        // Preserve packaged modes; only the format metadata may be rewritten by electron-builder.
+        copyPrivateTree(preparedDirectory, appDirectory, { unprotect: () => {} })
+        console.log(
+          `[linux-package] ${format} copied in ${Math.round(performance.now() - startedFormatAt)}ms`
+        )
+        await runBuilder(
+          linuxFormatArguments({ format, appDirectory, outputDirectory: formatOutput })
+        )
+        const artifacts = readdirSync(formatOutput).filter((name) => name.endsWith(`.${format}`))
+        const artifactStats =
+          artifacts.length === 1 ? statSync(join(formatOutput, artifacts[0])) : null
+        if (!artifactStats?.isFile() || artifactStats.size === 0) {
+          throw new Error(`${format} did not produce exactly one nonempty package`)
+        }
+        console.log(
+          `[linux-package] ${format} finished in ${Math.round(performance.now() - startedFormatAt)}ms`
+        )
+        return { format, formatOutput, artifact: artifacts[0] }
+      })
+    )
+    const failures = results.flatMap((result, index) =>
+      result.status === 'rejected'
+        ? [new Error(`${formats[index]} packaging failed`, { cause: result.reason })]
+        : []
+    )
+    if (failures.length > 0) {
+      throw new AggregateError(failures, 'Linux package formats failed')
+    }
+    const completed = results.flatMap((result) =>
+      result.status === 'fulfilled' ? [result.value] : []
+    )
+    const metadataDirectory = join(outputDirectory, 'linux-package-formats')
+    for (const destination of [
+      metadataDirectory,
+      ...completed.map(({ artifact }) => join(outputDirectory, artifact))
+    ]) {
+      if (existsSync(destination)) {
+        throw new Error(`Refusing to replace existing package output: ${destination}`)
+      }
+    }
+    mkdirSync(metadataDirectory)
+    for (const { format, formatOutput, artifact } of completed) {
+      renameSync(join(formatOutput, artifact), join(outputDirectory, artifact))
+      // Update manifests and builder diagnostics have overlapping names across formats.
+      renameSync(formatOutput, join(metadataDirectory, format))
+    }
+    console.log(
+      `[linux-package] all formats finished in ${Math.round(performance.now() - startedAt)}ms`
+    )
+  } finally {
+    rmSync(staging, { recursive: true, force: true })
+  }
+}
+
+if (process.argv[1] && realpathSync(process.argv[1]) === realpathSync(import.meta.filename)) {
+  if (process.platform !== 'linux' || process.arch !== 'x64') {
+    throw new Error('PR Linux packaging requires a Linux x64 host')
+  }
+  await packageLinuxFormats()
+}
diff --git a/config/scripts/package-linux-formats.test.mjs b/config/scripts/package-linux-formats.test.mjs
new file mode 100644
index 000000000000..7d187af658d8
--- /dev/null
+++ b/config/scripts/package-linux-formats.test.mjs
@@ -0,0 +1,226 @@
+import {
+  chmodSync,
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  readdirSync,
+  readlinkSync,
+  rmSync,
+  statSync,
+  symlinkSync,
+  writeFileSync
+} from 'node:fs'
+import { createRequire } from 'node:module'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+import { linuxFormatArguments, packageLinuxFormats } from './package-linux-formats.mjs'
+
+let root
+let preparedDirectory
+let outputDirectory
+const targets = ['AppImage', 'deb', 'rpm']
+const valueAfter = (args, flag) => args[args.indexOf(flag) + 1]
+
+beforeEach(() => {
+  root = mkdtempSync(join(tmpdir(), 'orca formats with spaces-'))
+  preparedDirectory = join(root, 'prepared app')
+  outputDirectory = join(root, 'output packages')
+  mkdirSync(join(preparedDirectory, 'resources'), { recursive: true })
+  mkdirSync(outputDirectory)
+  writeFileSync(join(preparedDirectory, 'resources/package-type'), 'AppImage')
+  writeFileSync(join(preparedDirectory, 'resources/app.asar'), 'verified application')
+  writeFileSync(join(preparedDirectory, 'orca-ide'), 'executable')
+  chmodSync(join(preparedDirectory, 'orca-ide'), 0o755)
+})
+
+afterEach(() => rmSync(root, { recursive: true, force: true }))
+
+function emitPackage(args) {
+  const format = valueAfter(args, '--linux')
+  const app = valueAfter(args, '--prepackaged')
+  const output = valueAfter(args, '--config.directories.output')
+  writeFileSync(join(app, 'resources/package-type'), format)
+  mkdirSync(output, { recursive: true })
+  writeFileSync(join(output, `orca.${format}`), format)
+  writeFileSync(join(output, 'latest-linux.yml'), format)
+  return { format, app, output }
+}
+
+it('preserves configured hooks, architecture, names, and PR compression with exact argv', () => {
+  const args = linuxFormatArguments({
+    format: 'deb',
+    appDirectory: '/app with spaces',
+    outputDirectory: '/out with spaces'
+  })
+  expect(args).toEqual([
+    '--config',
+    'config/electron-builder-pr-linux.config.cjs',
+    '--linux',
+    'deb',
+    '--x64',
+    '--publish',
+    'never',
+    '--prepackaged',
+    '/app with spaces',
+    '--config.directories.output',
+    '/out with spaces',
+    '--config.deb.compression=gz',
+    '--config.rpm.compression=gzip'
+  ])
+  expect(() => linuxFormatArguments({ format: 'zip' })).toThrow('Unsupported Linux package format')
+})
+
+describe('independent Linux package formats', () => {
+  it('starts all formats before awaiting completion and isolates metadata writes', async () => {
+    if (process.platform !== 'win32') {
+      symlinkSync('resources/package-type', join(preparedDirectory, 'marker-link'))
+    }
+    let release
+    const gate = new Promise((resolve) => {
+      release = resolve
+    })
+    const copies = []
+    await packageLinuxFormats({
+      preparedDirectory,
+      outputDirectory,
+      runBuilder: async (args) => {
+        const app = valueAfter(args, '--prepackaged')
+        const format = valueAfter(args, '--linux')
+        expect(readFileSync(join(app, 'resources/package-type'), 'utf8')).toBe('AppImage')
+        expect(readFileSync(join(app, 'resources/app.asar'), 'utf8')).toBe('verified application')
+        if (process.platform !== 'win32') {
+          expect(readlinkSync(join(app, 'marker-link'))).toBe('resources/package-type')
+          expect(statSync(join(app, 'orca-ide')).mode & 0o777).toBe(0o755)
+          expect(statSync(join(app, 'resources/package-type')).ino).not.toBe(
+            statSync(join(preparedDirectory, 'resources/package-type')).ino
+          )
+        }
+        copies.push(app)
+        if (copies.length === 3) {
+          release()
+        }
+        await gate
+        expect(readdirSync(outputDirectory)).toHaveLength(1)
+        emitPackage(args)
+        await Promise.resolve()
+        expect(readFileSync(join(app, 'resources/package-type'), 'utf8')).toBe(format)
+      }
+    })
+    expect(new Set(copies).size).toBe(3)
+    expect(readFileSync(join(preparedDirectory, 'resources/package-type'), 'utf8')).toBe('AppImage')
+    expect(readFileSync(join(preparedDirectory, 'resources/app.asar'), 'utf8')).toBe(
+      'verified application'
+    )
+    for (const format of targets) {
+      expect(readFileSync(join(outputDirectory, `orca.${format}`), 'utf8')).toBe(format)
+      expect(
+        readFileSync(
+          join(outputDirectory, 'linux-package-formats', format, 'latest-linux.yml'),
+          'utf8'
+        )
+      ).toBe(format)
+    }
+    expect(
+      readdirSync(outputDirectory).some((name) => name.startsWith('.linux-package-formats-'))
+    ).toBe(false)
+  })
+
+  it('settles every worker before cleanup and exposes no partial artifact on failure', async () => {
+    const finished = []
+    let release
+    const gate = new Promise((resolve) => {
+      release = resolve
+    })
+    await expect(
+      packageLinuxFormats({
+        preparedDirectory,
+        outputDirectory,
+        runBuilder: async (args) => {
+          const format = valueAfter(args, '--linux')
+          if (format === 'AppImage') {
+            throw new Error('compression failed')
+          }
+          if (format === 'rpm') {
+            release()
+          }
+          await gate
+          const { app } = emitPackage(args)
+          expect(existsSync(app)).toBe(true)
+          finished.push(format)
+        }
+      })
+    ).rejects.toMatchObject({
+      message: 'Linux package formats failed',
+      errors: [
+        expect.objectContaining({
+          message: 'AppImage packaging failed',
+          cause: expect.objectContaining({ message: 'compression failed' })
+        })
+      ]
+    })
+    expect(finished.sort()).toEqual(['deb', 'rpm'])
+    expect(readdirSync(outputDirectory)).toEqual([])
+    expect(readFileSync(join(preparedDirectory, 'resources/package-type'), 'utf8')).toBe('AppImage')
+  })
+
+  it('rejects missing artifacts even when the builder reports success', async () => {
+    await expect(
+      packageLinuxFormats({
+        preparedDirectory,
+        outputDirectory,
+        runBuilder: async (args) => {
+          const result = emitPackage(args)
+          if (result.format === 'rpm') {
+            writeFileSync(join(result.output, 'orca.rpm'), '')
+          }
+        }
+      })
+    ).rejects.toThrow('Linux package formats failed')
+    expect(readdirSync(outputDirectory)).toEqual([])
+  })
+
+  it('does not replace existing output packages', async () => {
+    writeFileSync(join(outputDirectory, 'orca.deb'), 'previous package')
+    await expect(
+      packageLinuxFormats({
+        preparedDirectory,
+        outputDirectory,
+        runBuilder: async (args) => {
+          emitPackage(args)
+        }
+      })
+    ).rejects.toThrow('Refusing to replace existing package output')
+    expect(readdirSync(outputDirectory)).toEqual(['orca.deb'])
+    expect(readFileSync(join(outputDirectory, 'orca.deb'), 'utf8')).toBe('previous package')
+  })
+
+  it('rejects a tree already mutated by a previous root-package build', async () => {
+    writeFileSync(join(preparedDirectory, 'resources/package-type'), 'rpm')
+    await expect(
+      packageLinuxFormats({
+        preparedDirectory,
+        outputDirectory,
+        runBuilder: async () => {
+          throw new Error('must not run')
+        }
+      })
+    ).rejects.toThrow('Expected a fresh Linux directory build')
+    expect(readdirSync(outputDirectory)).toEqual([])
+  })
+})
+
+it('changes only CI deb/rpm compression levels without mutating release settings or hooks', () => {
+  const require = createRequire(import.meta.url)
+  const release = require('../electron-builder.config.cjs')
+  const before = { deb: { ...release.deb }, rpm: { ...release.rpm } }
+  const ci = require('../electron-builder-pr-linux.config.cjs')
+  expect(release.deb).toEqual(before.deb)
+  expect(release.rpm).toEqual(before.rpm)
+  expect(ci).toEqual({
+    ...release,
+    deb: { ...release.deb, fpm: [...(release.deb.fpm ?? []), '--deb-compression-level=1'] },
+    rpm: { ...release.rpm, fpm: [...(release.rpm.fpm ?? []), '--rpm-compression-level=1'] }
+  })
+})
diff --git a/config/scripts/packaged-browser-lane-contract.test.mjs b/config/scripts/packaged-browser-lane-contract.test.mjs
index bac077d57d4b..3d1932a1035e 100644
--- a/config/scripts/packaged-browser-lane-contract.test.mjs
+++ b/config/scripts/packaged-browser-lane-contract.test.mjs
@@ -20,7 +20,8 @@ describe('packaged browser compatibility lane', () => {
   it('verifies the pinned package before selecting the desktop executable', () => {
     const download = steps.find((step) => step.name === 'Download pinned old release').run
     expect(download).toContain('gh release download v1.4.188')
-    expect(download).toContain('hashlib.sha512(package.read_bytes())')
+    expect(download).toContain('hashlib.sha512()')
+    expect(download).not.toContain('package.read_bytes()')
     expect(download).toContain("extracted/'opt'/'Orca'/'orca-ide'")
     expect(download).toContain('assert base64.')
     expect(download).toContain('decode()==expected')
diff --git a/config/scripts/pdfjs-viewer-assets-stream.test.ts b/config/scripts/pdfjs-viewer-assets-stream.test.ts
new file mode 100644
index 000000000000..2e8f67efa8f4
--- /dev/null
+++ b/config/scripts/pdfjs-viewer-assets-stream.test.ts
@@ -0,0 +1,190 @@
+import { once } from 'node:events'
+import type * as fs from 'node:fs'
+import { mkdtempSync, mkdirSync, rmSync, writeFileSync, type ReadStream } from 'node:fs'
+import type { IncomingMessage, ServerResponse } from 'node:http'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { PassThrough } from 'node:stream'
+import type { Connect, ViteDevServer } from 'vite'
+import { afterEach, beforeEach, expect, it, vi } from 'vitest'
+import { createPdfjsViewerAssetsPlugin } from '../build-plugins/pdfjs-viewer-assets'
+
+const observed = vi.hoisted(() => {
+  const streams: ReadStream[] = []
+  return { streams }
+})
+vi.mock('node:fs', async (importOriginal) => {
+  const original = await importOriginal<typeof fs>()
+  return {
+    ...original,
+    createReadStream: (...args: Parameters<typeof original.createReadStream>) => {
+      const stream = original.createReadStream(...args)
+      observed.streams.push(stream)
+      return stream
+    }
+  }
+})
+
+let root: string
+let middleware: Connect.NextHandleFunction
+
+beforeEach(() => {
+  root = mkdtempSync(join(tmpdir(), 'orca-pdfjs-stream-'))
+  mkdirSync(join(root, 'wasm'))
+  mkdirSync(join(root, 'cmaps'))
+  writeFileSync(join(root, 'wasm', 'fixture.wasm'), Buffer.alloc(1024 * 1024, 1))
+  writeFileSync(join(root, 'cmaps', 'fixture.bcmap'), 'map bytes')
+  const hook = createPdfjsViewerAssetsPlugin(root).configureServer
+  if (typeof hook !== 'function') {
+    throw new Error('Missing configureServer hook')
+  }
+  const server = {
+    middlewares: {
+      use(handler: Connect.NextHandleFunction) {
+        middleware = handler
+      }
+    }
+  }
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: This hook only registers middleware through the supplied use method.
+  hook.call({} as never, server as ViteDevServer)
+})
+
+afterEach(async () => {
+  await Promise.all(
+    observed.streams.map(async (stream) => {
+      if (stream.closed) {
+        return
+      }
+      const closed = new Promise<void>((resolve) => stream.once('close', resolve))
+      stream.destroy()
+      await closed
+    })
+  )
+  observed.streams.length = 0
+  rmSync(root, { recursive: true, force: true })
+})
+
+function request(method = 'GET', url = '/wasm/fixture.wasm') {
+  const response = Object.assign(new PassThrough({ highWaterMark: 16 }), {
+    setHeader: vi.fn(),
+    statusCode: 0
+  })
+  const foreign = { close: vi.fn(), error: vi.fn() }
+  response.on('close', foreign.close)
+  response.on('error', foreign.error)
+  const next = vi.fn()
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The middleware reads only method/url and uses the implemented writable response and header fields.
+  middleware({ method, url } as IncomingMessage, response as unknown as ServerResponse, next)
+  return { response, next, source: observed.streams.at(-1), foreign }
+}
+
+it('releases file handles after repeated abandoned responses with backpressure', async () => {
+  const responses: ReturnType<typeof request>[] = []
+  for (let index = 0; index < 25; index += 1) {
+    const current = request()
+    const { response, source } = current
+    responses.push(current)
+    if (!source) {
+      throw new Error('Missing source')
+    }
+    await once(source, 'pause')
+    const closed = once(response, 'close')
+    response.destroy()
+    await closed
+  }
+  await expect.poll(() => observed.streams.filter((stream) => !stream.closed).length).toBe(0)
+  expect(observed.streams.every((stream) => stream.fd === null)).toBe(true)
+  for (const { response, foreign } of responses) {
+    expect(response.listeners('close')).toEqual([foreign.close])
+    expect(response.listeners('error')).toEqual([foreign.error])
+  }
+})
+
+it('preserves successful GET bytes and removes response cleanup listeners', async () => {
+  const { response, source, next, foreign } = request('GET', '/cmaps/fixture.bcmap')
+  const chunks: Buffer[] = []
+  response.on('data', (chunk: Buffer) => chunks.push(chunk))
+  await once(response, 'end')
+  await expect.poll(() => source?.closed).toBe(true)
+  expect(Buffer.concat(chunks).toString()).toBe('map bytes')
+  expect(response.statusCode).toBe(200)
+  expect(response.setHeader.mock.calls).toEqual([
+    ['Content-Length', 9],
+    ['Content-Type', 'application/octet-stream']
+  ])
+  expect(response.listeners('close')).toEqual([foreign.close])
+  expect(response.listeners('error')).toEqual([foreign.error])
+  expect(next).not.toHaveBeenCalled()
+})
+
+it('answers HEAD without opening a file stream', () => {
+  const { response, next } = request('HEAD')
+  expect(observed.streams).toHaveLength(0)
+  expect(response.writableEnded).toBe(true)
+  expect(response.setHeader.mock.calls).toEqual([
+    ['Content-Length', 1024 * 1024],
+    ['Content-Type', 'application/wasm']
+  ])
+  expect(next).not.toHaveBeenCalled()
+  response.destroy()
+})
+
+it('closes the response on source failure without leaving listeners', async () => {
+  const { response, source, foreign } = request()
+  if (!source) {
+    throw new Error('Missing source')
+  }
+  const closed = once(response, 'close')
+  source.destroy(new Error('fixture read failed'))
+  await closed
+  await expect.poll(() => source.closed).toBe(true)
+  expect(response.destroyed).toBe(true)
+  expect(response.listeners('close')).toEqual([foreign.close])
+  expect(response.listeners('error')).toEqual([foreign.error])
+})
+
+it('closes a source when the response fails', async () => {
+  const { response, source, foreign } = request()
+  if (!source) {
+    throw new Error('Missing source')
+  }
+  await once(source, 'pause')
+  response.destroy(new Error('fixture downstream failed'))
+  await expect.poll(() => source.closed).toBe(true)
+  expect(source.fd).toBe(null)
+  expect(response.listeners('close')).toEqual([foreign.close])
+  expect(response.listeners('error')).toEqual([foreign.error])
+})
+
+it.each([
+  ['POST', '/wasm/fixture.wasm'],
+  ['GET', '/wasm/missing.wasm'],
+  ['GET', '/other/fixture.wasm'],
+  ['GET', '/wasm/%00.wasm']
+])('passes through %s %s without a stream', (method, url) => {
+  const { response, next } = request(method, url)
+  expect(observed.streams).toHaveLength(0)
+  expect(next).toHaveBeenCalledOnce()
+  response.destroy()
+})
+
+it('does not open a stream when earlier middleware resumes after response close', async () => {
+  const response = Object.assign(new PassThrough(), {
+    setHeader: vi.fn(() => {
+      throw new Error('ERR_HTTP_HEADERS_SENT')
+    }),
+    statusCode: 0
+  })
+  const closed = once(response, 'close')
+  response.destroy()
+  await closed
+  middleware(
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The middleware reads only these method/url fields.
+    { method: 'GET', url: '/wasm/fixture.wasm' } as IncomingMessage,
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The fixture implements the writable response and header fields used by this middleware.
+    response as unknown as ServerResponse,
+    vi.fn()
+  )
+  expect(observed.streams).toHaveLength(0)
+  expect(response.setHeader).not.toHaveBeenCalled()
+})
diff --git a/config/scripts/plain-node-entry-guard.test.ts b/config/scripts/plain-node-entry-guard.test.ts
index 673b796fd438..843d185b1016 100644
--- a/config/scripts/plain-node-entry-guard.test.ts
+++ b/config/scripts/plain-node-entry-guard.test.ts
@@ -4,6 +4,7 @@ import { join } from 'node:path'
 import type { Plugin, Rollup } from 'vite'
 import { afterEach, describe, expect, it } from 'vitest'
 import {
+  CLI_MAIN_ENTRY_NAMES,
   createPlainNodeEntryGuardPlugin,
   GUARDED_ENTRY_NAMES
 } from '../build-plugins/plain-node-entry-guard'
@@ -158,8 +159,8 @@ describe('guarded entry names', () => {
 // main-process worker and kills it at startup. The worker entries carried only
 // hand-written "must stay electron-free" comments, and the port-scan worker sits
 // one import away from a client that deliberately does require electron.
-describe('worker thread entry guard', () => {
-  function runWorkerWriteBundle(plugin: Plugin, bundle: Rollup.OutputBundle): void {
+describe('CLI and worker thread entry guard', () => {
+  function runEntryWriteBundle(plugin: Plugin, bundle: Rollup.OutputBundle): void {
     const hook = plugin.writeBundle
     if (typeof hook !== 'function') {
       throw new Error('Expected writeBundle hook')
@@ -171,7 +172,7 @@ describe('worker thread entry guard', () => {
     )
   }
 
-  function workerChunk(name: string, code: string, imports: string[] = []): Rollup.OutputChunk {
+  function entryChunk(name: string, code: string, imports: string[] = []): Rollup.OutputChunk {
     return {
       type: 'chunk',
       code,
@@ -183,33 +184,54 @@ describe('worker thread entry guard', () => {
     } as Rollup.OutputChunk
   }
 
+  it.each(CLI_MAIN_ENTRY_NAMES)('rejects direct and transitive Electron imports in %s', (name) => {
+    const plugin = createPlainNodeEntryGuardPlugin()
+    const entry = entryChunk(name, 'require("electron")')
+    const bundle: Rollup.OutputBundle = { [entry.fileName]: entry }
+    expect(() => runEntryWriteBundle(plugin, bundle)).toThrow('requires electron')
+
+    entry.code = ''
+    const shared = entryChunk('shared', 'require("electron/main")')
+    shared.isEntry = false
+    bundle[shared.fileName] = shared
+    for (const edge of ['imports', 'dynamicImports'] as const) {
+      entry[edge] = [shared.fileName]
+      expect(() => runEntryWriteBundle(plugin, bundle)).toThrow('requires electron')
+      entry[edge] = []
+    }
+
+    shared.code = 'require("node:fs")'
+    entry.imports = [shared.fileName]
+    expect(() => runEntryWriteBundle(plugin, bundle)).not.toThrow()
+  })
+
   it('rejects an Electron require reachable from a worker entry', () => {
     const plugin = createPlainNodeEntryGuardPlugin()
-    const bundle = {
-      'port-scan-command-worker-entry.js': workerChunk(
+    const bundle: Rollup.OutputBundle = {
+      'port-scan-command-worker-entry.js': entryChunk(
         'port-scan-command-worker-entry',
         'require("electron")'
       )
-    } as Rollup.OutputBundle
+    }
 
-    expect(() => runWorkerWriteBundle(plugin, bundle)).toThrow('requires electron')
+    expect(() => runEntryWriteBundle(plugin, bundle)).toThrow('requires electron')
   })
 
   it('names the worker-thread runtime so the failure is actionable', () => {
     const plugin = createPlainNodeEntryGuardPlugin()
-    const bundle = {
-      'stt-worker.js': workerChunk('stt-worker', 'require("electron")')
-    } as Rollup.OutputBundle
+    const bundle: Rollup.OutputBundle = {
+      'stt-worker.js': entryChunk('stt-worker', 'require("electron")')
+    }
 
-    expect(() => runWorkerWriteBundle(plugin, bundle)).toThrow('runs as a worker thread')
+    expect(() => runEntryWriteBundle(plugin, bundle)).toThrow('runs as a worker thread')
   })
 
   // The real risk is transitive: a worker entry importing a shared chunk that
   // reaches the electron-requiring client, not a direct import anyone would spot.
   it('follows shared chunks out of a worker entry', () => {
     const plugin = createPlainNodeEntryGuardPlugin()
-    const bundle = {
-      'session-scanner-opencode-sqlite-worker-entry.js': workerChunk(
+    const bundle: Rollup.OutputBundle = {
+      'session-scanner-opencode-sqlite-worker-entry.js': entryChunk(
         'session-scanner-opencode-sqlite-worker-entry',
         'require("./chunks/shared.js")',
         ['chunks/shared.js']
@@ -223,20 +245,20 @@ describe('worker thread entry guard', () => {
         isEntry: false,
         name: 'shared'
       } as Rollup.OutputChunk
-    } as Rollup.OutputBundle
+    }
 
-    expect(() => runWorkerWriteBundle(plugin, bundle)).toThrow('chunks/shared.js')
+    expect(() => runEntryWriteBundle(plugin, bundle)).toThrow('chunks/shared.js')
   })
 
   it('passes a clean worker entry', () => {
     const plugin = createPlainNodeEntryGuardPlugin()
-    const bundle = {
-      'warp-theme-parser-worker.js': workerChunk(
+    const bundle: Rollup.OutputBundle = {
+      'warp-theme-parser-worker.js': entryChunk(
         'warp-theme-parser-worker',
         'require("node:worker_threads")'
       )
-    } as Rollup.OutputBundle
+    }
 
-    expect(() => runWorkerWriteBundle(plugin, bundle)).not.toThrow()
+    expect(() => runEntryWriteBundle(plugin, bundle)).not.toThrow()
   })
 })
diff --git a/config/scripts/playwright-focused-workflow-selection.test.mjs b/config/scripts/playwright-focused-workflow-selection.test.mjs
new file mode 100644
index 000000000000..b78cbec4480e
--- /dev/null
+++ b/config/scripts/playwright-focused-workflow-selection.test.mjs
@@ -0,0 +1,105 @@
+import { mkdirSync, mkdtempSync, readFileSync, realpathSync, rmSync, writeFileSync } from 'node:fs'
+import { createRequire } from 'node:module'
+import { tmpdir } from 'node:os'
+import { dirname, join, resolve } from 'node:path'
+import { expect, it } from 'vitest'
+import { parse } from 'yaml'
+import { runProcess } from '../../src/shared/child-process/run-process'
+
+const require = createRequire(import.meta.url)
+const projectDir = resolve(import.meta.dirname, '../..')
+
+function assertGoldenPlatformCommands(workflow) {
+  const fresh = [
+    'tests/e2e/golden-fresh-profile-terminal.spec.ts',
+    'tests/e2e/golden-shell-command.spec.ts'
+  ]
+  const core = ['tests/e2e/golden-core-flows.spec.ts']
+  for (const [platform, expected] of Object.entries({
+    Linux: [core, fresh],
+    macOS: [core, fresh],
+    Windows: [fresh]
+  })) {
+    const step = workflow.jobs['golden-e2e'].steps.find(
+      (candidate) => candidate.name === `Run golden E2E tests on ${platform}`
+    )
+    expect(step, platform).toMatchObject({ if: `runner.os == '${platform}'` })
+    const args = [...step.run.matchAll(/\bpnpm run test:e2e\s+([^\n]+)/g)].map((match) =>
+      match[1].trim().split(/\s+/)
+    )
+    expect(args, platform).toEqual(expected)
+  }
+}
+
+function focusedArguments() {
+  const commands = []
+  for (const filename of ['terminal-ime-e2e.yml', 'golden-e2e-experiment.yml']) {
+    const workflow = parse(readFileSync(join(projectDir, '.github/workflows', filename), 'utf8'))
+    if (filename === 'golden-e2e-experiment.yml') {
+      assertGoldenPlatformCommands(workflow)
+    }
+    for (const job of Object.values(workflow.jobs)) {
+      for (const step of job.steps) {
+        for (const match of (step.run ?? '').matchAll(/\bpnpm run test:e2e\s+([^\n]+)/g)) {
+          commands.push(match[1].trim().split(/\s+/))
+        }
+      }
+    }
+  }
+  const runner = readFileSync(
+    join(projectDir, 'config/scripts/run-terminal-ibus-hangul-e2e.mjs'),
+    'utf8'
+  )
+  const native = runner.match(/\[\s*'run',\s*'test:e2e:headful',([\s\S]*?)\]/)
+  expect(native).not.toBeNull()
+  expect(native[1].replace(/'[^']*'|[\s,]/g, '')).toBe('')
+  commands.push([...native[1].matchAll(/'([^']*)'/g)].map((match) => match[1]))
+  return [...new Map(commands.map((args) => [JSON.stringify(args), args])).values()]
+}
+
+it('focused IME and golden commands discover only their requested files with the installed Playwright CLI', async () => {
+  const commands = focusedArguments()
+  expect(commands).toHaveLength(4)
+  const directory = realpathSync(mkdtempSync(join(tmpdir(), 'orca-playwright-focused-')))
+  const config = join(directory, 'playwright.config.cjs')
+  const testPackage = JSON.stringify(require.resolve('@stablyai/playwright-test'))
+  try {
+    mkdirSync(join(directory, 'tests/e2e'), { recursive: true })
+    writeFileSync(config, "module.exports = { testDir: '.', testMatch: '**/*.spec.ts' }")
+    const requestedFiles = commands.flatMap((args) =>
+      args.filter((arg) => arg.endsWith('.spec.ts'))
+    )
+    for (const filename of new Set([...requestedFiles, 'tests/e2e/unrelated.spec.ts'])) {
+      writeFileSync(
+        join(directory, filename),
+        `const { test } = require(${testPackage}); test('selected', () => {});`
+      )
+    }
+    for (const args of commands) {
+      const result = await runProcess({
+        program: process.execPath,
+        cwd: directory,
+        args: [
+          join(dirname(require.resolve('playwright/package.json')), 'cli.js'),
+          'test',
+          '--config',
+          config,
+          '--list',
+          '--reporter=json',
+          ...args
+        ],
+        env: { ...process.env, ORCA_BACKGROUND_LAUNCH: '1' },
+        timeoutMs: 20_000
+      })
+      expect(result.code, result.stderr).toBe(0)
+      const report = JSON.parse(result.stdout)
+      const expected = args.filter((arg) => arg.endsWith('.spec.ts')).sort()
+      expect(
+        report.suites.map((suite) => suite.file.replaceAll('\\', '/')).sort(),
+        JSON.stringify(args)
+      ).toEqual(expected)
+    }
+  } finally {
+    rmSync(directory, { recursive: true, force: true })
+  }
+}, 30_000)
diff --git a/config/scripts/pr-code-change-scope.mjs b/config/scripts/pr-code-change-scope.mjs
index babe8e8c7e05..98dc914052af 100644
--- a/config/scripts/pr-code-change-scope.mjs
+++ b/config/scripts/pr-code-change-scope.mjs
@@ -44,6 +44,7 @@ const GLOBAL_FORCE_PREFIXES = [
 const GLOBAL_FORCE_FILES = new Set(['package.json', 'pnpm-lock.yaml'])
 
 const GIT_COMPAT_PREFIXES = [
+  '.github/actions/prepare-git-compatibility/',
   'src/shared/git-',
   'src/shared/review-head-tracking-ref',
   'src/main/git/',
@@ -112,6 +113,9 @@ const ORCAD_BROWSER_PREFIXES = [
 // import, and the shell policy the render check runs the page under.
 const MOBILE_WEB_APP_PREFIXES = [
   'config/scripts/build-mobile-web-app',
+  'config/scripts/run-mobile-web-app-checks',
+  'config/scripts/script-child-process.mjs',
+  'src/shared/child-process/',
   'config/scripts/verify-mobile-web-app-bundle',
   'config/scripts/mobile-web-app-',
   'config/scripts/mobile-web-bundle-',
@@ -142,11 +146,14 @@ const CROSS_VERSION_WIRE_PREFIXES = [
   'src/shared/rpc-contract/agent-launch-params',
   'src/shared/agent-session-wire',
   'src/shared/agent-session-mutation-envelope',
+  'src/shared/agent-session-record',
   'src/shared/agent-session-journal-',
   'src/main/ai-vault/structured-session-ownership.ts',
   'src/main/native-chat/agent-session-journal/',
   'src/main/native-chat/agent-session-wire/',
   'src/main/runtime/agent-session-record-store',
+  'src/main/runtime/agent-session-recovery-capsule',
+  'src/shared/agent-session-resume-marker',
   'src/main/runtime/rpc/dispatcher',
   'src/main/runtime/rpc/methods/agent-launch',
   'src/main/runtime/rpc/methods/ai-vault.ts',
@@ -154,6 +161,9 @@ const CROSS_VERSION_WIRE_PREFIXES = [
   'src/main/runtime/rpc/methods/session-tabs.ts',
   'src/main/runtime/rpc/methods/structured-agent-session',
   'src/main/runtime/rpc/methods/terminal',
+  'src/main/runtime/runtime-worktree-agent-',
+  'src/main/runtime/runtime-worktree-pty-agent-sources',
+  'src/shared/runtime-worktree-contracts',
   'src/renderer/src/runtime/remote-runtime-terminal-multiplexer'
 ]
 
@@ -215,6 +225,10 @@ const SHARED_PACKAGE_PREFIXES = [
 
 const LINUX_PACKAGE_PREFIXES = [
   ...SHARED_PACKAGE_PREFIXES,
+  'config/scripts/package-linux-formats',
+  'config/scripts/script-child-process.mjs',
+  'config/scripts/space-sharing-copy.mjs',
+  '.github/actions/prepare-linux-package-fixture/',
   'config/docker/cli-launch-contract/',
   'config/docker/headless-pairing/',
   'config/docker/headless-serve-shutdown/',
@@ -251,6 +265,7 @@ const WINDOWS_PACKAGE_TESTS = [
   'config/scripts/rebuild-native-deps.test.mjs',
   'config/scripts/rebuild-native-deps-windows-process-tree.test.mjs',
   'config/scripts/rebuild-native-deps-node-pty.test.mjs',
+  'config/scripts/nsis-process-check.test.mjs',
   'config/scripts/ensure-native-runtime-job-ownership.test.mjs',
   'config/scripts/verify-packaged-node-pty-job-ownership.test.mjs',
   'config/scripts/windows-pe-machine.test.mjs',
@@ -271,6 +286,7 @@ const WINDOWS_PACKAGE_TESTS = [
   'src/main/windows/windows-host-job.win32.test.ts',
   'src/main/windows/windows-process-tree-command-line-patch.test.ts',
   'src/main/windows/windows-process-table-native-addon.win32.test.ts',
+  'src/main/persistence/profile-state/profile-state-access-windows-native.win32.test.ts',
   'src/main/windows-live-tree-kill.win32.test.ts',
   'src/main/wsl/wsl-runner.test.ts',
   'src/main/wsl/wsl-guest-environment.test.ts',
diff --git a/config/scripts/pr-code-change-scope.test.mjs b/config/scripts/pr-code-change-scope.test.mjs
index cab82db3e031..c23ea0e11406 100644
--- a/config/scripts/pr-code-change-scope.test.mjs
+++ b/config/scripts/pr-code-change-scope.test.mjs
@@ -129,6 +129,9 @@ describe('per-job path classification', () => {
     expectClassification(['src/shared/git-binary-compatibility.test.ts'], {
       git_compatibility: true
     })
+    expectClassification(['.github/actions/prepare-git-compatibility/action.yml'], {
+      git_compatibility: true
+    })
   })
 
   it('runs the Codex index-heal contract only when the heal or its transport changes', () => {
@@ -195,6 +198,10 @@ describe('per-job path classification', () => {
 
   it('runs Linux packaging when an artifact contract changes', () => {
     for (const file of [
+      'config/scripts/package-linux-formats.mjs',
+      'config/scripts/script-child-process.mjs',
+      'config/scripts/space-sharing-copy.mjs',
+      '.github/actions/prepare-linux-package-fixture/action.yml',
       'config/docker/cli-launch-contract/Dockerfile',
       'config/docker/cli-launch-contract/run-cli-case.sh',
       'config/docker/headless-pairing/Dockerfile',
@@ -204,7 +211,10 @@ describe('per-job path classification', () => {
       'config/scripts/run-headless-linux-pairing-docker.mjs',
       'config/scripts/static-appimage-package-contract.cjs'
     ]) {
-      expectClassification([file], { package: true })
+      expectClassification([file], {
+        package: true,
+        mobile_web_app: file === 'config/scripts/script-child-process.mjs'
+      })
     }
   })
 
@@ -216,7 +226,10 @@ describe('per-job path classification', () => {
       'config/docker/daemon-shutdown-descendants/run-case.sh',
       'config/scripts/run-daemon-shutdown-descendants-docker.mjs'
     ]) {
-      expectClassification([file], { package: true })
+      expectClassification([file], {
+        package: true,
+        mobile_web_app: file === 'config/scripts/script-child-process.mjs'
+      })
     }
     for (const file of [
       'src/main/daemon/terminal-host.ts',
@@ -281,6 +294,9 @@ describe('per-job path classification', () => {
   it('runs the mobile web app job for the builder, the page source and the shell policy', () => {
     for (const file of [
       'config/scripts/build-mobile-web-app-bundle.mjs',
+      'config/scripts/run-mobile-web-app-checks.mjs',
+      'config/scripts/script-child-process.mjs',
+      'src/shared/child-process/run-process.ts',
       'config/scripts/mobile-web-app-route-manifest.mjs',
       'mobile/web-entry/index.tsx',
       'mobile/app/h/[hostId]/index.tsx',
@@ -334,6 +350,9 @@ describe('per-job path classification', () => {
       'src/main/runtime/rpc/methods/structured-agent-session-hold.ts',
       'src/main/runtime/rpc/methods/structured-agent-session-schemas.ts',
       'src/main/runtime/rpc/methods/terminal.ts',
+      'src/main/runtime/runtime-worktree-agent-rows.ts',
+      'src/main/runtime/runtime-worktree-pty-agent-sources.ts',
+      'src/shared/runtime-worktree-contracts.ts',
       'src/renderer/src/runtime/remote-runtime-terminal-multiplexer.ts'
     ]) {
       expectClassification([file], {
@@ -511,12 +530,19 @@ describe('PR Checks skip wiring', () => {
     )
     expect(classify.run).toContain('--diff-filter=ACDMR')
     expect(classify.run).toContain('--no-renames')
-    expect(classify.run).toContain('--merge-base "$BASE_SHA" "$HEAD_SHA"')
+    // HEAD is the merge commit, so HEAD^1 is the base side and no merge base is computed.
+    // That is what lets this job check out shallowly, which every other job waits on.
+    expect(classify.run).toContain('node config/scripts/git-pull-request-diff-base.mjs "$BASE_SHA"')
+    expect(classify.run).toContain('"$DIFF_BASE" HEAD')
+    expect(classify.run).not.toContain('--merge-base "$')
     expect(classify.run).toContain('node config/scripts/pr-code-change-scope.mjs')
     expect(classify.run).toContain('tee -a "$GITHUB_OUTPUT"')
-    for (const jobName of ['should_run', 'native_cache_changed', ...expensiveJobs]) {
+    expect(prWorkflow.jobs.code_paths.outputs.should_run).toBe(
+      '${{ steps.filter.outputs.should_run }}'
+    )
+    for (const jobName of ['native_cache_changed', ...expensiveJobs]) {
       expect(prWorkflow.jobs.code_paths.outputs[jobName], jobName).toBe(
-        `\${{ steps.filter.outputs.${jobName} }}`
+        `\${{ steps.readiness.outputs.reused != 'true' && steps.filter.outputs.${jobName} }}`
       )
     }
   })
@@ -546,19 +572,35 @@ describe('PR Checks skip wiring', () => {
     expect(installStep.run).toContain('--frozen-lockfile')
   })
 
-  it('keeps the cheap root-directory guard on docs-only PRs', () => {
-    expect(prWorkflow.jobs.root_directory_guard.if).toBeUndefined()
-    expect(prWorkflow.jobs.root_directory_guard.needs).toBeUndefined()
+  it('keeps the root and README guards on docs-only PRs without another runner', () => {
+    const detector = prWorkflow.jobs.code_paths
+    expect(detector.if).toBeUndefined()
+    expect(detector.needs).toBeUndefined()
+    for (const name of ['Reject new root-level files and folders', 'Check README local links']) {
+      const step = detector.steps.find((candidate) => candidate.name === name)
+      expect(step).toBeDefined()
+      expect(step.if).toBeUndefined()
+    }
+    expect(prWorkflow.jobs.root_directory_guard).toBeUndefined()
   })
 
   it('gates each expensive job on its classifier and cache prerequisite', () => {
     for (const jobName of expensiveJobs.filter((jobName) => jobName !== 'test')) {
-      expect(prWorkflow.jobs[jobName].needs, jobName).toEqual(['code_paths'])
+      expect(prWorkflow.jobs[jobName].needs, jobName).toEqual(
+        ['package', 'package_windows'].includes(jobName)
+          ? ['code_paths', 'static_analysis', 'typecheck']
+          : ['code_paths']
+      )
       expect(prWorkflow.jobs[jobName].if, jobName).toBe(
         `needs.code_paths.outputs.${jobName} == 'true'`
       )
     }
-    expect(prWorkflow.jobs.test.needs).toEqual(['code_paths', 'test_native_cache'])
+    expect(prWorkflow.jobs.test.needs).toEqual([
+      'code_paths',
+      'test_native_cache',
+      'static_analysis',
+      'typecheck'
+    ])
     expect(prWorkflow.jobs.test.if).toContain("needs.code_paths.outputs.test == 'true'")
     expect(prWorkflow.jobs.test.if).toContain("needs.test_native_cache.result == 'success'")
     expect(prWorkflow.jobs.test.if).toContain("needs.test_native_cache.result == 'skipped'")
@@ -587,12 +629,12 @@ describe('PR Checks skip wiring', () => {
     )
     expect(prWorkflow.jobs.verify.needs[0]).toBe('code_paths')
     expect(verifyStep.env.SHOULD_RUN).toBe('${{ needs.code_paths.outputs.should_run }}')
-    expect(verifyStep.run).toContain('"$ROOT_DIRECTORY_GUARD" != "success"')
+    expect(verifyStep.run).toContain('"$CODE_PATHS" != "success"')
     expect(verifyStep.run).toContain('# Require success when the PR has code-relevant changes')
     expect(verifyStep.run).toContain('expected skipped')
     expect(verifyStep.run).toContain('expected success')
     for (const job of prWorkflow.jobs.verify.needs) {
-      if (job === 'code_paths' || job === 'root_directory_guard') {
+      if (job === 'code_paths') {
         continue
       }
       const envVar = `${job.replaceAll('-', '_').toUpperCase()}_SHOULD_RUN`
diff --git a/config/scripts/pr-e2e-gate-contract.test.mjs b/config/scripts/pr-e2e-gate-contract.test.mjs
index d586f27ff1a6..4bcb1b4f1af1 100644
--- a/config/scripts/pr-e2e-gate-contract.test.mjs
+++ b/config/scripts/pr-e2e-gate-contract.test.mjs
@@ -127,11 +127,10 @@ describe('PR E2E gate contract', () => {
     const successLoop = verifyStep.run.slice(verifyStep.run.indexOf(successMarker))
     expect(successLoop.length).toBeGreaterThan(0)
     expect(verifyStep.run).toContain('"$CODE_PATHS" != "success"')
-    expect(verifyStep.run).toContain('"$ROOT_DIRECTORY_GUARD" != "success"')
     for (const job of prWorkflow.jobs.verify.needs) {
       const envVar = job.replaceAll('-', '_').toUpperCase()
       expect(verifyStep.env[envVar]).toBe(`\${{ needs.${job}.result }}`)
-      if (job === 'code_paths' || job === 'root_directory_guard') {
+      if (job === 'code_paths') {
         continue
       }
       expect(successLoop).toContain(`"$${envVar}"`)
@@ -239,7 +238,7 @@ describe('PR E2E gate contract', () => {
   })
 
   it('scopes detection to the PR range so base drift cannot false-trigger', () => {
-    expect(filterStep.run).toContain('--merge-base "$BASE" "$HEAD"')
+    expect(filterStep.run).toMatch(/diff-base\.mjs "\$BASE"[\s\S]*"\$DIFF_BASE" HEAD/)
     expect(filterStep.run).toContain('set -euo pipefail')
   })
 
@@ -445,7 +444,7 @@ describe('PR E2E gate contract', () => {
   })
 
   it('scopes the VM rollback oracle to the PR range and recipe schema authorities', () => {
-    expect(rollbackStep.run).toContain('--merge-base "$BASE_SHA" "$HEAD_SHA"')
+    expect(rollbackStep.run).toMatch(/diff-base\.mjs "\$BASE_SHA"[\s\S]*"\$DIFF_BASE" HEAD --/)
     expect(rollbackStep.run).toContain('src/shared/ephemeral-vm-recipes.ts')
     expect(rollbackStep.run).toContain('src/shared/orca-yaml-hook-types.ts')
     expect(selectPrE2eSpecs(['src/shared/ephemeral-vm-recipes.ts'])).toEqual([
diff --git a/config/scripts/pr-e2e-source-routing.mjs b/config/scripts/pr-e2e-source-routing.mjs
index 9a8f678860f0..f8737ad6ea62 100644
--- a/config/scripts/pr-e2e-source-routing.mjs
+++ b/config/scripts/pr-e2e-source-routing.mjs
@@ -33,6 +33,17 @@ export const PR_E2E_SOURCE_ROUTES = [
           file
         ))
   },
+  {
+    // Why the host-connection phase: the route gate waits on it, so a phase change can strand the
+    // SSH-unavailable card without touching a browser file.
+    id: 'browser.local-ssh-workspace-route',
+    specs: ['tests/e2e/local-ssh-browser-routing.spec.ts'],
+    matches: (file) =>
+      isProductSource(file) &&
+      /^src\/(?:main\/browser\/local-ssh-browser-(?:route|partitions)\.ts|renderer\/src\/(?:components\/browser-pane\/(?:use-ssh-workspace-browser-route\.ts|assemble-chrome\/ssh-routed-browser-page-gate\.tsx)|lib\/worktree-host-connection-phase\.ts))$/.test(
+        file
+      )
+  },
   {
     id: 'terminal.windows-wsl-launch-and-paste',
     specs: [
diff --git a/config/scripts/pr-ready-check-gate.test.mjs b/config/scripts/pr-ready-check-gate.test.mjs
new file mode 100644
index 000000000000..27e5cf991037
--- /dev/null
+++ b/config/scripts/pr-ready-check-gate.test.mjs
@@ -0,0 +1,66 @@
+import { readFileSync } from 'node:fs'
+import { describe, expect, it } from 'vitest'
+import { parse } from 'yaml'
+import { runProcess } from '../../src/shared/child-process/run-process'
+import { PR_CHECK_JOBS } from './pr-code-change-scope.mjs'
+
+const workflow = parse(readFileSync('.github/workflows/pr.yml', 'utf8'))
+const gate = workflow.jobs.verify.steps.find((step) => step.name === 'Require successful checks')
+const variable = (job) => job.replaceAll('-', '_').toUpperCase()
+
+function requiredResults(shouldRun) {
+  return Object.fromEntries(
+    PR_CHECK_JOBS.flatMap((job) => [
+      [variable(job), shouldRun ? 'success' : 'skipped'],
+      [`${variable(job)}_SHOULD_RUN`, String(shouldRun)]
+    ])
+  )
+}
+
+async function verify(results) {
+  return runProcess({
+    program: 'bash',
+    args: ['-c', gate.run],
+    env: {
+      ...process.env,
+      ORCA_BACKGROUND_LAUNCH: '1',
+      CODE_PATHS: 'success',
+      SHOULD_RUN: 'true',
+      ...results
+    },
+    timeoutMs: 10_000
+  })
+}
+
+// The aggregate runs as Bash on Linux; Windows has no required Bash installation.
+describe.skipIf(process.platform === 'win32')(
+  'readiness reuse through the real aggregate gate',
+  () => {
+    it('accepts completed required checks or skips authorized by exact-source evidence', async () => {
+      expect((await verify(requiredResults(true))).code).toBe(0)
+      expect((await verify(requiredResults(false))).code).toBe(0)
+    })
+
+    it('rejects every missing, failed or cancelled required result when reuse is unavailable', async () => {
+      for (const job of PR_CHECK_JOBS) {
+        for (const result of ['', 'skipped', 'failure', 'cancelled']) {
+          const verdict = await verify({ ...requiredResults(true), [variable(job)]: result })
+          expect(verdict.code, `${job}: ${result}`).toBe(1)
+        }
+      }
+    })
+
+    it('requires the detector to succeed even when every downstream job is skipped', async () => {
+      for (const result of ['', 'skipped', 'failure', 'cancelled']) {
+        expect((await verify({ ...requiredResults(false), CODE_PATHS: result })).code).toBe(1)
+      }
+    })
+
+    it('rejects unexpected downstream execution when the proven plan requires skips', async () => {
+      for (const job of PR_CHECK_JOBS) {
+        const verdict = await verify({ ...requiredResults(false), [variable(job)]: 'success' })
+        expect(verdict.code, job).toBe(1)
+      }
+    })
+  }
+)
diff --git a/config/scripts/pr-ready-check-reuse.mjs b/config/scripts/pr-ready-check-reuse.mjs
new file mode 100644
index 000000000000..57e00a740c23
--- /dev/null
+++ b/config/scripts/pr-ready-check-reuse.mjs
@@ -0,0 +1,99 @@
+import { appendFileSync, readFileSync } from 'node:fs'
+import { pathToFileURL } from 'node:url'
+
+export function prCheckRunTitle({ number, sourceSha, workflowSha, unitMode = 'full' }) {
+  return `PR ${number} | source ${sourceSha} | workflow ${workflowSha} | unit ${unitMode}`
+}
+
+export function reusablePrCheckRun(runs, identity) {
+  if (
+    !Number.isSafeInteger(identity.number) ||
+    identity.number < 1 ||
+    ![identity.sourceSha, identity.workflowSha, identity.headSha].every((sha) =>
+      /^[a-f0-9]{40}$/.test(sha ?? '')
+    )
+  ) {
+    return undefined
+  }
+  return runs.find(
+    (run) =>
+      Number.isSafeInteger(run.id) &&
+      run.id > 0 &&
+      String(run.id) !== identity.runId &&
+      run.path === '.github/workflows/pr.yml' &&
+      run.event === 'pull_request' &&
+      run.status === 'completed' &&
+      run.conclusion === 'success' &&
+      run.head_sha === identity.headSha &&
+      run.display_title === prCheckRunTitle(identity)
+  )
+}
+
+export async function lookupReadyCheckRun(env, event, request = fetch) {
+  if (
+    env.GITHUB_EVENT_NAME !== 'pull_request' ||
+    event.action !== 'ready_for_review' ||
+    event.pull_request?.draft !== false
+  ) {
+    return undefined
+  }
+  const identity = {
+    number: event.pull_request?.number,
+    headSha: event.pull_request?.head?.sha,
+    sourceSha: env.GITHUB_SHA,
+    workflowSha: env.PR_CHECK_WORKFLOW_SHA,
+    runId: env.GITHUB_RUN_ID
+  }
+  const repository = env.GITHUB_REPOSITORY
+  if (!/^[\w.-]+\/[\w.-]+$/.test(repository ?? '') || !env.GH_TOKEN) {
+    return undefined
+  }
+  const url = new URL(
+    `/repos/${repository}/actions/workflows/pr.yml/runs`,
+    env.GITHUB_API_URL ?? 'https://api.github.com'
+  )
+  url.search = new URLSearchParams({
+    event: 'pull_request',
+    head_sha: identity.headSha ?? '',
+    status: 'success',
+    per_page: '20'
+  }).toString()
+  try {
+    const response = await request(url, {
+      headers: {
+        Accept: 'application/vnd.github+json',
+        Authorization: `Bearer ${env.GH_TOKEN}`,
+        'User-Agent': 'orca-pr-ready-check-reuse',
+        'X-GitHub-Api-Version': '2022-11-28'
+      },
+      signal: AbortSignal.timeout(10_000)
+    })
+    if (!response.ok) {
+      throw new Error(`Run lookup returned HTTP ${response.status}`)
+    }
+    const result = await response.json()
+    if (!Array.isArray(result.workflow_runs)) {
+      throw new Error('Run lookup omitted workflow runs')
+    }
+    return reusablePrCheckRun(result.workflow_runs, identity)
+  } catch (error) {
+    console.log(`No reusable result: ${error.message}; running the required checks.`)
+    return undefined
+  }
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  let run
+  try {
+    const event = JSON.parse(readFileSync(process.env.GITHUB_EVENT_PATH, 'utf8'))
+    run = await lookupReadyCheckRun(process.env, event)
+  } catch (error) {
+    console.log(`No reusable result: ${error.message}; running the required checks.`)
+  }
+  appendFileSync(process.env.GITHUB_OUTPUT, `reused=${Boolean(run)}\nrun_id=${run?.id ?? ''}\n`)
+  console.log(
+    run
+      ? `Required checks already passed for this source and workflow: ${run.html_url}`
+      : 'No identical successful run found; running the required checks.'
+  )
+}
diff --git a/config/scripts/pr-ready-check-reuse.test.mjs b/config/scripts/pr-ready-check-reuse.test.mjs
new file mode 100644
index 000000000000..1d64542a6144
--- /dev/null
+++ b/config/scripts/pr-ready-check-reuse.test.mjs
@@ -0,0 +1,172 @@
+import { readFileSync } from 'node:fs'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { parse } from 'yaml'
+import { PR_CHECK_JOBS } from './pr-code-change-scope.mjs'
+import {
+  lookupReadyCheckRun,
+  prCheckRunTitle,
+  reusablePrCheckRun
+} from './pr-ready-check-reuse.mjs'
+
+const identity = {
+  number: 42,
+  sourceSha: 'a'.repeat(40),
+  workflowSha: 'b'.repeat(40),
+  headSha: 'c'.repeat(40),
+  runId: '456'
+}
+const passed = {
+  id: 123,
+  path: '.github/workflows/pr.yml',
+  event: 'pull_request',
+  status: 'completed',
+  conclusion: 'success',
+  head_sha: identity.headSha,
+  display_title: prCheckRunTitle(identity)
+}
+const event = {
+  action: 'ready_for_review',
+  pull_request: { number: 42, draft: false, head: { sha: identity.headSha } }
+}
+const env = {
+  GITHUB_EVENT_NAME: 'pull_request',
+  GITHUB_SHA: identity.sourceSha,
+  PR_CHECK_WORKFLOW_SHA: identity.workflowSha,
+  GITHUB_RUN_ID: identity.runId,
+  GITHUB_REPOSITORY: 'stablyai/orca',
+  GH_TOKEN: 'read-only-test-token'
+}
+const response = (runs) => ({ ok: true, json: async () => ({ workflow_runs: runs }) })
+const workflow = parse(readFileSync('.github/workflows/pr.yml', 'utf8'))
+
+afterEach(() => vi.restoreAllMocks())
+
+describe('ready-for-review required check reuse', () => {
+  it('reuses a completed success only for the identical PR, merge source and workflow', () => {
+    expect(reusablePrCheckRun([passed], identity)).toBe(passed)
+    expect(reusablePrCheckRun([], identity)).toBeUndefined()
+    expect(
+      reusablePrCheckRun(
+        [{ ...passed, display_title: prCheckRunTitle({ ...identity, unitMode: 'selected' }) }],
+        identity
+      )
+    ).toBeUndefined()
+    for (const key of ['number', 'sourceSha', 'workflowSha', 'headSha', 'runId']) {
+      const changed = key === 'number' ? 43 : key === 'runId' ? '123' : 'd'.repeat(40)
+      expect(reusablePrCheckRun([passed], { ...identity, [key]: changed }), key).toBeUndefined()
+    }
+    for (const key of ['number', 'sourceSha', 'workflowSha', 'headSha']) {
+      expect(reusablePrCheckRun([passed], { ...identity, [key]: undefined }), key).toBeUndefined()
+    }
+  })
+
+  it.each([
+    { status: 'in_progress' },
+    { status: 'queued' },
+    { conclusion: 'failure' },
+    { conclusion: 'cancelled' },
+    { conclusion: 'skipped' },
+    { event: 'push' },
+    { path: '.github/workflows/other.yml' },
+    { display_title: 'Previous workflow without source provenance' },
+    { id: -1 }
+  ])('rejects unusable evidence %j', (change) => {
+    expect(reusablePrCheckRun([{ ...passed, ...change }], identity)).toBeUndefined()
+  })
+
+  it('bounds the read-only lookup to this workflow and PR head', async () => {
+    const request = vi.fn(async () => response([passed]))
+    expect(await lookupReadyCheckRun(env, event, request)).toBe(passed)
+    expect(request).toHaveBeenCalledTimes(1)
+    const [url, options] = request.mock.calls[0]
+    expect(url.origin).toBe('https://api.github.com')
+    expect(url.pathname).toBe('/repos/stablyai/orca/actions/workflows/pr.yml/runs')
+    expect(Object.fromEntries(url.searchParams)).toEqual({
+      event: 'pull_request',
+      head_sha: identity.headSha,
+      status: 'success',
+      per_page: '20'
+    })
+    expect(options.method).toBeUndefined()
+    expect(options.signal).toBeInstanceOf(AbortSignal)
+  })
+
+  it('runs ordinary pushes and draft checks without consulting old results', async () => {
+    const request = vi.fn()
+    for (const action of ['opened', 'synchronize', 'reopened', 'converted_to_draft']) {
+      expect(await lookupReadyCheckRun(env, { ...event, action }, request)).toBeUndefined()
+    }
+    expect(
+      await lookupReadyCheckRun(
+        env,
+        { ...event, pull_request: { ...event.pull_request, draft: true } },
+        request
+      )
+    ).toBeUndefined()
+    expect(await lookupReadyCheckRun({ ...env, GH_TOKEN: '' }, event, request)).toBeUndefined()
+    expect(
+      await lookupReadyCheckRun({ ...env, GITHUB_EVENT_NAME: 'push' }, event, request)
+    ).toBeUndefined()
+    expect(request).not.toHaveBeenCalled()
+  })
+
+  it('falls back to full checks when the API is unavailable or evidence is malformed', async () => {
+    vi.spyOn(console, 'log').mockImplementation(() => {})
+    for (const request of [
+      async () => ({ ok: false, status: 403 }),
+      async () => ({ ok: false, status: 429 }),
+      async () => ({ ok: true, json: async () => ({}) }),
+      async () => {
+        throw new Error('Network unavailable')
+      }
+    ]) {
+      expect(await lookupReadyCheckRun(env, event, request)).toBeUndefined()
+    }
+    expect(await lookupReadyCheckRun(env, event, async () => response([]))).toBeUndefined()
+  })
+
+  it('keeps required skips conditional on proof and leaves advisory routing eligible', () => {
+    expect(workflow['run-name']).toBe(
+      "PR ${{ github.event.pull_request.number }} | source ${{ github.sha }} | workflow ${{ github.workflow_sha }} | unit ${{ github.event.pull_request.draft && vars.ORCA_UNIT_SELECTION_MODE == 'selected' && 'selected' || 'full' }}"
+    )
+    expect(workflow.on.pull_request.types).toContain('ready_for_review')
+    const detector = workflow.jobs.code_paths
+    expect(detector.permissions).toEqual({ contents: 'read', actions: 'read' })
+    const readiness = detector.steps.find((step) => step.id === 'readiness')
+    expect(readiness.if).toBe("github.event.action == 'ready_for_review'")
+    expect(readiness.env.PR_CHECK_WORKFLOW_SHA).toBe('${{ github.workflow_sha }}')
+    expect(readiness.run).toBe('node config/scripts/pr-ready-check-reuse.mjs')
+    expect(detector.steps[0].with['sparse-checkout']).toContain(
+      '/config/scripts/pr-ready-check-reuse.mjs'
+    )
+    for (const job of ['native_cache_changed', ...PR_CHECK_JOBS]) {
+      expect(detector.outputs[job]).toBe(
+        `\${{ steps.readiness.outputs.reused != 'true' && steps.filter.outputs.${job} }}`
+      )
+    }
+    expect(detector.outputs.should_run).toBe('${{ steps.filter.outputs.should_run }}')
+    for (const name of [
+      'test_files',
+      'ssh_source_changed',
+      'native_ime_source_changed',
+      'wsl_source_changed'
+    ]) {
+      expect(detector.outputs[name]).toBe(`\${{ steps.e2e_filter.outputs.${name} }}`)
+    }
+    expect(detector.steps.find((step) => step.id === 'e2e_filter').if).toBe(
+      "github.event.pull_request.draft != true && steps.filter.outputs.should_run == 'true'"
+    )
+    expect(workflow.jobs.verify.if).toBe('${{ !cancelled() }}')
+    expect(workflow.jobs.verify.needs).toEqual(['code_paths', ...PR_CHECK_JOBS])
+  })
+
+  it.each(['pr-test-loc.yml', 'mobile.yml'])(
+    'does not rerun draft-independent %s on readiness changes',
+    (file) => {
+      const source = readFileSync(`.github/workflows/${file}`, 'utf8')
+      const independent = parse(source)
+      expect(independent.on.pull_request.types).toEqual(['opened', 'synchronize', 'reopened'])
+      expect(source).not.toContain('pull_request.draft')
+    }
+  )
+})
diff --git a/config/scripts/pr-test-loc-summary.test.mjs b/config/scripts/pr-test-loc-summary.test.mjs
index 044b645a29ca..d206c3c09a09 100644
--- a/config/scripts/pr-test-loc-summary.test.mjs
+++ b/config/scripts/pr-test-loc-summary.test.mjs
@@ -233,7 +233,7 @@ describe('PR test LoC summary', () => {
   })
 
   it('is a no-checkout GitHub-hosted PR workflow', () => {
-    expect(locJob['runs-on']).toBe('ubuntu-latest')
+    expect(locJob['runs-on']).toBe('ubuntu-slim')
     expect(locJob.steps).toHaveLength(1)
     expect(locStep.run).toContain('gh api')
     expect(locStep.run).toContain('pr-test-loc-table.mjs')
diff --git a/config/scripts/pr-workflow-parallelism.test.mjs b/config/scripts/pr-workflow-parallelism.test.mjs
index 0ed60ffb4bb7..b08365f5baf2 100644
--- a/config/scripts/pr-workflow-parallelism.test.mjs
+++ b/config/scripts/pr-workflow-parallelism.test.mjs
@@ -1,9 +1,15 @@
 import { existsSync, globSync, readFileSync } from 'node:fs'
 import { parse } from 'yaml'
 import { describe, expect, it } from 'vitest'
+import { UNIT_EXCLUDE } from './ci-unit-files.mjs'
+import { mobileWebCheckArgs } from './run-mobile-web-app-checks.mjs'
 import { MOBILE_WEB_APP_DEPENDENCIES_REQUIRED_ENV } from './mobile-web-app-bundle-dependencies.mjs'
 
 const workflow = parse(readFileSync('.github/workflows/pr.yml', 'utf8'))
+const prTestLocWorkflow = parse(readFileSync('.github/workflows/pr-test-loc.yml', 'utf8'))
+const trackingWorkflow = parse(readFileSync('.github/workflows/track-community-prs.yaml', 'utf8'))
+const releasePolicyWorkflow = parse(readFileSync('.github/workflows/release-policy.yml', 'utf8'))
+const issueLabelWorkflow = parse(readFileSync('.github/workflows/issue-os-labeler.yaml', 'utf8'))
 const unitTestWorkflow = parse(readFileSync('.github/workflows/unit-tests.yml', 'utf8'))
 const nodeNextWorkflow = parse(readFileSync('.github/workflows/node-next-compat.yml', 'utf8'))
 const dependencyAction = parse(
@@ -43,16 +49,29 @@ const realZshUsage =
   /(?:spawnSync|execFileSync|spawn)\(\s*['"](?:\/(?:usr\/)?bin\/)?zsh['"]|spawnSync\(\s*['"]which['"]\s*,\s*\[\s*['"]zsh['"]|name:\s*['"]zsh['"]\s*,\s*path:\s*executablePath|from '[^']*zsh-startup-hook-pty-harness'/
 
 describe('PR workflow parallelism', () => {
+  it('keeps lightweight orchestration jobs on the free slim runner', () => {
+    expect(workflow.jobs.code_paths['runs-on']).toBe('ubuntu-slim')
+    expect(workflow.jobs.typecheck['runs-on']).toBe('ubuntu-24.04-arm')
+    expect(workflow.jobs.verify['runs-on']).toBe('ubuntu-slim')
+    expect(prTestLocWorkflow.jobs.loc['runs-on']).toBe('ubuntu-slim')
+    expect(trackingWorkflow.jobs['track-community-pr']['runs-on']).toBe('ubuntu-slim')
+    expect(releasePolicyWorkflow.jobs.enforce['runs-on']).toBe('ubuntu-slim')
+    expect(issueLabelWorkflow.jobs['apply-os-label']['runs-on']).toBe('ubuntu-slim')
+  })
+
   it('cancels superseded runs for the same pull request', () => {
     expect(workflow.concurrency.group).toBe('pr-checks-${{ github.event.pull_request.number }}')
     expect(workflow.concurrency['cancel-in-progress']).toBe(true)
+    expect(workflow.jobs.test.if).toContain('!cancelled()')
+    expect(workflow.jobs.test.if).not.toContain('always()')
+    expect(workflow.jobs.verify.if).toBe('${{ !cancelled() }}')
   })
 
   it('grants the PR workflow read-only repository access', () => {
     expect(workflow.permissions).toEqual({ contents: 'read' })
   })
 
-  it('runs Node 24 on PRs and the same eight-shard suite on Node 26 daily', () => {
+  it('runs all eight shards on ARM for PRs and both Node versions on x86 daily', () => {
     const sharedTest = unitTestWorkflow.jobs.test
     const testStep = sharedTest.steps.find((step) => step.name === 'Test shard')
     const installStep = sharedTest.steps.find(
@@ -68,25 +87,38 @@ describe('PR workflow parallelism', () => {
     expect(workflow.jobs.test.uses).toBe('./.github/workflows/unit-tests.yml')
     expect(JSON.parse(workflow.jobs.test.with.node_versions)).toEqual(['24'])
     expect(nodeNextWorkflow.jobs.test.uses).toBe('./.github/workflows/unit-tests.yml')
-    expect(JSON.parse(nodeNextWorkflow.jobs.test.with.node_versions)).toEqual(['26'])
+    expect(JSON.parse(nodeNextWorkflow.jobs.test.with.node_versions)).toEqual(['24', '26'])
+    expect(workflow.jobs.test.with.runner).toBe('ubuntu-24.04-arm')
+    expect(workflow.jobs.test_native_cache['runs-on']).toBe('ubuntu-24.04-arm')
+    expect(sharedTest['runs-on']).toBe('${{ inputs.runner }}')
+    expect(unitTestWorkflow.on.workflow_call.inputs.runner.default).toBe('ubuntu-latest')
+    expect(nodeNextWorkflow.jobs.test.with.runner).toBeUndefined()
+    expect(nodeNextWorkflow.jobs.test_native_cache['runs-on']).toBe('ubuntu-latest')
+    expect(nodeNextWorkflow.jobs.test_native_cache.strategy.matrix.node).toEqual(['24', '26'])
+    const relay = unitTestWorkflow.jobs.relay_integration
+    expect(relay.strategy.matrix.node).toBe('${{ fromJSON(inputs.node_versions) }}')
+    expect(relay['runs-on']).toBe('ubuntu-latest')
+    expect(
+      relay.steps.find((step) => step.uses === './.github/actions/install-node-dependencies').with[
+        'node-version'
+      ]
+    ).toBe('${{ matrix.node }}')
     expect(nodeNextWorkflow.on.schedule).toHaveLength(1)
     expect(nodeNextWorkflow.on.workflow_dispatch).toBeNull()
     expect(sharedTest.strategy.matrix.node).toBe('${{ fromJSON(inputs.node_versions) }}')
-    expect(sharedTest.strategy.matrix.shard).toEqual(
-      Array.from({ length: 8 }, (_, index) => index + 1)
-    )
-    expect(sharedTest.strategy.matrix.shard_total).toEqual([8])
+    expect(sharedTest.strategy.matrix.shard).toBe('${{ fromJSON(needs.plan.outputs.shards) }}')
+    expect(sharedTest.needs).toBe('plan')
     expect(installStep.with['node-version']).toBe('${{ matrix.node }}')
     expect(installStep.with['cache-electron-package']).toBe('true')
-    expect(testStep.run).toContain('--shard=${{ matrix.shard }}/${{ matrix.shard_total }}')
+    expect(testStep.run).toContain('--shard=${{ matrix.shard.index }}/${{ matrix.shard.count }}')
     for (const testFile of nativeShellContractFiles) {
-      expect(testStep.run).toContain(`--exclude=${testFile}`)
+      expect(UNIT_EXCLUDE).toContain(testFile)
     }
     expect(primerInstall.with['native-runtime']).toBe('node')
     expect(primerInstall.with['node-version']).toBe('24')
     expect(workflow.jobs.test.needs).toContain('test_native_cache')
     expect(nodeNextPrimerInstall.with['native-runtime']).toBe('node')
-    expect(nodeNextPrimerInstall.with['node-version']).toBe('26')
+    expect(nodeNextPrimerInstall.with['node-version']).toBe('${{ matrix.node }}')
     expect(nodeNextWorkflow.jobs.test.needs).toEqual(['test_native_cache'])
   })
 
@@ -252,11 +284,20 @@ describe('PR workflow parallelism', () => {
     expect(steps[pnpmIndex].uses).toBe('pnpm/setup@v2')
     expect(steps[pnpmIndex].with.version).toBeUndefined()
     expect(steps[pnpmIndex].with.install).toBe(false)
-    expect(steps[nodeIndex].with.cache).toBe('pnpm')
+    const saveOutsidePrs = "${{ github.event_name != 'pull_request' && 'pnpm' || '' }}"
+    expect(steps[nodeIndex].with.cache).toBe(saveOutsidePrs)
     expect(steps[nodeIndex].if).toBe("inputs.node-version == ''")
     expect(steps[requestedNodeIndex].if).toBe("inputs.node-version != ''")
     expect(steps[requestedNodeIndex].with['node-version']).toBe('${{ inputs.node-version }}')
-    expect(steps[requestedNodeIndex].with.cache).toBe('pnpm')
+    expect(steps[requestedNodeIndex].with.cache).toBe(saveOutsidePrs)
+    const restoreIndex = steps.findIndex(
+      (step) => step.name === 'Restore pnpm download store without saving'
+    )
+    expect(restoreIndex).toBeGreaterThan(requestedNodeIndex)
+    expect(restoreIndex).toBeLessThan(
+      steps.findIndex((step) => step.name === 'Install dependencies')
+    )
+    expect(steps[restoreIndex].uses).toBe('actions/cache/restore@v5')
   })
 
   it('uses the repository package-manager version for every direct pnpm setup', () => {
@@ -297,9 +338,10 @@ describe('PR workflow parallelism', () => {
       (step) => step.uses === './.github/actions/install-node-dependencies'
     )
 
-    for (const jobName of ['typecheck', 'git_compatibility', 'xterm_patch_sync']) {
+    for (const jobName of ['typecheck', 'git_compatibility']) {
       expect(installFor(jobName).with, jobName).toBeUndefined()
     }
+    expect(installFor('xterm_patch_sync')).toBeUndefined()
     expect(installFor('static_analysis').with['native-runtime']).toBe('node')
     expect(installFor('shell_contracts').with['native-runtime']).toBe('node')
     expect(sharedTestInstall.with['native-runtime']).toBe('node')
@@ -414,7 +456,9 @@ describe('PR workflow parallelism', () => {
     expect(electronCacheResolution.if).toBe(
       "inputs.native-runtime == 'electron' || inputs.cache-electron-package == 'true'"
     )
-    expect(electronCache.if).toBe(electronCacheResolution.if)
+    expect(electronCache.if).toBe(
+      "(github.event_name != 'pull_request' || runner.os != 'Linux') && steps.electron-package-cache.outputs.version != ''"
+    )
     expect(electronCache.uses).toBe('actions/cache@v5')
     expect(electronCache.with.key).toContain('steps.electron-package-cache.outputs.version')
     expect(dependencyAction.inputs['cache-electron-package'].default).toBe('false')
@@ -456,7 +500,6 @@ describe('PR workflow parallelism', () => {
     expect(workflow.jobs.verify.needs).toEqual([
       'code_paths',
       'static_analysis',
-      'root_directory_guard',
       'typecheck',
       'git_compatibility',
       'codex_index_heal_contract',
@@ -491,9 +534,18 @@ describe('PR workflow parallelism', () => {
     // The bundling tests skip themselves without mobile/node_modules, which is what keeps the
     // sharded `test` job green. Only this env var stops that skip from spreading to the one job
     // that installs them, so a typo here would leave the whole job passing vacuously.
-    const step = workflow.jobs.mobile_web_app.steps.find((entry) =>
-      entry.run?.includes('build-mobile-web-app-bundle.test.mjs')
+    const step = workflow.jobs.mobile_web_app.steps.find(
+      (entry) => entry.name === 'Builder, override census and render checks'
     )
+    expect(step.run).toContain('node config/scripts/run-mobile-web-app-checks.mjs')
+    expect(step.run).not.toContain('--prepare-route-snapshot')
     expect(step.env[MOBILE_WEB_APP_DEPENDENCIES_REQUIRED_ENV]).toBe('1')
+    expect(mobileWebCheckArgs).toEqual([
+      'run',
+      '--config',
+      'config/vitest.config.ts',
+      'config/scripts/mobile-web-app-',
+      'config/scripts/build-mobile-web-app-bundle.test.mjs'
+    ])
   })
 })
diff --git a/config/scripts/profile-state-worker-smoke.mjs b/config/scripts/profile-state-worker-smoke.mjs
new file mode 100644
index 000000000000..81ff1b5eaf13
--- /dev/null
+++ b/config/scripts/profile-state-worker-smoke.mjs
@@ -0,0 +1,156 @@
+import { deepStrictEqual } from 'node:assert'
+import { randomUUID } from 'node:crypto'
+import { build } from 'esbuild'
+import { mkdtempSync, rmSync } from 'node:fs'
+import { createRequire } from 'node:module'
+import { tmpdir } from 'node:os'
+import { join, resolve } from 'node:path'
+import { Worker } from 'node:worker_threads'
+import { runProcessSync } from './script-child-process.mjs'
+import {
+  ORCAD_PROFILE_PREFLIGHT_FLAG,
+  parseOrcadProfilePreflight
+} from '../../src/shared/orcad-profile-preflight.ts'
+import { ORCAD_BUN_VERSION } from '../../src/shared/orcad-bun-runtime.ts'
+
+async function initializeFixture(directory, databasePath, profileId) {
+  const fixture = join(directory, 'initialize.cjs')
+  await build({
+    stdin: {
+      contents: `import { openProfileStateDatabase } from './src/main/persistence/profile-state/profile-state-database';
+        export function initialize(path, profileId) { openProfileStateDatabase(path, profileId).db.close() }`,
+      resolveDir: resolve(import.meta.dirname, '../..'),
+      sourcefile: 'profile-state-build-fixture.ts'
+    },
+    outfile: fixture,
+    bundle: true,
+    platform: 'node',
+    format: 'cjs',
+    logLevel: 'silent'
+  })
+  createRequire(import.meta.url)(fixture).initialize(databasePath, profileId)
+}
+
+function runWorker(entry, workerData, steps, timeoutMs) {
+  return new Promise((resolve, reject) => {
+    const worker = new Worker(entry, { workerData, execArgv: [] })
+    let received = 0
+    let failure
+    const stop = (error) => {
+      failure ??= error
+      void worker.terminate().catch((terminationError) => {
+        failure ??= terminationError
+      })
+    }
+    const timer = setTimeout(() => stop(new Error(`${entry} timed out`)), timeoutMs)
+    worker.on('message', (response) => {
+      if (failure) {
+        return
+      }
+      const step = steps[received]
+      if (!step) {
+        stop(new Error(`${entry} sent an unexpected response`))
+        return
+      }
+      try {
+        if (response?.ok === false) {
+          throw new Error(`${entry}: ${response.error?.message ?? response.error}`)
+        }
+        for (const [key, expected] of Object.entries(step.reply)) {
+          deepStrictEqual(response?.[key], expected, `${entry}: unexpected ${key}`)
+        }
+        received++
+        const next = steps[received]
+        if (next) {
+          worker.postMessage(next.request)
+        }
+      } catch (error) {
+        stop(error)
+      }
+    })
+    worker.on('error', (error) => {
+      failure ??= error
+    })
+    worker.once('exit', (code) => {
+      clearTimeout(timer)
+      if (failure || code !== 0 || received !== steps.length) {
+        reject(failure ?? new Error(`${entry} exited before completing its protocol (${code})`))
+      } else {
+        resolve()
+      }
+    })
+  })
+}
+
+/** Exercise the shipped entries and copied state before publishing their content version. */
+export async function smokeProfileStateWorkers(outDir, { timeoutMs = 30_000, runtimePath } = {}) {
+  if (runtimePath) {
+    const nonce = randomUUID()
+    const result = runProcessSync({
+      program: runtimePath,
+      args: [join(outDir, 'orcad.js'), ORCAD_PROFILE_PREFLIGHT_FLAG, nonce],
+      env: { ...process.env, ORCA_BACKGROUND_LAUNCH: '1' },
+      timeoutMs,
+      maxOutputBytes: 64 * 1024
+    })
+    if (result.code !== 0 || result.timedOut || result.outputTruncated) {
+      throw new Error(`Packaged profile runtime preflight failed: ${result.stderr}`)
+    }
+    parseOrcadProfilePreflight(result.stdout, nonce, ORCAD_BUN_VERSION)
+    return
+  }
+  const directory = mkdtempSync(join(tmpdir(), 'orca-profile-worker-smoke-'))
+  const databasePath = join(directory, 'profile.db')
+  const targetPath = join(directory, 'backup.db')
+  const profileId = 'build-smoke'
+  const payload = JSON.stringify({ theme: 'dark', witness: 'saved \ud800 \u{1f419}' })
+  try {
+    await initializeFixture(directory, databasePath, profileId)
+    await runWorker(
+      join(outDir, 'profile-state-writer-worker-entry.js'),
+      { databasePath, profileId, revision: 0 },
+      [
+        { reply: { id: 0, ok: true, revision: 0 } },
+        {
+          request: {
+            id: 1,
+            command: 'write-complete',
+            replacements: [{ domain: 'settings', payload }]
+          },
+          reply: { id: 1, ok: true, revision: 1 }
+        },
+        {
+          request: { id: 2, command: 'close' },
+          reply: { id: 2, ok: true, revision: 1 }
+        }
+      ],
+      timeoutMs
+    )
+    await runWorker(
+      join(outDir, 'profile-state-backup-worker-entry.js'),
+      { databasePath, profileId, targetPath },
+      [{ reply: { ok: true } }],
+      timeoutMs
+    )
+    const { DatabaseSync } = process.getBuiltinModule('node:sqlite')
+    const database = new DatabaseSync(targetPath, { readOnly: true })
+    try {
+      deepStrictEqual(database.prepare('PRAGMA quick_check').get()['quick_check'], 'ok')
+      deepStrictEqual(
+        database
+          .prepare("SELECT payload FROM profile_state_documents WHERE domain = 'settings'")
+          .get()?.payload,
+        payload
+      )
+      deepStrictEqual(
+        database.prepare("SELECT value FROM profile_state_meta WHERE key = 'revision'").get()
+          ?.value,
+        '1'
+      )
+    } finally {
+      database.close()
+    }
+  } finally {
+    rmSync(directory, { recursive: true, force: true })
+  }
+}
diff --git a/config/scripts/profile-state-worker-smoke.test.mjs b/config/scripts/profile-state-worker-smoke.test.mjs
new file mode 100644
index 000000000000..06f45e9fd6d7
--- /dev/null
+++ b/config/scripts/profile-state-worker-smoke.test.mjs
@@ -0,0 +1,91 @@
+import { build } from 'esbuild'
+import { copyFileSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join, resolve } from 'node:path'
+import { afterAll, beforeAll, describe, expect, it } from 'vitest'
+import { smokeProfileStateWorkers } from './profile-state-worker-smoke.mjs'
+
+const directories = []
+const writerFilename = 'profile-state-writer-worker-entry.js'
+const backupFilename = 'profile-state-backup-worker-entry.js'
+let builtDirectory
+
+function fixtureDirectory() {
+  const directory = mkdtempSync(join(tmpdir(), 'orca-profile-worker-build-test-'))
+  directories.push(directory)
+  return directory
+}
+
+beforeAll(async () => {
+  builtDirectory = fixtureDirectory()
+  await Promise.all(
+    ['writer', 'backup'].map((role) =>
+      build({
+        entryPoints: [
+          resolve(`src/main/persistence/profile-state/profile-state-${role}-worker-entry.ts`)
+        ],
+        outfile: join(builtDirectory, `profile-state-${role}-worker-entry.js`),
+        bundle: true,
+        platform: 'node',
+        target: 'node18',
+        format: 'cjs',
+        logLevel: 'silent'
+      })
+    )
+  )
+})
+
+afterAll(() => {
+  for (const directory of directories) {
+    rmSync(directory, { recursive: true, force: true })
+  }
+})
+
+describe('profile state build smoke', () => {
+  it('writes through the built writer and verifies the built backup after handle release', async () => {
+    await expect(smokeProfileStateWorkers(builtDirectory)).resolves.toBeUndefined()
+  })
+
+  it('rejects a worker that exits without completing its protocol', async () => {
+    const directory = fixtureDirectory()
+    writeFileSync(join(directory, writerFilename), 'process.exit(0)\n')
+    await expect(smokeProfileStateWorkers(directory)).rejects.toThrow('before completing')
+  })
+
+  it('rejects a mismatched startup revision', async () => {
+    const directory = fixtureDirectory()
+    writeFileSync(
+      join(directory, writerFilename),
+      `const { parentPort } = require('node:worker_threads')
+      parentPort.postMessage({ id: 0, ok: true, revision: 7 })
+      parentPort.close()`
+    )
+    await expect(smokeProfileStateWorkers(directory)).rejects.toThrow('unexpected revision')
+  })
+
+  it('does not accept a close acknowledgement from a worker that remains alive', async () => {
+    const directory = fixtureDirectory()
+    writeFileSync(
+      join(directory, writerFilename),
+      `const { parentPort } = require('node:worker_threads')
+      parentPort.postMessage({ id: 0, ok: true, revision: 0 })
+      parentPort.on('message', ({ id }) => parentPort.postMessage({ id, ok: true, revision: 1 }))
+      setInterval(() => {}, 1000)`
+    )
+    await expect(smokeProfileStateWorkers(directory, { timeoutMs: 2_000 })).rejects.toThrow(
+      'timed out'
+    )
+  })
+
+  it('does not accept a successful backup response without the copied database', async () => {
+    const directory = fixtureDirectory()
+    copyFileSync(join(builtDirectory, writerFilename), join(directory, writerFilename))
+    writeFileSync(
+      join(directory, backupFilename),
+      `const { parentPort } = require('node:worker_threads')
+      parentPort.postMessage({ ok: true })
+      parentPort.close()`
+    )
+    await expect(smokeProfileStateWorkers(directory)).rejects.toThrow()
+  })
+})
diff --git a/config/scripts/pullfrog-review-scope.cjs b/config/scripts/pullfrog-review-scope.cjs
new file mode 100644
index 000000000000..5168d5bd7ef7
--- /dev/null
+++ b/config/scripts/pullfrog-review-scope.cjs
@@ -0,0 +1,64 @@
+function reviewNumber(inputs) {
+  if (/^[1-9]\d*$/.test(inputs.pull_request_number ?? '')) {
+    return Number(inputs.pull_request_number)
+  }
+  const match =
+    / \| PR ([1-9]\d*)$/.exec(inputs.name ?? '') ??
+    /^Review (?:new commits on )?#([1-9]\d*) \[[\w-]+\]$/.exec(inputs.name ?? '')
+  return match ? Number(match[1]) : null
+}
+
+function reviewRunOrder(runs, number, runId) {
+  const related = runs.filter((run) => reviewNumber({ name: run.display_title }) === number)
+  return {
+    superseded: related.some((run) => run.id > runId),
+    older: related
+      .filter(
+        (run) =>
+          run.id < runId &&
+          ['queued', 'in_progress', 'waiting', 'pending', 'requested'].includes(run.status)
+      )
+      .map((run) => run.id)
+  }
+}
+
+async function reviewScope({ github, context, core }) {
+  const inputs = context.payload.inputs ?? {}
+  const number = reviewNumber(inputs)
+  core.setOutput('current', 'true')
+  if (!number || !Number.isSafeInteger(number)) {
+    return
+  }
+  try {
+    const { data: pr } = await github.rest.pulls.get({ ...context.repo, pull_number: number })
+    if (pr.state !== 'open' || (inputs.head_sha && inputs.head_sha !== pr.head.sha)) {
+      core.setOutput('current', 'false')
+      return
+    }
+    core.setOutput('head', pr.head.sha)
+    core.setOutput('number', String(number))
+    const { data } = await github.rest.actions.listWorkflowRuns({
+      ...context.repo,
+      workflow_id: 'pullfrog.yml',
+      event: 'workflow_dispatch',
+      per_page: 100
+    })
+    const order = reviewRunOrder(data.workflow_runs, number, context.runId)
+    if (order.superseded) {
+      core.setOutput('current', 'false')
+      return
+    }
+    // Run IDs, unlike scope-job completion order, cannot let an older review cancel a newer one.
+    for (const runId of order.older) {
+      try {
+        await github.rest.actions.cancelWorkflowRun({ ...context.repo, run_id: runId })
+      } catch (error) {
+        core.warning(`Could not cancel older review ${runId}: ${error.message}`)
+      }
+    }
+  } catch (error) {
+    core.warning(`Review identity unavailable; leaving this task independent: ${error.message}`)
+  }
+}
+
+module.exports = { reviewNumber, reviewRunOrder, reviewScope }
diff --git a/config/scripts/pullfrog-review-scope.test.mjs b/config/scripts/pullfrog-review-scope.test.mjs
new file mode 100644
index 000000000000..2a3f902da879
--- /dev/null
+++ b/config/scripts/pullfrog-review-scope.test.mjs
@@ -0,0 +1,109 @@
+import { expect, it, vi } from 'vitest'
+import scope from './pullfrog-review-scope.cjs'
+
+it('groups a current review by PR while leaving other agent tasks independent', async () => {
+  const get = vi.fn(async () => ({ data: { state: 'open', head: { sha: 'current' } } }))
+  const core = { setOutput: vi.fn(), warning: vi.fn() }
+  const context = {
+    repo: { owner: 'stablyai', repo: 'orca' },
+    runId: 7,
+    payload: { inputs: { name: 'Review #42 [abc]' } }
+  }
+  const github = {
+    rest: {
+      pulls: { get },
+      actions: { listWorkflowRuns: async () => ({ data: { workflow_runs: [] } }) }
+    }
+  }
+  await scope.reviewScope({ core, context, github })
+  expect(get).toHaveBeenCalledWith({ owner: 'stablyai', repo: 'orca', pull_number: 42 })
+  expect(core.setOutput).toHaveBeenCalledWith('head', 'current')
+  get.mockClear()
+  await scope.reviewScope({
+    core,
+    github,
+    context: { ...context, payload: { inputs: { name: 'Investigate #42' } } }
+  })
+  expect(get).not.toHaveBeenCalled()
+  expect(core.setOutput).toHaveBeenLastCalledWith('current', 'true')
+})
+
+it('coalesces only explicit or recognized PR review identities', () => {
+  expect(scope.reviewNumber({ name: 'Review #23532 [85jpk]' })).toBe(23532)
+  expect(scope.reviewNumber({ name: 'Review new commits on #22727 [24lpq]' })).toBe(22727)
+  expect(scope.reviewNumber({ pull_request_number: '123' })).toBe(123)
+  for (const name of ['Fix #123', 'Review #12; echo test', 'Review #123', '', 'Review #0 [abc]']) {
+    expect(scope.reviewNumber({ name })).toBeNull()
+  }
+})
+
+it('skips closed or explicitly stale reviews and tolerates lookup failure', async () => {
+  for (const data of [
+    { state: 'closed', head: { sha: 'a' } },
+    { state: 'open', head: { sha: 'b' } }
+  ]) {
+    const core = { setOutput: vi.fn(), warning: vi.fn() }
+    await scope.reviewScope({
+      core,
+      context: {
+        repo: {},
+        runId: 1,
+        payload: { inputs: { pull_request_number: '1', head_sha: 'a' } }
+      },
+      github: { rest: { pulls: { get: async () => ({ data }) } } }
+    })
+    expect(core.setOutput).toHaveBeenCalledWith('current', 'false')
+  }
+  const core = { setOutput: vi.fn(), warning: vi.fn() }
+  await scope.reviewScope({
+    core,
+    context: { repo: {}, runId: 2, payload: { inputs: { pull_request_number: '1' } } },
+    github: {
+      rest: {
+        pulls: {
+          get: async () => {
+            throw new Error('offline')
+          }
+        }
+      }
+    }
+  })
+  expect(core.setOutput).toHaveBeenCalledWith('current', 'true')
+  expect(core.warning).toHaveBeenCalled()
+})
+
+it('a delayed older scope cannot cancel or replace a newer review', async () => {
+  const runs = [
+    { id: 6, display_title: 'Review #42 [a]', status: 'in_progress' },
+    { id: 8, display_title: 'Custom review | PR 42', status: 'queued' },
+    { id: 5, display_title: 'Investigate #42', status: 'in_progress' },
+    { id: 4, display_title: 'Review #43 [other]', status: 'in_progress' }
+  ]
+  for (const runId of [7, 9]) {
+    const cancelWorkflowRun = vi.fn(async () => ({}))
+    const core = { setOutput: vi.fn(), warning: vi.fn() }
+    await scope.reviewScope({
+      context: {
+        repo: { owner: 'stablyai', repo: 'orca' },
+        runId,
+        payload: { inputs: { name: 'Review #42 [current]' } }
+      },
+      core,
+      github: {
+        rest: {
+          pulls: { get: async () => ({ data: { state: 'open', head: { sha: 'head' } } }) },
+          actions: {
+            listWorkflowRuns: async () => ({ data: { workflow_runs: runs } }),
+            cancelWorkflowRun
+          }
+        }
+      }
+    })
+    if (runId === 7) {
+      expect(cancelWorkflowRun).not.toHaveBeenCalled()
+      expect(core.setOutput).toHaveBeenCalledWith('current', 'false')
+    } else {
+      expect(cancelWorkflowRun.mock.calls.map(([args]) => args.run_id)).toEqual([6, 8])
+    }
+  }
+})
diff --git a/config/scripts/rebuild-native-deps-test-fixtures.mjs b/config/scripts/rebuild-native-deps-test-fixtures.mjs
index 7a5eb1822120..333c8f939ef5 100644
--- a/config/scripts/rebuild-native-deps-test-fixtures.mjs
+++ b/config/scripts/rebuild-native-deps-test-fixtures.mjs
@@ -439,7 +439,7 @@ export function writeFakeWindowsProcessTree(projectDir) {
   mkdirSync(processTreeDir, { recursive: true })
   writeFileSync(
     join(processTreeDir, 'index.js'),
-    `module.exports = { supportedProcessDataFlags: ${CREATION_TIME_FLAG} }\n`
+    `module.exports = { supportedProcessDataFlags: ${CREATION_TIME_FLAG}, getProcessCreationTime: () => undefined }\n`
   )
 }
 
@@ -480,19 +480,29 @@ export function writeFakeWindowsProcessTreeWithNodeAddonApi(
     join(processTreeDir, 'src', 'process_worker.cc'),
     creationTimePatchApplied ? 'object.Set("creationTimeMs", process.creationTimeMs);\n' : '\n'
   )
+  writeFileSync(
+    join(processTreeDir, 'src', 'addon.cc'),
+    creationTimePatchApplied ? 'exports.Set("getProcessCreationTime", getter);\n' : '\n'
+  )
   mkdirSync(join(processTreeDir, 'lib'), { recursive: true })
   writeFileSync(
     join(processTreeDir, 'lib', 'index.js'),
-    creationTimePatchApplied ? 'exports.ProcessDataFlag["CreationTime"] = 4;\n' : '\n'
+    creationTimePatchApplied
+      ? 'exports.ProcessDataFlag["CreationTime"] = 4;\nexports.getProcessCreationTime = getter;\n'
+      : '\n'
   )
   writeFileSync(
     join(processTreeDir, 'lib', 'index.ts'),
-    creationTimePatchApplied ? 'export enum ProcessDataFlag { CreationTime = 4 }\n' : '\n'
+    creationTimePatchApplied
+      ? 'export enum ProcessDataFlag { CreationTime = 4 }\nexport const getProcessCreationTime = getter;\n'
+      : '\n'
   )
   mkdirSync(join(processTreeDir, 'typings'), { recursive: true })
   writeFileSync(
     join(processTreeDir, 'typings', 'windows-process-tree.d.ts'),
-    creationTimePatchApplied ? 'creationTimeMs?: number\n' : '\n'
+    creationTimePatchApplied
+      ? 'creationTimeMs?: number\nexport const getProcessCreationTime: Function;\n'
+      : '\n'
   )
   writeFileSync(join(nodeAddonApiDir, 'package.json'), '{"name":"node-addon-api"}\n')
   writeFileSync(join(nodeAddonApiDir, 'napi.h'), '// napi.h\n')
diff --git a/config/scripts/regenerate-xterm-patches.mjs b/config/scripts/regenerate-xterm-patches.mjs
index 672be8bee61b..c67c6eb66221 100644
--- a/config/scripts/regenerate-xterm-patches.mjs
+++ b/config/scripts/regenerate-xterm-patches.mjs
@@ -236,6 +236,7 @@ function ensureDependencies(upstreamRoot, manifest) {
   const stamp = path.join(upstreamRoot, 'node_modules', '.orca-xterm-install-stamp')
   const want = `${manifest.upstream.commit}\n${statSync(lockfile).size}\n`
   if (existsSync(stamp) && readFileSync(stamp, 'utf8') === want) {
+    assertToolchain(upstreamRoot, manifest)
     return
   }
   run('npm', ['ci'], {
diff --git a/config/scripts/relay-artifact-manifest.test.mjs b/config/scripts/relay-artifact-manifest.test.mjs
index 2796a3617780..7177b9821f8f 100644
--- a/config/scripts/relay-artifact-manifest.test.mjs
+++ b/config/scripts/relay-artifact-manifest.test.mjs
@@ -13,7 +13,8 @@ import {
   RELAY_BUILD_PLATFORMS,
   RELAY_VERSION_FILENAME,
   isWindowsRelayPlatform,
-  relayArtifactFilenames
+  relayArtifactFilenames,
+  relayOptionalArtifactFilenames
 } from '../../src/shared/relay-artifacts.ts'
 
 const projectDir = resolve(import.meta.dirname, '../..')
@@ -46,13 +47,22 @@ describe('packaged relay artifact manifest', () => {
     const emitted = readdirSync(outDir)
       .filter((name) => name !== RELAY_VERSION_FILENAME)
       .sort()
-    expect(emitted).toEqual([...expected].sort())
+    const optional = relayOptionalArtifactFilenames(isWindowsRelayPlatform(platform)).filter(
+      (filename) => existsSync(join(outDir, filename))
+    )
+    expect(emitted).toEqual([...expected, ...optional].sort())
   })
 
   it.each([...RELAY_BUILD_PLATFORMS])('hashes every declared artifact for %s', (platform) => {
     const outDir = join(relayOutDir, platform)
     const hash = createHash('sha256')
-    for (const filename of relayArtifactFilenames(isWindowsRelayPlatform(platform))) {
+    const artifacts = [
+      ...relayArtifactFilenames(isWindowsRelayPlatform(platform)),
+      ...relayOptionalArtifactFilenames(isWindowsRelayPlatform(platform)).filter((filename) =>
+        existsSync(join(outDir, filename))
+      )
+    ]
+    for (const filename of artifacts) {
       hash.update(readFileSync(join(outDir, filename)))
     }
     const version = readFileSync(join(outDir, RELAY_VERSION_FILENAME), 'utf8')
diff --git a/config/scripts/release-e2e-dispatch-contract.test.mjs b/config/scripts/release-e2e-dispatch-contract.test.mjs
index 4590e8bc1361..2277cd399a49 100644
--- a/config/scripts/release-e2e-dispatch-contract.test.mjs
+++ b/config/scripts/release-e2e-dispatch-contract.test.mjs
@@ -53,7 +53,6 @@ describe('release E2E dispatch contract', () => {
     expect(buildStep.run).toContain('pnpm run build:relay &')
     expect(buildStep.run).toContain('relay_pid=$!')
     expect(buildStep.run).toContain('wait "$relay_pid"')
-    expect(buildStep.run).toContain('pnpm run build:web-from-renderer')
   })
 
   it('primes the Electron native cache before every E2E consumer', () => {
@@ -72,12 +71,29 @@ describe('release E2E dispatch contract', () => {
   it('includes the paired-runtime web client in the shared E2E build artifact', () => {
     const buildStep = e2eWorkflow.jobs.build.steps.find((step) => step.name === 'Build E2E outputs')
 
-    expect(buildStep.run).toContain('electron-vite build --mode e2e')
+    expect(buildStep.run).toContain('pnpm run build:electron-vite:parallel --mode e2e')
     expect(buildStep.env.VITE_EXPOSE_STORE).toBe('true')
-    expect(buildStep.run).toContain('pnpm run build:web-from-renderer')
     expect(buildStep.run).toContain('pnpm run build:relay')
   })
 
+  it('joins the shared CLI and web builds before uploading complete E2E output', () => {
+    const steps = e2eWorkflow.jobs.build.steps
+    const electron = steps.findIndex((step) => step.name === 'Build E2E outputs')
+    const cli = steps.findIndex((step) => step.id === 'e2e-cli')
+    const web = steps.findIndex((step) => step.name === 'Project shared E2E web client')
+    const join = steps.findIndex((step) => step.wait === 'e2e-cli')
+    const upload = steps.findIndex((step) => step.name === 'Upload E2E build output')
+    expect(cli).toBeGreaterThan(electron)
+    expect(steps[cli].background).toBe(true)
+    expect(steps[cli].run).toContain('pnpm run build:cli')
+    expect(steps[cli].run).toContain('scripts["prepare:cli-output"]')
+    expect(web).toBeGreaterThan(cli)
+    expect(steps[web].run).toBe('pnpm run build:web-from-renderer')
+    expect(join).toBeGreaterThan(web)
+    expect(upload).toBeGreaterThan(join)
+    expect(steps[upload].with.path).toBe('out/')
+  })
+
   it('hands the built relay artifact to every E2E run command', () => {
     const uploadStep = e2eWorkflow.jobs.build.steps.find(
       (step) => step.name === 'Upload E2E build output'
diff --git a/config/scripts/run-bun-profile-tests.mjs b/config/scripts/run-bun-profile-tests.mjs
new file mode 100644
index 000000000000..debd895675b0
--- /dev/null
+++ b/config/scripts/run-bun-profile-tests.mjs
@@ -0,0 +1,74 @@
+import { join, resolve } from 'node:path'
+import { randomUUID } from 'node:crypto'
+import { readFileSync } from 'node:fs'
+import {
+  ORCAD_VERSION_FILENAME,
+  orcadBunRuntimeFilename
+} from '../../src/shared/orcad-artifacts.ts'
+import { ORCAD_BUN_VERSION } from '../../src/shared/orcad-bun-runtime.ts'
+import {
+  ORCAD_PROFILE_PREFLIGHT_FLAG,
+  parseOrcadProfilePreflight
+} from '../../src/shared/orcad-profile-preflight.ts'
+import { currentTarget } from './build-orcad-bun.mjs'
+import { runProcessSync } from './script-child-process.mjs'
+import { bunProfileTestPaths } from './bun-profile-test-paths.mjs'
+
+const root = resolve(import.meta.dirname, '../..')
+const target = currentTarget()
+const artifact = process.argv.includes('--artifact')
+const testArgs = process.argv.slice(2).filter((arg) => arg !== '--artifact')
+const runtimeDir = artifact
+  ? join(root, 'out', 'orcad')
+  : join(root, 'out', '.bun-profile-test-runtime', target)
+const runtimePath = join(runtimeDir, orcadBunRuntimeFilename(target))
+const env = { ...process.env, ORCA_BACKGROUND_LAUNCH: '1', BUN_EXECUTABLE: runtimePath }
+
+function run(program, args) {
+  const result = runProcessSync({
+    program,
+    args,
+    cwd: root,
+    env,
+    stdio: 'inherit',
+    timeoutMs: null
+  })
+  if (result.code !== 0) {
+    process.exit(result.code ?? 1)
+  }
+}
+
+if (artifact) {
+  const nonce = randomUUID()
+  const result = runProcessSync({
+    program: runtimePath,
+    args: [join(runtimeDir, 'orcad.js'), ORCAD_PROFILE_PREFLIGHT_FLAG, nonce],
+    cwd: root,
+    env,
+    timeoutMs: 90_000
+  })
+  if (result.code !== 0 || result.timedOut || result.outputTruncated) {
+    throw new Error(`Bundled runtime readiness failed: ${result.stderr}`)
+  }
+  const response = parseOrcadProfilePreflight(
+    result.stdout,
+    nonce,
+    ORCAD_BUN_VERSION,
+    readFileSync(join(runtimeDir, ORCAD_VERSION_FILENAME), 'utf8').trim()
+  )
+  process.stdout.write(`${JSON.stringify({ target, ...response })}\n`)
+} else {
+  run(process.execPath, [
+    join(root, 'config/scripts/build-orcad-bun.mjs'),
+    '--runtime-only',
+    '--out-dir',
+    runtimeDir
+  ])
+}
+run(runtimePath, [
+  join(root, 'node_modules/vitest/vitest.mjs'),
+  'run',
+  '--config',
+  'config/vitest.config.ts',
+  ...(testArgs.length > 0 ? testArgs : bunProfileTestPaths({ artifact }))
+])
diff --git a/config/scripts/run-electron-vite-targets-in-parallel.mjs b/config/scripts/run-electron-vite-targets-in-parallel.mjs
index 2c0d00644247..149e35ca67e4 100644
--- a/config/scripts/run-electron-vite-targets-in-parallel.mjs
+++ b/config/scripts/run-electron-vite-targets-in-parallel.mjs
@@ -11,7 +11,7 @@ function buildTarget(target) {
   return new Promise((resolve, reject) => {
     const child = spawn(
       process.execPath,
-      [buildScript, '--config', targetConfig, '--ignoreConfigWarning'],
+      [buildScript, '--config', targetConfig, '--ignoreConfigWarning', ...process.argv.slice(2)],
       {
         stdio: 'inherit',
         env: {
diff --git a/config/scripts/run-headless-serve-shutdown-docker.mjs b/config/scripts/run-headless-serve-shutdown-docker.mjs
index 4c367b5f7c48..f5119961c83a 100755
--- a/config/scripts/run-headless-serve-shutdown-docker.mjs
+++ b/config/scripts/run-headless-serve-shutdown-docker.mjs
@@ -63,6 +63,9 @@ try {
     'build',
     '--platform',
     platform,
+    ...(process.env.ORCA_SHUTDOWN_FIXTURE_CACHE_IMAGE
+      ? ['--cache-from', process.env.ORCA_SHUTDOWN_FIXTURE_CACHE_IMAGE]
+      : []),
     '-f',
     shutdownDockerfile,
     '-t',
diff --git a/config/scripts/run-linux-cli-launch-contract-docker.mjs b/config/scripts/run-linux-cli-launch-contract-docker.mjs
index bd414947026b..5cf14009c1c2 100755
--- a/config/scripts/run-linux-cli-launch-contract-docker.mjs
+++ b/config/scripts/run-linux-cli-launch-contract-docker.mjs
@@ -14,7 +14,6 @@ const suffix = `${process.pid}-${Date.now()}`
 const artifactVolume = `orca-cli-contract-artifact-${suffix}`
 const tagArchitecture = platform?.split('/')[1] ?? process.arch
 const tag = `orca-cli-launch-contract:ubuntu-24.04-${tagArchitecture}-${suffix}`
-const base = 'ubuntu@sha256:4fbb8e6a8395de5a7550b33509421a2bafbc0aab6c06ba2cef9ebffbc7092d90'
 const containers = new Set()
 let artifactVolumeCreated = false
 const CASE_TIMEOUT_MS = 90_000
@@ -176,8 +175,9 @@ function buildImage() {
   const buildArgs = [
     'build',
     ...dockerPlatformArgs,
-    '--build-arg',
-    `BASE_IMAGE=${base}`,
+    ...(process.env.ORCA_CLI_FIXTURE_CACHE_IMAGE
+      ? ['--cache-from', process.env.ORCA_CLI_FIXTURE_CACHE_IMAGE]
+      : []),
     '-f',
     'config/docker/cli-launch-contract/Dockerfile',
     '-t',
diff --git a/config/scripts/run-mobile-web-app-checks.mjs b/config/scripts/run-mobile-web-app-checks.mjs
new file mode 100644
index 000000000000..c62576769115
--- /dev/null
+++ b/config/scripts/run-mobile-web-app-checks.mjs
@@ -0,0 +1,88 @@
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { dirname, join } from 'node:path'
+import { pathToFileURL } from 'node:url'
+import { createRequire } from 'node:module'
+import { mobileWebAppModuleClosure } from './build-mobile-web-app-bundle.mjs'
+import { readRouteSnapshot } from './mobile-web-app-route-snapshot.mjs'
+import { PAGE_ROUTE_MODULES } from './mobile-web-app-page-route-modules.mjs'
+import { spawnProcess } from './script-child-process.mjs'
+
+const require = createRequire(import.meta.url)
+export const mobileWebCheckArgs = [
+  'run',
+  '--config',
+  'config/vitest.config.ts',
+  'config/scripts/mobile-web-app-',
+  'config/scripts/build-mobile-web-app-bundle.test.mjs'
+]
+
+export async function prepareRouteSnapshot(file, collect = mobileWebAppModuleClosure) {
+  rmSync(file, { force: true })
+  const routes = []
+  for (const route of new Set(PAGE_ROUTE_MODULES.values())) {
+    const closure = await collect(['app/_layout', 'app/h/_layout', route])
+    routes.push({ route, closure })
+  }
+  writeFileSync(file, JSON.stringify({ version: 1, routes }))
+}
+
+export async function withPreparedRouteSnapshot(file, run) {
+  try {
+    for (const route of new Set(PAGE_ROUTE_MODULES.values())) {
+      if (!readRouteSnapshot(route, file)) {
+        throw new Error(`Prepared mobile route snapshot is missing ${route}`)
+      }
+    }
+    return await run(file)
+  } finally {
+    rmSync(file, { force: true })
+  }
+}
+
+export async function withRouteSnapshot(run, collect = mobileWebAppModuleClosure) {
+  const directory = mkdtempSync(join(tmpdir(), 'orca-route-snapshot-'))
+  try {
+    const file = join(directory, 'routes.json')
+    await prepareRouteSnapshot(file, collect)
+    return await withPreparedRouteSnapshot(file, run)
+  } finally {
+    rmSync(directory, { recursive: true, force: true })
+  }
+}
+
+function runTests(file) {
+  return new Promise((resolve, reject) => {
+    const child = spawnProcess({
+      program: process.execPath,
+      args: [
+        join(dirname(require.resolve('vitest/package.json')), 'vitest.mjs'),
+        ...mobileWebCheckArgs,
+        ...process.argv.slice(2)
+      ],
+      env: { ...process.env, ORCA_BACKGROUND_LAUNCH: '1', ORCA_MOBILE_WEB_ROUTE_SNAPSHOT: file },
+      stdio: 'inherit'
+    })
+    child.once('error', reject)
+    child.once('close', (code, signal) => {
+      if (code === 0 && signal === null) {
+        resolve()
+      } else {
+        reject(new Error(`Mobile web checks failed (code=${code}, signal=${signal})`))
+      }
+    })
+  })
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  if (process.argv[2] === '--prepare-route-snapshot') {
+    if (process.argv.length !== 4) {
+      throw new Error('Expected --prepare-route-snapshot FILE')
+    }
+    await prepareRouteSnapshot(process.argv[3])
+  } else if (process.env.ORCA_MOBILE_WEB_PREPARED_ROUTE_SNAPSHOT) {
+    await withPreparedRouteSnapshot(process.env.ORCA_MOBILE_WEB_PREPARED_ROUTE_SNAPSHOT, runTests)
+  } else {
+    await withRouteSnapshot(runTests)
+  }
+}
diff --git a/config/scripts/run-ssh-docker-e2e.mjs b/config/scripts/run-ssh-docker-e2e.mjs
index 6a1fb69a7282..64709cdbb43d 100644
--- a/config/scripts/run-ssh-docker-e2e.mjs
+++ b/config/scripts/run-ssh-docker-e2e.mjs
@@ -40,9 +40,6 @@ if (runtime.status !== 0) {
 // grep-inverts away.
 //
 // Known gaps in SSH e2e coverage, recorded here because nothing else names them:
-//   - The job that runs this is still called `ssh-docker-watcher-isolation`, though watcher
-//     isolation is now one spec of many. Renaming it changes the GitHub check name and can
-//     break required-check config, so the name understates the job on purpose.
 //   - E2E does not gate merges: `verify.needs` in pr.yml omits `e2e` while the suite is red on
 //     main. Nothing in this lane blocks a PR yet. pr.yml's Require-successful-checks comment
 //     has the exact wiring to flip it, and the gate contract asserts the current state.
diff --git a/config/scripts/run-terminal-ibus-hangul-e2e.mjs b/config/scripts/run-terminal-ibus-hangul-e2e.mjs
index 572f1988629d..dead1c42f133 100644
--- a/config/scripts/run-terminal-ibus-hangul-e2e.mjs
+++ b/config/scripts/run-terminal-ibus-hangul-e2e.mjs
@@ -254,7 +254,6 @@ async function runInsideSession(evidenceDir) {
             'run',
             'test:e2e:headful',
             '--workers=1',
-            '--',
             'tests/e2e/terminal-ibus-hangul-native.spec.ts',
             'tests/e2e/terminal-hangul-terminating-digit-native.spec.ts'
           ],
diff --git a/config/scripts/runtime-serve-terminal-smoke.mjs b/config/scripts/runtime-serve-terminal-smoke.mjs
index a03c85983d8a..c1d998717ffd 100644
--- a/config/scripts/runtime-serve-terminal-smoke.mjs
+++ b/config/scripts/runtime-serve-terminal-smoke.mjs
@@ -388,7 +388,9 @@ async function main() {
       child.kill('SIGTERM')
       const exited = await Promise.race([
         new Promise((r) => child.on('exit', () => r(true))),
-        new Promise((r) => setTimeout(() => r(false), SHUTDOWN_TIMEOUT_MS))
+        // unref'd: the loser of this race must not hold the event loop open after the
+        // winner already decided. The timer still bounds the wait.
+        new Promise((r) => setTimeout(() => r(false), SHUTDOWN_TIMEOUT_MS).unref())
       ])
       if (!exited) {
         child.kill('SIGKILL')
diff --git a/config/scripts/script-child-process.mjs b/config/scripts/script-child-process.mjs
new file mode 100644
index 000000000000..fca512c33241
--- /dev/null
+++ b/config/scripts/script-child-process.mjs
@@ -0,0 +1,35 @@
+import { build } from 'esbuild'
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join, resolve } from 'node:path'
+import { pathToFileURL } from 'node:url'
+
+const root = resolve(import.meta.dirname, '../..')
+const temporary = mkdtempSync(join(tmpdir(), 'orca-script-child-process-'))
+const output = join(temporary, 'child-process.mjs')
+let implementation
+
+try {
+  await build({
+    stdin: {
+      contents: [
+        `export { runProcessSync, spawnProcess } from ${JSON.stringify(join(root, 'src/shared/child-process/run-process.ts'))}`
+      ].join('\n'),
+      resolveDir: root,
+      sourcefile: 'script-child-process-entry.ts'
+    },
+    bundle: true,
+    platform: 'node',
+    target: 'node20',
+    format: 'esm',
+    outfile: output,
+    logLevel: 'silent'
+  })
+  implementation = await import(pathToFileURL(output).href)
+} finally {
+  rmSync(temporary, { recursive: true, force: true })
+}
+
+export const runProcessSync = implementation.runProcessSync
+
+export const spawnProcess = implementation.spawnProcess
diff --git a/config/scripts/script-module-dependencies.mjs b/config/scripts/script-module-dependencies.mjs
index b92db587a81d..51381cdc4fbb 100644
--- a/config/scripts/script-module-dependencies.mjs
+++ b/config/scripts/script-module-dependencies.mjs
@@ -1,8 +1,8 @@
 import { copyFileSync, mkdirSync, readFileSync } from 'node:fs'
-import { basename, dirname, join } from 'node:path'
+import { dirname, join, relative } from 'node:path'
 
 /**
- * Copy a script and every co-located module it imports into a fixture's `config/scripts`.
+ * Copy a script and its relative modules, preserving their paths in the fixture.
  *
  * Walked rather than listed: a module the script needs but the fixture never copied fails every
  * test in the suite with a module-resolution error that looks nothing like the defect it hides.
@@ -10,7 +10,9 @@ import { basename, dirname, join } from 'node:path'
 export function copyScriptWithLocalModules(sourceScriptPath, destinationScriptsDir) {
   mkdirSync(destinationScriptsDir, { recursive: true })
   for (const modulePath of collectScriptModules(sourceScriptPath)) {
-    copyFileSync(modulePath, join(destinationScriptsDir, basename(modulePath)))
+    const destination = join(destinationScriptsDir, relative(dirname(sourceScriptPath), modulePath))
+    mkdirSync(dirname(destination), { recursive: true })
+    copyFileSync(modulePath, destination)
   }
 }
 
@@ -27,7 +29,7 @@ function collectScriptModules(scriptPath, seen = new Set()) {
   // not against this file, so following them would stage the wrong path.
   const source = readFileSync(scriptPath, 'utf8')
   const specifiers = source.matchAll(
-    /(?:\bfrom|\brequire\s*\(|\bimport\s*\(|\bimport)\s*'(\.\/[^']+)'/g
+    /(?:\bfrom|\brequire\s*\(|\bimport\s*\(|\bimport)\s*'(\.\.?\/[^']+)'/g
   )
   for (const [, specifier] of specifiers) {
     collectScriptModules(join(dirname(scriptPath), specifier), seen)
diff --git a/config/scripts/script-module-dependencies.test.mjs b/config/scripts/script-module-dependencies.test.mjs
index 998226e04273..68482954ee3e 100644
--- a/config/scripts/script-module-dependencies.test.mjs
+++ b/config/scripts/script-module-dependencies.test.mjs
@@ -1,4 +1,11 @@
-import { existsSync, mkdtempSync, readdirSync, writeFileSync } from 'node:fs'
+import {
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readdirSync,
+  readFileSync,
+  writeFileSync
+} from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { fileURLToPath } from 'node:url'
@@ -23,6 +30,23 @@ function copiedNames(files, entryName) {
 }
 
 describe('copyScriptWithLocalModules', () => {
+  it('preserves parent paths for modules shared with the runtime', () => {
+    const sourceDir = sourceTree({ 'runtime.ts': 'export const value = 42\n' })
+    mkdirSync(join(sourceDir, 'scripts'))
+    writeFileSync(
+      join(sourceDir, 'scripts', 'entry.mjs'),
+      "export { value } from '../runtime.ts'\n"
+    )
+    const destinationRoot = mkdtempSync(join(fixtureDir, 'dest-'))
+    copyScriptWithLocalModules(
+      join(sourceDir, 'scripts', 'entry.mjs'),
+      join(destinationRoot, 'scripts')
+    )
+    expect(readFileSync(join(destinationRoot, 'runtime.ts'), 'utf8')).toBe(
+      'export const value = 42\n'
+    )
+  })
+
   it('takes the entry script itself', () => {
     expect(copiedNames({ 'entry.mjs': 'export const a = 1\n' }, 'entry.mjs')).toEqual(['entry.mjs'])
   })
diff --git a/config/scripts/ssh-browser-e2e-routing.test.mjs b/config/scripts/ssh-browser-e2e-routing.test.mjs
index 0b46131cf141..a36df63dfd9d 100644
--- a/config/scripts/ssh-browser-e2e-routing.test.mjs
+++ b/config/scripts/ssh-browser-e2e-routing.test.mjs
@@ -2,7 +2,7 @@ import { readFileSync } from 'node:fs'
 import { join, resolve } from 'node:path'
 import { parse } from 'yaml'
 import { expect, it } from 'vitest'
-import { selectPrE2eSpecs } from './pr-e2e-source-routing.mjs'
+import { selectPrE2eSpecs, shouldRunReusablePrE2e } from './pr-e2e-source-routing.mjs'
 
 const root = resolve(import.meta.dirname, '../..')
 const workflow = parse(readFileSync(join(root, '.github/workflows/e2e.yml'), 'utf8'))
@@ -62,3 +62,24 @@ it('executes both Docker network routes in a Node job with their opt-in enabled'
     spec
   )
 })
+
+it('runs the local SSH browser spec when its route source changes', () => {
+  const spec = 'tests/e2e/local-ssh-browser-routing.spec.ts'
+  for (const changed of [
+    'src/main/browser/local-ssh-browser-route.ts',
+    'src/main/browser/local-ssh-browser-partitions.ts',
+    'src/renderer/src/components/browser-pane/use-ssh-workspace-browser-route.ts',
+    'src/renderer/src/components/browser-pane/assemble-chrome/ssh-routed-browser-page-gate.tsx',
+    'src/renderer/src/lib/worktree-host-connection-phase.ts'
+  ]) {
+    expect(selectPrE2eSpecs([changed])).toContain(spec)
+    expect(shouldRunReusablePrE2e([changed])).toBe(true)
+  }
+  for (const unrelated of [
+    'src/renderer/src/components/browser-pane/use-ssh-workspace-browser-route.host-connection.test.tsx',
+    'src/main/browser/local-ssh-browser-route.test.ts',
+    'src/renderer/src/components/browser-pane/BrowserPane.tsx'
+  ]) {
+    expect(selectPrE2eSpecs([unrelated])).not.toContain(spec)
+  }
+})
diff --git a/config/scripts/ssh-docker-ci-sharding.test.mjs b/config/scripts/ssh-docker-ci-sharding.test.mjs
new file mode 100644
index 000000000000..c3b015727d67
--- /dev/null
+++ b/config/scripts/ssh-docker-ci-sharding.test.mjs
@@ -0,0 +1,117 @@
+import { readFileSync } from 'node:fs'
+import { createRequire } from 'node:module'
+import { dirname, join } from 'node:path'
+import { expect, it } from 'vitest'
+import { parse } from 'yaml'
+import { runProcess } from '../../src/shared/child-process/run-process'
+
+const require = createRequire(import.meta.url)
+const root = join(import.meta.dirname, '../..')
+const workflow = parse(readFileSync(join(root, '.github/workflows/e2e.yml'), 'utf8'))
+const job = workflow.jobs['ssh-docker-watcher-isolation']
+const readRunner = (name) => readFileSync(join(root, `config/scripts/${name}.mjs`), 'utf8')
+const runnerSpecs = (name) =>
+  [...readRunner(name).matchAll(/^    '(tests\/e2e\/[^']+\.spec\.ts)',/gm)].map((match) => match[1])
+const runners = [
+  'run-ssh-docker-e2e',
+  'run-ssh-docker-watcher-isolation-e2e',
+  'run-ssh-docker-terminal-parking-e2e'
+]
+
+it('gives every removed SSH spec a dedicated owner even for test-only edits', () => {
+  const changedRun = workflow.jobs['changed-e2e'].steps.find(
+    (step) => step.name === 'Run changed E2E specs'
+  ).run
+  const excluded = [...changedRun.matchAll(/\. != "([^"]+)"/g)].map((match) => match[1])
+  const owned = runners.flatMap(runnerSpecs)
+  expect(owned.length).toBeGreaterThan(25)
+  expect(new Set(owned).size).toBe(owned.length)
+  for (const spec of owned) {
+    expect(excluded, spec).toContain(spec)
+    expect(job.if, spec).toContain(`contains(inputs.test_files, '${spec}')`)
+  }
+  expect(excluded.filter((spec) => !owned.includes(spec)).sort()).toEqual([
+    'tests/e2e/ssh-browser-network-execution-route.docker.unit.test.ts',
+    'tests/e2e/ssh-localhost.spec.ts',
+    'tests/e2e/terminal-ibus-hangul-native.spec.ts'
+  ])
+})
+
+it('runs all four isolated shards and the special SSH suites exactly once', () => {
+  expect(job.strategy.matrix.shard).toEqual([1, 2, 3, 4])
+  expect(job.strategy['fail-fast']).toBe(false)
+  const remaining = job.steps.find((step) => step.name === 'Run remaining Docker SSH E2E')
+  expect(remaining.run).toContain('pnpm run test:e2e:ssh-docker --shard=${{ matrix.shard }}/4')
+  expect(remaining.if).toBe('always()')
+  expect(remaining['continue-on-error']).toBeUndefined()
+  expect(readRunner(runners[0])).toContain("'--workers=1'")
+  expect(job.steps.find((step) => step.name === 'Run Docker SSH watcher isolation E2E').if).toBe(
+    'matrix.shard == 1'
+  )
+  expect(
+    job.steps.find(
+      (step) => step.name === 'Run Docker SSH terminal parking + startup readiness E2E'
+    ).if
+  ).toBe('always() && matrix.shard == 1')
+  const upload = job.steps.find((step) => step.uses === 'actions/upload-artifact@v7')
+  expect(upload.with.name).toContain('${{ matrix.shard }}')
+})
+
+it('native Playwright shards preserve every SSH test and project exactly once', async () => {
+  const cli = join(dirname(require.resolve('playwright/package.json')), 'cli.js')
+  const env = {
+    ...process.env,
+    ORCA_BACKGROUND_LAUNCH: '1',
+    ORCA_E2E_SSH_DOCKER: '1',
+    ORCA_E2E_LOCAL_SSH_BROWSER: '1',
+    ORCA_E2E_SSH_CLIENT_HOSTED_BROWSER: '1',
+    ORCA_E2E_WEB_CLIENT: '1'
+  }
+  async function discover(extra = []) {
+    const result = await runProcess({
+      program: process.execPath,
+      cwd: root,
+      args: [
+        cli,
+        'test',
+        ...runnerSpecs(runners[0]),
+        '--config',
+        'tests/playwright.config.ts',
+        '--project=electron-headless',
+        '--project=electron-headful',
+        '--workers=1',
+        '--list',
+        '--reporter=json',
+        ...extra
+      ],
+      env,
+      timeoutMs: 30000
+    })
+    expect(result.code, result.stderr).toBe(0)
+    const report = JSON.parse(result.stdout)
+    expect(report.errors).toEqual([])
+    const ids = []
+    function visit(suite) {
+      for (const spec of suite.specs ?? []) {
+        for (const test of spec.tests) {
+          ids.push(`${spec.id}:${test.projectName}`)
+        }
+      }
+      for (const child of suite.suites ?? []) {
+        visit(child)
+      }
+    }
+    visit(report)
+    return ids
+  }
+  const full = await discover()
+  const sharded = []
+  for (const index of job.strategy.matrix.shard) {
+    const selected = await discover([`--shard=${index}/4`])
+    expect(selected.length).toBeGreaterThan(0)
+    sharded.push(...selected)
+  }
+  expect(full.length).toBeGreaterThanOrEqual(40)
+  expect(new Set(sharded).size).toBe(sharded.length)
+  expect(sharded.sort()).toEqual(full.sort())
+}, 90000)
diff --git a/config/scripts/terminal-ime-e2e-workflow.test.mjs b/config/scripts/terminal-ime-e2e-workflow.test.mjs
index 65277b5e8980..162a6d08ace0 100644
--- a/config/scripts/terminal-ime-e2e-workflow.test.mjs
+++ b/config/scripts/terminal-ime-e2e-workflow.test.mjs
@@ -61,7 +61,7 @@ describe('terminal IME e2e workflow', () => {
     expect(runner).toContain("process.kill(-processGroupId, 'SIGKILL')")
     expect(runner).toContain('const killDeadline = Date.now() + processKillTimeoutMs')
     expect(runner).toMatch(
-      /'test:e2e:headful',\s*'--workers=1',\s*'--',\s*'tests\/e2e\/terminal-ibus-hangul-native\.spec\.ts'/
+      /'test:e2e:headful',\s*'--workers=1',\s*'tests\/e2e\/terminal-ibus-hangul-native\.spec\.ts'/
     )
     expect(runner).not.toContain("'--replace'")
     expect(runner).not.toContain('killall')
diff --git a/config/scripts/terminal-partial-escape-tail-benchmark.mjs b/config/scripts/terminal-partial-escape-tail-benchmark.mjs
index 0337daa4e9d7..0ba8e9741610 100644
--- a/config/scripts/terminal-partial-escape-tail-benchmark.mjs
+++ b/config/scripts/terminal-partial-escape-tail-benchmark.mjs
@@ -3,15 +3,16 @@
 // baseline with the pre-change shape (unconditional concat + per-code-unit walk). Equivalence is
 // proven over a corpus first, so the reported speedup cannot come from the gate changing the answer.
 import { performance } from 'node:perf_hooks'
-import {
-  advancePartialEscapeTail,
-  extractPartialEscapeTail,
-  MAX_PARTIAL_ESCAPE_TAIL_LENGTH
-} from '../../src/shared/terminal-partial-escape-tail.ts'
+import { createJiti } from 'jiti'
 
 const CHUNK_BYTES = 16 * 1024
 const CHUNKS = 640
 const ROUNDS = 7
+// jiti, not a bare `node` import: type-stripping cannot resolve the extensionless
+// relative imports inside the module graph under test.
+const jiti = createJiti(import.meta.url)
+const { advancePartialEscapeTail, extractPartialEscapeTail, MAX_PARTIAL_ESCAPE_TAIL_LENGTH } =
+  await jiti.import('../../src/shared/terminal-partial-escape-tail.ts')
 
 function baselineAdvance(pendingTail, chunk) {
   const tail = extractPartialEscapeTail(pendingTail + chunk)
diff --git a/config/scripts/verify-linux-glibc-floor.cjs b/config/scripts/verify-linux-glibc-floor.cjs
index 3d4a0ca3c1d0..ebfdb2b88161 100644
--- a/config/scripts/verify-linux-glibc-floor.cjs
+++ b/config/scripts/verify-linux-glibc-floor.cjs
@@ -366,23 +366,38 @@ function parseImportedSymbols(objdumpOutput) {
 /** Version needs + DT_NEEDED from a single `objdump -p` (fail-closed). */
 function readDynamicInfo(filePath, objdumpPath) {
   const output = runObjdump(objdumpPath, '-p', filePath)
+  const versionNeeds = parseVersionNeeds(output)
+  const neededLibraries = parseNeededLibraries(output)
   return {
-    versionNeeds: parseVersionNeeds(output),
-    neededLibraries: parseNeededLibraries(output)
+    versionNeeds,
+    neededLibraries,
+    // LLVM prints an empty Dynamic Section even for static executables.
+    isStatic:
+      /^Program Header:/m.test(output) &&
+      /^\s+LOAD\s+off\s+0x[0-9a-f]+/m.test(output) &&
+      !/^\s+(?:DYNAMIC|INTERP)\s+off\s+/m.test(output) &&
+      versionNeeds.length === 0 &&
+      neededLibraries.size === 0
   }
 }
 
+function isMuslTemplatePayload(filePath, neededLibraries, versionNeeds) {
+  return (
+    /(?:^|[/\\])orcad-template[/\\]targets[/\\]linux-(?:x64|arm64)-musl[/\\]/.test(filePath) &&
+    [...neededLibraries].some(
+      (name) => name === 'libc.so' || /^libc\.musl-[\w-]+\.so\.1$/.test(name)
+    ) &&
+    ![...neededLibraries, ...versionNeeds.map((need) => need.library)].some((name) =>
+      /^(?:libc\.so\.6|libm\.so\.6|libpthread\.so\.0|libdl\.so\.2|librt\.so\.1|ld-linux.*)$/.test(
+        name
+      )
+    )
+  )
+}
+
 /** Imported (undefined) dynamic symbols from `objdump -T` (fail-closed). */
 function readImportedSymbols(filePath, objdumpPath) {
-  try {
-    return parseImportedSymbols(runObjdump(objdumpPath, '-T', filePath))
-  } catch (error) {
-    // Why: a statically linked binary (bundled ripgrep) has no dynamic symbol table to import from.
-    if (error instanceof Error && error.message.includes('not a dynamic object')) {
-      return new Set()
-    }
-    throw error
-  }
+  return parseImportedSymbols(runObjdump(objdumpPath, '-T', filePath))
 }
 
 /**
@@ -433,15 +448,20 @@ function verifyLinuxGlibcFloor(rootDir, options = {}) {
 
   const offenders = []
   for (const filePath of binaries) {
-    const { versionNeeds, neededLibraries } = readDynamicInfo(filePath, objdumpPath)
-    const floorViolations = findFloorViolations(versionNeeds, filePath)
+    const { versionNeeds, neededLibraries, isStatic } = readDynamicInfo(filePath, objdumpPath)
+    const isMuslTarget = isMuslTemplatePayload(filePath, neededLibraries, versionNeeds)
+    // Remote musl payloads use their host's C++ runtime, not Ubuntu's libstdc++ or libutil.
+    const floorViolations = findFloorViolations(versionNeeds, filePath).filter(
+      (need) => !isMuslTarget || !isLibstdcxxNode(need.name)
+    )
     // Only pay for `objdump -T` when a relocated-symbol provider is not already
     // in DT_NEEDED (the common, healthy case short-circuits without it).
-    const providerViolations = Object.values(RELOCATED_SYMBOL_PROVIDERS).some(
-      (library) => !neededLibraries.has(library)
-    )
-      ? findMissingProviderDeps(readImportedSymbols(filePath, objdumpPath), neededLibraries)
-      : []
+    const providerViolations =
+      !isStatic &&
+      !isMuslTarget &&
+      Object.values(RELOCATED_SYMBOL_PROVIDERS).some((library) => !neededLibraries.has(library))
+        ? findMissingProviderDeps(readImportedSymbols(filePath, objdumpPath), neededLibraries)
+        : []
     if (floorViolations.length > 0 || providerViolations.length > 0) {
       offenders.push({ filePath, floorViolations, providerViolations })
     }
@@ -473,7 +493,7 @@ function verifyLinuxGlibcFloor(rootDir, options = {}) {
   }
 
   console.log(
-    `[verify-linux-glibc-floor] OK — ${binaries.length} bundled native binaries all load on ${FLOOR_LABEL}`
+    `[verify-linux-glibc-floor] OK — ${binaries.length} bundled native binaries meet applicable ${FLOOR_LABEL} requirements`
   )
 }
 
diff --git a/config/scripts/verify-linux-glibc-payloads.test.mjs b/config/scripts/verify-linux-glibc-payloads.test.mjs
new file mode 100644
index 000000000000..9a68142cf9e4
--- /dev/null
+++ b/config/scripts/verify-linux-glibc-payloads.test.mjs
@@ -0,0 +1,124 @@
+import { mkdtemp, mkdir, writeFile, rm } from 'node:fs/promises'
+import { createRequire } from 'node:module'
+import { tmpdir } from 'node:os'
+import { dirname, join } from 'node:path'
+import { afterEach, describe, expect, it } from 'vitest'
+
+const require = createRequire(import.meta.url)
+const { verifyLinuxGlibcFloor } = require('./verify-linux-glibc-floor.cjs')
+const roots = []
+const STATIC_HEADERS = 'Program Header:\n    LOAD off 0x0000000000000000\n'
+const MUSL_TARGET = 'orcad-template/targets/linux-arm64-musl/watcher.node'
+
+afterEach(async () => {
+  await Promise.all(roots.splice(0).map((root) => rm(root, { recursive: true, force: true })))
+})
+
+async function writeObjdumpFixture(
+  headers,
+  { filename = 'browser', symbolTableError = false } = {}
+) {
+  const root = await mkdtemp(join(tmpdir(), 'orca-glibc-payload-'))
+  roots.push(root)
+  const app = join(root, 'app')
+  const binary = join(app, ...filename.split('/'))
+  await mkdir(dirname(binary), { recursive: true })
+  const elf = Buffer.alloc(64)
+  elf.write('\x7fELF', 0, 'latin1')
+  elf[4] = 2
+  elf[5] = 1
+  elf[6] = 1
+  elf.writeUInt16LE(0xb7, 18)
+  await writeFile(binary, elf)
+  await writeFile(join(root, 'private-headers.txt'), headers)
+  const objdumpPath = join(root, 'objdump-stub.sh')
+  await writeFile(
+    objdumpPath,
+    [
+      '#!/bin/sh',
+      'case "$1" in',
+      '  --version) echo "GNU objdump (fixture)" ;;',
+      '  -p) cat "$(dirname "$0")/private-headers.txt" ;;',
+      symbolTableError
+        ? '  -T) echo "not a dynamic object" >&2; exit 1 ;;'
+        : '  -T) echo "0000 DF *UND* 0000 openpty" ;;',
+      'esac'
+    ].join('\n'),
+    { mode: 0o755 }
+  )
+  return () => verifyLinuxGlibcFloor(app, { objdumpPath, targetArch: 'arm64' })
+}
+
+describe.skipIf(process.platform === 'win32')('static ELF and remote musl payloads', () => {
+  it.each(['', '\nDynamic Section:\n'])(
+    'accepts static LOAD segments with no dynamic imports (section suffix %j)',
+    async (suffix) => {
+      const verify = await writeObjdumpFixture(STATIC_HEADERS + suffix, { symbolTableError: true })
+      expect(verify).not.toThrow()
+    }
+  )
+
+  it.each([
+    ['missing program headers', 'Dynamic Section:\n'],
+    ['dynamic segment', `${STATIC_HEADERS} DYNAMIC off 0x0000000000001000\n`],
+    ['interpreter segment', `${STATIC_HEADERS} INTERP off 0x0000000000001000\n`],
+    ['dependency without a dynamic segment', `${STATIC_HEADERS}  NEEDED libc.so.6\n`]
+  ])('preserves symbol-table failures for %s', async (_label, headers) => {
+    const verify = await writeObjdumpFixture(headers, { symbolTableError: true })
+    expect(verify).toThrow(/objdump -T failed/)
+  })
+
+  it.each(['libc.so', 'libc.musl-aarch64.so.1'])(
+    'does not apply Ubuntu C++ or libutil requirements to a remote payload linked to %s',
+    async (libc) => {
+      const verify = await writeObjdumpFixture(
+        `Dynamic Section:\n  NEEDED ${libc}\n  NEEDED libstdc++.so.6\n` +
+          'Version References:\n  required from libstdc++.so.6:\n    0x0 0x00 02 GLIBCXX_3.4.29\n',
+        { filename: MUSL_TARGET }
+      )
+      expect(verify).not.toThrow()
+    }
+  )
+
+  it.each([
+    ['desktop addon', 'watcher.node', 'libc.so'],
+    ['glibc target', 'orcad-template/targets/linux-arm64-glibc/watcher.node', 'libc.so'],
+    ['mislabeled glibc target', MUSL_TARGET, 'libc.so.6'],
+    ['mixed libc dependencies', MUSL_TARGET, 'libc.so\n  NEEDED libc.so.6']
+  ])('retains Ubuntu floor and provider checks for %s', async (_label, filename, libc) => {
+    const verify = await writeObjdumpFixture(
+      `Dynamic Section:\n  NEEDED ${libc}\n  NEEDED libstdc++.so.6\n` +
+        'Version References:\n  required from libstdc++.so.6:\n    0x0 0x00 02 GLIBCXX_3.4.29\n',
+      { filename }
+    )
+    expect(verify).toThrow(
+      /needs GLIBCXX_3.4.29.*imports openpty but libutil.so.1 is not in DT_NEEDED/
+    )
+  })
+
+  it('still rejects too-new glibc version needs in a musl payload', async () => {
+    const verify = await writeObjdumpFixture(
+      'Dynamic Section:\n  NEEDED libc.so\nVersion References:\n' +
+        '  required from libc.so:\n    0x0 0x00 02 GLIBC_2.34\n',
+      { filename: MUSL_TARGET }
+    )
+    expect(verify).toThrow(/needs GLIBC_2.34/)
+  })
+
+  it('retains the provider check when version references disclose a glibc dependency', async () => {
+    const verify = await writeObjdumpFixture(
+      'Dynamic Section:\n  NEEDED libc.so\nVersion References:\n' +
+        '  required from libc.so.6:\n    0x0 0x00 02 GLIBC_2.17\n',
+      { filename: MUSL_TARGET }
+    )
+    expect(verify).toThrow(/imports openpty but libutil.so.1 is not in DT_NEEDED/)
+  })
+
+  it('preserves objdump failures for a musl-labeled file without proven musl dependencies', async () => {
+    const verify = await writeObjdumpFixture('Dynamic Section:\n', {
+      filename: MUSL_TARGET,
+      symbolTableError: true
+    })
+    expect(verify).toThrow(/objdump -T failed/)
+  })
+})
diff --git a/config/scripts/verify-localization-catalog.mjs b/config/scripts/verify-localization-catalog.mjs
index a73e9d5e3cc1..a155e8741d3a 100644
--- a/config/scripts/verify-localization-catalog.mjs
+++ b/config/scripts/verify-localization-catalog.mjs
@@ -442,7 +442,27 @@ async function reportPluginCatalog(root, catalog, pluginCatalogPath) {
   return interpolationMismatches.length > 0 ? 1 : 0
 }
 
-export async function main(root = process.cwd(), options = parseArgs(process.argv.slice(2))) {
+export async function collectLocalizationReferences(root) {
+  const sourceRoots = LOCALIZATION_SOURCE_ROOTS.map((sourceRoot) => path.join(root, sourceRoot))
+  const references = []
+
+  for (const sourceRoot of sourceRoots) {
+    const files = await collectSourceFiles(root, sourceRoot)
+    for (const filePath of files) {
+      references.push(
+        ...collectLocalizationKeyReferences(filePath, await fs.readFile(filePath, 'utf8'), root)
+      )
+    }
+  }
+
+  return references
+}
+
+export async function main(
+  root = process.cwd(),
+  options = parseArgs(process.argv.slice(2)),
+  sharedReferences
+) {
   const localesDir = path.join(root, LOCALES_RELATIVE_DIR)
   const catalogPath = path.join(localesDir, 'en.json')
   const catalog = JSON.parse(await fs.readFile(catalogPath, 'utf8'))
@@ -461,17 +481,7 @@ export async function main(root = process.cwd(), options = parseArgs(process.arg
     return 0
   }
   let catalogKeys = new Set(flattenCatalogKeys(catalog))
-  const sourceRoots = LOCALIZATION_SOURCE_ROOTS.map((sourceRoot) => path.join(root, sourceRoot))
-  const references = []
-
-  for (const sourceRoot of sourceRoots) {
-    const files = await collectSourceFiles(root, sourceRoot)
-    for (const filePath of files) {
-      references.push(
-        ...collectLocalizationKeyReferences(filePath, await fs.readFile(filePath, 'utf8'), root)
-      )
-    }
-  }
+  const references = sharedReferences ?? (await collectLocalizationReferences(root))
 
   const missing = references.filter((reference) => !catalogKeys.has(reference.key))
   if (missing.length > 0) {
diff --git a/config/scripts/verify-localization-catalogs.mjs b/config/scripts/verify-localization-catalogs.mjs
new file mode 100644
index 000000000000..73eb9ab943ba
--- /dev/null
+++ b/config/scripts/verify-localization-catalogs.mjs
@@ -0,0 +1,30 @@
+import process from 'node:process'
+import { pathToFileURL } from 'node:url'
+import {
+  collectLocalizationReferences,
+  main as verifyCatalog
+} from './verify-localization-catalog.mjs'
+import { main as verifyRuntimeCatalog } from './generate-runtime-required-english-catalog.mjs'
+
+export async function main(root = process.cwd()) {
+  // Share only this invocation's scan, never cached evidence from another checkout.
+  const references = await collectLocalizationReferences(root)
+  const results = await Promise.allSettled([
+    verifyCatalog(root, {}, references),
+    verifyRuntimeCatalog(root, [], references)
+  ])
+  let exitCode = 0
+  for (const result of results) {
+    if (result.status === 'rejected') {
+      console.error(result.reason)
+      exitCode = 1
+    } else if (result.value !== 0) {
+      exitCode = 1
+    }
+  }
+  return exitCode
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  process.exit(await main())
+}
diff --git a/config/scripts/verify-localization-catalogs.test.mjs b/config/scripts/verify-localization-catalogs.test.mjs
new file mode 100644
index 000000000000..038bf34254e9
--- /dev/null
+++ b/config/scripts/verify-localization-catalogs.test.mjs
@@ -0,0 +1,80 @@
+import { mkdtemp, mkdir, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it } from 'vitest'
+import { main as verifyTogether } from './verify-localization-catalogs.mjs'
+import { main as verifyCatalog } from './verify-localization-catalog.mjs'
+import { main as verifyRuntimeCatalog } from './generate-runtime-required-english-catalog.mjs'
+
+const directories = []
+const renderer = 'src/renderer/src'
+const englishPath = `${renderer}/i18n/locales/en.json`
+const runtimePath = `${renderer}/i18n/en-runtime-required.json`
+
+async function fixture() {
+  const root = await mkdtemp(join(tmpdir(), 'orca-localization-checks-'))
+  directories.push(root)
+  await mkdir(join(root, renderer, 'i18n/locales'), { recursive: true })
+  await mkdir(join(root, 'src/main'), { recursive: true })
+  await writeFile(join(root, renderer, 'greeting.ts'), "translate('hello', 'Hello')\n")
+  await writeFile(join(root, 'src/main/ready.ts'), "translateMain('ready', 'Ready')\n")
+  await writeFile(
+    join(root, englishPath),
+    JSON.stringify({ hello: 'Hello', ready: 'Ready', dynamic: 'Required' })
+  )
+  await writeFile(join(root, runtimePath), JSON.stringify({ dynamic: 'Required' }))
+  return root
+}
+
+afterEach(async () => {
+  await Promise.all(directories.splice(0).map((root) => rm(root, { recursive: true, force: true })))
+})
+
+describe('combined localization verification', () => {
+  it.each([
+    ['valid catalogs', undefined, undefined, 0, 0],
+    ['missing reference', `${renderer}/greeting.ts`, "translate('missing', 'Missing')", 1, 1],
+    ['missing runtime entry', runtimePath, '{}', 0, 1],
+    ['contradictory runtime entry', runtimePath, '{"dynamic":"Wrong"}', 0, 1],
+    ['malformed runtime catalog', runtimePath, '{', 0, 1],
+    [
+      'inconsistent placeholders',
+      `${renderer}/greeting.ts`,
+      "translate('hello', 'Hello {{name}}'); translate('hello', 'Hello {{account}}')",
+      1,
+      1
+    ]
+  ])(
+    'preserves both standalone verdicts: %s',
+    async (_name, file, contents, catalogCode, combinedCode) => {
+      const root = await fixture()
+      if (file) {
+        await writeFile(join(root, file), contents)
+      }
+      const results = await Promise.allSettled([
+        verifyCatalog(root, {}),
+        verifyRuntimeCatalog(root, [])
+      ])
+      expect(results[0]).toMatchObject({ status: 'fulfilled', value: catalogCode })
+      const expected = results.some((result) => result.status === 'rejected' || result.value !== 0)
+        ? 1
+        : 0
+      expect(expected).toBe(combinedCode)
+      expect(await verifyTogether(root)).toBe(expected)
+    }
+  )
+
+  it('reads source edits, new files, removals, and separate roots on each invocation', async () => {
+    const root = await fixture()
+    expect(await verifyTogether(root)).toBe(0)
+    await writeFile(join(root, renderer, 'greeting.ts'), "translate('hello', 'New fallback')")
+    expect(await verifyTogether(root)).toBe(1)
+    await writeFile(join(root, renderer, 'greeting.ts'), "translate('hello', 'Hello')")
+    expect(await verifyTogether(root)).toBe(0)
+    await writeFile(join(root, 'src/main/added.ts'), "translateMain('absent', 'Absent')")
+    expect(await verifyTogether(root)).toBe(1)
+    await rm(join(root, 'src/main/added.ts'))
+    expect(await verifyTogether(root)).toBe(0)
+    expect(await verifyTogether(await fixture())).toBe(0)
+  })
+})
diff --git a/config/scripts/verify-packaged-orcad-template.cjs b/config/scripts/verify-packaged-orcad-template.cjs
new file mode 100644
index 000000000000..ad0e3fe485ad
--- /dev/null
+++ b/config/scripts/verify-packaged-orcad-template.cjs
@@ -0,0 +1,150 @@
+const { createHash } = require('node:crypto')
+const { lstatSync, readFileSync, readdirSync } = require('node:fs')
+const { basename, join } = require('node:path')
+const {
+  ORCAD_BUILD_TARGET_FILENAME,
+  ORCAD_TEMPLATE_MANIFEST_FILENAME,
+  ORCAD_TEMPLATE_TARGETS_DIR,
+  orcadTemplateCommonFilenames
+} = require('../../src/shared/orcad-artifacts.ts')
+const { ORCAD_TEMPLATE_TARGETS } = require('../../src/shared/orcad-bun-runtime.ts')
+
+const SHA256_PATTERN = /^[a-f0-9]{64}$/
+const BROWSER_NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]*$/
+
+function sha256(path) {
+  return createHash('sha256').update(readFileSync(path)).digest('hex')
+}
+
+function readManifest(templateDir) {
+  const path = join(templateDir, ORCAD_TEMPLATE_MANIFEST_FILENAME)
+  try {
+    return JSON.parse(readFileSync(path, 'utf8'))
+  } catch (error) {
+    throw new Error(
+      `[verify-packaged-orcad-template] invalid manifest at ${path}: ${error instanceof Error ? error.message : String(error)}`
+    )
+  }
+}
+
+function requireRecord(value, label) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) {
+    throw new Error(`[verify-packaged-orcad-template] ${label} must be an object`)
+  }
+  return value
+}
+
+function requireSha256(value, label) {
+  if (typeof value !== 'string' || !SHA256_PATTERN.test(value)) {
+    throw new Error(`[verify-packaged-orcad-template] ${label} must be a SHA-256 digest`)
+  }
+  return value
+}
+
+function requireRegularFile(path, label) {
+  let metadata
+  try {
+    metadata = lstatSync(path)
+  } catch {
+    throw new Error(`[verify-packaged-orcad-template] missing ${label} at ${path}`)
+  }
+  if (!metadata.isFile() || metadata.isSymbolicLink()) {
+    throw new Error(`[verify-packaged-orcad-template] ${label} is not a regular file at ${path}`)
+  }
+}
+
+function verifyFile(path, expected, label) {
+  requireRegularFile(path, label)
+  const actual = sha256(path)
+  if (actual !== expected) {
+    throw new Error(
+      `[verify-packaged-orcad-template] ${label} checksum mismatch: expected ${expected}, got ${actual}`
+    )
+  }
+}
+
+function requireExactNames(actual, expected, label) {
+  const actualNames = [...actual].sort()
+  const expectedNames = [...expected].sort()
+  if (
+    actualNames.length !== expectedNames.length ||
+    actualNames.some((name, index) => name !== expectedNames[index])
+  ) {
+    throw new Error(
+      `[verify-packaged-orcad-template] ${label} mismatch: expected=${expectedNames.join(',')} actual=${actualNames.join(',')}`
+    )
+  }
+}
+
+function verifyTarget(templateDir, target, value) {
+  const targetManifest = requireRecord(value, `${target} manifest`)
+  const targetSha256 = requireSha256(targetManifest.targetSha256, `${target} targetSha256`)
+  const watcherSha256 = requireSha256(targetManifest.watcherSha256, `${target} watcherSha256`)
+  const hasBrowserName = Object.hasOwn(targetManifest, 'browserName')
+  const hasBrowserSha256 = Object.hasOwn(targetManifest, 'browserSha256')
+  if (hasBrowserName !== hasBrowserSha256) {
+    throw new Error(
+      `[verify-packaged-orcad-template] ${target} browserName and browserSha256 must both be present`
+    )
+  }
+  const targetDir = join(templateDir, ORCAD_TEMPLATE_TARGETS_DIR, target)
+  const targetIdentity = join(targetDir, ORCAD_BUILD_TARGET_FILENAME)
+  verifyFile(targetIdentity, targetSha256, `${target} build target`)
+  if (readFileSync(targetIdentity, 'utf8').trim() !== target) {
+    throw new Error(`[verify-packaged-orcad-template] ${target} build target identity disagrees`)
+  }
+  verifyFile(join(targetDir, 'watcher.node'), watcherSha256, `${target} watcher`)
+
+  const expectedFiles = [ORCAD_BUILD_TARGET_FILENAME, 'watcher.node']
+  if (hasBrowserName) {
+    const browserName = targetManifest.browserName
+    if (
+      typeof browserName !== 'string' ||
+      !BROWSER_NAME_PATTERN.test(browserName) ||
+      basename(browserName) !== browserName
+    ) {
+      throw new Error(`[verify-packaged-orcad-template] ${target} browserName is invalid`)
+    }
+    verifyFile(
+      join(targetDir, browserName),
+      requireSha256(targetManifest.browserSha256, `${target} browserSha256`),
+      `${target} browser`
+    )
+    expectedFiles.push(browserName)
+  }
+  requireExactNames(readdirSync(targetDir), expectedFiles, `${target} file inventory`)
+}
+
+function verifyPackagedOrcadTemplate(resourcesDir) {
+  const templateDir = join(resourcesDir, 'orcad-template')
+  const manifest = requireRecord(readManifest(templateDir), 'manifest')
+  if (manifest.schemaVersion !== 2) {
+    throw new Error('[verify-packaged-orcad-template] manifest schemaVersion must be 2')
+  }
+  const commonSha256 = requireRecord(manifest.commonSha256, 'commonSha256')
+  const commonFilenames = orcadTemplateCommonFilenames()
+  requireExactNames(Object.keys(commonSha256), commonFilenames, 'common manifest inventory')
+  for (const filename of commonFilenames) {
+    verifyFile(
+      join(templateDir, ...filename.split('/')),
+      requireSha256(commonSha256[filename], `${filename} checksum`),
+      filename
+    )
+  }
+
+  const targets = requireRecord(manifest.targets, 'targets')
+  requireExactNames(Object.keys(targets), ORCAD_TEMPLATE_TARGETS, 'target manifest inventory')
+  requireExactNames(
+    readdirSync(join(templateDir, ORCAD_TEMPLATE_TARGETS_DIR)),
+    ORCAD_TEMPLATE_TARGETS,
+    'target directory inventory'
+  )
+  for (const target of ORCAD_TEMPLATE_TARGETS) {
+    verifyTarget(templateDir, target, targets[target])
+  }
+  console.log(
+    `[verify-packaged-orcad-template] OK — verified ${ORCAD_TEMPLATE_TARGETS.length} Bun targets`
+  )
+}
+
+module.exports = { verifyPackagedOrcadTemplate }
diff --git a/config/scripts/verify-packaged-orcad-template.test.mjs b/config/scripts/verify-packaged-orcad-template.test.mjs
new file mode 100644
index 000000000000..9be9b4564396
--- /dev/null
+++ b/config/scripts/verify-packaged-orcad-template.test.mjs
@@ -0,0 +1,93 @@
+import { createRequire } from 'node:module'
+import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it } from 'vitest'
+import {
+  ORCAD_TEMPLATE_MANIFEST_FILENAME,
+  ORCAD_TEMPLATE_TARGETS_DIR
+} from '../../src/shared/orcad-artifacts.ts'
+import { writeOrcadTemplateTestFixture } from './orcad-template-test-fixture.mjs'
+
+const require = createRequire(import.meta.url)
+const { verifyPackagedOrcadTemplate } = require('./verify-packaged-orcad-template.cjs')
+const builderConfig = require('../electron-builder.config.cjs')
+const roots = []
+
+async function createFixture() {
+  const root = await mkdtemp(join(tmpdir(), 'orca-packaged-orcad-template-'))
+  roots.push(root)
+  const templateDir = await writeOrcadTemplateTestFixture(root)
+  return { root, templateDir }
+}
+
+afterEach(async () => {
+  await Promise.all(roots.splice(0).map((root) => rm(root, { recursive: true, force: true })))
+})
+
+describe('verifyPackagedOrcadTemplate', () => {
+  it('accepts the exact six-target packaged template', async () => {
+    const fixture = await createFixture()
+
+    expect(() => verifyPackagedOrcadTemplate(fixture.root)).not.toThrow()
+  })
+
+  it('rejects target-native bytes changed after manifest generation', async () => {
+    const fixture = await createFixture()
+    await writeFile(
+      join(fixture.templateDir, ORCAD_TEMPLATE_TARGETS_DIR, 'linux-x64-glibc', 'watcher.node'),
+      'mutated'
+    )
+
+    expect(() => verifyPackagedOrcadTemplate(fixture.root)).toThrow(
+      'linux-x64-glibc watcher checksum mismatch'
+    )
+  })
+
+  it('rejects a missing Windows PTY gate worker', async () => {
+    const fixture = await createFixture()
+    await rm(join(fixture.templateDir, 'windows-bun-pty-gate-entry.js'))
+
+    expect(() => verifyPackagedOrcadTemplate(fixture.root)).toThrow('windows-bun-pty-gate-entry.js')
+  })
+
+  it.each(['writer', 'backup'])(
+    'requires the profile %s worker and its exact bytes',
+    async (role) => {
+      const fixture = await createFixture()
+      const filename = `profile-state-${role}-worker-entry.js`
+      await writeFile(join(fixture.templateDir, filename), 'stale-worker')
+      expect(() => verifyPackagedOrcadTemplate(fixture.root)).toThrow(
+        `${filename} checksum mismatch`
+      )
+      await rm(join(fixture.templateDir, filename))
+      expect(() => verifyPackagedOrcadTemplate(fixture.root)).toThrow(`missing ${filename}`)
+    }
+  )
+
+  it('rejects a missing target before the package reaches deployment', async () => {
+    const fixture = await createFixture()
+    const manifestPath = join(fixture.templateDir, ORCAD_TEMPLATE_MANIFEST_FILENAME)
+    const manifest = JSON.parse(await readFile(manifestPath, 'utf8'))
+    delete manifest.targets['linux-arm64-musl']
+    await writeFile(manifestPath, JSON.stringify(manifest))
+
+    expect(() => verifyPackagedOrcadTemplate(fixture.root)).toThrow(
+      'target manifest inventory mismatch'
+    )
+  })
+
+  it('does not ship the unused deployment template in desktop packages', async () => {
+    for (const platform of ['win', 'mac', 'linux']) {
+      expect(
+        builderConfig[platform].extraResources.some(
+          (resource) => typeof resource === 'object' && resource.to.startsWith('orcad-template')
+        )
+      ).toBe(false)
+    }
+    const { scripts } = JSON.parse(await readFile(join(process.cwd(), 'package.json'), 'utf8'))
+    for (const name of ['build:desktop', 'build:release', 'build:release:parallel']) {
+      expect(scripts[name]).not.toContain('build:orcad-template')
+    }
+  })
+})
diff --git a/config/scripts/win32-test-lane-registration.test.mjs b/config/scripts/win32-test-lane-registration.test.mjs
index a1566c55c31f..0cd947f722b1 100644
--- a/config/scripts/win32-test-lane-registration.test.mjs
+++ b/config/scripts/win32-test-lane-registration.test.mjs
@@ -69,7 +69,10 @@ import { classifyPrJobs } from './pr-code-change-scope.mjs'
 
 const projectDir = resolve(import.meta.dirname, '../..')
 const WINDOWS_LANE_JOB = 'package_windows'
-const WINDOWS_LANE_STEP = 'Test Windows-specific boundaries'
+const WINDOWS_LANE_STEPS = [
+  'Test Windows-specific boundaries',
+  'Test Windows installer process probe'
+]
 const WINDOWS_LANE_RUNNER = 'windows-2022'
 
 /**
@@ -288,19 +291,20 @@ function readWindowsWorkflow() {
   const jobs = Object.entries(workflow.jobs ?? {})
   const windowsJobs = jobs.filter(([, job]) => couldRunOnWindows(job?.['runs-on']))
   const steps = workflow.jobs?.[WINDOWS_LANE_JOB]?.steps ?? []
-  const step = steps.find((candidate) => candidate?.name === WINDOWS_LANE_STEP)
-  if (!step) {
-    throw new Error(
-      `No "${WINDOWS_LANE_STEP}" step in the ${WINDOWS_LANE_JOB} job of .github/workflows/pr.yml. ` +
-        'If it was renamed, update WINDOWS_LANE_STEP here -- do not delete this guard.'
-    )
-  }
-  const run = String(step.run ?? '')
-  if (!run.includes('vitest run')) {
-    throw new Error(
-      `The "${WINDOWS_LANE_STEP}" step no longer invokes vitest; this guard is stale.`
-    )
-  }
+  const runs = WINDOWS_LANE_STEPS.map((name) => {
+    const step = steps.find((candidate) => candidate?.name === name)
+    if (!step) {
+      throw new Error(
+        `No "${name}" step in ${WINDOWS_LANE_JOB}; update WINDOWS_LANE_STEPS if renamed.`
+      )
+    }
+    const run = String(step.run ?? '')
+    if (!run.includes('vitest run')) {
+      throw new Error(`The "${name}" step no longer invokes vitest; this guard is stale.`)
+    }
+    return run
+  })
+  const run = runs.join(' ')
   return {
     windowsJobNames: windowsJobs.map(([name]) => name),
     laneFiles: run.split(/\s+/).filter((token) => TEST_FILE_PATTERN.test(token))
@@ -331,7 +335,7 @@ function registrationFailure(path) {
   const missing = []
   if (!laneFiles.includes(path)) {
     missing.push(
-      `add "${path}" to the "${WINDOWS_LANE_STEP}" vitest argv in .github/workflows/pr.yml ` +
+      `add "${path}" to the "${WINDOWS_LANE_STEPS[0]}" vitest argv in .github/workflows/pr.yml ` +
         `(job ${WINDOWS_LANE_JOB})`
     )
   }
diff --git a/config/scripts/windows-process-tree-creation-time.cjs b/config/scripts/windows-process-tree-creation-time.cjs
index 88f231f14d36..769cd8854349 100644
--- a/config/scripts/windows-process-tree-creation-time.cjs
+++ b/config/scripts/windows-process-tree-creation-time.cjs
@@ -1,7 +1,7 @@
 'use strict'
 
 /**
- * Prove the COMPILED addon understands `CREATIONTIME`, not just the patched JS.
+ * Prove the compiled addon supports table and synchronous process creation-time reads.
  *
  * Unlike node-pty, this package ships a prebuilt `.node` at the same
  * `build/Release/` path node-gyp writes to, so neither a load nor a path check
@@ -23,17 +23,19 @@ function assertWindowsProcessTreeCreationTime({ module, platform = process.platf
     return
   }
   const supported = module?.supportedProcessDataFlags
-  if (typeof supported === 'number' && (supported & CREATION_TIME_FLAG) !== 0) {
+  if (
+    typeof supported === 'number' &&
+    (supported & CREATION_TIME_FLAG) !== 0 &&
+    typeof module?.getProcessCreationTime === 'function'
+  ) {
     return
   }
   throw new Error(
     [
-      '@vscode/windows-process-tree does not report CreationTime support',
+      '@vscode/windows-process-tree does not report CreationTime support with a synchronous identity getter',
       `(supportedProcessDataFlags=${String(supported)}).`,
-      'That is the tarball prebuilt, not a build of the patched source, so every',
-      'process row comes back without creationTimeMs: Windows descendant exit',
-      'verification cannot identify a PID and structured Claude/Codex chat runs',
-      'with an unprovable child-tree reaper.',
+      'This is an unpatched or older binary, so process identities or synchronous',
+      'profile-owner recovery are unavailable.',
       'Rebuild it from source so config/patches/@vscode__windows-process-tree@0.8.0.patch applies.'
     ].join(' ')
   )
diff --git a/config/scripts/windows-process-tree-creation-time.test.mjs b/config/scripts/windows-process-tree-creation-time.test.mjs
new file mode 100644
index 000000000000..8bfbf17d7138
--- /dev/null
+++ b/config/scripts/windows-process-tree-creation-time.test.mjs
@@ -0,0 +1,37 @@
+import { createRequire } from 'node:module'
+import { expect, it } from 'vitest'
+
+const { assertWindowsProcessTreeCreationTime } = createRequire(import.meta.url)(
+  './windows-process-tree-creation-time.cjs'
+)
+
+it('rejects a previously patched binary that has table creation times but no synchronous getter', () => {
+  expect(() =>
+    assertWindowsProcessTreeCreationTime({
+      platform: 'win32',
+      module: { supportedProcessDataFlags: 7 }
+    })
+  ).toThrow('synchronous identity getter')
+})
+
+it('accepts the compiled capability only when both readers are available', () => {
+  expect(() =>
+    assertWindowsProcessTreeCreationTime({
+      platform: 'win32',
+      module: { supportedProcessDataFlags: 7, getProcessCreationTime: () => undefined }
+    })
+  ).not.toThrow()
+})
+
+it('still rejects a binary without table creation-time support', () => {
+  expect(() =>
+    assertWindowsProcessTreeCreationTime({
+      platform: 'win32',
+      module: { getProcessCreationTime: () => undefined }
+    })
+  ).toThrow('CreationTime support')
+})
+
+it('does not require Windows native capabilities on another platform', () => {
+  expect(() => assertWindowsProcessTreeCreationTime({ platform: 'darwin' })).not.toThrow()
+})
diff --git a/config/scripts/windows-process-tree-gyp-rebuild.mjs b/config/scripts/windows-process-tree-gyp-rebuild.mjs
index 6f21fb2a153a..befbcf96acc6 100644
--- a/config/scripts/windows-process-tree-gyp-rebuild.mjs
+++ b/config/scripts/windows-process-tree-gyp-rebuild.mjs
@@ -39,9 +39,13 @@ const CREATION_TIME_PATCH_MARKERS = [
   ['src/process.cc', 'GetProcessCreationTime(pinfo)'],
   ['src/process.cc', 'GetProcessTimes(hProcess, &creationTime'],
   ['src/process_worker.cc', 'object.Set("creationTimeMs"'],
+  ['src/addon.cc', 'exports.Set("getProcessCreationTime"'],
   ['lib/index.js', '["CreationTime"] = 4'],
+  ['lib/index.js', 'exports.getProcessCreationTime'],
   ['lib/index.ts', 'CreationTime = 4'],
-  ['typings/windows-process-tree.d.ts', 'creationTimeMs?: number']
+  ['lib/index.ts', 'export const getProcessCreationTime'],
+  ['typings/windows-process-tree.d.ts', 'creationTimeMs?: number'],
+  ['typings/windows-process-tree.d.ts', 'export const getProcessCreationTime']
 ]
 
 export const WINDOWS_PROCESS_TREE_NODE_ADDON_API_HEADERS = [
diff --git a/config/scripts/windows-pty-table-stress.cjs b/config/scripts/windows-pty-table-stress.cjs
new file mode 100644
index 000000000000..b703e18d19ce
--- /dev/null
+++ b/config/scripts/windows-pty-table-stress.cjs
@@ -0,0 +1,156 @@
+'use strict'
+
+const assert = require('node:assert/strict')
+const { createHash } = require('node:crypto')
+const { readFileSync, writeSync } = require('node:fs')
+const { dirname, resolve } = require('node:path')
+
+function report(phase, details = {}) {
+  writeSync(1, `${JSON.stringify({ phase, hostPid: process.pid, ...details })}\n`)
+}
+
+async function exerciseTable() {
+  assert.equal(process.platform, 'win32', 'This probe requires real Windows ConPTY')
+  const rounds = Number(process.env.ORCA_PTY_TABLE_STRESS_ROUNDS ?? 8)
+  assert.ok(Number.isInteger(rounds) && rounds > 0 && rounds <= 2000)
+  const pty = require('node-pty')
+  const nativePath = require.resolve('node-pty/lib/utils')
+  const loaded = require(nativePath).loadNativeModule('conpty')
+  const native = loaded.module
+  const addonPath = resolve(dirname(nativePath), loaded.dir, 'conpty.node')
+  report('native', {
+    addonPath,
+    sha256: createHash('sha256').update(readFileSync(addonPath)).digest('hex'),
+    node: process.version,
+    rounds
+  })
+  // Unlike production's fallback, this crash probe requires a host that permits nested jobs.
+  const hostJobAssigned = native.assignCurrentProcessToJob()
+  report('host-job-precondition', { assigned: hostJobAssigned })
+  assert.equal(hostJobAssigned, true, 'Probe precondition: host must permit a crash-cleanup job')
+
+  const spawned = []
+  function spawn(round, slot) {
+    report('spawn', { round, slot })
+    const proc = pty.spawn(process.env.ComSpec || 'cmd.exe', ['/d', '/q'], {
+      cwd: process.cwd(),
+      cols: 80,
+      rows: 24,
+      useConptyDll: true
+    })
+    const record = { proc, output: '', exited: false, closed: false }
+    const marker = `ORCA_PTY_READY_${spawned.length}`
+    let resolveReady
+    record.ready = new Promise((resolve) => {
+      resolveReady = resolve
+    })
+    record.exit = new Promise((resolveExit) => {
+      proc.onExit((event) => {
+        record.exited = true
+        resolveReady(false)
+        resolveExit(event)
+      })
+    })
+    proc.onData((chunk) => {
+      record.output = (record.output + chunk).slice(-2048)
+      if (record.output.includes(marker)) {
+        resolveReady(true)
+      }
+    })
+    spawned.push(record)
+    // Escaping one letter keeps echoed input from satisfying the output marker.
+    proc.write(`echo ${marker.replace('READY', 'REA^DY')}\r`)
+    return record
+  }
+
+  async function waitForReady(records) {
+    let timer
+    try {
+      await Promise.race([
+        Promise.all(
+          records.map(async (record) => {
+            assert.equal(await record.ready, true, `Shell exited before ready: ${record.output}`)
+          })
+        ),
+        new Promise((_, reject) => {
+          timer = setTimeout(() => {
+            const transcripts = records.map(({ proc, output }) => ({ pid: proc.pid, output }))
+            reject(new Error(`PTY readiness timed out: ${JSON.stringify(transcripts)}`))
+          }, 15_000)
+        })
+      ])
+    } finally {
+      clearTimeout(timer)
+    }
+    for (const { proc } of records) {
+      const members = native.listJobProcessIds(proc._pty, proc.pid)
+      assert.ok(members?.includes(proc.pid), `Ready shell ${proc.pid} must retain its job`)
+    }
+    report('ready', { shellPids: records.map(({ proc }) => proc.pid) })
+  }
+
+  function close(record, round, slot) {
+    report('kill', { round, slot, shellPid: record.proc.pid })
+    record.proc.kill()
+    record.closed = true
+  }
+
+  let failure
+  try {
+    const survivor = spawn(-1, -1)
+    await waitForReady([survivor])
+    const slots = []
+    for (let round = 0; round < rounds; round += 1) {
+      for (let slot = 0; slot < 3; slot += 1) {
+        if (slots[slot]) {
+          close(slots[slot], round, slot)
+        }
+        // The next lookup/insertion overlaps the previous shell's native exit watcher.
+        slots[slot] = spawn(round, slot)
+        report('resize-clear-list', { round, slot, shellPid: survivor.proc.pid })
+        survivor.proc.resize(80 + (round % 2), 24)
+        survivor.proc.clear()
+        const members = native.listJobProcessIds(survivor.proc._pty, survivor.proc.pid)
+        assert.ok(members?.includes(survivor.proc.pid), 'A live survivor must retain its job')
+      }
+      // A ready terminal runs kill/resize/clear immediately instead of deferring them.
+      await waitForReady(slots)
+    }
+    assert.equal(survivor.exited, false, survivor.output)
+    report('overlap-complete', { terminals: spawned.length })
+  } catch (error) {
+    failure = { error }
+  } finally {
+    for (const record of spawned) {
+      if (!record.closed) {
+        close(record, -1, -1)
+      }
+    }
+    let timer
+    try {
+      await Promise.race([
+        Promise.all(spawned.map((record) => record.exit)),
+        new Promise((_, reject) => {
+          timer = setTimeout(() => reject(new Error('PTY exit callbacks did not drain')), 15_000)
+        })
+      ])
+    } catch (error) {
+      if (failure) {
+        report('drain-error', { message: error.stack })
+      } else {
+        failure = { error }
+      }
+    } finally {
+      clearTimeout(timer)
+    }
+  }
+  if (failure) {
+    throw failure.error
+  }
+  report('complete', { terminals: spawned.length })
+}
+
+exerciseTable().catch((error) => {
+  report('error', { message: error.stack })
+  process.exitCode = 1
+})
diff --git a/config/scripts/worktree-refresh-churn-benchmark.mjs b/config/scripts/worktree-refresh-churn-benchmark.mjs
index 5a165801ded1..9e7fdffcf3c8 100644
--- a/config/scripts/worktree-refresh-churn-benchmark.mjs
+++ b/config/scripts/worktree-refresh-churn-benchmark.mjs
@@ -1,7 +1,16 @@
 #!/usr/bin/env node
 import { performance } from 'node:perf_hooks'
-import { planWorktreeSortOrderUpdates } from '../../src/shared/worktree/sort-order-update.ts'
-import { reuseEqualCatalogRows } from '../../src/renderer/src/store/slices/worktree-catalog-reconciliation.ts'
+import { createJiti } from 'jiti'
+
+// jiti, not a bare `node` import: type-stripping cannot resolve the extensionless
+// relative imports inside the module graph under test.
+const jiti = createJiti(import.meta.url)
+const { planWorktreeSortOrderUpdates } = await jiti.import(
+  '../../src/shared/worktree/sort-order-update.ts'
+)
+const { reuseEqualCatalogRows } = await jiti.import(
+  '../../src/renderer/src/store/slices/worktree-catalog-reconciliation.ts'
+)
 
 const WORKTREE_COUNT = 655
 const TAB_COUNT = 1_895
diff --git a/config/scripts/xterm-dependency-cache.test.mjs b/config/scripts/xterm-dependency-cache.test.mjs
new file mode 100644
index 000000000000..4c4f69191ef3
--- /dev/null
+++ b/config/scripts/xterm-dependency-cache.test.mjs
@@ -0,0 +1,72 @@
+import { readFileSync } from 'node:fs'
+import { expect, it } from 'vitest'
+import { parse } from 'yaml'
+
+const readYaml = (path) => parse(readFileSync(new URL(path, import.meta.url), 'utf8'))
+const action = readYaml('../../.github/actions/prepare-xterm-dependencies/action.yml')
+const workflow = readYaml('../../.github/workflows/ci-xterm-cache.yml')
+const restore = action.runs.steps.find((step) => step.id === 'restore')
+
+it('separates toolchains and restores dependencies without a stale fallback or build results', () => {
+  for (const input of [
+    'runner.os',
+    'runtime.outputs.image',
+    'runner.arch',
+    'runtime.outputs.node',
+    'xterm-upstream.json',
+    'regenerate-xterm-patches.mjs',
+    'xterm-patch-text.mjs',
+    'prepare-xterm-dependencies/action.yml'
+  ]) {
+    expect(restore.with.key).toContain(input)
+  }
+  expect(restore.uses).toBe('actions/cache/restore@v5')
+  expect(restore.with['restore-keys']).toBeUndefined()
+  expect(restore.with.path.trim().split('\n')).toEqual([
+    '${{ runner.temp }}/xterm-patch-build/upstream/.git',
+    '${{ runner.temp }}/xterm-patch-build/upstream/node_modules'
+  ])
+})
+
+it('publishes only from main after a successful fresh verification, and skips work on hits', () => {
+  expect(workflow.on.pull_request).toBeUndefined()
+  expect(workflow.on.push.branches).toEqual(['main'])
+  expect(workflow.jobs.seed.if).toBe("github.ref == 'refs/heads/main'")
+  expect(workflow.permissions).toEqual({ contents: 'read' })
+  const steps = workflow.jobs.seed.steps
+  const verify = steps.find((step) => step.name === 'Verify and populate dependencies')
+  const save = steps.find((step) => step.uses === 'actions/cache/save@v5')
+  expect(verify.if).toBe("steps.cache.outputs.cache-hit != 'true'")
+  expect(save.if).toBe(verify.if)
+  expect(save.with.path).toBe(restore.with.path)
+  expect(save.with.key).toBe('${{ steps.cache.outputs.cache-key }}')
+  expect(steps.indexOf(save)).toBeGreaterThan(steps.indexOf(verify))
+  expect(verify.run).toContain('regenerate-xterm-patches.mjs --check')
+  const pr = readYaml('../../.github/workflows/pr.yml').jobs.xterm_patch_sync.steps
+  expect(workflow.jobs.seed['runs-on']).toBe(
+    readYaml('../../.github/workflows/pr.yml').jobs.xterm_patch_sync['runs-on']
+  )
+  expect(pr.some((step) => step.uses === './.github/actions/prepare-xterm-dependencies')).toBe(true)
+  expect(pr.some((step) => /cache(?:\/save)?@/.test(step.uses ?? ''))).toBe(false)
+  expect(pr.at(-1).run).toContain('regenerate-xterm-patches.mjs --check')
+})
+
+it('restores download fallback only on a miss and preserves its established key and paths', () => {
+  const fallback = action.runs.steps.at(-1)
+  const save = workflow.jobs.seed.steps.at(-1)
+  expect(fallback.if).toBe("steps.restore.outputs.cache-hit != 'true'")
+  expect(fallback.uses).toBe('actions/cache/restore@v5')
+  expect(fallback.with).toEqual(save.with)
+  expect(save.if).toBe("steps.cache.outputs.cache-hit != 'true'")
+})
+
+it('runs the standalone generator without installing unrelated Orca dependencies', () => {
+  const steps = readYaml('../../.github/workflows/pr.yml').jobs.xterm_patch_sync.steps
+  expect(steps.some((step) => step.uses === './.github/actions/install-node-dependencies')).toBe(
+    false
+  )
+  expect(steps.find((step) => step.uses === 'actions/setup-node@v6').with).toEqual({
+    'node-version-file': 'package.json',
+    'package-manager-cache': false
+  })
+})
diff --git a/config/scripts/zip-extractor-command.mjs b/config/scripts/zip-extractor-command.mjs
new file mode 100644
index 000000000000..fbd4c696748b
--- /dev/null
+++ b/config/scripts/zip-extractor-command.mjs
@@ -0,0 +1 @@
+export { getZipExtractorCommand } from '../../src/shared/zip-extractor-command.ts'
diff --git a/config/scripts/zip-extractor-command.test.mjs b/config/scripts/zip-extractor-command.test.mjs
new file mode 100644
index 000000000000..9cc574f87ec6
--- /dev/null
+++ b/config/scripts/zip-extractor-command.test.mjs
@@ -0,0 +1,62 @@
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { runProcessSync } from './script-child-process.mjs'
+import { getZipExtractorCommand } from './zip-extractor-command.mjs'
+
+const directories = []
+afterEach(() => {
+  vi.unstubAllEnvs()
+  vi.restoreAllMocks()
+  for (const directory of directories.splice(0)) {
+    rmSync(directory, { recursive: true, force: true })
+  }
+})
+
+function extract(bytes) {
+  const directory = mkdtempSync(join(tmpdir(), "orca archive '$ "))
+  directories.push(directory)
+  const archive = join(directory, "source '$.zip")
+  const destination = join(directory, "output '$")
+  writeFileSync(archive, bytes)
+  mkdirSync(destination)
+  const command = getZipExtractorCommand(archive, destination)
+  const result = runProcessSync({ program: command.file, args: command.args, timeoutMs: 120_000 })
+  return { result, destination }
+}
+
+describe('native archive extraction', () => {
+  it('uses the system archive reader on Windows unless an override is configured', () => {
+    vi.spyOn(process, 'platform', 'get').mockReturnValue('win32')
+    vi.stubEnv('SystemRoot', 'C:\\Windows')
+    vi.stubEnv('ORCA_UNZIP_BIN', '')
+    expect(getZipExtractorCommand('source.zip', 'output')).toEqual({
+      file: join('C:\\Windows', 'System32', 'tar.exe'),
+      args: ['-xf', 'source.zip', '-C', 'output'],
+      label: 'tar'
+    })
+    vi.stubEnv('ORCA_UNZIP_BIN', 'C:\\tools\\unzip.exe')
+    expect(getZipExtractorCommand("source '$.zip", "output '$")).toEqual({
+      file: 'C:\\tools\\unzip.exe',
+      args: ['-q', "source '$.zip", '-d', "output '$"],
+      label: 'unzip'
+    })
+  })
+
+  it('extracts through paths containing spaces, apostrophes and shell characters', () => {
+    const { result, destination } = extract(
+      Buffer.from(
+        'UEsDBBQAAAAAAI1iOF16rk6zGAAAABgAAAALAAAAcGF5bG9hZC50eHR2ZXJpZmllZCBhcmNoaXZlIHBheWxvYWRQSwECFAMUAAAAAACNYjhdeq5OsxgAAAAYAAAACwAAAAAAAAAAAAAAgAEAAAAAcGF5bG9hZC50eHRQSwUGAAAAAAEAAQA5AAAAQQAAAAAA',
+        'base64'
+      )
+    )
+    expect(result.code, result.stderr).toBe(0)
+    expect(readFileSync(join(destination, 'payload.txt'), 'utf8')).toBe('verified archive payload')
+  })
+
+  it('fails on a malformed archive', () => {
+    const { result } = extract('invalid archive')
+    expect(result.code).not.toBe(0)
+  })
+})
diff --git a/config/tsconfig.cli.json b/config/tsconfig.cli.json
index cfb75813483c..f6dfcfcd55b9 100644
--- a/config/tsconfig.cli.json
+++ b/config/tsconfig.cli.json
@@ -6,6 +6,7 @@
     "../src/main/agent-state-file-reader.ts",
     "../src/main/agent-hooks/grok-replay-guard.ts",
     "../src/main/claude/hook-script.ts",
+    "../src/main/qoder/hook-service.ts",
     "../src/main/claude/claude-session-end-hook-capability.ts",
     "../src/main/agent-hooks/hook-stdin-contract.ts",
     "../src/main/agent-hooks/hook-post-command.ts",
@@ -18,8 +19,80 @@
     "../src/main/agent-hooks/managed-agent-hook-controls.ts",
     "../src/main/agent-hooks/managed-agent-hook-registry.ts",
     "../src/main/agent-hooks/managed-hook-script-refresh.ts",
+    "../src/main/agent-hooks/managed-hooks-json-events.ts",
     "../src/main/agent-hooks/posix-hook-command.ts",
     "../src/main/agent-hooks/runtime-home-hook-command.ts",
+    "../src/main/orca-profiles/profile-storage-paths.ts",
+    "../src/main/orca-profiles/profile-index-store.ts",
+    "../src/main/orca-profiles/profile-telemetry-consent-seed.ts",
+    "../src/main/orca-profiles/profile-legacy-state-import.ts",
+    "../src/main/persistence/profile-state/profile-state-migration.ts",
+    "../src/main/persistence/profile-state/profile-state-database-publication.ts",
+    "../src/main/persistence/profile-state/profile-state-database.ts",
+    "../src/main/persistence/profile-state/profile-state-database-errors.ts",
+    "../src/main/persistence/profile-state/profile-state-database-validation.ts",
+    "../src/main/persistence/profile-state/profile-state-database-schema.ts",
+    "../src/main/persistence/profile-state/profile-state-documents.ts",
+    "../src/main/persistence/profile-state/legacy-json/profile-state-json-acceptance.ts",
+    "../src/main/persistence/profile-state/profile-state-revision.ts",
+    "../src/main/persistence/profile-state/profile-state-read-snapshot.ts",
+    "../src/main/persistence/profile-state/profile-state-sqlite-authority.ts",
+    "../src/main/persistence/profile-state/legacy-json/profile-state-authority-exports.ts",
+    "../src/main/persistence/profile-state/profile-state-complete-replacements.ts",
+    "../src/main/persistence/profile-state/profile-state-revision-readmission.ts",
+    "../src/main/persistence/profile-state/profile-state-writer-protocol.ts",
+    "../src/main/persistence/loading-store/profile-state-authority.ts",
+    "../src/main/persistence/profile-state/profile-state-automation-runs-migration.ts",
+    "../src/main/persistence/profile-state/profile-state-document-reader.ts",
+    "../src/main/persistence/profile-state/profile-state-document-validation.ts",
+    "../src/main/persistence/profile-state/profile-state-domain-writes.ts",
+    "../src/main/persistence/profile-state/profile-state-write-transaction.ts",
+    "../src/main/persistence/profile-state/profile-state-domain-write-validation.ts",
+    "../src/main/persistence/profile-state/profile-state-domain-reader.ts",
+    "../src/main/persistence/profile-state/profile-state-automation-runs.ts",
+    "../src/main/persistence/profile-state/profile-state-automation-runs-model.ts",
+    "../src/main/persistence/profile-state/profile-state-automation-runs-payload.ts",
+    "../src/main/persistence/profile-state/profile-state-automation-runs-reader.ts",
+    "../src/main/persistence/profile-state/profile-state-automation-runs-storage.ts",
+    "../src/main/persistence/profile-state/profile-state-automation-runs-validation.ts",
+    "../src/main/persistence/profile-state/profile-state-automation-runs-writer.ts",
+    "../src/main/persistence/profile-state/profile-state-offline-settings.ts",
+    "../src/main/persistence/profile-state/legacy-json/profile-state-export-path.ts",
+    "../src/main/persistence/profile-state/legacy-json/profile-state-legacy-backup-path.ts",
+    "../src/main/persistence/profile-state/profile-state-backup-path.ts",
+    "../src/main/persistence/profile-state/profile-state-backup-rotation.ts",
+    "../src/main/persistence/profile-state/profile-state-backup-job.ts",
+    "../src/main/persistence/profile-state/profile-state-backup-worker.ts",
+    "../src/main/persistence/profile-state/profile-state-backup-worker-entry.ts",
+    "../src/main/worker-thread-entry-path.ts",
+    "../src/main/persistence/profile-state/profile-state-database-snapshot.ts",
+    "../src/main/persistence/profile-state/profile-state-database-recovery.ts",
+    "../src/main/persistence/profile-state/profile-state-recovery-required.ts",
+    "../src/main/persistence/profile-state/legacy-json/profile-state-recovery.ts",
+    "../src/main/persistence/profile-state/profile-state-recovery-copy.ts",
+    "../src/main/persistence/profile-state/profile-state-recovery-command.ts",
+    "../src/main/orca-profiles/profile-project-move-record.ts",
+    "../src/main/orca-profiles/profile-project-domain-changes.ts",
+    "../src/main/persistence/profile-state/profile-state-active-location.ts",
+    "../src/main/persistence/profile-state/profile-state-access.ts",
+    "../src/main/persistence/profile-state/profile-state-access-owner.ts",
+    "../src/main/persistence/profile-state/profile-state-access-identity.ts",
+    "../src/main/windows-native-registry.ts",
+    "../src/main/windows/windows-command-line-recovery-health.ts",
+    "../src/main/windows/windows-process-table.ts",
+    "../src/main/windows/windows-process-table-cim-scan.ts",
+    "../src/main/daemon/daemon-process-start-time.ts",
+    "../src/main/daemon/daemon-process-identity-query.ts",
+    "../src/main/startup/startup-diagnostics.ts",
+    "../src/main/persistence/profile-state/legacy-json/profile-state-versioned-export.ts",
+    "../src/main/persistence/profile-state/profile-state-backup-temporary-files.ts",
+    "../src/main/persistence/profile-state/profile-state-database-quarantine.ts",
+    "../src/main/persistence/profile-state/profile-state-storage-classification.ts",
+    "../src/main/durable-file-write.ts",
+    "../src/shared/secure-file.ts",
+    "../src/main/sqlite/harden-database-files.ts",
+    "../src/main/startup/http1-compatibility-marker.ts",
+    "../src/main/startup/http1-compatibility-profile-state.ts",
     "../src/main/agent-hooks/windows-direct-cmd-hook-command.ts",
     "../src/main/agent-hooks/windows-powershell-hook-launcher.ts",
     "../src/main/amp/agent-status-plugin-source.ts",
@@ -33,6 +106,7 @@
     "../src/main/claude/hook-service.ts",
     "../src/main/claude/statusline-script.ts",
     "../src/main/claude-accounts/keychain.ts",
+    "../src/main/macos-keychain/generic-password.ts",
     "../src/main/codex/codex-app-server-capability-cache.ts",
     "../src/main/codex/codex-app-server-capability-signal.ts",
     "../src/main/codex/codex-app-server-client.ts",
@@ -44,6 +118,7 @@
     "../src/main/codex/codex-config-settings-preservation.ts",
     "../src/main/codex/codex-config-settings-removal.ts",
     "../src/main/codex/codex-config-settings-upsert.ts",
+    "../src/main/codex/codex-daemon-socket-path-guard.ts",
     "../src/main/codex/codex-home-paths.ts",
     "../src/main/codex/codex-hook-definition.ts",
     "../src/main/codex/codex-managed-home-resource-copy-marker.ts",
@@ -90,6 +165,7 @@
     "../src/main/codex/config-toml-hook-trust-read.ts",
     "../src/main/codex/config-toml-key-path.ts",
     "../src/main/codex/config-toml-line-scan.ts",
+    "../src/main/codex/config-toml-mcp-servers.ts",
     "../src/main/codex/config-toml-project-trust.ts",
     "../src/main/codex/config-toml-runtime-owned-sections.ts",
     "../src/main/codex/config-toml-syntax.ts",
@@ -123,6 +199,8 @@
     "../src/main/devin/hook-settings.ts",
     "../src/main/devin/hook-service.ts",
     "../src/main/devin/hook-config-json.ts",
+    "../src/main/hermes/hermes-config-document.ts",
+    "../src/main/hermes/hermes-config-source-edits.ts",
     "../src/main/hermes/hermes-config-yaml.ts",
     "../src/main/hermes/hermes-home-filesystem.ts",
     "../src/main/hermes/hermes-managed-plugin-source.ts",
@@ -131,6 +209,9 @@
     "../src/main/in-flight-run-dedupe.ts",
     "../src/main/kimi/hook-service.ts",
     "../src/main/kimi/kimi-hook-config-toml.ts",
+    "../src/main/dsh/dsh-home-patch.ts",
+    "../src/main/dsh/hook-service.ts",
+    "../src/main/dsh/hook-settings.ts",
     "../src/main/muse/hook-config-json.ts",
     "../src/main/muse/hook-service.ts",
     "../src/main/muse/hook-settings.ts",
@@ -148,6 +229,12 @@
     "../src/main/startup/cli-command-names.ts",
     "../src/main/runtime/runtime-metadata.ts",
     "../src/main/sqlite/sync-database.ts",
+    "../src/main/sqlite/bun-readonly-wal.ts",
+    "../src/main/sqlite/sqlite-statement.ts",
+    "../src/main/sqlite/sqlite-integer-reader.ts",
+    "../src/main/sqlite/node-sqlite-statement.ts",
+    "../src/main/sqlite/bun-sqlite-statement.ts",
+    "../src/main/sqlite/bun-sqlite-database.ts",
     "../src/main/win32-utils.ts"
   ],
   "compilerOptions": {
diff --git a/config/tsconfig.node.json b/config/tsconfig.node.json
index c42b937a4671..4f7cc41bcc1e 100644
--- a/config/tsconfig.node.json
+++ b/config/tsconfig.node.json
@@ -6,6 +6,8 @@
     "./scripts/vitest-host-ports-setup.ts",
     "../src/main/**/*",
     "../src/renderer/src/lib/skill-freshness-display-status.ts",
+    "../src/renderer/src/components/native-chat/native-chat-resolution-receipt.ts",
+    "../src/renderer/src/components/native-chat/structured-agent-question-projection.ts",
     "../src/preload/**/*",
     "../src/shared/**/*",
     "../src/relay/**/*",
diff --git a/config/update-translation.txt b/config/update-translation.txt
new file mode 100644
index 000000000000..d1a85bab7240
--- /dev/null
+++ b/config/update-translation.txt
@@ -0,0 +1,67 @@
+# Translation scan tracker
+
+Recurring task: after a batch of merged PRs, scan for i18n gaps and fix them:
+1. unkeyed user-visible UI strings (gate: `audit:localization` / `verify:localization-coverage`),
+2. keyed strings missing target-locale translations (en.json has the key, es/fr/ja/ko/zh does not),
+3. badly translated target values (placeholder mismatch, brand/term policy violations).
+
+Method (reproducible):
+- `node config/scripts/verify-localization-catalog.mjs` — key references vs en.json,
+  per-locale coverage, interpolation mismatches, generic-term regressions.
+- `node config/scripts/audit-localization-coverage.mjs --check` — unkeyed strings.
+- `node config/scripts/verify-localization-extraction.mjs` — en.json in sync with code.
+- Missing-key delta since last scan: flatten en.json at HEAD vs at the last-scanned
+  base commit, keep keys absent from each target locale.
+- Translate the delta per `config/i18n-translation-source.md` policy and the overrides in
+  `config/scripts/locale-*-overrides.mjs` / `locale-*-fixes.mjs` / `locale-generic-ui-terms.mjs`
+  (brands such as Orca/OpenCode/Git/Python stay Latin; `{{placeholders}}`, markdown links,
+  backtick code spans, and `[python.org](...)` links are preserved verbatim).
+- Apply with `node config/scripts/apply-translation-delta.mjs /tmp/translations.json`
+  (validates placeholder parity and runs every value through `repairTranslatedValue`
+  so CJK spacing, brand-mistranslation fixes, and phrase fixes match the repo pipeline).
+- Re-run all four gates plus the vitest locale suites before finishing.
+- Mobile (`mobile/`) has no locale catalogs (only SVG `translate()` transforms); out of scope
+  until the mobile catalog migration lands. Missing keys fall back to English at runtime
+  (sparse-catalog architecture, PR #8512), so untranslated leftovers are safe, not broken.
+
+## Scan 2026-09-25 (first tracked scan; no prior file existed)
+
+- HEAD scanned: 80e0bee23b (2026-09-24)
+- Window covered: 519bde81df^ .. HEAD (all PRs merged 2026-09-23..2026-09-24 back to and
+  including #22519; en.json deltas computed per commit, full commit list below).
+- Gates before fix: catalog verify PASS, coverage --check PASS (58 allowlisted), extraction
+  PASS, runtime-catalog PASS. So no unkeyed strings and en.json in sync; the gap was
+  target-locale coverage only.
+
+## Scan 2026-09-26
+
+- HEAD scanned: a15a5c8c1a6 (origin/main @ 067975bfd1 plus merge; 12 newest main
+  commits add zero en keys, verified).
+- Window covered: 80e0bee23b .. HEAD. Note: the previous scan's own branch commits
+  (chat-resume/Git-toolchain/notebook translations + fr/ko terminology fixes +
+  jupyter fix) have since landed upstream as #22746, so this scan's base-to-HEAD
+  delta already includes them; the merge was resolved with --theirs on
+  es/fr/ja/zh (our stale native-chat.handoff.* translations correctly dropped:
+  the keys were removed from en.json by upstream #22783).
+- Delta since base: 113 new en keys (mostly sessionSearch x44, resume-modal
+  activity, ipynb venv, Cursor accounts, feature-tips), 4 changed en values
+  (3x "mid-turn" -> "working" resume copy; screenshotsHint gained {{maxSize}}).
+  fr/ja/ko/zh translations of the 3 resume keys already matched new semantics.
+- Applied: es +111 (107 new + 3 resume + screenshotsHint), fr/ja/ko/zh +100 each
+  (99 new + screenshotsHint) via apply-translation-delta.mjs (pipeline repaired
+  ja 使用状況->使用量 x1, ja phrase x2, zh 智能体->代理 x5). Strictly additive:
+  +511 keys, 0 removed.
+- Gates after fix: catalog verify PASS (fr/ja/ko/zh 14733/14733 = 100%;
+  es 12328/14733, remaining 2405 missing are pre-existing es backlog, out of
+  delta scope), coverage --check PASS (58 allowlisted), extraction PASS,
+  locale vitest suites PASS (policy x7 files, ko overrides, generic terms,
+  frozen keywords, native-chat locales).
+- Reviews (3 of max 4 rounds, subagents; round 0 = 5 parallel translators):
+  R1 fixed 20 (es kw.rateLimit->EN per 10-hit precedent; fr NBSP guillemets;
+  ja settingsLink/progressStarting; ko demo-snippet localization x8 +
+  consentInstruction fragment; zh x6 incl. 仪表盘/表结构/工作流程).
+  R2 fixed 5 and reverted fr NBSP->plain spaces (91-vs-7 file convention;
+  R1 evidence was circular) + ja kw.spend->追加料金 + ja particle fix +
+  ko 색인화. R3 sign-off clean on all locales (R2 fixes byte-verified,
+  full placeholder parity 0 mismatches, 0 missing keys).
+
diff --git a/config/vitest.config.ts b/config/vitest.config.ts
index beaf82f4e12d..b81bbc2b0f3a 100644
--- a/config/vitest.config.ts
+++ b/config/vitest.config.ts
@@ -1,5 +1,6 @@
 import { resolve } from 'node:path'
 import { defineConfig } from 'vitest/config'
+import { UNIT_INCLUDE, UNIT_EXCLUDE } from './scripts/ci-unit-files.mjs'
 import TimingSequencer from './scripts/ci-unit-sequencer.mjs'
 
 const windowsTestWorkerOptions = process.platform === 'win32' ? { maxWorkers: 4 } : {}
@@ -16,8 +17,13 @@ export default defineConfig({
   },
   test: {
     environment: 'node',
+    // Bun's external-module cache otherwise loses Zod named exports across mocked graphs.
+    ...(process.versions.bun ? { server: { deps: { inline: ['zod'] } } } : {}),
     ...(process.env.ORCA_BALANCE_UNIT_SHARDS === '1'
-      ? { sequence: { sequencer: TimingSequencer } }
+      ? {
+          sequence: { sequencer: TimingSequencer },
+          reporters: ['default', resolve('config/scripts/ci-unit-timing-reporter.mjs')]
+        }
       : {}),
     // Why: Node 26's undefined Web Storage globals prevent Vitest from installing happy-dom's.
     // Why --expose-gc: retention tests need a deterministic collection point to measure what a queue really holds.
@@ -28,14 +34,8 @@ export default defineConfig({
       resolve('config/scripts/happy-dom-mutation-observer-retention.ts'),
       resolve('config/scripts/vitest-host-ports-setup.ts')
     ],
-    include: [
-      'src/**/*.test.ts',
-      'src/**/*.test.tsx',
-      'config/scripts/**/*.test.ts',
-      'config/scripts/**/*.test.mjs',
-      'tests/tools/**/*.test.mjs',
-      'tests/e2e/**/*.unit.test.ts'
-    ],
+    include: UNIT_INCLUDE,
+    ...(process.env.ORCA_BALANCE_UNIT_SHARDS === '1' ? { exclude: UNIT_EXCLUDE } : {}),
     // Why: the full suite runs heavy TS transforms plus real git/http fixtures;
     // the Vitest 5s defaults are too tight for the slowest integration cases.
     hookTimeout: 60_000,
diff --git a/docs/assets/readme-downloads.svg b/docs/assets/readme-downloads.svg
index 42f7829a90a4..9fbda727d28f 100644
--- a/docs/assets/readme-downloads.svg
+++ b/docs/assets/readme-downloads.svg
@@ -1,5 +1,5 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="106" height="20" role="img" aria-label="downloads: 77m">
-  <title>downloads: 77m</title>
+<svg xmlns="http://www.w3.org/2000/svg" width="106" height="20" role="img" aria-label="downloads: 82m">
+  <title>downloads: 82m</title>
   <linearGradient id="s" x2="0" y2="100%">
     <stop offset="0" stop-color="#bbb" stop-opacity=".1"/>
     <stop offset="1" stop-opacity=".1"/>
@@ -15,7 +15,7 @@
   <g fill="#fff" text-anchor="middle" font-family="Verdana,Geneva,DejaVu Sans,sans-serif" text-rendering="geometricPrecision" font-size="11">
     <text x="37" y="15" fill="#010101" fill-opacity=".3">downloads</text>
     <text x="37" y="14">downloads</text>
-    <text x="90" y="15" fill="#010101" fill-opacity=".3">77m</text>
-    <text x="90" y="14">77m</text>
+    <text x="90" y="15" fill="#010101" fill-opacity=".3">82m</text>
+    <text x="90" y="14">82m</text>
   </g>
 </svg>
diff --git a/docs/bug-reproductions/opencode2-form-created-kinds/README.md b/docs/bug-reproductions/opencode2-form-created-kinds/README.md
index 8ac1dbfe4493..f3a0b4713e22 100644
--- a/docs/bug-reproductions/opencode2-form-created-kinds/README.md
+++ b/docs/bug-reproductions/opencode2-form-created-kinds/README.md
@@ -13,8 +13,8 @@ against a real `opencode serve` instance and reading the server's `/api/event` S
 v2.0.12 bundle (still exactly five on `v2.0.15`, in `tool/plugin/question.ts`,
 `tool/plugin/websearch.ts` and `mcp/index.ts`):
 
-| `metadata.kind`      | Form title                                    | `sessionID` | Blocks the pane owner    |
-| -------------------- | --------------------------------------------- | ----------- | ------------------------ |
+| `metadata.kind`      | Form title                                    | `sessionID` | Blocks the pane owner     |
+| -------------------- | --------------------------------------------- | ----------- | ------------------------- |
 | `question`           | `Questions`                                   | the session | yes — the `question` tool |
 | `websearch.provider` | `Web Search` / `Choose a web search provider` | the session | yes — the turn is stalled |
 | `mcp-elicitation`    | `<server> is requesting input`                | `"global"`  | no — see below            |
diff --git a/docs/readme/README.es.md b/docs/readme/README.es.md
index fdd067ef763a..17ec41e82949 100644
--- a/docs/readme/README.es.md
+++ b/docs/readme/README.es.md
@@ -179,6 +179,7 @@ Funciona con **cualquier agente CLI** — si corre en una terminal, corre en Orc
   <a href="https://cursor.com/cli"><kbd><img src="https://www.google.com/s2/favicons?domain=cursor.com&sz=64" alt="Cursor logo" width="16" valign="middle" /> Cursor</kbd></a> &nbsp;
   <a href="https://docs.github.com/en/copilot/how-tos/set-up/install-copilot-cli"><kbd><img src="https://www.google.com/s2/favicons?domain=github.com&sz=64" alt="GitHub Copilot logo" width="16" valign="middle" /> GitHub Copilot</kbd></a> &nbsp;
   <a href="https://dev.meta.ai/docs/muse-code"><kbd><img src="../../src/shared/agent-icons/muse.png" alt="Muse logo" width="16" valign="middle" /> Muse</kbd></a> &nbsp;
+  <a href="https://deepseek-harness.github.io/deepseek-harness/"><kbd><img src="../../src/shared/agent-icons/dsh.png" alt="DeepSeek Harness logo" width="16" valign="middle" /> DeepSeek Harness</kbd></a> &nbsp;
   <a href="https://zcode.z.ai/en/docs"><kbd><img src="../../src/shared/agent-icons/zcode.png" alt="ZCode logo" width="16" valign="middle" /> ZCode</kbd></a> &nbsp;
   <a href="https://opencode.ai/docs/cli/"><kbd><img src="https://www.google.com/s2/favicons?domain=opencode.ai&sz=64" alt="OpenCode logo" width="16" valign="middle" /> OpenCode</kbd></a> &nbsp;
   <a href="https://ampcode.com/manual#install"><kbd><img src="https://www.google.com/s2/favicons?domain=ampcode.com&sz=64" alt="Amp logo" width="16" valign="middle" /> Amp</kbd></a> &nbsp;
@@ -193,6 +194,7 @@ Funciona con **cualquier agente CLI** — si corre en una terminal, corre en Orc
   <a href="https://github.com/charmbracelet/crush"><kbd><img src="https://www.google.com/s2/favicons?domain=charm.sh&sz=64" alt="Charm logo" width="16" valign="middle" /> Charm</kbd></a> &nbsp;
   <a href="https://docs.cline.bot/cline-cli/overview"><kbd><img src="https://www.google.com/s2/favicons?domain=cline.bot&sz=64" alt="Cline logo" width="16" valign="middle" /> Cline</kbd></a> &nbsp;
   <a href="https://www.codebuff.com/docs/help/quick-start"><kbd><img src="https://www.google.com/s2/favicons?domain=codebuff.com&sz=64" alt="Codebuff logo" width="16" valign="middle" /> Codebuff</kbd></a> &nbsp;
+  <a href="https://freebuff.com/cli"><kbd><img src="https://www.google.com/s2/favicons?domain=freebuff.com&sz=64" alt="Freebuff logo" width="16" valign="middle" /> Freebuff</kbd></a> &nbsp;
   <a href="https://commandcode.ai/docs/quickstart"><kbd><img src="https://www.google.com/s2/favicons?domain=commandcode.ai&sz=64" alt="Command Code logo" width="16" valign="middle" /> Command Code</kbd></a> &nbsp;
   <a href="https://docs.continue.dev/guides/cli"><kbd><img src="https://www.google.com/s2/favicons?domain=continue.dev&sz=64" alt="Continue logo" width="16" valign="middle" /> Continue</kbd></a> &nbsp;
   <a href="https://docs.factory.ai/cli/getting-started/quickstart"><kbd><img src="../assets/droid-logo.svg" alt="Droid logo" width="16" valign="middle" /> Droid</kbd></a> &nbsp;
diff --git a/docs/readme/README.fr.md b/docs/readme/README.fr.md
index 56cfc334fd75..1c7713bffd7d 100644
--- a/docs/readme/README.fr.md
+++ b/docs/readme/README.fr.md
@@ -183,6 +183,7 @@ Fonctionne avec **n'importe quel agent CLI** — s'il tourne dans un terminal, i
   <a href="https://cursor.com/cli"><kbd><img src="https://www.google.com/s2/favicons?domain=cursor.com&sz=64" alt="Logo Cursor" width="16" valign="middle" /> Cursor</kbd></a> &nbsp;
   <a href="https://docs.github.com/en/copilot/how-tos/set-up/install-copilot-cli"><kbd><img src="https://www.google.com/s2/favicons?domain=github.com&sz=64" alt="Logo GitHub Copilot" width="16" valign="middle" /> GitHub Copilot</kbd></a> &nbsp;
   <a href="https://dev.meta.ai/docs/muse-code"><kbd><img src="../../src/shared/agent-icons/muse.png" alt="Logo Muse" width="16" valign="middle" /> Muse</kbd></a> &nbsp;
+  <a href="https://deepseek-harness.github.io/deepseek-harness/"><kbd><img src="../../src/shared/agent-icons/dsh.png" alt="DeepSeek Harness logo" width="16" valign="middle" /> DeepSeek Harness</kbd></a> &nbsp;
   <a href="https://zcode.z.ai/en/docs"><kbd><img src="../../src/shared/agent-icons/zcode.png" alt="Logo ZCode" width="16" valign="middle" /> ZCode</kbd></a> &nbsp;
   <a href="https://opencode.ai/docs/cli/"><kbd><img src="https://www.google.com/s2/favicons?domain=opencode.ai&sz=64" alt="Logo OpenCode" width="16" valign="middle" /> OpenCode</kbd></a> &nbsp;
   <a href="https://mimo.xiaomi.com/coder"><kbd><img src="https://www.google.com/s2/favicons?domain=mimo.xiaomi.com&sz=64" alt="Logo MiMo Code" width="16" valign="middle" /> MiMo Code</kbd></a> &nbsp;
@@ -199,6 +200,7 @@ Fonctionne avec **n'importe quel agent CLI** — s'il tourne dans un terminal, i
   <a href="https://github.com/charmbracelet/crush"><kbd><img src="https://www.google.com/s2/favicons?domain=charm.sh&sz=64" alt="Logo Charm" width="16" valign="middle" /> Charm</kbd></a> &nbsp;
   <a href="https://docs.cline.bot/cline-cli/overview"><kbd><img src="https://www.google.com/s2/favicons?domain=cline.bot&sz=64" alt="Logo Cline" width="16" valign="middle" /> Cline</kbd></a> &nbsp;
   <a href="https://www.codebuff.com/docs/help/quick-start"><kbd><img src="https://www.google.com/s2/favicons?domain=codebuff.com&sz=64" alt="Logo Codebuff" width="16" valign="middle" /> Codebuff</kbd></a> &nbsp;
+  <a href="https://freebuff.com/cli"><kbd><img src="https://www.google.com/s2/favicons?domain=freebuff.com&sz=64" alt="Logo Freebuff" width="16" valign="middle" /> Freebuff</kbd></a> &nbsp;
   <a href="https://commandcode.ai/docs/quickstart"><kbd><img src="https://www.google.com/s2/favicons?domain=commandcode.ai&sz=64" alt="Logo Command Code" width="16" valign="middle" /> Command Code</kbd></a> &nbsp;
   <a href="https://docs.continue.dev/guides/cli"><kbd><img src="https://www.google.com/s2/favicons?domain=continue.dev&sz=64" alt="Logo Continue" width="16" valign="middle" /> Continue</kbd></a> &nbsp;
   <a href="https://docs.factory.ai/cli/getting-started/quickstart"><kbd><img src="../assets/droid-logo.svg" alt="Logo Droid" width="16" valign="middle" /> Droid</kbd></a> &nbsp;
diff --git a/docs/readme/README.ja.md b/docs/readme/README.ja.md
index e5eee5781b0e..ed37efa595f1 100644
--- a/docs/readme/README.ja.md
+++ b/docs/readme/README.ja.md
@@ -179,6 +179,7 @@ PR、Issue、プロジェクトボードをアプリ内で閲覧 — 任意の
   <a href="https://cursor.com/cli"><kbd><img src="https://www.google.com/s2/favicons?domain=cursor.com&sz=64" alt="Cursor logo" width="16" valign="middle" /> Cursor</kbd></a> &nbsp;
   <a href="https://docs.github.com/en/copilot/how-tos/set-up/install-copilot-cli"><kbd><img src="https://www.google.com/s2/favicons?domain=github.com&sz=64" alt="GitHub Copilot logo" width="16" valign="middle" /> GitHub Copilot</kbd></a> &nbsp;
   <a href="https://dev.meta.ai/docs/muse-code"><kbd><img src="../../src/shared/agent-icons/muse.png" alt="Muse logo" width="16" valign="middle" /> Muse</kbd></a> &nbsp;
+  <a href="https://deepseek-harness.github.io/deepseek-harness/"><kbd><img src="../../src/shared/agent-icons/dsh.png" alt="DeepSeek Harness logo" width="16" valign="middle" /> DeepSeek Harness</kbd></a> &nbsp;
   <a href="https://zcode.z.ai/en/docs"><kbd><img src="../../src/shared/agent-icons/zcode.png" alt="ZCode logo" width="16" valign="middle" /> ZCode</kbd></a> &nbsp;
   <a href="https://opencode.ai/docs/cli/"><kbd><img src="https://www.google.com/s2/favicons?domain=opencode.ai&sz=64" alt="OpenCode logo" width="16" valign="middle" /> OpenCode</kbd></a> &nbsp;
   <a href="https://ampcode.com/manual#install"><kbd><img src="https://www.google.com/s2/favicons?domain=ampcode.com&sz=64" alt="Amp logo" width="16" valign="middle" /> Amp</kbd></a> &nbsp;
@@ -193,6 +194,7 @@ PR、Issue、プロジェクトボードをアプリ内で閲覧 — 任意の
   <a href="https://github.com/charmbracelet/crush"><kbd><img src="https://www.google.com/s2/favicons?domain=charm.sh&sz=64" alt="Charm logo" width="16" valign="middle" /> Charm</kbd></a> &nbsp;
   <a href="https://docs.cline.bot/cline-cli/overview"><kbd><img src="https://www.google.com/s2/favicons?domain=cline.bot&sz=64" alt="Cline logo" width="16" valign="middle" /> Cline</kbd></a> &nbsp;
   <a href="https://www.codebuff.com/docs/help/quick-start"><kbd><img src="https://www.google.com/s2/favicons?domain=codebuff.com&sz=64" alt="Codebuff logo" width="16" valign="middle" /> Codebuff</kbd></a> &nbsp;
+  <a href="https://freebuff.com/cli"><kbd><img src="https://www.google.com/s2/favicons?domain=freebuff.com&sz=64" alt="Freebuff logo" width="16" valign="middle" /> Freebuff</kbd></a> &nbsp;
   <a href="https://commandcode.ai/docs/quickstart"><kbd><img src="https://www.google.com/s2/favicons?domain=commandcode.ai&sz=64" alt="Command Code logo" width="16" valign="middle" /> Command Code</kbd></a> &nbsp;
   <a href="https://docs.continue.dev/guides/cli"><kbd><img src="https://www.google.com/s2/favicons?domain=continue.dev&sz=64" alt="Continue logo" width="16" valign="middle" /> Continue</kbd></a> &nbsp;
   <a href="https://docs.factory.ai/cli/getting-started/quickstart"><kbd><img src="../assets/droid-logo.svg" alt="Droid logo" width="16" valign="middle" /> Droid</kbd></a> &nbsp;
diff --git a/docs/readme/README.ko.md b/docs/readme/README.ko.md
index 17528c25ee03..ab6d5c50eba6 100644
--- a/docs/readme/README.ko.md
+++ b/docs/readme/README.ko.md
@@ -179,6 +179,7 @@ diff의 어느 줄에든 코멘트를 남기고 에이전트에게 바로 보내
   <a href="https://cursor.com/cli"><kbd><img src="https://www.google.com/s2/favicons?domain=cursor.com&sz=64" alt="Cursor logo" width="16" valign="middle" /> Cursor</kbd></a> &nbsp;
   <a href="https://docs.github.com/en/copilot/how-tos/set-up/install-copilot-cli"><kbd><img src="https://www.google.com/s2/favicons?domain=github.com&sz=64" alt="GitHub Copilot logo" width="16" valign="middle" /> GitHub Copilot</kbd></a> &nbsp;
   <a href="https://dev.meta.ai/docs/muse-code"><kbd><img src="../../src/shared/agent-icons/muse.png" alt="Muse logo" width="16" valign="middle" /> Muse</kbd></a> &nbsp;
+  <a href="https://deepseek-harness.github.io/deepseek-harness/"><kbd><img src="../../src/shared/agent-icons/dsh.png" alt="DeepSeek Harness logo" width="16" valign="middle" /> DeepSeek Harness</kbd></a> &nbsp;
   <a href="https://zcode.z.ai/en/docs"><kbd><img src="../../src/shared/agent-icons/zcode.png" alt="ZCode logo" width="16" valign="middle" /> ZCode</kbd></a> &nbsp;
   <a href="https://opencode.ai/docs/cli/"><kbd><img src="https://www.google.com/s2/favicons?domain=opencode.ai&sz=64" alt="OpenCode logo" width="16" valign="middle" /> OpenCode</kbd></a> &nbsp;
   <a href="https://mimo.xiaomi.com/coder"><kbd><img src="https://www.google.com/s2/favicons?domain=mimo.xiaomi.com&sz=64" alt="MiMo Code logo" width="16" valign="middle" /> MiMo Code</kbd></a> &nbsp;
@@ -195,6 +196,7 @@ diff의 어느 줄에든 코멘트를 남기고 에이전트에게 바로 보내
   <a href="https://github.com/charmbracelet/crush"><kbd><img src="https://www.google.com/s2/favicons?domain=charm.sh&sz=64" alt="Charm logo" width="16" valign="middle" /> Charm</kbd></a> &nbsp;
   <a href="https://docs.cline.bot/cline-cli/overview"><kbd><img src="https://www.google.com/s2/favicons?domain=cline.bot&sz=64" alt="Cline logo" width="16" valign="middle" /> Cline</kbd></a> &nbsp;
   <a href="https://www.codebuff.com/docs/help/quick-start"><kbd><img src="https://www.google.com/s2/favicons?domain=codebuff.com&sz=64" alt="Codebuff logo" width="16" valign="middle" /> Codebuff</kbd></a> &nbsp;
+  <a href="https://freebuff.com/cli"><kbd><img src="https://www.google.com/s2/favicons?domain=freebuff.com&sz=64" alt="Freebuff logo" width="16" valign="middle" /> Freebuff</kbd></a> &nbsp;
   <a href="https://commandcode.ai/docs/quickstart"><kbd><img src="https://www.google.com/s2/favicons?domain=commandcode.ai&sz=64" alt="Command Code logo" width="16" valign="middle" /> Command Code</kbd></a> &nbsp;
   <a href="https://docs.continue.dev/guides/cli"><kbd><img src="https://www.google.com/s2/favicons?domain=continue.dev&sz=64" alt="Continue logo" width="16" valign="middle" /> Continue</kbd></a> &nbsp;
   <a href="https://docs.factory.ai/cli/getting-started/quickstart"><kbd><img src="../assets/droid-logo.svg" alt="Droid logo" width="16" valign="middle" /> Droid</kbd></a> &nbsp;
diff --git a/docs/readme/README.pt.md b/docs/readme/README.pt.md
index 568a6d0de0d0..4ade6ad6e41f 100644
--- a/docs/readme/README.pt.md
+++ b/docs/readme/README.pt.md
@@ -179,6 +179,7 @@ Funciona com **qualquer agente CLI** — se roda em um terminal, roda no Orca.
   <a href="https://cursor.com/cli"><kbd><img src="https://www.google.com/s2/favicons?domain=cursor.com&sz=64" alt="Logotipo do Cursor" width="16" valign="middle" /> Cursor</kbd></a> &nbsp;
   <a href="https://docs.github.com/en/copilot/how-tos/set-up/install-copilot-cli"><kbd><img src="https://www.google.com/s2/favicons?domain=github.com&sz=64" alt="Logotipo do GitHub Copilot" width="16" valign="middle" /> GitHub Copilot</kbd></a> &nbsp;
   <a href="https://dev.meta.ai/docs/muse-code"><kbd><img src="../../src/shared/agent-icons/muse.png" alt="Logotipo do Muse" width="16" valign="middle" /> Muse</kbd></a> &nbsp;
+  <a href="https://deepseek-harness.github.io/deepseek-harness/"><kbd><img src="../../src/shared/agent-icons/dsh.png" alt="DeepSeek Harness logo" width="16" valign="middle" /> DeepSeek Harness</kbd></a> &nbsp;
   <a href="https://zcode.z.ai/en/docs"><kbd><img src="../../src/shared/agent-icons/zcode.png" alt="Logotipo do ZCode" width="16" valign="middle" /> ZCode</kbd></a> &nbsp;
   <a href="https://opencode.ai/docs/cli/"><kbd><img src="https://www.google.com/s2/favicons?domain=opencode.ai&sz=64" alt="Logotipo do OpenCode" width="16" valign="middle" /> OpenCode</kbd></a> &nbsp;
   <a href="https://mimo.xiaomi.com/coder"><kbd><img src="https://www.google.com/s2/favicons?domain=mimo.xiaomi.com&sz=64" alt="Logotipo do MiMo Code" width="16" valign="middle" /> MiMo Code</kbd></a> &nbsp;
@@ -195,6 +196,7 @@ Funciona com **qualquer agente CLI** — se roda em um terminal, roda no Orca.
   <a href="https://github.com/charmbracelet/crush"><kbd><img src="https://www.google.com/s2/favicons?domain=charm.sh&sz=64" alt="Logotipo do Charm" width="16" valign="middle" /> Charm</kbd></a> &nbsp;
   <a href="https://docs.cline.bot/cline-cli/overview"><kbd><img src="https://www.google.com/s2/favicons?domain=cline.bot&sz=64" alt="Logotipo do Cline" width="16" valign="middle" /> Cline</kbd></a> &nbsp;
   <a href="https://www.codebuff.com/docs/help/quick-start"><kbd><img src="https://www.google.com/s2/favicons?domain=codebuff.com&sz=64" alt="Logotipo do Codebuff" width="16" valign="middle" /> Codebuff</kbd></a> &nbsp;
+  <a href="https://freebuff.com/cli"><kbd><img src="https://www.google.com/s2/favicons?domain=freebuff.com&sz=64" alt="Logotipo do Freebuff" width="16" valign="middle" /> Freebuff</kbd></a> &nbsp;
   <a href="https://commandcode.ai/docs/quickstart"><kbd><img src="https://www.google.com/s2/favicons?domain=commandcode.ai&sz=64" alt="Logotipo do Command Code" width="16" valign="middle" /> Command Code</kbd></a> &nbsp;
   <a href="https://docs.continue.dev/guides/cli"><kbd><img src="https://www.google.com/s2/favicons?domain=continue.dev&sz=64" alt="Logotipo do Continue" width="16" valign="middle" /> Continue</kbd></a> &nbsp;
   <a href="https://docs.factory.ai/cli/getting-started/quickstart"><kbd><img src="../assets/droid-logo.svg" alt="Logotipo do Droid" width="16" valign="middle" /> Droid</kbd></a> &nbsp;
diff --git a/docs/readme/README.zh-CN.md b/docs/readme/README.zh-CN.md
index 7882935dfa41..54583f4777b7 100644
--- a/docs/readme/README.zh-CN.md
+++ b/docs/readme/README.zh-CN.md
@@ -179,6 +179,7 @@ VS Code 的编辑器，处处自动保存 — 把文件或图片直接拖入智
   <a href="https://cursor.com/cli"><kbd><img src="https://www.google.com/s2/favicons?domain=cursor.com&sz=64" alt="Cursor logo" width="16" valign="middle" /> Cursor</kbd></a> &nbsp;
   <a href="https://docs.github.com/en/copilot/how-tos/set-up/install-copilot-cli"><kbd><img src="https://www.google.com/s2/favicons?domain=github.com&sz=64" alt="GitHub Copilot logo" width="16" valign="middle" /> GitHub Copilot</kbd></a> &nbsp;
   <a href="https://dev.meta.ai/docs/muse-code"><kbd><img src="../../src/shared/agent-icons/muse.png" alt="Muse logo" width="16" valign="middle" /> Muse</kbd></a> &nbsp;
+  <a href="https://deepseek-harness.github.io/deepseek-harness/"><kbd><img src="../../src/shared/agent-icons/dsh.png" alt="DeepSeek Harness logo" width="16" valign="middle" /> DeepSeek Harness</kbd></a> &nbsp;
   <a href="https://zcode.z.ai/en/docs"><kbd><img src="../../src/shared/agent-icons/zcode.png" alt="ZCode logo" width="16" valign="middle" /> ZCode</kbd></a> &nbsp;
   <a href="https://opencode.ai/docs/cli/"><kbd><img src="https://www.google.com/s2/favicons?domain=opencode.ai&sz=64" alt="OpenCode logo" width="16" valign="middle" /> OpenCode</kbd></a> &nbsp;
   <a href="https://ampcode.com/manual#install"><kbd><img src="https://www.google.com/s2/favicons?domain=ampcode.com&sz=64" alt="Amp logo" width="16" valign="middle" /> Amp</kbd></a> &nbsp;
@@ -193,6 +194,7 @@ VS Code 的编辑器，处处自动保存 — 把文件或图片直接拖入智
   <a href="https://github.com/charmbracelet/crush"><kbd><img src="https://www.google.com/s2/favicons?domain=charm.sh&sz=64" alt="Charm logo" width="16" valign="middle" /> Charm</kbd></a> &nbsp;
   <a href="https://docs.cline.bot/cline-cli/overview"><kbd><img src="https://www.google.com/s2/favicons?domain=cline.bot&sz=64" alt="Cline logo" width="16" valign="middle" /> Cline</kbd></a> &nbsp;
   <a href="https://www.codebuff.com/docs/help/quick-start"><kbd><img src="https://www.google.com/s2/favicons?domain=codebuff.com&sz=64" alt="Codebuff logo" width="16" valign="middle" /> Codebuff</kbd></a> &nbsp;
+  <a href="https://freebuff.com/cli"><kbd><img src="https://www.google.com/s2/favicons?domain=freebuff.com&sz=64" alt="Freebuff logo" width="16" valign="middle" /> Freebuff</kbd></a> &nbsp;
   <a href="https://commandcode.ai/docs/quickstart"><kbd><img src="https://www.google.com/s2/favicons?domain=commandcode.ai&sz=64" alt="Command Code logo" width="16" valign="middle" /> Command Code</kbd></a> &nbsp;
   <a href="https://docs.continue.dev/guides/cli"><kbd><img src="https://www.google.com/s2/favicons?domain=continue.dev&sz=64" alt="Continue logo" width="16" valign="middle" /> Continue</kbd></a> &nbsp;
   <a href="https://docs.factory.ai/cli/getting-started/quickstart"><kbd><img src="../assets/droid-logo.svg" alt="Droid logo" width="16" valign="middle" /> Droid</kbd></a> &nbsp;
diff --git a/docs/reference/agent-status-store.md b/docs/reference/agent-status-store.md
index 4dff79d6666a..b7ce4fa16dde 100644
--- a/docs/reference/agent-status-store.md
+++ b/docs/reference/agent-status-store.md
@@ -105,8 +105,15 @@ ingests the summary into the hook server as a status row:
 | `structuredHost`                                    | `'owned'` while `summary.hostExecutionOwned` is set, otherwise `'held'`; `worktree ps` derives its row's `structuredHostOwned` from it                                        |
 | prompt, tool, last message, model, provider session | the summary's fields                                                                                                                                                          |
 
-Sessions with no persisted turn (`status === null`) produce no row, matching
-what the chat shows. When the host revokes live ownership the row is re-set
+Sessions with no request (`status === null`) produce no row. A request is a
+turn record, an assistant message, a user message the provider journaled itself
+(history, an older host), an accepted or unanswered send, or a send the agent or
+its start refused; a send that was withdrawn, or left undelivered by a
+restart or a close, fails nobody and makes nothing listable.
+`summary.turnOutcome` is the latest request's verdict: its turn's outcome, or
+`failure` for a send the agent or its start refused (a send that joined a running
+turn is answered by that turn). The row also publishes `interrupted` from
+`mainAgent.outcome`, exactly as the hook lanes do. When the host revokes live ownership the row is re-set
 without the flag; when the host closes or evicts the session the row is
 dropped. Both already exist as feed events (`revokeLive` and the roster
 filter in `liveSessionSummaries`); PR 1 turns them into store writes.
@@ -218,6 +225,32 @@ sends no hook at all on a cancel and no `is_interrupt` on Stop; that flag on a
 turn boundary remains a secondary source for builds that send it, and
 `StopFailure` maps to `failure`.
 
+Readers decode the verdict through one accessor, `agentMainAgentVerdict`, which
+reads the main agent's own state, not the combined row's: `mainAgent.outcome`
+while `mainAgent.state` is `done`, then the legacy `interrupted` flag as a
+cancellation, which alone needs the combined `done`. So a main agent that
+failed while its subagents still run has a verdict on a `working` row. Every
+copy of a row (state-history entries, sleep records, `worktree ps` rows) takes
+the verdict through `agentVerdictFields`, which carries `interrupted` and the
+whole `mainAgent` (state, outcome and its own clock) together, so a copy agrees
+with the row and can date a failure by `mainAgent.stateStartedAt`.
+
+Display reads the verdict through `agentVerdictDisplayMark`: a failure marks the
+agent failed whatever the combined state, because it is news the user must see
+even while subagents run; a stop marks it interrupted only on a `done` row, so
+a stopped or finished main agent with live child work still reads working.
+Each subagent keeps its own row and state. Container rollups (worktree card,
+terminal tab, Cmd+J) rank a pending question first, then a failure, then live
+work, then a stop, then done. On the worktree card, a failure retained after its
+agent's pane went away has no expiry, so it ranks below live work and above a
+stop. Lifecycle waiters keep reading the combined `state`.
+
+Policy splits the verdict two ways. Clean-finish policy (hibernation, pane
+ownership, the star-nag value moment) treats a failure like a cancellation
+(`agentTurnEndedUncleanly`). Attention (completion time, Smart Sort, sticky
+retention, Cmd+J Recent) demotes only a turn the user stopped
+(`agentTurnStoppedByUser`); a failure ranks like a completion.
+
 Admission is one function, `normalizeAgentStatusPayload`, on the relay wire,
 IPC and disk. A malformed `mainAgent` drops the field and keeps the row. Old hosts
 send none and readers fall back to `state`. Hook rows persist it inside the
diff --git a/docs/reference/antigravity-readiness-evidence.md b/docs/reference/antigravity-readiness-evidence.md
index 2700730fccfd..db505d2ff033 100644
--- a/docs/reference/antigravity-readiness-evidence.md
+++ b/docs/reference/antigravity-readiness-evidence.md
@@ -251,7 +251,7 @@ What the captures support and the shipped detector now does:
   API-key users.
 - **Veto an active model picker.** `Switch Model` followed by a labeled selection row means the
   bare caret belongs to the composer behind the picker; readiness resumes after `Exited /model
-  command`.
+command`.
 - **Do not anchor on `headerIndex`.** The banner is printed once and never reprinted.
 - **The blocked-signal path already works** for the trust dialog: `antigravity-dialog-trust-workspace.txt`
   is correctly refused today, by wording, not by structure.
diff --git a/docs/reference/ci-demand-rollout.md b/docs/reference/ci-demand-rollout.md
new file mode 100644
index 000000000000..8219a3401cb7
--- /dev/null
+++ b/docs/reference/ci-demand-rollout.md
@@ -0,0 +1,145 @@
+# CI demand rollout
+
+This implements the September 28 runner-demand analysis. The baseline inventory
+covered September 27 04:00–September 28 04:00 UTC: 4,028 workflow runs, with
+463 stratified job samples. Estimated occupancy was 1,081 runner-hours, dominated
+by PR unit shards (414 hours) and Bun qualification (262 hours). These are
+sampled sums of job durations across different runner pools, not billing totals
+or a guaranteed forecast of savings.
+
+## What runs now
+
+| Work                         | Ordinary draft update                                                          | Ready PR / final checks                       | Main reference                          |
+| ---------------------------- | ------------------------------------------------------------------------------ | --------------------------------------------- | --------------------------------------- |
+| Static analysis and types    | Immediately                                                                    | Immediately                                   | Existing workflows                      |
+| Unit suite                   | Full, with shadow selection evidence                                           | Full                                          | Existing daily Node 24/26 x86 suite     |
+| Packages                     | After successful static analysis and types                                     | Same                                          | Existing release workflows              |
+| Bun persistence              | Linux x64 for ordinary runtime changes; all six platforms for sensitive inputs | All six platforms when Bun inputs changed     | Full nightly qualification at 11:30 UTC |
+| Bun glibc/musl qualification | Sensitive inputs only, after persistence succeeds                              | Both architectures after persistence succeeds | Both architectures                      |
+| E2E                          | Existing targeted routing                                                      | Existing targeted routing                     | One complete run at 17:00 UTC           |
+
+Bun-sensitive inputs include root/toolchain files, configuration, native code,
+resources, platform-specific paths, persistence, SQLite, orcad, providers,
+daemon, SSH, relay, and child-process code. Dependency discovery failure, a
+missing event or an incomplete diff retains full qualification. An unrelated
+change still skips Bun through the existing dependency classifier. No native
+artifact is shared across platforms or ABIs. The routine draft reduction is an
+explicit coverage-placement change; it does not assert identical per-update
+coverage. Every non-draft synchronize event and the ready-for-review event
+restores full qualification.
+
+Expensive PR jobs wait for static/type success. This reduces fan-out for failed
+or rapidly superseded commits without sleeping on a runner. Successful isolated
+PRs pay the extra stage latency. Existing per-PR cancellation remains in place.
+Package assertions, native boundaries, SSH/folder coverage, cache warming and
+slow-test assertions are retained.
+
+## Unit selection rollout
+
+`ci-unit-plan.mjs` discovers the same include/exclude set as Vitest and follows
+static imports, re-exports, literal dynamic imports, CommonJS requires and the
+renderer aliases. Consumers of indirect filesystem/process inputs remain in the
+candidate set, as do script/tool tests. Global configuration changes, deletions,
+renames involving removed paths, unknown inputs and graph failures run the full
+suite. A shard verifies the plan's source SHA and complete discovery list before
+using it. Missing/stale artifacts fall back to full coverage, even if that means
+running the suite on fewer shards.
+
+The initial policy is **shadow**, with all eight shards retained. The first
+local inventory matched Vitest exactly (9,950 files at validation); representative
+source changes retained roughly 88% of files because of indirect input readers.
+That is evidence for conservative coverage, not evidence of the analysis's
+hypothetical 50% unit-work reduction. Improvements to indirect dependency
+modeling should be demonstrated against full results before expanding selection.
+
+Every shard uploads `unit-selection.json`, `unit-timings.json` (including module
+outcomes), and its assignment. The evidence job combines these into
+`unit-selection-review-attempt-N/selection-review.json`, reporting:
+
+- Whether every discovered file appeared once across a complete reference run.
+- Failures outside the candidate set, including failures in otherwise red runs.
+- Measured worker time that selection would omit; worker times overlap and are
+  not runner occupancy or a prediction of wall-clock savings.
+
+Missing/duplicate shards, stale plans, interrupted runs and unhandled errors do
+not count as complete references. Diagnostic upload/report failures do not make
+tests pass and do not independently fail successful tests.
+
+After representative complete shadow runs show no missed failures, set repository
+variable `ORCA_UNIT_SELECTION_MODE=selected` to enable selection **only for draft
+PRs**. Keep full ready-PR checks and the daily compatibility suite. Inspect at
+least a week's evidence across renderer, main, shared, SSH and fixture changes
+before promotion, including red runs rather than only successful examples.
+Unknown variable values retain shadow mode. Unset the variable or set it to
+`shadow` to roll back immediately. Selected runs use one to eight timing-balanced
+shards based on retained work.
+
+Ready-for-review result reuse includes `unit full` in its source/workflow
+identity. A green selected draft cannot satisfy the final full check, even if
+the repository variable changes between runs. An already successful _full_
+identical-source check can still be reused.
+
+To inspect downloaded shard artifacts locally:
+
+```sh
+node config/scripts/ci-unit-selection-review.mjs ARTIFACT_DIRECTORY
+```
+
+## Review automation
+
+Pullfrog recognizes the existing `Review #N [id]` and
+`Review new commits on #N [id]` dispatch names. Explicit dispatchers may provide
+`pull_request_number` and `head_sha`. Explicit PR identities share concurrency at the workflow boundary. Legacy review
+names use a bounded lookup of the latest 100 dispatches and cancel only lower
+run IDs for the same PR; a delayed older scope cannot cancel a newer review.
+Unrecognized tasks are never grouped. The scope job alone has Actions write
+permission for ordered cancellation. Closed PRs and explicitly stale heads
+are skipped. A second head check prevents starting an agent after its queued
+head has changed. Unrecognized agent tasks remain independent; lookup failures
+also retain an independent task rather than cancelling unrelated work.
+
+This does not introduce a fixed debounce interval or remove final reviews.
+Dispatchers should supply `head_sha` for reliable stale-at-dispatch detection;
+legacy names identify a PR but do not prove which head the prompt describes.
+
+## E2E signal
+
+The daily reference still executes all shards and keeps original verdicts. Each
+shard uploads Playwright JSON and publishes expected, skipped, unexpected, flaky
+and startup-error counts with the failing test names/messages. Targeted PR and
+manual coverage remain available. This change does not fix the historically
+red tests or pretend they pass.
+
+`config/e2e-failure-tracking.json` can separate an evidenced repeated failure
+from new failures in the summary. Each entry must have exact `file`, full
+`title`, `project`, a nonempty stable `message` substring, an `@owner`, a linked
+repository `issue`, and an ISO `expires` review date. Expired/malformed entries
+are ignored and reported; changed error signatures appear as untracked. Entries
+never skip a test or change its exit status. The initial list is empty because
+the analysis established red workflows but did not establish owners and
+reproductions for individual failures. Do not blanket-baseline an entire red run.
+
+## Capacity measurements and acceptance
+
+`CI runner demand` runs daily at 04:23 UTC and can be dispatched manually. It
+reads the previous 24 complete hours in hourly pages, samples up to six runs per
+workflow/outcome stratum, and fetches job pages with bounded concurrency. An
+hour exceeding the API's 1,000-result search cap fails visibly. The report and
+raw evidence are retained for 30 days. No extra runner pool is provisioned.
+
+The report measures the full job durations of runs **created** in the window,
+not occupancy clipped to the window: earlier runs that overlap it are excluded,
+and completed sampled jobs may finish after it. This matches the baseline
+cohort method. Workflow IDs keep ref-qualified paths in one sampling stratum.
+
+The report shows weighted runner-hours and cancelled-run hours per workflow,
+runner-minutes per completed PR _run_, and weighted queue/provisioning p95 per
+runner label. It counts latest attempts only, excludes incomplete jobs, and
+retains zero-job observations. It does not measure other repositories competing
+for organization capacity. Compare equivalent traffic windows, not raw totals
+alone. The collector needs only `contents: read` and `actions: read`.
+
+After a week, compare runner-minutes per PR run, cancellation occupancy and
+queue p95 in each affected pool. Count newly added planning/reference overhead.
+A 25–35% overall reduction remains an experiment target, not an achieved result;
+selection, coalescing and matrix reductions overlap and cannot simply be added.
diff --git a/docs/reference/ci-runner-efficiency.md b/docs/reference/ci-runner-efficiency.md
index 6d6885980973..5a59c75db5e1 100644
--- a/docs/reference/ci-runner-efficiency.md
+++ b/docs/reference/ci-runner-efficiency.md
@@ -1,5 +1,350 @@
 # CI efficiency and runner capacity
 
+The [September 28 demand rollout](ci-demand-rollout.md) documents staged checks,
+unit-selection evidence, Bun qualification, review cancellation and daily occupancy reports.
+
+## September 27 follow-up
+
+### Shared E2E CLI output
+
+E2E consumers previously compiled the CLI individually even though they downloaded
+shared Electron, web, and relay output. The producer now compiles the CLI once,
+in parallel with web projection after Electron has finished clearing `out/main`.
+Consumers repair executable permissions and install their own dev launcher with
+the same preparation script used by local CLI builds. Older refs without that
+script retain their original per-consumer compilation.
+
+An [eight-sample comparison](https://github.com/stablyai/orca/actions/runs/36307081200)
+measured producer time increasing from 26.3–27.9s to 38.8–41.0s, while consumer
+CLI compilation fell from 20.9–21.2s to 0.06–0.07s of direct preparation. All 5,519
+output files matched byte-for-byte, and every sample passed the CLI help smoke.
+A four-sample
+[final implementation comparison](https://github.com/stablyai/orca/actions/runs/36307382635)
+also passed parity and CLI smoke checks. Consumer compilation took 4.7 / 12.8s
+versus 0.08 / 0.06s of preparation; producer time increased by 0.2 / 7.1s in
+the paired trials. Across both runs this models roughly 1.1–4.7 aggregate runner
+minutes saved across 14 consumers, before artifact transfer overhead. Runner
+variation is substantial; this is not a measured workflow wall-time reduction.
+Test coverage and deadlines stay intact.
+
+
+[PR #23368](https://github.com/stablyai/orca/pull/23368) overlaps shell installation
+with dependency setup, starts localization extraction before the orcad smoke,
+and prepares mobile route snapshots while WebKit and the bundle are being built.
+Its 27 checks passed without retries; seven existing conditional checks skipped.
+
+Same-runner comparisons in both orders measured:
+
+| Work | Before | After | Evidence |
+| --- | --- | --- | --- |
+| Static block | 63.5 / 74.7s | 38.9 / 55.6s | [Full comparisons](https://github.com/stablyai/orca/actions/runs/36302208990) |
+| Shell job, downloads warmed equally | 76.8 / 70.3s | 64.4 / 64.0s | [Controlled shell runs](https://github.com/stablyai/orca/actions/runs/36302612626) |
+| Mobile preparation | 19.8–21.6s | 18.0–18.5s | [Eight measurements](https://github.com/stablyai/orca/actions/runs/36302877583) |
+| Web projection and mobile build | 17.2–17.3s | 11.7–12.1s | [Eight measurements](https://github.com/stablyai/orca/actions/runs/36302974324) |
+| Mobile verifier fixture suite | 25.47 / 25.35s | 20.04 / 19.92s | [Four full-suite runs](https://github.com/stablyai/orca/actions/runs/36302692823) |
+| E2E build outputs | 28.6–30.4s | 25.8–27.8s | [Eight measurements](https://github.com/stablyai/orca/actions/runs/36304001325) |
+
+Full mobile-job timings were dominated by first-run apt installation and browser
+test variation; the controlled preparation measurement is the scheduling evidence.
+All 1,248 web/mobile output files matched byte-for-byte in the build comparison.
+The fixture suite kept all 47 tests, isolated mutable copies, and the verifier's
+two fresh builds. No deadline, isolation, or worker-count changes were needed.
+
+E2E builds reuse the existing isolated main/preload/renderer build wrapper, now
+forwarding `--mode e2e` to each target. All 2,640 output files matched byte-for-byte
+in both execution orders, including the exposed test store and relay artifacts.
+This saves a few build seconds; it does not speed up the E2E tests themselves.
+
+The existing unit assignment was already balanced at about 919 historical
+worker-seconds per shard; fresh x86 elapsed times still ranged from 254 to 433s.
+Refreshing weights alone would encode runner variation rather than resolve it.
+An [identical-source architecture pilot](https://github.com/stablyai/orca/actions/runs/36302250920)
+ran shards 1 and 8 on both four-CPU hosted runners. Complete jobs improved from
+449 to 404s and 461 to 384s on ARM, including setup; test and skip counts matched.
+A [full ARM run](https://github.com/stablyai/orca/actions/runs/36302906752) then passed
+all eight shards in 329–373 test seconds (365–412 job seconds). Uploaded reports
+matched the same complete x86 assignment: 9,876 files, each exactly once, no
+unhandled errors. These are elapsed samples excluding queue time, not a guarantee
+that every ARM allocation is faster than every x86 allocation.
+
+PR unit shards and their cache primer now use ARM; a main-branch warmer seeds
+that architecture's existing native and pnpm cache keys. Native, package, and
+relay gates continue on x86. The daily workflow retains complete x86 coverage on
+both Node 24 and Node 26, including relay integration. Thus PR unit architecture
+changes, while x86 unit coverage remains scheduled; this is an explicit coverage
+placement tradeoff rather than a claim of identical per-PR host coverage.
+
+PR validation exposed a WebRTC probe timeout inside a hidden renderer. Isolated
+and four-concurrent probes passed on both architectures; the original cause is
+unproven. The probe now uses Electron main for the same three-second observation
+interval. A [fault-injection comparison](https://github.com/stablyai/orca/actions/runs/36304349257)
+passed with renderer timers unavailable on both architectures, while the original
+probe failed the negative control. Packet assertions and deadlines are unchanged.
+A subsequent Windows run timed out in the installer's real CIM process query
+after verifying restricted policy. Its unchanged probe now runs before the
+concurrent native suite, removing that source of contention without relaxing
+the twenty-second process deadline or dropping either PowerShell architecture.
+
+Replacing Vitest deep comparisons with Node assertions in the status-store
+oracle saved only about one local second in an initial trial. The change was
+not retained: that evidence did not justify changing assertion semantics.
+
+The combined root/mobile pnpm cache is now present on main and was restored in
+the September 27 static comparison, so another warmer for that key is unnecessary.
+
+A [fixture-warmer overlap trial](https://github.com/stablyai/orca/actions/runs/36303613587)
+ran faster after initialization but exposed a first-use action-download race:
+both background composites downloaded `actions/cache@v5` simultaneously, and
+one briefly could not find `restore/action.yml`. The existing cache fallback
+rebuilt the image and the job passed, but that recovery erased the speedup.
+Keep the dedicated warmer serial. PR package restores remain safe from this
+observed first-use race because their earlier top-level cache action is loaded
+before the composites start; the workflow contract now preserves that ordering.
+
+## Four follow-up changes
+
+- Keep the readiness event, but reuse required checks only after an Actions API
+  lookup proves that the same PR head, tested merge commit, and workflow commit
+  already completed successfully. A changed base, missing proof, failed lookup,
+  or still-running check falls back to the full checks. Advisory tests retain
+  their normal readiness routing. The mobile and line-count workflows have no
+  draft-dependent work, so they no longer run again when a draft becomes ready.
+- Route the Bun matrix using the actual headless build and selected tests'
+  transitive imports, with conservative inclusion for dynamic workers, native
+  inputs, fixtures, and toolchain changes. A graph failure runs the full matrix;
+  manual dispatch still runs all ten platform jobs. The shared test selectors
+  retain the same 85 files. Unrelated shard timings and mobile-test tooling can
+  skip the matrix; shared shortcut definitions remain real runtime dependencies
+  and still run it. Building the graph does not execute the imported modules.
+- Restore pnpm stores on PRs using setup-node's existing key and store path,
+  without publishing more PR-private copies. Non-PR setup-node caching and
+  native/TypeScript caches keep their existing behavior. A missing main store
+  still installs with the frozen lockfile. The mixed root/mobile store may miss
+  repeatedly because the existing main warmer only seeds the root lockfile.
+- Batch only the PowerShell quota-fixture reservations within each test, using
+  the original generated scripts in fresh local scopes. Commands under test
+  retain separate processes, real file identities, and existing race assertions.
+  A traced local run confirms 44 PowerShell starts become 24, with all 21 cases
+  passing. Alternating after/before/after elapsed times were 50.00/59.28/37.00
+  seconds on a shared macOS arm64 host; that variance does not justify a precise
+  percentage or hosted runner-time claim. Test budgets and worker counts are
+  unchanged.
+
+The reproducible pnpm-store comparison is
+`ORCA_BACKGROUND_LAUNCH=1 node config/scripts/ci-pnpm-store-benchmark.mjs --samples=3`.
+On macOS arm64 with BSD tar, three alternating fresh-store pairs eliminated a
+median 332,746,995-byte archive per miss. Median install time was 17.33 seconds
+before and 16.94 after; the removed archive step alone took 53.51 seconds.
+Those local disk/CPU measurements exclude uploads and are not a prediction of
+Linux or Windows hosted savings. Restore cost is common to both policies.
+
+## September 26 verification
+
+[PR #23053](https://github.com/stablyai/orca/pull/23053) was merged before its
+latest full run finished. That run,
+[36221874572](https://github.com/stablyai/orca/actions/runs/36221874572), ultimately
+failed the mobile pending-frame precondition, just as the previous run had.
+All eight unit shards passed, but the aggregate did not. An unchanged assertion
+was not enough evidence to label the failure an unrelated flake.
+
+Main subsequently received the deterministic frame hold in PR #22635. The real
+terminal refit now queues a frame that the recorder holds until disposal has
+finished, then releases surviving work against a remounted terminal. This
+follow-up adds a negative control: cancellation is disabled only during disposal,
+and the same recorder must report a document-owned callback after disposal.
+The normal case retains its pending-work and zero-leak assertions. Both cases
+passed five fresh headless Chromium runs locally; the complete terminal-render
+file passed all 13 tests. Browser dependencies were required, so these were real
+render checks rather than skipped bundles.
+
+Unit model tests now import Monaco's editor API directly, preserving real models
+and undo stacks without loading every language contribution. The registry bridge
+requires only the editor and URI interfaces it actually uses. The full application
+still imports its existing Monaco entry point; no production runtime behavior,
+assertions, worker counts, timeouts or isolation settings changed.
+A controlled local comparison (macOS arm64, Node 26.6.0, Vitest 4.1.11,
+`--maxWorkers=1` only for this comparison) kept six files and all 32 tests.
+Three warm original samples took 14.53/12.84/11.62 seconds; three editor-API
+samples took 12.95/9.81/7.99 seconds, alternating back to the original imports
+between measurements. Median elapsed time fell 12.84 to 9.81 seconds (23.6%);
+median import time fell 10.73 to 7.94 seconds (26.0%). The initial cold original
+sample, 20.29 seconds, is excluded. Shared-host variance remains; this is a
+focused measurement, not a claim of a 23.6% improvement to the full unit suite.
+
+The default-branch warmer
+[36221917346](https://github.com/stablyai/orca/actions/runs/36221917346) successfully
+published native modules and TypeScript state. Fresh PRs
+[#23101](https://github.com/stablyai/orca/pull/23101) and
+[#23104](https://github.com/stablyai/orca/pull/23104) restored both on their first
+runs. Scope inventories showed neither PR had a private copy; the TypeScript
+key existed only on main. Native restore took 0.45/0.54 seconds; TypeScript restore
+took 0.38/1.31 seconds, with compiler steps of 8/39 seconds versus the warmer's
+80-second cold compiler step. PR #23104 used the prefix fallback after its base
+advanced, confirming reuse across commits as well as PRs.
+
+The same warmer saved a 22.5 MB Git cache, but the exact key disappeared before
+it was reused. Quota eviction is plausible, not proven: the usage API reported
+17.48 GiB while a separate live 100-entry sample contained 15.15 GiB of pnpm
+stores alone. These rapidly changing inventories are not atomic. The root-only
+warmer does not seed the root-plus-mobile download-store key used by static
+analysis, so both fresh PRs saved another roughly 350 MiB store. Controlling that
+cache duplication is a remaining opportunity; hourly warming alone cannot
+promise retention. Git's checksum-verified cold-build fallback remains required.
+
+The unit scheduling baseline now comes from all eight successful Node 24 shards in
+[run 36294142683](https://github.com/stablyai/orca/actions/runs/36294142683).
+All 9,847 measurements match current discovery exactly once; the previous baseline
+had 165 unmeasured files and one deleted path. Applying the same measurements to
+both assignments reduces the largest projected load from 1,043.811 to 919.695
+worker-seconds (11.9%). This is a scheduling projection, not an elapsed-time claim;
+runner variation remains visible in the source run. See
+[provenance and reproduction](../../config/scripts/ci-shard-timings.md).
+
+## Recording compilation reuse
+
+[Benchmark run 36295773765](https://github.com/stablyai/orca/actions/runs/36295773765)
+compared the complete mobile suite on two hosted runners in opposite orders.
+Compilation reuse reduced elapsed time from 439.002 to 138.308 seconds and from
+560.926 to 200.751 seconds (64–68%). Each run preserved all 9,629 original test
+verdicts and passed four additional cache regression tests. Compiled code is
+bounded to 512 entries; exports, dependencies, and scenario state remain fresh.
+
+Splitting family recordings across four files took 145.165 and 217.226 seconds,
+5–8% slower than compilation reuse alone, so the original suite structure stays.
+All 787 goldens were regenerated from the unchanged pinned product tree; only
+the recorder digest changed, with identical recording bodies and value pools.
+
+Desktop validation in [run 36295671576](https://github.com/stablyai/orca/actions/runs/36295671576)
+passed all eight shards. The longest test step was 419 seconds versus 429 in the
+source run; summed test time was 3,028 versus 3,031 seconds. Runner variation
+prevents attributing that small elapsed-time difference solely to the weights.
+
+## September 25 follow-up
+
+The current queue is a bigger part of PR latency than setup. Successful full PR
+[36212793136](https://github.com/stablyai/orca/actions/runs/36212793136) used
+**74.6 aggregate runner-minutes**, including **55.5** for its eight unit shards.
+Those jobs ran for 315–448 seconds but waited 229–1,076 seconds to start. The
+three-second final `verify` job waited another 264 seconds. These are observed
+job creation-to-start and start-to-completion intervals, not billing figures.
+
+This follow-up keeps the existing tests, isolation, eight unit shards, platform
+coverage, and release behavior:
+
+- Make the reusable unit-test call and final aggregate respect cancellation.
+  Their old `always()` conditions kept superseded work alive despite workflow
+  cancellation. In [36215475069](https://github.com/stablyai/orca/actions/runs/36215475069),
+  a newer push cancelled ordinary jobs while all eight unit shards remained
+  queued and the replacement workflow remained pending. `!cancelled()` still
+  evaluates after failed/skipped dependencies, without resisting cancellation.
+  Two other superseded PR runs reproduced this: at 04:27 UTC on September 26,
+  [36216165253](https://github.com/stablyai/orca/actions/runs/36216165253) and
+  [36215543186](https://github.com/stablyai/orca/actions/runs/36215543186) still held
+  11 runners, with two more obsolete jobs queued. They had consumed another
+  71.3 runner-minutes after replacement pushes. After rechecking current PR heads
+  and replacement runs, both obsolete runs were force-cancelled; their replacements
+  left the blocked pending state.
+- Combine root/README guards with change detection. A real sparse checkout kept
+  all 29,487 index entries while materializing only 12 files (192 KB). This
+  eliminates one runner allocation and checkout per PR. README link checks still
+  see tracked targets outside the working tree and run on docs-only PRs.
+- Use free `ubuntu-slim` containers for small guard/aggregate/API jobs; trial
+  free `ubuntu-24.04-arm` for typechecking, which needs no native runtime.
+  Both share the account's standard concurrency limit. Different labels do
+  **not** grant extra concurrent jobs; hosted timings determine their value.
+- Cancel superseded PR attempts in the Git termination, Pi owner, and Pi provider
+  runtime workflows, retaining independent manual runs.
+- Fetch only complete HEAD ancestry for cloud secret scanning. The old checkout
+  fetched every branch and tag and took 55 seconds in
+  [36214130174](https://github.com/stablyai/orca/actions/runs/36214130174).
+  Real Git fixtures prove both merge parents and deleted historical contents
+  still produce the identical scanned patches.
+- Remove the cloud lockfile from the eight unit shards' download-cache key; the
+  dedicated relay integration job still includes it. Record actual per-file
+  environment, setup, import, and test durations for the existing shard planner.
+  Shard 4 spent 535 worker-seconds importing and 357 executing tests; a uniform
+  per-file import estimate misses that cost. See [timing refresh](../../config/scripts/ci-shard-timings.md).
+- Seed Node 24 native modules, the pinned Git compatibility binary, and TypeScript
+  state on the default branch, hourly
+  and when dependency/toolchain inputs change. One ten-minute-bounded hosted job
+  reuses existing cache keys and skips typechecking an already-cached commit.
+  New PRs can restore default-branch caches, while caches saved by another PR
+  are inaccessible. The audit found 80 entries totaling 10.67 GiB, including
+  9.31 GiB of pnpm stores, but no main-branch Node 24 native or TypeScript state.
+  Seven PRs held separate copies of the same pnpm key (2.36 GB combined).
+  Git preparation now has one shared action with the unchanged cache key,
+  checksum, and build command. In
+  [36212101873](https://github.com/stablyai/orca/actions/runs/36212101873), a new PR
+  spent 40 seconds compiling the same Git 2.25.5 binary; main-branch warming
+  makes that cache available to new PRs too.
+
+The hosted trial also removes repeated work in mobile bundle checks. The
+builder keeps private snapshots of the default real output for read-only checks
+(15 identical builds become two), and haptics checks reuse each route closure
+(32 builds become eight). Determinism, custom inputs, malformed routes, stale
+outputs, and tampered manifests retain independent builds. A mutation regression
+proves Buffer/manifest consumers cannot change another assertion's fixture.
+The grant census reuses parsed references for unchanged file contents, still
+reads source every time, and has a real-file edit invalidation regression.
+The first hosted mobile lane used 400 seconds for its 448 tests; the grant
+census alone took 259 seconds. Locally, the same one-worker invocation of the
+three changed files fell from 243.07 seconds (101 passing tests) to 49.49 seconds
+(103 passing tests). Hosted run
+[36217238462](https://github.com/stablyai/orca/actions/runs/36217238462) retained
+the same 43 files and passed all 450 tests: the original 448 plus two regressions.
+Its test step fell from 400.26 to 205.17 seconds, and the complete job fell from
+498 to 298 seconds (40% less runner time). Builder, haptics, and grant-census file
+times fell from 73.70/88.94/258.58 seconds to 29.24/32.98/22.58 seconds.
+The later default-worker verification retained the same 450-test coverage, but
+its unchanged terminal-render test failed twice on the pre-existing timing
+assertion that a frame must be pending at disposal (`expected 0 to be greater
+than 0`). Its other 449 tests passed; no mobile source or assertion was relaxed.
+
+A four-worker experiment reduced aggregate unit job time from 3,386 to 3,133
+seconds (7.5%), but the repeat run exceeded the palette matcher's existing
+180ms performance budget at 235ms. The override was removed; retain Vitest's
+default worker count, isolation, timeouts, retries, and coverage. The first trial
+also found an outdated hook-order snapshot after main added three layout-persistence
+hooks. That snapshot was refreshed only after comparing the exact old and merged
+hook sequences. Final verification is linked from
+[PR #23053](https://github.com/stablyai/orca/pull/23053). Failed timing reports
+never replace the checked-in baseline.
+
+No account settings, paid services, or runner entitlements changed. Standard
+public-repository runners remain free. GitHub documents plan concurrency limits
+of Free 20, Pro 40, Team 60, Enterprise 500, and permits support requests for
+increases. The organization's actual entitlement was not exposed by the API.
+See [runner specifications](https://docs.github.com/en/actions/reference/runners/github-hosted-runners)
+and [concurrency limits](https://docs.github.com/en/actions/reference/limits).
+
+Hosted observations from [PR run 36215718607](https://github.com/stablyai/orca/actions/runs/36215718607):
+
+| Check                                     | Earlier sample |        Trial | Result               |
+| ----------------------------------------- | -------------: | -----------: | -------------------- |
+| Detection plus repository guards          |  54s, two jobs | 26s, one job | Passed               |
+| Typecheck (whole job)                     |       109s x64 |      81s ARM | Passed               |
+| Typecheck command, cold incremental state |        76s x64 |      51s ARM | Passed               |
+| Cloud secret scan (whole job)             |            69s |          55s | Passed               |
+| Cloud checkout/history fetch              |            55s |          40s | Identical scan scope |
+
+The [warmup trial](https://github.com/stablyai/orca/actions/runs/36215718295)
+passed in 54 seconds. Its x64 compiler restored the ARM job's incremental state
+and rechecked the same source in eight seconds. Unit shard 3 subsequently
+restored its pnpm/native cache keys successfully. Actual sharing across different
+PRs requires the producer to land on the default branch; this trial validates
+commands and key compatibility, not a completed default-branch rollout.
+The follow-up warmup built the Git binary in 40 seconds; the PR Git check restored
+that exact key and passed in 62 seconds overall. Its TypeScript refresh took
+seven seconds after restoring earlier incremental state.
+
+These are small observational samples from different revisions, not controlled
+benchmarks. The cold typecheck log confirms an incremental-cache miss. Queue
+changes must be separated from active duration and concurrent account traffic.
+At the time of that trial, checked-in shard weights were unchanged; the September
+26 refresh above now uses the complete successful unit reports.
+
+## September 5 audit
+
 Audit date: September 5, 2026. No paid capacity or provider configuration changed.
 
 ## Measurements and changes
diff --git a/docs/reference/monaco-language-associations.md b/docs/reference/monaco-language-associations.md
new file mode 100644
index 000000000000..a159477e1761
--- /dev/null
+++ b/docs/reference/monaco-language-associations.md
@@ -0,0 +1,30 @@
+# Monaco filename associations
+
+Orca imports Monaco's full `editor.main.js` entry point, which registers the built-in
+languages and loads their grammars on demand. Filename detection must not load the
+editor itself: it also runs during session restoration and before the editor mounts.
+
+`monaco-language-associations.json` contains the registration metadata from the
+installed package's entry point. Regenerate it after upgrading Monaco:
+
+```sh
+node config/scripts/generate-monaco-associations.mjs
+pnpm exec oxfmt --write src/renderer/src/lib/monaco-language-associations.json
+```
+
+The generator reads syntax trees without executing contributions or grammar loaders.
+Its test compares the checked-in metadata to the installed package. The original
+list was verified against a clone of `microsoft/monaco-editor`, tag `v0.55.1`, commit
+`516f350bdaf7a82f6731bd128a9ec86a6e5fa47d` (`src/basic-languages` and `src/language`).
+
+Existing Orca filename and extension choices take precedence. This preserves custom
+Vue, Svelte, Astro, Nim, Typst, JSONL, notebook and preview handling, as well as the
+Markdown mapping for MDX. The fallback matches exact filenames before the longest
+extension, case-insensitively, and resolves duplicate associations in upstream
+registration order (the last registration wins, so `.pp` selects Ruby over Pascal).
+
+Monaco 0.55.1 has 90 registrations, 81 with filenames or extensions. Registrations
+without either remain available in Monaco but cannot be inferred from a path. This
+does not add VS Code extensions or language servers, guess from file contents, or
+change mobile's separate lowlight grammar set. The renderer uses only the basename,
+so local, Windows, SSH and folder-workspace paths share the same detection.
diff --git a/docs/reference/orcad-operations.md b/docs/reference/orcad-operations.md
index 0fafdb1feed6..63f03777c176 100644
--- a/docs/reference/orcad-operations.md
+++ b/docs/reference/orcad-operations.md
@@ -145,11 +145,11 @@ An external supervisor (systemd, launchd, a process manager). orcad conforms to
   after the listener is bound and the daemon verdict is in. There is no separate readiness
   socket; the line is the signal. Set the supervisor's start timeout generously — the daemon
   launch has its own retries and can take tens of seconds on a cold host.
-- **Shutdown.** `SIGTERM` or `SIGINT` starts a graceful stop. A **second** signal exits
-  immediately with code 1 rather than being swallowed — a supervisor's second signal means
-  its first deadline elapsed, and waiting silently is what turns a stop into a `SIGKILL`,
-  the one teardown that skips the daemon handoff. orcad also imposes its own 15s deadline
-  and exits 1, so the failure stays attributable instead of arriving as an unlogged kill.
+- **Shutdown.** `SIGTERM` or `SIGINT` starts one graceful stop. Repeated signals share
+  that stop because a supervisor may signal both the launcher and its child. A 15s deadline
+  exits with code 1 if teardown stalls. The bundled runtime also stops gracefully if its
+  launcher's IPC channel closes. On POSIX, both the launcher and runtime ignore `SIGHUP`,
+  so terminal hangups do not stop a headless host. Use `SIGTERM` or `SIGINT` to stop it.
 - **Exit codes.**
 
   | Code | Meaning                                                      | Supervisor should    |
diff --git a/docs/reference/qoder-integration.md b/docs/reference/qoder-integration.md
new file mode 100644
index 000000000000..3a3a90121cd7
--- /dev/null
+++ b/docs/reference/qoder-integration.md
@@ -0,0 +1,89 @@
+# Qoder CLI integration
+
+Orca registers `qodercli` as `qoder`: detection, picker/settings, desktop and mobile
+identity, prompt launch, permission flags, managed hooks, workspace trust, and
+session resume use the existing TUI-agent and hook-status paths.
+
+## Verified contract
+
+Verified on macOS with Qoder CLI 1.1.64, including its versioned executable
+`qodercli-1.1.64`:
+
+- `--prompt-interactive` starts an interactive prompt; `--resume <id>` resumes a
+  session; `--dangerously-skip-permissions` is the permission bypass flag.
+- Hooks use the Claude-shaped nested configuration in `~/.qoder/settings.json`.
+  Orca registers its own `/hook/qoder` source and preserves user hooks.
+- Real SessionStart, UserPromptSubmit, Notification and SessionEnd events are
+  captured in `src/shared/__fixtures__/qoder-no-account-hooks.jsonl`, including
+  `source: resume` with the original session ID.
+- Trust is `permissions.trustDirectories` in that settings file, using the
+  canonical workspace path. A workspace `.trusted` marker did not bypass the
+  trust dialog in this version. Remote trust uses the execution host filesystem.
+- Qoder emits its `◇ … | Ready` title while the trust menu owns input. Readiness
+  therefore requires the live composer text, not merely this title or silence.
+  Raw PTY fixtures under `src/main/runtime/__fixtures__/qoder-*` cover trust,
+  unauthenticated prompt handling and the ready composer.
+- A hidden Orca dev instance launched Qoder from New Tab in a folder workspace.
+  Its icon, label, terminal rendering and failed-turn indicator were inspected.
+  A harmless prompt reached Qoder, which reported its credit usage limit; the
+  canonical hook store recorded Qoder identity, session metadata and failure.
+
+## Compatibility and limits
+
+Windows hooks explicitly select Qoder's documented PowerShell shell, avoiding
+an assumption that Qoder uses Git Bash just because it is installed. They reuse
+the existing managed `.cmd` payload without adding an encoded PowerShell hop.
+The configuration shape and preservation are tested; Windows, Linux and SSH
+execution have not been exercised live here.
+
+Resume requests to remote hosts require `agent-session.qoder-resume.v1`, so an
+older host is not sent an agent enum it cannot accept. Remote hook installation
+and trust preservation have automated coverage.
+
+Successful model output, tool execution and live permission dialogs remain
+unverified because the available account has exhausted its credits. Hook event
+mapping for these paths follows the official documentation. The China executable
+`qoderclicn` is not registered; it was not available for verification.
+
+New Tab follows the existing manual-launch trust behavior: an untrusted folder
+can show Qoder's trust dialog. Automated workspace/draft launch paths run the
+trust preflight before prompt delivery.
+
+## Sources
+
+- [Official hooks documentation](https://docs.qoder.com/cli/hooks)
+- [#15291](https://github.com/stablyai/orca/pull/15291): registration and hook proposal
+- [#13311](https://github.com/stablyai/orca/pull/13311): icon asset (commit
+  `b56197025530adb1b82d97a364a8c3d4a02c0d42`) and agent integration
+- [#8611](https://github.com/stablyai/orca/pull/8611) and
+  [#12910](https://github.com/stablyai/orca/pull/12910): contributor implementations
+- [#16540](https://github.com/stablyai/orca/issues/16540): Qoder misidentified as Gemini
+
+Contributor patches informed the integration; they were not applied wholesale.
+In particular, the trust marker proposal was replaced using the installed CLI's
+observed settings write, and no renderer workaround was added because the live
+WebGL terminal rendered correctly.
+
+## Cross-review of open proposals
+
+Reviewed the current patches for all six open Qoder PRs on 2026-09-28:
+
+| PR | Incorporated or confirmed | Deliberate differences |
+| --- | --- | --- |
+| #7502 (vincent-lxc) | Agent registration, mobile parity, identity before Gemini | Use structural titles and the current public permission flag. |
+| #8611 (Eridanus117, building on #7502) | Qoder hook source, notification/permission mapping, session resume | 1.1.64 supports `--prompt-interactive`; preserve startup session identity and ignore compact restarts. |
+| #9655 (xingqingzzp-gif) | Cross-checked minimum registration coverage | Placeholder icon and detection-only scope are superseded by the fuller integration; no code copied. |
+| #12910 (jyang2004) | Reuse the Claude-compatible installer with an event subset, plus remote installation | Use observed `.qoder` path and `/hook/qoder`; Qwen and the China build remain separate work. |
+| #13311 (sorrycc) | Icon, structural title disambiguation, headless detection, display glyph cleanup | No DOM renderer override: 1.1.64 renders correctly in the live WebGL terminal. No unverified executable alias. |
+| #15291 (adlternative) | Versioned binary recognition, trust preflight wiring, skills mapping and resume | Trust comes from settings, not `.trusted`; include notifications, permission and failure events with Qoder-specific normalization. |
+
+The rendered left sidebar was checked in the hidden Electron app using a temporary
+folder workspace and real Qoder hooks. The workspace fixture needed a parent path
+on its project group to appear in the sidebar. No agent status was injected into
+the renderer. A real prompt updated the row text and returned a credit-limit error;
+the row and workspace card showed failure with the Qoder icon. A DOM observer
+recorded the prompt-row transition before failure. Permission/waiting and successful
+completion remain automated event-mapping tests, not live model/tool verification.
+
+Commit co-authors credit all six proposal authors for the implementation and
+registration groundwork, including xingqingzzp-gif’s minimal registration proposal.
diff --git a/docs/reference/remote-wire-compatibility.md b/docs/reference/remote-wire-compatibility.md
index d72f93770c5d..b2bcb3c40f4e 100644
--- a/docs/reference/remote-wire-compatibility.md
+++ b/docs/reference/remote-wire-compatibility.md
@@ -181,8 +181,10 @@ hand-written. It covers the three skews that surface can fail on:
 - a new client against the old dispatcher always gets an answer rather than silence,
   and `method_not_found` for every method that release does not register, so the
   absence is visible during negotiation instead of by calling;
-- a cursor survives a host restart: the client's fence is refused as stale with the live
-  one attached, and resuming from the held cursor replays only what it missed.
+- a cursor survives a host restart: a reattach at the client's fence is refused as stale
+  with the live one attached, a write still carrying that fence is delivered (writes are
+  named by their target, and every released client still sends a fence), and resuming from
+  the held cursor replays only what it missed.
 
 Run it with:
 
diff --git a/docs/reference/ssh-execution-boundary.md b/docs/reference/ssh-execution-boundary.md
index a113a5e6f29c..12aeea897533 100644
--- a/docs/reference/ssh-execution-boundary.md
+++ b/docs/reference/ssh-execution-boundary.md
@@ -83,12 +83,12 @@ worth — is answered by `RuntimeHostContact` (`src/shared/runtime-host-contact.
 never be mapped onto one:
 
 - `refused` is the host answering and turning us away — unauthorized, a protocol mismatch, a status
-  method it does not implement. That is positive evidence about the *connection*, and it says
+  method it does not implement. That is positive evidence about the _connection_, and it says
   nothing whatever about whether the host's PTYs are running. They almost certainly still are.
 - `retired` is the pairing being ended by explicit user action. Same point: the client stops having
   a route, the remote work is unaffected.
 
-Both are reasons to stop *trusting a cached answer*, never reasons to report a process `exited`. A
+Both are reasons to stop _trusting a cached answer_, never reasons to report a process `exited`. A
 reader that needs a process verdict must still get it from the host that owns the process, by the
 tests above.
 
diff --git a/docs/reference/ssh-reconnect-source-recovery.md b/docs/reference/ssh-reconnect-source-recovery.md
index 5dffc50e7dd3..e8c12cf51895 100644
--- a/docs/reference/ssh-reconnect-source-recovery.md
+++ b/docs/reference/ssh-reconnect-source-recovery.md
@@ -129,6 +129,18 @@ the renderer retries.
 The SSH e2e lane must be green and triggering on **source** changes before any of this is attempted.
 It was skipping for 15 specs; four regressions reached a user during that window.
 
+## Resolved: a disposed pane killed its successor's new shell
+
+A pane rebuilt during its first spawn uses the same reservation key, so main can return the
+same PTY to both transports (#19386, #22578). The disposed transport must keep that shell
+while its tab and layout leaf remain and its execution host's workspace is not being deleted.
+A live transport refusing the id still retires it (#11003). This applies to local, WSL and SSH
+IPC terminals; the remote-runtime transport has no corresponding kill.
+
+The remount trigger in the Scan-22 user report remains unknown. A retained shell can outlive
+its tab if the tab closes before a successor binds it; keeping potentially owned work follows
+the SSH execution boundary.
+
 ## Open: the pane behind a preserved tab does not always rebind
 
 The merge now keeps a local tab the host has never been told about, so the tab and its title survive
diff --git a/docs/reference/windows-daemon-host-relocation.md b/docs/reference/windows-daemon-host-relocation.md
index f560597e25e6..c5cb34e8ab54 100644
--- a/docs/reference/windows-daemon-host-relocation.md
+++ b/docs/reference/windows-daemon-host-relocation.md
@@ -11,7 +11,7 @@ Read this before changing the copy plan, the host exe name, the LOCALAPPDATA lay
 
 ## What the relocation actually escapes
 
-The killer is **electron-builder's process sweep, matched on image path** — not file deletion.
+The killer is **electron-builder's process sweep** — not file deletion.
 Windows will not delete a running image, so `RMDir /r "$INSTDIR"` cannot end the daemon on its own.
 
 In app-builder-lib's `allowOnlyOneInstallerInstance.nsh`, `FIND_PROCESS` / `KILL_PROCESS` have two
@@ -22,15 +22,22 @@ branches:
 | Primary  | `powershell.exe` runs, `Get-CimInstance` resolves, and `Get-ExecutionPolicy -Scope Process` is not `Restricted` | `Win32_Process` where `$_.Path.StartsWith('$INSTDIR', 'CurrentCultureIgnoreCase')` — **path-scoped**                                                                  |
 | Fallback | otherwise                                                                                                       | per-user: `taskkill /F /IM "<AppName>.exe" /FI "PID ne $pid" /FI "USERNAME eq %USERNAME%"`; per-machine: the same without the username filter — **image-name-scoped** |
 
-The probe reads the **process** scope, not the effective policy, and Group Policy writes
-`MachinePolicy`/`UserPolicy` — so a GPO-managed host whose effective policy is `Restricted` still
-exits 0 and takes the primary branch. The fallback is reached only when `powershell.exe` is absent,
-`Get-CimInstance` does not resolve, PowerShell is blocked outright (WDAC/AppLocker, Server Core), or
-an inherited `PSExecutionPolicyPreference=Restricted` is in the environment.
+The upstream policy check can select the image-name fallback even when the inline process query
+works. `Restricted` disallows script files, not inline commands. A packaged trace for #22872
+showed that fallback successfully killing the relocated `Orca.exe` during an update; the
+genuine-uninstall cleanup guard was not responsible.
 
-So on essentially every machine the sweep is path-scoped, and a daemon whose image lives under
-`%LOCALAPPDATA%` is out of range regardless of what the file is called. **Survival is a property of
-the path.** The name only matters on the fallback branch.
+Orca's `customCheckAppRunning` in `config/nsis/orca-process-check.nsh` tests the actual inline
+`Get-CimInstance Win32_Process` query with terminating errors. Success selects the path-scoped
+branch; any other result retains the upstream fallback. The hook reuses upstream process
+selection, retry, permission and installation-mode handling. It neither overrides execution
+policy nor assumes PowerShell is available.
+
+A daemon outside `$INSTDIR` survives the path-scoped sweep. A genuinely unavailable process query
+still permits an image-name sweep and cold restore. Updates also run the **old installed
+uninstaller**, whose old capability check cannot be repaired by the new installer: the first
+upgrade can still cold-restore on an affected host. Once both binaries contain the hook, later
+updates use the actual capability test on both sides.
 
 ## Why the exe is copied verbatim (and not renamed)
 
@@ -99,15 +106,22 @@ stop being scored.
   `orca-terminal-daemon.exe` name stays in the macro to reap hosts left by older builds.
 - `LOCAL_HOST_ROOT_NAME` in `daemon-host-relocation.ts` and the path in the uninstall macro are the
   same directory. Change both together.
+- Every native module the daemon bundle `require()`s must be in the copy plan
+  (`daemon-host-manifest.ts`). A missing one does not fail the fork: bare `require` walks up from the
+  relocated bundle, finds nothing, and the caller's fallback runs forever. That is how
+  `@vscode/windows-process-tree` went missing and every process-table read became a
+  `powershell.exe` CIM scan (#16905). A host missing the addon's runtime files counts as
+  unmaterialized, so hosts built before it was copied get rebuilt.
 
 ## Verifying a change
 
-Unit coverage lives in `src/main/daemon/daemon-host-relocation.test.ts` (copy plan, verbatim
+Unit coverage lives in `src/main/daemon/daemon-host-relocation.test.ts` (copy plan, native-addon mirror, verbatim
 naming, marker/atomic publish, fail-open, prune veto). Nothing in unit tests can prove survival, so
 any change to this file or to the NSIS macro needs the packaged harnesses:
 
 - `.github/workflows/win-update-survival-e2e.yml` — builds an installer from the branch and updates
-  it over itself with `--expect survival`. The primary proof.
+  it over itself with `--expect survival`. Verify normal and child-scoped `Restricted` policy;
+  also verify released-to-branch migration with the expected cold-restore limitation.
 - `.github/workflows/win-crash-survival-e2e.yml` — proves the daemon survives a main-process crash.
 - `.github/workflows/windows-terminal-restart-e2e.yml` — terminal restart behaviour.
 - `.github/workflows/win-update-e2e.yml` — release-tag-to-release-tag update, both `survival` and
diff --git a/docs/reference/windows-edr-posture.md b/docs/reference/windows-edr-posture.md
index 1ba19df87ea3..f1e63657f764 100644
--- a/docs/reference/windows-edr-posture.md
+++ b/docs/reference/windows-edr-posture.md
@@ -203,7 +203,9 @@ unquoted parameter string on whitespace.
 
 One site still spells `-ExecutionPolicy Bypass` with **no** encoding, the weaker
 signal: `src/main/cli/wsl-cli-scripts.ts` (`-File`, and it is a real script
-file, so the switch is not a no-op there). `src/main/system-fonts.ts` dropped it
+file, so the switch is not a no-op there). Every Orca-managed WSL terminal now
+reaches it by default on each CLI call (`docs/reference/wsl-managed-cli.md`), not
+only after the user registers the WSL CLI. `src/main/system-fonts.ts` dropped it
 for plain `-Command`; `src/shared/secure-path-windows-acl.ts` no longer runs
 PowerShell at all, having moved to `icacls.exe`; and computer use now asks for
 `-ExecutionPolicy RemoteSigned` in
diff --git a/docs/reference/wsl-managed-cli.md b/docs/reference/wsl-managed-cli.md
new file mode 100644
index 000000000000..8ae3b61aa62e
--- /dev/null
+++ b/docs/reference/wsl-managed-cli.md
@@ -0,0 +1,37 @@
+# CLI access in Orca-managed WSL shells
+
+A WSL terminal on a Windows host gets this app's CLI (`orca-ide` packaged,
+`orca-dev` in development) on its PATH with nothing installed in the guest:
+`~/.local/bin`, shell profiles, and the Windows user PATH are untouched. External
+WSL shells still need Settings → General registration.
+
+1. **Host.** `buildPtyHostEnv` calls `getManagedWslCliDir` for WSL panes only. It
+   writes a launcher and PowerShell bridge (reusing `wsl-cli-scripts.ts`) under
+   `<userData>/wsl-managed-cli/<content hash>` and exports `ORCA_WSL_CLI_DIR`.
+   Content addressing follows `shell-wrapper-content-address.ts`: builds sharing
+   user data never overwrite each other, and a present file is complete because
+   each one lands by rename. Old directories are not collected.
+2. **Crossing.** `addOrcaWslInteropEnv` adds `ORCA_WSL_CLI_DIR/p`, so both the
+   daemon and in-process spawn paths translate it with the distro's own mounts.
+3. **Guest.** `WSL_MANAGED_CLI_PATH_RESTORE` runs after user startup files in the
+   bash rcfile and the local zsh first-prompt hook, which run once per Orca shell.
+   It leads PATH with the directory when `$ORCA_WSL_CLI_DIR/$ORCA_CLI_COMMAND` is
+   executable, and otherwise prints one warning. Other login shells get no CLI;
+   nothing blocks a shell.
+
+The colocated launcher finds its bridge beside itself and PowerShell by Windows
+path, so neither guest PATH nor the automount root matters. The bridge pins this
+app's user-data directory and is written with a UTF-8 BOM so Windows PowerShell 5.1
+reads non-ASCII paths correctly. It clears `ORCA_WSL_CLI_DIR`, which WSLENV maps
+back to Windows, so an app the CLI starts never inherits it. In development it runs
+Electron as Node on `out/cli/index.js` directly, with the environment
+`buildWindowsDevLauncher` sets (`ORCA_APP_EXECUTABLE`, stashed `NODE_OPTIONS`).
+Otherwise it launches its child exactly like the registered bridge.
+
+A missing runtime (logged once) or a failed write (logged per spawn) leaves
+`ORCA_WSL_CLI_DIR` unset. A terminal daemon from an older build adds no WSLENV
+entry, so its WSL panes lack the CLI until the daemon restarts.
+
+Run the opt-in end-to-end test on Windows with `ORCA_BACKGROUND_LAUNCH=1`,
+`ORCA_TEST_MANAGED_WSL=1`, and optionally `ORCA_TEST_WSL_DISTRO=<distro>`. The zsh
+case skips when the distro lacks `zsh` or `script`.
diff --git a/docs/site/content/docs/agents/supported.mdx b/docs/site/content/docs/agents/supported.mdx
index 6532e04fb58c..0658ce6fd8c3 100644
--- a/docs/site/content/docs/agents/supported.mdx
+++ b/docs/site/content/docs/agents/supported.mdx
@@ -46,8 +46,10 @@ To restore prompts for one agent only, edit that agent's default arguments or en
 | Autohand           | Auto-setup                                                                                                                 | [Autohand](https://github.com/autohandai/code-cli)                                                |
 | Cline              | Auto-setup                                                                                                                 | [Cline](https://docs.cline.bot/cline-cli/overview)                                                |
 | Codebuff           | Auto-setup                                                                                                                 | [Codebuff](https://www.codebuff.com/docs/help/quick-start)                                        |
+| Freebuff           | Auto-setup                                                                                                                 | [Freebuff](https://freebuff.com/cli)                                                              |
 | Command Code       | Auto-setup, status                                                                                                         | [Command Code](https://commandcode.ai/docs/quickstart)                                            |
 | Muse               | macOS/Linux; trusts the workspace at launch                                                                                | [Meta](https://dev.meta.ai/docs/muse-code)                                                        |
+| DeepSeek Harness   | Launched through its `dsh-tui` profile; hooks, status, questions, resume                                                   | [DeepSeek](https://deepseek-harness.github.io/deepseek-harness/)                                  |
 | ZCode              | Deep integration; needs a `zcode` CLI that ships the TUI (see note below)                                                  | [Z.ai](https://zcode.z.ai/en/docs)                                                                |
 | Continue           | Auto-setup                                                                                                                 | [Continue](https://docs.continue.dev/guides/cli)                                                  |
 | Cursor CLI         | Deep integration                                                                                                           | [Cursor](https://cursor.com/cli)                                                                  |
diff --git a/docs/site/content/docs/telemetry.mdx b/docs/site/content/docs/telemetry.mdx
index 604202e067e1..f7f8568cd959 100644
--- a/docs/site/content/docs/telemetry.mdx
+++ b/docs/site/content/docs/telemetry.mdx
@@ -21,12 +21,12 @@ The categories of behavior we observe:
 
 - **Lifecycle** — when the app opens. Used to estimate daily, weekly, and monthly active users.
 - **Repos and workspaces** — when you add a repo or create a workspace. We record _how_ you did it (e.g. folder picker vs. clone URL; command palette vs. drag-and-drop), never the repo name, URL, path, branch name, or any free-form text.
-- **Agents** — when you start an agent, which agent kind it was (from a fixed list like `claude-code`, `codex`, `gemini`, etc.), and where you launched it from. Never the prompt, model details, or agent output.
+- **Agents** — which agents you use and their token counts. Never prompts or agent output.
 - **Agent errors** — a coarse error category and which agent kind was involved. We never see raw error messages or stack traces; per-incident detail stays in a local diagnostic trace file on your machine and only reaches Orca if you explicitly share a diagnostic bundle.
 - **Settings** — when you toggle one of a small whitelisted set of feature-flag or UX preferences. We record which preference changed and whether it's a boolean or an enum, never the raw value of any free-form setting.
 - **Privacy controls** — when you opt in or out of telemetry, so we can tell from aggregate data whether our consent UI is working.
 
-Every field we transmit is either a fixed enum value, a version string, or the anonymous local ID. No free-form strings from any UI input ever leave your machine.
+Fields include fixed enum values, version strings, numeric counts and revisions, and random local IDs. Conversation IDs allow repeated token summaries for the same conversation to be associated; they are pseudonymous. No free-form strings from any UI input ever leave your machine.
 
 ## What we never send
 
diff --git a/electron.vite.config.ts b/electron.vite.config.ts
index 615fffe3a995..5dac7dfbbba0 100644
--- a/electron.vite.config.ts
+++ b/electron.vite.config.ts
@@ -5,7 +5,10 @@ import react from '@vitejs/plugin-react'
 import tailwindcss from '@tailwindcss/vite'
 import { createBootstrapFatalExitBanner } from './config/build-plugins/bootstrap-fatal-exit-banner'
 import { createPdfjsViewerAssetsPlugin } from './config/build-plugins/pdfjs-viewer-assets'
-import { createPlainNodeEntryGuardPlugin } from './config/build-plugins/plain-node-entry-guard'
+import {
+  CLI_MAIN_ENTRY_NAMES,
+  createPlainNodeEntryGuardPlugin
+} from './config/build-plugins/plain-node-entry-guard'
 import { parseReleaseSources } from './src/shared/release-sources'
 import packageJson from './package.json' with { type: 'json' }
 
@@ -257,6 +260,12 @@ export const electronViteConfig: UserConfig = {
           // corpora and read SQLite synchronously; a worker thread keeps that
           // off the main-process event loop.
           'usage-scan-worker-entry': resolve('src/main/usage/usage-scan-worker-entry.ts'),
+          'profile-state-backup-worker-entry': resolve(
+            'src/main/persistence/profile-state/profile-state-backup-worker-entry.ts'
+          ),
+          'profile-state-writer-worker-entry': resolve(
+            'src/main/persistence/profile-state/profile-state-writer-worker-entry.ts'
+          ),
           // Why: forked with ELECTRON_RUN_AS_NODE so @parcel/watcher faults
           // can't take down the main process (issue #7547).
           'parcel-watcher-process-entry': resolve('src/main/ipc/parcel-watcher-process-entry.ts'),
@@ -265,16 +274,9 @@ export const electronViteConfig: UserConfig = {
           'main-thread-hang-watchdog-entry': resolve(
             'src/main/hang-watchdog/main-thread-hang-watchdog-entry.ts'
           ),
-          // Why: electron-vite cleans out/main in dev. The dev CLI imports
-          // this path for `orca agent hooks ...`, so it must survive rebuilds.
-          'agent-hooks/managed-agent-hook-controls': resolve(
-            'src/main/agent-hooks/managed-agent-hook-controls.ts'
-          ),
-          'codex/managed-home-shell-preflight': resolve(
-            'src/main/codex/managed-home-shell-preflight.ts'
-          ),
-          // Why: account import mutates the user's macOS Keychain from the CLI.
-          'claude-accounts/keychain': resolve('src/main/claude-accounts/keychain.ts')
+          ...Object.fromEntries(
+            CLI_MAIN_ENTRY_NAMES.map((module) => [module, resolve(`src/main/${module}.ts`)])
+          )
         },
         // Why: Rolldown's SSR default is ESM, but Electron and sidecar launchers
         // consume these stable CommonJS paths.
diff --git a/mobile/app/h/[hostId]/edit.tsx b/mobile/app/h/[hostId]/edit.tsx
index af15f28ad200..90e9bc6c1671 100644
--- a/mobile/app/h/[hostId]/edit.tsx
+++ b/mobile/app/h/[hostId]/edit.tsx
@@ -17,15 +17,16 @@ import { colors, radii, spacing, typography } from '../../../src/theme/mobile-th
 import { loadHosts, updateHostNameAndEndpoint } from '../../../src/transport/host-store'
 import { displayHostEndpoint } from '../../../src/transport/host-endpoint'
 import { resolveHostEndpointEdit } from '../../../src/transport/host-endpoint-edit'
-import { useForceReconnect, usePrimeHosts } from '../../../src/transport/client-context'
+import { usePrimeHosts, useRefreshHostClient } from '../../../src/transport/client-context'
 import type { HostProfile } from '../../../src/transport/types'
+import { hostOs } from '../../../src/platform/host-os'
 
 export default function EditHostScreen() {
   const router = useRouter()
   const insets = useSafeAreaInsets()
   const { hostId } = useLocalSearchParams<{ hostId: string }>()
   const primeHosts = usePrimeHosts()
-  const forceReconnectHost = useForceReconnect()
+  const refreshHostClient = useRefreshHostClient()
 
   const [host, setHost] = useState<HostProfile | null>(null)
   const [loadError, setLoadError] = useState<string | null>(null)
@@ -130,10 +131,8 @@ export default function EditHostScreen() {
     router.back()
 
     if (nextEndpoint !== undefined) {
-      // Why: reconnect is a follow-on side effect of a save that already
-      // committed — its failure or a hang must not be reported as a save
-      // failure or block navigating back.
-      void forceReconnectHost?.(host.id).catch(() => {})
+      // Why: the live client, even one riding the relay, and its primed profile hold the old address.
+      refreshHostClient(host.id)
     }
   }
 
@@ -181,7 +180,7 @@ export default function EditHostScreen() {
       ) : (
         <KeyboardAvoidingView
           style={styles.flex}
-          behavior={Platform.OS === 'ios' ? 'padding' : undefined}
+          behavior={hostOs() === 'ios' ? 'padding' : undefined}
         >
           <ScrollView
             contentContainerStyle={[styles.form, { paddingBottom: insets.bottom + spacing.xl }]}
diff --git a/mobile/modules/orca-mobile-web-shell/ios/MobileWebShellKeyboardAccessory.swift b/mobile/modules/orca-mobile-web-shell/ios/MobileWebShellKeyboardAccessory.swift
new file mode 100644
index 000000000000..43de70947b0a
--- /dev/null
+++ b/mobile/modules/orca-mobile-web-shell/ios/MobileWebShellKeyboardAccessory.swift
@@ -0,0 +1,50 @@
+import ObjectiveC
+import UIKit
+import WebKit
+
+/// Removes WKWebView's form accessory bar (up, down, done). Native screens have none, and the
+/// keyboard event the shell publishes counts it, so the page lifted by the bar as well. WebKit
+/// exposes no switch, so the content view is moved onto a subclass whose `inputAccessoryView` is
+/// nil, the same technique react-native-webview's `hideKeyboardAccessoryView` uses.
+func hideKeyboardAccessoryBar(of webView: WKWebView) {
+  guard
+    let content = webView.scrollView.subviews.first(where: {
+      String(describing: type(of: $0)).hasPrefix("WKContent")
+    })
+  else {
+    return
+  }
+  let base: AnyClass = type(of: content)
+  let name = "\(NSStringFromClass(base))_OrcaNoAccessory"
+  let subclass: AnyClass
+  if let existing = NSClassFromString(name) {
+    subclass = existing
+  } else {
+    guard let created = objc_allocateClassPair(base, name, 0) else {
+      return
+    }
+    let noAccessory: @convention(block) (AnyObject) -> UIView? = { _ in nil }
+    let selector = #selector(getter: UIResponder.inputAccessoryView)
+    let typeEncoding = method_getTypeEncoding(class_getInstanceMethod(UIResponder.self, selector)!)
+    class_addMethod(created, selector, imp_implementationWithBlock(noAccessory), typeEncoding)
+    objc_registerClassPair(created)
+    subclass = created
+  }
+  object_setClass(content, subclass)
+}
+
+/// Stops WKWebView reacting to the keyboard itself. It listens for the keyboard's frame and scrolls
+/// the document to reveal the focused field, on top of the lift the page already applies from the
+/// height the shell sends, so the page moved twice. The shell's own listeners are unaffected.
+func ignoreKeyboardNotifications(in webView: WKWebView) {
+  for name in [
+    UIResponder.keyboardWillShowNotification,
+    UIResponder.keyboardDidShowNotification,
+    UIResponder.keyboardWillHideNotification,
+    UIResponder.keyboardDidHideNotification,
+    UIResponder.keyboardWillChangeFrameNotification,
+    UIResponder.keyboardDidChangeFrameNotification
+  ] {
+    NotificationCenter.default.removeObserver(webView, name: name, object: nil)
+  }
+}
diff --git a/mobile/modules/orca-mobile-web-shell/ios/MobileWebShellView.swift b/mobile/modules/orca-mobile-web-shell/ios/MobileWebShellView.swift
index 0a2122f8183a..abf9e7a70ede 100644
--- a/mobile/modules/orca-mobile-web-shell/ios/MobileWebShellView.swift
+++ b/mobile/modules/orca-mobile-web-shell/ios/MobileWebShellView.swift
@@ -221,6 +221,8 @@ final class OrcaMobileWebShellView: ExpoView, WKNavigationDelegate, WKUIDelegate
     webView.backgroundColor = .clear
     webView.scrollView.backgroundColor = .clear
     webView.scrollView.contentInsetAdjustmentBehavior = .never
+    hideKeyboardAccessoryBar(of: webView)
+    ignoreKeyboardNotifications(in: webView)
     webView.translatesAutoresizingMaskIntoConstraints = false
     addSubview(webView)
     NSLayoutConstraint.activate([
diff --git a/mobile/package.json b/mobile/package.json
index cd0d5df409e3..13724e1c57af 100644
--- a/mobile/package.json
+++ b/mobile/package.json
@@ -49,7 +49,7 @@
     "expo-splash-screen": "^55.0.25",
     "expo-status-bar": "^55.0.6",
     "expo-task-manager": "~55.0.20",
-    "fflate": "0.8.2",
+    "fflate": "0.8.3",
     "lowlight": "^3.3.0",
     "lucide-react-native": "^1.14.0",
     "mermaid": "11.17.2",
@@ -60,27 +60,27 @@
     "react-native-reanimated": "4.3.4",
     "react-native-safe-area-context": "^5.7.0",
     "react-native-screens": "^4.24.0",
-    "react-native-svg": "^15.15.4",
+    "react-native-svg": "^15.15.5",
     "react-native-uitextview": "2.2.0",
     "react-native-web": "^0.21.2",
     "react-native-webview": "13.16.2",
     "react-native-worklets": "^0.8.3",
     "tweetnacl": "^1.0.3",
     "ws": "^8.21.3",
-    "zod": "~4.4.3",
-    "zustand": "^5.0.13"
+    "zod": "~4.6.5",
+    "zustand": "^5.0.15"
   },
   "devDependencies": {
     "@types/react": "^19.2.14",
     "@types/react-native": "^0.73.0",
     "@types/react-test-renderer": "19.1.0",
     "@types/ws": "^8.18.1",
-    "acorn": "8.15.0",
+    "acorn": "8.18.0",
     "esbuild": "0.25.4",
     "expo-module-scripts": "^55.0.2",
     "happy-dom": "^20.11.8",
-    "oxfmt": "^0.65.0",
-    "oxlint": "^1.80.0",
+    "oxfmt": "^0.70.0",
+    "oxlint": "^1.85.0",
     "react-test-renderer": "19.2.8",
     "tsx": "^4.22.4",
     "typescript": "6.0.3",
diff --git a/mobile/pnpm-lock.yaml b/mobile/pnpm-lock.yaml
index c9834eec8921..f55a633e3f65 100644
--- a/mobile/pnpm-lock.yaml
+++ b/mobile/pnpm-lock.yaml
@@ -100,7 +100,7 @@ importers:
         version: 55.0.27(patch_hash=ce20843a3daad4185d7e8571788fa323ba4d11984936188790858650a61749c0)(expo@55.0.30)(react-native@0.83.10(patch_hash=44876634a8efbb0f2c3f66cd4332be170ec821d1cbfc0264ac80680983e8513d)(@babel/core@7.29.7)(@react-native/metro-config@0.85.2(@babel/core@7.29.7))(@types/react@19.2.14)(react@19.2.8))(react@19.2.8)(typescript@6.0.3)
       expo-router:
         specifier: ^55.0.18
-        version: 55.0.18(a23394d2f99d0f32345ec3f01a246fbf)
+        version: 55.0.18(05d3bd5bc5f5a85f046d39988db35c3c)
       expo-secure-store:
         specifier: ^55.0.18
         version: 55.0.18(expo@55.0.30)
@@ -114,14 +114,14 @@ importers:
         specifier: ~55.0.20
         version: 55.0.20(expo@55.0.30)(react-native@0.83.10(patch_hash=44876634a8efbb0f2c3f66cd4332be170ec821d1cbfc0264ac80680983e8513d)(@babel/core@7.29.7)(@react-native/metro-config@0.85.2(@babel/core@7.29.7))(@types/react@19.2.14)(react@19.2.8))
       fflate:
-        specifier: 0.8.2
-        version: 0.8.2
+        specifier: 0.8.3
+        version: 0.8.3
       lowlight:
         specifier: ^3.3.0
         version: 3.3.0
       lucide-react-native:
         specifier: ^1.14.0
-        version: 1.14.0(react-native-svg@15.15.4(react-native@0.83.10(patch_hash=44876634a8efbb0f2c3f66cd4332be170ec821d1cbfc0264ac80680983e8513d)(@babel/core@7.29.7)(@react-native/metro-config@0.85.2(@babel/core@7.29.7))(@types/react@19.2.14)(react@19.2.8))(react@19.2.8))(react-native@0.83.10(patch_hash=44876634a8efbb0f2c3f66cd4332be170ec821d1cbfc0264ac80680983e8513d)(@babel/core@7.29.7)(@react-native/metro-config@0.85.2(@babel/core@7.29.7))(@types/react@19.2.14)(react@19.2.8))(react@19.2.8)
+        version: 1.14.0(react-native-svg@15.15.5(react-native@0.83.10(patch_hash=44876634a8efbb0f2c3f66cd4332be170ec821d1cbfc0264ac80680983e8513d)(@babel/core@7.29.7)(@react-native/metro-config@0.85.2(@babel/core@7.29.7))(@types/react@19.2.14)(react@19.2.8))(react@19.2.8))(react-native@0.83.10(patch_hash=44876634a8efbb0f2c3f66cd4332be170ec821d1cbfc0264ac80680983e8513d)(@babel/core@7.29.7)(@react-native/metro-config@0.85.2(@babel/core@7.29.7))(@types/react@19.2.14)(react@19.2.8))(react@19.2.8)
       mermaid:
         specifier: 11.17.2
         version: 11.17.2
@@ -147,8 +147,8 @@ importers:
         specifier: ^4.24.0
         version: 4.24.0(react-native@0.83.10(patch_hash=44876634a8efbb0f2c3f66cd4332be170ec821d1cbfc0264ac80680983e8513d)(@babel/core@7.29.7)(@react-native/metro-config@0.85.2(@babel/core@7.29.7))(@types/react@19.2.14)(react@19.2.8))(react@19.2.8)
       react-native-svg:
-        specifier: ^15.15.4
-        version: 15.15.4(react-native@0.83.10(patch_hash=44876634a8efbb0f2c3f66cd4332be170ec821d1cbfc0264ac80680983e8513d)(@babel/core@7.29.7)(@react-native/metro-config@0.85.2(@babel/core@7.29.7))(@types/react@19.2.14)(react@19.2.8))(react@19.2.8)
+        specifier: ^15.15.5
+        version: 15.15.5(react-native@0.83.10(patch_hash=44876634a8efbb0f2c3f66cd4332be170ec821d1cbfc0264ac80680983e8513d)(@babel/core@7.29.7)(@react-native/metro-config@0.85.2(@babel/core@7.29.7))(@types/react@19.2.14)(react@19.2.8))(react@19.2.8)
       react-native-uitextview:
         specifier: 2.2.0
         version: 2.2.0(react-native@0.83.10(patch_hash=44876634a8efbb0f2c3f66cd4332be170ec821d1cbfc0264ac80680983e8513d)(@babel/core@7.29.7)(@react-native/metro-config@0.85.2(@babel/core@7.29.7))(@types/react@19.2.14)(react@19.2.8))(react@19.2.8)
@@ -168,11 +168,11 @@ importers:
         specifier: ^8.21.3
         version: 8.21.3
       zod:
-        specifier: ~4.4.3
-        version: 4.4.3
+        specifier: ~4.6.5
+        version: 4.6.5
       zustand:
-        specifier: ^5.0.13
-        version: 5.0.13(@types/react@19.2.14)(react@19.2.8)(use-sync-external-store@1.6.0(react@19.2.8))
+        specifier: ^5.0.15
+        version: 5.0.15(@types/react@19.2.14)(react@19.2.8)(use-sync-external-store@1.6.0(react@19.2.8))
     devDependencies:
       '@types/react':
         specifier: ^19.2.14
@@ -187,23 +187,23 @@ importers:
         specifier: ^8.18.1
         version: 8.18.1
       acorn:
-        specifier: 8.15.0
-        version: 8.15.0
+        specifier: 8.18.0
+        version: 8.18.0
       esbuild:
         specifier: 0.25.4
         version: 0.25.4
       expo-module-scripts:
         specifier: ^55.0.2
-        version: 55.0.2(@babel/core@7.29.7)(@babel/runtime@7.29.7)(@jest/types@29.6.3)(babel-jest@29.7.0(@babel/core@7.29.7))(esbuild@0.25.4)(eslint@9.39.4)(expo@55.0.30)(jest@29.7.0(@types/node@26.5.1))(prettier@2.8.8)(react-native@0.83.10(patch_hash=44876634a8efbb0f2c3f66cd4332be170ec821d1cbfc0264ac80680983e8513d)(@babel/core@7.29.7)(@react-native/metro-config@0.85.2(@babel/core@7.29.7))(@types/react@19.2.14)(react@19.2.8))(react-refresh@0.14.2)(react-test-renderer@19.2.8(react@19.2.8))(react@19.2.8)
+        version: 55.0.2(@babel/core@7.29.7)(@babel/runtime@7.29.7)(@jest/types@29.6.3)(babel-jest@29.7.0(@babel/core@7.29.7))(esbuild@0.25.4)(eslint@9.39.4)(expo@55.0.30)(jest@29.7.0(@types/node@26.6.2))(prettier@2.8.8)(react-native@0.83.10(patch_hash=44876634a8efbb0f2c3f66cd4332be170ec821d1cbfc0264ac80680983e8513d)(@babel/core@7.29.7)(@react-native/metro-config@0.85.2(@babel/core@7.29.7))(@types/react@19.2.14)(react@19.2.8))(react-refresh@0.14.2)(react-test-renderer@19.2.8(react@19.2.8))(react@19.2.8)
       happy-dom:
         specifier: ^20.11.8
         version: 20.11.8
       oxfmt:
-        specifier: ^0.65.0
-        version: 0.65.0
+        specifier: ^0.70.0
+        version: 0.70.0
       oxlint:
-        specifier: ^1.80.0
-        version: 1.80.0
+        specifier: ^1.85.0
+        version: 1.85.0
       react-test-renderer:
         specifier: 19.2.8
         version: 19.2.8(react@19.2.8)
@@ -215,10 +215,10 @@ importers:
         version: 6.0.3
       vite:
         specifier: ^8.0.16
-        version: 8.1.0(@types/node@26.5.1)(esbuild@0.25.4)(terser@5.51.2)(tsx@4.22.4)(yaml@2.9.1)
+        version: 8.1.0(@types/node@26.6.2)(esbuild@0.25.4)(terser@5.51.2)(tsx@4.22.4)(yaml@2.9.1)
       vitest:
         specifier: ^4.1.11
-        version: 4.1.11(@types/node@26.5.1)(happy-dom@20.11.8)(jsdom@20.0.3)(vite@8.1.0(@types/node@26.5.1)(esbuild@0.25.4)(terser@5.51.2)(tsx@4.22.4)(yaml@2.9.1))
+        version: 4.1.11(@types/node@26.6.2)(happy-dom@20.11.8)(jsdom@20.0.3)(vite@8.1.0(@types/node@26.6.2)(esbuild@0.25.4)(terser@5.51.2)(tsx@4.22.4)(yaml@2.9.1))
 
 packages:
 
@@ -451,6 +451,11 @@ packages:
     engines: {node: '>=6.0.0'}
     hasBin: true
 
+  '@babel/parser@7.29.9':
+    resolution: {integrity: sha512-CjXrNHTnvqBVqHgdBysY3vk2T8tpJHb5/RMeHJBTyVa9xgugCB0CJTx/3oO8RV2QRQP391RWpB7D6hLjm8V9uA==}
+    engines: {node: '>=6.0.0'}
+    hasBin: true
+
   '@babel/plugin-bugfix-firefox-class-in-computed-class-key@7.28.5':
     resolution: {integrity: sha512-87GDMS3tsmMSi/3bWOte1UblL+YUTFMV8SZPZ2eSEL17s74Cw/l63rR6NmGVKMYW2GYi85nE+/d6Hw5N0bEk2Q==}
     engines: {node: '>=6.9.0'}
@@ -1129,6 +1134,12 @@ packages:
     peerDependencies:
       '@babel/core': ^7.0.0-0
 
+  '@babel/plugin-transform-typescript@7.29.9':
+    resolution: {integrity: sha512-FFwIwzU+7SCOuxxV4YtJql6T9981ZVTm+FHO5GhVsRqCTdy0WwrEZh3l42ARpXruJUDGOptdduHW6Zr7pNPLNg==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
   '@babel/plugin-transform-unicode-escapes@7.27.1':
     resolution: {integrity: sha512-Ysg4v6AmF26k9vpfFuTZg8HRfVWzsh1kVfowA23y9j/Gu6dOuahdUVhkLqpObp3JIv27MLSii6noRnuKN8H0Mg==}
     engines: {node: '>=6.9.0'}
@@ -1968,246 +1979,246 @@ packages:
   '@oxc-project/types@0.137.0':
     resolution: {integrity: sha512-WT+Gb24i8hmvo85AIv2oEYouEXkRlKAlT9WaCa3TfLgNCN+GhrJOGZuIlMouAh38Qe4QOx26eUOVsq70qXrywA==}
 
-  '@oxfmt/binding-android-arm-eabi@0.65.0':
-    resolution: {integrity: sha512-M10Gs1SSpTNI6ahGx3M/OlIdUF4hkaP6OgUb+MS79t/Pgflk3r1nW5gPFqsZGUAXg0H1AfANT9AvLdBSTIhZKg==}
+  '@oxfmt/binding-android-arm-eabi@0.70.0':
+    resolution: {integrity: sha512-Xd7YO4/T2axEj6FTLcj4Why3mTBqFMg+x24xtorT4Lb2+1g82090GH0a/4U1m0pABGYiix2bq1pqkYrmV3f0Sw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm]
     os: [android]
 
-  '@oxfmt/binding-android-arm64@0.65.0':
-    resolution: {integrity: sha512-6DXH5sftNlaHpWJG50hFMF+Qxtq5D2TmahvcDPxWNcGIf8qrC9Y0YgHYcYZ2hlWzaccKXh/f3GcssH8vtkl4JA==}
+  '@oxfmt/binding-android-arm64@0.70.0':
+    resolution: {integrity: sha512-x9rlMYyKXdgKdYyUJzGsK1ZV8P4di/J32ipzcS6Jet6p9r9UAh28neXIMtdlSaJJycdi61Z4YkcLKLpk8ueFjg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [android]
 
-  '@oxfmt/binding-darwin-arm64@0.65.0':
-    resolution: {integrity: sha512-K9m7lr53pcOLETNsC88sWes/GWHUGjZyHx95UhYcSXy0r30haLdeXlSufSenEAtoLaW753WN8/l4M7GYcRt6cg==}
+  '@oxfmt/binding-darwin-arm64@0.70.0':
+    resolution: {integrity: sha512-IUTUPvrBVYy7POh4stXzRdz4IVC/1QSaviCWoyenSlOhGu0X9j5K07vCTM9biLjAA2Zs31l0Rj5vvRpj9n95wA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [darwin]
 
-  '@oxfmt/binding-darwin-x64@0.65.0':
-    resolution: {integrity: sha512-sTNwIx1gre3MyiHOPLu7IGW4UyMScYL4DTmJT01p4vzB0En+OJUQz6KuH8t0PpsClRSaMuY3b0QmtoPItfO8Lg==}
+  '@oxfmt/binding-darwin-x64@0.70.0':
+    resolution: {integrity: sha512-vw745q870oTd6J517O24asoX4/E+eK0nxYIFoedSLqgJ+nI5En7+ZS82iZSHZ69zevQrnOXiyHP01dA+t8xD8w==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [darwin]
 
-  '@oxfmt/binding-freebsd-x64@0.65.0':
-    resolution: {integrity: sha512-lYZMVIiIpnjGu5hJb2jxA8NYQ/e0OTGuaiAf4dqlGPNnPmUTu23FZRMltmjro/KkQm1uE4NT4n5yJ2zWmKcpfA==}
+  '@oxfmt/binding-freebsd-x64@0.70.0':
+    resolution: {integrity: sha512-NO14EgSM9dFkcg+MfGPxvsKqXYs9LKaxPrOKXpv1R0rLokGGFDcCq6dBMq18dE4wlpFOovX0UZY2uh1P30O7QA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [freebsd]
 
-  '@oxfmt/binding-linux-arm-gnueabihf@0.65.0':
-    resolution: {integrity: sha512-gIdXFAt/bURnjxuoedDEWdZ0PEWEmdDcm8qdpoFYYvW3QMk/5D4vUaH4mlMeRpeTdST4izUgHVO6RawQ4QulJw==}
+  '@oxfmt/binding-linux-arm-gnueabihf@0.70.0':
+    resolution: {integrity: sha512-139OEhHarj9CYoJ/i9gXlPv4KLBGtLj2toseOWYFf09QwlhklaZk+wW3aOvlqoeZtuayvkoSNVWra7WJ21s3VQ==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm]
     os: [linux]
 
-  '@oxfmt/binding-linux-arm-musleabihf@0.65.0':
-    resolution: {integrity: sha512-jJVyADto7gA2AaX5qAjAexrxx9PJQaKWOe8PICE7yKMbjBRyOHcmj9TtVJ+MZYDUQ3hodU0AcoTj0jFQ1W4C6Q==}
+  '@oxfmt/binding-linux-arm-musleabihf@0.70.0':
+    resolution: {integrity: sha512-GEh2PY3IWTE0M24eNhTduountANSbWyDmMnzFSQE/nGg/bjPugbUgiGuFu+xdqcQSd/HKSwH80/F2yVVD48yhA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm]
     os: [linux]
 
-  '@oxfmt/binding-linux-arm64-gnu@0.65.0':
-    resolution: {integrity: sha512-p3RFkB+u7u+8up99b/NEcI1hdpLDiGgJYNwDorB60n7eH+eKposAKuMBxx+NqB3b+sJP4CZmYDh9G7X62tUsKg==}
+  '@oxfmt/binding-linux-arm64-gnu@0.70.0':
+    resolution: {integrity: sha512-En5i+UJmZSPxuSf47F2Hl5YOzKB0bicQLnGQkeTCMQ35cWLtbrSwACJKfiLqRZrk05DwSnsJkhBRaM3OURtIaA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [linux]
     libc: [glibc]
 
-  '@oxfmt/binding-linux-arm64-musl@0.65.0':
-    resolution: {integrity: sha512-5Prb0uFzJHr+OUD/qS/TmU526wD+PaHDsm3KoRiUXbMIDpTSErjeQYkK3OQeshAvD/PuLa9WGEi9WPajjdOZJg==}
+  '@oxfmt/binding-linux-arm64-musl@0.70.0':
+    resolution: {integrity: sha512-WWOoV5W9Im3flVwOVrWn/2DUlOF8v5vcCip+kcNuaMpulRCh6nzzt1Su2vcL2F908YJIXNV3HvegbBHuyLwKHg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [linux]
     libc: [musl]
 
-  '@oxfmt/binding-linux-ppc64-gnu@0.65.0':
-    resolution: {integrity: sha512-S8svxTp81obnF3admN9yd+u2rOYXtyzThLGBTg1PY6TPtGcC09BaaXLQD+TBSMa7yvqhCDZ8DFri+S/yG60qCg==}
+  '@oxfmt/binding-linux-ppc64-gnu@0.70.0':
+    resolution: {integrity: sha512-YUouneIqW+5n7aE8xx/zeZ6/utr/KH7oykcGoFyd8Uz8uh591T1oKlnoWA3BsRq/ZR42oY1w4MUYvS/0e/MQOA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [ppc64]
     os: [linux]
     libc: [glibc]
 
-  '@oxfmt/binding-linux-riscv64-gnu@0.65.0':
-    resolution: {integrity: sha512-WtXBr75G/h2qOHy8SiGtC1R6aS3jt4mE52v1D8AtwMXIgoOmSNP9lKvbSaTRoL0e5wsMPoi6T72QWDYPu+S+nA==}
+  '@oxfmt/binding-linux-riscv64-gnu@0.70.0':
+    resolution: {integrity: sha512-iEnMf21S5aGVa4hViDGY8sAQ/AHyCu2JPyrQF8P06wtHhSkD1YJBeT4m/KiGewgf7+a5XCYSCRIPcRQa1xwEoQ==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [riscv64]
     os: [linux]
     libc: [glibc]
 
-  '@oxfmt/binding-linux-riscv64-musl@0.65.0':
-    resolution: {integrity: sha512-YwSLVvpaz4o/nv/miiPEBJz+eJ+VmbgNIrao6RccK9ce+L5EA8wP+ZD0uFeq6wKOza6zoWv/dR0sj6lip6R3EA==}
+  '@oxfmt/binding-linux-riscv64-musl@0.70.0':
+    resolution: {integrity: sha512-91Sdniaj20fQzyMeCxMDzTP4c9s4RB8dGQ308xHhDR0n6U7+1Xq7N9klE7mfXq8iV3lRmIGSXi5X23Hn/0XX/g==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [riscv64]
     os: [linux]
     libc: [musl]
 
-  '@oxfmt/binding-linux-s390x-gnu@0.65.0':
-    resolution: {integrity: sha512-XQTPqgvyrgkKcFq+Tp2eK6JS7sqqJ+nRmy2Fav4j3I+i4dJoPJm7YwEdoeSDX9xkqj9jZ/lWfF3bXUWztIrn6A==}
+  '@oxfmt/binding-linux-s390x-gnu@0.70.0':
+    resolution: {integrity: sha512-uUV30M6E+2TKKGMaKiwfeL4RZrviHXlUxsrYJ/jFBb+1EZy+pnFT+hF73eeWdzh5NqPOAnw0iiMAIqjqiLZPFg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [s390x]
     os: [linux]
     libc: [glibc]
 
-  '@oxfmt/binding-linux-x64-gnu@0.65.0':
-    resolution: {integrity: sha512-cjZlx6S/VkeCNWCbwZriTnLnZeTcV3DEyeRGSw/2wwLP9viq+C0bJ4bC1k/ZLkFxDcB1lUgSasPkYGP1bdraOg==}
+  '@oxfmt/binding-linux-x64-gnu@0.70.0':
+    resolution: {integrity: sha512-ivMcX6kNDPhqtbOaBt/ItFlLlTlXNHLgRuNmxP6Na6UuYXRT10llpJcAPbGeRgjjb3Qzv4jwPp3fB0hui50WNQ==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [linux]
     libc: [glibc]
 
-  '@oxfmt/binding-linux-x64-musl@0.65.0':
-    resolution: {integrity: sha512-2azCjxdLtK4zCcIOU1dlXlU0xxfbPi6EjwWx7Ac7teWPidIIDOcIhudup83xNCKYhtqeVd/gaVDOxbUq4syXWA==}
+  '@oxfmt/binding-linux-x64-musl@0.70.0':
+    resolution: {integrity: sha512-w+S+fERxYmlZSyZlJK/U292FjyBoH8cCEj21/tYJX6atX5kNSn+HDkhlFQKT2zcMwUW0uAtUL/bOrlwJZwqRdA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [linux]
     libc: [musl]
 
-  '@oxfmt/binding-openharmony-arm64@0.65.0':
-    resolution: {integrity: sha512-KXQ7xi1e/voP0IQaw6fG6XY4Z5+Llf1XmRSZS1t7pVFCecFJ0iXaboKmVwjFtp5MLlT5iWQrJ2U1C3GJdZ2u+Q==}
+  '@oxfmt/binding-openharmony-arm64@0.70.0':
+    resolution: {integrity: sha512-Zlom1Xkx257R8bk4ZI4zJsrGno2opknz1+5v5baka3nn4FPyvNSdh8JUL4CdN1S1OWRMvJ9UJQ+RfIqGGCUEfA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [openharmony]
 
-  '@oxfmt/binding-win32-arm64-msvc@0.65.0':
-    resolution: {integrity: sha512-2FbbjG5jEqLSLKVJwBap84uJfpn5Y5A53KEO0aUNr+zeiRB9nyPUIFMcSbZVMFLitfBytFWRNngozXYjb6Rsbw==}
+  '@oxfmt/binding-win32-arm64-msvc@0.70.0':
+    resolution: {integrity: sha512-FQgPW5R17vzt7cgrJ8eG/dqX00o2xHsqFeLfw4xzA9FRHpN/DjFo9YDonvIIXGxiEuS9F/jZPnGO+KHNKuCo4Q==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [win32]
 
-  '@oxfmt/binding-win32-ia32-msvc@0.65.0':
-    resolution: {integrity: sha512-LJ+ZacAPSjegDOnSLyA1TMWAhdDrsK4el3REdr1oL2UtVBCMhO2II/Sb3cEW6mF2MfLhl8hDNCSvc7KSbgk3LQ==}
+  '@oxfmt/binding-win32-ia32-msvc@0.70.0':
+    resolution: {integrity: sha512-ZfZublNhZ+XBndMiXhkiLlPE+XyGRDa0CweeTL6t1fZypfCh1LTg7e5CvnOeTBunq15MskOcRempumSPGAaCQA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [ia32]
     os: [win32]
 
-  '@oxfmt/binding-win32-x64-msvc@0.65.0':
-    resolution: {integrity: sha512-higu9cWEO6XXFzATD1jf0mCK34rNfN2H9JrJie7QB1IhleVpTh0QlLH9Ip2C1H/Nd5n0v5pvRtC+5R0uE4HpVg==}
+  '@oxfmt/binding-win32-x64-msvc@0.70.0':
+    resolution: {integrity: sha512-HlIZEn+WzLQL0DszNzldiRl/DPRCX5R0Vkt6qeUPR1YHwy52hZZo4x6HoTOVmKRP2wUiwPGtKsihNY/f8KRaBg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [win32]
 
-  '@oxlint/binding-android-arm-eabi@1.80.0':
-    resolution: {integrity: sha512-RM3Plj+biQpxa5d1GOOX6ciDlcUROmm4OZ/pLTpitkQt2mJv4jhtY4cbgaetOm5UKWZe05/TGQ6o1Vl8EOHkrA==}
+  '@oxlint/binding-android-arm-eabi@1.85.0':
+    resolution: {integrity: sha512-q2KO/Zso9UT+OMn0NF9ywn4E4t0MI3yxiDhNyhsQ7DyQJrC4FhFE4TXOi4bktFnOWXTMds8qZSbpv2XwRaNOBg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm]
     os: [android]
 
-  '@oxlint/binding-android-arm64@1.80.0':
-    resolution: {integrity: sha512-YlO5JEf0Yr2bUUlu8O8daVcUxtcGGbcSmyV7E7nSbJbfAdxTE0PFPwgnIlw7wXJaTYjb+qs5hI5q3jxUkI7cAw==}
+  '@oxlint/binding-android-arm64@1.85.0':
+    resolution: {integrity: sha512-SxLN3ALjoT9NNdvpjEevGeHvfzTAFrF0NBYB5tzK7/GtCKMze3j1e/m/X2ozqGj2U9hfGG/dg/OG8vpVK4PiDA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [android]
 
-  '@oxlint/binding-darwin-arm64@1.80.0':
-    resolution: {integrity: sha512-BULDOyO3AhsmdWfQeIUCykDt3dd7XZBGLhp1eIh56skRv01O+cNjNPwXMIbeW1x4+pxcln5if72wcRgViVo7PA==}
+  '@oxlint/binding-darwin-arm64@1.85.0':
+    resolution: {integrity: sha512-Y/Sup/J4f0f9UGsSd/xyCNTeWL+gepO63GBdEDAfue9nBsnk9zMmnIXx1O6b1V8C90vB5nucYNZ0pbMXAp8zJA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [darwin]
 
-  '@oxlint/binding-darwin-x64@1.80.0':
-    resolution: {integrity: sha512-YJ4JzLw7N5TDSQFlA0hAQGHvnDZgyypm1yunObVWcWiF9KM7eGCJKYKLgTC2Fi/57OdnBhbj4OkzPGdFQJ6HyA==}
+  '@oxlint/binding-darwin-x64@1.85.0':
+    resolution: {integrity: sha512-ApOSNC04ynpDTwvBD+//0wyfODRSbEzvRoKpX8teffmc27z8AockwSNeMXGJXn5KP85eahDgR/2llICWLkzcnw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [darwin]
 
-  '@oxlint/binding-freebsd-x64@1.80.0':
-    resolution: {integrity: sha512-AYUIk5QnL0s8oWAYsREZwkRYy1SupJTXALo93J1TgzHywxQtdM99FecRMQ87MXEdPQ0j1TmEpeeq3fGNkpvMqg==}
+  '@oxlint/binding-freebsd-x64@1.85.0':
+    resolution: {integrity: sha512-bNrVrCOA/kHky3Tu79IXWXe5bhIgLXfUuUEDHlAGOHUk96MkvDZ1ecaQF19rwstrnaqfP1o9nBTqzIr9+ZHkUg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [freebsd]
 
-  '@oxlint/binding-linux-arm-gnueabihf@1.80.0':
-    resolution: {integrity: sha512-9hBZVANupQ89W9dXyE0n8doCyaW5pDyGn3y6XlIMPZ+rIKuyqkr3SNUXmVJIhuvUq0NBU3RBiSXXE69l4XI6KA==}
+  '@oxlint/binding-linux-arm-gnueabihf@1.85.0':
+    resolution: {integrity: sha512-NUrzOJ1s/EqsVvfn2L/1D8Wro2LPIZUbihL8kOJLh5fEdGEN3rdOGUYq3HwnUIL8sjpoP+4N6RaGrgmMJnaMPw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm]
     os: [linux]
 
-  '@oxlint/binding-linux-arm-musleabihf@1.80.0':
-    resolution: {integrity: sha512-SvS2uKqzY+pbfuvAHzH4338R6Zwo805GAwrIMVvK1KxoOWCIjZUdfzTCvilD7z6JK91v011+zYMryabhDo2AsQ==}
+  '@oxlint/binding-linux-arm-musleabihf@1.85.0':
+    resolution: {integrity: sha512-UJXrAT3E/RWkEqXLIs2ehETja1qfgkPb+5gwLIIS+o/6cf+grHvoOXTa5997a/YNQfcJS0DRBTOfZt95cvOI1g==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm]
     os: [linux]
 
-  '@oxlint/binding-linux-arm64-gnu@1.80.0':
-    resolution: {integrity: sha512-tCLadyqRVL3pQTRPNg7cjXKvcvS4fbyXeQHhKk5BTJ1oftQln5/yIIWbu/Xom/DX41zv2P9QGt6+D/TtQVtY3A==}
+  '@oxlint/binding-linux-arm64-gnu@1.85.0':
+    resolution: {integrity: sha512-lK40QLjI0HxigO7CjDDshEtfYIeiYS0020v5BHFPqN4uuQBQxd2K9LNom2dW15o9F1937quSCRVp4ZsVhdbYdg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [linux]
     libc: [glibc]
 
-  '@oxlint/binding-linux-arm64-musl@1.80.0':
-    resolution: {integrity: sha512-XfpCNRlOPcLlJl4Bn/FUhjqlR6BVavEykERBf/MV7YA9VZDa5g5znVqYhyviMafcxS9Pe/i/kPvHNO0U6svEHQ==}
+  '@oxlint/binding-linux-arm64-musl@1.85.0':
+    resolution: {integrity: sha512-c2zbdBwGKreHXwRx3gWBuFGJxLhxgsg6YlZ+3H+RgRusU/UEV9jNwJ3HGYK+nRo0LvBa7mt6Kj86xoVotUo8cw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [linux]
     libc: [musl]
 
-  '@oxlint/binding-linux-ppc64-gnu@1.80.0':
-    resolution: {integrity: sha512-3I4yMwcFG9NeO8ioY6JBBuKsIm5GL/x7MATt1S4tVWaxPu5HcJ+XnLUbcVBTxG8q2Wu56HSj+NmXQiVYb1lp6A==}
+  '@oxlint/binding-linux-ppc64-gnu@1.85.0':
+    resolution: {integrity: sha512-tlt/Hy8lZ97/lCPmCgw/B3k/mwh+BzaIPbPkldZEly7TwLmx0xe2CQcaW2g/rR0dOgS9JNGCZsMEqLhUNMGvaw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [ppc64]
     os: [linux]
     libc: [glibc]
 
-  '@oxlint/binding-linux-riscv64-gnu@1.80.0':
-    resolution: {integrity: sha512-E1wAKymkpe1/E8helzBKdm81OBOF+ezxRyXRMEuik3ZpWDER5CPOKZwF66RsdwW98uwZv8UTFremUQtC1CzdJA==}
+  '@oxlint/binding-linux-riscv64-gnu@1.85.0':
+    resolution: {integrity: sha512-3tNR9Xey82X0zKuY1d8hJ6Rc9gwRDurmqGLnQZa5xqOXy8/YyiqFXjAtugkKLY82obOlpK1eSiDRlgcNPuxtIg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [riscv64]
     os: [linux]
     libc: [glibc]
 
-  '@oxlint/binding-linux-riscv64-musl@1.80.0':
-    resolution: {integrity: sha512-+gLRGD4sIo3+VA++iham5UxD9tKSoJ/VOrROCEXIcknrYtQg6iIQgvjN0cpiRF7N6UYC7pJbvHJlDnMge5LRpQ==}
+  '@oxlint/binding-linux-riscv64-musl@1.85.0':
+    resolution: {integrity: sha512-wbGRd5PqCcjkJFHhZuZ2OBSUQY9czlQsoA/cQQB9JK/L9mC5MQgGoKAh+xd8QjA5V+0D3j+Qd1lAWn1I8zlelA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [riscv64]
     os: [linux]
     libc: [musl]
 
-  '@oxlint/binding-linux-s390x-gnu@1.80.0':
-    resolution: {integrity: sha512-aR0PrzHj9leW3NmzBAAP4EzdoBNoJcs9sjnIQPIwyRnBGYrRbXUIpEB5Q39AqK3PLY5JK5uEhDQDiUa1QSAstw==}
+  '@oxlint/binding-linux-s390x-gnu@1.85.0':
+    resolution: {integrity: sha512-3Sn0kSrE4DPZCWV/8o+n4x3aFZxI9ulMnkYlwCbJ8eUVkwRK2IerohE/A/z3SNbCwoPFOCJmGE5Avrq0rrvdvQ==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [s390x]
     os: [linux]
     libc: [glibc]
 
-  '@oxlint/binding-linux-x64-gnu@1.80.0':
-    resolution: {integrity: sha512-vSVh5cSo3Xxs6ghBCcFJlpbkbENzDog1qXtoXLa/HC3aCrR4XO76GZbXmQoCPHnu99nQpdCeC3H9tdNICfDh7A==}
+  '@oxlint/binding-linux-x64-gnu@1.85.0':
+    resolution: {integrity: sha512-JY2pxxYfB62bAGfejljVCqc44etItehPuAyaeSAdMuEMtwNA00ggMnS66lC1oIhos6oOXUkuU6mZ9bpFh3BqWg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [linux]
     libc: [glibc]
 
-  '@oxlint/binding-linux-x64-musl@1.80.0':
-    resolution: {integrity: sha512-FfzBXpNQ8u7/ZI/p8bl73MeZ508Ax3hxWp3SiJpEFiC+BB9XcXy5FAZHTLKDPSzrUpxQZSZJAVdDmuJp/+HDBQ==}
+  '@oxlint/binding-linux-x64-musl@1.85.0':
+    resolution: {integrity: sha512-5k74vZ6qJBjBHEOlBk9B/iv68Yu0F1Afw/vvT2ar6OGCqEeXLaSjXz2n/IPCbhLG22UoKoYEJTzpYraRdcp6PA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [linux]
     libc: [musl]
 
-  '@oxlint/binding-openharmony-arm64@1.80.0':
-    resolution: {integrity: sha512-zMzbkumtmprCgRwoYNzcB3iC39fXdJIMLMU33KdCjEGLlJGOEt1+LwQ4LF8ndLzAEKVz4BR0y3V6Xrkk3Nm3yA==}
+  '@oxlint/binding-openharmony-arm64@1.85.0':
+    resolution: {integrity: sha512-GbAl5qt5TCkPLXTaIISZJnugrcBhra6rodcXc9jYt620UtdsTt71NlNmJmm0frxzFpd54x/G+MkitEJA8I/BoA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [openharmony]
 
-  '@oxlint/binding-win32-arm64-msvc@1.80.0':
-    resolution: {integrity: sha512-ib6iRcrXsk4t1fm3iKcwksyWh1ZkZXC/2mEzakl0ai2+6HZunf1WWMZ/xP9EJAvw9g9K4UVTC3NF/+G2qLrbTQ==}
+  '@oxlint/binding-win32-arm64-msvc@1.85.0':
+    resolution: {integrity: sha512-kjmws5MK0et2swk4ND85D7NVQyDHw162i6whtZDLUA/lo6FQyBZDcmMRCMcVZcNrAhIaftVb00x9ChGDOjjNJA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [win32]
 
-  '@oxlint/binding-win32-ia32-msvc@1.80.0':
-    resolution: {integrity: sha512-xhRWBMpLxZvgKAH6+DJZmpP+W8Y8UdQOSU1JfxSWNXsaBaRGW77j+1hCuNHlzj7OH4SPN8fYd1q0o2qrDtoVyw==}
+  '@oxlint/binding-win32-ia32-msvc@1.85.0':
+    resolution: {integrity: sha512-eSsIJx9n4yxvOqYTZyPEMyEXRmE60XH7xGAU7i0Qbsn1lf6Za3CWJ9aRd82oSFKXaxhp+sA6/yMJVRIpLpna6A==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [ia32]
     os: [win32]
 
-  '@oxlint/binding-win32-x64-msvc@1.80.0':
-    resolution: {integrity: sha512-yAnO7lwBYQnz2pcfBPIGQQZWIX5zd5R/1aAKIF3oE+TVj7IhoHcROjOkz3sRDngzqhfPKfFaXqug5j5rE5dn6Q==}
+  '@oxlint/binding-win32-x64-msvc@1.85.0':
+    resolution: {integrity: sha512-pBebIPUpKKhWrhSMWhy8TdAZBewiXnfxmaAGxhzxM1068GagqFaTwgKlU6e+UyJ2sPR+VoHouhXuGJkQjsrDvA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [win32]
@@ -2899,14 +2910,8 @@ packages:
   '@types/node@25.6.0':
     resolution: {integrity: sha512-+qIYRKdNYJwY3vRCZMdJbPLJAtGjQBudzZzdzwQYkEPQd+PJGixUL5QfvCLDaULoLv+RhT3LDkwEfKaAkgSmNQ==}
 
-  '@types/node@26.1.1':
-    resolution: {integrity: sha512-nxAkRSVkN1Y0JC1W8ky/fTfkGsMmcrRsbx+3XoZE+rMOX71kLYTV7fLXpqud1GpbpP5TuffXFqfX7fH2GgZREw==}
-
-  '@types/node@26.1.2':
-    resolution: {integrity: sha512-Vu4a5UFA9rIIFJ7rB/Vaafh9lrCQszopTCx6KjFboXTGQbPNasehVR5TEiithSDGyd1DEiUByggTZsg8jukeIg==}
-
-  '@types/node@26.5.1':
-    resolution: {integrity: sha512-CzNm2FezW4VR/LjG6yUdiEgLE/rAQ9Slj5gCu/C2VrdcW7I0ahNZ8DRbHT7zOZ6r3ONgd/bsQIeSaoDGrd1C6g==}
+  '@types/node@26.6.2':
+    resolution: {integrity: sha512-X1P21scMv4zGKLYqjdGjaKa7COa0RKVYYZZN/NfvLQ1JegxFhdhpZG/Lyn8AXx6CDUavKAd11v6BvfpkDByK8g==}
 
   '@types/react-native@0.73.0':
     resolution: {integrity: sha512-6ZRPQrYM72qYKGWidEttRe6M5DZBEV5F+MHMHqd4TTYx0tfkcdrUFGdef6CCxY0jXU7wldvd/zA/b0A/kTeJmA==}
@@ -3132,8 +3137,8 @@ packages:
     resolution: {integrity: sha512-HEHNfbars9v4pgpW6SO1KSPkfoS0xVOM/9UzkJltjlsHZmJasxg8aXkuZa7SMf8vKGIBhpUsPluQSqhJFCqebw==}
     engines: {node: '>=0.4.0'}
 
-  acorn@8.15.0:
-    resolution: {integrity: sha512-NZyJarBfL7nWwIq+FDL6Zp/yHEhePMNnnJ0y3qfieCrmNvYct8uvtiV41UvlSe6apAfk0fY1FbWx+NwfmpvtTg==}
+  acorn@8.18.0:
+    resolution: {integrity: sha512-lGq+9yr1/GuAWaVYIHRjvvySG5/4VfKIvC8EWxStPdcDh/Ka7FG3twP6v4d5BkravUilhIAsG4Qj83t02LWUPQ==}
     engines: {node: '>=0.4.0'}
     hasBin: true
 
@@ -4564,8 +4569,8 @@ packages:
   fetch-nodeshim@0.4.10:
     resolution: {integrity: sha512-m6I8ALe4L4XpdETy7MJZWs6L1IVMbjs99bwbpIKphxX+0CTns4IKDWJY0LWfr4YsFjfg+z1TjzTMU8lKl8rG0w==}
 
-  fflate@0.8.2:
-    resolution: {integrity: sha512-cPJU47OaAoCbg0pBvzsgpTPhmhqI5eJjh/JIu8tPj5q+T7iLvW/JAYUqmE7KOB4R1ZyEhzBaIQpQpardBF5z8A==}
+  fflate@0.8.3:
+    resolution: {integrity: sha512-tbZNuJrLwGUp3zshBtdy4W+ORxZuIh8a5ilyIEQDC5rY1f3U20JMry0Ll3WBzU58EZKsEuJFXhb5gwv8CsPvgA==}
 
   file-entry-cache@8.0.0:
     resolution: {integrity: sha512-XXTUwCvisa5oacNGRP9SfNtYBNAMi+RPwBFmblZEF7N7swHYQS6/Zfk7SRwx4D5j3CH211YNRco1DEMNVfZCnQ==}
@@ -5831,8 +5836,8 @@ packages:
     resolution: {integrity: sha512-qFOyK5PjiWZd+QQIh+1jhdb9LpxTF0qs7Pm8o5QHYZ0M3vKqSqzsZaEB6oWlxZ+q2sJBMI/Ktgd2N5ZwQoRHfg==}
     engines: {node: '>= 0.4'}
 
-  oxfmt@0.65.0:
-    resolution: {integrity: sha512-SgS5VgnP42T0zl3zWD+xoH8FCqg1SAFnSRoOT/qeoa6gxcYIqrDMOmcXIg/EWSN92Du4ogB4riuKhKd6Y4CGhw==}
+  oxfmt@0.70.0:
+    resolution: {integrity: sha512-IsHxZ4y0wQLLMhnrJblBJgZsLDzfULrJnAw5j/QqsTlMa/m3AqsbToi+W71uhBGaqlqq/PbbjvHc09TJwdv3Tw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     hasBin: true
     peerDependencies:
@@ -5844,8 +5849,8 @@ packages:
       vite-plus:
         optional: true
 
-  oxlint@1.80.0:
-    resolution: {integrity: sha512-5nTiSps4qdbCWLbxzuO00alHkEO2exR9YMN/ig6QXWrLsYSG0KaObOAM+l6oU2LcKPWoSAGYbkZIGEu1ViiWKA==}
+  oxlint@1.85.0:
+    resolution: {integrity: sha512-bc26s97nuvPj1ViyPsqmKecVkUWFMEdtayO8MaQ6oiLfs1pj94cQlZZhrh4BPNlr9HQosjhIlwgZKsfcwmcNgg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     hasBin: true
     peerDependencies:
@@ -6095,8 +6100,8 @@ packages:
       react: '*'
       react-native: '*'
 
-  react-native-svg@15.15.4:
-    resolution: {integrity: sha512-boT/vIRgj6zZKBpfTPJJiYWMbZE9duBMOwPK6kCSTgxsS947IFMOq9OgIFkpWZTB7t229H24pDRkh3W9ZK/J1A==}
+  react-native-svg@15.15.5:
+    resolution: {integrity: sha512-L4go5jA+GWutdJ/JucuN20cjAbMg1HmMtAP+wZ+3JLCf6Jd0bhXQHxciRP/AQm/FlrIEZwkMcHNZP+FXAiic0w==}
     peerDependencies:
       react: '*'
       react-native: '*'
@@ -6653,8 +6658,8 @@ packages:
     resolution: {integrity: sha512-wXR/dYpcqKmfWpEdZjiKJOwCNFndD0DMnrW/cYjVGttEkBfVgcLFHoNrlj47mjOVic9yyNu65alsgF4NQyTa2g==}
     engines: {node: '>=12.0.0'}
 
-  tinypool@2.1.0:
-    resolution: {integrity: sha512-Pugqs6M0m7Lv1I7FtxN4aoyToKg1C4tu+/381vH35y8oENM/Ai7f7C4StcoK4/+BSw9ebcS8jRiVrORFKCALLw==}
+  tinypool@2.1.2:
+    resolution: {integrity: sha512-9YodfrxS9g9IbFr/KOjE5bAeJ0p61n3bW6mqvy0jtoeKd1kTW1Cxm0oulm6KX2lyM9Gl6WIe8nEbY7LWv5ZJww==}
     engines: {node: ^20.0.0 || >=22.0.0}
 
   tinyrainbow@3.1.0:
@@ -6793,9 +6798,6 @@ packages:
   undici-types@7.19.2:
     resolution: {integrity: sha512-qYVnV5OEm2AW8cJMCpdV20CDyaN3g0AjDlOGf1OW4iaDEx8MwdtChUp4zu4H0VP3nDRF/8RKWH+IPp9uW0YGZg==}
 
-  undici-types@8.3.0:
-    resolution: {integrity: sha512-j375ScV60dom+YkPFIfTLcOiPxkN/buHz5GobjLhixFuANaNs3C9l4GmrWqejgXWJ7BbJcFYpTEUkS1Ge8bpZQ==}
-
   undici-types@8.9.0:
     resolution: {integrity: sha512-KTDyRTYX8sWmKXAikPHHSyc63CRPETMctyjKFupcC6OBLXT3xsN0e9aF7m+mIXutFWpUXuedtowG7iLOzp0kQg==}
 
@@ -7147,11 +7149,11 @@ packages:
   zod@3.25.76:
     resolution: {integrity: sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ==}
 
-  zod@4.4.3:
-    resolution: {integrity: sha512-ytENFjIJFl2UwYglde2jchW2Hwm4GJFLDiSXWdTrJQBIN9Fcyp7n4DhxJEiWNAJMV1/BqWfW/kkg71UDcHJyTQ==}
+  zod@4.6.5:
+    resolution: {integrity: sha512-v5l/aFXZQeai4awLbOpSoHecE9UiMrnfx75tEXLjNonXVARxQ5mOeipTjROUchszUNCqnE+hqAMujRsRHsut2Q==}
 
-  zustand@5.0.13:
-    resolution: {integrity: sha512-efI2tVaVQPqtOh114loML/Z80Y4NP3yc+Ff0fYiZJPauNeWZeIp/bRFD7I9bfmCOYBh/PHxlglQ9+wvlwnPikQ==}
+  zustand@5.0.15:
+    resolution: {integrity: sha512-MpSEjRiBkA9crSYeOUH32rJC7SVqAbm0Fqcqge/bUi2PPoLcBWKOsG+C8mevmpr8TwXHBVkChbbJiyvkE+i/3A==}
     engines: {node: '>=12.20.0'}
     peerDependencies:
       '@types/react': '>=18.0.0'
@@ -7497,6 +7499,10 @@ snapshots:
     dependencies:
       '@babel/types': 7.29.8
 
+  '@babel/parser@7.29.9':
+    dependencies:
+      '@babel/types': 7.29.8
+
   '@babel/plugin-bugfix-firefox-class-in-computed-class-key@7.28.5(@babel/core@7.29.7)':
     dependencies:
       '@babel/core': 7.29.7
@@ -8245,6 +8251,17 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
+  '@babel/plugin-transform-typescript@7.29.9(@babel/core@7.29.7)':
+    dependencies:
+      '@babel/core': 7.29.7
+      '@babel/helper-annotate-as-pure': 7.29.7
+      '@babel/helper-create-class-features-plugin': 7.29.7(@babel/core@7.29.7)
+      '@babel/helper-plugin-utils': 7.29.7
+      '@babel/helper-skip-transparent-expression-wrappers': 7.29.7
+      '@babel/plugin-syntax-typescript': 7.29.7(@babel/core@7.29.7)
+    transitivePeerDependencies:
+      - supports-color
+
   '@babel/plugin-transform-unicode-escapes@7.27.1(@babel/core@7.29.7)':
     dependencies:
       '@babel/core': 7.29.7
@@ -8742,7 +8759,7 @@ snapshots:
       ws: 8.21.3
       zod: 3.25.76
     optionalDependencies:
-      expo-router: 55.0.18(a23394d2f99d0f32345ec3f01a246fbf)
+      expo-router: 55.0.18(05d3bd5bc5f5a85f046d39988db35c3c)
       react-native: 0.83.10(patch_hash=44876634a8efbb0f2c3f66cd4332be170ec821d1cbfc0264ac80680983e8513d)(@babel/core@7.29.7)(@react-native/metro-config@0.85.2(@babel/core@7.29.7))(@types/react@19.2.14)(react@19.2.8)
     transitivePeerDependencies:
       - '@expo/dom-webview'
@@ -9076,7 +9093,7 @@ snapshots:
       react: 19.2.8
     optionalDependencies:
       '@expo/metro-runtime': 55.0.12(@expo/dom-webview@55.0.6)(expo@55.0.30)(react-dom@19.2.8(react@19.2.8))(react-native@0.83.10(patch_hash=44876634a8efbb0f2c3f66cd4332be170ec821d1cbfc0264ac80680983e8513d)(@babel/core@7.29.7)(@react-native/metro-config@0.85.2(@babel/core@7.29.7))(@types/react@19.2.14)(react@19.2.8))(react@19.2.8)
-      expo-router: 55.0.18(a23394d2f99d0f32345ec3f01a246fbf)
+      expo-router: 55.0.18(05d3bd5bc5f5a85f046d39988db35c3c)
       react-dom: 19.2.8(react@19.2.8)
     transitivePeerDependencies:
       - supports-color
@@ -9148,7 +9165,7 @@ snapshots:
   '@jest/console@29.7.0':
     dependencies:
       '@jest/types': 29.6.3
-      '@types/node': 26.1.1
+      '@types/node': 26.6.2
       chalk: 4.1.2
       jest-message-util: 29.7.0
       jest-util: 29.7.0
@@ -9161,14 +9178,14 @@ snapshots:
       '@jest/test-result': 29.7.0
       '@jest/transform': 29.7.0
       '@jest/types': 29.6.3
-      '@types/node': 26.5.1
+      '@types/node': 26.6.2
       ansi-escapes: 4.3.2
       chalk: 4.1.2
       ci-info: 3.9.0
       exit: 0.1.2
       graceful-fs: 4.2.11
       jest-changed-files: 29.7.0
-      jest-config: 29.7.0(@types/node@26.5.1)
+      jest-config: 29.7.0(@types/node@26.6.2)
       jest-haste-map: 29.7.0
       jest-message-util: 29.7.0
       jest-regex-util: 29.6.3
@@ -9199,7 +9216,7 @@ snapshots:
     dependencies:
       '@jest/fake-timers': 29.7.0
       '@jest/types': 29.6.3
-      '@types/node': 25.6.0
+      '@types/node': 26.6.2
       jest-mock: 29.7.0
 
   '@jest/expect-utils@29.7.0':
@@ -9217,7 +9234,7 @@ snapshots:
     dependencies:
       '@jest/types': 29.6.3
       '@sinonjs/fake-timers': 10.3.0
-      '@types/node': 25.6.0
+      '@types/node': 26.6.2
       jest-message-util: 29.7.0
       jest-mock: 29.7.0
       jest-util: 29.7.0
@@ -9241,7 +9258,7 @@ snapshots:
       '@jest/transform': 29.7.0
       '@jest/types': 29.6.3
       '@jridgewell/trace-mapping': 0.3.31
-      '@types/node': 26.5.1
+      '@types/node': 26.6.2
       chalk: 4.1.2
       collect-v8-coverage: 1.0.3
       exit: 0.1.2
@@ -9315,7 +9332,7 @@ snapshots:
       '@jest/schemas': 29.6.3
       '@types/istanbul-lib-coverage': 2.0.6
       '@types/istanbul-reports': 3.0.4
-      '@types/node': 26.1.1
+      '@types/node': 26.6.2
       '@types/yargs': 17.0.35
       chalk: 4.1.2
 
@@ -9367,118 +9384,118 @@ snapshots:
 
   '@oxc-project/types@0.137.0': {}
 
-  '@oxfmt/binding-android-arm-eabi@0.65.0':
+  '@oxfmt/binding-android-arm-eabi@0.70.0':
     optional: true
 
-  '@oxfmt/binding-android-arm64@0.65.0':
+  '@oxfmt/binding-android-arm64@0.70.0':
     optional: true
 
-  '@oxfmt/binding-darwin-arm64@0.65.0':
+  '@oxfmt/binding-darwin-arm64@0.70.0':
     optional: true
 
-  '@oxfmt/binding-darwin-x64@0.65.0':
+  '@oxfmt/binding-darwin-x64@0.70.0':
     optional: true
 
-  '@oxfmt/binding-freebsd-x64@0.65.0':
+  '@oxfmt/binding-freebsd-x64@0.70.0':
     optional: true
 
-  '@oxfmt/binding-linux-arm-gnueabihf@0.65.0':
+  '@oxfmt/binding-linux-arm-gnueabihf@0.70.0':
     optional: true
 
-  '@oxfmt/binding-linux-arm-musleabihf@0.65.0':
+  '@oxfmt/binding-linux-arm-musleabihf@0.70.0':
     optional: true
 
-  '@oxfmt/binding-linux-arm64-gnu@0.65.0':
+  '@oxfmt/binding-linux-arm64-gnu@0.70.0':
     optional: true
 
-  '@oxfmt/binding-linux-arm64-musl@0.65.0':
+  '@oxfmt/binding-linux-arm64-musl@0.70.0':
     optional: true
 
-  '@oxfmt/binding-linux-ppc64-gnu@0.65.0':
+  '@oxfmt/binding-linux-ppc64-gnu@0.70.0':
     optional: true
 
-  '@oxfmt/binding-linux-riscv64-gnu@0.65.0':
+  '@oxfmt/binding-linux-riscv64-gnu@0.70.0':
     optional: true
 
-  '@oxfmt/binding-linux-riscv64-musl@0.65.0':
+  '@oxfmt/binding-linux-riscv64-musl@0.70.0':
     optional: true
 
-  '@oxfmt/binding-linux-s390x-gnu@0.65.0':
+  '@oxfmt/binding-linux-s390x-gnu@0.70.0':
     optional: true
 
-  '@oxfmt/binding-linux-x64-gnu@0.65.0':
+  '@oxfmt/binding-linux-x64-gnu@0.70.0':
     optional: true
 
-  '@oxfmt/binding-linux-x64-musl@0.65.0':
+  '@oxfmt/binding-linux-x64-musl@0.70.0':
     optional: true
 
-  '@oxfmt/binding-openharmony-arm64@0.65.0':
+  '@oxfmt/binding-openharmony-arm64@0.70.0':
     optional: true
 
-  '@oxfmt/binding-win32-arm64-msvc@0.65.0':
+  '@oxfmt/binding-win32-arm64-msvc@0.70.0':
     optional: true
 
-  '@oxfmt/binding-win32-ia32-msvc@0.65.0':
+  '@oxfmt/binding-win32-ia32-msvc@0.70.0':
     optional: true
 
-  '@oxfmt/binding-win32-x64-msvc@0.65.0':
+  '@oxfmt/binding-win32-x64-msvc@0.70.0':
     optional: true
 
-  '@oxlint/binding-android-arm-eabi@1.80.0':
+  '@oxlint/binding-android-arm-eabi@1.85.0':
     optional: true
 
-  '@oxlint/binding-android-arm64@1.80.0':
+  '@oxlint/binding-android-arm64@1.85.0':
     optional: true
 
-  '@oxlint/binding-darwin-arm64@1.80.0':
+  '@oxlint/binding-darwin-arm64@1.85.0':
     optional: true
 
-  '@oxlint/binding-darwin-x64@1.80.0':
+  '@oxlint/binding-darwin-x64@1.85.0':
     optional: true
 
-  '@oxlint/binding-freebsd-x64@1.80.0':
+  '@oxlint/binding-freebsd-x64@1.85.0':
     optional: true
 
-  '@oxlint/binding-linux-arm-gnueabihf@1.80.0':
+  '@oxlint/binding-linux-arm-gnueabihf@1.85.0':
     optional: true
 
-  '@oxlint/binding-linux-arm-musleabihf@1.80.0':
+  '@oxlint/binding-linux-arm-musleabihf@1.85.0':
     optional: true
 
-  '@oxlint/binding-linux-arm64-gnu@1.80.0':
+  '@oxlint/binding-linux-arm64-gnu@1.85.0':
     optional: true
 
-  '@oxlint/binding-linux-arm64-musl@1.80.0':
+  '@oxlint/binding-linux-arm64-musl@1.85.0':
     optional: true
 
-  '@oxlint/binding-linux-ppc64-gnu@1.80.0':
+  '@oxlint/binding-linux-ppc64-gnu@1.85.0':
     optional: true
 
-  '@oxlint/binding-linux-riscv64-gnu@1.80.0':
+  '@oxlint/binding-linux-riscv64-gnu@1.85.0':
     optional: true
 
-  '@oxlint/binding-linux-riscv64-musl@1.80.0':
+  '@oxlint/binding-linux-riscv64-musl@1.85.0':
     optional: true
 
-  '@oxlint/binding-linux-s390x-gnu@1.80.0':
+  '@oxlint/binding-linux-s390x-gnu@1.85.0':
     optional: true
 
-  '@oxlint/binding-linux-x64-gnu@1.80.0':
+  '@oxlint/binding-linux-x64-gnu@1.85.0':
     optional: true
 
-  '@oxlint/binding-linux-x64-musl@1.80.0':
+  '@oxlint/binding-linux-x64-musl@1.85.0':
     optional: true
 
-  '@oxlint/binding-openharmony-arm64@1.80.0':
+  '@oxlint/binding-openharmony-arm64@1.85.0':
     optional: true
 
-  '@oxlint/binding-win32-arm64-msvc@1.80.0':
+  '@oxlint/binding-win32-arm64-msvc@1.85.0':
     optional: true
 
-  '@oxlint/binding-win32-ia32-msvc@1.80.0':
+  '@oxlint/binding-win32-ia32-msvc@1.85.0':
     optional: true
 
-  '@oxlint/binding-win32-x64-msvc@1.80.0':
+  '@oxlint/binding-win32-x64-msvc@1.85.0':
     optional: true
 
   '@pkgr/core@0.2.9': {}
@@ -9835,7 +9852,7 @@ snapshots:
       '@babel/plugin-transform-react-jsx-source': 7.29.7(@babel/core@7.29.7)
       '@babel/plugin-transform-regenerator': 7.29.8(@babel/core@7.29.7)
       '@babel/plugin-transform-runtime': 7.29.7(@babel/core@7.29.7)
-      '@babel/plugin-transform-typescript': 7.29.7(@babel/core@7.29.7)
+      '@babel/plugin-transform-typescript': 7.29.9(@babel/core@7.29.7)
       '@babel/plugin-transform-unicode-regex': 7.29.7(@babel/core@7.29.7)
       '@react-native/babel-plugin-codegen': 0.85.2(@babel/core@7.29.7)
       babel-plugin-syntax-hermes-parser: 0.33.3
@@ -9867,7 +9884,7 @@ snapshots:
   '@react-native/codegen@0.85.2(@babel/core@7.29.7)':
     dependencies:
       '@babel/core': 7.29.7
-      '@babel/parser': 7.29.8
+      '@babel/parser': 7.29.9
       hermes-parser: 0.33.3
       invariant: 2.2.4
       nullthrows: 1.1.1
@@ -10086,7 +10103,7 @@ snapshots:
 
   '@standard-schema/spec@1.1.0': {}
 
-  '@testing-library/react-native@13.3.3(jest@29.7.0(@types/node@26.5.1))(react-native@0.83.10(patch_hash=44876634a8efbb0f2c3f66cd4332be170ec821d1cbfc0264ac80680983e8513d)(@babel/core@7.29.7)(@react-native/metro-config@0.85.2(@babel/core@7.29.7))(@types/react@19.2.14)(react@19.2.8))(react-test-renderer@19.2.8(react@19.2.8))(react@19.2.8)':
+  '@testing-library/react-native@13.3.3(jest@29.7.0(@types/node@26.6.2))(react-native@0.83.10(patch_hash=44876634a8efbb0f2c3f66cd4332be170ec821d1cbfc0264ac80680983e8513d)(@babel/core@7.29.7)(@react-native/metro-config@0.85.2(@babel/core@7.29.7))(@types/react@19.2.14)(react@19.2.8))(react-test-renderer@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
       jest-matcher-utils: 30.3.0
       picocolors: 1.1.1
@@ -10096,7 +10113,7 @@ snapshots:
       react-test-renderer: 19.2.8(react@19.2.8)
       redent: 3.0.0
     optionalDependencies:
-      jest: 29.7.0(@types/node@26.5.1)
+      jest: 29.7.0(@types/node@26.6.2)
 
   '@tootallnate/once@2.0.1': {}
 
@@ -10260,7 +10277,7 @@ snapshots:
 
   '@types/graceful-fs@4.1.9':
     dependencies:
-      '@types/node': 26.1.1
+      '@types/node': 26.6.2
 
   '@types/hammerjs@2.0.46': {}
 
@@ -10285,7 +10302,7 @@ snapshots:
 
   '@types/jsdom@20.0.1':
     dependencies:
-      '@types/node': 25.6.0
+      '@types/node': 26.6.2
       '@types/tough-cookie': 4.0.5
       parse5: 7.3.0
 
@@ -10297,15 +10314,7 @@ snapshots:
     dependencies:
       undici-types: 7.19.2
 
-  '@types/node@26.1.1':
-    dependencies:
-      undici-types: 8.3.0
-
-  '@types/node@26.1.2':
-    dependencies:
-      undici-types: 8.3.0
-
-  '@types/node@26.5.1':
+  '@types/node@26.6.2':
     dependencies:
       undici-types: 8.9.0
 
@@ -10489,13 +10498,13 @@ snapshots:
       chai: 6.2.2
       tinyrainbow: 3.1.0
 
-  '@vitest/mocker@4.1.11(vite@8.1.0(@types/node@26.5.1)(esbuild@0.25.4)(terser@5.51.2)(tsx@4.22.4)(yaml@2.9.1))':
+  '@vitest/mocker@4.1.11(vite@8.1.0(@types/node@26.6.2)(esbuild@0.25.4)(terser@5.51.2)(tsx@4.22.4)(yaml@2.9.1))':
     dependencies:
       '@vitest/spy': 4.1.11
       estree-walker: 3.0.3
       magic-string: 0.30.21
     optionalDependencies:
-      vite: 8.1.0(@types/node@26.5.1)(esbuild@0.25.4)(terser@5.51.2)(tsx@4.22.4)(yaml@2.9.1)
+      vite: 8.1.0(@types/node@26.6.2)(esbuild@0.25.4)(terser@5.51.2)(tsx@4.22.4)(yaml@2.9.1)
 
   '@vitest/pretty-format@4.1.11':
     dependencies:
@@ -10553,18 +10562,18 @@ snapshots:
 
   acorn-globals@7.0.1:
     dependencies:
-      acorn: 8.15.0
+      acorn: 8.18.0
       acorn-walk: 8.3.5
 
-  acorn-jsx@5.3.2(acorn@8.15.0):
+  acorn-jsx@5.3.2(acorn@8.18.0):
     dependencies:
-      acorn: 8.15.0
+      acorn: 8.18.0
 
   acorn-walk@8.3.5:
     dependencies:
-      acorn: 8.15.0
+      acorn: 8.18.0
 
-  acorn@8.15.0: {}
+  acorn@8.18.0: {}
 
   agent-base@6.0.2:
     dependencies:
@@ -10956,7 +10965,7 @@ snapshots:
 
   buffer-image-size@0.6.4:
     dependencies:
-      '@types/node': 26.1.2
+      '@types/node': 26.6.2
 
   buffer@6.0.3:
     dependencies:
@@ -11027,7 +11036,7 @@ snapshots:
 
   chrome-launcher@0.15.2:
     dependencies:
-      '@types/node': 26.1.2
+      '@types/node': 26.6.2
       escape-string-regexp: 4.0.0
       is-wsl: 2.2.0
       lighthouse-logger: 1.4.2
@@ -11036,7 +11045,7 @@ snapshots:
 
   chromium-edge-launcher@0.2.0:
     dependencies:
-      '@types/node': 26.1.2
+      '@types/node': 26.6.2
       escape-string-regexp: 4.0.0
       is-wsl: 2.2.0
       lighthouse-logger: 1.4.2
@@ -11148,13 +11157,13 @@ snapshots:
     dependencies:
       layout-base: 2.0.1
 
-  create-jest@29.7.0(@types/node@26.5.1):
+  create-jest@29.7.0(@types/node@26.6.2):
     dependencies:
       '@jest/types': 29.6.3
       chalk: 4.1.2
       exit: 0.1.2
       graceful-fs: 4.2.11
-      jest-config: 29.7.0(@types/node@26.5.1)
+      jest-config: 29.7.0(@types/node@26.6.2)
       jest-util: 29.7.0
       prompts: 2.4.2
     transitivePeerDependencies:
@@ -11936,8 +11945,8 @@ snapshots:
 
   espree@10.4.0:
     dependencies:
-      acorn: 8.15.0
-      acorn-jsx: 5.3.2(acorn@8.15.0)
+      acorn: 8.18.0
+      acorn-jsx: 5.3.2(acorn@8.18.0)
       eslint-visitor-keys: 4.2.1
 
   esprima@4.0.1: {}
@@ -12133,7 +12142,7 @@ snapshots:
       expo: 55.0.30(e404b20c1cb2e50a7d80f2cede5c5264)
       expo-json-utils: 55.0.2
 
-  expo-module-scripts@55.0.2(@babel/core@7.29.7)(@babel/runtime@7.29.7)(@jest/types@29.6.3)(babel-jest@29.7.0(@babel/core@7.29.7))(esbuild@0.25.4)(eslint@9.39.4)(expo@55.0.30)(jest@29.7.0(@types/node@26.5.1))(prettier@2.8.8)(react-native@0.83.10(patch_hash=44876634a8efbb0f2c3f66cd4332be170ec821d1cbfc0264ac80680983e8513d)(@babel/core@7.29.7)(@react-native/metro-config@0.85.2(@babel/core@7.29.7))(@types/react@19.2.14)(react@19.2.8))(react-refresh@0.14.2)(react-test-renderer@19.2.8(react@19.2.8))(react@19.2.8):
+  expo-module-scripts@55.0.2(@babel/core@7.29.7)(@babel/runtime@7.29.7)(@jest/types@29.6.3)(babel-jest@29.7.0(@babel/core@7.29.7))(esbuild@0.25.4)(eslint@9.39.4)(expo@55.0.30)(jest@29.7.0(@types/node@26.6.2))(prettier@2.8.8)(react-native@0.83.10(patch_hash=44876634a8efbb0f2c3f66cd4332be170ec821d1cbfc0264ac80680983e8513d)(@babel/core@7.29.7)(@react-native/metro-config@0.85.2(@babel/core@7.29.7))(@types/react@19.2.14)(react@19.2.8))(react-refresh@0.14.2)(react-test-renderer@19.2.8(react@19.2.8))(react@19.2.8):
     dependencies:
       '@babel/cli': 7.28.6(@babel/core@7.29.7)
       '@babel/plugin-transform-export-namespace-from': 7.27.1(@babel/core@7.29.7)
@@ -12141,7 +12150,7 @@ snapshots:
       '@babel/preset-typescript': 7.28.5(@babel/core@7.29.7)
       '@expo/npm-proofread': 1.0.1
       '@expo/spawn-async': 1.7.2
-      '@testing-library/react-native': 13.3.3(jest@29.7.0(@types/node@26.5.1))(react-native@0.83.10(patch_hash=44876634a8efbb0f2c3f66cd4332be170ec821d1cbfc0264ac80680983e8513d)(@babel/core@7.29.7)(@react-native/metro-config@0.85.2(@babel/core@7.29.7))(@types/react@19.2.14)(react@19.2.8))(react-test-renderer@19.2.8(react@19.2.8))(react@19.2.8)
+      '@testing-library/react-native': 13.3.3(jest@29.7.0(@types/node@26.6.2))(react-native@0.83.10(patch_hash=44876634a8efbb0f2c3f66cd4332be170ec821d1cbfc0264ac80680983e8513d)(@babel/core@7.29.7)(@react-native/metro-config@0.85.2(@babel/core@7.29.7))(@types/react@19.2.14)(react@19.2.8))(react-test-renderer@19.2.8(react@19.2.8))(react@19.2.8)
       '@tsconfig/node18': 18.2.6
       '@types/jest': 29.5.14
       babel-plugin-dynamic-import-node: 2.3.3
@@ -12149,11 +12158,11 @@ snapshots:
       commander: 12.1.0
       eslint-config-universe: 15.0.4(eslint@9.39.4)(prettier@2.8.8)(typescript@5.9.3)
       glob: 13.0.6
-      jest-expo: 55.0.17(@babel/core@7.29.7)(expo@55.0.30)(jest@29.7.0(@types/node@26.5.1))(react-native@0.83.10(patch_hash=44876634a8efbb0f2c3f66cd4332be170ec821d1cbfc0264ac80680983e8513d)(@babel/core@7.29.7)(@react-native/metro-config@0.85.2(@babel/core@7.29.7))(@types/react@19.2.14)(react@19.2.8))(react@19.2.8)(typescript@5.9.3)
+      jest-expo: 55.0.17(@babel/core@7.29.7)(expo@55.0.30)(jest@29.7.0(@types/node@26.6.2))(react-native@0.83.10(patch_hash=44876634a8efbb0f2c3f66cd4332be170ec821d1cbfc0264ac80680983e8513d)(@babel/core@7.29.7)(@react-native/metro-config@0.85.2(@babel/core@7.29.7))(@types/react@19.2.14)(react@19.2.8))(react@19.2.8)(typescript@5.9.3)
       jest-snapshot-prettier: prettier@2.8.8
-      jest-watch-typeahead: 2.2.1(jest@29.7.0(@types/node@26.5.1))
+      jest-watch-typeahead: 2.2.1(jest@29.7.0(@types/node@26.6.2))
       resolve-workspace-root: 2.0.1
-      ts-jest: 29.0.5(@babel/core@7.29.7)(@jest/types@29.6.3)(babel-jest@29.7.0(@babel/core@7.29.7))(esbuild@0.25.4)(jest@29.7.0(@types/node@26.5.1))(typescript@5.9.3)
+      ts-jest: 29.0.5(@babel/core@7.29.7)(@jest/types@29.6.3)(babel-jest@29.7.0(@babel/core@7.29.7))(esbuild@0.25.4)(jest@29.7.0(@types/node@26.6.2))(typescript@5.9.3)
       typescript: 5.9.3
     transitivePeerDependencies:
       - '@babel/core'
@@ -12216,7 +12225,7 @@ snapshots:
       - supports-color
       - typescript
 
-  expo-router@55.0.18(a23394d2f99d0f32345ec3f01a246fbf):
+  expo-router@55.0.18(05d3bd5bc5f5a85f046d39988db35c3c):
     dependencies:
       '@expo/log-box': 55.0.13(@expo/dom-webview@55.0.6)(expo@55.0.30)(react-native@0.83.10(patch_hash=44876634a8efbb0f2c3f66cd4332be170ec821d1cbfc0264ac80680983e8513d)(@babel/core@7.29.7)(@react-native/metro-config@0.85.2(@babel/core@7.29.7))(@types/react@19.2.14)(react@19.2.8))(react@19.2.8)
       '@expo/metro-runtime': 55.0.12(@expo/dom-webview@55.0.6)(expo@55.0.30)(react-dom@19.2.8(react@19.2.8))(react-native@0.83.10(patch_hash=44876634a8efbb0f2c3f66cd4332be170ec821d1cbfc0264ac80680983e8513d)(@babel/core@7.29.7)(@react-native/metro-config@0.85.2(@babel/core@7.29.7))(@types/react@19.2.14)(react@19.2.8))(react@19.2.8)
@@ -12253,7 +12262,7 @@ snapshots:
       use-latest-callback: 0.2.6(react@19.2.8)
       vaul: 1.1.2(@types/react@19.2.14)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
     optionalDependencies:
-      '@testing-library/react-native': 13.3.3(jest@29.7.0(@types/node@26.5.1))(react-native@0.83.10(patch_hash=44876634a8efbb0f2c3f66cd4332be170ec821d1cbfc0264ac80680983e8513d)(@babel/core@7.29.7)(@react-native/metro-config@0.85.2(@babel/core@7.29.7))(@types/react@19.2.14)(react@19.2.8))(react-test-renderer@19.2.8(react@19.2.8))(react@19.2.8)
+      '@testing-library/react-native': 13.3.3(jest@29.7.0(@types/node@26.6.2))(react-native@0.83.10(patch_hash=44876634a8efbb0f2c3f66cd4332be170ec821d1cbfc0264ac80680983e8513d)(@babel/core@7.29.7)(@react-native/metro-config@0.85.2(@babel/core@7.29.7))(@types/react@19.2.14)(react@19.2.8))(react-test-renderer@19.2.8(react@19.2.8))(react@19.2.8)
       react-dom: 19.2.8(react@19.2.8)
       react-native-gesture-handler: 2.31.2(react-native@0.83.10(patch_hash=44876634a8efbb0f2c3f66cd4332be170ec821d1cbfc0264ac80680983e8513d)(@babel/core@7.29.7)(@react-native/metro-config@0.85.2(@babel/core@7.29.7))(@types/react@19.2.14)(react@19.2.8))(react@19.2.8)
       react-native-reanimated: 4.3.4(react-native-worklets@0.8.3(@babel/core@7.29.7)(@react-native/metro-config@0.85.2(@babel/core@7.29.7))(react-native@0.83.10(patch_hash=44876634a8efbb0f2c3f66cd4332be170ec821d1cbfc0264ac80680983e8513d)(@babel/core@7.29.7)(@react-native/metro-config@0.85.2(@babel/core@7.29.7))(@types/react@19.2.14)(react@19.2.8))(react@19.2.8))(react-native@0.83.10(patch_hash=44876634a8efbb0f2c3f66cd4332be170ec821d1cbfc0264ac80680983e8513d)(@babel/core@7.29.7)(@react-native/metro-config@0.85.2(@babel/core@7.29.7))(@types/react@19.2.14)(react@19.2.8))(react@19.2.8)
@@ -12387,7 +12396,7 @@ snapshots:
 
   fetch-nodeshim@0.4.10: {}
 
-  fflate@0.8.2: {}
+  fflate@0.8.3: {}
 
   file-entry-cache@8.0.0:
     dependencies:
@@ -12553,7 +12562,7 @@ snapshots:
 
   happy-dom@20.11.8:
     dependencies:
-      '@types/node': 26.1.2
+      '@types/node': 26.6.2
       '@types/whatwg-mimetype': 3.0.2
       '@types/ws': 8.18.1
       buffer-image-size: 0.6.4
@@ -12871,7 +12880,7 @@ snapshots:
   istanbul-lib-instrument@6.0.3:
     dependencies:
       '@babel/core': 7.29.7
-      '@babel/parser': 7.29.8
+      '@babel/parser': 7.29.9
       '@istanbuljs/schema': 0.1.6
       istanbul-lib-coverage: 3.2.2
       semver: 7.8.5
@@ -12918,7 +12927,7 @@ snapshots:
       '@jest/expect': 29.7.0
       '@jest/test-result': 29.7.0
       '@jest/types': 29.6.3
-      '@types/node': 26.5.1
+      '@types/node': 26.6.2
       chalk: 4.1.2
       co: 4.6.0
       dedent: 1.7.2
@@ -12938,16 +12947,16 @@ snapshots:
       - babel-plugin-macros
       - supports-color
 
-  jest-cli@29.7.0(@types/node@26.5.1):
+  jest-cli@29.7.0(@types/node@26.6.2):
     dependencies:
       '@jest/core': 29.7.0
       '@jest/test-result': 29.7.0
       '@jest/types': 29.6.3
       chalk: 4.1.2
-      create-jest: 29.7.0(@types/node@26.5.1)
+      create-jest: 29.7.0(@types/node@26.6.2)
       exit: 0.1.2
       import-local: 3.2.0
-      jest-config: 29.7.0(@types/node@26.5.1)
+      jest-config: 29.7.0(@types/node@26.6.2)
       jest-util: 29.7.0
       jest-validate: 29.7.0
       yargs: 17.7.3
@@ -12957,7 +12966,7 @@ snapshots:
       - supports-color
       - ts-node
 
-  jest-config@29.7.0(@types/node@26.5.1):
+  jest-config@29.7.0(@types/node@26.6.2):
     dependencies:
       '@babel/core': 7.29.7
       '@jest/test-sequencer': 29.7.0
@@ -12982,7 +12991,7 @@ snapshots:
       slash: 3.0.0
       strip-json-comments: 3.1.1
     optionalDependencies:
-      '@types/node': 26.5.1
+      '@types/node': 26.6.2
     transitivePeerDependencies:
       - babel-plugin-macros
       - supports-color
@@ -13019,7 +13028,7 @@ snapshots:
       '@jest/fake-timers': 29.7.0
       '@jest/types': 29.6.3
       '@types/jsdom': 20.0.1
-      '@types/node': 25.6.0
+      '@types/node': 26.6.2
       jest-mock: 29.7.0
       jest-util: 29.7.0
       jsdom: 20.0.3
@@ -13033,11 +13042,11 @@ snapshots:
       '@jest/environment': 29.7.0
       '@jest/fake-timers': 29.7.0
       '@jest/types': 29.6.3
-      '@types/node': 26.1.2
+      '@types/node': 26.6.2
       jest-mock: 29.7.0
       jest-util: 29.7.0
 
-  jest-expo@55.0.17(@babel/core@7.29.7)(expo@55.0.30)(jest@29.7.0(@types/node@26.5.1))(react-native@0.83.10(patch_hash=44876634a8efbb0f2c3f66cd4332be170ec821d1cbfc0264ac80680983e8513d)(@babel/core@7.29.7)(@react-native/metro-config@0.85.2(@babel/core@7.29.7))(@types/react@19.2.14)(react@19.2.8))(react@19.2.8)(typescript@5.9.3):
+  jest-expo@55.0.17(@babel/core@7.29.7)(expo@55.0.30)(jest@29.7.0(@types/node@26.6.2))(react-native@0.83.10(patch_hash=44876634a8efbb0f2c3f66cd4332be170ec821d1cbfc0264ac80680983e8513d)(@babel/core@7.29.7)(@react-native/metro-config@0.85.2(@babel/core@7.29.7))(@types/react@19.2.14)(react@19.2.8))(react@19.2.8)(typescript@5.9.3):
     dependencies:
       '@expo/config': 55.0.16(typescript@5.9.3)
       '@expo/json-file': 10.0.14
@@ -13048,7 +13057,7 @@ snapshots:
       jest-environment-jsdom: 29.7.0
       jest-snapshot: 29.7.0
       jest-watch-select-projects: 2.0.0
-      jest-watch-typeahead: 2.2.1(jest@29.7.0(@types/node@26.5.1))
+      jest-watch-typeahead: 2.2.1(jest@29.7.0(@types/node@26.6.2))
       json5: 2.2.3
       lodash: 4.18.1
       react-native: 0.83.10(patch_hash=44876634a8efbb0f2c3f66cd4332be170ec821d1cbfc0264ac80680983e8513d)(@babel/core@7.29.7)(@react-native/metro-config@0.85.2(@babel/core@7.29.7))(@types/react@19.2.14)(react@19.2.8)
@@ -13071,7 +13080,7 @@ snapshots:
     dependencies:
       '@jest/types': 29.6.3
       '@types/graceful-fs': 4.1.9
-      '@types/node': 26.1.1
+      '@types/node': 26.6.2
       anymatch: 3.1.3
       fb-watchman: 2.0.2
       graceful-fs: 4.2.11
@@ -13117,7 +13126,7 @@ snapshots:
   jest-mock@29.7.0:
     dependencies:
       '@jest/types': 29.6.3
-      '@types/node': 25.6.0
+      '@types/node': 26.6.2
       jest-util: 29.7.0
 
   jest-pnp-resolver@1.2.3(jest-resolve@29.7.0):
@@ -13152,7 +13161,7 @@ snapshots:
       '@jest/test-result': 29.7.0
       '@jest/transform': 29.7.0
       '@jest/types': 29.6.3
-      '@types/node': 26.5.1
+      '@types/node': 26.6.2
       chalk: 4.1.2
       emittery: 0.13.1
       graceful-fs: 4.2.11
@@ -13180,7 +13189,7 @@ snapshots:
       '@jest/test-result': 29.7.0
       '@jest/transform': 29.7.0
       '@jest/types': 29.6.3
-      '@types/node': 26.5.1
+      '@types/node': 26.6.2
       chalk: 4.1.2
       cjs-module-lexer: 1.4.3
       collect-v8-coverage: 1.0.3
@@ -13226,7 +13235,7 @@ snapshots:
   jest-util@29.7.0:
     dependencies:
       '@jest/types': 29.6.3
-      '@types/node': 26.1.1
+      '@types/node': 26.6.2
       chalk: 4.1.2
       ci-info: 3.9.0
       graceful-fs: 4.2.11
@@ -13247,11 +13256,11 @@ snapshots:
       chalk: 3.0.0
       prompts: 2.4.2
 
-  jest-watch-typeahead@2.2.1(jest@29.7.0(@types/node@26.5.1)):
+  jest-watch-typeahead@2.2.1(jest@29.7.0(@types/node@26.6.2)):
     dependencies:
       ansi-escapes: 6.2.1
       chalk: 4.1.2
-      jest: 29.7.0(@types/node@26.5.1)
+      jest: 29.7.0(@types/node@26.6.2)
       jest-regex-util: 29.6.3
       jest-watcher: 29.7.0
       slash: 5.1.0
@@ -13262,7 +13271,7 @@ snapshots:
     dependencies:
       '@jest/test-result': 29.7.0
       '@jest/types': 29.6.3
-      '@types/node': 25.6.0
+      '@types/node': 26.6.2
       ansi-escapes: 4.3.2
       chalk: 4.1.2
       emittery: 0.13.1
@@ -13271,17 +13280,17 @@ snapshots:
 
   jest-worker@29.7.0:
     dependencies:
-      '@types/node': 26.1.1
+      '@types/node': 26.6.2
       jest-util: 29.7.0
       merge-stream: 2.0.0
       supports-color: 8.1.1
 
-  jest@29.7.0(@types/node@26.5.1):
+  jest@29.7.0(@types/node@26.6.2):
     dependencies:
       '@jest/core': 29.7.0
       '@jest/types': 29.6.3
       import-local: 3.2.0
-      jest-cli: 29.7.0(@types/node@26.5.1)
+      jest-cli: 29.7.0(@types/node@26.6.2)
     transitivePeerDependencies:
       - '@types/node'
       - babel-plugin-macros
@@ -13306,7 +13315,7 @@ snapshots:
   jsdom@20.0.3:
     dependencies:
       abab: 2.0.6
-      acorn: 8.15.0
+      acorn: 8.18.0
       acorn-globals: 7.0.1
       cssom: 0.5.0
       cssstyle: 2.3.0
@@ -13484,11 +13493,11 @@ snapshots:
     dependencies:
       yallist: 3.1.1
 
-  lucide-react-native@1.14.0(react-native-svg@15.15.4(react-native@0.83.10(patch_hash=44876634a8efbb0f2c3f66cd4332be170ec821d1cbfc0264ac80680983e8513d)(@babel/core@7.29.7)(@react-native/metro-config@0.85.2(@babel/core@7.29.7))(@types/react@19.2.14)(react@19.2.8))(react@19.2.8))(react-native@0.83.10(patch_hash=44876634a8efbb0f2c3f66cd4332be170ec821d1cbfc0264ac80680983e8513d)(@babel/core@7.29.7)(@react-native/metro-config@0.85.2(@babel/core@7.29.7))(@types/react@19.2.14)(react@19.2.8))(react@19.2.8):
+  lucide-react-native@1.14.0(react-native-svg@15.15.5(react-native@0.83.10(patch_hash=44876634a8efbb0f2c3f66cd4332be170ec821d1cbfc0264ac80680983e8513d)(@babel/core@7.29.7)(@react-native/metro-config@0.85.2(@babel/core@7.29.7))(@types/react@19.2.14)(react@19.2.8))(react@19.2.8))(react-native@0.83.10(patch_hash=44876634a8efbb0f2c3f66cd4332be170ec821d1cbfc0264ac80680983e8513d)(@babel/core@7.29.7)(@react-native/metro-config@0.85.2(@babel/core@7.29.7))(@types/react@19.2.14)(react@19.2.8))(react@19.2.8):
     dependencies:
       react: 19.2.8
       react-native: 0.83.10(patch_hash=44876634a8efbb0f2c3f66cd4332be170ec821d1cbfc0264ac80680983e8513d)(@babel/core@7.29.7)(@react-native/metro-config@0.85.2(@babel/core@7.29.7))(@types/react@19.2.14)(react@19.2.8)
-      react-native-svg: 15.15.4(react-native@0.83.10(patch_hash=44876634a8efbb0f2c3f66cd4332be170ec821d1cbfc0264ac80680983e8513d)(@babel/core@7.29.7)(@react-native/metro-config@0.85.2(@babel/core@7.29.7))(@types/react@19.2.14)(react@19.2.8))(react@19.2.8)
+      react-native-svg: 15.15.5(react-native@0.83.10(patch_hash=44876634a8efbb0f2c3f66cd4332be170ec821d1cbfc0264ac80680983e8513d)(@babel/core@7.29.7)(@react-native/metro-config@0.85.2(@babel/core@7.29.7))(@types/react@19.2.14)(react@19.2.8))(react@19.2.8)
 
   magic-string@0.30.21:
     dependencies:
@@ -13792,7 +13801,7 @@ snapshots:
     dependencies:
       '@babel/core': 7.29.7
       '@babel/generator': 7.29.8
-      '@babel/parser': 7.29.8
+      '@babel/parser': 7.29.9
       '@babel/types': 7.29.8
       flow-enums-runtime: 0.0.6
       metro: 0.84.6
@@ -13858,7 +13867,7 @@ snapshots:
       '@babel/code-frame': 7.29.7
       '@babel/core': 7.29.7
       '@babel/generator': 7.29.8
-      '@babel/parser': 7.29.8
+      '@babel/parser': 7.29.9
       '@babel/template': 7.29.7
       '@babel/traverse': 7.29.8
       '@babel/types': 7.29.8
@@ -14100,51 +14109,51 @@ snapshots:
       object-keys: 1.1.1
       safe-push-apply: 1.0.0
 
-  oxfmt@0.65.0:
+  oxfmt@0.70.0:
     dependencies:
-      tinypool: 2.1.0
+      tinypool: 2.1.2
     optionalDependencies:
-      '@oxfmt/binding-android-arm-eabi': 0.65.0
-      '@oxfmt/binding-android-arm64': 0.65.0
-      '@oxfmt/binding-darwin-arm64': 0.65.0
-      '@oxfmt/binding-darwin-x64': 0.65.0
-      '@oxfmt/binding-freebsd-x64': 0.65.0
-      '@oxfmt/binding-linux-arm-gnueabihf': 0.65.0
-      '@oxfmt/binding-linux-arm-musleabihf': 0.65.0
-      '@oxfmt/binding-linux-arm64-gnu': 0.65.0
-      '@oxfmt/binding-linux-arm64-musl': 0.65.0
-      '@oxfmt/binding-linux-ppc64-gnu': 0.65.0
-      '@oxfmt/binding-linux-riscv64-gnu': 0.65.0
-      '@oxfmt/binding-linux-riscv64-musl': 0.65.0
-      '@oxfmt/binding-linux-s390x-gnu': 0.65.0
-      '@oxfmt/binding-linux-x64-gnu': 0.65.0
-      '@oxfmt/binding-linux-x64-musl': 0.65.0
-      '@oxfmt/binding-openharmony-arm64': 0.65.0
-      '@oxfmt/binding-win32-arm64-msvc': 0.65.0
-      '@oxfmt/binding-win32-ia32-msvc': 0.65.0
-      '@oxfmt/binding-win32-x64-msvc': 0.65.0
-
-  oxlint@1.80.0:
+      '@oxfmt/binding-android-arm-eabi': 0.70.0
+      '@oxfmt/binding-android-arm64': 0.70.0
+      '@oxfmt/binding-darwin-arm64': 0.70.0
+      '@oxfmt/binding-darwin-x64': 0.70.0
+      '@oxfmt/binding-freebsd-x64': 0.70.0
+      '@oxfmt/binding-linux-arm-gnueabihf': 0.70.0
+      '@oxfmt/binding-linux-arm-musleabihf': 0.70.0
+      '@oxfmt/binding-linux-arm64-gnu': 0.70.0
+      '@oxfmt/binding-linux-arm64-musl': 0.70.0
+      '@oxfmt/binding-linux-ppc64-gnu': 0.70.0
+      '@oxfmt/binding-linux-riscv64-gnu': 0.70.0
+      '@oxfmt/binding-linux-riscv64-musl': 0.70.0
+      '@oxfmt/binding-linux-s390x-gnu': 0.70.0
+      '@oxfmt/binding-linux-x64-gnu': 0.70.0
+      '@oxfmt/binding-linux-x64-musl': 0.70.0
+      '@oxfmt/binding-openharmony-arm64': 0.70.0
+      '@oxfmt/binding-win32-arm64-msvc': 0.70.0
+      '@oxfmt/binding-win32-ia32-msvc': 0.70.0
+      '@oxfmt/binding-win32-x64-msvc': 0.70.0
+
+  oxlint@1.85.0:
     optionalDependencies:
-      '@oxlint/binding-android-arm-eabi': 1.80.0
-      '@oxlint/binding-android-arm64': 1.80.0
-      '@oxlint/binding-darwin-arm64': 1.80.0
-      '@oxlint/binding-darwin-x64': 1.80.0
-      '@oxlint/binding-freebsd-x64': 1.80.0
-      '@oxlint/binding-linux-arm-gnueabihf': 1.80.0
-      '@oxlint/binding-linux-arm-musleabihf': 1.80.0
-      '@oxlint/binding-linux-arm64-gnu': 1.80.0
-      '@oxlint/binding-linux-arm64-musl': 1.80.0
-      '@oxlint/binding-linux-ppc64-gnu': 1.80.0
-      '@oxlint/binding-linux-riscv64-gnu': 1.80.0
-      '@oxlint/binding-linux-riscv64-musl': 1.80.0
-      '@oxlint/binding-linux-s390x-gnu': 1.80.0
-      '@oxlint/binding-linux-x64-gnu': 1.80.0
-      '@oxlint/binding-linux-x64-musl': 1.80.0
-      '@oxlint/binding-openharmony-arm64': 1.80.0
-      '@oxlint/binding-win32-arm64-msvc': 1.80.0
-      '@oxlint/binding-win32-ia32-msvc': 1.80.0
-      '@oxlint/binding-win32-x64-msvc': 1.80.0
+      '@oxlint/binding-android-arm-eabi': 1.85.0
+      '@oxlint/binding-android-arm64': 1.85.0
+      '@oxlint/binding-darwin-arm64': 1.85.0
+      '@oxlint/binding-darwin-x64': 1.85.0
+      '@oxlint/binding-freebsd-x64': 1.85.0
+      '@oxlint/binding-linux-arm-gnueabihf': 1.85.0
+      '@oxlint/binding-linux-arm-musleabihf': 1.85.0
+      '@oxlint/binding-linux-arm64-gnu': 1.85.0
+      '@oxlint/binding-linux-arm64-musl': 1.85.0
+      '@oxlint/binding-linux-ppc64-gnu': 1.85.0
+      '@oxlint/binding-linux-riscv64-gnu': 1.85.0
+      '@oxlint/binding-linux-riscv64-musl': 1.85.0
+      '@oxlint/binding-linux-s390x-gnu': 1.85.0
+      '@oxlint/binding-linux-x64-gnu': 1.85.0
+      '@oxlint/binding-linux-x64-musl': 1.85.0
+      '@oxlint/binding-openharmony-arm64': 1.85.0
+      '@oxlint/binding-win32-arm64-msvc': 1.85.0
+      '@oxlint/binding-win32-ia32-msvc': 1.85.0
+      '@oxlint/binding-win32-x64-msvc': 1.85.0
 
   p-limit@2.3.0:
     dependencies:
@@ -14365,13 +14374,12 @@ snapshots:
       react-native: 0.83.10(patch_hash=44876634a8efbb0f2c3f66cd4332be170ec821d1cbfc0264ac80680983e8513d)(@babel/core@7.29.7)(@react-native/metro-config@0.85.2(@babel/core@7.29.7))(@types/react@19.2.14)(react@19.2.8)
       warn-once: 0.1.1
 
-  react-native-svg@15.15.4(react-native@0.83.10(patch_hash=44876634a8efbb0f2c3f66cd4332be170ec821d1cbfc0264ac80680983e8513d)(@babel/core@7.29.7)(@react-native/metro-config@0.85.2(@babel/core@7.29.7))(@types/react@19.2.14)(react@19.2.8))(react@19.2.8):
+  react-native-svg@15.15.5(react-native@0.83.10(patch_hash=44876634a8efbb0f2c3f66cd4332be170ec821d1cbfc0264ac80680983e8513d)(@babel/core@7.29.7)(@react-native/metro-config@0.85.2(@babel/core@7.29.7))(@types/react@19.2.14)(react@19.2.8))(react@19.2.8):
     dependencies:
       css-select: 5.2.2
       css-tree: 1.1.3
       react: 19.2.8
       react-native: 0.83.10(patch_hash=44876634a8efbb0f2c3f66cd4332be170ec821d1cbfc0264ac80680983e8513d)(@babel/core@7.29.7)(@react-native/metro-config@0.85.2(@babel/core@7.29.7))(@types/react@19.2.14)(react@19.2.8)
-      warn-once: 0.1.1
 
   react-native-uitextview@2.2.0(react-native@0.83.10(patch_hash=44876634a8efbb0f2c3f66cd4332be170ec821d1cbfc0264ac80680983e8513d)(@babel/core@7.29.7)(@react-native/metro-config@0.85.2(@babel/core@7.29.7))(@types/react@19.2.14)(react@19.2.8))(react@19.2.8):
     dependencies:
@@ -14995,14 +15003,14 @@ snapshots:
   terser@5.49.1:
     dependencies:
       '@jridgewell/source-map': 0.3.11
-      acorn: 8.15.0
+      acorn: 8.18.0
       commander: 2.20.3
       source-map-support: 0.5.21
 
   terser@5.51.2:
     dependencies:
       '@jridgewell/source-map': 0.3.11
-      acorn: 8.15.0
+      acorn: 8.18.0
       commander: 2.20.3
       source-map-support: 0.5.21
 
@@ -15023,7 +15031,7 @@ snapshots:
       fdir: 6.5.0(picomatch@4.0.4)
       picomatch: 4.0.4
 
-  tinypool@2.1.0: {}
+  tinypool@2.1.2: {}
 
   tinyrainbow@3.1.0: {}
 
@@ -15061,11 +15069,11 @@ snapshots:
 
   ts-dedent@2.3.0: {}
 
-  ts-jest@29.0.5(@babel/core@7.29.7)(@jest/types@29.6.3)(babel-jest@29.7.0(@babel/core@7.29.7))(esbuild@0.25.4)(jest@29.7.0(@types/node@26.5.1))(typescript@5.9.3):
+  ts-jest@29.0.5(@babel/core@7.29.7)(@jest/types@29.6.3)(babel-jest@29.7.0(@babel/core@7.29.7))(esbuild@0.25.4)(jest@29.7.0(@types/node@26.6.2))(typescript@5.9.3):
     dependencies:
       bs-logger: 0.2.6
       fast-json-stable-stringify: 2.1.0
-      jest: 29.7.0(@types/node@26.5.1)
+      jest: 29.7.0(@types/node@26.6.2)
       jest-util: 29.7.0
       json5: 2.2.3
       lodash.memoize: 4.1.2
@@ -15158,8 +15166,6 @@ snapshots:
 
   undici-types@7.19.2: {}
 
-  undici-types@8.3.0: {}
-
   undici-types@8.9.0: {}
 
   unicode-canonical-property-names-ecmascript@2.0.1: {}
@@ -15240,7 +15246,7 @@ snapshots:
       - '@types/react'
       - '@types/react-dom'
 
-  vite@8.1.0(@types/node@26.5.1)(esbuild@0.25.4)(terser@5.51.2)(tsx@4.22.4)(yaml@2.9.1):
+  vite@8.1.0(@types/node@26.6.2)(esbuild@0.25.4)(terser@5.51.2)(tsx@4.22.4)(yaml@2.9.1):
     dependencies:
       lightningcss: 1.32.0
       picomatch: 4.0.4
@@ -15248,17 +15254,17 @@ snapshots:
       rolldown: 1.1.3
       tinyglobby: 0.2.17
     optionalDependencies:
-      '@types/node': 26.5.1
+      '@types/node': 26.6.2
       esbuild: 0.25.4
       fsevents: 2.3.3
       terser: 5.51.2
       tsx: 4.22.4
       yaml: 2.9.1
 
-  vitest@4.1.11(@types/node@26.5.1)(happy-dom@20.11.8)(jsdom@20.0.3)(vite@8.1.0(@types/node@26.5.1)(esbuild@0.25.4)(terser@5.51.2)(tsx@4.22.4)(yaml@2.9.1)):
+  vitest@4.1.11(@types/node@26.6.2)(happy-dom@20.11.8)(jsdom@20.0.3)(vite@8.1.0(@types/node@26.6.2)(esbuild@0.25.4)(terser@5.51.2)(tsx@4.22.4)(yaml@2.9.1)):
     dependencies:
       '@vitest/expect': 4.1.11
-      '@vitest/mocker': 4.1.11(vite@8.1.0(@types/node@26.5.1)(esbuild@0.25.4)(terser@5.51.2)(tsx@4.22.4)(yaml@2.9.1))
+      '@vitest/mocker': 4.1.11(vite@8.1.0(@types/node@26.6.2)(esbuild@0.25.4)(terser@5.51.2)(tsx@4.22.4)(yaml@2.9.1))
       '@vitest/pretty-format': 4.1.11
       '@vitest/runner': 4.1.11
       '@vitest/snapshot': 4.1.11
@@ -15275,10 +15281,10 @@ snapshots:
       tinyexec: 1.1.2
       tinyglobby: 0.2.17
       tinyrainbow: 3.1.0
-      vite: 8.1.0(@types/node@26.5.1)(esbuild@0.25.4)(terser@5.51.2)(tsx@4.22.4)(yaml@2.9.1)
+      vite: 8.1.0(@types/node@26.6.2)(esbuild@0.25.4)(terser@5.51.2)(tsx@4.22.4)(yaml@2.9.1)
       why-is-node-running: 2.3.0
     optionalDependencies:
-      '@types/node': 26.5.1
+      '@types/node': 26.6.2
       happy-dom: 20.11.8
       jsdom: 20.0.3
     transitivePeerDependencies:
@@ -15445,9 +15451,9 @@ snapshots:
 
   zod@3.25.76: {}
 
-  zod@4.4.3: {}
+  zod@4.6.5: {}
 
-  zustand@5.0.13(@types/react@19.2.14)(react@19.2.8)(use-sync-external-store@1.6.0(react@19.2.8)):
+  zustand@5.0.15(@types/react@19.2.14)(react@19.2.8)(use-sync-external-store@1.6.0(react@19.2.8)):
     optionalDependencies:
       '@types/react': 19.2.14
       react: 19.2.8
diff --git a/mobile/rpc-foundation/goldens/aivault-history-scan-fulfilled.json b/mobile/rpc-foundation/goldens/aivault-history-scan-fulfilled.json
index 55471099e5f4..14863eb6ed5e 100644
--- a/mobile/rpc-foundation/goldens/aivault-history-scan-fulfilled.json
+++ b/mobile/rpc-foundation/goldens/aivault-history-scan-fulfilled.json
@@ -3,9 +3,9 @@
   "family": "aiVault.history",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "ec16931c5431d3dbb05729d4670c381a434bff71648d334b7b5224db188fdccb",
   "scenarioSha256": "0431ac82cbb8c60b16f4432fd0da7cff665485d668e512b20fc1168ec63db3fe",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/aivault-history-scan-unsupported.json b/mobile/rpc-foundation/goldens/aivault-history-scan-unsupported.json
index fc7ea66eca0b..0fcee77ec0f3 100644
--- a/mobile/rpc-foundation/goldens/aivault-history-scan-unsupported.json
+++ b/mobile/rpc-foundation/goldens/aivault-history-scan-unsupported.json
@@ -3,9 +3,9 @@
   "family": "aiVault.history",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "ec16931c5431d3dbb05729d4670c381a434bff71648d334b7b5224db188fdccb",
   "scenarioSha256": "e97c6db772a70ee1912419ac67835b6074aaf9a341d4360389a11465f08092c5",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/aivault-history-scan-worktrees-late.json b/mobile/rpc-foundation/goldens/aivault-history-scan-worktrees-late.json
index 98b48fdd6887..1db6d75eb73d 100644
--- a/mobile/rpc-foundation/goldens/aivault-history-scan-worktrees-late.json
+++ b/mobile/rpc-foundation/goldens/aivault-history-scan-worktrees-late.json
@@ -3,9 +3,9 @@
   "family": "aiVault.history",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "ec16931c5431d3dbb05729d4670c381a434bff71648d334b7b5224db188fdccb",
   "scenarioSha256": "10011c7c75e74d9c2e880c5458c9156264ae07e91956a80946ede1d4e684952a",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/aivault-history-screen-listed.json b/mobile/rpc-foundation/goldens/aivault-history-screen-listed.json
index f964c1a28b4b..5ffaa3c502ac 100644
--- a/mobile/rpc-foundation/goldens/aivault-history-screen-listed.json
+++ b/mobile/rpc-foundation/goldens/aivault-history-screen-listed.json
@@ -3,9 +3,9 @@
   "family": "aiVault.history-screen",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c78ab47eea594b7e1988403321ff9ba135ca60c513bb9d5848bdde26c0ffe3c3",
   "scenarioSha256": "d52d3c5858298a4a6a90bd9a8986b780004477de105fe93f6303d9c303ffea38",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/aivault-history-screen-worktrees.json b/mobile/rpc-foundation/goldens/aivault-history-screen-worktrees.json
index 942df4ffd3d6..82e38d52e866 100644
--- a/mobile/rpc-foundation/goldens/aivault-history-screen-worktrees.json
+++ b/mobile/rpc-foundation/goldens/aivault-history-screen-worktrees.json
@@ -3,9 +3,9 @@
   "family": "aiVault.history-screen",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c78ab47eea594b7e1988403321ff9ba135ca60c513bb9d5848bdde26c0ffe3c3",
   "scenarioSha256": "f50f63c4e2a69793b3d322ed16089c4241ff6169d8f9549106480230fb8dd5e7",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/aivault-resume-launch-create-refused.json b/mobile/rpc-foundation/goldens/aivault-resume-launch-create-refused.json
index 6391a5e8a3c4..d5c046956b77 100644
--- a/mobile/rpc-foundation/goldens/aivault-resume-launch-create-refused.json
+++ b/mobile/rpc-foundation/goldens/aivault-resume-launch-create-refused.json
@@ -3,9 +3,9 @@
   "family": "aiVault.resume-launch",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "2f43211e4084c0493bd02ec98868acf53a4c748f89a70cd9657c9c3ee87b12fb",
   "scenarioSha256": "ebf1bbc01ad7704fe79eff0969fcc2d4af8ebfa7c2410d2ed9d3ae8c6976b434",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/aivault-resume-launch-invalid-tab.json b/mobile/rpc-foundation/goldens/aivault-resume-launch-invalid-tab.json
index e1fdd21067ea..a77c715a27b8 100644
--- a/mobile/rpc-foundation/goldens/aivault-resume-launch-invalid-tab.json
+++ b/mobile/rpc-foundation/goldens/aivault-resume-launch-invalid-tab.json
@@ -3,9 +3,9 @@
   "family": "aiVault.resume-launch",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "2f43211e4084c0493bd02ec98868acf53a4c748f89a70cd9657c9c3ee87b12fb",
   "scenarioSha256": "281ccf5a082f3788ae8bf19f742ea4baf35c20c78bc91d7d91873845583e1a91",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/aivault-resume-launch-locked.json b/mobile/rpc-foundation/goldens/aivault-resume-launch-locked.json
index d2d76536ff1a..8a9790b721a9 100644
--- a/mobile/rpc-foundation/goldens/aivault-resume-launch-locked.json
+++ b/mobile/rpc-foundation/goldens/aivault-resume-launch-locked.json
@@ -3,9 +3,9 @@
   "family": "aiVault.resume-launch",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "2f43211e4084c0493bd02ec98868acf53a4c748f89a70cd9657c9c3ee87b12fb",
   "scenarioSha256": "941fcf202417c94ef546f5ee331983689d8b72397dac6f61dda944ca24abed9e",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/aivault-resume-launch-sent.json b/mobile/rpc-foundation/goldens/aivault-resume-launch-sent.json
index 59508853b535..a892d7739a26 100644
--- a/mobile/rpc-foundation/goldens/aivault-resume-launch-sent.json
+++ b/mobile/rpc-foundation/goldens/aivault-resume-launch-sent.json
@@ -3,9 +3,9 @@
   "family": "aiVault.resume-launch",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "2f43211e4084c0493bd02ec98868acf53a4c748f89a70cd9657c9c3ee87b12fb",
   "scenarioSha256": "f0ac1c996e5b1b4043e0a081978476c6c2dd8a5d517d5752857721205a588fb0",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/aivault-resume-prepare-refused.json b/mobile/rpc-foundation/goldens/aivault-resume-prepare-refused.json
index 3c558612089f..f696b86ddea1 100644
--- a/mobile/rpc-foundation/goldens/aivault-resume-prepare-refused.json
+++ b/mobile/rpc-foundation/goldens/aivault-resume-prepare-refused.json
@@ -3,9 +3,9 @@
   "family": "aiVault.resume-preparation",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "2f43211e4084c0493bd02ec98868acf53a4c748f89a70cd9657c9c3ee87b12fb",
   "scenarioSha256": "dc9926f95475413627315e1f1c96740ececa697c6a0a5e3c42e18cfd4d58448a",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/aivault-resume-prepare-repin.json b/mobile/rpc-foundation/goldens/aivault-resume-prepare-repin.json
index a68e03375541..c121e0d54c70 100644
--- a/mobile/rpc-foundation/goldens/aivault-resume-prepare-repin.json
+++ b/mobile/rpc-foundation/goldens/aivault-resume-prepare-repin.json
@@ -3,9 +3,9 @@
   "family": "aiVault.resume-preparation",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "2f43211e4084c0493bd02ec98868acf53a4c748f89a70cd9657c9c3ee87b12fb",
   "scenarioSha256": "6719aea706086a68709894546f9595264407db2df94fa56180cb3c68b08aaa69",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/aivault-resume-prepare-skipped.json b/mobile/rpc-foundation/goldens/aivault-resume-prepare-skipped.json
index 909b23172ce4..2bc7cdb16d7e 100644
--- a/mobile/rpc-foundation/goldens/aivault-resume-prepare-skipped.json
+++ b/mobile/rpc-foundation/goldens/aivault-resume-prepare-skipped.json
@@ -3,9 +3,9 @@
   "family": "aiVault.resume-preparation",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "2f43211e4084c0493bd02ec98868acf53a4c748f89a70cd9657c9c3ee87b12fb",
   "scenarioSha256": "3afaf2807506f5bde2159b367f34c6b777739d6aad564796d54ac0da05b5bd02",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/aivault-resume-prepare-unavailable.json b/mobile/rpc-foundation/goldens/aivault-resume-prepare-unavailable.json
index 8ec6ca3ffc41..4262ba6f21e0 100644
--- a/mobile/rpc-foundation/goldens/aivault-resume-prepare-unavailable.json
+++ b/mobile/rpc-foundation/goldens/aivault-resume-prepare-unavailable.json
@@ -3,9 +3,9 @@
   "family": "aiVault.resume-preparation",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "2f43211e4084c0493bd02ec98868acf53a4c748f89a70cd9657c9c3ee87b12fb",
   "scenarioSha256": "a5eedea5f551e0ca0e143292f1d9aa8920dd7af62a02d8e8777666ab3779c019",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/b1.json b/mobile/rpc-foundation/goldens/b1.json
index ec6cc9d96684..c980aacea104 100644
--- a/mobile/rpc-foundation/goldens/b1.json
+++ b/mobile/rpc-foundation/goldens/b1.json
@@ -3,9 +3,9 @@
   "family": "legacy-inventory",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "262eaad263a45aa13ec5b27c12b59946b12c202474229fff7a5727dba6d702ca",
   "scenarioSha256": "23ffc912a432dcd3ff70be1903a8d518cf85634f27a2be6d21585963e338e7e3",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/b2.json b/mobile/rpc-foundation/goldens/b2.json
index 5f5fbc606c8f..a8f0cbfbe91a 100644
--- a/mobile/rpc-foundation/goldens/b2.json
+++ b/mobile/rpc-foundation/goldens/b2.json
@@ -3,9 +3,9 @@
   "family": "project-explicit-false",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "d3b7f33d810e1fa420ac41a628cde9fe4a9e65fd57f89fbca0a40fc7d74951ab",
   "scenarioSha256": "b31992be2f91bd61fbe1b8a5400da3b7a56753564b0b0b2b38bc5d549812d693",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/b3.json b/mobile/rpc-foundation/goldens/b3.json
index 4b65472be526..9fe5cc5de1ab 100644
--- a/mobile/rpc-foundation/goldens/b3.json
+++ b/mobile/rpc-foundation/goldens/b3.json
@@ -3,9 +3,9 @@
   "family": "linear-detail-barrier",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "d3b7f33d810e1fa420ac41a628cde9fe4a9e65fd57f89fbca0a40fc7d74951ab",
   "scenarioSha256": "130e493fcd7765e037405f59e6cc78a0cc1793b1ae092cad933ff9d5a9df8b7a",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/browser-dialog-accepted.json b/mobile/rpc-foundation/goldens/browser-dialog-accepted.json
index 98b00a167f42..532bde414afe 100644
--- a/mobile/rpc-foundation/goldens/browser-dialog-accepted.json
+++ b/mobile/rpc-foundation/goldens/browser-dialog-accepted.json
@@ -3,9 +3,9 @@
   "family": "browser.dialog",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "55971752f963202d30160851197a301089b0f3ebd0c46725af1a461d8310d658",
   "scenarioSha256": "95f377bc4d8bf1248cafed26b2e9f425ad37e8d3c99e354bd6a8c67eb9bd9b1b",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/browser-dialog-dismissed.json b/mobile/rpc-foundation/goldens/browser-dialog-dismissed.json
index c877396079e8..1080195516c0 100644
--- a/mobile/rpc-foundation/goldens/browser-dialog-dismissed.json
+++ b/mobile/rpc-foundation/goldens/browser-dialog-dismissed.json
@@ -3,9 +3,9 @@
   "family": "browser.dialog",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "55971752f963202d30160851197a301089b0f3ebd0c46725af1a461d8310d658",
   "scenarioSha256": "5071188ee492a4ced5be793b2dab32baa9750ee6535128635f274fd79198e2f1",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/browser-keyboard-input.json b/mobile/rpc-foundation/goldens/browser-keyboard-input.json
index 3dca387cf68a..8a1f2b657bcc 100644
--- a/mobile/rpc-foundation/goldens/browser-keyboard-input.json
+++ b/mobile/rpc-foundation/goldens/browser-keyboard-input.json
@@ -3,9 +3,9 @@
   "family": "browser.keyboard",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "55971752f963202d30160851197a301089b0f3ebd0c46725af1a461d8310d658",
   "scenarioSha256": "eb2294c30af70ebc2bac092dc5105249ae8cf1941f750406622f7ff6dd70cc1b",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/browser-pointer-click-accepted.json b/mobile/rpc-foundation/goldens/browser-pointer-click-accepted.json
index d07f0f17927c..d82a129a2e61 100644
--- a/mobile/rpc-foundation/goldens/browser-pointer-click-accepted.json
+++ b/mobile/rpc-foundation/goldens/browser-pointer-click-accepted.json
@@ -3,9 +3,9 @@
   "family": "browser.pointer-click",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "55971752f963202d30160851197a301089b0f3ebd0c46725af1a461d8310d658",
   "scenarioSha256": "73faa87b359a11959543542016295bb6b36a10934dd99ad5c1a77a4290a608cd",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/browser-pointer-click-fallback.json b/mobile/rpc-foundation/goldens/browser-pointer-click-fallback.json
index 70c5e0c5d401..c8b892ddb3c1 100644
--- a/mobile/rpc-foundation/goldens/browser-pointer-click-fallback.json
+++ b/mobile/rpc-foundation/goldens/browser-pointer-click-fallback.json
@@ -3,9 +3,9 @@
   "family": "browser.pointer-click",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "55971752f963202d30160851197a301089b0f3ebd0c46725af1a461d8310d658",
   "scenarioSha256": "34efd4d8568ac15d4e67d475e28194522d6413ad27dce1d6850718af15b3f874",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/browser-wheel-scrolled.json b/mobile/rpc-foundation/goldens/browser-wheel-scrolled.json
index 4ec937a7cfc5..1e647f8c0eb8 100644
--- a/mobile/rpc-foundation/goldens/browser-wheel-scrolled.json
+++ b/mobile/rpc-foundation/goldens/browser-wheel-scrolled.json
@@ -3,9 +3,9 @@
   "family": "browser.wheel",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "55971752f963202d30160851197a301089b0f3ebd0c46725af1a461d8310d658",
   "scenarioSha256": "e1bc21248ccff45ff217e385a51618b6f5724c037bfbefa03bb76a48dd4d793b",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/clipboard-image-attachment-anonymous.json b/mobile/rpc-foundation/goldens/clipboard-image-attachment-anonymous.json
index 394897047ff7..5bb1fc8916b2 100644
--- a/mobile/rpc-foundation/goldens/clipboard-image-attachment-anonymous.json
+++ b/mobile/rpc-foundation/goldens/clipboard-image-attachment-anonymous.json
@@ -3,9 +3,9 @@
   "family": "clipboard.image-attachment",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "16779b663f4faec8cbccdb42efd7b568a2912845b161f8a4827754687eb4235c",
   "scenarioSha256": "5411e29436e9faf18a1b81f369082f3ae087a9a96a2e1ea0f97e65e9391bfd0c",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/clipboard-image-attachment-blocked-before-send.json b/mobile/rpc-foundation/goldens/clipboard-image-attachment-blocked-before-send.json
index 33570af989f0..1a8293a8c112 100644
--- a/mobile/rpc-foundation/goldens/clipboard-image-attachment-blocked-before-send.json
+++ b/mobile/rpc-foundation/goldens/clipboard-image-attachment-blocked-before-send.json
@@ -3,9 +3,9 @@
   "family": "clipboard.image-attachment",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "16779b663f4faec8cbccdb42efd7b568a2912845b161f8a4827754687eb4235c",
   "scenarioSha256": "ea04d03c15d3cb94be7fe111a8a6219c4e0304095679bbae62af623f5b36c9f4",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/clipboard-image-attachment-cancelled.json b/mobile/rpc-foundation/goldens/clipboard-image-attachment-cancelled.json
index 832cc3394016..1a055189ffc8 100644
--- a/mobile/rpc-foundation/goldens/clipboard-image-attachment-cancelled.json
+++ b/mobile/rpc-foundation/goldens/clipboard-image-attachment-cancelled.json
@@ -3,9 +3,9 @@
   "family": "clipboard.image-attachment",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "16779b663f4faec8cbccdb42efd7b568a2912845b161f8a4827754687eb4235c",
   "scenarioSha256": "e6be7d5dd6b4f5083627a3ba864b1b040d71bf72b60ad940b7d0d575964a7b80",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/clipboard-image-attachment-pasted.json b/mobile/rpc-foundation/goldens/clipboard-image-attachment-pasted.json
index 3de080b6349e..1e5eb1794790 100644
--- a/mobile/rpc-foundation/goldens/clipboard-image-attachment-pasted.json
+++ b/mobile/rpc-foundation/goldens/clipboard-image-attachment-pasted.json
@@ -3,9 +3,9 @@
   "family": "clipboard.image-attachment",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "16779b663f4faec8cbccdb42efd7b568a2912845b161f8a4827754687eb4235c",
   "scenarioSha256": "d6db064741cd68d6ad8a3e490a774d8145adb4a5b7cca8218f5c972b1a31f93b",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/clipboard-image-attachment-upload-refused.json b/mobile/rpc-foundation/goldens/clipboard-image-attachment-upload-refused.json
index 35da905b4d99..73634ccd6143 100644
--- a/mobile/rpc-foundation/goldens/clipboard-image-attachment-upload-refused.json
+++ b/mobile/rpc-foundation/goldens/clipboard-image-attachment-upload-refused.json
@@ -3,9 +3,9 @@
   "family": "clipboard.image-attachment",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "16779b663f4faec8cbccdb42efd7b568a2912845b161f8a4827754687eb4235c",
   "scenarioSha256": "e7f492523421873f045726e15ec95eac26d43f7e971a33fd89ec1a9749492987",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/clipboard-image-upload-aborts-on-chunk-failure.json b/mobile/rpc-foundation/goldens/clipboard-image-upload-aborts-on-chunk-failure.json
index d4f1147b97c9..9d309faa74bf 100644
--- a/mobile/rpc-foundation/goldens/clipboard-image-upload-aborts-on-chunk-failure.json
+++ b/mobile/rpc-foundation/goldens/clipboard-image-upload-aborts-on-chunk-failure.json
@@ -3,9 +3,9 @@
   "family": "clipboard.image-upload",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "16779b663f4faec8cbccdb42efd7b568a2912845b161f8a4827754687eb4235c",
   "scenarioSha256": "195c2f15d81c70012ea88750ab3f84bfe512f7e422f7d2d09fb7919bd9cfd85a",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/clipboard-image-upload-chunked.json b/mobile/rpc-foundation/goldens/clipboard-image-upload-chunked.json
index f2c1cf2045d5..a6138359ec46 100644
--- a/mobile/rpc-foundation/goldens/clipboard-image-upload-chunked.json
+++ b/mobile/rpc-foundation/goldens/clipboard-image-upload-chunked.json
@@ -3,9 +3,9 @@
   "family": "clipboard.image-upload",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "16779b663f4faec8cbccdb42efd7b568a2912845b161f8a4827754687eb4235c",
   "scenarioSha256": "160101326d39705c2036c12646ff6b13d997a1cf91bdc86e5e29279ba31867e4",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/clipboard-image-upload-single-frame-fallback.json b/mobile/rpc-foundation/goldens/clipboard-image-upload-single-frame-fallback.json
index 0f39d1e497bc..cedf2b33b695 100644
--- a/mobile/rpc-foundation/goldens/clipboard-image-upload-single-frame-fallback.json
+++ b/mobile/rpc-foundation/goldens/clipboard-image-upload-single-frame-fallback.json
@@ -3,9 +3,9 @@
   "family": "clipboard.image-upload",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "16779b663f4faec8cbccdb42efd7b568a2912845b161f8a4827754687eb4235c",
   "scenarioSha256": "89ffa843d08ee27dd44b7bba507ce84661b0df73c35f7a8c273e004604710dc9",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/clipboard-image-upload-start-refused.json b/mobile/rpc-foundation/goldens/clipboard-image-upload-start-refused.json
index 0c9c5af4693b..abc62c495fe8 100644
--- a/mobile/rpc-foundation/goldens/clipboard-image-upload-start-refused.json
+++ b/mobile/rpc-foundation/goldens/clipboard-image-upload-start-refused.json
@@ -3,9 +3,9 @@
   "family": "clipboard.image-upload",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "16779b663f4faec8cbccdb42efd7b568a2912845b161f8a4827754687eb4235c",
   "scenarioSha256": "bf0227939c2d41d6a1ebc5b07a31196043e78f1580811bd32ec6fc5f447f5934",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/codex-reset-credit-consumed.json b/mobile/rpc-foundation/goldens/codex-reset-credit-consumed.json
index 075bc5a05ccb..ccea03279bcd 100644
--- a/mobile/rpc-foundation/goldens/codex-reset-credit-consumed.json
+++ b/mobile/rpc-foundation/goldens/codex-reset-credit-consumed.json
@@ -3,9 +3,9 @@
   "family": "components.codex-reset-credit",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "76b53dea504a688493843e23e8e7d052fc196f559bb1e2579d0fd38bf3156d0e",
   "scenarioSha256": "00260be9809576607ac91bfacd9fa6cc4f8a190c6b88804c977ea07d36d7162e",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/codex-reset-credit-resumed.json b/mobile/rpc-foundation/goldens/codex-reset-credit-resumed.json
index 74b969bc3d6b..7379c82d88b9 100644
--- a/mobile/rpc-foundation/goldens/codex-reset-credit-resumed.json
+++ b/mobile/rpc-foundation/goldens/codex-reset-credit-resumed.json
@@ -3,9 +3,9 @@
   "family": "components.codex-reset-credit",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "76b53dea504a688493843e23e8e7d052fc196f559bb1e2579d0fd38bf3156d0e",
   "scenarioSha256": "d85a4031b701e563941afcdd7375cf78a1ee1487a0dab722f8516c2bc8d3dcee",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/components-codex-capability.json b/mobile/rpc-foundation/goldens/components-codex-capability.json
index 545d506604b8..ead4dfee3d1c 100644
--- a/mobile/rpc-foundation/goldens/components-codex-capability.json
+++ b/mobile/rpc-foundation/goldens/components-codex-capability.json
@@ -3,9 +3,9 @@
   "family": "components.codex-reset-capability",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5cfbce3c7d97d908fbd447646d611e41a8aa1f61f684b9b710c4b67d6ff023a7",
   "scenarioSha256": "88570b9d2376863c7f88d7ed8c745a5fb771deddbc7409f8944fa861dd4bdce9",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/components-setup-ask.json b/mobile/rpc-foundation/goldens/components-setup-ask.json
index 4ca71821d397..f2afa228f1c9 100644
--- a/mobile/rpc-foundation/goldens/components-setup-ask.json
+++ b/mobile/rpc-foundation/goldens/components-setup-ask.json
@@ -3,9 +3,9 @@
   "family": "components.setup-script",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5cfbce3c7d97d908fbd447646d611e41a8aa1f61f684b9b710c4b67d6ff023a7",
   "scenarioSha256": "d4052f119c7ed68dc922c8beeb0074701f1532b10e48e284fb71aa165a17e437",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/components-target-local.json b/mobile/rpc-foundation/goldens/components-target-local.json
index 9b1909fb92f7..da6c45d74941 100644
--- a/mobile/rpc-foundation/goldens/components-target-local.json
+++ b/mobile/rpc-foundation/goldens/components-target-local.json
@@ -3,9 +3,9 @@
   "family": "components.execution-target-local",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5cfbce3c7d97d908fbd447646d611e41a8aa1f61f684b9b710c4b67d6ff023a7",
   "scenarioSha256": "2e0d3021621698b63117e250dd5e9762b5bfb3dc1911e27c510e9539bd2ee6c9",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/components-target-ssh.json b/mobile/rpc-foundation/goldens/components-target-ssh.json
index 3ea267663658..041a0d4110af 100644
--- a/mobile/rpc-foundation/goldens/components-target-ssh.json
+++ b/mobile/rpc-foundation/goldens/components-target-ssh.json
@@ -3,9 +3,9 @@
   "family": "components.execution-target",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5cfbce3c7d97d908fbd447646d611e41a8aa1f61f684b9b710c4b67d6ff023a7",
   "scenarioSha256": "82b891c7a7a2f255e2d22a372ee6112c9cc1f650259244e87f2e8c1356e97e5f",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/diff-review-branch-compare.json b/mobile/rpc-foundation/goldens/diff-review-branch-compare.json
index 52bfa580b4d4..4d04835ac8b7 100644
--- a/mobile/rpc-foundation/goldens/diff-review-branch-compare.json
+++ b/mobile/rpc-foundation/goldens/diff-review-branch-compare.json
@@ -3,9 +3,9 @@
   "family": "session.diff-review",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a8016eb61915cf80a3bdeb622ee67d35be8b4b9862a75e4ef2e8f4ff8e93e7f2",
   "scenarioSha256": "b7579013e65f0f5fe503c10cf2294cb9d4ac1938108275de001db6e02cf2cc21",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/diff-review-branch-file-diff.json b/mobile/rpc-foundation/goldens/diff-review-branch-file-diff.json
index 1b187b744162..67328b169864 100644
--- a/mobile/rpc-foundation/goldens/diff-review-branch-file-diff.json
+++ b/mobile/rpc-foundation/goldens/diff-review-branch-file-diff.json
@@ -3,9 +3,9 @@
   "family": "session.diff-review",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a8016eb61915cf80a3bdeb622ee67d35be8b4b9862a75e4ef2e8f4ff8e93e7f2",
   "scenarioSha256": "6c71b0f217a464dffbc6f5736605b840edac74ebaf0664edc0ab85984bb64328",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/diff-review-notes-refused-before-compare.json b/mobile/rpc-foundation/goldens/diff-review-notes-refused-before-compare.json
index 4f101dc938e6..cd0b56a0dc20 100644
--- a/mobile/rpc-foundation/goldens/diff-review-notes-refused-before-compare.json
+++ b/mobile/rpc-foundation/goldens/diff-review-notes-refused-before-compare.json
@@ -3,9 +3,9 @@
   "family": "session.diff-review",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a8016eb61915cf80a3bdeb622ee67d35be8b4b9862a75e4ef2e8f4ff8e93e7f2",
   "scenarioSha256": "3e7fa054f77587b9ac24b6732a9926273b0f2ff35a266e633d0ccd1dada932cc",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/diff-review-refused-file-diff.json b/mobile/rpc-foundation/goldens/diff-review-refused-file-diff.json
index c116428fbc81..4ac2f0398eb1 100644
--- a/mobile/rpc-foundation/goldens/diff-review-refused-file-diff.json
+++ b/mobile/rpc-foundation/goldens/diff-review-refused-file-diff.json
@@ -3,9 +3,9 @@
   "family": "session.diff-review",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a8016eb61915cf80a3bdeb622ee67d35be8b4b9862a75e4ef2e8f4ff8e93e7f2",
   "scenarioSha256": "d1b04fe2945a2799ac8465d8fd9e45ab790ae29b401a0cf4fef68ebc5fa3cc76",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/diff-review-snapshot.json b/mobile/rpc-foundation/goldens/diff-review-snapshot.json
index 9f84bf37f0b1..bab97a02bdc8 100644
--- a/mobile/rpc-foundation/goldens/diff-review-snapshot.json
+++ b/mobile/rpc-foundation/goldens/diff-review-snapshot.json
@@ -3,9 +3,9 @@
   "family": "session.diff-review",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a8016eb61915cf80a3bdeb622ee67d35be8b4b9862a75e4ef2e8f4ff8e93e7f2",
   "scenarioSha256": "fa0a81462196458fdded5b7c00aa4e73975c2111afdd8dac115871490a481da2",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/diff-review-status-unavailable.json b/mobile/rpc-foundation/goldens/diff-review-status-unavailable.json
index ac4b1efac373..f3630340c622 100644
--- a/mobile/rpc-foundation/goldens/diff-review-status-unavailable.json
+++ b/mobile/rpc-foundation/goldens/diff-review-status-unavailable.json
@@ -3,9 +3,9 @@
   "family": "session.diff-review",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a8016eb61915cf80a3bdeb622ee67d35be8b4b9862a75e4ef2e8f4ff8e93e7f2",
   "scenarioSha256": "182f37fbe6ae7c0694b50d603ecd4a03bc9a8c7c9738ebb775b47eb5f3b9660f",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/diff-review-worktree-file-diff.json b/mobile/rpc-foundation/goldens/diff-review-worktree-file-diff.json
index 18c0ea296dba..16b90782cd81 100644
--- a/mobile/rpc-foundation/goldens/diff-review-worktree-file-diff.json
+++ b/mobile/rpc-foundation/goldens/diff-review-worktree-file-diff.json
@@ -3,9 +3,9 @@
   "family": "session.diff-review",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a8016eb61915cf80a3bdeb622ee67d35be8b4b9862a75e4ef2e8f4ff8e93e7f2",
   "scenarioSha256": "538b68485a2268d311fcc7e13ff1a3e446ba4aa010bc18633af8e938a6688257",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/file-tap-open-refused.json b/mobile/rpc-foundation/goldens/file-tap-open-refused.json
index d2d2a042bab0..2c53dc076b7d 100644
--- a/mobile/rpc-foundation/goldens/file-tap-open-refused.json
+++ b/mobile/rpc-foundation/goldens/file-tap-open-refused.json
@@ -3,9 +3,9 @@
   "family": "files.terminal-path-tap",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "e20a76ecd5e820dc4797fb25307810af68b5ced996dba2b9599464a21b5cbe1b",
   "scenarioSha256": "a927e85c3ae58cd3b017955fe28aeffec6a5471b51d782f116639a3aaf4af77d",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/file-tap-opens-worktree-file.json b/mobile/rpc-foundation/goldens/file-tap-opens-worktree-file.json
index 15d1a782c2b5..5fc43a8f830a 100644
--- a/mobile/rpc-foundation/goldens/file-tap-opens-worktree-file.json
+++ b/mobile/rpc-foundation/goldens/file-tap-opens-worktree-file.json
@@ -3,9 +3,9 @@
   "family": "files.terminal-path-tap",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "e20a76ecd5e820dc4797fb25307810af68b5ced996dba2b9599464a21b5cbe1b",
   "scenarioSha256": "297ea4075333e178ca20247eb0abf6600efb44fe2b33f5142d1c1cabffb5a2d3",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/file-tap-previews-absolute-artifact.json b/mobile/rpc-foundation/goldens/file-tap-previews-absolute-artifact.json
index f13b7b96bc23..53215f54c4cc 100644
--- a/mobile/rpc-foundation/goldens/file-tap-previews-absolute-artifact.json
+++ b/mobile/rpc-foundation/goldens/file-tap-previews-absolute-artifact.json
@@ -3,9 +3,9 @@
   "family": "files.terminal-path-tap",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "e20a76ecd5e820dc4797fb25307810af68b5ced996dba2b9599464a21b5cbe1b",
   "scenarioSha256": "f1844c2608ce90250fddfc78c0b35bb1bf3647598a5ab2914eca0d8cb4403a38",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/file-tap-resolve-miss.json b/mobile/rpc-foundation/goldens/file-tap-resolve-miss.json
index 9db2ea750049..8adb1d19d57b 100644
--- a/mobile/rpc-foundation/goldens/file-tap-resolve-miss.json
+++ b/mobile/rpc-foundation/goldens/file-tap-resolve-miss.json
@@ -3,9 +3,9 @@
   "family": "files.terminal-path-tap",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "e20a76ecd5e820dc4797fb25307810af68b5ced996dba2b9599464a21b5cbe1b",
   "scenarioSha256": "0f76b96408081737b3d630ee837dbb80bcce6670b6acc4f1f7c033a69bd40533",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/file-tap-resolve-refused.json b/mobile/rpc-foundation/goldens/file-tap-resolve-refused.json
index fc088e8152fe..0b876017b9f9 100644
--- a/mobile/rpc-foundation/goldens/file-tap-resolve-refused.json
+++ b/mobile/rpc-foundation/goldens/file-tap-resolve-refused.json
@@ -3,9 +3,9 @@
   "family": "files.terminal-path-tap",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "e20a76ecd5e820dc4797fb25307810af68b5ced996dba2b9599464a21b5cbe1b",
   "scenarioSha256": "1ada35966dfb65afbb9b3dc8139961b8f042e2d53241b9608a080d0e655a5987",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/files-explorer-legacy-fallback.json b/mobile/rpc-foundation/goldens/files-explorer-legacy-fallback.json
index d2af44da2e3d..8f9c1b500f20 100644
--- a/mobile/rpc-foundation/goldens/files-explorer-legacy-fallback.json
+++ b/mobile/rpc-foundation/goldens/files-explorer-legacy-fallback.json
@@ -3,9 +3,9 @@
   "family": "files.explorer-screen",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "7a42a348f4407b94cf75ac77a4b6b783b7d28103b1ae1d111d2708dab0dd4a0c",
   "scenarioSha256": "ec02d3f76085619fad35231e12654ec6e926e423c6799fd0df53708743000612",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/files-explorer-readdir.json b/mobile/rpc-foundation/goldens/files-explorer-readdir.json
index f97fcde68dc2..2510dcb8da54 100644
--- a/mobile/rpc-foundation/goldens/files-explorer-readdir.json
+++ b/mobile/rpc-foundation/goldens/files-explorer-readdir.json
@@ -3,9 +3,9 @@
   "family": "files.explorer-screen",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "7a42a348f4407b94cf75ac77a4b6b783b7d28103b1ae1d111d2708dab0dd4a0c",
   "scenarioSha256": "0b87a230cf1c4219e415c840a088502c8bda7cd2fb525bde1a83a5903d6fd96b",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/files-ownership-local.json b/mobile/rpc-foundation/goldens/files-ownership-local.json
index cbc0e219a59e..3c8785507d4f 100644
--- a/mobile/rpc-foundation/goldens/files-ownership-local.json
+++ b/mobile/rpc-foundation/goldens/files-ownership-local.json
@@ -3,9 +3,9 @@
   "family": "files.mutation-ownership",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b93fc8b6f1ece041acaa8cc5699852085e67d7e2f39db13145e483f854ea3309",
   "scenarioSha256": "8d24f52eb4194c3bc5d9f0dcabade6d7a09c066f79f911657647ed21dbecb3b1",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/files-ownership-ssh.json b/mobile/rpc-foundation/goldens/files-ownership-ssh.json
index 3819cbc5c703..869b69ea732f 100644
--- a/mobile/rpc-foundation/goldens/files-ownership-ssh.json
+++ b/mobile/rpc-foundation/goldens/files-ownership-ssh.json
@@ -3,9 +3,9 @@
   "family": "files.mutation-ownership",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b93fc8b6f1ece041acaa8cc5699852085e67d7e2f39db13145e483f854ea3309",
   "scenarioSha256": "4cd0be3a1c338b4b68211c717fd10738653c553fdb3b072db6706ff8175a8bd1",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/files-preview-artifact-direct.json b/mobile/rpc-foundation/goldens/files-preview-artifact-direct.json
index 3cc0e9686fb2..f7ad51f0bf42 100644
--- a/mobile/rpc-foundation/goldens/files-preview-artifact-direct.json
+++ b/mobile/rpc-foundation/goldens/files-preview-artifact-direct.json
@@ -3,9 +3,9 @@
   "family": "files.preview-load",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b93fc8b6f1ece041acaa8cc5699852085e67d7e2f39db13145e483f854ea3309",
   "scenarioSha256": "dd8b7a0916a84c7d763a163759c02210ae99f8fbccfccaa98796b8610c5da97c",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/files-preview-artifact-image-read.json b/mobile/rpc-foundation/goldens/files-preview-artifact-image-read.json
index aa650dc41ec0..2d6eeb2be0ee 100644
--- a/mobile/rpc-foundation/goldens/files-preview-artifact-image-read.json
+++ b/mobile/rpc-foundation/goldens/files-preview-artifact-image-read.json
@@ -3,9 +3,9 @@
   "family": "files.preview-artifact-image",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b93fc8b6f1ece041acaa8cc5699852085e67d7e2f39db13145e483f854ea3309",
   "scenarioSha256": "39fe4bce80a2323dbc276235daab48e7fe55d1fdb9c1ea1eeac7c17bceb8df18",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/files-preview-artifact-image.json b/mobile/rpc-foundation/goldens/files-preview-artifact-image.json
index 8a0b86c9b192..dfdb817d9376 100644
--- a/mobile/rpc-foundation/goldens/files-preview-artifact-image.json
+++ b/mobile/rpc-foundation/goldens/files-preview-artifact-image.json
@@ -3,9 +3,9 @@
   "family": "files.preview-load",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b93fc8b6f1ece041acaa8cc5699852085e67d7e2f39db13145e483f854ea3309",
   "scenarioSha256": "d15c1f4e0f95b5c49a8f889d2d37458225293d7306c8439690d972d2df4c29c0",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/files-preview-grant-refresh.json b/mobile/rpc-foundation/goldens/files-preview-grant-refresh.json
index 991490b5a68e..acedc84c06b9 100644
--- a/mobile/rpc-foundation/goldens/files-preview-grant-refresh.json
+++ b/mobile/rpc-foundation/goldens/files-preview-grant-refresh.json
@@ -3,9 +3,9 @@
   "family": "files.preview-load",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b93fc8b6f1ece041acaa8cc5699852085e67d7e2f39db13145e483f854ea3309",
   "scenarioSha256": "055f3b45442c1736f10ee98c493e2ece1885fdb68d925ee627e2ba20853537e0",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/files-preview-worktree-image-read.json b/mobile/rpc-foundation/goldens/files-preview-worktree-image-read.json
index 0ad6e8704944..639277d8b566 100644
--- a/mobile/rpc-foundation/goldens/files-preview-worktree-image-read.json
+++ b/mobile/rpc-foundation/goldens/files-preview-worktree-image-read.json
@@ -3,9 +3,9 @@
   "family": "files.preview-worktree-image",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b93fc8b6f1ece041acaa8cc5699852085e67d7e2f39db13145e483f854ea3309",
   "scenarioSha256": "767af05bb58756f4adc960b95ee6547cc28145c7f6c7c6a4b27582aed9741e37",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/files-preview-worktree-image.json b/mobile/rpc-foundation/goldens/files-preview-worktree-image.json
index 528f6f6ea143..da550e85887a 100644
--- a/mobile/rpc-foundation/goldens/files-preview-worktree-image.json
+++ b/mobile/rpc-foundation/goldens/files-preview-worktree-image.json
@@ -3,9 +3,9 @@
   "family": "files.preview-load",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b93fc8b6f1ece041acaa8cc5699852085e67d7e2f39db13145e483f854ea3309",
   "scenarioSha256": "0ffaffb472b663e08a42317d799a2a000211dda5b127fb21cc64f04f73800130",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/files-preview-worktree-text-read.json b/mobile/rpc-foundation/goldens/files-preview-worktree-text-read.json
index 4536644fabcd..51a3d994d725 100644
--- a/mobile/rpc-foundation/goldens/files-preview-worktree-text-read.json
+++ b/mobile/rpc-foundation/goldens/files-preview-worktree-text-read.json
@@ -3,9 +3,9 @@
   "family": "files.preview-worktree-text",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b93fc8b6f1ece041acaa8cc5699852085e67d7e2f39db13145e483f854ea3309",
   "scenarioSha256": "21c3c61a18939873157f74c8d2d28bceae01abc702565af1ca897ab7304cb93c",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/files-preview-worktree.json b/mobile/rpc-foundation/goldens/files-preview-worktree.json
index 1e11e3bdea8f..5589a7e33caa 100644
--- a/mobile/rpc-foundation/goldens/files-preview-worktree.json
+++ b/mobile/rpc-foundation/goldens/files-preview-worktree.json
@@ -3,9 +3,9 @@
   "family": "files.preview-load",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b93fc8b6f1ece041acaa8cc5699852085e67d7e2f39db13145e483f854ea3309",
   "scenarioSha256": "bcba4a7d9d929078c5ed80fc7e1acd45859d0b4c559767a919b0396dc6a70a3e",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/files-save-blind.json b/mobile/rpc-foundation/goldens/files-save-blind.json
index ec82d88923d9..a4aada230166 100644
--- a/mobile/rpc-foundation/goldens/files-save-blind.json
+++ b/mobile/rpc-foundation/goldens/files-save-blind.json
@@ -3,9 +3,9 @@
   "family": "files.preview-save",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b93fc8b6f1ece041acaa8cc5699852085e67d7e2f39db13145e483f854ea3309",
   "scenarioSha256": "8b5c3e87d989966d7b252f19a537040cd5078ba9355a824e7e49af3424390a3e",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/files-save-verified.json b/mobile/rpc-foundation/goldens/files-save-verified.json
index edee94bea23c..f457d594a067 100644
--- a/mobile/rpc-foundation/goldens/files-save-verified.json
+++ b/mobile/rpc-foundation/goldens/files-save-verified.json
@@ -3,9 +3,9 @@
   "family": "files.preview-save",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b93fc8b6f1ece041acaa8cc5699852085e67d7e2f39db13145e483f854ea3309",
   "scenarioSha256": "6e124d16173074d851d58593b20b25889ed13a3d8021c08fbed53b85a7d3196e",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/files-tab-doc-shapes.json b/mobile/rpc-foundation/goldens/files-tab-doc-shapes.json
index cba9625cf4d5..5e112a24495a 100644
--- a/mobile/rpc-foundation/goldens/files-tab-doc-shapes.json
+++ b/mobile/rpc-foundation/goldens/files-tab-doc-shapes.json
@@ -3,9 +3,9 @@
   "family": "files.tab-doc",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b93fc8b6f1ece041acaa8cc5699852085e67d7e2f39db13145e483f854ea3309",
   "scenarioSha256": "b636221f719dae19a3af6772b687b0bcb300c9910645d23e98c309578ec1c5c5",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/home-host-accounts.json b/mobile/rpc-foundation/goldens/home-host-accounts.json
index 708ae3d8ff5a..138ee27c5788 100644
--- a/mobile/rpc-foundation/goldens/home-host-accounts.json
+++ b/mobile/rpc-foundation/goldens/home-host-accounts.json
@@ -3,9 +3,9 @@
   "family": "home.host-accounts",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c632fdbc4b730777ecb09f08bec14cca0586042b01ed99d40d0228806c7def4a",
   "scenarioSha256": "366426641e25542fcc6fcd351ece6a1ee897c8b3974c08eb7557eadfa4d3b06f",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/home-host-stats.json b/mobile/rpc-foundation/goldens/home-host-stats.json
index 654734a8b56f..1a582a218848 100644
--- a/mobile/rpc-foundation/goldens/home-host-stats.json
+++ b/mobile/rpc-foundation/goldens/home-host-stats.json
@@ -3,9 +3,9 @@
   "family": "home.host-stats",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a9e0780298a1443664e7ae02056168aa34d67556c9c056d51a82c7b4a73ad35b",
   "scenarioSha256": "bd5f4e5f24a29d96c4c98950691c6571918332f71ebb1f29ee97a9abc857ac29",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/host-view-settings-sync.json b/mobile/rpc-foundation/goldens/host-view-settings-sync.json
index eecef703ed94..42c1e36b480b 100644
--- a/mobile/rpc-foundation/goldens/host-view-settings-sync.json
+++ b/mobile/rpc-foundation/goldens/host-view-settings-sync.json
@@ -3,9 +3,9 @@
   "family": "host.view-settings",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a9e0780298a1443664e7ae02056168aa34d67556c9c056d51a82c7b4a73ad35b",
   "scenarioSha256": "1ee6031227fa3efd5b36841afa60f7b2264eacdd9c6126e5851d5acb39ffaadd",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/host-worktree-actions-pin-open-delete.json b/mobile/rpc-foundation/goldens/host-worktree-actions-pin-open-delete.json
index 279d97c34f6c..1783e6c491b7 100644
--- a/mobile/rpc-foundation/goldens/host-worktree-actions-pin-open-delete.json
+++ b/mobile/rpc-foundation/goldens/host-worktree-actions-pin-open-delete.json
@@ -3,9 +3,9 @@
   "family": "host.worktree-actions",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "92c29bd78ca0c0d5917e9386fc447bb9a1698b1d1ffaba0db7546eaac60da639",
   "scenarioSha256": "720add498c79425ca8efc9764fd5d8307fe33bc891842604cfc899f770b79811",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/host-worktree-delete-refused.json b/mobile/rpc-foundation/goldens/host-worktree-delete-refused.json
index 304e215d9060..7f7cad606f50 100644
--- a/mobile/rpc-foundation/goldens/host-worktree-delete-refused.json
+++ b/mobile/rpc-foundation/goldens/host-worktree-delete-refused.json
@@ -3,9 +3,9 @@
   "family": "host.worktree-actions",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "92c29bd78ca0c0d5917e9386fc447bb9a1698b1d1ffaba0db7546eaac60da639",
   "scenarioSha256": "5dd5e7eabaabba1e471b13958f59891c3b28f553087c96315598c83a14ded7e7",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/host-worktree-refresh-stream.json b/mobile/rpc-foundation/goldens/host-worktree-refresh-stream.json
index 0cd99cfea3da..e10f751b1f33 100644
--- a/mobile/rpc-foundation/goldens/host-worktree-refresh-stream.json
+++ b/mobile/rpc-foundation/goldens/host-worktree-refresh-stream.json
@@ -3,9 +3,9 @@
   "family": "host-worktree-refresh",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "8e41c8624b9b6185e447cee3590a851ab88b6b1ee1d632af90e3a771a90310be",
   "scenarioSha256": "6ac11f1ab42fea3b718d9714e512a4e8a344aea66ae170fbe9ef2b5ae82dbe0a",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/interruptions-inventory-lifecycle.json b/mobile/rpc-foundation/goldens/interruptions-inventory-lifecycle.json
index 863ea20d0d1a..a1e43b0e0729 100644
--- a/mobile/rpc-foundation/goldens/interruptions-inventory-lifecycle.json
+++ b/mobile/rpc-foundation/goldens/interruptions-inventory-lifecycle.json
@@ -3,9 +3,9 @@
   "family": "legacy-inventory",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "262eaad263a45aa13ec5b27c12b59946b12c202474229fff7a5727dba6d702ca",
   "scenarioSha256": "d6c57a5153d915f0a0c0fd9e305cac70b41b7eb8be226fc865227ebf1821e5d1",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/interruptions-settings-bot-overrides-fulfilled.json b/mobile/rpc-foundation/goldens/interruptions-settings-bot-overrides-fulfilled.json
index e5f209c60ad0..a80a49405f37 100644
--- a/mobile/rpc-foundation/goldens/interruptions-settings-bot-overrides-fulfilled.json
+++ b/mobile/rpc-foundation/goldens/interruptions-settings-bot-overrides-fulfilled.json
@@ -3,9 +3,9 @@
   "family": "settings.bot-overrides",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "2d5c6dea28aa1a7bb9e4aa14a4c8441527d9ad401ad30161f05ea1f8da836bb2",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/inventory-lifecycle.json b/mobile/rpc-foundation/goldens/inventory-lifecycle.json
index 2ed4291612a6..86cc5a797be1 100644
--- a/mobile/rpc-foundation/goldens/inventory-lifecycle.json
+++ b/mobile/rpc-foundation/goldens/inventory-lifecycle.json
@@ -3,9 +3,9 @@
   "family": "legacy-inventory",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "262eaad263a45aa13ec5b27c12b59946b12c202474229fff7a5727dba6d702ca",
   "scenarioSha256": "3471f5bcd6923c7b8ba3a737bb45b5239689deb78c00e85a828f38a6d6d68a05",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/inventory-repeat-query.json b/mobile/rpc-foundation/goldens/inventory-repeat-query.json
index 82ddc0490e0b..e13e271c53f6 100644
--- a/mobile/rpc-foundation/goldens/inventory-repeat-query.json
+++ b/mobile/rpc-foundation/goldens/inventory-repeat-query.json
@@ -3,9 +3,9 @@
   "family": "legacy-inventory",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "262eaad263a45aa13ec5b27c12b59946b12c202474229fff7a5727dba6d702ca",
   "scenarioSha256": "73a468d5c7a51c2dbb7af2642f0050d05d861fce29295460c48d7c51f86bf57f",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/lifecycle-b3.json b/mobile/rpc-foundation/goldens/lifecycle-b3.json
index 9e4cec6ea273..70e4e2bbcbae 100644
--- a/mobile/rpc-foundation/goldens/lifecycle-b3.json
+++ b/mobile/rpc-foundation/goldens/lifecycle-b3.json
@@ -3,9 +3,9 @@
   "family": "linear-detail-barrier",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "d3b7f33d810e1fa420ac41a628cde9fe4a9e65fd57f89fbca0a40fc7d74951ab",
   "scenarioSha256": "8be12d116865d27e8dfd37921d2c723d63da101ec1197b1f5b2d9510838e1943",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/lifecycle-inventory-lifecycle.json b/mobile/rpc-foundation/goldens/lifecycle-inventory-lifecycle.json
index e0885db66ae2..70618945c1cd 100644
--- a/mobile/rpc-foundation/goldens/lifecycle-inventory-lifecycle.json
+++ b/mobile/rpc-foundation/goldens/lifecycle-inventory-lifecycle.json
@@ -3,9 +3,9 @@
   "family": "legacy-inventory",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "262eaad263a45aa13ec5b27c12b59946b12c202474229fff7a5727dba6d702ca",
   "scenarioSha256": "46bbafcc57fe2e3aee41a14bc26a0375b7b56e58030705fe4c28841a272b2560",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/lifecycle-settings-bot-overrides-fulfilled.json b/mobile/rpc-foundation/goldens/lifecycle-settings-bot-overrides-fulfilled.json
index c47ae1338bac..1b5f354c5f17 100644
--- a/mobile/rpc-foundation/goldens/lifecycle-settings-bot-overrides-fulfilled.json
+++ b/mobile/rpc-foundation/goldens/lifecycle-settings-bot-overrides-fulfilled.json
@@ -3,9 +3,9 @@
   "family": "settings.bot-overrides",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "eb80283956c93849778f23cbabf1dbf83b72744197af4f6f50335b2fc1590d87",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/lifecycle-settings-task-hydration-fulfilled.json b/mobile/rpc-foundation/goldens/lifecycle-settings-task-hydration-fulfilled.json
index 84ba8326b1a7..32b971e6c965 100644
--- a/mobile/rpc-foundation/goldens/lifecycle-settings-task-hydration-fulfilled.json
+++ b/mobile/rpc-foundation/goldens/lifecycle-settings-task-hydration-fulfilled.json
@@ -3,9 +3,9 @@
   "family": "settings.task-hydration",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "3a8eab831602443d320ca0aa0f35dc269d8d511e76bdae8fd025c433561d068d",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/lifecycle-settings-workspace-context-fulfilled.json b/mobile/rpc-foundation/goldens/lifecycle-settings-workspace-context-fulfilled.json
index 596040608174..bb177b8f14a8 100644
--- a/mobile/rpc-foundation/goldens/lifecycle-settings-workspace-context-fulfilled.json
+++ b/mobile/rpc-foundation/goldens/lifecycle-settings-workspace-context-fulfilled.json
@@ -3,9 +3,9 @@
   "family": "settings.workspace-context",
   "namedDeltas": ["new-workspace-runtime-context-null-results-degrade-to-absent"],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "136fb1d8d5925ad12ba22f4dd6c72573a9ad03b6a6ec8308668f0d9cd71aa36d",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/linear-select-workspace.json b/mobile/rpc-foundation/goldens/linear-select-workspace.json
index 4213ec2ba39e..6d66f10d6e72 100644
--- a/mobile/rpc-foundation/goldens/linear-select-workspace.json
+++ b/mobile/rpc-foundation/goldens/linear-select-workspace.json
@@ -3,9 +3,9 @@
   "family": "linear.select-workspace-picker",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b65996c152b632d553a31e07e31ea5c76f998eada42cf0966923d730da21908f",
   "scenarioSha256": "b6eb40d9a91c89179483afec93fbc121b99ef679d3b2433575b26694d0c577d5",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/live-worktree-name-stream.json b/mobile/rpc-foundation/goldens/live-worktree-name-stream.json
index 4311d04732ee..0eb76ef03a33 100644
--- a/mobile/rpc-foundation/goldens/live-worktree-name-stream.json
+++ b/mobile/rpc-foundation/goldens/live-worktree-name-stream.json
@@ -3,9 +3,9 @@
   "family": "live-worktree-name",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "8e41c8624b9b6185e447cee3590a851ab88b6b1ee1d632af90e3a771a90310be",
   "scenarioSha256": "056abf42b34537025fed30a4401bd465c93bc21558babb826f21b5c803b487eb",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-agentsession.structured-create-agentsession.create-1.json b/mobile/rpc-foundation/goldens/matrix-agentsession.structured-create-agentsession.create-1.json
index 5fd79f912093..0dd95e326d02 100644
--- a/mobile/rpc-foundation/goldens/matrix-agentsession.structured-create-agentsession.create-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-agentsession.structured-create-agentsession.create-1.json
@@ -3,9 +3,9 @@
   "family": "agentSession.structured-create",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "d340697a64a198066b1037a550afb9a0de7507246a545901d2fc0a23407f38d6",
   "scenarioSha256": "81ed7c1a4276cf1d891334c64c06362b88b5f9690b3ebae6d0988559b1faab0f",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-agentsession.structured-create-agentsession.createsupport-1.json b/mobile/rpc-foundation/goldens/matrix-agentsession.structured-create-agentsession.createsupport-1.json
index e1e605ec8fc4..2aa03df5a0b1 100644
--- a/mobile/rpc-foundation/goldens/matrix-agentsession.structured-create-agentsession.createsupport-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-agentsession.structured-create-agentsession.createsupport-1.json
@@ -3,9 +3,9 @@
   "family": "agentSession.structured-create",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "d340697a64a198066b1037a550afb9a0de7507246a545901d2fc0a23407f38d6",
   "scenarioSha256": "eed54b1c4c77eec4b411d8daa197b20c8cfb4b86ac2d01f1d7ee2de23c27dff8",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-agentsession.structured-launch-agentsession.createsupport-1.json b/mobile/rpc-foundation/goldens/matrix-agentsession.structured-launch-agentsession.createsupport-1.json
index 49ae0d7e6621..ff9b97185738 100644
--- a/mobile/rpc-foundation/goldens/matrix-agentsession.structured-launch-agentsession.createsupport-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-agentsession.structured-launch-agentsession.createsupport-1.json
@@ -3,9 +3,9 @@
   "family": "agentSession.structured-launch",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "d340697a64a198066b1037a550afb9a0de7507246a545901d2fc0a23407f38d6",
   "scenarioSha256": "211e3780edc0ff5fa0529c0de0e8bc2fd746a19c8a6b4e49900f6c4e56d53f7c",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-aivault.history-aivault.listsessions-1.json b/mobile/rpc-foundation/goldens/matrix-aivault.history-aivault.listsessions-1.json
index a952c2f1c227..f1c1ee9933e5 100644
--- a/mobile/rpc-foundation/goldens/matrix-aivault.history-aivault.listsessions-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-aivault.history-aivault.listsessions-1.json
@@ -3,9 +3,9 @@
   "family": "aiVault.history",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "ec16931c5431d3dbb05729d4670c381a434bff71648d334b7b5224db188fdccb",
   "scenarioSha256": "efb8d1cd2a2ff0ade4cdc48a1aacec565e33b405bbe95c100b86534cdde49740",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-aivault.history-screen-platform-status.json b/mobile/rpc-foundation/goldens/matrix-aivault.history-screen-platform-status.json
index 0ef5b9a71073..9abbabeb5455 100644
--- a/mobile/rpc-foundation/goldens/matrix-aivault.history-screen-platform-status.json
+++ b/mobile/rpc-foundation/goldens/matrix-aivault.history-screen-platform-status.json
@@ -3,9 +3,9 @@
   "family": "aiVault.history-screen",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c78ab47eea594b7e1988403321ff9ba135ca60c513bb9d5848bdde26c0ffe3c3",
   "scenarioSha256": "30e00c0d94413aab61b164fb9a658e526448addc4c42fd8892b1c28335d30beb",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-aivault.history-screen-status.get-2.json b/mobile/rpc-foundation/goldens/matrix-aivault.history-screen-status.get-2.json
index 4fab6aabbbd4..7c7e63ff8e6b 100644
--- a/mobile/rpc-foundation/goldens/matrix-aivault.history-screen-status.get-2.json
+++ b/mobile/rpc-foundation/goldens/matrix-aivault.history-screen-status.get-2.json
@@ -3,9 +3,9 @@
   "family": "aiVault.history-screen",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c78ab47eea594b7e1988403321ff9ba135ca60c513bb9d5848bdde26c0ffe3c3",
   "scenarioSha256": "b146be741484f2a6dca25e97f52b9ed10f8a2b28bd00e6b56acffbcd82136b2f",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-aivault.history-screen-worktree.ps-1.json b/mobile/rpc-foundation/goldens/matrix-aivault.history-screen-worktree.ps-1.json
index 2faa872fabf2..25f821fee695 100644
--- a/mobile/rpc-foundation/goldens/matrix-aivault.history-screen-worktree.ps-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-aivault.history-screen-worktree.ps-1.json
@@ -3,9 +3,9 @@
   "family": "aiVault.history-screen",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c78ab47eea594b7e1988403321ff9ba135ca60c513bb9d5848bdde26c0ffe3c3",
   "scenarioSha256": "5365449c24d789c6c01604b520b795502d0bec352032686efecd121fc4497f96",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-aivault.history-status.get-1.json b/mobile/rpc-foundation/goldens/matrix-aivault.history-status.get-1.json
index 8ed82ab367c1..6873290ccf1a 100644
--- a/mobile/rpc-foundation/goldens/matrix-aivault.history-status.get-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-aivault.history-status.get-1.json
@@ -3,9 +3,9 @@
   "family": "aiVault.history",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "ec16931c5431d3dbb05729d4670c381a434bff71648d334b7b5224db188fdccb",
   "scenarioSha256": "a5698ca720dad08561a509c9c18f7586611fc68c58bd86791f4fcefc7915ab1f",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-aivault.resume-launch-session.tabs.createterminal-1.json b/mobile/rpc-foundation/goldens/matrix-aivault.resume-launch-session.tabs.createterminal-1.json
index 87d14c75d512..b35d25482ee0 100644
--- a/mobile/rpc-foundation/goldens/matrix-aivault.resume-launch-session.tabs.createterminal-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-aivault.resume-launch-session.tabs.createterminal-1.json
@@ -3,9 +3,9 @@
   "family": "aiVault.resume-launch",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "2f43211e4084c0493bd02ec98868acf53a4c748f89a70cd9657c9c3ee87b12fb",
   "scenarioSha256": "f721ab4438c4183927ce5ebc5fd6f1f18414701a5fa3b2807c359785829962a3",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-aivault.resume-launch-terminal.send-1.json b/mobile/rpc-foundation/goldens/matrix-aivault.resume-launch-terminal.send-1.json
index e479c4e12e7f..f19801409636 100644
--- a/mobile/rpc-foundation/goldens/matrix-aivault.resume-launch-terminal.send-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-aivault.resume-launch-terminal.send-1.json
@@ -3,9 +3,9 @@
   "family": "aiVault.resume-launch",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "2f43211e4084c0493bd02ec98868acf53a4c748f89a70cd9657c9c3ee87b12fb",
   "scenarioSha256": "aa812132ede83e4aced73a644e996df82a38bfc70ead70a5db2e9af8a8b1bfff",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-aivault.resume-preparation-aivault.preparesessionresume-1.json b/mobile/rpc-foundation/goldens/matrix-aivault.resume-preparation-aivault.preparesessionresume-1.json
index 40039c0d266d..41b607ed3f69 100644
--- a/mobile/rpc-foundation/goldens/matrix-aivault.resume-preparation-aivault.preparesessionresume-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-aivault.resume-preparation-aivault.preparesessionresume-1.json
@@ -3,9 +3,9 @@
   "family": "aiVault.resume-preparation",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "2f43211e4084c0493bd02ec98868acf53a4c748f89a70cd9657c9c3ee87b12fb",
   "scenarioSha256": "c3b400967b0b1c7bd3f82a278f4b10855ade72d384922ec4d34795c7bb20084d",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-browser.dialog-browser.dialogaccept-1.json b/mobile/rpc-foundation/goldens/matrix-browser.dialog-browser.dialogaccept-1.json
index 17b5d5354860..675841953d70 100644
--- a/mobile/rpc-foundation/goldens/matrix-browser.dialog-browser.dialogaccept-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-browser.dialog-browser.dialogaccept-1.json
@@ -3,9 +3,9 @@
   "family": "browser.dialog",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "55971752f963202d30160851197a301089b0f3ebd0c46725af1a461d8310d658",
   "scenarioSha256": "9cae732e4227d4c2fe874a5fb2e104552c16cbc91b59523de8fd46454660cde8",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-browser.keyboard-browser.keyboardinserttext-1.json b/mobile/rpc-foundation/goldens/matrix-browser.keyboard-browser.keyboardinserttext-1.json
index f9536456b20c..82d458cc64b5 100644
--- a/mobile/rpc-foundation/goldens/matrix-browser.keyboard-browser.keyboardinserttext-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-browser.keyboard-browser.keyboardinserttext-1.json
@@ -3,9 +3,9 @@
   "family": "browser.keyboard",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "55971752f963202d30160851197a301089b0f3ebd0c46725af1a461d8310d658",
   "scenarioSha256": "fc3411f3f4cb58b6a1338ea943f59446fda7819931814e9ab002e35e2de42462",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-browser.keyboard-browser.keypress-1.json b/mobile/rpc-foundation/goldens/matrix-browser.keyboard-browser.keypress-1.json
index c96f9cba5717..d359fa7f8255 100644
--- a/mobile/rpc-foundation/goldens/matrix-browser.keyboard-browser.keypress-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-browser.keyboard-browser.keypress-1.json
@@ -3,9 +3,9 @@
   "family": "browser.keyboard",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "55971752f963202d30160851197a301089b0f3ebd0c46725af1a461d8310d658",
   "scenarioSha256": "c1df871e84d4399e9a447caaff244241933c0dfc7c3d5e114d022e54b0ed7ed4",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-browser.pointer-click-browser.mouseclick-1.json b/mobile/rpc-foundation/goldens/matrix-browser.pointer-click-browser.mouseclick-1.json
index b53f11178f20..0a86c5777cfd 100644
--- a/mobile/rpc-foundation/goldens/matrix-browser.pointer-click-browser.mouseclick-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-browser.pointer-click-browser.mouseclick-1.json
@@ -3,9 +3,9 @@
   "family": "browser.pointer-click",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "55971752f963202d30160851197a301089b0f3ebd0c46725af1a461d8310d658",
   "scenarioSha256": "91a1ef5e07178585f583dd1609543c3bfb0c71d13eb4ce1eedab3acc2635f0da",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-browser.pointer-click-browser.mousedown-1.json b/mobile/rpc-foundation/goldens/matrix-browser.pointer-click-browser.mousedown-1.json
index 01192a5ad11d..d8ef9402bd4b 100644
--- a/mobile/rpc-foundation/goldens/matrix-browser.pointer-click-browser.mousedown-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-browser.pointer-click-browser.mousedown-1.json
@@ -3,9 +3,9 @@
   "family": "browser.pointer-click",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "55971752f963202d30160851197a301089b0f3ebd0c46725af1a461d8310d658",
   "scenarioSha256": "a302565f0172a763bfb0865389849703d3ceb52d848e1bc40f2204ce7f97bbef",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-browser.pointer-click-browser.mousemove-1.json b/mobile/rpc-foundation/goldens/matrix-browser.pointer-click-browser.mousemove-1.json
index d1a4bcde2f5e..e156567d6962 100644
--- a/mobile/rpc-foundation/goldens/matrix-browser.pointer-click-browser.mousemove-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-browser.pointer-click-browser.mousemove-1.json
@@ -3,9 +3,9 @@
   "family": "browser.pointer-click",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "55971752f963202d30160851197a301089b0f3ebd0c46725af1a461d8310d658",
   "scenarioSha256": "33cb8faa9c8b50945a2d8275140c65f483b8023c890a5a16165a759f0a59baad",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-browser.pointer-click-browser.mouseup-1.json b/mobile/rpc-foundation/goldens/matrix-browser.pointer-click-browser.mouseup-1.json
index 3406570d8451..480078b28956 100644
--- a/mobile/rpc-foundation/goldens/matrix-browser.pointer-click-browser.mouseup-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-browser.pointer-click-browser.mouseup-1.json
@@ -3,9 +3,9 @@
   "family": "browser.pointer-click",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "55971752f963202d30160851197a301089b0f3ebd0c46725af1a461d8310d658",
   "scenarioSha256": "96c4862084d7ba2a8e07047abcee1716220ba35d9c754bcb97f7227020976c95",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-browser.wheel-browser.mousemove-1.json b/mobile/rpc-foundation/goldens/matrix-browser.wheel-browser.mousemove-1.json
index f9d656b0d9f0..ac2d3276d30b 100644
--- a/mobile/rpc-foundation/goldens/matrix-browser.wheel-browser.mousemove-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-browser.wheel-browser.mousemove-1.json
@@ -3,9 +3,9 @@
   "family": "browser.wheel",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "55971752f963202d30160851197a301089b0f3ebd0c46725af1a461d8310d658",
   "scenarioSha256": "c1283bbfb340e968bbd4c86ac63489995d6191290751316228d27779dc6a2c55",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-browser.wheel-browser.mousewheel-1.json b/mobile/rpc-foundation/goldens/matrix-browser.wheel-browser.mousewheel-1.json
index a47000279bc6..4f6c047f4dc1 100644
--- a/mobile/rpc-foundation/goldens/matrix-browser.wheel-browser.mousewheel-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-browser.wheel-browser.mousewheel-1.json
@@ -3,9 +3,9 @@
   "family": "browser.wheel",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "55971752f963202d30160851197a301089b0f3ebd0c46725af1a461d8310d658",
   "scenarioSha256": "092777c9ce457dcae95eafbe083c70510580569ac74e31c0d4224ac94b9fad76",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-clipboard.image-attachment-clipboard.startimageupload-1.json b/mobile/rpc-foundation/goldens/matrix-clipboard.image-attachment-clipboard.startimageupload-1.json
index 20b8478b685b..fe3c3c6a406e 100644
--- a/mobile/rpc-foundation/goldens/matrix-clipboard.image-attachment-clipboard.startimageupload-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-clipboard.image-attachment-clipboard.startimageupload-1.json
@@ -3,9 +3,9 @@
   "family": "clipboard.image-attachment",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "16779b663f4faec8cbccdb42efd7b568a2912845b161f8a4827754687eb4235c",
   "scenarioSha256": "fc690a2ac59a6fbcdc08f9b91e769cd793f5a48d9034a50c2d587ce0d0fca3d9",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-clipboard.image-upload-clipboard.saveimageastempfile-1.json b/mobile/rpc-foundation/goldens/matrix-clipboard.image-upload-clipboard.saveimageastempfile-1.json
index cd252dcbae23..5f569d3594b8 100644
--- a/mobile/rpc-foundation/goldens/matrix-clipboard.image-upload-clipboard.saveimageastempfile-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-clipboard.image-upload-clipboard.saveimageastempfile-1.json
@@ -3,9 +3,9 @@
   "family": "clipboard.image-upload",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "16779b663f4faec8cbccdb42efd7b568a2912845b161f8a4827754687eb4235c",
   "scenarioSha256": "fa69748b6d0e29abc37757b48bcb22dac07af1686554200ceaf18b4e3d62e4ac",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-clipboard.image-upload-clipboard.startimageupload-1.json b/mobile/rpc-foundation/goldens/matrix-clipboard.image-upload-clipboard.startimageupload-1.json
index 541b816ed6c9..a6a213fa2e98 100644
--- a/mobile/rpc-foundation/goldens/matrix-clipboard.image-upload-clipboard.startimageupload-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-clipboard.image-upload-clipboard.startimageupload-1.json
@@ -3,9 +3,9 @@
   "family": "clipboard.image-upload",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "16779b663f4faec8cbccdb42efd7b568a2912845b161f8a4827754687eb4235c",
   "scenarioSha256": "a4bea606723da4d4a86db6e04c46266801149a852a8861b15e637d5c0855c679",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-components.codex-reset-capability-status.get-1.json b/mobile/rpc-foundation/goldens/matrix-components.codex-reset-capability-status.get-1.json
index cb63d591b7d1..1584210054ee 100644
--- a/mobile/rpc-foundation/goldens/matrix-components.codex-reset-capability-status.get-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-components.codex-reset-capability-status.get-1.json
@@ -3,9 +3,9 @@
   "family": "components.codex-reset-capability",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5cfbce3c7d97d908fbd447646d611e41a8aa1f61f684b9b710c4b67d6ff023a7",
   "scenarioSha256": "06c2ad6d4b464f889a640be7a238f6d0ff7c54b0e93fb5ea22aaa856dadb0336",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-components.codex-reset-credit-accounts.consumecodexresetcredit-1.json b/mobile/rpc-foundation/goldens/matrix-components.codex-reset-credit-accounts.consumecodexresetcredit-1.json
index 476633dcdf48..467f627c04ae 100644
--- a/mobile/rpc-foundation/goldens/matrix-components.codex-reset-credit-accounts.consumecodexresetcredit-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-components.codex-reset-credit-accounts.consumecodexresetcredit-1.json
@@ -3,9 +3,9 @@
   "family": "components.codex-reset-credit",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "76b53dea504a688493843e23e8e7d052fc196f559bb1e2579d0fd38bf3156d0e",
   "scenarioSha256": "cc6de73be00be072f9a3b7fd63459fd1a529c45d0916a67d5fe6d90dbee61e91",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-components.execution-target-local-preflight.detectagents-1.json b/mobile/rpc-foundation/goldens/matrix-components.execution-target-local-preflight.detectagents-1.json
index 3212a72b2544..ad5a116fd680 100644
--- a/mobile/rpc-foundation/goldens/matrix-components.execution-target-local-preflight.detectagents-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-components.execution-target-local-preflight.detectagents-1.json
@@ -3,9 +3,9 @@
   "family": "components.execution-target-local",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5cfbce3c7d97d908fbd447646d611e41a8aa1f61f684b9b710c4b67d6ff023a7",
   "scenarioSha256": "f88ee2f5d19b19cc53dca5180a9b5936a13a00a82e8a4636a5e895262b669dec",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-components.execution-target-preflight.detectremoteagents-1.json b/mobile/rpc-foundation/goldens/matrix-components.execution-target-preflight.detectremoteagents-1.json
index 484fdd1fc6bb..ee80824dc831 100644
--- a/mobile/rpc-foundation/goldens/matrix-components.execution-target-preflight.detectremoteagents-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-components.execution-target-preflight.detectremoteagents-1.json
@@ -3,9 +3,9 @@
   "family": "components.execution-target",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5cfbce3c7d97d908fbd447646d611e41a8aa1f61f684b9b710c4b67d6ff023a7",
   "scenarioSha256": "79a49cddf66935007afb9be8a30593b778f02237894e5fd4d2898b526fc125df",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-components.execution-target-ssh.connect-1.json b/mobile/rpc-foundation/goldens/matrix-components.execution-target-ssh.connect-1.json
index ea7b9b35f5e0..ee6a81d855a2 100644
--- a/mobile/rpc-foundation/goldens/matrix-components.execution-target-ssh.connect-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-components.execution-target-ssh.connect-1.json
@@ -3,9 +3,9 @@
   "family": "components.execution-target",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5cfbce3c7d97d908fbd447646d611e41a8aa1f61f684b9b710c4b67d6ff023a7",
   "scenarioSha256": "8b8f7fe7227d44330e216e0bf5d366c41b54d9bf76acfb24df2c1770984b9f27",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-components.execution-target-ssh.getstate-1.json b/mobile/rpc-foundation/goldens/matrix-components.execution-target-ssh.getstate-1.json
index b4c9fbb3f0cf..5b54a462fe2b 100644
--- a/mobile/rpc-foundation/goldens/matrix-components.execution-target-ssh.getstate-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-components.execution-target-ssh.getstate-1.json
@@ -3,9 +3,9 @@
   "family": "components.execution-target",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5cfbce3c7d97d908fbd447646d611e41a8aa1f61f684b9b710c4b67d6ff023a7",
   "scenarioSha256": "6832d23c6500e4fcb20abe7c53bc4f5abe72180dc0ad747a4907b82d99bc75d0",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-components.new-workspace-repositories-repo.list-1.json b/mobile/rpc-foundation/goldens/matrix-components.new-workspace-repositories-repo.list-1.json
index 9a048b1baf53..ffd3f00d8559 100644
--- a/mobile/rpc-foundation/goldens/matrix-components.new-workspace-repositories-repo.list-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-components.new-workspace-repositories-repo.list-1.json
@@ -3,9 +3,9 @@
   "family": "components.new-workspace-repositories",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "64c1772f0f95a3c43fbb14398a8804b2b4784f7f18874e4fd79767ae634c7faa",
   "scenarioSha256": "95f7dbb11bca7203d29bd13230d4a286f49ff20596535163094e1bff73e7f3cb",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-components.setup-script-repo.hooks-1.json b/mobile/rpc-foundation/goldens/matrix-components.setup-script-repo.hooks-1.json
index 43ee28e2985c..ca1e153e8d73 100644
--- a/mobile/rpc-foundation/goldens/matrix-components.setup-script-repo.hooks-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-components.setup-script-repo.hooks-1.json
@@ -3,9 +3,9 @@
   "family": "components.setup-script",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5cfbce3c7d97d908fbd447646d611e41a8aa1f61f684b9b710c4b67d6ff023a7",
   "scenarioSha256": "a844134d7bad3c7c12107d60dbd298f5cfba778703fb9dd0f7ad454615d26b07",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-files.explorer-screen-files.list-1.json b/mobile/rpc-foundation/goldens/matrix-files.explorer-screen-files.list-1.json
index 45e652894f78..f1f02ac024c4 100644
--- a/mobile/rpc-foundation/goldens/matrix-files.explorer-screen-files.list-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-files.explorer-screen-files.list-1.json
@@ -3,9 +3,9 @@
   "family": "files.explorer-screen",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "7a42a348f4407b94cf75ac77a4b6b783b7d28103b1ae1d111d2708dab0dd4a0c",
   "scenarioSha256": "38b5590173c1f6791d1b35c0f036e2f844ed4b0e39c880e8e376c5f314adaade",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-files.explorer-screen-files.readdir-1.json b/mobile/rpc-foundation/goldens/matrix-files.explorer-screen-files.readdir-1.json
index b07b71e98da4..012059fdf035 100644
--- a/mobile/rpc-foundation/goldens/matrix-files.explorer-screen-files.readdir-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-files.explorer-screen-files.readdir-1.json
@@ -3,9 +3,9 @@
   "family": "files.explorer-screen",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "7a42a348f4407b94cf75ac77a4b6b783b7d28103b1ae1d111d2708dab0dd4a0c",
   "scenarioSha256": "8c1fa604104c5551b8418af225c9420b1292f0c55b392f847985947c66749959",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-files.mutation-ownership-ssh.getstate-1.json b/mobile/rpc-foundation/goldens/matrix-files.mutation-ownership-ssh.getstate-1.json
index acbef18e1aeb..9958e76d69ac 100644
--- a/mobile/rpc-foundation/goldens/matrix-files.mutation-ownership-ssh.getstate-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-files.mutation-ownership-ssh.getstate-1.json
@@ -3,9 +3,9 @@
   "family": "files.mutation-ownership",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b93fc8b6f1ece041acaa8cc5699852085e67d7e2f39db13145e483f854ea3309",
   "scenarioSha256": "5815450e8d07f463423ca0bd8237830791c220234201abffc6fa13e698913516",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-files.mutation-ownership-status.get-1.json b/mobile/rpc-foundation/goldens/matrix-files.mutation-ownership-status.get-1.json
index 5062f9399a55..4797219f6744 100644
--- a/mobile/rpc-foundation/goldens/matrix-files.mutation-ownership-status.get-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-files.mutation-ownership-status.get-1.json
@@ -3,9 +3,9 @@
   "family": "files.mutation-ownership",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b93fc8b6f1ece041acaa8cc5699852085e67d7e2f39db13145e483f854ea3309",
   "scenarioSha256": "b9cfb187224a4b42efe8ccfcd96145833730d135c4fffa345716f95991a4700f",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-files.mutation-ownership-worktree.show-1.json b/mobile/rpc-foundation/goldens/matrix-files.mutation-ownership-worktree.show-1.json
index 161e7cdb18f3..04ca092f7615 100644
--- a/mobile/rpc-foundation/goldens/matrix-files.mutation-ownership-worktree.show-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-files.mutation-ownership-worktree.show-1.json
@@ -3,9 +3,9 @@
   "family": "files.mutation-ownership",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b93fc8b6f1ece041acaa8cc5699852085e67d7e2f39db13145e483f854ea3309",
   "scenarioSha256": "0bf3b17048bceb0bc8592405facd99cb8086274509206d9e55cd589a05d7415f",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-files.preview-artifact-image-files.readterminalartifactpreview-1.json b/mobile/rpc-foundation/goldens/matrix-files.preview-artifact-image-files.readterminalartifactpreview-1.json
index 0e89d2dec133..b44c387ac7cf 100644
--- a/mobile/rpc-foundation/goldens/matrix-files.preview-artifact-image-files.readterminalartifactpreview-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-files.preview-artifact-image-files.readterminalartifactpreview-1.json
@@ -3,9 +3,9 @@
   "family": "files.preview-artifact-image",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b93fc8b6f1ece041acaa8cc5699852085e67d7e2f39db13145e483f854ea3309",
   "scenarioSha256": "83cad9595793b30d38115ba7118ae1400ecb2af21327853183e91289f4f33a04",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-files.preview-load-files.readterminalartifact-1.json b/mobile/rpc-foundation/goldens/matrix-files.preview-load-files.readterminalartifact-1.json
index 0cbc76708401..2a0289521209 100644
--- a/mobile/rpc-foundation/goldens/matrix-files.preview-load-files.readterminalartifact-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-files.preview-load-files.readterminalartifact-1.json
@@ -3,9 +3,9 @@
   "family": "files.preview-load",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b93fc8b6f1ece041acaa8cc5699852085e67d7e2f39db13145e483f854ea3309",
   "scenarioSha256": "dbd20e271999641affbd4b52635c8864e25f08aa6db820a46d0773faa09770c6",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-files.preview-load-files.readterminalartifact-2.json b/mobile/rpc-foundation/goldens/matrix-files.preview-load-files.readterminalartifact-2.json
index 28b1cd75b42b..86ecd0352f78 100644
--- a/mobile/rpc-foundation/goldens/matrix-files.preview-load-files.readterminalartifact-2.json
+++ b/mobile/rpc-foundation/goldens/matrix-files.preview-load-files.readterminalartifact-2.json
@@ -3,9 +3,9 @@
   "family": "files.preview-load",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b93fc8b6f1ece041acaa8cc5699852085e67d7e2f39db13145e483f854ea3309",
   "scenarioSha256": "c4a09003352ba4e97a17ec4109cc125298cf7123b317265cc5eca06e8dcc0615",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-files.preview-load-files.resolveterminalpath-1.json b/mobile/rpc-foundation/goldens/matrix-files.preview-load-files.resolveterminalpath-1.json
index 06414c8fa7cf..edb175af8350 100644
--- a/mobile/rpc-foundation/goldens/matrix-files.preview-load-files.resolveterminalpath-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-files.preview-load-files.resolveterminalpath-1.json
@@ -3,9 +3,9 @@
   "family": "files.preview-load",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b93fc8b6f1ece041acaa8cc5699852085e67d7e2f39db13145e483f854ea3309",
   "scenarioSha256": "ecdeff2713e454925158dde09782713d76f39455729bb25688a6ffcfff154f30",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-files.preview-save-files.readterminalartifact-1.json b/mobile/rpc-foundation/goldens/matrix-files.preview-save-files.readterminalartifact-1.json
index f781f01f113e..701b00772ee0 100644
--- a/mobile/rpc-foundation/goldens/matrix-files.preview-save-files.readterminalartifact-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-files.preview-save-files.readterminalartifact-1.json
@@ -3,9 +3,9 @@
   "family": "files.preview-save",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b93fc8b6f1ece041acaa8cc5699852085e67d7e2f39db13145e483f854ea3309",
   "scenarioSha256": "1a4f7dff351be244712bedb8f495c83a531cfbfc5b5923267d1ed46bf2d6d11b",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-files.preview-save-files.writeterminalartifact-1.json b/mobile/rpc-foundation/goldens/matrix-files.preview-save-files.writeterminalartifact-1.json
index 6f1cae00ae93..20d302012ccb 100644
--- a/mobile/rpc-foundation/goldens/matrix-files.preview-save-files.writeterminalartifact-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-files.preview-save-files.writeterminalartifact-1.json
@@ -3,9 +3,9 @@
   "family": "files.preview-save",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b93fc8b6f1ece041acaa8cc5699852085e67d7e2f39db13145e483f854ea3309",
   "scenarioSha256": "8d443bda91fe5a1fa74910d525bb2ec40f639109bc71afbd42bccd949b3d463f",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-files.preview-worktree-image-files.readpreview-1.json b/mobile/rpc-foundation/goldens/matrix-files.preview-worktree-image-files.readpreview-1.json
index 8434453384f2..aae0ab561aa0 100644
--- a/mobile/rpc-foundation/goldens/matrix-files.preview-worktree-image-files.readpreview-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-files.preview-worktree-image-files.readpreview-1.json
@@ -3,9 +3,9 @@
   "family": "files.preview-worktree-image",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b93fc8b6f1ece041acaa8cc5699852085e67d7e2f39db13145e483f854ea3309",
   "scenarioSha256": "0962cb776492001a60db2ca89d715faec94c648962f140077fc9a85355784d81",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-files.preview-worktree-text-files.read-1.json b/mobile/rpc-foundation/goldens/matrix-files.preview-worktree-text-files.read-1.json
index a42c95a7b820..c5e9f6407559 100644
--- a/mobile/rpc-foundation/goldens/matrix-files.preview-worktree-text-files.read-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-files.preview-worktree-text-files.read-1.json
@@ -3,9 +3,9 @@
   "family": "files.preview-worktree-text",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b93fc8b6f1ece041acaa8cc5699852085e67d7e2f39db13145e483f854ea3309",
   "scenarioSha256": "08d73805619f00748caa5726a7fb0d9b9c561f93ec1e6dd28b27065a4515d65d",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-files.tab-doc-files.read-1.json b/mobile/rpc-foundation/goldens/matrix-files.tab-doc-files.read-1.json
index 3cde08a7331f..b9704e0e7907 100644
--- a/mobile/rpc-foundation/goldens/matrix-files.tab-doc-files.read-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-files.tab-doc-files.read-1.json
@@ -3,9 +3,9 @@
   "family": "files.tab-doc",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b93fc8b6f1ece041acaa8cc5699852085e67d7e2f39db13145e483f854ea3309",
   "scenarioSha256": "65895c028637185238baf4fd4f1297c11f528a289fe8173a41c48dc5a0b37c26",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-files.tab-doc-files.readpreview-1.json b/mobile/rpc-foundation/goldens/matrix-files.tab-doc-files.readpreview-1.json
index 883b213680b6..0ef791fe93e0 100644
--- a/mobile/rpc-foundation/goldens/matrix-files.tab-doc-files.readpreview-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-files.tab-doc-files.readpreview-1.json
@@ -3,9 +3,9 @@
   "family": "files.tab-doc",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b93fc8b6f1ece041acaa8cc5699852085e67d7e2f39db13145e483f854ea3309",
   "scenarioSha256": "2ceca0ecd901fd78838fcbdc789cbb6b96f04674b850a0994c7611f5db804915",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-files.tab-doc-git.diff-1.json b/mobile/rpc-foundation/goldens/matrix-files.tab-doc-git.diff-1.json
index a4dc093fbb31..51c711d42336 100644
--- a/mobile/rpc-foundation/goldens/matrix-files.tab-doc-git.diff-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-files.tab-doc-git.diff-1.json
@@ -3,9 +3,9 @@
   "family": "files.tab-doc",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b93fc8b6f1ece041acaa8cc5699852085e67d7e2f39db13145e483f854ea3309",
   "scenarioSha256": "c4db2424b8a35fd97b3fea00b4dd91a3c8d50c6fb73795811ef5402e3d14f8df",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-files.terminal-path-tap-files.open-1.json b/mobile/rpc-foundation/goldens/matrix-files.terminal-path-tap-files.open-1.json
index 563df8d71faf..1cba34985bc3 100644
--- a/mobile/rpc-foundation/goldens/matrix-files.terminal-path-tap-files.open-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-files.terminal-path-tap-files.open-1.json
@@ -3,9 +3,9 @@
   "family": "files.terminal-path-tap",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "e20a76ecd5e820dc4797fb25307810af68b5ced996dba2b9599464a21b5cbe1b",
   "scenarioSha256": "73dbbb8b96662af57240194be4af5726697d402b624a807d003ab56fea04dbd7",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-files.terminal-path-tap-files.resolveterminalpath-1.json b/mobile/rpc-foundation/goldens/matrix-files.terminal-path-tap-files.resolveterminalpath-1.json
index a0d293c1dc98..86d83ddee9ec 100644
--- a/mobile/rpc-foundation/goldens/matrix-files.terminal-path-tap-files.resolveterminalpath-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-files.terminal-path-tap-files.resolveterminalpath-1.json
@@ -3,9 +3,9 @@
   "family": "files.terminal-path-tap",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "e20a76ecd5e820dc4797fb25307810af68b5ced996dba2b9599464a21b5cbe1b",
   "scenarioSha256": "ba8728e890e0e9c10ea163bd16f4f99fbc9727cd2f9c4ed69c56436d8bc29f89",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-git.base-ref-chain-repo.baserefdefault-1.json b/mobile/rpc-foundation/goldens/matrix-git.base-ref-chain-repo.baserefdefault-1.json
index e24cef7b3945..4772cb6adb59 100644
--- a/mobile/rpc-foundation/goldens/matrix-git.base-ref-chain-repo.baserefdefault-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-git.base-ref-chain-repo.baserefdefault-1.json
@@ -3,9 +3,9 @@
   "family": "git.base-ref-chain",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5e47c7960b9352753f0751d4ccf5e3ff7fb7b74a63cc4e4df3c3ffdcc6c1e66b",
   "scenarioSha256": "5605a2984d7692aa80e5e38f804bdfed4b1ce8ac2102def5dc728b1a79dc1acf",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-git.base-ref-chain-repo.list-1.json b/mobile/rpc-foundation/goldens/matrix-git.base-ref-chain-repo.list-1.json
index a9b59fbcd32a..33768d3d81c0 100644
--- a/mobile/rpc-foundation/goldens/matrix-git.base-ref-chain-repo.list-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-git.base-ref-chain-repo.list-1.json
@@ -3,9 +3,9 @@
   "family": "git.base-ref-chain",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5e47c7960b9352753f0751d4ccf5e3ff7fb7b74a63cc4e4df3c3ffdcc6c1e66b",
   "scenarioSha256": "ed0e97ead1aad0b45bdfc48f5fe4e498810d0cfee88f07d3c6228db56fda1dd9",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-git.base-ref-chain-worktree.show-1.json b/mobile/rpc-foundation/goldens/matrix-git.base-ref-chain-worktree.show-1.json
index cf4db4e2da21..a5e802971810 100644
--- a/mobile/rpc-foundation/goldens/matrix-git.base-ref-chain-worktree.show-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-git.base-ref-chain-worktree.show-1.json
@@ -3,9 +3,9 @@
   "family": "git.base-ref-chain",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5e47c7960b9352753f0751d4ccf5e3ff7fb7b74a63cc4e4df3c3ffdcc6c1e66b",
   "scenarioSha256": "1db6919b94df3b8548838ff4c206fafa3a09ea096b17c04483f78f9321ccb1ba",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-git.branch-diff-preview-git.branchdiff-1.json b/mobile/rpc-foundation/goldens/matrix-git.branch-diff-preview-git.branchdiff-1.json
index f19ed91eda1d..837fc221dc60 100644
--- a/mobile/rpc-foundation/goldens/matrix-git.branch-diff-preview-git.branchdiff-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-git.branch-diff-preview-git.branchdiff-1.json
@@ -3,9 +3,9 @@
   "family": "git.branch-diff-preview",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "48ccada93f208a24160483e98ee94a771ab6d63222f29ac4bbd6979157f98333",
   "scenarioSha256": "42879d7300691a80aa0d09a2aeb5f8cb9438fc72b0ac7f24b0bbae4309f3a2ca",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-git.changes-load-git.branchcompare-1.json b/mobile/rpc-foundation/goldens/matrix-git.changes-load-git.branchcompare-1.json
index 8e364723e610..21f412d5aa64 100644
--- a/mobile/rpc-foundation/goldens/matrix-git.changes-load-git.branchcompare-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-git.changes-load-git.branchcompare-1.json
@@ -3,9 +3,9 @@
   "family": "git.changes-load",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "48ccada93f208a24160483e98ee94a771ab6d63222f29ac4bbd6979157f98333",
   "scenarioSha256": "afdfde4c58b6ff2047ea1b2f18b955074c0ae23850d4ac8783e69c0724096eab",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-git.changes-load-git.status-1.json b/mobile/rpc-foundation/goldens/matrix-git.changes-load-git.status-1.json
index e2477dc76881..505b519e89b1 100644
--- a/mobile/rpc-foundation/goldens/matrix-git.changes-load-git.status-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-git.changes-load-git.status-1.json
@@ -3,9 +3,9 @@
   "family": "git.changes-load",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "48ccada93f208a24160483e98ee94a771ab6d63222f29ac4bbd6979157f98333",
   "scenarioSha256": "a428557212fd35e84506b671c2b254d7ce5cab486dada61fc9b5e5357f76df2c",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-git.changes-load-repo.list-1.json b/mobile/rpc-foundation/goldens/matrix-git.changes-load-repo.list-1.json
index ac0b04c87660..fedb8e55d360 100644
--- a/mobile/rpc-foundation/goldens/matrix-git.changes-load-repo.list-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-git.changes-load-repo.list-1.json
@@ -3,9 +3,9 @@
   "family": "git.changes-load",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "48ccada93f208a24160483e98ee94a771ab6d63222f29ac4bbd6979157f98333",
   "scenarioSha256": "901b8f44a090b5871b3edc20be72c4f407889b4830fcb00be0e99c8c96274cc5",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-git.changes-load-worktree.show-1.json b/mobile/rpc-foundation/goldens/matrix-git.changes-load-worktree.show-1.json
index 362edc5e5396..411a2b2d435c 100644
--- a/mobile/rpc-foundation/goldens/matrix-git.changes-load-worktree.show-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-git.changes-load-worktree.show-1.json
@@ -3,9 +3,9 @@
   "family": "git.changes-load",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "48ccada93f208a24160483e98ee94a771ab6d63222f29ac4bbd6979157f98333",
   "scenarioSha256": "d40c9235948cb1cd85bec5451ce0f4183074e0a12a35834d8c911c35e99a6599",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-git.commit-message-ai-git.generatecommitmessage-1.json b/mobile/rpc-foundation/goldens/matrix-git.commit-message-ai-git.generatecommitmessage-1.json
index e7afb911bfa7..446ad90a026a 100644
--- a/mobile/rpc-foundation/goldens/matrix-git.commit-message-ai-git.generatecommitmessage-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-git.commit-message-ai-git.generatecommitmessage-1.json
@@ -3,9 +3,9 @@
   "family": "git.commit-message-ai",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5e47c7960b9352753f0751d4ccf5e3ff7fb7b74a63cc4e4df3c3ffdcc6c1e66b",
   "scenarioSha256": "22ea5279155ecf749aaab521ffd570221ac3169b177fc1daf85ef93a49d38260",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-git.history-commit-files-git.commitcompare-1.json b/mobile/rpc-foundation/goldens/matrix-git.history-commit-files-git.commitcompare-1.json
index 7e1e8c4a09bb..a92368dd7257 100644
--- a/mobile/rpc-foundation/goldens/matrix-git.history-commit-files-git.commitcompare-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-git.history-commit-files-git.commitcompare-1.json
@@ -3,9 +3,9 @@
   "family": "git.history-commit-files",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "48ccada93f208a24160483e98ee94a771ab6d63222f29ac4bbd6979157f98333",
   "scenarioSha256": "fc12c33acd3f3a34cbdb5893204be009bb089e2383a715fea4151c912de11ab0",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-git.history-commit-files-git.history-1.json b/mobile/rpc-foundation/goldens/matrix-git.history-commit-files-git.history-1.json
index 94311f3b2539..ebbc86490865 100644
--- a/mobile/rpc-foundation/goldens/matrix-git.history-commit-files-git.history-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-git.history-commit-files-git.history-1.json
@@ -3,9 +3,9 @@
   "family": "git.history-commit-files",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "48ccada93f208a24160483e98ee94a771ab6d63222f29ac4bbd6979157f98333",
   "scenarioSha256": "52610bb18381d371e479a5bef4a160814547baa355104059949b1c35b87342bc",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-git.history-read-git.history-1.json b/mobile/rpc-foundation/goldens/matrix-git.history-read-git.history-1.json
index 6da90af3d7ea..c4d29c3fb19b 100644
--- a/mobile/rpc-foundation/goldens/matrix-git.history-read-git.history-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-git.history-read-git.history-1.json
@@ -3,9 +3,9 @@
   "family": "git.history-read",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5e47c7960b9352753f0751d4ccf5e3ff7fb7b74a63cc4e4df3c3ffdcc6c1e66b",
   "scenarioSha256": "86254ed87ad3427d6ee4631d7348075039ba2d4d7496d59f27f03f78580f35a1",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-git.remote-prerequisite-git.push-1.json b/mobile/rpc-foundation/goldens/matrix-git.remote-prerequisite-git.push-1.json
index 4a18e4886a43..9c8ba886c2d6 100644
--- a/mobile/rpc-foundation/goldens/matrix-git.remote-prerequisite-git.push-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-git.remote-prerequisite-git.push-1.json
@@ -3,9 +3,9 @@
   "family": "git.remote-prerequisite",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c582ce355b0704b38d7e84cbce352630096c91231bf09aecd1f6dbb409fed17f",
   "scenarioSha256": "5009c22df7e74a850bcea41fc110ea7d7eb4bdada623837279f32eaa5149a9b8",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-git.review-preparation-git.status-1.json b/mobile/rpc-foundation/goldens/matrix-git.review-preparation-git.status-1.json
index 5c787df186c5..df9240be29f4 100644
--- a/mobile/rpc-foundation/goldens/matrix-git.review-preparation-git.status-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-git.review-preparation-git.status-1.json
@@ -3,9 +3,9 @@
   "family": "git.review-preparation",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c582ce355b0704b38d7e84cbce352630096c91231bf09aecd1f6dbb409fed17f",
   "scenarioSha256": "485b2751006ee8fb4df28b228ea7adda85779feae83974eb0f7e795e31c500a1",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-github.pr-comment-mutation-github.addissuecomment-1.json b/mobile/rpc-foundation/goldens/matrix-github.pr-comment-mutation-github.addissuecomment-1.json
index acf5b472feb6..08746cbd4f9c 100644
--- a/mobile/rpc-foundation/goldens/matrix-github.pr-comment-mutation-github.addissuecomment-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-github.pr-comment-mutation-github.addissuecomment-1.json
@@ -3,9 +3,9 @@
   "family": "github.pr-comment-mutation",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "f560ff1582487c118756c527faa1fb1f65e37ce22ca9573491fd4b2dbcedf38d",
   "scenarioSha256": "0c8f09683408a919dd3ac2b7cd12197d8745882627134cde95ecee209575b027",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-github.pr-comment-mutation-github.addprreviewcommentreply-1.json b/mobile/rpc-foundation/goldens/matrix-github.pr-comment-mutation-github.addprreviewcommentreply-1.json
index 078f9fe8e31a..7a9473ab0d69 100644
--- a/mobile/rpc-foundation/goldens/matrix-github.pr-comment-mutation-github.addprreviewcommentreply-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-github.pr-comment-mutation-github.addprreviewcommentreply-1.json
@@ -3,9 +3,9 @@
   "family": "github.pr-comment-mutation",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "f560ff1582487c118756c527faa1fb1f65e37ce22ca9573491fd4b2dbcedf38d",
   "scenarioSha256": "4f2b61df5e59d2efe81d467214a78132654035cbcb4d929385410b53f735c9fe",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-github.pr-comment-mutation-github.project.deleteissuecommentbyslug-1.json b/mobile/rpc-foundation/goldens/matrix-github.pr-comment-mutation-github.project.deleteissuecommentbyslug-1.json
index 7fd9e35724f7..ac09e3a83440 100644
--- a/mobile/rpc-foundation/goldens/matrix-github.pr-comment-mutation-github.project.deleteissuecommentbyslug-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-github.pr-comment-mutation-github.project.deleteissuecommentbyslug-1.json
@@ -3,9 +3,9 @@
   "family": "github.pr-comment-mutation",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "f560ff1582487c118756c527faa1fb1f65e37ce22ca9573491fd4b2dbcedf38d",
   "scenarioSha256": "04b2052cce6f24d9e208c992f204355639409ddc9793b3044b394c0e38d3c284",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-github.pr-comment-mutation-github.project.updateissuecommentbyslug-1.json b/mobile/rpc-foundation/goldens/matrix-github.pr-comment-mutation-github.project.updateissuecommentbyslug-1.json
index 1843db870106..569f79e8ba5b 100644
--- a/mobile/rpc-foundation/goldens/matrix-github.pr-comment-mutation-github.project.updateissuecommentbyslug-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-github.pr-comment-mutation-github.project.updateissuecommentbyslug-1.json
@@ -3,9 +3,9 @@
   "family": "github.pr-comment-mutation",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "f560ff1582487c118756c527faa1fb1f65e37ce22ca9573491fd4b2dbcedf38d",
   "scenarioSha256": "8f849437158296753a84a75dfdbaf69852bcdb6cdc6e8205496961ec16e4be21",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-github.pr-comment-mutation-github.resolvereviewthread-1.json b/mobile/rpc-foundation/goldens/matrix-github.pr-comment-mutation-github.resolvereviewthread-1.json
index f2dc1a2d4031..c470f12d3857 100644
--- a/mobile/rpc-foundation/goldens/matrix-github.pr-comment-mutation-github.resolvereviewthread-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-github.pr-comment-mutation-github.resolvereviewthread-1.json
@@ -3,9 +3,9 @@
   "family": "github.pr-comment-mutation",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "f560ff1582487c118756c527faa1fb1f65e37ce22ca9573491fd4b2dbcedf38d",
   "scenarioSha256": "77eba7deff3f15e64795cdcbefd009abfcf2379e7293eefb1f154ca1e99f4d5d",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-github.pr-mutation-github.mergepr-1.json b/mobile/rpc-foundation/goldens/matrix-github.pr-mutation-github.mergepr-1.json
index 5b5b41e2a472..1a47943d9873 100644
--- a/mobile/rpc-foundation/goldens/matrix-github.pr-mutation-github.mergepr-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-github.pr-mutation-github.mergepr-1.json
@@ -3,9 +3,9 @@
   "family": "github.pr-mutation",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "f560ff1582487c118756c527faa1fb1f65e37ce22ca9573491fd4b2dbcedf38d",
   "scenarioSha256": "2235d05e0d2c6f1a9518cfdd76870e303cccd35289d6a44334147b6a5b6b675e",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-github.pr-mutation-github.removeprreviewers-1.json b/mobile/rpc-foundation/goldens/matrix-github.pr-mutation-github.removeprreviewers-1.json
index 13ba431e5600..d8415c0685cc 100644
--- a/mobile/rpc-foundation/goldens/matrix-github.pr-mutation-github.removeprreviewers-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-github.pr-mutation-github.removeprreviewers-1.json
@@ -3,9 +3,9 @@
   "family": "github.pr-mutation",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "f560ff1582487c118756c527faa1fb1f65e37ce22ca9573491fd4b2dbcedf38d",
   "scenarioSha256": "2cea87c339b35daf62c963092c01c6379db43f2ee4ca5cb2b5f817975b0caf65",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-github.pr-mutation-github.requestprreviewers-1.json b/mobile/rpc-foundation/goldens/matrix-github.pr-mutation-github.requestprreviewers-1.json
index b6c4508f84dd..45bf3d7fef0f 100644
--- a/mobile/rpc-foundation/goldens/matrix-github.pr-mutation-github.requestprreviewers-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-github.pr-mutation-github.requestprreviewers-1.json
@@ -3,9 +3,9 @@
   "family": "github.pr-mutation",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "f560ff1582487c118756c527faa1fb1f65e37ce22ca9573491fd4b2dbcedf38d",
   "scenarioSha256": "78de11de556c91782590725819b22821732a12d3769f493d165c80bc7fcc1f53",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-github.pr-mutation-github.rerunprchecks-1.json b/mobile/rpc-foundation/goldens/matrix-github.pr-mutation-github.rerunprchecks-1.json
index 7383da5ffefb..9bf6a49bb387 100644
--- a/mobile/rpc-foundation/goldens/matrix-github.pr-mutation-github.rerunprchecks-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-github.pr-mutation-github.rerunprchecks-1.json
@@ -3,9 +3,9 @@
   "family": "github.pr-mutation",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "f560ff1582487c118756c527faa1fb1f65e37ce22ca9573491fd4b2dbcedf38d",
   "scenarioSha256": "ac7e91b4d35021eca63af8ce01f9a2c7959109e4cb824009881437cb94dbfe82",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-github.pr-mutation-github.setprautomerge-1.json b/mobile/rpc-foundation/goldens/matrix-github.pr-mutation-github.setprautomerge-1.json
index 7b13a40b7b74..b4fffd04b695 100644
--- a/mobile/rpc-foundation/goldens/matrix-github.pr-mutation-github.setprautomerge-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-github.pr-mutation-github.setprautomerge-1.json
@@ -3,9 +3,9 @@
   "family": "github.pr-mutation",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "f560ff1582487c118756c527faa1fb1f65e37ce22ca9573491fd4b2dbcedf38d",
   "scenarioSha256": "a85682e5009d634bf468b8dbe4f35a957988754ed9c2b07d57ad475c1590d1f6",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-github.pr-mutation-github.updateprstate-1.json b/mobile/rpc-foundation/goldens/matrix-github.pr-mutation-github.updateprstate-1.json
index be4567b6a6b9..d2b57069195d 100644
--- a/mobile/rpc-foundation/goldens/matrix-github.pr-mutation-github.updateprstate-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-github.pr-mutation-github.updateprstate-1.json
@@ -3,9 +3,9 @@
   "family": "github.pr-mutation",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "f560ff1582487c118756c527faa1fb1f65e37ce22ca9573491fd4b2dbcedf38d",
   "scenarioSha256": "30f321fcbfaf09505bc6e18e64c09ca49c0dcdb7c5e12c4e27c2429b3e1066ca",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-github.pr-read-github.listassignableusers-1.json b/mobile/rpc-foundation/goldens/matrix-github.pr-read-github.listassignableusers-1.json
index d8d0c13c1c5b..8663551cd07d 100644
--- a/mobile/rpc-foundation/goldens/matrix-github.pr-read-github.listassignableusers-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-github.pr-read-github.listassignableusers-1.json
@@ -3,9 +3,9 @@
   "family": "github.pr-read",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "f560ff1582487c118756c527faa1fb1f65e37ce22ca9573491fd4b2dbcedf38d",
   "scenarioSha256": "507743a5925a37be32156b3d8df83ddb8e08c262d2c2f44bbd117dee4672bbc5",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-github.pr-read-github.prcheckdetails-1.json b/mobile/rpc-foundation/goldens/matrix-github.pr-read-github.prcheckdetails-1.json
index d09c2ba7257c..8b47ed74b929 100644
--- a/mobile/rpc-foundation/goldens/matrix-github.pr-read-github.prcheckdetails-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-github.pr-read-github.prcheckdetails-1.json
@@ -3,9 +3,9 @@
   "family": "github.pr-read",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "f560ff1582487c118756c527faa1fb1f65e37ce22ca9573491fd4b2dbcedf38d",
   "scenarioSha256": "6efca320cf31a1de988110004a9fb7b67fdad279a789e046ad6b5141b66e5bf1",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-github.pr-read-github.prchecks-1.json b/mobile/rpc-foundation/goldens/matrix-github.pr-read-github.prchecks-1.json
index 588acd53d37b..6f528205be1c 100644
--- a/mobile/rpc-foundation/goldens/matrix-github.pr-read-github.prchecks-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-github.pr-read-github.prchecks-1.json
@@ -3,9 +3,9 @@
   "family": "github.pr-read",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "f560ff1582487c118756c527faa1fb1f65e37ce22ca9573491fd4b2dbcedf38d",
   "scenarioSha256": "c77d7c7a05ecb9b27180ef28ca63a28e1c1ca42db2bb54a468699da77281ae35",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-github.pr-read-github.prforbranch-1.json b/mobile/rpc-foundation/goldens/matrix-github.pr-read-github.prforbranch-1.json
index 56980471b508..a633598fa80b 100644
--- a/mobile/rpc-foundation/goldens/matrix-github.pr-read-github.prforbranch-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-github.pr-read-github.prforbranch-1.json
@@ -3,9 +3,9 @@
   "family": "github.pr-read",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "f560ff1582487c118756c527faa1fb1f65e37ce22ca9573491fd4b2dbcedf38d",
   "scenarioSha256": "3b3d3032b992fc7461b13de8a42512affa12fb018ad583898179a9934c13b414",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-github.pr-read-github.reposlug-1.json b/mobile/rpc-foundation/goldens/matrix-github.pr-read-github.reposlug-1.json
index 6e79740501f8..a54073d825e9 100644
--- a/mobile/rpc-foundation/goldens/matrix-github.pr-read-github.reposlug-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-github.pr-read-github.reposlug-1.json
@@ -3,9 +3,9 @@
   "family": "github.pr-read",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "f560ff1582487c118756c527faa1fb1f65e37ce22ca9573491fd4b2dbcedf38d",
   "scenarioSha256": "4ebe865f874b0b4a813860ec7356b8dc214ea02f0a9036cb003efe863d89b83e",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-github.pr-read-github.workitemdetails-1.json b/mobile/rpc-foundation/goldens/matrix-github.pr-read-github.workitemdetails-1.json
index e09d7e1bece3..c160111e9e8b 100644
--- a/mobile/rpc-foundation/goldens/matrix-github.pr-read-github.workitemdetails-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-github.pr-read-github.workitemdetails-1.json
@@ -3,9 +3,9 @@
   "family": "github.pr-read",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "f560ff1582487c118756c527faa1fb1f65e37ce22ca9573491fd4b2dbcedf38d",
   "scenarioSha256": "bc3350efc030f824fc21046aea8c6dc9a46993b6c75613c66874fde59af9171a",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-github.pr-read-hostedreview.forbranch-1.json b/mobile/rpc-foundation/goldens/matrix-github.pr-read-hostedreview.forbranch-1.json
index b27a39400776..ce776c7f3400 100644
--- a/mobile/rpc-foundation/goldens/matrix-github.pr-read-hostedreview.forbranch-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-github.pr-read-hostedreview.forbranch-1.json
@@ -3,9 +3,9 @@
   "family": "github.pr-read",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "f560ff1582487c118756c527faa1fb1f65e37ce22ca9573491fd4b2dbcedf38d",
   "scenarioSha256": "9171e982babc4e56852fe35bafa7a9f3aeda2be5bd4648f29aaa04ca7119d5d2",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-github.pr-title-mutation-github.updateprtitle-1.json b/mobile/rpc-foundation/goldens/matrix-github.pr-title-mutation-github.updateprtitle-1.json
index a7cc077a298f..75497449e069 100644
--- a/mobile/rpc-foundation/goldens/matrix-github.pr-title-mutation-github.updateprtitle-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-github.pr-title-mutation-github.updateprtitle-1.json
@@ -3,9 +3,9 @@
   "family": "github.pr-title-mutation",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "f560ff1582487c118756c527faa1fb1f65e37ce22ca9573491fd4b2dbcedf38d",
   "scenarioSha256": "fe91d5518501a078dff3010e74c4b9d70122f88a629e384336cd1b6a84de36a8",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-home.host-accounts-accounts.list-1.json b/mobile/rpc-foundation/goldens/matrix-home.host-accounts-accounts.list-1.json
index 7ed1116c59bb..b756f0e26eb7 100644
--- a/mobile/rpc-foundation/goldens/matrix-home.host-accounts-accounts.list-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-home.host-accounts-accounts.list-1.json
@@ -3,9 +3,9 @@
   "family": "home.host-accounts",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c632fdbc4b730777ecb09f08bec14cca0586042b01ed99d40d0228806c7def4a",
   "scenarioSha256": "047e4c8fb2c4b374406658ec3954ac00fda96928bdd999a33ab9867284ffb4a4",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-home.host-stats-stats.summary-1.json b/mobile/rpc-foundation/goldens/matrix-home.host-stats-stats.summary-1.json
index 031c1d9bb268..860b9a4214b2 100644
--- a/mobile/rpc-foundation/goldens/matrix-home.host-stats-stats.summary-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-home.host-stats-stats.summary-1.json
@@ -3,9 +3,9 @@
   "family": "home.host-stats",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a9e0780298a1443664e7ae02056168aa34d67556c9c056d51a82c7b4a73ad35b",
   "scenarioSha256": "5518e08c1b20f0ddd4cb6bc81ff9af032b1a38daf24f3d3497bac5df8b2d0ec5",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-host-worktree-refresh-runtime.clientevents.subscribe-1-1.json b/mobile/rpc-foundation/goldens/matrix-host-worktree-refresh-runtime.clientevents.subscribe-1-1.json
index 50372b9d6dfd..8509139ab93c 100644
--- a/mobile/rpc-foundation/goldens/matrix-host-worktree-refresh-runtime.clientevents.subscribe-1-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-host-worktree-refresh-runtime.clientevents.subscribe-1-1.json
@@ -3,9 +3,9 @@
   "family": "host-worktree-refresh",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "8e41c8624b9b6185e447cee3590a851ab88b6b1ee1d632af90e3a771a90310be",
   "scenarioSha256": "0604294e541a4b2c73e0501cfc393c84384342ffcae286211a657ca5bc5892b7",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-host-worktree-refresh-runtime.clientevents.subscribe-1-2.json b/mobile/rpc-foundation/goldens/matrix-host-worktree-refresh-runtime.clientevents.subscribe-1-2.json
index 69b010804810..a35f134c9630 100644
--- a/mobile/rpc-foundation/goldens/matrix-host-worktree-refresh-runtime.clientevents.subscribe-1-2.json
+++ b/mobile/rpc-foundation/goldens/matrix-host-worktree-refresh-runtime.clientevents.subscribe-1-2.json
@@ -3,9 +3,9 @@
   "family": "host-worktree-refresh",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "8e41c8624b9b6185e447cee3590a851ab88b6b1ee1d632af90e3a771a90310be",
   "scenarioSha256": "6d03d17a5711db33473611858b225e2ac42fe33d2a982fbb0defdbd1dce037d6",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-host-worktree-refresh-runtime.clientevents.subscribe-1-3.json b/mobile/rpc-foundation/goldens/matrix-host-worktree-refresh-runtime.clientevents.subscribe-1-3.json
index ab58a7da199a..efceb3aca89b 100644
--- a/mobile/rpc-foundation/goldens/matrix-host-worktree-refresh-runtime.clientevents.subscribe-1-3.json
+++ b/mobile/rpc-foundation/goldens/matrix-host-worktree-refresh-runtime.clientevents.subscribe-1-3.json
@@ -3,9 +3,9 @@
   "family": "host-worktree-refresh",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "8e41c8624b9b6185e447cee3590a851ab88b6b1ee1d632af90e3a771a90310be",
   "scenarioSha256": "f36f11b3d69397bd98651fdad4614a4115098e23667e4dfc397c1d9ff2dc3186",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-host-worktree-refresh-runtime.clientevents.subscribe-2-1.json b/mobile/rpc-foundation/goldens/matrix-host-worktree-refresh-runtime.clientevents.subscribe-2-1.json
index 1cc3d71efcbd..4341e370fcea 100644
--- a/mobile/rpc-foundation/goldens/matrix-host-worktree-refresh-runtime.clientevents.subscribe-2-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-host-worktree-refresh-runtime.clientevents.subscribe-2-1.json
@@ -3,9 +3,9 @@
   "family": "host-worktree-refresh",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "8e41c8624b9b6185e447cee3590a851ab88b6b1ee1d632af90e3a771a90310be",
   "scenarioSha256": "a70fa323de86b706f05818f321095349ed55b265804ec0ebb54419314a3ca612",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-host.view-settings-ui.get-1.json b/mobile/rpc-foundation/goldens/matrix-host.view-settings-ui.get-1.json
index 054510d16844..888840f25b2b 100644
--- a/mobile/rpc-foundation/goldens/matrix-host.view-settings-ui.get-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-host.view-settings-ui.get-1.json
@@ -3,9 +3,9 @@
   "family": "host.view-settings",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a9e0780298a1443664e7ae02056168aa34d67556c9c056d51a82c7b4a73ad35b",
   "scenarioSha256": "a9a3191e2e8c36870ce2769a7bb972813f435267fdc6ed9e42632a57a227bbd6",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-host.view-settings-ui.set-1.json b/mobile/rpc-foundation/goldens/matrix-host.view-settings-ui.set-1.json
index 43883704b782..4c6e4995ba1a 100644
--- a/mobile/rpc-foundation/goldens/matrix-host.view-settings-ui.set-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-host.view-settings-ui.set-1.json
@@ -3,9 +3,9 @@
   "family": "host.view-settings",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a9e0780298a1443664e7ae02056168aa34d67556c9c056d51a82c7b4a73ad35b",
   "scenarioSha256": "30cbeff90a845ab5dd576e302156e859338357b608e87e9fadeddf18ae93d9ca",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-host.worktree-actions-worktree.activate-1.json b/mobile/rpc-foundation/goldens/matrix-host.worktree-actions-worktree.activate-1.json
index 39fb4f33744a..cd25bda2a979 100644
--- a/mobile/rpc-foundation/goldens/matrix-host.worktree-actions-worktree.activate-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-host.worktree-actions-worktree.activate-1.json
@@ -3,9 +3,9 @@
   "family": "host.worktree-actions",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "92c29bd78ca0c0d5917e9386fc447bb9a1698b1d1ffaba0db7546eaac60da639",
   "scenarioSha256": "7e842584620018d5ec5560711d63a472302e8da80cfe65dfcd2952aebb509af2",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-host.worktree-actions-worktree.rm-1.json b/mobile/rpc-foundation/goldens/matrix-host.worktree-actions-worktree.rm-1.json
index 502a257adc15..aea83826f582 100644
--- a/mobile/rpc-foundation/goldens/matrix-host.worktree-actions-worktree.rm-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-host.worktree-actions-worktree.rm-1.json
@@ -3,9 +3,9 @@
   "family": "host.worktree-actions",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "92c29bd78ca0c0d5917e9386fc447bb9a1698b1d1ffaba0db7546eaac60da639",
   "scenarioSha256": "c47656a4ca21762e4b5a247ddf9a96efb746bec81e942ffa308a774bab1449e2",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-host.worktree-actions-worktree.set-1.json b/mobile/rpc-foundation/goldens/matrix-host.worktree-actions-worktree.set-1.json
index ee374ba2b5b6..6b9dab5fdd93 100644
--- a/mobile/rpc-foundation/goldens/matrix-host.worktree-actions-worktree.set-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-host.worktree-actions-worktree.set-1.json
@@ -3,9 +3,9 @@
   "family": "host.worktree-actions",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "92c29bd78ca0c0d5917e9386fc447bb9a1698b1d1ffaba0db7546eaac60da639",
   "scenarioSha256": "054f1b1380fc6cfd4b0f4a85d6f143822a12a0a732d550dd85eef64a6556b3ba",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-hostedreview.create-chain-git.push-1.json b/mobile/rpc-foundation/goldens/matrix-hostedreview.create-chain-git.push-1.json
index b6238a38dd6f..36a506da6961 100644
--- a/mobile/rpc-foundation/goldens/matrix-hostedreview.create-chain-git.push-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-hostedreview.create-chain-git.push-1.json
@@ -3,9 +3,9 @@
   "family": "hostedReview.create-chain",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c582ce355b0704b38d7e84cbce352630096c91231bf09aecd1f6dbb409fed17f",
   "scenarioSha256": "fcf5cdc7388457156dd81fe28a470f42fbabac7435ec5572cb19e209f410ca84",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-hostedreview.create-chain-hostedreview.create-1.json b/mobile/rpc-foundation/goldens/matrix-hostedreview.create-chain-hostedreview.create-1.json
index 5edf9297691a..d1753f4425b7 100644
--- a/mobile/rpc-foundation/goldens/matrix-hostedreview.create-chain-hostedreview.create-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-hostedreview.create-chain-hostedreview.create-1.json
@@ -3,9 +3,9 @@
   "family": "hostedReview.create-chain",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c582ce355b0704b38d7e84cbce352630096c91231bf09aecd1f6dbb409fed17f",
   "scenarioSha256": "26e666a57805f354602a5b3906a691b10c8d6db66c77acc96c67153279c515a7",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-hostedreview.create-chain-worktree.set-1.json b/mobile/rpc-foundation/goldens/matrix-hostedreview.create-chain-worktree.set-1.json
index e8ae358e69fa..0c5e2396e0e9 100644
--- a/mobile/rpc-foundation/goldens/matrix-hostedreview.create-chain-worktree.set-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-hostedreview.create-chain-worktree.set-1.json
@@ -3,9 +3,9 @@
   "family": "hostedReview.create-chain",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c582ce355b0704b38d7e84cbce352630096c91231bf09aecd1f6dbb409fed17f",
   "scenarioSha256": "08c25b6cb5bc12a7f67e858f229d15cf66b98b2ad4601b11f18c4c03f4a59669",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-git.bulkstage-1.json b/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-git.bulkstage-1.json
index eb11b29a5f0b..2df5db78fe11 100644
--- a/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-git.bulkstage-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-git.bulkstage-1.json
@@ -3,9 +3,9 @@
   "family": "hostedReview.create-intent",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c582ce355b0704b38d7e84cbce352630096c91231bf09aecd1f6dbb409fed17f",
   "scenarioSha256": "ff9d1bfd6337607f3d3e8162692b589ecea4a32ae01b5ebb3c602f8f0a55642c",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-git.commit-1.json b/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-git.commit-1.json
index 60814b5852a6..56a0f6948ae2 100644
--- a/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-git.commit-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-git.commit-1.json
@@ -3,9 +3,9 @@
   "family": "hostedReview.create-intent",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c582ce355b0704b38d7e84cbce352630096c91231bf09aecd1f6dbb409fed17f",
   "scenarioSha256": "efeb9b248aeb98fac71c043d50afe0036cf804d3c11edfccd4e050fe8f3d8f9b",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-git.generatecommitmessage-1.json b/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-git.generatecommitmessage-1.json
index b65e39dade00..b32c45655df8 100644
--- a/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-git.generatecommitmessage-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-git.generatecommitmessage-1.json
@@ -3,9 +3,9 @@
   "family": "hostedReview.create-intent",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c582ce355b0704b38d7e84cbce352630096c91231bf09aecd1f6dbb409fed17f",
   "scenarioSha256": "7b0d9ddcb8df83fc4e465aa6b0dcf05aa0d8f266cd4bb8651969cb8321bcf549",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-git.push-1.json b/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-git.push-1.json
index bedc0068d894..4a7a2504aba1 100644
--- a/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-git.push-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-git.push-1.json
@@ -3,9 +3,9 @@
   "family": "hostedReview.create-intent",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c582ce355b0704b38d7e84cbce352630096c91231bf09aecd1f6dbb409fed17f",
   "scenarioSha256": "72c1f08739db1c0dfcd48adffaca582a3596116c1c377f95f7dab8b08b7e6cdc",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-git.status-1.json b/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-git.status-1.json
index 368671f56b4e..2cf03eb5cbdf 100644
--- a/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-git.status-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-git.status-1.json
@@ -3,9 +3,9 @@
   "family": "hostedReview.create-intent",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c582ce355b0704b38d7e84cbce352630096c91231bf09aecd1f6dbb409fed17f",
   "scenarioSha256": "1f002f900c1a3c92e8f7c72261579ee5015ec1529c003a1b32bcf3eaf98b672d",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-git.status-2.json b/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-git.status-2.json
index 86d3f97631b3..053bc25523b0 100644
--- a/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-git.status-2.json
+++ b/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-git.status-2.json
@@ -3,9 +3,9 @@
   "family": "hostedReview.create-intent",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c582ce355b0704b38d7e84cbce352630096c91231bf09aecd1f6dbb409fed17f",
   "scenarioSha256": "3a6487a07457e0e5aa6fc3fccfa43687acfb06d94334e621081728de937e4e8d",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-git.status-3.json b/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-git.status-3.json
index 9fcd864013d5..b4a5e9c257f7 100644
--- a/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-git.status-3.json
+++ b/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-git.status-3.json
@@ -3,9 +3,9 @@
   "family": "hostedReview.create-intent",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c582ce355b0704b38d7e84cbce352630096c91231bf09aecd1f6dbb409fed17f",
   "scenarioSha256": "7355c45a707fa8a31f0999c4805a5b1dace4c65b727e711231f784b2f92c05ff",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-git.status-4.json b/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-git.status-4.json
index bba497b965de..7a84c2dddc0e 100644
--- a/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-git.status-4.json
+++ b/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-git.status-4.json
@@ -3,9 +3,9 @@
   "family": "hostedReview.create-intent",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c582ce355b0704b38d7e84cbce352630096c91231bf09aecd1f6dbb409fed17f",
   "scenarioSha256": "45cda6757b76399d282d4b07992dab21bbb8236faadedba5e92eab8818e886bf",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-hostedreview.create-1.json b/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-hostedreview.create-1.json
index e93d69e443f9..01e9ec501a93 100644
--- a/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-hostedreview.create-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-hostedreview.create-1.json
@@ -3,9 +3,9 @@
   "family": "hostedReview.create-intent",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c582ce355b0704b38d7e84cbce352630096c91231bf09aecd1f6dbb409fed17f",
   "scenarioSha256": "0ca08d5e70e1780a6ee5c919491dcddb062a22623f803e9960a329825f274cbe",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-hostedreview.getcreationeligibility-1.json b/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-hostedreview.getcreationeligibility-1.json
index 12b2bb93ba46..09368580565b 100644
--- a/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-hostedreview.getcreationeligibility-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-hostedreview.getcreationeligibility-1.json
@@ -3,9 +3,9 @@
   "family": "hostedReview.create-intent",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c582ce355b0704b38d7e84cbce352630096c91231bf09aecd1f6dbb409fed17f",
   "scenarioSha256": "658eb7bbf63b3a4b38eca0b1733e523962b6b6943644d65aab6f5c7e62534d6a",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-hostedreview.getcreationeligibility-2.json b/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-hostedreview.getcreationeligibility-2.json
index 8e93ed265c92..eb0269a9e9d1 100644
--- a/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-hostedreview.getcreationeligibility-2.json
+++ b/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-hostedreview.getcreationeligibility-2.json
@@ -3,9 +3,9 @@
   "family": "hostedReview.create-intent",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c582ce355b0704b38d7e84cbce352630096c91231bf09aecd1f6dbb409fed17f",
   "scenarioSha256": "75ba135731290bf734a5eef0b65f9ad8b7cac453c4e2006faac88a5da9dbe3a3",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-worktree.set-1.json b/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-worktree.set-1.json
index a68caa0c65f3..df36974ab3c4 100644
--- a/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-worktree.set-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-hostedreview.create-intent-worktree.set-1.json
@@ -3,9 +3,9 @@
   "family": "hostedReview.create-intent",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c582ce355b0704b38d7e84cbce352630096c91231bf09aecd1f6dbb409fed17f",
   "scenarioSha256": "beb1161b98ffde8c5f1128e843766a1da3182d195f1f0a9012e12e5318ae01bc",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-hostedreview.eligibility-hostedreview.getcreationeligibility-1.json b/mobile/rpc-foundation/goldens/matrix-hostedreview.eligibility-hostedreview.getcreationeligibility-1.json
index 97c2da5393ab..3619df0912a4 100644
--- a/mobile/rpc-foundation/goldens/matrix-hostedreview.eligibility-hostedreview.getcreationeligibility-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-hostedreview.eligibility-hostedreview.getcreationeligibility-1.json
@@ -3,9 +3,9 @@
   "family": "hostedReview.eligibility",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c582ce355b0704b38d7e84cbce352630096c91231bf09aecd1f6dbb409fed17f",
   "scenarioSha256": "6c4de90e2617d204e82ca5e65eb17fc397acbcbb9dc0ec18594d2a7739e3528b",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-legacy-inventory-files.searchpaths-1.json b/mobile/rpc-foundation/goldens/matrix-legacy-inventory-files.searchpaths-1.json
index d58f857f6eff..e694b94eebd1 100644
--- a/mobile/rpc-foundation/goldens/matrix-legacy-inventory-files.searchpaths-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-legacy-inventory-files.searchpaths-1.json
@@ -3,9 +3,9 @@
   "family": "legacy-inventory",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "262eaad263a45aa13ec5b27c12b59946b12c202474229fff7a5727dba6d702ca",
   "scenarioSha256": "4f6472fb7add960be9bcc8596a748264d7cb0755a782ebe9e85753ab1d1d5710",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-legacy-inventory-files.searchpaths-2.json b/mobile/rpc-foundation/goldens/matrix-legacy-inventory-files.searchpaths-2.json
index c9410da2e46c..f69f771fd9c8 100644
--- a/mobile/rpc-foundation/goldens/matrix-legacy-inventory-files.searchpaths-2.json
+++ b/mobile/rpc-foundation/goldens/matrix-legacy-inventory-files.searchpaths-2.json
@@ -3,9 +3,9 @@
   "family": "legacy-inventory",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "262eaad263a45aa13ec5b27c12b59946b12c202474229fff7a5727dba6d702ca",
   "scenarioSha256": "048c3ec55ec67d09d9b02e17822f1154adca577e57ffe6d3059102d552d2f759",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-legacy-inventory-fresh-inventory.json b/mobile/rpc-foundation/goldens/matrix-legacy-inventory-fresh-inventory.json
index f9596f02843c..09b3cbae8749 100644
--- a/mobile/rpc-foundation/goldens/matrix-legacy-inventory-fresh-inventory.json
+++ b/mobile/rpc-foundation/goldens/matrix-legacy-inventory-fresh-inventory.json
@@ -3,9 +3,9 @@
   "family": "legacy-inventory",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "262eaad263a45aa13ec5b27c12b59946b12c202474229fff7a5727dba6d702ca",
   "scenarioSha256": "ad458a3407e3f1303343b46a1308b43535abef2c9ed2f68db59157db5b91daa1",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-legacy-inventory-old-inventory.json b/mobile/rpc-foundation/goldens/matrix-legacy-inventory-old-inventory.json
index f0fec51ab580..5aca63619881 100644
--- a/mobile/rpc-foundation/goldens/matrix-legacy-inventory-old-inventory.json
+++ b/mobile/rpc-foundation/goldens/matrix-legacy-inventory-old-inventory.json
@@ -3,9 +3,9 @@
   "family": "legacy-inventory",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "262eaad263a45aa13ec5b27c12b59946b12c202474229fff7a5727dba6d702ca",
   "scenarioSha256": "52742d894d0ea53db89729101664a393b10794d9c2d2fe7b40b020643a13af81",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-linear-detail-barrier-linear.getissue-1.json b/mobile/rpc-foundation/goldens/matrix-linear-detail-barrier-linear.getissue-1.json
index d30f3c135c38..3d3020deaebd 100644
--- a/mobile/rpc-foundation/goldens/matrix-linear-detail-barrier-linear.getissue-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-linear-detail-barrier-linear.getissue-1.json
@@ -3,9 +3,9 @@
   "family": "linear-detail-barrier",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "d3b7f33d810e1fa420ac41a628cde9fe4a9e65fd57f89fbca0a40fc7d74951ab",
   "scenarioSha256": "8e00afc85e5b82d75bedecea0c748a3c8658cfc8545650e755c03f51fdc932d6",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-linear-detail-barrier-linear.issuecomments-1.json b/mobile/rpc-foundation/goldens/matrix-linear-detail-barrier-linear.issuecomments-1.json
index e9cb83c1aa64..6a39e49786ab 100644
--- a/mobile/rpc-foundation/goldens/matrix-linear-detail-barrier-linear.issuecomments-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-linear-detail-barrier-linear.issuecomments-1.json
@@ -3,9 +3,9 @@
   "family": "linear-detail-barrier",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "d3b7f33d810e1fa420ac41a628cde9fe4a9e65fd57f89fbca0a40fc7d74951ab",
   "scenarioSha256": "40289acce4a3542773f74681d255d67cfddadf6c42317928d6728f26a76f6cfb",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-linear.select-workspace-picker-linear.selectworkspace-1.json b/mobile/rpc-foundation/goldens/matrix-linear.select-workspace-picker-linear.selectworkspace-1.json
index c1e5552f7188..b31443e09133 100644
--- a/mobile/rpc-foundation/goldens/matrix-linear.select-workspace-picker-linear.selectworkspace-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-linear.select-workspace-picker-linear.selectworkspace-1.json
@@ -3,9 +3,9 @@
   "family": "linear.select-workspace-picker",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b65996c152b632d553a31e07e31ea5c76f998eada42cf0966923d730da21908f",
   "scenarioSha256": "c7de1f6fc0895d4ddf1b87a83859da46c583f098e058f14c8f85d48120c80c40",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-live-worktree-name-runtime.clientevents.subscribe-1-1.json b/mobile/rpc-foundation/goldens/matrix-live-worktree-name-runtime.clientevents.subscribe-1-1.json
index d31162e2e584..74ffddc8b2b8 100644
--- a/mobile/rpc-foundation/goldens/matrix-live-worktree-name-runtime.clientevents.subscribe-1-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-live-worktree-name-runtime.clientevents.subscribe-1-1.json
@@ -3,9 +3,9 @@
   "family": "live-worktree-name",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "8e41c8624b9b6185e447cee3590a851ab88b6b1ee1d632af90e3a771a90310be",
   "scenarioSha256": "f3fa2738875e15b640f21e56d3a0628333cd5b271242314b9c328822eec01d34",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-live-worktree-name-runtime.clientevents.subscribe-1-2.json b/mobile/rpc-foundation/goldens/matrix-live-worktree-name-runtime.clientevents.subscribe-1-2.json
index dbbecc3c341d..6d72e3913f26 100644
--- a/mobile/rpc-foundation/goldens/matrix-live-worktree-name-runtime.clientevents.subscribe-1-2.json
+++ b/mobile/rpc-foundation/goldens/matrix-live-worktree-name-runtime.clientevents.subscribe-1-2.json
@@ -3,9 +3,9 @@
   "family": "live-worktree-name",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "8e41c8624b9b6185e447cee3590a851ab88b6b1ee1d632af90e3a771a90310be",
   "scenarioSha256": "24b9ef7c06386b8af8303cfb196d2f652e46759b40aadb7b6af5144c964ea179",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-live-worktree-name-runtime.clientevents.subscribe-2-1.json b/mobile/rpc-foundation/goldens/matrix-live-worktree-name-runtime.clientevents.subscribe-2-1.json
index ddd012e08aee..4017eb86085a 100644
--- a/mobile/rpc-foundation/goldens/matrix-live-worktree-name-runtime.clientevents.subscribe-2-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-live-worktree-name-runtime.clientevents.subscribe-2-1.json
@@ -3,9 +3,9 @@
   "family": "live-worktree-name",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "8e41c8624b9b6185e447cee3590a851ab88b6b1ee1d632af90e3a771a90310be",
   "scenarioSha256": "e13633e6b76dce4aec343c391359adfd39430e91af1b183140fe4423316c81e1",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-live-worktree-name-worktree.show-1.json b/mobile/rpc-foundation/goldens/matrix-live-worktree-name-worktree.show-1.json
index 7f91621772e5..783985104e7e 100644
--- a/mobile/rpc-foundation/goldens/matrix-live-worktree-name-worktree.show-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-live-worktree-name-worktree.show-1.json
@@ -3,9 +3,9 @@
   "family": "live-worktree-name",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "8e41c8624b9b6185e447cee3590a851ab88b6b1ee1d632af90e3a771a90310be",
   "scenarioSha256": "0bbbff1a914ba146777515d6d971144cc62f29f2d484a264513a1ce0f48be96a",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-live-worktree-name-worktree.show-2.json b/mobile/rpc-foundation/goldens/matrix-live-worktree-name-worktree.show-2.json
index bb0d509288dc..06af0bb3874f 100644
--- a/mobile/rpc-foundation/goldens/matrix-live-worktree-name-worktree.show-2.json
+++ b/mobile/rpc-foundation/goldens/matrix-live-worktree-name-worktree.show-2.json
@@ -3,9 +3,9 @@
   "family": "live-worktree-name",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "8e41c8624b9b6185e447cee3590a851ab88b6b1ee1d632af90e3a771a90310be",
   "scenarioSha256": "2ed321bfdc419635734c37b0a1cc4f85d6d92766846e25a37bd547dfa3af8f72",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-live-worktree-name-worktree.show-3.json b/mobile/rpc-foundation/goldens/matrix-live-worktree-name-worktree.show-3.json
index 2e5c27863ae3..df5294fc0338 100644
--- a/mobile/rpc-foundation/goldens/matrix-live-worktree-name-worktree.show-3.json
+++ b/mobile/rpc-foundation/goldens/matrix-live-worktree-name-worktree.show-3.json
@@ -3,9 +3,9 @@
   "family": "live-worktree-name",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "8e41c8624b9b6185e447cee3590a851ab88b6b1ee1d632af90e3a771a90310be",
   "scenarioSha256": "ab7efe1dc6ef2ddfffa69c88bcc936f43393968a2281bc0ebfc864be650e7af1",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-mobileweb.bundle-fetch-app-js.json b/mobile/rpc-foundation/goldens/matrix-mobileweb.bundle-fetch-app-js.json
index f1a6502fe3ca..fe736f7396da 100644
--- a/mobile/rpc-foundation/goldens/matrix-mobileweb.bundle-fetch-app-js.json
+++ b/mobile/rpc-foundation/goldens/matrix-mobileweb.bundle-fetch-app-js.json
@@ -3,9 +3,9 @@
   "family": "mobileWeb.bundle-fetch",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "af339fef2c684d5709c6d3f279e5f0d9c33d17b6d4e5c89e501963400901b564",
   "scenarioSha256": "9de83f3ad2d85d1304a6ff00046b128a97318b3d859c78aa9acde73d9419aabe",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-mobileweb.bundle-fetch-index-head.json b/mobile/rpc-foundation/goldens/matrix-mobileweb.bundle-fetch-index-head.json
index f8744f2373eb..c2cbe4c9b80f 100644
--- a/mobile/rpc-foundation/goldens/matrix-mobileweb.bundle-fetch-index-head.json
+++ b/mobile/rpc-foundation/goldens/matrix-mobileweb.bundle-fetch-index-head.json
@@ -3,9 +3,9 @@
   "family": "mobileWeb.bundle-fetch",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "af339fef2c684d5709c6d3f279e5f0d9c33d17b6d4e5c89e501963400901b564",
   "scenarioSha256": "b15dbbc7f1d9ecc6918c9b9aec395fca93108e39f6b02c82f559dc060383a03b",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-mobileweb.bundle-fetch-index-tail.json b/mobile/rpc-foundation/goldens/matrix-mobileweb.bundle-fetch-index-tail.json
index 3c10217d224d..7f0da328ff60 100644
--- a/mobile/rpc-foundation/goldens/matrix-mobileweb.bundle-fetch-index-tail.json
+++ b/mobile/rpc-foundation/goldens/matrix-mobileweb.bundle-fetch-index-tail.json
@@ -3,9 +3,9 @@
   "family": "mobileWeb.bundle-fetch",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "af339fef2c684d5709c6d3f279e5f0d9c33d17b6d4e5c89e501963400901b564",
   "scenarioSha256": "89539ae4d46c4fd7d93f06e464da91ebfb6da6abad4eda03f67c3bf727c8731f",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-mobileweb.bundle-fetch-mobileweb.bundle.manifest-1.json b/mobile/rpc-foundation/goldens/matrix-mobileweb.bundle-fetch-mobileweb.bundle.manifest-1.json
index 3b22abeb4898..129834bd4c18 100644
--- a/mobile/rpc-foundation/goldens/matrix-mobileweb.bundle-fetch-mobileweb.bundle.manifest-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-mobileweb.bundle-fetch-mobileweb.bundle.manifest-1.json
@@ -3,9 +3,9 @@
   "family": "mobileWeb.bundle-fetch",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "af339fef2c684d5709c6d3f279e5f0d9c33d17b6d4e5c89e501963400901b564",
   "scenarioSha256": "f453e5e35d31bb2f1638ae68d97db16a0955375d3863e124e2aa57f7d1fa292c",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-mobileweb.bundle-manifest-mobileweb.bundle.manifest-1.json b/mobile/rpc-foundation/goldens/matrix-mobileweb.bundle-manifest-mobileweb.bundle.manifest-1.json
index 508254099b7a..d5d66e9516b4 100644
--- a/mobile/rpc-foundation/goldens/matrix-mobileweb.bundle-manifest-mobileweb.bundle.manifest-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-mobileweb.bundle-manifest-mobileweb.bundle.manifest-1.json
@@ -3,9 +3,9 @@
   "family": "mobileWeb.bundle-manifest",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "af339fef2c684d5709c6d3f279e5f0d9c33d17b6d4e5c89e501963400901b564",
   "scenarioSha256": "8f5211fd3de1d77d3ea139f22bd6fc6119c72c08aa016f252a0df14bedf23ab3",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-nativechat.image-paste-terminal.send-1.json b/mobile/rpc-foundation/goldens/matrix-nativechat.image-paste-terminal.send-1.json
index e5d73e9bc269..f802878a60a7 100644
--- a/mobile/rpc-foundation/goldens/matrix-nativechat.image-paste-terminal.send-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-nativechat.image-paste-terminal.send-1.json
@@ -3,9 +3,9 @@
   "family": "nativeChat.image-paste",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "16779b663f4faec8cbccdb42efd7b568a2912845b161f8a4827754687eb4235c",
   "scenarioSha256": "165402f60bc723edb2a867f09573fdae11a7c2ee4ef2be891916cfeb8aab21a0",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-nativechat.image-paste-terminal.send-2.json b/mobile/rpc-foundation/goldens/matrix-nativechat.image-paste-terminal.send-2.json
index 41c96bd6654f..01042c9b7550 100644
--- a/mobile/rpc-foundation/goldens/matrix-nativechat.image-paste-terminal.send-2.json
+++ b/mobile/rpc-foundation/goldens/matrix-nativechat.image-paste-terminal.send-2.json
@@ -3,9 +3,9 @@
   "family": "nativeChat.image-paste",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "16779b663f4faec8cbccdb42efd7b568a2912845b161f8a4827754687eb4235c",
   "scenarioSha256": "443fb50425d5cdbf0b289c6c051732090f165abba9b1ba4c39b712a459c612c9",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-nativechat.image-upload-clipboard.startimageupload-1.json b/mobile/rpc-foundation/goldens/matrix-nativechat.image-upload-clipboard.startimageupload-1.json
index 456d70d52292..8aad2e65a2a2 100644
--- a/mobile/rpc-foundation/goldens/matrix-nativechat.image-upload-clipboard.startimageupload-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-nativechat.image-upload-clipboard.startimageupload-1.json
@@ -3,9 +3,9 @@
   "family": "nativeChat.image-upload",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "16779b663f4faec8cbccdb42efd7b568a2912845b161f8a4827754687eb4235c",
   "scenarioSha256": "0478b692709ef0fe3cd75bf0d47fc27fcbb50ebc779e231537ba36638a0125f8",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-nativechat.session-option-pick-settings.mutatenativechatsessionoptions-1.json b/mobile/rpc-foundation/goldens/matrix-nativechat.session-option-pick-settings.mutatenativechatsessionoptions-1.json
index 523b59649fa6..ea997ee12801 100644
--- a/mobile/rpc-foundation/goldens/matrix-nativechat.session-option-pick-settings.mutatenativechatsessionoptions-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-nativechat.session-option-pick-settings.mutatenativechatsessionoptions-1.json
@@ -3,9 +3,9 @@
   "family": "nativeChat.session-option-pick",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b98a3ca3818678b88cf629bc4635300a103637126a136f025a1600dc16f08008",
   "scenarioSha256": "1305f50c6e838d89d0a9e65d9011d2a532a2f75f7b3aea73f9e33330214f5724",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-nativechat.terminal-write-orchestration.workerterminaluserinput-1.json b/mobile/rpc-foundation/goldens/matrix-nativechat.terminal-write-orchestration.workerterminaluserinput-1.json
index 4a78ba9941a6..72033dfd789c 100644
--- a/mobile/rpc-foundation/goldens/matrix-nativechat.terminal-write-orchestration.workerterminaluserinput-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-nativechat.terminal-write-orchestration.workerterminaluserinput-1.json
@@ -3,9 +3,9 @@
   "family": "nativeChat.terminal-write",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b98a3ca3818678b88cf629bc4635300a103637126a136f025a1600dc16f08008",
   "scenarioSha256": "860d3a80815ec68dc3fe2891a69888b80ec60fa205940e31f14643fb1097ead5",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-nativechat.terminal-write-terminal.send-1.json b/mobile/rpc-foundation/goldens/matrix-nativechat.terminal-write-terminal.send-1.json
index d6a9f8c3864f..e3f8dbb15280 100644
--- a/mobile/rpc-foundation/goldens/matrix-nativechat.terminal-write-terminal.send-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-nativechat.terminal-write-terminal.send-1.json
@@ -3,9 +3,9 @@
   "family": "nativeChat.terminal-write",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b98a3ca3818678b88cf629bc4635300a103637126a136f025a1600dc16f08008",
   "scenarioSha256": "c4193d972250dbe72907dcd32b8300b22986edfa5eeb651268c3838835177c64",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-notifications.desktop-stream-notifications.getmissedsince-1.json b/mobile/rpc-foundation/goldens/matrix-notifications.desktop-stream-notifications.getmissedsince-1.json
index ba902c136a6d..255c3d46378e 100644
--- a/mobile/rpc-foundation/goldens/matrix-notifications.desktop-stream-notifications.getmissedsince-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-notifications.desktop-stream-notifications.getmissedsince-1.json
@@ -3,9 +3,9 @@
   "family": "notifications.desktop-stream",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "eacf859143588ae6bee2804975d642b6c1088d57ae77ffe298620250d9a9f0e4",
   "scenarioSha256": "e13d3072f9a0ff4458ec4231013d29f7131144b52089914cd08914652a2e136b",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-notifications.desktop-stream-notifications.subscribe-1-1.json b/mobile/rpc-foundation/goldens/matrix-notifications.desktop-stream-notifications.subscribe-1-1.json
index 44601d301fa3..9561cf1c0fd2 100644
--- a/mobile/rpc-foundation/goldens/matrix-notifications.desktop-stream-notifications.subscribe-1-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-notifications.desktop-stream-notifications.subscribe-1-1.json
@@ -3,9 +3,9 @@
   "family": "notifications.desktop-stream",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "eacf859143588ae6bee2804975d642b6c1088d57ae77ffe298620250d9a9f0e4",
   "scenarioSha256": "aca5a21c0928ca5e84aac346f543a6840691c92b124c845cd01e3f2de553ea3d",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-notifications.desktop-stream-notifications.subscribe-1-2.json b/mobile/rpc-foundation/goldens/matrix-notifications.desktop-stream-notifications.subscribe-1-2.json
index b2e62af8e68f..bc1ba1fca745 100644
--- a/mobile/rpc-foundation/goldens/matrix-notifications.desktop-stream-notifications.subscribe-1-2.json
+++ b/mobile/rpc-foundation/goldens/matrix-notifications.desktop-stream-notifications.subscribe-1-2.json
@@ -3,9 +3,9 @@
   "family": "notifications.desktop-stream",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "eacf859143588ae6bee2804975d642b6c1088d57ae77ffe298620250d9a9f0e4",
   "scenarioSha256": "53c8aa2ecfc045a50180dc707e353e22eef8511c0815ebacd3bda8cfb69d65c0",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-notifications.desktop-stream-notifications.unsubscribe-1.json b/mobile/rpc-foundation/goldens/matrix-notifications.desktop-stream-notifications.unsubscribe-1.json
index 5883cc11186d..580ba532dc6e 100644
--- a/mobile/rpc-foundation/goldens/matrix-notifications.desktop-stream-notifications.unsubscribe-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-notifications.desktop-stream-notifications.unsubscribe-1.json
@@ -3,9 +3,9 @@
   "family": "notifications.desktop-stream",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "eacf859143588ae6bee2804975d642b6c1088d57ae77ffe298620250d9a9f0e4",
   "scenarioSha256": "afd3985ecdc07a1880aaee81739432633a1e87ec2de2c02166f43a6c78cb493b",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-notifications.display-test-screen-notifications.testpush-1.json b/mobile/rpc-foundation/goldens/matrix-notifications.display-test-screen-notifications.testpush-1.json
index df44dd68281f..9c021bd6b645 100644
--- a/mobile/rpc-foundation/goldens/matrix-notifications.display-test-screen-notifications.testpush-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-notifications.display-test-screen-notifications.testpush-1.json
@@ -3,9 +3,9 @@
   "family": "notifications.display-test-screen",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "f55275c268e49679b37d72ce6cbe71186ce02c77fe3fd53f0f21e796502d62e8",
   "scenarioSha256": "b7a862c0de7dd4efcdf3f4db7c5aeda6b765ab58498f40f3b21232264758b16f",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-notifications.push-dismissal-notifications.getmissedsince-1.json b/mobile/rpc-foundation/goldens/matrix-notifications.push-dismissal-notifications.getmissedsince-1.json
index 9c887a694fc0..a25a4546f4ea 100644
--- a/mobile/rpc-foundation/goldens/matrix-notifications.push-dismissal-notifications.getmissedsince-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-notifications.push-dismissal-notifications.getmissedsince-1.json
@@ -3,9 +3,9 @@
   "family": "notifications.push-dismissal",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "595a3eb2994d0596b9fcd0707b175b4e978625053dfbc5c541b0350c0cbfb524",
   "scenarioSha256": "9ab21cda2ac956c70ddd23fe589778bbb46333314508cf92770d668ba59d5a90",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-notifications.push-registration-notifications.registerpush-1.json b/mobile/rpc-foundation/goldens/matrix-notifications.push-registration-notifications.registerpush-1.json
index 7367d26f3fd0..3cde52720467 100644
--- a/mobile/rpc-foundation/goldens/matrix-notifications.push-registration-notifications.registerpush-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-notifications.push-registration-notifications.registerpush-1.json
@@ -3,9 +3,9 @@
   "family": "notifications.push-registration",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "2e3d939dc162dbc5a38d8a7207111688204a825fd70348721917b3016e1c9470",
   "scenarioSha256": "c77a518d35203370669fea20f7669d7695a2ec851f22b220a8be417c546efeab",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-notifications.push-registration-notifications.unregisterpush-1.json b/mobile/rpc-foundation/goldens/matrix-notifications.push-registration-notifications.unregisterpush-1.json
index 60dc9f50a9c1..98b09225b58f 100644
--- a/mobile/rpc-foundation/goldens/matrix-notifications.push-registration-notifications.unregisterpush-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-notifications.push-registration-notifications.unregisterpush-1.json
@@ -3,9 +3,9 @@
   "family": "notifications.push-registration",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "2e3d939dc162dbc5a38d8a7207111688204a825fd70348721917b3016e1c9470",
   "scenarioSha256": "bb772b4b000644f18b48dcf78b05863b30906bcf588824d94eff086014fa69e8",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-pairing.pre-profile-direct-status.json b/mobile/rpc-foundation/goldens/matrix-pairing.pre-profile-direct-status.json
index ac517ac038d2..878a7b2dc423 100644
--- a/mobile/rpc-foundation/goldens/matrix-pairing.pre-profile-direct-status.json
+++ b/mobile/rpc-foundation/goldens/matrix-pairing.pre-profile-direct-status.json
@@ -3,10 +3,10 @@
   "family": "pairing.pre-profile",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
-  "adapterSha256": "e33d584229530c716ecdc44d198b95fcfb4dfd9468fba7d5222ee3f122950197",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "57c8ad93d162ea69e4a0ecd5de7d8fae6806f8f7a51945c2c13661d81bae6497",
   "scenarioSha256": "a28912c9abb97a227904723ff0de8162de31fce66c056da1813e0c18f6e01ccf",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/matrix-pairing.pre-profile-pairing.getendpoints-1.json b/mobile/rpc-foundation/goldens/matrix-pairing.pre-profile-pairing.getendpoints-1.json
index 612641fa8419..a66ed6e69f5a 100644
--- a/mobile/rpc-foundation/goldens/matrix-pairing.pre-profile-pairing.getendpoints-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-pairing.pre-profile-pairing.getendpoints-1.json
@@ -3,10 +3,10 @@
   "family": "pairing.pre-profile",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
-  "adapterSha256": "e33d584229530c716ecdc44d198b95fcfb4dfd9468fba7d5222ee3f122950197",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "57c8ad93d162ea69e4a0ecd5de7d8fae6806f8f7a51945c2c13661d81bae6497",
   "scenarioSha256": "ccd2ef7c617d13bdf5987f5f89fed6917206205268633b9ef061b92c3580d672",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/matrix-pairing.pre-profile-pairing.provisionrelay-1.json b/mobile/rpc-foundation/goldens/matrix-pairing.pre-profile-pairing.provisionrelay-1.json
index 12ed0fe3cfb9..b59204614958 100644
--- a/mobile/rpc-foundation/goldens/matrix-pairing.pre-profile-pairing.provisionrelay-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-pairing.pre-profile-pairing.provisionrelay-1.json
@@ -3,10 +3,10 @@
   "family": "pairing.pre-profile",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
-  "adapterSha256": "e33d584229530c716ecdc44d198b95fcfb4dfd9468fba7d5222ee3f122950197",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "57c8ad93d162ea69e4a0ecd5de7d8fae6806f8f7a51945c2c13661d81bae6497",
   "scenarioSha256": "399fa8b85d9c2fc341ea2284a54aed278fd1a5b19a84cc9284c29d5a583bc519",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/matrix-pairing.pre-profile-relay-status.json b/mobile/rpc-foundation/goldens/matrix-pairing.pre-profile-relay-status.json
index 0863b06ec7aa..38a4ee6d5f08 100644
--- a/mobile/rpc-foundation/goldens/matrix-pairing.pre-profile-relay-status.json
+++ b/mobile/rpc-foundation/goldens/matrix-pairing.pre-profile-relay-status.json
@@ -3,10 +3,10 @@
   "family": "pairing.pre-profile",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
-  "adapterSha256": "e33d584229530c716ecdc44d198b95fcfb4dfd9468fba7d5222ee3f122950197",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "57c8ad93d162ea69e4a0ecd5de7d8fae6806f8f7a51945c2c13661d81bae6497",
   "scenarioSha256": "14931cc23cd0e6d850f596c880014c606834898acbeee4abff3dc83a94b0c6c0",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/matrix-project-explicit-false-github.project.updateissuebyslug-1.json b/mobile/rpc-foundation/goldens/matrix-project-explicit-false-github.project.updateissuebyslug-1.json
index 847ca2faa3d9..46d7585d11fa 100644
--- a/mobile/rpc-foundation/goldens/matrix-project-explicit-false-github.project.updateissuebyslug-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-project-explicit-false-github.project.updateissuebyslug-1.json
@@ -3,9 +3,9 @@
   "family": "project-explicit-false",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "d3b7f33d810e1fa420ac41a628cde9fe4a9e65fd57f89fbca0a40fc7d74951ab",
   "scenarioSha256": "926f0d8c37a33d465bf3a04f056600cfc9f1669b1eca7e968aa1a1f797a74c61",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-relay.credential-rotation-pairing.getendpoints-1.json b/mobile/rpc-foundation/goldens/matrix-relay.credential-rotation-pairing.getendpoints-1.json
index fecaf04d061f..f1b5b508ccf4 100644
--- a/mobile/rpc-foundation/goldens/matrix-relay.credential-rotation-pairing.getendpoints-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-relay.credential-rotation-pairing.getendpoints-1.json
@@ -3,10 +3,10 @@
   "family": "relay.credential-rotation",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
-  "adapterSha256": "651e75383caf1b30c329dec2d5d4f0da5358c410402d03cbb087f39600d7a4d2",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "374a16da4187ee44fcc6e07daf822ae96ecfc13ab47ee6c29d048b1c0bd0f291",
   "scenarioSha256": "042d0f9ef57e2a18bf661b79f2f8f92a12125dbc0fc65dd8605f8cd6f7059d10",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/matrix-relay.credential-rotation-pairing.getendpoints-2.json b/mobile/rpc-foundation/goldens/matrix-relay.credential-rotation-pairing.getendpoints-2.json
index 65a07363a94e..7698befb4c5a 100644
--- a/mobile/rpc-foundation/goldens/matrix-relay.credential-rotation-pairing.getendpoints-2.json
+++ b/mobile/rpc-foundation/goldens/matrix-relay.credential-rotation-pairing.getendpoints-2.json
@@ -3,10 +3,10 @@
   "family": "relay.credential-rotation",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
-  "adapterSha256": "651e75383caf1b30c329dec2d5d4f0da5358c410402d03cbb087f39600d7a4d2",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "374a16da4187ee44fcc6e07daf822ae96ecfc13ab47ee6c29d048b1c0bd0f291",
   "scenarioSha256": "530aa1f2ddc6fce10d485c8a160ae3e695250b2e80e1e7fc3e8dacb9f5117347",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/matrix-relay.credential-rotation-pairing.provisionrelay-1.json b/mobile/rpc-foundation/goldens/matrix-relay.credential-rotation-pairing.provisionrelay-1.json
index d253fdfc31a1..edc674f77efb 100644
--- a/mobile/rpc-foundation/goldens/matrix-relay.credential-rotation-pairing.provisionrelay-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-relay.credential-rotation-pairing.provisionrelay-1.json
@@ -3,10 +3,10 @@
   "family": "relay.credential-rotation",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
-  "adapterSha256": "651e75383caf1b30c329dec2d5d4f0da5358c410402d03cbb087f39600d7a4d2",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "374a16da4187ee44fcc6e07daf822ae96ecfc13ab47ee6c29d048b1c0bd0f291",
   "scenarioSha256": "18b1855f354c23cd5bb7af0db698f0a23d28208c3c6b7347f667bf6cd3ed612f",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/matrix-relay.direct-upgrade-pairing.getendpoints-1.json b/mobile/rpc-foundation/goldens/matrix-relay.direct-upgrade-pairing.getendpoints-1.json
index 161e4777c0ba..66c4a2477163 100644
--- a/mobile/rpc-foundation/goldens/matrix-relay.direct-upgrade-pairing.getendpoints-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-relay.direct-upgrade-pairing.getendpoints-1.json
@@ -3,10 +3,10 @@
   "family": "relay.direct-upgrade",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
-  "adapterSha256": "651e75383caf1b30c329dec2d5d4f0da5358c410402d03cbb087f39600d7a4d2",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "374a16da4187ee44fcc6e07daf822ae96ecfc13ab47ee6c29d048b1c0bd0f291",
   "scenarioSha256": "03355bc2696d02fed125d9f0e24c6c26c8df2f3709c1c5f4412aaf9317cd41d4",
   "platform": "darwin",
   "scenarioVersion": 1,
@@ -131,6 +131,32 @@
         }
       }
     },
+    "232ca274f695": {
+      "status": "fulfilled",
+      "startedAt": 0,
+      "settledAt": 0,
+      "value": {
+        "bundle": {
+          "current": {
+            "expiresAt": 1767830400000,
+            "hash": "7ehR_WuQWkxwOFJdkHfI5jEg4DeVYWImtDuip60LHK4",
+            "token": "pending00000000000000000000000000000000001x",
+            "version": 4
+          },
+          "deviceToken": "device-token-1",
+          "hostId": "host-1",
+          "v": 1
+        },
+        "relay": {
+          "assignmentEpoch": 1,
+          "cellUrl": "https://cell.example",
+          "directorUrl": "https://director.example",
+          "e2eeFraming": 2,
+          "relayHostId": "relay-host-0001x",
+          "v": 1
+        }
+      }
+    },
     "240d8ec7e573": {
       "name": "pairing.getEndpoints#2",
       "ordinal": 5,
@@ -307,53 +333,6 @@
         }
       }
     },
-    "590b3311b0c4": {
-      "status": "fulfilled",
-      "startedAt": 0,
-      "settledAt": 0,
-      "value": {
-        "bundle": {
-          "current": {
-            "expiresAt": 1767830400000,
-            "hash": "7ehR_WuQWkxwOFJdkHfI5jEg4DeVYWImtDuip60LHK4",
-            "token": "pending00000000000000000000000000000000001x",
-            "version": 4
-          },
-          "deviceToken": "device-token-1",
-          "hostId": "host-1",
-          "v": 1
-        },
-        "host": {
-          "deviceToken": "device-token-1",
-          "endpoint": "ws://192.168.1.10:8765",
-          "endpoints": [
-            {
-              "id": "direct-primary",
-              "kind": "lan",
-              "url": "ws://192.168.1.10:8765"
-            },
-            {
-              "id": "relay-primary",
-              "kind": "relay",
-              "url": "wss://cell.example/v1/connect/relay-host-0001x"
-            }
-          ],
-          "id": "host-1",
-          "lastConnected": 1767225600000,
-          "name": "Fixture host",
-          "publicKeyB64": "AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8=",
-          "relay": {
-            "assignmentEpoch": 1,
-            "cellUrl": "https://cell.example",
-            "directorUrl": "https://director.example",
-            "e2eeFraming": 2,
-            "relayHostId": "relay-host-0001x",
-            "v": 1
-          },
-          "relayHostId": "relay-host-0001x"
-        }
-      }
-    },
     "691df8767d71": {
       "name": "journal-cleared",
       "ordinal": 9,
@@ -678,7 +657,7 @@
           "sender": ["6e14239ef339", "2fce658b56a1", "240d8ec7e573"],
           "payloads": ["c5d28dd067e4", "f41ffc93936f", "10098087f961"],
           "settlements": {
-            "upgrade": "590b3311b0c4"
+            "upgrade": "232ca274f695"
           },
           "state": "980bbba0b617",
           "effects": ["aaef09eec3f3", "161baaed4df3", "691df8767d71"]
diff --git a/mobile/rpc-foundation/goldens/matrix-relay.direct-upgrade-pairing.getendpoints-2.json b/mobile/rpc-foundation/goldens/matrix-relay.direct-upgrade-pairing.getendpoints-2.json
index 9abf285105f6..7bf353e83710 100644
--- a/mobile/rpc-foundation/goldens/matrix-relay.direct-upgrade-pairing.getendpoints-2.json
+++ b/mobile/rpc-foundation/goldens/matrix-relay.direct-upgrade-pairing.getendpoints-2.json
@@ -3,10 +3,10 @@
   "family": "relay.direct-upgrade",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
-  "adapterSha256": "651e75383caf1b30c329dec2d5d4f0da5358c410402d03cbb087f39600d7a4d2",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "374a16da4187ee44fcc6e07daf822ae96ecfc13ab47ee6c29d048b1c0bd0f291",
   "scenarioSha256": "d0c4dd34645308f30c0999ea74c16b53f20e9183832fdf016c3dc21434744b05",
   "platform": "darwin",
   "scenarioVersion": 1,
@@ -66,6 +66,32 @@
       "ordinal": 8,
       "value": "host-1"
     },
+    "232ca274f695": {
+      "status": "fulfilled",
+      "startedAt": 0,
+      "settledAt": 0,
+      "value": {
+        "bundle": {
+          "current": {
+            "expiresAt": 1767830400000,
+            "hash": "7ehR_WuQWkxwOFJdkHfI5jEg4DeVYWImtDuip60LHK4",
+            "token": "pending00000000000000000000000000000000001x",
+            "version": 4
+          },
+          "deviceToken": "device-token-1",
+          "hostId": "host-1",
+          "v": 1
+        },
+        "relay": {
+          "assignmentEpoch": 1,
+          "cellUrl": "https://cell.example",
+          "directorUrl": "https://director.example",
+          "e2eeFraming": 2,
+          "relayHostId": "relay-host-0001x",
+          "v": 1
+        }
+      }
+    },
     "240d8ec7e573": {
       "name": "pairing.getEndpoints#2",
       "ordinal": 5,
@@ -183,53 +209,6 @@
       "journal": "present",
       "outcome": "failed: refused: outer refused"
     },
-    "590b3311b0c4": {
-      "status": "fulfilled",
-      "startedAt": 0,
-      "settledAt": 0,
-      "value": {
-        "bundle": {
-          "current": {
-            "expiresAt": 1767830400000,
-            "hash": "7ehR_WuQWkxwOFJdkHfI5jEg4DeVYWImtDuip60LHK4",
-            "token": "pending00000000000000000000000000000000001x",
-            "version": 4
-          },
-          "deviceToken": "device-token-1",
-          "hostId": "host-1",
-          "v": 1
-        },
-        "host": {
-          "deviceToken": "device-token-1",
-          "endpoint": "ws://192.168.1.10:8765",
-          "endpoints": [
-            {
-              "id": "direct-primary",
-              "kind": "lan",
-              "url": "ws://192.168.1.10:8765"
-            },
-            {
-              "id": "relay-primary",
-              "kind": "relay",
-              "url": "wss://cell.example/v1/connect/relay-host-0001x"
-            }
-          ],
-          "id": "host-1",
-          "lastConnected": 1767225600000,
-          "name": "Fixture host",
-          "publicKeyB64": "AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8=",
-          "relay": {
-            "assignmentEpoch": 1,
-            "cellUrl": "https://cell.example",
-            "directorUrl": "https://director.example",
-            "e2eeFraming": 2,
-            "relayHostId": "relay-host-0001x",
-            "v": 1
-          },
-          "relayHostId": "relay-host-0001x"
-        }
-      }
-    },
     "5d4b5d435fef": {
       "name": "pairing.getEndpoints#2",
       "ordinal": 5,
@@ -673,7 +652,7 @@
           "sender": ["6e14239ef339", "2fce658b56a1", "240d8ec7e573"],
           "payloads": ["c5d28dd067e4", "f41ffc93936f", "10098087f961"],
           "settlements": {
-            "upgrade": "590b3311b0c4"
+            "upgrade": "232ca274f695"
           },
           "state": "980bbba0b617",
           "effects": ["aaef09eec3f3", "161baaed4df3", "691df8767d71"]
diff --git a/mobile/rpc-foundation/goldens/matrix-relay.direct-upgrade-pairing.provisionrelay-1.json b/mobile/rpc-foundation/goldens/matrix-relay.direct-upgrade-pairing.provisionrelay-1.json
index 61a9dfa4be87..a9ac9f36c10a 100644
--- a/mobile/rpc-foundation/goldens/matrix-relay.direct-upgrade-pairing.provisionrelay-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-relay.direct-upgrade-pairing.provisionrelay-1.json
@@ -3,10 +3,10 @@
   "family": "relay.direct-upgrade",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
-  "adapterSha256": "651e75383caf1b30c329dec2d5d4f0da5358c410402d03cbb087f39600d7a4d2",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "374a16da4187ee44fcc6e07daf822ae96ecfc13ab47ee6c29d048b1c0bd0f291",
   "scenarioSha256": "0fe163f405373adbb1913dddd79d6d596bf88d69fc27c824ba5a2cd4c1406446",
   "platform": "darwin",
   "scenarioVersion": 1,
@@ -101,6 +101,32 @@
         }
       }
     },
+    "232ca274f695": {
+      "status": "fulfilled",
+      "startedAt": 0,
+      "settledAt": 0,
+      "value": {
+        "bundle": {
+          "current": {
+            "expiresAt": 1767830400000,
+            "hash": "7ehR_WuQWkxwOFJdkHfI5jEg4DeVYWImtDuip60LHK4",
+            "token": "pending00000000000000000000000000000000001x",
+            "version": 4
+          },
+          "deviceToken": "device-token-1",
+          "hostId": "host-1",
+          "v": 1
+        },
+        "relay": {
+          "assignmentEpoch": 1,
+          "cellUrl": "https://cell.example",
+          "directorUrl": "https://director.example",
+          "e2eeFraming": 2,
+          "relayHostId": "relay-host-0001x",
+          "v": 1
+        }
+      }
+    },
     "240d8ec7e573": {
       "name": "pairing.getEndpoints#2",
       "ordinal": 5,
@@ -208,53 +234,6 @@
       "journal": "present",
       "outcome": "failed: refused: outer refused"
     },
-    "590b3311b0c4": {
-      "status": "fulfilled",
-      "startedAt": 0,
-      "settledAt": 0,
-      "value": {
-        "bundle": {
-          "current": {
-            "expiresAt": 1767830400000,
-            "hash": "7ehR_WuQWkxwOFJdkHfI5jEg4DeVYWImtDuip60LHK4",
-            "token": "pending00000000000000000000000000000000001x",
-            "version": 4
-          },
-          "deviceToken": "device-token-1",
-          "hostId": "host-1",
-          "v": 1
-        },
-        "host": {
-          "deviceToken": "device-token-1",
-          "endpoint": "ws://192.168.1.10:8765",
-          "endpoints": [
-            {
-              "id": "direct-primary",
-              "kind": "lan",
-              "url": "ws://192.168.1.10:8765"
-            },
-            {
-              "id": "relay-primary",
-              "kind": "relay",
-              "url": "wss://cell.example/v1/connect/relay-host-0001x"
-            }
-          ],
-          "id": "host-1",
-          "lastConnected": 1767225600000,
-          "name": "Fixture host",
-          "publicKeyB64": "AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8=",
-          "relay": {
-            "assignmentEpoch": 1,
-            "cellUrl": "https://cell.example",
-            "directorUrl": "https://director.example",
-            "e2eeFraming": 2,
-            "relayHostId": "relay-host-0001x",
-            "v": 1
-          },
-          "relayHostId": "relay-host-0001x"
-        }
-      }
-    },
     "65dfa1d22ba8": {
       "name": "pairing.provisionRelay#1",
       "ordinal": 3,
@@ -688,7 +667,7 @@
           "sender": ["6e14239ef339", "2fce658b56a1", "240d8ec7e573"],
           "payloads": ["c5d28dd067e4", "f41ffc93936f", "10098087f961"],
           "settlements": {
-            "upgrade": "590b3311b0c4"
+            "upgrade": "232ca274f695"
           },
           "state": "980bbba0b617",
           "effects": ["aaef09eec3f3", "161baaed4df3", "691df8767d71"]
diff --git a/mobile/rpc-foundation/goldens/matrix-relay.pairing-recovery-pairing.getendpoints-1.json b/mobile/rpc-foundation/goldens/matrix-relay.pairing-recovery-pairing.getendpoints-1.json
index 4184575793de..c1b44082403d 100644
--- a/mobile/rpc-foundation/goldens/matrix-relay.pairing-recovery-pairing.getendpoints-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-relay.pairing-recovery-pairing.getendpoints-1.json
@@ -3,10 +3,10 @@
   "family": "relay.pairing-recovery",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
-  "adapterSha256": "e33d584229530c716ecdc44d198b95fcfb4dfd9468fba7d5222ee3f122950197",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "57c8ad93d162ea69e4a0ecd5de7d8fae6806f8f7a51945c2c13661d81bae6497",
   "scenarioSha256": "5aaa104a652d4f10cd48ab742112cf59fca22f52bbf85ee3716505a9642fbe37",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/matrix-session.browser-tab-create-browser.tabcreate-1.json b/mobile/rpc-foundation/goldens/matrix-session.browser-tab-create-browser.tabcreate-1.json
index 3fb7066b1ba6..52aca46c39ad 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.browser-tab-create-browser.tabcreate-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.browser-tab-create-browser.tabcreate-1.json
@@ -3,9 +3,9 @@
   "family": "session.browser-tab-create",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "562c2f4ab669e774dd7045ecd9518e483845433fef6034688090f3b056df2815",
   "scenarioSha256": "6c606813584d6ac89251c725a556d717603acde405a8d45ef6d844e06f2da67a",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.content-create-files.createfile-1.json b/mobile/rpc-foundation/goldens/matrix-session.content-create-files.createfile-1.json
index b978b65c12ad..ca2bf0d57abc 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.content-create-files.createfile-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.content-create-files.createfile-1.json
@@ -3,9 +3,9 @@
   "family": "session.content-create",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "562c2f4ab669e774dd7045ecd9518e483845433fef6034688090f3b056df2815",
   "scenarioSha256": "06bf92360e6985770c08a9e53be0f55b6e8ff120d4e6411dacc22e88d08cef32",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.content-create-files.open-1.json b/mobile/rpc-foundation/goldens/matrix-session.content-create-files.open-1.json
index e959bf5466dc..b306aff0691c 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.content-create-files.open-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.content-create-files.open-1.json
@@ -3,9 +3,9 @@
   "family": "session.content-create",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "562c2f4ab669e774dd7045ecd9518e483845433fef6034688090f3b056df2815",
   "scenarioSha256": "17f87233352ff8e452f061f4558d58b44643efe49313162d4aad140343a1ead9",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.content-create-status.get-1.json b/mobile/rpc-foundation/goldens/matrix-session.content-create-status.get-1.json
index 191cddf8ffc8..6bd3875e6c6b 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.content-create-status.get-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.content-create-status.get-1.json
@@ -3,9 +3,9 @@
   "family": "session.content-create",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "562c2f4ab669e774dd7045ecd9518e483845433fef6034688090f3b056df2815",
   "scenarioSha256": "5100bd674509d1d83b1e2594eee036af21ea14b12226185b44070555d1d43060",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.content-create-worktree.show-1.json b/mobile/rpc-foundation/goldens/matrix-session.content-create-worktree.show-1.json
index 545543cd356e..8b995a39f1d6 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.content-create-worktree.show-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.content-create-worktree.show-1.json
@@ -3,9 +3,9 @@
   "family": "session.content-create",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "562c2f4ab669e774dd7045ecd9518e483845433fef6034688090f3b056df2815",
   "scenarioSha256": "b9ca49e401df8710924f200f92a071bac2e120ed43df7be2cfb8a325ab1cd9cb",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.create-terminal-session.tabs.createterminal-1.json b/mobile/rpc-foundation/goldens/matrix-session.create-terminal-session.tabs.createterminal-1.json
index d2a320ab6215..89ea3ff7faf6 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.create-terminal-session.tabs.createterminal-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.create-terminal-session.tabs.createterminal-1.json
@@ -3,9 +3,9 @@
   "family": "session.create-terminal",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fa7d9fd6428e89282f08e04fefba4289000eb3aed1462489a2f11efed374382c",
   "scenarioSha256": "ae1572c1670073d0ac3d2d3abd0e7bee9910cbe4a0b09ecd941e887eeb1db165",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.create-terminal-terminal.send-1.json b/mobile/rpc-foundation/goldens/matrix-session.create-terminal-terminal.send-1.json
index 92a4c5e58fbb..66a448071178 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.create-terminal-terminal.send-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.create-terminal-terminal.send-1.json
@@ -3,9 +3,9 @@
   "family": "session.create-terminal",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fa7d9fd6428e89282f08e04fefba4289000eb3aed1462489a2f11efed374382c",
   "scenarioSha256": "62930616f1017ffd4b74546c80b17f3aa3bcee52a6ad62ec144d95872fd31321",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.diff-notes-worktree.show-1.json b/mobile/rpc-foundation/goldens/matrix-session.diff-notes-worktree.show-1.json
index 773bf5107a0a..50dcddadb557 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.diff-notes-worktree.show-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.diff-notes-worktree.show-1.json
@@ -3,9 +3,9 @@
   "family": "session.diff-notes",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "42334358b5e5966001639653b553f15033f6e201d785107871fe056536f0a5e2",
   "scenarioSha256": "e54684bad13aa8b8b4794e06351c709053b1c4c6d87776ecdbb1dd1b4406a694",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.diff-review-actions-worktree.set-1.json b/mobile/rpc-foundation/goldens/matrix-session.diff-review-actions-worktree.set-1.json
index f695faa44497..039d20a56622 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.diff-review-actions-worktree.set-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.diff-review-actions-worktree.set-1.json
@@ -3,10 +3,10 @@
   "family": "session.diff-review-actions",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
-  "adapterSha256": "2d72b8e68a66a906394167beb8c78f1c0521ca1e731976fd26963ec3bfa9cca4",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "86ef3d98ee6c11726bf0991e1a40400b60666b0a2e24d137abe66562fe5876bc",
   "scenarioSha256": "c583058382c949e977b7a1287895ed9ccb8cb408b684aef186b629976ff1da4d",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/matrix-session.diff-review-base-ref-show.json b/mobile/rpc-foundation/goldens/matrix-session.diff-review-base-ref-show.json
index 373de909b870..252347370060 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.diff-review-base-ref-show.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.diff-review-base-ref-show.json
@@ -3,9 +3,9 @@
   "family": "session.diff-review",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a8016eb61915cf80a3bdeb622ee67d35be8b4b9862a75e4ef2e8f4ff8e93e7f2",
   "scenarioSha256": "17e2b30594a2b37e82ff1976377722c2f1c3ae7f01857e50e010a2dd2e89da3a",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.diff-review-git.branchcompare-1.json b/mobile/rpc-foundation/goldens/matrix-session.diff-review-git.branchcompare-1.json
index fccca9f7de75..3e636b0a1db1 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.diff-review-git.branchcompare-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.diff-review-git.branchcompare-1.json
@@ -3,9 +3,9 @@
   "family": "session.diff-review",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a8016eb61915cf80a3bdeb622ee67d35be8b4b9862a75e4ef2e8f4ff8e93e7f2",
   "scenarioSha256": "b99f51a5527e42a32ea9203ad75b16f9dd3cdcdc2a3ed235f6467ac1c7e3a4f3",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.diff-review-git.status-1.json b/mobile/rpc-foundation/goldens/matrix-session.diff-review-git.status-1.json
index 9515e1c51450..377a84d8ec0c 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.diff-review-git.status-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.diff-review-git.status-1.json
@@ -3,9 +3,9 @@
   "family": "session.diff-review",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a8016eb61915cf80a3bdeb622ee67d35be8b4b9862a75e4ef2e8f4ff8e93e7f2",
   "scenarioSha256": "b4627f9ac9bc090a2b48fd35f32d5dc3d66fefe0fb65abab75597ef2c73510ec",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.diff-review-repo.list-1.json b/mobile/rpc-foundation/goldens/matrix-session.diff-review-repo.list-1.json
index f2683d727ff3..ea586be64af1 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.diff-review-repo.list-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.diff-review-repo.list-1.json
@@ -3,9 +3,9 @@
   "family": "session.diff-review",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a8016eb61915cf80a3bdeb622ee67d35be8b4b9862a75e4ef2e8f4ff8e93e7f2",
   "scenarioSha256": "c9f720134506b6db71b742c219abe736fca1f90070403d7c96df9396fd048b6f",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.diff-review-review-show.json b/mobile/rpc-foundation/goldens/matrix-session.diff-review-review-show.json
index 6fee790d44a0..1058b2aef3a8 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.diff-review-review-show.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.diff-review-review-show.json
@@ -3,9 +3,9 @@
   "family": "session.diff-review",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a8016eb61915cf80a3bdeb622ee67d35be8b4b9862a75e4ef2e8f4ff8e93e7f2",
   "scenarioSha256": "f17bb817f9a172e776f1814920d58abc7db122da9c49cfe3bbeaf217f82d70d7",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.markdown-disk-fallback-files.read-1.json b/mobile/rpc-foundation/goldens/matrix-session.markdown-disk-fallback-files.read-1.json
index 7989c55cfcbe..b110bd884a1d 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.markdown-disk-fallback-files.read-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.markdown-disk-fallback-files.read-1.json
@@ -3,9 +3,9 @@
   "family": "session.markdown-disk-fallback",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a3daf9a05d05424959baf77feb45cb0c076d77d8c49e877941ed612cc1e5ce95",
   "scenarioSha256": "c4b6c9c21433876e2bb3822f289627e7c5607830559289d35cae066ff895fc23",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.markdown-disk-fallback-markdown.readtab-1.json b/mobile/rpc-foundation/goldens/matrix-session.markdown-disk-fallback-markdown.readtab-1.json
index edcb8b8d52b7..91909e865ffd 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.markdown-disk-fallback-markdown.readtab-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.markdown-disk-fallback-markdown.readtab-1.json
@@ -3,9 +3,9 @@
   "family": "session.markdown-disk-fallback",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a3daf9a05d05424959baf77feb45cb0c076d77d8c49e877941ed612cc1e5ce95",
   "scenarioSha256": "42ddfcc6c8cac61e5891b72fbac9d04763fa9c52d0cb4f44e1044714a8a1ee77",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.markdown-save-markdown.savetab-1.json b/mobile/rpc-foundation/goldens/matrix-session.markdown-save-markdown.savetab-1.json
index d91c73248de0..fb1c7e64b196 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.markdown-save-markdown.savetab-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.markdown-save-markdown.savetab-1.json
@@ -3,9 +3,9 @@
   "family": "session.markdown-save",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "42334358b5e5966001639653b553f15033f6e201d785107871fe056536f0a5e2",
   "scenarioSha256": "389c6118f3137b78e88af6b901554b0331c652063a00d8ba3119e0883ce82f25",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.native-chat-page-nativechat.readsession-1.json b/mobile/rpc-foundation/goldens/matrix-session.native-chat-page-nativechat.readsession-1.json
index 48bcc36a6790..7bcea9f41e34 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.native-chat-page-nativechat.readsession-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.native-chat-page-nativechat.readsession-1.json
@@ -3,9 +3,9 @@
   "family": "session.native-chat-page",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "60ce67f66134d6385aa7fb47f2135436a7b3ce0221e3b2514bea65e06dba5518",
   "scenarioSha256": "8a6f6d37fd7dbc9e0da081565f24b270949306c47a874568874ec8ce2579076b",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.native-chat-page-nativechat.subscribe-1-1.json b/mobile/rpc-foundation/goldens/matrix-session.native-chat-page-nativechat.subscribe-1-1.json
index 587035988993..301135042b25 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.native-chat-page-nativechat.subscribe-1-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.native-chat-page-nativechat.subscribe-1-1.json
@@ -3,9 +3,9 @@
   "family": "session.native-chat-page",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "60ce67f66134d6385aa7fb47f2135436a7b3ce0221e3b2514bea65e06dba5518",
   "scenarioSha256": "de804d4fa5287b07be9079d21e0a3cfc7f22d0e4b8649f13a3465a30683a77c8",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.native-chat-page-nativechat.subscribe-2-1.json b/mobile/rpc-foundation/goldens/matrix-session.native-chat-page-nativechat.subscribe-2-1.json
index 712b6ad786c1..1b63830b2deb 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.native-chat-page-nativechat.subscribe-2-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.native-chat-page-nativechat.subscribe-2-1.json
@@ -3,9 +3,9 @@
   "family": "session.native-chat-page",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "60ce67f66134d6385aa7fb47f2135436a7b3ce0221e3b2514bea65e06dba5518",
   "scenarioSha256": "f7535862ae280e7e47916ad25701040e25d3318baceea52515c9d81b4144ae92",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.native-chat-readability-repo.list-1.json b/mobile/rpc-foundation/goldens/matrix-session.native-chat-readability-repo.list-1.json
index 37d4e0050865..1f825b99b809 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.native-chat-readability-repo.list-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.native-chat-readability-repo.list-1.json
@@ -3,9 +3,9 @@
   "family": "session.native-chat-readability",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a3daf9a05d05424959baf77feb45cb0c076d77d8c49e877941ed612cc1e5ce95",
   "scenarioSha256": "d6a0472f274d55aab584b58b67018d042ee1ba6799f42072a8a5986f45554bfc",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.native-chat-stop-orchestration.workerterminaluserinput-1.json b/mobile/rpc-foundation/goldens/matrix-session.native-chat-stop-orchestration.workerterminaluserinput-1.json
index f1f6fa81f3b2..90bd2675ef3e 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.native-chat-stop-orchestration.workerterminaluserinput-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.native-chat-stop-orchestration.workerterminaluserinput-1.json
@@ -3,9 +3,9 @@
   "family": "session.native-chat-stop",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a3daf9a05d05424959baf77feb45cb0c076d77d8c49e877941ed612cc1e5ce95",
   "scenarioSha256": "a60de7b496f8149593a6e89cd2d29e20fdf75d26536592fec6b0100b43322d3b",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.native-chat-stop-terminal.send-1.json b/mobile/rpc-foundation/goldens/matrix-session.native-chat-stop-terminal.send-1.json
index fa26f91b6cfa..a6ab1484dd11 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.native-chat-stop-terminal.send-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.native-chat-stop-terminal.send-1.json
@@ -3,9 +3,9 @@
   "family": "session.native-chat-stop",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a3daf9a05d05424959baf77feb45cb0c076d77d8c49e877941ed612cc1e5ce95",
   "scenarioSha256": "96499f352af2ff884bfa94996659609fdbd228e1d071ad462400b978ab8e239b",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.native-chat-stop-terminal.send-2.json b/mobile/rpc-foundation/goldens/matrix-session.native-chat-stop-terminal.send-2.json
index b56116470062..be04167eb324 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.native-chat-stop-terminal.send-2.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.native-chat-stop-terminal.send-2.json
@@ -3,9 +3,9 @@
   "family": "session.native-chat-stop",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a3daf9a05d05424959baf77feb45cb0c076d77d8c49e877941ed612cc1e5ce95",
   "scenarioSha256": "c28251d769ca9788952ed4fb29d8665c870fb85f2c5a4f32f8af33baf44498af",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.pr-branch-context-git.branchcompare-1.json b/mobile/rpc-foundation/goldens/matrix-session.pr-branch-context-git.branchcompare-1.json
index 8860d8480a42..35356ae5376f 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.pr-branch-context-git.branchcompare-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.pr-branch-context-git.branchcompare-1.json
@@ -3,9 +3,9 @@
   "family": "session.pr-branch-context",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "f560ff1582487c118756c527faa1fb1f65e37ce22ca9573491fd4b2dbcedf38d",
   "scenarioSha256": "af78542ad2c449b629f8705b940ec92fd16f879a9bcc81ff6ae3a192f804fa2c",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.pr-branch-context-git.status-1.json b/mobile/rpc-foundation/goldens/matrix-session.pr-branch-context-git.status-1.json
index 3ffd233f6ce0..9190412e1683 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.pr-branch-context-git.status-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.pr-branch-context-git.status-1.json
@@ -3,9 +3,9 @@
   "family": "session.pr-branch-context",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "f560ff1582487c118756c527faa1fb1f65e37ce22ca9573491fd4b2dbcedf38d",
   "scenarioSha256": "1e7cad00f4dfcda65a3830b0b2468020816b940611af1b68600de33cd8c1d7c2",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.pr-branch-context-repo.list-1.json b/mobile/rpc-foundation/goldens/matrix-session.pr-branch-context-repo.list-1.json
index b282e8f5b4a4..4be13a32f11a 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.pr-branch-context-repo.list-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.pr-branch-context-repo.list-1.json
@@ -3,9 +3,9 @@
   "family": "session.pr-branch-context",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "f560ff1582487c118756c527faa1fb1f65e37ce22ca9573491fd4b2dbcedf38d",
   "scenarioSha256": "d456ec18056eb9663e99d4991784bd802422256d81ddd7509720814da06915f4",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.pr-branch-context-worktree.show-1.json b/mobile/rpc-foundation/goldens/matrix-session.pr-branch-context-worktree.show-1.json
index ce66b9f2c1b7..8e9287ac1da8 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.pr-branch-context-worktree.show-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.pr-branch-context-worktree.show-1.json
@@ -3,9 +3,9 @@
   "family": "session.pr-branch-context",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "f560ff1582487c118756c527faa1fb1f65e37ce22ca9573491fd4b2dbcedf38d",
   "scenarioSha256": "039f26cc90d2239028d6ad1d9ecae9cc976d48f386f2d29fbfa425afc702657d",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.pr-sidebar-github.prchecks-1.json b/mobile/rpc-foundation/goldens/matrix-session.pr-sidebar-github.prchecks-1.json
index 73a110d15a5a..c08ed1bbc216 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.pr-sidebar-github.prchecks-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.pr-sidebar-github.prchecks-1.json
@@ -3,9 +3,9 @@
   "family": "session.pr-sidebar",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "87ffa2daea415d2682f1112025b5bd9d52404c6fc7c239180a3ad2120678ff1f",
   "scenarioSha256": "97a92fc3e9b496a6295fb01e490407c1154cd19c54777fdce67377e07af08729",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.pr-sidebar-github.prforbranch-1.json b/mobile/rpc-foundation/goldens/matrix-session.pr-sidebar-github.prforbranch-1.json
index 3e31e9adaae5..d10ae826214f 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.pr-sidebar-github.prforbranch-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.pr-sidebar-github.prforbranch-1.json
@@ -3,9 +3,9 @@
   "family": "session.pr-sidebar",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "87ffa2daea415d2682f1112025b5bd9d52404c6fc7c239180a3ad2120678ff1f",
   "scenarioSha256": "cb052d2107df7bbf24927199935dde7f30352ce875c7ddd7bbab7d8044da0add",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.pr-sidebar-hostedreview.forbranch-1.json b/mobile/rpc-foundation/goldens/matrix-session.pr-sidebar-hostedreview.forbranch-1.json
index a9fc4d25fb51..a77e3f98f5a5 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.pr-sidebar-hostedreview.forbranch-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.pr-sidebar-hostedreview.forbranch-1.json
@@ -3,9 +3,9 @@
   "family": "session.pr-sidebar",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "87ffa2daea415d2682f1112025b5bd9d52404c6fc7c239180a3ad2120678ff1f",
   "scenarioSha256": "461af8bf31bbf47e84f64a9177bae34c9b796a3f0158a16041ccb0a1a3ea62ec",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.pr-sidebar-worktree.show-1.json b/mobile/rpc-foundation/goldens/matrix-session.pr-sidebar-worktree.show-1.json
index 38b6cc301be0..79217dcc90d2 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.pr-sidebar-worktree.show-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.pr-sidebar-worktree.show-1.json
@@ -3,9 +3,9 @@
   "family": "session.pr-sidebar",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "87ffa2daea415d2682f1112025b5bd9d52404c6fc7c239180a3ad2120678ff1f",
   "scenarioSha256": "1bde693e45b01d09c47a1542cb7e43b4b7798ae52755ba41c5812bc07a425914",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.pr-triage-session.tabs.createterminal-1.json b/mobile/rpc-foundation/goldens/matrix-session.pr-triage-session.tabs.createterminal-1.json
index b795a9830864..02ec381a2681 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.pr-triage-session.tabs.createterminal-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.pr-triage-session.tabs.createterminal-1.json
@@ -3,9 +3,9 @@
   "family": "session.pr-triage",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "f560ff1582487c118756c527faa1fb1f65e37ce22ca9573491fd4b2dbcedf38d",
   "scenarioSha256": "0d06d27000a8f6ad66480a16c7b84e8464f4b6e1d775326aeae005926e134cb4",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.pr-triage-terminal.send-1.json b/mobile/rpc-foundation/goldens/matrix-session.pr-triage-terminal.send-1.json
index bb38c3764fbe..742a1fd1da60 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.pr-triage-terminal.send-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.pr-triage-terminal.send-1.json
@@ -3,9 +3,9 @@
   "family": "session.pr-triage",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "f560ff1582487c118756c527faa1fb1f65e37ce22ca9573491fd4b2dbcedf38d",
   "scenarioSha256": "a288e105a0af6dbbd9657b84f7c4860826184fb7f50dabc6e31b114a70d7ca44",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.review-branch-diff-git.branchdiff-1.json b/mobile/rpc-foundation/goldens/matrix-session.review-branch-diff-git.branchdiff-1.json
index de2fbda4714f..c527ee5d6df5 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.review-branch-diff-git.branchdiff-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.review-branch-diff-git.branchdiff-1.json
@@ -3,9 +3,9 @@
   "family": "session.review-branch-diff",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a8016eb61915cf80a3bdeb622ee67d35be8b4b9862a75e4ef2e8f4ff8e93e7f2",
   "scenarioSha256": "05d42780508d46d5c88f0c987448dc693bb49208a4298e6cf2f0d5e3979066af",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.review-file-diff-git.diff-1.json b/mobile/rpc-foundation/goldens/matrix-session.review-file-diff-git.diff-1.json
index 08676f0295c8..85ff63d13804 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.review-file-diff-git.diff-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.review-file-diff-git.diff-1.json
@@ -3,9 +3,9 @@
   "family": "session.review-file-diff",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a8016eb61915cf80a3bdeb622ee67d35be8b4b9862a75e4ef2e8f4ff8e93e7f2",
   "scenarioSha256": "9567f8594e0287954c1b236b2f0617ed06be04d2b97f82e527c8e3ce732e65c1",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.review-file-diff-git.diff-2.json b/mobile/rpc-foundation/goldens/matrix-session.review-file-diff-git.diff-2.json
index 730483d14e2f..478e6a02d9f2 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.review-file-diff-git.diff-2.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.review-file-diff-git.diff-2.json
@@ -3,9 +3,9 @@
   "family": "session.review-file-diff",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a8016eb61915cf80a3bdeb622ee67d35be8b4b9862a75e4ef2e8f4ff8e93e7f2",
   "scenarioSha256": "95c8c5451aabbbebab8422ccd867b70e000ac62aacf1d231ad0d181cbec3a2b0",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.review-file-diff-git.diff-3.json b/mobile/rpc-foundation/goldens/matrix-session.review-file-diff-git.diff-3.json
index 8a41f46842bf..517dc85458e8 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.review-file-diff-git.diff-3.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.review-file-diff-git.diff-3.json
@@ -3,9 +3,9 @@
   "family": "session.review-file-diff",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a8016eb61915cf80a3bdeb622ee67d35be8b4b9862a75e4ef2e8f4ff8e93e7f2",
   "scenarioSha256": "91558fbfdf10c17a363e38cc0489b1a59e8b1657c51f7444840b2e7d37646851",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.review-git-mutations-git.discard-1.json b/mobile/rpc-foundation/goldens/matrix-session.review-git-mutations-git.discard-1.json
index 23c702cfa117..333dd05532fe 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.review-git-mutations-git.discard-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.review-git-mutations-git.discard-1.json
@@ -3,10 +3,10 @@
   "family": "session.review-git-mutations",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
-  "adapterSha256": "2d72b8e68a66a906394167beb8c78f1c0521ca1e731976fd26963ec3bfa9cca4",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "86ef3d98ee6c11726bf0991e1a40400b60666b0a2e24d137abe66562fe5876bc",
   "scenarioSha256": "651cb070a4b4ba7deddeb37c08886094b83f006e7cbe2bef65d5433ce0430dff",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/matrix-session.review-git-mutations-git.stage-1.json b/mobile/rpc-foundation/goldens/matrix-session.review-git-mutations-git.stage-1.json
index 4427560b7781..99b29c020507 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.review-git-mutations-git.stage-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.review-git-mutations-git.stage-1.json
@@ -3,10 +3,10 @@
   "family": "session.review-git-mutations",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
-  "adapterSha256": "2d72b8e68a66a906394167beb8c78f1c0521ca1e731976fd26963ec3bfa9cca4",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "86ef3d98ee6c11726bf0991e1a40400b60666b0a2e24d137abe66562fe5876bc",
   "scenarioSha256": "e0ce643010302d304ba3611bd43932c6cdd0fa9290a3ecd4fffb4fc92c758b77",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/matrix-session.review-git-mutations-git.stage-2.json b/mobile/rpc-foundation/goldens/matrix-session.review-git-mutations-git.stage-2.json
index 3348bf40f669..155da273f955 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.review-git-mutations-git.stage-2.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.review-git-mutations-git.stage-2.json
@@ -3,10 +3,10 @@
   "family": "session.review-git-mutations",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
-  "adapterSha256": "2d72b8e68a66a906394167beb8c78f1c0521ca1e731976fd26963ec3bfa9cca4",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "86ef3d98ee6c11726bf0991e1a40400b60666b0a2e24d137abe66562fe5876bc",
   "scenarioSha256": "c6b3b4be6b55daf53ee1f5ff755e73a032c4da5379f90f4973736c032eb79414",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/matrix-session.review-send-sheet-session.tabs.list-1.json b/mobile/rpc-foundation/goldens/matrix-session.review-send-sheet-session.tabs.list-1.json
index 41d4ab5079aa..814dc73c7215 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.review-send-sheet-session.tabs.list-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.review-send-sheet-session.tabs.list-1.json
@@ -3,10 +3,10 @@
   "family": "session.review-send-sheet",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
-  "adapterSha256": "2d72b8e68a66a906394167beb8c78f1c0521ca1e731976fd26963ec3bfa9cca4",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "86ef3d98ee6c11726bf0991e1a40400b60666b0a2e24d137abe66562fe5876bc",
   "scenarioSha256": "a71815661dee6129a1b133c398b37ea89a9e4939b45626dada16889acabb2afe",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/matrix-session.startup-worktree.activate-1.json b/mobile/rpc-foundation/goldens/matrix-session.startup-worktree.activate-1.json
index d2524f07f31a..0b7469973d7e 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.startup-worktree.activate-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.startup-worktree.activate-1.json
@@ -3,9 +3,9 @@
   "family": "session.startup",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "6b08c394e37fd572cf63a4c11934247d379008f11117aa5af33b2926fbd32d1e",
   "scenarioSha256": "f4d1e8eff8e1a3dc7b04fcf5dafb2befca2211922443f1958ba801c49f488152",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.startup-worktree.activate-2.json b/mobile/rpc-foundation/goldens/matrix-session.startup-worktree.activate-2.json
index b0a486585f4d..a16c896c67c0 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.startup-worktree.activate-2.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.startup-worktree.activate-2.json
@@ -3,9 +3,9 @@
   "family": "session.startup",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "6b08c394e37fd572cf63a4c11934247d379008f11117aa5af33b2926fbd32d1e",
   "scenarioSha256": "7ba969778e57cc5591365c688ef13ce5b09c41db9fa3666d61bbbbfe4e3fd35c",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.tab-activation-session.tabs.activate-1.json b/mobile/rpc-foundation/goldens/matrix-session.tab-activation-session.tabs.activate-1.json
index 96a6b6b8d527..d204255a15cd 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.tab-activation-session.tabs.activate-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.tab-activation-session.tabs.activate-1.json
@@ -3,9 +3,9 @@
   "family": "session.tab-activation",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "4a1e81ab3229c8fd10b3ad435568efec11a944e0f02a183f94e4b1f44a7e5de0",
   "scenarioSha256": "d25fc19d4e3e9b12f2a60a076ea10741e13fc45dcd9a76bd3a9d88432c3e6fbe",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.tab-activation-terminal.focus-1.json b/mobile/rpc-foundation/goldens/matrix-session.tab-activation-terminal.focus-1.json
index 03f2cb2d95ee..cb428c4052e6 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.tab-activation-terminal.focus-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.tab-activation-terminal.focus-1.json
@@ -3,9 +3,9 @@
   "family": "session.tab-activation",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "4a1e81ab3229c8fd10b3ad435568efec11a944e0f02a183f94e4b1f44a7e5de0",
   "scenarioSha256": "5b050af6f02aa90f66340838cb5cc53c8fc0d5693d313b653c23881150384874",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.tab-close-session-session.tabs.close-1.json b/mobile/rpc-foundation/goldens/matrix-session.tab-close-session-session.tabs.close-1.json
index f57cfa230dc6..df02aacec85c 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.tab-close-session-session.tabs.close-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.tab-close-session-session.tabs.close-1.json
@@ -3,9 +3,9 @@
   "family": "session.tab-close-session",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "562c2f4ab669e774dd7045ecd9518e483845433fef6034688090f3b056df2815",
   "scenarioSha256": "64c12ae20aaf7202c2271134d57e4312127e8f909ad086ba69b4662bbd749bb0",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.tab-close-terminal.close-1.json b/mobile/rpc-foundation/goldens/matrix-session.tab-close-terminal.close-1.json
index 8279a3f952c4..e597a6f9f16f 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.tab-close-terminal.close-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.tab-close-terminal.close-1.json
@@ -3,9 +3,9 @@
   "family": "session.tab-close",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "562c2f4ab669e774dd7045ecd9518e483845433fef6034688090f3b056df2815",
   "scenarioSha256": "89141e3e400feea78460ede72d5269bdc885f6d3de75388542b4b7d6dff2840d",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.tab-documents-markdown.readtab-1.json b/mobile/rpc-foundation/goldens/matrix-session.tab-documents-markdown.readtab-1.json
index 4db6bf5c7fe8..b9ac10cf846c 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.tab-documents-markdown.readtab-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.tab-documents-markdown.readtab-1.json
@@ -3,9 +3,9 @@
   "family": "session.tab-documents",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a3daf9a05d05424959baf77feb45cb0c076d77d8c49e877941ed612cc1e5ce95",
   "scenarioSha256": "c97d925b63253e87ada0777e95a24ccf4e4e1682eda048800b44e335767df648",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.tab-rename-terminal.rename-1.json b/mobile/rpc-foundation/goldens/matrix-session.tab-rename-terminal.rename-1.json
index 93c3cd2b28fd..c40cd3ce1d7d 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.tab-rename-terminal.rename-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.tab-rename-terminal.rename-1.json
@@ -3,9 +3,9 @@
   "family": "session.tab-rename",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "562c2f4ab669e774dd7045ecd9518e483845433fef6034688090f3b056df2815",
   "scenarioSha256": "55c461287c1d8fb6de3c4fe28f801d095678dcf52bfcce39c336c9d61e8be908",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.tab-reveal-session.tabs.activate-1.json b/mobile/rpc-foundation/goldens/matrix-session.tab-reveal-session.tabs.activate-1.json
index 1a040bd301b2..61a4f4d6888f 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.tab-reveal-session.tabs.activate-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.tab-reveal-session.tabs.activate-1.json
@@ -3,9 +3,9 @@
   "family": "session.tab-reveal",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5e47c7960b9352753f0751d4ccf5e3ff7fb7b74a63cc4e4df3c3ffdcc6c1e66b",
   "scenarioSha256": "73366226aeaec1581aeeb47219fc703917143cfd7f6a2eb01d7bd703a7c7612d",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.tab-reveal-session.tabs.list-1.json b/mobile/rpc-foundation/goldens/matrix-session.tab-reveal-session.tabs.list-1.json
index 4554fc8f42f6..7df475361a6c 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.tab-reveal-session.tabs.list-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.tab-reveal-session.tabs.list-1.json
@@ -3,9 +3,9 @@
   "family": "session.tab-reveal",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5e47c7960b9352753f0751d4ccf5e3ff7fb7b74a63cc4e4df3c3ffdcc6c1e66b",
   "scenarioSha256": "c38f2bc5c9faca0774dfe202137877bada9deba165c5e9c955cbe67eae0cbdd9",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.tabs-stream-health-session.tabs.list-1.json b/mobile/rpc-foundation/goldens/matrix-session.tabs-stream-health-session.tabs.list-1.json
index d4c4cbd0fa7f..a5ecdf8b11ff 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.tabs-stream-health-session.tabs.list-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.tabs-stream-health-session.tabs.list-1.json
@@ -3,9 +3,9 @@
   "family": "session.tabs-stream-health",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "4a1e81ab3229c8fd10b3ad435568efec11a944e0f02a183f94e4b1f44a7e5de0",
   "scenarioSha256": "fab12524a09049d976da752cbe1b837a0aee04ce6e1eef75cbf517c862cb0d4a",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.terminal-display-mode-terminal.setdisplaymode-1.json b/mobile/rpc-foundation/goldens/matrix-session.terminal-display-mode-terminal.setdisplaymode-1.json
index 210d8b01658f..b3ded358b098 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.terminal-display-mode-terminal.setdisplaymode-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.terminal-display-mode-terminal.setdisplaymode-1.json
@@ -3,9 +3,9 @@
   "family": "session.terminal-display-mode",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "9e90ad39a8d4257adf30166757a6364c4710dc3ae9f06365f80a3dd8f1c94d89",
   "scenarioSha256": "2ae1839ae5f4fb98c2ef250fb5e071508ec1376e737dab28ac589c08f1a42b0e",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.terminal-gesture-input-orchestration.workerterminaluserinput-1.json b/mobile/rpc-foundation/goldens/matrix-session.terminal-gesture-input-orchestration.workerterminaluserinput-1.json
index 34c2bab0c934..4bfb3cabab29 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.terminal-gesture-input-orchestration.workerterminaluserinput-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.terminal-gesture-input-orchestration.workerterminaluserinput-1.json
@@ -3,9 +3,9 @@
   "family": "session.terminal-gesture-input",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "9d119d5ec320e2538105d6ff673b9f4b8e3decbe46527947489dffbcf2ac0472",
   "scenarioSha256": "27e0d44ca22593ff2ecef93de075508863024f3f10f00161818962c07e7b59e1",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.terminal-gesture-input-terminal.clearbuffer-1.json b/mobile/rpc-foundation/goldens/matrix-session.terminal-gesture-input-terminal.clearbuffer-1.json
index 8eb2b7f9d135..ecd75782f2a8 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.terminal-gesture-input-terminal.clearbuffer-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.terminal-gesture-input-terminal.clearbuffer-1.json
@@ -3,9 +3,9 @@
   "family": "session.terminal-gesture-input",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "9d119d5ec320e2538105d6ff673b9f4b8e3decbe46527947489dffbcf2ac0472",
   "scenarioSha256": "53ffb52ef015193fdaaeb1ac5a1c88488a607e6cec2e39e87d1e4e3173321983",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.terminal-gesture-input-terminal.send-1.json b/mobile/rpc-foundation/goldens/matrix-session.terminal-gesture-input-terminal.send-1.json
index 8d8ba9535dc5..4b946df5abce 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.terminal-gesture-input-terminal.send-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.terminal-gesture-input-terminal.send-1.json
@@ -3,9 +3,9 @@
   "family": "session.terminal-gesture-input",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "9d119d5ec320e2538105d6ff673b9f4b8e3decbe46527947489dffbcf2ac0472",
   "scenarioSha256": "d7bc4d7a3e7e54accd4b51eef7e83ae70cc0c794738a83af222503a0f12ba70f",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.terminal-input-send-orchestration.workerterminaluserinput-1.json b/mobile/rpc-foundation/goldens/matrix-session.terminal-input-send-orchestration.workerterminaluserinput-1.json
index 4c18fa07d1bd..e1ab54e2c80f 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.terminal-input-send-orchestration.workerterminaluserinput-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.terminal-input-send-orchestration.workerterminaluserinput-1.json
@@ -3,9 +3,9 @@
   "family": "session.terminal-input-send",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "e7e3718f685e3713cf1b8209d59d618741f892bd286853b79bb456c59cec8d86",
   "scenarioSha256": "cde3cac5407ef731315d18fc855b2696b9bfd30b90cb43d4a2cc812059cdd987",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.terminal-input-send-terminal.send-1.json b/mobile/rpc-foundation/goldens/matrix-session.terminal-input-send-terminal.send-1.json
index 995f691e9698..4914564da47e 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.terminal-input-send-terminal.send-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.terminal-input-send-terminal.send-1.json
@@ -3,9 +3,9 @@
   "family": "session.terminal-input-send",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "e7e3718f685e3713cf1b8209d59d618741f892bd286853b79bb456c59cec8d86",
   "scenarioSha256": "6575a0f89894d9b66e50a73446dfe92293ceccc7048b556f1ff114fd3ce05b8e",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.terminal-inventory-terminal.list-1.json b/mobile/rpc-foundation/goldens/matrix-session.terminal-inventory-terminal.list-1.json
index 72029e3612b6..66c429b0b5a5 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.terminal-inventory-terminal.list-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.terminal-inventory-terminal.list-1.json
@@ -3,9 +3,9 @@
   "family": "session.terminal-inventory",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a3daf9a05d05424959baf77feb45cb0c076d77d8c49e877941ed612cc1e5ce95",
   "scenarioSha256": "12f1006d704e362552317a3afcb4db4366146da3a863a1c55b524c6fc1b9757a",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.terminal-paste-orchestration.workerterminaluserinput-1.json b/mobile/rpc-foundation/goldens/matrix-session.terminal-paste-orchestration.workerterminaluserinput-1.json
index 0c71ee0f1a7d..3a3a461aa6c4 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.terminal-paste-orchestration.workerterminaluserinput-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.terminal-paste-orchestration.workerterminaluserinput-1.json
@@ -3,9 +3,9 @@
   "family": "session.terminal-paste",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "e7e3718f685e3713cf1b8209d59d618741f892bd286853b79bb456c59cec8d86",
   "scenarioSha256": "27c4f13ae43042cf5e6b5ca95e9c1a37db2f1f0c08b31a1164bb56cf0967549a",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.terminal-paste-settings.get-1.json b/mobile/rpc-foundation/goldens/matrix-session.terminal-paste-settings.get-1.json
index 58ef55fb4b19..5fe5ca6205d5 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.terminal-paste-settings.get-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.terminal-paste-settings.get-1.json
@@ -3,9 +3,9 @@
   "family": "session.terminal-paste",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "e7e3718f685e3713cf1b8209d59d618741f892bd286853b79bb456c59cec8d86",
   "scenarioSha256": "449f8c793a371dddf1bb9b3beb36b2dbd9b991918dae1f6290df75fe6d2aeace",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.terminal-paste-terminal.send-1.json b/mobile/rpc-foundation/goldens/matrix-session.terminal-paste-terminal.send-1.json
index 5ceed2d1d743..e00618c25882 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.terminal-paste-terminal.send-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.terminal-paste-terminal.send-1.json
@@ -3,9 +3,9 @@
   "family": "session.terminal-paste",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "e7e3718f685e3713cf1b8209d59d618741f892bd286853b79bb456c59cec8d86",
   "scenarioSha256": "5cc67ab6df80a81be814a16cb60dcc4c703b0fc17594e409697a9fdeb0edeb76",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.worktree-connection-repo.list-1.json b/mobile/rpc-foundation/goldens/matrix-session.worktree-connection-repo.list-1.json
index 31c6d4050a41..f55a57ea30f6 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.worktree-connection-repo.list-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.worktree-connection-repo.list-1.json
@@ -3,9 +3,9 @@
   "family": "session.worktree-connection",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "e7e3718f685e3713cf1b8209d59d618741f892bd286853b79bb456c59cec8d86",
   "scenarioSha256": "e7fb7a8083aac4c8c5edc7dd52465ca53bfcded00bf8b1ec18ae7604651bbe32",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-session.worktree-connection-settings.get-1.json b/mobile/rpc-foundation/goldens/matrix-session.worktree-connection-settings.get-1.json
index 6fdd6fbdc87b..b609575e82b4 100644
--- a/mobile/rpc-foundation/goldens/matrix-session.worktree-connection-settings.get-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-session.worktree-connection-settings.get-1.json
@@ -3,9 +3,9 @@
   "family": "session.worktree-connection",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "e7e3718f685e3713cf1b8209d59d618741f892bd286853b79bb456c59cec8d86",
   "scenarioSha256": "b1e1b221ab7bfe5356c89a09cf4252613c78aecab48b2212e84ac7de885ec569",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-settings-agent-read-preflight.detectremoteagents-1.json b/mobile/rpc-foundation/goldens/matrix-settings-agent-read-preflight.detectremoteagents-1.json
index 1b86ad3943a8..e2c2a2758fe8 100644
--- a/mobile/rpc-foundation/goldens/matrix-settings-agent-read-preflight.detectremoteagents-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-settings-agent-read-preflight.detectremoteagents-1.json
@@ -3,9 +3,9 @@
   "family": "settings-agent-read",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "448cdbd12f4f6a14bb33947bfbbb1837aebeb28979db70c62f2ba2fbb4d89c8f",
   "scenarioSha256": "a0effc9a0be519ccd18c1b1abfc8b497cd3858b89ea8d345ac0f8bd6d195cf21",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-settings-agent-read-repo.list-1.json b/mobile/rpc-foundation/goldens/matrix-settings-agent-read-repo.list-1.json
index 9be971f3bb22..9b07de546862 100644
--- a/mobile/rpc-foundation/goldens/matrix-settings-agent-read-repo.list-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-settings-agent-read-repo.list-1.json
@@ -3,9 +3,9 @@
   "family": "settings-agent-read",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "448cdbd12f4f6a14bb33947bfbbb1837aebeb28979db70c62f2ba2fbb4d89c8f",
   "scenarioSha256": "c21b2e0e97fab86664f634cc99d77dd587df4af4d02e6286c8380e09844096b2",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-settings-agent-read-settings.get-1.json b/mobile/rpc-foundation/goldens/matrix-settings-agent-read-settings.get-1.json
index 47bc711c487b..928a5696fe57 100644
--- a/mobile/rpc-foundation/goldens/matrix-settings-agent-read-settings.get-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-settings-agent-read-settings.get-1.json
@@ -3,9 +3,9 @@
   "family": "settings-agent-read",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "448cdbd12f4f6a14bb33947bfbbb1837aebeb28979db70c62f2ba2fbb4d89c8f",
   "scenarioSha256": "46c4e32a921612c736c8cf45ff72ed513431c917ed3dd03f289c0ba4c28d6adb",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-settings-best-effort-settings.update-1.json b/mobile/rpc-foundation/goldens/matrix-settings-best-effort-settings.update-1.json
index a6e95e8218c8..c2338edc9440 100644
--- a/mobile/rpc-foundation/goldens/matrix-settings-best-effort-settings.update-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-settings-best-effort-settings.update-1.json
@@ -3,9 +3,9 @@
   "family": "settings-best-effort",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "d3b7f33d810e1fa420ac41a628cde9fe4a9e65fd57f89fbca0a40fc7d74951ab",
   "scenarioSha256": "cf671da175d50a4c2e1336f4e8338c24c4752db111e1eafd226bee6ff3582b1d",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-settings.bot-overrides-settings.get-1.json b/mobile/rpc-foundation/goldens/matrix-settings.bot-overrides-settings.get-1.json
index 74831189ccf2..8787f9554dda 100644
--- a/mobile/rpc-foundation/goldens/matrix-settings.bot-overrides-settings.get-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-settings.bot-overrides-settings.get-1.json
@@ -3,9 +3,9 @@
   "family": "settings.bot-overrides",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "01408cebcc193f8e30119381c8acf494fa5e29850fe010809deb330c2f9bcb36",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-settings.home-providers-linear.status-1.json b/mobile/rpc-foundation/goldens/matrix-settings.home-providers-linear.status-1.json
index 16d7e3c6bd8e..242f9a062fa0 100644
--- a/mobile/rpc-foundation/goldens/matrix-settings.home-providers-linear.status-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-settings.home-providers-linear.status-1.json
@@ -3,9 +3,9 @@
   "family": "settings.home-providers",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "19b445b39da98d28bcbcdab6f70e47ce208ca68f165e7b62c5fe9762eee67c8d",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-settings.home-providers-preflight.check-1.json b/mobile/rpc-foundation/goldens/matrix-settings.home-providers-preflight.check-1.json
index c1496f2eb010..962c677e9616 100644
--- a/mobile/rpc-foundation/goldens/matrix-settings.home-providers-preflight.check-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-settings.home-providers-preflight.check-1.json
@@ -3,9 +3,9 @@
   "family": "settings.home-providers",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "4953dd0de509ce620b9840d7f460e472dc74f54d53636694d12cba2e3bb51da8",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-settings.home-providers-settings.get-1.json b/mobile/rpc-foundation/goldens/matrix-settings.home-providers-settings.get-1.json
index 44d3a3338a46..9ff81d7ad4c6 100644
--- a/mobile/rpc-foundation/goldens/matrix-settings.home-providers-settings.get-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-settings.home-providers-settings.get-1.json
@@ -3,9 +3,9 @@
   "family": "settings.home-providers",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "70f601caeaee957bd3b172fc0fc12e85d6e2d6bed7683c86869559c6c9f25834",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-settings.new-tab-local-agents-preflight.detectagents-1.json b/mobile/rpc-foundation/goldens/matrix-settings.new-tab-local-agents-preflight.detectagents-1.json
index e5faa8e3ff92..8dc8f21eee71 100644
--- a/mobile/rpc-foundation/goldens/matrix-settings.new-tab-local-agents-preflight.detectagents-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-settings.new-tab-local-agents-preflight.detectagents-1.json
@@ -3,9 +3,9 @@
   "family": "settings.new-tab-local-agents",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "448cdbd12f4f6a14bb33947bfbbb1837aebeb28979db70c62f2ba2fbb4d89c8f",
   "scenarioSha256": "c5db2d14be8dc1b3b3b68c151507da49d1c96b44f94b080c5908a65a885f1763",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-settings.new-tab-local-agents-repo.list-1.json b/mobile/rpc-foundation/goldens/matrix-settings.new-tab-local-agents-repo.list-1.json
index 4f6cf8b81a3e..726c2e195b64 100644
--- a/mobile/rpc-foundation/goldens/matrix-settings.new-tab-local-agents-repo.list-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-settings.new-tab-local-agents-repo.list-1.json
@@ -3,9 +3,9 @@
   "family": "settings.new-tab-local-agents",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "448cdbd12f4f6a14bb33947bfbbb1837aebeb28979db70c62f2ba2fbb4d89c8f",
   "scenarioSha256": "c9b66eb3c676b1e18db588b8e35f267f5618c007ae0955adcc3292740fddfe23",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-settings.new-tab-local-agents-settings.get-1.json b/mobile/rpc-foundation/goldens/matrix-settings.new-tab-local-agents-settings.get-1.json
index 79a4ce0e4657..a07fee8e62ba 100644
--- a/mobile/rpc-foundation/goldens/matrix-settings.new-tab-local-agents-settings.get-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-settings.new-tab-local-agents-settings.get-1.json
@@ -3,9 +3,9 @@
   "family": "settings.new-tab-local-agents",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "448cdbd12f4f6a14bb33947bfbbb1837aebeb28979db70c62f2ba2fbb4d89c8f",
   "scenarioSha256": "9eaad87e8f648fdbfa33f493f991f9c7943fbf81f93580067819c4bbb02b672f",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-settings.quick-commands-settings.getterminalquickcommands-1.json b/mobile/rpc-foundation/goldens/matrix-settings.quick-commands-settings.getterminalquickcommands-1.json
index 21d05df46a9d..ee6f101dc92c 100644
--- a/mobile/rpc-foundation/goldens/matrix-settings.quick-commands-settings.getterminalquickcommands-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-settings.quick-commands-settings.getterminalquickcommands-1.json
@@ -3,9 +3,9 @@
   "family": "settings.quick-commands",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "42334358b5e5966001639653b553f15033f6e201d785107871fe056536f0a5e2",
   "scenarioSha256": "c6d5040d0fd1e6b852625561aa67d11f555f5adb12303b6f8d0176183026a6b1",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-settings.quick-commands-settings.updateterminalquickcommands-1.json b/mobile/rpc-foundation/goldens/matrix-settings.quick-commands-settings.updateterminalquickcommands-1.json
index 8ec504f3e315..79cfe0654437 100644
--- a/mobile/rpc-foundation/goldens/matrix-settings.quick-commands-settings.updateterminalquickcommands-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-settings.quick-commands-settings.updateterminalquickcommands-1.json
@@ -3,9 +3,9 @@
   "family": "settings.quick-commands",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "42334358b5e5966001639653b553f15033f6e201d785107871fe056536f0a5e2",
   "scenarioSha256": "b9edb5c27852d4e1e968f85668f1ea7afde3ed1c6e5c6582d6607f9fa5643356",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-settings.repo-metadata-host.platform-1.json b/mobile/rpc-foundation/goldens/matrix-settings.repo-metadata-host.platform-1.json
index 224e6fe248d0..bad9a30e3fc9 100644
--- a/mobile/rpc-foundation/goldens/matrix-settings.repo-metadata-host.platform-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-settings.repo-metadata-host.platform-1.json
@@ -3,9 +3,9 @@
   "family": "settings.repo-metadata",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "687b109bd2bcc0c85b7c858d553e68e2fc4cb5b281d9f8b32836dbacc4bdc8f2",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-settings.repo-metadata-repo.list-1.json b/mobile/rpc-foundation/goldens/matrix-settings.repo-metadata-repo.list-1.json
index fb899e2c3c9f..4d7b5884e1d5 100644
--- a/mobile/rpc-foundation/goldens/matrix-settings.repo-metadata-repo.list-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-settings.repo-metadata-repo.list-1.json
@@ -3,9 +3,9 @@
   "family": "settings.repo-metadata",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "3199c745e22973b432b0a36c34bb0bdda994334a4a0cd7ad2daf8b172625ce8d",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-settings.repo-metadata-settings.get-1.json b/mobile/rpc-foundation/goldens/matrix-settings.repo-metadata-settings.get-1.json
index e0fc1b68b5ab..f536a3066a8b 100644
--- a/mobile/rpc-foundation/goldens/matrix-settings.repo-metadata-settings.get-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-settings.repo-metadata-settings.get-1.json
@@ -3,9 +3,9 @@
   "family": "settings.repo-metadata",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "5e9c3ff57cf432b24a17ee046636b61b94116a687cfa506cd79dee464542b76b",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-settings.repo-metadata-ssh.listtargetsummaries-1.json b/mobile/rpc-foundation/goldens/matrix-settings.repo-metadata-ssh.listtargetsummaries-1.json
index 25790fd5fd52..89a64b9a3f31 100644
--- a/mobile/rpc-foundation/goldens/matrix-settings.repo-metadata-ssh.listtargetsummaries-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-settings.repo-metadata-ssh.listtargetsummaries-1.json
@@ -3,9 +3,9 @@
   "family": "settings.repo-metadata",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "a88061d3d1f03074b0ed2b663b523f1602362bc317ba614106f1f646d037d6e3",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-settings.resume-metadata-folderworkspace.list-1.json b/mobile/rpc-foundation/goldens/matrix-settings.resume-metadata-folderworkspace.list-1.json
index 6a059e8497a3..a8a4078b3cf9 100644
--- a/mobile/rpc-foundation/goldens/matrix-settings.resume-metadata-folderworkspace.list-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-settings.resume-metadata-folderworkspace.list-1.json
@@ -3,9 +3,9 @@
   "family": "settings.resume-metadata",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "50ba7c7963cb494e4b3d484eb334977d21cc69018da57d75a7b6fd0c92860bd2",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-settings.resume-metadata-projectgroup.list-1.json b/mobile/rpc-foundation/goldens/matrix-settings.resume-metadata-projectgroup.list-1.json
index 44b35ca55c21..58c72c88352b 100644
--- a/mobile/rpc-foundation/goldens/matrix-settings.resume-metadata-projectgroup.list-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-settings.resume-metadata-projectgroup.list-1.json
@@ -3,9 +3,9 @@
   "family": "settings.resume-metadata",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "8dfd4550b39f0cfcb9aaa72fab0631b11f9e776ed389b206b326359d7f4c2d6e",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-settings.resume-metadata-repo.list-1.json b/mobile/rpc-foundation/goldens/matrix-settings.resume-metadata-repo.list-1.json
index 1e8564b721c9..845f19803257 100644
--- a/mobile/rpc-foundation/goldens/matrix-settings.resume-metadata-repo.list-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-settings.resume-metadata-repo.list-1.json
@@ -3,9 +3,9 @@
   "family": "settings.resume-metadata",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "85dc526201f66409dd6a411c5e14615b82389791ec210efb9889078f5d580373",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-settings.resume-metadata-settings.get-1.json b/mobile/rpc-foundation/goldens/matrix-settings.resume-metadata-settings.get-1.json
index fa3a9bfe32d7..f1add389a64d 100644
--- a/mobile/rpc-foundation/goldens/matrix-settings.resume-metadata-settings.get-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-settings.resume-metadata-settings.get-1.json
@@ -3,9 +3,9 @@
   "family": "settings.resume-metadata",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "080e10ae774ef097082267da0c8b6d0ebacae582d57b04a189c123258d0e5131",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-settings.resume-metadata-worktree.ps-1.json b/mobile/rpc-foundation/goldens/matrix-settings.resume-metadata-worktree.ps-1.json
index 6b52b0c7d3c3..9ac803e5454c 100644
--- a/mobile/rpc-foundation/goldens/matrix-settings.resume-metadata-worktree.ps-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-settings.resume-metadata-worktree.ps-1.json
@@ -3,9 +3,9 @@
   "family": "settings.resume-metadata",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "5988fa5ce0bf6b8585f7ec66918123ee086d5cdf1185a4eeff2e88904985064c",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-settings.task-hydration-linear.status-1.json b/mobile/rpc-foundation/goldens/matrix-settings.task-hydration-linear.status-1.json
index e54820026eb3..59f98f665627 100644
--- a/mobile/rpc-foundation/goldens/matrix-settings.task-hydration-linear.status-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-settings.task-hydration-linear.status-1.json
@@ -3,9 +3,9 @@
   "family": "settings.task-hydration",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "f5033a7a3567cc9e016bf09ac8bcd8ff381c3054c041dbccc773f7011918bf1d",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-settings.task-hydration-preflight.check-1.json b/mobile/rpc-foundation/goldens/matrix-settings.task-hydration-preflight.check-1.json
index 45f693f7c9e5..65ff795fd27f 100644
--- a/mobile/rpc-foundation/goldens/matrix-settings.task-hydration-preflight.check-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-settings.task-hydration-preflight.check-1.json
@@ -3,9 +3,9 @@
   "family": "settings.task-hydration",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "0931b3d35868e5452cb550962f2408b6ce7cd6c89e90a9cf2897425edbb4b42d",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-settings.task-hydration-settings.get-1.json b/mobile/rpc-foundation/goldens/matrix-settings.task-hydration-settings.get-1.json
index 6659e0427616..addcac907422 100644
--- a/mobile/rpc-foundation/goldens/matrix-settings.task-hydration-settings.get-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-settings.task-hydration-settings.get-1.json
@@ -3,9 +3,9 @@
   "family": "settings.task-hydration",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "d0f8d9bfe0e1469af3b0dab8b5c9799d91cc2234e72f0e031d6872059654077d",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-settings.task-hydration-status.get-1.json b/mobile/rpc-foundation/goldens/matrix-settings.task-hydration-status.get-1.json
index 43e113af2bed..1acf99da567b 100644
--- a/mobile/rpc-foundation/goldens/matrix-settings.task-hydration-status.get-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-settings.task-hydration-status.get-1.json
@@ -3,9 +3,9 @@
   "family": "settings.task-hydration",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "3f448feff463b59c3927dae020ecd8d4931bb4a6036df6d6af080de2ec5fcf2b",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-settings.task-hydration-ui.get-1.json b/mobile/rpc-foundation/goldens/matrix-settings.task-hydration-ui.get-1.json
index 5f70685c7b4e..fd1bc8d0aacc 100644
--- a/mobile/rpc-foundation/goldens/matrix-settings.task-hydration-ui.get-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-settings.task-hydration-ui.get-1.json
@@ -3,9 +3,9 @@
   "family": "settings.task-hydration",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "4438f9fd62876333bb980157612aaf457c5a9b9115659c8c941c3b373ad071dd",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-settings.task-workspace-create-settings.get-1.json b/mobile/rpc-foundation/goldens/matrix-settings.task-workspace-create-settings.get-1.json
index ebeaceb8a2b8..9eeab114d696 100644
--- a/mobile/rpc-foundation/goldens/matrix-settings.task-workspace-create-settings.get-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-settings.task-workspace-create-settings.get-1.json
@@ -3,9 +3,9 @@
   "family": "settings.task-workspace-create",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c2eed306311a844cd6f2f84b6513c0a1182f86a5e3cace434385b8287c80d7c5",
   "scenarioSha256": "7e4c5bb29e0f630cda8a09233575b9295e485f3d3e315ebdc0458c69515fcfc7",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-settings.task-workspace-create-worktree.create-1.json b/mobile/rpc-foundation/goldens/matrix-settings.task-workspace-create-worktree.create-1.json
index 4d881062645b..7b47f7e06cb1 100644
--- a/mobile/rpc-foundation/goldens/matrix-settings.task-workspace-create-worktree.create-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-settings.task-workspace-create-worktree.create-1.json
@@ -3,9 +3,9 @@
   "family": "settings.task-workspace-create",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c2eed306311a844cd6f2f84b6513c0a1182f86a5e3cace434385b8287c80d7c5",
   "scenarioSha256": "1d7713cf4c23d053105c2abb02340d81d5eb689f4311a0984932d8ebd031b4ce",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-settings.task-workspace-settings.get-1.json b/mobile/rpc-foundation/goldens/matrix-settings.task-workspace-settings.get-1.json
index ec0a6c855e75..abbe895d7b53 100644
--- a/mobile/rpc-foundation/goldens/matrix-settings.task-workspace-settings.get-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-settings.task-workspace-settings.get-1.json
@@ -3,9 +3,9 @@
   "family": "settings.task-workspace",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c2eed306311a844cd6f2f84b6513c0a1182f86a5e3cace434385b8287c80d7c5",
   "scenarioSha256": "994ea8b4ddb05774a8c2d5902bb68bf5e8f25399a787262b8f23f458f2790698",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-settings.workspace-context-linear.status-1.json b/mobile/rpc-foundation/goldens/matrix-settings.workspace-context-linear.status-1.json
index a83bef1544e9..61fab66b2eb8 100644
--- a/mobile/rpc-foundation/goldens/matrix-settings.workspace-context-linear.status-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-settings.workspace-context-linear.status-1.json
@@ -3,9 +3,9 @@
   "family": "settings.workspace-context",
   "namedDeltas": ["new-workspace-runtime-context-null-results-degrade-to-absent"],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "30b3f8d79589e9fb3d7ef804233554fa231f68ab88e5130ddfa78e79221e3c78",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-settings.workspace-context-preflight.check-1.json b/mobile/rpc-foundation/goldens/matrix-settings.workspace-context-preflight.check-1.json
index dc006d1d4ac5..b73f7398e80d 100644
--- a/mobile/rpc-foundation/goldens/matrix-settings.workspace-context-preflight.check-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-settings.workspace-context-preflight.check-1.json
@@ -3,9 +3,9 @@
   "family": "settings.workspace-context",
   "namedDeltas": ["new-workspace-runtime-context-null-results-degrade-to-absent"],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "a5366cbd31d899feeb7e1901edd0c78191c2c8c8179ad5d5b24b7ca22bd538f8",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-settings.workspace-context-settings.get-1.json b/mobile/rpc-foundation/goldens/matrix-settings.workspace-context-settings.get-1.json
index b060c3922563..a958e3713eb7 100644
--- a/mobile/rpc-foundation/goldens/matrix-settings.workspace-context-settings.get-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-settings.workspace-context-settings.get-1.json
@@ -3,9 +3,9 @@
   "family": "settings.workspace-context",
   "namedDeltas": ["new-workspace-runtime-context-null-results-degrade-to-absent"],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "797ea410af6536410335ebe93b8bc354cd633cf980eb95efbb10bc46f5516cb7",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-settings.workspace-context-ui.get-1.json b/mobile/rpc-foundation/goldens/matrix-settings.workspace-context-ui.get-1.json
index cc1be7201101..878f43bf3b27 100644
--- a/mobile/rpc-foundation/goldens/matrix-settings.workspace-context-ui.get-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-settings.workspace-context-ui.get-1.json
@@ -3,9 +3,9 @@
   "family": "settings.workspace-context",
   "namedDeltas": ["new-workspace-runtime-context-null-results-degrade-to-absent"],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "3cd29e7b6a1cdfd99796a58cf6ad6f9aa3dbac75dd6e989ea99ba6027c210028",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-settings.workspace-submit-settings.get-1.json b/mobile/rpc-foundation/goldens/matrix-settings.workspace-submit-settings.get-1.json
index 977ef457b24f..a876a198ba62 100644
--- a/mobile/rpc-foundation/goldens/matrix-settings.workspace-submit-settings.get-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-settings.workspace-submit-settings.get-1.json
@@ -3,9 +3,9 @@
   "family": "settings.workspace-submit",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c2eed306311a844cd6f2f84b6513c0a1182f86a5e3cace434385b8287c80d7c5",
   "scenarioSha256": "a89bdf93df71a958810aba72c80e42f663644781a29e934898e2ddf86c5dd5d5",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-speech.dictation-chunk-speech.dictation.chunk-1.json b/mobile/rpc-foundation/goldens/matrix-speech.dictation-chunk-speech.dictation.chunk-1.json
index bbdad42c0bd5..72181fa566b8 100644
--- a/mobile/rpc-foundation/goldens/matrix-speech.dictation-chunk-speech.dictation.chunk-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-speech.dictation-chunk-speech.dictation.chunk-1.json
@@ -3,9 +3,9 @@
   "family": "speech.dictation-chunk",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5d978690e3626892b83bdba64537f9b1e1bb66c2060a00517ceead042a6d2334",
   "scenarioSha256": "cfc84498c2ed080ca2be50725c8ad4fac84eaf2e64ecad1445997949737da11d",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-speech.dictation-session-speech.dictation.finish-1.json b/mobile/rpc-foundation/goldens/matrix-speech.dictation-session-speech.dictation.finish-1.json
index 9934d9399737..3471fb8e012e 100644
--- a/mobile/rpc-foundation/goldens/matrix-speech.dictation-session-speech.dictation.finish-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-speech.dictation-session-speech.dictation.finish-1.json
@@ -3,9 +3,9 @@
   "family": "speech.dictation-session",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5d978690e3626892b83bdba64537f9b1e1bb66c2060a00517ceead042a6d2334",
   "scenarioSha256": "2cb8e1e5c1c4f9da7dcf68e3fcd51a3979966019b5872279b7347d5f09f381d5",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-speech.dictation-session-speech.dictation.start-1.json b/mobile/rpc-foundation/goldens/matrix-speech.dictation-session-speech.dictation.start-1.json
index 4b9304e018b8..c72dcfe532f0 100644
--- a/mobile/rpc-foundation/goldens/matrix-speech.dictation-session-speech.dictation.start-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-speech.dictation-session-speech.dictation.start-1.json
@@ -3,9 +3,9 @@
   "family": "speech.dictation-session",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5d978690e3626892b83bdba64537f9b1e1bb66c2060a00517ceead042a6d2334",
   "scenarioSha256": "c72f6ff7dad56e5dca200f2c9c71567f0d9811c7e39a9b9aee4543f0f9d9ca0a",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-speech.dictation-start-speech.dictation.cancel-1.json b/mobile/rpc-foundation/goldens/matrix-speech.dictation-start-speech.dictation.cancel-1.json
index 0cdac41c7b70..b8d799efd24c 100644
--- a/mobile/rpc-foundation/goldens/matrix-speech.dictation-start-speech.dictation.cancel-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-speech.dictation-start-speech.dictation.cancel-1.json
@@ -3,9 +3,9 @@
   "family": "speech.dictation-start",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5d978690e3626892b83bdba64537f9b1e1bb66c2060a00517ceead042a6d2334",
   "scenarioSha256": "ef890c668aded545c5423322aeaab0e0715ff80d5f76c6512d6579e277853f6c",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-speech.dictation-start-speech.dictation.start-1.json b/mobile/rpc-foundation/goldens/matrix-speech.dictation-start-speech.dictation.start-1.json
index 25d20f45724e..f33b22916acb 100644
--- a/mobile/rpc-foundation/goldens/matrix-speech.dictation-start-speech.dictation.start-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-speech.dictation-start-speech.dictation.start-1.json
@@ -3,9 +3,9 @@
   "family": "speech.dictation-start",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5d978690e3626892b83bdba64537f9b1e1bb66c2060a00517ceead042a6d2334",
   "scenarioSha256": "cd65f6b30f92d9542d19ad74cc9437ea33a1ec8fbdf4439ba13c14960f8a1994",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-speech.setup-sheet-speech.dictation.setup-1.json b/mobile/rpc-foundation/goldens/matrix-speech.setup-sheet-speech.dictation.setup-1.json
index 04758eeaeeae..0a0c8289994f 100644
--- a/mobile/rpc-foundation/goldens/matrix-speech.setup-sheet-speech.dictation.setup-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-speech.setup-sheet-speech.dictation.setup-1.json
@@ -3,9 +3,9 @@
   "family": "speech.setup-sheet",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5d978690e3626892b83bdba64537f9b1e1bb66c2060a00517ceead042a6d2334",
   "scenarioSha256": "407a52b099cbf2fcb261010e4235dae2e5e16e11b386fb6bc99d5a2d237af541",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-speech.setup-sheet-speech.models.delete-1.json b/mobile/rpc-foundation/goldens/matrix-speech.setup-sheet-speech.models.delete-1.json
index bdcf7a20acd0..86ba9fcd4701 100644
--- a/mobile/rpc-foundation/goldens/matrix-speech.setup-sheet-speech.models.delete-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-speech.setup-sheet-speech.models.delete-1.json
@@ -3,9 +3,9 @@
   "family": "speech.setup-sheet",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5d978690e3626892b83bdba64537f9b1e1bb66c2060a00517ceead042a6d2334",
   "scenarioSha256": "140ede79a9ee0c02bedbfe67551060ef85692b6cb71968a48a1c41fcb4863804",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-speech.setup-sheet-speech.models.download-1.json b/mobile/rpc-foundation/goldens/matrix-speech.setup-sheet-speech.models.download-1.json
index cf97cac1fa90..3409286301b5 100644
--- a/mobile/rpc-foundation/goldens/matrix-speech.setup-sheet-speech.models.download-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-speech.setup-sheet-speech.models.download-1.json
@@ -3,9 +3,9 @@
   "family": "speech.setup-sheet",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5d978690e3626892b83bdba64537f9b1e1bb66c2060a00517ceead042a6d2334",
   "scenarioSha256": "6c0a9d2f2e28acd10c3a1f03888c23961e95bff02af10fe0e703d34fe6d60e8b",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-speech.setup-sheet-speech.models.list-1.json b/mobile/rpc-foundation/goldens/matrix-speech.setup-sheet-speech.models.list-1.json
index cd06b5fecf0b..c53ad0dc95b5 100644
--- a/mobile/rpc-foundation/goldens/matrix-speech.setup-sheet-speech.models.list-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-speech.setup-sheet-speech.models.list-1.json
@@ -3,9 +3,9 @@
   "family": "speech.setup-sheet",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5d978690e3626892b83bdba64537f9b1e1bb66c2060a00517ceead042a6d2334",
   "scenarioSha256": "d63062b89cc83321f6bcbd05c55dd21c71c6ff8c8026d026b5d94e44278ed3d8",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.item-checks-files-github.addprreviewcomment-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.item-checks-files-github.addprreviewcomment-1.json
index bbf3dbd9ce0d..b67b7af9961c 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.item-checks-files-github.addprreviewcomment-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.item-checks-files-github.addprreviewcomment-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.item-checks-files",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "8c4218bfb2af227da5386f29989cec438f2c6187f39ce1c06859e136ea920bfa",
   "scenarioSha256": "7bf61d34ba5217f7c00925612bb17542f3db17e1298294ca3ed647cd46278745",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.item-checks-files-github.prfilecontents-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.item-checks-files-github.prfilecontents-1.json
index f012772a853f..21054a03d14b 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.item-checks-files-github.prfilecontents-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.item-checks-files-github.prfilecontents-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.item-checks-files",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "8c4218bfb2af227da5386f29989cec438f2c6187f39ce1c06859e136ea920bfa",
   "scenarioSha256": "0186ae4ee9b3653fd9e7050a5316608a8e68f8bb463e1391862cdb3cd312676b",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.item-checks-files-github.rerunprchecks-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.item-checks-files-github.rerunprchecks-1.json
index f9f256f620f0..320e22d281e1 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.item-checks-files-github.rerunprchecks-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.item-checks-files-github.rerunprchecks-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.item-checks-files",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "8c4218bfb2af227da5386f29989cec438f2c6187f39ce1c06859e136ea920bfa",
   "scenarioSha256": "8f5a47f74635937c88584eeac40d2d9bec960823e7bf8f242e48575355be0d4e",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.item-checks-files-github.resolvereviewthread-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.item-checks-files-github.resolvereviewthread-1.json
index eda4db077d18..8e6b46a0e8de 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.item-checks-files-github.resolvereviewthread-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.item-checks-files-github.resolvereviewthread-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.item-checks-files",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "8c4218bfb2af227da5386f29989cec438f2c6187f39ce1c06859e136ea920bfa",
   "scenarioSha256": "c91ad2604cacc2b02ccd727333ba66275a27f783f3adb1faf64699ea0ffa67c2",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.item-checks-files-github.setprfileviewed-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.item-checks-files-github.setprfileviewed-1.json
index cb750bfad211..b03c44c060ab 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.item-checks-files-github.setprfileviewed-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.item-checks-files-github.setprfileviewed-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.item-checks-files",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "8c4218bfb2af227da5386f29989cec438f2c6187f39ce1c06859e136ea920bfa",
   "scenarioSha256": "984dd772f207f674d511d2711819855c7c6923d858ef87ea159842c337ed3ea0",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.item-comment-github-github.addissuecomment-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.item-comment-github-github.addissuecomment-1.json
index 30487de344be..95155ad41678 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.item-comment-github-github.addissuecomment-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.item-comment-github-github.addissuecomment-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.item-comment-github",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "8f68885d57a9aa76d80ba0ee29a95bdbaa98cef29c79c68ce75d67202cde7bfe",
   "scenarioSha256": "1cc7fdf3139e0c5a81cd83987ffedc4f59cd4866fc1b4018b61e35eacc74fc11",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.item-comment-gitlab-gitlab.addissuecomment-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.item-comment-gitlab-gitlab.addissuecomment-1.json
index ff4e387ee662..031fe3d00f99 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.item-comment-gitlab-gitlab.addissuecomment-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.item-comment-gitlab-gitlab.addissuecomment-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.item-comment-gitlab",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "8f68885d57a9aa76d80ba0ee29a95bdbaa98cef29c79c68ce75d67202cde7bfe",
   "scenarioSha256": "154d91d00db23ea2718a6ee0b6c5cafc7233084532b3d561731b059d58e006f5",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.item-comment-gitlab-mr-gitlab.addmrcomment-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.item-comment-gitlab-mr-gitlab.addmrcomment-1.json
index 171b0f678808..d11a120012f2 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.item-comment-gitlab-mr-gitlab.addmrcomment-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.item-comment-gitlab-mr-gitlab.addmrcomment-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.item-comment-gitlab-mr",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "8f68885d57a9aa76d80ba0ee29a95bdbaa98cef29c79c68ce75d67202cde7bfe",
   "scenarioSha256": "ae07579881829263a2b5590249d4119f5d9f4ef3877149ac3b780ad985413f00",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.item-detail-github-github.workitemdetails-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.item-detail-github-github.workitemdetails-1.json
index 1ad23b00f347..dfde030a09ce 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.item-detail-github-github.workitemdetails-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.item-detail-github-github.workitemdetails-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.item-detail-github",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c0ef16b959002e4a3c5347114a0844b95670e274ef010d910b6671ac5f49e783",
   "scenarioSha256": "955729f9100dce7eeb103f7b4d08ff56ac66853b9ad0d33627c0838011287bca",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.item-detail-gitlab-gitlab.workitemdetails-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.item-detail-gitlab-gitlab.workitemdetails-1.json
index 7c429394baa2..7d0b97060637 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.item-detail-gitlab-gitlab.workitemdetails-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.item-detail-gitlab-gitlab.workitemdetails-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.item-detail-gitlab",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c0ef16b959002e4a3c5347114a0844b95670e274ef010d910b6671ac5f49e783",
   "scenarioSha256": "d163c6125fa180da7575642ee29f4bb18e3678079b7c30a42934550896d5b3c1",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.item-detail-linear-linear.getissue-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.item-detail-linear-linear.getissue-1.json
index 652667fe8df9..443860d4591d 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.item-detail-linear-linear.getissue-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.item-detail-linear-linear.getissue-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.item-detail-linear",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c0ef16b959002e4a3c5347114a0844b95670e274ef010d910b6671ac5f49e783",
   "scenarioSha256": "83b30b2a160d162d16c66aa3bf6a633489e86dd4fd1c30828d2d244164b9c95e",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.item-detail-linear-linear.issuecomments-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.item-detail-linear-linear.issuecomments-1.json
index 6bffa5995662..eca351d61b28 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.item-detail-linear-linear.issuecomments-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.item-detail-linear-linear.issuecomments-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.item-detail-linear",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c0ef16b959002e4a3c5347114a0844b95670e274ef010d910b6671ac5f49e783",
   "scenarioSha256": "06b06c84f4b8a1ee8e5159d8ada2656da4d7096729759c76601ad4e251310924",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.item-detail-metadata-github.listassignableusers-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.item-detail-metadata-github.listassignableusers-1.json
index 80941a520e07..ad93b3ea025c 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.item-detail-metadata-github.listassignableusers-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.item-detail-metadata-github.listassignableusers-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.item-detail-metadata",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "58ea1553e04017c993aea4753aace41ee664705a3fdb3b18569c5a9d7968cf06",
   "scenarioSha256": "3ef6ef046f60d2d11ef81adf69bd5216036405eb05e5fd30cf1c402120488ee5",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.item-detail-metadata-github.listlabels-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.item-detail-metadata-github.listlabels-1.json
index a63f55006ca8..96bc25cec251 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.item-detail-metadata-github.listlabels-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.item-detail-metadata-github.listlabels-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.item-detail-metadata",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "58ea1553e04017c993aea4753aace41ee664705a3fdb3b18569c5a9d7968cf06",
   "scenarioSha256": "a2ecf4ddc2c9870a8d73cbd920b46bb0663a958ac156dc6de092be3c9474ea2b",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.item-merge-gitlab-gitlab.mergemr-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.item-merge-gitlab-gitlab.mergemr-1.json
index 8864e2bab3b5..cbb4de4f6bcd 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.item-merge-gitlab-gitlab.mergemr-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.item-merge-gitlab-gitlab.mergemr-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.item-merge-gitlab",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "8f68885d57a9aa76d80ba0ee29a95bdbaa98cef29c79c68ce75d67202cde7bfe",
   "scenarioSha256": "f40d99c60523ad1a6a3a761935e86ab0739337486dd316e6ab3248980e575027",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.item-metadata-github-github.updatepr-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.item-metadata-github-github.updatepr-1.json
index da47a7c322f9..9bcdd6808696 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.item-metadata-github-github.updatepr-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.item-metadata-github-github.updatepr-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.item-metadata-github",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "97cfbcd82778ed6517ca2d10b2f3ad5a8d366e380d7846c1e89d5a5baf17e739",
   "scenarioSha256": "27587bfb5745051e3cb27b01dc49b90b6f3c8ddbeb38f20772502fae2f562d91",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.item-metadata-gitlab-gitlab.updateissue-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.item-metadata-gitlab-gitlab.updateissue-1.json
index fbcb5f118ef8..077b75b17d5e 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.item-metadata-gitlab-gitlab.updateissue-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.item-metadata-gitlab-gitlab.updateissue-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.item-metadata-gitlab",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "97cfbcd82778ed6517ca2d10b2f3ad5a8d366e380d7846c1e89d5a5baf17e739",
   "scenarioSha256": "01664112d8f24d0a08fa7ba4e2d7f389acb363ce493e083f359f90fa0b87911d",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.item-metadata-gitlab-mr-gitlab.updatemr-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.item-metadata-gitlab-mr-gitlab.updatemr-1.json
index faf8ec093b70..0b807b5ed225 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.item-metadata-gitlab-mr-gitlab.updatemr-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.item-metadata-gitlab-mr-gitlab.updatemr-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.item-metadata-gitlab-mr",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "97cfbcd82778ed6517ca2d10b2f3ad5a8d366e380d7846c1e89d5a5baf17e739",
   "scenarioSha256": "186444ac8dc34dc63d1fbf304275e2265d96c6742e4c8f1e8e5568aa5504bf5d",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.item-reply-merge-github.addissuecomment-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.item-reply-merge-github.addissuecomment-1.json
index a28c8366700a..9a9603a28117 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.item-reply-merge-github.addissuecomment-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.item-reply-merge-github.addissuecomment-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.item-reply-merge",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "8f68885d57a9aa76d80ba0ee29a95bdbaa98cef29c79c68ce75d67202cde7bfe",
   "scenarioSha256": "c6e5ae446b875afba3944a96d931fdca6006ed8e904374e5040088004eb9b044",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.item-reply-merge-github.addprreviewcommentreply-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.item-reply-merge-github.addprreviewcommentreply-1.json
index fa3aa120fd99..a474ac6a30bf 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.item-reply-merge-github.addprreviewcommentreply-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.item-reply-merge-github.addprreviewcommentreply-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.item-reply-merge",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "8f68885d57a9aa76d80ba0ee29a95bdbaa98cef29c79c68ce75d67202cde7bfe",
   "scenarioSha256": "2da11d5a9c7a223a59c56ec416ab33acd42d900b4080132bde27313e042808d9",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.item-reply-merge-github.mergepr-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.item-reply-merge-github.mergepr-1.json
index d7cb3751cc68..b3dda42772f7 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.item-reply-merge-github.mergepr-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.item-reply-merge-github.mergepr-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.item-reply-merge",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "8f68885d57a9aa76d80ba0ee29a95bdbaa98cef29c79c68ce75d67202cde7bfe",
   "scenarioSha256": "a5d8ba37f44421d3efd19617ef319f37fda3fe53004b6829ae2c320f85d5c98d",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.item-reply-merge-linear.updateissue-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.item-reply-merge-linear.updateissue-1.json
index fd352bb21b53..405d54c6c108 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.item-reply-merge-linear.updateissue-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.item-reply-merge-linear.updateissue-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.item-reply-merge",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "8f68885d57a9aa76d80ba0ee29a95bdbaa98cef29c79c68ce75d67202cde7bfe",
   "scenarioSha256": "abc4b882c92ba90a52d3635fe882b2c653bc91ab4d9927f240ebee4dd147b81d",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.item-review-github-github.prchecks-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.item-review-github-github.prchecks-1.json
index 96ce7f747ddb..8e6247874d26 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.item-review-github-github.prchecks-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.item-review-github-github.prchecks-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.item-review-github",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "8f68885d57a9aa76d80ba0ee29a95bdbaa98cef29c79c68ce75d67202cde7bfe",
   "scenarioSha256": "77b0812842903075bb3d3ec1f7bcea94b1e1dac5993c3c8854bd4c3d2a567988",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.item-review-github-github.requestprreviewers-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.item-review-github-github.requestprreviewers-1.json
index efaf467a1c47..ded345480f92 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.item-review-github-github.requestprreviewers-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.item-review-github-github.requestprreviewers-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.item-review-github",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "8f68885d57a9aa76d80ba0ee29a95bdbaa98cef29c79c68ce75d67202cde7bfe",
   "scenarioSha256": "96a1813de0159396f6a5eb36a764fad4511de0a25eff6323571e1fade2a7f334",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.item-status-gitlab-github.updateissue-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.item-status-gitlab-github.updateissue-1.json
index 7ed2a3c36ca2..c087e542b0f9 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.item-status-gitlab-github.updateissue-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.item-status-gitlab-github.updateissue-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.item-status-gitlab",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "8c4218bfb2af227da5386f29989cec438f2c6187f39ce1c06859e136ea920bfa",
   "scenarioSha256": "57c41b51e34e451975a9f28a6461aa3b8e9dcf04cbebaea80ddf14afc4b78edf",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.item-status-gitlab-gitlab.updateissue-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.item-status-gitlab-gitlab.updateissue-1.json
index 5e4f5169aa97..281a32427592 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.item-status-gitlab-gitlab.updateissue-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.item-status-gitlab-gitlab.updateissue-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.item-status-gitlab",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "8c4218bfb2af227da5386f29989cec438f2c6187f39ce1c06859e136ea920bfa",
   "scenarioSha256": "64a7af1bfac25dfe673832ef0ef7776be8d1a628c995eafd938fa3ad11d7ba0f",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.item-status-gitlab-mr-gitlab.updatemrstate-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.item-status-gitlab-mr-gitlab.updatemrstate-1.json
index a4698564cdc7..5e7e0f495014 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.item-status-gitlab-mr-gitlab.updatemrstate-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.item-status-gitlab-mr-gitlab.updatemrstate-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.item-status-gitlab-mr",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "8c4218bfb2af227da5386f29989cec438f2c6187f39ce1c06859e136ea920bfa",
   "scenarioSha256": "8443a59a1d432fbcfb9d158995cfa69bef364c33b66a97cbef0e70e197fcad4d",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.linear-connect-linear.connect-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.linear-connect-linear.connect-1.json
index 94fdf74e9164..c593debdb83e 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.linear-connect-linear.connect-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.linear-connect-linear.connect-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.linear-connect",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "07a15e900363faa25bc364f5bc1c330f96798abfeaed35210428c2ac558586b8",
   "scenarioSha256": "a60d7c0ce3d155116aecbb3d1ca015b4d9de310155f4e840b2fc391dc9d04860",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.linear-item-linear.addissuecomment-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.linear-item-linear.addissuecomment-1.json
index 0ea32461fe32..7007ebff9184 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.linear-item-linear.addissuecomment-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.linear-item-linear.addissuecomment-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.linear-item",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "97cfbcd82778ed6517ca2d10b2f3ad5a8d366e380d7846c1e89d5a5baf17e739",
   "scenarioSha256": "a2c0c5c200b36d2194815e67df2ea50422f6ecfd9df411132202e9660c87c41b",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.linear-item-linear.createissue-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.linear-item-linear.createissue-1.json
index c339b0dcb33b..1aba541766f6 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.linear-item-linear.createissue-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.linear-item-linear.createissue-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.linear-item",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "97cfbcd82778ed6517ca2d10b2f3ad5a8d366e380d7846c1e89d5a5baf17e739",
   "scenarioSha256": "8a5c5b210459d3938bc010bc88c69696a631072cd5a6b7e1a3eb3e1fd0da9c8a",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.linear-item-linear.getissue-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.linear-item-linear.getissue-1.json
index e63c965f73e5..0d1d7b376ca6 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.linear-item-linear.getissue-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.linear-item-linear.getissue-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.linear-item",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "97cfbcd82778ed6517ca2d10b2f3ad5a8d366e380d7846c1e89d5a5baf17e739",
   "scenarioSha256": "ab0ac02611d487a9edd58319c6e4b9302148684f27711afc3b69feaa73fc4b07",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.linear-team-context-linear.listteams-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.linear-team-context-linear.listteams-1.json
index 2aa5ca0ef0d3..d6fa613a3d96 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.linear-team-context-linear.listteams-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.linear-team-context-linear.listteams-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.linear-team-context",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "58ea1553e04017c993aea4753aace41ee664705a3fdb3b18569c5a9d7968cf06",
   "scenarioSha256": "c4a5928ef7035ad8bed20945f235f4fa509238b3a167c91df50baefff8e8433f",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.linear-team-context-linear.teamstates-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.linear-team-context-linear.teamstates-1.json
index 874de723ad0c..b0424264674f 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.linear-team-context-linear.teamstates-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.linear-team-context-linear.teamstates-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.linear-team-context",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "58ea1553e04017c993aea4753aace41ee664705a3fdb3b18569c5a9d7968cf06",
   "scenarioSha256": "8ec517c98775f3af0d45776dc74bcaaf99dcc751e85343084e39c557b6ddede1",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.paste-lookup-github.reposlug-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.paste-lookup-github.reposlug-1.json
index fb5878536598..13d5fb72afac 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.paste-lookup-github.reposlug-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.paste-lookup-github.reposlug-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.paste-lookup",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "52a76b7a830b32287bce14abbe1b9d9ac70e71eafe5b4c6801c2eb14a4150125",
   "scenarioSha256": "77b429e1066a877bb3c8513e89e42314bb974478385695ceb36dbaa7c57e654a",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.paste-lookup-github.workitem-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.paste-lookup-github.workitem-1.json
index da25973c6e76..8ca021156ec4 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.paste-lookup-github.workitem-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.paste-lookup-github.workitem-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.paste-lookup",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "52a76b7a830b32287bce14abbe1b9d9ac70e71eafe5b4c6801c2eb14a4150125",
   "scenarioSha256": "8d58d134262cd828348bc3416f7208b51259dff9ea952eeceaab6e6dcfcfd96a",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.paste-lookup-github.workitembyownerrepo-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.paste-lookup-github.workitembyownerrepo-1.json
index ad1cc23c8dea..2d182d0a0d92 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.paste-lookup-github.workitembyownerrepo-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.paste-lookup-github.workitembyownerrepo-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.paste-lookup",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "52a76b7a830b32287bce14abbe1b9d9ac70e71eafe5b4c6801c2eb14a4150125",
   "scenarioSha256": "4dc2c4cfc9c29ee998796980a7ae6ded99a39f17e143e3db588239bc224b2cc5",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.paste-lookup-gitlab.workitembypath-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.paste-lookup-gitlab.workitembypath-1.json
index f222d36e114e..a06701de86e6 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.paste-lookup-gitlab.workitembypath-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.paste-lookup-gitlab.workitembypath-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.paste-lookup",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "52a76b7a830b32287bce14abbe1b9d9ac70e71eafe5b4c6801c2eb14a4150125",
   "scenarioSha256": "d622fc252f4e2e1d2e244d8781b260ed6e42dee572b8d2fd39d6c3b49baae04a",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.project-board-load-github.project.listaccessible-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.project-board-load-github.project.listaccessible-1.json
index 2522ec3e7520..0fbdd02524a4 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.project-board-load-github.project.listaccessible-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.project-board-load-github.project.listaccessible-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.project-board-load",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c4272385ed3b0de4feab38de9e4f6363ecd6317fdd4de47f76a98eb18abaf371",
   "scenarioSha256": "7c16d49ffeace5c689309316da6e4638fa1b70d3ef52a78d27db934ae56cf64d",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.project-board-load-github.project.listviews-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.project-board-load-github.project.listviews-1.json
index 47d4449c9254..ff472ef25946 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.project-board-load-github.project.listviews-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.project-board-load-github.project.listviews-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.project-board-load",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c4272385ed3b0de4feab38de9e4f6363ecd6317fdd4de47f76a98eb18abaf371",
   "scenarioSha256": "c5cc9a11a75a86780195be7d1055d1064c8aba78bb8e4e8bbdf033409c2b2aa5",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.project-board-load-github.project.listviews-2.json b/mobile/rpc-foundation/goldens/matrix-tasks.project-board-load-github.project.listviews-2.json
index a2d26d09c2e4..1e07891bcd87 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.project-board-load-github.project.listviews-2.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.project-board-load-github.project.listviews-2.json
@@ -3,9 +3,9 @@
   "family": "tasks.project-board-load",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c4272385ed3b0de4feab38de9e4f6363ecd6317fdd4de47f76a98eb18abaf371",
   "scenarioSha256": "7f748bb55df907bba315ea6899c585837d97fa0ea9b312330cf35d95bda87bd1",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.project-board-load-github.project.resolveref-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.project-board-load-github.project.resolveref-1.json
index 865fe2ffd826..ccd800b30010 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.project-board-load-github.project.resolveref-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.project-board-load-github.project.resolveref-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.project-board-load",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c4272385ed3b0de4feab38de9e4f6363ecd6317fdd4de47f76a98eb18abaf371",
   "scenarioSha256": "4ab4e4022cafd69cbc7af45ddf72d2dad3e8215df363511651d7faea014147d3",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.project-board-load-github.project.viewtable-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.project-board-load-github.project.viewtable-1.json
index 2c3e0048b7c1..e3a2bb532512 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.project-board-load-github.project.viewtable-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.project-board-load-github.project.viewtable-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.project-board-load",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c4272385ed3b0de4feab38de9e4f6363ecd6317fdd4de47f76a98eb18abaf371",
   "scenarioSha256": "cf64dd43e708ff953ba2cbb2a70378aa8ab5d13ede157af7ba0967d913755b82",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.project-repo-slugs-github.reposlug-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.project-repo-slugs-github.reposlug-1.json
index 2089edd06467..9a2392eb024c 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.project-repo-slugs-github.reposlug-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.project-repo-slugs-github.reposlug-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.project-repo-slugs",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c4272385ed3b0de4feab38de9e4f6363ecd6317fdd4de47f76a98eb18abaf371",
   "scenarioSha256": "667a06cf9ff8129eee64327566012448abe1fe31f58c0d9b882b13e74db5a877",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-comments-issue-github.project.addissuecommentbyslug-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-comments-issue-github.project.addissuecommentbyslug-1.json
index 0e5bf5d2d30b..9e4ad5923869 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-comments-issue-github.project.addissuecommentbyslug-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-comments-issue-github.project.addissuecommentbyslug-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.project-row-comments-issue",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "55058202df36c8b951510215936e496ea88d3d71a6690090a13c52deb13e34e1",
   "scenarioSha256": "9fd4756c2224f3ecbc9ffc82e1ee11615a9e057e600bc56ccaf5c5e2c0e411d8",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-comments-issue-github.project.updateissuebyslug-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-comments-issue-github.project.updateissuebyslug-1.json
index 2d7d12532037..f26251dd6277 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-comments-issue-github.project.updateissuebyslug-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-comments-issue-github.project.updateissuebyslug-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.project-row-comments-issue",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "55058202df36c8b951510215936e496ea88d3d71a6690090a13c52deb13e34e1",
   "scenarioSha256": "cfe0284f502001a57a9d18585222e5ae4b254d9bac32e0bb4080ee9363e8e019",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-comments-issue-github.project.updateissuecommentbyslug-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-comments-issue-github.project.updateissuecommentbyslug-1.json
index 8a478d57b7e1..77f447daa8da 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-comments-issue-github.project.updateissuecommentbyslug-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-comments-issue-github.project.updateissuecommentbyslug-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.project-row-comments-issue",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "55058202df36c8b951510215936e496ea88d3d71a6690090a13c52deb13e34e1",
   "scenarioSha256": "b21a3b3f568bf6caecca62272f4b7882062027684c70878fd5f883622ff2a9ea",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-comments-pr-github.project.updatepullrequestbyslug-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-comments-pr-github.project.updatepullrequestbyslug-1.json
index e1c135b56997..8d8ecf09a955 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-comments-pr-github.project.updatepullrequestbyslug-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-comments-pr-github.project.updatepullrequestbyslug-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.project-row-comments-pr",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "55058202df36c8b951510215936e496ea88d3d71a6690090a13c52deb13e34e1",
   "scenarioSha256": "e286edb942c338fd844ce8437ac03c872838228515ce833cfd310332354da725",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-detail-github.project.workitemdetailsbyslug-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-detail-github.project.workitemdetailsbyslug-1.json
index c7aa345f79fd..e210a9781f15 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-detail-github.project.workitemdetailsbyslug-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-detail-github.project.workitemdetailsbyslug-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.project-row-detail",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "f8f6e5d500f959b9b15c5498885a05422747880b6aef4ad795bc3064ebbacea6",
   "scenarioSha256": "52b2cc222d9819121ba99f8f603bc76abe420d731e5853116e802a4db59e2d3e",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-fields-github.project.clearitemfield-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-fields-github.project.clearitemfield-1.json
index 776905dd36b4..ee80800548e9 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-fields-github.project.clearitemfield-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-fields-github.project.clearitemfield-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.project-row-fields",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "370aeaee59978071ccb821da13c9e6114936c168947b608539cdb80d40cc9889",
   "scenarioSha256": "0fe8c60631cf04d33b34371155f5f80c8426b07b1cbec2fabc5d6d619f2633b8",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-fields-github.project.updateissuetypebyslug-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-fields-github.project.updateissuetypebyslug-1.json
index 3126d7cd00c4..29a69fc4ecd4 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-fields-github.project.updateissuetypebyslug-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-fields-github.project.updateissuetypebyslug-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.project-row-fields",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "370aeaee59978071ccb821da13c9e6114936c168947b608539cdb80d40cc9889",
   "scenarioSha256": "8ad021e101d8ef17ed47472a5fbfbeaebb2690a4040c89a0e9ee133e69e4fecd",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-fields-github.project.updateitemfield-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-fields-github.project.updateitemfield-1.json
index 3d87fbdd7830..396a5ef5a7a3 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-fields-github.project.updateitemfield-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-fields-github.project.updateitemfield-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.project-row-fields",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "370aeaee59978071ccb821da13c9e6114936c168947b608539cdb80d40cc9889",
   "scenarioSha256": "4d33ce12f3f35bea8a98fec2c0378e73caf7fbfb93085545e890b082a392cd60",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-files-merge-github.addprreviewcomment-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-files-merge-github.addprreviewcomment-1.json
index bd821ab36f5a..348fa5d00bad 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-files-merge-github.addprreviewcomment-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-files-merge-github.addprreviewcomment-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.project-row-files-merge",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b228732762828412ad3d9eec3ece00a897d866046e37044322c3911758d6e0a9",
   "scenarioSha256": "3ed626e9d776e009f008c85f5165c8199bc2b85afd279a435e2e0f800737b42f",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-files-merge-github.mergepr-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-files-merge-github.mergepr-1.json
index bbdf26c3274b..d43f59244e4c 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-files-merge-github.mergepr-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-files-merge-github.mergepr-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.project-row-files-merge",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b228732762828412ad3d9eec3ece00a897d866046e37044322c3911758d6e0a9",
   "scenarioSha256": "1e402d7984c7958ba23fb700464a450374ad72424be8f2669f769199a1a2899e",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-files-merge-github.prfilecontents-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-files-merge-github.prfilecontents-1.json
index 3ca293ee003a..e7e09e99bff9 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-files-merge-github.prfilecontents-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-files-merge-github.prfilecontents-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.project-row-files-merge",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b228732762828412ad3d9eec3ece00a897d866046e37044322c3911758d6e0a9",
   "scenarioSha256": "1b2ead3380b546c94c5da2ed61c9208cd158db9a56ca87e3e72e450668e1e507",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-files-merge-github.updateissue-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-files-merge-github.updateissue-1.json
index cb93a77cd96b..01e655d36eac 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-files-merge-github.updateissue-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-files-merge-github.updateissue-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.project-row-files-merge",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b228732762828412ad3d9eec3ece00a897d866046e37044322c3911758d6e0a9",
   "scenarioSha256": "947b1c1aa9688688a1e4cbdbacfde185fbf5d0b28b13e753ba87bdf7f999aa00",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-files-merge-github.updateprstate-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-files-merge-github.updateprstate-1.json
index 2dda0bcac16f..cf97438c9459 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-files-merge-github.updateprstate-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-files-merge-github.updateprstate-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.project-row-files-merge",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b228732762828412ad3d9eec3ece00a897d866046e37044322c3911758d6e0a9",
   "scenarioSha256": "cc450fcf20e403eea6ce1ee103c131feccb2906c0ae31c7cd3f3d3fa0b739d68",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-metadata-load-github.project.listassignableusersbyslug-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-metadata-load-github.project.listassignableusersbyslug-1.json
index 9115c20437ee..94f6d229695f 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-metadata-load-github.project.listassignableusersbyslug-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-metadata-load-github.project.listassignableusersbyslug-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.project-row-metadata-load",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "f8f6e5d500f959b9b15c5498885a05422747880b6aef4ad795bc3064ebbacea6",
   "scenarioSha256": "2303fc902e5a6cf6a43db58ef2938538a7b770d1509cc22a9811f4c83051aea1",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-metadata-load-github.project.listissuetypesbyslug-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-metadata-load-github.project.listissuetypesbyslug-1.json
index 04980c004f50..dd49f3079ea3 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-metadata-load-github.project.listissuetypesbyslug-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-metadata-load-github.project.listissuetypesbyslug-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.project-row-metadata-load",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "f8f6e5d500f959b9b15c5498885a05422747880b6aef4ad795bc3064ebbacea6",
   "scenarioSha256": "8b75854487566ca6da98d391b6822c81c99e61011fc094458ae038905c1c9287",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-metadata-load-github.project.listlabelsbyslug-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-metadata-load-github.project.listlabelsbyslug-1.json
index c1bc6d520298..7d1fcbc4ae32 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-metadata-load-github.project.listlabelsbyslug-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-metadata-load-github.project.listlabelsbyslug-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.project-row-metadata-load",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "f8f6e5d500f959b9b15c5498885a05422747880b6aef4ad795bc3064ebbacea6",
   "scenarioSha256": "7c948e76afb331e4038298215181adc97cd533c4f79e205e183c08e8a2db20fc",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-review-checks-github.prchecks-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-review-checks-github.prchecks-1.json
index 9c7fa793d2a4..840421c8cf0b 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-review-checks-github.prchecks-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-review-checks-github.prchecks-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.project-row-review-checks",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "370aeaee59978071ccb821da13c9e6114936c168947b608539cdb80d40cc9889",
   "scenarioSha256": "20e9631df87e40e64d35cee0c0e06b922fe53bd93e3d9e4078633b85a5278b7e",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-review-checks-github.requestprreviewers-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-review-checks-github.requestprreviewers-1.json
index b0f04b290a95..7a4bc5ee2f8b 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-review-checks-github.requestprreviewers-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-review-checks-github.requestprreviewers-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.project-row-review-checks",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "370aeaee59978071ccb821da13c9e6114936c168947b608539cdb80d40cc9889",
   "scenarioSha256": "2d947b63fb35dad9bbe201061cb51d0b3c5a5e6f3e8018eeda2ec1f962952809",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-review-checks-github.rerunprchecks-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-review-checks-github.rerunprchecks-1.json
index 5286d9a2aa1c..4f65f491d23e 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-review-checks-github.rerunprchecks-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-review-checks-github.rerunprchecks-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.project-row-review-checks",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "370aeaee59978071ccb821da13c9e6114936c168947b608539cdb80d40cc9889",
   "scenarioSha256": "ca6b0d81b19811806ce332a776361a40e526a73bef90cfa3df05a764e2ee83b6",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-review-checks-github.setprfileviewed-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-review-checks-github.setprfileviewed-1.json
index aa3e48550466..d8ea88595a7c 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-review-checks-github.setprfileviewed-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-review-checks-github.setprfileviewed-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.project-row-review-checks",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "370aeaee59978071ccb821da13c9e6114936c168947b608539cdb80d40cc9889",
   "scenarioSha256": "bd58d88e0534366e281869ee79eb75fe65b418d02523d815d8d0d58799edc31b",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-threads-github.addissuecomment-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-threads-github.addissuecomment-1.json
index e30179c1b832..6fa2add9b38d 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-threads-github.addissuecomment-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-threads-github.addissuecomment-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.project-row-threads",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "55058202df36c8b951510215936e496ea88d3d71a6690090a13c52deb13e34e1",
   "scenarioSha256": "0f220b97bbb64ef8d347973690e6fab4b305eaaa54c9b7883340415c54e61206",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-threads-github.addprreviewcommentreply-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-threads-github.addprreviewcommentreply-1.json
index 512bf6ce5d2a..7cdf2f5e692a 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-threads-github.addprreviewcommentreply-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-threads-github.addprreviewcommentreply-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.project-row-threads",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "55058202df36c8b951510215936e496ea88d3d71a6690090a13c52deb13e34e1",
   "scenarioSha256": "85160836c5a5c9bae76aff82c834ceb908f9262a90facd6e055c289362664eaa",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-threads-github.project.deleteissuecommentbyslug-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-threads-github.project.deleteissuecommentbyslug-1.json
index d7d246999be1..5f1530f55842 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-threads-github.project.deleteissuecommentbyslug-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-threads-github.project.deleteissuecommentbyslug-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.project-row-threads",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "55058202df36c8b951510215936e496ea88d3d71a6690090a13c52deb13e34e1",
   "scenarioSha256": "5bc59cfd0d951ae5193df5c49ce3618d9536be0bc8f8192a7b03000963c2001b",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-threads-github.resolvereviewthread-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-threads-github.resolvereviewthread-1.json
index 89f41930554b..fe59a15359a3 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.project-row-threads-github.resolvereviewthread-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.project-row-threads-github.resolvereviewthread-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.project-row-threads",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "55058202df36c8b951510215936e496ea88d3d71a6690090a13c52deb13e34e1",
   "scenarioSha256": "0d8c240718b3911464a6fc486114d67cd6f60aa295cd0886ff755b77d5036014",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.provider-load-github.countworkitems-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.provider-load-github.countworkitems-1.json
index 33b19046f6d0..1ba3862369cf 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.provider-load-github.countworkitems-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.provider-load-github.countworkitems-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.provider-load",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "07a15e900363faa25bc364f5bc1c330f96798abfeaed35210428c2ac558586b8",
   "scenarioSha256": "e9bdad78cf60e3dd931eab8810d011c6e0066f9a336a206f8f9ca62621b21fee",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.provider-load-github.listworkitems-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.provider-load-github.listworkitems-1.json
index 13121a83b9e0..57ed5a30f4b7 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.provider-load-github.listworkitems-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.provider-load-github.listworkitems-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.provider-load",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "07a15e900363faa25bc364f5bc1c330f96798abfeaed35210428c2ac558586b8",
   "scenarioSha256": "a5704c6849de9a45564c8738076ec8c0307754a5acc2c039880fe436771e68b3",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.provider-load-linear.listteams-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.provider-load-linear.listteams-1.json
index 6526189721d1..7b3c99dd7d56 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.provider-load-linear.listteams-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.provider-load-linear.listteams-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.provider-load",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "07a15e900363faa25bc364f5bc1c330f96798abfeaed35210428c2ac558586b8",
   "scenarioSha256": "e518040cbd40e3cc8c22e0b70b6de1087386936f75ed2f65f6e7b4fcdc344ba2",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.provider-load-linear.status-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.provider-load-linear.status-1.json
index 79b255a765e7..34dde76dcc53 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.provider-load-linear.status-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.provider-load-linear.status-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.provider-load",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "07a15e900363faa25bc364f5bc1c330f96798abfeaed35210428c2ac558586b8",
   "scenarioSha256": "f02acd2ed6319b8cb674c04b41a1e96c50e53123a8914790acc8af5410d63f98",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.provider-load-settings.update-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.provider-load-settings.update-1.json
index c974d5b6d732..193eb1794813 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.provider-load-settings.update-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.provider-load-settings.update-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.provider-load",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "07a15e900363faa25bc364f5bc1c330f96798abfeaed35210428c2ac558586b8",
   "scenarioSha256": "2b3006bfe1e7f3040b86ccc698e58ae19ae1aa11389aee2ec2a8f2dfdb0270f4",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.route-repo-list-repo.list-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.route-repo-list-repo.list-1.json
index 4cc6a77f830b..37c8aa87aadb 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.route-repo-list-repo.list-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.route-repo-list-repo.list-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.route-repo-list",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "23f974df8b57c723069605de1db80c339ead286b18aae38e67fce03ea50c5180",
   "scenarioSha256": "6373b83783b1a9b061bede3bba7aa3b573c3a50b897102a094df93f926856fdc",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.smart-source-search-github.listworkitems-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.smart-source-search-github.listworkitems-1.json
index 69fd50bfc0bf..1b3d8a1fb84e 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.smart-source-search-github.listworkitems-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.smart-source-search-github.listworkitems-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.smart-source-search",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "52a76b7a830b32287bce14abbe1b9d9ac70e71eafe5b4c6801c2eb14a4150125",
   "scenarioSha256": "85c9e5107fe3e74f44d8b3e5c791b80ff0370cdc3ada69dc09fe38d8058fb263",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.smart-source-search-gitlab.listworkitems-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.smart-source-search-gitlab.listworkitems-1.json
index caee5c7f76ac..9d4c9c75b925 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.smart-source-search-gitlab.listworkitems-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.smart-source-search-gitlab.listworkitems-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.smart-source-search",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "52a76b7a830b32287bce14abbe1b9d9ac70e71eafe5b4c6801c2eb14a4150125",
   "scenarioSha256": "0db7a8e1e5e740c341167bf045a0ab858f61708e995777fa4cf2e88cff1ec727",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.smart-source-search-linear.listissues-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.smart-source-search-linear.listissues-1.json
index 0b9880bd6207..de1e8ec39ec7 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.smart-source-search-linear.listissues-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.smart-source-search-linear.listissues-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.smart-source-search",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "52a76b7a830b32287bce14abbe1b9d9ac70e71eafe5b4c6801c2eb14a4150125",
   "scenarioSha256": "5d9211140d751c6cc844775d3e818f125483f1dac5b78960557ccfe73f41d08f",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.smart-source-search-linear.searchissues-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.smart-source-search-linear.searchissues-1.json
index 8050558ebe22..f8e8159ffa72 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.smart-source-search-linear.searchissues-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.smart-source-search-linear.searchissues-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.smart-source-search",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "52a76b7a830b32287bce14abbe1b9d9ac70e71eafe5b4c6801c2eb14a4150125",
   "scenarioSha256": "1cfdbdeca951545a4fafd23649991e93a02feea72d174a7c469f18dc64decfc4",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.smart-source-search-repo.searchrefs-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.smart-source-search-repo.searchrefs-1.json
index 7694916b374f..2f560b10ebb2 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.smart-source-search-repo.searchrefs-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.smart-source-search-repo.searchrefs-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.smart-source-search",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "52a76b7a830b32287bce14abbe1b9d9ac70e71eafe5b4c6801c2eb14a4150125",
   "scenarioSha256": "9fc0825ec19c2c90cec44ee284e7c54399e1552bdb15c329727921a15ad62944",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.task-create-github-github.createissue-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.task-create-github-github.createissue-1.json
index 587b666decdc..fca4fce1197a 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.task-create-github-github.createissue-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.task-create-github-github.createissue-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.task-create-github",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "07a15e900363faa25bc364f5bc1c330f96798abfeaed35210428c2ac558586b8",
   "scenarioSha256": "014040846f649f3c6ca1175b610ed1b51bae3001e7de103549d7ee1a511a2506",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.task-create-github-repo.update-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.task-create-github-repo.update-1.json
index f65a9a26c21c..fa23c0c10fb5 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.task-create-github-repo.update-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.task-create-github-repo.update-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.task-create-github",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "07a15e900363faa25bc364f5bc1c330f96798abfeaed35210428c2ac558586b8",
   "scenarioSha256": "9efe74e5a1b0d92f674e6044edfd534693c15b0a153bcb2c0e283a6cd53fa61b",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.task-create-gitlab-gitlab.createissue-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.task-create-gitlab-gitlab.createissue-1.json
index 8b0e79deb4ef..91964a45c8a7 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.task-create-gitlab-gitlab.createissue-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.task-create-gitlab-gitlab.createissue-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.task-create-gitlab",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "07a15e900363faa25bc364f5bc1c330f96798abfeaed35210428c2ac558586b8",
   "scenarioSha256": "217a3da50a54c4cbe19a68835ecfa038eae5b350430f0b8fd0a616bb5bdfe32d",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.task-create-linear-linear.createissue-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.task-create-linear-linear.createissue-1.json
index 85517be94047..098d6ee570fe 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.task-create-linear-linear.createissue-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.task-create-linear-linear.createissue-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.task-create-linear",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "07a15e900363faa25bc364f5bc1c330f96798abfeaed35210428c2ac558586b8",
   "scenarioSha256": "cb4c10cc6401e5b68340bd1fa09381c973348b6e0c7ffef563cde92080c57a15",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.task-list-gitlab-items-gitlab.listworkitems-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.task-list-gitlab-items-gitlab.listworkitems-1.json
index ef2cc6786707..ac71243b86cb 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.task-list-gitlab-items-gitlab.listworkitems-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.task-list-gitlab-items-gitlab.listworkitems-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.task-list-gitlab-items",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "07a15e900363faa25bc364f5bc1c330f96798abfeaed35210428c2ac558586b8",
   "scenarioSha256": "038221907a57f5bb25338f9b07a744dbac3ea0a7ea2ba43281f171912f45a586",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.task-list-gitlab-todos-gitlab.todos-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.task-list-gitlab-todos-gitlab.todos-1.json
index c41a4fe7b951..02a4a5205251 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.task-list-gitlab-todos-gitlab.todos-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.task-list-gitlab-todos-gitlab.todos-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.task-list-gitlab-todos",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "07a15e900363faa25bc364f5bc1c330f96798abfeaed35210428c2ac558586b8",
   "scenarioSha256": "e36b90621e11880ec1e6c16e8e3c89cc14f5d68a4a9e06b8a3098fc0bd0104a2",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.task-list-linear-linear.listissues-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.task-list-linear-linear.listissues-1.json
index 6335e2aff477..39c5056378be 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.task-list-linear-linear.listissues-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.task-list-linear-linear.listissues-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.task-list-linear",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "07a15e900363faa25bc364f5bc1c330f96798abfeaed35210428c2ac558586b8",
   "scenarioSha256": "39ef28af17e4d3774b42bba1555606770667bc9010692fb1a4492413a940c0a0",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.task-list-linear-linear.searchissues-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.task-list-linear-linear.searchissues-1.json
index 66e476f087f6..07b47c3b8751 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.task-list-linear-linear.searchissues-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.task-list-linear-linear.searchissues-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.task-list-linear",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "07a15e900363faa25bc364f5bc1c330f96798abfeaed35210428c2ac558586b8",
   "scenarioSha256": "c589700af145f58c37292dafb891b3b7d50302fd4ec044155c044ccd48f79c74",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.workspace-source-repo.searchrefs-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.workspace-source-repo.searchrefs-1.json
index 294a195f836e..f5568be42586 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.workspace-source-repo.searchrefs-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.workspace-source-repo.searchrefs-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.workspace-source",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "4e567302ac8acffcfd602c9b323ecf8b5b7c0c4692bda1a4c881011a91d98979",
   "scenarioSha256": "9e91d46870cd69279cc7d8ebfd317ab8b13136ccff9662876c7601a3a83ecafe",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.workspace-source-repo.sparsepresets-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.workspace-source-repo.sparsepresets-1.json
index c505118727bd..164dbc2c3859 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.workspace-source-repo.sparsepresets-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.workspace-source-repo.sparsepresets-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.workspace-source",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "4e567302ac8acffcfd602c9b323ecf8b5b7c0c4692bda1a4c881011a91d98979",
   "scenarioSha256": "2d4a681bffbc5ff9d3040ea0d6bb2603ee940c3c497269d0b63caca564fb25e1",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.workspace-sparse-repo.savesparsepreset-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.workspace-sparse-repo.savesparsepreset-1.json
index abf2962dddc2..0e4bb3020873 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.workspace-sparse-repo.savesparsepreset-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.workspace-sparse-repo.savesparsepreset-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.workspace-sparse",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "4e567302ac8acffcfd602c9b323ecf8b5b7c0c4692bda1a4c881011a91d98979",
   "scenarioSha256": "3d4637406e2d658b72f73153f0a5e176cb8b143593b72bce0cdf979bc6e4cbdd",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.workspace-sparse-ssh.getstate-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.workspace-sparse-ssh.getstate-1.json
index 13bcbc2eb546..4626bfa69e43 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.workspace-sparse-ssh.getstate-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.workspace-sparse-ssh.getstate-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.workspace-sparse",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "4e567302ac8acffcfd602c9b323ecf8b5b7c0c4692bda1a4c881011a91d98979",
   "scenarioSha256": "3453024581230908d1e0e9335f5310e7b4ae03faf50d93654b9ff28c464fb95f",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.workspace-ssh-local-preflight.detectagents-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.workspace-ssh-local-preflight.detectagents-1.json
index 87d9d11bdefd..bbd02ec0d5c7 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.workspace-ssh-local-preflight.detectagents-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.workspace-ssh-local-preflight.detectagents-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.workspace-ssh-local",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "4e567302ac8acffcfd602c9b323ecf8b5b7c0c4692bda1a4c881011a91d98979",
   "scenarioSha256": "28f7ba289c188bfc121ef7b969133711189e887fbfc7b37c8a5401ea7f30b56a",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.workspace-ssh-preflight.detectremoteagents-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.workspace-ssh-preflight.detectremoteagents-1.json
index 852361bf234d..83cb2175e336 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.workspace-ssh-preflight.detectremoteagents-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.workspace-ssh-preflight.detectremoteagents-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.workspace-ssh",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "4e567302ac8acffcfd602c9b323ecf8b5b7c0c4692bda1a4c881011a91d98979",
   "scenarioSha256": "35771ab92d0d4ff44a1dd6e5f1e5d3137570a2e013bddea5ca77ecac7989ed53",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.workspace-ssh-repo.hooks-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.workspace-ssh-repo.hooks-1.json
index 157eef6cfb74..328d3a78b15d 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.workspace-ssh-repo.hooks-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.workspace-ssh-repo.hooks-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.workspace-ssh",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "4e567302ac8acffcfd602c9b323ecf8b5b7c0c4692bda1a4c881011a91d98979",
   "scenarioSha256": "39451d3c811068754f91ac243fe1208f4ce742df53261314345d8209ba761e94",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-tasks.workspace-ssh-ssh.connect-1.json b/mobile/rpc-foundation/goldens/matrix-tasks.workspace-ssh-ssh.connect-1.json
index 643e113e5683..bc40f5401eb2 100644
--- a/mobile/rpc-foundation/goldens/matrix-tasks.workspace-ssh-ssh.connect-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-tasks.workspace-ssh-ssh.connect-1.json
@@ -3,9 +3,9 @@
   "family": "tasks.workspace-ssh",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "4e567302ac8acffcfd602c9b323ecf8b5b7c0c4692bda1a4c881011a91d98979",
   "scenarioSha256": "5cc1773d06d49d2616da72f2790753322edda6d67e12b5e41116971d34787391",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-terminal.query-reply-terminal.send-1.json b/mobile/rpc-foundation/goldens/matrix-terminal.query-reply-terminal.send-1.json
index fdf3c6d4ad24..c821da19b595 100644
--- a/mobile/rpc-foundation/goldens/matrix-terminal.query-reply-terminal.send-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-terminal.query-reply-terminal.send-1.json
@@ -3,10 +3,10 @@
   "family": "terminal.query-reply",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
-  "adapterSha256": "7588d30f33a8bb846c48f160aa9a4a8138176662bb2fb6be7bbdf352f553d05f",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "42e1fe434b591ab5a945b6b366bbb20b567085d58bade63413f2251e8202b255",
   "scenarioSha256": "15b5694a63d54aeb4f4d9a861729e7e3b42ce06b15af6784fcb1afab744ed18b",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/matrix-terminal.raw-input-orchestration.workerterminaluserinput-1.json b/mobile/rpc-foundation/goldens/matrix-terminal.raw-input-orchestration.workerterminaluserinput-1.json
index 4702dc97c62b..30d583e8a304 100644
--- a/mobile/rpc-foundation/goldens/matrix-terminal.raw-input-orchestration.workerterminaluserinput-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-terminal.raw-input-orchestration.workerterminaluserinput-1.json
@@ -3,10 +3,10 @@
   "family": "terminal.raw-input",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
-  "adapterSha256": "7588d30f33a8bb846c48f160aa9a4a8138176662bb2fb6be7bbdf352f553d05f",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "42e1fe434b591ab5a945b6b366bbb20b567085d58bade63413f2251e8202b255",
   "scenarioSha256": "68c039f74da08523d67d8d5b0a178c1d12507ec88d25891cd1377cd3fb40205c",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/matrix-terminal.raw-input-terminal.send-1.json b/mobile/rpc-foundation/goldens/matrix-terminal.raw-input-terminal.send-1.json
index 2dc9a7dba4bd..5204b12e3a82 100644
--- a/mobile/rpc-foundation/goldens/matrix-terminal.raw-input-terminal.send-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-terminal.raw-input-terminal.send-1.json
@@ -3,10 +3,10 @@
   "family": "terminal.raw-input",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
-  "adapterSha256": "7588d30f33a8bb846c48f160aa9a4a8138176662bb2fb6be7bbdf352f553d05f",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "42e1fe434b591ab5a945b6b366bbb20b567085d58bade63413f2251e8202b255",
   "scenarioSha256": "19d55a77e9c2f64f062070c9985f756e0ba72f3ccc3c884a80843fe888f42a47",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/matrix-terminal.takeover-report-orchestration.workerterminaluserinput-1.json b/mobile/rpc-foundation/goldens/matrix-terminal.takeover-report-orchestration.workerterminaluserinput-1.json
index 501b09d9d7bf..f505e5796bf2 100644
--- a/mobile/rpc-foundation/goldens/matrix-terminal.takeover-report-orchestration.workerterminaluserinput-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-terminal.takeover-report-orchestration.workerterminaluserinput-1.json
@@ -3,10 +3,10 @@
   "family": "terminal.takeover-report",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
-  "adapterSha256": "7588d30f33a8bb846c48f160aa9a4a8138176662bb2fb6be7bbdf352f553d05f",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "42e1fe434b591ab5a945b6b366bbb20b567085d58bade63413f2251e8202b255",
   "scenarioSha256": "6913de3f553b47a7e6663e21b0b93e97df26405c210db876f0b9593bd38936be",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/matrix-terminal.takeover-report-orchestration.workerterminaluserinput-2.json b/mobile/rpc-foundation/goldens/matrix-terminal.takeover-report-orchestration.workerterminaluserinput-2.json
index b7da174f32c4..b9c439efcb8c 100644
--- a/mobile/rpc-foundation/goldens/matrix-terminal.takeover-report-orchestration.workerterminaluserinput-2.json
+++ b/mobile/rpc-foundation/goldens/matrix-terminal.takeover-report-orchestration.workerterminaluserinput-2.json
@@ -3,10 +3,10 @@
   "family": "terminal.takeover-report",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
-  "adapterSha256": "7588d30f33a8bb846c48f160aa9a4a8138176662bb2fb6be7bbdf352f553d05f",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "42e1fe434b591ab5a945b6b366bbb20b567085d58bade63413f2251e8202b255",
   "scenarioSha256": "da13ec556c0f672371a8cd2aabd4dcc68001c0f9aa47015dfa4b5937355c4c2c",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/matrix-terminal.viewport-refit-terminal.updateviewport-1.json b/mobile/rpc-foundation/goldens/matrix-terminal.viewport-refit-terminal.updateviewport-1.json
index 26e15478b569..2a108be84ca1 100644
--- a/mobile/rpc-foundation/goldens/matrix-terminal.viewport-refit-terminal.updateviewport-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-terminal.viewport-refit-terminal.updateviewport-1.json
@@ -3,10 +3,10 @@
   "family": "terminal.viewport-refit",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
-  "adapterSha256": "7588d30f33a8bb846c48f160aa9a4a8138176662bb2fb6be7bbdf352f553d05f",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "42e1fe434b591ab5a945b6b366bbb20b567085d58bade63413f2251e8202b255",
   "scenarioSha256": "bde05ca916393d7f5ccd48686cf13a52fb2dfa599ea874b084c58bd59adb7e7f",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/matrix-transport.capability-probe-status.get-1.json b/mobile/rpc-foundation/goldens/matrix-transport.capability-probe-status.get-1.json
index 55f9ec528894..6db96292ba91 100644
--- a/mobile/rpc-foundation/goldens/matrix-transport.capability-probe-status.get-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-transport.capability-probe-status.get-1.json
@@ -3,9 +3,9 @@
   "family": "transport.capability-probe",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "34b382b13fe75e8ef4002325287c95b3c4db62eeaaf3762af7fbaf6f836c2fa1",
   "scenarioSha256": "874b1a120443ee679e2f4b3974762fd84fc929e93a2117b20bbb0cf373316616",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-transport.host-status-gates-status.get-1.json b/mobile/rpc-foundation/goldens/matrix-transport.host-status-gates-status.get-1.json
index f244af8b9f80..c8b59e0185e7 100644
--- a/mobile/rpc-foundation/goldens/matrix-transport.host-status-gates-status.get-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-transport.host-status-gates-status.get-1.json
@@ -3,9 +3,9 @@
   "family": "transport.host-status-gates",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "34b382b13fe75e8ef4002325287c95b3c4db62eeaaf3762af7fbaf6f836c2fa1",
   "scenarioSha256": "d6be62e5eb2737d75634c053098d06a4bb175c64ff915cec6ead79922492a068",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-transport.pairing-race-direct-status.json b/mobile/rpc-foundation/goldens/matrix-transport.pairing-race-direct-status.json
index 8c4977f8aeab..79cb47a8caa9 100644
--- a/mobile/rpc-foundation/goldens/matrix-transport.pairing-race-direct-status.json
+++ b/mobile/rpc-foundation/goldens/matrix-transport.pairing-race-direct-status.json
@@ -3,9 +3,9 @@
   "family": "transport.pairing-race",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "34b382b13fe75e8ef4002325287c95b3c4db62eeaaf3762af7fbaf6f836c2fa1",
   "scenarioSha256": "1d032c86e7cc12efa3d5044339cb990bd258d830119d0e7b61d1b995b4df29a3",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-transport.pairing-race-relay-status.json b/mobile/rpc-foundation/goldens/matrix-transport.pairing-race-relay-status.json
index f39d62c8cb00..8f82062e0178 100644
--- a/mobile/rpc-foundation/goldens/matrix-transport.pairing-race-relay-status.json
+++ b/mobile/rpc-foundation/goldens/matrix-transport.pairing-race-relay-status.json
@@ -3,9 +3,9 @@
   "family": "transport.pairing-race",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "34b382b13fe75e8ef4002325287c95b3c4db62eeaaf3762af7fbaf6f836c2fa1",
   "scenarioSha256": "048ee6d7848e0e4b8d6463ff9dc4124bfd478114ab87f6b52ff82a1dfd6ebc04",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-worktree.agent-launch-create-agent.launch-1.json b/mobile/rpc-foundation/goldens/matrix-worktree.agent-launch-create-agent.launch-1.json
index 5ea2618400d2..eefc85fe1a2b 100644
--- a/mobile/rpc-foundation/goldens/matrix-worktree.agent-launch-create-agent.launch-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-worktree.agent-launch-create-agent.launch-1.json
@@ -3,9 +3,9 @@
   "family": "worktree.agent-launch-create",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "52a76b7a830b32287bce14abbe1b9d9ac70e71eafe5b4c6801c2eb14a4150125",
   "scenarioSha256": "887b5d16b4bee027edf5e2f1122a79a34b223f6926322a99f6e3de83f40bf6ee",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-worktree.catalog-snapshot-worktree.ps-1.json b/mobile/rpc-foundation/goldens/matrix-worktree.catalog-snapshot-worktree.ps-1.json
index e6bddacee239..ae509cdf5250 100644
--- a/mobile/rpc-foundation/goldens/matrix-worktree.catalog-snapshot-worktree.ps-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-worktree.catalog-snapshot-worktree.ps-1.json
@@ -3,9 +3,9 @@
   "family": "worktree.catalog-snapshot",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "4e942ddfbaa0ba6bfc2993969276987f6528ac53765d125e99a830e261f93a8e",
   "scenarioSha256": "95ca47f382997c412da974e564a46b1ae0c20d6e0f3ca14258d33c8d8b51a160",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-worktree.create-retry-worktree.create-1.json b/mobile/rpc-foundation/goldens/matrix-worktree.create-retry-worktree.create-1.json
index 3f32a0049e94..ffe4a7ef2a87 100644
--- a/mobile/rpc-foundation/goldens/matrix-worktree.create-retry-worktree.create-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-worktree.create-retry-worktree.create-1.json
@@ -3,9 +3,9 @@
   "family": "worktree.create-retry",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "52a76b7a830b32287bce14abbe1b9d9ac70e71eafe5b4c6801c2eb14a4150125",
   "scenarioSha256": "e93a36ef900de27e1a566cdb2389ba4f900a330eadbb476b9bfb1ef05707b352",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-worktree.home-catalog-worktree.ps-1.json b/mobile/rpc-foundation/goldens/matrix-worktree.home-catalog-worktree.ps-1.json
index 0cee6befadbb..61a36e1b3261 100644
--- a/mobile/rpc-foundation/goldens/matrix-worktree.home-catalog-worktree.ps-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-worktree.home-catalog-worktree.ps-1.json
@@ -3,9 +3,9 @@
   "family": "worktree.home-catalog",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "4e942ddfbaa0ba6bfc2993969276987f6528ac53765d125e99a830e261f93a8e",
   "scenarioSha256": "fa0e28a167a5fba6fe7ffebb9f4ad28dd413d601c07116a24a7781d156f54beb",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-worktree.hosted-base-worktree.resolvemrbase-1.json b/mobile/rpc-foundation/goldens/matrix-worktree.hosted-base-worktree.resolvemrbase-1.json
index bae64b3a31ea..23a6359dd93c 100644
--- a/mobile/rpc-foundation/goldens/matrix-worktree.hosted-base-worktree.resolvemrbase-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-worktree.hosted-base-worktree.resolvemrbase-1.json
@@ -3,9 +3,9 @@
   "family": "worktree.hosted-base",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "52a76b7a830b32287bce14abbe1b9d9ac70e71eafe5b4c6801c2eb14a4150125",
   "scenarioSha256": "a84f8a5acfd428eb77b5c02a3de0fa8b780c666db31bbe574ecf76cdf84adeb2",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-worktree.hosted-base-worktree.resolveprbase-1.json b/mobile/rpc-foundation/goldens/matrix-worktree.hosted-base-worktree.resolveprbase-1.json
index e018de3b8784..4bbc628922c0 100644
--- a/mobile/rpc-foundation/goldens/matrix-worktree.hosted-base-worktree.resolveprbase-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-worktree.hosted-base-worktree.resolveprbase-1.json
@@ -3,9 +3,9 @@
   "family": "worktree.hosted-base",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "52a76b7a830b32287bce14abbe1b9d9ac70e71eafe5b4c6801c2eb14a4150125",
   "scenarioSha256": "45783a7cbb44b04dbbd6bfd6735799bb4c75e503f43f1821cf8640d11f7464ad",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-worktree.retired-names-worktree.listretirednames-1.json b/mobile/rpc-foundation/goldens/matrix-worktree.retired-names-worktree.listretirednames-1.json
index 64d78f2c898f..1ea68b390786 100644
--- a/mobile/rpc-foundation/goldens/matrix-worktree.retired-names-worktree.listretirednames-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-worktree.retired-names-worktree.listretirednames-1.json
@@ -3,9 +3,9 @@
   "family": "worktree.retired-names",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "4e942ddfbaa0ba6bfc2993969276987f6528ac53765d125e99a830e261f93a8e",
   "scenarioSha256": "d321d6c17e67ae90f6ceefb775495ff765a86a35423ed33a212e71ec5e9e94aa",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-worktree.review-link-worktree.set-1.json b/mobile/rpc-foundation/goldens/matrix-worktree.review-link-worktree.set-1.json
index d60f9f728203..a388f5c0775e 100644
--- a/mobile/rpc-foundation/goldens/matrix-worktree.review-link-worktree.set-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-worktree.review-link-worktree.set-1.json
@@ -3,9 +3,9 @@
   "family": "worktree.review-link",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5e47c7960b9352753f0751d4ccf5e3ff7fb7b74a63cc4e4df3c3ffdcc6c1e66b",
   "scenarioSha256": "2fc093ec505bfac04a4ff0adab991baeba985253486dbe9e3ec9884b8d5f0920",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-worktree.runtime-capabilities-status.get-1.json b/mobile/rpc-foundation/goldens/matrix-worktree.runtime-capabilities-status.get-1.json
index 26761df7f21a..d26247dff58d 100644
--- a/mobile/rpc-foundation/goldens/matrix-worktree.runtime-capabilities-status.get-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-worktree.runtime-capabilities-status.get-1.json
@@ -3,9 +3,9 @@
   "family": "worktree.runtime-capabilities",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "52a76b7a830b32287bce14abbe1b9d9ac70e71eafe5b4c6801c2eb14a4150125",
   "scenarioSha256": "f70c6b1753377b5a502bf7d1e69dc95617f24c42137471320eb393567efbe735",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/matrix-worktree.setup-hook-trust-ui.set-1.json b/mobile/rpc-foundation/goldens/matrix-worktree.setup-hook-trust-ui.set-1.json
index b8aa18922815..2596e9690722 100644
--- a/mobile/rpc-foundation/goldens/matrix-worktree.setup-hook-trust-ui.set-1.json
+++ b/mobile/rpc-foundation/goldens/matrix-worktree.setup-hook-trust-ui.set-1.json
@@ -3,9 +3,9 @@
   "family": "worktree.setup-hook-trust",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "52a76b7a830b32287bce14abbe1b9d9ac70e71eafe5b4c6801c2eb14a4150125",
   "scenarioSha256": "8487fd14ed779708415b264e2b80b26b0d5094e379a04f4f32c2cd75ec469182",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/mobile-web-bundle-build-changed.json b/mobile/rpc-foundation/goldens/mobile-web-bundle-build-changed.json
index 69c4bbeb59b2..04df881a60ab 100644
--- a/mobile/rpc-foundation/goldens/mobile-web-bundle-build-changed.json
+++ b/mobile/rpc-foundation/goldens/mobile-web-bundle-build-changed.json
@@ -3,9 +3,9 @@
   "family": "mobileWeb.bundle-fetch",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "af339fef2c684d5709c6d3f279e5f0d9c33d17b6d4e5c89e501963400901b564",
   "scenarioSha256": "9bab59797b04304d8e25573664b011949e9b15010270ccbfd0e3d2a4d772180c",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/mobile-web-bundle-fetch-paged.json b/mobile/rpc-foundation/goldens/mobile-web-bundle-fetch-paged.json
index 5d340f8a2a5b..d194ccbaf4d2 100644
--- a/mobile/rpc-foundation/goldens/mobile-web-bundle-fetch-paged.json
+++ b/mobile/rpc-foundation/goldens/mobile-web-bundle-fetch-paged.json
@@ -3,9 +3,9 @@
   "family": "mobileWeb.bundle-fetch",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "af339fef2c684d5709c6d3f279e5f0d9c33d17b6d4e5c89e501963400901b564",
   "scenarioSha256": "e3044fe513a5fc1fb10c5c00422d965dd760eeea37cfcebc79b4597141f4baa1",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/mobile-web-bundle-manifest-read.json b/mobile/rpc-foundation/goldens/mobile-web-bundle-manifest-read.json
index 4d1da7ef0e38..71c57191f47e 100644
--- a/mobile/rpc-foundation/goldens/mobile-web-bundle-manifest-read.json
+++ b/mobile/rpc-foundation/goldens/mobile-web-bundle-manifest-read.json
@@ -3,9 +3,9 @@
   "family": "mobileWeb.bundle-manifest",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "af339fef2c684d5709c6d3f279e5f0d9c33d17b6d4e5c89e501963400901b564",
   "scenarioSha256": "5e9f4e6878be3f534288a90f7ccabc9cfe4e968aa29da372a98c3064d8e4d89e",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/mobile-web-bundle-unavailable.json b/mobile/rpc-foundation/goldens/mobile-web-bundle-unavailable.json
index 68da2307c37b..9467539ba39a 100644
--- a/mobile/rpc-foundation/goldens/mobile-web-bundle-unavailable.json
+++ b/mobile/rpc-foundation/goldens/mobile-web-bundle-unavailable.json
@@ -3,9 +3,9 @@
   "family": "mobileWeb.bundle-fetch",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "af339fef2c684d5709c6d3f279e5f0d9c33d17b6d4e5c89e501963400901b564",
   "scenarioSha256": "7333b1c83120bcfd9bdac8888ec1528c1db9b36325509f1328a551676df219c5",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/native-chat-image-paste-single.json b/mobile/rpc-foundation/goldens/native-chat-image-paste-single.json
index 1d60b52f0224..c600880dba7f 100644
--- a/mobile/rpc-foundation/goldens/native-chat-image-paste-single.json
+++ b/mobile/rpc-foundation/goldens/native-chat-image-paste-single.json
@@ -3,9 +3,9 @@
   "family": "nativeChat.image-paste",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "16779b663f4faec8cbccdb42efd7b568a2912845b161f8a4827754687eb4235c",
   "scenarioSha256": "8e88e44d077ce8f3f3e3214b80e9e8b1e770b9a73025bc284a8333d6a8be07f9",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/native-chat-image-paste-stops-on-rejection.json b/mobile/rpc-foundation/goldens/native-chat-image-paste-stops-on-rejection.json
index 6f722e2c3186..77c453270f5f 100644
--- a/mobile/rpc-foundation/goldens/native-chat-image-paste-stops-on-rejection.json
+++ b/mobile/rpc-foundation/goldens/native-chat-image-paste-stops-on-rejection.json
@@ -3,9 +3,9 @@
   "family": "nativeChat.image-paste",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "16779b663f4faec8cbccdb42efd7b568a2912845b161f8a4827754687eb4235c",
   "scenarioSha256": "1e2c7d2c238bb87a0fd1896a0151a6cecd670c9b1b2679ca47b39520355c6e05",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/native-chat-image-paste-trailing-image.json b/mobile/rpc-foundation/goldens/native-chat-image-paste-trailing-image.json
index 5fcf7cc218c5..e2e1c2d81f90 100644
--- a/mobile/rpc-foundation/goldens/native-chat-image-paste-trailing-image.json
+++ b/mobile/rpc-foundation/goldens/native-chat-image-paste-trailing-image.json
@@ -3,9 +3,9 @@
   "family": "nativeChat.image-paste",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "16779b663f4faec8cbccdb42efd7b568a2912845b161f8a4827754687eb4235c",
   "scenarioSha256": "43575aede8307947e027239b4e582df281f6424c9216135ae20d150234f247f6",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/native-chat-image-paste-two-images.json b/mobile/rpc-foundation/goldens/native-chat-image-paste-two-images.json
index 8f9ce577c283..fa156646e3e4 100644
--- a/mobile/rpc-foundation/goldens/native-chat-image-paste-two-images.json
+++ b/mobile/rpc-foundation/goldens/native-chat-image-paste-two-images.json
@@ -3,9 +3,9 @@
   "family": "nativeChat.image-paste",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "16779b663f4faec8cbccdb42efd7b568a2912845b161f8a4827754687eb4235c",
   "scenarioSha256": "4ff80434eea90f31c03522c9277983cc1c88d0292ba7c384fa9760fc1dcb03bf",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/native-chat-image-upload-cancelled.json b/mobile/rpc-foundation/goldens/native-chat-image-upload-cancelled.json
index b4914c611496..2603c1af994e 100644
--- a/mobile/rpc-foundation/goldens/native-chat-image-upload-cancelled.json
+++ b/mobile/rpc-foundation/goldens/native-chat-image-upload-cancelled.json
@@ -3,9 +3,9 @@
   "family": "nativeChat.image-upload",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "16779b663f4faec8cbccdb42efd7b568a2912845b161f8a4827754687eb4235c",
   "scenarioSha256": "1f513883eb62cdd1673eb58809817e2b2f5fd64b74f80ed6e3b9d8c2ef2d33e9",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/native-chat-image-upload-second-fails.json b/mobile/rpc-foundation/goldens/native-chat-image-upload-second-fails.json
index 7aaca6938622..d3022a44345e 100644
--- a/mobile/rpc-foundation/goldens/native-chat-image-upload-second-fails.json
+++ b/mobile/rpc-foundation/goldens/native-chat-image-upload-second-fails.json
@@ -3,9 +3,9 @@
   "family": "nativeChat.image-upload",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "16779b663f4faec8cbccdb42efd7b568a2912845b161f8a4827754687eb4235c",
   "scenarioSha256": "181b02243b1ecf98364473ee0b3f4c82a6037b5f5bae33703ab4f611cc050db4",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/native-chat-image-upload-single.json b/mobile/rpc-foundation/goldens/native-chat-image-upload-single.json
index eee6721a769b..6efedc9f7f91 100644
--- a/mobile/rpc-foundation/goldens/native-chat-image-upload-single.json
+++ b/mobile/rpc-foundation/goldens/native-chat-image-upload-single.json
@@ -3,9 +3,9 @@
   "family": "nativeChat.image-upload",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "16779b663f4faec8cbccdb42efd7b568a2912845b161f8a4827754687eb4235c",
   "scenarioSha256": "d7dca3742c4086f9ced0ba4b2f6c32ee9fa9272a5a955e8623fdc9cdb4c71528",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/native-chat-image-upload-start-refused.json b/mobile/rpc-foundation/goldens/native-chat-image-upload-start-refused.json
index aa5478d0006d..eec517f79f42 100644
--- a/mobile/rpc-foundation/goldens/native-chat-image-upload-start-refused.json
+++ b/mobile/rpc-foundation/goldens/native-chat-image-upload-start-refused.json
@@ -3,9 +3,9 @@
   "family": "nativeChat.image-upload",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "16779b663f4faec8cbccdb42efd7b568a2912845b161f8a4827754687eb4235c",
   "scenarioSha256": "09fd9bf97a4da7313e24f8c333b66c7c1af927bbea0a6d9fef9803856a608c78",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/native-chat-image-upload-two.json b/mobile/rpc-foundation/goldens/native-chat-image-upload-two.json
index 7d1b36fbe43b..ee8acc72bf0f 100644
--- a/mobile/rpc-foundation/goldens/native-chat-image-upload-two.json
+++ b/mobile/rpc-foundation/goldens/native-chat-image-upload-two.json
@@ -3,9 +3,9 @@
   "family": "nativeChat.image-upload",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "16779b663f4faec8cbccdb42efd7b568a2912845b161f8a4827754687eb4235c",
   "scenarioSha256": "db0397f8f6ae28de0cc7afd91552ee9416d7f7054a76a42aac02f480c6f363d5",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/native-chat-page-earlier.json b/mobile/rpc-foundation/goldens/native-chat-page-earlier.json
index 969ff83d8fdc..4622a00d4524 100644
--- a/mobile/rpc-foundation/goldens/native-chat-page-earlier.json
+++ b/mobile/rpc-foundation/goldens/native-chat-page-earlier.json
@@ -3,9 +3,9 @@
   "family": "session.native-chat-page",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "60ce67f66134d6385aa7fb47f2135436a7b3ce0221e3b2514bea65e06dba5518",
   "scenarioSha256": "674cab85ed9896dae311bfc0acfb1d1d1a2a7f25b7546b4714edbb0a585e6178",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/native-chat-readability-local-repo.json b/mobile/rpc-foundation/goldens/native-chat-readability-local-repo.json
index 71c4a461a9b0..5d7e2a8b35e4 100644
--- a/mobile/rpc-foundation/goldens/native-chat-readability-local-repo.json
+++ b/mobile/rpc-foundation/goldens/native-chat-readability-local-repo.json
@@ -3,9 +3,9 @@
   "family": "session.native-chat-readability",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a3daf9a05d05424959baf77feb45cb0c076d77d8c49e877941ed612cc1e5ce95",
   "scenarioSha256": "46d80cfd496b06ce42ff1ed985e513bbf49b5188bc1128c6d01a74675741935a",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/native-chat-readability-refused.json b/mobile/rpc-foundation/goldens/native-chat-readability-refused.json
index 7a44b4715d61..c95d2e51fda1 100644
--- a/mobile/rpc-foundation/goldens/native-chat-readability-refused.json
+++ b/mobile/rpc-foundation/goldens/native-chat-readability-refused.json
@@ -3,9 +3,9 @@
   "family": "session.native-chat-readability",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a3daf9a05d05424959baf77feb45cb0c076d77d8c49e877941ed612cc1e5ce95",
   "scenarioSha256": "08a9ab4f180f2d6bb44d2a23f87be0443e8dfdde15f966458270a1bb6f131e0b",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/native-chat-readability-remote-repo.json b/mobile/rpc-foundation/goldens/native-chat-readability-remote-repo.json
index a0b760ff9c07..9082a47d7320 100644
--- a/mobile/rpc-foundation/goldens/native-chat-readability-remote-repo.json
+++ b/mobile/rpc-foundation/goldens/native-chat-readability-remote-repo.json
@@ -3,9 +3,9 @@
   "family": "session.native-chat-readability",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a3daf9a05d05424959baf77feb45cb0c076d77d8c49e877941ed612cc1e5ce95",
   "scenarioSha256": "0c6afb12dce2c402dfd7ac24eb4a306e09fcacc78415ecb47b5320b2fe8102b5",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/native-chat-session-option-pick-empty.json b/mobile/rpc-foundation/goldens/native-chat-session-option-pick-empty.json
index e1ffeeb993aa..2485293b4a1a 100644
--- a/mobile/rpc-foundation/goldens/native-chat-session-option-pick-empty.json
+++ b/mobile/rpc-foundation/goldens/native-chat-session-option-pick-empty.json
@@ -3,9 +3,9 @@
   "family": "nativeChat.session-option-pick",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b98a3ca3818678b88cf629bc4635300a103637126a136f025a1600dc16f08008",
   "scenarioSha256": "55f675f7d3f380db10dd966ae6d011927dbc7eb8f3abd36e09edf5043ad1131c",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/native-chat-session-option-pick-refused.json b/mobile/rpc-foundation/goldens/native-chat-session-option-pick-refused.json
index 1d0c59bcad9f..5aa52c6bd244 100644
--- a/mobile/rpc-foundation/goldens/native-chat-session-option-pick-refused.json
+++ b/mobile/rpc-foundation/goldens/native-chat-session-option-pick-refused.json
@@ -3,9 +3,9 @@
   "family": "nativeChat.session-option-pick",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b98a3ca3818678b88cf629bc4635300a103637126a136f025a1600dc16f08008",
   "scenarioSha256": "57b60064eca4526e5d533de5862e7e86ba69b6722cd04692228bdc768486cd76",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/native-chat-session-option-pick-written.json b/mobile/rpc-foundation/goldens/native-chat-session-option-pick-written.json
index ccbe9516f4ad..cebae58375e4 100644
--- a/mobile/rpc-foundation/goldens/native-chat-session-option-pick-written.json
+++ b/mobile/rpc-foundation/goldens/native-chat-session-option-pick-written.json
@@ -3,9 +3,9 @@
   "family": "nativeChat.session-option-pick",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b98a3ca3818678b88cf629bc4635300a103637126a136f025a1600dc16f08008",
   "scenarioSha256": "a180b7ae1f84bc69d7819c7c17b1e2915cb380e8ea8543d68fe6777feb90d0bd",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/native-chat-stop-accepted.json b/mobile/rpc-foundation/goldens/native-chat-stop-accepted.json
index f1855e504df4..aaadf20e0742 100644
--- a/mobile/rpc-foundation/goldens/native-chat-stop-accepted.json
+++ b/mobile/rpc-foundation/goldens/native-chat-stop-accepted.json
@@ -3,9 +3,9 @@
   "family": "session.native-chat-stop",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a3daf9a05d05424959baf77feb45cb0c076d77d8c49e877941ed612cc1e5ce95",
   "scenarioSha256": "a72f08c12c244912912be34deb3ec12bada6b74f1bc29c0034b347dcba9ddb10",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/native-chat-stop-both-rejected.json b/mobile/rpc-foundation/goldens/native-chat-stop-both-rejected.json
index f4b366189190..dfed38ee14f7 100644
--- a/mobile/rpc-foundation/goldens/native-chat-stop-both-rejected.json
+++ b/mobile/rpc-foundation/goldens/native-chat-stop-both-rejected.json
@@ -3,9 +3,9 @@
   "family": "session.native-chat-stop",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a3daf9a05d05424959baf77feb45cb0c076d77d8c49e877941ed612cc1e5ce95",
   "scenarioSha256": "a7419d4b3e00d49ebdac7db4fa97ad9d3af9516201f9102beed0376b181e74a5",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/native-chat-stop-delivery-unknown.json b/mobile/rpc-foundation/goldens/native-chat-stop-delivery-unknown.json
index 66479ff78fe6..2c966e243ce0 100644
--- a/mobile/rpc-foundation/goldens/native-chat-stop-delivery-unknown.json
+++ b/mobile/rpc-foundation/goldens/native-chat-stop-delivery-unknown.json
@@ -3,9 +3,9 @@
   "family": "session.native-chat-stop",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a3daf9a05d05424959baf77feb45cb0c076d77d8c49e877941ed612cc1e5ce95",
   "scenarioSha256": "977ee5602e3a612d537686d17d15312f8b0e775df8800b27bb0d42b8642b4675",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/native-chat-write-accepted.json b/mobile/rpc-foundation/goldens/native-chat-write-accepted.json
index 4814f0e3d4be..8e934e9492b9 100644
--- a/mobile/rpc-foundation/goldens/native-chat-write-accepted.json
+++ b/mobile/rpc-foundation/goldens/native-chat-write-accepted.json
@@ -3,9 +3,9 @@
   "family": "nativeChat.terminal-write",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b98a3ca3818678b88cf629bc4635300a103637126a136f025a1600dc16f08008",
   "scenarioSha256": "3e8804f21d32370bb0bc48c4ea3d182748d48dc19d73de1b50005f18368566ba",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/native-chat-write-clear-line.json b/mobile/rpc-foundation/goldens/native-chat-write-clear-line.json
index 17ee41e2c1cd..55168585b18a 100644
--- a/mobile/rpc-foundation/goldens/native-chat-write-clear-line.json
+++ b/mobile/rpc-foundation/goldens/native-chat-write-clear-line.json
@@ -3,9 +3,9 @@
   "family": "nativeChat.terminal-write",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b98a3ca3818678b88cf629bc4635300a103637126a136f025a1600dc16f08008",
   "scenarioSha256": "b8265928eefc167de59c64dc62ebe40635007a5f73c87ec8b6eb5e0f6dc0ce00",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/native-chat-write-delivery-unknown.json b/mobile/rpc-foundation/goldens/native-chat-write-delivery-unknown.json
index 9f772f5943cb..5544bb4877bf 100644
--- a/mobile/rpc-foundation/goldens/native-chat-write-delivery-unknown.json
+++ b/mobile/rpc-foundation/goldens/native-chat-write-delivery-unknown.json
@@ -3,9 +3,9 @@
   "family": "nativeChat.terminal-write",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b98a3ca3818678b88cf629bc4635300a103637126a136f025a1600dc16f08008",
   "scenarioSha256": "22f7711ed82a4d56f1886a746838e3eb85c555c9069694ba3aa958e121cc1ee9",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/native-chat-write-rejected.json b/mobile/rpc-foundation/goldens/native-chat-write-rejected.json
index 1a176ad2fa73..90d3789a3710 100644
--- a/mobile/rpc-foundation/goldens/native-chat-write-rejected.json
+++ b/mobile/rpc-foundation/goldens/native-chat-write-rejected.json
@@ -3,9 +3,9 @@
   "family": "nativeChat.terminal-write",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b98a3ca3818678b88cf629bc4635300a103637126a136f025a1600dc16f08008",
   "scenarioSha256": "7e05773966a18123aaae297aed9ac44bd841713de88c8a1fa30c31b324118f6f",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/native-chat-write-typed-command.json b/mobile/rpc-foundation/goldens/native-chat-write-typed-command.json
index 5f5b11414173..5d9bcbd1c1d6 100644
--- a/mobile/rpc-foundation/goldens/native-chat-write-typed-command.json
+++ b/mobile/rpc-foundation/goldens/native-chat-write-typed-command.json
@@ -3,9 +3,9 @@
   "family": "nativeChat.terminal-write",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b98a3ca3818678b88cf629bc4635300a103637126a136f025a1600dc16f08008",
   "scenarioSha256": "a89ff803859c60e5645126de8b0f423807c435dcd856fe8825721f71f3b5bec5",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/new-tab-local-agents.json b/mobile/rpc-foundation/goldens/new-tab-local-agents.json
index 6c9ee1faa0fd..27e7b91e5cad 100644
--- a/mobile/rpc-foundation/goldens/new-tab-local-agents.json
+++ b/mobile/rpc-foundation/goldens/new-tab-local-agents.json
@@ -3,9 +3,9 @@
   "family": "settings.new-tab-local-agents",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "448cdbd12f4f6a14bb33947bfbbb1837aebeb28979db70c62f2ba2fbb4d89c8f",
   "scenarioSha256": "ef016c6b4b77ba0c40b6feba2f670398c641f8ce9f411896e3ae41f38d8be17d",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/new-workspace-repositories-fulfilled.json b/mobile/rpc-foundation/goldens/new-workspace-repositories-fulfilled.json
index 40aaf1a7bc36..d77510ab2b16 100644
--- a/mobile/rpc-foundation/goldens/new-workspace-repositories-fulfilled.json
+++ b/mobile/rpc-foundation/goldens/new-workspace-repositories-fulfilled.json
@@ -3,9 +3,9 @@
   "family": "components.new-workspace-repositories",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "64c1772f0f95a3c43fbb14398a8804b2b4784f7f18874e4fd79767ae634c7faa",
   "scenarioSha256": "41ac47445191a24de5e48877478bdab6fd9c030f48024ea43e053de7b6b68bb5",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/notifications-desktop-stream-closed.json b/mobile/rpc-foundation/goldens/notifications-desktop-stream-closed.json
index da64762c8d52..893a8ccbc6f8 100644
--- a/mobile/rpc-foundation/goldens/notifications-desktop-stream-closed.json
+++ b/mobile/rpc-foundation/goldens/notifications-desktop-stream-closed.json
@@ -3,9 +3,9 @@
   "family": "notifications.desktop-stream",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "eacf859143588ae6bee2804975d642b6c1088d57ae77ffe298620250d9a9f0e4",
   "scenarioSha256": "24f8c05639f82bc5e32abe3864c3d01a0589e295369028929fed2f0c684f1d0c",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/notifications-desktop-stream-replayed.json b/mobile/rpc-foundation/goldens/notifications-desktop-stream-replayed.json
index f64542e54bc7..3adabb6ea405 100644
--- a/mobile/rpc-foundation/goldens/notifications-desktop-stream-replayed.json
+++ b/mobile/rpc-foundation/goldens/notifications-desktop-stream-replayed.json
@@ -3,9 +3,9 @@
   "family": "notifications.desktop-stream",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "eacf859143588ae6bee2804975d642b6c1088d57ae77ffe298620250d9a9f0e4",
   "scenarioSha256": "0495c25d6e5d8a84fe4192d7aa0e2901fe86ede19ac9c4d72dee27da6694878b",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/notifications-desktop-stream.json b/mobile/rpc-foundation/goldens/notifications-desktop-stream.json
index 1a9e88d20f61..2095440edb6c 100644
--- a/mobile/rpc-foundation/goldens/notifications-desktop-stream.json
+++ b/mobile/rpc-foundation/goldens/notifications-desktop-stream.json
@@ -3,9 +3,9 @@
   "family": "notifications.desktop-stream",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "eacf859143588ae6bee2804975d642b6c1088d57ae77ffe298620250d9a9f0e4",
   "scenarioSha256": "359add5203e68fcb85586f06babb694ee9d548e1dc58481e6d03871ab9f922cb",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/notifications-display-test-accepted.json b/mobile/rpc-foundation/goldens/notifications-display-test-accepted.json
index 9c943e3a70bc..40d0e5a55b66 100644
--- a/mobile/rpc-foundation/goldens/notifications-display-test-accepted.json
+++ b/mobile/rpc-foundation/goldens/notifications-display-test-accepted.json
@@ -3,9 +3,9 @@
   "family": "notifications.display-test-screen",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "f55275c268e49679b37d72ce6cbe71186ce02c77fe3fd53f0f21e796502d62e8",
   "scenarioSha256": "e19c4ff95d568edbb5c0d6058eb17843be31bdfd528825985963f8ece8cbc652",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/notifications-display-test-not-registered.json b/mobile/rpc-foundation/goldens/notifications-display-test-not-registered.json
index 2cdc76ede298..623c63fc50a2 100644
--- a/mobile/rpc-foundation/goldens/notifications-display-test-not-registered.json
+++ b/mobile/rpc-foundation/goldens/notifications-display-test-not-registered.json
@@ -3,9 +3,9 @@
   "family": "notifications.display-test-screen",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "f55275c268e49679b37d72ce6cbe71186ce02c77fe3fd53f0f21e796502d62e8",
   "scenarioSha256": "3edeb5f744ed832104df750544b99fea1a1cd9d1b8d2f3f9a5e7c13b415edc3e",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/notifications-display-test-rate-limited.json b/mobile/rpc-foundation/goldens/notifications-display-test-rate-limited.json
index 2b4cf8bf85ea..fe0f81c73c92 100644
--- a/mobile/rpc-foundation/goldens/notifications-display-test-rate-limited.json
+++ b/mobile/rpc-foundation/goldens/notifications-display-test-rate-limited.json
@@ -3,9 +3,9 @@
   "family": "notifications.display-test-screen",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "f55275c268e49679b37d72ce6cbe71186ce02c77fe3fd53f0f21e796502d62e8",
   "scenarioSha256": "53827d812956f05e86d72e44effd017270328eb36588ca90431cf9a8ae97b146",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/notifications-display-test-unknown-reason.json b/mobile/rpc-foundation/goldens/notifications-display-test-unknown-reason.json
index c402372c5aa6..1efb5baabdcb 100644
--- a/mobile/rpc-foundation/goldens/notifications-display-test-unknown-reason.json
+++ b/mobile/rpc-foundation/goldens/notifications-display-test-unknown-reason.json
@@ -3,9 +3,9 @@
   "family": "notifications.display-test-screen",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "f55275c268e49679b37d72ce6cbe71186ce02c77fe3fd53f0f21e796502d62e8",
   "scenarioSha256": "37439be5aba4a84cf6c12c5f583a0334405792387edb72ceab388e7c64109eff",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/notifications-push-gateway-rejected.json b/mobile/rpc-foundation/goldens/notifications-push-gateway-rejected.json
index 7c56b965997c..8ff714c172e2 100644
--- a/mobile/rpc-foundation/goldens/notifications-push-gateway-rejected.json
+++ b/mobile/rpc-foundation/goldens/notifications-push-gateway-rejected.json
@@ -3,9 +3,9 @@
   "family": "notifications.push-registration",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "2e3d939dc162dbc5a38d8a7207111688204a825fd70348721917b3016e1c9470",
   "scenarioSha256": "ac2b214ece34dc25aef2b73d020e04343f81cd48b3d243508be92cfdba01eb45",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/notifications-push-registered.json b/mobile/rpc-foundation/goldens/notifications-push-registered.json
index 75fba0a646fc..e355038f68e3 100644
--- a/mobile/rpc-foundation/goldens/notifications-push-registered.json
+++ b/mobile/rpc-foundation/goldens/notifications-push-registered.json
@@ -3,9 +3,9 @@
   "family": "notifications.push-registration",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "2e3d939dc162dbc5a38d8a7207111688204a825fd70348721917b3016e1c9470",
   "scenarioSha256": "90f49e430518bfc6e662da1d0c55b0084f30ab54dabdd15293b1f8ad9d2fa592",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/pairing-pre-profile-direct-wins-and-provisions.json b/mobile/rpc-foundation/goldens/pairing-pre-profile-direct-wins-and-provisions.json
index 8933cc65fbe2..d2fa56dad74c 100644
--- a/mobile/rpc-foundation/goldens/pairing-pre-profile-direct-wins-and-provisions.json
+++ b/mobile/rpc-foundation/goldens/pairing-pre-profile-direct-wins-and-provisions.json
@@ -3,10 +3,10 @@
   "family": "pairing.pre-profile",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
-  "adapterSha256": "e33d584229530c716ecdc44d198b95fcfb4dfd9468fba7d5222ee3f122950197",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "57c8ad93d162ea69e4a0ecd5de7d8fae6806f8f7a51945c2c13661d81bae6497",
   "scenarioSha256": "e4fb7aa3b071c1207f206adcc0f31e92b6bb98a80f86a0772e48b5cebcab24ff",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/pairing-pre-profile-provision-unsupported-saves-direct-host.json b/mobile/rpc-foundation/goldens/pairing-pre-profile-provision-unsupported-saves-direct-host.json
index db89c034e0d8..49dabc4919c2 100644
--- a/mobile/rpc-foundation/goldens/pairing-pre-profile-provision-unsupported-saves-direct-host.json
+++ b/mobile/rpc-foundation/goldens/pairing-pre-profile-provision-unsupported-saves-direct-host.json
@@ -3,10 +3,10 @@
   "family": "pairing.pre-profile",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
-  "adapterSha256": "e33d584229530c716ecdc44d198b95fcfb4dfd9468fba7d5222ee3f122950197",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "57c8ad93d162ea69e4a0ecd5de7d8fae6806f8f7a51945c2c13661d81bae6497",
   "scenarioSha256": "5696ea2a62bb3f24902305f8bac0c4ae8f1e505f359db76fd69aabe353adae86",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/pairing-pre-profile-times-out.json b/mobile/rpc-foundation/goldens/pairing-pre-profile-times-out.json
index 73c1f4ca8c8e..5d4f2a3b7e14 100644
--- a/mobile/rpc-foundation/goldens/pairing-pre-profile-times-out.json
+++ b/mobile/rpc-foundation/goldens/pairing-pre-profile-times-out.json
@@ -3,10 +3,10 @@
   "family": "pairing.pre-profile",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
-  "adapterSha256": "e33d584229530c716ecdc44d198b95fcfb4dfd9468fba7d5222ee3f122950197",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "57c8ad93d162ea69e4a0ecd5de7d8fae6806f8f7a51945c2c13661d81bae6497",
   "scenarioSha256": "9ab72231bf97fbe7eed232019c56568a9411433835eae424628af62c7c6a10c1",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/pr-branch-identity.json b/mobile/rpc-foundation/goldens/pr-branch-identity.json
index 5f93e074480a..f66cf79630a8 100644
--- a/mobile/rpc-foundation/goldens/pr-branch-identity.json
+++ b/mobile/rpc-foundation/goldens/pr-branch-identity.json
@@ -3,9 +3,9 @@
   "family": "session.pr-branch-context",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "f560ff1582487c118756c527faa1fb1f65e37ce22ca9573491fd4b2dbcedf38d",
   "scenarioSha256": "d1b208a7bee947a603949fdc1f0d145e8c5576926f89f3e32330585f3a115290",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/pr-branch-repo-context.json b/mobile/rpc-foundation/goldens/pr-branch-repo-context.json
index 65c65daff9c4..82069390082b 100644
--- a/mobile/rpc-foundation/goldens/pr-branch-repo-context.json
+++ b/mobile/rpc-foundation/goldens/pr-branch-repo-context.json
@@ -3,9 +3,9 @@
   "family": "session.pr-branch-context",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "f560ff1582487c118756c527faa1fb1f65e37ce22ca9573491fd4b2dbcedf38d",
   "scenarioSha256": "bd715681a856254e0c374b504cece07e5df4c9a75fa2b97c35498df12210fbab",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/pr-comment-mutation.json b/mobile/rpc-foundation/goldens/pr-comment-mutation.json
index 2925ec5d3e47..4f4943938a73 100644
--- a/mobile/rpc-foundation/goldens/pr-comment-mutation.json
+++ b/mobile/rpc-foundation/goldens/pr-comment-mutation.json
@@ -3,9 +3,9 @@
   "family": "github.pr-comment-mutation",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "f560ff1582487c118756c527faa1fb1f65e37ce22ca9573491fd4b2dbcedf38d",
   "scenarioSha256": "73cc5da2649b9687bb0d8247fa4ecf3c085746cf398515e8d2b40be2ed0da688",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/pr-comment-resolve-unconfirmed.json b/mobile/rpc-foundation/goldens/pr-comment-resolve-unconfirmed.json
index f4fb77dfdd2c..2be5190aebbc 100644
--- a/mobile/rpc-foundation/goldens/pr-comment-resolve-unconfirmed.json
+++ b/mobile/rpc-foundation/goldens/pr-comment-resolve-unconfirmed.json
@@ -3,9 +3,9 @@
   "family": "github.pr-comment-mutation",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "f560ff1582487c118756c527faa1fb1f65e37ce22ca9573491fd4b2dbcedf38d",
   "scenarioSha256": "f425131d29fee8826c00a550fb537d0bd1a37bbaf3b33992984d5e04a990a512",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/pr-mutation-in-band-failure.json b/mobile/rpc-foundation/goldens/pr-mutation-in-band-failure.json
index 696ad71ea2d8..feafcb833d37 100644
--- a/mobile/rpc-foundation/goldens/pr-mutation-in-band-failure.json
+++ b/mobile/rpc-foundation/goldens/pr-mutation-in-band-failure.json
@@ -3,9 +3,9 @@
   "family": "github.pr-mutation",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "f560ff1582487c118756c527faa1fb1f65e37ce22ca9573491fd4b2dbcedf38d",
   "scenarioSha256": "70a94f45dbf7d58d9024c1cc4c94edd98fa48cd5ccffe8f2b7c53fa3e55d18d3",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/pr-mutation-status.json b/mobile/rpc-foundation/goldens/pr-mutation-status.json
index 81f712c865f2..2a139a74c951 100644
--- a/mobile/rpc-foundation/goldens/pr-mutation-status.json
+++ b/mobile/rpc-foundation/goldens/pr-mutation-status.json
@@ -3,9 +3,9 @@
   "family": "github.pr-mutation",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "f560ff1582487c118756c527faa1fb1f65e37ce22ca9573491fd4b2dbcedf38d",
   "scenarioSha256": "e9291209234bacab12201f4c13bb592e06bd405215389e19f0754c23e79eb197",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/pr-read-fork-routing.json b/mobile/rpc-foundation/goldens/pr-read-fork-routing.json
index 8a6dcedddc56..c715b9fcc2ca 100644
--- a/mobile/rpc-foundation/goldens/pr-read-fork-routing.json
+++ b/mobile/rpc-foundation/goldens/pr-read-fork-routing.json
@@ -3,9 +3,9 @@
   "family": "github.pr-read",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "f560ff1582487c118756c527faa1fb1f65e37ce22ca9573491fd4b2dbcedf38d",
   "scenarioSha256": "ba21f7fc3966cb1e3c1e59d6e8a8b184fa0559bf3037365391ce23e364befd7f",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/pr-read-surface.json b/mobile/rpc-foundation/goldens/pr-read-surface.json
index 35f24e04b630..68f5d6391b44 100644
--- a/mobile/rpc-foundation/goldens/pr-read-surface.json
+++ b/mobile/rpc-foundation/goldens/pr-read-surface.json
@@ -3,9 +3,9 @@
   "family": "github.pr-read",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "f560ff1582487c118756c527faa1fb1f65e37ce22ca9573491fd4b2dbcedf38d",
   "scenarioSha256": "4246e7ffa62e85aac489c561171a6468f862b7f18eefac9926b65073616b6d35",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/pr-read-upstream-error.json b/mobile/rpc-foundation/goldens/pr-read-upstream-error.json
index 128dbebe3a3b..81fc076d446d 100644
--- a/mobile/rpc-foundation/goldens/pr-read-upstream-error.json
+++ b/mobile/rpc-foundation/goldens/pr-read-upstream-error.json
@@ -3,9 +3,9 @@
   "family": "github.pr-read",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "f560ff1582487c118756c527faa1fb1f65e37ce22ca9573491fd4b2dbcedf38d",
   "scenarioSha256": "b2445b299e18664b698d659c5041860b8a253314687666ae467aab441ab07235",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/pr-sidebar-checks-refused.json b/mobile/rpc-foundation/goldens/pr-sidebar-checks-refused.json
index 0215c70d9970..cc88806225f2 100644
--- a/mobile/rpc-foundation/goldens/pr-sidebar-checks-refused.json
+++ b/mobile/rpc-foundation/goldens/pr-sidebar-checks-refused.json
@@ -3,9 +3,9 @@
   "family": "session.pr-sidebar",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "87ffa2daea415d2682f1112025b5bd9d52404c6fc7c239180a3ad2120678ff1f",
   "scenarioSha256": "1b489d319f6517fe2ee33beaeedf4e0cb0f531c952dc7e9f833ca814366d60cb",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/pr-sidebar-load.json b/mobile/rpc-foundation/goldens/pr-sidebar-load.json
index b81c1fc3b9a6..6164f9f3891c 100644
--- a/mobile/rpc-foundation/goldens/pr-sidebar-load.json
+++ b/mobile/rpc-foundation/goldens/pr-sidebar-load.json
@@ -3,9 +3,9 @@
   "family": "session.pr-sidebar",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "87ffa2daea415d2682f1112025b5bd9d52404c6fc7c239180a3ad2120678ff1f",
   "scenarioSha256": "d4da89a37325ac4e92d9eae8de33f9cc6d9414fcf89a4f44064a7b1e4254102a",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/pr-title-mutation.json b/mobile/rpc-foundation/goldens/pr-title-mutation.json
index c6d08140fe7b..7ea0aadadca7 100644
--- a/mobile/rpc-foundation/goldens/pr-title-mutation.json
+++ b/mobile/rpc-foundation/goldens/pr-title-mutation.json
@@ -3,9 +3,9 @@
   "family": "github.pr-title-mutation",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "f560ff1582487c118756c527faa1fb1f65e37ce22ca9573491fd4b2dbcedf38d",
   "scenarioSha256": "071e745453795d18d683aaab63e810783e3cee4927b47425c20a3d915397d0dd",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/pr-title-unconfirmed.json b/mobile/rpc-foundation/goldens/pr-title-unconfirmed.json
index 448a0dbfb992..9c1f08180fd4 100644
--- a/mobile/rpc-foundation/goldens/pr-title-unconfirmed.json
+++ b/mobile/rpc-foundation/goldens/pr-title-unconfirmed.json
@@ -3,9 +3,9 @@
   "family": "github.pr-title-mutation",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "f560ff1582487c118756c527faa1fb1f65e37ce22ca9573491fd4b2dbcedf38d",
   "scenarioSha256": "669260c675021b37252dc5023a7a78e4e90536c2f35d9a5da3e53778e6a0cf52",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/pr-triage-invalid-terminal.json b/mobile/rpc-foundation/goldens/pr-triage-invalid-terminal.json
index 1c7fc3657790..c8553aded664 100644
--- a/mobile/rpc-foundation/goldens/pr-triage-invalid-terminal.json
+++ b/mobile/rpc-foundation/goldens/pr-triage-invalid-terminal.json
@@ -3,9 +3,9 @@
   "family": "session.pr-triage",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "f560ff1582487c118756c527faa1fb1f65e37ce22ca9573491fd4b2dbcedf38d",
   "scenarioSha256": "58ad4e4d5b0200c44f329236e10fd81918a1cc36b33b22cba24662c79dd61b4e",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/pr-triage-launch.json b/mobile/rpc-foundation/goldens/pr-triage-launch.json
index b84c3b1e60d3..cf7698c10cf6 100644
--- a/mobile/rpc-foundation/goldens/pr-triage-launch.json
+++ b/mobile/rpc-foundation/goldens/pr-triage-launch.json
@@ -3,9 +3,9 @@
   "family": "session.pr-triage",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "f560ff1582487c118756c527faa1fb1f65e37ce22ca9573491fd4b2dbcedf38d",
   "scenarioSha256": "8bb2ff4e899ee873289fed7c1ef12e7f9dba91949125b1f0e4336d378ceb071e",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/pr-triage-send-locked.json b/mobile/rpc-foundation/goldens/pr-triage-send-locked.json
index 8eec5ec397c4..306a128f2b55 100644
--- a/mobile/rpc-foundation/goldens/pr-triage-send-locked.json
+++ b/mobile/rpc-foundation/goldens/pr-triage-send-locked.json
@@ -3,9 +3,9 @@
   "family": "session.pr-triage",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "f560ff1582487c118756c527faa1fb1f65e37ce22ca9573491fd4b2dbcedf38d",
   "scenarioSha256": "d80bc346e84bc35e6dce70643dcd3af3ea9e5a7f8a1f2b7a9e92c71c0c30d4c9",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/probe-new-tab-both-refused.json b/mobile/rpc-foundation/goldens/probe-new-tab-both-refused.json
index 6dc74856c025..7c910ca21b2d 100644
--- a/mobile/rpc-foundation/goldens/probe-new-tab-both-refused.json
+++ b/mobile/rpc-foundation/goldens/probe-new-tab-both-refused.json
@@ -3,9 +3,9 @@
   "family": "settings-agent-read",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "448cdbd12f4f6a14bb33947bfbbb1837aebeb28979db70c62f2ba2fbb4d89c8f",
   "scenarioSha256": "819fa73c7700b4d526da91c37558a6498008d745d1debcc26e6bb757550ebf99",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/probe-new-tab-null-sibling-refused.json b/mobile/rpc-foundation/goldens/probe-new-tab-null-sibling-refused.json
index ab24c7e4745f..45df1788131a 100644
--- a/mobile/rpc-foundation/goldens/probe-new-tab-null-sibling-refused.json
+++ b/mobile/rpc-foundation/goldens/probe-new-tab-null-sibling-refused.json
@@ -3,9 +3,9 @@
   "family": "settings-agent-read",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "448cdbd12f4f6a14bb33947bfbbb1837aebeb28979db70c62f2ba2fbb4d89c8f",
   "scenarioSha256": "500396d72abd2f73d11ef066bca3f88798c8cbdaef09fa7c1c8d1fbaf0b3b85a",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/probe-new-tab-refused-sibling-rejects.json b/mobile/rpc-foundation/goldens/probe-new-tab-refused-sibling-rejects.json
index e4b3155bb503..222aaccca170 100644
--- a/mobile/rpc-foundation/goldens/probe-new-tab-refused-sibling-rejects.json
+++ b/mobile/rpc-foundation/goldens/probe-new-tab-refused-sibling-rejects.json
@@ -3,9 +3,9 @@
   "family": "settings-agent-read",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "448cdbd12f4f6a14bb33947bfbbb1837aebeb28979db70c62f2ba2fbb4d89c8f",
   "scenarioSha256": "daf68df8840ea6872521d823cc17e1e5de3f3a74a8855465fcf40cc276e9c2ce",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/probe-new-tab-rejects-sibling-refused.json b/mobile/rpc-foundation/goldens/probe-new-tab-rejects-sibling-refused.json
index febd43b12cec..09fe006b04b5 100644
--- a/mobile/rpc-foundation/goldens/probe-new-tab-rejects-sibling-refused.json
+++ b/mobile/rpc-foundation/goldens/probe-new-tab-rejects-sibling-refused.json
@@ -3,9 +3,9 @@
   "family": "settings-agent-read",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "448cdbd12f4f6a14bb33947bfbbb1837aebeb28979db70c62f2ba2fbb4d89c8f",
   "scenarioSha256": "61e36caf6b3bb01c3ad0db282b7f0fbc0f300d40184f9cf3d7e4e3a3194a4f2a",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/push-dismissal-tray-reconciled.json b/mobile/rpc-foundation/goldens/push-dismissal-tray-reconciled.json
index 977a6ca81d8a..afd8573259e2 100644
--- a/mobile/rpc-foundation/goldens/push-dismissal-tray-reconciled.json
+++ b/mobile/rpc-foundation/goldens/push-dismissal-tray-reconciled.json
@@ -3,9 +3,9 @@
   "family": "notifications.push-dismissal",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "595a3eb2994d0596b9fcd0707b175b4e978625053dfbc5c541b0350c0cbfb524",
   "scenarioSha256": "318fab8c1efb1786bbdaea7f13b769952c1ce463bc5504dca6a9f545e905b7c9",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/quick-commands-load-refused.json b/mobile/rpc-foundation/goldens/quick-commands-load-refused.json
index 4c60fda3475b..6f8973598fb9 100644
--- a/mobile/rpc-foundation/goldens/quick-commands-load-refused.json
+++ b/mobile/rpc-foundation/goldens/quick-commands-load-refused.json
@@ -3,9 +3,9 @@
   "family": "settings.quick-commands",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "42334358b5e5966001639653b553f15033f6e201d785107871fe056536f0a5e2",
   "scenarioSha256": "42573387533f75122f626ce6ec81c1e61fe54cde5df416154bb7cba132f53309",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/quick-commands-loaded-and-saved.json b/mobile/rpc-foundation/goldens/quick-commands-loaded-and-saved.json
index 64811dd1626f..6e5f97a0d5af 100644
--- a/mobile/rpc-foundation/goldens/quick-commands-loaded-and-saved.json
+++ b/mobile/rpc-foundation/goldens/quick-commands-loaded-and-saved.json
@@ -3,9 +3,9 @@
   "family": "settings.quick-commands",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "42334358b5e5966001639653b553f15033f6e201d785107871fe056536f0a5e2",
   "scenarioSha256": "a621156bbb662c78a0baa356b60d0af41d10a7bd14e54f23be0581a59377cec3",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/quick-commands-save-refused-rolls-back.json b/mobile/rpc-foundation/goldens/quick-commands-save-refused-rolls-back.json
index dd4ffd3c57b2..d0873be6ba1f 100644
--- a/mobile/rpc-foundation/goldens/quick-commands-save-refused-rolls-back.json
+++ b/mobile/rpc-foundation/goldens/quick-commands-save-refused-rolls-back.json
@@ -3,9 +3,9 @@
   "family": "settings.quick-commands",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "42334358b5e5966001639653b553f15033f6e201d785107871fe056536f0a5e2",
   "scenarioSha256": "72517336e451e1e078135103073c1821e8af27c0702f6dc83b9a686fe7ff8c04",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/relay-direct-upgrade-commits.json b/mobile/rpc-foundation/goldens/relay-direct-upgrade-commits.json
index 8f763e01ea6d..3a75dffa1a1a 100644
--- a/mobile/rpc-foundation/goldens/relay-direct-upgrade-commits.json
+++ b/mobile/rpc-foundation/goldens/relay-direct-upgrade-commits.json
@@ -3,10 +3,10 @@
   "family": "relay.direct-upgrade",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
-  "adapterSha256": "651e75383caf1b30c329dec2d5d4f0da5358c410402d03cbb087f39600d7a4d2",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "374a16da4187ee44fcc6e07daf822ae96ecfc13ab47ee6c29d048b1c0bd0f291",
   "scenarioSha256": "a92bccd183127829b6dfd85add28e42370d54990f63214940b1c584f7fde56a9",
   "platform": "darwin",
   "scenarioVersion": 1,
@@ -23,6 +23,32 @@
       "ordinal": 8,
       "value": "host-1"
     },
+    "232ca274f695": {
+      "status": "fulfilled",
+      "startedAt": 0,
+      "settledAt": 0,
+      "value": {
+        "bundle": {
+          "current": {
+            "expiresAt": 1767830400000,
+            "hash": "7ehR_WuQWkxwOFJdkHfI5jEg4DeVYWImtDuip60LHK4",
+            "token": "pending00000000000000000000000000000000001x",
+            "version": 4
+          },
+          "deviceToken": "device-token-1",
+          "hostId": "host-1",
+          "v": 1
+        },
+        "relay": {
+          "assignmentEpoch": 1,
+          "cellUrl": "https://cell.example",
+          "directorUrl": "https://director.example",
+          "e2eeFraming": 2,
+          "relayHostId": "relay-host-0001x",
+          "v": 1
+        }
+      }
+    },
     "240d8ec7e573": {
       "name": "pairing.getEndpoints#2",
       "ordinal": 5,
@@ -116,53 +142,6 @@
         }
       }
     },
-    "590b3311b0c4": {
-      "status": "fulfilled",
-      "startedAt": 0,
-      "settledAt": 0,
-      "value": {
-        "bundle": {
-          "current": {
-            "expiresAt": 1767830400000,
-            "hash": "7ehR_WuQWkxwOFJdkHfI5jEg4DeVYWImtDuip60LHK4",
-            "token": "pending00000000000000000000000000000000001x",
-            "version": 4
-          },
-          "deviceToken": "device-token-1",
-          "hostId": "host-1",
-          "v": 1
-        },
-        "host": {
-          "deviceToken": "device-token-1",
-          "endpoint": "ws://192.168.1.10:8765",
-          "endpoints": [
-            {
-              "id": "direct-primary",
-              "kind": "lan",
-              "url": "ws://192.168.1.10:8765"
-            },
-            {
-              "id": "relay-primary",
-              "kind": "relay",
-              "url": "wss://cell.example/v1/connect/relay-host-0001x"
-            }
-          ],
-          "id": "host-1",
-          "lastConnected": 1767225600000,
-          "name": "Fixture host",
-          "publicKeyB64": "AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8=",
-          "relay": {
-            "assignmentEpoch": 1,
-            "cellUrl": "https://cell.example",
-            "directorUrl": "https://director.example",
-            "e2eeFraming": 2,
-            "relayHostId": "relay-host-0001x",
-            "v": 1
-          },
-          "relayHostId": "relay-host-0001x"
-        }
-      }
-    },
     "691df8767d71": {
       "name": "journal-cleared",
       "ordinal": 9,
@@ -248,7 +227,7 @@
           "sender": ["6e14239ef339", "2fce658b56a1", "240d8ec7e573"],
           "payloads": ["c5d28dd067e4", "f41ffc93936f", "10098087f961"],
           "settlements": {
-            "upgrade": "590b3311b0c4"
+            "upgrade": "232ca274f695"
           },
           "state": "980bbba0b617",
           "effects": ["aaef09eec3f3", "161baaed4df3", "691df8767d71"]
diff --git a/mobile/rpc-foundation/goldens/relay-direct-upgrade-unsupported-host-declines.json b/mobile/rpc-foundation/goldens/relay-direct-upgrade-unsupported-host-declines.json
index 98f5ce137285..a3070e19e8f2 100644
--- a/mobile/rpc-foundation/goldens/relay-direct-upgrade-unsupported-host-declines.json
+++ b/mobile/rpc-foundation/goldens/relay-direct-upgrade-unsupported-host-declines.json
@@ -3,10 +3,10 @@
   "family": "relay.direct-upgrade",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
-  "adapterSha256": "651e75383caf1b30c329dec2d5d4f0da5358c410402d03cbb087f39600d7a4d2",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "374a16da4187ee44fcc6e07daf822ae96ecfc13ab47ee6c29d048b1c0bd0f291",
   "scenarioSha256": "7d5cad367e76767b039fc5ebc15837930f02c5e1bed33ae7ca4695bae56287bd",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/relay-pairing-recovery-invite-authorizes.json b/mobile/rpc-foundation/goldens/relay-pairing-recovery-invite-authorizes.json
index d6b3824bf301..71306eca520f 100644
--- a/mobile/rpc-foundation/goldens/relay-pairing-recovery-invite-authorizes.json
+++ b/mobile/rpc-foundation/goldens/relay-pairing-recovery-invite-authorizes.json
@@ -3,10 +3,10 @@
   "family": "relay.pairing-recovery",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
-  "adapterSha256": "e33d584229530c716ecdc44d198b95fcfb4dfd9468fba7d5222ee3f122950197",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "57c8ad93d162ea69e4a0ecd5de7d8fae6806f8f7a51945c2c13661d81bae6497",
   "scenarioSha256": "8dc3fd27c5720276608ca8743990e4f57d94eab84f620e9aa42702a4686fd5a9",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/relay-pairing-recovery-resume-committed.json b/mobile/rpc-foundation/goldens/relay-pairing-recovery-resume-committed.json
index 8bef0cd8c5ca..f3f2cd6770b7 100644
--- a/mobile/rpc-foundation/goldens/relay-pairing-recovery-resume-committed.json
+++ b/mobile/rpc-foundation/goldens/relay-pairing-recovery-resume-committed.json
@@ -3,10 +3,10 @@
   "family": "relay.pairing-recovery",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
-  "adapterSha256": "e33d584229530c716ecdc44d198b95fcfb4dfd9468fba7d5222ee3f122950197",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "57c8ad93d162ea69e4a0ecd5de7d8fae6806f8f7a51945c2c13661d81bae6497",
   "scenarioSha256": "7e54c3af4b8b8e6eac007267fb96620283b735491883c505401c79656d920ca6",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/relay-rotation-installs-and-commits.json b/mobile/rpc-foundation/goldens/relay-rotation-installs-and-commits.json
index c72ddb96667b..d889372f3a6e 100644
--- a/mobile/rpc-foundation/goldens/relay-rotation-installs-and-commits.json
+++ b/mobile/rpc-foundation/goldens/relay-rotation-installs-and-commits.json
@@ -3,10 +3,10 @@
   "family": "relay.credential-rotation",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
-  "adapterSha256": "651e75383caf1b30c329dec2d5d4f0da5358c410402d03cbb087f39600d7a4d2",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "374a16da4187ee44fcc6e07daf822ae96ecfc13ab47ee6c29d048b1c0bd0f291",
   "scenarioSha256": "c786fb19f9593ee60238e42813561edf6f5e976fcf217dff8de977a333fe8451",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/relay-rotation-resumes-committed-pending.json b/mobile/rpc-foundation/goldens/relay-rotation-resumes-committed-pending.json
index 37b89127caae..551bbd469bfb 100644
--- a/mobile/rpc-foundation/goldens/relay-rotation-resumes-committed-pending.json
+++ b/mobile/rpc-foundation/goldens/relay-rotation-resumes-committed-pending.json
@@ -3,10 +3,10 @@
   "family": "relay.credential-rotation",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
-  "adapterSha256": "651e75383caf1b30c329dec2d5d4f0da5358c410402d03cbb087f39600d7a4d2",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "374a16da4187ee44fcc6e07daf822ae96ecfc13ab47ee6c29d048b1c0bd0f291",
   "scenarioSha256": "96df784c1d56de3bdd04afe20ab019339c7d9a616528ca2617e2fffe4f0157c8",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/review-branch-diff-shapes.json b/mobile/rpc-foundation/goldens/review-branch-diff-shapes.json
index 14c91caf5ab3..989e935206ea 100644
--- a/mobile/rpc-foundation/goldens/review-branch-diff-shapes.json
+++ b/mobile/rpc-foundation/goldens/review-branch-diff-shapes.json
@@ -3,9 +3,9 @@
   "family": "session.review-branch-diff",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a8016eb61915cf80a3bdeb622ee67d35be8b4b9862a75e4ef2e8f4ff8e93e7f2",
   "scenarioSha256": "36dbf57e82d87819b403839c22044209f0f399057f62efa7004bb8b899fdbe81",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/review-create-terminal-refused.json b/mobile/rpc-foundation/goldens/review-create-terminal-refused.json
index 459bd85ffd2d..4eb6cbae8164 100644
--- a/mobile/rpc-foundation/goldens/review-create-terminal-refused.json
+++ b/mobile/rpc-foundation/goldens/review-create-terminal-refused.json
@@ -3,10 +3,10 @@
   "family": "session.diff-review-actions",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
-  "adapterSha256": "2d72b8e68a66a906394167beb8c78f1c0521ca1e731976fd26963ec3bfa9cca4",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "86ef3d98ee6c11726bf0991e1a40400b60666b0a2e24d137abe66562fe5876bc",
   "scenarioSha256": "af837de2e273c5f03130b51d6e1a9bff9ff99a4e8d1c9554a53134acb5924c72",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/review-file-diff-shapes.json b/mobile/rpc-foundation/goldens/review-file-diff-shapes.json
index d7cb7b6c362e..4ac8364c7741 100644
--- a/mobile/rpc-foundation/goldens/review-file-diff-shapes.json
+++ b/mobile/rpc-foundation/goldens/review-file-diff-shapes.json
@@ -3,9 +3,9 @@
   "family": "session.review-file-diff",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a8016eb61915cf80a3bdeb622ee67d35be8b4b9862a75e4ef2e8f4ff8e93e7f2",
   "scenarioSha256": "30f0d2ecb8ab5a51a85037196325d5bbac53eb48c5d59a5af62e3ab1fc9420e7",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/review-git-mutations-run.json b/mobile/rpc-foundation/goldens/review-git-mutations-run.json
index e6cd41ea394d..bbf3e6e48003 100644
--- a/mobile/rpc-foundation/goldens/review-git-mutations-run.json
+++ b/mobile/rpc-foundation/goldens/review-git-mutations-run.json
@@ -3,10 +3,10 @@
   "family": "session.review-git-mutations",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
-  "adapterSha256": "2d72b8e68a66a906394167beb8c78f1c0521ca1e731976fd26963ec3bfa9cca4",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "86ef3d98ee6c11726bf0991e1a40400b60666b0a2e24d137abe66562fe5876bc",
   "scenarioSha256": "7981ac87c4397b9703330835327c70828cb5a76633f1c4803ded1b66520d184d",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/review-mark-reviewed-persists.json b/mobile/rpc-foundation/goldens/review-mark-reviewed-persists.json
index d4651db8a023..903c81db2eb1 100644
--- a/mobile/rpc-foundation/goldens/review-mark-reviewed-persists.json
+++ b/mobile/rpc-foundation/goldens/review-mark-reviewed-persists.json
@@ -3,10 +3,10 @@
   "family": "session.diff-review-actions",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
-  "adapterSha256": "2d72b8e68a66a906394167beb8c78f1c0521ca1e731976fd26963ec3bfa9cca4",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "86ef3d98ee6c11726bf0991e1a40400b60666b0a2e24d137abe66562fe5876bc",
   "scenarioSha256": "9f1c39e91a97266b0a550d2b2d061592ae050078401ef23177dd2e00db67bf04",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/review-mark-reviewed-rolls-back.json b/mobile/rpc-foundation/goldens/review-mark-reviewed-rolls-back.json
index 8d4810e2ed58..2123c9832873 100644
--- a/mobile/rpc-foundation/goldens/review-mark-reviewed-rolls-back.json
+++ b/mobile/rpc-foundation/goldens/review-mark-reviewed-rolls-back.json
@@ -3,10 +3,10 @@
   "family": "session.diff-review-actions",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
-  "adapterSha256": "2d72b8e68a66a906394167beb8c78f1c0521ca1e731976fd26963ec3bfa9cca4",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "86ef3d98ee6c11726bf0991e1a40400b60666b0a2e24d137abe66562fe5876bc",
   "scenarioSha256": "c858cfca59148548146b4c0a775e9518d3ab826ef268ccc9af60b04e52cc9e3d",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/review-open-in-session.json b/mobile/rpc-foundation/goldens/review-open-in-session.json
index 99af34217347..8762e9163ca5 100644
--- a/mobile/rpc-foundation/goldens/review-open-in-session.json
+++ b/mobile/rpc-foundation/goldens/review-open-in-session.json
@@ -3,10 +3,10 @@
   "family": "session.diff-review-actions",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
-  "adapterSha256": "2d72b8e68a66a906394167beb8c78f1c0521ca1e731976fd26963ec3bfa9cca4",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "86ef3d98ee6c11726bf0991e1a40400b60666b0a2e24d137abe66562fe5876bc",
   "scenarioSha256": "2f0a6aa8ce100edbce9ccf64c81efe64356fccbdcd2e16f561360e2b11b5700f",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/review-send-notes-heals-stale-input.json b/mobile/rpc-foundation/goldens/review-send-notes-heals-stale-input.json
index 86fadc0c11a8..c63f3eb74064 100644
--- a/mobile/rpc-foundation/goldens/review-send-notes-heals-stale-input.json
+++ b/mobile/rpc-foundation/goldens/review-send-notes-heals-stale-input.json
@@ -3,10 +3,10 @@
   "family": "session.diff-review-actions",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
-  "adapterSha256": "2d72b8e68a66a906394167beb8c78f1c0521ca1e731976fd26963ec3bfa9cca4",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "86ef3d98ee6c11726bf0991e1a40400b60666b0a2e24d137abe66562fe5876bc",
   "scenarioSha256": "7099d7311b2046dde21a2750201718995c0869bc4f17fb7f3ce2b997ce0e6506",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/review-send-sheet-lists-terminals.json b/mobile/rpc-foundation/goldens/review-send-sheet-lists-terminals.json
index 2df87b5e6bf9..04e253838be3 100644
--- a/mobile/rpc-foundation/goldens/review-send-sheet-lists-terminals.json
+++ b/mobile/rpc-foundation/goldens/review-send-sheet-lists-terminals.json
@@ -3,10 +3,10 @@
   "family": "session.review-send-sheet",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
-  "adapterSha256": "2d72b8e68a66a906394167beb8c78f1c0521ca1e731976fd26963ec3bfa9cca4",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "86ef3d98ee6c11726bf0991e1a40400b60666b0a2e24d137abe66562fe5876bc",
   "scenarioSha256": "8b4a06c1b2918d5ed5f40102c1c7cb411e02aba5e7601e98658d673634784bb0",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/review-stage-file.json b/mobile/rpc-foundation/goldens/review-stage-file.json
index f3495bf340ea..5ec53a81a4a5 100644
--- a/mobile/rpc-foundation/goldens/review-stage-file.json
+++ b/mobile/rpc-foundation/goldens/review-stage-file.json
@@ -3,10 +3,10 @@
   "family": "session.diff-review-actions",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
-  "adapterSha256": "2d72b8e68a66a906394167beb8c78f1c0521ca1e731976fd26963ec3bfa9cca4",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "86ef3d98ee6c11726bf0991e1a40400b60666b0a2e24d137abe66562fe5876bc",
   "scenarioSha256": "793e954960d371c6477d4cd3d70a5215c0bd90764684eafdb1e1a2e09790cc86",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/review-stage-refused.json b/mobile/rpc-foundation/goldens/review-stage-refused.json
index ea6be585eda7..aef207226d14 100644
--- a/mobile/rpc-foundation/goldens/review-stage-refused.json
+++ b/mobile/rpc-foundation/goldens/review-stage-refused.json
@@ -3,10 +3,10 @@
   "family": "session.diff-review-actions",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
-  "adapterSha256": "2d72b8e68a66a906394167beb8c78f1c0521ca1e731976fd26963ec3bfa9cca4",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "86ef3d98ee6c11726bf0991e1a40400b60666b0a2e24d137abe66562fe5876bc",
   "scenarioSha256": "46b720fed417d29f79dbde4cc7941579f2d6a2f920bae24234537480079e7de5",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/sc-base-ref-default.json b/mobile/rpc-foundation/goldens/sc-base-ref-default.json
index 782589ece491..6df3080de543 100644
--- a/mobile/rpc-foundation/goldens/sc-base-ref-default.json
+++ b/mobile/rpc-foundation/goldens/sc-base-ref-default.json
@@ -3,9 +3,9 @@
   "family": "git.base-ref-chain",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5e47c7960b9352753f0751d4ccf5e3ff7fb7b74a63cc4e4df3c3ffdcc6c1e66b",
   "scenarioSha256": "374129def6baa0e06b808c067831820966638d79d7a782e96c1f2f891cc9dc86",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/sc-base-ref-repo-fallback.json b/mobile/rpc-foundation/goldens/sc-base-ref-repo-fallback.json
index dea28ff8f3a9..f3dc9ae7834c 100644
--- a/mobile/rpc-foundation/goldens/sc-base-ref-repo-fallback.json
+++ b/mobile/rpc-foundation/goldens/sc-base-ref-repo-fallback.json
@@ -3,9 +3,9 @@
   "family": "git.base-ref-chain",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5e47c7960b9352753f0751d4ccf5e3ff7fb7b74a63cc4e4df3c3ffdcc6c1e66b",
   "scenarioSha256": "97a8b8f5b9a7c7467745666becee07f5dfc57fb283d4e80dcbe7941509177598",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/sc-base-ref-unavailable.json b/mobile/rpc-foundation/goldens/sc-base-ref-unavailable.json
index 4bd8b13caf87..1dbdb118320b 100644
--- a/mobile/rpc-foundation/goldens/sc-base-ref-unavailable.json
+++ b/mobile/rpc-foundation/goldens/sc-base-ref-unavailable.json
@@ -3,9 +3,9 @@
   "family": "git.base-ref-chain",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5e47c7960b9352753f0751d4ccf5e3ff7fb7b74a63cc4e4df3c3ffdcc6c1e66b",
   "scenarioSha256": "25a4762d735dfb4979e6ef31b9fdb380941a824a54b45b3d08ddb2cde25c2eb7",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/sc-base-ref-worktree-hit.json b/mobile/rpc-foundation/goldens/sc-base-ref-worktree-hit.json
index aa16a192cfd8..11a6308c70a8 100644
--- a/mobile/rpc-foundation/goldens/sc-base-ref-worktree-hit.json
+++ b/mobile/rpc-foundation/goldens/sc-base-ref-worktree-hit.json
@@ -3,9 +3,9 @@
   "family": "git.base-ref-chain",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5e47c7960b9352753f0751d4ccf5e3ff7fb7b74a63cc4e4df3c3ffdcc6c1e66b",
   "scenarioSha256": "f3b193f93f6c9de41d11e706ecbd99648eb2ed41ccb7c66cdb80c934e780ed7c",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/sc-branch-diff-previewed.json b/mobile/rpc-foundation/goldens/sc-branch-diff-previewed.json
index 743726c466c0..ba10deb68d43 100644
--- a/mobile/rpc-foundation/goldens/sc-branch-diff-previewed.json
+++ b/mobile/rpc-foundation/goldens/sc-branch-diff-previewed.json
@@ -3,9 +3,9 @@
   "family": "git.branch-diff-preview",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "48ccada93f208a24160483e98ee94a771ab6d63222f29ac4bbd6979157f98333",
   "scenarioSha256": "819d010b9a8bb2741b09f104415f648e0e65d797882a2152ccfa4fb8a107cafc",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/sc-changes-loaded.json b/mobile/rpc-foundation/goldens/sc-changes-loaded.json
index c81cc99c9f02..c016cf328bbe 100644
--- a/mobile/rpc-foundation/goldens/sc-changes-loaded.json
+++ b/mobile/rpc-foundation/goldens/sc-changes-loaded.json
@@ -3,9 +3,9 @@
   "family": "git.changes-load",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "48ccada93f208a24160483e98ee94a771ab6d63222f29ac4bbd6979157f98333",
   "scenarioSha256": "f2c4d64b3761fcd036d9538155037edc4e35492e67ce5eb158372ddc76e55cc9",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/sc-commit-message-cancel-rejected.json b/mobile/rpc-foundation/goldens/sc-commit-message-cancel-rejected.json
index b93079578823..f5400fc135ff 100644
--- a/mobile/rpc-foundation/goldens/sc-commit-message-cancel-rejected.json
+++ b/mobile/rpc-foundation/goldens/sc-commit-message-cancel-rejected.json
@@ -3,9 +3,9 @@
   "family": "git.commit-message-ai",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5e47c7960b9352753f0751d4ccf5e3ff7fb7b74a63cc4e4df3c3ffdcc6c1e66b",
   "scenarioSha256": "013db25622b180a8333bb1ef27c22a5b1f8e04148201201e5cc3413a10640781",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/sc-commit-message-canceled.json b/mobile/rpc-foundation/goldens/sc-commit-message-canceled.json
index 02dfe0e525c2..20e5cbead2db 100644
--- a/mobile/rpc-foundation/goldens/sc-commit-message-canceled.json
+++ b/mobile/rpc-foundation/goldens/sc-commit-message-canceled.json
@@ -3,9 +3,9 @@
   "family": "git.commit-message-ai",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5e47c7960b9352753f0751d4ccf5e3ff7fb7b74a63cc4e4df3c3ffdcc6c1e66b",
   "scenarioSha256": "15bf6c17f4b524dfbf5373b2eeed61ee2e659421cf8b6e3cff6c0378c7692cc1",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/sc-commit-message-generated.json b/mobile/rpc-foundation/goldens/sc-commit-message-generated.json
index adcd6c17eadb..c1ed89ff9d2a 100644
--- a/mobile/rpc-foundation/goldens/sc-commit-message-generated.json
+++ b/mobile/rpc-foundation/goldens/sc-commit-message-generated.json
@@ -3,9 +3,9 @@
   "family": "git.commit-message-ai",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5e47c7960b9352753f0751d4ccf5e3ff7fb7b74a63cc4e4df3c3ffdcc6c1e66b",
   "scenarioSha256": "540f05d84d1cbffd566af933c547838c75500bb5d708e8558c21fe8131d724e3",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/sc-create-existing-review.json b/mobile/rpc-foundation/goldens/sc-create-existing-review.json
index c40965a7d288..33de7f54a839 100644
--- a/mobile/rpc-foundation/goldens/sc-create-existing-review.json
+++ b/mobile/rpc-foundation/goldens/sc-create-existing-review.json
@@ -3,9 +3,9 @@
   "family": "hostedReview.create-chain",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c582ce355b0704b38d7e84cbce352630096c91231bf09aecd1f6dbb409fed17f",
   "scenarioSha256": "7d6099248aa6a2ef19f2e169ff917af794649d9d64d139aa9ffeea6a41355ddc",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/sc-create-intent-stage-commit-push-create.json b/mobile/rpc-foundation/goldens/sc-create-intent-stage-commit-push-create.json
index 5d92f7e0edc8..e93034cccbad 100644
--- a/mobile/rpc-foundation/goldens/sc-create-intent-stage-commit-push-create.json
+++ b/mobile/rpc-foundation/goldens/sc-create-intent-stage-commit-push-create.json
@@ -3,9 +3,9 @@
   "family": "hostedReview.create-intent",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c582ce355b0704b38d7e84cbce352630096c91231bf09aecd1f6dbb409fed17f",
   "scenarioSha256": "447f9b3d697dbfe21cb7fb6e12d1bf5fa94b023b7e1697bdc2dc82ce7072183f",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/sc-create-intent-unlisted-provider.json b/mobile/rpc-foundation/goldens/sc-create-intent-unlisted-provider.json
index 9a353202bc12..ad6511c94ea1 100644
--- a/mobile/rpc-foundation/goldens/sc-create-intent-unlisted-provider.json
+++ b/mobile/rpc-foundation/goldens/sc-create-intent-unlisted-provider.json
@@ -3,9 +3,9 @@
   "family": "hostedReview.create-intent",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c582ce355b0704b38d7e84cbce352630096c91231bf09aecd1f6dbb409fed17f",
   "scenarioSha256": "7a032109038c14b0a0f254097939b877eba62c10ba7b963070988bb4a1c06ef0",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/sc-create-link-failure-is-non-fatal.json b/mobile/rpc-foundation/goldens/sc-create-link-failure-is-non-fatal.json
index ef34c3499478..d2e07b8bd5f1 100644
--- a/mobile/rpc-foundation/goldens/sc-create-link-failure-is-non-fatal.json
+++ b/mobile/rpc-foundation/goldens/sc-create-link-failure-is-non-fatal.json
@@ -3,9 +3,9 @@
   "family": "hostedReview.create-chain",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c582ce355b0704b38d7e84cbce352630096c91231bf09aecd1f6dbb409fed17f",
   "scenarioSha256": "2deb0435ef63a3e0102e28f2f3f331039486d193d1e1ffdfb53ad86d3ff039f0",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/sc-create-pushes-then-creates.json b/mobile/rpc-foundation/goldens/sc-create-pushes-then-creates.json
index 3809e363ca3d..ec8982ed6dd1 100644
--- a/mobile/rpc-foundation/goldens/sc-create-pushes-then-creates.json
+++ b/mobile/rpc-foundation/goldens/sc-create-pushes-then-creates.json
@@ -3,9 +3,9 @@
   "family": "hostedReview.create-chain",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c582ce355b0704b38d7e84cbce352630096c91231bf09aecd1f6dbb409fed17f",
   "scenarioSha256": "0f86b3e6059c48cd327c55df2452a9bc6ea85584ffbeacafad496f600c20e06f",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/sc-create-refused-empty-message.json b/mobile/rpc-foundation/goldens/sc-create-refused-empty-message.json
index f4887f73863c..d6ac8f188565 100644
--- a/mobile/rpc-foundation/goldens/sc-create-refused-empty-message.json
+++ b/mobile/rpc-foundation/goldens/sc-create-refused-empty-message.json
@@ -3,9 +3,9 @@
   "family": "hostedReview.create-chain",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c582ce355b0704b38d7e84cbce352630096c91231bf09aecd1f6dbb409fed17f",
   "scenarioSha256": "5008e69a8e396b1deccd98712d92650a630f971cd76a02862a461afb8617b8a4",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/sc-create-rejected-empty-message.json b/mobile/rpc-foundation/goldens/sc-create-rejected-empty-message.json
index fdf228ace861..1aa2aed3cada 100644
--- a/mobile/rpc-foundation/goldens/sc-create-rejected-empty-message.json
+++ b/mobile/rpc-foundation/goldens/sc-create-rejected-empty-message.json
@@ -3,9 +3,9 @@
   "family": "hostedReview.create-chain",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c582ce355b0704b38d7e84cbce352630096c91231bf09aecd1f6dbb409fed17f",
   "scenarioSha256": "ea71081982a101d0f8624707b59c99de9981e9b1d1bafa25c66d575e3f876ff4",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/sc-eligibility-fetched.json b/mobile/rpc-foundation/goldens/sc-eligibility-fetched.json
index 49e625b3e114..8c69f7504ae0 100644
--- a/mobile/rpc-foundation/goldens/sc-eligibility-fetched.json
+++ b/mobile/rpc-foundation/goldens/sc-eligibility-fetched.json
@@ -3,9 +3,9 @@
   "family": "hostedReview.eligibility",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c582ce355b0704b38d7e84cbce352630096c91231bf09aecd1f6dbb409fed17f",
   "scenarioSha256": "f6a1595073abe11b33973e8865900a1d849f44221961da5c12ea13aa696f6490",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/sc-history-commit-files.json b/mobile/rpc-foundation/goldens/sc-history-commit-files.json
index 72bc6a1c43dc..23f2847f93c7 100644
--- a/mobile/rpc-foundation/goldens/sc-history-commit-files.json
+++ b/mobile/rpc-foundation/goldens/sc-history-commit-files.json
@@ -3,9 +3,9 @@
   "family": "git.history-commit-files",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "48ccada93f208a24160483e98ee94a771ab6d63222f29ac4bbd6979157f98333",
   "scenarioSha256": "27e71d989da152adcbe40a02186df8b8a2e19a6a0e8bfe727e2133c4360f7639",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/sc-history-loaded.json b/mobile/rpc-foundation/goldens/sc-history-loaded.json
index eab530014cd9..893640bc704a 100644
--- a/mobile/rpc-foundation/goldens/sc-history-loaded.json
+++ b/mobile/rpc-foundation/goldens/sc-history-loaded.json
@@ -3,9 +3,9 @@
   "family": "git.history-read",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5e47c7960b9352753f0751d4ccf5e3ff7fb7b74a63cc4e4df3c3ffdcc6c1e66b",
   "scenarioSha256": "83f61085a91458bad529905ecc6fe240c598cddfe44a56dd497b8aed9fb8a7e5",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/sc-pr-link-hosted-review.json b/mobile/rpc-foundation/goldens/sc-pr-link-hosted-review.json
index 2fafba76e503..1feb3cb1814d 100644
--- a/mobile/rpc-foundation/goldens/sc-pr-link-hosted-review.json
+++ b/mobile/rpc-foundation/goldens/sc-pr-link-hosted-review.json
@@ -3,9 +3,9 @@
   "family": "worktree.review-link",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5e47c7960b9352753f0751d4ccf5e3ff7fb7b74a63cc4e4df3c3ffdcc6c1e66b",
   "scenarioSha256": "42b0304b2fdce08b7ff52ec979dd9f199f368e5e4ef0b5370acc417909b592b3",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/sc-pr-link-read.json b/mobile/rpc-foundation/goldens/sc-pr-link-read.json
index 15ab4728e2e2..e275ba742315 100644
--- a/mobile/rpc-foundation/goldens/sc-pr-link-read.json
+++ b/mobile/rpc-foundation/goldens/sc-pr-link-read.json
@@ -3,9 +3,9 @@
   "family": "worktree.review-link",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5e47c7960b9352753f0751d4ccf5e3ff7fb7b74a63cc4e4df3c3ffdcc6c1e66b",
   "scenarioSha256": "4520bd54a55eabfe6ec64a4b2f824f095f98b2fffd1bf22fe4f9ec7f63cbfa3f",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/sc-pr-link-set.json b/mobile/rpc-foundation/goldens/sc-pr-link-set.json
index 963a5a009c82..97668379bf5c 100644
--- a/mobile/rpc-foundation/goldens/sc-pr-link-set.json
+++ b/mobile/rpc-foundation/goldens/sc-pr-link-set.json
@@ -3,9 +3,9 @@
   "family": "worktree.review-link",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5e47c7960b9352753f0751d4ccf5e3ff7fb7b74a63cc4e4df3c3ffdcc6c1e66b",
   "scenarioSha256": "b65bad4f8c0ae0b686f6c3db93bd43ffa072ae426f978f1a86ad8008fb24fa24",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/sc-prefill-unavailable-on-refusal.json b/mobile/rpc-foundation/goldens/sc-prefill-unavailable-on-refusal.json
index 357090c75b8f..e387920494d3 100644
--- a/mobile/rpc-foundation/goldens/sc-prefill-unavailable-on-refusal.json
+++ b/mobile/rpc-foundation/goldens/sc-prefill-unavailable-on-refusal.json
@@ -3,9 +3,9 @@
   "family": "hostedReview.eligibility",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c582ce355b0704b38d7e84cbce352630096c91231bf09aecd1f6dbb409fed17f",
   "scenarioSha256": "9de96287a4dfa6cf5c9a8b683cc696fdc2cd387f86f231e22ee3f100a2e778e3",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/sc-prefill-unavailable-on-rejection.json b/mobile/rpc-foundation/goldens/sc-prefill-unavailable-on-rejection.json
index cfb9808535d5..3215dff50ccd 100644
--- a/mobile/rpc-foundation/goldens/sc-prefill-unavailable-on-rejection.json
+++ b/mobile/rpc-foundation/goldens/sc-prefill-unavailable-on-rejection.json
@@ -3,9 +3,9 @@
   "family": "hostedReview.eligibility",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c582ce355b0704b38d7e84cbce352630096c91231bf09aecd1f6dbb409fed17f",
   "scenarioSha256": "adbdfcc3895cc04d830900de518e689c9e63f6f75569127e1fde24488658e8a0",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/sc-prerequisite-force-with-lease.json b/mobile/rpc-foundation/goldens/sc-prerequisite-force-with-lease.json
index 1171b1f1abb3..26a535638b2f 100644
--- a/mobile/rpc-foundation/goldens/sc-prerequisite-force-with-lease.json
+++ b/mobile/rpc-foundation/goldens/sc-prerequisite-force-with-lease.json
@@ -3,9 +3,9 @@
   "family": "git.remote-prerequisite",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c582ce355b0704b38d7e84cbce352630096c91231bf09aecd1f6dbb409fed17f",
   "scenarioSha256": "ec2847b4af357d8564d8e0a9a1072713c1afd7ff86ba69e9c83c056a6841ee39",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/sc-prerequisite-publish.json b/mobile/rpc-foundation/goldens/sc-prerequisite-publish.json
index b03376ee631e..0c9f8b46ab10 100644
--- a/mobile/rpc-foundation/goldens/sc-prerequisite-publish.json
+++ b/mobile/rpc-foundation/goldens/sc-prerequisite-publish.json
@@ -3,9 +3,9 @@
   "family": "git.remote-prerequisite",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c582ce355b0704b38d7e84cbce352630096c91231bf09aecd1f6dbb409fed17f",
   "scenarioSha256": "6cf6ebd20adc4cc76a12d3424863ee9db2b24f36593664a1f4e0e05de9a53d39",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/sc-prerequisite-push.json b/mobile/rpc-foundation/goldens/sc-prerequisite-push.json
index e62d35534866..5c78df7a2e0c 100644
--- a/mobile/rpc-foundation/goldens/sc-prerequisite-push.json
+++ b/mobile/rpc-foundation/goldens/sc-prerequisite-push.json
@@ -3,9 +3,9 @@
   "family": "git.remote-prerequisite",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c582ce355b0704b38d7e84cbce352630096c91231bf09aecd1f6dbb409fed17f",
   "scenarioSha256": "e6e8197a541cd73e5811a1f28b0dbfc414a4d34c1ae6929fc1bbae1213820674",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/sc-prerequisite-skipped.json b/mobile/rpc-foundation/goldens/sc-prerequisite-skipped.json
index b1a955f8063d..d39070adb225 100644
--- a/mobile/rpc-foundation/goldens/sc-prerequisite-skipped.json
+++ b/mobile/rpc-foundation/goldens/sc-prerequisite-skipped.json
@@ -3,9 +3,9 @@
   "family": "git.remote-prerequisite",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c582ce355b0704b38d7e84cbce352630096c91231bf09aecd1f6dbb409fed17f",
   "scenarioSha256": "523d1ee21e3871a4dffc32f48d2e28c31ecea48cbf3f842acffc8355be06b14b",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/sc-reveal-first-poll.json b/mobile/rpc-foundation/goldens/sc-reveal-first-poll.json
index 7e1609c6dfd5..519db73bcb31 100644
--- a/mobile/rpc-foundation/goldens/sc-reveal-first-poll.json
+++ b/mobile/rpc-foundation/goldens/sc-reveal-first-poll.json
@@ -3,9 +3,9 @@
   "family": "session.tab-reveal",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5e47c7960b9352753f0751d4ccf5e3ff7fb7b74a63cc4e4df3c3ffdcc6c1e66b",
   "scenarioSha256": "00b26cb279b0a934df98d93ba98a4a0c79e302c7690c582e778dc0156ab4f235",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/sc-reveal-timeout.json b/mobile/rpc-foundation/goldens/sc-reveal-timeout.json
index f7b9c640533b..feb0b6e2e430 100644
--- a/mobile/rpc-foundation/goldens/sc-reveal-timeout.json
+++ b/mobile/rpc-foundation/goldens/sc-reveal-timeout.json
@@ -3,9 +3,9 @@
   "family": "session.tab-reveal",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5e47c7960b9352753f0751d4ccf5e3ff7fb7b74a63cc4e4df3c3ffdcc6c1e66b",
   "scenarioSha256": "fcd61f1ef46c42889827a87876239534b851c425f8ef7a9405ea95b8d07d2363",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/sc-review-commit-inner-failure.json b/mobile/rpc-foundation/goldens/sc-review-commit-inner-failure.json
index 4343c2e8765f..8d9358da2e1a 100644
--- a/mobile/rpc-foundation/goldens/sc-review-commit-inner-failure.json
+++ b/mobile/rpc-foundation/goldens/sc-review-commit-inner-failure.json
@@ -3,9 +3,9 @@
   "family": "git.review-preparation",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c582ce355b0704b38d7e84cbce352630096c91231bf09aecd1f6dbb409fed17f",
   "scenarioSha256": "db1fb2a584cd806028b9be861283a63aa4836c83f61558f3d518ddbb7a59498d",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/sc-review-commit-refused-empty-message.json b/mobile/rpc-foundation/goldens/sc-review-commit-refused-empty-message.json
index f1bd6b92d59f..43259c0204c4 100644
--- a/mobile/rpc-foundation/goldens/sc-review-commit-refused-empty-message.json
+++ b/mobile/rpc-foundation/goldens/sc-review-commit-refused-empty-message.json
@@ -3,9 +3,9 @@
   "family": "git.review-preparation",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c582ce355b0704b38d7e84cbce352630096c91231bf09aecd1f6dbb409fed17f",
   "scenarioSha256": "dba1676583dc832ef059285a6bd4c3eefe6be0230e42100cb9d7a125755d136b",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/sc-review-commit-rejected.json b/mobile/rpc-foundation/goldens/sc-review-commit-rejected.json
index c1078704ae2d..e93d03b75bcf 100644
--- a/mobile/rpc-foundation/goldens/sc-review-commit-rejected.json
+++ b/mobile/rpc-foundation/goldens/sc-review-commit-rejected.json
@@ -3,9 +3,9 @@
   "family": "git.review-preparation",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c582ce355b0704b38d7e84cbce352630096c91231bf09aecd1f6dbb409fed17f",
   "scenarioSha256": "de079de9cc21bfb40da6e1431273b10c3e2a5b5402b91b2b8a85c8d7ac41bc97",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/sc-review-commit.json b/mobile/rpc-foundation/goldens/sc-review-commit.json
index fa51204de4fa..138f19fbe4da 100644
--- a/mobile/rpc-foundation/goldens/sc-review-commit.json
+++ b/mobile/rpc-foundation/goldens/sc-review-commit.json
@@ -3,9 +3,9 @@
   "family": "git.review-preparation",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c582ce355b0704b38d7e84cbce352630096c91231bf09aecd1f6dbb409fed17f",
   "scenarioSha256": "a29d518b2d075e8e4811404e0fcbf8948fbfe53a3aefbf0948cb2f2e622e8cbb",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/sc-review-status-entries-not-array.json b/mobile/rpc-foundation/goldens/sc-review-status-entries-not-array.json
index b0250ca22971..79c7440a0049 100644
--- a/mobile/rpc-foundation/goldens/sc-review-status-entries-not-array.json
+++ b/mobile/rpc-foundation/goldens/sc-review-status-entries-not-array.json
@@ -3,9 +3,9 @@
   "family": "git.review-preparation",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c582ce355b0704b38d7e84cbce352630096c91231bf09aecd1f6dbb409fed17f",
   "scenarioSha256": "37ba7780ca9525ab313c0a9c781ce5bb26344e63af9272c32ae889621f383b2b",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/sc-review-status-normalized.json b/mobile/rpc-foundation/goldens/sc-review-status-normalized.json
index 4d733fe616b5..3c4f90c59f95 100644
--- a/mobile/rpc-foundation/goldens/sc-review-status-normalized.json
+++ b/mobile/rpc-foundation/goldens/sc-review-status-normalized.json
@@ -3,9 +3,9 @@
   "family": "git.review-preparation",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c582ce355b0704b38d7e84cbce352630096c91231bf09aecd1f6dbb409fed17f",
   "scenarioSha256": "93193acd57d6f00abc8e6c22ec3a8f1ca6ce7c5808d906d0aa7c11e41dab4635",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/schedules-b3.json b/mobile/rpc-foundation/goldens/schedules-b3.json
index 9c55ab71ca14..22804fede528 100644
--- a/mobile/rpc-foundation/goldens/schedules-b3.json
+++ b/mobile/rpc-foundation/goldens/schedules-b3.json
@@ -3,9 +3,9 @@
   "family": "linear-detail-barrier",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "d3b7f33d810e1fa420ac41a628cde9fe4a9e65fd57f89fbca0a40fc7d74951ab",
   "scenarioSha256": "b59fb599dd3a5fbc79bb8602dcec4b1c51a392c662efab7efc8324fc718ce8de",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/schedules-settings-home-providers-fulfilled.json b/mobile/rpc-foundation/goldens/schedules-settings-home-providers-fulfilled.json
index 4c87f468a63e..af7284442158 100644
--- a/mobile/rpc-foundation/goldens/schedules-settings-home-providers-fulfilled.json
+++ b/mobile/rpc-foundation/goldens/schedules-settings-home-providers-fulfilled.json
@@ -3,9 +3,9 @@
   "family": "settings.home-providers",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "fbd311a377672a9335521c30734880eea1b04bab0aff367854c1deebcf66b105",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/schedules-settings-new-tab-ssh.json b/mobile/rpc-foundation/goldens/schedules-settings-new-tab-ssh.json
index 2d0befaa201c..c920fabd9396 100644
--- a/mobile/rpc-foundation/goldens/schedules-settings-new-tab-ssh.json
+++ b/mobile/rpc-foundation/goldens/schedules-settings-new-tab-ssh.json
@@ -3,9 +3,9 @@
   "family": "settings-agent-read",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "448cdbd12f4f6a14bb33947bfbbb1837aebeb28979db70c62f2ba2fbb4d89c8f",
   "scenarioSha256": "2726d71130f623e3ad02c168c13269979ca6f84703bf1c5aaf36bd4432dfb516",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/schedules-settings-repo-metadata-fulfilled.json b/mobile/rpc-foundation/goldens/schedules-settings-repo-metadata-fulfilled.json
index 42c9b4f886be..1b95c26e609d 100644
--- a/mobile/rpc-foundation/goldens/schedules-settings-repo-metadata-fulfilled.json
+++ b/mobile/rpc-foundation/goldens/schedules-settings-repo-metadata-fulfilled.json
@@ -3,9 +3,9 @@
   "family": "settings.repo-metadata",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "664eba1468e229f9ac2dced262e7ad896ead01688dff4c570f397c3f8594efd7",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/schedules-settings-resume-metadata-fulfilled.json b/mobile/rpc-foundation/goldens/schedules-settings-resume-metadata-fulfilled.json
index 709267c90da5..a2b54e456578 100644
--- a/mobile/rpc-foundation/goldens/schedules-settings-resume-metadata-fulfilled.json
+++ b/mobile/rpc-foundation/goldens/schedules-settings-resume-metadata-fulfilled.json
@@ -3,9 +3,9 @@
   "family": "settings.resume-metadata",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "7bfba3fae1dc33acf40e8a955bbfccf28580b3daee3270dec6a15e6cefd45a84",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/schedules-settings-task-hydration-fulfilled.json b/mobile/rpc-foundation/goldens/schedules-settings-task-hydration-fulfilled.json
index 209c539d92a9..d220a0d5d717 100644
--- a/mobile/rpc-foundation/goldens/schedules-settings-task-hydration-fulfilled.json
+++ b/mobile/rpc-foundation/goldens/schedules-settings-task-hydration-fulfilled.json
@@ -3,9 +3,9 @@
   "family": "settings.task-hydration",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "02e3ca10296704b5478185e9d3dc0136596a2ee57580d7f9268672568dab4cd4",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/schedules-settings-workspace-context-fulfilled.json b/mobile/rpc-foundation/goldens/schedules-settings-workspace-context-fulfilled.json
index f8aa7413a1da..fbee0b8b473f 100644
--- a/mobile/rpc-foundation/goldens/schedules-settings-workspace-context-fulfilled.json
+++ b/mobile/rpc-foundation/goldens/schedules-settings-workspace-context-fulfilled.json
@@ -3,9 +3,9 @@
   "family": "settings.workspace-context",
   "namedDeltas": ["new-workspace-runtime-context-null-results-degrade-to-absent"],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "eb980fc027ca0200212ba6ad3bf9a1ab3460936a7bb4b04353a9462eecd287a1",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-browser-tab-created.json b/mobile/rpc-foundation/goldens/session-browser-tab-created.json
index 3f8b70150780..cd208d04e141 100644
--- a/mobile/rpc-foundation/goldens/session-browser-tab-created.json
+++ b/mobile/rpc-foundation/goldens/session-browser-tab-created.json
@@ -3,9 +3,9 @@
   "family": "session.browser-tab-create",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "562c2f4ab669e774dd7045ecd9518e483845433fef6034688090f3b056df2815",
   "scenarioSha256": "b4b584b1da9569f18475211ff84d157de3e5d3f300719f6848ac51c01d011531",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-create-browser-refused.json b/mobile/rpc-foundation/goldens/session-create-browser-refused.json
index ab0740b210ad..b493cbe3b511 100644
--- a/mobile/rpc-foundation/goldens/session-create-browser-refused.json
+++ b/mobile/rpc-foundation/goldens/session-create-browser-refused.json
@@ -3,9 +3,9 @@
   "family": "session.content-create",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "562c2f4ab669e774dd7045ecd9518e483845433fef6034688090f3b056df2815",
   "scenarioSha256": "59b5f0aac2f8c1aab5fc3a457fb69e1a2f46cc88c617c25e638175acb7f7c0cb",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-create-browser-tab.json b/mobile/rpc-foundation/goldens/session-create-browser-tab.json
index 4b1ae82eb2bf..b5a3eb306141 100644
--- a/mobile/rpc-foundation/goldens/session-create-browser-tab.json
+++ b/mobile/rpc-foundation/goldens/session-create-browser-tab.json
@@ -3,9 +3,9 @@
   "family": "session.content-create",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "562c2f4ab669e774dd7045ecd9518e483845433fef6034688090f3b056df2815",
   "scenarioSha256": "36dbd24dc3d24be8c14217ced1963d10ef8264438729dd146cbff79d9fbdf279",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-create-markdown-name-collision.json b/mobile/rpc-foundation/goldens/session-create-markdown-name-collision.json
index 9a7f3f18608d..f758d48f2cf4 100644
--- a/mobile/rpc-foundation/goldens/session-create-markdown-name-collision.json
+++ b/mobile/rpc-foundation/goldens/session-create-markdown-name-collision.json
@@ -3,9 +3,9 @@
   "family": "session.content-create",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "562c2f4ab669e774dd7045ecd9518e483845433fef6034688090f3b056df2815",
   "scenarioSha256": "be8d4b4be07b0ee5988471b26813d7d0d2a97fbd789b52e7ce00dd09a2e9d75c",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-create-markdown-note.json b/mobile/rpc-foundation/goldens/session-create-markdown-note.json
index 785d27b4e12d..bb8f96bc9509 100644
--- a/mobile/rpc-foundation/goldens/session-create-markdown-note.json
+++ b/mobile/rpc-foundation/goldens/session-create-markdown-note.json
@@ -3,9 +3,9 @@
   "family": "session.content-create",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "562c2f4ab669e774dd7045ecd9518e483845433fef6034688090f3b056df2815",
   "scenarioSha256": "4118eea1175cba0f15174072f5715f9054ded09a4cb0c359fc4ee41ad00e9440",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-create-terminal-ignores-a-second-create-in-flight.json b/mobile/rpc-foundation/goldens/session-create-terminal-ignores-a-second-create-in-flight.json
index daa9842a0392..67c96e0e2aaf 100644
--- a/mobile/rpc-foundation/goldens/session-create-terminal-ignores-a-second-create-in-flight.json
+++ b/mobile/rpc-foundation/goldens/session-create-terminal-ignores-a-second-create-in-flight.json
@@ -3,9 +3,9 @@
   "family": "session.create-terminal",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fa7d9fd6428e89282f08e04fefba4289000eb3aed1462489a2f11efed374382c",
   "scenarioSha256": "df99b9c0ebcffb3d8f173c87783862edb0a66befcc3cd73f1096871f45963913",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-create-terminal-launches-an-agent-quick-command.json b/mobile/rpc-foundation/goldens/session-create-terminal-launches-an-agent-quick-command.json
index 17193952eb96..0b133ccfa954 100644
--- a/mobile/rpc-foundation/goldens/session-create-terminal-launches-an-agent-quick-command.json
+++ b/mobile/rpc-foundation/goldens/session-create-terminal-launches-an-agent-quick-command.json
@@ -3,9 +3,9 @@
   "family": "session.create-terminal",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fa7d9fd6428e89282f08e04fefba4289000eb3aed1462489a2f11efed374382c",
   "scenarioSha256": "fb9828d5e13917ce394061b2d702890e5198df04ce803363b2ce9f939921d00e",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-create-terminal-refused.json b/mobile/rpc-foundation/goldens/session-create-terminal-refused.json
index 72fcac8f0d19..99cb58af8a12 100644
--- a/mobile/rpc-foundation/goldens/session-create-terminal-refused.json
+++ b/mobile/rpc-foundation/goldens/session-create-terminal-refused.json
@@ -3,9 +3,9 @@
   "family": "session.create-terminal",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fa7d9fd6428e89282f08e04fefba4289000eb3aed1462489a2f11efed374382c",
   "scenarioSha256": "e9c32bdf3357ca5d69ac07cb7bbc63fe279c1a23c44e5c79fa0b1db4fd1c55dd",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-create-terminal-replaces-active.json b/mobile/rpc-foundation/goldens/session-create-terminal-replaces-active.json
index e5710dcb14a1..7ff9bd442e79 100644
--- a/mobile/rpc-foundation/goldens/session-create-terminal-replaces-active.json
+++ b/mobile/rpc-foundation/goldens/session-create-terminal-replaces-active.json
@@ -3,9 +3,9 @@
   "family": "session.create-terminal",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fa7d9fd6428e89282f08e04fefba4289000eb3aed1462489a2f11efed374382c",
   "scenarioSha256": "726e19307f1e82f0c8ae9a555ec9c27c8eea7f8f40fa700dc0b71c54ecc9ca11",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-create-terminal-runs-a-quick-command.json b/mobile/rpc-foundation/goldens/session-create-terminal-runs-a-quick-command.json
index ed09356a66a8..5d3ad4f5a5bd 100644
--- a/mobile/rpc-foundation/goldens/session-create-terminal-runs-a-quick-command.json
+++ b/mobile/rpc-foundation/goldens/session-create-terminal-runs-a-quick-command.json
@@ -3,9 +3,9 @@
   "family": "session.create-terminal",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fa7d9fd6428e89282f08e04fefba4289000eb3aed1462489a2f11efed374382c",
   "scenarioSha256": "4dfbe31daae64a03fc588f2095235fdd9b37f26ecccefe596c35c8ef8f623651",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-create-terminal-with-prompt.json b/mobile/rpc-foundation/goldens/session-create-terminal-with-prompt.json
index a314b2f9451d..38a47b44a8ea 100644
--- a/mobile/rpc-foundation/goldens/session-create-terminal-with-prompt.json
+++ b/mobile/rpc-foundation/goldens/session-create-terminal-with-prompt.json
@@ -3,9 +3,9 @@
   "family": "session.create-terminal",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fa7d9fd6428e89282f08e04fefba4289000eb3aed1462489a2f11efed374382c",
   "scenarioSha256": "fd654a7e34ae8004543a34a7a301d51858989fdc2bffb02ddf6edb814071b22d",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-create-terminal-without-active-tab.json b/mobile/rpc-foundation/goldens/session-create-terminal-without-active-tab.json
index 6e97863751f6..47ced3dad4bd 100644
--- a/mobile/rpc-foundation/goldens/session-create-terminal-without-active-tab.json
+++ b/mobile/rpc-foundation/goldens/session-create-terminal-without-active-tab.json
@@ -3,9 +3,9 @@
   "family": "session.create-terminal",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fa7d9fd6428e89282f08e04fefba4289000eb3aed1462489a2f11efed374382c",
   "scenarioSha256": "da78ad25ea15e1c714f0147d34207529362743a56a519153f36b09345dee0ebc",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-create-terminal-without-handle.json b/mobile/rpc-foundation/goldens/session-create-terminal-without-handle.json
index aa5ca98a4464..0a369faee451 100644
--- a/mobile/rpc-foundation/goldens/session-create-terminal-without-handle.json
+++ b/mobile/rpc-foundation/goldens/session-create-terminal-without-handle.json
@@ -3,9 +3,9 @@
   "family": "session.create-terminal",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fa7d9fd6428e89282f08e04fefba4289000eb3aed1462489a2f11efed374382c",
   "scenarioSha256": "f1952a0e2c9108dadf2f5b85ac1f43ec9db09db0ce81a575bb4dd3a8d18d9c83",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-diff-notes-load-refused.json b/mobile/rpc-foundation/goldens/session-diff-notes-load-refused.json
index 3f826d83b36e..662eaa4289c4 100644
--- a/mobile/rpc-foundation/goldens/session-diff-notes-load-refused.json
+++ b/mobile/rpc-foundation/goldens/session-diff-notes-load-refused.json
@@ -3,9 +3,9 @@
   "family": "session.diff-notes",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "42334358b5e5966001639653b553f15033f6e201d785107871fe056536f0a5e2",
   "scenarioSha256": "5ab16800f82813778078e84739e0ac72886c145d20789dedcea9428ee31b9182",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-diff-notes-loaded.json b/mobile/rpc-foundation/goldens/session-diff-notes-loaded.json
index bbadbe0e1f9b..ceababf7aee1 100644
--- a/mobile/rpc-foundation/goldens/session-diff-notes-loaded.json
+++ b/mobile/rpc-foundation/goldens/session-diff-notes-loaded.json
@@ -3,9 +3,9 @@
   "family": "session.diff-notes",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "42334358b5e5966001639653b553f15033f6e201d785107871fe056536f0a5e2",
   "scenarioSha256": "795286ff495a243059a3eb55ccbbc9b4adfdd2034258f91f9182e83c7492fa60",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-file-tab-read.json b/mobile/rpc-foundation/goldens/session-file-tab-read.json
index 9bc3289fe3ef..d994300f6503 100644
--- a/mobile/rpc-foundation/goldens/session-file-tab-read.json
+++ b/mobile/rpc-foundation/goldens/session-file-tab-read.json
@@ -3,9 +3,9 @@
   "family": "session.tab-documents",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a3daf9a05d05424959baf77feb45cb0c076d77d8c49e877941ed612cc1e5ce95",
   "scenarioSha256": "82c1d8e87e0a87c1c1a6dba7bd4f61e08f77fe0ae1b3758d1b5543bd9719a53f",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-markdown-disk-read.json b/mobile/rpc-foundation/goldens/session-markdown-disk-read.json
index 313188d3cd04..bc585366f512 100644
--- a/mobile/rpc-foundation/goldens/session-markdown-disk-read.json
+++ b/mobile/rpc-foundation/goldens/session-markdown-disk-read.json
@@ -3,9 +3,9 @@
   "family": "session.markdown-disk-fallback",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a3daf9a05d05424959baf77feb45cb0c076d77d8c49e877941ed612cc1e5ce95",
   "scenarioSha256": "29565833b19968faa701f656d166050419f149d6bb76d1f63f4dd3af76b8e896",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-markdown-disk-served.json b/mobile/rpc-foundation/goldens/session-markdown-disk-served.json
index dcf9df964857..a58b982b032a 100644
--- a/mobile/rpc-foundation/goldens/session-markdown-disk-served.json
+++ b/mobile/rpc-foundation/goldens/session-markdown-disk-served.json
@@ -3,9 +3,9 @@
   "family": "session.markdown-disk-fallback",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a3daf9a05d05424959baf77feb45cb0c076d77d8c49e877941ed612cc1e5ce95",
   "scenarioSha256": "8375df17afabf282a1d37ffaa3a334b1fa9105ba04e6618f16082f66bfe3f76d",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-markdown-save-conflict.json b/mobile/rpc-foundation/goldens/session-markdown-save-conflict.json
index 835d3de14b12..05ef486efd39 100644
--- a/mobile/rpc-foundation/goldens/session-markdown-save-conflict.json
+++ b/mobile/rpc-foundation/goldens/session-markdown-save-conflict.json
@@ -3,9 +3,9 @@
   "family": "session.markdown-save",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "42334358b5e5966001639653b553f15033f6e201d785107871fe056536f0a5e2",
   "scenarioSha256": "76bccdabb78dc3f16b36987f6b7cefbe41e08167fe39612620e27ad476089f93",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-markdown-saved.json b/mobile/rpc-foundation/goldens/session-markdown-saved.json
index 7f7dfa18a080..2ca7429d6878 100644
--- a/mobile/rpc-foundation/goldens/session-markdown-saved.json
+++ b/mobile/rpc-foundation/goldens/session-markdown-saved.json
@@ -3,9 +3,9 @@
   "family": "session.markdown-save",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "42334358b5e5966001639653b553f15033f6e201d785107871fe056536f0a5e2",
   "scenarioSha256": "a2b5b73b2455f9efc48361e4b96ab1d3ecc3d136459403c9c3678104604cd774",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-markdown-tab-disk-fallback.json b/mobile/rpc-foundation/goldens/session-markdown-tab-disk-fallback.json
index 6c197c7ae723..8e1d814c42f6 100644
--- a/mobile/rpc-foundation/goldens/session-markdown-tab-disk-fallback.json
+++ b/mobile/rpc-foundation/goldens/session-markdown-tab-disk-fallback.json
@@ -3,9 +3,9 @@
   "family": "session.tab-documents",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a3daf9a05d05424959baf77feb45cb0c076d77d8c49e877941ed612cc1e5ce95",
   "scenarioSha256": "f46cef9d1c6a5ed6d8b6f1d180cdf5c666f52e043b70feb07e5fccee885ceeda",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-markdown-tab-read.json b/mobile/rpc-foundation/goldens/session-markdown-tab-read.json
index cd133f5da9ff..bb8d4d1c3cc2 100644
--- a/mobile/rpc-foundation/goldens/session-markdown-tab-read.json
+++ b/mobile/rpc-foundation/goldens/session-markdown-tab-read.json
@@ -3,9 +3,9 @@
   "family": "session.tab-documents",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a3daf9a05d05424959baf77feb45cb0c076d77d8c49e877941ed612cc1e5ce95",
   "scenarioSha256": "f88c39d410655b229aa740b45ccdaa10186f41f7c6cbff9fed6eaee3f0a55844",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-markdown-tab-refused.json b/mobile/rpc-foundation/goldens/session-markdown-tab-refused.json
index acaea8cba606..7fc0d4c23163 100644
--- a/mobile/rpc-foundation/goldens/session-markdown-tab-refused.json
+++ b/mobile/rpc-foundation/goldens/session-markdown-tab-refused.json
@@ -3,9 +3,9 @@
   "family": "session.tab-documents",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a3daf9a05d05424959baf77feb45cb0c076d77d8c49e877941ed612cc1e5ce95",
   "scenarioSha256": "63227f28110e90acac78058baa875b1bc7f8895b5033e47016a2ffa9f42f66ce",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-startup-both-activation-sites.json b/mobile/rpc-foundation/goldens/session-startup-both-activation-sites.json
index 27c04907019e..140568a674b4 100644
--- a/mobile/rpc-foundation/goldens/session-startup-both-activation-sites.json
+++ b/mobile/rpc-foundation/goldens/session-startup-both-activation-sites.json
@@ -3,9 +3,9 @@
   "family": "session.startup",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "6b08c394e37fd572cf63a4c11934247d379008f11117aa5af33b2926fbd32d1e",
   "scenarioSha256": "efb7ff45ac09f1b7f0f3ad7f1b6f09d4d5c349e22de7d9c4d63ca93530552418",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-startup-floating-route-skips-activation.json b/mobile/rpc-foundation/goldens/session-startup-floating-route-skips-activation.json
index 089a83212633..e4ba7d6609e2 100644
--- a/mobile/rpc-foundation/goldens/session-startup-floating-route-skips-activation.json
+++ b/mobile/rpc-foundation/goldens/session-startup-floating-route-skips-activation.json
@@ -3,9 +3,9 @@
   "family": "session.startup",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "6b08c394e37fd572cf63a4c11934247d379008f11117aa5af33b2926fbd32d1e",
   "scenarioSha256": "82ff29efaa6ee0bf49ce41bfe7dff2083d0f942c10cc9d8bab48925354d17519",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-startup-keeps-terminals-visible-on-reconnect.json b/mobile/rpc-foundation/goldens/session-startup-keeps-terminals-visible-on-reconnect.json
index f1b46371acbe..47c68de8a4e1 100644
--- a/mobile/rpc-foundation/goldens/session-startup-keeps-terminals-visible-on-reconnect.json
+++ b/mobile/rpc-foundation/goldens/session-startup-keeps-terminals-visible-on-reconnect.json
@@ -3,9 +3,9 @@
   "family": "session.startup",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "6b08c394e37fd572cf63a4c11934247d379008f11117aa5af33b2926fbd32d1e",
   "scenarioSha256": "f540e4a06380a6a5d82d670230c76b7afc2c60302bc27dda13156b620095c5cc",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-startup-refused-tab-load-still-loads-terminals.json b/mobile/rpc-foundation/goldens/session-startup-refused-tab-load-still-loads-terminals.json
index 55d929a8fdf4..b74a116393ab 100644
--- a/mobile/rpc-foundation/goldens/session-startup-refused-tab-load-still-loads-terminals.json
+++ b/mobile/rpc-foundation/goldens/session-startup-refused-tab-load-still-loads-terminals.json
@@ -3,9 +3,9 @@
   "family": "session.startup",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "6b08c394e37fd572cf63a4c11934247d379008f11117aa5af33b2926fbd32d1e",
   "scenarioSha256": "18d0bbda11a394a13d0eaea12b8748dbeede1ae7212907b0ca70a9bafa037424",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-tab-activation-focus-and-activate.json b/mobile/rpc-foundation/goldens/session-tab-activation-focus-and-activate.json
index 8b3b11a237bc..237eb95ba4e5 100644
--- a/mobile/rpc-foundation/goldens/session-tab-activation-focus-and-activate.json
+++ b/mobile/rpc-foundation/goldens/session-tab-activation-focus-and-activate.json
@@ -3,9 +3,9 @@
   "family": "session.tab-activation",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "4a1e81ab3229c8fd10b3ad435568efec11a944e0f02a183f94e4b1f44a7e5de0",
   "scenarioSha256": "72a972996461cc58bda2b1c11dbb4ecdbdecd5ff2f977c3d61e40d635f63c1b9",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-tab-activation-refused.json b/mobile/rpc-foundation/goldens/session-tab-activation-refused.json
index ad6695ece1df..4a08a057eb85 100644
--- a/mobile/rpc-foundation/goldens/session-tab-activation-refused.json
+++ b/mobile/rpc-foundation/goldens/session-tab-activation-refused.json
@@ -3,9 +3,9 @@
   "family": "session.tab-activation",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "4a1e81ab3229c8fd10b3ad435568efec11a944e0f02a183f94e4b1f44a7e5de0",
   "scenarioSha256": "e5049c9ee2aef93194adf1b9540c1eb4b085e6f975648c5ed605718d19fc6afa",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-tab-activation-transport-error.json b/mobile/rpc-foundation/goldens/session-tab-activation-transport-error.json
index 72511ec075f2..d7816c487bf6 100644
--- a/mobile/rpc-foundation/goldens/session-tab-activation-transport-error.json
+++ b/mobile/rpc-foundation/goldens/session-tab-activation-transport-error.json
@@ -3,9 +3,9 @@
   "family": "session.tab-activation",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "4a1e81ab3229c8fd10b3ad435568efec11a944e0f02a183f94e4b1f44a7e5de0",
   "scenarioSha256": "44e25e8624c6d7f072c5f7aa3c706df29d0e751bb59b3fb58bec003233f7e5e3",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-tab-close-refused-keeps-tab.json b/mobile/rpc-foundation/goldens/session-tab-close-refused-keeps-tab.json
index c2c40b07c901..3729c8a4e0db 100644
--- a/mobile/rpc-foundation/goldens/session-tab-close-refused-keeps-tab.json
+++ b/mobile/rpc-foundation/goldens/session-tab-close-refused-keeps-tab.json
@@ -3,9 +3,9 @@
   "family": "session.tab-close",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "562c2f4ab669e774dd7045ecd9518e483845433fef6034688090f3b056df2815",
   "scenarioSha256": "1b3da0207aef65f4b2348aed334284259170c640e767fb354b9e95f3c1369445",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-tab-close-session-tab.json b/mobile/rpc-foundation/goldens/session-tab-close-session-tab.json
index 5ea59e25e385..890988141f10 100644
--- a/mobile/rpc-foundation/goldens/session-tab-close-session-tab.json
+++ b/mobile/rpc-foundation/goldens/session-tab-close-session-tab.json
@@ -3,9 +3,9 @@
   "family": "session.tab-close",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "562c2f4ab669e774dd7045ecd9518e483845433fef6034688090f3b056df2815",
   "scenarioSha256": "fe83a7d50d08f874d863eb8872bcb24d974c1dc46571a93d3f9184f8feba63a4",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-tab-close-terminal.json b/mobile/rpc-foundation/goldens/session-tab-close-terminal.json
index 0b26a0ae1ea0..d0c0b4e1e54c 100644
--- a/mobile/rpc-foundation/goldens/session-tab-close-terminal.json
+++ b/mobile/rpc-foundation/goldens/session-tab-close-terminal.json
@@ -3,9 +3,9 @@
   "family": "session.tab-close",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "562c2f4ab669e774dd7045ecd9518e483845433fef6034688090f3b056df2815",
   "scenarioSha256": "194b010d00fdeca85418870fd053ac500c38cae02e98c4bfc544b8fea78bbcb8",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-tab-closed.json b/mobile/rpc-foundation/goldens/session-tab-closed.json
index dbf49d7ac77f..58f7d2c89b56 100644
--- a/mobile/rpc-foundation/goldens/session-tab-closed.json
+++ b/mobile/rpc-foundation/goldens/session-tab-closed.json
@@ -3,9 +3,9 @@
   "family": "session.tab-close-session",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "562c2f4ab669e774dd7045ecd9518e483845433fef6034688090f3b056df2815",
   "scenarioSha256": "334b50e135103db21b93e60acff31047823371049171b57388df050179a6dcbc",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-tab-rename.json b/mobile/rpc-foundation/goldens/session-tab-rename.json
index 65125105cc65..25d6dd7ff728 100644
--- a/mobile/rpc-foundation/goldens/session-tab-rename.json
+++ b/mobile/rpc-foundation/goldens/session-tab-rename.json
@@ -3,9 +3,9 @@
   "family": "session.tab-close",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "562c2f4ab669e774dd7045ecd9518e483845433fef6034688090f3b056df2815",
   "scenarioSha256": "9e877af8539e5425f65edd6b3ff8af73e719aae2033980411a8e8a3b508dcd9e",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-tab-renamed.json b/mobile/rpc-foundation/goldens/session-tab-renamed.json
index 291d3d4e2155..ed066a874232 100644
--- a/mobile/rpc-foundation/goldens/session-tab-renamed.json
+++ b/mobile/rpc-foundation/goldens/session-tab-renamed.json
@@ -3,9 +3,9 @@
   "family": "session.tab-rename",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "562c2f4ab669e774dd7045ecd9518e483845433fef6034688090f3b056df2815",
   "scenarioSha256": "927e7cda255922c2e6ac893f0068679774ce5de988376df1ff8b7d5072f7d127",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-tabs-health-errored.json b/mobile/rpc-foundation/goldens/session-tabs-health-errored.json
index b79bd82b0b20..6da5f28240a5 100644
--- a/mobile/rpc-foundation/goldens/session-tabs-health-errored.json
+++ b/mobile/rpc-foundation/goldens/session-tabs-health-errored.json
@@ -3,9 +3,9 @@
   "family": "session.tabs-stream-health",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "4a1e81ab3229c8fd10b3ad435568efec11a944e0f02a183f94e4b1f44a7e5de0",
   "scenarioSha256": "4f55a21a5c42ff8d96ccb1b16de235f91f9f7e38fe90de7191c36c8c16cc4e43",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-tabs-health-reconciled.json b/mobile/rpc-foundation/goldens/session-tabs-health-reconciled.json
index f4b1a5670bce..9329f6d81518 100644
--- a/mobile/rpc-foundation/goldens/session-tabs-health-reconciled.json
+++ b/mobile/rpc-foundation/goldens/session-tabs-health-reconciled.json
@@ -3,9 +3,9 @@
   "family": "session.tabs-stream-health",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "4a1e81ab3229c8fd10b3ad435568efec11a944e0f02a183f94e4b1f44a7e5de0",
   "scenarioSha256": "29bee268df8e92fb1e3fd59291262c8d2d04a1b7e9fe40f6ed8dd181b0df828a",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-tabs-health-refused.json b/mobile/rpc-foundation/goldens/session-tabs-health-refused.json
index 38d721b3cc3f..157fefada794 100644
--- a/mobile/rpc-foundation/goldens/session-tabs-health-refused.json
+++ b/mobile/rpc-foundation/goldens/session-tabs-health-refused.json
@@ -3,9 +3,9 @@
   "family": "session.tabs-stream-health",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "4a1e81ab3229c8fd10b3ad435568efec11a944e0f02a183f94e4b1f44a7e5de0",
   "scenarioSha256": "101e8ce865088891800680db0e3df787b5f15ceb05ace9840931c384d9732d1c",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-tabs-health-stale-application-revision.json b/mobile/rpc-foundation/goldens/session-tabs-health-stale-application-revision.json
index 8bc8b65c458e..611c202a7584 100644
--- a/mobile/rpc-foundation/goldens/session-tabs-health-stale-application-revision.json
+++ b/mobile/rpc-foundation/goldens/session-tabs-health-stale-application-revision.json
@@ -3,9 +3,9 @@
   "family": "session.tabs-stream-health",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "4a1e81ab3229c8fd10b3ad435568efec11a944e0f02a183f94e4b1f44a7e5de0",
   "scenarioSha256": "5381b6ade796596ac362d4ed64349266e65fe8fd2b4fc778a54315d4b6fda3da",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-terminal-display-mode-auto-take-floor.json b/mobile/rpc-foundation/goldens/session-terminal-display-mode-auto-take-floor.json
index 22bfd8d776a4..a9d96292fd25 100644
--- a/mobile/rpc-foundation/goldens/session-terminal-display-mode-auto-take-floor.json
+++ b/mobile/rpc-foundation/goldens/session-terminal-display-mode-auto-take-floor.json
@@ -3,9 +3,9 @@
   "family": "session.terminal-display-mode",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "9e90ad39a8d4257adf30166757a6364c4710dc3ae9f06365f80a3dd8f1c94d89",
   "scenarioSha256": "a4ba13014a128c0e06a3d40b9e3fa3b0136b07f52a92c89a9afa3c73bc39d69f",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-terminal-display-mode-auto-without-device-token.json b/mobile/rpc-foundation/goldens/session-terminal-display-mode-auto-without-device-token.json
index 63a282211f46..53323a00850a 100644
--- a/mobile/rpc-foundation/goldens/session-terminal-display-mode-auto-without-device-token.json
+++ b/mobile/rpc-foundation/goldens/session-terminal-display-mode-auto-without-device-token.json
@@ -3,9 +3,9 @@
   "family": "session.terminal-display-mode",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "9e90ad39a8d4257adf30166757a6364c4710dc3ae9f06365f80a3dd8f1c94d89",
   "scenarioSha256": "10295c4779f010c5040a7a04264a8094c342752ea5d75d887ab99f1a57ba4b2e",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-terminal-display-mode-auto-without-viewport.json b/mobile/rpc-foundation/goldens/session-terminal-display-mode-auto-without-viewport.json
index db36e60c1df0..fc57e97eb1fc 100644
--- a/mobile/rpc-foundation/goldens/session-terminal-display-mode-auto-without-viewport.json
+++ b/mobile/rpc-foundation/goldens/session-terminal-display-mode-auto-without-viewport.json
@@ -3,9 +3,9 @@
   "family": "session.terminal-display-mode",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "9e90ad39a8d4257adf30166757a6364c4710dc3ae9f06365f80a3dd8f1c94d89",
   "scenarioSha256": "bb278c4da53b82d84cf50b308901ce196cc1f07c1a84790ad491319ee6746541",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-terminal-display-mode-drops-second-toggle.json b/mobile/rpc-foundation/goldens/session-terminal-display-mode-drops-second-toggle.json
index 66a8d010a2f5..fa0f936bac57 100644
--- a/mobile/rpc-foundation/goldens/session-terminal-display-mode-drops-second-toggle.json
+++ b/mobile/rpc-foundation/goldens/session-terminal-display-mode-drops-second-toggle.json
@@ -3,9 +3,9 @@
   "family": "session.terminal-display-mode",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "9e90ad39a8d4257adf30166757a6364c4710dc3ae9f06365f80a3dd8f1c94d89",
   "scenarioSha256": "16f645f758f2463bf6e16559d581afbc8794aa56069210f13a45952158d35a4c",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-terminal-display-mode-to-desktop.json b/mobile/rpc-foundation/goldens/session-terminal-display-mode-to-desktop.json
index 43957207deba..267ee68b793c 100644
--- a/mobile/rpc-foundation/goldens/session-terminal-display-mode-to-desktop.json
+++ b/mobile/rpc-foundation/goldens/session-terminal-display-mode-to-desktop.json
@@ -3,9 +3,9 @@
   "family": "session.terminal-display-mode",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "9e90ad39a8d4257adf30166757a6364c4710dc3ae9f06365f80a3dd8f1c94d89",
   "scenarioSha256": "fc81b0ac28970f9db27276c90f486306d74387f1404d757216a09823fedf680c",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-terminal-list-dedupes-handles.json b/mobile/rpc-foundation/goldens/session-terminal-list-dedupes-handles.json
index c3db575187bc..dde7b4e2b1dd 100644
--- a/mobile/rpc-foundation/goldens/session-terminal-list-dedupes-handles.json
+++ b/mobile/rpc-foundation/goldens/session-terminal-list-dedupes-handles.json
@@ -3,9 +3,9 @@
   "family": "session.terminal-inventory",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a3daf9a05d05424959baf77feb45cb0c076d77d8c49e877941ed612cc1e5ce95",
   "scenarioSha256": "d0f5ecc9c8fcb10193f481648215a54460ce5a54a8fbd2ded3921a9599fefc0a",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-terminal-list-empty-guarded.json b/mobile/rpc-foundation/goldens/session-terminal-list-empty-guarded.json
index a6112ca691eb..1304b6d2d153 100644
--- a/mobile/rpc-foundation/goldens/session-terminal-list-empty-guarded.json
+++ b/mobile/rpc-foundation/goldens/session-terminal-list-empty-guarded.json
@@ -3,9 +3,9 @@
   "family": "session.terminal-inventory",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a3daf9a05d05424959baf77feb45cb0c076d77d8c49e877941ed612cc1e5ce95",
   "scenarioSha256": "5c2b3237a14f9df9357ab458b2e21f2df8e68ad6bf6dc5670c0ace7eeb567e80",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-terminal-list-merged.json b/mobile/rpc-foundation/goldens/session-terminal-list-merged.json
index 2ea340c9428e..2466a6acb857 100644
--- a/mobile/rpc-foundation/goldens/session-terminal-list-merged.json
+++ b/mobile/rpc-foundation/goldens/session-terminal-list-merged.json
@@ -3,9 +3,9 @@
   "family": "session.terminal-inventory",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a3daf9a05d05424959baf77feb45cb0c076d77d8c49e877941ed612cc1e5ce95",
   "scenarioSha256": "9f3fb6e58e8d9ef4f52b2b6c0a42b6e4285d5786060f966261795cf64d055f65",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/session-terminal-list-refused.json b/mobile/rpc-foundation/goldens/session-terminal-list-refused.json
index cf3091853638..3060f266068a 100644
--- a/mobile/rpc-foundation/goldens/session-terminal-list-refused.json
+++ b/mobile/rpc-foundation/goldens/session-terminal-list-refused.json
@@ -3,9 +3,9 @@
   "family": "session.terminal-inventory",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "a3daf9a05d05424959baf77feb45cb0c076d77d8c49e877941ed612cc1e5ce95",
   "scenarioSha256": "10a8ba5332f4fc2f90cff537ca69f2f1474339cbc4996f67a6feaea70669fb25",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/settings-bot-overrides-fulfilled.json b/mobile/rpc-foundation/goldens/settings-bot-overrides-fulfilled.json
index 491e0e9e18a8..ea89099af12a 100644
--- a/mobile/rpc-foundation/goldens/settings-bot-overrides-fulfilled.json
+++ b/mobile/rpc-foundation/goldens/settings-bot-overrides-fulfilled.json
@@ -3,9 +3,9 @@
   "family": "settings.bot-overrides",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "4b4b4a8d1acaaec1c8dde0233dc49a696ffe53466578477efcbcdb7263dbd617",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/settings-bot-overrides-refresh-refused.json b/mobile/rpc-foundation/goldens/settings-bot-overrides-refresh-refused.json
index d1f7a90cfa86..7b34727382f7 100644
--- a/mobile/rpc-foundation/goldens/settings-bot-overrides-refresh-refused.json
+++ b/mobile/rpc-foundation/goldens/settings-bot-overrides-refresh-refused.json
@@ -3,9 +3,9 @@
   "family": "settings.bot-overrides",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "cac4980465661fba372e187699741123a4edeb9270125a0a1cad7bbb6a6adebd",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/settings-bot-overrides-refused.json b/mobile/rpc-foundation/goldens/settings-bot-overrides-refused.json
index 9cf30c8a1188..289cea6a4dd0 100644
--- a/mobile/rpc-foundation/goldens/settings-bot-overrides-refused.json
+++ b/mobile/rpc-foundation/goldens/settings-bot-overrides-refused.json
@@ -3,9 +3,9 @@
   "family": "settings.bot-overrides",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "f8ebd2348373b2b39c167735e0c418dfe868511fb5306ecba90cb6f2a905b95e",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/settings-bot-overrides-transport-error.json b/mobile/rpc-foundation/goldens/settings-bot-overrides-transport-error.json
index 700ea43d05e8..469cc04e8ba2 100644
--- a/mobile/rpc-foundation/goldens/settings-bot-overrides-transport-error.json
+++ b/mobile/rpc-foundation/goldens/settings-bot-overrides-transport-error.json
@@ -3,9 +3,9 @@
   "family": "settings.bot-overrides",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "f7e63144421a689f05cc50ad87ec901a9eaeb3163165656887be12a5f2753005",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/settings-home-coalesced.json b/mobile/rpc-foundation/goldens/settings-home-coalesced.json
index c8ef39133d92..4bbda1487af0 100644
--- a/mobile/rpc-foundation/goldens/settings-home-coalesced.json
+++ b/mobile/rpc-foundation/goldens/settings-home-coalesced.json
@@ -3,9 +3,9 @@
   "family": "settings.home-providers",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "d8d6f738ee11d84d6e9e546624f4babcb42476432f6bddbc74e8519d9ca18370",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/settings-home-providers-fulfilled.json b/mobile/rpc-foundation/goldens/settings-home-providers-fulfilled.json
index 60693dd76b97..6331f10b5b11 100644
--- a/mobile/rpc-foundation/goldens/settings-home-providers-fulfilled.json
+++ b/mobile/rpc-foundation/goldens/settings-home-providers-fulfilled.json
@@ -3,9 +3,9 @@
   "family": "settings.home-providers",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "a32b2fc99e830c58460e6f7c857aed0048738a55501e508eb236604680b9c235",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/settings-home-providers-refuse-after-data.json b/mobile/rpc-foundation/goldens/settings-home-providers-refuse-after-data.json
index a66ce1e4ce4a..fc844d3e4c5a 100644
--- a/mobile/rpc-foundation/goldens/settings-home-providers-refuse-after-data.json
+++ b/mobile/rpc-foundation/goldens/settings-home-providers-refuse-after-data.json
@@ -3,9 +3,9 @@
   "family": "settings.home-providers",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "78c48025c4af6cc0f1f136448c0ede9f76b7485d7b33b1356d11dec017bd9053",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/settings-home-providers-refused.json b/mobile/rpc-foundation/goldens/settings-home-providers-refused.json
index 81d5eeea7623..a33e64c910dd 100644
--- a/mobile/rpc-foundation/goldens/settings-home-providers-refused.json
+++ b/mobile/rpc-foundation/goldens/settings-home-providers-refused.json
@@ -3,9 +3,9 @@
   "family": "settings.home-providers",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "c22f33a0ed28622d4d53ae31e934056f87d2c10e8dc4475831ae1ee5fd3a9b8b",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/settings-home-providers-transport-error.json b/mobile/rpc-foundation/goldens/settings-home-providers-transport-error.json
index 3be0d46136a4..d226228b33c2 100644
--- a/mobile/rpc-foundation/goldens/settings-home-providers-transport-error.json
+++ b/mobile/rpc-foundation/goldens/settings-home-providers-transport-error.json
@@ -3,9 +3,9 @@
   "family": "settings.home-providers",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "4f16b43dddfb9257828342b0297317868df24b03fd98a89c66f5cd1897829d73",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/settings-new-tab-refused.json b/mobile/rpc-foundation/goldens/settings-new-tab-refused.json
index 559130bc4776..0fd8b5c545fa 100644
--- a/mobile/rpc-foundation/goldens/settings-new-tab-refused.json
+++ b/mobile/rpc-foundation/goldens/settings-new-tab-refused.json
@@ -3,9 +3,9 @@
   "family": "settings-agent-read",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "448cdbd12f4f6a14bb33947bfbbb1837aebeb28979db70c62f2ba2fbb4d89c8f",
   "scenarioSha256": "b6fb40be3bb92d7d9f1a79d99dee077cf95097077917679dc99702f912241fa4",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/settings-new-tab-ssh.json b/mobile/rpc-foundation/goldens/settings-new-tab-ssh.json
index e021d7ab450b..dd636c43ac7b 100644
--- a/mobile/rpc-foundation/goldens/settings-new-tab-ssh.json
+++ b/mobile/rpc-foundation/goldens/settings-new-tab-ssh.json
@@ -3,9 +3,9 @@
   "family": "settings-agent-read",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "448cdbd12f4f6a14bb33947bfbbb1837aebeb28979db70c62f2ba2fbb4d89c8f",
   "scenarioSha256": "31f8a348322551738b14207b3477bae492d48d45c5d51be4d97ffaca2fe2b6e1",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/settings-new-tab-transport-error.json b/mobile/rpc-foundation/goldens/settings-new-tab-transport-error.json
index de8ac267bcd6..0e85224755f3 100644
--- a/mobile/rpc-foundation/goldens/settings-new-tab-transport-error.json
+++ b/mobile/rpc-foundation/goldens/settings-new-tab-transport-error.json
@@ -3,9 +3,9 @@
   "family": "settings-agent-read",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "448cdbd12f4f6a14bb33947bfbbb1837aebeb28979db70c62f2ba2fbb4d89c8f",
   "scenarioSha256": "1347663aba0ada1eee8e88fac306757dc0d29fe21f0d062ac2d3968a30a2f214",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/settings-repo-cache-expiry.json b/mobile/rpc-foundation/goldens/settings-repo-cache-expiry.json
index 14ceb1efc61d..284bb8dccb92 100644
--- a/mobile/rpc-foundation/goldens/settings-repo-cache-expiry.json
+++ b/mobile/rpc-foundation/goldens/settings-repo-cache-expiry.json
@@ -3,9 +3,9 @@
   "family": "settings.repo-metadata",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "adebd553e2648278d719a1d7299cb36683fce714682a1ab7b49d4c9027eea34e",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/settings-repo-metadata-fulfilled.json b/mobile/rpc-foundation/goldens/settings-repo-metadata-fulfilled.json
index 61052713a2ae..7dc7dafba2d1 100644
--- a/mobile/rpc-foundation/goldens/settings-repo-metadata-fulfilled.json
+++ b/mobile/rpc-foundation/goldens/settings-repo-metadata-fulfilled.json
@@ -3,9 +3,9 @@
   "family": "settings.repo-metadata",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "b45eba2007e8e2668f524cd7503b8a711eba67816c9c35af5c3725a1afe32d8d",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/settings-repo-metadata-icons.json b/mobile/rpc-foundation/goldens/settings-repo-metadata-icons.json
index 152f040c646d..74b9b368ead1 100644
--- a/mobile/rpc-foundation/goldens/settings-repo-metadata-icons.json
+++ b/mobile/rpc-foundation/goldens/settings-repo-metadata-icons.json
@@ -3,9 +3,9 @@
   "family": "settings.repo-metadata",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "e67b645d8c4fa42e93d4cf36f45311922f7b9d9d8cc597a12f55c664d840901b",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/settings-repo-metadata-refuse-after-data.json b/mobile/rpc-foundation/goldens/settings-repo-metadata-refuse-after-data.json
index e24e3d403eaa..048e91bc4a8a 100644
--- a/mobile/rpc-foundation/goldens/settings-repo-metadata-refuse-after-data.json
+++ b/mobile/rpc-foundation/goldens/settings-repo-metadata-refuse-after-data.json
@@ -3,9 +3,9 @@
   "family": "settings.repo-metadata",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "b1c0b957b828c32e7ec388ec6668273fe84bbe5d11d8286b9a246fa92395a26e",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/settings-repo-metadata-refused.json b/mobile/rpc-foundation/goldens/settings-repo-metadata-refused.json
index 68f4f9837f48..ab5ab06802b1 100644
--- a/mobile/rpc-foundation/goldens/settings-repo-metadata-refused.json
+++ b/mobile/rpc-foundation/goldens/settings-repo-metadata-refused.json
@@ -3,9 +3,9 @@
   "family": "settings.repo-metadata",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "867b6905c8a533ddd1c7c8174bf4aadd5fd725cc72bdddbcb2ea8af26e219078",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/settings-repo-metadata-single-host.json b/mobile/rpc-foundation/goldens/settings-repo-metadata-single-host.json
index 733a131e4866..295f1a89e66d 100644
--- a/mobile/rpc-foundation/goldens/settings-repo-metadata-single-host.json
+++ b/mobile/rpc-foundation/goldens/settings-repo-metadata-single-host.json
@@ -3,9 +3,9 @@
   "family": "settings.repo-metadata",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "d8a00a72849f1ed254c3b35ebcc330dd1bb15b189f006bd1517853a19e53de6c",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/settings-repo-metadata-transport-error.json b/mobile/rpc-foundation/goldens/settings-repo-metadata-transport-error.json
index 85145546469c..762aa3301824 100644
--- a/mobile/rpc-foundation/goldens/settings-repo-metadata-transport-error.json
+++ b/mobile/rpc-foundation/goldens/settings-repo-metadata-transport-error.json
@@ -3,9 +3,9 @@
   "family": "settings.repo-metadata",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "741db13a84dbcec2e97e80605d742e69558954657c72f8450f3f8bc177dd01b6",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/settings-resume-metadata-fulfilled.json b/mobile/rpc-foundation/goldens/settings-resume-metadata-fulfilled.json
index 9687e6e83247..59f943199945 100644
--- a/mobile/rpc-foundation/goldens/settings-resume-metadata-fulfilled.json
+++ b/mobile/rpc-foundation/goldens/settings-resume-metadata-fulfilled.json
@@ -3,9 +3,9 @@
   "family": "settings.resume-metadata",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "7a8d0a5305aafea56733c229989b6e825fe9b8a681f48f6cef405350304520b6",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/settings-resume-metadata-refuse-after-data.json b/mobile/rpc-foundation/goldens/settings-resume-metadata-refuse-after-data.json
index 5d0556f977d9..238e05b697f3 100644
--- a/mobile/rpc-foundation/goldens/settings-resume-metadata-refuse-after-data.json
+++ b/mobile/rpc-foundation/goldens/settings-resume-metadata-refuse-after-data.json
@@ -3,9 +3,9 @@
   "family": "settings.resume-metadata",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "a11756ecaf7c2d3955b9512aa7479ca55d810341f1492f472985abb538e140e8",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/settings-resume-metadata-refused.json b/mobile/rpc-foundation/goldens/settings-resume-metadata-refused.json
index fdd98543b859..0d2aea110fec 100644
--- a/mobile/rpc-foundation/goldens/settings-resume-metadata-refused.json
+++ b/mobile/rpc-foundation/goldens/settings-resume-metadata-refused.json
@@ -3,9 +3,9 @@
   "family": "settings.resume-metadata",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "def0640be601a8013f9537f161b60d8c14ac9551931e5ee4d4cc2acd3c2baf2a",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/settings-resume-metadata-transport-error.json b/mobile/rpc-foundation/goldens/settings-resume-metadata-transport-error.json
index 867bd2fddd8a..b493d8301c26 100644
--- a/mobile/rpc-foundation/goldens/settings-resume-metadata-transport-error.json
+++ b/mobile/rpc-foundation/goldens/settings-resume-metadata-transport-error.json
@@ -3,9 +3,9 @@
   "family": "settings.resume-metadata",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "17c31d0c2b7ae5322fd59bafcfa1d2779ae9eff841e12c0cf16b27e454b49f13",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/settings-task-hydration-fulfilled.json b/mobile/rpc-foundation/goldens/settings-task-hydration-fulfilled.json
index a94d3bdf4615..f7402150df1c 100644
--- a/mobile/rpc-foundation/goldens/settings-task-hydration-fulfilled.json
+++ b/mobile/rpc-foundation/goldens/settings-task-hydration-fulfilled.json
@@ -3,9 +3,9 @@
   "family": "settings.task-hydration",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "c08cce5d1f71761dbf504863b736e5546abb42b9ff4ab8ced65c7c42e3d66c0e",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/settings-task-hydration-refuse-after-data.json b/mobile/rpc-foundation/goldens/settings-task-hydration-refuse-after-data.json
index 683394226574..675935e6a07c 100644
--- a/mobile/rpc-foundation/goldens/settings-task-hydration-refuse-after-data.json
+++ b/mobile/rpc-foundation/goldens/settings-task-hydration-refuse-after-data.json
@@ -3,9 +3,9 @@
   "family": "settings.task-hydration",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "b23c3076081901c89e8a8fb8d20028e03f030db040c9cd793b6f2c7cd49d8f25",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/settings-task-hydration-refused.json b/mobile/rpc-foundation/goldens/settings-task-hydration-refused.json
index 7c9fe7e82ad5..6f8b89786547 100644
--- a/mobile/rpc-foundation/goldens/settings-task-hydration-refused.json
+++ b/mobile/rpc-foundation/goldens/settings-task-hydration-refused.json
@@ -3,9 +3,9 @@
   "family": "settings.task-hydration",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "a510ff7505cddbd6dad3c7e5a2dcde206a5dab1940901511d72c97aca576a6f1",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/settings-task-hydration-transport-error.json b/mobile/rpc-foundation/goldens/settings-task-hydration-transport-error.json
index 1cc5b75b615f..6f16b412587e 100644
--- a/mobile/rpc-foundation/goldens/settings-task-hydration-transport-error.json
+++ b/mobile/rpc-foundation/goldens/settings-task-hydration-transport-error.json
@@ -3,9 +3,9 @@
   "family": "settings.task-hydration",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "d4a2fef3aefb78bdb4aed94fda982124f24a3af3832227654d324735f44aaeeb",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/settings-task-workspace-create-linear.json b/mobile/rpc-foundation/goldens/settings-task-workspace-create-linear.json
index b89795ab7b0b..d1e31a418e89 100644
--- a/mobile/rpc-foundation/goldens/settings-task-workspace-create-linear.json
+++ b/mobile/rpc-foundation/goldens/settings-task-workspace-create-linear.json
@@ -3,9 +3,9 @@
   "family": "settings.task-workspace-create",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c2eed306311a844cd6f2f84b6513c0a1182f86a5e3cace434385b8287c80d7c5",
   "scenarioSha256": "662c3e04e31bce5757f09f91e3e3739fb9d57767b7443be4dc936705b64b1432",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/settings-task-workspace-create-pr-start-point.json b/mobile/rpc-foundation/goldens/settings-task-workspace-create-pr-start-point.json
index fadef8b0f3a8..6f6ad5a0181a 100644
--- a/mobile/rpc-foundation/goldens/settings-task-workspace-create-pr-start-point.json
+++ b/mobile/rpc-foundation/goldens/settings-task-workspace-create-pr-start-point.json
@@ -3,9 +3,9 @@
   "family": "settings.task-workspace-create",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c2eed306311a844cd6f2f84b6513c0a1182f86a5e3cace434385b8287c80d7c5",
   "scenarioSha256": "8ae9e1dbb32d404eac9e01f71dacf1c37497030220a8e988c0093bb7ed2d159b",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/settings-task-workspace-fulfilled.json b/mobile/rpc-foundation/goldens/settings-task-workspace-fulfilled.json
index 2ea1de712e5a..fe964a2851b2 100644
--- a/mobile/rpc-foundation/goldens/settings-task-workspace-fulfilled.json
+++ b/mobile/rpc-foundation/goldens/settings-task-workspace-fulfilled.json
@@ -3,9 +3,9 @@
   "family": "settings.task-workspace",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c2eed306311a844cd6f2f84b6513c0a1182f86a5e3cace434385b8287c80d7c5",
   "scenarioSha256": "5c4c890e4c71e80fa8847a5e29700fc9df3ac3bd634bad6289db37522fadd621",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/settings-task-workspace-refused.json b/mobile/rpc-foundation/goldens/settings-task-workspace-refused.json
index fe7920f39be4..a4cf15ec20de 100644
--- a/mobile/rpc-foundation/goldens/settings-task-workspace-refused.json
+++ b/mobile/rpc-foundation/goldens/settings-task-workspace-refused.json
@@ -3,9 +3,9 @@
   "family": "settings.task-workspace",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c2eed306311a844cd6f2f84b6513c0a1182f86a5e3cace434385b8287c80d7c5",
   "scenarioSha256": "a699a0a5b128fa422dab0c7557b5aa18599b2d23fa6685cdcc02e17edf328af1",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/settings-task-workspace-transport-error.json b/mobile/rpc-foundation/goldens/settings-task-workspace-transport-error.json
index a7b4c593585d..bf1825fc881d 100644
--- a/mobile/rpc-foundation/goldens/settings-task-workspace-transport-error.json
+++ b/mobile/rpc-foundation/goldens/settings-task-workspace-transport-error.json
@@ -3,9 +3,9 @@
   "family": "settings.task-workspace",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c2eed306311a844cd6f2f84b6513c0a1182f86a5e3cace434385b8287c80d7c5",
   "scenarioSha256": "a5e812cd508826b3f01ec3798c621ab4303de6536a364113f01a4770dd197bb5",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/settings-task-write.json b/mobile/rpc-foundation/goldens/settings-task-write.json
index 4afb1fd75627..16b50f96b152 100644
--- a/mobile/rpc-foundation/goldens/settings-task-write.json
+++ b/mobile/rpc-foundation/goldens/settings-task-write.json
@@ -3,9 +3,9 @@
   "family": "settings-best-effort",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "d3b7f33d810e1fa420ac41a628cde9fe4a9e65fd57f89fbca0a40fc7d74951ab",
   "scenarioSha256": "bbcdefe16b07068a81f3c46ae60df01ccb0fbe5a7c1eade3f584f6f0130c23fe",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/settings-workspace-context-fulfilled.json b/mobile/rpc-foundation/goldens/settings-workspace-context-fulfilled.json
index 9a3c3dafde7f..6d9360e04cb9 100644
--- a/mobile/rpc-foundation/goldens/settings-workspace-context-fulfilled.json
+++ b/mobile/rpc-foundation/goldens/settings-workspace-context-fulfilled.json
@@ -3,9 +3,9 @@
   "family": "settings.workspace-context",
   "namedDeltas": ["new-workspace-runtime-context-null-results-degrade-to-absent"],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "287f94e469548f28c9d5591ff6ffb916fa22caa18776b091542b75704c9e1fee",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/settings-workspace-context-refuse-after-data.json b/mobile/rpc-foundation/goldens/settings-workspace-context-refuse-after-data.json
index a79cfdb2cfe8..5a194a928fc8 100644
--- a/mobile/rpc-foundation/goldens/settings-workspace-context-refuse-after-data.json
+++ b/mobile/rpc-foundation/goldens/settings-workspace-context-refuse-after-data.json
@@ -3,9 +3,9 @@
   "family": "settings.workspace-context",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "76793a56e7b9e596d8c42e9a5a1c47337db32d7437bec2e41d6e7253943f3fd8",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/settings-workspace-context-refused.json b/mobile/rpc-foundation/goldens/settings-workspace-context-refused.json
index 57d13e2ee6eb..66dfc1b18a61 100644
--- a/mobile/rpc-foundation/goldens/settings-workspace-context-refused.json
+++ b/mobile/rpc-foundation/goldens/settings-workspace-context-refused.json
@@ -3,9 +3,9 @@
   "family": "settings.workspace-context",
   "namedDeltas": ["new-workspace-runtime-context-null-results-degrade-to-absent"],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "ad19fc24973b49ee7d14bc31460a7e4af5d207db6a2375b52b5a0aa878e09205",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/settings-workspace-context-transport-error.json b/mobile/rpc-foundation/goldens/settings-workspace-context-transport-error.json
index 90572ff87b0b..a4355d8caed2 100644
--- a/mobile/rpc-foundation/goldens/settings-workspace-context-transport-error.json
+++ b/mobile/rpc-foundation/goldens/settings-workspace-context-transport-error.json
@@ -3,9 +3,9 @@
   "family": "settings.workspace-context",
   "namedDeltas": ["new-workspace-runtime-context-null-results-degrade-to-absent"],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "fc73116d95985606fe32f22d3f14f434a6d5cd49219416c9fa0f47f971fa6ff0",
   "scenarioSha256": "a2c80c9cdbb631f3a8fa648dfbb9e691418467d6ead8fe769d72e7e1d8b552b4",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/settings-workspace-submit-fulfilled.json b/mobile/rpc-foundation/goldens/settings-workspace-submit-fulfilled.json
index 4cfed3477a75..cceb0745c9b2 100644
--- a/mobile/rpc-foundation/goldens/settings-workspace-submit-fulfilled.json
+++ b/mobile/rpc-foundation/goldens/settings-workspace-submit-fulfilled.json
@@ -3,9 +3,9 @@
   "family": "settings.workspace-submit",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c2eed306311a844cd6f2f84b6513c0a1182f86a5e3cace434385b8287c80d7c5",
   "scenarioSha256": "b10ff86086c134284cb0446e8857cd4b55f5ff2bd0507388ec659a95f25e2a19",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/settings-workspace-submit-refused.json b/mobile/rpc-foundation/goldens/settings-workspace-submit-refused.json
index 081d28486a0c..3de0a24d8558 100644
--- a/mobile/rpc-foundation/goldens/settings-workspace-submit-refused.json
+++ b/mobile/rpc-foundation/goldens/settings-workspace-submit-refused.json
@@ -3,9 +3,9 @@
   "family": "settings.workspace-submit",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c2eed306311a844cd6f2f84b6513c0a1182f86a5e3cace434385b8287c80d7c5",
   "scenarioSha256": "373ea3743dac4e0845df01d5c8f75c909563b8c517f3858293a478234dc9ca5c",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/settings-workspace-submit-transport-error.json b/mobile/rpc-foundation/goldens/settings-workspace-submit-transport-error.json
index 02586fc64431..0e4952a9c408 100644
--- a/mobile/rpc-foundation/goldens/settings-workspace-submit-transport-error.json
+++ b/mobile/rpc-foundation/goldens/settings-workspace-submit-transport-error.json
@@ -3,9 +3,9 @@
   "family": "settings.workspace-submit",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c2eed306311a844cd6f2f84b6513c0a1182f86a5e3cace434385b8287c80d7c5",
   "scenarioSha256": "dfbacbd6392ae8e8199550952fe917e7c01182349df6c99a06eb0682cfd9175c",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/speech-audio-chunk-acknowledged.json b/mobile/rpc-foundation/goldens/speech-audio-chunk-acknowledged.json
index 8891f4f0f1dd..9dc8018eb3a3 100644
--- a/mobile/rpc-foundation/goldens/speech-audio-chunk-acknowledged.json
+++ b/mobile/rpc-foundation/goldens/speech-audio-chunk-acknowledged.json
@@ -3,9 +3,9 @@
   "family": "speech.dictation-chunk",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5d978690e3626892b83bdba64537f9b1e1bb66c2060a00517ceead042a6d2334",
   "scenarioSha256": "08b583790d858a4cb7cf7377126818b6d05766c02587343ec89a167f94094082",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/speech-desktop-start-fulfilled.json b/mobile/rpc-foundation/goldens/speech-desktop-start-fulfilled.json
index 4ee211b4c780..5829932c84a2 100644
--- a/mobile/rpc-foundation/goldens/speech-desktop-start-fulfilled.json
+++ b/mobile/rpc-foundation/goldens/speech-desktop-start-fulfilled.json
@@ -3,9 +3,9 @@
   "family": "speech.dictation-start",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5d978690e3626892b83bdba64537f9b1e1bb66c2060a00517ceead042a6d2334",
   "scenarioSha256": "35fadd03f2c98344e22d6aec2dc85ad15ca5ac8e092fc1c29a20366db5d46628",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/speech-desktop-start-recording-failed.json b/mobile/rpc-foundation/goldens/speech-desktop-start-recording-failed.json
index 921bf0847b06..c357fd080b1b 100644
--- a/mobile/rpc-foundation/goldens/speech-desktop-start-recording-failed.json
+++ b/mobile/rpc-foundation/goldens/speech-desktop-start-recording-failed.json
@@ -3,9 +3,9 @@
   "family": "speech.dictation-start",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5d978690e3626892b83bdba64537f9b1e1bb66c2060a00517ceead042a6d2334",
   "scenarioSha256": "75b8d1b7ed98b2bf7420986958d0a36222b007c535f85c1308b534301241ec2d",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/speech-desktop-start-superseded.json b/mobile/rpc-foundation/goldens/speech-desktop-start-superseded.json
index a0c31c84540b..ff341a979c27 100644
--- a/mobile/rpc-foundation/goldens/speech-desktop-start-superseded.json
+++ b/mobile/rpc-foundation/goldens/speech-desktop-start-superseded.json
@@ -3,9 +3,9 @@
   "family": "speech.dictation-start",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5d978690e3626892b83bdba64537f9b1e1bb66c2060a00517ceead042a6d2334",
   "scenarioSha256": "b1c4a6d6c94d54fb5f60eb2deb437562ededd724140dd3973d842d7c29bf1a60",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/speech-dictation-session-cancelled.json b/mobile/rpc-foundation/goldens/speech-dictation-session-cancelled.json
index e4c189745d60..33dce7408fe7 100644
--- a/mobile/rpc-foundation/goldens/speech-dictation-session-cancelled.json
+++ b/mobile/rpc-foundation/goldens/speech-dictation-session-cancelled.json
@@ -3,9 +3,9 @@
   "family": "speech.dictation-session",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5d978690e3626892b83bdba64537f9b1e1bb66c2060a00517ceead042a6d2334",
   "scenarioSha256": "5fe007d384731f954e086c16886055722fab45bafac23f4c4d52f0bb1f47acc9",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/speech-dictation-session-transcript.json b/mobile/rpc-foundation/goldens/speech-dictation-session-transcript.json
index 5c29bb8fdb0f..bbdd26362055 100644
--- a/mobile/rpc-foundation/goldens/speech-dictation-session-transcript.json
+++ b/mobile/rpc-foundation/goldens/speech-dictation-session-transcript.json
@@ -3,9 +3,9 @@
   "family": "speech.dictation-session",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5d978690e3626892b83bdba64537f9b1e1bb66c2060a00517ceead042a6d2334",
   "scenarioSha256": "cd3be6291ce181c4acfd7bacc0a8380f296fa5db13a52c4c0fcd75cfff3ae7d6",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/speech-setup-sheet-denied-to-mobile.json b/mobile/rpc-foundation/goldens/speech-setup-sheet-denied-to-mobile.json
index ef015ef0c710..e074e2b00fb9 100644
--- a/mobile/rpc-foundation/goldens/speech-setup-sheet-denied-to-mobile.json
+++ b/mobile/rpc-foundation/goldens/speech-setup-sheet-denied-to-mobile.json
@@ -3,9 +3,9 @@
   "family": "speech.setup-sheet",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5d978690e3626892b83bdba64537f9b1e1bb66c2060a00517ceead042a6d2334",
   "scenarioSha256": "69c1c20ea667a2b6a5b53aeb3d9af11b2b707e04086e15ee4ff9e954b1701851",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/speech-setup-sheet-fulfilled.json b/mobile/rpc-foundation/goldens/speech-setup-sheet-fulfilled.json
index 892e08aea03d..ad2c2b29997a 100644
--- a/mobile/rpc-foundation/goldens/speech-setup-sheet-fulfilled.json
+++ b/mobile/rpc-foundation/goldens/speech-setup-sheet-fulfilled.json
@@ -3,9 +3,9 @@
   "family": "speech.setup-sheet",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5d978690e3626892b83bdba64537f9b1e1bb66c2060a00517ceead042a6d2334",
   "scenarioSha256": "748e1bc0575fca6baab51b19cbbea5ac6185fca2a15dc4d8577212134355cd7e",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/speech-setup-sheet-legacy-desktop.json b/mobile/rpc-foundation/goldens/speech-setup-sheet-legacy-desktop.json
index ac5f900e38e2..f9ff05f9bfae 100644
--- a/mobile/rpc-foundation/goldens/speech-setup-sheet-legacy-desktop.json
+++ b/mobile/rpc-foundation/goldens/speech-setup-sheet-legacy-desktop.json
@@ -3,9 +3,9 @@
   "family": "speech.setup-sheet",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5d978690e3626892b83bdba64537f9b1e1bb66c2060a00517ceead042a6d2334",
   "scenarioSha256": "0ba2d8283fe98206c7500b62732e30acdc5b8e55f50b7ea8cae96403b803d519",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/speech-setup-sheet-model-vocabulary.json b/mobile/rpc-foundation/goldens/speech-setup-sheet-model-vocabulary.json
index 0336e23fe277..a861cd3df34f 100644
--- a/mobile/rpc-foundation/goldens/speech-setup-sheet-model-vocabulary.json
+++ b/mobile/rpc-foundation/goldens/speech-setup-sheet-model-vocabulary.json
@@ -3,9 +3,9 @@
   "family": "speech.setup-sheet",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "5d978690e3626892b83bdba64537f9b1e1bb66c2060a00517ceead042a6d2334",
   "scenarioSha256": "88e563aa087955b9ef6447b7e73711f90d5befb7c082270da58695c3a7169e67",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/structured-agent-session-created.json b/mobile/rpc-foundation/goldens/structured-agent-session-created.json
index c75c28edb7d4..c6ee43ea4892 100644
--- a/mobile/rpc-foundation/goldens/structured-agent-session-created.json
+++ b/mobile/rpc-foundation/goldens/structured-agent-session-created.json
@@ -3,9 +3,9 @@
   "family": "agentSession.structured-create",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "d340697a64a198066b1037a550afb9a0de7507246a545901d2fc0a23407f38d6",
   "scenarioSha256": "6e2d1633645a3072241729328cc71ea2979533d28797c14de86c8b3457ac018a",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/structured-launch-created.json b/mobile/rpc-foundation/goldens/structured-launch-created.json
index c20bcda3f33d..fee02228fc6d 100644
--- a/mobile/rpc-foundation/goldens/structured-launch-created.json
+++ b/mobile/rpc-foundation/goldens/structured-launch-created.json
@@ -3,9 +3,9 @@
   "family": "agentSession.structured-launch",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "d340697a64a198066b1037a550afb9a0de7507246a545901d2fc0a23407f38d6",
   "scenarioSha256": "0b5dd55868490e4d62d7d718821dec9634773b20d32fe9889523606a3f6b9168",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/structured-launch-definitive-refusal.json b/mobile/rpc-foundation/goldens/structured-launch-definitive-refusal.json
index 7d845d1838ad..a8ee592e54e4 100644
--- a/mobile/rpc-foundation/goldens/structured-launch-definitive-refusal.json
+++ b/mobile/rpc-foundation/goldens/structured-launch-definitive-refusal.json
@@ -3,9 +3,9 @@
   "family": "agentSession.structured-launch",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "d340697a64a198066b1037a550afb9a0de7507246a545901d2fc0a23407f38d6",
   "scenarioSha256": "64916f2d8ab51132b08c3e8c72f89c3a2698d83945def294f42edf22eb6d08ea",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/structured-launch-replays-dropped-create.json b/mobile/rpc-foundation/goldens/structured-launch-replays-dropped-create.json
index 48649b36f2b2..682e73782d98 100644
--- a/mobile/rpc-foundation/goldens/structured-launch-replays-dropped-create.json
+++ b/mobile/rpc-foundation/goldens/structured-launch-replays-dropped-create.json
@@ -3,9 +3,9 @@
   "family": "agentSession.structured-launch",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "d340697a64a198066b1037a550afb9a0de7507246a545901d2fc0a23407f38d6",
   "scenarioSha256": "fb1ab1209f0a7c03ee1b3985401ce2df080d673532f045c4fca26e754d5e5a9f",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/structured-launch-support-refused.json b/mobile/rpc-foundation/goldens/structured-launch-support-refused.json
index 6213d2f9af72..11a1ae08e72f 100644
--- a/mobile/rpc-foundation/goldens/structured-launch-support-refused.json
+++ b/mobile/rpc-foundation/goldens/structured-launch-support-refused.json
@@ -3,9 +3,9 @@
   "family": "agentSession.structured-launch",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "d340697a64a198066b1037a550afb9a0de7507246a545901d2fc0a23407f38d6",
   "scenarioSha256": "d8928461e3295d265872e5f98fb8aad445b5edc55fc76f137e45c0cff0d8b961",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/structured-launch-unsupported.json b/mobile/rpc-foundation/goldens/structured-launch-unsupported.json
index eae1215c052a..1d2957a23943 100644
--- a/mobile/rpc-foundation/goldens/structured-launch-unsupported.json
+++ b/mobile/rpc-foundation/goldens/structured-launch-unsupported.json
@@ -3,9 +3,9 @@
   "family": "agentSession.structured-launch",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "d340697a64a198066b1037a550afb9a0de7507246a545901d2fc0a23407f38d6",
   "scenarioSha256": "c30e9cae49e134715c009a98f423f3e4a9d552c014be3e28b38e98c57999b6f5",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tasks-route-repo-list.json b/mobile/rpc-foundation/goldens/tasks-route-repo-list.json
index 316c610fad01..f8ef9c417d67 100644
--- a/mobile/rpc-foundation/goldens/tasks-route-repo-list.json
+++ b/mobile/rpc-foundation/goldens/tasks-route-repo-list.json
@@ -3,9 +3,9 @@
   "family": "tasks.route-repo-list",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "23f974df8b57c723069605de1db80c339ead286b18aae38e67fce03ea50c5180",
   "scenarioSha256": "b62ca571d4defcc2e53960033c5b4eb3f7e406b57664664cbc6a173041a9f803",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/terminal-gesture-flush-and-clear.json b/mobile/rpc-foundation/goldens/terminal-gesture-flush-and-clear.json
index 0decfef4021e..3f3a88e9bae4 100644
--- a/mobile/rpc-foundation/goldens/terminal-gesture-flush-and-clear.json
+++ b/mobile/rpc-foundation/goldens/terminal-gesture-flush-and-clear.json
@@ -3,9 +3,9 @@
   "family": "session.terminal-gesture-input",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "9d119d5ec320e2538105d6ff673b9f4b8e3decbe46527947489dffbcf2ac0472",
   "scenarioSha256": "97e6d63c6b4bc154e94be6cf3dcd25620b4656cacd2b62cdc872ff793b39ebd2",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/terminal-input-send-accepted.json b/mobile/rpc-foundation/goldens/terminal-input-send-accepted.json
index 537418d4329d..10cd3e655730 100644
--- a/mobile/rpc-foundation/goldens/terminal-input-send-accepted.json
+++ b/mobile/rpc-foundation/goldens/terminal-input-send-accepted.json
@@ -3,9 +3,9 @@
   "family": "session.terminal-input-send",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "e7e3718f685e3713cf1b8209d59d618741f892bd286853b79bb456c59cec8d86",
   "scenarioSha256": "7cdbf3308411ed6764cc1cdcc0f663a27ddc9390fcc329c49fad4b27cb5a7fd5",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/terminal-input-send-refused.json b/mobile/rpc-foundation/goldens/terminal-input-send-refused.json
index 61aabf47aa34..7ffb62337a0c 100644
--- a/mobile/rpc-foundation/goldens/terminal-input-send-refused.json
+++ b/mobile/rpc-foundation/goldens/terminal-input-send-refused.json
@@ -3,9 +3,9 @@
   "family": "session.terminal-input-send",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "e7e3718f685e3713cf1b8209d59d618741f892bd286853b79bb456c59cec8d86",
   "scenarioSha256": "eb5e47e3accccc7ca280ca029f97405905b0cee8a05afb9ef15448314041d9d4",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/terminal-live-input-accepted.json b/mobile/rpc-foundation/goldens/terminal-live-input-accepted.json
index ee247754bcd8..ca673c6d5965 100644
--- a/mobile/rpc-foundation/goldens/terminal-live-input-accepted.json
+++ b/mobile/rpc-foundation/goldens/terminal-live-input-accepted.json
@@ -3,9 +3,9 @@
   "family": "session.terminal-input-send",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "e7e3718f685e3713cf1b8209d59d618741f892bd286853b79bb456c59cec8d86",
   "scenarioSha256": "391a4f681443f099e6ea4417811d82d730242dfe07e21f74b0ad49a98bcd7c81",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/terminal-paste-accepted.json b/mobile/rpc-foundation/goldens/terminal-paste-accepted.json
index bdf802d1d6c5..e8fd3b767c4e 100644
--- a/mobile/rpc-foundation/goldens/terminal-paste-accepted.json
+++ b/mobile/rpc-foundation/goldens/terminal-paste-accepted.json
@@ -3,9 +3,9 @@
   "family": "session.terminal-paste",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "e7e3718f685e3713cf1b8209d59d618741f892bd286853b79bb456c59cec8d86",
   "scenarioSha256": "48bb495de3b54f2b2edc0543f0f232ff4fd6068d5aca34d005766ebacbb078c9",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/terminal-paste-refused.json b/mobile/rpc-foundation/goldens/terminal-paste-refused.json
index f17eaaef73df..f488db77f385 100644
--- a/mobile/rpc-foundation/goldens/terminal-paste-refused.json
+++ b/mobile/rpc-foundation/goldens/terminal-paste-refused.json
@@ -3,9 +3,9 @@
   "family": "session.terminal-paste",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "e7e3718f685e3713cf1b8209d59d618741f892bd286853b79bb456c59cec8d86",
   "scenarioSha256": "78e62b9125252accc7f6d2ce772b93c84a917b01d2df308c1f9fb163d9127665",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/terminal-query-reply-accepted.json b/mobile/rpc-foundation/goldens/terminal-query-reply-accepted.json
index cadde16acb1e..19d2effe75d2 100644
--- a/mobile/rpc-foundation/goldens/terminal-query-reply-accepted.json
+++ b/mobile/rpc-foundation/goldens/terminal-query-reply-accepted.json
@@ -3,10 +3,10 @@
   "family": "terminal.query-reply",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
-  "adapterSha256": "7588d30f33a8bb846c48f160aa9a4a8138176662bb2fb6be7bbdf352f553d05f",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "42e1fe434b591ab5a945b6b366bbb20b567085d58bade63413f2251e8202b255",
   "scenarioSha256": "bfa1d5f83b4112d3cce6a19e9dc27daf9281ed99745bc01bd19226dd7b268c71",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/terminal-query-reply-unsubscribed.json b/mobile/rpc-foundation/goldens/terminal-query-reply-unsubscribed.json
index 774ea8fc6067..d7676e22d1c0 100644
--- a/mobile/rpc-foundation/goldens/terminal-query-reply-unsubscribed.json
+++ b/mobile/rpc-foundation/goldens/terminal-query-reply-unsubscribed.json
@@ -3,10 +3,10 @@
   "family": "terminal.query-reply",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
-  "adapterSha256": "7588d30f33a8bb846c48f160aa9a4a8138176662bb2fb6be7bbdf352f553d05f",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "42e1fe434b591ab5a945b6b366bbb20b567085d58bade63413f2251e8202b255",
   "scenarioSha256": "ad03596f31eeccc5e9eb7e5061b1af705f9af249f76377c8f5ce1a9db257770f",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/terminal-raw-input-refused.json b/mobile/rpc-foundation/goldens/terminal-raw-input-refused.json
index cea013dd1569..9946ad0e68dd 100644
--- a/mobile/rpc-foundation/goldens/terminal-raw-input-refused.json
+++ b/mobile/rpc-foundation/goldens/terminal-raw-input-refused.json
@@ -3,10 +3,10 @@
   "family": "terminal.raw-input",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
-  "adapterSha256": "7588d30f33a8bb846c48f160aa9a4a8138176662bb2fb6be7bbdf352f553d05f",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "42e1fe434b591ab5a945b6b366bbb20b567085d58bade63413f2251e8202b255",
   "scenarioSha256": "76fc0c1499ec48a67428f35eba705f68147d2ff2c344b67aa0c9d60ed999f173",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/terminal-raw-input-reported.json b/mobile/rpc-foundation/goldens/terminal-raw-input-reported.json
index 94f5f1807edd..3c20eb9d6a9d 100644
--- a/mobile/rpc-foundation/goldens/terminal-raw-input-reported.json
+++ b/mobile/rpc-foundation/goldens/terminal-raw-input-reported.json
@@ -3,10 +3,10 @@
   "family": "terminal.raw-input",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
-  "adapterSha256": "7588d30f33a8bb846c48f160aa9a4a8138176662bb2fb6be7bbdf352f553d05f",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "42e1fe434b591ab5a945b6b366bbb20b567085d58bade63413f2251e8202b255",
   "scenarioSha256": "579077efd3a4652a6930af3f6690138c20536270cbcd7274246047d2e322199f",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/terminal-takeover-report-accepted.json b/mobile/rpc-foundation/goldens/terminal-takeover-report-accepted.json
index 466898ae45ad..e3fab46651aa 100644
--- a/mobile/rpc-foundation/goldens/terminal-takeover-report-accepted.json
+++ b/mobile/rpc-foundation/goldens/terminal-takeover-report-accepted.json
@@ -3,10 +3,10 @@
   "family": "terminal.takeover-report",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
-  "adapterSha256": "7588d30f33a8bb846c48f160aa9a4a8138176662bb2fb6be7bbdf352f553d05f",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "42e1fe434b591ab5a945b6b366bbb20b567085d58bade63413f2251e8202b255",
   "scenarioSha256": "c2236257032fab72ebb007391313eec4e5f0a1bdb4fbcbd907117f9914ffafc6",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/terminal-takeover-report-retried.json b/mobile/rpc-foundation/goldens/terminal-takeover-report-retried.json
index e703b5a060d8..58e97af466f4 100644
--- a/mobile/rpc-foundation/goldens/terminal-takeover-report-retried.json
+++ b/mobile/rpc-foundation/goldens/terminal-takeover-report-retried.json
@@ -3,10 +3,10 @@
   "family": "terminal.takeover-report",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
-  "adapterSha256": "7588d30f33a8bb846c48f160aa9a4a8138176662bb2fb6be7bbdf352f553d05f",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "42e1fe434b591ab5a945b6b366bbb20b567085d58bade63413f2251e8202b255",
   "scenarioSha256": "8ad436ca6c3de8b0b3148326337acce18a8a4cf3c514acad1a4530a001f28c75",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/terminal-viewport-refit-applied.json b/mobile/rpc-foundation/goldens/terminal-viewport-refit-applied.json
index 61c1bdae0cf3..174eef0fa8f8 100644
--- a/mobile/rpc-foundation/goldens/terminal-viewport-refit-applied.json
+++ b/mobile/rpc-foundation/goldens/terminal-viewport-refit-applied.json
@@ -3,10 +3,10 @@
   "family": "terminal.viewport-refit",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
-  "adapterSha256": "7588d30f33a8bb846c48f160aa9a4a8138176662bb2fb6be7bbdf352f553d05f",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "42e1fe434b591ab5a945b6b366bbb20b567085d58bade63413f2251e8202b255",
   "scenarioSha256": "f966c2ef2e747a5231f423147ddaf38458cb08c719434b274016a5e4abc10771",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/terminal-viewport-refit-legacy-desktop.json b/mobile/rpc-foundation/goldens/terminal-viewport-refit-legacy-desktop.json
index ca11ed6f47c4..8ea1c81bd6b6 100644
--- a/mobile/rpc-foundation/goldens/terminal-viewport-refit-legacy-desktop.json
+++ b/mobile/rpc-foundation/goldens/terminal-viewport-refit-legacy-desktop.json
@@ -3,10 +3,10 @@
   "family": "terminal.viewport-refit",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
-  "adapterSha256": "7588d30f33a8bb846c48f160aa9a4a8138176662bb2fb6be7bbdf352f553d05f",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
+  "adapterSha256": "42e1fe434b591ab5a945b6b366bbb20b567085d58bade63413f2251e8202b255",
   "scenarioSha256": "88961a369cb7a7fa92708bb83aa7f818e904018e8cfcedc2f50ef9a0058c8b9d",
   "platform": "darwin",
   "scenarioVersion": 1,
diff --git a/mobile/rpc-foundation/goldens/terminal-worktree-connection-resolved.json b/mobile/rpc-foundation/goldens/terminal-worktree-connection-resolved.json
index 1ddd88513440..b60492b1439f 100644
--- a/mobile/rpc-foundation/goldens/terminal-worktree-connection-resolved.json
+++ b/mobile/rpc-foundation/goldens/terminal-worktree-connection-resolved.json
@@ -3,9 +3,9 @@
   "family": "session.worktree-connection",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "e7e3718f685e3713cf1b8209d59d618741f892bd286853b79bb456c59cec8d86",
   "scenarioSha256": "f921c4a764cdf7a4c1df0a7ec618d7c3b1d8a05ee4baa42d66f3bc0d95b3f550",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tk-create-github.json b/mobile/rpc-foundation/goldens/tk-create-github.json
index 7c361f1d9971..9edbf4c7c5b7 100644
--- a/mobile/rpc-foundation/goldens/tk-create-github.json
+++ b/mobile/rpc-foundation/goldens/tk-create-github.json
@@ -3,9 +3,9 @@
   "family": "tasks.task-create-github",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "07a15e900363faa25bc364f5bc1c330f96798abfeaed35210428c2ac558586b8",
   "scenarioSha256": "260a84280f69c43ac582149d9befe6ae547b2ad2b5f56a181d8e3a1314a0a071",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tk-create-gitlab.json b/mobile/rpc-foundation/goldens/tk-create-gitlab.json
index 433649183a6c..9ac18768f93d 100644
--- a/mobile/rpc-foundation/goldens/tk-create-gitlab.json
+++ b/mobile/rpc-foundation/goldens/tk-create-gitlab.json
@@ -3,9 +3,9 @@
   "family": "tasks.task-create-gitlab",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "07a15e900363faa25bc364f5bc1c330f96798abfeaed35210428c2ac558586b8",
   "scenarioSha256": "a4d3d1f322d49593056bd20f4122bbf0309d2161123e404161950bcab65decd5",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tk-create-linear.json b/mobile/rpc-foundation/goldens/tk-create-linear.json
index c8e5bad1c8af..23757a18f58e 100644
--- a/mobile/rpc-foundation/goldens/tk-create-linear.json
+++ b/mobile/rpc-foundation/goldens/tk-create-linear.json
@@ -3,9 +3,9 @@
   "family": "tasks.task-create-linear",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "07a15e900363faa25bc364f5bc1c330f96798abfeaed35210428c2ac558586b8",
   "scenarioSha256": "f6c7eea985190d9edeead5b36f90c8aa98679f69d19dab7579fec88841645259",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tk-item-checks-files.json b/mobile/rpc-foundation/goldens/tk-item-checks-files.json
index 59d8065cbfb2..15de8ca97705 100644
--- a/mobile/rpc-foundation/goldens/tk-item-checks-files.json
+++ b/mobile/rpc-foundation/goldens/tk-item-checks-files.json
@@ -3,9 +3,9 @@
   "family": "tasks.item-checks-files",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "8c4218bfb2af227da5386f29989cec438f2c6187f39ce1c06859e136ea920bfa",
   "scenarioSha256": "644a27c1e3fa6bfa73c7822c2949e9534508e5e3a996b0e8e56be6326658d123",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tk-item-comment-github.json b/mobile/rpc-foundation/goldens/tk-item-comment-github.json
index 20745fbfc8c0..37c608059188 100644
--- a/mobile/rpc-foundation/goldens/tk-item-comment-github.json
+++ b/mobile/rpc-foundation/goldens/tk-item-comment-github.json
@@ -3,9 +3,9 @@
   "family": "tasks.item-comment-github",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "8f68885d57a9aa76d80ba0ee29a95bdbaa98cef29c79c68ce75d67202cde7bfe",
   "scenarioSha256": "fb0cdff9e02bac37b0bd8e1c47922474823d46fa735f3069ed70cdad41800be6",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tk-item-comment-gitlab-mr.json b/mobile/rpc-foundation/goldens/tk-item-comment-gitlab-mr.json
index ac1dc62f9247..3ba00962b59e 100644
--- a/mobile/rpc-foundation/goldens/tk-item-comment-gitlab-mr.json
+++ b/mobile/rpc-foundation/goldens/tk-item-comment-gitlab-mr.json
@@ -3,9 +3,9 @@
   "family": "tasks.item-comment-gitlab-mr",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "8f68885d57a9aa76d80ba0ee29a95bdbaa98cef29c79c68ce75d67202cde7bfe",
   "scenarioSha256": "cb696d402b8af2b9a54d4d6f9d85abfc12280e73b360196e55ec25530e610eee",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tk-item-comment-gitlab.json b/mobile/rpc-foundation/goldens/tk-item-comment-gitlab.json
index be839f84ccc8..d2149f2bbb81 100644
--- a/mobile/rpc-foundation/goldens/tk-item-comment-gitlab.json
+++ b/mobile/rpc-foundation/goldens/tk-item-comment-gitlab.json
@@ -3,9 +3,9 @@
   "family": "tasks.item-comment-gitlab",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "8f68885d57a9aa76d80ba0ee29a95bdbaa98cef29c79c68ce75d67202cde7bfe",
   "scenarioSha256": "d993b9f74cf8c5d7af8d31a73cf19d97141c54f6fcf009e98ca5b9106f3ba35b",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tk-item-detail-github-reactions.json b/mobile/rpc-foundation/goldens/tk-item-detail-github-reactions.json
index 26662179c5b7..ec05baaebff0 100644
--- a/mobile/rpc-foundation/goldens/tk-item-detail-github-reactions.json
+++ b/mobile/rpc-foundation/goldens/tk-item-detail-github-reactions.json
@@ -3,9 +3,9 @@
   "family": "tasks.item-detail-github",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c0ef16b959002e4a3c5347114a0844b95670e274ef010d910b6671ac5f49e783",
   "scenarioSha256": "885dafb68162f5777fc050af34dbe3443940d041a45bfb18c51dfcf433ed54f3",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tk-item-detail-github.json b/mobile/rpc-foundation/goldens/tk-item-detail-github.json
index f60a340e6fa6..b9c0b5cf4d9a 100644
--- a/mobile/rpc-foundation/goldens/tk-item-detail-github.json
+++ b/mobile/rpc-foundation/goldens/tk-item-detail-github.json
@@ -3,9 +3,9 @@
   "family": "tasks.item-detail-github",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c0ef16b959002e4a3c5347114a0844b95670e274ef010d910b6671ac5f49e783",
   "scenarioSha256": "5fbff075d7da476f93c2a7da871c2afacc67822d1317acf6c23000195e2b2576",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tk-item-detail-gitlab-reactions.json b/mobile/rpc-foundation/goldens/tk-item-detail-gitlab-reactions.json
index bd20b8e746fd..3a85e9dfb3bc 100644
--- a/mobile/rpc-foundation/goldens/tk-item-detail-gitlab-reactions.json
+++ b/mobile/rpc-foundation/goldens/tk-item-detail-gitlab-reactions.json
@@ -3,9 +3,9 @@
   "family": "tasks.item-detail-gitlab",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c0ef16b959002e4a3c5347114a0844b95670e274ef010d910b6671ac5f49e783",
   "scenarioSha256": "c49d2df6c31f37c488ce9d29a801dd8ad0aa668ae380fc60b1f790ef508281d8",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tk-item-detail-gitlab.json b/mobile/rpc-foundation/goldens/tk-item-detail-gitlab.json
index 3434fb57e59d..85466d2d9a5d 100644
--- a/mobile/rpc-foundation/goldens/tk-item-detail-gitlab.json
+++ b/mobile/rpc-foundation/goldens/tk-item-detail-gitlab.json
@@ -3,9 +3,9 @@
   "family": "tasks.item-detail-gitlab",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c0ef16b959002e4a3c5347114a0844b95670e274ef010d910b6671ac5f49e783",
   "scenarioSha256": "36bbd34ed8b8f67e516ce7cd230b01ab88f14369fda632037c46dbbd1a0d95a3",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tk-item-detail-linear.json b/mobile/rpc-foundation/goldens/tk-item-detail-linear.json
index 76728744a9bd..4104e9807b09 100644
--- a/mobile/rpc-foundation/goldens/tk-item-detail-linear.json
+++ b/mobile/rpc-foundation/goldens/tk-item-detail-linear.json
@@ -3,9 +3,9 @@
   "family": "tasks.item-detail-linear",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c0ef16b959002e4a3c5347114a0844b95670e274ef010d910b6671ac5f49e783",
   "scenarioSha256": "f0407adc774b29553bdd177885e8ea9047127c4ebe8298de160a421fb4c1fe67",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tk-item-detail-metadata.json b/mobile/rpc-foundation/goldens/tk-item-detail-metadata.json
index ced46d3f9471..b7d3c3548a8b 100644
--- a/mobile/rpc-foundation/goldens/tk-item-detail-metadata.json
+++ b/mobile/rpc-foundation/goldens/tk-item-detail-metadata.json
@@ -3,9 +3,9 @@
   "family": "tasks.item-detail-metadata",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "58ea1553e04017c993aea4753aace41ee664705a3fdb3b18569c5a9d7968cf06",
   "scenarioSha256": "e6429c235d8c0b0376f71fea7b47c3b9ff22b850c92922b85ff993ae8b6cd6d0",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tk-item-merge-gitlab.json b/mobile/rpc-foundation/goldens/tk-item-merge-gitlab.json
index c6f9670e7b7e..f0f1cee85a66 100644
--- a/mobile/rpc-foundation/goldens/tk-item-merge-gitlab.json
+++ b/mobile/rpc-foundation/goldens/tk-item-merge-gitlab.json
@@ -3,9 +3,9 @@
   "family": "tasks.item-merge-gitlab",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "8f68885d57a9aa76d80ba0ee29a95bdbaa98cef29c79c68ce75d67202cde7bfe",
   "scenarioSha256": "28d8dfb15fec1ecaaa1c675c9c8c0cdc196e184a6884625c44dfe1f0f9fc8e7e",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tk-item-metadata-github.json b/mobile/rpc-foundation/goldens/tk-item-metadata-github.json
index ae59f792565c..5baef64f2e6d 100644
--- a/mobile/rpc-foundation/goldens/tk-item-metadata-github.json
+++ b/mobile/rpc-foundation/goldens/tk-item-metadata-github.json
@@ -3,9 +3,9 @@
   "family": "tasks.item-metadata-github",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "97cfbcd82778ed6517ca2d10b2f3ad5a8d366e380d7846c1e89d5a5baf17e739",
   "scenarioSha256": "010c65eaa056c5df0b867dd5b5851e206e8479e9fcce02515f1e326df4b8889c",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tk-item-metadata-gitlab-mr.json b/mobile/rpc-foundation/goldens/tk-item-metadata-gitlab-mr.json
index e339ebff4df0..084b033b3961 100644
--- a/mobile/rpc-foundation/goldens/tk-item-metadata-gitlab-mr.json
+++ b/mobile/rpc-foundation/goldens/tk-item-metadata-gitlab-mr.json
@@ -3,9 +3,9 @@
   "family": "tasks.item-metadata-gitlab-mr",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "97cfbcd82778ed6517ca2d10b2f3ad5a8d366e380d7846c1e89d5a5baf17e739",
   "scenarioSha256": "daa54da6cfb8d96c2a66c138beeaf70c764f96a60bdc84f2ff4cde80483cb365",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tk-item-metadata-gitlab.json b/mobile/rpc-foundation/goldens/tk-item-metadata-gitlab.json
index f14ba1b8359b..ce49d95e7478 100644
--- a/mobile/rpc-foundation/goldens/tk-item-metadata-gitlab.json
+++ b/mobile/rpc-foundation/goldens/tk-item-metadata-gitlab.json
@@ -3,9 +3,9 @@
   "family": "tasks.item-metadata-gitlab",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "97cfbcd82778ed6517ca2d10b2f3ad5a8d366e380d7846c1e89d5a5baf17e739",
   "scenarioSha256": "4daf374f040e27836c154245d6a7fbad9ba3f6e6c0c9608218451286e4712d6b",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tk-item-reply-merge.json b/mobile/rpc-foundation/goldens/tk-item-reply-merge.json
index 5203e2305225..0b84be2a477c 100644
--- a/mobile/rpc-foundation/goldens/tk-item-reply-merge.json
+++ b/mobile/rpc-foundation/goldens/tk-item-reply-merge.json
@@ -3,9 +3,9 @@
   "family": "tasks.item-reply-merge",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "8f68885d57a9aa76d80ba0ee29a95bdbaa98cef29c79c68ce75d67202cde7bfe",
   "scenarioSha256": "b8e60092a29ea4944a891adc026444cc1da18c52221876f9e7c07b450b34cea8",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tk-item-review-github.json b/mobile/rpc-foundation/goldens/tk-item-review-github.json
index efe812657fbc..4f77e5964ab6 100644
--- a/mobile/rpc-foundation/goldens/tk-item-review-github.json
+++ b/mobile/rpc-foundation/goldens/tk-item-review-github.json
@@ -3,9 +3,9 @@
   "family": "tasks.item-review-github",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "8f68885d57a9aa76d80ba0ee29a95bdbaa98cef29c79c68ce75d67202cde7bfe",
   "scenarioSha256": "3ba358ff7b6a95d9158257225483f77578dfa10c8643cdf89f8a81e0022997e9",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tk-item-status-gitlab-mr.json b/mobile/rpc-foundation/goldens/tk-item-status-gitlab-mr.json
index 102768524393..fd4bf42ab43f 100644
--- a/mobile/rpc-foundation/goldens/tk-item-status-gitlab-mr.json
+++ b/mobile/rpc-foundation/goldens/tk-item-status-gitlab-mr.json
@@ -3,9 +3,9 @@
   "family": "tasks.item-status-gitlab-mr",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "8c4218bfb2af227da5386f29989cec438f2c6187f39ce1c06859e136ea920bfa",
   "scenarioSha256": "5de4936aed0efd0d8bd5bc5ce893d561f6bc3d0fdf4a76c9e33e7cbefd6ec362",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tk-item-status-gitlab.json b/mobile/rpc-foundation/goldens/tk-item-status-gitlab.json
index 1160bfd353b3..f1f85970c988 100644
--- a/mobile/rpc-foundation/goldens/tk-item-status-gitlab.json
+++ b/mobile/rpc-foundation/goldens/tk-item-status-gitlab.json
@@ -3,9 +3,9 @@
   "family": "tasks.item-status-gitlab",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "8c4218bfb2af227da5386f29989cec438f2c6187f39ce1c06859e136ea920bfa",
   "scenarioSha256": "85414544a9e8570567770b43e6bf5cfcc406c9b9b4ffed3a4ff0c8187beb7549",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tk-linear-connect.json b/mobile/rpc-foundation/goldens/tk-linear-connect.json
index a7e2566b06c5..74b99af9a036 100644
--- a/mobile/rpc-foundation/goldens/tk-linear-connect.json
+++ b/mobile/rpc-foundation/goldens/tk-linear-connect.json
@@ -3,9 +3,9 @@
   "family": "tasks.linear-connect",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "07a15e900363faa25bc364f5bc1c330f96798abfeaed35210428c2ac558586b8",
   "scenarioSha256": "d1bd7ad9b647a50403953ba01d3a4bcccc5f4020c2aefa6146cca8c7688612c1",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tk-linear-item.json b/mobile/rpc-foundation/goldens/tk-linear-item.json
index 293d0fb682b9..ed7a2a596aba 100644
--- a/mobile/rpc-foundation/goldens/tk-linear-item.json
+++ b/mobile/rpc-foundation/goldens/tk-linear-item.json
@@ -3,9 +3,9 @@
   "family": "tasks.linear-item",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "97cfbcd82778ed6517ca2d10b2f3ad5a8d366e380d7846c1e89d5a5baf17e739",
   "scenarioSha256": "354eaff5243b3aae774c375aa303548d82c4db106a89ada39907d6654fa549b3",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tk-linear-team-context.json b/mobile/rpc-foundation/goldens/tk-linear-team-context.json
index 4854d7b8d3a4..a6770bfc5ac5 100644
--- a/mobile/rpc-foundation/goldens/tk-linear-team-context.json
+++ b/mobile/rpc-foundation/goldens/tk-linear-team-context.json
@@ -3,9 +3,9 @@
   "family": "tasks.linear-team-context",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "58ea1553e04017c993aea4753aace41ee664705a3fdb3b18569c5a9d7968cf06",
   "scenarioSha256": "524c2421e61d663dd1344a47ab0552c3bb029ad09e0b6271eac91f1548e8265c",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tk-list-gitlab-items.json b/mobile/rpc-foundation/goldens/tk-list-gitlab-items.json
index b0429fdb5959..37eff4e25338 100644
--- a/mobile/rpc-foundation/goldens/tk-list-gitlab-items.json
+++ b/mobile/rpc-foundation/goldens/tk-list-gitlab-items.json
@@ -3,9 +3,9 @@
   "family": "tasks.task-list-gitlab-items",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "07a15e900363faa25bc364f5bc1c330f96798abfeaed35210428c2ac558586b8",
   "scenarioSha256": "9b26b8f112021fe65c156b7d4067071551bcdab44a5858f8a933f7ace66e6f80",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tk-list-gitlab-todos.json b/mobile/rpc-foundation/goldens/tk-list-gitlab-todos.json
index 7033c1531de2..2cbfdc71345d 100644
--- a/mobile/rpc-foundation/goldens/tk-list-gitlab-todos.json
+++ b/mobile/rpc-foundation/goldens/tk-list-gitlab-todos.json
@@ -3,9 +3,9 @@
   "family": "tasks.task-list-gitlab-todos",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "07a15e900363faa25bc364f5bc1c330f96798abfeaed35210428c2ac558586b8",
   "scenarioSha256": "ba91378284c5dc3dc470f0601e4ff0202622a8d1fb97f27ab45c096d65c0bb48",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tk-list-linear.json b/mobile/rpc-foundation/goldens/tk-list-linear.json
index 58f28a73fbdd..2cdee6f7f840 100644
--- a/mobile/rpc-foundation/goldens/tk-list-linear.json
+++ b/mobile/rpc-foundation/goldens/tk-list-linear.json
@@ -3,9 +3,9 @@
   "family": "tasks.task-list-linear",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "07a15e900363faa25bc364f5bc1c330f96798abfeaed35210428c2ac558586b8",
   "scenarioSha256": "216ddbf8cb71481d179563d8b033d7dc6cd71bface049e83073b977909776fc9",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tk-project-board-load.json b/mobile/rpc-foundation/goldens/tk-project-board-load.json
index 782a83622ed2..d495876e45a7 100644
--- a/mobile/rpc-foundation/goldens/tk-project-board-load.json
+++ b/mobile/rpc-foundation/goldens/tk-project-board-load.json
@@ -3,9 +3,9 @@
   "family": "tasks.project-board-load",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c4272385ed3b0de4feab38de9e4f6363ecd6317fdd4de47f76a98eb18abaf371",
   "scenarioSha256": "7840e811e81d3645f1c874b871158202a53432989f3b5c849df12550b082813b",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tk-project-repo-slugs.json b/mobile/rpc-foundation/goldens/tk-project-repo-slugs.json
index 9de7692a92bd..13bea2fa111a 100644
--- a/mobile/rpc-foundation/goldens/tk-project-repo-slugs.json
+++ b/mobile/rpc-foundation/goldens/tk-project-repo-slugs.json
@@ -3,9 +3,9 @@
   "family": "tasks.project-repo-slugs",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "c4272385ed3b0de4feab38de9e4f6363ecd6317fdd4de47f76a98eb18abaf371",
   "scenarioSha256": "a83d5768892764af2dd6866f03d51c09aef63d1c5d3e0645bd5e1c16454b201f",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tk-project-row-comments-issue.json b/mobile/rpc-foundation/goldens/tk-project-row-comments-issue.json
index a48e89de1d94..ad2609c4a53b 100644
--- a/mobile/rpc-foundation/goldens/tk-project-row-comments-issue.json
+++ b/mobile/rpc-foundation/goldens/tk-project-row-comments-issue.json
@@ -3,9 +3,9 @@
   "family": "tasks.project-row-comments-issue",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "55058202df36c8b951510215936e496ea88d3d71a6690090a13c52deb13e34e1",
   "scenarioSha256": "6f1bfb05a9df6482200bbab4400fd07a09955d47fcc468e1d2feda1ca9875aa1",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tk-project-row-comments-pr.json b/mobile/rpc-foundation/goldens/tk-project-row-comments-pr.json
index 2f4b58e69b61..cc93506baee5 100644
--- a/mobile/rpc-foundation/goldens/tk-project-row-comments-pr.json
+++ b/mobile/rpc-foundation/goldens/tk-project-row-comments-pr.json
@@ -3,9 +3,9 @@
   "family": "tasks.project-row-comments-pr",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "55058202df36c8b951510215936e496ea88d3d71a6690090a13c52deb13e34e1",
   "scenarioSha256": "e5ff558593fd32d66e6ba1722ebf54d50992c9c2b6db41ef2435b47972fbd0fd",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tk-project-row-detail.json b/mobile/rpc-foundation/goldens/tk-project-row-detail.json
index 0f205c2e16d9..f81ea5085c2d 100644
--- a/mobile/rpc-foundation/goldens/tk-project-row-detail.json
+++ b/mobile/rpc-foundation/goldens/tk-project-row-detail.json
@@ -3,9 +3,9 @@
   "family": "tasks.project-row-detail",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "f8f6e5d500f959b9b15c5498885a05422747880b6aef4ad795bc3064ebbacea6",
   "scenarioSha256": "f572b37cfd15f41f283e5f96b772a1055670f80e68064ac81477d9b768fc971a",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tk-project-row-fields.json b/mobile/rpc-foundation/goldens/tk-project-row-fields.json
index cf0f54e2e682..ecf900b7b9b4 100644
--- a/mobile/rpc-foundation/goldens/tk-project-row-fields.json
+++ b/mobile/rpc-foundation/goldens/tk-project-row-fields.json
@@ -3,9 +3,9 @@
   "family": "tasks.project-row-fields",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "370aeaee59978071ccb821da13c9e6114936c168947b608539cdb80d40cc9889",
   "scenarioSha256": "af54a351f4b79fff4a11948fc47a9f5194733065682ff96d6b46b9ae292e327e",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tk-project-row-files-merge.json b/mobile/rpc-foundation/goldens/tk-project-row-files-merge.json
index d64ec18237b1..50770208962d 100644
--- a/mobile/rpc-foundation/goldens/tk-project-row-files-merge.json
+++ b/mobile/rpc-foundation/goldens/tk-project-row-files-merge.json
@@ -3,9 +3,9 @@
   "family": "tasks.project-row-files-merge",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "b228732762828412ad3d9eec3ece00a897d866046e37044322c3911758d6e0a9",
   "scenarioSha256": "fef96700723edcf7d0a55ee05928a0293b8a28217b161cd3823437f3bc33b1ec",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tk-project-row-metadata-load.json b/mobile/rpc-foundation/goldens/tk-project-row-metadata-load.json
index 230a31e798c5..b22f912af37d 100644
--- a/mobile/rpc-foundation/goldens/tk-project-row-metadata-load.json
+++ b/mobile/rpc-foundation/goldens/tk-project-row-metadata-load.json
@@ -3,9 +3,9 @@
   "family": "tasks.project-row-metadata-load",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "f8f6e5d500f959b9b15c5498885a05422747880b6aef4ad795bc3064ebbacea6",
   "scenarioSha256": "60ea389fe16734fb53db01101f1feb4496653a99faa09e4309b3790a50d558d7",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tk-project-row-review-checks.json b/mobile/rpc-foundation/goldens/tk-project-row-review-checks.json
index 26463bebe14c..065975ecbd28 100644
--- a/mobile/rpc-foundation/goldens/tk-project-row-review-checks.json
+++ b/mobile/rpc-foundation/goldens/tk-project-row-review-checks.json
@@ -3,9 +3,9 @@
   "family": "tasks.project-row-review-checks",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "370aeaee59978071ccb821da13c9e6114936c168947b608539cdb80d40cc9889",
   "scenarioSha256": "08caec8e0ab5e674aabbf034ca88fc4a000c4b645ad6397afe6dc18db1f7c098",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tk-project-row-threads.json b/mobile/rpc-foundation/goldens/tk-project-row-threads.json
index 915690c2dcc8..3f77cab43cf5 100644
--- a/mobile/rpc-foundation/goldens/tk-project-row-threads.json
+++ b/mobile/rpc-foundation/goldens/tk-project-row-threads.json
@@ -3,9 +3,9 @@
   "family": "tasks.project-row-threads",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "55058202df36c8b951510215936e496ea88d3d71a6690090a13c52deb13e34e1",
   "scenarioSha256": "815f55c0fb848fc9345a66bb7b71b1351f17e56129e005eb1776d6b47c831647",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tk-provider-load.json b/mobile/rpc-foundation/goldens/tk-provider-load.json
index d08f7425e7ca..ad1489bb3ad3 100644
--- a/mobile/rpc-foundation/goldens/tk-provider-load.json
+++ b/mobile/rpc-foundation/goldens/tk-provider-load.json
@@ -3,9 +3,9 @@
   "family": "tasks.provider-load",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "07a15e900363faa25bc364f5bc1c330f96798abfeaed35210428c2ac558586b8",
   "scenarioSha256": "21b6272878cba5f2b41c89378c178933ffc9406fe69b9c693fc5021a265ef2c9",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/transport-capability-probe-cutover-reasks-fast.json b/mobile/rpc-foundation/goldens/transport-capability-probe-cutover-reasks-fast.json
index 2fa90b966893..fc3e688a0d54 100644
--- a/mobile/rpc-foundation/goldens/transport-capability-probe-cutover-reasks-fast.json
+++ b/mobile/rpc-foundation/goldens/transport-capability-probe-cutover-reasks-fast.json
@@ -3,9 +3,9 @@
   "family": "transport.capability-probe",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "34b382b13fe75e8ef4002325287c95b3c4db62eeaaf3762af7fbaf6f836c2fa1",
   "scenarioSha256": "c5d28c2973881ae6cc94c7d8f6eef544046461f15e236634489afd272b5f1e6b",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/transport-capability-probe-non-string-capabilities-drop.json b/mobile/rpc-foundation/goldens/transport-capability-probe-non-string-capabilities-drop.json
index ed3d571ae5d5..c5f1d44911e2 100644
--- a/mobile/rpc-foundation/goldens/transport-capability-probe-non-string-capabilities-drop.json
+++ b/mobile/rpc-foundation/goldens/transport-capability-probe-non-string-capabilities-drop.json
@@ -3,9 +3,9 @@
   "family": "transport.capability-probe",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "34b382b13fe75e8ef4002325287c95b3c4db62eeaaf3762af7fbaf6f836c2fa1",
   "scenarioSha256": "95ef0a8b60bf92ef5c12a73f923dc143989b34374fb319f812fbaa58c79aa6a6",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/transport-capability-probe-publishes.json b/mobile/rpc-foundation/goldens/transport-capability-probe-publishes.json
index 8d8deee35bf4..4283db94a478 100644
--- a/mobile/rpc-foundation/goldens/transport-capability-probe-publishes.json
+++ b/mobile/rpc-foundation/goldens/transport-capability-probe-publishes.json
@@ -3,9 +3,9 @@
   "family": "transport.capability-probe",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "34b382b13fe75e8ef4002325287c95b3c4db62eeaaf3762af7fbaf6f836c2fa1",
   "scenarioSha256": "6e0c3a784992e383a05ccfdf34e44e6f74ebd55ff17c4de0b05b2dfb4197c681",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/transport-capability-probe-refused-backs-off.json b/mobile/rpc-foundation/goldens/transport-capability-probe-refused-backs-off.json
index bb64ee9edf1c..ebb9d1fb9328 100644
--- a/mobile/rpc-foundation/goldens/transport-capability-probe-refused-backs-off.json
+++ b/mobile/rpc-foundation/goldens/transport-capability-probe-refused-backs-off.json
@@ -3,9 +3,9 @@
   "family": "transport.capability-probe",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "34b382b13fe75e8ef4002325287c95b3c4db62eeaaf3762af7fbaf6f836c2fa1",
   "scenarioSha256": "2ba1e1d70c98e2fd0d2d2dce6f68c11a186756f05207747e156375fc613940d7",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/transport-host-status-gates-drop-keeps-capabilities.json b/mobile/rpc-foundation/goldens/transport-host-status-gates-drop-keeps-capabilities.json
index 3324c401b7a1..9aa6562f39ff 100644
--- a/mobile/rpc-foundation/goldens/transport-host-status-gates-drop-keeps-capabilities.json
+++ b/mobile/rpc-foundation/goldens/transport-host-status-gates-drop-keeps-capabilities.json
@@ -3,9 +3,9 @@
   "family": "transport.host-status-gates",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "34b382b13fe75e8ef4002325287c95b3c4db62eeaaf3762af7fbaf6f836c2fa1",
   "scenarioSha256": "f25f444aca6cf768c602bf879e6b30235d1c4c0632636cfd245bd6e27959756b",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/transport-host-status-gates-ready.json b/mobile/rpc-foundation/goldens/transport-host-status-gates-ready.json
index 8b746ad85b54..40132e9e1ecc 100644
--- a/mobile/rpc-foundation/goldens/transport-host-status-gates-ready.json
+++ b/mobile/rpc-foundation/goldens/transport-host-status-gates-ready.json
@@ -3,9 +3,9 @@
   "family": "transport.host-status-gates",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "34b382b13fe75e8ef4002325287c95b3c4db62eeaaf3762af7fbaf6f836c2fa1",
   "scenarioSha256": "9c5095c24bdf5ab65d6387cc22b9984fee3aa7d5ce93d96bcb470944ac253f86",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/transport-host-status-gates-refused-degrades.json b/mobile/rpc-foundation/goldens/transport-host-status-gates-refused-degrades.json
index 816364f8ef66..99d4963780df 100644
--- a/mobile/rpc-foundation/goldens/transport-host-status-gates-refused-degrades.json
+++ b/mobile/rpc-foundation/goldens/transport-host-status-gates-refused-degrades.json
@@ -3,9 +3,9 @@
   "family": "transport.host-status-gates",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "34b382b13fe75e8ef4002325287c95b3c4db62eeaaf3762af7fbaf6f836c2fa1",
   "scenarioSha256": "a7871b5f1d37b0156970858d5a7fcab3105de7a8a6bfe827299a36f2b2ba5548",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/transport-pairing-race-both-refused.json b/mobile/rpc-foundation/goldens/transport-pairing-race-both-refused.json
index 3852a6f8d7a1..3d655a8f42bd 100644
--- a/mobile/rpc-foundation/goldens/transport-pairing-race-both-refused.json
+++ b/mobile/rpc-foundation/goldens/transport-pairing-race-both-refused.json
@@ -3,9 +3,9 @@
   "family": "transport.pairing-race",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "34b382b13fe75e8ef4002325287c95b3c4db62eeaaf3762af7fbaf6f836c2fa1",
   "scenarioSha256": "4f0ddbea3c08ea3e90f6e707215a4831f06aed408065b45d0771028d256d6b12",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/transport-pairing-race-direct-completes-first.json b/mobile/rpc-foundation/goldens/transport-pairing-race-direct-completes-first.json
index b5306d491f0e..92a2b4eecd70 100644
--- a/mobile/rpc-foundation/goldens/transport-pairing-race-direct-completes-first.json
+++ b/mobile/rpc-foundation/goldens/transport-pairing-race-direct-completes-first.json
@@ -3,9 +3,9 @@
   "family": "transport.pairing-race",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "34b382b13fe75e8ef4002325287c95b3c4db62eeaaf3762af7fbaf6f836c2fa1",
   "scenarioSha256": "488173fa313295f97aa88fb4bf1944fdb655e37cfd2444e9d15515bd6ad82d95",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/transport-pairing-race-relay-completes-first.json b/mobile/rpc-foundation/goldens/transport-pairing-race-relay-completes-first.json
index e5676bddd33a..2feb84554d1a 100644
--- a/mobile/rpc-foundation/goldens/transport-pairing-race-relay-completes-first.json
+++ b/mobile/rpc-foundation/goldens/transport-pairing-race-relay-completes-first.json
@@ -3,9 +3,9 @@
   "family": "transport.pairing-race",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "34b382b13fe75e8ef4002325287c95b3c4db62eeaaf3762af7fbaf6f836c2fa1",
   "scenarioSha256": "dee9824e5ec32115fa7dfaaf223fc34c28d057a5526ac3dad42365543288a934",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/transport-pairing-race-relay-wins-when-direct-refused.json b/mobile/rpc-foundation/goldens/transport-pairing-race-relay-wins-when-direct-refused.json
index 6bf7b0f35a0c..957af87f1608 100644
--- a/mobile/rpc-foundation/goldens/transport-pairing-race-relay-wins-when-direct-refused.json
+++ b/mobile/rpc-foundation/goldens/transport-pairing-race-relay-wins-when-direct-refused.json
@@ -3,9 +3,9 @@
   "family": "transport.pairing-race",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "34b382b13fe75e8ef4002325287c95b3c4db62eeaaf3762af7fbaf6f836c2fa1",
   "scenarioSha256": "a34ffec446f9bbc465bd3f7d0a43166c9bc221a6ece8714e0b5717169625cf43",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tw-capabilities-advertised.json b/mobile/rpc-foundation/goldens/tw-capabilities-advertised.json
index 74c468088d3b..556c4b649c22 100644
--- a/mobile/rpc-foundation/goldens/tw-capabilities-advertised.json
+++ b/mobile/rpc-foundation/goldens/tw-capabilities-advertised.json
@@ -3,9 +3,9 @@
   "family": "worktree.runtime-capabilities",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "52a76b7a830b32287bce14abbe1b9d9ac70e71eafe5b4c6801c2eb14a4150125",
   "scenarioSha256": "9d79bcfd6957d11d5ce8c3296f1038a3cfab81eedad7f990b44071104dfd0f91",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tw-capabilities-cutover-retried.json b/mobile/rpc-foundation/goldens/tw-capabilities-cutover-retried.json
index 9f85167d7e72..8573b4902c7d 100644
--- a/mobile/rpc-foundation/goldens/tw-capabilities-cutover-retried.json
+++ b/mobile/rpc-foundation/goldens/tw-capabilities-cutover-retried.json
@@ -3,9 +3,9 @@
   "family": "worktree.runtime-capabilities",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "52a76b7a830b32287bce14abbe1b9d9ac70e71eafe5b4c6801c2eb14a4150125",
   "scenarioSha256": "fb9c0e4b7c34f9bd1bd355b606c6ba75a7583cff3788000b7ed013612f5574fe",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tw-capabilities-legacy-idempotency.json b/mobile/rpc-foundation/goldens/tw-capabilities-legacy-idempotency.json
index b271b649f951..12ac26904e2b 100644
--- a/mobile/rpc-foundation/goldens/tw-capabilities-legacy-idempotency.json
+++ b/mobile/rpc-foundation/goldens/tw-capabilities-legacy-idempotency.json
@@ -3,9 +3,9 @@
   "family": "worktree.runtime-capabilities",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "52a76b7a830b32287bce14abbe1b9d9ac70e71eafe5b4c6801c2eb14a4150125",
   "scenarioSha256": "d73fed49e0a7e3e054d5c2fa75780f98bf78b6fa7e02f1ccb2fdc49465cf2fe5",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tw-create-retry-agent-launched.json b/mobile/rpc-foundation/goldens/tw-create-retry-agent-launched.json
index 0c0fa3ab18a1..35bcbfa6500d 100644
--- a/mobile/rpc-foundation/goldens/tw-create-retry-agent-launched.json
+++ b/mobile/rpc-foundation/goldens/tw-create-retry-agent-launched.json
@@ -3,9 +3,9 @@
   "family": "worktree.agent-launch-create",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "52a76b7a830b32287bce14abbe1b9d9ac70e71eafe5b4c6801c2eb14a4150125",
   "scenarioSha256": "85595f5fdde16441d22bf07c14c65edda6cb90019d036aae2c5031d19664e66f",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tw-create-retry-ambiguous-after-drop.json b/mobile/rpc-foundation/goldens/tw-create-retry-ambiguous-after-drop.json
index ed6fa5322e60..0e109a4c28c4 100644
--- a/mobile/rpc-foundation/goldens/tw-create-retry-ambiguous-after-drop.json
+++ b/mobile/rpc-foundation/goldens/tw-create-retry-ambiguous-after-drop.json
@@ -3,9 +3,9 @@
   "family": "worktree.create-retry",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "52a76b7a830b32287bce14abbe1b9d9ac70e71eafe5b4c6801c2eb14a4150125",
   "scenarioSha256": "a99bb80a5826af1df8d74114fcc5654aa42c9208747b512cea9bd5ca65b64ccb",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tw-create-retry-ambiguous-while-connected.json b/mobile/rpc-foundation/goldens/tw-create-retry-ambiguous-while-connected.json
index 56655ec2ab0f..5174ee540e1c 100644
--- a/mobile/rpc-foundation/goldens/tw-create-retry-ambiguous-while-connected.json
+++ b/mobile/rpc-foundation/goldens/tw-create-retry-ambiguous-while-connected.json
@@ -3,9 +3,9 @@
   "family": "worktree.create-retry",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "52a76b7a830b32287bce14abbe1b9d9ac70e71eafe5b4c6801c2eb14a4150125",
   "scenarioSha256": "3cda09e4a4ad4092f5f9a48b7c9715a99a51eb3bc4bed00f7054537a9e21cea9",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tw-create-retry-ambiguous-without-idempotency.json b/mobile/rpc-foundation/goldens/tw-create-retry-ambiguous-without-idempotency.json
index c2cf5aee5e2a..1937c32ae842 100644
--- a/mobile/rpc-foundation/goldens/tw-create-retry-ambiguous-without-idempotency.json
+++ b/mobile/rpc-foundation/goldens/tw-create-retry-ambiguous-without-idempotency.json
@@ -3,9 +3,9 @@
   "family": "worktree.create-retry",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "52a76b7a830b32287bce14abbe1b9d9ac70e71eafe5b4c6801c2eb14a4150125",
   "scenarioSha256": "61097c13b262a4454510936fa9c9554a07865b610f18407f1b67bdd74476df08",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tw-create-retry-created.json b/mobile/rpc-foundation/goldens/tw-create-retry-created.json
index d1c9253370a8..b419ccb9433d 100644
--- a/mobile/rpc-foundation/goldens/tw-create-retry-created.json
+++ b/mobile/rpc-foundation/goldens/tw-create-retry-created.json
@@ -3,9 +3,9 @@
   "family": "worktree.create-retry",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "52a76b7a830b32287bce14abbe1b9d9ac70e71eafe5b4c6801c2eb14a4150125",
   "scenarioSha256": "0278216fee698c00118bb0e73a7fe755dc59c3b8e2b0459153edae64f155774c",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tw-create-retry-name-collision.json b/mobile/rpc-foundation/goldens/tw-create-retry-name-collision.json
index 354f4b117ff2..addd1959fa95 100644
--- a/mobile/rpc-foundation/goldens/tw-create-retry-name-collision.json
+++ b/mobile/rpc-foundation/goldens/tw-create-retry-name-collision.json
@@ -3,9 +3,9 @@
   "family": "worktree.create-retry",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "52a76b7a830b32287bce14abbe1b9d9ac70e71eafe5b4c6801c2eb14a4150125",
   "scenarioSha256": "6cb658dadc9e146c4f36c6ce643451e72300b8cdda19cc684ffa9fb2b0822c0a",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tw-create-retry-unretryable-refusal.json b/mobile/rpc-foundation/goldens/tw-create-retry-unretryable-refusal.json
index a29c422369d9..38dfeaf46a9c 100644
--- a/mobile/rpc-foundation/goldens/tw-create-retry-unretryable-refusal.json
+++ b/mobile/rpc-foundation/goldens/tw-create-retry-unretryable-refusal.json
@@ -3,9 +3,9 @@
   "family": "worktree.create-retry",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "52a76b7a830b32287bce14abbe1b9d9ac70e71eafe5b4c6801c2eb14a4150125",
   "scenarioSha256": "16abe9e1a8d4cff17b3ea29d40277ae30a3d555a4a9efa08b2745c3a85b02740",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tw-create-retry-warning-kept.json b/mobile/rpc-foundation/goldens/tw-create-retry-warning-kept.json
index e4670e286b1d..6516a11579da 100644
--- a/mobile/rpc-foundation/goldens/tw-create-retry-warning-kept.json
+++ b/mobile/rpc-foundation/goldens/tw-create-retry-warning-kept.json
@@ -3,9 +3,9 @@
   "family": "worktree.create-retry",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "52a76b7a830b32287bce14abbe1b9d9ac70e71eafe5b4c6801c2eb14a4150125",
   "scenarioSha256": "f469b2b7d61e7fc500fa97b5548f5a3732b0dbcdb405412a514a609f786dfbb5",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tw-hosted-base-resolved.json b/mobile/rpc-foundation/goldens/tw-hosted-base-resolved.json
index fa09275fc5b0..ee87403dcdd0 100644
--- a/mobile/rpc-foundation/goldens/tw-hosted-base-resolved.json
+++ b/mobile/rpc-foundation/goldens/tw-hosted-base-resolved.json
@@ -3,9 +3,9 @@
   "family": "worktree.hosted-base",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "52a76b7a830b32287bce14abbe1b9d9ac70e71eafe5b4c6801c2eb14a4150125",
   "scenarioSha256": "b3734c24f8a083d3efcdd995ea6a57e608d3d3ae3bbbd514db19dcf69448fa48",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tw-hosted-base-soft-error.json b/mobile/rpc-foundation/goldens/tw-hosted-base-soft-error.json
index 382dedf9932b..ca34001ac4f2 100644
--- a/mobile/rpc-foundation/goldens/tw-hosted-base-soft-error.json
+++ b/mobile/rpc-foundation/goldens/tw-hosted-base-soft-error.json
@@ -3,9 +3,9 @@
   "family": "worktree.hosted-base",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "52a76b7a830b32287bce14abbe1b9d9ac70e71eafe5b4c6801c2eb14a4150125",
   "scenarioSha256": "451e74a430d2549976fa360a0e43e76a8d855b1470b8e313797019770ceca4cb",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tw-paste-lookup-resolved.json b/mobile/rpc-foundation/goldens/tw-paste-lookup-resolved.json
index 358401549130..74e3431b0c56 100644
--- a/mobile/rpc-foundation/goldens/tw-paste-lookup-resolved.json
+++ b/mobile/rpc-foundation/goldens/tw-paste-lookup-resolved.json
@@ -3,9 +3,9 @@
   "family": "tasks.paste-lookup",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "52a76b7a830b32287bce14abbe1b9d9ac70e71eafe5b4c6801c2eb14a4150125",
   "scenarioSha256": "81be14c5ec31045004465de4234d1f682f5946d6f8dac7a42263e285b1f24591",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tw-paste-lookup-slug-refused.json b/mobile/rpc-foundation/goldens/tw-paste-lookup-slug-refused.json
index ba65fd02c67c..382f8b47a988 100644
--- a/mobile/rpc-foundation/goldens/tw-paste-lookup-slug-refused.json
+++ b/mobile/rpc-foundation/goldens/tw-paste-lookup-slug-refused.json
@@ -3,9 +3,9 @@
   "family": "tasks.paste-lookup",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "52a76b7a830b32287bce14abbe1b9d9ac70e71eafe5b4c6801c2eb14a4150125",
   "scenarioSha256": "e9d85c576adf93063a8f56d49d28869c402cad38122732b46b8ec021d25db5e3",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tw-paste-lookup-slug-unsupported.json b/mobile/rpc-foundation/goldens/tw-paste-lookup-slug-unsupported.json
index 1adbe084565a..5cf0fb3c664d 100644
--- a/mobile/rpc-foundation/goldens/tw-paste-lookup-slug-unsupported.json
+++ b/mobile/rpc-foundation/goldens/tw-paste-lookup-slug-unsupported.json
@@ -3,9 +3,9 @@
   "family": "tasks.paste-lookup",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "52a76b7a830b32287bce14abbe1b9d9ac70e71eafe5b4c6801c2eb14a4150125",
   "scenarioSha256": "14509b4c1cc3beb00cc329b6bae46913f59b3938f76c0bd3bf3e374f34fb680d",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tw-setup-hook-trust-always.json b/mobile/rpc-foundation/goldens/tw-setup-hook-trust-always.json
index 81c4db07b440..07943ec88643 100644
--- a/mobile/rpc-foundation/goldens/tw-setup-hook-trust-always.json
+++ b/mobile/rpc-foundation/goldens/tw-setup-hook-trust-always.json
@@ -3,9 +3,9 @@
   "family": "worktree.setup-hook-trust",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "52a76b7a830b32287bce14abbe1b9d9ac70e71eafe5b4c6801c2eb14a4150125",
   "scenarioSha256": "0d2e3f48aadf45abbf6927b72ed5fef4caa8e3eb2efd1046339a3fbfab6f9f18",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tw-setup-hook-trust-approved.json b/mobile/rpc-foundation/goldens/tw-setup-hook-trust-approved.json
index bebda2cf8c5e..e9c9c89dd104 100644
--- a/mobile/rpc-foundation/goldens/tw-setup-hook-trust-approved.json
+++ b/mobile/rpc-foundation/goldens/tw-setup-hook-trust-approved.json
@@ -3,9 +3,9 @@
   "family": "worktree.setup-hook-trust",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "52a76b7a830b32287bce14abbe1b9d9ac70e71eafe5b4c6801c2eb14a4150125",
   "scenarioSha256": "f54f5c6dbbe7dbcf8e85e9bd36b27ca9bea7de65d5e35dabace49b3fc766a403",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tw-smart-search-all-providers.json b/mobile/rpc-foundation/goldens/tw-smart-search-all-providers.json
index a37318e44c8e..eb5eec8394d4 100644
--- a/mobile/rpc-foundation/goldens/tw-smart-search-all-providers.json
+++ b/mobile/rpc-foundation/goldens/tw-smart-search-all-providers.json
@@ -3,9 +3,9 @@
   "family": "tasks.smart-source-search",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "52a76b7a830b32287bce14abbe1b9d9ac70e71eafe5b4c6801c2eb14a4150125",
   "scenarioSha256": "5d869d55848aea469954eb945ddc2b74f366387f8fc2853b7ae01de779208c4a",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tw-smart-search-gitlab-provider-error.json b/mobile/rpc-foundation/goldens/tw-smart-search-gitlab-provider-error.json
index b051f020d856..c5a55c67575f 100644
--- a/mobile/rpc-foundation/goldens/tw-smart-search-gitlab-provider-error.json
+++ b/mobile/rpc-foundation/goldens/tw-smart-search-gitlab-provider-error.json
@@ -3,9 +3,9 @@
   "family": "tasks.smart-source-search",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "52a76b7a830b32287bce14abbe1b9d9ac70e71eafe5b4c6801c2eb14a4150125",
   "scenarioSha256": "4537bf83f7a030521eec549adf4490da5be183471d5a9f9e58b71815b29481ff",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tw-smart-search-linear-listed.json b/mobile/rpc-foundation/goldens/tw-smart-search-linear-listed.json
index 760f763c7752..a1b1cdd02478 100644
--- a/mobile/rpc-foundation/goldens/tw-smart-search-linear-listed.json
+++ b/mobile/rpc-foundation/goldens/tw-smart-search-linear-listed.json
@@ -3,9 +3,9 @@
   "family": "tasks.smart-source-search",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "52a76b7a830b32287bce14abbe1b9d9ac70e71eafe5b4c6801c2eb14a4150125",
   "scenarioSha256": "9681485eec93644a01dd6dff0d07f9629361a86989a900176c5aaff3d5805db3",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tw-task-preferences-resume-write.json b/mobile/rpc-foundation/goldens/tw-task-preferences-resume-write.json
index d2b49cb0d287..6184077cf597 100644
--- a/mobile/rpc-foundation/goldens/tw-task-preferences-resume-write.json
+++ b/mobile/rpc-foundation/goldens/tw-task-preferences-resume-write.json
@@ -3,9 +3,9 @@
   "family": "settings-best-effort",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "d3b7f33d810e1fa420ac41a628cde9fe4a9e65fd57f89fbca0a40fc7d74951ab",
   "scenarioSha256": "31bfa49f888b0eb3f72873bf4a3af26129e78c23126e8fc8fe45b952caa60904",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tw-workspace-source-presets-refused.json b/mobile/rpc-foundation/goldens/tw-workspace-source-presets-refused.json
index 01a9541cf3ad..0b246c454262 100644
--- a/mobile/rpc-foundation/goldens/tw-workspace-source-presets-refused.json
+++ b/mobile/rpc-foundation/goldens/tw-workspace-source-presets-refused.json
@@ -3,9 +3,9 @@
   "family": "tasks.workspace-source",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "4e567302ac8acffcfd602c9b323ecf8b5b7c0c4692bda1a4c881011a91d98979",
   "scenarioSha256": "2cd1e8972f226572744dad7da82afffbdf0452a121c1cd8c3334d5c3fde5d57c",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tw-workspace-source-presets.json b/mobile/rpc-foundation/goldens/tw-workspace-source-presets.json
index 1906fef16339..ada7e73f2320 100644
--- a/mobile/rpc-foundation/goldens/tw-workspace-source-presets.json
+++ b/mobile/rpc-foundation/goldens/tw-workspace-source-presets.json
@@ -3,9 +3,9 @@
   "family": "tasks.workspace-source",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "4e567302ac8acffcfd602c9b323ecf8b5b7c0c4692bda1a4c881011a91d98979",
   "scenarioSha256": "046dd3a125a3c9abcf5a0dd122818939b516adb91cbda2554b3409d4bb3a7980",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tw-workspace-sparse-missing-preset.json b/mobile/rpc-foundation/goldens/tw-workspace-sparse-missing-preset.json
index b86f6d82138d..aa5fb681f76f 100644
--- a/mobile/rpc-foundation/goldens/tw-workspace-sparse-missing-preset.json
+++ b/mobile/rpc-foundation/goldens/tw-workspace-sparse-missing-preset.json
@@ -3,9 +3,9 @@
   "family": "tasks.workspace-sparse",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "4e567302ac8acffcfd602c9b323ecf8b5b7c0c4692bda1a4c881011a91d98979",
   "scenarioSha256": "865a659012dd882fd6073813585e2911a1d6252404fbf5a5e273f062b89fc91d",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tw-workspace-sparse-saved.json b/mobile/rpc-foundation/goldens/tw-workspace-sparse-saved.json
index f98c9a9d0c2c..a9a0adfbd305 100644
--- a/mobile/rpc-foundation/goldens/tw-workspace-sparse-saved.json
+++ b/mobile/rpc-foundation/goldens/tw-workspace-sparse-saved.json
@@ -3,9 +3,9 @@
   "family": "tasks.workspace-sparse",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "4e567302ac8acffcfd602c9b323ecf8b5b7c0c4692bda1a4c881011a91d98979",
   "scenarioSha256": "124f664e339bfd83a1d892e1cd953a78fdf0dc4b20c4272356d24079c72a3e04",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tw-workspace-ssh-connect-refused.json b/mobile/rpc-foundation/goldens/tw-workspace-ssh-connect-refused.json
index 5d14e70584b5..f77e63d59d40 100644
--- a/mobile/rpc-foundation/goldens/tw-workspace-ssh-connect-refused.json
+++ b/mobile/rpc-foundation/goldens/tw-workspace-ssh-connect-refused.json
@@ -3,9 +3,9 @@
   "family": "tasks.workspace-ssh",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "4e567302ac8acffcfd602c9b323ecf8b5b7c0c4692bda1a4c881011a91d98979",
   "scenarioSha256": "dd25391fdd3dc864ae493f72d013e789884a21e9c71522edc79323bc2b6c7f76",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tw-workspace-ssh-connected.json b/mobile/rpc-foundation/goldens/tw-workspace-ssh-connected.json
index 2ae1a4a8d37f..dbdf3aa282df 100644
--- a/mobile/rpc-foundation/goldens/tw-workspace-ssh-connected.json
+++ b/mobile/rpc-foundation/goldens/tw-workspace-ssh-connected.json
@@ -3,9 +3,9 @@
   "family": "tasks.workspace-ssh",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "4e567302ac8acffcfd602c9b323ecf8b5b7c0c4692bda1a4c881011a91d98979",
   "scenarioSha256": "495f51d9c2f7f3d71f53a53e88786b8d1f767a5bf66b8655c28222d2909a964c",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tw-workspace-ssh-local-agents.json b/mobile/rpc-foundation/goldens/tw-workspace-ssh-local-agents.json
index 4efd8c3da1cd..42ab1548b5c2 100644
--- a/mobile/rpc-foundation/goldens/tw-workspace-ssh-local-agents.json
+++ b/mobile/rpc-foundation/goldens/tw-workspace-ssh-local-agents.json
@@ -3,9 +3,9 @@
   "family": "tasks.workspace-ssh-local",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "4e567302ac8acffcfd602c9b323ecf8b5b7c0c4692bda1a4c881011a91d98979",
   "scenarioSha256": "af0623c2d106d2ed18ef9149d4990539f9ed82146ae091a872a3e1d792efeffe",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/tw-workspace-ssh-not-ready.json b/mobile/rpc-foundation/goldens/tw-workspace-ssh-not-ready.json
index 9da6e290ff79..31f60e7b6355 100644
--- a/mobile/rpc-foundation/goldens/tw-workspace-ssh-not-ready.json
+++ b/mobile/rpc-foundation/goldens/tw-workspace-ssh-not-ready.json
@@ -3,9 +3,9 @@
   "family": "tasks.workspace-ssh",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "4e567302ac8acffcfd602c9b323ecf8b5b7c0c4692bda1a4c881011a91d98979",
   "scenarioSha256": "3aa23f15da8fe9972e47c767db454b41750ca353ab10797082fde4514ffe9da0",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/worktree-catalog-snapshot-unreadable.json b/mobile/rpc-foundation/goldens/worktree-catalog-snapshot-unreadable.json
index 623f82a58019..14d129b25f20 100644
--- a/mobile/rpc-foundation/goldens/worktree-catalog-snapshot-unreadable.json
+++ b/mobile/rpc-foundation/goldens/worktree-catalog-snapshot-unreadable.json
@@ -3,9 +3,9 @@
   "family": "worktree.catalog-snapshot",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "4e942ddfbaa0ba6bfc2993969276987f6528ac53765d125e99a830e261f93a8e",
   "scenarioSha256": "e28e66567389598edbc720c89f5af73b5beca836cd0357af235d8ddc3d29fbfc",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/worktree-catalog-snapshot.json b/mobile/rpc-foundation/goldens/worktree-catalog-snapshot.json
index d8a2d5c78bfc..79b9fd77f2ab 100644
--- a/mobile/rpc-foundation/goldens/worktree-catalog-snapshot.json
+++ b/mobile/rpc-foundation/goldens/worktree-catalog-snapshot.json
@@ -3,9 +3,9 @@
   "family": "worktree.catalog-snapshot",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "4e942ddfbaa0ba6bfc2993969276987f6528ac53765d125e99a830e261f93a8e",
   "scenarioSha256": "d2947158840576cbd0f0604ed3d37b0f446c63c6d439b4d1b7def7fe8524523d",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/worktree-home-catalog.json b/mobile/rpc-foundation/goldens/worktree-home-catalog.json
index 3797ec591cfb..596cae592e75 100644
--- a/mobile/rpc-foundation/goldens/worktree-home-catalog.json
+++ b/mobile/rpc-foundation/goldens/worktree-home-catalog.json
@@ -3,9 +3,9 @@
   "family": "worktree.home-catalog",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "4e942ddfbaa0ba6bfc2993969276987f6528ac53765d125e99a830e261f93a8e",
   "scenarioSha256": "4749bb3b871275ba08f026f9b6bcfd383605f443e7bba70a7f89175b91db6fa5",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/goldens/worktree-retired-names.json b/mobile/rpc-foundation/goldens/worktree-retired-names.json
index c1c0964adda9..4d24bf3cb445 100644
--- a/mobile/rpc-foundation/goldens/worktree-retired-names.json
+++ b/mobile/rpc-foundation/goldens/worktree-retired-names.json
@@ -3,9 +3,9 @@
   "family": "worktree.retired-names",
   "namedDeltas": [],
   "runnerVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
-  "lockfileSha256": "1327605e77b3fed83c7410635d39fdab40c49380e5cbf483ec6ff1b404b4e1d1",
-  "recorderSha256": "f67c2f5b753d2a4f572599f6861fae8e6e917fe89ac75b58288f8e84be609d86",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
+  "lockfileSha256": "9317f3a98ab047f9f96fe26fd8531b8a632ac5954064b322f41a904148cbf6bb",
+  "recorderSha256": "0317fe2aebe4743ce5e7ae194531aa91b4fe0a84df457640851fe6dfdb9362af",
   "adapterSha256": "4e942ddfbaa0ba6bfc2993969276987f6528ac53765d125e99a830e261f93a8e",
   "scenarioSha256": "2faa07ee5f12b3ed584117359d3b7aeb9c78a04e8fc49e753372f8c3927a3740",
   "platform": "darwin",
diff --git a/mobile/rpc-foundation/pilot-scenarios.json b/mobile/rpc-foundation/pilot-scenarios.json
index fb86117fba00..58bb048ec615 100644
--- a/mobile/rpc-foundation/pilot-scenarios.json
+++ b/mobile/rpc-foundation/pilot-scenarios.json
@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "baseline": "80e0bee23b8153f5db195a0d8c1db114f28bd336",
+  "baseline": "2077956254c707d904c066ca890dc25f3671fb70",
   "scenarios": [
     {
       "id": "b1",
diff --git a/mobile/src/components/AgentStateDot.tsx b/mobile/src/components/AgentStateDot.tsx
index 1637296d900f..80ef9d9d239e 100644
--- a/mobile/src/components/AgentStateDot.tsx
+++ b/mobile/src/components/AgentStateDot.tsx
@@ -5,7 +5,7 @@ import type { AgentDotState } from '../worktree/agent-row-display'
 
 // Per-agent state indicator, 1:1 with desktop AgentStateDot
 // (src/renderer/src/components/AgentStateDot.tsx): yellow spinner for 'working',
-// emerald for 'done', red for blocked/waiting/interrupted (attention), neutral
+// emerald for 'done', red for blocked/waiting/interrupted/failed (attention), neutral
 // for idle. Distinct from the worktree-level AgentSpinner, which collapses the
 // agent vocabulary into the 5-state rollup the sidebar dot uses.
 const DOT_COLORS: Record<Exclude<AgentDotState, 'working' | 'monitoring'>, string> = {
@@ -13,6 +13,7 @@ const DOT_COLORS: Record<Exclude<AgentDotState, 'working' | 'monitoring'>, strin
   blocked: '#ef4444',
   waiting: '#ef4444',
   interrupted: '#ef4444',
+  failed: '#ef4444',
   idle: 'rgba(115,115,115,0.4)'
 }
 const WORKING_COLOR = '#eab308'
diff --git a/mobile/src/components/BottomDrawer.tsx b/mobile/src/components/BottomDrawer.tsx
index 9d27c2c0c4e1..4b381511d763 100644
--- a/mobile/src/components/BottomDrawer.tsx
+++ b/mobile/src/components/BottomDrawer.tsx
@@ -1,6 +1,5 @@
-import { type ReactNode, useCallback, useEffect, useRef, useState } from 'react'
-import { resolveBottomDrawerMounted } from './bottom-drawer-mount-state'
-import { MountedBottomDrawer } from './mounted-bottom-drawer'
+import type { ReactNode } from 'react'
+import { KeyedBottomDrawer } from './keyed-bottom-drawer'
 
 type Props = {
   visible: boolean
@@ -19,75 +18,21 @@ type Props = {
   zIndex?: number
 }
 
-export function BottomDrawer({
-  visible,
-  onClose,
-  onAfterClose,
-  children,
-  dragContentToDismiss = true,
-  contentScrollable = true,
-  fillAvailable = false,
-  interactive = true,
-  zIndex
-}: Props) {
-  const [mounted, setMounted] = useState(visible)
-  const onAfterCloseRef = useRef(onAfterClose)
-  const hiddenHandledRef = useRef(false)
-  const afterClosePendingRef = useRef(false)
-
-  useEffect(() => {
-    onAfterCloseRef.current = onAfterClose
-  }, [onAfterClose])
-
-  useEffect(() => {
-    if (visible) {
-      hiddenHandledRef.current = false
-      afterClosePendingRef.current = false
-    }
-  }, [visible])
-
-  useEffect(() => {
-    if (mounted || !afterClosePendingRef.current) {
-      return
-    }
-    afterClosePendingRef.current = false
-    onAfterCloseRef.current?.()
-  }, [mounted])
-
-  const handleHidden = useCallback(() => {
-    if (hiddenHandledRef.current) {
-      return
-    }
-    hiddenHandledRef.current = true
-    afterClosePendingRef.current = true
-    setMounted(false)
-  }, [])
-  const resolvedMounted = resolveBottomDrawerMounted(visible, mounted)
-
-  // Why: opening drawers should mount before commit; waiting for a passive
-  // Effect adds a null render before every drawer can animate in.
-  if (resolvedMounted !== mounted) {
-    setMounted(resolvedMounted)
-  }
-
-  // Why: hidden drawers are rendered by parent screens even while closed; keep
-  // their Reanimated/Gesture setup out of hot paths like commit-message typing.
-  if (!resolvedMounted) {
-    return null
-  }
+const SHOWN = 'shown'
+const sheetKey = () => SHOWN
 
+export function BottomDrawer({ visible, onClose, onAfterClose, children, ...drawerProps }: Props) {
+  // Why: hidden drawers are rendered by parent screens even while closed; the keyed drawer
+  // renders nothing until shown, which keeps Reanimated/Gesture setup out of hot paths.
   return (
-    <MountedBottomDrawer
-      visible={visible}
+    <KeyedBottomDrawer
+      {...drawerProps}
+      sheet={visible ? SHOWN : null}
+      sheetKey={sheetKey}
       onClose={onClose}
-      onHidden={handleHidden}
-      dragContentToDismiss={dragContentToDismiss}
-      contentScrollable={contentScrollable}
-      fillAvailable={fillAvailable}
-      interactive={interactive}
-      zIndex={zIndex}
+      onAfterClose={onAfterClose}
     >
-      {children}
-    </MountedBottomDrawer>
+      {() => children}
+    </KeyedBottomDrawer>
   )
 }
diff --git a/mobile/src/components/ConfirmModal.tsx b/mobile/src/components/ConfirmModal.tsx
index a393593b5cf8..5d0f70e60812 100644
--- a/mobile/src/components/ConfirmModal.tsx
+++ b/mobile/src/components/ConfirmModal.tsx
@@ -2,8 +2,7 @@ import { View, Text, Pressable, StyleSheet } from 'react-native'
 import { colors, spacing, radii, typography } from '../theme/mobile-theme'
 import { BottomDrawer } from './BottomDrawer'
 
-type Props = {
-  visible: boolean
+type ContentProps = {
   title: string
   message?: string
   confirmLabel?: string
@@ -13,8 +12,17 @@ type Props = {
   onCancel: () => void
 }
 
-export function ConfirmModal({
-  visible,
+type Props = ContentProps & { visible: boolean }
+
+export function ConfirmModal({ visible, ...content }: Props) {
+  return (
+    <BottomDrawer visible={visible} onClose={content.onCancel}>
+      <ConfirmContent {...content} />
+    </BottomDrawer>
+  )
+}
+
+export function ConfirmContent({
   title,
   message,
   confirmLabel = 'Confirm',
@@ -22,9 +30,9 @@ export function ConfirmModal({
   destructive = false,
   onConfirm,
   onCancel
-}: Props) {
+}: ContentProps) {
   return (
-    <BottomDrawer visible={visible} onClose={onCancel}>
+    <>
       <View style={styles.content}>
         <Text style={styles.title}>{title}</Text>
         {message ? <Text style={styles.message}>{message}</Text> : null}
@@ -52,7 +60,7 @@ export function ConfirmModal({
           </Text>
         </Pressable>
       </View>
-    </BottomDrawer>
+    </>
   )
 }
 
diff --git a/mobile/src/components/MobileDiffReviewDrawers.tsx b/mobile/src/components/MobileDiffReviewDrawers.tsx
index 9f979761fe87..b3c418a8fb70 100644
--- a/mobile/src/components/MobileDiffReviewDrawers.tsx
+++ b/mobile/src/components/MobileDiffReviewDrawers.tsx
@@ -1,75 +1,103 @@
 import { useMemo } from 'react'
-import { KeyboardAvoidingView, Platform, Pressable, Text, TextInput, View } from 'react-native'
+import { KeyboardAvoidingView, Pressable, Text, TextInput, View } from 'react-native'
 import { Check, Copy, FileText, Plus, Send, Trash2, X } from 'lucide-react-native'
 import type { DiffComment } from '../../../src/shared/diff-comment-types'
-import { useKeyboardAvoidingPadding } from '../platform/keyboard-occlusion'
 import { colors } from '../theme/mobile-theme'
 import type { ActionSheetAction } from './ActionSheetModal'
-import { ActionSheetModal } from './ActionSheetModal'
-import { BottomDrawer } from './BottomDrawer'
-import { ConfirmModal } from './ConfirmModal'
-import { mobileReviewCountLabel } from '../session/mobile-diff-review-screen-model'
+import { ActionSheetContent } from './ActionSheetModal'
+import { ConfirmContent } from './ConfirmModal'
+import { KeyedBottomDrawer } from './keyed-bottom-drawer'
+import {
+  mobileReviewCountLabel,
+  type ComposerState,
+  type SendSheetState
+} from '../session/mobile-diff-review-screen-model'
+import { reviewSheetKey, type ReviewSheet } from '../session/mobile-diff-review-sheets'
 import type { useMobileDiffReviewController } from '../session/use-mobile-diff-review-controller'
 import { mobileDiffReviewStyles as styles } from './mobile-diff-review-screen-styles'
+import { hostOs } from '../platform/host-os'
 
 type Props = {
   controller: ReturnType<typeof useMobileDiffReviewController>
 }
 
 export function MobileDiffReviewDrawers({ controller }: Props) {
-  const sendActions = useSendActions(controller)
+  // One drawer for every review sheet: iOS cannot present a sheet while another is still closing.
+  return (
+    <KeyedBottomDrawer
+      sheet={controller.sheet}
+      sheetKey={reviewSheetKey}
+      onClose={(presented) => controller.closeSheet(presented.kind)}
+    >
+      {(presented) => <ReviewSheetContent controller={controller} sheet={presented} />}
+    </KeyedBottomDrawer>
+  )
+}
+
+function ReviewSheetContent({ controller, sheet }: Props & { sheet: ReviewSheet }) {
+  switch (sheet.kind) {
+    case 'actions':
+      return <ReviewActionsContent controller={controller} />
+    case 'send':
+      return <SendNotesContent controller={controller} load={sheet.load} />
+    case 'discard':
+      return (
+        <ConfirmContent
+          title="Discard File"
+          message={`Discard changes to "${sheet.target.filePath}"? This cannot be undone.`}
+          confirmLabel="Discard"
+          destructive
+          onConfirm={() => {
+            controller.closeSheet('discard')
+            void controller.runGitMutation('git.discard', sheet.target)
+          }}
+          onCancel={() => controller.closeSheet('discard')}
+        />
+      )
+    case 'composer':
+      return <NoteComposerContent controller={controller} composer={sheet.composer} />
+    case 'completion':
+      return <CompletionContent controller={controller} />
+  }
+}
+
+function ReviewActionsContent({ controller }: Props) {
   const overflowActions = useOverflowActions(controller)
   return (
-    <>
-      <ActionSheetModal
-        visible={controller.showOverflow}
-        title="Review Actions"
-        message={
-          controller.reviewedUnstagedCount > 0
-            ? `${controller.reviewedUnstagedCount} reviewed unstaged files can be staged`
-            : undefined
-        }
-        actions={overflowActions}
-        onClose={() => controller.setShowOverflow(false)}
-      />
-      <ActionSheetModal
-        visible={controller.sendSheet !== null}
-        title="Send Notes"
-        message={sendSheetMessage(controller)}
-        actions={sendActions}
-        onClose={() => controller.setSendSheet(null)}
-      />
-      <ConfirmModal
-        visible={controller.discardTarget !== null}
-        title="Discard File"
-        message={
-          controller.discardTarget
-            ? `Discard changes to "${controller.discardTarget.filePath}"? This cannot be undone.`
-            : undefined
-        }
-        confirmLabel="Discard"
-        destructive
-        onConfirm={() => {
-          const target = controller.discardTarget
-          controller.setDiscardTarget(null)
-          if (target) {
-            void controller.runGitMutation('git.discard', target)
-          }
-        }}
-        onCancel={() => controller.setDiscardTarget(null)}
-      />
-      <NoteComposerDrawer controller={controller} />
-      <CompletionDrawer controller={controller} />
-    </>
+    <ActionSheetContent
+      title="Review Actions"
+      message={
+        controller.reviewedUnstagedCount > 0
+          ? `${controller.reviewedUnstagedCount} reviewed unstaged files can be staged`
+          : undefined
+      }
+      actions={overflowActions}
+      onClose={() => controller.closeSheet('actions')}
+    />
   )
 }
 
-function useSendActions(controller: ReturnType<typeof useMobileDiffReviewController>) {
+function SendNotesContent({ controller, load }: Props & { load: SendSheetState }) {
+  const sendActions = useSendActions(controller, load)
+  return (
+    <ActionSheetContent
+      title="Send Notes"
+      message={sendSheetMessage(controller, load)}
+      actions={sendActions}
+      onClose={() => controller.closeSheet('send')}
+    />
+  )
+}
+
+function useSendActions(
+  controller: ReturnType<typeof useMobileDiffReviewController>,
+  load: SendSheetState
+) {
   return useMemo<ActionSheetAction[]>(() => {
     const comments = controller.unsentComments
     const terminalActions =
-      controller.sendSheet?.kind === 'ready' || controller.sendSheet?.kind === 'error'
-        ? controller.sendSheet.terminals.map((terminal) => ({
+      load.kind === 'ready' || load.kind === 'error'
+        ? load.terminals.map((terminal) => ({
             label: `${terminal.title || 'Terminal'} (${terminal.terminal.slice(0, 6)})`,
             icon: Send,
             disabled: comments.length === 0,
@@ -94,7 +122,7 @@ function useSendActions(controller: ReturnType<typeof useMobileDiffReviewControl
         onPress: () => void controller.copyNotes()
       }
     ]
-  }, [controller])
+  }, [controller, load])
 }
 
 function useOverflowActions(controller: ReturnType<typeof useMobileDiffReviewController>) {
@@ -111,7 +139,6 @@ function useOverflowActions(controller: ReturnType<typeof useMobileDiffReviewCon
         label: 'Send Unsent Notes',
         icon: Send,
         disabled: controller.unsentComments.length === 0,
-        skipAutoClose: true,
         onPress: () => void controller.openSendSheet()
       },
       {
@@ -152,65 +179,54 @@ function useOverflowActions(controller: ReturnType<typeof useMobileDiffReviewCon
 }
 
 function sendSheetMessage(
-  controller: ReturnType<typeof useMobileDiffReviewController>
+  controller: ReturnType<typeof useMobileDiffReviewController>,
+  load: SendSheetState
 ): string | undefined {
-  return controller.sendSheet?.kind === 'loading'
+  return load.kind === 'loading'
     ? 'Loading agent sessions...'
-    : controller.sendSheet?.kind === 'error'
-      ? controller.sendSheet.message
+    : load.kind === 'error'
+      ? load.message
       : `${controller.unsentComments.length} unsent notes`
 }
 
-function NoteComposerDrawer({ controller }: Props) {
-  const composer = controller.composer
-  // Zero on a phone, where `KeyboardAvoidingView` above already moved this; the page's own
-  // keyboard measurement where it cannot, because that view is driven by events RN Web never
-  // sends. Padding rather than a second avoiding view: the drawer owns the position.
-  const keyboardPadding = useKeyboardAvoidingPadding()
+function NoteComposerContent({ controller, composer }: Props & { composer: ComposerState }) {
   return (
-    <BottomDrawer visible={composer !== null} onClose={controller.closeComposer}>
-      <KeyboardAvoidingView
-        behavior={Platform.OS === 'ios' ? 'padding' : undefined}
-        style={keyboardPadding > 0 ? { paddingBottom: keyboardPadding } : undefined}
-      >
-        <View style={styles.composerHeader}>
-          <View>
-            <Text style={styles.drawerTitle}>
-              {composer?.mode === 'edit' ? 'Edit Note' : 'Add Note'}
-            </Text>
-            <Text style={styles.drawerSubtitle}>
-              {composer?.mode === 'create' && composer.lineNumber > 0
-                ? `Line ${composer.lineNumber}`
-                : 'File note'}
-            </Text>
-          </View>
-          <Pressable
-            style={({ pressed }) => [styles.iconButton, pressed && styles.iconButtonPressed]}
-            onPress={controller.closeComposer}
-            accessibilityRole="button"
-            accessibilityLabel="Cancel note"
-          >
-            <X size={18} color={colors.textPrimary} strokeWidth={2.2} />
-          </Pressable>
-        </View>
-        <TextInput
-          style={styles.composerInput}
-          value={controller.composerBody}
-          onChangeText={controller.setComposerBody}
-          multiline
-          autoFocus
-          placeholder="Review note"
-          placeholderTextColor={colors.textMuted}
-          accessibilityLabel={composerLabel(composer)}
-        />
-        <View style={styles.drawerButtonRow}>
-          {composer?.mode === 'edit' ? (
-            <DeleteNoteButton onPress={controller.deleteComment} />
-          ) : null}
-          <SaveNoteButton controller={controller} composer={composer} />
+    <KeyboardAvoidingView behavior={hostOs() === 'ios' ? 'padding' : undefined}>
+      <View style={styles.composerHeader}>
+        <View>
+          <Text style={styles.drawerTitle}>
+            {composer.mode === 'edit' ? 'Edit Note' : 'Add Note'}
+          </Text>
+          <Text style={styles.drawerSubtitle}>
+            {composer.mode === 'create' && composer.lineNumber > 0
+              ? `Line ${composer.lineNumber}`
+              : 'File note'}
+          </Text>
         </View>
-      </KeyboardAvoidingView>
-    </BottomDrawer>
+        <Pressable
+          style={({ pressed }) => [styles.iconButton, pressed && styles.iconButtonPressed]}
+          onPress={controller.closeComposer}
+          accessibilityRole="button"
+          accessibilityLabel="Cancel note"
+        >
+          <X size={18} color={colors.textPrimary} strokeWidth={2.2} />
+        </Pressable>
+      </View>
+      <TextInput
+        style={styles.composerInput}
+        value={controller.composerBody}
+        onChangeText={controller.setComposerBody}
+        multiline
+        autoFocus
+        placeholder="Review note"
+        placeholderTextColor={colors.textMuted}
+        accessibilityLabel={composerLabel(composer)}
+      />
+      <View style={styles.drawerButtonRow}>
+        {composer.mode === 'edit' ? <DeleteNoteButton onPress={controller.deleteComment} /> : null}
+        <SaveNoteButton controller={controller} composer={composer} />
+      </View>
+    </KeyboardAvoidingView>
   )
 }
 
@@ -262,14 +278,11 @@ function SaveNoteButton({
   )
 }
 
-function CompletionDrawer({ controller }: Props) {
+function CompletionContent({ controller }: Props) {
   const noteCount =
     controller.screenState.kind === 'ready' ? controller.screenState.comments.length : 0
   return (
-    <BottomDrawer
-      visible={controller.showCompletion}
-      onClose={() => controller.setShowCompletion(false)}
-    >
+    <>
       <Text style={styles.drawerTitle}>Review Complete</Text>
       <Text style={styles.drawerSubtitle}>
         {mobileReviewCountLabel(controller.queue.length, 'file', 'files')} reviewed,{' '}
@@ -297,6 +310,6 @@ function CompletionDrawer({ controller }: Props) {
           <Text style={styles.primaryButtonText}>Send Notes</Text>
         </Pressable>
       </View>
-    </BottomDrawer>
+    </>
   )
 }
diff --git a/mobile/src/components/MobileDiffReviewScreenView.tsx b/mobile/src/components/MobileDiffReviewScreenView.tsx
index 3e68dd7c8f79..6fda33f76c58 100644
--- a/mobile/src/components/MobileDiffReviewScreenView.tsx
+++ b/mobile/src/components/MobileDiffReviewScreenView.tsx
@@ -61,7 +61,7 @@ export function MobileDiffReviewScreenView({ controller, onBack }: Props) {
         unsentCount={controller.unsentComments.length}
         worktreeLabel={controller.worktreeLabel}
         onBack={onBack}
-        onOpenActions={() => controller.setShowOverflow(true)}
+        onOpenActions={() => controller.openSheet({ kind: 'actions' })}
         onOpenPRSidebar={controller.openPRSidebar}
         onSelectFilter={controller.selectFilter}
       />
@@ -104,7 +104,7 @@ export function MobileDiffReviewScreenView({ controller, onBack }: Props) {
               busyAction={controller.busyAction}
               item={controller.currentItem}
               onAddFileNote={() => controller.openComposer(0)}
-              onDiscard={controller.setDiscardTarget}
+              onDiscard={(target) => controller.openSheet({ kind: 'discard', target })}
               onGitMutation={(method, item) => void controller.runGitMutation(method, item)}
               onMarkReviewed={() => void controller.markReviewed()}
               onMoveFile={controller.moveFile}
diff --git a/mobile/src/components/MobileHostCard.test.ts b/mobile/src/components/MobileHostCard.test.ts
index e29ab50bfabb..9a5354e8bf71 100644
--- a/mobile/src/components/MobileHostCard.test.ts
+++ b/mobile/src/components/MobileHostCard.test.ts
@@ -342,7 +342,6 @@ describe('MobileHostCard', () => {
             deviceToken: 'token',
             publicKeyB64: 'key',
             lastConnected: 1,
-            relayHostId: 'AbCdEf0123_-xyZ9',
             relay: {
               v: 1 as const,
               directorUrl: 'https://relay-staging.onorca.dev',
diff --git a/mobile/src/components/ProtocolBlockScreen.test.ts b/mobile/src/components/ProtocolBlockScreen.test.ts
index a69b52566e3d..c0dd920293d1 100644
--- a/mobile/src/components/ProtocolBlockScreen.test.ts
+++ b/mobile/src/components/ProtocolBlockScreen.test.ts
@@ -151,6 +151,19 @@ describe('ProtocolBlockScreen', () => {
     expect(primaryActionUrl()).toBe(RELEASES_URL)
   })
 
+  it('sends a desktop whose page is older than this shell to the desktop update', () => {
+    const output = render({
+      kind: 'blocked',
+      reason: 'bundle-incompatible',
+      side: 'desktop',
+      pageVersion: 0,
+      requiredPageVersion: 1
+    })
+    expect(output).toContain('Update Orca on your computer')
+    expect(output).toContain('This paired desktop app is too old for your current Orca Mobile app')
+    expect(primaryActionUrl()).toBe(RELEASES_URL)
+  })
+
   it('routes an Android bundle wall to GitHub Releases, not a store that has no listing', () => {
     nativeTestState.platform.OS = 'android'
     const output = render({
diff --git a/mobile/src/components/WorktreeAgentRow.tsx b/mobile/src/components/WorktreeAgentRow.tsx
index 8740d12eaed6..cd8e10b3454e 100644
--- a/mobile/src/components/WorktreeAgentRow.tsx
+++ b/mobile/src/components/WorktreeAgentRow.tsx
@@ -2,7 +2,12 @@ import { memo } from 'react'
 import { StyleSheet, Text, View } from 'react-native'
 import type { RuntimeWorktreeAgentRow } from '../../../src/shared/runtime-types'
 import { colors, spacing } from '../theme/mobile-theme'
-import { agentDisplayLabel, agentDotState, formatTimeAgo } from '../worktree/agent-row-display'
+import {
+  agentDisplayLabel,
+  agentDotState,
+  agentRowTimeAt,
+  formatTimeAgo
+} from '../worktree/agent-row-display'
 import { AgentStateDot } from './AgentStateDot'
 import { MobileAgentIcon } from './MobileAgentIcon'
 
@@ -22,7 +27,7 @@ type Props = {
 function WorktreeAgentRowComponent({ agent, depth, now, unvisited }: Props) {
   const dotState = agentDotState(agent, now)
   const label = agentDisplayLabel(agent, now)
-  const ts = formatTimeAgo(agent.stateStartedAt, now)
+  const ts = formatTimeAgo(agentRowTimeAt(agent), now)
 
   return (
     <View style={[styles.row, { paddingLeft: depth * INDENT_PER_DEPTH }]}>
diff --git a/mobile/src/components/accounts-snapshot.ts b/mobile/src/components/accounts-snapshot.ts
index 8baf02136235..f95f291da9d1 100644
--- a/mobile/src/components/accounts-snapshot.ts
+++ b/mobile/src/components/accounts-snapshot.ts
@@ -39,7 +39,8 @@ export const ProviderRateLimitsSchema = z
       'kimi',
       'minimax',
       'grok',
-      'antigravity'
+      'antigravity',
+      'cursor'
     ]),
     session: RateLimitWindowSchema.nullable(),
     weekly: RateLimitWindowSchema.nullable(),
diff --git a/mobile/src/components/bottom-drawer-back-while-hiding.test.tsx b/mobile/src/components/bottom-drawer-back-while-hiding.test.tsx
new file mode 100644
index 000000000000..a038560b44f7
--- /dev/null
+++ b/mobile/src/components/bottom-drawer-back-while-hiding.test.tsx
@@ -0,0 +1,151 @@
+import { act, create, type ReactTestRenderer } from 'react-test-renderer'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+
+type Timing = { to: number; callback?: (finished: boolean) => void }
+
+// Models Reanimated's contract: assigning a new animation cancels the running one,
+// whose callback then gets finished=false.
+const animations = vi.hoisted((): { running: Timing[] } => ({ running: [] }))
+
+vi.mock('../navigation/use-back-claim', () => ({ useBackClaim: () => {} }))
+vi.mock('../platform/keyboard-occlusion', () => ({
+  currentSoftKeyboardHeight: () => 0,
+  subscribeSoftKeyboard: () => () => {}
+}))
+vi.mock('react-native', () => ({
+  Keyboard: { dismiss: () => {} },
+  Modal: 'Modal',
+  Platform: { OS: 'android', select: (options: { android?: unknown }) => options.android },
+  Pressable: 'Pressable',
+  ScrollView: 'ScrollView',
+  StyleSheet: { create: <T,>(styles: T) => styles, absoluteFillObject: {} },
+  View: 'View',
+  useWindowDimensions: () => ({ width: 412, height: 900 })
+}))
+vi.mock('react-native-safe-area-context', () => ({
+  useSafeAreaInsets: () => ({ top: 24, bottom: 0, left: 0, right: 0 })
+}))
+vi.mock('react-native-gesture-handler', () => {
+  const chain: Record<string, unknown> = {}
+  for (const method of [
+    'activeOffsetY',
+    'simultaneousWithExternalGesture',
+    'onBegin',
+    'onUpdate',
+    'onEnd'
+  ]) {
+    chain[method] = () => chain
+  }
+  return {
+    Gesture: { Pan: () => chain, Native: () => chain },
+    GestureDetector: 'GestureDetector',
+    GestureHandlerRootView: 'GestureHandlerRootView'
+  }
+})
+vi.mock('react-native-reanimated', () => {
+  function isTiming(value: unknown): value is Timing {
+    return typeof value === 'object' && value !== null && 'to' in value
+  }
+  return {
+    default: { View: 'AnimatedView', ScrollView: 'AnimatedScrollView' },
+    useSharedValue: (initial: number) => {
+      let value = initial
+      let current: Timing | null = null
+      return {
+        get value() {
+          return value
+        },
+        set value(next: unknown) {
+          if (current) {
+            const cancelled = current
+            current = null
+            animations.running = animations.running.filter((entry) => entry !== cancelled)
+            cancelled.callback?.(false)
+          }
+          if (isTiming(next)) {
+            current = next
+            animations.running.push(next)
+            value = next.to
+          } else if (typeof next === 'number') {
+            value = next
+          }
+        }
+      }
+    },
+    useAnimatedStyle: () => ({}),
+    useAnimatedScrollHandler: () => () => {},
+    withSpring: (to: number) => to,
+    withTiming: (to: number, _config?: unknown, callback?: (finished: boolean) => void) => ({
+      to,
+      callback
+    }),
+    runOnJS: (fn: () => void) => fn,
+    interpolate: () => 0,
+    Extrapolation: { CLAMP: 'clamp' }
+  }
+})
+
+import { MountedBottomDrawer } from './mounted-bottom-drawer'
+
+function finishAnimations(): void {
+  const finishing = animations.running
+  animations.running = []
+  act(() => {
+    for (const animation of finishing) {
+      animation.callback?.(true)
+    }
+  })
+}
+
+function drawer(visible: boolean, onClose: () => void, onHidden: () => void) {
+  return (
+    <MountedBottomDrawer visible={visible} onClose={onClose} onHidden={onHidden}>
+      {null}
+    </MountedBottomDrawer>
+  )
+}
+
+function pressAndroidBack(renderer: ReactTestRenderer): void {
+  act(() => renderer.root.find((node) => String(node.type) === 'Modal').props.onRequestClose())
+}
+
+describe('bottom drawer close request while hiding', () => {
+  afterEach(() => {
+    animations.running = []
+  })
+
+  it('still closes an open drawer on Android Back', () => {
+    const onClose = vi.fn()
+    let renderer!: ReactTestRenderer
+    act(() => {
+      renderer = create(drawer(true, onClose, vi.fn()))
+    })
+    finishAnimations()
+
+    pressAndroidBack(renderer)
+    finishAnimations()
+
+    expect(onClose).toHaveBeenCalledTimes(1)
+    act(() => renderer.unmount())
+  })
+
+  // A Back press inside the hide animation used to restart it, so onHidden never fired
+  // and the drawer's invisible Modal stayed up, swallowing every tap on the screen.
+  it('lets the hide finish when Back is pressed mid-close', () => {
+    const onClose = vi.fn()
+    const onHidden = vi.fn()
+    let renderer!: ReactTestRenderer
+    act(() => {
+      renderer = create(drawer(true, onClose, onHidden))
+    })
+    finishAnimations()
+    act(() => renderer.update(drawer(false, onClose, onHidden)))
+
+    pressAndroidBack(renderer)
+    finishAnimations()
+
+    expect(onHidden).toHaveBeenCalledTimes(1)
+    expect(onClose).not.toHaveBeenCalled()
+    act(() => renderer.unmount())
+  })
+})
diff --git a/mobile/src/components/bottom-drawer-close-lifecycle.test.ts b/mobile/src/components/bottom-drawer-close-lifecycle.test.ts
index 94eb8a8495c9..2e993af225cd 100644
--- a/mobile/src/components/bottom-drawer-close-lifecycle.test.ts
+++ b/mobile/src/components/bottom-drawer-close-lifecycle.test.ts
@@ -98,4 +98,23 @@ describe('BottomDrawer close lifecycle', () => {
     expect(latestAfterClose).toHaveBeenCalledTimes(1)
     expect(renderer.toJSON()).toBeNull()
   })
+
+  // The hide finished and the drawer reopened before the scheduled JS callback ran; that late
+  // callback used to latch, so the next close never unmounted and its invisible Modal ate taps.
+  it('a hide that lands after a reopen does not swallow the next close', () => {
+    const onAfterClose = vi.fn()
+    const renderer = renderDrawer(true, vi.fn(), onAfterClose)
+    const lateOnHidden = mountedDrawer(renderer).props.onHidden
+    updateDrawer(renderer, false, vi.fn(), onAfterClose)
+    updateDrawer(renderer, true, vi.fn(), onAfterClose)
+
+    act(() => lateOnHidden())
+    expect(mountedDrawer(renderer).props.visible).toBe(true)
+    expect(onAfterClose).not.toHaveBeenCalled()
+
+    updateDrawer(renderer, false, vi.fn(), onAfterClose)
+    act(() => mountedDrawer(renderer).props.onHidden())
+    expect(renderer.toJSON()).toBeNull()
+    expect(onAfterClose).toHaveBeenCalledTimes(1)
+  })
 })
diff --git a/mobile/src/components/keyed-bottom-drawer.test.tsx b/mobile/src/components/keyed-bottom-drawer.test.tsx
new file mode 100644
index 000000000000..26d95521ce44
--- /dev/null
+++ b/mobile/src/components/keyed-bottom-drawer.test.tsx
@@ -0,0 +1,294 @@
+import { createElement, Profiler, useLayoutEffect, useState, type ReactElement } from 'react'
+import { act, create, type ReactTestRenderer } from 'react-test-renderer'
+import { afterEach, beforeEach, describe, expect, it, vi, type Mock } from 'vitest'
+
+// iOS cannot present a native Modal while another is still presented, even mid-close. Each mounted
+// MountedBottomDrawer is one native Modal; this mock records when each mounts and unmounts, in which
+// commit, and which sheets it ever showed, so the tests can check the drawer's lifecycle directly.
+
+type Drawer = {
+  id: number
+  keys: Set<string>
+  visible: boolean
+  onHidden: () => void
+  onClose: () => void
+}
+type Event = { type: 'mount' | 'unmount'; id: number; commit: number }
+
+type Modals = {
+  commit: number
+  nextId: number
+  all: Drawer[]
+  live: Map<number, Drawer>
+  events: Event[]
+}
+
+const modals = vi.hoisted((): Modals => ({
+  commit: 0,
+  nextId: 0,
+  all: [],
+  live: new Map(),
+  events: []
+}))
+
+vi.mock('./mounted-bottom-drawer', () => ({
+  MountedBottomDrawer: function MockMountedBottomDrawer(props: {
+    visible: boolean
+    onHidden: () => void
+    onClose: () => void
+    children: ReactElement<{ name: string }>
+  }) {
+    const [drawer] = useState((): Drawer => ({ id: modals.nextId++, keys: new Set(), ...props }))
+    useLayoutEffect(() => {
+      drawer.visible = props.visible
+      drawer.onHidden = props.onHidden
+      drawer.onClose = props.onClose
+      drawer.keys.add(props.children.props.name)
+    })
+    useLayoutEffect(() => {
+      modals.all.push(drawer)
+      modals.live.set(drawer.id, drawer)
+      modals.events.push({ type: 'mount', id: drawer.id, commit: modals.commit })
+      return () => {
+        modals.live.delete(drawer.id)
+        modals.events.push({ type: 'unmount', id: drawer.id, commit: modals.commit })
+      }
+    }, [])
+    return props.children
+  }
+}))
+
+const { KeyedBottomDrawer } = await import('./keyed-bottom-drawer')
+
+type Sheet = { name: string; version: number }
+
+let renderer: ReactTestRenderer | null = null
+let onAfterClose: Mock<(closed: Sheet) => void>
+
+function tree(sheet: Sheet | null, onClose: (presented: Sheet) => void = () => {}): ReactElement {
+  return (
+    <Profiler
+      id="drawer"
+      // Why: runs once per commit after its subtree's layout effects, so it numbers commits.
+      onRender={() => {
+        modals.commit++
+      }}
+    >
+      <KeyedBottomDrawer<Sheet>
+        sheet={sheet}
+        sheetKey={(s) => s.name}
+        onClose={onClose}
+        onAfterClose={onAfterClose}
+      >
+        {(presented) =>
+          createElement('SheetContent', { name: presented.name, version: presented.version })
+        }
+      </KeyedBottomDrawer>
+    </Profiler>
+  )
+}
+
+function request(sheet: Sheet | null): void {
+  act(() => {
+    if (renderer) {
+      renderer.update(tree(sheet))
+    } else {
+      renderer = create(tree(sheet))
+    }
+  })
+}
+
+function only(): Drawer | null {
+  expect(modals.live.size).toBeLessThanOrEqual(1)
+  return [...modals.live.values()][0] ?? null
+}
+
+function presented(): { name: string; version: number; visible: boolean } | null {
+  const drawer = only()
+  if (!drawer) {
+    return null
+  }
+  const content = renderer!.root.find((node) => String(node.type) === 'SheetContent')
+  return { name: content.props.name, version: content.props.version, visible: drawer.visible }
+}
+
+/** The native hide animation of the mounted drawer finished. */
+function finishHide(drawer = only()): void {
+  act(() => drawer?.onHidden())
+}
+
+function mounts(): Event[] {
+  return modals.events.filter((event) => event.type === 'mount')
+}
+
+const A = { name: 'a', version: 1 }
+const B = { name: 'b', version: 1 }
+const C = { name: 'c', version: 1 }
+
+beforeEach(() => {
+  modals.commit = 0
+  modals.nextId = 0
+  modals.all = []
+  modals.live.clear()
+  modals.events = []
+  onAfterClose = vi.fn()
+})
+
+afterEach(() => {
+  act(() => renderer?.unmount())
+  renderer = null
+})
+
+describe('KeyedBottomDrawer', () => {
+  it('presents a request at once when nothing is presented', () => {
+    request(null)
+    expect(presented()).toBeNull()
+    request(A)
+    expect(presented()).toEqual({ name: 'a', version: 1, visible: true })
+  })
+
+  it('hides the presented sheet and shows the next only after its Modal has unmounted', () => {
+    request(A)
+    request(B)
+    // A keeps its content through the close; B is not mounted yet.
+    expect(presented()).toEqual({ name: 'a', version: 1, visible: false })
+
+    finishHide()
+    expect(presented()).toEqual({ name: 'b', version: 1, visible: true })
+    expect(onAfterClose).toHaveBeenCalledExactlyOnceWith(A)
+
+    const unmountA = modals.events.find((event) => event.type === 'unmount')
+    const mountB = mounts()[1]!
+    // A commit with no Modal at all lands between A leaving and B arriving.
+    expect(mountB.commit).toBeGreaterThan(unmountA!.commit)
+  })
+
+  it('presents the latest request after a close, never one replaced before it was shown', () => {
+    request(A)
+    request(B)
+    request(C)
+    finishHide()
+    expect(presented()?.name).toBe('c')
+    expect(modals.all.map((drawer) => [...drawer.keys])).toEqual([['a'], ['c']])
+  })
+
+  it('a request cleared before the close finishes presents nothing afterwards', () => {
+    request(A)
+    request(B)
+    request(null)
+    finishHide()
+    expect(presented()).toBeNull()
+    expect(mounts()).toHaveLength(1)
+  })
+
+  it('reopening the same sheet mid-close re-shows the same Modal with the new content', () => {
+    request(A)
+    const drawer = only()
+    request(null)
+    expect(presented()?.visible).toBe(false)
+    request({ name: 'a', version: 2 })
+    expect(presented()).toEqual({ name: 'a', version: 2, visible: true })
+    expect(only()).toBe(drawer)
+    expect(mounts()).toHaveLength(1)
+  })
+
+  it('switching away and back to the presented sheet mid-close re-shows it', () => {
+    request(A)
+    request(B)
+    request(A)
+    expect(presented()).toEqual({ name: 'a', version: 1, visible: true })
+    finishHide()
+    expect(presented()?.visible).toBe(true)
+    expect(mounts()).toHaveLength(1)
+  })
+
+  // The hide animation finishes, the sheet reopens before the scheduled JS callback runs, and then
+  // the callback lands: it must not unmount the shown sheet or swallow the next close.
+  it('ignores a hide that lands after a reopen and still honours the next close', () => {
+    request(A)
+    const drawer = only()!
+    request(null)
+    request(A)
+    finishHide(drawer)
+    expect(presented()).toEqual({ name: 'a', version: 1, visible: true })
+    expect(onAfterClose).not.toHaveBeenCalled()
+
+    request(B)
+    finishHide()
+    expect(presented()).toEqual({ name: 'b', version: 1, visible: true })
+    expect(onAfterClose).toHaveBeenCalledExactlyOnceWith(A)
+  })
+
+  it('a hide from an earlier Modal cannot close a later one', () => {
+    request(A)
+    const first = only()!
+    request(null)
+    finishHide()
+    request(B)
+    request(null)
+    act(() => first.onHidden())
+    expect(presented()).toEqual({ name: 'b', version: 1, visible: false })
+    finishHide()
+    expect(presented()).toBeNull()
+  })
+
+  it('reports the close with the sheet that was presented', () => {
+    const onClose = vi.fn()
+    act(() => {
+      renderer = create(tree({ name: 'a', version: 3 }, onClose))
+    })
+    act(() => only()?.onClose())
+    expect(onClose).toHaveBeenCalledExactlyOnceWith({ name: 'a', version: 3 })
+  })
+
+  it('keeps one Modal, never swaps its sheet, and always settles on the latest request', () => {
+    const names = ['a', 'b', 'c']
+    let seed = 11
+    const random = (n: number) => {
+      seed = (seed * 48271) % 2147483647
+      return seed % n
+    }
+    let latestName: string | null = null
+    let version = 0
+    for (let step = 0; step < 600; step++) {
+      const move = random(5)
+      if (move === 2) {
+        finishHide()
+      } else if (move === 3) {
+        // A stale or early hide from whichever Modal is up.
+        act(() => only()?.onHidden())
+      } else {
+        // A new request, or the same sheet again with fresh content.
+        const pick = random(names.length + 1)
+        latestName = move === 4 ? latestName : (names[pick] ?? null)
+        request(latestName === null ? null : { name: latestName, version: ++version })
+      }
+      const shown = presented()
+      if (shown?.visible) {
+        expect(shown.name).toBe(latestName)
+      }
+    }
+    // Settle: finishing every pending hide lands on the latest request.
+    for (let i = 0; i < 3; i++) {
+      if (presented()?.visible === false) {
+        finishHide()
+      }
+    }
+    expect(presented()?.name ?? null).toBe(latestName)
+
+    expect(modals.all.length).toBeGreaterThan(20)
+    for (const drawer of modals.all) {
+      expect(drawer.keys.size).toBe(1)
+    }
+    // Each Modal mounted in a later commit than the one before it left.
+    const ordered = modals.events
+    for (let i = 1; i < ordered.length; i++) {
+      const event = ordered[i]!
+      if (event.type === 'mount') {
+        const previous = ordered[i - 1]!
+        expect(previous.type).toBe('unmount')
+        expect(event.commit).toBeGreaterThan(previous.commit)
+      }
+    }
+  })
+})
diff --git a/mobile/src/components/keyed-bottom-drawer.tsx b/mobile/src/components/keyed-bottom-drawer.tsx
new file mode 100644
index 000000000000..83265cc079b4
--- /dev/null
+++ b/mobile/src/components/keyed-bottom-drawer.tsx
@@ -0,0 +1,106 @@
+import { type ReactNode, useCallback, useEffect, useRef, useState } from 'react'
+import { MountedBottomDrawer, type MountedBottomDrawerProps } from './mounted-bottom-drawer'
+
+// iOS cannot present a native Modal while another is still presented, even mid-close, so one
+// drawer owns what is on screen and swaps sheets only after the previous Modal has unmounted.
+
+type Props<T> = Omit<MountedBottomDrawerProps, 'visible' | 'onClose' | 'onHidden' | 'children'> & {
+  /** The sheet the screen wants shown, or null for none. */
+  sheet: T | null
+  /** Sheets with the same key are one presentation: new content refreshes it in place. */
+  sheetKey: (sheet: T) => string
+  onClose: (presented: T) => void
+  /** Runs once a sheet's Modal has unmounted, in the commit after it left the tree. */
+  onAfterClose?: (closed: T) => void
+  children: (presented: T) => ReactNode
+}
+
+type Presentation<T> = {
+  presented: T | null
+  /** The presented sheet is animating closed. */
+  closing: boolean
+  /** Just unmounted; nothing may present until a commit without its Modal has landed. */
+  released: T | null
+  /** Identifies one mounted Modal so a hide from an earlier one cannot close a later one. */
+  epoch: number
+}
+
+export function KeyedBottomDrawer<T>({
+  sheet,
+  sheetKey,
+  onClose,
+  onAfterClose,
+  children,
+  ...drawerProps
+}: Props<T>) {
+  const [state, setState] = useState<Presentation<T>>(() => ({
+    presented: sheet,
+    closing: false,
+    released: null,
+    epoch: 0
+  }))
+  const onAfterCloseRef = useRef(onAfterClose)
+  useEffect(() => {
+    onAfterCloseRef.current = onAfterClose
+  }, [onAfterClose])
+
+  const next = followRequest(state, sheet, sheetKey)
+  // Why: present in the same render as the request so opening does not add a blank commit.
+  if (next !== state) {
+    setState(next)
+  }
+
+  const { epoch, released } = next
+  const handleHidden = useCallback(() => {
+    // Why: a hide that finished before a reopen re-showed this sheet must not unmount it.
+    setState((current) =>
+      current.epoch === epoch && current.closing
+        ? { presented: null, closing: false, released: current.presented, epoch: epoch + 1 }
+        : current
+    )
+  }, [epoch])
+
+  useEffect(() => {
+    if (released === null) {
+      return
+    }
+    onAfterCloseRef.current?.(released)
+    setState((current) =>
+      current.released === released ? { ...current, released: null } : current
+    )
+  }, [released])
+
+  const presented = next.presented
+  if (presented === null) {
+    return null
+  }
+  return (
+    <MountedBottomDrawer
+      {...drawerProps}
+      visible={!next.closing}
+      onClose={() => onClose(presented)}
+      onHidden={handleHidden}
+    >
+      {children(presented)}
+    </MountedBottomDrawer>
+  )
+}
+
+function followRequest<T>(
+  state: Presentation<T>,
+  sheet: T | null,
+  sheetKey: (sheet: T) => string
+): Presentation<T> {
+  const { presented } = state
+  if (presented === null) {
+    return sheet !== null && state.released === null
+      ? { ...state, presented: sheet, closing: false }
+      : state
+  }
+  if (sheet !== null && sheetKey(sheet) === sheetKey(presented)) {
+    return sheet !== presented || state.closing
+      ? { ...state, presented: sheet, closing: false }
+      : state
+  }
+  return state.closing ? state : { ...state, closing: true }
+}
diff --git a/mobile/src/components/mobile-agent-icon-assets.ts b/mobile/src/components/mobile-agent-icon-assets.ts
index 473b557096e0..8d0a6d474f7c 100644
--- a/mobile/src/components/mobile-agent-icon-assets.ts
+++ b/mobile/src/components/mobile-agent-icon-assets.ts
@@ -18,6 +18,7 @@ export const MOBILE_AGENT_ICON_ASSETS: Partial<Record<TuiAgent, ImageSourcePropT
   ante: require('../../../src/shared/agent-icons/ante.png'),
   trae: require('../../../src/shared/agent-icons/trae.png'),
   'prime-agent': require('../../../src/shared/agent-icons/prime-agent.png'),
+  qoder: require('../../../src/shared/agent-icons/qoder.png'),
   gemini: require('../../../src/shared/agent-icons/gemini.png'),
   antigravity: require('../../../src/shared/agent-icons/antigravity.png'),
   goose: require('../../../src/shared/agent-icons/goose.png'),
@@ -29,6 +30,7 @@ export const MOBILE_AGENT_ICON_ASSETS: Partial<Record<TuiAgent, ImageSourcePropT
   autohand: require('../../../src/shared/agent-icons/autohand.png'),
   cline: require('../../../src/shared/agent-icons/cline.png'),
   codebuff: require('../../../src/shared/agent-icons/codebuff.png'),
+  freebuff: require('../../../src/shared/agent-icons/freebuff.png'),
   'command-code': require('../../../src/shared/agent-icons/command-code.png'),
   continue: require('../../../src/shared/agent-icons/continue.png'),
   cursor: require('../../../src/shared/agent-icons/cursor.png'),
@@ -40,6 +42,7 @@ export const MOBILE_AGENT_ICON_ASSETS: Partial<Record<TuiAgent, ImageSourcePropT
   hermes: require('../../../src/shared/agent-icons/hermes.png'),
   devin: require('../../../src/shared/agent-icons/devin.png'),
   muse: require('../../../src/shared/agent-icons/muse.png'),
+  dsh: require('../../../src/shared/agent-icons/dsh.png'),
   zcode: require('../../../src/shared/agent-icons/zcode.png'),
   openclaw: require('../../../src/shared/agent-icons/openclaw.png')
 }
diff --git a/mobile/src/components/mobile-diff-review-send-sheet-stacking.test.ts b/mobile/src/components/mobile-diff-review-send-sheet-stacking.test.ts
new file mode 100644
index 000000000000..017f57b28db2
--- /dev/null
+++ b/mobile/src/components/mobile-diff-review-send-sheet-stacking.test.ts
@@ -0,0 +1,308 @@
+import { createElement } from 'react'
+import { act, create, type ReactTestInstance, type ReactTestRenderer } from 'react-test-renderer'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { DiffComment } from '../../../src/shared/diff-comment-types'
+import type { RpcClient } from '../transport/rpc-client'
+import type { ReviewScreenState } from '../session/mobile-diff-review-screen-model'
+
+// iOS cannot present a review sheet while another is still on screen (even mid-close): the second
+// presentation silently fails and every later tap on the screen is swallowed. These drive the real
+// controller and keyed drawer; only the native drawer is mocked, and its finished hide animation is
+// played by calling its `onHidden`.
+
+vi.mock('react-native', () => ({
+  ActivityIndicator: 'ActivityIndicator',
+  KeyboardAvoidingView: 'KeyboardAvoidingView',
+  Platform: { OS: 'ios' },
+  Pressable: 'Pressable',
+  StyleSheet: { create: <T>(styles: T) => styles, hairlineWidth: 1 },
+  Text: 'Text',
+  TextInput: 'TextInput',
+  View: 'View'
+}))
+vi.mock('lucide-react-native', () => ({
+  Check: 'Check',
+  Copy: 'Copy',
+  Edit3: 'Edit3',
+  FileText: 'FileText',
+  Plus: 'Plus',
+  Send: 'Send',
+  Trash2: 'Trash2',
+  X: 'X'
+}))
+vi.mock('expo-haptics', () => ({
+  impactAsync: vi.fn(async () => {}),
+  notificationAsync: vi.fn(async () => {}),
+  selectionAsync: vi.fn(async () => {}),
+  performAndroidHapticsAsync: vi.fn(async () => {}),
+  AndroidHaptics: {},
+  ImpactFeedbackStyle: {},
+  NotificationFeedbackType: {}
+}))
+vi.mock('expo-clipboard', () => ({ setStringAsync: vi.fn() }))
+vi.mock('./mobile-diff-review-screen-styles', () => ({
+  mobileDiffReviewStyles: new Proxy({}, { get: () => ({}) })
+}))
+vi.mock('./mounted-bottom-drawer', () => ({ MountedBottomDrawer: 'MountedBottomDrawer' }))
+const loadSnapshot = vi.hoisted(() => vi.fn())
+vi.mock('../session/mobile-diff-review-loaders', () => ({
+  loadMobileDiffReviewSnapshot: loadSnapshot,
+  loadMobileDiffReviewDiff: vi.fn().mockResolvedValue({ kind: 'idle' })
+}))
+vi.mock('../session/use-mobile-pr-sidebar-controller', () => ({
+  useMobilePrSidebarController: () => ({})
+}))
+
+const { MobileDiffReviewDrawers } = await import('./MobileDiffReviewDrawers')
+const { useMobileDiffReviewController } =
+  await import('../session/use-mobile-diff-review-controller')
+
+type Controller = ReturnType<typeof useMobileDiffReviewController>
+type Deferred = { promise: Promise<unknown>; resolve: (value: unknown) => void }
+
+function deferred(): Deferred {
+  let resolve: (value: unknown) => void = () => {}
+  const promise = new Promise<unknown>((settle) => {
+    resolve = settle
+  })
+  return { promise, resolve }
+}
+
+const NOTE: DiffComment = {
+  id: 'note-1',
+  worktreeId: 'wt-1',
+  filePath: 'src/a.ts',
+  lineNumber: 3,
+  body: 'rename this',
+  createdAt: 1,
+  side: 'modified'
+}
+
+const SNAPSHOT: ReviewScreenState = {
+  kind: 'ready',
+  status: {
+    entries: [{ path: 'src/a.ts', status: 'modified', area: 'unstaged' }],
+    conflictOperation: undefined,
+    upstreamStatus: undefined,
+    branch: 'feature',
+    head: 'abc123'
+  },
+  branchCompare: null,
+  comments: [NOTE],
+  reviewState: { version: 1, files: {} }
+}
+
+const TABS_REPLY = {
+  id: 'tabs',
+  ok: true,
+  result: { tabs: [{ type: 'terminal', id: 'tab-1', terminal: 'terminal-1', title: 'codex' }] },
+  _meta: { runtimeId: 'runtime' }
+}
+const SAVE_REPLY = { id: 'save', ok: true, result: {}, _meta: { runtimeId: 'runtime' } }
+
+let renderer: ReactTestRenderer | null = null
+let controller: Controller
+let replies: Map<string, Deferred>
+
+function Screen({ client }: { client: RpcClient }) {
+  controller = useMobileDiffReviewController({
+    client,
+    connState: 'connected',
+    hostId: 'host-1',
+    worktreeId: 'wt-1',
+    name: 'review',
+    initialFilter: 'all',
+    initialTarget: null,
+    onOpenSession: () => {},
+    onReconnect: null
+  })
+  return createElement(MobileDiffReviewDrawers, { controller })
+}
+
+/** Every RPC waits until the test answers it, so each case controls when a load or save lands. */
+async function mountScreen(): Promise<void> {
+  replies = new Map()
+  const sendRequest = vi.fn((method: string) => {
+    const reply = deferred()
+    replies.set(method, reply)
+    return reply.promise
+  })
+  loadSnapshot.mockResolvedValue(SNAPSHOT)
+  await act(async () => {
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the operations under test only call `sendRequest`.
+    renderer = create(createElement(Screen, { client: { sendRequest } as unknown as RpcClient }))
+    await Promise.resolve()
+  })
+  expect(controller.currentItem).not.toBeNull()
+}
+
+async function answer(method: string, reply: unknown): Promise<void> {
+  const pending = replies.get(method)
+  expect(pending, `${method} was never requested`).toBeDefined()
+  await act(async () => {
+    pending?.resolve(reply)
+    await new Promise((settle) => setTimeout(settle, 0))
+  })
+}
+
+function textOf(node: ReactTestInstance): string[] {
+  return node
+    .findAll((child) => String(child.type) === 'Text')
+    .flatMap((text) => text.children.filter((child) => typeof child === 'string'))
+}
+
+/** Every mounted native drawer: each is its own Modal, so there must never be two. */
+function mountedDrawers(): ReactTestInstance[] {
+  return renderer!.root.findAll((node) => String(node.type) === 'MountedBottomDrawer')
+}
+
+/** The mounted sheet, which must carry this title (the first text it renders). */
+function drawer(title: string): ReactTestInstance {
+  const [mounted, ...others] = mountedDrawers()
+  expect(others).toEqual([])
+  expect(mounted && textOf(mounted)[0]).toBe(title)
+  return mounted!
+}
+
+function shownSheets(): string[] {
+  const mounted = mountedDrawers()
+  expect(mounted.length).toBeLessThanOrEqual(1)
+  return mounted.filter((node) => node.props.visible === true).map((node) => textOf(node)[0]!)
+}
+
+function press(within: ReactTestInstance, label: string): void {
+  const target = within.find(
+    (node) =>
+      String(node.type) === 'Pressable' &&
+      (node.props.accessibilityLabel === label || textOf(node).includes(label))
+  )
+  act(() => target.props.onPress())
+}
+
+/** The drawer's native hide animation finished. */
+function finishClosing(title: string): void {
+  const closing = drawer(title)
+  expect(closing.props.visible).toBe(false)
+  act(() => closing.props.onHidden())
+}
+
+/** Marks the only file reviewed; the save stays in flight until `answer('worktree.set')`. */
+function startMarkReviewed(): Promise<void> {
+  let marking: Promise<void> = Promise.resolve()
+  act(() => {
+    marking = controller.markReviewed()
+  })
+  return marking
+}
+
+async function completeReview(): Promise<void> {
+  const marking = startMarkReviewed()
+  await answer('worktree.set', SAVE_REPLY)
+  await act(() => marking)
+}
+
+beforeEach(() => {
+  loadSnapshot.mockReset()
+})
+
+afterEach(() => {
+  act(() => renderer?.unmount())
+  renderer = null
+})
+
+describe('review screen sheets never stack', () => {
+  it('Send Unsent Notes shows Send Notes only after Review Actions has closed', async () => {
+    await mountScreen()
+    act(() => controller.openSheet({ kind: 'actions' }))
+    expect(shownSheets()).toEqual(['Review Actions'])
+
+    press(drawer('Review Actions'), 'Send Unsent Notes')
+    expect(shownSheets()).toEqual([])
+
+    await answer('session.tabs.list', TABS_REPLY)
+    expect(shownSheets()).toEqual([])
+
+    finishClosing('Review Actions')
+    expect(shownSheets()).toEqual(['Send Notes'])
+    expect(textOf(drawer('Send Notes'))).toContain('codex (termin)')
+  })
+
+  it('Review Complete → Send shows Send Notes only after Review Complete has closed', async () => {
+    await mountScreen()
+    await completeReview()
+    expect(shownSheets()).toEqual(['Review Complete'])
+
+    press(drawer('Review Complete'), 'Send notes to agent')
+    expect(shownSheets()).toEqual([])
+
+    finishClosing('Review Complete')
+    expect(shownSheets()).toEqual(['Send Notes'])
+  })
+
+  it('does not open Send Notes when Review Complete closes for another reason', async () => {
+    await mountScreen()
+    await completeReview()
+
+    act(() => drawer('Review Complete').props.onClose())
+    finishClosing('Review Complete')
+
+    expect(shownSheets()).toEqual([])
+  })
+
+  it('Review Complete arriving while another sheet is open waits for that sheet to close', async () => {
+    await mountScreen()
+    const marking = startMarkReviewed()
+    // The user opens Review Actions while the save is still in flight.
+    act(() => controller.openSheet({ kind: 'actions' }))
+    await answer('worktree.set', SAVE_REPLY)
+    await act(() => marking)
+    expect(shownSheets()).toEqual(['Review Actions'])
+
+    act(() => drawer('Review Actions').props.onClose())
+    expect(shownSheets()).toEqual([])
+
+    finishClosing('Review Actions')
+    expect(shownSheets()).toEqual(['Review Complete'])
+  })
+
+  it('a sheet replaced before it was ever shown is never mounted', async () => {
+    await mountScreen()
+    act(() => {
+      controller.openSheet({ kind: 'completion' })
+      controller.openSheet({ kind: 'actions' })
+    })
+    expect(shownSheets()).toEqual(['Review Actions'])
+
+    act(() => {
+      controller.openSheet({ kind: 'completion' })
+      controller.closeSheet('completion')
+    })
+    expect(shownSheets()).toEqual([])
+    finishClosing('Review Actions')
+    expect(mountedDrawers()).toEqual([])
+  })
+
+  it('a send list that lands after Send Notes was dismissed does not bring it back', async () => {
+    await mountScreen()
+    act(() => void controller.openSendSheet())
+    expect(shownSheets()).toEqual(['Send Notes'])
+
+    act(() => drawer('Send Notes').props.onClose())
+    await answer('session.tabs.list', TABS_REPLY)
+    finishClosing('Send Notes')
+    expect(mountedDrawers()).toEqual([])
+
+    act(() => controller.openSheet({ kind: 'actions' }))
+    expect(shownSheets()).toEqual(['Review Actions'])
+  })
+
+  it('Discard keeps its file through the close and discards the file it showed', async () => {
+    await mountScreen()
+    const target = controller.currentItem!
+    act(() => controller.openSheet({ kind: 'discard', target }))
+    press(drawer('Discard File'), 'Discard')
+    expect(shownSheets()).toEqual([])
+    expect(textOf(drawer('Discard File')).join(' ')).toContain(target.filePath)
+    expect(replies.has('git.discard')).toBe(true)
+  })
+})
diff --git a/mobile/src/components/mounted-bottom-drawer-page-keyboard.web.test.tsx b/mobile/src/components/mounted-bottom-drawer-page-keyboard.web.test.tsx
index a741f5c864da..d7d0c67a0cbb 100644
--- a/mobile/src/components/mounted-bottom-drawer-page-keyboard.web.test.tsx
+++ b/mobile/src/components/mounted-bottom-drawer-page-keyboard.web.test.tsx
@@ -69,6 +69,7 @@ vi.mock('react-native-reanimated', () => ({
 }))
 
 import { MountedBottomDrawer } from './mounted-bottom-drawer'
+import { publishShellKeyboardSource } from '../platform/keyboard-occlusion.web'
 
 const RESTING_HEIGHT = 900
 const IME_HEIGHT = 300
@@ -106,15 +107,36 @@ describe('a fill-mode sheet on the page', () => {
     act(() => renderer.unmount())
   })
 
-  it('does not lift over a keyboard the shell already shortened the WebView for', () => {
-    setWindowHeight(RESTING_HEIGHT)
-    const renderer = renderFillSheet()
-    act(() => setWindowHeight(RESTING_HEIGHT - IME_HEIGHT))
-    // The shortened window is the whole avoidance: the sheet's height follows it and nothing lifts.
-    expect(sheetStyle(renderer)).toMatchObject({
-      marginBottom: 0,
-      height: RESTING_HEIGHT - IME_HEIGHT - 24 - 16
+  it('sits on the keyboard the shell says covers the page, as it does natively', () => {
+    let height = 0
+    const listeners = new Set<(next: number) => void>()
+    publishShellKeyboardSource({
+      read: () => height,
+      subscribe: (listener) => {
+        listeners.add(listener)
+        return () => listeners.delete(listener)
+      }
     })
-    act(() => renderer.unmount())
+    try {
+      setWindowHeight(RESTING_HEIGHT)
+      const renderer = renderFillSheet()
+      act(() => {
+        height = IME_HEIGHT
+        listeners.forEach((listener) => listener(IME_HEIGHT))
+      })
+      expect(sheetStyle(renderer)).toMatchObject({
+        marginBottom: IME_HEIGHT,
+        height: RESTING_HEIGHT - IME_HEIGHT - 24 - 16
+      })
+      act(() => {
+        height = 0
+        listeners.forEach((listener) => listener(0))
+      })
+      expect(sheetStyle(renderer).marginBottom).toBe(0)
+      act(() => renderer.unmount())
+      expect(listeners.size).toBe(0)
+    } finally {
+      publishShellKeyboardSource(null)
+    }
   })
 })
diff --git a/mobile/src/components/mounted-bottom-drawer.tsx b/mobile/src/components/mounted-bottom-drawer.tsx
index ea85c3208610..764a3c5437e5 100644
--- a/mobile/src/components/mounted-bottom-drawer.tsx
+++ b/mobile/src/components/mounted-bottom-drawer.tsx
@@ -1,13 +1,5 @@
 import { type ReactNode, useCallback, useEffect, useRef, useState } from 'react'
-import {
-  View,
-  Pressable,
-  useWindowDimensions,
-  ScrollView,
-  Keyboard,
-  Modal,
-  Platform
-} from 'react-native'
+import { View, Pressable, useWindowDimensions, ScrollView, Keyboard, Modal } from 'react-native'
 import { useSafeAreaInsets } from 'react-native-safe-area-context'
 import { Gesture, GestureDetector, GestureHandlerRootView } from 'react-native-gesture-handler'
 import Animated, {
@@ -29,6 +21,7 @@ import { useInsideBottomDrawerModalHost } from './bottom-drawer-modal-host'
 import { useResponsiveLayout } from '../layout/responsive-layout'
 import { useBackClaim } from '../navigation/use-back-claim'
 import { currentSoftKeyboardHeight, subscribeSoftKeyboard } from '../platform/keyboard-occlusion'
+import { hostOs } from '../platform/host-os'
 
 const DISMISS_THRESHOLD = 80
 const SPRING_CONFIG = { damping: 28, stiffness: 400 }
@@ -131,8 +124,7 @@ export function MountedBottomDrawer({
   // Why: KeyboardAvoidingView and useAnimatedKeyboard are both unreliable
   // inside Modal (iOS ignores KAV; Android needs adjustNothing for
   // useAnimatedKeyboard). The keyboard seam's events work on both platforms
-  // and give the exact height; inside the shell's page none fire, because
-  // the shell shortens the WebView above the IME.
+  // and give the exact height; inside the shell's page they are the shell's.
   useEffect(() => {
     // Pinned-under sheets stay visible for size but must not ride the keyboard —
     // only the top interactive sheet owns inset/lift.
@@ -147,7 +139,7 @@ export function MountedBottomDrawer({
         keyboardHeight,
         bottomInset: insets.bottom,
         fillAvailable,
-        platform: Platform.OS
+        platform: hostOs()
       })
       setKeyboardInset(inset)
       if (duration > 0) {
@@ -185,13 +177,18 @@ export function MountedBottomDrawer({
   }, [visible, interactive, insets.bottom, fillAvailable])
 
   const dismiss = useCallback(() => {
+    // Why: restarting the hide animation cancels it, so onHidden never fires and the
+    // invisible Modal stays up swallowing taps (Android Back lands here mid-close).
+    if (!visible) {
+      return
+    }
     Keyboard.dismiss()
     progress.value = withTiming(0, { duration: BOTTOM_DRAWER_HIDE_DURATION_MS }, (finished) => {
       if (finished) {
         runOnJS(onClose)()
       }
     })
-  }, [onClose, progress])
+  }, [onClose, progress, visible])
 
   // One seam, both platforms: natively this is the hardware key, and inside the shell's page it is
   // a claim the shell hands one press over on. Every session sheet renders through this component,
diff --git a/mobile/src/diagnostics/use-mobile-web-bundle-probe.test.tsx b/mobile/src/diagnostics/use-mobile-web-bundle-probe.test.tsx
index c7878e65ea54..b72cb584d02e 100644
--- a/mobile/src/diagnostics/use-mobile-web-bundle-probe.test.tsx
+++ b/mobile/src/diagnostics/use-mobile-web-bundle-probe.test.tsx
@@ -23,6 +23,9 @@ vi.mock('../transport/runtime-status-probe', () => ({ startRuntimeStatusProbe: (
 vi.mock('../transport/connection-revival-triggers', () => ({
   subscribeConnectionRevivalTriggers: () => () => {}
 }))
+vi.mock('../transport/connection-log-background-flush', () => ({
+  subscribeConnectionLogBackgroundFlush: () => () => {}
+}))
 vi.mock('../transport/mobile-web-bundle-fetch', () => ({
   fetchMobileWebBundle: (...args: unknown[]) => fetchMock(...args)
 }))
diff --git a/mobile/src/host-edit-route-accessibility.test.ts b/mobile/src/host-edit-route-accessibility.test.ts
index d5fc20521a94..12d4ae230e14 100644
--- a/mobile/src/host-edit-route-accessibility.test.ts
+++ b/mobile/src/host-edit-route-accessibility.test.ts
@@ -5,7 +5,7 @@ import EditHostScreen from '../app/h/[hostId]/edit'
 
 const dependencies = vi.hoisted(() => ({
   back: vi.fn(),
-  forceReconnectHost: vi.fn(),
+  refreshHostClient: vi.fn(),
   loadHosts: vi.fn(),
   primeHosts: vi.fn(),
   updateHostNameAndEndpoint: vi.fn()
@@ -42,8 +42,8 @@ vi.mock('./transport/host-store', () => ({
 }))
 
 vi.mock('./transport/client-context', () => ({
-  useForceReconnect: () => dependencies.forceReconnectHost,
-  usePrimeHosts: () => dependencies.primeHosts
+  usePrimeHosts: () => dependencies.primeHosts,
+  useRefreshHostClient: () => dependencies.refreshHostClient
 }))
 
 async function renderEditHostRoute(): Promise<ReactTestRenderer> {
diff --git a/mobile/src/host-edit-save-flow.test.ts b/mobile/src/host-edit-save-flow.test.ts
index 835af6330f3e..0c55da0cb0fe 100644
--- a/mobile/src/host-edit-save-flow.test.ts
+++ b/mobile/src/host-edit-save-flow.test.ts
@@ -5,7 +5,7 @@ import EditHostScreen from '../app/h/[hostId]/edit'
 
 const dependencies = vi.hoisted(() => ({
   back: vi.fn(),
-  forceReconnectHost: vi.fn(),
+  refreshHostClient: vi.fn(),
   loadHosts: vi.fn(),
   primeHosts: vi.fn(),
   updateHostNameAndEndpoint: vi.fn(),
@@ -43,8 +43,8 @@ vi.mock('./transport/host-store', () => ({
 }))
 
 vi.mock('./transport/client-context', () => ({
-  useForceReconnect: () => dependencies.forceReconnectHost,
-  usePrimeHosts: () => dependencies.primeHosts
+  usePrimeHosts: () => dependencies.primeHosts,
+  useRefreshHostClient: () => dependencies.refreshHostClient
 }))
 
 const HOST_FIXTURE = {
@@ -120,7 +120,7 @@ describe('edit host handleSave', () => {
   beforeEach(() => {
     dependencies.hostId = 'host-1'
     dependencies.back.mockReset()
-    dependencies.forceReconnectHost.mockReset().mockResolvedValue(undefined)
+    dependencies.refreshHostClient.mockReset()
     dependencies.loadHosts.mockReset().mockResolvedValue([HOST_FIXTURE])
     dependencies.primeHosts.mockReset()
     dependencies.updateHostNameAndEndpoint.mockReset().mockResolvedValue(undefined)
@@ -143,7 +143,7 @@ describe('edit host handleSave', () => {
     expect(dependencies.updateHostNameAndEndpoint).toHaveBeenCalledWith('host-1', {
       personalName: 'Home Desk'
     })
-    expect(dependencies.forceReconnectHost).not.toHaveBeenCalled()
+    expect(dependencies.refreshHostClient).not.toHaveBeenCalled()
     expect(dependencies.back).toHaveBeenCalledTimes(1)
 
     act(() => renderer.unmount())
@@ -157,7 +157,7 @@ describe('edit host handleSave', () => {
     expect(dependencies.updateHostNameAndEndpoint).toHaveBeenCalledWith('host-1', {
       endpoint: 'ws://192.168.1.20:6768'
     })
-    expect(dependencies.forceReconnectHost).toHaveBeenCalledWith('host-1')
+    expect(dependencies.refreshHostClient).toHaveBeenCalledWith('host-1')
     expect(dependencies.back).toHaveBeenCalledTimes(1)
 
     act(() => renderer.unmount())
@@ -174,7 +174,7 @@ describe('edit host handleSave', () => {
       personalName: 'Home Desk',
       endpoint: 'ws://192.168.1.20:6768'
     })
-    expect(dependencies.forceReconnectHost).toHaveBeenCalledWith('host-1')
+    expect(dependencies.refreshHostClient).toHaveBeenCalledWith('host-1')
     expect(dependencies.back).toHaveBeenCalledTimes(1)
 
     act(() => renderer.unmount())
@@ -185,7 +185,7 @@ describe('edit host handleSave', () => {
     await pressSave(renderer)
 
     expect(dependencies.updateHostNameAndEndpoint).not.toHaveBeenCalled()
-    expect(dependencies.forceReconnectHost).not.toHaveBeenCalled()
+    expect(dependencies.refreshHostClient).not.toHaveBeenCalled()
     expect(dependencies.back).toHaveBeenCalledTimes(1)
 
     act(() => renderer.unmount())
@@ -198,7 +198,7 @@ describe('edit host handleSave', () => {
     await pressSave(renderer)
 
     expect(findText(renderer, 'Host not found')).toBe(true)
-    expect(dependencies.forceReconnectHost).not.toHaveBeenCalled()
+    expect(dependencies.refreshHostClient).not.toHaveBeenCalled()
     expect(dependencies.back).not.toHaveBeenCalled()
 
     act(() => renderer.unmount())
@@ -218,23 +218,6 @@ describe('edit host handleSave', () => {
     act(() => renderer.unmount())
   })
 
-  it('still navigates back and shows no error when the post-save reconnect rejects', async () => {
-    dependencies.forceReconnectHost.mockRejectedValueOnce(new Error('connect failed'))
-    const renderer = await renderEditHostRoute()
-    setFieldValue(renderer, 'Address', '192.168.1.20:6768')
-    await pressSave(renderer)
-    await act(async () => {
-      await Promise.resolve()
-      await Promise.resolve()
-    })
-
-    expect(dependencies.forceReconnectHost).toHaveBeenCalledWith('host-1')
-    expect(dependencies.back).toHaveBeenCalledTimes(1)
-    expect(findText(renderer, 'connect failed')).toBe(false)
-
-    act(() => renderer.unmount())
-  })
-
   it('ignores a second Save trigger while a save is already in flight', async () => {
     let resolveSave: () => void = () => {}
     dependencies.updateHostNameAndEndpoint.mockImplementationOnce(
@@ -269,7 +252,7 @@ describe('edit host load() error states', () => {
   beforeEach(() => {
     dependencies.hostId = 'host-1'
     dependencies.back.mockReset()
-    dependencies.forceReconnectHost.mockReset().mockResolvedValue(undefined)
+    dependencies.refreshHostClient.mockReset()
     dependencies.loadHosts.mockReset().mockResolvedValue([HOST_FIXTURE])
     dependencies.primeHosts.mockReset()
     dependencies.updateHostNameAndEndpoint.mockReset().mockResolvedValue(undefined)
diff --git a/mobile/src/mobile-web-shell/MobileWebShellScreen.test.tsx b/mobile/src/mobile-web-shell/MobileWebShellScreen.test.tsx
index b41c67a2d710..a93f503bd63a 100644
--- a/mobile/src/mobile-web-shell/MobileWebShellScreen.test.tsx
+++ b/mobile/src/mobile-web-shell/MobileWebShellScreen.test.tsx
@@ -39,14 +39,13 @@ import {
   textOf,
   updateScreen as reRenderScreen
 } from './mobile-web-shell-screen-test-harness'
-import { BRIDGE_BACK_CLAIM_NOTIFY, BRIDGE_BACK_FRAME } from './bridge/bridge-page-back'
+import { BRIDGE_BACK_CLAIM_NOTIFY } from './bridge/bridge-page-back'
 import { BRIDGE_PAGE_PAINTED } from './bridge/bridge-page-painted'
 import {
   BRIDGE_FAULT_GRANT,
   BRIDGE_NAVIGATE_BACK_NOTIFY,
   readBridgeHostMessage
 } from './bridge/bridge-envelope'
-import { BRIDGE_ROUTE_UPDATE_ACCEPT } from './bridge/bridge-route-update'
 import { MobileWebShellScreen } from './MobileWebShellScreen'
 import type { MobileWebShellSessionState } from './mobile-web-shell-session-contract'
 import type { ReactTestInstance, ReactTestRenderer } from 'react-test-renderer'
@@ -227,7 +226,7 @@ describe('the hybrid shell screen', () => {
     tree: ReactTestRenderer
     initRoutes: () => (Record<string, string> | undefined)[]
     move: (next: Record<string, string>) => Promise<void>
-    ready: (accepts?: readonly string[]) => Promise<void>
+    ready: () => Promise<void>
   }> {
     const element = (next: Record<string, string>) =>
       createElement(MobileWebShellScreen, {
@@ -259,10 +258,10 @@ describe('the hybrid shell screen', () => {
           tree.update(element(next))
         })
       },
-      ready: async (accepts = [BRIDGE_ROUTE_UPDATE_ACCEPT]) => {
+      ready: async () => {
         await act(async () => {
           byName(tree, 'ShellViewProbe')[0]?.props.onBridgeMessage({
-            nativeEvent: { json: clientFrame({ type: 'ready', accepts }) }
+            nativeEvent: { json: clientFrame({ type: 'ready' }) }
           })
         })
       }
@@ -302,18 +301,6 @@ describe('the hybrid shell screen', () => {
     warned.mockRestore()
   })
 
-  it('sends no second init to a page that never said it takes one', async () => {
-    dependencies.client = createFakeRpcClient()
-    const page = await renderForRoute({ paneKey: '' })
-    // A page built before route updates existed declares nothing, and reads a second `init` as a
-    // replacement: the route still moves, so its next `ready` is answered with the new one.
-    await page.ready([])
-    await page.move({ paneKey: 'pane-1' })
-    expect(page.initRoutes()).toEqual([{ paneKey: '' }])
-    await page.ready([])
-    expect(page.initRoutes()).toEqual([{ paneKey: '' }, { paneKey: 'pane-1' }])
-  })
-
   it('ends that wait on the page asking for a session', async () => {
     dependencies.client = createFakeRpcClient()
     const tree = await renderScreen(readyState('session-one'))
@@ -434,7 +421,7 @@ describe('the hybrid shell screen', () => {
     const tree = await renderScreen(readyState('session-one'))
     await act(async () => {
       byName(tree, 'ShellViewProbe')[0].props.onBridgeMessage({
-        nativeEvent: { json: clientFrame({ type: 'ready', accepts: [BRIDGE_BACK_FRAME] }) }
+        nativeEvent: { json: clientFrame({ type: 'ready' }) }
       })
       byName(tree, 'ShellViewProbe')[0].props.onBridgeMessage({
         nativeEvent: {
@@ -661,25 +648,6 @@ describe('what one case mutates does not reach the next', () => {
       client: null
     })
   })
-
-  it('keeps both bar strips off the view for a page that does not pad for them', async () => {
-    // A page served from an older desktop has no reader for the insets, so the shell reserves
-    // the strips itself. Edge-to-edge makes the manifest's `adjustResize` inert, so the keyboard
-    // strip comes off the view too: the page's `visualViewport` reads full height with the IME up.
-    const tree = await renderScreen(readyState('session-keyboard'))
-    const root = tree.root.find((node) => node.props.testID === 'mobile-web-shell-ready')
-    expect(root.props.style[1]).toEqual({ paddingTop: 44, paddingBottom: 8 })
-
-    await act(async () => {
-      dependencies.keyboardListeners.get('keyboardWillShow')?.({ endCoordinates: { height: 336 } })
-    })
-    expect(root.props.style[1]).toEqual({ paddingTop: 44, paddingBottom: 336 })
-
-    await act(async () => {
-      dependencies.keyboardListeners.get('keyboardWillHide')?.({ endCoordinates: { height: 0 } })
-    })
-    expect(root.props.style[1]).toEqual({ paddingTop: 44, paddingBottom: 8 })
-  })
 })
 
 /**
@@ -718,17 +686,17 @@ describe('the frame under a page that has not painted', () => {
     expect(tree.root.findAll((node) => node.props.testID === 'mobile-web-shell-cover')).toEqual([])
   })
 
-  it('covers the same box the view gets, which is what the keyboard strip shortens', async () => {
+  it('covers the same box the view gets, which the keyboard does not shorten', async () => {
     // Both are children of the padded root: the view is `flex: 1` and the cover is an absolute
-    // fill, so Yoga lays each of them out against the same content box. The keyboard takes its
-    // strip off that box, so it takes it off both, and the cover cannot leave a gap the view fills.
+    // fill, so Yoga lays each of them out against the same content box, and the cover cannot leave
+    // a gap the view fills. The keyboard covers that box rather than taking a strip off it.
     dependencies.pageFrame = 'unpainted'
     const tree = await renderScreen(readyState('session-keyboard-cover'))
     const root = tree.root.find((node) => node.props.testID === 'mobile-web-shell-ready')
     await act(async () => {
       dependencies.keyboardListeners.get('keyboardWillShow')?.({ endCoordinates: { height: 336 } })
     })
-    expect(root.props.style[1]).toEqual({ paddingTop: 44, paddingBottom: 336 })
+    expect(root.props.style[1]).toEqual({ paddingTop: 0 })
     const cover = tree.root.find((node) => node.props.testID === 'mobile-web-shell-cover')
     expect(cover.props.style[0]).toMatchObject({
       position: 'absolute',
@@ -750,13 +718,10 @@ describe('the frame under a page that has not painted', () => {
     const probe = byName(tree, 'ShellViewProbe')[0]
     await act(async () => {
       probe.props.onBridgeMessage({
-        nativeEvent: { json: clientFrame({ type: 'ready', reports: [BRIDGE_PAGE_PAINTED] }) }
+        nativeEvent: { json: clientFrame({ type: 'ready' }) }
       })
     })
-    expect(dependencies.reportPageReady).toHaveBeenCalledWith({
-      reports: [BRIDGE_PAGE_PAINTED],
-      accepts: []
-    })
+    expect(dependencies.reportPageReady).toHaveBeenCalledTimes(1)
     await act(async () => {
       probe.props.onBridgeMessage({
         nativeEvent: { json: clientFrame({ type: 'notify', name: BRIDGE_PAGE_PAINTED }) }
diff --git a/mobile/src/mobile-web-shell/MobileWebShellScreen.tsx b/mobile/src/mobile-web-shell/MobileWebShellScreen.tsx
index 83d6d1724998..88cedd9fd6de 100644
--- a/mobile/src/mobile-web-shell/MobileWebShellScreen.tsx
+++ b/mobile/src/mobile-web-shell/MobileWebShellScreen.tsx
@@ -1,13 +1,5 @@
 import { useEffect, useState, type ReactNode } from 'react'
-import {
-  ActivityIndicator,
-  Linking,
-  Platform,
-  Pressable,
-  StyleSheet,
-  Text,
-  View
-} from 'react-native'
+import { ActivityIndicator, Linking, Pressable, StyleSheet, Text, View } from 'react-native'
 import { useNavigation, useRouter } from 'expo-router'
 import { useSafeAreaInsets } from 'react-native-safe-area-context'
 import {
@@ -34,7 +26,6 @@ import { playPageHaptic } from './page-haptics'
 import { useMobileWebShellBridge } from './use-mobile-web-shell-bridge'
 import type { MobileWebShellRuntime } from './mobile-web-shell-runtime'
 import { useKeyboardOcclusion } from '../platform/keyboard-occlusion'
-import { softwareKeyboardWindowInset } from '../platform/software-keyboard-window-inset'
 import { useNativeDeviceVerbs } from '../platform/use-native-device-verbs'
 import { useShellPageBack } from './use-shell-page-back'
 import { useShellStackPop } from './use-shell-stack-pop'
@@ -178,16 +169,6 @@ export function MobileWebShellScreen({
   runtime
 }: MobileWebShellScreenProps) {
   const insets = useSafeAreaInsets()
-  // The page cannot see the IME for itself: edge-to-edge makes the manifest's `adjustResize` inert,
-  // so the window never shrinks and `visualViewport` inside the WebView reads full height with the
-  // keyboard up — the session route lays its live input row out under the keys. The shell owns the
-  // window, so it takes the strip off the view and the page lays out in what is left.
-  const keyboardHeight = useKeyboardOcclusion()
-  const keyboardInset = softwareKeyboardWindowInset({
-    keyboardHeight,
-    bottomInset: insets.bottom,
-    platform: Platform.OS
-  })
   const router = useRouter()
   const navigation = useNavigation()
   const popShellStack = useShellStackPop()
@@ -207,19 +188,18 @@ export function MobileWebShellScreen({
     reportPageBackClaim,
     pageReady,
     pageFrame,
-    backClaimed,
-    pageOwnsSafeArea
+    backClaimed
   } = useMobileWebShellSession({ hostId, routePathname: route.pathname, runtime })
   // Which mount the notice was dismissed on, not whether it was: a later refusal opens its own
   // generation under a new session id, so it is not silenced by a tap on the one before it.
   const [noticeDismissedFor, setNoticeDismissedFor] = useState<string | null>(null)
   const noticeShown =
     updateNotice !== null && state.kind === 'ready' && noticeDismissedFor !== state.sessionId
-  const pageInsets = pageSafeAreaInsets({
-    insets,
-    keyboardInset,
-    topCovered: noticeShown
-  })
+  // The page cannot see the IME for itself: edge-to-edge makes `adjustResize` inert and the view's
+  // IME insets are zeroed, so `visualViewport` never shrinks. The keyboard covers the view like a
+  // native screen, and the page lifts by the height native screens read.
+  const keyboardInset = Math.max(0, useKeyboardOcclusion())
+  const pageInsets = pageSafeAreaInsets({ insets, topCovered: noticeShown })
   const { snapshot, unreadable, readStorage, refreshStorage, writeStorage } = usePageHostSnapshot(
     hostId,
     route.pathname
@@ -242,6 +222,7 @@ export function MobileWebShellScreen({
     hostId,
     route,
     safeAreaInsets: pageInsets,
+    keyboardInset,
     pageRoutes,
     pageRouteGrants,
     routeGrants,
@@ -264,12 +245,12 @@ export function MobileWebShellScreen({
     // the map as they are made. This re-seats that map on the store afterwards, for the key whose
     // write never persisted, and it runs on every ask because a document that reloads inside this
     // mount asks again.
-    onPageReady: (ready) => {
-      reportPageReady(ready)
+    onPageReady: () => {
+      reportPageReady()
       void refreshStorage()
     },
     // The one thing that says the page is something to look at. The cover below stays up until it
-    // lands, for a page that declared it would send one.
+    // lands.
     onPagePainted: reportPagePainted,
     // While this is true the key below belongs to the page, not to the stack this screen sits on.
     onPageBackClaim: reportPageBackClaim,
@@ -323,6 +304,11 @@ export function MobileWebShellScreen({
   }, [publishRoute, route])
 
   usePublishedSafeAreaInsets(bridge.publishSafeAreaInsets, pageInsets)
+  // Every keyboard event, a height change while open included, so the page never holds a stale one.
+  const publishKeyboardInset = bridge.publishKeyboardInset
+  useEffect(() => {
+    publishKeyboardInset(keyboardInset)
+  }, [publishKeyboardInset, keyboardInset])
 
   // The navigation object rather than the router: what this takes away is this screen's own place
   // on the stack, which is a screen option, and the router has no member that says it.
@@ -372,12 +358,9 @@ export function MobileWebShellScreen({
     <View
       style={[
         styles.shellRoot,
-        // Edge-to-edge like a native screen, for a page that pads for the bars itself; an older page
-        // keeps the strips. The keyboard strip stays off either way, since the page cannot see it,
-        // and the banner takes the status bar strip when it shows.
-        pageOwnsSafeArea
-          ? { paddingTop: noticeShown ? insets.top : 0, paddingBottom: keyboardInset }
-          : { paddingTop: insets.top, paddingBottom: Math.max(insets.bottom, keyboardInset) }
+        // Edge-to-edge like a native screen: the page pads for the bars itself from the insets
+        // `init` carries. The banner takes the status bar strip when it shows.
+        { paddingTop: noticeShown ? insets.top : 0 }
       ]}
       testID="mobile-web-shell-ready"
     >
diff --git a/mobile/src/mobile-web-shell/bridge-host-back.test.ts b/mobile/src/mobile-web-shell/bridge-host-back.test.ts
index 7010e85ea8b8..d368c74d524e 100644
--- a/mobile/src/mobile-web-shell/bridge-host-back.test.ts
+++ b/mobile/src/mobile-web-shell/bridge-host-back.test.ts
@@ -3,8 +3,8 @@ import { clientFrame } from './bridge-host-test-fakes'
 import { harness } from './bridge-host-test-harness'
 import { BRIDGE_BACK_CLAIM_NOTIFY, BRIDGE_BACK_FRAME } from './bridge/bridge-page-back'
 
-function ready(accepts?: readonly string[]): string {
-  return clientFrame(accepts === undefined ? { type: 'ready' } : { type: 'ready', accepts })
+function ready(): string {
+  return clientFrame({ type: 'ready' })
 }
 
 function claim(claimed: boolean): string {
@@ -21,7 +21,7 @@ function claim(claimed: boolean): string {
 describe('the claim a host holds on the device Back key', () => {
   it('carries the page taking the key and letting it go, and says neither twice', () => {
     const bridge = harness()
-    bridge.host.receive(ready([BRIDGE_BACK_FRAME]))
+    bridge.host.receive(ready())
     bridge.host.receive(claim(true))
     bridge.host.receive(claim(true))
     bridge.host.receive(claim(false))
@@ -30,15 +30,15 @@ describe('the claim a host holds on the device Back key', () => {
 
   it('drops it on the next document saying ready, which is the one that has to claim again', () => {
     const bridge = harness()
-    bridge.host.receive(ready([BRIDGE_BACK_FRAME]))
+    bridge.host.receive(ready())
     bridge.host.receive(claim(true))
-    bridge.host.receive(ready([BRIDGE_BACK_FRAME]))
+    bridge.host.receive(ready())
     expect(bridge.backClaims).toEqual([true, false])
   })
 
   it('drops it when the page closes, which is the document saying it is going', () => {
     const bridge = harness()
-    bridge.host.receive(ready([BRIDGE_BACK_FRAME]))
+    bridge.host.receive(ready())
     bridge.host.receive(claim(true))
     bridge.host.receive(clientFrame({ type: 'close' }))
     expect(bridge.backClaims).toEqual([true, false])
@@ -53,7 +53,7 @@ describe('the claim a host holds on the device Back key', () => {
    */
   it('reports nothing when the host itself ends: the claim belongs to the session', () => {
     const bridge = harness()
-    bridge.host.receive(ready([BRIDGE_BACK_FRAME]))
+    bridge.host.receive(ready())
     bridge.host.receive(claim(true))
     bridge.host.dispose()
     expect(bridge.backClaims).toEqual([true])
@@ -61,35 +61,35 @@ describe('the claim a host holds on the device Back key', () => {
 
   it('hands what the session established to the host that takes over from it', () => {
     const bridge = harness()
-    bridge.host.receive(ready([BRIDGE_BACK_FRAME]))
+    bridge.host.receive(ready())
     bridge.host.receive(claim(true))
     bridge.host.dispose()
-    expect(bridge.host.readSessionBack()).toEqual({ accepts: [BRIDGE_BACK_FRAME], claimed: true })
+    expect(bridge.host.readSessionBack()).toEqual({ claimed: true })
   })
 
   it('takes that seed without announcing a claim the screen never heard go', () => {
     const rebuilt = harness({
-      sessionBack: { accepts: [BRIDGE_BACK_FRAME], claimed: true },
+      sessionBack: { claimed: true },
       sessionEstablished: true
     })
     expect(rebuilt.backClaims).toEqual([])
-    // And it delivers on it: the page said it takes a press, over a session that is still open.
+    // And it delivers on it, over a session that is still open.
     expect(rebuilt.host.sendBack()).toBe(true)
     expect(rebuilt.last()).toEqual({ v: 1, type: BRIDGE_BACK_FRAME })
   })
 
   it('lets the next document reset a carried claim, so the seed is not a latch', () => {
     const rebuilt = harness({
-      sessionBack: { accepts: [BRIDGE_BACK_FRAME], claimed: true },
+      sessionBack: { claimed: true },
       sessionEstablished: true
     })
-    rebuilt.host.receive(ready([BRIDGE_BACK_FRAME]))
+    rebuilt.host.receive(ready())
     expect(rebuilt.backClaims).toEqual([false])
   })
 
   it('says nothing on a document that never claimed, so a drop is always a real one', () => {
     const bridge = harness()
-    bridge.host.receive(ready([BRIDGE_BACK_FRAME]))
+    bridge.host.receive(ready())
     bridge.host.receive(clientFrame({ type: 'close' }))
     bridge.host.dispose()
     expect(bridge.backClaims).toEqual([])
@@ -110,7 +110,7 @@ describe('the claim a host holds on the device Back key', () => {
 describe('handing one press to the page', () => {
   it('posts a back frame to a page that said it takes one', () => {
     const bridge = harness()
-    bridge.host.receive(ready([BRIDGE_BACK_FRAME]))
+    bridge.host.receive(ready())
     expect(bridge.host.sendBack()).toBe(true)
     expect(bridge.last()).toEqual({ v: 1, type: BRIDGE_BACK_FRAME })
   })
@@ -120,24 +120,16 @@ describe('handing one press to the page', () => {
    * one as `unrecognised-message` and drops the whole thing, so the shell must not send it. False
    * is what leaves the press to the navigator, which is what Back did before this lane.
    */
-  it('sends nothing to a page that never declared it, and says so to the caller', () => {
-    const bridge = harness()
-    bridge.host.receive(ready())
-    const before = bridge.posted.length
-    expect(bridge.host.sendBack()).toBe(false)
-    expect(bridge.posted).toHaveLength(before)
-  })
-
   it('sends nothing between documents, when the view belongs to no page', () => {
     const bridge = harness()
-    bridge.host.receive(ready([BRIDGE_BACK_FRAME]))
+    bridge.host.receive(ready())
     bridge.host.receive(clientFrame({ type: 'close' }))
     expect(bridge.host.sendBack()).toBe(false)
   })
 
   it('sends nothing once the host is disposed', () => {
     const bridge = harness()
-    bridge.host.receive(ready([BRIDGE_BACK_FRAME]))
+    bridge.host.receive(ready())
     bridge.host.dispose()
     expect(bridge.host.sendBack()).toBe(false)
   })
diff --git a/mobile/src/mobile-web-shell/bridge-host-back.ts b/mobile/src/mobile-web-shell/bridge-host-back.ts
index b9cbe108e553..a835be0e3549 100644
--- a/mobile/src/mobile-web-shell/bridge-host-back.ts
+++ b/mobile/src/mobile-web-shell/bridge-host-back.ts
@@ -2,8 +2,7 @@ import { BRIDGE_PROTOCOL_VERSION, type BridgeHostMessage } from './bridge/bridge
 import { BRIDGE_BACK_FRAME } from './bridge/bridge-page-back'
 
 /**
- * What one session has established about the device Back key: what its page declared it takes, and
- * whether it is holding the key right now.
+ * What one session has established about the device Back key: whether its page is holding it.
  *
  * Carried across a host rebuild rather than relearned, the way `sessionEstablished` already is. A
  * client swapped under a live page is not a new document — the WebView stays mounted and the page
@@ -11,8 +10,6 @@ import { BRIDGE_BACK_FRAME } from './bridge/bridge-page-back'
  * under an open sheet.
  */
 export type BridgeSessionBack = {
-  /** What the page's last `ready` said it takes. Empty for a page too old to name the frame. */
-  readonly accepts: readonly string[]
   readonly claimed: boolean
 }
 
@@ -29,14 +26,12 @@ export type BridgeSessionBack = {
  * whoever builds the replacement, and reports nothing, because the claim belongs to the session.
  */
 export type BridgeHostBack = {
-  /** A document has spoken: it takes what it named, and claims nothing until it says otherwise. */
-  readonly readReady: (accepts: readonly string[]) => void
+  /** A document has spoken: it claims nothing until it says otherwise. */
+  readonly readReady: () => void
   /** The page holding Back, or letting it go. */
   readonly readClaim: (claimed: boolean) => void
-  /**
-   * Posts one press. False when this page never said it takes one — every page older than the
-   * frame — and the caller then leaves Back to the navigator, which is what it did before this.
-   */
+  /** Posts one press. False when no document can take it, and the caller leaves Back to the
+   *  navigator. */
   readonly send: () => boolean
   /** The document is gone; whatever it claimed goes with it. */
   readonly drop: () => void
@@ -53,7 +48,6 @@ export function createBridgeHostBack(args: {
    *  a host opening a session of its own, which has established nothing yet. */
   established?: BridgeSessionBack
 }): BridgeHostBack {
-  let accepts: readonly string[] = args.established?.accepts ?? []
   // Seeded without a report: the screen never heard this claim go, because it did not.
   let claimed = args.established?.claimed ?? false
 
@@ -66,10 +60,7 @@ export function createBridgeHostBack(args: {
   }
 
   return {
-    readReady: (next) => {
-      accepts = next
-      drop()
-    },
+    readReady: drop,
     readClaim: (next) => {
       if (next === claimed) {
         return
@@ -78,13 +69,13 @@ export function createBridgeHostBack(args: {
       args.onClaim(next)
     },
     send: () => {
-      if (!accepts.includes(BRIDGE_BACK_FRAME) || !args.deliverable()) {
+      if (!args.deliverable()) {
         return false
       }
       args.send({ v: BRIDGE_PROTOCOL_VERSION, type: BRIDGE_BACK_FRAME })
       return true
     },
     drop,
-    read: () => ({ accepts, claimed })
+    read: () => ({ claimed })
   }
 }
diff --git a/mobile/src/mobile-web-shell/bridge-host-contract.ts b/mobile/src/mobile-web-shell/bridge-host-contract.ts
index f360fdc0d964..a9f9dfcb10b2 100644
--- a/mobile/src/mobile-web-shell/bridge-host-contract.ts
+++ b/mobile/src/mobile-web-shell/bridge-host-contract.ts
@@ -5,7 +5,6 @@ import type { BridgeRefusal } from './bridge/bridge-caps'
 import type { BridgeInitHost, BridgeInitRoute } from './bridge/bridge-envelope'
 import type { BridgeClearableRouteParam } from './bridge/bridge-route-update'
 import type { BridgeSafeAreaInsets } from './bridge/bridge-safe-area-insets'
-import type { PageReadyDeclaration } from './mobile-web-shell-session-contract'
 import type { BridgeHapticsKind } from './bridge/bridge-haptics-notify'
 import type { BridgeErrorCapture } from './bridge/bridge-error-capture'
 import type { BridgeNativeVerb } from './bridge/bridge-native-verbs'
@@ -133,6 +132,9 @@ export type BridgeHostOptions = {
   /** How much of the WebView sits under a system bar when it is drawn edge-to-edge. Zeros when
    *  absent; moved later with `publishSafeAreaInsets`. */
   safeAreaInsets?: BridgeSafeAreaInsets
+  /** The keyboard height native screens read on the shell's OS. 0 when absent; moved later with
+   *  `publishKeyboardInset`. */
+  keyboardInset?: number
   /**
    * This device's identity to that host, as the native screens already send it, swapped in for the
    * page's placeholder on the way out. Read at forward time rather than captured: the host outlives
@@ -202,12 +204,8 @@ export type BridgeHostOptions = {
    * the same reason as the fault: the shell bounds the wait for it, and a host built without this
    * would leave a document that never spoke looking exactly like one still starting up.
    */
-  onPageReady: (ready: PageReadyDeclaration) => void
-  /**
-   * The page has a frame on screen. Only pages whose `ready` listed `BRIDGE_PAGE_PAINTED` post it,
-   * which is why `onPageReady` carries that list: a caller covering the view until this arrives
-   * has to know whether it is coming, and a page served from an older desktop never sends one.
-   */
+  onPageReady: () => void
+  /** The page has a frame on screen, which a caller covering the view until then waits for. */
   onPagePainted: () => void
   /**
    * The page is holding the device Back key, or has let it go. Required, because the shell only
diff --git a/mobile/src/mobile-web-shell/bridge-host-init.test.ts b/mobile/src/mobile-web-shell/bridge-host-init.test.ts
index 6e2f86788f2d..0b0b52687fc1 100644
--- a/mobile/src/mobile-web-shell/bridge-host-init.test.ts
+++ b/mobile/src/mobile-web-shell/bridge-host-init.test.ts
@@ -7,10 +7,6 @@ import {
   BRIDGE_MAX_SUBSCRIPTIONS
 } from './bridge/bridge-caps'
 import { BRIDGE_FAULT_GRANT } from './bridge/bridge-envelope'
-import { BRIDGE_PAGE_CLIENT_IDENTITY_ACCEPT } from './bridge/bridge-page-client-identity'
-import { BRIDGE_BACK_CLAIM_NOTIFY } from './bridge/bridge-page-back'
-import { BRIDGE_PAGE_PAINTED } from './bridge/bridge-page-painted'
-import { BRIDGE_ROUTE_PARAM_CLEAR } from './bridge/bridge-route-update'
 import { routeViewOf } from './page-route-policy'
 
 describe('init and state', () => {
@@ -29,13 +25,6 @@ describe('init and state', () => {
       type: 'init',
       sessionId: 'session-a',
       buildId: 'build-a',
-      // What this shell takes from the page, which is the page's own check before it posts one.
-      accepts: [
-        BRIDGE_ROUTE_PARAM_CLEAR,
-        BRIDGE_PAGE_CLIENT_IDENTITY_ACCEPT,
-        BRIDGE_PAGE_PAINTED,
-        BRIDGE_BACK_CLAIM_NOTIFY
-      ],
       connection: {
         state: 'reconnecting',
         reconnectAttempt: 3,
@@ -265,7 +254,7 @@ describe('init and state', () => {
       route: { pathname: '/h/host-a/session/wt-1' },
       post: () => (view.gone ? Promise.reject(new Error('the view is gone')) : Promise.resolve())
     })
-    // A page that declares nothing is never sent a second `init`, so the tap can only be held.
+    // The second `init` the tap sends is refused with the view, so only the held route is left.
     bridge.host.receive(clientFrame({ type: 'ready' }))
     bridge.host.publishRoute({
       pathname: '/h/host-a/session/wt-1',
@@ -274,7 +263,7 @@ describe('init and state', () => {
     for (let turn = 0; turn < 4; turn += 1) {
       await Promise.resolve()
     }
-    expect(bridge.posted).toHaveLength(1)
+    expect(bridge.posted).toHaveLength(2)
     // The next document over the same host: a reload, or the view coming back.
     view.gone = false
     bridge.host.receive(clientFrame({ type: 'ready' }))
diff --git a/mobile/src/mobile-web-shell/bridge-host-notifications.test.ts b/mobile/src/mobile-web-shell/bridge-host-notifications.test.ts
index dc9436074e83..1e7b7904a101 100644
--- a/mobile/src/mobile-web-shell/bridge-host-notifications.test.ts
+++ b/mobile/src/mobile-web-shell/bridge-host-notifications.test.ts
@@ -6,8 +6,6 @@ import {
   BRIDGE_FAULT_GRANT,
   BRIDGE_NAVIGATE_BACK_NOTIFY
 } from './bridge/bridge-envelope'
-import { BRIDGE_PAGE_CLIENT_IDENTITY_ACCEPT } from './bridge/bridge-page-client-identity'
-import { BRIDGE_BACK_CLAIM_NOTIFY } from './bridge/bridge-page-back'
 import { BRIDGE_PAGE_PAINTED } from './bridge/bridge-page-painted'
 import { BRIDGE_ROUTE_PARAM_CLEAR } from './bridge/bridge-route-update'
 import {
@@ -462,20 +460,6 @@ describe('the page erasing a one-shot route param', () => {
     expect(bridge.routeParamClears()).toEqual([])
     expect(bridge.diagnostics).toEqual([{ kind: 'refused', refusal: 'unrecognised-message' }])
   })
-
-  it('tells the page it takes a clear, so a page built for an older shell does not post one', () => {
-    const bridge = harness({ route: { pathname: '/h/host-a/session/wt-1' } })
-    bridge.host.receive(clientFrame({ type: 'ready' }))
-    const init = bridge.last()
-    // Written out rather than compared against `BRIDGE_SHELL_ACCEPTS`: a list that pins itself
-    // pins nothing, and this is the frame an older page reads to decide what it may post.
-    expect(init.type === 'init' && init.accepts).toEqual([
-      BRIDGE_ROUTE_PARAM_CLEAR,
-      BRIDGE_PAGE_CLIENT_IDENTITY_ACCEPT,
-      BRIDGE_PAGE_PAINTED,
-      BRIDGE_BACK_CLAIM_NOTIFY
-    ])
-  })
 })
 
 /**
@@ -485,20 +469,13 @@ describe('the page erasing a one-shot route param', () => {
 describe('the page reporting its first frame', () => {
   it('hands the report to the session and asks the client for nothing', () => {
     const bridge = harness()
-    bridge.host.receive(clientFrame({ type: 'ready', reports: [BRIDGE_PAGE_PAINTED] }))
+    bridge.host.receive(clientFrame({ type: 'ready' }))
     bridge.host.receive(clientFrame({ type: 'notify', name: BRIDGE_PAGE_PAINTED }))
     expect(bridge.pagePaintCount()).toBe(1)
     expect(bridge.client.requests).toHaveLength(0)
     expect(bridge.client.foregroundCalls).toHaveLength(0)
   })
 
-  it('forwards what each ready declared, including a name this shell does not implement', () => {
-    const bridge = harness()
-    bridge.host.receive(clientFrame({ type: 'ready', reports: [BRIDGE_PAGE_PAINTED, 'weather'] }))
-    bridge.host.receive(clientFrame({ type: 'ready' }))
-    expect(bridge.pageReports()).toEqual([[BRIDGE_PAGE_PAINTED, 'weather'], []])
-  })
-
   it('refuses a report from a document nothing has answered', () => {
     const bridge = harness()
     bridge.host.receive(clientFrame({ type: 'notify', name: BRIDGE_PAGE_PAINTED }))
diff --git a/mobile/src/mobile-web-shell/bridge-host-route.ts b/mobile/src/mobile-web-shell/bridge-host-route.ts
index 055932a5ffeb..1306ea276a29 100644
--- a/mobile/src/mobile-web-shell/bridge-host-route.ts
+++ b/mobile/src/mobile-web-shell/bridge-host-route.ts
@@ -1,11 +1,6 @@
-import {
-  BridgeInitRouteSchema,
-  type BridgeClientMessage,
-  type BridgeInitRoute
-} from './bridge/bridge-envelope'
+import { BridgeInitRouteSchema, type BridgeInitRoute } from './bridge/bridge-envelope'
 import { readBridgeRouteUpdate } from './bridge/bridge-route-update'
 import {
-  BRIDGE_SAFE_AREA_ACCEPT,
   sameSafeAreaInsets,
   ZERO_SAFE_AREA_INSETS,
   type BridgeSafeAreaInsets
@@ -17,13 +12,10 @@ export type BridgeHostRoute = {
   readonly current: () => BridgeInitRoute | null
   /** Why the opened route was refused, for the line the host prints at construction. */
   readonly openIssue: () => string
-  /** What the page's latest `ready` said it can be sent. Reset by each document's `ready`. */
-  readonly readReady: (message: Extract<BridgeClientMessage, { type: 'ready' }>) => void
   /**
    * Hands the page a rewritten param for the screen it is already on, and sends one `init` when
    * that moved the route. The held route moves either way, so a page that reloads inside this
-   * mount is given the newest one on its next `ready` even when it is too old to be sent one in
-   * flight.
+   * mount is given the newest one on its next `ready`.
    *
    * Answers nothing, and nothing here learns anything from a post (ruling 34). It cannot: a frame
    * the page received and then failed to handle is caught by the page and reported there, so what
@@ -36,10 +28,14 @@ export type BridgeHostRoute = {
   /** The insets the next `init` carries. */
   readonly safeAreaInsets: () => BridgeSafeAreaInsets
   /**
-   * Moves the held insets, and sends one `init` when they moved and the page reads them. The same
-   * lane as a pane update: held either way, so the next `ready` carries them.
+   * Moves the held insets, and sends one `init` when they moved. The same lane as a pane update:
+   * held either way, so the next `ready` carries them.
    */
   readonly publishSafeAreaInsets: (next: BridgeSafeAreaInsets, deliverable: boolean) => void
+  /** The keyboard height the next `init` carries. */
+  readonly keyboardInset: () => number
+  /** Moves the held keyboard height on the same lane as the insets. */
+  readonly publishKeyboardInset: (next: number, deliverable: boolean) => void
 }
 
 /**
@@ -65,19 +61,17 @@ export function createBridgeHostRoute(args: {
   sendInit: () => void
   onRefused: (issue: string) => void
   safeAreaInsets?: BridgeSafeAreaInsets
+  keyboardInset?: number
 }): BridgeHostRoute {
   const parsed = BridgeInitRouteSchema.safeParse(args.opened)
   let route = parsed.success && !args.refused ? parsed.data : null
-  let accepts: readonly string[] = []
   let insets = args.safeAreaInsets ?? ZERO_SAFE_AREA_INSETS
+  let keyboard = args.keyboardInset ?? 0
   return {
     current: () => route,
     openIssue: () => (parsed.success ? 'unknown' : (parsed.error.issues[0]?.message ?? 'unknown')),
-    readReady: (message) => {
-      accepts = message.accepts ?? []
-    },
     publish: (next, deliverable) => {
-      const update = readBridgeRouteUpdate({ held: route, next, accepts, deliverable })
+      const update = readBridgeRouteUpdate({ held: route, next, deliverable })
       if (update.kind === 'refuse') {
         args.onRefused(update.issue)
         return
@@ -93,8 +87,17 @@ export function createBridgeHostRoute(args: {
         return
       }
       insets = next
-      // Only to a page that reads them: a re-init to one that does not is a wasted frame per move.
-      if (deliverable && accepts.includes(BRIDGE_SAFE_AREA_ACCEPT)) {
+      if (deliverable) {
+        args.sendInit()
+      }
+    },
+    keyboardInset: () => keyboard,
+    publishKeyboardInset: (next, deliverable) => {
+      if (keyboard === next) {
+        return
+      }
+      keyboard = next
+      if (deliverable) {
         args.sendInit()
       }
     }
diff --git a/mobile/src/mobile-web-shell/bridge-host-test-harness.ts b/mobile/src/mobile-web-shell/bridge-host-test-harness.ts
index 835698e24ac7..5c3d602a4ed5 100644
--- a/mobile/src/mobile-web-shell/bridge-host-test-harness.ts
+++ b/mobile/src/mobile-web-shell/bridge-host-test-harness.ts
@@ -50,7 +50,6 @@ export type Harness = {
   /** Every claim the host reported, in order, including the false it sends when a document ends. */
   backClaims: boolean[]
   /** What each answered `ready` declared it reports, in order. */
-  pageReports: () => readonly (readonly string[])[]
   /** One entry per `ready` answered, saying whether its `init` reached the page. Filled as each
    *  post settles, so a case reads it after awaiting the turn the post resolves on. */
   /** Every clear the page asked for, in order. */
@@ -120,7 +119,6 @@ export function harness(
   let pageReadies = 0
   let pagePaints = 0
   /** What each answered `ready` declared it reports, in order. */
-  const pageReports: (readonly string[])[] = []
   /** One entry per `ready` answered, saying whether an `init` actually went out for it. */
   const routeParamClears: { param: string; value: string }[] = []
   const routeRefusals: string[] = []
@@ -146,9 +144,8 @@ export function harness(
     readStorage:
       options.readStorage ?? (() => ({ storage: options.storage ?? {}, storageOversize: [] })),
     onStorageWrite: (key, value) => storageWrites.push({ key, value }),
-    onPageReady: ({ reports }) => {
+    onPageReady: () => {
       pageReadies += 1
-      pageReports.push(reports)
     },
     onPageBackClaim: (claimed) => backClaims.push(claimed),
     onPagePainted: () => {
@@ -212,7 +209,6 @@ export function harness(
     pageReadyCount: () => pageReadies,
     pagePaintCount: () => pagePaints,
     backClaims,
-    pageReports: () => pageReports,
     routeParamClears: () => routeParamClears,
     routeRefusals,
     pageFaults,
diff --git a/mobile/src/mobile-web-shell/bridge-host.ts b/mobile/src/mobile-web-shell/bridge-host.ts
index 28e25c2e452a..9431b4500db0 100644
--- a/mobile/src/mobile-web-shell/bridge-host.ts
+++ b/mobile/src/mobile-web-shell/bridge-host.ts
@@ -13,7 +13,7 @@ import {
   type BridgeInitRoute
 } from './bridge/bridge-envelope'
 import { BridgePageRouteGrantsSchema } from './bridge/bridge-page-route-grants'
-import { BRIDGE_SHELL_ACCEPTS, createBridgeInitFrame } from './bridge/bridge-init-frame'
+import { createBridgeInitFrame } from './bridge/bridge-init-frame'
 import { splitBridgeReply } from './bridge/bridge-reply-chunking'
 import { createBridgeHostFrames } from './bridge-host-frames'
 import { createBridgeHostBack, type BridgeSessionBack } from './bridge-host-back'
@@ -31,9 +31,8 @@ export type BridgeHost = {
    * Hands this session a rewritten route: same screen, different params (ruling 33.1).
    *
    * The held route moves either way, so a page that reloads inside this mount is told the newest
-   * one; the frame goes out only to a page that declared `BRIDGE_ROUTE_UPDATE_ACCEPT`, because a
-   * page too old to name it reads a second `init` as a replacement. A different pathname is a
-   * different screen and is refused here — that is a remount, which is what the shell already does.
+   * one. A different pathname is a different screen and is refused here — that is a remount,
+   * which is what the shell already does.
    *
    * Answers nothing, and nothing is tracked (ruling 34): a frame the view refused is repaired by
    * the next `init`, and the request it carried is spent by the page, which erases the param it
@@ -42,6 +41,8 @@ export type BridgeHost = {
   publishRoute: (next: BridgeInitRoute) => void
   /** Hands this session moved safe-area insets over the same re-sent `init` a route update takes. */
   publishSafeAreaInsets: (next: BridgeSafeAreaInsets) => void
+  /** Hands this session a moved keyboard height over the same re-sent `init`. */
+  publishKeyboardInset: (next: number) => void
   /**
    * Hands the page one Back press. False when this document never said it takes one, which is
    * every page older than the frame; the caller then leaves the key to the navigator.
@@ -87,7 +88,8 @@ export function createBridgeHost(options: BridgeHostOptions): BridgeHost {
       sendInit()
     },
     onRefused: (issue) => options.onDiagnostic?.({ kind: 'route-update-refused', issue }),
-    ...(options.safeAreaInsets === undefined ? {} : { safeAreaInsets: options.safeAreaInsets })
+    ...(options.safeAreaInsets === undefined ? {} : { safeAreaInsets: options.safeAreaInsets }),
+    ...(options.keyboardInset === undefined ? {} : { keyboardInset: options.keyboardInset })
   })
   let closed = false
   // One document's turn at the bridge. `close` ends it and the next `ready` begins the next one;
@@ -163,12 +165,12 @@ export function createBridgeHost(options: BridgeHostOptions): BridgeHost {
           connection: snapshot(),
           route,
           safeAreaInsets: routes.safeAreaInsets(),
+          keyboardInset: routes.keyboardInset(),
           pageRoutes,
           ...(parsedRouteGrants?.success === true
             ? { pageRouteGrants: parsedRouteGrants.data }
             : {}),
           granted,
-          accepts: BRIDGE_SHELL_ACCEPTS,
           host,
           ...options.readStorage()
         })
@@ -249,16 +251,12 @@ export function createBridgeHost(options: BridgeHostOptions): BridgeHost {
     // re-asked `ready` from the document already being served is answered the same way.
     if (message.type === 'ready') {
       serving = true
-      routes.readReady(message)
-      back.readReady(message.accepts ?? [])
+      back.readReady()
       // Every time it is asked, not once: the page re-asks on a backoff, and each ask is answered
       // with the route the shell holds now. That is the whole repair path for a frame that never
       // arrived (ruling 34) — nothing here waits on one, and nothing retries one.
       sendInit()
-      // Forwarded verbatim, including a name this shell has never implemented: what each report
-      // means is the caller's, and this host's job is that the list belongs to the document that
-      // just spoke rather than to the one before it.
-      options.onPageReady({ reports: message.reports ?? [], accepts: message.accepts ?? [] })
+      options.onPageReady()
       return
     }
     if (!serving) {
@@ -337,6 +335,9 @@ export function createBridgeHost(options: BridgeHostOptions): BridgeHost {
     publishSafeAreaInsets: (next) => {
       routes.publishSafeAreaInsets(next, deliverable())
     },
+    publishKeyboardInset: (next) => {
+      routes.publishKeyboardInset(next, deliverable())
+    },
     sendBack: back.send,
     readSessionBack: back.read,
     dispose
diff --git a/mobile/src/mobile-web-shell/bridge/bridge-back-round-trip.test.ts b/mobile/src/mobile-web-shell/bridge/bridge-back-round-trip.test.ts
index 1ceb977eb71a..a4940d4d9d8b 100644
--- a/mobile/src/mobile-web-shell/bridge/bridge-back-round-trip.test.ts
+++ b/mobile/src/mobile-web-shell/bridge/bridge-back-round-trip.test.ts
@@ -1,6 +1,6 @@
 import { describe, expect, it, vi } from 'vitest'
 import { BRIDGE_PROTOCOL_VERSION } from './bridge-envelope'
-import { BRIDGE_BACK_CLAIM_NOTIFY, BRIDGE_BACK_FRAME } from './bridge-page-back'
+import { BRIDGE_BACK_CLAIM_NOTIFY } from './bridge-page-back'
 import { createFakeBridgePortPair, type BridgePortPair } from './bridge-port-pair-test-harness'
 import type { FakeRpcClient } from '../bridge-host-test-fakes'
 
@@ -58,9 +58,7 @@ describe('a Back press crossing from the shell to the page', () => {
     release()
     await pair.flush()
     // The shell still sends one, standing in for a claim that went stale in flight.
-    pair.host.receive(
-      JSON.stringify({ v: BRIDGE_PROTOCOL_VERSION, type: 'ready', accepts: [BRIDGE_BACK_FRAME] })
-    )
+    pair.host.receive(JSON.stringify({ v: BRIDGE_PROTOCOL_VERSION, type: 'ready' }))
     await pair.flush()
     expect(pair.host.sendBack()).toBe(true)
     await pair.flush()
@@ -83,18 +81,14 @@ describe('a Back press crossing from the shell to the page', () => {
     expect(pair.backClaims).toEqual([true])
     // The page re-asks, which is what a stale `state` frame makes it do; the host drops the claim
     // answering it, and the page's re-assert is what puts the two back in step.
-    pair.host.receive(
-      JSON.stringify({ v: BRIDGE_PROTOCOL_VERSION, type: 'ready', accepts: [BRIDGE_BACK_FRAME] })
-    )
+    pair.host.receive(JSON.stringify({ v: BRIDGE_PROTOCOL_VERSION, type: 'ready' }))
     await pair.flush()
     expect(pair.backClaims).toEqual([true, false, true])
   })
 
   it('says nothing again when this document is holding nothing', async () => {
     const pair = await opened()
-    pair.host.receive(
-      JSON.stringify({ v: BRIDGE_PROTOCOL_VERSION, type: 'ready', accepts: [BRIDGE_BACK_FRAME] })
-    )
+    pair.host.receive(JSON.stringify({ v: BRIDGE_PROTOCOL_VERSION, type: 'ready' }))
     await pair.flush()
     expect(notifies(pair)).toEqual([])
     expect(pair.backClaims).toEqual([])
@@ -111,66 +105,22 @@ describe('a Back press crossing from the shell to the page', () => {
   })
 })
 
-/**
- * Both halves of the mixed-version matrix. The page bundle is served by a desktop that updates
- * independently of the installed shell, so one side older than the other is the normal state and
- * each direction has to degrade to exactly what Back did before this lane: the navigator pops.
- */
-describe('a shell and a page built either side of the Back lane', () => {
-  it('old shell, new page: the page never posts a claim it was not offered', async () => {
-    // The `init.accepts` this shell sends, with the claim taken back out of it on the wire — which
-    // is exactly the frame a shell built before the name would have posted.
-    const pair = createFakeBridgePortPair({
-      rewriteToPage: (json) => {
-        const frame: Record<string, unknown> = JSON.parse(json)
-        const accepts = frame.accepts
-        if (frame.type !== 'init' || !Array.isArray(accepts)) {
-          return json
-        }
-        return JSON.stringify({
-          ...frame,
-          accepts: accepts.filter((name) => name !== BRIDGE_BACK_CLAIM_NOTIFY)
-        })
-      }
-    })
-    await pair.flush()
-    pair.client.claimBack(() => true)
-    await pair.flush()
-    expect(notifies(pair)).toEqual([])
-    expect(pair.backClaims).toEqual([])
-    // And the re-assert is held to the same declaration: a second `init` from a shell that never
-    // named the claim is still one the page says nothing back to.
-    pair.host.receive(JSON.stringify({ v: BRIDGE_PROTOCOL_VERSION, type: 'ready' }))
-    await pair.flush()
-    expect(notifies(pair)).toEqual([])
-  })
-
-  it('new shell, old page: the shell never sends a press the page would refuse', async () => {
+describe('the Back lane with no negotiation', () => {
+  it('hands a press to any page it serves, whose ready declares nothing', async () => {
     const pair = await opened()
-    // The same document reloaded as a build that declares nothing, which is what a released page is.
     pair.host.receive(JSON.stringify({ v: BRIDGE_PROTOCOL_VERSION, type: 'ready' }))
     await pair.flush()
     const before = pair.toPage.length
-    expect(pair.host.sendBack()).toBe(false)
+    expect(pair.host.sendBack()).toBe(true)
     await pair.flush()
-    expect(pair.toPage).toHaveLength(before)
+    expect(pair.toPage.length).toBe(before + 1)
   })
 
-  /** Why that gate has to exist: an older page's reader takes the whole frame down rather than
-   *  ignoring a type it has never heard of. */
-  it('a page too old to read the frame refuses it whole', async () => {
-    const pair = createFakeBridgePortPair({
-      rewriteToPage: (json) =>
-        JSON.parse(json).type === BRIDGE_BACK_FRAME ? '{"v":1,"type":"b4ck"}' : json
-    })
-    await pair.flush()
-    pair.host.receive(
-      JSON.stringify({ v: BRIDGE_PROTOCOL_VERSION, type: 'ready', accepts: [BRIDGE_BACK_FRAME] })
-    )
-    await pair.flush()
-    expect(pair.host.sendBack()).toBe(true)
+  it('posts the claim to the shell with nothing offered in init', async () => {
+    const pair = await opened()
+    pair.client.claimBack(() => true)
     await pair.flush()
-    expect(pair.diagnostics).toContainEqual({ kind: 'refused', refusal: 'unrecognised-message' })
-    expect(pair.backPops).toEqual([])
+    expect(notifies(pair)).toEqual([BRIDGE_BACK_CLAIM_NOTIFY])
+    expect(pair.backClaims).toEqual([true])
   })
 })
diff --git a/mobile/src/mobile-web-shell/bridge/bridge-caps.ts b/mobile/src/mobile-web-shell/bridge/bridge-caps.ts
index de7056a9b70a..4e625884b840 100644
--- a/mobile/src/mobile-web-shell/bridge/bridge-caps.ts
+++ b/mobile/src/mobile-web-shell/bridge/bridge-caps.ts
@@ -138,15 +138,6 @@ export function isBridgeExternalLinkUrl(url: string): boolean {
 }
 export const BRIDGE_MAX_PAGE_ROUTES = 64
 
-/**
- * What a page may say it can be sent, bounded the way every other list on the envelope is.
- *
- * A frame bound and not a vocabulary: the shell acts on the names it knows and ignores the rest,
- * which is what lets a newer page declare one an older shell has never heard of.
- */
-export const BRIDGE_MAX_PAGE_ACCEPTS = 16
-export const BRIDGE_MAX_PAGE_ACCEPT_CHARS = 64
-
 /** A host id, its name and its endpoint. Bounded because the page renders all three. */
 export const BRIDGE_MAX_HOST_FIELD_CHARS = 1024
 
diff --git a/mobile/src/mobile-web-shell/bridge/bridge-client-init-handshake.ts b/mobile/src/mobile-web-shell/bridge/bridge-client-init-handshake.ts
index 609016f033e4..24060668e24b 100644
--- a/mobile/src/mobile-web-shell/bridge/bridge-client-init-handshake.ts
+++ b/mobile/src/mobile-web-shell/bridge/bridge-client-init-handshake.ts
@@ -1,8 +1,4 @@
 import { BRIDGE_PROTOCOL_VERSION, type BridgeClientMessage } from './bridge-envelope'
-import { BRIDGE_BACK_FRAME } from './bridge-page-back'
-import { BRIDGE_PAGE_PAINTED } from './bridge-page-painted'
-import { BRIDGE_ROUTE_UPDATE_ACCEPT } from './bridge-route-update'
-import { BRIDGE_SAFE_AREA_ACCEPT } from './bridge-safe-area-insets'
 
 /** The page asks again until the shell answers; a session has no other way to start. */
 export const BRIDGE_READY_RETRY_MIN_MS = 50
@@ -53,17 +49,8 @@ export function createBridgeInitHandshake(ask: () => void): BridgeInitHandshake
   }
 }
 
-/**
- * What the page says on every ask, because the shell reads it off whichever `ready` it answers.
- * `accepts` is what this page build can be sent: a second `init` for the session it holds, the
- * Back frame, and insets it pads for itself. `reports` runs the other way: what a shell may wait
- * for this page to post, and the shell holds a frame over the view until it arrives.
- */
+/** What the page says on every ask. It declares nothing: the shell serves no page older than its
+ *  floor, so every page it talks to takes everything the shell sends. */
 export function createPageReadyFrame(): Extract<BridgeClientMessage, { type: 'ready' }> {
-  return {
-    v: BRIDGE_PROTOCOL_VERSION,
-    type: 'ready',
-    accepts: [BRIDGE_ROUTE_UPDATE_ACCEPT, BRIDGE_BACK_FRAME, BRIDGE_SAFE_AREA_ACCEPT],
-    reports: [BRIDGE_PAGE_PAINTED]
-  }
+  return { v: BRIDGE_PROTOCOL_VERSION, type: 'ready' }
 }
diff --git a/mobile/src/mobile-web-shell/bridge/bridge-client-notifications.ts b/mobile/src/mobile-web-shell/bridge/bridge-client-notifications.ts
index b900a0957254..993782d8818e 100644
--- a/mobile/src/mobile-web-shell/bridge/bridge-client-notifications.ts
+++ b/mobile/src/mobile-web-shell/bridge/bridge-client-notifications.ts
@@ -43,8 +43,6 @@ export type BridgeClientNotificationDeps = {
   isClosed: () => boolean
   /** What `init.grants.native` named. A grant the shell did not give is a frame it would refuse. */
   hasGrant: (name: string) => boolean
-  /** What `init.accepts` named. The other half of the same read: a capability rather than a grant. */
-  shellAccepts: (name: string) => boolean
 }
 
 export type BridgeClientNotifications = {
@@ -140,25 +138,12 @@ export function createBridgeClientNotifications(
         error: captureBridgeError(error)
       })
     },
-    // Gated on the shell saying it takes one, not on a grant: `notify` is a closed union, so an
-    // older shell answers an unknown name with an error frame per mount. Answering nothing, because
-    // a page that has painted has nothing else to do about a shell that will not hear it.
+    // Not on a grant: every session takes it, and a page that has painted has nothing else to do.
     notifyPagePainted: () => {
-      if (deps.shellAccepts(BRIDGE_PAGE_PAINTED)) {
-        post({ v: BRIDGE_PROTOCOL_VERSION, type: 'notify', name: BRIDGE_PAGE_PAINTED })
-      }
+      post({ v: BRIDGE_PROTOCOL_VERSION, type: 'notify', name: BRIDGE_PAGE_PAINTED })
     },
-    // Gated the same way, for the same reason, and answering nothing: a shell that will not hear
-    // the claim keeps the key, which is what every shell did before this frame existed.
     notifyBackClaim: (claimed) => {
-      if (deps.shellAccepts(BRIDGE_BACK_CLAIM_NOTIFY)) {
-        post({
-          v: BRIDGE_PROTOCOL_VERSION,
-          type: 'notify',
-          name: BRIDGE_BACK_CLAIM_NOTIFY,
-          claimed
-        })
-      }
+      post({ v: BRIDGE_PROTOCOL_VERSION, type: 'notify', name: BRIDGE_BACK_CLAIM_NOTIFY, claimed })
     }
   }
 }
diff --git a/mobile/src/mobile-web-shell/bridge/bridge-client-session.ts b/mobile/src/mobile-web-shell/bridge/bridge-client-session.ts
index 02d8a5348297..09085cb2ec6f 100644
--- a/mobile/src/mobile-web-shell/bridge/bridge-client-session.ts
+++ b/mobile/src/mobile-web-shell/bridge/bridge-client-session.ts
@@ -27,6 +27,8 @@ export type BridgeShellSession = {
   /** How much of the WebView sits under a system bar. Zeros for a shell that reserves the bars
    *  outside the view, which is every shell before the field. */
   safeAreaInsets: BridgeSafeAreaInsets
+  /** The keyboard height native screens read on the shell's OS; 0 while it is closed. */
+  keyboardInset: number
   /** Null for a shell too old to name it; the page's own `loadHosts()` then answers with nothing. */
   host: BridgeInitHost | null
   /** The allowlisted keys as the app held them when this page opened. */
@@ -34,14 +36,6 @@ export type BridgeShellSession = {
   /** The allowlisted keys `storage` could not carry because the app's value is over the page's cap
    *  (ruling 33.6). Empty for a shell too old to name them, which is what it was before. */
   storageOversize: readonly string[]
-  /**
-   * What this shell takes from the page beyond the frames every shell has taken (ruling 34).
-   *
-   * Empty for a shell that named none, which is every shell before this field: a page that posts
-   * one of these to one of those has the whole frame refused as `unrecognised-message`, so the
-   * check is the page's and it is made from here.
-   */
-  accepts: readonly string[]
 }
 
 /**
@@ -61,9 +55,9 @@ export function readShellSession(
     pageRoutes: message.pageRoutes ?? [],
     pageRouteGrants: message.pageRouteGrants ?? null,
     safeAreaInsets: message.safeAreaInsets ?? ZERO_SAFE_AREA_INSETS,
+    keyboardInset: message.keyboardInset ?? 0,
     host: message.host ?? null,
     storage: message.storage ?? {},
-    storageOversize: message.storageOversize ?? [],
-    accepts: message.accepts ?? []
+    storageOversize: message.storageOversize ?? []
   }
 }
diff --git a/mobile/src/mobile-web-shell/bridge/bridge-client-shell-session.ts b/mobile/src/mobile-web-shell/bridge/bridge-client-shell-session.ts
index db5614119e86..03181a4e03fd 100644
--- a/mobile/src/mobile-web-shell/bridge/bridge-client-shell-session.ts
+++ b/mobile/src/mobile-web-shell/bridge/bridge-client-shell-session.ts
@@ -31,6 +31,8 @@ export type BridgeClientShellSession = {
   onRouteUpdate: (listener: (route: BridgeInitRoute | null) => void) => () => void
   /** Fires when an `init` moved the safe-area insets the page holds, including a replacement's. */
   onSafeAreaInsetsUpdate: (listener: (insets: BridgeSafeAreaInsets) => void) => () => void
+  /** Fires when an `init` moved the keyboard height the page holds, including a replacement's. */
+  onKeyboardInsetUpdate: (listener: (height: number) => void) => () => void
   /** Drops the session and every listener waiting on one, which `close` is the only caller of. */
   close: () => void
 }
@@ -45,6 +47,7 @@ export function createBridgeClientShellSession(args: {
   const readyListeners = new Set<() => void>()
   const routeUpdateListeners = new Set<(route: BridgeInitRoute | null) => void>()
   const insetsListeners = new Set<(insets: BridgeSafeAreaInsets) => void>()
+  const keyboardListeners = new Set<(height: number) => void>()
 
   return {
     current: () => session,
@@ -62,10 +65,12 @@ export function createBridgeClientShellSession(args: {
       // The held object when the values match, so a reader keyed on identity does not re-render
       // for a re-asked `ready`.
       const safeAreaInsets = held === null || movedInsets ? sent : held.safeAreaInsets
+      const keyboardInset = message.keyboardInset ?? 0
+      const movedKeyboard = held !== null && held.keyboardInset !== keyboardInset
       session =
         update === null
           ? { ...readShellSession(message), safeAreaInsets }
-          : { ...update, route: message.route ?? null, safeAreaInsets }
+          : { ...update, route: message.route ?? null, safeAreaInsets, keyboardInset }
       // Re-primed either way, because a second `init` is also how the page recovers a cache it has
       // refused a `state` frame into: the shell rebuilt under it publishes a generation the page's
       // own is newer than, and this frame is what puts the two back in step. A pane update carries
@@ -80,6 +85,11 @@ export function createBridgeClientShellSession(args: {
           listener(safeAreaInsets)
         }
       }
+      if (movedKeyboard) {
+        for (const listener of keyboardListeners) {
+          listener(keyboardInset)
+        }
+      }
       // Only a route that moved is an update. The shell answers every `ready` with the route it
       // holds, and the page re-asks after a refused `state` frame, so publishing each of those
       // would hand the pane hook the route it is already on.
@@ -114,6 +124,12 @@ export function createBridgeClientShellSession(args: {
         insetsListeners.delete(listener)
       }
     },
+    onKeyboardInsetUpdate: (listener) => {
+      keyboardListeners.add(listener)
+      return () => {
+        keyboardListeners.delete(listener)
+      }
+    },
     close: () => {
       session = null
       readyListeners.clear()
diff --git a/mobile/src/mobile-web-shell/bridge/bridge-envelope.test.ts b/mobile/src/mobile-web-shell/bridge/bridge-envelope.test.ts
index 056dcf7bb180..4542949ac326 100644
--- a/mobile/src/mobile-web-shell/bridge/bridge-envelope.test.ts
+++ b/mobile/src/mobile-web-shell/bridge/bridge-envelope.test.ts
@@ -34,7 +34,7 @@ import {
   type BridgeHostMessage,
   type BridgeReplyPayload
 } from './bridge-envelope'
-import { BRIDGE_BACK_CLAIM_NOTIFY, BRIDGE_BACK_FRAME } from './bridge-page-back'
+import { BRIDGE_BACK_CLAIM_NOTIFY } from './bridge-page-back'
 import { BRIDGE_PAGE_PAINTED } from './bridge-page-painted'
 
 const ID = 'AAAAAAAAAAAAAAAAAAAAAA'
@@ -89,20 +89,12 @@ function client(fields: Record<string, unknown>): Record<string, unknown> {
 describe('client messages', () => {
   const accepted = [
     ['ready', { type: 'ready' }],
-    ['ready naming what it reports', { type: 'ready', reports: [BRIDGE_PAGE_PAINTED] }],
-    // A shell with no row for the name reads a report it will never wait on, which is what an
-    // additive field has to look like in the older direction.
-    [
-      'ready naming a report this shell does not implement',
-      { type: 'ready', reports: ['weather'] }
-    ],
     ['a page painted notify', { type: 'notify', name: BRIDGE_PAGE_PAINTED }],
     ['a back claim', { type: 'notify', name: BRIDGE_BACK_CLAIM_NOTIFY, claimed: true }],
     [
       'a back claim being let go',
       { type: 'notify', name: BRIDGE_BACK_CLAIM_NOTIFY, claimed: false }
     ],
-    ['ready naming what it takes', { type: 'ready', accepts: [BRIDGE_BACK_FRAME] }],
     ['request without params', { type: 'request', id: ID, method: 'status.get' }],
     ['request with params', { type: 'request', id: ID, method: 'status.get', params: { a: 1 } }],
     [
diff --git a/mobile/src/mobile-web-shell/bridge/bridge-envelope.ts b/mobile/src/mobile-web-shell/bridge/bridge-envelope.ts
index ae8729f96ce5..d24f1ab599c9 100644
--- a/mobile/src/mobile-web-shell/bridge/bridge-envelope.ts
+++ b/mobile/src/mobile-web-shell/bridge/bridge-envelope.ts
@@ -7,6 +7,7 @@ import { BridgeErrorCaptureSchema } from './bridge-error-capture'
 import { BridgeInitRouteSchema, type BridgeInitRoute } from './bridge-init-route'
 import { BridgePageRouteGrantsSchema } from './bridge-page-route-grants'
 import { BridgeSafeAreaInsetsSchema } from './bridge-safe-area-insets'
+import { BridgeKeyboardInsetSchema } from './bridge-keyboard-inset'
 import { BridgeNotifySchema } from './bridge-notify-envelope'
 import { BRIDGE_BACK_FRAME } from './bridge-page-back'
 import { BRIDGE_ID_PATTERN, idSchema, methodSchema, versionSchema } from './bridge-frame-fields'
@@ -26,8 +27,6 @@ import {
   PAGE_STORAGE_MAX_VALUE_CHARS
 } from '../page-storage-keys'
 import {
-  BRIDGE_MAX_PAGE_ACCEPT_CHARS,
-  BRIDGE_MAX_PAGE_ACCEPTS,
   BRIDGE_MAX_PAGE_ROUTES,
   BRIDGE_MAX_REPLY_PARTS,
   BRIDGE_MAX_ROUTE_PATHNAME_CHARS,
@@ -170,37 +169,7 @@ const replyPartSchema = z.object({
 const BridgeClientMessageSchema = z.discriminatedUnion('type', [
   z.object({
     v: versionSchema,
-    type: z.literal('ready'),
-    /**
-     * What this page can be sent beyond its first `init`; the names and why live in
-     * `bridge-route-update.ts`, which is the only one there is.
-     *
-     * Optional, and safe in both directions without a version bump: a page that sends none is
-     * never sent a second `init`, and a shell that reads none never sends one. An unknown name is
-     * accepted by the schema and ignored by the shell, which is what a newer page declaring a
-     * capability this shell has never implemented has to look like.
-     */
-    accepts: z
-      .array(z.string().min(1).max(BRIDGE_MAX_PAGE_ACCEPT_CHARS))
-      .max(BRIDGE_MAX_PAGE_ACCEPTS)
-      .optional(),
-    /**
-     * What this page will post that the shell may have to wait for, which today is
-     * `BRIDGE_PAGE_PAINTED` and nothing else.
-     *
-     * `accepts` runs the other way and cannot stand in for this: it says what may be sent *to* the
-     * page. A shell waiting on a frame has to know the page will send one, because the generation
-     * is served by a desktop that updates independently of the installed shell — an undeclared
-     * wait would hide a working page built before the frame existed.
-     *
-     * Optional and additive in both directions, on the same bounds as `accepts`: a page that
-     * declares none is waited for by nothing, and an unknown name is a report this shell does not
-     * act on.
-     */
-    reports: z
-      .array(z.string().min(1).max(BRIDGE_MAX_PAGE_ACCEPT_CHARS))
-      .max(BRIDGE_MAX_PAGE_ACCEPTS)
-      .optional()
+    type: z.literal('ready')
   }),
   z.object({
     v: versionSchema,
@@ -282,8 +251,7 @@ const BridgeHostMessageSchema = z.union([
     connection: BridgeConnectionSnapshotSchema
   }),
   // One Back press, and nothing else: the shell pops what it pushed, so a frame naming where to go
-  // back to would be naming a screen the page cannot see. Sent only to a page whose `ready` listed
-  // `BRIDGE_BACK_FRAME`, because an older page's reader refuses the whole frame.
+  // back to would be naming a screen the page cannot see.
   z.object({ v: versionSchema, type: z.literal(BRIDGE_BACK_FRAME) }),
   z.object({
     v: versionSchema,
@@ -307,6 +275,8 @@ const BridgeHostMessageSchema = z.union([
     route: BridgeInitRouteSchema.optional(),
     /** How much of the WebView is under a system bar; absent reads as zeros. */
     safeAreaInsets: BridgeSafeAreaInsetsSchema.optional(),
+    /** The keyboard height native screens read on the shell's OS; absent reads as 0. */
+    keyboardInset: BridgeKeyboardInsetSchema.optional(),
     host: BridgeInitHostSchema.optional(),
     storage: BridgeInitStorageSchema.optional(),
     /**
@@ -343,19 +313,7 @@ const BridgeHostMessageSchema = z.union([
      * behaviour, an older page ignores it. The grant grammar is the manifest's own, so a name the
      * bundle could not have declared cannot arrive here either.
      */
-    pageRouteGrants: BridgePageRouteGrantsSchema.optional(),
-    /**
-     * What this shell accepts from the page beyond the frames every shell has always taken, which
-     * today is `BRIDGE_ROUTE_PARAM_CLEAR` and nothing else.
-     *
-     * The mirror of `ready.accepts`, and optional for the same reason: a shell that sends none is
-     * never posted a clear, and a page that reads none never posts one. An unknown name is a
-     * capability this page has never heard of and is ignored.
-     */
-    accepts: z
-      .array(z.string().min(1).max(BRIDGE_MAX_PAGE_ACCEPT_CHARS))
-      .max(BRIDGE_MAX_PAGE_ACCEPTS)
-      .optional()
+    pageRouteGrants: BridgePageRouteGrantsSchema.optional()
   })
 ])
 
diff --git a/mobile/src/mobile-web-shell/bridge/bridge-init-frame.ts b/mobile/src/mobile-web-shell/bridge/bridge-init-frame.ts
index 582ed79548c1..c31244c23ac6 100644
--- a/mobile/src/mobile-web-shell/bridge/bridge-init-frame.ts
+++ b/mobile/src/mobile-web-shell/bridge/bridge-init-frame.ts
@@ -8,10 +8,6 @@ import {
   type BridgeInitHost,
   type BridgeInitRoute
 } from './bridge-envelope'
-import { BRIDGE_PAGE_CLIENT_IDENTITY_ACCEPT } from './bridge-page-client-identity'
-import { BRIDGE_BACK_CLAIM_NOTIFY } from './bridge-page-back'
-import { BRIDGE_PAGE_PAINTED } from './bridge-page-painted'
-import { BRIDGE_ROUTE_PARAM_CLEAR } from './bridge-route-update'
 import {
   sameSafeAreaInsets,
   ZERO_SAFE_AREA_INSETS,
@@ -34,18 +30,6 @@ export const BRIDGE_NATIVE_GRANTS: readonly string[] = [
   ...MOBILE_WEB_SHELL_GRANTS
 ]
 
-/**
- * What this shell accepts from a page beyond the frames every shell has always taken. Additive
- * names on an optional list, so no version moves: a page that knows none posts none, one told
- * nothing claims no identity, and one told nothing reports no paint.
- */
-export const BRIDGE_SHELL_ACCEPTS: readonly string[] = [
-  BRIDGE_ROUTE_PARAM_CLEAR,
-  BRIDGE_PAGE_CLIENT_IDENTITY_ACCEPT,
-  BRIDGE_PAGE_PAINTED,
-  BRIDGE_BACK_CLAIM_NOTIFY
-]
-
 /** The one frame that starts a session, built in one place so its caps and its grants agree. */
 export function createBridgeInitFrame(args: {
   sessionId: string
@@ -57,13 +41,13 @@ export function createBridgeInitFrame(args: {
   pageRoutes: readonly string[]
   /** How much of the WebView sits under a system bar, for a page that pads for them itself. */
   safeAreaInsets?: BridgeSafeAreaInsets
+  /** The keyboard height native screens read on the shell's OS. */
+  keyboardInset?: number
   /** What each of those patterns declared, so the page can tell a hop it may keep from one it
    *  must hand back. Omitted by a shell that has none, which leaves the page on its old rule. */
   pageRouteGrants?: readonly { pathname: string; grants: readonly string[] }[]
   /** What this session may do: the protocol's own grant plus what its route declared. */
   granted: readonly string[]
-  /** What this shell takes from the page beyond the frames every shell has taken (ruling 34). */
-  accepts?: readonly string[]
   /** The host the page is showing, minus the credential the bridge already carries for it. */
   host: BridgeInitHost
   /** The allowlisted keys as the app holds them right now. */
@@ -94,12 +78,10 @@ export function createBridgeInitFrame(args: {
     sameSafeAreaInsets(args.safeAreaInsets, ZERO_SAFE_AREA_INSETS)
       ? {}
       : { safeAreaInsets: { ...args.safeAreaInsets } }),
-    pageRoutes: [...args.pageRoutes],
-    // Omitted when empty for the reason `storageOversize` is: a shell that declares nothing and
-    // one that declares an empty list are the same answer to the page's check.
-    ...(args.accepts === undefined || args.accepts.length === 0
+    ...(args.keyboardInset === undefined || args.keyboardInset === 0
       ? {}
-      : { accepts: [...args.accepts] }),
+      : { keyboardInset: args.keyboardInset }),
+    pageRoutes: [...args.pageRoutes],
     // Copied entry by entry for the reason the grants are: nothing the shell keeps may be
     // reachable through a frame it hands out.
     ...(args.pageRouteGrants === undefined
diff --git a/mobile/src/mobile-web-shell/bridge/bridge-keyboard-inset.test.ts b/mobile/src/mobile-web-shell/bridge/bridge-keyboard-inset.test.ts
new file mode 100644
index 000000000000..9cdf24ae99b2
--- /dev/null
+++ b/mobile/src/mobile-web-shell/bridge/bridge-keyboard-inset.test.ts
@@ -0,0 +1,91 @@
+import { describe, expect, it } from 'vitest'
+import { createFakeBridgePortPair } from './bridge-port-pair-test-harness'
+import { readBridgeHostMessage } from './bridge-envelope'
+import { createBridgeInitFrame } from './bridge-init-frame'
+import { readShellSession } from './bridge-client-session'
+
+function initFrame(keyboardInset?: number) {
+  return createBridgeInitFrame({
+    sessionId: 'session-a',
+    buildId: 'build-a',
+    connection: {
+      state: 'connected',
+      reconnectAttempt: 0,
+      lastConnectedAt: null,
+      lastInboundAt: null,
+      generation: null
+    },
+    route: { pathname: '/h/host-a' },
+    pageRoutes: ['/h/[hostId]'],
+    granted: [],
+    host: { id: 'host-a', name: 'Host A', endpoint: 'ws://host-a', lastConnected: 0 },
+    storage: {},
+    ...(keyboardInset === undefined ? {} : { keyboardInset })
+  })
+}
+
+function readInit(json: string) {
+  const read = readBridgeHostMessage(json)
+  if (!read.ok || read.message.type !== 'init') {
+    throw new Error(
+      `not an init the page would read: ${read.ok ? read.message.type : read.refusal}`
+    )
+  }
+  return read.message
+}
+
+describe('keyboardInset on init', () => {
+  it('reads an init without the field as 0, which is every shell before it', () => {
+    const init = readInit(JSON.stringify(initFrame()))
+    expect('keyboardInset' in init).toBe(false)
+    expect(readShellSession(init).keyboardInset).toBe(0)
+  })
+
+  it('passes the keyboard height through to the session the page holds', () => {
+    expect(readShellSession(readInit(JSON.stringify(initFrame(312)))).keyboardInset).toBe(312)
+  })
+
+  it('omits 0, since absent and closed are the same answer', () => {
+    expect('keyboardInset' in initFrame(0)).toBe(false)
+  })
+
+  it('refuses an init whose keyboard no device produces', () => {
+    for (const bad of [-1, 1e9, Number.NaN, '312']) {
+      const frame = { ...initFrame(), keyboardInset: bad }
+      expect(readBridgeHostMessage(JSON.stringify(frame)).ok, String(bad)).toBe(false)
+    }
+  })
+})
+
+describe('a keyboard that moves under a live page', () => {
+  it('re-sends init on show, height change and hide, and the page reads each in place', async () => {
+    const pair = createFakeBridgePortPair()
+    await pair.flush()
+    const session = pair.client.getShellSession()
+    expect(session?.keyboardInset).toBe(0)
+    const seen: number[] = []
+    pair.client.onKeyboardInsetUpdate((height) => seen.push(height))
+
+    // Pixel_API_37: the IME opens at 312, the suggestion strip grows it by 34, then it closes.
+    for (const height of [312, 346, 0]) {
+      pair.host.publishKeyboardInset(height)
+      await pair.flush()
+      expect(pair.client.getShellSession()?.keyboardInset).toBe(height)
+    }
+    expect(seen).toEqual([312, 346, 0])
+    // Same session: a keyboard update is not a replacement.
+    expect(pair.client.getShellSession()?.sessionId).toBe(session?.sessionId)
+    expect(pair.client.getShellSession()?.route).toEqual(session?.route)
+  })
+
+  it('sends nothing for a height that did not move', async () => {
+    const pair = createFakeBridgePortPair({ keyboardInset: 312 })
+    await pair.flush()
+    const inits = () => pair.readToPage().filter((frame) => frame.type === 'init').length
+    const before = inits()
+    pair.host.publishKeyboardInset(312)
+    await pair.flush()
+    expect(inits()).toBe(before)
+    expect(pair.client.getShellSession()?.keyboardInset).toBe(312)
+  })
+})
diff --git a/mobile/src/mobile-web-shell/bridge/bridge-keyboard-inset.ts b/mobile/src/mobile-web-shell/bridge/bridge-keyboard-inset.ts
new file mode 100644
index 000000000000..c11a642e8c24
--- /dev/null
+++ b/mobile/src/mobile-web-shell/bridge/bridge-keyboard-inset.ts
@@ -0,0 +1,9 @@
+import { z } from 'zod'
+import { BRIDGE_MAX_SAFE_AREA_INSET } from './bridge-safe-area-insets'
+
+/**
+ * The software keyboard's height as native screens read it on the shell's OS (iOS from the
+ * window's bottom, Android above the bars), in the page's px; 0 while it is closed. The shell
+ * overlays the IME on the view like a native screen, and the page cannot measure it.
+ */
+export const BridgeKeyboardInsetSchema = z.number().finite().min(0).max(BRIDGE_MAX_SAFE_AREA_INSET)
diff --git a/mobile/src/mobile-web-shell/bridge/bridge-notify-grants.ts b/mobile/src/mobile-web-shell/bridge/bridge-notify-grants.ts
index d363be3f5fd4..04683d787399 100644
--- a/mobile/src/mobile-web-shell/bridge/bridge-notify-grants.ts
+++ b/mobile/src/mobile-web-shell/bridge/bridge-notify-grants.ts
@@ -37,11 +37,10 @@ const BRIDGE_NOTIFY_GRANTS: Readonly<Record<BridgeNotifyName, string | null>> =
   // The protocol's own as well: it spends a request this shell handed the page, on a param closed
   // to the one the shell hands over, so there is nothing here for a grant to gate.
   [BRIDGE_ROUTE_PARAM_CLEAR]: null,
-  // The page reporting on its own document. Nothing here reaches the host or the device, and the
-  // shell acts on it only for a page that declared it in `ready.reports`.
+  // The page reporting on its own document. Nothing here reaches the host or the device.
   [BRIDGE_PAGE_PAINTED]: null,
   // The page reporting on its own document as well. A claim is not a capability: the shell decides
-  // whether to hand the key over, and it acts on this only for a page that declared it takes one.
+  // whether to hand the key over.
   [BRIDGE_BACK_CLAIM_NOTIFY]: null,
   navigate: 'navigate',
   [BRIDGE_NAVIGATE_BACK_NOTIFY]: 'navigate',
diff --git a/mobile/src/mobile-web-shell/bridge/bridge-page-back.ts b/mobile/src/mobile-web-shell/bridge/bridge-page-back.ts
index 87d08d46d6f6..e7c151f63e45 100644
--- a/mobile/src/mobile-web-shell/bridge/bridge-page-back.ts
+++ b/mobile/src/mobile-web-shell/bridge/bridge-page-back.ts
@@ -1,12 +1,8 @@
-/**
- * The device Back key, in the two places it is named: the page's claim on it, and the frame that
- * hands one press over. Negotiated both ways, because each is a closed list on the other side — a
- * claim to a shell that never advertised it is an error frame per mount on every shell installed,
- * and a `back` to a page that never asked for one is a frame its reader drops.
- */
+/** The device Back key, in the two places it is named: the page's claim on it, and the frame that
+ *  hands one press over. */
 
-/** Page to shell, on `init.accepts`: this document is holding Back, or has let it go. */
+/** Page to shell, a notify: this document is holding Back, or has let it go. */
 export const BRIDGE_BACK_CLAIM_NOTIFY = 'back-claim'
 
-/** Shell to page, on `ready.accepts`: one Back press, handed to whoever claimed it. */
+/** Shell to page, a frame: one Back press, handed to whoever claimed it. */
 export const BRIDGE_BACK_FRAME = 'back'
diff --git a/mobile/src/mobile-web-shell/bridge/bridge-page-client-identity.test.ts b/mobile/src/mobile-web-shell/bridge/bridge-page-client-identity.test.ts
index bda9737f02f0..b65a8faeee23 100644
--- a/mobile/src/mobile-web-shell/bridge/bridge-page-client-identity.test.ts
+++ b/mobile/src/mobile-web-shell/bridge/bridge-page-client-identity.test.ts
@@ -1,7 +1,6 @@
 import { describe, expect, it } from 'vitest'
 import {
   BRIDGE_PAGE_CLIENT_ID,
-  BRIDGE_PAGE_CLIENT_IDENTITY_ACCEPT,
   BridgePageClientIdentityUnavailableError,
   substituteBridgePageClientIdentity
 } from './bridge-page-client-identity'
@@ -39,7 +38,6 @@ describe('the placeholder a page claims', () => {
     // The composer's send journal refuses a retained operation whose caller changed, and it has no
     // expiry. A per-document identity would turn "send it again" into a permanent refusal.
     expect(BRIDGE_PAGE_CLIENT_ID).toBe('orca-page-client')
-    expect(BRIDGE_PAGE_CLIENT_IDENTITY_ACCEPT).toBe('page-client-identity')
   })
 
   it('becomes the device identity in both fields a page carries one in', () => {
@@ -184,12 +182,6 @@ describe('the shell substitutes on both doors to the client', () => {
       }
     })
   })
-
-  it('tells the page it performs the swap, on a list an older page ignores', () => {
-    const bridge = harness({ ready: true })
-    const init = bridge.frames().find((message) => message.type === 'init')
-    expect(init?.accepts).toContain(BRIDGE_PAGE_CLIENT_IDENTITY_ACCEPT)
-  })
 })
 
 describe('what the page hears when the shell has no identity', () => {
diff --git a/mobile/src/mobile-web-shell/bridge/bridge-page-client-identity.ts b/mobile/src/mobile-web-shell/bridge/bridge-page-client-identity.ts
index a23a8b4c319e..44277fa0d244 100644
--- a/mobile/src/mobile-web-shell/bridge/bridge-page-client-identity.ts
+++ b/mobile/src/mobile-web-shell/bridge/bridge-page-client-identity.ts
@@ -8,9 +8,6 @@
 /** What a page puts in `client.id`. Fixed, so a resent message fingerprints the same caller. */
 export const BRIDGE_PAGE_CLIENT_ID = 'orca-page-client'
 
-/** `init.accepts` name for a shell that swaps. A page told nothing claims no identity at all. */
-export const BRIDGE_PAGE_CLIENT_IDENTITY_ACCEPT = 'page-client-identity'
-
 /** The two fields a page carries an identity in. `mobileClient` is native chat's spelling. */
 const IDENTITY_FIELDS = ['client', 'mobileClient'] as const
 
diff --git a/mobile/src/mobile-web-shell/bridge/bridge-page-painted.ts b/mobile/src/mobile-web-shell/bridge/bridge-page-painted.ts
index effa3c07a054..41266b01fe01 100644
--- a/mobile/src/mobile-web-shell/bridge/bridge-page-painted.ts
+++ b/mobile/src/mobile-web-shell/bridge/bridge-page-painted.ts
@@ -1,6 +1,2 @@
-/**
- * The page's first frame, in all three places it is named: `ready.reports`, the notify, and
- * `init.accepts`. Negotiated both ways, because the notify union is closed — a report to a shell
- * that never advertised it is an error frame per mount on every shell already installed.
- */
+/** The notify a page posts when its first frame is on screen; the shell covers the view until it. */
 export const BRIDGE_PAGE_PAINTED = 'painted'
diff --git a/mobile/src/mobile-web-shell/bridge/bridge-port-pair-test-harness.test.ts b/mobile/src/mobile-web-shell/bridge/bridge-port-pair-test-harness.test.ts
index 705360361db1..ac532410aa03 100644
--- a/mobile/src/mobile-web-shell/bridge/bridge-port-pair-test-harness.test.ts
+++ b/mobile/src/mobile-web-shell/bridge/bridge-port-pair-test-harness.test.ts
@@ -2,10 +2,6 @@ import { describe, expect, it } from 'vitest'
 import type { RpcClient } from '../../transport/rpc-client'
 import type { RpcResponse } from '../../transport/types'
 import { createBridgePortPair, createFakeBridgePortPair } from './bridge-port-pair-test-harness'
-import { BRIDGE_PAGE_CLIENT_IDENTITY_ACCEPT } from './bridge-page-client-identity'
-import { BRIDGE_BACK_CLAIM_NOTIFY } from './bridge-page-back'
-import { BRIDGE_PAGE_PAINTED } from './bridge-page-painted'
-import { BRIDGE_ROUTE_PARAM_CLEAR } from './bridge-route-update'
 
 /** Every member of the contract, none of them a fake anything: the pair must carry a plain client. */
 function plainShellClient(record: string[]): RpcClient {
@@ -43,15 +39,10 @@ describe('the bridge port pair', () => {
       pageRoutes: expect.any(Array),
       pageRouteGrants: null,
       safeAreaInsets: { top: 0, right: 0, bottom: 0, left: 0 },
+      keyboardInset: 0,
       host: expect.objectContaining({ id: expect.any(String) }),
       storage: expect.any(Object),
-      storageOversize: [],
-      accepts: [
-        BRIDGE_ROUTE_PARAM_CLEAR,
-        BRIDGE_PAGE_CLIENT_IDENTITY_ACCEPT,
-        BRIDGE_PAGE_PAINTED,
-        BRIDGE_BACK_CLAIM_NOTIFY
-      ]
+      storageOversize: []
     })
   })
 
diff --git a/mobile/src/mobile-web-shell/bridge/bridge-port-pair-test-harness.ts b/mobile/src/mobile-web-shell/bridge/bridge-port-pair-test-harness.ts
index bf9b611a540d..1b329207d539 100644
--- a/mobile/src/mobile-web-shell/bridge/bridge-port-pair-test-harness.ts
+++ b/mobile/src/mobile-web-shell/bridge/bridge-port-pair-test-harness.ts
@@ -60,7 +60,6 @@ export type BridgePortPair<TRpc extends RpcClient = FakeRpcClient> = {
   /** Every claim on the device Back key the host reported, in order. */
   readonly backClaims: boolean[]
   /** What each answered `ready` declared it reports, in order. */
-  readonly pageReports: () => readonly (readonly string[])[]
   /** Every clear the page asked the shell for, in order. */
   readonly routeParamClears: () => readonly { param: string; value: string }[]
   /** Why the host refused to open a session at all, if it did. */
@@ -105,6 +104,7 @@ export type BridgePortPairOptions<TRpc extends RpcClient> = {
   /** Replaces the verb handler, for the arms where the shell refuses rather than answers. */
   serveNativeVerb?: (verb: BridgeNativeVerb, params: unknown) => Promise<unknown>
   safeAreaInsets?: BridgeSafeAreaInsets
+  keyboardInset?: number
 }
 
 type Lane = {
@@ -210,7 +210,6 @@ export function createBridgePortPair<TRpc extends RpcClient>(
   let pageReadies = 0
   let pagePaints = 0
   /** What each answered `ready` declared it reports, in order. */
-  const pageReports: (readonly string[])[] = []
   const routeParamClears: { param: string; value: string }[] = []
   const routeRefusals: string[] = []
   let receiveOnPage: ((json: string) => void) | null = null
@@ -229,6 +228,7 @@ export function createBridgePortPair<TRpc extends RpcClient>(
     sessionId: options.sessionId ?? 'session-a',
     route: options.route ?? { pathname: '/h/host-a' },
     ...(options.safeAreaInsets === undefined ? {} : { safeAreaInsets: options.safeAreaInsets }),
+    ...(options.keyboardInset === undefined ? {} : { keyboardInset: options.keyboardInset }),
     readClientIdentity: () =>
       options.clientIdentity === undefined ? PORT_PAIR_CLIENT_IDENTITY : options.clientIdentity,
     pageRoutes: options.pageRoutes ?? ['/h/[hostId]'],
@@ -254,9 +254,8 @@ export function createBridgePortPair<TRpc extends RpcClient>(
     }),
     onStorageWrite: (key, value) => storageWrites.push({ key, value }),
     onPageFault: (error) => pageFaults.push(error),
-    onPageReady: ({ reports }) => {
+    onPageReady: () => {
       pageReadies += 1
-      pageReports.push(reports)
     },
     onPagePainted: () => {
       pagePaints += 1
@@ -299,7 +298,6 @@ export function createBridgePortPair<TRpc extends RpcClient>(
     pageReadyCount: () => pageReadies,
     pagePaintCount: () => pagePaints,
     backClaims,
-    pageReports: () => pageReports,
     routeParamClears: () => routeParamClears,
     routeRefusals,
     async flush(): Promise<void> {
diff --git a/mobile/src/mobile-web-shell/bridge/bridge-route-update.test.ts b/mobile/src/mobile-web-shell/bridge/bridge-route-update.test.ts
index aaef95a00ffc..ff3b1c0b3bb1 100644
--- a/mobile/src/mobile-web-shell/bridge/bridge-route-update.test.ts
+++ b/mobile/src/mobile-web-shell/bridge/bridge-route-update.test.ts
@@ -1,7 +1,6 @@
 import { describe, expect, it } from 'vitest'
 import { createFakeBridgePortPair } from './bridge-port-pair-test-harness'
 import type { BridgeInitRoute } from './bridge-envelope'
-import { BRIDGE_ROUTE_UPDATE_ACCEPT } from './bridge-route-update'
 
 const SESSION = '/h/host-a/session/wt-1'
 
@@ -79,17 +78,13 @@ describe('a route update over a re-sent init', () => {
   it('publishes nothing for a re-asked ready that carries the route the page holds', async () => {
     const pair = await openedOnTheSession()
     const seen = recordRouteUpdates(pair)
-    pair.host.receive(
-      JSON.stringify({ v: 1, type: 'ready', accepts: [BRIDGE_ROUTE_UPDATE_ACCEPT] })
-    )
+    pair.host.receive(JSON.stringify({ v: 1, type: 'ready' }))
     await pair.flush()
     expect(seen).toEqual([])
     // And the same ask after a real update still leaves exactly the one delivery behind it.
     pair.host.publishRoute(sessionRoute('pane-1'))
     await pair.flush()
-    pair.host.receive(
-      JSON.stringify({ v: 1, type: 'ready', accepts: [BRIDGE_ROUTE_UPDATE_ACCEPT] })
-    )
+    pair.host.receive(JSON.stringify({ v: 1, type: 'ready' }))
     await pair.flush()
     expect(seen).toEqual(['pane-1'])
   })
@@ -114,32 +109,13 @@ describe('a route update over a re-sent init', () => {
     expect(pair.client.getShellSession()?.storage).toBe(before)
   })
 
-  /**
-   * Wire compatibility, the half a schema cannot state: an older page never declares `accepts`, so
-   * the shell must not post it a second `init`. That page would read one as a replacement and
-   * settle every request it held; the tap it degrades to losing is what it loses today.
-   */
-  it('sends no second init to a page that never declared it accepts one', async () => {
+  it('sends the second init to a page whose ready declares nothing', async () => {
     const pair = await openedOnTheSession()
-    expect(pair.readToShell().find((frame) => frame.type === 'ready')?.accepts).toContain(
-      BRIDGE_ROUTE_UPDATE_ACCEPT
-    )
-    // This page, then the same document reloaded as a build that declares nothing -- which is what
-    // a released page is. The host reads `accepts` off whichever `ready` it last answered.
     pair.host.receive(JSON.stringify({ v: 1, type: 'ready' }))
     await pair.flush()
     const framesBefore = pair.toPage.length
     pair.host.publishRoute(sessionRoute('pane-1'))
     await pair.flush()
-    expect(pair.toPage.length).toBe(framesBefore)
-    // And the contrast, so the case fails when the gate stops gating rather than when it starts.
-    pair.host.receive(
-      JSON.stringify({ v: 1, type: 'ready', accepts: [BRIDGE_ROUTE_UPDATE_ACCEPT] })
-    )
-    await pair.flush()
-    const framesAfterReady = pair.toPage.length
-    pair.host.publishRoute(sessionRoute('pane-2'))
-    await pair.flush()
-    expect(pair.toPage.length).toBe(framesAfterReady + 1)
+    expect(pair.toPage.length).toBe(framesBefore + 1)
   })
 })
diff --git a/mobile/src/mobile-web-shell/bridge/bridge-route-update.ts b/mobile/src/mobile-web-shell/bridge/bridge-route-update.ts
index 93e42564424b..1f5d3c00e5ae 100644
--- a/mobile/src/mobile-web-shell/bridge/bridge-route-update.ts
+++ b/mobile/src/mobile-web-shell/bridge/bridge-route-update.ts
@@ -2,23 +2,15 @@ import { BridgeInitRouteSchema, type BridgeInitRoute } from './bridge-init-route
 import { shellScreenRouteKey } from '../shell-screen-route'
 
 /**
- * The one thing a page can say it accepts, which is a second `init` for the session it already has.
- *
  * A notification tap for another pane of the session on screen rewrites one route param of a page
  * that is already mounted, and the shell has no push lane to deliver it on: `notify` runs
  * page-to-shell only, and a shell-to-page frame kind would need a capability of its own
  * (`bridge-audio-verbs.ts` refused one for raw PCM). `init` already carries `route`, is already
- * re-sent on every `ready` and is already re-read, so the pane request rides it.
- *
- * Declared by the page rather than assumed by the shell, in both directions. A page too old to
- * name it reads a second `init` as a replacement and settles every request it holds, so a shell
- * that sent one unasked would break it; a shell too old to re-send one leaves a newer page exactly
- * where it is today. Both degrade to the repeat tap doing nothing, which is what it does now.
+ * re-sent on every `ready` and is already re-read, so the pane request rides a second `init`.
  */
-export const BRIDGE_ROUTE_UPDATE_ACCEPT = 'route-update'
 
 /**
- * The one thing a shell can say it accepts, which is a page erasing a one-shot route param.
+ * The notify a page posts to erase a one-shot route param.
  *
  * The reader erases (ruling 34). A notification tap writes `paneKey` onto the native route, the
  * shell re-sends `init` for as long as it holds one, and the page — having applied the pane — asks
@@ -28,10 +20,6 @@ export const BRIDGE_ROUTE_UPDATE_ACCEPT = 'route-update'
  * Every one of those is followed by a fresh document's `ready`, answered with the route the shell
  * holds then. A clear naming a pane the tap has already moved past is refused by the comparison
  * rather than by a sequence number.
- *
- * Declared in `init` rather than assumed, in the direction `ready.accepts` runs the other way. No
- * shipped shell serves a page, so nothing needs negotiating today; the declaration is here so the
- * page's check exists from the first version that can post one.
  */
 export const BRIDGE_ROUTE_PARAM_CLEAR = 'route-param-clear'
 
@@ -67,8 +55,8 @@ export function bridgeRouteMoved(
  * What a host does with a rewritten route: hold it for the next `init`, send one now, or refuse.
  *
  * `hold` and `send` both move what the host will publish, because a page that reloads inside this
- * mount must be handed the newest route on its next `ready` even when it is too old to be sent one
- * in flight. Only `send` is a frame, and only a frame lets the caller clear the param it delivered.
+ * mount must be handed the newest route on its next `ready`. Only `send` is a frame, and only a
+ * frame lets the caller clear the param it delivered.
  */
 export type BridgeRouteUpdate =
   | { readonly kind: 'send'; readonly route: BridgeInitRoute }
@@ -86,8 +74,6 @@ export type BridgeRouteUpdate =
 export function readBridgeRouteUpdate(args: {
   held: BridgeInitRoute | null
   next: BridgeInitRoute
-  /** What the page's last `ready` declared. Empty for every page built before this existed. */
-  accepts: readonly string[]
   /** Whether this host has a served document that has already had an `init`. */
   deliverable: boolean
 }): BridgeRouteUpdate {
@@ -100,6 +86,5 @@ export function readBridgeRouteUpdate(args: {
     return { kind: 'refuse', issue: 'not-this-screen' }
   }
   const moved = bridgeRouteMoved(held, parsed.data)
-  const sendable = moved && args.deliverable && args.accepts.includes(BRIDGE_ROUTE_UPDATE_ACCEPT)
-  return { kind: sendable ? 'send' : 'hold', route: parsed.data }
+  return { kind: moved && args.deliverable ? 'send' : 'hold', route: parsed.data }
 }
diff --git a/mobile/src/mobile-web-shell/bridge/bridge-rpc-client-frames.test.ts b/mobile/src/mobile-web-shell/bridge/bridge-rpc-client-frames.test.ts
index 55cff6ace69f..f651e23b080d 100644
--- a/mobile/src/mobile-web-shell/bridge/bridge-rpc-client-frames.test.ts
+++ b/mobile/src/mobile-web-shell/bridge/bridge-rpc-client-frames.test.ts
@@ -12,10 +12,6 @@ import {
   BRIDGE_ACK_INTERVAL_FRAMES
 } from './bridge-client-subscriptions'
 import { BRIDGE_PROTOCOL_VERSION, type BridgeHostMessage } from './bridge-envelope'
-import { BRIDGE_BACK_FRAME } from './bridge-page-back'
-import { BRIDGE_PAGE_PAINTED } from './bridge-page-painted'
-import { BRIDGE_ROUTE_UPDATE_ACCEPT } from './bridge-route-update'
-import { BRIDGE_SAFE_AREA_ACCEPT } from './bridge-safe-area-insets'
 import {
   BRIDGE_READY_RETRY_MAX_MS,
   BRIDGE_READY_RETRY_MIN_MS
@@ -43,16 +39,9 @@ afterEach(() => {
 })
 
 describe('bridge client handshake', () => {
-  it('asks for a session as soon as it exists, naming what it can be sent and what it reports', () => {
+  it('asks for a session as soon as it exists, declaring nothing', () => {
     const page = createPageClient()
-    expect(page.frames()).toEqual([
-      {
-        v: BRIDGE_PROTOCOL_VERSION,
-        type: 'ready',
-        accepts: [BRIDGE_ROUTE_UPDATE_ACCEPT, BRIDGE_BACK_FRAME, BRIDGE_SAFE_AREA_ACCEPT],
-        reports: [BRIDGE_PAGE_PAINTED]
-      }
-    ])
+    expect(page.frames()).toEqual([{ v: BRIDGE_PROTOCOL_VERSION, type: 'ready' }])
   })
 
   it('keeps asking on a widening backoff until init answers', () => {
@@ -141,13 +130,11 @@ describe('bridge client handshake', () => {
       pageRouteGrants: null,
       // And no insets, which is the shell that reserves the bar strips outside the view.
       safeAreaInsets: { top: 0, right: 0, bottom: 0, left: 0 },
+      keyboardInset: 0,
       // And no host and no stored keys, which is what `host-store.web.ts` then answers with.
       host: null,
       storage: {},
-      storageOversize: [],
-      // And one that takes nothing from the page beyond the frames every shell has taken, which
-      // is what stops the page posting an erase it would refuse whole (ruling 34).
-      accepts: []
+      storageOversize: []
     })
   })
 
diff --git a/mobile/src/mobile-web-shell/bridge/bridge-rpc-client.ts b/mobile/src/mobile-web-shell/bridge/bridge-rpc-client.ts
index 452bcceb57c3..687d26637f71 100644
--- a/mobile/src/mobile-web-shell/bridge/bridge-rpc-client.ts
+++ b/mobile/src/mobile-web-shell/bridge/bridge-rpc-client.ts
@@ -77,6 +77,8 @@ export type BridgeRpcClient = RpcClient & {
   onRouteUpdate: (listener: (route: BridgeInitRoute | null) => void) => () => void
   /** Fires when an `init` moved the safe-area insets; the value itself is on `getShellSession`. */
   onSafeAreaInsetsUpdate: (listener: (insets: BridgeSafeAreaInsets) => void) => () => void
+  /** Fires when an `init` moved the keyboard height; the value itself is on `getShellSession`. */
+  onKeyboardInsetUpdate: (listener: (height: number) => void) => () => void
   getShellSession: () => BridgeShellSession | null
   /**
    * Asks the shell to open a screen this page does not render. False when the shell granted no
@@ -108,7 +110,6 @@ export type BridgeRpcClient = RpcClient & {
   /**
    * Tells the shell this document has a frame on screen, which is the only thing that does: the
    * shell sees a document commit and a page say `ready`, and neither of those is a painted tree.
-   * Declared in `ready.reports`, so a shell waiting for it is one this page will answer.
    */
   notifyPagePainted: () => void
   /**
@@ -141,9 +142,8 @@ export type BridgeRpcClient = RpcClient & {
    * (ruling 34). The reader erases: the shell tracks no delivery, so a request stays on the route
    * and keeps arriving until the page that applied it says so.
    *
-   * False when this shell never declared it takes one, which is every shell older than the field.
-   * Nothing is owed the caller either way — a clear that did not leave is repaired by the request
-   * arriving again, which is the same path a lost frame takes.
+   * False when the frame could not leave. Nothing is owed the caller — a clear that did not leave
+   * is repaired by the request arriving again, which is the same path a lost frame takes.
    */
   clearRouteParam: (param: BridgeClearableRouteParam, value: string) => boolean
 }
@@ -292,8 +292,7 @@ export function createBridgeRpcClient(options: BridgeRpcClientOptions): BridgeRp
     subscriptions,
     report,
     // Declared here rather than beside the others: the re-assert has to run after the session has
-    // taken this frame, so the claim's own gate reads this `init`'s `accepts` and a shell that
-    // never named it still hears nothing.
+    // taken this frame.
     acceptInit: (message) => {
       handshake.stop()
       shellSession.accept(message)
@@ -412,8 +411,7 @@ export function createBridgeRpcClient(options: BridgeRpcClientOptions): BridgeRp
     send: posted,
     requireSession,
     isClosed: () => closed,
-    hasGrant: (name) => shellSession.current()?.grants.native.includes(name) === true,
-    shellAccepts: (name) => shellSession.current()?.accepts.includes(name) === true
+    hasGrant: (name) => shellSession.current()?.grants.native.includes(name) === true
   })
 
   const unsubscribeFromMessages = options.onMessage(receive)
@@ -465,9 +463,9 @@ export function createBridgeRpcClient(options: BridgeRpcClientOptions): BridgeRp
     onReady: shellSession.onReady,
     onRouteUpdate: shellSession.onRouteUpdate,
     onSafeAreaInsetsUpdate: shellSession.onSafeAreaInsetsUpdate,
+    onKeyboardInsetUpdate: shellSession.onKeyboardInsetUpdate,
     getShellSession: shellSession.current,
     clearRouteParam: (param, value) =>
-      shellSession.current()?.accepts.includes(BRIDGE_ROUTE_PARAM_CLEAR) === true &&
       posted({
         v: BRIDGE_PROTOCOL_VERSION,
         type: 'notify',
diff --git a/mobile/src/mobile-web-shell/bridge/bridge-safe-area-insets.ts b/mobile/src/mobile-web-shell/bridge/bridge-safe-area-insets.ts
index ada32878371d..67d42c774c4c 100644
--- a/mobile/src/mobile-web-shell/bridge/bridge-safe-area-insets.ts
+++ b/mobile/src/mobile-web-shell/bridge/bridge-safe-area-insets.ts
@@ -41,10 +41,3 @@ export function sameSafeAreaInsets(
     left.left === right.left
   )
 }
-
-/**
- * What a page puts in `ready.accepts` to say it pads for the system bars itself. The shell draws
- * the WebView edge-to-edge only for such a page: an older page has no reader for the insets and
- * would lay its header under the status bar, so it keeps the strips the shell reserves.
- */
-export const BRIDGE_SAFE_AREA_ACCEPT = 'safe-area-insets'
diff --git a/mobile/src/mobile-web-shell/bridge/page-first-paint-through-the-bridge.test.ts b/mobile/src/mobile-web-shell/bridge/page-first-paint-through-the-bridge.test.ts
index 86d5189db5e1..c4962ebe16c6 100644
--- a/mobile/src/mobile-web-shell/bridge/page-first-paint-through-the-bridge.test.ts
+++ b/mobile/src/mobile-web-shell/bridge/page-first-paint-through-the-bridge.test.ts
@@ -1,37 +1,18 @@
 /**
- * The paint report end to end, and the three pairings it has to survive: a shell that never
- * advertised it, a page that never declared it, and two halves that did both.
- *
- * Driven through the real port pair rather than a mocked host, because what is worth proving is
- * that each half reads the other's word off a real frame rather than assuming it.
+ * The paint report end to end, driven through the real port pair rather than a mocked host, because
+ * what is worth proving is that the page's post reaches the shell's cover over a real frame.
  */
 import { describe, expect, it } from 'vitest'
 import { readFileSync } from 'node:fs'
 import { join } from 'node:path'
 import { createFakeRpcClient } from '../bridge-host-test-fakes'
 import { createFakeBridgePortPair } from './bridge-port-pair-test-harness'
-import { BRIDGE_PAGE_PAINTED } from './bridge-page-painted'
 import { createRouteScreenPaintReporter } from './page-first-paint'
 
-/** One `init` frame with one name taken out of `accepts`, which is what an older shell sends. */
-function stripAccept(json: string, name: string): string {
-  const frame: unknown = JSON.parse(json)
-  if (typeof frame !== 'object' || frame === null || !('type' in frame)) {
-    return json
-  }
-  const record: Record<string, unknown> = { ...frame }
-  if (record.type !== 'init' || !Array.isArray(record.accepts)) {
-    return json
-  }
-  record.accepts = record.accepts.filter((entry) => entry !== name)
-  return JSON.stringify(record)
-}
-
 describe('the page telling the shell it has a frame', () => {
-  it('new shell, new page: declares on ready and posts after the first paint', async () => {
+  it('posts after the first paint, and not before', async () => {
     const pair = createFakeBridgePortPair({ rpc: createFakeRpcClient() })
     await pair.flush()
-    expect(pair.pageReports()).toEqual([[BRIDGE_PAGE_PAINTED]])
     expect(pair.pagePaintCount()).toBe(0)
 
     // The two frames the entry waits out, drained by hand so "after the paint" is a step.
@@ -52,31 +33,6 @@ describe('the page telling the shell it has a frame', () => {
     expect(pair.pagePaintCount()).toBe(1)
   })
 
-  it('old shell, new page: posts nothing, so no shell is left refusing a frame', async () => {
-    // Stands for every shell installed before this change: `notify` is a closed union there, so an
-    // unasked-for report is an error frame per mount rather than a dropped one.
-    const pair = createFakeBridgePortPair({
-      rpc: createFakeRpcClient(),
-      rewriteToPage: (json) => stripAccept(json, BRIDGE_PAGE_PAINTED)
-    })
-    await pair.flush()
-    expect(pair.client.getShellSession()?.accepts).not.toContain(BRIDGE_PAGE_PAINTED)
-    const framesToShell = pair.toShell.length
-    pair.client.notifyPagePainted()
-    await pair.flush()
-    expect(pair.toShell).toHaveLength(framesToShell)
-    expect(pair.pagePaintCount()).toBe(0)
-    expect(pair.hostDiagnostics).not.toContainEqual(
-      expect.objectContaining({ refusal: 'unrecognised-message' })
-    )
-  })
-
-  it('advertises the report in init, which is what the page reads before posting one', async () => {
-    const pair = createFakeBridgePortPair({ rpc: createFakeRpcClient() })
-    await pair.flush()
-    expect(pair.client.getShellSession()?.accepts).toContain(BRIDGE_PAGE_PAINTED)
-  })
-
   it('is reported by the page entry, from the effect that runs after the tree commits', () => {
     // The one call site, pinned: every test above drives the client directly, so a deleted line in
     // the entry would leave a shell covering a page that has painted and will never say so.
diff --git a/mobile/src/mobile-web-shell/mobile-web-shell-back-claim-state.test.ts b/mobile/src/mobile-web-shell/mobile-web-shell-back-claim-state.test.ts
index 29c0d802860a..b75cd2b54477 100644
--- a/mobile/src/mobile-web-shell/mobile-web-shell-back-claim-state.test.ts
+++ b/mobile/src/mobile-web-shell/mobile-web-shell-back-claim-state.test.ts
@@ -13,7 +13,7 @@ describe('the page claiming the device Back key', () => {
   function claimed(): MobileWebShellStep {
     return run(
       readySession().session,
-      { type: 'page-ready', reports: [], accepts: [] },
+      { type: 'page-ready' },
       { type: 'page-back-claim', claimed: true }
     )
   }
@@ -38,7 +38,7 @@ describe('the page claiming the device Back key', () => {
   })
 
   it('drops it when the document asks for a session again, so the page has to claim again', () => {
-    const reasked = run(claimed().session, { type: 'page-ready', reports: [], accepts: [] })
+    const reasked = run(claimed().session, { type: 'page-ready' })
     expect(shellPageBackClaimed(reasked.session)).toBe(false)
   })
 
diff --git a/mobile/src/mobile-web-shell/mobile-web-shell-failed-update-fallback.test.ts b/mobile/src/mobile-web-shell/mobile-web-shell-failed-update-fallback.test.ts
index 7814b33c73fe..3ae35fc7a6e5 100644
--- a/mobile/src/mobile-web-shell/mobile-web-shell-failed-update-fallback.test.ts
+++ b/mobile/src/mobile-web-shell/mobile-web-shell-failed-update-fallback.test.ts
@@ -122,6 +122,7 @@ function manifestOf(
     buildId: computeMobileWebBundleId(assets),
     minCompatibleRuntimeProtocolVersion: 2,
     runtimeProtocolVersion,
+    pageVersion: 1,
     entrypoint: 'index.html',
     totalBytes: TOTAL_BYTES,
     assets,
diff --git a/mobile/src/mobile-web-shell/mobile-web-shell-keyboard-overlay-screen.test.tsx b/mobile/src/mobile-web-shell/mobile-web-shell-keyboard-overlay-screen.test.tsx
new file mode 100644
index 000000000000..bc0c93968c97
--- /dev/null
+++ b/mobile/src/mobile-web-shell/mobile-web-shell-keyboard-overlay-screen.test.tsx
@@ -0,0 +1,108 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+const harness = await vi.hoisted(async () => await import('./mobile-web-shell-screen-test-harness'))
+const dependencies = vi.hoisted(() => harness.createScreenDependencies())
+
+const { screenModuleMocks } = await vi.hoisted(
+  async () => await import('./mobile-web-shell-screen-test-mocks')
+)
+const mocks = vi.hoisted(() => screenModuleMocks(dependencies))
+vi.mock('react-native', mocks['react-native'])
+vi.mock('expo-clipboard', mocks['expo-clipboard'])
+vi.mock('expo-haptics', mocks['expo-haptics'])
+vi.mock('expo-document-picker', mocks['expo-document-picker'])
+vi.mock('@orca/expo-two-way-audio', mocks['@orca/expo-two-way-audio'])
+vi.mock('expo-keep-awake', mocks['expo-keep-awake'])
+vi.mock('expo-image-picker', mocks['expo-image-picker'])
+vi.mock('expo-file-system', mocks['expo-file-system'])
+vi.mock('lucide-react-native', mocks['lucide-react-native'])
+vi.mock('react-native-safe-area-context', mocks['react-native-safe-area-context'])
+vi.mock('expo-router', mocks['expo-router'])
+vi.mock('../../modules/orca-mobile-web-shell/src', mocks['../../modules/orca-mobile-web-shell/src'])
+vi.mock('../transport/client-context', mocks['../transport/client-context'])
+vi.mock('./use-page-host-snapshot', mocks['./use-page-host-snapshot'])
+vi.mock('./use-mobile-web-shell-session', mocks['./use-mobile-web-shell-session'])
+
+import { act } from 'react-test-renderer'
+import { clientFrame, createFakeRpcClient } from './bridge-host-test-fakes'
+import {
+  byName,
+  readyState,
+  renderScreen as mountScreen
+} from './mobile-web-shell-screen-test-harness'
+import { readBridgeHostMessage } from './bridge/bridge-envelope'
+import { MobileWebShellScreen } from './MobileWebShellScreen'
+import type { MobileWebShellSessionState } from './mobile-web-shell-session-contract'
+import type { ReactTestRenderer } from 'react-test-renderer'
+
+const renderScreen = (state: MobileWebShellSessionState): Promise<ReactTestRenderer> =>
+  mountScreen(MobileWebShellScreen, dependencies, state)
+
+afterEach(harness.unmountRenderedScreens)
+
+beforeEach(() => {
+  harness.resetScreenDependencies(dependencies)
+})
+
+const WINDOW = { top: 44, right: 0, bottom: 8, left: 0 }
+
+/**
+ * The page is covered by the keyboard like a native screen: the view keeps its size, and the page
+ * is told the height on every keyboard event.
+ */
+describe('a page the keyboard covers', () => {
+  async function openPage(sessionId: string) {
+    dependencies.client = createFakeRpcClient()
+    const tree = await renderScreen(readyState(sessionId))
+    await act(async () => {
+      byName(tree, 'ShellViewProbe')[0]?.props.onBridgeMessage({
+        nativeEvent: { json: clientFrame({ type: 'ready' }) }
+      })
+    })
+    const root = () => tree.root.find((node) => node.props.testID === 'mobile-web-shell-ready')
+    const inits = () =>
+      dependencies.posted.flatMap((json) => {
+        const read = readBridgeHostMessage(json)
+        return read.ok && read.message.type === 'init'
+          ? [{ keyboard: read.message.keyboardInset ?? 0, insets: read.message.safeAreaInsets }]
+          : []
+      })
+    const keyboard = async (height: number) => {
+      await act(async () => {
+        const ios = dependencies.platform === 'ios'
+        const name =
+          height > 0
+            ? ios
+              ? 'keyboardWillShow'
+              : 'keyboardDidShow'
+            : ios
+              ? 'keyboardWillHide'
+              : 'keyboardDidHide'
+        dependencies.keyboardListeners.get(name)?.({ endCoordinates: { height } })
+      })
+    }
+    return { root, inits, keyboard }
+  }
+
+  for (const platform of ['ios', 'android'] as const) {
+    it(`never shortens the view, and publishes show, a height change and hide (${platform})`, async () => {
+      dependencies.platform = platform
+      const page = await openPage(`session-overlay-${platform}`)
+      // Pixel_API_37: 312 up, 346 with the suggestion strip, then closed. The inset tracks each, so
+      // a keyboard that changes height while open leaves no gap above it.
+      for (const height of [312, 346, 0]) {
+        await page.keyboard(height)
+        expect(page.root().props.style[1]).toEqual({ paddingTop: 0 })
+      }
+      // The keyboard's own height as native screens read it on this OS, home indicator included on
+      // iOS; the page's arithmetic branches on the shell's OS, as native does. The bottom inset
+      // stays the window's.
+      expect(page.inits()).toEqual([
+        { keyboard: 0, insets: WINDOW },
+        { keyboard: 312, insets: WINDOW },
+        { keyboard: 346, insets: WINDOW },
+        { keyboard: 0, insets: WINDOW }
+      ])
+    })
+  }
+})
diff --git a/mobile/src/mobile-web-shell/mobile-web-shell-offline-grant-staleness.test.ts b/mobile/src/mobile-web-shell/mobile-web-shell-offline-grant-staleness.test.ts
index c39c55604645..1fb8acee474f 100644
--- a/mobile/src/mobile-web-shell/mobile-web-shell-offline-grant-staleness.test.ts
+++ b/mobile/src/mobile-web-shell/mobile-web-shell-offline-grant-staleness.test.ts
@@ -110,6 +110,7 @@ function manifestGranting(
     buildId: BUILD_ID,
     minCompatibleRuntimeProtocolVersion: 2,
     runtimeProtocolVersion: 5,
+    pageVersion: 1,
     entrypoint: 'index.html',
     totalBytes: TOTAL_BYTES,
     assets: ASSETS,
diff --git a/mobile/src/mobile-web-shell/mobile-web-shell-safe-area-screen.test.tsx b/mobile/src/mobile-web-shell/mobile-web-shell-safe-area-screen.test.tsx
index e8fcf93aad76..446f57b5062c 100644
--- a/mobile/src/mobile-web-shell/mobile-web-shell-safe-area-screen.test.tsx
+++ b/mobile/src/mobile-web-shell/mobile-web-shell-safe-area-screen.test.tsx
@@ -31,8 +31,6 @@ import {
   renderScreen as mountScreen
 } from './mobile-web-shell-screen-test-harness'
 import { readBridgeHostMessage } from './bridge/bridge-envelope'
-import { BRIDGE_ROUTE_UPDATE_ACCEPT } from './bridge/bridge-route-update'
-import { BRIDGE_SAFE_AREA_ACCEPT } from './bridge/bridge-safe-area-insets'
 import { MobileWebShellScreen } from './MobileWebShellScreen'
 import type { MobileWebShellSessionState } from './mobile-web-shell-session-contract'
 import type { ReactTestRenderer } from 'react-test-renderer'
@@ -47,16 +45,16 @@ beforeEach(() => {
 })
 
 /**
- * A page that pads for the system bars itself gets the whole window, like a native screen: it
+ * Every page pads for the system bars itself and gets the whole window, like a native screen: it
  * paints under both bars and its SafeAreaViews pad by the insets `init` carries.
  */
 describe('a page that owns its safe area', () => {
-  async function openPage(sessionId: string, accepts: readonly string[]) {
+  async function openPage(sessionId: string) {
     dependencies.client = createFakeRpcClient()
     const tree = await renderScreen(readyState(sessionId))
     await act(async () => {
       byName(tree, 'ShellViewProbe')[0]?.props.onBridgeMessage({
-        nativeEvent: { json: clientFrame({ type: 'ready', accepts }) }
+        nativeEvent: { json: clientFrame({ type: 'ready' }) }
       })
     })
     const root = () => tree.root.find((node) => node.props.testID === 'mobile-web-shell-ready')
@@ -65,73 +63,31 @@ describe('a page that owns its safe area', () => {
         const read = readBridgeHostMessage(json)
         return read.ok && read.message.type === 'init' ? [read.message.safeAreaInsets ?? null] : []
       })
-    const keyboard = async (height: number) => {
-      await act(async () => {
-        const ios = dependencies.platform === 'ios'
-        const name =
-          height > 0
-            ? ios
-              ? 'keyboardWillShow'
-              : 'keyboardDidShow'
-            : ios
-              ? 'keyboardWillHide'
-              : 'keyboardDidHide'
-        dependencies.keyboardListeners.get(name)?.({ endCoordinates: { height } })
-      })
-    }
-    return { tree, root, initInsets, keyboard }
-  }
-  const ownedPage = (sessionId: string) => {
-    dependencies.pageOwnsSafeArea = true
-    return openPage(sessionId, [BRIDGE_ROUTE_UPDATE_ACCEPT, BRIDGE_SAFE_AREA_ACCEPT])
+    return { tree, root, initInsets }
   }
+  // A `ready` that declares nothing: every page the shell serves reads the insets.
+  const ownedPage = openPage
   const WINDOW = { top: 44, right: 0, bottom: 8, left: 0 }
 
   it('draws the view edge-to-edge and hands the page the insets it now sits under', async () => {
     const page = await ownedPage('session-owned')
-    expect(page.root().props.style[1]).toEqual({ paddingTop: 0, paddingBottom: 0 })
+    expect(page.root().props.style[1]).toEqual({ paddingTop: 0 })
     expect(page.initInsets()).toEqual([WINDOW])
   })
 
-  it('re-sends init with no bottom inset while the keyboard ends the view', async () => {
-    const page = await ownedPage('session-owned-keyboard')
-    await page.keyboard(336)
-    // The view ends at the keyboard's top, so nothing of it is under the gesture bar.
-    expect(page.root().props.style[1]).toEqual({ paddingTop: 0, paddingBottom: 336 })
-    await page.keyboard(0)
-    expect(page.root().props.style[1]).toEqual({ paddingTop: 0, paddingBottom: 0 })
-    expect(page.initInsets()).toEqual([WINDOW, { ...WINDOW, bottom: 0 }, WINDOW])
-  })
-
-  it('does the same on Android, where the IME strip is measured above the gesture bar', async () => {
-    dependencies.platform = 'android'
-    const page = await ownedPage('session-owned-android')
-    await page.keyboard(336)
-    expect(page.root().props.style[1]).toEqual({ paddingTop: 0, paddingBottom: 344 })
-    await page.keyboard(0)
-    expect(page.root().props.style[1]).toEqual({ paddingTop: 0, paddingBottom: 0 })
-    expect(page.initInsets()).toEqual([WINDOW, { ...WINDOW, bottom: 0 }, WINDOW])
-  })
-
   it('gives the status bar strip to the update banner while it shows', async () => {
     dependencies.updateNotice = 'update-failed'
     const page = await ownedPage('session-owned-banner')
-    expect(page.root().props.style[1]).toEqual({ paddingTop: 44, paddingBottom: 0 })
+    expect(page.root().props.style[1]).toEqual({ paddingTop: 44 })
     expect(page.initInsets()).toEqual([{ ...WINDOW, top: 0 }])
+    const dismiss = byName(page.tree, 'Pressable').find(
+      (node) => node.props.accessibilityLabel === 'Dismiss notice'
+    )
+    expect(dismiss).toBeDefined()
     await act(async () => {
-      byName(page.tree, 'Pressable')
-        .find((node) => node.props.accessibilityLabel === 'Dismiss notice')
-        ?.props.onPress()
+      dismiss?.props.onPress()
     })
-    expect(page.root().props.style[1]).toEqual({ paddingTop: 0, paddingBottom: 0 })
+    expect(page.root().props.style[1]).toEqual({ paddingTop: 0 })
     expect(page.initInsets()).toEqual([{ ...WINDOW, top: 0 }, WINDOW])
   })
-
-  it('sends no second init to an older page that takes route updates but not insets', async () => {
-    const page = await openPage('session-older', [BRIDGE_ROUTE_UPDATE_ACCEPT])
-    await page.keyboard(336)
-    await page.keyboard(0)
-    expect(page.root().props.style[1]).toEqual({ paddingTop: 44, paddingBottom: 8 })
-    expect(page.initInsets()).toHaveLength(1)
-  })
 })
diff --git a/mobile/src/mobile-web-shell/mobile-web-shell-safe-area-state.test.ts b/mobile/src/mobile-web-shell/mobile-web-shell-safe-area-state.test.ts
deleted file mode 100644
index 0ea58b85b0be..000000000000
--- a/mobile/src/mobile-web-shell/mobile-web-shell-safe-area-state.test.ts
+++ /dev/null
@@ -1,34 +0,0 @@
-import { describe, expect, it } from 'vitest'
-import { readySession, run } from './mobile-web-shell-session-test-fixtures'
-import { BRIDGE_SAFE_AREA_ACCEPT } from './bridge/bridge-safe-area-insets'
-import { shellPageOwnsSafeArea } from './page-document-state'
-
-/** Whether the shell may draw the view edge-to-edge, which only the document on screen can say. */
-describe('the page declaring it pads for the system bars', () => {
-  const owned = () =>
-    run(readySession().session, {
-      type: 'page-ready',
-      reports: [],
-      accepts: [BRIDGE_SAFE_AREA_ACCEPT]
-    })
-
-  it('is read off the ready that declared it', () => {
-    expect(shellPageOwnsSafeArea(owned().session)).toBe(true)
-  })
-
-  it('is false for a page that did not declare it, which is every page before the name', () => {
-    const older = run(readySession().session, { type: 'page-ready', reports: [], accepts: [] })
-    expect(shellPageOwnsSafeArea(older.session)).toBe(false)
-  })
-
-  it('is dropped when a replacement document starts, so the next one has to say it again', () => {
-    expect(shellPageOwnsSafeArea(run(owned().session, { type: 'document-started' }).session)).toBe(
-      false
-    )
-  })
-
-  it('is not read once the generation is off screen', () => {
-    const failed = run(owned().session, { type: 'shell-failed', reason: 'document-load-failed' })
-    expect(shellPageOwnsSafeArea(failed.session)).toBe(false)
-  })
-})
diff --git a/mobile/src/mobile-web-shell/mobile-web-shell-screen-test-harness.tsx b/mobile/src/mobile-web-shell/mobile-web-shell-screen-test-harness.tsx
index 64135cef2485..2abeff8fd96e 100644
--- a/mobile/src/mobile-web-shell/mobile-web-shell-screen-test-harness.tsx
+++ b/mobile/src/mobile-web-shell/mobile-web-shell-screen-test-harness.tsx
@@ -55,9 +55,7 @@ export type ScreenDependencies = {
   setScreenOptions: Mock
   /** Whether the session says the page is holding the device Back key. */
   backClaimed: boolean
-  /** Whether the session says the page pads for the system bars itself. */
-  pageOwnsSafeArea: boolean
-  /** What `Platform.OS` answers, which picks the keyboard events and the IME strip. */
+  /** What `Platform.OS` answers, which picks the keyboard events. */
   platform: 'ios' | 'android'
   reportPageBackClaim: Mock
   /** Whether the mounted host would take a press, which is a page that declared it takes one. */
@@ -114,7 +112,6 @@ export function createScreenDependencies(): ScreenDependencies {
     backHandlers: new Map(),
     setScreenOptions: vi.fn(),
     backClaimed: false,
-    pageOwnsSafeArea: false,
     platform: 'ios',
     reportPageBackClaim: vi.fn(),
     sendBackDelivers: true,
@@ -154,7 +151,6 @@ export function resetScreenDependencies(dependencies: ScreenDependencies): void
   dependencies.setScreenOptions.mockReset()
   dependencies.reportPageBackClaim.mockReset()
   dependencies.backClaimed = false
-  dependencies.pageOwnsSafeArea = false
   dependencies.platform = 'ios'
   dependencies.sendBackDelivers = true
   dependencies.backSends = 0
diff --git a/mobile/src/mobile-web-shell/mobile-web-shell-screen-test-mocks.tsx b/mobile/src/mobile-web-shell/mobile-web-shell-screen-test-mocks.tsx
index c622c77f11d5..1976c3d700f7 100644
--- a/mobile/src/mobile-web-shell/mobile-web-shell-screen-test-mocks.tsx
+++ b/mobile/src/mobile-web-shell/mobile-web-shell-screen-test-mocks.tsx
@@ -180,8 +180,7 @@ export function screenModuleMocks(dependencies: ScreenDependencies) {
         reportPageBackClaim: dependencies.reportPageBackClaim,
         pageReady: dependencies.pageReady,
         pageFrame: dependencies.pageFrame,
-        backClaimed: dependencies.backClaimed,
-        pageOwnsSafeArea: dependencies.pageOwnsSafeArea
+        backClaimed: dependencies.backClaimed
       })
     })
   }
diff --git a/mobile/src/mobile-web-shell/mobile-web-shell-session-contract.ts b/mobile/src/mobile-web-shell/mobile-web-shell-session-contract.ts
index 98f0df8a9007..bfc8c5f385e9 100644
--- a/mobile/src/mobile-web-shell/mobile-web-shell-session-contract.ts
+++ b/mobile/src/mobile-web-shell/mobile-web-shell-session-contract.ts
@@ -11,11 +11,6 @@ import type {
   MobileWebShellUpdateFailureFacts
 } from './mobile-web-shell-update-failure'
 
-/** What one `ready` declared: what the page will report, and what it can be sent. */
-export type PageReadyDeclaration = {
-  readonly reports: readonly string[]
-  readonly accepts: readonly string[]
-}
 /**
  * Whether the host can be asked anything right now.
  *
@@ -218,12 +213,9 @@ export type MobileWebShellSessionEvent =
   /** The native view finished a document. Unstamped, like the view's failure and for the same
    *  reason: the view exists only under the generation on screen. */
   | { readonly type: 'document-loaded' }
-  /**
-   * The page said `ready` over the bridge, which is the only proof its code ran at all, carrying
-   * what that `ready` declared it reports and accepts.
-   */
-  | ({ readonly type: 'page-ready' } & PageReadyDeclaration)
-  /** The page has a frame on screen. Only a page that declared it ever sends one. */
+  /** The page said `ready` over the bridge, which is the only proof its code ran at all. */
+  | { readonly type: 'page-ready' }
+  /** The page has a frame on screen. */
   | { readonly type: 'page-painted' }
   /** The page is holding the device Back key, or has let it go. The host sends false on its own
    *  for every way a document ends, so this never has to be inferred from silence. */
@@ -251,9 +243,6 @@ export type MobileWebShellSession = {
   /** Whether the document on screen has spoken over the bridge. Cleared by every new document,
    *  because each one has to prove itself: the last one's word says nothing about this one. */
   readonly pageReady: boolean
-  /** Whether this document said it would report its first paint. Cleared with `pageReady`, and
-   *  false for every page built before the report existed. */
-  readonly pageReportsPaint: boolean
   /** Whether this document has reported a frame on screen. Cleared with `pageReady`. */
   readonly pagePainted: boolean
   /**
@@ -264,9 +253,6 @@ export type MobileWebShellSession = {
    * with it, which is a key that does nothing at all.
    */
   readonly pageBackClaimed: boolean
-  /** Whether this document pads for the system bars itself, so the view may go edge-to-edge.
-   *  Cleared with `pageReady`, and false for every page built before the declaration existed. */
-  readonly pageOwnsSafeArea: boolean
   /** The gates the current step was taken on; null until the first one arrives. */
   readonly gates: MobileWebShellGates | null
   readonly cached: CachedGeneration | null
diff --git a/mobile/src/mobile-web-shell/mobile-web-shell-session-effects.test.ts b/mobile/src/mobile-web-shell/mobile-web-shell-session-effects.test.ts
index 24f3e9a01b8d..5777cb8173f2 100644
--- a/mobile/src/mobile-web-shell/mobile-web-shell-session-effects.test.ts
+++ b/mobile/src/mobile-web-shell/mobile-web-shell-session-effects.test.ts
@@ -20,7 +20,7 @@ import { MobileWebBundleFetchError } from '../transport/mobile-web-bundle-fetch-
 import { markRpcDeliveryUnknown } from '../transport/rpc-delivery-ambiguity'
 import type { RpcClient } from '../transport/rpc-client'
 import type { GenerationStore } from './generation-store'
-import { download, readManifest } from './mobile-web-shell-session-effects'
+import { download, openCache, readManifest } from './mobile-web-shell-session-effects'
 
 // The mocked operations never touch the client; they only need one to exist.
 const CLIENT: RpcClient = {
@@ -128,6 +128,27 @@ describe('the manifest read', () => {
   })
 })
 
+describe('the page version the floor reads', () => {
+  it('is carried from the host manifest to the reducer', async () => {
+    doubles.manifest = () => Promise.resolve({ manifest: { ...MANIFEST, pageVersion: 4 } })
+    const { events, send } = collect()
+    await readManifest(CLIENT, 3, send)
+    expect(events).toMatchObject([{ type: 'manifest-read', manifest: { pageVersion: 4 } }])
+  })
+
+  it('is carried from the cached manifest to the generation judged against the host', async () => {
+    const store: GenerationStore = {
+      ...storeThat(null),
+      readActiveGeneration: async () => ({
+        buildId: MANIFEST.buildId,
+        directory: 'd',
+        manifest: { ...MANIFEST, pageVersion: 4, routes: [] }
+      })
+    }
+    expect((await openCache(store, 'k'))?.compat.pageVersion).toBe(4)
+  })
+})
+
 describe('the download', () => {
   beforeEach(() => {
     doubles.fetch = () =>
diff --git a/mobile/src/mobile-web-shell/mobile-web-shell-session-effects.ts b/mobile/src/mobile-web-shell/mobile-web-shell-session-effects.ts
index 989f56bb99bf..56f3ab554d03 100644
--- a/mobile/src/mobile-web-shell/mobile-web-shell-session-effects.ts
+++ b/mobile/src/mobile-web-shell/mobile-web-shell-session-effects.ts
@@ -40,7 +40,9 @@ export async function openCache(
           compat: {
             schemaVersion: active.manifest.schemaVersion,
             runtimeProtocolVersion: active.manifest.runtimeProtocolVersion,
-            minCompatibleRuntimeProtocolVersion: active.manifest.minCompatibleRuntimeProtocolVersion
+            minCompatibleRuntimeProtocolVersion:
+              active.manifest.minCompatibleRuntimeProtocolVersion,
+            pageVersion: active.manifest.pageVersion
           }
         }
   } catch {
@@ -78,6 +80,7 @@ export async function readManifest(
         schemaVersion: manifest.schemaVersion,
         runtimeProtocolVersion: manifest.runtimeProtocolVersion,
         minCompatibleRuntimeProtocolVersion: manifest.minCompatibleRuntimeProtocolVersion,
+        pageVersion: manifest.pageVersion,
         totalBytes: manifest.totalBytes,
         totalAssets: manifest.assets.length,
         routes: manifest.routes,
diff --git a/mobile/src/mobile-web-shell/mobile-web-shell-session-test-fixtures.ts b/mobile/src/mobile-web-shell/mobile-web-shell-session-test-fixtures.ts
index 2151597353e1..17fb655dba62 100644
--- a/mobile/src/mobile-web-shell/mobile-web-shell-session-test-fixtures.ts
+++ b/mobile/src/mobile-web-shell/mobile-web-shell-session-test-fixtures.ts
@@ -41,6 +41,7 @@ export const MANIFEST_WIRE: MobileWebBundleManifestRead = {
   buildId: 'b'.repeat(64),
   minCompatibleRuntimeProtocolVersion: 2,
   runtimeProtocolVersion: 5,
+  pageVersion: 1,
   entrypoint: 'index.html',
   totalBytes: 4096,
   assets: [
@@ -86,6 +87,7 @@ export function manifestFacts(wire: MobileWebBundleManifestRead): MobileWebShell
     schemaVersion: wire.schemaVersion,
     runtimeProtocolVersion: wire.runtimeProtocolVersion,
     minCompatibleRuntimeProtocolVersion: wire.minCompatibleRuntimeProtocolVersion,
+    pageVersion: wire.pageVersion,
     totalBytes: wire.totalBytes,
     totalAssets: wire.assets.length,
     routes: wire.routes,
@@ -103,7 +105,8 @@ export const CACHED: CachedGeneration = {
   compat: {
     schemaVersion: MANIFEST.schemaVersion,
     runtimeProtocolVersion: MANIFEST.runtimeProtocolVersion,
-    minCompatibleRuntimeProtocolVersion: MANIFEST.minCompatibleRuntimeProtocolVersion
+    minCompatibleRuntimeProtocolVersion: MANIFEST.minCompatibleRuntimeProtocolVersion,
+    pageVersion: MANIFEST.pageVersion
   }
 }
 
diff --git a/mobile/src/mobile-web-shell/mobile-web-shell-session.test.ts b/mobile/src/mobile-web-shell/mobile-web-shell-session.test.ts
index 1cf6c0914b07..a0cf5fd07742 100644
--- a/mobile/src/mobile-web-shell/mobile-web-shell-session.test.ts
+++ b/mobile/src/mobile-web-shell/mobile-web-shell-session.test.ts
@@ -14,7 +14,6 @@ import {
   LINK_LOST,
   withoutRecord
 } from './mobile-web-shell-session-test-fixtures'
-import { BRIDGE_PAGE_PAINTED } from './bridge/bridge-page-painted'
 import { shellPageFrame } from './shell-page-frame'
 
 describe('the gates decide whether a step is taken at all', () => {
@@ -221,6 +220,25 @@ describe('the connected flow', () => {
     })
   })
 
+  it('walls a listed route whose page is older than this shell, as a desktop to update', () => {
+    for (const manifest of [
+      { ...MANIFEST, pageVersion: 0 },
+      { ...MANIFEST, pageVersion: undefined }
+    ]) {
+      const step = run(afterCacheRead(null).session, { type: 'manifest-read', manifest })
+      expect(step.session.state).toEqual({
+        kind: 'wall',
+        verdict: {
+          kind: 'blocked',
+          reason: 'bundle-incompatible',
+          side: 'desktop',
+          pageVersion: 0,
+          requiredPageVersion: 1
+        }
+      })
+    }
+  })
+
   it('tells the page which routes it may keep, so it hands the rest back', () => {
     const step = run(afterCacheRead(null).session, { type: 'manifest-read', manifest: MANIFEST })
     expect(step.session.pageRoutes).toEqual(['/h/[hostId]'])
@@ -690,11 +708,7 @@ describe('the page has to speak for the document that loaded', () => {
   })
 
   it('arms nothing when the page spoke first, because there is nothing left to wait for', () => {
-    const step = run(
-      readySession().session,
-      { type: 'page-ready', reports: [], accepts: [] },
-      { type: 'document-loaded' }
-    )
+    const step = run(readySession().session, { type: 'page-ready' }, { type: 'document-loaded' })
     expect(step.effects).toEqual([])
     expect(step.session.pageReady).toBe(true)
   })
@@ -718,7 +732,7 @@ describe('the page has to speak for the document that loaded', () => {
     const step = run(
       readySession().session,
       { type: 'document-loaded' },
-      { type: 'page-ready', reports: [], accepts: [] },
+      { type: 'page-ready' },
       { type: 'page-ready-deadline' }
     )
     expect(step.effects).toEqual([])
@@ -737,7 +751,7 @@ describe('the page has to speak for the document that loaded', () => {
   })
 
   it('makes the second document prove itself, rather than riding the first one word', () => {
-    const spoken = run(readySession().session, { type: 'page-ready', reports: [], accepts: [] })
+    const spoken = run(readySession().session, { type: 'page-ready' })
     const remounted = run(spoken.session, { type: 'remounted', sessionId: 'session-two' })
     expect(remounted.session.pageReady).toBe(false)
     expect(run(remounted.session, { type: 'document-loaded' }).effects).toEqual([
@@ -746,11 +760,7 @@ describe('the page has to speak for the document that loaded', () => {
   })
 
   it('leaves a remounted document its own wait when the first one expires late', () => {
-    const first = run(
-      readySession().session,
-      { type: 'document-loaded' },
-      { type: 'page-ready', reports: [], accepts: [] }
-    )
+    const first = run(readySession().session, { type: 'document-loaded' }, { type: 'page-ready' })
     const armed = first.session.flow
     const second = run(
       first.session,
@@ -766,7 +776,7 @@ describe('the page has to speak for the document that loaded', () => {
   })
 
   it('makes a freshly activated generation prove itself too', () => {
-    const spoken = run(readySession().session, { type: 'page-ready', reports: [], accepts: [] })
+    const spoken = run(readySession().session, { type: 'page-ready' })
     const reactivated = run(spoken.session, {
       type: 'activated',
       generationDirectory: CACHED.directory,
@@ -784,13 +794,8 @@ describe('the page has to speak for the document that loaded', () => {
  * thing that says the view is worth showing is the page saying so.
  */
 describe('the page reporting a frame on screen', () => {
-  it('records what the ready declared and keeps the frame covered until the report', () => {
-    const spoken = run(readySession().session, {
-      type: 'page-ready',
-      reports: [BRIDGE_PAGE_PAINTED],
-      accepts: []
-    })
-    expect(spoken.session.pageReportsPaint).toBe(true)
+  it('keeps the frame covered past ready until the report', () => {
+    const spoken = run(readySession().session, { type: 'page-ready' })
     expect(spoken.session.pagePainted).toBe(false)
     expect(shellPageFrame(spoken.session)).toBe('unpainted')
     const painted = run(spoken.session, { type: 'page-painted' })
@@ -798,42 +803,15 @@ describe('the page reporting a frame on screen', () => {
     expect(shellPageFrame(painted.session)).toBe('painted')
   })
 
-  it('new shell, old page: ignores an undeclared report and uncovers on ready', () => {
-    const spoken = run(readySession().session, { type: 'page-ready', reports: [], accepts: [] })
-    const step = run(spoken.session, { type: 'page-painted' })
-    expect(step.session.pagePainted).toBe(false)
-    // Uncovered anyway: `ready` is the newest word a page built before the report can say.
-    expect(shellPageFrame(step.session)).toBe('painted')
-  })
-
-  it('re-reads the declaration on every ask, because a reload asks again', () => {
-    const declared = run(readySession().session, {
-      type: 'page-ready',
-      reports: [BRIDGE_PAGE_PAINTED],
-      accepts: []
-    })
-    const reloaded = run(declared.session, { type: 'page-ready', reports: [], accepts: [] })
-    expect(reloaded.session.pageReportsPaint).toBe(false)
-  })
-
   it('makes a remounted document report its own frame', () => {
-    const painted = run(
-      readySession().session,
-      { type: 'page-ready', reports: [BRIDGE_PAGE_PAINTED], accepts: [] },
-      { type: 'page-painted' }
-    )
+    const painted = run(readySession().session, { type: 'page-ready' }, { type: 'page-painted' })
     const remounted = run(painted.session, { type: 'remounted', sessionId: 'session-two' })
     expect(remounted.session.pagePainted).toBe(false)
-    expect(remounted.session.pageReportsPaint).toBe(false)
     expect(shellPageFrame(remounted.session)).toBe('unpainted')
   })
 
   it('makes a freshly activated generation report its own frame', () => {
-    const painted = run(
-      readySession().session,
-      { type: 'page-ready', reports: [BRIDGE_PAGE_PAINTED], accepts: [] },
-      { type: 'page-painted' }
-    )
+    const painted = run(readySession().session, { type: 'page-ready' }, { type: 'page-painted' })
     const reactivated = run(painted.session, {
       type: 'activated',
       generationDirectory: CACHED.directory,
@@ -843,24 +821,15 @@ describe('the page reporting a frame on screen', () => {
       elapsedMs: 9
     })
     expect(reactivated.session.pagePainted).toBe(false)
-    expect(reactivated.session.pageReportsPaint).toBe(false)
   })
 
   it('makes the document that replaced a painted one inside this mount report its own frame', () => {
-    const painted = run(
-      readySession().session,
-      { type: 'page-ready', reports: [BRIDGE_PAGE_PAINTED], accepts: [] },
-      { type: 'page-painted' }
-    )
+    const painted = run(readySession().session, { type: 'page-ready' }, { type: 'page-painted' })
     expect(shellPageFrame(painted.session)).toBe('painted')
     // No new session and no new generation: the view reloaded under the one already on screen.
     const restarted = run(painted.session, { type: 'document-started' })
     expect(restarted.session.pagePainted).toBe(false)
-    const reasked = run(restarted.session, {
-      type: 'page-ready',
-      reports: [BRIDGE_PAGE_PAINTED],
-      accepts: []
-    })
+    const reasked = run(restarted.session, { type: 'page-ready' })
     expect(shellPageFrame(reasked.session)).toBe('unpainted')
     expect(shellPageFrame(run(reasked.session, { type: 'page-painted' }).session)).toBe('painted')
   })
@@ -869,11 +838,7 @@ describe('the page reporting a frame on screen', () => {
     const loaded = run(readySession().session, { type: 'document-loaded' })
     expect(loaded.effects).toEqual([{ kind: 'await-page-ready' }])
     const armed = loaded.session.flow
-    const spoken = run(loaded.session, {
-      type: 'page-ready',
-      reports: [BRIDGE_PAGE_PAINTED],
-      accepts: []
-    })
+    const spoken = run(loaded.session, { type: 'page-ready' })
     const restarted = run(spoken.session, { type: 'document-started' })
     // The replacement is still loading and has said nothing, which is exactly what the retired
     // document's deadline reads as a document that never loaded.
@@ -888,9 +853,9 @@ describe('the page reporting a frame on screen', () => {
   it('keeps the frame of a document that repeats its own handshake', () => {
     const painted = run(
       readySession().session,
-      { type: 'page-ready', reports: [BRIDGE_PAGE_PAINTED], accepts: [] },
+      { type: 'page-ready' },
       { type: 'page-painted' },
-      { type: 'page-ready', reports: [BRIDGE_PAGE_PAINTED], accepts: [] }
+      { type: 'page-ready' }
     )
     // The document never restarted, so its frame is still the one on screen.
     expect(painted.session.pagePainted).toBe(true)
@@ -900,8 +865,9 @@ describe('the page reporting a frame on screen', () => {
   it('records nothing from a page whose generation is no longer on screen', () => {
     const failed = run(readySession().session, {
       type: 'shell-failed',
-      reason: 'render-process-gone'
+      reason: 'document-load-failed'
     })
+    expect(failed.session.state.kind).not.toBe('ready')
     expect(run(failed.session, { type: 'page-painted' }).session.pagePainted).toBe(false)
   })
 })
diff --git a/mobile/src/mobile-web-shell/mobile-web-shell-session.ts b/mobile/src/mobile-web-shell/mobile-web-shell-session.ts
index 5a0a25b7db68..595e1d92dfdf 100644
--- a/mobile/src/mobile-web-shell/mobile-web-shell-session.ts
+++ b/mobile/src/mobile-web-shell/mobile-web-shell-session.ts
@@ -39,10 +39,8 @@ export function createMobileWebShellSession(routePathname: string): MobileWebShe
     retriedOnce: false,
     remountedOnce: false,
     pageReady: false,
-    pageReportsPaint: false,
     pagePainted: false,
     pageBackClaimed: false,
-    pageOwnsSafeArea: false,
     gates: null,
     cached: null,
     updateNotice: null,
diff --git a/mobile/src/mobile-web-shell/page-document-state.ts b/mobile/src/mobile-web-shell/page-document-state.ts
index 935f201d346f..e2405f24591d 100644
--- a/mobile/src/mobile-web-shell/page-document-state.ts
+++ b/mobile/src/mobile-web-shell/page-document-state.ts
@@ -1,5 +1,3 @@
-import { BRIDGE_PAGE_PAINTED } from './bridge/bridge-page-painted'
-import { BRIDGE_SAFE_AREA_ACCEPT } from './bridge/bridge-safe-area-insets'
 import type {
   MobileWebShellSession,
   MobileWebShellSessionEvent
@@ -8,10 +6,8 @@ import type {
 /** Everything one document told the shell about itself, which the next one has to say again. */
 export const CLEAR_PAGE_DOCUMENT_STATE = {
   pageReady: false,
-  pageReportsPaint: false,
   pagePainted: false,
-  pageBackClaimed: false,
-  pageOwnsSafeArea: false
+  pageBackClaimed: false
 } as const
 
 /** The three things a document reports about itself, as the reducer receives them. */
@@ -25,7 +21,7 @@ export type PageDocumentEvent = Extract<
  * view exists only under the generation on screen.
  */
 export function pageDocumentStatePatch(
-  session: Pick<MobileWebShellSession, 'state' | 'pageReportsPaint'>,
+  session: Pick<MobileWebShellSession, 'state'>,
   event: PageDocumentEvent
 ): Partial<MobileWebShellSession> {
   if (session.state.kind !== 'ready') {
@@ -35,25 +31,8 @@ export function pageDocumentStatePatch(
     return { pageBackClaimed: event.claimed }
   }
   if (event.type === 'page-ready') {
-    // Re-read on every ask rather than latched: a document that reloads inside this mount asks
-    // again, and it is the newest ask that says whether a paint report is coming. The key goes with
-    // it: the host drops the claim on the same `ready`, so a page that still holds one re-claims.
-    return {
-      pageReady: true,
-      pageReportsPaint: event.reports.includes(BRIDGE_PAGE_PAINTED),
-      pageBackClaimed: false,
-      pageOwnsSafeArea: event.accepts.includes(BRIDGE_SAFE_AREA_ACCEPT)
-    }
+    // The host drops the claim on the same `ready`, so a page that still holds one re-claims.
+    return { pageReady: true, pageBackClaimed: false }
   }
-  // Kept off a page that never said it would report: acting on an unasked-for frame would make
-  // the wait depend on a name arriving instead of on a claim the page made.
-  return session.pageReportsPaint ? { pagePainted: true } : {}
-}
-
-/** Whether the shell may draw the view edge-to-edge: gated on `ready` like the Back claim, so a
- *  declaration never outlives the document on screen. */
-export function shellPageOwnsSafeArea(
-  session: Pick<MobileWebShellSession, 'state' | 'pageOwnsSafeArea'>
-): boolean {
-  return session.state.kind === 'ready' && session.pageOwnsSafeArea
+  return { pagePainted: true }
 }
diff --git a/mobile/src/mobile-web-shell/page-safe-area-insets.test.ts b/mobile/src/mobile-web-shell/page-safe-area-insets.test.ts
index 76877567b31c..e0bd1305405b 100644
--- a/mobile/src/mobile-web-shell/page-safe-area-insets.test.ts
+++ b/mobile/src/mobile-web-shell/page-safe-area-insets.test.ts
@@ -5,22 +5,10 @@ const WINDOW = { top: 52, right: 12, bottom: 24, left: 12 }
 
 describe('the insets the page pads for', () => {
   it('is the window insets while nothing of the shell stands over the view', () => {
-    expect(pageSafeAreaInsets({ insets: WINDOW, keyboardInset: 0, topCovered: false })).toEqual(
-      WINDOW
-    )
-  })
-
-  it('has no bottom while the keyboard ends the view above the gesture bar', () => {
-    expect(pageSafeAreaInsets({ insets: WINDOW, keyboardInset: 360, topCovered: false })).toEqual({
-      ...WINDOW,
-      bottom: 0
-    })
+    expect(pageSafeAreaInsets({ insets: WINDOW, topCovered: false })).toEqual(WINDOW)
   })
 
   it('has no top while the shell banner takes the status bar strip', () => {
-    expect(pageSafeAreaInsets({ insets: WINDOW, keyboardInset: 0, topCovered: true })).toEqual({
-      ...WINDOW,
-      top: 0
-    })
+    expect(pageSafeAreaInsets({ insets: WINDOW, topCovered: true })).toEqual({ ...WINDOW, top: 0 })
   })
 })
diff --git a/mobile/src/mobile-web-shell/page-safe-area-insets.ts b/mobile/src/mobile-web-shell/page-safe-area-insets.ts
index 3b9666baca95..71da590370b1 100644
--- a/mobile/src/mobile-web-shell/page-safe-area-insets.ts
+++ b/mobile/src/mobile-web-shell/page-safe-area-insets.ts
@@ -4,26 +4,24 @@ import type { BridgeSafeAreaInsets } from './bridge/bridge-safe-area-insets'
 /**
  * The part of an edge-to-edge WebView that sits under a system bar, which is what the page pads for.
  *
- * Not the window's insets as they are: with the keyboard up the shell already ends the view at the
- * keyboard's top, so nothing of the page is under the gesture bar, and a banner the shell draws above
- * the view takes the status bar strip itself.
+ * The window's insets, as a native screen reads them with the keyboard covering it, except where
+ * the shell's banner stands above the view and takes the status bar strip itself.
  */
 export function pageSafeAreaInsets(input: {
   insets: BridgeSafeAreaInsets
-  keyboardInset: number
   topCovered: boolean
 }): BridgeSafeAreaInsets {
   const { insets } = input
   return {
     top: input.topCovered ? 0 : insets.top,
     right: insets.right,
-    bottom: input.keyboardInset > 0 ? 0 : insets.bottom,
+    bottom: insets.bottom,
     left: insets.left
   }
 }
 
-/** Hands moved insets to the page over the re-sent `init` a pane move takes: the keyboard, a
- *  rotation, or the shell's banner. Keyed on the four numbers, so a render moves nothing. */
+/** Hands moved insets to the page over the re-sent `init` a pane move takes: a rotation or the
+ *  shell's banner. Keyed on the four numbers, so a render moves nothing. */
 export function usePublishedSafeAreaInsets(
   publish: (insets: BridgeSafeAreaInsets) => void,
   insets: BridgeSafeAreaInsets
diff --git a/mobile/src/mobile-web-shell/shell-older-page-paths-census.test.ts b/mobile/src/mobile-web-shell/shell-older-page-paths-census.test.ts
new file mode 100644
index 000000000000..a1d40ccf49a1
--- /dev/null
+++ b/mobile/src/mobile-web-shell/shell-older-page-paths-census.test.ts
@@ -0,0 +1,89 @@
+/**
+ * The shell serves no page older than its floor (`MOBILE_WEB_PAGE_VERSION_FLOOR`), so it keeps no
+ * path for one: no negotiated `accepts`/`reports`, and no WebView resized for the keyboard. The
+ * retired names are listed so a reintroduction goes red.
+ */
+import { readFileSync } from 'node:fs'
+import { join, relative } from 'node:path'
+import { describe, expect, it } from 'vitest'
+import { censusSourceFiles } from '../test-support/census-source-files'
+
+const MOBILE_DIR = join(import.meta.dirname, '..', '..')
+const SHELL_DIR = import.meta.dirname
+const RETIRED = new RegExp(
+  [
+    'softwareKeyboardWindowInset',
+    'viewShortenedBy',
+    'pageReadsKeyboardInset',
+    'shellPageReadsKeyboardInset',
+    'shellKeyboardGeometry',
+    'BRIDGE_KEYBOARD_INSET_ACCEPT',
+    'BRIDGE_ROUTE_UPDATE_ACCEPT',
+    'BRIDGE_SAFE_AREA_ACCEPT',
+    'BRIDGE_PAGE_CLIENT_IDENTITY_ACCEPT',
+    'BRIDGE_SHELL_ACCEPTS',
+    'BRIDGE_MAX_PAGE_ACCEPTS',
+    'pageReportsPaint',
+    'pageOwnsSafeArea',
+    'shellPageOwnsSafeArea',
+    'shellAccepts',
+    'PageReadyDeclaration',
+    "'keyboard-inset'",
+    "'route-update'",
+    "'safe-area-insets'",
+    "'page-client-identity'"
+  ].join('|')
+)
+/** The negotiated fields themselves, in code: a `ready` or `init` declaring what it takes or reports. */
+const NEGOTIATED_FIELD = /\.(accepts|reports)\b|\b(accepts|reports)\??:/
+const COMMENT = /^\s*(\/\/|\*|\/\*)/
+const KEYBOARD_SIZES_VIEW = /\b(padding|margin)?(Bottom|bottom|height|Height)\s*:[^,}\n]*keyboard/i
+
+/** Lines that bring back a path for an older page, or size the view from the keyboard. */
+export function olderPagePaths(source: string, inShell: boolean): number[] {
+  return source
+    .split('\n')
+    .flatMap((line, index) =>
+      RETIRED.test(line) ||
+      (inShell &&
+        ((NEGOTIATED_FIELD.test(line) && !COMMENT.test(line)) || KEYBOARD_SIZES_VIEW.test(line)))
+        ? [index + 1]
+        : []
+    )
+}
+
+function sources(dir: string): string[] {
+  return censusSourceFiles(dir).filter(
+    (file) => /\.tsx?$/.test(file) && !/\.test\.tsx?$/.test(file)
+  )
+}
+
+describe('the shell and a page older than its floor', () => {
+  it('finds the lines it is looking for', () => {
+    expect(olderPagePaths('style={{ paddingBottom: keyboardInset }}', true)).toEqual([1])
+    expect(olderPagePaths("accepts.includes('keyboard-inset')", false)).toEqual([1])
+    expect(olderPagePaths('if (accepts.includes(BRIDGE_SAFE_AREA_ACCEPT)) {', false)).toEqual([1])
+    expect(olderPagePaths('    accepts: z.array(z.string()).optional(),', true)).toEqual([1])
+    expect(olderPagePaths('return message.reports ?? []', true)).toEqual([1])
+    expect(olderPagePaths('session.pageOwnsSafeArea', false)).toEqual([1])
+    expect(
+      olderPagePaths('{ paddingTop: insets.top, paddingBottom: insets.bottom }', true)
+    ).toEqual([])
+    expect(olderPagePaths('publishKeyboardInset(keyboardInset)', true)).toEqual([])
+    // The field rule is the shell's code: elsewhere, and in prose, `accepts` is an ordinary word.
+    expect(olderPagePaths('gate.accepts(byteCount)', false)).toEqual([])
+    expect(olderPagePaths('    // the answer is what the caller reports: a page', true)).toEqual([])
+  })
+
+  it('keeps no path for one anywhere in the app or the page entry', () => {
+    const offenders = [
+      ...sources(join(MOBILE_DIR, 'src')),
+      ...sources(join(MOBILE_DIR, 'web-entry'))
+    ].flatMap((file) =>
+      olderPagePaths(readFileSync(file, 'utf8'), file.startsWith(SHELL_DIR)).map(
+        (line) => `${relative(MOBILE_DIR, file)}:${line}`
+      )
+    )
+    expect(offenders).toEqual([])
+  })
+})
diff --git a/mobile/src/mobile-web-shell/shell-page-frame.test.ts b/mobile/src/mobile-web-shell/shell-page-frame.test.ts
index 243f5763d771..8c4d7b5b6d87 100644
--- a/mobile/src/mobile-web-shell/shell-page-frame.test.ts
+++ b/mobile/src/mobile-web-shell/shell-page-frame.test.ts
@@ -1,5 +1,4 @@
 import { describe, expect, it } from 'vitest'
-import { BRIDGE_PAGE_PAINTED } from './bridge/bridge-page-painted'
 import type { MobileWebShellSessionState } from './mobile-web-shell-session-contract'
 import { shellPageFrame } from './shell-page-frame'
 
@@ -12,18 +11,8 @@ const READY: MobileWebShellSessionState = {
   elapsedMs: 1
 }
 
-function frame(patch: {
-  state?: MobileWebShellSessionState
-  pageReady?: boolean
-  pageReportsPaint?: boolean
-  pagePainted?: boolean
-}) {
-  return shellPageFrame({
-    state: patch.state ?? READY,
-    pageReady: patch.pageReady ?? false,
-    pageReportsPaint: patch.pageReportsPaint ?? false,
-    pagePainted: patch.pagePainted ?? false
-  })
+function frame(patch: { state?: MobileWebShellSessionState; pagePainted?: boolean }) {
+  return shellPageFrame({ state: patch.state ?? READY, pagePainted: patch.pagePainted ?? false })
 }
 
 describe('how long the shell keeps its own frame up', () => {
@@ -38,33 +27,13 @@ describe('how long the shell keeps its own frame up', () => {
     }
   })
 
-  it('covers a mounted view that has said nothing, which is the whole of the page boot', () => {
+  it('covers a mounted view until the page reports a frame, handshake or not', () => {
+    // `ready` is posted before the tree is built, so the view is mounted, empty and showing the
+    // surface behind it for every frame between the two.
     expect(frame({})).toBe('unpainted')
   })
 
-  it('keeps covering a page that has handshaken and not yet painted', () => {
-    // The gap this exists for: `ready` is posted before the tree is built, so the view is mounted,
-    // empty and showing the surface behind it for every frame between the two.
-    expect(frame({ pageReady: true, pageReportsPaint: true })).toBe('unpainted')
-  })
-
-  it('new shell, new page: uncovers on the page reporting a frame', () => {
-    expect(frame({ pageReady: true, pageReportsPaint: true, pagePainted: true })).toBe('painted')
-  })
-
-  it('new shell, old page: uncovers on ready, the newest word that page will ever say', () => {
-    // A generation served by a desktop built before the report exists. Waiting on a frame it
-    // cannot send would hide a working workspace for the life of the document.
-    expect(frame({ pageReady: true, pageReportsPaint: false })).toBe('painted')
-  })
-
-  it('reads the declaration off the list the page sent, not off the shell', () => {
-    // The name is what the page puts in `ready.reports`, so the frame follows that list and not a
-    // flag the shell set: a list without it is a page whose newest word is `ready`.
-    const declared = [BRIDGE_PAGE_PAINTED].includes(BRIDGE_PAGE_PAINTED)
-    expect(frame({ pageReady: true, pageReportsPaint: declared })).toBe('unpainted')
-    expect(
-      frame({ pageReady: true, pageReportsPaint: ['other'].includes(BRIDGE_PAGE_PAINTED) })
-    ).toBe('painted')
+  it('uncovers on the page reporting a frame', () => {
+    expect(frame({ pagePainted: true })).toBe('painted')
   })
 })
diff --git a/mobile/src/mobile-web-shell/shell-page-frame.ts b/mobile/src/mobile-web-shell/shell-page-frame.ts
index 02d870a0f489..45094d9d0a0b 100644
--- a/mobile/src/mobile-web-shell/shell-page-frame.ts
+++ b/mobile/src/mobile-web-shell/shell-page-frame.ts
@@ -7,19 +7,12 @@ import type { MobileWebShellSession } from './mobile-web-shell-session-contract'
  */
 export type ShellPageFrame = 'pending' | 'unpainted' | 'painted'
 
-/**
- * Bounded by the page's declaration, never by a timer. A page that declared none is one served by
- * a desktop older than the report, and `ready` is the newest thing it will ever say: waiting on a
- * word it cannot speak would hide a working workspace for the life of the document.
- */
+/** Up until the page reports a frame of its own; every page the shell serves reports one. */
 export function shellPageFrame(
-  session: Pick<MobileWebShellSession, 'state' | 'pageReady' | 'pageReportsPaint' | 'pagePainted'>
+  session: Pick<MobileWebShellSession, 'state' | 'pagePainted'>
 ): ShellPageFrame {
   if (session.state.kind !== 'ready') {
     return 'pending'
   }
-  if (session.pagePainted) {
-    return 'painted'
-  }
-  return session.pageReportsPaint || !session.pageReady ? 'unpainted' : 'painted'
+  return session.pagePainted ? 'painted' : 'unpainted'
 }
diff --git a/mobile/src/mobile-web-shell/shell-view-keyboard-accessory.test.ts b/mobile/src/mobile-web-shell/shell-view-keyboard-accessory.test.ts
new file mode 100644
index 000000000000..56e542fd40a0
--- /dev/null
+++ b/mobile/src/mobile-web-shell/shell-view-keyboard-accessory.test.ts
@@ -0,0 +1,31 @@
+import { describe, expect, it } from 'vitest'
+import { readFileSync } from 'node:fs'
+import { join } from 'node:path'
+
+/**
+ * The iOS shell's keyboard, read off the Swift view: a property of a live WKWebView, so what is
+ * checkable here is that the view installs the fix, and the simulator proof measures its effect.
+ *
+ * iPhone 17 simulator, measured: WKWebView's form accessory bar (up, down, done) rides on the
+ * keyboard, and the keyboard event's height counts it, so the page's terminal lifted 376 pt against
+ * native's 274 and its dock stood 52 pt above the bar.
+ */
+const SHELL = join(import.meta.dirname, '..', '..', 'modules', 'orca-mobile-web-shell', 'ios')
+
+describe("the iOS WebView's keyboard", () => {
+  it('carries no form accessory bar, so the keyboard is the height a native screen reads', () => {
+    const view = readFileSync(join(SHELL, 'MobileWebShellView.swift'), 'utf8')
+    expect(view).toContain('hideKeyboardAccessoryBar(of: webView)')
+    const accessory = readFileSync(join(SHELL, 'MobileWebShellKeyboardAccessory.swift'), 'utf8')
+    expect(accessory).toContain('inputAccessoryView')
+  })
+
+  it('does not scroll the page to reveal a focused field, which the page lifts itself', () => {
+    // iPhone 17 simulator: focusing the page's commit message scrolled the whole document up, the
+    // header off screen and the bar 384 pt above the keyboard (shot ios-43).
+    const view = readFileSync(join(SHELL, 'MobileWebShellView.swift'), 'utf8')
+    expect(view).toContain('ignoreKeyboardNotifications(in: webView)')
+    const accessory = readFileSync(join(SHELL, 'MobileWebShellKeyboardAccessory.swift'), 'utf8')
+    expect(accessory).toContain('keyboardWillChangeFrameNotification')
+  })
+})
diff --git a/mobile/src/mobile-web-shell/use-mobile-web-shell-bridge.test.ts b/mobile/src/mobile-web-shell/use-mobile-web-shell-bridge.test.ts
index 82ed511a2234..67bc07fba2c5 100644
--- a/mobile/src/mobile-web-shell/use-mobile-web-shell-bridge.test.ts
+++ b/mobile/src/mobile-web-shell/use-mobile-web-shell-bridge.test.ts
@@ -151,6 +151,7 @@ function Harness(props: {
     // Built inline on every render, as a caller writes it: the host is not rebuilt for it.
     route: { pathname: '/h/host-1' },
     safeAreaInsets: { top: 0, right: 0, bottom: 0, left: 0 },
+    keyboardInset: 0,
     pageRoutes: ['/h/[hostId]'],
     pageRouteGrants: [{ pathname: '/h/[hostId]', grants: ['navigate', 'storage'] }],
     routeGrants: [
@@ -338,7 +339,7 @@ describe('the bridge channel', () => {
 
   it("hands the page's first paint to the caller that owns the cover over the view", async () => {
     const mounted = await mount(readyState('session-one'))
-    await mounted.deliver(clientFrame({ type: 'ready', reports: [BRIDGE_PAGE_PAINTED] }))
+    await mounted.deliver(clientFrame({ type: 'ready' }))
     expect(mounted.probe.paints).toBe(0)
     await mounted.deliver(clientFrame({ type: 'notify', name: BRIDGE_PAGE_PAINTED }))
     expect(mounted.probe.paints).toBe(1)
@@ -657,13 +658,13 @@ describe('client changes', () => {
    *
    * A client swapped under a live page is not a new document: the WebView stays mounted, the
    * session id does not move, and the page neither handshakes again nor hears that anything
-   * happened. What it declared and what it is holding therefore belong to the session, the way
+   * happened. What it is holding therefore belongs to the session, the way
    * `sessionEstablished` already does — a rebuilt host that started over would answer every press
    * with "I cannot deliver this" and pop the screen out from under an open sheet.
    */
   it('keeps delivering Back to an open sheet after the host is rebuilt under it', async () => {
     const mounted = await mount(readyState('session-one'))
-    await mounted.deliver(clientFrame({ type: 'ready', accepts: [BRIDGE_BACK_FRAME] }))
+    await mounted.deliver(clientFrame({ type: 'ready' }))
     await mounted.deliver(
       clientFrame({ type: 'notify', name: BRIDGE_BACK_CLAIM_NOTIFY, claimed: true })
     )
@@ -681,47 +682,17 @@ describe('client changes', () => {
     expect(mounted.frames('session-one').slice(before)).toEqual([{ v: 1, type: BRIDGE_BACK_FRAME }])
   })
 
-  /** The other half of the same seed: a page that never said it takes a press is still one the
-   *  rebuilt host will not send to. An empty declaration is a declaration. */
-  it('sends nothing after a rebuild to a page that never declared the frame', async () => {
-    const mounted = await mount(readyState('session-one'))
-    await mounted.deliver(clientFrame({ type: 'ready' }))
-    doubles.client = createFakeRpcClient()
-    await mounted.update(readyState('session-one'))
-    const before = mounted.frames('session-one').length
-    expect(mounted.probe.view?.sendBack()).toBe(false)
-    expect(mounted.frames('session-one')).toHaveLength(before)
-  })
-
-  /** The seed is the session's, not the hook's. A different session id is a different document,
-   *  which has declared nothing and is holding nothing until it says so itself. */
-  it('carries nothing into a host built for a different session', async () => {
-    // Both mounts stand for an established session, so the rebuilt host's own pre-handshake gate
-    // is already open and the declaration is the only thing left that can refuse the press.
-    const mounted = await mount(readyState('session-one'), true)
-    await mounted.deliver(clientFrame({ type: 'ready', accepts: [BRIDGE_BACK_FRAME] }))
-    await mounted.deliver(
-      clientFrame({ type: 'notify', name: BRIDGE_BACK_CLAIM_NOTIFY, claimed: true })
-    )
-    // The control: the same rebuild inside the session does keep delivering.
-    doubles.client = createFakeRpcClient()
-    await mounted.update(readyState('session-one'))
-    expect(mounted.probe.view?.sendBack()).toBe(true)
-    await mounted.update(readyState('session-two'))
-    expect(mounted.probe.view?.sendBack()).toBe(false)
-  })
-
   /** A new document inside the same session still starts over: its own `ready` is what the host
    *  reads, and the seed is not a latch. */
   it('drops the carried claim when the next document says ready', async () => {
     const mounted = await mount(readyState('session-one'))
-    await mounted.deliver(clientFrame({ type: 'ready', accepts: [BRIDGE_BACK_FRAME] }))
+    await mounted.deliver(clientFrame({ type: 'ready' }))
     await mounted.deliver(
       clientFrame({ type: 'notify', name: BRIDGE_BACK_CLAIM_NOTIFY, claimed: true })
     )
     doubles.client = createFakeRpcClient()
     await mounted.update(readyState('session-one'))
-    await mounted.deliver(clientFrame({ type: 'ready', accepts: [BRIDGE_BACK_FRAME] }))
+    await mounted.deliver(clientFrame({ type: 'ready' }))
     expect(mounted.probe.backClaims).toEqual([true, false])
   })
 
diff --git a/mobile/src/mobile-web-shell/use-mobile-web-shell-bridge.ts b/mobile/src/mobile-web-shell/use-mobile-web-shell-bridge.ts
index 2489e1ef564c..3a55096ac32b 100644
--- a/mobile/src/mobile-web-shell/use-mobile-web-shell-bridge.ts
+++ b/mobile/src/mobile-web-shell/use-mobile-web-shell-bridge.ts
@@ -14,10 +14,7 @@ import type { BridgeSessionBack } from './bridge-host-back'
 import type { BridgeNavigateBackOutcome } from './bridge-host-contract'
 import type { BridgeNativeVerb } from './bridge/bridge-native-verbs'
 import type { BridgeErrorCapture } from './bridge/bridge-error-capture'
-import type {
-  MobileWebShellSessionState,
-  PageReadyDeclaration
-} from './mobile-web-shell-session-contract'
+import type { MobileWebShellSessionState } from './mobile-web-shell-session-contract'
 import type { PageHostSnapshot } from './use-page-host-snapshot'
 import type { PageStorageForInit } from './page-storage-keys'
 
@@ -62,6 +59,8 @@ export type MobileWebShellBridgeView = {
   readonly publishRoute: (route: BridgeInitRoute) => void
   /** Hands the mounted host moved safe-area insets; dropped with no host, as a route is. */
   readonly publishSafeAreaInsets: (insets: BridgeSafeAreaInsets) => void
+  /** Hands the mounted host a moved keyboard height; dropped with no host, as the insets are. */
+  readonly publishKeyboardInset: (height: number) => void
   /**
    * Hands the mounted host one Back press. False when there is no host, or when the document it
    * serves never said it takes one — the caller then leaves the key to the navigator.
@@ -86,6 +85,8 @@ export type MobileWebShellBridgeArgs = {
   route: BridgeInitRoute
   /** What the first `init` of a new host carries; later moves go through `publishSafeAreaInsets`. */
   safeAreaInsets: BridgeSafeAreaInsets
+  /** What the first `init` of a new host carries; later moves go through `publishKeyboardInset`. */
+  keyboardInset: number
   /** The route patterns the page keeps for itself; everything else comes back as `navigate`. */
   pageRoutes: readonly string[]
   pageRouteGrants: readonly { pathname: string; grants: readonly string[] }[]
@@ -113,10 +114,9 @@ export type MobileWebShellBridgeArgs = {
   onStorageWrite: (key: string, value: string | null) => void
   /** The page could not render the generation on screen. Reported, never recovered from here. */
   onPageFault: (error: BridgeErrorCapture) => void
-  /** The page asked for a session, and what it declared it reports. Reported so the screen can
-   *  stop waiting for it, and so it knows whether a paint report is coming. */
-  onPageReady: (ready: PageReadyDeclaration) => void
-  /** The page has a frame on screen, from a page that said it would report one. */
+  /** The page asked for a session. Reported so the screen can stop waiting for it. */
+  onPageReady: () => void
+  /** The page has a frame on screen. */
   onPagePainted: () => void
   /** The page is holding the device Back key, or has let it go. False arrives on its own for
    *  every way a document ends, so no claim outlives the page that made it. */
@@ -195,6 +195,7 @@ export function useMobileWebShellBridge(args: MobileWebShellBridgeArgs): MobileW
       sessionId,
       route: latest.route,
       safeAreaInsets: latest.safeAreaInsets,
+      keyboardInset: latest.keyboardInset,
       pageRoutes: latest.pageRoutes,
       pageRouteGrants: latest.pageRouteGrants,
       routeGrants: latest.routeGrants,
@@ -222,7 +223,7 @@ export function useMobileWebShellBridge(args: MobileWebShellBridgeArgs): MobileW
       onRouteParamClear: (param, value) => argsRef.current.onRouteParamClear(param, value),
       onRouteRefused: (issue) => argsRef.current.onRouteRefused(issue),
       onBinaryFramesDropped: (total) => argsRef.current.onBinaryFramesDropped(total),
-      onPageReady: (ready) => argsRef.current.onPageReady(ready),
+      onPageReady: () => argsRef.current.onPageReady(),
       onPagePainted: () => argsRef.current.onPagePainted(),
       onPageBackClaim: (claimed) => argsRef.current.onPageBackClaim(claimed)
     })
@@ -283,6 +284,15 @@ export function useMobileWebShellBridge(args: MobileWebShellBridgeArgs): MobileW
       },
       [buildId, client, sessionId, snapshot]
     ),
+    publishKeyboardInset: useCallback(
+      (height: number) => {
+        const mounted = hostRef.current
+        if (mounted !== null && mounted.sessionId === sessionId) {
+          mounted.host.publishKeyboardInset(height)
+        }
+      },
+      [buildId, client, sessionId, snapshot]
+    ),
     // Fenced on the session the way inbound frames are, and answering false rather than throwing
     // when there is no host: the caller is a hardware key handler, and a press it cannot forward
     // is one the navigator has to be left to answer.
diff --git a/mobile/src/mobile-web-shell/use-mobile-web-shell-session.test.ts b/mobile/src/mobile-web-shell/use-mobile-web-shell-session.test.ts
index 0787874b441f..f9ab64437887 100644
--- a/mobile/src/mobile-web-shell/use-mobile-web-shell-session.test.ts
+++ b/mobile/src/mobile-web-shell/use-mobile-web-shell-session.test.ts
@@ -41,6 +41,7 @@ const doubles = vi.hoisted((): Doubles => {
     buildId: 'b'.repeat(64),
     minCompatibleRuntimeProtocolVersion: 2,
     runtimeProtocolVersion: 5,
+    pageVersion: 1,
     entrypoint: 'index.html',
     totalBytes: 2048,
     assets: [
@@ -210,7 +211,7 @@ type Mounted = {
   /** Whether the page had spoken, as every render of the hook reported it. */
   handshakes: () => readonly boolean[]
   documentLoaded: () => void
-  pageReady: (reports?: readonly string[]) => void
+  pageReady: () => void
   timers: ReturnType<typeof createTimerSeam>
 }
 
@@ -219,7 +220,7 @@ async function mount(store: GenerationStore): Promise<Mounted> {
   const handle: {
     retry: () => void
     documentLoaded: () => void
-    pageReady: (ready: { reports: readonly string[]; accepts: readonly string[] }) => void
+    pageReady: () => void
     states: MobileWebShellSessionState[]
     handshakes: boolean[]
   } = {
@@ -262,7 +263,7 @@ async function mount(store: GenerationStore): Promise<Mounted> {
     states: () => handle.states,
     handshakes: () => handle.handshakes,
     documentLoaded: () => handle.documentLoaded(),
-    pageReady: (reports: readonly string[] = []) => handle.pageReady({ reports, accepts: [] }),
+    pageReady: () => handle.pageReady(),
     timers
   }
 }
diff --git a/mobile/src/mobile-web-shell/use-mobile-web-shell-session.ts b/mobile/src/mobile-web-shell/use-mobile-web-shell-session.ts
index da22cd69a2e2..57eea752065e 100644
--- a/mobile/src/mobile-web-shell/use-mobile-web-shell-session.ts
+++ b/mobile/src/mobile-web-shell/use-mobile-web-shell-session.ts
@@ -21,10 +21,8 @@ import type {
   MobileWebShellSessionEffect,
   MobileWebShellSessionEvent,
   MobileWebShellSessionState,
-  MobileWebShellUpdateNotice,
-  PageReadyDeclaration
+  MobileWebShellUpdateNotice
 } from './mobile-web-shell-session-contract'
-import { shellPageOwnsSafeArea } from './page-document-state'
 
 export type MobileWebShellSessionView = {
   readonly state: MobileWebShellSessionState
@@ -42,10 +40,9 @@ export type MobileWebShellSessionView = {
   readonly reportDocumentStarted: () => void
   /** The native view finished a document; starts the wait for the page's first word. */
   readonly reportDocumentLoaded: () => void
-  /** The page spoke over the bridge; ends that wait, whichever of the two arrived first. Carries
-   *  what that `ready` declared it reports, which is what says whether a paint is coming. */
-  readonly reportPageReady: (ready: PageReadyDeclaration) => void
-  /** The page has a frame on screen. Ignored for a page that never said it would report one. */
+  /** The page spoke over the bridge; ends that wait, whichever of the two arrived first. */
+  readonly reportPageReady: () => void
+  /** The page has a frame on screen. */
   readonly reportPagePainted: () => void
   /** The page took the device Back key, or let it go. */
   readonly reportPageBackClaim: (claimed: boolean) => void
@@ -62,9 +59,6 @@ export type MobileWebShellSessionView = {
   /** Whether the shell should take Back off the navigator. Projected for the same reason as
    *  `pageReady`: a claim moves nothing else, so no other value would re-render to carry it. */
   readonly backClaimed: boolean
-  /** Whether the document on screen pads for the system bars itself. Projected for the same
-   *  reason as `backClaimed`. */
-  readonly pageOwnsSafeArea: boolean
 }
 
 /**
@@ -95,9 +89,6 @@ export function useMobileWebShellSession(args: {
   const [pageReady, setPageReady] = useState(sessionRef.current.pageReady)
   const [pageFrame, setPageFrame] = useState(() => shellPageFrame(sessionRef.current))
   const [backClaimed, setBackClaimed] = useState(() => shellPageBackClaimed(sessionRef.current))
-  const [pageOwnsSafeArea, setPageOwnsSafeArea] = useState(() =>
-    shellPageOwnsSafeArea(sessionRef.current)
-  )
   const hostKey = useMemo(() => deriveHostCacheKey(hostId), [hostId])
   const startedAtRef = useRef(runtime.now())
   // Bumped by anything that invalidates work in flight; every dispatch out of an effect checks it.
@@ -121,7 +112,6 @@ export function useMobileWebShellSession(args: {
     setPageReady(stepped.session.pageReady)
     setPageFrame(shellPageFrame(stepped.session))
     setBackClaimed(shellPageBackClaimed(stepped.session))
-    setPageOwnsSafeArea(shellPageOwnsSafeArea(stepped.session))
     for (const effect of stepped.effects) {
       // Every effect of a step belongs to the flow that step produced, and its result carries that
       // number back, so a flow the session has since restarted reports into nothing.
@@ -281,12 +271,9 @@ export function useMobileWebShellSession(args: {
     dispatch(epochRef.current, { type: 'document-loaded' })
   }, [dispatch])
 
-  const reportPageReady = useCallback(
-    (ready: PageReadyDeclaration) => {
-      dispatch(epochRef.current, { type: 'page-ready', ...ready })
-    },
-    [dispatch]
-  )
+  const reportPageReady = useCallback(() => {
+    dispatch(epochRef.current, { type: 'page-ready' })
+  }, [dispatch])
 
   const reportPagePainted = useCallback(() => {
     dispatch(epochRef.current, { type: 'page-painted' })
@@ -314,7 +301,6 @@ export function useMobileWebShellSession(args: {
     reportPageReady,
     reportPagePainted,
     reportPageBackClaim,
-    backClaimed,
-    pageOwnsSafeArea
+    backClaimed
   }
 }
diff --git a/mobile/src/mobile-web-shell/use-shell-page-back.ts b/mobile/src/mobile-web-shell/use-shell-page-back.ts
index dd1ac0ac7b1c..ecf8f145f208 100644
--- a/mobile/src/mobile-web-shell/use-shell-page-back.ts
+++ b/mobile/src/mobile-web-shell/use-shell-page-back.ts
@@ -9,7 +9,7 @@ import { BackHandler, Platform } from 'react-native'
  * and posted; iOS has none, so what is taken away is the stack's swipe-back gesture — a swipe while
  * a sheet is open would leave the screen with the sheet still on it.
  *
- * Nothing is registered without a live claim, so a page too old to make one, a shell whose page has
+ * Nothing is registered without a live claim, so a page holding nothing, a shell whose page has
  * faulted, and a session between documents all keep today's behaviour: the navigator pops.
  */
 export function useShellPageBack(args: {
diff --git a/mobile/src/platform/host-os.ts b/mobile/src/platform/host-os.ts
new file mode 100644
index 000000000000..da58fbe0d1ec
--- /dev/null
+++ b/mobile/src/platform/host-os.ts
@@ -0,0 +1,8 @@
+import { Platform } from 'react-native'
+
+/** The OS a screen's keyboard and inset arithmetic is for. Natively, the one it runs on. */
+export type HostOs = 'ios' | 'android' | 'windows' | 'macos' | 'web'
+
+export function hostOs(): HostOs {
+  return Platform.OS
+}
diff --git a/mobile/src/platform/host-os.web.test.ts b/mobile/src/platform/host-os.web.test.ts
new file mode 100644
index 000000000000..fcc3d446f36b
--- /dev/null
+++ b/mobile/src/platform/host-os.web.test.ts
@@ -0,0 +1,38 @@
+// @vitest-environment happy-dom
+import { afterEach, describe, expect, it } from 'vitest'
+import { hostOs } from './host-os.web'
+
+function agent(userAgent: string, platform = '', maxTouchPoints = 0) {
+  Object.defineProperty(navigator, 'userAgent', { value: userAgent, configurable: true })
+  Object.defineProperty(navigator, 'platform', { value: platform, configurable: true })
+  Object.defineProperty(navigator, 'maxTouchPoints', { value: maxTouchPoints, configurable: true })
+}
+
+afterEach(() => agent(''))
+
+describe("the page's host OS", () => {
+  it('reads the phone off the WebView user agent', () => {
+    agent(
+      'Mozilla/5.0 (iPhone; CPU iPhone OS 26_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148'
+    )
+    expect(hostOs()).toBe('ios')
+    agent(
+      'Mozilla/5.0 (Linux; Android 17; sdk_gphone64_arm64 Build/CP1A; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/144.0 Mobile Safari/537.36'
+    )
+    expect(hostOs()).toBe('android')
+  })
+
+  it('reads an iPad that still names itself in the user agent', () => {
+    agent(
+      'Mozilla/5.0 (iPad; CPU OS 18_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148'
+    )
+    expect(hostOs()).toBe('ios')
+  })
+
+  it('takes an iPad, which reports a Mac, by its touch points', () => {
+    agent('Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15', 'MacIntel', 5)
+    expect(hostOs()).toBe('ios')
+    agent('Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15', 'MacIntel', 0)
+    expect(hostOs()).toBe('web')
+  })
+})
diff --git a/mobile/src/platform/host-os.web.ts b/mobile/src/platform/host-os.web.ts
new file mode 100644
index 000000000000..755cf3a2ace1
--- /dev/null
+++ b/mobile/src/platform/host-os.web.ts
@@ -0,0 +1,19 @@
+import type { HostOs } from './host-os'
+
+export type { HostOs } from './host-os'
+
+/**
+ * Web sibling: `Platform.OS` is `web` inside the shell's page, but the keyboard it lifts over is the
+ * phone's, whose height the shell reports in that OS's own terms. So the page answers the phone's
+ * OS from the WebView's user agent. iPadOS reports a Mac, which only its touch points give away.
+ */
+export function hostOs(): HostOs {
+  const agent = globalThis.navigator?.userAgent ?? ''
+  if (/iP(ad|hone|od)/.test(agent)) {
+    return 'ios'
+  }
+  if (globalThis.navigator?.platform === 'MacIntel' && globalThis.navigator.maxTouchPoints > 1) {
+    return 'ios'
+  }
+  return agent.includes('Android') ? 'android' : 'web'
+}
diff --git a/mobile/src/platform/keyboard-geometry-host-os-census.test.ts b/mobile/src/platform/keyboard-geometry-host-os-census.test.ts
new file mode 100644
index 000000000000..81b7259395dc
--- /dev/null
+++ b/mobile/src/platform/keyboard-geometry-host-os-census.test.ts
@@ -0,0 +1,69 @@
+/**
+ * Keyboard and inset arithmetic branches on the host OS, never on `Platform.OS`.
+ *
+ * The page runs as `web` while the keyboard it lifts over is the phone's, reported in that OS's own
+ * terms (iOS counts the home indicator). A `Platform.OS === 'ios'` there takes the Android branch on
+ * an iPhone page: measured on the iPhone 17 simulator, the terminal lifted 34 pt past native.
+ */
+import { readFileSync } from 'node:fs'
+import { relative } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { describe, expect, it } from 'vitest'
+import { censusSourceFiles } from '../test-support/census-source-files'
+
+const MOBILE_DIR = fileURLToPath(new URL('../../', import.meta.url))
+const GEOMETRY =
+  /keyboardHeight|keyboardLift|keyboardInset|bottomInset|insets\.bottom|KeyboardAvoidingView|keyboard(Will|Did)(Show|Hide)/
+
+const KEYBOARD_READ =
+  /keyboardHeight|keyboardLift|keyboardInset|useKeyboardOcclusion|useSoftKeyboard/
+const KEYBOARD_IMPORT = /from '[^']*(keyboard|inset)[^']*'/i
+const KEYBOARD_FILE = /(keyboard|inset|drawer|lift)[^/]*$/i
+const COMMENT = /^\s*(\/\/|\*|\/\*)/
+
+/**
+ * `Platform.OS` reads near keyboard or inset arithmetic, or anywhere in a file that reads the keyboard,
+ * imports a keyboard/inset module or is named for one: a live-input reopen flag four lines from its
+ * keyboard height escaped the proximity rule alone. Comments are not reads.
+ */
+export function platformReadsInGeometry(source: string, file = ''): number[] {
+  const lines = source.split('\n')
+  const wholeFile =
+    KEYBOARD_READ.test(source) || KEYBOARD_IMPORT.test(source) || KEYBOARD_FILE.test(file)
+  return lines.flatMap((line, index) =>
+    line.includes('Platform.OS') &&
+    !COMMENT.test(line) &&
+    (wholeFile ||
+      lines.slice(Math.max(0, index - 2), index + 3).some((near) => GEOMETRY.test(near)))
+      ? [index + 1]
+      : []
+  )
+}
+
+function files(): string[] {
+  return ['src', 'app'].flatMap((dir) =>
+    censusSourceFiles(fileURLToPath(new URL(`../../${dir}/`, import.meta.url))).filter(
+      (file) => /\.tsx?$/.test(file) && !/\.test\.tsx?$/.test(file) && !file.endsWith('host-os.ts')
+    )
+  )
+}
+
+describe('keyboard and inset arithmetic', () => {
+  it('finds the reads it is looking for', () => {
+    expect(
+      platformReadsInGeometry("const lift = Platform.OS === 'ios' ? keyboardHeight - 1 : 0")
+    ).toEqual([1])
+    expect(
+      platformReadsInGeometry("keyboardType={Platform.OS === 'ios' ? 'url' : 'default'}")
+    ).toEqual([])
+  })
+
+  it('reads the host OS, never Platform.OS', () => {
+    const offenders = files().flatMap((file) =>
+      platformReadsInGeometry(readFileSync(file, 'utf8'), file).map(
+        (line) => `${relative(MOBILE_DIR, file)}:${line}`
+      )
+    )
+    expect(offenders).toEqual([])
+  })
+})
diff --git a/mobile/src/platform/keyboard-geometry-owner-census.test.ts b/mobile/src/platform/keyboard-geometry-owner-census.test.ts
index 25c90d0d1eeb..b3bee07b5f49 100644
--- a/mobile/src/platform/keyboard-geometry-owner-census.test.ts
+++ b/mobile/src/platform/keyboard-geometry-owner-census.test.ts
@@ -15,8 +15,8 @@ const MOBILE_DIR = fileURLToPath(new URL('../../', import.meta.url))
 const SRC_DIR = fileURLToPath(new URL('../', import.meta.url))
 
 const SEAM = 'src/platform/keyboard-occlusion.ts'
-/** A one-shot "open after the keyboard hides" with a timer fallback; it subscribes only while the
- *  seam reports a keyboard, which on the page is never, so there it cannot wait forever. */
+/** A one-shot "open after the keyboard hides" with a timer fallback; on the page, where the event
+ *  never fires, the timer is what opens the sheet, so it cannot wait forever. */
 const TAB_SHEET_AFTER_HIDE = 'src/session/use-mobile-session-terminal-send-actions.ts'
 
 const asksKeyboard = (line: string): boolean =>
diff --git a/mobile/src/platform/keyboard-occlusion.test.tsx b/mobile/src/platform/keyboard-occlusion.test.tsx
index 526da87f12dd..c388c775de2d 100644
--- a/mobile/src/platform/keyboard-occlusion.test.tsx
+++ b/mobile/src/platform/keyboard-occlusion.test.tsx
@@ -47,14 +47,12 @@ vi.mock('react-native', () => ({
 import {
   currentSoftKeyboardHeight,
   subscribeSoftKeyboard,
-  useKeyboardAvoidingPadding,
   useKeyboardOcclusion,
   useSoftKeyboard,
   type SoftKeyboardState
 } from './keyboard-occlusion'
 
 let lift = 0
-let padding = 0
 let keyboardState: SoftKeyboardState = { height: 0, visible: false }
 
 function Harness(): null {
@@ -62,12 +60,6 @@ function Harness(): null {
   return null
 }
 
-/** Separate, so the padding case measures the padding hook's own subscriptions and nothing else. */
-function PaddingHarness(): null {
-  padding = useKeyboardAvoidingPadding()
-  return null
-}
-
 function StateHarness(): null {
   keyboardState = useSoftKeyboard()
   return null
@@ -94,7 +86,6 @@ describe('the keyboard the phone reports', () => {
     keyboard.addListenerCalls = 0
     keyboard.metrics = undefined
     lift = 0
-    padding = 0
     keyboardState = { height: 0, visible: false }
   })
 
@@ -137,17 +128,6 @@ describe('the keyboard the phone reports', () => {
     expect(keyboard.removed.sort()).toEqual(['keyboardWillHide', 'keyboardWillShow'])
   })
 
-  it('asks a phone for no composer padding, because KeyboardAvoidingView already moved it', async () => {
-    // Rendered, not called: a hook read outside a component measures whatever the module does at
-    // the top of its body and nothing its effects do, which is where a subscription would live.
-    // And it subscribes to nothing doing it, so a composer that calls this renders as often as it
-    // does today — which is what makes adding the call to a shared component safe.
-    await mountComponent(PaddingHarness)
-    expect(padding).toBe(0)
-    expect(keyboard.addListenerCalls).toBe(0)
-    expect(keyboard.listeners.size).toBe(0)
-  })
-
   it('answers both facts from one subscription, so a screen wanting each pays for one', async () => {
     // The session screen reads the height to lift its dock and the flag to hold off the terminal
     // refit. Two hooks would mean two listener pairs and two renders per keyboard event.
diff --git a/mobile/src/platform/keyboard-occlusion.ts b/mobile/src/platform/keyboard-occlusion.ts
index 6b0fc0deb2b5..aa952871d984 100644
--- a/mobile/src/platform/keyboard-occlusion.ts
+++ b/mobile/src/platform/keyboard-occlusion.ts
@@ -1,5 +1,6 @@
 import { useEffect, useState } from 'react'
-import { Keyboard, Platform } from 'react-native'
+import { Keyboard } from 'react-native'
+import { hostOs } from './host-os'
 
 /** How much of the bottom of the layout viewport it covers, and whether it is open at all. */
 export type SoftKeyboardState = { readonly height: number; readonly visible: boolean }
@@ -44,8 +45,8 @@ export function subscribeSoftKeyboard(
   onShow: (height: number, duration: number) => void,
   onHide: (duration: number) => void
 ): () => void {
-  const showEvent = Platform.OS === 'ios' ? 'keyboardWillShow' : 'keyboardDidShow'
-  const hideEvent = Platform.OS === 'ios' ? 'keyboardWillHide' : 'keyboardDidHide'
+  const showEvent = hostOs() === 'ios' ? 'keyboardWillShow' : 'keyboardDidShow'
+  const hideEvent = hostOs() === 'ios' ? 'keyboardWillHide' : 'keyboardDidHide'
   const show = Keyboard.addListener(showEvent, (event) =>
     onShow(event.endCoordinates.height, event.duration)
   )
@@ -68,17 +69,3 @@ export function currentSoftKeyboardHeight(): number {
 export function useKeyboardOcclusion(): number {
   return useSoftKeyboard().height
 }
-
-/**
- * The bottom padding a composer needs to clear the keyboard, which natively is none.
- *
- * `KeyboardAvoidingView` already moves the composer on a phone, so adding padding there would move
- * it twice. It is inert on the web for the same reason the `Keyboard` stub is — it is driven by
- * those events — so there the padding is the whole of the avoidance.
- *
- * A second name rather than a `Platform.OS` branch at the call site: this one subscribes to nothing
- * on a phone, so a composer that asks for it renders exactly as many times as it does today.
- */
-export function useKeyboardAvoidingPadding(): number {
-  return 0
-}
diff --git a/mobile/src/platform/keyboard-occlusion.web.test.tsx b/mobile/src/platform/keyboard-occlusion.web.test.tsx
index 11e96afff8fa..b6bae0e85476 100644
--- a/mobile/src/platform/keyboard-occlusion.web.test.tsx
+++ b/mobile/src/platform/keyboard-occlusion.web.test.tsx
@@ -5,9 +5,9 @@ import { afterEach, beforeEach, describe, expect, it } from 'vitest'
 import {
   currentSoftKeyboardHeight,
   subscribeSoftKeyboard,
-  useKeyboardAvoidingPadding,
   useKeyboardOcclusion,
   useSoftKeyboard,
+  publishShellKeyboardSource,
   type SoftKeyboardState
 } from './keyboard-occlusion.web'
 
@@ -62,11 +62,9 @@ class FakeVisualViewport extends EventTarget {
 const LAYOUT_HEIGHT = 800
 let viewport: FakeVisualViewport | null = null
 let lift = 0
-let padding = 0
 
 function Harness(): null {
   lift = useKeyboardOcclusion()
-  padding = useKeyboardAvoidingPadding()
   return null
 }
 
@@ -83,7 +81,6 @@ async function mount(): Promise<ReturnType<typeof create>> {
 
 beforeEach(() => {
   lift = 0
-  padding = 0
   viewport = new FakeVisualViewport(LAYOUT_HEIGHT)
   Object.defineProperty(window, 'innerHeight', { value: LAYOUT_HEIGHT, configurable: true })
   Object.defineProperty(window, 'visualViewport', { value: viewport, configurable: true })
@@ -189,15 +186,9 @@ describe('the keyboard the browser reports', () => {
     expect(lift).toBe(0)
   })
 
-  it('is the whole of the avoidance here, where KeyboardAvoidingView is inert', async () => {
-    await mount()
-    await act(async () => viewport?.resizeTo(464))
-    expect(padding).toBe(336)
-  })
-
   it('removes both listeners on unmount', async () => {
     const tree = await mount()
-    expect(viewport?.counts).toEqual({ resize: 2, scroll: 2 })
+    expect(viewport?.counts).toEqual({ resize: 1, scroll: 1 })
     await act(async () => tree.unmount())
     expect(viewport?.counts).toEqual({ resize: 0, scroll: 0 })
   })
@@ -237,7 +228,7 @@ describe('the keyboard as events, for a sheet', () => {
     expect(lift).toBe(0)
   })
 
-  it('stays silent when nothing is covered, which is the shell shortening the WebView', () => {
+  it('stays silent while the visual viewport covers nothing', () => {
     const calls: string[] = []
     const unsubscribe = subscribeSoftKeyboard(
       () => calls.push('show'),
@@ -262,7 +253,6 @@ describe('the keyboard as events, for a sheet', () => {
   })
 })
 
-const LAYOUT_WIDTH = 400
 let keyboardState: SoftKeyboardState = { height: 0, visible: false }
 
 function StateHarness(): null {
@@ -270,16 +260,6 @@ function StateHarness(): null {
   return null
 }
 
-function resizeWindow(width: number, height: number): void {
-  Object.defineProperty(window, 'innerWidth', { value: width, configurable: true })
-  Object.defineProperty(window, 'innerHeight', { value: height, configurable: true })
-  window.dispatchEvent(new Event('resize'))
-}
-
-/** Tracked so a case that resizes the window is not also re-rendering an earlier case's harness,
- *  which shares this file's one `keyboardState`. */
-const mountedStateHarnesses: ReturnType<typeof create>[] = []
-
 async function mountState(): Promise<ReturnType<typeof create>> {
   let tree: ReturnType<typeof create> | null = null
   await act(async () => {
@@ -288,65 +268,102 @@ async function mountState(): Promise<ReturnType<typeof create>> {
   if (tree === null) {
     throw new Error('the harness did not mount')
   }
-  mountedStateHarnesses.push(tree)
   return tree
 }
 
-/**
- * The shell shortens the WebView to sit above the IME, so by the time the page measures itself
- * nothing is covered and `visualViewport` reads full height. The resize is what is left.
- */
-describe('the keyboard the page cannot see, because the shell already moved it', () => {
-  beforeEach(() => {
-    act(() => {
-      for (const tree of mountedStateHarnesses.splice(0)) {
-        tree.unmount()
+/** The shell's side of the bridge, as the entry publishes it: the height `init` last carried. */
+function createShellKeyboard(initial = 0) {
+  let height = initial
+  const listeners = new Set<(height: number) => void>()
+  return {
+    source: {
+      read: () => height,
+      subscribe: (listener: (height: number) => void) => {
+        listeners.add(listener)
+        return () => {
+          listeners.delete(listener)
+        }
       }
-    })
-    keyboardState = { height: 0, visible: false }
-    Object.defineProperty(window, 'innerWidth', { value: LAYOUT_WIDTH, configurable: true })
-    Object.defineProperty(window, 'innerHeight', { value: LAYOUT_HEIGHT, configurable: true })
-  })
+    },
+    move: (next: number) => {
+      height = next
+      for (const listener of listeners) {
+        listener(next)
+      }
+    },
+    listenerCount: () => listeners.size
+  }
+}
 
-  it('reads no keyboard while the window keeps the height it mounted at', async () => {
-    await mountState()
+describe('the state a native screen reads, from the browser outside the shell', () => {
+  it('is open exactly while something is covered', async () => {
+    const tree = await mountState()
     expect(keyboardState).toEqual({ height: 0, visible: false })
+    await act(async () => viewport?.resizeTo(464))
+    expect(keyboardState).toEqual({ height: 336, visible: true })
+    await act(async () => viewport?.resizeTo(LAYOUT_HEIGHT))
+    expect(keyboardState).toEqual({ height: 0, visible: false })
+    await act(async () => tree.unmount())
   })
+})
 
-  it('calls the window shortened at an unchanged width the keyboard, and covers nothing by it', async () => {
-    await mountState()
-    await act(async () => resizeWindow(LAYOUT_WIDTH, LAYOUT_HEIGHT - 336))
-    expect(keyboardState).toEqual({ height: 0, visible: true })
-  })
-
-  it('drops the flag when the window gets its height back', async () => {
-    await mountState()
-    await act(async () => resizeWindow(LAYOUT_WIDTH, LAYOUT_HEIGHT - 336))
-    await act(async () => resizeWindow(LAYOUT_WIDTH, LAYOUT_HEIGHT))
-    expect(keyboardState.visible).toBe(false)
-  })
-
-  it('reads a rotation as a new window rather than a keyboard, because the width moved too', async () => {
-    await mountState()
-    await act(async () => resizeWindow(LAYOUT_HEIGHT, LAYOUT_WIDTH))
-    expect(keyboardState.visible).toBe(false)
-    // And the shorter window is now the one the next keyboard is measured against.
-    await act(async () => resizeWindow(LAYOUT_HEIGHT, LAYOUT_WIDTH - 200))
-    expect(keyboardState.visible).toBe(true)
+/**
+ * Inside the shell the keyboard covers the page as it covers a native screen, but the page cannot
+ * measure it: the WebView's IME insets are zeroed, so `visualViewport` never moves. The shell says
+ * the height over the bridge, and every reader here answers from that.
+ */
+describe('the keyboard the shell says covers the page', () => {
+  afterEach(() => {
+    publishShellKeyboardSource(null)
   })
 
-  it('takes a window that grew as the new resting height, not as a keyboard closing twice', async () => {
-    await mountState()
-    await act(async () => resizeWindow(LAYOUT_WIDTH, LAYOUT_HEIGHT + 60))
-    expect(keyboardState.visible).toBe(false)
-    await act(async () => resizeWindow(LAYOUT_WIDTH, LAYOUT_HEIGHT))
-    expect(keyboardState.visible).toBe(true)
+  it('answers the height the shell sent, and ignores the visual viewport', async () => {
+    const shell = createShellKeyboard()
+    publishShellKeyboardSource(shell.source)
+    const tree = await mountState()
+    const lifted = await mount()
+    // Pixel_API_37: the IME opens at 312 and the suggestion strip grows it to 346.
+    for (const height of [312, 346]) {
+      await act(async () => shell.move(height))
+      expect(keyboardState).toEqual({ height, visible: true })
+      expect(lift).toBe(height)
+    }
+    await act(async () => viewport?.resizeTo(464))
+    expect(keyboardState.height).toBe(346)
+    await act(async () => shell.move(0))
+    expect(keyboardState).toEqual({ height: 0, visible: false })
+    expect(lift).toBe(0)
+    await act(async () => {
+      tree.unmount()
+      lifted.unmount()
+    })
+    expect(shell.listenerCount()).toBe(0)
   })
 
-  it('stops listening on unmount', async () => {
+  it('reads a keyboard already up at mount, which the shell sent in the first init', async () => {
+    publishShellKeyboardSource(createShellKeyboard(312).source)
+    expect(currentSoftKeyboardHeight()).toBe(312)
     const tree = await mountState()
+    expect(keyboardState).toEqual({ height: 312, visible: true })
     await act(async () => tree.unmount())
-    await act(async () => resizeWindow(LAYOUT_WIDTH, LAYOUT_HEIGHT - 336))
-    expect(keyboardState.visible).toBe(false)
+  })
+
+  it('hands a sheet each height as a show and the close as one hide', () => {
+    const shell = createShellKeyboard()
+    publishShellKeyboardSource(shell.source)
+    const calls: string[] = []
+    const unsubscribe = subscribeSoftKeyboard(
+      (height, duration) => calls.push(`show ${height} ${duration}`),
+      (duration) => calls.push(`hide ${duration}`)
+    )
+    viewport?.resizeTo(464)
+    shell.move(312)
+    shell.move(346)
+    shell.move(0)
+    shell.move(0)
+    expect(calls).toEqual(['show 312 0', 'show 346 0', 'hide 0'])
+    unsubscribe()
+    expect(shell.listenerCount()).toBe(0)
+    expect(viewport?.counts).toEqual({ resize: 0, scroll: 0 })
   })
 })
diff --git a/mobile/src/platform/keyboard-occlusion.web.ts b/mobile/src/platform/keyboard-occlusion.web.ts
index 05500f369ee0..c157f24cb4cd 100644
--- a/mobile/src/platform/keyboard-occlusion.web.ts
+++ b/mobile/src/platform/keyboard-occlusion.web.ts
@@ -1,7 +1,24 @@
 import { useEffect, useState } from 'react'
 
+/** The height the shell last said over the bridge, and a way to hear it move. */
+export type ShellKeyboardSource = {
+  read: () => number
+  subscribe: (listener: (height: number) => void) => () => void
+}
+
+let shellKeyboard: ShellKeyboardSource | null = null
+
+/**
+ * Called once by the page entry. Inside the shell the keyboard covers the page as it covers a
+ * native screen, but the WebView's IME insets are zeroed, so `visualViewport` never moves: the
+ * shell is the only thing that knows the height, and every reader below answers from it.
+ */
+export function publishShellKeyboardSource(source: ShellKeyboardSource | null): void {
+  shellKeyboard = source
+}
+
 /**
- * Web sibling: the keyboard's height as the browser reports it, which is not as an event.
+ * Outside the shell: the keyboard's height as the browser reports it, which is not as an event.
  *
  * react-native-web's `Keyboard` is a stub whose `addListener` returns a subscription that never
  * fires, so every screen waiting for `keyboardDidShow` inside the shell's page waits forever and
@@ -48,21 +65,15 @@ function visualViewport(): VisualViewport | undefined {
 }
 
 /**
- * The strip as events, with duration 0: the browser has already moved the viewport by the time it
- * says so. Inside the shell nothing fires, because the shell shortens the WebView above the IME and
- * the strip stays 0; in a plain mobile browser the keyboard overlays the page and this is the lift.
+ * The strip as events, with duration 0: the shell and the browser have both moved the keyboard by
+ * the time they say so.
  */
 export function subscribeSoftKeyboard(
   onShow: (height: number, duration: number) => void,
   onHide: (duration: number) => void
 ): () => void {
-  const viewport = visualViewport()
-  if (viewport === undefined) {
-    return () => {}
-  }
-  let open = occlusion(viewport) > 0
-  const read = (): void => {
-    const height = occlusion(viewport)
+  let open = currentSoftKeyboardHeight() > 0
+  const read = (height: number): void => {
     if (height > 0) {
       open = true
       onShow(height, 0)
@@ -71,17 +82,28 @@ export function subscribeSoftKeyboard(
       onHide(0)
     }
   }
-  viewport.addEventListener('resize', read)
-  viewport.addEventListener('scroll', read)
+  if (shellKeyboard !== null) {
+    return shellKeyboard.subscribe(read)
+  }
+  const viewport = visualViewport()
+  if (viewport === undefined) {
+    return () => {}
+  }
+  const measure = (): void => read(occlusion(viewport))
+  viewport.addEventListener('resize', measure)
+  viewport.addEventListener('scroll', measure)
 
   return () => {
-    viewport.removeEventListener('resize', read)
-    viewport.removeEventListener('scroll', read)
+    viewport.removeEventListener('resize', measure)
+    viewport.removeEventListener('scroll', measure)
   }
 }
 
 /** A keyboard already up when a composer opens gets no event at all. */
 export function currentSoftKeyboardHeight(): number {
+  if (shellKeyboard !== null) {
+    return shellKeyboard.read()
+  }
   const viewport = visualViewport()
   return viewport === undefined ? 0 : occlusion(viewport)
 }
@@ -100,50 +122,10 @@ export function useKeyboardOcclusion(): number {
   return keyboardLift
 }
 
-/**
- * On the web the padding is the whole of the avoidance: `KeyboardAvoidingView` is driven by the
- * `Keyboard` events this file exists because the page never receives.
- */
-export function useKeyboardAvoidingPadding(): number {
-  return useKeyboardOcclusion()
-}
-
-/** The sibling's shape; the two facts it answers together are measured separately here. */
+/** The sibling's shape. Open is a covered strip here: neither source reports a keyboard of 0. */
 export type SoftKeyboardState = { readonly height: number; readonly visible: boolean }
 
-/**
- * Whether a keyboard is open, which here is not what it covers: the shell shortens the WebView to
- * sit above the IME, so nothing covers the page and the occlusion above reads 0, correctly. The
- * resize is what is left of the keyboard — inside the shell's WebView the shell's own bottom
- * padding is the one thing that changes this window's height without changing its width too.
- */
-function useShortenedWindow(): boolean {
-  const [shortened, setShortened] = useState(false)
-
-  useEffect(() => {
-    // The tallest height seen at this width is the resting one; a width change is a rotation or a
-    // fold, which starts the comparison again. A page that mounts with the keyboard already up
-    // reads false until it closes once, which costs one terminal refit and no correctness.
-    let width = window.innerWidth
-    let tallest = window.innerHeight
-    const read = (): void => {
-      if (window.innerWidth !== width) {
-        width = window.innerWidth
-        tallest = window.innerHeight
-      } else if (window.innerHeight > tallest) {
-        tallest = window.innerHeight
-      }
-      setShortened(window.innerHeight < tallest)
-    }
-    read()
-    window.addEventListener('resize', read)
-
-    return () => window.removeEventListener('resize', read)
-  }, [])
-
-  return shortened
-}
-
 export function useSoftKeyboard(): SoftKeyboardState {
-  return { height: useKeyboardOcclusion(), visible: useShortenedWindow() }
+  const height = useKeyboardOcclusion()
+  return { height, visible: height > 0 }
 }
diff --git a/mobile/src/platform/keyboard-persisting-taps.ts b/mobile/src/platform/keyboard-persisting-taps.ts
new file mode 100644
index 000000000000..77185a5f2b33
--- /dev/null
+++ b/mobile/src/platform/keyboard-persisting-taps.ts
@@ -0,0 +1,6 @@
+export type KeyboardPersistingTaps = 'always' | 'handled'
+
+/** Natively a Pressable never takes focus; the ScrollView's `keyboardShouldPersistTaps` is the rule. */
+export function useKeyboardPersistingTaps(_mode: KeyboardPersistingTaps): undefined {
+  return undefined
+}
diff --git a/mobile/src/platform/keyboard-persisting-taps.web.test.ts b/mobile/src/platform/keyboard-persisting-taps.web.test.ts
new file mode 100644
index 000000000000..9bea438b4050
--- /dev/null
+++ b/mobile/src/platform/keyboard-persisting-taps.web.test.ts
@@ -0,0 +1,87 @@
+// @vitest-environment happy-dom
+/**
+ * The page's form of `keyboardShouldPersistTaps`, which react-native-web ignores.
+ *
+ * Measured on Pixel_API_37: a tap on a dock key or a session tab moves focus from the live input
+ * to the Pressable (tabindex 0) on mousedown, and the IME closes. Natively a Pressable never takes
+ * focus, so the same taps keep the keyboard up.
+ */
+import { afterEach, describe, expect, it } from 'vitest'
+import { keepTextFocusThroughTaps } from './keyboard-persisting-taps.web'
+
+function plant() {
+  const container = document.createElement('div')
+  const button = document.createElement('div')
+  button.tabIndex = 0
+  const label = document.createElement('span')
+  button.appendChild(label)
+  const gap = document.createElement('span')
+  const field = document.createElement('input')
+  container.append(button, gap, field)
+  const liveInput = document.createElement('input')
+  document.body.append(container, liveInput)
+  return { container, label, gap, field, liveInput }
+}
+
+/** Whether a mousedown on `target` was kept from moving focus. */
+function pressKeepsFocus(target: Element): boolean {
+  const event = new MouseEvent('mousedown', { bubbles: true, cancelable: true })
+  target.dispatchEvent(event)
+  return event.defaultPrevented
+}
+
+afterEach(() => {
+  document.body.innerHTML = ''
+})
+
+describe('keepTextFocusThroughTaps', () => {
+  it("keeps a text field's focus through a tap on a pressable, in both modes", () => {
+    for (const mode of ['always', 'handled'] as const) {
+      const { container, label, liveInput } = plant()
+      const release = keepTextFocusThroughTaps(container, mode)
+      liveInput.focus()
+      expect(pressKeepsFocus(label), mode).toBe(true)
+      release()
+      document.body.innerHTML = ''
+    }
+  })
+
+  it('lets a tap on nothing pressable dismiss only when taps are handled', () => {
+    const always = plant()
+    keepTextFocusThroughTaps(always.container, 'always')
+    always.liveInput.focus()
+    expect(pressKeepsFocus(always.gap)).toBe(true)
+    document.body.innerHTML = ''
+
+    const handled = plant()
+    keepTextFocusThroughTaps(handled.container, 'handled')
+    handled.liveInput.focus()
+    expect(pressKeepsFocus(handled.gap)).toBe(false)
+  })
+
+  it('leaves focus alone when no text field holds it, or when the tap is on a text field', () => {
+    const { container, label, field, liveInput } = plant()
+    keepTextFocusThroughTaps(container, 'always')
+    expect(pressKeepsFocus(label)).toBe(false)
+    liveInput.focus()
+    expect(pressKeepsFocus(field)).toBe(false)
+  })
+
+  it('does not count a focusable ancestor above the container as a pressable in the bar', () => {
+    const outer = document.createElement('div')
+    outer.tabIndex = 0
+    const { container, gap, liveInput } = plant()
+    outer.append(container)
+    document.body.prepend(outer)
+    keepTextFocusThroughTaps(container, 'handled')
+    liveInput.focus()
+    expect(pressKeepsFocus(gap)).toBe(false)
+  })
+
+  it('stops when released', () => {
+    const { container, label, liveInput } = plant()
+    keepTextFocusThroughTaps(container, 'always')()
+    liveInput.focus()
+    expect(pressKeepsFocus(label)).toBe(false)
+  })
+})
diff --git a/mobile/src/platform/keyboard-persisting-taps.web.ts b/mobile/src/platform/keyboard-persisting-taps.web.ts
new file mode 100644
index 000000000000..ae05cf0355f5
--- /dev/null
+++ b/mobile/src/platform/keyboard-persisting-taps.web.ts
@@ -0,0 +1,56 @@
+import { useCallback, useRef } from 'react'
+import type { KeyboardPersistingTaps } from './keyboard-persisting-taps'
+
+export type { KeyboardPersistingTaps } from './keyboard-persisting-taps'
+
+function isTextField(element: Element | null): boolean {
+  if (!(element instanceof HTMLElement)) {
+    return false
+  }
+  return (
+    element instanceof HTMLInputElement ||
+    element instanceof HTMLTextAreaElement ||
+    element.isContentEditable
+  )
+}
+
+/** A focusable element between the tap and the container; an ancestor above it is not in the bar. */
+function isPressableInside(container: HTMLElement, target: Element): boolean {
+  const pressable = target.closest('[tabindex]:not([tabindex="-1"])')
+  return pressable !== null && pressable !== container && container.contains(pressable)
+}
+
+/**
+ * `keyboardShouldPersistTaps` for the page: react-native-web ignores it, and a Pressable there is a
+ * focusable element that takes focus on mousedown, which blurs the text field and closes the IME.
+ * `handled` keeps focus only for a tap on something pressable; `always` for any tap.
+ */
+export function keepTextFocusThroughTaps(
+  container: HTMLElement,
+  mode: KeyboardPersistingTaps
+): () => void {
+  const onMouseDown = (event: MouseEvent) => {
+    const target = event.target instanceof Element ? event.target : null
+    if (!isTextField(document.activeElement) || !target || isTextField(target)) {
+      return
+    }
+    if (mode === 'handled' && !isPressableInside(container, target)) {
+      return
+    }
+    event.preventDefault()
+  }
+  container.addEventListener('mousedown', onMouseDown, true)
+  return () => container.removeEventListener('mousedown', onMouseDown, true)
+}
+
+/** A ref for the View that holds the taps; on the page that View is its DOM element. */
+export function useKeyboardPersistingTaps(mode: KeyboardPersistingTaps) {
+  const releaseRef = useRef<(() => void) | null>(null)
+  return useCallback(
+    (node: unknown) => {
+      releaseRef.current?.()
+      releaseRef.current = node instanceof HTMLElement ? keepTextFocusThroughTaps(node, mode) : null
+    },
+    [mode]
+  )
+}
diff --git a/mobile/src/platform/live-input-composing-range.test.ts b/mobile/src/platform/live-input-composing-range.test.ts
new file mode 100644
index 000000000000..f056f03e8379
--- /dev/null
+++ b/mobile/src/platform/live-input-composing-range.test.ts
@@ -0,0 +1,44 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { reportedLiveInputComposing } from './live-input-composing-range'
+import { reportedLiveInputComposing as reportedPageLiveInputComposing } from './live-input-composing-range.web'
+
+const ANDROID_WEBVIEW = 'Mozilla/5.0 (Linux; Android 16; wv) Chrome/140'
+const IPHONE_WEBVIEW = 'Mozilla/5.0 (iPhone; CPU iPhone OS 19_0 like Mac OS X) AppleWebKit/605.1.15'
+
+describe('the composing range a live input reports', () => {
+  afterEach(() => {
+    vi.unstubAllGlobals()
+  })
+
+  it('passes the native event through, whatever the user agent says', () => {
+    vi.stubGlobal('navigator', { userAgent: ANDROID_WEBVIEW })
+    expect([true, false, undefined].map(reportedLiveInputComposing)).toEqual([
+      true,
+      false,
+      undefined
+    ])
+  })
+
+  it('reports no range in an Android WebView, as native Android does', () => {
+    vi.stubGlobal('navigator', { userAgent: ANDROID_WEBVIEW })
+    expect([true, false, undefined].map(reportedPageLiveInputComposing)).toEqual([
+      undefined,
+      undefined,
+      undefined
+    ])
+  })
+
+  it("passes the DOM's range through in any other browser", () => {
+    vi.stubGlobal('navigator', { userAgent: IPHONE_WEBVIEW })
+    expect([true, false, undefined].map(reportedPageLiveInputComposing)).toEqual([
+      true,
+      false,
+      undefined
+    ])
+  })
+
+  it('passes the range through where there is no navigator', () => {
+    vi.stubGlobal('navigator', undefined)
+    expect(reportedPageLiveInputComposing(true)).toBe(true)
+  })
+})
diff --git a/mobile/src/platform/live-input-composing-range.ts b/mobile/src/platform/live-input-composing-range.ts
new file mode 100644
index 000000000000..99835eed7d64
--- /dev/null
+++ b/mobile/src/platform/live-input-composing-range.ts
@@ -0,0 +1,7 @@
+/**
+ * The marked-text range a live input's change event reports, as the host's text system means it.
+ * Native passes the event's own through: iOS reports its range, React Native Android reports none.
+ */
+export function reportedLiveInputComposing(isComposing: boolean | undefined): boolean | undefined {
+  return isComposing
+}
diff --git a/mobile/src/platform/live-input-composing-range.web.ts b/mobile/src/platform/live-input-composing-range.web.ts
new file mode 100644
index 000000000000..61b46a3096e6
--- /dev/null
+++ b/mobile/src/platform/live-input-composing-range.web.ts
@@ -0,0 +1,11 @@
+/**
+ * Web sibling: the event is the DOM's, so its `isComposing` passes through except in an Android
+ * WebView, which reports none, as native Android does.
+ */
+export function reportedLiveInputComposing(isComposing: boolean | undefined): boolean | undefined {
+  // Why: Android keyboards compose every Latin word, so the DOM's range would hold each one unsent.
+  if (globalThis.navigator?.userAgent?.includes('Android')) {
+    return undefined
+  }
+  return isComposing
+}
diff --git a/mobile/src/platform/software-keyboard-window-inset.test.ts b/mobile/src/platform/software-keyboard-window-inset.test.ts
deleted file mode 100644
index b458993d0eaa..000000000000
--- a/mobile/src/platform/software-keyboard-window-inset.test.ts
+++ /dev/null
@@ -1,39 +0,0 @@
-import { describe, expect, it } from 'vitest'
-import { softwareKeyboardWindowInset } from './software-keyboard-window-inset'
-
-describe('the strip of the window the software keyboard takes', () => {
-  it('is nothing while the keyboard is closed', () => {
-    expect(
-      softwareKeyboardWindowInset({ keyboardHeight: 0, bottomInset: 48, platform: 'android' })
-    ).toBe(0)
-  })
-
-  it('is the iOS frame height as reported, which already spans the home indicator', () => {
-    expect(
-      softwareKeyboardWindowInset({ keyboardHeight: 336, bottomInset: 34, platform: 'ios' })
-    ).toBe(336)
-  })
-
-  it('adds the navigation bar back on Android, whose IME height stops above it', () => {
-    // The session dock is the proof this split is real: it pads itself by the inset and then
-    // translates by the raw height, which lands on the keys only if Android's excludes the bar.
-    expect(
-      softwareKeyboardWindowInset({ keyboardHeight: 336, bottomInset: 48, platform: 'android' })
-    ).toBe(384)
-  })
-
-  it('takes the page host as a phone, since it is one: the shell runs no web build', () => {
-    expect(
-      softwareKeyboardWindowInset({ keyboardHeight: 300, bottomInset: 20, platform: 'web' })
-    ).toBe(320)
-  })
-
-  it('never reports a negative strip, whatever the event and the inset say', () => {
-    expect(
-      softwareKeyboardWindowInset({ keyboardHeight: -10, bottomInset: 48, platform: 'android' })
-    ).toBe(0)
-    expect(
-      softwareKeyboardWindowInset({ keyboardHeight: 336, bottomInset: -48, platform: 'android' })
-    ).toBe(336)
-  })
-})
diff --git a/mobile/src/platform/software-keyboard-window-inset.ts b/mobile/src/platform/software-keyboard-window-inset.ts
deleted file mode 100644
index 0c15bba7c2a4..000000000000
--- a/mobile/src/platform/software-keyboard-window-inset.ts
+++ /dev/null
@@ -1,17 +0,0 @@
-/**
- * The strip at the bottom of the window the software keyboard takes, for a view that owns the
- * window and has to shorten itself out of the way. The two platforms measure the IME from
- * different edges: iOS's frame height starts at the bottom of the window and already spans the
- * home indicator, Android's starts above the system bars, so only Android adds the bar back.
- */
-export function softwareKeyboardWindowInset(input: {
-  keyboardHeight: number
-  bottomInset: number
-  platform: 'ios' | 'android' | 'windows' | 'macos' | 'web'
-}): number {
-  const keyboardHeight = Math.max(0, input.keyboardHeight)
-  if (keyboardHeight === 0) {
-    return 0
-  }
-  return input.platform === 'ios' ? keyboardHeight : keyboardHeight + Math.max(0, input.bottomInset)
-}
diff --git a/mobile/src/session/MobileNativeChatMessage.tsx b/mobile/src/session/MobileNativeChatMessage.tsx
index 9b480fdd7d90..a290a9991610 100644
--- a/mobile/src/session/MobileNativeChatMessage.tsx
+++ b/mobile/src/session/MobileNativeChatMessage.tsx
@@ -148,7 +148,6 @@ function MobileNativeChatMessageImpl({
       {turnStatus ? (
         <MobileNativeChatTurnStatus
           startedAt={turnStatus.startedAt}
-          thinking={turnStatus.thinking}
           workedSeconds={turnStatus.workedSeconds}
           expanded={turnExpanded ?? false}
           onToggleExpanded={turnKey && onToggleTurn ? () => onToggleTurn(turnKey) : undefined}
diff --git a/mobile/src/session/MobileNativeChatTurnStatus.test.ts b/mobile/src/session/MobileNativeChatTurnStatus.test.ts
index 6b6a1d49e070..e99412b42bf1 100644
--- a/mobile/src/session/MobileNativeChatTurnStatus.test.ts
+++ b/mobile/src/session/MobileNativeChatTurnStatus.test.ts
@@ -19,27 +19,34 @@ vi.mock('react-native', async () => {
 })
 vi.mock('lucide-react-native', () => ({ ChevronRight: 'ChevronRight' }))
 
-import { MobileNativeChatTurnStatus } from './MobileNativeChatTurnStatus'
+import {
+  MobileNativeChatTurnActivity,
+  MobileNativeChatTurnStatus
+} from './MobileNativeChatTurnStatus'
 
-describe('MobileNativeChatTurnStatus', () => {
-  let renderer: ReactTestRenderer | null = null
+const labels = (node: ReactTestInstance): string[] =>
+  node.findAllByType('Text' as never).map((text) => String(text.children.join('')))
 
-  beforeEach(() => {
-    vi.useFakeTimers()
-    vi.setSystemTime(new Date('2026-09-04T00:00:00Z'))
-  })
+const spinners = (node: ReactTestInstance): ReactTestInstance[] =>
+  node.findAllByType('ActivityIndicator' as never)
 
-  afterEach(() => {
-    act(() => renderer?.unmount())
-    renderer = null
-    vi.useRealTimers()
-  })
+let renderer: ReactTestRenderer | null = null
 
+beforeEach(() => {
+  vi.useFakeTimers()
+  vi.setSystemTime(new Date('2026-09-04T00:00:00Z'))
+})
+
+afterEach(() => {
+  act(() => renderer?.unmount())
+  renderer = null
+  vi.useRealTimers()
+})
+
+describe('MobileNativeChatTurnStatus', () => {
   function render(props: {
     startedAt: number | null
-    thinking: boolean
     workedSeconds?: number | null
-    activityText?: string | null
     expanded?: boolean
     onToggleExpanded?: () => void
   }): ReactTestRenderer {
@@ -49,49 +56,19 @@ describe('MobileNativeChatTurnStatus', () => {
     return renderer!
   }
 
-  const labels = (node: ReactTestInstance): string[] =>
-    node.findAllByType('Text' as never).map((text) => String(text.children.join('')))
-
-  const spinners = (node: ReactTestInstance): ReactTestInstance[] =>
-    node.findAllByType('ActivityIndicator' as never)
-
-  it('reads "Thinking" beside one spinner while the turn reasons', () => {
-    const tree = render({ startedAt: Date.now(), thinking: true })
-    expect(labels(tree.root)).toEqual(['Thinking'])
-    expect(spinners(tree.root)).toHaveLength(1)
-  })
-
-  it('counts up on that same single row when the turn is not reasoning', () => {
-    const startedAt = Date.now()
-    const tree = render({ startedAt, thinking: false })
+  it('counts up from the first second while the turn runs, with no spinner', () => {
+    const tree = render({ startedAt: Date.now() })
     expect(labels(tree.root)).toEqual(['Working for 0s'])
     act(() => {
       vi.advanceTimersByTime(12_000)
     })
     expect(labels(tree.root)).toEqual(['Working for 12s'])
-    expect(spinners(tree.root)).toHaveLength(1)
-  })
-
-  it('lets provider activity text beat both fallbacks and hold the clock', () => {
-    const tree = render({
-      startedAt: Date.now(),
-      thinking: true,
-      activityText: 'Running pnpm test'
-    })
-    expect(labels(tree.root)).toEqual(['Running pnpm test'])
-    expect(spinners(tree.root)).toHaveLength(1)
-    // No label consumes the duration, so nothing schedules a tick for it.
-    expect(vi.getTimerCount()).toBe(0)
+    expect(spinners(tree.root)).toHaveLength(0)
   })
 
   it('settles to a tappable "Worked for" row that toggles the turn', () => {
     const onToggleExpanded = vi.fn()
-    const tree = render({
-      startedAt: Date.now(),
-      thinking: false,
-      workedSeconds: 184,
-      onToggleExpanded
-    })
+    const tree = render({ startedAt: Date.now(), workedSeconds: 184, onToggleExpanded })
     expect(labels(tree.root)).toEqual(['Worked for 3m 4s'])
     const button = tree.root.findByType('Pressable' as never)
     expect(button.props.accessibilityLabel).toBe('Toggle turn details')
@@ -101,19 +78,46 @@ describe('MobileNativeChatTurnStatus', () => {
   })
 
   it('stays a plain row when the settled turn has nothing to disclose', () => {
-    const tree = render({ startedAt: Date.now(), thinking: false, workedSeconds: 5 })
+    const tree = render({ startedAt: Date.now(), workedSeconds: 5 })
     expect(tree.root.findAllByType('Pressable' as never)).toHaveLength(0)
     expect(labels(tree.root)).toEqual(['Worked for 5s'])
   })
 
-  it('holds no interval, and no spinner, once the turn has settled', () => {
-    const tree = render({ startedAt: Date.now(), thinking: false, workedSeconds: 5 })
+  it('holds no interval once the turn has settled', () => {
+    render({ startedAt: Date.now(), workedSeconds: 5 })
     expect(vi.getTimerCount()).toBe(0)
-    expect(spinners(tree.root)).toHaveLength(0)
+  })
+})
+
+describe('MobileNativeChatTurnActivity', () => {
+  function render(props: { thinking: boolean; activityText?: string | null }): ReactTestRenderer {
+    act(() => {
+      renderer = create(createElement(MobileNativeChatTurnActivity, props))
+    })
+    return renderer!
+  }
+
+  it('reads "Thinking" beside one spinner while the turn reasons', () => {
+    const tree = render({ thinking: true })
+    expect(labels(tree.root)).toEqual(['Thinking'])
+    expect(spinners(tree.root)).toHaveLength(1)
+  })
+
+  // The bar owns the clock; the tail line never repeats it.
+  it('reads plain "Working…" when the turn is not reasoning, and holds no timer', () => {
+    const tree = render({ thinking: false })
+    expect(labels(tree.root)).toEqual(['Working…'])
+    expect(vi.getTimerCount()).toBe(0)
+  })
+
+  it('lets provider activity text beat both fallbacks', () => {
+    const tree = render({ thinking: true, activityText: 'Running pnpm test' })
+    expect(labels(tree.root)).toEqual(['Running pnpm test'])
+    expect(spinners(tree.root)).toHaveLength(1)
   })
 
-  it('announces the live row to assistive tech', () => {
-    const tree = render({ startedAt: Date.now(), thinking: true })
+  it('announces the live line to assistive tech', () => {
+    const tree = render({ thinking: true })
     const row = tree.root.findByType('View' as never)
     expect(row.props.accessibilityLiveRegion).toBe('polite')
     expect(row.props.accessibilityLabel).toBe('Agent is responding')
diff --git a/mobile/src/session/MobileNativeChatTurnStatus.tsx b/mobile/src/session/MobileNativeChatTurnStatus.tsx
index acf922265f66..250036852409 100644
--- a/mobile/src/session/MobileNativeChatTurnStatus.tsx
+++ b/mobile/src/session/MobileNativeChatTurnStatus.tsx
@@ -26,38 +26,28 @@ function useElapsedSeconds(startedAt: number | null, counting: boolean): number
   return counting ? nativeChatElapsedSeconds(startedAt, mountedAt, now) : 0
 }
 
-/** The per-turn status row. While the turn runs it is the one live indicator — a
- *  spinner beside what the provider says it is doing, else "Thinking", else
- *  "Working for 12s". It settles to a tappable "Worked for 3m 4s" that discloses
- *  the turn's tool activity. Desktop parity: `NativeChatTurnActivityLine` for the
- *  live row, `NativeChatWorkingStatus` for the settled one. */
+/** The turn bar under the user's message: "Working for 12s" while the turn runs,
+ *  settling in place to a tappable "Worked for 3m 4s" that discloses the turn's
+ *  tool activity. Desktop parity: `NativeChatWorkingStatus`. */
 export function MobileNativeChatTurnStatus({
   startedAt,
-  thinking,
   workedSeconds,
-  activityText,
   expanded = false,
   onToggleExpanded
 }: {
   startedAt: number | null
-  thinking: boolean
   workedSeconds?: number | null
-  /** Provider activity copy for a live turn; outranks the other two labels. */
-  activityText?: string | null
   expanded?: boolean
   onToggleExpanded?: () => void
 }): React.JSX.Element {
   const settled = workedSeconds != null
-  const counting = !settled && !thinking && !activityText?.trim()
-  const elapsedSeconds = useElapsedSeconds(startedAt, counting)
-  const label = settled
-    ? formatNativeChatTurnStatusLabel({ thinking, workedSeconds, elapsedSeconds })
-    : formatNativeChatActiveTurnLabel({ activityText, thinking, elapsedSeconds })
+  const elapsedSeconds = useElapsedSeconds(startedAt, !settled)
+  const label = formatNativeChatTurnStatusLabel({ workedSeconds, elapsedSeconds })
 
   if (settled && onToggleExpanded) {
     return (
       <Pressable
-        style={({ pressed }) => [styles.row, styles.rowSettled, pressed && styles.pressed]}
+        style={({ pressed }) => [styles.row, styles.bar, pressed && styles.pressed]}
         onPress={onToggleExpanded}
         hitSlop={6}
         accessibilityRole="button"
@@ -72,15 +62,34 @@ export function MobileNativeChatTurnStatus({
     )
   }
 
+  return (
+    <View style={[styles.row, styles.bar]}>
+      <Text style={styles.label} numberOfLines={1}>
+        {label}
+      </Text>
+    </View>
+  )
+}
+
+/** The live turn's tail line: a spinner beside what the provider says it is doing,
+ *  else "Thinking", else "Working…". The clock stays in the turn bar. Desktop
+ *  parity: `NativeChatTurnActivityLine`. */
+export function MobileNativeChatTurnActivity({
+  thinking,
+  activityText
+}: {
+  thinking: boolean
+  activityText?: string | null
+}): React.JSX.Element {
   return (
     <View
-      style={[styles.row, settled ? styles.rowSettled : null]}
+      style={styles.row}
       accessibilityLiveRegion="polite"
       accessibilityLabel={NATIVE_CHAT_TURN_STATUS_COPY.responding}
     >
-      {settled ? null : <ActivityIndicator size="small" color={colors.textMuted} />}
+      <ActivityIndicator size="small" color={colors.textMuted} />
       <Text style={styles.label} numberOfLines={1}>
-        {label}
+        {formatNativeChatActiveTurnLabel({ activityText, thinking })}
       </Text>
     </View>
   )
@@ -94,7 +103,7 @@ const styles = StyleSheet.create({
     minHeight: 28,
     paddingHorizontal: spacing.md
   },
-  rowSettled: {
+  bar: {
     borderBottomWidth: StyleSheet.hairlineWidth,
     borderBottomColor: colors.borderSubtle
   },
diff --git a/mobile/src/session/MobileNativeChatView.test.ts b/mobile/src/session/MobileNativeChatView.test.ts
index 6b80c3500aed..fa29e13c8c87 100644
--- a/mobile/src/session/MobileNativeChatView.test.ts
+++ b/mobile/src/session/MobileNativeChatView.test.ts
@@ -703,14 +703,14 @@ describe('MobileNativeChatView', () => {
       return renderer!.root.findAll((node) => node.type === 'WorkingIndicator')
     }
 
-    it('puts the live status at the turn tail and drops the three-dot indicator', async () => {
+    it('puts the clock bar under the prompt, activity at the tail, and drops the three dots', async () => {
       const folded = [userTurn('u1', 'go'), assistantTurn('a1', 'still working')]
       await render({ messages: folded, folded, structuredActivityUi: true, agentWorking: true })
       const props = rowProps('u1')
       expect(props.structuredActivityUi).toBe(true)
-      expect(props.turnStatus).toBeNull()
-      // Nothing reports reasoning, so the one live footer counts instead of guessing.
-      expect(footerProps()).toMatchObject({ thinking: false, workedSeconds: null })
+      expect(props.turnStatus).toMatchObject({ workedSeconds: null })
+      // Nothing reports reasoning, so the tail line reads plain working instead of guessing.
+      expect(footerProps()).toEqual({ thinking: false, activityText: null })
       expect(listIds().at(-1)).toBe('a1')
       expect(props.activeTurnIsWorking).toBe(true)
       expect(workingIndicators()).toHaveLength(0)
@@ -778,7 +778,7 @@ describe('MobileNativeChatView', () => {
       expect(renderer!.root.findAll((node) => node.type === testCase.cardType)).toHaveLength(1)
 
       await update(working)
-      expect(footerProps()).toMatchObject({ thinking: false, workedSeconds: null })
+      expect(footerProps()).toMatchObject({ thinking: false })
       expect(rowProps('a1').activeTurnIsWorking).toBe(true)
     })
 
@@ -791,8 +791,8 @@ describe('MobileNativeChatView', () => {
         agentWorking: true,
         turnIndicator: { thinking: true, activityText: null }
       })
-      expect(rowProps('u1').turnStatus).toBeNull()
-      expect(footerProps()).toMatchObject({ thinking: true, workedSeconds: null })
+      expect(rowProps('u1').turnStatus).toMatchObject({ workedSeconds: null })
+      expect(footerProps()).toMatchObject({ thinking: true })
     })
 
     it('hands the live row the provider activity copy that outranks its fallbacks', async () => {
@@ -838,8 +838,8 @@ describe('MobileNativeChatView', () => {
     it('settles the finished turn to a tappable duration', async () => {
       const folded = [userTurn('u1', 'go'), assistantTurn('a1', 'done')]
       await render({ messages: folded, folded, structuredActivityUi: true, agentWorking: true })
-      expect(rowProps('u1').turnStatus).toBeNull()
-      expect(footerProps()).toMatchObject({ thinking: false, workedSeconds: null })
+      expect(rowProps('u1').turnStatus).toMatchObject({ workedSeconds: null })
+      expect(footerProps()).toMatchObject({ thinking: false })
       await update({ messages: folded, folded, structuredActivityUi: true, agentWorking: false })
       const settled = rowProps('u1')
       expect(settled.turnStatus).toMatchObject({ thinking: false })
@@ -857,7 +857,7 @@ describe('MobileNativeChatView', () => {
       expect(rowProps('a1').turnStatus).toBeNull()
       // The assistant row still belongs to the live turn, so its tool row stays visible.
       expect(rowProps('a1').activeTurnIsWorking).toBe(true)
-      expect(footerProps()).toMatchObject({ workedSeconds: null })
+      expect(footerProps()).toMatchObject({ thinking: false })
     })
 
     it('does not carry a running turn clock across chat surfaces', async () => {
@@ -872,7 +872,7 @@ describe('MobileNativeChatView', () => {
           agentWorking: true,
           sendSurfaceId: 'host\0worktree\0tab-a'
         })
-        expect(footerProps()).toMatchObject({ startedAt: 1_000 })
+        expect(rowProps('u1').turnStatus).toMatchObject({ startedAt: 1_000 })
 
         vi.setSystemTime(12_000)
         const secondTab = [userTurn('u2', 'second')]
@@ -884,7 +884,7 @@ describe('MobileNativeChatView', () => {
           sendSurfaceId: 'host\0worktree\0tab-b'
         })
 
-        expect(footerProps()).toMatchObject({ startedAt: 12_000 })
+        expect(rowProps('u2').turnStatus).toMatchObject({ startedAt: 12_000 })
       } finally {
         vi.useRealTimers()
       }
diff --git a/mobile/src/session/MobileNativeChatView.tsx b/mobile/src/session/MobileNativeChatView.tsx
index 6a51601d151a..050a532de3cd 100644
--- a/mobile/src/session/MobileNativeChatView.tsx
+++ b/mobile/src/session/MobileNativeChatView.tsx
@@ -28,7 +28,7 @@ import { useMobileNativeChatPinchGesture } from './use-mobile-native-chat-pinch-
 import { useMobileNativeChatTailFollow } from './use-mobile-native-chat-tail-follow'
 import { useMobileNativeChatTurnDisclosure } from './use-mobile-native-chat-turn-disclosure'
 import { useSettledMobileNativeChatInputLock } from './use-mobile-native-chat-input-lease'
-import { MobileNativeChatTurnStatus } from './MobileNativeChatTurnStatus'
+import { MobileNativeChatTurnActivity } from './MobileNativeChatTurnStatus'
 import { MobileAgentWorkingIndicator } from './MobileAgentWorkingIndicator'
 import type { PendingNativeChatImage } from './mobile-native-chat-image-attachment'
 import { MobileNativeChatComposer } from './MobileNativeChatComposer'
@@ -338,10 +338,8 @@ export function MobileNativeChatView({
                 agentWorking &&
                 !hasPendingStructuredInteraction &&
                 turns.active ? (
-                  <MobileNativeChatTurnStatus
-                    startedAt={turns.active.startedAt}
+                  <MobileNativeChatTurnActivity
                     thinking={turns.active.thinking}
-                    workedSeconds={turns.active.workedSeconds}
                     activityText={turns.activeActivityText}
                   />
                 ) : null
diff --git a/mobile/src/session/MobileSessionActiveContent.tsx b/mobile/src/session/MobileSessionActiveContent.tsx
index 83cabe1c372d..9c4f0eb313fe 100644
--- a/mobile/src/session/MobileSessionActiveContent.tsx
+++ b/mobile/src/session/MobileSessionActiveContent.tsx
@@ -32,8 +32,6 @@ export function MobileSessionActiveContent({
     setShowCreateTabDrawer,
     dictationMode,
     toastMessage,
-    terminalFrameHeightRef,
-    setTerminalFrameWidth,
     handleTerminalTap,
     browserScreencastSupported,
     showToast,
@@ -53,9 +51,10 @@ export function MobileSessionActiveContent({
     copyMarkdownLocalContent,
     discardMarkdownLocalContent,
     saveMarkdownTab,
-    notifyTerminalFrameHeight,
     setTerminalWebViewRef,
     handleTerminalWebReady,
+    notifyTerminalFrame,
+    notifyTerminalCellBoxChange,
     handleFileTap,
     handleNativeChatFileTap,
     handleTerminalOpenUrl,
@@ -81,7 +80,7 @@ export function MobileSessionActiveContent({
     toastAnimatedStyle,
     createTabBusy
   } = controller
-  return showLoadingState ? (
+  const content = showLoadingState ? (
     <View style={styles.emptyState}>
       <ActivityIndicator size="small" color={colors.textSecondary} />
     </View>
@@ -192,19 +191,7 @@ export function MobileSessionActiveContent({
       )}
     </View>
   ) : (
-    <View
-      // Why: react-native-web observes onLayout only on a View that mounts with it; unkeyed, this reuses the loading View and never reports.
-      key="terminal-frame"
-      style={styles.terminalFrame}
-      onLayout={(e) => {
-        terminalFrameHeightRef.current = e.nativeEvent.layout.height
-        // Why: notify height imperatively so dock settling re-fits the PTY without rerendering SessionScreen.
-        const nextWidth = Math.round(e.nativeEvent.layout.width)
-        const nextHeight = Math.round(e.nativeEvent.layout.height)
-        setTerminalFrameWidth((prev) => (prev === nextWidth ? prev : nextWidth))
-        notifyTerminalFrameHeight(nextHeight)
-      }}
-    >
+    <View style={styles.terminalFrame}>
       {terminals.map((terminal) => (
         <TerminalPaneView
           key={terminal.handle}
@@ -220,6 +207,7 @@ export function MobileSessionActiveContent({
           }}
           onRef={setTerminalWebViewRef}
           onWebReady={handleTerminalWebReady}
+          onCellBoxChange={notifyTerminalCellBoxChange}
           onSelectionMode={handleSelectionMode}
           onSelectionCopy={handleSelectionCopy}
           onSelectionEvicted={handleSelectionEvicted}
@@ -256,4 +244,16 @@ export function MobileSessionActiveContent({
       )}
     </View>
   )
+  return (
+    <View
+      // Why: one frame under every branch; react-native-web observes onLayout only on a View that mounts with it.
+      style={styles.contentFrame}
+      onLayout={(e) => {
+        const { width, height } = e.nativeEvent.layout
+        notifyTerminalFrame({ width, height })
+      }}
+    >
+      {content}
+    </View>
+  )
 }
diff --git a/mobile/src/session/MobileSessionCommandDock.tsx b/mobile/src/session/MobileSessionCommandDock.tsx
index ed12bb6e51a1..87b46246572f 100644
--- a/mobile/src/session/MobileSessionCommandDock.tsx
+++ b/mobile/src/session/MobileSessionCommandDock.tsx
@@ -1,4 +1,5 @@
-import { View, Text, ScrollView, TextInput, Pressable, Platform } from 'react-native'
+import { View, Text, ScrollView, TextInput, Pressable } from 'react-native'
+import { hostOs } from '../platform/host-os'
 import {
   ArrowUp,
   ChevronDown,
@@ -19,6 +20,7 @@ import { MobileTerminalInputActions } from './MobileTerminalInputActions'
 import { isTerminalPhoneDisplayMode } from './mobile-session-route-helpers'
 import { colors } from '../theme/mobile-theme'
 import { styles } from './mobile-session-styles'
+import { useKeyboardPersistingTaps } from '../platform/keyboard-persisting-taps'
 import type { MobileSessionController } from './use-mobile-session-controller'
 
 export function MobileSessionCommandDock({ controller }: { controller: MobileSessionController }) {
@@ -65,6 +67,7 @@ export function MobileSessionCommandDock({ controller }: { controller: MobileSes
     activeBrowserTab,
     keyboardLift
   } = controller
+  const accessoryBarKeepsKeyboard = useKeyboardPersistingTaps('always')
   return (
     !activeMarkdownTab &&
     !activeFileTab &&
@@ -77,7 +80,7 @@ export function MobileSessionCommandDock({ controller }: { controller: MobileSes
         ]}
       >
         {/* Accessory keys */}
-        <View style={styles.accessoryBar}>
+        <View ref={accessoryBarKeepsKeyboard} style={styles.accessoryBar}>
           {/* Why: fixed keyboard escape hatch; outside ScrollView + shortcut path so it can't scroll away or be hidden (#5106). */}
           {keyboardLift > 0 && (
             <Pressable
@@ -303,7 +306,7 @@ export function MobileSessionCommandDock({ controller }: { controller: MobileSes
               smartInsertDelete={false}
               // Why: iOS textContentType overrides autoComplete and can narrow the keyboard; keep IME switching available.
               autoComplete="off"
-              keyboardType={getTerminalLiveInputKeyboardType(Platform.OS)}
+              keyboardType={getTerminalLiveInputKeyboardType(hostOs())}
               returnKeyType="default"
               blurOnSubmit={false}
               editable={canSend}
@@ -316,7 +319,7 @@ export function MobileSessionCommandDock({ controller }: { controller: MobileSes
               ref={bindCommandField}
               // Why: Android caches IME inputType at mount, so toggling autocomplete must remount there; iOS updates in place.
               key={
-                Platform.OS === 'android'
+                hostOs() === 'android'
                   ? autocompleteEnabled
                     ? 'cmd-input-ac-on'
                     : 'cmd-input-ac-off'
@@ -334,7 +337,7 @@ export function MobileSessionCommandDock({ controller }: { controller: MobileSes
               smartInsertDelete={false}
               // Why: not autofill content, but keyboard must stay default so non-Latin IMEs remain selectable.
               autoComplete="off"
-              keyboardType={getTerminalCommandKeyboardType(Platform.OS, autocompleteEnabled)}
+              keyboardType={getTerminalCommandKeyboardType(hostOs(), autocompleteEnabled)}
               returnKeyType="send"
               blurOnSubmit={false}
               // Why: composing is local — an outage must not lock the field or discard typed text (#6713).
diff --git a/mobile/src/session/MobileSessionHeader.tsx b/mobile/src/session/MobileSessionHeader.tsx
index d8cd0644b3a9..b0d59a781580 100644
--- a/mobile/src/session/MobileSessionHeader.tsx
+++ b/mobile/src/session/MobileSessionHeader.tsx
@@ -21,6 +21,7 @@ import {
 import { colors } from '../theme/mobile-theme'
 import { QuickCommandsTabButton } from './QuickCommandsTabButton'
 import { styles } from './mobile-session-styles'
+import { useKeyboardPersistingTaps } from '../platform/keyboard-persisting-taps'
 import type { MobileSessionController } from './use-mobile-session-controller'
 
 export function MobileSessionHeader({ controller }: { controller: MobileSessionController }) {
@@ -58,6 +59,7 @@ export function MobileSessionHeader({ controller }: { controller: MobileSessionC
     handlePanelTap,
     showHeaderMoreButton
   } = controller
+  const tabBarKeepsKeyboard = useKeyboardPersistingTaps('handled')
   return (
     <SafeAreaView style={styles.sessionChrome} edges={['top']}>
       <View style={styles.sessionTopBar}>
@@ -119,7 +121,7 @@ export function MobileSessionHeader({ controller }: { controller: MobileSessionC
       </View>
 
       {visibleTabs.length > 0 && (
-        <View style={styles.tabBar}>
+        <View ref={tabBarKeepsKeyboard} style={styles.tabBar}>
           {/* Why: tab taps must register on first press with the keyboard open instead of being eaten by dismissal (#5106). */}
           <ScrollView
             ref={tabStripRef}
diff --git a/mobile/src/session/TerminalPaneView.tsx b/mobile/src/session/TerminalPaneView.tsx
index 06174cd0378d..03631d114675 100644
--- a/mobile/src/session/TerminalPaneView.tsx
+++ b/mobile/src/session/TerminalPaneView.tsx
@@ -28,6 +28,7 @@ type TerminalPaneViewProps = {
   onFileTap: (handle: string, pathText: string, line: number | null, column: number | null) => void
   onOpenUrl: (handle: string, url: string) => void
   onTextScaleChange: (scale: number) => void
+  onCellBoxChange: (handle: string) => void
 }
 
 export function TerminalPaneView({
@@ -49,7 +50,8 @@ export function TerminalPaneView({
   onTerminalTap,
   onFileTap,
   onOpenUrl,
-  onTextScaleChange
+  onTextScaleChange,
+  onCellBoxChange
 }: TerminalPaneViewProps) {
   const setRef = useCallback(
     (ref: TerminalWebViewHandle | null) => {
@@ -74,6 +76,7 @@ export function TerminalPaneView({
         style={styles.terminalWebView}
         terminalTheme={terminalTheme}
         textScale={textScale}
+        shownAtMount={active}
         onWebReady={() => onWebReady(handle)}
         onSelectionMode={(a) => onSelectionMode(handle, a)}
         onSelectionCopy={(t) => onSelectionCopy(handle, t)}
@@ -87,6 +90,7 @@ export function TerminalPaneView({
         onFileTap={(pathText, line, column) => onFileTap(handle, pathText, line, column)}
         onOpenUrl={(url) => onOpenUrl(handle, url)}
         onTextScaleChange={onTextScaleChange}
+        onCellBoxChange={() => onCellBoxChange(handle)}
       />
     </View>
   )
diff --git a/mobile/src/session/mobile-dictation-refused-start-routing.test.tsx b/mobile/src/session/mobile-dictation-refused-start-routing.test.tsx
index b073eda047d9..41dc8b5d11f5 100644
--- a/mobile/src/session/mobile-dictation-refused-start-routing.test.tsx
+++ b/mobile/src/session/mobile-dictation-refused-start-routing.test.tsx
@@ -92,7 +92,7 @@ function mount(client: FakeRpcClient): Mounted {
       worktreeId: 'w1',
       client,
       connState: 'connected',
-      agentSessionPromptCancelSupported: true,
+      agentSessionHostSupport: { promptCancel: true, questionAnswers: false },
       setInput: () => {},
       liveInputTerminalHandles: new Set<string>(),
       activeHandle: 't1',
diff --git a/mobile/src/session/mobile-diff-review-sheets.test.ts b/mobile/src/session/mobile-diff-review-sheets.test.ts
new file mode 100644
index 000000000000..2a0f70c28df0
--- /dev/null
+++ b/mobile/src/session/mobile-diff-review-sheets.test.ts
@@ -0,0 +1,151 @@
+import { describe, expect, it } from 'vitest'
+import type { MobileDiffReviewQueueItem } from './mobile-diff-review-queue'
+import type { SendSheetState } from './mobile-diff-review-screen-model'
+import {
+  NO_REVIEW_SHEETS,
+  reduceReviewSheets,
+  reviewComposer,
+  type ReviewSheet,
+  type ReviewSheetsAction,
+  type ReviewSheetsState
+} from './mobile-diff-review-sheets'
+
+const ACTIONS: ReviewSheet = { kind: 'actions' }
+const COMPLETION: ReviewSheet = { kind: 'completion' }
+const SEND_LOADING: ReviewSheet = { kind: 'send', load: { kind: 'loading' } }
+const COMPOSER: ReviewSheet = { kind: 'composer', composer: { mode: 'create', lineNumber: 4 } }
+const READY: SendSheetState = { kind: 'ready', terminals: [] }
+const DISCARD_TARGET: MobileDiffReviewQueueItem = {
+  key: 'unstaged:src/a.ts',
+  scope: 'unstaged',
+  area: 'unstaged',
+  filePath: 'src/a.ts',
+  status: 'modified',
+  title: 'a.ts',
+  subtitle: 'src',
+  canStage: true,
+  canUnstage: false,
+  canDiscard: true,
+  isGeneratedOrLockFile: false,
+  diffIdentity: 'identity-1',
+  noteCount: 0,
+  unsentNoteCount: 0,
+  staleNoteCount: 0,
+  isReviewed: false,
+  changedSinceReview: false
+}
+
+function run(...actions: ReviewSheetsAction[]): ReviewSheetsState {
+  return actions.reduce(reduceReviewSheets, NO_REVIEW_SHEETS)
+}
+
+const open = (sheet: ReviewSheet): ReviewSheetsAction => ({ type: 'open', sheet })
+const openWhenIdle = (sheet: ReviewSheet): ReviewSheetsAction => ({ type: 'openWhenIdle', sheet })
+const close = (kind: ReviewSheet['kind']): ReviewSheetsAction => ({ type: 'close', kind })
+const updateSend = (load: SendSheetState): ReviewSheetsAction => ({ type: 'updateSend', load })
+const DISCARD: ReviewSheet = { kind: 'discard', target: DISCARD_TARGET }
+
+describe('review screen sheet requests', () => {
+  it('the newest request wins', () => {
+    expect(run(open(ACTIONS))).toEqual({ requested: ACTIONS, deferred: null })
+    expect(run(open(ACTIONS), open(SEND_LOADING), open(COMPOSER))).toEqual({
+      requested: COMPOSER,
+      deferred: null
+    })
+  })
+
+  it('closing a sheet clears the request only for that sheet', () => {
+    expect(run(open(DISCARD), close('discard'))).toEqual(NO_REVIEW_SHEETS)
+    const state = run(open(ACTIONS))
+    expect(reduceReviewSheets(state, close('send'))).toBe(state)
+  })
+
+  it('exposes the requested composer only', () => {
+    expect(reviewComposer(run(open(COMPOSER)))).toEqual({ mode: 'create', lineNumber: 4 })
+    expect(reviewComposer(run(open(COMPOSER), close('composer')))).toBeNull()
+  })
+
+  it('openWhenIdle opens at once when nothing is requested', () => {
+    expect(run(openWhenIdle(COMPLETION))).toEqual({ requested: COMPLETION, deferred: null })
+  })
+
+  it('openWhenIdle waits behind the user sheet and opens when it closes', () => {
+    const waiting = run(open(ACTIONS), openWhenIdle(COMPLETION))
+    expect(waiting).toEqual({ requested: ACTIONS, deferred: COMPLETION })
+    expect(reduceReviewSheets(waiting, close('actions'))).toEqual({
+      requested: COMPLETION,
+      deferred: null
+    })
+  })
+
+  // Review Complete → Send Notes, then a second Mark Reviewed save lands while Review Complete is
+  // still closing: Send Notes must stay the request.
+  it('a late Review Complete never displaces a sheet the user asked for', () => {
+    const state = run(open(COMPLETION), open(SEND_LOADING), openWhenIdle(COMPLETION))
+    expect(state.requested).toEqual(SEND_LOADING)
+    expect(run(open(ACTIONS), open(SEND_LOADING), openWhenIdle(COMPLETION)).requested).toEqual(
+      SEND_LOADING
+    )
+  })
+
+  it('openWhenIdle does not repeat a sheet that is already requested or waiting', () => {
+    const shown = run(openWhenIdle(COMPLETION))
+    expect(reduceReviewSheets(shown, openWhenIdle(COMPLETION))).toBe(shown)
+    const waiting = run(open(ACTIONS), openWhenIdle(COMPLETION))
+    expect(reduceReviewSheets(waiting, openWhenIdle(COMPLETION))).toBe(waiting)
+  })
+
+  it('moving to another sheet drops a waiting background sheet', () => {
+    expect(run(open(ACTIONS), openWhenIdle(COMPLETION), open(SEND_LOADING))).toEqual({
+      requested: SEND_LOADING,
+      deferred: null
+    })
+  })
+
+  it('refreshing the requested sheet keeps a waiting background sheet', () => {
+    const edit: ReviewSheet = { kind: 'composer', composer: { mode: 'create', lineNumber: 9 } }
+    expect(run(open(COMPOSER), openWhenIdle(COMPLETION), open(edit))).toEqual({
+      requested: edit,
+      deferred: COMPLETION
+    })
+  })
+
+  it('closing a waiting background sheet leaves the user sheet alone', () => {
+    expect(run(open(ACTIONS), openWhenIdle(COMPLETION), close('completion'))).toEqual({
+      requested: ACTIONS,
+      deferred: null
+    })
+  })
+
+  it('updateSend fills a requested Send Notes', () => {
+    expect(run(open(SEND_LOADING), updateSend(READY)).requested).toEqual({
+      kind: 'send',
+      load: READY
+    })
+  })
+
+  it('a send list that lands after Send Notes was dismissed does not bring it back', () => {
+    const dismissed = run(open(SEND_LOADING), close('send'))
+    expect(reduceReviewSheets(dismissed, updateSend(READY))).toBe(dismissed)
+    const moved = run(open(SEND_LOADING), open(ACTIONS))
+    expect(reduceReviewSheets(moved, updateSend(READY))).toBe(moved)
+  })
+
+  it('never waits a sheet behind nothing or behind its own kind', () => {
+    const sheets = [ACTIONS, COMPLETION, SEND_LOADING, COMPOSER, DISCARD]
+    const actions: ReviewSheetsAction[] = [updateSend(READY)]
+    for (const sheet of sheets) {
+      actions.push(open(sheet), openWhenIdle(sheet), close(sheet.kind))
+    }
+    let seed = 7
+    let state = NO_REVIEW_SHEETS
+    for (let step = 0; step < 2000; step++) {
+      seed = (seed * 48271) % 2147483647
+      state = reduceReviewSheets(state, actions[seed % actions.length]!)
+      if (state.deferred !== null) {
+        expect(state.requested).not.toBeNull()
+        expect(state.deferred.kind).not.toBe(state.requested?.kind)
+      }
+    }
+  })
+})
diff --git a/mobile/src/session/mobile-diff-review-sheets.ts b/mobile/src/session/mobile-diff-review-sheets.ts
new file mode 100644
index 000000000000..29a87f478c70
--- /dev/null
+++ b/mobile/src/session/mobile-diff-review-sheets.ts
@@ -0,0 +1,86 @@
+import type { MobileDiffReviewQueueItem } from './mobile-diff-review-queue'
+import type { ComposerState, SendSheetState } from './mobile-diff-review-screen-model'
+
+// Which review sheet the user wants; the screen's one keyed drawer decides when it can be shown.
+
+export type ReviewSheet =
+  | { kind: 'actions' }
+  | { kind: 'send'; load: SendSheetState }
+  | { kind: 'discard'; target: MobileDiffReviewQueueItem }
+  | { kind: 'composer'; composer: ComposerState }
+  | { kind: 'completion' }
+
+export type ReviewSheetKind = ReviewSheet['kind']
+
+export type ReviewSheetsState = {
+  requested: ReviewSheet | null
+  /** A background sheet waiting for `requested` to close; never of the same kind. */
+  deferred: ReviewSheet | null
+}
+
+export type ReviewSheetsAction =
+  | { type: 'open'; sheet: ReviewSheet }
+  | { type: 'openWhenIdle'; sheet: ReviewSheet }
+  | { type: 'close'; kind: ReviewSheetKind }
+  | { type: 'updateSend'; load: SendSheetState }
+
+export const NO_REVIEW_SHEETS: ReviewSheetsState = { requested: null, deferred: null }
+
+export function reduceReviewSheets(
+  state: ReviewSheetsState,
+  action: ReviewSheetsAction
+): ReviewSheetsState {
+  const { requested, deferred } = state
+  switch (action.type) {
+    case 'open':
+      // Why: the newest request wins; a background sheet only survives a refresh of the same sheet.
+      return {
+        requested: action.sheet,
+        deferred: requested?.kind === action.sheet.kind ? deferred : null
+      }
+    case 'openWhenIdle':
+      if (!requested) {
+        return { requested: action.sheet, deferred: null }
+      }
+      // Why: a background opener waits behind the user's sheet and never displaces it.
+      if (deferred || requested.kind === action.sheet.kind) {
+        return state
+      }
+      return { requested, deferred: action.sheet }
+    case 'close':
+      if (requested?.kind === action.kind) {
+        return { requested: deferred, deferred: null }
+      }
+      if (deferred?.kind === action.kind) {
+        return { requested, deferred: null }
+      }
+      return state
+    case 'updateSend':
+      // Why: a list that resolves after Send Notes was dismissed must not bring it back.
+      if (requested?.kind !== 'send') {
+        return state
+      }
+      return { requested: { kind: 'send', load: action.load }, deferred }
+  }
+}
+
+export function reviewComposer(state: ReviewSheetsState): ComposerState | null {
+  return state.requested?.kind === 'composer' ? state.requested.composer : null
+}
+
+/** The only ways callers change the review screen's sheets. */
+export function reviewSheetIntents(dispatch: (action: ReviewSheetsAction) => void) {
+  return {
+    openSheet: (sheet: ReviewSheet) => dispatch({ type: 'open', sheet }),
+    /** For async openers: waits for the user's sheet to close instead of closing it. */
+    openSheetWhenIdle: (sheet: ReviewSheet) => dispatch({ type: 'openWhenIdle', sheet }),
+    closeSheet: (kind: ReviewSheetKind) => dispatch({ type: 'close', kind }),
+    updateSendSheet: (load: SendSheetState) => dispatch({ type: 'updateSend', load })
+  }
+}
+
+export type ReviewSheetIntents = ReturnType<typeof reviewSheetIntents>
+
+export function reviewSheetKey(sheet: ReviewSheet): ReviewSheetKind {
+  return sheet.kind
+}
diff --git a/mobile/src/session/mobile-file-language.ts b/mobile/src/session/mobile-file-language.ts
index 03b368c9411f..a40e4e4d5c6d 100644
--- a/mobile/src/session/mobile-file-language.ts
+++ b/mobile/src/session/mobile-file-language.ts
@@ -89,5 +89,10 @@ export function detectMobileFileLanguage(filePath: string, preferredLanguage?: s
     return exact
   }
 
-  return EXT_TO_LANGUAGE[extname(filename).toLowerCase()] ?? 'plaintext'
+  const lowerName = filename.toLowerCase()
+  // Scoped dotenv names fall back to INI only when no specific extension matches.
+  return (
+    EXT_TO_LANGUAGE[extname(filename).toLowerCase()] ??
+    (lowerName === '.env' || lowerName.startsWith('.env.') ? 'ini' : 'plaintext')
+  )
 }
diff --git a/mobile/src/session/mobile-file-syntax.test.ts b/mobile/src/session/mobile-file-syntax.test.ts
index f01a240e10f6..821a1261960d 100644
--- a/mobile/src/session/mobile-file-syntax.test.ts
+++ b/mobile/src/session/mobile-file-syntax.test.ts
@@ -9,6 +9,65 @@ import {
 import type { MobileDiffLine } from './mobile-diff-lines'
 
 describe('mobile file syntax highlighting', () => {
+  it.each([
+    ['.env', 'ini'],
+    ['.env.local', 'ini'],
+    ['.env.development', 'ini'],
+    ['.env.production', 'ini'],
+    ['.env.functions.local', 'ini'],
+    ['.env.staging', 'ini'],
+    ['.env.test.example', 'ini'],
+    ['config/.env.development.local', 'ini'],
+    ['.ENV', 'ini'],
+    ['.ENV.STAGING', 'ini'],
+    ['C:\\repo\\.EnV.FUNCTIONS.LOCAL', 'ini'],
+    ['\\\\server\\share\\.env.test.example', 'ini'],
+    ['.env.sh', 'shell'],
+    ['.ENV.SH', 'shell'],
+    ['.env.json', 'json'],
+    ['.env.local.ts', 'typescript'],
+    ['.env/CMakeLists.txt', 'cmake'],
+    ['C:\\repo\\.env.local\\Dockerfile', 'dockerfile'],
+    ['.envrc', 'plaintext'],
+    ['.environment', 'plaintext'],
+    ['env.staging', 'plaintext'],
+    ['dev.env', 'plaintext'],
+    ['other.env.local', 'plaintext'],
+    ['..env.local', 'plaintext'],
+    ['.env.staging/readme', 'plaintext'],
+    ['C:\\repo\\.env.local\\notes', 'plaintext'],
+    ['', 'plaintext']
+  ])('detects dotenv names without overriding specific mappings: %s', (filePath, expected) => {
+    expect(detectMobileFileLanguage(filePath)).toBe(expected)
+  })
+
+  it('keeps a mobile language preference ahead of the dotenv fallback', () => {
+    expect(detectMobileFileLanguage('.env.staging', ' JSON ')).toBe('json')
+    expect(detectMobileFileLanguage('.env.staging', ' plaintext ')).toBe('ini')
+  })
+
+  it('highlights dotenv file and diff contents with the bundled ini grammar', () => {
+    const language = resolveMobileSyntaxLanguage('.env.functions.local', 'plaintext')
+    const content = '# Local settings\nAPI_URL="https://example.test"\nPORT=54321'
+    expect(language).toBe('ini')
+    const file = highlightMobileCode(content, language)
+    expect(file.highlighted).toBe(true)
+    expect(file.segments.map((segment) => segment.text).join('')).toBe(content)
+    expect(file.segments).toEqual(
+      expect.arrayContaining([
+        { text: '# Local settings', kind: 'comment' },
+        { text: 'API_URL', kind: 'variable' },
+        { text: '"https://example.test"', kind: 'string' }
+      ])
+    )
+    const [line] = highlightMobileDiffLines(
+      [{ kind: 'add', text: 'PORT=54321', newLineNumber: 3 }],
+      language
+    )
+    expect(line).toMatchObject({ kind: 'add', newLineNumber: 3, highlighted: true })
+    expect(line?.segments).toContainEqual({ text: 'PORT', kind: 'variable' })
+  })
+
   it('detects common source languages from file paths', () => {
     expect(detectMobileFileLanguage('src/App.tsx')).toBe('typescript')
     expect(detectMobileFileLanguage('config/vitest.config.mts')).toBe('typescript')
diff --git a/mobile/src/session/mobile-session-connection-retry.test.tsx b/mobile/src/session/mobile-session-connection-retry.test.tsx
index 0102819b311f..410c6dea1966 100644
--- a/mobile/src/session/mobile-session-connection-retry.test.tsx
+++ b/mobile/src/session/mobile-session-connection-retry.test.tsx
@@ -30,7 +30,7 @@ function present(forceReconnectHost: ForceReconnect): Presentation {
     toastOpacityRef: { current: 1 },
     hostEndpoint: null,
     initialSessionAutoCreateRef: { current: null },
-    terminalFrameHeightRef: { current: 0 },
+    terminalFrameRef: { current: null },
     handleCreateTerminal: () => Promise.resolve(),
     visibleTabs: [],
     forceReconnectHost
diff --git a/mobile/src/session/mobile-session-frame-styles.ts b/mobile/src/session/mobile-session-frame-styles.ts
index a02c14be0149..c6117fc8aaea 100644
--- a/mobile/src/session/mobile-session-frame-styles.ts
+++ b/mobile/src/session/mobile-session-frame-styles.ts
@@ -142,6 +142,11 @@ export const mobileSessionFrameStyles = StyleSheet.create({
     height: 18,
     backgroundColor: colors.borderSubtle
   },
+  // The content slot every branch renders in, measured as the terminal's frame; clips nothing.
+  contentFrame: {
+    flex: 1,
+    minHeight: 0
+  },
   terminalFrame: {
     flex: 1,
     minHeight: 0,
diff --git a/mobile/src/session/mobile-session-route-parity.test.ts b/mobile/src/session/mobile-session-route-parity.test.ts
index 60df6b17d085..6083ecbcd683 100644
--- a/mobile/src/session/mobile-session-route-parity.test.ts
+++ b/mobile/src/session/mobile-session-route-parity.test.ts
@@ -92,10 +92,23 @@ const HOST_COMPONENT_NAMES = new Set([
 // never pass it. Found by pullfrog on #22300.
 // Moved, count unchanged, when the Markdown actions' Back `useEffect` became `useBackClaim`, the
 // seam that also claims the key on the page while a draft is dirty.
-const HEAD_MAIN_HOOK_SHA256 = '914bf72e0bf0abe2b22850467b5dfdc3ab3fd19111924f1de91d9c1d9d1ce74f'
-const HEAD_HOOK_BINDING_SHA256 = 'd0677b98b909f8a24089ac5d6afe9ad2c238fa6c24969da1e84e01cd6f653a16'
+// Refreshed when the first subscribe began sizing itself from the document's reported cell box:
+// the first-subscribe mark ref and `measureViewportOnce` are gone (hooks 282 → 280, callbacks 79 → 78).
+// Again when xterm became the only cell measurer: `useTerminalCellBoxRefit` is gone, the frame's
+// width ref and `handleTerminalFrameLayout` subscribe a known box on layout (hooks 282, callbacks 79),
+// and the pane's `onCellBoxChange` goes to the viewport refit.
+// Again when one frame ref replaced the height ref, width ref and width state (hooks 280).
+// Again when one `notifyTerminalFrame` took the frame's layout (hooks 281, callbacks 80).
+const HEAD_MAIN_HOOK_SHA256 = '004b011722b17ac82c96f0b3c8e303d39b2431a216424e9b86a1ee6a4896f23e'
+// Moved when the prompt-cancel flag became one structured-session host support object (main).
+// Re-recorded against the merged tree. Again when the frame-layout and cell-box-change callbacks
+// named the refs they read in their dependency lists (react-doctor).
+// Again when the frame's width and height became one `terminalFrameRef`.
+// Again when the frame's layout moved into `notifyTerminalFrame`.
+const HEAD_HOOK_BINDING_SHA256 = 'c1bcb859202aaf8d612d3023cb4d895719da513879c61b01545a249a0bda662b'
+// Moved when `notifyTerminalFrame` joined and `handleTerminalFrameLayout` became `subscribeIntendedActiveTerminal`.
 const HEAD_CALLBACK_IDENTITY_SHA256 =
-  'e396ab759b2401acef45dea428e97c7f8f24fff41aae7fb7858da5a5b145c64c'
+  '9c966301b373c11b27359ef1388c593b638c7f6831186d5c5321553504183e07'
 // Pins that no callback body in the route changed unnoticed. Body text, not behaviour: the sends
 // and repo reads inside them now name their `RpcOperation` instead of the raw `sendRequest` port.
 // Refreshed in step 6 for the gesture flush, whose `terminal.send` became `terminalInputSend` and
@@ -115,7 +128,16 @@ const HEAD_CALLBACK_IDENTITY_SHA256 =
 // the other's body. The hook and string counts are C7.2's and stand.
 // Refreshed once more for the two dictation failure handlers, which now both call
 // `reportDictationFailure` instead of each choosing between the setup sheet and a toast.
-const HEAD_CALLBACK_BODY_SHA256 = '349ad6f766da14b3bce23a13f3a67f2b013efadd8896f63b7b68e724b9726d9b'
+// Moved when the metrics handler compared every field, the row pitch included (main).
+// Again when the subscribe waited for web-ready and `handleTerminalWebReady` lost `documentHasInit`.
+// Again when the subscribe's inits began carrying the laid-out terminal frame, and its resize too.
+// Again when those grids read the one frame ref.
+// Again when the subscribe sized its viewport inline instead of through a helper.
+// Again when the document took the hold rule and the subscribe stopped holding its grid.
+// Again when an init took one options object.
+// Again when the frame's layout became one `notifyTerminalFrame`.
+// Again when the init option took the message's name, `initialData`.
+const HEAD_CALLBACK_BODY_SHA256 = '4848e925f478f1656f26031c1bdebbb9f2da60811c7e91cfd732fc9da9764079'
 // Refreshed for the startup effect: both `worktree.activate` sends became `worktreeActivate`, and
 // the sleeping-agent check reads that operation's verdict instead of the reply envelope. Refreshed
 // again when the reporter took the reply and interpreted it itself, retiring the hand-built
@@ -125,7 +147,8 @@ const HEAD_CALLBACK_BODY_SHA256 = '349ad6f766da14b3bce23a13f3a67f2b013efadd8896f
 // the diff-comments effect, which now catches the loader's rejection. Count unchanged.
 // Moved again by the keyboard seam above, which is the +1 effect.
 // -1 effect for the Markdown actions' Back registration, which is `useBackClaim`'s own now.
-const HEAD_EFFECT_SHA256 = '69096e20a44fa03a2c364e00a617eeabc437a79bb850b9135408d35fbd4d4a71'
+// Moved by the capability probe setting that host support object.
+const HEAD_EFFECT_SHA256 = '9b045a547ed269acf95db16cc87e33a9035a20c6888fd30e0363e58bb6b7d883'
 const HEAD_CONTENT_HOOK_SHA256 = '9c3b612fef3f370d66873aefdbe1d701f20cb64ded31fef5cc45fde6f8189581'
 // Same pin for the 12 bodies that sit in nested functions rather than callbacks, moved by the same
 // rewrite of those send and read expressions. Count unchanged. Refreshed again in step 6 for
@@ -171,17 +194,33 @@ const HEAD_TIMER_CLEANUP_SHA256 = 'c73f1d1c2cc89642f3d727d6f3b6b81860a9d6f342345
 // 529 -> 530, and the host-JSX hash: `key="terminal-frame"`, so the page's frame mounts with its
 // onLayout rather than reusing the loading View. Native measured 47 rows before and after: its
 // frame reported either way, and its window is its frame, so both measure paths agree there.
+//
+// 531 -> 530, and the host-JSX and style hashes: the key left, and one `contentFrame` View wraps
+// every branch and carries the frame's onLayout, so the page's frame mounts with it. The page measured
+// 47 rows before and after; native was measured only on main's bundle (47), and the wrapper is a
+// flex:1 View around the same flex:1 frame, so its box is the frame's.
+// Count unchanged: `'frame-not-laid-out'`, the gate awaiting the frame's first layout, replaced `'measuring-viewport'`.
+// 530 -> 532, and the host-JSX hash: the tab bar and the accessory bar take a ref that gives the
+// page `keyboardShouldPersistTaps` ('handled', 'always'), which react-native-web ignores. Natively
+// the ref is undefined. 532 -> 531: the live input's reopen flag reads the host OS, not an 'android' literal.
 const HEAD_RUNTIME_STRING_SHA256 =
-  'd7eea5438ff7b4ee77c9bf652626adfdc3d2b49716ffb660df078f70bae0d88d'
-// Moved by both of the dock's fields: their refs, and the live one's submit handler, are the seam's now.
-const HEAD_HOST_JSX_SHA256 = 'ca4c8b46af86a05cb671de91c22111c9e4aaeefd4a04c7b8b09976ca01a31c9b'
-const HEAD_LEAF_JSX_SHA256 = 'c7e1a4b90197697f1eaa640c38da63281b4f7b84fb036ae2152f00c2f7d7cb77'
+  'ab8cc43940d3a3e0fdb8df3bdc178b9b61e51c7ccd55a944933862a3c290e8e3'
+// Moved by both of the dock's fields: their refs, and the live one's submit handler, are the seam's now;
+// their keyboard type and remount key read the host OS.
+// Moved again when the terminal frame kept its laid-out width unrounded, for every fit.
+// Again when the frame's onLayout wrote one frame ref and notified a new width imperatively.
+// Again when the frame's first laid-out layout alone subscribes a held-back document.
+// Again when the frame's onLayout made one `notifyTerminalFrame` call.
+const HEAD_HOST_JSX_SHA256 = 'f71b1ee495f67a6e389abf597948ffdff1f9a4a10cde6abefd2611ea4dd94245'
+const HEAD_LEAF_JSX_SHA256 = '62eb05c6e2ac0be6d553a141fc8aa1641fcb0c678777d5d539f490aab8648417'
 const HEAD_STYLE_REFERENCE_SHA256 =
-  '295a3501c2c6d7bea7c8bbf38b3f3534f01344cd7e1b91bb8e07c040821d596a'
+  '56a005a1f65b30c11092e3422caef67810e1ec50f66fdd06471c370138b1eeb6'
 const HEAD_IDENTITY_FIELD_SHA256 =
   '91146853930a34dd1f3d80e5c97fbacd7cf19fb93dd26fe8fc6f29169622f9d6'
 const HEAD_NAVIGATION_SHA256 = '9d96f5dad7de555d6553eac39c0fab00efad507470fd562cb9beaa32db16f512'
-const HEAD_CAPABILITY_SHA256 = '67c3154b71b542bb63a4365d3ea75aef19ef133c02f509318619618221786fab'
+// Moved when structured-session features became one helper call; the capability strings it reads
+// are pinned by that helper's own test.
+const HEAD_CAPABILITY_SHA256 = 'ec1159d6e726383bf7121e9c642657fee5b4ebec049cb44ba132a303bb9a61e2'
 
 type Definition = { declaration: ts.FunctionDeclaration; sourceFile: ts.SourceFile }
 type HookFacts = {
@@ -550,7 +589,11 @@ function readCompatibilityFacts(definitions: ReadonlyMap<string, Definition>): {
         : ''
     const callText = canonical(node, sourceFile)
     if (
-      ['startRuntimeCapabilityProbe', 'supportsMobileQuickCommands'].includes(callName) ||
+      [
+        'startRuntimeCapabilityProbe',
+        'supportsMobileQuickCommands',
+        'structuredAgentSessionHostSupport'
+      ].includes(callName) ||
       (callName === 'includes' && callText.includes('capabilities.includes'))
     ) {
       capabilities.push(callText)
@@ -569,7 +612,7 @@ describe('mobile session route extraction parity', () => {
     expect(main.hooks).toHaveLength(281)
     expect(hash(main.hooks)).toBe(HEAD_MAIN_HOOK_SHA256)
     expect(hash(main.bindings)).toBe(HEAD_HOOK_BINDING_SHA256)
-    expect(main.callbacks).toHaveLength(79)
+    expect(main.callbacks).toHaveLength(80)
     expect(hash(main.callbacks)).toBe(HEAD_CALLBACK_IDENTITY_SHA256)
     expect(hash(main.callbackBodies)).toBe(HEAD_CALLBACK_BODY_SHA256)
     expect(main.effects).toHaveLength(24)
@@ -611,14 +654,14 @@ describe('mobile session route extraction parity', () => {
 
   it('preserves runtime strings, styles, and the expanded JSX tree', () => {
     const strings = readRuntimeStrings()
-    expect(strings).toHaveLength(530)
+    expect(strings).toHaveLength(531)
     expect(hash(strings)).toBe(HEAD_RUNTIME_STRING_SHA256)
     const jsx = readJsxFacts(readDefinitions())
-    expect(jsx.host).toHaveLength(124)
+    expect(jsx.host).toHaveLength(125)
     expect(hash(jsx.host)).toBe(HEAD_HOST_JSX_SHA256)
     expect(jsx.leaf).toHaveLength(61)
     expect(hash(jsx.leaf)).toBe(HEAD_LEAF_JSX_SHA256)
-    expect(jsx.styleReferences).toHaveLength(172)
+    expect(jsx.styleReferences).toHaveLength(173)
     expect(hash(jsx.styleReferences)).toBe(HEAD_STYLE_REFERENCE_SHA256)
   })
 })
diff --git a/mobile/src/session/mobile-session-terminal-frame-layout.test.tsx b/mobile/src/session/mobile-session-terminal-frame-layout.test.tsx
index 857a6ac561ac..1cec63717c73 100644
--- a/mobile/src/session/mobile-session-terminal-frame-layout.test.tsx
+++ b/mobile/src/session/mobile-session-terminal-frame-layout.test.tsx
@@ -45,17 +45,20 @@ import { MobileSessionActiveContent } from './MobileSessionActiveContent'
 
 type Controller = Parameters<typeof MobileSessionActiveContent>[0]['controller']
 
+type Branch = 'loading' | 'pending' | 'terminal'
+
 function controller(
-  showLoadingState: boolean,
-  notifyTerminalFrameHeight: (height: number) => void
+  branch: Branch | boolean,
+  notifyTerminalFrame: (frame: { width: number; height: number }) => void
 ): Controller {
+  const shown = branch === true ? 'loading' : branch === false ? 'terminal' : branch
   const scope = {
-    showLoadingState,
+    showLoadingState: shown === 'loading',
+    activePendingTerminalTab: shown === 'pending' ? { title: 'Loading terminal' } : null,
+    isPendingTerminalRecoveryParked: false,
     showEmptyState: false,
     terminals: [],
-    terminalFrameHeightRef: { current: 0 },
-    setTerminalFrameWidth: () => {},
-    notifyTerminalFrameHeight,
+    notifyTerminalFrame,
     dictation: { isRecording: false },
     nativeChatSendError: { message: null, clear: () => {} }
   }
@@ -66,8 +69,8 @@ function controller(
 describe('the terminal frame on the page', () => {
   it('reports its height when the session opens from the loading state', () => {
     const heights: number[] = []
-    const notify = (height: number): void => {
-      heights.push(height)
+    const notify = (frame: { height: number }): void => {
+      heights.push(frame.height)
     }
     let renderer: ReturnType<typeof create> | undefined
     act(() => {
@@ -82,4 +85,30 @@ describe('the terminal frame on the page', () => {
     })
     expect(heights).toEqual([FRAME.height])
   })
+
+  it('stays one mounted frame across loading, a pending terminal and the terminal', () => {
+    // A frame that remounts per branch reports again on every return; one that stays reports once.
+    const heights: number[] = []
+    const notify = (frame: { height: number }): void => {
+      heights.push(frame.height)
+    }
+    let renderer: ReturnType<typeof create> | undefined
+    const show = (branch: Branch) => {
+      const element = createElement(MobileSessionActiveContent, {
+        controller: controller(branch, notify)
+      })
+      act(() => {
+        if (renderer) {
+          renderer.update(element)
+        } else {
+          renderer = create(element)
+        }
+      })
+    }
+    show('loading')
+    show('terminal')
+    show('pending')
+    show('terminal')
+    expect(heights).toEqual([FRAME.height])
+  })
 })
diff --git a/mobile/src/session/mobile-structured-agent-prompts.ts b/mobile/src/session/mobile-structured-agent-prompts.ts
index d11a2fc0317b..649fc06b7741 100644
--- a/mobile/src/session/mobile-structured-agent-prompts.ts
+++ b/mobile/src/session/mobile-structured-agent-prompts.ts
@@ -1,4 +1,8 @@
 import type { AgentJournalRenderItem } from '../../../src/shared/agent-session-journal-types'
+import {
+  agentSessionPromptQuestions,
+  type AgentSessionQuestionAnswer
+} from '../../../src/shared/agent-session-question-answer'
 import type { MobileChatPermission } from './mobile-native-chat-permission'
 import type { MobileChatQuestion } from './mobile-native-chat-question'
 import {
@@ -21,6 +25,12 @@ export type StructuredPromptResponseTarget = {
   optionId: string
 }
 
+export type StructuredQuestionResponseTarget = {
+  itemId: string
+  expectedRevision: number
+  answer: AgentSessionQuestionAnswer
+}
+
 type PromptTokenPayload =
   | {
       kind: 'approval'
@@ -32,6 +42,7 @@ type PromptTokenPayload =
       kind: 'question-option'
       itemId: string
       revision: number
+      questionId: string
       optionId: string
     }
   | {
@@ -55,10 +66,6 @@ export function pendingStructuredQuestion(
   return item.body.kind === 'question' && item.body.resolution.state === 'pending'
 }
 
-function encodeQuestionAnswer(questionId: string, answer: string): string {
-  return `${encodeURIComponent(questionId)}:${encodeURIComponent(answer)}`
-}
-
 function encodePromptToken(payload: PromptTokenPayload): string {
   return `${STRUCTURED_PROMPT_TOKEN_PREFIX}${encodeURIComponent(JSON.stringify(payload))}`
 }
@@ -86,11 +93,16 @@ function decodePromptToken(value: string): PromptTokenPayload | null {
         optionId: decoded.optionId
       }
     }
-    if (decoded.kind === 'question-option' && typeof decoded.optionId === 'string') {
+    if (
+      decoded.kind === 'question-option' &&
+      typeof decoded.questionId === 'string' &&
+      typeof decoded.optionId === 'string'
+    ) {
       return {
         kind: decoded.kind,
         itemId: decoded.itemId,
         revision: decoded.revision,
+        questionId: decoded.questionId,
         optionId: decoded.optionId
       }
     }
@@ -169,6 +181,10 @@ export function projectStructuredQuestion(
       { itemId: prompt.itemId, expectedRevision: prompt.revision }
     )
   }
+  const [question] = agentSessionPromptQuestions(prompt.body)
+  if (!question) {
+    return null
+  }
   const optionDescriptions = prompt.body.options.map((option) => option.description)
   return {
     question: prompt.body.question,
@@ -182,6 +198,7 @@ export function projectStructuredQuestion(
         kind: 'question-option',
         itemId: prompt.itemId,
         revision: prompt.revision,
+        questionId: question.id,
         optionId: option.id
       })
     ),
@@ -228,13 +245,13 @@ export function structuredApprovalResponseTarget(
 export function structuredQuestionResponseTarget(
   response: string,
   currentPrompt: StructuredQuestionItem | null
-): StructuredPromptResponseTarget | null {
+): StructuredQuestionResponseTarget | null {
   const token = decodePromptToken(response)
   if (token?.kind === 'question-option') {
     return {
       itemId: token.itemId,
       expectedRevision: token.revision,
-      optionId: token.optionId
+      answer: { questionId: token.questionId, optionIds: [token.optionId] }
     }
   }
   if (token) {
@@ -247,29 +264,30 @@ export function structuredQuestionResponseTarget(
       ? {
           itemId: freeText.payload.itemId,
           expectedRevision: freeText.payload.revision,
-          optionId: encodeQuestionAnswer(freeText.payload.questionId, answer)
+          answer: { questionId: freeText.payload.questionId, optionIds: [], other: answer }
         }
       : null
   }
   if (!currentPrompt) {
     return null
   }
+  const [question] = agentSessionPromptQuestions(currentPrompt.body)
   const trimmed = response.trim()
   const option = currentPrompt.body.options.find(
     (candidate) => candidate.id === response || candidate.label === trimmed
   )
-  if (option) {
+  if (question && option) {
     return {
       itemId: currentPrompt.itemId,
       expectedRevision: currentPrompt.revision,
-      optionId: option.id
+      answer: { questionId: question.id, optionIds: [option.id] }
     }
   }
-  return currentPrompt.body.freeTextQuestionId && trimmed
+  return question && currentPrompt.body.freeTextQuestionId && trimmed
     ? {
         itemId: currentPrompt.itemId,
         expectedRevision: currentPrompt.revision,
-        optionId: encodeQuestionAnswer(currentPrompt.body.freeTextQuestionId, trimmed)
+        answer: { questionId: question.id, optionIds: [], other: trimmed }
       }
     : null
 }
diff --git a/mobile/src/session/mobile-structured-agent-session-cancel.ts b/mobile/src/session/mobile-structured-agent-session-cancel.ts
index f144accc2e78..4666cad48175 100644
--- a/mobile/src/session/mobile-structured-agent-session-cancel.ts
+++ b/mobile/src/session/mobile-structured-agent-session-cancel.ts
@@ -75,7 +75,7 @@ export async function requestMobileStructuredAgentSessionCancel(args: {
   } else if (result.status === 'refused') {
     onSendError(result.message)
   } else if (result.status === 'failed') {
-    onSendError(result.message === 'Request not sent' ? 'Stop not sent' : result.message)
+    onSendError(result.message)
   }
   return false
 }
diff --git a/mobile/src/session/mobile-structured-agent-session-host-support.test.ts b/mobile/src/session/mobile-structured-agent-session-host-support.test.ts
new file mode 100644
index 000000000000..6857855c9b47
--- /dev/null
+++ b/mobile/src/session/mobile-structured-agent-session-host-support.test.ts
@@ -0,0 +1,21 @@
+import { describe, expect, it } from 'vitest'
+import {
+  AGENT_SESSION_PROMPT_CANCEL_RUNTIME_CAPABILITY,
+  AGENT_SESSION_QUESTION_ANSWERS_RUNTIME_CAPABILITY
+} from '../../../src/shared/protocol-version'
+import { structuredAgentSessionHostSupport } from './mobile-structured-agent-session-host-support'
+
+describe('structuredAgentSessionHostSupport', () => {
+  it('reads each structured-session feature from the host capability list', () => {
+    expect(structuredAgentSessionHostSupport([])).toEqual({
+      promptCancel: false,
+      questionAnswers: false
+    })
+    expect(
+      structuredAgentSessionHostSupport([AGENT_SESSION_QUESTION_ANSWERS_RUNTIME_CAPABILITY])
+    ).toEqual({ promptCancel: false, questionAnswers: true })
+    expect(
+      structuredAgentSessionHostSupport([AGENT_SESSION_PROMPT_CANCEL_RUNTIME_CAPABILITY])
+    ).toEqual({ promptCancel: true, questionAnswers: false })
+  })
+})
diff --git a/mobile/src/session/mobile-structured-agent-session-host-support.ts b/mobile/src/session/mobile-structured-agent-session-host-support.ts
new file mode 100644
index 000000000000..939f7d559f49
--- /dev/null
+++ b/mobile/src/session/mobile-structured-agent-session-host-support.ts
@@ -0,0 +1,19 @@
+import {
+  AGENT_SESSION_PROMPT_CANCEL_RUNTIME_CAPABILITY,
+  AGENT_SESSION_QUESTION_ANSWERS_RUNTIME_CAPABILITY
+} from '../../../src/shared/protocol-version'
+
+/** Structured-session features the connected host advertised; null until the status probe answers. */
+export type StructuredAgentSessionHostSupport = {
+  promptCancel: boolean
+  questionAnswers: boolean
+}
+
+export function structuredAgentSessionHostSupport(
+  capabilities: readonly string[]
+): StructuredAgentSessionHostSupport {
+  return {
+    promptCancel: capabilities.includes(AGENT_SESSION_PROMPT_CANCEL_RUNTIME_CAPABILITY),
+    questionAnswers: capabilities.includes(AGENT_SESSION_QUESTION_ANSWERS_RUNTIME_CAPABILITY)
+  }
+}
diff --git a/mobile/src/session/mobile-structured-agent-session-rpc.ts b/mobile/src/session/mobile-structured-agent-session-rpc.ts
index 27c50d85104e..bca14e293f75 100644
--- a/mobile/src/session/mobile-structured-agent-session-rpc.ts
+++ b/mobile/src/session/mobile-structured-agent-session-rpc.ts
@@ -8,6 +8,17 @@ import type {
   AgentSessionWireRefusalCode
 } from '../../../src/shared/agent-session-wire'
 import { structuredAgentSessionPayloadFingerprint } from '../../../src/shared/structured-agent-session-mutation'
+import {
+  agentSessionRefusalNotice,
+  agentSessionWriteFailureNotice,
+  agentSessionWriteNoticeEnglish,
+  agentSessionWriteNoticeParts
+} from '../../../src/shared/agent-session-refusal-notice'
+import {
+  agentSessionRpcErrorFailure,
+  agentSessionWriteKindForMethod,
+  type AgentSessionWriteKind
+} from '../../../src/shared/agent-session-write-failure'
 import { structuredSessionOperationId } from './structured-session-operation-id'
 import { isRpcDeliveryUnknown } from '../transport/rpc-delivery-ambiguity'
 import type { RpcClient } from '../transport/rpc-client'
@@ -46,13 +57,6 @@ class AgentSessionRpcResponseError extends Error {
   }
 }
 
-const PRE_HANDLER_RPC_REFUSALS = new Set([
-  'invalid_argument',
-  'method_not_found',
-  'method_not_supported',
-  'unauthorized'
-])
-
 export async function callAgentSession<TResult>(
   client: RpcClient,
   method: string,
@@ -115,6 +119,15 @@ export function timeoutForDeadline(deadline: number | undefined): number | null
   return timeoutMs >= MOBILE_NATIVE_CHAT_MIN_WRITE_TIMEOUT_MS ? timeoutMs : null
 }
 
+/** A refused phone send goes back into the composer; there is no Retry control. */
+function phoneWriteKind(
+  fingerprintMethod: string,
+  fields: Record<string, unknown>
+): AgentSessionWriteKind {
+  const write = agentSessionWriteKindForMethod(fingerprintMethod, fields)
+  return write === 'send' ? 'composer-send' : write
+}
+
 export async function requestStructuredAgentSessionMutation<TValue>(args: {
   client: RpcClient
   method: string
@@ -163,10 +176,25 @@ export async function requestStructuredAgentSessionMutation<TValue>(args: {
     }
     return result.ok
       ? { status: 'accepted', value: result.value }
-      : { status: 'refused', code: result.refusal.code, message: result.refusal.message }
+      : {
+          status: 'refused',
+          code: result.refusal.code,
+          message: agentSessionRefusalNotice(
+            result.refusal,
+            phoneWriteKind(fingerprintMethod, fields)
+          )
+        }
   } catch (error) {
-    if (error instanceof AgentSessionRpcResponseError && PRE_HANDLER_RPC_REFUSALS.has(error.code)) {
-      return { status: 'failed', message: error.message }
+    const answered =
+      error instanceof AgentSessionRpcResponseError ? agentSessionRpcErrorFailure(error.code) : null
+    if (answered && answered.kind !== 'unconfirmed') {
+      // The host turned the request away before running it; its text is written for a log.
+      return {
+        status: 'failed',
+        message: agentSessionWriteNoticeEnglish(
+          agentSessionWriteNoticeParts(answered, phoneWriteKind(fingerprintMethod, fields))
+        )
+      }
     }
     if (
       isRpcDeliveryUnknown(error) ||
@@ -177,7 +205,7 @@ export async function requestStructuredAgentSessionMutation<TValue>(args: {
     }
     return {
       status: 'failed',
-      message: error instanceof Error ? error.message : 'Request not sent'
+      message: agentSessionWriteFailureNotice(phoneWriteKind(fingerprintMethod, fields))
     }
   }
 }
diff --git a/mobile/src/session/mobile-structured-grouped-question.test.ts b/mobile/src/session/mobile-structured-grouped-question.test.ts
index 45a365864d9a..37a4dc125c27 100644
--- a/mobile/src/session/mobile-structured-grouped-question.test.ts
+++ b/mobile/src/session/mobile-structured-grouped-question.test.ts
@@ -1,6 +1,5 @@
 import { describe, expect, it } from 'vitest'
 import type { AgentJournalQuestion } from '../../../src/shared/agent-session-journal-types'
-import { decodeAgentSessionQuestionAnswers } from '../../../src/shared/agent-session-question-answer'
 import {
   formatQuestionAnswer,
   formatQuestionFreeTextAnswer,
@@ -85,7 +84,7 @@ describe('mobile structured grouped questions', () => {
     expect(second).toMatchObject({ question: 'Which regions? (2 of 2)', multiSelect: true })
   })
 
-  it('submits the whole group as one encoded answer on the last step', () => {
+  it('submits the whole group as one set of answers on the last step', () => {
     const questions = [question(), SECOND]
     const draft: GroupedQuestionDraft = {
       promptKey: PROMPT_KEY,
@@ -102,9 +101,7 @@ describe('mobile structured grouped questions', () => {
     })
 
     expect(result?.kind).toBe('submit')
-    expect(
-      decodeAgentSessionQuestionAnswers(result?.kind === 'submit' ? result.optionId : '')
-    ).toEqual([
+    expect(result?.kind === 'submit' ? result.answers : null).toEqual([
       { questionId: 'q1', optionIds: ['q1:choice-1'] },
       { questionId: 'q2', optionIds: ['q2:choice-1', 'q2:choice-2'] }
     ])
@@ -121,9 +118,9 @@ describe('mobile structured grouped questions', () => {
       promptKey: PROMPT_KEY
     })
 
-    expect(
-      decodeAgentSessionQuestionAnswers(result?.kind === 'submit' ? result.optionId : '')
-    ).toEqual([{ questionId: 'q1', optionIds: [], other: 'DuckDB' }])
+    expect(result?.kind === 'submit' ? result.answers : null).toEqual([
+      { questionId: 'q1', optionIds: [], other: 'DuckDB' }
+    ])
   })
 
   it('keeps selected options and other text for grouped multi-select answers', () => {
@@ -137,9 +134,9 @@ describe('mobile structured grouped questions', () => {
       promptKey: PROMPT_KEY
     })
 
-    expect(
-      decodeAgentSessionQuestionAnswers(result?.kind === 'submit' ? result.optionId : '')
-    ).toEqual([{ questionId: 'q2', optionIds: ['q2:choice-1'], other: 'ap-south' }])
+    expect(result?.kind === 'submit' ? result.answers : null).toEqual([
+      { questionId: 'q2', optionIds: ['q2:choice-1'], other: 'ap-south' }
+    ])
   })
 
   it('gives each step a distinct card key so a selection cannot carry into the next question', () => {
diff --git a/mobile/src/session/mobile-structured-grouped-question.ts b/mobile/src/session/mobile-structured-grouped-question.ts
index 031cdf3f10f3..d111b4de95aa 100644
--- a/mobile/src/session/mobile-structured-grouped-question.ts
+++ b/mobile/src/session/mobile-structured-grouped-question.ts
@@ -1,6 +1,5 @@
 import type { AgentJournalQuestion } from '../../../src/shared/agent-session-journal-types'
 import {
-  encodeAgentSessionQuestionAnswers,
   isValidAgentSessionQuestionAnswers,
   type AgentSessionQuestionAnswer
 } from '../../../src/shared/agent-session-question-answer'
@@ -11,7 +10,7 @@ import type { MobileChatQuestion } from './mobile-native-chat-question'
  * prompt. The host then leaves the flat `question.options` EMPTY and puts the real content in
  * `questions`, so a client that reads only the flat shape renders an unanswerable card and the turn
  * stalls. The phone has room for one question at a time, so the group is answered as steps and
- * submitted once — the host accepts the whole group as one encoded option id.
+ * submitted once as one set of answers.
  */
 export type GroupedQuestionDraft = {
   /** Identifies the exact prompt revision these answers belong to; a revised prompt discards them. */
@@ -21,7 +20,7 @@ export type GroupedQuestionDraft = {
 
 export type GroupedQuestionAdvance =
   | { kind: 'advance'; draft: GroupedQuestionDraft }
-  | { kind: 'submit'; optionId: string }
+  | { kind: 'submit'; answers: AgentSessionQuestionAnswer[] }
 
 const GROUPED_TOKEN_PREFIX = 'structured-grouped-question:'
 
@@ -195,7 +194,7 @@ function answerFromResponse(
 
 /**
  * Fold one answer into the draft. Returns `advance` while questions remain and `submit` with the
- * encoded group once the last one lands; null when the response does not answer this prompt step.
+ * whole group once the last one lands; null when the response does not answer this prompt step.
  */
 export function advanceGroupedQuestion(args: {
   response: string
@@ -218,6 +217,6 @@ export function advanceGroupedQuestion(args: {
   }
   // Never send a group the host would refuse — the user would see a silent failure with no way back.
   return isValidAgentSessionQuestionAnswers(args.questions, answers)
-    ? { kind: 'submit', optionId: encodeAgentSessionQuestionAnswers(answers) }
+    ? { kind: 'submit', answers }
     : null
 }
diff --git a/mobile/src/session/mobile-structured-operation-id-retirement.test.ts b/mobile/src/session/mobile-structured-operation-id-retirement.test.ts
index 6c8b50e33b86..82ccd1e19dc6 100644
--- a/mobile/src/session/mobile-structured-operation-id-retirement.test.ts
+++ b/mobile/src/session/mobile-structured-operation-id-retirement.test.ts
@@ -131,3 +131,102 @@ describe('structured Stop after an unknown outcome', () => {
     expect(operationIds.size).toBe(1)
   })
 })
+
+describe('what a structured refusal says on the phone', () => {
+  it("replaces the host's diagnostic with words a person can act on", async () => {
+    const result = await requestStructuredAgentSessionMutation({
+      client: fakeClient(async () => ({
+        ok: true,
+        result: {
+          ok: false,
+          refusal: {
+            code: 'agent_session_checkpoint_stale',
+            message: 'Expected runtime fence 1; the session is at 3.'
+          }
+        },
+        _meta: { runtimeId: 'runtime-1' }
+      })),
+      method: 'agentSession.send',
+      fingerprintMethod: 'agentSession.send',
+      sessionId: 'session-1',
+      expectedRuntimeFence: 1,
+      fields: { body: 'hello' },
+      clientOperationId: `1900000000000-${'c'.repeat(32)}`
+    })
+
+    expect(result).toEqual({
+      status: 'refused',
+      code: 'agent_session_checkpoint_stale',
+      message: 'Your message was not sent. Send it again.'
+    })
+  })
+
+  it('says what the host named as the reason, in the same words as desktop', async () => {
+    const result = await requestStructuredAgentSessionMutation({
+      client: fakeClient(async () => ({
+        ok: true,
+        result: {
+          ok: false,
+          refusal: {
+            code: 'agent_session_operation_invalid',
+            message: 'This conversation has been cleared. Use the current conversation.',
+            details: { reason: 'conversationCleared' }
+          }
+        },
+        _meta: { runtimeId: 'runtime-1' }
+      })),
+      method: 'agentSession.send',
+      fingerprintMethod: 'agentSession.send',
+      sessionId: 'session-1',
+      expectedRuntimeFence: 1,
+      fields: { body: 'hello' },
+      clientOperationId: `1900000000000-${'e'.repeat(32)}`
+    })
+
+    expect(result).toEqual({
+      status: 'refused',
+      code: 'agent_session_operation_invalid',
+      message:
+        'This conversation has been cleared. Your message was not sent. Open the current conversation to continue.'
+    })
+  })
+
+  const stop = {
+    method: 'agentSession.cancel',
+    fingerprintMethod: 'agentSession.cancel',
+    sessionId: 'session-1',
+    expectedRuntimeFence: 1,
+    fields: { turnId: 'turn-1' },
+    clientOperationId: `1900000000000-${'d'.repeat(32)}`
+  }
+
+  it("keeps a failed request's transport text off the screen", async () => {
+    const result = await requestStructuredAgentSessionMutation({
+      ...stop,
+      client: fakeClient(async () => {
+        throw new Error('ECONNRESET 10.0.0.2:443')
+      })
+    })
+
+    expect(result).toEqual({
+      status: 'failed',
+      message: "The agent wasn't stopped."
+    })
+  })
+
+  it("keeps the host's text off the screen when it turns the request away unrun", async () => {
+    const result = await requestStructuredAgentSessionMutation({
+      ...stop,
+      client: fakeClient(async () => ({
+        ok: false,
+        error: { code: 'method_not_found', message: 'Unknown method: agentSession.cancel' },
+        _meta: { runtimeId: 'runtime-1' }
+      }))
+    })
+
+    expect(result).toEqual({
+      status: 'failed',
+      message: "The Orca running this chat doesn't support this. Update Orca, then try again."
+    })
+  })
+})
diff --git a/mobile/src/session/mobile-structured-send-delivery.test.ts b/mobile/src/session/mobile-structured-send-delivery.test.ts
index 614cadac391e..dec553693443 100644
--- a/mobile/src/session/mobile-structured-send-delivery.test.ts
+++ b/mobile/src/session/mobile-structured-send-delivery.test.ts
@@ -58,7 +58,7 @@ describe('mobileStructuredSendDelivery', () => {
     ).toEqual({
       outcome: 'rejected',
       operationIdSpent: true,
-      error: "Couldn't reach the agent. Your message was not sent — Retry to send it again."
+      error: "Orca couldn't reach the agent. Your message was not sent. Send it again."
     })
   })
 
@@ -94,13 +94,16 @@ describe('mobileStructuredSendDelivery', () => {
         message: 'Outcome unknown'
       })
     ).toEqual({ outcome: 'unknown', operationIdSpent: false, error: null })
-    expect(mobileStructuredSendDelivery({ status: 'failed', message: 'Request not sent' })).toEqual(
-      {
-        outcome: 'rejected',
-        operationIdSpent: true,
-        error: 'Message not sent'
-      }
-    )
+    expect(
+      mobileStructuredSendDelivery({
+        status: 'failed',
+        message: 'Your message was not sent. Send it again.'
+      })
+    ).toEqual({
+      outcome: 'rejected',
+      operationIdSpent: true,
+      error: 'Your message was not sent. Send it again.'
+    })
   })
 
   it('never releases an ambiguous id on a later RPC refusal or failure', () => {
@@ -115,8 +118,15 @@ describe('mobileStructuredSendDelivery', () => {
       )
     ).toEqual({ outcome: 'rejected', operationIdSpent: false, error: 'Operation expired' })
     expect(
-      mobileStructuredSendDelivery({ status: 'failed', message: 'Request not sent' }, true)
-    ).toEqual({ outcome: 'rejected', operationIdSpent: false, error: 'Message not sent' })
+      mobileStructuredSendDelivery(
+        { status: 'failed', message: 'Your message was not sent. Send it again.' },
+        true
+      )
+    ).toEqual({
+      outcome: 'rejected',
+      operationIdSpent: false,
+      error: 'Your message was not sent. Send it again.'
+    })
   })
 
   it('fails closed when an invalid host response omits the required submission', () => {
diff --git a/mobile/src/session/mobile-structured-send-delivery.ts b/mobile/src/session/mobile-structured-send-delivery.ts
index 70f8a8f0d3d7..b8d0246f5e7a 100644
--- a/mobile/src/session/mobile-structured-send-delivery.ts
+++ b/mobile/src/session/mobile-structured-send-delivery.ts
@@ -57,7 +57,7 @@ export function mobileStructuredSendDelivery(
     return {
       outcome: 'rejected',
       operationIdSpent: !retained,
-      error: result.message === 'Request not sent' ? 'Message not sent' : result.message
+      error: result.message
     }
   }
   const submission = result.value.submission as AgentSessionSendResult['submission'] | undefined
@@ -68,7 +68,7 @@ export function mobileStructuredSendDelivery(
     return {
       outcome: 'rejected',
       operationIdSpent: true,
-      error: structuredAgentSessionRejectionNotice(submission.reason)
+      error: structuredAgentSessionRejectionNotice(submission.reason, 'composer-send')
     }
   }
   if (retained) {
diff --git a/mobile/src/session/mobile-terminal-viewport-resubscribe.test.ts b/mobile/src/session/mobile-terminal-viewport-resubscribe.test.ts
index 35aac89f6f88..752d20169795 100644
--- a/mobile/src/session/mobile-terminal-viewport-resubscribe.test.ts
+++ b/mobile/src/session/mobile-terminal-viewport-resubscribe.test.ts
@@ -239,6 +239,7 @@ describe('runTerminalViewportFitPass', () => {
     viewportMeasured?: boolean
     viewport?: { cols: number; rows: number } | null
     measured?: { cols: number; rows: number } | null
+    sentViewport?: { cols: number; rows: number } | null
     budget?: TerminalViewportResubscribeBudget
   }) {
     const budget = overrides.budget ?? new TerminalViewportResubscribeBudget()
@@ -251,7 +252,7 @@ describe('runTerminalViewportFitPass', () => {
     const scheduled: { fn: () => void; ms: number }[] = []
     const webView = {
       awaitReady: () => Promise.resolve(),
-      measureFitDimensions: () => Promise.resolve(overrides.measured ?? PHONE)
+      fitDimensions: () => (overrides.measured === undefined ? PHONE : overrides.measured)
     }
     const unsubscribeTerminal = vi.fn((handle: string) => {
       terminalUnsubsRef.current.delete(handle)
@@ -266,6 +267,7 @@ describe('runTerminalViewportFitPass', () => {
       seq: 1,
       hostCols: overrides.hostCols ?? null,
       hostRows: overrides.hostRows ?? null,
+      sentViewport: overrides.sentViewport ?? null,
       budget,
       diagnostics,
       viewportRef: { current: overrides.viewport ?? null },
@@ -273,7 +275,7 @@ describe('runTerminalViewportFitPass', () => {
       subscribeSeqRef: { current: new Map([[HANDLE, 1]]) },
       initializedHandlesRef: { current: new Set([HANDLE]) },
       terminalUnsubsRef,
-      terminalFrameHeightRef: { current: 0 },
+      terminalFrameRef: { current: { width: 390, height: 600 } },
       getTerminalRef: () => webView,
       unsubscribeTerminal,
       subscribeToTerminal,
@@ -313,6 +315,38 @@ describe('runTerminalViewportFitPass', () => {
     expect(h.budget.attempts(HANDLE)).toBe(1)
   })
 
+  it('re-measures a stale sent viewport after the flag was cleared, and resubscribes at the phone size', async () => {
+    const stale = { cols: 80, rows: 30 }
+    const h = makeHarness({
+      hostCols: stale.cols,
+      hostRows: stale.rows,
+      viewportMeasured: false,
+      viewport: stale,
+      sentViewport: stale,
+      measured: PHONE
+    })
+    runTerminalViewportFitPass(h.args)
+    await settle()
+    expect(h.unsubscribeTerminal).toHaveBeenCalledTimes(1)
+    expect(h.subscribeToTerminal).toHaveBeenCalledTimes(1)
+    expect(h.args.viewportRef.current).toEqual(PHONE)
+  })
+
+  it('re-measures locally and skips the round trip when the host matches the viewport the subscribe carried', async () => {
+    const h = makeHarness({
+      hostCols: PHONE.cols,
+      hostRows: PHONE.rows,
+      viewportMeasured: false,
+      viewport: PHONE,
+      sentViewport: PHONE
+    })
+    runTerminalViewportFitPass(h.args)
+    await settle()
+    expect(h.unsubscribeTerminal).not.toHaveBeenCalled()
+    expect(h.subscribeToTerminal).not.toHaveBeenCalled()
+    expect(h.budget.attempts(HANDLE)).toBe(0)
+  })
+
   it('treats an equal fresh measure as convergence instead of resubscribing', async () => {
     const budget = new TerminalViewportResubscribeBudget()
     budget.chargeAttempt(HANDLE)
diff --git a/mobile/src/session/mobile-terminal-viewport-resubscribe.ts b/mobile/src/session/mobile-terminal-viewport-resubscribe.ts
index 175eb9d92b88..f0fc70a13334 100644
--- a/mobile/src/session/mobile-terminal-viewport-resubscribe.ts
+++ b/mobile/src/session/mobile-terminal-viewport-resubscribe.ts
@@ -2,6 +2,7 @@
  *  frame dims can never equal the phone viewport must not re-arm the stream
  *  forever — it broke gesture recognition and drained battery at ~25 cycles/s. */
 
+import type { TerminalFrame } from '../terminal/terminal-webview-messages'
 import type { MobileTerminalDiagnostics } from './mobile-terminal-diagnostics'
 
 export const MAX_TERMINAL_VIEWPORT_RESUBSCRIBE_ATTEMPTS = 3
@@ -173,11 +174,11 @@ export class TerminalViewportResubscribeBudget {
   }
 }
 
-type MutableRef<T> = { current: T }
+export type MutableRef<T> = { current: T }
 
 type TerminalFitWebView = {
   awaitReady: () => Promise<unknown>
-  measureFitDimensions: (frameHeight?: number) => Promise<TerminalViewportDims | null | undefined>
+  fitDimensions: (frame: { width: number; height: number }) => TerminalViewportDims | null
 }
 
 export type TerminalViewportFitPassArgs = {
@@ -185,6 +186,8 @@ export type TerminalViewportFitPassArgs = {
   seq: number
   hostCols: number | null
   hostRows: number | null
+  /** The viewport this subscribe carried; null when it went without one. */
+  sentViewport: TerminalViewportDims | null
   budget: TerminalViewportResubscribeBudget
   diagnostics: Pick<
     MobileTerminalDiagnostics,
@@ -195,7 +198,7 @@ export type TerminalViewportFitPassArgs = {
   subscribeSeqRef: MutableRef<Map<string, number>>
   initializedHandlesRef: MutableRef<Set<string>>
   terminalUnsubsRef: MutableRef<Map<string, () => void>>
-  terminalFrameHeightRef: MutableRef<number>
+  terminalFrameRef: MutableRef<TerminalFrame | null>
   getTerminalRef: (handle: string | null) => TerminalFitWebView | undefined
   unsubscribeTerminal: (handle: string) => void
   subscribeToTerminal: (handle: string) => void
@@ -230,9 +233,10 @@ export function runTerminalViewportFitPass(args: TerminalViewportFitPassArgs): v
     }
     return
   }
-  const viewportWasMeasured = args.viewportMeasuredRef.current
+  // Why: a subscribe that carried a viewport already told the host one; a fresh measure that matches it needs no round trip.
+  const viewportWasMeasured = args.viewportMeasuredRef.current || args.sentViewport != null
   void (async () => {
-    // Why: wait for init()'s rAF chain before measuring, else the measure races ahead and returns null (log dump 2026-05-06).
+    // Why: wait for init()'s rAF chain, which reports the box the fit reads (log dump 2026-05-06).
     await args.getTerminalRef(handle)?.awaitReady()
     if (
       args.subscribeSeqRef.current.get(handle) !== seq ||
@@ -240,17 +244,9 @@ export function runTerminalViewportFitPass(args: TerminalViewportFitPassArgs): v
     ) {
       return
     }
-    const dims = await args
-      .getTerminalRef(handle)
-      ?.measureFitDimensions(args.terminalFrameHeightRef.current || undefined)
-    // Why: re-check seq — the awaits may have let a newer subscribe cycle arm; tearing it down would resubscribe a stale generation.
-    if (
-      args.subscribeSeqRef.current.get(handle) !== seq ||
-      !budget.isRetryGenerationCurrent(handle, retryGeneration)
-    ) {
-      return
-    }
-    if (!args.getTerminalRef(handle) || !dims) {
+    const frame = args.terminalFrameRef.current
+    const dims = frame ? args.getTerminalRef(handle)?.fitDimensions(frame) : null
+    if (!dims) {
       return
     }
     args.viewportRef.current = dims
diff --git a/mobile/src/session/mobile-worker-takeover-send-sites.test.ts b/mobile/src/session/mobile-worker-takeover-send-sites.test.ts
index 1c13100e1c87..d018495fdfa5 100644
--- a/mobile/src/session/mobile-worker-takeover-send-sites.test.ts
+++ b/mobile/src/session/mobile-worker-takeover-send-sites.test.ts
@@ -110,13 +110,14 @@ function mountSendSites(client: ReturnType<typeof clientFixture>, handle = 'term
       onSuccess: vi.fn(),
       refreshCanPaste: vi.fn()
     } as never)
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: untyped vi.fn() stubs stand in for callbacks whose returns the send path never reads.
     diff = useMobileDiffReviewSendActions({
       client: client as unknown as RpcClient,
       connState: 'connected',
       worktreeId: 'workspace',
       screenState: { kind: 'loading' },
       setActionError: vi.fn(),
-      setSendSheet: vi.fn(),
+      sheets: { openSheet: vi.fn(), closeSheet: vi.fn(), updateSendSheet: vi.fn() },
       saveCommentsAndReviewState: vi.fn()
     } as never)
     return null
diff --git a/mobile/src/session/use-mobile-diff-review-comment-actions.ts b/mobile/src/session/use-mobile-diff-review-comment-actions.ts
index d49350f1519f..b5e2df91e169 100644
--- a/mobile/src/session/use-mobile-diff-review-comment-actions.ts
+++ b/mobile/src/session/use-mobile-diff-review-comment-actions.ts
@@ -21,6 +21,7 @@ import {
   nextReviewIndexAfterMarkReviewed,
   reviewDescriptorFromItem
 } from './mobile-diff-review-screen-model'
+import type { ReviewSheetIntents } from './mobile-diff-review-sheets'
 
 type CommentActionsInput = {
   client: RpcClient | null
@@ -36,10 +37,9 @@ type CommentActionsInput = {
   composerBody: string
   setScreenState: Dispatch<SetStateAction<ReviewScreenState>>
   setCurrentIndex: Dispatch<SetStateAction<number>>
-  setComposer: Dispatch<SetStateAction<ComposerState | null>>
   setComposerBody: Dispatch<SetStateAction<string>>
   setActionError: Dispatch<SetStateAction<string | null>>
-  setShowCompletion: Dispatch<SetStateAction<boolean>>
+  sheets: Pick<ReviewSheetIntents, 'openSheet' | 'openSheetWhenIdle' | 'closeSheet'>
 }
 
 export function useMobileDiffReviewCommentActions(input: CommentActionsInput) {
@@ -57,11 +57,11 @@ export function useMobileDiffReviewCommentActions(input: CommentActionsInput) {
     composerBody,
     setScreenState,
     setCurrentIndex,
-    setComposer,
     setComposerBody,
     setActionError,
-    setShowCompletion
+    sheets
   } = input
+  const { openSheet, openSheetWhenIdle, closeSheet } = sheets
 
   const persistMetadata = useCallback(
     async (comments: readonly DiffComment[], reviewState: MobileDiffReviewState) => {
@@ -109,24 +109,24 @@ export function useMobileDiffReviewCommentActions(input: CommentActionsInput) {
 
   const openComposer = useCallback(
     (lineNumber: number) => {
-      setComposer({ mode: 'create', lineNumber })
+      openSheet({ kind: 'composer', composer: { mode: 'create', lineNumber } })
       setComposerBody('')
     },
-    [setComposer, setComposerBody]
+    [openSheet, setComposerBody]
   )
 
   const openEditComposer = useCallback(
     (comment: DiffComment) => {
-      setComposer({ mode: 'edit', comment })
+      openSheet({ kind: 'composer', composer: { mode: 'edit', comment } })
       setComposerBody(comment.body)
     },
-    [setComposer, setComposerBody]
+    [openSheet, setComposerBody]
   )
 
   const closeComposer = useCallback(() => {
-    setComposer(null)
+    closeSheet('composer')
     setComposerBody('')
-  }, [setComposer, setComposerBody])
+  }, [closeSheet, setComposerBody])
 
   const saveComposer = useCallback(async () => {
     if (!composer || !currentItem || screenState.kind !== 'ready') {
@@ -201,18 +201,19 @@ export function useMobileDiffReviewCommentActions(input: CommentActionsInput) {
     if (nextIndex !== null) {
       setCurrentIndex(nextIndex)
     } else {
-      setShowCompletion(true)
+      // Why: the save can outlast a sheet the user opened meanwhile; never stack on or close it.
+      openSheetWhenIdle({ kind: 'completion' })
     }
   }, [
     currentIndex,
     currentItem,
     filter,
     filteredQueue,
+    openSheetWhenIdle,
     queue,
     saveCommentsAndReviewState,
     screenState,
-    setCurrentIndex,
-    setShowCompletion
+    setCurrentIndex
   ])
 
   const markUnreviewed = useCallback(async () => {
diff --git a/mobile/src/session/use-mobile-diff-review-controller.ts b/mobile/src/session/use-mobile-diff-review-controller.ts
index 1efab1fe4ee7..3ce6481dc2db 100644
--- a/mobile/src/session/use-mobile-diff-review-controller.ts
+++ b/mobile/src/session/use-mobile-diff-review-controller.ts
@@ -1,4 +1,4 @@
-import { useCallback, useEffect, useMemo, useRef, useState } from 'react'
+import { useCallback, useEffect, useMemo, useReducer, useRef, useState } from 'react'
 import type { FlatList } from 'react-native'
 import type { DiffComment } from '../../../src/shared/diff-comment-types'
 import type { ConnectionState } from '../transport/types'
@@ -10,8 +10,7 @@ import {
   filterMobileDiffReviewQueue,
   mobileDiffReviewCommentMatchesItem,
   summarizeMobileDiffReviewQueue,
-  type MobileDiffReviewQueueFilter,
-  type MobileDiffReviewQueueItem
+  type MobileDiffReviewQueueFilter
 } from './mobile-diff-review-queue'
 import {
   findMobileDiffReviewInitialIndex,
@@ -20,12 +19,13 @@ import {
 import { loadMobileDiffReviewSnapshot } from './mobile-diff-review-loaders'
 import { useMobileDiffReviewDiffLoading } from './use-mobile-diff-review-diff-loading'
 import { canOpenMobileBranchCompareDiff } from '../source-control/mobile-branch-compare'
-import type {
-  ComposerState,
-  ReviewDiffLine,
-  ReviewScreenState,
-  SendSheetState
-} from './mobile-diff-review-screen-model'
+import type { ReviewDiffLine, ReviewScreenState } from './mobile-diff-review-screen-model'
+import {
+  NO_REVIEW_SHEETS,
+  reduceReviewSheets,
+  reviewComposer,
+  reviewSheetIntents
+} from './mobile-diff-review-sheets'
 import { useMobileDiffReviewInteractions } from './use-mobile-diff-review-interactions'
 import { useMobilePrSidebarController } from './use-mobile-pr-sidebar-controller'
 
@@ -62,14 +62,12 @@ export function useMobileDiffReviewController(input: ControllerInput) {
   const [filter, setFilter] = useState<MobileDiffReviewQueueFilter>(initialFilter)
   const [currentIndex, setCurrentIndex] = useState(0)
   const [activeHunkIndex, setActiveHunkIndex] = useState<number | null>(null)
-  const [composer, setComposer] = useState<ComposerState | null>(null)
+  const [sheets, dispatchSheets] = useReducer(reduceReviewSheets, NO_REVIEW_SHEETS)
+  const sheetIntents = useMemo(() => reviewSheetIntents(dispatchSheets), [])
+  const composer = reviewComposer(sheets)
   const [composerBody, setComposerBody] = useState('')
   const [actionError, setActionError] = useState<string | null>(null)
   const [busyAction, setBusyAction] = useState<string | null>(null)
-  const [discardTarget, setDiscardTarget] = useState<MobileDiffReviewQueueItem | null>(null)
-  const [showOverflow, setShowOverflow] = useState(false)
-  const [sendSheet, setSendSheet] = useState<SendSheetState | null>(null)
-  const [showCompletion, setShowCompletion] = useState(false)
   const worktreeLabel = getWorktreeLabel(name, worktreeId)
 
   const loadReviewData = useCallback(async () => {
@@ -244,12 +242,10 @@ export function useMobileDiffReviewController(input: ControllerInput) {
     setFilter,
     setCurrentIndex,
     setActiveHunkIndex,
-    setComposer,
     setComposerBody,
     setActionError,
     setBusyAction,
-    setSendSheet,
-    setShowCompletion,
+    sheets: sheetIntents,
     loadReviewData,
     onOpenSession,
     onReconnect
@@ -258,6 +254,7 @@ export function useMobileDiffReviewController(input: ControllerInput) {
   return {
     ...interactions,
     ...prSidebar,
+    ...sheetIntents,
     // Exposed so the screen can thread the RPC client + worktree into the PR
     // sidebar's lazy check-detail fetches (U5) and mutation actions (U6).
     client,
@@ -274,7 +271,6 @@ export function useMobileDiffReviewController(input: ControllerInput) {
     currentIndex,
     currentItem,
     diffState,
-    discardTarget,
     fileNotes: commentsByLine.get(0) ?? [],
     filter,
     filteredQueue,
@@ -283,14 +279,8 @@ export function useMobileDiffReviewController(input: ControllerInput) {
     reviewedCount,
     reviewedUnstagedCount,
     screenState,
-    sendSheet,
     setComposerBody,
-    setDiscardTarget,
-    setSendSheet,
-    setShowCompletion,
-    setShowOverflow,
-    showCompletion,
-    showOverflow,
+    sheet: sheets.requested,
     staleCommentIds,
     unsentComments,
     worktreeLabel
diff --git a/mobile/src/session/use-mobile-diff-review-interactions.ts b/mobile/src/session/use-mobile-diff-review-interactions.ts
index 53dc69fadad2..1f8c78e1f195 100644
--- a/mobile/src/session/use-mobile-diff-review-interactions.ts
+++ b/mobile/src/session/use-mobile-diff-review-interactions.ts
@@ -12,9 +12,9 @@ import type {
   ComposerState,
   ReviewDiffLine,
   ReviewDiffState,
-  ReviewScreenState,
-  SendSheetState
+  ReviewScreenState
 } from './mobile-diff-review-screen-model'
+import type { ReviewSheetIntents } from './mobile-diff-review-sheets'
 import { sourceFileDiffOpenRun } from '../source-control/mobile-source-file-open-operations'
 import { refusedRpcMessageOrFallback } from '../transport/rpc-refusal-message'
 import { useMobileDiffReviewCommentActions } from './use-mobile-diff-review-comment-actions'
@@ -42,12 +42,10 @@ type InteractionInput = {
   setFilter: Dispatch<SetStateAction<MobileDiffReviewQueueFilter>>
   setCurrentIndex: Dispatch<SetStateAction<number>>
   setActiveHunkIndex: Dispatch<SetStateAction<number | null>>
-  setComposer: Dispatch<SetStateAction<ComposerState | null>>
   setComposerBody: Dispatch<SetStateAction<string>>
   setActionError: Dispatch<SetStateAction<string | null>>
   setBusyAction: Dispatch<SetStateAction<string | null>>
-  setSendSheet: Dispatch<SetStateAction<SendSheetState | null>>
-  setShowCompletion: Dispatch<SetStateAction<boolean>>
+  sheets: ReviewSheetIntents
   loadReviewData: () => Promise<void>
   onOpenSession: () => void
   onReconnect: ((hostId: string) => void | Promise<void>) | null
@@ -74,12 +72,10 @@ export function useMobileDiffReviewInteractions(input: InteractionInput) {
     setFilter,
     setCurrentIndex,
     setActiveHunkIndex,
-    setComposer,
     setComposerBody,
     setActionError,
     setBusyAction,
-    setSendSheet,
-    setShowCompletion,
+    sheets,
     loadReviewData,
     onOpenSession,
     onReconnect
@@ -108,10 +104,9 @@ export function useMobileDiffReviewInteractions(input: InteractionInput) {
     composerBody,
     setScreenState,
     setCurrentIndex,
-    setComposer,
     setComposerBody,
     setActionError,
-    setShowCompletion
+    sheets
   })
 
   const { runGitMutation, stageReviewedFiles } = useMobileDiffReviewGitActions({
@@ -131,7 +126,7 @@ export function useMobileDiffReviewInteractions(input: InteractionInput) {
       worktreeId,
       screenState,
       setActionError,
-      setSendSheet,
+      sheets,
       saveCommentsAndReviewState
     })
 
diff --git a/mobile/src/session/use-mobile-diff-review-send-actions.test.ts b/mobile/src/session/use-mobile-diff-review-send-actions.test.ts
index f763a8f30789..ab41abb6b4bd 100644
--- a/mobile/src/session/use-mobile-diff-review-send-actions.test.ts
+++ b/mobile/src/session/use-mobile-diff-review-send-actions.test.ts
@@ -1,9 +1,10 @@
 import { createElement } from 'react'
 import { act, create, type ReactTestRenderer } from 'react-test-renderer'
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { afterEach, beforeEach, describe, expect, it, vi, type Mock } from 'vitest'
 import type { DiffComment } from '../../../src/shared/diff-comment-types'
 import type { RpcClient } from '../transport/rpc-client'
 import type { ReviewScreenState } from './mobile-diff-review-screen-model'
+import type { ReviewSheetIntents } from './mobile-diff-review-sheets'
 import {
   isMobileNativeChatInputStale,
   markMobileNativeChatInputStale,
@@ -51,14 +52,18 @@ describe('useMobileDiffReviewSendActions', () => {
   let actions: SendActions | null = null
   let mountedClient: RpcClient | null = null
   let setActionError: ReturnType<typeof vi.fn>
-  let setSendSheet: ReturnType<typeof vi.fn>
+  let sheets: {
+    openSheet: Mock<ReviewSheetIntents['openSheet']>
+    closeSheet: Mock<ReviewSheetIntents['closeSheet']>
+    updateSendSheet: Mock<ReviewSheetIntents['updateSendSheet']>
+  }
   let saveCommentsAndReviewState: ReturnType<typeof vi.fn>
 
   beforeEach(() => {
     clipboardMock.setStringAsync.mockReset().mockResolvedValue(true)
     resetMobileNativeChatStaleInputForTests()
     setActionError = vi.fn()
-    setSendSheet = vi.fn()
+    sheets = { openSheet: vi.fn(), closeSheet: vi.fn(), updateSendSheet: vi.fn() }
     saveCommentsAndReviewState = vi.fn().mockResolvedValue(undefined)
   })
 
@@ -76,7 +81,7 @@ describe('useMobileDiffReviewSendActions', () => {
       worktreeId: 'wt-1',
       screenState: READY,
       setActionError,
-      setSendSheet,
+      sheets,
       saveCommentsAndReviewState
     })
     return null
@@ -158,7 +163,7 @@ describe('useMobileDiffReviewSendActions', () => {
     expect(sendRequest.mock.calls[0]?.[1]).toMatchObject({ text: '\x15', enter: false })
     expect(saveCommentsAndReviewState).not.toHaveBeenCalled()
     expect(setActionError).not.toHaveBeenCalled()
-    expect(setSendSheet).not.toHaveBeenCalled()
+    expect(sheets.closeSheet).not.toHaveBeenCalled()
     // Marker survives for the next attempt.
     expect(isMobileNativeChatInputStale('terminal-1')).toBe(true)
   })
@@ -192,7 +197,7 @@ describe('useMobileDiffReviewSendActions', () => {
     expect(sendRequest.mock.calls[0]?.[1]).toMatchObject({ terminal: 'terminal-1', enter: true })
     expect(saveCommentsAndReviewState).toHaveBeenCalledTimes(1)
     expect(setActionError).toHaveBeenCalledWith('Review notes sent')
-    expect(setSendSheet).toHaveBeenCalledWith(null)
+    expect(sheets.closeSheet).toHaveBeenCalledWith('send')
   })
 
   it('only heals the terminal that was marked', async () => {
diff --git a/mobile/src/session/use-mobile-diff-review-send-actions.ts b/mobile/src/session/use-mobile-diff-review-send-actions.ts
index 8413cf61c36f..90ddd591300d 100644
--- a/mobile/src/session/use-mobile-diff-review-send-actions.ts
+++ b/mobile/src/session/use-mobile-diff-review-send-actions.ts
@@ -13,7 +13,8 @@ import {
 } from './mobile-review-terminal-operations'
 import { interpretOrThrowRefusalMessage } from '../transport/rpc-refusal-message'
 import { healMobileNativeChatStaleInput } from './mobile-native-chat-stale-input'
-import type { ReviewScreenState, SendSheetState } from './mobile-diff-review-screen-model'
+import type { ReviewScreenState } from './mobile-diff-review-screen-model'
+import type { ReviewSheetIntents } from './mobile-diff-review-sheets'
 
 type SendActionsInput = {
   client: RpcClient | null
@@ -21,7 +22,7 @@ type SendActionsInput = {
   worktreeId: string
   screenState: ReviewScreenState
   setActionError: Dispatch<SetStateAction<string | null>>
-  setSendSheet: Dispatch<SetStateAction<SendSheetState | null>>
+  sheets: Pick<ReviewSheetIntents, 'openSheet' | 'closeSheet' | 'updateSendSheet'>
   saveCommentsAndReviewState: (
     comments: DiffComment[],
     reviewState: MobileDiffReviewState
@@ -38,9 +39,10 @@ export function useMobileDiffReviewSendActions(input: SendActionsInput) {
     worktreeId,
     screenState,
     setActionError,
-    setSendSheet,
+    sheets,
     saveCommentsAndReviewState
   } = input
+  const { openSheet, closeSheet, updateSendSheet } = sheets
 
   const copyNotes = useCallback(async () => {
     if (screenState.kind !== 'ready' || screenState.comments.length === 0) {
@@ -107,9 +109,9 @@ export function useMobileDiffReviewSendActions(input: SendActionsInput) {
       await markNotesSent(comments)
       triggerSuccess()
       setActionError('Review notes sent')
-      setSendSheet(null)
+      closeSheet('send')
     },
-    [client, connState, markNotesSent, setActionError, setSendSheet]
+    [client, connState, closeSheet, markNotesSent, setActionError]
   )
 
   const createTerminalAndSend = useCallback(
@@ -138,7 +140,7 @@ export function useMobileDiffReviewSendActions(input: SendActionsInput) {
       setActionError('Waiting for desktop...')
       return
     }
-    setSendSheet({ kind: 'loading' })
+    openSheet({ kind: 'send', load: { kind: 'loading' } })
     try {
       const response = await reviewTerminalListRead.request(client, {
         worktree: `id:${worktreeId}`
@@ -148,15 +150,15 @@ export function useMobileDiffReviewSendActions(input: SendActionsInput) {
         () => reviewTerminalListRead.interpret(response),
         'Unable to load agent sessions'
       )
-      setSendSheet({ kind: 'ready', terminals })
+      updateSendSheet({ kind: 'ready', terminals })
     } catch (err) {
-      setSendSheet({
+      updateSendSheet({
         kind: 'error',
         message: err instanceof Error ? err.message : 'Unable to load agent sessions',
         terminals: []
       })
     }
-  }, [client, connState, setActionError, setSendSheet, worktreeId])
+  }, [client, connState, openSheet, setActionError, updateSendSheet, worktreeId])
 
   return {
     clearSentNotes,
diff --git a/mobile/src/session/use-mobile-native-chat-controller.ts b/mobile/src/session/use-mobile-native-chat-controller.ts
index a3a49e53552a..dfefcf476279 100644
--- a/mobile/src/session/use-mobile-native-chat-controller.ts
+++ b/mobile/src/session/use-mobile-native-chat-controller.ts
@@ -2,6 +2,7 @@ import { useLayoutEffect, useRef, type MutableRefObject } from 'react'
 import type { RpcClient } from '../transport/rpc-client'
 import type { ConnectionState } from '../transport/types'
 import type { MobileNativeChatTab } from './mobile-native-chat-eligibility'
+import type { StructuredAgentSessionHostSupport } from './mobile-structured-agent-session-host-support'
 import { useMobileNativeChatAskDismiss } from './use-mobile-native-chat-ask-dismiss'
 import { useMobileNativeChatDrafts } from './use-mobile-native-chat-drafts'
 import { useMobileNativeChatFileSearch } from './use-mobile-native-chat-file-search'
@@ -36,7 +37,7 @@ export function useMobileNativeChatController(args: {
   /** Live socket state; the lease collapses on disconnect but one render later. */
   connState: ConnectionState
   /** Host capability fact from the shared runtime status probe. */
-  agentSessionPromptCancelSupported?: boolean | null
+  agentSessionHostSupport?: StructuredAgentSessionHostSupport | null
   onSendError: (message: string) => void
   /** Retires a held failure banner. Any accepted chat write clears it — a delivered
    *  answer or permission reply must not sit under a stale "not sent". */
@@ -53,7 +54,7 @@ export function useMobileNativeChatController(args: {
     nativeChatTranscriptIsLocalReadable,
     nativeChatInputLeaseReady,
     connState,
-    agentSessionPromptCancelSupported = null,
+    agentSessionHostSupport = null,
     onSendError,
     onSendResolved
   } = args
@@ -93,7 +94,7 @@ export function useMobileNativeChatController(args: {
       callerIdentity: deviceTokenRef.current ?? '',
       enabled: showNativeChat,
       connState,
-      promptCancelSupported: agentSessionPromptCancelSupported,
+      hostSupport: agentSessionHostSupport,
       onSendError
     })
   const {
diff --git a/mobile/src/session/use-mobile-native-chat-session-lane.ts b/mobile/src/session/use-mobile-native-chat-session-lane.ts
index bfeb1b069453..147cf017ac0e 100644
--- a/mobile/src/session/use-mobile-native-chat-session-lane.ts
+++ b/mobile/src/session/use-mobile-native-chat-session-lane.ts
@@ -1,5 +1,6 @@
 import type { RpcClient } from '../transport/rpc-client'
 import type { ConnectionState } from '../transport/types'
+import type { StructuredAgentSessionHostSupport } from './mobile-structured-agent-session-host-support'
 import { useMobileNativeChatSession } from './use-mobile-native-chat-session'
 import { useMobileStructuredAgentSession } from './use-mobile-structured-agent-session'
 
@@ -15,7 +16,7 @@ export function useMobileNativeChatSessionLane({
   sessionId,
   sourceIdentity,
   callerIdentity,
-  promptCancelSupported,
+  hostSupport,
   enabled,
   connState,
   onSendError
@@ -30,7 +31,7 @@ export function useMobileNativeChatSessionLane({
   sessionId: string | null
   sourceIdentity: Parameters<typeof useMobileNativeChatSession>[0]['sourceIdentity']
   callerIdentity: string
-  promptCancelSupported?: boolean | null
+  hostSupport: StructuredAgentSessionHostSupport | null
   enabled: boolean
   connState: ConnectionState
   onSendError: (message: string) => void
@@ -50,7 +51,7 @@ export function useMobileNativeChatSessionLane({
     sessionId: structured ? sessionId : null,
     sourceIdentity,
     callerIdentity,
-    promptCancelSupported,
+    hostSupport,
     enabled,
     // Holds are connection-scoped; dropping this on transport loss lets the hook
     // reacquire the provider without clearing the cached transcript.
diff --git a/mobile/src/session/use-mobile-native-chat-turn-disclosure.test.tsx b/mobile/src/session/use-mobile-native-chat-turn-disclosure.test.tsx
index 33e99bfb6033..3546a568e732 100644
--- a/mobile/src/session/use-mobile-native-chat-turn-disclosure.test.tsx
+++ b/mobile/src/session/use-mobile-native-chat-turn-disclosure.test.tsx
@@ -144,6 +144,38 @@ describe('useMobileNativeChatTurnDisclosure', () => {
     }
   })
 
+  it('keeps the live bar on every render until it settles in place', () => {
+    vi.useFakeTimers()
+    try {
+      vi.setSystemTime(1_000)
+      const messages = [userMessage('u1')]
+      const seen: unknown[] = []
+      function Recorder({ isWorking }: { isWorking: boolean }): React.JSX.Element {
+        const disclosure = useMobileNativeChatTurnDisclosure({
+          messages,
+          enabled: true,
+          isWorking,
+          scopeKey: 'host\0worktree\0tab-a'
+        })
+        seen.push(disclosure.resolveRow(0, messages[0]).turnStatus)
+        return createElement('result', { disclosure })
+      }
+      act(() => {
+        renderer = create(createElement(Recorder, { isWorking: true }))
+      })
+      vi.setSystemTime(6_000)
+      seen.length = 0
+      // No host duration for this turn: the settle is stamped locally, one pass later.
+      act(() => {
+        renderer?.update(createElement(Recorder, { isWorking: false }))
+      })
+      expect(seen).not.toContain(null)
+      expect(seen.at(-1)).toEqual({ startedAt: 1_000, thinking: false, workedSeconds: 5 })
+    } finally {
+      vi.useRealTimers()
+    }
+  })
+
   it('suppresses local duration when the host explicitly cannot verify the end', () => {
     vi.useFakeTimers()
     try {
diff --git a/mobile/src/session/use-mobile-native-chat-turn-disclosure.ts b/mobile/src/session/use-mobile-native-chat-turn-disclosure.ts
index a67a6a886638..4e236d648bec 100644
--- a/mobile/src/session/use-mobile-native-chat-turn-disclosure.ts
+++ b/mobile/src/session/use-mobile-native-chat-turn-disclosure.ts
@@ -104,12 +104,13 @@ export function useMobileNativeChatTurnDisclosure({
   const resolveRow = useCallback(
     (index: number, message: NativeChatMessage): MobileNativeChatTurnRow => {
       const turnKey = turnKeys[index]
+      // The live turn's bar carries its running clock; it settles in place.
       const turnStatus =
-        !enabled || message.role !== 'user'
+        !enabled || message.role !== 'user' || !turnKey
           ? null
-          : turnKey
-            ? (completedByTurn[turnKey] ?? null)
-            : null
+          : turnKey === activeTurnKey
+            ? active
+            : (completedByTurn[turnKey] ?? null)
       return {
         turnStatus,
         turnExpanded: turnKey ? expandedTurnIds.has(turnKey) : false,
@@ -126,7 +127,7 @@ export function useMobileNativeChatTurnDisclosure({
             (turnKey === undefined && activeTurnKey === MOBILE_UNANCHORED_TURN_KEY))
       }
     },
-    [turnKeys, enabled, activeTurnKey, completedByTurn, expandedTurnIds, isWorking]
+    [turnKeys, enabled, activeTurnKey, active, completedByTurn, expandedTurnIds, isWorking]
   )
 
   return {
diff --git a/mobile/src/session/use-mobile-session-accessory-selection.ts b/mobile/src/session/use-mobile-session-accessory-selection.ts
index 7e3cfcfa76cd..a9795d82b1fc 100644
--- a/mobile/src/session/use-mobile-session-accessory-selection.ts
+++ b/mobile/src/session/use-mobile-session-accessory-selection.ts
@@ -8,9 +8,10 @@ import {
   triggerError,
   triggerEdgeBump
 } from '../platform/haptics'
-import type {
-  TerminalKeyboardAvoidanceMetrics,
-  TerminalModes
+import {
+  sameTerminalKeyboardAvoidanceMetrics,
+  type TerminalKeyboardAvoidanceMetrics,
+  type TerminalModes
 } from '../terminal/terminal-webview-contract'
 import type { createTerminalLiveAccessoryInput } from '../terminal/terminal-live-accessory-input'
 import { clearTerminalLiveInputFocusTimer } from '../terminal/terminal-live-input'
@@ -165,13 +166,7 @@ export function useMobileSessionAccessorySelection(scope: MobileSessionTerminalI
     (handle: string, metrics: TerminalKeyboardAvoidanceMetrics) => {
       setTerminalKeyboardMetrics((prev) => {
         const current = prev.get(handle)
-        if (
-          current &&
-          current.cursorY === metrics.cursorY &&
-          current.contentBottomRow === metrics.contentBottomRow &&
-          current.rows === metrics.rows &&
-          current.altScreen === metrics.altScreen
-        ) {
+        if (current && sameTerminalKeyboardAvoidanceMetrics(current, metrics)) {
           return prev
         }
         return new Map(prev).set(handle, metrics)
diff --git a/mobile/src/session/use-mobile-session-feedback-capabilities.ts b/mobile/src/session/use-mobile-session-feedback-capabilities.ts
index f02311893096..ea8d6438bf49 100644
--- a/mobile/src/session/use-mobile-session-feedback-capabilities.ts
+++ b/mobile/src/session/use-mobile-session-feedback-capabilities.ts
@@ -2,6 +2,7 @@ import { useState, useRef, useCallback } from 'react'
 import { Animated } from 'react-native'
 import { reconcileMobileSessionCreateWarningState } from './mobile-session-create-warning-state'
 import type { MobileSessionTerminalRuntimeModel } from './use-mobile-session-terminal-runtime'
+import type { StructuredAgentSessionHostSupport } from './mobile-structured-agent-session-host-support'
 
 export function useMobileSessionFeedbackCapabilities(scope: MobileSessionTerminalRuntimeModel) {
   const {
@@ -32,11 +33,10 @@ export function useMobileSessionFeedbackCapabilities(scope: MobileSessionTermina
     null
   )
   const [quickCommandsSupported, setQuickCommandsSupported] = useState<boolean | null>(null)
-  // Prompt cancellation is negotiated with the same host capability probe as
+  // Structured-session features are negotiated with the same host capability probe as
   // the other session surfaces; consumers never maintain a second status cache.
-  const [agentSessionPromptCancelSupported, setAgentSessionPromptCancelSupported] = useState<
-    boolean | null
-  >(null)
+  const [agentSessionHostSupport, setAgentSessionHostSupport] =
+    useState<StructuredAgentSessionHostSupport | null>(null)
   // Why: stable callbacks (handleFileTap) read the live value via this ref, since
   // the capability probe resolves after the callbacks are created.
   const browserScreencastSupportedRef = useRef(browserScreencastSupported)
@@ -120,8 +120,8 @@ export function useMobileSessionFeedbackCapabilities(scope: MobileSessionTermina
     setAgentSessionHistorySupported,
     quickCommandsSupported,
     setQuickCommandsSupported,
-    agentSessionPromptCancelSupported,
-    setAgentSessionPromptCancelSupported,
+    agentSessionHostSupport,
+    setAgentSessionHostSupport,
     browserScreencastSupportedRef,
     reconciledCreateWarningState,
     createWarning,
diff --git a/mobile/src/session/use-mobile-session-keyboard-state.test.tsx b/mobile/src/session/use-mobile-session-keyboard-state.test.tsx
index e1f12b7414d0..96ab0a8d4ab9 100644
--- a/mobile/src/session/use-mobile-session-keyboard-state.test.tsx
+++ b/mobile/src/session/use-mobile-session-keyboard-state.test.tsx
@@ -73,8 +73,7 @@ function Harness(): null {
     initializedHandlesRef: { current: new Set() },
     showNativeChatRef: { current: false },
     subscribeToTerminal: () => {},
-    terminalFrameHeightRef: { current: 0 },
-    terminalFrameWidth: 0,
+    terminalFrameRef: { current: null },
     terminalRefs: { current: new Map() },
     unsubscribeTerminal: () => {},
     viewportMeasuredRef: { current: false },
@@ -121,10 +120,10 @@ describe('what the session screen hears about the keyboard', () => {
     expect(harness.notifyKeyboardVisibility).toHaveBeenLastCalledWith(false)
   })
 
-  it('holds the refit off on the page, where the keyboard is open and covers nothing', async () => {
-    // Inside the shell the WebView is already shortened, so the seam reports no occlusion: the
-    // dock needs no lift. Refitting on that height change would reflow the desktop PTY on every
-    // keyboard open, which is the reflow the visibility flag exists to defer.
+  it('holds the refit off for a keyboard that is open and covers nothing', async () => {
+    // A floating keyboard reports no occlusion, so the dock needs no lift. Refitting on that height
+    // change would reflow the desktop PTY on every keyboard open, which is the reflow the
+    // visibility flag exists to defer.
     const tree = await mount()
     harness.keyboard = { height: 0, visible: true }
     await rerender(tree)
diff --git a/mobile/src/session/use-mobile-session-keyboard-state.ts b/mobile/src/session/use-mobile-session-keyboard-state.ts
index 6d9ec467a35e..cfc5f9af0119 100644
--- a/mobile/src/session/use-mobile-session-keyboard-state.ts
+++ b/mobile/src/session/use-mobile-session-keyboard-state.ts
@@ -31,8 +31,7 @@ export type MobileSessionKeyboardScope = Pick<
   | 'tabStripOffsetRef'
   | 'tabStripRef'
   | 'tabStripViewportWidthRef'
-  | 'terminalFrameHeightRef'
-  | 'terminalFrameWidth'
+  | 'terminalFrameRef'
   | 'terminalRefs'
   | 'terminals'
   | 'terminalTextScale'
@@ -67,17 +66,21 @@ export function useMobileSessionKeyboardState(scope: MobileSessionKeyboardScope)
     terminalRefs,
     initializedHandlesRef,
     activeHandleRef,
-    terminalFrameHeightRef,
-    terminalFrameWidth,
+    terminalFrameRef,
     showNativeChatRef,
     unsubscribeTerminal,
     subscribeToTerminal
   } = scope
   // Why: non-subscribe layout refits (tab strip, fold, rotation) live in a dedicated hook — see terminal-viewport-refit.ts.
-  const { notifyTerminalFrameHeight, notifyKeyboardVisibility } = useTerminalViewportRefit({
+  const {
+    notifyTerminalFrameHeight,
+    notifyTerminalFrameWidth,
+    notifyKeyboardVisibility,
+    notifyTerminalCellBoxChange
+  } = useTerminalViewportRefit({
     activeHandleRef,
     terminalRefs,
-    terminalFrameHeightRef,
+    terminalFrameRef,
     viewportRef,
     viewportMeasuredRef,
     nativeChatCoveredRef: showNativeChatRef,
@@ -87,7 +90,6 @@ export function useMobileSessionKeyboardState(scope: MobileSessionKeyboardScope)
     connState,
     tabStripVisible: terminals.length > 1,
     textScale: terminalTextScale,
-    terminalFrameWidth,
     unsubscribeTerminal,
     subscribeToTerminal
   })
@@ -151,7 +153,9 @@ export function useMobileSessionKeyboardState(scope: MobileSessionKeyboardScope)
   }, [router])
   return {
     notifyTerminalFrameHeight,
+    notifyTerminalFrameWidth,
     notifyKeyboardVisibility,
+    notifyTerminalCellBoxChange,
     scrollActiveTabIntoView,
     handleDeleteCustomKey,
     handleManageShortcuts
diff --git a/mobile/src/session/use-mobile-session-native-chat-dictation.ts b/mobile/src/session/use-mobile-session-native-chat-dictation.ts
index 8ea9de2b9f0a..4dc1743e2219 100644
--- a/mobile/src/session/use-mobile-session-native-chat-dictation.ts
+++ b/mobile/src/session/use-mobile-session-native-chat-dictation.ts
@@ -27,7 +27,7 @@ export function useMobileSessionNativeChatDictation(
     worktreeId,
     client,
     connState,
-    agentSessionPromptCancelSupported,
+    agentSessionHostSupport,
     setInput,
     liveInputTerminalHandles,
     activeHandle,
@@ -73,7 +73,7 @@ export function useMobileSessionNativeChatDictation(
     nativeChatTranscriptIsLocalReadable,
     nativeChatInputLeaseReady,
     connState,
-    agentSessionPromptCancelSupported,
+    agentSessionHostSupport,
     onSendError: nativeChatSendError.show,
     onSendResolved: nativeChatSendError.clear
   })
diff --git a/mobile/src/session/use-mobile-session-presentation.ts b/mobile/src/session/use-mobile-session-presentation.ts
index 2bea9158db08..dca323343b07 100644
--- a/mobile/src/session/use-mobile-session-presentation.ts
+++ b/mobile/src/session/use-mobile-session-presentation.ts
@@ -1,9 +1,9 @@
-import { Platform } from 'react-native'
 import { classifyConnection, verdictDisplayLabel } from '../transport/connection-health'
 import { computeActiveTerminalKeyboardLift } from '../terminal/terminal-keyboard-avoidance-lift'
 import { useInitialSessionTerminalAutoCreate } from './use-initial-session-terminal-autocreate'
 import { MOBILE_SESSION_STATUS_LABELS } from './mobile-session-route-helpers'
 import type { MobileSessionBulkCloseModel } from './use-mobile-session-bulk-close'
+import { hostOs } from '../platform/host-os'
 
 export function useMobileSessionPresentation(scope: MobileSessionBulkCloseModel) {
   const {
@@ -25,7 +25,7 @@ export function useMobileSessionPresentation(scope: MobileSessionBulkCloseModel)
     toastOpacityRef,
     hostEndpoint,
     initialSessionAutoCreateRef,
-    terminalFrameHeightRef,
+    terminalFrameRef,
     handleCreateTerminal,
     visibleTabs,
     forceReconnectHost
@@ -77,14 +77,14 @@ export function useMobileSessionPresentation(scope: MobileSessionBulkCloseModel)
   // Why: iOS keyboard height includes the home-indicator inset; Android IME height does not.
   const keyboardLift =
     keyboardHeight > 0
-      ? Platform.OS === 'ios'
+      ? hostOs() === 'ios'
         ? Math.max(0, keyboardHeight - insets.bottom)
         : keyboardHeight
       : 0
   const activeTerminalKeyboardLift = computeActiveTerminalKeyboardLift({
     keyboardLift,
     metrics: activeHandle ? terminalKeyboardMetrics.get(activeHandle) : undefined,
-    terminalFrameHeight: terminalFrameHeightRef.current
+    terminalFrameHeight: terminalFrameRef.current?.height ?? 0
   })
   const toastAnimatedStyle = {
     opacity: toastOpacityRef.current,
diff --git a/mobile/src/session/use-mobile-session-tab-reconciliation.ts b/mobile/src/session/use-mobile-session-tab-reconciliation.ts
index da7a48e035ca..9f9af59833d1 100644
--- a/mobile/src/session/use-mobile-session-tab-reconciliation.ts
+++ b/mobile/src/session/use-mobile-session-tab-reconciliation.ts
@@ -2,10 +2,8 @@ import { useEffect, useRef, useCallback, useMemo, useState } from 'react'
 import { startRuntimeCapabilityProbe } from '../transport/runtime-capability-probe'
 import { supportsMobileQuickCommands } from '../terminal/quick-commands'
 import { MOBILE_AI_VAULT_CAPABILITY } from '../agent-history/agent-history-capability'
-import {
-  AGENT_SESSION_PROMPT_CANCEL_RUNTIME_CAPABILITY,
-  TERMINAL_QUERY_REPLY_INPUT_RUNTIME_CAPABILITY
-} from '../../../src/shared/protocol-version'
+import { TERMINAL_QUERY_REPLY_INPUT_RUNTIME_CAPABILITY } from '../../../src/shared/protocol-version'
+import { structuredAgentSessionHostSupport } from './mobile-structured-agent-session-host-support'
 import { runAcceptedMobileSessionTabsEffects } from './mobile-session-tabs-accepted-effects'
 import type { SessionTabsStreamSource } from './mobile-session-tabs-stream-health'
 import { useMobileSessionTabsFetchReporting } from './use-mobile-session-tabs-fetch-reporting'
@@ -34,7 +32,7 @@ export function useMobileSessionTabReconciliation(scope: MobileSessionMarkdownAc
     switchSessionTabRef,
     setBrowserScreencastSupported,
     setAgentSessionHistorySupported,
-    setAgentSessionPromptCancelSupported,
+    setAgentSessionHostSupport,
     setQuickCommandsSupported,
     nativeChatStream,
     fetchTerminals,
@@ -152,7 +150,7 @@ export function useMobileSessionTabReconciliation(scope: MobileSessionMarkdownAc
     if (!client || connState !== 'connected') {
       setBrowserScreencastSupported(null)
       setAgentSessionHistorySupported(null)
-      setAgentSessionPromptCancelSupported(null)
+      setAgentSessionHostSupport(null)
       setQuickCommandsSupported(null)
       setShowQuickCommands(false)
       hostQueryReplyInputSupportedRef.current = false
@@ -162,7 +160,7 @@ export function useMobileSessionTabReconciliation(scope: MobileSessionMarkdownAc
     // host; clear the prior capability before exposing host-specific actions.
     setBrowserScreencastSupported(null)
     setAgentSessionHistorySupported(null)
-    setAgentSessionPromptCancelSupported(null)
+    setAgentSessionHostSupport(null)
     setQuickCommandsSupported(null)
     setShowQuickCommands(false)
     hostQueryReplyInputSupportedRef.current = false
@@ -171,9 +169,7 @@ export function useMobileSessionTabReconciliation(scope: MobileSessionMarkdownAc
     return startRuntimeCapabilityProbe(client, (capabilities) => {
       setBrowserScreencastSupported(capabilities.includes('browser.screencast.v1'))
       setAgentSessionHistorySupported(capabilities.includes(MOBILE_AI_VAULT_CAPABILITY))
-      setAgentSessionPromptCancelSupported(
-        capabilities.includes(AGENT_SESSION_PROMPT_CANCEL_RUNTIME_CAPABILITY)
-      )
+      setAgentSessionHostSupport(structuredAgentSessionHostSupport(capabilities))
       setQuickCommandsSupported(supportsMobileQuickCommands(capabilities))
       // Why: hosts without this capability strip inputKind from terminal.send,
       // so a forwarded xterm reply would become floor-stealing shell input.
diff --git a/mobile/src/session/use-mobile-session-terminal-runtime.ts b/mobile/src/session/use-mobile-session-terminal-runtime.ts
index 374a9eefd949..b19213f53564 100644
--- a/mobile/src/session/use-mobile-session-terminal-runtime.ts
+++ b/mobile/src/session/use-mobile-session-terminal-runtime.ts
@@ -1,10 +1,12 @@
 import { useState, useRef, useCallback } from 'react'
-import { Platform, type Keyboard, type TextInput } from 'react-native'
+import type { TerminalFrame } from '../terminal/terminal-webview-messages'
+import type { Keyboard, TextInput } from 'react-native'
 import { useFocusEffect } from 'expo-router'
 import type { RpcClient } from '../transport/rpc-client'
 import type { ConnectionState } from '../transport/types'
 import type { TerminalModes, TerminalWebViewHandle } from '../terminal/terminal-webview-contract'
 import { useTerminalLiveInputFocus } from '../terminal/use-terminal-live-input-focus'
+import { reopensFocusedInputWhenKeyboardHidden } from '../terminal/terminal-live-input-keyboard-reopen'
 import type { TerminalLiveInputSender } from '../terminal/terminal-live-input-sender'
 import { useTerminalLiveInputCommit } from '../terminal/use-terminal-live-input-commit'
 import { resolveMobileTerminalInputGate } from '../terminal/terminal-input-connection-gate'
@@ -101,10 +103,9 @@ export function useMobileSessionTerminalRuntime(scope: MobileSessionScreenStateM
   // Why: highest applyLayout seq seen per handle; drop older scrollback/resized as stale, but a >20 gap resets (fresh subscription/server restart).
   const layoutSeqRef = useRef<Map<string, number>>(new Map())
   const sendingRef = useRef(false)
-  // Why: exact terminal-frame height for measureFitDimensions; window.innerHeight can overstate the visible area.
-  const terminalFrameHeightRef = useRef<number>(0)
-  // Why: sidebar resizes change the terminal frame width without a window-dim change; track it so the refit hook re-fits (see terminal-viewport-refit.ts).
-  const [terminalFrameWidth, setTerminalFrameWidth] = useState(0)
+  // Why: the terminal frame React Native laid out, unrounded, for every fit; window.innerHeight can
+  // overstate the visible area. Null until the frame's first layout.
+  const terminalFrameRef = useRef<TerminalFrame | null>(null)
   const activeSessionTab = sessionTabs.find((tab) => tab.id === activeSessionTabId) ?? null
   const {
     clearPendingLiveInputCommit,
@@ -142,7 +143,7 @@ export function useMobileSessionTerminalRuntime(scope: MobileSessionScreenStateM
     lifecycleIdentity: client,
     lifecycleKey: JSON.stringify([hostId, worktreeId, connState]),
     liveInputEnabled,
-    reopenFocusedInputWhenKeyboardHidden: Platform.OS === 'android',
+    reopenFocusedInputWhenKeyboardHidden: reopensFocusedInputWhenKeyboardHidden(),
     timerRef: liveInputFocusTimerRef
   })
   useFocusEffect(
@@ -195,9 +196,7 @@ export function useMobileSessionTerminalRuntime(scope: MobileSessionScreenStateM
     delayedActionTimersRef,
     layoutSeqRef,
     sendingRef,
-    terminalFrameHeightRef,
-    terminalFrameWidth,
-    setTerminalFrameWidth,
+    terminalFrameRef,
     activeSessionTab,
     clearPendingLiveInputCommit,
     flushPendingLiveInputBeforeExternalSend,
diff --git a/mobile/src/session/use-mobile-session-terminal-subscription-foundation.ts b/mobile/src/session/use-mobile-session-terminal-subscription-foundation.ts
index 76d8229b288a..306adec9b332 100644
--- a/mobile/src/session/use-mobile-session-terminal-subscription-foundation.ts
+++ b/mobile/src/session/use-mobile-session-terminal-subscription-foundation.ts
@@ -8,8 +8,6 @@ export function useMobileSessionTerminalSubscriptionFoundation(
     setCoveredStreamRevision,
     setTerminalKeyboardMetrics,
     terminalCwdRef,
-    viewportRef,
-    viewportMeasuredRef,
     terminalRefs,
     terminalUnsubsRef,
     subscribingHandlesRef,
@@ -21,7 +19,6 @@ export function useMobileSessionTerminalSubscriptionFoundation(
     activeHandleRef,
     subscribeSeqRef,
     layoutSeqRef,
-    terminalFrameHeightRef,
     nativeChatInputLeaseReadyRef,
     clearNativeChatInputLease,
     showNativeChatRef
@@ -83,30 +80,11 @@ export function useMobileSessionTerminalSubscriptionFoundation(
       term.clear()
     }
   }, [clearNativeChatInputLease])
-
-  // Why: measure the phone viewport once from the first TerminalWebView; dims ride every subscribe so the server auto-fits without a separate RPC.
-  const measureViewportOnce = useCallback(
-    async (handle: string) => {
-      if (viewportMeasuredRef.current) {
-        return
-      }
-      const dims = await getTerminalRef(handle)?.measureFitDimensions(
-        terminalFrameHeightRef.current || undefined
-      )
-      terminalDiagnosticsRef.current.viewportMeasured(handle, dims, terminalFrameHeightRef.current)
-      if (dims) {
-        viewportRef.current = dims
-        viewportMeasuredRef.current = true
-      }
-    },
-    [getTerminalRef]
-  )
   return {
     getTerminalRef,
     unsubscribeTerminal,
     unsubscribeTerminalRef,
-    clearTerminalCache,
-    measureViewportOnce
+    clearTerminalCache
   }
 }
 
diff --git a/mobile/src/session/use-mobile-session-terminal-subscription.test.tsx b/mobile/src/session/use-mobile-session-terminal-subscription.test.tsx
new file mode 100644
index 000000000000..ef2954e183b4
--- /dev/null
+++ b/mobile/src/session/use-mobile-session-terminal-subscription.test.tsx
@@ -0,0 +1,230 @@
+import { createElement } from 'react'
+import { act, create, type ReactTestRenderer } from 'react-test-renderer'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import type { TerminalWebViewHandle } from '../terminal/terminal-webview-contract'
+import { MobileTerminalDiagnostics } from './mobile-terminal-diagnostics'
+import { TerminalViewportResubscribeBudget } from './mobile-terminal-viewport-resubscribe'
+import type { MobileSessionTerminalSubscriptionFoundationModel } from './use-mobile-session-terminal-subscription-foundation'
+import { useMobileSessionTerminalSubscription } from './use-mobile-session-terminal-subscription'
+import type { MobileSessionTabSwitchingModel } from './use-mobile-session-tab-switching'
+import { useMobileSessionTerminalWebview } from './use-mobile-session-terminal-webview'
+
+const HANDLE = 'term-1'
+const PHONE = { cols: 55, rows: 44 }
+
+type StreamHandler = (result: unknown) => void
+
+/** The route's subscribe, driven end to end against a recording client and terminal. */
+function subscriptionHarness(opts: {
+  fit: typeof PHONE | null
+  webReady: boolean
+  frameWidth?: number
+  viewport?: typeof PHONE
+}) {
+  let fit = opts.fit
+  const order: string[] = []
+  const handlers: StreamHandler[] = []
+  const terminal: TerminalWebViewHandle = {
+    prepareForForegroundRecovery: vi.fn(),
+    write: vi.fn(),
+    init: vi.fn(({ cols, rows }: { cols: number; rows: number }) => {
+      order.push(`init ${cols}x${rows}`)
+      // An init's document reports its laid-out box before its ready.
+      fit = fit ?? PHONE
+    }),
+    resize: vi.fn(),
+    reflow: vi.fn(),
+    clear: vi.fn(),
+    fitDimensions: vi.fn(() => fit),
+    resetZoom: vi.fn(),
+    cancelSelect: vi.fn(),
+    doSelectAll: vi.fn(),
+    awaitReady: vi.fn(async () => {})
+  }
+  const terminalUnsubsRef = { current: new Map<string, () => void>() }
+  const subscribeSeqRef = { current: new Map<string, number>() }
+  const subscribingHandlesRef = { current: new Set<string>() }
+  const initializedHandlesRef = { current: new Set<string>() }
+  const webReadyHandlesRef = { current: new Set<string>(opts.webReady ? [HANDLE] : []) }
+  const terminalFrameRef: { current: { width: number; height: number } | null } = {
+    current: opts.frameWidth === 0 ? null : { width: opts.frameWidth ?? 427, height: 751 }
+  }
+  const fields = {
+    client: {
+      subscribe: vi.fn(
+        (_method: string, params: Record<string, unknown>, onData: StreamHandler) => {
+          order.push(`subscribe ${JSON.stringify(params.viewport ?? null)}`)
+          handlers.push(onData)
+          return () => {}
+        }
+      )
+    },
+    clientId: 'client-1',
+    setTerminalModes: vi.fn(),
+    terminalCwdRef: { current: new Map() },
+    viewportRef: { current: opts.viewport ?? null },
+    viewportMeasuredRef: { current: opts.viewport !== undefined },
+    terminalUnsubsRef,
+    subscribingHandlesRef,
+    leaseOnlyHandlesRef: { current: new Set<string>() },
+    initializedHandlesRef,
+    terminalDiagnosticsRef: { current: new MobileTerminalDiagnostics() },
+    viewportResubscribeBudgetRef: { current: new TerminalViewportResubscribeBudget() },
+    webReadyHandlesRef,
+    activeHandleRef: { current: HANDLE },
+    subscribeSeqRef,
+    layoutSeqRef: { current: new Map() },
+    terminalFrameRef,
+    scheduleDelayedAction: vi.fn(),
+    showToast: vi.fn(),
+    markNativeChatInputLeaseReady: vi.fn(),
+    showNativeChatRef: { current: false },
+    getTerminalRef: (handle: string | null) => (handle === HANDLE ? terminal : undefined),
+    unsubscribeTerminal: (handle: string) => {
+      terminalUnsubsRef.current.delete(handle)
+      subscribingHandlesRef.current.delete(handle)
+      subscribeSeqRef.current.set(handle, (subscribeSeqRef.current.get(handle) ?? 0) + 1)
+    },
+    unsubscribeTerminalRef: { current: vi.fn() },
+    signalTerminalInventoryRecovery: vi.fn(),
+    terminalRefs: { current: new Map([[HANDLE, terminal]]) },
+    pendingActiveTerminalHandleRef: { current: null },
+    nativeChatStream: { notifyWebReady: vi.fn() },
+    terminalGestureInputBucketsRef: { current: new Map() },
+    terminalGestureInputQueuesRef: { current: new Map() },
+    terminalGestureInputInFlightRef: { current: new Set() },
+    activeSessionTab: null,
+    markdownDocs: new Map(),
+    fileDocs: new Map(),
+    readMarkdownTab: vi.fn(),
+    readFileTab: vi.fn(),
+    notifyTerminalFrameHeight: vi.fn(),
+    notifyTerminalFrameWidth: vi.fn()
+  }
+  let subscribe: ((handle: string) => void) | undefined
+  let webReady: ((handle: string) => void) | undefined
+  let notifyFrame: ((frame: { width: number; height: number }) => void) | undefined
+  function Probe() {
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the hook destructures only the fields built above.
+    const scope = fields as unknown as MobileSessionTerminalSubscriptionFoundationModel
+    subscribe = useMobileSessionTerminalSubscription(scope).subscribeToTerminal
+    const withSubscribe = { ...fields, subscribeToTerminal: subscribe }
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the web-ready handler reads only the fields built above.
+    const webviewScope = withSubscribe as unknown as MobileSessionTabSwitchingModel
+    const webview = useMobileSessionTerminalWebview(webviewScope)
+    webReady = webview.handleTerminalWebReady
+    notifyFrame = webview.notifyTerminalFrame
+    return null
+  }
+  act(() => {
+    renderer = create(createElement(Probe))
+  })
+  const scrollback = (index: number, cols: number, rows: number) =>
+    act(() => {
+      handlers[index]({ type: 'scrollback', seq: 1, cols, rows, serialized: 'x' })
+    })
+  return {
+    order,
+    subscribe: () => act(() => subscribe!(HANDLE)),
+    scrollback,
+    terminal,
+    // The document's web-ready, carrying the box xterm laid out.
+    documentReady: () => {
+      act(() => webReady!(HANDLE))
+    },
+    fields,
+    terminalFrameRef,
+    // The frame's onLayout.
+    layOutFrame: (width: number, height = 751) => act(() => notifyFrame!({ width, height }))
+  }
+}
+
+let renderer: ReactTestRenderer | undefined
+afterEach(() => {
+  act(() => renderer?.unmount())
+  renderer = undefined
+})
+
+describe('a terminal first subscribe', () => {
+  it('does not subscribe before its document is ready, then subscribes once from its box', async () => {
+    const harness = subscriptionHarness({ fit: PHONE, webReady: false })
+    harness.subscribe()
+    expect(harness.order).toEqual([])
+    harness.documentReady()
+    expect(harness.order).toEqual(['subscribe {"cols":55,"rows":44}'])
+    harness.scrollback(0, PHONE.cols, PHONE.rows)
+    await act(async () => {})
+    expect(harness.order).toEqual(['subscribe {"cols":55,"rows":44}', 'init 55x44'])
+  })
+
+  it('resubscribes a document reloaded after its first ready, which lost its terminal', async () => {
+    const harness = subscriptionHarness({ fit: PHONE, webReady: false })
+    harness.documentReady()
+    harness.scrollback(0, PHONE.cols, PHONE.rows)
+    await act(async () => {})
+    harness.documentReady()
+    harness.scrollback(1, PHONE.cols, PHONE.rows)
+    await act(async () => {})
+    expect(harness.order.filter((step) => step.startsWith('init'))).toEqual([
+      'init 55x44',
+      'init 55x44'
+    ])
+  })
+
+  it('sizes from the reported box against the laid-out frame', () => {
+    const harness = subscriptionHarness({ fit: PHONE, webReady: true, frameWidth: 427.5 })
+    harness.subscribe()
+    expect(harness.terminal.fitDimensions).toHaveBeenCalledWith({ width: 427.5, height: 751 })
+    expect(harness.order).toEqual(['subscribe {"cols":55,"rows":44}'])
+  })
+
+  it('keeps a measured viewport rather than fitting again', () => {
+    const measured = { cols: 60, rows: 40 }
+    const harness = subscriptionHarness({ fit: PHONE, webReady: true, viewport: measured })
+    harness.subscribe()
+    expect(harness.terminal.fitDimensions).not.toHaveBeenCalled()
+    expect(harness.order).toEqual(['subscribe {"cols":60,"rows":40}'])
+  })
+
+  it('holds a ready document without a box until its frame is laid out', () => {
+    const harness = subscriptionHarness({ fit: null, webReady: true, frameWidth: 0 })
+    harness.subscribe()
+    expect(harness.order).toEqual([])
+    // The frame's first layout subscribes the document held back for it.
+    harness.layOutFrame(427)
+    expect(harness.order).toEqual(['subscribe null'])
+  })
+
+  it('keeps one frame, notifies a new width, and subscribes on the first layout only', () => {
+    const harness = subscriptionHarness({ fit: null, webReady: true, frameWidth: 0 })
+    const { notifyTerminalFrameHeight, notifyTerminalFrameWidth } = harness.fields
+    harness.layOutFrame(0, 0)
+    expect(harness.terminalFrameRef.current).toBeNull()
+    harness.layOutFrame(427, 751)
+    harness.layOutFrame(427, 700)
+    expect(harness.order).toEqual(['subscribe null'])
+    expect(notifyTerminalFrameWidth).not.toHaveBeenCalled()
+    // A hidden 0x0 layout keeps the box it was laid out at.
+    harness.layOutFrame(0, 0)
+    expect(harness.terminalFrameRef.current).toEqual({ width: 427, height: 700 })
+    harness.layOutFrame(360.5, 700)
+    expect(harness.terminalFrameRef.current).toEqual({ width: 360.5, height: 700 })
+    expect(notifyTerminalFrameWidth).toHaveBeenCalledTimes(1)
+    expect(notifyTerminalFrameHeight.mock.calls.map(([height]) => height)).toEqual([
+      0, 751, 700, 0, 700
+    ])
+  })
+
+  it('goes without dims when no cell box was reported, and the fit pass resubscribes once', async () => {
+    const harness = subscriptionHarness({ fit: null, webReady: true })
+    harness.subscribe()
+    expect(harness.order).toEqual(['subscribe null'])
+    harness.scrollback(0, 120, 40)
+    await vi.waitFor(() => expect(harness.order).toHaveLength(3))
+    expect(harness.order).toEqual([
+      'subscribe null',
+      'init 120x40',
+      'subscribe {"cols":55,"rows":44}'
+    ])
+  })
+})
diff --git a/mobile/src/session/use-mobile-session-terminal-subscription.ts b/mobile/src/session/use-mobile-session-terminal-subscription.ts
index e92fb12488e2..73af79a959df 100644
--- a/mobile/src/session/use-mobile-session-terminal-subscription.ts
+++ b/mobile/src/session/use-mobile-session-terminal-subscription.ts
@@ -34,7 +34,7 @@ export function useMobileSessionTerminalSubscription(
     activeHandleRef,
     subscribeSeqRef,
     layoutSeqRef,
-    terminalFrameHeightRef,
+    terminalFrameRef,
     scheduleDelayedAction,
     showToast,
     markNativeChatInputLeaseReady,
@@ -72,7 +72,8 @@ export function useMobileSessionTerminalSubscription(
       )
       // Why: a native-chat-covered terminal has no mounted webview, so only gate on the webview when not covered.
       if (!covered) {
-        if (!getTerminalRef(handle)) {
+        const ref = getTerminalRef(handle)
+        if (!ref) {
           logSkippedGate('no-webview-ref')
           return
         }
@@ -80,6 +81,21 @@ export function useMobileSessionTerminalSubscription(
           logSkippedGate('webview-not-ready')
           return
         }
+        const frame = terminalFrameRef.current
+        if (!viewportMeasuredRef.current) {
+          // Why: the frame's first layout subscribes it; going now would miss the dims (page web-ready precedes it).
+          if (!frame) {
+            logSkippedGate('frame-not-laid-out')
+            return
+          }
+          // Why: sized from the box the ready document reported, the host serializes the snapshot at the phone's size.
+          const dims = ref.fitDimensions(frame)
+          diagnostics.viewportMeasured(handle, dims, frame.height)
+          if (dims) {
+            viewportRef.current = dims
+            viewportMeasuredRef.current = true
+          }
+        }
       }
 
       subscribingHandlesRef.current.add(handle)
@@ -91,6 +107,10 @@ export function useMobileSessionTerminalSubscription(
       const seq = (subscribeSeqRef.current.get(handle) ?? 0) + 1
       subscribeSeqRef.current.set(handle, seq)
       diagnostics.streamArmed(handle, seq, viewportRef.current)
+      const sentViewport = nativeChatTerminalStream.mobileNativeChatSubscribeViewport(
+        covered,
+        viewportRef.current
+      )
 
       // Why: viewport is embedded in the subscribe params so the server auto-fits before serializing scrollback (no focus→safeFit race).
       const unsub = subscribeMobileTerminalSafely(
@@ -98,10 +118,7 @@ export function useMobileSessionTerminalSubscription(
         {
           terminal: handle,
           client: { id: clientId, type: 'mobile' as const },
-          viewport: nativeChatTerminalStream.mobileNativeChatSubscribeViewport(
-            covered,
-            viewportRef.current
-          ),
+          viewport: sentViewport,
           capabilities: nativeChatTerminalStream.mobileNativeChatTerminalCapabilities(covered),
           // Undefined on a phone, where no per-message cap exists; omitted rather than sent as
           // undefined so an older host sees the params it has always seen.
@@ -178,7 +195,7 @@ export function useMobileSessionTerminalSubscription(
               })
               return
             }
-            ref.init(cols, rows, initialData, false, oscLinks)
+            ref.init({ cols, rows, initialData, oscLinks, frame: terminalFrameRef.current })
             initializedHandlesRef.current.add(handle)
             if (data.displayMode) {
               const displayMode = data.displayMode as MobileDisplayMode
@@ -189,14 +206,15 @@ export function useMobileSessionTerminalSubscription(
             }
             // Why: cold-start refit — init()'s fit can run against a transient scrollWidth, so re-fire against a settled DOM.
             scheduleDelayedAction(() => getTerminalRef(handle)?.resetZoom(), 200)
-            // Why: first subscribe has no viewport (xterm not loaded yet), so measure after init
-            // and resubscribe so the server can phone-fit — bounded per handle so a
+            // Why: a subscribe without a viewport (no reported cell box) measures after init and
+            // resubscribes so the server can phone-fit — bounded per handle so a
             // non-converging host degrades visibly instead of hot-looping (STA-3337).
             runTerminalViewportFitPass({
               handle,
               seq,
               hostCols,
               hostRows,
+              sentViewport: sentViewport ?? null,
               budget: viewportResubscribeBudgetRef.current,
               diagnostics,
               viewportRef,
@@ -204,7 +222,7 @@ export function useMobileSessionTerminalSubscription(
               subscribeSeqRef,
               initializedHandlesRef,
               terminalUnsubsRef,
-              terminalFrameHeightRef,
+              terminalFrameRef,
               getTerminalRef,
               unsubscribeTerminal,
               subscribeToTerminal,
@@ -245,9 +263,16 @@ export function useMobileSessionTerminalSubscription(
             diagnostics.streamResized(handle, seq, eventSeq, data, getTerminalRef(handle) != null)
             const oscLinks = isTerminalOscLinkRanges(data.oscLinks) ? data.oscLinks : undefined
             if (serialized != null) {
-              getTerminalRef(handle)?.init(cols, rows, serialized, true, oscLinks)
+              getTerminalRef(handle)?.init({
+                cols,
+                rows,
+                initialData: serialized,
+                preserveScroll: true,
+                oscLinks,
+                frame: terminalFrameRef.current
+              })
             } else {
-              getTerminalRef(handle)?.resize(cols, rows)
+              getTerminalRef(handle)?.resize(cols, rows, terminalFrameRef.current)
             }
             if (data.displayMode) {
               const displayMode = data.displayMode as MobileDisplayMode
diff --git a/mobile/src/session/use-mobile-session-terminal-webview.ts b/mobile/src/session/use-mobile-session-terminal-webview.ts
index 56af08c6309a..484930f1218e 100644
--- a/mobile/src/session/use-mobile-session-terminal-webview.ts
+++ b/mobile/src/session/use-mobile-session-terminal-webview.ts
@@ -1,5 +1,6 @@
 import { useEffect, useCallback } from 'react'
 import type { TerminalWebViewHandle } from '../terminal/terminal-webview-contract'
+import type { TerminalFrame } from '../terminal/terminal-webview-messages'
 import type { MobileSessionTabSwitchingModel } from './use-mobile-session-tab-switching'
 
 export function useMobileSessionTerminalWebview(scope: MobileSessionTabSwitchingModel) {
@@ -18,11 +19,13 @@ export function useMobileSessionTerminalWebview(scope: MobileSessionTabSwitching
     pendingActiveTerminalHandleRef,
     activeSessionTab,
     unsubscribeTerminal,
-    measureViewportOnce,
     subscribeToTerminal,
     nativeChatStream,
     readMarkdownTab,
-    readFileTab
+    readFileTab,
+    terminalFrameRef,
+    notifyTerminalFrameHeight,
+    notifyTerminalFrameWidth
   } = scope
   // Why: only store the ref; subscribe on web-ready to avoid the blank-terminal race (init queued before xterm.js loaded).
   const setTerminalWebViewRef = useCallback((handle: string, ref: TerminalWebViewHandle | null) => {
@@ -60,20 +63,48 @@ export function useMobileSessionTerminalWebview(scope: MobileSessionTabSwitching
         }
         return
       }
-      // Why: first subscribe may skip (no WebView ref); await measure so it carries the viewport, else it races measureViewportOnce and skips.
       // Why: a just-created tab can lose activeHandleRef to a lagging snapshot; honor the pending marker so its web-ready subscribe still fires.
-      const isIntendedActive = () =>
+      const isIntendedActive =
         handle === activeHandleRef.current || handle === pendingActiveTerminalHandleRef.current
-      if (isIntendedActive() && !terminalUnsubsRef.current.has(handle)) {
-        void (async () => {
-          await measureViewportOnce(handle)
-          if (isIntendedActive() && !terminalUnsubsRef.current.has(handle)) {
-            subscribeToTerminal(handle)
-          }
-        })()
+      // Why: web-ready carried the cell box xterm laid out, so subscribeToTerminal sizes this subscribe.
+      if (isIntendedActive && !terminalUnsubsRef.current.has(handle)) {
+        subscribeToTerminal(handle)
       }
     },
-    [measureViewportOnce, nativeChatStream, subscribeToTerminal, unsubscribeTerminal]
+    [nativeChatStream, subscribeToTerminal, unsubscribeTerminal]
+  )
+
+  const subscribeIntendedActiveTerminal = useCallback(() => {
+    const handle = pendingActiveTerminalHandleRef.current ?? activeHandleRef.current
+    if (handle && !terminalUnsubsRef.current.has(handle)) {
+      subscribeToTerminal(handle)
+    }
+  }, [activeHandleRef, pendingActiveTerminalHandleRef, subscribeToTerminal, terminalUnsubsRef])
+
+  /** The terminal frame React Native laid out: kept in the one frame ref, then what it changed. */
+  const notifyTerminalFrame = useCallback(
+    (frame: TerminalFrame) => {
+      // Why: notify height imperatively so dock settling re-fits the PTY without rerendering SessionScreen.
+      notifyTerminalFrameHeight(Math.round(frame.height))
+      // Why: the page reports a hidden frame as 0x0; it keeps the box it was laid out at.
+      if (frame.width <= 0) {
+        return
+      }
+      const previous = terminalFrameRef.current
+      terminalFrameRef.current = frame
+      if (!previous) {
+        // Why: a ready document held back for its frame subscribes on the first layout.
+        subscribeIntendedActiveTerminal()
+      } else if (frame.width !== previous.width) {
+        notifyTerminalFrameWidth()
+      }
+    },
+    [
+      notifyTerminalFrameHeight,
+      notifyTerminalFrameWidth,
+      subscribeIntendedActiveTerminal,
+      terminalFrameRef
+    ]
   )
 
   useEffect(() => {
@@ -97,7 +128,8 @@ export function useMobileSessionTerminalWebview(scope: MobileSessionTabSwitching
   }, [activeSessionTab, fileDocs, readFileTab])
   return {
     setTerminalWebViewRef,
-    handleTerminalWebReady
+    handleTerminalWebReady,
+    notifyTerminalFrame
   }
 }
 
diff --git a/mobile/src/session/use-mobile-structured-agent-session-hold-refused.test.tsx b/mobile/src/session/use-mobile-structured-agent-session-hold-refused.test.tsx
new file mode 100644
index 000000000000..cba5ec91ba84
--- /dev/null
+++ b/mobile/src/session/use-mobile-structured-agent-session-hold-refused.test.tsx
@@ -0,0 +1,103 @@
+import { createElement } from 'react'
+import { act, create, type ReactTestRenderer } from 'react-test-renderer'
+import { afterEach, beforeEach, expect, it, vi } from 'vitest'
+import type { AgentSessionSubscribeEvent } from '../../../src/shared/agent-session-wire'
+import type { RpcClient } from '../transport/rpc-client'
+import { useMobileStructuredAgentSession } from './use-mobile-structured-agent-session'
+
+const asyncStorage = vi.hoisted(() => ({
+  getItem: vi.fn(async () => null),
+  setItem: vi.fn(async () => undefined),
+  removeItem: vi.fn(async () => undefined)
+}))
+
+vi.mock('@react-native-async-storage/async-storage', () => ({ default: asyncStorage }))
+
+// oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: a literal snapshot frame; the hook reads its type, page and fence.
+const SNAPSHOT: AgentSessionSubscribeEvent = {
+  type: 'snapshot',
+  sessionId: 'session-1',
+  fence: 3,
+  page: {
+    sessionId: 'session-1',
+    epoch: 'epoch-1',
+    direction: 'tail',
+    items: [
+      {
+        itemId: 'msg-1',
+        revision: 1,
+        sequence: 1,
+        observedAt: 10,
+        body: { kind: 'message', role: 'user', blocks: [{ type: 'text', text: 'still here' }] }
+      }
+    ],
+    removedItemIds: [],
+    submissions: [],
+    window: {
+      oldest: { epoch: 'epoch-1', sequence: 1 },
+      newest: { epoch: 'epoch-1', sequence: 1 },
+      nextCursor: { epoch: 'epoch-1', sequence: 2 }
+    },
+    liveCursor: { epoch: 'epoch-1', sequence: 1 },
+    hasOlder: false,
+    hasNewer: false
+  }
+} as AgentSessionSubscribeEvent
+
+let renderer: ReactTestRenderer | null = null
+let hook: ReturnType<typeof useMobileStructuredAgentSession> | null = null
+
+afterEach(() => {
+  act(() => renderer?.unmount())
+  renderer = null
+  hook = null
+})
+
+beforeEach(() => {
+  vi.clearAllMocks()
+})
+
+it('subscribes when an older host refuses the hold, and shows the transcript (P2-24)', async () => {
+  const sendRequest = vi.fn(async (method: string) =>
+    method === 'agentSession.hold'
+      ? {
+          ok: false,
+          error: { code: 'agent_session_owner_restart_failed', message: 'Codex could not start.' },
+          _meta: { runtimeId: 'runtime-1' }
+        }
+      : { ok: true, result: {}, _meta: { runtimeId: 'runtime-1' } }
+  )
+  const subscribe = vi.fn((_method: string, _params: unknown, onData: (value: unknown) => void) => {
+    onData(SNAPSHOT)
+    return () => undefined
+  })
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: an RPC client stub with the two members the hook calls.
+  const client = { sendRequest, subscribe } as unknown as RpcClient
+  function Harness(): null {
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the hook's options, of which this test supplies the ones it reads.
+    hook = useMobileStructuredAgentSession({
+      client,
+      sessionId: 'session-1',
+      sourceIdentity: 'host-a\0workspace-a',
+      enabled: true,
+      connected: true,
+      agent: 'codex',
+      onSendError: () => undefined
+    } as never)
+    return null
+  }
+
+  act(() => {
+    renderer = create(createElement(Harness))
+  })
+
+  await vi.waitFor(() =>
+    expect(subscribe).toHaveBeenCalledWith(
+      'agentSession.subscribe',
+      { sessionId: 'session-1' },
+      expect.any(Function)
+    )
+  )
+  await vi.waitFor(() => expect(hook?.session.messages.length).toBeGreaterThan(0))
+  expect(hook?.session.status).not.toBe('error')
+})
diff --git a/mobile/src/session/use-mobile-structured-agent-session-prompt-cancel.test.tsx b/mobile/src/session/use-mobile-structured-agent-session-prompt-cancel.test.tsx
index 2ce48ff908da..2e18bce750c3 100644
--- a/mobile/src/session/use-mobile-structured-agent-session-prompt-cancel.test.tsx
+++ b/mobile/src/session/use-mobile-structured-agent-session-prompt-cancel.test.tsx
@@ -5,7 +5,14 @@ import type { AgentJournalRenderItem } from '../../../src/shared/agent-session-j
 import type { StructuredAgentSessionState } from '../../../src/shared/structured-agent-session-reducer'
 import type { RpcClient } from '../transport/rpc-client'
 
-const mocks = vi.hoisted(() => ({ sendRequest: vi.fn() }))
+const mocks = vi.hoisted(() => ({
+  sendRequest: vi.fn(),
+  promptResponses: vi.fn(() => ({
+    groupedDraft: null,
+    respondPermission: vi.fn(),
+    respondQuestion: vi.fn()
+  }))
+}))
 vi.mock('./use-mobile-structured-agent-state', () => ({
   useMobileStructuredAgentState: () => ({
     state,
@@ -25,11 +32,7 @@ vi.mock('./use-mobile-structured-agent-options', () => ({
   })
 }))
 vi.mock('./use-mobile-structured-prompt-responses', () => ({
-  useMobileStructuredPromptResponses: () => ({
-    groupedDraft: null,
-    respondPermission: vi.fn(),
-    respondQuestion: vi.fn()
-  })
+  useMobileStructuredPromptResponses: mocks.promptResponses
 }))
 vi.mock('./use-mobile-structured-send-operation-reconciliation', () => ({
   useMobileStructuredSendOperationReconciliation: vi.fn()
@@ -104,7 +107,13 @@ const client: RpcClient = {
   close: () => {}
 }
 
-function Harness({ promptCancelSupported }: { promptCancelSupported: boolean }): null {
+function Harness({
+  promptCancelSupported,
+  questionAnswersSupported = false
+}: {
+  promptCancelSupported: boolean
+  questionAnswersSupported?: boolean
+}): null {
   hook = useMobileStructuredAgentSession({
     client,
     sessionId: 'session-1',
@@ -112,7 +121,7 @@ function Harness({ promptCancelSupported }: { promptCancelSupported: boolean }):
     enabled: true,
     connected: true,
     agent: 'codex',
-    promptCancelSupported,
+    hostSupport: { promptCancel: promptCancelSupported, questionAnswers: questionAnswersSupported },
     onSendError: vi.fn()
   })
   return null
@@ -151,6 +160,17 @@ describe('mobile structured prompt cancellation', () => {
     renderer = null
   })
 
+  it('hands question answering the host answers capability', () => {
+    act(() => {
+      renderer = create(
+        createElement(Harness, { promptCancelSupported: false, questionAnswersSupported: true })
+      )
+    })
+    expect(mocks.promptResponses).toHaveBeenLastCalledWith(
+      expect.objectContaining({ questionAnswersSupported: true })
+    )
+  })
+
   it('sends the clicked prompt identity on capable hosts', async () => {
     act(() => {
       renderer = create(createElement(Harness, { promptCancelSupported: true }))
diff --git a/mobile/src/session/use-mobile-structured-agent-session.ts b/mobile/src/session/use-mobile-structured-agent-session.ts
index 2a24d38a38e7..f04d78cc9a76 100644
--- a/mobile/src/session/use-mobile-structured-agent-session.ts
+++ b/mobile/src/session/use-mobile-structured-agent-session.ts
@@ -32,6 +32,7 @@ import type { MobileNativeChatSession } from './use-mobile-native-chat-session'
 import type { NativeChatLiveTurnIndicator } from '../../../src/shared/native-chat-turn-status'
 import { useMobileStructuredAgentState } from './use-mobile-structured-agent-state'
 import { useMobileStructuredPromptResponses } from './use-mobile-structured-prompt-responses'
+import type { StructuredAgentSessionHostSupport } from './mobile-structured-agent-session-host-support'
 import { useMobileStructuredAgentOptions } from './use-mobile-structured-agent-options'
 import { useMobileStructuredAgentTurnTiming } from './use-mobile-structured-agent-turn-timing'
 import { sendMobileStructuredAgentSessionMessage } from './mobile-structured-agent-session-send'
@@ -77,8 +78,8 @@ export function useMobileStructuredAgentSession(args: {
   enabled: boolean
   /** Live transport only; gates the connection-scoped hold, nothing else. */
   connected: boolean
-  /** Capability fact from the shared runtime status probe; null follows legacy cancellation. */
-  promptCancelSupported?: boolean | null
+  /** Capability facts from the shared runtime status probe; null follows the legacy wire. */
+  hostSupport: StructuredAgentSessionHostSupport | null
   agent: string | null
   onSendError: (message: string) => void
 }): StructuredMobileSession {
@@ -91,8 +92,9 @@ export function useMobileStructuredAgentSession(args: {
     sourceIdentity = '',
     enabled,
     onSendError,
-    promptCancelSupported = null
+    hostSupport
   } = args
+  const promptCancelSupported = hostSupport?.promptCancel ?? null
   const sessionKey = encodeNativeChatTranscriptIdentity([sourceIdentity, agent, sessionId])
   const operationIdsRef = useRef(new Map<string, string>())
   const commandPendingRef = useRef(false)
@@ -240,6 +242,7 @@ export function useMobileStructuredAgentSession(args: {
     stateRef,
     sessionKey,
     mutate,
+    questionAnswersSupported: hostSupport?.questionAnswers ?? null,
     onSendError
   })
 
diff --git a/mobile/src/session/use-mobile-structured-agent-state.ts b/mobile/src/session/use-mobile-structured-agent-state.ts
index 494260049689..d2b6d1a50629 100644
--- a/mobile/src/session/use-mobile-structured-agent-state.ts
+++ b/mobile/src/session/use-mobile-structured-agent-state.ts
@@ -19,6 +19,33 @@ const MAX_RETAINED_SESSION_STATES = 32
 /** Bounded so a busy stream cannot turn one Load-earlier tap into an endless read chain. */
 const OLDER_PAGE_ANCHOR_ATTEMPTS = 3
 
+/**
+ * Opens the transcript stream once the hold settles, either way: a refused hold is an older host
+ * saying it could not start the agent — which the next send does — never a reason to hide the
+ * transcript. Returns what ends the stream, opened or not yet. Outside the effect so its cleanup
+ * rule can see the stream is owned.
+ */
+function openTranscriptAfterHold(
+  client: RpcClient,
+  sessionId: string,
+  held: Promise<unknown>,
+  onFrame: (raw: unknown) => void
+): () => void {
+  let ended = false
+  let close = (): void => {}
+  void held
+    .catch(() => undefined)
+    .then(() => {
+      if (!ended) {
+        close = client.subscribe('agentSession.subscribe', { sessionId }, onFrame)
+      }
+    })
+  return () => {
+    ended = true
+    close()
+  }
+}
+
 function isSubscribeEvent(value: unknown): value is AgentSessionSubscribeEvent {
   if (typeof value !== 'object' || value === null) {
     return false
@@ -101,39 +128,21 @@ export function useMobileStructuredAgentState(args: {
     }
     apply({ type: 'loading' })
     const holderId = structuredAgentSessionHolderId('mobile-chat')
-    let cancelled = false
-    let unsubscribe = (): void => {}
     const held = callAgentSession(client, 'agentSession.hold', {
       sessionId,
       holderId
     })
-    void held
-      .then(() => {
-        if (cancelled) {
-          return
-        }
-        unsubscribe = client.subscribe('agentSession.subscribe', { sessionId }, (raw) => {
-          if (
-            typeof raw === 'object' &&
-            raw !== null &&
-            (raw as { type?: unknown }).type === 'error'
-          ) {
-            apply({ type: 'error', message: String((raw as { message?: unknown }).message ?? '') })
-            return
-          }
-          if (isSubscribeEvent(raw)) {
-            apply({ type: 'event', event: raw })
-          }
-        })
-      })
-      .catch((error: unknown) => {
-        if (!cancelled) {
-          apply({ type: 'error', message: error instanceof Error ? error.message : String(error) })
-        }
-      })
+    const endStream = openTranscriptAfterHold(client, sessionId, held, (raw) => {
+      if (typeof raw === 'object' && raw !== null && 'type' in raw && raw.type === 'error') {
+        apply({ type: 'error', message: 'message' in raw ? String(raw.message ?? '') : '' })
+        return
+      }
+      if (isSubscribeEvent(raw)) {
+        apply({ type: 'event', event: raw })
+      }
+    })
     return () => {
-      cancelled = true
-      unsubscribe()
+      endStream()
       void held
         .then(() =>
           callAgentSession(
diff --git a/mobile/src/session/use-mobile-structured-prompt-responses.test.tsx b/mobile/src/session/use-mobile-structured-prompt-responses.test.tsx
index 05a2b7fc380c..67e15635aa56 100644
--- a/mobile/src/session/use-mobile-structured-prompt-responses.test.tsx
+++ b/mobile/src/session/use-mobile-structured-prompt-responses.test.tsx
@@ -7,7 +7,12 @@ import {
   EMPTY_STRUCTURED_AGENT_SESSION,
   type StructuredAgentSessionState
 } from '../../../src/shared/structured-agent-session-reducer'
-import { projectStructuredQuestion } from './mobile-structured-agent-prompts'
+import { encodeAgentSessionQuestionAnswers } from '../../../src/shared/agent-session-question-answer'
+import { formatQuestionFreeTextAnswer } from './mobile-native-chat-question'
+import {
+  projectStructuredQuestion,
+  type StructuredQuestionItem
+} from './mobile-structured-agent-prompts'
 import type {
   StructuredAgentSessionMutate,
   StructuredAgentSessionMutationResult
@@ -72,6 +77,8 @@ function Probe(props: {
   sessionKey: string
   state: StructuredAgentSessionState
   mutate: StructuredAgentSessionMutate
+  questionAnswersSupported?: boolean | null
+  onSendError?: (message: string) => void
 }) {
   const stateRef = useRef(props.state)
   stateRef.current = props.state
@@ -79,7 +86,8 @@ function Probe(props: {
     stateRef,
     sessionKey: props.sessionKey,
     mutate: props.mutate,
-    onSendError: vi.fn()
+    questionAnswersSupported: props.questionAnswersSupported ?? null,
+    onSendError: props.onSendError ?? vi.fn()
   })
   return null
 }
@@ -172,4 +180,298 @@ describe('useMobileStructuredPromptResponses', () => {
       expect(hook().groupedDraft?.answers).toHaveLength(1)
     }
   )
+
+  describe('answer wire', () => {
+    const LONG_ANSWER = 'Proceed with the replacement, but wait for the capture. '.repeat(30).trim()
+
+    function singlePrompt(): StructuredQuestionItem {
+      return {
+        itemId: 'item-s',
+        revision: 3,
+        sequence: 1,
+        observedAt: 1,
+        body: {
+          kind: 'question',
+          question: 'Anything else?',
+          options: [
+            { id: 'yes', label: 'Yes' },
+            { id: 'no', label: 'No' }
+          ],
+          freeTextQuestionId: 'notes',
+          resolution: {
+            state: 'pending',
+            selectedOptionId: null,
+            resolvedBy: null,
+            resolvedAt: null
+          }
+        }
+      }
+    }
+
+    // Records what was sent; the verdict is irrelevant to the wire shape under test.
+    function recordingMutate() {
+      const sent: { method: string; fields: Record<string, unknown> }[] = []
+      const mutate: StructuredAgentSessionMutate = async (method, _fingerprint, fields) => {
+        sent.push({ method, fields })
+        return { status: 'rejected' }
+      }
+      return { mutate, sent }
+    }
+
+    function mount(
+      prompt: AgentJournalRenderItem,
+      mutate: StructuredAgentSessionMutate,
+      questionAnswersSupported: boolean | null,
+      onSendError?: (message: string) => void
+    ): void {
+      act(() => {
+        renderer = create(
+          createElement(Probe, {
+            sessionKey: 'session-a',
+            state: sessionState(prompt),
+            mutate,
+            questionAnswersSupported,
+            onSendError
+          })
+        )
+      })
+    }
+
+    function sentFields(sent: ReturnType<typeof recordingMutate>['sent']): Record<string, unknown> {
+      expect(sent).toHaveLength(1)
+      expect(sent[0]!.method).toBe('agentSession.respondToQuestion')
+      return sent[0]!.fields
+    }
+
+    it('sends a long typed answer as structured answers to a capable host', async () => {
+      const prompt = singlePrompt()
+      const { mutate, sent } = recordingMutate()
+      mount(prompt, mutate, true)
+      const card = projectStructuredQuestion(prompt)!
+
+      await act(async () => {
+        await hook().respondQuestion(formatQuestionFreeTextAnswer(card, LONG_ANSWER))
+      })
+
+      expect(sentFields(sent)).toEqual({
+        itemId: 'item-s',
+        expectedRevision: 3,
+        answers: [{ questionId: 'notes', optionIds: [], other: LONG_ANSWER }]
+      })
+    })
+
+    it('packs a typed answer into the option id for a host that predates answers', async () => {
+      const prompt = singlePrompt()
+      const { mutate, sent } = recordingMutate()
+      mount(prompt, mutate, null)
+      const card = projectStructuredQuestion(prompt)!
+
+      await act(async () => {
+        await hook().respondQuestion(formatQuestionFreeTextAnswer(card, '  DuckDB  '))
+      })
+
+      expect(sentFields(sent)).toEqual({
+        itemId: 'item-s',
+        expectedRevision: 3,
+        optionId: 'notes:DuckDB'
+      })
+    })
+
+    it('tries structured answers for an answer too long to pack while support is unknown', async () => {
+      const prompt = singlePrompt()
+      const { mutate, sent } = recordingMutate()
+      mount(prompt, mutate, null)
+
+      await act(async () => {
+        await hook().respondQuestion(
+          formatQuestionFreeTextAnswer(projectStructuredQuestion(prompt)!, LONG_ANSWER)
+        )
+      })
+
+      expect(sentFields(sent)).toEqual({
+        itemId: 'item-s',
+        expectedRevision: 3,
+        answers: [{ questionId: 'notes', optionIds: [], other: LONG_ANSWER }]
+      })
+    })
+
+    it('tells the user to update an older host instead of sending an answer it must refuse', async () => {
+      const prompt = singlePrompt()
+      const { mutate, sent } = recordingMutate()
+      const onSendError = vi.fn()
+      mount(prompt, mutate, false, onSendError)
+
+      let accepted = true
+      await act(async () => {
+        accepted = await hook().respondQuestion(
+          formatQuestionFreeTextAnswer(projectStructuredQuestion(prompt)!, LONG_ANSWER)
+        )
+      })
+
+      expect(accepted).toBe(false)
+      expect(sent).toEqual([])
+      expect(onSendError).toHaveBeenCalledWith(
+        'Update Orca on your computer to send answers this long'
+      )
+    })
+
+    it.each([
+      [true, { answers: [{ questionId: 'notes', optionIds: ['no'] }] }],
+      [false, { optionId: 'no' }]
+    ])(
+      'answers an option tap for the question it was shown on (answers: %s)',
+      async (supported, wire) => {
+        const prompt = singlePrompt()
+        const { mutate, sent } = recordingMutate()
+        mount(prompt, mutate, supported)
+
+        await act(async () => {
+          await hook().respondQuestion(projectStructuredQuestion(prompt)!.optionTokens[1]!)
+        })
+
+        expect(sentFields(sent)).toEqual({ itemId: 'item-s', expectedRevision: 3, ...wire })
+      }
+    )
+
+    it.each([true, false])('submits a grouped question once (answers: %s)', async (supported) => {
+      const prompt = groupedPrompt('item-g', 1)
+      const { mutate, sent } = recordingMutate()
+      mount(prompt, mutate, supported)
+
+      await act(async () => {
+        await hook().respondQuestion(projectedResponse(prompt, null))
+      })
+      await act(async () => {
+        await hook().respondQuestion(projectedResponse(prompt, hook().groupedDraft))
+      })
+
+      const answers = [
+        { questionId: 'q1', optionIds: ['q1:choice-1'] },
+        { questionId: 'q2', optionIds: ['q2:choice-1'] }
+      ]
+      expect(sentFields(sent)).toEqual({
+        itemId: 'item-g',
+        expectedRevision: 1,
+        ...(supported ? { answers } : { optionId: encodeAgentSessionQuestionAnswers(answers) })
+      })
+    })
+
+    // Claude always sends a question list, so this is the path a long typed Claude answer takes.
+    it.each([
+      [true, true],
+      [null, true],
+      [false, false]
+    ])('submits a grouped long typed answer (answers: %s)', async (supported, expectSent) => {
+      const base = groupedPrompt('item-g', 1)
+      if (base.body.kind !== 'question' || !base.body.questions) {
+        throw new Error('expected a grouped question')
+      }
+      const [first, second] = base.body.questions
+      const prompt: AgentJournalRenderItem = {
+        ...base,
+        body: { ...base.body, questions: [first!, { ...second!, freeTextQuestionId: 'q2' }] }
+      }
+      const { mutate, sent } = recordingMutate()
+      const onSendError = vi.fn()
+      mount(prompt, mutate, supported, onSendError)
+
+      await act(async () => {
+        await hook().respondQuestion(projectedResponse(prompt, null))
+      })
+      const step = projectStructuredQuestion(prompt, hook().groupedDraft)!
+      await act(async () => {
+        await hook().respondQuestion(formatQuestionFreeTextAnswer(step, LONG_ANSWER))
+      })
+
+      if (!expectSent) {
+        expect(sent).toEqual([])
+        expect(onSendError).toHaveBeenCalledWith(
+          'Update Orca on your computer to send answers this long'
+        )
+        return
+      }
+      expect(sentFields(sent)).toEqual({
+        itemId: 'item-g',
+        expectedRevision: 1,
+        answers: [
+          { questionId: 'q1', optionIds: ['q1:choice-1'] },
+          { questionId: 'q2', optionIds: [], other: LONG_ANSWER }
+        ]
+      })
+    })
+
+    it('keeps a grouped draft an older host cannot take so it sends after an update', async () => {
+      const base = groupedPrompt('item-g', 1)
+      if (base.body.kind !== 'question' || !base.body.questions) {
+        throw new Error('expected a grouped question')
+      }
+      const [first, second] = base.body.questions
+      const prompt: AgentJournalRenderItem = {
+        ...base,
+        body: { ...base.body, questions: [{ ...first!, freeTextQuestionId: 'q1' }, second!] }
+      }
+      const { mutate, sent } = recordingMutate()
+      const onSendError = vi.fn()
+      mount(prompt, mutate, false, onSendError)
+
+      let advanced = false
+      await act(async () => {
+        advanced = await hook().respondQuestion(
+          formatQuestionFreeTextAnswer(projectStructuredQuestion(prompt, null)!, LONG_ANSWER)
+        )
+      })
+      expect(advanced).toBe(true)
+      await act(async () => {
+        await hook().respondQuestion(projectedResponse(prompt, hook().groupedDraft))
+      })
+
+      expect(sent).toEqual([])
+      expect(onSendError).toHaveBeenCalledWith(
+        'Update Orca on your computer to send answers this long'
+      )
+      expect(hook().groupedDraft).not.toBeNull()
+
+      act(() => {
+        renderer?.update(
+          createElement(Probe, {
+            sessionKey: 'session-a',
+            state: sessionState(prompt),
+            mutate,
+            questionAnswersSupported: true,
+            onSendError
+          })
+        )
+      })
+      await act(async () => {
+        await hook().respondQuestion(projectedResponse(prompt, hook().groupedDraft))
+      })
+
+      expect(sentFields(sent)).toEqual({
+        itemId: 'item-g',
+        expectedRevision: 1,
+        answers: [
+          { questionId: 'q1', optionIds: [], other: LONG_ANSWER },
+          { questionId: 'q2', optionIds: ['q2:choice-1'] }
+        ]
+      })
+    })
+
+    it('names the single question an option tap answers when the prompt has no typed field', async () => {
+      const base = singlePrompt()
+      const { freeTextQuestionId: _omitted, ...body } = base.body
+      const prompt: StructuredQuestionItem = { ...base, body }
+      const { mutate, sent } = recordingMutate()
+      mount(prompt, mutate, true)
+
+      await act(async () => {
+        await hook().respondQuestion(projectStructuredQuestion(prompt)!.optionTokens[0]!)
+      })
+
+      expect(sentFields(sent)).toEqual({
+        itemId: 'item-s',
+        expectedRevision: 3,
+        answers: [{ questionId: 'q1', optionIds: ['yes'] }]
+      })
+    })
+  })
 })
diff --git a/mobile/src/session/use-mobile-structured-prompt-responses.ts b/mobile/src/session/use-mobile-structured-prompt-responses.ts
index 8340b7edee87..093029b2be52 100644
--- a/mobile/src/session/use-mobile-structured-prompt-responses.ts
+++ b/mobile/src/session/use-mobile-structured-prompt-responses.ts
@@ -1,5 +1,11 @@
 import { useCallback, useState } from 'react'
 import type { AgentSessionPromptResult } from '../../../src/shared/agent-session-wire'
+import type { AgentJournalQuestionItem } from '../../../src/shared/agent-session-journal-types'
+import {
+  AGENT_SESSION_RESPONSE_OPTION_ID_MAX_LENGTH,
+  legacyAgentSessionSelectedOptionId,
+  type AgentSessionQuestionAnswer
+} from '../../../src/shared/agent-session-question-answer'
 import type { StructuredAgentSessionState } from '../../../src/shared/structured-agent-session-reducer'
 import {
   pendingStructuredApproval,
@@ -7,7 +13,10 @@ import {
   structuredApprovalResponseTarget,
   structuredQuestionResponseTarget
 } from './mobile-structured-agent-prompts'
-import type { StructuredAgentSessionMutate } from './mobile-structured-agent-session-rpc'
+import type {
+  StructuredAgentSessionMutate,
+  StructuredAgentSessionMutationResult
+} from './mobile-structured-agent-session-rpc'
 import {
   advanceGroupedQuestion,
   groupedQuestionPromptKey,
@@ -23,13 +32,15 @@ export function useMobileStructuredPromptResponses(args: {
   stateRef: { readonly current: StructuredAgentSessionState }
   sessionKey: string
   mutate: StructuredAgentSessionMutate
+  /** Host takes structured `answers`; otherwise the answer is packed into `optionId`. */
+  questionAnswersSupported: boolean | null
   onSendError: (message: string) => void
 }): {
   groupedDraft: GroupedQuestionDraft | null
   respondPermission: (optionId: string) => Promise<boolean>
   respondQuestion: (answer: string) => Promise<boolean>
 } {
-  const { mutate, onSendError, sessionKey, stateRef } = args
+  const { mutate, onSendError, questionAnswersSupported, sessionKey, stateRef } = args
   // Partially answered grouped question, held only until its last step is submitted. The session it
   // was collected in is stored with it and checked on read, so switching sessions drops the draft
   // without an effect that would render the stale one for a frame first.
@@ -62,6 +73,38 @@ export function useMobileStructuredPromptResponses(args: {
     [mutate, onSendError, stateRef]
   )
 
+  const sendAnswers = useCallback(
+    (
+      target: { itemId: string; expectedRevision: number },
+      body: Pick<AgentJournalQuestionItem, 'questions'>,
+      answers: AgentSessionQuestionAnswer[]
+    ): Promise<StructuredAgentSessionMutationResult<AgentSessionPromptResult> | null> => {
+      const send = (fields: Record<string, unknown>) =>
+        mutate<AgentSessionPromptResult>(
+          'agentSession.respondToQuestion',
+          'agentSession.respondTo:question',
+          { ...target, ...fields }
+        )
+      if (questionAnswersSupported === true) {
+        return send({ answers })
+      }
+      const optionId = legacyAgentSessionSelectedOptionId(body, answers)
+      if (optionId === null) {
+        return Promise.resolve(null)
+      }
+      if (optionId.length > AGENT_SESSION_RESPONSE_OPTION_ID_MAX_LENGTH) {
+        // Too long to pack for any host: while support is unknown, `answers` is the only form that can land.
+        if (questionAnswersSupported === null) {
+          return send({ answers })
+        }
+        onSendError('Update Orca on your computer to send answers this long')
+        return Promise.resolve(null)
+      }
+      return send({ optionId })
+    },
+    [mutate, onSendError, questionAnswersSupported]
+  )
+
   const respondQuestion = useCallback(
     async (answer: string): Promise<boolean> => {
       const prompt = stateRef.current.items.find(pendingStructuredQuestion) ?? null
@@ -80,11 +123,14 @@ export function useMobileStructuredPromptResponses(args: {
           setCollected({ sessionKey, draft: grouped.draft })
           return true
         }
-        const result = await mutate<AgentSessionPromptResult>(
-          'agentSession.respondToQuestion',
-          'agentSession.respondTo:question',
-          { itemId: prompt.itemId, expectedRevision: prompt.revision, optionId: grouped.optionId }
+        const result = await sendAnswers(
+          { itemId: prompt.itemId, expectedRevision: prompt.revision },
+          prompt.body,
+          grouped.answers
         )
+        if (!result) {
+          return false
+        }
         if (result.status !== 'rejected') {
           // The group left the phone; a retry must start from the first question, not a stale tail.
           setCollected((current) =>
@@ -103,18 +149,22 @@ export function useMobileStructuredPromptResponses(args: {
       if (!target) {
         return false
       }
-      const result = await mutate<AgentSessionPromptResult>(
-        'agentSession.respondToQuestion',
-        'agentSession.respondTo:question',
-        target
+      const result = await sendAnswers(
+        { itemId: target.itemId, expectedRevision: target.expectedRevision },
+        // Grouped questions returned above, so this is a single question.
+        {},
+        [target.answer]
       )
+      if (!result) {
+        return false
+      }
       if (result.status === 'unknown') {
         onSendError('Answer unconfirmed — check chat before retrying')
         return false
       }
       return result.status === 'accepted'
     },
-    [groupedDraft, mutate, onSendError, sessionKey, stateRef]
+    [groupedDraft, onSendError, sendAnswers, sessionKey, stateRef]
   )
 
   return { groupedDraft, respondPermission, respondQuestion }
diff --git a/mobile/src/tasks/mobile-tasks-refactor-parity.test.ts b/mobile/src/tasks/mobile-tasks-refactor-parity.test.ts
index 859fb8d14595..3ba14c571d65 100644
--- a/mobile/src/tasks/mobile-tasks-refactor-parity.test.ts
+++ b/mobile/src/tasks/mobile-tasks-refactor-parity.test.ts
@@ -110,7 +110,8 @@ const hash = (parts: string[] | string): string =>
 const SCREEN_RPC_SCREEN_HOOKS = '0f66df2141117dfec2f8a0adb3f598312e6fda8e80833a365a645796f5ab48c3'
 const PRE_REFACTOR_DIFF_HOOKS = '93c7189b32bed8456cc51814fffa8ce80cf62011ef968a9d53ddec2b9686f58f'
 const SCREEN_RPC_STATEMENTS = 'dd8f33cb3cf96f5c39abac397cb77e35f59079291033a1866ead462b041ab979'
-const MAIN_REBASED_DECLARATIONS = '920a1b66445d10e2a64fbdbe9d7138a4ebe21bbccde1b9ac9c89267cecc584b9'
+// Saved Linear selections now accept unknown persisted values; reconciliation tests cover them.
+const MAIN_REBASED_DECLARATIONS = 'ec77d34712c7c4ab19ac6a4d57878f32d22aba790d2420cc14c2c0f000d120e9'
 const SCREEN_RPC_SEMANTICS = 'e07a63387d57106483ee703ec6c19dea593e0eca5c651758f42bcb36254850b7'
 const PRE_REFACTOR_STYLES = '1db6af69c791d9963928541ad5310942fcbda6d984b422c90b6eb92b6816579a'
 const SCREEN_RPC_RENDER_TREE = '086742f95f1e87fb89d8c67ffd9f7a229799ae05115f9f4bcc1a925e56dcc8bb'
diff --git a/mobile/src/tasks/mobile-tasks-reviewer-linear.test.ts b/mobile/src/tasks/mobile-tasks-reviewer-linear.test.ts
new file mode 100644
index 000000000000..3fec8b222aee
--- /dev/null
+++ b/mobile/src/tasks/mobile-tasks-reviewer-linear.test.ts
@@ -0,0 +1,26 @@
+import { describe, expect, it, vi } from 'vitest'
+
+vi.mock('./mobile-tasks-dependencies', () => import('../theme/mobile-theme'))
+import { reconcileTeamSelection } from './mobile-tasks-reviewer-linear'
+import type { LinearTeam } from './mobile-tasks-provider-detail-types'
+
+function team(id: string): LinearTeam {
+  return { id, name: id, key: id.toUpperCase() }
+}
+
+describe('reconcileTeamSelection', () => {
+  it('selects every team for sticky-all', () => {
+    expect([...reconcileTeamSelection([team('a'), team('b')], null)]).toEqual(['a', 'b'])
+  })
+
+  it('keeps saved teams that still exist', () => {
+    expect([...reconcileTeamSelection([team('a'), team('b')], ['b'])]).toEqual(['b'])
+  })
+
+  // Why: an older host projects its raw store value, which reached 1.4.207
+  // desktops as a string (0a2b6e7f); the mobile list must not fail on it.
+  it('reads a saved value of the wrong shape as sticky-all instead of throwing', () => {
+    expect([...reconcileTeamSelection([team('a'), team('b')], 'a')]).toEqual(['a', 'b'])
+    expect([...reconcileTeamSelection([team('a'), team('b')], { 0: 'a' })]).toEqual(['a', 'b'])
+  })
+})
diff --git a/mobile/src/tasks/mobile-tasks-reviewer-linear.ts b/mobile/src/tasks/mobile-tasks-reviewer-linear.ts
index ed5e51f8bf78..32b872550aa3 100644
--- a/mobile/src/tasks/mobile-tasks-reviewer-linear.ts
+++ b/mobile/src/tasks/mobile-tasks-reviewer-linear.ts
@@ -196,11 +196,10 @@ export function linearIssueSecondaryParts(
   return parts
 }
 
-export function reconcileTeamSelection(
-  teams: LinearTeam[],
-  saved: string[] | null | undefined
-): Set<string> {
-  if (!saved) {
+// Why `unknown`: a host predating the desktop fix for 0a2b6e7f projects its
+// raw store value, which can be a string; that must read as sticky-all.
+export function reconcileTeamSelection(teams: LinearTeam[], saved: unknown): Set<string> {
+  if (!Array.isArray(saved)) {
     return new Set(teams.map((team) => team.id))
   }
   const available = new Set(teams.map((team) => team.id))
diff --git a/mobile/src/tasks/mobile-tui-agents.ts b/mobile/src/tasks/mobile-tui-agents.ts
index 46d8dd00886e..e1dad2269d6f 100644
--- a/mobile/src/tasks/mobile-tui-agents.ts
+++ b/mobile/src/tasks/mobile-tui-agents.ts
@@ -22,9 +22,11 @@ export const MOBILE_TUI_AGENT_FAVICON_DOMAINS: Partial<Record<TuiAgent, string>>
   ante: 'antigma.ai',
   trae: 'www.trae.cn',
   muse: 'dev.meta.ai',
+  dsh: 'deepseek.com',
   zcode: 'zcode.z.ai',
   omp: 'omp.sh',
   'prime-agent': 'primeintellect.ai',
+  qoder: 'qoder.com',
   gemini: 'gemini.google.com',
   antigravity: 'antigravity.google',
   goose: 'goose-docs.ai',
@@ -36,6 +38,7 @@ export const MOBILE_TUI_AGENT_FAVICON_DOMAINS: Partial<Record<TuiAgent, string>>
   autohand: 'autohand.ai',
   cline: 'cline.bot',
   codebuff: 'codebuff.com',
+  freebuff: 'freebuff.com',
   'command-code': 'commandcode.ai',
   continue: 'continue.dev',
   cursor: 'cursor.com',
diff --git a/mobile/src/terminal/TerminalWebView.tsx b/mobile/src/terminal/TerminalWebView.tsx
index 88d9da6106a4..8c474fcd1869 100644
--- a/mobile/src/terminal/TerminalWebView.tsx
+++ b/mobile/src/terminal/TerminalWebView.tsx
@@ -1,10 +1,10 @@
-import { useRef, useCallback, forwardRef, useImperativeHandle } from 'react'
+import { useRef, useCallback, useState, forwardRef, useImperativeHandle } from 'react'
 import { Platform, View } from 'react-native'
 import { WebView, type WebViewMessageEvent } from 'react-native-webview'
 import type { TerminalWebViewHandle, TerminalWebViewProps } from './terminal-webview-contract'
 import { TerminalWebViewEngineErrorOverlay } from './terminal-webview-engine-error-state'
 import { TERMINAL_WEBVIEW_FRAME_STYLES } from './terminal-webview-frame-styles'
-import { XTERM_WEBVIEW_SOURCE } from './terminal-webview-html'
+import { xtermWebViewSource } from './terminal-webview-html'
 import type { TerminalWebViewCommand } from './terminal-webview-messages'
 import { useTerminalWebViewController } from './use-terminal-webview-controller'
 
@@ -34,6 +34,13 @@ export const TerminalWebView = forwardRef<TerminalWebViewHandle, Props>(
     })
 
     useImperativeHandle(ref, () => handle, [handle])
+    // Why: the document builds its terminal before ready, so it needs the text scale before any
+    // message can reach it; later changes arrive as set-font-scale.
+    // Why: in the page source rather than injected: Android can run an injected script after the
+    // document's own, which then starts without them.
+    const [source] = useState(() =>
+      xtermWebViewSource({ textScale: props.textScale ?? 1, shown: props.shownAtMount ?? true })
+    )
 
     const handleMessage = useCallback(
       (event: WebViewMessageEvent) => {
@@ -65,7 +72,7 @@ export const TerminalWebView = forwardRef<TerminalWebViewHandle, Props>(
       <View style={[TERMINAL_WEBVIEW_FRAME_STYLES.container, props.style]}>
         <WebView
           ref={webViewRef}
-          source={XTERM_WEBVIEW_SOURCE}
+          source={source}
           style={TERMINAL_WEBVIEW_FRAME_STYLES.webview}
           originWhitelist={['*']}
           javaScriptEnabled
diff --git a/mobile/src/terminal/TerminalWebView.web.tsx b/mobile/src/terminal/TerminalWebView.web.tsx
index c810dbc86d82..38de971d5878 100644
--- a/mobile/src/terminal/TerminalWebView.web.tsx
+++ b/mobile/src/terminal/TerminalWebView.web.tsx
@@ -54,6 +54,12 @@ export const TerminalWebView = forwardRef<TerminalWebViewHandle, Props>(
     // The page's answer to the WebView's reload: drop the document and build another one. The host
     // element is keyed on it so React replaces the div rather than handing back one xterm left in.
     const [generation, setGeneration] = useState(0)
+    // Why: every document this view builds starts as the view mounted — its scale, and whether it
+    // was shown — as the native WebView's pre-content script does; later scales arrive with init.
+    const [atMount] = useState(() => ({
+      textScale: props.textScale ?? 1,
+      shown: props.shownAtMount ?? true
+    }))
 
     useImperativeHandle(ref, () => handle, [handle])
     // In an effect, not during render: React may replay or discard render work, and the document
@@ -62,7 +68,6 @@ export const TerminalWebView = forwardRef<TerminalWebViewHandle, Props>(
     useEffect(() => {
       receiveRef.current = receive
     }, [receive])
-
     useEffect(() => {
       // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: react-native-web renders View as a div and forwards the ref to it; this module only ever runs in that build.
       const host = hostRef.current as unknown as HTMLElement | null
@@ -71,7 +76,7 @@ export const TerminalWebView = forwardRef<TerminalWebViewHandle, Props>(
       }
       let live
       try {
-        live = mountTerminalWebDocument(host, (message) => receiveRef.current?.(message))
+        live = mountTerminalWebDocument(host, (message) => receiveRef.current?.(message), atMount)
       } catch (error) {
         // A start that throws is the document's own failure and the factory has already unwound
         // it, so there is no handle and no engine ran: no `error` notify is coming. It goes down
@@ -101,7 +106,11 @@ export const TerminalWebView = forwardRef<TerminalWebViewHandle, Props>(
       }
       // Mounted once per generation: re-running this would throw away a live terminal and its
       // scrollback, and the controller's identity changes with every callback prop.
-    }, [generation])
+    }, [atMount, generation])
+
+    const handleHostLayout = useCallback(() => {
+      documentRef.current?.notifyViewport()
+    }, [])
 
     const handleReload = useCallback(() => {
       clearEngineError()
@@ -112,7 +121,13 @@ export const TerminalWebView = forwardRef<TerminalWebViewHandle, Props>(
 
     return (
       <View style={[TERMINAL_WEBVIEW_FRAME_STYLES.container, props.style]}>
-        <View key={generation} ref={hostRef} style={TERMINAL_WEBVIEW_FRAME_STYLES.webview} />
+        {/* Why: mounted with onLayout, so react-native-web observes it; the document sizes to this box. */}
+        <View
+          key={generation}
+          ref={hostRef}
+          style={TERMINAL_WEBVIEW_FRAME_STYLES.webview}
+          onLayout={handleHostLayout}
+        />
         {engineError ? (
           <TerminalWebViewEngineErrorOverlay message={engineError} onReload={handleReload} />
         ) : null}
diff --git a/mobile/src/terminal/document/document-host-root.test.ts b/mobile/src/terminal/document/document-host-root.test.ts
index e9b3ed5f1e2c..8a3e066bbe96 100644
--- a/mobile/src/terminal/document/document-host-root.test.ts
+++ b/mobile/src/terminal/document/document-host-root.test.ts
@@ -224,3 +224,137 @@ describe('two terminal documents on one page', () => {
     two.started.stop()
   })
 })
+
+/** A started document over a measured grid whose cells scale with the font, as xterm's do. */
+function startMeasuredDocument() {
+  document.body.innerHTML = ''
+  const host = plantHost('pinch-host')
+  const engine = terminalDocumentDouble()
+  const parsedWrites: Array<() => void> = []
+  const grid = Object.assign(engine.terminal, {
+    cols: 80,
+    rows: 24,
+    _core: {
+      _renderService: {
+        get dimensions() {
+          const k = grid.options.fontSize / 13
+          return { css: { cell: { width: 7.5 * k, height: 15 * k } } }
+        }
+      }
+    }
+  })
+  grid.resize = (cols: number, rows: number) => {
+    grid.cols = cols
+    grid.rows = rows
+  }
+  grid.onWriteParsed = (listener: () => void) => {
+    parsedWrites.push(listener)
+    return { dispose() {} }
+  }
+  const posted: Array<Record<string, unknown>> = []
+  const started = createTerminalDocument({
+    root: host,
+    postToHost: (message) => {
+      posted.push(message)
+    },
+    hasEngine: () => true,
+    installHostTransport: () => () => {},
+    installErrorReporter: () => () => {},
+    paintDocumentBackground: () => {},
+    viewportRect: () => ({ left: 0, top: 0, width: 412, height: 600 }),
+    createTerminal: () => grid,
+    createUnicode11Addon: () => null,
+    createWebglAddon: () => null
+  })
+  // The app's init carries the frame it laid out.
+  started.send({
+    type: 'init',
+    cols: 80,
+    rows: 24,
+    initialData: '',
+    preserveScroll: false,
+    frame: { width: 412, height: 600 }
+  })
+  const write = () => parsedWrites.forEach((listener) => listener())
+  return { started, posted, surface: surfaceOf(host), write }
+}
+
+const nextFrame = () => new Promise<void>((resolve) => requestAnimationFrame(() => resolve()))
+async function settle() {
+  for (let frame = 0; frame < 10; frame++) {
+    await nextFrame()
+  }
+}
+
+const metricsOf = (posted: Array<Record<string, unknown>>) =>
+  posted.filter((message) => message.type === 'keyboard-avoidance-metrics')
+
+/** A touch on the surface itself, where the pinch listeners are; `fireTouch` reaches only `document`. */
+function fireSurfaceTouch(type: string, surface: HTMLElement, xs: number[]) {
+  const event = new Event(type, { bubbles: true, cancelable: true })
+  Object.defineProperty(event, 'touches', {
+    value: xs.map((x, identifier) => ({ identifier, clientX: x, clientY: 10, target: surface }))
+  })
+  surface.dispatchEvent(event)
+}
+
+/** Two fingers 20px apart, spread to `spread`px, a parsed write mid-gesture, then both lift. */
+function pinchTo(doc: ReturnType<typeof startMeasuredDocument>, spread: number, write = true) {
+  fireSurfaceTouch('touchstart', doc.surface, [10, 30])
+  fireSurfaceTouch('touchmove', doc.surface, [10, 10 + spread])
+  if (write) {
+    doc.write()
+  }
+  fireSurfaceTouch('touchend', doc.surface, [])
+}
+
+/**
+ * The lift's row pitch is read off the scale as drawn, and a pinch moves that scale with no fit
+ * to report it. A write mid-gesture emits the transient pitch; the release must replace it.
+ */
+describe('keyboard-avoidance metrics across a pinch', () => {
+  it('reports the at-rest pitch after a pinch that releases onto the same preset', async () => {
+    const doc = startMeasuredDocument()
+    await settle()
+    const atRest = metricsOf(doc.posted).at(-1)?.rowPitch
+    expect(atRest).toBeGreaterThan(0)
+
+    pinchTo(doc, 21)
+    await settle()
+
+    const metrics = metricsOf(doc.posted)
+    expect(metrics.at(-1)?.rowPitch).toBe(atRest)
+    doc.started.stop()
+  })
+
+  it('reports a release that changes the preset once, through the refit', async () => {
+    const doc = startMeasuredDocument()
+    await settle()
+    const before = metricsOf(doc.posted).length
+
+    pinchTo(doc, 30)
+    const afterWrite = metricsOf(doc.posted).length
+    await settle()
+
+    expect(afterWrite).toBe(before + 1)
+    expect(metricsOf(doc.posted).length).toBe(afterWrite + 1)
+    doc.started.stop()
+  })
+
+  it('never reports the pre-refit pitch when a release lands while a refit is pending', async () => {
+    const doc = startMeasuredDocument()
+    await settle()
+    const before = metricsOf(doc.posted).length
+
+    // The settings change sets the new font now and refits a frame later; the pinch releases
+    // onto that same preset in between.
+    doc.started.send({ type: 'set-font-scale', fontScale: 1.5 })
+    pinchTo(doc, 20, false)
+    await settle()
+
+    const reported = metricsOf(doc.posted).slice(before)
+    expect(reported.map((message) => message.rowPitch)).toEqual([reported.at(-1)?.rowPitch])
+    expect(reported.at(-1)?.rowPitch).toBeGreaterThan(20)
+    doc.started.stop()
+  })
+})
diff --git a/mobile/src/terminal/document/document-host-seams.ts b/mobile/src/terminal/document/document-host-seams.ts
index ec10e313d435..1afaac6c1a15 100644
--- a/mobile/src/terminal/document/document-host-seams.ts
+++ b/mobile/src/terminal/document/document-host-seams.ts
@@ -26,8 +26,13 @@ export type TerminalDocumentViewportRect = {
   top: number
   width: number
   height: number
+  /** The host is `display:none` and the size is the last one it had; a fit waits for it to show. */
+  hidden?: boolean
 }
 
+/** What the host reports: a new box, or the same box back from being hidden. */
+export type TerminalViewportChange = 'resized' | 'shown'
+
 /** The document's runtime error reporter, taking the window error handler's own arguments. */
 export type TerminalDocumentErrorReporter = (
   message: string | (Event & { message?: unknown }),
@@ -40,6 +45,9 @@ export type TerminalDocumentErrorReporter = (
 /** A frame from the host, as its transport delivers it: JSON text from a bridge, or the object. */
 export type TerminalDocumentHostFrame = string | Record<string, unknown> | undefined
 
+/** How a document starts, as its view mounted. */
+export type TerminalDocumentStart = { textScale: number; shown: boolean }
+
 /**
  * The ten host seams, kept apart from the state because the host sets them once when it builds
  * the scope, before the start sequence runs, and no module writes them afterwards.
@@ -63,10 +71,16 @@ export type TerminalDocumentHostSeams = {
   installHostTransport: (receive: (frame: TerminalDocumentHostFrame) => void) => () => void
   /** `message-bridge`: whether the engine is here, which is what readiness is reported on. */
   hasEngine: () => boolean
+  /**
+   * How the document starts, as its view mounted: the app's text scale, which the terminal built
+   * before ready lays out at, and whether it was shown. Only a shown document builds before ready;
+   * every terminal is a WebGL context, and a page or app holds about sixteen.
+   */
+  start: () => TerminalDocumentStart
   /** Every fit, pan, scroll and overlay bound, and every client point mapped into the grid. */
   viewportRect: () => TerminalDocumentViewportRect
-  /** `fit-scale`: calls back when that box changes size, handing back its removal. */
-  observeViewport: (onChange: () => void) => () => void
+  /** `fit-scale`: calls back when that box changes size or is shown again, handing back its removal. */
+  observeViewport: (onChange: (change: TerminalViewportChange) => void) => () => void
   /**
    * Where this document's elements are: the node its markup was planted in, or null for the page
    * the document is running in.
@@ -120,6 +134,12 @@ declare global {
      * quotes it. The document reaches it through a seam, so a page's mount holds its own instead.
      */
     __engineErrors?: string[]
+    /**
+     * The WebView page writes these ahead of the document script: the text scale its view mounted
+     * at, and whether that view was shown then.
+     */
+    __orcaTerminalTextScale?: unknown
+    __orcaTerminalShown?: unknown
   }
   const Terminal: new (options: Record<string, unknown>) => TerminalDocumentTerminal
 }
@@ -213,6 +233,14 @@ export function windowHasEngine() {
   return window.Terminal !== undefined
 }
 
+export function windowStart(): TerminalDocumentStart {
+  const scale = window.__orcaTerminalTextScale
+  return {
+    textScale: typeof scale === 'number' && scale > 0 ? scale : 1,
+    shown: window.__orcaTerminalShown !== false
+  }
+}
+
 /**
  * The WebView's viewport: there the window is the terminal frame. On the page the window is the
  * whole page, taller than the frame by the header and dock, so the page answers with its host.
@@ -222,10 +250,11 @@ export function windowViewportRect(): TerminalDocumentViewportRect {
 }
 
 /** The WebView's frame changes size exactly when its window does. */
-export function observeWindowViewport(onChange: () => void) {
-  window.addEventListener('resize', onChange)
+export function observeWindowViewport(onChange: (change: TerminalViewportChange) => void) {
+  const listener = () => onChange('resized')
+  window.addEventListener('resize', listener)
   return function () {
-    window.removeEventListener('resize', onChange)
+    window.removeEventListener('resize', listener)
   }
 }
 
diff --git a/mobile/src/terminal/document/document-scope.ts b/mobile/src/terminal/document/document-scope.ts
index 9be374b2b274..0095a3275cee 100644
--- a/mobile/src/terminal/document/document-scope.ts
+++ b/mobile/src/terminal/document/document-scope.ts
@@ -1,3 +1,4 @@
+import type { TerminalLaidOutCellBox } from '../terminal-cell-box'
 import { DEFAULT_TERMINAL_THEME } from '../terminal-webview-html/theme'
 import {
   createEngineTerminal,
@@ -9,6 +10,7 @@ import {
   postToReactNativeWebView,
   windowCapturedEngineErrors,
   windowHasEngine,
+  windowStart,
   observeWindowViewport,
   windowViewportRect,
   type TerminalDocumentHost,
@@ -94,6 +96,8 @@ export type TerminalDocumentState = {
   terminalFontFamily: string
   /** `terminal-init`: whether the first live chunk since init is still pending. */
   firstDataPending: boolean
+  /** `laid-out-cell-box`: the box last reported or at ready, with the grid it was laid out at. */
+  reportedCellBox: TerminalLaidOutCellBox | null
   /** `terminal-init`: whether the replayed snapshot was an alternate screen. */
   activeAltScreenSnapshot: boolean
   /** `fit-scale`: the fit scale the document committed. */
@@ -156,6 +160,8 @@ export type TerminalDocumentState = {
   pendingTerm: TerminalDocumentTerminal | null
   /** `surface-swap`: the terminal the committed surface is showing. */
   committedTerm: TerminalDocumentTerminal | null
+  /** `terminal-init`: the terminal built before ready, until the first init reuses it. */
+  provisionalTerm: TerminalDocumentTerminal | null
   /** `surface-swap`: the surface the committed terminal is mounted on. */
   committedSurface: HTMLElement | null
   /** `surface-swap`: the hidden replacement surface, until it commits. */
@@ -181,8 +187,10 @@ export type TerminalDocumentState = {
   removeWebglRecovery: (() => void) | null
   /** `fit-scale`: the generation of the retry loop; a bump abandons the one in flight. */
   fitRetryToken: number
-  /** `fit-scale`: the viewport box the last fit was committed for, or null before one. */
-  fittedBox: { width: number; height: number } | null
+  /** `host-message-router`: the terminal frame the app last sent with a grid, or null before one. */
+  hostFrame: { width: number; height: number } | null
+  /** `fit-scale`: the reason of a fit held while the host is hidden, or null when none is owed. */
+  fitPending: string | null
   /** `mouse-click-drag`: the mouse gesture in progress, or null. */
   mouseGesture: TerminalMouseGesture | null
   /** `tap-dispatch`: what the document-level dispatcher has latched onto. */
@@ -263,6 +271,7 @@ function createTerminalDocumentState(): TerminalDocumentState {
     currentTextScale: 1,
     terminalFontFamily: '',
     firstDataPending: false,
+    reportedCellBox: null,
     activeAltScreenSnapshot: false,
     currentScale: 1,
     userScale: 1,
@@ -295,6 +304,7 @@ function createTerminalDocumentState(): TerminalDocumentState {
     surface: null,
     pendingTerm: null,
     committedTerm: null,
+    provisionalTerm: null,
     committedSurface: null,
     pendingSurface: null,
     scrollIndicator: null,
@@ -308,7 +318,8 @@ function createTerminalDocumentState(): TerminalDocumentState {
     removeTapDispatch: null,
     removeWebglRecovery: null,
     fitRetryToken: 0,
-    fittedBox: null,
+    hostFrame: null,
+    fitPending: null,
     mouseGesture: null,
     touchDispatch: {
       mode: 'idle',
@@ -346,6 +357,7 @@ function createTerminalDocumentHostSeams(): TerminalDocumentHostSeams {
     paintDocumentBackground: paintWindowDocumentBackground,
     installHostTransport: installWindowHostTransport,
     hasEngine: windowHasEngine,
+    start: windowStart,
     viewportRect: windowViewportRect,
     observeViewport: observeWindowViewport,
     root: null
diff --git a/mobile/src/terminal/document/document-terminal-shape.ts b/mobile/src/terminal/document/document-terminal-shape.ts
index 15cccfda35b3..b5807efdf7fa 100644
--- a/mobile/src/terminal/document/document-terminal-shape.ts
+++ b/mobile/src/terminal/document/document-terminal-shape.ts
@@ -102,6 +102,7 @@ export type TerminalDocumentTerminal = {
   onLineFeed?: (listener: () => void) => TerminalDocumentDisposable
   onScroll?: (listener: () => void) => TerminalDocumentDisposable
   onWriteParsed?: (listener: () => void) => TerminalDocumentDisposable
+  onRender?: (listener: () => void) => TerminalDocumentDisposable
   resize: (cols: number, rows: number) => void
   refresh: (start: number, end: number) => void
   dispose: () => void
diff --git a/mobile/src/terminal/document/fit-scale.ts b/mobile/src/terminal/document/fit-scale.ts
index 20aa1c1ee49e..8047b9f630c1 100644
--- a/mobile/src/terminal/document/fit-scale.ts
+++ b/mobile/src/terminal/document/fit-scale.ts
@@ -3,24 +3,17 @@ import {
   computeFitScale,
   flog,
   getCellWidth,
+  getMeasuredCellHeight,
   getTotalScale,
   updateTransform
 } from './viewport-transform'
 import type { TerminalDocumentScope } from './document-scope'
+import type { TerminalViewportChange } from './document-host-seams'
 import { scheduleDocumentFrame } from './document-frame-registry'
-
-/** The narrowest grid a fit or a text-scale change will fit to. */
-export const MIN_FIT_COLS = 20
+import { emitKeyboardAvoidanceMetrics } from './keyboard-avoidance-metrics'
 
 export function getCellHeight(scope: TerminalDocumentScope) {
-  if (!scope.term || !scope.term._core) {
-    return 15
-  }
-  const core = scope.term._core
-  if (core._renderService && core._renderService.dimensions) {
-    return core._renderService.dimensions.css.cell.height || 15
-  }
-  return 15
+  return getMeasuredCellHeight(scope) || 15
 }
 
 // Why: clamp pan so the terminal content always covers the viewport
@@ -65,23 +58,15 @@ export function adjustRowsForViewport() {}
 // so a backgrounded WebView never spins forever.
 const FIT_RETRY_MAX_FRAMES = 60
 
-function isFittedBox(scope: TerminalDocumentScope) {
-  const { width, height } = scope.viewportRect()
-  const fitted = scope.fittedBox
-  return fitted !== null && fitted.width === width && fitted.height === height
-}
-
-function hasViewportWidth(scope: TerminalDocumentScope) {
-  const width = scope.viewportRect().width
-  return Number.isFinite(width) && width > 0
+function isViewportShown(scope: TerminalDocumentScope) {
+  const { width, hidden } = scope.viewportRect()
+  return hidden !== true && Number.isFinite(width) && width > 0
 }
 
 export function applyFitScale(scope: TerminalDocumentScope, reason: string) {
   if (!scope.term || !scope.term.element) {
     return
   }
-  // Why: a fit asked for while hidden is dropped until a box arrives, and that box may be the old one.
-  scope.fittedBox = null
   const token = ++scope.fitRetryToken
   let attempts = 0
   let lastScrollWidth = -1
@@ -92,8 +77,9 @@ export function applyFitScale(scope: TerminalDocumentScope, reason: string) {
     if (!scope.term || !scope.term.element) {
       return
     }
-    // Why: a display:none host measures 0 wide; the fit stays pending until observeViewport reports a box.
-    if (!hasViewportWidth(scope)) {
+    // Why: a hidden grid may not measure its cells, so the fit is held until the host is shown.
+    if (!isViewportShown(scope)) {
+      scope.fitPending = reason
       return
     }
     attempts++
@@ -134,8 +120,7 @@ export function commitFitScale(
     return
   }
   const preSnapScale = computeFitScale(scope)
-  const { width, height } = scope.viewportRect()
-  scope.fittedBox = { width, height }
+  scope.fitPending = null
   scope.currentScale = preSnapScale
   // Why: when scale is very close to 1 (e.g. 0.97 from xterm scrollbar
   // sub-pixels) snap to 1 to avoid imperceptible shrinkage that prevents
@@ -170,6 +155,8 @@ export function commitFitScale(
     })
   }
   repositionOverlay(scope)
+  // The host's lift reads the drawn row pitch, which a new scale changes with no new output.
+  emitKeyboardAvoidanceMetrics(scope)
 }
 
 /**
@@ -181,10 +168,12 @@ export function commitFitScale(
  * had to copy the five calls into its mount to get it at all (ruling 24).
  */
 export function startFitScale(scope: TerminalDocumentScope) {
-  const refit = () => {
-    // Why: a hidden screen reports 0x0 and then its old box again; native never refits on that, so
-    // only a box other than the one last fitted refits, and the user's pan and zoom survive.
-    if (!hasViewportWidth(scope) || isFittedBox(scope)) {
+  const refit = (change: TerminalViewportChange) => {
+    // Why: showing the same box again is not a resize; only a fit held while hidden runs, so pan and zoom survive.
+    if (change === 'shown') {
+      if (scope.fitPending !== null) {
+        applyFitScale(scope, scope.fitPending)
+      }
       return
     }
     applyFitScale(scope, 'window-resize')
diff --git a/mobile/src/terminal/document/host-message-router.ts b/mobile/src/terminal/document/host-message-router.ts
index 8c63c715b179..0b155e1b70cd 100644
--- a/mobile/src/terminal/document/host-message-router.ts
+++ b/mobile/src/terminal/document/host-message-router.ts
@@ -1,6 +1,5 @@
 import type { TerminalDocumentScope } from './document-scope'
-import { scheduleDocumentFrame } from './document-frame-registry'
-import { applyFitScale, MIN_FIT_COLS } from './fit-scale'
+import { applyFitScale } from './fit-scale'
 import { notify } from './host-notify'
 import { emitKeyboardAvoidanceMetrics } from './keyboard-avoidance-metrics'
 import { emitModesIfChanged } from './mode-mirroring'
@@ -12,7 +11,6 @@ import { resetEvictionCounter } from './selection-state-and-eviction'
 import { applyTerminalTheme } from './terminal-theme'
 import { init, resize, write } from './terminal-init'
 import { applyTextScale } from './text-scaling'
-import { flog } from './viewport-transform'
 import { resetWriteQueue } from './write-queue'
 
 /** One message from the host. Every field is optional because the router reads them by type. */
@@ -27,83 +25,20 @@ export type TerminalHostMessage = {
   preserveScroll?: boolean
   oscLinks?: unknown
   data?: string
-  containerHeight?: number
+  frame?: { width: number; height: number } | null
 }
 
-export function measureFitDimensions(
-  scope: TerminalDocumentScope,
-  containerHeightPx: unknown,
-  retriesLeft?: number
-) {
-  if (typeof retriesLeft !== 'number') {
-    retriesLeft = 30
-  }
-  // Why: init and measure are posted back-to-back from React, but
-  // init has an async rAF chain. A measure that runs synchronously
-  // after init can find term null, disposed, lacking element, or
-  // with cells size 0. Retry the whole gate for ~500ms.
-  const notReady = !scope.term || !scope.term.element
-  let cellWidth = 0
-  let cellHeight = 0
-  if (!notReady) {
-    const core = scope.term!._core
-    if (core && core._renderService && core._renderService.dimensions) {
-      cellWidth = core._renderService.dimensions.css.cell.width
-      cellHeight = core._renderService.dimensions.css.cell.height
-    }
-  }
-  if (notReady || cellWidth <= 0 || cellHeight <= 0) {
-    if (retriesLeft > 0) {
-      // Ruling 21: a retry that outlives its mount would answer the next mount's measure.
-      const gen = scope.terminalGeneration
-      scheduleDocumentFrame(scope, function () {
-        if (gen !== scope.terminalGeneration) {
-          return
-        }
-        measureFitDimensions(scope, containerHeightPx, retriesLeft - 1)
-      })
-      return
-    }
-    flog(scope, 'measure-fail', {
-      notReady: notReady,
-      cellWidth: cellWidth,
-      cellHeight: cellHeight,
-      retriesLeft: retriesLeft
-    })
-    notify(scope, { type: 'measure-result', cols: null, rows: null })
-    return
-  }
-  const viewport = scope.viewportRect()
-  const vpWidth = viewport.width
-  // Why: prefer the container height passed from React Native over the
-  // viewport's. The RN layout system knows the exact pixel height of the
-  // terminal frame after the accessory/input bars are subtracted, whereas
-  // the viewport can overstate the visible area due to layout timing or
-  // safe-area insets.
-  const vpHeight =
-    typeof containerHeightPx === 'number' && containerHeightPx > 0
-      ? containerHeightPx
-      : viewport.height
-  const cols = Math.floor(vpWidth / cellWidth)
-  if (cols < MIN_FIT_COLS) {
-    flog(scope, 'measure-skip-small-width', {
-      vpWidth: vpWidth,
-      cellWidth: cellWidth,
-      cols: cols
-    })
-    notify(scope, { type: 'measure-result', cols: null, rows: null })
-    return
-  }
-  // Why: the rows we report become the PTY's actual row count after the
-  // server fits to viewport, and xterm renders exactly that many lines
-  // anchored top-left of the WebView. Subtracting rows here would leave
-  // dead xterm-background space at the bottom of the container and make
-  // the last PTY rows visually appear above an "invisible line." Any
-  // safety margin between the prompt and the accessory bar must come
-  // from RN layout (terminalFrame's flex bounds), not from undersizing
-  // the PTY.
-  const rows = Math.max(8, Math.floor(vpHeight / cellHeight))
-  notify(scope, { type: 'measure-result', cols: cols, rows: rows })
+/** The frame React Native laid out, sent with every grid; null when absent or without a size. */
+function hostFrameOf(msg: TerminalHostMessage) {
+  const frame = msg.frame
+  return frame && frame.width > 0 && frame.height > 0
+    ? { width: frame.width, height: frame.height }
+    : null
+}
+
+/** Keeps the frame a grid was fitted to, for a later text-scale change to fit. */
+function holdHostFrame(scope: TerminalDocumentScope, msg: TerminalHostMessage) {
+  scope.hostFrame = hostFrameOf(msg) ?? scope.hostFrame
 }
 
 export function handleMsg(scope: TerminalDocumentScope, msg: TerminalHostMessage) {
@@ -120,6 +55,7 @@ export function handleMsg(scope: TerminalDocumentScope, msg: TerminalHostMessage
   if (msg.type === 'ping') {
     notify(scope, { type: 'pong', pingId: msg.id })
   } else if (msg.type === 'init') {
+    holdHostFrame(scope, msg)
     init(
       scope,
       msg.cols!,
@@ -144,8 +80,10 @@ export function handleMsg(scope: TerminalDocumentScope, msg: TerminalHostMessage
       applyTextScale(scope, msg.fontScale)
     }
   } else if (msg.type === 'resize') {
+    holdHostFrame(scope, msg)
     resize(scope, msg.cols!, msg.rows!)
   } else if (msg.type === 'reflow') {
+    holdHostFrame(scope, msg)
     reflow(scope, msg.cols!, msg.rows!)
   } else if (msg.type === 'write') {
     write(scope, msg.data!)
@@ -174,8 +112,6 @@ export function handleMsg(scope: TerminalDocumentScope, msg: TerminalHostMessage
       notify(scope, { type: 'selection-evicted' })
       cancelSelect(scope)
     }
-  } else if (msg.type === 'measure') {
-    measureFitDimensions(scope, msg.containerHeight)
   } else if (msg.type === 'reset-zoom') {
     applyFitScale(scope, 'reset-zoom-msg')
   } else if (msg.type === 'set-theme') {
diff --git a/mobile/src/terminal/document/host-seams.test.ts b/mobile/src/terminal/document/host-seams.test.ts
index 0991f4bb9b14..17d709ddc421 100644
--- a/mobile/src/terminal/document/host-seams.test.ts
+++ b/mobile/src/terminal/document/host-seams.test.ts
@@ -6,7 +6,7 @@ import { handleMsg } from './host-message-router'
 import { notify } from './host-notify'
 import { flog } from './viewport-transform'
 import { attachWebglAddon } from './webgl-recovery'
-import type { TerminalDocumentHost } from './document-host-seams'
+import type { TerminalDocumentHost, TerminalViewportChange } from './document-host-seams'
 import { documentSourceText } from './document-module-source.test-support'
 
 /**
@@ -205,24 +205,22 @@ describe('the document host seams, by default', () => {
 })
 
 describe('the document host seams, once the page sets them', () => {
-  it('fits a measure with no container height to the host rather than the window', () => {
-    // The page's host is one element on a page that is taller and wider than it; the window is
-    // happy-dom's 1024x768, so a fit read off the window would answer 136x51.
-    const cell = { width: 7.5, height: 15 }
-    const terminal = Object.assign(terminalDouble(), {
-      _core: { _renderService: { dimensions: { css: { cell } } } }
-    })
-    const posted: Record<string, unknown>[] = []
+  it('keeps the frame React Native laid out from each grid, not the viewport CSS rounded', () => {
+    // 1080 device px at a 2.75 pixel ratio: React Native lays the frame out at 392.73 and the
+    // document's viewport reads 393. A grid without a whole frame leaves the last one in place.
+    const frame = { width: 1080 / 2.75, height: 600 }
     const scope = startedScope({
-      createTerminal: () => terminal,
-      postToHost: (message) => posted.push(message),
-      viewportRect: () => ({ left: 0, top: 82, width: 390, height: 600 })
+      createTerminal: () => terminalDouble(),
+      viewportRect: () => ({ left: 0, top: 0, width: 393, height: 600 })
     })
     handleMsg(scope, { type: 'init', cols: 80, rows: 24, initialData: '', preserveScroll: false })
-    handleMsg(scope, { type: 'measure' })
-    expect(posted.filter((message) => message.type === 'measure-result')).toEqual([
-      { type: 'measure-result', cols: 52, rows: 40 }
-    ])
+    expect(scope.hostFrame).toBeNull()
+    handleMsg(scope, { type: 'resize', cols: 50, rows: 40, frame: { width: 390, height: 0 } })
+    expect(scope.hostFrame).toBeNull()
+    handleMsg(scope, { type: 'resize', cols: 50, rows: 40, frame })
+    expect(scope.hostFrame).toEqual(frame)
+    handleMsg(scope, { type: 'reflow', cols: 50, rows: 40 })
+    expect(scope.hostFrame).toEqual(frame)
   })
 
   it('routes every notify to the field and nothing to the bridge', () => {
@@ -232,7 +230,7 @@ describe('the document host seams, once the page sets them', () => {
     const scope = startedScope({ postToHost: (message) => posted.push(message) })
     // The sequence's own `web-ready` is the document reporting itself started; what this case reads
     // is what the two notify paths send afterwards.
-    expect(posted).toEqual([{ type: 'web-ready' }])
+    expect(posted).toEqual([expect.objectContaining({ type: 'web-ready' })])
     posted.length = 0
     notify(scope, { type: 'pong', pingId: 7 })
     flog(scope, 'probe', { n: 1 })
@@ -299,7 +297,7 @@ describe('the document host seams, once the page sets them', () => {
 
 describe("the document's viewport", () => {
   it('refits when the host says its box changed, and not on a window resize it does not own', () => {
-    const changes: (() => void)[] = []
+    const changes: ((change: TerminalViewportChange) => void)[] = []
     const scope = startedScope({
       createTerminal: () => terminalDouble(),
       observeViewport: (onChange) => {
@@ -312,7 +310,10 @@ describe("the document's viewport", () => {
     window.dispatchEvent(new Event('resize'))
     expect(scope.panX).toBe(50)
     expect(changes).toHaveLength(1)
-    changes[0]!()
+    // The same box shown again with no fit held is not a resize: the pan stays.
+    changes[0]!('shown')
+    expect(scope.panX).toBe(50)
+    changes[0]!('resized')
     expect(scope.panX).toBe(0)
   })
 
diff --git a/mobile/src/terminal/document/keyboard-avoidance-metrics.ts b/mobile/src/terminal/document/keyboard-avoidance-metrics.ts
index 516dfdb1b2a6..a0f28d801c16 100644
--- a/mobile/src/terminal/document/keyboard-avoidance-metrics.ts
+++ b/mobile/src/terminal/document/keyboard-avoidance-metrics.ts
@@ -1,3 +1,4 @@
+import { getMeasuredCellHeight, getTotalScale } from './viewport-transform'
 import { notify } from './host-notify'
 import type {
   TerminalDocumentCell,
@@ -70,6 +71,8 @@ export function emitKeyboardAvoidanceMetrics(scope: TerminalDocumentScope) {
     cursorY: scope.term.buffer && scope.term.buffer.active ? scope.term.buffer.active.cursorY : 0,
     contentBottomRow: alt ? 0 : computeContentBottomRow(scope),
     rows: scope.term.rows || 0,
-    altScreen: alt
+    altScreen: alt,
+    // As drawn: desktop display mode scales the desktop's rows down to the phone's width.
+    rowPitch: getMeasuredCellHeight(scope) * getTotalScale(scope)
   })
 }
diff --git a/mobile/src/terminal/document/laid-out-cell-box.test.ts b/mobile/src/terminal/document/laid-out-cell-box.test.ts
new file mode 100644
index 000000000000..5a8ed7453a0d
--- /dev/null
+++ b/mobile/src/terminal/document/laid-out-cell-box.test.ts
@@ -0,0 +1,343 @@
+// @vitest-environment happy-dom
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { laidOutCellBox, reportLaidOutCellBox } from './laid-out-cell-box'
+import { createTerminalDocumentScope, type TerminalDocumentScope } from './document-scope'
+import { startTerminalDocument, stopTerminalDocument } from './create-terminal-document'
+import type { TerminalDocumentHost } from './document-host-seams'
+import { fontPxForScale } from './text-scaling'
+import { terminalDocumentDouble } from './document-terminal-double.test-support'
+import { handleMsg } from './host-message-router'
+import { TERMINAL_DOCUMENT_MARKUP } from '../terminal-webview-html/document-markup'
+
+afterEach(() => {
+  vi.unstubAllGlobals()
+  document.body.innerHTML = ''
+})
+
+describe('laidOutCellBox', () => {
+  function scopeWithCell(
+    cell: { width: number; height: number },
+    fontSize: number,
+    posted: Record<string, unknown>[] = []
+  ) {
+    const scope = createTerminalDocumentScope({ postToHost: (message) => posted.push(message) })
+    scope.currentTextScale = 1.25
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the reader touches only cols, rows, options.fontSize and _core's render dimensions.
+    scope.term = {
+      cols: 55,
+      rows: 47,
+      options: { fontSize },
+      _core: { _renderService: { dimensions: { css: { cell } } } }
+    } as unknown as typeof scope.term
+    return scope
+  }
+
+  it('reads the box xterm laid out at the current text scale, with its grid', () => {
+    const scope = scopeWithCell({ width: 29 / 3, height: 21 }, fontPxForScale(1.25))
+    expect(laidOutCellBox(scope)).toEqual({
+      cellBox: { fontScale: 1.25, cellWidth: 29 / 3, cellHeight: 21 },
+      cols: 55,
+      rows: 47
+    })
+  })
+
+  it('tells the host each new box once, and refits only a box that changed at a kept grid', () => {
+    const posted: Record<string, unknown>[] = []
+    const cell = { width: 29 / 3, height: 21 }
+    const scope = scopeWithCell(cell, fontPxForScale(1.25), posted)
+    reportLaidOutCellBox(scope)
+    reportLaidOutCellBox(scope)
+    // A new grid with the same box tells the host nothing; the document holds that grid.
+    Object.assign(scope.term!, { cols: 50 })
+    reportLaidOutCellBox(scope)
+    cell.width = 9.75
+    reportLaidOutCellBox(scope)
+    expect(posted).toEqual([
+      {
+        type: 'cell-box',
+        cellBox: { fontScale: 1.25, cellWidth: 29 / 3, cellHeight: 21 },
+        refit: false
+      },
+      {
+        type: 'cell-box',
+        cellBox: { fontScale: 1.25, cellWidth: 9.75, cellHeight: 21 },
+        refit: true
+      }
+    ])
+  })
+})
+
+describe('a started document', () => {
+  /** A document whose engine builds grids with a cell that follows the font, and every notify. */
+  function started(host: TerminalDocumentHost = {}) {
+    document.body.innerHTML = TERMINAL_DOCUMENT_MARKUP
+    const cell = { width: 23 / 3, height: 15 }
+    const renderListeners: (() => void)[] = []
+    const built: { options: Record<string, unknown> }[] = []
+    const createTerminal = (options: Record<string, unknown>) => {
+      const terminal = terminalDocumentDouble().terminal
+      const grid = Object.assign(terminal, {
+        cols: Number(options.cols),
+        rows: Number(options.rows),
+        options: { ...terminal.options, fontSize: Number(options.fontSize) },
+        _core: {
+          _renderService: {
+            get dimensions() {
+              const k = grid.options.fontSize / 13
+              return { css: { cell: { width: cell.width * k, height: cell.height * k } } }
+            }
+          }
+        },
+        onRender: (listener: () => void) => {
+          renderListeners.push(listener)
+          return { dispose() {} }
+        }
+      })
+      grid.resize = (cols: number, rows: number) => {
+        grid.cols = cols
+        grid.rows = rows
+      }
+      built.push({ options })
+      return grid
+    }
+    const posted: Record<string, unknown>[] = []
+    const scope = createTerminalDocumentScope({
+      installHostTransport: () => () => {},
+      hasEngine: () => true,
+      createTerminal,
+      postToHost: (message) => posted.push(message),
+      ...host
+    })
+    startTerminalDocument(scope)
+    const render = () => renderListeners.forEach((listener) => listener())
+    const init = () =>
+      handleMsg(scope, { type: 'init', cols: 55, rows: 47, initialData: '', preserveScroll: false })
+    return { scope, cell, posted, render, built, init }
+  }
+
+  const nextFrame = () => new Promise<void>((resolve) => requestAnimationFrame(() => resolve()))
+  async function untilReady(posted: Record<string, unknown>[]) {
+    for (let frame = 0; frame < 30 && !posted.some((m) => m.type === 'ready'); frame++) {
+      await nextFrame()
+    }
+  }
+  const boxes = (posted: Record<string, unknown>[]) =>
+    posted.filter((m) => m.type === 'cell-box').map((m) => m.cellBox)
+  const refits = (posted: Record<string, unknown>[]) =>
+    posted.filter((m) => m.type === 'cell-box').map((m) => m.refit)
+  const reflowTo = (scope: TerminalDocumentScope, cols: number) =>
+    handleMsg(scope, { type: 'reflow', cols, rows: 47 })
+
+  it('takes the frame the app laid out from init, resize and reflow', () => {
+    const { scope } = started()
+    try {
+      handleMsg(scope, {
+        type: 'init',
+        cols: 55,
+        rows: 47,
+        initialData: '',
+        preserveScroll: false,
+        frame: { width: 427.5, height: 710 }
+      })
+      expect(scope.hostFrame).toEqual({ width: 427.5, height: 710 })
+    } finally {
+      stopTerminalDocument(scope)
+    }
+  })
+
+  it('reports ready with the box its own terminal laid out, at the app text scale', () => {
+    const { scope, posted, built } = started({ start: () => ({ textScale: 1.25, shown: true }) })
+    try {
+      expect(built).toHaveLength(1)
+      expect(built[0].options.fontSize).toBe(fontPxForScale(1.25))
+      expect(posted[0]).toEqual({
+        type: 'web-ready',
+        cellBox: { fontScale: 1.25, cellWidth: (23 / 3) * (16 / 13), cellHeight: 15 * (16 / 13) }
+      })
+    } finally {
+      stopTerminalDocument(scope)
+    }
+  })
+
+  it('leaves no live terminal when opening the one it builds before ready throws', () => {
+    const double = terminalDocumentDouble()
+    double.terminal.open = () => {
+      throw new Error('no surface')
+    }
+    const { scope, posted } = started({ createTerminal: () => double.terminal })
+    try {
+      expect(scope.term).toBeNull()
+      expect(double.disposals()).toBe(1)
+      expect(posted[0]).toEqual({ type: 'web-ready', cellBox: null })
+    } finally {
+      stopTerminalDocument(scope)
+    }
+  })
+
+  it('builds nothing before ready for a view hidden when it mounted, and reports no box', () => {
+    const { scope, posted, built } = started({ start: () => ({ textScale: 1, shown: false }) })
+    try {
+      expect(built).toHaveLength(0)
+      expect(posted[0]).toEqual({ type: 'web-ready', cellBox: null })
+    } finally {
+      stopTerminalDocument(scope)
+    }
+  })
+
+  it('reuses that terminal for the first init, so an open builds one xterm', async () => {
+    const { scope, posted, built, init } = started()
+    try {
+      const prepared = scope.term
+      init()
+      await untilReady(posted)
+      expect(built).toHaveLength(1)
+      expect(scope.term).toBe(prepared)
+      expect(scope.term?.cols).toBe(55)
+      expect(scope.term?.rows).toBe(47)
+    } finally {
+      stopTerminalDocument(scope)
+    }
+  })
+
+  it('keeps the terminal built before ready out of sight until the first init has replayed', async () => {
+    const { scope, posted, init } = started()
+    try {
+      // Hidden, not removed from layout: the box is measured and reported while it is out of sight.
+      expect(scope.surface?.style.visibility).toBe('hidden')
+      expect(scope.surface?.style.display).toBe('')
+      expect(posted[0]).toEqual({
+        type: 'web-ready',
+        cellBox: { fontScale: 1, cellWidth: 23 / 3, cellHeight: 15 }
+      })
+      init()
+      expect(scope.surface?.style.visibility).toBe('hidden')
+      await untilReady(posted)
+      expect(scope.surface?.style.visibility).toBe('')
+      // The box is the ready's own at the init's grid, which the app already holds.
+      expect(posted.filter((message) => message.type === 'cell-box')).toEqual([])
+    } finally {
+      stopTerminalDocument(scope)
+    }
+  })
+
+  it('reports a paused renderer at ready, before ready itself', async () => {
+    const { scope, cell, posted, init } = started()
+    try {
+      // The DOM renderer's box at the init's grid, which the paused renderer has not drawn yet.
+      cell.width = 7.8
+      init()
+      await untilReady(posted)
+      const types = posted.map((m) => m.type)
+      expect(types.indexOf('cell-box')).toBeGreaterThan(-1)
+      expect(types.indexOf('cell-box')).toBeLessThan(types.indexOf('ready'))
+      expect(boxes(posted)).toEqual([{ fontScale: 1, cellWidth: 7.8, cellHeight: 15 }])
+    } finally {
+      stopTerminalDocument(scope)
+    }
+  })
+
+  it('reports a text-size change on the render after it, not when the font is set', async () => {
+    // xterm updates the render service's cell box synchronously when fontSize is set
+    // (CharSizeService.measure → RenderService.handleCharSizeChanged), and onRender fires after the
+    // rows it redrew, so the next render reads the new box at the new scale.
+    const { scope, posted, render, init } = started()
+    try {
+      init()
+      await untilReady(posted)
+      const reported = boxes(posted).length
+      handleMsg(scope, { type: 'set-font-scale', fontScale: 1.25 })
+      expect(boxes(posted)).toHaveLength(reported)
+      render()
+      expect(boxes(posted).at(-1)).toEqual({
+        fontScale: 1.25,
+        cellWidth: (23 / 3) * (16 / 13),
+        cellHeight: 15 * (16 / 13)
+      })
+    } finally {
+      stopTerminalDocument(scope)
+    }
+  })
+
+  it('reports a renderer swap after context loss on the next render', async () => {
+    const { scope, cell, posted, render, init } = started()
+    try {
+      init()
+      await untilReady(posted)
+      cell.width = 7.8
+      render()
+      expect(boxes(posted).at(-1)).toEqual({ fontScale: 1, cellWidth: 7.8, cellHeight: 15 })
+    } finally {
+      stopTerminalDocument(scope)
+    }
+  })
+
+  it("refits a DOM first init once, and not again on the refit's own report", async () => {
+    const { scope, cell, posted, render, init } = started()
+    try {
+      // The terminal built before ready laid its box out at 80x24; the DOM renderer's box follows cols.
+      cell.width = 7.8
+      init()
+      await untilReady(posted)
+      expect(refits(posted)).toEqual([true])
+      cell.width = 7.9
+      reflowTo(scope, 54)
+      render()
+      expect(refits(posted)).toEqual([true, false])
+    } finally {
+      stopTerminalDocument(scope)
+    }
+  })
+
+  it('never refits a box that came with a new grid, so the DOM renderer cannot loop', async () => {
+    const { scope, cell, posted, render, init } = started()
+    try {
+      init()
+      await untilReady(posted)
+      for (const [cols, width] of [
+        [50, 7.9],
+        [55, 7.8],
+        [54, 8]
+      ]) {
+        cell.width = width
+        reflowTo(scope, cols)
+        render()
+      }
+      expect(refits(posted)).toEqual([false, false, false])
+    } finally {
+      stopTerminalDocument(scope)
+    }
+  })
+
+  it('refits a renderer swap at a grid applied in place', async () => {
+    const { scope, cell, posted, render, init } = started()
+    try {
+      init()
+      await untilReady(posted)
+      // A width change applied in place: the WebGL box is unchanged, so nothing is told.
+      reflowTo(scope, 50)
+      render()
+      expect(refits(posted)).toEqual([])
+      // WebGL context lost: the DOM fallback lays out a new box at the same grid.
+      cell.width = 7.8
+      render()
+      expect(refits(posted)).toEqual([true])
+    } finally {
+      stopTerminalDocument(scope)
+    }
+  })
+
+  it('refits a re-init at the same grid with a different renderer', async () => {
+    const { scope, cell, posted, init } = started()
+    try {
+      init()
+      await untilReady(posted)
+      posted.length = 0
+      cell.width = 7.8
+      init()
+      await untilReady(posted)
+      expect(refits(posted)).toEqual([true])
+    } finally {
+      stopTerminalDocument(scope)
+    }
+  })
+})
diff --git a/mobile/src/terminal/document/laid-out-cell-box.ts b/mobile/src/terminal/document/laid-out-cell-box.ts
new file mode 100644
index 000000000000..3c6c45fa723f
--- /dev/null
+++ b/mobile/src/terminal/document/laid-out-cell-box.ts
@@ -0,0 +1,38 @@
+import { sameCellBox, type TerminalLaidOutCellBox } from '../terminal-cell-box'
+import type { TerminalDocumentScope } from './document-scope'
+import { notify } from './host-notify'
+
+/** The box xterm laid out at the current text scale, with its grid; null before one. */
+export function laidOutCellBox(scope: TerminalDocumentScope): TerminalLaidOutCellBox | null {
+  const term = scope.term
+  const dimensions = term && term._core && term._core._renderService?.dimensions
+  if (!term || !dimensions) {
+    return null
+  }
+  const { width, height } = dimensions.css.cell
+  if (!(width > 0 && height > 0)) {
+    return null
+  }
+  const cellBox = { fontScale: scope.currentTextScale, cellWidth: width, cellHeight: height }
+  return { cellBox, cols: term.cols, rows: term.rows }
+}
+
+/**
+ * Tells the host each box xterm lays out that differs from the last: after init, a renderer swap
+ * on context loss, a text-size or DPR change, or a resize (the DOM renderer's width follows cols).
+ * `refit` is a box that changed while the grid did not, which only a renderer or pixel-ratio
+ * change does; one that arrives with a new grid is that grid's own, so refitting it would loop.
+ */
+export function reportLaidOutCellBox(scope: TerminalDocumentScope) {
+  const laidOut = laidOutCellBox(scope)
+  if (!laidOut) {
+    return
+  }
+  const last = scope.reportedCellBox
+  scope.reportedCellBox = laidOut
+  if (last && sameCellBox(last.cellBox, laidOut.cellBox)) {
+    return
+  }
+  const refit = last !== null && last.cols === laidOut.cols && last.rows === laidOut.rows
+  notify(scope, { type: 'cell-box', cellBox: laidOut.cellBox, refit })
+}
diff --git a/mobile/src/terminal/document/message-bridge.ts b/mobile/src/terminal/document/message-bridge.ts
index b4e21da07b7b..f86bec8b743d 100644
--- a/mobile/src/terminal/document/message-bridge.ts
+++ b/mobile/src/terminal/document/message-bridge.ts
@@ -1,5 +1,7 @@
 import { handleMsg, type TerminalHostMessage } from './host-message-router'
 import { notify, reportEngineError, type TerminalEngineError } from './host-notify'
+import { laidOutCellBox } from './laid-out-cell-box'
+import { prepareTerminal } from './terminal-init'
 import type { TerminalDocumentScope } from './document-scope'
 import type { TerminalDocumentHostFrame } from './document-host-seams'
 
@@ -45,7 +47,13 @@ export function startMessageBridge(scope: TerminalDocumentScope) {
     handleIncomingMessage(scope, frame)
   )
   if (scope.hasEngine()) {
-    notify(scope, { type: 'web-ready' })
+    // Why: ready carries the cell box xterm itself laid out, so the host sizes the first subscribe.
+    if (scope.start().shown) {
+      prepareTerminal(scope)
+    }
+    // Why: the first init's report is checked against the box the terminal built before ready laid out.
+    scope.reportedCellBox = laidOutCellBox(scope)
+    notify(scope, { type: 'web-ready', cellBox: scope.reportedCellBox?.cellBox ?? null })
   } else {
     reportEngineError(scope, 'terminal engine missing', 'xterm failed to load', true)
   }
diff --git a/mobile/src/terminal/document/native-document-bundle.test.ts b/mobile/src/terminal/document/native-document-bundle.test.ts
index 15eb000ee1f5..4389c3bb1058 100644
--- a/mobile/src/terminal/document/native-document-bundle.test.ts
+++ b/mobile/src/terminal/document/native-document-bundle.test.ts
@@ -311,7 +311,10 @@ describe('the bundled native document', () => {
     // that ships rather than about a bundle this case built for itself.
     const { script, inputs } = await terminalDocumentBundle()
     expect(inputs.filter((input) => input.includes('node_modules'))).toEqual([])
-    expect(inputs).toHaveLength(47)
+    // 50: `laid-out-cell-box` reads the cell box xterm laid out, for web-ready and each render;
+    // `terminal-grid-fit` is the one fit of that box and `terminal-cell-box` its one comparison,
+    // both shared with the app.
+    expect(inputs).toHaveLength(50)
     expect(script).not.toContain('__commonJS')
     // `__esm` wrappers are esbuild's answer to a cycle, and a cycle would make a module's top level
     // run at first import rather than where the bundle places it.
diff --git a/mobile/src/terminal/document/term-observers.ts b/mobile/src/terminal/document/term-observers.ts
index 80f3ec597afb..e35a85acc4fa 100644
--- a/mobile/src/terminal/document/term-observers.ts
+++ b/mobile/src/terminal/document/term-observers.ts
@@ -4,6 +4,7 @@ import type { TerminalDocumentScope } from './document-scope'
 import { logFeedAndEvict } from './selection-state-and-eviction'
 import { emitKeyboardAvoidanceMetrics } from './keyboard-avoidance-metrics'
 import { emitModesIfChanged } from './mode-mirroring'
+import { reportLaidOutCellBox } from './laid-out-cell-box'
 
 export function attachTermObservers(scope: TerminalDocumentScope) {
   if (!scope.term) {
@@ -36,6 +37,16 @@ export function attachTermObservers(scope: TerminalDocumentScope) {
       )
     }
   } catch {}
+  // Why: onDimensionsChange skips a renderer swap and a DPR change; every one of them re-renders.
+  try {
+    if (scope.term.onRender) {
+      scope.termObserverDisposables.push(
+        scope.term.onRender(function () {
+          reportLaidOutCellBox(scope)
+        })
+      )
+    }
+  } catch {}
   // Initial emit once buffer settles.
   afterWritesDrained(scope, function () {
     emitModesIfChanged(scope)
diff --git a/mobile/src/terminal/document/terminal-init.ts b/mobile/src/terminal/document/terminal-init.ts
index f63e2b5f508e..04e90b4578e1 100644
--- a/mobile/src/terminal/document/terminal-init.ts
+++ b/mobile/src/terminal/document/terminal-init.ts
@@ -2,8 +2,9 @@ import { emitKeyboardAvoidanceMetrics } from './keyboard-avoidance-metrics'
 import { MOBILE_TERMINAL_CARET_OPTIONS } from '../terminal-webview-html/theme'
 import { ESC } from './escape-introducers'
 import { notify } from './host-notify'
+import { reportLaidOutCellBox } from './laid-out-cell-box'
 import { fontPxForScale } from './text-scaling'
-import type { TerminalDocumentScope } from './document-scope'
+import type { TerminalDocumentScope, TerminalDocumentTerminal } from './document-scope'
 import { scheduleDocumentFrame } from './document-frame-registry'
 import { applyFitScale } from './fit-scale'
 import {
@@ -21,6 +22,63 @@ import { applyTerminalTheme } from './terminal-theme'
 import { attachWebglAddon, cancelWebglContextRecovery } from './webgl-recovery'
 import { afterWritesDrained, enqueueWrite, pumpWrites, resetWriteQueue } from './write-queue'
 
+/** Builds and opens a terminal on the current surface, with the renderer and addons attached. */
+function openTerminal(scope: TerminalDocumentScope, cols: number, rows: number) {
+  const term = scope.createTerminal({
+    cols: cols,
+    rows: rows,
+    theme: scope.terminalTheme,
+    minimumContrastRatio: scope.terminalMinimumContrastRatio,
+    fontFamily: scope.terminalFontFamily,
+    fontSize: fontPxForScale(scope.currentTextScale),
+    fontWeight: '300',
+    fontWeightBold: '500',
+    scrollback: 5000,
+    // Why: xterm suppresses parser-generated query replies when disableStdin
+    // is true. Native accepts only validated reply grammars from onData.
+    disableStdin: false,
+    cursorBlink: MOBILE_TERMINAL_CARET_OPTIONS.cursorBlink,
+    cursorStyle: MOBILE_TERMINAL_CARET_OPTIONS.cursorStyle,
+    // Native TextInput owns focus; initialize xterm's otherwise-gated main-buffer caret.
+    showCursorImmediately: MOBILE_TERMINAL_CARET_OPTIONS.showCursorImmediately,
+    // A full inactive cell remains visible under the terminal's phone-fit scale.
+    cursorInactiveStyle: MOBILE_TERMINAL_CARET_OPTIONS.cursorInactiveStyle,
+    convertEol: false,
+    allowProposedApi: true
+  })
+  scope.term = term
+  term.open(scope.surface!)
+  attachWebglAddon(scope, true)
+  try {
+    const unicodeAddon = scope.createUnicode11Addon()
+    if (unicodeAddon) {
+      term.loadAddon(unicodeAddon)
+      term.unicode.activeVersion = '11'
+    }
+  } catch {}
+  return term
+}
+
+/**
+ * The document's terminal, built before it reports ready so ready can carry the cell box xterm
+ * lays out at the app's text scale. Any size will do: the first init resizes and reuses it.
+ */
+export function prepareTerminal(scope: TerminalDocumentScope) {
+  // Why: laid out for the measure, but not shown — an empty 80x24 grid and caret until init.
+  scope.surface!.style.visibility = 'hidden'
+  try {
+    scope.committedTerm = openTerminal(scope, 80, 24)
+    scope.provisionalTerm = scope.committedTerm
+  } catch {
+    // Why: init builds again and reports the failure through the path every init failure takes.
+    scope.surface!.style.visibility = ''
+    try {
+      scope.term?.dispose()
+    } catch {}
+    scope.term = null
+  }
+}
+
 export function init(
   scope: TerminalDocumentScope,
   cols: number,
@@ -44,11 +102,15 @@ export function init(
   const scrollAnchorRows = prevB ? Math.max(0, (prevB.baseY || 0) - (prevB.viewportY || 0)) : -1
   scope.terminalGeneration++
   const gen = scope.terminalGeneration
+  const reused = scope.provisionalTerm
+  scope.provisionalTerm = null
   // Why: snapshot replay can contain old queries whose replies must never
   // re-enter the live PTY. Each replacement terminal earns authority anew.
   resetTerminalDataReplyAuthority(scope)
-  cancelWebglContextRecovery(scope)
-  scope.webglAddon = null
+  if (!reused) {
+    cancelWebglContextRecovery(scope)
+    scope.webglAddon = null
+  }
   scope.ready = false
   resetWriteQueue(scope)
   scope.statusDotPendingSelector = false
@@ -77,44 +139,27 @@ export function init(
   scope.initialOscLinks = Array.isArray(nextOscLinks) ? nextOscLinks : []
   scope.initialOscLinkRowOffset = 0
   scope.initialOscLinkEvictionReady = false
-  const surfaceSwap = beginTerminalSurfaceSwap(scope)
-  // oxlint-disable-next-line no-unused-vars -- the document declares it here; removing it is a different program
-  const nextSurface = surfaceSwap.nextSurface
+  // Why: the terminal built before ready is on the committed surface already; only a
+  // replacement needs a hidden surface to replay into.
+  const surfaceSwap = reused ? null : beginTerminalSurfaceSwap(scope)
 
   applyTerminalTheme(scope, nextTheme)
-  scope.term = scope.createTerminal({
-    cols: cols || 80,
-    rows: rows || 24,
-    theme: scope.terminalTheme,
-    minimumContrastRatio: scope.terminalMinimumContrastRatio,
-    fontFamily: scope.terminalFontFamily,
-    fontSize: fontPxForScale(scope.currentTextScale),
-    fontWeight: '300',
-    fontWeightBold: '500',
-    scrollback: 5000,
-    // Why: xterm suppresses parser-generated query replies when disableStdin
-    // is true. Native accepts only validated reply grammars from onData.
-    disableStdin: false,
-    cursorBlink: MOBILE_TERMINAL_CARET_OPTIONS.cursorBlink,
-    cursorStyle: MOBILE_TERMINAL_CARET_OPTIONS.cursorStyle,
-    // Native TextInput owns focus; initialize xterm's otherwise-gated main-buffer caret.
-    showCursorImmediately: MOBILE_TERMINAL_CARET_OPTIONS.showCursorImmediately,
-    // A full inactive cell remains visible under the terminal's phone-fit scale.
-    cursorInactiveStyle: MOBILE_TERMINAL_CARET_OPTIONS.cursorInactiveStyle,
-    convertEol: false,
-    allowProposedApi: true
-  })
-  const nextTerm = scope.term
-  scope.pendingTerm = nextTerm
-  scope.term.open(scope.surface!)
-  attachWebglAddon(scope, true)
-  try {
-    const unicodeAddon = scope.createUnicode11Addon()
-    if (unicodeAddon) {
-      scope.term.loadAddon(unicodeAddon)
-      scope.term.unicode.activeVersion = '11'
+  let nextTerm: TerminalDocumentTerminal
+  if (reused) {
+    nextTerm = reused
+    scope.term = reused
+    reused.reset()
+    reused.options.fontSize = fontPxForScale(scope.currentTextScale)
+    reused.resize(cols || 80, rows || 24)
+    // Why: its box was laid out at 80x24; the first report at this grid must read as the box
+    // changing at a kept grid, which the DOM renderer's cols-dependent box then refits once.
+    if (scope.reportedCellBox) {
+      scope.reportedCellBox = { ...scope.reportedCellBox, cols: reused.cols, rows: reused.rows }
     }
-  } catch {}
+  } else {
+    nextTerm = openTerminal(scope, cols || 80, rows || 24)
+    scope.pendingTerm = nextTerm
+  }
   if (typeof replayData === 'string' && replayData.length > 0) {
     // Why no trailing reset: the snapshot pen belongs to the live host TUI receiving later output.
     enqueueWrite(scope, ESC + '[0m' + replayData)
@@ -124,7 +169,7 @@ export function init(
   resetEvictionCounter(scope)
   cancelSelect(scope)
   attachTermObservers(scope)
-  attachTerminalQueryReplyBridge(scope, scope.term, gen)
+  attachTerminalQueryReplyBridge(scope, nextTerm, gen)
 
   scheduleDocumentFrame(scope, function () {
     if (gen !== scope.terminalGeneration) {
@@ -136,7 +181,12 @@ export function init(
       if (gen !== scope.terminalGeneration) {
         return
       }
-      commitTerminalSurfaceSwap(scope, surfaceSwap, nextTerm)
+      if (surfaceSwap) {
+        commitTerminalSurfaceSwap(scope, surfaceSwap, nextTerm)
+      } else {
+        // The terminal built before ready, shown now that it holds the replay.
+        scope.surface!.style.visibility = ''
+      }
       // Why: restore the reader's place after the rewrapped buffer replays.
       // Replay lands at bottom, so only act when they were scrolled up (rows>0).
       if (scrollAnchorRows > 0 && scope.term && scope.term.buffer && scope.term.buffer.active) {
@@ -150,6 +200,8 @@ export function init(
       scope.initialOscLinkRowOffset = 0
       scope.initialOscLinkEvictionReady = true
       applyFitScale(scope, 'init-replay')
+      // Why: a paused (hidden) render service has not rendered yet, so ready reports it too.
+      reportLaidOutCellBox(scope)
       notify(scope, { type: 'ready', cols: cols, rows: rows })
     })
   })
@@ -207,4 +259,5 @@ export function stopTerminalInit(scope: TerminalDocumentScope) {
   }
   scope.term = null
   scope.committedTerm = null
+  scope.provisionalTerm = null
 }
diff --git a/mobile/src/terminal/document/text-scaling.ts b/mobile/src/terminal/document/text-scaling.ts
index 9fd4cd0dbf3d..88d7b5dd7620 100644
--- a/mobile/src/terminal/document/text-scaling.ts
+++ b/mobile/src/terminal/document/text-scaling.ts
@@ -2,9 +2,9 @@ import { elementInRoot } from './document-host-seams'
 import { TERMINAL_TEXT_SCALES } from '../terminal-text-scales'
 import type { TerminalDocumentScope } from './document-scope'
 import { scheduleDocumentFrame } from './document-frame-registry'
-import { applyFitScale, getCellHeight, MIN_FIT_COLS } from './fit-scale'
+import { applyFitScale, getCellHeight } from './fit-scale'
+import { fitDimensionsFromCell } from '../terminal-grid-fit'
 import { getCellWidth } from './viewport-transform'
-import { emitKeyboardAvoidanceMetrics } from './keyboard-avoidance-metrics'
 
 // Why: init() flips ready false on every re-init (live width reflow included)
 // while the old surface stays visible; a document-scoped latch drives the
@@ -64,6 +64,8 @@ export function applyTextScale(scope: TerminalDocumentScope, scale: number) {
   }
   const px = fontPxForScale(scale)
   if (scope.term.options.fontSize === px) {
+    // Why: a pinch moved the drawn pitch; the fit commit is the one site that reports it.
+    applyFitScale(scope, 'text-scale')
     return
   }
   scope.term.options.fontSize = px
@@ -76,22 +78,31 @@ export function applyTextScale(scope: TerminalDocumentScope, scale: number) {
     }
     const cellW = getCellWidth(scope)
     const cellH = getCellHeight(scope)
+    // Why: fit the frame React Native laid out, by the same formula; init and measure give it. Before
+    // either, the pre-ready terminal stays hidden until the first init, which applies the font and resizes.
+    const frame = scope.hostFrame
+    if (!frame) {
+      return
+    }
     if (cellW > 0 && cellH > 0) {
-      const cols = Math.floor(scope.viewportRect().width / cellW)
-      if (cols < MIN_FIT_COLS) {
-        // Why: hidden (0 wide) or too narrow; the next box must refit at the new cell size.
-        scope.fittedBox = null
+      const fit = fitDimensionsFromCell(
+        { cellWidth: cellW, cellHeight: cellH },
+        frame.width,
+        frame.height
+      )
+      if (!fit) {
+        // Why: too narrow to resize the grid, but the fit still tracks the new cell size; hidden hosts hold it.
+        applyFitScale(scope, 'text-scale')
         return
       }
-      const rows = Math.max(8, Math.floor(scope.viewportRect().height / cellH))
-      scope.term.resize(cols, rows)
-      emitKeyboardAvoidanceMetrics(scope)
+      scope.term.resize(fit.cols, fit.rows)
     }
     applyFitScale(scope, 'text-scale')
   })
 }
 
 export function startTextScaling(scope: TerminalDocumentScope) {
+  scope.currentTextScale = scope.start().textScale
   scope.scrollIndicator = elementInRoot(scope.root, 'scroll-indicator')
   scope.scrollThumb = elementInRoot(scope.root, 'scroll-thumb')
   scope.terminalFontFamily =
diff --git a/mobile/src/terminal/document/viewport-frame.test.ts b/mobile/src/terminal/document/viewport-frame.test.ts
index 8dee5807bc11..063cf964c6fd 100644
--- a/mobile/src/terminal/document/viewport-frame.test.ts
+++ b/mobile/src/terminal/document/viewport-frame.test.ts
@@ -2,7 +2,7 @@
 import { afterEach, describe, expect, it } from 'vitest'
 import { startTerminalDocument, stopTerminalDocument } from './create-terminal-document'
 import { createTerminalDocumentScope, type TerminalDocumentScope } from './document-scope'
-import type { TerminalDocumentHost } from './document-host-seams'
+import type { TerminalDocumentHost, TerminalViewportChange } from './document-host-seams'
 import { terminalDocumentDouble } from './document-terminal-double.test-support'
 import { handleMsg } from './host-message-router'
 import { viewportToMouseReportCell } from './mouse-report-cell'
@@ -110,10 +110,12 @@ describe("the document's frame on the page", () => {
     expect(computeFitScale(scope)).toBe(1)
   })
 
-  it('commits no fit while the host is hidden, and one once it has a box', async () => {
+  it('commits no fit before the host has a box, and one once it has', async () => {
+    // A page host mounted under a hidden screen has no box until RN lays it out; hide and show after
+    // that are the mount's to absorb (terminal-web-document-mount.test.ts).
     let box = { left: 0, top: 0, width: 0, height: 0 }
     const widthsRead: number[] = []
-    const changes: (() => void)[] = []
+    const changes: ((change: TerminalViewportChange) => void)[] = []
     const scope = startedWithGrid({
       viewportRect: () => {
         widthsRead.push(box.width)
@@ -135,7 +137,7 @@ describe("the document's frame on the page", () => {
     await nextFrame()
     expect(scales).toEqual([])
     box = { left: 0, top: 0, width: 390, height: 600 }
-    changes.forEach((onChange) => onChange())
+    changes.forEach((onChange) => onChange('resized'))
     await framesUntil(() => scales.length === 2)
     // The refit repaints at the scale it has, then the fit commits once: 390 / (7.5 x 55).
     expect(scales).toEqual(['1', String(FIT_390)])
@@ -157,92 +159,4 @@ describe("the document's frame on the page", () => {
     expect(edge(400)).toBe(0)
     expect(edge(120)).toBe(-1)
   })
-
-  it('keeps pan and zoom across hide and show, and refits when the box really changes', async () => {
-    // react-native-screens hides the session when another screen covers it and shows it again at
-    // the same size; native never refits on navigation, so the pan the user left must survive.
-    let box = { left: 0, top: 0, width: 390, height: 600 }
-    const changes: (() => void)[] = []
-    const scope = startedWithGrid({
-      viewportRect: () => box,
-      observeViewport: (onChange) => {
-        changes.push(onChange)
-        return () => {}
-      }
-    })
-    const resize = async (width: number, height: number) => {
-      box = { left: 0, top: 0, width, height }
-      changes.forEach((onChange) => onChange())
-      await nextFrame()
-      await nextFrame()
-    }
-    await framesUntil(() => scope.currentScale === FIT_390)
-    scope.panX = -40
-    scope.panY = -30
-    scope.userScale = 1.5
-    const kept = { panX: -40, panY: -30, userScale: 1.5, currentScale: scope.currentScale }
-    const view = () => {
-      const { panX, panY, userScale, currentScale } = scope
-      return { panX, panY, userScale, currentScale }
-    }
-
-    await resize(0, 0)
-    expect(view()).toEqual(kept)
-    await resize(390, 600)
-    expect(view()).toEqual(kept)
-
-    box = { left: 0, top: 0, width: 300, height: 600 }
-    changes.forEach((onChange) => onChange())
-    await framesUntil(() => scope.currentScale === 300 / (7.5 * 55))
-    expect(view()).toEqual({ panX: 0, panY: 0, userScale: 1, currentScale: 300 / (7.5 * 55) })
-  })
-
-  it('refits on show when a fit was asked for while hidden, even at the same box', async () => {
-    let box = { left: 0, top: 0, width: 390, height: 600 }
-    const changes: (() => void)[] = []
-    const scope = startedWithGrid({
-      viewportRect: () => box,
-      observeViewport: (onChange) => {
-        changes.push(onChange)
-        return () => {}
-      }
-    })
-    const show = (width: number, height: number) => {
-      box = { left: 0, top: 0, width, height }
-      changes.forEach((onChange) => onChange())
-    }
-    await framesUntil(() => scope.currentScale === FIT_390)
-    show(0, 0)
-    handleMsg(scope, { type: 'resize', cols: 80, rows: 40 })
-    await nextFrame()
-    show(390, 600)
-    await framesUntil(() => scope.currentScale !== FIT_390, { required: false })
-    expect(scope.currentScale).toBe(390 / (7.5 * 80))
-  })
-
-  it('refits on show after a text-scale change while hidden', async () => {
-    let box = { left: 0, top: 0, width: 390, height: 600 }
-    const changes: (() => void)[] = []
-    const scope = startedWithGrid({
-      viewportRect: () => box,
-      observeViewport: (onChange) => {
-        changes.push(onChange)
-        return () => {}
-      }
-    })
-    const show = (width: number, height: number) => {
-      box = { left: 0, top: 0, width, height }
-      changes.forEach((onChange) => onChange())
-    }
-    await framesUntil(() => scope.currentScale === FIT_390)
-    show(0, 0)
-    handleMsg(scope, { type: 'set-font-scale', fontScale: 0.8 })
-    await nextFrame()
-    await nextFrame()
-    show(390, 600)
-    // The smaller font's cells: 55 columns at fontPxForScale(0.8) = 10 px, 7.5 x 10/13 each.
-    const fitted = 390 / (7.5 * (10 / 13) * 55)
-    await framesUntil(() => scope.currentScale !== FIT_390, { required: false })
-    expect(scope.currentScale).toBe(Math.min(1, fitted) >= 0.95 ? 1 : fitted)
-  })
 })
diff --git a/mobile/src/terminal/document/viewport-transform.ts b/mobile/src/terminal/document/viewport-transform.ts
index 4f60fc9eca1a..61190307db4e 100644
--- a/mobile/src/terminal/document/viewport-transform.ts
+++ b/mobile/src/terminal/document/viewport-transform.ts
@@ -19,6 +19,15 @@ export function flog(scope: TerminalDocumentScope, tag: string, payload: Record<
   } catch {}
 }
 
+/** 0 until the renderer has measured a cell. */
+export function getMeasuredCellHeight(scope: TerminalDocumentScope) {
+  const core = scope.term?._core
+  if (core && core._renderService && core._renderService.dimensions) {
+    return core._renderService.dimensions.css.cell.height || 0
+  }
+  return 0
+}
+
 export function getCellWidth(scope: TerminalDocumentScope) {
   if (!scope.term || !scope.term._core) {
     return 0
@@ -51,7 +60,7 @@ export function computeFitScale(scope: TerminalDocumentScope) {
     return 1
   }
   const vpWidth = scope.viewportRect().width
-  // Why: a host hidden with display:none measures 0; a 0 scale would blank it when shown again.
+  // Why: a viewport with no width yet (a page host never laid out) would give scale 0 and blank the grid.
   if (vpWidth <= 0) {
     return 1
   }
diff --git a/mobile/src/terminal/terminal-cell-box-census.test.ts b/mobile/src/terminal/terminal-cell-box-census.test.ts
new file mode 100644
index 000000000000..ea0e9ece12ca
--- /dev/null
+++ b/mobile/src/terminal/terminal-cell-box-census.test.ts
@@ -0,0 +1,62 @@
+import { readFileSync } from 'node:fs'
+import { relative } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { describe, expect, it } from 'vitest'
+import { censusSourceFiles } from '../test-support/census-source-files'
+
+const SOURCE_ROOT = fileURLToPath(new URL('..', import.meta.url))
+
+// xterm is the only measurer of the cell box. These are the ways to measure a glyph without it,
+// matched by technique rather than by name, so a rename cannot hide one. xterm's own code is the
+// generated engine, which the walk leaves out.
+const GLYPH_MEASUREMENT: [string, RegExp][] = [
+  ['canvas text metrics', /\bmeasureText\s*\(/],
+  ['offscreen canvas', /\bOffscreenCanvas\b/],
+  ['font bounding box', /\b(font|actual)BoundingBox(Ascent|Descent|Left|Right)\b/]
+]
+// A probe span: a created span, a run of one glyph, and its laid-out width, all in one file.
+const PROBE_SPAN = [
+  /createElement\(\s*['"`]span['"`]\s*\)/,
+  /['"`][A-Za-z0-9]['"`]\s*\.repeat\s*\(/,
+  /\b(offsetWidth|getBoundingClientRect)\b/
+]
+
+function productSources(): { path: string; text: string }[] {
+  return censusSourceFiles(SOURCE_ROOT)
+    .map((path) => ({ path, name: relative(SOURCE_ROOT, path).replaceAll('\\', '/') }))
+    .filter(({ name }) => /\.tsx?$/.test(name) && !/\.test\.tsx?$/.test(name))
+    .map(({ path, name }) => ({ path: name, text: readFileSync(path, 'utf8') }))
+}
+
+function glyphMeasurements(text: string): string[] {
+  const found = GLYPH_MEASUREMENT.filter(([, pattern]) => pattern.test(text)).map(([kind]) => kind)
+  return PROBE_SPAN.every((pattern) => pattern.test(text)) ? [...found, 'probe span'] : found
+}
+
+describe('the cell box has one measurer', () => {
+  it('walks the product sources, including the document that reports the box', () => {
+    const paths = productSources().map((source) => source.path)
+    expect(paths).toContain('terminal/document/laid-out-cell-box.ts')
+    expect(paths).toContain('terminal/document/terminal-init.ts')
+  })
+
+  it('recognises each technique it fences', () => {
+    expect(glyphMeasurements("ctx.measureText('W')")).toEqual(['canvas text metrics'])
+    expect(glyphMeasurements('new OffscreenCanvas(1, 1)')).toEqual(['offscreen canvas'])
+    expect(glyphMeasurements('m.fontBoundingBoxAscent + m.fontBoundingBoxDescent')).toEqual([
+      'font bounding box'
+    ])
+    expect(
+      glyphMeasurements(
+        "const s = document.createElement('span'); s.textContent = 'W'.repeat(32); s.offsetWidth"
+      )
+    ).toEqual(['probe span'])
+  })
+
+  it('has no file under mobile/src measure a glyph outside xterm', () => {
+    const found = productSources().flatMap(({ path, text }) =>
+      glyphMeasurements(text).map((kind) => `${path}: ${kind}`)
+    )
+    expect(found).toEqual([])
+  })
+})
diff --git a/mobile/src/terminal/terminal-cell-box-refit.test.tsx b/mobile/src/terminal/terminal-cell-box-refit.test.tsx
new file mode 100644
index 000000000000..0bf8e774bc94
--- /dev/null
+++ b/mobile/src/terminal/terminal-cell-box-refit.test.tsx
@@ -0,0 +1,128 @@
+import { createElement } from 'react'
+import { act, create, type ReactTestRenderer } from 'react-test-renderer'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { TerminalWebViewHandle } from './terminal-webview-contract'
+import { useTerminalViewportRefit, type TerminalViewportDims } from './terminal-viewport-refit'
+
+vi.mock('react-native', () => ({
+  AppState: { currentState: 'active', addEventListener: () => ({ remove() {} }) },
+  Platform: { OS: 'android' },
+  useWindowDimensions: () => ({ width: 427, height: 900 })
+}))
+
+const HANDLE = 'term-1'
+
+/** The session's refit over one open terminal whose document reported a `cellWidth` box. */
+function refitHarness(cellWidth: number) {
+  const terminal: TerminalWebViewHandle = {
+    prepareForForegroundRecovery: vi.fn(),
+    write: vi.fn(),
+    init: vi.fn(),
+    resize: vi.fn(),
+    reflow: vi.fn(),
+    clear: vi.fn(),
+    // The reported box, 47 rows high in the 710 px frame.
+    fitDimensions: vi.fn((frame: { width: number }) => ({
+      cols: Math.floor(frame.width / cellWidth),
+      rows: 47
+    })),
+    resetZoom: vi.fn(),
+    cancelSelect: vi.fn(),
+    doSelectAll: vi.fn(),
+    awaitReady: vi.fn(async () => {})
+  }
+  const viewportRef: { current: TerminalViewportDims | null } = { current: { cols: 55, rows: 47 } }
+  const subscribeToTerminal = vi.fn()
+  const unsubscribeTerminal = vi.fn()
+  const terminalFrameRef: { current: { width: number; height: number } | null } = {
+    current: { width: 427, height: 710 }
+  }
+  let refit: ReturnType<typeof useTerminalViewportRefit> | undefined
+  function Probe() {
+    refit = useTerminalViewportRefit({
+      activeHandleRef: { current: HANDLE },
+      terminalRefs: { current: new Map([[HANDLE, terminal]]) },
+      terminalFrameRef,
+      viewportRef,
+      viewportMeasuredRef: { current: true },
+      nativeChatCoveredRef: { current: false },
+      clientRef: { current: null },
+      deviceTokenRef: { current: null },
+      initializedHandlesRef: { current: new Set([HANDLE]) },
+      connState: 'connected',
+      tabStripVisible: false,
+      textScale: 1,
+      unsubscribeTerminal,
+      subscribeToTerminal
+    })
+    return null
+  }
+  act(() => {
+    renderer = create(createElement(Probe))
+  })
+  return {
+    terminal,
+    viewportRef,
+    subscribeToTerminal,
+    report: (handle: string) => act(() => refit!.notifyTerminalCellBoxChange(handle)),
+    // The session's onLayout: the one frame store, then the width notify.
+    layOut: (width: number) =>
+      act(() => {
+        terminalFrameRef.current = { width, height: 710 }
+        refit!.notifyTerminalFrameWidth()
+      })
+  }
+}
+
+let renderer: ReactTestRenderer | undefined
+beforeEach(() => {
+  vi.useFakeTimers()
+})
+afterEach(() => {
+  act(() => renderer?.unmount())
+  renderer = undefined
+  vi.useRealTimers()
+})
+
+describe('a new cell box for the open terminal', () => {
+  it('refits the PTY to the grid the new box fits, as after a renderer swap', async () => {
+    const harness = refitHarness(7.8)
+    harness.report(HANDLE)
+    await act(async () => {
+      await vi.advanceTimersByTimeAsync(150)
+    })
+    expect(harness.terminal.fitDimensions).toHaveBeenLastCalledWith({ width: 427, height: 710 })
+    expect(harness.viewportRef.current).toEqual({ cols: 54, rows: 47 })
+    expect(harness.subscribeToTerminal).toHaveBeenCalledWith(HANDLE)
+  })
+
+  it('leaves a terminal that is not on screen alone', async () => {
+    const harness = refitHarness(7.8)
+    harness.report('term-2')
+    await act(async () => {
+      await vi.advanceTimersByTimeAsync(150)
+    })
+    expect(harness.subscribeToTerminal).not.toHaveBeenCalled()
+    expect(harness.viewportRef.current).toEqual({ cols: 55, rows: 47 })
+  })
+
+  it('leaves the PTY alone when a new frame width holds the same grid, as sub-pixel jitter does', async () => {
+    const harness = refitHarness(23 / 3)
+    harness.layOut(427.3)
+    await act(async () => {
+      await vi.advanceTimersByTimeAsync(150)
+    })
+    expect(harness.subscribeToTerminal).not.toHaveBeenCalled()
+    expect(harness.viewportRef.current).toEqual({ cols: 55, rows: 47 })
+  })
+
+  it('refits when a new frame width holds a different grid', async () => {
+    const harness = refitHarness(23 / 3)
+    harness.layOut(420)
+    await act(async () => {
+      await vi.advanceTimersByTimeAsync(150)
+    })
+    expect(harness.terminal.fitDimensions).toHaveBeenLastCalledWith({ width: 420, height: 710 })
+    expect(harness.viewportRef.current).toEqual({ cols: 54, rows: 47 })
+  })
+})
diff --git a/mobile/src/terminal/terminal-cell-box.test.ts b/mobile/src/terminal/terminal-cell-box.test.ts
new file mode 100644
index 000000000000..9ddec3bcc073
--- /dev/null
+++ b/mobile/src/terminal/terminal-cell-box.test.ts
@@ -0,0 +1,17 @@
+import { describe, expect, it } from 'vitest'
+import { readTerminalCellBox } from './terminal-cell-box'
+
+// 23 device px at DPR 3: the WebGL renderer's 13px cell on the emulator.
+const CELL_1X = { fontScale: 1, cellWidth: 23 / 3, cellHeight: 15 }
+
+describe('readTerminalCellBox', () => {
+  it('reads nothing from a notify without a cell box', () => {
+    expect(readTerminalCellBox({ type: 'web-ready' })).toBeNull()
+  })
+
+  it('reads a well-formed box and rejects a malformed one', () => {
+    expect(readTerminalCellBox({ cellBox: CELL_1X })).toEqual(CELL_1X)
+    expect(readTerminalCellBox({ cellBox: { ...CELL_1X, cellWidth: 0 } })).toBeNull()
+    expect(readTerminalCellBox({ cellBox: [CELL_1X] })).toBeNull()
+  })
+})
diff --git a/mobile/src/terminal/terminal-cell-box.ts b/mobile/src/terminal/terminal-cell-box.ts
new file mode 100644
index 000000000000..843150499913
--- /dev/null
+++ b/mobile/src/terminal/terminal-cell-box.ts
@@ -0,0 +1,36 @@
+/**
+ * The cell box xterm laid out in one document, so the first subscribe after ready carries the phone's dims.
+ *
+ * The document builds its terminal before it reports ready, puts that box in `web-ready`, and
+ * reports it again whenever xterm lays out a different one.
+ */
+export type TerminalCellBox = { fontScale: number; cellWidth: number; cellHeight: number }
+
+/** A box xterm laid out, with the grid it was laid out at: the document's own record. */
+export type TerminalLaidOutCellBox = { cellBox: TerminalCellBox; cols: number; rows: number }
+
+function positive(value: unknown): number | null {
+  return typeof value === 'number' && Number.isFinite(value) && value > 0 ? value : null
+}
+
+/** The notify's `cellBox` when well formed; null when absent or malformed. */
+export function readTerminalCellBox(msg: Record<string, unknown>): TerminalCellBox | null {
+  const box = msg.cellBox
+  if (
+    typeof box !== 'object' ||
+    box === null ||
+    !('fontScale' in box && 'cellWidth' in box && 'cellHeight' in box)
+  ) {
+    return null
+  }
+  const fontScale = positive(box.fontScale)
+  const cellWidth = positive(box.cellWidth)
+  const cellHeight = positive(box.cellHeight)
+  return fontScale !== null && cellWidth !== null && cellHeight !== null
+    ? { fontScale, cellWidth, cellHeight }
+    : null
+}
+
+export function sameCellBox(a: TerminalCellBox, b: TerminalCellBox): boolean {
+  return a.fontScale === b.fontScale && a.cellWidth === b.cellWidth && a.cellHeight === b.cellHeight
+}
diff --git a/mobile/src/terminal/terminal-grid-fit.test.ts b/mobile/src/terminal/terminal-grid-fit.test.ts
new file mode 100644
index 000000000000..77c0be8cdcbe
--- /dev/null
+++ b/mobile/src/terminal/terminal-grid-fit.test.ts
@@ -0,0 +1,28 @@
+import { describe, expect, it } from 'vitest'
+import { fitDimensionsFromCell } from './terminal-grid-fit'
+
+// 23 device px at DPR 3: the WebGL renderer's 13px cell on the emulator.
+const CELL_1X = { cellWidth: 23 / 3, cellHeight: 15 }
+
+describe('fitDimensionsFromCell', () => {
+  it('fits the frame React Native laid out', () => {
+    // floor(427 / 7.667) = 55, floor(710 / 15) = 47
+    expect(fitDimensionsFromCell(CELL_1X, 427, 710)).toEqual({ cols: 55, rows: 47 })
+  })
+
+  it('answers null for a frame too narrow to fit', () => {
+    expect(fitDimensionsFromCell(CELL_1X, 100, 710)).toBeNull()
+  })
+
+  it('keeps an exact fit at a fractional pixel ratio whole', () => {
+    // 900 device px of frame over 18 px cells at 2.75 is 50 columns; the two quotients divide
+    // to 49.999… in floating point.
+    const cell = { cellWidth: 18 / 2.75, cellHeight: 40 / 2.75 }
+    expect(fitDimensionsFromCell(cell, 900 / 2.75, 1320 / 2.75)).toEqual({ cols: 50, rows: 33 })
+  })
+
+  it('still falls short of a column the frame does not hold', () => {
+    const cell = { cellWidth: 393 / 51, cellHeight: 15 }
+    expect(fitDimensionsFromCell(cell, 1080 / 2.75, 600)?.cols).toBe(50)
+  })
+})
diff --git a/mobile/src/terminal/terminal-grid-fit.ts b/mobile/src/terminal/terminal-grid-fit.ts
new file mode 100644
index 000000000000..3f8daf8c6821
--- /dev/null
+++ b/mobile/src/terminal/terminal-grid-fit.ts
@@ -0,0 +1,28 @@
+/**
+ * The one fit of a cell box to the terminal frame, shared by the app and the document so a first
+ * subscribe and every later refit reach the same grid from the same frame width.
+ */
+
+export type TerminalFitDimensions = { cols: number; rows: number }
+
+/** Below these the fit is not a terminal anyone can read, and the caller disables fit-to-phone. */
+export const MIN_FIT_COLS = 20
+export const MIN_FIT_ROWS = 8
+
+// Why: frame and cell are each device pixels over the pixel ratio, so an exact fit can divide to
+// 49.999…; a real shortfall is at least 1/cell-device-px (> 0.02) below the next integer.
+const EXACT_FIT_TOLERANCE = 1e-6
+
+/** The grid the frame (as React Native laid it out) holds at this cell box; null when too narrow. */
+export function fitDimensionsFromCell(
+  cell: { cellWidth: number; cellHeight: number },
+  width: number,
+  height: number
+): TerminalFitDimensions | null {
+  const cols = Math.floor(width / cell.cellWidth + EXACT_FIT_TOLERANCE)
+  if (!(cols >= MIN_FIT_COLS)) {
+    return null
+  }
+  const rows = Math.floor(height / cell.cellHeight + EXACT_FIT_TOLERANCE)
+  return { cols, rows: Math.max(MIN_FIT_ROWS, rows) }
+}
diff --git a/mobile/src/terminal/terminal-keyboard-avoidance-lift.test.ts b/mobile/src/terminal/terminal-keyboard-avoidance-lift.test.ts
index 4c11320db2e3..d98ba59566e6 100644
--- a/mobile/src/terminal/terminal-keyboard-avoidance-lift.test.ts
+++ b/mobile/src/terminal/terminal-keyboard-avoidance-lift.test.ts
@@ -103,6 +103,13 @@ describe('computeActiveTerminalKeyboardLift', () => {
       terminalFrameHeight: FRAME_HEIGHT
     })
     expect(lift).toBeLessThanOrEqual(KEYBOARD_LIFT)
+    // With the drawn row pitch too, and a grid drawn taller than the frame it is lifted in.
+    const taller = computeActiveTerminalKeyboardLift({
+      keyboardLift: KEYBOARD_LIFT,
+      metrics: metrics({ rows: 60, rowPitch: 18, cursorY: 59, contentBottomRow: 59 }),
+      terminalFrameHeight: FRAME_HEIGHT
+    })
+    expect(taller).toBe(KEYBOARD_LIFT)
   })
 
   it('uses the platform-adjusted lift proportionally on iOS and Android', () => {
@@ -119,4 +126,90 @@ describe('computeActiveTerminalKeyboardLift', () => {
     })
     expect({ android, ios }).toEqual({ android: 220, ios: 186 })
   })
+
+  /** Base's arithmetic, kept here as the oracle a covered frame must match to the pixel. */
+  function baseLift(keyboardLift: number, m: TerminalKeyboardAvoidanceMetrics, frame: number) {
+    if (keyboardLift <= 0) {
+      return 0
+    }
+    if (m.rows <= 0 || frame <= 0 || m.altScreen) {
+      return keyboardLift
+    }
+    const rowHeight = frame / m.rows
+    const anchorBottom = (Math.max(m.cursorY, m.contentBottomRow) + 1) * rowHeight
+    return Math.min(keyboardLift, Math.max(0, anchorBottom + rowHeight - (frame - keyboardLift)))
+  }
+
+  describe('a keyboard that covers the frame', () => {
+    const lift = (keyboardLift: number, m: TerminalKeyboardAvoidanceMetrics, frame = 713.7) =>
+      computeActiveTerminalKeyboardLift({
+        keyboardLift,
+        metrics: m,
+        terminalFrameHeight: frame
+      })
+
+    it('keeps base in phone mode, where the fit fills the frame to within a row', () => {
+      // Pixel_API_37: 47 rows of 15 px in a 713.7 px frame under a 312 px keyboard.
+      const phone = metrics({ rows: 47, rowPitch: 15, cursorY: 46, contentBottomRow: 46 })
+      expect(lift(312, phone)).toBe(312)
+      expect(lift(312, phone)).toBe(baseLift(312, phone, 713.7))
+    })
+
+    it('lifts a desktop-mode grid only by what the keyboard hides of it', () => {
+      // Pixel_API_37, measured blank: 40 desktop rows drawn 270 px tall, lifted 312 under the header.
+      const drawn270 = metrics({ rows: 40, rowPitch: 6.75, cursorY: 39, contentBottomRow: 39 })
+      expect(lift(312, drawn270)).toBe(0)
+      expect(lift(312, { ...drawn270, altScreen: true })).toBe(0)
+      // 425 px drawn, the dock at 401.7: the caret row's bottom lands on the dock.
+      const drawn425 = metrics({ rows: 50, rowPitch: 8.5, cursorY: 49, contentBottomRow: 49 })
+      expect(lift(312, drawn425)).toBeCloseTo(23.3, 5)
+      expect(lift(312, { ...drawn425, altScreen: true })).toBeCloseTo(23.3, 5)
+      // A caret mid-grid lifts only enough to clear its row plus one: 47 x 8.5 + 8.5 - 401.7.
+      expect(lift(312, { ...drawn425, cursorY: 46, contentBottomRow: 46 })).toBeCloseTo(6.3, 5)
+      expect(lift(312, { ...drawn425, cursorY: 45, contentBottomRow: 45 })).toBe(0)
+    })
+
+    it('lifts nothing for a keyboard that is open and covers nothing', () => {
+      expect(lift(0, metrics({ rows: 50, rowPitch: 17, cursorY: 49, contentBottomRow: 49 }))).toBe(
+        0
+      )
+    })
+
+    it('stays under the strip while stale rows outlast a rotation or a text-size change', () => {
+      const rotated = metrics({ rows: 47, rowPitch: 15, cursorY: 46, contentBottomRow: 46 })
+      expect(lift(150, rotated, 300)).toBe(150)
+      const resized = metrics({ rows: 47, rowPitch: 18, cursorY: 46, contentBottomRow: 46 })
+      expect(lift(312, resized)).toBe(312)
+    })
+
+    it('matches base wherever the drawn grid fills the frame, and never lifts past it elsewhere', () => {
+      let matched = 0
+      let drawnShort = 0
+      for (const rows of [8, 26, 47, 50, 80]) {
+        for (const rowPitch of [undefined, 5.1, 8.5, 15, 18, 25]) {
+          for (const frame of [300, 401.7, 710.33, 713.7]) {
+            for (const keyboard of [0.5, 150, 312, 336]) {
+              for (const anchor of [0, Math.floor(rows / 2), rows - 1]) {
+                const m = metrics({ rows, rowPitch, cursorY: anchor, contentBottomRow: anchor })
+                const got = lift(keyboard, m, frame)
+                const drawn = rowPitch === undefined ? frame : rows * rowPitch
+                // The fit floors rows, so a grid that fills the frame leaves less than a row.
+                if (drawn >= frame - (rowPitch ?? 0)) {
+                  expect(got).toBe(baseLift(keyboard, m, frame))
+                  matched++
+                  continue
+                }
+                expect(got).toBeLessThanOrEqual(keyboard)
+                expect(got).toBeLessThanOrEqual(Math.max(0, drawn - (frame - keyboard)) + 1e-9)
+                drawnShort++
+              }
+            }
+          }
+        }
+      }
+      // Presence: both halves of the sweep ran.
+      expect(matched).toBeGreaterThan(500)
+      expect(drawnShort).toBeGreaterThan(500)
+    })
+  })
 })
diff --git a/mobile/src/terminal/terminal-keyboard-avoidance-lift.ts b/mobile/src/terminal/terminal-keyboard-avoidance-lift.ts
index 6ada640430d9..003b42b50c40 100644
--- a/mobile/src/terminal/terminal-keyboard-avoidance-lift.ts
+++ b/mobile/src/terminal/terminal-keyboard-avoidance-lift.ts
@@ -1,11 +1,16 @@
 import type { TerminalKeyboardAvoidanceMetrics } from './terminal-webview-contract'
 
 type ActiveTerminalKeyboardLiftParams = {
+  // What the keyboard covers of the frame.
   keyboardLift: number
   metrics: TerminalKeyboardAvoidanceMetrics | undefined
   terminalFrameHeight: number
 }
 
+/**
+ * How far to lift the active pane so its anchor row clears the keyboard. Never more than the strip
+ * the keyboard covers, nor more than it hides of the grid as drawn.
+ */
 export function computeActiveTerminalKeyboardLift(
   params: ActiveTerminalKeyboardLiftParams
 ): number {
@@ -16,14 +21,33 @@ export function computeActiveTerminalKeyboardLift(
   if (!metrics || metrics.rows <= 0 || terminalFrameHeight <= 0) {
     return keyboardLift
   }
+  const dockTop = terminalFrameHeight - keyboardLift
+  const pitch = metrics.rowPitch
+  // Desktop display mode draws the desktop's rows scaled down, well short of the frame; lifting
+  // by the strip there moved the whole grid under the header. The fit floors rows, so a gap under
+  // one row is a grid that fills the frame, and keeps the arithmetic below.
+  if (pitch && metrics.rows * pitch < terminalFrameHeight - pitch) {
+    const drawnHidden = metrics.rows * pitch - dockTop
+    if (drawnHidden <= 0) {
+      return 0
+    }
+    const hidden = Math.min(keyboardLift, drawnHidden)
+    return metrics.altScreen ? hidden : Math.min(hidden, anchorOverflow(metrics, pitch, dockTop))
+  }
   if (metrics.altScreen) {
     return keyboardLift
   }
   const rowHeight = terminalFrameHeight / metrics.rows
+  return Math.min(keyboardLift, anchorOverflow(metrics, rowHeight, dockTop))
+}
+
+/** How far the anchor row, plus one row of margin, reaches below `visibleBottom`. */
+function anchorOverflow(
+  metrics: TerminalKeyboardAvoidanceMetrics,
+  rowHeight: number,
+  visibleBottom: number
+): number {
   // Main-buffer TUI footer rows can sit below the caret.
   const anchorRow = Math.max(metrics.cursorY, metrics.contentBottomRow)
-  const anchorBottom = (anchorRow + 1) * rowHeight
-  const dockTop = terminalFrameHeight - keyboardLift
-  const margin = rowHeight
-  return Math.min(keyboardLift, Math.max(0, anchorBottom + margin - dockTop))
+  return Math.max(0, (anchorRow + 1) * rowHeight + rowHeight - visibleBottom)
 }
diff --git a/mobile/src/terminal/terminal-keyboard-avoidance-webview.test.ts b/mobile/src/terminal/terminal-keyboard-avoidance-webview.test.ts
index f47395be0490..89830162921d 100644
--- a/mobile/src/terminal/terminal-keyboard-avoidance-webview.test.ts
+++ b/mobile/src/terminal/terminal-keyboard-avoidance-webview.test.ts
@@ -1,8 +1,10 @@
+// @vitest-environment happy-dom
 import { Terminal } from '@xterm/xterm'
 import { describe, expect, it, vi } from 'vitest'
 import { createTerminalDocumentScope } from './document/document-scope'
 import { documentModuleSource } from './document/document-module-source.test-support'
 import { emitKeyboardAvoidanceMetrics } from './document/keyboard-avoidance-metrics'
+import { commitFitScale } from './document/fit-scale'
 import { parseTerminalKeyboardAvoidanceMetrics } from './terminal-webview-contract'
 
 // The scope object plus the metrics block, exactly as the document carries them.
@@ -13,11 +15,12 @@ import { parseTerminalKeyboardAvoidanceMetrics } from './terminal-webview-contra
  * it is handed, so a case builds one with its own terminal double and reads the notifications back
  * out of the seam it passed in.
  */
-function runMetricsOver(term: unknown): Record<string, unknown>[] {
+function runMetricsOver(term: unknown, fitScale = 1): Record<string, unknown>[] {
   const notifications: Record<string, unknown>[] = []
   const scope = createTerminalDocumentScope({
     postToHost: (message) => notifications.push(message)
   })
+  scope.currentScale = fitScale
   // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: each case's double implements the buffer members the scan reads, which is what the assertions check.
   scope.term = term as typeof scope.term
   emitKeyboardAvoidanceMetrics(scope)
@@ -194,19 +197,21 @@ describe('terminal keyboard-avoidance WebView metrics', () => {
     // Four places change the buffer's geometry, and each owes a fresh emit after it: a stale
     // content-bottom row is what lifts the keyboard over the wrong line. Read from each module's
     // own source, so a fifth site added in a new module is not silently uncovered.
+    // A text-scale resize reports through the fit it schedules, whose commit emits (pinned below).
+    const directEmit = 'emitKeyboardAvoidanceMetrics(scope)'
     const blocks = [
-      ['terminal-init', 'export function resize('],
-      ['reflow', 'export function reflow('],
-      ['host-message-router', "} else if (msg.type === 'clear') {"],
-      ['text-scaling', 'export function applyTextScale(']
+      ['terminal-init', 'export function resize(', directEmit],
+      ['reflow', 'export function reflow(', directEmit],
+      ['host-message-router', "} else if (msg.type === 'clear') {", directEmit],
+      ['text-scaling', 'export function applyTextScale(', 'applyFitScale(scope']
     ] as const
 
-    for (const [module, opener] of blocks) {
+    for (const [module, opener, emit] of blocks) {
       const source = documentModuleSource(module)
       const start = source.indexOf(opener)
       expect(start, `${module} no longer carries ${opener}`).toBeGreaterThanOrEqual(0)
       const block = source.slice(start, source.indexOf('\n}', start))
-      const emitAt = block.indexOf('emitKeyboardAvoidanceMetrics(scope)')
+      const emitAt = block.lastIndexOf(emit)
       const geometryAt = block.includes('.resize(')
         ? block.indexOf('.resize(')
         : block.indexOf('.reset(')
@@ -214,4 +219,57 @@ describe('terminal keyboard-avoidance WebView metrics', () => {
       expect(emitAt, `${module} emits before it resizes`).toBeGreaterThan(geometryAt)
     }
   })
+
+  it('reports a text-scale change only through the fit it commits', () => {
+    // One emit site: a pinch release and a settings change both end in the fit commit, so the
+    // release carries no emit of its own and needs no word back on whether a refit is pending.
+    const textScaling = documentModuleSource('text-scaling')
+    const start = textScaling.indexOf('export function applyTextScale(')
+    const applyTextScale = textScaling.slice(start, textScaling.indexOf('\n}', start))
+    expect(applyTextScale).not.toMatch(/return (true|false)/)
+    expect(documentModuleSource('surface-touch-gestures')).not.toContain(
+      'emitKeyboardAvoidanceMetrics'
+    )
+  })
+
+  it('reports the row pitch as drawn, fit scale included, and none before a cell is measured', () => {
+    // Desktop display mode keeps the desktop's rows and the fit shrinks the grid by width.
+    const buffer = { cursorY: 0, viewportY: 0, type: 'normal', getLine: () => undefined }
+    const measuredTerm = {
+      buffer: { active: buffer },
+      cols: 10,
+      rows: 47,
+      _core: { _renderService: { dimensions: { css: { cell: { width: 8, height: 15 } } } } }
+    }
+    const phone = runMetricsOver(measuredTerm)[0]
+    const desktop = runMetricsOver(measuredTerm, 0.5)[0]
+    const unmeasured = runMetricsOver({ buffer: { active: buffer }, cols: 10, rows: 47 })[0]
+    expect({
+      phone: phone?.rowPitch,
+      desktop: desktop?.rowPitch,
+      unmeasured: unmeasured?.rowPitch
+    }).toEqual({ phone: 15, desktop: 7.5, unmeasured: 0 })
+  })
+
+  it('reports again when a fit commits a new scale, carrying the new pitch', () => {
+    const notifications: Record<string, unknown>[] = []
+    const scope = createTerminalDocumentScope({
+      postToHost: (message) => notifications.push(message),
+      // Half the width 80 columns of 8 px need, so the fit commits a scale of 0.5.
+      viewportRect: () => ({ left: 0, top: 0, width: 320, height: 700 })
+    })
+    const buffer = { cursorY: 0, viewportY: 0, type: 'normal', getLine: () => undefined }
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the double implements every member the fit and the metrics read, which the assertion checks.
+    scope.term = {
+      buffer: { active: buffer },
+      cols: 80,
+      rows: 40,
+      element: { scrollWidth: 640 },
+      _core: { _renderService: { dimensions: { css: { cell: { width: 8, height: 15 } } } } }
+    } as unknown as typeof scope.term
+    scope.surface = document.createElement('div')
+    commitFitScale(scope, 'test', 0, 'test')
+    const metrics = notifications.filter((message) => message.type === 'keyboard-avoidance-metrics')
+    expect(metrics.at(-1)?.rowPitch).toBe(7.5)
+  })
 })
diff --git a/mobile/src/terminal/terminal-live-input-keyboard-reopen.test.ts b/mobile/src/terminal/terminal-live-input-keyboard-reopen.test.ts
new file mode 100644
index 000000000000..c70880c1642d
--- /dev/null
+++ b/mobile/src/terminal/terminal-live-input-keyboard-reopen.test.ts
@@ -0,0 +1,17 @@
+import { describe, expect, it, vi } from 'vitest'
+
+const host = vi.hoisted(() => ({ os: 'android' }))
+vi.mock('react-native', () => ({ Platform: { OS: 'web' } }))
+vi.mock('../platform/host-os', () => ({ hostOs: () => host.os }))
+
+const { reopensFocusedInputWhenKeyboardHidden } =
+  await import('./terminal-live-input-keyboard-reopen')
+
+describe('reopening a focused live input whose keyboard is hidden', () => {
+  it("follows the phone's OS on the page, which runs as web", () => {
+    host.os = 'android'
+    expect(reopensFocusedInputWhenKeyboardHidden()).toBe(true)
+    host.os = 'ios'
+    expect(reopensFocusedInputWhenKeyboardHidden()).toBe(false)
+  })
+})
diff --git a/mobile/src/terminal/terminal-live-input-keyboard-reopen.ts b/mobile/src/terminal/terminal-live-input-keyboard-reopen.ts
new file mode 100644
index 000000000000..4fc6cf57e1ac
--- /dev/null
+++ b/mobile/src/terminal/terminal-live-input-keyboard-reopen.ts
@@ -0,0 +1,6 @@
+import { hostOs } from '../platform/host-os'
+
+/** Android keeps a hidden TextInput focused after Back closes the IME, so focus must blur first. */
+export function reopensFocusedInputWhenKeyboardHidden(): boolean {
+  return hostOs() === 'android'
+}
diff --git a/mobile/src/terminal/terminal-live-preedit-mirror.ts b/mobile/src/terminal/terminal-live-preedit-mirror.ts
index 29c903f4366f..2bc165a625cf 100644
--- a/mobile/src/terminal/terminal-live-preedit-mirror.ts
+++ b/mobile/src/terminal/terminal-live-preedit-mirror.ts
@@ -21,9 +21,10 @@ export type TerminalLiveMirrorStep = {
  * ever classified. That is what makes this hold for input methods nobody tested.
  *
  * `composing` is undefined only where the platform reports no range at all —
- * today React Native Android. The fallback holds the trailing non-ASCII run: a
- * conversion IME always leaves one and ASCII keeps its zero-latency echo. It
- * enumerates nothing, and it cannot see an ASCII preedit — only a report can.
+ * today React Native Android and the page on Android. The fallback holds the
+ * trailing non-ASCII run: a conversion IME always leaves one and ASCII keeps its
+ * zero-latency echo. It enumerates nothing, and it cannot see an ASCII preedit —
+ * only a report can.
  */
 function heldPreeditLength(
   fieldCodePoints: readonly string[],
diff --git a/mobile/src/terminal/terminal-live-text-commit.test.ts b/mobile/src/terminal/terminal-live-text-commit.test.ts
index 7c41cb1c5b8b..ac177542be81 100644
--- a/mobile/src/terminal/terminal-live-text-commit.test.ts
+++ b/mobile/src/terminal/terminal-live-text-commit.test.ts
@@ -127,14 +127,14 @@ describe('terminal live accessory local edit text', () => {
     const fieldText = `${'a'.repeat(100_000)}🙂`
     const originalIterator = String.prototype[Symbol.iterator]
     let visits = 0
-    const iterator = vi
-      .spyOn(String.prototype, Symbol.iterator)
-      .mockImplementation(function* (this: string) {
-        for (const codePoint of originalIterator.call(this)) {
-          visits += 1
-          yield codePoint
-        }
-      })
+    const iterator = vi.spyOn(String.prototype, Symbol.iterator).mockImplementation(function* (
+      this: string
+    ) {
+      for (const codePoint of originalIterator.call(this)) {
+        visits += 1
+        yield codePoint
+      }
+    })
     let result: string
     try {
       result = getTerminalLiveAccessoryLocalEditText({ localEdit: 'backspace', fieldText })
diff --git a/mobile/src/terminal/terminal-viewport-refit.test.ts b/mobile/src/terminal/terminal-viewport-refit.test.ts
index 7a54c70c8683..9b8a5b24b0e4 100644
--- a/mobile/src/terminal/terminal-viewport-refit.test.ts
+++ b/mobile/src/terminal/terminal-viewport-refit.test.ts
@@ -15,7 +15,8 @@ import {
 const hookSource = readFileSync(new URL('./terminal-viewport-refit.ts', import.meta.url), 'utf8')
 const sessionSource = [
   readMobileSessionRouteSource('../session/use-mobile-session-keyboard-state.ts'),
-  readMobileSessionRouteSource('../session/MobileSessionActiveContent.tsx')
+  readMobileSessionRouteSource('../session/MobileSessionActiveContent.tsx'),
+  readMobileSessionRouteSource('../session/use-mobile-session-terminal-webview.ts')
 ].join('\n')
 
 describe('terminal viewport refit', () => {
@@ -140,10 +141,10 @@ describe('terminal viewport refit', () => {
     // reflow the desktop PTY to phone dims the user never sees.
     const timerStart = hookSource.indexOf('refitTimerRef.current = setTimeout(')
     const coveredCheck = hookSource.indexOf('if (nativeChatCoveredRef.current)', timerStart)
-    const measureIndex = hookSource.indexOf('measureFitDimensions', timerStart)
+    const fitIndex = hookSource.indexOf('ref.fitDimensions(', timerStart)
     expect(timerStart).toBeGreaterThanOrEqual(0)
     expect(coveredCheck).toBeGreaterThan(timerStart)
-    expect(measureIndex).toBeGreaterThan(coveredCheck)
+    expect(fitIndex).toBeGreaterThan(coveredCheck)
     expect(sessionSource).toContain('nativeChatCoveredRef: showNativeChatRef')
   })
 
@@ -152,9 +153,11 @@ describe('terminal viewport refit', () => {
     expect(sessionSource).toContain('tabStripVisible: terminals.length > 1')
     expect(sessionSource).toContain('textScale: terminalTextScale')
     expect(sessionSource).toContain('connState,')
-    expect(sessionSource).toContain('notifyTerminalFrameHeight(nextHeight)')
-    // One seam for both facts: on the page they come apart, because the shell shortens the WebView
-    // and the keyboard covers nothing the screen has to lift for.
+    expect(sessionSource).toContain('notifyTerminalFrame({ width, height })')
+    expect(sessionSource).toContain('notifyTerminalFrameHeight(Math.round(frame.height))')
+    expect(sessionSource).toContain('notifyTerminalFrameWidth()')
+    // One seam for both facts: they come apart for a floating keyboard, which is open yet covers
+    // nothing the screen has to lift for.
     expect(sessionSource).toContain('const softKeyboard = useSoftKeyboard()')
     expect(sessionSource).toContain('notifyKeyboardVisibility(softKeyboard.visible)')
     expect(sessionSource).toContain('setKeyboardHeight(softKeyboard.height)')
@@ -253,7 +256,7 @@ describe('terminal viewport refit', () => {
     // desktop mode. Reflow local scrollback only after the server says it
     // actually applied phone-fit to the PTY.
     const appliedIndex = hookSource.indexOf('if (outcome.applied)')
-    const reflowIndex = hookSource.indexOf('ref.reflow(dims.cols, dims.rows)')
+    const reflowIndex = hookSource.indexOf('ref.reflow(dims.cols, dims.rows, frame)')
     const cacheUpdateIndex = hookSource.indexOf('updateTerminalSubscriptionViewport(handle, dims)')
     // Assert each anchor exists before ordering: a missing marker yields -1 and would
     // let the ordering comparisons pass vacuously.
diff --git a/mobile/src/terminal/terminal-viewport-refit.ts b/mobile/src/terminal/terminal-viewport-refit.ts
index 50388ee2d7fe..533b5f8d51fb 100644
--- a/mobile/src/terminal/terminal-viewport-refit.ts
+++ b/mobile/src/terminal/terminal-viewport-refit.ts
@@ -3,6 +3,7 @@ import { AppState, Platform, useWindowDimensions, type AppStateStatus } from 're
 import type { RpcClient } from '../transport/rpc-client'
 import type { ConnectionState } from '../transport/types'
 import type { TerminalWebViewHandle } from './TerminalWebView'
+import type { TerminalFrame } from './terminal-webview-messages'
 import { shouldRecoverTerminalOnAppStateChange } from './terminal-foreground-recovery'
 import { terminalViewportUpdate } from './mobile-terminal-operations'
 import {
@@ -19,7 +20,8 @@ export type TerminalViewportDims = { cols: number; rows: number }
 type TerminalViewportRefitOptions = {
   activeHandleRef: RefObject<string | null>
   terminalRefs: RefObject<Map<string, TerminalWebViewHandle>>
-  terminalFrameHeightRef: RefObject<number>
+  // The terminal frame React Native laid out, unrounded; null until its first layout.
+  terminalFrameRef: RefObject<TerminalFrame | null>
   viewportRef: RefObject<TerminalViewportDims | null>
   viewportMeasuredRef: RefObject<boolean>
   // Why: while native chat covers the active terminal, a refit would push phone dims into a PTY nobody on this device is viewing.
@@ -31,25 +33,16 @@ type TerminalViewportRefitOptions = {
   tabStripVisible: boolean
   // Why: text size (font scale); changing it changes cell size, so the PTY must be re-fitted to a new column count.
   textScale: number
-  // Why: measured frame width; panel dock/undock or sidebar resize changes it with no window/tab change, so it re-fits the PTY.
-  terminalFrameWidth: number
   unsubscribeTerminal: (handle: string) => void
   subscribeToTerminal: (handle: string) => void
 }
 
-type TerminalViewportRefitNotifications = {
-  notifyTerminalFrameHeight: (height: number) => void
-  notifyKeyboardVisibility: (visible: boolean) => void
-}
-
 // Why: re-measure on layout changes outside the subscribe path (tab strip, fold/rotate/resize), or a PTY renders "cut in half" (#4579).
-export function useTerminalViewportRefit(
-  options: TerminalViewportRefitOptions
-): TerminalViewportRefitNotifications {
+export function useTerminalViewportRefit(options: TerminalViewportRefitOptions) {
   const {
     activeHandleRef,
     terminalRefs,
-    terminalFrameHeightRef,
+    terminalFrameRef,
     viewportRef,
     viewportMeasuredRef,
     nativeChatCoveredRef,
@@ -59,7 +52,6 @@ export function useTerminalViewportRefit(
     connState,
     tabStripVisible,
     textScale,
-    terminalFrameWidth,
     unsubscribeTerminal,
     subscribeToTerminal
   } = options
@@ -121,10 +113,12 @@ export function useTerminalViewportRefit(
             currentRunSeq: refitRunSeqRef.current
           })
         void (async () => {
-          const dims = await ref.measureFitDimensions(terminalFrameHeightRef.current || undefined)
+          await ref.awaitReady()
           if (!isCurrentTarget()) {
             return
           }
+          const frame = terminalFrameRef.current
+          const dims = frame ? ref.fitDimensions(frame) : null
           if (!dims) {
             return
           }
@@ -155,7 +149,7 @@ export function useTerminalViewportRefit(
                 rpc.updateTerminalSubscriptionViewport(handle, dims)
                 if (outcome.applied) {
                   // Why: updateViewport re-streams only the visible screen, so local scrollback stays wrapped at the old width — reflow it locally.
-                  ref.reflow(dims.cols, dims.rows)
+                  ref.reflow(dims.cols, dims.rows, frame)
                 }
                 return
               }
@@ -175,7 +169,7 @@ export function useTerminalViewportRefit(
     [
       activeHandleRef,
       terminalRefs,
-      terminalFrameHeightRef,
+      terminalFrameRef,
       viewportRef,
       viewportMeasuredRef,
       nativeChatCoveredRef,
@@ -230,16 +224,26 @@ export function useTerminalViewportRefit(
     scheduleViewportRefit()
   }, [textScale, viewportMeasuredRef, scheduleViewportRefit])
 
-  // Why: panel dock/undock or sidebar resize changes frame width with no window/tab change, so the cached viewport goes stale.
-  const prevFrameWidthRef = useRef(terminalFrameWidth)
-  useEffect(() => {
-    if (prevFrameWidthRef.current === terminalFrameWidth) {
+  // Why: panel dock/undock or a sidebar resize changes the width with no window or tab change; a
+  // width that still fits the PTY's grid (sub-pixel layout jitter) needs no refit.
+  const notifyTerminalFrameWidth = useCallback(() => {
+    const handle = activeHandleRef.current
+    const frame = terminalFrameRef.current
+    const fit = handle && frame ? terminalRefs.current.get(handle)?.fitDimensions(frame) : null
+    const grid = viewportRef.current
+    if (fit && grid && fit.cols === grid.cols && fit.rows === grid.rows) {
       return
     }
-    prevFrameWidthRef.current = terminalFrameWidth
     viewportMeasuredRef.current = false
     scheduleViewportRefit()
-  }, [terminalFrameWidth, viewportMeasuredRef, scheduleViewportRefit])
+  }, [
+    activeHandleRef,
+    terminalFrameRef,
+    terminalRefs,
+    viewportRef,
+    viewportMeasuredRef,
+    scheduleViewportRefit
+  ])
 
   const notifyFrameHeightRefitEvent = useCallback(
     (event: TerminalFrameHeightRefitEvent) => {
@@ -263,6 +267,18 @@ export function useTerminalViewportRefit(
     [notifyFrameHeightRefitEvent]
   )
 
+  // Why: a renderer swap or pixel-ratio change gives the same grid a different cell box.
+  const notifyTerminalCellBoxChange = useCallback(
+    (handle: string) => {
+      if (handle !== activeHandleRef.current) {
+        return
+      }
+      viewportMeasuredRef.current = false
+      scheduleViewportRefit()
+    },
+    [activeHandleRef, viewportMeasuredRef, scheduleViewportRefit]
+  )
+
   useEffect(() => {
     if (Platform.OS !== 'ios') {
       return
@@ -310,5 +326,10 @@ export function useTerminalViewportRefit(
     }
   }, [])
 
-  return { notifyTerminalFrameHeight, notifyKeyboardVisibility }
+  return {
+    notifyTerminalFrameHeight,
+    notifyTerminalFrameWidth,
+    notifyKeyboardVisibility,
+    notifyTerminalCellBoxChange
+  }
 }
diff --git a/mobile/src/terminal/terminal-web-document-mount.test.ts b/mobile/src/terminal/terminal-web-document-mount.test.ts
index 1ce4aa3d40b1..3849a02a9e7e 100644
--- a/mobile/src/terminal/terminal-web-document-mount.test.ts
+++ b/mobile/src/terminal/terminal-web-document-mount.test.ts
@@ -3,6 +3,8 @@ import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { createElement } from 'react'
 import { act, create, type ReactTestRenderer } from 'react-test-renderer'
 import { terminalDocumentDouble } from './document/document-terminal-double.test-support'
+import type { TerminalDocumentTerminal } from './document/document-terminal-shape'
+import type { TerminalWebViewCommand } from './terminal-webview-messages'
 import { TERMINAL_DOCUMENT_MARKUP } from './terminal-webview-html'
 
 /**
@@ -18,16 +20,25 @@ import { TERMINAL_DOCUMENT_MARKUP } from './terminal-webview-html'
  */
 /** Set for the length of one case; the factory throws it instead of building a document. */
 let startThrows: Error | null = null
+/** The text scale each document the factory built was started at, in order. */
+const startedScales: number[] = []
+/** Whether each of those documents was told to build its terminal before ready. */
+const startedBuilds: boolean[] = []
+/** Set for the length of one case; the document builds its terminals here instead of xterm. */
+let gridTerminal: (() => TerminalDocumentTerminal) | null = null
 
 vi.mock('./document/create-terminal-document', async (importOriginal) => {
   const actual = await importOriginal<typeof import('./document/create-terminal-document')>()
   return {
     ...actual,
     createTerminalDocument: (host: Parameters<typeof actual.createTerminalDocument>[0]) => {
+      startedScales.push(host?.start?.().textScale ?? 1)
+      startedBuilds.push(host?.start?.().shown ?? true)
       if (startThrows) {
         throw startThrows
       }
-      return actual.createTerminalDocument(host)
+      const grid = gridTerminal
+      return actual.createTerminalDocument(grid ? { ...host, createTerminal: grid } : host)
     }
   }
 })
@@ -61,9 +72,13 @@ const settle = () => new Promise((resolve) => setTimeout(resolve, 50))
 const INIT = { type: 'init', cols: 80, rows: 24, initialData: '', preserveScroll: false } as const
 
 let renderer: ReactTestRenderer | null = null
+let restoreTransform: (() => void) | null = null
 
 beforeEach(() => {
   startThrows = null
+  startedScales.length = 0
+  startedBuilds.length = 0
+  gridTerminal = null
   document.body.innerHTML = ''
   document.head.innerHTML = ''
 })
@@ -71,6 +86,8 @@ beforeEach(() => {
 afterEach(() => {
   act(() => renderer?.unmount())
   renderer = null
+  restoreTransform?.()
+  restoreTransform = null
 })
 
 describe('a stopped document takes its engines with it', () => {
@@ -244,3 +261,269 @@ describe('the component names the cause of a start that threw', () => {
     expect(engineErrors).toEqual([])
   })
 })
+
+describe('the text scale a document is built at', () => {
+  it('is the one the view mounted with, for a reloaded document too, as on native', () => {
+    const host = plantHost()
+    startThrows = new Error('engine missing')
+    act(() => {
+      renderer = create(createElement(TerminalWebView, { textScale: 1.25 }), {
+        createNodeMock: () => host
+      })
+    })
+    act(() => renderer?.update(createElement(TerminalWebView, { textScale: 1.5 })))
+    startThrows = null
+    act(() => {
+      renderer?.root.find((node) => node.props.accessibilityRole === 'button').props.onPress()
+    })
+    expect(startedScales).toEqual([1.25, 1.25])
+  })
+
+  it('builds nothing before ready on the page for a view hidden when it mounted', () => {
+    const host = plantHost()
+    act(() => {
+      renderer = create(createElement(TerminalWebView, { shownAtMount: false }), {
+        createNodeMock: () => host
+      })
+    })
+    expect(startedBuilds).toEqual([false])
+  })
+})
+
+const CELL = { width: 7.5, height: 15 }
+const FIT_390 = 390 / (7.5 * 55)
+
+/**
+ * A laid-out 55x40 grid whose cells scale with the font, as xterm's do, or read 0 while `cells`
+ * says they cannot be measured: xterm's DOM measure on a `display:none` host, where no
+ * OffscreenCanvas is available.
+ */
+function gridDouble(cells: { measurable: boolean }): TerminalDocumentTerminal {
+  const terminal = terminalDocumentDouble().terminal
+  const cell = () => {
+    const k = cells.measurable ? terminal.options.fontSize / 13 : 0
+    return { width: CELL.width * k, height: CELL.height * k }
+  }
+  const grid = Object.assign(terminal, {
+    cols: 55,
+    rows: 40,
+    _core: {
+      _renderService: {
+        get dimensions() {
+          return { css: { cell: cell() } }
+        }
+      }
+    }
+  })
+  grid.resize = (cols: number, rows: number) => {
+    grid.cols = cols
+    grid.rows = rows
+  }
+  return grid
+}
+
+/**
+ * A mounted page document over a grid, whose host box the case sets and pushes as RN layout does:
+ * react-native-web's `onLayout` reports a `display:none` screen as 0x0 and its return as the old box.
+ */
+async function mountedOverGrid({ laidOutFirst = true } = {}) {
+  const cells = { measurable: true }
+  const grids: TerminalDocumentTerminal[] = []
+  gridTerminal = () => {
+    const grid = gridDouble(cells)
+    grids.push(grid)
+    return grid
+  }
+  const host = plantHost()
+  let box = { width: 390, height: 600 }
+  host.getBoundingClientRect = () => new DOMRect(0, 134, box.width, box.height)
+  const mounted = mountTerminalWebDocument(host, () => {})
+  // Every surface transform the document writes; a refit writes one even when nothing moved. Read
+  // off the style prototype because an init swaps the surface element for a fresh one.
+  const scales: number[] = []
+  const proto: object = Object.getPrototypeOf(host.style)
+  const own = Object.getOwnPropertyDescriptor(proto, 'transform')!
+  const write = own.set!
+  Object.defineProperty(proto, 'transform', {
+    ...own,
+    set(this: CSSStyleDeclaration, value: string) {
+      const scale = /scale\(([^)]*)\)/.exec(String(value))
+      if (scale) {
+        scales.push(Number(scale[1]))
+      }
+      write.call(this, value)
+    }
+  })
+  restoreTransform = () => Object.defineProperty(proto, 'transform', own)
+  let id = 0
+  const send = (command: TerminalWebViewCommand) => mounted.send({ ...command, id: ++id })
+  const layOut = (width: number, height: number) => {
+    box = { width, height }
+    mounted.notifyViewport()
+  }
+  if (laidOutFirst) {
+    layOut(390, 600)
+  }
+  // The app's init carries the frame it laid out.
+  send({
+    type: 'init',
+    cols: 55,
+    rows: 40,
+    initialData: '',
+    preserveScroll: false,
+    frame: { width: 390, height: 600 }
+  })
+  await framesUntil(() => scales.at(-1) === FIT_390)
+  return { mounted, scales, send, layOut, cells, grid: () => grids.at(-1)! }
+}
+
+const nextFrame = () => new Promise<void>((resolve) => requestAnimationFrame(() => resolve()))
+
+async function framesUntil(done: () => boolean, frames = 30) {
+  for (let frame = 0; frame < frames && !done(); frame++) {
+    await nextFrame()
+  }
+  expect(done()).toBe(true)
+}
+
+describe("the page pushes its terminal frame's box into the document", () => {
+  it('refits on a box RN laid out, through the host View, with no ResizeObserver of its own', () => {
+    let observers = 0
+    vi.stubGlobal(
+      'ResizeObserver',
+      class {
+        constructor() {
+          observers += 1
+        }
+        observe() {}
+        disconnect() {}
+      }
+    )
+    try {
+      const host = plantHost()
+      let height = 600
+      host.getBoundingClientRect = () => new DOMRect(0, 134, 390, height)
+      act(() => {
+        renderer = create(createElement(TerminalWebView, {}), { createNodeMock: () => host })
+      })
+      const surface = host.querySelector<HTMLElement>('#terminal-surface')!
+      expect(surface.style.transform).toBe('')
+      const laidOut = renderer!.root.findAll((node) => typeof node.props.onLayout === 'function')
+      expect(laidOut).toHaveLength(1)
+      height = 560
+      act(() => {
+        laidOut[0]!.props.onLayout({ nativeEvent: { layout: { width: 390, height: 560 } } })
+      })
+      expect(surface.style.transform).toContain('scale(1)')
+      expect(observers).toBe(0)
+    } finally {
+      vi.unstubAllGlobals()
+    }
+  })
+
+  it('keeps pan and zoom across hide and show, and refits when the box really changes', async () => {
+    // Native never refits on navigation: its WebView keeps its size while another screen covers it.
+    const { mounted, scales, layOut } = await mountedOverGrid()
+    const fitted = scales.length
+    layOut(0, 0)
+    layOut(390, 600)
+    await nextFrame()
+    await nextFrame()
+    expect(scales).toHaveLength(fitted)
+
+    layOut(300, 600)
+    await framesUntil(() => scales.at(-1) === 300 / (7.5 * 55))
+    mounted.dispose()
+  })
+
+  it('keeps pan and zoom when RN laid the host out before the mount existed', async () => {
+    // The first layout can land before the document does; the box it reported is still the box.
+    const { mounted, scales, layOut } = await mountedOverGrid({ laidOutFirst: false })
+    const fitted = scales.length
+    layOut(0, 0)
+    layOut(390, 600)
+    await nextFrame()
+    await nextFrame()
+    expect(scales).toHaveLength(fitted)
+    mounted.dispose()
+  })
+
+  it('holds a fit asked for while hidden and lands it on show', async () => {
+    const { mounted, scales, send, layOut } = await mountedOverGrid()
+    layOut(0, 0)
+    send({ type: 'resize', cols: 80, rows: 40, frame: null })
+    await nextFrame()
+    await nextFrame()
+    expect(scales.at(-1)).toBe(FIT_390)
+    layOut(390, 600)
+    await framesUntil(() => scales.at(-1) === 390 / (7.5 * 80))
+    // The held fit is spent: a second hide and show must not run it again over the user's pan.
+    const landed = scales.length
+    layOut(0, 0)
+    layOut(390, 600)
+    await nextFrame()
+    await nextFrame()
+    expect(scales).toHaveLength(landed)
+    mounted.dispose()
+  })
+
+  it('never commits a blind fit when the grid cannot be measured while hidden', async () => {
+    // A reconnect re-inits under a covering screen, where xterm's DOM measure reads every cell as 0.
+    const { mounted, scales, send, layOut, cells } = await mountedOverGrid()
+    layOut(0, 0)
+    const shown = scales.length
+    cells.measurable = false
+    send({ type: 'init', cols: 55, rows: 40, initialData: '', preserveScroll: false, frame: null })
+    // Past the retry loop's 60-frame cap, where a fit that did not wait commits scale 1.
+    for (let frame = 0; frame < 75; frame++) {
+      await nextFrame()
+    }
+    expect(scales.slice(shown)).not.toContain(1)
+    cells.measurable = true
+    layOut(390, 600)
+    await framesUntil(() => scales.at(-1) === FIT_390)
+    mounted.dispose()
+  })
+
+  it('fits a text scale too large to resize the grid while visible', async () => {
+    const { mounted, scales, send, layOut, grid } = await mountedOverGrid()
+    layOut(280, 600)
+    // The app's refit for the new width sends its grid with the frame.
+    send({ type: 'resize', cols: 55, rows: 40, frame: { width: 280, height: 600 } })
+    await framesUntil(() => scales.at(-1) === 280 / (7.5 * 55))
+    // fontPxForScale(2) = 26 px: 280 / (7.5 x 2) = 18 columns, under MIN_FIT_COLS, so no resize.
+    send({ type: 'set-font-scale', fontScale: 2 })
+    await framesUntil(() => scales.at(-1) === 280 / (15 * 55))
+    expect(grid().cols).toBe(55)
+    mounted.dispose()
+  })
+
+  it('refits on show after a text scale too large to resize the grid while hidden', async () => {
+    const { mounted, scales, send, layOut } = await mountedOverGrid()
+    layOut(280, 600)
+    // The app's refit for the new width sends its grid with the frame.
+    send({ type: 'resize', cols: 55, rows: 40, frame: { width: 280, height: 600 } })
+    await framesUntil(() => scales.at(-1) === 280 / (7.5 * 55))
+    layOut(0, 0)
+    // fontPxForScale(2) = 26 px: 280 / (7.5 x 2) = 18 columns, under MIN_FIT_COLS, so no resize.
+    send({ type: 'set-font-scale', fontScale: 2 })
+    await nextFrame()
+    await nextFrame()
+    layOut(280, 600)
+    await framesUntil(() => scales.at(-1) === 280 / (15 * 55))
+    mounted.dispose()
+  })
+
+  it('resizes the grid to a text scale changed while hidden, and fits it on show', async () => {
+    const { mounted, scales, send, layOut, grid } = await mountedOverGrid()
+    layOut(0, 0)
+    send({ type: 'set-font-scale', fontScale: 0.8 })
+    // fontPxForScale(0.8) = 10 px: 390 / (7.5 x 10/13) = 67 columns, where stale cells give 52.
+    await framesUntil(() => grid().cols === 67)
+    const hidden = scales.length
+    layOut(390, 600)
+    await framesUntil(() => scales.length > hidden)
+    expect(scales.at(-1)).toBe(1)
+    mounted.dispose()
+  })
+})
diff --git a/mobile/src/terminal/terminal-web-document-mount.ts b/mobile/src/terminal/terminal-web-document-mount.ts
index c1b13e386573..b16afa800959 100644
--- a/mobile/src/terminal/terminal-web-document-mount.ts
+++ b/mobile/src/terminal/terminal-web-document-mount.ts
@@ -2,6 +2,7 @@ import { Terminal } from '@xterm/xterm'
 import { Unicode11Addon } from '@xterm/addon-unicode11'
 import { WebglAddon } from '@xterm/addon-webgl'
 import type { TerminalDocumentTerminal } from './document/document-terminal-shape'
+import type { TerminalDocumentStart, TerminalViewportChange } from './document/document-host-seams'
 import { TERMINAL_DOCUMENT_ELEMENT_STYLE, TERMINAL_DOCUMENT_MARKUP } from './terminal-webview-html'
 import { scopeStyleToHost } from '../style-scoping/document-style-scoping'
 import { XTERM_ENGINE_CSS } from './terminal-webview-engine-css.generated'
@@ -25,6 +26,8 @@ import type { TerminalWebViewCommand } from './terminal-webview-messages'
 export type TerminalWebDocument = {
   /** Hands one host command to the document, as a bridge frame does inside the WebView. */
   send: (command: TerminalWebViewCommand & { id: number }) => void
+  /** RN laid the host out again: the page's counterpart of the WebView's window resize. */
+  notifyViewport: () => void
   dispose: () => void
 }
 
@@ -95,19 +98,23 @@ function createPageWebglAddon(onFallback: (reason: string) => void) {
  * Synchronous, because the factory is a static import and building a document is a function call.
  * A caller's cleanup can therefore never arrive before there is something to clean up.
  */
+/** What the view fixed when it mounted, for every document it builds. */
 export function mountTerminalWebDocument(
   host: HTMLElement,
-  receive: (message: Record<string, unknown>) => void
+  receive: (message: Record<string, unknown>) => void,
+  start: TerminalDocumentStart = { textScale: 1, shown: true }
 ): TerminalWebDocument {
   ensureDocumentStyle()
   host.classList.add(HOST_CLASS)
   host.innerHTML = TERMINAL_DOCUMENT_MARKUP
-  const started = startDocumentOrGiveTheHostBack(host, receive)
+  const viewport = pageViewport(host)
+  const started = startDocumentOrGiveTheHostBack(host, receive, start, viewport)
 
   return {
     send: (command) => {
       started.send(command)
     },
+    notifyViewport: viewport.notify,
     dispose: () => {
       started.stop()
       host.innerHTML = ''
@@ -128,10 +135,12 @@ export function mountTerminalWebDocument(
  */
 function startDocumentOrGiveTheHostBack(
   host: HTMLElement,
-  receive: (message: Record<string, unknown>) => void
+  receive: (message: Record<string, unknown>) => void,
+  start: TerminalDocumentStart,
+  viewport: PageViewport
 ) {
   try {
-    return startPageDocument(host, receive)
+    return startPageDocument(host, receive, start, viewport)
   } catch (error) {
     host.innerHTML = ''
     host.classList.remove(HOST_CLASS)
@@ -139,8 +148,53 @@ function startDocumentOrGiveTheHostBack(
   }
 }
 
+type PageViewport = ReturnType<typeof pageViewport>
+
+/**
+ * The host's box, pushed by RN layout. RN web lays a `display:none` host out as 0x0 and its return
+ * as the same box: the size stays the last real one, as a covered WebView's does, and the return is
+ * a show rather than a resize. Sizes are the client rect's; RN web's are whole-pixel `offsetWidth`s.
+ */
+function pageViewport(host: HTMLElement) {
+  // Seeded from the host, since RN's first layout can land before this mount exists.
+  const seed = host.getBoundingClientRect()
+  let laidOut = { width: seed.width, height: seed.height }
+  let onChange: ((change: TerminalViewportChange) => void) | null = null
+  return {
+    rect: () => {
+      const box = host.getBoundingClientRect()
+      const hidden = box.width <= 0
+      const size = hidden ? laidOut : box
+      return { left: box.left, top: box.top, width: size.width, height: size.height, hidden }
+    },
+    observe: (change: (change: TerminalViewportChange) => void) => {
+      onChange = change
+      return () => {
+        onChange = null
+      }
+    },
+    notify: () => {
+      const { width, height } = host.getBoundingClientRect()
+      if (width <= 0) {
+        return
+      }
+      if (width === laidOut.width && height === laidOut.height) {
+        onChange?.('shown')
+        return
+      }
+      laidOut = { width, height }
+      onChange?.('resized')
+    }
+  }
+}
+
 /** The eleven seams, as the page answers them. */
-function startPageDocument(host: HTMLElement, receive: (message: Record<string, unknown>) => void) {
+function startPageDocument(
+  host: HTMLElement,
+  receive: (message: Record<string, unknown>) => void,
+  start: TerminalDocumentStart,
+  viewport: PageViewport
+) {
   // Written by this document's own reporter: `startHostNotify` installs it through the seam below,
   // which here is a `window` error listener, and every error it forwards is appended before the
   // report that quotes it. What the page cannot have is the WebView head's half — a buffer open
@@ -186,18 +240,13 @@ function startPageDocument(host: HTMLElement, receive: (message: Record<string,
     // fail. Here the engine is the import above, so it is here or this module did not load.
     hasEngine: () => true,
 
+    start: () => start,
+
     // The window here is the whole page, header and dock included; the grid is shown in the host.
-    viewportRect: () => {
-      const box = host.getBoundingClientRect()
-      return { left: box.left, top: box.top, width: box.width, height: box.height }
-    },
+    viewportRect: viewport.rect,
 
-    // The host resizes without the window: a dock growing, a panel docking beside it.
-    observeViewport: (onChange) => {
-      const observer = new ResizeObserver(onChange)
-      observer.observe(host)
-      return () => observer.disconnect()
-    },
+    // The host resizes without the window, and RN layout is what says so: the component pushes it.
+    observeViewport: viewport.observe,
 
     // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the shape is xterm's own, except that `getCell` takes back the cell xterm allocated and the document declares only the members it reads on one.
     createTerminal: (options) => new Terminal(options) as unknown as TerminalDocumentTerminal,
diff --git a/mobile/src/terminal/terminal-webview-cell-box.test.ts b/mobile/src/terminal/terminal-webview-cell-box.test.ts
new file mode 100644
index 000000000000..602bddd0f373
--- /dev/null
+++ b/mobile/src/terminal/terminal-webview-cell-box.test.ts
@@ -0,0 +1,200 @@
+import { createElement, createRef } from 'react'
+import { act, create, type ReactTestRenderer } from 'react-test-renderer'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { TerminalWebView } from './TerminalWebView'
+import type { TerminalWebViewHandle } from './terminal-webview-contract'
+
+const nativeWebViewMethods = vi.hoisted(() => ({
+  postMessage: vi.fn<(message: string) => void>(),
+  reload: vi.fn<() => void>()
+}))
+
+vi.mock('react-native', () => ({
+  AppState: { currentState: 'active' },
+  Platform: { OS: 'android' },
+  Pressable: 'Pressable',
+  StyleSheet: {
+    absoluteFillObject: { bottom: 0, left: 0, position: 'absolute', right: 0, top: 0 },
+    create: (styles: unknown) => styles
+  },
+  Text: 'Text',
+  View: 'View'
+}))
+
+vi.mock('react-native-webview', async () => {
+  const React = await import('react')
+  const WebView = React.forwardRef((props: Record<string, unknown>, ref) => {
+    React.useImperativeHandle(ref, () => nativeWebViewMethods)
+    return React.createElement('WebView', props)
+  })
+  return { WebView, default: WebView }
+})
+
+vi.mock('lucide-react-native', () => ({ RefreshCw: 'RefreshCw' }))
+
+const FRAME = { width: 427, height: 710 }
+const scale = 1
+const cellAt = (fontScale: number, cellWidth = 23 / 3) => ({ fontScale, cellWidth, cellHeight: 15 })
+
+const renderers: ReactTestRenderer[] = []
+afterEach(() => {
+  act(() => renderers.splice(0).forEach((renderer) => renderer.unmount()))
+  nativeWebViewMethods.postMessage.mockClear()
+  nativeWebViewMethods.reload.mockClear()
+  vi.useRealTimers()
+})
+
+function mount(textScale = scale) {
+  const ref = createRef<TerminalWebViewHandle>()
+  const onCellBoxChange = vi.fn()
+  const onWebReady = vi.fn<() => void>()
+  let renderer: ReactTestRenderer | undefined
+  act(() => {
+    renderer = create(
+      createElement(TerminalWebView, { ref, textScale, onCellBoxChange, onWebReady })
+    )
+  })
+  renderers.push(renderer!)
+  const handle = () => {
+    if (!ref.current) {
+      throw new Error('no handle')
+    }
+    return ref.current
+  }
+  const webView = () => renderer!.root.find((node) => typeof node.props.onMessage === 'function')
+  const notify = (payload: Record<string, unknown>) => {
+    act(() => {
+      webView().props.onMessage({ nativeEvent: { data: JSON.stringify(payload) } })
+    })
+  }
+  return { handle, notify, onCellBoxChange, onWebReady, webView }
+}
+
+function postedTypes(): unknown[] {
+  return nativeWebViewMethods.postMessage.mock.calls.map(([message]) => JSON.parse(message).type)
+}
+
+const cellBoxNotify = (cellWidth: number, refit: boolean) => ({
+  type: 'cell-box',
+  cellBox: cellAt(scale, cellWidth),
+  refit
+})
+
+describe('the cell box xterm laid out', () => {
+  it('sizes a fit from web-ready, which the document sends once its terminal is built', () => {
+    const { handle, notify } = mount()
+    expect(handle().fitDimensions(FRAME)).toBeNull()
+    notify({ type: 'web-ready', cellBox: cellAt(scale) })
+    expect(handle().fitDimensions(FRAME)).toEqual({ cols: 55, rows: 47 })
+    expect(postedTypes()).not.toContain('measure')
+  })
+
+  it('fits each box the document reports, and refits only when the document says so', () => {
+    // The document holds the grid and decides; its tests pin the one-refit bound.
+    const { handle, notify, onCellBoxChange } = mount()
+    notify({ type: 'web-ready', cellBox: cellAt(scale) })
+    notify(cellBoxNotify(7.9, false))
+    expect(onCellBoxChange).not.toHaveBeenCalled()
+    expect(handle().fitDimensions(FRAME)).toEqual({ cols: 54, rows: 47 })
+    notify(cellBoxNotify(7.8, true))
+    expect(onCellBoxChange).toHaveBeenCalledTimes(1)
+    expect(handle().fitDimensions(FRAME)).toEqual({ cols: 54, rows: 47 })
+  })
+
+  it('fits from the box the current document reported, not one an earlier document did', () => {
+    const { handle, notify, webView } = mount()
+    notify({ type: 'web-ready', cellBox: cellAt(scale) })
+    act(() => webView().props.onLoadStart())
+    notify({ type: 'web-ready', cellBox: null })
+    expect(handle().fitDimensions(FRAME)).toBeNull()
+  })
+
+  it("fits only from a ready box at the app's text scale", () => {
+    const { handle, notify, webView } = mount(1.5)
+    // A document built at mount keeps that scale; a reload after a text-size change reports it.
+    notify({ type: 'web-ready', cellBox: cellAt(1) })
+    expect(handle().fitDimensions(FRAME)).toBeNull()
+    act(() => webView().props.onLoadStart())
+    notify({ type: 'web-ready', cellBox: cellAt(1.5) })
+    expect(handle().fitDimensions(FRAME)).toEqual({ cols: 55, rows: 47 })
+  })
+
+  it('fits in the app from the reported box, and sends the frame with every grid', () => {
+    const { handle, notify } = mount()
+    notify({ type: 'web-ready', cellBox: cellAt(scale) })
+    expect(handle().fitDimensions({ width: 427.5, height: 0 })).toBeNull()
+    expect(handle().fitDimensions({ width: 427.5, height: 710 })).toEqual({ cols: 55, rows: 47 })
+    const frame = { width: 427.5, height: 710 }
+    handle().init({ cols: 55, rows: 47, initialData: '', frame })
+    handle().resize(55, 47, frame)
+    handle().reflow(55, 47, frame)
+    const grids = nativeWebViewMethods.postMessage.mock.calls
+      .map(([message]) => JSON.parse(message))
+      .filter((message) => ['init', 'resize', 'reflow'].includes(message.type))
+    expect(grids.map((message) => message.frame)).toEqual([frame, frame, frame])
+    expect(postedTypes()).not.toContain('measure')
+  })
+
+  it('sends nothing before a ready: a load start drops what was queued', () => {
+    const { handle, notify, webView } = mount()
+    handle().init({ cols: 55, rows: 47, initialData: 'snapshot', frame: null })
+    expect(postedTypes()).toEqual([])
+    act(() => webView().props.onLoadStart())
+    notify({ type: 'web-ready', cellBox: cellAt(scale) })
+    expect(postedTypes()).not.toContain('init')
+  })
+
+  it('reloads the same view when its content process ends', () => {
+    const { webView } = mount()
+    const view = webView()
+    act(() => view.props.onContentProcessDidTerminate({ nativeEvent: {} }))
+    expect(nativeWebViewMethods.reload).toHaveBeenCalledTimes(1)
+    expect(webView()).toBe(view)
+  })
+
+  it('drops queued and coalesced commands on a reload or a lost content process', () => {
+    vi.useFakeTimers()
+    const { handle, notify, webView } = mount()
+    act(() => webView().props.onLoadStart())
+    handle().write('for the reloaded document')
+    act(() => webView().props.onLoadStart())
+    handle().write('for the lost content process')
+    act(() => webView().props.onContentProcessDidTerminate({ nativeEvent: {} }))
+    notify({ type: 'web-ready', cellBox: cellAt(scale) })
+    act(() => {
+      vi.runAllTimers()
+    })
+    expect(postedTypes()).not.toContain('write')
+    handle().write('for the current document')
+    act(() => {
+      vi.runAllTimers()
+    })
+    expect(postedTypes()).toContain('write')
+  })
+
+  it('tells the document the app text scale before it builds its terminal', () => {
+    const { webView } = mount(1.25)
+    const html: string = webView().props.source.html
+    const start = html.indexOf('window.__orcaTerminalTextScale = 1.25;')
+    expect(start).toBeGreaterThan(-1)
+    // Ahead of the document script, in the page itself, so no platform can run it late.
+    expect(start).toBeLessThan(html.indexOf('startTerminalDocument'))
+  })
+
+  it('keeps the source it mounted with across renders, so a new text scale does not reload', () => {
+    const { webView } = mount(1)
+    const source = webView().props.source
+    act(() => renderers[0]!.update(createElement(TerminalWebView, { textScale: 1.5 })))
+    expect(webView().props.source).toBe(source)
+  })
+
+  it('tells a document whose view was hidden at mount not to build before ready', () => {
+    let renderer: ReactTestRenderer | undefined
+    act(() => {
+      renderer = create(createElement(TerminalWebView, { shownAtMount: false }))
+    })
+    renderers.push(renderer!)
+    const webView = renderer!.root.find((node) => typeof node.props.onMessage === 'function')
+    expect(webView.props.source.html).toContain('window.__orcaTerminalShown = false;')
+  })
+})
diff --git a/mobile/src/terminal/terminal-webview-contract.test.ts b/mobile/src/terminal/terminal-webview-contract.test.ts
index 0a3527111e3e..aca7f9533d83 100644
--- a/mobile/src/terminal/terminal-webview-contract.test.ts
+++ b/mobile/src/terminal/terminal-webview-contract.test.ts
@@ -1,6 +1,10 @@
 import { describe, expect, it } from 'vitest'
 
-import { parseTerminalKeyboardAvoidanceMetrics } from './terminal-webview-contract'
+import {
+  parseTerminalKeyboardAvoidanceMetrics,
+  sameTerminalKeyboardAvoidanceMetrics,
+  type TerminalKeyboardAvoidanceMetrics
+} from './terminal-webview-contract'
 
 describe('parseTerminalKeyboardAvoidanceMetrics', () => {
   it('parses a full payload', () => {
@@ -49,4 +53,44 @@ describe('parseTerminalKeyboardAvoidanceMetrics', () => {
       })
     ).toEqual({ cursorY: 0, contentBottomRow: 0, rows: 0, altScreen: false })
   })
+
+  it('carries the drawn row pitch when the document reports one, and omits it otherwise', () => {
+    expect(parseTerminalKeyboardAvoidanceMetrics({ cursorY: 46, rows: 47, rowPitch: 7.5 })).toEqual(
+      { cursorY: 46, contentBottomRow: 46, rows: 47, altScreen: false, rowPitch: 7.5 }
+    )
+    for (const rowPitch of [undefined, 0, -3, Number.NaN, Number.POSITIVE_INFINITY, '15']) {
+      expect(
+        'rowPitch' in parseTerminalKeyboardAvoidanceMetrics({ cursorY: 1, rows: 4, rowPitch })
+      ).toBe(false)
+    }
+  })
+})
+
+describe('sameTerminalKeyboardAvoidanceMetrics', () => {
+  const metrics: Required<TerminalKeyboardAvoidanceMetrics> = {
+    cursorY: 38,
+    contentBottomRow: 38,
+    rows: 40,
+    altScreen: false,
+    rowPitch: 15
+  }
+  // One variant per field, each differing from `metrics` in that field alone.
+  const variants: [keyof typeof metrics, TerminalKeyboardAvoidanceMetrics][] = [
+    ['cursorY', { ...metrics, cursorY: 39 }],
+    ['contentBottomRow', { ...metrics, contentBottomRow: 39 }],
+    ['rows', { ...metrics, rows: 41 }],
+    ['altScreen', { ...metrics, altScreen: true }],
+    // Desktop display mode, measured on the page: same rows, the fit scale moved to 0.46.
+    ['rowPitch', { ...metrics, rowPitch: 6.96 }]
+  ]
+
+  it('tells apart metrics that differ in any one field', () => {
+    expect(sameTerminalKeyboardAvoidanceMetrics(metrics, { ...metrics })).toBe(true)
+    expect(variants.map(([key]) => key).sort()).toEqual(Object.keys(metrics).sort())
+    for (const [key, variant] of variants) {
+      expect(sameTerminalKeyboardAvoidanceMetrics(metrics, variant), key).toBe(false)
+    }
+    const { rowPitch: _rowPitch, ...older } = metrics
+    expect(sameTerminalKeyboardAvoidanceMetrics(metrics, older)).toBe(false)
+  })
 })
diff --git a/mobile/src/terminal/terminal-webview-contract.ts b/mobile/src/terminal/terminal-webview-contract.ts
index 45b9a38c05a5..1c9960ab1ecd 100644
--- a/mobile/src/terminal/terminal-webview-contract.ts
+++ b/mobile/src/terminal/terminal-webview-contract.ts
@@ -1,6 +1,8 @@
 import type { RuntimeMobileTerminalTheme } from '../../../src/shared/runtime-types'
 import type { TerminalOscLinkRange } from '../../../src/shared/terminal-osc-link-ranges'
 import type { StyleProp, ViewStyle } from 'react-native'
+import type { TerminalFitDimensions } from './terminal-grid-fit'
+import type { TerminalFrame } from './terminal-webview-messages'
 
 type TerminalMouseTrackingMode = 'none' | 'x10' | 'vt200' | 'drag' | 'any'
 
@@ -18,6 +20,23 @@ export type TerminalKeyboardAvoidanceMetrics = {
   contentBottomRow: number
   rows: number
   altScreen: boolean
+  // CSS px between drawn rows, fit scale included; absent from older documents and before the
+  // renderer has measured.
+  rowPitch?: number
+}
+
+/** Every field: a fit-scale change moves only the row pitch, and the lift must hear it. */
+export function sameTerminalKeyboardAvoidanceMetrics(
+  a: TerminalKeyboardAvoidanceMetrics,
+  b: TerminalKeyboardAvoidanceMetrics
+): boolean {
+  return (
+    a.cursorY === b.cursorY &&
+    a.contentBottomRow === b.contentBottomRow &&
+    a.rows === b.rows &&
+    a.altScreen === b.altScreen &&
+    a.rowPitch === b.rowPitch
+  )
 }
 
 export function parseTerminalKeyboardAvoidanceMetrics(
@@ -30,12 +49,11 @@ export function parseTerminalKeyboardAvoidanceMetrics(
     msg.contentBottomRow === undefined
       ? cursorY
       : Math.min(toNonNegativeInteger(msg.contentBottomRow), maxRow)
-  return {
-    cursorY,
-    contentBottomRow,
-    rows,
-    altScreen: msg.altScreen === true
-  }
+  const metrics = { cursorY, contentBottomRow, rows, altScreen: msg.altScreen === true }
+  const rowPitch = msg.rowPitch
+  return typeof rowPitch === 'number' && Number.isFinite(rowPitch) && rowPitch > 0
+    ? { ...metrics, rowPitch }
+    : metrics
 }
 
 function toNonNegativeInteger(value: unknown): number {
@@ -61,6 +79,8 @@ export type TerminalSelectionEvents = {
   // Why: pinch-to-zoom in the terminal snaps to a text-size preset and reports it
   // here so the app persists it and keeps Settings + other panes in sync.
   onTextScaleChange?: (scale: number) => void
+  // xterm laid out a different cell box at the same grid (renderer swap, pixel-ratio change).
+  onCellBoxChange?: () => void
 }
 
 export type TerminalWebViewProps = {
@@ -69,35 +89,42 @@ export type TerminalWebViewProps = {
   // Why: baseline zoom multiplier applied on top of fit-to-width scale; raw
   // xterm fontSize alone cannot drive apparent size because fitting cancels it.
   textScale?: number
+  // Why: only a view shown when it mounts builds its terminal before ready (one WebGL context each).
+  shownAtMount?: boolean
   onWebReady?: () => void
   onEngineError?: (message: string) => void
 } & TerminalSelectionEvents
 
+/** One init: the grid, the snapshot it replays, and the frame the grid was fitted to. */
+export type TerminalInit = {
+  cols: number
+  rows: number
+  initialData?: string
+  preserveScroll?: boolean
+  oscLinks?: TerminalOscLinkRange[]
+  frame: TerminalFrame | null
+}
+
 export type TerminalWebViewHandle = {
   // Why: iOS can preserve the native view while discarding its JS/backing-store
   // state; foreground recovery must wait for the document to answer before replay.
   prepareForForegroundRecovery: () => void
   write: (data: string) => void
-  init: (
-    cols: number,
-    rows: number,
-    initialData?: string,
-    preserveScroll?: boolean,
-    oscLinks?: TerminalOscLinkRange[]
-  ) => void
-  resize: (cols: number, rows: number) => void
+  init: (init: TerminalInit) => void
+  resize: (cols: number, rows: number, frame: TerminalFrame | null) => void
   // Why: reflow the local xterm buffer (scrollback included) to a new width
   // after a server-side PTY reflow, so older wrapped lines rewrap to match the
   // latest output. No-op on the alternate screen.
-  reflow: (cols: number, rows: number) => void
+  reflow: (cols: number, rows: number, frame: TerminalFrame | null) => void
   clear: () => void
-  measureFitDimensions: (containerHeight?: number) => Promise<{ cols: number; rows: number } | null>
+  /** The grid this frame holds at the cell box the document reported; null without one at this text size. */
+  fitDimensions: (frame: TerminalFrame) => TerminalFitDimensions | null
   resetZoom: () => void
   cancelSelect: () => void
   doSelectAll: () => void
   // Why: lets callers await the WebView-side `init` rAF chain (term.open
-  // → renderService population → first paint) so a follow-up measure
-  // doesn't race ahead and find term=null or cellWidth=0. Resolves on
-  // the next 'ready' notify after the most recent init.
+  // → renderService population → first paint → the init's cell box) so a
+  // follow-up fit reads that box. Resolves on the next 'ready' notify after
+  // the most recent init.
   awaitReady: () => Promise<void>
 }
diff --git a/mobile/src/terminal/terminal-webview-html.ts b/mobile/src/terminal/terminal-webview-html.ts
index 01d0e577a864..65bbff60d352 100644
--- a/mobile/src/terminal/terminal-webview-html.ts
+++ b/mobile/src/terminal/terminal-webview-html.ts
@@ -21,4 +21,20 @@ export const XTERM_HTML = [
   TERMINAL_HTML_DOCUMENT_CLOSE
 ].join('')
 
-export const XTERM_WEBVIEW_SOURCE = { html: XTERM_HTML }
+/**
+ * The WebView's document, starting as its view mounted: at this text scale, and whether it was
+ * shown. Written into the page ahead of the document script, which reads them as it starts.
+ */
+export function xtermWebViewSource(start: { textScale: number; shown: boolean }) {
+  const startValues =
+    `window.__orcaTerminalTextScale = ${JSON.stringify(start.textScale)};\n` +
+    `window.__orcaTerminalShown = ${JSON.stringify(start.shown)};\n`
+  return {
+    html: [
+      TERMINAL_HTML_DOCUMENT_SHELL,
+      startValues,
+      TERMINAL_DOCUMENT_SCRIPT,
+      TERMINAL_HTML_DOCUMENT_CLOSE
+    ].join('')
+  }
+}
diff --git a/mobile/src/terminal/terminal-webview-messages.ts b/mobile/src/terminal/terminal-webview-messages.ts
index 35c6e991b68d..ca82f1739178 100644
--- a/mobile/src/terminal/terminal-webview-messages.ts
+++ b/mobile/src/terminal/terminal-webview-messages.ts
@@ -1,6 +1,9 @@
 import type { RuntimeMobileTerminalTheme } from '../../../src/shared/runtime-types'
 import type { TerminalOscLinkRange } from '../../../src/shared/terminal-osc-link-ranges'
 
+/** The frame React Native laid out, sent with each grid so the document fits a text-size change to it. */
+export type TerminalFrame = { width: number; height: number }
+
 export type TerminalWebViewCommand =
   | { type: 'ping'; id?: number }
   | { type: 'write'; id?: number; data: string }
@@ -16,12 +19,12 @@ export type TerminalWebViewCommand =
       // Why: width-reflow re-streams replay the same content rewrapped at new
       // cols; preserve the reader's scroll position instead of jumping to bottom.
       preserveScroll?: boolean
+      frame: TerminalFrame | null
     }
   | { type: 'set-font-scale'; id?: number; fontScale: number }
-  | { type: 'resize'; id?: number; cols: number; rows: number }
-  | { type: 'reflow'; id?: number; cols: number; rows: number }
+  | { type: 'resize'; id?: number; cols: number; rows: number; frame: TerminalFrame | null }
+  | { type: 'reflow'; id?: number; cols: number; rows: number; frame: TerminalFrame | null }
   | { type: 'clear'; id?: number }
-  | { type: 'measure'; id?: number; containerHeight?: number }
   | { type: 'reset-zoom'; id?: number }
   | { type: 'cancel-select'; id?: number }
   | { type: 'do-select-all'; id?: number }
diff --git a/mobile/src/terminal/terminal-webview-query-reply.test.ts b/mobile/src/terminal/terminal-webview-query-reply.test.ts
index 49b8fb635391..48de712bcaa7 100644
--- a/mobile/src/terminal/terminal-webview-query-reply.test.ts
+++ b/mobile/src/terminal/terminal-webview-query-reply.test.ts
@@ -119,7 +119,7 @@ describe('mobile terminal query replies', () => {
     expect(messages).toEqual([{ type: 'terminal-data', bytes: '\x1b[3;4R' }])
     const router = documentModuleSource('host-message-router')
     const clearStart = router.indexOf("} else if (msg.type === 'clear') {")
-    const clearEnd = router.indexOf("} else if (msg.type === 'measure')", clearStart)
+    const clearEnd = router.indexOf("} else if (msg.type === 'reset-zoom')", clearStart)
     expect(clearStart).toBeGreaterThanOrEqual(0)
     expect(router.slice(clearStart, clearEnd)).toContain('resumeTerminalDataReplyAuthority(scope)')
   })
diff --git a/mobile/src/terminal/terminal-webview-ready-promises.ts b/mobile/src/terminal/terminal-webview-ready-promises.ts
index fde27fe28460..0eab14849dc8 100644
--- a/mobile/src/terminal/terminal-webview-ready-promises.ts
+++ b/mobile/src/terminal/terminal-webview-ready-promises.ts
@@ -1,35 +1,24 @@
 import { useMemo } from 'react'
-import type { TerminalWebViewCommand } from './terminal-webview-messages'
 
 /**
- * The two promises the terminal handle hands out, and the notifies that settle them.
+ * The ready promise the terminal handle hands out, and the notify that settles it.
  *
  * `awaitReady` waits for the document's `init` rAF chain — `term.open`, renderService population,
- * first paint — because a measure that runs synchronously after init finds `term` null or cells
- * of size zero. `measureFitDimensions` waits for the document's answer. Both are promises held
- * across a message round trip, both have a timeout for the case where the document never answers,
- * and both are the same on either host, so they live here rather than in the controller that owns
- * the readiness handshake.
+ * first paint, and the cell box that init reports — so a fit after it reads the init's own box. It
+ * has a timeout for a document that never answers, and is the same on either host.
  */
 
 const READY_TIMEOUT_MS = 3000
-const MEASURE_TIMEOUT_MS = 2000
-/** Below these the fit is not a terminal anyone can read, and the caller disables fit-to-phone. */
-const MIN_FIT_COLS = 20
-const MIN_FIT_ROWS = 8
-
-export type TerminalFitDimensions = { cols: number; rows: number }
 
 export function createTerminalWebViewReadyPromises() {
   let readyPromise: Promise<void> | null = null
   let readyResolve: (() => void) | null = null
-  let measureResolve: ((result: TerminalFitDimensions | null) => void) | null = null
 
   /**
    * Arms a fresh ready promise, resolving any prior one first.
    *
    * Why: an awaiter from the previous generation would otherwise sit on the timeout below — each
-   * leaked timer and closure pinned an awaiting measure caller for the full 3s under rapid
+   * leaked timer and closure pinned an awaiting fit caller for the full 3s under rapid
    * re-init (orientation change, multiple resubscribes), delaying cold-start fit chains.
    */
   function armReady() {
@@ -70,47 +59,7 @@ export function createTerminalWebViewReadyPromises() {
     })
   }
 
-  function measure(
-    send: (command: TerminalWebViewCommand) => void,
-    containerHeight?: number
-  ): Promise<TerminalFitDimensions | null> {
-    return new Promise((resolve) => {
-      measureResolve?.(null)
-      let timeout: ReturnType<typeof setTimeout> | null = null
-      const finish = (result: TerminalFitDimensions | null) => {
-        if (timeout) {
-          clearTimeout(timeout)
-          timeout = null
-        }
-        if (measureResolve === finish) {
-          measureResolve = null
-        }
-        resolve(result)
-      }
-      measureResolve = finish
-      send({ type: 'measure', containerHeight })
-      // Why: if the document doesn't respond (e.g., xterm failed to load), resolve null so the
-      // caller can disable Fit to Phone rather than hanging indefinitely.
-      timeout = setTimeout(() => {
-        if (measureResolve === finish) {
-          finish(null)
-        }
-      }, MEASURE_TIMEOUT_MS)
-    })
-  }
-
-  function resolveMeasure(msg: Record<string, unknown>) {
-    const resolve = measureResolve
-    measureResolve = null
-    if (!resolve) {
-      return
-    }
-    const cols = typeof msg.cols === 'number' ? msg.cols : null
-    const rows = typeof msg.rows === 'number' ? msg.rows : null
-    resolve(cols && rows && cols >= MIN_FIT_COLS && rows >= MIN_FIT_ROWS ? { cols, rows } : null)
-  }
-
-  return { armReady, awaitReady, measure, resolveMeasure, resolveReady }
+  return { armReady, awaitReady, resolveReady }
 }
 
 export function useTerminalWebViewReadyPromises() {
diff --git a/mobile/src/terminal/terminal-webview-reflow.test.ts b/mobile/src/terminal/terminal-webview-reflow.test.ts
index 5e29cb06c8e6..82948f541eb7 100644
--- a/mobile/src/terminal/terminal-webview-reflow.test.ts
+++ b/mobile/src/terminal/terminal-webview-reflow.test.ts
@@ -50,16 +50,13 @@ describe('terminal WebView reflow', () => {
   it('is dispatched by the reflow WebView message and exposed on the handle', () => {
     expect(DOCUMENT_SOURCE).toContain("} else if (msg.type === 'reflow') {")
     expect(DOCUMENT_SOURCE).toContain('reflow(scope, msg.cols!, msg.rows!)')
-    expect(handleSource).toContain("postMessage({ type: 'reflow', cols, rows })")
+    expect(handleSource).toContain("postMessage({ type: 'reflow', cols, rows, frame })")
   })
 
   it('does not locally resize hidden WebViews to a one-column grid', () => {
-    // The floor is a constant of the module that fits the grid, and both readers import it.
-    expect(DOCUMENT_SOURCE).toContain('export const MIN_FIT_COLS = 20')
-    expect(DOCUMENT_SOURCE).toContain('if (cols < MIN_FIT_COLS) {')
-    expect(DOCUMENT_SOURCE).toContain("flog(scope, 'measure-skip-small-width'")
-    expect(DOCUMENT_SOURCE).toContain(
-      "notify(scope, { type: 'measure-result', cols: null, rows: null })"
-    )
+    // The floor belongs to the one fit the app and the document share.
+    const gridFitSource = readFileSync(new URL('./terminal-grid-fit.ts', import.meta.url), 'utf8')
+    expect(gridFitSource).toContain('export const MIN_FIT_COLS = 20')
+    expect(gridFitSource).toContain('if (!(cols >= MIN_FIT_COLS)) {')
   })
 })
diff --git a/mobile/src/terminal/terminal-webview-scroll-routing.test.ts b/mobile/src/terminal/terminal-webview-scroll-routing.test.ts
index f62bfdf1ee25..bb0cc6494121 100644
--- a/mobile/src/terminal/terminal-webview-scroll-routing.test.ts
+++ b/mobile/src/terminal/terminal-webview-scroll-routing.test.ts
@@ -140,14 +140,10 @@ describe('TerminalWebView scroll routing', () => {
     expect(source).toContain('pendingMessages.clear()')
   })
 
-  it('clears WebView await timers when the real response wins', () => {
-    // C7.5 moved both promises into `terminal-webview-ready-promises.ts`, which both components
-    // reach through the controller; the two blocks are the same code in their new home.
-    const measureBlock = sliceBetween('function measure(', 'function resolveMeasure')
-    expect(measureBlock).toContain('clearTimeout(timeout)')
-    expect(measureBlock).toContain('measureResolve === finish')
-
-    const readyBlock = sliceBetween('async function awaitReady()', 'function measure(')
+  it('clears the ready await timer when the real response wins', () => {
+    // C7.5 moved the promise into `terminal-webview-ready-promises.ts`, which both components
+    // reach through the controller.
+    const readyBlock = sliceBetween('async function awaitReady()', 'return { armReady')
     expect(readyBlock).toContain('clearTimeout(timeout)')
     expect(readyBlock).toContain('void pending.finally')
   })
diff --git a/mobile/src/terminal/terminal-webview-text-zoom.test.ts b/mobile/src/terminal/terminal-webview-text-zoom.test.ts
index 9d2403098ca2..20b2d2a0afdc 100644
--- a/mobile/src/terminal/terminal-webview-text-zoom.test.ts
+++ b/mobile/src/terminal/terminal-webview-text-zoom.test.ts
@@ -8,10 +8,6 @@ import { startTextScaling } from './document/text-scaling'
 import { webviewPageSource } from './document/document-module-source.test-support'
 
 const terminalWebViewSource = readFileSync(join(import.meta.dirname, 'TerminalWebView.tsx'), 'utf8')
-const terminalHtmlModuleSource = readFileSync(
-  join(import.meta.dirname, 'terminal-webview-html.ts'),
-  'utf8'
-)
 const terminalHtmlDocumentShellSource = readFileSync(
   join(import.meta.dirname, 'terminal-webview-html', 'document-shell.ts'),
   'utf8'
@@ -65,11 +61,9 @@ describe('TerminalWebView text zoom', () => {
     const end = terminalWebViewSource.indexOf('/>', start)
     expect(end).toBeGreaterThan(start)
     const webViewProps = terminalWebViewSource.slice(start, end)
-    expect(terminalHtmlModuleSource).toContain(
-      'export const XTERM_WEBVIEW_SOURCE = { html: XTERM_HTML }'
-    )
-    expect(webViewProps).toContain('source={XTERM_WEBVIEW_SOURCE}')
-    expect(webViewProps).not.toContain('source={{ html: XTERM_HTML }}')
+    // One source object per view, pinned at mount.
+    expect(terminalWebViewSource).toContain('const [source] = useState(() =>')
+    expect(webViewProps).toContain('source={source}')
   })
 
   it('forces the Claude status dot to text presentation before xterm writes', () => {
@@ -123,7 +117,7 @@ describe('TerminalWebView text zoom', () => {
       'const replayData = normalizeInitialData(initialData)'
     )
     const clearStart = terminalHtmlSource.indexOf("} else if (msg.type === 'clear') {")
-    const clearEnd = terminalHtmlSource.indexOf("} else if (msg.type === 'measure')", clearStart)
+    const clearEnd = terminalHtmlSource.indexOf("} else if (msg.type === 'reset-zoom')", clearStart)
     expect(initStart).toBeGreaterThanOrEqual(0)
     expect(initReplay).toBeGreaterThan(initStart)
     expect(clearStart).toBeGreaterThanOrEqual(0)
@@ -139,8 +133,8 @@ describe('TerminalWebView text zoom', () => {
   it('loads Unicode 11 before replaying mobile terminal bytes', () => {
     expect(terminalHtmlDocumentShellSource).toContain('XTERM_ENGINE_JS')
     expect(terminalHtmlSource).toContain('window.Unicode11Addon.Unicode11Addon')
-    const open = terminalHtmlSource.indexOf('scope.term.open(scope.surface!)')
-    const unicode = terminalHtmlSource.indexOf("scope.term.unicode.activeVersion = '11'")
+    const open = terminalHtmlSource.indexOf('term.open(scope.surface!)')
+    const unicode = terminalHtmlSource.indexOf("term.unicode.activeVersion = '11'")
     const replay = terminalHtmlSource.indexOf("enqueueWrite(scope, ESC + '[0m' + replayData)")
     expect(open).toBeGreaterThanOrEqual(0)
     expect(unicode).toBeGreaterThan(open)
diff --git a/mobile/src/terminal/terminal-write-coalescer-boundaries.test.ts b/mobile/src/terminal/terminal-write-coalescer-boundaries.test.ts
index 22e76581a0e5..39615ef36926 100644
--- a/mobile/src/terminal/terminal-write-coalescer-boundaries.test.ts
+++ b/mobile/src/terminal/terminal-write-coalescer-boundaries.test.ts
@@ -50,12 +50,12 @@ describe('terminal write coalescer boundaries', () => {
     view.coalescer.write('stale-pre-snapshot')
     // init() boundary as wired in TerminalWebView: clear the coalescer, then post init.
     view.coalescer.clear()
-    view.postMessage({ type: 'init', cols: 80, rows: 24, initialData: 'snapshot' })
+    view.postMessage({ type: 'init', cols: 80, rows: 24, initialData: 'snapshot', frame: null })
     vi.runOnlyPendingTimers()
 
     expect(view.delivered).toEqual([
       { type: 'write', data: 'a' },
-      { type: 'init', cols: 80, rows: 24, initialData: 'snapshot' }
+      { type: 'init', cols: 80, rows: 24, initialData: 'snapshot', frame: null }
     ])
     const initIndex = view.delivered.findIndex((msg) => msg.type === 'init')
     expect(initIndex).toBeGreaterThanOrEqual(0)
@@ -75,7 +75,7 @@ describe('terminal write coalescer boundaries', () => {
     // Recovery re-init: coalescer.clear() cancels any pending timer synchronously,
     // so nothing can flush after this point; the queued init supersedes the flush.
     view.coalescer.clear()
-    view.postMessage({ type: 'init', cols: 80, rows: 24, initialData: 'snapshot' })
+    view.postMessage({ type: 'init', cols: 80, rows: 24, initialData: 'snapshot', frame: null })
 
     view.readiness.webReady = true
     view.pendingMessages.flush(view.send)
@@ -84,7 +84,7 @@ describe('terminal write coalescer boundaries', () => {
     expect(view.delivered).toEqual([
       { type: 'write', data: 'live' },
       { type: 'write', data: 'buffered-mid-recovery' },
-      { type: 'init', cols: 80, rows: 24, initialData: 'snapshot' }
+      { type: 'init', cols: 80, rows: 24, initialData: 'snapshot', frame: null }
     ])
     // Invariant: no write reaches the document after the recovery init.
     const initIndex = view.delivered.findIndex((msg) => msg.type === 'init')
@@ -124,7 +124,9 @@ describe('terminal write coalescer boundaries', () => {
 
   it('clears the coalescer before posting init and clear (snapshot supersession)', () => {
     // Anchor on the init() signature (unique) — 'init(' alone also matches comments.
-    const initStart = controllerSource.indexOf('initialData?: string,')
+    const initStart = controllerSource.indexOf(
+      'init({ cols, rows, initialData, preserveScroll, oscLinks, frame }'
+    )
     const initClear = controllerSource.indexOf('writeCoalescer.clear()', initStart)
     const initPost = controllerSource.indexOf("type: 'init'", initStart)
     expect(initStart).toBeGreaterThanOrEqual(0)
@@ -142,7 +144,9 @@ describe('terminal write coalescer boundaries', () => {
 
   it('flushes pending writes before resize and reflow so boundaries observe prior bytes', () => {
     for (const method of ['resize', 'reflow'] as const) {
-      const start = controllerSource.indexOf(`${method}(cols: number, rows: number) {`)
+      const start = controllerSource.indexOf(
+        `${method}(cols: number, rows: number, frame: TerminalFrame | null) {`
+      )
       expect(start).toBeGreaterThanOrEqual(0)
       const body = controllerSource.slice(start, start + 300)
       const flushIndex = body.indexOf('writeCoalescer.flushNow()')
diff --git a/mobile/src/terminal/use-terminal-live-input-commit.test.ts b/mobile/src/terminal/use-terminal-live-input-commit.test.ts
index 87ad2b642923..211454c87ad0 100644
--- a/mobile/src/terminal/use-terminal-live-input-commit.test.ts
+++ b/mobile/src/terminal/use-terminal-live-input-commit.test.ts
@@ -6,6 +6,13 @@ import type { TerminalLiveInputSender } from './terminal-live-input-sender'
 import { TERMINAL_LIVE_HELD_PREEDIT_COMMIT_DELAY_MS } from './terminal-live-preedit-mirror'
 import { useTerminalLiveInputCommit } from './use-terminal-live-input-commit'
 
+// The host's report is the seam's subject; here only whether it reports a range at all matters.
+const composingRange = vi.hoisted(() => ({ hostReportsNone: false }))
+vi.mock('../platform/live-input-composing-range', () => ({
+  reportedLiveInputComposing: (isComposing: boolean | undefined) =>
+    composingRange.hostReportsNone ? undefined : isComposing
+}))
+
 type TerminalLiveInputCommitHandlers = ReturnType<typeof useTerminalLiveInputCommit<string>>
 
 /** `isComposing` omitted models a platform that reports no marked-text range. */
@@ -121,6 +128,7 @@ function createTerminalLiveInputCommitHarness({
 describe('terminal live input commit hook', () => {
   afterEach(() => {
     vi.useRealTimers()
+    composingRange.hostReportsNone = false
   })
 
   it('Given Hangul composition and no marked-text report When steps arrive Then no jamo leaks', async () => {
@@ -168,6 +176,41 @@ describe('terminal live input commit hook', () => {
     expect(sent).toEqual([])
   })
 
+  it('Given an Android WebView composing each word When letters follow a slash Then each reaches the terminal as typed', async () => {
+    // Given: the page's field event is the DOM's, and an Android keyboard composes Latin words
+    composingRange.hostReportsNone = true
+    const { handlers, sent } = createTerminalLiveInputCommitHarness()
+
+    // When
+    changeLiveInput(handlers, '/', false)
+    await vi.waitFor(() => expect(sent).toHaveLength(1))
+    for (const fieldText of ['/t', '/tu', '/tui']) {
+      changeLiveInput(handlers, fieldText, true)
+      // Each keystroke on its own, so a held letter cannot hide inside a later batch.
+      await vi.waitFor(() => expect(sent).toHaveLength(fieldText.length))
+    }
+
+    // Then: what native Android sends for the same keys, which report no range there
+    await vi.waitFor(() => expect(sent).toEqual(['/', 't', 'u', 'i']))
+  })
+
+  it('Given an Android WebView composing Hangul When steps arrive Then the non-ASCII run still settles on the timer', async () => {
+    // Given
+    vi.useFakeTimers()
+    composingRange.hostReportsNone = true
+    const { handlers, sent } = createTerminalLiveInputCommitHarness()
+
+    // When
+    for (const fieldText of ['ㅎ', '하', '한']) {
+      changeLiveInput(handlers, fieldText, true)
+      await vi.advanceTimersByTimeAsync(50)
+    }
+    await vi.advanceTimersByTimeAsync(TERMINAL_LIVE_HELD_PREEDIT_COMMIT_DELAY_MS)
+
+    // Then
+    await vi.waitFor(() => expect(sent).toEqual(['한']))
+  })
+
   it('Given an iOS pinyin preedit When accessory Backspace edits it Then only the candidate reaches the terminal', async () => {
     // Given
     vi.useFakeTimers()
diff --git a/mobile/src/terminal/use-terminal-live-input-commit.ts b/mobile/src/terminal/use-terminal-live-input-commit.ts
index 55bc23c3dcc9..485a6a1e425b 100644
--- a/mobile/src/terminal/use-terminal-live-input-commit.ts
+++ b/mobile/src/terminal/use-terminal-live-input-commit.ts
@@ -1,5 +1,6 @@
 import { useCallback, useEffect, useRef, type RefObject } from 'react'
 import type { TextInput } from 'react-native'
+import { reportedLiveInputComposing } from '../platform/live-input-composing-range'
 import { getTerminalLiveSpecialKeyDecision } from './terminal-live-text-commit'
 import { sendTerminalLiveControlAfterPendingFlush } from './terminal-live-control-send-order'
 import type { TerminalLiveAccessoryInput } from './terminal-live-accessory-input'
@@ -148,7 +149,7 @@ export function useTerminalLiveInputCommit<TTabType extends string>({
       void applyLiveInputMirror(
         activeHandle,
         normalizeTerminalTextInput(nativeEvent.text),
-        nativeEvent.isComposing
+        reportedLiveInputComposing(nativeEvent.isComposing)
       )
     },
     [
diff --git a/mobile/src/terminal/use-terminal-webview-controller.ts b/mobile/src/terminal/use-terminal-webview-controller.ts
index c2c0575f548d..8ca48f55a65a 100644
--- a/mobile/src/terminal/use-terminal-webview-controller.ts
+++ b/mobile/src/terminal/use-terminal-webview-controller.ts
@@ -1,9 +1,14 @@
 import { useCallback, useEffect, useMemo, useRef } from 'react'
-import type { TerminalOscLinkRange } from '../../../src/shared/terminal-osc-link-ranges'
-import type { TerminalWebViewHandle, TerminalWebViewProps } from './terminal-webview-contract'
+import { readTerminalCellBox, type TerminalCellBox } from './terminal-cell-box'
+import { fitDimensionsFromCell } from './terminal-grid-fit'
+import type {
+  TerminalInit,
+  TerminalWebViewHandle,
+  TerminalWebViewProps
+} from './terminal-webview-contract'
 import { useTerminalWebViewEngineErrorState } from './terminal-webview-engine-error-state'
 import { useTerminalWebReadyWatchdog } from './terminal-webview-ready-watchdog'
-import type { TerminalWebViewCommand } from './terminal-webview-messages'
+import type { TerminalFrame, TerminalWebViewCommand } from './terminal-webview-messages'
 import { createTerminalWebViewPendingMessages } from './terminal-webview-pending-messages'
 import { dispatchTerminalWebViewNotification } from './terminal-webview-notification-dispatch'
 import { routeTerminalQueryReply } from './terminal-webview-query-reply-routing'
@@ -15,7 +20,7 @@ import { createTerminalWriteCoalescer } from './terminal-write-coalescer'
  *
  * The document is the same program on both platforms — inside the WebView it is the generated
  * script, on the page it is the modules that script is generated from — so the readiness
- * handshake, the pending queue, the write coalescer, the ready and measure promises and the whole
+ * handshake, the pending queue, the write coalescer, the ready promise and the whole
  * imperative handle are the same too. What differs is only how a command reaches the document and
  * how a notify comes back: a `postMessage` across the WebView bridge, or a direct call.
  *
@@ -61,7 +66,8 @@ export function useTerminalWebViewController(
     onTerminalTap,
     onFileTap,
     onOpenUrl,
-    onTextScaleChange
+    onTextScaleChange,
+    onCellBoxChange
   } = props
   const { pingsOnForegroundRecovery, post } = transport
   const isWebReadyRef = useRef(false)
@@ -70,9 +76,11 @@ export function useTerminalWebViewController(
   const pendingPingIdRef = useRef<number | null>(null)
   const terminalThemeKey = useMemo(() => JSON.stringify(terminalTheme ?? null), [terminalTheme])
   // Why: each init() call posts 'init' to the document and arms a fresh ready promise. The
-  // document's init() rAF chain ends with a 'ready' notify that resolves it. measureFitDimensions
-  // awaits this so it doesn't race ahead of term.open() / renderService population.
+  // document's init() rAF chain ends with a 'ready' notify that resolves it. A fit awaits this so
+  // it reads the box the init reported.
   const promises = useTerminalWebViewReadyPromises()
+  // The box the current document last reported; its re-reports cover a text-size change.
+  const cellBoxRef = useRef<TerminalCellBox | null>(null)
   const { clearEngineError, engineError, reportEngineError, reportNativeEngineError } =
     useTerminalWebViewEngineErrorState(onEngineError)
   const { armWebReadyWatchdog, clearWebReadyWatchdog } = useTerminalWebReadyWatchdog(
@@ -148,6 +156,8 @@ export function useTerminalWebViewController(
       routeTerminalQueryReply(msg, onTerminalQueryReply)
 
       if (msg.type === 'web-ready') {
+        // Why: nothing subscribes before ready, so a ready's box only sizes the subscribe after it.
+        cellBoxRef.current = readTerminalCellBox(msg)
         confirmWebReady(true)
       } else if (
         msg.type === 'pong' &&
@@ -157,11 +167,14 @@ export function useTerminalWebViewController(
         confirmWebReady(false)
       } else if (msg.type === 'ready') {
         // Why: the document's init() rAF chain has run — term is open, renderService is
-        // populated, first paint has happened. Resolve any pending awaitReady() so a queued
-        // measure can now safely read cell dims.
+        // populated, first paint has happened, and its box was reported. Resolve any pending
+        // awaitReady() so a queued fit reads that box.
         promises.resolveReady()
-      } else if (msg.type === 'measure-result') {
-        promises.resolveMeasure(msg)
+      } else if (msg.type === 'cell-box') {
+        cellBoxRef.current = readTerminalCellBox(msg)
+        if (msg.refit === true) {
+          onCellBoxChange?.()
+        }
       } else {
         dispatchTerminalWebViewNotification(msg, {
           reportEngineError,
@@ -194,7 +207,8 @@ export function useTerminalWebViewController(
       onTerminalTap,
       onFileTap,
       onOpenUrl,
-      onTextScaleChange
+      onTextScaleChange,
+      onCellBoxChange
     ]
   )
 
@@ -209,6 +223,7 @@ export function useTerminalWebViewController(
     pendingPingIdRef.current = null
     pendingMessages.clear()
     writeCoalescer.clear()
+    cellBoxRef.current = null
     armWebReadyWatchdog()
   }, [armWebReadyWatchdog, pendingMessages, writeCoalescer])
 
@@ -222,6 +237,17 @@ export function useTerminalWebViewController(
     postMessage({ type: 'set-font-scale', fontScale: textScale })
   }, [postMessage, textScale])
 
+  const fitDimensions = useCallback(
+    (frame: TerminalFrame) => {
+      const cell = cellBoxRef.current
+      // Why: a box at another scale (a reload keeps the mount's) fits nothing; the route stays unmeasured.
+      return cell && cell.fontScale === textScale && frame.width > 0 && frame.height > 0
+        ? fitDimensionsFromCell(cell, frame.width, frame.height)
+        : null
+    },
+    [textScale]
+  )
+
   const handle = useMemo<TerminalWebViewHandle>(
     () => ({
       prepareForForegroundRecovery() {
@@ -237,13 +263,7 @@ export function useTerminalWebViewController(
       write(data: string) {
         writeCoalescer.write(data)
       },
-      init(
-        cols: number,
-        rows: number,
-        initialData?: string,
-        preserveScroll?: boolean,
-        oscLinks?: TerminalOscLinkRange[]
-      ) {
+      init({ cols, rows, initialData, preserveScroll, oscLinks, frame }: TerminalInit) {
         // Why: arm a fresh ready promise BEFORE posting init. The document resolves it via the
         // 'ready' notify at the end of its rAF chain.
         promises.armReady()
@@ -258,28 +278,24 @@ export function useTerminalWebViewController(
           oscLinks,
           terminalTheme,
           fontScale: textScale,
-          preserveScroll
+          preserveScroll,
+          frame
         })
       },
-      resize(cols: number, rows: number) {
+      resize(cols: number, rows: number, frame: TerminalFrame | null) {
         // Why: resize/reflow must observe all prior writes or bytes reorder.
         writeCoalescer.flushNow()
-        postMessage({ type: 'resize', cols, rows })
+        postMessage({ type: 'resize', cols, rows, frame })
       },
-      reflow(cols: number, rows: number) {
+      reflow(cols: number, rows: number, frame: TerminalFrame | null) {
         writeCoalescer.flushNow()
-        postMessage({ type: 'reflow', cols, rows })
+        postMessage({ type: 'reflow', cols, rows, frame })
       },
       clear() {
         writeCoalescer.clear()
         postMessage({ type: 'clear' })
       },
-      measureFitDimensions(containerHeight?: number) {
-        if (!isWebReadyRef.current) {
-          return Promise.resolve(null)
-        }
-        return promises.measure(sendToDocument, containerHeight)
-      },
+      fitDimensions,
       resetZoom() {
         postMessage({ type: 'reset-zoom' })
       },
@@ -295,6 +311,7 @@ export function useTerminalWebViewController(
     }),
     [
       armWebReadyWatchdog,
+      fitDimensions,
       pingsOnForegroundRecovery,
       postMessage,
       promises,
diff --git a/mobile/src/test-support/rpc-recording/adapters/diff-review-action-mount-adapters.ts b/mobile/src/test-support/rpc-recording/adapters/diff-review-action-mount-adapters.ts
index cc8c69061d2f..8dd7d816fc3a 100644
--- a/mobile/src/test-support/rpc-recording/adapters/diff-review-action-mount-adapters.ts
+++ b/mobile/src/test-support/rpc-recording/adapters/diff-review-action-mount-adapters.ts
@@ -31,6 +31,9 @@ export function diffReviewActionMountAdapters(
       const useInteractions = modules.load<
         typeof import('../../../session/use-mobile-diff-review-interactions')
       >('mobile/src/session/use-mobile-diff-review-interactions.ts').useMobileDiffReviewInteractions
+      const reviewSheets = modules.load<
+        typeof import('../../../session/mobile-diff-review-sheets')
+      >('mobile/src/session/mobile-diff-review-sheets.ts')
       const staleInput = modules.load<
         typeof import('../../../session/mobile-native-chat-stale-input')
       >('mobile/src/session/mobile-native-chat-stale-input.ts')
@@ -75,7 +78,12 @@ export function diffReviewActionMountAdapters(
       }
       let actionError: string | null = null
       let busyAction: string | null = null
-      let sendSheet: SendSheetState | null = null
+      let sheets = reviewSheets.NO_REVIEW_SHEETS
+      const sheetIntents = reviewSheets.reviewSheetIntents((action) => {
+        sheets = reviewSheets.reduceReviewSheets(sheets, action)
+      })
+      const sendSheet = (): SendSheetState | null =>
+        sheets.requested?.kind === 'send' ? sheets.requested.load : null
       let interactions: ReturnType<typeof useInteractions>
       const hook = hookMount(() => {
         interactions = useInteractions(
@@ -101,7 +109,6 @@ export function diffReviewActionMountAdapters(
             setFilter: () => {},
             setCurrentIndex: () => {},
             setActiveHunkIndex: () => {},
-            setComposer: () => {},
             setComposerBody: () => {},
             setActionError: (update) => {
               actionError = typeof update === 'function' ? update(actionError) : update
@@ -109,10 +116,7 @@ export function diffReviewActionMountAdapters(
             setBusyAction: (update) => {
               busyAction = typeof update === 'function' ? update(busyAction) : update
             },
-            setSendSheet: (update) => {
-              sendSheet = typeof update === 'function' ? update(sendSheet) : update
-            },
-            setShowCompletion: () => {},
+            sheets: sheetIntents,
             loadReviewData: () => {
               effect('load-review-data', {})
               return Promise.resolve()
@@ -163,7 +167,7 @@ export function diffReviewActionMountAdapters(
             throw new Error(`Unknown review action: ${name}${String(args.unused ?? '')}`)
           })
         },
-        state: () => ({ screenState, actionError, busyAction, sendSheet }),
+        state: () => ({ screenState, actionError, busyAction, sendSheet: sendSheet() }),
         dispose: () => {
           staleInput.resetMobileNativeChatStaleInputForTests()
           hook.unmount()
diff --git a/mobile/src/test-support/rpc-recording/adapters/pairing-journal-mount-adapters.ts b/mobile/src/test-support/rpc-recording/adapters/pairing-journal-mount-adapters.ts
index 64a6c8715b5c..26cd6d0a0d36 100644
--- a/mobile/src/test-support/rpc-recording/adapters/pairing-journal-mount-adapters.ts
+++ b/mobile/src/test-support/rpc-recording/adapters/pairing-journal-mount-adapters.ts
@@ -51,7 +51,7 @@ export function pairingJournalMountAdapters(
               effect('bundle-written', { version: written.current.version })
             },
             loadHosts: async () => [],
-            saveHost: async () => {
+            savePairedHost: async () => {
               effect('host-saved', HOST_ID)
             },
             connectRelay: () => candidateClient(client, effect, 'relay'),
@@ -95,8 +95,8 @@ export function pairingJournalMountAdapters(
               connectRelay: () => candidateClient(client, effect, 'relay'),
               resolveInviteDirector: async () => pairingRelay(),
               resolveHostIdentity: async () => ({ id: HOST_ID, name: 'Fixture host' }),
-              saveHost: async (host: { relayHostId?: string }) => {
-                savedHost = host.relayHostId ?? 'direct-only'
+              savePairedHost: async (host: { relay?: { relayHostId: string } }) => {
+                savedHost = host.relay?.relayHostId ?? 'direct-only'
                 effect('host-saved', savedHost)
               },
               saveJournal: async () => {
diff --git a/mobile/src/test-support/rpc-recording/adapters/relay-credential-mount-adapters.ts b/mobile/src/test-support/rpc-recording/adapters/relay-credential-mount-adapters.ts
index 6cf359e7fb4e..75a11afadf9f 100644
--- a/mobile/src/test-support/rpc-recording/adapters/relay-credential-mount-adapters.ts
+++ b/mobile/src/test-support/rpc-recording/adapters/relay-credential-mount-adapters.ts
@@ -106,7 +106,7 @@ export function relayCredentialMountAdapters(
               writeBundle: async (written: { current: { version: number } }) => {
                 effect('bundle-written', { version: written.current.version })
               },
-              saveHost: async () => {
+              setRelayRouting: async () => {
                 effect('host-saved', HOST_ID)
               },
               deleteBundle: async () => {
@@ -116,7 +116,7 @@ export function relayCredentialMountAdapters(
           })
           started.then(
             (result) => {
-              outcome = result === null ? 'declined' : result.host.relayHostId
+              outcome = result === null ? 'declined' : result.relay.relayHostId
             },
             (error: unknown) => {
               outcome = `failed: ${error instanceof Error ? error.message : String(error)}`
diff --git a/mobile/src/test-support/rpc-recording/adapters/terminal-mount-adapters.ts b/mobile/src/test-support/rpc-recording/adapters/terminal-mount-adapters.ts
index 0cb0d559cbcb..8af181a469b0 100644
--- a/mobile/src/test-support/rpc-recording/adapters/terminal-mount-adapters.ts
+++ b/mobile/src/test-support/rpc-recording/adapters/terminal-mount-adapters.ts
@@ -12,9 +12,10 @@ function terminalWebViewHandle(
   dims: { cols: number; rows: number }
 ) {
   return {
-    measureFitDimensions: (frameHeight?: number) => {
-      effect('measure-fit', { frameHeight: frameHeight ?? null })
-      return Promise.resolve(dims)
+    awaitReady: () => Promise.resolve(),
+    fitDimensions: (frame: { height: number }) => {
+      effect('measure-fit', { frameHeight: frame.height })
+      return dims
     },
     reflow: (cols: number, rows: number) => effect('reflow', { cols, rows })
   }
@@ -106,7 +107,7 @@ export function terminalMountAdapters(
         notifications = useRefit({
           activeHandleRef: { current: HANDLE },
           terminalRefs,
-          terminalFrameHeightRef: { current: 600 },
+          terminalFrameRef: { current: { width: 390, height: 600 } },
           viewportRef,
           viewportMeasuredRef,
           nativeChatCoveredRef: { current: false },
@@ -116,7 +117,6 @@ export function terminalMountAdapters(
           connState,
           tabStripVisible: true,
           textScale: 1,
-          terminalFrameWidth: 390,
           unsubscribeTerminal: (handle: string) => effect('unsubscribe-terminal', { handle }),
           subscribeToTerminal: (handle: string) => effect('subscribe-terminal', { handle })
         } as unknown as Parameters<typeof useRefit>[0])
diff --git a/mobile/src/test-support/rpc-recording/compiled-operation-module.test.ts b/mobile/src/test-support/rpc-recording/compiled-operation-module.test.ts
new file mode 100644
index 000000000000..c79a7141d5c5
--- /dev/null
+++ b/mobile/src/test-support/rpc-recording/compiled-operation-module.test.ts
@@ -0,0 +1,30 @@
+import { describe, expect, it } from 'vitest'
+import { compiledOperationModule } from './compiled-operation-module'
+
+describe('compiled operation code', () => {
+  it('reuses identical code but separates source, exposure and diagnostic filename', () => {
+    const source = 'const value: number = 1; export const read = () => value'
+    const original = compiledOperationModule('original.ts', source, '')
+    expect(compiledOperationModule('original.ts', source, '')).toBe(original)
+    expect(compiledOperationModule('original.ts', source.replace('= 1', '= 2'), '')).not.toBe(
+      original
+    )
+    expect(compiledOperationModule('original.ts', source, '\nexports.extra = value')).not.toBe(
+      original
+    )
+    expect(compiledOperationModule('different.ts', source, '')).not.toBe(original)
+  })
+
+  it('bounds retained code and still evaluates an evicted module correctly', () => {
+    const source = 'export const value = 42'
+    const original = compiledOperationModule('evicted.ts', source, '')
+    for (let index = 0; index < 512; index++) {
+      compiledOperationModule(`bounded-${index}.ts`, 'export {}', '')
+    }
+    const recompiled = compiledOperationModule('evicted.ts', source, '')
+    expect(recompiled).not.toBe(original)
+    const exports = {}
+    recompiled(() => undefined, exports)
+    expect(exports).toEqual({ value: 42 })
+  })
+})
diff --git a/mobile/src/test-support/rpc-recording/compiled-operation-module.ts b/mobile/src/test-support/rpc-recording/compiled-operation-module.ts
new file mode 100644
index 000000000000..ca9f14a6ed97
--- /dev/null
+++ b/mobile/src/test-support/rpc-recording/compiled-operation-module.ts
@@ -0,0 +1,31 @@
+import { compileFunction } from 'node:vm'
+import ts from 'typescript'
+
+const compiled = new Map<string, ReturnType<typeof compileFunction>>()
+const MAX_COMPILED_MODULES = 512
+
+/** Only code is shared: each invocation receives a fresh require closure and exports object. */
+export function compiledOperationModule(file: string, source: string, exposure: string) {
+  const key = JSON.stringify([file, source, exposure])
+  const cached = compiled.get(key)
+  if (cached) {
+    return cached
+  }
+  const output = ts.transpileModule(source, {
+    compilerOptions: {
+      module: ts.ModuleKind.CommonJS,
+      target: ts.ScriptTarget.ES2022,
+      // Product JSX uses the automatic runtime without importing React.
+      jsx: ts.JsxEmit.ReactJSX
+    }
+  }).outputText
+  const evaluate = compileFunction(output + exposure, ['require', 'exports'], { filename: file })
+  if (compiled.size >= MAX_COMPILED_MODULES) {
+    const oldest = compiled.keys().next().value
+    if (oldest !== undefined) {
+      compiled.delete(oldest)
+    }
+  }
+  compiled.set(key, evaluate)
+  return evaluate
+}
diff --git a/mobile/src/test-support/rpc-recording/operation-module-loader.test.ts b/mobile/src/test-support/rpc-recording/operation-module-loader.test.ts
index bf8d411cff76..cd97f5ce529f 100644
--- a/mobile/src/test-support/rpc-recording/operation-module-loader.test.ts
+++ b/mobile/src/test-support/rpc-recording/operation-module-loader.test.ts
@@ -1,4 +1,4 @@
-import { mkdtempSync, mkdirSync, writeFileSync } from 'node:fs'
+import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { createElement } from 'react'
@@ -11,21 +11,84 @@ import { operationModuleLoader } from './operation-module-loader'
  * loader does rather than by what one screen happens to import today.
  */
 const roots: string[] = []
-function loaderOver(files: Record<string, string>): ReturnType<typeof operationModuleLoader> {
+function sourceTree(files: Record<string, string>): string {
   const root = mkdtempSync(join(tmpdir(), 'rpc-loader-'))
   roots.push(root)
   for (const [name, source] of Object.entries(files)) {
     mkdirSync(join(root, 'mobile/src'), { recursive: true })
     writeFileSync(join(root, 'mobile/src', name), source)
   }
-  return operationModuleLoader(root)
+  return root
+}
+function loaderOver(files: Record<string, string>): ReturnType<typeof operationModuleLoader> {
+  return operationModuleLoader(sourceTree(files))
 }
 
 afterAll(() => {
+  for (const root of roots) {
+    rmSync(root, { recursive: true, force: true })
+  }
   roots.length = 0
 })
 
 describe('the mounted module loader', () => {
+  it('reuses code without sharing exports, module state, mounting dependencies or effects', () => {
+    const root = sourceTree({
+      'state.ts': `
+        import { mounted, initial } from 'scenario-device'
+        mounted()
+        let count = initial
+        export const next = () => ++count
+      `,
+      'operation.ts': `export { next } from './state'`
+    })
+    let mounts = 0
+    function scenario(initial: number) {
+      return operationModuleLoader(
+        root,
+        undefined,
+        [],
+        new Map([['scenario-device', { initial, mounted: () => mounts++ }]])
+      )
+    }
+    const firstLoader = scenario(0)
+    const first = firstLoader.load<{ next: () => number }>('mobile/src/operation.ts')
+    expect(first.next()).toBe(1)
+    expect(first.next()).toBe(2)
+    expect(firstLoader.load('mobile/src/operation.ts')).toBe(first)
+    const second = scenario(10).load<{ next: () => number }>('mobile/src/operation.ts')
+    expect(second).not.toBe(first)
+    expect(second.next()).toBe(11)
+    expect(first.next()).toBe(3)
+    expect(mounts).toBe(2)
+  })
+
+  it('keeps mutations, exposure code and later source edits distinct on a warm cache', () => {
+    const source = 'const value: number = 1; export const read = () => value'
+    const root = sourceTree({ 'value.ts': source })
+    const path = 'mobile/src/value.ts'
+    const baseline = operationModuleLoader(root).load<{ read: () => number }>(path)
+    const mutation = { name: 'value', file: 'value.ts', before: '= 1', after: '= 2' }
+    for (let index = 0; index < 2; index++) {
+      const mutated = operationModuleLoader(root, mutation, [
+        ['value.ts', '\nexports.exposed = () => value + 10']
+      ])
+      const result = mutated.load<{ read: () => number; exposed: () => number }>(path)
+      expect(result.read()).toBe(2)
+      expect(result.exposed()).toBe(12)
+      expect(mutated.mutationsApplied()).toBe(1)
+    }
+    expect(baseline.read()).toBe(1)
+    const fresh = operationModuleLoader(root).load<{ read: () => number; exposed?: unknown }>(path)
+    expect(fresh.read()).toBe(1)
+    expect(fresh.exposed).toBeUndefined()
+    writeFileSync(join(root, path), source.replace('= 1', '= 3'))
+    expect(operationModuleLoader(root).load<{ read: () => number }>(path).read()).toBe(3)
+    expect(() => operationModuleLoader(root, mutation).load(path)).toThrow(
+      'Mutant anchor matched 0 sites'
+    )
+  })
+
   /**
    * Product sources compile with the automatic runtime and never import React, so a classic
    * `React.createElement` emit throws `React is not defined` on the first render of every screen.
diff --git a/mobile/src/test-support/rpc-recording/operation-module-loader.ts b/mobile/src/test-support/rpc-recording/operation-module-loader.ts
index 2f337c94964a..b2f75a4cb4ff 100644
--- a/mobile/src/test-support/rpc-recording/operation-module-loader.ts
+++ b/mobile/src/test-support/rpc-recording/operation-module-loader.ts
@@ -1,10 +1,10 @@
-import { compileFunction } from 'node:vm'
 import { existsSync, readFileSync } from 'node:fs'
 import { dirname, resolve } from 'node:path'
 import ts from 'typescript'
 import { nativeMountingSubstitutes } from './native-mounting-substitutes'
 import { observeSalvagedReads } from './salvage-observation'
 import * as deliveryAmbiguity from '../../transport/rpc-delivery-ambiguity'
+import { compiledOperationModule } from './compiled-operation-module'
 
 export type OperationModule = Record<string, (...args: any[]) => unknown>
 /** One anchored in-memory source edit, resolved by the caller so the loader needs no mutant table. */
@@ -139,17 +139,8 @@ export function operationModuleLoader(
     }
     const exports: OperationModule = {}
     cache.set(file, exports)
-    const output = ts.transpileModule(source, {
-      compilerOptions: {
-        module: ts.ModuleKind.CommonJS,
-        target: ts.ScriptTarget.ES2022,
-        // Product sources use the automatic runtime and never import React, so a classic
-        // `React.createElement` emit throws `React is not defined` on the first screen render.
-        jsx: ts.JsxEmit.ReactJSX
-      }
-    }).outputText
     const exposure = exposures.find(([suffix]) => file.endsWith(suffix))?.[1] ?? ''
-    const evaluate = compileFunction(output + exposure, ['require', 'exports'], { filename: file })
+    const evaluate = compiledOperationModule(file, source, exposure)
     evaluate((name: string) => imported(file, name), exports)
     observeSalvagedReads(file, exports)
     return exports
diff --git a/mobile/src/transport/client-context.test.ts b/mobile/src/transport/client-context.test.ts
index 0d65be5a63f5..99a8e31fa4f6 100644
--- a/mobile/src/transport/client-context.test.ts
+++ b/mobile/src/transport/client-context.test.ts
@@ -40,12 +40,17 @@ vi.mock('./host-store', () => ({
 vi.mock('./connection-revival-triggers', () => ({
   subscribeConnectionRevivalTriggers: () => () => {}
 }))
+vi.mock('./connection-log-background-flush', () => ({
+  subscribeConnectionLogBackgroundFlush: () => () => {}
+}))
 
 import {
   RpcClientProvider,
   useDisconnectHostClient,
   useForceReconnect,
-  useHostClient
+  useHostClient,
+  usePrimeHosts,
+  useRefreshHostClient
 } from './client-context'
 import { useAllHostClients } from './use-all-host-clients'
 import { useRelayRecoveryStatus } from './client-context-connection-metrics'
@@ -415,6 +420,49 @@ describe('useHostClient', () => {
     }
   })
 
+  it('refreshes a Relay-active owned client onto the saved row after an endpoint edit', async () => {
+    const relayClient = makeFakeClient('connected', 'relay')
+    const replacement = makeFakeClient('connecting', 'tailscale')
+    connectMock.mockReturnValueOnce(relayClient).mockReturnValueOnce(replacement)
+    loadHostsMock.mockResolvedValue([HOST])
+    const edited = { ...HOST, endpoint: 'ws://100.101.102.103:6768' }
+
+    const states: ConnectionState[] = []
+    let refreshHostClient: ((hostId: string) => void) | null = null
+    let primeHosts: ((hosts: (typeof HOST)[]) => void) | null = null
+    let renderer: ReactTestRenderer | null = null
+    function Probe(): null {
+      refreshHostClient = useRefreshHostClient()
+      primeHosts = usePrimeHosts()
+      states.push(useHostClient(HOST.id).state)
+      return null
+    }
+
+    try {
+      await act(async () => {
+        renderer = create(createElement(RpcClientProvider, null, createElement(Probe)))
+        await Promise.resolve()
+      })
+      // A failed post-save re-prime leaves the pre-edit profile cached.
+      act(() => primeHosts?.([HOST]))
+      loadHostsMock.mockResolvedValue([edited])
+      states.length = 0
+
+      await act(async () => {
+        refreshHostClient?.(HOST.id)
+        await Promise.resolve()
+      })
+
+      expect(relayClient.closeMock).toHaveBeenCalled()
+      expect(relayClient.notifyForeground).not.toHaveBeenCalled()
+      expect(connectMock.mock.calls[1]?.[0]).toEqual(edited)
+      // The owner reads amber through the rebuild, never a grey flash.
+      expect(states).not.toContain('disconnected')
+    } finally {
+      act(() => renderer?.unmount())
+    }
+  })
+
   it('rebuilds a pairing-rejected Relay client so re-pairing credentials are re-read', async () => {
     const rejectedRelayClient = makeFakeClient('disconnected', 'relay')
     const replacement = makeFakeClient('connecting', 'tailscale')
diff --git a/mobile/src/transport/client-context.tsx b/mobile/src/transport/client-context.tsx
index 76d26c1bab52..0348c22105d8 100644
--- a/mobile/src/transport/client-context.tsx
+++ b/mobile/src/transport/client-context.tsx
@@ -12,6 +12,7 @@ import {
 import type { RpcClient } from './rpc-client'
 import type { StableLogicalRpcClient } from './stable-logical-rpc-client'
 import { subscribeConnectionRevivalTriggers } from './connection-revival-triggers'
+import { subscribeConnectionLogBackgroundFlush } from './connection-log-background-flush'
 import { HostClientOpenRegistry } from './host-client-open-registry'
 import {
   HostClientAcquisitionRegistry,
@@ -20,7 +21,7 @@ import {
 import { HostOpenRetryScheduler } from './host-open-retry-scheduler'
 import { openHostClientEntry, type HostClientStoreEntry } from './host-entry-opener'
 import { shouldPreserveActiveRelay } from './relay-reconnect-preservation'
-import { recordConnectionRevival } from './persisted-connection-log-store'
+import { connectionLogStore, recordConnectionRevival } from './persisted-connection-log-store'
 import {
   createHostClientSelectors,
   listHostClients,
@@ -329,6 +330,14 @@ export function RpcClientProvider({ children }: { children: ReactNode }) {
     })
   }, [])
 
+  // Why: a connection-log write that failed is only retried by the next append, so
+  // flush before the OS can kill a backgrounded app (see connection-log-background-flush).
+  useEffect(() => {
+    return subscribeConnectionLogBackgroundFlush(() => {
+      void connectionLogStore.flush()
+    })
+  }, [])
+
   const value = useMemo<RpcClientContextValue>(
     () => ({
       acquire,
diff --git a/mobile/src/transport/client-context.web.test.tsx b/mobile/src/transport/client-context.web.test.tsx
index c322d07ab7ed..1efc5771dd97 100644
--- a/mobile/src/transport/client-context.web.test.tsx
+++ b/mobile/src/transport/client-context.web.test.tsx
@@ -2,10 +2,7 @@ import type { ReactElement } from 'react'
 import { act, create } from 'react-test-renderer'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { BRIDGE_PROTOCOL_VERSION } from '../mobile-web-shell/bridge/bridge-envelope'
-import {
-  BRIDGE_PAGE_CLIENT_ID,
-  BRIDGE_PAGE_CLIENT_IDENTITY_ACCEPT
-} from '../mobile-web-shell/bridge/bridge-page-client-identity'
+import { BRIDGE_PAGE_CLIENT_ID } from '../mobile-web-shell/bridge/bridge-page-client-identity'
 import { createShellPageClient } from '../mobile-web-shell/bridge/page-bootstrap'
 import type { BridgeRpcClient } from '../mobile-web-shell/bridge/bridge-rpc-client'
 import type { RpcClientContextValue } from './rpc-client-context-contract'
@@ -35,8 +32,7 @@ const INIT = {
     lastInboundAt: 1800,
     generation: 5
   },
-  grants: { rpc: { maxPendingRequests: 64, maxSubscriptions: 32 }, native: [] },
-  accepts: [BRIDGE_PAGE_CLIENT_IDENTITY_ACCEPT]
+  grants: { rpc: { maxPendingRequests: 64, maxSubscriptions: 32 }, native: [] }
 }
 
 /** What the page mounted, and what it holds — the two things the provider decides. */
@@ -172,25 +168,6 @@ describe('the page provider', () => {
     expect(first).toBe(BRIDGE_PAGE_CLIENT_ID)
   })
 
-  it('claims nothing at all when the shell never said it performs the swap', () => {
-    const channel = installChannel()
-    const client = createShellPageClient()
-    if (client === null) {
-      throw new Error('no channel installed')
-    }
-    // An `init` that landed, naming no swap — not a client with no session at all, which would
-    // answer null for a reason that has nothing to do with the capability.
-    channel.deliver({ ...INIT, accepts: [] })
-    act(() => {
-      create(render(client))
-    })
-    expect(readContext().getState('host-a')).toBe('connected')
-
-    // An older shell forwards what the page sent, so a placeholder would reach the host and be
-    // refused as a spoof. Nothing claimed is the honest answer, and it is what shipped before.
-    expect(readContext().getClientId('host-a')).toBe(null)
-  })
-
   it('carries a state change from the shell to the screens watching it', () => {
     const channel = installChannel()
     const client = createReadyClient(channel.deliver)
diff --git a/mobile/src/transport/client-context.web.tsx b/mobile/src/transport/client-context.web.tsx
index 463aff873b21..a1606ba98534 100644
--- a/mobile/src/transport/client-context.web.tsx
+++ b/mobile/src/transport/client-context.web.tsx
@@ -3,10 +3,7 @@
 // side of the bridge already did, and this provider only carries what it holds across the boundary.
 import { createContext, useContext, useMemo, useRef, type ReactNode } from 'react'
 import type { BridgeRpcClient } from '../mobile-web-shell/bridge/bridge-rpc-client'
-import {
-  BRIDGE_PAGE_CLIENT_ID,
-  BRIDGE_PAGE_CLIENT_IDENTITY_ACCEPT
-} from '../mobile-web-shell/bridge/bridge-page-client-identity'
+import { BRIDGE_PAGE_CLIENT_ID } from '../mobile-web-shell/bridge/bridge-page-client-identity'
 import type { ConnectionState, HostProfile } from './types'
 import type { RpcClientContextValue } from './rpc-client-context-contract'
 
@@ -61,17 +58,8 @@ export function RpcClientProvider({
       getState: () => client.getState(),
       // Nothing mounts before `init`, so the page's state is never the unknown this answers null for.
       getKnownState: () => client.getState(),
-      /**
-       * A placeholder the shell swaps for this device's real identity, never the credential itself.
-       *
-       * Only when the shell said it performs the swap; a shell that did not leaves this null, which
-       * is no terminal and no live input, because the session route refuses to subscribe or send
-       * without one — but a placeholder the host read itself would be refused as a spoof.
-       */
-      getClientId: () =>
-        client.getShellSession()?.accepts.includes(BRIDGE_PAGE_CLIENT_IDENTITY_ACCEPT) === true
-          ? BRIDGE_PAGE_CLIENT_ID
-          : null,
+      /** A placeholder the shell swaps for this device's real identity, never the credential. */
+      getClientId: () => BRIDGE_PAGE_CLIENT_ID,
       getReconnectAttempt: () => client.getReconnectAttempt(),
       getLastConnectedAt: () => client.getLastConnectedAt(),
       // The page reaches its host through the shell bridge, which rides whatever path the RN
diff --git a/mobile/src/transport/connection-log-background-flush.test.ts b/mobile/src/transport/connection-log-background-flush.test.ts
new file mode 100644
index 000000000000..e5563a9fccdf
--- /dev/null
+++ b/mobile/src/transport/connection-log-background-flush.test.ts
@@ -0,0 +1,45 @@
+import { beforeEach, describe, expect, it, type Mock, vi } from 'vitest'
+import { subscribeConnectionLogBackgroundFlush } from './connection-log-background-flush'
+
+type AppStateListener = (next: string) => void
+
+let appStateListener: AppStateListener | null = null
+const appStateRemove = vi.fn()
+
+vi.mock('react-native', () => ({
+  AppState: {
+    addEventListener: (_event: string, listener: AppStateListener) => {
+      appStateListener = listener
+      return { remove: appStateRemove }
+    }
+  }
+}))
+
+describe('subscribeConnectionLogBackgroundFlush', () => {
+  let flush: Mock<() => void>
+
+  beforeEach(() => {
+    vi.clearAllMocks()
+    appStateListener = null
+    flush = vi.fn<() => void>()
+  })
+
+  it('flushes when the app goes to the background', () => {
+    subscribeConnectionLogBackgroundFlush(flush)
+    appStateListener?.('background')
+    expect(flush).toHaveBeenCalledTimes(1)
+  })
+
+  it('does not flush on foreground or transient inactive states', () => {
+    subscribeConnectionLogBackgroundFlush(flush)
+    appStateListener?.('active')
+    appStateListener?.('inactive')
+    expect(flush).not.toHaveBeenCalled()
+  })
+
+  it('removes the listener on unsubscribe', () => {
+    const unsubscribe = subscribeConnectionLogBackgroundFlush(flush)
+    unsubscribe()
+    expect(appStateRemove).toHaveBeenCalledTimes(1)
+  })
+})
diff --git a/mobile/src/transport/connection-log-background-flush.ts b/mobile/src/transport/connection-log-background-flush.ts
new file mode 100644
index 000000000000..860b7e43ca66
--- /dev/null
+++ b/mobile/src/transport/connection-log-background-flush.ts
@@ -0,0 +1,14 @@
+import { AppState } from 'react-native'
+
+// Why: connection-log persistence is best-effort — a failed write is only retried
+// by the next append, so when a disconnect is the last thing that happens the
+// entries explaining it never reach storage. Background is the last point the OS
+// still runs JS before it can kill the process, so flush the newest snapshot there.
+export function subscribeConnectionLogBackgroundFlush(flush: () => void): () => void {
+  const subscription = AppState.addEventListener('change', (next) => {
+    if (next === 'background') {
+      flush()
+    }
+  })
+  return () => subscription.remove()
+}
diff --git a/mobile/src/transport/connection-log-buffer.ts b/mobile/src/transport/connection-log-buffer.ts
index 5af67051cf87..149e8dc4ee8a 100644
--- a/mobile/src/transport/connection-log-buffer.ts
+++ b/mobile/src/transport/connection-log-buffer.ts
@@ -9,9 +9,13 @@ import { redactConnectionLogEntry } from '../diagnostics/connection-log-redactio
 // swaps (forceReconnect) and provider remounts (hot reload); bounded so an
 // all-night reconnect loop can't grow memory unbounded.
 const MAX_ENTRIES_PER_HOST = 200
+// Why: a store that just rejected almost always rejects again on the same tick, so
+// the one retry a snapshot gets waits instead of firing back-to-back.
+const PERSISTENCE_RETRY_DELAY_MS = 200
 
 export type ConnectionLogStore = {
   append: (hostId: string, entry: ConnectionLogEntry) => void
+  flush: () => Promise<void>
   get: (hostId: string) => readonly ConnectionLogEntry[]
   hydrate: (hostId: string) => Promise<void>
   subscribe: (hostId: string, listener: () => void) => () => void
@@ -31,10 +35,11 @@ export function createConnectionLogStore(
   const hydratedHosts = new Set<string>()
   const hydrationFailedHosts = new Set<string>()
   const hydrationByHost = new Map<string, Promise<void>>()
-  const saveByHost = new Map<string, Promise<void>>()
+  const activeSaveByHost = new Map<string, Promise<void>>()
+  const dirtyHosts = new Set<string>()
   const persistenceRevisionByHost = new Map<
     string,
-    { snapshot: readonly ConnectionLogEntry[]; saved: boolean }
+    { snapshot: readonly ConnectionLogEntry[]; retried: boolean; saved: boolean }
   >()
   // Why: useSyncExternalStore compares snapshots by reference — getSnapshot
   // must return the SAME array until the data actually changes, or React
@@ -59,36 +64,74 @@ export function createConnectionLogStore(
     }
   }
 
+  // Why: one in-flight save per host, re-reading the revision after each write, so
+  // slow storage retains the in-flight snapshot and the newest pending one instead
+  // of one superseded MAX_ENTRIES_PER_HOST copy per queued append.
+  const runSaveLoop = async (hostId: string, storage: ConnectionLogPersistence): Promise<void> => {
+    try {
+      // Yield once so a synchronous append burst collapses into a single write.
+      await Promise.resolve()
+      while (dirtyHosts.delete(hostId)) {
+        const revision = persistenceRevisionByHost.get(hostId)
+        if (!revision || revision.saved) {
+          return
+        }
+        try {
+          await storage.save(hostId, revision.snapshot)
+          revision.saved = true
+        } catch {
+          // At most one delayed retry per snapshot, and none at all once a newer
+          // snapshot is queued — that snapshot already carries these entries, so
+          // re-attempting this one is pure write amplification.
+          if (!revision.retried && !dirtyHosts.has(hostId)) {
+            revision.retried = true
+            setTimeout(() => persist(hostId), PERSISTENCE_RETRY_DELAY_MS)
+          }
+        }
+      }
+    } finally {
+      activeSaveByHost.delete(hostId)
+    }
+  }
+
   const persist = (hostId: string): void => {
     if (!persistence || !hydratedHosts.has(hostId)) {
       return
     }
     let revision = persistenceRevisionByHost.get(hostId)
     if (!revision) {
-      revision = { snapshot: [...(entriesByHost.get(hostId) ?? [])], saved: false }
+      revision = {
+        snapshot: [...(entriesByHost.get(hostId) ?? [])],
+        retried: false,
+        saved: false
+      }
       persistenceRevisionByHost.set(hostId, revision)
     }
-    const currentRevision = revision
-    if (currentRevision.saved) {
+    if (revision.saved) {
       return
     }
-    const previous = saveByHost.get(hostId) ?? Promise.resolve()
-    const pending = previous
-      .catch(() => {})
-      .then(async () => {
-        // Duplicate requests retain retry opportunities until this revision is durable.
-        if (currentRevision.saved) {
-          return
-        }
-        try {
-          await persistence.save(hostId, currentRevision.snapshot)
-        } catch {
-          await persistence.save(hostId, currentRevision.snapshot)
-        }
-        currentRevision.saved = true
-      })
-      .catch(() => {})
-    saveByHost.set(hostId, pending)
+    dirtyHosts.add(hostId)
+    if (activeSaveByHost.has(hostId)) {
+      return
+    }
+    activeSaveByHost.set(hostId, runSaveLoop(hostId, persistence))
+  }
+
+  // Why: a failed write is otherwise only retried by the next append, so the final
+  // entries explaining a disconnect are lost when the log goes quiet and the OS
+  // kills the app. Two passes: drain whatever is running, then one retry.
+  const flushHost = async (hostId: string): Promise<void> => {
+    for (let pass = 0; pass < 2; pass++) {
+      persist(hostId)
+      const active = activeSaveByHost.get(hostId)
+      if (!active) {
+        return
+      }
+      await active
+      if (persistenceRevisionByHost.get(hostId)?.saved === true) {
+        return
+      }
+    }
   }
 
   const hydrateHost = async (hostId: string, retryAfterFailure: boolean): Promise<void> => {
@@ -148,6 +191,10 @@ export function createConnectionLogStore(
         .catch(() => {})
     },
 
+    flush: async () => {
+      await Promise.all([...entriesByHost.keys()].map((hostId) => flushHost(hostId)))
+    },
+
     get(hostId) {
       const cached = snapshotByHost.get(hostId)
       if (cached) {
diff --git a/mobile/src/transport/connection-log-persistence-backpressure.test.ts b/mobile/src/transport/connection-log-persistence-backpressure.test.ts
new file mode 100644
index 000000000000..0819fc87ee30
--- /dev/null
+++ b/mobile/src/transport/connection-log-persistence-backpressure.test.ts
@@ -0,0 +1,266 @@
+import { describe, expect, it, vi } from 'vitest'
+import { createConnectionLogStore } from './connection-log-buffer'
+import type { ConnectionLogEntry } from './types'
+
+const entry = (id: number): ConnectionLogEntry => ({
+  id: String(id),
+  ts: id,
+  level: 'info',
+  message: `event ${id}`
+})
+
+async function drainMicrotasks(): Promise<void> {
+  for (let i = 0; i < 12; i++) {
+    await Promise.resolve()
+  }
+}
+
+describe('connection log persistence backpressure', () => {
+  it('writes only the latest pending snapshot when storage falls behind', async () => {
+    const saved: string[][] = []
+    let release: () => void = () => {}
+    let delay = false
+    const store = createConnectionLogStore(200, {
+      load: async () => [],
+      save: async (_host, entries) => {
+        saved.push(entries.map((item) => item.id))
+        if (delay) {
+          delay = false
+          await new Promise<void>((resolve) => {
+            release = resolve
+          })
+        }
+      }
+    })
+    await store.hydrate('a')
+    await drainMicrotasks()
+    saved.length = 0
+    delay = true
+    store.append('a', entry(0))
+    await drainMicrotasks()
+    for (let i = 1; i <= 1000; i++) {
+      store.append('a', entry(i))
+      await drainMicrotasks()
+    }
+    expect(saved).toEqual([['0']])
+    release()
+    for (let i = 0; i < 1000; i++) {
+      await drainMicrotasks()
+    }
+    expect(saved).toHaveLength(2)
+    expect(saved[1]).toEqual(store.get('a').map((item) => item.id))
+  })
+
+  it('persists a different host while one host has a stalled save', async () => {
+    const saved: [string, string[]][] = []
+    let release: () => void = () => {}
+    let delay = false
+    const store = createConnectionLogStore(200, {
+      load: async () => [],
+      save: async (host, entries) => {
+        saved.push([host, entries.map((item) => item.id)])
+        if (delay && host === 'a') {
+          delay = false
+          await new Promise<void>((resolve) => {
+            release = resolve
+          })
+        }
+      }
+    })
+    await Promise.all(['a', 'b'].map((host) => store.hydrate(host)))
+    await drainMicrotasks()
+    saved.length = 0
+    delay = true
+    store.append('a', entry(1))
+    await drainMicrotasks()
+    store.append('a', entry(2))
+    store.append('b', entry(3))
+    await drainMicrotasks()
+    expect(saved).toEqual([
+      ['a', ['1']],
+      ['b', ['3']]
+    ])
+    release()
+    await drainMicrotasks()
+    expect(saved.at(-1)).toEqual(['a', ['1', '2']])
+  })
+
+  it('saves the latest snapshot after an older in-flight revision fails', async () => {
+    let rejectSave: (error: Error) => void = () => {}
+    let failing = false
+    let persisted: readonly ConnectionLogEntry[] = []
+    const saved: string[][] = []
+    const persistence = {
+      load: async () => persisted,
+      save: async (_host: string, entries: readonly ConnectionLogEntry[]) => {
+        saved.push(entries.map((item) => item.id))
+        if (failing && entries.length === 1) {
+          if (saved.length === 1) {
+            await new Promise<void>((_resolve, reject) => {
+              rejectSave = reject
+            })
+          }
+          throw new Error('storage unavailable')
+        }
+        persisted = entries
+      }
+    }
+    const store = createConnectionLogStore(2, persistence)
+    await store.hydrate('a')
+    await drainMicrotasks()
+    saved.length = 0
+    failing = true
+    store.append('a', entry(1))
+    await drainMicrotasks()
+    store.append('a', entry(2))
+    await drainMicrotasks()
+    store.append('a', entry(3))
+    await drainMicrotasks()
+    rejectSave(new Error('storage unavailable'))
+    await drainMicrotasks()
+    expect(saved).toEqual([['1'], ['2', '3']])
+    const reloaded = createConnectionLogStore(2, persistence)
+    await reloaded.hydrate('a')
+    expect(reloaded.get('a')).toEqual(store.get('a'))
+  })
+
+  it.each([false, true])(
+    'includes an append during save settlement (deferred=%s)',
+    async (deferred) => {
+      let afterSave = () => {}
+      const saved: string[][] = []
+      const store = createConnectionLogStore(200, {
+        load: async () => [],
+        save: async (_host, entries) => {
+          saved.push(entries.map((item) => item.id))
+          afterSave()
+        }
+      })
+      await store.hydrate('a')
+      await drainMicrotasks()
+      saved.length = 0
+      afterSave = () => {
+        afterSave = () => {}
+        if (deferred) {
+          queueMicrotask(() => store.append('a', entry(2)))
+        } else {
+          store.append('a', entry(2))
+        }
+      }
+      store.append('a', entry(1))
+      await drainMicrotasks()
+      expect(saved).toEqual([['1'], ['1', '2']])
+    }
+  )
+
+  it('attempts the newest snapshot instead of replaying superseded ones', async () => {
+    let release: () => void = () => {}
+    let hold = false
+    let failing = false
+    const attempted: string[][] = []
+    const store = createConnectionLogStore(2, {
+      load: async () => [],
+      save: async (_host, entries) => {
+        attempted.push(entries.map((item) => item.id))
+        if (hold) {
+          hold = false
+          await new Promise<void>((resolve) => {
+            release = resolve
+          })
+        }
+        if (failing) {
+          throw new Error('storage temporarily unavailable')
+        }
+      }
+    })
+    await store.hydrate('a')
+    await drainMicrotasks()
+    attempted.length = 0
+    hold = true
+    failing = true
+    for (let i = 1; i <= 3; i++) {
+      store.append('a', entry(i))
+      await drainMicrotasks()
+    }
+    expect(attempted).toEqual([['1']])
+    release()
+    await drainMicrotasks()
+    // The superseded ['1'] snapshot is never replayed; only the newest one is attempted.
+    expect(attempted).toEqual([['1'], ['2', '3']])
+  })
+
+  it('bounds writes when a long stall unblocks against failing storage', async () => {
+    vi.useFakeTimers()
+    try {
+      let release: () => void = () => {}
+      let hold = false
+      let failing = false
+      let writes = 0
+      const store = createConnectionLogStore(200, {
+        load: async () => [],
+        save: async () => {
+          writes += 1
+          if (hold) {
+            hold = false
+            await new Promise<void>((resolve) => {
+              release = resolve
+            })
+          }
+          if (failing) {
+            throw new Error('storage unavailable')
+          }
+        }
+      })
+      await store.hydrate('a')
+      await drainMicrotasks()
+      writes = 0
+      hold = true
+      failing = true
+      for (let i = 0; i < 500; i++) {
+        store.append('a', entry(i))
+        await drainMicrotasks()
+      }
+      expect(writes).toBe(1)
+      release()
+      for (let i = 0; i < 20; i++) {
+        await drainMicrotasks()
+      }
+      // 500 stalled appends cost the held write plus one attempt at the newest snapshot.
+      expect(writes).toBe(2)
+      await vi.advanceTimersByTimeAsync(5_000)
+      // Draining the backoff adds that snapshot's single retry and nothing more.
+      expect(writes).toBe(3)
+    } finally {
+      vi.useRealTimers()
+    }
+  })
+
+  it('flush persists the newest snapshot after a failed save and a quiet log', async () => {
+    let failing = true
+    let durableIds: string[] = []
+    let writes = 0
+    const store = createConnectionLogStore(200, {
+      load: async () => [],
+      save: async (_host, entries) => {
+        writes += 1
+        if (failing) {
+          throw new Error('storage unavailable')
+        }
+        durableIds = entries.map((item) => item.id)
+      }
+    })
+    await store.hydrate('a')
+    await drainMicrotasks()
+    store.append('a', entry(1))
+    store.append('a', entry(2))
+    await drainMicrotasks()
+    expect(durableIds).toEqual([])
+    failing = false
+    writes = 0
+    await store.flush()
+    expect(durableIds).toEqual(['1', '2'])
+    expect(writes).toBe(1)
+    await store.flush()
+    expect(writes).toBe(1)
+  })
+})
diff --git a/mobile/src/transport/connection-log-persistence-revisions.test.ts b/mobile/src/transport/connection-log-persistence-revisions.test.ts
index e85567d9eafc..abe40775911f 100644
--- a/mobile/src/transport/connection-log-persistence-revisions.test.ts
+++ b/mobile/src/transport/connection-log-persistence-revisions.test.ts
@@ -50,7 +50,7 @@ describe('connection log persistence revisions', () => {
     )
   })
 
-  it('preserves distinct queued revisions while a save is delayed', async () => {
+  it('replaces obsolete queued revisions while a save is delayed', async () => {
     const saved: string[][] = []
     let release!: () => void
     let delay = false
@@ -79,27 +79,29 @@ describe('connection log persistence revisions', () => {
     expect(saved).toEqual([['1']])
     release()
     await drain()
-    expect(saved).toEqual([['1'], ['1', '2'], ['2', '3']])
+    expect(saved).toEqual([['1'], ['2', '3']])
   })
 
-  it('retains retries and later attempts when both initial save attempts fail', async () => {
+  it('attempts a failed snapshot once and carries the entries into the next write', async () => {
     const save = vi.fn<ConnectionLogPersistence['save']>(async () => {})
     const store = createConnectionLogStore(200, { load: async () => [], save })
     await store.hydrate('a')
     await drain()
     save.mockClear()
-    save.mockRejectedValueOnce(new Error('first')).mockRejectedValueOnce(new Error('retry'))
+    save.mockRejectedValueOnce(new Error('first'))
     store.append('a', entry(1))
     store.append('a', entry(2))
     store.append('a', entry(3))
     await drain()
-    expect(save).toHaveBeenCalledTimes(3)
-    expect(save.mock.calls[2]?.[1]).toBe(save.mock.calls[0]?.[1])
-    for (const [, snapshot] of save.mock.calls) {
-      expect(snapshot).toEqual([entry(1), entry(2), entry(3)])
-    }
+    expect(save).toHaveBeenCalledTimes(1)
+    expect(save.mock.calls[0]?.[1]).toEqual([entry(1), entry(2), entry(3)])
+    store.append('a', entry(4))
+    await drain()
+    expect(save).toHaveBeenCalledTimes(2)
+    expect(save).toHaveBeenLastCalledWith('a', store.get('a'))
   })
-  it('keeps every queued retry opportunity during a sustained failure', async () => {
+
+  it('writes once per snapshot during a sustained failure', async () => {
     const save = vi.fn<ConnectionLogPersistence['save']>(async () => {})
     const store = createConnectionLogStore(200, { load: async () => [], save })
     await store.hydrate('a')
@@ -109,7 +111,7 @@ describe('connection log persistence revisions', () => {
       store.append('a', entry(i))
     }
     await drain()
-    expect(save).toHaveBeenCalledTimes(6)
+    expect(save).toHaveBeenCalledTimes(1)
     save.mockClear().mockResolvedValue(undefined)
     store.append('a', entry(3))
     await drain()
diff --git a/mobile/src/transport/force-reconnect-page-seam.test.tsx b/mobile/src/transport/force-reconnect-page-seam.test.tsx
index 8aa8aee556e8..38d07b0d44b3 100644
--- a/mobile/src/transport/force-reconnect-page-seam.test.tsx
+++ b/mobile/src/transport/force-reconnect-page-seam.test.tsx
@@ -27,8 +27,7 @@ const INIT = {
     lastInboundAt: 1800,
     generation: 5
   },
-  grants: { rpc: { maxPendingRequests: 64, maxSubscriptions: 32 }, native: [] },
-  accepts: []
+  grants: { rpc: { maxPendingRequests: 64, maxSubscriptions: 32 }, native: [] }
 }
 
 afterEach(() => {
diff --git a/mobile/src/transport/host-catalog-credential-join.ts b/mobile/src/transport/host-catalog-credential-join.ts
index e914742ff4e9..229889b37b79 100644
--- a/mobile/src/transport/host-catalog-credential-join.ts
+++ b/mobile/src/transport/host-catalog-credential-join.ts
@@ -1,10 +1,10 @@
-import type { MobileRelayHostOverlay } from './mobile-relay-host-overlay'
+import type { MobileRelayEndpoint } from '../../../src/shared/mobile-relay-credential-contract'
 import type { HostListSnapshot } from './host-list-load-sharing'
 import type { HostCatalogEntry, StoredHostProfile } from './types'
 
 export async function joinHostCatalogCredentials(args: {
   storedHosts: readonly StoredHostProfile[]
-  overlays: ReadonlyMap<string, MobileRelayHostOverlay>
+  relays: ReadonlyMap<string, MobileRelayEndpoint>
   tokenCache: Map<string, string>
   readToken: (hostId: string) => Promise<string | null>
   getRevision: () => number
@@ -31,17 +31,8 @@ export async function joinHostCatalogCredentials(args: {
         args.tokenCache.set(stored.id, token)
       }
     }
-    const overlay = args.overlays.get(stored.id)
-    const base = {
-      ...stored,
-      ...(overlay
-        ? {
-            endpoints: overlay.endpoints,
-            relayHostId: overlay.relayHostId,
-            relay: overlay.relay
-          }
-        : {})
-    }
+    const relay = args.relays.get(stored.id)
+    const base = { ...stored, ...(relay ? { relay } : {}) }
     const profile = token ? { ...base, deviceToken: token } : null
     catalog.push({ ...base, credentialStatus, profile })
     if (profile) {
diff --git a/mobile/src/transport/host-list-mutation-queue.ts b/mobile/src/transport/host-list-mutation-queue.ts
index 5ed1a06f5ece..c695f362f3df 100644
--- a/mobile/src/transport/host-list-mutation-queue.ts
+++ b/mobile/src/transport/host-list-mutation-queue.ts
@@ -10,9 +10,12 @@ export function hostListMutationsSettled(): Promise<void> {
   return hostListMutation
 }
 
-export function enqueueHostListMutation(operation: () => Promise<void>): Promise<void> {
+export function enqueueHostListMutation<T>(operation: () => Promise<T>): Promise<T> {
   const mutation = hostListMutation.then(operation)
-  hostListMutation = mutation.catch(() => {})
+  hostListMutation = mutation.then(
+    () => {},
+    () => {}
+  )
   return mutation
 }
 
diff --git a/mobile/src/transport/host-logical-client.ts b/mobile/src/transport/host-logical-client.ts
index 7682fc9591b4..19d5e8d5ebc4 100644
--- a/mobile/src/transport/host-logical-client.ts
+++ b/mobile/src/transport/host-logical-client.ts
@@ -10,7 +10,7 @@ export function openHostLogicalClient(host: HostProfile, onLog: ConnectionLogSin
   // direct socket remains a replaceable first physical generation.
   const logical = createStableLogicalRpcClient(
     connect(host.endpoint, host.deviceToken, host.publicKeyB64, { onLog }),
-    directPathForEndpoint(host, host.endpoint)
+    directPathForEndpoint(host.endpoint)
   )
   if (Platform.OS === 'web') {
     return logical
diff --git a/mobile/src/transport/host-name-identity.test.ts b/mobile/src/transport/host-name-identity.test.ts
index 8c67d86bdec6..07277f7b90dd 100644
--- a/mobile/src/transport/host-name-identity.test.ts
+++ b/mobile/src/transport/host-name-identity.test.ts
@@ -35,7 +35,7 @@ vi.mock('./host-credential-cleanup', () => ({
 import {
   loadHosts,
   resetHostStoreForTests,
-  saveHost,
+  savePairedHost,
   updateHostDescriptor,
   updateHostNameAndEndpoint
 } from './host-store'
@@ -176,7 +176,7 @@ describe('host name identity', () => {
   describe('re-pair', () => {
     it('preserves the override and descriptor a pairing save knows nothing about', async () => {
       await updateHostDescriptor(TYPED_HOST.id, { machineName: 'm4airs-Air', platform: 'darwin' })
-      await saveHost({
+      await savePairedHost({
         id: TYPED_HOST.id,
         name: 'Windows-Low Spec',
         endpoint: 'ws://10.0.0.9:6768',
@@ -198,7 +198,7 @@ describe('host name identity', () => {
         machineName: 'm4airs-Air',
         platform: 'darwin'
       })
-      await saveHost({
+      await savePairedHost({
         id: GENERATED_HOST.id,
         name: 'Host 1',
         endpoint: GENERATED_HOST.endpoint,
@@ -211,11 +211,11 @@ describe('host name identity', () => {
 
     it('does not roll back identity changed since a connection took its profile snapshot', async () => {
       await updateHostDescriptor(TYPED_HOST.id, { machineName: 'Studio', platform: 'darwin' })
-      // A connection holds this for its lifetime and re-saves it on relay credential rotation.
+      // A connection holds this for its lifetime; a save built from it must not roll identity back.
       const snapshot = (await loadHosts()).find(({ id }) => id === TYPED_HOST.id)!
       await updateHostNameAndEndpoint(TYPED_HOST.id, { personalName: null })
       await updateHostDescriptor(TYPED_HOST.id, { machineName: 'Studio 2', platform: 'darwin' })
-      await saveHost({ ...snapshot, lastConnected: 99 })
+      await savePairedHost({ ...snapshot, lastConnected: 99 })
       const record = stored().find(({ id }) => id === TYPED_HOST.id)
       expect(record?.personalName).toBeUndefined()
       expect(record).toMatchObject({
diff --git a/mobile/src/transport/host-open-recovery.test.tsx b/mobile/src/transport/host-open-recovery.test.tsx
index 972a30dce1cb..d4bf4fe669ab 100644
--- a/mobile/src/transport/host-open-recovery.test.tsx
+++ b/mobile/src/transport/host-open-recovery.test.tsx
@@ -31,6 +31,9 @@ vi.mock('./connection-revival-triggers', () => ({
     }
   }
 }))
+vi.mock('./connection-log-background-flush', () => ({
+  subscribeConnectionLogBackgroundFlush: () => () => {}
+}))
 
 import {
   useDisconnectHostClient,
diff --git a/mobile/src/transport/host-store-endpoint.test.ts b/mobile/src/transport/host-store-endpoint.test.ts
index 8553f66e851e..59035e0d2b0a 100644
--- a/mobile/src/transport/host-store-endpoint.test.ts
+++ b/mobile/src/transport/host-store-endpoint.test.ts
@@ -1,6 +1,14 @@
 import AsyncStorage from '@react-native-async-storage/async-storage'
+import * as SecureStore from 'expo-secure-store'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
-import { updateHostNameAndEndpoint } from './host-store'
+import {
+  loadHosts,
+  RelayRoutingHostRemovedError,
+  resetHostStoreForTests,
+  setRelayRouting,
+  updateHostNameAndEndpoint
+} from './host-store'
+import { resetMobileRelayHostOverlayStoreForTests } from './mobile-relay-host-overlay-store'
 
 vi.mock('@react-native-async-storage/async-storage', () => ({
   default: {
@@ -104,3 +112,110 @@ describe('updateHostNameAndEndpoint', () => {
     expect(AsyncStorage.setItem).not.toHaveBeenCalled()
   })
 })
+
+describe('relay routing after a host edit', () => {
+  const OVERLAY_KEY = 'orca:mobile-relay:host-overlays:v2'
+  const OLD_ENDPOINT = 'ws://192.168.1.10:6768'
+  const NEW_ENDPOINT = 'ws://192.168.1.20:6768'
+  const relay = {
+    v: 1 as const,
+    directorUrl: 'https://relay.onorca.dev',
+    cellUrl: 'https://relay-c1.onorca.dev',
+    assignmentEpoch: 7,
+    relayHostId: 'AbCdEf0123_-xyZ9',
+    e2eeFraming: 2 as const
+  }
+  const moved = { ...relay, cellUrl: 'https://relay-c2.onorca.dev', assignmentEpoch: 8 }
+  const storage = new Map<string, string>()
+
+  function writesTo(key: string): unknown[] {
+    return vi.mocked(AsyncStorage.setItem).mock.calls.filter(([written]) => written === key)
+  }
+
+  beforeEach(() => {
+    resetHostStoreForTests()
+    resetMobileRelayHostOverlayStoreForTests()
+    storage.clear()
+    storage.set(
+      'orca:hosts',
+      JSON.stringify([
+        { id: 'host-1', name: 'Desk', endpoint: OLD_ENDPOINT, publicKeyB64: 'pk', lastConnected: 1 }
+      ])
+    )
+    // An older build's record: a copy of the row's address beside the relay.
+    storage.set(
+      OVERLAY_KEY,
+      JSON.stringify([
+        {
+          v: 2,
+          hostId: 'host-1',
+          endpoints: [
+            { id: 'direct-primary', kind: 'lan', url: OLD_ENDPOINT },
+            { id: 'relay-primary', kind: 'relay', url: 'wss://relay-c1.onorca.dev/v1/connect/id' }
+          ],
+          relayHostId: relay.relayHostId,
+          relay
+        }
+      ])
+    )
+    vi.mocked(AsyncStorage.getItem).mockReset()
+    vi.mocked(AsyncStorage.getItem).mockImplementation(async (key) => storage.get(key) ?? null)
+    vi.mocked(AsyncStorage.setItem).mockReset()
+    vi.mocked(AsyncStorage.setItem).mockImplementation(async (key, value) => {
+      storage.set(key, value)
+    })
+    vi.mocked(SecureStore.getItemAsync).mockResolvedValue('device-token')
+    vi.mocked(SecureStore.setItemAsync).mockReset()
+  })
+
+  it('loads only the edited address, whatever an older overlay stored', async () => {
+    await updateHostNameAndEndpoint('host-1', { endpoint: NEW_ENDPOINT })
+
+    const [host] = await loadHosts()
+    expect(host).toEqual({
+      id: 'host-1',
+      name: 'Desk',
+      personalName: 'Desk',
+      endpoint: NEW_ENDPOINT,
+      publicKeyB64: 'pk',
+      lastConnected: 1,
+      deviceToken: 'device-token',
+      relay
+    })
+  })
+
+  it('keeps an edited endpoint and the device token when relay routing is learned later', async () => {
+    await updateHostNameAndEndpoint('host-1', { personalName: 'Renamed', endpoint: NEW_ENDPOINT })
+    const hostsAfterEdit = storage.get('orca:hosts')
+
+    await setRelayRouting('host-1', moved)
+
+    expect(storage.get('orca:hosts')).toBe(hostsAfterEdit)
+    expect(SecureStore.setItemAsync).not.toHaveBeenCalled()
+    const [host] = await loadHosts()
+    expect(host).toMatchObject({ name: 'Renamed', endpoint: NEW_ENDPOINT, relay: moved })
+  })
+
+  it('does not rewrite storage when relay resolution repeats the stored routing', async () => {
+    await setRelayRouting('host-1', relay)
+    vi.mocked(AsyncStorage.setItem).mockClear()
+
+    await setRelayRouting('host-1', relay)
+
+    expect(AsyncStorage.setItem).not.toHaveBeenCalled()
+    expect(SecureStore.setItemAsync).not.toHaveBeenCalled()
+  })
+
+  it('refuses to write routing for a removed host and leaves no overlay behind', async () => {
+    storage.set('orca:hosts', '[]')
+    storage.set(OVERLAY_KEY, '[]')
+
+    await expect(setRelayRouting('host-1', relay)).rejects.toBeInstanceOf(
+      RelayRoutingHostRemovedError
+    )
+
+    expect(writesTo(OVERLAY_KEY)).toEqual([])
+    expect(writesTo('orca:hosts')).toEqual([])
+    await expect(loadHosts()).resolves.toEqual([])
+  })
+})
diff --git a/mobile/src/transport/host-store.test.ts b/mobile/src/transport/host-store.test.ts
index bb13e23dc4d0..60269c01d5ec 100644
--- a/mobile/src/transport/host-store.test.ts
+++ b/mobile/src/transport/host-store.test.ts
@@ -1,5 +1,8 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest'
-import type { MobileRelayHostOverlay } from './mobile-relay-host-overlay'
+import {
+  toStoredMobileRelayHostOverlay,
+  type MobileRelayHostOverlay
+} from './mobile-relay-host-overlay'
 
 const asyncStorageMock = vi.hoisted(() => ({
   getItem: vi.fn(),
@@ -41,12 +44,12 @@ vi.mock('./host-credential-cleanup', () => ({
 import {
   loadHostCatalog,
   loadHosts,
-  MobileRelayUpgradeHostRemovedError,
+  RelayRoutingHostRemovedError,
   removeHost,
   resolvePairingHostIdentity,
   resetHostStoreForTests,
-  saveHost,
-  saveExistingHostRelayUpgrade,
+  savePairedHost,
+  setRelayRouting,
   updateHostNameAndEndpoint,
   updateLastConnected
 } from './host-store'
@@ -69,6 +72,14 @@ const HOST_TWO = {
   publicKeyB64: 'key-2',
   lastConnected: 0
 }
+const HOST_ONE_RELAY = {
+  v: 1 as const,
+  directorUrl: 'https://relay.onorca.dev',
+  cellUrl: 'https://relay-c1.onorca.dev',
+  assignmentEpoch: 7,
+  relayHostId: 'AbCdEf0123_-xyZ9',
+  e2eeFraming: 2 as const
+}
 const HOST_ONE_RELAY_BUNDLE = {
   v: 1 as const,
   hostId: HOST_ONE.id,
@@ -175,7 +186,7 @@ describe('host-store list mutations', () => {
   })
 
   it('keeps existing metadata when pairing a distinct host', async () => {
-    await saveHost({
+    await savePairedHost({
       id: 'host-new',
       name: 'Host 3',
       endpoint: 'ws://127.0.0.1:3',
@@ -204,7 +215,7 @@ describe('host-store list mutations', () => {
       { ...HOST_TWO, id: 'host-duplicate', publicKeyB64: HOST_ONE.publicKeyB64 }
     ])
 
-    await saveHost({
+    await savePairedHost({
       ...HOST_ONE,
       endpoint: 'ws://127.0.0.1:3',
       deviceToken: 'replacement-token'
@@ -227,7 +238,11 @@ describe('host-store list mutations', () => {
     secureStoreMock.setItemAsync.mockRejectedValue(new Error('keychain write failed'))
 
     await expect(
-      saveHost({ ...HOST_ONE, endpoint: 'ws://127.0.0.1:3', deviceToken: 'replacement-token' })
+      savePairedHost({
+        ...HOST_ONE,
+        endpoint: 'ws://127.0.0.1:3',
+        deviceToken: 'replacement-token'
+      })
     ).rejects.toThrow('keychain write failed')
 
     expect(JSON.parse(storedHostsRaw)).toEqual([HOST_ONE, duplicate])
@@ -246,7 +261,11 @@ describe('host-store list mutations', () => {
     asyncStorageMock.setItem.mockRejectedValueOnce(new Error('metadata write failed'))
 
     await expect(
-      saveHost({ ...HOST_ONE, endpoint: 'ws://127.0.0.1:3', deviceToken: 'replacement-token' })
+      savePairedHost({
+        ...HOST_ONE,
+        endpoint: 'ws://127.0.0.1:3',
+        deviceToken: 'replacement-token'
+      })
     ).rejects.toThrow('metadata write failed')
 
     expect(JSON.parse(storedHostsRaw)).toEqual([HOST_ONE, duplicate])
@@ -264,7 +283,7 @@ describe('host-store list mutations', () => {
     }
     asyncStorageMock.setItem.mockRejectedValueOnce(new Error('metadata write failed'))
 
-    await expect(saveHost(replacement)).rejects.toThrow('metadata write failed')
+    await expect(savePairedHost(replacement)).rejects.toThrow('metadata write failed')
 
     expect(JSON.parse(storedHostsRaw)).toEqual([HOST_ONE, HOST_TWO])
     expect(recordCleanupIntentMock).toHaveBeenCalledWith(replacement.id)
@@ -281,10 +300,10 @@ describe('host-store list mutations', () => {
       publicKeyB64: HOST_ONE.publicKeyB64
     }
     storedHostsRaw = JSON.stringify([HOST_ONE, duplicate])
-    await saveHost({ ...HOST_ONE, deviceToken: 'token-a' })
+    await savePairedHost({ ...HOST_ONE, deviceToken: 'token-a' })
     const staleCleanup = scheduledCleanup(duplicate.id)
 
-    await saveHost({ ...duplicate, deviceToken: 'token-b' })
+    await savePairedHost({ ...duplicate, deviceToken: 'token-b' })
     await staleCleanup(duplicate.id)
 
     expect(JSON.parse(storedHostsRaw)).toEqual([duplicate])
@@ -390,26 +409,19 @@ describe('host-store list mutations', () => {
           url: 'wss://relay-c1.onorca.dev/v1/connect/AbCdEf0123_-xyZ9'
         }
       ],
-      relayHostId: 'AbCdEf0123_-xyZ9',
-      relay: {
-        v: 1,
-        directorUrl: 'https://relay.onorca.dev',
-        cellUrl: 'https://relay-c1.onorca.dev',
-        assignmentEpoch: 7,
-        relayHostId: 'AbCdEf0123_-xyZ9',
-        e2eeFraming: 2
-      }
+      relayHostId: HOST_ONE_RELAY.relayHostId,
+      relay: HOST_ONE_RELAY
     }
     storedOverlayRaw = JSON.stringify([overlay])
 
-    await saveHost({ ...HOST_ONE, deviceToken: 'replacement-token' })
+    await savePairedHost({ ...HOST_ONE, deviceToken: 'replacement-token' })
 
     expect(JSON.parse(storedOverlayRaw!)).toEqual([])
     expect(secureStoreMock.deleteItemAsync).not.toHaveBeenCalled()
   })
 
   it('does not touch relay storage when saving a new direct-only host', async () => {
-    await saveHost({
+    await savePairedHost({
       id: 'host-new',
       name: 'New Host',
       endpoint: 'ws://127.0.0.1:3',
@@ -423,7 +435,7 @@ describe('host-store list mutations', () => {
   })
 
   it('keeps the normal iOS save on the existing default keychain service', async () => {
-    await saveHost({
+    await savePairedHost({
       id: 'host-new',
       name: 'New Host',
       endpoint: 'ws://127.0.0.1:3',
@@ -467,7 +479,7 @@ describe('host-store list mutations', () => {
       })
     )
 
-    const save = saveHost({ ...HOST_ONE, deviceToken: 'replacement-token' })
+    const save = savePairedHost({ ...HOST_ONE, deviceToken: 'replacement-token' })
     await vi.waitFor(() => expect(secureStoreMock.setItemAsync).toHaveBeenCalledOnce())
     await removeHost(HOST_ONE.id)
     releaseTokenWrite()
@@ -488,7 +500,7 @@ describe('host-store list mutations', () => {
     }
     recordCleanupIntentMock.mockRejectedValueOnce(new Error('intent storage unavailable'))
 
-    await expect(saveHost(replacement)).rejects.toThrow('intent storage unavailable')
+    await expect(savePairedHost(replacement)).rejects.toThrow('intent storage unavailable')
 
     expect(JSON.parse(storedHostsRaw)).toEqual([HOST_ONE, HOST_TWO])
     expect(secureStoreMock.setItemAsync).not.toHaveBeenCalled()
@@ -518,15 +530,8 @@ describe('host-store list mutations', () => {
           url: 'wss://relay-c1.onorca.dev/v1/connect/AbCdEf0123_-xyZ9'
         }
       ],
-      relayHostId: 'AbCdEf0123_-xyZ9',
-      relay: {
-        v: 1,
-        directorUrl: 'https://relay.onorca.dev',
-        cellUrl: 'https://relay-c1.onorca.dev',
-        assignmentEpoch: 7,
-        relayHostId: 'AbCdEf0123_-xyZ9',
-        e2eeFraming: 2
-      }
+      relayHostId: HOST_ONE_RELAY.relayHostId,
+      relay: HOST_ONE_RELAY
     }
     storedOverlayRaw = JSON.stringify([overlay, { ...overlay, hostId: 'removed-by-old-build' }])
     let releaseCleanup: () => void = () => {}
@@ -538,38 +543,32 @@ describe('host-store list mutations', () => {
 
     const hostsLoad = loadHosts()
     await vi.waitFor(() => expect(scheduleCleanupMock).toHaveBeenCalled())
-    await saveHost({
+    await savePairedHost({
       ...HOST_ONE,
       id: 'removed-by-old-build',
       publicKeyB64: 'restored-key',
       deviceToken: 'restored-token',
-      endpoints: overlay.endpoints,
-      relayHostId: overlay.relayHostId,
       relay: overlay.relay
     })
     releaseCleanup()
     const hosts = await hostsLoad
 
-    expect(hosts.find(({ id }) => id === HOST_ONE.id)).toMatchObject({
-      endpoints: overlay.endpoints,
-      relayHostId: overlay.relayHostId,
-      relay: overlay.relay
-    })
+    expect(hosts.find(({ id }) => id === HOST_ONE.id)).toMatchObject({ relay: overlay.relay })
     expect(hosts.some(({ id }) => id === 'removed-by-old-build')).toBe(false)
-    expect(JSON.parse(storedOverlayRaw!)).toContainEqual({
-      ...overlay,
-      hostId: 'removed-by-old-build'
-    })
+    expect(JSON.parse(storedOverlayRaw!)).toContainEqual(
+      toStoredMobileRelayHostOverlay('removed-by-old-build', HOST_ONE_RELAY)
+    )
   })
 
   it('refuses to resurrect a removed host during relay upgrade publication', async () => {
     storedHostsRaw = JSON.stringify([HOST_TWO])
 
-    await expect(
-      saveExistingHostRelayUpgrade({ ...HOST_ONE, deviceToken: 'token-1' })
-    ).rejects.toBeInstanceOf(MobileRelayUpgradeHostRemovedError)
+    await expect(setRelayRouting(HOST_ONE.id, HOST_ONE_RELAY)).rejects.toBeInstanceOf(
+      RelayRoutingHostRemovedError
+    )
 
     expect(JSON.parse(storedHostsRaw)).toEqual([HOST_TWO])
+    expect(storedOverlayRaw).toBeNull()
     expect(secureStoreMock.setItemAsync).not.toHaveBeenCalled()
   })
 
@@ -705,7 +704,7 @@ describe('host-store list mutations', () => {
     expect(hosts.find((host) => host.id === HOST_ONE.id)?.name).toBe('Living Room Mac')
   })
 
-  it('does not share a host-list pass started before saveHost commits its token', async () => {
+  it('does not share a host-list pass started before savePairedHost commits its token', async () => {
     const newHost = {
       id: 'host-new',
       name: 'New Host',
@@ -736,7 +735,7 @@ describe('host-store list mutations', () => {
       return key.endsWith(HOST_ONE.id) || key.endsWith(HOST_TWO.id) ? `token-${key.at(-1)}` : null
     })
 
-    const save = saveHost(newHost)
+    const save = savePairedHost(newHost)
     await vi.waitFor(() => {
       expect(secureStoreMock.setItemAsync).toHaveBeenCalled()
     })
@@ -784,7 +783,7 @@ describe('host-store list mutations', () => {
     await vi.waitFor(() => {
       expect(secureStoreMock.getItemAsync).toHaveBeenCalled()
     })
-    await saveHost(newHost)
+    await savePairedHost(newHost)
     resolvePrewriteTokenRead('token-old')
     await parkedLoad
 
@@ -876,7 +875,7 @@ describe('host-store pairing save after an Android encryption rejection', () =>
       }
     )
 
-    await expect(saveHost(NEW_HOST)).resolves.toBeUndefined()
+    await expect(savePairedHost(NEW_HOST)).resolves.toBeUndefined()
 
     expect(written.get('orca.pairing.v1')).toBe('device-token')
     expect(JSON.parse(storedHostsRaw)).toEqual([
@@ -893,7 +892,7 @@ describe('host-store pairing save after an Android encryption rejection', () =>
   it('still surfaces the failure when no keystore alias can accept the token', async () => {
     secureStoreMock.setItemAsync.mockRejectedValue(ENCRYPT_REJECTION)
 
-    await expect(saveHost(NEW_HOST)).rejects.toBe(ENCRYPT_REJECTION)
+    await expect(savePairedHost(NEW_HOST)).rejects.toBe(ENCRYPT_REJECTION)
   })
 
   it('serves the rotated token to loadHosts so the saved host survives a relaunch', async () => {
@@ -906,7 +905,7 @@ describe('host-store pairing save after an Android encryption rejection', () =>
         written.set(options.keychainService, value)
       }
     )
-    await saveHost(NEW_HOST)
+    await savePairedHost(NEW_HOST)
     // Why: a fresh process has no token cache, so the host list has to come back off the rotated alias.
     resetHostStoreForTests()
     secureStoreMock.getItemAsync.mockImplementation(
diff --git a/mobile/src/transport/host-store.ts b/mobile/src/transport/host-store.ts
index 32f910cd27d6..f34b3866d691 100644
--- a/mobile/src/transport/host-store.ts
+++ b/mobile/src/transport/host-store.ts
@@ -1,3 +1,4 @@
+import type { MobileRelayEndpoint } from '../../../src/shared/mobile-relay-credential-contract'
 import { HostProfileSchema } from './types'
 import type { HostCatalogEntry, HostProfile, StoredHostProfile } from './types'
 import { getNextHostNameFromHosts } from './host-names'
@@ -13,10 +14,10 @@ import {
   scheduleHostCredentialCleanup
 } from './host-credential-cleanup'
 import {
-  loadMobileRelayHostOverlayState,
-  removeMobileRelayHostOverlay,
-  removeMobileRelayHostOverlays,
-  saveMobileRelayHostOverlay
+  loadMobileRelayHostRoutingState,
+  removeMobileRelayHostRouting,
+  removeMobileRelayHostRoutings,
+  saveMobileRelayHostRouting
 } from './mobile-relay-host-overlay-store'
 import { scheduleOrphanedMobileRelayCleanup } from './mobile-relay-orphan-cleanup'
 import {
@@ -63,7 +64,7 @@ async function doLoadHostListSnapshot(): Promise<hostListLoads.HostListSnapshot>
   if (!storedHosts) {
     return { catalog: [], profiles: [] }
   }
-  const overlayState = await loadMobileRelayHostOverlayState(
+  const overlayState = await loadMobileRelayHostRoutingState(
     new Set(storedHosts.map(({ id }) => id))
   )
   const orphanWriteRevisions = new Map(
@@ -77,7 +78,7 @@ async function doLoadHostListSnapshot(): Promise<hostListLoads.HostListSnapshot>
   })
   return joinHostCatalogCredentials({
     storedHosts,
-    overlays: overlayState.overlays,
+    relays: overlayState.relays,
     tokenCache,
     readToken: readHostDeviceToken,
     getRevision: hostListLoads.getHostListLoadRevision
@@ -140,7 +141,7 @@ function removeOrphanOverlayIfUnpaired(hostId: string): Promise<void> {
   return enqueueHostListMutation(async () => {
     const hosts = await readStoredHostProfilesForMutation()
     if (!hosts.some(({ id }) => id === hostId)) {
-      await removeMobileRelayHostOverlay(hostId)
+      await removeMobileRelayHostRouting(hostId)
     }
   })
 }
@@ -148,14 +149,28 @@ function removeOrphanOverlayIfUnpaired(hostId: string): Promise<void> {
 // The page's host-store sibling keeps its own no-op, so only the native store reaches persistence.
 export { updateHostDescriptor } from './host-descriptor-persistence'
 
-export class MobileRelayUpgradeHostRemovedError extends Error {}
+export class RelayRoutingHostRemovedError extends Error {}
 
-export const saveHost = (host: HostProfile): Promise<void> => persistHost(host, false)
-
-export const saveExistingHostRelayUpgrade = (host: HostProfile): Promise<void> =>
-  persistHost(host, true)
+/**
+ * Relay routing learned after pairing (re-resolution, rotation, direct upgrade). Routing only; the
+ * row and token belong to pairing and Edit Host.
+ */
+export async function setRelayRouting(hostId: string, relay: MobileRelayEndpoint): Promise<void> {
+  const wrote = await enqueueHostListMutation(async () => {
+    const hosts = await readStoredHostProfilesForMutation()
+    if (!hosts.some(({ id }) => id === hostId)) {
+      // Why: an in-flight relay learner must not resurrect a host the user removed.
+      throw new RelayRoutingHostRemovedError('mobile relay host was removed')
+    }
+    return saveMobileRelayHostRouting(hostId, relay)
+  })
+  if (wrote) {
+    hostListLoads.dropSharedHostListLoad()
+  }
+}
 
-async function persistHost(host: HostProfile, requireExisting: boolean): Promise<void> {
+/** Pairing only (a census fences the importers): it creates or re-pairs the whole host. */
+export async function savePairedHost(host: HostProfile): Promise<void> {
   const validated = HostProfileSchema.parse(host)
   const stored = toStoredHostProfile(validated)
   const duplicateHostIds = new Set<string>()
@@ -179,9 +194,6 @@ async function persistHost(host: HostProfile, requireExisting: boolean): Promise
           .map((candidate) =>
             candidate.id === stored.id ? mergeHostNameIdentity(stored, candidate) : candidate
           )
-      } else if (requireExisting) {
-        // Why: an in-flight relay upgrade must not resurrect a host the user removed.
-        throw new MobileRelayUpgradeHostRemovedError('mobile relay upgrade host was removed')
       } else {
         next = [...hosts.filter(({ id }) => !duplicateHostIds.has(id)), stored]
       }
@@ -217,23 +229,17 @@ async function persistHost(host: HostProfile, requireExisting: boolean): Promise
   }
   // Why: a later removal owns its cleanup intent; cancel only while this publication remains authoritative.
   cancelCleanupForStoredHost(stored.id)
-  if (validated.endpoints) {
-    await saveMobileRelayHostOverlay({
-      v: 2,
-      hostId: stored.id,
-      endpoints: validated.endpoints,
-      relayHostId: validated.relayHostId,
-      relay: validated.relay
-    })
+  if (validated.relay) {
+    await saveMobileRelayHostRouting(stored.id, validated.relay)
     hostListLoads.dropSharedHostListLoad()
   }
   const overlayRemovalIds = [...duplicateHostIds]
-  if (!validated.endpoints && updatedExistingHost) {
+  if (!validated.relay && updatedExistingHost) {
     overlayRemovalIds.push(stored.id)
   }
   if (overlayRemovalIds.length > 0) {
     // Why: reusing an id for direct-only re-pairing must not retain routing metadata from the previous transport state.
-    await removeMobileRelayHostOverlays(overlayRemovalIds)
+    await removeMobileRelayHostRoutings(overlayRemovalIds)
     hostListLoads.dropSharedHostListLoad()
   }
   for (const duplicateHostId of duplicateHostIds) {
@@ -265,7 +271,7 @@ export async function removeHost(hostId: string): Promise<void> {
   }
   tokenCache.delete(hostId)
   try {
-    await removeMobileRelayHostOverlay(hostId)
+    await removeMobileRelayHostRouting(hostId)
     hostListLoads.dropSharedHostListLoad()
   } catch {
     // Base removal is authoritative; a retained overlay can't resurrect the host and is cleaned on a later retry.
diff --git a/mobile/src/transport/host-store.web.ts b/mobile/src/transport/host-store.web.ts
index 8c9d54e588ce..fdadca91b86c 100644
--- a/mobile/src/transport/host-store.web.ts
+++ b/mobile/src/transport/host-store.web.ts
@@ -3,6 +3,7 @@
 // this host up paints "Host not found" over the host the shell just opened it for. What crosses
 // instead is `init.host`: the profile the screens read, without the credential the bridge carries.
 import { readPageHostProfile } from '../mobile-web-shell/bridge/page-host-profile'
+import type { MobileRelayEndpoint } from '../../../src/shared/mobile-relay-credential-contract'
 import type { HostCatalogEntry, HostProfile } from './types'
 
 /**
@@ -25,8 +26,10 @@ export const loadHostCatalog = (): Promise<HostCatalogEntry[]> =>
   )
 
 /** Pairing happened natively before this document existed, and the page never re-does it. */
-export const saveHost = (_host: HostProfile): Promise<void> => Promise.resolve()
-export const saveExistingHostRelayUpgrade = (_host: HostProfile): Promise<void> => Promise.resolve()
+export const savePairedHost = (_host: HostProfile): Promise<void> => Promise.resolve()
+/** Relay routing belongs to the native endpoint lifecycle, which the page does not run. */
+export const setRelayRouting = (_hostId: string, _relay: MobileRelayEndpoint): Promise<void> =>
+  Promise.resolve()
 export const removeHost = (_hostId: string): Promise<void> => Promise.resolve()
 
 /** A native write the page drops: recency orders the app's host list, which the page does not show. */
diff --git a/mobile/src/transport/mobile-direct-endpoint-probe.test.ts b/mobile/src/transport/mobile-direct-endpoint-probe.test.ts
index 4049b4b073ba..e225d02de8a5 100644
--- a/mobile/src/transport/mobile-direct-endpoint-probe.test.ts
+++ b/mobile/src/transport/mobile-direct-endpoint-probe.test.ts
@@ -1,7 +1,10 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import type { RpcClient } from './rpc-client'
-import { openAuthenticatedDirectEndpoint } from './mobile-direct-endpoint-probe'
-import type { ConnectionState, HostProfile, RpcResponse } from './types'
+import {
+  directPathForEndpoint,
+  openAuthenticatedDirectEndpoint
+} from './mobile-direct-endpoint-probe'
+import type { ConnectionState, RpcResponse } from './types'
 
 class FakeClient implements RpcClient {
   readonly sendRequest = vi.fn(async (): Promise<RpcResponse> => ({
@@ -34,42 +37,17 @@ class FakeClient implements RpcClient {
   }
 }
 
-const host: HostProfile = {
-  id: 'host-1',
-  name: 'Blue Whale',
-  endpoint: 'ws://192.168.1.10:6768',
-  deviceToken: 'device-token',
-  publicKeyB64: 'A'.repeat(44),
-  lastConnected: 1,
-  endpoints: [
-    { id: 'lan', kind: 'lan', url: 'ws://192.168.1.10:6768' },
-    { id: 'tailscale', kind: 'tailscale', url: 'ws://100.64.0.2:6768' }
-  ]
-}
-
 describe('mobile direct endpoint probe', () => {
   beforeEach(() => vi.useFakeTimers())
   afterEach(() => vi.useRealTimers())
 
-  it('uses the first authenticated candidate without waiting for a stale primary', async () => {
-    const clients = new Map<string, FakeClient>()
-    const openDirect = vi.fn((endpoint: string) => {
-      const client = new FakeClient('connecting')
-      clients.set(endpoint, client)
-      if (endpoint.includes('100.64.0.2')) {
-        setTimeout(() => client.publishState('connected'), 100)
-      }
-      return client
-    })
-
-    const probing = openAuthenticatedDirectEndpoint(host, openDirect, 12_000)
-    await vi.advanceTimersByTimeAsync(100)
-    const result = await probing
-
-    expect(result?.path).toBe('tailscale')
-    expect(openDirect).toHaveBeenCalledTimes(2)
-    expect(clients.get(host.endpoint)?.close).toHaveBeenCalledOnce()
-    expect(result?.client.close).not.toHaveBeenCalled()
+  it('classifies a tailnet endpoint apart from a LAN one', () => {
+    expect(directPathForEndpoint('ws://100.64.0.2:6768')).toBe('tailscale')
+    expect(directPathForEndpoint('wss://desk.tail1234.ts.net:6768')).toBe('tailscale')
+    expect(directPathForEndpoint('ws://[fd7a:115c:a1e0::1]:6768')).toBe('tailscale')
+    // 100.0.0.0/10 is not the tailnet's 100.64.0.0/10.
+    expect(directPathForEndpoint('ws://100.12.0.2:6768')).toBe('lan')
+    expect(directPathForEndpoint('ws://192.168.1.10:6768')).toBe('lan')
   })
 
   it('fails a whole dead LAN in seconds instead of holding the 12s bound', async () => {
@@ -84,15 +62,13 @@ describe('mobile direct endpoint probe', () => {
       return client
     })
 
-    const probing = openAuthenticatedDirectEndpoint(host, openDirect, 12_000)
+    const probing = openAuthenticatedDirectEndpoint(openDirect, 12_000)
     await vi.advanceTimersByTimeAsync(20)
     await vi.advanceTimersByTimeAsync(2_000)
     await expect(probing).resolves.toBeNull()
 
-    expect(clients).toHaveLength(2)
-    for (const client of clients) {
-      expect(client.close).toHaveBeenCalledOnce()
-    }
+    expect(clients).toHaveLength(1)
+    expect(clients[0]!.close).toHaveBeenCalledOnce()
     // No 12s timer is left behind to fire into a settled probe.
     expect(vi.getTimerCount()).toBe(0)
   })
@@ -100,41 +76,37 @@ describe('mobile direct endpoint probe', () => {
   it('rides out one access-point flap that the first redial recovers', async () => {
     // 'reconnecting' is published on any socket close, so a single RST on the first
     // dial must not book a direct failure and its 60s cooldown.
-    const openDirect = vi.fn((endpoint: string) => {
+    const openDirect = vi.fn(() => {
       const client = new FakeClient('connecting')
-      if (endpoint.includes('100.64.0.2')) {
-        setTimeout(() => client.publishState('reconnecting'), 20)
-        setTimeout(() => client.publishState('connected'), 600)
-      }
+      setTimeout(() => client.publishState('reconnecting'), 20)
+      setTimeout(() => client.publishState('connected'), 600)
       return client
     })
 
-    const probing = openAuthenticatedDirectEndpoint(host, openDirect, 12_000)
+    const probing = openAuthenticatedDirectEndpoint(openDirect, 12_000)
     await vi.advanceTimersByTimeAsync(600)
     const result = await probing
 
-    expect(result?.path).toBe('tailscale')
-    expect(result?.client.close).not.toHaveBeenCalled()
+    expect(result).not.toBeNull()
+    expect(result?.close).not.toHaveBeenCalled()
   })
 
   it('extends the grace once when the redial reaches a handshake', async () => {
     // The redial fires at 500ms, but 'connected' waits on the Noise handshake and a
     // capability RPC, so real work needs more than one grace window.
-    const openDirect = vi.fn((endpoint: string) => {
+    const openDirect = vi.fn(() => {
       const client = new FakeClient('connecting')
-      if (endpoint.includes('100.64.0.2')) {
-        setTimeout(() => client.publishState('reconnecting'), 20)
-        setTimeout(() => client.publishState('handshaking'), 1_500)
-        // Past the first grace window: only the re-arm keeps this probe alive.
-        setTimeout(() => client.publishState('connected'), 3_000)
-      }
+      setTimeout(() => client.publishState('reconnecting'), 20)
+      setTimeout(() => client.publishState('handshaking'), 1_500)
+      // Past the first grace window: only the re-arm keeps this probe alive.
+      setTimeout(() => client.publishState('connected'), 3_000)
       return client
     })
 
-    const probing = openAuthenticatedDirectEndpoint(host, openDirect, 12_000)
+    const probing = openAuthenticatedDirectEndpoint(openDirect, 12_000)
     await vi.advanceTimersByTimeAsync(3_000)
 
-    expect((await probing)?.path).toBe('tailscale')
+    expect(await probing).not.toBeNull()
   })
 
   it('fails a handshake that stalls, one grace after it started', async () => {
@@ -147,7 +119,7 @@ describe('mobile direct endpoint probe', () => {
       return client
     })
 
-    const probing = openAuthenticatedDirectEndpoint(host, openDirect, 12_000)
+    const probing = openAuthenticatedDirectEndpoint(openDirect, 12_000)
     await vi.advanceTimersByTimeAsync(3_499)
     let settled = false
     void probing.then(() => {
@@ -168,7 +140,7 @@ describe('mobile direct endpoint probe', () => {
       return client
     })
 
-    const probing = openAuthenticatedDirectEndpoint(host, openDirect, 12_000)
+    const probing = openAuthenticatedDirectEndpoint(openDirect, 12_000)
     await vi.advanceTimersByTimeAsync(2_019)
     let settled = false
     void probing.then(() => {
diff --git a/mobile/src/transport/mobile-direct-endpoint-probe.ts b/mobile/src/transport/mobile-direct-endpoint-probe.ts
index 038f73b93b89..a586d45eb0ae 100644
--- a/mobile/src/transport/mobile-direct-endpoint-probe.ts
+++ b/mobile/src/transport/mobile-direct-endpoint-probe.ts
@@ -1,28 +1,9 @@
+import { isTailscaleEndpoint } from '../../../src/shared/remote-runtime-tailscale-hint'
 import type { RpcClient } from './rpc-client'
 import type { MobileConnectionPath } from './stable-logical-rpc-client'
-import type { HostProfile } from './types'
 
-function directEndpointUrls(host: HostProfile): string[] {
-  const endpoints =
-    host.endpoints?.filter(({ kind }) => kind !== 'relay').map(({ url }) => url) ?? []
-  return [...new Set([host.endpoint, ...endpoints])]
-}
-
-export function directPathForEndpoint(
-  host: HostProfile,
-  endpoint: string
-): Exclude<MobileConnectionPath, 'relay'> {
-  const configured = host.endpoints?.find((candidate) => candidate.url === endpoint)
-  if (configured?.kind === 'tailscale') {
-    return 'tailscale'
-  }
-  try {
-    const hostname = new URL(endpoint).hostname
-    if (hostname.endsWith('.ts.net') || /^100\.(?:\d{1,3}\.){2}\d{1,3}$/.test(hostname)) {
-      return 'tailscale'
-    }
-  } catch {}
-  return 'lan'
+export function directPathForEndpoint(endpoint: string): Exclude<MobileConnectionPath, 'relay'> {
+  return isTailscaleEndpoint(endpoint) ? 'tailscale' : 'lan'
 }
 
 // Why: 'reconnecting' is published on any socket close, so it cannot tell a dead
@@ -98,62 +79,28 @@ function waitForAuthenticatedSession(
 }
 
 export async function openAuthenticatedDirectEndpoint(
-  host: HostProfile,
-  openDirect: (endpoint: string) => RpcClient,
+  openDirect: () => RpcClient,
   timeoutMs: number,
   signal?: AbortSignal
-): Promise<{ client: RpcClient; path: Exclude<MobileConnectionPath, 'relay'> } | null> {
+): Promise<RpcClient | null> {
   if (signal?.aborted) {
     return null
   }
-  const endpoints = directEndpointUrls(host)
-  return await new Promise((resolve) => {
-    const clients = new Set<RpcClient>()
-    let remaining = endpoints.length
-    let settled = false
-    const rejectCandidate = (): void => {
-      remaining--
-      if (!settled && remaining === 0) {
-        settled = true
-        resolve(null)
-      }
-    }
-    for (const endpoint of endpoints) {
-      let client: RpcClient
-      try {
-        client = openDirect(endpoint)
-      } catch {
-        rejectCandidate()
-        continue
-      }
-      clients.add(client)
-      void waitForAuthenticatedSession(client, timeoutMs, signal).then(
-        () => {
-          if (signal?.aborted) {
-            client.close()
-            rejectCandidate()
-            return
-          }
-          if (settled) {
-            client.close()
-            return
-          }
-          settled = true
-          for (const candidate of clients) {
-            if (candidate !== client) {
-              candidate.close()
-            }
-          }
-          resolve({ client, path: directPathForEndpoint(host, endpoint) })
-        },
-        () => {
-          if (settled) {
-            return
-          }
-          client.close()
-          rejectCandidate()
-        }
-      )
-    }
-  })
+  let client: RpcClient
+  try {
+    client = openDirect()
+  } catch {
+    return null
+  }
+  try {
+    await waitForAuthenticatedSession(client, timeoutMs, signal)
+  } catch {
+    client.close()
+    return null
+  }
+  if (signal?.aborted) {
+    client.close()
+    return null
+  }
+  return client
 }
diff --git a/mobile/src/transport/mobile-direct-probe-stop-budget.test.ts b/mobile/src/transport/mobile-direct-probe-stop-budget.test.ts
index 535790ed480e..409863bb9927 100644
--- a/mobile/src/transport/mobile-direct-probe-stop-budget.test.ts
+++ b/mobile/src/transport/mobile-direct-probe-stop-budget.test.ts
@@ -3,7 +3,8 @@ import {
   dependencies,
   FakeLogicalClient,
   FakeSession,
-  host
+  host,
+  relay
 } from './mobile-endpoint-supervisor-test-fakes'
 import { MobileEndpointHysteresis } from './mobile-endpoint-hysteresis'
 import { createStableLogicalRpcClient } from './stable-logical-rpc-client'
@@ -17,7 +18,7 @@ it('closes in-flight candidates and clears their timeout when the owner stops',
     const candidate = new FakeSession('connecting')
     const logical = new FakeLogicalClient('connected', 'relay')
     const deps = dependencies({ openDirect: vi.fn(() => candidate) })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
     await supervisor.start()
     await vi.advanceTimersByTimeAsync(15_000)
     expect(deps.openDirect).toHaveBeenCalledOnce()
@@ -42,7 +43,7 @@ it('closes an authenticated candidate when stop races its completion', async ()
     const candidate = new FakeSession('connecting')
     const logical = new FakeLogicalClient('connected', 'relay')
     const deps = dependencies({ openDirect: vi.fn(() => candidate) })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
     await supervisor.start()
     await vi.advanceTimersByTimeAsync(15_000)
     candidate.publishState('connected')
@@ -63,7 +64,7 @@ it('preserves an in-flight probe across a transient background pause', async ()
     const candidate = new FakeSession('connecting')
     const logical = new FakeLogicalClient('connected', 'relay')
     const deps = dependencies({ openDirect: vi.fn(() => candidate) })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
     await supervisor.start()
     await vi.advanceTimersByTimeAsync(15_000)
     supervisor.setForeground(false)
@@ -79,54 +80,14 @@ it('preserves an in-flight probe across a transient background pause', async ()
   }
 })
 
-it('releases every candidate when multiple endpoint probes are pending', async () => {
-  vi.useFakeTimers()
-  try {
-    const candidates: FakeSession[] = []
-    const logical = new FakeLogicalClient('connected', 'relay')
-    const deps = dependencies({
-      openDirect: vi.fn(() => {
-        const candidate = new FakeSession('connecting')
-        candidates.push(candidate)
-        return candidate
-      })
-    })
-    const supervisor = new MobileEndpointSupervisor(
-      logical,
-      {
-        ...host,
-        endpoints: [{ id: 'alternate', kind: 'tailscale', url: 'ws://100.64.0.2:6768' }]
-      },
-      deps
-    )
-    await supervisor.start()
-    await vi.advanceTimersByTimeAsync(15_000)
-    expect(candidates).toHaveLength(2)
-    supervisor.stop()
-    await vi.advanceTimersByTimeAsync(0)
-    expect(vi.getTimerCount()).toBe(0)
-    for (const candidate of candidates) {
-      expect(candidate.close).toHaveBeenCalledOnce()
-      candidate.publishState('connected')
-    }
-    await vi.advanceTimersByTimeAsync(60_000)
-    expect(logical.migrateTo).not.toHaveBeenCalled()
-    expect(deps.openDirect).toHaveBeenCalledTimes(2)
-    expect(vi.getTimerCount()).toBe(0)
-  } finally {
-    vi.restoreAllMocks()
-    vi.useRealTimers()
-  }
-})
-
 it.each([false, true])(
   'fences migration finishing after stop (already swapped: %s)',
   async (alreadySwapped) => {
     vi.useFakeTimers()
     try {
       const recordedMigration = vi.spyOn(MobileEndpointHysteresis.prototype, 'recordMigration')
-      const relay = new FakeSession('connected')
-      const logical = createStableLogicalRpcClient(relay, 'relay')
+      const relaySession = new FakeSession('connected')
+      const logical = createStableLogicalRpcClient(relaySession, 'relay')
       const candidates: FakeSession[] = []
       const deps = dependencies({
         openDirect: vi.fn(() => {
@@ -135,7 +96,7 @@ it.each([false, true])(
           return candidate
         })
       })
-      const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+      const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
       const migrate = logical.migrateTo.bind(logical)
       let release!: () => void
       const pending = new Promise<void>((resolve) => {
@@ -153,7 +114,7 @@ it.each([false, true])(
       await supervisor.start()
       await vi.advanceTimersByTimeAsync(60_000)
       expect(migration).toHaveBeenCalledOnce()
-      const requestsBeforeStop = relay.sendRequest.mock.calls.length
+      const requestsBeforeStop = relaySession.sendRequest.mock.calls.length
       const candidateRequestsBeforeStop = candidates[3].sendRequest.mock.calls.length
       const migrationsBeforeStop = recordedMigration.mock.calls.length
       supervisor.stop()
@@ -161,7 +122,7 @@ it.each([false, true])(
       await vi.advanceTimersByTimeAsync(0)
       expect(logical.getActivePath()).toBe(alreadySwapped ? 'lan' : 'relay')
       expect(logical.getGeneration()).toBe(alreadySwapped ? 2 : 1)
-      expect(relay.sendRequest).toHaveBeenCalledTimes(requestsBeforeStop)
+      expect(relaySession.sendRequest).toHaveBeenCalledTimes(requestsBeforeStop)
       expect(candidates[3].sendRequest).toHaveBeenCalledTimes(candidateRequestsBeforeStop)
       expect(recordedMigration).toHaveBeenCalledTimes(migrationsBeforeStop)
       expect(candidates[3].close).toHaveBeenCalledTimes(alreadySwapped ? 0 : 1)
diff --git a/mobile/src/transport/mobile-direct-return-probe.ts b/mobile/src/transport/mobile-direct-return-probe.ts
index c3b3464a3ba1..3552805f7ee9 100644
--- a/mobile/src/transport/mobile-direct-return-probe.ts
+++ b/mobile/src/transport/mobile-direct-return-probe.ts
@@ -2,7 +2,6 @@ import { openAuthenticatedDirectEndpoint } from './mobile-direct-endpoint-probe'
 import type { MobileEndpointHysteresis } from './mobile-endpoint-hysteresis'
 import type { RpcClient } from './rpc-client'
 import type { ScheduleTimer } from './timer-scheduler'
-import type { HostProfile } from './types'
 import type { MobileConnectionPath } from './stable-logical-rpc-client'
 
 const DIRECT_PROBE_INTERVAL_MS = 15_000
@@ -20,11 +19,11 @@ export class DirectReturnProbe {
       now: () => number
       setTimer: ScheduleTimer
       clearTimer: typeof clearTimeout
-      openDirect: (endpoint: string) => RpcClient
+      openDirect: () => RpcClient
+      directPath: Exclude<MobileConnectionPath, 'relay'>
     },
     private readonly hooks: {
       hysteresis: MobileEndpointHysteresis
-      host: () => HostProfile
       canSchedule: () => boolean
       canAttempt: () => boolean
       beginOperation: () => void
@@ -75,7 +74,6 @@ export class DirectReturnProbe {
     let successful: Awaited<ReturnType<typeof openAuthenticatedDirectEndpoint>> = null
     try {
       successful = await openAuthenticatedDirectEndpoint(
-        this.hooks.host(),
         this.deps.openDirect,
         12_000,
         controller.signal
@@ -88,14 +86,14 @@ export class DirectReturnProbe {
         return
       }
       if (!this.hooks.hysteresis.recordDirectSuccess(this.deps.now())) {
-        successful.client.close()
+        successful.close()
         return
       }
       const candidate = successful
       // Migration owns the candidate, including closing it if cutover is canceled.
       successful = null
       try {
-        await this.hooks.migrate(candidate.client, candidate.path, () => this.stopped)
+        await this.hooks.migrate(candidate, this.deps.directPath, () => this.stopped)
       } catch (error) {
         if (this.stopped) {
           return
@@ -109,7 +107,7 @@ export class DirectReturnProbe {
       await this.hooks.onDirectMigrated()
     } finally {
       this.activeProbe = null
-      successful?.client.close()
+      successful?.close()
       // Why: a relay drop or backoff timer can arrive while the probe owns the
       // operation mutex; afterProbe releases it and replays deferred recovery.
       this.hooks.afterProbe()
diff --git a/mobile/src/transport/mobile-endpoint-lifecycle-host-edit.test.ts b/mobile/src/transport/mobile-endpoint-lifecycle-host-edit.test.ts
new file mode 100644
index 000000000000..b676e979188a
--- /dev/null
+++ b/mobile/src/transport/mobile-endpoint-lifecycle-host-edit.test.ts
@@ -0,0 +1,244 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type { MobileRelayEndpoint } from '../../../src/shared/mobile-relay-credential-contract'
+
+const storage = vi.hoisted(() => new Map<string, string>())
+const asyncStorageMock = vi.hoisted(() => ({
+  getItem: vi.fn(async (key: string) => storage.get(key) ?? null),
+  setItem: vi.fn(async (key: string, value: string) => {
+    storage.set(key, value)
+  }),
+  removeItem: vi.fn(async (key: string) => {
+    storage.delete(key)
+  })
+}))
+const secureStoreMock = vi.hoisted(() => ({
+  WHEN_UNLOCKED_THIS_DEVICE_ONLY: 'WHEN_UNLOCKED_THIS_DEVICE_ONLY',
+  getItemAsync: vi.fn(async () => 'device-token'),
+  setItemAsync: vi.fn(async () => {}),
+  deleteItemAsync: vi.fn(async () => {})
+}))
+const connectMock = vi.hoisted(() => vi.fn())
+const openRelayMock = vi.hoisted(() => vi.fn())
+const resolveRelayMock = vi.hoisted(() => vi.fn())
+const readBundleMock = vi.hoisted(() => vi.fn())
+const writeBundleMock = vi.hoisted(() => vi.fn(async (..._args: unknown[]) => {}))
+
+vi.mock('@react-native-async-storage/async-storage', () => ({ default: asyncStorageMock }))
+vi.mock('react-native', () => ({ Platform: { OS: 'ios' } }))
+vi.mock('expo-crypto', () => ({ getRandomBytes: (length: number) => new Uint8Array(length) }))
+vi.mock('expo-secure-store', () => secureStoreMock)
+vi.mock('./rpc-client', async (importOriginal) => ({
+  ...(await importOriginal<typeof import('./rpc-client')>()),
+  connect: (...args: unknown[]) => connectMock(...args)
+}))
+vi.mock('./mobile-relay-rpc-session', async (importOriginal) => ({
+  ...(await importOriginal<typeof import('./mobile-relay-rpc-session')>()),
+  connectMobileRelayRpcSession: (...args: unknown[]) => openRelayMock(...args)
+}))
+vi.mock('./mobile-relay-resume-director', async (importOriginal) => ({
+  ...(await importOriginal<typeof import('./mobile-relay-resume-director')>()),
+  resolveMobileRelayEndpoint: (...args: unknown[]) => resolveRelayMock(...args)
+}))
+vi.mock('./mobile-relay-credential-bundle', async (importOriginal) => ({
+  ...(await importOriginal<typeof import('./mobile-relay-credential-bundle')>()),
+  readMobileRelayCredentialBundle: (...args: unknown[]) => readBundleMock(...args),
+  writeMobileRelayCredentialBundle: (...args: unknown[]) => writeBundleMock(...args)
+}))
+
+import { loadHosts, resetHostStoreForTests, updateHostNameAndEndpoint } from './host-store'
+import { startMobileEndpointLifecycle } from './mobile-endpoint-lifecycle'
+import {
+  bundle,
+  FakeLogicalClient,
+  FakeRelaySession,
+  FakeSession,
+  host,
+  mockCredentialRotation,
+  relay
+} from './mobile-endpoint-supervisor-test-fakes'
+import { RelayOuterError } from './mobile-relay-e2ee-link'
+import { resetMobileRelayHostOverlayStoreForTests } from './mobile-relay-host-overlay-store'
+import { createMobileRelayDirectUpgradeJournal } from './mobile-relay-direct-upgrade-journal'
+import { upgradeDirectMobileRelay } from './mobile-relay-direct-upgrade'
+
+const OVERLAY_KEY = 'orca:mobile-relay:host-overlays:v2'
+const EDITED_ENDPOINT = 'ws://192.168.1.20:6768'
+const resolved = { ...relay, cellUrl: 'https://relay-c2.onorca.dev', assignmentEpoch: 8 }
+
+// Starts a relay host whose first dial hits the wrong cell, leaving director resolution pending.
+async function startWithPendingResolution(): Promise<{
+  logical: FakeLogicalClient
+  lifecycle: ReturnType<typeof startMobileEndpointLifecycle>
+  settle: (value: MobileRelayEndpoint) => void
+}> {
+  let settle: (value: MobileRelayEndpoint) => void = () => {}
+  resolveRelayMock.mockReturnValue(
+    new Promise<MobileRelayEndpoint>((resolve) => {
+      settle = resolve
+    })
+  )
+  openRelayMock
+    .mockReturnValueOnce(new FakeRelaySession('disconnected', new RelayOuterError(4409)))
+    .mockReturnValue(new FakeRelaySession('connected'))
+  const logical = new FakeLogicalClient('disconnected', 'lan')
+  const lifecycle = startMobileEndpointLifecycle(logical, host, () => {})
+  await vi.waitFor(() => expect(resolveRelayMock).toHaveBeenCalledOnce())
+  return { logical, lifecycle, settle: (value) => settle(value) }
+}
+
+function overlayWrites(): number {
+  return asyncStorageMock.setItem.mock.calls.filter(([key]) => key === OVERLAY_KEY).length
+}
+
+async function expectEditKept(expectedRelay: MobileRelayEndpoint): Promise<void> {
+  const [saved] = await loadHosts()
+  expect(saved).toMatchObject({
+    name: 'Renamed',
+    endpoint: EDITED_ENDPOINT,
+    deviceToken: 'device-token',
+    relay: expectedRelay
+  })
+  expect(secureStoreMock.setItemAsync).not.toHaveBeenCalled()
+}
+
+describe('mobile endpoint lifecycle host edits', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    storage.clear()
+    resetHostStoreForTests()
+    resetMobileRelayHostOverlayStoreForTests()
+    const { id, name, endpoint, publicKeyB64, lastConnected } = host
+    storage.set('orca:hosts', JSON.stringify([{ id, name, endpoint, publicKeyB64, lastConnected }]))
+    storage.set(
+      OVERLAY_KEY,
+      JSON.stringify([
+        {
+          v: 2,
+          hostId: id,
+          endpoints: [
+            { id: 'direct-primary', kind: 'lan', url: endpoint },
+            { id: 'relay-primary', kind: 'relay', url: 'wss://relay-c1.onorca.dev/v1/connect/id' }
+          ],
+          relayHostId: relay.relayHostId,
+          relay
+        }
+      ])
+    )
+    connectMock.mockImplementation(() => new FakeSession('disconnected'))
+    readBundleMock.mockResolvedValue(bundle)
+  })
+
+  it('keeps an edit made while relay resolution was pending', async () => {
+    const { lifecycle, settle } = await startWithPendingResolution()
+
+    await updateHostNameAndEndpoint(host.id, { personalName: 'Renamed', endpoint: EDITED_ENDPOINT })
+    settle(resolved)
+    await vi.waitFor(() => expect(openRelayMock).toHaveBeenCalledTimes(2))
+
+    await expectEditKept(resolved)
+    lifecycle.stop()
+  })
+
+  it('does not persist a resolution that settles after stop', async () => {
+    const { logical, lifecycle, settle } = await startWithPendingResolution()
+    await updateHostNameAndEndpoint(host.id, { personalName: 'Renamed', endpoint: EDITED_ENDPOINT })
+    const writesBeforeSettle = asyncStorageMock.setItem.mock.calls.length
+
+    lifecycle.stop()
+    const recoveryPathCalls = logical.setRecoveryPath.mock.calls.length
+    settle(resolved)
+    // The withdrawn dial clears the recovery path only after any persistence has run.
+    await vi.waitFor(() =>
+      expect(logical.setRecoveryPath).toHaveBeenCalledTimes(recoveryPathCalls + 1)
+    )
+
+    expect(asyncStorageMock.setItem).toHaveBeenCalledTimes(writesBeforeSettle)
+    await expectEditKept(relay)
+    expect(openRelayMock).toHaveBeenCalledOnce()
+  })
+
+  it('keeps an edit made before a credential rotation publishes its relay', async () => {
+    readBundleMock.mockResolvedValue({
+      ...bundle,
+      current: { ...bundle.current, expiresAt: Date.now() + 60_000 }
+    })
+    const logical = new FakeLogicalClient('connected', 'lan')
+    mockCredentialRotation(logical)
+    const lifecycle = startMobileEndpointLifecycle(logical, host, () => {})
+    await updateHostNameAndEndpoint(host.id, { personalName: 'Renamed', endpoint: EDITED_ENDPOINT })
+
+    logical.publishState('connected')
+    await vi.waitFor(() => expect(overlayWrites()).toBe(1))
+
+    await expectEditKept(relay)
+    lifecycle.stop()
+  })
+
+  it('does not persist relay routing from a rotation that finishes after stop', async () => {
+    readBundleMock.mockResolvedValue({
+      ...bundle,
+      current: { ...bundle.current, expiresAt: Date.now() + 60_000 }
+    })
+    let finishCredentialWrite: () => void = () => {}
+    writeBundleMock.mockResolvedValueOnce().mockReturnValueOnce(
+      new Promise<void>((resolve) => {
+        finishCredentialWrite = resolve
+      })
+    )
+    const logical = new FakeLogicalClient('connected', 'lan')
+    mockCredentialRotation(logical)
+    const lifecycle = startMobileEndpointLifecycle(logical, host, () => {})
+    await updateHostNameAndEndpoint(host.id, { personalName: 'Renamed', endpoint: EDITED_ENDPOINT })
+
+    logical.publishState('connected')
+    await vi.waitFor(() => expect(writeBundleMock).toHaveBeenCalledTimes(2))
+    lifecycle.stop()
+    finishCredentialWrite()
+    await new Promise((resolve) => setTimeout(resolve, 0))
+
+    // The rotated bundle itself stays durable; only the stale relay routing write is skipped.
+    expect(writeBundleMock).toHaveBeenCalledTimes(2)
+    expect(overlayWrites()).toBe(0)
+    await expectEditKept(relay)
+  })
+
+  it('keeps an edit made while a direct-only host was being upgraded to relay', async () => {
+    storage.set(OVERLAY_KEY, '[]')
+    const { relay: _relay, ...directHost } = host
+    const journal = createMobileRelayDirectUpgradeJournal(host.id, (length) =>
+      new Uint8Array(length).fill(3)
+    )
+    const installed = {
+      v: 1,
+      reqId: journal.reqId,
+      authorizationMode: 'authenticated-direct',
+      currentVersion: 1,
+      resumeExpiresAt: 9_999_999
+    }
+    const client = new FakeSession('connected')
+    client.sendRequest.mockResolvedValue({
+      id: 'rpc',
+      ok: true,
+      result: {
+        v: 1,
+        relay,
+        installStatus: { v: 1, reqId: journal.reqId, state: 'committed', result: installed }
+      },
+      _meta: { runtimeId: 'runtime-1' }
+    })
+    await updateHostNameAndEndpoint(host.id, { personalName: 'Renamed', endpoint: EDITED_ENDPOINT })
+
+    // `directHost` is the controller's pre-edit snapshot; only the default routing writer runs.
+    await upgradeDirectMobileRelay({
+      client,
+      host: directHost,
+      dependencies: {
+        readJournal: async () => journal,
+        clearJournal: async () => {},
+        writeBundle: async () => {}
+      }
+    })
+
+    await expectEditKept(relay)
+  })
+})
diff --git a/mobile/src/transport/mobile-endpoint-lifecycle.ts b/mobile/src/transport/mobile-endpoint-lifecycle.ts
index b7cab59c49ad..3f727d4e7311 100644
--- a/mobile/src/transport/mobile-endpoint-lifecycle.ts
+++ b/mobile/src/transport/mobile-endpoint-lifecycle.ts
@@ -1,5 +1,6 @@
 import * as ExpoCrypto from 'expo-crypto'
 import type { ConnectionLogSink, ForegroundNudgeReason, HostProfile } from './types'
+import type { MobileRelayEndpoint } from '../../../src/shared/mobile-relay-credential-contract'
 import { connect } from './rpc-client'
 import { MobileEndpointSupervisor } from './mobile-endpoint-supervisor'
 import { connectMobileRelayRpcSession } from './mobile-relay-rpc-session'
@@ -8,8 +9,9 @@ import {
   readMobileRelayCredentialBundle,
   writeMobileRelayCredentialBundle
 } from './mobile-relay-credential-bundle'
-import { saveHost } from './host-store'
+import { setRelayRouting } from './host-store'
 import { upgradeDirectMobileRelay } from './mobile-relay-direct-upgrade'
+import { directPathForEndpoint } from './mobile-direct-endpoint-probe'
 import { MobileRelayDirectUpgradeController } from './mobile-relay-direct-upgrade-controller'
 import { defaultCancelTimer, defaultScheduleTimer } from './timer-scheduler'
 import type { StableLogicalRpcClient } from './stable-logical-rpc-client'
@@ -33,11 +35,11 @@ export function startMobileEndpointLifecycle(
   let foreground = true
   let owner: EndpointOwner
 
-  const startSupervisor = async (host: HostProfile): Promise<void> => {
+  const startSupervisor = async (relay: MobileRelayEndpoint): Promise<void> => {
     if (stopped) {
       return
     }
-    const supervisor = createSupervisor(logical, host, onLog)
+    const supervisor = createSupervisor(logical, initialHost, relay, onLog)
     owner.stop()
     owner = supervisor
     supervisor.setForeground(foreground)
@@ -45,7 +47,7 @@ export function startMobileEndpointLifecycle(
   }
 
   if (initialHost.relay) {
-    owner = createSupervisor(logical, initialHost, onLog)
+    owner = createSupervisor(logical, initialHost, initialHost.relay, onLog)
     void owner.start()
   } else {
     owner = new MobileRelayDirectUpgradeController(logical, initialHost, {
@@ -55,7 +57,7 @@ export function startMobileEndpointLifecycle(
           host,
           dependencies: { randomBytes: ExpoCrypto.getRandomBytes }
         }),
-      onUpgraded: ({ host }) => startSupervisor(host)
+      onUpgraded: ({ relay }) => startSupervisor(relay)
     })
     void owner.start()
   }
@@ -83,10 +85,12 @@ export function startMobileEndpointLifecycle(
 function createSupervisor(
   logical: StableLogicalRpcClient,
   host: HostProfile,
+  relay: MobileRelayEndpoint,
   onLog: ConnectionLogSink
 ): MobileEndpointSupervisor {
-  return new MobileEndpointSupervisor(logical, host, {
-    openDirect: (endpoint) => connect(endpoint, host.deviceToken, host.publicKeyB64, { onLog }),
+  return new MobileEndpointSupervisor(logical, host.id, relay, {
+    openDirect: () => connect(host.endpoint, host.deviceToken, host.publicKeyB64, { onLog }),
+    directPath: directPathForEndpoint(host.endpoint),
     openRelay: (relay, credential, confirmReqId, onHostCloseReason) =>
       connectMobileRelayRpcSession({
         relay,
@@ -101,7 +105,7 @@ function createSupervisor(
     resolveRelay: resolveMobileRelayEndpoint,
     readBundle: readMobileRelayCredentialBundle,
     writeBundle: writeMobileRelayCredentialBundle,
-    saveHost,
+    setRelayRouting,
     onLog,
     now: Date.now,
     randomBytes: ExpoCrypto.getRandomBytes,
diff --git a/mobile/src/transport/mobile-endpoint-supervisor-contract.ts b/mobile/src/transport/mobile-endpoint-supervisor-contract.ts
index 247c2ec051ee..81620c54ece0 100644
--- a/mobile/src/transport/mobile-endpoint-supervisor-contract.ts
+++ b/mobile/src/transport/mobile-endpoint-supervisor-contract.ts
@@ -4,11 +4,13 @@ import type { MobileRelayCredentialBundle } from './mobile-relay-credential-bund
 import type { MobileRelayRpcSession } from './mobile-relay-rpc-session'
 import type { resolveMobileRelayEndpoint } from './mobile-relay-resume-director'
 import type { RpcClient } from './rpc-client'
+import type { MobileConnectionPath } from './stable-logical-rpc-client'
 import type { ScheduleTimer } from './timer-scheduler'
-import type { ConnectionLogSink, HostProfile } from './types'
+import type { ConnectionLogSink } from './types'
 
 export type MobileEndpointSupervisorDependencies = {
-  openDirect: (endpoint: string) => RpcClient
+  openDirect: () => RpcClient
+  directPath: Exclude<MobileConnectionPath, 'relay'>
   openRelay: (
     relay: MobileRelayEndpoint,
     credential: { token: string; version: number },
@@ -18,7 +20,7 @@ export type MobileEndpointSupervisorDependencies = {
   resolveRelay: typeof resolveMobileRelayEndpoint
   readBundle: (hostId: string) => Promise<MobileRelayCredentialBundle | null>
   writeBundle: (bundle: MobileRelayCredentialBundle) => Promise<void>
-  saveHost: (host: HostProfile) => Promise<void>
+  setRelayRouting: (hostId: string, relay: MobileRelayEndpoint) => Promise<void>
   now: () => number
   randomBytes: (length: number) => Uint8Array
   setTimer: ScheduleTimer
diff --git a/mobile/src/transport/mobile-endpoint-supervisor-direct-probe.test.ts b/mobile/src/transport/mobile-endpoint-supervisor-direct-probe.test.ts
index 3ee52fc7ddf6..d0ca76d0dcce 100644
--- a/mobile/src/transport/mobile-endpoint-supervisor-direct-probe.test.ts
+++ b/mobile/src/transport/mobile-endpoint-supervisor-direct-probe.test.ts
@@ -5,7 +5,8 @@ import {
   FakeLogicalClient,
   FakeRelaySession,
   FakeSession,
-  host
+  host,
+  relay
 } from './mobile-endpoint-supervisor-test-fakes'
 
 vi.mock('react-native', () => ({ Platform: { OS: 'ios' } }))
@@ -27,7 +28,7 @@ describe('mobile endpoint supervisor direct probe', () => {
     const direct = new FakeSession('connecting')
     const openRelay = vi.fn(() => new FakeRelaySession('connected'))
     const deps = dependencies({ openDirect: vi.fn(() => direct), openRelay })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
     await supervisor.start()
 
     // Foreground return: the probe dials direct at once, the dead LAN answers with
diff --git a/mobile/src/transport/mobile-endpoint-supervisor-nudge.test.ts b/mobile/src/transport/mobile-endpoint-supervisor-nudge.test.ts
index 9db4ea3b9f7c..86ea50e5c452 100644
--- a/mobile/src/transport/mobile-endpoint-supervisor-nudge.test.ts
+++ b/mobile/src/transport/mobile-endpoint-supervisor-nudge.test.ts
@@ -6,7 +6,8 @@ import {
   FakeLogicalClient,
   FakeRelaySession,
   FakeSession,
-  host
+  host,
+  relay
 } from './mobile-endpoint-supervisor-test-fakes'
 import { MobileEndpointSupervisor } from './mobile-endpoint-supervisor'
 import { MobileRelaySessionEstablisher } from './mobile-relay-session-establisher'
@@ -33,7 +34,7 @@ describe('mobile endpoint supervisor nudges', () => {
     const deps = dependencies({
       openDirect: vi.fn(() => new FakeSession('disconnected'))
     })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     await supervisor.start()
     expect(deps.openRelay).toHaveBeenCalledOnce()
@@ -62,7 +63,7 @@ describe('mobile endpoint supervisor nudges', () => {
       // Deterministic full jitter: fraction 0.5 → half the backoff window.
       randomBytes: () => new Uint8Array([128, 0])
     })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     await supervisor.start()
     expect(openRelay).toHaveBeenCalledOnce()
@@ -100,7 +101,7 @@ describe('mobile endpoint supervisor nudges', () => {
       openDirect: vi.fn(() => new FakeSession('disconnected')),
       randomBytes: () => new Uint8Array([128, 0])
     })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     await supervisor.start()
     await vi.advanceTimersByTimeAsync(0)
@@ -119,7 +120,7 @@ describe('mobile endpoint supervisor nudges', () => {
   it('leaves physical relay probing to the session watchdog', async () => {
     const logical = new FakeLogicalClient('connected', 'relay')
     const deps = dependencies()
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
     await supervisor.start()
 
     supervisor.nudge('focus')
@@ -138,7 +139,7 @@ describe('mobile endpoint supervisor nudges', () => {
   it('does not suspend a relay from one focus RPC failure', async () => {
     const logical = new FakeLogicalClient('connected', 'relay')
     const deps = dependencies()
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
     await supervisor.start()
 
     supervisor.nudge('focus')
@@ -164,7 +165,7 @@ describe('mobile endpoint supervisor nudges', () => {
             })
         )
     })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
     await supervisor.start()
     expect(deps.openRelay).toHaveBeenCalledOnce()
 
@@ -195,7 +196,7 @@ describe('mobile endpoint supervisor nudges', () => {
       readBundle: vi.fn(async () => expired),
       randomBytes: () => new Uint8Array([128, 0])
     })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
     await supervisor.start()
 
     supervisor.nudge('network-change')
@@ -221,9 +222,11 @@ describe('mobile endpoint supervisor nudges', () => {
       writeBundle: vi.fn(async () => {}),
       isActive: () => true,
       isForeground: () => true,
-      relay: () => host.relay,
+      isStopped: () => false,
+      hostId: host.id,
+      relay,
       resolveRelay: vi.fn(async ({ relay: endpoint }) => endpoint),
-      persistResolvedRelay: vi.fn(async () => {}),
+      setRelayRouting: vi.fn(async () => {}),
       bundle: () => bundle,
       adoptBundle: vi.fn(),
       recordMigration: vi.fn(),
@@ -260,9 +263,11 @@ describe('mobile endpoint supervisor nudges', () => {
       writeBundle: vi.fn(async () => {}),
       isActive: () => active,
       isForeground: () => active,
-      relay: () => host.relay,
+      isStopped: () => false,
+      hostId: host.id,
+      relay,
       resolveRelay: vi.fn(async ({ relay: endpoint }) => endpoint),
-      persistResolvedRelay: vi.fn(async () => {}),
+      setRelayRouting: vi.fn(async () => {}),
       bundle: () => bundle,
       adoptBundle: vi.fn(),
       recordMigration: vi.fn(),
diff --git a/mobile/src/transport/mobile-endpoint-supervisor-stalled-cell.test.ts b/mobile/src/transport/mobile-endpoint-supervisor-stalled-cell.test.ts
index be4050cee5bf..b0d567ace28e 100644
--- a/mobile/src/transport/mobile-endpoint-supervisor-stalled-cell.test.ts
+++ b/mobile/src/transport/mobile-endpoint-supervisor-stalled-cell.test.ts
@@ -43,7 +43,8 @@ describe('relay dial against a cell that took the dial and stalled', () => {
     const onLog = vi.fn()
     const supervisor = new MobileEndpointSupervisor(
       logical,
-      host,
+      host.id,
+      relay,
       dependencies({ openRelay, resolveRelay, onLog })
     )
 
@@ -67,7 +68,8 @@ describe('relay dial against a cell that took the dial and stalled', () => {
     const resolveRelay = vi.fn(async () => relay)
     const supervisor = new MobileEndpointSupervisor(
       logical,
-      host,
+      host.id,
+      relay,
       dependencies({ openRelay, resolveRelay })
     )
 
diff --git a/mobile/src/transport/mobile-endpoint-supervisor-support.ts b/mobile/src/transport/mobile-endpoint-supervisor-support.ts
index 1a2c00f12dee..e4294f56fcdc 100644
--- a/mobile/src/transport/mobile-endpoint-supervisor-support.ts
+++ b/mobile/src/transport/mobile-endpoint-supervisor-support.ts
@@ -3,7 +3,6 @@ import { MobileE2EEAuthenticationError } from './mobile-e2ee-v2-physical-channel
 import { ReplacementAuthenticationTimeoutError } from './replacement-session-authentication'
 import type { RelayReconnectController } from './mobile-relay-reconnect-controller'
 import type { StableLogicalRpcClient } from './stable-logical-rpc-client'
-import type { HostProfile } from './types'
 import type { MobileRelayEndpoint } from '../../../src/shared/mobile-relay-credential-contract'
 
 // Why: a suspect session that survived a failed replacement dial must come down,
@@ -41,10 +40,10 @@ export class RelayDialAbortedError extends Error {
 // cell assignment, persist it durably, then dial once more.
 export async function dialRelayThroughDirectorFallback(args: {
   resumeToken: string
-  relay: () => HostProfile['relay']
+  relay: () => MobileRelayEndpoint
   dial: () => Promise<RelayDialResult>
   resolveRelay: (input: {
-    relay: NonNullable<HostProfile['relay']>
+    relay: MobileRelayEndpoint
     resumeToken: string
   }) => Promise<MobileRelayEndpoint>
   persistResolvedRelay: (resolved: MobileRelayEndpoint) => Promise<void>
@@ -54,8 +53,7 @@ export async function dialRelayThroughDirectorFallback(args: {
   if (
     first.ok ||
     first.error instanceof RelayDialAbortedError ||
-    !isDirectorResolutionFailure(first.error) ||
-    !relay
+    !isDirectorResolutionFailure(first.error)
   ) {
     return first
   }
@@ -80,27 +78,6 @@ export function isDirectorResolutionFailure(error: Error): boolean {
   )
 }
 
-export function relayWebSocketUrl(relay: { cellUrl: string; relayHostId: string }): string {
-  const url = new URL(relay.cellUrl)
-  url.protocol = 'wss:'
-  url.pathname = `/v1/connect/${encodeURIComponent(relay.relayHostId)}`
-  return url.toString()
-}
-
-export async function persistRelayHost(
-  host: HostProfile,
-  relay: MobileRelayEndpoint,
-  saveHost: (host: HostProfile) => Promise<void>
-): Promise<HostProfile> {
-  const endpoints = [
-    ...(host.endpoints ?? [{ id: 'direct-primary', kind: 'lan' as const, url: host.endpoint }])
-  ].filter(({ kind }) => kind !== 'relay')
-  endpoints.push({ id: 'relay-primary', kind: 'relay', url: relayWebSocketUrl(relay) })
-  const updated = { ...host, endpoints, relayHostId: relay.relayHostId, relay }
-  await saveHost(updated)
-  return updated
-}
-
 export function encodeBase64Url(value: Uint8Array): string {
   let binary = ''
   for (const byte of value) {
diff --git a/mobile/src/transport/mobile-endpoint-supervisor-test-fakes.ts b/mobile/src/transport/mobile-endpoint-supervisor-test-fakes.ts
index 3507127b2a8c..70bf1f3aae25 100644
--- a/mobile/src/transport/mobile-endpoint-supervisor-test-fakes.ts
+++ b/mobile/src/transport/mobile-endpoint-supervisor-test-fakes.ts
@@ -187,11 +187,6 @@ export const host: HostProfile = {
   deviceToken: 'device-token',
   publicKeyB64: 'A'.repeat(44),
   lastConnected: 1,
-  endpoints: [
-    { id: 'direct-primary', kind: 'lan', url: 'ws://192.168.1.10:6768' },
-    { id: 'relay-primary', kind: 'relay', url: 'wss://relay-c1.onorca.dev/v1/connect/id' }
-  ],
-  relayHostId: relay.relayHostId,
   relay
 }
 export const bundle: MobileRelayCredentialBundle = {
@@ -215,7 +210,8 @@ export function dependencies(
     resolveRelay: vi.fn(async ({ relay }) => relay),
     readBundle: vi.fn(async () => bundle),
     writeBundle: vi.fn(async () => {}),
-    saveHost: vi.fn(async () => {}),
+    setRelayRouting: vi.fn(async () => {}),
+    directPath: 'lan',
     now: Date.now,
     randomBytes: (length) => new Uint8Array(length).fill(1),
     setTimer: defaultScheduleTimer,
diff --git a/mobile/src/transport/mobile-endpoint-supervisor.test.ts b/mobile/src/transport/mobile-endpoint-supervisor.test.ts
index 10ef892a479a..367a7867a341 100644
--- a/mobile/src/transport/mobile-endpoint-supervisor.test.ts
+++ b/mobile/src/transport/mobile-endpoint-supervisor.test.ts
@@ -31,7 +31,7 @@ describe('mobile endpoint supervisor', () => {
   it('fails over to a confirmed relay session and persists its renewed expiry', async () => {
     const logical = new FakeLogicalClient('disconnected', 'lan')
     const deps = dependencies()
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     await supervisor.start()
 
@@ -51,7 +51,7 @@ describe('mobile endpoint supervisor', () => {
   it('fails over when the direct retry loop publishes reconnecting', async () => {
     const logical = new FakeLogicalClient('connecting', 'lan')
     const deps = dependencies()
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
     await supervisor.start()
 
     logical.publishState('handshaking')
@@ -77,7 +77,7 @@ describe('mobile endpoint supervisor', () => {
   it('fails over when direct is already reconnecting before startup completes', async () => {
     const logical = new FakeLogicalClient('reconnecting', 'lan')
     const deps = dependencies()
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     await supervisor.start()
 
@@ -102,7 +102,7 @@ describe('mobile endpoint supervisor', () => {
       .mockResolvedValueOnce(null)
       .mockReturnValueOnce(credentialReadPending)
     const deps = dependencies({ readBundle })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     const starting = supervisor.start()
     await vi.waitFor(() => expect(readBundle).toHaveBeenCalledTimes(2))
@@ -120,7 +120,7 @@ describe('mobile endpoint supervisor', () => {
     const logical = new FakeLogicalClient('reconnecting', 'lan')
     const expired = { ...bundle, current: { ...bundle.current, expiresAt: Date.now() - 1 } }
     const deps = dependencies({ readBundle: vi.fn(async () => expired) })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     await supervisor.start()
 
@@ -136,7 +136,7 @@ describe('mobile endpoint supervisor', () => {
       openRelay: vi.fn(() => new FakeRelaySession('disconnected', new RelayOuterError(4408))),
       randomBytes: () => new Uint8Array([128, 0])
     })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     await supervisor.start()
 
@@ -155,7 +155,7 @@ describe('mobile endpoint supervisor', () => {
       openRelay,
       randomBytes: () => new Uint8Array([128, 0])
     })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     await supervisor.start()
     expect(openRelay).toHaveBeenCalledOnce()
@@ -180,7 +180,7 @@ describe('mobile endpoint supervisor', () => {
       openRelay,
       resolveRelay: vi.fn(async () => resolved)
     })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     await supervisor.start()
 
@@ -191,16 +191,14 @@ describe('mobile endpoint supervisor', () => {
       expect.any(String),
       expect.any(Function)
     )
-    expect(deps.saveHost).toHaveBeenCalledWith(
-      expect.objectContaining({ relay: resolved, endpoint: host.endpoint })
-    )
+    expect(deps.setRelayRouting).toHaveBeenCalledWith(host.id, resolved)
     supervisor.stop()
   })
 
   it('promotes direct only after repeated foreground authenticated probes and dwell', async () => {
     const logical = new FakeLogicalClient('connected', 'relay')
     const deps = dependencies()
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
     await supervisor.start()
 
     await vi.advanceTimersByTimeAsync(45_000)
@@ -219,7 +217,7 @@ describe('mobile endpoint supervisor', () => {
       openDirect: vi.fn(() => direct),
       openRelay
     })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
     await supervisor.start()
 
     // Start the probe, then drop the active relay while the probe owns the
@@ -245,7 +243,7 @@ describe('mobile endpoint supervisor', () => {
       onLog,
       randomBytes: () => new Uint8Array([128, 0])
     })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     await supervisor.start()
     logical.publishState('disconnected')
@@ -270,7 +268,7 @@ describe('mobile endpoint supervisor', () => {
     const logical = new FakeLogicalClient('connected', 'relay')
     const expired = { ...bundle, current: { ...bundle.current, expiresAt: Date.now() - 1 } }
     const deps = dependencies({ readBundle: vi.fn(async () => expired) })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
     await supervisor.start()
 
     logical.publishState('disconnected')
@@ -289,7 +287,7 @@ describe('mobile endpoint supervisor', () => {
       openRelay,
       randomBytes: () => new Uint8Array([128, 0])
     })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     await supervisor.start()
     logical.publishState('disconnected')
@@ -321,7 +319,7 @@ describe('mobile endpoint supervisor', () => {
       openRelay,
       randomBytes: () => new Uint8Array([128, 0])
     })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     await supervisor.start()
 
@@ -350,7 +348,7 @@ describe('mobile endpoint supervisor', () => {
       openRelay,
       randomBytes: () => new Uint8Array([128, 0])
     })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     await supervisor.start()
     expect(openRelay).toHaveBeenCalledTimes(2)
@@ -383,7 +381,7 @@ describe('mobile endpoint supervisor', () => {
       ),
       writeBundle
     })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     await supervisor.start()
     writeBundle.mockClear()
@@ -409,7 +407,7 @@ describe('mobile endpoint supervisor', () => {
       openRelay,
       resolveRelay
     })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     await supervisor.start()
 
@@ -431,7 +429,7 @@ describe('mobile endpoint supervisor', () => {
         throw new Error('secure store unavailable')
       })
     })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     await supervisor.start()
     expect(openRelay).toHaveBeenCalledOnce()
@@ -447,7 +445,7 @@ describe('mobile endpoint supervisor', () => {
       openRelay: vi.fn(() => new FakeRelaySession('disconnected', new RelayOuterError(4408))),
       randomBytes: () => new Uint8Array([128, 0])
     })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     await supervisor.start()
     expect(vi.getTimerCount()).toBe(1)
@@ -472,7 +470,7 @@ describe('mobile endpoint supervisor', () => {
       writeBundle: vi.fn(() => writePending),
       randomBytes: () => new Uint8Array([128, 0])
     })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     const starting = supervisor.start()
     await vi.waitFor(() => expect(deps.writeBundle).toHaveBeenCalledOnce())
@@ -493,7 +491,7 @@ describe('mobile endpoint supervisor', () => {
       openRelay,
       randomBytes: () => new Uint8Array([128, 0])
     })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     await supervisor.start()
 
@@ -512,7 +510,7 @@ describe('mobile endpoint supervisor', () => {
     const logical = new FakeLogicalClient('disconnected', 'lan')
     const openRelay = vi.fn(() => new FakeRelaySession('disconnected', new RelayOuterError(4401)))
     const deps = dependencies({ openRelay })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     await supervisor.start()
     supervisor.setForeground(true)
@@ -544,7 +542,7 @@ describe('mobile endpoint supervisor', () => {
       .mockReturnValueOnce(credentialWritePending)
     mockCredentialRotation(logical)
     const deps = dependencies({ openRelay, writeBundle })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     await supervisor.start()
     logical.publishState('connected')
@@ -594,7 +592,7 @@ describe('mobile endpoint supervisor', () => {
       openRelay,
       writeBundle
     })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     await supervisor.start()
     logical.publishState('connected')
@@ -630,7 +628,7 @@ describe('mobile endpoint supervisor', () => {
       openDirect: vi.fn(() => new FakeSession('disconnected')),
       resolveRelay: vi.fn(() => resolvePending)
     })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     const starting = supervisor.start()
     await vi.waitFor(() => expect(deps.resolveRelay).toHaveBeenCalledOnce())
@@ -659,14 +657,14 @@ describe('mobile endpoint supervisor', () => {
       openDirect: vi.fn(() => new FakeSession('disconnected')),
       resolveRelay: vi.fn(() => resolvePending)
     })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     await supervisor.start()
     await vi.advanceTimersByTimeAsync(60_000)
     await vi.waitFor(() => expect(deps.resolveRelay).toHaveBeenCalledOnce())
     supervisor.setForeground(false)
     finishResolve?.(relay)
-    await vi.waitFor(() => expect(deps.saveHost).toHaveBeenCalledOnce())
+    await vi.waitFor(() => expect(deps.setRelayRouting).toHaveBeenCalledOnce())
     await vi.advanceTimersByTimeAsync(0)
 
     expect(openRelay).toHaveBeenCalledTimes(2)
@@ -685,7 +683,7 @@ describe('mobile endpoint supervisor', () => {
       finishWrite = resolve
     })
     const deps = dependencies({ writeBundle: vi.fn(() => writePending) })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     const starting = supervisor.start()
     await vi.waitFor(() => expect(deps.writeBundle).toHaveBeenCalledOnce())
@@ -706,7 +704,7 @@ describe('mobile endpoint supervisor', () => {
       openRelay,
       openDirect: vi.fn(() => new FakeSession('disconnected'))
     })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     await supervisor.start()
     await vi.advanceTimersByTimeAsync(60_000)
@@ -728,7 +726,7 @@ describe('mobile endpoint supervisor', () => {
       openRelay,
       openDirect: vi.fn(() => new FakeSession('disconnected'))
     })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     await supervisor.start()
     expect(openRelay).toHaveBeenCalledTimes(1)
@@ -752,7 +750,7 @@ describe('mobile endpoint supervisor', () => {
       openDirect: vi.fn(() => new FakeSession('disconnected')),
       randomBytes: () => new Uint8Array([128, 0])
     })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     await supervisor.start()
     await vi.advanceTimersByTimeAsync(60_000)
@@ -778,7 +776,7 @@ describe('mobile endpoint supervisor', () => {
       openDirect: vi.fn(() => new FakeSession('disconnected')),
       randomBytes: () => new Uint8Array([128, 0])
     })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     await supervisor.start()
     await vi.advanceTimersByTimeAsync(60_000)
@@ -807,7 +805,7 @@ describe('mobile endpoint supervisor', () => {
       openRelay,
       randomBytes: () => new Uint8Array([128, 0])
     })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     await supervisor.start()
     await vi.advanceTimersByTimeAsync(900)
@@ -828,7 +826,7 @@ describe('mobile endpoint supervisor', () => {
       openDirect: vi.fn(() => new FakeSession('disconnected')),
       randomBytes: () => new Uint8Array([128, 0])
     })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     await supervisor.start()
     const afterStart = openRelay.mock.calls.length
@@ -844,7 +842,7 @@ describe('mobile endpoint supervisor', () => {
   it('races a relay dial when the direct dial stalls unauthenticated', async () => {
     const logical = new FakeLogicalClient('connecting', 'lan')
     const deps = dependencies()
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     await supervisor.start()
     await vi.advanceTimersByTimeAsync(2_499)
@@ -866,7 +864,7 @@ describe('mobile endpoint supervisor', () => {
   it('cancels the grace race when the direct dial authenticates first', async () => {
     const logical = new FakeLogicalClient('connecting', 'lan')
     const deps = dependencies()
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     await supervisor.start()
     logical.publishState('connected')
@@ -878,23 +876,10 @@ describe('mobile endpoint supervisor', () => {
     supervisor.stop()
   })
 
-  it('never races a relay dial against a desktop with no relay endpoint', async () => {
-    const logical = new FakeLogicalClient('connecting', 'lan')
-    const deps = dependencies()
-    const supervisor = new MobileEndpointSupervisor(logical, { ...host, relay: undefined }, deps)
-
-    await supervisor.start()
-    await vi.advanceTimersByTimeAsync(5_000)
-
-    expect(deps.openRelay).not.toHaveBeenCalled()
-    expect(vi.getTimerCount()).toBe(0)
-    supervisor.stop()
-  })
-
   it('drops the pending grace race when the phone backgrounds', async () => {
     const logical = new FakeLogicalClient('connecting', 'lan')
     const deps = dependencies()
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     await supervisor.start()
     supervisor.setForeground(false)
@@ -909,7 +894,7 @@ describe('mobile endpoint supervisor', () => {
     const logical = new FakeLogicalClient('connecting', 'lan')
     const openRelay = vi.fn(() => new FakeRelaySession('disconnected', new RelayOuterError(4408)))
     const deps = dependencies({ openRelay, randomBytes: () => new Uint8Array([128, 0]) })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     await supervisor.start()
     await vi.advanceTimersByTimeAsync(2_500)
diff --git a/mobile/src/transport/mobile-endpoint-supervisor.ts b/mobile/src/transport/mobile-endpoint-supervisor.ts
index 9ba12f351120..862a739fb12c 100644
--- a/mobile/src/transport/mobile-endpoint-supervisor.ts
+++ b/mobile/src/transport/mobile-endpoint-supervisor.ts
@@ -5,7 +5,6 @@ import { RelayLeaseRotationTimer } from './mobile-relay-lease-rotation-timer'
 import { MobileEndpointHysteresis } from './mobile-endpoint-hysteresis'
 import {
   liveRelayLeaseExpiry,
-  persistRelayHost,
   suspendRelayIfStillConnected
 } from './mobile-endpoint-supervisor-support'
 import { selectDialableRelayCredentials } from './mobile-relay-credential-selection'
@@ -20,7 +19,8 @@ import { MobileRelayDirectGraceTimer } from './mobile-relay-direct-grace-timer'
 import { MobileRelaySessionEstablisher } from './mobile-relay-session-establisher'
 import * as recoveryPresentation from './mobile-relay-recovery-presentation'
 import type { StableLogicalRpcClient } from './stable-logical-rpc-client'
-import type { ForegroundNudgeReason, HostProfile } from './types'
+import type { ForegroundNudgeReason } from './types'
+import type { MobileRelayEndpoint } from '../../../src/shared/mobile-relay-credential-contract'
 import { MobileRelayBackgroundGrace } from './mobile-relay-background-grace'
 import {
   logRelayConnected,
@@ -54,7 +54,8 @@ export class MobileEndpointSupervisor {
 
   constructor(
     private readonly logical: StableLogicalRpcClient,
-    private host: HostProfile,
+    private readonly hostId: string,
+    relay: MobileRelayEndpoint,
     private readonly dependencies: MobileEndpointSupervisorDependencies
   ) {
     this.hysteresis = new MobileEndpointHysteresis(dependencies.now(), {
@@ -81,7 +82,7 @@ export class MobileEndpointSupervisor {
     })
     // Why: the race owns recovery exactly like a network-change replacement — its
     // failure must book the shared cooldown. recoverRelay's own guards already
-    // cover stopped/background/no-relay, so the timer needs no scope check.
+    // cover stopped/background, so the timer needs no scope check.
     this.directGrace = new MobileRelayDirectGraceTimer(dependencies, logical, () => {
       void this.recoverRelay(true, true)
     })
@@ -93,11 +94,11 @@ export class MobileEndpointSupervisor {
       writeBundle: dependencies.writeBundle,
       isActive: () => this.isActive(),
       isForeground: () => this.backgroundGrace.isForeground(),
-      relay: () => this.host.relay,
+      isStopped: () => this.stopped,
+      hostId,
+      relay,
       resolveRelay: dependencies.resolveRelay,
-      persistResolvedRelay: async (resolved) => {
-        this.host = await persistRelayHost(this.host, resolved, dependencies.saveHost)
-      },
+      setRelayRouting: dependencies.setRelayRouting,
       bundle: () => this.bundle,
       adoptBundle: (bundle) => (this.bundle = bundle),
       recordMigration: () => {
@@ -116,7 +117,6 @@ export class MobileEndpointSupervisor {
     })
     this.directProbe = new DirectReturnProbe(dependencies, {
       hysteresis: this.hysteresis,
-      host: () => this.host,
       canSchedule: () => this.isActive() && this.logical.getActivePath() === 'relay',
       canAttempt: () => this.isActive() && !this.operationInFlight,
       beginOperation: () => (this.operationInFlight = true),
@@ -148,8 +148,8 @@ export class MobileEndpointSupervisor {
   }
 
   async start(): Promise<void> {
-    this.bundle = await this.dependencies.readBundle(this.host.id).catch(() => null)
-    if (this.stopped || !this.host.relay) {
+    this.bundle = await this.dependencies.readBundle(this.hostId).catch(() => null)
+    if (this.stopped) {
       return
     }
     if (!this.bundle) {
@@ -211,7 +211,7 @@ export class MobileEndpointSupervisor {
   // shared cooldown and any session left stale-'connected' by a half-open socket
   // comes down; lease rotation clears it because armRetry owns its own retry.
   private async recoverRelay(forceReplacement = false, ownsRecovery = false): Promise<void> {
-    if (!this.isActive() || !this.host.relay) {
+    if (!this.isActive()) {
       return
     }
     if (this.operationInFlight) {
@@ -247,7 +247,7 @@ export class MobileEndpointSupervisor {
       const selection = await selectDialableRelayCredentials({
         bundle: this.bundle,
         controller: this.relayReconnect,
-        readBundle: () => this.dependencies.readBundle(this.host.id),
+        readBundle: () => this.dependencies.readBundle(this.hostId),
         onAdoptedFresherBundle: () => this.logRelay('adopted fresher durable credential bundle')
       })
       this.bundle = selection.bundle
@@ -325,7 +325,7 @@ export class MobileEndpointSupervisor {
       this.bundle = result.bundle
       // Why: a scheduled rotation can finish after the old credential enters the rejection gate.
       credentialRefreshed = true
-      this.host = await persistRelayHost(this.host, result.relay, this.dependencies.saveHost)
+      await this.sessionEstablisher.adoptRelay(result.relay)
     } catch {
       // Why: pending material remains durable; the next authenticated direct
       // opportunity must reconcile it before creating another install key.
diff --git a/mobile/src/transport/mobile-relay-background-lifecycle.test.ts b/mobile/src/transport/mobile-relay-background-lifecycle.test.ts
index 76bca72426d1..53e44f383b82 100644
--- a/mobile/src/transport/mobile-relay-background-lifecycle.test.ts
+++ b/mobile/src/transport/mobile-relay-background-lifecycle.test.ts
@@ -4,7 +4,8 @@ import {
   FakeLogicalClient,
   FakeRelaySession,
   FakeSession,
-  host
+  host,
+  relay
 } from './mobile-endpoint-supervisor-test-fakes'
 import { MobileEndpointSupervisor } from './mobile-endpoint-supervisor'
 
@@ -23,7 +24,7 @@ describe('mobile Relay background lifecycle', () => {
   it('retains a relay session across a quick background and foreground', async () => {
     const logical = new FakeLogicalClient('connected', 'relay')
     const deps = dependencies()
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
     await supervisor.start()
 
     supervisor.setForeground(false)
@@ -43,7 +44,7 @@ describe('mobile Relay background lifecycle', () => {
   it('releases a retained relay after 30 seconds and recovers only on foreground', async () => {
     const logical = new FakeLogicalClient('connected', 'relay')
     const deps = dependencies()
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
     await supervisor.start()
 
     supervisor.setForeground(false)
@@ -64,7 +65,7 @@ describe('mobile Relay background lifecycle', () => {
   it('enforces an overdue grace on foreground when the background timer was suspended', async () => {
     const logical = new FakeLogicalClient('connected', 'relay')
     const deps = dependencies()
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
     await supervisor.start()
 
     supervisor.setForeground(false)
@@ -81,7 +82,7 @@ describe('mobile Relay background lifecycle', () => {
   it('recovers after a retained relay fails while backgrounded', async () => {
     const logical = new FakeLogicalClient('connected', 'relay')
     const deps = dependencies()
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
     await supervisor.start()
 
     supervisor.setForeground(false)
@@ -101,7 +102,7 @@ describe('mobile Relay background lifecycle', () => {
   it('does not retain or suspend a healthy direct session in the background', async () => {
     const logical = new FakeLogicalClient('connected', 'tailscale')
     const deps = dependencies()
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
     await supervisor.start()
 
     supervisor.setForeground(false)
@@ -120,7 +121,7 @@ describe('mobile Relay background lifecycle', () => {
       openDirect: vi.fn(() => new FakeSession('disconnected')),
       openRelay
     })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
     await supervisor.start()
 
     await vi.advanceTimersByTimeAsync(40_000)
@@ -147,7 +148,7 @@ describe('mobile Relay background lifecycle', () => {
       openRelay,
       writeBundle: vi.fn(() => writeStarted)
     })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
     const starting = supervisor.start()
     await vi.waitFor(() => expect(deps.writeBundle).toHaveBeenCalledOnce())
 
diff --git a/mobile/src/transport/mobile-relay-connect-url.ts b/mobile/src/transport/mobile-relay-connect-url.ts
new file mode 100644
index 000000000000..5f83812764bf
--- /dev/null
+++ b/mobile/src/transport/mobile-relay-connect-url.ts
@@ -0,0 +1,7 @@
+/** The relay's phone connect socket for `relayHostId`, on a cell or on the director. */
+export function relayConnectWebSocketUrl(baseUrl: string, relayHostId: string): string {
+  const url = new URL(baseUrl)
+  url.protocol = 'wss:'
+  url.pathname = `/v1/connect/${encodeURIComponent(relayHostId)}`
+  return url.toString()
+}
diff --git a/mobile/src/transport/mobile-relay-direct-upgrade-controller.test.ts b/mobile/src/transport/mobile-relay-direct-upgrade-controller.test.ts
index 28fb7c307f56..0d99c7d94292 100644
--- a/mobile/src/transport/mobile-relay-direct-upgrade-controller.test.ts
+++ b/mobile/src/transport/mobile-relay-direct-upgrade-controller.test.ts
@@ -14,17 +14,13 @@ const directHost: HostProfile = {
 }
 
 const upgraded = {
-  host: {
-    ...directHost,
+  relay: {
+    v: 1 as const,
+    directorUrl: 'https://relay-staging.onorca.dev',
+    cellUrl: 'https://c1.relay-staging.onorca.dev',
+    assignmentEpoch: 4,
     relayHostId: 'AbCdEf0123_-xyZ9',
-    relay: {
-      v: 1 as const,
-      directorUrl: 'https://relay-staging.onorca.dev',
-      cellUrl: 'https://c1.relay-staging.onorca.dev',
-      assignmentEpoch: 4,
-      relayHostId: 'AbCdEf0123_-xyZ9',
-      e2eeFraming: 2 as const
-    }
+    e2eeFraming: 2 as const
   },
   bundle: {
     v: 1 as const,
diff --git a/mobile/src/transport/mobile-relay-direct-upgrade.test.ts b/mobile/src/transport/mobile-relay-direct-upgrade.test.ts
index 13d020ec239b..d76e887b299f 100644
--- a/mobile/src/transport/mobile-relay-direct-upgrade.test.ts
+++ b/mobile/src/transport/mobile-relay-direct-upgrade.test.ts
@@ -1,6 +1,6 @@
 import { describe, expect, it, vi } from 'vitest'
 import type { MobileRelayEndpoint } from '../../../src/shared/mobile-relay-credential-contract'
-import { MobileRelayUpgradeHostRemovedError } from './host-store'
+import { RelayRoutingHostRemovedError } from './host-store'
 import {
   createMobileRelayDirectUpgradeJournal,
   type MobileRelayDirectUpgradeJournal
@@ -64,7 +64,7 @@ function dependencies(journal: MobileRelayDirectUpgradeJournal | null = null) {
     }),
     writeBundle: vi.fn(async () => {}),
     deleteBundle: vi.fn(async () => {}),
-    saveHost: vi.fn(async () => {}),
+    setRelayRouting: vi.fn(async () => {}),
     randomBytes: (length: number) => new Uint8Array(length).fill(7)
   }
 }
@@ -113,8 +113,9 @@ describe('existing direct pairing relay upgrade', () => {
       reqId: journal!.reqId,
       newResumeTokenHash: journal!.pendingResumeTokenHash
     })
-    expect(deps.writeBundle).toHaveBeenCalledBefore(deps.saveHost)
-    expect(result?.host.relay).toEqual(relay)
+    expect(deps.writeBundle).toHaveBeenCalledBefore(deps.setRelayRouting)
+    expect(deps.setRelayRouting).toHaveBeenCalledWith(host.id, relay)
+    expect(result?.relay).toEqual(relay)
     expect(deps.clearJournal).toHaveBeenCalledWith(host.id)
   })
 
@@ -153,7 +154,7 @@ describe('existing direct pairing relay upgrade', () => {
     await expect(upgradeDirectMobileRelay({ client, host, dependencies: deps })).resolves.toBeNull()
     expect(deps.clearJournal).toHaveBeenCalledWith(host.id)
     expect(deps.writeBundle).not.toHaveBeenCalled()
-    expect(deps.saveHost).not.toHaveBeenCalled()
+    expect(deps.setRelayRouting).not.toHaveBeenCalled()
   })
 
   // Why 'forbidden': a desktop that predates pairing.getEndpoints has it on neither its mobile
@@ -176,7 +177,7 @@ describe('existing direct pairing relay upgrade', () => {
     await expect(upgradeDirectMobileRelay({ client, host, dependencies: deps })).resolves.toBeNull()
     expect(deps.clearJournal).toHaveBeenCalledWith(host.id)
     expect(deps.writeBundle).not.toHaveBeenCalled()
-    expect(deps.saveHost).not.toHaveBeenCalled()
+    expect(deps.setRelayRouting).not.toHaveBeenCalled()
   })
 
   it('retains the durable journal when relay registration is temporarily unavailable', async () => {
@@ -196,8 +197,8 @@ describe('existing direct pairing relay upgrade', () => {
     )
     const committed = installed(journal)
     const deps = dependencies(journal)
-    deps.saveHost.mockRejectedValue(
-      new MobileRelayUpgradeHostRemovedError('mobile relay upgrade host was removed')
+    deps.setRelayRouting.mockRejectedValue(
+      new RelayRoutingHostRemovedError('mobile relay upgrade host was removed')
     )
     const client = clientWith([
       success({
@@ -209,7 +210,7 @@ describe('existing direct pairing relay upgrade', () => {
 
     await expect(
       upgradeDirectMobileRelay({ client, host, dependencies: deps })
-    ).rejects.toBeInstanceOf(MobileRelayUpgradeHostRemovedError)
+    ).rejects.toBeInstanceOf(RelayRoutingHostRemovedError)
     expect(deps.deleteBundle).toHaveBeenCalledWith(host.id)
     expect(deps.clearJournal).toHaveBeenCalledWith(host.id)
   })
diff --git a/mobile/src/transport/mobile-relay-direct-upgrade.ts b/mobile/src/transport/mobile-relay-direct-upgrade.ts
index 221d5a5d6c16..30b2a76e681d 100644
--- a/mobile/src/transport/mobile-relay-direct-upgrade.ts
+++ b/mobile/src/transport/mobile-relay-direct-upgrade.ts
@@ -1,10 +1,10 @@
 import * as ExpoCrypto from 'expo-crypto'
 import type {
   DeviceCredentialInstalled,
+  MobileRelayEndpoint,
   PairingGetEndpointsResult
 } from '../../../src/shared/mobile-relay-credential-contract'
-import { MobileRelayUpgradeHostRemovedError, saveExistingHostRelayUpgrade } from './host-store'
-import { persistRelayHost } from './mobile-endpoint-supervisor-support'
+import { RelayRoutingHostRemovedError, setRelayRouting } from './host-store'
 import {
   MobileRelayCredentialBundleSchema,
   deleteMobileRelayCredentialBundle,
@@ -27,7 +27,7 @@ import type { HostProfile } from './types'
 import { isPairingRelayRpcUnavailable } from './pairing-relay-rpc-unavailable'
 
 export type MobileRelayDirectUpgradeResult = {
-  host: HostProfile
+  relay: MobileRelayEndpoint
   bundle: MobileRelayCredentialBundle
 }
 
@@ -36,7 +36,7 @@ type Dependencies = {
   writeJournal: typeof writeMobileRelayDirectUpgradeJournal
   clearJournal: typeof deleteMobileRelayDirectUpgradeJournal
   writeBundle: typeof writeMobileRelayCredentialBundle
-  saveHost: typeof saveExistingHostRelayUpgrade
+  setRelayRouting: typeof setRelayRouting
   deleteBundle: typeof deleteMobileRelayCredentialBundle
   randomBytes: (length: number) => Uint8Array
 }
@@ -54,7 +54,7 @@ export async function upgradeDirectMobileRelay(args: {
     writeJournal: writeMobileRelayDirectUpgradeJournal,
     clearJournal: deleteMobileRelayDirectUpgradeJournal,
     writeBundle: writeMobileRelayCredentialBundle,
-    saveHost: saveExistingHostRelayUpgrade,
+    setRelayRouting,
     deleteBundle: deleteMobileRelayCredentialBundle,
     randomBytes: ExpoCrypto.getRandomBytes,
     ...args.dependencies
@@ -120,18 +120,17 @@ async function publishCommitted(
   })
   // Why: the overlay must never advertise relay without its matching credential.
   await dependencies.writeBundle(bundle)
-  let updatedHost: HostProfile
   try {
-    updatedHost = await persistRelayHost(host, endpoints.relay, dependencies.saveHost)
+    await dependencies.setRelayRouting(host.id, endpoints.relay)
   } catch (error) {
-    if (error instanceof MobileRelayUpgradeHostRemovedError) {
+    if (error instanceof RelayRoutingHostRemovedError) {
       await dependencies.deleteBundle(host.id)
       await dependencies.clearJournal(host.id)
     }
     throw error
   }
   await dependencies.clearJournal(host.id)
-  return { host: updatedHost, bundle }
+  return { relay: endpoints.relay, bundle }
 }
 
 async function getEndpoints(
diff --git a/mobile/src/transport/mobile-relay-e2ee-link.ts b/mobile/src/transport/mobile-relay-e2ee-link.ts
index 9b1f7a9a3551..c2f24f718230 100644
--- a/mobile/src/transport/mobile-relay-e2ee-link.ts
+++ b/mobile/src/transport/mobile-relay-e2ee-link.ts
@@ -9,6 +9,7 @@ import {
 import { MobileE2EEV2ClientSession } from './mobile-e2ee-v2-client-session'
 import { MobileE2EEV2PhysicalChannel } from './mobile-e2ee-v2-physical-channel'
 import { websocketPayloadToUint8 } from './websocket-payload-bytes'
+import { relayConnectWebSocketUrl } from './mobile-relay-connect-url'
 
 // Native WebSockets normally emit close immediately after error; bound the
 // missing-close case so a dead socket cannot leave recovery pending forever.
@@ -54,7 +55,7 @@ export class MobileRelayE2eeLink {
   constructor(options: MobileRelayE2eeLinkOptions) {
     this.options = options
     this.socket = (options.createSocket ?? ((url) => new WebSocket(url)))(
-      relaySocketUrl(options.endpoint)
+      relayConnectWebSocketUrl(options.endpoint.cellUrl, options.endpoint.relayHostId)
     )
     const session = MobileE2EEV2ClientSession.create({
       desktopPublicKeyB64: options.desktopPublicKeyB64,
@@ -188,13 +189,6 @@ export class MobileRelayE2eeLink {
   }
 }
 
-function relaySocketUrl(endpoint: { cellUrl: string; relayHostId: string }): string {
-  const url = new URL(endpoint.cellUrl)
-  url.protocol = 'wss:'
-  url.pathname = `/v1/connect/${encodeURIComponent(endpoint.relayHostId)}`
-  return url.toString()
-}
-
 function asError(error: unknown): Error {
   return error instanceof Error ? error : new Error(String(error))
 }
diff --git a/mobile/src/transport/mobile-relay-host-overlay-store.test.ts b/mobile/src/transport/mobile-relay-host-overlay-store.test.ts
index 812d61ebb1d9..d2053b7a515f 100644
--- a/mobile/src/transport/mobile-relay-host-overlay-store.test.ts
+++ b/mobile/src/transport/mobile-relay-host-overlay-store.test.ts
@@ -1,4 +1,6 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { z } from 'zod'
+import { MobileRelayEndpointSchema } from '../../../src/shared/mobile-relay-credential-contract'
 
 const asyncStorage = vi.hoisted(() => ({
   getItem: vi.fn(),
@@ -8,36 +10,83 @@ const asyncStorage = vi.hoisted(() => ({
 vi.mock('@react-native-async-storage/async-storage', () => ({ default: asyncStorage }))
 
 import {
-  loadMobileRelayHostOverlays,
-  removeMobileRelayHostOverlays,
+  loadMobileRelayHostRoutingState,
+  removeMobileRelayHostRoutings,
   resetMobileRelayHostOverlayStoreForTests,
-  saveMobileRelayHostOverlay
+  saveMobileRelayHostRouting
 } from './mobile-relay-host-overlay-store'
 import type { MobileRelayHostOverlay } from './mobile-relay-host-overlay'
 
 const STORAGE_KEY = 'orca:mobile-relay:host-overlays:v2'
-const OVERLAY: MobileRelayHostOverlay = {
+const RELAY = {
+  v: 1 as const,
+  directorUrl: 'https://relay.onorca.dev',
+  cellUrl: 'https://relay-c1.onorca.dev',
+  assignmentEpoch: 7,
+  relayHostId: 'AbCdEf0123_-xyZ9',
+  e2eeFraming: 2 as const
+}
+const RELAY_ONLY_OVERLAY: MobileRelayHostOverlay = {
   v: 2,
   hostId: 'host-1',
   endpoints: [
-    { id: 'direct-primary', kind: 'lan', url: 'ws://192.168.1.10:6768' },
     {
       id: 'relay-primary',
       kind: 'relay',
       url: 'wss://relay-c1.onorca.dev/v1/connect/AbCdEf0123_-xyZ9'
     }
   ],
-  relayHostId: 'AbCdEf0123_-xyZ9',
-  relay: {
-    v: 1,
-    directorUrl: 'https://relay.onorca.dev',
-    cellUrl: 'https://relay-c1.onorca.dev',
-    assignmentEpoch: 7,
-    relayHostId: 'AbCdEf0123_-xyZ9',
-    e2eeFraming: 2
-  }
+  relayHostId: RELAY.relayHostId,
+  relay: RELAY
+}
+// What builds before the relay-routing split wrote: a copy of the row's address beside the relay.
+const LEGACY_OVERLAY: MobileRelayHostOverlay = {
+  ...RELAY_ONLY_OVERLAY,
+  endpoints: [
+    { id: 'direct-primary', kind: 'lan', url: 'ws://192.168.1.10:6768' },
+    ...RELAY_ONLY_OVERLAY.endpoints
+  ]
 }
 
+// Frozen copy of the overlay schema shipped builds parse with (relay endpoint schema is shared);
+// they drop a record it rejects.
+const ShippedOverlaySchema = z
+  .object({
+    v: z.literal(2),
+    hostId: z.string().min(1),
+    endpoints: z
+      .array(
+        z
+          .object({
+            id: z.string().min(1).max(128),
+            kind: z.enum(['lan', 'tailscale', 'relay']),
+            url: z.string().min(1).max(2048)
+          })
+          .strict()
+      )
+      .min(1)
+      .max(16),
+    relayHostId: z
+      .string()
+      .regex(/^[A-Za-z0-9_-]{16}$/)
+      .optional(),
+    relay: MobileRelayEndpointSchema.optional()
+  })
+  .strict()
+  .superRefine((overlay, context) => {
+    if ((overlay.relayHostId === undefined) !== (overlay.relay === undefined)) {
+      context.addIssue({ code: 'custom', message: 'Relay identity and endpoint must coexist' })
+      return
+    }
+    if (overlay.relay && overlay.relay.relayHostId !== overlay.relayHostId) {
+      context.addIssue({ code: 'custom', message: 'Relay host identity mismatch' })
+    }
+    const relayEndpointCount = overlay.endpoints.filter(({ kind }) => kind === 'relay').length
+    if (relayEndpointCount !== (overlay.relay ? 1 : 0)) {
+      context.addIssue({ code: 'custom', message: 'Expected exactly one relay endpoint' })
+    }
+  })
+
 describe('mobile relay host overlay store', () => {
   let stored: string | null
 
@@ -55,35 +104,57 @@ describe('mobile relay host overlay store', () => {
     })
   })
 
-  it('round-trips v2 metadata in a namespace legacy builds do not rewrite', async () => {
-    await saveMobileRelayHostOverlay(OVERLAY)
+  it('round-trips relay routing in a namespace legacy builds do not rewrite', async () => {
+    await expect(saveMobileRelayHostRouting('host-1', RELAY)).resolves.toBe(true)
 
-    await expect(loadMobileRelayHostOverlays(new Set(['host-1']))).resolves.toEqual(
-      new Map([['host-1', OVERLAY]])
-    )
-    expect(asyncStorage.setItem).toHaveBeenCalledWith(STORAGE_KEY, expect.any(String))
+    await expect(loadMobileRelayHostRoutingState(new Set(['host-1']))).resolves.toEqual({
+      relays: new Map([['host-1', RELAY]]),
+      orphanHostIds: []
+    })
+    expect(JSON.parse(stored!)).toEqual([RELAY_ONLY_OVERLAY])
+  })
+
+  it('writes a record the shipped overlay schema still accepts', async () => {
+    await saveMobileRelayHostRouting('host-1', RELAY)
+
+    const [record] = JSON.parse(stored!)
+    expect(ShippedOverlaySchema.safeParse(record).success).toBe(true)
+  })
+
+  it('ignores a direct address an older build stored and drops it on the next routing write', async () => {
+    stored = JSON.stringify([LEGACY_OVERLAY])
+
+    await expect(loadMobileRelayHostRoutingState(new Set(['host-1']))).resolves.toEqual({
+      relays: new Map([['host-1', RELAY]]),
+      orphanHostIds: []
+    })
+    await expect(saveMobileRelayHostRouting('host-1', RELAY)).resolves.toBe(true)
+    expect(JSON.parse(stored!)).toEqual([RELAY_ONLY_OVERLAY])
   })
 
   it('never overlays or resurrects a host whose legacy base was removed', async () => {
-    stored = JSON.stringify([OVERLAY])
+    stored = JSON.stringify([LEGACY_OVERLAY])
 
-    await expect(loadMobileRelayHostOverlays(new Set())).resolves.toEqual(new Map())
+    await expect(loadMobileRelayHostRoutingState(new Set())).resolves.toEqual({
+      relays: new Map(),
+      orphanHostIds: ['host-1']
+    })
     expect(asyncStorage.setItem).not.toHaveBeenCalled()
-    expect(JSON.parse(stored)).toEqual([OVERLAY])
+    expect(JSON.parse(stored)).toEqual([LEGACY_OVERLAY])
   })
 
   it('refuses to overwrite unreadable overlay storage', async () => {
     stored = '{'
 
-    await expect(saveMobileRelayHostOverlay(OVERLAY)).rejects.toThrow(/unreadable/)
+    await expect(saveMobileRelayHostRouting('host-1', RELAY)).rejects.toThrow(/unreadable/)
     expect(asyncStorage.setItem).not.toHaveBeenCalled()
   })
 
   it('removes requested overlays in one storage write', async () => {
-    const second = { ...OVERLAY, hostId: 'host-2' }
-    stored = JSON.stringify([OVERLAY, second])
+    const second = { ...RELAY_ONLY_OVERLAY, hostId: 'host-2' }
+    stored = JSON.stringify([RELAY_ONLY_OVERLAY, second])
 
-    await expect(removeMobileRelayHostOverlays(['host-1', 'host-missing'])).resolves.toBeUndefined()
+    await expect(removeMobileRelayHostRoutings(['host-1', 'host-missing'])).resolves.toBeUndefined()
 
     expect(JSON.parse(stored!)).toEqual([second])
     expect(asyncStorage.getItem).toHaveBeenCalledOnce()
@@ -91,9 +162,9 @@ describe('mobile relay host overlay store', () => {
   })
 
   it('skips the storage write when no requested overlay exists', async () => {
-    stored = JSON.stringify([OVERLAY])
+    stored = JSON.stringify([RELAY_ONLY_OVERLAY])
 
-    await expect(removeMobileRelayHostOverlays(['host-missing'])).resolves.toBeUndefined()
+    await expect(removeMobileRelayHostRoutings(['host-missing'])).resolves.toBeUndefined()
 
     expect(asyncStorage.getItem).toHaveBeenCalledOnce()
     expect(asyncStorage.setItem).not.toHaveBeenCalled()
diff --git a/mobile/src/transport/mobile-relay-host-overlay-store.ts b/mobile/src/transport/mobile-relay-host-overlay-store.ts
index 4960fbec3f08..85ef8b8c181d 100644
--- a/mobile/src/transport/mobile-relay-host-overlay-store.ts
+++ b/mobile/src/transport/mobile-relay-host-overlay-store.ts
@@ -1,6 +1,8 @@
 import AsyncStorage from '@react-native-async-storage/async-storage'
+import type { MobileRelayEndpoint } from '../../../src/shared/mobile-relay-credential-contract'
 import {
   MobileRelayHostOverlaySchema,
+  toStoredMobileRelayHostOverlay,
   type MobileRelayHostOverlay
 } from './mobile-relay-host-overlay'
 
@@ -37,74 +39,74 @@ async function readOverlaysForMutation(): Promise<MobileRelayHostOverlay[]> {
 
 async function mutateOverlays(
   update: (overlays: MobileRelayHostOverlay[]) => MobileRelayHostOverlay[]
-): Promise<void> {
+): Promise<boolean> {
   const mutation = overlayMutation.then(async () => {
     const current = await readOverlaysForMutation()
     const next = update(current)
-    // Why: direct-only saves commonly have no overlay to remove; avoid a full
-    // AsyncStorage write when cleanup leaves the durable list unchanged.
-    if (next !== current) {
-      await AsyncStorage.setItem(OVERLAY_STORAGE_KEY, JSON.stringify(next))
+    // Why: an update handing back the list it read changed nothing; skip the full AsyncStorage write.
+    if (next === current) {
+      return false
     }
+    await AsyncStorage.setItem(OVERLAY_STORAGE_KEY, JSON.stringify(next))
+    return true
   })
-  overlayMutation = mutation.catch(() => {})
+  overlayMutation = mutation.then(
+    () => {},
+    () => {}
+  )
   return mutation
 }
 
-export async function loadMobileRelayHostOverlays(
-  existingHostIds: ReadonlySet<string>
-): Promise<Map<string, MobileRelayHostOverlay>> {
-  return (await loadMobileRelayHostOverlayState(existingHostIds)).overlays
-}
-
-export async function loadMobileRelayHostOverlayState(
+export async function loadMobileRelayHostRoutingState(
   existingHostIds: ReadonlySet<string>
-): Promise<{ overlays: Map<string, MobileRelayHostOverlay>; orphanHostIds: string[] }> {
+): Promise<{ relays: Map<string, MobileRelayEndpoint>; orphanHostIds: string[] }> {
   await overlayMutation
   const overlays = parseOverlays(await AsyncStorage.getItem(OVERLAY_STORAGE_KEY)) ?? []
-  const active = new Map<string, MobileRelayHostOverlay>()
+  const relays = new Map<string, MobileRelayEndpoint>()
   const orphanHostIds: string[] = []
   for (const overlay of overlays) {
     // Why: an older app can remove the legacy base without knowing this
     // namespace; never let the retained overlay resurrect that host later.
-    if (existingHostIds.has(overlay.hostId)) {
-      active.set(overlay.hostId, overlay)
-    } else {
+    if (!existingHostIds.has(overlay.hostId)) {
       orphanHostIds.push(overlay.hostId)
+    } else if (overlay.relay) {
+      relays.set(overlay.hostId, overlay.relay)
     }
   }
-  return { overlays: active, orphanHostIds }
+  return { relays, orphanHostIds }
 }
 
-export async function saveMobileRelayHostOverlay(overlay: MobileRelayHostOverlay): Promise<void> {
-  const validated = MobileRelayHostOverlaySchema.parse(overlay)
+/** Resolves whether storage changed. */
+export function saveMobileRelayHostRouting(
+  hostId: string,
+  relay: MobileRelayEndpoint
+): Promise<boolean> {
+  const validated = toStoredMobileRelayHostOverlay(hostId, relay)
   return mutateOverlays((overlays) => {
-    const index = overlays.findIndex(({ hostId }) => hostId === validated.hostId)
+    const index = overlays.findIndex((overlay) => overlay.hostId === hostId)
     if (index === -1) {
       return [...overlays, validated]
     }
+    // Why: a failing relay loop re-resolves the same cell every retry. Both sides are this
+    // schema's output, so key order matches; an older record's direct entry fails the compare.
+    if (JSON.stringify(overlays[index]) === JSON.stringify(validated)) {
+      return overlays
+    }
     const next = overlays.slice()
     next[index] = validated
     return next
   })
 }
 
-export function removeMobileRelayHostOverlay(hostId: string): Promise<void> {
-  return removeMobileRelayHostOverlays([hostId])
+export function removeMobileRelayHostRouting(hostId: string): Promise<void> {
+  return removeMobileRelayHostRoutings([hostId])
 }
 
-export function removeMobileRelayHostOverlays(hostIds: readonly string[]): Promise<void> {
+export async function removeMobileRelayHostRoutings(hostIds: readonly string[]): Promise<void> {
   const targets = new Set(hostIds)
-  let removed = false
-  return mutateOverlays((overlays) => {
-    const next = overlays.filter((overlay) => {
-      if (!targets.has(overlay.hostId)) {
-        return true
-      }
-      removed = true
-      return false
-    })
-    return removed ? next : overlays
+  await mutateOverlays((overlays) => {
+    const next = overlays.filter((overlay) => !targets.has(overlay.hostId))
+    return next.length === overlays.length ? overlays : next
   })
 }
 
diff --git a/mobile/src/transport/mobile-relay-host-overlay.ts b/mobile/src/transport/mobile-relay-host-overlay.ts
index 59c407c9ee39..8076e7a0ad0a 100644
--- a/mobile/src/transport/mobile-relay-host-overlay.ts
+++ b/mobile/src/transport/mobile-relay-host-overlay.ts
@@ -1,7 +1,11 @@
 import { z } from 'zod'
-import { MobileRelayEndpointSchema } from '../../../src/shared/mobile-relay-credential-contract'
+import {
+  MobileRelayEndpointSchema,
+  type MobileRelayEndpoint
+} from '../../../src/shared/mobile-relay-credential-contract'
+import { relayConnectWebSocketUrl } from './mobile-relay-connect-url'
 
-export const MobileAccessEndpointSchema = z
+const MobileAccessEndpointSchema = z
   .object({
     id: z.string().min(1).max(128),
     kind: z.enum(['lan', 'tailscale', 'relay']),
@@ -9,6 +13,10 @@ export const MobileAccessEndpointSchema = z
   })
   .strict()
 
+/**
+ * The stored record, which shipped builds also read and write. Only `relay` is authoritative here:
+ * `endpoints` and `relayHostId` are derived copies kept so an older build still parses the record.
+ */
 export const MobileRelayHostOverlaySchema = z
   .object({
     v: z.literal(2),
@@ -43,5 +51,24 @@ export const MobileRelayHostOverlaySchema = z
     }
   })
 
-export type MobileAccessEndpoint = z.infer<typeof MobileAccessEndpointSchema>
 export type MobileRelayHostOverlay = z.infer<typeof MobileRelayHostOverlaySchema>
+
+// Why no direct entry: the host row owns the address, and a copy here outlived every Edit Host.
+export function toStoredMobileRelayHostOverlay(
+  hostId: string,
+  relay: MobileRelayEndpoint
+): MobileRelayHostOverlay {
+  return MobileRelayHostOverlaySchema.parse({
+    v: 2,
+    hostId,
+    endpoints: [
+      {
+        id: 'relay-primary',
+        kind: 'relay',
+        url: relayConnectWebSocketUrl(relay.cellUrl, relay.relayHostId)
+      }
+    ],
+    relayHostId: relay.relayHostId,
+    relay
+  })
+}
diff --git a/mobile/src/transport/mobile-relay-invite-director.ts b/mobile/src/transport/mobile-relay-invite-director.ts
index 408f83c8c095..5ae760240546 100644
--- a/mobile/src/transport/mobile-relay-invite-director.ts
+++ b/mobile/src/transport/mobile-relay-invite-director.ts
@@ -1,4 +1,5 @@
 import type { PairingRelay } from '../../../src/shared/mobile-relay-pairing-offer'
+import { relayConnectWebSocketUrl } from './mobile-relay-connect-url'
 import { RelayMovedSchema } from '../../../src/shared/mobile-relay-phone-protocol'
 
 export class RelayDirectorMoveNotNewerError extends Error {
@@ -28,7 +29,7 @@ export function resolvePairingInviteThroughDirector(args: {
   createSocket?: (url: string) => WebSocket
 }): Promise<PairingRelay> {
   const socket = (args.createSocket ?? ((url) => new WebSocket(url)))(
-    directorWebSocketUrl(args.relay)
+    relayConnectWebSocketUrl(args.relay.directorUrl, args.relay.relayHostId)
   )
   return new Promise((resolve, reject) => {
     let settled = false
@@ -101,10 +102,3 @@ export function resolvePairingInviteThroughDirector(args: {
     }
   })
 }
-
-export function directorWebSocketUrl(relay: PairingRelay): string {
-  const url = new URL(relay.directorUrl)
-  url.protocol = 'wss:'
-  url.pathname = `/v1/connect/${encodeURIComponent(relay.relayHostId)}`
-  return url.toString()
-}
diff --git a/mobile/src/transport/mobile-relay-orphan-cleanup.ts b/mobile/src/transport/mobile-relay-orphan-cleanup.ts
index fd57f01f9c97..14929890f4fd 100644
--- a/mobile/src/transport/mobile-relay-orphan-cleanup.ts
+++ b/mobile/src/transport/mobile-relay-orphan-cleanup.ts
@@ -1,14 +1,14 @@
 import { scheduleHostCredentialCleanup } from './host-credential-cleanup'
-import { removeMobileRelayHostOverlay } from './mobile-relay-host-overlay-store'
+import { removeMobileRelayHostRouting } from './mobile-relay-host-overlay-store'
 
 export async function scheduleOrphanedMobileRelayCleanup(args: {
   hostIds: string[]
   deleteCredential: (hostId: string) => Promise<void>
   scheduleCleanup?: typeof scheduleHostCredentialCleanup
-  removeOverlay?: typeof removeMobileRelayHostOverlay
+  removeOverlay?: typeof removeMobileRelayHostRouting
 }): Promise<void> {
   const scheduleCleanup = args.scheduleCleanup ?? scheduleHostCredentialCleanup
-  const removeOverlay = args.removeOverlay ?? removeMobileRelayHostOverlay
+  const removeOverlay = args.removeOverlay ?? removeMobileRelayHostRouting
   for (const hostId of new Set(args.hostIds)) {
     try {
       // Why: an older build may remove the legacy host while retaining the v2
diff --git a/mobile/src/transport/mobile-relay-outage-escalation.test.ts b/mobile/src/transport/mobile-relay-outage-escalation.test.ts
index 93694f1efacc..09eac93bf4fb 100644
--- a/mobile/src/transport/mobile-relay-outage-escalation.test.ts
+++ b/mobile/src/transport/mobile-relay-outage-escalation.test.ts
@@ -5,7 +5,8 @@ import {
   dependencies,
   FakeRelaySession,
   FakeSession,
-  host
+  host,
+  relay
 } from './mobile-endpoint-supervisor-test-fakes'
 import { RelayOuterError } from './mobile-relay-e2ee-link'
 import { createStableLogicalRpcClient } from './stable-logical-rpc-client'
@@ -40,7 +41,7 @@ describe('continuous Relay outage escalation', () => {
       openRelay,
       randomBytes: () => new Uint8Array([0, 0])
     })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     await supervisor.start()
     expect(openRelay).toHaveBeenCalledOnce()
diff --git a/mobile/src/transport/mobile-relay-pairing-recovery.test.ts b/mobile/src/transport/mobile-relay-pairing-recovery.test.ts
index 96d71b376805..e9024e23c246 100644
--- a/mobile/src/transport/mobile-relay-pairing-recovery.test.ts
+++ b/mobile/src/transport/mobile-relay-pairing-recovery.test.ts
@@ -6,7 +6,7 @@ import {
   resetMobileRelayPairingRecoveryForTests
 } from './mobile-relay-pairing-recovery'
 import type { PairingCandidateClient } from './mobile-relay-physical-client'
-import type { PairingOffer, RpcResponse } from './types'
+import type { HostProfile, PairingOffer, RpcResponse } from './types'
 
 vi.mock('react-native', () => ({ Platform: { OS: 'ios' } }))
 vi.mock('expo-crypto', () => ({ getRandomBytes: vi.fn() }))
@@ -92,6 +92,7 @@ function dependencies(args: {
   journal: ReturnType<typeof journal>
   connectRelay: ReturnType<typeof vi.fn>
   bundle?: MobileRelayCredentialBundle | null
+  hosts?: HostProfile[]
 }) {
   return {
     loadJournal: vi.fn(async () => args.journal),
@@ -101,8 +102,8 @@ function dependencies(args: {
     clearJournal: vi.fn(async () => {}),
     readCredentialBundle: vi.fn(async () => args.bundle ?? null),
     writeCredentialBundle: vi.fn(async () => {}),
-    loadHosts: vi.fn(async () => []),
-    saveHost: vi.fn(async () => {}),
+    loadHosts: vi.fn(async (): Promise<HostProfile[]> => args.hosts ?? []),
+    savePairedHost: vi.fn(async () => {}),
     connectRelay: args.connectRelay,
     resolveInviteDirector: vi.fn(async () => {
       throw new Error('director not needed')
@@ -139,7 +140,26 @@ describe('mobile relay pairing recovery', () => {
       })
     )
     expect(deps.writeCredentialBundle).toHaveBeenCalledOnce()
-    expect(deps.saveHost).toHaveBeenCalledOnce()
+    expect(deps.savePairedHost).toHaveBeenCalledOnce()
+    expect(deps.clearJournal).toHaveBeenCalledOnce()
+  })
+
+  it('clears a journal whose relay routing the host already carries, without dialing', async () => {
+    const saved = journal()
+    const connectRelay = vi.fn()
+    const bundle: MobileRelayCredentialBundle = {
+      v: 1,
+      hostId: 'host-1',
+      deviceToken: offer.deviceToken,
+      current: { token: 'C'.repeat(43), hash: 'D'.repeat(43), version: 1, expiresAt: now + 60_000 }
+    }
+    const { relay } = endpoints(saved, { state: 'not-found' })
+    const hosts = [{ ...saved.metadata.host, deviceToken: offer.deviceToken, relay }]
+    const deps = dependencies({ journal: saved, connectRelay, bundle, hosts })
+
+    await expect(recoverMobileRelayPairing(deps)).resolves.toBe('recovered')
+    expect(connectRelay).not.toHaveBeenCalled()
+    expect(deps.savePairedHost).not.toHaveBeenCalled()
     expect(deps.clearJournal).toHaveBeenCalledOnce()
   })
 
diff --git a/mobile/src/transport/mobile-relay-pairing-recovery.ts b/mobile/src/transport/mobile-relay-pairing-recovery.ts
index a6ecd6bbd5a7..c93baec9c0d0 100644
--- a/mobile/src/transport/mobile-relay-pairing-recovery.ts
+++ b/mobile/src/transport/mobile-relay-pairing-recovery.ts
@@ -1,11 +1,10 @@
 import { Platform } from 'react-native'
 import type {
   DeviceCredentialInstalled,
-  MobileRelayEndpoint,
   PairingGetEndpointsResult
 } from '../../../src/shared/mobile-relay-credential-contract'
 import type { PairingRelay } from '../../../src/shared/mobile-relay-pairing-offer'
-import { loadHosts, saveHost } from './host-store'
+import { loadHosts, savePairedHost } from './host-store'
 import {
   promotePairingJournalCredential,
   readMobileRelayCredentialBundle,
@@ -24,7 +23,7 @@ import {
   type PairingCandidateClient
 } from './mobile-relay-physical-client'
 import { createRecoveringPairingRelayCandidate } from './pairing-relay-candidate'
-import type { HostProfile } from './types'
+import { relayHost } from './pairing-relay-host'
 import {
   relayCredentialProvision,
   relayPairingEndpointsRead
@@ -39,7 +38,7 @@ type RecoveryDependencies = {
   readCredentialBundle: typeof readMobileRelayCredentialBundle
   writeCredentialBundle: typeof writeMobileRelayCredentialBundle
   loadHosts: typeof loadHosts
-  saveHost: typeof saveHost
+  savePairedHost: typeof savePairedHost
   connectRelay: typeof connectMobileRelayForPairing
   resolveInviteDirector: typeof resolvePairingInviteThroughDirector
   now: () => number
@@ -53,7 +52,7 @@ const defaultDependencies: RecoveryDependencies = {
   readCredentialBundle: readMobileRelayCredentialBundle,
   writeCredentialBundle: writeMobileRelayCredentialBundle,
   loadHosts,
-  saveHost,
+  savePairedHost,
   connectRelay: connectMobileRelayForPairing,
   resolveInviteDirector: resolvePairingInviteThroughDirector,
   now: Date.now,
@@ -97,7 +96,7 @@ async function runRecovery(
   const bundle = await dependencies.readCredentialBundle(journal.metadata.host.id).catch(() => null)
   const hosts = await dependencies.loadHosts().catch(() => [])
   const existing = hosts.find(({ id }) => id === journal!.metadata.host.id)
-  if (existing?.relayHostId === journal.metadata.relay.relayHostId && bundle) {
+  if (existing?.relay?.relayHostId === journal.metadata.relay.relayHostId && bundle) {
     await dependencies.clearJournal(journal.metadata.journalId)
     return 'recovered'
   }
@@ -266,27 +265,10 @@ async function publishCommitted(
   await dependencies.writeCredentialBundle(
     promotePairingJournalCredential({ journal: reconciledJournal, installed })
   )
-  await dependencies.saveHost(relayHost(reconciledJournal, endpoints.relay))
+  await dependencies.savePairedHost(relayHost(reconciledJournal, endpoints.relay))
   await dependencies.clearJournal(journal.metadata.journalId)
 }
 
-function relayHost(journal: MobileRelayPairingJournal, relay: MobileRelayEndpoint): HostProfile {
-  const host = journal.metadata.host
-  const url = new URL(relay.cellUrl)
-  url.protocol = 'wss:'
-  url.pathname = `/v1/connect/${encodeURIComponent(relay.relayHostId)}`
-  return {
-    ...host,
-    deviceToken: journal.secrets.deviceToken,
-    endpoints: [
-      { id: 'direct-primary', kind: 'lan', url: host.endpoint },
-      { id: 'relay-primary', kind: 'relay', url: url.toString() }
-    ],
-    relayHostId: relay.relayHostId,
-    relay
-  }
-}
-
 function pairingRelay(journal: MobileRelayPairingJournal): PairingRelay {
   return { ...journal.metadata.relay, inviteToken: journal.secrets.inviteToken }
 }
diff --git a/mobile/src/transport/mobile-relay-pairing-rejection-escalation.test.ts b/mobile/src/transport/mobile-relay-pairing-rejection-escalation.test.ts
index 89a0f6f0ef17..4fff86c46059 100644
--- a/mobile/src/transport/mobile-relay-pairing-rejection-escalation.test.ts
+++ b/mobile/src/transport/mobile-relay-pairing-rejection-escalation.test.ts
@@ -6,7 +6,8 @@ import {
   dependencies,
   FakeRelaySession,
   FakeSession,
-  host
+  host,
+  relay
 } from './mobile-endpoint-supervisor-test-fakes'
 import { MobileE2EEAuthenticationError } from './mobile-e2ee-v2-physical-channel'
 import { RelayOuterError } from './mobile-relay-e2ee-link'
@@ -65,7 +66,7 @@ describe('continuous Relay pairing-rejection escalation', () => {
       randomBytes: () => new Uint8Array([0, 0]),
       onLog: () => {}
     })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
     return { activeRelay, logical, openRelay, supervisor }
   }
 
diff --git a/mobile/src/transport/mobile-relay-physical-client.ts b/mobile/src/transport/mobile-relay-physical-client.ts
index 9e3e4c259f86..3df30542ffac 100644
--- a/mobile/src/transport/mobile-relay-physical-client.ts
+++ b/mobile/src/transport/mobile-relay-physical-client.ts
@@ -7,6 +7,7 @@ import { isRpcResponse } from './rpc-response-shape'
 import { redactSocketEndpoint } from './socket-event-debug'
 import type { ConnectionLogSink, RpcResponse } from './types'
 import { websocketPayloadToUint8 } from './websocket-payload-bytes'
+import { relayConnectWebSocketUrl } from './mobile-relay-connect-url'
 export { RelayOuterError } from './mobile-relay-e2ee-link'
 import { RelayOuterError } from './mobile-relay-e2ee-link'
 
@@ -34,7 +35,7 @@ export function connectMobileRelayForPairing(args: {
   onLog?: ConnectionLogSink
 }): PairingCandidateClient {
   const requestTimeoutMs = args.requestTimeoutMs ?? 30_000
-  const socketUrl = relayPhoneWebSocketUrl(args.relay)
+  const socketUrl = relayConnectWebSocketUrl(args.relay.cellUrl, args.relay.relayHostId)
   const log = createPairingRelayLogger(args.onLog)
   const cellHost = redactSocketEndpoint(socketUrl)
   log('info', 'Relay: dialing cell', cellHost)
@@ -208,13 +209,6 @@ export function connectMobileRelayForPairing(args: {
   }
 }
 
-export function relayPhoneWebSocketUrl(relay: PairingRelay): string {
-  const url = new URL(relay.cellUrl)
-  url.protocol = 'wss:'
-  url.pathname = `/v1/connect/${encodeURIComponent(relay.relayHostId)}`
-  return url.toString()
-}
-
 function asError(error: unknown): Error {
   return error instanceof Error ? error : new Error(String(error))
 }
diff --git a/mobile/src/transport/mobile-relay-rpc-stream-cancellation.test.ts b/mobile/src/transport/mobile-relay-rpc-stream-cancellation.test.ts
index 0a7a25dfbd7d..d58ebd229e40 100644
--- a/mobile/src/transport/mobile-relay-rpc-stream-cancellation.test.ts
+++ b/mobile/src/transport/mobile-relay-rpc-stream-cancellation.test.ts
@@ -101,7 +101,7 @@ describe('mobile relay subscription cancellation', () => {
       'terminal.subscribe',
       { terminal: 'term', client: { id: 'phone' } },
       'terminal.unsubscribe',
-      { subscriptionId: 'term:phone', client: { id: 'phone' } }
+      { subscriptionId: 'term:phone', client: { id: 'phone' }, requestId: 'request-1' }
     ],
     [
       'session.tabs.subscribe',
@@ -218,6 +218,25 @@ describe('mobile relay subscription cancellation', () => {
     }
   )
 
+  it('keeps skipping for a live newer terminal sibling though each unsubscribe names its request', async () => {
+    const { streams, sendFrame } = createStreams()
+    const params = { terminal: 'term', client: { id: 'phone' } }
+    const cancelOlder = streams.subscribe('terminal.subscribe', params, vi.fn())
+    const cancelNewer = streams.subscribe('terminal.subscribe', { ...params }, vi.fn())
+    await Promise.resolve()
+
+    // A host without request addressing ends the slot, which the newer stream now owns.
+    cancelOlder()
+    expect(sendFrame).toHaveBeenCalledTimes(2)
+
+    cancelNewer()
+    expect(sendFrame).toHaveBeenLastCalledWith({
+      id: 'request-3',
+      method: 'terminal.unsubscribe',
+      params: { subscriptionId: 'term:phone', client: { id: 'phone' }, requestId: 'request-2' }
+    })
+  })
+
   it('still unsubscribes a shared-token nativeChat stream when the sibling is unsent', async () => {
     const wait = Promise.withResolvers<void>()
     let connected = false
diff --git a/mobile/src/transport/mobile-relay-rpc-streams.ts b/mobile/src/transport/mobile-relay-rpc-streams.ts
index 3af5b2b3f5e5..ad996b3811f8 100644
--- a/mobile/src/transport/mobile-relay-rpc-streams.ts
+++ b/mobile/src/transport/mobile-relay-rpc-streams.ts
@@ -29,7 +29,7 @@ type StreamRecord = {
   receivedSnapshot?: boolean
 }
 
-type StreamUnsubscribe = { method: string; params: unknown }
+type StreamUnsubscribe = { method: string; params: Record<string, unknown> }
 
 /** Unsubscribe derived from the subscribe params alone (no server-assigned id). */
 function buildParamsUnsubscribe(
@@ -194,7 +194,7 @@ export class MobileRelayRpcStreams {
       const byParams = buildParamsUnsubscribe(stream.method, stream.params, id)
       if (stream.method === 'terminal.subscribe') {
         if (byParams) {
-          this.sendUnsubscribe(byParams)
+          this.sendUnsubscribe(byParams, id)
         }
       } else {
         const unsubscribe = stream.subscriptionId
@@ -224,11 +224,15 @@ export class MobileRelayRpcStreams {
 
   /** Skip the unsubscribe when a live sibling shares the host cleanup token (e.g. nativeChat's
    *  deterministic `agent:sessionId`), since the host would evict the sibling's registration. */
-  private sendUnsubscribe(unsubscribe: StreamUnsubscribe): void {
+  private sendUnsubscribe(unsubscribe: StreamUnsubscribe, terminalRequestId?: string): void {
     if (this.hasLiveOwner(unsubscribe)) {
       return
     }
-    this.options.sendFrame({ id: this.options.nextId(), ...unsubscribe })
+    // Why: added after the sibling check; an old host strips it and would evict the live sibling.
+    const params = terminalRequestId
+      ? { ...unsubscribe.params, requestId: terminalRequestId }
+      : unsubscribe.params
+    this.options.sendFrame({ id: this.options.nextId(), method: unsubscribe.method, params })
   }
 
   private hasLiveOwner(unsubscribe: StreamUnsubscribe): boolean {
diff --git a/mobile/src/transport/mobile-relay-runtime-failover.test.ts b/mobile/src/transport/mobile-relay-runtime-failover.test.ts
index e7e299209eda..0a9cc8590c9a 100644
--- a/mobile/src/transport/mobile-relay-runtime-failover.test.ts
+++ b/mobile/src/transport/mobile-relay-runtime-failover.test.ts
@@ -199,15 +199,6 @@ const host: HostProfile = {
   deviceToken: 'device-token',
   publicKeyB64: 'A'.repeat(44),
   lastConnected: 1,
-  endpoints: [
-    { id: 'direct-primary', kind: 'lan', url: DIRECT_ENDPOINT },
-    {
-      id: 'relay-primary',
-      kind: 'relay',
-      url: 'wss://relay-c1.onorca.dev/v1/connect/id'
-    }
-  ],
-  relayHostId: relay.relayHostId,
   relay
 }
 
@@ -234,7 +225,8 @@ function dependencies(
     resolveRelay: vi.fn(async ({ relay }) => relay),
     readBundle: vi.fn(async () => bundleWith(2, Number.MAX_SAFE_INTEGER)),
     writeBundle: vi.fn(async () => {}),
-    saveHost: vi.fn(async () => {}),
+    setRelayRouting: vi.fn(async () => {}),
+    directPath: 'lan',
     now: Date.now,
     randomBytes: (length: number) => new Uint8Array(length),
     setTimer: (handler, ms) => setTimeout(handler, ms),
@@ -265,7 +257,7 @@ describe('relay runtime recovery without direct connectivity', () => {
       .fn(async () => bundleWith(3, Number.MAX_SAFE_INTEGER))
       .mockResolvedValueOnce(bundleWith(2, Number.MAX_SAFE_INTEGER))
     const deps = dependencies({ openRelay, readBundle })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     await supervisor.start()
     await vi.advanceTimersByTimeAsync(0)
@@ -290,7 +282,7 @@ describe('relay runtime recovery without direct connectivity', () => {
       .fn(async () => bundleWith(2, Number.MAX_SAFE_INTEGER))
       .mockResolvedValueOnce(null)
     const deps = dependencies({ readBundle })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     // Pre-fix, a null first read killed relay recovery for the process lifetime.
     await supervisor.start()
@@ -306,7 +298,7 @@ describe('relay runtime recovery without direct connectivity', () => {
     const expired = bundleWith(2, Date.now() - 1)
     const readBundle = vi.fn(async () => expired)
     const deps = dependencies({ readBundle })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     await supervisor.start()
     await vi.advanceTimersByTimeAsync(0)
@@ -333,7 +325,7 @@ describe('relay runtime recovery without direct connectivity', () => {
       )
       .mockImplementation(() => new FakeRelaySession('connected'))
     const deps = dependencies({ openRelay })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     await supervisor.start()
     await vi.advanceTimersByTimeAsync(0)
@@ -356,7 +348,7 @@ describe('relay runtime recovery without direct connectivity', () => {
       .mockResolvedValueOnce(expired)
       .mockResolvedValueOnce(expired)
     const deps = dependencies({ readBundle })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     await supervisor.start()
     await vi.advanceTimersByTimeAsync(0)
@@ -386,7 +378,7 @@ describe('relay runtime recovery without direct connectivity', () => {
       .fn(async () => bundleWith(1, Number.MAX_SAFE_INTEGER))
       .mockResolvedValueOnce(bundleWith(4, Number.MAX_SAFE_INTEGER))
     const deps = dependencies({ openRelay, readBundle })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     await supervisor.start()
     await vi.advanceTimersByTimeAsync(0)
@@ -414,7 +406,7 @@ describe('relay runtime recovery without direct connectivity', () => {
     // confuse the churn measurement by migrating back to direct.
     const openDirect = vi.fn(() => new FakeSession('disconnected'))
     const deps = dependencies({ openRelay, openDirect })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     await supervisor.start()
     await vi.advanceTimersByTimeAsync(0)
@@ -435,7 +427,7 @@ describe('relay runtime recovery without direct connectivity', () => {
       )
       .mockImplementation(() => new FakeRelaySession('connected'))
     const deps = dependencies({ openRelay })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     await supervisor.start()
     await vi.advanceTimersByTimeAsync(0)
@@ -453,7 +445,7 @@ describe('relay runtime recovery without direct connectivity', () => {
   it('restarts Relay promptly after the background grace expires', async () => {
     const logical = new FakeLogicalClient('connected', 'relay')
     const deps = dependencies({ openDirect: vi.fn(() => new FakeSession('disconnected')) })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     await supervisor.start()
     expect(deps.openRelay).not.toHaveBeenCalled()
@@ -476,7 +468,7 @@ describe('relay runtime recovery without direct connectivity', () => {
   it('recovers an expired background Relay through the app-resume manual retry nudge', async () => {
     const logical = new FakeLogicalClient('connected', 'relay')
     const deps = dependencies({ openDirect: vi.fn(() => new FakeSession('disconnected')) })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     await supervisor.start()
     supervisor.setForeground(false)
@@ -539,7 +531,7 @@ describe('failover with a real direct rpc-client', () => {
       'tailscale' as MobileConnectionPath
     )
     const deps = dependencies()
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     await supervisor.start()
     await vi.advanceTimersByTimeAsync(3_000)
@@ -561,7 +553,7 @@ describe('failover with a real direct rpc-client', () => {
         return bundleWith(2, Number.MAX_SAFE_INTEGER)
       })
     })
-    const supervisor = new MobileEndpointSupervisor(logical, host, deps)
+    const supervisor = new MobileEndpointSupervisor(logical, host.id, relay, deps)
 
     const started = supervisor.start()
     await vi.advanceTimersByTimeAsync(300)
diff --git a/mobile/src/transport/mobile-relay-session-establisher.ts b/mobile/src/transport/mobile-relay-session-establisher.ts
index e50a977500ad..959f015752c4 100644
--- a/mobile/src/transport/mobile-relay-session-establisher.ts
+++ b/mobile/src/transport/mobile-relay-session-establisher.ts
@@ -12,7 +12,6 @@ import type { RelayReconnectController } from './mobile-relay-reconnect-controll
 import type { StableLogicalRpcClient } from './stable-logical-rpc-client'
 import type { MobileRelayEndpoint } from '../../../src/shared/mobile-relay-credential-contract'
 import { RELAY_HOST_CLOSE_REASON } from '../../../src/shared/relay-host-close-reason'
-import type { HostProfile } from './types'
 
 type EstablishResult = { ok: true } | { ok: false; error: Error }
 
@@ -23,8 +22,10 @@ function directWon(logical: StableLogicalRpcClient): boolean {
 // Turns one relay credential into the active runtime session: resolve the cell
 // assignment if the director rejects the cached one, open the cell socket,
 // migrate the logical client onto it, then persist the resume confirmation and
-// re-arm the supervisor's timers.
+// re-arm the supervisor's timers. Owns the relay it dials.
 export class MobileRelaySessionEstablisher {
+  private relay: MobileRelayEndpoint
+
   constructor(
     private readonly args: {
       logical: StableLogicalRpcClient
@@ -34,9 +35,11 @@ export class MobileRelaySessionEstablisher {
       writeBundle: (bundle: MobileRelayCredentialBundle) => Promise<void>
       isActive: () => boolean
       isForeground: () => boolean
-      relay: () => HostProfile['relay']
+      isStopped: () => boolean
+      hostId: string
+      relay: MobileRelayEndpoint
       resolveRelay: MobileEndpointSupervisorDependencies['resolveRelay']
-      persistResolvedRelay: (resolved: MobileRelayEndpoint) => Promise<void>
+      setRelayRouting: MobileEndpointSupervisorDependencies['setRelayRouting']
       bundle: () => MobileRelayCredentialBundle | null
       adoptBundle: (bundle: MobileRelayCredentialBundle) => void
       // Hysteresis stamp + rotation-pending clear + recovery log line.
@@ -47,7 +50,18 @@ export class MobileRelaySessionEstablisher {
       onBookkeepingError: (error: Error) => void
       onDialFailure: (error: Error) => void
     }
-  ) {}
+  ) {
+    this.relay = args.relay
+  }
+
+  async adoptRelay(relay: MobileRelayEndpoint): Promise<void> {
+    // Why: a stopped supervisor's host may be removed or re-paired; its successor owns routing.
+    if (this.args.isStopped()) {
+      return
+    }
+    await this.args.setRelayRouting(this.args.hostId, relay)
+    this.relay = relay
+  }
 
   // Tries each eligible credential until one establishes. Only a grace-repairable
   // failure (BAD_OUTER_CREDENTIAL) moves on to the next credential.
@@ -81,10 +95,10 @@ export class MobileRelaySessionEstablisher {
   dial(credential: { token: string; version: number }): Promise<EstablishResult> {
     return dialRelayThroughDirectorFallback({
       resumeToken: credential.token,
-      relay: this.args.relay,
+      relay: () => this.relay,
       dial: () => this.establish(credential),
       resolveRelay: this.args.resolveRelay,
-      persistResolvedRelay: this.args.persistResolvedRelay
+      persistResolvedRelay: (resolved) => this.adoptRelay(resolved)
     })
   }
 
@@ -93,14 +107,13 @@ export class MobileRelaySessionEstablisher {
     version: number
   }): Promise<EstablishResult> {
     const { args } = this
-    const relay = args.relay()
     const bundle = args.bundle()
     // Why: director resolution and grace fallback can finish after background/stop.
-    if (!args.isActive() || !relay || !bundle) {
+    if (!args.isActive() || !bundle) {
       return { ok: false, error: new RelayDialAbortedError() }
     }
     const session = args.openRelay(
-      relay,
+      this.relay,
       credential,
       `confirm-${encodeBase64Url(args.randomBytes(16))}`,
       // Asserted on the controller's latch, not on the dial result: the close
diff --git a/mobile/src/transport/mobile-web-bundle-compat.test.ts b/mobile/src/transport/mobile-web-bundle-compat.test.ts
index 639d41ef7db1..4fea3dab1767 100644
--- a/mobile/src/transport/mobile-web-bundle-compat.test.ts
+++ b/mobile/src/transport/mobile-web-bundle-compat.test.ts
@@ -25,6 +25,7 @@ function manifest(
     schemaVersion: 1,
     runtimeProtocolVersion: 3,
     minCompatibleRuntimeProtocolVersion: 2,
+    pageVersion: 1,
     ...overrides
   }
 }
@@ -189,3 +190,40 @@ describe('evaluateMobileWebBundleCompat', () => {
     expect(SUPPORTED_MOBILE_WEB_BUNDLE_SCHEMA_VERSIONS).toContain(MOBILE_WEB_BUNDLE_SCHEMA_VERSION)
   })
 })
+
+/** The shell requires a page at least as new as itself; an older desktop is walled, never served. */
+describe('the page floor', () => {
+  const tooOld = (pageVersion: number) => ({
+    kind: 'blocked',
+    reason: 'bundle-incompatible',
+    side: 'desktop',
+    pageVersion,
+    requiredPageVersion: 1
+  })
+
+  it('walls a desktop whose page is older than this shell, as a desktop to update', () => {
+    expect(evaluate({ manifest: manifest({ pageVersion: 0 }) })).toEqual(tooOld(0))
+  })
+
+  it('reads a manifest with no page version as older than the floor', () => {
+    const { schemaVersion, runtimeProtocolVersion, minCompatibleRuntimeProtocolVersion } =
+      manifest()
+    const unversioned = {
+      schemaVersion,
+      runtimeProtocolVersion,
+      minCompatibleRuntimeProtocolVersion
+    }
+    expect(evaluate({ manifest: unversioned })).toEqual(tooOld(0))
+  })
+
+  it('opens a page at the floor and one above it', () => {
+    expect(evaluate({ manifest: manifest({ pageVersion: 1 }) })).toEqual({
+      kind: 'ok',
+      manifestChecked: true
+    })
+    expect(evaluate({ manifest: manifest({ pageVersion: 7 }) })).toEqual({
+      kind: 'ok',
+      manifestChecked: true
+    })
+  })
+})
diff --git a/mobile/src/transport/mobile-web-bundle-compat.ts b/mobile/src/transport/mobile-web-bundle-compat.ts
index b331540df669..d039816be14b 100644
--- a/mobile/src/transport/mobile-web-bundle-compat.ts
+++ b/mobile/src/transport/mobile-web-bundle-compat.ts
@@ -1,6 +1,10 @@
 import { MOBILE_WEB_BUNDLE_CAPABILITY } from '../../../src/shared/mobile-web-bundle/mobile-web-bundle-capability'
 import type { HostStatusReply } from './host-status-reply-schema'
 
+/** The oldest page this shell serves: the `MOBILE_WEB_PAGE_VERSION` of the page built beside it. An
+ *  older desktop is walled rather than served, so the shell keeps no path for an older page. */
+export const MOBILE_WEB_PAGE_VERSION_FLOOR = 1
+
 /** The manifest schemas this app shell can mount. Widening it is a shell release, so the list is
  *  stated here rather than read off the contract's current version: the contract names the schema
  *  the desktop writes, which is exactly the number this shell may not recognise. */
@@ -24,6 +28,8 @@ export type MobileWebBundleCompatManifest = {
   schemaVersion: number
   runtimeProtocolVersion: number
   minCompatibleRuntimeProtocolVersion: number
+  /** Absent from a desktop older than the field, which reads as 0: below every floor. */
+  pageVersion?: number
 }
 
 export type MobileWebBundleCompatVerdict =
@@ -42,6 +48,14 @@ export type MobileWebBundleCompatVerdict =
       hostProtocolVersion: number
       requiredHostProtocolVersion: number
     }
+  /** The host serves a page older than this shell's floor. */
+  | {
+      kind: 'blocked'
+      reason: 'bundle-incompatible'
+      side: 'desktop'
+      pageVersion: number
+      requiredPageVersion: number
+    }
   /** The bundle is older than the host expects; the caller refetches. */
   | {
       kind: 'blocked'
@@ -90,6 +104,16 @@ export function evaluateMobileWebBundleCompat(input: {
       schemaVersion: manifest.schemaVersion
     }
   }
+  const pageVersion = manifest.pageVersion ?? 0
+  if (pageVersion < MOBILE_WEB_PAGE_VERSION_FLOOR) {
+    return {
+      kind: 'blocked',
+      reason: 'bundle-incompatible',
+      side: 'desktop',
+      pageVersion,
+      requiredPageVersion: MOBILE_WEB_PAGE_VERSION_FLOOR
+    }
+  }
   const hostProtocolVersion = input.hostStatus.protocolVersion ?? 0
   if (hostProtocolVersion < manifest.minCompatibleRuntimeProtocolVersion) {
     return {
diff --git a/mobile/src/transport/mobile-web-bundle-reply-schemas.test.ts b/mobile/src/transport/mobile-web-bundle-reply-schemas.test.ts
index ca00eca79515..57f5618763ab 100644
--- a/mobile/src/transport/mobile-web-bundle-reply-schemas.test.ts
+++ b/mobile/src/transport/mobile-web-bundle-reply-schemas.test.ts
@@ -55,6 +55,7 @@ function manifestReply(overrides: Record<string, unknown> = {}) {
     desktopVersion: '1.4.200',
     minCompatibleRuntimeProtocolVersion: 2,
     runtimeProtocolVersion: 2,
+    pageVersion: 1,
     entrypoint: 'index.html',
     totalBytes: 12,
     assets: [asset()],
@@ -234,6 +235,16 @@ describe('mobile web bundle manifest reply reader', () => {
     expect(verdict).toEqual({ kind: 'ok', manifestChecked: true })
   })
 
+  it('reads the page version the floor compares, and one a desktop older than it never wrote', () => {
+    expect(MobileWebBundleManifestReplySchema.parse(manifestReply()).manifest.pageVersion).toBe(1)
+    expect(readManifest(manifestReply({ pageVersion: undefined })).compatible).toBe(true)
+    for (const pageVersion of [-1, 1.5, 'one', null]) {
+      expect(readManifest(manifestReply({ pageVersion })).compatible, String(pageVersion)).toBe(
+        false
+      )
+    }
+  })
+
   it('refuses a manifest with no protocol window, which only a host without the capability sends', () => {
     expect(readManifest(manifestReply({ runtimeProtocolVersion: undefined })).compatible).toBe(
       false
diff --git a/mobile/src/transport/mobile-web-bundle-reply-schemas.ts b/mobile/src/transport/mobile-web-bundle-reply-schemas.ts
index ea68e7dbd142..be9b7bf40add 100644
--- a/mobile/src/transport/mobile-web-bundle-reply-schemas.ts
+++ b/mobile/src/transport/mobile-web-bundle-reply-schemas.ts
@@ -72,6 +72,7 @@ export const MobileWebBundleManifestReadSchema = z
     buildId: z.string().regex(SHA256_PATTERN),
     minCompatibleRuntimeProtocolVersion: z.number().int().nonnegative(),
     runtimeProtocolVersion: z.number().int().nonnegative(),
+    pageVersion: z.number().int().nonnegative().optional(),
     entrypoint: MobileWebBundleAssetPathSchema,
     totalBytes: z.number().int().nonnegative().max(MOBILE_WEB_BUNDLE_MAX_TOTAL_BYTES),
     assets: z.array(assetSchema).min(1).max(MOBILE_WEB_BUNDLE_MAX_ASSETS),
diff --git a/mobile/src/transport/mobile-web-page-version-floor.test.ts b/mobile/src/transport/mobile-web-page-version-floor.test.ts
new file mode 100644
index 000000000000..284e136e7cc8
--- /dev/null
+++ b/mobile/src/transport/mobile-web-page-version-floor.test.ts
@@ -0,0 +1,9 @@
+import { describe, expect, it } from 'vitest'
+import { MOBILE_WEB_PAGE_VERSION } from '../../../src/shared/mobile-web-bundle/manifest-contract'
+import { MOBILE_WEB_PAGE_VERSION_FLOOR } from './mobile-web-bundle-compat'
+
+describe("the shell's page floor", () => {
+  it('never requires a page newer than the one built beside this shell', () => {
+    expect(MOBILE_WEB_PAGE_VERSION_FLOOR).toBeLessThanOrEqual(MOBILE_WEB_PAGE_VERSION)
+  })
+})
diff --git a/mobile/src/transport/paired-host-writer-census.test.ts b/mobile/src/transport/paired-host-writer-census.test.ts
new file mode 100644
index 000000000000..aa7ac0c4f564
--- /dev/null
+++ b/mobile/src/transport/paired-host-writer-census.test.ts
@@ -0,0 +1,39 @@
+/**
+ * Who may write a whole host profile: pairing, which creates or re-pairs it.
+ *
+ * A relay learner (supervisor, credential rotation, direct upgrade) holds a snapshot taken when its
+ * connection opened, so a full-profile save from it reverts any Edit Host made since. Those write
+ * through `setRelayRouting`, which takes no profile.
+ */
+import { readFileSync } from 'node:fs'
+import { join, relative } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { describe, expect, it } from 'vitest'
+import { censusSourceFiles } from '../test-support/census-source-files'
+
+const MOBILE_DIR = fileURLToPath(new URL('../../', import.meta.url))
+
+const PAIRING_WRITERS = [
+  'src/transport/mobile-relay-pairing-recovery.ts',
+  'src/transport/pre-profile-pairing-coordinator.ts'
+]
+
+// A value import of `savePairedHost` from the host store, at any relative depth.
+const IMPORTS_PAIRED_HOST_WRITER =
+  /import\s*\{[^}]*\bsavePairedHost\b[^}]*\}\s*from\s*['"](?:\.{1,2}\/)+(?:[\w-]+\/)*host-store['"]/
+
+function importingFiles(): string[] {
+  return ['src', 'app']
+    .flatMap((directory) => censusSourceFiles(join(MOBILE_DIR, directory)))
+    .filter((file) => /\.tsx?$/.test(file) && !/\.test\.tsx?$/.test(file))
+    .filter((file) => IMPORTS_PAIRED_HOST_WRITER.test(readFileSync(file, 'utf8')))
+    .map((file) => relative(MOBILE_DIR, file))
+    .sort()
+}
+
+describe('full host profile writes', () => {
+  it('are reachable only from pairing', () => {
+    // Also the presence precondition: both creators must match, or the matcher is broken.
+    expect(importingFiles()).toEqual(PAIRING_WRITERS)
+  })
+})
diff --git a/mobile/src/transport/pairing-relay-host.ts b/mobile/src/transport/pairing-relay-host.ts
index 4954b079fc92..a8ce6a96534c 100644
--- a/mobile/src/transport/pairing-relay-host.ts
+++ b/mobile/src/transport/pairing-relay-host.ts
@@ -10,23 +10,7 @@ export function relayHost(
   relay: MobileRelayEndpoint
 ): HostProfile {
   const host = journal.metadata.host
-  return {
-    ...host,
-    deviceToken: journal.secrets.deviceToken,
-    endpoints: [
-      { id: 'direct-primary', kind: 'lan', url: host.endpoint },
-      { id: 'relay-primary', kind: 'relay', url: relayWebSocketUrl(relay) }
-    ],
-    relayHostId: relay.relayHostId,
-    relay
-  }
-}
-
-export function relayWebSocketUrl(relay: MobileRelayEndpoint): string {
-  const url = new URL(relay.cellUrl)
-  url.protocol = 'wss:'
-  url.pathname = `/v1/connect/${encodeURIComponent(relay.relayHostId)}`
-  return url.toString()
+  return { ...host, deviceToken: journal.secrets.deviceToken, relay }
 }
 
 export function assertCommittedInstall(
diff --git a/mobile/src/transport/pre-profile-pairing-coordinator.test.ts b/mobile/src/transport/pre-profile-pairing-coordinator.test.ts
index bff67eadf2c8..0a4484f59c39 100644
--- a/mobile/src/transport/pre-profile-pairing-coordinator.test.ts
+++ b/mobile/src/transport/pre-profile-pairing-coordinator.test.ts
@@ -108,7 +108,7 @@ function dependencies(client: RpcClient, events: string[]) {
       id: hostId,
       name: 'Blue Whale'
     })),
-    saveHost: vi.fn(async (_host: HostProfile) => {
+    savePairedHost: vi.fn(async (_host: HostProfile) => {
       events.push('save-host')
     }),
     saveJournal: vi.fn(async (_journal: MobileRelayPairingJournal) => {
@@ -171,7 +171,7 @@ describe('pre-profile pairing coordinator', () => {
     })
 
     await expect(attempt.result).resolves.toEqual({ hostId: `host-${now}` })
-    expect(deps.saveHost).toHaveBeenCalledWith({
+    expect(deps.savePairedHost).toHaveBeenCalledWith({
       id: `host-${now}`,
       name: 'Blue Whale',
       endpoint: directOffer.endpoint,
@@ -201,7 +201,7 @@ describe('pre-profile pairing coordinator', () => {
     })
 
     await expect(attempt.result).resolves.toEqual({ hostId: 'host-existing' })
-    expect(deps.saveHost).toHaveBeenCalledWith({
+    expect(deps.savePairedHost).toHaveBeenCalledWith({
       id: 'host-existing',
       name: 'Studio Mac',
       endpoint: directOffer.endpoint,
@@ -238,7 +238,7 @@ describe('pre-profile pairing coordinator', () => {
     })
 
     await expect(attempt.result).resolves.toEqual({ hostId: `host-${now}` })
-    expect(deps.saveHost).toHaveBeenCalledOnce()
+    expect(deps.savePairedHost).toHaveBeenCalledOnce()
     expect(deps.recordDescriptorFromStatus).not.toHaveBeenCalled()
   })
 
@@ -256,7 +256,7 @@ describe('pre-profile pairing coordinator', () => {
     })
 
     await expect(attempt.result).resolves.toEqual({ hostId: `host-${now}` })
-    expect(deps.saveHost).toHaveBeenCalledOnce()
+    expect(deps.savePairedHost).toHaveBeenCalledOnce()
   })
 
   it('journals before connecting and publishes only after authoritative direct install', async () => {
@@ -327,19 +327,11 @@ describe('pre-profile pairing coordinator', () => {
       reqId: journal!.metadata.installReqId,
       newResumeTokenHash: journal!.metadata.pendingResumeTokenHash
     })
-    expect(deps.saveHost).toHaveBeenCalledWith(
+    expect(deps.savePairedHost).toHaveBeenCalledWith(
       expect.objectContaining({
         id: `host-${now}`,
         endpoint: directOffer.endpoint,
-        relayHostId: relayOffer.relay!.relayHostId,
-        endpoints: [
-          { id: 'direct-primary', kind: 'lan', url: directOffer.endpoint },
-          {
-            id: 'relay-primary',
-            kind: 'relay',
-            url: `wss://relay-c1.onorca.dev/v1/connect/${relayOffer.relay!.relayHostId}`
-          }
-        ]
+        relay: expect.objectContaining({ relayHostId: relayOffer.relay!.relayHostId })
       })
     )
   })
@@ -356,8 +348,8 @@ describe('pre-profile pairing coordinator', () => {
     })
     await expect(attempt.result).resolves.toEqual({ hostId: `host-${now}` })
 
-    expect(deps.saveHost).toHaveBeenCalledWith(
-      expect.not.objectContaining({ endpoints: expect.anything() })
+    expect(deps.savePairedHost).toHaveBeenCalledWith(
+      expect.not.objectContaining({ relay: expect.anything() })
     )
     expect(events).toEqual([
       'save-journal',
@@ -388,8 +380,8 @@ describe('pre-profile pairing coordinator', () => {
     })
     await expect(attempt.result).resolves.toEqual({ hostId: `host-${now}` })
 
-    expect(deps.saveHost).toHaveBeenCalledWith(
-      expect.not.objectContaining({ endpoints: expect.anything() })
+    expect(deps.savePairedHost).toHaveBeenCalledWith(
+      expect.not.objectContaining({ relay: expect.anything() })
     )
     expect(events).toEqual([
       'save-journal',
@@ -550,6 +542,6 @@ describe('pre-profile pairing coordinator', () => {
 
     await expect(attempt.result).rejects.toThrow(/cancelled/)
     expect(client.close).toHaveBeenCalledOnce()
-    expect(deps.saveHost).not.toHaveBeenCalled()
+    expect(deps.savePairedHost).not.toHaveBeenCalled()
   })
 })
diff --git a/mobile/src/transport/pre-profile-pairing-coordinator.ts b/mobile/src/transport/pre-profile-pairing-coordinator.ts
index 0939938bec39..58b1c7931181 100644
--- a/mobile/src/transport/pre-profile-pairing-coordinator.ts
+++ b/mobile/src/transport/pre-profile-pairing-coordinator.ts
@@ -1,6 +1,6 @@
 import { Platform } from 'react-native'
 import { connect, type ConnectOptions } from './rpc-client'
-import { resolvePairingHostIdentity, saveHost } from './host-store'
+import { resolvePairingHostIdentity, savePairedHost } from './host-store'
 import type { HostProfile, PairingOffer } from './types'
 import { isPairingRelayRpcUnavailable } from './pairing-relay-rpc-unavailable'
 import {
@@ -45,7 +45,7 @@ type Dependencies = {
   connectRelay: typeof connectMobileRelayForPairing
   resolveInviteDirector: typeof resolvePairingInviteThroughDirector
   resolveHostIdentity: typeof resolvePairingHostIdentity
-  saveHost: typeof saveHost
+  savePairedHost: typeof savePairedHost
   saveJournal: typeof saveMobileRelayPairingJournal
   updateJournal: typeof updateMobileRelayPairingJournal
   clearJournal: typeof clearMobileRelayPairingJournal
@@ -60,7 +60,7 @@ const defaultDependencies: Dependencies = {
   connectRelay: connectMobileRelayForPairing,
   resolveInviteDirector: resolvePairingInviteThroughDirector,
   resolveHostIdentity: resolvePairingHostIdentity,
-  saveHost,
+  savePairedHost,
   saveJournal: saveMobileRelayPairingJournal,
   updateJournal: updateMobileRelayPairingJournal,
   clearJournal: clearMobileRelayPairingJournal,
@@ -206,7 +206,7 @@ async function runPairing(
   assertActive(isDisposed)
 
   if (!journal) {
-    await dependencies.saveHost(baseHost(offer, hostId, hostName, now))
+    await dependencies.savePairedHost(baseHost(offer, hostId, hostName, now))
     recordWinnerDescriptor(dependencies, hostId, winner.status)
     return { hostId }
   }
@@ -231,7 +231,7 @@ async function runPairing(
     // Why: this commits a LAN-only host instead of failing, so the refusal code is the only
     // record of why the phone never got a relay endpoint.
     log('info', 'Relay: desktop will not serve relay pairing', provision.error.code)
-    await dependencies.saveHost(baseHost(offer, hostId, hostName, now))
+    await dependencies.savePairedHost(baseHost(offer, hostId, hostName, now))
     await dependencies.clearJournal(journal.metadata.journalId)
     recordWinnerDescriptor(dependencies, hostId, winner.status)
     return { hostId }
@@ -247,7 +247,7 @@ async function runPairing(
   }
   assertActive(isDisposed)
   await dependencies.writeCredentialBundle(promotePairingJournalCredential({ journal, installed }))
-  await dependencies.saveHost(relayHost(journal, endpoints.relay))
+  await dependencies.savePairedHost(relayHost(journal, endpoints.relay))
   await dependencies.clearJournal(journal.metadata.journalId)
   recordWinnerDescriptor(dependencies, hostId, winner.status)
   return { hostId }
diff --git a/mobile/src/transport/relay-host-signed-out-supervisor.test.ts b/mobile/src/transport/relay-host-signed-out-supervisor.test.ts
index 1c07b4b7f6ba..b2f08ad1980a 100644
--- a/mobile/src/transport/relay-host-signed-out-supervisor.test.ts
+++ b/mobile/src/transport/relay-host-signed-out-supervisor.test.ts
@@ -6,7 +6,8 @@ import {
   dependencies,
   FakeLogicalClient,
   FakeRelaySession,
-  host
+  host,
+  relay
 } from './mobile-endpoint-supervisor-test-fakes'
 import { MobileEndpointSupervisor } from './mobile-endpoint-supervisor'
 
@@ -37,7 +38,7 @@ describe('a signed-out desktop reaches the phone verdict', () => {
         )
       })
     })
-    return { logical, supervisor: new MobileEndpointSupervisor(logical, host, deps) }
+    return { logical, supervisor: new MobileEndpointSupervisor(logical, host.id, relay, deps) }
   }
 
   it('latches the sign-out the cell reported', async () => {
diff --git a/mobile/src/transport/rpc-client-runtime-events.test.ts b/mobile/src/transport/rpc-client-runtime-events.test.ts
index 04b2a90039eb..ce035f63b0bc 100644
--- a/mobile/src/transport/rpc-client-runtime-events.test.ts
+++ b/mobile/src/transport/rpc-client-runtime-events.test.ts
@@ -136,4 +136,30 @@ describe('runtime client-event stream disposal', () => {
     ])
     client.close()
   })
+
+  it('releases the replayed registration on the new socket when disposed before its ready', async () => {
+    const { client, socket: first } = connectReadyClient()
+    const unsubscribe = client.subscribe('runtime.clientEvents.subscribe', null, () => {})
+    const request = sentRequests(first, 'runtime.clientEvents.subscribe')[0]!
+    emitReady(first, request.id, 'runtime-events:first-socket')
+
+    first.close()
+    await vi.advanceTimersByTimeAsync(500)
+    const second = sockets.at(-1)!
+    expect(second).not.toBe(first)
+    second.open()
+    second.receive(JSON.stringify({ type: 'e2ee_ready' }))
+    second.receive('encrypted:{"type":"e2ee_authenticated"}')
+    expect(sentRequests(second, 'runtime.clientEvents.subscribe')).toEqual([
+      expect.objectContaining({ id: request.id })
+    ])
+
+    unsubscribe()
+    emitReady(second, request.id, 'runtime-events:second-socket')
+
+    expect(sentRequests(second, 'runtime.clientEvents.unsubscribe')).toEqual([
+      expect.objectContaining({ params: { subscriptionId: 'runtime-events:second-socket' } })
+    ])
+    client.close()
+  })
 })
diff --git a/mobile/src/transport/rpc-client-stream-registry.test.ts b/mobile/src/transport/rpc-client-stream-registry.test.ts
index 0e7d561be6e3..6afcd8a7ef35 100644
--- a/mobile/src/transport/rpc-client-stream-registry.test.ts
+++ b/mobile/src/transport/rpc-client-stream-registry.test.ts
@@ -79,6 +79,41 @@ describe('RpcClientStreamRegistry', () => {
     ])
   })
 
+  it('ends one transcript stream on dispose and leaves a sibling on the same socket (U-03)', () => {
+    const { registry, sent } = createRegistry()
+    const disposeFirst = registry.subscribe('agentSession.subscribe', { sessionId: 's1' }, () => {})
+    registry.subscribe('agentSession.subscribe', { sessionId: 's2' }, () => {})
+    const [first] = sent
+
+    disposeFirst()
+    expect(sent.at(-1)).toMatchObject({
+      method: 'agentSession.unsubscribe',
+      params: { sessionId: 's1', subscriptionId: first!.id }
+    })
+    expect(sent.filter((request) => request.method === 'agentSession.unsubscribe')).toHaveLength(1)
+  })
+
+  it('names the terminal request it sent when unsubscribing, and keeps the slot for older hosts', () => {
+    const { registry, sent } = createRegistry()
+    const dispose = registry.subscribe(
+      'terminal.subscribe',
+      { terminal: 'term-1', client: { id: 'phone-1', type: 'mobile' } },
+      () => {}
+    )
+    const subscribe = sent[0]!
+
+    dispose()
+
+    expect(sent[1]).toMatchObject({
+      method: 'terminal.unsubscribe',
+      params: {
+        subscriptionId: 'term-1:phone-1',
+        client: { id: 'phone-1' },
+        requestId: subscribe.id
+      }
+    })
+  })
+
   it('keeps a disposed browser tombstone until ready can be unsubscribed', () => {
     const { registry, sent } = createRegistry()
     const dispose = registry.subscribe('browser.screencast', { page: 'page-1' }, () => {})
@@ -98,4 +133,105 @@ describe('RpcClientStreamRegistry', () => {
       params: { subscriptionId: 'browser-screencast:page-1:test' }
     })
   })
+
+  it('releases a replayed browser stream replaced by a new one before its ready', () => {
+    const { registry, sent } = createRegistry()
+    registry.subscribe('browser.screencast', { page: 'page-1' }, () => {})
+    const replayedId = sent[0]!.id
+    registry.handleResponse(
+      streamingResponse(replayedId, { type: 'ready', subscriptionId: 'page-1-old-connection' })
+    )
+
+    registry.markForReplay()
+    registry.replayAfterAuthentication()
+    registry.subscribe('browser.screencast', { page: 'page-2' }, () => {})
+    const replacementId = sent.at(-1)!.id
+    registry.handleResponse(
+      streamingResponse(replayedId, { type: 'ready', subscriptionId: 'page-1-new-connection' })
+    )
+    registry.handleResponse(
+      streamingResponse(replacementId, { type: 'ready', subscriptionId: 'page-2' })
+    )
+
+    expect(
+      sent
+        .filter((request) => request.method === 'browser.screencast.unsubscribe')
+        .map((request) => request.params)
+    ).toEqual([{ subscriptionId: 'page-1-new-connection' }])
+    expect(registry.size()).toBe(1)
+  })
+
+  describe.each([
+    ['runtime.clientEvents.subscribe', 'runtime.clientEvents.unsubscribe', null],
+    ['browser.screencast', 'browser.screencast.unsubscribe', { page: 'page-1' }]
+  ])('%s ready id across a replay', (method, unsubscribeMethod, params) => {
+    function unsubscribes(sent: SentRequest[]): unknown[] {
+      return sent.filter((request) => request.method === unsubscribeMethod).map((r) => r.params)
+    }
+
+    function subscribeReady() {
+      const harness = createRegistry()
+      const dispose = harness.registry.subscribe(method, params, () => {})
+      const requestId = harness.sent[0]!.id
+      harness.registry.handleResponse(
+        streamingResponse(requestId, { type: 'ready', subscriptionId: 'old-connection-id' })
+      )
+      return { ...harness, dispose, requestId }
+    }
+
+    it('releases the replayed registration when disposed before its new ready', () => {
+      const { registry, sent, dispose, requestId } = subscribeReady()
+
+      registry.markForReplay()
+      registry.replayAfterAuthentication()
+      dispose()
+      registry.handleResponse(
+        streamingResponse(requestId, { type: 'ready', subscriptionId: 'new-connection-id' })
+      )
+
+      expect(unsubscribes(sent)).toEqual([{ subscriptionId: 'new-connection-id' }])
+    })
+
+    it('forgets the previous connection id when marked for replay', () => {
+      const { registry, sent, dispose } = subscribeReady()
+
+      registry.markForReplay()
+      dispose()
+
+      // A disposal while disconnected has nothing to name on the next connection.
+      expect(unsubscribes(sent)).toEqual([])
+      expect(registry.size()).toBe(0)
+    })
+
+    it('still releases a stream cancelled before its first ready', () => {
+      const { registry, sent } = createRegistry()
+      const dispose = registry.subscribe(method, params, () => {})
+      const requestId = sent[0]!.id
+
+      dispose()
+      expect(unsubscribes(sent)).toEqual([])
+      registry.handleResponse(
+        streamingResponse(requestId, { type: 'ready', subscriptionId: 'first-id' })
+      )
+
+      expect(unsubscribes(sent)).toEqual([{ subscriptionId: 'first-id' }])
+      expect(registry.size()).toBe(0)
+    })
+
+    it('sends one unsubscribe however often the stream is disposed', () => {
+      const { registry, sent, dispose, requestId } = subscribeReady()
+
+      registry.markForReplay()
+      registry.replayAfterAuthentication()
+      dispose()
+      dispose()
+      registry.handleResponse(
+        streamingResponse(requestId, { type: 'ready', subscriptionId: 'new-connection-id' })
+      )
+      dispose()
+
+      expect(unsubscribes(sent)).toEqual([{ subscriptionId: 'new-connection-id' }])
+      expect(registry.size()).toBe(0)
+    })
+  })
 })
diff --git a/mobile/src/transport/rpc-client-stream-registry.ts b/mobile/src/transport/rpc-client-stream-registry.ts
index 68e50a6e6ddf..ebfdb7419970 100644
--- a/mobile/src/transport/rpc-client-stream-registry.ts
+++ b/mobile/src/transport/rpc-client-stream-registry.ts
@@ -108,6 +108,8 @@ export class RpcClientStreamRegistry {
     this.pendingBrowserRequestId = null
     for (const [id, stream] of this.streams) {
       stream.sent = false
+      // The id named a registration on the closed socket; the replay's ready brings the new one.
+      stream.subscriptionId = undefined
       this.resetTerminalRouting(id)
     }
   }
@@ -210,10 +212,11 @@ export class RpcClientStreamRegistry {
     if (stream?.method === 'terminal.subscribe') {
       const params = buildTerminalUnsubscribeParams(stream.params)
       if (params) {
-        this.sendRpc('terminal.unsubscribe', params)
+        // Why: `requestId` names this exact request; hosts that predate it strip it and use the slot.
+        this.sendRpc('terminal.unsubscribe', { ...params, requestId: id })
       }
     } else {
-      const unsubscribe = buildStreamUnsubscribe(stream?.method, stream?.params)
+      const unsubscribe = buildStreamUnsubscribe(stream?.method, stream?.params, id)
       if (unsubscribe) {
         this.sendRpc(unsubscribe.method, unsubscribe.params)
       }
diff --git a/mobile/src/transport/rpc-client-terminal-subscription.ts b/mobile/src/transport/rpc-client-terminal-subscription.ts
index 405f7f1d9e00..2bed2ab0458f 100644
--- a/mobile/src/transport/rpc-client-terminal-subscription.ts
+++ b/mobile/src/transport/rpc-client-terminal-subscription.ts
@@ -53,6 +53,14 @@ export function buildStreamUnsubscribe(
         }
       : null
   }
+  if (method === 'agentSession.subscribe') {
+    const sessionId = (params as { sessionId?: unknown }).sessionId
+    // The host keys each transcript stream by its frame id; without it every stream of the
+    // session on this socket would end.
+    return typeof sessionId === 'string' && requestId
+      ? { method: 'agentSession.unsubscribe', params: { sessionId, subscriptionId: requestId } }
+      : null
+  }
   if (method === 'nativeChat.subscribe') {
     const subscriptionId = (params as { subscriptionId?: unknown }).subscriptionId
     if (typeof subscriptionId === 'string') {
diff --git a/mobile/src/transport/settings-host-client-lifecycle.test.ts b/mobile/src/transport/settings-host-client-lifecycle.test.ts
index e6c55117e0d9..44a9a94f86ae 100644
--- a/mobile/src/transport/settings-host-client-lifecycle.test.ts
+++ b/mobile/src/transport/settings-host-client-lifecycle.test.ts
@@ -44,6 +44,9 @@ vi.mock('./host-store', () => ({
 vi.mock('./connection-revival-triggers', () => ({
   subscribeConnectionRevivalTriggers: () => () => {}
 }))
+vi.mock('./connection-log-background-flush', () => ({
+  subscribeConnectionLogBackgroundFlush: () => () => {}
+}))
 
 type FakeClient = RpcClient & {
   closeMock: ReturnType<typeof vi.fn>
diff --git a/mobile/src/transport/types.ts b/mobile/src/transport/types.ts
index 0ed86a7a986b..d9c9271c79d0 100644
--- a/mobile/src/transport/types.ts
+++ b/mobile/src/transport/types.ts
@@ -4,11 +4,9 @@ import {
   type PairingOffer
 } from '../../../src/shared/mobile-relay-pairing-offer'
 import {
-  MobileAccessEndpointSchema,
-  type MobileAccessEndpoint,
-  type MobileRelayHostOverlay
-} from './mobile-relay-host-overlay'
-import { MobileRelayEndpointSchema } from '../../../src/shared/mobile-relay-credential-contract'
+  MobileRelayEndpointSchema,
+  type MobileRelayEndpoint
+} from '../../../src/shared/mobile-relay-credential-contract'
 import { NODE_PLATFORM_NAMES } from './mobile-runtime-host-platform'
 import { salvagedOptional } from '../../../src/shared/zod-salvage'
 
@@ -116,9 +114,8 @@ export type HostProfile = {
   deviceToken: string
   publicKeyB64: string
   lastConnected: number
-  endpoints?: MobileAccessEndpoint[]
-  relayHostId?: MobileRelayHostOverlay['relayHostId']
-  relay?: MobileRelayHostOverlay['relay']
+  /** Relay routing, joined from the overlay; only `setRelayRouting` and pairing write it. */
+  relay?: MobileRelayEndpoint
 }
 
 export type HostCredentialStatus = 'ready' | 'temporarily-unavailable' | 'missing'
@@ -148,11 +145,6 @@ export const HostProfileSchema = z.object({
   deviceToken: z.string().min(1),
   publicKeyB64: z.string().min(1),
   lastConnected: z.number().finite(),
-  endpoints: z.array(MobileAccessEndpointSchema).min(1).max(16).optional(),
-  relayHostId: z
-    .string()
-    .regex(/^[A-Za-z0-9_-]{16}$/)
-    .optional(),
   relay: MobileRelayEndpointSchema.optional()
 })
 
diff --git a/mobile/src/worktree/agent-row-display.test.ts b/mobile/src/worktree/agent-row-display.test.ts
index ee872e40f266..47898017ff8e 100644
--- a/mobile/src/worktree/agent-row-display.test.ts
+++ b/mobile/src/worktree/agent-row-display.test.ts
@@ -1,13 +1,26 @@
 import { describe, expect, it } from 'vitest'
 import type { RuntimeWorktreeAgentRow } from '../../../src/shared/runtime-types'
+import {
+  agentMainAgentVerdict,
+  agentVerdictDisplayMark
+} from '../../../src/shared/agent-main-agent-verdict'
+import { AGENT_JOURNAL_TURN_OUTCOMES } from '../../../src/shared/agent-turn-outcome'
 import {
   AGENT_STATUS_STALE_AFTER_MS,
   agentDisplayLabel,
   agentDotState,
   agentIdentityLabel,
+  agentRowTimeAt,
+  agentRowVerdict,
+  agentRowVerdictMark,
   formatTimeAgo
 } from './agent-row-display'
 
+type Outcome = (typeof AGENT_JOURNAL_TURN_OUTCOMES)[number]
+const mainAgentDone = (outcome: Outcome, stateStartedAt = 0) => ({
+  mainAgent: { state: 'done' as const, outcome, stateStartedAt }
+})
+
 function row(overrides: Partial<RuntimeWorktreeAgentRow> = {}): RuntimeWorktreeAgentRow {
   return {
     paneKey: 'p',
@@ -37,8 +50,54 @@ describe('agentDotState', () => {
     expect(agentDotState(row({ state: 'unknown-state' as never }), 0)).toBe('idle')
   })
 
-  it('reports interrupted regardless of state', () => {
+  it('reports the verdict of a done row: failed, interrupted, or an old host legacy flag', () => {
     expect(agentDotState(row({ state: 'done', interrupted: true }), 0)).toBe('interrupted')
+    expect(agentDotState(row({ state: 'done', ...mainAgentDone('failure') }), 0)).toBe('failed')
+    expect(
+      agentDotState(row({ state: 'done', ...mainAgentDone('cancellation'), interrupted: true }), 0)
+    ).toBe('interrupted')
+    expect(agentDotState(row({ state: 'done', ...mainAgentDone('success') }), 0)).toBe('done')
+  })
+
+  it('shows a main agent that failed while its subagents still run as failed', () => {
+    expect(agentDotState(row({ state: 'working', ...mainAgentDone('failure') }), 0)).toBe('failed')
+    expect(agentDotState(row({ state: 'waiting', ...mainAgentDone('failure') }), 0)).toBe('failed')
+    // Only a failure outranks live work; a success or a stop with live subagents reads working.
+    expect(agentDotState(row({ state: 'working', ...mainAgentDone('success') }), 0)).toBe('working')
+    expect(
+      agentDotState(
+        row({ state: 'working', ...mainAgentDone('cancellation'), interrupted: true }),
+        0
+      )
+    ).toBe('working')
+  })
+
+  // The shared accessor cannot be imported by app code here, so this mirror must not drift from it.
+  it('agrees with the desktop verdict accessor on every row', () => {
+    const states = ['working', 'blocked', 'waiting', 'done'] as const
+    const mainAgents = [
+      undefined,
+      ...states.flatMap((state) =>
+        [undefined, ...AGENT_JOURNAL_TURN_OUTCOMES].map((outcome) => ({
+          state,
+          ...(outcome ? { outcome } : {}),
+          stateStartedAt: 0
+        }))
+      )
+    ]
+    for (const state of states) {
+      for (const mainAgent of mainAgents) {
+        for (const interrupted of [false, true]) {
+          const agentRow = { state, interrupted, ...(mainAgent ? { mainAgent } : {}) }
+          expect(agentRowVerdict(agentRow), JSON.stringify(agentRow)).toBe(
+            agentMainAgentVerdict(agentRow)
+          )
+          expect(agentRowVerdictMark(agentRow), JSON.stringify(agentRow)).toBe(
+            agentVerdictDisplayMark(agentRow)
+          )
+        }
+      }
+    }
   })
 
   it('decays a stale active state to idle, matching desktop', () => {
@@ -51,14 +110,36 @@ describe('agentDotState', () => {
     expect(
       agentDotState(row({ state: 'working', updatedAt: 0 }), AGENT_STATUS_STALE_AFTER_MS)
     ).toBe('working')
-    // 'done' never decays; interrupted still wins.
+    // 'done' never decays, and neither does its verdict.
     expect(agentDotState(row({ state: 'done', updatedAt: 0 }), stale)).toBe('done')
-    expect(agentDotState(row({ state: 'working', updatedAt: 0, interrupted: true }), stale)).toBe(
+    expect(agentDotState(row({ state: 'done', updatedAt: 0, interrupted: true }), stale)).toBe(
       'interrupted'
     )
   })
 })
 
+describe('agentRowTimeAt', () => {
+  it('dates a main agent that failed while its subagents run by its own failure', () => {
+    expect(
+      agentRowTimeAt(
+        row({ state: 'working', stateStartedAt: 100, ...mainAgentDone('failure', 900) })
+      )
+    ).toBe(900)
+  })
+
+  it('dates every other row by when its state began', () => {
+    expect(
+      agentRowTimeAt(
+        row({ state: 'working', stateStartedAt: 100, ...mainAgentDone('success', 900) })
+      )
+    ).toBe(100)
+    expect(
+      agentRowTimeAt(row({ state: 'done', stateStartedAt: 100, ...mainAgentDone('failure', 900) }))
+    ).toBe(100)
+    expect(agentRowTimeAt(row({ state: 'working', stateStartedAt: 100 }))).toBe(100)
+  })
+})
+
 describe('agentDisplayLabel', () => {
   it('prefers last message, then prompt, then state label', () => {
     expect(agentDisplayLabel(row({ lastAssistantMessage: 'hello there' }), 0)).toBe('hello there')
diff --git a/mobile/src/worktree/agent-row-display.ts b/mobile/src/worktree/agent-row-display.ts
index c678b522a152..da93aa392207 100644
--- a/mobile/src/worktree/agent-row-display.ts
+++ b/mobile/src/worktree/agent-row-display.ts
@@ -1,4 +1,5 @@
 import type { RuntimeWorktreeAgentRow } from '../../../src/shared/runtime-types'
+import type { AgentJournalTurnOutcome } from '../../../src/shared/agent-turn-outcome'
 
 // Mirrors the desktop AGENT_STATUS_STALE_AFTER_MS (src/shared/agent-status-types.ts:
 // 30 min). Defined locally rather than imported because a runtime-value import
@@ -17,13 +18,39 @@ export type AgentDotState =
   | 'done'
   | 'idle'
   | 'interrupted'
+  | 'failed'
+
+type AgentRowVerdictSource = Pick<RuntimeWorktreeAgentRow, 'state' | 'interrupted' | 'mainAgent'>
+
+// Mirrors desktop agentMainAgentVerdict and agentVerdictDisplayMark
+// (src/shared/agent-main-agent-verdict.ts); a parity test runs both over one table. `mainAgent` is
+// the main agent's own status, sent also while subagents hold the row working; an old host sends none.
+export function agentRowVerdict(row: AgentRowVerdictSource): AgentJournalTurnOutcome | null {
+  if (row.mainAgent && row.mainAgent.state !== 'done') {
+    return null
+  }
+  return row.mainAgent?.outcome ?? (row.state === 'done' && row.interrupted ? 'cancellation' : null)
+}
+
+// A failure outranks every state; a stop marks only a row that is itself done.
+export function agentRowVerdictMark(row: AgentRowVerdictSource): 'failed' | 'interrupted' | null {
+  const verdict = agentRowVerdict(row)
+  if (verdict === 'failure') {
+    return 'failed'
+  }
+  return verdict === 'cancellation' && row.state === 'done' ? 'interrupted' : null
+}
 
 export function agentDotState(
-  row: Pick<RuntimeWorktreeAgentRow, 'state' | 'workingMode' | 'interrupted' | 'updatedAt'>,
+  row: Pick<
+    RuntimeWorktreeAgentRow,
+    'state' | 'workingMode' | 'interrupted' | 'mainAgent' | 'updatedAt'
+  >,
   now: number
 ): AgentDotState {
-  if (row.interrupted) {
-    return 'interrupted'
+  const mark = agentRowVerdictMark(row)
+  if (mark) {
+    return mark
   }
   switch (row.state) {
     case 'blocked':
@@ -56,6 +83,8 @@ export function agentStateLabel(state: AgentDotState): string {
       return 'Waiting for input'
     case 'interrupted':
       return 'Interrupted'
+    case 'failed':
+      return 'Failed'
     case 'done':
       return 'Done'
     case 'idle':
@@ -99,6 +128,17 @@ export function agentIdentityLabel(agentType: string | null): string {
   return known[normalized] ?? normalized.slice(0, 2).toUpperCase()
 }
 
+// When the row's state began, except that a main agent that failed while its subagents run is
+// dated by its own failure. Mirrors desktop lastEnteredDoneAt (agent-finished-timestamp.ts).
+export function agentRowTimeAt(
+  row: Pick<RuntimeWorktreeAgentRow, 'state' | 'interrupted' | 'mainAgent' | 'stateStartedAt'>
+): number {
+  if (row.state !== 'done' && row.mainAgent && agentRowVerdictMark(row) === 'failed') {
+    return row.mainAgent.stateStartedAt
+  }
+  return row.stateStartedAt
+}
+
 // Relative time, matching desktop formatTimeAgo thresholds (just now / Xm / Xh / Xd).
 export function formatTimeAgo(ts: number, now: number): string {
   const delta = now - ts
diff --git a/mobile/src/worktree/worktree-list-snapshot.test.ts b/mobile/src/worktree/worktree-list-snapshot.test.ts
index c7c5756160ff..25c9ecbe852b 100644
--- a/mobile/src/worktree/worktree-list-snapshot.test.ts
+++ b/mobile/src/worktree/worktree-list-snapshot.test.ts
@@ -21,6 +21,13 @@ function agent(overrides: Partial<RuntimeWorktreeAgentRow> = {}): RuntimeWorktre
   }
 }
 
+function done(
+  outcome: 'success' | 'failure',
+  stateStartedAt = 1
+): NonNullable<RuntimeWorktreeAgentRow['mainAgent']> {
+  return { state: 'done', outcome, stateStartedAt }
+}
+
 function worktree(overrides: Partial<Worktree> = {}): Worktree {
   const worktreePath = join('/tmp', 'orca', 'worktrees', 'manta')
   return {
@@ -160,6 +167,31 @@ describe('areWorktreeListsEqual', () => {
     expect(areWorktreeListsEqual(first, second)).toBe(false)
   })
 
+  it('detects a verdict change that leaves the interrupted flag as it was', () => {
+    const first = [worktree({ agents: [agent({ state: 'done', mainAgent: done('success') })] })]
+    const second = [worktree({ agents: [agent({ state: 'done', mainAgent: done('failure') })] })]
+
+    expect(areWorktreeListsEqual(first, second)).toBe(false)
+  })
+
+  it('detects a main agent failing while its subagents keep the row working', () => {
+    const first = [worktree({ agents: [agent({ state: 'working' })] })]
+    const second = [worktree({ agents: [agent({ state: 'working', mainAgent: done('failure') })] })]
+
+    expect(areWorktreeListsEqual(first, second)).toBe(false)
+  })
+
+  it('detects the main agent clock moving, which dates a failure', () => {
+    const at = (stateStartedAt: number) => [
+      worktree({
+        agents: [agent({ state: 'working', mainAgent: done('failure', stateStartedAt) })]
+      })
+    ]
+
+    expect(areWorktreeListsEqual(at(1), at(2))).toBe(false)
+    expect(areWorktreeListsEqual(at(1), at(1))).toBe(true)
+  })
+
   it('detects monitoring mode changes within working', () => {
     const first = [worktree({ agents: [agent({ state: 'working' })] })]
     const second = [worktree({ agents: [agent({ state: 'working', workingMode: 'monitoring' })] })]
diff --git a/mobile/src/worktree/worktree-list-snapshot.ts b/mobile/src/worktree/worktree-list-snapshot.ts
index 8fa27c2a1979..250c871493fb 100644
--- a/mobile/src/worktree/worktree-list-snapshot.ts
+++ b/mobile/src/worktree/worktree-list-snapshot.ts
@@ -110,6 +110,7 @@ function areAgentRowsEqual(
       a.toolName !== b.toolName ||
       a.toolInput !== b.toolInput ||
       a.interrupted !== b.interrupted ||
+      !areMainAgentsEqual(a.mainAgent, b.mainAgent) ||
       a.stateStartedAt !== b.stateStartedAt ||
       a.updatedAt !== b.updatedAt
     ) {
@@ -118,3 +119,20 @@ function areAgentRowsEqual(
   }
   return true
 }
+
+function areMainAgentsEqual(
+  left: RuntimeWorktreeAgentRow['mainAgent'],
+  right: RuntimeWorktreeAgentRow['mainAgent']
+): boolean {
+  if (left === right) {
+    return true
+  }
+  if (!left || !right) {
+    return false
+  }
+  return (
+    left.state === right.state &&
+    left.outcome === right.outcome &&
+    left.stateStartedAt === right.stateStartedAt
+  )
+}
diff --git a/mobile/web-entry/index.tsx b/mobile/web-entry/index.tsx
index 2c346e0dbf2c..57936f042529 100644
--- a/mobile/web-entry/index.tsx
+++ b/mobile/web-entry/index.tsx
@@ -20,6 +20,7 @@ import { PageFaultBoundary } from '../src/mobile-web-shell/bridge/page-fault-bou
 import { publishPageHostProfile } from '../src/mobile-web-shell/bridge/page-host-profile'
 import { publishExternalLinkOpener } from '../src/platform/external-link.web'
 import { publishHapticsNotifier } from '../src/platform/haptics.web'
+import { publishShellKeyboardSource } from '../src/platform/keyboard-occlusion.web'
 // Named with its extension: this entry is the web build's and the provider it needs is the web
 // sibling's, which takes the page's client. The screens below still import `./client-context`
 // and reach the same module, because the builder resolves both specifiers to the same file.
@@ -111,6 +112,11 @@ bootstrapShellPage({
     // The same shape again, and for the same reason: every haptic on this page is played from a
     // plain function inside a row's press handler, which no provider wraps.
     publishHapticsNotifier((kind) => client.notifyHaptics(kind))
+    // The shell's keyboard height, read by plain functions as well as hooks; 0 while it is closed.
+    publishShellKeyboardSource({
+      read: () => client.getShellSession()?.keyboardInset ?? 0,
+      subscribe: client.onKeyboardInsetUpdate
+    })
     // Scoped to the host `init` named: with none, no key is writable, which is the right answer
     // for a shell too old to say whose list this is.
     publishPageStorage(
diff --git a/mobile/web-entry/web-overrides.json b/mobile/web-entry/web-overrides.json
index 50a31ed61cbe..3dc3e661f6fb 100644
--- a/mobile/web-entry/web-overrides.json
+++ b/mobile/web-entry/web-overrides.json
@@ -29,6 +29,10 @@
       "file": "src/transport/host-device-token-store.web.ts",
       "reason": "expo-secure-store resolves to {} on web, and the bridge carries the RPC, so the page holds no device token."
     },
+    {
+      "file": "src/platform/host-os.web.ts",
+      "reason": "Platform.OS is web inside the shell's page, but the keyboard the page lifts over is the phone's, reported in that OS's own terms: iOS counts the home indicator. Keyboard and inset arithmetic branches on the host OS, so this answers the phone's OS from the WebView's user agent, and the page computes what the native screen computes."
+    },
     {
       "file": "app/_layout.web.tsx",
       "reason": "The page's route tree starts at app/h, so without a root layout expo-router mounts DefaultNavigator, an all-edges SafeAreaView that would pad every screen a second time. The native root owns pairing and push and cannot reach the page. This one adds no padding and feeds the insets the shell sent in init to react-native-safe-area-context, whose web provider reads env(safe-area-inset-*) as 0 in both WebViews."
@@ -69,6 +73,14 @@
       "file": "src/platform/keyboard-occlusion.web.ts",
       "reason": "react-native-web's Keyboard is a stub: addListener returns a subscription that never fires and isVisible() is always false, so a screen waiting for keyboardDidShow inside the page waits forever and the software keyboard covers whatever sits at the bottom of the document \u2014 the source-control commit bar, and the review note composer whose KeyboardAvoidingView is driven by those same events. The browser publishes the geometry a different way: the layout viewport keeps its size and visualViewport shrinks, so the occluded strip is innerHeight minus the visual viewport's height and offsetTop, tracked on its resize and scroll. A document with no visualViewport answers 0 rather than guessing."
     },
+    {
+      "file": "src/platform/keyboard-persisting-taps.web.ts",
+      "reason": "react-native-web ignores keyboardShouldPersistTaps, and its Pressable is a focusable element that takes focus on mousedown. On Pixel_API_37 a tap on a session tab or a dock key moved focus off the live input and the IME closed, while natively a Pressable never takes focus and those two ScrollViews persist taps. This sibling gives the tab bar ('handled') and the accessory bar ('always') the same rule by keeping a focused text field's focus through the mousedown; the native module returns no ref."
+    },
+    {
+      "file": "src/platform/live-input-composing-range.web.ts",
+      "reason": "The terminal's Live input reads the change event's isComposing as the text system's marked-text range, and on the page that event is the DOM's. An Android WebView marks the keyboard's composing region, which Samsung and other Latin keyboards keep over every word, so the preedit mirror held each word unsent until the next keystroke or Enter. Native Android reports no range at all; this sibling answers the same in an Android WebView and passes the DOM's range through in any other browser. The native file passes the event's own through."
+    },
     {
       "file": "src/platform/clipboard.web.ts",
       "reason": "expo-clipboard resolves to navigator.clipboard on the web, which needs a secure context; the iOS shell serves the page from the custom scheme orca-mobile-web://<session>/ while Android serves https, so that path would work on one platform and silently not on the other. This one asks the shell through the native.clipboard.write and native.clipboard.read verbs, where the pasteboard is the device's, and rejects when the route was not granted one so the caller's own catch puts that on screen. An image is the same pasteboard reached a different way: native.clipboard.read admits only text, and a 24 MiB base64 image cannot cross an 8 MiB reply cap, so readImage runs native.media.pick with source 'clipboard', reads the staged bytes back a chunk at a time and gives the handle back. contents answers per grant without probing, because the shell serves no 'is there text' verb and reading to find out would raise iOS's paste-consent prompt on every mount."
diff --git a/native/computer-use-linux/runtime.py b/native/computer-use-linux/runtime.py
index ac53f6cf65f8..464235b206ae 100644
--- a/native/computer-use-linux/runtime.py
+++ b/native/computer-use-linux/runtime.py
@@ -406,8 +406,10 @@ def walk(node, depth, path):
                 truncation["maxDepthReached"] = True
             return
         item = record(node, len(records), path, window_rect)
-        child_items = list(children(node))
         role_key = (item["controlType"] or "").lower()
+        title = item["name"] or item["automationId"] or ""
+        suppressed = suppress_children(role_key, title, item["value"], None)
+        child_items = [] if suppressed else list(children(node))
         generic_summary = None
         if role_key in {"panel", "filler", "unknown", "section"} and not item["name"] and not item["value"]:
             summary_values = text_snippets(node, limit=8, max_depth=4)
@@ -418,7 +420,6 @@ def walk(node, depth, path):
                 walk(child, depth, path + [child_index])
             return
         records.append(item)
-        title = item["name"] or item["automationId"] or ""
         role_label = item["localizedControlType"] or item["controlType"]
         line = f'{item["index"]} {role_label} {sanitize_text(title)}'.rstrip()
         line += formatted_value(role_key, title, item["value"])
@@ -432,7 +433,7 @@ def walk(node, depth, path):
         if filtered_actions:
             line += ", Secondary Actions: " + ", ".join(display_action(action) for action in filtered_actions)
         lines.append(("\t" * depth) + line)
-        if generic_summary or suppress_children(role_key, title, item["value"], generic_summary):
+        if generic_summary or suppressed:
             return
         child_line_start = len(lines)
         for child_index, child in child_items:
diff --git a/native/computer-use-linux/runtime_render_test.py b/native/computer-use-linux/runtime_render_test.py
index 83a600c7d2d2..d3672912ca60 100644
--- a/native/computer-use-linux/runtime_render_test.py
+++ b/native/computer-use-linux/runtime_render_test.py
@@ -98,6 +98,7 @@ def get_value_iface(self):
 
 class FailingChildrenAccessible(FakeAccessible):
     def get_child_count(self):
+        self.counter["child_reads"] += 1
         raise RuntimeError("defunct node")
 
 
@@ -113,9 +114,63 @@ def test_named_non_generic_node_skips_unused_summary_walk(self):
 
         self.assertEqual([record["name"] for record in records], ["Save"])
         self.assertEqual(lines, ["0 button Save"])
+        self.assertEqual(root.counter["child_reads"], 0)
+        self.assertFalse(truncation["truncated"])
+
+    def test_wide_labeled_controls_never_enumerate_suppressed_children(self):
+        roles = (
+            "button", "check box", "checkbox", "combo box", "heading", "link",
+            "menu item", "page tab", "push button", "radio button",
+        )
+        for role in roles:
+            with self.subTest(role=role):
+                root = FakeAccessible(
+                    role, "Save", children=[FakeAccessible("text", str(i)) for i in range(10000)]
+                )
+
+                records, lines, truncation = render(root)
+
+                self.assertEqual([item["runtimeId"] for item in records], [[0]])
+                self.assertEqual(lines, [f"0 {role} Save"])
+                self.assertEqual(root.counter["child_reads"], 0)
+                self.assertFalse(truncation["truncated"])
+
+    def test_control_value_or_identifier_keeps_suppression(self):
+        value_node = FakeAccessible("combo box", value="Choice", children=[FakeAccessible("text", "Child")])
+        identifier_node = FakeAccessible("button", children=[FakeAccessible("text", "Child")])
+        identifier_node.get_accessible_id = lambda: "save-button"
+        for root, expected in (
+            (value_node, "0 combo box, Value: Choice"),
+            (identifier_node, "0 button save-button"),
+        ):
+            with self.subTest(expected=expected):
+                records, lines, truncation = render(root)
+
+                self.assertEqual(len(records), 1)
+                self.assertEqual(lines, [expected])
+                self.assertEqual(root.counter["child_reads"], 0)
+                self.assertFalse(truncation["truncated"])
+
+    def test_unlabeled_controls_keep_child_indices_and_depth(self):
+        root = FakeAccessible("button", children=[FakeAccessible("button", "Nested")])
+
+        records, lines, truncation = render(root)
+
+        self.assertEqual([item["runtimeId"] for item in records], [[0], [0, 0]])
+        self.assertEqual(lines, ["0 button", "\t1 button Nested"])
         self.assertEqual(root.counter["child_reads"], 2)
         self.assertFalse(truncation["truncated"])
 
+    def test_suppressed_child_failure_keeps_control_output(self):
+        root = FailingChildrenAccessible("button", "Save")
+
+        records, lines, truncation = render(root)
+
+        self.assertEqual([item["name"] for item in records], ["Save"])
+        self.assertEqual(lines, ["0 button Save"])
+        self.assertFalse(truncation["truncated"])
+        self.assertEqual(root.counter["child_reads"], 0)
+
     def test_named_generic_node_skips_unused_summary_walk(self):
         root = FakeAccessible("section", "Details", children=[FakeAccessible("text", "body")])
 
diff --git a/package.json b/package.json
index 5e88d8ab9940..9ba088dcc4e6 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "orca",
-  "version": "1.4.197",
+  "version": "1.4.214",
   "description": "Next-gen IDE for parallel agentic development",
   "homepage": "https://github.com/stablyai/orca",
   "author": "stablyai",
@@ -14,7 +14,7 @@
     "audit:perf": "oxlint --config config/oxlint-performance-audit.json --format json src",
     "test:perf:contracts": "vitest run --config config/vitest.performance.config.ts",
     "format": "oxfmt --write .",
-    "lint": "oxlint && pnpm run audit:anti-slop && pnpm run audit:code-quality:native && pnpm run audit:code-quality:type-aware && pnpm run check:reliability-gates && pnpm run check:dead-classes && pnpm run check:max-lines-ratchet && pnpm run check:ts-nocheck-ratchet && pnpm run check:runtime-electron-ratchet && pnpm run check:readme-local-links && pnpm run verify:rpc-params-catalog && pnpm run verify:bundled-skill-guides && pnpm run verify:skill-bundle-manifest && pnpm run verify:localization-catalog && pnpm run verify:localization-runtime-catalog && pnpm run verify:localization-extraction && pnpm run verify:localization-coverage",
+    "lint": "oxlint && pnpm run audit:anti-slop && pnpm run audit:code-quality:native && pnpm run audit:code-quality:type-aware && pnpm run check:reliability-gates && pnpm run check:dead-classes && pnpm run check:max-lines-ratchet && pnpm run check:ts-nocheck-ratchet && pnpm run check:runtime-electron-ratchet && pnpm run check:readme-local-links && pnpm run verify:rpc-params-catalog && pnpm run verify:bundled-skill-guides && pnpm run verify:skill-bundle-manifest && pnpm run verify:localization-catalogs && pnpm run verify:localization-extraction && pnpm run verify:localization-coverage",
     "audit:code-quality": "pnpm run audit:code-quality:native && pnpm run audit:code-quality:type-aware && pnpm run audit:react-doctor",
     "audit:code-quality:native": "oxlint --config config/oxlint-code-quality-native-plugins.json src config tests mobile --deny-warnings",
     "audit:code-quality:type-aware": "oxlint --type-aware --config config/oxlint-code-quality-type-aware.json src config tests --deny-warnings",
@@ -30,6 +30,7 @@
     "lint:react-doctor:changed": "node config/scripts/lint-react-doctor-changed.mjs",
     "prepare": "husky",
     "test": "node config/scripts/ensure-native-runtime.mjs --runtime=node && vitest run --config config/vitest.config.ts",
+    "test:bun:profile": "node config/scripts/run-bun-profile-tests.mjs",
     "test:skill-sharing:release": "vitest run --config config/vitest.config.ts src/main/skills src/main/runtime/rpc/methods/skills.test.ts src/relay/skill-install-handler.test.ts src/shared/skill-bundle-install-contract.test.ts src/shared/skill-install-contract.test.ts src/shared/skill-install-failure.test.ts src/shared/skill-package-manifest.test.ts",
     "test:repro:remote-agent-session": "pnpm run build:cli && pnpm run build:electron-vite && node config/scripts/remote-agent-session-authority-repro.mjs",
     "capture:agent-transcript": "node config/scripts/ensure-native-runtime.mjs --runtime=node && node config/scripts/capture-agent-pty-transcript.mjs",
@@ -38,7 +39,8 @@
     "check:ts-nocheck-ratchet": "node config/scripts/check-ts-nocheck-ratchet.mjs",
     "check:runtime-electron-ratchet": "node config/scripts/check-runtime-electron-ratchet.mjs",
     "check:readme-local-links": "node config/scripts/check-readme-local-links.mjs",
-    "build:orcad": "node config/scripts/build-orcad.mjs",
+    "build:orcad": "node config/scripts/build-orcad-bun.mjs",
+    "build:orcad-template": "node config/scripts/build-orcad-template.mjs",
     "build:orcad-prebuilds": "node config/scripts/build-orcad-prebuilds.mjs",
     "smoke:orcad-terminal": "node config/scripts/ensure-native-runtime.mjs --runtime=node && pnpm run build:cli && pnpm run build:orcad && node config/scripts/runtime-serve-terminal-smoke.mjs --target orcad",
     "smoke:serve-terminal": "node config/scripts/runtime-serve-terminal-smoke.mjs",
@@ -79,6 +81,7 @@
     "verify:cli-bin": "node config/scripts/verify-cli-bin.mjs",
     "verify:built-skills-cli": "node config/scripts/verify-skills-cli-runtime.cjs out",
     "verify:renderer-boot-graph": "node config/scripts/verify-renderer-boot-graph.mjs",
+    "verify:localization-catalogs": "node config/scripts/verify-localization-catalogs.mjs",
     "verify:localization-catalog": "node config/scripts/verify-localization-catalog.mjs",
     "sync:localization-catalog": "node config/scripts/verify-localization-catalog.mjs --fix",
     "verify:localization-runtime-catalog": "node config/scripts/generate-runtime-required-english-catalog.mjs",
@@ -86,7 +89,8 @@
     "verify:localization-extraction": "node config/scripts/verify-localization-extraction.mjs",
     "verify:localization-coverage": "node config/scripts/audit-localization-coverage.mjs --check",
     "audit:localization": "node config/scripts/audit-localization-coverage.mjs",
-    "build:cli": "tsc -p config/tsconfig.cli.json --outDir out --composite false --incremental false && node config/scripts/verify-cli-bin.mjs --fix-executable --fix-package-json && node config/scripts/install-dev-cli.mjs",
+    "build:cli": "tsc -p config/tsconfig.cli.json --outDir out --composite false --incremental false && pnpm run prepare:cli-output",
+    "prepare:cli-output": "node config/scripts/verify-cli-bin.mjs --fix-executable --fix-package-json && node config/scripts/install-dev-cli.mjs",
     "test:linux-cli-contract": "node config/scripts/run-linux-cli-launch-contract-docker.mjs --appimage dist/orca-linux.AppImage",
     "test:repro:skills-cli-runtime": "pnpm run build:cli && pnpm run build:electron-vite && pnpm run verify:built-skills-cli",
     "build:electron-vite": "node config/scripts/run-electron-vite-build.mjs",
@@ -172,7 +176,7 @@
   "dependencies": {
     "@anthropic-ai/claude-agent-sdk": "0.3.251",
     "@electron-toolkit/utils": "^4.0.0",
-    "@floating-ui/dom": "1.7.6",
+    "@floating-ui/dom": "1.8.0",
     "@linear/sdk": "^82.1.0",
     "@parcel/watcher": "^2.5.6",
     "@streamparser/json": "0.0.26",
@@ -183,18 +187,18 @@
     "i18next": "^26.3.1",
     "jsonc-parser": "^3.3.1",
     "node-pty": "^1.1.0",
-    "posthog-node": "^5.33.3",
+    "posthog-node": "^5.52.5",
     "proper-lockfile": "4.1.2",
     "qrcode": "^1.5.4",
-    "react-i18next": "17.0.13",
+    "react-i18next": "17.0.15",
     "serve-sim": "0.1.40",
     "sherpa-onnx": "1.12.37",
     "ssh2": "^1.17.0",
-    "tldts": "7.4.12",
+    "tldts": "7.4.14",
     "tweetnacl": "^1.0.3",
     "ws": "^8.21.3",
-    "yaml": "^2.8.4",
-    "zod": "~4.5.4"
+    "yaml": "^2.9.1",
+    "zod": "~4.6.5"
   },
   "devDependencies": {
     "@dnd-kit/core": "^6.3.1",
@@ -202,16 +206,16 @@
     "@electron-toolkit/tsconfig": "^2.0.0",
     "@electron/rebuild": "^4.2.0",
     "@monaco-editor/react": "^4.7.0",
-    "@oxlint/plugins": "1.80.0",
-    "@playwright/test": "^1.59.1",
-    "@sanity/diff-match-patch": "^3.2.0",
+    "@oxlint/plugins": "1.85.0",
+    "@playwright/test": "^1.63.0",
+    "@sanity/diff-match-patch": "^3.2.1",
     "@shadcn/lint": "^0.1.0",
-    "@stablyai/playwright-test": "^2.1.14",
+    "@stablyai/playwright-test": "^2.1.16",
     "@tailwindcss/vite": "^4.2.4",
-    "@tanstack/react-virtual": "^3.14.10",
+    "@tanstack/react-virtual": "^3.14.13",
     "@testing-library/jest-dom": "^6.9.1",
-    "@testing-library/react": "^16.3.2",
-    "@testing-library/user-event": "^14.6.1",
+    "@testing-library/react": "^16.3.3",
+    "@testing-library/user-event": "^14.6.7",
     "@tiptap/extension-code-block": "3.31.3",
     "@tiptap/extension-code-block-lowlight": "3.31.3",
     "@tiptap/extension-details": "3.31.3",
@@ -251,7 +255,7 @@
     "clsx": "^2.1.1",
     "cmdk": "^1.1.1",
     "diff": "8.0.4",
-    "dompurify": "3.4.14",
+    "dompurify": "3.4.15",
     "electron": "43.7.0",
     "electron-builder": "^26.15.3",
     "electron-builder-squirrel-windows": "^26.15.3",
@@ -262,7 +266,7 @@
     "happy-dom": "^20.11.8",
     "html-to-image": "^1.11.13",
     "husky": "^9.1.7",
-    "i18next-cli": "1.65.0",
+    "i18next-cli": "1.74.1",
     "katex": "^0.16.45",
     "lint-staged": "^16.4.0",
     "lowlight": "^3.3.0",
@@ -270,8 +274,8 @@
     "marked": "^17.0.1",
     "mermaid": "^11.17.2",
     "monaco-editor": "^0.55.1",
-    "oxfmt": "^0.65.0",
-    "oxlint": "^1.80.0",
+    "oxfmt": "^0.70.0",
+    "oxlint": "^1.85.0",
     "oxlint-plugin-anti-slop": "github:dmmulroy/anti-slop#c44ef22ca116d0ba62a3ff663a0bd13a3f3fa40b",
     "oxlint-plugin-react-doctor": "0.9.1",
     "oxlint-tsgolint": "7.0.2001",
@@ -299,6 +303,7 @@
     "sonner": "^2.0.7",
     "tailwind-merge": "^3.5.0",
     "tailwindcss": "^4.2.4",
+    "tar": "7.5.22",
     "tw-animate-css": "^1.4.0",
     "typescript": "^7.0.2",
     "typescript-api": "npm:typescript@6.0.3",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 513267db1e36..1d2fe31772f3 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -106,10 +106,10 @@ settings:
   excludeLinksFromLockfile: false
 
 overrides:
-  monaco-editor>dompurify: 3.4.14
+  monaco-editor>dompurify: 3.4.15
 
 patchedDependencies:
-  '@vscode/windows-process-tree@0.8.0': e66202cc623996d02040c93449eb9ae353fddadf426cb53202a59ee710ee6fe7
+  '@vscode/windows-process-tree@0.8.0': b4be93859cefb159949d9cf05f97fa91a221dff0f793a6f03d02d78ae5b32035
   '@xterm/addon-image@0.10.0-beta.300': 5fc280019957573eefe8daa2969534d6090ddb29c6b5842b8f22e99dc1ce3146
   '@xterm/addon-ligatures@0.11.0-beta.300': 47405b9994b5acf1b4e90b49250358c1ca03649854d59560e7732b72fe336920
   '@xterm/addon-search@0.17.0-beta.300': eee5338dd2621ece46e79c61ec06766cd7fadaf79ffdb24e2a8ab68e97ef31f0
@@ -117,7 +117,7 @@ patchedDependencies:
   '@xterm/addon-webgl@0.20.0-beta.299': 94687e89a0115e6e6aa102837f986debdc029c091527ee5eb4a4e17ceaf9473e
   '@xterm/xterm@6.1.0-beta.303': dd0ccc59cd1ccf99f4d76e5aa2456da165fa0804dce19a833d7638bd07ffa393
   lint-staged@16.4.0: 7333b3837f80a7fbd045964db6d76ba4fc118e49134bdbabb00585b6b7b60673
-  node-pty@1.1.0: 346cb29d33dd6eeb14910ff411c7584b0b2ff9a4b271c4b6d23c3b48e6548f74
+  node-pty@1.1.0: 92c95cffab383d86b3b13a460c75a08074468ebf1f3911db8e874e083201f192
 
 importers:
 
@@ -125,13 +125,13 @@ importers:
     dependencies:
       '@anthropic-ai/claude-agent-sdk':
         specifier: 0.3.251
-        version: 0.3.251(@anthropic-ai/sdk@0.122.0(zod@4.5.4))(@modelcontextprotocol/sdk@1.30.0(supports-color@7.2.0)(zod@4.5.4))(zod@4.5.4)
+        version: 0.3.251(@anthropic-ai/sdk@0.122.0(zod@4.6.5))(@modelcontextprotocol/sdk@1.30.0(supports-color@7.2.0)(zod@4.6.5))(zod@4.6.5)
       '@electron-toolkit/utils':
         specifier: ^4.0.0
         version: 4.0.0(electron@43.7.0(supports-color@7.2.0))
       '@floating-ui/dom':
-        specifier: 1.7.6
-        version: 1.7.6
+        specifier: 1.8.0
+        version: 1.8.0
       '@linear/sdk':
         specifier: ^82.1.0
         version: 82.1.0(graphql@16.14.2)
@@ -161,10 +161,10 @@ importers:
         version: 3.3.1
       node-pty:
         specifier: ^1.1.0
-        version: 1.1.0(patch_hash=346cb29d33dd6eeb14910ff411c7584b0b2ff9a4b271c4b6d23c3b48e6548f74)
+        version: 1.1.0(patch_hash=92c95cffab383d86b3b13a460c75a08074468ebf1f3911db8e874e083201f192)
       posthog-node:
-        specifier: ^5.33.3
-        version: 5.33.3
+        specifier: ^5.52.5
+        version: 5.52.5
       proper-lockfile:
         specifier: 4.1.2
         version: 4.1.2
@@ -172,8 +172,8 @@ importers:
         specifier: ^1.5.4
         version: 1.5.4
       react-i18next:
-        specifier: 17.0.13
-        version: 17.0.13(i18next@26.3.1(typescript@7.0.2))(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(typescript@7.0.2)
+        specifier: 17.0.15
+        version: 17.0.15(i18next@26.3.1(typescript@7.0.2))(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(typescript@7.0.2)
       serve-sim:
         specifier: 0.1.40
         version: 0.1.40(typescript@7.0.2)
@@ -184,8 +184,8 @@ importers:
         specifier: ^1.17.0
         version: 1.17.0
       tldts:
-        specifier: 7.4.12
-        version: 7.4.12
+        specifier: 7.4.14
+        version: 7.4.14
       tweetnacl:
         specifier: ^1.0.3
         version: 1.0.3
@@ -193,11 +193,11 @@ importers:
         specifier: ^8.21.3
         version: 8.21.3
       yaml:
-        specifier: ^2.8.4
-        version: 2.8.4
+        specifier: ^2.9.1
+        version: 2.9.1
       zod:
-        specifier: ~4.5.4
-        version: 4.5.4
+        specifier: ~4.6.5
+        version: 4.6.5
     devDependencies:
       '@dnd-kit/core':
         specifier: ^6.3.1
@@ -215,35 +215,35 @@ importers:
         specifier: ^4.7.0
         version: 4.7.0(monaco-editor@0.55.1)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
       '@oxlint/plugins':
-        specifier: 1.80.0
-        version: 1.80.0
+        specifier: 1.85.0
+        version: 1.85.0
       '@playwright/test':
-        specifier: ^1.59.1
-        version: 1.59.1
+        specifier: ^1.63.0
+        version: 1.63.0
       '@sanity/diff-match-patch':
-        specifier: ^3.2.0
-        version: 3.2.0
+        specifier: ^3.2.1
+        version: 3.2.1
       '@shadcn/lint':
         specifier: ^0.1.0
         version: 0.1.0(eslint@10.10.0(jiti@2.7.0)(supports-color@7.2.0))(supports-color@7.2.0)(typescript@7.0.2)
       '@stablyai/playwright-test':
-        specifier: ^2.1.14
-        version: 2.1.14(@playwright/test@1.59.1)(zod@4.5.4)
+        specifier: ^2.1.16
+        version: 2.1.16(@playwright/test@1.63.0)(zod@4.6.5)
       '@tailwindcss/vite':
         specifier: ^4.2.4
-        version: 4.2.4(rolldown-vite@7.3.1(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@25.9.5)(esbuild@0.25.12)(jiti@2.7.0)(yaml@2.8.4))
+        version: 4.2.4(rolldown-vite@7.3.1(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@25.9.5)(esbuild@0.25.12)(jiti@2.7.0)(yaml@2.9.1))
       '@tanstack/react-virtual':
-        specifier: ^3.14.10
-        version: 3.14.10(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+        specifier: ^3.14.13
+        version: 3.14.13(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
       '@testing-library/jest-dom':
         specifier: ^6.9.1
         version: 6.9.1
       '@testing-library/react':
-        specifier: ^16.3.2
-        version: 16.3.2(@testing-library/dom@10.4.1)(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+        specifier: ^16.3.3
+        version: 16.3.3(@testing-library/dom@10.4.1)(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
       '@testing-library/user-event':
-        specifier: ^14.6.1
-        version: 14.6.1(@testing-library/dom@10.4.1)
+        specifier: ^14.6.7
+        version: 14.6.7(@testing-library/dom@10.4.1)
       '@tiptap/extension-code-block':
         specifier: 3.31.3
         version: 3.31.3(@tiptap/core@3.31.3(@tiptap/pm@3.31.3))(@tiptap/pm@3.31.3)
@@ -294,7 +294,7 @@ importers:
         version: 3.31.3
       '@tiptap/react':
         specifier: 3.31.3
-        version: 3.31.3(@floating-ui/dom@1.7.6)(@tiptap/core@3.31.3(@tiptap/pm@3.31.3))(@tiptap/pm@3.31.3)(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+        version: 3.31.3(@floating-ui/dom@1.8.0)(@tiptap/core@3.31.3(@tiptap/pm@3.31.3))(@tiptap/pm@3.31.3)(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
       '@tiptap/starter-kit':
         specifier: 3.31.3
         version: 3.31.3
@@ -321,7 +321,7 @@ importers:
         version: 8.18.1
       '@vitejs/plugin-react':
         specifier: ^5.2.0
-        version: 5.2.0(rolldown-vite@7.3.1(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@25.9.5)(esbuild@0.25.12)(jiti@2.7.0)(yaml@2.8.4))
+        version: 5.2.0(rolldown-vite@7.3.1(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@25.9.5)(esbuild@0.25.12)(jiti@2.7.0)(yaml@2.9.1))
       '@vscode/ripgrep-universal':
         specifier: 1.18.0
         version: 1.18.0
@@ -362,8 +362,8 @@ importers:
         specifier: 8.0.4
         version: 8.0.4
       dompurify:
-        specifier: 3.4.14
-        version: 3.4.14
+        specifier: 3.4.15
+        version: 3.4.15
       electron:
         specifier: 43.7.0
         version: 43.7.0(supports-color@7.2.0)
@@ -375,7 +375,7 @@ importers:
         version: 26.15.3(dmg-builder@26.15.3)
       electron-vite:
         specifier: ^5.0.0
-        version: 5.0.0(@swc/core@1.15.46)(rolldown-vite@7.3.1(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@25.9.5)(esbuild@0.25.12)(jiti@2.7.0)(yaml@2.8.4))
+        version: 5.0.0(@swc/core@1.15.46)(rolldown-vite@7.3.1(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@25.9.5)(esbuild@0.25.12)(jiti@2.7.0)(yaml@2.9.1))
       emoji-picker-react:
         specifier: ^4.19.1
         version: 4.19.1(react@19.2.8)
@@ -395,8 +395,8 @@ importers:
         specifier: ^9.1.7
         version: 9.1.7
       i18next-cli:
-        specifier: 1.65.0
-        version: 1.65.0(@types/node@25.9.5)(react-dom@19.2.8(react@19.2.8))(typescript@7.0.2)
+        specifier: 1.74.1
+        version: 1.74.1(@types/node@25.9.5)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(typescript@7.0.2)
       katex:
         specifier: ^0.16.45
         version: 0.16.45
@@ -419,11 +419,11 @@ importers:
         specifier: ^0.55.1
         version: 0.55.1
       oxfmt:
-        specifier: ^0.65.0
-        version: 0.65.0
+        specifier: ^0.70.0
+        version: 0.70.0
       oxlint:
-        specifier: ^1.80.0
-        version: 1.80.0(oxlint-tsgolint@7.0.2001)
+        specifier: ^1.85.0
+        version: 1.85.0(oxlint-tsgolint@7.0.2001)
       oxlint-plugin-anti-slop:
         specifier: github:dmmulroy/anti-slop#c44ef22ca116d0ba62a3ff663a0bd13a3f3fa40b
         version: https://codeload.github.com/dmmulroy/anti-slop/tar.gz/c44ef22ca116d0ba62a3ff663a0bd13a3f3fa40b
@@ -505,6 +505,9 @@ importers:
       tailwindcss:
         specifier: ^4.2.4
         version: 4.2.4
+      tar:
+        specifier: 7.5.22
+        version: 7.5.22
       tw-animate-css:
         specifier: ^1.4.0
         version: 1.4.0
@@ -519,10 +522,10 @@ importers:
         version: 11.0.5
       vite:
         specifier: npm:rolldown-vite@7.3.1
-        version: rolldown-vite@7.3.1(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@25.9.5)(esbuild@0.25.12)(jiti@2.7.0)(yaml@2.8.4)
+        version: rolldown-vite@7.3.1(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@25.9.5)(esbuild@0.25.12)(jiti@2.7.0)(yaml@2.9.1)
       vitest:
         specifier: ^4.1.11
-        version: 4.1.11(@opentelemetry/api@1.9.1)(@types/node@25.9.5)(happy-dom@20.11.8)(msw@2.14.3(@types/node@25.9.5)(typescript@7.0.2))(rolldown-vite@7.3.1(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@25.9.5)(esbuild@0.25.12)(jiti@2.7.0)(yaml@2.8.4))
+        version: 4.1.11(@opentelemetry/api@1.9.1)(@types/node@25.9.5)(happy-dom@20.11.8)(msw@2.14.3(@types/node@25.9.5)(typescript@7.0.2))(rolldown-vite@7.3.1(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@25.9.5)(esbuild@0.25.12)(jiti@2.7.0)(yaml@2.9.1))
       vscode-oniguruma:
         specifier: ^2.0.1
         version: 2.0.1
@@ -538,7 +541,7 @@ importers:
         version: link:native/windows-registry
       '@vscode/windows-process-tree':
         specifier: 0.8.0
-        version: 0.8.0(patch_hash=e66202cc623996d02040c93449eb9ae353fddadf426cb53202a59ee710ee6fe7)
+        version: 0.8.0(patch_hash=b4be93859cefb159949d9cf05f97fa91a221dff0f793a6f03d02d78ae5b32035)
       sherpa-onnx-darwin-arm64:
         specifier: 1.12.37
         version: 1.12.37
@@ -1040,11 +1043,11 @@ packages:
     resolution: {integrity: sha512-IkO+/KEUvwbVpiURZg+P7zF74z5Jxe0UgJxVni+RtoHQ6IZieXaO02kmadomap/q+l6bc/jdPGGqTjhuZnuz1Q==}
     engines: {node: ^20.19.0 || ^22.13.0 || >=24}
 
-  '@floating-ui/core@1.7.5':
-    resolution: {integrity: sha512-1Ih4WTWyw0+lKyFMcBHGbb5U5FtuHJuujoyyr5zTaWS5EYMeT6Jb2AuDeftsCsEuchO+mM2ij5+q9crhydzLhQ==}
+  '@floating-ui/core@1.8.0':
+    resolution: {integrity: sha512-0CIZ5itps/8x7BG8dEIhs53BvCUH2PCoogtakwRTut+Arm58sJooJ0AuZhLw2HJYIR5cMLNPBSS728sPho2khQ==}
 
-  '@floating-ui/dom@1.7.6':
-    resolution: {integrity: sha512-9gZSAI5XM36880PPMm//9dfiEngYoC6Am2izES1FF406YFsjvyBMmeJ2g4SAju3xWwtuynNRFL2s9hgxpLI5SQ==}
+  '@floating-ui/dom@1.8.0':
+    resolution: {integrity: sha512-yXSrzeHZBTZadLOlfyhCkJHNeLJnHRnRInwdZ40L7ZiaAtrBwoYlsDrX3v5zB1Utk7CLfzcOVnVVWoXEky7Ceg==}
 
   '@floating-ui/react-dom@2.1.8':
     resolution: {integrity: sha512-cC52bHwM/n/CxS87FH0yWdngEZrjdtLW/qVruo68qg+prK7ZQ4YGdut2GyDVpoGeAYe/h899rVeOVm6Oi40k2A==}
@@ -1052,8 +1055,8 @@ packages:
       react: '>=16.8.0'
       react-dom: '>=16.8.0'
 
-  '@floating-ui/utils@0.2.11':
-    resolution: {integrity: sha512-RiB/yIh78pcIxl6lLMG0CgBXAZ2Y0eVHqMPYugu+9U0AeT6YBeiJpf7lbdJNIugFP5SIjwNRgo4DhR1Qxi26Gg==}
+  '@floating-ui/utils@0.2.12':
+    resolution: {integrity: sha512-HpCo8tmWzLVad5s2d19EhAz5zqrrQ6s69qd6moPMQvkOuSwDT1YgRfWSVuc4ennqrgv3OHppiOGMQ7oC13yIww==}
 
   '@graphql-typed-document-node/core@3.2.0':
     resolution: {integrity: sha512-mB9oAsNCm9aM3/SOv4YtBMqZbYj10R7dkq8byBqxGY/ncFwhf2oQzMV+LCRlWoDSEBJ3COiR1yeDvMtsoOsuFQ==}
@@ -1096,8 +1099,12 @@ packages:
     resolution: {integrity: sha512-3eTuUO1vH2cZm2ZKHeQxnOqlTi9EfZDGgIe3BL3I4u+rJHocr9Fz86M4fjYABPvFnQG/gGK551HqDiIcETwU6Q==}
     engines: {node: '>=23.5.0 || ^22.13.0 || ^20.17.0'}
 
-  '@inquirer/checkbox@5.2.1':
-    resolution: {integrity: sha512-b6xmA/VlTe0ZgDQHDui+Nav470u7u49nRd8/iuhOcQPO9Ch7lGuogydhi2VOmNlZ+zXcM8IcPuNSwQcdJaF/kw==}
+  '@inquirer/ansi@2.0.8':
+    resolution: {integrity: sha512-WpQM+Ti6Z40EFwwt+uL2p4UabT+W179zHp6HhLVOzfbwnVn05IPO/eXIZXGNqcT1jbQ15SujNLzQ39k4QPPxBQ==}
+    engines: {node: '>=23.5.0 || ^22.13.0 || ^20.17.0'}
+
+  '@inquirer/checkbox@5.2.5':
+    resolution: {integrity: sha512-bRt8J8m+Fot9CXv+zNQGXUq2ET0MggR1fPz7v6edN6MFYmsbfGnMmkmWZJEegMKqrAC8ej/o1sqisHZXZJMAfQ==}
     engines: {node: '>=23.5.0 || ^22.13.0 || ^20.17.0'}
     peerDependencies:
       '@types/node': '>=18'
@@ -1114,6 +1121,15 @@ packages:
       '@types/node':
         optional: true
 
+  '@inquirer/confirm@6.3.2':
+    resolution: {integrity: sha512-Xvr/0HggjddPtGppuqVmxhTw+Hr8PvsZ/k0HmOEaAqQEt80OITNkFWnsdNmyT0/eM4Ab+iJLx2R8rctlEyfSVg==}
+    engines: {node: '>=23.5.0 || ^22.13.0 || ^20.17.0'}
+    peerDependencies:
+      '@types/node': '>=18'
+    peerDependenciesMeta:
+      '@types/node':
+        optional: true
+
   '@inquirer/core@11.2.1':
     resolution: {integrity: sha512-Qd6GJT1yVyrZZCfN8W2qKF5ApmqryXRhRKCuip8h01x2w/esJQ2XIYc6f9abMIHgKQdBfFTSOdbHRLAhuM09UA==}
     engines: {node: '>=23.5.0 || ^22.13.0 || ^20.17.0'}
@@ -1123,8 +1139,8 @@ packages:
       '@types/node':
         optional: true
 
-  '@inquirer/editor@5.2.2':
-    resolution: {integrity: sha512-ZRVd/oD+sYsUd5zVm0NflqEzlqfYCyHNsqkHl2oWXEUHs12tCbcSFi+wVFEvD8+LGRaMUsVrE7qeo6lSG/S1Vg==}
+  '@inquirer/core@12.0.3':
+    resolution: {integrity: sha512-wsSy0sznmXwkty+2PzZwx00Cazc/E0r0B7mAzdGROz2Ct+DFZXaK7WDjGZvgjRldxH5ZhFVfF2lgkYrqgOw2KA==}
     engines: {node: '>=23.5.0 || ^22.13.0 || ^20.17.0'}
     peerDependencies:
       '@types/node': '>=18'
@@ -1132,8 +1148,8 @@ packages:
       '@types/node':
         optional: true
 
-  '@inquirer/expand@5.1.1':
-    resolution: {integrity: sha512-YmQpenjbFSHAK3sOd44puHh3V1KXXr+JiNpUztoSQ4drLh2rTVzTap/YtlAVu/5xavifIlBfNEzJ/neZJ1a/1g==}
+  '@inquirer/editor@5.3.3':
+    resolution: {integrity: sha512-YsKkS2q63IiLtaDK/9nqzdComN97SDQrmKiyNggN+ceP4ty+Z6VwyTz3FpjeUWeW1Efss2xHFKCC9sx7hnrsxg==}
     engines: {node: '>=23.5.0 || ^22.13.0 || ^20.17.0'}
     peerDependencies:
       '@types/node': '>=18'
@@ -1141,8 +1157,17 @@ packages:
       '@types/node':
         optional: true
 
-  '@inquirer/external-editor@3.0.3':
-    resolution: {integrity: sha512-6thf5I8q7lZwzGLAxPaaGEREEkZ3nyePPDQ1oyobblxmEE8mqTLguScP7pDjUTAibiyb4hfXl+qjUEJ+di/aNA==}
+  '@inquirer/expand@5.1.5':
+    resolution: {integrity: sha512-uHuXLmXW+TtIfT/9vSBotypAkqn1n34Ul+CLGPos/xANyO4Ff5xZzkYhbKR4NEcfVK4a9mHQOpwVZzluSHFRGw==}
+    engines: {node: '>=23.5.0 || ^22.13.0 || ^20.17.0'}
+    peerDependencies:
+      '@types/node': '>=18'
+    peerDependenciesMeta:
+      '@types/node':
+        optional: true
+
+  '@inquirer/external-editor@3.0.5':
+    resolution: {integrity: sha512-f3QQJRIX5ZEneBHNUIuPjmbdzHnmRFJA8r2dkcb8q+OM5Uv5KtnuAttQumnrjcBVBM3mcTX1CkmtAkU58VRZxg==}
     engines: {node: '>=23.5.0 || ^22.13.0 || ^20.17.0'}
     peerDependencies:
       '@types/node': '>=18'
@@ -1154,8 +1179,12 @@ packages:
     resolution: {integrity: sha512-aJ8TBPOGB6f/2qziPfElISTCEd5XOYTFckA2SGjhNmiKzfK/u4ot3v0DUzGVdUnKjN10EqnnEPck36BkyfLnJw==}
     engines: {node: '>=23.5.0 || ^22.13.0 || ^20.17.0'}
 
-  '@inquirer/input@5.1.2':
-    resolution: {integrity: sha512-9K/DDBSQpOyZSkt6sOVP9Vo0TR7atX2kuILsUu0x3wVcVbe97lJwIJKMLdMw25tDYuXl/qp6erT0Xs1rfmcfZg==}
+  '@inquirer/figures@2.0.9':
+    resolution: {integrity: sha512-EAWgUTGQ/Umgga51dE3B2PUHbufuXarDfg86uVgoSgNHNNQnyFKcOrQLWVqYMghuSyHh8+2HUH0Js9cTC1WAdg==}
+    engines: {node: '>=23.5.0 || ^22.13.0 || ^20.17.0'}
+
+  '@inquirer/input@5.1.6':
+    resolution: {integrity: sha512-HtcJhB2QFVXbLuJ5S3syhNbTUVxYvwqV4VRBDkQceBloC9bmTViUoRFP5PbSaDZb3HzfPmpuU/gG4ybVBz4FHA==}
     engines: {node: '>=23.5.0 || ^22.13.0 || ^20.17.0'}
     peerDependencies:
       '@types/node': '>=18'
@@ -1163,8 +1192,8 @@ packages:
       '@types/node':
         optional: true
 
-  '@inquirer/number@4.1.1':
-    resolution: {integrity: sha512-XF4IXAbPnGPgw0wsbC/i2tPcyfdZgDpUlhsqU0SfT4IRIGWha6Xm9VRgN5yYxJq+jnyXlfXI/nQ3ulfk0iEICA==}
+  '@inquirer/number@4.2.3':
+    resolution: {integrity: sha512-6Yuwh1NGSbu1Lo4N1EWjXs1jKRntLg/ZCwhmeorEHde90v1XxAozdbd4Iu30eOQLW+6h1hp2O9ujNfLSbTPJnA==}
     engines: {node: '>=23.5.0 || ^22.13.0 || ^20.17.0'}
     peerDependencies:
       '@types/node': '>=18'
@@ -1172,8 +1201,8 @@ packages:
       '@types/node':
         optional: true
 
-  '@inquirer/password@5.1.1':
-    resolution: {integrity: sha512-3XBfF7DAsp5qeDsvN5Rd1HmbNokVvEQoUM0QLrRcybC9nX96w3Pbmu7qUsb3IT3J3jBvs2+mTXaKHOUsgHMLzg==}
+  '@inquirer/password@5.2.2':
+    resolution: {integrity: sha512-W9zYdyzogK+6110mqwaSJWCBu2yA5Q/OfnGSjjZB1bNpHlmUozXxTl0+QOZBNeVd6Qo81/qT75gW05gLAtITxw==}
     engines: {node: '>=23.5.0 || ^22.13.0 || ^20.17.0'}
     peerDependencies:
       '@types/node': '>=18'
@@ -1181,8 +1210,8 @@ packages:
       '@types/node':
         optional: true
 
-  '@inquirer/prompts@8.5.2':
-    resolution: {integrity: sha512-IYR/3C/paEVVQYQvdDlFZVjRCJVYHHON0XXMH91KO9GSxs0TdKYWlUdvfQl2EfAHDxUaN3IBffkE/BDTh5nJ6g==}
+  '@inquirer/prompts@8.7.2':
+    resolution: {integrity: sha512-QoRB4wFIjgH5iOhSjoIKMkTvSHDuV+O3OITlIqAYO0oK5x364GJILXiMBvlPiE+klg7Xx9tq5XVqQHcGUDYYPA==}
     engines: {node: '>=23.5.0 || ^22.13.0 || ^20.17.0'}
     peerDependencies:
       '@types/node': '>=18'
@@ -1190,8 +1219,8 @@ packages:
       '@types/node':
         optional: true
 
-  '@inquirer/rawlist@5.3.1':
-    resolution: {integrity: sha512-QqdTqQddL3qPX/PPrjobpsO25NZ4dWXgTLenrR445L2ptLEYE6Z+PD5c5CNDJNx4ugRgELAIpSIJxZaO2jJ2Og==}
+  '@inquirer/rawlist@5.3.5':
+    resolution: {integrity: sha512-1oHky1ONfCOwNrnkQGDE1oaSij/3fI6HFMSf2H/WsGO2lEyDX9My82iggITSy9ddSZ8yk8j9v41OI0fVoSIoaA==}
     engines: {node: '>=23.5.0 || ^22.13.0 || ^20.17.0'}
     peerDependencies:
       '@types/node': '>=18'
@@ -1199,8 +1228,8 @@ packages:
       '@types/node':
         optional: true
 
-  '@inquirer/search@4.2.1':
-    resolution: {integrity: sha512-xJj8QWKRSrfKoBIITLZK61dD3zwo0Rz11fgDImku30/Oe81zMdIdGgrLY2h6RkJ+KZ/GhNYIRMKnH/62qBTA5g==}
+  '@inquirer/search@4.3.3':
+    resolution: {integrity: sha512-fyuIU1Nbpvwlikjg3gXwJFDI11+EFjqQ7P+iByfmivIKQ1vmaykNrD/vy5unHuUqUpsOsnvJ25//tPF7E/RBRA==}
     engines: {node: '>=23.5.0 || ^22.13.0 || ^20.17.0'}
     peerDependencies:
       '@types/node': '>=18'
@@ -1208,8 +1237,8 @@ packages:
       '@types/node':
         optional: true
 
-  '@inquirer/select@5.2.1':
-    resolution: {integrity: sha512-FlDndEUww8m7BfukO2nJa25vhD+H5jxxCv4oGioKqzyWz3nPHhhw4LKdYRSlXuAx7DsdWia7iyaBPKKS95Evfw==}
+  '@inquirer/select@5.2.5':
+    resolution: {integrity: sha512-9kc15hr8r/kI+3DO/xLog5nOzTz1jqsHXa6JBFzmQKhkoJ8Slda1I1L/uD8ZSZ9tF1yp79wwXe7mclvX1rqR2Q==}
     engines: {node: '>=23.5.0 || ^22.13.0 || ^20.17.0'}
     peerDependencies:
       '@types/node': '>=18'
@@ -1226,6 +1255,15 @@ packages:
       '@types/node':
         optional: true
 
+  '@inquirer/type@4.1.1':
+    resolution: {integrity: sha512-yJoHYrMnxIsJZCY+0Vb66Dy3he3kL3e2wOBKhoSwWWAzZAY82emlxwgprCtp6yRixvNRNq9ztfRWQYPNr3Go7A==}
+    engines: {node: '>=23.5.0 || ^22.13.0 || ^20.17.0'}
+    peerDependencies:
+      '@types/node': '>=18'
+    peerDependenciesMeta:
+      '@types/node':
+        optional: true
+
   '@isaacs/fs-minipass@4.0.1':
     resolution: {integrity: sha512-wgm9Ehl2jpeqP3zw/7mo3kRHFp5MEDhqAdwy1fTGkHAwnkGOVsgpvQhL8B5n1qlb01jV3n/bI0ZfZp5lWA1k4w==}
     engines: {node: '>=18.0.0'}
@@ -1243,6 +1281,9 @@ packages:
   '@jridgewell/sourcemap-codec@1.5.5':
     resolution: {integrity: sha512-cYQ9310grqxueWbl+WuIUIaiUaDcj7WOq5fVhEljNVgRfOUhY9fy2zTvfoqWsnebh8Sl70VScFbICvJnLKB0Og==}
 
+  '@jridgewell/sourcemap-codec@1.6.0':
+    resolution: {integrity: sha512-T7jf+5zgsZHwNJ4lvQ7/aezbyk0nNX+zJVWpmHA7VYsEx7a7qr5Rg5IbtJFqkgze5Y2sruq1RUY8Q837Od7iFw==}
+
   '@jridgewell/trace-mapping@0.3.31':
     resolution: {integrity: sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw==}
 
@@ -1685,124 +1726,124 @@ packages:
   '@oxc-project/types@0.148.0':
     resolution: {integrity: sha512-Nm4s/jB+4FpFsPhWGEC4h7rzksesmtnMXomo6rCMcg/b8zLQuOziRgkCS1fxDCXOlJB/6Q8oABOZ/OP6RIPj9A==}
 
-  '@oxfmt/binding-android-arm-eabi@0.65.0':
-    resolution: {integrity: sha512-M10Gs1SSpTNI6ahGx3M/OlIdUF4hkaP6OgUb+MS79t/Pgflk3r1nW5gPFqsZGUAXg0H1AfANT9AvLdBSTIhZKg==}
+  '@oxfmt/binding-android-arm-eabi@0.70.0':
+    resolution: {integrity: sha512-Xd7YO4/T2axEj6FTLcj4Why3mTBqFMg+x24xtorT4Lb2+1g82090GH0a/4U1m0pABGYiix2bq1pqkYrmV3f0Sw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm]
     os: [android]
 
-  '@oxfmt/binding-android-arm64@0.65.0':
-    resolution: {integrity: sha512-6DXH5sftNlaHpWJG50hFMF+Qxtq5D2TmahvcDPxWNcGIf8qrC9Y0YgHYcYZ2hlWzaccKXh/f3GcssH8vtkl4JA==}
+  '@oxfmt/binding-android-arm64@0.70.0':
+    resolution: {integrity: sha512-x9rlMYyKXdgKdYyUJzGsK1ZV8P4di/J32ipzcS6Jet6p9r9UAh28neXIMtdlSaJJycdi61Z4YkcLKLpk8ueFjg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [android]
 
-  '@oxfmt/binding-darwin-arm64@0.65.0':
-    resolution: {integrity: sha512-K9m7lr53pcOLETNsC88sWes/GWHUGjZyHx95UhYcSXy0r30haLdeXlSufSenEAtoLaW753WN8/l4M7GYcRt6cg==}
+  '@oxfmt/binding-darwin-arm64@0.70.0':
+    resolution: {integrity: sha512-IUTUPvrBVYy7POh4stXzRdz4IVC/1QSaviCWoyenSlOhGu0X9j5K07vCTM9biLjAA2Zs31l0Rj5vvRpj9n95wA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [darwin]
 
-  '@oxfmt/binding-darwin-x64@0.65.0':
-    resolution: {integrity: sha512-sTNwIx1gre3MyiHOPLu7IGW4UyMScYL4DTmJT01p4vzB0En+OJUQz6KuH8t0PpsClRSaMuY3b0QmtoPItfO8Lg==}
+  '@oxfmt/binding-darwin-x64@0.70.0':
+    resolution: {integrity: sha512-vw745q870oTd6J517O24asoX4/E+eK0nxYIFoedSLqgJ+nI5En7+ZS82iZSHZ69zevQrnOXiyHP01dA+t8xD8w==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [darwin]
 
-  '@oxfmt/binding-freebsd-x64@0.65.0':
-    resolution: {integrity: sha512-lYZMVIiIpnjGu5hJb2jxA8NYQ/e0OTGuaiAf4dqlGPNnPmUTu23FZRMltmjro/KkQm1uE4NT4n5yJ2zWmKcpfA==}
+  '@oxfmt/binding-freebsd-x64@0.70.0':
+    resolution: {integrity: sha512-NO14EgSM9dFkcg+MfGPxvsKqXYs9LKaxPrOKXpv1R0rLokGGFDcCq6dBMq18dE4wlpFOovX0UZY2uh1P30O7QA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [freebsd]
 
-  '@oxfmt/binding-linux-arm-gnueabihf@0.65.0':
-    resolution: {integrity: sha512-gIdXFAt/bURnjxuoedDEWdZ0PEWEmdDcm8qdpoFYYvW3QMk/5D4vUaH4mlMeRpeTdST4izUgHVO6RawQ4QulJw==}
+  '@oxfmt/binding-linux-arm-gnueabihf@0.70.0':
+    resolution: {integrity: sha512-139OEhHarj9CYoJ/i9gXlPv4KLBGtLj2toseOWYFf09QwlhklaZk+wW3aOvlqoeZtuayvkoSNVWra7WJ21s3VQ==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm]
     os: [linux]
 
-  '@oxfmt/binding-linux-arm-musleabihf@0.65.0':
-    resolution: {integrity: sha512-jJVyADto7gA2AaX5qAjAexrxx9PJQaKWOe8PICE7yKMbjBRyOHcmj9TtVJ+MZYDUQ3hodU0AcoTj0jFQ1W4C6Q==}
+  '@oxfmt/binding-linux-arm-musleabihf@0.70.0':
+    resolution: {integrity: sha512-GEh2PY3IWTE0M24eNhTduountANSbWyDmMnzFSQE/nGg/bjPugbUgiGuFu+xdqcQSd/HKSwH80/F2yVVD48yhA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm]
     os: [linux]
 
-  '@oxfmt/binding-linux-arm64-gnu@0.65.0':
-    resolution: {integrity: sha512-p3RFkB+u7u+8up99b/NEcI1hdpLDiGgJYNwDorB60n7eH+eKposAKuMBxx+NqB3b+sJP4CZmYDh9G7X62tUsKg==}
+  '@oxfmt/binding-linux-arm64-gnu@0.70.0':
+    resolution: {integrity: sha512-En5i+UJmZSPxuSf47F2Hl5YOzKB0bicQLnGQkeTCMQ35cWLtbrSwACJKfiLqRZrk05DwSnsJkhBRaM3OURtIaA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [linux]
     libc: [glibc]
 
-  '@oxfmt/binding-linux-arm64-musl@0.65.0':
-    resolution: {integrity: sha512-5Prb0uFzJHr+OUD/qS/TmU526wD+PaHDsm3KoRiUXbMIDpTSErjeQYkK3OQeshAvD/PuLa9WGEi9WPajjdOZJg==}
+  '@oxfmt/binding-linux-arm64-musl@0.70.0':
+    resolution: {integrity: sha512-WWOoV5W9Im3flVwOVrWn/2DUlOF8v5vcCip+kcNuaMpulRCh6nzzt1Su2vcL2F908YJIXNV3HvegbBHuyLwKHg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [linux]
     libc: [musl]
 
-  '@oxfmt/binding-linux-ppc64-gnu@0.65.0':
-    resolution: {integrity: sha512-S8svxTp81obnF3admN9yd+u2rOYXtyzThLGBTg1PY6TPtGcC09BaaXLQD+TBSMa7yvqhCDZ8DFri+S/yG60qCg==}
+  '@oxfmt/binding-linux-ppc64-gnu@0.70.0':
+    resolution: {integrity: sha512-YUouneIqW+5n7aE8xx/zeZ6/utr/KH7oykcGoFyd8Uz8uh591T1oKlnoWA3BsRq/ZR42oY1w4MUYvS/0e/MQOA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [ppc64]
     os: [linux]
     libc: [glibc]
 
-  '@oxfmt/binding-linux-riscv64-gnu@0.65.0':
-    resolution: {integrity: sha512-WtXBr75G/h2qOHy8SiGtC1R6aS3jt4mE52v1D8AtwMXIgoOmSNP9lKvbSaTRoL0e5wsMPoi6T72QWDYPu+S+nA==}
+  '@oxfmt/binding-linux-riscv64-gnu@0.70.0':
+    resolution: {integrity: sha512-iEnMf21S5aGVa4hViDGY8sAQ/AHyCu2JPyrQF8P06wtHhSkD1YJBeT4m/KiGewgf7+a5XCYSCRIPcRQa1xwEoQ==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [riscv64]
     os: [linux]
     libc: [glibc]
 
-  '@oxfmt/binding-linux-riscv64-musl@0.65.0':
-    resolution: {integrity: sha512-YwSLVvpaz4o/nv/miiPEBJz+eJ+VmbgNIrao6RccK9ce+L5EA8wP+ZD0uFeq6wKOza6zoWv/dR0sj6lip6R3EA==}
+  '@oxfmt/binding-linux-riscv64-musl@0.70.0':
+    resolution: {integrity: sha512-91Sdniaj20fQzyMeCxMDzTP4c9s4RB8dGQ308xHhDR0n6U7+1Xq7N9klE7mfXq8iV3lRmIGSXi5X23Hn/0XX/g==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [riscv64]
     os: [linux]
     libc: [musl]
 
-  '@oxfmt/binding-linux-s390x-gnu@0.65.0':
-    resolution: {integrity: sha512-XQTPqgvyrgkKcFq+Tp2eK6JS7sqqJ+nRmy2Fav4j3I+i4dJoPJm7YwEdoeSDX9xkqj9jZ/lWfF3bXUWztIrn6A==}
+  '@oxfmt/binding-linux-s390x-gnu@0.70.0':
+    resolution: {integrity: sha512-uUV30M6E+2TKKGMaKiwfeL4RZrviHXlUxsrYJ/jFBb+1EZy+pnFT+hF73eeWdzh5NqPOAnw0iiMAIqjqiLZPFg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [s390x]
     os: [linux]
     libc: [glibc]
 
-  '@oxfmt/binding-linux-x64-gnu@0.65.0':
-    resolution: {integrity: sha512-cjZlx6S/VkeCNWCbwZriTnLnZeTcV3DEyeRGSw/2wwLP9viq+C0bJ4bC1k/ZLkFxDcB1lUgSasPkYGP1bdraOg==}
+  '@oxfmt/binding-linux-x64-gnu@0.70.0':
+    resolution: {integrity: sha512-ivMcX6kNDPhqtbOaBt/ItFlLlTlXNHLgRuNmxP6Na6UuYXRT10llpJcAPbGeRgjjb3Qzv4jwPp3fB0hui50WNQ==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [linux]
     libc: [glibc]
 
-  '@oxfmt/binding-linux-x64-musl@0.65.0':
-    resolution: {integrity: sha512-2azCjxdLtK4zCcIOU1dlXlU0xxfbPi6EjwWx7Ac7teWPidIIDOcIhudup83xNCKYhtqeVd/gaVDOxbUq4syXWA==}
+  '@oxfmt/binding-linux-x64-musl@0.70.0':
+    resolution: {integrity: sha512-w+S+fERxYmlZSyZlJK/U292FjyBoH8cCEj21/tYJX6atX5kNSn+HDkhlFQKT2zcMwUW0uAtUL/bOrlwJZwqRdA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [linux]
     libc: [musl]
 
-  '@oxfmt/binding-openharmony-arm64@0.65.0':
-    resolution: {integrity: sha512-KXQ7xi1e/voP0IQaw6fG6XY4Z5+Llf1XmRSZS1t7pVFCecFJ0iXaboKmVwjFtp5MLlT5iWQrJ2U1C3GJdZ2u+Q==}
+  '@oxfmt/binding-openharmony-arm64@0.70.0':
+    resolution: {integrity: sha512-Zlom1Xkx257R8bk4ZI4zJsrGno2opknz1+5v5baka3nn4FPyvNSdh8JUL4CdN1S1OWRMvJ9UJQ+RfIqGGCUEfA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [openharmony]
 
-  '@oxfmt/binding-win32-arm64-msvc@0.65.0':
-    resolution: {integrity: sha512-2FbbjG5jEqLSLKVJwBap84uJfpn5Y5A53KEO0aUNr+zeiRB9nyPUIFMcSbZVMFLitfBytFWRNngozXYjb6Rsbw==}
+  '@oxfmt/binding-win32-arm64-msvc@0.70.0':
+    resolution: {integrity: sha512-FQgPW5R17vzt7cgrJ8eG/dqX00o2xHsqFeLfw4xzA9FRHpN/DjFo9YDonvIIXGxiEuS9F/jZPnGO+KHNKuCo4Q==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [win32]
 
-  '@oxfmt/binding-win32-ia32-msvc@0.65.0':
-    resolution: {integrity: sha512-LJ+ZacAPSjegDOnSLyA1TMWAhdDrsK4el3REdr1oL2UtVBCMhO2II/Sb3cEW6mF2MfLhl8hDNCSvc7KSbgk3LQ==}
+  '@oxfmt/binding-win32-ia32-msvc@0.70.0':
+    resolution: {integrity: sha512-ZfZublNhZ+XBndMiXhkiLlPE+XyGRDa0CweeTL6t1fZypfCh1LTg7e5CvnOeTBunq15MskOcRempumSPGAaCQA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [ia32]
     os: [win32]
 
-  '@oxfmt/binding-win32-x64-msvc@0.65.0':
-    resolution: {integrity: sha512-higu9cWEO6XXFzATD1jf0mCK34rNfN2H9JrJie7QB1IhleVpTh0QlLH9Ip2C1H/Nd5n0v5pvRtC+5R0uE4HpVg==}
+  '@oxfmt/binding-win32-x64-msvc@0.70.0':
+    resolution: {integrity: sha512-HlIZEn+WzLQL0DszNzldiRl/DPRCX5R0Vkt6qeUPR1YHwy52hZZo4x6HoTOVmKRP2wUiwPGtKsihNY/f8KRaBg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [win32]
@@ -1837,124 +1878,124 @@ packages:
     cpu: [x64]
     os: [win32]
 
-  '@oxlint/binding-android-arm-eabi@1.80.0':
-    resolution: {integrity: sha512-RM3Plj+biQpxa5d1GOOX6ciDlcUROmm4OZ/pLTpitkQt2mJv4jhtY4cbgaetOm5UKWZe05/TGQ6o1Vl8EOHkrA==}
+  '@oxlint/binding-android-arm-eabi@1.85.0':
+    resolution: {integrity: sha512-q2KO/Zso9UT+OMn0NF9ywn4E4t0MI3yxiDhNyhsQ7DyQJrC4FhFE4TXOi4bktFnOWXTMds8qZSbpv2XwRaNOBg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm]
     os: [android]
 
-  '@oxlint/binding-android-arm64@1.80.0':
-    resolution: {integrity: sha512-YlO5JEf0Yr2bUUlu8O8daVcUxtcGGbcSmyV7E7nSbJbfAdxTE0PFPwgnIlw7wXJaTYjb+qs5hI5q3jxUkI7cAw==}
+  '@oxlint/binding-android-arm64@1.85.0':
+    resolution: {integrity: sha512-SxLN3ALjoT9NNdvpjEevGeHvfzTAFrF0NBYB5tzK7/GtCKMze3j1e/m/X2ozqGj2U9hfGG/dg/OG8vpVK4PiDA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [android]
 
-  '@oxlint/binding-darwin-arm64@1.80.0':
-    resolution: {integrity: sha512-BULDOyO3AhsmdWfQeIUCykDt3dd7XZBGLhp1eIh56skRv01O+cNjNPwXMIbeW1x4+pxcln5if72wcRgViVo7PA==}
+  '@oxlint/binding-darwin-arm64@1.85.0':
+    resolution: {integrity: sha512-Y/Sup/J4f0f9UGsSd/xyCNTeWL+gepO63GBdEDAfue9nBsnk9zMmnIXx1O6b1V8C90vB5nucYNZ0pbMXAp8zJA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [darwin]
 
-  '@oxlint/binding-darwin-x64@1.80.0':
-    resolution: {integrity: sha512-YJ4JzLw7N5TDSQFlA0hAQGHvnDZgyypm1yunObVWcWiF9KM7eGCJKYKLgTC2Fi/57OdnBhbj4OkzPGdFQJ6HyA==}
+  '@oxlint/binding-darwin-x64@1.85.0':
+    resolution: {integrity: sha512-ApOSNC04ynpDTwvBD+//0wyfODRSbEzvRoKpX8teffmc27z8AockwSNeMXGJXn5KP85eahDgR/2llICWLkzcnw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [darwin]
 
-  '@oxlint/binding-freebsd-x64@1.80.0':
-    resolution: {integrity: sha512-AYUIk5QnL0s8oWAYsREZwkRYy1SupJTXALo93J1TgzHywxQtdM99FecRMQ87MXEdPQ0j1TmEpeeq3fGNkpvMqg==}
+  '@oxlint/binding-freebsd-x64@1.85.0':
+    resolution: {integrity: sha512-bNrVrCOA/kHky3Tu79IXWXe5bhIgLXfUuUEDHlAGOHUk96MkvDZ1ecaQF19rwstrnaqfP1o9nBTqzIr9+ZHkUg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [freebsd]
 
-  '@oxlint/binding-linux-arm-gnueabihf@1.80.0':
-    resolution: {integrity: sha512-9hBZVANupQ89W9dXyE0n8doCyaW5pDyGn3y6XlIMPZ+rIKuyqkr3SNUXmVJIhuvUq0NBU3RBiSXXE69l4XI6KA==}
+  '@oxlint/binding-linux-arm-gnueabihf@1.85.0':
+    resolution: {integrity: sha512-NUrzOJ1s/EqsVvfn2L/1D8Wro2LPIZUbihL8kOJLh5fEdGEN3rdOGUYq3HwnUIL8sjpoP+4N6RaGrgmMJnaMPw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm]
     os: [linux]
 
-  '@oxlint/binding-linux-arm-musleabihf@1.80.0':
-    resolution: {integrity: sha512-SvS2uKqzY+pbfuvAHzH4338R6Zwo805GAwrIMVvK1KxoOWCIjZUdfzTCvilD7z6JK91v011+zYMryabhDo2AsQ==}
+  '@oxlint/binding-linux-arm-musleabihf@1.85.0':
+    resolution: {integrity: sha512-UJXrAT3E/RWkEqXLIs2ehETja1qfgkPb+5gwLIIS+o/6cf+grHvoOXTa5997a/YNQfcJS0DRBTOfZt95cvOI1g==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm]
     os: [linux]
 
-  '@oxlint/binding-linux-arm64-gnu@1.80.0':
-    resolution: {integrity: sha512-tCLadyqRVL3pQTRPNg7cjXKvcvS4fbyXeQHhKk5BTJ1oftQln5/yIIWbu/Xom/DX41zv2P9QGt6+D/TtQVtY3A==}
+  '@oxlint/binding-linux-arm64-gnu@1.85.0':
+    resolution: {integrity: sha512-lK40QLjI0HxigO7CjDDshEtfYIeiYS0020v5BHFPqN4uuQBQxd2K9LNom2dW15o9F1937quSCRVp4ZsVhdbYdg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [linux]
     libc: [glibc]
 
-  '@oxlint/binding-linux-arm64-musl@1.80.0':
-    resolution: {integrity: sha512-XfpCNRlOPcLlJl4Bn/FUhjqlR6BVavEykERBf/MV7YA9VZDa5g5znVqYhyviMafcxS9Pe/i/kPvHNO0U6svEHQ==}
+  '@oxlint/binding-linux-arm64-musl@1.85.0':
+    resolution: {integrity: sha512-c2zbdBwGKreHXwRx3gWBuFGJxLhxgsg6YlZ+3H+RgRusU/UEV9jNwJ3HGYK+nRo0LvBa7mt6Kj86xoVotUo8cw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [linux]
     libc: [musl]
 
-  '@oxlint/binding-linux-ppc64-gnu@1.80.0':
-    resolution: {integrity: sha512-3I4yMwcFG9NeO8ioY6JBBuKsIm5GL/x7MATt1S4tVWaxPu5HcJ+XnLUbcVBTxG8q2Wu56HSj+NmXQiVYb1lp6A==}
+  '@oxlint/binding-linux-ppc64-gnu@1.85.0':
+    resolution: {integrity: sha512-tlt/Hy8lZ97/lCPmCgw/B3k/mwh+BzaIPbPkldZEly7TwLmx0xe2CQcaW2g/rR0dOgS9JNGCZsMEqLhUNMGvaw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [ppc64]
     os: [linux]
     libc: [glibc]
 
-  '@oxlint/binding-linux-riscv64-gnu@1.80.0':
-    resolution: {integrity: sha512-E1wAKymkpe1/E8helzBKdm81OBOF+ezxRyXRMEuik3ZpWDER5CPOKZwF66RsdwW98uwZv8UTFremUQtC1CzdJA==}
+  '@oxlint/binding-linux-riscv64-gnu@1.85.0':
+    resolution: {integrity: sha512-3tNR9Xey82X0zKuY1d8hJ6Rc9gwRDurmqGLnQZa5xqOXy8/YyiqFXjAtugkKLY82obOlpK1eSiDRlgcNPuxtIg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [riscv64]
     os: [linux]
     libc: [glibc]
 
-  '@oxlint/binding-linux-riscv64-musl@1.80.0':
-    resolution: {integrity: sha512-+gLRGD4sIo3+VA++iham5UxD9tKSoJ/VOrROCEXIcknrYtQg6iIQgvjN0cpiRF7N6UYC7pJbvHJlDnMge5LRpQ==}
+  '@oxlint/binding-linux-riscv64-musl@1.85.0':
+    resolution: {integrity: sha512-wbGRd5PqCcjkJFHhZuZ2OBSUQY9czlQsoA/cQQB9JK/L9mC5MQgGoKAh+xd8QjA5V+0D3j+Qd1lAWn1I8zlelA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [riscv64]
     os: [linux]
     libc: [musl]
 
-  '@oxlint/binding-linux-s390x-gnu@1.80.0':
-    resolution: {integrity: sha512-aR0PrzHj9leW3NmzBAAP4EzdoBNoJcs9sjnIQPIwyRnBGYrRbXUIpEB5Q39AqK3PLY5JK5uEhDQDiUa1QSAstw==}
+  '@oxlint/binding-linux-s390x-gnu@1.85.0':
+    resolution: {integrity: sha512-3Sn0kSrE4DPZCWV/8o+n4x3aFZxI9ulMnkYlwCbJ8eUVkwRK2IerohE/A/z3SNbCwoPFOCJmGE5Avrq0rrvdvQ==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [s390x]
     os: [linux]
     libc: [glibc]
 
-  '@oxlint/binding-linux-x64-gnu@1.80.0':
-    resolution: {integrity: sha512-vSVh5cSo3Xxs6ghBCcFJlpbkbENzDog1qXtoXLa/HC3aCrR4XO76GZbXmQoCPHnu99nQpdCeC3H9tdNICfDh7A==}
+  '@oxlint/binding-linux-x64-gnu@1.85.0':
+    resolution: {integrity: sha512-JY2pxxYfB62bAGfejljVCqc44etItehPuAyaeSAdMuEMtwNA00ggMnS66lC1oIhos6oOXUkuU6mZ9bpFh3BqWg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [linux]
     libc: [glibc]
 
-  '@oxlint/binding-linux-x64-musl@1.80.0':
-    resolution: {integrity: sha512-FfzBXpNQ8u7/ZI/p8bl73MeZ508Ax3hxWp3SiJpEFiC+BB9XcXy5FAZHTLKDPSzrUpxQZSZJAVdDmuJp/+HDBQ==}
+  '@oxlint/binding-linux-x64-musl@1.85.0':
+    resolution: {integrity: sha512-5k74vZ6qJBjBHEOlBk9B/iv68Yu0F1Afw/vvT2ar6OGCqEeXLaSjXz2n/IPCbhLG22UoKoYEJTzpYraRdcp6PA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [linux]
     libc: [musl]
 
-  '@oxlint/binding-openharmony-arm64@1.80.0':
-    resolution: {integrity: sha512-zMzbkumtmprCgRwoYNzcB3iC39fXdJIMLMU33KdCjEGLlJGOEt1+LwQ4LF8ndLzAEKVz4BR0y3V6Xrkk3Nm3yA==}
+  '@oxlint/binding-openharmony-arm64@1.85.0':
+    resolution: {integrity: sha512-GbAl5qt5TCkPLXTaIISZJnugrcBhra6rodcXc9jYt620UtdsTt71NlNmJmm0frxzFpd54x/G+MkitEJA8I/BoA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [openharmony]
 
-  '@oxlint/binding-win32-arm64-msvc@1.80.0':
-    resolution: {integrity: sha512-ib6iRcrXsk4t1fm3iKcwksyWh1ZkZXC/2mEzakl0ai2+6HZunf1WWMZ/xP9EJAvw9g9K4UVTC3NF/+G2qLrbTQ==}
+  '@oxlint/binding-win32-arm64-msvc@1.85.0':
+    resolution: {integrity: sha512-kjmws5MK0et2swk4ND85D7NVQyDHw162i6whtZDLUA/lo6FQyBZDcmMRCMcVZcNrAhIaftVb00x9ChGDOjjNJA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [win32]
 
-  '@oxlint/binding-win32-ia32-msvc@1.80.0':
-    resolution: {integrity: sha512-xhRWBMpLxZvgKAH6+DJZmpP+W8Y8UdQOSU1JfxSWNXsaBaRGW77j+1hCuNHlzj7OH4SPN8fYd1q0o2qrDtoVyw==}
+  '@oxlint/binding-win32-ia32-msvc@1.85.0':
+    resolution: {integrity: sha512-eSsIJx9n4yxvOqYTZyPEMyEXRmE60XH7xGAU7i0Qbsn1lf6Za3CWJ9aRd82oSFKXaxhp+sA6/yMJVRIpLpna6A==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [ia32]
     os: [win32]
 
-  '@oxlint/binding-win32-x64-msvc@1.80.0':
-    resolution: {integrity: sha512-yAnO7lwBYQnz2pcfBPIGQQZWIX5zd5R/1aAKIF3oE+TVj7IhoHcROjOkz3sRDngzqhfPKfFaXqug5j5rE5dn6Q==}
+  '@oxlint/binding-win32-x64-msvc@1.85.0':
+    resolution: {integrity: sha512-pBebIPUpKKhWrhSMWhy8TdAZBewiXnfxmaAGxhzxM1068GagqFaTwgKlU6e+UyJ2sPR+VoHouhXuGJkQjsrDvA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [win32]
@@ -1963,8 +2004,8 @@ packages:
     resolution: {integrity: sha512-Ypt8KeRYw+4jUtlPirfcHWMrn5ms12VrrFPD+Mds477/7tJxG1Kcz2Yrg2nVcTQEUx/GdlhS+BUg1kmxNm04Ug==}
     engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0}
 
-  '@oxlint/plugins@1.80.0':
-    resolution: {integrity: sha512-QRgH1XqQEYNHa4f1vvPQ5fAdNdncHGIUG1ZWLlGIZHky3qwCEeAKYitZNbZMtaXtAQAAFFTOwqUfzESvimqZNA==}
+  '@oxlint/plugins@1.85.0':
+    resolution: {integrity: sha512-qqHqML3ME3cxGgFvWJG8wwMnJc9ol5SMdtqkq0k8r7l0USmC+HRXYjzDacME4Dqkx4yqrUsBhj0JYvji8fHxJQ==}
     engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0}
 
   '@parcel/watcher-android-arm64@2.5.6':
@@ -2069,16 +2110,16 @@ packages:
     resolution: {integrity: sha512-ODOov0sGMJMf3jPonOkgGqPknTsu+DdQ7kD++gz8aI+aFMOMHFbWAA2taqXXVTdP+OTOQR/znGvSpmkeI0WTYQ==}
     engines: {node: '>=14.18.0'}
 
-  '@playwright/test@1.59.1':
-    resolution: {integrity: sha512-PG6q63nQg5c9rIi4/Z5lR5IVF7yU5MqmKaPOe0HSc0O2cX1fPi96sUQu5j7eo4gKCkB2AnNGoWt7y4/Xx3Kcqg==}
-    engines: {node: '>=18'}
+  '@playwright/test@1.63.0':
+    resolution: {integrity: sha512-oxMK4vllB9RK5NQ2l1pq1IfOf2AvnEuj/vYGDj0H2nMtmtZpKtCwt/l00GEO6xjGfpBNAvjovvYdCm50dRQkpQ==}
+    engines: {node: '>=20'}
     hasBin: true
 
-  '@posthog/core@1.28.3':
-    resolution: {integrity: sha512-SOy0aphKawZzp8jxfeOpTcXPwi6ii0I2V6tX8YXnM+WbxKKR/R+BXLK0jS6LV8kZtW3H5YxmPAfuIbUP1UnGTw==}
+  '@posthog/core@1.55.1':
+    resolution: {integrity: sha512-S76bSbCHGVC8oQa1zyue6A6WzkNf1Ue4oRvfvBNLRnFM3UoWnpWnQ4T/4IzrIEtVCQYv1OI7gk8uL8/U6Tuu7w==}
 
-  '@posthog/types@1.372.9':
-    resolution: {integrity: sha512-B7k9S+H9WUKHXxe1HOkQWbpWtMcrBvsodm5stZaLQ3pYxf9TowtwssdzTtX4hHjzSYqgrS1IpNnJX4vs1KgBzA==}
+  '@posthog/types@1.412.4':
+    resolution: {integrity: sha512-Q7lV9O9TbLngjOYw1ucm3bS3tn48xb1B4ZQdDy8gv7yfKe99hCTeWYG4xZ36nJM80VxpTF9TriiJt5hngDOkBg==}
 
   '@radix-ui/number@1.1.2':
     resolution: {integrity: sha512-ceTwaxc4I5IOi97DgCotl3pqiyRGvffcc0oOsE2dQYaJOFIDsDt4VWG6xEbg1QePv9QWausCEIppud/tJ1wNig==}
@@ -2861,8 +2902,8 @@ packages:
   '@rolldown/pluginutils@1.0.0-rc.3':
     resolution: {integrity: sha512-eybk3TjzzzV97Dlj5c+XrBFW57eTNhzod66y9HrBlzJ6NsCrWCp/2kaPS3K9wJmurBC0Tdw4yPjXKZqlznim3Q==}
 
-  '@sanity/diff-match-patch@3.2.0':
-    resolution: {integrity: sha512-4hPADs0qUThFZkBK/crnfKKHg71qkRowfktBljH2UIxGHHTxIzt8g8fBiXItyCjxkuNy+zpYOdRMifQNv8+Yww==}
+  '@sanity/diff-match-patch@3.2.1':
+    resolution: {integrity: sha512-Ll3BPOn9aPGeBUOFDZpKk0IObL+NI4tNq7VyOKj680xd+iCtfjnbcZZU0vpj94XozVGE0Zf+0FoYWXk2xJgZCg==}
     engines: {node: '>=18.18'}
 
   '@sec-ant/readable-stream@0.4.1':
@@ -2888,8 +2929,8 @@ packages:
   '@stablelib/base64@1.0.1':
     resolution: {integrity: sha512-1bnPQqSxSuc3Ii6MhBysoWCg58j97aUjuCSZrGSmDxNqtytIi0k8utUenAwTZN4V5mXXYGsVUI9zeBqy+jBOSQ==}
 
-  '@stablyai/playwright-base@2.1.14':
-    resolution: {integrity: sha512-/iAgMW5tC0ETDo3mFyTzszRrD7rGFIT4fgDgtZxqa9vPhiTLix/1+GeOOBNY0uS+XRLFY0Uc/irsC3XProL47g==}
+  '@stablyai/playwright-base@2.1.16':
+    resolution: {integrity: sha512-mdZ+WO5VA6hhHcWLQFcDwOolosvrA60dY0Uua8L45iWsqa4RdzEpmoDmdf7m3nGdlHDk9uY8XSJFSXK9qr64Ig==}
     engines: {node: '>=18'}
     peerDependencies:
       '@playwright/test': ^1.52.0
@@ -2898,13 +2939,13 @@ packages:
       zod:
         optional: true
 
-  '@stablyai/playwright-test@2.1.14':
-    resolution: {integrity: sha512-CAyVVnRdsyJg9pbK3Yq5L9lcvEabilFLb2RWeTQybKv7sDkEEqE2t1boXqBt3X6wQO6lsyhUHB9pc10wSwuc4Q==}
+  '@stablyai/playwright-test@2.1.16':
+    resolution: {integrity: sha512-NLbywKt/Y+AFra2puI2Ja3KADBPOQksPSpl6Zk7IlgZvawbz0CNom90aiAQX/jZ0g2KkF94cAQ08UZeVVwGzyA==}
     peerDependencies:
       '@playwright/test': ^1.52.0
 
-  '@stablyai/playwright@2.1.14':
-    resolution: {integrity: sha512-+SkphioOf+o2VWiM3KPm/fFTTjwNHUV5b2ZRPrLMTsW6bwmEvjo2FbVOUobNBqbopQBnntNLd8ZCG2gvw7rwtg==}
+  '@stablyai/playwright@2.1.16':
+    resolution: {integrity: sha512-gG+TIce/Y6Z8l0hJVuJUmD1c0UF+dPrCfqGrebR5TFgO5Vxag5UzgSyoHXEozn2oAfqrnxPE2l9QmkrclIr61w==}
     peerDependencies:
       '@playwright/test': ^1.52.0
 
@@ -2920,18 +2961,36 @@ packages:
     cpu: [arm64]
     os: [darwin]
 
+  '@swc/core-darwin-arm64@1.16.2':
+    resolution: {integrity: sha512-i/j0HNbnn79qnTVPicvay92Nark8fW8NQqn1e2mGERjUXNpBV0+SwQxlRpk2zBhn6laJ8PDI6Kn1nHZhnz3LCA==}
+    engines: {node: '>=10'}
+    cpu: [arm64]
+    os: [darwin]
+
   '@swc/core-darwin-x64@1.15.46':
     resolution: {integrity: sha512-4Tj4ppVIPCmUMpmGFiGtyEriwLyJ+yi/US4WfBrP/ok8COGddDZXLEzQETnKyK46mjvr1v0jevrS23zjoff7vA==}
     engines: {node: '>=10'}
     cpu: [x64]
     os: [darwin]
 
+  '@swc/core-darwin-x64@1.16.2':
+    resolution: {integrity: sha512-HrwqHyEyHVXO3qTk8EkNK7/b6sOZSEoNh+pot6RdE5x0LbNqfo8LtJUvi3UTXr+5ja/o5HbJdW80eCXo+NjbiA==}
+    engines: {node: '>=10'}
+    cpu: [x64]
+    os: [darwin]
+
   '@swc/core-linux-arm-gnueabihf@1.15.46':
     resolution: {integrity: sha512-i8tUGnNjyOgMmfmgFSg4aeJLQoFyfpIHK5FjpQAwpRyQIqEUB2w1e8zIDQzY1WhOxx8NoS1S5iUL813Un4Sf5A==}
     engines: {node: '>=10'}
     cpu: [arm]
     os: [linux]
 
+  '@swc/core-linux-arm-gnueabihf@1.16.2':
+    resolution: {integrity: sha512-MdXi83Z/gGp1LIrg+h7HKxiul/z/Bty/ZJSvYAFqDl9zteC1XLSAZdScquKtXPp50rdyXqritTDCqQBhwVfZKA==}
+    engines: {node: '>=10'}
+    cpu: [arm]
+    os: [linux]
+
   '@swc/core-linux-arm64-gnu@1.15.46':
     resolution: {integrity: sha512-c0OnhqzdhfOvv6qhNCcByepB+sNYOGZyhtr2Qa6ZCHvAWTYhSRw4j/u92Stue9PbZ/6q74b9nHzi76+kVzqQHQ==}
     engines: {node: '>=10'}
@@ -2939,6 +2998,13 @@ packages:
     os: [linux]
     libc: [glibc]
 
+  '@swc/core-linux-arm64-gnu@1.16.2':
+    resolution: {integrity: sha512-/jcTmK6Ktz3owM3YtiKvjofV6p3VpHnYzTIrOGwDIOsDigRAAVuZ8east33wYO/7UTdKYFlyHNnJNT0WJqOA3Q==}
+    engines: {node: '>=10'}
+    cpu: [arm64]
+    os: [linux]
+    libc: [glibc]
+
   '@swc/core-linux-arm64-musl@1.15.46':
     resolution: {integrity: sha512-imyRpNEcUzFQFV2LE4jL68ErvmKEuZCbvZru77iQREunJ+bR4i658cupTgtG1mLYM3F1Tzy3Sb9xYb02KghWTg==}
     engines: {node: '>=10'}
@@ -2946,6 +3012,13 @@ packages:
     os: [linux]
     libc: [musl]
 
+  '@swc/core-linux-arm64-musl@1.16.2':
+    resolution: {integrity: sha512-4gFarKaFnlJTSlJYKmMhV4u+3YE4uYfiydpBoYjmgQhCf9lAieOq+WilZaK9vVSHeqLuQpTEiGULZqAdsRX5Dw==}
+    engines: {node: '>=10'}
+    cpu: [arm64]
+    os: [linux]
+    libc: [musl]
+
   '@swc/core-linux-ppc64-gnu@1.15.46':
     resolution: {integrity: sha512-ctEfcl/HcUeomK33cbySiHZm98GEDIxTm1EkpBsYCiHxElYBzvTXVeuQT2YwbUXn9XCrjiw4ipyUNk33k26qRg==}
     engines: {node: '>=10'}
@@ -2953,6 +3026,13 @@ packages:
     os: [linux]
     libc: [glibc]
 
+  '@swc/core-linux-ppc64-gnu@1.16.2':
+    resolution: {integrity: sha512-syqSLGd6KlZ1PciNzs6bIUlhOuFztZufebOHaERjc4N4SqNZxyqYd4I+jj/EfOYnpe0kNjccn9HJLN1p5dz3+w==}
+    engines: {node: '>=10'}
+    cpu: [ppc64]
+    os: [linux]
+    libc: [glibc]
+
   '@swc/core-linux-s390x-gnu@1.15.46':
     resolution: {integrity: sha512-DxlMdnt84TtRVTv7WL/thWyz9+QU8QZNNoAP9rrk0P68LziuhfePp8MjQ44zIprpTHTsEwyziIuGUUN5iSC1bQ==}
     engines: {node: '>=10'}
@@ -2960,6 +3040,13 @@ packages:
     os: [linux]
     libc: [glibc]
 
+  '@swc/core-linux-s390x-gnu@1.16.2':
+    resolution: {integrity: sha512-ZBBLK+ewGyXLzWeMS7wbKtWBdnif6etn7xvPY/iOfbdsjX/+bgkp1pQt2lWF2wlu2hXYZuhJ/tHZE/QR8/apzg==}
+    engines: {node: '>=10'}
+    cpu: [s390x]
+    os: [linux]
+    libc: [glibc]
+
   '@swc/core-linux-x64-gnu@1.15.46':
     resolution: {integrity: sha512-SKxI7J6t90XPl8hRUqtJi9NfGdunN/E/vZMc7Bc0figeRdOPDBT+Tm8g7cx9xM0T0mewh2l+8dewa3Am27/P+A==}
     engines: {node: '>=10'}
@@ -2967,6 +3054,13 @@ packages:
     os: [linux]
     libc: [glibc]
 
+  '@swc/core-linux-x64-gnu@1.16.2':
+    resolution: {integrity: sha512-LyHJgxCA4Tje0ysBMbEb0tt/ie8kgUKoFE3JAKFhpevmTmhYEoC0H9s47WuDsqiFckF1ITUguZIXJG6K5e0dvg==}
+    engines: {node: '>=10'}
+    cpu: [x64]
+    os: [linux]
+    libc: [glibc]
+
   '@swc/core-linux-x64-musl@1.15.46':
     resolution: {integrity: sha512-qj9T6B7bosI0VEsrWOVXZN1OXxS8Tp63ywyrLxNdOycnUtLdkgYcoBsN5y8ImnDDsnwrEWZOy1e+J4xSe7mA3Q==}
     engines: {node: '>=10'}
@@ -2974,24 +3068,49 @@ packages:
     os: [linux]
     libc: [musl]
 
+  '@swc/core-linux-x64-musl@1.16.2':
+    resolution: {integrity: sha512-PghXJlVM1cgtLfNUR1vxFo1z+PDRAe8cWAJlZZ7spmeiN7BospGXg/MHUg7oNSgwSX7Zo//YKv9P5yD9apsFJQ==}
+    engines: {node: '>=10'}
+    cpu: [x64]
+    os: [linux]
+    libc: [musl]
+
   '@swc/core-win32-arm64-msvc@1.15.46':
     resolution: {integrity: sha512-8p7l4c3LU+eA5g9Et1JPhNeMC1oQwXTGU+uah8DPIBX7YXzqswvaBtyKVmXefVGi/DJU1x3YJsc3mbAp9aWzSQ==}
     engines: {node: '>=10'}
     cpu: [arm64]
     os: [win32]
 
+  '@swc/core-win32-arm64-msvc@1.16.2':
+    resolution: {integrity: sha512-StTOSefYBxemvNYYUI3UmO1a8y+hSPjjfHogC2TEHL+Z1PlEBim/XtLas5rS04jAzT9RrNmbtX911SZ42H9jSQ==}
+    engines: {node: '>=10'}
+    cpu: [arm64]
+    os: [win32]
+
   '@swc/core-win32-ia32-msvc@1.15.46':
     resolution: {integrity: sha512-tUEnfr3Bn9u6FOjUb3PN9p+09qZC2j+wNDLKHzXXZn22rqGcUqR/ohCRSS+nG9B9+X+U+3FewNEHJkTmdIvMjQ==}
     engines: {node: '>=10'}
     cpu: [ia32]
     os: [win32]
 
+  '@swc/core-win32-ia32-msvc@1.16.2':
+    resolution: {integrity: sha512-fycER209DYIzsibpTMC+chND05OfOjgztWL9U8OE6/uUlsOUZH3eh98isBLEnOymYUhlJLEt5++W1+KL/FOh5Q==}
+    engines: {node: '>=10'}
+    cpu: [ia32]
+    os: [win32]
+
   '@swc/core-win32-x64-msvc@1.15.46':
     resolution: {integrity: sha512-Vux7UDzBJYQggSuPfcl2w9iu+IJpgpRCxHzgCaVkELnAXAE4XZMOTX9HNcaNiwfeIDqdu2rkr69RuDm6wY8neA==}
     engines: {node: '>=10'}
     cpu: [x64]
     os: [win32]
 
+  '@swc/core-win32-x64-msvc@1.16.2':
+    resolution: {integrity: sha512-cSd1z6ivSrJPVr+moVwOHWjeKy6TpO4/Shwcv5KCrKYXCccxwh4pRy1C3fDioNx2PF1jPZWHKZjtXt+Be9VbaQ==}
+    engines: {node: '>=10'}
+    cpu: [x64]
+    os: [win32]
+
   '@swc/core@1.15.46':
     resolution: {integrity: sha512-Ri3em2mBpq3h2zSPliCYl63otDGqek8PPEfv2nWgRQEbZ/VBCNyypVTVQ6cEbTCXBhy+WE2T3fQb08moIyuYaw==}
     engines: {node: '>=10'}
@@ -3001,12 +3120,24 @@ packages:
       '@swc/helpers':
         optional: true
 
+  '@swc/core@1.16.2':
+    resolution: {integrity: sha512-95I4kiSMeveI/Mhi+tE4fiWcWLUMfzfKrk0jtr8LRMqHgOgq+xHS+zExkDqoO4b5OeeuXHMWVdD5MeP3X6sULw==}
+    engines: {node: '>=10'}
+    peerDependencies:
+      '@swc/helpers': '>=0.5.17'
+    peerDependenciesMeta:
+      '@swc/helpers':
+        optional: true
+
   '@swc/counter@0.1.3':
     resolution: {integrity: sha512-e2BR4lsJkkRlKZ/qCHPw9ZaSxc0MVUd7gtbtaB7aMvHeJVYe8sOB8DBZkP2DtISHGSku9sCK6T6cnY0CtXrOCQ==}
 
   '@swc/types@0.1.27':
     resolution: {integrity: sha512-K6h3iUlqeM946U4sXFYeahefR1YBbXJvko+hv8WS8/0BNJ4OHiHRywMnQUJCqkR7Y9+hqQ1TvEpiKqUhz7NEFg==}
 
+  '@swc/types@0.1.28':
+    resolution: {integrity: sha512-V6Mnml8v09QALx6K0elJ7o9K/MkVDtW3t6L+7Ou/JcWtb3xwId2AH4FeOceySd2JaO87IMw4+6vSZxLm34LPbw==}
+
   '@szmarczak/http-timer@4.0.6':
     resolution: {integrity: sha512-4BAffykYOgO+5nzBWYwE3W90sBgLJoUPRWWcL8wlyiM8IB8ipJz3UMJ9KXQd1RKQXpKp8Tutn80HZtWsu2u76w==}
     engines: {node: '>=10'}
@@ -3105,14 +3236,14 @@ packages:
     peerDependencies:
       vite: ^5.2.0 || ^6 || ^7 || ^8
 
-  '@tanstack/react-virtual@3.14.10':
-    resolution: {integrity: sha512-SRyoUbdFMRHuYXMijV5H4ZarQWpXkj3iANq8OFre+pybeVap8ZJjZ3Nz9bVjx4d8PfobVUQUdKyyyHYk3E+djw==}
+  '@tanstack/react-virtual@3.14.13':
+    resolution: {integrity: sha512-JbDTAwtzZ99aOeCrAfW5EsE5KSq5RWh6Af2dtFwyLIIk48Ja7vm6n4axu/43T3vfjFnEGJalxJ1wyYjSQD6bSg==}
     peerDependencies:
       react: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
       react-dom: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
 
-  '@tanstack/virtual-core@3.17.8':
-    resolution: {integrity: sha512-BfEvehNpOT75r5Ksc5xW6NZuXujTfb7nlSEyVu4XHG3gdxNg1KqXruWbDewXOUaUYIo4oRbSfkjIajz4MAT8tA==}
+  '@tanstack/virtual-core@3.17.11':
+    resolution: {integrity: sha512-+ILjvtHup6Y2hzQ6YzwMgX1Q+oQpxEGOXCEsCNaPoIP0VxMbizIBTmYTDtkerkIQS8/CbP1BRuyt8V/8BCsy1g==}
 
   '@testing-library/dom@10.4.1':
     resolution: {integrity: sha512-o4PXJQidqJl82ckFaXUeoAW+XysPLauYI43Abki5hABd853iMhitooc6znOnczgbTYmEP6U6/y1ZyKAIsvMKGg==}
@@ -3122,8 +3253,8 @@ packages:
     resolution: {integrity: sha512-zIcONa+hVtVSSep9UT3jZ5rizo2BsxgyDYU7WFD5eICBE7no3881HGeb/QkGfsJs6JTkY1aQhT7rIPC7e+0nnA==}
     engines: {node: '>=14', npm: '>=6', yarn: '>=1'}
 
-  '@testing-library/react@16.3.2':
-    resolution: {integrity: sha512-XU5/SytQM+ykqMnAnvB2umaJNIOsLF3PVv//1Ew4CTcpz0/BRyy/af40qqrt7SjKpDdT1saBMc42CUok5gaw+g==}
+  '@testing-library/react@16.3.3':
+    resolution: {integrity: sha512-Uo193NgQbPMz6lrrhtRQQFcMC6Re/ELLFbbuVL30WDlZxlpZf9/lMHTAVxPRLw1q1iu9OJmR1c2BLiENRstdBg==}
     engines: {node: '>=18'}
     peerDependencies:
       '@testing-library/dom': ^10.0.0
@@ -3137,8 +3268,8 @@ packages:
       '@types/react-dom':
         optional: true
 
-  '@testing-library/user-event@14.6.1':
-    resolution: {integrity: sha512-vq7fv0rnt+QTXgPxr5Hjc210p6YKq2kmdziLgnsZGgLJ9e6VAShx1pACLuRjd/AS/sr7phAR58OIIpf0LlmQNw==}
+  '@testing-library/user-event@14.6.7':
+    resolution: {integrity: sha512-MPCpX8bxe8zS+JmmTwLp8jd0dy1rAm60Te/SL8JrQM3qvQJcBOs1d7IefJMyZzqM3EWBrDn/LWDt1BCGu4ASfg==}
     engines: {node: '>=12', npm: '>=6'}
     peerDependencies:
       '@testing-library/dom': '>=7.21.4'
@@ -4207,6 +4338,10 @@ packages:
     resolution: {integrity: sha512-H+y0Jo/T1RZ9qPP4Eh1pkcQcLRglraJaSLoyOtHxu6AapkjWVCy2Sit1QQ4x3Dng8qDlSsZEet7g5Pq06MvTgw==}
     engines: {node: '>=20'}
 
+  commander@15.0.0:
+    resolution: {integrity: sha512-z67u4ZhzCL/Tydu1lJARtEZYWbWaN7oYLHbsuzocr6y4N6WZAagG3RQ4FW61V1/0+jImpj293XfrcYnd1qxtPg==}
+    engines: {node: '>=22.12.0'}
+
   commander@5.1.0:
     resolution: {integrity: sha512-P0CysNDQ7rtVw4QIQtm+MRxV66vKFSvlsQvGYXZWR3qFU0jlMKHZZZgw8e+8DSah4UDKMqnknRDQz+xuQXQ/Zg==}
     engines: {node: '>= 6'}
@@ -4569,8 +4704,8 @@ packages:
   dom-accessibility-api@0.6.3:
     resolution: {integrity: sha512-7ZgogeTnjuHbo+ct10G9Ffp0mif17idi0IyWNVA/wcwcm7NPOD/WEHVP3n7n3MhXqxoIYm8d6MuZohYWIZ4T3w==}
 
-  dompurify@3.4.14:
-    resolution: {integrity: sha512-dVoH9z+MY+C9IilgGCk3YfFqjLi3fChm2OiKJMzh6axrJ5qwxqWaZamgmHrpv22CN/KdbZJuGEGgfQoL00LTdg==}
+  dompurify@3.4.15:
+    resolution: {integrity: sha512-EUBjM+B+lkDE41iE82DDSCfkoPGfXx8IxFxPMjNzm/Uk4xDet77rTN9wqlxlVg71kK7XGuUMv6wUxJUwwv+Xyw==}
 
   dotenv-expand@11.0.7:
     resolution: {integrity: sha512-zIHwmZPRshsCdpMDyVsqGmgyP0yT8GAgXUnkdAoJisxvf33k7yO6OuoKmcTGuXPWSsm8Oh88nZicRLA9Y0rUeA==}
@@ -4811,6 +4946,10 @@ packages:
     resolution: {integrity: sha512-CRT1WTyuQoD771GW56XEZFQ/ZoSfWid1alKGDYMmkt2yl8UXrVR4pspqWNEcqKvVIzg6PAltWjxcSSPrboA4iA==}
     engines: {node: '>=18.0.0'}
 
+  execa@10.0.1:
+    resolution: {integrity: sha512-ge98qjkRK4IB7tL7Ju/6qmm5LHoH1eEMt5FNZrz3f4UIYhF28lggX20z3FaX1sgc67msLEn0N0BscOs29iuwyw==}
+    engines: {node: '>=22'}
+
   execa@5.1.1:
     resolution: {integrity: sha512-8uSpZZocAZRBAPIEINJj3Lo9HyGitllczc27Eh5YYojjMFMn8yHMDMaUHE2Jqfq05D/wucwI4JGURyXt1vchyg==}
     engines: {node: '>=10'}
@@ -4967,11 +5106,6 @@ packages:
   fs.realpath@1.0.0:
     resolution: {integrity: sha512-OO0pH2lK6a0hZnAdau5ItzHPI6pUlvI7jMVnxUQRtw4owF2wk8lOSabtGDCTP4Ggrg2MbGnWO9X8K1t4+fGMDw==}
 
-  fsevents@2.3.2:
-    resolution: {integrity: sha512-xiqMQR4xAeHTuB9uWm+fFRcIOgKBMiOBP+eXiyT7jsgVCq1bkVygt00oASowB7EdtpOHaaPgKt812P9ab+DDKA==}
-    engines: {node: ^8.16.0 || ^10.6.0 || >=11.0.0}
-    os: [darwin]
-
   fsevents@2.3.3:
     resolution: {integrity: sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw==}
     engines: {node: ^8.16.0 || ^10.6.0 || >=11.0.0}
@@ -5205,8 +5339,8 @@ packages:
     engines: {node: '>=18'}
     hasBin: true
 
-  i18next-cli@1.65.0:
-    resolution: {integrity: sha512-sak+2Ry4P7wtl7xMAZg2sWG2vup1lRHFBKA7h5IeEqFUog51QEgeYUhHxd2x85+MvS4BhVOZZs833clnd1WgYA==}
+  i18next-cli@1.74.1:
+    resolution: {integrity: sha512-8OEbo4jfn4r4/QwieyAvoLWV/rJW2OR6SG09I12jA6kffyhUNsyrH6OaA4bumLIWkdBaGySbiFm0wj1k19N/jA==}
     engines: {node: '>=22'}
     hasBin: true
 
@@ -5222,6 +5356,14 @@ packages:
       typescript:
         optional: true
 
+  i18next@26.4.2:
+    resolution: {integrity: sha512-RX+R0VLg13IbvRuJSxnqykUFS9vQZTl8wYpWPCIUDWVrSGjsQywB5Y+pjzrkboxGAuYfJZVH1InFTdgBdxq6ug==}
+    peerDependencies:
+      typescript: ^5 || ^6 || ^7
+    peerDependenciesMeta:
+      typescript:
+        optional: true
+
   iconv-lite@0.6.3:
     resolution: {integrity: sha512-4fCk79wshMdzMp2rH06qWrJE4iolqLhCUH+OiuIgU++RB0+94NlDL81atO7GX55uUKueo0txHNtvEyI6D7WdMw==}
     engines: {node: '>=0.10.0'}
@@ -5260,8 +5402,8 @@ packages:
   inline-style-parser@0.2.7:
     resolution: {integrity: sha512-Nb2ctOyNR8DqQoR0OwRG95uNWIC0C1lCgf5Naz5H6Ji72KZ8OcFZLz2P5sNgwlyoJ8Yif11oMuYs5pBQa86csA==}
 
-  inquirer@14.0.2:
-    resolution: {integrity: sha512-VsSx1JneSNp3ld1veMTLe+UDcUD8Tw2/jjOthhkX3/IX2q+xHhVELifeb/hsb1fBw31pabEPNUf/xUOyb+KZjA==}
+  inquirer@14.2.2:
+    resolution: {integrity: sha512-WGerZIIb7mTtaFFskkD/P0europ8xBWf1OXACMiugzKPSmVzoqhcPSuSUzbzMch/t3rf1ncBT3v/0WU73cLqJQ==}
     engines: {node: '>=23.5.0 || ^22.13.0 || ^20.17.0'}
     peerDependencies:
       '@types/node': '>=18'
@@ -5662,6 +5804,9 @@ packages:
   magic-string@0.30.21:
     resolution: {integrity: sha512-vd2F4YUyEXKGcLHoq+TEyCjxueSeHnFxyyjNp80yg0XV4vUhnDer/lvvlqM/arB5bXQN5K2/3oinyCRyx8T2CQ==}
 
+  magic-string@1.4.2:
+    resolution: {integrity: sha512-vG+rjFRj1PqdIBozIxAGMjPlOhaVe+GXpbttY/iSK7rGcJRMlwNJO7dcUwmUqkymsFLJiNGI06t4D7Fr7yRC9g==}
+
   markdown-table@3.0.4:
     resolution: {integrity: sha512-wiYz4+JrLyb/DqW2hkFJxP7Vd7JuTDm77fvbM8VfEQdmSMqcImWeeRbHwZjBjIFki/VaMK2BhFi7oUUZeM5bqw==}
 
@@ -5927,6 +6072,10 @@ packages:
     resolution: {integrity: sha512-MULkVLfKGYDFYejP07QOurDLLQpcjk7Fw+7jXS2R2czRQzR56yHRveU5NDJEOviH+hETZKSkIk5c+T23GjFUMg==}
     engines: {node: 18 || 20 || >=22}
 
+  minimatch@10.2.6:
+    resolution: {integrity: sha512-vpLQEs+VLCr1nU0BXS07maYoFwlDAH0gngQuuttxIwutDFEMHq2blX+8vpgxDdK3J1PwjCJiep77OitTZ4Ll1A==}
+    engines: {node: 18 || 20 || >=22}
+
   minimatch@3.1.5:
     resolution: {integrity: sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==}
 
@@ -6095,6 +6244,10 @@ packages:
     resolution: {integrity: sha512-84cglkRILFxdtA8hAvLNdMrtBpPNBTrQ9/ulg0FA7xLMnD6mifv+enAIeRmvtv+WgdCE+LPGOfQmtJRrVaIVhQ==}
     engines: {node: '>=20'}
 
+  ora@9.4.1:
+    resolution: {integrity: sha512-6VlU9MLXbjVQD04AZCMX28hVtA5bUoadvUqO76MUCVA0ilwJbMiHsITRPfyVm6p/BC0Av/BXMujx39WCe1LEqw==}
+    engines: {node: '>=20'}
+
   orderedmap@2.1.1:
     resolution: {integrity: sha512-TvAWxi0nDe1j/rtMcWcIj94+Ffe6n7zhow33h40SKxmsmozs6dz/e+EajymfoFcHd7sxNn8yHM8839uixMOV6g==}
 
@@ -6109,8 +6262,8 @@ packages:
     resolution: {integrity: sha512-syxUKHeUll89RIABQADcI7sikYrwyssvA6gj4phSSIPezKVM8yMaLAiLLSc7fmzVvrwybfFGFbW5zme9sX87rg==}
     engines: {node: ^20.19.0 || >=22.12.0}
 
-  oxfmt@0.65.0:
-    resolution: {integrity: sha512-SgS5VgnP42T0zl3zWD+xoH8FCqg1SAFnSRoOT/qeoa6gxcYIqrDMOmcXIg/EWSN92Du4ogB4riuKhKd6Y4CGhw==}
+  oxfmt@0.70.0:
+    resolution: {integrity: sha512-IsHxZ4y0wQLLMhnrJblBJgZsLDzfULrJnAw5j/QqsTlMa/m3AqsbToi+W71uhBGaqlqq/PbbjvHc09TJwdv3Tw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     hasBin: true
     peerDependencies:
@@ -6134,8 +6287,8 @@ packages:
     resolution: {integrity: sha512-KjK/XLcXr1DSyonKhsuFqJRiuKqcyG9j3LJ8nkOsrLzGvodBPqzHOKauy10asLMDI0sUpvb+1sxlzff3udZvfg==}
     hasBin: true
 
-  oxlint@1.80.0:
-    resolution: {integrity: sha512-5nTiSps4qdbCWLbxzuO00alHkEO2exR9YMN/ig6QXWrLsYSG0KaObOAM+l6oU2LcKPWoSAGYbkZIGEu1ViiWKA==}
+  oxlint@1.85.0:
+    resolution: {integrity: sha512-bc26s97nuvPj1ViyPsqmKecVkUWFMEdtayO8MaQ6oiLfs1pj94cQlZZhrh4BPNlr9HQosjhIlwgZKsfcwmcNgg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     hasBin: true
     peerDependencies:
@@ -6265,14 +6418,14 @@ packages:
     resolution: {integrity: sha512-emEcLuomt2j03vxD54giVB4SxTjnsqkU692xZOZXHDVoYyypEm+b3jpiTcc+Cf+myooc+/Ly0z01jqeNHVgJGw==}
     engines: {node: '>=16.0.0'}
 
-  playwright-core@1.59.1:
-    resolution: {integrity: sha512-HBV/RJg81z5BiiZ9yPzIiClYV/QMsDCKUyogwH9p3MCP6IYjUFu/MActgYAvK0oWyV9NlwM3GLBjADyWgydVyg==}
-    engines: {node: '>=18'}
+  playwright-core@1.63.0:
+    resolution: {integrity: sha512-rYCsBF/M5HjUch52bbtVONEFjv6Xu8sm8h72dNlR5bzIE1fvC/bxgspzkjSfU+MweEMmPM8KJebG6nnyxo5mCg==}
+    engines: {node: '>=20'}
     hasBin: true
 
-  playwright@1.59.1:
-    resolution: {integrity: sha512-C8oWjPR3F81yljW9o5OxcWzfh6avkVwDD2VYdwIGqTkl+OGFISgypqzfu7dOe4QNLL2aqcWBmI3PMtLIK233lw==}
-    engines: {node: '>=18'}
+  playwright@1.63.0:
+    resolution: {integrity: sha512-+7ziBLidS4NaNCdt57SUDT+wYmmd5fmiQejUic/kb+YsYSCPyOOE9sebzMjNmQrsnNpDJqd4WHvV/8lfKfUDUg==}
+    engines: {node: '>=20'}
     hasBin: true
 
   plist@3.1.0:
@@ -6301,8 +6454,8 @@ packages:
     resolution: {integrity: sha512-DTPx3RWSSnWyzLxQnlH0rJP+EW5ekl16ZU4/psbIhA0e53kJfdgaN5vKM+xP7yJtXVu+nfdVFmlgFDEKAe4Pyw==}
     engines: {node: ^10 || ^12 || >=14}
 
-  posthog-node@5.33.3:
-    resolution: {integrity: sha512-6BkdRtRKf/y/j6JGXLUDWpruL9Rebpe2EtbSU3EB+yaI9ukTwEGT8XJQDyM8wcsxu1HdOnvAwN7gnOOu5OgY2A==}
+  posthog-node@5.52.5:
+    resolution: {integrity: sha512-r4KRXh2MvcHYh1s3NUca022GqujkJjpmD4qbRzWOLVTu8BfN3fqZj+MyKIxvHPXsS8sKsNVX+MlKk2qzW0Y4GQ==}
     engines: {node: ^20.20.0 || >=22.22.0}
     peerDependencies:
       rxjs: ^7.0.0
@@ -6474,8 +6627,8 @@ packages:
       react:
         optional: true
 
-  react-i18next@17.0.13:
-    resolution: {integrity: sha512-Cc1PscmblIHA1kljTqDwrcVMI21ydgmUzw0UAeQBe7pAOgfuRLfzXze4EUBQoeDiICzFIXXhHFoZxuetNg5D0Q==}
+  react-i18next@17.0.15:
+    resolution: {integrity: sha512-7uYpx/oBkesLto7cOzOmfITlUBaXHCAcFahmgETMfWr8nbbWRRnVGvz8wsH/xpbNcyoH+NpCcnOQEqWPMO6/hw==}
     peerDependencies:
       i18next: '>= 26.2.0'
       react: '>= 16.8.0'
@@ -7053,19 +7206,19 @@ packages:
     resolution: {integrity: sha512-pn99VhoACYR8nFHhxqix+uvsbXineAasWm5ojXoN8xEwK5Kd3/TrhNn1wByuD52UxWRLy8pu+kRMniEi6Eq9Zg==}
     engines: {node: '>=12.0.0'}
 
-  tinypool@2.1.0:
-    resolution: {integrity: sha512-Pugqs6M0m7Lv1I7FtxN4aoyToKg1C4tu+/381vH35y8oENM/Ai7f7C4StcoK4/+BSw9ebcS8jRiVrORFKCALLw==}
+  tinypool@2.1.2:
+    resolution: {integrity: sha512-9YodfrxS9g9IbFr/KOjE5bAeJ0p61n3bW6mqvy0jtoeKd1kTW1Cxm0oulm6KX2lyM9Gl6WIe8nEbY7LWv5ZJww==}
     engines: {node: ^20.0.0 || >=22.0.0}
 
   tinyrainbow@3.1.0:
     resolution: {integrity: sha512-Bf+ILmBgretUrdJxzXM0SgXLZ3XfiaUuOj/IKQHuTXip+05Xn+uyEYdVg0kYDipTBcLrCVyUzAPz7QmArb0mmw==}
     engines: {node: '>=14.0.0'}
 
-  tldts-core@7.4.12:
-    resolution: {integrity: sha512-nYNzS2WRf4QJmjzFFgAxLOBjyBxAGRbCy9PVBPaglcYyYajh40VBn+v5Ngr96ZMc7oM0+aCJdtQnNejvdBnXMQ==}
+  tldts-core@7.4.14:
+    resolution: {integrity: sha512-KYkjfJHnIC5t+Gy7hPrMHgJmWc/N9FfmS+fggRPSlpFckidpB9HD6OzPsSTkfDH+MpZgcu2tJPGgLfHl979N1Q==}
 
-  tldts@7.4.12:
-    resolution: {integrity: sha512-WylhSDKVeYnWXL3a+vKTaOxjnOeEGw938hImY8zoRWJjRRK/Jp1K+IihBzIONpUmW4e3WmXT6q5FW6vlESVZCA==}
+  tldts@7.4.14:
+    resolution: {integrity: sha512-EahQoi+Q5oqmG3yxRHx+bwn36OaLbtw6jnTFcGjc8fcmktzTgk45xRnzAx8Ch87PFEiqRhoc3FWBmY+LBrvEGQ==}
     hasBin: true
 
   tmp-promise@3.0.3:
@@ -7341,6 +7494,11 @@ packages:
     resolution: {integrity: sha512-nt+N2dzIutVRxARx1nghPKGv1xHikU7HKdfafKkLNLindmPU/ch3U31NOCGGA/dmPcmb1VlofO0vnKAcsm0o/Q==}
     engines: {node: '>=12'}
 
+  which-command@0.1.0:
+    resolution: {integrity: sha512-XZyoF5/5hZtXitIwzrU4NKK+Wtbb9aB9CezUEw2Q0wlYK8NUYQxC1rRXgNueYLtBAJwXIb+/tFVk4dozciNJMA==}
+    engines: {node: '>=22'}
+    hasBin: true
+
   which-module@2.0.1:
     resolution: {integrity: sha512-iBdZ57RDvnOR9AGBhML2vFZf7h8vmBjhoaZqODJBFWHVtKkDmKuHai3cx5PgVMrX5YDNp27AofYbAwctSS+vhQ==}
 
@@ -7437,13 +7595,8 @@ packages:
     resolution: {integrity: sha512-YgvUTfwqyc7UXVMrB+SImsVYSmTS8X/tSrtdNZMImM+n7+QTriRXyXim0mBrTXNeqzVF0KWGgHPeiyViFFrNDw==}
     engines: {node: '>=18'}
 
-  yaml@2.8.4:
-    resolution: {integrity: sha512-ml/JPOj9fOQK8RNnWojA67GbZ0ApXAUlN2UQclwv2eVgTgn7O9gg9o7paZWKMp4g0H3nTLtS9LVzhkpOFIKzog==}
-    engines: {node: '>= 14.6'}
-    hasBin: true
-
-  yaml@2.9.0:
-    resolution: {integrity: sha512-2AvhNX3mb8zd6Zy7INTtSpl1F15HW6Wnqj0srWlkKLcpYl/gMIMJiyuGq2KeI2YFxUPjdlB+3Lc10seMLtL4cA==}
+  yaml@2.9.1:
+    resolution: {integrity: sha512-3NxN8+78OdzbT7C/WjGsyfPAtJaN3FNDsWxv7Y7mcDsT/oOmgW8BpyQQFFBnvZE3j9Y2Sdz1ULFLezL7Eb2yFw==}
     engines: {node: '>= 14.6'}
     hasBin: true
 
@@ -7483,8 +7636,8 @@ packages:
   zod@3.25.76:
     resolution: {integrity: sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ==}
 
-  zod@4.5.4:
-    resolution: {integrity: sha512-sC95tT5iHHH9gtpj6A81kh+NEaRAUFN+qlUPDUbRfOMvNf5QCBqsb3WgvnpVtK5Y+4UfA6KqufotuTvMGiTlsA==}
+  zod@4.6.5:
+    resolution: {integrity: sha512-v5l/aFXZQeai4awLbOpSoHecE9UiMrnfx75tEXLjNonXVARxQ5mOeipTjROUchszUNCqnE+hqAMujRsRHsut2Q==}
 
   zustand@5.0.14:
     resolution: {integrity: sha512-/8tAspM5LMPr28b3fwLYrtdj77ECpfZviaP75CMTnwO8ISyaE4GDIG/9rDDYq/cH9D2Xw2A2RXglLInmVBQB/g==}
@@ -7526,18 +7679,18 @@ snapshots:
       package-manager-detector: 1.6.0
       tinyexec: 1.1.2
 
-  '@anthropic-ai/claude-agent-sdk@0.3.251(@anthropic-ai/sdk@0.122.0(zod@4.5.4))(@modelcontextprotocol/sdk@1.30.0(supports-color@7.2.0)(zod@4.5.4))(zod@4.5.4)':
+  '@anthropic-ai/claude-agent-sdk@0.3.251(@anthropic-ai/sdk@0.122.0(zod@4.6.5))(@modelcontextprotocol/sdk@1.30.0(supports-color@7.2.0)(zod@4.6.5))(zod@4.6.5)':
     dependencies:
-      '@anthropic-ai/sdk': 0.122.0(zod@4.5.4)
-      '@modelcontextprotocol/sdk': 1.30.0(supports-color@7.2.0)(zod@4.5.4)
-      zod: 4.5.4
+      '@anthropic-ai/sdk': 0.122.0(zod@4.6.5)
+      '@modelcontextprotocol/sdk': 1.30.0(supports-color@7.2.0)(zod@4.6.5)
+      zod: 4.6.5
 
-  '@anthropic-ai/sdk@0.122.0(zod@4.5.4)':
+  '@anthropic-ai/sdk@0.122.0(zod@4.6.5)':
     dependencies:
       json-schema-to-ts: 3.1.1
       standardwebhooks: 1.1.1
     optionalDependencies:
-      zod: 4.5.4
+      zod: 4.6.5
 
   '@babel/code-frame@7.29.7':
     dependencies:
@@ -8036,22 +8189,22 @@ snapshots:
       '@eslint/core': 1.2.1
       levn: 0.4.1
 
-  '@floating-ui/core@1.7.5':
+  '@floating-ui/core@1.8.0':
     dependencies:
-      '@floating-ui/utils': 0.2.11
+      '@floating-ui/utils': 0.2.12
 
-  '@floating-ui/dom@1.7.6':
+  '@floating-ui/dom@1.8.0':
     dependencies:
-      '@floating-ui/core': 1.7.5
-      '@floating-ui/utils': 0.2.11
+      '@floating-ui/core': 1.8.0
+      '@floating-ui/utils': 0.2.12
 
   '@floating-ui/react-dom@2.1.8(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
-      '@floating-ui/dom': 1.7.6
+      '@floating-ui/dom': 1.8.0
       react: 19.2.8
       react-dom: 19.2.8(react@19.2.8)
 
-  '@floating-ui/utils@0.2.11': {}
+  '@floating-ui/utils@0.2.12': {}
 
   '@graphql-typed-document-node/core@3.2.0(graphql@16.14.2)':
     dependencies:
@@ -8085,14 +8238,17 @@ snapshots:
       '@iconify/types': 2.0.0
       mlly: 1.8.2
 
-  '@inquirer/ansi@2.0.7': {}
+  '@inquirer/ansi@2.0.7':
+    optional: true
 
-  '@inquirer/checkbox@5.2.1(@types/node@25.9.5)':
+  '@inquirer/ansi@2.0.8': {}
+
+  '@inquirer/checkbox@5.2.5(@types/node@25.9.5)':
     dependencies:
-      '@inquirer/ansi': 2.0.7
-      '@inquirer/core': 11.2.1(@types/node@25.9.5)
-      '@inquirer/figures': 2.0.7
-      '@inquirer/type': 4.0.7(@types/node@25.9.5)
+      '@inquirer/ansi': 2.0.8
+      '@inquirer/core': 12.0.3(@types/node@25.9.5)
+      '@inquirer/figures': 2.0.9
+      '@inquirer/type': 4.1.1(@types/node@25.9.5)
     optionalDependencies:
       '@types/node': 25.9.5
 
@@ -8102,6 +8258,14 @@ snapshots:
       '@inquirer/type': 4.0.7(@types/node@25.9.5)
     optionalDependencies:
       '@types/node': 25.9.5
+    optional: true
+
+  '@inquirer/confirm@6.3.2(@types/node@25.9.5)':
+    dependencies:
+      '@inquirer/core': 12.0.3(@types/node@25.9.5)
+      '@inquirer/type': 4.1.1(@types/node@25.9.5)
+    optionalDependencies:
+      '@types/node': 25.9.5
 
   '@inquirer/core@11.2.1(@types/node@25.9.5)':
     dependencies:
@@ -8114,95 +8278,116 @@ snapshots:
       signal-exit: 4.1.0
     optionalDependencies:
       '@types/node': 25.9.5
+    optional: true
 
-  '@inquirer/editor@5.2.2(@types/node@25.9.5)':
+  '@inquirer/core@12.0.3(@types/node@25.9.5)':
     dependencies:
-      '@inquirer/core': 11.2.1(@types/node@25.9.5)
-      '@inquirer/external-editor': 3.0.3(@types/node@25.9.5)
-      '@inquirer/type': 4.0.7(@types/node@25.9.5)
+      '@inquirer/ansi': 2.0.8
+      '@inquirer/figures': 2.0.9
+      '@inquirer/type': 4.1.1(@types/node@25.9.5)
+      cli-width: 4.1.0
+      fast-wrap-ansi: 0.2.2
+      mute-stream: 3.0.0
+      signal-exit: 4.1.0
     optionalDependencies:
       '@types/node': 25.9.5
 
-  '@inquirer/expand@5.1.1(@types/node@25.9.5)':
+  '@inquirer/editor@5.3.3(@types/node@25.9.5)':
     dependencies:
-      '@inquirer/core': 11.2.1(@types/node@25.9.5)
-      '@inquirer/type': 4.0.7(@types/node@25.9.5)
+      '@inquirer/core': 12.0.3(@types/node@25.9.5)
+      '@inquirer/external-editor': 3.0.5(@types/node@25.9.5)
+      '@inquirer/type': 4.1.1(@types/node@25.9.5)
     optionalDependencies:
       '@types/node': 25.9.5
 
-  '@inquirer/external-editor@3.0.3(@types/node@25.9.5)':
+  '@inquirer/expand@5.1.5(@types/node@25.9.5)':
+    dependencies:
+      '@inquirer/core': 12.0.3(@types/node@25.9.5)
+      '@inquirer/type': 4.1.1(@types/node@25.9.5)
+    optionalDependencies:
+      '@types/node': 25.9.5
+
+  '@inquirer/external-editor@3.0.5(@types/node@25.9.5)':
     dependencies:
       chardet: 2.2.0
       iconv-lite: 0.7.2
     optionalDependencies:
       '@types/node': 25.9.5
 
-  '@inquirer/figures@2.0.7': {}
+  '@inquirer/figures@2.0.7':
+    optional: true
 
-  '@inquirer/input@5.1.2(@types/node@25.9.5)':
+  '@inquirer/figures@2.0.9': {}
+
+  '@inquirer/input@5.1.6(@types/node@25.9.5)':
     dependencies:
-      '@inquirer/core': 11.2.1(@types/node@25.9.5)
-      '@inquirer/type': 4.0.7(@types/node@25.9.5)
+      '@inquirer/core': 12.0.3(@types/node@25.9.5)
+      '@inquirer/type': 4.1.1(@types/node@25.9.5)
     optionalDependencies:
       '@types/node': 25.9.5
 
-  '@inquirer/number@4.1.1(@types/node@25.9.5)':
+  '@inquirer/number@4.2.3(@types/node@25.9.5)':
     dependencies:
-      '@inquirer/core': 11.2.1(@types/node@25.9.5)
-      '@inquirer/type': 4.0.7(@types/node@25.9.5)
+      '@inquirer/core': 12.0.3(@types/node@25.9.5)
+      '@inquirer/type': 4.1.1(@types/node@25.9.5)
     optionalDependencies:
       '@types/node': 25.9.5
 
-  '@inquirer/password@5.1.1(@types/node@25.9.5)':
+  '@inquirer/password@5.2.2(@types/node@25.9.5)':
     dependencies:
-      '@inquirer/ansi': 2.0.7
-      '@inquirer/core': 11.2.1(@types/node@25.9.5)
-      '@inquirer/type': 4.0.7(@types/node@25.9.5)
+      '@inquirer/ansi': 2.0.8
+      '@inquirer/core': 12.0.3(@types/node@25.9.5)
+      '@inquirer/type': 4.1.1(@types/node@25.9.5)
     optionalDependencies:
       '@types/node': 25.9.5
 
-  '@inquirer/prompts@8.5.2(@types/node@25.9.5)':
-    dependencies:
-      '@inquirer/checkbox': 5.2.1(@types/node@25.9.5)
-      '@inquirer/confirm': 6.1.1(@types/node@25.9.5)
-      '@inquirer/editor': 5.2.2(@types/node@25.9.5)
-      '@inquirer/expand': 5.1.1(@types/node@25.9.5)
-      '@inquirer/input': 5.1.2(@types/node@25.9.5)
-      '@inquirer/number': 4.1.1(@types/node@25.9.5)
-      '@inquirer/password': 5.1.1(@types/node@25.9.5)
-      '@inquirer/rawlist': 5.3.1(@types/node@25.9.5)
-      '@inquirer/search': 4.2.1(@types/node@25.9.5)
-      '@inquirer/select': 5.2.1(@types/node@25.9.5)
+  '@inquirer/prompts@8.7.2(@types/node@25.9.5)':
+    dependencies:
+      '@inquirer/checkbox': 5.2.5(@types/node@25.9.5)
+      '@inquirer/confirm': 6.3.2(@types/node@25.9.5)
+      '@inquirer/editor': 5.3.3(@types/node@25.9.5)
+      '@inquirer/expand': 5.1.5(@types/node@25.9.5)
+      '@inquirer/input': 5.1.6(@types/node@25.9.5)
+      '@inquirer/number': 4.2.3(@types/node@25.9.5)
+      '@inquirer/password': 5.2.2(@types/node@25.9.5)
+      '@inquirer/rawlist': 5.3.5(@types/node@25.9.5)
+      '@inquirer/search': 4.3.3(@types/node@25.9.5)
+      '@inquirer/select': 5.2.5(@types/node@25.9.5)
     optionalDependencies:
       '@types/node': 25.9.5
 
-  '@inquirer/rawlist@5.3.1(@types/node@25.9.5)':
+  '@inquirer/rawlist@5.3.5(@types/node@25.9.5)':
     dependencies:
-      '@inquirer/core': 11.2.1(@types/node@25.9.5)
-      '@inquirer/type': 4.0.7(@types/node@25.9.5)
+      '@inquirer/core': 12.0.3(@types/node@25.9.5)
+      '@inquirer/type': 4.1.1(@types/node@25.9.5)
     optionalDependencies:
       '@types/node': 25.9.5
 
-  '@inquirer/search@4.2.1(@types/node@25.9.5)':
+  '@inquirer/search@4.3.3(@types/node@25.9.5)':
     dependencies:
-      '@inquirer/core': 11.2.1(@types/node@25.9.5)
-      '@inquirer/figures': 2.0.7
-      '@inquirer/type': 4.0.7(@types/node@25.9.5)
+      '@inquirer/core': 12.0.3(@types/node@25.9.5)
+      '@inquirer/figures': 2.0.9
+      '@inquirer/type': 4.1.1(@types/node@25.9.5)
     optionalDependencies:
       '@types/node': 25.9.5
 
-  '@inquirer/select@5.2.1(@types/node@25.9.5)':
+  '@inquirer/select@5.2.5(@types/node@25.9.5)':
     dependencies:
-      '@inquirer/ansi': 2.0.7
-      '@inquirer/core': 11.2.1(@types/node@25.9.5)
-      '@inquirer/figures': 2.0.7
-      '@inquirer/type': 4.0.7(@types/node@25.9.5)
+      '@inquirer/ansi': 2.0.8
+      '@inquirer/core': 12.0.3(@types/node@25.9.5)
+      '@inquirer/figures': 2.0.9
+      '@inquirer/type': 4.1.1(@types/node@25.9.5)
     optionalDependencies:
       '@types/node': 25.9.5
 
   '@inquirer/type@4.0.7(@types/node@25.9.5)':
     optionalDependencies:
       '@types/node': 25.9.5
+    optional: true
+
+  '@inquirer/type@4.1.1(@types/node@25.9.5)':
+    optionalDependencies:
+      '@types/node': 25.9.5
 
   '@isaacs/fs-minipass@4.0.1':
     dependencies:
@@ -8222,6 +8407,8 @@ snapshots:
 
   '@jridgewell/sourcemap-codec@1.5.5': {}
 
+  '@jridgewell/sourcemap-codec@1.6.0': {}
+
   '@jridgewell/trace-mapping@0.3.31':
     dependencies:
       '@jridgewell/resolve-uri': 3.1.2
@@ -8258,7 +8445,7 @@ snapshots:
     dependencies:
       '@chevrotain/types': 11.1.2
 
-  '@modelcontextprotocol/sdk@1.30.0(supports-color@7.2.0)(zod@4.5.4)':
+  '@modelcontextprotocol/sdk@1.30.0(supports-color@7.2.0)(zod@4.6.5)':
     dependencies:
       '@hono/node-server': 2.1.0(hono@4.13.7)
       ajv: 8.20.0
@@ -8269,14 +8456,14 @@ snapshots:
       eventsource: 3.0.7
       eventsource-parser: 3.0.8
       express: 5.2.1(supports-color@7.2.0)
-      express-rate-limit: 8.5.2(express@5.2.1)
+      express-rate-limit: 8.5.2(express@5.2.1(supports-color@7.2.0))
       hono: 4.13.7
       jose: 6.2.3
       json-schema-typed: 8.0.2
       pkce-challenge: 5.0.1
       raw-body: 3.0.2
-      zod: 4.5.4
-      zod-to-json-schema: 3.25.2(zod@4.5.4)
+      zod: 4.6.5
+      zod-to-json-schema: 3.25.2(zod@4.6.5)
     transitivePeerDependencies:
       - supports-color
 
@@ -8291,7 +8478,7 @@ snapshots:
       eventsource: 3.0.7
       eventsource-parser: 3.0.8
       express: 5.2.1(supports-color@7.2.0)
-      express-rate-limit: 8.5.2(express@5.2.1)
+      express-rate-limit: 8.5.2(express@5.2.1(supports-color@7.2.0))
       hono: 4.13.7
       jose: 6.2.3
       json-schema-typed: 8.0.2
@@ -8550,61 +8737,61 @@ snapshots:
   '@oxc-project/types@0.148.0':
     optional: true
 
-  '@oxfmt/binding-android-arm-eabi@0.65.0':
+  '@oxfmt/binding-android-arm-eabi@0.70.0':
     optional: true
 
-  '@oxfmt/binding-android-arm64@0.65.0':
+  '@oxfmt/binding-android-arm64@0.70.0':
     optional: true
 
-  '@oxfmt/binding-darwin-arm64@0.65.0':
+  '@oxfmt/binding-darwin-arm64@0.70.0':
     optional: true
 
-  '@oxfmt/binding-darwin-x64@0.65.0':
+  '@oxfmt/binding-darwin-x64@0.70.0':
     optional: true
 
-  '@oxfmt/binding-freebsd-x64@0.65.0':
+  '@oxfmt/binding-freebsd-x64@0.70.0':
     optional: true
 
-  '@oxfmt/binding-linux-arm-gnueabihf@0.65.0':
+  '@oxfmt/binding-linux-arm-gnueabihf@0.70.0':
     optional: true
 
-  '@oxfmt/binding-linux-arm-musleabihf@0.65.0':
+  '@oxfmt/binding-linux-arm-musleabihf@0.70.0':
     optional: true
 
-  '@oxfmt/binding-linux-arm64-gnu@0.65.0':
+  '@oxfmt/binding-linux-arm64-gnu@0.70.0':
     optional: true
 
-  '@oxfmt/binding-linux-arm64-musl@0.65.0':
+  '@oxfmt/binding-linux-arm64-musl@0.70.0':
     optional: true
 
-  '@oxfmt/binding-linux-ppc64-gnu@0.65.0':
+  '@oxfmt/binding-linux-ppc64-gnu@0.70.0':
     optional: true
 
-  '@oxfmt/binding-linux-riscv64-gnu@0.65.0':
+  '@oxfmt/binding-linux-riscv64-gnu@0.70.0':
     optional: true
 
-  '@oxfmt/binding-linux-riscv64-musl@0.65.0':
+  '@oxfmt/binding-linux-riscv64-musl@0.70.0':
     optional: true
 
-  '@oxfmt/binding-linux-s390x-gnu@0.65.0':
+  '@oxfmt/binding-linux-s390x-gnu@0.70.0':
     optional: true
 
-  '@oxfmt/binding-linux-x64-gnu@0.65.0':
+  '@oxfmt/binding-linux-x64-gnu@0.70.0':
     optional: true
 
-  '@oxfmt/binding-linux-x64-musl@0.65.0':
+  '@oxfmt/binding-linux-x64-musl@0.70.0':
     optional: true
 
-  '@oxfmt/binding-openharmony-arm64@0.65.0':
+  '@oxfmt/binding-openharmony-arm64@0.70.0':
     optional: true
 
-  '@oxfmt/binding-win32-arm64-msvc@0.65.0':
+  '@oxfmt/binding-win32-arm64-msvc@0.70.0':
     optional: true
 
-  '@oxfmt/binding-win32-ia32-msvc@0.65.0':
+  '@oxfmt/binding-win32-ia32-msvc@0.70.0':
     optional: true
 
-  '@oxfmt/binding-win32-x64-msvc@0.65.0':
+  '@oxfmt/binding-win32-x64-msvc@0.70.0':
     optional: true
 
   '@oxlint-tsgolint/darwin-arm64@7.0.2001':
@@ -8625,66 +8812,66 @@ snapshots:
   '@oxlint-tsgolint/win32-x64@7.0.2001':
     optional: true
 
-  '@oxlint/binding-android-arm-eabi@1.80.0':
+  '@oxlint/binding-android-arm-eabi@1.85.0':
     optional: true
 
-  '@oxlint/binding-android-arm64@1.80.0':
+  '@oxlint/binding-android-arm64@1.85.0':
     optional: true
 
-  '@oxlint/binding-darwin-arm64@1.80.0':
+  '@oxlint/binding-darwin-arm64@1.85.0':
     optional: true
 
-  '@oxlint/binding-darwin-x64@1.80.0':
+  '@oxlint/binding-darwin-x64@1.85.0':
     optional: true
 
-  '@oxlint/binding-freebsd-x64@1.80.0':
+  '@oxlint/binding-freebsd-x64@1.85.0':
     optional: true
 
-  '@oxlint/binding-linux-arm-gnueabihf@1.80.0':
+  '@oxlint/binding-linux-arm-gnueabihf@1.85.0':
     optional: true
 
-  '@oxlint/binding-linux-arm-musleabihf@1.80.0':
+  '@oxlint/binding-linux-arm-musleabihf@1.85.0':
     optional: true
 
-  '@oxlint/binding-linux-arm64-gnu@1.80.0':
+  '@oxlint/binding-linux-arm64-gnu@1.85.0':
     optional: true
 
-  '@oxlint/binding-linux-arm64-musl@1.80.0':
+  '@oxlint/binding-linux-arm64-musl@1.85.0':
     optional: true
 
-  '@oxlint/binding-linux-ppc64-gnu@1.80.0':
+  '@oxlint/binding-linux-ppc64-gnu@1.85.0':
     optional: true
 
-  '@oxlint/binding-linux-riscv64-gnu@1.80.0':
+  '@oxlint/binding-linux-riscv64-gnu@1.85.0':
     optional: true
 
-  '@oxlint/binding-linux-riscv64-musl@1.80.0':
+  '@oxlint/binding-linux-riscv64-musl@1.85.0':
     optional: true
 
-  '@oxlint/binding-linux-s390x-gnu@1.80.0':
+  '@oxlint/binding-linux-s390x-gnu@1.85.0':
     optional: true
 
-  '@oxlint/binding-linux-x64-gnu@1.80.0':
+  '@oxlint/binding-linux-x64-gnu@1.85.0':
     optional: true
 
-  '@oxlint/binding-linux-x64-musl@1.80.0':
+  '@oxlint/binding-linux-x64-musl@1.85.0':
     optional: true
 
-  '@oxlint/binding-openharmony-arm64@1.80.0':
+  '@oxlint/binding-openharmony-arm64@1.85.0':
     optional: true
 
-  '@oxlint/binding-win32-arm64-msvc@1.80.0':
+  '@oxlint/binding-win32-arm64-msvc@1.85.0':
     optional: true
 
-  '@oxlint/binding-win32-ia32-msvc@1.80.0':
+  '@oxlint/binding-win32-ia32-msvc@1.85.0':
     optional: true
 
-  '@oxlint/binding-win32-x64-msvc@1.80.0':
+  '@oxlint/binding-win32-x64-msvc@1.85.0':
     optional: true
 
   '@oxlint/plugins@1.78.0': {}
 
-  '@oxlint/plugins@1.80.0': {}
+  '@oxlint/plugins@1.85.0': {}
 
   '@parcel/watcher-android-arm64@2.5.6':
     optional: true
@@ -8768,15 +8955,15 @@ snapshots:
       tslib: 2.8.1
       webcrypto-core: 1.9.2
 
-  '@playwright/test@1.59.1':
+  '@playwright/test@1.63.0':
     dependencies:
-      playwright: 1.59.1
+      playwright: 1.63.0
 
-  '@posthog/core@1.28.3':
+  '@posthog/core@1.55.1':
     dependencies:
-      '@posthog/types': 1.372.9
+      '@posthog/types': 1.412.4
 
-  '@posthog/types@1.372.9': {}
+  '@posthog/types@1.412.4': {}
 
   '@radix-ui/number@1.1.2': {}
 
@@ -9584,7 +9771,7 @@ snapshots:
 
   '@rolldown/pluginutils@1.0.0-rc.3': {}
 
-  '@sanity/diff-match-patch@3.2.0': {}
+  '@sanity/diff-match-patch@3.2.1': {}
 
   '@sec-ant/readable-stream@0.4.1': {}
 
@@ -9606,27 +9793,27 @@ snapshots:
 
   '@stablelib/base64@1.0.1': {}
 
-  '@stablyai/playwright-base@2.1.14(@playwright/test@1.59.1)(zod@4.5.4)':
+  '@stablyai/playwright-base@2.1.16(@playwright/test@1.63.0)(zod@4.6.5)':
     dependencies:
-      '@playwright/test': 1.59.1
+      '@playwright/test': 1.63.0
       jpeg-js: 0.4.4
       p-retry: 4.6.2
       pngjs: 7.0.0
     optionalDependencies:
-      zod: 4.5.4
+      zod: 4.6.5
 
-  '@stablyai/playwright-test@2.1.14(@playwright/test@1.59.1)(zod@4.5.4)':
+  '@stablyai/playwright-test@2.1.16(@playwright/test@1.63.0)(zod@4.6.5)':
     dependencies:
-      '@playwright/test': 1.59.1
-      '@stablyai/playwright': 2.1.14(@playwright/test@1.59.1)(zod@4.5.4)
-      '@stablyai/playwright-base': 2.1.14(@playwright/test@1.59.1)(zod@4.5.4)
+      '@playwright/test': 1.63.0
+      '@stablyai/playwright': 2.1.16(@playwright/test@1.63.0)(zod@4.6.5)
+      '@stablyai/playwright-base': 2.1.16(@playwright/test@1.63.0)(zod@4.6.5)
     transitivePeerDependencies:
       - zod
 
-  '@stablyai/playwright@2.1.14(@playwright/test@1.59.1)(zod@4.5.4)':
+  '@stablyai/playwright@2.1.16(@playwright/test@1.63.0)(zod@4.6.5)':
     dependencies:
-      '@playwright/test': 1.59.1
-      '@stablyai/playwright-base': 2.1.14(@playwright/test@1.59.1)(zod@4.5.4)
+      '@playwright/test': 1.63.0
+      '@stablyai/playwright-base': 2.1.16(@playwright/test@1.63.0)(zod@4.6.5)
     transitivePeerDependencies:
       - zod
 
@@ -9637,39 +9824,75 @@ snapshots:
   '@swc/core-darwin-arm64@1.15.46':
     optional: true
 
+  '@swc/core-darwin-arm64@1.16.2':
+    optional: true
+
   '@swc/core-darwin-x64@1.15.46':
     optional: true
 
+  '@swc/core-darwin-x64@1.16.2':
+    optional: true
+
   '@swc/core-linux-arm-gnueabihf@1.15.46':
     optional: true
 
+  '@swc/core-linux-arm-gnueabihf@1.16.2':
+    optional: true
+
   '@swc/core-linux-arm64-gnu@1.15.46':
     optional: true
 
+  '@swc/core-linux-arm64-gnu@1.16.2':
+    optional: true
+
   '@swc/core-linux-arm64-musl@1.15.46':
     optional: true
 
+  '@swc/core-linux-arm64-musl@1.16.2':
+    optional: true
+
   '@swc/core-linux-ppc64-gnu@1.15.46':
     optional: true
 
+  '@swc/core-linux-ppc64-gnu@1.16.2':
+    optional: true
+
   '@swc/core-linux-s390x-gnu@1.15.46':
     optional: true
 
+  '@swc/core-linux-s390x-gnu@1.16.2':
+    optional: true
+
   '@swc/core-linux-x64-gnu@1.15.46':
     optional: true
 
+  '@swc/core-linux-x64-gnu@1.16.2':
+    optional: true
+
   '@swc/core-linux-x64-musl@1.15.46':
     optional: true
 
+  '@swc/core-linux-x64-musl@1.16.2':
+    optional: true
+
   '@swc/core-win32-arm64-msvc@1.15.46':
     optional: true
 
+  '@swc/core-win32-arm64-msvc@1.16.2':
+    optional: true
+
   '@swc/core-win32-ia32-msvc@1.15.46':
     optional: true
 
+  '@swc/core-win32-ia32-msvc@1.16.2':
+    optional: true
+
   '@swc/core-win32-x64-msvc@1.15.46':
     optional: true
 
+  '@swc/core-win32-x64-msvc@1.16.2':
+    optional: true
+
   '@swc/core@1.15.46':
     dependencies:
       '@swc/counter': 0.1.3
@@ -9688,12 +9911,34 @@ snapshots:
       '@swc/core-win32-ia32-msvc': 1.15.46
       '@swc/core-win32-x64-msvc': 1.15.46
 
+  '@swc/core@1.16.2':
+    dependencies:
+      '@swc/counter': 0.1.3
+      '@swc/types': 0.1.28
+    optionalDependencies:
+      '@swc/core-darwin-arm64': 1.16.2
+      '@swc/core-darwin-x64': 1.16.2
+      '@swc/core-linux-arm-gnueabihf': 1.16.2
+      '@swc/core-linux-arm64-gnu': 1.16.2
+      '@swc/core-linux-arm64-musl': 1.16.2
+      '@swc/core-linux-ppc64-gnu': 1.16.2
+      '@swc/core-linux-s390x-gnu': 1.16.2
+      '@swc/core-linux-x64-gnu': 1.16.2
+      '@swc/core-linux-x64-musl': 1.16.2
+      '@swc/core-win32-arm64-msvc': 1.16.2
+      '@swc/core-win32-ia32-msvc': 1.16.2
+      '@swc/core-win32-x64-msvc': 1.16.2
+
   '@swc/counter@0.1.3': {}
 
   '@swc/types@0.1.27':
     dependencies:
       '@swc/counter': 0.1.3
 
+  '@swc/types@0.1.28':
+    dependencies:
+      '@swc/counter': 0.1.3
+
   '@szmarczak/http-timer@4.0.6':
     dependencies:
       defer-to-connect: 2.0.1
@@ -9759,20 +10004,20 @@ snapshots:
       '@tailwindcss/oxide-win32-arm64-msvc': 4.2.4
       '@tailwindcss/oxide-win32-x64-msvc': 4.2.4
 
-  '@tailwindcss/vite@4.2.4(rolldown-vite@7.3.1(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@25.9.5)(esbuild@0.25.12)(jiti@2.7.0)(yaml@2.8.4))':
+  '@tailwindcss/vite@4.2.4(rolldown-vite@7.3.1(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@25.9.5)(esbuild@0.25.12)(jiti@2.7.0)(yaml@2.9.1))':
     dependencies:
       '@tailwindcss/node': 4.2.4
       '@tailwindcss/oxide': 4.2.4
       tailwindcss: 4.2.4
-      vite: rolldown-vite@7.3.1(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@25.9.5)(esbuild@0.25.12)(jiti@2.7.0)(yaml@2.8.4)
+      vite: rolldown-vite@7.3.1(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@25.9.5)(esbuild@0.25.12)(jiti@2.7.0)(yaml@2.9.1)
 
-  '@tanstack/react-virtual@3.14.10(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
+  '@tanstack/react-virtual@3.14.13(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
-      '@tanstack/virtual-core': 3.17.8
+      '@tanstack/virtual-core': 3.17.11
       react: 19.2.8
       react-dom: 19.2.8(react@19.2.8)
 
-  '@tanstack/virtual-core@3.17.8': {}
+  '@tanstack/virtual-core@3.17.11': {}
 
   '@testing-library/dom@10.4.1':
     dependencies:
@@ -9794,7 +10039,7 @@ snapshots:
       picocolors: 1.1.1
       redent: 3.0.0
 
-  '@testing-library/react@16.3.2(@testing-library/dom@10.4.1)(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
+  '@testing-library/react@16.3.3(@testing-library/dom@10.4.1)(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
       '@babel/runtime': 7.29.7
       '@testing-library/dom': 10.4.1
@@ -9804,7 +10049,7 @@ snapshots:
       '@types/react': 19.2.17
       '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@testing-library/user-event@14.6.1(@testing-library/dom@10.4.1)':
+  '@testing-library/user-event@14.6.7(@testing-library/dom@10.4.1)':
     dependencies:
       '@testing-library/dom': 10.4.1
 
@@ -9823,7 +10068,7 @@ snapshots:
 
   '@tiptap/extension-bubble-menu@3.31.3(@tiptap/core@3.31.3(@tiptap/pm@3.31.3))(@tiptap/pm@3.31.3)':
     dependencies:
-      '@floating-ui/dom': 1.7.6
+      '@floating-ui/dom': 1.8.0
       '@tiptap/core': 3.31.3(@tiptap/pm@3.31.3)
       '@tiptap/pm': 3.31.3
     optional: true
@@ -9863,9 +10108,9 @@ snapshots:
     dependencies:
       '@tiptap/extensions': 3.31.3(@tiptap/core@3.31.3(@tiptap/pm@3.31.3))(@tiptap/pm@3.31.3)
 
-  '@tiptap/extension-floating-menu@3.31.3(@floating-ui/dom@1.7.6)(@tiptap/core@3.31.3(@tiptap/pm@3.31.3))(@tiptap/pm@3.31.3)':
+  '@tiptap/extension-floating-menu@3.31.3(@floating-ui/dom@1.8.0)(@tiptap/core@3.31.3(@tiptap/pm@3.31.3))(@tiptap/pm@3.31.3)':
     dependencies:
-      '@floating-ui/dom': 1.7.6
+      '@floating-ui/dom': 1.8.0
       '@tiptap/core': 3.31.3(@tiptap/pm@3.31.3)
       '@tiptap/pm': 3.31.3
     optional: true
@@ -10000,7 +10245,7 @@ snapshots:
       prosemirror-transform: 1.12.0
       prosemirror-view: 1.42.3
 
-  '@tiptap/react@3.31.3(@floating-ui/dom@1.7.6)(@tiptap/core@3.31.3(@tiptap/pm@3.31.3))(@tiptap/pm@3.31.3)(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
+  '@tiptap/react@3.31.3(@floating-ui/dom@1.8.0)(@tiptap/core@3.31.3(@tiptap/pm@3.31.3))(@tiptap/pm@3.31.3)(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
       '@tiptap/core': 3.31.3(@tiptap/pm@3.31.3)
       '@tiptap/pm': 3.31.3
@@ -10013,7 +10258,7 @@ snapshots:
       use-sync-external-store: 1.6.0(react@19.2.8)
     optionalDependencies:
       '@tiptap/extension-bubble-menu': 3.31.3(@tiptap/core@3.31.3(@tiptap/pm@3.31.3))(@tiptap/pm@3.31.3)
-      '@tiptap/extension-floating-menu': 3.31.3(@floating-ui/dom@1.7.6)(@tiptap/core@3.31.3(@tiptap/pm@3.31.3))(@tiptap/pm@3.31.3)
+      '@tiptap/extension-floating-menu': 3.31.3(@floating-ui/dom@1.8.0)(@tiptap/core@3.31.3(@tiptap/pm@3.31.3))(@tiptap/pm@3.31.3)
     transitivePeerDependencies:
       - '@floating-ui/dom'
 
@@ -10431,7 +10676,7 @@ snapshots:
       d3-selection: 3.0.0
       d3-transition: 3.0.1(d3-selection@3.0.0)
 
-  '@vitejs/plugin-react@5.2.0(rolldown-vite@7.3.1(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@25.9.5)(esbuild@0.25.12)(jiti@2.7.0)(yaml@2.8.4))':
+  '@vitejs/plugin-react@5.2.0(rolldown-vite@7.3.1(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@25.9.5)(esbuild@0.25.12)(jiti@2.7.0)(yaml@2.9.1))':
     dependencies:
       '@babel/core': 7.29.7
       '@babel/plugin-transform-react-jsx-self': 7.27.1(@babel/core@7.29.7)
@@ -10439,7 +10684,7 @@ snapshots:
       '@rolldown/pluginutils': 1.0.0-rc.3
       '@types/babel__core': 7.20.5
       react-refresh: 0.18.0
-      vite: rolldown-vite@7.3.1(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@25.9.5)(esbuild@0.25.12)(jiti@2.7.0)(yaml@2.8.4)
+      vite: rolldown-vite@7.3.1(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@25.9.5)(esbuild@0.25.12)(jiti@2.7.0)(yaml@2.9.1)
     transitivePeerDependencies:
       - supports-color
 
@@ -10452,14 +10697,14 @@ snapshots:
       chai: 6.2.2
       tinyrainbow: 3.1.0
 
-  '@vitest/mocker@4.1.11(msw@2.14.3(@types/node@25.9.5)(typescript@7.0.2))(rolldown-vite@7.3.1(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@25.9.5)(esbuild@0.25.12)(jiti@2.7.0)(yaml@2.8.4))':
+  '@vitest/mocker@4.1.11(msw@2.14.3(@types/node@25.9.5)(typescript@7.0.2))(rolldown-vite@7.3.1(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@25.9.5)(esbuild@0.25.12)(jiti@2.7.0)(yaml@2.9.1))':
     dependencies:
       '@vitest/spy': 4.1.11
       estree-walker: 3.0.3
       magic-string: 0.30.21
     optionalDependencies:
       msw: 2.14.3(@types/node@25.9.5)(typescript@7.0.2)
-      vite: rolldown-vite@7.3.1(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@25.9.5)(esbuild@0.25.12)(jiti@2.7.0)(yaml@2.8.4)
+      vite: rolldown-vite@7.3.1(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@25.9.5)(esbuild@0.25.12)(jiti@2.7.0)(yaml@2.9.1)
 
   '@vitest/pretty-format@4.1.11':
     dependencies:
@@ -10487,7 +10732,7 @@ snapshots:
 
   '@vscode/ripgrep-universal@1.18.0': {}
 
-  '@vscode/windows-process-tree@0.8.0(patch_hash=e66202cc623996d02040c93449eb9ae353fddadf426cb53202a59ee710ee6fe7)':
+  '@vscode/windows-process-tree@0.8.0(patch_hash=b4be93859cefb159949d9cf05f97fa91a221dff0f793a6f03d02d78ae5b32035)':
     dependencies:
       node-addon-api: 7.1.0
     optional: true
@@ -10914,6 +11159,8 @@ snapshots:
 
   commander@14.0.3: {}
 
+  commander@15.0.0: {}
+
   commander@5.1.0: {}
 
   commander@7.2.0: {}
@@ -11266,7 +11513,7 @@ snapshots:
 
   dom-accessibility-api@0.6.3: {}
 
-  dompurify@3.4.14:
+  dompurify@3.4.15:
     optionalDependencies:
       '@types/trusted-types': 2.0.7
 
@@ -11355,7 +11602,7 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  electron-vite@5.0.0(@swc/core@1.15.46)(rolldown-vite@7.3.1(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@25.9.5)(esbuild@0.25.12)(jiti@2.7.0)(yaml@2.8.4)):
+  electron-vite@5.0.0(@swc/core@1.15.46)(rolldown-vite@7.3.1(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@25.9.5)(esbuild@0.25.12)(jiti@2.7.0)(yaml@2.9.1)):
     dependencies:
       '@babel/core': 7.29.7
       '@babel/plugin-transform-arrow-functions': 7.27.1(@babel/core@7.29.7)
@@ -11363,7 +11610,7 @@ snapshots:
       esbuild: 0.25.12
       magic-string: 0.30.21
       picocolors: 1.1.1
-      vite: rolldown-vite@7.3.1(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@25.9.5)(esbuild@0.25.12)(jiti@2.7.0)(yaml@2.8.4)
+      vite: rolldown-vite@7.3.1(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@25.9.5)(esbuild@0.25.12)(jiti@2.7.0)(yaml@2.9.1)
     optionalDependencies:
       '@swc/core': 1.15.46
     transitivePeerDependencies:
@@ -11574,6 +11821,21 @@ snapshots:
     dependencies:
       eventsource-parser: 3.0.8
 
+  execa@10.0.1:
+    dependencies:
+      '@sindresorhus/merge-streams': 4.0.0
+      figures: 6.1.0
+      get-stream: 9.0.1
+      human-signals: 8.0.1
+      is-plain-obj: 4.1.0
+      is-stream: 4.0.1
+      npm-run-path: 6.0.0
+      pretty-ms: 9.3.0
+      signal-exit: 4.1.0
+      strip-final-newline: 4.0.0
+      which-command: 0.1.0
+      yoctocolors: 2.1.2
+
   execa@5.1.1:
     dependencies:
       cross-spawn: 7.0.6
@@ -11605,7 +11867,7 @@ snapshots:
 
   exponential-backoff@3.1.3: {}
 
-  express-rate-limit@8.5.2(express@5.2.1):
+  express-rate-limit@8.5.2(express@5.2.1(supports-color@7.2.0)):
     dependencies:
       express: 5.2.1(supports-color@7.2.0)
       ip-address: 10.4.0
@@ -11791,9 +12053,6 @@ snapshots:
 
   fs.realpath@1.0.0: {}
 
-  fsevents@2.3.2:
-    optional: true
-
   fsevents@2.3.3:
     optional: true
 
@@ -12118,28 +12377,28 @@ snapshots:
 
   husky@9.1.7: {}
 
-  i18next-cli@1.65.0(@types/node@25.9.5)(react-dom@19.2.8(react@19.2.8))(typescript@7.0.2):
+  i18next-cli@1.74.1(@types/node@25.9.5)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(typescript@7.0.2):
     dependencies:
       '@croct/json5-parser': 0.2.2
-      '@swc/core': 1.15.46
+      '@swc/core': 1.16.2
       chokidar: 5.0.0
-      commander: 14.0.3
-      execa: 9.6.1
+      commander: 15.0.0
+      execa: 10.0.1
       glob: 13.0.6
-      i18next: 26.3.1(typescript@7.0.2)
+      i18next: 26.4.2(typescript@7.0.2)
       i18next-resources-for-ts: 2.1.0
-      inquirer: 14.0.2(@types/node@25.9.5)
+      inquirer: 14.2.2(@types/node@25.9.5)
       jiti: 2.7.0
       jsonc-parser: 3.3.1
-      magic-string: 0.30.21
-      minimatch: 10.2.5
-      ora: 9.4.0
-      react: 19.2.8
-      react-i18next: 17.0.13(i18next@26.3.1(typescript@7.0.2))(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(typescript@7.0.2)
-      yaml: 2.9.0
+      magic-string: 1.4.2
+      minimatch: 10.2.6
+      ora: 9.4.1
+      react-i18next: 17.0.15(i18next@26.4.2(typescript@7.0.2))(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(typescript@7.0.2)
+      yaml: 2.9.1
     transitivePeerDependencies:
       - '@swc/helpers'
       - '@types/node'
+      - react
       - react-dom
       - react-native
       - typescript
@@ -12149,7 +12408,7 @@ snapshots:
       '@babel/runtime': 7.29.7
       '@swc/core': 1.15.46
       chokidar: 5.0.0
-      yaml: 2.9.0
+      yaml: 2.9.1
     transitivePeerDependencies:
       - '@swc/helpers'
 
@@ -12157,6 +12416,10 @@ snapshots:
     optionalDependencies:
       typescript: 7.0.2
 
+  i18next@26.4.2(typescript@7.0.2):
+    optionalDependencies:
+      typescript: 7.0.2
+
   iconv-lite@0.6.3:
     dependencies:
       safer-buffer: 2.1.2
@@ -12187,12 +12450,12 @@ snapshots:
 
   inline-style-parser@0.2.7: {}
 
-  inquirer@14.0.2(@types/node@25.9.5):
+  inquirer@14.2.2(@types/node@25.9.5):
     dependencies:
-      '@inquirer/ansi': 2.0.7
-      '@inquirer/core': 11.2.1(@types/node@25.9.5)
-      '@inquirer/prompts': 8.5.2(@types/node@25.9.5)
-      '@inquirer/type': 4.0.7(@types/node@25.9.5)
+      '@inquirer/ansi': 2.0.8
+      '@inquirer/core': 12.0.3(@types/node@25.9.5)
+      '@inquirer/prompts': 8.7.2(@types/node@25.9.5)
+      '@inquirer/type': 4.1.1(@types/node@25.9.5)
       mute-stream: 3.0.0
       run-async: 4.0.6
     optionalDependencies:
@@ -12429,7 +12692,7 @@ snapshots:
       picomatch: 4.0.4
       string-argv: 0.3.2
       tinyexec: 1.1.2
-      yaml: 2.8.4
+      yaml: 2.9.1
 
   listr2@9.0.5:
     dependencies:
@@ -12504,6 +12767,10 @@ snapshots:
     dependencies:
       '@jridgewell/sourcemap-codec': 1.5.5
 
+  magic-string@1.4.2:
+    dependencies:
+      '@jridgewell/sourcemap-codec': 1.6.0
+
   markdown-table@3.0.4: {}
 
   marked@14.0.0: {}
@@ -12732,7 +12999,7 @@ snapshots:
       d3-sankey: 0.12.3
       dagre-d3-es: 7.0.14
       dayjs: 1.11.23
-      dompurify: 3.4.14
+      dompurify: 3.4.15
       es-toolkit: 1.46.1
       fastdom: 1.0.12
       katex: 0.16.47
@@ -13003,6 +13270,10 @@ snapshots:
     dependencies:
       brace-expansion: 5.0.9
 
+  minimatch@10.2.6:
+    dependencies:
+      brace-expansion: 5.0.9
+
   minimatch@3.1.5:
     dependencies:
       brace-expansion: 1.1.18
@@ -13036,7 +13307,7 @@ snapshots:
 
   monaco-editor@0.55.1:
     dependencies:
-      dompurify: 3.4.14
+      dompurify: 3.4.15
       marked: 14.0.0
 
   ms@2.1.3: {}
@@ -13108,7 +13379,7 @@ snapshots:
 
   node-int64@0.4.0: {}
 
-  node-pty@1.1.0(patch_hash=346cb29d33dd6eeb14910ff411c7584b0b2ff9a4b271c4b6d23c3b48e6548f74):
+  node-pty@1.1.0(patch_hash=92c95cffab383d86b3b13a460c75a08074468ebf1f3911db8e874e083201f192):
     dependencies:
       node-addon-api: 7.1.1
 
@@ -13199,6 +13470,17 @@ snapshots:
       stdin-discarder: 0.3.2
       string-width: 8.2.1
 
+  ora@9.4.1:
+    dependencies:
+      chalk: 5.6.2
+      cli-cursor: 5.0.0
+      cli-spinners: 3.4.0
+      is-interactive: 2.0.0
+      is-unicode-supported: 2.1.0
+      log-symbols: 7.0.1
+      stdin-discarder: 0.3.2
+      string-width: 8.2.1
+
   orderedmap@2.1.1: {}
 
   outvariant@1.4.3:
@@ -13254,29 +13536,29 @@ snapshots:
       '@oxc-parser/binding-win32-x64-msvc': 0.148.0
     optional: true
 
-  oxfmt@0.65.0:
-    dependencies:
-      tinypool: 2.1.0
-    optionalDependencies:
-      '@oxfmt/binding-android-arm-eabi': 0.65.0
-      '@oxfmt/binding-android-arm64': 0.65.0
-      '@oxfmt/binding-darwin-arm64': 0.65.0
-      '@oxfmt/binding-darwin-x64': 0.65.0
-      '@oxfmt/binding-freebsd-x64': 0.65.0
-      '@oxfmt/binding-linux-arm-gnueabihf': 0.65.0
-      '@oxfmt/binding-linux-arm-musleabihf': 0.65.0
-      '@oxfmt/binding-linux-arm64-gnu': 0.65.0
-      '@oxfmt/binding-linux-arm64-musl': 0.65.0
-      '@oxfmt/binding-linux-ppc64-gnu': 0.65.0
-      '@oxfmt/binding-linux-riscv64-gnu': 0.65.0
-      '@oxfmt/binding-linux-riscv64-musl': 0.65.0
-      '@oxfmt/binding-linux-s390x-gnu': 0.65.0
-      '@oxfmt/binding-linux-x64-gnu': 0.65.0
-      '@oxfmt/binding-linux-x64-musl': 0.65.0
-      '@oxfmt/binding-openharmony-arm64': 0.65.0
-      '@oxfmt/binding-win32-arm64-msvc': 0.65.0
-      '@oxfmt/binding-win32-ia32-msvc': 0.65.0
-      '@oxfmt/binding-win32-x64-msvc': 0.65.0
+  oxfmt@0.70.0:
+    dependencies:
+      tinypool: 2.1.2
+    optionalDependencies:
+      '@oxfmt/binding-android-arm-eabi': 0.70.0
+      '@oxfmt/binding-android-arm64': 0.70.0
+      '@oxfmt/binding-darwin-arm64': 0.70.0
+      '@oxfmt/binding-darwin-x64': 0.70.0
+      '@oxfmt/binding-freebsd-x64': 0.70.0
+      '@oxfmt/binding-linux-arm-gnueabihf': 0.70.0
+      '@oxfmt/binding-linux-arm-musleabihf': 0.70.0
+      '@oxfmt/binding-linux-arm64-gnu': 0.70.0
+      '@oxfmt/binding-linux-arm64-musl': 0.70.0
+      '@oxfmt/binding-linux-ppc64-gnu': 0.70.0
+      '@oxfmt/binding-linux-riscv64-gnu': 0.70.0
+      '@oxfmt/binding-linux-riscv64-musl': 0.70.0
+      '@oxfmt/binding-linux-s390x-gnu': 0.70.0
+      '@oxfmt/binding-linux-x64-gnu': 0.70.0
+      '@oxfmt/binding-linux-x64-musl': 0.70.0
+      '@oxfmt/binding-openharmony-arm64': 0.70.0
+      '@oxfmt/binding-win32-arm64-msvc': 0.70.0
+      '@oxfmt/binding-win32-ia32-msvc': 0.70.0
+      '@oxfmt/binding-win32-x64-msvc': 0.70.0
 
   oxlint-plugin-anti-slop@https://codeload.github.com/dmmulroy/anti-slop/tar.gz/c44ef22ca116d0ba62a3ff663a0bd13a3f3fa40b:
     dependencies:
@@ -13298,27 +13580,27 @@ snapshots:
       '@oxlint-tsgolint/win32-arm64': 7.0.2001
       '@oxlint-tsgolint/win32-x64': 7.0.2001
 
-  oxlint@1.80.0(oxlint-tsgolint@7.0.2001):
-    optionalDependencies:
-      '@oxlint/binding-android-arm-eabi': 1.80.0
-      '@oxlint/binding-android-arm64': 1.80.0
-      '@oxlint/binding-darwin-arm64': 1.80.0
-      '@oxlint/binding-darwin-x64': 1.80.0
-      '@oxlint/binding-freebsd-x64': 1.80.0
-      '@oxlint/binding-linux-arm-gnueabihf': 1.80.0
-      '@oxlint/binding-linux-arm-musleabihf': 1.80.0
-      '@oxlint/binding-linux-arm64-gnu': 1.80.0
-      '@oxlint/binding-linux-arm64-musl': 1.80.0
-      '@oxlint/binding-linux-ppc64-gnu': 1.80.0
-      '@oxlint/binding-linux-riscv64-gnu': 1.80.0
-      '@oxlint/binding-linux-riscv64-musl': 1.80.0
-      '@oxlint/binding-linux-s390x-gnu': 1.80.0
-      '@oxlint/binding-linux-x64-gnu': 1.80.0
-      '@oxlint/binding-linux-x64-musl': 1.80.0
-      '@oxlint/binding-openharmony-arm64': 1.80.0
-      '@oxlint/binding-win32-arm64-msvc': 1.80.0
-      '@oxlint/binding-win32-ia32-msvc': 1.80.0
-      '@oxlint/binding-win32-x64-msvc': 1.80.0
+  oxlint@1.85.0(oxlint-tsgolint@7.0.2001):
+    optionalDependencies:
+      '@oxlint/binding-android-arm-eabi': 1.85.0
+      '@oxlint/binding-android-arm64': 1.85.0
+      '@oxlint/binding-darwin-arm64': 1.85.0
+      '@oxlint/binding-darwin-x64': 1.85.0
+      '@oxlint/binding-freebsd-x64': 1.85.0
+      '@oxlint/binding-linux-arm-gnueabihf': 1.85.0
+      '@oxlint/binding-linux-arm-musleabihf': 1.85.0
+      '@oxlint/binding-linux-arm64-gnu': 1.85.0
+      '@oxlint/binding-linux-arm64-musl': 1.85.0
+      '@oxlint/binding-linux-ppc64-gnu': 1.85.0
+      '@oxlint/binding-linux-riscv64-gnu': 1.85.0
+      '@oxlint/binding-linux-riscv64-musl': 1.85.0
+      '@oxlint/binding-linux-s390x-gnu': 1.85.0
+      '@oxlint/binding-linux-x64-gnu': 1.85.0
+      '@oxlint/binding-linux-x64-musl': 1.85.0
+      '@oxlint/binding-openharmony-arm64': 1.85.0
+      '@oxlint/binding-win32-arm64-msvc': 1.85.0
+      '@oxlint/binding-win32-ia32-msvc': 1.85.0
+      '@oxlint/binding-win32-x64-msvc': 1.85.0
       oxlint-tsgolint: 7.0.2001
 
   p-cancelable@2.1.1: {}
@@ -13430,13 +13712,11 @@ snapshots:
       pvutils: 1.1.5
       tslib: 2.8.1
 
-  playwright-core@1.59.1: {}
+  playwright-core@1.63.0: {}
 
-  playwright@1.59.1:
+  playwright@1.63.0:
     dependencies:
-      playwright-core: 1.59.1
-    optionalDependencies:
-      fsevents: 2.3.2
+      playwright-core: 1.63.0
 
   plist@3.1.0:
     dependencies:
@@ -13466,9 +13746,9 @@ snapshots:
       picocolors: 1.1.1
       source-map-js: 1.2.1
 
-  posthog-node@5.33.3:
+  posthog-node@5.52.5:
     dependencies:
-      '@posthog/core': 1.28.3
+      '@posthog/core': 1.55.1
 
   postject@1.0.0-alpha.6:
     dependencies:
@@ -13713,7 +13993,7 @@ snapshots:
     optionalDependencies:
       react: 19.2.8
 
-  react-i18next@17.0.13(i18next@26.3.1(typescript@7.0.2))(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(typescript@7.0.2):
+  react-i18next@17.0.15(i18next@26.3.1(typescript@7.0.2))(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(typescript@7.0.2):
     dependencies:
       '@babel/runtime': 7.29.7
       html-parse-stringify: 4.0.1
@@ -13724,6 +14004,17 @@ snapshots:
       react-dom: 19.2.8(react@19.2.8)
       typescript: 7.0.2
 
+  react-i18next@17.0.15(i18next@26.4.2(typescript@7.0.2))(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(typescript@7.0.2):
+    dependencies:
+      '@babel/runtime': 7.29.7
+      html-parse-stringify: 4.0.1
+      i18next: 26.4.2(typescript@7.0.2)
+      react: 19.2.8
+      use-sync-external-store: 1.6.0(react@19.2.8)
+    optionalDependencies:
+      react-dom: 19.2.8(react@19.2.8)
+      typescript: 7.0.2
+
   react-is@17.0.2: {}
 
   react-markdown@10.1.0(@types/react@19.2.17)(react@19.2.8):
@@ -13962,7 +14253,7 @@ snapshots:
 
   robust-predicates@3.0.3: {}
 
-  rolldown-vite@7.3.1(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@25.9.5)(esbuild@0.25.12)(jiti@2.7.0)(yaml@2.8.4):
+  rolldown-vite@7.3.1(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@25.9.5)(esbuild@0.25.12)(jiti@2.7.0)(yaml@2.9.1):
     dependencies:
       '@oxc-project/runtime': 0.101.0
       fdir: 6.5.0(picomatch@4.0.4)
@@ -13976,7 +14267,7 @@ snapshots:
       esbuild: 0.25.12
       fsevents: 2.3.3
       jiti: 2.7.0
-      yaml: 2.8.4
+      yaml: 2.9.1
     transitivePeerDependencies:
       - '@emnapi/core'
       - '@emnapi/runtime'
@@ -14380,15 +14671,15 @@ snapshots:
       fdir: 6.5.0(picomatch@4.0.4)
       picomatch: 4.0.4
 
-  tinypool@2.1.0: {}
+  tinypool@2.1.2: {}
 
   tinyrainbow@3.1.0: {}
 
-  tldts-core@7.4.12: {}
+  tldts-core@7.4.14: {}
 
-  tldts@7.4.12:
+  tldts@7.4.14:
     dependencies:
-      tldts-core: 7.4.12
+      tldts-core: 7.4.14
 
   tmp-promise@3.0.3:
     dependencies:
@@ -14404,7 +14695,7 @@ snapshots:
 
   tough-cookie@6.0.2:
     dependencies:
-      tldts: 7.4.12
+      tldts: 7.4.14
     optional: true
 
   trim-lines@3.0.1: {}
@@ -14613,10 +14904,10 @@ snapshots:
       '@types/unist': 3.0.3
       vfile-message: 4.0.3
 
-  vitest@4.1.11(@opentelemetry/api@1.9.1)(@types/node@25.9.5)(happy-dom@20.11.8)(msw@2.14.3(@types/node@25.9.5)(typescript@7.0.2))(rolldown-vite@7.3.1(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@25.9.5)(esbuild@0.25.12)(jiti@2.7.0)(yaml@2.8.4)):
+  vitest@4.1.11(@opentelemetry/api@1.9.1)(@types/node@25.9.5)(happy-dom@20.11.8)(msw@2.14.3(@types/node@25.9.5)(typescript@7.0.2))(rolldown-vite@7.3.1(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@25.9.5)(esbuild@0.25.12)(jiti@2.7.0)(yaml@2.9.1)):
     dependencies:
       '@vitest/expect': 4.1.11
-      '@vitest/mocker': 4.1.11(msw@2.14.3(@types/node@25.9.5)(typescript@7.0.2))(rolldown-vite@7.3.1(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@25.9.5)(esbuild@0.25.12)(jiti@2.7.0)(yaml@2.8.4))
+      '@vitest/mocker': 4.1.11(msw@2.14.3(@types/node@25.9.5)(typescript@7.0.2))(rolldown-vite@7.3.1(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@25.9.5)(esbuild@0.25.12)(jiti@2.7.0)(yaml@2.9.1))
       '@vitest/pretty-format': 4.1.11
       '@vitest/runner': 4.1.11
       '@vitest/snapshot': 4.1.11
@@ -14633,7 +14924,7 @@ snapshots:
       tinyexec: 1.1.2
       tinyglobby: 0.2.16
       tinyrainbow: 3.1.0
-      vite: rolldown-vite@7.3.1(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@25.9.5)(esbuild@0.25.12)(jiti@2.7.0)(yaml@2.8.4)
+      vite: rolldown-vite@7.3.1(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(@types/node@25.9.5)(esbuild@0.25.12)(jiti@2.7.0)(yaml@2.9.1)
       why-is-node-running: 2.3.0
     optionalDependencies:
       '@opentelemetry/api': 1.9.1
@@ -14660,6 +14951,8 @@ snapshots:
 
   whatwg-mimetype@3.0.0: {}
 
+  which-command@0.1.0: {}
+
   which-module@2.0.1: {}
 
   which@2.0.2:
@@ -14726,9 +15019,7 @@ snapshots:
 
   yallist@5.0.0: {}
 
-  yaml@2.8.4: {}
-
-  yaml@2.9.0: {}
+  yaml@2.9.1: {}
 
   yargs-parser@18.1.3:
     dependencies:
@@ -14773,13 +15064,13 @@ snapshots:
     dependencies:
       zod: 3.25.76
 
-  zod-to-json-schema@3.25.2(zod@4.5.4):
+  zod-to-json-schema@3.25.2(zod@4.6.5):
     dependencies:
-      zod: 4.5.4
+      zod: 4.6.5
 
   zod@3.25.76: {}
 
-  zod@4.5.4: {}
+  zod@4.6.5: {}
 
   zustand@5.0.14(@types/react@19.2.17)(react@19.2.8)(use-sync-external-store@1.6.0(react@19.2.8)):
     optionalDependencies:
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 90020c507410..1cf678294784 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -57,7 +57,7 @@ allowBuilds:
   '@orca/windows-registry': false
 
 overrides:
-  monaco-editor>dompurify: 3.4.14
+  monaco-editor>dompurify: 3.4.15
 
 patchedDependencies:
   '@xterm/addon-image@0.10.0-beta.300': config/patches/@xterm__addon-image@0.10.0-beta.300.patch
diff --git a/resources/skills/release-mapping.json b/resources/skills/release-mapping.json
index 4a0fb2a7ae97..3190eb3ea6ad 100644
--- a/resources/skills/release-mapping.json
+++ b/resources/skills/release-mapping.json
@@ -639,6 +639,19 @@
         "orca-per-workspace-env": 5,
         "orchestration": 28
       }
+    },
+    {
+      "appVersion": "1.4.214",
+      "skills": {
+        "computer-use": 9,
+        "linear-tickets": 11,
+        "orca-cli": 37,
+        "orca-emulator": 8,
+        "orca-emulator-android": 6,
+        "orca-linear": 9,
+        "orca-per-workspace-env": 6,
+        "orchestration": 29
+      }
     }
   ]
 }
diff --git a/src/cli/handler-group-manifest.ts b/src/cli/handler-group-manifest.ts
index bda6799a8bca..bf1f1e313d1e 100644
--- a/src/cli/handler-group-manifest.ts
+++ b/src/cli/handler-group-manifest.ts
@@ -183,6 +183,11 @@ export const HANDLER_GROUPS: readonly HandlerGroup[] = [
     keys: ['agent hooks prepare-codex', 'agent hooks status', 'agent hooks off', 'agent hooks on'],
     load: async () => (await import('./handlers/agent-hooks.js')).AGENT_HOOK_HANDLERS
   },
+  {
+    name: 'profile-state',
+    keys: ['profile state exports', 'profile state rollback'],
+    load: async () => (await import('./handlers/profile-state.js')).PROFILE_STATE_HANDLERS
+  },
   {
     name: 'diagnostics',
     keys: ['diagnostics memory'],
diff --git a/src/cli/handlers/account-wsl-location.ts b/src/cli/handlers/account-wsl-location.ts
new file mode 100644
index 000000000000..a38aa5826723
--- /dev/null
+++ b/src/cli/handlers/account-wsl-location.ts
@@ -0,0 +1,10 @@
+import { parseWslUncPath } from '../../shared/wsl-paths'
+
+// The bridge preserves the caller's distro even when /mnt/c makes cwd a Windows drive path.
+export function getWslAccountTarget(cwd: string): { runtime: 'wsl'; wslDistro: string } | null {
+  const distro =
+    process.platform === 'win32'
+      ? process.env.ORCA_CLI_WSL_DISTRO?.trim() || parseWslUncPath(cwd)?.distro
+      : undefined
+  return distro ? { runtime: 'wsl', wslDistro: distro } : null
+}
diff --git a/src/cli/handlers/account.test.ts b/src/cli/handlers/account.test.ts
index c35f2270e6ca..9cecb6f12e4a 100644
--- a/src/cli/handlers/account.test.ts
+++ b/src/cli/handlers/account.test.ts
@@ -97,14 +97,16 @@ describe('account CLI handlers', () => {
   const originalPlatform = Object.getOwnPropertyDescriptor(process, 'platform')!
   const originalElectronRunAsNode = process.env.ELECTRON_RUN_AS_NODE
   const originalPathAlias = process.env.Path
+  const originalWslDistroName = process.env.WSL_DISTRO_NAME
+  const originalBridgeDistro = process.env.ORCA_CLI_WSL_DISTRO
   const callMock = vi.fn()
   const client = { call: callMock } as unknown as RuntimeClient
   let logSpy: ReturnType<typeof vi.spyOn>
 
-  function context(agent: string, json = false): HandlerContext {
+  function context(agent: string, json = false, cwd = process.cwd()): HandlerContext {
     return {
       client,
-      cwd: process.cwd(),
+      cwd,
       flags: new Map([['agent', agent]]),
       json,
       rawArgs: []
@@ -136,6 +138,10 @@ describe('account CLI handlers', () => {
     )
     logSpy = vi.spyOn(console, 'log').mockImplementation(() => {})
     process.env.ELECTRON_RUN_AS_NODE = '1'
+    // Why: a test run inside a real distro carries WSL_DISTRO_NAME, which would
+    // leak WSL attribution into every faked-win32 add below.
+    delete process.env.WSL_DISTRO_NAME
+    delete process.env.ORCA_CLI_WSL_DISTRO
   })
 
   afterEach(() => {
@@ -151,6 +157,16 @@ describe('account CLI handlers', () => {
     } else {
       process.env.Path = originalPathAlias
     }
+    if (originalBridgeDistro === undefined) {
+      delete process.env.ORCA_CLI_WSL_DISTRO
+    } else {
+      process.env.ORCA_CLI_WSL_DISTRO = originalBridgeDistro
+    }
+    if (originalWslDistroName === undefined) {
+      delete process.env.WSL_DISTRO_NAME
+    } else {
+      process.env.WSL_DISTRO_NAME = originalWslDistroName
+    }
   })
 
   it('uses Codex device auth and keeps JSON stdout clean', async () => {
@@ -308,6 +324,88 @@ describe('account CLI handlers', () => {
     expect(existsSync(configDir)).toBe(false)
   })
 
+  it('attributes a Claude account added through the WSL bridge to the cwd distro', async () => {
+    Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' })
+
+    await ACCOUNT_HANDLERS['account add'](
+      context('claude', false, String.raw`\\wsl.localhost\Ubuntu-22.04\home\user\project`)
+    )
+
+    const configDir = spawnMock.mock.calls[0]?.[2].env.CLAUDE_CONFIG_DIR
+    expect(callMock).toHaveBeenCalledWith('accounts.addClaudeFromConfigDir', {
+      configDir,
+      runtime: 'wsl',
+      wslDistro: 'Ubuntu-22.04'
+    })
+  })
+
+  it('attributes a Codex account added through the WSL bridge to the cwd distro', async () => {
+    Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' })
+
+    await ACCOUNT_HANDLERS['account add'](
+      context('codex', false, String.raw`\\wsl$\Ubuntu\home\user`)
+    )
+
+    const sourceHome = spawnMock.mock.calls[0]?.[2].env.CODEX_HOME
+    expect(callMock).toHaveBeenCalledWith('accounts.addCodexFromHome', {
+      sourceHome,
+      runtime: 'wsl',
+      wslDistro: 'Ubuntu'
+    })
+  })
+
+  it('uses the explicit bridge distro over an ambient environment or another distro cwd', async () => {
+    Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' })
+    process.env.WSL_DISTRO_NAME = 'stale-Windows-value'
+    process.env.ORCA_CLI_WSL_DISTRO = 'Debian'
+
+    await ACCOUNT_HANDLERS['account add'](
+      context('claude', false, String.raw`\\wsl.localhost\Ubuntu-22.04\home\user`)
+    )
+
+    expect(callMock).toHaveBeenCalledWith(
+      'accounts.addClaudeFromConfigDir',
+      expect.objectContaining({ runtime: 'wsl', wslDistro: 'Debian' })
+    )
+  })
+
+  it.each(['claude', 'codex'])(
+    'attributes %s from a Windows mount to the bridge distro',
+    async (agent) => {
+      Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' })
+      process.env.ORCA_CLI_WSL_DISTRO = 'Ubuntu Work'
+      await ACCOUNT_HANDLERS['account add'](context(agent, false, String.raw`C:\work with spaces`))
+      expect(callMock).toHaveBeenCalledWith(
+        agent === 'claude' ? 'accounts.addClaudeFromConfigDir' : 'accounts.addCodexFromHome',
+        expect.objectContaining({ runtime: 'wsl', wslDistro: 'Ubuntu Work' })
+      )
+    }
+  )
+
+  it('ignores an ambient WSL distro in a native Windows account add', async () => {
+    Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' })
+    process.env.WSL_DISTRO_NAME = 'stale-Windows-value'
+    await ACCOUNT_HANDLERS['account add'](context('codex', false, String.raw`C:\work`))
+    const sourceHome = spawnMock.mock.calls[0]?.[2].env.CODEX_HOME
+    expect(callMock).toHaveBeenCalledWith('accounts.addCodexFromHome', { sourceHome })
+  })
+
+  it.each(['linux', 'darwin'])(
+    'keeps host attribution when the CLI runs on %s',
+    async (platform) => {
+      // Why: a Linux CLI talks to a Linux runtime whose accounts are host-lane;
+      // WSL_DISTRO_NAME there names the CLI's own environment, not a target lane.
+      Object.defineProperty(process, 'platform', { configurable: true, value: platform })
+      process.env.WSL_DISTRO_NAME = 'Ubuntu-22.04'
+      process.env.ORCA_CLI_WSL_DISTRO = 'Ubuntu-22.04'
+
+      await ACCOUNT_HANDLERS['account add'](context('codex'))
+
+      const sourceHome = spawnMock.mock.calls[0]?.[2].env.CODEX_HOME
+      expect(callMock).toHaveBeenCalledWith('accounts.addCodexFromHome', { sourceHome })
+    }
+  )
+
   it('waits for physical child close before removing interrupted login credentials', async () => {
     // Why: deleting first lets the still-live login recreate credentials afterward.
     Object.defineProperty(process, 'platform', { configurable: true, value: 'linux' })
diff --git a/src/cli/handlers/account.ts b/src/cli/handlers/account.ts
index 5a8bd4d3c6c7..b2a06c6d2e25 100644
--- a/src/cli/handlers/account.ts
+++ b/src/cli/handlers/account.ts
@@ -34,6 +34,7 @@ import {
   type InteractiveLoginSession,
   withInteractiveLoginCleanup
 } from './interactive-login-interruption'
+import { getWslAccountTarget } from './account-wsl-location'
 
 // Why: add returns just that provider's state; list returns the full snapshot.
 type AccountsListSnapshot = {
@@ -194,7 +195,7 @@ async function cleanupClaudeLoginArtifacts(
 }
 
 /** Logs into a Claude account in a temp config dir, then registers it with the local runtime. */
-async function addClaudeAccount({ client, json }: HandlerContext): Promise<void> {
+async function addClaudeAccount({ client, cwd, json }: HandlerContext): Promise<void> {
   const configDir = mkdtempSync(join(tmpdir(), 'orca-account-add-claude-'))
   const session: InteractiveLoginSession = {
     child: null,
@@ -225,6 +226,7 @@ async function addClaudeAccount({ client, json }: HandlerContext): Promise<void>
       session.registering = true
       return client.call<ClaudeRateLimitAccountsState>('accounts.addClaudeFromConfigDir', {
         configDir,
+        ...getWslAccountTarget(cwd),
         ...(process.platform === 'darwin'
           ? {
               previousLegacyCredentialsSha256: legacyCredentials
@@ -239,7 +241,7 @@ async function addClaudeAccount({ client, json }: HandlerContext): Promise<void>
 }
 
 /** Logs into a Codex account in a temp CODEX_HOME, then registers it with the local runtime. */
-async function addCodexAccount({ client, json }: HandlerContext): Promise<void> {
+async function addCodexAccount({ client, cwd, json }: HandlerContext): Promise<void> {
   const codexHome = mkdtempSync(join(tmpdir(), 'orca-account-add-codex-'))
   const session: InteractiveLoginSession = {
     child: null,
@@ -263,7 +265,8 @@ async function addCodexAccount({ client, json }: HandlerContext): Promise<void>
       )
       session.registering = true
       return client.call<CodexRateLimitAccountsState>('accounts.addCodexFromHome', {
-        sourceHome: codexHome
+        sourceHome: codexHome,
+        ...getWslAccountTarget(cwd)
       })
     }
   )
diff --git a/src/cli/handlers/agent-hooks-load-boundary.test.ts b/src/cli/handlers/agent-hooks-load-boundary.test.ts
new file mode 100644
index 000000000000..ff11e2a2d501
--- /dev/null
+++ b/src/cli/handlers/agent-hooks-load-boundary.test.ts
@@ -0,0 +1,42 @@
+import { afterEach, expect, it, vi } from 'vitest'
+import { main } from '../index'
+
+const { prepare } = vi.hoisted(() => ({ prepare: vi.fn() }))
+vi.mock('../runtime-client', () => ({
+  RuntimeClient: class {
+    async call() {
+      return { result: { settings: { agentStatusHooksEnabled: true } } }
+    }
+  },
+  RuntimeClientError: Error,
+  getDefaultUserDataPath: () => '/unused/user-data'
+}))
+vi.mock('../../main/codex/managed-home-shell-preflight', () => ({
+  prepareManagedCodexHomeBeforeShellLaunch: prepare
+}))
+vi.mock('../../main/persistence/profile-state/profile-state-offline-settings', () => {
+  throw new Error('Offline profile settings loaded during online preparation')
+})
+vi.mock('../../main/persistence/profile-state/profile-state-access', () => {
+  throw new Error('Profile admission loaded during online preparation')
+})
+vi.mock('../profile-state-location', () => {
+  throw new Error('Profile location loaded during online preparation')
+})
+
+afterEach(() => {
+  vi.unstubAllEnvs()
+  vi.restoreAllMocks()
+  process.exitCode = undefined
+})
+
+it('prepares Codex through the runtime without loading offline profile storage', async () => {
+  vi.stubEnv('WSL_DISTRO_NAME', '')
+  const error = vi.spyOn(console, 'error').mockImplementation(() => {})
+  await main(['agent', 'hooks', 'prepare-codex'])
+  expect(error).not.toHaveBeenCalled()
+  expect(prepare).toHaveBeenCalledWith({
+    userDataPath: '/unused/user-data',
+    hooksEnabled: true
+  })
+})
diff --git a/src/cli/handlers/agent-hooks.test.ts b/src/cli/handlers/agent-hooks.test.ts
index 279a8900bec9..2d75a096cc4a 100644
--- a/src/cli/handlers/agent-hooks.test.ts
+++ b/src/cli/handlers/agent-hooks.test.ts
@@ -1,9 +1,33 @@
-import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import * as fs from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import {
+  createDefaultLocalOrcaProfile,
+  DEFAULT_LOCAL_ORCA_PROFILE_ID
+} from '../../shared/orca-profiles'
 import { getDefaultPersistedState } from '../../shared/constants'
 import type { PersistedState } from '../../shared/persisted-state-types'
+import {
+  getOrcaProfileDataFile,
+  getOrcaProfileStateDatabaseFile
+} from '../../main/orca-profiles/profile-storage-paths'
+import { openProfileStateDatabase } from '../../main/persistence/profile-state/profile-state-database'
+import * as profileStateDatabase from '../../main/persistence/profile-state/profile-state-database'
+import {
+  exportProfileStateJson,
+  hashProfileStateJson,
+  importProfileStateJson
+} from '../../main/persistence/profile-state/profile-state-documents'
+import { ProfileStateSqliteAuthority } from '../../main/persistence/profile-state/profile-state-sqlite-authority'
+import {
+  acquireProfileStateMaintenance,
+  acquireProfileStateRuntimeAdmission,
+  type ProfileStateRuntimeAdmission
+} from '../../main/persistence/profile-state/profile-state-access'
+
+vi.mock('node:fs', async (original) => ({ ...(await original<typeof fs>()) }))
 
 const {
   applyAgentStatusHooksEnabledMock,
@@ -65,8 +89,16 @@ vi.mock('../../main/codex/managed-home-shell-preflight', () => ({
 
 import { main } from '../index'
 
-function readDataFile(userDataPath: string): PersistedState {
-  return JSON.parse(readFileSync(join(userDataPath, 'orca-data.json'), 'utf-8')) as PersistedState
+function readDefaultProfileState(userDataPath: string) {
+  const opened = openProfileStateDatabase(
+    getOrcaProfileStateDatabaseFile(DEFAULT_LOCAL_ORCA_PROFILE_ID, userDataPath),
+    DEFAULT_LOCAL_ORCA_PROFILE_ID
+  )
+  try {
+    return JSON.parse(exportProfileStateJson(opened.db))
+  } finally {
+    opened.db.close()
+  }
 }
 
 function writeDataFile(userDataPath: string, state: PersistedState): void {
@@ -74,6 +106,17 @@ function writeDataFile(userDataPath: string, state: PersistedState): void {
   writeFileSync(join(userDataPath, 'orca-data.json'), JSON.stringify(state, null, 2), 'utf-8')
 }
 
+function writeActiveProfileIndex(userDataPath: string, profileId: string): void {
+  writeFileSync(
+    join(userDataPath, 'orca-profile-index.json'),
+    JSON.stringify({
+      activeProfileId: profileId,
+      profiles: [{ ...createDefaultLocalOrcaProfile(1), id: profileId }]
+    }),
+    'utf-8'
+  )
+}
+
 async function runAgentHooksOff(userDataPath: string): Promise<void> {
   getDefaultUserDataPathMock.mockReturnValue(userDataPath)
   await main(['agent', 'hooks', 'off', '--json'], userDataPath)
@@ -84,7 +127,7 @@ describe('agent hooks CLI handler', () => {
 
   beforeEach(() => {
     userDataPath = mkdtempSync(join(tmpdir(), 'orca-agent-hooks-cli-'))
-    applyAgentStatusHooksEnabledMock.mockReturnValue([])
+    applyAgentStatusHooksEnabledMock.mockReset().mockReturnValue([])
     callMock.mockReset()
     getCliStatusMock.mockClear()
     getManagedAgentHookStatusesMock.mockReturnValue([])
@@ -103,12 +146,249 @@ describe('agent hooks CLI handler', () => {
   it('keeps new card style off when creating offline settings for a fresh profile', async () => {
     await runAgentHooksOff(userDataPath)
 
-    const persisted = readDataFile(userDataPath)
+    const persisted = readDefaultProfileState(userDataPath)
 
     expect(persisted.settings.experimentalNewWorktreeCardStyle).toBe(false)
     expect(persisted.settings.agentStatusHooksEnabled).toBe(false)
+    expect(existsSync(join(userDataPath, 'orca-data.json'))).toBe(false)
+    expect(existsSync(getOrcaProfileDataFile(DEFAULT_LOCAL_ORCA_PROFILE_ID, userDataPath))).toBe(
+      false
+    )
   })
 
+  it.each(['fresh', 'root-json', 'profile-json'] as const)(
+    'refuses an incapable offline writer before any %s profile or hook changes',
+    async (source) => {
+      const profileId = 'unsupported-runtime'
+      const state = getDefaultPersistedState(userDataPath)
+      const directory =
+        source === 'profile-json' ? join(userDataPath, 'profiles', profileId) : userDataPath
+      if (source !== 'fresh') {
+        writeDataFile(directory, state)
+      }
+      if (source === 'profile-json') {
+        writeActiveProfileIndex(userDataPath, profileId)
+      }
+      vi.spyOn(profileStateDatabase, 'isProfileStateSqliteAvailable').mockReturnValue(false)
+
+      await runAgentHooksOff(userDataPath)
+
+      expect(process.exitCode).toBe(1)
+      expect(applyAgentStatusHooksEnabledMock).not.toHaveBeenCalled()
+      expect(existsSync(join(userDataPath, '.profile-state-access'))).toBe(false)
+      expect(existsSync(getOrcaProfileStateDatabaseFile(profileId, userDataPath))).toBe(false)
+      expect(
+        existsSync(getOrcaProfileStateDatabaseFile(DEFAULT_LOCAL_ORCA_PROFILE_ID, userDataPath))
+      ).toBe(false)
+      if (source !== 'fresh') {
+        expect(JSON.parse(readFileSync(join(directory, 'orca-data.json'), 'utf8'))).toEqual(state)
+      }
+      if (source !== 'profile-json') {
+        expect(existsSync(join(userDataPath, 'orca-profile-index.json'))).toBe(false)
+      }
+      expect(console.log).toHaveBeenCalledWith(expect.stringContaining('bundled Orca CLI'))
+    }
+  )
+
+  it('keeps runtime writes available to an incapable CLI', async () => {
+    vi.spyOn(profileStateDatabase, 'isProfileStateSqliteAvailable').mockReturnValue(false)
+    getCliStatusMock.mockResolvedValueOnce({
+      id: 'test-status',
+      ok: true,
+      result: {
+        app: { running: true, pid: null },
+        runtime: { state: 'ready', reachable: true, runtimeId: null },
+        graph: { state: 'ready' }
+      },
+      _meta: { runtimeId: 'test' }
+    })
+    callMock.mockResolvedValueOnce({ result: {} })
+
+    await runAgentHooksOff(userDataPath)
+
+    expect(process.exitCode).not.toBe(1)
+    expect(callMock).toHaveBeenCalledWith(
+      'settings.update',
+      { agentStatusHooksEnabled: false },
+      { timeoutMs: 10_000 }
+    )
+    expect(applyAgentStatusHooksEnabledMock).not.toHaveBeenCalled()
+    expect(existsSync(join(userDataPath, '.profile-state-access'))).toBe(false)
+    expect(existsSync(join(userDataPath, 'orca-profile-index.json'))).toBe(false)
+  })
+
+  it.each(['root', 'indexed'] as const)(
+    'reads %s JSON status without SQLite or migration',
+    async (source) => {
+      const profileId = 'read-only'
+      const directory =
+        source === 'indexed' ? join(userDataPath, 'profiles', profileId) : userDataPath
+      writeDataFile(directory, getDefaultPersistedState(userDataPath))
+      if (source === 'indexed') {
+        writeActiveProfileIndex(userDataPath, profileId)
+      }
+      getDefaultUserDataPathMock.mockReturnValue(userDataPath)
+      vi.spyOn(profileStateDatabase, 'isProfileStateSqliteAvailable').mockReturnValue(false)
+      const original = readFileSync(join(directory, 'orca-data.json'), 'utf8')
+
+      await main(['agent', 'hooks', 'status', '--json'], userDataPath)
+
+      expect(process.exitCode).not.toBe(1)
+      expect(readFileSync(join(directory, 'orca-data.json'), 'utf8')).toBe(original)
+      expect(existsSync(join(directory, 'profile-state.db'))).toBe(false)
+      expect(applyAgentStatusHooksEnabledMock).not.toHaveBeenCalled()
+    }
+  )
+
+  it.each(['missing', 'corrupt'] as const)(
+    'uses the backup index when the primary is %s',
+    async (primary) => {
+      const profileId = 'backup-selected'
+      const indexPath = join(userDataPath, 'orca-profile-index.json')
+      writeActiveProfileIndex(userDataPath, profileId)
+      fs.renameSync(indexPath, `${indexPath}.bak`)
+      if (primary === 'corrupt') {
+        writeFileSync(indexPath, '{broken')
+      }
+      writeDataFile(
+        join(userDataPath, 'profiles', profileId),
+        getDefaultPersistedState(userDataPath)
+      )
+
+      await runAgentHooksOff(userDataPath)
+
+      expect(process.exitCode).not.toBe(1)
+      expect(existsSync(getOrcaProfileStateDatabaseFile(profileId, userDataPath))).toBe(true)
+      expect(
+        existsSync(getOrcaProfileStateDatabaseFile(DEFAULT_LOCAL_ORCA_PROFILE_ID, userDataPath))
+      ).toBe(false)
+      const { ensureActiveOrcaProfile } =
+        await import('../../main/orca-profiles/profile-index-store.js')
+      expect(ensureActiveOrcaProfile(userDataPath).profile.id).toBe(profileId)
+    }
+  )
+
+  it.each([0, 1, 2, 3, 4])('refuses a pre-index root with only legacy backup %s', async (slot) => {
+    const backup = join(userDataPath, `orca-data.json.bak.${slot}`)
+    const source = '{"settings":{"agentStatusHooksEnabled":true}}'
+    writeFileSync(backup, source)
+
+    await runAgentHooksOff(userDataPath)
+
+    expect(process.exitCode).toBe(1)
+    expect(readFileSync(backup, 'utf8')).toBe(source)
+    expect(existsSync(join(userDataPath, 'orca-profile-index.json'))).toBe(false)
+    expect(existsSync(join(userDataPath, 'profiles'))).toBe(false)
+    expect(applyAgentStatusHooksEnabledMock).not.toHaveBeenCalled()
+  })
+
+  it.each(['root-json', 'profile-json', 'sqlite'] as const)(
+    'refuses offline %s mutation when startup wins after the stopped-status response',
+    async (backend) => {
+      const profileId = 'startup-race'
+      const directory =
+        backend === 'root-json' ? userDataPath : join(userDataPath, 'profiles', profileId)
+      mkdirSync(directory, { recursive: true })
+      const dataFile = join(directory, 'orca-data.json')
+      const raw = JSON.stringify({
+        settings: { agentStatusHooksEnabled: true },
+        unknown: { retained: null }
+      })
+      writeFileSync(dataFile, raw)
+      if (backend !== 'root-json') {
+        writeActiveProfileIndex(userDataPath, profileId)
+      }
+      const databaseFile = join(directory, 'profile-state.db')
+      if (backend === 'sqlite') {
+        const opened = openProfileStateDatabase(databaseFile, profileId)
+        try {
+          importProfileStateJson(opened.db, raw, {
+            acceptedLegacyJsonHash: hashProfileStateJson(raw)
+          })
+        } finally {
+          opened.db.close()
+        }
+      }
+      const stopped = await getCliStatusMock()
+      let runtime: ProfileStateRuntimeAdmission | undefined
+      getCliStatusMock.mockImplementationOnce(async () => {
+        runtime = acquireProfileStateRuntimeAdmission(userDataPath)
+        return stopped
+      })
+      try {
+        await runAgentHooksOff(userDataPath)
+        expect(process.exitCode).toBe(1)
+        expect(applyAgentStatusHooksEnabledMock).not.toHaveBeenCalled()
+        expect(readFileSync(dataFile, 'utf8')).toBe(raw)
+        if (backend === 'sqlite') {
+          const opened = openProfileStateDatabase(databaseFile, profileId)
+          try {
+            expect(JSON.parse(exportProfileStateJson(opened.db))).toEqual(JSON.parse(raw))
+          } finally {
+            opened.db.close()
+          }
+        }
+      } finally {
+        runtime?.release()
+      }
+      process.exitCode = undefined
+      await runAgentHooksOff(userDataPath)
+      expect(process.exitCode).not.toBe(1)
+      expect(applyAgentStatusHooksEnabledMock).toHaveBeenCalledOnce()
+    }
+  )
+
+  it.each(['root-json', 'profile-json'] as const)(
+    'excludes startup and other offline writers through %s publication',
+    async (backend) => {
+      const profileId = 'offline-first'
+      const directory =
+        backend === 'root-json' ? userDataPath : join(userDataPath, 'profiles', profileId)
+      mkdirSync(directory, { recursive: true })
+      if (backend === 'profile-json') {
+        writeActiveProfileIndex(userDataPath, profileId)
+      }
+      const dataFile = join(directory, 'orca-data.json')
+      writeFileSync(dataFile, JSON.stringify({ settings: { agentStatusHooksEnabled: true } }))
+      const databaseFile = getOrcaProfileStateDatabaseFile(
+        backend === 'root-json' ? DEFAULT_LOCAL_ORCA_PROFILE_ID : profileId,
+        userDataPath
+      )
+      const link = fs.linkSync
+      let checkedPublication = false
+      vi.spyOn(fs, 'linkSync').mockImplementation((source, target) => {
+        if (target === databaseFile) {
+          checkedPublication = true
+          expect(() => acquireProfileStateRuntimeAdmission(userDataPath)).toThrow()
+          expect(() => acquireProfileStateMaintenance(userDataPath)).toThrow()
+        }
+        return link(source, target)
+      })
+      await runAgentHooksOff(userDataPath)
+      expect(checkedPublication).toBe(true)
+      expect(process.exitCode).not.toBe(1)
+      const runtime = acquireProfileStateRuntimeAdmission(userDataPath)
+      try {
+        const opened = openProfileStateDatabase(
+          databaseFile,
+          backend === 'root-json' ? DEFAULT_LOCAL_ORCA_PROFILE_ID : profileId
+        )
+        try {
+          expect(
+            JSON.parse(exportProfileStateJson(opened.db)).settings.agentStatusHooksEnabled
+          ).toBe(false)
+        } finally {
+          opened.db.close()
+        }
+        expect(JSON.parse(readFileSync(dataFile, 'utf8')).settings.agentStatusHooksEnabled).toBe(
+          true
+        )
+      } finally {
+        runtime.release()
+      }
+    }
+  )
+
   it('keeps missing new card style off when updating offline settings', async () => {
     const existing = getDefaultPersistedState(userDataPath)
     delete existing.settings.experimentalNewWorktreeCardStyle
@@ -116,7 +396,9 @@ describe('agent hooks CLI handler', () => {
 
     await runAgentHooksOff(userDataPath)
 
-    expect(readDataFile(userDataPath).settings.experimentalNewWorktreeCardStyle).toBe(false)
+    expect(readDefaultProfileState(userDataPath).settings.experimentalNewWorktreeCardStyle).toBe(
+      false
+    )
   })
 
   it('preserves an existing explicit new card style opt-in when updating offline settings', async () => {
@@ -126,9 +408,36 @@ describe('agent hooks CLI handler', () => {
 
     await runAgentHooksOff(userDataPath)
 
-    expect(readDataFile(userDataPath).settings.experimentalNewWorktreeCardStyle).toBe(true)
+    expect(readDefaultProfileState(userDataPath).settings.experimentalNewWorktreeCardStyle).toBe(
+      true
+    )
   })
 
+  it.each(['on', 'off', 'status', 'prepare-codex'])(
+    'refuses explicit remote selection before local hook command %s',
+    async (command) => {
+      const state = getDefaultPersistedState(userDataPath)
+      writeDataFile(userDataPath, state)
+      const before = readFileSync(join(userDataPath, 'orca-data.json'), 'utf8')
+      getDefaultUserDataPathMock.mockReturnValue(userDataPath)
+
+      for (const selector of ['environment', 'pairing-code']) {
+        process.exitCode = undefined
+        await main(
+          ['agent', 'hooks', command, `--${selector}`, 'unreachable-host', '--json'],
+          userDataPath
+        )
+
+        expect(process.exitCode).toBe(1)
+        expect(getCliStatusMock).not.toHaveBeenCalled()
+        expect(callMock).not.toHaveBeenCalled()
+        expect(applyAgentStatusHooksEnabledMock).not.toHaveBeenCalled()
+        expect(prepareManagedCodexHomeBeforeShellLaunchMock).not.toHaveBeenCalled()
+        expect(readFileSync(join(userDataPath, 'orca-data.json'), 'utf8')).toBe(before)
+      }
+    }
+  )
+
   it('prepares managed Codex trust with the current hooks setting', async () => {
     const state = getDefaultPersistedState(userDataPath)
     state.settings.agentStatusHooksEnabled = false
@@ -231,4 +540,157 @@ describe('agent hooks CLI handler', () => {
       timeoutMs: 1_000
     })
   })
+
+  it('updates an established SQLite profile without rewriting its JSON export', async () => {
+    const profileId = 'work-profile'
+    const profileDirectory = join(userDataPath, 'profiles', profileId)
+    const dataFile = getOrcaProfileDataFile(profileId, userDataPath)
+    const databaseFile = getOrcaProfileStateDatabaseFile(profileId, userDataPath)
+    const raw = JSON.stringify({
+      settings: {
+        agentStatusHooksEnabled: true,
+        disabledTuiAgents: ['codex'],
+        opencodeSessionCookie: 'encrypted-ciphertext'
+      },
+      unknownDomain: { preserved: true }
+    })
+    mkdirSync(profileDirectory, { recursive: true })
+    writeFileSync(dataFile, raw, 'utf-8')
+    writeActiveProfileIndex(userDataPath, profileId)
+    const opened = openProfileStateDatabase(databaseFile, profileId)
+    try {
+      importProfileStateJson(opened.db, raw, {
+        acceptedLegacyJsonHash: hashProfileStateJson(raw)
+      })
+    } finally {
+      opened.db.close()
+    }
+
+    await runAgentHooksOff(userDataPath)
+
+    expect(readFileSync(dataFile, 'utf-8')).toBe(raw)
+    const readBack = openProfileStateDatabase(databaseFile, profileId)
+    try {
+      expect(JSON.parse(exportProfileStateJson(readBack.db))).toMatchObject({
+        settings: {
+          agentStatusHooksEnabled: false,
+          opencodeSessionCookie: 'encrypted-ciphertext',
+          disabledTuiAgents: ['codex']
+        },
+        unknownDomain: { preserved: true }
+      })
+    } finally {
+      readBack.db.close()
+    }
+  })
+
+  it.each(['update-failed', 'unreachable', 'status-failed'] as const)(
+    'preserves a live SQLite writer when runtime contact is %s',
+    async (failure) => {
+      const profileId = 'live-profile'
+      const profileDirectory = join(userDataPath, 'profiles', profileId)
+      mkdirSync(profileDirectory, { recursive: true })
+      writeActiveProfileIndex(userDataPath, profileId)
+      const authority = new ProfileStateSqliteAuthority(
+        getOrcaProfileStateDatabaseFile(profileId, userDataPath),
+        profileId
+      )
+      authority.writeSerializedState(
+        Buffer.from(JSON.stringify({ settings: { agentStatusHooksEnabled: true } }))
+      )
+      if (failure === 'status-failed') {
+        getCliStatusMock.mockRejectedValueOnce(new Error('status transport unavailable'))
+      } else {
+        getCliStatusMock.mockResolvedValueOnce({
+          id: 'test-status',
+          ok: true,
+          result: {
+            app: { running: true, pid: null },
+            runtime: {
+              state: failure === 'unreachable' ? 'starting' : 'ready',
+              reachable: failure !== 'unreachable',
+              runtimeId: null
+            },
+            graph: { state: 'ready' }
+          },
+          _meta: { runtimeId: 'test' }
+        })
+        callMock.mockRejectedValueOnce(new Error('settings request timed out'))
+      }
+      try {
+        await runAgentHooksOff(userDataPath)
+
+        expect(process.exitCode).toBe(1)
+        expect(applyAgentStatusHooksEnabledMock).not.toHaveBeenCalled()
+        expect(() =>
+          authority.writeSerializedDomains([
+            { domain: 'ui', payload: '{"marker":"still-writable"}' }
+          ])
+        ).not.toThrow()
+        const persisted = JSON.parse(authority.readSerializedState() ?? '{}')
+        expect(persisted).toMatchObject({
+          settings: { agentStatusHooksEnabled: true },
+          ui: { marker: 'still-writable' }
+        })
+      } finally {
+        authority.close()
+      }
+    }
+  )
+
+  it('imports a JSON-only active profile before the first settings mutation', async () => {
+    const profileId = 'json-profile'
+    const profileDirectory = join(userDataPath, 'profiles', profileId)
+    mkdirSync(profileDirectory, { recursive: true })
+    writeDataFile(profileDirectory, getDefaultPersistedState(userDataPath))
+    writeActiveProfileIndex(userDataPath, profileId)
+
+    await runAgentHooksOff(userDataPath)
+
+    expect(existsSync(getOrcaProfileStateDatabaseFile(profileId, userDataPath))).toBe(true)
+    expect(
+      JSON.parse(readFileSync(getOrcaProfileDataFile(profileId, userDataPath), 'utf-8')).settings
+        .agentStatusHooksEnabled
+    ).toBe(true)
+    const opened = openProfileStateDatabase(
+      getOrcaProfileStateDatabaseFile(profileId, userDataPath),
+      profileId
+    )
+    try {
+      expect(JSON.parse(exportProfileStateJson(opened.db)).settings.agentStatusHooksEnabled).toBe(
+        false
+      )
+    } finally {
+      opened.db.close()
+    }
+  })
+
+  it('fails closed when a profile has corrupt SQLite alongside legacy JSON', async () => {
+    const profileId = 'corrupt-profile'
+    const profileDirectory = join(userDataPath, 'profiles', profileId)
+    mkdirSync(profileDirectory, { recursive: true })
+    const state = getDefaultPersistedState(userDataPath)
+    writeDataFile(profileDirectory, state)
+    writeActiveProfileIndex(userDataPath, profileId)
+    const databaseFile = getOrcaProfileStateDatabaseFile(profileId, userDataPath)
+    writeFileSync(databaseFile, 'not sqlite', 'utf-8')
+    const before = readFileSync(getOrcaProfileDataFile(profileId, userDataPath), 'utf-8')
+
+    await runAgentHooksOff(userDataPath)
+
+    expect(process.exitCode).toBe(1)
+    expect(readFileSync(getOrcaProfileDataFile(profileId, userDataPath), 'utf-8')).toBe(before)
+  })
+
+  it('fails closed when a profile index is present but unreadable', async () => {
+    const legacy = getDefaultPersistedState(userDataPath)
+    writeDataFile(userDataPath, legacy)
+    writeFileSync(join(userDataPath, 'orca-profile-index.json'), '{ torn', 'utf-8')
+    const before = readFileSync(join(userDataPath, 'orca-data.json'), 'utf-8')
+
+    await runAgentHooksOff(userDataPath)
+
+    expect(process.exitCode).toBe(1)
+    expect(readFileSync(join(userDataPath, 'orca-data.json'), 'utf-8')).toBe(before)
+  })
 })
diff --git a/src/cli/handlers/agent-hooks.ts b/src/cli/handlers/agent-hooks.ts
index 4fcfe64f9b7d..74b4596accb4 100644
--- a/src/cli/handlers/agent-hooks.ts
+++ b/src/cli/handlers/agent-hooks.ts
@@ -1,9 +1,7 @@
-import { existsSync, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from 'node:fs'
-import { homedir } from 'node:os'
-import { dirname, join } from 'node:path'
-import { randomUUID } from 'node:crypto'
+import { join } from 'node:path'
 import type { CommandHandler } from '../dispatch'
 import { printResult } from '../format'
+import { rejectRemoteSelectionFlags } from '../remote-selection-flag-rejection'
 import {
   RuntimeClientError,
   type RuntimeClient,
@@ -11,11 +9,11 @@ import {
   getDefaultUserDataPath
 } from '../runtime-client'
 import type { AgentHookInstallStatus } from '../../shared/agent-hook-types'
-import { getDefaultPersistedState } from '../../shared/constants'
+import { DEFAULT_LOCAL_ORCA_PROFILE_ID } from '../../shared/orca-profiles'
 import { normalizeDisabledTuiAgents } from '../../shared/tui-agent-selection'
 import type { GlobalSettings } from '../../shared/global-settings-types'
-import type { PersistedState } from '../../shared/persisted-state-types'
 import { prepareManagedCodexHomeBeforeShellLaunch } from '../../main/codex/managed-home-shell-preflight'
+import type { ProfileStateOfflineLocation } from '../../main/persistence/profile-state/profile-state-offline-settings'
 
 type AgentHookCommandResult = {
   enabled: boolean
@@ -27,80 +25,47 @@ type AgentHookCommandResult = {
 // Covers managed-home verification, WSL identity, trust grant, and bounded app-server reap.
 const WSL_CODEX_PREPARE_TIMEOUT_MS = 50_000
 
-function getDataPath(): string {
-  const userDataPath = getDefaultUserDataPath()
-  const indexPath = join(userDataPath, 'orca-profile-index.json')
-  for (const candidate of [indexPath, `${indexPath}.bak`]) {
-    try {
-      const parsed: unknown = JSON.parse(readFileSync(candidate, 'utf-8'))
-      if (!isRecord(parsed) || !Array.isArray(parsed.profiles)) {
-        continue
-      }
-      const profileId = parsed.activeProfileId
-      if (
-        typeof profileId === 'string' &&
-        /^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/.test(profileId) &&
-        parsed.profiles.some((profile) => isRecord(profile) && profile.id === profileId)
-      ) {
-        return join(userDataPath, 'profiles', profileId, 'orca-data.json')
-      }
-    } catch {
-      // Try the profile-index backup, then the legacy pre-profile path.
-    }
-  }
-  return join(userDataPath, 'orca-data.json')
+async function getDataPath(): Promise<string> {
+  return (
+    (await getProfileStateLocation())?.dataFile ?? join(getDefaultUserDataPath(), 'orca-data.json')
+  )
 }
 
-function isRecord(value: unknown): value is Record<string, unknown> {
-  return typeof value === 'object' && value !== null && !Array.isArray(value)
+async function getProfileStateLocation(): Promise<ProfileStateOfflineLocation | undefined> {
+  const { getActiveProfileStateLocation } = await import('../profile-state-location.js')
+  return getActiveProfileStateLocation()
 }
 
-function readPersistedState(dataPath: string): PersistedState {
-  if (!existsSync(dataPath)) {
-    return getDefaultPersistedState(homedir())
-  }
-  try {
-    const parsed = JSON.parse(readFileSync(dataPath, 'utf-8'))
-    if (!isRecord(parsed)) {
-      throw new Error('file does not contain a JSON object')
-    }
-    return parsed as PersistedState
-  } catch (error) {
-    throw new RuntimeClientError(
-      'runtime_error',
-      `Could not read ${dataPath}: ${error instanceof Error ? error.message : String(error)}`
-    )
+function legacyProfileStateLocation(): ProfileStateOfflineLocation {
+  const userDataPath = getDefaultUserDataPath()
+  return {
+    dataFile: join(userDataPath, 'orca-data.json'),
+    databaseFile: join(userDataPath, 'profile-state.db'),
+    profileId: DEFAULT_LOCAL_ORCA_PROFILE_ID
   }
 }
 
-function writePersistedState(dataPath: string, state: PersistedState): void {
-  mkdirSync(dirname(dataPath), { recursive: true })
-  const tmpPath = join(dirname(dataPath), `.${Date.now()}-${randomUUID()}.tmp`)
-  let renamed = false
+async function readHookSettingsFromDisk(): Promise<
+  Pick<GlobalSettings, 'agentStatusHooksEnabled' | 'disabledTuiAgents'>
+> {
+  const { acquireProfileStateRuntimeAdmission } =
+    await import('../../main/persistence/profile-state/profile-state-access.js')
+  const admission = acquireProfileStateRuntimeAdmission(getDefaultUserDataPath())
   try {
-    writeFileSync(tmpPath, `${JSON.stringify(state, null, 2)}\n`, 'utf-8')
-    renameSync(tmpPath, dataPath)
-    renamed = true
+    return await readAdmittedHookSettingsFromDisk()
   } finally {
-    if (!renamed && existsSync(tmpPath)) {
-      try {
-        unlinkSync(tmpPath)
-      } catch {
-        // best effort
-      }
-    }
+    admission.release()
   }
 }
 
-function readHookSettingsFromDisk(): Pick<
-  GlobalSettings,
-  'agentStatusHooksEnabled' | 'disabledTuiAgents'
+async function readAdmittedHookSettingsFromDisk(): Promise<
+  Pick<GlobalSettings, 'agentStatusHooksEnabled' | 'disabledTuiAgents'>
 > {
-  const state = readPersistedState(getDataPath())
-  return {
-    agentStatusHooksEnabled: state.settings?.agentStatusHooksEnabled !== false,
-    disabledTuiAgents: normalizeDisabledTuiAgents(state.settings?.disabledTuiAgents)
-  }
+  const { readAgentHookSettingsFromProfileState } =
+    await import('../../main/persistence/profile-state/profile-state-offline-settings.js')
+  return readAgentHookSettingsFromProfileState(
+    (await getProfileStateLocation()) ?? legacyProfileStateLocation()
+  )
 }
 
 async function readHookSettings(
@@ -123,42 +88,66 @@ async function readHookSettings(
   return readHookSettingsFromDisk()
 }
 
-function updateEnabledOnDisk(enabled: boolean): {
+async function updateEnabledOnDisk(enabled: boolean): Promise<{
   settingsPath: string
   settings: Pick<GlobalSettings, 'agentCmdOverrides' | 'disabledTuiAgents'>
-} {
-  const dataPath = getDataPath()
-  const state = readPersistedState(dataPath)
-  state.settings = {
-    ...getDefaultPersistedState(homedir()).settings,
-    ...state.settings,
-    agentStatusHooksEnabled: enabled
+}> {
+  const { assertOfflineProfileStateMutationRuntime } =
+    await import('../../main/persistence/profile-state/profile-state-offline-settings.js')
+  assertOfflineProfileStateMutationRuntime()
+  const { acquireProfileStateMaintenance } =
+    await import('../../main/persistence/profile-state/profile-state-access.js')
+  // A stopped-status response cannot exclude startup racing the first import.
+  const maintenance = acquireProfileStateMaintenance(getDefaultUserDataPath())
+  try {
+    return await updateAdmittedEnabledOnDisk(enabled)
+  } finally {
+    maintenance.release()
   }
-  writePersistedState(dataPath, state)
-  return {
-    settingsPath: dataPath,
-    settings: {
-      agentCmdOverrides: state.settings.agentCmdOverrides ?? {},
-      disabledTuiAgents: state.settings.disabledTuiAgents ?? []
+}
+
+async function updateAdmittedEnabledOnDisk(enabled: boolean): Promise<{
+  settingsPath: string
+  settings: Pick<GlobalSettings, 'agentCmdOverrides' | 'disabledTuiAgents'>
+}> {
+  const { updateAgentHookSettingsFromProfileState, readAgentHookSettingsFromProfileState } =
+    await import('../../main/persistence/profile-state/profile-state-offline-settings.js')
+  let location = await getProfileStateLocation()
+  if (!location) {
+    const legacy = legacyProfileStateLocation()
+    const { classifyProfileStateStorage } =
+      await import('../../main/persistence/profile-state/profile-state-storage-classification.js')
+    const storage = classifyProfileStateStorage(legacy.dataFile, legacy.databaseFile)
+    if (storage !== 'json-only' && storage !== 'neither') {
+      throw new RuntimeClientError('runtime_error', 'Profile state has no active profile index.')
+    }
+    // Validate retained recovery evidence and source bytes before creating the index.
+    readAgentHookSettingsFromProfileState(legacy)
+    const { ensureActiveOrcaProfile } =
+      await import('../../main/orca-profiles/profile-index-store.js')
+    const profile = ensureActiveOrcaProfile(getDefaultUserDataPath())
+    location = {
+      dataFile: profile.dataFile,
+      databaseFile: profile.stateDatabaseFile,
+      profileId: profile.profile.id
     }
   }
+  return updateAgentHookSettingsFromProfileState(location, enabled)
 }
 
 async function updateRunningRuntime(client: RuntimeClient, enabled: boolean): Promise<boolean> {
-  try {
-    const status = await client.getCliStatus()
-    if (!status.result.runtime.reachable) {
-      return false
+  const status = await client.getCliStatus()
+  if (!status.result.runtime.reachable) {
+    if (status.result.app.running) {
+      throw new RuntimeClientError(
+        'runtime_error',
+        'Orca is running but unavailable. Retry when it responds, or stop Orca before changing agent hooks offline.'
+      )
     }
-    await client.call(
-      'settings.update',
-      { agentStatusHooksEnabled: enabled },
-      { timeoutMs: 10_000 }
-    )
-    return true
-  } catch {
     return false
   }
+  await client.call('settings.update', { agentStatusHooksEnabled: enabled }, { timeoutMs: 10_000 })
+  return true
 }
 
 function localSuccess<TResult>(result: TResult): RuntimeRpcSuccess<TResult> {
@@ -193,8 +182,8 @@ async function setAgentHooksEnabled(
   const { applyAgentStatusHooksEnabled, getManagedAgentHookStatuses } =
     await import('../../main/agent-hooks/managed-agent-hook-controls.js')
   const updatedRuntime = await updateRunningRuntime(client, enabled)
-  const offlineUpdate = updatedRuntime ? null : updateEnabledOnDisk(enabled)
-  const settingsPath = offlineUpdate?.settingsPath ?? getDataPath()
+  const offlineUpdate = updatedRuntime ? null : await updateEnabledOnDisk(enabled)
+  const settingsPath = offlineUpdate?.settingsPath ?? (await getDataPath())
   const statuses = updatedRuntime
     ? getManagedAgentHookStatuses()
     : await applyAgentStatusHooksEnabled(enabled, offlineUpdate?.settings)
@@ -207,7 +196,8 @@ async function setAgentHooksEnabled(
 }
 
 export const AGENT_HOOK_HANDLERS: Record<string, CommandHandler> = {
-  'agent hooks prepare-codex': async ({ client }) => {
+  'agent hooks prepare-codex': async ({ client, flags }) => {
+    rejectRemoteHookSelection(flags)
     if (process.env.WSL_DISTRO_NAME?.trim()) {
       try {
         await client.call(
@@ -231,23 +221,33 @@ export const AGENT_HOOK_HANDLERS: Record<string, CommandHandler> = {
         settings.agentStatusHooksEnabled && !settings.disabledTuiAgents.includes('codex')
     })
   },
-  'agent hooks status': async ({ json }) => {
+  'agent hooks status': async ({ json, flags }) => {
+    rejectRemoteHookSelection(flags)
     const { getManagedAgentHookStatuses } =
       await import('../../main/agent-hooks/managed-agent-hook-controls.js')
     const result: AgentHookCommandResult = {
-      enabled: readHookSettingsFromDisk().agentStatusHooksEnabled,
-      settingsPath: getDataPath(),
+      enabled: (await readHookSettingsFromDisk()).agentStatusHooksEnabled,
+      settingsPath: await getDataPath(),
       appliedBy: 'offline',
       statuses: getManagedAgentHookStatuses()
     }
     printResult(localSuccess(result), json, formatAgentHookCommandResult)
   },
-  'agent hooks off': async ({ client, json }) => {
+  'agent hooks off': async ({ client, json, flags }) => {
+    rejectRemoteHookSelection(flags)
     const result = await setAgentHooksEnabled(client, false)
     printResult(localSuccess(result), json, formatAgentHookCommandResult)
   },
-  'agent hooks on': async ({ client, json }) => {
+  'agent hooks on': async ({ client, json, flags }) => {
+    rejectRemoteHookSelection(flags)
     const result = await setAgentHooksEnabled(client, true)
     printResult(localSuccess(result), json, formatAgentHookCommandResult)
   }
 }
+
+function rejectRemoteHookSelection(flags: ReadonlyMap<string, string | boolean>): void {
+  rejectRemoteSelectionFlags(
+    flags,
+    'agent hooks; run this command on the machine whose hooks you want to manage.'
+  )
+}
diff --git a/src/cli/handlers/profile-state-recovery-admission.test.ts b/src/cli/handlers/profile-state-recovery-admission.test.ts
new file mode 100644
index 000000000000..1da200843c96
--- /dev/null
+++ b/src/cli/handlers/profile-state-recovery-admission.test.ts
@@ -0,0 +1,245 @@
+import { mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import * as durableFileWrite from '../../main/durable-file-write'
+import {
+  acquireProfileStateMaintenance,
+  acquireProfileStateRuntimeAdmission
+} from '../../main/persistence/profile-state/profile-state-access'
+import {
+  openProfileStateDatabase,
+  openProfileStateDatabaseReadOnly
+} from '../../main/persistence/profile-state/profile-state-database'
+import {
+  importProfileStateJson,
+  readProfileStateSnapshot
+} from '../../main/persistence/profile-state/profile-state-documents'
+import {
+  createProfileStateDatabaseBackupId,
+  profileStateDatabaseBackupPath
+} from '../../main/persistence/profile-state/profile-state-backup-path'
+import { writeProfileStateDatabaseSnapshotAsync } from '../../main/persistence/profile-state/profile-state-database-snapshot'
+import { restoreProfileStateDatabaseBackup } from '../../main/persistence/profile-state/profile-state-database-recovery'
+import {
+  assertNoRetainedProfileStateExports,
+  ProfileStateRecoveryRequiredError
+} from '../../main/persistence/profile-state/profile-state-recovery-required'
+import { RuntimeClient } from '../runtime-client'
+import { PROFILE_STATE_HANDLERS } from './profile-state'
+
+const mocks = vi.hoisted(() => ({ root: vi.fn(), status: vi.fn() }))
+vi.mock('../runtime-client', () => ({
+  getDefaultUserDataPath: mocks.root,
+  RuntimeClient: class {
+    getCliStatus = mocks.status
+  },
+  RuntimeClientError: class extends Error {
+    constructor(
+      readonly code: string,
+      message: string
+    ) {
+      super(message)
+    }
+  }
+}))
+
+const roots: string[] = []
+const profileId = 'admission-recovery'
+const backupState = {
+  settings: {
+    theme: 'restored',
+    httpProxyUrl: 'sealed:backup',
+    electronHttp1CompatibilityMode: true
+  },
+  extension: { unknown: [null, '\ud800', 'backup'] },
+  opaque: null
+}
+const liveState = {
+  settings: { theme: 'runtime-before-restore', httpProxyUrl: 'sealed:live' },
+  extension: { unknown: [null, '\ud800', 'live'] },
+  opaque: null
+}
+
+beforeEach(() => {
+  mocks.status.mockReset().mockResolvedValue({
+    result: { app: { running: false }, runtime: { reachable: false } }
+  })
+  vi.spyOn(console, 'log').mockImplementation(() => {})
+})
+
+afterEach(() => {
+  vi.restoreAllMocks()
+  for (const root of roots.splice(0)) {
+    rmSync(root, { recursive: true, force: true })
+  }
+})
+
+async function fixture() {
+  const root = mkdtempSync(join(tmpdir(), 'orca-recovery-admission-'))
+  roots.push(root)
+  const directory = join(root, 'profiles', profileId)
+  mkdirSync(directory, { recursive: true })
+  writeFileSync(
+    join(root, 'orca-profile-index.json'),
+    JSON.stringify({ activeProfileId: profileId, profiles: [{ id: profileId }] })
+  )
+  const databasePath = join(directory, 'profile-state.db')
+  const dataFile = join(directory, 'orca-data.json')
+  const backupId = createProfileStateDatabaseBackupId()
+  const backupPath = profileStateDatabaseBackupPath(databasePath, backupId)
+  const source = openProfileStateDatabase(databasePath, profileId)
+  try {
+    importProfileStateJson(source.db, JSON.stringify(backupState))
+    await writeProfileStateDatabaseSnapshotAsync(source.db, backupPath)
+    importProfileStateJson(source.db, JSON.stringify(liveState), { expectedRevision: 1 })
+  } finally {
+    source.db.close()
+  }
+  mocks.root.mockReturnValue(root)
+  return { root, directory, databasePath, dataFile, backupId, backupPath }
+}
+
+function rollback(profile: Awaited<ReturnType<typeof fixture>>): Promise<void> {
+  const handler = PROFILE_STATE_HANDLERS['profile state rollback']
+  if (handler === undefined) {
+    throw new Error('Profile rollback handler is missing')
+  }
+  return handler({
+    flags: new Map([['backup', profile.backupId]]),
+    client: new RuntimeClient(profile.root),
+    cwd: profile.root,
+    json: true
+  })
+}
+
+function state(databasePath: string) {
+  const opened = openProfileStateDatabaseReadOnly(databasePath, profileId)
+  try {
+    return readProfileStateSnapshot(opened.db)
+  } finally {
+    opened.db.close()
+  }
+}
+
+describe('offline recovery excludes runtime admission', () => {
+  it('refuses rollback without changing the database when a move journal is unresolved', async () => {
+    const profile = await fixture()
+    const before = readFileSync(profile.databasePath)
+    const intents = join(profile.root, 'profile-move-intents')
+    mkdirSync(intents)
+    const intentPath = join(intents, '00000000-0000-0000-0000-000000000001.json')
+    writeFileSync(intentPath, '{"partial":true}')
+    await expect(rollback(profile)).rejects.toThrow('pending project move')
+    expect(readFileSync(profile.databasePath)).toEqual(before)
+    expect(readFileSync(intentPath, 'utf8')).toBe('{"partial":true}')
+  })
+
+  it('refuses recovery before any mutation when a runtime has already entered', async () => {
+    const profile = await fixture()
+    const original = readFileSync(profile.databasePath)
+    const backup = readFileSync(profile.backupPath)
+    const admission = acquireProfileStateRuntimeAdmission(profile.root)
+    const runtime = openProfileStateDatabase(profile.databasePath, profileId)
+    try {
+      await expect(rollback(profile)).rejects.toThrow('in use')
+      expect(mocks.status).not.toHaveBeenCalled()
+      expect(JSON.parse(readProfileStateSnapshot(runtime.db).json)).toEqual(liveState)
+      expect(readFileSync(profile.databasePath)).toEqual(original)
+      expect(readFileSync(profile.backupPath)).toEqual(backup)
+      expect(
+        readdirSync(profile.directory).some((name) => name.startsWith('profile-state-corrupt'))
+      ).toBe(false)
+    } finally {
+      runtime.db.close()
+      admission.release()
+    }
+  })
+
+  it('blocks startup between the stopped census and restoration while preserving complete original and restored state', async () => {
+    const profile = await fixture()
+    const original = readFileSync(profile.databasePath)
+    const backup = readFileSync(profile.backupPath)
+    mocks.status.mockImplementation(async () => {
+      const stopped = { result: { app: { running: false }, runtime: { reachable: false } } }
+      expect(() => acquireProfileStateRuntimeAdmission(profile.root)).toThrow('in use')
+      expect(() => acquireProfileStateMaintenance(profile.root)).toThrow('in use')
+      return stopped
+    })
+
+    await rollback(profile)
+
+    expect(mocks.status).toHaveBeenCalledOnce()
+    expect(JSON.parse(state(profile.databasePath).json)).toEqual(backupState)
+    expect(readFileSync(profile.backupPath)).toEqual(backup)
+    const quarantine = readdirSync(profile.directory).find((name) =>
+      name.startsWith('profile-state-corrupt')
+    )
+    expect(quarantine).toBeDefined()
+    if (quarantine === undefined) {
+      throw new Error('Recovery did not preserve a quarantine')
+    }
+    const quarantined = join(profile.directory, quarantine, 'profile-state.db')
+    expect(readFileSync(quarantined)).toEqual(original)
+    expect(JSON.parse(state(quarantined).json)).toEqual(liveState)
+    const admission = acquireProfileStateRuntimeAdmission(profile.root)
+    expect(JSON.parse(state(profile.databasePath).json)).toEqual(backupState)
+    admission.release()
+  })
+
+  it('keeps startup blocked after failed durable publication and permits an explicit successful retry', async () => {
+    const profile = await fixture()
+    const backup = readFileSync(profile.backupPath)
+    const rename = durableFileWrite.renameDurableSync
+    const failure = vi
+      .spyOn(durableFileWrite, 'renameDurableSync')
+      .mockImplementation((from, to) => {
+        if (to === profile.databasePath) {
+          throw new Error('injected recovery publication failure')
+        }
+        rename(from, to)
+      })
+    await expect(rollback(profile)).rejects.toThrow('injected recovery publication failure')
+    const admission = acquireProfileStateRuntimeAdmission(profile.root)
+    try {
+      expect(() =>
+        assertNoRetainedProfileStateExports({
+          dataFile: profile.dataFile,
+          databaseFile: profile.databasePath,
+          profileId
+        })
+      ).toThrow(ProfileStateRecoveryRequiredError)
+    } finally {
+      admission.release()
+    }
+    expect(readFileSync(profile.backupPath)).toEqual(backup)
+    const quarantine = readdirSync(profile.directory).find((name) =>
+      name.startsWith('profile-state-corrupt')
+    )
+    if (quarantine === undefined) {
+      throw new Error('Recovery did not preserve original state')
+    }
+    expect(JSON.parse(state(join(profile.directory, quarantine, 'profile-state.db')).json)).toEqual(
+      liveState
+    )
+
+    failure.mockRestore()
+    await rollback(profile)
+
+    expect(JSON.parse(state(profile.databasePath).json)).toEqual(backupState)
+    acquireProfileStateRuntimeAdmission(profile.root).release()
+  })
+
+  it('rejects fabricated or released maintenance handles before replacing any database bytes', async () => {
+    const profile = await fixture()
+    const maintenance = acquireProfileStateMaintenance(profile.root)
+    const original = readFileSync(profile.databasePath)
+    const options = { ...profile, profileId }
+    expect(() =>
+      restoreProfileStateDatabaseBackup({ ...options, maintenance: { ...maintenance } })
+    ).toThrow('acquired')
+    maintenance.release()
+    expect(() => restoreProfileStateDatabaseBackup({ ...options, maintenance })).toThrow('released')
+    expect(readFileSync(profile.databasePath)).toEqual(original)
+  })
+})
diff --git a/src/cli/handlers/profile-state.test.ts b/src/cli/handlers/profile-state.test.ts
new file mode 100644
index 000000000000..259a55d0368c
--- /dev/null
+++ b/src/cli/handlers/profile-state.test.ts
@@ -0,0 +1,521 @@
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { basename, join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import * as durableFileWrite from '../../main/durable-file-write'
+import * as http1Marker from '../../main/startup/http1-compatibility-marker'
+import { readPersistedHttp1CompatibilityMode } from '../../main/startup/http1-compatibility-profile-state'
+import {
+  openProfileStateDatabase,
+  openProfileStateDatabaseReadOnly,
+  profileStateDatabaseFile
+} from '../../main/persistence/profile-state/profile-state-database'
+import {
+  exportProfileStateJson,
+  importProfileStateJson
+} from '../../main/persistence/profile-state/profile-state-documents'
+import {
+  createProfileStateDatabaseBackupId,
+  profileStateDatabaseBackupPath
+} from '../../main/persistence/profile-state/profile-state-backup-path'
+import { writeProfileStateDatabaseSnapshotAsync } from '../../main/persistence/profile-state/profile-state-database-snapshot'
+import { profileStateJsonExportPath } from '../../main/persistence/profile-state/legacy-json/profile-state-export-path'
+import { main } from '../index'
+
+const { getCliStatusMock, getDefaultUserDataPathMock, runtimeClientConstructorMock } = vi.hoisted(
+  () => ({
+    getCliStatusMock: vi.fn(),
+    getDefaultUserDataPathMock: vi.fn(),
+    runtimeClientConstructorMock: vi.fn()
+  })
+)
+
+vi.mock('../runtime-client', () => {
+  class RuntimeClientError extends Error {
+    readonly code: string
+    readonly data: unknown
+
+    constructor(code: string, message: string, data?: unknown) {
+      super(message)
+      this.code = code
+      this.data = data
+    }
+  }
+
+  class RuntimeClient {
+    getCliStatus = getCliStatusMock
+
+    constructor(
+      _userDataPath?: string,
+      _requestTimeoutMs?: number,
+      remotePairingCode?: string | null,
+      environmentSelector?: string | null
+    ) {
+      runtimeClientConstructorMock(remotePairingCode, environmentSelector)
+    }
+  }
+
+  return {
+    RuntimeClient,
+    RuntimeClientError,
+    getDefaultUserDataPath: getDefaultUserDataPathMock
+  }
+})
+
+const temporaryDirectories: string[] = []
+
+afterEach(() => {
+  for (const directory of temporaryDirectories.splice(0)) {
+    rmSync(directory, { recursive: true, force: true })
+  }
+  vi.restoreAllMocks()
+  runtimeClientConstructorMock.mockReset()
+  process.exitCode = 0
+})
+
+function createProfile(): {
+  userDataPath: string
+  dataFile: string
+  databaseFile: string
+  exportPath: string
+} {
+  const userDataPath = mkdtempSync(join(tmpdir(), 'orca-profile-state-cli-'))
+  temporaryDirectories.push(userDataPath)
+  const profileId = 'profile-cli-recovery'
+  const profileDirectory = join(userDataPath, 'profiles', profileId)
+  mkdirSync(profileDirectory, { recursive: true })
+  writeFileSync(
+    join(userDataPath, 'orca-profile-index.json'),
+    JSON.stringify({ activeProfileId: profileId, profiles: [{ id: profileId }] }),
+    'utf8'
+  )
+  const dataFile = join(profileDirectory, 'orca-data.json')
+  const databaseFile = profileStateDatabaseFile(profileDirectory)
+  const exportPath = profileStateJsonExportPath(dataFile, 1)
+  writeFileSync(dataFile, JSON.stringify({ settings: { theme: 'old' } }), 'utf8')
+  writeFileSync(
+    exportPath,
+    JSON.stringify({ settings: { theme: 'recovered', electronHttp1CompatibilityMode: true } }),
+    'utf8'
+  )
+  writeFileSync(databaseFile, 'damaged sqlite primary', 'utf8')
+  writeFileSync(`${databaseFile}-wal`, 'damaged wal sidecar', 'utf8')
+  return { userDataPath, dataFile, databaseFile, exportPath }
+}
+
+async function createDatabaseBackup(
+  profile: ReturnType<typeof createProfile>,
+  profileId = 'profile-cli-recovery'
+) {
+  const id = createProfileStateDatabaseBackupId()
+  const path = profileStateDatabaseBackupPath(profile.databaseFile, id)
+  const source = openProfileStateDatabase(join(profile.userDataPath, 'backup-source.db'), profileId)
+  try {
+    importProfileStateJson(
+      source.db,
+      JSON.stringify({
+        settings: {
+          theme: 'sqlite-recovered',
+          electronHttp1CompatibilityMode: true,
+          httpProxyUrl: 'sealed:unchanged'
+        },
+        extensionState: { retained: true }
+      })
+    )
+    await writeProfileStateDatabaseSnapshotAsync(source.db, path)
+  } finally {
+    source.db.close()
+  }
+  return { id, path }
+}
+
+describe('profile-state CLI recovery', () => {
+  beforeEach(() => {
+    getCliStatusMock.mockResolvedValue({
+      id: 'status',
+      ok: true,
+      result: {
+        app: { running: false, pid: null },
+        runtime: { state: 'not_running', reachable: false, runtimeId: null },
+        graph: { state: 'not_running' }
+      },
+      _meta: { runtimeId: 'test' }
+    })
+    vi.spyOn(console, 'log').mockImplementation(() => {})
+    vi.spyOn(console, 'error').mockImplementation(() => {})
+  })
+
+  it('restores the selected export through the offline CLI command', async () => {
+    const profile = createProfile()
+    getDefaultUserDataPathMock.mockReturnValue(profile.userDataPath)
+
+    await main(['profile', 'state', 'rollback', '--revision', '1', '--json'], profile.userDataPath)
+
+    expect(existsSync(profile.databaseFile)).toBe(false)
+    expect(readFileSync(profile.dataFile, 'utf8')).toBe(
+      JSON.stringify({ settings: { theme: 'recovered', electronHttp1CompatibilityMode: true } })
+    )
+    expect(
+      JSON.parse(readFileSync(join(profile.userDataPath, 'http1-compatibility.json'), 'utf8'))
+    ).toMatchObject({
+      enabled: true,
+      profileId: 'profile-cli-recovery'
+    })
+    const output = vi.mocked(console.log).mock.calls.at(-1)?.[0]
+    expect(String(output)).toContain('quarantineDirectory')
+    expect(getCliStatusMock).toHaveBeenCalledOnce()
+  })
+
+  it('adopts current JSON through CLI with an honest source description', async () => {
+    const profile = createProfile()
+    getDefaultUserDataPathMock.mockReturnValue(profile.userDataPath)
+    const original = readFileSync(profile.dataFile)
+    await main(['profile', 'state', 'rollback', '--current-json'], profile.userDataPath)
+    expect(readFileSync(profile.dataFile)).toEqual(original)
+    expect(existsSync(profile.databaseFile)).toBe(false)
+    const output = String(vi.mocked(console.log).mock.calls.at(-1)?.[0])
+    expect(output).toContain('source: current JSON')
+    expect(output).not.toContain('revision:')
+  })
+
+  it('keeps current SQLite through CLI and rewrites the diverged JSON', async () => {
+    const profile = createProfile()
+    getDefaultUserDataPathMock.mockReturnValue(profile.userDataPath)
+    rmSync(profile.databaseFile)
+    rmSync(`${profile.databaseFile}-wal`)
+    rmSync(profile.exportPath)
+    const source = openProfileStateDatabase(profile.databaseFile, 'profile-cli-recovery')
+    try {
+      importProfileStateJson(source.db, JSON.stringify({ settings: { theme: 'sqlite' } }))
+    } finally {
+      source.db.close()
+    }
+    writeFileSync(profile.dataFile, JSON.stringify({ settings: { theme: 'older-build' } }))
+    await main(['profile', 'state', 'rollback', '--current-sqlite'], profile.userDataPath)
+    expect(JSON.parse(readFileSync(profile.dataFile, 'utf8'))).toEqual({
+      settings: { theme: 'sqlite' }
+    })
+    expect(String(vi.mocked(console.log).mock.calls.at(-1)?.[0])).toContain(
+      'source: current SQLite'
+    )
+  })
+
+  it('refuses to keep an unreadable SQLite and leaves JSON untouched', async () => {
+    const profile = createProfile()
+    getDefaultUserDataPathMock.mockReturnValue(profile.userDataPath)
+    const json = readFileSync(profile.dataFile)
+    await main(['profile', 'state', 'rollback', '--current-sqlite', '--json'], profile.userDataPath)
+    expect(process.exitCode).toBe(1)
+    expect(readFileSync(profile.dataFile)).toEqual(json)
+    expect(readFileSync(profile.databaseFile, 'utf8')).toBe('damaged sqlite primary')
+  })
+
+  it.each([
+    ['--current-json', '--revision', '1'],
+    ['--current-json', '--backup', '1'],
+    ['--current-json', '--current-sqlite'],
+    ['--current-json=false'],
+    ['--current-sqlite=false']
+  ])('rejects ambiguous current JSON arguments: %s', async (...flags) => {
+    getCliStatusMock.mockClear()
+    const profile = createProfile()
+    getDefaultUserDataPathMock.mockReturnValue(profile.userDataPath)
+    await main(['profile', 'state', 'rollback', ...flags, '--json'], profile.userDataPath)
+    expect(process.exitCode).toBe(1)
+    expect(existsSync(profile.databaseFile)).toBe(true)
+    expect(getCliStatusMock).not.toHaveBeenCalled()
+  })
+
+  it('keeps profile-state recovery local when remote selection is configured', async () => {
+    const profile = createProfile()
+    getDefaultUserDataPathMock.mockReturnValue(profile.userDataPath)
+    vi.stubEnv('ORCA_PAIRING_CODE', 'remote-pairing-code')
+    vi.stubEnv('ORCA_ENVIRONMENT', 'stale-environment')
+
+    await main(['profile', 'state', 'rollback', '--revision', '1', '--json'], profile.userDataPath)
+
+    expect(runtimeClientConstructorMock).toHaveBeenCalledWith(null, null)
+    expect(vi.mocked(console.log).mock.calls.at(-1)?.[0]).toContain('quarantineDirectory')
+  })
+
+  it.each([true, false])(
+    'recovers an absent database and archives every export (legacy JSON present: %s)',
+    async (hasJson) => {
+      const profile = createProfile()
+      getDefaultUserDataPathMock.mockReturnValue(profile.userDataPath)
+      rmSync(profile.databaseFile)
+      rmSync(`${profile.databaseFile}-wal`)
+      if (!hasJson) {
+        rmSync(profile.dataFile)
+      }
+      const laterExport = profileStateJsonExportPath(profile.dataFile, 2)
+      writeFileSync(laterExport, JSON.stringify({ settings: { theme: 'later' } }))
+      const selectedBytes = readFileSync(profile.exportPath)
+      const laterBytes = readFileSync(laterExport)
+
+      await main(
+        ['profile', 'state', 'rollback', '--revision', '1', '--json'],
+        profile.userDataPath
+      )
+
+      expect(process.exitCode).toBe(0)
+      expect(readFileSync(profile.dataFile)).toEqual(selectedBytes)
+      expect(existsSync(profile.exportPath)).toBe(false)
+      expect(existsSync(laterExport)).toBe(false)
+      const output: unknown = JSON.parse(String(vi.mocked(console.log).mock.calls.at(-1)?.[0]))
+      expect(output).toMatchObject({ ok: true, result: { removedDatabaseFiles: [] } })
+      if (
+        !output ||
+        typeof output !== 'object' ||
+        !('result' in output) ||
+        !output.result ||
+        typeof output.result !== 'object' ||
+        !('quarantineDirectory' in output.result) ||
+        typeof output.result.quarantineDirectory !== 'string'
+      ) {
+        throw new Error('Expected rollback archive directory')
+      }
+      const archive = output.result.quarantineDirectory
+      expect(readFileSync(join(archive, basename(profile.exportPath)))).toEqual(selectedBytes)
+      expect(readFileSync(join(archive, basename(laterExport)))).toEqual(laterBytes)
+      expect(existsSync(join(archive, basename(profile.dataFile)))).toBe(hasJson)
+      expect(readPersistedHttp1CompatibilityMode(profile.userDataPath)).toBe(true)
+    }
+  )
+
+  it('preserves all live recovery sources when archiving an export fails', async () => {
+    const profile = createProfile()
+    getDefaultUserDataPathMock.mockReturnValue(profile.userDataPath)
+    const unavailableExport = profileStateJsonExportPath(profile.dataFile, 2)
+    mkdirSync(unavailableExport)
+    const original = readFileSync(profile.dataFile)
+
+    await main(['profile', 'state', 'rollback', '--revision', '1', '--json'], profile.userDataPath)
+
+    expect(process.exitCode).toBe(1)
+    expect(readFileSync(profile.dataFile)).toEqual(original)
+    expect(existsSync(profile.exportPath)).toBe(true)
+    expect(existsSync(profile.databaseFile)).toBe(true)
+    expect(existsSync(`${profile.databaseFile}-wal`)).toBe(true)
+  })
+
+  it('falls back to restored settings when refreshing the marker fails', async () => {
+    const profile = createProfile()
+    getDefaultUserDataPathMock.mockReturnValue(profile.userDataPath)
+    http1Marker.writeHttp1CompatibilityMarker(profile.userDataPath, false, 'profile-cli-recovery')
+    const writeFileDurableSync = durableFileWrite.writeFileDurableSync
+    vi.spyOn(durableFileWrite, 'writeFileDurableSync').mockImplementation(
+      (tmp, target, contents) => {
+        if (target === join(profile.userDataPath, http1Marker.HTTP1_COMPATIBILITY_MARKER_FILE)) {
+          throw new Error('injected marker write failure')
+        }
+        return writeFileDurableSync(tmp, target, contents)
+      }
+    )
+
+    await main(['profile', 'state', 'rollback', '--revision', '1', '--json'], profile.userDataPath)
+
+    expect(existsSync(profile.databaseFile)).toBe(false)
+    expect(
+      http1Marker.readHttp1CompatibilityMarker(profile.userDataPath, 'profile-cli-recovery')
+    ).toBeNull()
+    expect(readPersistedHttp1CompatibilityMode(profile.userDataPath)).toBe(true)
+    expect(String(vi.mocked(console.log).mock.calls.at(-1)?.[0])).toContain('quarantineDirectory')
+  })
+
+  it('preserves SQLite authority when the old marker cannot be invalidated', async () => {
+    const profile = createProfile()
+    getDefaultUserDataPathMock.mockReturnValue(profile.userDataPath)
+    // A directory at the marker path makes non-recursive removal fail on every supported OS.
+    mkdirSync(join(profile.userDataPath, http1Marker.HTTP1_COMPATIBILITY_MARKER_FILE))
+
+    await main(['profile', 'state', 'rollback', '--revision', '1', '--json'], profile.userDataPath)
+
+    expect(readFileSync(profile.databaseFile, 'utf8')).toBe('damaged sqlite primary')
+    expect(existsSync(profile.exportPath)).toBe(true)
+    expect(readFileSync(profile.dataFile, 'utf8')).toBe(
+      JSON.stringify({ settings: { theme: 'old' } })
+    )
+    expect(String(vi.mocked(console.log).mock.calls.at(-1)?.[0])).not.toContain(
+      'quarantineDirectory'
+    )
+    expect(process.exitCode).toBe(1)
+  })
+
+  it('does not invalidate the active setting for an invalid recovery export', async () => {
+    const profile = createProfile()
+    getDefaultUserDataPathMock.mockReturnValue(profile.userDataPath)
+    http1Marker.writeHttp1CompatibilityMarker(profile.userDataPath, true, 'profile-cli-recovery')
+    writeFileSync(profile.exportPath, 'invalid JSON')
+
+    await main(['profile', 'state', 'rollback', '--revision', '1', '--json'], profile.userDataPath)
+
+    expect(existsSync(profile.databaseFile)).toBe(true)
+    expect(
+      http1Marker.readHttp1CompatibilityMarker(profile.userDataPath, 'profile-cli-recovery')
+    ).toBe(true)
+    expect(process.exitCode).toBe(1)
+  })
+
+  it('rejects an explicit remote selector instead of silently ignoring it', async () => {
+    const profile = createProfile()
+    getDefaultUserDataPathMock.mockReturnValue(profile.userDataPath)
+
+    await main(
+      ['profile', 'state', 'rollback', '--revision', '1', '--environment', 'remote', '--json'],
+      profile.userDataPath
+    )
+
+    expect(existsSync(profile.databaseFile)).toBe(true)
+    expect(vi.mocked(console.log).mock.calls.at(-1)?.[0]).toContain(
+      '`--environment` does not retarget profile-state recovery'
+    )
+  })
+
+  it.each([['--revision', '1'], ['--current-json']])(
+    'refuses rollback while runtime is reachable: %s',
+    async (...flags) => {
+      const profile = createProfile()
+      getDefaultUserDataPathMock.mockReturnValue(profile.userDataPath)
+      getCliStatusMock.mockResolvedValueOnce({
+        id: 'status',
+        ok: true,
+        result: {
+          app: { running: true, pid: 123 },
+          runtime: { state: 'ready', reachable: true, runtimeId: 'desktop' },
+          graph: { state: 'ready' }
+        },
+        _meta: { runtimeId: 'test' }
+      })
+
+      await main(['profile', 'state', 'rollback', ...flags], profile.userDataPath)
+
+      expect(existsSync(profile.databaseFile)).toBe(true)
+      expect(readFileSync(profile.dataFile, 'utf8')).toBe(
+        JSON.stringify({ settings: { theme: 'old' } })
+      )
+      expect(vi.mocked(console.error).mock.calls.at(-1)?.[0]).toContain('Stop Orca')
+    }
+  )
+
+  it('lists SQLite backups alongside JSON exports without opening the damaged primary', async () => {
+    const profile = createProfile()
+    const backup = await createDatabaseBackup(profile)
+    getDefaultUserDataPathMock.mockReturnValue(profile.userDataPath)
+    getCliStatusMock.mockClear()
+
+    await main(['profile', 'state', 'exports', '--json'], profile.userDataPath)
+
+    const output: unknown = JSON.parse(String(vi.mocked(console.log).mock.calls.at(-1)?.[0]))
+    expect(output).toMatchObject({
+      ok: true,
+      result: { exportPaths: [profile.exportPath], backups: [{ id: backup.id, path: backup.path }] }
+    })
+    expect(getCliStatusMock).not.toHaveBeenCalled()
+  })
+
+  it.each([true, false])(
+    'restores SQLite backup authority with damaged database present=%s',
+    async (hasDatabase) => {
+      const profile = createProfile()
+      const backup = await createDatabaseBackup(profile)
+      getDefaultUserDataPathMock.mockReturnValue(profile.userDataPath)
+      http1Marker.writeHttp1CompatibilityMarker(profile.userDataPath, false, 'profile-cli-recovery')
+      if (!hasDatabase) {
+        rmSync(profile.databaseFile)
+        rmSync(`${profile.databaseFile}-wal`)
+        rmSync(profile.dataFile)
+      }
+
+      await main(
+        ['profile', 'state', 'rollback', '--backup', backup.id, '--json'],
+        profile.userDataPath
+      )
+
+      expect(process.exitCode).toBe(0)
+      expect(existsSync(profile.dataFile)).toBe(false)
+      expect(existsSync(backup.path)).toBe(true)
+      const restored = openProfileStateDatabaseReadOnly(
+        profile.databaseFile,
+        'profile-cli-recovery'
+      )
+      try {
+        expect(JSON.parse(exportProfileStateJson(restored.db))).toMatchObject({
+          settings: { theme: 'sqlite-recovered', httpProxyUrl: 'sealed:unchanged' },
+          extensionState: { retained: true }
+        })
+      } finally {
+        restored.db.close()
+      }
+      expect(
+        http1Marker.readHttp1CompatibilityMarker(profile.userDataPath, 'profile-cli-recovery')
+      ).toBe(true)
+      expect(String(vi.mocked(console.log).mock.calls.at(-1)?.[0])).toContain('"storage": "sqlite"')
+    }
+  )
+
+  it('rejects a backup belonging to another profile before invalidating the startup marker', async () => {
+    const profile = createProfile()
+    const backup = await createDatabaseBackup(profile, 'foreign-profile')
+    getDefaultUserDataPathMock.mockReturnValue(profile.userDataPath)
+    http1Marker.writeHttp1CompatibilityMarker(profile.userDataPath, true, 'profile-cli-recovery')
+
+    await main(
+      ['profile', 'state', 'rollback', '--backup', backup.id, '--json'],
+      profile.userDataPath
+    )
+
+    expect(process.exitCode).toBe(1)
+    expect(readFileSync(profile.databaseFile, 'utf8')).toBe('damaged sqlite primary')
+    expect(
+      http1Marker.readHttp1CompatibilityMarker(profile.userDataPath, 'profile-cli-recovery')
+    ).toBe(true)
+  })
+
+  it('requires an unambiguous retained backup selection', async () => {
+    const profile = createProfile()
+    const backup = await createDatabaseBackup(profile)
+    getDefaultUserDataPathMock.mockReturnValue(profile.userDataPath)
+
+    await main(
+      ['profile', 'state', 'rollback', '--backup', backup.id, '--revision', '1', '--json'],
+      profile.userDataPath
+    )
+
+    expect(process.exitCode).toBe(1)
+    expect(readFileSync(profile.databaseFile, 'utf8')).toBe('damaged sqlite primary')
+    expect(String(vi.mocked(console.log).mock.calls.at(-1)?.[0])).toContain('exactly one')
+  })
+
+  it('rejects escaping backup IDs without touching any recovery artifact', async () => {
+    const profile = createProfile()
+    getDefaultUserDataPathMock.mockReturnValue(profile.userDataPath)
+
+    await main(
+      ['profile', 'state', 'rollback', '--backup', '../../outside', '--json'],
+      profile.userDataPath
+    )
+
+    expect(process.exitCode).toBe(1)
+    expect(readFileSync(profile.databaseFile, 'utf8')).toBe('damaged sqlite primary')
+    expect(String(vi.mocked(console.log).mock.calls.at(-1)?.[0])).toContain('backup is unavailable')
+  })
+
+  it('refuses database backup restoration while the app is running', async () => {
+    const profile = createProfile()
+    const backup = await createDatabaseBackup(profile)
+    getDefaultUserDataPathMock.mockReturnValue(profile.userDataPath)
+    getCliStatusMock.mockResolvedValueOnce({
+      result: { app: { running: true }, runtime: { reachable: false } }
+    })
+
+    await main(
+      ['profile', 'state', 'rollback', '--backup', backup.id, '--json'],
+      profile.userDataPath
+    )
+
+    expect(process.exitCode).toBe(1)
+    expect(readFileSync(profile.databaseFile, 'utf8')).toBe('damaged sqlite primary')
+    expect(String(vi.mocked(console.log).mock.calls.at(-1)?.[0])).toContain('Stop Orca')
+  })
+})
diff --git a/src/cli/handlers/profile-state.ts b/src/cli/handlers/profile-state.ts
new file mode 100644
index 000000000000..be7e70413bbf
--- /dev/null
+++ b/src/cli/handlers/profile-state.ts
@@ -0,0 +1,159 @@
+import type { CommandHandler } from '../dispatch'
+import { printResult } from '../format'
+import { rejectRemoteSelectionFlags } from '../remote-selection-flag-rejection'
+import {
+  getDefaultUserDataPath,
+  RuntimeClientError,
+  type RuntimeClient,
+  type RuntimeRpcSuccess
+} from '../runtime-client'
+import {
+  getProfileStateExports,
+  rollbackProfileState
+} from '../../main/persistence/profile-state/profile-state-recovery-command'
+import { acquireProfileStateMaintenance } from '../../main/persistence/profile-state/profile-state-access'
+import {
+  isProfileStateRecoveryCommandError,
+  type ProfileStateExportsResult,
+  type ProfileStateRollbackResult,
+  type ProfileStateRecoverySelector
+} from '../../shared/profile-state-recovery-command'
+import {
+  canLaunchProfileStateRecovery,
+  launchProfileStateRecovery
+} from '../runtime/profile-state-recovery-launch'
+
+function localSuccess<TResult>(result: TResult): RuntimeRpcSuccess<TResult> {
+  return {
+    id: 'local',
+    ok: true,
+    result,
+    _meta: { runtimeId: 'local' }
+  }
+}
+
+function formatExports(result: ProfileStateExportsResult): string {
+  return [
+    `profileId: ${result.profileId}`,
+    `dataFile: ${result.dataFile}`,
+    `databaseFile: ${result.databaseFile}`,
+    'JSON exports:',
+    ...(result.exportPaths.length > 0 ? result.exportPaths : ['(none)']),
+    'SQLite backups:',
+    ...(result.backups.length > 0
+      ? result.backups.map((backup) => `${backup.id}: ${backup.path}`)
+      : ['(none)'])
+  ].join('\n')
+}
+
+function formatRollback(result: ProfileStateRollbackResult): string {
+  return [
+    `profileId: ${result.profileId}`,
+    result.revision === null ? 'source: current JSON' : `revision: ${result.revision}`,
+    ...(result.storage === 'sqlite' && result.backupId === undefined
+      ? ['source: current SQLite']
+      : []),
+    `storage: ${result.storage}`,
+    `restored: ${result.restoredPath}`,
+    `quarantine: ${result.quarantineDirectory}`,
+    `removedDatabaseFiles: ${result.removedDatabaseFiles.length}`
+  ].join('\n')
+}
+
+function rejectProfileStateRemoteSelection(flags: ReadonlyMap<string, string | boolean>): void {
+  rejectRemoteSelectionFlags(
+    flags,
+    "profile-state recovery; it operates on this machine's active profile."
+  )
+}
+
+async function requireStoppedRuntime(client: RuntimeClient): Promise<void> {
+  const status = await client.getCliStatus()
+  if (status.result.runtime.reachable || status.result.app.running) {
+    throw new RuntimeClientError(
+      'runtime_error',
+      'Stop Orca before profile-state rollback so no process can write the SQLite database.'
+    )
+  }
+}
+
+function parseRevision(flags: Map<string, string | boolean>): number {
+  const rawRevision = flags.get('revision')
+  if (typeof rawRevision !== 'string' || rawRevision.length === 0) {
+    throw new RuntimeClientError('invalid_argument', 'Profile-state rollback requires --revision.')
+  }
+  const revision = Number(rawRevision)
+  if (!Number.isSafeInteger(revision) || revision < 1) {
+    throw new RuntimeClientError(
+      'invalid_argument',
+      `Invalid profile-state revision: ${rawRevision}`
+    )
+  }
+  return revision
+}
+
+export const PROFILE_STATE_HANDLERS: Record<string, CommandHandler> = {
+  'profile state exports': async ({ flags, json }) => {
+    rejectProfileStateRemoteSelection(flags)
+    const result = translateRecoveryError(() => getProfileStateExports(getDefaultUserDataPath()))
+    printResult(localSuccess(result), json, formatExports)
+  },
+  'profile state rollback': async ({ client, flags, json }) => {
+    rejectProfileStateRemoteSelection(flags)
+    const selector = parseSelector(flags)
+    const userDataPath = getDefaultUserDataPath()
+    let result: ProfileStateRollbackResult
+    if (canLaunchProfileStateRecovery()) {
+      await requireStoppedRuntime(client)
+      result = await launchProfileStateRecovery({ userDataPath, selector })
+    } else {
+      const maintenance = acquireProfileStateMaintenance(userDataPath)
+      try {
+        await requireStoppedRuntime(client)
+        result = translateRecoveryError(() =>
+          rollbackProfileState(userDataPath, selector, maintenance)
+        )
+      } finally {
+        maintenance.release()
+      }
+    }
+    printResult(localSuccess(result), json, formatRollback)
+  }
+}
+
+function parseSelector(flags: Map<string, string | boolean>): ProfileStateRecoverySelector {
+  const selectors = ['revision', 'backup', 'current-json', 'current-sqlite'] as const
+  if (selectors.filter((flag) => flags.has(flag)).length !== 1) {
+    throw new RuntimeClientError(
+      'invalid_argument',
+      'Select exactly one of --revision, --backup, --current-json, or --current-sqlite.'
+    )
+  }
+  for (const kind of ['current-json', 'current-sqlite'] as const) {
+    if (flags.has(kind)) {
+      if (flags.get(kind) !== true) {
+        throw new RuntimeClientError('invalid_argument', `--${kind} does not take a value.`)
+      }
+      return { kind }
+    }
+  }
+  if (!flags.has('backup')) {
+    return { kind: 'json', revision: parseRevision(flags) }
+  }
+  const backupId = flags.get('backup')
+  if (typeof backupId !== 'string' || backupId.length === 0) {
+    throw new RuntimeClientError('invalid_argument', 'Profile-state rollback requires --backup.')
+  }
+  return { kind: 'sqlite', backupId }
+}
+
+function translateRecoveryError<T>(operation: () => T): T {
+  try {
+    return operation()
+  } catch (error) {
+    if (isProfileStateRecoveryCommandError(error)) {
+      throw new RuntimeClientError(error.code, error.message)
+    }
+    throw error
+  }
+}
diff --git a/src/cli/handlers/terminal-close.ts b/src/cli/handlers/terminal-close.ts
index 5ba8a25b64a1..9e65b2f5f473 100644
--- a/src/cli/handlers/terminal-close.ts
+++ b/src/cli/handlers/terminal-close.ts
@@ -6,6 +6,7 @@ import type { CommandHandler } from '../dispatch'
 import { formatTerminalClose, reportCliError, printResult } from '../format'
 import { RuntimeClientError } from '../runtime-client'
 import { getRequiredWorktreeSelector, getTerminalHandle } from '../selectors'
+import { describeUnconfirmedCloseStop } from '../../shared/pty-liveness-verdict'
 
 /** A false stop receipt is an error only when the host supplied a liveness verdict. */
 function terminalCloseFailure(close: RuntimeTerminalClose): RuntimeClientError | null {
@@ -13,14 +14,17 @@ function terminalCloseFailure(close: RuntimeTerminalClose): RuntimeClientError |
     return null
   }
 
-  const verdict = close.ptyStopVerdict
-  const detail =
-    verdict === 'live'
-      ? 'The PTY is live.'
-      : `The PTY was not confirmed stopped: ${close.ptyStopReason ?? 'its host could not be reached'}.`
+  if (close.ptyStopVerdict === 'live') {
+    return new RuntimeClientError(
+      'terminal_stop_live',
+      `Terminal ${close.handle} close failed to confirm the PTY stopped (live). The PTY is live.`,
+      { close }
+    )
+  }
+  // Why: the close itself committed; only the process stop is unproven, so say which.
   return new RuntimeClientError(
-    verdict === 'live' ? 'terminal_stop_live' : 'terminal_stop_unverifiable',
-    `Terminal ${close.handle} close failed to confirm the PTY stopped (${verdict}). ${detail}`,
+    'terminal_stop_unverifiable',
+    `Closed terminal ${close.handle}. ${describeUnconfirmedCloseStop(close)}`,
     { close }
   )
 }
diff --git a/src/cli/handlers/terminal.test.ts b/src/cli/handlers/terminal.test.ts
index 06df95f55a94..c0d9e8acda54 100644
--- a/src/cli/handlers/terminal.test.ts
+++ b/src/cli/handlers/terminal.test.ts
@@ -42,40 +42,57 @@ describe('terminal close CLI', () => {
     expect(process.exitCode).toBeUndefined()
   })
 
-  it('reports an unverifiable PTY stop as a failing JSON outcome', async () => {
-    process.exitCode = undefined
-    const close = {
-      handle: 'term-remote',
-      tabId: 'tab-1',
-      ptyKilled: false,
-      ptyStopVerdict: 'unverifiable' as const,
-      ptyStopReason: 'its SSH provider is no longer registered'
-    }
-    const call = vi.fn().mockResolvedValue({
-      id: 'req-close',
-      ok: true,
-      result: { close },
-      _meta: { runtimeId: 'runtime-1' }
-    })
-    const log = vi.spyOn(console, 'log').mockImplementation(() => {})
+  it.each([
+    [
+      'its SSH provider is no longer registered',
+      false,
+      'Closed terminal term-remote. The PTY was not confirmed stopped: its SSH provider is no longer registered.'
+    ],
+    [
+      'Request "pty.shutdown" timed out after 14250ms',
+      true,
+      'Closed terminal term-remote. The PTY was not confirmed stopped: Request "pty.shutdown" timed out after 14250ms. The kill retries when the host reconnects.'
+    ],
+    // An older host never reports a recorded kill, so the same reason promises nothing.
+    [
+      'Request "pty.shutdown" timed out after 14250ms',
+      false,
+      'Closed terminal term-remote. The PTY was not confirmed stopped: Request "pty.shutdown" timed out after 14250ms.'
+    ]
+  ])(
+    'reports an unverifiable stop (%s, kill recorded: %s) as a committed close with exit code 1',
+    async (ptyStopReason, pendingKillRecorded, message) => {
+      process.exitCode = undefined
+      const close = {
+        handle: 'term-remote',
+        tabId: 'tab-1',
+        ptyKilled: false,
+        ptyStopVerdict: 'unverifiable' as const,
+        ptyStopReason,
+        ...(pendingKillRecorded ? { pendingKillRecorded: true as const } : {})
+      }
+      const call = vi.fn().mockResolvedValue({
+        id: 'req-close',
+        ok: true,
+        result: { close },
+        _meta: { runtimeId: 'runtime-1' }
+      })
+      const log = vi.spyOn(console, 'log').mockImplementation(() => {})
 
-    await TERMINAL_HANDLERS['terminal close']({
-      flags: new Map([['terminal', close.handle]]),
-      client: { call } as unknown as RuntimeClient,
-      cwd: '/tmp/worktree',
-      json: true
-    })
+      await TERMINAL_HANDLERS['terminal close']({
+        flags: new Map([['terminal', close.handle]]),
+        client: { call } as unknown as RuntimeClient,
+        cwd: '/tmp/worktree',
+        json: true
+      })
 
-    expect(JSON.parse(String(log.mock.calls[0]?.[0]))).toMatchObject({
-      ok: false,
-      error: {
-        code: 'terminal_stop_unverifiable',
-        message: expect.stringContaining('unverifiable'),
-        data: { close }
-      }
-    })
-    expect(process.exitCode).toBe(1)
-  })
+      expect(JSON.parse(String(log.mock.calls[0]?.[0]))).toMatchObject({
+        ok: false,
+        error: { code: 'terminal_stop_unverifiable', message, data: { close } }
+      })
+      expect(process.exitCode).toBe(1)
+    }
+  )
 
   it('reports a live PTY stop as a failing human outcome', async () => {
     process.exitCode = undefined
diff --git a/src/cli/index-vm-recipe-doctor.test.ts b/src/cli/index-vm-recipe-doctor.test.ts
index c707c5cdc88a..1e8bd99e15f4 100644
--- a/src/cli/index-vm-recipe-doctor.test.ts
+++ b/src/cli/index-vm-recipe-doctor.test.ts
@@ -198,11 +198,13 @@ describe('orca cli worktree awareness', () => {
           process.nextTick(() => {
             startChild.stdout.emit(
               'data',
-              JSON.stringify({
-                schemaVersion: 1,
-                pairingCode,
-                projectRoot: '/workspace/repo'
-              })
+              Buffer.from(
+                JSON.stringify({
+                  schemaVersion: 1,
+                  pairingCode,
+                  projectRoot: '/workspace/repo'
+                })
+              )
             )
             startChild.emit('exit', 0, null)
             startChild.emit('close', 0, null)
@@ -289,8 +291,8 @@ describe('orca cli worktree awareness', () => {
       // create emits a non-JSON line to stdout + a real diagnostic to stderr, then exits 0
       spawnMock.mockImplementationOnce(() => {
         process.nextTick(() => {
-          startChild.stdout.emit('data', 'Provisioning sandbox...\n')
-          startChild.stderr.emit('data', 'vercel: error: missing scope\n')
+          startChild.stdout.emit('data', Buffer.from('Provisioning sandbox...\n'))
+          startChild.stderr.emit('data', Buffer.from('vercel: error: missing scope\n'))
           startChild.emit('exit', 0, null)
           startChild.emit('close', 0, null)
         })
diff --git a/src/cli/index-worktree-create-freebuff.test.ts b/src/cli/index-worktree-create-freebuff.test.ts
new file mode 100644
index 000000000000..aab4b17c36e0
--- /dev/null
+++ b/src/cli/index-worktree-create-freebuff.test.ts
@@ -0,0 +1,94 @@
+import { describe, expect, it, vi } from 'vitest'
+
+const {
+  callMock,
+  runtimeClientConstructorMock,
+  serveOrcaAppMock,
+  getDefaultUserDataPathMock,
+  addEnvironmentFromPairingCodeMock,
+  listEnvironmentsMock,
+  spawnMock
+} = vi.hoisted(() => ({
+  callMock: vi.fn(),
+  runtimeClientConstructorMock: vi.fn(),
+  serveOrcaAppMock: vi.fn(),
+  getDefaultUserDataPathMock: vi.fn(() => '/tmp/orca-user-data'),
+  addEnvironmentFromPairingCodeMock: vi.fn(),
+  listEnvironmentsMock: vi.fn(),
+  spawnMock: vi.fn()
+}))
+
+vi.mock('./runtime-client', async () => {
+  const { createRuntimeClientModuleMock } = await import('./index-test-harness.js')
+  return createRuntimeClientModuleMock({
+    callMock,
+    runtimeClientConstructorMock,
+    serveOrcaAppMock,
+    getDefaultUserDataPathMock
+  })
+})
+
+vi.mock('./runtime/environments', () => ({
+  addEnvironmentFromPairingCode: addEnvironmentFromPairingCodeMock,
+  listEnvironments: listEnvironmentsMock,
+  removeEnvironment: vi.fn(),
+  resolveEnvironment: vi.fn()
+}))
+
+vi.mock('child_process', async () => {
+  const { createChildProcessModuleMock } = await import('./index-test-harness.js')
+  return createChildProcessModuleMock(spawnMock)
+})
+
+import { main } from './index'
+import { buildWorktree, okFixture, queueFixtures, worktreeListFixture } from './test-fixtures'
+import { useWorktreeAwarenessEnvironment } from './index-test-harness'
+
+describe('Freebuff worktree creation', () => {
+  useWorktreeAwarenessEnvironment({
+    callMock,
+    serveOrcaAppMock,
+    getDefaultUserDataPathMock,
+    addEnvironmentFromPairingCodeMock,
+    listEnvironmentsMock,
+    spawnMock
+  })
+
+  it('passes Freebuff and its prompt to the runtime without activating the worktree', async () => {
+    queueFixtures(
+      callMock,
+      worktreeListFixture([buildWorktree('/tmp/repo', 'main', 'abc', 'repo-1')]),
+      okFixture('req_create', {
+        worktree: buildWorktree('/tmp/repo/freebuff-task', 'freebuff-task', 'abc', 'repo-1')
+      })
+    )
+    vi.spyOn(console, 'log').mockImplementation(() => {})
+
+    await main(
+      [
+        'worktree',
+        'create',
+        '--repo',
+        'id:repo-1',
+        '--name',
+        'freebuff-task',
+        '--agent',
+        'freebuff',
+        '--prompt',
+        'Review this workspace',
+        '--json'
+      ],
+      '/tmp/repo'
+    )
+
+    expect(callMock).toHaveBeenNthCalledWith(
+      2,
+      'worktree.create',
+      expect.objectContaining({
+        startupAgent: 'freebuff',
+        startupPrompt: 'Review this workspace',
+        activate: false
+      })
+    )
+  })
+})
diff --git a/src/cli/index.ts b/src/cli/index.ts
index 33566dcf8374..b2e01c04e56f 100644
--- a/src/cli/index.ts
+++ b/src/cli/index.ts
@@ -38,7 +38,8 @@ function shouldIgnoreRemoteSelection(commandPath: string[]): boolean {
     commandPath[0] === 'serve' ||
     commandPath[0] === 'agent' ||
     commandPath[0] === 'vm' ||
-    commandPath[0] === 'agent-context'
+    commandPath[0] === 'agent-context' ||
+    commandPath[0] === 'profile'
   )
 }
 
diff --git a/src/cli/main-module-bundle-parity.test.ts b/src/cli/main-module-bundle-parity.test.ts
deleted file mode 100644
index a109fcb9fdb5..000000000000
--- a/src/cli/main-module-bundle-parity.test.ts
+++ /dev/null
@@ -1,58 +0,0 @@
-import { readFileSync, readdirSync } from 'node:fs'
-import { join, resolve } from 'node:path'
-import { describe, expect, it } from 'vitest'
-
-const REPO_ROOT = resolve(__dirname, '..', '..')
-const CLI_ROOT = join(REPO_ROOT, 'src', 'cli')
-
-function listCliSourceFiles(dir: string): string[] {
-  return readdirSync(dir, { withFileTypes: true }).flatMap((entry) => {
-    const path = join(dir, entry.name)
-    if (entry.isDirectory()) {
-      return listCliSourceFiles(path)
-    }
-    return entry.isFile() && entry.name.endsWith('.ts') && !entry.name.endsWith('.test.ts')
-      ? [path]
-      : []
-  })
-}
-
-// Why: `import type` is erased by tsc, so it needs no emitted module at runtime.
-const VALUE_IMPORT_FROM_MAIN = /(?<!\btype\s)from '\.\.\/\.\.\/main\/([^']+)'/g
-
-function findMainImports(): { file: string; module: string }[] {
-  return listCliSourceFiles(CLI_ROOT).flatMap((file) => {
-    const source = readFileSync(file, 'utf-8')
-    return [...source.matchAll(VALUE_IMPORT_FROM_MAIN)].map((match) => ({
-      file: file.slice(REPO_ROOT.length + 1),
-      module: match[1]
-    }))
-  })
-}
-
-function findElectronViteMainEntries(): Set<string> {
-  const config = readFileSync(join(REPO_ROOT, 'electron.vite.config.ts'), 'utf-8')
-  return new Set(
-    // Why: entries wrap across lines once the path is long, so allow whitespace.
-    [...config.matchAll(/resolve\(\s*'src\/main\/([^']+)\.ts'\s*\)/g)].map((match) => match[1])
-  )
-}
-
-describe('CLI imports of main-process modules', () => {
-  // Why: electron-vite cleans out/main and emits only its declared entries, so a
-  // `src/main/*` module the CLI imports but the config omits is deleted by the
-  // build that runs after `build:cli` — keep source-level feedback ahead of the
-  // final-artifact runtime verifier.
-  it('has an electron-vite entry for every main module the CLI imports', () => {
-    const entries = findElectronViteMainEntries()
-    const missing = findMainImports().filter(({ module }) => !entries.has(module))
-
-    expect(missing).toEqual([])
-  })
-
-  it('finds the imports it is meant to guard', () => {
-    // Why: a broken matcher would make the guard above vacuously pass.
-    expect(findMainImports().length).toBeGreaterThanOrEqual(2)
-    expect(findElectronViteMainEntries().size).toBeGreaterThanOrEqual(2)
-  })
-})
diff --git a/src/cli/profile-state-location.ts b/src/cli/profile-state-location.ts
new file mode 100644
index 000000000000..1e9325872a11
--- /dev/null
+++ b/src/cli/profile-state-location.ts
@@ -0,0 +1,13 @@
+import { getActiveProfileStateLocation as resolveActiveProfileStateLocation } from '../main/persistence/profile-state/profile-state-active-location'
+import { RuntimeClientError, getDefaultUserDataPath } from './runtime-client'
+
+export function getActiveProfileStateLocation(userDataPath = getDefaultUserDataPath()) {
+  try {
+    return resolveActiveProfileStateLocation(userDataPath)
+  } catch (error) {
+    throw new RuntimeClientError(
+      'runtime_error',
+      error instanceof Error ? error.message : String(error)
+    )
+  }
+}
diff --git a/src/cli/runtime-client-deferral.test.ts b/src/cli/runtime-client-deferral.test.ts
index fdf77082729c..1487e2364f73 100644
--- a/src/cli/runtime-client-deferral.test.ts
+++ b/src/cli/runtime-client-deferral.test.ts
@@ -153,7 +153,9 @@ describe('RuntimeClient module-graph deferral', () => {
     async (_name, argv, constructs) => {
       vi.stubEnv('ORCA_PAIRING_CODE', 'pairing-code')
       vi.stubEnv('ORCA_ENVIRONMENT', 'some-environment')
-      getCliStatusMock.mockResolvedValue({ result: { runtime: { reachable: false } } })
+      getCliStatusMock.mockResolvedValue({
+        result: { runtime: { reachable: false }, app: { running: false } }
+      })
 
       await main(argv, '/tmp/repo')
 
diff --git a/src/cli/runtime/launch.ts b/src/cli/runtime/launch.ts
index a326ae333f58..ebf10c2aaa9b 100644
--- a/src/cli/runtime/launch.ts
+++ b/src/cli/runtime/launch.ts
@@ -255,7 +255,7 @@ function waitForRecipeJson(child: ReturnType<typeof spawnProcess>): Promise<numb
   })
 }
 
-function getExecutableAppArgs(executable: string): string[] {
+export function getExecutableAppArgs(executable: string): string[] {
   const args = process.env.ORCA_APP_EXECUTABLE_NEEDS_APP_ROOT === '1' ? [resolveAppRoot()] : []
   if (shouldDisableExtractedAppImageSandbox(executable)) {
     args.push('--no-sandbox')
@@ -289,14 +289,14 @@ function getExecutableSpawnOptions(executable: string): Pick<SpawnOptions, 'shel
   return process.platform === 'win32' && /\.(?:cmd|bat)$/i.test(executable) ? { shell: true } : {}
 }
 
-function resolveAppRoot(): string {
+export function resolveAppRoot(): string {
   // Why: dev-mode resource resolution in the Electron child may consult
   // process.cwd(). Pin it to the app root so `orca serve` behaves the same
   // regardless of the shell directory it was launched from.
   return resolve(__dirname, '../../..')
 }
 
-function resolveForegroundOrcaExecutable(): string {
+export function resolveForegroundOrcaExecutable(): string {
   const overrideExecutable = process.env.ORCA_APP_EXECUTABLE
   if (typeof overrideExecutable === 'string' && overrideExecutable.trim().length > 0) {
     return overrideExecutable
diff --git a/src/cli/runtime/profile-state-recovery-launch.test.ts b/src/cli/runtime/profile-state-recovery-launch.test.ts
new file mode 100644
index 000000000000..36ae0e7868ff
--- /dev/null
+++ b/src/cli/runtime/profile-state-recovery-launch.test.ts
@@ -0,0 +1,154 @@
+import { realpathSync } from 'node:fs'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import {
+  PROFILE_STATE_RECOVERY_FLAG,
+  PROFILE_STATE_RECOVERY_RESULT_PREFIX
+} from '../../shared/profile-state-recovery-command'
+import {
+  canLaunchProfileStateRecovery,
+  launchProfileStateRecovery
+} from './profile-state-recovery-launch'
+
+const mocks = vi.hoisted(() => ({ run: vi.fn() }))
+vi.mock('../../shared/child-process/run-process', () => ({ runProcess: mocks.run }))
+vi.mock('./launch', () => ({
+  resolveForegroundOrcaExecutable: () => '/packaged/Orca',
+  resolveAppRoot: () => '/application',
+  getExecutableAppArgs: () => ['/application'],
+  stripElectronRunAsNode: (env: NodeJS.ProcessEnv) => {
+    const clean = { ...env }
+    delete clean.ELECTRON_RUN_AS_NODE
+    return clean
+  }
+}))
+
+const result = {
+  profileId: 'profile',
+  dataFile: '/root/orca-data.json',
+  databaseFile: '/root/profile-state.db',
+  exportPaths: [],
+  backups: [],
+  revision: 1,
+  quarantineDirectory: '/root/quarantine',
+  removedDatabaseFiles: [],
+  storage: 'json',
+  restoredPath: '/root/orca-data.json'
+}
+const request = { userDataPath: '.', selector: { kind: 'json', revision: 1 } } as const
+beforeEach(() => {
+  mocks.run.mockReset().mockResolvedValue({
+    code: 0,
+    signal: null,
+    timedOut: false,
+    stdout: `${PROFILE_STATE_RECOVERY_RESULT_PREFIX}${JSON.stringify({ ok: true, result })}\n`,
+    stderr: ''
+  })
+})
+afterEach(() => vi.unstubAllEnvs())
+
+describe('profile-state recovery launch', () => {
+  it('preserves direct participation only for plain Node without an explicit Electron executable', () => {
+    vi.stubEnv('ELECTRON_RUN_AS_NODE', undefined)
+    vi.stubEnv('ORCA_APP_EXECUTABLE', undefined)
+    expect(canLaunchProfileStateRecovery()).toBe(false)
+    vi.stubEnv('ELECTRON_RUN_AS_NODE', '1')
+    expect(canLaunchProfileStateRecovery()).toBe(true)
+    vi.stubEnv('ELECTRON_RUN_AS_NODE', undefined)
+    vi.stubEnv('ORCA_APP_EXECUTABLE', '/explicit/Orca')
+    expect(canLaunchProfileStateRecovery()).toBe(true)
+  })
+
+  it('uses a foreground-safe serve request and binds the canonical recovery root', async () => {
+    vi.stubEnv('ELECTRON_RUN_AS_NODE', '1')
+    vi.stubEnv('ORCA_USER_DATA_PATH', '/stale/root')
+    expect(await launchProfileStateRecovery(request)).toEqual(result)
+    expect(mocks.run).toHaveBeenCalledWith(
+      expect.objectContaining({
+        program: '/packaged/Orca',
+        args: [
+          '/application',
+          '--serve',
+          PROFILE_STATE_RECOVERY_FLAG,
+          JSON.stringify({ ...request, userDataPath: realpathSync('.') })
+        ],
+        env: expect.objectContaining({
+          ORCA_BACKGROUND_LAUNCH: '1',
+          ORCA_USER_DATA_PATH: realpathSync('.')
+        }),
+        timeoutMs: null
+      })
+    )
+    expect(mocks.run.mock.calls[0][0].env).not.toHaveProperty('ELECTRON_RUN_AS_NODE')
+  })
+
+  it('round-trips current JSON selection without requiring an invented revision', async () => {
+    const current = { ...result, revision: null }
+    mocks.run.mockResolvedValue({
+      code: 0,
+      signal: null,
+      timedOut: false,
+      stdout: `${PROFILE_STATE_RECOVERY_RESULT_PREFIX}${JSON.stringify({ ok: true, result: current })}\n`,
+      stderr: ''
+    })
+    expect(
+      await launchProfileStateRecovery({ userDataPath: '.', selector: { kind: 'current-json' } })
+    ).toEqual(current)
+    expect(mocks.run.mock.calls[0][0].args.at(-1)).toContain('"kind":"current-json"')
+  })
+
+  it('preserves a structured refusal from the lock owner', async () => {
+    mocks.run.mockResolvedValue({
+      code: 1,
+      stdout: `${PROFILE_STATE_RECOVERY_RESULT_PREFIX}${JSON.stringify({ ok: false, code: 'invalid_argument', message: 'Backup unavailable' })}`
+    })
+    await expect(launchProfileStateRecovery(request)).rejects.toMatchObject({
+      code: 'invalid_argument',
+      message: 'Backup unavailable'
+    })
+  })
+
+  it.each([
+    { code: 1 },
+    { signal: 'SIGKILL' },
+    { timedOut: true },
+    { outputTruncated: true },
+    { stdout: '' },
+    { stdout: `${PROFILE_STATE_RECOVERY_RESULT_PREFIX}{` },
+    { stdout: `${PROFILE_STATE_RECOVERY_RESULT_PREFIX}{"ok":true,"result":{}}` },
+    {
+      stdout: `${PROFILE_STATE_RECOVERY_RESULT_PREFIX}{}\n${PROFILE_STATE_RECOVERY_RESULT_PREFIX}{}`
+    }
+  ])('rejects incomplete or ambiguous child results %j', async (override) => {
+    const original = await mocks.run()
+    mocks.run.mockResolvedValue({ ...original, ...override })
+    await expect(launchProfileStateRecovery(request)).rejects.toMatchObject({
+      code: 'runtime_error'
+    })
+  })
+
+  it('propagates launch failure without retrying another recovery path', async () => {
+    mocks.run.mockRejectedValue(new Error('Executable unavailable'))
+    await expect(launchProfileStateRecovery(request)).rejects.toThrow('Executable unavailable')
+    expect(mocks.run).toHaveBeenCalledOnce()
+  })
+
+  it('retains bounded child diagnostics when recovery exits without a result', async () => {
+    mocks.run.mockResolvedValue({
+      code: null,
+      signal: 'SIGTRAP',
+      timedOut: false,
+      stdout: '',
+      stderr: `${'x'.repeat(5000)}\nsandbox unavailable\n`
+    })
+    await expect(launchProfileStateRecovery(request)).rejects.toMatchObject({
+      data: {
+        exitCode: null,
+        signal: 'SIGTRAP',
+        timedOut: false,
+        outputTruncated: false,
+        stderr: `${'x'.repeat(5000)}\nsandbox unavailable`.slice(-4096)
+      }
+    })
+    expect(mocks.run).toHaveBeenCalledOnce()
+  })
+})
diff --git a/src/cli/runtime/profile-state-recovery-launch.ts b/src/cli/runtime/profile-state-recovery-launch.ts
new file mode 100644
index 000000000000..dd0d68ff2e43
--- /dev/null
+++ b/src/cli/runtime/profile-state-recovery-launch.ts
@@ -0,0 +1,78 @@
+import { realpathSync } from 'node:fs'
+import { runProcess } from '../../shared/child-process/run-process'
+import {
+  PROFILE_STATE_RECOVERY_FLAG,
+  PROFILE_STATE_RECOVERY_RESULT_PREFIX,
+  profileStateRecoveryResponseSchema,
+  type ProfileStateRecoveryRequest,
+  type ProfileStateRollbackResult
+} from '../../shared/profile-state-recovery-command'
+import {
+  getExecutableAppArgs,
+  resolveAppRoot,
+  resolveForegroundOrcaExecutable,
+  stripElectronRunAsNode
+} from './launch'
+import { RuntimeClientError } from './types'
+
+export function canLaunchProfileStateRecovery(): boolean {
+  return process.env.ELECTRON_RUN_AS_NODE === '1' || !!process.env.ORCA_APP_EXECUTABLE?.trim()
+}
+
+export async function launchProfileStateRecovery(
+  request: ProfileStateRecoveryRequest
+): Promise<ProfileStateRollbackResult> {
+  const executable = resolveForegroundOrcaExecutable()
+  const userDataPath = realpathSync(request.userDataPath)
+  const response = await runProcess({
+    program: executable,
+    args: [
+      ...getExecutableAppArgs(executable),
+      '--serve',
+      PROFILE_STATE_RECOVERY_FLAG,
+      JSON.stringify({ ...request, userDataPath })
+    ],
+    cwd: resolveAppRoot(),
+    env: {
+      ...stripElectronRunAsNode(process.env),
+      ORCA_BACKGROUND_LAUNCH: '1',
+      ORCA_USER_DATA_PATH: userDataPath
+    },
+    // Recovery may copy large backups; the lock owner must finish or be explicitly terminated.
+    timeoutMs: null
+  })
+  const lines = response.stdout
+    .split(/\r?\n/)
+    .filter((line) => line.startsWith(PROFILE_STATE_RECOVERY_RESULT_PREFIX))
+  if (!response.outputTruncated && lines.length === 1) {
+    let parsed: unknown
+    try {
+      parsed = JSON.parse(lines[0].slice(PROFILE_STATE_RECOVERY_RESULT_PREFIX.length))
+    } catch {
+      throw new RuntimeClientError(
+        'runtime_error',
+        'Orca recovery returned an invalid response. Inspect retained recovery artifacts before retrying.'
+      )
+    }
+    const result = profileStateRecoveryResponseSchema.safeParse(parsed)
+    if (result.success) {
+      if (!result.data.ok) {
+        throw new RuntimeClientError(result.data.code, result.data.message)
+      }
+      if (response.code === 0 && !response.signal && !response.timedOut) {
+        return result.data.result
+      }
+    }
+  }
+  throw new RuntimeClientError(
+    'runtime_error',
+    'Orca recovery did not complete successfully. Inspect retained recovery artifacts before retrying.',
+    {
+      exitCode: response.code,
+      signal: response.signal,
+      timedOut: response.timedOut,
+      outputTruncated: response.outputTruncated ?? false,
+      stderr: response.stderr.trim().slice(-4096)
+    }
+  )
+}
diff --git a/src/cli/runtime/transport-framing.test.ts b/src/cli/runtime/transport-framing.test.ts
index cf3150f60c99..0f2c27b6a1bc 100644
--- a/src/cli/runtime/transport-framing.test.ts
+++ b/src/cli/runtime/transport-framing.test.ts
@@ -66,14 +66,16 @@ describe('CLI runtime response framing', () => {
     const pending = sendRequest(metadata, 'terminal.read', {}, 30000)
     const originalIndexOf = String.prototype.indexOf
     let searchedCharacters = 0
-    const search = vi
-      .spyOn(String.prototype, 'indexOf')
-      .mockImplementation(function (this: string, value, position) {
-        if (value === '\n') {
-          searchedCharacters += this.length - (position ?? 0)
-        }
-        return originalIndexOf.call(this, value, position)
-      })
+    const search = vi.spyOn(String.prototype, 'indexOf').mockImplementation(function (
+      this: string,
+      value,
+      position
+    ) {
+      if (value === '\n') {
+        searchedCharacters += this.length - (position ?? 0)
+      }
+      return originalIndexOf.call(this, value, position)
+    })
     try {
       for (let offset = 0; offset < encoded.length; offset += 256) {
         socket.emit('data', encoded.slice(offset, offset + 256))
diff --git a/src/cli/specs/index.ts b/src/cli/specs/index.ts
index ee9db22dc1a8..b817749f425c 100644
--- a/src/cli/specs/index.ts
+++ b/src/cli/specs/index.ts
@@ -18,6 +18,7 @@ import { VM_COMMAND_SPECS } from './vm'
 import { SKILL_COMMAND_SPECS } from './skills'
 import { ARTIFACT_COMMAND_SPECS } from './artifacts'
 import { SEARCH_COMMAND_SPECS } from './search'
+import { PROFILE_STATE_COMMAND_SPECS } from './profile-state'
 
 export const COMMAND_SPECS: CommandSpec[] = [
   ...CORE_COMMAND_SPECS,
@@ -38,5 +39,6 @@ export const COMMAND_SPECS: CommandSpec[] = [
   ...VM_COMMAND_SPECS,
   ...EMULATOR_COMMAND_SPECS,
   ...SKILL_COMMAND_SPECS,
-  ...SEARCH_COMMAND_SPECS
+  ...SEARCH_COMMAND_SPECS,
+  ...PROFILE_STATE_COMMAND_SPECS
 ]
diff --git a/src/cli/specs/profile-state.test.ts b/src/cli/specs/profile-state.test.ts
new file mode 100644
index 000000000000..53798b47de33
--- /dev/null
+++ b/src/cli/specs/profile-state.test.ts
@@ -0,0 +1,29 @@
+import { describe, expect, it } from 'vitest'
+import { parseArgs, validateCommandAndFlags } from '../args'
+import { PROFILE_STATE_COMMAND_SPECS } from './profile-state'
+
+describe('profile state rollback discovery', () => {
+  it.each([
+    { argv: ['profile', 'state', 'rollback', '--current-json'] },
+    { argv: ['--current-json', 'profile', 'state', 'rollback'] },
+    { argv: ['profile', '--current-json', 'state', 'rollback'] }
+  ])('parses the current JSON selector as a boolean: $argv', ({ argv }) => {
+    const parsed = parseArgs(argv)
+    expect(parsed.commandPath).toEqual(['profile', 'state', 'rollback'])
+    expect(parsed.flags.get('current-json')).toBe(true)
+    expect(() => validateCommandAndFlags(PROFILE_STATE_COMMAND_SPECS, parsed)).not.toThrow()
+  })
+
+  it('parses the current SQLite selector as a boolean', () => {
+    const parsed = parseArgs(['profile', 'state', 'rollback', '--current-sqlite'])
+    expect(parsed.flags.get('current-sqlite')).toBe(true)
+    expect(() => validateCommandAndFlags(PROFILE_STATE_COMMAND_SPECS, parsed)).not.toThrow()
+  })
+
+  it('explains that adoption selects one full state and preserves both copies', () => {
+    const spec = PROFILE_STATE_COMMAND_SPECS.find((item) => item.path.at(-1) === 'rollback')
+    expect(spec?.usage).toContain('--current-json')
+    expect(spec?.notes?.join('\n')).toContain('without merging; both copies are archived')
+    expect(spec?.examples).toContain('orca profile state rollback --current-json')
+  })
+})
diff --git a/src/cli/specs/profile-state.ts b/src/cli/specs/profile-state.ts
new file mode 100644
index 000000000000..89c9ed13315c
--- /dev/null
+++ b/src/cli/specs/profile-state.ts
@@ -0,0 +1,33 @@
+import type { CommandSpec } from '../args'
+import { GLOBAL_FLAGS } from '../args'
+
+export const PROFILE_STATE_COMMAND_SPECS: CommandSpec[] = [
+  {
+    path: ['profile', 'state', 'exports'],
+    summary: 'List retained SQLite backups and JSON exports for profile-state recovery',
+    usage: 'orca profile state exports [--json]',
+    allowedFlags: [...GLOBAL_FLAGS]
+  },
+  {
+    path: ['profile', 'state', 'rollback'],
+    destructive: true,
+    summary:
+      'Restore a SQLite backup or retained JSON export, or keep the current JSON or SQLite profile',
+    usage:
+      'orca profile state rollback (--backup <id> | --revision <revision> | --current-json | --current-sqlite) [--json]',
+    allowedFlags: [...GLOBAL_FLAGS, 'revision', 'backup', 'current-json', 'current-sqlite'],
+    notes: [
+      'Orca must be stopped. Recovery validates the selected artifact and archives the current database family, JSON, and retained recovery artifacts before replacing state.',
+      '--backup restores SQLite authority; --revision restores a JSON export for an older compatible runtime.',
+      '--current-json keeps the current orca-data.json, including edits from an older build. It replaces SQLite state without merging; both copies are archived. The next SQLite-capable start imports the selected JSON.',
+      '--current-sqlite keeps the current SQLite state and discards JSON edits from an older build. The JSON is archived, then rewritten from SQLite.'
+    ],
+    examples: [
+      'orca profile state exports',
+      'orca profile state rollback --backup <id>',
+      'orca profile state rollback --revision 1',
+      'orca profile state rollback --current-json',
+      'orca profile state rollback --current-sqlite'
+    ]
+  }
+]
diff --git a/src/cli/terminal-format.test.ts b/src/cli/terminal-format.test.ts
index 294fbc09ceeb..ee0a985441ea 100644
--- a/src/cli/terminal-format.test.ts
+++ b/src/cli/terminal-format.test.ts
@@ -57,6 +57,22 @@ describe('formatTerminalClose', () => {
     )
   })
 
+  it('promises the reconnect replay only when the host recorded the kill for it', () => {
+    const close = {
+      handle: 'term_remote',
+      tabId: 'tab-1',
+      ptyKilled: false,
+      ptyStopVerdict: 'unverifiable' as const,
+      ptyStopReason: 'SSH connection lost, reconnecting...'
+    }
+    expect(formatTerminalClose({ close: { ...close, pendingKillRecorded: true } })).toBe(
+      'Closed terminal term_remote. The PTY was not confirmed stopped: SSH connection lost, reconnecting... The kill retries when the host reconnects.'
+    )
+    expect(formatTerminalClose({ close })).toBe(
+      'Closed terminal term_remote. The PTY was not confirmed stopped: SSH connection lost, reconnecting...'
+    )
+  })
+
   it('names a PTY known to be live', () => {
     expect(
       formatTerminalClose({
diff --git a/src/cli/terminal-format.ts b/src/cli/terminal-format.ts
index 97e117b2229e..5a67a6413aae 100644
--- a/src/cli/terminal-format.ts
+++ b/src/cli/terminal-format.ts
@@ -1,4 +1,4 @@
-import { PTY_LIVE_NOTE, describeUnconfirmedStop } from '../shared/pty-liveness-verdict'
+import { PTY_LIVE_NOTE, describeUnconfirmedCloseStop } from '../shared/pty-liveness-verdict'
 import { describeTerminalWaitBlockedReason } from '../shared/terminal-wait-blocked-reason-legacy-alias'
 import { formatListingHostScope, type WithAnnotatedHostScope } from './omitted-host-scope-selectors'
 import type {
@@ -254,7 +254,7 @@ function describePtyStop(close: RuntimeTerminalClose): string {
     return ` ${PTY_LIVE_NOTE}`
   }
   if (close.ptyStopVerdict === 'unverifiable') {
-    return ` ${describeUnconfirmedStop(close.ptyStopReason ?? 'its host could not be reached')}`
+    return ` ${describeUnconfirmedCloseStop(close)}`
   }
   return ''
 }
diff --git a/src/main/__fixtures__/shell-wrapper-snapshots/local-bash-rcfile.txt b/src/main/__fixtures__/shell-wrapper-snapshots/local-bash-rcfile.txt
index a11d3e6183ef..a541bb9769b4 100644
--- a/src/main/__fixtures__/shell-wrapper-snapshots/local-bash-rcfile.txt
+++ b/src/main/__fixtures__/shell-wrapper-snapshots/local-bash-rcfile.txt
@@ -33,6 +33,13 @@ __orca_restore_agent_teams_path() {
   export PATH="${ORCA_AGENT_TEAMS_SHIM_DIR}:$PATH"
 }
 __orca_restore_agent_teams_path
+if [ -n "${ORCA_WSL_CLI_DIR:-}" ]; then
+  if [ -x "$ORCA_WSL_CLI_DIR/${ORCA_CLI_COMMAND:-}" ]; then
+    export PATH="$ORCA_WSL_CLI_DIR${PATH:+:$PATH}"
+  else
+    printf 'Orca CLI unavailable: cannot run %s. Check WSL Windows-drive mount options.\n' "$ORCA_WSL_CLI_DIR/${ORCA_CLI_COMMAND:-}" >&2
+  fi
+fi
 # Why: user startup files may set the default OpenCode config after Orca's
 # spawn env; restore the Orca-managed config dir before the first prompt.
 [[ -n "${ORCA_OPENCODE_CONFIG_DIR:-}" ]] && export OPENCODE_CONFIG_DIR="${ORCA_OPENCODE_CONFIG_DIR}"
diff --git a/src/main/__fixtures__/shell-wrapper-snapshots/local-zsh-zshenv.txt b/src/main/__fixtures__/shell-wrapper-snapshots/local-zsh-zshenv.txt
index 35a262b5e02a..674ac3a9e375 100644
--- a/src/main/__fixtures__/shell-wrapper-snapshots/local-zsh-zshenv.txt
+++ b/src/main/__fixtures__/shell-wrapper-snapshots/local-zsh-zshenv.txt
@@ -60,6 +60,13 @@ __orca_deferred_init() {
   else
     precmd_functions=(${precmd_functions:#__orca_deferred_init})
   fi
+  if [ -n "${ORCA_WSL_CLI_DIR:-}" ]; then
+    if [ -x "$ORCA_WSL_CLI_DIR/${ORCA_CLI_COMMAND:-}" ]; then
+      export PATH="$ORCA_WSL_CLI_DIR${PATH:+:$PATH}"
+    else
+      printf 'Orca CLI unavailable: cannot run %s. Check WSL Windows-drive mount options.\n' "$ORCA_WSL_CLI_DIR/${ORCA_CLI_COMMAND:-}" >&2
+    fi
+  fi
   if __orca_has_feature overlay; then
     # Why: ~/.zshrc can export the user's default OpenCode config after spawn.
     __orca_restore_agent_teams_path() {
diff --git a/src/main/active-view-persistence-boundary.test.ts b/src/main/active-view-persistence-boundary.test.ts
index 26bb25ac70ef..54112b2b08f1 100644
--- a/src/main/active-view-persistence-boundary.test.ts
+++ b/src/main/active-view-persistence-boundary.test.ts
@@ -1,3 +1,8 @@
+import {
+  closeTestStores,
+  createSqliteTestStore,
+  readPersistedStateJson
+} from './persistence-test-harness'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { mkdtempSync, readFileSync, rmSync } from 'node:fs'
 import { tmpdir } from 'node:os'
@@ -27,7 +32,8 @@ describe('active-view persistence boundary', () => {
     testState.dir = mkdtempSync(join(tmpdir(), 'orca-active-view-boundary-'))
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     vi.useRealTimers()
     rmSync(testState.dir, { recursive: true, force: true })
   })
@@ -37,9 +43,9 @@ describe('active-view persistence boundary', () => {
     vi.resetModules()
     const { Store } = await import('./persistence')
     const dataFile = join(testState.dir, 'orca-data.json')
-    const store = new Store({ dataFile })
+    const store = createSqliteTestStore(Store, { dataFile })
     store.flush()
-    const durableBefore = readFileSync(dataFile, 'utf-8')
+    const durableBefore = readPersistedStateJson(dataFile)
 
     store.updateUI({ activeView: 'settings' })
     vi.advanceTimersByTime(1_000)
@@ -49,10 +55,10 @@ describe('active-view persistence boundary', () => {
     const preferencePayload = readFileSync(preferenceFile, 'utf-8')
     expect(Buffer.byteLength(preferencePayload)).toBeLessThan(64)
     expect(JSON.parse(preferencePayload)).toEqual({ activeView: 'settings' })
-    expect(readFileSync(dataFile, 'utf-8')).toBe(durableBefore)
+    expect(readPersistedStateJson(dataFile)).toBe(durableBefore)
     expect(store.getUI().activeView).toBe('settings')
 
-    const reloaded = new Store({ dataFile })
+    const reloaded = createSqliteTestStore(Store, { dataFile })
     expect(reloaded.getUI().activeView).toBe('settings')
   })
 })
diff --git a/src/main/active-view-preference.ts b/src/main/active-view-preference.ts
index eb6098f8c1d5..41115306e95c 100644
--- a/src/main/active-view-preference.ts
+++ b/src/main/active-view-preference.ts
@@ -43,6 +43,7 @@ export class ActiveViewPreference {
   /** Set by flushAsync so the quit flush is the final write; see scheduleSave. */
   private quitFlushStarted = false
   private quitFlushPromise: Promise<void> | null = null
+  private maintenancePaused = false
 
   constructor(dataFile: string, legacyActiveView: unknown) {
     this.file = getActiveViewPreferenceFile(dataFile)
@@ -78,6 +79,9 @@ export class ActiveViewPreference {
       return
     }
     this.writeGeneration += 1
+    if (this.maintenancePaused) {
+      return
+    }
     if (this.writeTimer) {
       clearTimeout(this.writeTimer)
     }
@@ -246,4 +250,21 @@ export class ActiveViewPreference {
       await this.pendingWrite
     }
   }
+
+  pauseForMaintenance(): () => void {
+    if (this.maintenancePaused || this.quitFlushStarted) {
+      throw new Error('Active-view persistence is already paused')
+    }
+    this.maintenancePaused = true
+    if (this.writeTimer) {
+      clearTimeout(this.writeTimer)
+      this.writeTimer = null
+    }
+    return () => {
+      this.maintenancePaused = false
+      if (this.activeView !== this.persistedActiveView) {
+        this.scheduleSave()
+      }
+    }
+  }
 }
diff --git a/src/main/agent-auth-restart-preservation.test.ts b/src/main/agent-auth-restart-preservation.test.ts
index 700631280687..291d294d9ba5 100644
--- a/src/main/agent-auth-restart-preservation.test.ts
+++ b/src/main/agent-auth-restart-preservation.test.ts
@@ -151,12 +151,14 @@ describe('preserveAgentAuthBeforeRestart', () => {
     )
   })
 
-  it('flushes the store when auth services are missing', async () => {
+  it('checkpoints admitted state without waiting for ongoing edits when auth services are missing', async () => {
     const flushPendingOrThrowAsync = vi.fn()
 
     await preserveAgentAuthBeforeRestart({ store: { flushPendingOrThrowAsync } })
 
-    expect(flushPendingOrThrowAsync).toHaveBeenCalledTimes(1)
+    expect(flushPendingOrThrowAsync).toHaveBeenCalledExactlyOnceWith({
+      drainToStableGeneration: false
+    })
   })
 
   it('logs secret-free warnings and does not throw when sync fails', async () => {
diff --git a/src/main/agent-auth-restart-preservation.ts b/src/main/agent-auth-restart-preservation.ts
index a3e24ef8abed..d00641088cc2 100644
--- a/src/main/agent-auth-restart-preservation.ts
+++ b/src/main/agent-auth-restart-preservation.ts
@@ -44,7 +44,7 @@ export async function preserveAgentAuthBeforeRestart({
   const storePreservation = store
     ? runWithinLifecycleTimeout(
         'Store persistence',
-        () => store.flushPendingOrThrowAsync(),
+        () => store.flushPendingOrThrowAsync({ drainToStableGeneration: false }),
         remainingLifecycleTime(startedAt)
       )
     : Promise.resolve()
diff --git a/src/main/agent-hooks/installer-utils.test.ts b/src/main/agent-hooks/installer-utils.test.ts
index 40966c0f7251..1a4f087f19b6 100644
--- a/src/main/agent-hooks/installer-utils.test.ts
+++ b/src/main/agent-hooks/installer-utils.test.ts
@@ -638,6 +638,15 @@ describe('wrapWindowsHookCommand', () => {
     )
   })
 
+  it('doubles typographic single quotes in the script path literal', () => {
+    const decoded = decodeWindowsHookCommand(
+      wrapWindowsHookCommand('C:\\Users\\O\u2019Brien\\.orca\\agent-hooks\\codex-hook.cmd')
+    )
+    expect(decoded).toContain(
+      "Test-Path -LiteralPath 'C:\\Users\\O\u2019\u2019Brien\\.orca\\agent-hooks\\codex-hook.cmd'"
+    )
+  })
+
   it('scopes environment variables inside the encoded launcher', () => {
     const command = wrapWindowsHookCommand('C:\\hooks\\copilot-hook.ps1', {
       ORCA_COPILOT_HOOK_EVENT: 'UserPromptSubmit'
diff --git a/src/main/agent-hooks/installer-utils.ts b/src/main/agent-hooks/installer-utils.ts
index a1cd78776386..9eb23e44316e 100644
--- a/src/main/agent-hooks/installer-utils.ts
+++ b/src/main/agent-hooks/installer-utils.ts
@@ -12,6 +12,7 @@ import { homedir } from 'node:os'
 import { dirname, join } from 'node:path'
 import { randomUUID } from 'node:crypto'
 import type { AgentHookSource } from '../../shared/agent-hook-relay'
+import { quotePowerShellLiteral } from '../../shared/powershell-native-argument'
 import { grantDirAcl, isPermissionError } from '../win32-utils'
 import { resolveHooksJsonWritePath } from './hook-config-write-path'
 import { writeRollingFileBackup } from '../rolling-file-backup'
@@ -108,10 +109,6 @@ export function getSharedManagedScriptPath(scriptFileName: string): string {
 
 export { wrapPosixHookCommand } from './posix-hook-command'
 
-export function quotePowerShellString(value: string): string {
-  return `'${value.replaceAll("'", "''")}'`
-}
-
 export {
   wrapWindowsPowerShellEncodedCommand,
   WINDOWS_POWERSHELL_HOOK_SWITCHES
@@ -134,14 +131,14 @@ export function buildWindowsHookPowerShellCommand(
   options: { fallbackStdout?: string } = {}
 ): string {
   // Why: the encoded launcher protects paths across Windows shells and drains stdin when the config points at a missing script.
-  const quoted = quotePowerShellString(scriptPath)
+  const quoted = quotePowerShellLiteral(scriptPath)
   const envPrefix = Object.entries(env)
-    .map(([key, value]) => `$env:${key} = ${quotePowerShellString(value)}; `)
+    .map(([key, value]) => `$env:${key} = ${quotePowerShellLiteral(value)}; `)
     .join('')
   const fallback =
     options.fallbackStdout === undefined
       ? ''
-      : `Write-Output ${quotePowerShellString(options.fallbackStdout)}; `
+      : `Write-Output ${quotePowerShellLiteral(options.fallbackStdout)}; `
   // Why the order: answer first (a gate event reads silence as deny), then the shared
   // env guard, and only then own stdin — outside an Orca pane the caller may abandon the
   // pipe, and ReadToEnd would strand the launcher there forever (#11549).
@@ -323,7 +320,7 @@ export function writeHooksJson(
   config: Record<string, unknown>,
   // Why: `serialized` lets a JSONC config (Devin) supply text edited in place, so the
   // atomic write + rolling backup below stay shared instead of being reimplemented.
-  options?: { preserveMode?: boolean; serialized?: string }
+  options?: { preserveMode?: boolean; defaultMode?: number; serialized?: string }
 ): void {
   const writePath = resolveHooksJsonWritePath(configPath)
   const dir = dirname(writePath)
@@ -334,7 +331,9 @@ export function writeHooksJson(
   const tmpPath = join(dir, `.${Date.now()}-${randomUUID()}.tmp`)
   const serialized = options?.serialized ?? `${JSON.stringify(config, null, 2)}\n`
   const existingMode =
-    options?.preserveMode === true && existsSync(writePath) ? statSync(writePath).mode : undefined
+    options?.preserveMode === true && existsSync(writePath)
+      ? statSync(writePath).mode & 0o777
+      : options?.defaultMode
 
   // Why: skip the write (and therefore the .bak rotation) when the on-disk
   // content is already identical. Without this, every install() rewrites the
@@ -351,7 +350,11 @@ export function writeHooksJson(
   }
 
   try {
-    writeFileSync(tmpPath, serialized, { encoding: 'utf-8', mode: existingMode })
+    writeFileSync(tmpPath, serialized, { encoding: 'utf-8', mode: existingMode, flag: 'wx' })
+    if (existingMode !== undefined && process.platform !== 'win32') {
+      // Preserve requested permissions even with a stricter process umask.
+      chmodSync(tmpPath, existingMode)
+    }
     // Why: single rolling backup — one file, no accumulation in ~/.claude.
     // Protects against a merge-logic bug producing bad JSON; the original is
     // always recoverable from <configPath>.bak until the next write.
diff --git a/src/main/agent-hooks/managed-agent-hook-registry.ts b/src/main/agent-hooks/managed-agent-hook-registry.ts
index 560233e8363a..31513658035b 100644
--- a/src/main/agent-hooks/managed-agent-hook-registry.ts
+++ b/src/main/agent-hooks/managed-agent-hook-registry.ts
@@ -1,3 +1,4 @@
+import { qoderHookService } from '../qoder/hook-service'
 import type { AgentHookInstallStatus } from '../../shared/agent-hook-types'
 import type { HookInstallAgent } from '../../shared/telemetry-events'
 import { ampHookService } from '../amp/hook-service'
@@ -8,6 +9,7 @@ import { commandCodeHookService } from '../command-code/hook-service'
 import { copilotHookService } from '../copilot/hook-service'
 import { cursorHookService } from '../cursor/hook-service'
 import { devinHookService } from '../devin/hook-service'
+import { dshHookService } from '../dsh/hook-service'
 import { droidHookService } from '../droid/hook-service'
 import { geminiHookService } from '../gemini/hook-service'
 import { grokHookService } from '../grok/hook-service'
@@ -43,6 +45,7 @@ export const MANAGED_AGENT_HOOK_INSTALLERS: readonly ManagedAgentHookInstaller[]
   ['openclaude', () => openClaudeHookService.install()],
   ['codex', () => codexHookService.install()],
   ['gemini', () => geminiHookService.install()],
+  ['qoder', () => qoderHookService.install()],
   ['antigravity', () => antigravityHookService.install()],
   ['amp', () => ampHookService.install()],
   ['cursor', () => cursorHookService.install()],
@@ -54,7 +57,8 @@ export const MANAGED_AGENT_HOOK_INSTALLERS: readonly ManagedAgentHookInstaller[]
   ['devin', () => devinHookService.install()],
   ['kimi', () => kimiHookService.install()],
   ['muse', () => museHookService.install()],
-  ['zcode', () => zcodeHookService.install()]
+  ['zcode', () => zcodeHookService.install()],
+  ['dsh', () => dshHookService.install()]
 ]
 
 // Why: covers the shared launcher/statusline scripts under ~/.orca/agent-hooks — the files a
@@ -68,6 +72,7 @@ export const MANAGED_AGENT_HOOK_SCRIPT_REFRESHERS: readonly ManagedAgentHookScri
   ['openclaude', () => openClaudeHookService.refreshManagedScripts()],
   ['codex', () => codexHookService.refreshManagedScripts()],
   ['gemini', () => geminiHookService.refreshManagedScripts()],
+  ['qoder', () => qoderHookService.refreshManagedScripts()],
   ['antigravity', () => antigravityHookService.refreshManagedScripts()],
   ['cursor', () => cursorHookService.refreshManagedScripts()],
   ['droid', () => droidHookService.refreshManagedScripts()],
@@ -77,7 +82,8 @@ export const MANAGED_AGENT_HOOK_SCRIPT_REFRESHERS: readonly ManagedAgentHookScri
   ['devin', () => devinHookService.refreshManagedScripts()],
   ['kimi', () => kimiHookService.refreshManagedScripts()],
   ['muse', () => museHookService.refreshManagedScripts()],
-  ['zcode', () => zcodeHookService.refreshManagedScripts()]
+  ['zcode', () => zcodeHookService.refreshManagedScripts()],
+  ['dsh', () => dshHookService.refreshManagedScripts()]
 ]
 
 export const MANAGED_AGENT_HOOK_REMOVERS: readonly ManagedAgentHookRemover[] = [
@@ -85,6 +91,7 @@ export const MANAGED_AGENT_HOOK_REMOVERS: readonly ManagedAgentHookRemover[] = [
   ['openclaude', () => openClaudeHookService.remove()],
   ['codex', () => codexHookService.remove()],
   ['gemini', () => geminiHookService.remove()],
+  ['qoder', () => qoderHookService.remove()],
   ['antigravity', () => antigravityHookService.remove()],
   ['amp', () => ampHookService.remove()],
   ['cursor', () => cursorHookService.remove()],
@@ -96,7 +103,8 @@ export const MANAGED_AGENT_HOOK_REMOVERS: readonly ManagedAgentHookRemover[] = [
   ['devin', () => devinHookService.remove()],
   ['kimi', () => kimiHookService.remove()],
   ['muse', () => museHookService.remove()],
-  ['zcode', () => zcodeHookService.remove()]
+  ['zcode', () => zcodeHookService.remove()],
+  ['dsh', () => dshHookService.remove()]
 ]
 
 export const MANAGED_AGENT_HOOK_ASYNC_REMOVERS: readonly ManagedAgentHookAsyncRemover[] = [
@@ -108,6 +116,7 @@ export const MANAGED_AGENT_HOOK_STATUS_READERS: readonly ManagedAgentHookStatusR
   ['openclaude', () => openClaudeHookService.getStatus()],
   ['codex', () => codexHookService.getStatus()],
   ['gemini', () => geminiHookService.getStatus()],
+  ['qoder', () => qoderHookService.getStatus()],
   ['antigravity', () => antigravityHookService.getStatus()],
   ['amp', () => ampHookService.getStatus()],
   ['cursor', () => cursorHookService.getStatus()],
@@ -119,5 +128,6 @@ export const MANAGED_AGENT_HOOK_STATUS_READERS: readonly ManagedAgentHookStatusR
   ['devin', () => devinHookService.getStatus()],
   ['kimi', () => kimiHookService.getStatus()],
   ['muse', () => museHookService.getStatus()],
-  ['zcode', () => zcodeHookService.getStatus()]
+  ['zcode', () => zcodeHookService.getStatus()],
+  ['dsh', () => dshHookService.getStatus()]
 ]
diff --git a/src/main/agent-hooks/managed-hook-command-contract.test.ts b/src/main/agent-hooks/managed-hook-command-contract.test.ts
index 774e9396c251..b3166a6c90e7 100644
--- a/src/main/agent-hooks/managed-hook-command-contract.test.ts
+++ b/src/main/agent-hooks/managed-hook-command-contract.test.ts
@@ -22,6 +22,7 @@ import {
 import { getDevinManagedCommand, getDevinRemoteManagedCommand } from '../devin/hook-settings'
 import { getGrokManagedCommand } from '../grok/grok-hook-script'
 import { getMuseManagedCommand, getMuseRemoteManagedCommand } from '../muse/hook-settings'
+import { getDshManagedCommand, getDshRemoteManagedCommand } from '../dsh/hook-settings'
 import { getZCodeManagedCommand, getZCodeRemoteManagedCommand } from '../zcode/hook-settings'
 import {
   wrapPosixHookCommand,
@@ -81,6 +82,20 @@ const buildersByAgent = new Map<string, CommandBuilders>([
       remote: (path) => [getClaudeRemoteCommand(path)]
     }
   ],
+  [
+    'qoder',
+    {
+      local: (path) => [
+        getManagedLifecycleHook(path, {
+          configDirName: '.qoder',
+          scriptBaseName: 'qoder-hook',
+          usesWindowsCompatLauncher: true,
+          windowsHookShell: 'powershell'
+        }).command
+      ],
+      remote: (path) => [getClaudeRemoteCommand(path)]
+    }
+  ],
   [
     'codex',
     {
@@ -151,6 +166,13 @@ const buildersByAgent = new Map<string, CommandBuilders>([
       remote: (path) => [getMuseRemoteManagedCommand(path)]
     }
   ],
+  [
+    'dsh',
+    {
+      local: (path) => [getDshManagedCommand(path)],
+      remote: (path) => [getDshRemoteManagedCommand(path)]
+    }
+  ],
   [
     'zcode',
     {
@@ -198,10 +220,15 @@ describe('managed hook command contract', () => {
       expect(commands.length).toBeGreaterThan(0)
       for (const command of commands) {
         expect(command.length).toBeGreaterThan(0)
-        // Native Windows Codex evaluates PowerShell variables without Grok's dollar-byte scanner.
+        // Native PowerShell hooks evaluate these variables without Grok's dollar-byte scanner.
         const scannedCommand =
-          agent === 'codex' && platform === 'win32' && command.startsWith('if (Test-Path')
-            ? command.replaceAll('$LASTEXITCODE', '').replaceAll('$env:', '')
+          platform === 'win32' &&
+          ((agent === 'codex' && command.startsWith('if (Test-Path')) ||
+            (agent === 'qoder' && command.startsWith('$scriptPath = Join-Path')))
+            ? command
+                .replaceAll('$LASTEXITCODE', '')
+                .replaceAll('$env:', '')
+                .replaceAll('$scriptPath', '')
             : command
         expect(findBareHookCommandVariables(scannedCommand), command).toEqual([])
       }
diff --git a/src/main/agent-hooks/managed-hooks-json-events.ts b/src/main/agent-hooks/managed-hooks-json-events.ts
new file mode 100644
index 000000000000..bff2bbf69429
--- /dev/null
+++ b/src/main/agent-hooks/managed-hooks-json-events.ts
@@ -0,0 +1,38 @@
+import { isPlainObject } from './installer-utils'
+
+/**
+ * Which of `events` an Orca-owned `{ hooks: { <event>: [{ hooks: [{ command }] }] } }` file
+ * still registers under a managed command.
+ *
+ * Shared by every agent whose managed hooks file Orca generates wholesale (Muse, DSH), so
+ * "installed", "partial" and "not_installed" cannot drift between them.
+ *
+ * Why every lookup is guarded: the file is on disk and hand-editable, so any node can be
+ * null, a scalar, or the wrong container. A malformed node reads as "event absent" — status
+ * calculation must report a broken install, never throw on it.
+ */
+export function readManagedHookEventsFromJson(
+  parsed: unknown,
+  events: readonly string[],
+  isManagedCommand: (command: string | undefined) => boolean
+): Set<string> {
+  const hooks = isPlainObject(parsed) && isPlainObject(parsed.hooks) ? parsed.hooks : {}
+  return new Set(
+    events.filter((event) =>
+      asArray(hooks[event]).some((definition) =>
+        asArray(isPlainObject(definition) ? definition.hooks : null).some((hook) =>
+          isManagedCommand(readCommand(hook))
+        )
+      )
+    )
+  )
+}
+
+function asArray(value: unknown): readonly unknown[] {
+  return Array.isArray(value) ? value : []
+}
+
+function readCommand(hook: unknown): string | undefined {
+  const command = isPlainObject(hook) ? hook.command : undefined
+  return typeof command === 'string' ? command : undefined
+}
diff --git a/src/main/agent-hooks/opencode-plugin-settings.ts b/src/main/agent-hooks/opencode-plugin-settings.ts
new file mode 100644
index 000000000000..7f1f884e3316
--- /dev/null
+++ b/src/main/agent-hooks/opencode-plugin-settings.ts
@@ -0,0 +1,26 @@
+import type { PluginSources } from '../../relay/plugin-overlay'
+import { isTuiAgentEnabled } from '../../shared/tui-agent-selection'
+import { isAgentStatusHooksEnabled } from './managed-agent-hook-controls'
+import type { ManagedHookDetectionSettings } from './managed-hook-detection-commands'
+
+function enabled(settings: ManagedHookDetectionSettings, agent: 'opencode' | 'opencode2'): boolean {
+  return (
+    isAgentStatusHooksEnabled(settings) && isTuiAgentEnabled(agent, settings?.disabledTuiAgents)
+  )
+}
+
+export function openCodePluginSettingsKey(settings: ManagedHookDetectionSettings): string {
+  return `${enabled(settings, 'opencode')}:${enabled(settings, 'opencode2')}`
+}
+
+export function selectOpenCodePluginSources(
+  sources: PluginSources,
+  settings: ManagedHookDetectionSettings
+): PluginSources {
+  // Older relays retain omitted sources; an empty string replaces the cache and cannot write a plugin.
+  return {
+    ...sources,
+    opencodePluginSource: enabled(settings, 'opencode') ? sources.opencodePluginSource : '',
+    opencode2PluginSource: enabled(settings, 'opencode2') ? sources.opencode2PluginSource : ''
+  }
+}
diff --git a/src/main/agent-hooks/remote-hook-service-installers.test.ts b/src/main/agent-hooks/remote-hook-service-installers.test.ts
index 148d5f719d75..f3cc23937b4d 100644
--- a/src/main/agent-hooks/remote-hook-service-installers.test.ts
+++ b/src/main/agent-hooks/remote-hook-service-installers.test.ts
@@ -1,3 +1,4 @@
+import { qoderHookService } from '../qoder/hook-service'
 import { describe, expect, it, vi } from 'vitest'
 import { parse as parseJsonc } from 'jsonc-parser'
 import type { SFTPWrapper } from 'ssh2'
@@ -685,6 +686,18 @@ describe('remote hook service installers', () => {
     expect(fs.modes.get('/home/dev/.orca/agent-hooks/copilot-hook.sh')).toBe(0o755)
   })
 
+  it('installs Qoder on the execution host with its own event endpoint', async () => {
+    const { sftp, fs } = createFakeSftp()
+    const result = await qoderHookService.installRemote(sftp, '/home/dev/')
+    expect(result.state).toBe('installed')
+    expect(result.configPath).toBe('/home/dev/.qoder/settings.json')
+    const settings = JSON.parse(fs.files.get(result.configPath) ?? '{}')
+    expect(settings.hooks.SessionEnd).toHaveLength(1)
+    expect(settings.hooks.Notification).toHaveLength(1)
+    expect(settings.hooks.TeammateIdle).toBeUndefined()
+    expect(fs.files.get('/home/dev/.orca/agent-hooks/qoder-hook.sh')).toContain('/hook/qoder')
+  })
+
   it('installs Droid and Copilot when running the aggregate remote installer (issue #7253)', async () => {
     const { sftp } = createFakeSftp()
     const results = await installRemoteManagedAgentHooks(sftp, '/home/dev', {
diff --git a/src/main/agent-hooks/remote-hook-service-registry-coverage.test.ts b/src/main/agent-hooks/remote-hook-service-registry-coverage.test.ts
index f145ebc9be8e..f9ff9c232e02 100644
--- a/src/main/agent-hooks/remote-hook-service-registry-coverage.test.ts
+++ b/src/main/agent-hooks/remote-hook-service-registry-coverage.test.ts
@@ -19,8 +19,10 @@ import { geminiHookService } from '../gemini/hook-service'
 import { grokHookService } from '../grok/hook-service'
 import { hermesHookService } from '../hermes/hook-service'
 import { kimiHookService } from '../kimi/hook-service'
+import { dshHookService } from '../dsh/hook-service'
 import { museHookService } from '../muse/hook-service'
 import { openClaudeHookService } from '../openclaude/hook-service'
+import { qoderHookService } from '../qoder/hook-service'
 import { zcodeHookService } from '../zcode/hook-service'
 import { MANAGED_AGENT_HOOK_INSTALLERS } from './managed-agent-hook-controls'
 import { REMOTE_MANAGED_HOOK_INSTALLER_AGENTS } from './remote-managed-hook-installers'
@@ -50,7 +52,9 @@ describe('remote hook service registry coverage', () => {
       ['devin', devinHookService],
       ['kimi', kimiHookService],
       ['muse', museHookService],
-      ['zcode', zcodeHookService]
+      ['qoder', qoderHookService],
+      ['zcode', zcodeHookService],
+      ['dsh', dshHookService]
     ])
 
     // Guard against a service silently missing from the map above as new agents land.
diff --git a/src/main/agent-hooks/remote-managed-hook-installers.ts b/src/main/agent-hooks/remote-managed-hook-installers.ts
index 1f42bdd68a6b..272e330be113 100644
--- a/src/main/agent-hooks/remote-managed-hook-installers.ts
+++ b/src/main/agent-hooks/remote-managed-hook-installers.ts
@@ -1,3 +1,4 @@
+import { qoderHookService } from '../qoder/hook-service'
 import type { SFTPWrapper } from 'ssh2'
 import type { AgentHookInstallStatus, AgentHookTarget } from '../../shared/agent-hook-types'
 import { ampHookService } from '../amp/hook-service'
@@ -13,6 +14,7 @@ import { droidHookService } from '../droid/hook-service'
 import { grokHookService } from '../grok/hook-service'
 import { hermesHookService } from '../hermes/hook-service'
 import { kimiHookService } from '../kimi/hook-service'
+import { dshHookService } from '../dsh/hook-service'
 import { museHookService } from '../muse/hook-service'
 import { zcodeHookService } from '../zcode/hook-service'
 import { openClaudeHookService } from '../openclaude/hook-service'
@@ -61,6 +63,7 @@ const REMOTE_MANAGED_HOOK_INSTALLERS: readonly RemoteManagedHookInstaller[] = [
       })
   ],
   ['gemini', (sftp, remoteHome) => geminiHookService.installRemote(sftp, remoteHome)],
+  ['qoder', (sftp, remoteHome) => qoderHookService.installRemote(sftp, remoteHome)],
   ['antigravity', (sftp, remoteHome) => antigravityHookService.installRemote(sftp, remoteHome)],
   ['amp', (sftp, remoteHome) => ampHookService.installRemote(sftp, remoteHome)],
   ['cursor', (sftp, remoteHome) => cursorHookService.installRemote(sftp, remoteHome)],
@@ -76,7 +79,8 @@ const REMOTE_MANAGED_HOOK_INSTALLERS: readonly RemoteManagedHookInstaller[] = [
   ['devin', (sftp, remoteHome) => devinHookService.installRemote(sftp, remoteHome)],
   ['kimi', (sftp, remoteHome) => kimiHookService.installRemote(sftp, remoteHome)],
   ['muse', (sftp, remoteHome) => museHookService.installRemote(sftp, remoteHome)],
-  ['zcode', (sftp, remoteHome) => zcodeHookService.installRemote(sftp, remoteHome)]
+  ['zcode', (sftp, remoteHome) => zcodeHookService.installRemote(sftp, remoteHome)],
+  ['dsh', (sftp, remoteHome) => dshHookService.installRemote(sftp, remoteHome)]
 ]
 
 /** Agents wired into the remote (SSH) hook installer. Exported so an invariant
diff --git a/src/main/agent-hooks/server-opencode-binder.test.ts b/src/main/agent-hooks/server-opencode-binder.test.ts
index 59d1c9142feb..328dc98c04c6 100644
--- a/src/main/agent-hooks/server-opencode-binder.test.ts
+++ b/src/main/agent-hooks/server-opencode-binder.test.ts
@@ -70,7 +70,13 @@ describe('opencode binder loop', () => {
         { paneKey: PANE_A, directory: DIR, worktreeId: `repo::${DIR}`, shellPid: 111 }
       ],
       sweep: async () => [
-        { pid: 112, ppid: 111, startedAtMs: Date.now() - 120_000, executable: 'opencode', argv: ['opencode'] }
+        {
+          pid: 112,
+          ppid: 111,
+          startedAtMs: Date.now() - 120_000,
+          executable: 'opencode',
+          argv: ['opencode']
+        }
       ]
     })
   })
diff --git a/src/main/agent-hooks/server-retired-pane-new-turn.test.ts b/src/main/agent-hooks/server-retired-pane-new-turn.test.ts
index d38f6c836c71..a405199a6e76 100644
--- a/src/main/agent-hooks/server-retired-pane-new-turn.test.ts
+++ b/src/main/agent-hooks/server-retired-pane-new-turn.test.ts
@@ -22,6 +22,7 @@ afterEach(() => vi.restoreAllMocks())
  *  classifier names no boundary for that source. That is not the same as "can never revive":
  *  mimo-code's boundary is an explicit-prompt MessagePart, which the gate handles separately. */
 const NEW_TURN_EVENT: Record<AgentHookSource, string | null> = {
+  qoder: 'SessionStart',
   claude: 'SessionStart',
   kimi: 'UserPromptSubmit',
   codex: 'SessionStart',
@@ -42,7 +43,8 @@ const NEW_TURN_EVENT: Record<AgentHookSource, string | null> = {
   'mimo-code': null,
   'command-code': null,
   muse: 'UserPromptSubmit',
-  zcode: 'SessionStart'
+  zcode: 'SessionStart',
+  dsh: 'SessionStart'
 }
 
 function reviveRetiredPane(source: unknown, hookEventName: string): boolean {
diff --git a/src/main/agent-hooks/server/server-ingest-structured.ts b/src/main/agent-hooks/server/server-ingest-structured.ts
index 5a5e2ce5ecfd..19ee70e88af3 100644
--- a/src/main/agent-hooks/server/server-ingest-structured.ts
+++ b/src/main/agent-hooks/server/server-ingest-structured.ts
@@ -11,7 +11,8 @@ import {
 } from '../../../shared/structured-agent-session-projection'
 import {
   continueMainAgentStatus,
-  isAgentStatusHeldOpenByChildWork
+  isAgentStatusHeldOpenByChildWork,
+  mainAgentTurnInterrupted
 } from '../../../shared/agent-lead-status-fold'
 import { structuredAgentSessionAgentStatus } from '../../../shared/structured-agent-session-agent-status'
 import {
@@ -73,6 +74,8 @@ export abstract class AgentHookServerIngestStructured extends AgentHookServerIng
       state,
       ...(workingMode ? { workingMode } : {}),
       mainAgent,
+      // Readers that predate `mainAgent` read a cancellation off this flag, as the hook lanes publish it.
+      interrupted: mainAgentTurnInterrupted(mainAgent),
       prompt: summary.latestPrompt,
       agentType: summary.agent,
       ...(summary.model ? { model: summary.model } : {}),
diff --git a/src/main/agent-hooks/wsl-guest-plugin-install.ts b/src/main/agent-hooks/wsl-guest-plugin-install.ts
index 80b98bed6f4c..40bf43ce0247 100644
--- a/src/main/agent-hooks/wsl-guest-plugin-install.ts
+++ b/src/main/agent-hooks/wsl-guest-plugin-install.ts
@@ -4,11 +4,14 @@
 // Mirrors the SSH relay's installPluginsOnRelay swallow list.
 import type { SshChannelMultiplexer } from '../ssh/ssh-channel-multiplexer'
 import { AGENT_HOOK_INSTALL_PLUGINS_METHOD } from '../../shared/agent-hook-relay'
+import { selectOpenCodePluginSources } from './opencode-plugin-settings'
+import type { ManagedHookDetectionSettings } from './managed-hook-detection-commands'
 import type { PluginSources } from '../../relay/plugin-overlay'
 
 /** Structural, not the deps type itself, so this stays free of the deps module. */
 type GuestPluginInstallDeps = {
   pluginSources: () => PluginSources
+  managedHookSettings?: () => ManagedHookDetectionSettings
   warn: (message: string) => void
 }
 
@@ -29,7 +32,7 @@ export async function requestGuestOpenCodeOverlayDir(
   try {
     // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Runtime validation or the local test fixture establishes the asserted shape.
     const res = (await mux.request(AGENT_HOOK_INSTALL_PLUGINS_METHOD, {
-      ...deps.pluginSources(),
+      ...selectOpenCodePluginSources(deps.pluginSources(), deps.managedHookSettings?.() ?? null),
       ...(launchKind ? { launchKind } : {})
     })) as {
       overlayDirs?: { opencode?: unknown; opencode2?: unknown; pi?: unknown; omp?: unknown }
diff --git a/src/main/agent-hooks/wsl-hook-relay-guest-install.ts b/src/main/agent-hooks/wsl-hook-relay-guest-install.ts
index 103a5e9909b5..87e29f2d414d 100644
--- a/src/main/agent-hooks/wsl-hook-relay-guest-install.ts
+++ b/src/main/agent-hooks/wsl-hook-relay-guest-install.ts
@@ -8,6 +8,7 @@ import { requestGuestOpenCodeOverlayDir } from './wsl-guest-plugin-install'
 import { installWslGuestHooks } from './wsl-hook-fs-adapter'
 import { REINSTALL_MIN_INTERVAL_MS, type WslHookRelayManagerDeps } from './wsl-hook-relay-deps'
 import type { SshChannelMultiplexer } from '../ssh/ssh-channel-multiplexer'
+import { openCodePluginSettingsKey } from './opencode-plugin-settings'
 import type { PluginSources } from '../../relay/plugin-overlay'
 
 /** Structural slice of WslHookRelayManagerDeps — only what an install pass uses. */
@@ -30,6 +31,10 @@ type GuestInstallState = {
   piAgentDir?: string
   ompStatusExtension?: string
   lastInstallAt?: number
+  lastOpenCodeSettings?: string
+  // Failed attempts throttle retries without claiming the guest accepted those settings.
+  lastAttemptOpenCodeSettings?: string
+  lastInstallMux?: SshChannelMultiplexer
   launchKinds?: Set<'pi' | 'omp'>
   installation?: Promise<void>
 }
@@ -52,11 +57,17 @@ export async function runWslRelayGuestInstall(
   if (state.installation) {
     return state.installation
   }
-  state.installation = installGuestHooksAndPlugins(deps, state, mux, guestHome)
+  // Publish ownership before an installer can re-enter the ensure path.
+  const installation = Promise.resolve().then(() =>
+    installGuestHooksAndPlugins(deps, state, mux, guestHome)
+  )
+  state.installation = installation
   try {
-    await state.installation
+    await installation
   } finally {
-    state.installation = undefined
+    if (state.installation === installation) {
+      state.installation = undefined
+    }
   }
 }
 
@@ -66,7 +77,15 @@ async function installGuestHooksAndPlugins(
   mux: SshChannelMultiplexer,
   guestHome: string
 ): Promise<void> {
+  if (state.mux !== mux || mux.isDisposed()) {
+    return
+  }
+  if (state.lastInstallMux !== mux) {
+    state.lastOpenCodeSettings = undefined
+  }
+  state.lastInstallMux = mux
   state.lastInstallAt = Date.now()
+  state.lastAttemptOpenCodeSettings = openCodePluginSettingsKey(deps.managedHookSettings())
   await installWslGuestHooks({
     mux,
     guestHome,
@@ -81,11 +100,27 @@ async function installGuestHooksAndPlugins(
   // PTY env points OPENCODE_CONFIG_DIR at; identity-guarded against teardown.
   const kinds = requestedKinds(state)
   for (const kind of kinds) {
-    const overlay = await requestGuestOpenCodeOverlayDir(mux, deps, state.distro, kind)
-    if (state.mux !== mux) {
+    if (state.mux !== mux || mux.isDisposed()) {
+      return
+    }
+    const currentSettings = deps.managedHookSettings()
+    const settings = currentSettings && {
+      ...currentSettings,
+      disabledTuiAgents: currentSettings.disabledTuiAgents?.slice()
+    }
+    const settingsKey = openCodePluginSettingsKey(settings)
+    state.lastAttemptOpenCodeSettings = settingsKey
+    const overlay = await requestGuestOpenCodeOverlayDir(
+      mux,
+      { ...deps, managedHookSettings: () => settings },
+      state.distro,
+      kind
+    )
+    if (state.mux !== mux || mux.isDisposed()) {
       return
     }
     if (overlay.kind !== 'unavailable') {
+      state.lastOpenCodeSettings = settingsKey
       state.opencodeOverlayDir = overlay.kind === 'dir' ? overlay.dir : undefined
       state.opencode2OverlayDir = overlay.kind === 'dir' ? overlay.dir2 : undefined
       if (kind === 'pi') {
@@ -102,25 +137,34 @@ export async function maybeRerunWslRelayGuestInstall(
   deps: GuestInstallDeps,
   state: GuestInstallState
 ): Promise<void> {
-  if (state.installation) {
-    await state.installation
-    return
-  }
-  const mux = state.mux
-  const guestHome = state.guestHome
-  if (
-    !mux ||
-    !guestHome ||
-    mux.isDisposed() ||
-    Date.now() - (state.lastInstallAt ?? 0) < REINSTALL_MIN_INTERVAL_MS
-  ) {
-    return
-  }
-  try {
-    // Why: the pass also re-ships the plugin source, so a mid-session Orca upgrade refreshes it.
-    await runWslRelayGuestInstall(deps, state, mux, guestHome)
-  } catch (err) {
-    const detail = err instanceof Error ? err.message : String(err)
-    deps.warn(`[agent-hooks] WSL hook reinstall for '${state.distro}' failed: ${detail}`)
+  let waited = false
+  // Every settled pass can expose newer settings or another waiter's task.
+  for (;;) {
+    try {
+      if (state.installation) {
+        waited = true
+        await state.installation
+        continue
+      }
+      const mux = state.mux
+      const guestHome = state.guestHome
+      const settingsKey = openCodePluginSettingsKey(deps.managedHookSettings())
+      if (
+        !mux ||
+        !guestHome ||
+        mux.isDisposed() ||
+        (state.lastInstallMux === mux &&
+          (waited || Date.now() - (state.lastInstallAt ?? 0) < REINSTALL_MIN_INTERVAL_MS) &&
+          (state.lastOpenCodeSettings === settingsKey ||
+            state.lastAttemptOpenCodeSettings === settingsKey))
+      ) {
+        return
+      }
+      waited = true
+      await runWslRelayGuestInstall(deps, state, mux, guestHome)
+    } catch (err) {
+      const detail = err instanceof Error ? err.message : String(err)
+      deps.warn(`[agent-hooks] WSL hook reinstall for '${state.distro}' failed: ${detail}`)
+    }
   }
 }
diff --git a/src/main/agent-hooks/wsl-hook-relay-state.ts b/src/main/agent-hooks/wsl-hook-relay-state.ts
index 509231b97d9d..2648280adddd 100644
--- a/src/main/agent-hooks/wsl-hook-relay-state.ts
+++ b/src/main/agent-hooks/wsl-hook-relay-state.ts
@@ -21,4 +21,7 @@ export type WslRelayDistroState = {
   restartTimer?: ReturnType<typeof setTimeout>
   reinstallTimer?: ReturnType<typeof setTimeout>
   lastInstallAt?: number
+  lastOpenCodeSettings?: string
+  lastAttemptOpenCodeSettings?: string
+  lastInstallMux?: SshChannelMultiplexer
 }
diff --git a/src/main/agent-hooks/wsl-opencode-install-race.test.ts b/src/main/agent-hooks/wsl-opencode-install-race.test.ts
new file mode 100644
index 000000000000..ccb8e79a445d
--- /dev/null
+++ b/src/main/agent-hooks/wsl-opencode-install-race.test.ts
@@ -0,0 +1,326 @@
+import { afterEach, beforeEach, expect, it, vi } from 'vitest'
+import { mkdirSync, mkdtempSync, readFileSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import type { TuiAgent } from '../../shared/tui-agent'
+import { RelayDispatcher } from '../../relay/dispatcher'
+import { PluginOverlayManager } from '../../relay/plugin-overlay'
+import { createInstallPluginsHandler } from '../../relay/wsl-install-plugins-handler'
+import { SshChannelMultiplexer } from '../ssh/ssh-channel-multiplexer'
+import { AGENT_HOOK_INSTALL_PLUGINS_METHOD } from '../../shared/agent-hook-relay'
+import {
+  maybeRerunWslRelayGuestInstall,
+  runWslRelayGuestInstall
+} from './wsl-hook-relay-guest-install'
+import type { WslRelayDistroState } from './wsl-hook-relay-state'
+import { REINSTALL_MIN_INTERVAL_MS } from './wsl-hook-relay-deps'
+
+function heldRequest() {
+  const reached = Promise.withResolvers<void>()
+  const release = Promise.withResolvers<void>()
+  return {
+    reached: reached.promise,
+    release: release.resolve,
+    wait: async () => {
+      reached.resolve()
+      await release.promise
+    }
+  }
+}
+
+let root: string
+let state: WslRelayDistroState
+let settings: { disabledTuiAgents: TuiAgent[] }
+let guests: { mux: SshChannelMultiplexer; dispatcher: RelayDispatcher }[]
+const sources = { opencodePluginSource: '// v1', opencode2PluginSource: '// v2' }
+const deps = {
+  pluginSources: () => sources,
+  managedHookSettings: () => settings,
+  installHooks: vi.fn(async () => []),
+  installCodex: async () => null,
+  warn: vi.fn<(message: string) => void>()
+}
+
+function createGuest(name: string, beforeInstall?: (index: number) => Promise<void>) {
+  const home = join(root, name)
+  mkdirSync(join(home, '.config', 'opencode'), { recursive: true })
+  const callbacks: ((data: Buffer) => void)[] = []
+  const dispatcher = new RelayDispatcher((data) => callbacks.forEach((callback) => callback(data)))
+  const mux = new SshChannelMultiplexer({
+    write: (data) => dispatcher.feed(data),
+    onData: (callback) => {
+      callbacks.push(callback)
+    },
+    onClose: () => {}
+  })
+  const install = createInstallPluginsHandler(new PluginOverlayManager({ homeDir: home }), {
+    HOME: home,
+    XDG_CONFIG_HOME: join(home, '.config'),
+    ORCA_WSL_HOOK_INSTANCE: name
+  })
+  const requests: Record<string, unknown>[] = []
+  dispatcher.onRequest('preflight.detectAgents', async () => ({ agents: [] }))
+  dispatcher.onRequest(AGENT_HOOK_INSTALL_PLUGINS_METHOD, async (params) => {
+    requests.push(params)
+    await beforeInstall?.(requests.length)
+    return install(params)
+  })
+  const guest = { home, mux, dispatcher, requests }
+  guests.push(guest)
+  return guest
+}
+
+function connect(guest: ReturnType<typeof createGuest>) {
+  state.mux = guest.mux
+  state.guestHome = guest.home
+}
+
+beforeEach(() => {
+  root = mkdtempSync(join(tmpdir(), 'orca-wsl-install-race-'))
+  guests = []
+  settings = { disabledTuiAgents: [] }
+  deps.installHooks.mockReset().mockResolvedValue([])
+  deps.warn.mockReset()
+  state = {
+    distro: 'fixture',
+    phase: 'running',
+    launchKinds: new Set(),
+    failures: 0,
+    cooldownUntil: 0
+  }
+})
+afterEach(() => {
+  vi.restoreAllMocks()
+  for (const guest of guests) {
+    guest.mux.dispose()
+    guest.dispatcher.dispose()
+  }
+  rmSync(root, { recursive: true, force: true })
+})
+
+it.each([true, false])('coalesces waiters through a held %s enablement toggle', async (enabled) => {
+  const first = heldRequest()
+  const second = heldRequest()
+  const guest = createGuest('guest', (index) => (index === 1 ? first.wait() : second.wait()))
+  connect(guest)
+  settings.disabledTuiAgents = enabled ? [] : ['opencode', 'opencode2']
+  const initial = runWslRelayGuestInstall(deps, state, guest.mux, guest.home)
+  await first.reached
+  settings.disabledTuiAgents = enabled ? ['opencode', 'opencode2'] : []
+  let settled = 0
+  const waiters = Array.from({ length: 4 }, () =>
+    maybeRerunWslRelayGuestInstall(deps, state).then(() => {
+      settled++
+    })
+  )
+  first.release()
+  await vi.waitFor(() => expect(guest.requests).toHaveLength(2), { timeout: 1000 })
+  await second.reached
+  expect(settled).toBe(0)
+  expect(guest.requests).toHaveLength(2)
+  second.release()
+  await Promise.all([initial, ...waiters])
+  expect(guest.requests).toHaveLength(2)
+  expect(guest.requests[1]).toMatchObject(
+    enabled ? { opencodePluginSource: '', opencode2PluginSource: '' } : sources
+  )
+  if (enabled) {
+    expect(state.opencodeOverlayDir).toBeUndefined()
+    expect(state.opencode2OverlayDir).toBeUndefined()
+  } else {
+    expect(
+      readFileSync(join(state.opencodeOverlayDir!, 'plugins', 'orca-opencode-status.js'), 'utf8')
+    ).toBe('// v1')
+    expect(
+      readFileSync(join(state.opencode2OverlayDir!, 'plugins', 'orca-opencode2-status.js'), 'utf8')
+    ).toBe('// v2')
+  }
+  await maybeRerunWslRelayGuestInstall(deps, state)
+  expect(guest.requests).toHaveLength(2)
+  expect(state.installation).toBeUndefined()
+})
+
+it('drains reentrant toggles during successive requests without duplicate passes', async () => {
+  const waiters: Promise<void>[] = []
+  const guest = createGuest('guest', async (index) => {
+    if (index <= 2) {
+      settings.disabledTuiAgents = index === 1 ? ['opencode'] : ['opencode', 'opencode2']
+      waiters.push(maybeRerunWslRelayGuestInstall(deps, state))
+    }
+  })
+  connect(guest)
+  await maybeRerunWslRelayGuestInstall(deps, state)
+  await Promise.all(waiters)
+  expect(
+    guest.requests.map((params) => [params.opencodePluginSource, params.opencode2PluginSource])
+  ).toEqual([
+    ['// v1', '// v2'],
+    ['', '// v2'],
+    ['', '']
+  ])
+  expect(state.opencodeOverlayDir).toBeUndefined()
+  expect(state.opencode2OverlayDir).toBeUndefined()
+})
+
+it('does not reinstall for rapid toggles that return to the in-flight settings', async () => {
+  const held = heldRequest()
+  const guest = createGuest('guest', () => held.wait())
+  connect(guest)
+  const initial = runWslRelayGuestInstall(deps, state, guest.mux, guest.home)
+  await held.reached
+  settings.disabledTuiAgents = ['opencode', 'opencode2']
+  const disabled = maybeRerunWslRelayGuestInstall(deps, state)
+  settings.disabledTuiAgents = []
+  const enabled = maybeRerunWslRelayGuestInstall(deps, state)
+  held.release()
+  await Promise.all([initial, disabled, enabled])
+  expect(guest.requests).toHaveLength(1)
+  expect(state.opencodeOverlayDir).toBeTruthy()
+  expect(state.opencode2OverlayDir).toBeTruthy()
+})
+
+it('coalesces an ensure re-entering before the first asynchronous hook operation', async () => {
+  const guest = createGuest('guest')
+  connect(guest)
+  const waiters: Promise<void>[] = []
+  vi.spyOn(deps, 'managedHookSettings').mockImplementationOnce(() => {
+    waiters.push(maybeRerunWslRelayGuestInstall(deps, state))
+    return settings
+  })
+  await runWslRelayGuestInstall(deps, state, guest.mux, guest.home)
+  await Promise.all(waiters)
+  expect(guest.requests).toHaveLength(1)
+  expect(state.opencodeOverlayDir).toBeTruthy()
+})
+
+it('finishes a slow pass once, leaving time-based refresh to a later ensure', async () => {
+  let now = Date.now()
+  vi.spyOn(Date, 'now').mockImplementation(() => now)
+  const held = heldRequest()
+  const guest = createGuest('guest', async (index) => {
+    if (index === 1) {
+      await held.wait()
+    }
+  })
+  connect(guest)
+  const initial = maybeRerunWslRelayGuestInstall(deps, state)
+  await held.reached
+  now += REINSTALL_MIN_INTERVAL_MS + 1
+  held.release()
+  await initial
+  expect(guest.requests).toHaveLength(1)
+  await maybeRerunWslRelayGuestInstall(deps, state)
+  expect(guest.requests).toHaveLength(2)
+})
+
+it.each([true, false])(
+  'handles a rejected joined task with changed settings %s',
+  async (changed) => {
+    const reached = Promise.withResolvers<void>()
+    const rejected = Promise.withResolvers<void>()
+    const guest = createGuest('guest')
+    connect(guest)
+    guest.dispatcher.onRequest('preflight.detectAgents', async () => ({ agents: ['claude'] }))
+    deps.installHooks.mockImplementationOnce(async () => {
+      reached.resolve()
+      await rejected.promise
+      return []
+    })
+    const initial = runWslRelayGuestInstall(deps, state, guest.mux, guest.home).catch(
+      (error) => error
+    )
+    await reached.promise
+    if (changed) {
+      settings.disabledTuiAgents = ['opencode', 'opencode2']
+    }
+    const waiter = maybeRerunWslRelayGuestInstall(deps, state)
+    rejected.reject(new Error('fixture installation failed'))
+    expect(await initial).toMatchObject({ message: 'fixture installation failed' })
+    await waiter
+    expect(deps.warn).toHaveBeenCalledWith(expect.stringContaining('fixture installation failed'))
+    expect(guest.requests).toHaveLength(changed ? 1 : 0)
+    if (changed) {
+      expect(guest.requests[0]).toMatchObject({
+        opencodePluginSource: '',
+        opencode2PluginSource: ''
+      })
+    }
+    expect(state.installation).toBeUndefined()
+    expect(state.opencodeOverlayDir).toBeUndefined()
+  }
+)
+
+it('does not publish a held response or reinstall after ownership is removed', async () => {
+  const held = heldRequest()
+  const guest = createGuest('retired', () => held.wait())
+  connect(guest)
+  const initial = runWslRelayGuestInstall(deps, state, guest.mux, guest.home)
+  await held.reached
+  settings.disabledTuiAgents = ['opencode', 'opencode2']
+  const waiter = maybeRerunWslRelayGuestInstall(deps, state)
+  state.mux = undefined
+  held.release()
+  await Promise.all([initial, waiter])
+  expect(guest.requests).toHaveLength(1)
+  expect(state.opencodeOverlayDir).toBeUndefined()
+  expect(state.opencode2OverlayDir).toBeUndefined()
+})
+
+it('leaves the replacement task and its paths owned by the new mux', async () => {
+  const oldHeld = heldRequest()
+  const nextHeld = heldRequest()
+  const old = createGuest('old', () => oldHeld.wait())
+  connect(old)
+  const initial = runWslRelayGuestInstall(deps, state, old.mux, old.home)
+  await oldHeld.reached
+  const waiter = maybeRerunWslRelayGuestInstall(deps, state)
+  const next = createGuest('next', () => nextHeld.wait())
+  connect(next)
+  state.installation = undefined
+  const replacement = runWslRelayGuestInstall(deps, state, next.mux, next.home)
+  await nextHeld.reached
+  const ownedTask = state.installation
+  oldHeld.release()
+  await initial
+  expect(state.installation).toBe(ownedTask)
+  expect(state.opencodeOverlayDir).toBeUndefined()
+  expect(state.opencode2OverlayDir).toBeUndefined()
+  nextHeld.release()
+  await Promise.all([waiter, replacement])
+  expect(state.opencodeOverlayDir).toContain(next.home)
+  expect(state.opencode2OverlayDir).toContain(next.home)
+  expect(old.requests).toHaveLength(1)
+  expect(next.requests).toHaveLength(1)
+})
+
+it('does not dispatch plugins after teardown during hook detection', async () => {
+  const held = heldRequest()
+  const guest = createGuest('retired')
+  connect(guest)
+  guest.dispatcher.onRequest('preflight.detectAgents', async () => {
+    await held.wait()
+    return { agents: [] }
+  })
+  const initial = runWslRelayGuestInstall(deps, state, guest.mux, guest.home)
+  await held.reached
+  state.mux = undefined
+  held.release()
+  await initial
+  expect(guest.requests).toHaveLength(0)
+  expect(state.opencodeOverlayDir).toBeUndefined()
+})
+
+it('does not dispatch a recheck on a disposed mux', async () => {
+  const held = heldRequest()
+  const guest = createGuest('disposed', () => held.wait())
+  connect(guest)
+  const initial = runWslRelayGuestInstall(deps, state, guest.mux, guest.home)
+  await held.reached
+  settings.disabledTuiAgents = ['opencode', 'opencode2']
+  const waiter = maybeRerunWslRelayGuestInstall(deps, state)
+  guest.mux.dispose()
+  held.release()
+  await Promise.all([initial, waiter])
+  expect(guest.requests).toHaveLength(1)
+  expect(state.opencodeOverlayDir).toBeUndefined()
+})
diff --git a/src/main/agent-hooks/wsl-opencode-settings-lifetime.test.ts b/src/main/agent-hooks/wsl-opencode-settings-lifetime.test.ts
new file mode 100644
index 000000000000..29cf139ace5e
--- /dev/null
+++ b/src/main/agent-hooks/wsl-opencode-settings-lifetime.test.ts
@@ -0,0 +1,353 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { EventEmitter } from 'node:events'
+import type { ChildProcessWithoutNullStreams } from 'node:child_process'
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { RelayDispatcher } from '../../relay/dispatcher'
+import { PluginOverlayManager } from '../../relay/plugin-overlay'
+import { createInstallPluginsHandler } from '../../relay/wsl-install-plugins-handler'
+import { WslHookRelayManager } from './wsl-hook-relay-manager'
+import { REINSTALL_MIN_INTERVAL_MS } from './wsl-hook-relay-deps'
+import type { MultiplexerTransport } from '../ssh/ssh-channel-multiplexer'
+import type { TuiAgent } from '../../shared/tui-agent'
+import {
+  AGENT_HOOK_INSTALL_PLUGINS_METHOD,
+  AGENT_HOOK_REQUEST_REPLAY_METHOD
+} from '../../shared/agent-hook-relay'
+import { WSL_HOOK_FS_METHODS } from '../../shared/wsl-hook-relay-contract'
+
+function gate() {
+  const reached = Promise.withResolvers<void>()
+  const release = Promise.withResolvers<void>()
+  return {
+    reached: reached.promise,
+    release: release.resolve,
+    wait: async () => {
+      reached.resolve()
+      await release.promise
+    }
+  }
+}
+
+function fakeChild(): ChildProcessWithoutNullStreams {
+  const child = Object.assign(new EventEmitter(), {
+    stdout: new EventEmitter(),
+    stderr: new EventEmitter(),
+    stdin: { write: () => true, end: () => {}, on: () => {} },
+    kill: () => true
+  })
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The injected launcher and link only use these emitter, stream, and kill members; no process is spawned.
+  return child as unknown as ChildProcessWithoutNullStreams
+}
+
+// Guest materialization uses POSIX home semantics; native Windows needs the WSL rig.
+describe.skipIf(process.platform === 'win32')('WSL public-manager settings lifetime', () => {
+  let root: string
+  let manager: WslHookRelayManager
+  let guests: ReturnType<typeof createGuest>[]
+  let activeGuest: ReturnType<typeof createGuest>
+  let settings: { disabledTuiAgents: TuiAgent[] }
+  let requests: Record<string, unknown>[]
+  let now: number
+  let detectionCount: number
+  let hookCount: number
+  let pause: 'detect' | 'hooks' | 'plugin'
+  let rejectRequest: boolean
+  let rejectHooks: boolean
+  let onPluginRequest: ((index: number) => Promise<void>) | undefined
+  let beforeSources: ReturnType<typeof gate>
+  let pendingRequest: ReturnType<typeof gate>
+  const sources = {
+    opencodePluginSource: '// independent v1',
+    opencode2PluginSource: '// independent v2',
+    piExtensionSource: '// pi',
+    ompExtensionSource: '// omp'
+  }
+
+  function createGuest(name: string): {
+    home: string
+    transport: MultiplexerTransport
+    dispatcher: RelayDispatcher
+  } {
+    const home = join(root, name)
+    mkdirSync(join(home, '.config', 'opencode'), { recursive: true })
+    writeFileSync(join(home, '.config', 'opencode', 'opencode.json'), '{"model":"fixture"}')
+    const callbacks: ((data: Buffer) => void)[] = []
+    const transport: MultiplexerTransport = {
+      write: (data) => dispatcher.feed(data),
+      onData: (callback) => {
+        callbacks.push(callback)
+      },
+      onClose: () => {}
+    }
+    const dispatcher = new RelayDispatcher((data) =>
+      callbacks.forEach((callback) => callback(data))
+    )
+    dispatcher.onRequest(WSL_HOOK_FS_METHODS.home, async () => ({ ok: true, home }))
+    dispatcher.onRequest(AGENT_HOOK_REQUEST_REPLAY_METHOD, async () => ({ replayed: 0 }))
+    dispatcher.onRequest('preflight.detectAgents', async () => {
+      if (++detectionCount === 2 && pause === 'detect') {
+        await beforeSources.wait()
+      }
+      return { agents: ['claude'] }
+    })
+    const install = createInstallPluginsHandler(new PluginOverlayManager({ homeDir: home }), {
+      HOME: home,
+      XDG_CONFIG_HOME: join(home, '.config'),
+      ORCA_WSL_HOOK_INSTANCE: 'independent-manager'
+    })
+    dispatcher.onRequest(AGENT_HOOK_INSTALL_PLUGINS_METHOD, async (params) => {
+      requests.push(params)
+      if (onPluginRequest) {
+        await onPluginRequest(requests.length)
+      } else if (requests.length === 2) {
+        await pendingRequest.wait()
+        if (rejectRequest) {
+          throw new Error('fixture plugin request rejected')
+        }
+      }
+      return install(params)
+    })
+    const guest = { home, transport, dispatcher }
+    guests.push(guest)
+    return guest
+  }
+
+  beforeEach(() => {
+    root = mkdtempSync(join(tmpdir(), 'orca-wsl-manager-boundary-'))
+    settings = { disabledTuiAgents: [] }
+    requests = []
+    now = Date.now()
+    vi.spyOn(Date, 'now').mockImplementation(() => now)
+    rejectRequest = false
+    rejectHooks = false
+    onPluginRequest = undefined
+    detectionCount = 0
+    hookCount = 0
+    beforeSources = gate()
+    pendingRequest = gate()
+    guests = []
+    activeGuest = createGuest('first')
+    manager = new WslHookRelayManager({
+      platform: () => 'win32',
+      remoteHooksEnabled: () => true,
+      hookCoordsEnv: () => ({ ORCA_AGENT_HOOK_PORT: '43117', ORCA_AGENT_HOOK_TOKEN: 'fixture' }),
+      instanceKey: () => 'independent',
+      resolveBundle: () => ({ jsPath: join(root, 'relay.js'), version: 'fixture' }),
+      readBundle: () => Buffer.from('// fixture'),
+      listDistros: async () => ['fixture'],
+      isDistroRunning: async () => true,
+      spawnRelay: () => fakeChild(),
+      runInstall: async () => ({ code: 0, stderr: '' }),
+      waitForSentinel: async () => activeGuest.transport,
+      ingest: () => {},
+      installHooks: async () => {
+        if (++hookCount === 2 && pause === 'hooks') {
+          await beforeSources.wait()
+        }
+        if (rejectHooks) {
+          throw new Error('fixture hook failure')
+        }
+        return []
+      },
+      installCodex: async () => null,
+      managedHookSettings: () => settings,
+      pluginSources: () => sources,
+      warn: vi.fn(),
+      transientRetryDelayMs: 1
+    })
+  })
+  afterEach(() => {
+    manager.disposeAll()
+    for (const guest of guests) {
+      guest.dispatcher.dispose()
+    }
+    vi.restoreAllMocks()
+    rmSync(root, { recursive: true, force: true })
+  })
+
+  const cases = (['detect', 'hooks', 'plugin'] as const).flatMap((stage) =>
+    [true, false].flatMap((initialEnabled) =>
+      [true, false].map((toggleBack) => ({ stage, initialEnabled, toggleBack }))
+    )
+  )
+
+  it.each(cases)(
+    'manager settings across $stage: initially enabled $initialEnabled, toggle back $toggleBack',
+    async ({ stage, initialEnabled, toggleBack }) => {
+      pause = stage
+      const setEnabled = (enabled: boolean) => {
+        settings = { disabledTuiAgents: enabled ? [] : ['opencode', 'opencode2'] }
+      }
+      setEnabled(initialEnabled)
+      await manager.ensureForDistro('fixture')
+      expect(requests).toHaveLength(1)
+      now += REINSTALL_MIN_INTERVAL_MS + 1
+      const refresh = manager.ensureForDistro('fixture')
+      const waiters: Promise<void>[] = [refresh]
+      if (stage !== 'plugin') {
+        await beforeSources.reached
+        setEnabled(!initialEnabled)
+        waiters.push(manager.ensureForDistro('fixture'))
+        beforeSources.release()
+      }
+      await pendingRequest.reached
+      const sentEnabled = stage === 'plugin' ? initialEnabled : !initialEnabled
+      expect(requests[1]).toMatchObject(
+        sentEnabled
+          ? sources
+          : {
+              opencodePluginSource: '',
+              opencode2PluginSource: ''
+            }
+      )
+      if (stage === 'plugin') {
+        setEnabled(!initialEnabled)
+        waiters.push(manager.ensureForDistro('fixture'))
+      }
+      const finalEnabled = toggleBack ? initialEnabled : !initialEnabled
+      setEnabled(finalEnabled)
+      waiters.push(...Array.from({ length: 4 }, () => manager.ensureForDistro('fixture')))
+      pendingRequest.release()
+      await Promise.all(waiters)
+      expect(requests).toHaveLength(sentEnabled === finalEnabled ? 2 : 3)
+      expect(requests.at(-1)).toMatchObject(
+        finalEnabled
+          ? sources
+          : {
+              opencodePluginSource: '',
+              opencode2PluginSource: ''
+            }
+      )
+      for (const agent of ['opencode', 'opencode2'] as const) {
+        const dir = manager.getOpenCodeOverlayDir('fixture', agent)
+        if (finalEnabled) {
+          expect(dir).toBeTruthy()
+          if (!dir) {
+            throw new Error('missing enabled overlay')
+          }
+          expect(readFileSync(join(dir, 'plugins', `orca-${agent}-status.js`), 'utf8')).toBe(
+            agent === 'opencode' ? sources.opencodePluginSource : sources.opencode2PluginSource
+          )
+        } else {
+          expect(dir).toBeNull()
+        }
+      }
+      const settledCount = requests.length
+      await manager.ensureForDistro('fixture')
+      expect(requests).toHaveLength(settledCount)
+    }
+  )
+
+  it('preserves known pointers after plugin rejection without treating it as revocation', async () => {
+    pause = 'detect'
+    await manager.ensureForDistro('fixture')
+    const oldV1 = manager.getOpenCodeOverlayDir('fixture')
+    const oldV2 = manager.getOpenCodeOverlayDir('fixture', 'opencode2')
+    now += REINSTALL_MIN_INTERVAL_MS + 1
+    const refresh = manager.ensureForDistro('fixture')
+    await beforeSources.reached
+    settings = { disabledTuiAgents: ['opencode', 'opencode2'] }
+    const disabled = manager.ensureForDistro('fixture')
+    beforeSources.release()
+    await pendingRequest.reached
+    rejectRequest = true
+    settings = { disabledTuiAgents: [] }
+    const restored = manager.ensureForDistro('fixture')
+    pendingRequest.release()
+    await Promise.all([refresh, disabled, restored])
+    expect(requests).toHaveLength(2)
+    expect(manager.getOpenCodeOverlayDir('fixture')).toBe(oldV1)
+    expect(manager.getOpenCodeOverlayDir('fixture', 'opencode2')).toBe(oldV2)
+    await manager.ensureForDistro('fixture')
+    expect(requests).toHaveLength(2)
+  })
+
+  it('tracks the settings sent by successive Pi and OMP requests', async () => {
+    pause = 'plugin'
+    await manager.ensureForDistro('fixture', undefined, 'pi')
+    const secondKind = gate()
+    onPluginRequest = async (index) => {
+      if (index === 2) {
+        await pendingRequest.wait()
+      }
+      if (index === 3) {
+        await secondKind.wait()
+      }
+    }
+    const refresh = manager.ensureForDistro('fixture', undefined, 'omp')
+    await pendingRequest.reached
+    settings.disabledTuiAgents = ['opencode', 'opencode2']
+    const disabled = manager.ensureForDistro('fixture')
+    pendingRequest.release()
+    await secondKind.reached
+    expect(requests[2]).toMatchObject({
+      launchKind: 'omp',
+      opencodePluginSource: '',
+      opencode2PluginSource: ''
+    })
+    settings.disabledTuiAgents = []
+    const restored = manager.ensureForDistro('fixture')
+    secondKind.release()
+    await Promise.all([refresh, disabled, restored])
+    expect(requests.map((request) => request.launchKind)).toEqual(['pi', 'pi', 'omp', 'pi', 'omp'])
+    expect(requests.at(-1)).toMatchObject(sources)
+    expect(manager.getOpenCodeOverlayDir('fixture')).toBeTruthy()
+    expect(manager.getOpenCodeOverlayDir('fixture', 'opencode2')).toBeTruthy()
+    const pi = manager.getGuestAgentPath('fixture', 'pi')
+    const omp = manager.getGuestAgentPath('fixture', 'omp')
+    if (!pi || !omp) {
+      throw new Error('missing guest agent paths')
+    }
+    expect(readFileSync(join(pi, 'extensions', 'orca-agent-status.ts'), 'utf8')).toContain('// pi')
+    expect(readFileSync(omp, 'utf8')).toContain('// omp')
+    await manager.ensureForDistro('fixture')
+    expect(requests).toHaveLength(5)
+  })
+
+  it('bounds repeated pre-plugin failures and retries after the cooldown', async () => {
+    pause = 'hooks'
+    await manager.ensureForDistro('fixture')
+    const previous = manager.getOpenCodeOverlayDir('fixture')
+    now += REINSTALL_MIN_INTERVAL_MS + 1
+    const refresh = manager.ensureForDistro('fixture')
+    await beforeSources.reached
+    settings.disabledTuiAgents = ['opencode', 'opencode2']
+    rejectHooks = true
+    const waiters = Array.from({ length: 4 }, () => manager.ensureForDistro('fixture'))
+    beforeSources.release()
+    await Promise.all([refresh, ...waiters])
+    expect(hookCount).toBe(3)
+    expect(requests).toHaveLength(1)
+    expect(manager.getOpenCodeOverlayDir('fixture')).toBe(previous)
+    await manager.ensureForDistro('fixture')
+    expect(hookCount).toBe(3)
+    now += REINSTALL_MIN_INTERVAL_MS + 1
+    rejectHooks = false
+    pendingRequest.release()
+    await manager.ensureForDistro('fixture')
+    expect(hookCount).toBe(4)
+    expect(requests.at(-1)).toMatchObject({ opencodePluginSource: '', opencode2PluginSource: '' })
+    expect(manager.getOpenCodeOverlayDir('fixture')).toBeNull()
+  })
+
+  it('keeps a disposed generation from publishing into a reconnected manager', async () => {
+    pause = 'plugin'
+    await manager.ensureForDistro('fixture')
+    now += REINSTALL_MIN_INTERVAL_MS + 1
+    const refresh = manager.ensureForDistro('fixture')
+    await pendingRequest.reached
+    const waiters = Array.from({ length: 4 }, () => manager.ensureForDistro('fixture'))
+    manager.disposeAll({ permanent: false })
+    activeGuest = createGuest('replacement')
+    await manager.ensureForDistro('fixture')
+    const current = manager.getOpenCodeOverlayDir('fixture')
+    expect(current).toContain(activeGuest.home)
+    pendingRequest.release()
+    await Promise.all([refresh, ...waiters])
+    expect(requests).toHaveLength(3)
+    expect(manager.getOpenCodeOverlayDir('fixture')).toBe(current)
+    expect(manager.getOpenCodeOverlayDir('fixture', 'opencode2')).toContain(activeGuest.home)
+  })
+})
diff --git a/src/main/agent-hooks/wsl-opencode-settings.test.ts b/src/main/agent-hooks/wsl-opencode-settings.test.ts
new file mode 100644
index 000000000000..0e868635ea2d
--- /dev/null
+++ b/src/main/agent-hooks/wsl-opencode-settings.test.ts
@@ -0,0 +1,136 @@
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import type { TuiAgent } from '../../shared/tui-agent'
+import { RelayDispatcher } from '../../relay/dispatcher'
+import { PluginOverlayManager } from '../../relay/plugin-overlay'
+import { createInstallPluginsHandler } from '../../relay/wsl-install-plugins-handler'
+import { SshChannelMultiplexer } from '../ssh/ssh-channel-multiplexer'
+import { AGENT_HOOK_INSTALL_PLUGINS_METHOD } from '../../shared/agent-hook-relay'
+import { requestGuestOpenCodeOverlayDir } from './wsl-guest-plugin-install'
+import {
+  maybeRerunWslRelayGuestInstall,
+  runWslRelayGuestInstall
+} from './wsl-hook-relay-guest-install'
+import type { WslRelayDistroState } from './wsl-hook-relay-state'
+
+let home: string
+let dispatcher: RelayDispatcher
+let mux: SshChannelMultiplexer
+let state: WslRelayDistroState
+let settings: { disabledTuiAgents: TuiAgent[] }
+let params: Record<string, unknown>[]
+const sources = {
+  opencodePluginSource: '// v1',
+  opencode2PluginSource: '// v2',
+  piExtensionSource: '// pi'
+}
+const deps = {
+  pluginSources: () => sources,
+  managedHookSettings: () => settings,
+  installHooks: async () => [],
+  installCodex: async () => null,
+  warn: (message: string) => {
+    throw new Error(message)
+  }
+}
+beforeEach(() => {
+  home = mkdtempSync(join(tmpdir(), 'orca-wsl-opencode-settings-'))
+  const xdg = join(home, 'xdg')
+  mkdirSync(join(xdg, 'opencode'), { recursive: true })
+  writeFileSync(join(xdg, 'opencode', 'opencode.json'), '{"model":"guest-fixture"}')
+  settings = { disabledTuiAgents: [] }
+  params = []
+  const callbacks: ((data: Buffer) => void)[] = []
+  dispatcher = new RelayDispatcher((data) => {
+    for (const callback of callbacks) {
+      callback(data)
+    }
+  })
+  mux = new SshChannelMultiplexer({
+    write: (data) => {
+      dispatcher.feed(data)
+    },
+    onData: (callback) => {
+      callbacks.push(callback)
+    },
+    onClose: () => {}
+  })
+  const install = createInstallPluginsHandler(new PluginOverlayManager({ homeDir: home }), {
+    HOME: home,
+    XDG_CONFIG_HOME: xdg,
+    ORCA_WSL_HOOK_INSTANCE: 'settings-fixture'
+  })
+  dispatcher.onRequest('preflight.detectAgents', async () => ({ agents: [] }))
+  dispatcher.onRequest(AGENT_HOOK_INSTALL_PLUGINS_METHOD, async (request) => {
+    params.push(request)
+    return install(request)
+  })
+  state = {
+    distro: 'fixture',
+    phase: 'running',
+    mux,
+    guestHome: home,
+    launchKinds: new Set(),
+    failures: 0,
+    cooldownUntil: 0
+  }
+})
+afterEach(() => {
+  mux.dispose()
+  dispatcher.dispose()
+  rmSync(home, { recursive: true, force: true })
+})
+
+describe('WSL settings over the existing plugin RPC into real fixture overlays', () => {
+  const cases: TuiAgent[][] = [[], ['opencode'], ['opencode2'], ['opencode', 'opencode2']]
+  it.each(cases.map((disabled) => ({ disabled })))(
+    'honors disabled $disabled',
+    async ({ disabled }) => {
+      settings.disabledTuiAgents = disabled
+      const result = await requestGuestOpenCodeOverlayDir(mux, deps, 'fixture')
+      for (const agent of ['opencode', 'opencode2'] as const) {
+        const key = agent === 'opencode' ? 'opencodePluginSource' : 'opencode2PluginSource'
+        expect(params[0][key]).toBe(disabled.includes(agent) ? '' : sources[key])
+      }
+      if (result.kind === 'dir') {
+        expect(Boolean(result.dir)).toBe(!disabled.includes('opencode'))
+        expect(Boolean(result.dir2)).toBe(!disabled.includes('opencode2'))
+        const dir = result.dir ?? result.dir2
+        if (!dir) {
+          throw new Error('missing overlay')
+        }
+        expect(readFileSync(join(dir, 'opencode.json'), 'utf8')).toBe('{"model":"guest-fixture"}')
+      } else {
+        expect(disabled).toEqual(['opencode', 'opencode2'])
+      }
+      expect(params[0].piExtensionSource).toBe('// pi')
+    }
+  )
+
+  it('revokes cached sources before the reinstall interval and re-enables the same service', async () => {
+    await runWslRelayGuestInstall(deps, state, mux, home)
+    const dir = state.opencodeOverlayDir
+    if (!dir) {
+      throw new Error('missing original overlay')
+    }
+    const path = join(dir, 'plugins', 'orca-opencode-status.js')
+    writeFileSync(path, '// installed sentinel')
+    settings.disabledTuiAgents = ['opencode']
+    await maybeRerunWslRelayGuestInstall(deps, state)
+    expect(state.opencodeOverlayDir).toBeUndefined()
+    expect(state.opencode2OverlayDir).toBeTruthy()
+    expect(readFileSync(path, 'utf8')).toBe('// installed sentinel')
+    const omitted = await requestGuestOpenCodeOverlayDir(
+      mux,
+      { ...deps, pluginSources: () => ({}) },
+      'fixture'
+    )
+    expect(omitted.kind === 'dir' ? omitted.dir : undefined).toBeUndefined()
+    settings.disabledTuiAgents = []
+    await maybeRerunWslRelayGuestInstall(deps, state)
+    expect(state.opencodeOverlayDir).toBe(dir)
+    expect(existsSync(path)).toBe(true)
+  })
+})
diff --git a/src/main/agent-launch/agent-launch-executor.test.ts b/src/main/agent-launch/agent-launch-executor.test.ts
index a95e71a30ef3..e7270287fb53 100644
--- a/src/main/agent-launch/agent-launch-executor.test.ts
+++ b/src/main/agent-launch/agent-launch-executor.test.ts
@@ -265,7 +265,7 @@ describe('the prompt receipt', () => {
       'createStructuredSession',
       'deliverStructuredPrompt'
     ])
-    // The send must name the lease the create was admitted under, not one re-read later.
+    // The send carries the create's own fence; nothing re-reads the session for it.
     expect(h.deliverStructuredPrompt).toHaveBeenCalledWith({
       sessionId: 'sess-1',
       fence: 4,
diff --git a/src/main/agent-launch/agent-launch-executor.ts b/src/main/agent-launch/agent-launch-executor.ts
index 090a65f7650f..1d9bae4f45d3 100644
--- a/src/main/agent-launch/agent-launch-executor.ts
+++ b/src/main/agent-launch/agent-launch-executor.ts
@@ -21,8 +21,8 @@
  * for a workspace it can resolve. That is why the decision is in two halves rather than one.
  *
  * What genuinely differs per surface is only how a surface is *built* — an orchestration worker's
- * session takes a dispatch hold and a mailbox that a plain launch must not take — so that is
- * injected as a factory instead of branched on here.
+ * session takes a redrive subscription and a mailbox that a plain launch must not take — so that
+ * is injected as a factory instead of branched on here.
  */
 
 import { parsePaneKey } from '../../shared/stable-pane-id'
diff --git a/src/main/agent-launch/agent-launch-not-started.ts b/src/main/agent-launch/agent-launch-not-started.ts
new file mode 100644
index 000000000000..ca40f53378f2
--- /dev/null
+++ b/src/main/agent-launch/agent-launch-not-started.ts
@@ -0,0 +1,37 @@
+/**
+ * A launch whose terminal failed before its spawn was requested: nothing was created, so the
+ * launch can settle as failed with its real cause instead of an unknown outcome.
+ *
+ * The original error is remembered rather than wrapped, so the caller still receives the host's own
+ * code and message. After the request leaves this process a failure proves nothing — an SSH or
+ * daemon spawn whose reply was lost may still have started — so only this earlier point counts.
+ *
+ * The verdict belongs to the launch, not to the error object: a failed pane spawn rejects the same
+ * error into the spawner (after its request left) and into a concurrent create waiting on that pane
+ * (before its own request left), so a mark on the error itself would clear both.
+ */
+export type TerminalSpawnDispatch = {
+  onPtySpawnDispatched: () => void
+  /** Rethrows the create's failure, remembering it when the spawn request had not yet left. */
+  rethrow: (error: unknown) => never
+  /** True only for the error this launch's create threw before its spawn request left. */
+  failedBeforeDispatch: (error: unknown) => boolean
+}
+
+export function trackTerminalSpawnDispatch(): TerminalSpawnDispatch {
+  let dispatched = false
+  let notStarted: { error: unknown } | undefined
+  return {
+    onPtySpawnDispatched: () => {
+      dispatched = true
+    },
+    rethrow: (error) => {
+      if (!dispatched) {
+        notStarted = { error }
+      }
+      throw error
+    },
+    failedBeforeDispatch: (error) =>
+      !dispatched && notStarted !== undefined && notStarted.error === error
+  }
+}
diff --git a/src/main/agent-launch/agent-launch-surface-factories.ts b/src/main/agent-launch/agent-launch-surface-factories.ts
index 11d72274bd4f..867eac40ab61 100644
--- a/src/main/agent-launch/agent-launch-surface-factories.ts
+++ b/src/main/agent-launch/agent-launch-surface-factories.ts
@@ -8,8 +8,8 @@ import type { AgentLaunchPrompt } from '../../shared/agent-launch-intent'
 import type { TuiAgent } from '../../shared/tui-agent'
 
 /** How a surface is built once the executor has decided which one. Injected because an
- *  orchestration worker's session carries a dispatch hold and a mailbox a plain launch must not
- *  take, while the decision and ordering above it are identical. */
+ *  orchestration worker's session carries a redrive subscription and a mailbox a plain launch
+ *  must not take, while the decision and ordering above it are identical. */
 export type AgentLaunchSurfaceFactory = {
   createStructuredSession(args: {
     worktreeId: string
@@ -64,8 +64,8 @@ export type AgentLaunchSurfaceFactory = {
   deliverTerminalPrompt?(args: { handle: string; prompt: AgentLaunchPrompt }): Promise<boolean>
 }
 
-/** `fence` is carried out of the create because a send must name the lease it was admitted against,
- *  and re-reading it later would read whatever fence the session has by then. */
+/** `fence` is the lease the create was admitted at, carried so the launch prompt's send can fill its
+ *  envelope without re-reading the session; the host does not check a write's fence. */
 export type AgentLaunchStructuredSurface = {
   sessionId: string
   handle: string
diff --git a/src/main/agent-trust-presets.ts b/src/main/agent-trust-presets.ts
index 30e2ba487f31..d84fc68a4680 100644
--- a/src/main/agent-trust-presets.ts
+++ b/src/main/agent-trust-presets.ts
@@ -6,7 +6,7 @@ import { getOrcaManagedCodexHomePath } from './codex/codex-home-paths'
 import { upsertProjectTrustLevel } from './codex/config-toml-trust'
 import { runExclusivelyForCodexTrustConfig } from './codex/codex-trust-config-mutation-queue'
 
-export type AgentTrustPreset = 'cursor' | 'copilot' | 'codex' | 'antigravity'
+export type AgentTrustPreset = 'cursor' | 'copilot' | 'codex' | 'antigravity' | 'qoder'
 
 /**
  * Pre-mark a workspace as trusted for cursor-agent, GitHub Copilot CLI, or
diff --git a/src/main/agent-trust-write-deadline.ts b/src/main/agent-trust-write-deadline.ts
new file mode 100644
index 000000000000..0effa8f69bc0
--- /dev/null
+++ b/src/main/agent-trust-write-deadline.ts
@@ -0,0 +1,47 @@
+import type { AgentTrustPreset } from './agent-trust-presets'
+
+/**
+ * Why: callers hold launch admission on a trust write, but the write is not
+ * self-bounding. The local Codex writer queues on the per-`config.toml` lane
+ * shared with hook installs and app-server trust grants (up to 10s native /
+ * 30s WSL each, with no cap on how many are already queued), and the SSH
+ * writer chains a `session.resolveHome` round trip plus unbounded SFTP
+ * read/write calls over a link that may be half-open. Without a cap the user
+ * clicks "start agent" and nothing happens, with no error.
+ *
+ * 20s covers a native grant session holding the lane with headroom. Past that
+ * we stop waiting and let the launch proceed *untrusted*: the write is never
+ * cancelled and still lands, and the agent meanwhile raises its own "Do you
+ * trust this folder?" prompt. Giving up therefore fails closed — it can only
+ * lose the ordering optimisation, never grant trust that was not written.
+ */
+export const AGENT_TRUST_WRITE_DEADLINE_MS = 20_000
+
+/**
+ * Awaits a trust write but never longer than the deadline. Rejections
+ * propagate to the caller's best-effort catch; a deadline miss is reported as
+ * a named warning rather than an exception, because every caller treats a
+ * failed trust write as "let the agent ask the user".
+ */
+export async function awaitAgentTrustWriteWithinDeadline(
+  write: Promise<void>,
+  context: { preset: AgentTrustPreset; workspacePath: string; deadlineMs?: number }
+): Promise<void> {
+  const deadlineMs = context.deadlineMs ?? AGENT_TRUST_WRITE_DEADLINE_MS
+  let timer: ReturnType<typeof setTimeout> | undefined
+  const expiry = new Promise<'expired'>((resolve) => {
+    timer = setTimeout(() => resolve('expired'), deadlineMs)
+  })
+  try {
+    // Why race adopts `write`: it attaches handlers, so a rejection arriving
+    // after the deadline is consumed here instead of surfacing unhandled.
+    const outcome = await Promise.race([write.then(() => 'written' as const), expiry])
+    if (outcome === 'expired') {
+      console.warn(
+        `[agent-trust] ${context.preset} trust write for ${context.workspacePath} did not settle within ${deadlineMs}ms; continuing untrusted so the agent can prompt`
+      )
+    }
+  } finally {
+    clearTimeout(timer)
+  }
+}
diff --git a/src/main/ai-vault-search/session-search-deleted-sources.test.ts b/src/main/ai-vault-search/session-search-deleted-sources.test.ts
index 5fd4e5cd6303..39fbda9bb140 100644
--- a/src/main/ai-vault-search/session-search-deleted-sources.test.ts
+++ b/src/main/ai-vault-search/session-search-deleted-sources.test.ts
@@ -264,6 +264,31 @@ it('keeps a synthetic row when this pass did not enumerate its container', async
   ).resolves.toMatchObject({ retired: [], unverifiable: [row] })
 })
 
+it('keeps a ZCode SQLite row when its database read failed during discovery', async () => {
+  const db = join(harness.root, 'db.sqlite')
+  await writeFile(db, '')
+  const row = `${db}#zcode-session`
+
+  const result = await retire([row], { roots: [] })
+  expect(result.retired).toEqual([])
+  expect(result.unverifiable).toEqual([row])
+  expect(removed).toEqual([])
+})
+
+it('retires a ZCode SQLite row only after a successful full database enumeration', async () => {
+  const db = join(harness.root, 'db.sqlite')
+  await writeFile(db, '')
+  const kept = `${db}#session-1`
+  const deleted = `${db}#session-2`
+
+  const result = await retire([kept, deleted], {
+    roots: [],
+    enumeratedContainers: new Map([[db, new Set(['session-1'])]])
+  })
+  expect(result.retired).toEqual([deleted])
+  expect(result.unverifiable).toEqual([])
+})
+
 it('retires a synthetic row when the container it came from is gone', async () => {
   const db = join(harness.root, 'opencode.db')
   await writeFile(db, '')
diff --git a/src/main/ai-vault-search/session-search-scan-roots.test.ts b/src/main/ai-vault-search/session-search-scan-roots.test.ts
index 39324ca5da88..0d30ca632e8b 100644
--- a/src/main/ai-vault-search/session-search-scan-roots.test.ts
+++ b/src/main/ai-vault-search/session-search-scan-roots.test.ts
@@ -76,3 +76,26 @@ it('reads an added, dropped or changed root as a different set', () => {
   expect(sameSessionSearchRoots(base, { openclawStateDir: STATE })).toBe(false)
   expect(sameSessionSearchRoots(base, { ...base, wslHomeDirs: ['/home/b'] })).toBe(false)
 })
+
+it('compares WSL readers structurally without restarting for reordered objects', () => {
+  const ubuntu = { distro: 'Ubuntu', executable: '/usr/bin/node', readerPath: '/reader.cjs' }
+  const debian = { distro: 'Debian', error: 'Preparing' }
+  expect(
+    sameSessionSearchRoots(
+      { wslOpenCodeReaders: [ubuntu, debian] },
+      {
+        wslOpenCodeReaders: [
+          { error: 'Preparing', distro: 'debian' },
+          { readerPath: '/reader.cjs', executable: '/usr/bin/node', distro: 'ubuntu' }
+        ]
+      }
+    )
+  ).toBe(true)
+  expect(sameSessionSearchRoots({}, { wslOpenCodeReaders: [] })).toBe(true)
+  expect(
+    sameSessionSearchRoots(
+      { wslOpenCodeReaders: [ubuntu] },
+      { wslOpenCodeReaders: [{ ...ubuntu, executable: '/new/node' }] }
+    )
+  ).toBe(false)
+})
diff --git a/src/main/ai-vault-search/session-search-scan-roots.ts b/src/main/ai-vault-search/session-search-scan-roots.ts
index 5c1041eac253..d8eb766a3711 100644
--- a/src/main/ai-vault-search/session-search-scan-roots.ts
+++ b/src/main/ai-vault-search/session-search-scan-roots.ts
@@ -153,10 +153,22 @@ export function sameSessionSearchRoots(
 }
 
 function comparableRootFields(roots: SessionSearchScanRoots): string[] {
-  return Object.entries(roots)
+  const { wslOpenCodeReaders, ...pathRoots } = roots
+  return Object.entries(pathRoots)
     .filter(([, value]) => value !== undefined)
     .map(
       ([key, value]) => `${key}=${JSON.stringify(Array.isArray(value) ? [...value].sort() : value)}`
     )
+    .concat(
+      (wslOpenCodeReaders ?? []).map(
+        (reader) =>
+          `wslOpenCodeReaders=${JSON.stringify([
+            reader.distro.toLowerCase(),
+            reader.executable,
+            reader.readerPath,
+            reader.error
+          ])}`
+      )
+    )
     .sort()
 }
diff --git a/src/main/ai-vault-search/session-search-synthetic-sources.ts b/src/main/ai-vault-search/session-search-synthetic-sources.ts
index 86222b9c5fe4..59541e7924f4 100644
--- a/src/main/ai-vault-search/session-search-synthetic-sources.ts
+++ b/src/main/ai-vault-search/session-search-synthetic-sources.ts
@@ -4,15 +4,14 @@ import type { SessionFileCandidate } from '../ai-vault/session-scanner-types'
 
 /**
  * A row whose path names a container and an entry inside it rather than a file
- * of its own. OpenCode's SQLite sessions are the one shape today
- * (`<opencode.db>#<sessionId>`), which is why this reads through that source's
- * own splitter rather than reinventing the encoding.
+ * of its own. OpenCode and ZCode SQLite sessions share the same encoding,
+ * with distinct database names validated by the source splitter.
  */
 export type SessionSearchSyntheticSource = { container: string; id: string }
 
 export function splitSyntheticSessionSource(path: string): SessionSearchSyntheticSource | null {
-  const openCode = splitOpenCodeSqliteCandidate(path)
-  return openCode ? { container: openCode.dbPath, id: openCode.sessionId } : null
+  const sqlite = splitOpenCodeSqliteCandidate(path) ?? splitOpenCodeSqliteCandidate(path, 'zcode')
+  return sqlite ? { container: sqlite.dbPath, id: sqlite.sessionId } : null
 }
 
 /**
diff --git a/src/main/ai-vault/cached-session-list-wsl-probe.test.ts b/src/main/ai-vault/cached-session-list-wsl-probe.test.ts
index e5857faf378c..0c2ef27316a6 100644
--- a/src/main/ai-vault/cached-session-list-wsl-probe.test.ts
+++ b/src/main/ai-vault/cached-session-list-wsl-probe.test.ts
@@ -15,6 +15,9 @@ vi.mock('./session-scanner-worker-spawn', () => ({
   scanAiVaultSessionsInWorker,
   resetAiVaultScannerWorkerForTests: vi.fn()
 }))
+vi.mock('./opencode-wsl-runtime-preparation', () => ({
+  prepareOpenCodeWslReaders: vi.fn(async () => [])
+}))
 
 import { _resetWslCachesForTests, _setWslCachesForTests, listWslDistrosAsync } from '../wsl'
 import { filterPathsToRunningWslDistrosAsync } from '../wsl-running-path-filter'
diff --git a/src/main/ai-vault/cached-session-list.ts b/src/main/ai-vault/cached-session-list.ts
index 8a02ee2f6bf4..5f485d48d5f1 100644
--- a/src/main/ai-vault/cached-session-list.ts
+++ b/src/main/ai-vault/cached-session-list.ts
@@ -8,6 +8,7 @@ import { getCachedWslDistros, hasCachedWslDistros, listRunningWslHomeDirsAsync }
 import { filterPathsToRunningWslDistrosAsync } from '../wsl-running-path-filter'
 import type { AiVaultListArgs, AiVaultListResult } from '../../shared/ai-vault-types'
 import type { AiVaultScanOptions } from './session-scanner-types'
+import { prepareOpenCodeWslReaders } from './opencode-wsl-runtime-preparation'
 import { LOCAL_EXECUTION_HOST_ID } from '../../shared/execution-host'
 import { AiVaultScanCoordinator } from './ai-vault-scan-coordinator'
 import {
@@ -57,7 +58,7 @@ export function configureAiVaultSessionSources(next: AiVaultSessionSources): voi
  */
 export async function localAiVaultScanRoots(): Promise<
   Required<Pick<AiVaultScanOptions, 'additionalCodexSessionsDirs' | 'wslHomeDirs'>> &
-    Pick<AiVaultScanOptions, 'executionHostId'>
+    Pick<AiVaultScanOptions, 'executionHostId' | 'wslOpenCodeReaders'>
 > {
   const [additionalCodexHomes, wslHomeDirs] = await Promise.all([
     filterPathsToRunningWslDistrosAsync(configuredAdditionalCodexHomePaths()),
@@ -66,6 +67,7 @@ export async function localAiVaultScanRoots(): Promise<
   return {
     additionalCodexSessionsDirs: additionalCodexHomes.map((homePath) => join(homePath, 'sessions')),
     wslHomeDirs,
+    wslOpenCodeReaders: await prepareOpenCodeWslReaders(wslHomeDirs),
     // Why: this scan is always host-local; callers addressing this host by a
     // runtime id get the result restamped at the RPC edge, never rescanned.
     executionHostId: LOCAL_EXECUTION_HOST_ID
diff --git a/src/main/ai-vault/opencode-wsl-runtime-preparation.test.ts b/src/main/ai-vault/opencode-wsl-runtime-preparation.test.ts
new file mode 100644
index 000000000000..d78130a119fa
--- /dev/null
+++ b/src/main/ai-vault/opencode-wsl-runtime-preparation.test.ts
@@ -0,0 +1,260 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { ORCAD_BUN_RELEASE_ASSETS } from '../../shared/orcad-bun-runtime'
+import { runProcess } from '../../shared/child-process/run-process'
+import type * as preparationModule from './opencode-wsl-runtime-preparation'
+
+const mocks = vi.hoisted(() => ({
+  exists: vi.fn(() => true),
+  run: vi.fn(),
+  running: vi.fn(async (paths: readonly string[]) => [...paths]),
+  download: vi.fn(async () => 'C:\\cache\\bun'),
+  bundles: vi.fn((platform: string) => [`C:/relay/${platform}`])
+}))
+vi.mock('node:fs', () => ({ existsSync: mocks.exists }))
+vi.mock('../../shared/app-environment', () => ({
+  getAppEnvironment: () => ({
+    getAppPath: () => 'C:/app',
+    getPath: () => 'C:/profile'
+  })
+}))
+vi.mock('../wsl/wsl-runner', () => ({ runWslProcess: mocks.run }))
+vi.mock('../wsl-running-path-filter', () => ({
+  filterPathsToRunningWslDistrosAsync: mocks.running
+}))
+vi.mock('../ssh/orcad-bun-runtime-materializer', () => ({
+  materializeCachedOrcadBunRuntime: mocks.download
+}))
+vi.mock('../ssh/relay-bundle-paths', () => ({ relayBundleCandidates: mocks.bundles }))
+
+const home = String.raw`\\wsl.localhost\Ubuntu\home\ada`
+const success = (stdout: string) => ({ stdout, stderr: '', code: 0, timedOut: false })
+let prepare: typeof preparationModule.prepareOpenCodeWslReaders
+
+beforeEach(async () => {
+  vi.resetModules()
+  vi.clearAllMocks()
+  vi.spyOn(process, 'platform', 'get').mockReturnValue('win32')
+  mocks.exists.mockReturnValue(true)
+  mocks.running.mockImplementation(async (paths) => [...paths])
+  mocks.run.mockImplementation(async (spec) =>
+    success(
+      spec.script?.startsWith('data=')
+        ? 'present'
+        : spec.program === 'wslpath'
+          ? '/mnt/c/reader.cjs'
+          : '/usr/bin/node'
+    )
+  )
+  prepare = (await import('./opencode-wsl-runtime-preparation')).prepareOpenCodeWslReaders
+})
+afterEach(() => {
+  vi.restoreAllMocks()
+  vi.useRealTimers()
+})
+
+async function prepared() {
+  let result = await prepare([home])
+  await vi.waitFor(async () => {
+    result = await prepare([home])
+    expect(result[0]?.executable).toBeDefined()
+  })
+  return result
+}
+
+describe('WSL SQLite runtime preparation', () => {
+  it('returns immediately, coalesces distro aliases, and uses an actual guest SQLite probe', async () => {
+    let release: (value: ReturnType<typeof success>) => void = () => {}
+    mocks.run.mockReturnValueOnce(
+      new Promise((resolve) => {
+        release = resolve
+      })
+    )
+    expect(await prepare([home, String.raw`\\wsl$\ubuntu\home\ada`])).toHaveLength(1)
+    await vi.waitFor(() => expect(mocks.run).toHaveBeenCalledOnce())
+    expect((await prepare([home]))[0]?.error).toContain('Preparing')
+    expect(mocks.run).toHaveBeenCalledOnce()
+    release(success('present'))
+    expect(await prepared()).toEqual([
+      { distro: 'ubuntu', executable: '/usr/bin/node', readerPath: '/mnt/c/reader.cjs' }
+    ])
+    expect(mocks.run).toHaveBeenCalledWith(
+      expect.objectContaining({
+        program: 'node',
+        loginPath: 'preferred',
+        args: ['-e', expect.stringContaining("require('node:sqlite')")]
+      })
+    )
+    expect(mocks.bundles.mock.calls.map(([platform]) => platform)).toEqual([
+      'linux-x64',
+      'linux-arm64'
+    ])
+    expect(mocks.download).not.toHaveBeenCalled()
+  })
+
+  it('does not start a stopped distro and retries a failed preparation after cooldown', async () => {
+    let now = 10_000
+    vi.spyOn(Date, 'now').mockImplementation(() => now)
+    mocks.running.mockResolvedValue([])
+    await prepare([home])
+    await vi.waitFor(async () => expect((await prepare([home]))[0]?.error).toContain('not running'))
+    expect(mocks.run).not.toHaveBeenCalled()
+    mocks.running.mockImplementation(async (paths) => [...paths])
+    expect((await prepare([home]))[0]?.error).toContain('not running')
+    now += 30_001
+    expect((await prepared())[0]?.executable).toBe('/usr/bin/node')
+  })
+
+  it('keeps a working reader during revalidation and prunes completed removed distros', async () => {
+    let now = 10_000
+    vi.spyOn(Date, 'now').mockImplementation(() => now)
+    const ready = await prepared()
+    now += 600_001
+    let release: (value: ReturnType<typeof success>) => void = () => {}
+    mocks.run.mockReturnValueOnce(
+      new Promise((resolve) => {
+        release = resolve
+      })
+    )
+    expect(await prepare([home])).toEqual(ready)
+    await vi.waitFor(() => expect(mocks.run).toHaveBeenCalledTimes(4))
+    expect(await prepare([home])).toEqual(ready)
+    mocks.run.mockResolvedValueOnce(success('/mnt/c/repaired-reader.cjs'))
+    release(success('present'))
+    await vi.waitFor(async () =>
+      expect((await prepare([home]))[0]?.readerPath).toBe('/mnt/c/repaired-reader.cjs')
+    )
+    expect(await prepare([])).toEqual([])
+    expect((await prepare([home]))[0]?.error).toContain('Preparing')
+    await prepared()
+  })
+
+  it('falls back to the pinned proxy runtime, verifies the guest stage, and preserves literal argv', async () => {
+    const expected = ORCAD_BUN_RELEASE_ASSETS['linux-arm64-musl'].executableSha256
+    mocks.run.mockImplementation(async (spec) => {
+      if (spec.script?.startsWith('data=')) {
+        return success('present')
+      }
+      if (spec.program === 'node') {
+        return { ...success(''), code: 1, stderr: 'no sqlite' }
+      }
+      if (spec.program === 'uname') {
+        return success('aarch64')
+      }
+      if (spec.program === 'wslpath') {
+        return success('/mnt/c/reader $literal.cjs')
+      }
+      if (spec.script?.startsWith('getconf')) {
+        return success('musl libc')
+      }
+      if (spec.script?.startsWith('printf')) {
+        return success('/home/ada $literal')
+      }
+      return success('')
+    })
+    const result = await prepared()
+    expect(mocks.download).toHaveBeenCalledWith(
+      'linux-arm64-musl',
+      expect.any(String),
+      expect.objectContaining({ signal: expect.any(AbortSignal) })
+    )
+    expect(result[0]?.executable).toBe(
+      `/home/ada $literal/.cache/orca/vault-sqlite/${expected}/bun`
+    )
+    expect(mocks.run).toHaveBeenCalledWith(
+      expect.objectContaining({
+        args: ['/mnt/c/reader $literal.cjs', result[0]?.executable, expected],
+        script: expect.stringContaining('actual=$(sha256sum -- "$stage")')
+      })
+    )
+    expect(
+      mocks.run.mock.calls.every(
+        ([spec]) => spec.timeoutMs <= 15_000 && spec.maxOutputBytes === 16_384
+      )
+    ).toBe(true)
+  })
+
+  it('rechecks running state after downloading before it copies a runtime', async () => {
+    mocks.run.mockImplementation(async (spec) => {
+      if (spec.script?.startsWith('data=')) {
+        return success('present')
+      }
+      if (spec.program === 'node') {
+        return { ...success(''), code: 1 }
+      }
+      if (spec.program === 'uname') {
+        return success('x86_64')
+      }
+      if (spec.program === 'wslpath') {
+        return success('/mnt/c/reader.cjs')
+      }
+      if (spec.script?.startsWith('getconf')) {
+        return success('glibc 2.31')
+      }
+      if (spec.script?.startsWith('printf')) {
+        return success('/home/ada')
+      }
+      return success('')
+    })
+    mocks.download.mockImplementationOnce(async () => {
+      mocks.running.mockResolvedValue([])
+      return 'C:\\cache\\bun'
+    })
+    await prepare([home])
+    await vi.waitFor(async () => expect((await prepare([home]))[0]?.error).toContain('not running'))
+    expect(mocks.run.mock.calls.some(([spec]) => spec.script?.includes('mv -f'))).toBe(false)
+  })
+
+  it('ignores native roots and does no work outside Windows', async () => {
+    expect(await prepare(['C:\\Users\\ada'])).toEqual([])
+    vi.spyOn(process, 'platform', 'get').mockReturnValue('linux')
+    expect(await prepare([home])).toEqual([])
+    expect(mocks.run).not.toHaveBeenCalled()
+  })
+
+  it('skips runtime setup without a database and rechecks soon after OpenCode starts', async () => {
+    let now = 10_000
+    vi.spyOn(Date, 'now').mockImplementation(() => now)
+    mocks.run.mockResolvedValueOnce(success(''))
+    await prepare([home])
+    await vi.waitFor(async () =>
+      expect((await prepare([home]))[0]?.error).toContain('No OpenCode database')
+    )
+    expect(mocks.run).toHaveBeenCalledOnce()
+    expect(mocks.download).not.toHaveBeenCalled()
+    expect(mocks.run.mock.calls[0]?.[0].script).toContain('OPENCODE_DB')
+    expect(mocks.run.mock.calls[0]?.[0].script).toContain('XDG_DATA_HOME')
+    now += 30_001
+    expect((await prepared())[0]?.executable).toBe('/usr/bin/node')
+    expect(mocks.running).toHaveBeenCalledWith(expect.any(Array), { requireConfirmed: true })
+  })
+
+  it.skipIf(process.platform === 'win32')(
+    'keeps the discovery default visible when guest overrides point elsewhere',
+    async () => {
+      await prepared()
+      const script = mocks.run.mock.calls[0]?.[0].script
+      const directory = await mkdtemp(join(tmpdir(), 'orca-wsl-presence-'))
+      try {
+        const data = join(directory, '.local', 'share', 'opencode')
+        await mkdir(data, { recursive: true })
+        await writeFile(join(data, 'opencode.db'), '')
+        const result = await runProcess({
+          program: '/bin/sh',
+          args: ['-c', script],
+          env: {
+            HOME: directory,
+            XDG_DATA_HOME: join(directory, 'empty'),
+            OPENCODE_DB: ':memory:'
+          }
+        })
+        expect(result.code).toBe(0)
+        expect(result.stdout).toBe('present')
+      } finally {
+        await rm(directory, { recursive: true, force: true })
+      }
+    }
+  )
+})
diff --git a/src/main/ai-vault/opencode-wsl-runtime-preparation.ts b/src/main/ai-vault/opencode-wsl-runtime-preparation.ts
new file mode 100644
index 000000000000..c9bc81fff775
--- /dev/null
+++ b/src/main/ai-vault/opencode-wsl-runtime-preparation.ts
@@ -0,0 +1,191 @@
+import { existsSync } from 'node:fs'
+import { join } from 'node:path'
+import { getAppEnvironment } from '../../shared/app-environment'
+import { waitForPromiseWithSignal } from '../../shared/abort-signal-reason'
+import { ORCAD_BUN_RELEASE_ASSETS, type OrcadBunTarget } from '../../shared/orcad-bun-runtime'
+import { RELAY_OPENCODE_SQLITE_READER_FILENAME } from '../../shared/relay-artifacts'
+import { parseWslUncPath, toWindowsWslUncPath } from '../../shared/wsl-paths'
+import { relayBundleCandidates } from '../ssh/relay-bundle-paths'
+import { materializeCachedOrcadBunRuntime } from '../ssh/orcad-bun-runtime-materializer'
+import { parseOrcadLinuxLibc } from '../ssh/orcad-deployment-target'
+import { runWslProcess, type WslSpec } from '../wsl/wsl-runner'
+import { filterPathsToRunningWslDistrosAsync } from '../wsl-running-path-filter'
+import type { OpenCodeWslRuntime } from './session-scanner-opencode-wsl-runtime'
+
+const preparation = new Map<string, { value: OpenCodeWslRuntime; expires: number }>()
+const downloads = new Map<OrcadBunTarget, Promise<string>>()
+const PREPARATION_TIMEOUT_MS = 180_000
+const SQLITE_PROBE = `const db=new (require('node:sqlite').DatabaseSync)(':memory:');db.prepare('SELECT 1').get();db.close();process.stdout.write(process.execPath)`
+
+/** Only running distro roots enter here; a slow first install must not hold up local history. */
+export async function prepareOpenCodeWslReaders(
+  roots: readonly string[]
+): Promise<OpenCodeWslRuntime[]> {
+  if (process.platform !== 'win32') {
+    return []
+  }
+  const distros = new Map<string, string>()
+  for (const root of roots) {
+    const distro = parseWslUncPath(root)?.distro
+    if (distro) {
+      distros.set(distro.toLowerCase(), distro)
+    }
+  }
+  for (const [key, entry] of preparation) {
+    if (!distros.has(key) && Number.isFinite(entry.expires)) {
+      preparation.delete(key)
+    }
+  }
+  return [...distros].map(([key, distro]) => {
+    const previous = preparation.get(key)
+    if (previous && previous.expires > Date.now()) {
+      return previous.value
+    }
+    const entry: { expires: number; value: OpenCodeWslRuntime } = {
+      expires: Number.POSITIVE_INFINITY,
+      value: previous?.value.executable
+        ? previous.value
+        : {
+            distro,
+            error: 'Preparing the WSL SQLite reader. Refresh Vault after setup finishes.'
+          }
+    }
+    preparation.set(key, entry)
+    void prepare(distro).then(
+      (runtime) => {
+        entry.expires = Date.now() + (runtime.executable ? 10 * 60_000 : 30_000)
+        entry.value = runtime
+      },
+      (error: unknown) => {
+        entry.expires = Date.now() + 30_000
+        entry.value = { distro, error: error instanceof Error ? error.message : String(error) }
+      }
+    )
+    return entry.value
+  })
+}
+
+async function prepare(distro: string): Promise<OpenCodeWslRuntime> {
+  const deadline = Date.now() + PREPARATION_TIMEOUT_MS
+  const signal = AbortSignal.timeout(PREPARATION_TIMEOUT_MS)
+  const run = async (spec: WslSpec): Promise<string> => {
+    signal.throwIfAborted()
+    const running = await waitForPromiseWithSignal(
+      filterPathsToRunningWslDistrosAsync([toWindowsWslUncPath('/', distro)], {
+        requireConfirmed: true
+      }),
+      signal
+    )
+    if (running.length === 0) {
+      throw new Error(`WSL distro ${distro} is not running. Start it to read its history.`)
+    }
+    signal.throwIfAborted()
+    const result = await runWslProcess({
+      ...spec,
+      distro,
+      timeoutMs: Math.max(1, Math.min(15_000, deadline - Date.now())),
+      maxOutputBytes: 16 * 1024
+    })
+    if (result.code !== 0 || result.timedOut) {
+      throw new Error(`WSL SQLite reader setup failed: ${result.stderr.trim() || 'command failed'}`)
+    }
+    return result.stdout.trim()
+  }
+  const app = getAppEnvironment()
+  // The reader is plain JavaScript; either packaged Linux architecture is usable.
+  const reader = (['linux-x64', 'linux-arm64'] as const)
+    .flatMap((platform) => relayBundleCandidates(platform, app.getAppPath()))
+    .map((directory) => join(directory, RELAY_OPENCODE_SQLITE_READER_FILENAME))
+    .find(existsSync)
+  if (!reader) {
+    throw new Error('The bundled WSL SQLite reader is missing. Reinstall Orca to repair it.')
+  }
+  const hasDatabase = await run({
+    script: [
+      'data="${XDG_DATA_HOME:-$HOME/.local/share}/opencode"',
+      // WSL discovery still enumerates the default data root independently of guest overrides.
+      'for db in "$HOME/.local/share/opencode"/opencode.db "$HOME/.local/share/opencode"/opencode-*.db; do if [ -f "$db" ]; then printf present; exit 0; fi; done',
+      'case "${OPENCODE_DB-}" in',
+      '  :memory:) exit 0 ;;',
+      '  /*) [ ! -f "$OPENCODE_DB" ] || printf present ;;',
+      '  "") for db in "$data"/opencode*.db; do if [ -f "$db" ]; then printf present; break; fi; done ;;',
+      '  *) [ ! -f "$data/$OPENCODE_DB" ] || printf present ;;',
+      'esac'
+    ].join('\n'),
+    loginPath: 'none'
+  })
+  if (hasDatabase !== 'present') {
+    return { distro, error: 'No OpenCode database is present in this WSL distro.' }
+  }
+  const readerPath = await run({
+    program: 'wslpath',
+    args: ['-a', '-u', reader],
+    loginPath: 'none'
+  })
+  let executable: string | null = null
+  try {
+    executable = await run({ program: 'node', args: ['-e', SQLITE_PROBE], loginPath: 'preferred' })
+  } catch {
+    // Older guest Node remains supported; only the SQLite reader needs this runtime.
+  }
+  if (!executable?.startsWith('/')) {
+    const arch = await run({ program: 'uname', args: ['-m'], loginPath: 'none' })
+    if (arch !== 'x86_64' && arch !== 'aarch64' && arch !== 'arm64') {
+      throw new Error(`Unsupported WSL SQLite reader architecture: ${arch}`)
+    }
+    const libc = parseOrcadLinuxLibc(
+      await run({
+        script:
+          'getconf GNU_LIBC_VERSION 2>/dev/null || ldd --version 2>&1 || ' +
+          'for loader in /lib/ld-musl-*.so.1; do [ ! -e "$loader" ] || { echo musl; break; }; done',
+        loginPath: 'none'
+      })
+    )
+    const target = `linux-${arch === 'x86_64' ? 'x64' : 'arm64'}-${libc}` as const
+    const expected = ORCAD_BUN_RELEASE_ASSETS[target].executableSha256
+    const home = await run({ script: 'printf %s "$HOME"', loginPath: 'none' })
+    if (!home.startsWith('/')) {
+      throw new Error('WSL did not provide an absolute home directory.')
+    }
+    executable = `${home}/.cache/orca/vault-sqlite/${expected}/bun`
+    const present = await run({
+      script: 'if [ -x "$1" ]; then sha256sum -- "$1"; fi',
+      args: [executable],
+      loginPath: 'none'
+    })
+    if (!present.startsWith(`${expected} `)) {
+      let download = downloads.get(target)
+      if (!download) {
+        download = materializeCachedOrcadBunRuntime(
+          target,
+          join(app.getPath('userData'), 'orcad-artifacts'),
+          {
+            signal: AbortSignal.timeout(PREPARATION_TIMEOUT_MS)
+          }
+        ).finally(() => downloads.delete(target))
+        downloads.set(target, download)
+      }
+      const localRuntime = await waitForPromiseWithSignal(download, signal)
+      const source = await run({
+        program: 'wslpath',
+        args: ['-a', '-u', localRuntime],
+        loginPath: 'none'
+      })
+      await run({
+        script: [
+          'set -eu; umask 077',
+          'mkdir -p -- "${2%/*}"',
+          'stage=$(mktemp "${2}.upload.XXXXXX")',
+          'trap \'rm -f -- "$stage"\' EXIT',
+          'cp -- "$1" "$stage"',
+          'actual=$(sha256sum -- "$stage"); [ "${actual%% *}" = "$3" ]',
+          'chmod 700 "$stage"',
+          'mv -f -- "$stage" "$2"'
+        ].join('\n'),
+        args: [source, executable, expected],
+        loginPath: 'none'
+      })
+    }
+  }
+  return { distro, executable, readerPath }
+}
diff --git a/src/main/ai-vault/remote-session-large-transcripts.test.ts b/src/main/ai-vault/remote-session-large-transcripts.test.ts
index 73c33aec27fe..e6bac42fd7e2 100644
--- a/src/main/ai-vault/remote-session-large-transcripts.test.ts
+++ b/src/main/ai-vault/remote-session-large-transcripts.test.ts
@@ -28,7 +28,7 @@ describe('large remote history through real relay filesystem', () => {
       await writeFile(badPath, metadata('bad') + 'x'.repeat(11 * 1024 * 1024))
       await writeFile(join(directory, 'good.jsonl'), metadata('good'))
       const result = await scanRemoteAiVaultSessions({
-        provider: createRelayAiVaultFilesystemProvider(),
+        provider: createRelayAiVaultFilesystemProvider({ homeDirectory: home, environment: {} }),
         executionHostId: 'ssh:record-limit',
         remoteHome: home,
         hostPlatform: platform,
@@ -94,7 +94,7 @@ describe('large remote history through real relay filesystem', () => {
           filler.slice(filler.length / 2)
       )
       const result = await scanRemoteAiVaultSessions({
-        provider: createRelayAiVaultFilesystemProvider(),
+        provider: createRelayAiVaultFilesystemProvider({ homeDirectory: home, environment: {} }),
         executionHostId: 'ssh:synthetic-17744',
         remoteHome: home,
         hostPlatform: platform,
@@ -161,7 +161,7 @@ describe('large remote history through real relay filesystem', () => {
         await mkdir(dirname(path), { recursive: true })
         await writeFile(path, JSON.stringify(record))
         const result = await scanRemoteAiVaultSessions({
-          provider: createRelayAiVaultFilesystemProvider(),
+          provider: createRelayAiVaultFilesystemProvider({ homeDirectory: home, environment: {} }),
           executionHostId: `ssh:large-${agent}`,
           remoteHome: home,
           hostPlatform: platform,
@@ -185,7 +185,10 @@ describe('large remote history through real relay filesystem', () => {
       await mkdir(directory, { recursive: true })
       const content = jsonl([{ type: 'session_meta', payload: { id: 'small', cwd: '/repo' } }])
       await writeFile(join(directory, 'small.jsonl'), content)
-      const provider = createRelayAiVaultFilesystemProvider()
+      const provider = createRelayAiVaultFilesystemProvider({
+        homeDirectory: home,
+        environment: {}
+      })
       provider.readTranscriptBytes = () => {
         throw new Error('Small file must keep its existing read path')
       }
diff --git a/src/main/ai-vault/remote-session-parse-cache.ts b/src/main/ai-vault/remote-session-parse-cache.ts
index c892c4961efb..24d63c3dc2a1 100644
--- a/src/main/ai-vault/remote-session-parse-cache.ts
+++ b/src/main/ai-vault/remote-session-parse-cache.ts
@@ -35,6 +35,10 @@ export function remoteSessionParseHostKey(context: RemoteScannerContext): string
   return `${context.executionHostId}\u0000${context.hostPlatform.relayPlatform}`
 }
 
+export function remoteSessionCandidateKey(candidate: RemoteSessionCandidate): string {
+  return `${candidate.source.agent}\u0000${candidate.file.path}`
+}
+
 function storeEntry(path: string, entry: RemoteSessionParseCacheEntry): void {
   cache.delete(path)
   cache.set(path, entry)
@@ -79,7 +83,8 @@ export async function parseRemoteSessionFileCached(args: {
   stats?: RemoteSessionParseStats
 }): Promise<AiVaultSession | null> {
   const { file } = args.candidate
-  const entry = cache.get(file.path)
+  const key = remoteSessionCandidateKey(args.candidate)
+  const entry = cache.get(key)
   const unchanged =
     entry !== undefined &&
     entry.hostKey === args.hostKey &&
@@ -96,7 +101,7 @@ export async function parseRemoteSessionFileCached(args: {
       entry.session = await args.refreshReusedSession(entry.session)
     }
     // Refresh recency without re-parsing so the LRU evicts cold paths first.
-    storeEntry(file.path, entry)
+    storeEntry(key, entry)
     return entry.session
   }
 
@@ -104,7 +109,7 @@ export async function parseRemoteSessionFileCached(args: {
   if (args.stats) {
     args.stats.parsed++
   }
-  storeEntry(file.path, {
+  storeEntry(key, {
     mtimeMs: file.mtimeMs,
     sizeBytes: file.sizeBytes ?? null,
     hostKey: args.hostKey,
diff --git a/src/main/ai-vault/remote-session-scan-concurrency.ts b/src/main/ai-vault/remote-session-scan-concurrency.ts
index e74375259f5b..a336af84a069 100644
--- a/src/main/ai-vault/remote-session-scan-concurrency.ts
+++ b/src/main/ai-vault/remote-session-scan-concurrency.ts
@@ -14,6 +14,7 @@ export function limitRemoteScanFilesystemConcurrency(
 ): RemoteSessionFilesystemProvider {
   const gate = createConcurrencyGate(maxInFlight)
   return {
+    openCode: provider.openCode,
     readDir: (dirPath) => gate(() => provider.readDir(dirPath)),
     readFile: (filePath) => gate(() => provider.readFile(filePath)),
     stat: (filePath) => gate(() => provider.stat(filePath)),
diff --git a/src/main/ai-vault/remote-session-scanner-discovery.ts b/src/main/ai-vault/remote-session-scanner-discovery.ts
index 1fb25213f32e..f6b13b24e306 100644
--- a/src/main/ai-vault/remote-session-scanner-discovery.ts
+++ b/src/main/ai-vault/remote-session-scanner-discovery.ts
@@ -22,6 +22,11 @@ export async function discoverRemoteSourceCandidates(args: {
   context: RemoteScannerContext
   issues: AiVaultScanIssue[]
 }): Promise<RemoteSessionCandidate[]> {
+  if (args.source.discover) {
+    const files = await args.source.discover(args.context, args.issues)
+    throwIfAiVaultScanCancelled(args.context.signal)
+    return files.map((file) => ({ source: args.source, file }))
+  }
   const walked = args.source.fixedChildFileSegments
     ? await listRemoteFixedChildFiles(args.source, args.context, args.issues)
     : await walkRemoteSessionFiles(args.source, args.context, args.issues)
diff --git a/src/main/ai-vault/remote-session-scanner-opencode-source.ts b/src/main/ai-vault/remote-session-scanner-opencode-source.ts
new file mode 100644
index 000000000000..c42f4b6cb090
--- /dev/null
+++ b/src/main/ai-vault/remote-session-scanner-opencode-source.ts
@@ -0,0 +1,149 @@
+import type { AiVaultScanIssue } from '../../shared/ai-vault-types'
+import { isOpenCodeV2DatabaseName } from '../../shared/opencode-database-name'
+import { joinRemotePath } from '../ssh/ssh-remote-platform'
+import { throwIfAiVaultScanCancelled } from './ai-vault-scan-cancellation'
+import { isMissingRemoteSessionPathError } from './remote-session-file-stat'
+import { discoverRemoteSourceCandidates } from './remote-session-scanner-discovery'
+import { remotePathSegments } from './remote-session-scanner-source-parsers'
+import type {
+  RemoteOpenCodeSessionReader,
+  RemoteScannerContext,
+  RemoteSessionSource
+} from './remote-session-scanner-types'
+import { recordSessionScanIssue } from './session-scan-issues'
+import { restampAiVaultListResult } from './session-list-results'
+import { splitOpenCodeSqliteCandidate } from './session-scanner-opencode-sqlite-paths'
+import { errorMessage } from './session-scanner-values'
+
+export function remoteOpenCodeSources(
+  reader: RemoteOpenCodeSessionReader | undefined,
+  candidateLimit: number
+): RemoteSessionSource[] {
+  if (!reader) {
+    return []
+  }
+  let databasePaths: Promise<string[]> | undefined
+  return (['opencode', 'opencode2'] as const).map((agent) => {
+    const source: RemoteSessionSource = {
+      agent,
+      rootDir: reader.dataDirectory,
+      extensions: ['.json'],
+      parse: async () => null,
+      parseCandidate: async (file, context) => {
+        throwIfAiVaultScanCancelled(context.signal)
+        const candidate = splitOpenCodeSqliteCandidate(file.path)
+        const session = candidate
+          ? await reader.parse({
+              ...candidate,
+              platform: context.hostPlatform.os,
+              ...(agent === 'opencode2' ? { agent } : {}),
+              signal: context.signal
+            })
+          : await reader.parseLegacy(file, context.hostPlatform.os)
+        throwIfAiVaultScanCancelled(context.signal)
+        if (!session) {
+          return null
+        }
+        const stamped = restampAiVaultListResult(
+          { sessions: [session], issues: [], scannedAt: '' },
+          context.executionHostId
+        ).sessions[0]
+        return stamped ? { ...stamped, executionHostPlatform: context.hostPlatform.os } : null
+      },
+      discover: async (context, issues) => {
+        databasePaths ??= discoverDatabasePaths(reader, context, issues)
+        const paths = await databasePaths
+        const ownPaths =
+          agent === 'opencode2'
+            ? paths
+            : paths.filter(
+                (path) => !isOpenCodeV2DatabaseName(remotePathSegments(path).at(-1) ?? '')
+              )
+        const readIssues: AiVaultScanIssue[] = []
+        const candidates = await reader.list({
+          dbPaths: ownPaths,
+          limit: candidateLimit,
+          issues: readIssues,
+          ...(agent === 'opencode2' ? { agent } : {}),
+          signal: context.signal
+        })
+        throwIfAiVaultScanCancelled(context.signal)
+        for (const issue of readIssues) {
+          recordSessionScanIssue(issues, { ...issue, executionHostId: context.executionHostId })
+        }
+        const files = candidates.map((candidate) => candidate.file)
+        if (agent === 'opencode2') {
+          return files
+        }
+        const legacy = await discoverRemoteSourceCandidates({
+          source: {
+            ...source,
+            discover: undefined,
+            rootDir: joinRemotePath(
+              context.hostPlatform,
+              reader.dataDirectory,
+              'storage',
+              'session'
+            )
+          },
+          context,
+          issues
+        })
+        const ids = new Set(files.map((file) => splitOpenCodeSqliteCandidate(file.path)?.sessionId))
+        return [
+          ...files,
+          ...legacy
+            .filter(
+              ({ file }) =>
+                !ids.has(
+                  remotePathSegments(file.path)
+                    .at(-1)
+                    ?.replace(/\.json$/, '')
+                )
+            )
+            .map(({ file }) => file)
+        ]
+      }
+    }
+    return source
+  })
+}
+
+async function discoverDatabasePaths(
+  reader: RemoteOpenCodeSessionReader,
+  context: RemoteScannerContext,
+  issues: AiVaultScanIssue[]
+): Promise<string[]> {
+  throwIfAiVaultScanCancelled(context.signal)
+  if (reader.databasePath === null) {
+    return []
+  }
+  try {
+    if (reader.databasePath !== undefined) {
+      const stat = await context.provider.stat(reader.databasePath)
+      return stat.type === 'file' || stat.type === 'symlink' ? [reader.databasePath] : []
+    }
+    const entries = await context.provider.readDir(reader.dataDirectory)
+    return entries
+      .filter(
+        (entry) =>
+          !entry.isDirectory &&
+          !entry.isSymlink &&
+          /^opencode(?:-[A-Za-z0-9_.-]+)?\.db$/.test(entry.name)
+      )
+      .map((entry) => joinRemotePath(context.hostPlatform, reader.dataDirectory, entry.name))
+      .sort()
+  } catch (error) {
+    throwIfAiVaultScanCancelled(context.signal)
+    if (!isMissingRemoteSessionPathError(error)) {
+      recordSessionScanIssue(issues, {
+        executionHostId: context.executionHostId,
+        agent: 'opencode',
+        kind: 'scope',
+        path: reader.databasePath ?? reader.dataDirectory,
+        message: errorMessage(error)
+      })
+    }
+    return []
+  }
+}
diff --git a/src/main/ai-vault/remote-session-scanner-opencode.test.ts b/src/main/ai-vault/remote-session-scanner-opencode.test.ts
new file mode 100644
index 000000000000..573ee1939cf4
--- /dev/null
+++ b/src/main/ai-vault/remote-session-scanner-opencode.test.ts
@@ -0,0 +1,235 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type { AiVaultSession } from '../../shared/ai-vault-types'
+import { getRemoteHostPlatform } from '../ssh/ssh-remote-platform'
+import { resetRemoteSessionParseCacheForTests } from './remote-session-parse-cache'
+import { scanRemoteAiVaultSessions } from './remote-session-scanner'
+import { MemoryRemoteProvider, jsonLines } from './remote-session-scanner-test-fixtures'
+import type { RemoteOpenCodeSessionReader } from './remote-session-scanner-types'
+import { createAccumulator, finalizeSession, updateTimeline } from './session-scanner-accumulator'
+import {
+  buildOpenCodeSqliteCandidatePath,
+  splitOpenCodeSqliteCandidate
+} from './session-scanner-opencode-sqlite-paths'
+import type { FileWithMtime } from './session-scanner-types'
+
+const remoteHome = '/home/ada'
+const dataDirectory = `${remoteHome}/.local/share/opencode`
+const hostPlatform = getRemoteHostPlatform('linux-x64')
+const scanOptions = { remoteHome, hostPlatform, executionHostId: 'ssh:one' as const }
+
+beforeEach(resetRemoteSessionParseCacheForTests)
+
+function fixture() {
+  const sessions = new Map<string, AiVaultSession>()
+  const list: RemoteOpenCodeSessionReader['list'] = vi.fn(async (args) =>
+    [...sessions.values()]
+      .filter(
+        (session) =>
+          session.agent === (args.agent ?? 'opencode') && args.dbPaths.includes(session.filePath)
+      )
+      .sort((left, right) => Date.parse(right.modifiedAt) - Date.parse(left.modifiedAt))
+      .slice(0, args.limit)
+      .map((session) => ({
+        agent: session.agent,
+        codexHome: null,
+        file: file(
+          buildOpenCodeSqliteCandidatePath(session.filePath, session.sessionId),
+          Date.parse(session.modifiedAt)
+        )
+      }))
+  )
+  const parse: RemoteOpenCodeSessionReader['parse'] = vi.fn(
+    async (args) =>
+      sessions.get(
+        `${args.agent ?? 'opencode'}:${buildOpenCodeSqliteCandidatePath(args.dbPath, args.sessionId)}`
+      ) ?? null
+  )
+  const parseLegacy = vi.fn(async (entry: FileWithMtime) =>
+    session('opencode', 'legacy', entry, '/home/ada/repo')
+  )
+  const provider = Object.assign(new MemoryRemoteProvider(), {
+    openCode: { dataDirectory, list, parse, parseLegacy }
+  })
+  const add = (
+    id: string,
+    mtime: number,
+    options: { agent?: 'opencode' | 'opencode2'; cwd?: string; dbName?: string } = {}
+  ) => {
+    const agent = options.agent ?? 'opencode'
+    const dbPath = `${dataDirectory}/${options.dbName ?? 'opencode.db'}`
+    provider.addFile(dbPath, 'database', 1)
+    const path = buildOpenCodeSqliteCandidatePath(dbPath, id)
+    sessions.set(
+      `${agent}:${path}`,
+      session(agent, id, file(path, mtime), options.cwd ?? '/home/ada/other')
+    )
+  }
+  return { provider, add, list, parse, parseLegacy }
+}
+
+function file(path: string, mtimeMs: number): FileWithMtime {
+  return { path, mtimeMs, modifiedAt: new Date(mtimeMs).toISOString() }
+}
+
+function session(
+  agent: 'opencode' | 'opencode2',
+  sessionId: string,
+  entry: FileWithMtime,
+  cwd: string
+): AiVaultSession {
+  const accumulator = createAccumulator({
+    agent,
+    file: { ...entry, path: splitOpenCodeSqliteCandidate(entry.path)?.dbPath ?? entry.path },
+    sessionId
+  })
+  accumulator.cwd = cwd
+  updateTimeline(accumulator, entry.modifiedAt)
+  const parsed = finalizeSession(accumulator, 'linux')
+  if (!parsed) {
+    throw new Error('Invalid fixture session')
+  }
+  return parsed
+}
+
+describe('remote OpenCode discovery', () => {
+  it('sorts database rows with file-backed agents before applying the global cap', async () => {
+    const { provider, add } = fixture()
+    add('older', 1000)
+    add('newest', 3000)
+    provider.addFile(
+      `${remoteHome}/.claude/projects/project/middle.jsonl`,
+      jsonLines([
+        {
+          sessionId: 'middle',
+          timestamp: new Date(2000).toISOString(),
+          type: 'user',
+          message: { content: 'middle' }
+        }
+      ]),
+      2000
+    )
+    const read = vi.spyOn(provider, 'readFile')
+    const result = await scanRemoteAiVaultSessions({ ...scanOptions, provider, limit: 2 })
+    expect(result.issues).toEqual([])
+    expect(result.sessions.map((entry) => entry.sessionId)).toEqual(['newest', 'middle'])
+    expect(result.sessions[0]).toMatchObject({
+      executionHostId: 'ssh:one',
+      executionHostPlatform: 'linux',
+      id: `ssh:one:opencode:newest:${dataDirectory}/opencode.db`
+    })
+    expect(read.mock.calls.every(([path]) => !path.includes('.db#'))).toBe(true)
+  })
+
+  it('retains older scoped rows beyond the recent parse budget', async () => {
+    const { provider, add, list } = fixture()
+    for (let index = 0; index < 10; index++) {
+      add(`other-${index}`, 10000 + index)
+    }
+    add('scoped', 1000, { cwd: '/home/ada/repo/app' })
+    const result = await scanRemoteAiVaultSessions({
+      ...scanOptions,
+      provider,
+      limit: 1,
+      scopePaths: ['/home/ada/repo']
+    })
+    expect(result.sessions.map((entry) => entry.sessionId)).toEqual(['other-9', 'scoped'])
+    expect(list).toHaveBeenCalledWith(expect.objectContaining({ limit: 1003 }))
+  })
+
+  it('drops stale legacy duplicates before limiting while keeping legacy-only history', async () => {
+    const { provider, add, parseLegacy } = fixture()
+    add('migrated', 2000)
+    provider.addFile(`${dataDirectory}/storage/session/project/migrated.json`, '{}', 9000)
+    provider.addFile(`${dataDirectory}/storage/session/project/legacy.json`, '{}', 1000)
+    const result = await scanRemoteAiVaultSessions({ ...scanOptions, provider, limit: 10 })
+    expect(result.sessions.map((entry) => entry.sessionId)).toEqual(['migrated', 'legacy'])
+    expect(parseLegacy).toHaveBeenCalledTimes(1)
+    expect(parseLegacy).toHaveBeenCalledWith(
+      expect.objectContaining({ path: expect.stringContaining('/legacy.json') }),
+      'linux'
+    )
+  })
+
+  it('keeps v1 and v2 identities separate in a shared database and parse cache', async () => {
+    const { provider, add, parse, list } = fixture()
+    add('same-id', 2000)
+    add('same-id', 2000, { agent: 'opencode2' })
+    add('beta', 1000, { agent: 'opencode2', dbName: 'opencode-next.db' })
+    const first = await scanRemoteAiVaultSessions({ ...scanOptions, provider })
+    const second = await scanRemoteAiVaultSessions({ ...scanOptions, provider })
+    expect(first.sessions.map((entry) => entry.agent).sort()).toEqual([
+      'opencode',
+      'opencode2',
+      'opencode2'
+    ])
+    expect(second.sessions).toEqual(first.sessions)
+    expect(parse).toHaveBeenCalledTimes(3)
+    expect(list).toHaveBeenCalledWith(
+      expect.objectContaining({ dbPaths: [`${dataDirectory}/opencode.db`] })
+    )
+    expect(list).toHaveBeenCalledWith(
+      expect.objectContaining({
+        dbPaths: [`${dataDirectory}/opencode-next.db`, `${dataDirectory}/opencode.db`],
+        agent: 'opencode2'
+      })
+    )
+  })
+
+  it('invalidates cached database rows after updates and across hosts', async () => {
+    const { provider, add, parse } = fixture()
+    add('session', 1000)
+    await scanRemoteAiVaultSessions({ ...scanOptions, provider })
+    add('session', 2000)
+    const updated = await scanRemoteAiVaultSessions({ ...scanOptions, provider })
+    const other = await scanRemoteAiVaultSessions({
+      ...scanOptions,
+      executionHostId: 'ssh:two',
+      provider
+    })
+    expect(parse).toHaveBeenCalledTimes(3)
+    expect(updated.sessions[0]?.modifiedAt).toBe(new Date(2000).toISOString())
+    expect(other.sessions[0]?.executionHostId).toBe('ssh:two')
+  })
+
+  it('propagates cancellation into the reader and does not cache cancelled parses', async () => {
+    const { provider, add, parse } = fixture()
+    add('session', 1000)
+    const controller = new AbortController()
+    provider.openCode.parse = async (args) => {
+      expect(args.signal).toBe(controller.signal)
+      controller.abort()
+      return parse(args)
+    }
+    await expect(
+      scanRemoteAiVaultSessions({ ...scanOptions, provider, signal: controller.signal })
+    ).rejects.toMatchObject({ name: 'AbortError' })
+    provider.openCode.parse = parse
+    await scanRemoteAiVaultSessions({ ...scanOptions, provider })
+    expect(parse).toHaveBeenCalledTimes(2)
+  })
+
+  it('leaves legacy filesystem providers on their existing fallback', async () => {
+    const provider = new MemoryRemoteProvider()
+    provider.addFile(`${dataDirectory}/opencode.db`, 'database', 1000)
+    const result = await scanRemoteAiVaultSessions({ ...scanOptions, provider })
+    expect(result.sessions).toEqual([])
+    expect(result.issues).toEqual([])
+    expect(provider.readDirPaths).not.toContain(dataDirectory)
+  })
+
+  it('honors an explicitly configured database symlink without enumerating sibling databases', async () => {
+    const { provider, add, list } = fixture()
+    add('selected', 1000, { dbName: 'opencode-team.db' })
+    add('other', 2000)
+    const selected = `${dataDirectory}/opencode-team.db`
+    Object.assign(provider.openCode, { databasePath: selected })
+    const stat = provider.stat.bind(provider)
+    vi.spyOn(provider, 'stat').mockImplementation(async (path) =>
+      path === selected ? { type: 'symlink', size: 20, mtime: 1000, mtimeMs: 1000 } : stat(path)
+    )
+    const result = await scanRemoteAiVaultSessions({ ...scanOptions, provider })
+    expect(result.sessions.map((entry) => entry.sessionId)).toEqual(['selected'])
+    expect(list).toHaveBeenCalledWith(expect.objectContaining({ dbPaths: [selected] }))
+    expect(provider.readDirPaths).not.toContain(dataDirectory)
+  })
+})
diff --git a/src/main/ai-vault/remote-session-scanner-types.ts b/src/main/ai-vault/remote-session-scanner-types.ts
index 7f78cbb5d60d..408a2ca47be7 100644
--- a/src/main/ai-vault/remote-session-scanner-types.ts
+++ b/src/main/ai-vault/remote-session-scanner-types.ts
@@ -1,10 +1,17 @@
-import type { AiVaultAgent, AiVaultSession } from '../../shared/ai-vault-types'
+import type { AiVaultAgent, AiVaultScanIssue, AiVaultSession } from '../../shared/ai-vault-types'
 import type { ExecutionHostId } from '../../shared/execution-host'
 import type { IFilesystemProvider } from '../providers/types'
 import type { RemoteHostPlatform } from '../ssh/ssh-remote-platform'
 import type { FileWithMtime } from './session-scanner-types'
 import type { SubagentTranscriptPartition } from './session-scanner-subagent-transcripts'
 import type { AntigravityWorkspaceResolver } from './session-scanner-antigravity-history'
+import type { OpenCodeSqliteWorkerClient } from './session-scanner-opencode-sqlite-worker-client'
+
+export type RemoteOpenCodeSessionReader = Pick<OpenCodeSqliteWorkerClient, 'list' | 'parse'> & {
+  dataDirectory: string
+  databasePath?: string | null
+  parseLegacy: (file: FileWithMtime, platform: NodeJS.Platform) => Promise<AiVaultSession | null>
+}
 
 export type RemoteScannerContext = {
   provider: RemoteSessionFilesystemProvider
@@ -21,6 +28,8 @@ export type RemoteSessionFilesystemProvider = Pick<
 > & {
   /** Available only beside the execution host's disk; never opens a client path. */
   readTranscriptBytes?: (path: string, signal?: AbortSignal) => AsyncIterable<Buffer>
+  /** Execution-host database access; absent from remote filesystem RPC providers. */
+  openCode?: RemoteOpenCodeSessionReader
 }
 
 export type RemoteParserOptions = {
@@ -31,6 +40,11 @@ export type RemoteParserOptions = {
 export type RemoteSessionSource = {
   agent: AiVaultAgent
   rootDir: string
+  discover?: (context: RemoteScannerContext, issues: AiVaultScanIssue[]) => Promise<FileWithMtime[]>
+  parseCandidate?: (
+    file: FileWithMtime,
+    context: RemoteScannerContext
+  ) => Promise<AiVaultSession | null>
   // Codex sources only: the CODEX_HOME the root belongs to, so bridged or
   // backfilled rollout aliases across remote roots collapse to one canonical row.
   codexHome?: string
diff --git a/src/main/ai-vault/remote-session-scanner.ts b/src/main/ai-vault/remote-session-scanner.ts
index 9caae0f5708c..aa03b530092a 100644
--- a/src/main/ai-vault/remote-session-scanner.ts
+++ b/src/main/ai-vault/remote-session-scanner.ts
@@ -16,6 +16,7 @@ import {
 import { ScannedSessionCollection, dedupeScannedSessions } from './session-root-dedup'
 import {
   parseRemoteSessionFileCached,
+  remoteSessionCandidateKey,
   remoteSessionParseHostKey
 } from './remote-session-parse-cache'
 import { remoteCodexIndexedTitleReader } from './remote-session-scanner-codex-index'
@@ -36,6 +37,7 @@ import { canStopParsingSessions } from './session-scan-cutoff'
 import { refreshCodexTitleFromIndex } from './session-scanner-codex-cached-title'
 import { limitRemoteScanFilesystemConcurrency } from './remote-session-scan-concurrency'
 import { aiVaultScanLimit, requestedAiVaultSessionDepth } from '../../shared/ai-vault-session-depth'
+import { remoteOpenCodeSources } from './remote-session-scanner-opencode-source'
 
 const REMOTE_SCAN_CONCURRENCY = 8
 const REMOTE_PARSE_CANDIDATE_MULTIPLIER = 2
@@ -84,7 +86,14 @@ export async function scanRemoteAiVaultSessions(args: {
   const candidates = dedupeCodexRolloutFileAliases(
     (
       await mapRemoteScanBatches(
-        remoteSessionSources(args.remoteHome, args.hostPlatform),
+        [
+          ...remoteSessionSources(args.remoteHome, args.hostPlatform),
+          ...remoteOpenCodeSources(
+            provider.openCode,
+            limit * REMOTE_PARSE_CANDIDATE_MULTIPLIER +
+              (args.scopePaths?.length ? REMOTE_SCOPE_PARSE_CANDIDATE_LIMIT + 1 : 0)
+          )
+        ],
         REMOTE_SCAN_CONCURRENCY,
         (source) => discoverRemoteSourceCandidates({ source, context, issues }),
         args.signal
@@ -120,7 +129,7 @@ export async function scanRemoteAiVaultSessions(args: {
     issues,
     scopePaths,
     limit,
-    alreadyParsedFilePaths: parsed.parsedFilePaths
+    alreadyParsedCandidateKeys: parsed.parsedCandidateKeys
   })
   const scopeSessions = dedupeScannedSessions([...parsedScopeSessions, ...extraScopeSessions])
     .sort((left, right) => sessionSortTime(right) - sessionSortTime(left))
@@ -141,9 +150,9 @@ async function parseRemoteSessionCandidates(args: {
   context: RemoteScannerContext
   issues: AiVaultScanIssue[]
   limit: number
-}): Promise<{ sessions: AiVaultSession[]; parsedFilePaths: Set<string> }> {
+}): Promise<{ sessions: AiVaultSession[]; parsedCandidateKeys: Set<string> }> {
   const sessions = new ScannedSessionCollection()
-  const parsedFilePaths = new Set<string>()
+  const parsedCandidateKeys = new Set<string>()
   let index = 0
 
   while (index < args.candidates.length) {
@@ -156,7 +165,7 @@ async function parseRemoteSessionCandidates(args: {
     const batchSize = Math.min(REMOTE_SCAN_CONCURRENCY, needed, remaining)
     const batch = args.candidates.slice(index, index + batchSize)
     for (const candidate of batch) {
-      parsedFilePaths.add(candidate.file.path)
+      parsedCandidateKeys.add(remoteSessionCandidateKey(candidate))
     }
     throwIfAiVaultScanCancelled(args.context.signal)
     const results = await Promise.all(
@@ -174,7 +183,7 @@ async function parseRemoteSessionCandidates(args: {
   // The loop can terminate on the yield after its final batch, so re-check
   // rather than letting a cancelled scan return a partial parse as a success.
   throwIfAiVaultScanCancelled(args.context.signal)
-  return { sessions: [...sessions.values()], parsedFilePaths }
+  return { sessions: [...sessions.values()], parsedCandidateKeys }
 }
 
 async function scanRemoteInScopeSessions(args: {
@@ -183,14 +192,14 @@ async function scanRemoteInScopeSessions(args: {
   issues: AiVaultScanIssue[]
   scopePaths: readonly string[]
   limit: number
-  alreadyParsedFilePaths: ReadonlySet<string>
+  alreadyParsedCandidateKeys: ReadonlySet<string>
 }): Promise<AiVaultSession[]> {
   if (args.scopePaths.length === 0) {
     return []
   }
 
   const candidates = args.candidates.filter(
-    (candidate) => !args.alreadyParsedFilePaths.has(candidate.file.path)
+    (candidate) => !args.alreadyParsedCandidateKeys.has(remoteSessionCandidateKey(candidate))
   )
   const bound = Math.min(candidates.length, REMOTE_SCOPE_PARSE_CANDIDATE_LIMIT)
   const sessions: AiVaultSession[] = []
diff --git a/src/main/ai-vault/remote-session-transcript-read.ts b/src/main/ai-vault/remote-session-transcript-read.ts
index 42ea29af4099..bc9d4a595323 100644
--- a/src/main/ai-vault/remote-session-transcript-read.ts
+++ b/src/main/ai-vault/remote-session-transcript-read.ts
@@ -9,6 +9,9 @@ export async function parseRemoteSessionTranscript(
   candidate: RemoteSessionCandidate,
   context: RemoteScannerContext
 ): Promise<AiVaultSession | null> {
+  if (candidate.source.parseCandidate) {
+    return candidate.source.parseCandidate(candidate.file, context)
+  }
   const sidecar = candidate.file.sidecar
   const exceedsWholeReadLimit =
     (candidate.file.sizeBytes ?? 0) > LEGACY_SESSION_TEXT_LIMIT_BYTES ||
diff --git a/src/main/ai-vault/session-first-user-prompt-opencode.test.ts b/src/main/ai-vault/session-first-user-prompt-opencode.test.ts
new file mode 100644
index 000000000000..c0d81a531a6f
--- /dev/null
+++ b/src/main/ai-vault/session-first-user-prompt-opencode.test.ts
@@ -0,0 +1,86 @@
+import { beforeEach, expect, it, vi } from 'vitest'
+import { readAiVaultFirstUserPrompt } from './session-first-user-prompt-read'
+
+const reader = vi.hoisted(() => ({ v1: vi.fn(), v2: vi.fn() }))
+vi.mock('./session-scanner-opencode-sqlite-worker-spawn', () => ({
+  parseOpenCodeSqliteSessionViaWorker: reader.v1,
+  parseOpenCode2SqliteSessionViaWorker: reader.v2
+}))
+
+beforeEach(() => {
+  reader.v1.mockReset().mockResolvedValue({ firstUserPrompt: 'full first prompt' })
+  reader.v2.mockReset().mockResolvedValue({ firstUserPrompt: 'full second-schema prompt' })
+})
+
+it('asks the host reader for the full prompt instead of opening SQLite in the calling process', async () => {
+  expect(
+    await readAiVaultFirstUserPrompt({
+      agent: 'opencode',
+      filePath: '/home/me/opencode.db#session-1'
+    })
+  ).toEqual({ prompt: 'full first prompt' })
+  expect(reader.v1).toHaveBeenCalledWith({
+    dbPath: '/home/me/opencode.db',
+    sessionId: 'session-1',
+    platform: process.platform,
+    fullFirstUserPrompt: true
+  })
+})
+
+it('keeps a WSL database address intact for host routing', async () => {
+  const dbPath = '\\\\wsl.localhost\\Ubuntu\\home\\me\\opencode.db'
+  expect(
+    await readAiVaultFirstUserPrompt({
+      agent: 'opencode',
+      filePath: dbPath,
+      sessionId: 'session-1'
+    })
+  ).toEqual({ prompt: 'full first prompt' })
+  expect(reader.v1).toHaveBeenCalledWith(
+    expect.objectContaining({
+      dbPath,
+      sessionId: 'session-1',
+      fullFirstUserPrompt: true
+    })
+  )
+})
+
+it('supports the v2 schema through the same full-prompt worker contract', async () => {
+  expect(
+    await readAiVaultFirstUserPrompt({
+      agent: 'opencode2',
+      filePath: '/home/me/opencode.db',
+      sessionId: 'channel/session-1'
+    })
+  ).toEqual({ prompt: 'full second-schema prompt' })
+  expect(reader.v2).toHaveBeenCalledWith(
+    expect.objectContaining({
+      sessionId: 'channel/session-1',
+      fullFirstUserPrompt: true
+    })
+  )
+  expect(reader.v1).not.toHaveBeenCalled()
+})
+
+it('does not substitute local history for a remote session', async () => {
+  expect(
+    await readAiVaultFirstUserPrompt({
+      agent: 'opencode',
+      filePath: '/home/me/opencode.db',
+      sessionId: 'session-1',
+      executionHostId: 'ssh:host'
+    })
+  ).toEqual({ prompt: null })
+  expect(reader.v1).not.toHaveBeenCalled()
+})
+
+it('degrades a failed guest read to an unavailable prompt', async () => {
+  reader.v1.mockRejectedValue(new Error('guest stopped'))
+  expect(
+    await readAiVaultFirstUserPrompt({
+      agent: 'opencode',
+      filePath: '/home/me/opencode.db',
+      sessionId: 'session-1'
+    })
+  ).toEqual({ prompt: null })
+})
diff --git a/src/main/ai-vault/session-first-user-prompt-read.ts b/src/main/ai-vault/session-first-user-prompt-read.ts
index ac5a35f2a532..c0aa1b8a2197 100644
--- a/src/main/ai-vault/session-first-user-prompt-read.ts
+++ b/src/main/ai-vault/session-first-user-prompt-read.ts
@@ -7,9 +7,15 @@ import { LOCAL_EXECUTION_HOST_ID, type ExecutionHostId } from '../../shared/exec
 import { wslGatedStat } from '../native-chat/wsl-transcript-fs-access'
 import { parseAgentSessionFile } from './session-scanner-agent-parser'
 import { withFullFirstUserPromptCapture } from './session-scanner-first-user-prompt-capture'
-import { parseOpenCodeSqliteSession } from './session-scanner-opencode-sqlite'
+import {
+  parseOpenCodeSqliteSessionViaWorker,
+  parseOpenCode2SqliteSessionViaWorker,
+  parseZcodeSqliteSessionViaWorker
+} from './session-scanner-opencode-sqlite-worker-spawn'
 import { splitOpenCodeSqliteCandidate } from './session-scanner-opencode-sqlite-paths'
 import type { FileWithMtime } from './session-scanner-types'
+import type { OpenCodeWslRuntime } from './session-scanner-opencode-wsl-runtime'
+import { configureOpenCodeWslReaders } from './session-scanner-opencode-wsl-client'
 
 export type ReadAiVaultFirstUserPromptArgs = {
   agent: AiVaultAgent
@@ -17,6 +23,7 @@ export type ReadAiVaultFirstUserPromptArgs = {
   sessionId?: string
   executionHostId?: ExecutionHostId
   codexHome?: string | null
+  wslOpenCodeReaders?: readonly OpenCodeWslRuntime[]
 }
 
 export type ReadAiVaultFirstUserPromptResult = AiVaultFirstUserPromptResult
@@ -39,6 +46,9 @@ export async function readAiVaultFirstUserPrompt(
   if (executionHostId !== LOCAL_EXECUTION_HOST_ID) {
     return { prompt: null }
   }
+  if (args.wslOpenCodeReaders) {
+    configureOpenCodeWslReaders(args.wslOpenCodeReaders)
+  }
 
   // Why: partial/corrupt transcripts make parsers throw. Resolve null like every
   // other unavailable case instead of rejecting the IPC call.
@@ -66,20 +76,26 @@ async function parseSessionForFullFirstUserPrompt(args: {
   sessionId?: string
   codexHome: string | null
 }): Promise<AiVaultSession | null> {
-  // Why: OpenCode SQLite sessions store filePath as the db path (not db#id).
-  // Re-parse in-process under full capture so ALS applies and we can read the
-  // earliest user row (worker list-scan path only joins newest messages).
-  if (args.agent === 'opencode') {
-    const fromSynthetic = splitOpenCodeSqliteCandidate(args.filePath)
+  // Full capture belongs inside the reader, including the guest reader for WSL.
+  if (args.agent === 'opencode' || args.agent === 'opencode2' || args.agent === 'zcode') {
+    const parse =
+      args.agent === 'opencode2'
+        ? parseOpenCode2SqliteSessionViaWorker
+        : args.agent === 'zcode'
+          ? parseZcodeSqliteSessionViaWorker
+          : parseOpenCodeSqliteSessionViaWorker
+    const fromSynthetic = splitOpenCodeSqliteCandidate(args.filePath, args.agent)
     if (fromSynthetic) {
-      return parseOpenCodeSqliteSession({
+      return parse({
+        fullFirstUserPrompt: true,
         dbPath: fromSynthetic.dbPath,
         sessionId: fromSynthetic.sessionId,
         platform: process.platform
       })
     }
     if (args.sessionId) {
-      return parseOpenCodeSqliteSession({
+      return parse({
+        fullFirstUserPrompt: true,
         dbPath: args.filePath,
         sessionId: args.sessionId,
         platform: process.platform
diff --git a/src/main/ai-vault/session-scanner-agent-parser.ts b/src/main/ai-vault/session-scanner-agent-parser.ts
index 7ca808173cf1..80a56bf2519d 100644
--- a/src/main/ai-vault/session-scanner-agent-parser.ts
+++ b/src/main/ai-vault/session-scanner-agent-parser.ts
@@ -1,4 +1,5 @@
 import type { AiVaultSession } from '../../shared/ai-vault-types'
+import { throwIfSignalAborted } from '../../shared/abort-signal-reason'
 import { parseDevinSessionFile } from './session-scanner-devin-parser'
 import { parseAntigravitySessionFile } from './session-scanner-antigravity-parser'
 import { parseDroidSessionFile } from './session-scanner-droid-parser'
@@ -11,8 +12,10 @@ import { splitOpenCodeSqliteCandidate } from './session-scanner-opencode-sqlite-
 import {
   captureOpenCodeSqliteSessionViaWorker,
   captureOpenCode2SqliteSessionViaWorker,
+  captureZcodeSqliteSessionViaWorker,
   parseOpenCode2SqliteSessionViaWorker,
-  parseOpenCodeSqliteSessionViaWorker
+  parseOpenCodeSqliteSessionViaWorker,
+  parseZcodeSqliteSessionViaWorker
 } from './session-scanner-opencode-sqlite-worker-spawn'
 import { parseClaudeSessionFile } from './session-scanner-primary-parsers'
 import { parseGeminiSessionFile } from './session-scanner-gemini-parsers'
@@ -35,17 +38,36 @@ import type { TranscriptMessageSink } from './session-transcript-consumers'
 async function readOpenCodeSqliteCandidate(
   sqliteCandidate: { dbPath: string; sessionId: string },
   platform: NodeJS.Platform,
-  messages?: TranscriptMessageSink
+  messages?: TranscriptMessageSink,
+  signal?: AbortSignal,
+  agent?: 'opencode2' | 'zcode'
 ): Promise<AiVaultSession | null> {
-  const request = { ...sqliteCandidate, platform }
+  throwIfSignalAborted(signal)
+  const request = { ...sqliteCandidate, platform, signal }
   if (!messages?.active) {
-    return parseOpenCodeSqliteSessionViaWorker(request)
+    const parse =
+      agent === 'opencode2'
+        ? parseOpenCode2SqliteSessionViaWorker
+        : agent === 'zcode'
+          ? parseZcodeSqliteSessionViaWorker
+          : parseOpenCodeSqliteSessionViaWorker
+    const session = await parse(request)
+    throwIfSignalAborted(signal)
+    return session
   }
-  const capture = await captureOpenCodeSqliteSessionViaWorker(request)
-  for (const message of capture.messages) {
+  const capture =
+    agent === 'opencode2'
+      ? captureOpenCode2SqliteSessionViaWorker
+      : agent === 'zcode'
+        ? captureZcodeSqliteSessionViaWorker
+        : captureOpenCodeSqliteSessionViaWorker
+  const result = await capture(request)
+  for (const message of result.messages) {
+    throwIfSignalAborted(signal)
     messages.push(message)
   }
-  return capture.session
+  throwIfSignalAborted(signal)
+  return result.session
 }
 
 /**
@@ -61,7 +83,8 @@ async function readOpenCodeSqliteCandidate(
 export async function parseAgentSessionFile(
   candidate: SessionFileCandidate,
   platform: NodeJS.Platform,
-  messages?: TranscriptMessageSink
+  messages?: TranscriptMessageSink,
+  signal?: AbortSignal
 ): Promise<AiVaultSession | null> {
   switch (candidate.agent) {
     case 'claude':
@@ -88,7 +111,7 @@ export async function parseAgentSessionFile(
       // real filesystem paths and fall through to the JSON parser.
       const sqliteCandidate = splitOpenCodeSqliteCandidate(candidate.file.path)
       if (sqliteCandidate) {
-        return readOpenCodeSqliteCandidate(sqliteCandidate, platform, messages)
+        return readOpenCodeSqliteCandidate(sqliteCandidate, platform, messages, signal)
       }
       return parseOpenCodeSessionFile(candidate.file, platform, messages)
     }
@@ -98,25 +121,16 @@ export async function parseAgentSessionFile(
       // candidate path; there is no legacy file store.
       const sqliteCandidate = splitOpenCodeSqliteCandidate(candidate.file.path)
       if (sqliteCandidate) {
-        if (messages?.active) {
-          const capture = await captureOpenCode2SqliteSessionViaWorker({
-            dbPath: sqliteCandidate.dbPath,
-            sessionId: sqliteCandidate.sessionId,
-            platform
-          })
-          for (const message of capture.messages) {
-            messages.push(message)
-          }
-          return capture.session
-        }
-        return parseOpenCode2SqliteSessionViaWorker({
-          dbPath: sqliteCandidate.dbPath,
-          sessionId: sqliteCandidate.sessionId,
-          platform
-        })
+        return readOpenCodeSqliteCandidate(sqliteCandidate, platform, messages, signal, 'opencode2')
       }
       return null
     }
+    case 'zcode': {
+      const sqliteCandidate = splitOpenCodeSqliteCandidate(candidate.file.path, 'zcode')
+      return sqliteCandidate
+        ? readOpenCodeSqliteCandidate(sqliteCandidate, platform, messages, signal, 'zcode')
+        : null
+    }
     case 'grok':
       return parseGrokSessionFile(candidate.file, platform, messages)
     case 'hermes':
diff --git a/src/main/ai-vault/session-scanner-background.ts b/src/main/ai-vault/session-scanner-background.ts
index 6903e689a64f..70eca2434ef5 100644
--- a/src/main/ai-vault/session-scanner-background.ts
+++ b/src/main/ai-vault/session-scanner-background.ts
@@ -25,6 +25,7 @@ import {
 } from './session-scanner-worker-spawn'
 import type { AiVaultWorkerScanOptions } from './session-scanner-worker-protocol'
 import { listLocalAiVaultSubagentSessions } from './session-subagent-reader'
+import { isWslUncPath } from '../../shared/wsl-paths'
 
 export function shouldUseAiVaultServiceProcess(): boolean {
   const configured = process.env.ORCA_AI_VAULT_SERVICE_PROCESS
@@ -70,9 +71,14 @@ export function listAiVaultSubagentSessionsInBackground(
     : listLocalAiVaultSubagentSessions(request)
 }
 
-export function readAiVaultFirstUserPromptInBackground(
+export async function readAiVaultFirstUserPromptInBackground(
   request: ReadAiVaultFirstUserPromptArgs
 ): Promise<ReadAiVaultFirstUserPromptResult> {
+  if (process.platform === 'win32' && isWslUncPath(request.filePath)) {
+    const { localAiVaultScanRoots } = await import('./cached-session-list')
+    const roots = await localAiVaultScanRoots()
+    request = { ...request, wslOpenCodeReaders: roots.wslOpenCodeReaders ?? [] }
+  }
   return shouldUseAiVaultServiceProcess()
     ? readAiVaultFirstUserPromptInService(request)
     : readAiVaultFirstUserPrompt(request)
diff --git a/src/main/ai-vault/session-scanner-codex-workers.test.ts b/src/main/ai-vault/session-scanner-codex-workers.test.ts
index 79271cbf39eb..4d001d00422c 100644
--- a/src/main/ai-vault/session-scanner-codex-workers.test.ts
+++ b/src/main/ai-vault/session-scanner-codex-workers.test.ts
@@ -219,6 +219,7 @@ describe('scanAiVaultSessions Codex worker sessions', () => {
       droidProjectsDir: join(root, 'droid-projects'),
       kimiSessionsDir: join(root, 'kimi-sessions'),
       museSessionsDir: join(root, 'muse-sessions'),
+      zcodeDbPath: join(root, 'zcode-db.sqlite'),
       platform: 'darwin'
     })
 
diff --git a/src/main/ai-vault/session-scanner-every-agent-fixture.ts b/src/main/ai-vault/session-scanner-every-agent-fixture.ts
index 5ae04c11b570..23caa8e348d5 100644
--- a/src/main/ai-vault/session-scanner-every-agent-fixture.ts
+++ b/src/main/ai-vault/session-scanner-every-agent-fixture.ts
@@ -5,6 +5,7 @@ import {
 } from './session-scanner-test-fixtures'
 import { writeDocumentAgentFixtures } from './session-scanner-document-agent-fixtures'
 import { writeLogAgentFixtures } from './session-scanner-log-agent-fixtures'
+import { writeOpenCodeSqliteDatabase } from './session-scanner-opencode-sqlite-fixture'
 
 // Why this is shared rather than inline in one test: it is the only place that
 // writes one transcript in every supported agent's own format. A scan test and
@@ -34,5 +35,13 @@ export async function writeEveryAgentVault(root: string): Promise<EveryAgentVaul
   await writeDocumentAgentFixtures(root, roots, antigravitySessionId)
   await writeMuseScannerFixture(roots.museSessionsDir)
   roots.opencodeDbPaths = [await writeOpenCode2SqliteFixture(root)]
+  writeOpenCodeSqliteDatabase(roots.zcodeDbPath, [
+    {
+      id: 'zcode-session',
+      directory: '/tmp/zcode',
+      title: 'ZCode title',
+      turns: [{ role: 'user', parts: ['ZCode session prompt'] }]
+    }
+  ])
   return { roots, antigravitySessionId, ompSessionFile, primeAgentSessionFile }
 }
diff --git a/src/main/ai-vault/session-scanner-opencode-cancellation.test.ts b/src/main/ai-vault/session-scanner-opencode-cancellation.test.ts
new file mode 100644
index 000000000000..4f47af380cd8
--- /dev/null
+++ b/src/main/ai-vault/session-scanner-opencode-cancellation.test.ts
@@ -0,0 +1,122 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type * as workerSpawn from './session-scanner-opencode-sqlite-worker-spawn'
+import type { SessionFileDiscovery } from './session-scanner-types'
+import type { TranscriptReadOutcome } from './session-transcript-consumers'
+import { createAccumulator, finalizeSession } from './session-scanner-accumulator'
+
+const readers = vi.hoisted(() => ({
+  parse: vi.fn<typeof workerSpawn.parseOpenCodeSqliteSessionViaWorker>(),
+  capture: vi.fn<typeof workerSpawn.captureOpenCodeSqliteSessionViaWorker>(),
+  discover: vi.fn<() => Promise<SessionFileDiscovery[]>>()
+}))
+vi.mock('./session-scanner-opencode-sqlite-worker-spawn', () => ({
+  parseOpenCodeSqliteSessionViaWorker: readers.parse,
+  parseOpenCode2SqliteSessionViaWorker: readers.parse,
+  captureOpenCodeSqliteSessionViaWorker: readers.capture,
+  captureOpenCode2SqliteSessionViaWorker: readers.capture
+}))
+vi.mock('./session-scanner-source-discovery', () => ({
+  discoverAiVaultSessionSources: readers.discover
+}))
+import { scanAiVaultSessions } from './session-scanner'
+import { resetSessionParseCacheForTests } from './session-scanner-parse-cache'
+import {
+  registerTranscriptConsumer,
+  resetTranscriptConsumersForTests
+} from './session-transcript-consumers'
+
+const file = {
+  path: '/fixture/opencode.db#session',
+  mtimeMs: 1,
+  modifiedAt: new Date(1).toISOString()
+}
+const messages = [
+  { role: 'user' as const, text: 'First', timestamp: null },
+  { role: 'assistant' as const, text: 'Second', timestamp: null }
+]
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  resetSessionParseCacheForTests()
+})
+afterEach(() => {
+  resetTranscriptConsumersForTests()
+  resetSessionParseCacheForTests()
+})
+
+function configure(agent: 'opencode' | 'opencode2') {
+  readers.discover.mockResolvedValue([{ agent, rootDir: '/fixture', files: [file] }])
+  const accumulator = createAccumulator({ agent, file, sessionId: 'session' })
+  accumulator.title = 'SQLite session'
+  return finalizeSession(accumulator, 'linux')
+}
+
+function untilAborted(signal: AbortSignal | undefined): Promise<never> {
+  if (!signal) {
+    throw new Error('SQLite request did not receive the scan signal')
+  }
+  return new Promise((_resolve, reject) => {
+    signal.addEventListener('abort', () => reject(signal.reason), { once: true })
+  })
+}
+
+describe.each(['opencode', 'opencode2'] as const)('%s scan cancellation', (agent) => {
+  it.each(['parse', 'capture'] as const)(
+    'cancels an active %s and retries the uncached read',
+    async (mode) => {
+      const session = configure(agent)
+      const outcomes: TranscriptReadOutcome[] = []
+      if (mode === 'capture') {
+        registerTranscriptConsumer({
+          beginRead: () => ({ message() {}, finish: (outcome) => outcomes.push(outcome) })
+        })
+        readers.capture.mockImplementationOnce(({ signal }) => untilAborted(signal))
+      } else {
+        readers.parse.mockImplementationOnce(({ signal }) => untilAborted(signal))
+      }
+      const controller = new AbortController()
+      const pending = scanAiVaultSessions({ platform: 'linux', signal: controller.signal })
+      const rejected = expect(pending).rejects.toMatchObject({ name: 'AbortError' })
+      await vi.waitFor(() => expect(readers[mode]).toHaveBeenCalledOnce())
+      controller.abort(new Error('Cancelled SQLite scan'))
+      await rejected
+      if (mode === 'capture') {
+        expect(outcomes).toEqual([{ session: null, byteOffset: 0, incomplete: true }])
+      }
+      readers.parse.mockResolvedValue(session)
+      readers.capture.mockResolvedValue({ session, messages })
+      const retried = await scanAiVaultSessions({ platform: 'linux' })
+      expect(readers[mode]).toHaveBeenCalledTimes(2)
+      expect(retried.sessions).toHaveLength(1)
+      if (mode === 'capture') {
+        expect(outcomes.at(-1)?.incomplete).toBe(false)
+      }
+    }
+  )
+
+  it('marks a partially delivered capture incomplete and never caches it', async () => {
+    const session = configure(agent)
+    const controller = new AbortController()
+    const outcomes: TranscriptReadOutcome[] = []
+    const received: string[] = []
+    registerTranscriptConsumer({
+      beginRead: () => ({
+        message(message) {
+          received.push(message.text)
+          controller.abort()
+        },
+        finish: (outcome) => outcomes.push(outcome)
+      })
+    })
+    readers.capture.mockResolvedValue({ session, messages })
+    await expect(
+      scanAiVaultSessions({ platform: 'linux', signal: controller.signal })
+    ).rejects.toMatchObject({ name: 'AbortError' })
+    expect(received).toEqual(['First'])
+    expect(outcomes).toEqual([{ session: null, byteOffset: 0, incomplete: true }])
+    resetTranscriptConsumersForTests()
+    readers.parse.mockResolvedValue(session)
+    expect((await scanAiVaultSessions({ platform: 'linux' })).sessions).toHaveLength(1)
+    expect(readers.parse).toHaveBeenCalledOnce()
+  })
+})
diff --git a/src/main/ai-vault/session-scanner-opencode-process-admission.test.ts b/src/main/ai-vault/session-scanner-opencode-process-admission.test.ts
new file mode 100644
index 000000000000..5f8920043a1c
--- /dev/null
+++ b/src/main/ai-vault/session-scanner-opencode-process-admission.test.ts
@@ -0,0 +1,116 @@
+import { EventEmitter } from 'node:events'
+import { PassThrough } from 'node:stream'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { createOpenCodeSqliteProcessClient } from './session-scanner-opencode-sqlite-process-client'
+
+const mocked = vi.hoisted(() => ({ spawn: vi.fn() }))
+vi.mock('../../shared/child-process/run-process', () => ({ spawnProcess: mocked.spawn }))
+
+function child() {
+  const process = Object.assign(new EventEmitter(), {
+    stdin: new PassThrough(),
+    stdout: new PassThrough(),
+    stderr: new PassThrough(),
+    unref: vi.fn(),
+    kill: vi.fn()
+  })
+  process.stdin.on('data', (data) => {
+    const request = JSON.parse(data.toString())
+    if (request.sessionId !== 'block') {
+      process.stdout.write(`${JSON.stringify({ id: request.id, ok: true, value: null })}\n`)
+    }
+  })
+  return process
+}
+const args = { dbPath: '/home/ada/opencode.db', sessionId: 'session', platform: 'linux' as const }
+const clients: ReturnType<typeof createOpenCodeSqliteProcessClient>[] = []
+afterEach(() => {
+  clients.splice(0).forEach((client) => client.dispose())
+  vi.restoreAllMocks()
+  vi.clearAllMocks()
+})
+
+function reader(beforeSpawn: (signal: AbortSignal) => Promise<void>, idleTeardownMs = 30_000) {
+  mocked.spawn.mockImplementation(child)
+  const result = createOpenCodeSqliteProcessClient({
+    executable: 'wsl.exe',
+    args: ['--exec', '/runtime', '/reader'],
+    beforeSpawn,
+    idleTeardownMs
+  })
+  clients.push(result)
+  return result
+}
+
+describe('SQLite process launch admission', () => {
+  it('does not probe a reader cancelled before admission starts', async () => {
+    const admit = vi.fn(async () => {})
+    const client = reader(admit)
+    const cancellation = new AbortController()
+    const pending = client.parse({ ...args, signal: cancellation.signal })
+    const rejected = expect(pending).rejects.toThrow('cancelled')
+    cancellation.abort(new Error('cancelled'))
+    await rejected
+    await Promise.resolve()
+    expect(admit).not.toHaveBeenCalled()
+    expect(mocked.spawn).not.toHaveBeenCalled()
+  })
+
+  it('probes once per process, reuses it for every read, and reprobes after idle expiry', async () => {
+    const admit = vi.fn(async () => {})
+    const client = reader(admit, 15)
+    for (let index = 0; index < 20; index++) {
+      expect(await client.parse(args)).toBeNull()
+    }
+    expect(admit).toHaveBeenCalledOnce()
+    expect(mocked.spawn).toHaveBeenCalledOnce()
+    await vi.waitFor(() => expect(mocked.spawn.mock.results[0]?.value.kill).toHaveBeenCalled())
+    await client.parse(args)
+    expect(admit).toHaveBeenCalledTimes(2)
+    expect(mocked.spawn).toHaveBeenCalledTimes(2)
+  })
+
+  it('blocks every queued respawn after the execution host stops', async () => {
+    const admit = vi.fn(async () => {})
+    const client = reader(admit)
+    const active = client.parse({ ...args, sessionId: 'block' }).catch((error: unknown) => error)
+    const queued = Array.from({ length: 4 }, () =>
+      client.parse(args).catch((error: unknown) => error)
+    )
+    await vi.waitFor(() => expect(mocked.spawn).toHaveBeenCalledOnce())
+    admit.mockRejectedValue(new Error('Distro is not running'))
+    mocked.spawn.mock.results[0]?.value.emit('exit', 1)
+    expect(await active).toMatchObject({ message: expect.stringContaining('exited') })
+    for (const result of await Promise.all(queued)) {
+      expect(result).toBeInstanceOf(Error)
+    }
+    expect(mocked.spawn).toHaveBeenCalledOnce()
+    expect(admit.mock.calls.length).toBeGreaterThan(1)
+  })
+
+  it('rejects unavailable admission and cancels a pending probe without a late spawn', async () => {
+    const refused = reader(async () => {
+      throw new Error('Running state unavailable')
+    })
+    await expect(refused.parse(args)).rejects.toThrow('Running state unavailable')
+    expect(mocked.spawn).not.toHaveBeenCalled()
+    let finish = () => {}
+    const admit = vi.fn(
+      () =>
+        new Promise<void>((resolve) => {
+          finish = resolve
+        })
+    )
+    const waiting = reader(admit)
+    const cancellation = new AbortController()
+    const pending = waiting.parse({ ...args, signal: cancellation.signal })
+    const rejected = expect(pending).rejects.toThrow('cancelled')
+    await vi.waitFor(() => expect(admit).toHaveBeenCalledOnce())
+    cancellation.abort(new Error('cancelled'))
+    await rejected
+    finish()
+    await Promise.resolve()
+    await Promise.resolve()
+    expect(mocked.spawn).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/main/ai-vault/session-scanner-opencode-sources.ts b/src/main/ai-vault/session-scanner-opencode-sources.ts
index ea93787d6425..5f15f17d7582 100644
--- a/src/main/ai-vault/session-scanner-opencode-sources.ts
+++ b/src/main/ai-vault/session-scanner-opencode-sources.ts
@@ -24,11 +24,14 @@ export function opencodeDiscoveries(
           storageDir,
           dbPaths: dbPaths.filter((path) => !isOpenCodeV2DatabaseName(basename(path))),
           limitPerAgent: limit,
-          issues
+          issues,
+          signal: options.signal
         })
       ),
       // Current releases share opencode.db with v1; the worker checks for v2 tables.
-      paths.then((dbPaths) => discoverOpenCode2Sessions(storageDir, dbPaths, limit, issues))
+      paths.then((dbPaths) =>
+        discoverOpenCode2Sessions(storageDir, dbPaths, limit, issues, options.signal)
+      )
     ]
   })
 }
@@ -96,9 +99,10 @@ async function discoverOpenCode2Sessions(
   storageDir: string,
   dbPaths: readonly string[],
   limit: number,
-  issues: AiVaultScanIssue[]
+  issues: AiVaultScanIssue[],
+  signal?: AbortSignal
 ): Promise<SessionFileDiscovery> {
-  const files = await listOpenCode2SqliteSessionsViaWorker({ dbPaths, limit, issues })
+  const files = await listOpenCode2SqliteSessionsViaWorker({ dbPaths, limit, issues, signal })
   return {
     agent: 'opencode2' as const,
     rootDir: storageDir,
diff --git a/src/main/ai-vault/session-scanner-opencode-sqlite-capture.ts b/src/main/ai-vault/session-scanner-opencode-sqlite-capture.ts
index f4622118956e..ef15b368ef34 100644
--- a/src/main/ai-vault/session-scanner-opencode-sqlite-capture.ts
+++ b/src/main/ai-vault/session-scanner-opencode-sqlite-capture.ts
@@ -10,6 +10,7 @@ import { readOpenCodeDatabase } from './session-scanner-opencode-sqlite-open'
 import { canReadOpenCodeMessageParts } from './session-scanner-opencode-sqlite-schema'
 import type { TranscriptMessage, TranscriptMessageRole } from './session-transcript-consumers'
 import { boundedText, toolCallText } from './session-transcript-message-content'
+import { zcodeVisibleMessageFilter } from './session-scanner-zcode-visibility'
 import type SyncDatabase from '../sqlite/sync-database'
 
 // Why: the session list needs the newest few messages, and the search index
@@ -119,7 +120,7 @@ function captureRole(role: string | null): TranscriptMessageRole | null {
   return role === 'user' || role === 'assistant' ? role : null
 }
 
-function buildCaptureQuery(): string {
+function buildCaptureQuery(agent: 'opencode' | 'zcode'): string {
   // Message order, then part order within a message: the same key the preview
   // read uses, run forwards and without the newest-N window.
   return `SELECT m.id AS message_id,
@@ -130,6 +131,7 @@ function buildCaptureQuery(): string {
           FROM message m
           JOIN part p ON p.message_id = m.id
           WHERE m.session_id = ?
+            ${zcodeVisibleMessageFilter(agent)}
             AND json_extract(m.data, '$.role') IN ('user','assistant')
             AND json_extract(p.data, '$.type') IN ${OPENCODE_CAPTURE_PART_TYPES}
           ORDER BY m.time_created ASC, m.id ASC, p.time_created ASC, p.rowid ASC
@@ -149,20 +151,24 @@ function buildCaptureQuery(): string {
  */
 export function readOpenCodeSessionMessages(
   db: SyncDatabase,
-  sessionId: string
+  sessionId: string,
+  agent: 'opencode' | 'zcode' = 'opencode'
 ): TranscriptMessage[] {
+  const agentName = agent === 'zcode' ? 'ZCode' : 'OpenCode'
   if (!canReadOpenCodeMessageParts(db)) {
     // Thrown for the same reason the part limit below throws: an empty capture
     // returned here is committed under a complete-read cursor, so the session
     // stays out of search with nothing on its row to say why and no retry.
     throw new Error(
-      `OpenCode session ${sessionId} uses an unreadable message-part schema; its transcript was not read.`
+      `${agentName} session ${sessionId} uses an unreadable message-part schema; its transcript was not read.`
     )
   }
-  const rows = db.prepare(buildCaptureQuery()).all(sessionId, OPENCODE_CAPTURE_RECORD_LIMIT + 1)
+  const rows = db
+    .prepare(buildCaptureQuery(agent))
+    .all(sessionId, OPENCODE_CAPTURE_RECORD_LIMIT + 1)
   if (rows.length > OPENCODE_CAPTURE_RECORD_LIMIT) {
     throw new Error(
-      `OpenCode session ${sessionId} holds more than ${OPENCODE_CAPTURE_RECORD_LIMIT} text parts; its transcript was not read.`
+      `${agentName} session ${sessionId} holds more than ${OPENCODE_CAPTURE_RECORD_LIMIT} text parts; its transcript was not read.`
     )
   }
 
@@ -178,7 +184,7 @@ export function readOpenCodeSessionMessages(
     captured += message.text.length
     if (captured > OPENCODE_CAPTURE_TEXT_LIMIT) {
       throw new Error(
-        `OpenCode session ${sessionId} decodes to more than ${OPENCODE_CAPTURE_TEXT_LIMIT} characters; its transcript was not read.`
+        `${agentName} session ${sessionId} decodes to more than ${OPENCODE_CAPTURE_TEXT_LIMIT} characters; its transcript was not read.`
       )
     }
     messages.push(message)
@@ -237,13 +243,17 @@ export async function captureOpenCodeSqliteSession(args: {
   dbPath: string
   sessionId: string
   platform: NodeJS.Platform
+  agent?: 'opencode' | 'zcode'
 }): Promise<OpenCodeSqliteCapture> {
   return readOpenCodeDatabase({
     dbPath: args.dbPath,
     read: (db) => {
       const session = readOpenCodeSqliteSession({ db, ...args })
       // No session row is no transcript: the id names nothing in this database.
-      return { session, messages: session ? readOpenCodeSessionMessages(db, args.sessionId) : [] }
+      return {
+        session,
+        messages: session ? readOpenCodeSessionMessages(db, args.sessionId, args.agent) : []
+      }
     }
   })
 }
diff --git a/src/main/ai-vault/session-scanner-opencode-sqlite-coexistence.test.ts b/src/main/ai-vault/session-scanner-opencode-sqlite-coexistence.test.ts
index ff51677d27f0..e2fbcb225129 100644
--- a/src/main/ai-vault/session-scanner-opencode-sqlite-coexistence.test.ts
+++ b/src/main/ai-vault/session-scanner-opencode-sqlite-coexistence.test.ts
@@ -17,6 +17,9 @@ vi.mock('./session-scanner-opencode-sqlite-worker-spawn', async () => {
   return {
     listOpenCode2SqliteSessionsViaWorker: listOpenCode2SqliteSessions,
     listOpenCodeSqliteSessionsViaWorker: listOpenCodeSqliteSessions,
+    // ZCode reuses the OpenCode SQLite lister; the worker only varies the agent it stamps.
+    listZcodeSqliteSessionsViaWorker: (args: Parameters<typeof listOpenCodeSqliteSessions>[0]) =>
+      listOpenCodeSqliteSessions({ ...args, agent: 'zcode' }),
     parseOpenCodeSqliteSessionViaWorker: parseOpenCodeSqliteSession
   }
 })
@@ -54,6 +57,7 @@ function isolatedScanRoots(root: string) {
     droidProjectsDir: join(root, 'droid-projects'),
     kimiSessionsDir: join(root, 'kimi-sessions'),
     museSessionsDir: join(root, 'muse-sessions'),
+    zcodeDbPath: join(root, 'zcode-db.sqlite'),
     ompSessionsDir: join(root, 'omp-sessions'),
     primeAgentSessionsDir: join(root, 'prime-agent-sessions')
   }
diff --git a/src/main/ai-vault/session-scanner-opencode-sqlite-discovery.ts b/src/main/ai-vault/session-scanner-opencode-sqlite-discovery.ts
index a32ca1b24471..f8d8a84a7a94 100644
--- a/src/main/ai-vault/session-scanner-opencode-sqlite-discovery.ts
+++ b/src/main/ai-vault/session-scanner-opencode-sqlite-discovery.ts
@@ -40,6 +40,7 @@ export async function discoverOpenCodeSessions(args: {
   dbPaths: readonly string[]
   limitPerAgent: number
   issues: AiVaultScanIssue[]
+  signal?: AbortSignal
 }): Promise<SessionFileDiscovery> {
   const [fileDiscovery, sqliteCandidates] = await Promise.all([
     discoverFiles({
@@ -54,7 +55,8 @@ export async function discoverOpenCodeSessions(args: {
     listOpenCodeSqliteSessionsViaWorker({
       dbPaths: args.dbPaths,
       limit: args.limitPerAgent,
-      issues: args.issues
+      issues: args.issues,
+      signal: args.signal
     })
   ])
 
diff --git a/src/main/ai-vault/session-scanner-opencode-sqlite-dispatch.ts b/src/main/ai-vault/session-scanner-opencode-sqlite-dispatch.ts
new file mode 100644
index 000000000000..e483f9482e11
--- /dev/null
+++ b/src/main/ai-vault/session-scanner-opencode-sqlite-dispatch.ts
@@ -0,0 +1,68 @@
+import type { AiVaultScanIssue } from '../../shared/ai-vault-types'
+import { captureOpenCodeSqliteSession } from './session-scanner-opencode-sqlite-capture'
+import { listOpenCodeSqliteSessions } from './session-scanner-opencode-sqlite-list'
+import { parseOpenCodeSqliteSession } from './session-scanner-opencode-sqlite'
+import { listOpenCode2SqliteSessions } from './session-scanner-opencode2-sqlite-list'
+import {
+  captureOpenCode2SqliteSession,
+  parseOpenCode2SqliteSession
+} from './session-scanner-opencode2-sqlite'
+import type {
+  OpenCodeSqliteWorkerRequest,
+  OpenCodeSqliteWorkerResponse
+} from './session-scanner-opencode-sqlite-worker-protocol'
+
+import { withFullFirstUserPromptCapture } from './session-scanner-first-user-prompt-capture'
+
+export async function handleOpenCodeSqliteRequest(
+  request: OpenCodeSqliteWorkerRequest
+): Promise<OpenCodeSqliteWorkerResponse> {
+  try {
+    if (request.kind === 'list') {
+      const issues: AiVaultScanIssue[] = []
+      const candidates =
+        request.agent === 'opencode2'
+          ? await listOpenCode2SqliteSessions({
+              dbPaths: request.dbPaths,
+              limit: request.limit ?? Infinity,
+              issues
+            })
+          : await listOpenCodeSqliteSessions({
+              dbPaths: request.dbPaths,
+              limit: request.limit ?? Infinity,
+              issues,
+              agent: request.agent === 'zcode' ? 'zcode' : 'opencode'
+            })
+      return { id: request.id, ok: true, value: { candidates, issues } }
+    }
+    if (request.kind === 'capture') {
+      const capture =
+        request.agent === 'opencode2'
+          ? await captureOpenCode2SqliteSession(request)
+          : await captureOpenCodeSqliteSession({
+              ...request,
+              agent: request.agent === 'zcode' ? 'zcode' : 'opencode'
+            })
+      return { id: request.id, ok: true, value: capture }
+    }
+    const parse = async () =>
+      request.agent === 'opencode2'
+        ? await parseOpenCode2SqliteSession({
+            dbPath: request.dbPath,
+            sessionId: request.sessionId,
+            platform: request.platform
+          })
+        : await parseOpenCodeSqliteSession({
+            dbPath: request.dbPath,
+            sessionId: request.sessionId,
+            platform: request.platform,
+            agent: request.agent === 'zcode' ? 'zcode' : 'opencode'
+          })
+    const session = request.fullFirstUserPrompt
+      ? await withFullFirstUserPromptCapture(parse)
+      : await parse()
+    return { id: request.id, ok: true, value: session }
+  } catch (err) {
+    return { id: request.id, ok: false, error: err instanceof Error ? err.message : String(err) }
+  }
+}
diff --git a/src/main/ai-vault/session-scanner-opencode-sqlite-list.ts b/src/main/ai-vault/session-scanner-opencode-sqlite-list.ts
index 93f9daab98cf..7e739ba22381 100644
--- a/src/main/ai-vault/session-scanner-opencode-sqlite-list.ts
+++ b/src/main/ai-vault/session-scanner-opencode-sqlite-list.ts
@@ -1,4 +1,4 @@
-import type { AiVaultAgent, AiVaultScanIssue } from '../../shared/ai-vault-types'
+import type { AiVaultScanIssue } from '../../shared/ai-vault-types'
 import {
   buildOpenCodeSqliteCandidatePath,
   splitOpenCodeSqliteCandidate
@@ -54,13 +54,17 @@ function readSessionRows(db: SyncDatabase, limit: number): SessionRow[] {
   return (limited ? statement.all(limit) : statement.all()) as SessionRow[]
 }
 
-function rowToCandidate(row: SessionRow, dbPath: string): SessionFileCandidate {
+function rowToCandidate(
+  row: SessionRow,
+  dbPath: string,
+  agent: 'opencode' | 'zcode'
+): SessionFileCandidate {
   const mtimeMs =
     typeof row.time_updated === 'number' && row.time_updated > 0
       ? row.time_updated
       : row.time_created
   return {
-    agent: 'opencode' as AiVaultAgent,
+    agent,
     file: {
       path: buildOpenCodeSqliteCandidatePath(dbPath, row.id),
       mtimeMs,
@@ -70,10 +74,13 @@ function rowToCandidate(row: SessionRow, dbPath: string): SessionFileCandidate {
   }
 }
 
-function dedupeAndSortSqliteCandidates(candidates: SessionFileCandidate[]): SessionFileCandidate[] {
+function dedupeAndSortSqliteCandidates(
+  candidates: SessionFileCandidate[],
+  agent: 'opencode' | 'zcode'
+): SessionFileCandidate[] {
   const candidatesBySessionId = new Map<string, SessionFileCandidate>()
   for (const candidate of candidates) {
-    const parsed = splitOpenCodeSqliteCandidate(candidate.file.path)
+    const parsed = splitOpenCodeSqliteCandidate(candidate.file.path, agent)
     if (!parsed) {
       continue
     }
@@ -102,8 +109,10 @@ export async function listOpenCodeSqliteSessions(args: {
   dbPaths: readonly string[]
   limit: number
   issues: AiVaultScanIssue[]
+  agent?: 'opencode' | 'zcode'
 }): Promise<SessionFileCandidate[]> {
   const candidates: SessionFileCandidate[] = []
+  const agent = args.agent ?? 'opencode'
   for (const dbPath of args.dbPaths) {
     try {
       const rows = readOpenCodeDatabase({
@@ -111,12 +120,12 @@ export async function listOpenCodeSqliteSessions(args: {
         read: (db) => readSessionRows(db, args.limit)
       })
       for (const row of rows) {
-        candidates.push(rowToCandidate(row, dbPath))
+        candidates.push(rowToCandidate(row, dbPath, agent))
       }
     } catch (err) {
       // A whole DB failed, not one transcript: kinded so the panel says so.
-      args.issues.push(openCodeDatabaseScanIssue(dbPath, err))
+      args.issues.push(openCodeDatabaseScanIssue(dbPath, err, agent))
     }
   }
-  return dedupeAndSortSqliteCandidates(candidates)
+  return dedupeAndSortSqliteCandidates(candidates, agent)
 }
diff --git a/src/main/ai-vault/session-scanner-opencode-sqlite-open.ts b/src/main/ai-vault/session-scanner-opencode-sqlite-open.ts
index 43e32da2ff5e..32f807cb1d9f 100644
--- a/src/main/ai-vault/session-scanner-opencode-sqlite-open.ts
+++ b/src/main/ai-vault/session-scanner-opencode-sqlite-open.ts
@@ -82,8 +82,13 @@ export function readOpenCodeDatabase<T>(args: {
  * @param error - The thrown value from the read.
  * @returns A kinded scan issue with actionable copy.
  */
-export function openCodeDatabaseScanIssue(dbPath: string, error: unknown): AiVaultScanIssue {
+export function openCodeDatabaseScanIssue(
+  dbPath: string,
+  error: unknown,
+  agent: 'opencode' | 'zcode' = 'opencode'
+): AiVaultScanIssue {
   const name = basename(dbPath)
+  const label = agent === 'zcode' ? 'ZCode' : 'OpenCode'
   // `fileMustExist` already proved the database file is there before SQLite ran,
   // so this needs no fs probe of its own — an extra sync stat on a 9p share is
   // exactly the hang the WSL transcript gate exists to prevent.
@@ -96,18 +101,18 @@ export function openCodeDatabaseScanIssue(dbPath: string, error: unknown): AiVau
   const overWslShare = isWslUncPath(dbPath)
   const detail =
     kind === 'contended' && !overWslShare
-      ? `OpenCode is writing to ${name} right now, so its history was skipped. It is read again on the next refresh.`
+      ? `${label} is writing to ${name} right now, so its history was skipped. It is read again on the next refresh.`
       : kind === 'unreadable'
-        ? `OpenCode history in ${name} could not be read: ${errorMessage(error)}`
-        : unreadableShareDetail(dbPath, name)
-  return { agent: 'opencode', kind: 'scope', path: dbPath, message: detail }
+        ? `${label} history in ${name} could not be read: ${errorMessage(error)}`
+        : unreadableShareDetail(dbPath, name, label)
+  return { agent, kind: 'scope', path: dbPath, message: detail }
 }
 
-function unreadableShareDetail(dbPath: string, name: string): string {
+function unreadableShareDetail(dbPath: string, name: string, label: string): string {
   // A known limitation, not a failure the user can act on: nothing they do on
   // the Windows side makes the share hand out SQLite's locks. Deliberately not
   // "flush the write-ahead log" either — checkpointing changes nothing here.
   return isWslUncPath(dbPath)
-    ? "OpenCode sessions inside WSL can't be searched from Windows yet."
-    : `OpenCode history in ${name} could not be read. Its write-ahead log cannot be opened read-only on this filesystem. Exit OpenCode cleanly to flush the log.`
+    ? `${label} sessions inside WSL can't be searched from Windows yet.`
+    : `${label} history in ${name} could not be read. Its write-ahead log cannot be opened read-only on this filesystem. Exit ${label} cleanly to flush the log.`
 }
diff --git a/src/main/ai-vault/session-scanner-opencode-sqlite-paths.ts b/src/main/ai-vault/session-scanner-opencode-sqlite-paths.ts
index 7f0a61a674a5..77c0e464154b 100644
--- a/src/main/ai-vault/session-scanner-opencode-sqlite-paths.ts
+++ b/src/main/ai-vault/session-scanner-opencode-sqlite-paths.ts
@@ -26,7 +26,8 @@ export function buildOpenCodeSqliteCandidatePath(dbPath: string, sessionId: stri
  * @returns `{ dbPath, sessionId }` if the path is a valid synthetic candidate, `null` otherwise.
  */
 export function splitOpenCodeSqliteCandidate(
-  candidatePath: string
+  candidatePath: string,
+  agent: 'opencode' | 'opencode2' | 'zcode' = 'opencode'
 ): { dbPath: string; sessionId: string } | null {
   const separatorIndex = candidatePath.lastIndexOf(OPENCODE_SQLITE_PATH_SEPARATOR)
   if (separatorIndex <= 0 || separatorIndex === candidatePath.length - 1) {
@@ -39,7 +40,11 @@ export function splitOpenCodeSqliteCandidate(
   }
   // Why: OpenCode DB files are named opencode*.db; reject anything else so we
   // never misroute a real filesystem path that happens to contain '#'.
-  if (!/^opencode(?:-[A-Za-z0-9_.-]+)?\.db$/i.test(basename(dbPath))) {
+  const validName =
+    agent === 'zcode'
+      ? basename(dbPath).toLowerCase() === 'db.sqlite'
+      : /^opencode(?:-[A-Za-z0-9_.-]+)?\.db$/i.test(basename(dbPath))
+  if (!validName) {
     return null
   }
   return { dbPath, sessionId }
diff --git a/src/main/ai-vault/session-scanner-opencode-sqlite-process-client.ts b/src/main/ai-vault/session-scanner-opencode-sqlite-process-client.ts
new file mode 100644
index 000000000000..59e12071dec4
--- /dev/null
+++ b/src/main/ai-vault/session-scanner-opencode-sqlite-process-client.ts
@@ -0,0 +1,154 @@
+import { EventEmitter } from 'node:events'
+import { spawnProcess } from '../../shared/child-process/run-process'
+import { waitForPromiseWithSignal } from '../../shared/abort-signal-reason'
+import type { WorkerRequestTransport } from '../lazy-worker-thread-host'
+import { OpenCodeSqliteWorkerClient } from './session-scanner-opencode-sqlite-worker-client'
+import {
+  createOpenCodeSqliteLineDecoder,
+  encodeOpenCodeSqliteFrame,
+  OPENCODE_SQLITE_REQUEST_MAX_BYTES,
+  OPENCODE_SQLITE_RESPONSE_MAX_BYTES
+} from './session-scanner-opencode-sqlite-process-framing'
+
+export type OpenCodeSqliteProcessOptions = {
+  executable: string
+  args: readonly string[]
+  env?: NodeJS.ProcessEnv
+  cwd?: string
+  log?: (message: string) => void
+  requestTimeoutMs?: number
+  idleTeardownMs?: number
+  beforeSpawn?: (signal: AbortSignal) => Promise<void>
+}
+
+function createProcessTransport(options: OpenCodeSqliteProcessOptions): WorkerRequestTransport {
+  const child = spawnProcess({
+    program: options.executable,
+    args: options.args,
+    env: options.env,
+    cwd: options.cwd
+  })
+  const events = new EventEmitter()
+  let retired = false
+  const fault = (error: Error): void => {
+    if (!retired) {
+      events.emit('error', error)
+    }
+  }
+  const decode = createOpenCodeSqliteLineDecoder(OPENCODE_SQLITE_RESPONSE_MAX_BYTES, (line) => {
+    const response: unknown = JSON.parse(line)
+    if (
+      typeof response !== 'object' ||
+      response === null ||
+      !('id' in response) ||
+      !Number.isSafeInteger(response.id) ||
+      !('ok' in response) ||
+      typeof response.ok !== 'boolean' ||
+      (!response.ok && (!('error' in response) || typeof response.error !== 'string'))
+    ) {
+      throw new Error('Invalid OpenCode SQLite process response.')
+    }
+    events.emit('message', response)
+  })
+  child.stdout.on('data', (chunk: Buffer) => {
+    if (retired) {
+      return
+    }
+    try {
+      decode(chunk)
+    } catch (error) {
+      fault(error instanceof Error ? error : new Error(String(error)))
+    }
+  })
+  // Diagnostics never share the framed response channel or accumulate in memory.
+  child.stderr.resume()
+  child.on('error', fault)
+  child.stdin.on('error', fault)
+  child.stdout.on('error', fault)
+  child.stderr.on('error', fault)
+  child.on('exit', (code) => {
+    if (!retired) {
+      events.emit('exit', code ?? 1)
+    }
+  })
+  return Object.assign(events, {
+    postMessage(request: unknown): void {
+      if (retired || child.stdin.destroyed) {
+        throw new Error('OpenCode SQLite reader process is unavailable.')
+      }
+      child.stdin.write(encodeOpenCodeSqliteFrame(request, OPENCODE_SQLITE_REQUEST_MAX_BYTES))
+    },
+    unref(): void {
+      child.unref()
+      for (const stream of [child.stdin, child.stdout, child.stderr]) {
+        if ('unref' in stream && typeof stream.unref === 'function') {
+          stream.unref()
+        }
+      }
+    },
+    async terminate(): Promise<number> {
+      retired = true
+      // EOF reaches the guest reader even when this process is an SSH/WSL launcher.
+      child.stdin.end()
+      child.kill('SIGKILL')
+      child.stdout.destroy()
+      child.stderr.destroy()
+      return 0
+    }
+  })
+}
+
+export function createOpenCodeSqliteProcessClient(
+  options: OpenCodeSqliteProcessOptions
+): OpenCodeSqliteWorkerClient {
+  return new OpenCodeSqliteWorkerClient({
+    workerFactory: () =>
+      options.beforeSpawn
+        ? createAdmittedProcessTransport(options, options.beforeSpawn)
+        : createProcessTransport(options),
+    log: options.log,
+    requestTimeoutMs: options.requestTimeoutMs,
+    idleTeardownMs: options.idleTeardownMs
+  })
+}
+
+/** Admission belongs to each process birth, including respawns queued after a failure. */
+function createAdmittedProcessTransport(
+  options: OpenCodeSqliteProcessOptions,
+  admit: (signal: AbortSignal) => Promise<void>
+): WorkerRequestTransport {
+  const events = new EventEmitter()
+  const controller = new AbortController()
+  let transport: WorkerRequestTransport | undefined
+  const ready = Promise.resolve().then(async () => {
+    controller.signal.throwIfAborted()
+    await waitForPromiseWithSignal(admit(controller.signal), controller.signal)
+    controller.signal.throwIfAborted()
+    transport = createProcessTransport(options)
+    transport.on('message', (message) => events.emit('message', message))
+    transport.on('error', (error) => events.emit('error', error))
+    transport.on('exit', (code) => events.emit('exit', code))
+    transport.unref()
+    return transport
+  })
+  return Object.assign(events, {
+    postMessage(request: unknown): void {
+      void ready
+        .then((processTransport) => {
+          controller.signal.throwIfAborted()
+          processTransport.postMessage(request)
+        })
+        .catch((error: unknown) => {
+          if (!controller.signal.aborted) {
+            events.emit('error', error instanceof Error ? error : new Error(String(error)))
+          }
+        })
+    },
+    unref(): void {},
+    async terminate(): Promise<number> {
+      controller.abort()
+      transport?.removeAllListeners()
+      return transport ? transport.terminate() : 0
+    }
+  })
+}
diff --git a/src/main/ai-vault/session-scanner-opencode-sqlite-process-entry.ts b/src/main/ai-vault/session-scanner-opencode-sqlite-process-entry.ts
new file mode 100644
index 000000000000..e53d89eeeaba
--- /dev/null
+++ b/src/main/ai-vault/session-scanner-opencode-sqlite-process-entry.ts
@@ -0,0 +1,117 @@
+import { isMainThread, parentPort, Worker } from 'node:worker_threads'
+import { handleOpenCodeSqliteRequest } from './session-scanner-opencode-sqlite-dispatch'
+import type { OpenCodeSqliteWorkerRequest } from './session-scanner-opencode-sqlite-worker-protocol'
+import {
+  createOpenCodeSqliteLineDecoder,
+  encodeOpenCodeSqliteFrame,
+  OPENCODE_SQLITE_PROCESS_MAX_TIMEOUT_MS,
+  OPENCODE_SQLITE_REQUEST_MAX_BYTES,
+  OPENCODE_SQLITE_RESPONSE_MAX_BYTES
+} from './session-scanner-opencode-sqlite-process-framing'
+
+function validRequest(value: unknown): value is OpenCodeSqliteWorkerRequest {
+  if (
+    typeof value !== 'object' ||
+    value === null ||
+    !('id' in value) ||
+    !Number.isSafeInteger(value.id) ||
+    !('kind' in value) ||
+    ('agent' in value && value.agent !== 'opencode2' && value.agent !== 'zcode') ||
+    ('timeoutMs' in value &&
+      (typeof value.timeoutMs !== 'number' ||
+        !Number.isFinite(value.timeoutMs) ||
+        value.timeoutMs <= 0))
+  ) {
+    return false
+  }
+  if (value.kind === 'list') {
+    return (
+      'dbPaths' in value &&
+      Array.isArray(value.dbPaths) &&
+      value.dbPaths.every((path) => typeof path === 'string') &&
+      'limit' in value &&
+      (value.limit === null ||
+        (typeof value.limit === 'number' && Number.isSafeInteger(value.limit) && value.limit >= 0))
+    )
+  }
+  return (
+    (value.kind === 'parse' || value.kind === 'capture') &&
+    'dbPath' in value &&
+    typeof value.dbPath === 'string' &&
+    'sessionId' in value &&
+    typeof value.sessionId === 'string' &&
+    'platform' in value &&
+    typeof value.platform === 'string' &&
+    [
+      'aix',
+      'android',
+      'darwin',
+      'freebsd',
+      'haiku',
+      'linux',
+      'openbsd',
+      'sunos',
+      'win32',
+      'cygwin',
+      'netbsd'
+    ].includes(value.platform) &&
+    (!('fullFirstUserPrompt' in value) || typeof value.fullFirstUserPrompt === 'boolean')
+  )
+}
+
+if (!isMainThread) {
+  const port = parentPort
+  if (!port) {
+    throw new Error('Missing OpenCode SQLite process worker port.')
+  }
+  port.on('message', (request: OpenCodeSqliteWorkerRequest) => {
+    void handleOpenCodeSqliteRequest(request).then((response) => {
+      try {
+        port.postMessage(encodeOpenCodeSqliteFrame(response, OPENCODE_SQLITE_RESPONSE_MAX_BYTES))
+      } catch {
+        port.postMessage(
+          `${JSON.stringify({
+            id: request.id,
+            ok: false,
+            error: 'OpenCode SQLite response exceeds its byte limit.'
+          })}\n`
+        )
+      }
+    })
+  })
+} else {
+  // Keep stdin and the hard deadline responsive while SQLite blocks its worker.
+  const worker = new Worker(__filename)
+  let activeId: number | null = null
+  let deadline: ReturnType<typeof setTimeout> | undefined
+  const stop = (code: number): never => process.exit(code)
+  worker.on('error', () => stop(1))
+  worker.on('exit', () => stop(1))
+  worker.on('message', (line: string) => {
+    clearTimeout(deadline)
+    activeId = null
+    process.stdout.write(line)
+  })
+  const decode = createOpenCodeSqliteLineDecoder(OPENCODE_SQLITE_REQUEST_MAX_BYTES, (line) => {
+    const request: unknown = JSON.parse(line)
+    if (!validRequest(request) || activeId !== null) {
+      return stop(1)
+    }
+    activeId = request.id
+    deadline = setTimeout(
+      () => stop(124),
+      Math.min(request.timeoutMs ?? 30_000, OPENCODE_SQLITE_PROCESS_MAX_TIMEOUT_MS)
+    )
+    worker.postMessage(request)
+  })
+  process.stdin.on('data', (chunk: Buffer) => {
+    try {
+      decode(chunk)
+    } catch {
+      stop(1)
+    }
+  })
+  process.stdin.on('end', () => stop(0))
+  process.stdin.on('error', () => stop(1))
+  process.stdout.on('error', () => stop(1))
+}
diff --git a/src/main/ai-vault/session-scanner-opencode-sqlite-process-framing.ts b/src/main/ai-vault/session-scanner-opencode-sqlite-process-framing.ts
new file mode 100644
index 000000000000..9458456cd8dd
--- /dev/null
+++ b/src/main/ai-vault/session-scanner-opencode-sqlite-process-framing.ts
@@ -0,0 +1,25 @@
+import { SearchSubprocessLineAccumulator } from '../../shared/search-subprocess-lines'
+
+export const OPENCODE_SQLITE_REQUEST_MAX_BYTES = 1024 * 1024
+export const OPENCODE_SQLITE_RESPONSE_MAX_BYTES = 32 * 1024 * 1024
+export const OPENCODE_SQLITE_PROCESS_MAX_TIMEOUT_MS = 60_000
+
+export function createOpenCodeSqliteLineDecoder(
+  maxBytes: number,
+  onLine: (line: string) => void
+): (chunk: Buffer) => void {
+  const lines = new SearchSubprocessLineAccumulator(maxBytes)
+  return (chunk) => {
+    if (!lines.push(chunk, onLine)) {
+      throw new Error('OpenCode SQLite transport frame exceeds its byte limit.')
+    }
+  }
+}
+
+export function encodeOpenCodeSqliteFrame(value: unknown, maxBytes: number): string {
+  const line = JSON.stringify(value)
+  if (Buffer.byteLength(line) > maxBytes) {
+    throw new Error('OpenCode SQLite transport frame exceeds its byte limit.')
+  }
+  return `${line}\n`
+}
diff --git a/src/main/ai-vault/session-scanner-opencode-sqlite-process.test.ts b/src/main/ai-vault/session-scanner-opencode-sqlite-process.test.ts
new file mode 100644
index 000000000000..914028857210
--- /dev/null
+++ b/src/main/ai-vault/session-scanner-opencode-sqlite-process.test.ts
@@ -0,0 +1,253 @@
+import { build } from 'esbuild'
+import { existsSync, mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join, resolve } from 'node:path'
+import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest'
+import * as processRunner from '../../shared/child-process/run-process'
+import { runProcess, spawnProcess } from '../../shared/child-process/run-process'
+import { ORCAD_BUN_VERSION } from '../../shared/orcad-bun-runtime'
+import { orcadBunRuntimeFilename } from '../../shared/orcad-artifacts'
+import SyncDatabase from '../sqlite/sync-database'
+import { appendTurns, writeOpenCodeSqliteDatabase } from './session-scanner-opencode-sqlite-fixture'
+import { createOpenCodeSqliteProcessClient } from './session-scanner-opencode-sqlite-process-client'
+import {
+  OPENCODE_SQLITE_REQUEST_MAX_BYTES,
+  OPENCODE_SQLITE_RESPONSE_MAX_BYTES
+} from './session-scanner-opencode-sqlite-process-framing'
+import type { AiVaultScanIssue } from '../../shared/ai-vault-types'
+
+const bun =
+  process.env.BUN_EXECUTABLE ?? resolve('out/orcad', orcadBunRuntimeFilename(process.platform))
+const directory = mkdtempSync(join(tmpdir(), 'orca-opencode-process-'))
+const entry = join(directory, 'reader.cjs')
+const dbPath = join(directory, 'opencode.db')
+const oversizedPath = join(directory, 'oversized.db')
+const prompt = 'A complete first prompt. '.repeat(200)
+let writer: SyncDatabase
+
+beforeAll(async () => {
+  await build({
+    entryPoints: ['src/main/ai-vault/session-scanner-opencode-sqlite-process-entry.ts'],
+    bundle: true,
+    platform: 'node',
+    format: 'cjs',
+    target: 'node22',
+    external: ['bun:sqlite'],
+    outfile: entry,
+    logLevel: 'silent'
+  })
+  writeOpenCodeSqliteDatabase(dbPath, [{ id: 'wal-session', turns: [] }])
+  writer = new SyncDatabase(dbPath)
+  writer.pragma('journal_mode = WAL')
+  writer.pragma('wal_autocheckpoint = 0')
+  appendTurns(writer, { id: 'wal-session', turns: [{ role: 'user', parts: [prompt] }] }, Date.now())
+  writeOpenCodeSqliteDatabase(oversizedPath, [
+    {
+      id: 'oversized',
+      turns: Array.from({ length: 130 }, () => ({
+        role: 'user' as const,
+        parts: ['x'.repeat(256 * 1024)]
+      }))
+    }
+  ])
+})
+
+afterAll(() => {
+  writer?.close()
+  rmSync(directory, { recursive: true, force: true })
+})
+
+for (const [runtime, executable] of [
+  ['Node', process.execPath],
+  ['Bun', bun]
+]) {
+  describe.skipIf(!existsSync(executable))(`OpenCode SQLite process under ${runtime}`, () => {
+    it('uses the deployed runtime and reads live WAL, full prompts and captures in one persistent child', async () => {
+      if (runtime === 'Bun') {
+        expect((await runProcess({ program: executable, args: ['--version'] })).stdout.trim()).toBe(
+          ORCAD_BUN_VERSION
+        )
+      }
+      expect(existsSync(`${dbPath}-wal`)).toBe(true)
+      const spawn = vi.spyOn(processRunner, 'spawnProcess')
+      const client = createOpenCodeSqliteProcessClient({
+        executable,
+        args: [entry],
+        cwd: directory,
+        beforeSpawn: async () => {}
+      })
+      try {
+        const issues: AiVaultScanIssue[] = []
+        const listed = await client.list({ dbPaths: [dbPath], limit: 5, issues })
+        expect(issues).toEqual([])
+        expect(listed).toHaveLength(1)
+        expect(await client.list({ dbPaths: [dbPath], limit: Infinity, issues })).toHaveLength(1)
+        const args = { dbPath, sessionId: 'wal-session', platform: process.platform }
+        expect((await client.parse(args))?.firstUserPrompt).toBeUndefined()
+        expect((await client.parse({ ...args, fullFirstUserPrompt: true }))?.firstUserPrompt).toBe(
+          prompt.trim()
+        )
+        expect((await client.capture(args)).messages).toEqual([
+          expect.objectContaining({ role: 'user', text: prompt })
+        ])
+        expect(spawn).toHaveBeenCalledOnce()
+      } finally {
+        client.dispose()
+        spawn.mockRestore()
+      }
+    })
+
+    it('fails oversized query responses without truncating a transcript and remains usable', async () => {
+      const client = createOpenCodeSqliteProcessClient({ executable, args: [entry] })
+      try {
+        await expect(
+          client.capture({
+            dbPath: oversizedPath,
+            sessionId: 'oversized',
+            platform: process.platform
+          })
+        ).rejects.toThrow('response exceeds its byte limit')
+        expect(
+          await client.parse({ dbPath, sessionId: 'wal-session', platform: process.platform })
+        ).not.toBeNull()
+      } finally {
+        client.dispose()
+      }
+    })
+
+    it('exits on parent EOF even while SQLite is busy, and enforces its own hard deadline', async () => {
+      const lockedPath = join(directory, `locked-${runtime}.db`)
+      writeOpenCodeSqliteDatabase(lockedPath, [{ id: 'locked', turns: [] }])
+      const lock = new SyncDatabase(lockedPath)
+      lock.exec('BEGIN EXCLUSIVE')
+      try {
+        const request = `${JSON.stringify({
+          id: 1,
+          kind: 'parse',
+          dbPath: lockedPath,
+          sessionId: 'locked',
+          platform: process.platform,
+          timeoutMs: 100
+        })}\n`
+        const child = spawnProcess({ program: executable, args: [entry] })
+        child.stderr.resume()
+        child.stdout.resume()
+        const exit = new Promise<number | null>((resolveExit) => child.once('exit', resolveExit))
+        child.stdin.on('error', () => {})
+        child.stdin.write(request)
+        expect(await exit).toBe(124)
+
+        const eof = await runProcess({
+          program: executable,
+          args: [entry],
+          input: request,
+          timeoutMs: 2_000
+        })
+        expect(eof.timedOut).toBe(false)
+        expect(eof.code).toBe(0)
+
+        const client = createOpenCodeSqliteProcessClient({ executable, args: [entry] })
+        const cancellation = new AbortController()
+        try {
+          const pending = client.parse({
+            dbPath: lockedPath,
+            sessionId: 'locked',
+            platform: process.platform,
+            signal: cancellation.signal
+          })
+          const rejected = expect(pending).rejects.toThrow('SQL read cancelled')
+          await new Promise((resolveDelay) => setTimeout(resolveDelay, 100))
+          cancellation.abort(new Error('SQL read cancelled'))
+          await rejected
+        } finally {
+          client.dispose()
+        }
+      } finally {
+        lock.exec('ROLLBACK')
+        lock.close()
+      }
+    })
+
+    it('rejects oversized request frames before running a query', async () => {
+      const result = await runProcess({
+        program: executable,
+        args: [entry],
+        input: 'x'.repeat(OPENCODE_SQLITE_REQUEST_MAX_BYTES + 1),
+        timeoutMs: 2_000
+      })
+      expect(result.code).toBe(1)
+      expect(result.stdout).toBe('')
+    })
+  })
+}
+
+describe('OpenCode SQLite process retirement', () => {
+  const args = { dbPath, sessionId: 'wal-session', platform: process.platform }
+
+  it('closes the child at idle expiry and creates one new reader for the next request', async () => {
+    const spawn = vi.spyOn(processRunner, 'spawnProcess')
+    const client = createOpenCodeSqliteProcessClient({
+      executable: process.execPath,
+      args: [entry],
+      idleTeardownMs: 20
+    })
+    try {
+      expect(await client.parse(args)).not.toBeNull()
+      const firstChild = spawn.mock.results[0]?.value
+      expect(firstChild).toBeDefined()
+      await vi.waitFor(() => expect(firstChild.signalCode).toBe('SIGKILL'))
+      expect(await client.parse(args)).not.toBeNull()
+      expect(spawn).toHaveBeenCalledTimes(2)
+    } finally {
+      client.dispose()
+      spawn.mockRestore()
+    }
+  })
+
+  it('cancels an active read, enforces queue limits, and fails closed after disposal', async () => {
+    const client = createOpenCodeSqliteProcessClient({
+      executable: process.execPath,
+      args: ['-e', 'process.stdin.resume();setInterval(()=>{},1000)'],
+      requestTimeoutMs: 5_000
+    })
+    const signal = new AbortController()
+    const active = client.parse({ ...args, signal: signal.signal }).catch((error: unknown) => error)
+    const queued = Array.from({ length: 64 }, () =>
+      client.parse(args).catch((error: unknown) => error)
+    )
+    await expect(client.parse(args)).rejects.toThrow('queue is full')
+    signal.abort(new Error('read cancelled'))
+    expect(await active).toMatchObject({ message: 'read cancelled' })
+    client.dispose()
+    expect(await Promise.all(queued)).toHaveLength(64)
+    await expect(client.parse(args)).rejects.toThrow('disposed')
+  })
+
+  it('retires a silent process at timeout and rejects bounded stdout/input overflow', async () => {
+    const silent = createOpenCodeSqliteProcessClient({
+      executable: process.execPath,
+      args: ['-e', 'process.stdin.resume();setInterval(()=>{},1000)'],
+      requestTimeoutMs: 100
+    })
+    try {
+      await expect(silent.parse(args)).rejects.toThrow('timed out')
+    } finally {
+      silent.dispose()
+    }
+    const noisy = createOpenCodeSqliteProcessClient({
+      executable: process.execPath,
+      args: [
+        '-e',
+        `process.stdin.once('data',()=>process.stdout.write('x'.repeat(${OPENCODE_SQLITE_RESPONSE_MAX_BYTES + 1})));`
+      ]
+    })
+    try {
+      await expect(noisy.parse(args)).rejects.toThrow('byte limit')
+      await expect(
+        noisy.parse({ ...args, dbPath: 'x'.repeat(OPENCODE_SQLITE_REQUEST_MAX_BYTES) })
+      ).rejects.toThrow('byte limit')
+    } finally {
+      noisy.dispose()
+    }
+  })
+})
diff --git a/src/main/ai-vault/session-scanner-opencode-sqlite-rows.ts b/src/main/ai-vault/session-scanner-opencode-sqlite-rows.ts
new file mode 100644
index 000000000000..6d72cc4f64e1
--- /dev/null
+++ b/src/main/ai-vault/session-scanner-opencode-sqlite-rows.ts
@@ -0,0 +1,48 @@
+import type { SqliteRow } from '../sqlite/sqlite-statement'
+import type { SQLOutputValue } from 'node:sqlite'
+
+type SessionRow = {
+  id: string
+  title: string | null
+  directory: string | null
+  time_created: number
+  time_updated: number
+  model_json: string | null
+  agent: string | null
+  tokens_input: number
+  tokens_output: number
+  tokens_reasoning: number
+  tokens_cache_read: number
+  cost: number
+  message_count: number
+}
+
+// Why guards and not casts: `SqliteStatement` hands back `Record<string, SQLOutputValue>`,
+// so the column types are only a claim about the query until something checks them. A row
+// from a schema that drifted, or from a database another tool wrote, reaches here too.
+export function readPartDataRow(row: SqliteRow): { part_data: string } | null {
+  return typeof row.part_data === 'string' ? { part_data: row.part_data } : null
+}
+
+export function readSessionRow(row: SqliteRow | undefined): SessionRow | null {
+  if (!row || typeof row.id !== 'string') {
+    return null
+  }
+  const text = (value: SQLOutputValue): string | null => (typeof value === 'string' ? value : null)
+  const count = (value: SQLOutputValue): number => (typeof value === 'number' ? value : 0)
+  return {
+    id: row.id,
+    title: text(row.title),
+    directory: text(row.directory),
+    time_created: count(row.time_created),
+    time_updated: count(row.time_updated),
+    model_json: text(row.model_json),
+    agent: text(row.agent),
+    tokens_input: count(row.tokens_input),
+    tokens_output: count(row.tokens_output),
+    tokens_reasoning: count(row.tokens_reasoning),
+    tokens_cache_read: count(row.tokens_cache_read),
+    cost: count(row.cost),
+    message_count: count(row.message_count)
+  }
+}
diff --git a/src/main/ai-vault/session-scanner-opencode-sqlite-worker-client.ts b/src/main/ai-vault/session-scanner-opencode-sqlite-worker-client.ts
index 1103a8379e51..c5f96c030e3b 100644
--- a/src/main/ai-vault/session-scanner-opencode-sqlite-worker-client.ts
+++ b/src/main/ai-vault/session-scanner-opencode-sqlite-worker-client.ts
@@ -52,16 +52,24 @@ function sessionReadFailure(err: unknown): Error {
  * SQLite work onto the main thread.
  */
 export class OpenCodeSqliteWorkerClient {
+  private readonly requestTimeoutMs: number | undefined
   private readonly requests: WorkerThreadRequestQueue<
     OpenCodeSqliteWorkerRequest,
     OpenCodeSqliteWorkerResponse
   >
 
-  constructor(options: { workerFactory: WorkerThreadFactory; log?: (message: string) => void }) {
+  constructor(options: {
+    workerFactory: WorkerThreadFactory
+    log?: (message: string) => void
+    idleTeardownMs?: number
+    requestTimeoutMs?: number
+  }) {
+    this.requestTimeoutMs = options.requestTimeoutMs
     const log = options.log ?? ((message: string) => console.warn(message))
     this.requests = new WorkerThreadRequestQueue({
       factory: options.workerFactory,
-      idleTeardownMs: IDLE_TEARDOWN_MS,
+      idleTeardownMs: options.idleTeardownMs ?? IDLE_TEARDOWN_MS,
+      queueCap: { maxQueuedCalls: 64, describeFull: () => 'OpenCode SQLite reader queue is full.' },
       maxConsecutiveDeaths: MAX_CONSECUTIVE_DEATHS,
       createUnavailableError: (message) => new OpenCodeSqliteWorkerUnavailableError(message),
       describeTimeout: (timeoutMs) => `OpenCode SQLite worker timed out after ${timeoutMs}ms`,
@@ -90,7 +98,8 @@ export class OpenCodeSqliteWorkerClient {
     dbPaths: readonly string[]
     limit: number
     issues: AiVaultScanIssue[]
-    agent?: 'opencode2'
+    agent?: 'opencode2' | 'zcode'
+    signal?: AbortSignal
   }): Promise<SessionFileCandidate[]> {
     if (args.dbPaths.length === 0) {
       return []
@@ -102,14 +111,18 @@ export class OpenCodeSqliteWorkerClient {
           id,
           kind: 'list',
           dbPaths: args.dbPaths,
-          limit: args.limit,
+          limit: Number.isFinite(args.limit) ? args.limit : null,
           ...(args.agent ? { agent: args.agent } : {})
         }),
-        LIST_TIMEOUT_MS
+        LIST_TIMEOUT_MS,
+        args.signal
       )) as OpenCodeSqliteListValue
       args.issues.push(...value.issues)
       return value.candidates
     } catch (err) {
+      if (args.signal?.aborted) {
+        throw err
+      }
       if (err instanceof OpenCodeSqliteWorkerUnavailableError) {
         // Kinded: a whole source failed, not a transcript.
         args.issues.push({
@@ -144,22 +157,26 @@ export class OpenCodeSqliteWorkerClient {
    *   worker timeout/crash so the scanner records a per-session scan issue.
    */
   async parse(args: {
+    fullFirstUserPrompt?: boolean
     dbPath: string
     sessionId: string
     platform: NodeJS.Platform
-    agent?: 'opencode2'
+    agent?: 'opencode2' | 'zcode'
+    signal?: AbortSignal
   }): Promise<AiVaultSession | null> {
     try {
       const value = await this.dispatch(
         (id) => ({
           id,
           kind: 'parse',
+          ...(args.fullFirstUserPrompt ? { fullFirstUserPrompt: true } : {}),
           dbPath: args.dbPath,
           sessionId: args.sessionId,
           platform: args.platform,
           ...(args.agent ? { agent: args.agent } : {})
         }),
-        PARSE_TIMEOUT_MS
+        PARSE_TIMEOUT_MS,
+        args.signal
       )
       // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the worker's parse leg returns exactly this, built by the repo's own reader on the other side of a structured clone.
       return value as AiVaultSession | null
@@ -184,7 +201,8 @@ export class OpenCodeSqliteWorkerClient {
     dbPath: string
     sessionId: string
     platform: NodeJS.Platform
-    agent?: 'opencode2'
+    agent?: 'opencode2' | 'zcode'
+    signal?: AbortSignal
   }): Promise<OpenCodeSqliteCaptureValue> {
     try {
       const value = await this.dispatch(
@@ -196,7 +214,8 @@ export class OpenCodeSqliteWorkerClient {
           platform: args.platform,
           ...(args.agent ? { agent: args.agent } : {})
         }),
-        CAPTURE_TIMEOUT_MS
+        CAPTURE_TIMEOUT_MS,
+        args.signal
       )
       return parseOpenCodeSqliteCaptureValue(value)
     } catch (err) {
@@ -204,11 +223,21 @@ export class OpenCodeSqliteWorkerClient {
     }
   }
 
+  dispose(): void {
+    this.requests.dispose()
+  }
+
   private async dispatch(
     buildRequest: (id: number) => OpenCodeSqliteWorkerRequest,
-    timeoutMs: number
+    timeoutMs: number,
+    signal?: AbortSignal
   ): Promise<unknown> {
-    const response = await this.requests.dispatch(buildRequest, timeoutMs)
+    const deadline = this.requestTimeoutMs ?? timeoutMs
+    const response = await this.requests.dispatch(
+      (id) => ({ ...buildRequest(id), timeoutMs: deadline }),
+      deadline,
+      signal
+    )
     if (!response.ok) {
       throw new Error(response.error)
     }
diff --git a/src/main/ai-vault/session-scanner-opencode-sqlite-worker-entry.ts b/src/main/ai-vault/session-scanner-opencode-sqlite-worker-entry.ts
index 7441bb1564aa..704f80a53a76 100644
--- a/src/main/ai-vault/session-scanner-opencode-sqlite-worker-entry.ts
+++ b/src/main/ai-vault/session-scanner-opencode-sqlite-worker-entry.ts
@@ -1,75 +1,14 @@
 import { parentPort } from 'node:worker_threads'
-import type { AiVaultScanIssue } from '../../shared/ai-vault-types'
-import { captureOpenCodeSqliteSession } from './session-scanner-opencode-sqlite-capture'
-import { listOpenCodeSqliteSessions } from './session-scanner-opencode-sqlite-list'
-import { parseOpenCodeSqliteSession } from './session-scanner-opencode-sqlite'
-import { listOpenCode2SqliteSessions } from './session-scanner-opencode2-sqlite-list'
-import {
-  captureOpenCode2SqliteSession,
-  parseOpenCode2SqliteSession
-} from './session-scanner-opencode2-sqlite'
-import type {
-  OpenCodeSqliteWorkerRequest,
-  OpenCodeSqliteWorkerResponse
-} from './session-scanner-opencode-sqlite-worker-protocol'
-
-// Why (#8864): OpenCode SQLite reads use synchronous node:sqlite. Running them
-// on this worker thread keeps the multi-GB-DB scan off the Electron main-process
-// event loop. The client dispatches one request at a time, so this loop stays
-// serial; imports must remain electron-free (see the worker-protocol note).
+import type { OpenCodeSqliteWorkerRequest } from './session-scanner-opencode-sqlite-worker-protocol'
+import { handleOpenCodeSqliteRequest } from './session-scanner-opencode-sqlite-dispatch'
 
 if (!parentPort) {
   throw new Error('OpenCode SQLite worker must run with a parent port.')
 }
 const port = parentPort
 
-async function handleRequest(
-  request: OpenCodeSqliteWorkerRequest
-): Promise<OpenCodeSqliteWorkerResponse> {
-  try {
-    if (request.kind === 'list') {
-      const issues: AiVaultScanIssue[] = []
-      const candidates =
-        request.agent === 'opencode2'
-          ? await listOpenCode2SqliteSessions({
-              dbPaths: request.dbPaths,
-              limit: request.limit,
-              issues
-            })
-          : await listOpenCodeSqliteSessions({
-              dbPaths: request.dbPaths,
-              limit: request.limit,
-              issues
-            })
-      return { id: request.id, ok: true, value: { candidates, issues } }
-    }
-    if (request.kind === 'capture') {
-      const capture =
-        request.agent === 'opencode2'
-          ? await captureOpenCode2SqliteSession(request)
-          : await captureOpenCodeSqliteSession(request)
-      return { id: request.id, ok: true, value: capture }
-    }
-    const session =
-      request.agent === 'opencode2'
-        ? await parseOpenCode2SqliteSession({
-            dbPath: request.dbPath,
-            sessionId: request.sessionId,
-            platform: request.platform
-          })
-        : await parseOpenCodeSqliteSession({
-            dbPath: request.dbPath,
-            sessionId: request.sessionId,
-            platform: request.platform
-          })
-    return { id: request.id, ok: true, value: session }
-  } catch (err) {
-    return { id: request.id, ok: false, error: err instanceof Error ? err.message : String(err) }
-  }
-}
-
 port.on('message', (request: OpenCodeSqliteWorkerRequest) => {
-  void handleRequest(request).then((response) => {
+  void handleOpenCodeSqliteRequest(request).then((response) => {
     try {
       port.postMessage(response)
     } catch {
diff --git a/src/main/ai-vault/session-scanner-opencode-sqlite-worker-protocol.ts b/src/main/ai-vault/session-scanner-opencode-sqlite-worker-protocol.ts
index e18cad32c2c5..9c8e42a5c7f4 100644
--- a/src/main/ai-vault/session-scanner-opencode-sqlite-worker-protocol.ts
+++ b/src/main/ai-vault/session-scanner-opencode-sqlite-worker-protocol.ts
@@ -10,19 +10,20 @@ export type OpenCodeSqliteListRequest = {
   id: number
   kind: 'list'
   dbPaths: readonly string[]
-  limit: number
+  limit: number | null
   /** When 'opencode2', lists from the v2 channel-scoped DB schema (session_v2). */
-  agent?: 'opencode2'
+  agent?: 'opencode2' | 'zcode'
 }
 
 export type OpenCodeSqliteParseRequest = {
   id: number
   kind: 'parse'
+  fullFirstUserPrompt?: boolean
   dbPath: string
   sessionId: string
   platform: NodeJS.Platform
   /** When 'opencode2', parses from the v2 channel-scoped DB schema (session_v2). */
-  agent?: 'opencode2'
+  agent?: 'opencode2' | 'zcode'
 }
 
 // Same arguments as `parse`, different answer: the session plus every message
@@ -35,13 +36,14 @@ export type OpenCodeSqliteCaptureRequest = {
   sessionId: string
   platform: NodeJS.Platform
   /** When 'opencode2', captures from the v2 channel-scoped schema. */
-  agent?: 'opencode2'
+  agent?: 'opencode2' | 'zcode'
 }
 
-export type OpenCodeSqliteWorkerRequest =
+export type OpenCodeSqliteWorkerRequest = (
   | OpenCodeSqliteListRequest
   | OpenCodeSqliteParseRequest
   | OpenCodeSqliteCaptureRequest
+) & { timeoutMs?: number }
 
 // The list leg returns candidates plus the issues it accumulated; the worker
 // mutates a local array and hands it back so the caller can merge it into the
diff --git a/src/main/ai-vault/session-scanner-opencode-sqlite-worker-spawn.ts b/src/main/ai-vault/session-scanner-opencode-sqlite-worker-spawn.ts
index c1e89e9fc790..68b1bacf6981 100644
--- a/src/main/ai-vault/session-scanner-opencode-sqlite-worker-spawn.ts
+++ b/src/main/ai-vault/session-scanner-opencode-sqlite-worker-spawn.ts
@@ -2,9 +2,19 @@ import { existsSync } from 'node:fs'
 import { join } from 'node:path'
 import { Worker } from 'node:worker_threads'
 import type { AiVaultScanIssue, AiVaultSession } from '../../shared/ai-vault-types'
+import { throwIfSignalAborted } from '../../shared/abort-signal-reason'
 import type { SessionFileCandidate } from './session-scanner-types'
 import type { OpenCodeSqliteCaptureValue } from './session-scanner-opencode-sqlite-worker-protocol'
 import { OpenCodeSqliteWorkerClient } from './session-scanner-opencode-sqlite-worker-client'
+import {
+  buildOpenCodeSqliteCandidatePath,
+  splitOpenCodeSqliteCandidate
+} from './session-scanner-opencode-sqlite-paths'
+import {
+  mapOpenCodeWslSession,
+  openCodeWslClient,
+  openCodeWslPath
+} from './session-scanner-opencode-wsl-client'
 
 // Why: resolve the built worker entry + own the process-wide shared client so
 // the client class stays free of Electron (require'd lazily here) and the
@@ -53,8 +63,9 @@ export function listOpenCodeSqliteSessionsViaWorker(args: {
   dbPaths: readonly string[]
   limit: number
   issues: AiVaultScanIssue[]
+  signal?: AbortSignal
 }): Promise<SessionFileCandidate[]> {
-  return getSharedClient().list(args)
+  return listForHost(args)
 }
 
 /**
@@ -65,8 +76,18 @@ export function listOpenCode2SqliteSessionsViaWorker(args: {
   dbPaths: readonly string[]
   limit: number
   issues: AiVaultScanIssue[]
+  signal?: AbortSignal
 }): Promise<SessionFileCandidate[]> {
-  return getSharedClient().list({ ...args, agent: 'opencode2' })
+  return listForHost({ ...args, agent: 'opencode2' })
+}
+
+export function listZcodeSqliteSessionsViaWorker(args: {
+  dbPaths: readonly string[]
+  limit: number
+  issues: AiVaultScanIssue[]
+  signal?: AbortSignal
+}): Promise<SessionFileCandidate[]> {
+  return listForHost({ ...args, agent: 'zcode' })
 }
 
 /**
@@ -77,19 +98,33 @@ export function listOpenCode2SqliteSessionsViaWorker(args: {
  * @returns The parsed session, or `null` when it does not exist.
  */
 export function parseOpenCodeSqliteSessionViaWorker(args: {
+  fullFirstUserPrompt?: boolean
   dbPath: string
   sessionId: string
   platform: NodeJS.Platform
+  signal?: AbortSignal
 }): Promise<AiVaultSession | null> {
-  return getSharedClient().parse(args)
+  return parseForHost(args)
 }
 
 export function parseOpenCode2SqliteSessionViaWorker(args: {
+  fullFirstUserPrompt?: boolean
+  dbPath: string
+  sessionId: string
+  platform: NodeJS.Platform
+  signal?: AbortSignal
+}): Promise<AiVaultSession | null> {
+  return parseForHost({ ...args, agent: 'opencode2' })
+}
+
+export function parseZcodeSqliteSessionViaWorker(args: {
+  fullFirstUserPrompt?: boolean
   dbPath: string
   sessionId: string
   platform: NodeJS.Platform
+  signal?: AbortSignal
 }): Promise<AiVaultSession | null> {
-  return getSharedClient().parse({ ...args, agent: 'opencode2' })
+  return parseForHost({ ...args, agent: 'zcode' })
 }
 
 /**
@@ -104,14 +139,109 @@ export function captureOpenCodeSqliteSessionViaWorker(args: {
   dbPath: string
   sessionId: string
   platform: NodeJS.Platform
+  signal?: AbortSignal
 }): Promise<OpenCodeSqliteCaptureValue> {
-  return getSharedClient().capture(args)
+  return captureForHost(args)
 }
 
 export function captureOpenCode2SqliteSessionViaWorker(args: {
   dbPath: string
   sessionId: string
   platform: NodeJS.Platform
+  signal?: AbortSignal
 }): Promise<OpenCodeSqliteCaptureValue> {
-  return getSharedClient().capture({ ...args, agent: 'opencode2' })
+  return captureForHost({ ...args, agent: 'opencode2' })
+}
+
+export function captureZcodeSqliteSessionViaWorker(args: {
+  dbPath: string
+  sessionId: string
+  platform: NodeJS.Platform
+  signal?: AbortSignal
+}): Promise<OpenCodeSqliteCaptureValue> {
+  return captureForHost({ ...args, agent: 'zcode' })
+}
+
+async function listForHost(
+  args: Parameters<OpenCodeSqliteWorkerClient['list']>[0]
+): Promise<SessionFileCandidate[]> {
+  throwIfSignalAborted(args.signal)
+  const native: string[] = []
+  const groups = new Map<string, { distro: string; paths: Map<string, string> }>()
+  for (const path of args.dbPaths) {
+    const wsl = openCodeWslPath(path)
+    if (!wsl) {
+      native.push(path)
+      continue
+    }
+    const key = wsl.distro.toLowerCase()
+    const group = groups.get(key) ?? { distro: wsl.distro, paths: new Map<string, string>() }
+    group.paths.set(wsl.linuxPath, path)
+    groups.set(key, group)
+  }
+  const candidates = await Promise.all([
+    native.length ? getSharedClient().list({ ...args, dbPaths: native }) : Promise.resolve([]),
+    ...[...groups.values()].map(async ({ distro, paths }) => {
+      const first = paths.values().next().value!
+      const issues: AiVaultScanIssue[] = []
+      try {
+        const client = await openCodeWslClient(distro, first, args.signal)
+        const result = await client.list({ ...args, dbPaths: [...paths.keys()], issues })
+        return result.flatMap((candidate) => {
+          const parsed = splitOpenCodeSqliteCandidate(candidate.file.path, args.agent)
+          const original = parsed && paths.get(parsed.dbPath)
+          return parsed && original
+            ? [
+                {
+                  ...candidate,
+                  file: {
+                    ...candidate.file,
+                    path: buildOpenCodeSqliteCandidatePath(original, parsed.sessionId)
+                  }
+                }
+              ]
+            : []
+        })
+      } catch (error) {
+        throwIfSignalAborted(args.signal)
+        issues.push({
+          agent: args.agent ?? 'opencode',
+          kind: 'scope',
+          path: first,
+          message: error instanceof Error ? error.message : String(error)
+        })
+        return []
+      } finally {
+        args.issues.push(
+          ...issues.map((issue) => ({ ...issue, path: paths.get(issue.path) ?? issue.path }))
+        )
+      }
+    })
+  ])
+  throwIfSignalAborted(args.signal)
+  return candidates.flat().sort((a, b) => b.file.mtimeMs - a.file.mtimeMs)
+}
+
+async function parseForHost(
+  args: Parameters<OpenCodeSqliteWorkerClient['parse']>[0]
+): Promise<AiVaultSession | null> {
+  const wsl = openCodeWslPath(args.dbPath)
+  if (!wsl) {
+    return getSharedClient().parse(args)
+  }
+  const client = await openCodeWslClient(wsl.distro, args.dbPath, args.signal)
+  const session = await client.parse({ ...args, dbPath: wsl.linuxPath, platform: 'linux' })
+  return mapOpenCodeWslSession(session, args.dbPath)
+}
+
+async function captureForHost(
+  args: Parameters<OpenCodeSqliteWorkerClient['capture']>[0]
+): Promise<OpenCodeSqliteCaptureValue> {
+  const wsl = openCodeWslPath(args.dbPath)
+  if (!wsl) {
+    return getSharedClient().capture(args)
+  }
+  const client = await openCodeWslClient(wsl.distro, args.dbPath, args.signal)
+  const capture = await client.capture({ ...args, dbPath: wsl.linuxPath, platform: 'linux' })
+  return { ...capture, session: mapOpenCodeWslSession(capture.session, args.dbPath) }
 }
diff --git a/src/main/ai-vault/session-scanner-opencode-sqlite.ts b/src/main/ai-vault/session-scanner-opencode-sqlite.ts
index 291a4ce0e884..4e3d8bc74b83 100644
--- a/src/main/ai-vault/session-scanner-opencode-sqlite.ts
+++ b/src/main/ai-vault/session-scanner-opencode-sqlite.ts
@@ -10,11 +10,13 @@ import {
   shouldCaptureFullFirstUserPrompt
 } from './session-scanner-first-user-prompt'
 import { readOpenCodeDatabase } from './session-scanner-opencode-sqlite-open'
+import { readPartDataRow, readSessionRow } from './session-scanner-opencode-sqlite-rows'
 import {
   canCountOpenCodeMessages,
   canReadOpenCodeMessageParts
 } from './session-scanner-opencode-sqlite-schema'
 import { normalizeTitleText } from './session-scanner-values'
+import { zcodeVisibleMessageFilter } from './session-scanner-zcode-visibility'
 import type SyncDatabase from '../sqlite/sync-database'
 import { columnExists, tableExists } from '../opencode-usage/schema-helpers'
 
@@ -34,22 +36,6 @@ const OPENCODE_SQLITE_PREVIEW_MESSAGE_WINDOW = 100
 // Bounds a pathological single message; a real typed prompt is a handful of parts.
 const FIRST_USER_PROMPT_PART_LIMIT = 512
 
-type SessionRow = {
-  id: string
-  title: string | null
-  directory: string | null
-  time_created: number
-  time_updated: number
-  model_json: string | null
-  agent: string | null
-  tokens_input: number
-  tokens_output: number
-  tokens_reasoning: number
-  tokens_cache_read: number
-  cost: number
-  message_count: number
-}
-
 type PreviewRow = {
   role: string | null
   part_data: string
@@ -74,10 +60,11 @@ function sessionNumberColumnSelect(db: SyncDatabase, columnName: string): string
   return columnExists(db, 'session', columnName) ? `s.${columnName}` : '0'
 }
 
-function buildSessionQuery(db: SyncDatabase): string {
+function buildSessionQuery(db: SyncDatabase, agent: 'opencode' | 'zcode'): string {
   const messageCountSubquery = canCountOpenCodeMessages(db)
     ? `(SELECT COUNT(*) FROM message m
         WHERE m.session_id = s.id
+          ${zcodeVisibleMessageFilter(agent)}
           AND json_extract(m.data, '$.role') IN ('user','assistant'))`
     : '0'
   return `SELECT s.id,
@@ -150,7 +137,11 @@ export function extractPartText(partData: string): string | null {
   }
 }
 
-function readFirstUserPromptFromOpenCodeDb(db: SyncDatabase, sessionId: string): string | null {
+function readFirstUserPromptFromOpenCodeDb(
+  db: SyncDatabase,
+  sessionId: string,
+  agent: 'opencode' | 'zcode'
+): string | null {
   if (!canReadOpenCodeMessageParts(db)) {
     return null
   }
@@ -168,6 +159,7 @@ function readFirstUserPromptFromOpenCodeDb(db: SyncDatabase, sessionId: string):
                  FROM message m
                  JOIN part fp ON fp.message_id = m.id
                  WHERE m.session_id = ?
+                   ${zcodeVisibleMessageFilter(agent)}
                    AND json_extract(m.data, '$.role') = 'user'
                    AND json_extract(fp.data, '$.type') = 'text'
                  ORDER BY m.time_created ASC, m.id ASC
@@ -177,7 +169,9 @@ function readFirstUserPromptFromOpenCodeDb(db: SyncDatabase, sessionId: string):
          ORDER BY p.time_created ASC, p.rowid ASC
          LIMIT ${FIRST_USER_PROMPT_PART_LIMIT}`
       )
-      .all(sessionId) as { part_data: string }[]
+      .all(sessionId)
+      .map(readPartDataRow)
+      .filter((row): row is { part_data: string } => row !== null)
 
     const parts: string[] = []
     for (const row of rows) {
@@ -195,7 +189,7 @@ function readFirstUserPromptFromOpenCodeDb(db: SyncDatabase, sessionId: string):
   }
 }
 
-function buildPreviewQuery(db: SyncDatabase): string | null {
+function buildPreviewQuery(db: SyncDatabase, agent: 'opencode' | 'zcode'): string | null {
   if (!canReadOpenCodeMessageParts(db)) {
     return null
   }
@@ -206,6 +200,7 @@ function buildPreviewQuery(db: SyncDatabase): string | null {
                  json_extract(m.data, '$.summary.body') AS summary_body
           FROM (SELECT id, data FROM message
                 WHERE session_id = ?
+                ${zcodeVisibleMessageFilter(agent, 'data')}
                 ORDER BY time_created DESC, id DESC
                 LIMIT ${OPENCODE_SQLITE_PREVIEW_MESSAGE_WINDOW}) m
           JOIN part p ON p.message_id = m.id
@@ -231,6 +226,7 @@ export async function parseOpenCodeSqliteSession(args: {
   dbPath: string
   sessionId: string
   platform: NodeJS.Platform
+  agent?: 'opencode' | 'zcode'
 }): Promise<AiVaultSession | null> {
   return readOpenCodeDatabase({
     dbPath: args.dbPath,
@@ -245,12 +241,14 @@ export function readOpenCodeSqliteSession(args: {
   dbPath: string
   sessionId: string
   platform: NodeJS.Platform
+  agent?: 'opencode' | 'zcode'
 }): AiVaultSession | null {
   const { db, dbPath, sessionId, platform } = args
   if (!canReadOpenCodeSessions(db)) {
     return null
   }
-  const row = db.prepare(buildSessionQuery(db)).get(sessionId) as SessionRow | undefined
+  const agent = args.agent ?? 'opencode'
+  const row = readSessionRow(db.prepare(buildSessionQuery(db, agent)).get(sessionId))
   if (!row || row.id !== sessionId) {
     return null
   }
@@ -262,7 +260,7 @@ export function readOpenCodeSqliteSession(args: {
   // Why: discovery uses a synthetic db#session path only for parser routing.
   // The UI's log open/reveal actions need a real filesystem path.
   const accumulator = createAccumulator({
-    agent: 'opencode',
+    agent: args.agent ?? 'opencode',
     file: {
       path: dbPath,
       mtimeMs,
@@ -279,7 +277,7 @@ export function readOpenCodeSqliteSession(args: {
   updateTimeline(accumulator, row.time_created)
   updateTimeline(accumulator, row.time_updated)
 
-  const previewSql = buildPreviewQuery(db)
+  const previewSql = buildPreviewQuery(db, agent)
   if (previewSql) {
     // Why: SQL already dropped anything older than the newest-N window, so the
     // accumulator never shifts and cannot detect the truncation itself. Ask for
@@ -322,7 +320,7 @@ export function readOpenCodeSqliteSession(args: {
   // Why: list preview only joins the newest messages. On-demand copy needs the
   // session's earliest real user text part, not a later turn still in the window.
   if (shouldCaptureFullFirstUserPrompt()) {
-    accumulator.firstUserPrompt = readFirstUserPromptFromOpenCodeDb(db, sessionId)
+    accumulator.firstUserPrompt = readFirstUserPromptFromOpenCodeDb(db, sessionId, agent)
   }
 
   return finalizeSession(accumulator, platform)
diff --git a/src/main/ai-vault/session-scanner-opencode-wsl-client.test.ts b/src/main/ai-vault/session-scanner-opencode-wsl-client.test.ts
new file mode 100644
index 000000000000..2d0e52bfc811
--- /dev/null
+++ b/src/main/ai-vault/session-scanner-opencode-wsl-client.test.ts
@@ -0,0 +1,131 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { createAccumulator, finalizeSession } from './session-scanner-accumulator'
+import type { OpenCodeSqliteProcessOptions } from './session-scanner-opencode-sqlite-process-client'
+
+const mocks = vi.hoisted(() => ({
+  running: vi.fn(async (paths: readonly string[]) => [...paths]),
+  create: vi.fn((_options: OpenCodeSqliteProcessOptions) => ({ dispose: vi.fn() }))
+}))
+vi.mock('../wsl-running-path-filter', () => ({
+  filterPathsToRunningWslDistrosAsync: mocks.running
+}))
+vi.mock('./session-scanner-opencode-sqlite-process-client', () => ({
+  createOpenCodeSqliteProcessClient: mocks.create
+}))
+vi.mock('../wsl/wsl-executable-path', () => ({
+  resolveWslExecutablePath: () => 'C:\\Windows\\System32\\wsl.exe'
+}))
+vi.mock('../wsl-interop-spawn-directory', () => ({
+  resolveWslInteropSpawnCwd: () => 'C:\\Windows'
+}))
+import {
+  configureOpenCodeWslReaders,
+  mapOpenCodeWslSession,
+  openCodeWslClient
+} from './session-scanner-opencode-wsl-client'
+
+const path = String.raw`\\wsl$\Ubuntu\home\ada\opencode.db`
+const runtime = {
+  distro: 'Ubuntu',
+  executable: '/usr/bin/node',
+  readerPath: '/mnt/c/reader $literal.cjs'
+}
+
+beforeEach(() => {
+  configureOpenCodeWslReaders([])
+  vi.clearAllMocks()
+  mocks.running.mockImplementation(async (paths) => [...paths])
+})
+afterEach(() => {
+  configureOpenCodeWslReaders([])
+  vi.restoreAllMocks()
+  vi.unstubAllEnvs()
+})
+
+describe('WSL SQLite reader clients', () => {
+  it('reuses one client per distro and uses literal --exec argv with a safe host cwd and env', async () => {
+    vi.stubEnv('NODE_OPTIONS', '--require=host-loader')
+    vi.stubEnv('WSLENV', 'NODE_OPTIONS/u')
+    configureOpenCodeWslReaders([runtime])
+    const first = await openCodeWslClient('Ubuntu', path)
+    configureOpenCodeWslReaders([
+      { readerPath: runtime.readerPath, executable: runtime.executable, distro: 'ubuntu' }
+    ])
+    expect(await openCodeWslClient('ubuntu', path)).toBe(first)
+    expect(mocks.create).toHaveBeenCalledOnce()
+    expect(mocks.running).not.toHaveBeenCalled()
+    expect(mocks.create).toHaveBeenCalledWith(
+      expect.objectContaining({
+        args: ['-d', 'Ubuntu', '--exec', '/usr/bin/node', '/mnt/c/reader $literal.cjs'],
+        cwd: 'C:\\Windows'
+      })
+    )
+    const options = mocks.create.mock.calls[0]?.[0]
+    expect(options).toEqual(
+      expect.objectContaining({
+        env: expect.not.objectContaining({
+          NODE_OPTIONS: expect.anything(),
+          WSLENV: expect.anything()
+        })
+      })
+    )
+  })
+
+  it('checks confirmed running state at process creation and retires changed configurations', async () => {
+    configureOpenCodeWslReaders([runtime])
+    await openCodeWslClient('Ubuntu', path)
+    const first = mocks.create.mock.results[0]?.value
+    const admit = mocks.create.mock.calls[0]?.[0].beforeSpawn
+    expect(admit).toBeDefined()
+    await admit?.(new AbortController().signal)
+    expect(mocks.running).toHaveBeenCalledWith([path], { requireConfirmed: true })
+    mocks.running.mockResolvedValueOnce([])
+    await expect(admit?.(new AbortController().signal)).rejects.toThrow('not running')
+    configureOpenCodeWslReaders([{ ...runtime, executable: '/new/node' }])
+    expect(first?.dispose).toHaveBeenCalledOnce()
+    await openCodeWslClient('Ubuntu', path)
+    const second = mocks.create.mock.results[1]?.value
+    configureOpenCodeWslReaders([])
+    expect(second?.dispose).toHaveBeenCalledOnce()
+  })
+
+  it('cancels a running-distro probe before creating a child', async () => {
+    configureOpenCodeWslReaders([runtime])
+    await openCodeWslClient('Ubuntu', path)
+    mocks.running.mockReturnValue(new Promise(() => {}))
+    const controller = new AbortController()
+    const pending = mocks.create.mock.calls[0]?.[0].beforeSpawn?.(controller.signal)
+    controller.abort(new Error('cancelled probe'))
+    await expect(pending).rejects.toThrow('cancelled probe')
+    expect(mocks.create).toHaveBeenCalledOnce()
+  })
+
+  it('keeps unavailable readers unavailable until repaired configuration arrives', async () => {
+    configureOpenCodeWslReaders([{ distro: 'Ubuntu', error: 'Preparing' }])
+    await expect(openCodeWslClient('Ubuntu', path)).rejects.toThrow('Preparing')
+    expect(mocks.create).not.toHaveBeenCalled()
+    configureOpenCodeWslReaders([runtime])
+    await openCodeWslClient('Ubuntu', path)
+    expect(mocks.create).toHaveBeenCalledOnce()
+  })
+
+  it('restores the original database identity and distro cwd while retaining a Linux resume command', () => {
+    const accumulator = createAccumulator({
+      agent: 'opencode',
+      sessionId: 'session',
+      file: { path: '/home/ada/opencode.db', mtimeMs: 1, modifiedAt: new Date(1).toISOString() }
+    })
+    accumulator.cwd = '/home/ada/project $literal'
+    accumulator.title = 'A session'
+    const native = finalizeSession(accumulator, 'linux')
+    const mapped = mapOpenCodeWslSession(native, path)
+    expect(mapped).toMatchObject({
+      id: `local:opencode:session:${path}`,
+      filePath: path,
+      cwd: '/home/ada/project $literal',
+      executionHostPlatform: 'linux',
+      resumeCommand: "cd '/home/ada/project $literal' && opencode --session 'session'"
+    })
+    expect(mapOpenCodeWslSession(null, path)).toBeNull()
+  })
+})
diff --git a/src/main/ai-vault/session-scanner-opencode-wsl-client.ts b/src/main/ai-vault/session-scanner-opencode-wsl-client.ts
new file mode 100644
index 000000000000..1c93c2616a61
--- /dev/null
+++ b/src/main/ai-vault/session-scanner-opencode-wsl-client.ts
@@ -0,0 +1,93 @@
+import type { AiVaultSession } from '../../shared/ai-vault-types'
+import { waitForPromiseWithSignal, throwIfSignalAborted } from '../../shared/abort-signal-reason'
+import { buildWslExecArgs } from '../../shared/wsl-login-shell-command'
+import { parseWslUncPath } from '../../shared/wsl-paths'
+import { resolveWslExecutablePath } from '../wsl/wsl-executable-path'
+import { resolveWslInteropSpawnCwd } from '../wsl-interop-spawn-directory'
+import { filterPathsToRunningWslDistrosAsync } from '../wsl-running-path-filter'
+import { createOpenCodeSqliteProcessClient } from './session-scanner-opencode-sqlite-process-client'
+import type { OpenCodeSqliteWorkerClient } from './session-scanner-opencode-sqlite-worker-client'
+import type { OpenCodeWslRuntime } from './session-scanner-opencode-wsl-runtime'
+import { buildRelayAiVaultServiceEnv } from './session-scanner-service-env'
+
+const runtimes = new Map<string, OpenCodeWslRuntime>()
+const clients = new Map<string, OpenCodeSqliteWorkerClient>()
+
+export function configureOpenCodeWslReaders(entries: readonly OpenCodeWslRuntime[]): void {
+  const present = new Set(entries.map((entry) => entry.distro.toLowerCase()))
+  for (const key of runtimes.keys()) {
+    if (!present.has(key)) {
+      clients.get(key)?.dispose()
+      clients.delete(key)
+      runtimes.delete(key)
+    }
+  }
+  for (const entry of entries) {
+    const key = entry.distro.toLowerCase()
+    const previous = runtimes.get(key)
+    if (
+      previous?.executable !== entry.executable ||
+      previous?.readerPath !== entry.readerPath ||
+      previous?.error !== entry.error
+    ) {
+      clients.get(key)?.dispose()
+      clients.delete(key)
+      runtimes.set(key, entry)
+    }
+  }
+}
+
+export function openCodeWslPath(path: string): ReturnType<typeof parseWslUncPath> {
+  return process.platform === 'win32' ? parseWslUncPath(path) : null
+}
+
+export async function openCodeWslClient(
+  distro: string,
+  dbPath: string,
+  signal?: AbortSignal
+): Promise<OpenCodeSqliteWorkerClient> {
+  throwIfSignalAborted(signal)
+  const key = distro.toLowerCase()
+  const runtime = runtimes.get(key)
+  if (!runtime || runtime.error !== undefined) {
+    throw new Error(
+      runtime?.error ?? 'The WSL SQLite reader is not prepared. Refresh Vault to retry.'
+    )
+  }
+  let client = clients.get(key)
+  if (!client) {
+    client = createOpenCodeSqliteProcessClient({
+      executable: resolveWslExecutablePath(),
+      args: buildWslExecArgs(distro, [runtime.executable, runtime.readerPath]),
+      cwd: resolveWslInteropSpawnCwd(),
+      env: { ...buildRelayAiVaultServiceEnv(), WSL_UTF8: '1' },
+      async beforeSpawn(spawnSignal) {
+        const running = await waitForPromiseWithSignal(
+          filterPathsToRunningWslDistrosAsync([dbPath], { requireConfirmed: true }),
+          spawnSignal
+        )
+        if (running.length === 0) {
+          throw new Error(`WSL distro ${distro} is not running. Start it to read its history.`)
+        }
+      }
+    })
+    clients.set(key, client)
+  }
+  return client
+}
+
+/** Keep database reads Windows-addressable and the working directory native to its host. */
+export function mapOpenCodeWslSession(
+  session: AiVaultSession | null,
+  dbPath: string
+): AiVaultSession | null {
+  if (!session) {
+    return null
+  }
+  return {
+    ...session,
+    id: `${session.executionHostId}:${session.agent}:${session.sessionId}:${dbPath}`,
+    filePath: dbPath,
+    executionHostPlatform: 'linux'
+  }
+}
diff --git a/src/main/ai-vault/session-scanner-opencode-wsl-routing.test.ts b/src/main/ai-vault/session-scanner-opencode-wsl-routing.test.ts
new file mode 100644
index 000000000000..754211c323ca
--- /dev/null
+++ b/src/main/ai-vault/session-scanner-opencode-wsl-routing.test.ts
@@ -0,0 +1,174 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { AiVaultScanIssue } from '../../shared/ai-vault-types'
+import { createAccumulator, finalizeSession } from './session-scanner-accumulator'
+import type { SessionFileCandidate } from './session-scanner-types'
+import type * as wslClientModule from './session-scanner-opencode-wsl-client'
+
+const mocks = vi.hoisted(() => ({
+  native: {
+    list: vi.fn(async (): Promise<SessionFileCandidate[]> => []),
+    parse: vi.fn(async () => null),
+    capture: vi.fn(async () => ({ session: null, messages: [] }))
+  },
+  guest: vi.fn()
+}))
+vi.mock('./session-scanner-opencode-sqlite-worker-client', () => ({
+  OpenCodeSqliteWorkerClient: class {
+    list = mocks.native.list
+    parse = mocks.native.parse
+    capture = mocks.native.capture
+  }
+}))
+vi.mock('./session-scanner-opencode-wsl-client', async (importOriginal) => ({
+  ...(await importOriginal<typeof wslClientModule>()),
+  openCodeWslClient: mocks.guest
+}))
+import {
+  captureOpenCode2SqliteSessionViaWorker,
+  captureOpenCodeSqliteSessionViaWorker,
+  listOpenCode2SqliteSessionsViaWorker,
+  listOpenCodeSqliteSessionsViaWorker,
+  parseOpenCode2SqliteSessionViaWorker,
+  parseOpenCodeSqliteSessionViaWorker
+} from './session-scanner-opencode-sqlite-worker-spawn'
+
+const ubuntu = '//wsl.localhost/Ubuntu/home/ada/opencode.db'
+const debian = '//wsl$/Debian/home/ada/opencode.db'
+const native = 'C:/Users/ada/opencode.db'
+const guest = '/home/ada/opencode.db'
+
+function row(path: string) {
+  return {
+    agent: 'opencode' as const,
+    codexHome: null,
+    file: { path: `${path}#same-session`, mtimeMs: 1, modifiedAt: new Date(1).toISOString() }
+  }
+}
+function session() {
+  const accumulator = createAccumulator({
+    agent: 'opencode',
+    sessionId: 'same-session',
+    file: row(guest).file
+  })
+  accumulator.title = 'Session'
+  accumulator.cwd = '/home/ada/repo'
+  return finalizeSession(accumulator, 'linux')
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  vi.spyOn(process, 'platform', 'get').mockReturnValue('win32')
+})
+afterEach(() => vi.restoreAllMocks())
+
+describe('OpenCode SQLite execution-host routes', () => {
+  it('separates native and distro databases and preserves equal IDs in different distros', async () => {
+    const list = vi.fn(async (args) => [row(args.dbPaths[0])])
+    mocks.guest.mockResolvedValue({ list })
+    mocks.native.list.mockResolvedValueOnce([row(native)])
+    const issues: AiVaultScanIssue[] = []
+    const result = await listOpenCodeSqliteSessionsViaWorker({
+      dbPaths: [native, ubuntu, debian],
+      limit: 2,
+      issues
+    })
+    expect(result.map((entry) => entry.file.path)).toEqual([
+      `${native}#same-session`,
+      `${ubuntu}#same-session`,
+      `${debian}#same-session`
+    ])
+    expect(mocks.native.list).toHaveBeenCalledWith(expect.objectContaining({ dbPaths: [native] }))
+    expect(list).toHaveBeenCalledTimes(2)
+    expect(list.mock.calls.every(([args]) => args.dbPaths[0] === guest)).toBe(true)
+    expect(mocks.guest).toHaveBeenNthCalledWith(1, 'Ubuntu', ubuntu, undefined)
+    expect(mocks.guest).toHaveBeenNthCalledWith(2, 'Debian', debian, undefined)
+    expect(issues).toEqual([])
+  })
+
+  it('maps guest list issues back to the original database and omits unavailable distros', async () => {
+    mocks.guest
+      .mockResolvedValueOnce({
+        list: vi.fn(async (args) => {
+          args.issues.push({ agent: 'opencode2', path: guest, message: 'locked' })
+          return []
+        })
+      })
+      .mockRejectedValueOnce(new Error('Distro stopped'))
+    const issues: AiVaultScanIssue[] = []
+    await listOpenCode2SqliteSessionsViaWorker({ dbPaths: [ubuntu, debian], limit: 2, issues })
+    expect(issues).toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({ path: ubuntu, message: 'locked' }),
+        expect.objectContaining({ path: debian, kind: 'scope', message: 'Distro stopped' })
+      ])
+    )
+    expect(mocks.native.list).not.toHaveBeenCalled()
+  })
+
+  it.each([
+    ['v1', parseOpenCodeSqliteSessionViaWorker, captureOpenCodeSqliteSessionViaWorker, undefined],
+    [
+      'v2',
+      parseOpenCode2SqliteSessionViaWorker,
+      captureOpenCode2SqliteSessionViaWorker,
+      'opencode2'
+    ]
+  ] as const)(
+    'routes %s parse/capture to Linux and restores the caller identity',
+    async (_label, parse, capture, agent) => {
+      const parsed = session()
+      const messages = [{ role: 'user' as const, text: 'Complete transcript', timestamp: null }]
+      const reader = {
+        parse: vi.fn(async () => parsed),
+        capture: vi.fn(async () => ({ session: parsed, messages }))
+      }
+      mocks.guest.mockResolvedValue(reader)
+      const controller = new AbortController()
+      const args = {
+        dbPath: ubuntu,
+        sessionId: 'same-session',
+        platform: 'win32' as const,
+        signal: controller.signal
+      }
+      expect(await parse({ ...args, fullFirstUserPrompt: true })).toMatchObject({
+        id: `local:opencode:same-session:${ubuntu}`,
+        filePath: ubuntu,
+        cwd: '/home/ada/repo',
+        executionHostPlatform: 'linux'
+      })
+      expect(reader.parse).toHaveBeenCalledWith({
+        ...args,
+        dbPath: guest,
+        platform: 'linux',
+        fullFirstUserPrompt: true,
+        ...(agent ? { agent } : {})
+      })
+      expect(await capture(args)).toMatchObject({ session: { filePath: ubuntu }, messages })
+      expect(reader.capture).toHaveBeenCalledWith({
+        ...args,
+        dbPath: guest,
+        platform: 'linux',
+        ...(agent ? { agent } : {})
+      })
+      expect(mocks.native.parse).not.toHaveBeenCalled()
+      expect(mocks.native.capture).not.toHaveBeenCalled()
+    }
+  )
+
+  it('propagates cancellation instead of returning an empty successful list', async () => {
+    const controller = new AbortController()
+    mocks.guest.mockImplementationOnce(async () => {
+      controller.abort(new Error('cancelled'))
+      throw new Error('cancelled')
+    })
+    await expect(
+      listOpenCodeSqliteSessionsViaWorker({
+        dbPaths: [ubuntu],
+        limit: 1,
+        issues: [],
+        signal: controller.signal
+      })
+    ).rejects.toThrow('cancelled')
+    expect(mocks.native.list).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/main/ai-vault/session-scanner-opencode-wsl-runtime.ts b/src/main/ai-vault/session-scanner-opencode-wsl-runtime.ts
new file mode 100644
index 000000000000..df03c61ef6d3
--- /dev/null
+++ b/src/main/ai-vault/session-scanner-opencode-wsl-runtime.ts
@@ -0,0 +1,4 @@
+export type OpenCodeWslRuntime = { distro: string } & (
+  | { executable: string; readerPath: string; error?: never }
+  | { error: string; executable?: never; readerPath?: never }
+)
diff --git a/src/main/ai-vault/session-scanner-parse-cache.ts b/src/main/ai-vault/session-scanner-parse-cache.ts
index a5eb98235e4a..4610c198cb37 100644
--- a/src/main/ai-vault/session-scanner-parse-cache.ts
+++ b/src/main/ai-vault/session-scanner-parse-cache.ts
@@ -81,6 +81,7 @@ function resumableStateFactoryFor(
     case 'muse':
     case 'opencode':
     case 'opencode2':
+    case 'zcode':
     case 'rovo':
       return null
   }
@@ -114,12 +115,13 @@ export async function parseAgentSessionFileCached(
   candidate: SessionFileCandidate,
   platform: NodeJS.Platform,
   stats?: SessionParseStats,
-  requireRead?: SessionParseReadRequirement
+  requireRead?: SessionParseReadRequirement,
+  signal?: AbortSignal
 ): Promise<AiVaultSession | null> {
   // The whole lookup-read-store sequence runs in the lane: a concurrent parse of
   // the same path shares this entry's resume point and its message channel.
   return inSessionParseFileLane(candidate.file.path, () =>
-    parseCachedInLane(candidate, platform, stats, requireRead)
+    parseCachedInLane(candidate, platform, stats, requireRead, signal)
   )
 }
 
@@ -162,7 +164,8 @@ async function parseCachedInLane(
   candidate: SessionFileCandidate,
   platform: NodeJS.Platform,
   stats?: SessionParseStats,
-  requireRead?: SessionParseReadRequirement
+  requireRead?: SessionParseReadRequirement,
+  signal?: AbortSignal
 ): Promise<AiVaultSession | null> {
   const { file } = candidate
   if (
@@ -216,7 +219,7 @@ async function parseCachedInLane(
     return enriched.session
   }
 
-  const session = await readWholeTranscript({ candidate, platform, stats })
+  const session = await readWholeTranscript({ candidate, platform, stats, signal })
   // Whole-file agents merge the sibling here just like the resumable branch
   // does post-read; the raw fold stays in foldSession so a sibling-only change
   // re-merges without re-reading the transcript.
diff --git a/src/main/ai-vault/session-scanner-service-env.test.ts b/src/main/ai-vault/session-scanner-service-env.test.ts
index b04db9e0c92d..e658cb63bbbb 100644
--- a/src/main/ai-vault/session-scanner-service-env.test.ts
+++ b/src/main/ai-vault/session-scanner-service-env.test.ts
@@ -150,5 +150,17 @@ it('carries OMP root/profile inputs only to the desktop service, retaining empty
     XDG_DATA_HOME: '/home/dev/data'
   }
   expect(buildAiVaultServiceEnv(roots, 'linux')).toEqual({ ...roots, ELECTRON_RUN_AS_NODE: '1' })
-  expect(buildRelayAiVaultServiceEnv(roots, 'linux')).toEqual({})
+  expect(buildRelayAiVaultServiceEnv(roots, 'linux')).toEqual({ XDG_DATA_HOME: '/home/dev/data' })
+})
+
+it('preserves execution-host OpenCode roots in the relay service', () => {
+  expect(
+    buildRelayAiVaultServiceEnv(
+      { XDG_DATA_HOME: '/srv/data', OPENCODE_DB: 'opencode-team.db' },
+      'linux'
+    )
+  ).toEqual({
+    XDG_DATA_HOME: '/srv/data',
+    OPENCODE_DB: 'opencode-team.db'
+  })
 })
diff --git a/src/main/ai-vault/session-scanner-service-env.ts b/src/main/ai-vault/session-scanner-service-env.ts
index 257ba676d8cc..063df2dcc639 100644
--- a/src/main/ai-vault/session-scanner-service-env.ts
+++ b/src/main/ai-vault/session-scanner-service-env.ts
@@ -97,10 +97,14 @@ export function buildAiVaultServiceEnv(
   return env
 }
 
-/** Relay: the sidecar takes every root from its init message, not the environment. */
+/** Relay: home comes from init; OpenCode also supports host-side data overrides. */
 export function buildRelayAiVaultServiceEnv(
   baseEnv: NodeJS.ProcessEnv = process.env,
   platform: NodeJS.Platform = process.platform
 ): NodeJS.ProcessEnv {
-  return pickAllowedEnv(RUNTIME_ENV_ALLOWLIST, baseEnv, platform)
+  return pickAllowedEnv(
+    [...RUNTIME_ENV_ALLOWLIST, 'XDG_DATA_HOME', 'OPENCODE_DB'],
+    baseEnv,
+    platform
+  )
 }
diff --git a/src/main/ai-vault/session-scanner-source-discovery.ts b/src/main/ai-vault/session-scanner-source-discovery.ts
index d62fdd4d19db..62b2e0562a8d 100644
--- a/src/main/ai-vault/session-scanner-source-discovery.ts
+++ b/src/main/ai-vault/session-scanner-source-discovery.ts
@@ -2,9 +2,11 @@ import { delimiter } from 'node:path'
 import type { AiVaultAgent, AiVaultScanIssue } from '../../shared/ai-vault-types'
 import { discoverFiles } from './session-scanner-discovery'
 import { opencodeDiscoveries } from './session-scanner-opencode-sources'
+import { zcodeDiscoveries } from './session-scanner-zcode-sources'
 import { antigravityDiscoveries } from './session-scanner-antigravity-sources'
 import { AI_VAULT_AGENT_SOURCES, type AiVaultAgentSource } from './session-scanner-agent-sources'
 import { normalizedWslHomeDirs } from './session-scanner-roots'
+import { configureOpenCodeWslReaders } from './session-scanner-opencode-wsl-client'
 import type { AiVaultScanOptions, SessionFileDiscovery } from './session-scanner-types'
 
 export { DEFAULT_CODEX_HOME_DIR } from './session-scanner-agent-sources'
@@ -15,6 +17,9 @@ export async function discoverAiVaultSessionSources(args: {
   issues: AiVaultScanIssue[]
 }): Promise<SessionFileDiscovery[]> {
   const { options, limitPerAgent, issues } = args
+  if (options.wslOpenCodeReaders) {
+    configureOpenCodeWslReaders(options.wslOpenCodeReaders)
+  }
   const wslHomeDirs = normalizedWslHomeDirs(options.wslHomeDirs)
 
   // The Cursor chat-meta scan scope is owned by scanAiVaultSessions: it has to
@@ -24,6 +29,7 @@ export async function discoverAiVaultSessionSources(args: {
     // SQLite DB. discoverOpenCodeSessions runs both the file scanner (legacy)
     // and the SQLite scanner (1.17.x); dedup by sessionId happens inside.
     ...opencodeDiscoveries(options, wslHomeDirs, limitPerAgent, issues),
+    ...zcodeDiscoveries(options, wslHomeDirs, limitPerAgent, issues),
     ...antigravityDiscoveries(options, wslHomeDirs, limitPerAgent, issues),
     ...Object.entries(AI_VAULT_AGENT_SOURCES).flatMap(([agent, source]) =>
       source
diff --git a/src/main/ai-vault/session-scanner-test-fixtures.ts b/src/main/ai-vault/session-scanner-test-fixtures.ts
index 7146d237bf78..43d03d340dde 100644
--- a/src/main/ai-vault/session-scanner-test-fixtures.ts
+++ b/src/main/ai-vault/session-scanner-test-fixtures.ts
@@ -63,6 +63,7 @@ export function isolatedScanRoots(root: string) {
     // Why: prevent the SQLite scanner from picking up the real
     // ~/.local/share/opencode/opencode.db during tests.
     opencodeDbPaths: [] as readonly string[],
+    zcodeDbPath: join(root, 'zcode', 'db.sqlite'),
     grokSessionsDir: join(root, 'grok-sessions'),
     devinTranscriptsDir: join(root, 'devin-transcripts'),
     hermesSessionsDir: join(root, 'hermes-sessions'),
diff --git a/src/main/ai-vault/session-scanner-types.ts b/src/main/ai-vault/session-scanner-types.ts
index ede4173a0900..099b3593431b 100644
--- a/src/main/ai-vault/session-scanner-types.ts
+++ b/src/main/ai-vault/session-scanner-types.ts
@@ -10,6 +10,7 @@ import type {
   TranscriptSessionIdentity
 } from './session-transcript-consumers'
 import type { SessionSidecarObservation } from './session-sidecar-stat'
+import type { OpenCodeWslRuntime } from './session-scanner-opencode-wsl-runtime'
 
 export type AiVaultScanOptions = {
   claudeProjectsDir?: string
@@ -19,6 +20,7 @@ export type AiVaultScanOptions = {
   // (codexHome null → unprefixed resume) is testable without the user's home.
   defaultCodexHomeDir?: string
   wslHomeDirs?: readonly string[]
+  wslOpenCodeReaders?: readonly OpenCodeWslRuntime[]
   geminiSessionsDir?: string
   antigravityBrainDir?: string
   copilotSessionsDir?: string
@@ -27,6 +29,8 @@ export type AiVaultScanOptions = {
   // Why: OpenCode 1.17.x stores sessions in SQLite; tests inject a temp DB
   // here so they don't depend on the real ~/.local/share/opencode.
   opencodeDbPaths?: readonly string[]
+  /** Test override for the ZCode CLI's OpenCode-shaped SQLite database. */
+  zcodeDbPath?: string
   grokSessionsDir?: string
   devinTranscriptsDir?: string
   hermesSessionsDir?: string
diff --git a/src/main/ai-vault/session-scanner-unlimited-dedup.test.ts b/src/main/ai-vault/session-scanner-unlimited-dedup.test.ts
index d217c2bf4895..8e912021e5ff 100644
--- a/src/main/ai-vault/session-scanner-unlimited-dedup.test.ts
+++ b/src/main/ai-vault/session-scanner-unlimited-dedup.test.ts
@@ -1,5 +1,6 @@
 import { beforeEach, expect, it, vi } from 'vitest'
 import type * as SessionDedup from './session-root-dedup'
+import type * as RemoteSessionParseCache from './remote-session-parse-cache'
 import type { AiVaultSession } from '../../shared/ai-vault-types'
 
 const fixture = vi.hoisted((): { sessions: AiVaultSession[]; visits: number } => ({
@@ -31,7 +32,8 @@ vi.mock('./remote-session-scanner-sources', () => ({ remoteSessionSources: () =>
 vi.mock('./remote-session-scanner-discovery', () => ({
   discoverRemoteSourceCandidates: async () => candidates()
 }))
-vi.mock('./remote-session-parse-cache', () => ({
+vi.mock('./remote-session-parse-cache', async (original) => ({
+  ...(await original<typeof RemoteSessionParseCache>()),
   remoteSessionParseHostKey: () => 'fixture',
   parseRemoteSessionFileCached: async ({ candidate }: { candidate: { session: AiVaultSession } }) =>
     candidate.session
diff --git a/src/main/ai-vault/session-scanner-zcode-sources.test.ts b/src/main/ai-vault/session-scanner-zcode-sources.test.ts
new file mode 100644
index 000000000000..4ed6667342fe
--- /dev/null
+++ b/src/main/ai-vault/session-scanner-zcode-sources.test.ts
@@ -0,0 +1,41 @@
+import { afterEach, expect, it, vi } from 'vitest'
+import type { AiVaultScanIssue } from '../../shared/ai-vault-types'
+import { wslGatedAccess } from '../native-chat/wsl-transcript-fs-access'
+import { zcodeDiscoveries } from './session-scanner-zcode-sources'
+
+vi.mock('../native-chat/wsl-transcript-fs-access', () => ({ wslGatedAccess: vi.fn() }))
+
+const access = vi.mocked(wslGatedAccess)
+
+afterEach(() => access.mockReset())
+
+it.each(['EACCES', 'EPERM', 'EIO'])(
+  'reports a ZCode database %s error instead of treating it as absent',
+  async (code) => {
+    access.mockRejectedValueOnce(
+      Object.assign(new Error(`Cannot read database: ${code}`), { code })
+    )
+    const issues: AiVaultScanIssue[] = []
+
+    const [discovery] = await Promise.all(
+      zcodeDiscoveries({ zcodeDbPath: '/example/db.sqlite' }, [], 10, issues)
+    )
+
+    expect(discovery?.files).toEqual([])
+    expect(issues).toEqual([
+      { agent: 'zcode', path: '/example/db.sqlite', message: `Cannot read database: ${code}` }
+    ])
+  }
+)
+
+it('silently skips a ZCode database that does not exist', async () => {
+  access.mockRejectedValueOnce(Object.assign(new Error('No such file'), { code: 'ENOENT' }))
+  const issues: AiVaultScanIssue[] = []
+
+  const [discovery] = await Promise.all(
+    zcodeDiscoveries({ zcodeDbPath: '/example/db.sqlite' }, [], 10, issues)
+  )
+
+  expect(discovery?.files).toEqual([])
+  expect(issues).toEqual([])
+})
diff --git a/src/main/ai-vault/session-scanner-zcode-sources.ts b/src/main/ai-vault/session-scanner-zcode-sources.ts
new file mode 100644
index 000000000000..68b013712e9d
--- /dev/null
+++ b/src/main/ai-vault/session-scanner-zcode-sources.ts
@@ -0,0 +1,55 @@
+import { homedir } from 'node:os'
+import { join } from 'node:path'
+import type { AiVaultScanIssue } from '../../shared/ai-vault-types'
+import { throwIfSignalAborted } from '../../shared/abort-signal-reason'
+import { wslGatedAccess } from '../native-chat/wsl-transcript-fs-access'
+import { listZcodeSqliteSessionsViaWorker } from './session-scanner-opencode-sqlite-worker-spawn'
+import type { AiVaultScanOptions, SessionFileDiscovery } from './session-scanner-types'
+
+// ZCode's CLI stores its OpenCode-shaped history in a separate database.
+// Keep discovery separate so an OpenCode install cannot absorb ZCode rows.
+export function zcodeDiscoveries(
+  options: AiVaultScanOptions,
+  wslHomeDirs: readonly string[],
+  limit: number,
+  issues: AiVaultScanIssue[]
+): Promise<SessionFileDiscovery>[] {
+  const paths = options.zcodeDbPath
+    ? [options.zcodeDbPath]
+    : [homedir(), ...wslHomeDirs].map((home) => join(home, '.zcode', 'cli', 'db', 'db.sqlite'))
+  return paths.map(async (dbPath) => ({
+    agent: 'zcode' as const,
+    rootDir: dbPath,
+    files: (await zcodeDatabaseExists(dbPath, issues, options.signal))
+      ? (
+          await listZcodeSqliteSessionsViaWorker({
+            dbPaths: [dbPath],
+            limit,
+            issues,
+            signal: options.signal
+          })
+        ).map((candidate) => candidate.file)
+      : []
+  }))
+}
+
+async function zcodeDatabaseExists(
+  dbPath: string,
+  issues: AiVaultScanIssue[],
+  signal?: AbortSignal
+): Promise<boolean> {
+  try {
+    return await wslGatedAccess(dbPath, 'scan', signal)
+  } catch (error) {
+    throwIfSignalAborted(signal)
+    if (error instanceof Error && 'code' in error && error.code === 'ENOENT') {
+      return false
+    }
+    issues.push({
+      agent: 'zcode',
+      path: dbPath,
+      message: error instanceof Error ? error.message : String(error)
+    })
+    return false
+  }
+}
diff --git a/src/main/ai-vault/session-scanner-zcode-visibility.ts b/src/main/ai-vault/session-scanner-zcode-visibility.ts
new file mode 100644
index 000000000000..06c0446b0e09
--- /dev/null
+++ b/src/main/ai-vault/session-scanner-zcode-visibility.ts
@@ -0,0 +1,9 @@
+/** Keep ZCode's hidden transcript messages out of every AI Vault read path. */
+export function zcodeVisibleMessageFilter(
+  agent: 'opencode' | 'zcode',
+  column: 'm.data' | 'data' = 'm.data'
+): string {
+  return agent === 'zcode'
+    ? `AND COALESCE(json_extract(${column}, '$.semantics.transcriptVisibility'), 'visible') != 'hidden'`
+    : ''
+}
diff --git a/src/main/ai-vault/session-scanner-zcode.test.ts b/src/main/ai-vault/session-scanner-zcode.test.ts
new file mode 100644
index 000000000000..4783b2134506
--- /dev/null
+++ b/src/main/ai-vault/session-scanner-zcode.test.ts
@@ -0,0 +1,188 @@
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it } from 'vitest'
+import { handleOpenCodeSqliteRequest } from './session-scanner-opencode-sqlite-dispatch'
+import { splitOpenCodeSqliteCandidate } from './session-scanner-opencode-sqlite-paths'
+import { writeOpenCodeSqliteDatabase } from './session-scanner-opencode-sqlite-fixture'
+import SyncDatabase from '../sqlite/sync-database'
+
+// Why readers and not casts: the worker dispatch returns `value: unknown` on purpose — it
+// crosses a process boundary. Narrowing here keeps the repo's no-assertions rule and fails
+// the test with a readable message if the payload shape ever changes.
+function readCandidates(value: unknown): { agent: string; path: string }[] {
+  if (typeof value !== 'object' || value === null || !('candidates' in value)) {
+    throw new Error('expected a listing payload with candidates')
+  }
+  const { candidates } = value
+  if (!Array.isArray(candidates)) {
+    throw new Error('expected candidates to be an array')
+  }
+  return candidates.map((candidate) => {
+    const agent = readStringField(candidate, 'agent')
+    const file = isRecord(candidate) ? candidate['file'] : null
+    return { agent, path: readStringField(file, 'path') }
+  })
+}
+
+function readMessageTexts(value: unknown): { text: string }[] {
+  if (typeof value !== 'object' || value === null || !('messages' in value)) {
+    throw new Error('expected a capture payload with messages')
+  }
+  const { messages } = value
+  if (!Array.isArray(messages)) {
+    throw new Error('expected messages to be an array')
+  }
+  return messages.map((message) => ({ text: readStringField(message, 'text') }))
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null
+}
+
+function readStringField(value: unknown, field: string): string {
+  const read = isRecord(value) ? value[field] : null
+  if (typeof read !== 'string') {
+    throw new Error(`expected a string \`${field}\``)
+  }
+  return read
+}
+
+const directories: string[] = []
+afterEach(() => {
+  for (const directory of directories) {
+    rmSync(directory, { recursive: true, force: true })
+  }
+  directories.length = 0
+})
+
+describe('ZCode AI Vault SQLite worker', () => {
+  it('lists, parses, and captures ZCode sessions without labelling them OpenCode', async () => {
+    const directory = mkdtempSync(join(tmpdir(), 'orca-zcode-ai-vault-'))
+    directories.push(directory)
+    const dbPath = join(directory, 'db.sqlite')
+    writeOpenCodeSqliteDatabase(dbPath, [
+      {
+        id: 'zcode-session',
+        directory: '/repo',
+        title: 'ZCode task',
+        turns: [
+          { role: 'user', parts: ['Fix the import'] },
+          { role: 'assistant', parts: ['Import fixed'] }
+        ]
+      }
+    ])
+
+    const listed = await handleOpenCodeSqliteRequest({
+      id: 1,
+      kind: 'list',
+      agent: 'zcode',
+      dbPaths: [dbPath],
+      limit: 10
+    })
+    expect(listed.ok).toBe(true)
+    if (!listed.ok) {
+      return
+    }
+    const candidates = readCandidates(listed.value)
+    expect(candidates).toHaveLength(1)
+    expect(candidates[0]?.agent).toBe('zcode')
+    expect(splitOpenCodeSqliteCandidate(candidates[0]!.path, 'zcode')).toEqual({
+      dbPath,
+      sessionId: 'zcode-session'
+    })
+    expect(splitOpenCodeSqliteCandidate(candidates[0]!.path)).toBeNull()
+
+    const parsed = await handleOpenCodeSqliteRequest({
+      id: 2,
+      kind: 'parse',
+      agent: 'zcode',
+      dbPath,
+      sessionId: 'zcode-session',
+      platform: 'darwin'
+    })
+    expect(parsed).toMatchObject({
+      ok: true,
+      value: {
+        agent: 'zcode',
+        title: 'ZCode task',
+        resumeCommand: "cd '/repo' && zcode --resume 'zcode-session'"
+      }
+    })
+
+    const captured = await handleOpenCodeSqliteRequest({
+      id: 3,
+      kind: 'capture',
+      agent: 'zcode',
+      dbPath,
+      sessionId: 'zcode-session',
+      platform: 'darwin'
+    })
+    expect(captured).toMatchObject({ ok: true, value: { session: { agent: 'zcode' } } })
+    if (!captured.ok) {
+      return
+    }
+    expect(readMessageTexts(captured.value)).toEqual(
+      expect.arrayContaining([expect.objectContaining({ text: 'Fix the import' })])
+    )
+  })
+
+  it('excludes ZCode hidden transcript messages from preview and search', async () => {
+    const directory = mkdtempSync(join(tmpdir(), 'orca-zcode-ai-vault-'))
+    directories.push(directory)
+    const dbPath = join(directory, 'db.sqlite')
+    writeOpenCodeSqliteDatabase(dbPath, [
+      {
+        id: 'visible-session',
+        turns: [
+          { role: 'user', parts: ['internal reminder'] },
+          { role: 'user', parts: ['visible request'] },
+          { role: 'assistant', parts: ['visible response'] }
+        ]
+      }
+    ])
+    const db = new SyncDatabase(dbPath)
+    try {
+      db.prepare(
+        "UPDATE message SET data = json_set(data, '$.semantics.transcriptVisibility', 'hidden') WHERE id LIKE '%-msg-0-%'"
+      ).run()
+    } finally {
+      db.close()
+    }
+
+    const parsed = await handleOpenCodeSqliteRequest({
+      id: 4,
+      kind: 'parse',
+      agent: 'zcode',
+      dbPath,
+      sessionId: 'visible-session',
+      platform: 'darwin',
+      fullFirstUserPrompt: true
+    })
+    expect(parsed).toMatchObject({
+      ok: true,
+      value: {
+        messageCount: 2,
+        firstUserPrompt: 'visible request'
+      }
+    })
+    if (!parsed.ok) {
+      return
+    }
+    expect(JSON.stringify(parsed.value)).not.toContain('internal reminder')
+
+    const captured = await handleOpenCodeSqliteRequest({
+      id: 5,
+      kind: 'capture',
+      agent: 'zcode',
+      dbPath,
+      sessionId: 'visible-session',
+      platform: 'darwin'
+    })
+    expect(captured.ok).toBe(true)
+    if (!captured.ok) {
+      return
+    }
+    expect(JSON.stringify(captured.value)).not.toContain('internal reminder')
+  })
+})
diff --git a/src/main/ai-vault/session-scanner.test.ts b/src/main/ai-vault/session-scanner.test.ts
index b8963ce80b8b..5bbe8d097513 100644
--- a/src/main/ai-vault/session-scanner.test.ts
+++ b/src/main/ai-vault/session-scanner.test.ts
@@ -23,9 +23,15 @@ vi.mock('./session-scanner-opencode-sqlite-worker-spawn', async () => {
     listOpenCodeSqliteSessionsViaWorker: (
       args: Parameters<typeof v1List.listOpenCodeSqliteSessions>[0]
     ) => v1List.listOpenCodeSqliteSessions(args),
+    listZcodeSqliteSessionsViaWorker: (
+      args: Parameters<typeof v1List.listOpenCodeSqliteSessions>[0]
+    ) => v1List.listOpenCodeSqliteSessions({ ...args, agent: 'zcode' }),
     parseOpenCodeSqliteSessionViaWorker: (
       args: Parameters<typeof v1Parse.parseOpenCodeSqliteSession>[0]
     ) => v1Parse.parseOpenCodeSqliteSession(args),
+    parseZcodeSqliteSessionViaWorker: (
+      args: Parameters<typeof v1Parse.parseOpenCodeSqliteSession>[0]
+    ) => v1Parse.parseOpenCodeSqliteSession({ ...args, agent: 'zcode' }),
     listOpenCode2SqliteSessionsViaWorker: (
       args: Parameters<typeof v2List.listOpenCode2SqliteSessions>[0]
     ) => v2List.listOpenCode2SqliteSessions(args),
@@ -400,7 +406,7 @@ describe('scanAiVaultSessions', () => {
       await writeEveryAgentVault(root)
     await writeMuseScannerFixture(roots.museSessionsDir)
 
-    const result = await scanAiVaultSessions({ ...roots, platform: 'darwin', limit: 20 })
+    const result = await scanAiVaultSessions({ ...roots, platform: 'darwin', limit: 25 })
 
     expect(result.issues).toEqual([])
     expect(new Set(result.sessions.map((session) => session.agent))).toEqual(
@@ -428,6 +434,7 @@ describe('scanAiVaultSessions', () => {
     expect(commandByAgent.get('opencode2')).toBe(
       "cd '/tmp/opencode2' && opencode2 --standalone --session 'opencode2-session'"
     )
+    expect(commandByAgent.get('zcode')).toBe("cd '/tmp/zcode' && zcode --resume 'zcode-session'")
     expect(commandByAgent.get('grok')).toBe("cd '/tmp/grok' && grok --resume 'grok-session'")
     expect(commandByAgent.get('hermes')).toBe(
       "cd '/tmp/hermes' && hermes --resume 'hermes-session'"
diff --git a/src/main/ai-vault/session-scanner.ts b/src/main/ai-vault/session-scanner.ts
index c730eac63858..2f5629f94c3e 100644
--- a/src/main/ai-vault/session-scanner.ts
+++ b/src/main/ai-vault/session-scanner.ts
@@ -240,7 +240,8 @@ async function parseSessionCandidates(args: {
           args.platform,
           args.executionHostId,
           args.parseStats,
-          args.antigravityWorkspaceResolver
+          args.antigravityWorkspaceResolver,
+          args.signal
         )
       )
     )
@@ -268,10 +269,17 @@ async function parseSessionCandidate(
   platform: NodeJS.Platform,
   executionHostId: ExecutionHostId,
   parseStats: SessionParseStats,
-  antigravityWorkspaceResolver?: AntigravityWorkspaceResolver
+  antigravityWorkspaceResolver?: AntigravityWorkspaceResolver,
+  signal?: AbortSignal
 ): Promise<SessionParseResult> {
   try {
-    let session = await parseAgentSessionFileCached(candidate, platform, parseStats)
+    let session = await parseAgentSessionFileCached(
+      candidate,
+      platform,
+      parseStats,
+      undefined,
+      signal
+    )
     if (session && candidate.antigravityHistoryPath && antigravityWorkspaceResolver) {
       session = await antigravityWorkspaceResolver.enrich(session, candidate.antigravityHistoryPath)
     }
diff --git a/src/main/ai-vault/session-transcript-every-agent-capture.test.ts b/src/main/ai-vault/session-transcript-every-agent-capture.test.ts
index 0d135cdb7e84..20b28fdb49be 100644
--- a/src/main/ai-vault/session-transcript-every-agent-capture.test.ts
+++ b/src/main/ai-vault/session-transcript-every-agent-capture.test.ts
@@ -20,18 +20,27 @@ vi.mock('./session-scanner-opencode-sqlite-worker-spawn', async () => {
     listOpenCode2SqliteSessionsViaWorker: (
       args: Parameters<typeof list2.listOpenCode2SqliteSessions>[0]
     ) => list2.listOpenCode2SqliteSessions(args),
+    listZcodeSqliteSessionsViaWorker: (
+      args: Parameters<typeof list.listOpenCodeSqliteSessions>[0]
+    ) => list.listOpenCodeSqliteSessions({ ...args, agent: 'zcode' }),
     parseOpenCodeSqliteSessionViaWorker: (
       args: Parameters<typeof parse.parseOpenCodeSqliteSession>[0]
     ) => parse.parseOpenCodeSqliteSession(args),
     parseOpenCode2SqliteSessionViaWorker: (
       args: Parameters<typeof parse2.parseOpenCode2SqliteSession>[0]
     ) => parse2.parseOpenCode2SqliteSession(args),
+    parseZcodeSqliteSessionViaWorker: (
+      args: Parameters<typeof parse.parseOpenCodeSqliteSession>[0]
+    ) => parse.parseOpenCodeSqliteSession({ ...args, agent: 'zcode' }),
     captureOpenCodeSqliteSessionViaWorker: (
       args: Parameters<typeof capture.captureOpenCodeSqliteSession>[0]
     ) => capture.captureOpenCodeSqliteSession(args),
     captureOpenCode2SqliteSessionViaWorker: (
       args: Parameters<typeof capture2.captureOpenCode2SqliteSession>[0]
-    ) => capture2.captureOpenCode2SqliteSession(args)
+    ) => capture2.captureOpenCode2SqliteSession(args),
+    captureZcodeSqliteSessionViaWorker: (
+      args: Parameters<typeof capture.captureOpenCodeSqliteSession>[0]
+    ) => capture.captureOpenCodeSqliteSession({ ...args, agent: 'zcode' })
   }
 })
 import { AI_VAULT_AGENTS, type AiVaultAgent } from '../../shared/ai-vault-types'
diff --git a/src/main/ai-vault/session-transcript-reader.ts b/src/main/ai-vault/session-transcript-reader.ts
index 8a5cd4e93e7b..f9eb4e91b110 100644
--- a/src/main/ai-vault/session-transcript-reader.ts
+++ b/src/main/ai-vault/session-transcript-reader.ts
@@ -160,6 +160,7 @@ export async function readWholeTranscript(args: {
   candidate: SessionFileCandidate
   platform: NodeJS.Platform
   stats?: TranscriptReadStats
+  signal?: AbortSignal
 }): Promise<AiVaultSession | null> {
   const { file } = args.candidate
   if (args.stats) {
@@ -169,7 +170,7 @@ export async function readWholeTranscript(args: {
   const channel = new TranscriptMessageChannel()
   channel.beginRead({ candidate: args.candidate, mode: 'replace', previousByteOffset: 0 })
   try {
-    const session = await parseAgentSessionFile(args.candidate, args.platform, channel)
+    const session = await parseAgentSessionFile(args.candidate, args.platform, channel, args.signal)
     channel.finishRead({ session, byteOffset: file.sizeBytes ?? 0, incomplete: false })
     return session
   } catch (error) {
diff --git a/src/main/artifacts/artifact-share-record-allocation.test.ts b/src/main/artifacts/artifact-share-record-allocation.test.ts
new file mode 100644
index 000000000000..489e0870dd4d
--- /dev/null
+++ b/src/main/artifacts/artifact-share-record-allocation.test.ts
@@ -0,0 +1,62 @@
+import { mkdtemp, mkdir, readFile, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, expect, it, vi } from 'vitest'
+import { getArtifactShareRecord } from './artifact-share-record-store'
+
+const createdPaths: string[] = []
+
+afterEach(async () => {
+  vi.restoreAllMocks()
+  await Promise.all(
+    createdPaths.splice(0).map((path) => rm(path, { recursive: true, force: true }))
+  )
+})
+
+it('constructs one record map when all ten thousand stored shares remain valid', async () => {
+  const userDataPath = await mkdtemp(join(tmpdir(), 'orca-artifact-record-allocation-'))
+  createdPaths.push(userDataPath)
+  const profileId = 'allocation-profile'
+  const profileDirectory = join(userDataPath, 'profiles', profileId)
+  await mkdir(profileDirectory, { recursive: true })
+  const recordsPath = join(profileDirectory, 'artifact-shares.json')
+  const scope = {
+    cloudUserId: 'user-a',
+    cloudProfileId: 'cloud-a',
+    cloudOrganizationId: 'org-a',
+    apiOrigin: 'https://share.onorca.dev'
+  }
+  const sourceKey = 'allocation-source-0'
+  const shares = Object.fromEntries(
+    Array.from({ length: 10_000 }, (_, index) => [
+      `allocation-source-${index}`,
+      {
+        ...scope,
+        slug: `artifact-${index}`,
+        editToken: 'synthetic-edit-token',
+        shareUrl: `https://share.onorca.dev/a/artifact-${index}`,
+        expiresAt: '2099-01-01T00:00:00.000Z',
+        savedAt: index
+      }
+    ])
+  )
+  const serialized = JSON.stringify({ version: 2, lifecycleGeneration: 7, shares })
+  await writeFile(recordsPath, serialized)
+  const fromEntries = Object.fromEntries
+  let recordMaps = 0
+  vi.spyOn(Object, 'fromEntries').mockImplementation((entries) => {
+    const result = fromEntries(entries)
+    if (Object.hasOwn(result, sourceKey)) {
+      recordMaps += 1
+    }
+    return result
+  })
+
+  expect(getArtifactShareRecord(profileId, userDataPath, sourceKey, scope)).toMatchObject({
+    slug: 'artifact-0',
+    editToken: 'synthetic-edit-token'
+  })
+
+  expect(recordMaps).toBe(1)
+  expect(await readFile(recordsPath, 'utf8')).toBe(serialized)
+})
diff --git a/src/main/artifacts/artifact-share-record-store.ts b/src/main/artifacts/artifact-share-record-store.ts
index a16ec19333ce..ac448fbc5641 100644
--- a/src/main/artifacts/artifact-share-record-store.ts
+++ b/src/main/artifacts/artifact-share-record-store.ts
@@ -94,7 +94,7 @@ function pruneRecords(
       ? unexpired.sort(compareRecordsNewestFirst).slice(0, MAX_ARTIFACT_SHARE_RECORDS)
       : unexpired
   return {
-    shares: Object.fromEntries(retained),
+    shares: retained.length === currentEntries.length ? shares : Object.fromEntries(retained),
     changed: retained.length !== currentEntries.length
   }
 }
diff --git a/src/main/automations/automation-dispatch-host-fence.test.ts b/src/main/automations/automation-dispatch-host-fence.test.ts
index a974ebb4ae04..1f28f5accd7b 100644
--- a/src/main/automations/automation-dispatch-host-fence.test.ts
+++ b/src/main/automations/automation-dispatch-host-fence.test.ts
@@ -10,17 +10,19 @@
  */
 
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import { mkdtempSync, rmSync } from 'node:fs'
+import { mkdtempSync } from 'node:fs'
 import { join } from 'node:path'
 import { tmpdir } from 'node:os'
 import type { Repo } from '../../shared/repo-types'
 import type { SshTarget } from '../../shared/ssh-types'
 import type { Automation } from '../../shared/automations-types'
 import { AUTOMATION_ORPHAN_ISSUES } from '../../shared/automation-list-scope'
+import { removeTreeSync } from '../../shared/windows-transient-lock-removal'
 import type { Store } from '../persistence'
 import { resolveAutomationRunTarget } from './run-target-resolution'
 import { AutomationService } from './service'
 import { installFakeAppEnvironment } from '../../../config/scripts/vitest-host-ports-setup'
+import { closeTestStores, createSqliteTestStore } from '../persistence-test-harness'
 
 const testState = { dir: '' }
 
@@ -40,7 +42,7 @@ async function createStore(): Promise<Store> {
   installFakeAppEnvironment({ getPath: () => testState.dir })
   const { Store: StoreClass, initDataPath } = await import('../persistence')
   initDataPath()
-  return new StoreClass()
+  return createSqliteTestStore(StoreClass, { dataFile: join(testState.dir, 'orca-data.json') })
 }
 
 /** The reachable shape: a runtime-owned id is derived, not minted per lifecycle. */
@@ -183,9 +185,10 @@ describe('scheduled dispatch fenced on the host the record captured', () => {
     vi.useFakeTimers()
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     vi.useRealTimers()
-    rmSync(testState.dir, { recursive: true, force: true })
+    removeTreeSync(testState.dir)
   })
 
   it('refuses the run once the same id carries a new registration', async () => {
diff --git a/src/main/automations/automation-dispatch-request.ts b/src/main/automations/automation-dispatch-request.ts
new file mode 100644
index 000000000000..348a1b9ecee9
--- /dev/null
+++ b/src/main/automations/automation-dispatch-request.ts
@@ -0,0 +1,154 @@
+import type { WebContents } from 'electron'
+import { isDeepStrictEqual } from 'node:util'
+import type { Automation, AutomationRun } from '../../shared/automations-types'
+import { getRepoExecutionHostId } from '../../shared/execution-host'
+import type { Store } from '../persistence'
+import type { AutomationRunWriter } from './automation-run-writer'
+import type { HeadlessAutomationDispatcher } from './headless-dispatch'
+import type { HeadlessAutomationDispatchContext } from './headless-dispatch-runner'
+import { runHeadlessAutomationDispatch } from './headless-dispatch-runner'
+import type { AutomationRunTargetResult } from './run-target-resolution'
+import { createAutomationDispatchToken } from './dispatch-tokens'
+import { NO_DISPATCH_HOST, sendRendererDispatch } from './dispatch-refusal'
+
+export type AutomationRendererChannel = Pick<WebContents, 'isDestroyed' | 'send'>
+
+export class AutomationDispatchCancelledError extends Error {}
+
+type DispatchContext = Pick<
+  HeadlessAutomationDispatchContext,
+  'runPrecheck' | 'markDispatchResult' | 'watchRun'
+> & {
+  store: Store
+  runs: AutomationRunWriter
+  isActive(): boolean
+  getRenderer(): AutomationRendererChannel | null
+  headlessDispatcher: HeadlessAutomationDispatcher | null
+  resolveTarget(automation: Automation): AutomationRunTargetResult
+}
+
+function definition(automation: Automation) {
+  const { lastRunAt: _last, updatedAt: _updated, nextRunAt: _next, ...configured } = automation
+  return configured
+}
+
+function destination(target: Extract<AutomationRunTargetResult, { ok: true }>) {
+  return {
+    cwd: target.cwd,
+    repoId: target.repo.id,
+    repoPath: target.repo.path,
+    host: getRepoExecutionHostId(target.repo),
+    setupId: target.setup?.id
+  }
+}
+
+/** Claim durably, then recheck everything that an acknowledgement wait can invalidate. */
+export async function requestAutomationDispatch(
+  ctx: DispatchContext,
+  automation: Automation,
+  run: AutomationRun,
+  expectedTarget: AutomationRunTargetResult
+): Promise<AutomationRun> {
+  const expectedDefinition = structuredClone(definition(automation))
+  const expectedDestination = expectedTarget.ok ? destination(expectedTarget) : undefined
+  const readRun = (): AutomationRun => {
+    if (!ctx.isActive()) {
+      throw new AutomationDispatchCancelledError(
+        'Orca stopped before this automation could launch.'
+      )
+    }
+    const current = ctx.store.listAutomationRuns(automation.id).find((entry) => entry.id === run.id)
+    if (!current || !ctx.store.listAutomations().some((entry) => entry.id === automation.id)) {
+      throw new AutomationDispatchCancelledError(
+        'The automation was removed before it could launch.'
+      )
+    }
+    return current
+  }
+  const resolveCurrentTarget = (): AutomationRunTargetResult => {
+    const current = ctx.store.listAutomations().find((entry) => entry.id === automation.id)
+    if (!current || !isDeepStrictEqual(expectedDefinition, definition(current))) {
+      return { ok: false, error: 'The automation changed before this run could launch.' }
+    }
+    const target = ctx.resolveTarget(current)
+    if (
+      target.ok &&
+      expectedDestination &&
+      !isDeepStrictEqual(expectedDestination, destination(target))
+    ) {
+      return {
+        ok: false,
+        error: 'The automation destination changed before this run could launch.'
+      }
+    }
+    return target
+  }
+  const refuse = (error: string) =>
+    ctx.runs.updateRun({
+      runId: run.id,
+      status: 'skipped_unavailable',
+      workspaceId: automation.workspaceId,
+      error
+    })
+  const returnDurable = async (current: AutomationRun) => {
+    await ctx.store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
+    return current
+  }
+
+  run = readRun()
+  if (run.status !== 'pending') {
+    return returnDurable(run)
+  }
+  let target = resolveCurrentTarget()
+  if (!target.ok || (!ctx.getRenderer() && !ctx.headlessDispatcher)) {
+    return refuse(target.ok ? NO_DISPATCH_HOST : target.error)
+  }
+  await ctx.runs.updateRun({
+    runId: run.id,
+    status: 'dispatching',
+    workspaceId: automation.workspaceId,
+    error: null
+  })
+
+  run = readRun()
+  if (run.status !== 'dispatching') {
+    return returnDurable(run)
+  }
+  target = resolveCurrentTarget()
+  if (!target.ok) {
+    return refuse(target.error)
+  }
+  const renderer = ctx.getRenderer()
+  if (renderer) {
+    return sendRendererDispatch(
+      renderer,
+      {
+        automation,
+        run,
+        dispatchToken: createAutomationDispatchToken(automation.id, run.id)
+      },
+      ctx.runs,
+      run
+    )
+  }
+  const dispatcher = ctx.headlessDispatcher
+  if (!dispatcher) {
+    return refuse(NO_DISPATCH_HOST)
+  }
+  return runHeadlessAutomationDispatch({
+    ...ctx,
+    automation,
+    run,
+    target,
+    dispatcher: (request) => {
+      if (readRun().status !== 'dispatching') {
+        throw new AutomationDispatchCancelledError('The run changed before its agent could launch.')
+      }
+      const latestTarget = resolveCurrentTarget()
+      if (!latestTarget.ok) {
+        throw new AutomationDispatchCancelledError(latestTarget.error)
+      }
+      return dispatcher({ ...request, target: latestTarget })
+    }
+  })
+}
diff --git a/src/main/automations/automation-owner-fencing.test.ts b/src/main/automations/automation-owner-fencing.test.ts
index 02e3419f38ae..14852c0267d9 100644
--- a/src/main/automations/automation-owner-fencing.test.ts
+++ b/src/main/automations/automation-owner-fencing.test.ts
@@ -1,3 +1,4 @@
+import { closeTestStores, createSqliteTestStore } from '../persistence-test-harness'
 /**
  * The desktop authority's end of the scoped-list and owner-fenced contracts:
  * a parameterless read still answers with everything it stores, a scoped read is
@@ -106,14 +107,15 @@ async function createStore() {
   installFakeAppEnvironment({ getPath: () => testState.dir })
   const { Store, initDataPath } = await import('../persistence')
   initDataPath()
-  return new Store()
+  return createSqliteTestStore(Store, { dataFile: join(testState.dir, 'orca-data.json') })
 }
 
 beforeEach(() => {
   testState.dir = mkdtempSync(join(tmpdir(), 'automation-fencing-'))
 })
 
-afterEach(() => {
+afterEach(async () => {
+  await closeTestStores()
   rmSync(testState.dir, { recursive: true, force: true })
 })
 
diff --git a/src/main/automations/automation-run-writer.test.ts b/src/main/automations/automation-run-writer.test.ts
index a149f28ea382..f6130fbf2234 100644
--- a/src/main/automations/automation-run-writer.test.ts
+++ b/src/main/automations/automation-run-writer.test.ts
@@ -5,20 +5,27 @@
  */
 import { describe, expect, it, vi } from 'vitest'
 import { createAutomationRunWriter } from './automation-run-writer'
-import { AutomationService } from './service'
+import { collectAutomationRunUsage } from './run-usage-collection'
+import { buildProfileStateCutoverFixture } from '../persistence/profile-state-cutover-fixture'
 import type { Store } from '../persistence'
-import type { Automation, AutomationRun } from '../../shared/automations-types'
 
 const SSH_SELECTOR = { kind: 'ssh', targetId: 'ssh-1' } as const
 
+const data = buildProfileStateCutoverFixture('/fixture')
+const automation = { ...data.automations[0], id: 'auto-1' }
+const run = { ...data.automationRuns[0], id: 'run-1', automationId: automation.id }
+
 function writerWith(selector: ReturnType<Store['automationChangeSelector']>) {
   const publish = vi.fn()
   const automationChangeSelector = vi.fn(() => selector)
   const store = {
-    createAutomationRun: vi.fn(() => ({ id: 'run-1', automationId: 'auto-1' }) as AutomationRun),
-    updateAutomationRun: vi.fn(() => ({ id: 'run-1', automationId: 'auto-1' }) as AutomationRun),
+    flushPendingOrThrowAsync: vi.fn().mockResolvedValue(undefined),
+    createAutomationRun: vi.fn(() => run),
+    updateAutomationRun: vi.fn(() => run),
+    recordRepeatedAutomationSkip: vi.fn(() => null),
+    advanceAutomationNextRun: vi.fn(() => automation),
     automationChangeSelector
-  } as unknown as Store
+  }
   return {
     publish,
     automationChangeSelector,
@@ -28,61 +35,68 @@ function writerWith(selector: ReturnType<Store['automationChangeSelector']>) {
 }
 
 describe('automation run writer publications', () => {
-  it('names the host a created run belongs to', () => {
+  it('waits for durable acknowledgement before publishing or returning a run', async () => {
+    const { store, writer, publish } = writerWith(SSH_SELECTOR)
+    const acknowledgement = Promise.withResolvers<void>()
+    vi.spyOn(store, 'flushPendingOrThrowAsync').mockReturnValue(acknowledgement.promise)
+    const completed = vi.fn()
+    const pending = writer.updateRun({ runId: 'run-1', status: 'dispatching' }).then(completed)
+    await Promise.resolve()
+    expect(publish).not.toHaveBeenCalled()
+    expect(completed).not.toHaveBeenCalled()
+    acknowledgement.resolve()
+    await pending
+    expect(publish).toHaveBeenCalledOnce()
+    expect(completed).toHaveBeenCalledOnce()
+  })
+
+  it('rejects a failed write without publishing success', async () => {
+    const { store, writer, publish } = writerWith(SSH_SELECTOR)
+    vi.spyOn(store, 'flushPendingOrThrowAsync').mockRejectedValue(new Error('disk full'))
+    await expect(writer.updateRun({ runId: 'run-1', status: 'completed' })).rejects.toThrow(
+      'disk full'
+    )
+    expect(publish).not.toHaveBeenCalled()
+  })
+
+  it('names the host a created run belongs to', async () => {
     const { writer, publish } = writerWith(SSH_SELECTOR)
-    writer.createRun({ id: 'auto-1' } as Automation, 0, 'scheduled')
+    await writer.createRun(automation, 0, 'scheduled')
     expect(publish).toHaveBeenCalledWith({ reason: 'run', selector: SSH_SELECTOR })
   })
 
-  it('resolves the host from the written run, which is all a dispatch result names', () => {
+  it('resolves the host from the written run, which is all a dispatch result names', async () => {
     const { writer, publish, automationChangeSelector } = writerWith(SSH_SELECTOR)
-    writer.updateRun({ runId: 'run-1', status: 'completed', usage: null })
+    await writer.updateRun({ runId: 'run-1', status: 'completed', usage: null })
     expect(automationChangeSelector).toHaveBeenCalledWith('auto-1')
     expect(publish).toHaveBeenCalledWith({ reason: 'run', selector: SSH_SELECTOR })
   })
 
-  it('keeps the usage reason on a usage-bearing write', () => {
+  it('keeps the usage reason on a usage-bearing write', async () => {
     const { writer, publish } = writerWith({ kind: 'self' })
-    writer.updateRun({
+    await writer.updateRun({
       runId: 'run-1',
       status: 'completed',
-      usage: { status: 'known' } as AutomationRun['usage']
+      usage: await collectAutomationRunUsage({
+        automation,
+        run,
+        claudeUsage: null,
+        codexUsage: null
+      })
     })
     expect(publish).toHaveBeenCalledWith({ reason: 'usage', selector: { kind: 'self' } })
   })
 
   // Over-broad beats silent: a subscriber must still hear that something changed.
-  it('falls back to the whole authority when the record can no longer be named', () => {
+  it('falls back to the whole authority when the record can no longer be named', async () => {
     const { writer, publish } = writerWith(null)
-    writer.createRun({ id: 'auto-1' } as Automation, 0, 'scheduled')
+    await writer.createRun(automation, 0, 'scheduled')
     expect(publish).toHaveBeenCalledWith({ reason: 'run' })
   })
 
-  it('does not project a selector nobody will hear', () => {
-    const automationChangeSelector = vi.fn(() => SSH_SELECTOR)
-    const store = {
-      createAutomationRun: vi.fn(() => ({ id: 'run-1', automationId: 'auto-1' }) as AutomationRun),
-      automationChangeSelector
-    } as unknown as Store
-    createAutomationRunWriter(store, null).createRun({ id: 'auto-1' } as Automation, 0, 'scheduled')
+  it('does not project a selector nobody will hear', async () => {
+    const { store, automationChangeSelector } = writerWith(SSH_SELECTOR)
+    await createAutomationRunWriter(store, null).createRun(automation, 0, 'scheduled')
     expect(automationChangeSelector).not.toHaveBeenCalled()
   })
-
-  // Why the renderer dispatch path no longer emits its own: the scoped event is
-  // published during the write, so it is queued before the reply the caller awaits.
-  it('publishes before markDispatchResult settles', async () => {
-    const publish = vi.fn()
-    const store = {
-      updateAutomationRun: vi.fn(
-        () => ({ id: 'run-1', automationId: 'auto-1', status: 'dispatched' }) as AutomationRun
-      ),
-      automationChangeSelector: vi.fn(() => SSH_SELECTOR)
-    } as unknown as Store
-    const service = new AutomationService(store, { onAutomationsChanged: publish })
-
-    const settled = service.markDispatchResult({ runId: 'run-1', status: 'dispatched' })
-
-    expect(publish).toHaveBeenCalledWith({ reason: 'run', selector: SSH_SELECTOR })
-    await settled
-  })
 })
diff --git a/src/main/automations/automation-run-writer.ts b/src/main/automations/automation-run-writer.ts
index ef08c84de49a..1f813a62d0cc 100644
--- a/src/main/automations/automation-run-writer.ts
+++ b/src/main/automations/automation-run-writer.ts
@@ -2,18 +2,31 @@ import type { Store } from '../persistence'
 import type { PublishAutomationsChanged } from '../../shared/runtime-client-events'
 import type { AutomationDispatchResult, AutomationRun } from '../../shared/automations-types'
 
+type DurableWrite<T extends (...args: never[]) => unknown> = (
+  ...args: Parameters<T>
+) => Promise<ReturnType<T>>
+
 export type AutomationRunWriter = {
-  createRun: Store['createAutomationRun']
-  updateRun: Store['updateAutomationRun']
+  createRun: DurableWrite<Store['createAutomationRun']>
+  updateRun: DurableWrite<Store['updateAutomationRun']>
   /** Null when nothing could be folded — the caller then writes an ordinary run. */
-  repeatSkip: Store['recordRepeatedAutomationSkip']
+  repeatSkip: DurableWrite<Store['recordRepeatedAutomationSkip']>
+  advanceNextRun: DurableWrite<Store['advanceAutomationNextRun']>
 }
 
 /** Wraps run persistence so every committed write announces itself. Clients with
  *  the Automations page closed — or none attached at all — have no other way to
  *  learn that a run progressed, so the event must follow the write, not a render. */
 export function createAutomationRunWriter(
-  store: Store,
+  store: Pick<
+    Store,
+    | 'createAutomationRun'
+    | 'updateAutomationRun'
+    | 'recordRepeatedAutomationSkip'
+    | 'advanceAutomationNextRun'
+    | 'automationChangeSelector'
+    | 'flushPendingOrThrowAsync'
+  >,
   publish: PublishAutomationsChanged | null
 ): AutomationRunWriter {
   // A run write never moves the record, so its own host is the whole publication.
@@ -26,19 +39,27 @@ export function createAutomationRunWriter(
     publish({ reason, ...(selector ? { selector } : {}) })
   }
   return {
-    createRun: (automation, scheduledFor, trigger): AutomationRun => {
+    advanceNextRun: async (id, now) => {
+      const automation = store.advanceAutomationNextRun(id, now)
+      await store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
+      return automation
+    },
+    createRun: async (automation, scheduledFor, trigger): Promise<AutomationRun> => {
       const run = store.createAutomationRun(automation, scheduledFor, trigger)
+      await store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
       announce(automation.id, 'run')
       return run
     },
-    updateRun: (result: AutomationDispatchResult): AutomationRun => {
+    updateRun: async (result: AutomationDispatchResult): Promise<AutomationRun> => {
       const run = store.updateAutomationRun(result)
+      await store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
       announce(run.automationId, result.usage ? 'usage' : 'run')
       return run
     },
-    repeatSkip: (automationId, error, scheduledFor): AutomationRun | null => {
+    repeatSkip: async (automationId, error, scheduledFor): Promise<AutomationRun | null> => {
       const run = store.recordRepeatedAutomationSkip(automationId, error, scheduledFor)
       if (run) {
+        await store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
         announce(automationId, 'run')
       }
       return run
diff --git a/src/main/automations/automation-skip-coalescing.test.ts b/src/main/automations/automation-skip-coalescing.test.ts
index 5ab58c1e8315..089a0dab196c 100644
--- a/src/main/automations/automation-skip-coalescing.test.ts
+++ b/src/main/automations/automation-skip-coalescing.test.ts
@@ -6,12 +6,19 @@
  */
 
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { mkdtempSync } from 'node:fs'
 import { join } from 'node:path'
 import { tmpdir } from 'node:os'
 import type { Repo } from '../../shared/repo-types'
 import type { Automation } from '../../shared/automations-types'
+import { removeTreeSync } from '../../shared/windows-transient-lock-removal'
 import type { Store } from '../persistence'
+import {
+  closeTestStores,
+  createSqliteTestStore,
+  readPersistedStateJson,
+  writePersistedStateJson
+} from '../persistence-test-harness'
 import { AutomationService } from './service'
 import { installFakeAppEnvironment } from '../../../config/scripts/vitest-host-ports-setup'
 
@@ -33,7 +40,7 @@ async function createStore(): Promise<Store> {
   installFakeAppEnvironment({ getPath: () => testState.dir })
   const { Store: StoreClass, initDataPath } = await import('../persistence')
   initDataPath()
-  return new StoreClass()
+  return createSqliteTestStore(StoreClass, { dataFile: join(testState.dir, 'orca-data.json') })
 }
 
 const makeRepo = (): Repo => ({
@@ -66,8 +73,10 @@ async function seedUnresolvableAutomation(): Promise<{ store: Store; automation:
     rrule: 'FREQ=DAILY;BYHOUR=9;BYMINUTE=0',
     dtstart: new Date('2026-05-12T00:00:00').getTime()
   })
+  seed.flushOrThrow()
+  await seed.freezeWritesAsync()
   const file = join(testState.dir, 'orca-data.json')
-  const state = JSON.parse(readFileSync(file, 'utf-8'))
+  const state = JSON.parse(readPersistedStateJson(file))
   state.automations[0].runContext = {
     kind: 'workspace-run',
     projectId: 'project-1',
@@ -76,7 +85,7 @@ async function seedUnresolvableAutomation(): Promise<{ store: Store; automation:
     repoId: 'r1',
     path: '/repo'
   }
-  writeFileSync(file, JSON.stringify(state, null, 2), 'utf-8')
+  writePersistedStateJson(file, JSON.stringify(state))
   return { store: await createStore(), automation }
 }
 
@@ -132,9 +141,10 @@ describe('repeated skipped_unavailable coalescing', () => {
     vi.useFakeTimers()
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     vi.useRealTimers()
-    rmSync(testState.dir, { recursive: true, force: true })
+    removeTreeSync(testState.dir)
   })
 
   it('folds every later refusal into the first record instead of writing a row each', async () => {
@@ -288,10 +298,10 @@ describe('repeated skipped_unavailable coalescing', () => {
     const scheduledFor = Date.now()
     seedSkip(store, automation, scheduledFor, SETUP_GONE)
     store.recordRepeatedAutomationSkip(automation.id, SETUP_GONE, scheduledFor + 1000)
-    store.flush()
+    store.flushOrThrow()
+    await store.freezeWritesAsync()
 
-    const { Store: StoreClass } = await import('../persistence')
-    const reloaded = new StoreClass()
+    const reloaded = await createStore()
 
     expect(reloaded.listAutomationRuns(automation.id)[0]?.occurrenceCount).toBe(2)
     expect(
diff --git a/src/main/automations/automation-update-host-retarget.test.ts b/src/main/automations/automation-update-host-retarget.test.ts
index d52bd29e0c3a..62c2b000d6fd 100644
--- a/src/main/automations/automation-update-host-retarget.test.ts
+++ b/src/main/automations/automation-update-host-retarget.test.ts
@@ -1,3 +1,4 @@
+import { closeTestStores, createSqliteTestStore } from '../persistence-test-harness'
 /**
  * An update may not move a record to another host unless it was asked to.
  *
@@ -123,7 +124,7 @@ async function createStore() {
   installFakeAppEnvironment({ getPath: () => testState.dir })
   const { Store, initDataPath } = await import('../persistence')
   initDataPath()
-  return new Store()
+  return createSqliteTestStore(Store, { dataFile: join(testState.dir, 'orca-data.json') })
 }
 
 type Store = Awaited<ReturnType<typeof createStore>>
@@ -146,7 +147,8 @@ beforeEach(() => {
   testState.dir = mkdtempSync(join(tmpdir(), 'automation-retarget-'))
 })
 
-afterEach(() => {
+afterEach(async () => {
+  await closeTestStores()
   rmSync(testState.dir, { recursive: true, force: true })
   vi.resetModules()
 })
diff --git a/src/main/automations/automation-worker-durability.test.ts b/src/main/automations/automation-worker-durability.test.ts
new file mode 100644
index 000000000000..22d13899e3b6
--- /dev/null
+++ b/src/main/automations/automation-worker-durability.test.ts
@@ -0,0 +1,245 @@
+import { describe, expect, it, vi } from 'vitest'
+import { AutomationService } from './service'
+import type { Store } from '../persistence'
+import {
+  createWorkerMaintenanceFixture,
+  maintenanceBarrier
+} from '../persistence/loading-store/profile-state-maintenance-fixture'
+
+vi.mock('../telemetry/client', () => ({ track: vi.fn() }))
+vi.mock('../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: () => ({ nth_repo_added: 2 })
+}))
+vi.mock('../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: () => ({ hosts: [] }),
+  sshConfigHostsToTargets: () => []
+}))
+
+async function fixture() {
+  const fixture = await createWorkerMaintenanceFixture()
+  for (const automation of fixture.store.listAutomations()) {
+    fixture.store.updateAutomation(automation.id, { enabled: false })
+  }
+  const automation = fixture.store.createAutomation({
+    name: 'Durable run',
+    prompt: 'Check the project',
+    agentId: 'claude',
+    projectId: 'repo-local',
+    workspaceMode: 'existing',
+    workspaceId: 'repo-local::/fixture/local',
+    timezone: 'UTC',
+    rrule: 'FREQ=HOURLY;BYMINUTE=0',
+    dtstart: Date.now() - 60_000
+  })
+  await fixture.store.flushPendingOrThrowAsync()
+  return { ...fixture, automation }
+}
+
+const launch = { workspaceId: 'repo-local::/fixture/local', terminalSessionId: 'run-tab' }
+
+function blockAcknowledgement(store: Store, index: number) {
+  const gate = maintenanceBarrier()
+  const blocked = maintenanceBarrier()
+  const flush = store.flushPendingOrThrowAsync.bind(store)
+  let calls = 0
+  vi.spyOn(store, 'flushPendingOrThrowAsync').mockImplementation(async (options) => {
+    calls += 1
+    if (calls === index) {
+      blocked.resolve()
+      await gate.promise
+    }
+    await flush(options)
+  })
+  return { blocked: blocked.promise, release: gate.resolve }
+}
+
+describe('automation background writer durability', () => {
+  it('claims a shared occurrence once when callers await the same pending row', async () => {
+    vi.spyOn(Date, 'now').mockReturnValue(1_800_000_000_000)
+    const { store, automation } = await fixture()
+    const dispatcher = vi.fn(async () => launch)
+    const service = new AutomationService(store, { headlessDispatcher: dispatcher })
+    try {
+      const runs = await Promise.all([service.runNow(automation.id), service.runNow(automation.id)])
+      expect(new Set(runs.map((run) => run.id)).size).toBe(1)
+      expect(dispatcher).toHaveBeenCalledOnce()
+    } finally {
+      service.stop()
+    }
+  })
+
+  it('persists dispatch intent before starting external work', async () => {
+    const { store, automation, readState } = await fixture()
+    const gate = maintenanceBarrier()
+    const flush = store.flushPendingOrThrowAsync.bind(store)
+    vi.spyOn(store, 'flushPendingOrThrowAsync').mockImplementationOnce(async (options) => {
+      await gate.promise
+      await flush(options)
+    })
+    const dispatcher = vi.fn(async () => {
+      expect(readState().automationRuns).toContainEqual(
+        expect.objectContaining({ automationId: automation.id, status: 'dispatching' })
+      )
+      return launch
+    })
+    const service = new AutomationService(store, { headlessDispatcher: dispatcher })
+    try {
+      const run = service.runNow(automation.id)
+      await Promise.resolve()
+      expect(dispatcher).not.toHaveBeenCalled()
+      gate.resolve()
+      await expect(run).resolves.toMatchObject({ status: 'dispatched' })
+      expect(dispatcher).toHaveBeenCalledOnce()
+    } finally {
+      service.stop()
+    }
+  })
+
+  it('never dispatches when the writer refuses the durable acknowledgement', async () => {
+    const { store, automation } = await fixture()
+    vi.spyOn(store, 'flushPendingOrThrowAsync').mockRejectedValueOnce(new Error('disk full'))
+    const dispatcher = vi.fn(async () => launch)
+    const service = new AutomationService(store, { headlessDispatcher: dispatcher })
+    try {
+      await expect(service.runNow(automation.id)).rejects.toThrow('disk full')
+      expect(dispatcher).not.toHaveBeenCalled()
+    } finally {
+      service.stop()
+    }
+  })
+
+  it.each([
+    ['dispatching', 1],
+    ['dispatched', 1],
+    ['completed', 1],
+    ['dispatching', 120_001],
+    ['dispatched', 120_001],
+    ['completed', 120_001]
+  ] as const)(
+    'preserves a durable %s occurrence after %s ms when next-run advancement was interrupted',
+    async (status, lateness) => {
+      const clock = vi.spyOn(Date, 'now').mockReturnValue(1_800_000_000_000)
+      const { store, automation, readState } = await fixture()
+      store.updateAutomation(automation.id, { missedRunGraceMinutes: 0 })
+      const dueAt = automation.nextRunAt
+      const run = store.createAutomationRun(automation, dueAt)
+      store.updateAutomationRun({ runId: run.id, status })
+      await store.flushPendingOrThrowAsync()
+      clock.mockReturnValue(dueAt + lateness)
+      const dispatcher = vi.fn(async () => launch)
+      const service = new AutomationService(store, { headlessDispatcher: dispatcher })
+      try {
+        service.start()
+        await vi.waitFor(() => {
+          const stored = readState().automations.find(
+            (entry: { id: string }) => entry.id === automation.id
+          )
+          expect(stored.nextRunAt).toBeGreaterThan(dueAt + lateness)
+        })
+        expect(dispatcher).not.toHaveBeenCalled()
+        expect(store.listAutomationRuns(automation.id)).toHaveLength(1)
+        expect(store.listAutomationRuns(automation.id)[0].status).toBe(status)
+      } finally {
+        service.stop()
+      }
+    }
+  )
+
+  it.each([1, 2])('cancels a pending dispatch stopped during acknowledgement %s', async (index) => {
+    const { store, automation } = await fixture()
+    const acknowledgement = blockAcknowledgement(store, index)
+    const dispatcher = vi.fn(async () => launch)
+    const service = new AutomationService(store, { headlessDispatcher: dispatcher })
+    const pending = service.runNow(automation.id)
+    const rejected = expect(pending).rejects.toThrow('stopped before')
+    await acknowledgement.blocked
+    service.stop()
+    acknowledgement.release()
+    await rejected
+    expect(dispatcher).not.toHaveBeenCalled()
+  })
+
+  it('does not resurrect or dispatch an automation deleted during its intent acknowledgement', async () => {
+    const { store, automation, readState } = await fixture()
+    const acknowledgement = blockAcknowledgement(store, 2)
+    const dispatcher = vi.fn(async () => launch)
+    const service = new AutomationService(store, { headlessDispatcher: dispatcher })
+    try {
+      const pending = service.runNow(automation.id)
+      const rejected = expect(pending).rejects.toThrow('removed before')
+      await acknowledgement.blocked
+      store.deleteAutomation(automation.id)
+      acknowledgement.release()
+      await rejected
+      expect(dispatcher).not.toHaveBeenCalled()
+      expect(
+        readState().automationRuns.some(
+          (run: { automationId: string }) => run.automationId === automation.id
+        )
+      ).toBe(false)
+    } finally {
+      service.stop()
+    }
+  })
+
+  it.each([1, 2])('refuses changed instructions during acknowledgement %s', async (index) => {
+    const { store, automation } = await fixture()
+    const acknowledgement = blockAcknowledgement(store, index)
+    const dispatcher = vi.fn(async () => launch)
+    const service = new AutomationService(store, { headlessDispatcher: dispatcher })
+    try {
+      const pending = service.runNow(automation.id)
+      await acknowledgement.blocked
+      store.updateAutomation(automation.id, { prompt: 'Different instructions' })
+      acknowledgement.release()
+      await expect(pending).resolves.toMatchObject({
+        status: 'skipped_unavailable',
+        error: expect.stringContaining('changed before')
+      })
+      expect(dispatcher).not.toHaveBeenCalled()
+    } finally {
+      service.stop()
+    }
+  })
+
+  it.each([1, 2])('refuses a moved execution host during acknowledgement %s', async (index) => {
+    const { store, automation } = await fixture()
+    const acknowledgement = blockAcknowledgement(store, index)
+    const dispatcher = vi.fn(async () => launch)
+    const service = new AutomationService(store, { headlessDispatcher: dispatcher })
+    try {
+      const pending = service.runNow(automation.id)
+      await acknowledgement.blocked
+      store.updateRepo('repo-local', { executionHostId: 'runtime:other-host' })
+      acknowledgement.release()
+      await expect(pending).resolves.toMatchObject({ status: 'skipped_unavailable' })
+      expect(dispatcher).not.toHaveBeenCalled()
+    } finally {
+      service.stop()
+    }
+  })
+
+  it.each(['disconnect', 'replacement'] as const)(
+    'refuses an unready renderer after %s during acknowledgement',
+    async (change) => {
+      const { store, automation } = await fixture()
+      const acknowledgement = blockAcknowledgement(store, 2)
+      const renderer = { isDestroyed: () => false, send: vi.fn() }
+      const replacement = { isDestroyed: () => false, send: vi.fn() }
+      const service = new AutomationService(store)
+      service.setWebContents(renderer)
+      service.setRendererReady()
+      try {
+        const pending = service.runNow(automation.id)
+        await acknowledgement.blocked
+        service.setWebContents(change === 'disconnect' ? null : replacement)
+        acknowledgement.release()
+        await expect(pending).resolves.toMatchObject({ status: 'skipped_unavailable' })
+        expect(renderer.send).not.toHaveBeenCalled()
+        expect(replacement.send).not.toHaveBeenCalled()
+      } finally {
+        service.stop()
+      }
+    }
+  )
+})
diff --git a/src/main/automations/automation-workspace-host-attribution.test.ts b/src/main/automations/automation-workspace-host-attribution.test.ts
index e5d66c27dc27..326de8fad23b 100644
--- a/src/main/automations/automation-workspace-host-attribution.test.ts
+++ b/src/main/automations/automation-workspace-host-attribution.test.ts
@@ -1,3 +1,4 @@
+import { closeTestStores, createSqliteTestStore } from '../persistence-test-harness'
 /**
  * A folder workspace can pin its execution host while its repo stays local.
  * The desktop authority used to project only the repo, so those records listed
@@ -119,14 +120,15 @@ async function createStore(
   installFakeAppEnvironment({ getPath: () => testState.dir })
   const { Store, initDataPath } = await import('../persistence')
   initDataPath()
-  return new Store()
+  return createSqliteTestStore(Store, { dataFile: join(testState.dir, 'orca-data.json') })
 }
 
 beforeEach(() => {
   testState.dir = mkdtempSync(join(tmpdir(), 'automation-workspace-host-'))
 })
 
-afterEach(() => {
+afterEach(async () => {
+  await closeTestStores()
   rmSync(testState.dir, { recursive: true, force: true })
 })
 
@@ -218,7 +220,8 @@ describe('dispatch refused for an ambiguous workspace host', () => {
     vi.useFakeTimers()
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     vi.useRealTimers()
     rmSync(testState.dir, { recursive: true, force: true })
   })
diff --git a/src/main/automations/automation-zero-grace-tick-latency.test.ts b/src/main/automations/automation-zero-grace-tick-latency.test.ts
index 4639a8728875..94020e03bef9 100644
--- a/src/main/automations/automation-zero-grace-tick-latency.test.ts
+++ b/src/main/automations/automation-zero-grace-tick-latency.test.ts
@@ -1,3 +1,4 @@
+import { closeTestStores, createSqliteTestStore } from '../persistence-test-harness'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { mkdtempSync, rmSync } from 'node:fs'
 import { join } from 'node:path'
@@ -24,7 +25,7 @@ async function createStore() {
   installFakeAppEnvironment({ getPath: () => testState.dir })
   const { Store, initDataPath } = await import('../persistence')
   initDataPath()
-  return new Store()
+  return createSqliteTestStore(Store, { dataFile: join(testState.dir, 'orca-data.json') })
 }
 
 const makeRepo = (overrides: Partial<Repo> = {}): Repo => ({
@@ -42,7 +43,8 @@ describe('AutomationService zero-grace tick latency', () => {
     vi.useFakeTimers()
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     vi.useRealTimers()
     rmSync(testState.dir, { recursive: true, force: true })
   })
@@ -76,7 +78,11 @@ describe('AutomationService zero-grace tick latency', () => {
     service.setWebContents({ isDestroyed: () => false, send: vi.fn() })
     service.start()
     service.setRendererReady()
-    await vi.advanceTimersByTimeAsync(0)
+    await vi.waitFor(() => {
+      if (store.listAutomations().some((automation) => automation.nextRunAt <= at)) {
+        throw new Error('Automation evaluation is still saving its next occurrence')
+      }
+    })
     service.stop()
   }
 
diff --git a/src/main/automations/dispatch-refusal.test.ts b/src/main/automations/dispatch-refusal.test.ts
index 233deb3e7827..27179f1cf56d 100644
--- a/src/main/automations/dispatch-refusal.test.ts
+++ b/src/main/automations/dispatch-refusal.test.ts
@@ -59,13 +59,14 @@ function makeRunWriter(foldsRepeat: boolean): {
   const created: string[] = []
   const updated: { status: string; error?: string | null }[] = []
   const writer: AutomationRunWriter = {
-    repeatSkip: () => (foldsRepeat ? makeRun('folded') : null),
-    createRun: () => {
+    advanceNextRun: async () => brokenAutomation,
+    repeatSkip: async () => (foldsRepeat ? makeRun('folded') : null),
+    createRun: async () => {
       const run = makeRun(`run-${created.length + 1}`)
       created.push(run.id)
       return run
     },
-    updateRun: (args) => {
+    updateRun: async (args) => {
       updated.push({ status: args.status, error: args.error })
       return { ...makeRun(args.runId), status: args.status, error: args.error ?? null }
     }
@@ -78,11 +79,11 @@ describe('recordUnevaluableAutomation', () => {
     vi.restoreAllMocks()
   })
 
-  it('writes one run and logs once when the record is newly broken', () => {
+  it('writes one run and logs once when the record is newly broken', async () => {
     const logged = vi.spyOn(console, 'error').mockImplementation(() => {})
     const { writer, created, updated } = makeRunWriter(false)
 
-    recordUnevaluableAutomation({
+    await recordUnevaluableAutomation({
       runs: writer,
       automation: brokenAutomation,
       error: new Error('Invalid cron day of month.')
@@ -95,12 +96,12 @@ describe('recordUnevaluableAutomation', () => {
 
   // The record is retried every tick on purpose, so a repaired schedule resumes on its own.
   // The fold is what keeps that from writing a row, and logging, once per tick forever.
-  it('stays silent on a record it has already reported', () => {
+  it('stays silent on a record it has already reported', async () => {
     const logged = vi.spyOn(console, 'error').mockImplementation(() => {})
     const { writer, created } = makeRunWriter(true)
 
     for (let tick = 0; tick < 5; tick += 1) {
-      recordUnevaluableAutomation({
+      await recordUnevaluableAutomation({
         runs: writer,
         automation: brokenAutomation,
         error: new Error('Invalid cron day of month.')
diff --git a/src/main/automations/dispatch-refusal.ts b/src/main/automations/dispatch-refusal.ts
index 4a5fffa1b16b..286abb2f2528 100644
--- a/src/main/automations/dispatch-refusal.ts
+++ b/src/main/automations/dispatch-refusal.ts
@@ -43,17 +43,17 @@ export function describeScheduledRefusal(input: {
  * and doc:94 asks for both. Never dispatches: the reason is the one the
  * scheduler would have written for the same record.
  */
-export function recordRefusedAutomationRun(input: {
+export async function recordRefusedAutomationRun(input: {
   store: Store
   runs: AutomationRunWriter
   automation: Automation
   allowRemoteHostScheduling: boolean
-}): void {
+}): Promise<void> {
   const target = resolveAutomationRunTarget(input.store, input.automation, {
     allowRemoteHostScheduling: input.allowRemoteHostScheduling
   })
-  const run = input.runs.createRun(input.automation, Date.now(), 'manual')
-  input.runs.updateRun({
+  const run = await input.runs.createRun(input.automation, Date.now(), 'manual')
+  await input.runs.updateRun({
     runId: run.id,
     status: 'skipped_unavailable',
     workspaceId: input.automation.workspaceId,
@@ -66,21 +66,24 @@ export function recordRefusedAutomationRun(input: {
  * stalled. Folds on the fixed sentence and the unchanged nextRunAt, so a record that stays
  * broken writes one row rather than one per tick, and never throws back into the tick.
  */
-export function recordUnevaluableAutomation(input: {
+export async function recordUnevaluableAutomation(input: {
   runs: AutomationRunWriter
   automation: Automation
   error: unknown
-}): void {
+}): Promise<void> {
   const { automation } = input
   try {
     // nextRunAt deliberately stays put: the record is retried so a repaired schedule resumes
     // on its own. The fold is what keeps that from writing a row — and logging — every tick.
-    if (input.runs.repeatSkip(automation.id, UNEVALUABLE_SCHEDULE, automation.nextRunAt)) {
+    if (await input.runs.repeatSkip(automation.id, UNEVALUABLE_SCHEDULE, automation.nextRunAt)) {
       return
     }
     console.error('[automations] failed to evaluate automation:', automation.id, input.error)
-    const run = input.runs.createRun(automation, automation.nextRunAt)
-    input.runs.updateRun({
+    const run = await input.runs.createRun(automation, automation.nextRunAt)
+    if (run.status !== 'pending') {
+      return
+    }
+    await input.runs.updateRun({
       runId: run.id,
       status: 'skipped_unavailable',
       workspaceId: automation.workspaceId,
@@ -101,12 +104,12 @@ export function recordUnevaluableAutomation(input: {
  * Sends the dispatch request through the renderer channel, closing the run out as
  * `dispatch_failed` when the send throws — a failed send is not an unreadable schedule.
  */
-export function sendRendererDispatch(
+export async function sendRendererDispatch(
   channel: Pick<WebContents, 'send'> | null,
   payload: AutomationDispatchRequest,
   runs: AutomationRunWriter,
   run: AutomationRun
-): AutomationRun {
+): Promise<AutomationRun> {
   try {
     channel?.send('automations:dispatchRequested', payload)
     return run
@@ -153,13 +156,16 @@ export function missedBeyondGrace(input: {
   return input.now - input.scheduledFor > graceMs + jitterMs
 }
 
-export function recordMissedRun(input: {
+export async function recordMissedRun(input: {
   runs: AutomationRunWriter
   automation: Automation
   scheduledFor: number
-}): void {
-  const missed = input.runs.createRun(input.automation, input.scheduledFor)
-  input.runs.updateRun({
+}): Promise<void> {
+  const missed = await input.runs.createRun(input.automation, input.scheduledFor)
+  if (missed.status !== 'pending') {
+    return
+  }
+  await input.runs.updateRun({
     runId: missed.id,
     status: 'skipped_missed',
     workspaceId: input.automation.workspaceId,
diff --git a/src/main/automations/headless-dispatch-durability.test.ts b/src/main/automations/headless-dispatch-durability.test.ts
new file mode 100644
index 000000000000..ea5403801e0f
--- /dev/null
+++ b/src/main/automations/headless-dispatch-durability.test.ts
@@ -0,0 +1,107 @@
+import { describe, expect, it, vi } from 'vitest'
+import { buildProfileStateCutoverFixture } from '../persistence/profile-state-cutover-fixture'
+import type { AutomationRun } from '../../shared/automations-types'
+import type { HeadlessAutomationDispatchLaunch } from './headless-dispatch'
+import { runHeadlessAutomationDispatch } from './headless-dispatch-runner'
+
+function fixture(launch: HeadlessAutomationDispatchLaunch) {
+  const state = buildProfileStateCutoverFixture('/fixture')
+  const automation = { ...state.automations[0], precheck: null }
+  const run: AutomationRun = {
+    ...state.automationRuns[0],
+    automationId: automation.id,
+    status: 'dispatching'
+  }
+  const dispatched: AutomationRun = { ...run, ...launch, status: 'dispatched' }
+  return {
+    automation,
+    run,
+    target: { ok: true as const, cwd: state.repos[0].path, repo: state.repos[0] },
+    dispatcher: vi.fn(async () => launch),
+    runs: {
+      createRun: vi.fn(async () => run),
+      updateRun: vi.fn(async () => dispatched),
+      repeatSkip: vi.fn(async () => null),
+      advanceNextRun: vi.fn(async () => automation)
+    },
+    runPrecheck: vi.fn(async () => null),
+    markDispatchResult: vi.fn(async () => dispatched),
+    watchRun: vi.fn()
+  }
+}
+
+const terminal = {
+  workspaceId: 'launched-workspace',
+  terminalSessionId: 'launched-tab',
+  terminalPaneKey: 'launched-pane',
+  terminalPtyId: 'launched-pty'
+}
+
+describe('headless automation observation during persistence', () => {
+  it('handles an early completion rejection while the dispatched write is stalled', async () => {
+    const completion = Promise.withResolvers<never>()
+    const acknowledgement = Promise.withResolvers<AutomationRun>()
+    const context = fixture({ ...terminal, completion: completion.promise })
+    context.runs.updateRun.mockReturnValueOnce(acknowledgement.promise)
+    const pending = runHeadlessAutomationDispatch(context)
+    await vi.waitFor(() => expect(context.runs.updateRun).toHaveBeenCalledOnce())
+    completion.reject(new Error('agent exited early'))
+    await vi.waitFor(() =>
+      expect(context.markDispatchResult).toHaveBeenCalledWith({
+        runId: context.run.id,
+        status: 'dispatch_failed',
+        ...terminal,
+        workspaceDisplayName: null,
+        error: 'agent exited early'
+      })
+    )
+    acknowledgement.resolve({ ...context.run, ...terminal, status: 'dispatched' })
+    await pending
+  })
+
+  it('starts terminal observation even when the dispatched write fails after launch', async () => {
+    const context = fixture(terminal)
+    const failure = new Error('disk full')
+    context.runs.updateRun.mockRejectedValueOnce(failure)
+    await expect(runHeadlessAutomationDispatch(context)).rejects.toBe(failure)
+    expect(context.watchRun).toHaveBeenCalledExactlyOnceWith(
+      expect.objectContaining({
+        ...terminal,
+        status: 'dispatched'
+      })
+    )
+    expect(context.runs.updateRun).toHaveBeenCalledExactlyOnceWith(
+      expect.objectContaining({
+        ...terminal,
+        status: 'dispatched'
+      })
+    )
+  })
+
+  it('keeps receiving completion after the launched run fails to persist', async () => {
+    const completion = Promise.withResolvers<{ status: 'completed' }>()
+    const context = fixture({ ...terminal, completion: completion.promise })
+    context.runs.updateRun.mockRejectedValueOnce(new Error('writer unavailable'))
+    await expect(runHeadlessAutomationDispatch(context)).rejects.toThrow('writer unavailable')
+    completion.resolve({ status: 'completed' })
+    await vi.waitFor(() =>
+      expect(context.markDispatchResult).toHaveBeenCalledWith(
+        expect.objectContaining({ ...terminal, status: 'completed' })
+      )
+    )
+    expect(context.runs.updateRun).toHaveBeenCalledOnce()
+  })
+
+  it('records an actual launch rejection as dispatch failure', async () => {
+    const context = fixture(terminal)
+    context.dispatcher.mockRejectedValueOnce(new Error('shell unavailable'))
+    await runHeadlessAutomationDispatch(context)
+    expect(context.runs.updateRun).toHaveBeenCalledExactlyOnceWith({
+      runId: context.run.id,
+      status: 'dispatch_failed',
+      workspaceId: context.automation.workspaceId,
+      error: 'shell unavailable'
+    })
+    expect(context.watchRun).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/main/automations/headless-dispatch-runner.ts b/src/main/automations/headless-dispatch-runner.ts
index 8d4e3aed290d..5a0ed60582cd 100644
--- a/src/main/automations/headless-dispatch-runner.ts
+++ b/src/main/automations/headless-dispatch-runner.ts
@@ -8,7 +8,10 @@ import {
   didAutomationPrecheckPass,
   formatAutomationPrecheckFailure
 } from '../../shared/automation-precheck'
-import type { HeadlessAutomationDispatcher } from './headless-dispatch'
+import type {
+  HeadlessAutomationDispatcher,
+  HeadlessAutomationDispatchLaunch
+} from './headless-dispatch'
 import type { AutomationRunTargetResult } from './run-target-resolution'
 import type { AutomationRunWriter } from './automation-run-writer'
 
@@ -42,47 +45,9 @@ export async function runHeadlessAutomationDispatch(
       error: formatAutomationPrecheckFailure(precheckResult)
     })
   }
+  let launch: HeadlessAutomationDispatchLaunch
   try {
-    const launch = await ctx.dispatcher({ automation, run, target })
-    const launchRunTarget = {
-      workspaceId: launch.workspaceId,
-      workspaceDisplayName: launch.workspaceDisplayName ?? null,
-      terminalSessionId: launch.terminalSessionId,
-      terminalPaneKey: launch.terminalPaneKey ?? null,
-      terminalPtyId: launch.terminalPtyId ?? null
-    }
-    const updated = runs.updateRun({
-      runId: run.id,
-      status: 'dispatched',
-      ...launchRunTarget,
-      error: null
-    })
-    if (!launch.completion) {
-      // Why: a dispatcher that reports no completion promise would otherwise
-      // leave the run at 'dispatched' for the process lifetime.
-      ctx.watchRun(updated)
-      return updated
-    }
-    void launch.completion
-      .then((completion) =>
-        ctx.markDispatchResult({
-          runId: run.id,
-          status: completion.status,
-          ...launchRunTarget,
-          precheckResult,
-          outputSnapshot: completion.outputSnapshot ?? null,
-          error: completion.error ?? null
-        })
-      )
-      .catch((error) =>
-        ctx.markDispatchResult({
-          runId: run.id,
-          status: 'dispatch_failed',
-          ...launchRunTarget,
-          error: describeDispatchError(error)
-        })
-      )
-    return updated
+    launch = await ctx.dispatcher({ automation, run, target })
   } catch (error) {
     return runs.updateRun({
       runId: run.id,
@@ -91,4 +56,43 @@ export async function runHeadlessAutomationDispatch(
       error: describeDispatchError(error)
     })
   }
+  const launchRunTarget = {
+    workspaceId: launch.workspaceId,
+    workspaceDisplayName: launch.workspaceDisplayName ?? null,
+    terminalSessionId: launch.terminalSessionId,
+    terminalPaneKey: launch.terminalPaneKey ?? null,
+    terminalPtyId: launch.terminalPtyId ?? null
+  }
+  const updated = runs.updateRun({
+    runId: run.id,
+    status: 'dispatched',
+    ...launchRunTarget,
+    error: null
+  })
+  // Observe the launched agent even while persistence is stalled or rejects its acknowledgement.
+  if (!launch.completion) {
+    ctx.watchRun({ ...run, ...launchRunTarget, status: 'dispatched', error: null })
+  } else {
+    void launch.completion
+      .then(
+        (completion) =>
+          ctx.markDispatchResult({
+            runId: run.id,
+            status: completion.status,
+            ...launchRunTarget,
+            precheckResult,
+            outputSnapshot: completion.outputSnapshot ?? null,
+            error: completion.error ?? null
+          }),
+        (error) =>
+          ctx.markDispatchResult({
+            runId: run.id,
+            status: 'dispatch_failed',
+            ...launchRunTarget,
+            error: describeDispatchError(error)
+          })
+      )
+      .catch((error) => console.error('[automations] Failed to persist run completion:', error))
+  }
+  return updated
 }
diff --git a/src/main/automations/refused-manual-run.test.ts b/src/main/automations/refused-manual-run.test.ts
index 2e6b4a16cdfc..6336b870bd9b 100644
--- a/src/main/automations/refused-manual-run.test.ts
+++ b/src/main/automations/refused-manual-run.test.ts
@@ -1,3 +1,4 @@
+import { closeTestStores, createSqliteTestStore } from '../persistence-test-harness'
 /**
  * doc:94 pairs "return the typed `target_removed` conflict" with "record a
  * skipped-run reason". The scheduler already did both; a manual attempt used to
@@ -98,7 +99,7 @@ async function createStore() {
   installFakeAppEnvironment({ getPath: () => testState.dir })
   const { Store, initDataPath } = await import('../persistence')
   initDataPath()
-  const store = new Store()
+  const store = createSqliteTestStore(Store, { dataFile: join(testState.dir, 'orca-data.json') })
   const service = new AutomationService(store, { tickMs: 60_000 })
   // Manual runs arrive over the shared runtime RPC surface for every transport.
   const { OrcaRuntimeService } = await import('../runtime/orca-runtime')
@@ -125,7 +126,8 @@ describe('manual run refused before dispatch', () => {
     testState.dir = mkdtempSync(join(tmpdir(), 'automation-refused-manual-'))
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
 
diff --git a/src/main/automations/refused-manual-run.ts b/src/main/automations/refused-manual-run.ts
index f6a103408c2a..b3b607866549 100644
--- a/src/main/automations/refused-manual-run.ts
+++ b/src/main/automations/refused-manual-run.ts
@@ -19,7 +19,7 @@ import {
 
 type RefusableAutomationService = {
   runNow: (automationId: string) => Promise<AutomationRun>
-  recordRefusedRun: (automationId: string) => void
+  recordRefusedRun: (automationId: string) => void | Promise<void>
 }
 
 export async function runAutomationNowFenced(input: {
@@ -34,7 +34,7 @@ export async function runAutomationNowFenced(input: {
       error instanceof AutomationOwnerConflictError &&
       error.code === AUTOMATION_OWNER_CONFLICT_CODES.targetRemoved
     ) {
-      input.service.recordRefusedRun(input.automationId)
+      await input.service.recordRefusedRun(input.automationId)
     }
     throw error
   }
diff --git a/src/main/automations/retained-run-reconciliation.test.ts b/src/main/automations/retained-run-reconciliation.test.ts
index 57afd5ba963f..f8f8b6e9017a 100644
--- a/src/main/automations/retained-run-reconciliation.test.ts
+++ b/src/main/automations/retained-run-reconciliation.test.ts
@@ -1,3 +1,4 @@
+import { closeTestStores, createSqliteTestStore } from '../persistence-test-harness'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { mkdtempSync, rmSync } from 'node:fs'
 import { join } from 'node:path'
@@ -32,7 +33,7 @@ async function createStore() {
   installFakeAppEnvironment({ getPath: () => testState.dir })
   const { Store, initDataPath } = await import('../persistence')
   initDataPath()
-  return new Store()
+  return createSqliteTestStore(Store, { dataFile: join(testState.dir, 'orca-data.json') })
 }
 
 type TestStore = Awaited<ReturnType<typeof createStore>>
@@ -125,7 +126,8 @@ describe('reconciling retained runs against a graph that has not published yet',
     vi.setSystemTime(new Date('2026-06-01T12:00:00Z'))
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     vi.useRealTimers()
     rmSync(testState.dir, { recursive: true, force: true })
   })
diff --git a/src/main/automations/run-completion-watcher.test.ts b/src/main/automations/run-completion-watcher.test.ts
index 31c1aea0bb47..69eb7a17201c 100644
--- a/src/main/automations/run-completion-watcher.test.ts
+++ b/src/main/automations/run-completion-watcher.test.ts
@@ -1,3 +1,4 @@
+import { closeTestStores, createSqliteTestStore } from '../persistence-test-harness'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { mkdtempSync, rmSync } from 'node:fs'
 import { join } from 'node:path'
@@ -36,7 +37,7 @@ async function createStore() {
   installFakeAppEnvironment({ getPath: () => testState.dir })
   const { Store, initDataPath } = await import('../persistence')
   initDataPath()
-  return new Store()
+  return createSqliteTestStore(Store, { dataFile: join(testState.dir, 'orca-data.json') })
 }
 
 const makeRepo = (overrides: Partial<Repo> = {}): Repo => ({
@@ -97,7 +98,8 @@ describe('authority-owned automation run completion', () => {
     ipcHandlers.clear()
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
 
@@ -168,6 +170,9 @@ describe('authority-owned automation run completion', () => {
   it('reconciles stranded runs on startup without claiming completion', async () => {
     const store = await createStore()
     const automation = createAutomation(store)
+    store.updateAutomation(automation.id, { enabled: false })
+    const pendingManual = store.createAutomationRun(automation, 3_000, 'manual')
+    const pendingScheduled = store.createAutomationRun(automation, 4_000, 'scheduled')
     const dispatched = store.createAutomationRun(automation, 1_000, 'manual')
     store.updateAutomationRun({
       runId: dispatched.id,
@@ -199,6 +204,11 @@ describe('authority-owned automation run completion', () => {
     expect(readRun(store, automation.id, dispatching.id).status).toBe('dispatch_failed')
     expect(readRun(store, automation.id, dispatched.id).error).toContain('terminal')
     expect(readRun(store, automation.id, dispatching.id).error).toContain('agent started')
+    expect(readRun(store, automation.id, pendingManual.id)).toMatchObject({
+      status: 'dispatch_failed',
+      error: 'Orca stopped before this manual run could launch.'
+    })
+    expect(readRun(store, automation.id, pendingScheduled.id).status).toBe('pending')
     service.stop()
     vi.useRealTimers()
   })
@@ -322,7 +332,8 @@ describe('automationsChanged publication', () => {
     ipcHandlers.clear()
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
 
@@ -341,7 +352,7 @@ describe('automationsChanged publication', () => {
     })
 
     const run = await service.runNow(automation.id)
-    expect(seen.map((entry) => entry.payload.reason)).toEqual(['run', 'run'])
+    expect(seen.map((entry) => entry.payload.reason)).toEqual(['run', 'run', 'run'])
     expect(seen.at(-1)?.status).toBe('dispatched')
 
     await service.markDispatchResult({
@@ -350,7 +361,7 @@ describe('automationsChanged publication', () => {
       ...LAUNCH_TARGET,
       error: null
     })
-    expect(seen.map((entry) => entry.payload.reason)).toEqual(['run', 'run', 'run', 'usage'])
+    expect(seen.map((entry) => entry.payload.reason)).toEqual(['run', 'run', 'run', 'run', 'usage'])
     expect(seen.at(-1)?.status).toBe('completed')
     // Every run/usage write names its own host, so one automation's run cannot
     // invalidate the rest of the authority.
diff --git a/src/main/automations/run-completion-watcher.ts b/src/main/automations/run-completion-watcher.ts
index 4ac125082fbf..ab53efaee582 100644
--- a/src/main/automations/run-completion-watcher.ts
+++ b/src/main/automations/run-completion-watcher.ts
@@ -24,6 +24,9 @@ export type AutomationRunTerminalObserver = {
 
 /** Truthful reason for a run this authority can no longer observe; never claims completion. */
 export function describeStrandedAutomationRun(run: AutomationRun): string {
+  if (run.status === 'pending') {
+    return 'Orca stopped before this manual run could launch.'
+  }
   if (run.status === 'dispatching') {
     return 'Orca stopped before this run reported that its agent started.'
   }
@@ -139,7 +142,12 @@ export class AutomationRunCompletionWatcher {
    *  reported ready and still cannot find it. */
   reconcileRetainedRuns(runs: readonly AutomationRun[]): void {
     this.reconciler.reconcile(
-      runs.filter((run) => run.status === 'dispatched' || run.status === 'dispatching')
+      runs.filter(
+        (run) =>
+          run.status === 'dispatched' ||
+          run.status === 'dispatching' ||
+          (run.status === 'pending' && run.trigger === 'manual')
+      )
     )
   }
 
diff --git a/src/main/automations/service-precheck.test.ts b/src/main/automations/service-precheck.test.ts
index c13359b546d9..2bd3b5dd969e 100644
--- a/src/main/automations/service-precheck.test.ts
+++ b/src/main/automations/service-precheck.test.ts
@@ -1,5 +1,11 @@
+import {
+  closeTestStores,
+  createSqliteTestStore,
+  readPersistedStateJson,
+  writePersistedStateJson
+} from '../persistence-test-harness'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { mkdtempSync, rmSync } from 'node:fs'
 import { join } from 'node:path'
 import { tmpdir } from 'node:os'
 import type { Repo } from '../../shared/repo-types'
@@ -31,7 +37,7 @@ async function createStore() {
   installFakeAppEnvironment({ getPath: () => testState.dir })
   const { Store, initDataPath } = await import('../persistence')
   initDataPath()
-  return new Store()
+  return createSqliteTestStore(Store, { dataFile: join(testState.dir, 'orca-data.json') })
 }
 
 const makeRepo = (overrides: Partial<Repo> = {}): Repo => ({
@@ -51,9 +57,9 @@ function mutateDataFile(
   }) => void
 ): void {
   const file = join(testState.dir, 'orca-data.json')
-  const state = JSON.parse(readFileSync(file, 'utf-8'))
+  const state = JSON.parse(readPersistedStateJson(file))
   mutate(state)
-  writeFileSync(file, JSON.stringify(state, null, 2), 'utf-8')
+  writePersistedStateJson(file, JSON.stringify(state))
 }
 
 describe('AutomationService prechecks', () => {
@@ -63,7 +69,8 @@ describe('AutomationService prechecks', () => {
     vi.useFakeTimers()
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     vi.useRealTimers()
     rmSync(testState.dir, { recursive: true, force: true })
   })
diff --git a/src/main/automations/service.test.ts b/src/main/automations/service.test.ts
index 7077a70b6d10..77aa8b8a6f30 100644
--- a/src/main/automations/service.test.ts
+++ b/src/main/automations/service.test.ts
@@ -1,5 +1,11 @@
+import {
+  closeTestStores,
+  createSqliteTestStore,
+  readPersistedStateJson,
+  writePersistedStateJson
+} from '../persistence-test-harness'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { mkdtempSync, rmSync } from 'node:fs'
 import { join } from 'node:path'
 import { tmpdir } from 'node:os'
 import type { Repo } from '../../shared/repo-types'
@@ -26,15 +32,15 @@ async function createStore() {
   installFakeAppEnvironment({ getPath: () => testState.dir })
   const { Store, initDataPath } = await import('../persistence')
   initDataPath()
-  return new Store()
+  return createSqliteTestStore(Store, { dataFile: join(testState.dir, 'orca-data.json') })
 }
 
 /** Simulate registry drift after a record was stored; the create path derives contexts itself. */
 function mutateDataFile(mutate: (state: { automations: Record<string, unknown>[] }) => void): void {
   const file = join(testState.dir, 'orca-data.json')
-  const state = JSON.parse(readFileSync(file, 'utf-8'))
+  const state = JSON.parse(readPersistedStateJson(file))
   mutate(state)
-  writeFileSync(file, JSON.stringify(state, null, 2), 'utf-8')
+  writePersistedStateJson(file, JSON.stringify(state))
 }
 
 const makeRepo = (overrides: Partial<Repo> = {}): Repo => ({
@@ -52,7 +58,8 @@ describe('AutomationService', () => {
     vi.useFakeTimers()
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     vi.useRealTimers()
     rmSync(testState.dir, { recursive: true, force: true })
   })
diff --git a/src/main/automations/service.ts b/src/main/automations/service.ts
index 227a290783bf..1ff8eafbd6b9 100644
--- a/src/main/automations/service.ts
+++ b/src/main/automations/service.ts
@@ -1,13 +1,13 @@
-import type { WebContents } from 'electron'
-
-/** All the service asks of the renderer: is it still there, and take this message. Narrower
- *  than WebContents so a test can supply the real shape instead of casting one. */
-export type AutomationRendererChannel = Pick<WebContents, 'isDestroyed' | 'send'>
+import {
+  AutomationDispatchCancelledError,
+  requestAutomationDispatch,
+  type AutomationRendererChannel
+} from './automation-dispatch-request'
+export type { AutomationRendererChannel } from './automation-dispatch-request'
 import type { Store } from '../persistence'
 import {
   isFinalAutomationRunStatus,
   type Automation,
-  type AutomationDispatchRequest,
   type AutomationDispatchResult,
   type AutomationPrecheckResult,
   type AutomationRun
@@ -18,8 +18,7 @@ import { runAutomationPrecheck } from './precheck-runner'
 import { resolveAutomationRunTarget, type AutomationRunTargetResult } from './run-target-resolution'
 import { writeAutomationRunUsage } from './run-usage-collection'
 import type { HeadlessAutomationDispatcher } from './headless-dispatch'
-import { clearAutomationDispatchTokens, createAutomationDispatchToken } from './dispatch-tokens'
-import { runHeadlessAutomationDispatch } from './headless-dispatch-runner'
+import { clearAutomationDispatchTokens } from './dispatch-tokens'
 import {
   AutomationRunCompletionWatcher,
   type AutomationRunTerminalObserver
@@ -31,9 +30,7 @@ import {
   missedBeyondGrace,
   recordMissedRun,
   recordRefusedAutomationRun,
-  recordUnevaluableAutomation,
-  sendRendererDispatch,
-  NO_DISPATCH_HOST
+  recordUnevaluableAutomation
 } from './dispatch-refusal'
 import type {
   AutomationsChangedPayload,
@@ -49,6 +46,8 @@ export class AutomationService {
   private webContents: AutomationRendererChannel | null = null
   private rendererReady = false
   private evaluating = false
+  private stopped = false
+  private dispatchGeneration = 0
   private readonly claudeUsage: ClaudeUsageStore | null
   private readonly codexUsage: CodexUsageStore | null
   private readonly allowRemoteHostScheduling: boolean
@@ -114,6 +113,7 @@ export class AutomationService {
     if (this.timer) {
       return
     }
+    this.stopped = false
     this.timer = setInterval(() => {
       void this.evaluateDueRuns()
     }, this.tickMs)
@@ -130,6 +130,8 @@ export class AutomationService {
   }
 
   stop(): void {
+    this.stopped = true
+    this.dispatchGeneration += 1
     this.completionWatcher?.dispose()
     if (!this.timer) {
       return
@@ -139,19 +141,21 @@ export class AutomationService {
   }
 
   async runNow(automationId: string): Promise<AutomationRun> {
+    const generation = this.dispatchGeneration
     const automation = this.store.listAutomations().find((entry) => entry.id === automationId)
     if (!automation) {
       throw new Error('Automation not found.')
     }
-    const run = this.runs.createRun(automation, Date.now(), 'manual')
-    return await this.requestDispatch(automation, run, this.resolveTarget(automation))
+    const target = this.resolveTarget(automation)
+    const run = await this.runs.createRun(automation, Date.now(), 'manual')
+    return await this.requestDispatch(automation, run, target, generation)
   }
 
   /** The run-history row doc:94 pairs with the typed refusal an execute fence throws. */
-  recordRefusedRun(automationId: string): void {
+  async recordRefusedRun(automationId: string): Promise<void> {
     const automation = this.store.listAutomations().find((entry) => entry.id === automationId)
     if (automation) {
-      recordRefusedAutomationRun({
+      await recordRefusedAutomationRun({
         store: this.store,
         runs: this.runs,
         automation,
@@ -198,7 +202,7 @@ export class AutomationService {
   }
 
   async markDispatchResult(result: AutomationDispatchResult): Promise<AutomationRun> {
-    const run = this.runs.updateRun(result)
+    const run = await this.runs.updateRun(result)
     clearAutomationDispatchTokens(run.automationId, run.id)
     if (!isFinalAutomationRunStatus(run.status)) {
       if (run.status === 'dispatched') {
@@ -224,13 +228,17 @@ export class AutomationService {
   }
 
   private async evaluateDueRuns(): Promise<void> {
-    if (this.evaluating) {
+    if (this.evaluating || this.stopped) {
       return
     }
     this.evaluating = true
+    const generation = this.dispatchGeneration
     try {
       const now = Date.now()
       for (const automation of this.store.listAutomations()) {
+        if (this.stopped || generation !== this.dispatchGeneration) {
+          break
+        }
         if (!automation.enabled || automation.nextRunAt > now) {
           continue
         }
@@ -239,7 +247,14 @@ export class AutomationService {
         try {
           await this.evaluateAutomation(automation, now)
         } catch (error) {
-          recordUnevaluableAutomation({ runs: this.runs, automation, error })
+          if (
+            !(error instanceof AutomationDispatchCancelledError) &&
+            !this.stopped &&
+            generation === this.dispatchGeneration &&
+            this.store.listAutomations().some((current) => current.id === automation.id)
+          ) {
+            await recordUnevaluableAutomation({ runs: this.runs, automation, error })
+          }
         }
       }
     } finally {
@@ -248,14 +263,15 @@ export class AutomationService {
   }
 
   private async evaluateAutomation(automation: Automation, now: number): Promise<void> {
+    const generation = this.dispatchGeneration
     const scheduledFor = this.store.getLatestAutomationOccurrence(automation, now)
     if (scheduledFor === null) {
-      this.store.advanceAutomationNextRun(automation.id, now)
+      await this.runs.advanceNextRun(automation.id, now)
       return
     }
     if (missedBeyondGrace({ automation, scheduledFor, now, tickMs: this.tickMs })) {
-      recordMissedRun({ runs: this.runs, automation, scheduledFor })
-      this.store.advanceAutomationNextRun(automation.id, now)
+      await recordMissedRun({ runs: this.runs, automation, scheduledFor })
+      await this.runs.advanceNextRun(automation.id, now)
       return
     }
 
@@ -263,14 +279,20 @@ export class AutomationService {
     // */5 automation would otherwise write ~288 identical rows a day — past
     // retention, which would evict the automation's real history.
     const target = this.resolveTarget(automation)
-    const refusal = describeScheduledRefusal({ target, canDispatch: this.canDispatch() })
-    if (refusal && this.runs.repeatSkip(automation.id, refusal, scheduledFor)) {
-      this.store.advanceAutomationNextRun(automation.id, now)
+    const canDispatch = this.canDispatchToRenderer() || Boolean(this.headlessDispatcher)
+    const refusal = describeScheduledRefusal({ target, canDispatch })
+    if (refusal && (await this.runs.repeatSkip(automation.id, refusal, scheduledFor))) {
+      await this.runs.advanceNextRun(automation.id, now)
       return
     }
 
-    await this.requestDispatch(automation, this.runs.createRun(automation, scheduledFor), target)
-    this.store.advanceAutomationNextRun(automation.id, now)
+    await this.requestDispatch(
+      automation,
+      await this.runs.createRun(automation, scheduledFor),
+      target,
+      generation
+    )
+    await this.runs.advanceNextRun(automation.id, now)
   }
 
   private resolveTarget(automation: Automation): AutomationRunTargetResult {
@@ -284,55 +306,27 @@ export class AutomationService {
     return Boolean(webContents && !webContents.isDestroyed() && this.rendererReady)
   }
 
-  /** Headless serve counts: it launches runs with no window at all. */
-  private canDispatch(): boolean {
-    return this.canDispatchToRenderer() || Boolean(this.headlessDispatcher)
-  }
-
-  private async requestDispatch(
+  private requestDispatch(
     automation: Automation,
     run: AutomationRun,
-    target: AutomationRunTargetResult
+    target: AutomationRunTargetResult,
+    generation: number
   ): Promise<AutomationRun> {
-    if (!target.ok) {
-      return this.runs.updateRun({
-        runId: run.id,
-        status: 'skipped_unavailable',
-        workspaceId: automation.workspaceId,
-        error: target.error
-      })
-    }
-    if (!this.canDispatchToRenderer()) {
-      if (this.headlessDispatcher) {
-        return await runHeadlessAutomationDispatch({
-          automation,
-          run,
-          target,
-          dispatcher: this.headlessDispatcher,
-          runs: this.runs,
-          runPrecheck: () => this.runPrecheck(automation.id, run.id),
-          markDispatchResult: (result) => this.markDispatchResult(result),
-          watchRun: (dispatched) => this.completionWatcher?.watch(dispatched)
-        })
-      }
-      return this.runs.updateRun({
-        runId: run.id,
-        status: 'skipped_unavailable',
-        workspaceId: automation.workspaceId,
-        error: NO_DISPATCH_HOST
-      })
-    }
-    const updated = this.runs.updateRun({
-      runId: run.id,
-      status: 'dispatching',
-      workspaceId: automation.workspaceId,
-      error: null
-    })
-    const payload: AutomationDispatchRequest = {
+    return requestAutomationDispatch(
+      {
+        store: this.store,
+        runs: this.runs,
+        isActive: () => !this.stopped && generation === this.dispatchGeneration,
+        getRenderer: () => (this.canDispatchToRenderer() ? this.webContents : null),
+        headlessDispatcher: this.headlessDispatcher,
+        resolveTarget: (current) => this.resolveTarget(current),
+        runPrecheck: () => this.runPrecheck(automation.id, run.id),
+        markDispatchResult: (result) => this.markDispatchResult(result),
+        watchRun: (dispatched) => this.completionWatcher?.watch(dispatched)
+      },
       automation,
-      run: updated,
-      dispatchToken: createAutomationDispatchToken(automation.id, updated.id)
-    }
-    return sendRendererDispatch(this.webContents, payload, this.runs, updated)
+      run,
+      target
+    )
   }
 }
diff --git a/src/main/browser/browser-route-webrtc-egress.electron.test.ts b/src/main/browser/browser-route-webrtc-egress.electron.test.ts
index 013a852e810a..23463f2f84aa 100644
--- a/src/main/browser/browser-route-webrtc-egress.electron.test.ts
+++ b/src/main/browser/browser-route-webrtc-egress.electron.test.ts
@@ -36,6 +36,12 @@ const dgram = require('node:dgram')
 const net = require('node:net')
 const os = require('node:os')
 const { writeFileSync } = require('node:fs')
+let phase = 'app-ready'
+
+function enterPhase(next) {
+  phase = next
+  console.error('[webrtc-egress] ' + phase)
+}
 
 function bind(socket, host) {
   return new Promise((resolve, reject) => {
@@ -71,19 +77,24 @@ async function probe() {
   const tcp = net.createServer((socket) => socket.destroy())
   const packets = []
   udp.on('message', (message) => packets.push(message.length))
+  enterPhase('bind-listeners')
   const [udpAddress, tcpAddress] = await Promise.all([
     bind(udp, '0.0.0.0'),
     listen(tcp, '127.0.0.1')
   ])
   const partition = 'persist:webrtc-egress-${protectedGuest}-' + Date.now()
   const routeSession = session.fromPartition(partition, { cache: false })
+  enterPhase('configure-proxy')
   await routeSession.setProxy({
     mode: 'fixed_servers',
     proxyRules: 'socks5://127.0.0.1:' + tcpAddress.port,
     proxyBypassRules: '<-loopback>'
   })
+  enterPhase('close-connections')
   await routeSession.closeAllConnections()
+  enterPhase('resolve-proxy')
   const resolvedProxy = await routeSession.resolveProxy('https://example.invalid/')
+  enterPhase('create-window')
   const window = new BrowserWindow({
     show: false,
     webPreferences: { partition, sandbox: true, nodeIntegration: false, contextIsolation: true }
@@ -92,6 +103,7 @@ async function probe() {
     window.webContents.setWebRTCIPHandlingPolicy('disable_non_proxied_udp')
   }
   const policy = window.webContents.getWebRTCIPHandlingPolicy()
+  enterPhase('load-page')
   await window.loadURL('data:text/html,<title>WebRTC egress probe</title>')
   const target = viewerAddress()
   const script = \`
@@ -100,15 +112,22 @@ async function probe() {
         iceServers: [{ urls: 'stun:\${target}:\${udpAddress.port}' }],
         iceCandidatePoolSize: 1
       })
+      globalThis.__webrtcEgressPeer = peer
       peer.createDataChannel('probe')
       const offer = await peer.createOffer()
       await peer.setLocalDescription(offer)
-      await new Promise(resolve => setTimeout(resolve, 3000))
-      peer.close()
     })()
   \`
+  enterPhase('renderer-webrtc')
   await window.webContents.executeJavaScript(script)
+  // Hidden renderer timers may be throttled; the packet observation clock belongs to the host.
+  enterPhase('observe-packets')
+  await new Promise((resolve) => setTimeout(resolve, 3000))
+  enterPhase('close-peer')
+  await window.webContents.executeJavaScript('globalThis.__webrtcEgressPeer.close()')
+  enterPhase('drain-packets')
   await new Promise((resolve) => setTimeout(resolve, 500))
+  enterPhase('cleanup')
   window.destroy()
   udp.close()
   tcp.close()
@@ -116,16 +135,22 @@ async function probe() {
 }
 
 async function run() {
-  const timeout = setTimeout(() => app.exit(2), 20000)
+  const timeout = setTimeout(() => {
+    writeFileSync(${JSON.stringify(resultPath)}, JSON.stringify({
+      error: 'WebRTC egress probe timed out', phase, protectedGuest: ${protectedGuest}
+    }))
+    app.exit(2)
+  }, 20000)
   await app.whenReady()
   const result = await probe()
+  enterPhase('write-result')
   writeFileSync(${JSON.stringify(resultPath)}, JSON.stringify(result))
   clearTimeout(timeout)
   app.quit()
 }
 
 run().catch((error) => {
-  writeFileSync(${JSON.stringify(resultPath)}, JSON.stringify({ error: String(error?.stack || error) }))
+  writeFileSync(${JSON.stringify(resultPath)}, JSON.stringify({ error: String(error?.stack || error), phase, protectedGuest: ${protectedGuest} }))
   app.exit(1)
 })
 `
diff --git a/src/main/browser/offscreen-browser-backend-lifecycle.test.ts b/src/main/browser/offscreen-browser-backend-lifecycle.test.ts
index a3758d70516c..381489963a33 100644
--- a/src/main/browser/offscreen-browser-backend-lifecycle.test.ts
+++ b/src/main/browser/offscreen-browser-backend-lifecycle.test.ts
@@ -90,18 +90,16 @@ describe('OffscreenBrowserBackend lifecycle', () => {
   beforeEach(() => {
     mocks.windows.length = 0
     mocks.finishLoads = true
-    mocks.BrowserWindow.mockImplementation(
-      function BrowserWindowMock(this: {
-        webContents: MockWebContents
-        isDestroyed: () => boolean
-        destroy: () => void
-      }) {
-        const window = new MockBrowserWindow()
-        this.webContents = window.webContents
-        this.isDestroyed = window.isDestroyed.bind(window)
-        this.destroy = window.destroy.bind(window)
-      }
-    )
+    mocks.BrowserWindow.mockImplementation(function BrowserWindowMock(this: {
+      webContents: MockWebContents
+      isDestroyed: () => boolean
+      destroy: () => void
+    }) {
+      const window = new MockBrowserWindow()
+      this.webContents = window.webContents
+      this.isDestroyed = window.isDestroyed.bind(window)
+      this.destroy = window.destroy.bind(window)
+    })
   })
 
   it('settles a pending load and removes its waiters when the page is destroyed', async () => {
diff --git a/src/main/claude-accounts/keychain.ts b/src/main/claude-accounts/keychain.ts
index eca0e9af44de..aa4dcfa64dbc 100644
--- a/src/main/claude-accounts/keychain.ts
+++ b/src/main/claude-accounts/keychain.ts
@@ -1,18 +1,15 @@
-import { execFile } from 'node:child_process'
 import { createHash } from 'node:crypto'
 import { lstatSync, realpathSync } from 'node:fs'
 import { userInfo } from 'node:os'
 import { basename, dirname, join } from 'node:path'
+import {
+  deleteKeychainPassword,
+  readKeychainPassword,
+  writeKeychainPassword
+} from '../macos-keychain/generic-password'
 
 const ACTIVE_CLAUDE_SERVICE = 'Claude Code-credentials'
 const ORCA_CLAUDE_SERVICE = 'Orca Claude Code Managed Credentials'
-const KEYCHAIN_COMMAND_TIMEOUT_MS = 3_000
-
-type SecurityCommandResult = {
-  stdout: string
-  stderr: string
-}
-
 export async function readActiveClaudeKeychainCredentials(
   configDir?: string
 ): Promise<string | null> {
@@ -183,136 +180,3 @@ function getActiveClaudeServices(configDir?: string): string[] {
   const scoped = claudeConfigDirKeychainAliases(configDir).map((dir) => getActiveClaudeService(dir))
   return [...new Set([...scoped, ACTIVE_CLAUDE_SERVICE])]
 }
-
-async function readKeychainPassword(service: string, account: string): Promise<string | null> {
-  if (process.platform !== 'darwin') {
-    return null
-  }
-  try {
-    const { stdout } = await execSecurityCommand([
-      'find-generic-password',
-      '-s',
-      service,
-      '-a',
-      account,
-      '-w'
-    ])
-    if (stdout.trim()) {
-      return stdout.trim()
-    }
-    throw new Error(`Could not read macOS Keychain item ${service}/${account}.`)
-  } catch (error) {
-    if (isKeychainNotFoundError(error)) {
-      return null
-    }
-    throw error
-  }
-}
-
-async function writeKeychainPassword(
-  service: string,
-  account: string,
-  contents: string
-): Promise<void> {
-  if (process.platform !== 'darwin') {
-    return
-  }
-  await execSecurity(['add-generic-password', '-U', '-s', service, '-a', account, '-w', contents])
-}
-
-async function deleteKeychainPassword(
-  service: string,
-  account: string,
-  options?: { failOnAccessError?: boolean }
-): Promise<void> {
-  if (process.platform !== 'darwin') {
-    return
-  }
-  await execSecurity(['delete-generic-password', '-s', service, '-a', account], {
-    ignoreNotFound: true,
-    ignoreFailure: !options?.failOnAccessError
-  })
-}
-
-function execSecurity(
-  args: string[],
-  options?: { ignoreFailure?: boolean; ignoreNotFound?: boolean }
-): Promise<void> {
-  return execSecurityCommand(args).then(undefined, (error: unknown) => {
-    if (options?.ignoreNotFound && isKeychainNotFoundError(error)) {
-      return
-    }
-    if (!options?.ignoreFailure) {
-      throw error
-    }
-  })
-}
-
-function isKeychainNotFoundError(error: unknown): boolean {
-  const code =
-    error && typeof error === 'object' && 'code' in error
-      ? (error as { code?: unknown }).code
-      : undefined
-  const message =
-    error && typeof error === 'object'
-      ? `${String((error as { stderr?: unknown }).stderr ?? '')} ${String(
-          (error as { message?: unknown }).message ?? ''
-        )}`.toLowerCase()
-      : String(error).toLowerCase()
-  return code === 44 || message.includes('could not be found') || message.includes('not be found')
-}
-
-function execSecurityCommand(args: string[]): Promise<SecurityCommandResult> {
-  return new Promise((resolve, reject) => {
-    let settled = false
-    let child: ReturnType<typeof execFile> | undefined
-    const timer = setTimeout(() => {
-      if (settled) {
-        return
-      }
-      settled = true
-      child?.kill()
-      reject(
-        Object.assign(new Error(`security timed out after ${KEYCHAIN_COMMAND_TIMEOUT_MS}ms`), {
-          code: 'ETIMEDOUT',
-          stderr: ''
-        })
-      )
-    }, KEYCHAIN_COMMAND_TIMEOUT_MS)
-
-    const settle = (callback: () => void): void => {
-      if (settled) {
-        return
-      }
-      settled = true
-      clearTimeout(timer)
-      callback()
-    }
-
-    // Why: Node's execFile timeout only signals the `security` process; a
-    // stuck callback would otherwise leave auth/keychain operations pending.
-    try {
-      child = execFile(
-        'security',
-        args,
-        { timeout: KEYCHAIN_COMMAND_TIMEOUT_MS },
-        (error, stdout, stderr) => {
-          if (error) {
-            settle(() =>
-              reject(
-                Object.assign(error, {
-                  stdout: String(stdout),
-                  stderr: String(stderr)
-                })
-              )
-            )
-            return
-          }
-          settle(() => resolve({ stdout: String(stdout), stderr: String(stderr) }))
-        }
-      )
-    } catch (error) {
-      settle(() => reject(error))
-    }
-  })
-}
diff --git a/src/main/claude-usage/store.ts b/src/main/claude-usage/store.ts
index f5fd8ca3ce35..686b32ab827e 100644
--- a/src/main/claude-usage/store.ts
+++ b/src/main/claude-usage/store.ts
@@ -1,3 +1,4 @@
+import { claudeTokenSessions } from '../usage/agent-token-usage'
 import { app } from 'electron'
 import { join } from 'node:path'
 import type {
@@ -79,6 +80,10 @@ export class ClaudeUsageStore extends UsageProviderStoreLifecycle<
 > {
   constructor(store: Pick<Store, 'getRepos' | 'getAllWorktreeMeta'>) {
     super(store, {
+      tokenUsage: {
+        provider: 'claude',
+        selectSessions: (state) => claudeTokenSessions(state.sessions)
+      },
       logTag: '[claude-usage]',
       resolveCacheFile: getClaudeUsageFile,
       createDefaultState: getDefaultState,
diff --git a/src/main/claude/claude-agent-sdk-exit-proof.test.ts b/src/main/claude/claude-agent-sdk-exit-proof.test.ts
index 3f15f8e8fca7..f9412a104882 100644
--- a/src/main/claude/claude-agent-sdk-exit-proof.test.ts
+++ b/src/main/claude/claude-agent-sdk-exit-proof.test.ts
@@ -432,8 +432,8 @@ describe('claude child tree reaper', () => {
     const child = mockChild()
     // Reap #1 completed and saw a descendant alive at its deadline; the root then
     // left on its own and the re-verification on a loaded host could not read the
-    // table. "Could not look" must not erase "was seen alive": the lease release
-    // gate is exactly the pair this distinguishes.
+    // table. "Could not look" must not erase "was seen alive": the report never
+    // calls a survivor gone.
     const terminateDescendants = vi
       .fn()
       .mockResolvedValueOnce('live')
diff --git a/src/main/claude/claude-agent-sdk-exit-proof.ts b/src/main/claude/claude-agent-sdk-exit-proof.ts
index 17533f87a701..883bf8efd6ac 100644
--- a/src/main/claude/claude-agent-sdk-exit-proof.ts
+++ b/src/main/claude/claude-agent-sdk-exit-proof.ts
@@ -26,7 +26,7 @@ import {
 /**
  * A later reap may only raise the latched verdict. An observed exit is final, and
  * a descendant seen alive at a deadline is never forgotten by a later look that
- * could not read the table: the lease gate discriminates on exactly that pair.
+ * could not read the table, so the report never calls a survivor gone.
  */
 const TREE_VERDICT_TRUST: Record<DescendantTreeVerdict, number> = {
   unverifiable: 0,
@@ -89,8 +89,8 @@ export type ClaudeChildTreeReaper = {
   reap(): Promise<DescendantTreeVerdict>
   /**
    * `unverifiable` until a reap observes otherwise. `exited` is the only verdict
-   * that lets a close release the lease; `live` names a descendant that was seen
-   * still running, which no later caller may collapse into "unknown".
+   * that proves a close; `live` names a descendant that was seen still running,
+   * which no later caller may collapse into "unknown".
    */
   readonly treeVerdict: DescendantTreeVerdict
 }
diff --git a/src/main/claude/claude-api-retry-idle-sweep.test.ts b/src/main/claude/claude-api-retry-idle-sweep.test.ts
new file mode 100644
index 000000000000..fc5d234ec877
--- /dev/null
+++ b/src/main/claude/claude-api-retry-idle-sweep.test.ts
@@ -0,0 +1,132 @@
+// A Claude that keeps retrying a refused request is working, so the idle sweep must not stop it.
+// Every retry frame's publish is the activity the sweep reads, even though a run writes one row.
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi, type Mock } from 'vitest'
+import { AgentSessionRecordStore } from '../runtime/agent-session-record-store'
+import type { StructuredAgentSessionAdapter } from '../native-chat/agent-session-wire/structured-agent-session-adapter'
+import type { StructuredAgentSessionEventSink } from '../native-chat/agent-session-wire/structured-agent-session-event-sink'
+import { StructuredAgentSessionHost } from '../native-chat/agent-session-wire/structured-agent-session-host'
+import { STRUCTURED_AGENT_SESSION_IDLE_MS } from '../native-chat/agent-session-wire/structured-agent-session-idle-sweep'
+import {
+  HOST_TEST_NOW as NOW,
+  HOST_TEST_SESSION as SESSION,
+  HOST_TEST_THREAD as THREAD,
+  hostTestAttachParams,
+  resetHostTestOperationIds
+} from '../native-chat/agent-session-wire/structured-agent-session-host-test-data'
+import { createClaudeJournalTranslator } from './claude-structured-journal-translation'
+
+const SWEEP_MS = 5
+const RETRY_GAP_MS = 10 * 60_000
+
+let root: string
+let host: StructuredAgentSessionHost
+let sink: StructuredAgentSessionEventSink | null
+let closeSession: Mock<NonNullable<StructuredAgentSessionAdapter['closeSession']>>
+let clock: number
+
+function apiRetry(attempt: number): Record<string, unknown> {
+  return {
+    type: 'system',
+    subtype: 'api_retry',
+    attempt,
+    max_retries: 10,
+    retry_delay_ms: 600_000,
+    error_status: 429,
+    error: 'rate_limit',
+    session_id: 'provider-1',
+    uuid: `9b2f6a1e-0c4d-4e7a-8f3b-00000000000${attempt}`
+  }
+}
+
+/** Long enough for many sweep ticks, so "still open" means the sweep declined. */
+function waitOutSeveralSweeps(): Promise<void> {
+  return new Promise((resolve) => setTimeout(resolve, SWEEP_MS * 20))
+}
+
+beforeEach(async () => {
+  root = await mkdtemp(join(tmpdir(), 'orca-claude-retry-sweep-'))
+  resetHostTestOperationIds()
+  sink = null
+  clock = NOW
+  closeSession = vi.fn(async () => true)
+  const store = await AgentSessionRecordStore.open({
+    directory: join(root, 'store'),
+    hostId: 'local'
+  })
+  const adapter: StructuredAgentSessionAdapter = {
+    acquire: async ({ fence, spawnToken, events }) => {
+      sink = events ?? null
+      return {
+        process: { hostId: 'local', pid: 4242, processStartTimeMs: NOW - 1_000, spawnToken },
+        acquisitionGeneration: 'generation-1',
+        link: {
+          linkId: `link-${fence}`,
+          handle: { provider: 'codex', threadId: THREAD },
+          origin: 'created',
+          mintedAtFence: fence,
+          observedAt: NOW
+        }
+      }
+    },
+    closeSession,
+    releaseAcquisition: async () => true,
+    dispatch: async () => ({ state: 'admitted' }),
+    cancelTurn: async () => ({ cancelled: false }),
+    answerPrompt: async () => undefined,
+    setOption: async () => undefined
+  }
+  host = new StructuredAgentSessionHost({
+    store,
+    adapter,
+    journalRoot: root,
+    claimKeyId: 'key-1',
+    mintSpawnToken: () => 'spawn-1',
+    idleSweep: { intervalMs: SWEEP_MS, idleMs: STRUCTURED_AGENT_SESSION_IDLE_MS },
+    now: () => clock
+  })
+})
+
+afterEach(async () => {
+  await host.flushAllStreamedEvents()
+  await rm(root, { recursive: true, force: true })
+})
+
+describe('a Claude retrying a refused request', () => {
+  it('keeps the conversation open past the idle window while retry frames arrive', async () => {
+    expect(await host.attach({ callerKey: 'client-1' }, hostTestAttachParams(null))).toMatchObject({
+      ok: true
+    })
+    if (!sink) {
+      throw new Error('the host never handed the provider its event sink')
+    }
+    const translator = createClaudeJournalTranslator({ sink, fallbackIdPrefix: '1' })
+
+    // Five frames ten minutes apart: fifty minutes, well past the thirty-minute idle window.
+    for (let attempt = 1; attempt <= 5; attempt += 1) {
+      clock += RETRY_GAP_MS
+      translator.handle({ type: 'message', sessionId: SESSION, message: apiRetry(attempt) })
+      await waitOutSeveralSweeps()
+      expect(closeSession).not.toHaveBeenCalled()
+      expect(host.hasSession(SESSION)).toBe(true)
+    }
+
+    const items = host['sessions'].get(SESSION)?.journal.snapshot().items ?? []
+    const retryRows = items.filter(
+      (item) => item.body.kind === 'status' && item.body.failure?.kind === 'providerRetrying'
+    )
+    expect(retryRows).toHaveLength(1)
+    expect(retryRows[0]?.body).toMatchObject({
+      failure: { detail: { text: expect.stringContaining('"attempt":5') } }
+    })
+
+    // Once the frames stop, the same clock does let the sweep close it.
+    clock += STRUCTURED_AGENT_SESSION_IDLE_MS
+    await vi.waitFor(() => {
+      expect(closeSession).toHaveBeenCalledWith(SESSION)
+      expect(host.hasSession(SESSION)).toBe(false)
+    })
+  })
+})
diff --git a/src/main/claude/claude-api-retry-row.test.ts b/src/main/claude/claude-api-retry-row.test.ts
new file mode 100644
index 000000000000..becadff90d3c
--- /dev/null
+++ b/src/main/claude/claude-api-retry-row.test.ts
@@ -0,0 +1,133 @@
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type {
+  AgentJournalItemBody,
+  AgentSessionJournalIdentity
+} from '../../shared/agent-session-journal-types'
+import { MAX_PROVIDER_DIAGNOSTIC_CHARS } from '../../shared/agent-session-failure'
+import { openAgentSessionJournal } from '../native-chat/agent-session-journal/journal-store-factory'
+import { createDeferredStructuredAgentSessionEventSink } from '../native-chat/agent-session-wire/structured-agent-session-event-sink'
+import { unhandledProviderFrameJournalItem } from '../native-chat/agent-session-wire/unhandled-provider-frame'
+import { createClaudeJournalTranslator } from './claude-structured-journal-translation'
+
+const IDENTITY: AgentSessionJournalIdentity = {
+  sessionId: 'session-1',
+  workspaceId: 'workspace-1',
+  hostId: 'host-1',
+  agent: 'claude',
+  providerHandle: { kind: 'claude', sessionId: 'provider-1', leafUuid: 'leaf-1' }
+}
+
+/** A frame as Claude Code sends it while it retries a refused request. */
+function apiRetry(attempt: number, fields: Record<string, unknown> = {}): Record<string, unknown> {
+  return {
+    type: 'system',
+    subtype: 'api_retry',
+    attempt,
+    max_retries: 10,
+    retry_delay_ms: 622,
+    error_status: 429,
+    error: 'rate_limit',
+    session_id: 'provider-1',
+    uuid: `9b2f6a1e-0c4d-4e7a-8f3b-00000000000${attempt}`,
+    ...fields
+  }
+}
+
+let root = ''
+
+beforeEach(async () => {
+  root = await mkdtemp(join(tmpdir(), 'orca-claude-api-retry-'))
+})
+
+afterEach(async () => {
+  await rm(root, { recursive: true, force: true })
+})
+
+async function statusRowsFor(frames: Record<string, unknown>[]) {
+  const journal = await openAgentSessionJournal({
+    identity: IDENTITY,
+    journalDir: root,
+    now: () => 1_700_000_000_000,
+    mintEpoch: () => 'epoch-1'
+  })
+  const deferred = createDeferredStructuredAgentSessionEventSink()
+  deferred.bind({ journal, fence: 1, publish: vi.fn() })
+  const translator = createClaudeJournalTranslator({ sink: deferred.sink, fallbackIdPrefix: '1' })
+  for (const frame of frames) {
+    translator.handle({ type: 'message', sessionId: 'orca-session', message: frame })
+    await deferred.drained()
+  }
+  return journal
+    .snapshot()
+    .items.flatMap((item): Extract<AgentJournalItemBody, { kind: 'status' }>[] =>
+      item.body.kind === 'status' ? [item.body] : []
+    )
+}
+
+describe('a Claude api_retry frame', () => {
+  it('writes one sentence row per retry run, revised by each attempt, not the frame', async () => {
+    const rows = await statusRowsFor([apiRetry(1), apiRetry(2), apiRetry(3)])
+
+    expect(rows).toHaveLength(1)
+    const [row] = rows
+    expect(row).toMatchObject({
+      text: 'Claude is rate-limited and retrying.',
+      tone: 'warning',
+      failure: {
+        kind: 'providerRetrying',
+        retry: { error: 'rate_limit', status: 429 },
+        detail: { audience: 'log' }
+      }
+    })
+    expect(row).not.toHaveProperty('providerFrame')
+    // The latest attempt's frame, as the log detail.
+    expect(row.failure?.detail?.text).toContain('"attempt":3')
+  })
+
+  it('starts a new row when a later run starts over', async () => {
+    const rows = await statusRowsFor([apiRetry(1), apiRetry(2), apiRetry(1)])
+    expect(rows.map((row) => row.text)).toEqual([
+      'Claude is rate-limited and retrying.',
+      'Claude is rate-limited and retrying.'
+    ])
+  })
+
+  it('does not call a retry a rate limit unless the frame says so', async () => {
+    const rows = await statusRowsFor([
+      apiRetry(1, { error: 'overloaded', error_status: 529 }),
+      apiRetry(1, { error: 'server_error', error_status: 500 }),
+      apiRetry(1, { error: undefined, error_status: undefined }),
+      apiRetry(1, { error: 'something_new', error_status: 429 })
+    ])
+    expect(rows.map((row) => row.text)).toEqual([
+      'Claude hit a temporary problem and is retrying.',
+      'Claude hit a temporary problem and is retrying.',
+      'Claude hit a temporary problem and is retrying.',
+      'Claude is rate-limited and retrying.'
+    ])
+    expect(rows[0]?.failure).toMatchObject({ retry: { error: 'overloaded', status: 529 } })
+  })
+
+  it('caps the frame it keeps as the detail', async () => {
+    const [row] = await statusRowsFor([apiRetry(1, { padding: 'x'.repeat(5_000) })])
+    expect(row?.failure?.detail?.text.length).toBe(MAX_PROVIDER_DIAGNOSTIC_CHARS)
+  })
+
+  it('leaves a frame kind no one catalogued to the provider fallback, as before', async () => {
+    const unknown = {
+      type: 'system',
+      subtype: 'future_notice',
+      error: 'rate_limit',
+      session_id: 'provider-1',
+      uuid: 'future-1'
+    }
+    const rows = await statusRowsFor([unknown])
+    expect(rows).toEqual([
+      unhandledProviderFrameJournalItem('claude', 'message:system:future_notice', unknown)?.body
+    ])
+    expect(rows[0]).toMatchObject({ text: 'rate_limit', tone: 'error' })
+  })
+})
diff --git a/src/main/claude/claude-api-retry-row.ts b/src/main/claude/claude-api-retry-row.ts
new file mode 100644
index 000000000000..195e30461a74
--- /dev/null
+++ b/src/main/claude/claude-api-retry-row.ts
@@ -0,0 +1,39 @@
+// The one row a Claude `system/api_retry` frame writes: a sentence and a `providerRetrying` fact,
+// revised in place for every attempt of the same retry run.
+
+import {
+  agentSessionFailureFact,
+  providerDiagnostic,
+  readProviderRetry
+} from '../../shared/agent-session-failure'
+import { agentSessionFailureWords } from '../../shared/agent-session-failure-words'
+import type { AgentJournalStatusItem } from '../../shared/agent-session-journal-types'
+import { TUI_AGENT_DISPLAY_NAMES } from '../../shared/tui-agent-display-names'
+
+export const CLAUDE_API_RETRY_FRAME_KIND = 'message:system:api_retry'
+
+export function claudeApiRetryRowBody(message: Record<string, unknown>): AgentJournalStatusItem {
+  const retry = readProviderRetry({ error: message.error, status: message.error_status })
+  const words = agentSessionFailureWords(
+    agentSessionFailureFact('providerRetrying', {
+      detail: providerDiagnostic(JSON.stringify(message), 'log'),
+      ...(retry ? { retry } : {})
+    }),
+    { surface: 'row', agentName: TUI_AGENT_DISPLAY_NAMES.claude }
+  )
+  return { kind: 'status', tone: 'warning', ...words }
+}
+
+/** Numbers retry runs: a frame whose attempt does not follow the last one starts a new run. */
+export function createClaudeApiRetryRuns(): (message: Record<string, unknown>) => number {
+  let run = 0
+  let lastAttempt: number | null = null
+  return (message) => {
+    const attempt = typeof message.attempt === 'number' ? message.attempt : null
+    if (attempt === null || lastAttempt === null || attempt <= lastAttempt) {
+      run += 1
+    }
+    lastAttempt = attempt
+    return run
+  }
+}
diff --git a/src/main/claude/claude-context-usage-restart.test.ts b/src/main/claude/claude-context-usage-restart.test.ts
index 58f883ab06d8..cb0dff927c50 100644
--- a/src/main/claude/claude-context-usage-restart.test.ts
+++ b/src/main/claude/claude-context-usage-restart.test.ts
@@ -6,7 +6,7 @@ import { selectStructuredAgentContextUsage } from '../../shared/structured-agent
 import type { AgentSessionJournal } from '../native-chat/agent-session-journal/journal-store'
 import { createTrackedJournalOpener } from '../native-chat/agent-session-journal/journal-store-test-open'
 import { createDeferredStructuredAgentSessionEventSink } from '../native-chat/agent-session-wire/structured-agent-session-event-sink'
-import { settleStaleSessionStateOnAcquire } from '../native-chat/agent-session-wire/structured-agent-session-stale-turn-verdict'
+import { settleStaleStructuredAgentSessionState } from '../native-chat/agent-session-wire/structured-agent-session-dead-generation-settlement'
 import { readAgentJournalTurn } from '../../shared/agent-session-turn-record'
 import { bindClaudeContextUsageCapture } from './claude-context-usage'
 import { createClaudeJournalTranslator } from './claude-structured-journal-translation'
@@ -212,11 +212,12 @@ describe('context usage across a restart', () => {
     // The child dies with turn-b running; nothing ends it from the provider side.
     crashed.release()
 
-    await settleStaleSessionStateOnAcquire({
+    await settleStaleStructuredAgentSessionState({
       journal,
       sessionId: 'orca-session',
       fence: 2,
-      acquisitionGeneration: 'next'
+      acquisitionGeneration: 'next',
+      deathEvidence: null
     })
     const turns = journal.snapshot().items.map((item) => readAgentJournalTurn(item.body)?.state)
     expect(turns).toContain('unverifiable')
@@ -233,11 +234,12 @@ describe('context usage across a restart', () => {
     // The write is queued while the host settles the turn behind the sink's back.
     live.detach()
     live.translator.handle(assistantFrame('reply-a2', 3_000, 30_000))
-    await settleStaleSessionStateOnAcquire({
+    await settleStaleStructuredAgentSessionState({
       journal,
       sessionId: 'orca-session',
       fence: 1,
-      acquisitionGeneration: 'next'
+      acquisitionGeneration: 'next',
+      deathEvidence: null
     })
     live.reattach()
     await live.settle()
diff --git a/src/main/claude/claude-context-usage-unloaded-turn.test.ts b/src/main/claude/claude-context-usage-unloaded-turn.test.ts
index 83d9248f6489..b562c839efdb 100644
--- a/src/main/claude/claude-context-usage-unloaded-turn.test.ts
+++ b/src/main/claude/claude-context-usage-unloaded-turn.test.ts
@@ -18,10 +18,8 @@ import { createTrackedJournalOpener } from '../native-chat/agent-session-journal
 import { readAgentSessionHistory } from '../native-chat/agent-session-wire/agent-session-history-page'
 import type { StructuredAgentSessionAdapter } from '../native-chat/agent-session-wire/structured-agent-session-adapter'
 import { createDeferredStructuredAgentSessionEventSink } from '../native-chat/agent-session-wire/structured-agent-session-event-sink'
-import {
-  readStructuredAgentSessionOptions,
-  type StructuredAgentSessionMutationContext
-} from '../native-chat/agent-session-wire/structured-agent-session-host-mutations'
+import type { StructuredAgentSessionMutationContext } from '../native-chat/agent-session-wire/structured-agent-session-host-mutations'
+import { readStructuredAgentSessionOptions } from '../native-chat/agent-session-wire/structured-agent-session-options-read'
 import {
   assistantFrame,
   initFrame,
@@ -85,6 +83,11 @@ function readOptions(
   journal: AgentSessionJournal,
   adapter: Partial<StructuredAgentSessionAdapter>
 ) {
+  const running = {
+    journal,
+    child: { fence: 1, generation: 'generation-1' },
+    params: { provider: 'claude' }
+  }
   // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the options read touches only these members.
   const context = {
     deps: {
@@ -95,7 +98,8 @@ function readOptions(
       store: { getRecord: () => undefined }
     },
     serialize: (_sessionId: string, task: () => Promise<unknown>) => task(),
-    requireSession: () => ({ journal, fence: 1 })
+    openConversation: async () => running,
+    conversation: async () => running
   } as unknown as StructuredAgentSessionMutationContext
   return readStructuredAgentSessionOptions(context, SESSION)
 }
diff --git a/src/main/claude/claude-prompt-journaling.ts b/src/main/claude/claude-prompt-journaling.ts
index 99b163fe197a..6d3bfe148cf0 100644
--- a/src/main/claude/claude-prompt-journaling.ts
+++ b/src/main/claude/claude-prompt-journaling.ts
@@ -13,7 +13,7 @@ import {
 
 export type ClaudePromptJournalDeps = {
   sink: StructuredAgentSessionEventSink
-  bindPromptItemId?: (journalItemId: string, promptKey: string, questionId?: string) => void
+  bindPromptItemId?: (journalItemId: string, promptKey: string) => void
   /** Prompt key → the rows it wrote, owned by the translator so a cancel can sweep them. */
   promptItems: Map<string, AgentJournalItemIdentity[]>
 }
diff --git a/src/main/claude/claude-prompt-registry.ts b/src/main/claude/claude-prompt-registry.ts
index 3437dba93dcc..5cd2f6b1a7b9 100644
--- a/src/main/claude/claude-prompt-registry.ts
+++ b/src/main/claude/claude-prompt-registry.ts
@@ -26,7 +26,6 @@ export type ClaudePendingPrompt = ClaudePromptPresentation & {
   input: Record<string, unknown>
   suggestions: PermissionUpdate[]
   questionIds: readonly string[]
-  answers: Map<string, string | readonly string[]>
   settle: ClaudePromptSettle
   turnId?: string | null
 }
@@ -43,13 +42,12 @@ export type ClaudePromptRegistration = ClaudePromptPresentation & {
 
 type PromptBinding = {
   address: string
-  questionId?: string
   turnId: string | null
 }
 
 export type ClaudePromptClaim = {
   readonly itemId: string
-  readonly found: { prompt: ClaudePendingPrompt; questionId?: string }
+  readonly found: { prompt: ClaudePendingPrompt }
 }
 
 type ClaudePromptCancellationObservation = {
@@ -111,7 +109,6 @@ export class ClaudePromptRegistry {
       ...(registration.matchedAskRule ? { matchedAskRule: registration.matchedAskRule } : {}),
       ...(registration.subject ? { subject: registration.subject } : {}),
       questionIds: questions.map(questionId),
-      answers: new Map(),
       settle: registration.settle,
       turnId: registration.turnId ?? null
     }
@@ -130,26 +127,18 @@ export class ClaudePromptRegistry {
     return true
   }
 
-  bindJournalItemId(
-    journalItemId: string,
-    promptKey: string,
-    questionIdForItem?: string,
-    turnId: string | null = null
-  ): void {
+  bindJournalItemId(journalItemId: string, promptKey: string, turnId: string | null = null): void {
     const prompt = this.prompts.get(promptKey)
     this.journalBindings.set(journalItemId, {
       address: promptKey,
-      ...(questionIdForItem ? { questionId: questionIdForItem } : {}),
       turnId: turnId ?? prompt?.turnId ?? null
     })
   }
 
-  find(itemId: string): { prompt: ClaudePendingPrompt; questionId?: string } | null {
+  find(itemId: string): { prompt: ClaudePendingPrompt } | null {
     const binding = this.journalBindings.get(itemId)
     const prompt = this.prompts.get(binding?.address ?? itemId)
-    return prompt
-      ? { prompt, ...(binding?.questionId ? { questionId: binding.questionId } : {}) }
-      : null
+    return prompt ? { prompt } : null
   }
 
   claim(itemId: string, kind?: 'approval' | 'question'): ClaudePromptClaim | null {
@@ -168,8 +157,7 @@ export class ClaudePromptRegistry {
     if (!binding || !prompt || binding.turnId !== turnId || this.claims.has(prompt)) {
       return null
     }
-    const found = { prompt, ...(binding.questionId ? { questionId: binding.questionId } : {}) }
-    const claim = { itemId, found }
+    const claim = { itemId, found: { prompt } }
     this.claims.set(prompt, claim)
     return claim
   }
diff --git a/src/main/claude/claude-stream-json-connection.test.ts b/src/main/claude/claude-stream-json-connection.test.ts
index 51ffa085163d..946cf08e1c41 100644
--- a/src/main/claude/claude-stream-json-connection.test.ts
+++ b/src/main/claude/claude-stream-json-connection.test.ts
@@ -2,6 +2,7 @@ import { execFileSync } from 'node:child_process'
 import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
+import { providerDiagnosticOf } from '../../shared/agent-session-failure'
 import { afterEach, describe, expect, it, vi } from 'vitest'
 import { spawnProcess, type SpawnedProcess } from '../../shared/child-process/run-process'
 import { hasLiveClaudePtys } from '../claude-accounts/live-pty-gate'
@@ -592,6 +593,11 @@ describe('Claude stream-json connection', () => {
     await until(() => exit, 'the exit error')
     // The status and stderr are the only diagnostic a refused start leaves behind.
     expect((exit as unknown as Error).message).toMatch(/exited \(code 1\): claude: not signed in/)
+    // Kept apart from Orca's wording where it is composed, and marked as log text.
+    expect(providerDiagnosticOf(exit)).toEqual({
+      text: expect.stringMatching(/^\(code 1\)\n.*claude: not signed in/s),
+      audience: 'log'
+    })
     expect(connection.closed).toBe(true)
     // Stderr-triggered capture can win or lose the race with this real child's exit.
     const closed = await connection.close()
diff --git a/src/main/claude/claude-stream-json-connection.ts b/src/main/claude/claude-stream-json-connection.ts
index 1a2a65bca34f..486407c0137e 100644
--- a/src/main/claude/claude-stream-json-connection.ts
+++ b/src/main/claude/claude-stream-json-connection.ts
@@ -1,4 +1,5 @@
 import { randomUUID } from 'node:crypto'
+import { providerDiagnostic, withProviderDiagnostic } from '../../shared/agent-session-failure'
 import type * as ClaudeAgentSdk from '@anthropic-ai/claude-agent-sdk'
 import type { CanUseTool, OnUserDialog, SDKUserMessage } from '@anthropic-ai/claude-agent-sdk'
 import { spawnProcess } from '../../shared/child-process/run-process'
@@ -103,7 +104,12 @@ function exitError(stderrTail: string, status: ExitStatus | null, cause?: Error)
         ? ` (code ${status.code})`
         : ''
   const message = `claude stream-json exited${how}${detail ? `: ${detail}` : ''}`
-  return cause ? new Error(message, { cause }) : new Error(message)
+  // Written for a log, not a person: the chat keeps it behind Details.
+  const diagnostic = providerDiagnostic([how.trim(), detail].filter(Boolean).join('\n'), 'log')
+  return withProviderDiagnostic(
+    cause ? new Error(message, { cause }) : new Error(message),
+    diagnostic
+  )
 }
 
 export async function openClaudeStreamJsonConnection(
@@ -315,6 +321,11 @@ export async function openClaudeStreamJsonConnection(
       })
       inbox.fail(new Error('claude stream-json connection closed'))
       if (!proven) {
+        if (exited && tree.treeVerdict === 'live') {
+          console.warn('[claude-stream-json] root exited but a descendant survived the close:', {
+            pid: spawner.pid
+          })
+        }
         closePromise = null
         return false
       }
diff --git a/src/main/claude/claude-structured-acquisition-release.ts b/src/main/claude/claude-structured-acquisition-release.ts
index 6be06c86e93c..3df76971df16 100644
--- a/src/main/claude/claude-structured-acquisition-release.ts
+++ b/src/main/claude/claude-structured-acquisition-release.ts
@@ -35,8 +35,8 @@ export async function releaseClaudeAcquisition(input: {
   const retriedProof = firstProof || (await exit.connection.close())
   if (retriedProof) {
     await input.onExitProven?.(input.sessionId, exit)
-    // Keep the first-hand exit evidence indexed until the tree proof succeeds;
-    // a failed close must be retryable and cannot look like an absent session.
+    // Only a proven close drops the exit here. An unknown one stays indexed so it is retryable and
+    // cannot look like an absent session; an observed root exit is dropped by its own settlement.
     input.exits.delete(input.sessionId)
     return true
   }
diff --git a/src/main/claude/claude-structured-auth-parity.test.ts b/src/main/claude/claude-structured-auth-parity.test.ts
index ddc69366aadb..002240e4dd77 100644
--- a/src/main/claude/claude-structured-auth-parity.test.ts
+++ b/src/main/claude/claude-structured-auth-parity.test.ts
@@ -105,7 +105,10 @@ describe('claude structured auth parity with the terminal preflight', () => {
       resolverFor({ stripAuthEnv: true, overlay: { ANTHROPIC_API_KEY: 'sk-ant-CONFIGURED' } })({
         identity: IDENTITY
       })
-    ).rejects.toThrow(CLAUDE_AUTH_ENV_CONFLICT_MESSAGE)
+    ).rejects.toMatchObject({
+      message: CLAUDE_AUTH_ENV_CONFLICT_MESSAGE,
+      reason: 'managedAccountEnvOverride'
+    })
   })
 
   it('refuses an auth-like ANTHROPIC_CUSTOM_HEADERS override while a managed account is pinned', async () => {
@@ -114,7 +117,10 @@ describe('claude structured auth parity with the terminal preflight', () => {
         stripAuthEnv: true,
         overlay: { ANTHROPIC_CUSTOM_HEADERS: 'Authorization: Bearer sk-ant-CONFIGURED' }
       })({ identity: IDENTITY })
-    ).rejects.toThrow(CLAUDE_AUTH_ENV_CONFLICT_MESSAGE)
+    ).rejects.toMatchObject({
+      message: CLAUDE_AUTH_ENV_CONFLICT_MESSAGE,
+      reason: 'managedAccountEnvOverride'
+    })
   })
 
   it('still admits a non-auth env overlay under a managed account', async () => {
@@ -161,7 +167,10 @@ describe('claude structured auth parity with the terminal preflight', () => {
 
     await expect(
       resolverFor({ stripAuthEnv: true, authSwitchSettleTimeoutMs: 20 })({ identity: IDENTITY })
-    ).rejects.toThrow(CLAUDE_AUTH_SWITCH_IN_PROGRESS_MESSAGE)
+    ).rejects.toMatchObject({
+      message: CLAUDE_AUTH_SWITCH_IN_PROGRESS_MESSAGE,
+      reason: 'accountSwitchInProgress'
+    })
   })
 
   it('waits a settling account switch out rather than refusing a resolved launch', async () => {
@@ -183,7 +192,10 @@ describe('claude structured auth parity with the terminal preflight', () => {
 
     await expect(
       adapter.acquire({ identity: identityFor(), fence: 7, spawnToken: 'spawn-9' })
-    ).rejects.toThrow(CLAUDE_AUTH_SWITCH_IN_PROGRESS_MESSAGE)
+    ).rejects.toMatchObject({
+      message: CLAUDE_AUTH_SWITCH_IN_PROGRESS_MESSAGE,
+      reason: 'accountSwitchInProgress'
+    })
     // Nothing was spawned, so the refusal must not have opened a connection.
     expect(claude.connections).toHaveLength(0)
   })
@@ -227,7 +239,10 @@ describe('claude structured auth parity with the terminal preflight', () => {
 
     await expect(
       adapter.acquire({ identity: identityFor(), fence: 8, spawnToken: 'spawn-10' })
-    ).rejects.toThrow(CLAUDE_AUTH_SWITCH_IN_PROGRESS_MESSAGE)
+    ).rejects.toMatchObject({
+      message: CLAUDE_AUTH_SWITCH_IN_PROGRESS_MESSAGE,
+      reason: 'accountSwitchInProgress'
+    })
     // No replacement child was opened, so nothing is left running unowned.
     expect(claude.connections).toHaveLength(1)
     await adapter.closeAll()
diff --git a/src/main/claude/claude-structured-compaction.test.ts b/src/main/claude/claude-structured-compaction.test.ts
index 5255ce37ea14..70aabc5ae506 100644
--- a/src/main/claude/claude-structured-compaction.test.ts
+++ b/src/main/claude/claude-structured-compaction.test.ts
@@ -22,7 +22,7 @@ describe('Claude compaction transcript content', () => {
       }
     }
     expect(isClaudeCompactionContent(tracker, event)).toBe(false)
-    const completion = tracker.run('orca-session', 'provider', async () => ({}))
+    const completion = tracker.run('orca-session', 'provider', async () => undefined)
     expect(isClaudeCompactionContent(tracker, event)).toBe(true)
     expect(isClaudeCompactionContent(tracker, { ...event, sessionId: 'other' })).toBe(false)
     expect(isClaudeCompactionContent(tracker, { ...event, message: { type: 'result' } })).toBe(
@@ -46,7 +46,7 @@ describe('Claude compaction transcript content', () => {
 
     await vi.advanceTimersByTimeAsync(1)
 
-    await expect(pending).resolves.toEqual({ error: 'provider_write_failed: input closed' })
+    await expect(pending).resolves.toEqual({ outcome: 'failed' })
   })
 
   it('keeps waiting when the command write outcome is ambiguous', async () => {
diff --git a/src/main/claude/claude-structured-compaction.ts b/src/main/claude/claude-structured-compaction.ts
index 6c3155739c2f..5b1f67e2e118 100644
--- a/src/main/claude/claude-structured-compaction.ts
+++ b/src/main/claude/claude-structured-compaction.ts
@@ -1,5 +1,8 @@
 import type { ClaudeSession, ClaudeStructuredSessionEvent } from './claude-structured-session-state'
-import type { StructuredSessionCompaction } from '../native-chat/agent-session-wire/structured-session-compaction'
+import type {
+  StructuredSessionCompaction,
+  StructuredSessionCompactionResult
+} from '../native-chat/agent-session-wire/structured-session-compaction'
 import { dispatchClaudeTurn } from './claude-structured-dispatch'
 import type { StructuredAgentSessionAdapter } from '../native-chat/agent-session-wire/structured-agent-session-adapter'
 /** Compaction needs no ack deadline of its own: `compactions.run` keeps its own
@@ -9,7 +12,7 @@ export function compactClaudeSession(
   session: ClaudeSession,
   compactions: StructuredSessionCompaction,
   input: Parameters<NonNullable<StructuredAgentSessionAdapter['compact']>>[0]
-): Promise<{ error?: string }> {
+): Promise<StructuredSessionCompactionResult> {
   return compactions.run(
     input.sessionId,
     session.providerSessionId,
@@ -18,7 +21,7 @@ export function compactClaudeSession(
         body: { kind: 'message', role: 'user', blocks: [{ type: 'text', text: '/compact' }] }
       })
       if (result.state === 'rejected') {
-        return { error: result.reason }
+        return { outcome: 'failed' as const }
       }
       return undefined
     },
diff --git a/src/main/claude/claude-structured-control-actions.test.ts b/src/main/claude/claude-structured-control-actions.test.ts
index f92a04a80031..4aaf57bf54ca 100644
--- a/src/main/claude/claude-structured-control-actions.test.ts
+++ b/src/main/claude/claude-structured-control-actions.test.ts
@@ -6,7 +6,7 @@ import {
 } from './claude-structured-control-actions'
 import { dispatchClaudeTurn } from './claude-structured-dispatch'
 import { ClaudeControlRequestError } from './claude-stream-json-connection'
-import { ClaudePromptRegistry } from './claude-structured-prompt-replies'
+import { buildClaudePromptReply, ClaudePromptRegistry } from './claude-structured-prompt-replies'
 import type { ClaudeDispatchWaiter, ClaudeSession } from './claude-structured-session-state'
 import { ClaudeBackgroundTaskTracker } from './claude-background-task-tracker'
 import { sessionFor, userMessage } from './claude-structured-dispatch-test-support'
@@ -85,7 +85,8 @@ describe('cancelClaudeTurn', () => {
     expect(settled).toHaveBeenNthCalledWith(1, {
       clientMessageId: 'client-0',
       state: 'rejected',
-      reason: 'provider_cancelled_before_start'
+      reason: 'provider_cancelled_before_start',
+      rejection: { kind: 'cancelled' }
     })
   })
 
@@ -118,7 +119,8 @@ describe('cancelClaudeTurn', () => {
     expect(settled).toHaveBeenCalledWith({
       clientMessageId: 'client-ambiguous',
       state: 'rejected',
-      reason: 'provider_cancelled_before_start'
+      reason: 'provider_cancelled_before_start',
+      rejection: { kind: 'cancelled' }
     })
   })
 
@@ -214,7 +216,11 @@ describe('answerClaudePrompt', () => {
     if (!claim) {
       throw new Error('expected prompt claim')
     }
-    await answerClaudePrompt(session, claim, 'allow')
+    await answerClaudePrompt(
+      session,
+      claim,
+      buildClaudePromptReply(prompt, { kind: 'option', optionId: 'allow' })
+    )
 
     expect(settle).toHaveBeenCalledWith(
       expect.objectContaining({ behavior: 'allow', toolUseID: 'tool-1' })
diff --git a/src/main/claude/claude-structured-control-actions.ts b/src/main/claude/claude-structured-control-actions.ts
index 961b9aee7ba6..5e5906c4216c 100644
--- a/src/main/claude/claude-structured-control-actions.ts
+++ b/src/main/claude/claude-structured-control-actions.ts
@@ -1,4 +1,5 @@
-import { applyClaudePromptAnswer, type ClaudePromptClaim } from './claude-structured-prompt-replies'
+import type { PermissionResult } from '@anthropic-ai/claude-agent-sdk'
+import type { ClaudePromptClaim } from './claude-structured-prompt-replies'
 import { ClaudeControlRequestError } from './claude-stream-json-connection'
 import {
   settleCancelledClaudeDispatchWaiters,
@@ -83,17 +84,12 @@ export async function stopClaudeBackgroundTasks(
 export async function answerClaudePrompt(
   session: ClaudeSession,
   claim: ClaudePromptClaim,
-  optionId: string
+  reply: PermissionResult
 ): Promise<void> {
   if (!session.prompts.ownsClaim(claim)) {
     throw new Error(`claude is no longer waiting on ${claim.itemId}`)
   }
-  const response = applyClaudePromptAnswer(claim.found, optionId)
-  if (response === null) {
-    session.prompts.releaseClaim(claim)
-    return
-  }
   session.prompts.forget(claim.found.prompt)
-  claim.found.prompt.settle(response)
+  claim.found.prompt.settle(reply)
   session.translator?.journalPrompts.resolve(claim.found.prompt.promptKey)
 }
diff --git a/src/main/claude/claude-structured-dispatch-admission.test.ts b/src/main/claude/claude-structured-dispatch-admission.test.ts
index 9a4d60a824cf..75553addd3c7 100644
--- a/src/main/claude/claude-structured-dispatch-admission.test.ts
+++ b/src/main/claude/claude-structured-dispatch-admission.test.ts
@@ -139,7 +139,11 @@ describe('Claude structured dispatch admission', () => {
         clientMessageId: 'client-over-capacity',
         body: userMessage([{ type: 'text', text: 'one too many' }])
       })
-    ).resolves.toEqual({ state: 'rejected', reason: 'claude structured dispatch queue is full' })
+    ).resolves.toEqual({
+      state: 'rejected',
+      reason: 'claude structured dispatch queue is full',
+      rejection: { kind: 'queueFull' }
+    })
     expect(session.dispatchWaiters).toHaveLength(64)
     expect(session.connection.send).toHaveBeenCalledTimes(64)
   })
diff --git a/src/main/claude/claude-structured-dispatch-attachment-rejection.test.ts b/src/main/claude/claude-structured-dispatch-attachment-rejection.test.ts
new file mode 100644
index 000000000000..a23767c09681
--- /dev/null
+++ b/src/main/claude/claude-structured-dispatch-attachment-rejection.test.ts
@@ -0,0 +1,177 @@
+// What a person reads when Orca refuses a message's content before sending it.
+
+import { mkdtemp, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { describe, expect, it, vi } from 'vitest'
+import { dispatchClaudeTurn } from './claude-structured-dispatch'
+import { sessionFor, userMessage } from './claude-structured-dispatch-test-support'
+
+describe('Claude structured dispatch attachment rejections', () => {
+  it('rejects more than twenty URL images before sending', async () => {
+    const session = sessionFor()
+    const body = userMessage(
+      Array.from({ length: 21 }, (_, index) => ({
+        type: 'image-ref' as const,
+        url: `https://example.test/${index}.png`
+      }))
+    )
+
+    await expect(
+      dispatchClaudeTurn(session, { clientMessageId: 'client-1', body })
+    ).resolves.toEqual({
+      state: 'rejected',
+      reason: 'Claude accepts at most 20 images in one message, so this message was not sent.',
+      rejection: { kind: 'attachmentInvalid', attachment: { reason: 'tooMany', limit: 20 } }
+    })
+    expect(session.connection.send).not.toHaveBeenCalled()
+  })
+
+  it('rejects local images whose aggregate size exceeds twenty MiB', async () => {
+    const directory = await mkdtemp(join(tmpdir(), 'orca-claude-images-'))
+    try {
+      const paths = await Promise.all(
+        Array.from({ length: 5 }, async (_, index) => {
+          const path = join(directory, `${index}.png`)
+          await writeFile(path, Buffer.alloc(5 * 1024 * 1024))
+          return path
+        })
+      )
+      const session = sessionFor()
+      const body = userMessage(paths.map((path) => ({ type: 'image-ref' as const, path })))
+
+      await expect(
+        dispatchClaudeTurn(session, { clientMessageId: 'client-1', body })
+      ).resolves.toEqual({
+        state: 'rejected',
+        reason:
+          'The images on this message add up to more than 20 MB, so the message was not sent.',
+        rejection: {
+          kind: 'attachmentInvalid',
+          attachment: { reason: 'totalTooLarge', limit: 20 * 1024 * 1024 }
+        }
+      })
+      expect(session.connection.send).not.toHaveBeenCalled()
+    } finally {
+      await rm(directory, { recursive: true, force: true })
+    }
+  })
+
+  it('rejects a local image by actual bytes read beyond the per-image cap', async () => {
+    const directory = await mkdtemp(join(tmpdir(), 'orca-claude-image-'))
+    try {
+      const path = join(directory, 'oversized.png')
+      await writeFile(path, Buffer.alloc(5 * 1024 * 1024 + 1))
+      const session = sessionFor()
+      const body = userMessage([{ type: 'image-ref', path }])
+
+      await expect(
+        dispatchClaudeTurn(session, { clientMessageId: 'client-1', body })
+      ).resolves.toEqual({
+        state: 'rejected',
+        reason: 'An image on this message is larger than 5 MB, so the message was not sent.',
+        rejection: {
+          kind: 'attachmentInvalid',
+          attachment: { reason: 'tooLarge', limit: 5 * 1024 * 1024 }
+        }
+      })
+      expect(session.connection.send).not.toHaveBeenCalled()
+    } finally {
+      await rm(directory, { recursive: true, force: true })
+    }
+  })
+
+  it('names an empty image as empty, not as too large', async () => {
+    const directory = await mkdtemp(join(tmpdir(), 'orca-claude-image-'))
+    try {
+      const path = join(directory, 'empty.png')
+      await writeFile(path, Buffer.alloc(0))
+      const session = sessionFor()
+
+      await expect(
+        dispatchClaudeTurn(session, {
+          clientMessageId: 'client-1',
+          body: userMessage([{ type: 'image-ref', path }])
+        })
+      ).resolves.toEqual({
+        state: 'rejected',
+        reason: 'An image on this message is empty, so the message was not sent.',
+        rejection: { kind: 'attachmentInvalid', attachment: { reason: 'empty' } }
+      })
+    } finally {
+      await rm(directory, { recursive: true, force: true })
+    }
+  })
+
+  it('names an unsupported image type in words a person can act on', async () => {
+    const directory = await mkdtemp(join(tmpdir(), 'orca-claude-image-'))
+    try {
+      const path = join(directory, 'picture.bmp')
+      await writeFile(path, Buffer.alloc(64))
+      const session = sessionFor()
+
+      await expect(
+        dispatchClaudeTurn(session, {
+          clientMessageId: 'client-1',
+          body: userMessage([{ type: 'image-ref', path }])
+        })
+      ).resolves.toEqual({
+        state: 'rejected',
+        reason:
+          'Claude accepts only PNG, JPEG, GIF, and WebP images, so this message was not sent.',
+        rejection: { kind: 'attachmentInvalid', attachment: { reason: 'unsupportedType' } }
+      })
+    } finally {
+      await rm(directory, { recursive: true, force: true })
+    }
+  })
+
+  it('does not blame an attachment for a message no Orca client sends', async () => {
+    const session = sessionFor()
+    await expect(
+      dispatchClaudeTurn(session, {
+        clientMessageId: 'client-1',
+        body: userMessage([{ type: 'text', text: '' }])
+      })
+    ).resolves.toEqual({
+      state: 'rejected',
+      reason: 'This message is empty, so it was not sent.',
+      rejection: { kind: 'emptyMessage' }
+    })
+    await expect(
+      dispatchClaudeTurn(session, {
+        clientMessageId: 'client-2',
+        body: { ...userMessage([{ type: 'text', text: 'hi' }]), role: 'assistant' }
+      })
+    ).resolves.toEqual({
+      state: 'rejected',
+      reason: "Orca ran into a problem, so this didn't go through. Try again.",
+      rejection: { kind: 'hostFault' }
+    })
+    expect(session.connection.send).not.toHaveBeenCalled()
+  })
+
+  it('rejects an attachment it cannot read with the generic sentence and no path', async () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+    const session = sessionFor()
+    const path = join(tmpdir(), 'orca-claude-image-missing', 'gone.png')
+
+    await expect(
+      dispatchClaudeTurn(session, {
+        clientMessageId: 'client-1',
+        body: userMessage([{ type: 'image-ref', path }])
+      })
+    ).resolves.toEqual({
+      state: 'rejected',
+      reason: "An attachment on this message couldn't be read, so the message was not sent.",
+      rejection: { kind: 'attachmentUnreadable' }
+    })
+    expect(session.connection.send).not.toHaveBeenCalled()
+    // The row drops the error, so the log is the only place left to find why.
+    expect(warn).toHaveBeenCalledWith(
+      '[claude-dispatch] attachment could not be read:',
+      expect.objectContaining({ code: 'ENOENT' })
+    )
+    warn.mockRestore()
+  })
+})
diff --git a/src/main/claude/claude-structured-dispatch-content.ts b/src/main/claude/claude-structured-dispatch-content.ts
index 7df84091b7cc..035b0a594926 100644
--- a/src/main/claude/claude-structured-dispatch-content.ts
+++ b/src/main/claude/claude-structured-dispatch-content.ts
@@ -3,11 +3,63 @@ import { open } from 'node:fs/promises'
 import { extname } from 'node:path'
 import type { AgentJournalMessageItem } from '../../shared/agent-session-journal-types'
 import type { NativeChatBlock } from '../../shared/native-chat-types'
+import {
+  agentSessionFailureFact,
+  type AgentSessionAttachmentProblem,
+  type SubmissionRejectionFact
+} from '../../shared/agent-session-failure'
+import {
+  agentSessionFailureWords,
+  type AgentJournalDispatchRejection
+} from '../../shared/agent-session-failure-words'
+import { TUI_AGENT_DISPLAY_NAMES } from '../../shared/tui-agent-display-names'
 import { claudeRecord } from './claude-structured-item-translation'
 
-const MAX_IMAGE_BYTES = 5 * 1024 * 1024
+/** Orca refused the message's content, as opposed to failing to read an attachment. */
+export class ClaudeDispatchContentError extends Error {
+  /** What was wrong, typed where the check saw it; `message` stays for logs. */
+  readonly failure: SubmissionRejectionFact
+
+  constructor(message: string, failure: SubmissionRejectionFact) {
+    super(message)
+    this.name = 'ClaudeDispatchContentError'
+    this.failure = failure
+  }
+}
+
+function attachmentError(message: string, attachment: AgentSessionAttachmentProblem): Error {
+  return new ClaudeDispatchContentError(
+    message,
+    agentSessionFailureFact('attachmentInvalid', { attachment })
+  )
+}
+
+/** A message Claude rejected, in the words that name Claude and its legacy markers. */
+export function claudeDispatchRejection(
+  failure: SubmissionRejectionFact
+): AgentJournalDispatchRejection {
+  return agentSessionFailureWords(failure, {
+    surface: 'rejection',
+    agentName: TUI_AGENT_DISPLAY_NAMES.claude,
+    provider: 'claude'
+  })
+}
+
+/** Why a message whose content could not be built was not sent: Orca's own refusal of it, or an
+ *  attachment it could not read. Never the provider. */
+export function claudeDispatchContentRejection(error: unknown): AgentJournalDispatchRejection {
+  if (error instanceof ClaudeDispatchContentError) {
+    return claudeDispatchRejection(error.failure)
+  }
+  // The row says only that it could not be read; why belongs in the log.
+  console.warn('[claude-dispatch] attachment could not be read:', error)
+  return claudeDispatchRejection(agentSessionFailureFact('attachmentUnreadable'))
+}
+
+const BYTES_PER_MB = 1024 * 1024
+const MAX_IMAGE_BYTES = 5 * BYTES_PER_MB
 const MAX_IMAGE_COUNT = 20
-const MAX_TOTAL_IMAGE_BYTES = 20 * 1024 * 1024
+const MAX_TOTAL_IMAGE_BYTES = 20 * BYTES_PER_MB
 const MAX_REPLAY_CONTENT_KEY_BYTES = 256
 
 type ImageBudget = {
@@ -18,14 +70,17 @@ type ImageBudget = {
 export async function readClaudeImage(path: string, openImpl: typeof open = open): Promise<Buffer> {
   const file = await openImpl(path, 'r')
   try {
-    const invalidImage = (): Error =>
-      new Error(`Claude image must be a non-empty file no larger than ${MAX_IMAGE_BYTES} bytes`)
+    const tooLarge = (): Error =>
+      attachmentError(`Claude image must be no larger than ${MAX_IMAGE_BYTES} bytes`, {
+        reason: 'tooLarge',
+        limit: MAX_IMAGE_BYTES
+      })
     const info = await file.stat()
     if (!info.isFile()) {
-      throw new Error('Claude image must be a file')
+      throw attachmentError('Claude image must be a file', { reason: 'notAFile' })
     }
     if (info.size > MAX_IMAGE_BYTES) {
-      throw invalidImage()
+      throw tooLarge()
     }
     const buffer = Buffer.allocUnsafe(info.size + 1)
     let bytesRead = 0
@@ -39,8 +94,15 @@ export async function readClaudeImage(path: string, openImpl: typeof open = open
     // A file can grow after the initial stat and after the final read returns
     // zero. Prove the descriptor's size matches what was copied before sending.
     const finalInfo = await file.stat()
-    if (bytesRead === 0 || bytesRead > MAX_IMAGE_BYTES || finalInfo.size !== bytesRead) {
-      throw invalidImage()
+    if (bytesRead > MAX_IMAGE_BYTES) {
+      throw tooLarge()
+    }
+    if (finalInfo.size !== bytesRead) {
+      // Not the image's fault: it changed while Orca read it, so it reads as unreadable.
+      throw new Error('Claude image changed while it was read')
+    }
+    if (bytesRead === 0) {
+      throw attachmentError('Claude image must be a non-empty file', { reason: 'empty' })
     }
     return buffer.subarray(0, bytesRead)
   } finally {
@@ -62,22 +124,30 @@ async function imageContent(
 ): Promise<unknown> {
   budget.count += 1
   if (budget.count > MAX_IMAGE_COUNT) {
-    throw new Error(`Claude messages support at most ${MAX_IMAGE_COUNT} images`)
+    throw attachmentError(`Claude messages support at most ${MAX_IMAGE_COUNT} images`, {
+      reason: 'tooMany',
+      limit: MAX_IMAGE_COUNT
+    })
   }
   if (block.url) {
     return { type: 'image', source: { type: 'url', url: block.url } }
   }
   if (!block.path) {
-    throw new Error('image reference has neither a path nor a URL')
+    throw attachmentError('image reference has neither a path nor a URL', { reason: 'noSource' })
   }
   const data = await readClaudeImage(block.path)
   budget.localBytes += data.byteLength
   if (budget.localBytes > MAX_TOTAL_IMAGE_BYTES) {
-    throw new Error(`Claude images must total no more than ${MAX_TOTAL_IMAGE_BYTES} bytes`)
+    throw attachmentError(`Claude images must total no more than ${MAX_TOTAL_IMAGE_BYTES} bytes`, {
+      reason: 'totalTooLarge',
+      limit: MAX_TOTAL_IMAGE_BYTES
+    })
   }
   const mediaType = IMAGE_MIME_BY_EXTENSION[extname(block.path).toLowerCase()]
   if (!mediaType) {
-    throw new Error(`Claude does not support the image type ${extname(block.path)}`)
+    throw attachmentError(`Claude does not support the image type ${extname(block.path)}`, {
+      reason: 'unsupportedType'
+    })
   }
   return {
     type: 'image',
@@ -99,7 +169,11 @@ export async function claudeDispatchMessageContent(
   body: AgentJournalMessageItem
 ): Promise<unknown[]> {
   if (body.role !== 'user') {
-    throw new Error('Claude dispatch accepts only user messages')
+    // No Orca client sends one, so the fault is Orca's.
+    throw new ClaudeDispatchContentError(
+      'Claude dispatch accepts only user messages',
+      agentSessionFailureFact('hostFault')
+    )
   }
   const images: unknown[] = []
   const texts: string[] = []
@@ -115,7 +189,10 @@ export async function claudeDispatchMessageContent(
   // text blocks would silently discard every one but the last.
   const content = texts.length > 0 ? [...images, { type: 'text', text: texts.join('\n') }] : images
   if (content.length === 0) {
-    throw new Error('Claude dispatch requires text or an image')
+    throw new ClaudeDispatchContentError(
+      'Claude dispatch requires text or an image',
+      agentSessionFailureFact('emptyMessage')
+    )
   }
   return content
 }
diff --git a/src/main/claude/claude-structured-dispatch-test-support.ts b/src/main/claude/claude-structured-dispatch-test-support.ts
index a309bd9d0b98..5af0f17243b5 100644
--- a/src/main/claude/claude-structured-dispatch-test-support.ts
+++ b/src/main/claude/claude-structured-dispatch-test-support.ts
@@ -5,7 +5,7 @@ import type { ClaudeSession } from './claude-structured-session-state'
 import { ClaudeBackgroundTaskTracker } from './claude-background-task-tracker'
 import { ClaudeChildWorkDecoder } from './claude-child-work-decoder'
 import { ClaudeSlashCommandCatalog } from './claude-slash-command-catalog'
-import { createClaudeSessionStartupGate } from './claude-structured-session-startup-gate'
+import { createClaudeSessionStartup } from './claude-structured-session-startup-state'
 
 export function sessionFor(send: Mock = vi.fn().mockResolvedValue(undefined)): ClaudeSession {
   return {
@@ -32,7 +32,7 @@ export function sessionFor(send: Mock = vi.fn().mockResolvedValue(undefined)): C
     capabilities: [],
     events: undefined,
     translator: null,
-    startup: { ...createClaudeSessionStartupGate(), state: 'proven' }
+    startup: { ...createClaudeSessionStartup(), state: 'proven' }
   }
 }
 
diff --git a/src/main/claude/claude-structured-dispatch.test.ts b/src/main/claude/claude-structured-dispatch.test.ts
index 1945ac3531d1..c540167de4c2 100644
--- a/src/main/claude/claude-structured-dispatch.test.ts
+++ b/src/main/claude/claude-structured-dispatch.test.ts
@@ -3,7 +3,7 @@ import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { describe, expect, it, vi } from 'vitest'
 import { dispatchClaudeTurn, resolveClaudeReplayTurn } from './claude-structured-dispatch'
-import { readClaudeImage } from './claude-structured-dispatch-content'
+import { ClaudeDispatchContentError, readClaudeImage } from './claude-structured-dispatch-content'
 import { claudeUnwrittenUserMessageError } from './claude-agent-sdk-user-message-queue'
 import type { ClaudeSession } from './claude-structured-session-state'
 import {
@@ -379,7 +379,11 @@ describe('Claude structured dispatch image limits', () => {
         clientMessageId: 'client-2',
         body: userMessage([{ type: 'text', text: 'two' }])
       })
-    ).resolves.toEqual({ state: 'rejected', reason: 'provider_write_failed: broken pipe' })
+    ).resolves.toEqual({
+      state: 'rejected',
+      reason: 'provider_write_failed',
+      rejection: { kind: 'writeFailed' }
+    })
     expect(session.dispatchWaiters).toEqual([firstWaiter])
 
     const firstUuid = (firstWaiter as { sentUuid?: string }).sentUuid
@@ -392,6 +396,7 @@ describe('Claude structured dispatch image limits', () => {
   })
 
   it('does not let a provably unwritten attempt block retry correlation', async () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
     const send = vi
       .fn()
       .mockRejectedValueOnce(claudeUnwrittenUserMessageError(new Error('broken pipe')))
@@ -401,7 +406,17 @@ describe('Claude structured dispatch image limits', () => {
 
     await expect(
       dispatchClaudeTurn(session, { clientMessageId: 'client-1', body })
-    ).resolves.toEqual({ state: 'rejected', reason: 'provider_write_failed: broken pipe' })
+    ).resolves.toEqual({
+      state: 'rejected',
+      reason: 'provider_write_failed',
+      rejection: { kind: 'writeFailed' }
+    })
+    // The row keeps only the marker; why the write failed goes to the log.
+    expect(warn).toHaveBeenCalledWith(
+      '[claude-dispatch] message could not be handed to Claude:',
+      expect.objectContaining({ message: expect.stringContaining('broken pipe') })
+    )
+    warn.mockRestore()
     expect(session.dispatchWaiters).toHaveLength(0)
     expect(session.retiredDispatchWaiters).toHaveLength(0)
 
@@ -684,66 +699,6 @@ describe('Claude structured dispatch image limits', () => {
     })
   })
 
-  it('rejects more than twenty URL images before sending', async () => {
-    const session = sessionFor()
-    const body = userMessage(
-      Array.from({ length: 21 }, (_, index) => ({
-        type: 'image-ref' as const,
-        url: `https://example.test/${index}.png`
-      }))
-    )
-
-    await expect(
-      dispatchClaudeTurn(session, { clientMessageId: 'client-1', body })
-    ).resolves.toEqual({ state: 'rejected', reason: 'Claude messages support at most 20 images' })
-    expect(session.connection.send).not.toHaveBeenCalled()
-  })
-
-  it('rejects local images whose aggregate size exceeds twenty MiB', async () => {
-    const directory = await mkdtemp(join(tmpdir(), 'orca-claude-images-'))
-    try {
-      const paths = await Promise.all(
-        Array.from({ length: 5 }, async (_, index) => {
-          const path = join(directory, `${index}.png`)
-          await writeFile(path, Buffer.alloc(5 * 1024 * 1024))
-          return path
-        })
-      )
-      const session = sessionFor()
-      const body = userMessage(paths.map((path) => ({ type: 'image-ref' as const, path })))
-
-      await expect(
-        dispatchClaudeTurn(session, { clientMessageId: 'client-1', body })
-      ).resolves.toEqual({
-        state: 'rejected',
-        reason: `Claude images must total no more than ${20 * 1024 * 1024} bytes`
-      })
-      expect(session.connection.send).not.toHaveBeenCalled()
-    } finally {
-      await rm(directory, { recursive: true, force: true })
-    }
-  })
-
-  it('rejects a local image by actual bytes read beyond the per-image cap', async () => {
-    const directory = await mkdtemp(join(tmpdir(), 'orca-claude-image-'))
-    try {
-      const path = join(directory, 'oversized.png')
-      await writeFile(path, Buffer.alloc(5 * 1024 * 1024 + 1))
-      const session = sessionFor()
-      const body = userMessage([{ type: 'image-ref', path }])
-
-      await expect(
-        dispatchClaudeTurn(session, { clientMessageId: 'client-1', body })
-      ).resolves.toEqual({
-        state: 'rejected',
-        reason: `Claude image must be a non-empty file no larger than ${5 * 1024 * 1024} bytes`
-      })
-      expect(session.connection.send).not.toHaveBeenCalled()
-    } finally {
-      await rm(directory, { recursive: true, force: true })
-    }
-  })
-
   it('allocates local image reads from the file size, not the maximum cap', async () => {
     const directory = await mkdtemp(join(tmpdir(), 'orca-claude-image-'))
     const allocUnsafe = vi.spyOn(Buffer, 'allocUnsafe')
@@ -821,8 +776,11 @@ describe('Claude structured dispatch image limits', () => {
       read,
       close: vi.fn().mockResolvedValue(undefined)
     } as never)
-    await expect(readClaudeImage('/controlled/growing.png', open)).rejects.toThrow(
-      `Claude image must be a non-empty file no larger than ${5 * 1024 * 1024} bytes`
+    // It changed while Orca read it: unreadable, never a limit the image did not break.
+    const rejected = await readClaudeImage('/controlled/growing.png', open).catch(
+      (error: unknown) => error
     )
+    expect(rejected).not.toBeInstanceOf(ClaudeDispatchContentError)
+    expect(rejected).toMatchObject({ message: 'Claude image changed while it was read' })
   })
 })
diff --git a/src/main/claude/claude-structured-dispatch.ts b/src/main/claude/claude-structured-dispatch.ts
index d93a8ecab0a3..220542fab91b 100644
--- a/src/main/claude/claude-structured-dispatch.ts
+++ b/src/main/claude/claude-structured-dispatch.ts
@@ -19,26 +19,24 @@ import type {
 import { readClaudeFrameString } from './claude-structured-init-proof'
 import {
   claudeDispatchContentKey,
+  claudeDispatchContentRejection,
   claudeDispatchInvokesSlashCommand,
-  claudeDispatchMessageContent
+  claudeDispatchMessageContent,
+  claudeDispatchRejection
 } from './claude-structured-dispatch-content'
 import { dispatchWriteOutcomeUnknownReason } from '../native-chat/agent-session-journal/journal-dispatch-doubt-reasons'
-import {
-  DISPATCH_REJECTED_CANCELLED,
-  DISPATCH_REJECTED_QUEUE_FULL,
-  dispatchWriteFailureReason
-} from '../../shared/structured-agent-session-dispatch-rejection'
+import { DISPATCH_REJECTED_QUEUE_FULL } from '../../shared/structured-agent-session-dispatch-rejection'
+import { agentSessionFailureFact } from '../../shared/agent-session-failure'
+import type { AgentJournalDispatchRejection } from '../../shared/agent-session-failure-words'
 import {
   claudeUnwrittenUserMessageError,
   claudeUserMessageWasProvablyUnwritten
 } from './claude-agent-sdk-user-message-queue'
 import { AgentSessionPreDispatchError } from '../native-chat/agent-session-wire/structured-agent-session-operation-settlement'
 import {
-  claudeStartupFailureReason,
-  claudeStartupHoldsWrites,
-  failClaudeStartupGate,
-  holdClaudeStartupWrite
-} from './claude-structured-session-startup-gate'
+  claudeStartupFailureFact,
+  failClaudeStartup
+} from './claude-structured-session-startup-state'
 
 const MAX_ACTIVE_DISPATCH_WAITERS = 64
 
@@ -216,7 +214,7 @@ export function settleCancelledClaudeDispatchWaiters(
       onSettledLate?.({
         clientMessageId: waiter.clientMessageId,
         state: 'rejected',
-        reason: DISPATCH_REJECTED_CANCELLED
+        ...claudeDispatchRejection(agentSessionFailureFact('cancelled'))
       })
     }
   }
@@ -226,31 +224,36 @@ export function settleCancelledClaudeDispatchWaiters(
  *  Retired rather than dropped: their identities stay joinable, bounded by
  *  `MAX_RETIRED_DISPATCH_WAITERS`. */
 export function retireClaudeDispatchWaiters(session: ClaudeSession): void {
-  failClaudeStartupGate(session, new Error('claude stream-json ended before startup completed'))
+  failClaudeStartup(session, new Error('claude stream-json ended before startup completed'))
   for (const waiter of session.dispatchWaiters.splice(0)) {
     retireWaiter(session, waiter)
     waiter.resolve(null)
   }
 }
 
+/** The row keeps only the marker released clients hide; why the write failed belongs in the log. */
+function claudeWriteFailureRejection(error: unknown): AgentJournalDispatchRejection {
+  console.warn('[claude-dispatch] message could not be handed to Claude:', error)
+  return claudeDispatchRejection(agentSessionFailureFact('writeFailed'))
+}
+
 export async function dispatchClaudeTurn(
   session: ClaudeSession,
   input: { clientMessageId?: string; body: AgentJournalMessageItem; requestedAt?: number },
-  beforeDispatch?: () => Promise<void>,
-  onSettledLate?: ClaudeLateDispatchSettlement
+  beforeDispatch?: () => Promise<void>
 ): Promise<AgentSessionDispatchOutcome> {
   let content: unknown[]
   try {
     content = await claudeDispatchMessageContent(input.body)
   } catch (error) {
-    return { state: 'rejected', reason: (error as Error).message }
+    return { state: 'rejected', ...claudeDispatchContentRejection(error) }
   }
   if (session.dispatchWaiters.length >= MAX_ACTIVE_DISPATCH_WAITERS) {
-    return { state: 'rejected', reason: DISPATCH_REJECTED_QUEUE_FULL }
+    return { state: 'rejected', ...claudeDispatchRejection(agentSessionFailureFact('queueFull')) }
   }
-  const startupFailure = claudeStartupFailureReason(session)
+  const startupFailure = claudeStartupFailureFact(session)
   if (startupFailure) {
-    return { state: 'rejected', reason: startupFailure }
+    return { state: 'rejected', ...claudeDispatchRejection(startupFailure) }
   }
   // Read the sent content, not the journal blocks: only the mapped trailing prompt decides
   // whether Claude runs a command, so the two cannot disagree about which frame settles this.
@@ -276,14 +279,6 @@ export async function dispatchClaudeTurn(
     parent_tool_use_id: null,
     session_id: session.providerSessionId
   }
-  if (claudeStartupHoldsWrites(session)) {
-    return holdClaudeStartupWrite(session, {
-      message,
-      arm,
-      ...(beforeDispatch ? { beforeDispatch } : {}),
-      ...(onSettledLate ? { settleLate: onSettledLate } : {})
-    })
-  }
   const pending = { replay: beforeDispatch ? undefined : arm() }
   const authorize = beforeDispatch
     ? async () => {
@@ -304,7 +299,7 @@ export async function dispatchClaudeTurn(
       if (error instanceof AgentSessionPreDispatchError) {
         throw error
       }
-      return { state: 'rejected', reason: dispatchWriteFailureReason(error) }
+      return { state: 'rejected', ...claudeWriteFailureRejection(error) }
     }
     const waiter = replay.waiter
     if (waiter.settledUuid) {
@@ -322,7 +317,7 @@ export async function dispatchClaudeTurn(
       waiter.resolve(null)
       // The frame was never handed to the SDK's input pump, so this is not doubt:
       // the message provably did not happen, which is what `rejected` means.
-      return { state: 'rejected', reason: dispatchWriteFailureReason(error) }
+      return { state: 'rejected', ...claudeWriteFailureRejection(error) }
     }
     if (!waiter.retired) {
       retireWaiter(session, waiter)
diff --git a/src/main/claude/claude-structured-inbound-control.test.ts b/src/main/claude/claude-structured-inbound-control.test.ts
index 20d0b9dd06a5..43c96ee8bea3 100644
--- a/src/main/claude/claude-structured-inbound-control.test.ts
+++ b/src/main/claude/claude-structured-inbound-control.test.ts
@@ -41,10 +41,12 @@ function callbacksFor() {
 describe('Claude permission callbacks', () => {
   it('registers a decodable can_use_tool as a durable prompt and settles it from the registry', async () => {
     const control = callbacksFor()
+    const controller = new AbortController()
+    const removeListener = vi.spyOn(controller.signal, 'removeEventListener')
     const answered = control.canUseTool(
       'Bash',
       { command: 'git status' },
-      permissionOptions('perm-1', 'tool-1', new AbortController().signal, [
+      permissionOptions('perm-1', 'tool-1', controller.signal, [
         { type: 'addRules', rules: [], behavior: 'allow', destination: 'session' }
       ])
     )
@@ -63,6 +65,7 @@ describe('Claude permission callbacks', () => {
     // The prompt's settle is the SDK callback's own resolve — answering resolves this promise.
     found?.prompt.settle({ behavior: 'allow', toolUseID: 'tool-1' })
     await expect(answered).resolves.toEqual({ behavior: 'allow', toolUseID: 'tool-1' })
+    expect(removeListener).toHaveBeenCalledTimes(1)
   })
 
   it('keeps the SDK permission presentation and strips terminal escapes', async () => {
diff --git a/src/main/claude/claude-structured-inbound-control.ts b/src/main/claude/claude-structured-inbound-control.ts
index 8d2954f028f8..b2bed91f1f45 100644
--- a/src/main/claude/claude-structured-inbound-control.ts
+++ b/src/main/claude/claude-structured-inbound-control.ts
@@ -56,6 +56,11 @@ export function buildClaudePermissionCallbacks(deps: ClaudePermissionCallbackDep
 } {
   const canUseTool: CanUseTool = (toolName, input, options) =>
     new Promise<PermissionResult | null>((resolve) => {
+      let cancel = (): void => {}
+      const settle = (response: PermissionResult | null): void => {
+        options.signal.removeEventListener('abort', cancel)
+        resolve(response)
+      }
       // Classify first so later permission-mode policy cannot swallow a plan proposal.
       const subject = claudePermissionSubject(toolName, input)
       const prompt = deps.prompts.register({
@@ -66,14 +71,14 @@ export function buildClaudePermissionCallbacks(deps: ClaudePermissionCallbackDep
         toolUseId: options.toolUseID,
         input,
         suggestions: options.suggestions ?? [],
-        settle: resolve,
+        settle,
         turnId: deps.currentTurnId?.() ?? null
       })
       if (!prompt) {
-        resolve(denySafeResult(options.toolUseID))
+        settle(denySafeResult(options.toolUseID))
         return
       }
-      const cancel = (): void => {
+      cancel = (): void => {
         if (deps.prompts.forgetIfPending(prompt)) {
           deps.emit({
             type: 'prompt-cancelled',
@@ -82,7 +87,7 @@ export function buildClaudePermissionCallbacks(deps: ClaudePermissionCallbackDep
           })
           // Null is the SDK's "no response written" sentinel: a cancelled request must not
           // be answered, only forgotten.
-          resolve(null)
+          settle(null)
         }
       }
       if (options.signal.aborted) {
diff --git a/src/main/claude/claude-structured-init-proof.ts b/src/main/claude/claude-structured-init-proof.ts
index c29cb2d4715b..0d4af831ea99 100644
--- a/src/main/claude/claude-structured-init-proof.ts
+++ b/src/main/claude/claude-structured-init-proof.ts
@@ -64,7 +64,8 @@ export function claudeInitializationAuthError(
     isRecord(initialization) && isRecord(initialization.account) ? initialization.account : null
   return readClaudeFrameString(account ?? {}, 'tokenSource') === 'none'
     ? new AgentSessionAcquisitionRefusal(
-        'Claude is not signed in for the selected account. Sign in with the Claude CLI for this CLAUDE_CONFIG_DIR, then retry.'
+        'Claude is not signed in for the selected account. Sign in with the Claude CLI for this CLAUDE_CONFIG_DIR, then retry.',
+        'notSignedIn'
       )
     : null
 }
diff --git a/src/main/claude/claude-structured-journal-prompt-retry.test.ts b/src/main/claude/claude-structured-journal-prompt-retry.test.ts
index 491152668edc..d22362467e9f 100644
--- a/src/main/claude/claude-structured-journal-prompt-retry.test.ts
+++ b/src/main/claude/claude-structured-journal-prompt-retry.test.ts
@@ -18,7 +18,6 @@ function approval(promptKey: string): ClaudePendingPrompt {
     input: { command: 'git status' },
     suggestions: [],
     questionIds: [],
-    answers: new Map(),
     settle: () => {}
   }
 }
diff --git a/src/main/claude/claude-structured-journal-prompts.ts b/src/main/claude/claude-structured-journal-prompts.ts
index 0d2509723f6a..73dd35071bae 100644
--- a/src/main/claude/claude-structured-journal-prompts.ts
+++ b/src/main/claude/claude-structured-journal-prompts.ts
@@ -54,7 +54,7 @@ export class ClaudeJournalPrompts {
   constructor(
     private readonly deps: {
       sink: StructuredAgentSessionEventSink
-      bindPromptItemId?: (journalItemId: string, promptKey: string, questionId?: string) => void
+      bindPromptItemId?: (journalItemId: string, promptKey: string) => void
       questionItems?: (input: {
         sessionId: string
         prompt: Extract<ClaudeStructuredSessionEvent, { type: 'prompt' }>['prompt']
diff --git a/src/main/claude/claude-structured-journal-translation.test.ts b/src/main/claude/claude-structured-journal-translation.test.ts
index 574547ee731d..d868b3816c4b 100644
--- a/src/main/claude/claude-structured-journal-translation.test.ts
+++ b/src/main/claude/claude-structured-journal-translation.test.ts
@@ -869,7 +869,6 @@ function prompt(
   return {
     ...input,
     suggestions: [],
-    answers: new Map(),
     settle: () => {}
   }
 }
diff --git a/src/main/claude/claude-structured-journal-translation.ts b/src/main/claude/claude-structured-journal-translation.ts
index c18392e1aa94..16c054945a16 100644
--- a/src/main/claude/claude-structured-journal-translation.ts
+++ b/src/main/claude/claude-structured-journal-translation.ts
@@ -38,7 +38,7 @@ export type { ClaudeJournalTranslator } from './claude-journal-translator-contra
 
 export type ClaudeJournalTranslatorDeps = {
   sink: StructuredAgentSessionEventSink
-  bindPromptItemId?: (journalItemId: string, promptKey: string, questionId?: string) => void
+  bindPromptItemId?: (journalItemId: string, promptKey: string) => void
   coalesceMs?: number
   schedule?: AgentSessionDeltaCoalescerDeps['schedule']
   fallbackIdPrefix?: string
@@ -56,8 +56,7 @@ export function createClaudeSessionJournalTranslator(
         sink,
         fallbackIdPrefix,
         ...(onBackgroundTaskJournalFailure ? { onBackgroundTaskJournalFailure } : {}),
-        bindPromptItemId: (itemId, promptKey, questionId) =>
-          prompts.bindJournalItemId(itemId, promptKey, questionId)
+        bindPromptItemId: (itemId, promptKey) => prompts.bindJournalItemId(itemId, promptKey)
       })
     : null
 }
diff --git a/src/main/claude/claude-structured-launch-resolution.test.ts b/src/main/claude/claude-structured-launch-resolution.test.ts
index c54d1a5179f3..3d7592c8406a 100644
--- a/src/main/claude/claude-structured-launch-resolution.test.ts
+++ b/src/main/claude/claude-structured-launch-resolution.test.ts
@@ -492,16 +492,17 @@ describe('claude structured launch resolution', () => {
 
       gate = WSL_ONLY_NORMALIZED
 
-      // Reacquire after the account state changed: refused before anything spawns.
-      await expect(resolve({ identity: identityAt('leaf-current') })).rejects.toBeInstanceOf(
-        AgentSessionPreSpawnError
-      )
+      // Reacquire after the account state changed: refused before anything spawns, naming the
+      // account shape a person can change.
+      const refused = resolve({ identity: identityAt('leaf-current') })
+      await expect(refused).rejects.toBeInstanceOf(AgentSessionPreSpawnError)
+      await expect(refused).rejects.toMatchObject({ reason: 'managedAccountUnsupported' })
     })
 
-    it('fails closed when the account state cannot be read', async () => {
-      await expect(
-        resolverWithGate(() => null)({ identity: identityAt('leaf-current') })
-      ).rejects.toBeInstanceOf(AgentSessionPreSpawnError)
+    it('fails closed when the account state cannot be read, naming no situation', async () => {
+      const refused = resolverWithGate(() => null)({ identity: identityAt('leaf-current') })
+      await expect(refused).rejects.toBeInstanceOf(AgentSessionPreSpawnError)
+      await expect(refused).rejects.toMatchObject({ reason: undefined })
     })
 
     it('keeps resolving when no gate is wired, so other embedders are unaffected', async () => {
diff --git a/src/main/claude/claude-structured-launch-resolution.ts b/src/main/claude/claude-structured-launch-resolution.ts
index a2b3d41bbfd1..d5d0542cb9da 100644
--- a/src/main/claude/claude-structured-launch-resolution.ts
+++ b/src/main/claude/claude-structured-launch-resolution.ts
@@ -22,6 +22,7 @@ import {
 } from '../claude-accounts/live-pty-gate'
 import { AgentSessionPreSpawnError } from '../native-chat/agent-session-wire/structured-agent-session-adapter'
 import {
+  hasWslBoundClaudeAccount,
   structuredClaudeMatchesActiveManagedAccount,
   type ClaudeManagedAccountGateSettings
 } from '../native-chat/claude-structured-managed-account-support'
@@ -172,7 +173,9 @@ export async function resolveClaudeStructuredInvocation(
   // Under a managed account the pinned credential is the only auth this launch may
   // use, so an explicit override is refused rather than silently beating the pin.
   if (auth.stripAuthEnv && hasClaudeAuthEnvConflict(overlay)) {
-    throw new Error(CLAUDE_AUTH_ENV_CONFLICT_MESSAGE)
+    throw new AgentSessionPreSpawnError(new Error(CLAUDE_AUTH_ENV_CONFLICT_MESSAGE), {
+      reason: 'managedAccountEnvOverride'
+    })
   }
   // Why the overlay merges onto the inherited env rather than replacing it: the child
   // still needs PATH and the rest of the shell environment, and withCliRuntimeOnPath
@@ -209,7 +212,9 @@ export async function assertClaudeAuthSwitchSettled(
   timeoutMs = CLAUDE_AUTH_SWITCH_SETTLE_TIMEOUT_MS
 ): Promise<void> {
   if (!(await whenClaudeAuthSwitchSettles(timeoutMs))) {
-    throw new Error(CLAUDE_AUTH_SWITCH_IN_PROGRESS_MESSAGE)
+    throw new AgentSessionPreSpawnError(new Error(CLAUDE_AUTH_SWITCH_IN_PROGRESS_MESSAGE), {
+      reason: 'accountSwitchInProgress'
+    })
   }
 }
 
@@ -247,12 +252,12 @@ export function createClaudeStructuredLaunchResolver(
     // Every acquisition, not just the first: the account state can change under a live session, and
     // a reacquire after an unexpected exit would otherwise spawn under whatever it has become.
     // Codex has no gate here — it resolves its account on a different path.
-    if (
-      deps.readManagedAccountGate &&
-      !structuredClaudeMatchesActiveManagedAccount(deps.readManagedAccountGate())
-    ) {
+    const gate = deps.readManagedAccountGate?.()
+    if (gate !== undefined && !structuredClaudeMatchesActiveManagedAccount(gate)) {
+      // Unreadable account state names no situation a person can act on, so only the log reads it.
       throw new AgentSessionPreSpawnError(
-        'structured Claude is not offered under the active managed Claude account'
+        'structured Claude is not offered under the active managed Claude account',
+        gate && hasWslBoundClaudeAccount(gate) ? { reason: 'managedAccountUnsupported' } : {}
       )
     }
     const head = agentSessionProviderHandleChainHead(record.providerHandleChain)
diff --git a/src/main/claude/claude-structured-options.test.ts b/src/main/claude/claude-structured-options.test.ts
index e02647f36253..a92149a2cddf 100644
--- a/src/main/claude/claude-structured-options.test.ts
+++ b/src/main/claude/claude-structured-options.test.ts
@@ -11,7 +11,7 @@ import {
 import { ClaudeBackgroundTaskTracker } from './claude-background-task-tracker'
 import { ClaudeChildWorkDecoder } from './claude-child-work-decoder'
 import { ClaudeSlashCommandCatalog } from './claude-slash-command-catalog'
-import { createClaudeSessionStartupGate } from './claude-structured-session-startup-gate'
+import { createClaudeSessionStartup } from './claude-structured-session-startup-state'
 import {
   claudeStructuredSessionOptionsFrom,
   observeClaudeFastModeFacts,
@@ -48,7 +48,7 @@ function sessionFor(setModel: ClaudeSession['connection']['setModel']): ClaudeSe
     capabilities: [],
     events: undefined,
     translator: null,
-    startup: { ...createClaudeSessionStartupGate(), state: 'proven' }
+    startup: { ...createClaudeSessionStartup(), state: 'proven' }
   }
 }
 
diff --git a/src/main/claude/claude-structured-options.ts b/src/main/claude/claude-structured-options.ts
index 0090cd2f039f..2f0b7ac4b707 100644
--- a/src/main/claude/claude-structured-options.ts
+++ b/src/main/claude/claude-structured-options.ts
@@ -41,6 +41,13 @@ export function restoredClaudeStructuredSessionOptions(
   )
 }
 
+/** The keys `setClaudeStructuredOption` writes; a pick made at rest is checked against these. */
+const CLAUDE_STRUCTURED_OPTION_KEYS = new Set(['model', 'permissionMode', 'effort', 'fastMode'])
+
+export function isClaudeStructuredOptionKey(key: string): boolean {
+  return CLAUDE_STRUCTURED_OPTION_KEYS.has(key)
+}
+
 /** A client's write; the startup restore writes through `setClaudeStructuredOption` directly. */
 export function setClaudeStructuredSessionOption(
   session: ClaudeSession,
@@ -51,7 +58,8 @@ export function setClaudeStructuredSessionOption(
   if (session.startup.state !== 'proven') {
     return Promise.reject(
       new AgentSessionOptionRejectedError(
-        'Claude is still starting; options can be changed once it is ready.'
+        'Claude is still starting; options can be changed once it is ready.',
+        'providerStarting'
       )
     )
   }
diff --git a/src/main/claude/claude-structured-prompt-items.test.ts b/src/main/claude/claude-structured-prompt-items.test.ts
index 297bf4054351..f032d4bcf8d2 100644
--- a/src/main/claude/claude-structured-prompt-items.test.ts
+++ b/src/main/claude/claude-structured-prompt-items.test.ts
@@ -1,13 +1,11 @@
 import { describe, expect, it } from 'vitest'
 import { agentJournalItemKey } from '../../shared/agent-session-journal-item-key'
-import { encodeAgentSessionQuestionAnswers } from '../../shared/agent-session-question-answer'
 import { cancelledJournalPromptBody } from '../native-chat/agent-session-journal/journal-prompt-body-bounds'
 import { MAX_JOURNAL_LIFECYCLE_BATCH_BYTES } from '../native-chat/agent-session-journal/journal-row-schema'
 import { MAX_TOOL_DETAIL_LENGTH } from '../../shared/native-chat-tool-summary'
 import { claudeApprovalItem, claudeQuestionItems } from './claude-structured-prompt-items'
 import {
-  applyClaudePromptAnswer,
-  encodeClaudeQuestionOptionId,
+  buildClaudePromptReply,
   type ClaudePendingPrompt
 } from './claude-structured-prompt-replies'
 
@@ -24,7 +22,6 @@ function approvalPrompt(
     input,
     suggestions: [],
     questionIds: [],
-    answers: new Map(),
     settle: () => {},
     ...presentation
   }
@@ -121,19 +118,21 @@ describe('Claude structured approval presentation', () => {
       }
     )
 
-    expect(applyClaudePromptAnswer({ prompt }, 'deny')).toEqual({
+    expect(buildClaudePromptReply(prompt, { kind: 'option', optionId: 'deny' })).toEqual({
       behavior: 'deny',
       message: 'User denied this action.',
       toolUseID: 'tool-approval'
     })
-    expect(applyClaudePromptAnswer({ prompt }, 'allowForSession')).toEqual({
-      behavior: 'allow',
-      updatedInput: { command: 'rm output.txt' },
-      updatedPermissions: [
-        { type: 'addRules', rules: [], behavior: 'allow', destination: 'session' }
-      ],
-      toolUseID: 'tool-approval'
-    })
+    expect(buildClaudePromptReply(prompt, { kind: 'option', optionId: 'allowForSession' })).toEqual(
+      {
+        behavior: 'allow',
+        updatedInput: { command: 'rm output.txt' },
+        updatedPermissions: [
+          { type: 'addRules', rules: [], behavior: 'allow', destination: 'session' }
+        ],
+        toolUseID: 'tool-approval'
+      }
+    )
   })
 
   it('asks Claude to revise a rejected plan while accepting legacy session replies', () => {
@@ -145,16 +144,18 @@ describe('Claude structured approval presentation', () => {
       }
     )
 
-    expect(applyClaudePromptAnswer({ prompt }, 'deny')).toEqual({
+    expect(buildClaudePromptReply(prompt, { kind: 'option', optionId: 'deny' })).toEqual({
       behavior: 'deny',
       message: 'The user asked you to keep planning. Revise the plan and call ExitPlanMode again.',
       toolUseID: 'tool-approval'
     })
-    expect(applyClaudePromptAnswer({ prompt }, 'allowForSession')).toEqual({
-      behavior: 'allow',
-      updatedInput: { plan: '# Release' },
-      toolUseID: 'tool-approval'
-    })
+    expect(buildClaudePromptReply(prompt, { kind: 'option', optionId: 'allowForSession' })).toEqual(
+      {
+        behavior: 'allow',
+        updatedInput: { plan: '# Release' },
+        toolUseID: 'tool-approval'
+      }
+    )
   })
 })
 
@@ -178,7 +179,6 @@ describe('Claude structured question addressing', () => {
       input: { questions },
       suggestions: [],
       questionIds: questions.map((question) => question.question),
-      answers: new Map(),
       settle: () => {}
     }
 
@@ -211,7 +211,6 @@ describe('Claude structured question addressing', () => {
       input: { questions: [{ question: questionId, options: [{ label }] }] },
       suggestions: [],
       questionIds: [questionId],
-      answers: new Map(),
       settle: () => {}
     }
 
@@ -219,7 +218,12 @@ describe('Claude structured question addressing', () => {
     expect(agentJournalItemKey(item.identity).length).toBeLessThan(512)
     expect(item.body.options[0]!.id.length).toBeLessThan(512)
     expect(item.body.freeTextQuestionId).toBe('q1')
-    expect(applyClaudePromptAnswer({ prompt }, item.body.options[0]!.id)).toMatchObject({
+    expect(
+      buildClaudePromptReply(prompt, {
+        kind: 'answers',
+        answers: [{ questionId: 'q1', optionIds: [item.body.options[0]!.id] }]
+      })
+    ).toMatchObject({
       updatedInput: { answers: { [questionId]: label } }
     })
   })
@@ -235,13 +239,15 @@ describe('Claude structured question addressing', () => {
       input: { questions: [{ question: questionId }] },
       suggestions: [],
       questionIds: [questionId],
-      answers: new Map(),
       settle: () => {}
     }
     const answer = 'https://example.test:8443/path'
 
     expect(
-      applyClaudePromptAnswer({ prompt }, encodeClaudeQuestionOptionId('q1', answer))
+      buildClaudePromptReply(prompt, {
+        kind: 'answers',
+        answers: [{ questionId: 'q1', optionIds: [], other: answer }]
+      })
     ).toMatchObject({
       updatedInput: { answers: { [questionId]: answer } }
     })
@@ -273,21 +279,20 @@ describe('Claude structured question addressing', () => {
       },
       suggestions: [],
       questionIds: [multiQuestion, singleQuestion, otherQuestion],
-      answers: new Map(),
       settle: () => {}
     }
     const item = claudeQuestionItems({ sessionId: 'session-1', prompt })[0]!
     const questions = item.body.questions!
-    const encoded = encodeAgentSessionQuestionAnswers([
+    const answers = [
       {
         questionId: 'q1',
         optionIds: [questions[0]!.options[0]!.id, questions[0]!.options[1]!.id]
       },
       { questionId: 'q2', optionIds: [questions[1]!.options[1]!.id] },
       { questionId: 'q3', optionIds: [], other: 'remote host' }
-    ])
+    ]
 
-    expect(applyClaudePromptAnswer({ prompt }, encoded)).toMatchObject({
+    expect(buildClaudePromptReply(prompt, { kind: 'answers', answers })).toMatchObject({
       updatedInput: {
         answers: {
           [multiQuestion]: ['frontend', 'backend'],
diff --git a/src/main/claude/claude-structured-prompt-ownership.test.ts b/src/main/claude/claude-structured-prompt-ownership.test.ts
index 7a06a58e881c..3c290fa5184a 100644
--- a/src/main/claude/claude-structured-prompt-ownership.test.ts
+++ b/src/main/claude/claude-structured-prompt-ownership.test.ts
@@ -120,7 +120,7 @@ describe('Claude live prompt ownership', () => {
       sessionId: 'session-1',
       itemId: 'journal-prompt',
       kind: 'approval',
-      optionId: 'allow',
+      response: { kind: 'option', optionId: 'allow' },
       fence: 7,
       commit: async () => {
         expect(answered.settled()).toBe(false)
@@ -185,7 +185,7 @@ describe('Claude live prompt ownership', () => {
         sessionId: 'session-1',
         itemId: 'journal-prompt',
         kind: 'approval',
-        optionId: 'allow',
+        response: { kind: 'option', optionId: 'allow' },
         fence: 7,
         commit
       })
@@ -204,7 +204,7 @@ describe('Claude live prompt ownership', () => {
         sessionId: 'session-1',
         itemId: 'journal-prompt',
         kind: 'approval',
-        optionId: 'allow',
+        response: { kind: 'option', optionId: 'allow' },
         fence: 7,
         commit
       })
@@ -269,7 +269,8 @@ describe('Claude live prompt ownership', () => {
       sessionId: 'session-1',
       clientMessageId: 'queued-message',
       state: 'rejected',
-      reason: 'provider_cancelled_before_start'
+      reason: 'provider_cancelled_before_start',
+      rejection: { kind: 'cancelled' }
     })
   })
 
@@ -356,7 +357,6 @@ describe('Claude live prompt ownership', () => {
           input: { command: 'git status' },
           suggestions: [],
           questionIds: [],
-          answers: new Map(),
           settle: vi.fn()
         }
       })
@@ -398,7 +398,7 @@ describe('Claude live prompt ownership', () => {
       sessionId: 'session-1',
       itemId: 'journal-prompt',
       kind: 'approval',
-      optionId: 'allow',
+      response: { kind: 'option', optionId: 'allow' },
       fence: 7,
       commit: async () => undefined
     })
@@ -557,7 +557,7 @@ describe('Claude live prompt ownership', () => {
         sessionId: 'session-1',
         itemId: promptItemId,
         kind: 'approval',
-        optionId: 'allow',
+        response: { kind: 'option', optionId: 'allow' },
         fence: 7,
         commit
       })
@@ -610,7 +610,7 @@ describe('Claude live prompt ownership', () => {
         sessionId: 'session-1',
         itemId: 'journal-prompt',
         kind: 'approval',
-        optionId: 'allow',
+        response: { kind: 'option', optionId: 'allow' },
         fence: 8,
         commit
       })
@@ -689,7 +689,6 @@ describe('Claude live prompt ownership', () => {
       },
       suggestions: [],
       questionIds: ['First?', 'Second?'],
-      answers: new Map(),
       settle: vi.fn()
     }
     prompts.handle({ type: 'prompt', sessionId: 'session-1', prompt })
@@ -728,7 +727,6 @@ describe('Claude live prompt ownership', () => {
         input: { command: 'git status' },
         suggestions: [],
         questionIds: [],
-        answers: new Map(),
         settle: vi.fn()
       }
       prompts.handle({ type: 'prompt', sessionId: 'session-1', prompt })
diff --git a/src/main/claude/claude-structured-prompt-ownership.ts b/src/main/claude/claude-structured-prompt-ownership.ts
index e4c9de982d07..864a99a0b770 100644
--- a/src/main/claude/claude-structured-prompt-ownership.ts
+++ b/src/main/claude/claude-structured-prompt-ownership.ts
@@ -1,4 +1,5 @@
 import {
+  AgentSessionPromptAnswerRejectedError,
   AgentSessionPromptUnavailableError,
   type StructuredAgentSessionAdapter
 } from '../native-chat/agent-session-wire/structured-agent-session-adapter'
@@ -10,12 +11,10 @@ import {
   supportsClaudeQueuedInterruptCancellation
 } from './claude-structured-control-actions'
 import type { ClaudeLateDispatchSettlement } from './claude-structured-dispatch'
+import { buildClaudePromptReply } from './claude-structured-prompt-replies'
 import type { ClaudeSession } from './claude-structured-session-state'
-import {
-  claudeStartupHoldsWrites,
-  rejectClaudeStartupWrites
-} from './claude-structured-session-startup-gate'
-import { DISPATCH_REJECTED_CANCELLED } from '../../shared/structured-agent-session-dispatch-rejection'
+import type { ClaudePendingPrompt } from './claude-prompt-registry'
+import type { PermissionResult } from '@anthropic-ai/claude-agent-sdk'
 
 /** Conservative user-facing window: below the 30s control deadline, trading
  * residual slow-pump risk for ensuring delivery bookkeeping cannot block Stop indefinitely. */
@@ -103,14 +102,9 @@ export async function cancelClaudeStructuredTurn(input: {
   const session = requireSession(sessions, request.sessionId)
   const acquisitionGeneration = session.acquisitionGeneration
   const prompt = request.prompt
-  // A held prompt was never written, so Stop withdraws it; the drain only writes what it still
-  // holds. Before startup lands nothing was written, so there is nothing to interrupt either.
-  let withdrewHeld = false
-  if (!prompt && claudeStartupHoldsWrites(session) && session.fence === request.fence) {
-    withdrewHeld = rejectClaudeStartupWrites(session, DISPATCH_REJECTED_CANCELLED)
-    if (session.startup.state === 'pending') {
-      return { cancelled: withdrewHeld }
-    }
+  // Before startup lands nothing was written, so there is nothing to interrupt.
+  if (!prompt && session.startup.state === 'pending') {
+    return { cancelled: false }
   }
   if (prompt && session.fence !== request.fence) {
     return { cancelled: false }
@@ -193,7 +187,7 @@ export async function cancelClaudeStructuredTurn(input: {
     } else if (claim) {
       session.prompts.releaseClaim(claim)
     }
-    return withdrewHeld ? { ...result, cancelled: true } : result
+    return result
   } catch (error) {
     if (claim && !interruptConfirmed) {
       session.prompts.releaseClaim(claim)
@@ -202,6 +196,19 @@ export async function cancelClaudeStructuredTurn(input: {
   }
 }
 
+function prepareClaudePromptReply(
+  prompt: ClaudePendingPrompt,
+  response: AnswerInput['response']
+): PermissionResult {
+  try {
+    return buildClaudePromptReply(prompt, response)
+  } catch (error) {
+    throw new AgentSessionPromptAnswerRejectedError(
+      error instanceof Error ? error.message : String(error)
+    )
+  }
+}
+
 export async function answerClaudeStructuredPrompt(input: {
   request: AnswerInput
   sessions: Map<string, ClaudeSession>
@@ -217,6 +224,7 @@ export async function answerClaudeStructuredPrompt(input: {
     throw new AgentSessionPromptUnavailableError(request.itemId)
   }
   try {
+    const reply = prepareClaudePromptReply(claim.found.prompt, request.response)
     await request.commit()
     if (
       sessions.get(request.sessionId) !== session ||
@@ -226,7 +234,7 @@ export async function answerClaudeStructuredPrompt(input: {
     ) {
       throw new AgentSessionPromptUnavailableError(request.itemId)
     }
-    await answerClaudePrompt(session, claim, request.optionId)
+    await answerClaudePrompt(session, claim, reply)
   } catch (error) {
     session.prompts.releaseClaim(claim)
     throw error
diff --git a/src/main/claude/claude-structured-prompt-replies.ts b/src/main/claude/claude-structured-prompt-replies.ts
index 96bc83d08761..3bb99e3638a3 100644
--- a/src/main/claude/claude-structured-prompt-replies.ts
+++ b/src/main/claude/claude-structured-prompt-replies.ts
@@ -1,5 +1,8 @@
 import type { PermissionResult } from '@anthropic-ai/claude-agent-sdk'
-import { decodeAgentSessionQuestionAnswers } from '../../shared/agent-session-question-answer'
+import type {
+  AgentSessionPromptResponse,
+  AgentSessionQuestionAnswer
+} from '../../shared/agent-session-question-answer'
 import {
   claudePromptQuestions,
   isClaudePromptRecord,
@@ -22,12 +25,6 @@ function isClaudeApprovalDecision(optionId: string): optionId is ClaudeApprovalD
   return CLAUDE_APPROVAL_DECISIONS.some((decision) => decision === optionId)
 }
 
-function questionIdFromAddress(prompt: ClaudePendingPrompt, address: string): string | null {
-  const match = /^q([1-9]\d*)$/.exec(address)
-  const index = match ? Number(match[1]) - 1 : -1
-  return index >= 0 ? (prompt.questionIds[index] ?? null) : null
-}
-
 function questionAnswer(prompt: ClaudePendingPrompt, questionId: string, optionId: string): string {
   const decoded = decodeClaudeQuestionOptionId(optionId)
   if (!decoded) {
@@ -111,49 +108,8 @@ function approvalResponse(prompt: ClaudePendingPrompt, optionId: string): Permis
 
 function questionResponse(
   prompt: ClaudePendingPrompt,
-  optionId: string,
-  boundQuestionId?: string
-): PermissionResult | null {
-  const decoded = decodeClaudeQuestionOptionId(optionId)
-  const decodedQuestionId = decoded
-    ? (questionIdFromAddress(prompt, decoded.questionId) ??
-      (prompt.questionIds.includes(decoded.questionId) ? decoded.questionId : null))
-    : null
-  const selectedQuestionId =
-    boundQuestionId ??
-    decodedQuestionId ??
-    (prompt.questionIds.length === 1 ? prompt.questionIds[0] : null)
-  if (!selectedQuestionId || !prompt.questionIds.includes(selectedQuestionId)) {
-    throw new Error(`${optionId} does not name a question on Claude prompt ${prompt.promptKey}`)
-  }
-  const answer = questionAnswer(prompt, selectedQuestionId, optionId)
-  prompt.answers.set(selectedQuestionId, answer)
-  if (prompt.questionIds.some((id) => !prompt.answers.has(id))) {
-    return null
-  }
-  const answers: Record<string, string | readonly string[]> = {}
-  for (const id of prompt.questionIds) {
-    const answer = prompt.answers.get(id)
-    if (answer === undefined) {
-      return null
-    }
-    answers[id] = answer
-  }
-  return {
-    behavior: 'allow',
-    updatedInput: { ...prompt.input, answers },
-    toolUseID: prompt.toolUseId
-  }
-}
-
-function groupedQuestionResponse(
-  prompt: ClaudePendingPrompt,
-  optionId: string
-): PermissionResult | null {
-  const grouped = decodeAgentSessionQuestionAnswers(optionId)
-  if (!grouped) {
-    return null
-  }
+  grouped: readonly AgentSessionQuestionAnswer[]
+): PermissionResult {
   const questions = claudePromptQuestions(prompt.input)
   if (grouped.length !== prompt.questionIds.length) {
     throw new Error(`Grouped answer does not match Claude prompt ${prompt.promptKey}`)
@@ -191,15 +147,20 @@ function groupedQuestionResponse(
   }
 }
 
-export function applyClaudePromptAnswer(
-  found: { prompt: ClaudePendingPrompt; questionId?: string },
-  optionId: string
-): PermissionResult | null {
-  if (found.prompt.kind === 'approval') {
-    return approvalResponse(found.prompt, optionId)
+/** Builds Claude's reply without touching the prompt, so a reply that cannot be built refuses the
+ *  answer before anything is recorded. */
+export function buildClaudePromptReply(
+  prompt: ClaudePendingPrompt,
+  response: AgentSessionPromptResponse
+): PermissionResult {
+  if (prompt.kind === 'approval') {
+    if (response.kind !== 'option') {
+      throw new Error(`Claude prompt ${prompt.promptKey} takes a decision, not answers`)
+    }
+    return approvalResponse(prompt, response.optionId)
   }
-  return (
-    groupedQuestionResponse(found.prompt, optionId) ??
-    questionResponse(found.prompt, optionId, found.questionId)
-  )
+  if (response.kind !== 'answers') {
+    throw new Error(`Claude prompt ${prompt.promptKey} takes answers, not a decision`)
+  }
+  return questionResponse(prompt, response.answers)
 }
diff --git a/src/main/claude/claude-structured-provider-fallback.ts b/src/main/claude/claude-structured-provider-fallback.ts
index baa6cb83a52a..e107633173c3 100644
--- a/src/main/claude/claude-structured-provider-fallback.ts
+++ b/src/main/claude/claude-structured-provider-fallback.ts
@@ -16,6 +16,11 @@ import {
 } from './claude-structured-item-translation'
 import { claudeResultOutcome } from './claude-result-outcome'
 import { rootClaudeRowStamp, type ClaudeRowStamp } from './claude-provisional-row-corrections'
+import {
+  CLAUDE_API_RETRY_FRAME_KIND,
+  claudeApiRetryRowBody,
+  createClaudeApiRetryRuns
+} from './claude-api-retry-row'
 
 export function claudeProviderFrameKind(message: Record<string, unknown>): string {
   const type = claudeText(message.type) ?? 'unknown'
@@ -121,9 +126,23 @@ export function createClaudeProviderFrameFallback(
   ) => boolean
 } {
   let sequence = 0
+  const retryRun = createClaudeApiRetryRuns()
   return {
     append: (kind, payload, displayText, beforeAppend, options, stamp) => {
       sequence += 1
+      const retrying = kind === CLAUDE_API_RETRY_FRAME_KIND ? claudeRecord(payload) : null
+      if (retrying) {
+        beforeAppend?.()
+        // One row per retry run, revised by each attempt, never the frame as a row.
+        const identity = {
+          provider: 'orca',
+          clientMessageId: `provider-retry:claude:${acquisitionId}:${retryRun(retrying)}`
+        } as const
+        const body = claudeApiRetryRowBody(retrying)
+        sink.appendItem(identity, body, (stamp ?? rootClaudeRowStamp)(identity, body))
+        sink.publish()
+        return true
+      }
       const translated = unhandledProviderFrameJournalItem(
         'claude',
         kind,
diff --git a/src/main/claude/claude-structured-real-cli.test.ts b/src/main/claude/claude-structured-real-cli.test.ts
index 4181dab43c7a..c117e3e863f1 100644
--- a/src/main/claude/claude-structured-real-cli.test.ts
+++ b/src/main/claude/claude-structured-real-cli.test.ts
@@ -70,7 +70,7 @@ function realAdapter(
   const acquire = adapter.acquire
   adapter.acquire = async (input) => {
     const acquisition = await acquire(input)
-    await adapter.drainStartup(input.identity.sessionId)
+    await adapter.awaitStarted(input.identity.sessionId)
     return acquisition
   }
   return adapter
diff --git a/src/main/claude/claude-structured-session-acquisition.ts b/src/main/claude/claude-structured-session-acquisition.ts
index b2efed691ee9..372e1f8eb945 100644
--- a/src/main/claude/claude-structured-session-acquisition.ts
+++ b/src/main/claude/claude-structured-session-acquisition.ts
@@ -30,6 +30,7 @@ import {
   type ClaudeAcquireCallbacks
 } from './claude-structured-session-state'
 import { resolveClaudeAcquisitionError } from './claude-structured-session-close'
+import { withObservedProviderExit } from '../native-chat/agent-session-wire/structured-agent-session-failure-text'
 import { readClaudeTranscriptEntryUuid } from './claude-transcript-entry-uuid'
 import { persistClaudeTurnResumePoint } from './claude-structured-resume-point'
 import { withAgentSessionCreatePhase } from '../observability/agent-session-instrumentation'
@@ -58,7 +59,9 @@ export async function acquireClaudeSession({
   // A managed-account switch is mid-swap of the pinned credential home; refuse here,
   // before this acquisition cancels the previous attempt and closes the live session.
   if (isClaudeAuthSwitchInProgress()) {
-    throw new AgentSessionPreSpawnError(new Error(CLAUDE_AUTH_SWITCH_IN_PROGRESS_MESSAGE))
+    throw new AgentSessionPreSpawnError(new Error(CLAUDE_AUTH_SWITCH_IN_PROGRESS_MESSAGE), {
+      reason: 'accountSwitchInProgress'
+    })
   }
   const sessionId = input.identity.sessionId
   const prompts = new ClaudePromptRegistry()
@@ -178,6 +181,8 @@ export async function acquireClaudeSession({
             initProof.reject(error)
           },
           onExit: (error) => {
+            // The child exited on its own; marked in place, as the fault report may hold this error.
+            withObservedProviderExit(error)
             childEnded ??= error
             initProof.reject(error)
             callbacks.handleExit(sessionId, attempt, error)
@@ -248,30 +253,34 @@ export async function acquireClaudeSession({
         event()
       }
     })
-    session.startup.settled = settleClaudeSessionStartup({
-      session,
-      facts: readClaudeStartupFacts({
-        connection,
-        initProof,
-        sessionId,
-        providerSessionId: launch.providerSessionId,
-        resumesTranscript: launch.resumesTranscript,
-        inputOptions: input.options,
-        requestTimeoutMs: deps.requestTimeoutMs,
-        emit
-      }),
-      isCurrent: () => sessions.get(sessionId) === session,
-      requestTimeoutMs: deps.requestTimeoutMs,
-      fault: (error) => callbacks.handleExit(sessionId, attempt, error),
-      onStarted: (options) =>
-        emit({
-          type: 'started',
+    // Whichever comes first: the start landing or faulting, or the child being ended.
+    session.startup.settled = Promise.race([
+      session.startup.settled,
+      settleClaudeSessionStartup({
+        session,
+        facts: readClaudeStartupFacts({
+          connection,
+          initProof,
           sessionId,
-          fence: input.fence,
-          acquisitionGeneration: session.acquisitionGeneration,
-          ...options
-        })
-    })
+          providerSessionId: launch.providerSessionId,
+          resumesTranscript: launch.resumesTranscript,
+          inputOptions: input.options,
+          requestTimeoutMs: deps.requestTimeoutMs,
+          emit
+        }),
+        isCurrent: () => sessions.get(sessionId) === session,
+        requestTimeoutMs: deps.requestTimeoutMs,
+        fault: (error) => callbacks.handleExit(sessionId, attempt, error),
+        onStarted: (options) =>
+          emit({
+            type: 'started',
+            sessionId,
+            fence: input.fence,
+            acquisitionGeneration: session.acquisitionGeneration,
+            ...options
+          })
+      })
+    ])
     // A child whose exit already reached `handleExit` is not handed over as live: the create
     // fails with the CLI's own diagnostic, as one that died before publish does.
     if (sessions.get(sessionId) !== session) {
diff --git a/src/main/claude/claude-structured-session-adapter-turns.test.ts b/src/main/claude/claude-structured-session-adapter-turns.test.ts
index caafee6a94b9..c77d5ee0a911 100644
--- a/src/main/claude/claude-structured-session-adapter-turns.test.ts
+++ b/src/main/claude/claude-structured-session-adapter-turns.test.ts
@@ -68,7 +68,11 @@ describe('ClaudeStructuredSessionAdapter turns and controls', () => {
         body: USER_MESSAGE,
         fence: 7
       })
-    ).resolves.toEqual({ state: 'rejected', reason: 'provider_write_failed: broken pipe' })
+    ).resolves.toEqual({
+      state: 'rejected',
+      reason: 'provider_write_failed',
+      rejection: { kind: 'writeFailed' }
+    })
   })
 
   it('requires an acknowledged interrupt and supports controlled options', async () => {
diff --git a/src/main/claude/claude-structured-session-adapter.test.ts b/src/main/claude/claude-structured-session-adapter.test.ts
index a879878436a9..376cac9d52f1 100644
--- a/src/main/claude/claude-structured-session-adapter.test.ts
+++ b/src/main/claude/claude-structured-session-adapter.test.ts
@@ -3,12 +3,12 @@ import { join } from 'node:path'
 import { describe, expect, it, vi } from 'vitest'
 import {
   AgentSessionAcquisitionExitUnprovenError,
-  AgentSessionAcquisitionRootExitObservedError
+  AgentSessionAcquisitionRootExitObservedError,
+  AgentSessionPromptAnswerRejectedError
 } from '../native-chat/agent-session-wire/structured-agent-session-adapter'
 import type { ClaudeStreamJsonConnection } from './claude-stream-json-connection'
 import { ClaudeControlRequestError } from './claude-stream-json-connection'
 import { CLAUDE_SPAWN_TOKEN_ENV } from './claude-structured-owner-identity'
-import { encodeClaudeQuestionOptionId } from './claude-structured-prompt-replies'
 import type {
   ClaudeStructuredSessionAdapter,
   ClaudeStructuredSessionEvent
@@ -556,21 +556,18 @@ describe('ClaudeStructuredSessionAdapter acquisition cleanup', () => {
       .catch((error: unknown) => error)
   }
 
-  it('releases on a first-hand root exit while still carrying the CLI diagnostic', async () => {
-    // The root's pid and start time are the lease's identity, and they are
-    // provably dead: latching the session would strand a signed-out user.
-    const error = await failedStart({ root: 'exited', tree: 'unverifiable' })
+  // The root's pid and start time are the lease's identity, and they are provably dead: latching
+  // the session would strand a signed-out user. The lease follows the root, so a descendant seen
+  // alive does not hold the session either.
+  it.each(['unverifiable', 'live'] as const)(
+    'releases on a first-hand root exit with its tree %s while still carrying the CLI diagnostic',
+    async (tree) => {
+      const error = await failedStart({ root: 'exited', tree })
 
-    expect(error).toBeInstanceOf(AgentSessionAcquisitionRootExitObservedError)
-    expect((error as Error).message).toBe('claude stream-json exited (code 1): not logged in')
-  })
-
-  it('never releases while a descendant was observed alive', async () => {
-    const error = await failedStart({ root: 'exited', tree: 'live' })
-
-    expect(error).toBeInstanceOf(AgentSessionAcquisitionExitUnprovenError)
-    expect(error).not.toBeInstanceOf(AgentSessionAcquisitionRootExitObservedError)
-  })
+      expect(error).toBeInstanceOf(AgentSessionAcquisitionRootExitObservedError)
+      expect((error as Error).message).toBe('claude stream-json exited (code 1): not logged in')
+    }
+  )
 
   it('never releases for a root Orca never saw leave', async () => {
     const error = await failedStart({ root: 'live', tree: 'unverifiable' })
@@ -590,27 +587,19 @@ describe('ClaudeStructuredSessionAdapter acquisition cleanup', () => {
     return { adapter, connection }
   }
 
-  it('classifies cleanup after a first-hand exit removed the session as a root exit, never as proven', async () => {
-    // The host may still be committing or proving the lease when the child dies;
-    // its cleanup must find the exit the ladder observed, not an absence.
-    const { adapter, connection } = await exitedAfterPublish({
-      root: 'exited',
-      tree: 'unverifiable'
-    })
-    const error = await adapter.releaseAcquisition({ sessionId: 'session-1' }).catch((e) => e)
-
-    expect(error).toBeInstanceOf(AgentSessionAcquisitionRootExitObservedError)
-    expect((error as Error).message).toBe('claude stream-json exited (code 1): crashed')
-    expect(connection.closeCount).toBe(2)
-  })
-
-  it('never releases after an exit that left a descendant observed alive', async () => {
-    const { adapter } = await exitedAfterPublish({ root: 'exited', tree: 'live' })
-    const error = await adapter.releaseAcquisition({ sessionId: 'session-1' }).catch((e) => e)
-
-    expect(error).toBeInstanceOf(AgentSessionAcquisitionExitUnprovenError)
-    expect(error).not.toBeInstanceOf(AgentSessionAcquisitionRootExitObservedError)
-  })
+  // The host may still be committing or proving the lease when the child dies; its cleanup must
+  // find the exit the ladder observed, not an absence.
+  it.each(['unverifiable', 'live'] as const)(
+    'classifies cleanup after a first-hand exit with its tree %s as a root exit, never as proven',
+    async (tree) => {
+      const { adapter, connection } = await exitedAfterPublish({ root: 'exited', tree })
+      const error = await adapter.releaseAcquisition({ sessionId: 'session-1' }).catch((e) => e)
+
+      expect(error).toBeInstanceOf(AgentSessionAcquisitionRootExitObservedError)
+      expect((error as Error).message).toBe('claude stream-json exited (code 1): crashed')
+      expect(connection.closeCount).toBe(2)
+    }
+  )
 
   it('forgets a retained exit once the session is acquired again', async () => {
     const options: Parameters<typeof fakeClaude>[0] = {}
@@ -780,7 +769,7 @@ describe('ClaudeStructuredSessionAdapter prompts', () => {
       sessionId: 'session-1',
       itemId: 'journal-approval',
       kind: 'approval',
-      optionId: 'allowForSession',
+      response: { kind: 'option', optionId: 'allowForSession' },
       fence: 7,
       commit: async () => undefined
     })
@@ -793,7 +782,7 @@ describe('ClaudeStructuredSessionAdapter prompts', () => {
     })
   })
 
-  it('collects every AskUserQuestion card before settling the one callback', async () => {
+  it('settles the one AskUserQuestion callback from structured answers, including a long typed answer', async () => {
     const claude = fakeClaude()
     const adapter = await acquired(claude)
     const answered = invokeCanUseTool(
@@ -810,31 +799,65 @@ describe('ClaudeStructuredSessionAdapter prompts', () => {
         }
       }
     )
-    adapter.bindPromptItemId('session-1', 'journal-q1', 'question-1', 'Library?')
-    adapter.bindPromptItemId('session-1', 'journal-q2', 'question-1', 'Ship now?')
+    adapter.bindPromptItemId('session-1', 'journal-question', 'question-1')
+    const typed = 'Wait for the capture to finish first. '.repeat(60)
 
     await adapter.answerPrompt({
       sessionId: 'session-1',
-      itemId: 'journal-q1',
+      itemId: 'journal-question',
       kind: 'question',
-      optionId: encodeClaudeQuestionOptionId('Library?', 'Luxon'),
+      response: {
+        kind: 'answers',
+        answers: [
+          { questionId: 'q1', optionIds: ['q1:choice-1'] },
+          { questionId: 'q2', optionIds: [], other: typed }
+        ]
+      },
       fence: 7,
       commit: async () => undefined
     })
-    await tick()
-    expect(answered.settled()).toBe(false)
+    await expect(answered.promise).resolves.toMatchObject({
+      behavior: 'allow',
+      updatedInput: { answers: { 'Library?': 'Luxon', 'Ship now?': typed.trim() } },
+      toolUseID: 'tool-question'
+    })
+  })
+
+  it('refuses answers Claude cannot take before the journal commits them', async () => {
+    const claude = fakeClaude()
+    const adapter = await acquired(claude)
+    const answered = invokeCanUseTool(
+      claude.connections[0],
+      'AskUserQuestion',
+      'question-1',
+      'tool-question',
+      { input: { questions: [{ question: 'Library?', options: [{ label: 'Luxon' }] }] } }
+    )
+    adapter.bindPromptItemId('session-1', 'journal-question', 'question-1')
+    const commit = vi.fn(async () => undefined)
+
+    await expect(
+      adapter.answerPrompt({
+        sessionId: 'session-1',
+        itemId: 'journal-question',
+        kind: 'question',
+        response: { kind: 'option', optionId: 'allow' },
+        fence: 7,
+        commit
+      })
+    ).rejects.toBeInstanceOf(AgentSessionPromptAnswerRejectedError)
+    expect(commit).not.toHaveBeenCalled()
+
     await adapter.answerPrompt({
       sessionId: 'session-1',
-      itemId: 'journal-q2',
+      itemId: 'journal-question',
       kind: 'question',
-      optionId: encodeClaudeQuestionOptionId('Ship now?', 'Yes'),
+      response: { kind: 'answers', answers: [{ questionId: 'q1', optionIds: ['q1:choice-1'] }] },
       fence: 7,
-      commit: async () => undefined
+      commit
     })
     await expect(answered.promise).resolves.toMatchObject({
-      behavior: 'allow',
-      updatedInput: { answers: { 'Library?': 'Luxon', 'Ship now?': 'Yes' } },
-      toolUseID: 'tool-question'
+      updatedInput: { answers: { 'Library?': 'Luxon' } }
     })
   })
 
@@ -859,7 +882,7 @@ describe('ClaudeStructuredSessionAdapter prompts', () => {
         sessionId: 'session-1',
         itemId: 'journal-9',
         kind: 'approval',
-        optionId: 'allow',
+        response: { kind: 'option', optionId: 'allow' },
         fence: 7,
         commit: async () => undefined
       })
diff --git a/src/main/claude/claude-structured-session-adapter.ts b/src/main/claude/claude-structured-session-adapter.ts
index 835757dc7303..29b51e730ae9 100644
--- a/src/main/claude/claude-structured-session-adapter.ts
+++ b/src/main/claude/claude-structured-session-adapter.ts
@@ -1,3 +1,4 @@
+import type { SubmissionRejectionFact } from '../../shared/agent-session-failure'
 import { compactClaudeSession, observeClaudeCompaction } from './claude-structured-compaction'
 import type {
   AgentSessionAcquisition,
@@ -12,7 +13,10 @@ import { acquireClaudeSession } from './claude-structured-session-acquisition'
 import { supportsClaudeStructuredLocation } from './claude-structured-location-support'
 import { setClaudeStructuredSessionOption } from './claude-structured-options'
 import { readClaudeStructuredSessionOptions } from './claude-structured-session-options'
-import { claudeStartupSettledWithin } from './claude-structured-session-startup-gate'
+import {
+  claudeStartupFailureFact,
+  claudeStartupSettledWithin
+} from './claude-structured-session-startup-state'
 import { CLAUDE_DEFAULT_REQUEST_TIMEOUT_MS } from './claude-agent-sdk-control-requests'
 import {
   ClaudeAcquisitionRegistry,
@@ -109,15 +113,22 @@ export class ClaudeStructuredSessionAdapter implements StructuredAgentSessionAda
   }
 
   /** Resolves once every first-hand exit observed so far has published its
-   *  lifecycle event — or has failed its tree proof and stayed indexed for a
-   *  retry. Publication trails observation by the close ladder and the
+   *  lifecycle event — or, with neither its tree proven gone nor its root's exit
+   *  observed, stayed indexed for a retry. Publication trails observation by the close ladder and the
    *  transcript cursor write, so nothing outside can otherwise tell the two
    *  apart without guessing at wall-clock. */
   drainObservedExits = (): Promise<void> => drainClaudeObservedExits(this.exits)
 
-  /** Resolves once a published session's startup has landed or faulted it. */
-  drainStartup = (sessionId: string): Promise<void> =>
-    this.sessions.get(sessionId)?.startup.settled ?? Promise.resolve()
+  /** Resolves once a published session's startup has landed, faulted, or been ended by a close;
+   *  with the reason when it did not land. */
+  awaitStarted = async (sessionId: string): Promise<void | SubmissionRejectionFact> => {
+    const session = this.sessions.get(sessionId)
+    if (!session) {
+      return
+    }
+    await session.startup.settled
+    return claudeStartupFailureFact(session) ?? undefined
+  }
 
   /** Restart reconciliation reads the transcript a resume replays; these maps track liveness. */
   providerHistoryWindow: NonNullable<StructuredAgentSessionAdapter['providerHistoryWindow']> = (
@@ -169,25 +180,17 @@ export class ClaudeStructuredSessionAdapter implements StructuredAgentSessionAda
     }
   }
 
-  bindPromptItemId(
-    sessionId: string,
-    journalItemId: string,
-    promptKey: string,
-    questionId?: string
-  ): void {
+  bindPromptItemId(sessionId: string, journalItemId: string, promptKey: string): void {
     const session = this.sessions.get(sessionId)
     session?.prompts.bindJournalItemId(
       journalItemId,
       promptKey,
-      questionId,
       session.translator?.currentTurnId ?? null
     )
   }
 
   dispatch: StructuredAgentSessionAdapter['dispatch'] = (input) =>
-    dispatchClaudeTurn(this.session(input.sessionId), input, input.beforeDispatch, (settlement) =>
-      this.deps.onDispatchSettledLate?.({ sessionId: input.sessionId, ...settlement })
-    )
+    dispatchClaudeTurn(this.session(input.sessionId), input, input.beforeDispatch)
 
   compact: NonNullable<StructuredAgentSessionAdapter['compact']> = (input) =>
     compactClaudeSession(this.session(input.sessionId), this.compactions, input)
@@ -242,7 +245,8 @@ export class ClaudeStructuredSessionAdapter implements StructuredAgentSessionAda
     )
   readOptions = (input: { sessionId: string; fence: number }) =>
     readClaudeStructuredSessionOptions(this.session(input.sessionId), this.deps.requestTimeoutMs)
-  recordsContextUsage = (sessionId: string): boolean => this.sessions.has(sessionId)
+  // Provider-level: a session at rest still reports the usage its journal recorded.
+  recordsContextUsage = (): boolean => true
 
   readOptionRestoreFailures = (sessionId: string): readonly string[] => [
     ...(this.sessions.get(sessionId)?.restoreSkippedOptions ?? [])
diff --git a/src/main/claude/claude-structured-session-close.ts b/src/main/claude/claude-structured-session-close.ts
index f0bba7ae2b0e..e27b2a41e93f 100644
--- a/src/main/claude/claude-structured-session-close.ts
+++ b/src/main/claude/claude-structured-session-close.ts
@@ -19,12 +19,12 @@ import { closeProcessRegistry } from '../../shared/child-process/close-process-r
 import { retireClaudeDispatchWaiters } from './claude-structured-dispatch'
 import { settledClaudeTurnEndLeaf } from './claude-structured-resume-point'
 
-/** The root's own exit was seen first-hand; only its descendants went unverified. */
+/** The root's own exit was seen first-hand. The lease follows the root, so a descendant
+ *  left unverified or seen alive does not hold it. */
 export function claudeRootExitObserved(
   connection: ClaudeStreamJsonConnection | null | undefined
 ): boolean {
-  const verdict = connection?.exitVerdict
-  return verdict?.root === 'exited' && verdict.tree === 'unverifiable'
+  return connection?.exitVerdict.root === 'exited'
 }
 
 export function claudeAcquisitionCleanupError(
diff --git a/src/main/claude/claude-structured-session-exit-blame.test.ts b/src/main/claude/claude-structured-session-exit-blame.test.ts
new file mode 100644
index 000000000000..79430131e15c
--- /dev/null
+++ b/src/main/claude/claude-structured-session-exit-blame.test.ts
@@ -0,0 +1,66 @@
+// After a Claude start lands, only the child's own exit says Claude stopped; a fault on Orca's
+// side that makes Orca close the child is Orca's.
+
+import { describe, expect, it, vi } from 'vitest'
+import type { StructuredAgentSessionEventSink } from '../native-chat/agent-session-wire/structured-agent-session-event-sink'
+import type { ClaudeStructuredSessionEvent } from './claude-structured-session-adapter'
+import {
+  adapterFor,
+  fakeClaude,
+  identityFor,
+  PROVIDER_SESSION_ID
+} from './claude-structured-session-test-support'
+
+async function startedClaude(sink: StructuredAgentSessionEventSink) {
+  const claude = fakeClaude()
+  const events: ClaudeStructuredSessionEvent[] = []
+  const adapter = adapterFor(claude, {}, events)
+  await adapter.acquire({ identity: identityFor(), fence: 7, spawnToken: 'spawn-9', events: sink })
+  const ended = async () => {
+    await vi.waitFor(() => expect(events.some((event) => event.type === 'ended')).toBe(true))
+    return events.find((event) => event.type === 'ended')
+  }
+  return { connection: claude.connections[0], ended }
+}
+
+describe('what a started Claude session says ended it', () => {
+  it('says Claude stopped when the child exits on its own', async () => {
+    const { connection, ended } = await startedClaude({
+      appendItem: () => {},
+      appendTombstone: () => {},
+      publish: () => {}
+    })
+
+    connection.handlers.onExit?.(new Error('claude stream-json exited (code 1): killed'))
+
+    expect(await ended()).toMatchObject({
+      cause: 'unexpected-exit',
+      failure: { kind: 'providerExited' }
+    })
+  })
+
+  it('blames Orca when a journal fault makes Orca close the child', async () => {
+    const { connection, ended } = await startedClaude({
+      appendItem: () => {},
+      appendTombstone: () => {},
+      publish: () => {},
+      tryAppendResolvedItemAndPublish: () => ({ accepted: false, reason: 'failed' })
+    })
+
+    connection.handlers.onMessage?.({
+      type: 'system',
+      subtype: 'task_notification',
+      session_id: PROVIDER_SESSION_ID,
+      task_id: 'task-1',
+      status: 'failed',
+      summary: 'failed'
+    })
+
+    expect(await ended()).toMatchObject({
+      reason: 'claude background task journal sink failed',
+      cause: 'unexpected-exit',
+      failure: { kind: 'hostFault' }
+    })
+    expect(connection.closeCount).toBeGreaterThanOrEqual(1)
+  })
+})
diff --git a/src/main/claude/claude-structured-session-exit-lifecycle.ts b/src/main/claude/claude-structured-session-exit-lifecycle.ts
index fdcfed379c51..854646490a8c 100644
--- a/src/main/claude/claude-structured-session-exit-lifecycle.ts
+++ b/src/main/claude/claude-structured-session-exit-lifecycle.ts
@@ -1,9 +1,14 @@
+import { agentSessionFailureFact, providerDiagnosticOf } from '../../shared/agent-session-failure'
+import {
+  providerExitObserved,
+  providerStartupFailureFact
+} from '../native-chat/agent-session-wire/structured-agent-session-failure-text'
 import { settledClaudeTurnEndLeaf } from './claude-structured-resume-point'
 import {
   claudeRootExitObserved,
   settleClaudeExitedSession
 } from './claude-structured-session-close'
-import { failClaudeStartupGate } from './claude-structured-session-startup-gate'
+import { failClaudeStartup } from './claude-structured-session-startup-state'
 import type {
   ClaudeAcquisitionAttempt,
   ClaudeSession,
@@ -32,7 +37,9 @@ export function observeClaudeSessionExit(
     return
   }
   lifecycle.sessions.delete(sessionId)
-  failClaudeStartupGate(session, error)
+  // Not marked here: startup and journal faults end the session this way too. The child's own
+  // exit arrives already marked by the connection's exit callback.
+  failClaudeStartup(session, error)
   // Re-enter the provider's close ladder before publishing lifecycle recovery.
   // An exit callback is root evidence only; the retained tree proof must run
   // before the host releases and reacquires this exact child.
@@ -55,7 +62,8 @@ export function observeClaudeSessionExit(
     .catch(() => undefined)
 }
 
-/** Lifecycle recovery is published only after the child tree proof is true. */
+/** Lifecycle recovery is published only after the close ladder ran and proved the tree gone or
+ *  observed the root's own exit. */
 export function settleClaudeUnexpectedExit(
   lifecycle: ClaudeExitLifecycle,
   sessionId: string,
@@ -84,6 +92,16 @@ export function settleClaudeUnexpectedExit(
       type: 'ended',
       sessionId,
       reason: exit.error.message,
+      // A start that never landed says why it failed. After it landed, only the child's own exit
+      // blames the provider; an Orca fault that closed it is Orca's.
+      failure:
+        exit.session.startup.state !== 'proven'
+          ? providerStartupFailureFact(exit.session.startup.failure ?? exit.error)
+          : providerExitObserved(exit.error)
+            ? agentSessionFailureFact('providerExited', {
+                detail: providerDiagnosticOf(exit.error)
+              })
+            : agentSessionFailureFact('hostFault'),
       cause: 'unexpected-exit',
       fence: exit.session.fence,
       acquisitionGeneration: exit.session.acquisitionGeneration,
diff --git a/src/main/claude/claude-structured-session-publication.ts b/src/main/claude/claude-structured-session-publication.ts
index d64273f9b8b7..f20bc0c79077 100644
--- a/src/main/claude/claude-structured-session-publication.ts
+++ b/src/main/claude/claude-structured-session-publication.ts
@@ -6,7 +6,7 @@ import type { ClaudeSession } from './claude-structured-session-state'
 import { ClaudeBackgroundTaskTracker } from './claude-background-task-tracker'
 import { ClaudeChildWorkDecoder } from './claude-child-work-decoder'
 import { ClaudeSlashCommandCatalog } from './claude-slash-command-catalog'
-import { createClaudeSessionStartupGate } from './claude-structured-session-startup-gate'
+import { createClaudeSessionStartup } from './claude-structured-session-startup-state'
 
 /** The session as published at spawn: nothing the CLI reports at init is assumed yet. */
 export function createClaudeSessionPublication(input: {
@@ -67,7 +67,7 @@ export function createClaudeSessionPublication(input: {
       translator: input.translator,
       events: input.events,
       ...(input.unbindReadingControl ? { unbindReadingControl: input.unbindReadingControl } : {}),
-      startup: createClaudeSessionStartupGate()
+      startup: createClaudeSessionStartup()
     }
   }
 }
diff --git a/src/main/claude/claude-structured-session-recovery.test.ts b/src/main/claude/claude-structured-session-recovery.test.ts
index ef8e0c654695..a5647caee846 100644
--- a/src/main/claude/claude-structured-session-recovery.test.ts
+++ b/src/main/claude/claude-structured-session-recovery.test.ts
@@ -338,7 +338,7 @@ describe('ClaudeStructuredSessionAdapter close and exit recovery', () => {
       spawnToken: 'spawn-9',
       events: journalSink
     })
-    await adapter.drainStartup('session-1')
+    await adapter.awaitStarted('session-1')
     const first = claude.connections[0]
     const oldPrompt = invokeCanUseTool(first, 'Bash', 'permission-retained', 'tool-retained')
     const oldSession = (
@@ -417,6 +417,7 @@ describe('ClaudeStructuredSessionAdapter close and exit recovery', () => {
         type: 'ended',
         sessionId: 'session-1',
         reason: 'crashed before replacement',
+        failure: { kind: 'providerExited' },
         cause: 'unexpected-exit',
         fence: 7,
         acquisitionGeneration: firstAcquisition.acquisitionGeneration,
diff --git a/src/main/claude/claude-structured-session-startup-gate.ts b/src/main/claude/claude-structured-session-startup-gate.ts
deleted file mode 100644
index 0df789361915..000000000000
--- a/src/main/claude/claude-structured-session-startup-gate.ts
+++ /dev/null
@@ -1,172 +0,0 @@
-// A Claude session is published once its child is spawned, before the CLI has answered
-// initialize. Prompts sent in that window are held here and written, in order, once startup
-// lands (init facts read and saved options restored), so a first turn never runs under
-// defaults the restore was about to replace. A held prompt was never written, so a startup
-// that fails rejects it rather than leaving its delivery in doubt.
-
-import type { AgentSessionDispatchOutcome } from '../native-chat/agent-session-wire/structured-agent-session-adapter'
-import { AgentSessionPreDispatchError } from '../native-chat/agent-session-wire/structured-agent-session-operation-settlement'
-import { dispatchWriteFailureReason } from '../../shared/structured-agent-session-dispatch-rejection'
-import { providerStartupFailureRejection } from '../native-chat/agent-session-wire/structured-agent-session-dead-generation-settlement'
-import { claudeUserMessageWasProvablyUnwritten } from './claude-agent-sdk-user-message-queue'
-import {
-  forgetRetiredWaiter,
-  forgetWaiter,
-  retireWaiter
-} from './claude-structured-dispatch-waiters'
-import type {
-  ClaudeDispatchWaiter,
-  ClaudeLateDispatchOutcome,
-  ClaudeSession
-} from './claude-structured-session-state'
-
-type ClaudeStartupHeldWrite = {
-  waiter: ClaudeDispatchWaiter
-  message: Record<string, unknown>
-  settleLate?: (outcome: ClaudeLateDispatchOutcome) => void
-}
-
-export type ClaudeSessionStartupGate = {
-  state: 'pending' | 'proven' | 'failed'
-  held: ClaudeStartupHeldWrite[]
-  /** Held prompts are still being written; later prompts must queue behind them. */
-  draining: boolean
-  failure: Error | null
-  /** Resolves once startup has landed or faulted the session; never rejects. */
-  settled: Promise<void>
-}
-
-export function createClaudeSessionStartupGate(): ClaudeSessionStartupGate {
-  return { state: 'pending', held: [], draining: false, failure: null, settled: Promise.resolve() }
-}
-
-export function claudeStartupFailureReason(session: ClaudeSession): string | null {
-  return session.startup.state === 'failed'
-    ? providerStartupFailureRejection(session.startup.failure ?? undefined)
-    : null
-}
-
-/** Resolves when startup lands or `timeoutMs` passes; a stuck start then refuses the write as before. */
-export function claudeStartupSettledWithin(
-  session: ClaudeSession | undefined,
-  timeoutMs: number
-): Promise<void> {
-  if (session?.startup.state !== 'pending') {
-    return Promise.resolve()
-  }
-  let timer: ReturnType<typeof setTimeout> | undefined
-  return Promise.race([
-    session.startup.settled,
-    new Promise<void>((resolve) => {
-      timer = setTimeout(resolve, timeoutMs)
-    })
-  ]).finally(() => clearTimeout(timer))
-}
-
-export function claudeStartupHoldsWrites(session: ClaudeSession): boolean {
-  return session.startup.state === 'pending' || session.startup.draining
-}
-
-/** Admits a prompt while startup is pending; it is written when `openClaudeStartupGate` runs. */
-export async function holdClaudeStartupWrite(
-  session: ClaudeSession,
-  input: {
-    message: Record<string, unknown>
-    arm: () => { waiter: ClaudeDispatchWaiter }
-    beforeDispatch?: () => Promise<void>
-    settleLate?: (outcome: ClaudeLateDispatchOutcome) => void
-  }
-): Promise<AgentSessionDispatchOutcome> {
-  if (input.beforeDispatch) {
-    try {
-      await input.beforeDispatch()
-    } catch (error) {
-      if (error instanceof AgentSessionPreDispatchError) {
-        throw error
-      }
-      return { state: 'rejected', reason: dispatchWriteFailureReason(error) }
-    }
-  }
-  // Startup may have failed while the admission barrier ran.
-  const failed = claudeStartupFailureReason(session)
-  if (failed) {
-    return { state: 'rejected', reason: failed }
-  }
-  const { waiter } = input.arm()
-  session.startup.held.push({
-    waiter,
-    message: input.message,
-    ...(input.settleLate ? { settleLate: input.settleLate } : {})
-  })
-  // Startup finished writing what it held while the barrier ran; nothing else would drain this.
-  if (!claudeStartupHoldsWrites(session)) {
-    void drainClaudeStartupWrites(session)
-  }
-  return { state: 'admitted' }
-}
-
-export async function openClaudeStartupGate(session: ClaudeSession): Promise<void> {
-  const gate = session.startup
-  if (gate.state !== 'pending') {
-    return
-  }
-  gate.state = 'proven'
-  await drainClaudeStartupWrites(session)
-}
-
-async function drainClaudeStartupWrites(session: ClaudeSession): Promise<void> {
-  const gate = session.startup
-  gate.draining = true
-  try {
-    for (let held = gate.held.shift(); held; held = gate.held.shift()) {
-      await writeHeld(session, held)
-    }
-  } finally {
-    gate.draining = false
-  }
-}
-
-async function writeHeld(session: ClaudeSession, held: ClaudeStartupHeldWrite): Promise<void> {
-  try {
-    await session.connection.send(held.message)
-  } catch (error) {
-    if (held.waiter.settledUuid) {
-      return
-    }
-    if (claudeUserMessageWasProvablyUnwritten(error)) {
-      rejectHeld(session, held, dispatchWriteFailureReason(error))
-      return
-    }
-    // Possibly written: only a replay or the child's exit can settle it now.
-    retireWaiter(session, held.waiter)
-    held.waiter.resolve(null)
-  }
-}
-
-function rejectHeld(session: ClaudeSession, held: ClaudeStartupHeldWrite, reason: string): void {
-  forgetWaiter(session, held.waiter)
-  forgetRetiredWaiter(session, held.waiter)
-  held.waiter.resolve(null)
-  if (held.waiter.clientMessageId) {
-    held.settleLate?.({ clientMessageId: held.waiter.clientMessageId, state: 'rejected', reason })
-  }
-}
-
-/** Rejects every held prompt with `reason`; true when any was held. */
-export function rejectClaudeStartupWrites(session: ClaudeSession, reason: string): boolean {
-  const held = session.startup.held.splice(0)
-  for (const entry of held) {
-    rejectHeld(session, entry, reason)
-  }
-  return held.length > 0
-}
-
-/** Startup cannot land any more; nothing held was written, so all of it is rejected. */
-export function failClaudeStartupGate(session: ClaudeSession, error: Error): void {
-  const gate = session.startup
-  if (gate.state === 'pending') {
-    gate.state = 'failed'
-    gate.failure = error
-  }
-  rejectClaudeStartupWrites(session, providerStartupFailureRejection(error))
-}
diff --git a/src/main/claude/claude-structured-session-startup-state.ts b/src/main/claude/claude-structured-session-startup-state.ts
new file mode 100644
index 000000000000..cf44bd984abd
--- /dev/null
+++ b/src/main/claude/claude-structured-session-startup-state.ts
@@ -0,0 +1,59 @@
+// Where a Claude start stands. A session is published once its child is spawned, before the CLI
+// has answered initialize. Nothing is written to it until startup lands (init facts read and saved
+// options restored): the host's delivery loop waits on `settled` before it hands a message over,
+// so a first turn never runs under defaults the restore was about to replace.
+
+import type { SubmissionRejectionFact } from '../../shared/agent-session-failure'
+import { providerStartupFailureFact } from '../native-chat/agent-session-wire/structured-agent-session-failure-text'
+import type { ClaudeSession } from './claude-structured-session-state'
+
+export type ClaudeSessionStartup = {
+  state: 'pending' | 'proven' | 'failed'
+  failure: Error | null
+  /** Resolves once startup has landed or faulted, or the child exited or was closed; never
+   *  rejects. A close must end it: the delivery loop waits here, and a start Stop cut short
+   *  would otherwise hold that loop forever. */
+  settled: Promise<void>
+  end: () => void
+}
+
+export function createClaudeSessionStartup(): ClaudeSessionStartup {
+  let end: () => void = () => undefined
+  const ended = new Promise<void>((resolve) => {
+    end = resolve
+  })
+  return { state: 'pending', failure: null, settled: ended, end }
+}
+
+export function claudeStartupFailureFact(session: ClaudeSession): SubmissionRejectionFact | null {
+  return session.startup.state === 'failed'
+    ? providerStartupFailureFact(session.startup.failure ?? undefined)
+    : null
+}
+
+/** Resolves when startup lands or `timeoutMs` passes; a stuck start then refuses the write as before. */
+export function claudeStartupSettledWithin(
+  session: ClaudeSession | undefined,
+  timeoutMs: number
+): Promise<void> {
+  if (session?.startup.state !== 'pending') {
+    return Promise.resolve()
+  }
+  let timer: ReturnType<typeof setTimeout> | undefined
+  return Promise.race([
+    session.startup.settled,
+    new Promise<void>((resolve) => {
+      timer = setTimeout(resolve, timeoutMs)
+    })
+  ]).finally(() => clearTimeout(timer))
+}
+
+/** Startup cannot land any more: the child exited, was closed, or its start faulted. */
+export function failClaudeStartup(session: ClaudeSession, error: Error): void {
+  const startup = session.startup
+  if (startup.state === 'pending') {
+    startup.state = 'failed'
+    startup.failure = error
+  }
+  startup.end()
+}
diff --git a/src/main/claude/claude-structured-session-startup.test.ts b/src/main/claude/claude-structured-session-startup.test.ts
index a106c172c45c..ceb9e9cdf6d6 100644
--- a/src/main/claude/claude-structured-session-startup.test.ts
+++ b/src/main/claude/claude-structured-session-startup.test.ts
@@ -55,7 +55,7 @@ describe('Claude structured session publishes before the CLI answers initialize'
     expect(adapter.readCommands('session-1')).toBeUndefined()
 
     await vi.advanceTimersByTimeAsync(SLOW_INIT_MS)
-    await adapter.drainStartup('session-1')
+    await adapter.awaitStarted('session-1')
 
     expect(events.find((event) => event.type === 'options')).toMatchObject({
       models: [{ value: 'claude-sonnet' }]
@@ -65,7 +65,7 @@ describe('Claude structured session publishes before the CLI answers initialize'
     await adapter.closeAll()
   })
 
-  it('reports `started` once saved options are restored, before any held prompt is written', async () => {
+  it('reports `started` once saved options are restored, having written no prompt of its own', async () => {
     const claude = fakeClaude({ initDelayMs: SLOW_INIT_MS, initModel: 'claude-opus-9' })
     const { adapter, events } = startingAdapter(claude)
     const order: string[] = []
@@ -74,11 +74,10 @@ describe('Claude structured session publishes before the CLI answers initialize'
       return undefined
     }
     await adapter.acquire({ ...ACQUIRE, options: { model: 'opus' } })
-    await adapter.dispatch(PROMPT)
     expect(events.some((event) => event.type === 'started')).toBe(false)
 
     await vi.advanceTimersByTimeAsync(SLOW_INIT_MS)
-    await adapter.drainStartup('session-1')
+    await adapter.awaitStarted('session-1')
 
     const startedAt = events.findIndex((event) => event.type === 'started')
     expect(events[startedAt]).toEqual({
@@ -90,9 +89,9 @@ describe('Claude structured session publishes before the CLI answers initialize'
       reportedOptions: expect.objectContaining({ model: 'opus' }),
       restoreSkippedOptions: []
     })
-    // The restore wrote the saved model before `started`, and the held prompt only after it.
+    // The restore wrote the saved model before `started`; no message waits inside the adapter.
     expect(order).toEqual(['set_model'])
-    expect(claude.connections[0].sent).toHaveLength(1)
+    expect(claude.connections[0].sent).toEqual([])
     expect(events.slice(0, startedAt).some((event) => event.type === 'options')).toBe(true)
     await adapter.closeAll()
   })
@@ -133,52 +132,37 @@ describe('Claude structured session publishes before the CLI answers initialize'
     await adapter.closeAll()
   })
 
-  it('holds a prompt sent before init and writes it once startup lands', async () => {
+  // The host's delivery loop waits here before it hands a message over, so the adapter no longer
+  // holds prompts of its own: nothing is written until startup lands because nothing is sent.
+  it('resolves awaitStarted only once startup lands', async () => {
     const claude = fakeClaude({ initDelayMs: SLOW_INIT_MS })
     const { adapter } = startingAdapter(claude)
     await adapter.acquire(ACQUIRE)
-
-    await expect(adapter.dispatch(PROMPT)).resolves.toEqual({ state: 'admitted' })
-    expect(claude.connections[0].sent).toEqual([])
-
-    await vi.advanceTimersByTimeAsync(SLOW_INIT_MS)
-    await adapter.drainStartup('session-1')
-
-    expect(claude.connections[0].sent).toHaveLength(1)
-    expect(claude.connections[0].sent[0]).toMatchObject({ type: 'user' })
-    await adapter.closeAll()
-  })
-
-  it('writes a prompt whose admission barrier was still running when startup landed', async () => {
-    const claude = fakeClaude({ initDelayMs: SLOW_INIT_MS })
-    const { adapter } = startingAdapter(claude)
-    await adapter.acquire(ACQUIRE)
-    let passBarrier = (): void => {}
-    const barrier = new Promise<void>((resolve) => {
-      passBarrier = resolve
+    let started = false
+    const waited = adapter.awaitStarted('session-1').then(() => {
+      started = true
     })
 
-    const dispatched = adapter.dispatch({ ...PROMPT, beforeDispatch: () => barrier })
-    await vi.advanceTimersByTimeAsync(SLOW_INIT_MS)
-    await adapter.drainStartup('session-1')
-    passBarrier()
+    await vi.advanceTimersByTimeAsync(SLOW_INIT_MS - 1)
+    expect(started).toBe(false)
+    await vi.advanceTimersByTimeAsync(1)
+    await waited
 
-    await expect(dispatched).resolves.toEqual({ state: 'admitted' })
-    expect(claude.connections[0].sent.filter((message) => message.type === 'user')).toHaveLength(1)
+    await expect(adapter.dispatch(PROMPT)).resolves.toEqual({ state: 'admitted' })
+    expect(claude.connections[0].sent).toEqual([expect.objectContaining({ type: 'user' })])
     await adapter.closeAll()
   })
 
-  it('ends the session with the exit reason when the CLI dies before init, and rejects held prompts', async () => {
+  it('ends the session with the exit reason when the CLI dies before init', async () => {
     const claude = fakeClaude({
       initDelayMs: SLOW_INIT_MS,
       exitBeforeInit: 'claude stream-json exited (code 1): stderr says no'
     })
-    const { adapter, events, late } = startingAdapter(claude)
+    const { adapter, events } = startingAdapter(claude)
     await adapter.acquire(ACQUIRE)
-    await adapter.dispatch(PROMPT)
 
     await vi.advanceTimersByTimeAsync(SLOW_INIT_MS)
-    await adapter.drainStartup('session-1')
+    await adapter.awaitStarted('session-1')
     await adapter.drainObservedExits()
 
     expect(events.find((event) => event.type === 'ended')).toMatchObject({
@@ -186,9 +170,6 @@ describe('Claude structured session publishes before the CLI answers initialize'
       cause: 'unexpected-exit',
       startupUnproven: true
     })
-    expect(late).toEqual([
-      expect.objectContaining({ clientMessageId: 'client-1', state: 'rejected' })
-    ])
     expect(claude.connections[0].sent).toEqual([])
     expect(claude.connections[0].closeCount).toBe(1)
   })
@@ -203,11 +184,10 @@ describe('Claude structured session publishes before the CLI answers initialize'
     await adapter.acquire(ACQUIRE)
 
     await vi.advanceTimersByTimeAsync(SLOW_INIT_MS)
-    await adapter.drainStartup('session-1')
+    await adapter.awaitStarted('session-1')
     await adapter.drainObservedExits()
 
-    // A failed start is released on the same evidence a failed create is; a proven-live
-    // descendant would have answered `tree: 'live'` instead.
+    // A failed start is released on the same evidence a failed create is.
     expect(events.find((event) => event.type === 'ended')).toMatchObject({
       cause: 'unexpected-exit',
       startupUnproven: true
@@ -218,7 +198,7 @@ describe('Claude structured session publishes before the CLI answers initialize'
     const claude = fakeClaude({ initAccount: { apiProvider: 'firstParty', tokenSource: 'none' } })
     const { adapter, events } = startingAdapter(claude)
     await adapter.acquire(ACQUIRE)
-    await adapter.drainStartup('session-1')
+    await adapter.awaitStarted('session-1')
     await adapter.drainObservedExits()
 
     expect(events.find((event) => event.type === 'ended')).toMatchObject({
@@ -227,82 +207,41 @@ describe('Claude structured session publishes before the CLI answers initialize'
     })
   })
 
-  it('closes a session stopped before init without faulting it or writing held prompts', async () => {
-    const claude = fakeClaude({ initDelayMs: SLOW_INIT_MS })
-    const { adapter, events, late } = startingAdapter(claude)
+  // A Stop that closes a child still starting must end the wait the host's delivery loop is in,
+  // though initialize never answers; otherwise every later send joins a loop that never moves.
+  it('ends the wait on a start closed before init, without faulting it', async () => {
+    const claude = fakeClaude({ initDelayMs: 10 * SLOW_INIT_MS })
+    const { adapter, events } = startingAdapter(claude)
     await adapter.acquire(ACQUIRE)
-    await adapter.dispatch(PROMPT)
+    let ended = false
+    const waited = adapter.awaitStarted('session-1').then(() => {
+      ended = true
+    })
 
     await expect(adapter.closeSession('session-1')).resolves.toBe(true)
-    await vi.advanceTimersByTimeAsync(SLOW_INIT_MS)
-    await adapter.drainStartup('session-1')
+    await vi.advanceTimersByTimeAsync(0)
+    await waited
 
+    expect(ended).toBe(true)
     const connection = claude.connections[0]
     expect(connection.closeCount).toBe(1)
     expect(connection.sent).toEqual([])
     expect(connection.calls.map(({ subtype }) => subtype)).not.toContain('get_settings')
-    expect(late).toEqual([
-      expect.objectContaining({ clientMessageId: 'client-1', state: 'rejected' })
-    ])
     expect(events.some((event) => event.type === 'ended' && event.startupUnproven)).toBe(false)
     expect(events.some((event) => event.type === 'started')).toBe(false)
   })
 
-  it('withdraws a held prompt when the turn is cancelled before init', async () => {
+  it('interrupts nothing when Stop lands before init: nothing was written', async () => {
     const claude = fakeClaude({ initDelayMs: SLOW_INIT_MS })
-    const { adapter, late } = startingAdapter(claude)
+    const { adapter } = startingAdapter(claude)
     await adapter.acquire(ACQUIRE)
-    await adapter.dispatch(PROMPT)
 
     await expect(
       adapter.cancelTurn({ sessionId: 'session-1', turnId: 'turn-1', fence: 7 })
-    ).resolves.toEqual({ cancelled: true })
-    await vi.advanceTimersByTimeAsync(SLOW_INIT_MS)
-    await adapter.drainStartup('session-1')
+    ).resolves.toEqual({ cancelled: false })
 
+    expect(claude.connections[0].calls.map(({ subtype }) => subtype)).not.toContain('interrupt')
     expect(claude.connections[0].sent).toEqual([])
-    expect(late).toEqual([
-      expect.objectContaining({ clientMessageId: 'client-1', state: 'rejected' })
-    ])
-    await adapter.closeAll()
-  })
-
-  it('withdraws the prompts still held when Stop lands while startup is writing them', async () => {
-    const claude = fakeClaude({ initDelayMs: SLOW_INIT_MS })
-    const { adapter, late } = startingAdapter(claude)
-    await adapter.acquire(ACQUIRE)
-    const connection = claude.connections[0]
-    const send = connection.send
-    let landFirstWrite = (): void => {}
-    const firstWrite = new Promise<void>((resolve) => {
-      landFirstWrite = resolve
-    })
-    let writes = 0
-    connection.send = async (message, beforeDispatch) => {
-      writes += 1
-      if (writes === 1) {
-        await firstWrite
-      }
-      return send(message, beforeDispatch)
-    }
-    await adapter.dispatch(PROMPT)
-    await adapter.dispatch({ ...PROMPT, clientMessageId: 'client-2' })
-
-    await vi.advanceTimersByTimeAsync(SLOW_INIT_MS)
-    // Startup has landed and is writing the first held prompt.
-    expect(writes).toBe(1)
-    const cancelled = adapter.cancelTurn({ sessionId: 'session-1', turnId: 'turn-1', fence: 7 })
-    await vi.advanceTimersByTimeAsync(0)
-    landFirstWrite()
-    await vi.advanceTimersByTimeAsync(5_000)
-    await adapter.drainStartup('session-1')
-
-    expect(connection.sent.filter((message) => message.type === 'user')).toHaveLength(1)
-    expect(late).toContainEqual(
-      expect.objectContaining({ clientMessageId: 'client-2', state: 'rejected' })
-    )
-    // Stop withdrew something, so it answers as a cancel whatever the interrupt made of the turn.
-    await expect(cancelled).resolves.toEqual({ cancelled: true })
     await adapter.closeAll()
   })
 })
diff --git a/src/main/claude/claude-structured-session-startup.ts b/src/main/claude/claude-structured-session-startup.ts
index aa1f9a02eccd..d486a670a13e 100644
--- a/src/main/claude/claude-structured-session-startup.ts
+++ b/src/main/claude/claude-structured-session-startup.ts
@@ -26,10 +26,7 @@ import {
   observeClaudeSettingsApplied,
   readClaudeSettingsEffort
 } from './claude-structured-session-options'
-import {
-  failClaudeStartupGate,
-  openClaudeStartupGate
-} from './claude-structured-session-startup-gate'
+import { failClaudeStartup } from './claude-structured-session-startup-state'
 import type { ClaudeSession, ClaudeStructuredSessionEvent } from './claude-structured-session-state'
 
 export type ClaudeInitProof = {
@@ -163,8 +160,8 @@ function claudeStartedReportedOptions(
   return persisted
 }
 
-/** Applies startup facts to the published session, restores saved options, then releases
- *  held prompts. Any failure faults the session so the user sees why it never started. */
+/** Applies startup facts to the published session and restores saved options; only then does the
+ *  session take input. Any failure faults the session so the user sees why it never started. */
 export async function settleClaudeSessionStartup(input: {
   session: ClaudeSession
   facts: Promise<ClaudeStartupFacts>
@@ -179,7 +176,7 @@ export async function settleClaudeSessionStartup(input: {
     if (input.isCurrent()) {
       return false
     }
-    failClaudeStartupGate(session, new Error('claude session closed before startup completed'))
+    failClaudeStartup(session, new Error('claude session closed before startup completed'))
     return true
   }
   try {
@@ -198,13 +195,15 @@ export async function settleClaudeSessionStartup(input: {
         ),
         restoreSkippedOptions: [...session.restoreSkippedOptions]
       })
-      await openClaudeStartupGate(session)
+      if (session.startup.state === 'pending') {
+        session.startup.state = 'proven'
+      }
     }
   } catch (caught) {
     const error = caught instanceof Error ? caught : new Error(String(caught))
     // A close or exit that already ended startup owns how the session ends.
     const endedElsewhere = session.startup.state !== 'pending'
-    failClaudeStartupGate(session, error)
+    failClaudeStartup(session, error)
     if (!endedElsewhere && input.isCurrent()) {
       input.fault(error)
     }
diff --git a/src/main/claude/claude-structured-session-state.ts b/src/main/claude/claude-structured-session-state.ts
index 7d99aff577b6..a0b0f3216793 100644
--- a/src/main/claude/claude-structured-session-state.ts
+++ b/src/main/claude/claude-structured-session-state.ts
@@ -1,3 +1,5 @@
+import type { AgentJournalDispatchRejection } from '../../shared/agent-session-failure-words'
+import type { SubmissionRejectionFact } from '../../shared/agent-session-failure'
 import type {
   AgentJournalItemIdentity,
   AgentSessionJournalIdentity
@@ -25,7 +27,7 @@ import type { AgentChildWorkEvidence } from '../../shared/agent-status-child-wor
 import type { ClaudeBackgroundTaskTracker } from './claude-background-task-tracker'
 import type { ClaudeChildWorkDecoder } from './claude-child-work-decoder'
 import type { ClaudeSlashCommandCatalog } from './claude-slash-command-catalog'
-import type { ClaudeSessionStartupGate } from './claude-structured-session-startup-gate'
+import type { ClaudeSessionStartup } from './claude-structured-session-startup-state'
 
 export type ClaudeAuthDiagnostic = {
   apiKeySourceConfigured: boolean
@@ -66,11 +68,11 @@ export type ClaudeStructuredSessionEvent =
       type: 'ended'
       sessionId: string
       reason: string
+      failure?: SubmissionRejectionFact
       /** Present for first-hand child exits so the host can fence recovery. */
       cause?: 'unexpected-exit' | 'requested-close'
       fence?: number
       acquisitionGeneration?: string
-      settlementRetryRequired?: boolean
       /** Host clock when the end was observed. */
       observedAt?: number
       /** The child ended before proving startup, so reacquiring would repeat the same start. */
@@ -82,7 +84,7 @@ export type ClaudeLateDispatchOutcome =
       clientMessageId: string
       providerIdentity: AgentJournalItemIdentity
     }
-  | { clientMessageId: string; state: 'rejected'; reason: string }
+  | ({ clientMessageId: string; state: 'rejected' } & AgentJournalDispatchRejection)
 
 export type ClaudeStructuredSessionAdapterDeps = {
   resolveLaunch: (input: {
@@ -196,7 +198,7 @@ export type ClaudeSession = {
   events: StructuredAgentSessionEventSink | undefined
   unbindReadingControl?: () => void
   /** Published at spawn; init facts, option restore and queued prompts land when startup does. */
-  startup: ClaudeSessionStartupGate
+  startup: ClaudeSessionStartup
 }
 
 export function mintClaudeAcquisitionGeneration(deps: ClaudeStructuredSessionAdapterDeps): string {
@@ -210,7 +212,7 @@ export function mintClaudeAcquisitionGeneration(deps: ClaudeStructuredSessionAda
  */
 export type ClaudeSessionExit = {
   connection: ClaudeStreamJsonConnection
-  /** Full session identity retained until its child tree is proven gone. */
+  /** Full session identity retained until the exit settles. */
   session: ClaudeSession
   error: Error
   /** The exit path's first proof attempt; retries must observe this result. */
diff --git a/src/main/claude/claude-structured-session-test-support.ts b/src/main/claude/claude-structured-session-test-support.ts
index 023e0ba46b70..c8e3d86b0e86 100644
--- a/src/main/claude/claude-structured-session-test-support.ts
+++ b/src/main/claude/claude-structured-session-test-support.ts
@@ -220,7 +220,7 @@ export function adapterFor(
   const acquire = adapter.acquire
   adapter.acquire = async (input) => {
     const acquisition = await acquire(input)
-    await adapter.drainStartup(input.identity.sessionId)
+    await adapter.awaitStarted(input.identity.sessionId)
     return acquisition
   }
   return adapter
diff --git a/src/main/claude/hook-script.ts b/src/main/claude/hook-script.ts
index efbe71fc9e36..e02fe3747016 100644
--- a/src/main/claude/hook-script.ts
+++ b/src/main/claude/hook-script.ts
@@ -1,6 +1,7 @@
 /** The managed Claude-compatible hook script, built for local, POSIX-remote and Windows targets.
  *  Split from hook-service.ts so the service owns install/status and this owns script text,
  *  mirroring the same split under src/main/cursor/. */
+import type { AgentHookSource } from '../../shared/agent-hook-relay'
 import { buildWindowsAgentHookCurlPostCommand } from '../agent-hooks/installer-utils'
 import { buildPosixAgentHookPostCommand } from '../agent-hooks/hook-post-command'
 import {
@@ -18,10 +19,12 @@ import {
 export function getManagedScript(
   target: 'local' | 'posix' = 'local',
   options: {
+    source?: AgentHookSource
     skipWhenDevinImportsClaude?: boolean
     skipWhenGrokImportsClaude?: boolean
   } = {}
 ): string {
+  const source = options.source ?? 'claude'
   if (target === 'local' && process.platform === 'win32') {
     return [
       '@echo off',
@@ -46,7 +49,7 @@ export function getManagedScript(
           ]
         : []),
       // Why: use curl.exe to avoid an extra PowerShell startup per hook.
-      buildWindowsAgentHookCurlPostCommand('claude'),
+      buildWindowsAgentHookCurlPostCommand(source),
       'exit /b 0',
       ...buildWindowsHookStdinDrainEpilogue(),
       ''
@@ -59,7 +62,7 @@ export function getManagedScript(
     'printf "{}\\n"',
     ...buildPosixHookPayloadCapture(),
     ...(options.skipWhenGrokImportsClaude ? buildPosixGrokReplayGuardLines() : []),
-    ...buildPosixHookSpoolLines('claude'),
+    ...buildPosixHookSpoolLines(source),
     ...(options.skipWhenDevinImportsClaude
       ? [
           // Why: Devin imports .claude hooks by default; skip Orca's managed hook there so status posts stay attributed to Devin.
@@ -84,7 +87,7 @@ export function getManagedScript(
     '  exit 0',
     'fi',
     // Why: keep full hook JSON off the command line and avoid IDS-friendly URL-encoded paths.
-    ...buildPosixAgentHookPostCommand('claude').map((line, index, lines) =>
+    ...buildPosixAgentHookPostCommand(source).map((line, index, lines) =>
       index === lines.length - 1 ? `${line} >/dev/null 2>&1 || spool_hook_event` : line
     ),
     'exit 0',
diff --git a/src/main/claude/hook-service.ts b/src/main/claude/hook-service.ts
index 73e7add40dcc..1e9a0d91982f 100644
--- a/src/main/claude/hook-service.ts
+++ b/src/main/claude/hook-service.ts
@@ -1,4 +1,5 @@
 import { existsSync, rmSync, writeFileSync } from 'node:fs'
+import type { AgentHookSource } from '../../shared/agent-hook-relay'
 import type { SFTPWrapper } from 'ssh2'
 import type { AgentHookInstallState, AgentHookInstallStatus } from '../../shared/agent-hook-types'
 import {
@@ -38,6 +39,7 @@ import {
   hasSameManagedHookInvocation,
   removeManagedHooks,
   removeManagedStatusLine,
+  type ApplyManagedClaudeHooksOptions,
   type ClaudeCompatibleHookSettings
 } from './hook-settings'
 
@@ -45,6 +47,8 @@ type ClaudeHookServiceOptions = {
   agent: AgentHookInstallStatus['agent']
   displayName: string
   settings: ClaudeCompatibleHookSettings
+  source?: AgentHookSource
+  events?: ApplyManagedClaudeHooksOptions['events']
 }
 
 type ClaudeHookInstallOptions = {
@@ -82,7 +86,7 @@ export class ClaudeHookService {
     const expectedHook = getManagedLifecycleHook(scriptPath, this.options.settings)
     const missing: string[] = []
     let presentCount = 0
-    for (const event of CLAUDE_EVENTS) {
+    for (const event of this.options.events ?? CLAUDE_EVENTS) {
       const definitions = Array.isArray(config.hooks?.[event.eventName])
         ? config.hooks![event.eventName]!
         : []
@@ -115,6 +119,7 @@ export class ClaudeHookService {
     await refreshManagedScriptIfPresent(
       getManagedScriptPath(this.options.settings),
       getManagedScript('local', {
+        source: this.options.source,
         skipWhenDevinImportsClaude: this.options.agent === 'claude',
         skipWhenGrokImportsClaude: this.options.agent === 'claude'
       })
@@ -145,11 +150,12 @@ export class ClaudeHookService {
       config,
       hook,
       getManagedScriptFileName(this.options.settings),
-      this.options.agent === 'claude' ? options : undefined
+      { ...(this.options.agent === 'claude' ? options : {}), events: this.options.events }
     )
     writeManagedScript(
       scriptPath,
       getManagedScript('local', {
+        source: this.options.source,
         skipWhenDevinImportsClaude: this.options.agent === 'claude',
         skipWhenGrokImportsClaude: this.options.agent === 'claude'
       })
@@ -211,12 +217,10 @@ export class ClaudeHookService {
 
       // Why: settings resolve HOME at runtime while SFTP still targets the discovered remote home.
       const hook = buildManagedCommandHook(getRemoteManagedCommand(remoteScriptPath))
-      const nextConfig = applyManagedHooks(
-        config,
-        hook,
-        remoteScriptFileName,
-        this.options.agent === 'claude' ? options : undefined
-      )
+      const nextConfig = applyManagedHooks(config, hook, remoteScriptFileName, {
+        ...(this.options.agent === 'claude' ? options : {}),
+        events: this.options.events
+      })
 
       // Why: write scripts before settings to avoid settings pointing to missing scripts.
       // Why: SSH scripts always use POSIX .sh paths, regardless of the local OS.
@@ -224,6 +228,7 @@ export class ClaudeHookService {
         sftp,
         remoteScriptPath,
         getManagedScript('posix', {
+          source: this.options.source,
           skipWhenDevinImportsClaude: this.options.agent === 'claude',
           skipWhenGrokImportsClaude: this.options.agent === 'claude'
         })
diff --git a/src/main/claude/hook-settings.ts b/src/main/claude/hook-settings.ts
index 92ffa9606a2d..185aa0b545a9 100644
--- a/src/main/claude/hook-settings.ts
+++ b/src/main/claude/hook-settings.ts
@@ -6,22 +6,23 @@ import {
   getSharedManagedScriptPath,
   isPlainObject,
   MANAGED_HOOK_TIMEOUT_SECONDS,
-  quotePowerShellString,
   removeManagedCommands,
   wrapWindowsPowerShellEncodedCommand,
   type HookCommandConfig,
   type HookDefinition,
   type HooksConfig
 } from '../agent-hooks/installer-utils'
+import { quotePowerShellLiteral } from '../../shared/powershell-native-argument'
 import { wrapRuntimeHomeHookCommand } from '../agent-hooks/runtime-home-hook-command'
 import { wrapWindowsDirectCmdHookCommand } from '../agent-hooks/windows-direct-cmd-hook-command'
 import { isGitBashAvailable } from '../git-bash'
 import { claudeVersionSupportsSessionEnd } from './claude-session-end-hook-capability'
 
 export type ClaudeCompatibleHookSettings = {
-  configDirName: '.claude' | '.openclaude'
-  scriptBaseName: 'claude-hook' | 'openclaude-hook'
+  configDirName: '.claude' | '.openclaude' | '.qoder'
+  scriptBaseName: 'claude-hook' | 'openclaude-hook' | 'qoder-hook'
   usesWindowsCompatLauncher: boolean
+  windowsHookShell?: 'powershell'
 }
 
 export const CLAUDE_HOOK_SETTINGS: ClaudeCompatibleHookSettings = {
@@ -109,6 +110,7 @@ const CLAUDE_SESSION_END_EVENT = {
 
 export type ApplyManagedClaudeHooksOptions = {
   claudeVersion?: string
+  events?: readonly { eventName: string; definition: Omit<HookDefinition, 'hooks'> }[]
 }
 
 export function getConfigPath(settings = CLAUDE_HOOK_SETTINGS): string {
@@ -171,6 +173,14 @@ export function getManagedLifecycleHook(
   if (process.platform !== 'win32' || !settings.usesWindowsCompatLauncher) {
     return buildManagedCommandHook(getManagedCommand(scriptPath, { neutralJsonWhenMissing: true }))
   }
+  if (settings.windowsHookShell === 'powershell') {
+    return {
+      type: 'command',
+      command: getWindowsPowerShellLifecycleCommand(scriptPath),
+      shell: 'powershell',
+      timeout: MANAGED_HOOK_TIMEOUT_SECONDS
+    }
+  }
   return getWindowsManagedLifecycleHook(scriptPath, options)
 }
 
@@ -190,27 +200,30 @@ export function getWindowsManagedLifecycleHook(
   if (directCommand) {
     return { type: 'command', command: directCommand, timeout: MANAGED_HOOK_TIMEOUT_SECONDS }
   }
-  const scriptFileName = win32.basename(scriptPath)
-  // Why: runtime profile resolution keeps the managed entry portable across users (STA-3348).
-  const quotedRelativePath = quotePowerShellString(`.orca\\agent-hooks\\${scriptFileName}`)
-  // Why: compat consumers require neutral JSON even when the managed script is missing (#14818).
-  const innerCommand =
-    `$scriptPath = Join-Path $env:USERPROFILE ${quotedRelativePath}; ` +
-    'if (Test-Path -LiteralPath $scriptPath -PathType Leaf) { & $scriptPath; exit $LASTEXITCODE }; ' +
-    "[Console]::In.ReadToEnd() | Out-Null; Write-Output '{}'; exit 0"
   return {
     type: 'command',
-    command: wrapWindowsPowerShellEncodedCommand(innerCommand),
+    command: wrapWindowsPowerShellEncodedCommand(getWindowsPowerShellLifecycleCommand(scriptPath)),
     timeout: MANAGED_HOOK_TIMEOUT_SECONDS
   }
 }
 
+function getWindowsPowerShellLifecycleCommand(scriptPath: string): string {
+  const scriptFileName = win32.basename(scriptPath)
+  const quotedRelativePath = quotePowerShellLiteral(`.orca\\agent-hooks\\${scriptFileName}`)
+  return (
+    `$scriptPath = Join-Path $env:USERPROFILE ${quotedRelativePath}; ` +
+    'if (Test-Path -LiteralPath $scriptPath -PathType Leaf) { & $scriptPath; exit $LASTEXITCODE }; ' +
+    "[Console]::In.ReadToEnd() | Out-Null; Write-Output '{}'; exit 0"
+  )
+}
+
 export function hasSameManagedHookInvocation(
   actual: HookCommandConfig,
   expected: HookCommandConfig
 ): boolean {
   return (
     actual.command === expected.command &&
+    actual.shell === expected.shell &&
     JSON.stringify(actual.args ?? []) === JSON.stringify(expected.args ?? [])
   )
 }
@@ -228,7 +241,9 @@ export function applyManagedHooks(
   const nextHooks = { ...config.hooks }
   const isManagedCommand = createManagedCommandMatcher(scriptFileName)
   const sessionEndCapable = claudeVersionSupportsSessionEnd(options.claudeVersion)
-  const events = sessionEndCapable ? [...CLAUDE_EVENTS, CLAUDE_SESSION_END_EVENT] : CLAUDE_EVENTS
+  const events =
+    options.events ??
+    (sessionEndCapable ? [...CLAUDE_EVENTS, CLAUDE_SESSION_END_EVENT] : CLAUDE_EVENTS)
 
   for (const event of events) {
     const current = Array.isArray(nextHooks[event.eventName]) ? nextHooks[event.eventName] : []
@@ -240,7 +255,7 @@ export function applyManagedHooks(
     nextHooks[event.eventName] = [...cleaned, definition]
   }
 
-  if (!sessionEndCapable) {
+  if (!sessionEndCapable && !options.events) {
     const current = Array.isArray(nextHooks.SessionEnd) ? nextHooks.SessionEnd : []
     const cleaned = removeManagedCommands(current, isManagedCommand)
     if (cleaned.length === 0) {
diff --git a/src/main/cli/cli-privileged-processes.test.ts b/src/main/cli/cli-privileged-processes.test.ts
index e391df0bc6b7..16d59af2df90 100644
--- a/src/main/cli/cli-privileged-processes.test.ts
+++ b/src/main/cli/cli-privileged-processes.test.ts
@@ -4,7 +4,11 @@ const runProcessMock = vi.hoisted(() => vi.fn())
 
 vi.mock('../../shared/child-process/run-process', () => ({ runProcess: runProcessMock }))
 
-import { runMacPrivilegedCommand, runWindowsPathCommand } from './cli-privileged-processes'
+import {
+  runMacPrivilegedCommand,
+  runWindowsPathCommand,
+  writeWindowsUserPath
+} from './cli-privileged-processes'
 
 describe('Windows CLI PATH process boundary', () => {
   beforeEach(() => runProcessMock.mockReset())
@@ -55,6 +59,21 @@ describe('Windows CLI PATH process boundary', () => {
       stderr: 'UnauthorizedAccessException'
     })
   })
+
+  it('doubles typographic single quotes in the PATH literal', async () => {
+    runProcessMock.mockResolvedValue({
+      code: 0,
+      signal: null,
+      stdout: '',
+      stderr: '',
+      timedOut: false
+    })
+
+    await writeWindowsUserPath('C:\\O\u2019Brien\\bin')
+    expect(runProcessMock.mock.calls[0][0].args.at(-1)).toBe(
+      "[Environment]::SetEnvironmentVariable('Path', 'C:\\O\u2019\u2019Brien\\bin', 'User')"
+    )
+  })
 })
 
 describe('macOS CLI privileged process boundary', () => {
diff --git a/src/main/cli/cli-privileged-processes.ts b/src/main/cli/cli-privileged-processes.ts
index 70e9e3cfb70a..89acc2542e01 100644
--- a/src/main/cli/cli-privileged-processes.ts
+++ b/src/main/cli/cli-privileged-processes.ts
@@ -1,4 +1,5 @@
 import { runProcess } from '../../shared/child-process/run-process'
+import { quotePowerShellLiteral } from '../../shared/powershell-native-argument'
 import { WINDOWS_PATH_WRITE_TIMEOUT_MS } from './cli-install-constants'
 
 export async function runMacPrivilegedCommand(command: string): Promise<void> {
@@ -21,7 +22,7 @@ export async function writeWindowsUserPath(value: string): Promise<void> {
   await runWindowsPathCommand([
     '-NoProfile',
     '-Command',
-    `[Environment]::SetEnvironmentVariable('Path', ${quotePowerShell(value)}, 'User')`
+    `[Environment]::SetEnvironmentVariable('Path', ${quotePowerShellLiteral(value)}, 'User')`
   ])
 }
 
@@ -49,7 +50,3 @@ function processFailure(
   Object.assign(error, { code: result.code, stderr: result.stderr })
   return error
 }
-
-function quotePowerShell(value: string): string {
-  return `'${value.replaceAll("'", "''")}'`
-}
diff --git a/src/main/cli/wsl-cli-powershell-boundary.test.ts b/src/main/cli/wsl-cli-powershell-boundary.test.ts
index ddfdabe9ad32..500d1a29f8ff 100644
--- a/src/main/cli/wsl-cli-powershell-boundary.test.ts
+++ b/src/main/cli/wsl-cli-powershell-boundary.test.ts
@@ -1,9 +1,10 @@
 import { spawnSync } from 'node:child_process'
-import { mkdir, mkdtemp, writeFile } from 'node:fs/promises'
+import { mkdir, mkdtemp, realpath, writeFile } from 'node:fs/promises'
 import { removeTree } from '../../shared/windows-transient-lock-removal'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { describe, expect, it } from 'vitest'
+import { runProcessSync } from '../../shared/child-process/run-process'
 import { buildWslBridgeScript, buildWslLauncher } from './wsl-cli-scripts'
 
 const FORWARDED_ARGS = [
@@ -32,6 +33,58 @@ const FORWARDED_ARGS = [
 ]
 
 describe('WSL CLI PowerShell boundary', () => {
+  it.skipIf(process.platform === 'win32')(
+    'forwards the distro as one argument and omits it when absent',
+    async () => {
+      const root = await mkdtemp(join(tmpdir(), 'orca-wsl-launcher-argv-'))
+      try {
+        const launcherPath = join(root, 'launcher.sh')
+        const expectedCwd = await realpath(root)
+        await writeFile(launcherPath, buildWslLauncher('C:\\Orca\\orca.exe', '/bridge.ps1'))
+        await writeFile(join(root, 'wslpath'), '#!/bin/bash\nprintf "%s" "$2"\n', {
+          mode: 0o700
+        })
+        await writeFile(join(root, 'powershell.exe'), '#!/bin/bash\nprintf "%s\\0" "$@"\n', {
+          mode: 0o700
+        })
+        for (const distro of [undefined, '', 'Ubuntu Work']) {
+          const env: NodeJS.ProcessEnv = {
+            ...process.env,
+            PATH: `${root}:${process.env.PATH ?? ''}`
+          }
+          delete env.WSL_DISTRO_NAME
+          if (distro !== undefined) {
+            env.WSL_DISTRO_NAME = distro
+          }
+          const result = runProcessSync({
+            program: '/bin/bash',
+            args: [launcherPath, 'account', 'add', '--agent', 'codex'],
+            env,
+            cwd: root
+          })
+          expect(result.code).toBe(0)
+          expect(result.stdout.split('\0').slice(0, -1)).toEqual([
+            '-NoProfile',
+            '-ExecutionPolicy',
+            'Bypass',
+            '-File',
+            '/bridge.ps1',
+            'C:\\Orca\\orca.exe',
+            '-WslCwd',
+            expectedCwd,
+            ...(distro ? ['-WslDistro', distro] : []),
+            'account',
+            'add',
+            '--agent',
+            'codex'
+          ])
+        }
+      } finally {
+        await removeTree(root)
+      }
+    }
+  )
+
   it('keeps forwarded argv outside PowerShell parsing', () => {
     const launcher = buildWslLauncher('C:\\Program Files\\Orca\\orca.exe')
     const bridge = buildWslBridgeScript()
@@ -58,21 +111,33 @@ describe('WSL CLI PowerShell boundary', () => {
         await writeFile(bridgePath, buildWslBridgeScript(), 'utf8')
         await writeFile(
           targetPath,
-          'process.stdout.write(JSON.stringify({ argv: process.argv.slice(2), cwd: process.env.ORCA_CLI_CWD ?? null }))\n',
+          'process.stdout.write(JSON.stringify({ argv: process.argv.slice(2), cwd: process.env.ORCA_CLI_CWD ?? null, distro: process.env.ORCA_CLI_WSL_DISTRO ?? null }))\n',
           'utf8'
         )
         const invocations = [
+          {
+            bridgeArgs: [
+              process.execPath,
+              '-WslCwd',
+              wslCwd,
+              '-WslDistro',
+              'Ubuntu Work',
+              targetPath,
+              ...FORWARDED_ARGS
+            ],
+            expected: { argv: FORWARDED_ARGS, cwd: wslCwd, distro: 'Ubuntu Work' }
+          },
           {
             bridgeArgs: [process.execPath, '-WslCwd', wslCwd, targetPath, ...FORWARDED_ARGS],
-            expected: { argv: FORWARDED_ARGS, cwd: wslCwd }
+            expected: { argv: FORWARDED_ARGS, cwd: wslCwd, distro: null }
           },
           {
             bridgeArgs: [process.execPath, '-WslCwd', wslCwd, targetPath],
-            expected: { argv: [], cwd: wslCwd }
+            expected: { argv: [], cwd: wslCwd, distro: null }
           },
           {
             bridgeArgs: [process.execPath, targetPath, ...FORWARDED_ARGS],
-            expected: { argv: FORWARDED_ARGS, cwd: null }
+            expected: { argv: FORWARDED_ARGS, cwd: null, distro: null }
           }
         ]
         for (const { bridgeArgs, expected } of invocations) {
@@ -87,7 +152,16 @@ describe('WSL CLI PowerShell boundary', () => {
               bridgePath,
               ...bridgeArgs
             ],
-            { encoding: 'utf8', env: { ...process.env, ORCA_CLI_CWD: 'stale' } }
+            {
+              encoding: 'utf8',
+              windowsHide: true,
+              env: {
+                ...process.env,
+                ORCA_CLI_CWD: 'stale',
+                ORCA_CLI_WSL_DISTRO: 'stale-distro',
+                WSL_DISTRO_NAME: 'wrong-distro'
+              }
+            }
           )
 
           expect(result.error).toBeUndefined()
@@ -109,7 +183,7 @@ describe('WSL CLI PowerShell boundary', () => {
             '-e',
             'process.exit(23)'
           ],
-          { encoding: 'utf8' }
+          { encoding: 'utf8', windowsHide: true }
         )
         expect(exitResult.error).toBeUndefined()
         expect(exitResult.status).toBe(23)
@@ -118,4 +192,61 @@ describe('WSL CLI PowerShell boundary', () => {
       }
     }
   )
+
+  it.skipIf(process.platform !== 'win32')(
+    'pins a non-ASCII app identity and the dev launcher env through Windows PowerShell 5.1',
+    async () => {
+      const root = await mkdtemp(join(tmpdir(), 'orca-wsl-managed-bridge-'))
+      const userDataPath = join(root, "张三's O\u2019Brien Orca")
+      const cliEntryPath = join(root, 'cli \u2018entry\u2019.cjs')
+      const bridgePath = join(root, 'orca-wsl-bridge.ps1')
+      try {
+        await writeFile(bridgePath, buildWslBridgeScript({ userDataPath, cliEntryPath }), 'utf8')
+        await writeFile(
+          cliEntryPath,
+          'console.error("to stderr"); const e = process.env; console.log(JSON.stringify({ argv: process.argv.slice(2), owner: e.ORCA_USER_DATA_PATH, app: e.ORCA_APP_EXECUTABLE, nodeOptions: e.NODE_OPTIONS ?? null, stashed: e.ORCA_NODE_OPTIONS, cliDir: e.ORCA_WSL_CLI_DIR ?? null }))\n',
+          'utf8'
+        )
+        const result = spawnSync(
+          'powershell.exe',
+          [
+            '-NoProfile',
+            '-NonInteractive',
+            '-ExecutionPolicy',
+            'Bypass',
+            '-File',
+            bridgePath,
+            process.execPath,
+            '-WslCwd',
+            root,
+            ...FORWARDED_ARGS
+          ],
+          {
+            encoding: 'utf8',
+            windowsHide: true,
+            env: {
+              ...process.env,
+              ORCA_APP_EXECUTABLE: '',
+              NODE_OPTIONS: '--max-old-space-size=4096',
+              ORCA_WSL_CLI_DIR: 'C:\\guest-only'
+            }
+          }
+        )
+
+        expect(result.error).toBeUndefined()
+        expect(result.status, result.stderr).toBe(0)
+        expect(result.stderr).toContain('to stderr')
+        expect(JSON.parse(result.stdout.trim())).toEqual({
+          argv: FORWARDED_ARGS,
+          owner: userDataPath,
+          app: process.execPath,
+          nodeOptions: null,
+          stashed: '--max-old-space-size=4096',
+          cliDir: null
+        })
+      } finally {
+        await removeTree(root)
+      }
+    }
+  )
 })
diff --git a/src/main/cli/wsl-cli-scripts.ts b/src/main/cli/wsl-cli-scripts.ts
index 8875a81d18ec..3f4e4156433d 100644
--- a/src/main/cli/wsl-cli-scripts.ts
+++ b/src/main/cli/wsl-cli-scripts.ts
@@ -1,9 +1,44 @@
+import { quotePowerShellLiteral } from '../../shared/powershell-native-argument'
+
 const MANAGED_MARKER = '# Orca managed WSL CLI launcher'
 const BRIDGE_MANAGED_MARKER = '# Orca managed WSL CLI PowerShell bridge'
 
+const FIND_INTEROP_POWERSHELL = `if command -v powershell.exe >/dev/null 2>&1; then
+  ORCA_POWERSHELL=powershell.exe
+elif [ -x /mnt/c/Windows/System32/WindowsPowerShell/v1.0/powershell.exe ]; then
+  ORCA_POWERSHELL=/mnt/c/Windows/System32/WindowsPowerShell/v1.0/powershell.exe
+else
+  echo "Orca WSL CLI requires Windows interop and could not find powershell.exe." >&2
+  exit 1
+fi`
+
 export function buildWslLauncher(
   windowsLauncherPath: string,
   bridgePath = '${XDG_DATA_HOME:-$HOME/.local/share}/orca/orca-wsl-bridge.ps1'
+): string {
+  return buildLauncher(windowsLauncherPath, quoteShell(bridgePath), FIND_INTEROP_POWERSHELL)
+}
+
+/** Launcher that finds its bridge beside itself and PowerShell by Windows path, independent of guest PATH. */
+export function buildColocatedWslLauncher(
+  windowsLauncherPath: string,
+  windowsPowerShellPath: string
+): string {
+  return buildLauncher(
+    windowsLauncherPath,
+    '"$(dirname -- "$0")/orca-wsl-bridge.ps1"',
+    `ORCA_POWERSHELL=$(wslpath -u ${quoteShell(windowsPowerShellPath)})
+if [ ! -x "$ORCA_POWERSHELL" ]; then
+  echo "Orca WSL CLI requires Windows interop and access to $ORCA_POWERSHELL." >&2
+  exit 1
+fi`
+  )
+}
+
+function buildLauncher(
+  windowsLauncherPath: string,
+  bridgePathExpression: string,
+  resolvePowerShell: string
 ): string {
   const encodedTarget = Buffer.from(windowsLauncherPath, 'utf8').toString('base64')
   return `#!/usr/bin/env bash
@@ -11,15 +46,8 @@ set -euo pipefail
 ${MANAGED_MARKER}
 # ORCA_WIN_LAUNCHER_B64=${encodedTarget}
 ORCA_WIN_LAUNCHER=${quoteShell(windowsLauncherPath)}
-ORCA_BRIDGE_PS1=${quoteShell(bridgePath)}
-if command -v powershell.exe >/dev/null 2>&1; then
-  ORCA_POWERSHELL=powershell.exe
-elif [ -x /mnt/c/Windows/System32/WindowsPowerShell/v1.0/powershell.exe ]; then
-  ORCA_POWERSHELL=/mnt/c/Windows/System32/WindowsPowerShell/v1.0/powershell.exe
-else
-  echo "Orca WSL CLI requires Windows interop and could not find powershell.exe." >&2
-  exit 1
-fi
+ORCA_BRIDGE_PS1=${bridgePathExpression}
+${resolvePowerShell}
 # Why: a shell can outlive a deleted worktree; keep explicit CLI selectors and
 # help usable, and repair cwd before any WSL interop tool tries to resolve it.
 ORCA_WSL_CWD=$(pwd -P 2>/dev/null) || {
@@ -28,12 +56,28 @@ ORCA_WSL_CWD=$(pwd -P 2>/dev/null) || {
 }
 ORCA_BRIDGE_PS1_WIN=$(wslpath -w "$ORCA_BRIDGE_PS1")
 ORCA_WSL_CWD_WIN=$(wslpath -w "$ORCA_WSL_CWD")
+if [ -n "\${WSL_DISTRO_NAME:-}" ]; then
+  set -- -WslDistro "$WSL_DISTRO_NAME" "$@"
+fi
 exec "$ORCA_POWERSHELL" -NoProfile -ExecutionPolicy Bypass -File "$ORCA_BRIDGE_PS1_WIN" "$ORCA_WIN_LAUNCHER" -WslCwd "$ORCA_WSL_CWD_WIN" "$@"
 `
 }
 
-export function buildWslBridgeScript(): string {
-  return `${BRIDGE_MANAGED_MARKER}
+/** `app` pins the bridge to one Orca instance; the guest-registered bridge omits it. */
+export function buildWslBridgeScript(app?: {
+  userDataPath: string
+  cliEntryPath?: string
+}): string {
+  const setAppEnv = app
+    ? [
+        `$env:ORCA_USER_DATA_PATH = ${quotePowerShellLiteral(app.userDataPath)}`,
+        // Why: WSLENV /p maps this guest-only dir back; an app the CLI starts must not inherit it.
+        'Remove-Item Env:ORCA_WSL_CLI_DIR -ErrorAction SilentlyContinue',
+        ...(app.cliEntryPath ? buildDevCliEnv(app.cliEntryPath) : [])
+      ]
+    : []
+  // Why the BOM: PowerShell 5.1 reads BOM-less scripts as ANSI, garbling non-ASCII embedded paths.
+  return `${app ? '\uFEFF' : ''}${BRIDGE_MANAGED_MARKER}
 function ConvertTo-NativeCommandLineArgument {
   param([AllowEmptyString()][string]$Value)
 
@@ -71,6 +115,7 @@ try {
   }
   [string]$OrcaLauncher = $args[0]
   [string]$WslCwd = ''
+  [string]$WslDistro = ''
   [int]$ForwardArgStart = 1
   if ($args.Count -ge 2 -and $args[1] -eq '-WslCwd') {
     if ($args.Count -lt 3) {
@@ -79,6 +124,13 @@ try {
     $WslCwd = $args[2]
     $ForwardArgStart = 3
   }
+  if ($ForwardArgStart -eq 3 -and $args.Count -ge 4 -and $args[3] -eq '-WslDistro') {
+    if ($args.Count -lt 5) {
+      throw 'Invalid Orca WSL CLI bridge invocation.'
+    }
+    $WslDistro = $args[4]
+    $ForwardArgStart = 5
+  }
   [string[]]$ForwardArgs = @()
   if ($args.Count -gt $ForwardArgStart) {
     $ForwardArgs = @($args[$ForwardArgStart..($args.Count - 1)])
@@ -88,12 +140,18 @@ try {
   } else {
     $env:ORCA_CLI_CWD = $WslCwd
   }
+  # Do not let an inherited Windows environment choose the caller's account location.
+  if ([string]::IsNullOrEmpty($WslDistro)) {
+    Remove-Item Env:ORCA_CLI_WSL_DISTRO -ErrorAction SilentlyContinue
+  } else {
+    $env:ORCA_CLI_WSL_DISTRO = $WslDistro
+  }
   $LauncherDirectory = Split-Path -Parent $OrcaLauncher
   Push-Location -LiteralPath $LauncherDirectory
   # Why: Windows PowerShell 5.1 cannot losslessly splat strings to native argv.
   $StartInfo = [System.Diagnostics.ProcessStartInfo]::new()
   $StartInfo.FileName = $OrcaLauncher
-  $StartInfo.Arguments = (($ForwardArgs | ForEach-Object {
+${bridgeLines(setAppEnv)}  $StartInfo.Arguments = (($ForwardArgs | ForEach-Object {
     ConvertTo-NativeCommandLineArgument $_
   }) -join ' ')
   $StartInfo.UseShellExecute = $false
@@ -119,6 +177,22 @@ exit $exitCode
 `
 }
 
+/** Runs the dev CLI directly (its .cmd launcher adds a cmd.exe quoting boundary) with that launcher's env. */
+function buildDevCliEnv(cliEntryPath: string): string[] {
+  return [
+    "$env:ELECTRON_RUN_AS_NODE = '1'",
+    "if (-not $env:ORCA_APP_EXECUTABLE) { $env:ORCA_APP_EXECUTABLE = $OrcaLauncher; $env:ORCA_APP_EXECUTABLE_NEEDS_APP_ROOT = '1' }",
+    '$env:ORCA_NODE_OPTIONS = $env:NODE_OPTIONS',
+    '$env:ORCA_NODE_REPL_EXTERNAL_MODULE = $env:NODE_REPL_EXTERNAL_MODULE',
+    'Remove-Item Env:NODE_OPTIONS, Env:NODE_REPL_EXTERNAL_MODULE -ErrorAction SilentlyContinue',
+    `$ForwardArgs = @(${quotePowerShellLiteral(cliEntryPath)}) + $ForwardArgs`
+  ]
+}
+
+function bridgeLines(lines: readonly string[]): string {
+  return lines.map((line) => `  ${line}\n`).join('')
+}
+
 export function getBridgePathFromCommandPath(commandPath: string): string {
   // Why: both the current Linux command and the legacy pre-rename command
   // share one WSL bridge under ~/.local/share/orca.
diff --git a/src/main/cli/wsl-managed-cli.test.ts b/src/main/cli/wsl-managed-cli.test.ts
new file mode 100644
index 000000000000..23e764f5a5ba
--- /dev/null
+++ b/src/main/cli/wsl-managed-cli.test.ts
@@ -0,0 +1,68 @@
+import { mkdtempSync, mkdirSync, readFileSync, rmSync, statSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it } from 'vitest'
+import { installFakeAppEnvironment } from '../../../config/scripts/vitest-host-ports-setup'
+import { getManagedWslCliDir } from './wsl-managed-cli'
+
+const roots: string[] = []
+afterEach(() => {
+  for (const root of roots.splice(0)) {
+    rmSync(root, { recursive: true, force: true })
+  }
+})
+function fixture() {
+  const root = mkdtempSync(join(tmpdir(), 'orca-managed-wsl-'))
+  roots.push(root)
+  const resourcesPath = join(root, 'resources with spaces')
+  mkdirSync(join(resourcesPath, 'bin'), { recursive: true })
+  writeFileSync(join(resourcesPath, 'bin', 'orca.exe'), 'fixture')
+  return { isPackaged: true, resourcesPath, userDataPath: join(root, 'user data') }
+}
+
+describe('managed WSL CLI provisioning', () => {
+  it('reuses a complete tree, repairs missing files, and isolates app identities and updates', () => {
+    const host = fixture()
+    const directory = getManagedWslCliDir(host) ?? ''
+    const launcher = join(directory, 'orca-ide')
+    const modified = statSync(launcher).mtimeMs
+    expect(getManagedWslCliDir(host)).toBe(directory)
+    expect(statSync(launcher).mtimeMs).toBe(modified)
+    rmSync(launcher)
+    expect(getManagedWslCliDir(host)).toBe(directory)
+    expect(readFileSync(launcher, 'utf8')).toContain('resources with spaces')
+    const second = { ...host, userDataPath: join(host.userDataPath, 'second') }
+    expect(getManagedWslCliDir(second)).not.toBe(directory)
+    const update = fixture()
+    expect(getManagedWslCliDir({ ...update, userDataPath: host.userDataPath })).not.toBe(directory)
+  })
+
+  it('provides nothing when the packaged CLI runtime is missing', () => {
+    const host = fixture()
+    rmSync(join(host.resourcesPath, 'bin', 'orca.exe'))
+    expect(getManagedWslCliDir(host)).toBeNull()
+  })
+
+  it('provides nothing when user data cannot hold the CLI', () => {
+    const host = fixture()
+    writeFileSync(host.userDataPath, 'a file, not a directory')
+    expect(getManagedWslCliDir(host)).toBeNull()
+  })
+
+  it('runs the development CLI directly with the dev launcher env', () => {
+    const host = fixture()
+    const appPath = host.resourcesPath
+    const cliEntryPath = join(appPath, 'out', 'cli', 'index.js')
+    mkdirSync(join(appPath, 'out', 'cli'), { recursive: true })
+    writeFileSync(cliEntryPath, 'fixture')
+    installFakeAppEnvironment({ getPath: () => host.userDataPath, getAppPath: () => appPath })
+    const directory = getManagedWslCliDir({ ...host, isPackaged: false }) ?? ''
+    expect(readFileSync(join(directory, 'orca-dev'), 'utf8')).toContain(process.execPath)
+    const bridge = readFileSync(join(directory, 'orca-wsl-bridge.ps1'), 'utf8')
+    expect(bridge.startsWith('\uFEFF')).toBe(true)
+    expect(bridge).toContain(host.userDataPath)
+    expect(bridge).toContain(cliEntryPath)
+    expect(bridge).toContain('$env:ORCA_APP_EXECUTABLE_NEEDS_APP_ROOT')
+    expect(bridge).toContain('Remove-Item Env:NODE_OPTIONS')
+  })
+})
diff --git a/src/main/cli/wsl-managed-cli.ts b/src/main/cli/wsl-managed-cli.ts
new file mode 100644
index 000000000000..2e3c478b9a92
--- /dev/null
+++ b/src/main/cli/wsl-managed-cli.ts
@@ -0,0 +1,53 @@
+import { createHash } from 'node:crypto'
+import { existsSync } from 'node:fs'
+import { join } from 'node:path'
+import { getAppEnvironment } from '../../shared/app-environment'
+import { windowsPowerShellPath } from '../../shared/child-process/windows-system-binary'
+import { writeShellWrapperFiles } from '../shell-wrapper-file-writer'
+import { getBundledLauncherPath, LINUX_CLI_COMMAND_NAME } from './bundled-cli-launcher-path'
+import { DEV_COMMAND_NAME } from './cli-install-constants'
+import { buildColocatedWslLauncher, buildWslBridgeScript } from './wsl-cli-scripts'
+
+/** Packaged builds share `orca-ide` with guest registration; dev builds get their own name. */
+export function getWslCliCommandName(isPackaged: boolean): string {
+  return isPackaged ? LINUX_CLI_COMMAND_NAME : DEV_COMMAND_NAME
+}
+
+let warnedMissingRuntime = false
+
+/**
+ * Directory holding this app's WSL launcher and bridge, or null when the CLI runtime is
+ * missing or unwritable. Content-addressed like shell-ready wrappers: builds sharing userData
+ * never overwrite each other, and a present file is complete because each one lands by rename.
+ */
+export function getManagedWslCliDir(opts: {
+  isPackaged: boolean
+  userDataPath: string
+  resourcesPath?: string
+}): string | null {
+  const cliEntryPath = opts.isPackaged
+    ? undefined
+    : join(getAppEnvironment().getAppPath(), 'out', 'cli', 'index.js')
+  const launcherPath = opts.isPackaged
+    ? opts.resourcesPath && getBundledLauncherPath('win32', opts.resourcesPath)
+    : process.execPath
+  if (!launcherPath || !existsSync(cliEntryPath ?? launcherPath)) {
+    if (!warnedMissingRuntime) {
+      warnedMissingRuntime = true
+      console.warn('[WSL CLI] Orca CLI runtime is missing; WSL terminals will not provide it.')
+    }
+    return null
+  }
+  const launcher = buildColocatedWslLauncher(launcherPath, windowsPowerShellPath())
+  const bridge = buildWslBridgeScript({ userDataPath: opts.userDataPath, cliEntryPath })
+  const digest = createHash('sha256').update(launcher).update(bridge).digest('hex').slice(0, 20)
+  const directory = join(opts.userDataPath, 'wsl-managed-cli', digest)
+  const files = [
+    [join(directory, getWslCliCommandName(opts.isPackaged)), launcher],
+    [join(directory, 'orca-wsl-bridge.ps1'), bridge]
+  ] as const
+  const ready =
+    files.every(([path]) => existsSync(path)) ||
+    writeShellWrapperFiles(files, '[WSL CLI]', 'WSL terminals will start without the Orca CLI')
+  return ready ? directory : null
+}
diff --git a/src/main/cli/wsl-managed-cli.wsl.test.ts b/src/main/cli/wsl-managed-cli.wsl.test.ts
new file mode 100644
index 000000000000..c7738397d772
--- /dev/null
+++ b/src/main/cli/wsl-managed-cli.wsl.test.ts
@@ -0,0 +1,142 @@
+import { mkdtempSync, mkdirSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { dirname, join } from 'node:path'
+import { expect, it } from 'vitest'
+import { runProcess } from '../../shared/child-process/run-process'
+import { removeTree } from '../../shared/windows-transient-lock-removal'
+import { buildWslExecArgs } from '../../shared/wsl-login-shell-command'
+import { installFakeAppEnvironment } from '../../../config/scripts/vitest-host-ports-setup'
+import { addOrcaWslInteropEnv } from '../pty/wsl-orca-env'
+import { getManagedWslCliDir } from './wsl-managed-cli'
+import { buildLocalShellReadyWrapperFiles } from '../providers/local-pty-shell-ready-wrapper-fileset'
+
+// Explicit opt-in: never require a developer's WSL installation for unit tests.
+const enabled = process.platform === 'win32' && process.env.ORCA_TEST_MANAGED_WSL === '1'
+const FIXTURE_CLI =
+  'if(process.argv.includes("--exit"))process.exit(23); console.error("bridge stderr"); console.log(JSON.stringify({argv:process.argv.slice(2),owner:process.env.ORCA_USER_DATA_PATH,handle:process.env.ORCA_TERMINAL_HANDLE}))'
+
+async function withManagedCli(
+  run: (fixture: {
+    env: Record<string, string>
+    guestRoot: string
+    root: string
+    userDataPath: string
+    wsl: (args: string[], input?: string) => ReturnType<typeof runProcess>
+  }) => Promise<void>
+): Promise<void> {
+  const root = mkdtempSync(join(tmpdir(), "orca WSL's managed CLI "))
+  const distro = process.env.ORCA_TEST_WSL_DISTRO || undefined
+  const userDataPath = join(root, 'user data 张三 O\u2019Brien')
+  const env: Record<string, string> = { ORCA_BACKGROUND_LAUNCH: '1' }
+  for (const [key, value] of Object.entries(process.env)) {
+    if (value !== undefined) {
+      env[key] = value
+    }
+  }
+  const wsl = (args: string[], input?: string) =>
+    runProcess({
+      program: 'wsl.exe',
+      args: buildWslExecArgs(distro, args),
+      env,
+      cwd: root,
+      input,
+      timeoutMs: 30_000
+    })
+  const snapshot = () =>
+    wsl([
+      'sh',
+      '-c',
+      'for file in "$HOME/.profile" "$HOME/.bashrc" "$HOME/.bash_profile" "$HOME/.zshrc" "$HOME/.zprofile" "$HOME/.zshenv" "$HOME/.local/bin/orca" "$HOME/.local/bin/orca-ide" "$HOME/.local/bin/orca-dev" "$HOME/.local/share/orca/orca-wsl-bridge.ps1"; do if [ -f "$file" ]; then sha256sum "$file"; fi; done; printf "PATH=%s\\n" "$PATH"'
+    ])
+  try {
+    const before = await snapshot()
+    expect(before.code, before.stderr).toBe(0)
+    mkdirSync(join(root, 'out', 'cli'), { recursive: true })
+    writeFileSync(join(root, 'out', 'cli', 'index.js'), FIXTURE_CLI)
+    for (const [path, content] of buildLocalShellReadyWrapperFiles(join(root, 'wrapper'))) {
+      mkdirSync(dirname(path), { recursive: true })
+      writeFileSync(path, content)
+    }
+    const translated = await wsl(['wslpath', '-u', root])
+    expect(translated.code, translated.stderr).toBe(0)
+    installFakeAppEnvironment({ getPath: () => userDataPath, getAppPath: () => root })
+    const directory = getManagedWslCliDir({ isPackaged: false, userDataPath })
+    expect(directory).not.toBeNull()
+    Object.assign(env, {
+      ORCA_WSL_CLI_DIR: directory ?? '',
+      ORCA_CLI_COMMAND: 'orca-dev',
+      ORCA_TERMINAL_HANDLE: 'term_managed_fixture'
+    })
+    addOrcaWslInteropEnv(env)
+    await run({ env, guestRoot: translated.stdout.trim(), root, userDataPath, wsl })
+    expect((await snapshot()).stdout).toBe(before.stdout)
+  } finally {
+    await removeTree(root)
+  }
+}
+
+it.skipIf(!enabled)(
+  'executes the managed bridge after bash startup resets PATH, without guest registration',
+  () =>
+    withManagedCli(async ({ env, guestRoot, root, userDataPath, wsl }) => {
+      writeFileSync(join(root, '.bash_profile'), 'export PATH=/usr/bin:/bin\n')
+      const shell = (command: string) =>
+        wsl([
+          'env',
+          `HOME=${guestRoot}`,
+          'PATH=/usr/bin:/bin',
+          'bash',
+          '--rcfile',
+          `${guestRoot}/wrapper/bash/rcfile`,
+          '-ic',
+          command
+        ])
+
+      const result = await shell('orca-dev "two words" "literal $" | cat')
+      expect(result.code, result.stderr).toBe(0)
+      expect(result.stderr).toContain('bridge stderr')
+      expect(result.stdout).toContain('"argv":["two words","literal $"]')
+      expect(result.stdout).toContain(JSON.stringify(userDataPath))
+      expect(result.stdout).toContain('"handle":"term_managed_fixture"')
+      expect((await shell('orca-dev --exit')).code).toBe(23)
+
+      env.ORCA_WSL_CLI_DIR = join(root, 'missing-cli')
+      // An unusable CLI warns but never blocks the shell.
+      const missing = await shell('echo SHELL_CONTINUED')
+      expect(missing.code).toBe(0)
+      expect(missing.stdout).toContain('SHELL_CONTINUED')
+      expect(missing.stderr).toContain('Check WSL Windows-drive mount options')
+    }),
+  90_000
+)
+
+// Why a PTY: the zsh restore runs from the first-prompt hook, which `zsh -c` never reaches.
+it.skipIf(!enabled)(
+  'executes the managed bridge from an interactive zsh after .zshrc resets PATH',
+  (ctx) =>
+    withManagedCli(async ({ guestRoot, root, userDataPath, wsl }) => {
+      if ((await wsl(['sh', '-c', 'command -v zsh && command -v script'])).code !== 0) {
+        ctx.skip()
+      }
+      writeFileSync(join(root, '.zshrc'), 'export PATH=/usr/bin:/bin\n')
+      const result = await wsl(
+        [
+          'env',
+          `HOME=${guestRoot}`,
+          'PATH=/usr/bin:/bin',
+          `ZDOTDIR=${guestRoot}/wrapper/zsh`,
+          'script',
+          '-qec',
+          'zsh -l',
+          '/dev/null'
+        ],
+        `orca-dev "two words" > "$HOME/zsh-out"; print -r -- "path=$PATH" >> "$HOME/zsh-out"; exit\n`
+      )
+      expect(result.code, result.stderr).toBe(0)
+      const output = await wsl(['cat', `${guestRoot}/zsh-out`])
+      expect(output.stdout).toContain('"argv":["two words"]')
+      expect(output.stdout).toContain(JSON.stringify(userDataPath))
+      expect(output.stdout).toMatch(/path=\/mnt\/.*wsl-managed-cli\/[0-9a-f]{20}:\/usr\/bin:\/bin/)
+    }),
+  90_000
+)
diff --git a/src/main/codex-accounts/async-file-rename.test.ts b/src/main/codex-accounts/async-file-rename.test.ts
new file mode 100644
index 000000000000..a453378a78d8
--- /dev/null
+++ b/src/main/codex-accounts/async-file-rename.test.ts
@@ -0,0 +1,87 @@
+import { mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from 'node:fs'
+import type * as NodeFsPromises from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, expect, it, vi } from 'vitest'
+import { writeFileDurable, writeFileDurableIfCurrent } from '../durable-file-write'
+
+const rename = vi.hoisted(() => vi.fn())
+vi.mock('node:fs/promises', async (importOriginal) => {
+  const actual = await importOriginal<typeof NodeFsPromises>()
+  rename.mockImplementation(actual.rename)
+  return { ...actual, rename }
+})
+
+const platform = process.platform
+const roots: string[] = []
+afterEach(() => {
+  Object.defineProperty(process, 'platform', { value: platform })
+  for (const root of roots.splice(0)) {
+    rmSync(root, { recursive: true, force: true })
+  }
+  rename.mockClear()
+  vi.restoreAllMocks()
+})
+
+function fixture() {
+  const root = mkdtempSync(join(tmpdir(), 'orca-async-rename-'))
+  roots.push(root)
+  const target = join(root, 'state.json')
+  const temporary = join(root, 'temporary.json')
+  writeFileSync(target, 'old')
+  return { root, target, temporary }
+}
+
+it.each(['EPERM', 'EACCES', 'EBUSY'])(
+  'retries a transient Windows %s without blocking the event loop',
+  async (code) => {
+    const { target, temporary } = fixture()
+    Object.defineProperty(process, 'platform', { value: 'win32' })
+    rename.mockRejectedValueOnce(Object.assign(new Error('file busy'), { code }))
+    let ticked = false
+    const timer = setTimeout(() => {
+      ticked = true
+    }, 0)
+    try {
+      await writeFileDurable(temporary, target, 'new')
+      expect(readFileSync(target, 'utf8')).toBe('new')
+      expect(rename).toHaveBeenCalledTimes(2)
+      expect(ticked).toBe(true)
+    } finally {
+      clearTimeout(timer)
+    }
+  }
+)
+
+it.each([
+  ['win32', 'EPERM', 6],
+  ['win32', 'ENOSPC', 1],
+  ['linux', 'EBUSY', 1]
+] as const)('bounds %s %s failures and preserves the old file', async (host, code, attempts) => {
+  const { root, target, temporary } = fixture()
+  Object.defineProperty(process, 'platform', { value: host })
+  for (let attempt = 0; attempt < attempts; attempt++) {
+    rename.mockRejectedValueOnce(Object.assign(new Error('injected file failure'), { code }))
+  }
+  await expect(writeFileDurable(temporary, target, 'new')).rejects.toThrow('injected file failure')
+  expect(rename).toHaveBeenCalledTimes(attempts)
+  expect(readFileSync(target, 'utf8')).toBe('old')
+  expect(readdirSync(root)).toEqual(['state.json'])
+})
+
+it('does not publish a superseded snapshot after a Windows retry delay', async () => {
+  const { root, target, temporary } = fixture()
+  Object.defineProperty(process, 'platform', { value: 'win32' })
+  let current = true
+  rename.mockImplementationOnce(async () => {
+    current = false
+    writeFileSync(target, 'newer snapshot')
+    throw Object.assign(new Error('busy'), { code: 'EBUSY' })
+  })
+  await expect(
+    writeFileDurableIfCurrent(temporary, target, 'stale snapshot', () => current)
+  ).resolves.toBe(false)
+  expect(rename).toHaveBeenCalledOnce()
+  expect(readFileSync(target, 'utf8')).toBe('newer snapshot')
+  expect(readdirSync(root)).toEqual(['state.json'])
+})
diff --git a/src/main/codex-accounts/codex-account-selection.ts b/src/main/codex-accounts/codex-account-selection.ts
index ad97d80696ba..24785e79dc12 100644
--- a/src/main/codex-accounts/codex-account-selection.ts
+++ b/src/main/codex-accounts/codex-account-selection.ts
@@ -28,7 +28,7 @@ type CodexAccountSelectionDependencies = {
   lifecycle: CodexAccountServiceLifecycle
   resolveSystemDefault: () => CodexSystemDefaultIdentity
   removeManagedHome: (candidatePath: string, expectedAccountId: string) => void
-  discardResetAttempts: (accountId: string) => void
+  discardResetAttempts: (accountId: string) => Promise<void>
 }
 
 export class CodexAccountSelection {
@@ -83,10 +83,13 @@ export class CodexAccountSelection {
     }
 
     this.dependencies.removeManagedHome(account.managedHomePath, account.id)
-    // Why: a removed account can no longer appear in the switcher dropdown,
-    // so purge its cached usage to avoid stale entries.
     this.dependencies.rateLimits.evictInactiveCodexCache(accountId)
-    this.dependencies.discardResetAttempts(accountId)
+    try {
+      await this.dependencies.discardResetAttempts(accountId)
+    } catch (error) {
+      // Removal already succeeded; retain the ledger's safety guards if cleanup fails.
+      console.warn('[codex-accounts] Removed account, but credit ledger cleanup failed:', error)
+    }
     const accountTarget = getCodexSelectionTargetForAccount(account)
     this.startQuotaRefresh(
       getSelectedCodexAccountIdForTarget(settings, accountTarget) === accountId
diff --git a/src/main/codex-accounts/codex-config-mirror.test.ts b/src/main/codex-accounts/codex-config-mirror.test.ts
new file mode 100644
index 000000000000..2dc54094bc44
--- /dev/null
+++ b/src/main/codex-accounts/codex-config-mirror.test.ts
@@ -0,0 +1,93 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import type * as NodeOs from 'node:os'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { getDefaultSettings } from '../../shared/constants'
+
+const testState = vi.hoisted(() => ({ fakeHomeDir: '' }))
+
+vi.mock('electron', () => ({
+  app: {
+    getPath: () => {
+      throw new Error('tests pass explicit homes')
+    }
+  }
+}))
+
+vi.mock('node:os', async () => {
+  const actual = await vi.importActual<typeof NodeOs>('node:os')
+  return { ...actual, homedir: () => testState.fakeHomeDir }
+})
+
+import { CodexConfigMirror } from './codex-config-mirror'
+
+const OVERRIDE_LINE = 'daemon_auto_start = false # orca: CODEX_HOME too long for the daemon socket'
+
+describe('CodexConfigMirror without ~/.codex/config.toml', () => {
+  let root: string
+  let managedHomePath: string
+  let mirror: CodexConfigMirror
+
+  beforeEach(() => {
+    root = mkdtempSync(join(tmpdir(), 'orca-codex-accounts-mirror-'))
+    testState.fakeHomeDir = join(root, 'user-home')
+    mkdirSync(testState.fakeHomeDir)
+    // Long enough to exceed sun_path on every platform, like a real account home.
+    managedHomePath = join(root, 'a'.repeat(80), 'home')
+    mkdirSync(managedHomePath, { recursive: true })
+    const settings = {
+      ...getDefaultSettings(testState.fakeHomeDir),
+      codexManagedAccounts: [
+        {
+          id: 'acct',
+          email: 'user@example.com',
+          managedHomePath,
+          createdAt: 1,
+          updatedAt: 1,
+          lastAuthenticatedAt: 1
+        }
+      ]
+    }
+    mirror = new CodexConfigMirror({ getSettings: () => settings }, (path) => path)
+  })
+
+  afterEach(() => {
+    rmSync(root, { recursive: true, force: true })
+  })
+
+  it('still guards every managed home against the daemon socket limit', () => {
+    mirror.safeSyncToManagedHomes()
+
+    expect(readFileSync(join(managedHomePath, 'config.toml'), 'utf-8')).toBe(
+      `[features]\n${OVERRIDE_LINE}\n`
+    )
+    expect(existsSync(join(testState.fakeHomeDir, '.codex'))).toBe(false)
+  })
+
+  it('leaves a WSL home to launch prep instead of running its blocking ownership check', () => {
+    const assertManagedHomePath = vi.fn((path: string) => path)
+    const wslMirror = new CodexConfigMirror(
+      { getSettings: () => getDefaultSettings(testState.fakeHomeDir) },
+      assertManagedHomePath
+    )
+
+    wslMirror.safeSyncIntoManagedHome(
+      '\\\\wsl.localhost\\Ubuntu\\home\\u\\.local\\share\\orca\\codex-accounts\\acct\\home',
+      undefined,
+      'acct'
+    )
+
+    expect(assertManagedHomePath).not.toHaveBeenCalled()
+  })
+
+  it('adds the guard without touching settings already in the managed home', () => {
+    writeFileSync(join(managedHomePath, 'config.toml'), 'model = "gpt-5"\n')
+
+    mirror.safeSyncIntoManagedHome(managedHomePath, undefined, 'acct')
+
+    expect(readFileSync(join(managedHomePath, 'config.toml'), 'utf-8')).toBe(
+      `model = "gpt-5"\n\n[features]\n${OVERRIDE_LINE}\n`
+    )
+  })
+})
diff --git a/src/main/codex-accounts/codex-config-mirror.ts b/src/main/codex-accounts/codex-config-mirror.ts
index 252ffb06d337..a45f85360687 100644
--- a/src/main/codex-accounts/codex-config-mirror.ts
+++ b/src/main/codex-accounts/codex-config-mirror.ts
@@ -2,7 +2,10 @@ import { existsSync, readFileSync } from 'node:fs'
 import { homedir } from 'node:os'
 import { join } from 'node:path'
 import { parseWslUncPath } from '../../shared/wsl-paths'
-import { syncSystemConfigIntoManagedCodexHome } from '../codex/codex-config-mirror'
+import {
+  ensureCodexDaemonSocketGuard,
+  syncSystemConfigIntoManagedCodexHome
+} from '../codex/codex-config-mirror'
 import { readCodexTopLevelModelProvider } from '../codex/codex-model-provider-config'
 import type { Store } from '../persistence'
 import { toWindowsWslPath } from '../wsl'
@@ -17,7 +20,7 @@ export type CanonicalCodexConfig = {
 
 export class CodexConfigMirror {
   constructor(
-    private readonly store: Store,
+    private readonly store: Pick<Store, 'getSettings'>,
     private readonly assertManagedHomePath: (
       candidatePath: string,
       expectedAccountId?: string
@@ -106,6 +109,11 @@ export class CodexConfigMirror {
     expectedAccountId?: string
   ): void {
     if (canonicalConfig === null) {
+      // Why: with no ~/.codex/config.toml there is nothing to mirror, but Codex still cannot start in a long home without the daemon guard.
+      // WSL homes are skipped: their ownership check is a blocking wsl.exe call (startup, account switch), and WSL launch prep guards the home it launches.
+      if (!parseWslUncPath(managedHomePath)) {
+        ensureCodexDaemonSocketGuard(this.assertManagedHomePath(managedHomePath, expectedAccountId))
+      }
       return
     }
     const trustedManagedHomePath = this.assertManagedHomePath(managedHomePath, expectedAccountId)
diff --git a/src/main/codex-accounts/codex-reset-credit-coordinator.ts b/src/main/codex-accounts/codex-reset-credit-coordinator.ts
index 5d6233d46eb1..cd0c8ad8569f 100644
--- a/src/main/codex-accounts/codex-reset-credit-coordinator.ts
+++ b/src/main/codex-accounts/codex-reset-credit-coordinator.ts
@@ -171,8 +171,8 @@ export class CodexResetCreditCoordinator {
     })
   }
 
-  discardForRemovedAccount(accountId: string): void {
-    this.ledger.discardForRemovedAccount(accountId)
+  discardForRemovedAccount(accountId: string): Promise<void> {
+    return this.ledger.discardForRemovedAccount(accountId)
   }
 
   private startAttempt(
@@ -182,6 +182,9 @@ export class CodexResetCreditCoordinator {
   ): Promise<CodexResetCreditConsumeResult> {
     const promise = this.dependencies.serializeMutation(
       async (): Promise<CodexResetCreditConsumeResult> => {
+        if (this.ledger.error) {
+          throw this.ledger.error
+        }
         const isFresh = attempt.state === 'fresh'
         let validation: { managedHomePath: string; rateLimits: RateLimitState }
         try {
@@ -204,7 +207,7 @@ export class CodexResetCreditCoordinator {
           throw error
         }
         if (isFresh) {
-          this.ledger.markProviderPending(idempotencyKey, attempt)
+          await this.ledger.markProviderPending(idempotencyKey, attempt)
         }
         const { outcome, state } =
           await this.dependencies.rateLimits.consumeCodexRateLimitResetCredit({
@@ -220,7 +223,7 @@ export class CodexResetCreditCoordinator {
           codex: this.dependencies.getSnapshot(),
           rateLimits: state
         }
-        this.ledger.markSettled(idempotencyKey, attempt, outcome)
+        await this.ledger.markSettled(idempotencyKey, attempt, outcome)
         return result
       }
     )
diff --git a/src/main/codex-accounts/codex-reset-credit-ledger.test.ts b/src/main/codex-accounts/codex-reset-credit-ledger.test.ts
new file mode 100644
index 000000000000..32f13e33d786
--- /dev/null
+++ b/src/main/codex-accounts/codex-reset-credit-ledger.test.ts
@@ -0,0 +1,131 @@
+import { describe, expect, it, vi } from 'vitest'
+import type { CodexResetCreditAttemptLedger } from '../../shared/codex-reset-credit-attempt-ledger'
+import type { CodexResetCreditExpectedScope } from '../../shared/codex-reset-credit-scope'
+import { ProfileStateWriterError } from '../persistence/profile-state/profile-state-writer-errors'
+import { CodexResetCreditLedger } from './codex-reset-credit-ledger'
+
+function scope(accountId: string): CodexResetCreditExpectedScope {
+  return {
+    target: { runtime: 'host', wslDistro: null },
+    accountId,
+    accountRevision: 1,
+    offerRevision: 'offer-1'
+  }
+}
+
+function setup() {
+  let durable: CodexResetCreditAttemptLedger = { version: 1, attempts: [] }
+  const barrier = vi.fn(async () => {})
+  const store = {
+    getCodexResetCreditAttemptLedger: () => structuredClone(durable),
+    replaceCodexResetCreditAttemptLedgerAndFlush: vi.fn(
+      async (next: CodexResetCreditAttemptLedger) => {
+        await barrier()
+        durable = structuredClone(next)
+      }
+    )
+  }
+  return { ledger: new CodexResetCreditLedger(store), store, barrier }
+}
+
+describe('async reset-credit ledger', () => {
+  it('serializes replacement construction so concurrent account writes survive', async () => {
+    const { ledger, store, barrier } = setup()
+    const gate = Promise.withResolvers<void>()
+    barrier.mockImplementationOnce(() => gate.promise)
+    const first = ledger.createFresh('first', scope('account-1'))
+    const second = ledger.createFresh('second', scope('account-2'))
+    const pendingFirst = ledger.markProviderPending('first', first)
+    const pendingSecond = ledger.markProviderPending('second', second)
+    await vi.waitFor(() => expect(barrier).toHaveBeenCalledOnce())
+    expect(first.state).toBe('fresh')
+    expect(second.state).toBe('fresh')
+    expect(store.getCodexResetCreditAttemptLedger().attempts).toEqual([])
+
+    gate.resolve()
+    await Promise.all([pendingFirst, pendingSecond])
+    expect(store.getCodexResetCreditAttemptLedger().attempts).toMatchObject([
+      { idempotencyKey: 'first', state: 'providerPending' },
+      { idempotencyKey: 'second', state: 'providerPending' }
+    ])
+    expect(ledger.getUnresolvedKey(first.accountScopeKey)).toBe('first')
+    expect(ledger.getUnresolvedKey(second.accountScopeKey)).toBe('second')
+  })
+
+  it('keeps pending guards until settlement commits and can retry a known failure', async () => {
+    const { ledger, store, barrier } = setup()
+    const attempt = ledger.createFresh('first', scope('account-1'))
+    await ledger.markProviderPending('first', attempt)
+    const gate = Promise.withResolvers<void>()
+    barrier.mockImplementationOnce(() => gate.promise)
+    const settled = ledger.markSettled('first', attempt, 'reset')
+    const rejected = expect(settled).rejects.toThrow('disk full')
+    await vi.waitFor(() => expect(barrier).toHaveBeenCalledTimes(2))
+    expect(attempt.state).toBe('providerPending')
+    expect(ledger.getUnresolvedKey(attempt.accountScopeKey)).toBe('first')
+
+    gate.reject(new Error('disk full'))
+    await rejected
+    expect(attempt.state).toBe('providerPending')
+    expect(store.getCodexResetCreditAttemptLedger().attempts[0]?.state).toBe('providerPending')
+    expect(ledger.error).toBeNull()
+    await ledger.markSettled('first', attempt, 'alreadyRedeemed')
+    expect(attempt.settledOutcome).toBe('alreadyRedeemed')
+    expect(ledger.getUnresolvedKey(attempt.accountScopeKey)).toBeUndefined()
+  })
+
+  it('waits for queued writes before removing an account and retains other accounts', async () => {
+    const { ledger, store, barrier } = setup()
+    const first = ledger.createFresh('first', scope('account-1'))
+    const second = ledger.createFresh('second', scope('account-2'))
+    await ledger.markProviderPending('first', first)
+    const gate = Promise.withResolvers<void>()
+    barrier.mockImplementationOnce(() => gate.promise)
+    const pendingSecond = ledger.markProviderPending('second', second)
+    const removed = ledger.discardForRemovedAccount('account-1')
+    await vi.waitFor(() => expect(barrier).toHaveBeenCalledTimes(2))
+    expect(ledger.get('first')).toBe(first)
+
+    gate.resolve()
+    await Promise.all([pendingSecond, removed])
+    expect(store.getCodexResetCreditAttemptLedger().attempts).toMatchObject([
+      { idempotencyKey: 'second', state: 'providerPending' }
+    ])
+    expect(ledger.get('first')).toBeUndefined()
+    expect(ledger.getUnresolvedKey(first.accountScopeKey)).toBeUndefined()
+    expect(ledger.get('second')).toBe(second)
+  })
+
+  it('retains the removed account guard when its async durability barrier fails', async () => {
+    const { ledger, barrier } = setup()
+    const attempt = ledger.createFresh('first', scope('account-1'))
+    await ledger.markProviderPending('first', attempt)
+    barrier.mockRejectedValueOnce(new Error('disk full'))
+    await expect(ledger.discardForRemovedAccount('account-1')).rejects.toThrow('disk full')
+    expect(ledger.get('first')).toBe(attempt)
+    expect(ledger.getUnresolvedKey(attempt.accountScopeKey)).toBe('first')
+  })
+
+  it('fails queued and future mutations closed when a commit outcome is unknown', async () => {
+    const { ledger, store, barrier } = setup()
+    const attempt = ledger.createFresh('first', scope('account-1'))
+    const second = ledger.createFresh('second', scope('account-2'))
+    const gate = Promise.withResolvers<void>()
+    barrier.mockImplementationOnce(() => gate.promise)
+    const pending = ledger.markProviderPending('first', attempt)
+    const queued = ledger.markProviderPending('second', second)
+    const rejected = expect(pending).rejects.toThrow('worker stopped')
+    const blocked = expect(queued).rejects.toThrow('durability is unknown')
+    await vi.waitFor(() => expect(barrier).toHaveBeenCalledOnce())
+    gate.reject(new ProfileStateWriterError('worker-exit', 'worker stopped', 'indeterminate'))
+    await Promise.all([rejected, blocked])
+
+    ledger.releaseFresh('first', attempt)
+    expect(ledger.get('first')).toBe(attempt)
+    expect(ledger.getClaimedKey(attempt.scopeKey)).toBe('first')
+    expect(store.replaceCodexResetCreditAttemptLedgerAndFlush).toHaveBeenCalledOnce()
+    await expect(ledger.discardForRemovedAccount('account-1')).rejects.toThrow(
+      'durability is unknown'
+    )
+  })
+})
diff --git a/src/main/codex-accounts/codex-reset-credit-ledger.ts b/src/main/codex-accounts/codex-reset-credit-ledger.ts
index 625731f7d385..77590bcfe362 100644
--- a/src/main/codex-accounts/codex-reset-credit-ledger.ts
+++ b/src/main/codex-accounts/codex-reset-credit-ledger.ts
@@ -9,6 +9,7 @@ import type {
   RateLimitRuntimeTarget
 } from '../../shared/rate-limit-types'
 import type { Store } from '../persistence'
+import { profileStateWriterFailureOutcome } from '../persistence/profile-state/profile-state-writer-errors'
 
 export type CodexResetCreditAttempt = {
   expectedScope: CodexResetCreditExpectedScope
@@ -45,14 +46,20 @@ export class CodexResetCreditLedger {
   private readonly attemptKeyByOffer = new Map<string, string>()
   private readonly unresolvedKeyByAccountScope = new Map<string, string>()
   private durableLedger: CodexResetCreditAttemptLedger | null = null
-  private loadError: Error | null = null
+  private stateError: Error | null = null
+  private mutationQueue: Promise<void> = Promise.resolve()
 
-  constructor(private readonly store: Store) {
+  constructor(
+    private readonly store: Pick<
+      Store,
+      'getCodexResetCreditAttemptLedger' | 'replaceCodexResetCreditAttemptLedgerAndFlush'
+    >
+  ) {
     this.hydrate()
   }
 
   get error(): Error | null {
-    return this.loadError
+    return this.stateError
   }
 
   get(idempotencyKey: string): CodexResetCreditAttempt | undefined {
@@ -114,32 +121,40 @@ export class CodexResetCreditLedger {
     )
   }
 
-  markProviderPending(idempotencyKey: string, attempt: CodexResetCreditAttempt): void {
-    this.persist({ idempotencyKey, expectedScope: attempt.expectedScope, state: 'providerPending' })
-    attempt.state = 'providerPending'
-    this.unresolvedKeyByAccountScope.set(attempt.accountScopeKey, idempotencyKey)
+  markProviderPending(idempotencyKey: string, attempt: CodexResetCreditAttempt): Promise<void> {
+    return this.serializeMutation(async () => {
+      await this.persist({
+        idempotencyKey,
+        expectedScope: attempt.expectedScope,
+        state: 'providerPending'
+      })
+      attempt.state = 'providerPending'
+      this.unresolvedKeyByAccountScope.set(attempt.accountScopeKey, idempotencyKey)
+    })
   }
 
   markSettled(
     idempotencyKey: string,
     attempt: CodexResetCreditAttempt,
     outcome: CodexRateLimitResetOutcome
-  ): void {
-    this.persist({
-      idempotencyKey,
-      expectedScope: attempt.expectedScope,
-      state: 'settled',
-      outcome
+  ): Promise<void> {
+    return this.serializeMutation(async () => {
+      await this.persist({
+        idempotencyKey,
+        expectedScope: attempt.expectedScope,
+        state: 'settled',
+        outcome
+      })
+      attempt.state = 'settled'
+      attempt.settledOutcome = outcome
+      if (this.unresolvedKeyByAccountScope.get(attempt.accountScopeKey) === idempotencyKey) {
+        this.unresolvedKeyByAccountScope.delete(attempt.accountScopeKey)
+      }
     })
-    attempt.state = 'settled'
-    attempt.settledOutcome = outcome
-    if (this.unresolvedKeyByAccountScope.get(attempt.accountScopeKey) === idempotencyKey) {
-      this.unresolvedKeyByAccountScope.delete(attempt.accountScopeKey)
-    }
   }
 
   releaseFresh(idempotencyKey: string, attempt: CodexResetCreditAttempt): void {
-    if (attempt.state !== 'fresh') {
+    if (attempt.state !== 'fresh' || this.stateError) {
       return
     }
     this.attemptsByKey.delete(idempotencyKey)
@@ -151,7 +166,11 @@ export class CodexResetCreditLedger {
   // Why: a removed account's managed home is gone, so its unresolved providerPending
   // attempt can never validate or be replayed; drop it so a target-scoped default reset
   // is not wedged forever by hasPendingResetForTarget matching the orphan.
-  discardForRemovedAccount(accountId: string): void {
+  discardForRemovedAccount(accountId: string): Promise<void> {
+    return this.serializeMutation(() => this.discardAccountAttempts(accountId))
+  }
+
+  private async discardAccountAttempts(accountId: string): Promise<void> {
     const staleAttempts = [...this.attemptsByKey].filter(
       ([, attempt]) => attempt.expectedScope.accountId === accountId
     )
@@ -167,7 +186,7 @@ export class CodexResetCreditLedger {
         const nextLedger: CodexResetCreditAttemptLedger = { version: 1, attempts }
         // Persist first so a failed durability barrier leaves the in-memory
         // fail-closed guards aligned with the ledger that will reload.
-        this.store.replaceCodexResetCreditAttemptLedgerAndFlush(nextLedger)
+        await this.store.replaceCodexResetCreditAttemptLedgerAndFlush(nextLedger)
         this.durableLedger = structuredClone(nextLedger)
       }
     }
@@ -202,14 +221,34 @@ export class CodexResetCreditLedger {
         }
       }
     } catch (error) {
-      this.loadError =
+      this.stateError =
         error instanceof Error ? error : new Error('Codex reset-credit attempt ledger is corrupt')
     }
   }
 
-  private persist(nextAttempt: DurableCodexResetCreditAttempt): void {
+  private serializeMutation(operation: () => Promise<void>): Promise<void> {
+    const next = this.mutationQueue.then(async () => {
+      if (this.stateError) {
+        throw this.stateError
+      }
+      try {
+        await operation()
+      } catch (error) {
+        if (profileStateWriterFailureOutcome(error) === 'indeterminate') {
+          this.stateError = new Error('Codex reset-credit attempt durability is unknown', {
+            cause: error
+          })
+        }
+        throw error
+      }
+    })
+    this.mutationQueue = next.catch(() => {})
+    return next
+  }
+
+  private async persist(nextAttempt: DurableCodexResetCreditAttempt): Promise<void> {
     if (!this.durableLedger) {
-      throw this.loadError ?? new Error('Codex reset-credit attempt ledger is unavailable')
+      throw this.stateError ?? new Error('Codex reset-credit attempt ledger is unavailable')
     }
     const index = this.durableLedger.attempts.findIndex(
       (attempt) => attempt.idempotencyKey === nextAttempt.idempotencyKey
@@ -221,7 +260,7 @@ export class CodexResetCreditLedger {
       attempts[index] = nextAttempt
     }
     const nextLedger: CodexResetCreditAttemptLedger = { version: 1, attempts }
-    this.store.replaceCodexResetCreditAttemptLedgerAndFlush(nextLedger)
+    await this.store.replaceCodexResetCreditAttemptLedgerAndFlush(nextLedger)
     this.durableLedger = structuredClone(nextLedger)
   }
 }
diff --git a/src/main/codex-accounts/fs-utils.ts b/src/main/codex-accounts/fs-utils.ts
index e0610cc79c78..295dfac9b66b 100644
--- a/src/main/codex-accounts/fs-utils.ts
+++ b/src/main/codex-accounts/fs-utils.ts
@@ -1,6 +1,8 @@
 import { randomUUID } from 'node:crypto'
 import { copyFileSync, existsSync, linkSync, renameSync, rmSync, writeFileSync } from 'node:fs'
+import { rename } from 'node:fs/promises'
 import { dirname } from 'node:path'
+import { setTimeout } from 'node:timers/promises'
 import { grantDirAcl, isPermissionError } from '../win32-utils'
 import { nodeFileContentsEqualSync } from '../../shared/node-file-content-equality'
 
@@ -168,7 +170,7 @@ function assertHardLinkPublicationSupported(sourcePath: string, targetPath: stri
   }
 }
 
-function publishFileWithoutOverwrite(sourcePath: string, targetPath: string): boolean {
+export function publishFileWithoutOverwrite(sourcePath: string, targetPath: string): boolean {
   try {
     linkSync(sourcePath, targetPath)
     return true
@@ -201,19 +203,38 @@ export function renameFileWithWindowsRetry(source: string, target: string): void
   runFileOperationWithWindowsRetry(() => renameSync(source, target))
 }
 
+export async function renameFileWithWindowsRetryAsync(
+  source: string,
+  target: string,
+  isCurrent: () => boolean = () => true
+): Promise<boolean> {
+  for (let attempt = 1; ; attempt++) {
+    if (!isCurrent()) {
+      return false
+    }
+    try {
+      await rename(source, target)
+      return true
+    } catch (error) {
+      if (!shouldRetryFileOperation(error, attempt)) {
+        throw error
+      }
+      await setTimeout(attempt * 50)
+    }
+  }
+}
+
 export function copyFileWithWindowsRetry(source: string, target: string): void {
   runFileOperationWithWindowsRetry(() => copyFileSync(source, target))
 }
 
 function runFileOperationWithWindowsRetry(operation: () => void): void {
-  const maxAttempts = process.platform === 'win32' ? 6 : 1
-  for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+  for (let attempt = 1; ; attempt++) {
     try {
       operation()
       return
     } catch (error) {
-      const code = (error as NodeJS.ErrnoException).code
-      if (attempt < maxAttempts && (code === 'EPERM' || code === 'EACCES' || code === 'EBUSY')) {
+      if (shouldRetryFileOperation(error, attempt)) {
         sleepSync(attempt * 50)
         continue
       }
@@ -222,6 +243,16 @@ function runFileOperationWithWindowsRetry(operation: () => void): void {
   }
 }
 
+function shouldRetryFileOperation(error: unknown, attempt: number): boolean {
+  return (
+    process.platform === 'win32' &&
+    attempt < 6 &&
+    error instanceof Error &&
+    'code' in error &&
+    (error.code === 'EPERM' || error.code === 'EACCES' || error.code === 'EBUSY')
+  )
+}
+
 // Why: writeFileAtomically is a sync API called from sync paths, so the retry
 // backoff must park the thread instead of burning CPU in a Date.now() loop.
 const sleepBuffer = new Int32Array(new SharedArrayBuffer(4))
diff --git a/src/main/codex-accounts/legacy-shared-config-compatibility.test.ts b/src/main/codex-accounts/legacy-shared-config-compatibility.test.ts
index 4e2dcdf3f741..085777fdf8ce 100644
--- a/src/main/codex-accounts/legacy-shared-config-compatibility.test.ts
+++ b/src/main/codex-accounts/legacy-shared-config-compatibility.test.ts
@@ -10,6 +10,12 @@ const generationRace = vi.hoisted(() => ({
   beforeGuardedReplace: null as (() => void) | null
 }))
 
+// Why: temp homes exceed sun_path on macOS but not on Linux; keep asserted config bytes host-independent.
+vi.mock('../codex/codex-daemon-socket-path-guard', async (importOriginal) => ({
+  ...(await importOriginal<object>()),
+  applyCodexDaemonSocketGuard: (config: string) => config
+}))
+
 vi.mock('./fs-utils', async (importOriginal) => {
   const actual = await importOriginal<typeof FsUtils>()
   return {
diff --git a/src/main/codex-accounts/runtime-home-managed-auth-recovery.test.ts b/src/main/codex-accounts/runtime-home-managed-auth-recovery.test.ts
index a3a4355130d2..438c73ff6a2b 100644
--- a/src/main/codex-accounts/runtime-home-managed-auth-recovery.test.ts
+++ b/src/main/codex-accounts/runtime-home-managed-auth-recovery.test.ts
@@ -13,6 +13,12 @@ import {
   testState
 } from './runtime-home-service-test-harness'
 
+// Why: temp homes exceed sun_path on macOS but not on Linux; keep asserted config bytes host-independent.
+vi.mock('../codex/codex-daemon-socket-path-guard', async (importOriginal) => ({
+  ...(await importOriginal<object>()),
+  applyCodexDaemonSocketGuard: (config: string) => config
+}))
+
 vi.mock('electron', () => ({
   app: {
     getPath: () => testState.userDataDir
diff --git a/src/main/codex-accounts/runtime-home-real-home-lane-routing.test.ts b/src/main/codex-accounts/runtime-home-real-home-lane-routing.test.ts
index c8c3c407c0cc..ef912678e769 100644
--- a/src/main/codex-accounts/runtime-home-real-home-lane-routing.test.ts
+++ b/src/main/codex-accounts/runtime-home-real-home-lane-routing.test.ts
@@ -31,6 +31,12 @@ function expectBaselineKeptWithLaunchDatePending(markerPath: string): void {
   ).toBe(true)
 }
 
+// Why: temp homes exceed sun_path on macOS but not on Linux; keep asserted config bytes host-independent.
+vi.mock('../codex/codex-daemon-socket-path-guard', async (importOriginal) => ({
+  ...(await importOriginal<object>()),
+  applyCodexDaemonSocketGuard: (config: string) => config
+}))
+
 vi.mock('electron', () => ({
   app: {
     getPath: () => testState.userDataDir
diff --git a/src/main/codex-accounts/runtime-home-retained-auth-provenance.test.ts b/src/main/codex-accounts/runtime-home-retained-auth-provenance.test.ts
index 29205f4472c2..40c3a45269cf 100644
--- a/src/main/codex-accounts/runtime-home-retained-auth-provenance.test.ts
+++ b/src/main/codex-accounts/runtime-home-retained-auth-provenance.test.ts
@@ -17,6 +17,12 @@ import {
   testState
 } from './runtime-home-service-test-harness'
 
+// Why: temp homes exceed sun_path on macOS but not on Linux; keep asserted config bytes host-independent.
+vi.mock('../codex/codex-daemon-socket-path-guard', async (importOriginal) => ({
+  ...(await importOriginal<object>()),
+  applyCodexDaemonSocketGuard: (config: string) => config
+}))
+
 vi.mock('electron', () => ({
   app: {
     getPath: () => testState.userDataDir
diff --git a/src/main/codex-accounts/runtime-home-system-resource-materialization.test.ts b/src/main/codex-accounts/runtime-home-system-resource-materialization.test.ts
index 86067a584d30..77470b5f984e 100644
--- a/src/main/codex-accounts/runtime-home-system-resource-materialization.test.ts
+++ b/src/main/codex-accounts/runtime-home-system-resource-materialization.test.ts
@@ -13,6 +13,12 @@ import {
   testState
 } from './runtime-home-service-test-harness'
 
+// Why: temp homes exceed sun_path on macOS but not on Linux; keep asserted config bytes host-independent.
+vi.mock('../codex/codex-daemon-socket-path-guard', async (importOriginal) => ({
+  ...(await importOriginal<object>()),
+  applyCodexDaemonSocketGuard: (config: string) => config
+}))
+
 vi.mock('electron', () => ({
   app: {
     getPath: () => testState.userDataDir
diff --git a/src/main/codex-accounts/service-account-add-login.test.ts b/src/main/codex-accounts/service-account-add-login.test.ts
index 68aa3e2f3af4..4bde86486cc2 100644
--- a/src/main/codex-accounts/service-account-add-login.test.ts
+++ b/src/main/codex-accounts/service-account-add-login.test.ts
@@ -17,6 +17,12 @@ import {
 } from './service-test-harness'
 import { createCanonicalHookTrustFixture } from './service-hook-trust-test-fixtures'
 
+// Why: temp homes exceed sun_path on macOS but not on Linux; keep asserted config bytes host-independent.
+vi.mock('../codex/codex-daemon-socket-path-guard', async (importOriginal) => ({
+  ...(await importOriginal<object>()),
+  applyCodexDaemonSocketGuard: (config: string) => config
+}))
+
 vi.mock('electron', () => ({
   app: {
     getPath: () => testState.userDataDir
diff --git a/src/main/codex-accounts/service-account-selection-and-removal.test.ts b/src/main/codex-accounts/service-account-selection-and-removal.test.ts
index a2d7d9a4bb73..861859223ea8 100644
--- a/src/main/codex-accounts/service-account-selection-and-removal.test.ts
+++ b/src/main/codex-accounts/service-account-selection-and-removal.test.ts
@@ -215,47 +215,67 @@ describe('CodexAccountService config sync', () => {
     })
   })
 
-  it('removes an account and cleans up managed home', async () => {
-    const managedHomePath = createManagedHome(
-      testState.userDataDir,
-      'account-1',
-      '',
-      '{"account":"managed"}\n'
-    )
-    const settings = createSettings({
-      codexManagedAccounts: [
-        {
-          id: 'account-1',
-          email: 'user@example.com',
-          managedHomePath,
-          providerAccountId: null,
-          workspaceLabel: null,
-          workspaceAccountId: null,
-          createdAt: 1,
-          updatedAt: 1,
-          lastAuthenticatedAt: 1
-        }
-      ],
-      activeCodexManagedAccountId: 'account-1'
-    })
-    const store = createStore(settings)
-    const rateLimits = createRateLimits()
-    const runtimeHome = createRuntimeHome()
-
-    const { CodexAccountService } = await import('./service')
-    const service = new CodexAccountService(
-      store as never,
-      rateLimits as never,
-      runtimeHome as never
-    )
-
-    const result = await service.removeAccount('account-1')
-
-    expect(result.accounts).toHaveLength(0)
-    expect(result.activeAccountId).toBe(null)
-    expect(existsSync(managedHomePath)).toBe(false)
-    expect(runtimeHome.syncForCurrentSelection).toHaveBeenCalled()
-  })
+  it.each(['healthy', 'unreadable'])(
+    'removes an account with a %s credit ledger',
+    async (ledger) => {
+      const managedHomePath = createManagedHome(
+        testState.userDataDir,
+        'account-1',
+        '',
+        '{"account":"managed"}\n'
+      )
+      const settings = createSettings({
+        codexManagedAccounts: [
+          {
+            id: 'account-1',
+            email: 'user@example.com',
+            managedHomePath,
+            providerAccountId: null,
+            workspaceLabel: null,
+            workspaceAccountId: null,
+            createdAt: 1,
+            updatedAt: 1,
+            lastAuthenticatedAt: 1
+          }
+        ],
+        activeCodexManagedAccountId: 'account-1'
+      })
+      const store = createStore(settings)
+      const rateLimits = createRateLimits()
+      const runtimeHome = createRuntimeHome()
+
+      const ledgerError = new Error('credit ledger unreadable')
+      if (ledger === 'unreadable') {
+        store.getCodexResetCreditAttemptLedger.mockImplementation(() => {
+          throw ledgerError
+        })
+      }
+      const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+
+      const { CodexAccountService } = await import('./service')
+      const service = new CodexAccountService(
+        store as never,
+        rateLimits as never,
+        runtimeHome as never
+      )
+
+      const result = await service.removeAccount('account-1')
+
+      expect(result.accounts).toHaveLength(0)
+      expect(result.activeAccountId).toBe(null)
+      expect(existsSync(managedHomePath)).toBe(false)
+      expect(runtimeHome.syncForCurrentSelection).toHaveBeenCalled()
+      expect(rateLimits.evictInactiveCodexCache).toHaveBeenCalledWith('account-1')
+      if (ledger === 'unreadable') {
+        expect(warn).toHaveBeenCalledWith(
+          '[codex-accounts] Removed account, but credit ledger cleanup failed:',
+          expect.any(Error)
+        )
+        expect(store.replaceCodexResetCreditAttemptLedgerAndFlush).not.toHaveBeenCalled()
+      }
+      warn.mockRestore()
+    }
+  )
 
   it('refuses to remove a managed home owned by a different account', async () => {
     const otherAccountHome = createManagedHome(
diff --git a/src/main/codex-accounts/service-reset-credit-durability.test.ts b/src/main/codex-accounts/service-reset-credit-durability.test.ts
index ac6cd8f2ef73..e524bda2aeb7 100644
--- a/src/main/codex-accounts/service-reset-credit-durability.test.ts
+++ b/src/main/codex-accounts/service-reset-credit-durability.test.ts
@@ -146,9 +146,22 @@ describe('CodexAccountService config sync', () => {
       account,
       limits
     })!
+    const store = createStore(settings)
+    const persist = store.replaceCodexResetCreditAttemptLedgerAndFlush.getMockImplementation()!
+    const pendingCommit = Promise.withResolvers<void>()
+    const settledCommit = Promise.withResolvers<void>()
+    store.replaceCodexResetCreditAttemptLedgerAndFlush
+      .mockImplementationOnce(async (ledger) => {
+        await pendingCommit.promise
+        await persist(ledger)
+      })
+      .mockImplementationOnce(async (ledger) => {
+        await settledCommit.promise
+        await persist(ledger)
+      })
     const { CodexAccountService } = await import('./service')
     const service = new CodexAccountService(
-      createStore(settings) as never,
+      store as never,
       rateLimits as never,
       createRuntimeHome() as never
     )
@@ -157,9 +170,20 @@ describe('CodexAccountService config sync', () => {
     const first = service.consumeRateLimitResetCredit(idempotencyKey, expectedScope)
     const second = service.consumeRateLimitResetCredit(idempotencyKey, expectedScope)
     expect(second).toBe(first)
+    await vi.waitFor(() =>
+      expect(store.replaceCodexResetCreditAttemptLedgerAndFlush).toHaveBeenCalledOnce()
+    )
+    expect(consume).not.toHaveBeenCalled()
+    pendingCommit.resolve()
     await vi.waitFor(() => expect(consume).toHaveBeenCalledOnce())
     const selectingNextAccount = service.selectAccount(nextAccount.id)
     finishConsume?.({ outcome: 'reset', state })
+    await vi.waitFor(() =>
+      expect(store.replaceCodexResetCreditAttemptLedgerAndFlush).toHaveBeenCalledTimes(2)
+    )
+    expect(service.listAccounts().activeAccountId).toBe(account.id)
+    expect(store.getCodexResetCreditAttemptLedger().attempts[0]?.state).toBe('providerPending')
+    settledCommit.resolve()
 
     const resetResults = await Promise.all([first, second])
     expect(resetResults).toMatchObject([
@@ -406,9 +430,10 @@ describe('CodexAccountService config sync', () => {
     const limits = createResetCreditLimits()
     const state = createResetRateLimitState(limits)
     const store = createStore(settings)
-    store.replaceCodexResetCreditAttemptLedgerAndFlush.mockImplementationOnce(() => {
-      throw new Error('disk full')
-    })
+    const pendingCommit = Promise.withResolvers<void>()
+    store.replaceCodexResetCreditAttemptLedgerAndFlush.mockImplementationOnce(
+      () => pendingCommit.promise
+    )
     const consume = vi.fn()
     const expectedScope = buildCodexResetCreditExpectedScope({
       target: state.codexTarget,
@@ -426,9 +451,15 @@ describe('CodexAccountService config sync', () => {
       createRuntimeHome() as never
     )
 
-    await expect(
+    const rejected = expect(
       service.consumeRateLimitResetCredit('bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb', expectedScope)
     ).rejects.toThrow('disk full')
+    await vi.waitFor(() =>
+      expect(store.replaceCodexResetCreditAttemptLedgerAndFlush).toHaveBeenCalledOnce()
+    )
+    expect(consume).not.toHaveBeenCalled()
+    pendingCommit.reject(new Error('disk full'))
+    await rejected
     expect(consume).not.toHaveBeenCalled()
     expect(store.getCodexResetCreditAttemptLedger().attempts).toEqual([])
   })
@@ -453,11 +484,11 @@ describe('CodexAccountService config sync', () => {
     const state = createResetRateLimitState(limits)
     const store = createStore(settings)
     const persist = store.replaceCodexResetCreditAttemptLedgerAndFlush.getMockImplementation()!
-    store.replaceCodexResetCreditAttemptLedgerAndFlush.mockImplementation((ledger) => {
+    store.replaceCodexResetCreditAttemptLedgerAndFlush.mockImplementation(async (ledger) => {
       if (ledger.attempts[0]?.state === 'settled') {
         throw new Error('settle disk full')
       }
-      persist(ledger)
+      return persist(ledger)
     })
     const expectedScope = buildCodexResetCreditExpectedScope({
       target: state.codexTarget,
diff --git a/src/main/codex-accounts/service-reset-credit-home-ownership.test.ts b/src/main/codex-accounts/service-reset-credit-home-ownership.test.ts
index 94e5a1746c38..eebc256a8c66 100644
--- a/src/main/codex-accounts/service-reset-credit-home-ownership.test.ts
+++ b/src/main/codex-accounts/service-reset-credit-home-ownership.test.ts
@@ -145,7 +145,7 @@ describe('Codex reset-credit managed-home ownership', () => {
           }
         ]
       }
-      fixture.store.replaceCodexResetCreditAttemptLedgerAndFlush(pendingLedger)
+      await fixture.store.replaceCodexResetCreditAttemptLedgerAndFlush(pendingLedger)
       makeHomeUnsafe(fixture.managedHomePath)
 
       const settingsBefore = structuredClone(fixture.store.getSettings())
@@ -158,9 +158,10 @@ describe('Codex reset-credit managed-home ownership', () => {
       fixture.store.getCodexResetCreditAttemptLedger.mockClear()
       fixture.store.replaceCodexResetCreditAttemptLedgerAndFlush.mockClear()
       fixture.store.updateSettings.mockClear()
+      const restarted = fixture.createService()
+      // Why: construction mirrors config into every managed home; only the retry itself is under test.
       fsFaults.resetMkdirCalls()
 
-      const restarted = fixture.createService()
       await expect(
         restarted.consumeRateLimitResetCredit(fixture.idempotencyKey, fixture.expectedScope)
       ).rejects.toThrow(expectedError)
@@ -186,13 +187,13 @@ describe('Codex reset-credit managed-home ownership', () => {
     fixture.consume.mockClear()
     fixture.store.replaceCodexResetCreditAttemptLedgerAndFlush.mockClear()
     fixture.store.updateSettings.mockClear()
+    // Why: construction mirrors config into every managed home; only the replay itself is under test.
+    const restarted = fixture.createService()
     fsFaults.hold(join(realpathSync(fixture.managedHomePath), '.orca-managed-home'))
     fsFaults.resetMkdirCalls()
 
     await expect(
-      fixture
-        .createService()
-        .consumeRateLimitResetCredit(fixture.idempotencyKey, fixture.expectedScope)
+      restarted.consumeRateLimitResetCredit(fixture.idempotencyKey, fixture.expectedScope)
     ).resolves.toMatchObject({ outcome: 'reset', scope: fixture.expectedScope })
 
     expect(fsFaults.heldReads()).toBe(0)
diff --git a/src/main/codex-accounts/service-reset-credit-target-routing.test.ts b/src/main/codex-accounts/service-reset-credit-target-routing.test.ts
index ebfe4e3ac1c5..1485794c5f97 100644
--- a/src/main/codex-accounts/service-reset-credit-target-routing.test.ts
+++ b/src/main/codex-accounts/service-reset-credit-target-routing.test.ts
@@ -1,4 +1,5 @@
 import { describe, expect, it, vi } from 'vitest'
+import { existsSync } from 'node:fs'
 import { buildCodexResetCreditExpectedScope } from '../../shared/codex-reset-credit-scope'
 import {
   createManagedHome,
@@ -329,7 +330,7 @@ describe('CodexAccountService config sync', () => {
       limits
     })!
     const store = createStore(settings)
-    store.replaceCodexResetCreditAttemptLedgerAndFlush({
+    await store.replaceCodexResetCreditAttemptLedgerAndFlush({
       version: 1,
       attempts: [
         {
@@ -379,7 +380,7 @@ describe('CodexAccountService config sync', () => {
       limits
     })!
     const store = createStore(settings)
-    store.replaceCodexResetCreditAttemptLedgerAndFlush({
+    await store.replaceCodexResetCreditAttemptLedgerAndFlush({
       version: 1,
       attempts: [
         {
@@ -414,7 +415,7 @@ describe('CodexAccountService config sync', () => {
     expect(store.getCodexResetCreditAttemptLedger().attempts).toEqual([])
   })
 
-  it('keeps reset attempts fail-closed when removal cannot persist their purge', async () => {
+  it('reports account removal while keeping reset attempts guarded after a failed purge', async () => {
     const managedHomePath = createManagedHome(testState.userDataDir, 'account-1')
     const account = {
       id: 'account-1',
@@ -438,7 +439,7 @@ describe('CodexAccountService config sync', () => {
       limits
     })!
     const store = createStore(settings)
-    store.replaceCodexResetCreditAttemptLedgerAndFlush({
+    await store.replaceCodexResetCreditAttemptLedgerAndFlush({
       version: 1,
       attempts: [
         {
@@ -459,11 +460,17 @@ describe('CodexAccountService config sync', () => {
       } as never,
       createRuntimeHome() as never
     )
-    vi.spyOn(store, 'replaceCodexResetCreditAttemptLedgerAndFlush').mockImplementationOnce(() => {
-      throw new Error('disk full')
-    })
+    const failure = new Error('disk full')
+    const warning = vi.spyOn(console, 'warn').mockImplementation(() => {})
+    vi.spyOn(store, 'replaceCodexResetCreditAttemptLedgerAndFlush').mockRejectedValueOnce(failure)
 
-    await expect(service.removeAccount('account-1')).rejects.toThrow('disk full')
+    await expect(service.removeAccount('account-1')).resolves.toMatchObject({ accounts: [] })
+    expect(store.getSettings().codexManagedAccounts).toEqual([])
+    expect(existsSync(managedHomePath)).toBe(false)
+    expect(warning).toHaveBeenCalledWith(
+      '[codex-accounts] Removed account, but credit ledger cleanup failed:',
+      failure
+    )
     await expect(service.consumeCurrentRateLimitResetCredit()).rejects.toThrow('unknown outcome')
     expect(consume).not.toHaveBeenCalled()
   })
diff --git a/src/main/codex-accounts/service-test-harness.ts b/src/main/codex-accounts/service-test-harness.ts
index 4587788ec67b..8b81cb2125f6 100644
--- a/src/main/codex-accounts/service-test-harness.ts
+++ b/src/main/codex-accounts/service-test-harness.ts
@@ -56,9 +56,11 @@ export function createStore(settings: GlobalSettings) {
       return settings
     }),
     getCodexResetCreditAttemptLedger: vi.fn(() => structuredClone(resetLedger)),
-    replaceCodexResetCreditAttemptLedgerAndFlush: vi.fn((next: CodexResetCreditAttemptLedger) => {
-      resetLedger = structuredClone(next)
-    })
+    replaceCodexResetCreditAttemptLedgerAndFlush: vi.fn(
+      async (next: CodexResetCreditAttemptLedger) => {
+        resetLedger = structuredClone(next)
+      }
+    )
   }
 }
 
diff --git a/src/main/codex-accounts/service-wsl-accounts.test.ts b/src/main/codex-accounts/service-wsl-accounts.test.ts
index 0a1e69a81cd4..477f32e3e308 100644
--- a/src/main/codex-accounts/service-wsl-accounts.test.ts
+++ b/src/main/codex-accounts/service-wsl-accounts.test.ts
@@ -15,6 +15,12 @@ import {
   testState
 } from './service-test-harness'
 
+// Why: temp homes exceed sun_path on macOS but not on Linux; keep asserted config bytes host-independent.
+vi.mock('../codex/codex-daemon-socket-path-guard', async (importOriginal) => ({
+  ...(await importOriginal<object>()),
+  applyCodexDaemonSocketGuard: (config: string) => config
+}))
+
 vi.mock('electron', () => ({
   app: {
     getPath: () => testState.userDataDir
diff --git a/src/main/codex-accounts/service.test.ts b/src/main/codex-accounts/service.test.ts
index 2b6729964960..6081b4b1369b 100644
--- a/src/main/codex-accounts/service.test.ts
+++ b/src/main/codex-accounts/service.test.ts
@@ -12,6 +12,12 @@ import {
 } from './service-test-harness'
 import { createCanonicalHookTrustFixture } from './service-hook-trust-test-fixtures'
 
+// Why: temp homes exceed sun_path on macOS but not on Linux; keep asserted config bytes host-independent.
+vi.mock('../codex/codex-daemon-socket-path-guard', async (importOriginal) => ({
+  ...(await importOriginal<object>()),
+  applyCodexDaemonSocketGuard: (config: string) => config
+}))
+
 vi.mock('electron', () => ({
   app: {
     getPath: () => testState.userDataDir
diff --git a/src/main/codex-cli/codex-home-process-lock.ts b/src/main/codex-cli/codex-home-process-lock.ts
index ef91a5705d90..63b64deaf8eb 100644
--- a/src/main/codex-cli/codex-home-process-lock.ts
+++ b/src/main/codex-cli/codex-home-process-lock.ts
@@ -17,12 +17,15 @@ export function resolveCodexHomeProcessLockKey(codexHomePath?: string | null): s
 
 export function resolveCodexHomeProcessLockKeyForSpawnEnv(
   env: NodeJS.ProcessEnv | undefined,
-  wslDistro?: string | null
+  wslDistro?: string | null,
+  commandEnv?: Record<string, string>
 ): string {
   if (wslDistro) {
     // buildWslLauncherEnv forwards only explicit values that differ from the
     // host process; all other cases use the distro user's default home.
-    const codexHome = env?.CODEX_HOME !== process.env.CODEX_HOME ? (env?.CODEX_HOME ?? null) : null
+    const codexHome =
+      commandEnv?.CODEX_HOME ??
+      (env?.CODEX_HOME !== process.env.CODEX_HOME ? (env?.CODEX_HOME ?? null) : null)
     // Why: WSL spawns carry a Linux CODEX_HOME; key it through the same UNC
     // normalization the probe's \\wsl$ home path uses so both lanes collide.
     // Without an explicit home the distro default is unknowable from the host;
diff --git a/src/main/codex-usage/codex-session-file-discovery.ts b/src/main/codex-usage/codex-session-file-discovery.ts
index 946f9f1838c9..bf2595fc3409 100644
--- a/src/main/codex-usage/codex-session-file-discovery.ts
+++ b/src/main/codex-usage/codex-session-file-discovery.ts
@@ -138,8 +138,9 @@ async function getCodexSessionFileAliasKey(filePath: string): Promise<string> {
 
 async function getPhysicalFileAliasKey(filePath: string): Promise<string> {
   try {
-    const fileStat = await stat(filePath)
-    if (fileStat.ino !== 0) {
+    // Windows file IDs can exceed the precision of JavaScript numbers.
+    const fileStat = await stat(filePath, { bigint: true })
+    if (fileStat.ino !== 0n) {
       return `${fileStat.dev}:${fileStat.ino}`
     }
   } catch {}
diff --git a/src/main/codex-usage/scanner-file-identity.test.ts b/src/main/codex-usage/scanner-file-identity.test.ts
new file mode 100644
index 000000000000..f0d850764574
--- /dev/null
+++ b/src/main/codex-usage/scanner-file-identity.test.ts
@@ -0,0 +1,183 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { linkSync, mkdirSync, mkdtempSync, rmSync, symlinkSync, writeFileSync } from 'node:fs'
+import type { PathLike } from 'node:fs'
+import type * as FsPromises from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+
+const fixture = vi.hoisted(() => ({
+  root: '',
+  identities: new Map<string, { dev: bigint; ino: bigint }>(),
+  statErrors: new Set<string>(),
+  realpathErrors: new Set<string>()
+}))
+
+vi.mock('node:fs/promises', async () => {
+  const actual = await vi.importActual<typeof FsPromises>('node:fs/promises')
+  return {
+    ...actual,
+    stat: async (filePath: PathLike, options?: { bigint?: boolean }) => {
+      const path = String(filePath)
+      if (fixture.statErrors.has(path)) {
+        throw new Error('Fixture stat unavailable')
+      }
+      const identity = fixture.identities.get(path)
+      if (options?.bigint) {
+        const stats = await actual.stat(filePath, { bigint: true })
+        return identity ? Object.assign(stats, identity) : stats
+      }
+      const stats = await actual.stat(filePath)
+      return identity
+        ? Object.assign(stats, { dev: Number(identity.dev), ino: Number(identity.ino) })
+        : stats
+    },
+    realpath: async (filePath: PathLike) => {
+      if (fixture.realpathErrors.has(String(filePath))) {
+        throw new Error('Fixture realpath unavailable')
+      }
+      return actual.realpath(filePath)
+    }
+  }
+})
+
+vi.mock('../codex/codex-home-paths', () => ({
+  getOrcaManagedCodexHomePath: () => join(fixture.root, 'runtime'),
+  getSystemCodexHomePath: () => join(fixture.root, 'system')
+}))
+
+vi.mock('../codex/codex-account-home-discovery', () => ({
+  getCodexAccountHomeSessionDirectories: () => []
+}))
+
+vi.mock('../codex/codex-session-bridge', () => ({
+  getLegacyCopiedCodexSessionBridgeScanPreference: () => null
+}))
+
+import { listCodexSessionFiles } from './codex-session-file-discovery'
+import { scanCodexUsageFiles } from './scanner'
+
+function writeSession(name: string, tokens = 10): string {
+  const filePath = join(fixture.root, 'runtime', 'sessions', `${name}.jsonl`)
+  const records = [
+    { type: 'session_meta', payload: { id: name, cwd: fixture.root } },
+    {
+      timestamp: '2026-09-20T12:00:00.000Z',
+      type: 'event_msg',
+      payload: {
+        type: 'token_count',
+        info: {
+          model: 'gpt-5-codex',
+          last_token_usage: { input_tokens: tokens, total_tokens: tokens }
+        }
+      }
+    }
+  ]
+  writeFileSync(filePath, `${records.map((record) => JSON.stringify(record)).join('\n')}\n`)
+  return filePath
+}
+
+beforeEach(() => {
+  fixture.root = mkdtempSync(join(tmpdir(), 'orca-codex-file-identity-'))
+  mkdirSync(join(fixture.root, 'runtime', 'sessions'), { recursive: true })
+  fixture.identities.clear()
+  fixture.statErrors.clear()
+  fixture.realpathErrors.clear()
+})
+
+afterEach(() => {
+  rmSync(fixture.root, { recursive: true, force: true })
+})
+
+describe('Codex session physical file identity', () => {
+  it('keeps adjacent large inode IDs distinct when numeric stats would round them together', async () => {
+    const first = writeSession('first')
+    const second = writeSession('second')
+    const firstIno = 2n ** 53n
+    const secondIno = firstIno + 1n
+    expect(Number(firstIno)).toBe(Number(secondIno))
+    fixture.identities.set(first, { dev: 1n, ino: firstIno })
+    fixture.identities.set(second, { dev: 1n, ino: secondIno })
+
+    expect(await listCodexSessionFiles()).toEqual([first, second])
+  })
+
+  it('keeps the device part of the identity exact too', async () => {
+    const first = writeSession('first')
+    const second = writeSession('second')
+    fixture.identities.set(first, { dev: 2n ** 53n, ino: 7n })
+    fixture.identities.set(second, { dev: 2n ** 53n + 1n, ino: 7n })
+
+    expect(await listCodexSessionFiles()).toEqual([first, second])
+  })
+
+  it('counts both distinct sessions and preserves numeric timestamps, sizes and cache reuse', async () => {
+    const first = writeSession('first', 10)
+    const second = writeSession('second', 20)
+    fixture.identities.set(first, { dev: 1n, ino: 2n ** 53n })
+    fixture.identities.set(second, { dev: 1n, ino: 2n ** 53n + 1n })
+
+    const result = await scanCodexUsageFiles([], [])
+    expect(result.dailyAggregates.reduce((total, row) => total + row.totalTokens, 0)).toBe(30)
+    expect(result.sessions).toHaveLength(2)
+    const actual = await vi.importActual<typeof FsPromises>('node:fs/promises')
+    for (const file of result.processedFiles) {
+      const stats = await actual.stat(file.path)
+      expect(file.mtimeMs).toBe(stats.mtimeMs)
+      expect(file.size).toBe(stats.size)
+    }
+    const cached = await scanCodexUsageFiles([], result.processedFiles)
+    expect(cached.dailyAggregates).toEqual(result.dailyAggregates)
+    expect(cached.processedFiles[0]).toBe(result.processedFiles[0])
+    expect(cached.processedFiles[1]).toBe(result.processedFiles[1])
+  })
+
+  it('deduplicates real hardlink aliases across session homes', async () => {
+    const original = writeSession('original')
+    mkdirSync(join(fixture.root, 'system', 'sessions'), { recursive: true })
+    const alias = join(fixture.root, 'system', 'sessions', 'alias.jsonl')
+    linkSync(original, alias)
+
+    expect(await listCodexSessionFiles()).toEqual([original, alias].sort().slice(0, 1))
+    const result = await scanCodexUsageFiles([], [])
+    expect(result.dailyAggregates.reduce((total, row) => total + row.totalTokens, 0)).toBe(10)
+  })
+
+  it('does not collapse distinct zero-inode files', async () => {
+    const first = writeSession('first')
+    const second = writeSession('second')
+    fixture.identities.set(first, { dev: 1n, ino: 0n })
+    fixture.identities.set(second, { dev: 1n, ino: 0n })
+
+    expect(await listCodexSessionFiles()).toEqual([first, second])
+  })
+
+  it.each(['zero inode', 'stat failure'])('deduplicates canonical paths after %s', async (mode) => {
+    const original = writeSession('original')
+    symlinkSync(
+      join(fixture.root, 'runtime'),
+      join(fixture.root, 'system'),
+      process.platform === 'win32' ? 'junction' : 'dir'
+    )
+    const alias = join(fixture.root, 'system', 'sessions', 'original.jsonl')
+    for (const path of [original, alias]) {
+      if (mode === 'zero inode') {
+        fixture.identities.set(path, { dev: 1n, ino: 0n })
+      } else {
+        fixture.statErrors.add(path)
+      }
+    }
+
+    expect(await listCodexSessionFiles()).toEqual([original, alias].sort().slice(0, 1))
+  })
+
+  it('preserves path spelling when both stat and realpath are unavailable', async () => {
+    const first = writeSession('MiXeD-first')
+    const second = writeSession('MiXeD-second')
+    for (const path of [first, second]) {
+      fixture.statErrors.add(path)
+      fixture.realpathErrors.add(path)
+    }
+
+    expect(await listCodexSessionFiles()).toEqual([first, second])
+  })
+})
diff --git a/src/main/codex-usage/store.ts b/src/main/codex-usage/store.ts
index f11121f5d0db..7e91fb3945aa 100644
--- a/src/main/codex-usage/store.ts
+++ b/src/main/codex-usage/store.ts
@@ -1,3 +1,4 @@
+import { codexOpenCodeTokenSessions } from '../usage/agent-token-usage'
 import { app } from 'electron'
 import { join } from 'node:path'
 import type {
@@ -84,6 +85,10 @@ export class CodexUsageStore extends UsageProviderStoreLifecycle<
 > {
   constructor(store: Pick<Store, 'getRepos' | 'getAllWorktreeMeta'>) {
     super(store, {
+      tokenUsage: {
+        provider: 'codex',
+        selectSessions: (state) => codexOpenCodeTokenSessions(state.sessions)
+      },
       logTag: '[codex-usage]',
       resolveCacheFile: getCodexUsageFile,
       createDefaultState: getDefaultState,
diff --git a/src/main/codex/codex-app-server-connection-types.ts b/src/main/codex/codex-app-server-connection-types.ts
index 5c3c2f425a28..df3f40ac39a5 100644
--- a/src/main/codex/codex-app-server-connection-types.ts
+++ b/src/main/codex/codex-app-server-connection-types.ts
@@ -9,6 +9,8 @@ export type CodexAppServerConnectionHandlers = {
   onServerRequest?: (request: CodexAppServerServerRequest) => void
   onUnhandledFrame?: (kind: string, payload: unknown) => void
   onExit?: (error: Error) => void
+  /** Awaited once the child has a pid and before the handshake; a rejection reaps the child. */
+  onSpawned?: (pid: number) => Promise<void>
 }
 
 export type CodexAppServerConnection = {
diff --git a/src/main/codex/codex-app-server-connection.test.ts b/src/main/codex/codex-app-server-connection.test.ts
index d67f2ebecc69..4e7cd016bd6c 100644
--- a/src/main/codex/codex-app-server-connection.test.ts
+++ b/src/main/codex/codex-app-server-connection.test.ts
@@ -2,6 +2,7 @@ import { EventEmitter } from 'node:events'
 import { realpathSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { PassThrough } from 'node:stream'
+import { providerDiagnosticOf } from '../../shared/agent-session-failure'
 import { afterEach, describe, expect, it, vi } from 'vitest'
 import type { spawnProcess } from '../../shared/child-process/run-process'
 import {
@@ -182,6 +183,45 @@ describe('openCodexAppServerConnection', () => {
     await connection.close()
   })
 
+  it('reports the spawned pid before it sends the handshake', async () => {
+    const { child, spawnImpl, written } = stubChild()
+    answerInitialize(child)
+    const writtenAtSpawn: number[] = []
+
+    const connection = await openCodexAppServerConnection(
+      { command: 'codex', args: ['app-server'] },
+      {
+        onSpawned: async (pid) => {
+          writtenAtSpawn.push(written.length)
+          expect(pid).toBe(child.pid)
+        }
+      },
+      spawnImpl
+    )
+
+    // The owner is durable before initialize, so a crash mid-handshake leaves it stoppable.
+    expect(writtenAtSpawn).toEqual([0])
+    expect(written[0]).toMatchObject({ method: 'initialize' })
+    await connection.close()
+  })
+
+  it('reaps the child and never handshakes when its spawn cannot be recorded', async () => {
+    const { spawnImpl, written } = stubChild()
+
+    await expect(
+      openCodexAppServerConnection(
+        { command: 'codex', args: ['app-server'] },
+        {
+          onSpawned: async () => {
+            throw new Error('agent_session_checkpoint_stale')
+          }
+        },
+        spawnImpl
+      )
+    ).rejects.toThrow('agent_session_checkpoint_stale')
+    expect(written).toEqual([])
+  })
+
   it('completes the handshake and keeps the child alive across calls', async () => {
     const notifications: { method: string; params: unknown }[] = []
     const connection = await openFakeServer({
@@ -254,6 +294,9 @@ describe('openCodexAppServerConnection', () => {
 
     expect(isCodexAppServerRequestError(refusal)).toBe(true)
     expect((refusal as Error).message).toContain('bad params')
+    // Codex's own words, apart from Orca's prefix, for a person to read.
+    expect(providerDiagnosticOf(refusal)).toEqual({ text: 'bad params', audience: 'person' })
+    expect(providerDiagnosticOf(missing)).toBeUndefined()
     expect(isCodexAppServerUnsupportedError(missing)).toBe(true)
     expect(isCodexAppServerRequestError(missing)).toBe(false)
     await connection.close()
diff --git a/src/main/codex/codex-app-server-connection.ts b/src/main/codex/codex-app-server-connection.ts
index 4bfd9a151691..c0ac7f07400a 100644
--- a/src/main/codex/codex-app-server-connection.ts
+++ b/src/main/codex/codex-app-server-connection.ts
@@ -280,13 +280,20 @@ export async function openCodexAppServerConnection(
     close
   }
 
+  let handshaking = false
   try {
+    // A spawn that failed has no pid; the handshake below reports why.
+    if (child.pid !== undefined) {
+      await handlers.onSpawned?.(child.pid)
+    }
+    handshaking = true
     await initializeCodexAppServerConnection(connection)
   } catch (error) {
     if ((await close()) !== true) {
       throw new CodexAppServerHandshakeExitUnprovenError(connection, error)
     }
-    throw error instanceof CodexAppServerUnsupportedError ||
+    throw !handshaking ||
+      error instanceof CodexAppServerUnsupportedError ||
       error instanceof CodexAppServerTimeoutError
       ? error
       : buildExitError(error instanceof Error ? error : new Error(String(error)))
diff --git a/src/main/codex/codex-app-server-exit-error.test.ts b/src/main/codex/codex-app-server-exit-error.test.ts
new file mode 100644
index 000000000000..63ec9a63743a
--- /dev/null
+++ b/src/main/codex/codex-app-server-exit-error.test.ts
@@ -0,0 +1,20 @@
+import { describe, expect, it } from 'vitest'
+import { providerDiagnosticOf } from '../../shared/agent-session-failure'
+import { buildCodexAppServerExitError } from './codex-app-server-exit-error'
+
+describe('buildCodexAppServerExitError', () => {
+  it("keeps the stderr tail apart from Orca's wording, as log text", () => {
+    const error = buildCodexAppServerExitError('  thread panicked at main.rs:4  ')
+    expect(error.message).toBe('codex app-server connection ended: thread panicked at main.rs:4')
+    expect(providerDiagnosticOf(error)).toEqual({
+      text: 'thread panicked at main.rs:4',
+      audience: 'log'
+    })
+  })
+
+  it('carries no diagnostic when a cause, not the stderr, explains the end', () => {
+    const error = buildCodexAppServerExitError('ignored', new Error('spawn codex ENOENT'))
+    expect(providerDiagnosticOf(error)).toBeUndefined()
+    expect(providerDiagnosticOf(buildCodexAppServerExitError(''))).toBeUndefined()
+  })
+})
diff --git a/src/main/codex/codex-app-server-exit-error.ts b/src/main/codex/codex-app-server-exit-error.ts
index 85d8bc7dd6e7..8812e6698a08 100644
--- a/src/main/codex/codex-app-server-exit-error.ts
+++ b/src/main/codex/codex-app-server-exit-error.ts
@@ -2,6 +2,7 @@
 // stderr tail is the only evidence: a CLI without the subcommand is a durable
 // capability fact, and anything else is this run's crash.
 
+import { providerDiagnostic, withProviderDiagnostic } from '../../shared/agent-session-failure'
 import { stderrIndicatesMissingAppServer } from './codex-app-server-capability-signal'
 import { CodexAppServerUnsupportedError } from './codex-app-server-session'
 
@@ -9,11 +10,17 @@ const EXIT_DETAIL_MAX_CHARS = 400
 
 export function buildCodexAppServerExitError(stderrTail: string, cause?: Error): Error {
   const tail = stderrTail.trim().slice(0, EXIT_DETAIL_MAX_CHARS)
+  // The tail is Codex's own stderr: a log, kept behind Details.
+  const diagnostic = providerDiagnostic(tail, 'log')
   if (stderrIndicatesMissingAppServer(stderrTail)) {
-    return new CodexAppServerUnsupportedError(
-      `codex CLI does not support the app-server subcommand: ${tail}`
+    return withProviderDiagnostic(
+      new CodexAppServerUnsupportedError(
+        `codex CLI does not support the app-server subcommand: ${tail}`
+      ),
+      diagnostic
     )
   }
   const detail = cause ? `: ${cause.message}` : tail ? `: ${tail}` : ''
-  return new Error(`codex app-server connection ended${detail}`)
+  const error = new Error(`codex app-server connection ended${detail}`)
+  return cause ? error : withProviderDiagnostic(error, diagnostic)
 }
diff --git a/src/main/codex/codex-app-server-record-dispatch.ts b/src/main/codex/codex-app-server-record-dispatch.ts
index e76f25093996..b1d3605b38f6 100644
--- a/src/main/codex/codex-app-server-record-dispatch.ts
+++ b/src/main/codex/codex-app-server-record-dispatch.ts
@@ -88,7 +88,8 @@ export function createCodexAppServerRecordDispatcher(input: {
           : new CodexAppServerRequestError(
               waiter.method,
               typeof error.code === 'number' ? error.code : null,
-              `codex app-server ${waiter.method} failed: ${detail}`
+              `codex app-server ${waiter.method} failed: ${detail}`,
+              typeof error.message === 'string' ? error.message : undefined
             )
       )
       return
diff --git a/src/main/codex/codex-app-server-request-error.ts b/src/main/codex/codex-app-server-request-error.ts
index 0dbefaca9655..0e7cc719017e 100644
--- a/src/main/codex/codex-app-server-request-error.ts
+++ b/src/main/codex/codex-app-server-request-error.ts
@@ -1,12 +1,23 @@
+import { providerDiagnostic, type ProviderDiagnostic } from '../../shared/agent-session-failure'
+
 /** Codex answered the call and refused it, rather than timing out or exiting. */
 export class CodexAppServerRequestError extends Error {
+  /** Codex's own `error.message`, kept apart from the Orca text around it. */
+  readonly providerDiagnostic?: ProviderDiagnostic
+
   constructor(
     readonly method: string,
     readonly code: number | null,
-    message: string
+    message: string,
+    providerMessage?: string
   ) {
     super(message)
     this.name = 'CodexAppServerRequestError'
+    const diagnostic =
+      providerMessage === undefined ? undefined : providerDiagnostic(providerMessage, 'person')
+    if (diagnostic) {
+      this.providerDiagnostic = diagnostic
+    }
   }
 }
 
diff --git a/src/main/codex/codex-config-mirror-mcp-ownership.test.ts b/src/main/codex/codex-config-mirror-mcp-ownership.test.ts
new file mode 100644
index 000000000000..85121996a065
--- /dev/null
+++ b/src/main/codex/codex-config-mirror-mcp-ownership.test.ts
@@ -0,0 +1,159 @@
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+import { mkdtempSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import {
+  syncSystemConfigIntoManagedCodexHome,
+  syncSystemConfigIntoLegacySharedCodexHome
+} from './codex-config-mirror'
+
+let root: string
+let runtimeHomePath: string
+let systemHomePath: string
+
+beforeEach(() => {
+  root = mkdtempSync(join(tmpdir(), 'orca-mcp-ownership-'))
+  runtimeHomePath = join(root, 'runtime')
+  systemHomePath = join(root, 'system')
+  mkdirSync(runtimeHomePath)
+  mkdirSync(systemHomePath)
+})
+
+afterEach(() => rmSync(root, { recursive: true, force: true }))
+
+describe('canonical MCP ownership during config mirroring', () => {
+  it('does not duplicate a server defined inline in the canonical MCP table', () => {
+    writeFileSync(
+      join(runtimeHomePath, 'config.toml'),
+      '[mcp_servers.shared]\ncommand = "runtime"\n'
+    )
+    writeFileSync(
+      join(systemHomePath, 'config.toml'),
+      '[mcp_servers]\nshared = { command = "system" }\n'
+    )
+
+    syncSystemConfigIntoManagedCodexHome({ runtimeHomePath, systemHomePath })
+
+    const runtimeConfig = readFileSync(join(runtimeHomePath, 'config.toml'), 'utf-8')
+    expect(runtimeConfig).toContain('shared = { command = "system" }')
+    expect(runtimeConfig).not.toContain('[mcp_servers.shared]')
+  })
+
+  it('preserves deletion after a canonical inline server is rewritten by the runtime', () => {
+    writeFileSync(
+      join(runtimeHomePath, 'config.toml'),
+      '[mcp_servers.shared]\ncommand = "runtime"\n'
+    )
+    writeFileSync(
+      join(systemHomePath, 'config.toml'),
+      '[mcp_servers]\nshared = { command = "system" }\n'
+    )
+    syncSystemConfigIntoManagedCodexHome({ runtimeHomePath, systemHomePath })
+    writeFileSync(
+      join(runtimeHomePath, 'config.toml'),
+      '[mcp_servers.shared]\ncommand = "system"\n[mcp_servers.runtime_only]\ncommand = "runtime"\n'
+    )
+    writeFileSync(join(systemHomePath, 'config.toml'), 'model = "system"\n')
+
+    syncSystemConfigIntoManagedCodexHome({ runtimeHomePath, systemHomePath })
+
+    const runtimeConfig = readFileSync(join(runtimeHomePath, 'config.toml'), 'utf-8')
+    expect(runtimeConfig).not.toContain('[mcp_servers.shared]')
+    expect(runtimeConfig).toContain('[mcp_servers.runtime_only]')
+  })
+
+  it('honors a closed canonical MCP root and its later removal', () => {
+    writeFileSync(
+      join(runtimeHomePath, 'config.toml'),
+      '[mcp_servers.runtime_only]\ncommand = "runtime"\n'
+    )
+    writeFileSync(
+      join(systemHomePath, 'config.toml'),
+      'mcp_servers = { shared = { enabled = false } }\n'
+    )
+    syncSystemConfigIntoManagedCodexHome({ runtimeHomePath, systemHomePath })
+    expect(readFileSync(join(runtimeHomePath, 'config.toml'), 'utf-8')).not.toContain(
+      '[mcp_servers.'
+    )
+    expect(
+      JSON.parse(
+        readFileSync(join(runtimeHomePath, '.orca-config-settings-baseline.json'), 'utf-8')
+      )
+    ).toMatchObject({ mcpServerRoot: true })
+    writeFileSync(join(runtimeHomePath, 'config.toml'), '[mcp_servers.shared]\nenabled = false\n')
+    writeFileSync(join(systemHomePath, 'config.toml'), 'model = "system"\n')
+
+    syncSystemConfigIntoManagedCodexHome({ runtimeHomePath, systemHomePath })
+
+    expect(readFileSync(join(runtimeHomePath, 'config.toml'), 'utf-8')).not.toContain(
+      '[mcp_servers.'
+    )
+  })
+})
+
+describe('MCP ownership migration', () => {
+  it.each([1, 2, 3])(
+    'keeps pre-ownership baseline version %s canonical for one pass',
+    (version) => {
+      writeFileSync(
+        join(runtimeHomePath, 'config.toml'),
+        '[mcp_servers.removed]\ncommand = "old"\n'
+      )
+      writeFileSync(join(systemHomePath, 'config.toml'), 'model = "system"\n')
+      writeFileSync(
+        join(runtimeHomePath, '.orca-config-settings-baseline.json'),
+        JSON.stringify({ version, settings: {} })
+      )
+
+      syncSystemConfigIntoManagedCodexHome({ runtimeHomePath, systemHomePath })
+
+      expect(readFileSync(join(runtimeHomePath, 'config.toml'), 'utf-8')).not.toContain(
+        '[mcp_servers.'
+      )
+      expect(
+        JSON.parse(
+          readFileSync(join(runtimeHomePath, '.orca-config-settings-baseline.json'), 'utf-8')
+        )
+      ).toMatchObject({ mcpServers: [] })
+      writeFileSync(join(runtimeHomePath, 'config.toml'), '[mcp_servers.added]\ncommand = "new"\n')
+
+      syncSystemConfigIntoManagedCodexHome({ runtimeHomePath, systemHomePath })
+
+      expect(readFileSync(join(runtimeHomePath, 'config.toml'), 'utf-8')).toContain(
+        '[mcp_servers.added]'
+      )
+    }
+  )
+
+  it('keeps the retained shared home one-way without an ownership baseline', () => {
+    writeFileSync(join(runtimeHomePath, 'config.toml'), '[mcp_servers.removed]\ncommand = "old"\n')
+    writeFileSync(join(systemHomePath, 'config.toml'), 'model = "system"\n')
+
+    syncSystemConfigIntoLegacySharedCodexHome({ runtimeHomePath, systemHomePath })
+
+    expect(readFileSync(join(runtimeHomePath, 'config.toml'), 'utf-8')).not.toContain(
+      '[mcp_servers.'
+    )
+  })
+
+  it('tracks commented CRLF names so their later removal remains authoritative', () => {
+    writeFileSync(
+      join(runtimeHomePath, 'config.toml'),
+      '[mcp_servers.shared]\ncommand = "runtime"\n'
+    )
+    writeFileSync(
+      join(systemHomePath, 'config.toml'),
+      '[mcp_servers.shared] # see [docs]\r\ncommand = "system"\r\n'
+    )
+
+    syncSystemConfigIntoManagedCodexHome({ runtimeHomePath, systemHomePath })
+    expect(readFileSync(join(runtimeHomePath, 'config.toml'), 'utf-8')).not.toContain('"runtime"')
+    writeFileSync(join(systemHomePath, 'config.toml'), 'model = "system"\n')
+
+    syncSystemConfigIntoManagedCodexHome({ runtimeHomePath, systemHomePath })
+
+    expect(readFileSync(join(runtimeHomePath, 'config.toml'), 'utf-8')).not.toContain(
+      '[mcp_servers.shared]'
+    )
+  })
+})
diff --git a/src/main/codex/codex-config-mirror.test.ts b/src/main/codex/codex-config-mirror.test.ts
index ee1d375582fd..74db1cd9c05b 100644
--- a/src/main/codex/codex-config-mirror.test.ts
+++ b/src/main/codex/codex-config-mirror.test.ts
@@ -4,6 +4,12 @@ import { tmpdir } from 'node:os'
 import type * as NodeOs from 'node:os'
 import { join } from 'node:path'
 
+// Why: temp homes exceed sun_path on macOS but not on Linux; keep asserted config bytes host-independent.
+vi.mock('./codex-daemon-socket-path-guard', async (importOriginal) => ({
+  ...(await importOriginal<object>()),
+  applyCodexDaemonSocketGuard: (config: string) => config
+}))
+
 const { getPathMock, homedirMock } = vi.hoisted(() => ({
   getPathMock: vi.fn<(name: string) => string>(),
   homedirMock: vi.fn<() => string>()
@@ -46,6 +52,10 @@ function getRuntimeConfigPath(): string {
   return join(userDataDir, 'codex-runtime-home', 'home', 'config.toml')
 }
 
+function getRuntimeBaselinePath(): string {
+  return join(userDataDir, 'codex-runtime-home', 'home', '.orca-config-settings-baseline.json')
+}
+
 beforeEach(() => {
   fakeHomeDir = mkdtempSync(join(tmpdir(), 'orca-codex-config-home-'))
   userDataDir = mkdtempSync(join(tmpdir(), 'orca-codex-config-user-data-'))
@@ -358,6 +368,96 @@ describe('syncSystemConfigIntoManagedCodexHome', () => {
     expect(runtimeConfig.match(/\[projects\."\/repo"\]/g)?.length).toBe(1)
   })
 
+  it('preserves runtime-only MCP servers and nested descendants with system precedence', () => {
+    mkdirSync(join(userDataDir, 'codex-runtime-home', 'home'), { recursive: true })
+    writeFileSync(
+      getRuntimeConfigPath(),
+      [
+        '[mcp_servers.runtime_only]',
+        'command = "runtime-command"',
+        '',
+        '[mcp_servers.runtime_only.env]',
+        'MODE = "runtime"',
+        '',
+        '[mcp_servers.shared]',
+        'command = "runtime-shared"',
+        ''
+      ].join('\n'),
+      'utf-8'
+    )
+    writeFileSync(
+      getSystemConfigPath(),
+      [
+        '[mcp_servers."shared"]',
+        'command = "system-shared"',
+        '',
+        '[mcp_servers.system_only]',
+        'command = "system-only"',
+        ''
+      ].join('\n'),
+      'utf-8'
+    )
+
+    syncSystemConfigIntoManagedCodexHome()
+
+    const runtimeConfig = readFileSync(getRuntimeConfigPath(), 'utf-8')
+    expect(runtimeConfig).toContain('[mcp_servers.runtime_only]')
+    expect(runtimeConfig).toContain('[mcp_servers.runtime_only.env]')
+    expect(runtimeConfig).toContain('MODE = "runtime"')
+    expect(runtimeConfig).toContain('command = "system-shared"')
+    expect(runtimeConfig).not.toContain('runtime-shared')
+    expect(runtimeConfig.match(/\[mcp_servers\.(?:shared|"shared")\]/g)).toHaveLength(1)
+    expect(runtimeConfig).toContain('[mcp_servers.system_only]')
+    expect(JSON.parse(readFileSync(getRuntimeBaselinePath(), 'utf-8'))).toMatchObject({
+      mcpServers: ['shared', 'system_only']
+    })
+  })
+
+  it('revokes a previously mirrored MCP server when the system source deletes it', () => {
+    mkdirSync(join(userDataDir, 'codex-runtime-home', 'home'), { recursive: true })
+    writeFileSync(getRuntimeConfigPath(), '[mcp_servers.revoked]\ncommand = "run"\n', 'utf-8')
+    writeFileSync(getSystemConfigPath(), '[mcp_servers.revoked]\ncommand = "run"\n', 'utf-8')
+
+    syncSystemConfigIntoManagedCodexHome()
+    writeFileSync(getSystemConfigPath(), 'model = "system"\n', 'utf-8')
+    syncSystemConfigIntoManagedCodexHome()
+
+    expect(readFileSync(getRuntimeConfigPath(), 'utf-8')).not.toContain('[mcp_servers.revoked]')
+  })
+
+  it('keeps runtime-only MCP additions after a source refresh and remains byte-idempotent', () => {
+    mkdirSync(join(userDataDir, 'codex-runtime-home', 'home'), { recursive: true })
+    writeFileSync(getRuntimeConfigPath(), '[mcp_servers.runtime_only]\ncommand = "run"\n', 'utf-8')
+    writeFileSync(getSystemConfigPath(), 'model = "system"\n', 'utf-8')
+
+    syncSystemConfigIntoManagedCodexHome()
+    const first = readFileSync(getRuntimeConfigPath(), 'utf-8')
+    syncSystemConfigIntoManagedCodexHome()
+
+    expect(readFileSync(getRuntimeConfigPath(), 'utf-8')).toBe(first)
+    expect(readFileSync(getRuntimeConfigPath(), 'utf-8')).toContain('[mcp_servers.runtime_only]')
+  })
+
+  it('keeps an explicit system MCP disable canonical', () => {
+    mkdirSync(join(userDataDir, 'codex-runtime-home', 'home'), { recursive: true })
+    writeFileSync(
+      getRuntimeConfigPath(),
+      '[mcp_servers.blocked]\ncommand = "runtime"\nenabled = true\n',
+      'utf-8'
+    )
+    writeFileSync(
+      getSystemConfigPath(),
+      '[mcp_servers."blocked"]\ncommand = "system"\nenabled = false\n',
+      'utf-8'
+    )
+
+    syncSystemConfigIntoManagedCodexHome()
+
+    const runtimeConfig = readFileSync(getRuntimeConfigPath(), 'utf-8')
+    expect(runtimeConfig).toContain('enabled = false')
+    expect(runtimeConfig).not.toContain('enabled = true')
+  })
+
   it('deduplicates basic and literal project headers by decoded Windows path', () => {
     mkdirSync(join(userDataDir, 'codex-runtime-home', 'home'), { recursive: true })
     writeFileSync(
diff --git a/src/main/codex/codex-config-mirror.ts b/src/main/codex/codex-config-mirror.ts
index d84a5bea5420..275e350328a2 100644
--- a/src/main/codex/codex-config-mirror.ts
+++ b/src/main/codex/codex-config-mirror.ts
@@ -1,3 +1,4 @@
+import { readMcpServerTomlOwnership } from './config-toml-mcp-servers'
 import { dirname, join } from 'node:path'
 import { observeAgentStateFile } from './codex-path-observation'
 import {
@@ -18,8 +19,10 @@ import {
 import { readCodexSettingsBaseline } from './config-settings-baseline'
 import { getCodexConfigSyncStatus, reportCodexConfigSyncOutcome } from './config-sync-stall'
 import { preserveRuntimeConflictValues } from './codex-config-settings-preservation'
+import { applyCodexDaemonSocketGuard } from './codex-daemon-socket-path-guard'
 import {
   deduplicateProjectTomlSections,
+  getMcpServerTomlSectionName,
   getProjectTrustLevel,
   getRevocationTomlSectionHeaderKey,
   getTomlSectionHeaderKey,
@@ -36,6 +39,15 @@ export function syncSystemConfigIntoManagedCodexHome(
     systemHomePath: getSystemCodexHomePath()
   }
 ): void {
+  if (!mirrorSystemConfigIntoManagedCodexHome(homes)) {
+    // Why: a stalled settings mirror must not also withhold the daemon guard,
+    // or Codex cannot start at all in a long home.
+    ensureCodexDaemonSocketGuard(homes.runtimeHomePath)
+  }
+}
+
+/** Returns false when no mirror pass ran, so the caller still owes the daemon guard. */
+function mirrorSystemConfigIntoManagedCodexHome(homes: CodexSettingsPromotionHomes): boolean {
   // Why: the mirror overwrites runtime settings from ~/.codex, so changes the
   // user made inside Orca-launched Codex (/model, /approvals) must be written
   // back to ~/.codex first or this very pass silently reverts them.
@@ -53,7 +65,7 @@ export function syncSystemConfigIntoManagedCodexHome(
     if (stalledStatus.state === 'stalled') {
       reportCodexConfigSyncOutcome(homes.runtimeHomePath, stalledStatus)
     }
-    return
+    return false
   }
   let mirrorResult: CodexConfigMirrorResult
   try {
@@ -64,7 +76,7 @@ export function syncSystemConfigIntoManagedCodexHome(
     // failure on every launch and quota poll while the surfaced reason never
     // reaches the user.
     reportCodexConfigSyncOutcome(homes.runtimeHomePath, getCodexConfigSyncStatus(homes), error)
-    return
+    return false
   }
   if (mirrorResult.status === 'refused-indeterminate') {
     // Why: no mirror ran, so this must behave exactly like the throwing path
@@ -75,7 +87,7 @@ export function syncSystemConfigIntoManagedCodexHome(
       getCodexConfigSyncStatus(homes),
       mirrorResult.error
     )
-    return
+    return false
   }
   // Why: report from the same pass that decided, so the surfaced status can
   // never disagree with what the mirror actually did.
@@ -89,7 +101,7 @@ export function syncSystemConfigIntoManagedCodexHome(
     if (!readCodexSettingsBaseline(homes.runtimeHomePath)) {
       snapshotCodexRuntimeSettingsBaseline(homes.runtimeHomePath)
     }
-    return
+    return true
   }
   // Why: the baseline advances only after a successful mirror; recording an
   // unpromoted runtime change as Orca-written would strand it forever.
@@ -99,8 +111,33 @@ export function syncSystemConfigIntoManagedCodexHome(
     ),
     // Why: this pass made the runtime's marketplace and plugin tables canonical,
     // so a later source config that lacks one is a removal, not an addition.
-    mirroredRegistrations: true
+    mirroredRegistrations: true,
+    mirroredMcpServers: mirrorResult.mirroredMcpServerNames,
+    mirroredMcpServerRoot: mirrorResult.mirroredMcpServerRoot
   })
+  return true
+}
+
+/** Applies only the daemon guard, for passes that have no source config to mirror. */
+export function ensureCodexDaemonSocketGuard(runtimeHomePath: string): void {
+  try {
+    const observation = observeAgentStateFile(join(runtimeHomePath, 'config.toml'))
+    if (observation.kind !== 'indeterminate') {
+      writeCodexDaemonSocketGuard(
+        runtimeHomePath,
+        observation.kind === 'present' ? observation.value : null
+      )
+    }
+  } catch (error) {
+    console.warn('[codex-config] Failed to apply the Codex daemon socket guard:', error)
+  }
+}
+
+function writeCodexDaemonSocketGuard(runtimeHomePath: string, runtimeConfig: string | null): void {
+  const guarded = applyCodexDaemonSocketGuard(runtimeConfig ?? '', runtimeHomePath)
+  if (guarded !== (runtimeConfig ?? '')) {
+    writeFileAtomicallyIfUnchanged(join(runtimeHomePath, 'config.toml'), runtimeConfig, guarded)
+  }
 }
 
 /**
@@ -124,26 +161,33 @@ export function syncSystemConfigIntoLegacySharedCodexHome(
   }
   const rawSystemConfig =
     systemConfigObservation.kind === 'present' ? systemConfigObservation.value : ''
-  // Why: a missing cloud-synced source is not proof the user cleared config.
-  if (rawSystemConfig.trim() === '') {
-    return
-  }
-
-  const sourceConfigDir = resolveCodexConfigMirrorSourceDirectory(homes.systemHomePath)
   const runtimeConfigObservation = observeAgentStateFile(runtimeConfigPath)
   if (runtimeConfigObservation.kind === 'indeterminate') {
     throw runtimeConfigObservation.error
   }
   const runtimeConfigBeforeMirror =
     runtimeConfigObservation.kind === 'present' ? runtimeConfigObservation.value : null
-  const nextRuntimeConfig =
-    runtimeConfigBeforeMirror !== null
-      ? mergeSystemCodexConfigIntoRuntime(
-          runtimeConfigBeforeMirror,
-          prepareSystemConfigForRuntimeMirror(rawSystemConfig, sourceConfigDir)
-        )
-      : prepareSystemConfigForFreshRuntimeMirror(rawSystemConfig, sourceConfigDir)
-  if (runtimeConfigBeforeMirror === nextRuntimeConfig) {
+  // Why: a missing cloud-synced source is not proof the user cleared config.
+  let mirroredRuntimeConfig = runtimeConfigBeforeMirror ?? ''
+  if (rawSystemConfig.trim() !== '') {
+    const sourceConfigDir = resolveCodexConfigMirrorSourceDirectory(homes.systemHomePath)
+    // The retired home has no ownership baseline; its entire MCP root stays canonical.
+    mirroredRuntimeConfig =
+      runtimeConfigBeforeMirror !== null
+        ? mergeSystemCodexConfigIntoRuntime(
+            runtimeConfigBeforeMirror,
+            prepareSystemConfigForRuntimeMirror(rawSystemConfig, sourceConfigDir),
+            new Set(),
+            true
+          )
+        : prepareSystemConfigForFreshRuntimeMirror(rawSystemConfig, sourceConfigDir)
+  }
+  // Why: retained pre-rollout panes still use this home, so a refresh must keep the daemon guard.
+  const nextRuntimeConfig = applyCodexDaemonSocketGuard(
+    mirroredRuntimeConfig,
+    homes.runtimeHomePath
+  )
+  if ((runtimeConfigBeforeMirror ?? '') === nextRuntimeConfig) {
     return
   }
   // Why: stage first, then compare immediately before replace so a retained
@@ -154,7 +198,12 @@ export function syncSystemConfigIntoLegacySharedCodexHome(
 type CodexConfigMirrorResult =
   | { status: 'skipped-missing-source' }
   | { status: 'refused-indeterminate'; error: unknown }
-  | { status: 'mirrored'; preservedConflictKeys: ReadonlySet<string> }
+  | {
+      status: 'mirrored'
+      preservedConflictKeys: ReadonlySet<string>
+      mirroredMcpServerNames: ReadonlySet<string>
+      mirroredMcpServerRoot: boolean
+    }
 
 function syncSystemConfigIntoManagedCodexHomeUnsafe(
   { runtimeHomePath, systemHomePath, systemConfigDir }: CodexSettingsPromotionHomes,
@@ -181,32 +230,62 @@ function syncSystemConfigIntoManagedCodexHomeUnsafe(
   // it would erase every ordinary setting from an existing managed runtime, and
   // a 0-byte file is what a half-written or unhydrated cloud-synced home shows.
   if (rawSystemConfig.trim() === '') {
+    // Why: no mirror write happens here, but the daemon guard must still land.
+    writeCodexDaemonSocketGuard(
+      runtimeHomePath,
+      runtimeConfigExists ? runtimeConfigObservation.value : null
+    )
     return runtimeConfigExists
       ? { status: 'skipped-missing-source' }
-      : { status: 'mirrored', preservedConflictKeys: new Set() }
+      : {
+          status: 'mirrored',
+          preservedConflictKeys: new Set(),
+          mirroredMcpServerNames: new Set(),
+          mirroredMcpServerRoot: false
+        }
   }
 
   const sourceConfigDir = resolveCodexConfigMirrorSourceDirectory(systemHomePath, systemConfigDir)
   if (!runtimeConfigExists) {
-    writeFileAtomically(
-      runtimeConfigPath,
-      prepareSystemConfigForFreshRuntimeMirror(rawSystemConfig, sourceConfigDir)
+    const freshRuntimeConfig = applyCodexDaemonSocketGuard(
+      prepareSystemConfigForFreshRuntimeMirror(rawSystemConfig, sourceConfigDir),
+      runtimeHomePath
     )
-    return { status: 'mirrored', preservedConflictKeys: new Set() }
+    const ownership = readMcpServerTomlOwnership(freshRuntimeConfig)
+    writeFileAtomically(runtimeConfigPath, freshRuntimeConfig)
+    return {
+      status: 'mirrored',
+      preservedConflictKeys: new Set(),
+      mirroredMcpServerNames: ownership.names,
+      mirroredMcpServerRoot: ownership.ownsRoot
+    }
   }
 
   const systemConfig = prepareSystemConfigForRuntimeMirror(rawSystemConfig, sourceConfigDir)
+  const { names: mirroredMcpServerNames, ownsRoot: mirroredMcpServerRoot } =
+    readMcpServerTomlOwnership(systemConfig)
   // Why: reuse the bytes already observed above rather than re-reading. A second
   // read could succeed where the first failed and re-open the gap this closes.
   const runtimeConfig = runtimeConfigObservation.value
   const preserved = preserveRuntimeConflictValues(
-    mergeSystemCodexConfigIntoRuntime(runtimeConfig, systemConfig),
+    mergeSystemCodexConfigIntoRuntime(
+      runtimeConfig,
+      systemConfig,
+      promotionPlan.mirroredMcpServers,
+      promotionPlan.mirroredMcpServerRoot
+    ),
     promotionPlan.runtimeValuesToPreserve
   )
-  if (preserved.content !== runtimeConfig) {
-    writeFileAtomically(runtimeConfigPath, preserved.content)
+  const nextRuntimeConfig = applyCodexDaemonSocketGuard(preserved.content, runtimeHomePath)
+  if (nextRuntimeConfig !== runtimeConfig) {
+    writeFileAtomically(runtimeConfigPath, nextRuntimeConfig)
+  }
+  return {
+    status: 'mirrored',
+    preservedConflictKeys: preserved.keys,
+    mirroredMcpServerNames,
+    mirroredMcpServerRoot
   }
-  return { status: 'mirrored', preservedConflictKeys: preserved.keys }
 }
 
 export function resolveCodexConfigMirrorSourceDirectory(
@@ -238,7 +317,12 @@ export function prepareSystemConfigForFreshRuntimeMirror(
   return stripRuntimeOwnedTomlSections(prepareSystemConfigForRuntimeMirror(config, systemConfigDir))
 }
 
-function mergeSystemCodexConfigIntoRuntime(runtimeConfig: string, systemConfig: string): string {
+function mergeSystemCodexConfigIntoRuntime(
+  runtimeConfig: string,
+  systemConfig: string,
+  mirroredMcpServerNames: ReadonlySet<string> = new Set(),
+  mirroredMcpServerRoot = false
+): string {
   const runtimeSections = deduplicateProjectTomlSections(getTomlSections(runtimeConfig))
   const runtimeProjectHeaders = new Set(
     runtimeSections
@@ -261,6 +345,7 @@ function mergeSystemCodexConfigIntoRuntime(runtimeConfig: string, systemConfig:
       .filter((section) => getProjectTrustLevel(section.block) === 'trusted')
       .map((section) => getTomlSectionHeaderKey(section.header))
   )
+  const systemMcpServers = readMcpServerTomlOwnership(systemConfig)
   // Why: ordinary Codex settings should mirror ~/.codex exactly; runtime hook
   // trust and project trust are written under Orca's managed CODEX_HOME and
   // must survive the copy unless the user explicitly revoked project trust in
@@ -268,7 +353,19 @@ function mergeSystemCodexConfigIntoRuntime(runtimeConfig: string, systemConfig:
   return joinTomlBlocks([
     stripRuntimeOwnedTomlSections(systemConfig, runtimeProjectHeaders),
     ...runtimeSections
-      .filter((section) => isRuntimePreservedTomlSection(section.header))
+      .filter((section) => {
+        if (isRuntimePreservedTomlSection(section.header)) {
+          return true
+        }
+        const mcpServerName = getMcpServerTomlSectionName(section.header)
+        return (
+          mcpServerName !== null &&
+          !systemMcpServers.ownsRoot &&
+          !mirroredMcpServerRoot &&
+          !systemMcpServers.names.has(mcpServerName) &&
+          !mirroredMcpServerNames.has(mcpServerName)
+        )
+      })
       .filter(
         (section) =>
           !isRuntimeProjectTomlSection(section.header) ||
diff --git a/src/main/codex/codex-config-settings-upsert.ts b/src/main/codex/codex-config-settings-upsert.ts
index 55fcd4db4808..1706d76da791 100644
--- a/src/main/codex/codex-config-settings-upsert.ts
+++ b/src/main/codex/codex-config-settings-upsert.ts
@@ -102,15 +102,15 @@ export function upsertTopLevelSettingsInContent(
   return joinPreservingTrailingNewline(lines, usesCrlf)
 }
 
-type TuiPlacementScan = {
+type TablePlacementScan = {
   bareKeyIndexes: Map<string, number>
   dottedKeyIndexes: Map<string, number>
-  hasBareTuiTable: boolean
-  hasDottedTuiKey: boolean
-  blocksNewTuiTable: boolean
+  hasBareTable: boolean
+  hasDottedKey: boolean
+  blocksNewTable: boolean
   blockedAbsentKeys: Set<string>
   bareBodyInsertIndex: number
-  lastDottedTuiIndex: number
+  lastDottedKeyIndex: number
 }
 
 /**
@@ -123,8 +123,17 @@ type TuiPlacementScan = {
  * table is ever defined twice.
  */
 export function upsertTuiSettingsInContent(content: string, updates: Map<string, string>): string {
+  return upsertTableSettingsInContent(content, 'tui', updates)
+}
+
+/** Same placement rule as `upsertTuiSettingsInContent`, for any single-segment table. */
+export function upsertTableSettingsInContent(
+  content: string,
+  table: string,
+  updates: Map<string, string>
+): string {
   const lines = content.split('\n')
-  const scan = scanTuiPlacement(lines, updates)
+  const scan = scanTablePlacement(lines, table, updates)
   const usesCrlf = content.includes('\r\n')
   const bareBodyInserts: string[] = []
   const dottedPreambleInserts: string[] = []
@@ -133,7 +142,7 @@ export function upsertTuiSettingsInContent(content: string, updates: Map<string,
   for (const [key, raw] of updates) {
     const dottedIndex = scan.dottedKeyIndexes.get(key)
     if (dottedIndex !== undefined) {
-      lines[dottedIndex] = withTrailingCr(lines[dottedIndex]!, `${tuiStructuredKey(key)} = ${raw}`)
+      lines[dottedIndex] = withTrailingCr(lines[dottedIndex]!, `${table}.${key} = ${raw}`)
       continue
     }
     const bareIndex = scan.bareKeyIndexes.get(key)
@@ -141,17 +150,17 @@ export function upsertTuiSettingsInContent(content: string, updates: Map<string,
       lines[bareIndex] = withTrailingCr(lines[bareIndex]!, `${key} = ${raw}`)
       continue
     }
-    // Why: adding a scalar beside an existing tui.<key> descendant would turn valid TOML invalid.
+    // Why: adding a scalar beside an existing <table>.<key> descendant would turn valid TOML invalid.
     if (scan.blockedAbsentKeys.has(key)) {
       continue
     }
-    if (scan.hasBareTuiTable) {
+    if (scan.hasBareTable) {
       bareBodyInserts.push(`${key} = ${raw}`)
-    } else if (scan.hasDottedTuiKey) {
-      dottedPreambleInserts.push(`${tuiStructuredKey(key)} = ${raw}`)
-    } else if (!scan.blocksNewTuiTable) {
-      // Why: inline/array tui definitions block this branch because adding a
-      // plain [tui] beside either would make the config invalid.
+    } else if (scan.hasDottedKey) {
+      dottedPreambleInserts.push(`${table}.${key} = ${raw}`)
+    } else if (!scan.blocksNewTable) {
+      // Why: inline/array table definitions block this branch because adding a
+      // plain [<table>] beside either would make the config invalid.
       newTableKeys.push(`${key} = ${raw}`)
     }
   }
@@ -160,7 +169,7 @@ export function upsertTuiSettingsInContent(content: string, updates: Map<string,
   // one insert group is non-empty; still apply EOF→body→preamble so a splice
   // never shifts a lower index a later splice depends on.
   if (newTableKeys.length > 0) {
-    appendNewTuiTable(lines, newTableKeys, usesCrlf)
+    appendNewTable(lines, table, newTableKeys, usesCrlf)
   }
   if (bareBodyInserts.length > 0) {
     lines.splice(
@@ -171,7 +180,7 @@ export function upsertTuiSettingsInContent(content: string, updates: Map<string,
   }
   if (dottedPreambleInserts.length > 0) {
     lines.splice(
-      scan.lastDottedTuiIndex + 1,
+      scan.lastDottedKeyIndex + 1,
       0,
       ...dottedPreambleInserts.map((line) => withCrLine(line, usesCrlf))
     )
@@ -179,16 +188,20 @@ export function upsertTuiSettingsInContent(content: string, updates: Map<string,
   return joinPreservingTrailingNewline(lines, usesCrlf)
 }
 
-function scanTuiPlacement(lines: string[], updates: Map<string, string>): TuiPlacementScan {
+function scanTablePlacement(
+  lines: string[],
+  tableName: string,
+  updates: Map<string, string>
+): TablePlacementScan {
   let state = createTomlLineScanState()
   let inPreamble = true
-  let tuiTableSeen = false
-  let tuiBodyActive = false
-  let tuiBodyHeaderIndex = -1
-  let tuiBodyEndIndex = -1
-  let hasDottedTuiKey = false
-  let blocksNewTuiTable = false
-  let lastDottedTuiIndex = -1
+  let tableSeen = false
+  let tableBodyActive = false
+  let tableBodyHeaderIndex = -1
+  let tableBodyEndIndex = -1
+  let hasDottedKey = false
+  let blocksNewTable = false
+  let lastDottedKeyIndex = -1
   const bareKeyIndexes = new Map<string, number>()
   const dottedKeyIndexes = new Map<string, number>()
   const blockedAbsentKeys = new Set<string>()
@@ -198,29 +211,29 @@ function scanTuiPlacement(lines: string[], updates: Map<string, string>): TuiPla
     if (isTomlStructuralLine(state)) {
       const header = getTomlTableHeader(line)
       if (header) {
-        if (tuiBodyActive) {
-          tuiBodyEndIndex = index
-          tuiBodyActive = false
+        if (tableBodyActive) {
+          tableBodyEndIndex = index
+          tableBodyActive = false
         }
         const table = parseTomlTableHeaderPath(header)
         if (
           table &&
           !table.isArray &&
           table.segments.length === 1 &&
-          table.segments[0] === 'tui' &&
-          !tuiTableSeen
+          table.segments[0] === tableName &&
+          !tableSeen
         ) {
-          tuiTableSeen = true
-          tuiBodyActive = true
-          tuiBodyHeaderIndex = index
+          tableSeen = true
+          tableBodyActive = true
+          tableBodyHeaderIndex = index
         }
-        // Why: a root [[tui]] is already an array, so appending [tui] would
+        // Why: a root [[<table>]] is already an array, so appending [<table>] would
         // redefine it and make an otherwise valid config unparseable.
-        if (table?.isArray && table.segments.length === 1 && table.segments[0] === 'tui') {
-          blocksNewTuiTable = true
+        if (table?.isArray && table.segments.length === 1 && table.segments[0] === tableName) {
+          blocksNewTable = true
         }
         const descendantKey =
-          table?.segments[0] === 'tui' && table.segments.length > 1 ? table.segments[1] : null
+          table?.segments[0] === tableName && table.segments.length > 1 ? table.segments[1] : null
         if (descendantKey && updates.has(descendantKey)) {
           blockedAbsentKeys.add(descendantKey)
         }
@@ -229,13 +242,13 @@ function scanTuiPlacement(lines: string[], updates: Map<string, string>): TuiPla
         continue
       }
       if (inPreamble) {
-        // Why: any dotted `tui.*` key (allowlisted or not) already defines the
-        // implicit tui table, so a new `[tui]` table at EOF would duplicate it.
+        // Why: any dotted `<table>.*` key (allowlisted or not) already defines the
+        // implicit table, so a new `[<table>]` table at EOF would duplicate it.
         const parsed = parseTomlKeyPath(line)
         const isAssignment = parsed && line[parsed.end] === '='
-        if (isAssignment && parsed.segments[0] === 'tui' && parsed.segments.length > 1) {
-          hasDottedTuiKey = true
-          lastDottedTuiIndex = index
+        if (isAssignment && parsed.segments[0] === tableName && parsed.segments.length > 1) {
+          hasDottedKey = true
+          lastDottedKeyIndex = index
           const promotedKey = parsed.segments.length === 2 ? parsed.segments[1] : null
           if (promotedKey && updates.has(promotedKey)) {
             dottedKeyIndexes.set(promotedKey, index)
@@ -244,10 +257,14 @@ function scanTuiPlacement(lines: string[], updates: Map<string, string>): TuiPla
           if (descendantKey && updates.has(descendantKey)) {
             blockedAbsentKeys.add(descendantKey)
           }
-        } else if (isAssignment && parsed.segments.length === 1 && parsed.segments[0] === 'tui') {
-          blocksNewTuiTable = true
+        } else if (
+          isAssignment &&
+          parsed.segments.length === 1 &&
+          parsed.segments[0] === tableName
+        ) {
+          blocksNewTable = true
         }
-      } else if (tuiBodyActive) {
+      } else if (tableBodyActive) {
         const parsed = parseTomlKeyPath(line)
         const key = parsed?.segments.length === 1 ? parsed.segments[0] : null
         if (parsed && line[parsed.end] === '=' && key && updates.has(key)) {
@@ -261,23 +278,23 @@ function scanTuiPlacement(lines: string[], updates: Map<string, string>): TuiPla
     }
     state = updateTomlLineScanState(state, line)
   }
-  if (tuiBodyActive) {
-    tuiBodyEndIndex = lines.length
+  if (tableBodyActive) {
+    tableBodyEndIndex = lines.length
   }
 
   return {
     bareKeyIndexes,
     dottedKeyIndexes,
-    hasBareTuiTable: tuiTableSeen,
-    hasDottedTuiKey,
-    blocksNewTuiTable,
+    hasBareTable: tableSeen,
+    hasDottedKey,
+    blocksNewTable,
     blockedAbsentKeys,
-    bareBodyInsertIndex: computeBareBodyInsertIndex(lines, tuiBodyHeaderIndex, tuiBodyEndIndex),
-    lastDottedTuiIndex
+    bareBodyInsertIndex: computeBareBodyInsertIndex(lines, tableBodyHeaderIndex, tableBodyEndIndex),
+    lastDottedKeyIndex
   }
 }
 
-// Why: TOML forbids adding bare keys to `[tui]` after a `[tui.*]` subtable opens,
+// Why: TOML forbids adding bare keys to `[<table>]` after a `[<table>.*]` subtable opens,
 // so absent keys land at the body's end — before trailing blanks and before the
 // next header — which is the only valid spot.
 function computeBareBodyInsertIndex(
@@ -295,13 +312,18 @@ function computeBareBodyInsertIndex(
   return insertAt
 }
 
-function appendNewTuiTable(lines: string[], keyRenders: string[], usesCrlf: boolean): void {
+function appendNewTable(
+  lines: string[],
+  table: string,
+  keyRenders: string[],
+  usesCrlf: boolean
+): void {
   let appendAt = lines.length
   while (appendAt > 0 && (lines[appendAt - 1] ?? '').trim() === '') {
     appendAt -= 1
   }
   // Why: separate the new table from prior content with a blank line, unless the
   // file was empty/blank, where a leading blank would be spurious.
-  const block = appendAt > 0 ? ['', '[tui]', ...keyRenders] : ['[tui]', ...keyRenders]
+  const block = appendAt > 0 ? ['', `[${table}]`, ...keyRenders] : [`[${table}]`, ...keyRenders]
   lines.splice(appendAt, 0, ...block.map((line) => withCrLine(line, usesCrlf)))
 }
diff --git a/src/main/codex/codex-daemon-socket-path-guard.test.ts b/src/main/codex/codex-daemon-socket-path-guard.test.ts
new file mode 100644
index 000000000000..612eca4ff803
--- /dev/null
+++ b/src/main/codex/codex-daemon-socket-path-guard.test.ts
@@ -0,0 +1,243 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+
+vi.mock('electron', () => ({
+  app: {
+    getPath: () => {
+      throw new Error('tests pass explicit homes')
+    }
+  }
+}))
+
+import {
+  applyCodexDaemonSocketGuard,
+  codexDaemonSocketPath,
+  codexDaemonSocketPathExceedsLimit,
+  stripCodexDaemonOverride
+} from './codex-daemon-socket-path-guard'
+import {
+  syncSystemConfigIntoLegacySharedCodexHome,
+  syncSystemConfigIntoManagedCodexHome
+} from './codex-config-mirror'
+import { getCodexConfigSyncStatus } from './config-sync-stall'
+import { getCodexSettingsBaselinePath } from './config-settings-baseline'
+import { extractOrdinaryCodexSettings } from './config-toml-runtime-owned-sections'
+
+const UUID = '9dd962e2-449d-44c4-9733-0633f255064a'
+const MAC_MANAGED_HOME = `/Users/john/Library/Application Support/orca/codex-accounts/${UUID}/home`
+const OVERRIDE_LINE = 'daemon_auto_start = false # orca: CODEX_HOME too long for the daemon socket'
+
+// The socket suffix is 43 bytes: sun_path 104 (macOS) / 108 (Linux) leaves 60 / 64 for the home.
+function homeOfLength(length: number): string {
+  return `/${'a'.repeat(length - 1)}`
+}
+
+describe('codexDaemonSocketPathExceedsLimit', () => {
+  it('matches the reproduced Codex ceiling on macOS and Linux', () => {
+    expect(codexDaemonSocketPathExceedsLimit(homeOfLength(60), 'darwin')).toBe(false)
+    expect(codexDaemonSocketPathExceedsLimit(homeOfLength(61), 'darwin')).toBe(true)
+    expect(codexDaemonSocketPathExceedsLimit(homeOfLength(64), 'linux')).toBe(false)
+    expect(codexDaemonSocketPathExceedsLimit(homeOfLength(65), 'linux')).toBe(true)
+  })
+
+  it('flags the reported per-account macOS home', () => {
+    expect(codexDaemonSocketPath(MAC_MANAGED_HOME, 'darwin')).toBe(
+      `${MAC_MANAGED_HOME}/app-server-control/app-server-control.sock`
+    )
+    expect(codexDaemonSocketPathExceedsLimit(MAC_MANAGED_HOME, 'darwin')).toBe(true)
+  })
+
+  it('counts bytes, not characters', () => {
+    const home = `/${'é'.repeat(30)}`
+    expect(home.length).toBe(31)
+    expect(codexDaemonSocketPathExceedsLimit(home, 'darwin')).toBe(true)
+  })
+
+  it('measures WSL homes by their Linux path and limit', () => {
+    const shortWsl = '\\\\wsl.localhost\\Ubuntu\\home\\u\\.codex-orca'
+    expect(codexDaemonSocketPath(shortWsl, 'win32')).toBe(
+      '/home/u/.codex-orca/app-server-control/app-server-control.sock'
+    )
+    expect(codexDaemonSocketPathExceedsLimit(shortWsl, 'win32')).toBe(false)
+    const managedWsl = `\\\\wsl.localhost\\Ubuntu\\home\\u\\.local\\share\\orca\\codex-accounts\\${UUID}\\home`
+    expect(codexDaemonSocketPathExceedsLimit(managedWsl, 'win32')).toBe(true)
+  })
+
+  it('flags the Windows managed home against the 108-byte uds_windows limit', () => {
+    const home = `C:\\Users\\neil\\AppData\\Roaming\\orca\\codex-accounts\\${UUID}\\home`
+    expect(codexDaemonSocketPathExceedsLimit(home, 'win32')).toBe(true)
+    expect(codexDaemonSocketPathExceedsLimit('C:\\Users\\neil\\.codex', 'win32')).toBe(false)
+  })
+})
+
+describe('applyCodexDaemonSocketGuard', () => {
+  it('appends a [features] table when none exists and strips back to the original', () => {
+    const config = 'model = "gpt-5"\n\n[tui]\ntheme = "dark"\n'
+    const guarded = applyCodexDaemonSocketGuard(config, MAC_MANAGED_HOME, 'darwin')
+    expect(guarded).toBe(`${config}\n[features]\n${OVERRIDE_LINE}\n`)
+    expect(applyCodexDaemonSocketGuard(guarded, MAC_MANAGED_HOME, 'darwin')).toBe(guarded)
+    expect(stripCodexDaemonOverride(guarded)).toBe(config)
+  })
+
+  it('writes into an existing [features] table and overrides an explicit true', () => {
+    const config = '[features]\nhooks = true\ndaemon_auto_start = true\n\n[tui]\ntheme = "dark"\n'
+    const guarded = applyCodexDaemonSocketGuard(config, MAC_MANAGED_HOME, 'darwin')
+    expect(guarded).toBe(`[features]\nhooks = true\n${OVERRIDE_LINE}\n\n[tui]\ntheme = "dark"\n`)
+    expect(stripCodexDaemonOverride(guarded)).toBe(
+      '[features]\nhooks = true\n\n[tui]\ntheme = "dark"\n'
+    )
+  })
+
+  it('uses a dotted key beside dotted features keys so the table is not defined twice', () => {
+    const config = 'features.hooks = true\n\n[tui]\ntheme = "dark"\n'
+    expect(applyCodexDaemonSocketGuard(config, MAC_MANAGED_HOME, 'darwin')).toBe(
+      `features.hooks = true\nfeatures.${OVERRIDE_LINE}\n\n[tui]\ntheme = "dark"\n`
+    )
+  })
+
+  it('creates a config for an empty home and keeps CRLF files CRLF', () => {
+    expect(applyCodexDaemonSocketGuard('', MAC_MANAGED_HOME, 'darwin')).toBe(
+      `[features]\n${OVERRIDE_LINE}\n`
+    )
+    const crlf = 'model = "gpt-5"\r\n'
+    const guarded = applyCodexDaemonSocketGuard(crlf, MAC_MANAGED_HOME, 'darwin')
+    expect(guarded).toBe(`model = "gpt-5"\r\n\r\n[features]\r\n${OVERRIDE_LINE}\r\n`)
+    expect(stripCodexDaemonOverride(guarded)).toBe(crlf)
+  })
+
+  it('removes a stale override once the home fits', () => {
+    const guarded = applyCodexDaemonSocketGuard('model = "m"\n', MAC_MANAGED_HOME, 'darwin')
+    expect(applyCodexDaemonSocketGuard(guarded, homeOfLength(20), 'darwin')).toBe('model = "m"\n')
+    expect(applyCodexDaemonSocketGuard('model = "m"\n', homeOfLength(20), 'darwin')).toBe(
+      'model = "m"\n'
+    )
+  })
+
+  it('warns once instead of failing silently when inline features block the override', () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+    const home = `${MAC_MANAGED_HOME}-inline`
+    const config = 'features = { hooks = true }\n'
+    expect(applyCodexDaemonSocketGuard(config, home, 'darwin')).toBe(config)
+    applyCodexDaemonSocketGuard(config, home, 'darwin')
+    expect(warn).toHaveBeenCalledTimes(1)
+    expect(String(warn.mock.calls[0]?.[0])).toContain('Could not turn off Codex daemon auto-start')
+    const alreadyOff = 'features = { daemon_auto_start = false }\n'
+    applyCodexDaemonSocketGuard(alreadyOff, `${home}-off`, 'darwin')
+    expect(warn).toHaveBeenCalledTimes(1)
+    warn.mockRestore()
+  })
+
+  it('never promotes the override into a seeded ~/.codex', () => {
+    const guarded = applyCodexDaemonSocketGuard('model = "m"\n', MAC_MANAGED_HOME, 'darwin')
+    expect(extractOrdinaryCodexSettings(guarded)).toBe('model = "m"')
+  })
+})
+
+describe('syncSystemConfigIntoManagedCodexHome daemon guard', () => {
+  let root: string
+  let systemHomePath: string
+
+  beforeEach(() => {
+    // Why: /tmp keeps the short home under every sun_path limit on POSIX hosts.
+    root = mkdtempSync(join(process.platform === 'win32' ? tmpdir() : '/tmp', 'cx-'))
+    systemHomePath = join(root, 's')
+    mkdirSync(systemHomePath)
+  })
+
+  afterEach(() => {
+    rmSync(root, { recursive: true, force: true })
+  })
+
+  function makeHome(name: string): string {
+    const home = join(root, name)
+    mkdirSync(home, { recursive: true })
+    return home
+  }
+
+  const longHome = (): string =>
+    makeHome(join('Library', 'Application Support', 'orca', 'codex-accounts', UUID, 'home'))
+
+  it('turns daemon auto-start off in a long managed home without touching ~/.codex', () => {
+    const systemConfig = 'model = "gpt-5"\n'
+    writeFileSync(join(systemHomePath, 'config.toml'), systemConfig)
+    const runtimeHomePath = longHome()
+
+    syncSystemConfigIntoManagedCodexHome({ runtimeHomePath, systemHomePath })
+    const first = readFileSync(join(runtimeHomePath, 'config.toml'), 'utf-8')
+    expect(first).toBe(`model = "gpt-5"\n\n[features]\n${OVERRIDE_LINE}\n`)
+
+    syncSystemConfigIntoManagedCodexHome({ runtimeHomePath, systemHomePath })
+    expect(readFileSync(join(runtimeHomePath, 'config.toml'), 'utf-8')).toBe(first)
+    expect(readFileSync(join(systemHomePath, 'config.toml'), 'utf-8')).toBe(systemConfig)
+  })
+
+  it('still guards a long home when the user has no ~/.codex/config.toml', () => {
+    const runtimeHomePath = longHome()
+    syncSystemConfigIntoManagedCodexHome({ runtimeHomePath, systemHomePath })
+    expect(readFileSync(join(runtimeHomePath, 'config.toml'), 'utf-8')).toBe(
+      `[features]\n${OVERRIDE_LINE}\n`
+    )
+    // A guard-only runtime config withholds no settings, so it must not raise the missing-source warning.
+    expect(getCodexConfigSyncStatus({ runtimeHomePath, systemHomePath }).state).toBe('synced')
+  })
+
+  it('still guards an existing home when a stalled settings write-back skips the mirror', () => {
+    writeFileSync(join(systemHomePath, 'config.toml'), 'model = "gpt-5"\n')
+    const runtimeHomePath = longHome()
+    writeFileSync(join(runtimeHomePath, 'config.toml'), 'model = "runtime"\n')
+    // An unreadable baseline makes promotion refuse, so no mirror pass runs.
+    mkdirSync(getCodexSettingsBaselinePath(runtimeHomePath))
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+
+    syncSystemConfigIntoManagedCodexHome({ runtimeHomePath, systemHomePath })
+    warn.mockRestore()
+    expect(readFileSync(join(runtimeHomePath, 'config.toml'), 'utf-8')).toBe(
+      `model = "runtime"\n\n[features]\n${OVERRIDE_LINE}\n`
+    )
+    expect(readFileSync(join(systemHomePath, 'config.toml'), 'utf-8')).toBe('model = "gpt-5"\n')
+  })
+
+  it('mirrors a later-created ~/.codex/config.toml into a guard-only home', () => {
+    const runtimeHomePath = longHome()
+    syncSystemConfigIntoManagedCodexHome({ runtimeHomePath, systemHomePath })
+    writeFileSync(join(systemHomePath, 'config.toml'), 'model = "gpt-5"\n')
+    syncSystemConfigIntoManagedCodexHome({ runtimeHomePath, systemHomePath })
+    expect(readFileSync(join(runtimeHomePath, 'config.toml'), 'utf-8')).toBe(
+      `model = "gpt-5"\n\n[features]\n${OVERRIDE_LINE}\n`
+    )
+    expect(readFileSync(join(systemHomePath, 'config.toml'), 'utf-8')).toBe('model = "gpt-5"\n')
+  })
+
+  it('still reports a real stall when the runtime holds user settings and the source is gone', () => {
+    writeFileSync(join(systemHomePath, 'config.toml'), 'model = "gpt-5"\n')
+    const runtimeHomePath = longHome()
+    syncSystemConfigIntoManagedCodexHome({ runtimeHomePath, systemHomePath })
+    rmSync(join(systemHomePath, 'config.toml'))
+    expect(getCodexConfigSyncStatus({ runtimeHomePath, systemHomePath })).toMatchObject({
+      state: 'stalled',
+      reason: 'missing-source'
+    })
+  })
+
+  it('keeps the guard in the legacy shared home when a system launch refreshes it', () => {
+    writeFileSync(join(systemHomePath, 'config.toml'), 'model = "gpt-5"\n')
+    const runtimeHomePath = longHome()
+    writeFileSync(
+      join(runtimeHomePath, 'config.toml'),
+      `model = "old"\n\n[features]\n${OVERRIDE_LINE}\n`
+    )
+    syncSystemConfigIntoLegacySharedCodexHome({ runtimeHomePath, systemHomePath })
+    expect(readFileSync(join(runtimeHomePath, 'config.toml'), 'utf-8')).toContain(OVERRIDE_LINE)
+    expect(readFileSync(join(runtimeHomePath, 'config.toml'), 'utf-8')).toContain('model = "gpt-5"')
+    expect(readFileSync(join(systemHomePath, 'config.toml'), 'utf-8')).toBe('model = "gpt-5"\n')
+  })
+
+  it('leaves a short home on the default daemon behavior', () => {
+    writeFileSync(join(systemHomePath, 'config.toml'), 'model = "gpt-5"\n')
+    const runtimeHomePath = makeHome('h')
+    syncSystemConfigIntoManagedCodexHome({ runtimeHomePath, systemHomePath })
+    expect(readFileSync(join(runtimeHomePath, 'config.toml'), 'utf-8')).toBe('model = "gpt-5"\n')
+  })
+})
diff --git a/src/main/codex/codex-daemon-socket-path-guard.ts b/src/main/codex/codex-daemon-socket-path-guard.ts
new file mode 100644
index 000000000000..98b7b87e0cf5
--- /dev/null
+++ b/src/main/codex/codex-daemon-socket-path-guard.ts
@@ -0,0 +1,140 @@
+import { realpathSync } from 'node:fs'
+import { parseWslUncPath } from '../../shared/wsl-paths'
+import { unixSocketPathByteLimit } from '../../shared/unix-socket-path-limit'
+import { upsertTableSettingsInContent } from './codex-config-settings-upsert'
+import {
+  createTomlLineScanState,
+  getTomlTableHeader,
+  isTomlStructuralLine,
+  joinPreservingTrailingNewline,
+  updateTomlLineScanState
+} from './config-toml-line-scan'
+import { parseTomlTableHeaderPath } from './config-toml-key-path'
+
+/**
+ * Codex >= 0.157 auto-starts a background app-server daemon and its client
+ * connects to `<CODEX_HOME>/app-server-control/app-server-control.sock`. Orca's
+ * managed homes live under userData, which makes that path longer than
+ * `sun_path`, so every interactive `codex` fails with "path must be shorter
+ * than SUN_LEN". Only for such homes, Orca turns daemon auto-start off.
+ */
+const DAEMON_SOCKET_SEGMENTS = ['app-server-control', 'app-server-control.sock']
+export const CODEX_DAEMON_OVERRIDE_MARKER = '# orca: CODEX_HOME too long for the daemon socket'
+const DAEMON_OVERRIDE_RAW = `false ${CODEX_DAEMON_OVERRIDE_MARKER}`
+
+export function codexDaemonSocketPath(homePath: string, platform = process.platform): string {
+  const wsl = parseWslUncPath(homePath)
+  if (wsl) {
+    return [wsl.linuxPath.replace(/\/+$/, ''), ...DAEMON_SOCKET_SEGMENTS].join('/')
+  }
+  // Why: Codex canonicalizes CODEX_HOME before building the socket path, so a
+  // short symlinked alias still resolves to the long real path. Its
+  // AbsolutePathBuf strips the Windows \\?\ prefix, so none is counted here.
+  let canonical = homePath
+  try {
+    canonical = realpathSync.native(homePath)
+  } catch {
+    // Unresolvable homes are measured as spelled.
+  }
+  const separator = platform === 'win32' ? '\\' : '/'
+  return [canonical.replace(/[\\/]+$/, ''), ...DAEMON_SOCKET_SEGMENTS].join(separator)
+}
+
+export function codexDaemonSocketPathExceedsLimit(
+  homePath: string,
+  platform = process.platform
+): boolean {
+  // Why: WSL homes run Linux Codex; Windows Codex's uds_windows also uses a 108-byte sun_path.
+  const os = platform === 'darwin' && !parseWslUncPath(homePath) ? 'darwin' : 'linux'
+  const socketPath = codexDaemonSocketPath(homePath, platform)
+  return Buffer.byteLength(socketPath, 'utf8') > unixSocketPathByteLimit(os)
+}
+
+const unguardableHomesWarned = new Set<string>()
+
+/** Applies (or removes) Orca's daemon override so it tracks the home's current path. */
+export function applyCodexDaemonSocketGuard(
+  config: string,
+  homePath: string,
+  platform = process.platform
+): string {
+  if (!codexDaemonSocketPathExceedsLimit(homePath, platform)) {
+    return stripCodexDaemonOverride(config)
+  }
+  // Why: upsert rewrites an existing daemon_auto_start line in place, so re-applying is a no-op.
+  const guarded = upsertTableSettingsInContent(
+    config,
+    'features',
+    new Map([['daemon_auto_start', DAEMON_OVERRIDE_RAW]])
+  )
+  if (
+    !guarded.includes(CODEX_DAEMON_OVERRIDE_MARKER) &&
+    !/\bdaemon_auto_start\s*=\s*false\b/.test(guarded) &&
+    !unguardableHomesWarned.has(homePath)
+  ) {
+    // Why: an inline `features = {...}` or `[[features]]` blocks the upsert; say so once instead of failing silently.
+    unguardableHomesWarned.add(homePath)
+    console.warn(
+      `[codex-config] Could not turn off Codex daemon auto-start in ${homePath}: its config defines features in a form Orca cannot extend. Codex may fail with "path must be shorter than SUN_LEN"; add daemon_auto_start = false to features in ~/.codex/config.toml.`
+    )
+  }
+  return guarded
+}
+
+/** True when a config holds nothing but Orca's daemon override, i.e. no user settings. */
+export function isOnlyCodexDaemonOverride(config: string): boolean {
+  return (
+    config.includes(CODEX_DAEMON_OVERRIDE_MARKER) && stripCodexDaemonOverride(config).trim() === ''
+  )
+}
+
+/**
+ * Removes only lines Orca wrote, plus a `[features]` table left empty by that
+ * removal, so the override never leaks into the user's real ~/.codex.
+ */
+export function stripCodexDaemonOverride(config: string): string {
+  if (!config.includes(CODEX_DAEMON_OVERRIDE_MARKER)) {
+    return config
+  }
+  const usesCrlf = config.includes('\r\n')
+  const lines = config.split('\n')
+  const kept: string[] = []
+  let featuresHeaderIndex = -1
+  let removedFromFeatures = false
+  const dropEmptyFeaturesTable = (): void => {
+    const body = kept.slice(featuresHeaderIndex + 1)
+    if (featuresHeaderIndex !== -1 && removedFromFeatures && body.every((l) => l.trim() === '')) {
+      kept.length = featuresHeaderIndex
+      while (kept.at(-1)?.trim() === '') {
+        kept.pop()
+      }
+      if (kept.length > 0) {
+        // Why: keep one blank line before the next table.
+        kept.push(usesCrlf ? '\r' : '')
+      }
+    }
+  }
+  let scan = createTomlLineScanState()
+  for (const line of lines) {
+    const structural = isTomlStructuralLine(scan)
+    scan = updateTomlLineScanState(scan, line)
+    if (structural && line.trimEnd().endsWith(CODEX_DAEMON_OVERRIDE_MARKER)) {
+      removedFromFeatures ||= featuresHeaderIndex !== -1
+      continue
+    }
+    const header = structural ? getTomlTableHeader(line) : null
+    if (header) {
+      dropEmptyFeaturesTable()
+      const table = parseTomlTableHeaderPath(header)
+      const isFeatures = table?.isArray === false && table.segments.join('.') === 'features'
+      featuresHeaderIndex = isFeatures ? kept.length : -1
+      removedFromFeatures = false
+    }
+    kept.push(line)
+  }
+  dropEmptyFeaturesTable()
+  while (kept.at(-1)?.trim() === '') {
+    kept.pop()
+  }
+  return kept.length === 0 ? '' : joinPreservingTrailingNewline(kept, usesCrlf)
+}
diff --git a/src/main/codex/codex-persistent-command-retention.test.ts b/src/main/codex/codex-persistent-command-retention.test.ts
index 498d5b186ef4..2c123a3b910c 100644
--- a/src/main/codex/codex-persistent-command-retention.test.ts
+++ b/src/main/codex/codex-persistent-command-retention.test.ts
@@ -71,14 +71,15 @@ describe('persistent command retention', () => {
     items.streams.flush()
     const originalJoin = Array.prototype.join
     let retainedJoins = 0
-    const spy = vi
-      .spyOn(Array.prototype, 'join')
-      .mockImplementation(function (this: unknown[], separator) {
-        if (this[0] === 'retained-prefix') {
-          retainedJoins += 1
-        }
-        return originalJoin.call(this, separator)
-      })
+    const spy = vi.spyOn(Array.prototype, 'join').mockImplementation(function (
+      this: unknown[],
+      separator
+    ) {
+      if (this[0] === 'retained-prefix') {
+        retainedJoins += 1
+      }
+      return originalJoin.call(this, separator)
+    })
     try {
       for (let index = 0; index < 100; index += 1) {
         items.streams.flush()
diff --git a/src/main/codex/codex-structured-compaction-refusal.test.ts b/src/main/codex/codex-structured-compaction-refusal.test.ts
new file mode 100644
index 000000000000..437f32f0a8ff
--- /dev/null
+++ b/src/main/codex/codex-structured-compaction-refusal.test.ts
@@ -0,0 +1,28 @@
+// A compaction Codex refuses up front keeps Codex's own words for the chat's failure row.
+
+import { describe, expect, it } from 'vitest'
+import { CodexAppServerRequestError } from './codex-app-server-connection'
+import { acquired, fakeCodex } from './codex-structured-session-adapter-fixture'
+
+describe('Codex compaction refused at the request', () => {
+  it("carries Codex's message as the detail, apart from Orca's wrapper", async () => {
+    const codex = fakeCodex({
+      'thread/compact/start': () => {
+        throw new CodexAppServerRequestError(
+          'thread/compact/start',
+          -32600,
+          'codex app-server thread/compact/start failed: thread has nothing to compact',
+          'thread has nothing to compact'
+        )
+      }
+    })
+    const adapter = await acquired(codex)
+
+    await expect(
+      adapter.compact({ turnId: 'compact-1', sessionId: 'session-1', fence: 7 })
+    ).resolves.toEqual({
+      outcome: 'failed',
+      detail: { text: 'thread has nothing to compact', audience: 'person' }
+    })
+  })
+})
diff --git a/src/main/codex/codex-structured-dispatch-admission.test.ts b/src/main/codex/codex-structured-dispatch-admission.test.ts
index 5fc811b9382c..b8ea81d592c7 100644
--- a/src/main/codex/codex-structured-dispatch-admission.test.ts
+++ b/src/main/codex/codex-structured-dispatch-admission.test.ts
@@ -140,7 +140,12 @@ describe('codex dispatch admission', () => {
     const { CodexAppServerRequestError } = await import('./codex-app-server-connection')
     const codex = fakeCodexAppServer({
       'turn/start': () => {
-        throw new CodexAppServerRequestError('turn/start', -32602, 'thread not found')
+        throw new CodexAppServerRequestError(
+          'turn/start',
+          -32602,
+          'codex app-server turn/start failed: thread not found',
+          'thread not found'
+        )
       }
     })
     const settlements: LateSettlement[] = []
@@ -148,9 +153,14 @@ describe('codex dispatch admission', () => {
     const connection = codex.connections[0]!
     startTurn(connection, 'turn-1')
 
+    // Codex's own words reach the sentence and the fact; Orca's prefix reaches neither.
     expect(await send(adapter, 'client-1')).toEqual({
       state: 'rejected',
-      reason: 'thread not found'
+      reason: 'The provider did not accept this message: thread not found.',
+      rejection: {
+        kind: 'providerRejected',
+        detail: { text: 'thread not found', audience: 'person' }
+      }
     })
 
     // A refused write is disarmed, so a later echo of that id settles nothing.
@@ -347,7 +357,8 @@ describe('codex dispatch admission', () => {
     }
     expect(await send(adapter, 'client-overflow')).toEqual({
       state: 'rejected',
-      reason: 'codex structured dispatch queue is full'
+      reason: 'codex structured dispatch queue is full',
+      rejection: { kind: 'queueFull' }
     })
 
     echoUserMessage(connection, { turnId: 'turn-1', itemId: 'item-u0', clientId: 'client-0' })
diff --git a/src/main/codex/codex-structured-launch-resolution.test.ts b/src/main/codex/codex-structured-launch-resolution.test.ts
index 60aab5ed1db3..36ab39e3babc 100644
--- a/src/main/codex/codex-structured-launch-resolution.test.ts
+++ b/src/main/codex/codex-structured-launch-resolution.test.ts
@@ -180,6 +180,16 @@ describe('codex structured launch resolution', () => {
     })
   })
 
+  // A thread opened on the configured default and then given a turn on the saved model reads to
+  // Codex as a model switch, and it injects the saved model's whole prompt a second time.
+  it('opens the thread on the model the record saved', async () => {
+    const launch = await resolverFor(
+      record({ options: { model: 'gpt-chosen', effort: 'high', fastMode: 'false' } })
+    )({ identity: IDENTITY })
+
+    expect(launch.model).toBe('gpt-chosen')
+  })
+
   // The configured CLI arguments are a terminal concern: a durable record written before they
   // stopped being read must not smuggle one back into app-server's argv.
   it("ignores the record's durable launch arguments", async () => {
diff --git a/src/main/codex/codex-structured-launch-resolution.ts b/src/main/codex/codex-structured-launch-resolution.ts
index 8a3fe002cb1e..ebfdb27200a5 100644
--- a/src/main/codex/codex-structured-launch-resolution.ts
+++ b/src/main/codex/codex-structured-launch-resolution.ts
@@ -94,6 +94,8 @@ export function createCodexStructuredLaunchResolver(
     const permissionPolicy = deps.resolvePermissionPolicy?.()
     const head = agentSessionProviderHandleChainHead(record.providerHandleChain)
     const resumeThreadId = head?.handle.provider === 'codex' ? head.handle.threadId : null
+    // The same saved options every turn sends, so the thread and its turns name one model.
+    const model = record.options?.model
     return {
       command,
       args: ['app-server'],
@@ -107,6 +109,7 @@ export function createCodexStructuredLaunchResolver(
       // forked or adopted head names a conversation Codex held.
       ...(resumeThreadId && head?.origin === 'created' ? { supersedeIfUnsaved: true } : {}),
       ...(permissionPolicy ? { permissionPolicy } : {}),
+      ...(model ? { model } : {}),
       ...(resumeThreadId
         ? {
             resumePath: await (deps.resolveRollout ?? resolvePinnedCodexRolloutProof)(
diff --git a/src/main/codex/codex-structured-owner-identity.ts b/src/main/codex/codex-structured-owner-identity.ts
index 44f25ea47247..805a767e6200 100644
--- a/src/main/codex/codex-structured-owner-identity.ts
+++ b/src/main/codex/codex-structured-owner-identity.ts
@@ -17,6 +17,32 @@ export const CODEX_SPAWN_TOKEN_ENV = 'ORCA_AGENT_SESSION_SPAWN_TOKEN'
 
 const START_TIME_READ_ATTEMPTS = 3
 
+/**
+ * The child's identity, read once. The real connection reports its spawn before the handshake, and
+ * `onSpawned` makes it durable there, so a crash mid-start leaves an owner recovery can stop; a
+ * connection that reports no spawn is identified once it is open.
+ */
+export function codexSpawnedProcessIdentity(
+  input: {
+    identity: AgentSessionJournalIdentity
+    spawnToken: string
+    onSpawned?: (process: AgentSessionProcessIdentity) => Promise<void>
+  },
+  readStartTime?: (pid: number) => Promise<number | null>
+): {
+  onSpawned: (pid: number) => Promise<void>
+  read: (pid: number | undefined) => Promise<AgentSessionProcessIdentity>
+} {
+  let spawned: Promise<AgentSessionProcessIdentity> | undefined
+  return {
+    onSpawned: async (pid) => {
+      spawned = codexProcessIdentity({ ...input, pid }, readStartTime)
+      await input.onSpawned?.(await spawned)
+    },
+    read: (pid) => spawned ?? codexProcessIdentity({ ...input, pid }, readStartTime)
+  }
+}
+
 export async function codexProcessIdentity(
   input: {
     identity: AgentSessionJournalIdentity
diff --git a/src/main/codex/codex-structured-prompt-ownership.test.ts b/src/main/codex/codex-structured-prompt-ownership.test.ts
index cfb77e628a7d..ecdc4c9a4be0 100644
--- a/src/main/codex/codex-structured-prompt-ownership.test.ts
+++ b/src/main/codex/codex-structured-prompt-ownership.test.ts
@@ -159,7 +159,7 @@ describe('Codex live prompt ownership', () => {
       sessionId: 'session-1',
       itemId: 'journal-prompt',
       kind: 'approval',
-      optionId: 'accept',
+      response: { kind: 'option', optionId: 'accept' },
       fence: 7,
       commit: async () => {
         expect(codex.connections[0]?.replies).toEqual([])
@@ -210,7 +210,7 @@ describe('Codex live prompt ownership', () => {
         sessionId: 'session-1',
         itemId: 'journal-prompt',
         kind: 'approval',
-        optionId: 'accept',
+        response: { kind: 'option', optionId: 'accept' },
         fence: 7,
         commit
       })
@@ -224,7 +224,7 @@ describe('Codex live prompt ownership', () => {
         sessionId: 'session-1',
         itemId: 'journal-prompt',
         kind: 'approval',
-        optionId: 'accept',
+        response: { kind: 'option', optionId: 'accept' },
         fence: 7,
         commit
       })
@@ -237,7 +237,7 @@ describe('Codex live prompt ownership', () => {
         sessionId: 'session-1',
         itemId: 'journal-prompt',
         kind: 'approval',
-        optionId: 'accept',
+        response: { kind: 'option', optionId: 'accept' },
         fence: 8,
         commit
       })
@@ -266,7 +266,7 @@ describe('Codex live prompt ownership', () => {
       sessionId: 'session-1',
       itemId: 'journal-prompt',
       kind: 'approval',
-      optionId: 'decline',
+      response: { kind: 'option', optionId: 'decline' },
       fence: 7,
       commit: async () => undefined
     })
@@ -382,7 +382,7 @@ describe('Codex live prompt ownership', () => {
         sessionId: 'session-1',
         itemId: siblingItemId,
         kind: 'question',
-        optionId: 'no',
+        response: { kind: 'answers', answers: [{ questionId: 'q2', optionIds: [], other: 'no' }] },
         fence: 7,
         commit: async () => undefined
       })
@@ -497,7 +497,7 @@ describe('Codex live prompt ownership', () => {
         sessionId: 'session-1',
         itemId: promptItemId,
         kind: 'approval',
-        optionId: 'accept',
+        response: { kind: 'option', optionId: 'accept' },
         fence: 7,
         commit
       })
@@ -545,7 +545,7 @@ describe('Codex live prompt ownership', () => {
         sessionId: 'session-1',
         itemId: promptItemId,
         kind: 'approval',
-        optionId: 'accept',
+        response: { kind: 'option', optionId: 'accept' },
         fence: 7,
         commit
       })
@@ -587,7 +587,7 @@ describe('Codex live prompt ownership', () => {
         sessionId: 'session-1',
         itemId: promptItemId,
         kind: 'approval',
-        optionId: 'accept',
+        response: { kind: 'option', optionId: 'accept' },
         fence: 7,
         commit
       })
diff --git a/src/main/codex/codex-structured-prompt-ownership.ts b/src/main/codex/codex-structured-prompt-ownership.ts
index 28d060d955f7..d58f08e731d2 100644
--- a/src/main/codex/codex-structured-prompt-ownership.ts
+++ b/src/main/codex/codex-structured-prompt-ownership.ts
@@ -1,9 +1,15 @@
 import {
+  AgentSessionPromptAnswerRejectedError,
   AgentSessionPromptUnavailableError,
   type StructuredAgentSessionAdapter
 } from '../native-chat/agent-session-wire/structured-agent-session-adapter'
 import type { StructuredSessionCompaction } from '../native-chat/agent-session-wire/structured-session-compaction'
-import { answerCodexPrompt } from './codex-structured-prompt-replies'
+import {
+  answerCodexPrompt,
+  prepareCodexPromptAnswer,
+  type CodexPendingPrompt,
+  type CodexPreparedAnswer
+} from './codex-structured-prompt-replies'
 import { requireLiveCodexSession, type CodexSession } from './codex-structured-session-state'
 import type { CodexStructuredTurnCancellation } from './codex-structured-turn-cancellation'
 
@@ -69,6 +75,19 @@ export async function cancelCodexStructuredTurn(input: {
   }
 }
 
+function prepareCodexAnswer(
+  prompt: CodexPendingPrompt,
+  response: AnswerInput['response']
+): CodexPreparedAnswer {
+  try {
+    return prepareCodexPromptAnswer(prompt, response)
+  } catch (error) {
+    throw new AgentSessionPromptAnswerRejectedError(
+      error instanceof Error ? error.message : String(error)
+    )
+  }
+}
+
 export async function answerCodexStructuredPrompt(input: {
   request: AnswerInput
   sessions: Map<string, CodexSession>
@@ -84,6 +103,7 @@ export async function answerCodexStructuredPrompt(input: {
     throw new AgentSessionPromptUnavailableError(request.itemId)
   }
   try {
+    const prepared = prepareCodexAnswer(claim.prompt, request.response)
     await request.commit()
     if (
       sessions.get(request.sessionId) !== session ||
@@ -95,7 +115,7 @@ export async function answerCodexStructuredPrompt(input: {
       throw new AgentSessionPromptUnavailableError(request.itemId)
     }
     session.translator?.resolvePrompt(request.itemId)
-    answerCodexPrompt(session.prompts, session.connection, claim, request.optionId)
+    answerCodexPrompt(session.prompts, session.connection, claim, prepared)
   } catch (error) {
     session.prompts.releaseClaim(claim)
     throw error
diff --git a/src/main/codex/codex-structured-prompt-replies.test.ts b/src/main/codex/codex-structured-prompt-replies.test.ts
index e575f27632b2..9f17a3efb4c6 100644
--- a/src/main/codex/codex-structured-prompt-replies.test.ts
+++ b/src/main/codex/codex-structured-prompt-replies.test.ts
@@ -1,8 +1,11 @@
 import { describe, expect, it } from 'vitest'
 import { AGENT_SESSION_ID_MAX_LENGTH } from '../../shared/agent-session-wire'
+import type { AgentSessionPromptResponse } from '../../shared/agent-session-question-answer'
 import {
   applyCodexPromptAnswer,
   CodexPromptRegistry,
+  prepareCodexPromptAnswer,
+  type CodexPendingPrompt,
   MAX_CODEX_PROMPT_REGISTRY_BYTES,
   MAX_CODEX_PROMPT_REGISTRY_ENTRIES,
   codexJournalPromptIdPart,
@@ -11,6 +14,29 @@ import {
   encodeCodexQuestionOptionId
 } from './codex-structured-prompt-replies'
 
+function picked(optionId: string): AgentSessionPromptResponse {
+  return { kind: 'answers', answers: [{ questionId: 'q1', optionIds: [optionId] }] }
+}
+
+function typed(questionId: string, other: string): AgentSessionPromptResponse {
+  return { kind: 'answers', answers: [{ questionId, optionIds: [], other }] }
+}
+
+function registered(prompt: CodexPendingPrompt | null): CodexPendingPrompt {
+  if (!prompt) {
+    throw new Error('expected the request to register')
+  }
+  return prompt
+}
+
+function answer(
+  prompt: CodexPendingPrompt | null,
+  response: AgentSessionPromptResponse
+): Record<string, unknown> | null {
+  const live = registered(prompt)
+  return applyCodexPromptAnswer(live, prepareCodexPromptAnswer(live, response))
+}
+
 function userInputRequest(questionIds: string[]): {
   id: number
   method: string
@@ -59,7 +85,7 @@ describe('codex question option ids', () => {
 
     expect(Buffer.byteLength(optionId, 'utf8')).toBeLessThan(1024)
     expect(codexJournalPromptIdPart(longQuestionId)).not.toBe(longQuestionId)
-    expect(applyCodexPromptAnswer(prompt as NonNullable<typeof prompt>, optionId)).toEqual({
+    expect(answer(prompt, picked(optionId))).toEqual({
       answers: { [longQuestionId]: { answers: [longAnswer] } }
     })
   })
@@ -219,11 +245,11 @@ describe('CodexPromptRegistry', () => {
 })
 
 describe('applyCodexPromptAnswer', () => {
-  it('accepts a bare answer only when the request has one question', () => {
+  it('answers the lone question of a single-question request with typed text', () => {
     const registry = new CodexPromptRegistry()
     const single = registry.register(userInputRequest(['q1']))
 
-    expect(applyCodexPromptAnswer(single as NonNullable<typeof single>, 'sure')).toEqual({
+    expect(answer(single, typed('q1', 'sure'))).toEqual({
       answers: { q1: { answers: ['sure'] } }
     })
   })
@@ -232,29 +258,32 @@ describe('applyCodexPromptAnswer', () => {
     const registry = new CodexPromptRegistry()
     const many = registry.register(userInputRequest(['q1', 'q2']))
 
-    expect(() => applyCodexPromptAnswer(many as NonNullable<typeof many>, 'sure')).toThrow(
-      'does not name a question'
-    )
-    expect(() =>
-      applyCodexPromptAnswer(
-        many as NonNullable<typeof many>,
-        encodeCodexQuestionOptionId('q3', 'sure')
-      )
-    ).toThrow('does not name a question')
+    expect(() => answer(many, picked('sure'))).toThrow('does not name a question')
+    expect(() => answer(many, typed('q3', 'sure'))).toThrow('does not name a question')
   })
 
   it('keeps the last answer when a question is answered twice', () => {
     const registry = new CodexPromptRegistry()
     const single = registry.register(userInputRequest(['q1']))
-    const prompt = single as NonNullable<typeof single>
 
-    applyCodexPromptAnswer(prompt, encodeCodexQuestionOptionId('q1', 'first'))
+    answer(single, typed('q1', 'first'))
 
-    expect(applyCodexPromptAnswer(prompt, encodeCodexQuestionOptionId('q1', 'second'))).toEqual({
+    expect(answer(single, typed('q1', 'second'))).toEqual({
       answers: { q1: { answers: ['second'] } }
     })
   })
 
+  it('refuses an answer over the registry bound before recording anything', () => {
+    const registry = new CodexPromptRegistry()
+    const single = registry.register(userInputRequest(['q1']))
+    const live = registered(single)
+
+    expect(() => prepareCodexPromptAnswer(live, typed('q1', 'x'.repeat(64 * 1024 + 1)))).toThrow(
+      'exceeds bounded registry state'
+    )
+    expect(live.answers.size).toBe(0)
+  })
+
   it('refuses question and option collections that exceed bounded live state', () => {
     const registry = new CodexPromptRegistry()
     const tooManyQuestions = registry.register(
diff --git a/src/main/codex/codex-structured-prompt-replies.ts b/src/main/codex/codex-structured-prompt-replies.ts
index 6e742bf827c4..d4301d8f27ce 100644
--- a/src/main/codex/codex-structured-prompt-replies.ts
+++ b/src/main/codex/codex-structured-prompt-replies.ts
@@ -1,3 +1,4 @@
+import type { AgentSessionPromptResponse } from '../../shared/agent-session-question-answer'
 import type { CodexAppServerConnection } from './codex-app-server-connection'
 import { CODEX_PROMPT_MAX_ANSWER_BYTES } from './codex-prompt-registry-bounds'
 import {
@@ -55,35 +56,61 @@ export function decodeCodexQuestionOptionId(
   }
 }
 
-/**
- * Records one answer and returns the reply payload once the request is fully
- * answered. A multi-question user-input request stays pending until every
- * question has an answer, because Codex takes one reply for all of them.
- */
-export function applyCodexPromptAnswer(
+/** One answer, checked against the prompt but not yet recorded on it. */
+export type CodexPreparedAnswer =
+  | { kind: 'decision'; decision: CodexApprovalDecision }
+  | { kind: 'answer'; questionId: string; answer: string }
+
+/** Validates a client's choice against the prompt without recording it, so an answer Codex
+ *  cannot take is refused before the journal commits it. */
+export function prepareCodexPromptAnswer(
   prompt: CodexPendingPrompt,
-  optionId: string
-): Record<string, unknown> | null {
+  response: AgentSessionPromptResponse
+): CodexPreparedAnswer {
   if (prompt.method !== CODEX_USER_INPUT_METHOD) {
-    if (!isCodexApprovalDecision(optionId)) {
-      throw new Error(`${optionId} is not a Codex approval decision`)
+    if (response.kind !== 'option' || !isCodexApprovalDecision(response.optionId)) {
+      throw new Error(`Codex item ${prompt.codexItemId} takes an approval decision`)
     }
-    return { decision: optionId }
+    return { kind: 'decision', decision: response.optionId }
   }
-  const mapped = prompt.optionAnswers.get(optionId)
-  const decoded = mapped ?? decodeCodexQuestionOptionId(optionId)
+  // Each Codex question is its own journal item, so an answer names exactly one question.
+  const entry =
+    response.kind === 'answers' && response.answers.length === 1 ? response.answers[0] : null
+  if (!entry) {
+    throw new Error(`Codex item ${prompt.codexItemId} takes one question answer`)
+  }
+  const optionId = entry.optionIds[0]
+  const decoded =
+    optionId === undefined
+      ? { questionId: entry.questionId, answer: entry.other?.trim() ?? '' }
+      : (prompt.optionAnswers.get(optionId) ?? decodeCodexQuestionOptionId(optionId))
   const questionId =
     (decoded?.questionId
       ? (prompt.questionIdAliases.get(decoded.questionId) ?? decoded.questionId)
       : null) ?? (prompt.questionIds.length === 1 ? prompt.questionIds[0] : null)
-  const answer = decoded?.answer ?? optionId
+  const answer = decoded?.answer ?? optionId ?? ''
   if (!questionId || !prompt.questionIds.includes(questionId)) {
-    throw new Error(`${optionId} does not name a question on Codex item ${prompt.codexItemId}`)
+    throw new Error(`The answer does not name a question on Codex item ${prompt.codexItemId}`)
   }
   if (Buffer.byteLength(answer, 'utf8') > CODEX_PROMPT_MAX_ANSWER_BYTES) {
     throw new Error('codex prompt answer exceeds bounded registry state')
   }
-  prompt.answers.set(questionId, answer)
+  return { kind: 'answer', questionId, answer }
+}
+
+/**
+ * Records one prepared answer and returns the reply payload once the request is fully
+ * answered. A multi-question user-input request stays pending until every
+ * question has an answer, because Codex takes one reply for all of them.
+ */
+export function applyCodexPromptAnswer(
+  prompt: CodexPendingPrompt,
+  prepared: CodexPreparedAnswer
+): Record<string, unknown> | null {
+  if (prepared.kind === 'decision') {
+    return { decision: prepared.decision }
+  }
+  prompt.answers.set(prepared.questionId, prepared.answer)
   if (prompt.questionIds.some((id) => !prompt.answers.has(id))) {
     return null
   }
@@ -104,13 +131,13 @@ export function answerCodexPrompt(
   registry: CodexPromptRegistry,
   connection: Pick<CodexAppServerConnection, 'respond'>,
   claim: CodexPromptClaim,
-  optionId: string
+  prepared: CodexPreparedAnswer
 ): void {
   if (!registry.ownsClaim(claim)) {
     throw new Error(`codex app-server is no longer waiting on ${claim.itemId}`)
   }
   const prompt = claim.prompt
-  const reply = applyCodexPromptAnswer(prompt, optionId)
+  const reply = applyCodexPromptAnswer(prompt, prepared)
   if (reply === null) {
     registry.releaseClaim(claim)
     return
diff --git a/src/main/codex/codex-structured-question-order.test.ts b/src/main/codex/codex-structured-question-order.test.ts
new file mode 100644
index 000000000000..ff9a210e17ad
--- /dev/null
+++ b/src/main/codex/codex-structured-question-order.test.ts
@@ -0,0 +1,257 @@
+// A Codex ask with several questions, driven from the real host journal through
+// the client's session reducer to the rows the transcript list draws.
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { computeAgentSessionPayloadFingerprint } from '../../shared/agent-session-mutation-envelope'
+import type { AgentJournalRenderItem } from '../../shared/agent-session-journal-types'
+import {
+  EMPTY_STRUCTURED_AGENT_SESSION,
+  reduceStructuredAgentSession,
+  type StructuredAgentSessionState
+} from '../../shared/structured-agent-session-reducer'
+import { projectStructuredAgentSessionMessages } from '../../shared/structured-agent-session-message-projection'
+import { projectNativeChatTranscriptMessages } from '../../shared/native-chat-transcript-projection'
+import { AgentSessionRecordStore } from '../runtime/agent-session-record-store'
+import { CodexJournalPrompts } from './codex-structured-journal-prompts'
+import { CODEX_USER_INPUT_METHOD } from './codex-structured-prompt-replies'
+import type { StructuredAgentSessionAdapter } from '../native-chat/agent-session-wire/structured-agent-session-adapter'
+import type { StructuredAgentSessionEventSink } from '../native-chat/agent-session-wire/structured-agent-session-event-sink'
+import { StructuredAgentSessionHost } from '../native-chat/agent-session-wire/structured-agent-session-host'
+import {
+  HOST_TEST_NOW,
+  HOST_TEST_SESSION as SESSION,
+  HOST_TEST_THREAD as THREAD,
+  hostTestAttachParams,
+  hostTestOperationId,
+  resetHostTestOperationIds
+} from '../native-chat/agent-session-wire/structured-agent-session-host-test-data'
+import {
+  projectStructuredQuestionMessages,
+  structuredQuestionTranscript
+} from '../../renderer/src/components/native-chat/structured-agent-question-projection'
+
+const CALLER = { callerKey: 'client-1' }
+
+type Asked = readonly { id: string; question: string }[]
+
+// Codex's question ids are the model's own words, so their text order is not
+// the order it asked in. These two asks spell the two orders live QA saw.
+const ASKED: Asked = [
+  { id: 'scope', question: 'Which files are in scope?' },
+  { id: 'priority', question: 'What matters most?' },
+  { id: 'deadline', question: 'When is it due?' }
+]
+const ASKED_OUT_OF_ORDER: Asked = [
+  { id: 'format', question: 'Which format?' },
+  { id: 'audience', question: 'Who reads it?' },
+  { id: 'length', question: 'How long?' }
+]
+
+let root: string
+let store: AgentSessionRecordStore
+let host: StructuredAgentSessionHost
+let sink: StructuredAgentSessionEventSink | null
+let client: StructuredAgentSessionState
+let clock: number
+
+beforeEach(async () => {
+  root = await mkdtemp(join(tmpdir(), 'orca-codex-question-order-'))
+  resetHostTestOperationIds()
+  sink = null
+  clock = HOST_TEST_NOW
+  const adapter: StructuredAgentSessionAdapter = {
+    acquire: vi.fn<StructuredAgentSessionAdapter['acquire']>(async ({ fence, events }) => {
+      sink = events ?? null
+      return {
+        process: {
+          hostId: 'local',
+          pid: 4242,
+          processStartTimeMs: 1_700_000_000_000,
+          spawnToken: store.getRecord(SESSION)?.lease.reservedSpawnToken ?? 'spawn-a'
+        },
+        link: {
+          linkId: `link-${fence}`,
+          handle: { provider: 'codex', threadId: THREAD },
+          origin: 'created',
+          mintedAtFence: fence,
+          observedAt: HOST_TEST_NOW
+        }
+      }
+    }),
+    releaseAcquisition: vi.fn(async () => true),
+    dispatch: vi.fn(),
+    cancelTurn: vi.fn(async () => ({ cancelled: true })),
+    answerPrompt: vi.fn(async ({ commit }) => commit()),
+    setOption: vi.fn(async () => undefined)
+  }
+  store = await AgentSessionRecordStore.open({ directory: join(root, 'store'), hostId: 'local' })
+  host = new StructuredAgentSessionHost({
+    store,
+    adapter,
+    journalRoot: root,
+    claimKeyId: 'key-1',
+    mintSpawnToken: () => 'spawn-a',
+    // Every write lands on its own millisecond, as it does live.
+    now: () => (clock += 1)
+  })
+  expect((await host.attach(CALLER, hostTestAttachParams(null))).ok).toBe(true)
+  const page = await host.history({ sessionId: SESSION, direction: 'tail' })
+  if (!page.ok) {
+    throw new Error('no history page')
+  }
+  client = reduceStructuredAgentSession(EMPTY_STRUCTURED_AGENT_SESSION, {
+    type: 'history-page',
+    page: page.page
+  })
+  host.subscribe({
+    id: 'client',
+    sessionId: SESSION,
+    cursor: page.page.liveCursor ?? page.page.window.nextCursor,
+    emit: (event) => {
+      client = reduceStructuredAgentSession(client, { type: 'event', event })
+    }
+  })
+})
+
+afterEach(async () => {
+  await host.flushAllStreamedEvents()
+  await rm(root, { recursive: true, force: true })
+})
+
+function codexPrompts(): CodexJournalPrompts {
+  if (!sink) {
+    throw new Error('session was never acquired')
+  }
+  return new CodexJournalPrompts(
+    { sink, linkageFor: () => ({}) },
+    () => null,
+    () => 'turn-1'
+  )
+}
+
+async function ask(prompts: CodexJournalPrompts, asked: Asked = ASKED): Promise<void> {
+  prompts.handle({
+    threadId: THREAD,
+    method: CODEX_USER_INPUT_METHOD,
+    codexItemId: 'codex-item-1',
+    promptKey: '7',
+    params: {
+      threadId: THREAD,
+      turnId: 'turn-1',
+      questions: asked.map((question) => ({
+        ...question,
+        options: [
+          { label: 'Yes', description: '' },
+          { label: 'No', description: '' }
+        ]
+      }))
+    }
+  })
+  await host.flushStreamedEvents(SESSION)
+}
+
+function questionItem(question: string): AgentJournalRenderItem {
+  const item = client.items.find(
+    (candidate) => candidate.body.kind === 'question' && candidate.body.question === question
+  )
+  if (!item || item.body.kind !== 'question') {
+    throw new Error(`no journal item for ${question}`)
+  }
+  return item
+}
+
+async function answer(question: string): Promise<void> {
+  const item = questionItem(question)
+  if (item.body.kind !== 'question') {
+    return
+  }
+  const fields = {
+    itemId: item.itemId,
+    expectedRevision: item.revision,
+    optionId: item.body.options[0]!.id
+  }
+  const result = await host.respondToPrompt(CALLER, {
+    envelope: {
+      sessionId: SESSION,
+      clientOperationId: hostTestOperationId(),
+      expectedRuntimeFence: store.getRecord(SESSION)?.lease.runtimeFence ?? 1,
+      payloadFingerprint: computeAgentSessionPayloadFingerprint({
+        method: 'agentSession.respondTo:question',
+        sessionId: SESSION,
+        fields
+      })
+    },
+    kind: 'question',
+    ...fields
+  })
+  expect(result.ok).toBe(true)
+  await host.flushStreamedEvents(SESSION)
+}
+
+/** The prompt rows the transcript list draws, top to bottom, as the questions each one shows. */
+function drawnPromptRows(): string[][] {
+  const { receipts } = structuredQuestionTranscript(client.items)
+  // The desktop list's projection: its comparator adds only a rank for rows the host never writes.
+  const rows = projectNativeChatTranscriptMessages(
+    projectStructuredAgentSessionMessages(
+      client.items,
+      [],
+      client.submissions,
+      projectStructuredQuestionMessages
+    )
+  )
+  return rows.flatMap((row) => {
+    const prompt = receipts.get(row.id)
+    if (!prompt || prompt.kind !== 'question') {
+      return []
+    }
+    const questions = prompt.questions?.length ? prompt.questions : [prompt]
+    return [questions.map(({ question }) => `${question} (${prompt.resolution.state})`)]
+  })
+}
+
+describe('a Codex ask with several questions', () => {
+  it('keeps the pending rest of the ask below the question already answered', async () => {
+    await ask(codexPrompts())
+    await answer(ASKED[0]!.question)
+
+    expect(drawnPromptRows()).toEqual([
+      ['Which files are in scope? (resolved)'],
+      ['What matters most? (pending)', 'When is it due? (pending)']
+    ])
+  })
+
+  it('draws every answered question in the order Codex asked it', async () => {
+    await ask(codexPrompts())
+    for (const { question } of ASKED) {
+      await answer(question)
+    }
+
+    expect(drawnPromptRows()).toEqual([
+      ['Which files are in scope? (resolved)'],
+      ['What matters most? (resolved)'],
+      ['When is it due? (resolved)']
+    ])
+    // Mobile draws the shared projection in journal order, one row per question.
+    expect(
+      projectStructuredAgentSessionMessages(client.items, [], client.submissions).map(
+        ({ blocks }) => (blocks[0]?.type === 'text' ? blocks[0].text.split('\n')[0] : null)
+      )
+    ).toEqual(ASKED.map(({ question }) => question))
+  })
+
+  it('draws a cancelled ask in the order Codex asked it', async () => {
+    const prompts = codexPrompts()
+    await ask(prompts, ASKED_OUT_OF_ORDER)
+    prompts.cancel(questionItem(ASKED_OUT_OF_ORDER[0]!.question).itemId)
+    await host.flushStreamedEvents(SESSION)
+
+    expect(drawnPromptRows()).toEqual([
+      ['Which format? (cancelled)'],
+      ['Who reads it? (cancelled)'],
+      ['How long? (cancelled)']
+    ])
+  })
+})
diff --git a/src/main/codex/codex-structured-session-acquire.ts b/src/main/codex/codex-structured-session-acquire.ts
index 2ce13d212505..b7262ea6fee2 100644
--- a/src/main/codex/codex-structured-session-acquire.ts
+++ b/src/main/codex/codex-structured-session-acquire.ts
@@ -13,7 +13,10 @@ import { CodexSubagentExecutions } from './codex-subagent-executions'
 import { createCodexDispatchEchoes } from './codex-structured-dispatch-echo'
 import { createCodexJournalTranslator } from './codex-structured-journal-translation'
 import { openCodexAppServerConnection } from './codex-app-server-connection'
-import { codexProcessIdentity, codexProviderHandleLink } from './codex-structured-owner-identity'
+import {
+  codexProviderHandleLink,
+  codexSpawnedProcessIdentity
+} from './codex-structured-owner-identity'
 import { buildCodexStructuredChildEnvironment } from './codex-structured-child-environment'
 import { openCodexThread } from './codex-structured-thread-open'
 import {
@@ -106,6 +109,7 @@ export async function acquireCodexStructuredSession(input: {
       })
     : null
   const open = deps.openConnection ?? openCodexAppServerConnection
+  const spawnIdentity = codexSpawnedProcessIdentity(acquireInput, deps.readProcessStartTime)
   try {
     await stopSupersededCodexAcquisition({
       sessionId,
@@ -165,6 +169,7 @@ export async function acquireCodexStructuredSession(input: {
             () => input.handleUnhandledFrame(sessionId, kind, payload),
             Buffer.byteLength(JSON.stringify(payload ?? null), 'utf8')
           ),
+        onSpawned: spawnIdentity.onSpawned,
         onExit: (error) => {
           try {
             handleCodexSessionExit({
@@ -198,14 +203,11 @@ export async function acquireCodexStructuredSession(input: {
     primaryThreadId = opened.threadId
     const restoreAdmission = translator?.restoreThread(opened.threadId, opened.thread ?? {})
     if (restoreAdmission && !restoreAdmission.accepted) {
-      throw new AgentSessionAcquisitionRefusal(
+      throw AgentSessionAcquisitionRefusal.historyTooLarge(
         'Codex thread history exceeds the bounded restore queue; history was not partially imported.'
       )
     }
-    const process = await codexProcessIdentity(
-      { ...acquireInput, pid: connection.pid },
-      deps.readProcessStartTime
-    )
+    const process = await spawnIdentity.read(connection.pid)
     acquisitions.assertCurrent(sessionId, attempt)
     const acquired: AgentSessionAcquisition = {
       process,
diff --git a/src/main/codex/codex-structured-session-adapter-lifecycle.test.ts b/src/main/codex/codex-structured-session-adapter-lifecycle.test.ts
index fc458304dc85..bcfd2f733f06 100644
--- a/src/main/codex/codex-structured-session-adapter-lifecycle.test.ts
+++ b/src/main/codex/codex-structured-session-adapter-lifecycle.test.ts
@@ -152,7 +152,7 @@ describe('CodexStructuredSessionAdapter lifecycle', () => {
         sessionId: 'session-2',
         itemId: 'codex-item-1',
         kind: 'approval',
-        optionId: 'accept',
+        response: { kind: 'option', optionId: 'accept' },
         fence: 1,
         commit: async () => undefined
       })
@@ -181,6 +181,7 @@ describe('CodexStructuredSessionAdapter lifecycle', () => {
       type: 'ended',
       sessionId: 'session-1',
       reason: 'codex app-server connection ended',
+      failure: { kind: 'providerExited' },
       cause: 'unexpected-exit',
       fence: 7,
       acquisitionGeneration: 'generation-1',
diff --git a/src/main/codex/codex-structured-session-adapter.test.ts b/src/main/codex/codex-structured-session-adapter.test.ts
index f17003f7e40a..43b76536c64e 100644
--- a/src/main/codex/codex-structured-session-adapter.test.ts
+++ b/src/main/codex/codex-structured-session-adapter.test.ts
@@ -1,4 +1,5 @@
 import { describe, expect, it, vi } from 'vitest'
+import { AgentSessionPromptAnswerRejectedError } from '../native-chat/agent-session-wire/structured-agent-session-adapter'
 import {
   CodexAppServerRequestError,
   type openCodexAppServerConnection
@@ -6,7 +7,6 @@ import {
 import type { StructuredAgentSessionEventSink } from '../native-chat/agent-session-wire/structured-agent-session-event-sink'
 import { CODEX_SPAWN_TOKEN_ENV } from './codex-structured-owner-identity'
 import { ORCA_STRUCTURED_SESSION_ENV } from '../../shared/structured-session-marker'
-import { encodeCodexQuestionOptionId } from './codex-structured-prompt-replies'
 import {
   CodexStructuredSessionAdapter,
   type CodexStructuredLaunch,
@@ -58,6 +58,20 @@ describe('CodexStructuredSessionAdapter.acquire', () => {
     expect(acquisition.acquisitionGeneration).toBe('generation-1')
   })
 
+  // A thread opened on Codex's configured default and then given a turn on the chosen model
+  // reads to Codex as a model switch, and it injects the chosen model's whole prompt again.
+  it('opens the thread on the model the session chose, not on the configured default', async () => {
+    const codex = fakeCodex()
+    const adapter = adapterFor(codex, { model: 'gpt-chosen' })
+
+    await adapter.acquire({ identity: identityFor('session-1'), fence: 7, spawnToken: 'spawn-9' })
+
+    expect(codex.connections[0].calls[0]).toEqual({
+      method: 'thread/start',
+      params: { cwd: '/work/repo', model: 'gpt-chosen' }
+    })
+  })
+
   it('resumes the thread the durable handle chain names, not the client one', async () => {
     const codex = fakeCodex()
     const adapter = adapterFor(codex, {
@@ -174,7 +188,7 @@ describe('CodexStructuredSessionAdapter.acquire', () => {
       sessionId: 'session-1',
       itemId: 'codex-item-early',
       kind: 'approval',
-      optionId: 'accept',
+      response: { kind: 'option', optionId: 'accept' },
       fence: 7,
       commit: async () => undefined
     })
@@ -452,7 +466,12 @@ describe('CodexStructuredSessionAdapter.dispatch', () => {
         body: USER_MESSAGE,
         fence: 7
       })
-    ).toEqual({ state: 'rejected', reason: 'turn already running' })
+    ).toEqual({
+      // Built without Codex's own words, so nothing is quoted and no detail is invented.
+      state: 'rejected',
+      reason: 'The provider did not accept this message.',
+      rejection: { kind: 'providerRejected' }
+    })
   })
 
   it('rethrows a dead child so the wire settles the submission unknown', async () => {
@@ -535,7 +554,7 @@ describe('CodexStructuredSessionAdapter prompts', () => {
       sessionId: 'session-1',
       itemId: 'codex:thread-abc:turn-1:3',
       kind: 'approval',
-      optionId: 'accept',
+      response: { kind: 'option', optionId: 'accept' },
       fence: 7,
       commit: async () => undefined
     })
@@ -548,7 +567,7 @@ describe('CodexStructuredSessionAdapter prompts', () => {
         sessionId: 'session-1',
         itemId: 'codex:thread-abc:turn-1:3',
         kind: 'approval',
-        optionId: 'decline',
+        response: { kind: 'option', optionId: 'decline' },
         fence: 7,
         commit: async () => undefined
       })
@@ -589,7 +608,7 @@ describe('CodexStructuredSessionAdapter prompts', () => {
         sessionId: 'session-1',
         itemId: 'codex-item-1',
         kind: 'approval',
-        optionId: 'accept',
+        response: { kind: 'option', optionId: 'accept' },
         fence: 7,
         commit: async () => undefined
       })
@@ -676,7 +695,7 @@ describe('CodexStructuredSessionAdapter prompts', () => {
         sessionId: 'session-1',
         itemId,
         kind: 'approval',
-        optionId,
+        response: { kind: 'option', optionId },
         fence: 7,
         commit: async () => undefined
       })
@@ -697,17 +716,20 @@ describe('CodexStructuredSessionAdapter prompts', () => {
     const adapter = await acquired(codex)
 
     askApproval(codex)
+    const commit = vi.fn(async () => undefined)
 
     await expect(
       adapter.answerPrompt({
         sessionId: 'session-1',
         itemId: 'codex-item-1',
         kind: 'approval',
-        optionId: 'yolo',
+        response: { kind: 'option', optionId: 'yolo' },
         fence: 7,
-        commit: async () => undefined
+        commit
       })
-    ).rejects.toThrow('is not a Codex approval decision')
+    ).rejects.toThrow(AgentSessionPromptAnswerRejectedError)
+    // Refused before the journal records an answer the agent never receives.
+    expect(commit).not.toHaveBeenCalled()
     expect(codex.connections[0].replies).toEqual([])
   })
 
@@ -732,7 +754,7 @@ describe('CodexStructuredSessionAdapter prompts', () => {
       sessionId: 'session-1',
       itemId: 'codex-item-2',
       kind: 'question',
-      optionId: encodeCodexQuestionOptionId('q1', 'yes'),
+      response: { kind: 'answers', answers: [{ questionId: 'q1', optionIds: [], other: 'yes' }] },
       fence: 7,
       commit: async () => undefined
     })
@@ -742,7 +764,7 @@ describe('CodexStructuredSessionAdapter prompts', () => {
       sessionId: 'session-1',
       itemId: 'codex-item-2',
       kind: 'question',
-      optionId: encodeCodexQuestionOptionId('q2', 'no'),
+      response: { kind: 'answers', answers: [{ questionId: 'q2', optionIds: [], other: 'no' }] },
       fence: 7,
       commit: async () => undefined
     })
@@ -778,7 +800,7 @@ describe('CodexStructuredSessionAdapter prompts', () => {
         sessionId: 'session-1',
         itemId: 'codex-item-gone',
         kind: 'approval',
-        optionId: 'accept',
+        response: { kind: 'option', optionId: 'accept' },
         fence: 7,
         commit: async () => undefined
       })
diff --git a/src/main/codex/codex-structured-session-adapter.ts b/src/main/codex/codex-structured-session-adapter.ts
index b9affd8bd003..68cdbd593298 100644
--- a/src/main/codex/codex-structured-session-adapter.ts
+++ b/src/main/codex/codex-structured-session-adapter.ts
@@ -257,12 +257,16 @@ export class CodexStructuredSessionAdapter implements StructuredAgentSessionAdap
             { threadId: session.threadId },
             { timeoutMs: this.deps.requestTimeoutMs }
           )
-          .catch((error) => {
-            if (isCodexAppServerRequestError(error)) {
-              return { error: error.message }
+          .then(
+            () => undefined,
+            (error) => {
+              if (isCodexAppServerRequestError(error)) {
+                const detail = error.providerDiagnostic
+                return { outcome: 'failed' as const, ...(detail ? { detail } : {}) }
+              }
+              throw error
             }
-            throw error
-          })
+          )
       },
       input.onLateResult,
       input.turnId
@@ -277,7 +281,8 @@ export class CodexStructuredSessionAdapter implements StructuredAgentSessionAdap
       this.deps.requestTimeoutMs
     )
 
-  supportsThreadGoal = (sessionId: string): boolean => this.sessions.has(sessionId)
+  // Provider-level: a goal change at rest starts the agent first.
+  supportsThreadGoal = (): boolean => true
 
   answerPrompt: StructuredAgentSessionAdapter['answerPrompt'] = (request) =>
     answerCodexStructuredPrompt({ request, sessions: this.sessions })
diff --git a/src/main/codex/codex-structured-session-close.test.ts b/src/main/codex/codex-structured-session-close.test.ts
index 17f3aecf6717..dffa7157dd61 100644
--- a/src/main/codex/codex-structured-session-close.test.ts
+++ b/src/main/codex/codex-structured-session-close.test.ts
@@ -125,10 +125,7 @@ describe('Codex structured session close lifecycle', () => {
     expect(clearPrompts).toHaveBeenCalledOnce()
     expect(onEvent).toHaveBeenCalledOnce()
     expect(translator.dispose).toHaveBeenCalledOnce()
-    expect(onEvent.mock.calls[0]?.[0]).toMatchObject({
-      cause: 'unexpected-exit',
-      settlementRetryRequired: true
-    })
+    expect(onEvent.mock.calls[0]?.[0]).toMatchObject({ cause: 'unexpected-exit' })
     expect(translator.handle).toHaveBeenCalledOnce()
   })
 
diff --git a/src/main/codex/codex-structured-session-close.ts b/src/main/codex/codex-structured-session-close.ts
index 1ed8dcd385ce..56e1855c60f3 100644
--- a/src/main/codex/codex-structured-session-close.ts
+++ b/src/main/codex/codex-structured-session-close.ts
@@ -1,3 +1,4 @@
+import { agentSessionFailureFact, providerDiagnosticOf } from '../../shared/agent-session-failure'
 import type { CodexAppServerConnection } from './codex-app-server-connection-types'
 import { closeProcessRegistry } from '../../shared/child-process/close-process-registry'
 import {
@@ -14,6 +15,9 @@ export function handleCodexSessionExit(input: {
   sessionId: string
   connection: CodexAppServerConnection | null
   error: Error
+  /** Set by Orca's own close. Absent only from the connection's onExit, which the connection
+   *  withholds while Orca is closing the child. */
+  closedByOrca?: true
   prompts?: CodexSession['prompts']
   allowFailedSettlement?: boolean
   onEvent?: (event: CodexStructuredSessionEvent) => void
@@ -29,22 +33,22 @@ export function handleCodexSessionExit(input: {
     type: 'ended',
     sessionId: input.sessionId,
     reason: input.error.message,
+    // Only the child's own exit blames Codex; a close Orca made, for any reason, is Orca's.
+    failure: input.closedByOrca
+      ? agentSessionFailureFact('hostFault')
+      : agentSessionFailureFact('providerExited', { detail: providerDiagnosticOf(input.error) }),
     cause: session.requestedClose ? 'requested-close' : 'unexpected-exit',
     fence: session.fence,
     acquisitionGeneration: session.acquisitionGeneration,
     observedAt: session.exitObservedAt
   } as const
-  // A synchronous sink rejection (usually backpressure) is handed to host
-  // recovery, which appends the bounded fallback before reacquisition.
+  // A synchronous sink rejection (usually backpressure) leaves the terminal rows to the host's
+  // exit settlement, which writes its own bounded fallback.
   const admission = session.translator?.handle(event) ?? { accepted: true }
-  if (!admission.accepted) {
-    // The connection invokes onExit exactly once. Forward a flagged event so
-    // host recovery can append its no-new-blob fallback even when admission is
-    // backpressured; waiting for a second callback would strand the lease.
-    if (event.cause !== 'unexpected-exit' && !input.allowFailedSettlement) {
-      return false
-    }
-    event.settlementRetryRequired = true
+  // The connection invokes onExit exactly once, so an unexpected exit is forwarded even when
+  // admission is backpressured; waiting for a second callback would strand the lease.
+  if (!admission.accepted && event.cause !== 'unexpected-exit' && !input.allowFailedSettlement) {
+    return false
   }
   session.ended = true
   // Nothing can echo for this child any more; the journal's pending-submission
@@ -97,6 +101,7 @@ export async function closeCodexPublishedSession(
       sessionId,
       connection: session.connection,
       error: options?.unexpectedReason ?? new Error('codex session closed'),
+      closedByOrca: true,
       prompts: session.prompts,
       ...(options?.allowFailedSettlement ? { allowFailedSettlement: true } : {}),
       ...(onEvent ? { onEvent } : {})
diff --git a/src/main/codex/codex-structured-session-exit-blame.test.ts b/src/main/codex/codex-structured-session-exit-blame.test.ts
new file mode 100644
index 000000000000..591f0e61ae8f
--- /dev/null
+++ b/src/main/codex/codex-structured-session-exit-blame.test.ts
@@ -0,0 +1,68 @@
+// Only the Codex app-server child's own exit says Codex stopped; a close Orca made — a journal
+// sink that could not take a frame, a forced close — is Orca's.
+
+import { describe, expect, it, vi } from 'vitest'
+import { agentSessionFailureWords } from '../../shared/agent-session-failure-words'
+import type { StructuredAgentSessionEventSink } from '../native-chat/agent-session-wire/structured-agent-session-event-sink'
+import { adapterFor, fakeCodex, identityFor } from './codex-structured-session-adapter-fixture'
+import type { CodexStructuredSessionEvent } from './codex-structured-session-state'
+
+function sink(overrides: Partial<StructuredAgentSessionEventSink> = {}) {
+  return { appendItem: vi.fn(), appendTombstone: vi.fn(), publish: vi.fn(), ...overrides }
+}
+
+async function startedCodex(events: StructuredAgentSessionEventSink) {
+  const codex = fakeCodex()
+  const emitted: CodexStructuredSessionEvent[] = []
+  const adapter = adapterFor(codex, {}, emitted)
+  await adapter.acquire({ identity: identityFor('session-1'), fence: 7, spawnToken: 's', events })
+  const ended = async () => {
+    await vi.waitFor(() => expect(emitted.some((event) => event.type === 'ended')).toBe(true))
+    return emitted.filter((event) => event.type === 'ended')
+  }
+  return { adapter, connection: codex.connections[0], ended }
+}
+
+describe('what a started Codex session says ended it', () => {
+  it('says Codex stopped when the child exits on its own', async () => {
+    const { connection, ended } = await startedCodex(sink())
+
+    connection.handlers.onExit?.(new Error('codex app-server connection ended: killed'))
+
+    const [event] = await ended()
+    expect(event).toMatchObject({ cause: 'unexpected-exit', failure: { kind: 'providerExited' } })
+    const failure = event && 'failure' in event ? event.failure : undefined
+    expect(
+      failure && agentSessionFailureWords(failure, { surface: 'row', agentName: 'Codex' }).text
+    ).toBe(
+      'Codex stopped while this response was in progress. You can continue in this conversation.'
+    )
+  })
+
+  it('blames Orca when a journal sink failure makes Orca close the child', async () => {
+    const { connection, ended } = await startedCodex(
+      sink({ tryAppendItem: () => ({ accepted: false, reason: 'failed' }) })
+    )
+
+    connection.handlers.onUnhandledFrame?.('frame:invalid-json', '{')
+
+    expect(await ended()).toMatchObject([
+      {
+        reason: 'Codex provider frame frame:invalid-json could not be durably recorded (failed)',
+        cause: 'unexpected-exit',
+        failure: { kind: 'hostFault' }
+      }
+    ])
+    expect(connection.closeCount).toBe(1)
+  })
+
+  it('blames Orca for a forced close', async () => {
+    const { adapter, ended } = await startedCodex(sink())
+
+    await expect(adapter.forceCloseSession('session-1')).resolves.toBe(true)
+
+    expect(await ended()).toMatchObject([
+      { cause: 'unexpected-exit', failure: { kind: 'hostFault' } }
+    ])
+  })
+})
diff --git a/src/main/codex/codex-structured-session-state.ts b/src/main/codex/codex-structured-session-state.ts
index b5e4796d21d9..f4828b7df682 100644
--- a/src/main/codex/codex-structured-session-state.ts
+++ b/src/main/codex/codex-structured-session-state.ts
@@ -34,6 +34,8 @@ export type CodexStructuredLaunch = {
    *  rollout for it, start a new thread in its place. Never set for a thread a resume proved. */
   supersedeIfUnsaved?: boolean
   permissionPolicy?: CodexStructuredPermissionPolicy
+  /** The model the session chose; the thread opens on it so its first turn is not a switch. */
+  model?: string
   env?: Record<string, string>
 }
 
diff --git a/src/main/codex/codex-structured-thread-open.test.ts b/src/main/codex/codex-structured-thread-open.test.ts
index b819a0dc6b21..fede869a83c9 100644
--- a/src/main/codex/codex-structured-thread-open.test.ts
+++ b/src/main/codex/codex-structured-thread-open.test.ts
@@ -261,6 +261,29 @@ describe('openCodexThread', () => {
       )
     })
 
+    it('opens the replacement thread on the chosen model', async () => {
+      const request = codexWithoutRollout()
+
+      await openCodexThread(
+        connectionFor(request),
+        {
+          cwd: '/workspace',
+          resumeThreadId: 'thread-unsaved',
+          supersedeIfUnsaved: true,
+          model: 'gpt-chosen'
+        },
+        2_000
+      )
+
+      // A resume keeps the thread's own saved model, provider and effort, which naming one skips.
+      expect(request.mock.calls[0]?.[1]).not.toHaveProperty('model')
+      expect(request).toHaveBeenLastCalledWith(
+        'thread/start',
+        { cwd: '/workspace', model: 'gpt-chosen' },
+        { timeoutMs: 2_000 }
+      )
+    })
+
     it('keeps the resume failure for a thread a resume already proved', async () => {
       const request = codexWithoutRollout()
 
diff --git a/src/main/codex/codex-structured-thread-open.ts b/src/main/codex/codex-structured-thread-open.ts
index 83cd710e1360..0f8b530d6240 100644
--- a/src/main/codex/codex-structured-thread-open.ts
+++ b/src/main/codex/codex-structured-thread-open.ts
@@ -90,14 +90,18 @@ export async function openCodexThread(
     resumePath?: string | null
     supersedeIfUnsaved?: boolean
     permissionPolicy?: CodexStructuredPermissionPolicy
+    /** Why: Codex renders a thread's base instructions for its opening model; a first turn on
+     *  another model reads as a mid-conversation switch and injects a second full prompt. */
+    model?: string
   },
   timeoutMs: number | undefined
 ): Promise<CodexOpenedThread> {
   const resumeThreadId = launch.resumeThreadId
+  const threadSettings = { cwd: launch.cwd, ...launch.permissionPolicy }
   const startThread = (): Promise<unknown> =>
     connection.request(
       'thread/start',
-      { cwd: launch.cwd, ...launch.permissionPolicy },
+      { ...threadSettings, ...(launch.model ? { model: launch.model } : {}) },
       { timeoutMs }
     )
   let supersededThreadId: string | undefined
@@ -105,10 +109,10 @@ export async function openCodexThread(
   if (!resumeThreadId) {
     opened = await startThread()
   } else {
+    // No model: naming one makes Codex skip the thread's saved model, provider and effort.
     const resumeParams = {
       threadId: resumeThreadId,
-      cwd: launch.cwd,
-      ...launch.permissionPolicy,
+      ...threadSettings,
       ...(launch.resumePath ? { path: launch.resumePath } : {})
     }
     try {
diff --git a/src/main/codex/codex-structured-turn-start.ts b/src/main/codex/codex-structured-turn-start.ts
index 2d22ce42f3ef..0c46969d62f8 100644
--- a/src/main/codex/codex-structured-turn-start.ts
+++ b/src/main/codex/codex-structured-turn-start.ts
@@ -1,3 +1,10 @@
+import { agentSessionFailureFact, providerDiagnosticOf } from '../../shared/agent-session-failure'
+import {
+  agentSessionFailureWords,
+  type AgentJournalDispatchRejection
+} from '../../shared/agent-session-failure-words'
+import type { SubmissionRejectionFact } from '../../shared/agent-session-failure'
+import { TUI_AGENT_DISPLAY_NAMES } from '../../shared/tui-agent-display-names'
 import type { AgentJournalMessageItem } from '../../shared/agent-session-journal-types'
 import type { NativeChatBlock } from '../../shared/native-chat-types'
 import type { AgentSessionDispatchOutcome } from '../native-chat/agent-session-wire/structured-agent-session-adapter'
@@ -7,7 +14,6 @@ import {
 } from './codex-app-server-connection'
 import { isCodexAppServerUnsupportedError } from './codex-app-server-session'
 import type { CodexDispatchEchoes } from './codex-structured-dispatch-echo'
-import { DISPATCH_REJECTED_CODEX_QUEUE_FULL } from '../../shared/structured-agent-session-dispatch-rejection'
 import { decodeStructuredAgentSessionOptionValue } from '../../shared/structured-agent-session-option-codec'
 
 // Writing a Codex turn and learning which message landed where, which are not
@@ -115,6 +121,15 @@ export async function startCodexTurn(
   return true
 }
 
+/** A message Codex rejected, in the words that name Codex and its legacy markers. */
+function codexDispatchRejection(failure: SubmissionRejectionFact): AgentJournalDispatchRejection {
+  return agentSessionFailureWords(failure, {
+    surface: 'rejection',
+    agentName: TUI_AGENT_DISPLAY_NAMES.codex,
+    provider: 'codex'
+  })
+}
+
 /**
  * One submission's outcome as the wire must read it: admitted means Codex owns
  * the message and its identity settles on the echo, rejected is Codex answering
@@ -128,13 +143,19 @@ export async function dispatchCodexTurn(
 ): Promise<AgentSessionDispatchOutcome> {
   try {
     if (!(await startCodexTurn(session, { ...input, timeoutMs }))) {
-      return { state: 'rejected', reason: DISPATCH_REJECTED_CODEX_QUEUE_FULL }
+      return { state: 'rejected', ...codexDispatchRejection(agentSessionFailureFact('queueFull')) }
     }
   } catch (error) {
     if (isCodexAppServerRequestError(error) || isCodexAppServerUnsupportedError(error)) {
       // Codex answered and declined, so no echo for this write can arrive.
       session.dispatchEchoes.disarm(input.clientMessageId)
-      return { state: 'rejected', reason: (error as Error).message }
+      // Codex's own words, when it gave any, are the one part of the error a person can use.
+      return {
+        state: 'rejected',
+        ...codexDispatchRejection(
+          agentSessionFailureFact('providerRejected', { detail: providerDiagnosticOf(error) })
+        )
+      }
     }
     // A timeout or transport failure can happen after the frame was written.
     // Keep the correlation armed so a later echo can prove delivery.
diff --git a/src/main/codex/config-settings-baseline.ts b/src/main/codex/config-settings-baseline.ts
index 5cc26e361b9b..d6c44909ef89 100644
--- a/src/main/codex/config-settings-baseline.ts
+++ b/src/main/codex/config-settings-baseline.ts
@@ -21,6 +21,9 @@ export type CodexSettingsBaseline = {
    * table reads as an addition rather than as a canonical removal.
    */
   registrations: ReadonlyMap<string, ReadonlyMap<string, string>>
+  /** MCP server names the last mirror copied from the canonical source. */
+  mcpServers: ReadonlySet<string>
+  mcpServerRoot: boolean
 }
 
 type StoredSettingsBaseline = {
@@ -28,6 +31,8 @@ type StoredSettingsBaseline = {
   settings: Record<string, string | null>
   conflicts?: Record<string, CodexSettingsConflict>
   registrations?: Record<string, Record<string, string>>
+  mcpServers?: string[]
+  mcpServerRoot?: boolean
 }
 
 /**
@@ -81,7 +86,14 @@ function readParsedCodexSettingsBaseline(
         conflicts.set(key, conflict)
       }
     }
-    return { settings, conflicts, registrations: readStoredRegistrations(parsed.registrations) }
+    return {
+      settings,
+      conflicts,
+      registrations: readStoredRegistrations(parsed.registrations),
+      mcpServers: readStoredMcpServers(parsed.mcpServers),
+      // Older mirrors owned the whole MCP root; retain that removal policy for one pass.
+      mcpServerRoot: parsed.mcpServers === undefined || parsed.mcpServerRoot === true
+    }
   } catch (error) {
     // Why: invalid baseline state is still `null` — resetting it is the intent,
     // and only a read that FAILED must be preserved.
@@ -89,6 +101,10 @@ function readParsedCodexSettingsBaseline(
   }
 }
 
+function readStoredMcpServers(stored: string[] | undefined): ReadonlySet<string> {
+  return new Set((stored ?? []).filter((name): name is string => typeof name === 'string'))
+}
+
 function readStoredRegistrations(
   stored: Record<string, Record<string, string>> | undefined
 ): Map<string, ReadonlyMap<string, string>> {
@@ -124,7 +140,8 @@ export function writeCodexSettingsBaseline(
 ): void {
   const file: StoredSettingsBaseline = {
     version: 3,
-    settings: Object.fromEntries(baseline.settings)
+    settings: Object.fromEntries(baseline.settings),
+    mcpServers: [...baseline.mcpServers]
   }
   if (baseline.conflicts.size > 0) {
     file.conflicts = Object.fromEntries(baseline.conflicts)
@@ -134,6 +151,9 @@ export function writeCodexSettingsBaseline(
       [...baseline.registrations].map(([key, fields]) => [key, Object.fromEntries(fields)])
     )
   }
+  if (baseline.mcpServerRoot) {
+    file.mcpServerRoot = true
+  }
   const baselinePath = getCodexSettingsBaselinePath(runtimeHomePath)
   const serialized = `${JSON.stringify(file, null, 2)}\n`
   let existing: string | null = null
diff --git a/src/main/codex/config-settings-promotion.test.ts b/src/main/codex/config-settings-promotion.test.ts
index e12d9168b002..fc99f300c1eb 100644
--- a/src/main/codex/config-settings-promotion.test.ts
+++ b/src/main/codex/config-settings-promotion.test.ts
@@ -17,6 +17,12 @@ import type * as Os from 'node:os'
 import { join } from 'node:path'
 import type * as CodexFsUtils from '../codex-accounts/fs-utils'
 
+// Why: temp homes exceed sun_path on macOS but not on Linux; keep asserted config bytes host-independent.
+vi.mock('./codex-daemon-socket-path-guard', async (importOriginal) => ({
+  ...(await importOriginal<object>()),
+  applyCodexDaemonSocketGuard: (config: string) => config
+}))
+
 const { homedirMock, promotionTestState } = vi.hoisted(() => ({
   homedirMock: vi.fn<() => string>(),
   promotionTestState: { failAtomicWrite: false, atomicWritePaths: [] as string[] }
diff --git a/src/main/codex/config-settings-promotion.ts b/src/main/codex/config-settings-promotion.ts
index 52f4d6eefcd0..56e499a6c186 100644
--- a/src/main/codex/config-settings-promotion.ts
+++ b/src/main/codex/config-settings-promotion.ts
@@ -37,6 +37,9 @@ export type CodexSettingsBaselineSnapshotOptions = {
    * mirrored would read a source config that never had them as a removal.
    */
   mirroredRegistrations?: boolean
+  /** Names copied from the canonical source in this mirror pass. */
+  mirroredMcpServers?: ReadonlySet<string>
+  mirroredMcpServerRoot?: boolean
 }
 
 /**
@@ -71,7 +74,9 @@ export function snapshotCodexRuntimeSettingsBaseline(
       conflicts,
       registrations: options.mirroredRegistrations
         ? readCodexRegistrationBaseline(runtimeConfig)
-        : new Map()
+        : new Map(),
+      mcpServers: options.mirroredMcpServers ?? new Set(),
+      mcpServerRoot: options.mirroredMcpServerRoot ?? false
     })
   } catch (error) {
     console.warn('[codex-settings-promotion] failed to snapshot settings baseline', error)
@@ -88,6 +93,9 @@ export type CodexSettingsPromotionHomes = {
 export type CodexSettingsPromotionPlan = {
   conflicts: ReadonlyMap<string, CodexSettingsConflict>
   runtimeValuesToPreserve: ReadonlyMap<string, string | null>
+  /** MCP names the previous mirror copied from the canonical source. */
+  mirroredMcpServers: ReadonlySet<string>
+  mirroredMcpServerRoot: boolean
 }
 
 function getHostPromotionHomes(): CodexSettingsPromotionHomes {
@@ -142,6 +150,8 @@ function promoteCodexRuntimeSettingsToSystemUnsafe(
     throw new Error('Codex settings baseline could not be read')
   }
   const baseline = baselineObservation.kind === 'present' ? baselineObservation.baseline : null
+  const mirroredMcpServers = baseline?.mcpServers ?? new Set<string>()
+  const mirroredMcpServerRoot = baseline?.mcpServerRoot ?? false
   const updates = new Map<string, string>()
   const conflicts = new Map<string, CodexSettingsConflict>()
   const runtimeValuesToPreserve = new Map<string, string | null>()
@@ -160,7 +170,7 @@ function promoteCodexRuntimeSettingsToSystemUnsafe(
   // canonical is an addition, never a removal it must honor. Scalars still need a
   // real baseline, so they stay gated above.
   if (updates.size === 0 && !hasCodexRegistrationEntries(runtimeTomlObservation.value)) {
-    return { conflicts, runtimeValuesToPreserve }
+    return { conflicts, runtimeValuesToPreserve, mirroredMcpServers, mirroredMcpServerRoot }
   }
   // Why: a fresh host has no ~/.codex; create it owner-only (holds auth.json) or the atomic write ENOENTs and the mirror wipes it.
   mkdirSync(systemHomePath, { recursive: true, mode: 0o700 })
@@ -202,17 +212,17 @@ function promoteCodexRuntimeSettingsToSystemUnsafe(
     )
   )
   if (nextContent === systemContent) {
-    return { conflicts, runtimeValuesToPreserve }
+    return { conflicts, runtimeValuesToPreserve, mirroredMcpServers, mirroredMcpServerRoot }
   }
   if (targetExists && parseWslUncPath(writeTarget.path)) {
     // Why: \\wsl$ 9P symlink metadata is unreliable; write through the existing file to preserve the WSL-side inode.
     writeFileSync(writeTarget.path, nextContent, 'utf-8')
-    return { conflicts, runtimeValuesToPreserve }
+    return { conflicts, runtimeValuesToPreserve, mirroredMcpServers, mirroredMcpServerRoot }
   }
   writeFileAtomically(writeTarget.path, nextContent, {
     mode: writeTarget.mode
   })
-  return { conflicts, runtimeValuesToPreserve }
+  return { conflicts, runtimeValuesToPreserve, mirroredMcpServers, mirroredMcpServerRoot }
 }
 
 type PromotionCollectionContext = {
@@ -264,7 +274,12 @@ function getComparableRaw(value: TopLevelSettingValue | undefined): string | nul
 }
 
 function emptyPromotionPlan(): CodexSettingsPromotionPlan {
-  return { conflicts: new Map(), runtimeValuesToPreserve: new Map() }
+  return {
+    conflicts: new Map(),
+    runtimeValuesToPreserve: new Map(),
+    mirroredMcpServers: new Set(),
+    mirroredMcpServerRoot: false
+  }
 }
 
 // Why: follow an existing dotfile-manager symlink and carry its mode forward so an atomic write can't widen a 0600 config.
diff --git a/src/main/codex/config-sync-stall.test.ts b/src/main/codex/config-sync-stall.test.ts
index 37c62c105a0e..0a28fb40f0b0 100644
--- a/src/main/codex/config-sync-stall.test.ts
+++ b/src/main/codex/config-sync-stall.test.ts
@@ -10,6 +10,12 @@ import {
 import { syncSystemConfigIntoManagedCodexHome } from './codex-config-mirror'
 import { getCodexSettingsBaselinePath } from './config-settings-baseline'
 
+// Why: temp homes exceed sun_path on macOS but not on Linux; keep asserted config bytes host-independent.
+vi.mock('./codex-daemon-socket-path-guard', async (importOriginal) => ({
+  ...(await importOriginal<object>()),
+  applyCodexDaemonSocketGuard: (config: string) => config
+}))
+
 let root: string
 let homes: { runtimeHomePath: string; systemHomePath: string }
 
diff --git a/src/main/codex/config-sync-stall.ts b/src/main/codex/config-sync-stall.ts
index c209b4d28b81..6971b8d62412 100644
--- a/src/main/codex/config-sync-stall.ts
+++ b/src/main/codex/config-sync-stall.ts
@@ -1,5 +1,6 @@
 import { join } from 'node:path'
 import { observeAgentStateFile } from './codex-path-observation'
+import { isOnlyCodexDaemonOverride } from './codex-daemon-socket-path-guard'
 import { getOrcaManagedCodexHomePath, getSystemCodexHomePath } from './codex-home-paths'
 import {
   getCodexSettingsBaselinePath,
@@ -35,7 +36,12 @@ export function getCodexConfigSyncStatus(
   // report `synced` while the mirror refused its content read — telling the
   // user their edits had been applied when nothing had run.
   const runtimeConfigObservation = observeAgentStateFile(runtimeConfigPath)
-  if (runtimeConfigObservation.kind === 'absent') {
+  // Why: a config holding only Orca's daemon override withholds no user settings.
+  if (
+    runtimeConfigObservation.kind === 'absent' ||
+    (runtimeConfigObservation.kind === 'present' &&
+      isOnlyCodexDaemonOverride(runtimeConfigObservation.value))
+  ) {
     return { state: 'synced', reason: null, systemConfigPath }
   }
   if (runtimeConfigObservation.kind === 'indeterminate') {
diff --git a/src/main/codex/config-toml-line-scan.ts b/src/main/codex/config-toml-line-scan.ts
index 98d096167fe6..0e983aac2dde 100644
--- a/src/main/codex/config-toml-line-scan.ts
+++ b/src/main/codex/config-toml-line-scan.ts
@@ -95,8 +95,18 @@ export function updateTomlLineScanState(state: TomlLineScanState, line: string):
 }
 
 export function getTomlTableHeader(line: string): string | null {
-  const match = /^(\s*\[\[?.+\]\]?\s*)(?:#.*)?$/.exec(line)
-  return match?.[1] ?? null
+  let index = 0
+  while (index < line.length && line[index] !== '#') {
+    if (line[index] === '"') {
+      index = skipTomlBasicString(line, index + 1)
+    } else if (line[index] === "'") {
+      index = skipTomlLiteralString(line, index + 1)
+    } else {
+      index++
+    }
+  }
+  const header = line.slice(0, index).trimEnd()
+  return /^\s*\[\[?.+\]\]?$/.test(header) ? header : null
 }
 
 export function parseTomlSingleLineStringValue(
diff --git a/src/main/codex/config-toml-mcp-servers.test.ts b/src/main/codex/config-toml-mcp-servers.test.ts
new file mode 100644
index 000000000000..e1d577700746
--- /dev/null
+++ b/src/main/codex/config-toml-mcp-servers.test.ts
@@ -0,0 +1,67 @@
+import { describe, expect, it } from 'vitest'
+import { readMcpServerTomlOwnership } from './config-toml-mcp-servers'
+import { getTomlTableHeader } from './config-toml-line-scan'
+
+describe('MCP server TOML ownership', () => {
+  it.each([
+    '[mcp_servers."server.with.dot"]\ncommand = "agent"',
+    '[mcp_servers]\n"server.with.dot" = { command = "agent" }',
+    'mcp_servers."server.with.dot".command = "agent"',
+    '[mcp_servers."server.with.dot".env]\nMODE = "fixture"',
+    '[mcp_servers."server.with.dot"] # see [docs]\ncommand = "agent"',
+    '[mcp_servers."server.with.dot"] # server\r\ncommand = "agent"\r\n',
+    '[[mcp_servers."server.with.dot"]] # array\r\ncommand = "agent"'
+  ])('recognizes the decoded server name in %s', (config) => {
+    expect(readMcpServerTomlOwnership(config)).toEqual({
+      names: new Set(['server.with.dot']),
+      ownsRoot: false
+    })
+  })
+
+  it('treats a root assignment as ownership of the whole closed table', () => {
+    expect(readMcpServerTomlOwnership('"mcp_servers" = { shared = { enabled = false } }')).toEqual({
+      names: new Set(),
+      ownsRoot: true
+    })
+  })
+
+  it.each([
+    '[profile] # comment\r\nmcp_servers = { foo = {} }\r\n',
+    '[profile] # see [docs]\nmcp_servers = { foo = {} }\n',
+    '[not valid]\nmcp_servers = { foo = {} }\n'
+  ])('does not treat a nested assignment as a canonical root in %s', (config) => {
+    expect(readMcpServerTomlOwnership(config)).toEqual({ names: new Set(), ownsRoot: false })
+  })
+
+  it('ignores apparent keys in strings, arrays and unrelated tables', () => {
+    const config = [
+      'description = """',
+      '[mcp_servers.fake]',
+      'mcp_servers = {}',
+      '"""',
+      'args = [',
+      '"mcp_servers.quoted = {}",',
+      ']',
+      '[profile]',
+      'mcp_servers = {}',
+      '[mcp_servers.real]',
+      'command = "agent"'
+    ].join('\n')
+    expect(readMcpServerTomlOwnership(config)).toEqual({
+      names: new Set(['real']),
+      ownsRoot: false
+    })
+  })
+})
+
+describe('commented TOML headers', () => {
+  it.each<[string, string | null]>([
+    ['[mcp_servers."name#with]bracket"] # see [docs]\r', '[mcp_servers."name#with]bracket"]'],
+    ['[[mcp_servers.name]] # comment\r', '[[mcp_servers.name]]'],
+    ["[mcp_servers.'literal#name'] # comment", "[mcp_servers.'literal#name']"],
+    ['# [mcp_servers.fake]', null],
+    ['command = "[mcp_servers.fake]"', null]
+  ])('recognizes the structural header in %s', (line, header) => {
+    expect(getTomlTableHeader(line)).toBe(header)
+  })
+})
diff --git a/src/main/codex/config-toml-mcp-servers.ts b/src/main/codex/config-toml-mcp-servers.ts
new file mode 100644
index 000000000000..12a492a7c882
--- /dev/null
+++ b/src/main/codex/config-toml-mcp-servers.ts
@@ -0,0 +1,42 @@
+import { parseTomlKeyPath, parseTomlTableHeaderPath } from './config-toml-key-path'
+import {
+  createTomlLineScanState,
+  getTomlTableHeader,
+  isTomlStructuralLine,
+  updateTomlLineScanState
+} from './config-toml-line-scan'
+
+/** Canonical inline root assignments own the whole table, which TOML forbids extending. */
+export function readMcpServerTomlOwnership(config: string): {
+  names: ReadonlySet<string>
+  ownsRoot: boolean
+} {
+  const names = new Set<string>()
+  let ownsRoot = false
+  let tablePath: string[] | null = []
+  let state = createTomlLineScanState()
+  for (const line of config.split('\n')) {
+    if (isTomlStructuralLine(state)) {
+      const header = getTomlTableHeader(line)
+      if (header) {
+        tablePath = parseTomlTableHeaderPath(header)?.segments ?? null
+        if (tablePath?.[0] === 'mcp_servers' && tablePath[1] !== undefined) {
+          names.add(tablePath[1])
+        }
+      } else {
+        const key = parseTomlKeyPath(line)
+        const path =
+          tablePath && key && line[key.end] === '=' ? [...tablePath, ...key.segments] : []
+        if (path[0] === 'mcp_servers') {
+          if (path[1] === undefined) {
+            ownsRoot = true
+          } else {
+            names.add(path[1])
+          }
+        }
+      }
+    }
+    state = updateTomlLineScanState(state, line)
+  }
+  return { names, ownsRoot }
+}
diff --git a/src/main/codex/config-toml-runtime-owned-sections.ts b/src/main/codex/config-toml-runtime-owned-sections.ts
index 9e55e9f21728..fee0cfdf6432 100644
--- a/src/main/codex/config-toml-runtime-owned-sections.ts
+++ b/src/main/codex/config-toml-runtime-owned-sections.ts
@@ -1,9 +1,11 @@
+import { stripCodexDaemonOverride } from './codex-daemon-socket-path-guard'
 import {
   createTomlLineScanState,
   getTomlTableHeader,
   isTomlStructuralLine,
   updateTomlLineScanState
 } from './config-toml-line-scan'
+import { parseTomlTableHeaderPath } from './config-toml-key-path'
 import {
   normalizeCodexProjectPathForLookup,
   normalizeCodexProjectPathForRevocationLookup,
@@ -90,6 +92,17 @@ export function isRuntimeProjectTomlSection(header: string): boolean {
   return parseCodexProjectHeaderPath(header) !== null
 }
 
+const CODEX_MCP_SERVER_TABLE_ROOT = 'mcp_servers'
+
+/** Returns the decoded MCP server name for an owner table or nested descendant. */
+export function getMcpServerTomlSectionName(header: string): string | null {
+  const table = parseTomlTableHeaderPath(header)
+  if (!table || table.isArray || table.segments[0] !== CODEX_MCP_SERVER_TABLE_ROOT) {
+    return null
+  }
+  return table.segments[1] ?? null
+}
+
 export function getTomlSectionHeaderKey(header: string): string {
   const projectPath = parseCodexProjectHeaderPath(header)
   return projectPath === null
@@ -160,5 +173,6 @@ export function extractOrdinaryCodexSettings(config: string): string {
       .filter((section) => isRuntimeProjectTomlSection(section.header))
       .map((section) => getTomlSectionHeaderKey(section.header))
   )
-  return stripRuntimeOwnedTomlSections(config, projectHeaders).trimEnd()
+  // Why: the daemon override exists only because Orca's home path is long; ~/.codex is not.
+  return stripCodexDaemonOverride(stripRuntimeOwnedTomlSections(config, projectHeaders)).trimEnd()
 }
diff --git a/src/main/cursor-accounts/status.ts b/src/main/cursor-accounts/status.ts
new file mode 100644
index 000000000000..e2104c36c38e
--- /dev/null
+++ b/src/main/cursor-accounts/status.ts
@@ -0,0 +1,32 @@
+import type { CursorAccountStatus } from '../../shared/rate-limit-types'
+import { readCursorAuthSession } from '../rate-limits/cursor-auth'
+import { isCursorSessionTokenExpired } from '../rate-limits/cursor-session-token'
+
+function signedOut(error: string | null): CursorAccountStatus {
+  return {
+    signedIn: false,
+    email: null,
+    displayName: null,
+    credentialSource: null,
+    planType: null,
+    tokenFresh: false,
+    error
+  }
+}
+
+export async function getCursorAccountStatus(): Promise<CursorAccountStatus> {
+  const readResult = await readCursorAuthSession()
+  if (readResult.status !== 'ok') {
+    return signedOut(readResult.status === 'error' ? readResult.error : null)
+  }
+  const session = readResult.session
+  return {
+    signedIn: true,
+    email: session.email,
+    displayName: session.displayName,
+    credentialSource: session.source,
+    planType: session.membershipType,
+    tokenFresh: !isCursorSessionTokenExpired(session.token),
+    error: null
+  }
+}
diff --git a/src/main/daemon/__fixtures__/freebuff-serialize-baseline.json b/src/main/daemon/__fixtures__/freebuff-serialize-baseline.json
new file mode 100644
index 000000000000..1f35b2abaa05
--- /dev/null
+++ b/src/main/daemon/__fixtures__/freebuff-serialize-baseline.json
@@ -0,0 +1,30 @@
+{
+  "freebuff-lifecycle": [
+    "none/false/2/31:22f0e3d90d75ceaf6fd95853c0b772074e441596caadcea8d133b64bad5db0f6",
+    "none/true/2/31:22f0e3d90d75ceaf6fd95853c0b772074e441596caadcea8d133b64bad5db0f6",
+    "shrink/false/1/29:b5d123b659e7cdd5a3d8c6031529a032d60311b1073e46717d2cbed8d46b6ba4",
+    "shrink/false/2/32:c3408d293abaa4e25303a4d1acf1ea2f096a35ff685e548f98aec777355d10a5",
+    "shrink/false/2/34:6c1dd1d115eb1c2af110cfa30ce84649b206ff48c76bcbcdfa31877d1b918140",
+    "shrink/true/1/29:b5d123b659e7cdd5a3d8c6031529a032d60311b1073e46717d2cbed8d46b6ba4",
+    "shrink/true/2/32:c3408d293abaa4e25303a4d1acf1ea2f096a35ff685e548f98aec777355d10a5",
+    "shrink/true/2/34:6c1dd1d115eb1c2af110cfa30ce84649b206ff48c76bcbcdfa31877d1b918140",
+    "shrink-grow/false/2/33:407f38549bb5be0a2545ba448d21940a201f1cca92e8117e42f3b30907d7d486",
+    "shrink-grow/true/2/33:407f38549bb5be0a2545ba448d21940a201f1cca92e8117e42f3b30907d7d486",
+    "jitter/false/2/34:adbbc27204f00658207075d10787b1ae8d929226d70a5321e029635193dc432b",
+    "jitter/true/2/34:adbbc27204f00658207075d10787b1ae8d929226d70a5321e029635193dc432b"
+  ],
+  "freebuff-login": [
+    "shrink-grow/false/1/21:92981723de5526414b99435b93b94ec87341b90acc7fea71b492e3ea6ae0d445",
+    "shrink-grow/false/1/23:92981723de5526414b99435b93b94ec87341b90acc7fea71b492e3ea6ae0d445",
+    "shrink-grow/false/2/33:f8c02c8afab034cc4fdcaa06b97764a32f6432d0c6d5f47b5f675fe6fd4cf67c",
+    "shrink-grow/true/1/21:44734d78cecaf5ae6203125b92dde9b61816b626efd6b643f78ce3f41c8b1b2d",
+    "shrink-grow/true/1/23:44734d78cecaf5ae6203125b92dde9b61816b626efd6b643f78ce3f41c8b1b2d",
+    "shrink-grow/true/2/33:f8c02c8afab034cc4fdcaa06b97764a32f6432d0c6d5f47b5f675fe6fd4cf67c",
+    "jitter/false/1/11:073b9a35e7a854d650d63f00dcc126f89656fab0f39951de83ff50fd564faab9",
+    "jitter/false/1/21:a046fe007dfe1161435083c3ed3448b4e74fa2203d692db99353b8df3c45f9a1",
+    "jitter/true/1/11:073b9a35e7a854d650d63f00dcc126f89656fab0f39951de83ff50fd564faab9",
+    "jitter/true/1/21:719241163ae1c3629c6a6e0739bb66324f620b8e285d176853d06d0ae26a6c00"
+  ],
+  "freebuff-ready": [],
+  "freebuff-trust": []
+}
diff --git a/src/main/daemon/daemon-entry.ts b/src/main/daemon/daemon-entry.ts
index 9f8d878eddbe..8d409a9dc871 100644
--- a/src/main/daemon/daemon-entry.ts
+++ b/src/main/daemon/daemon-entry.ts
@@ -28,6 +28,7 @@ import { readCurrentDaemonReadyIdentity } from './daemon-ready-identity'
 import { publishDaemonPidFile } from './daemon-spawner'
 import { isNativePtyException } from './daemon-native-pty-exception'
 import { startDaemonScopeDeathWatch } from './daemon-scope-death-watch'
+import { isWindowsProcessTableAvailable } from '../windows/windows-process-table'
 
 export type ParsedDaemonArgs = {
   socketPath: string
@@ -334,6 +335,13 @@ async function main(): Promise<void> {
   daemonLog.log('ready')
 
   warmWindowsConptyOnce()
+  // Whether the addon loads is fixed for this process, and a detached daemon has
+  // no stderr, so the module's own warn cannot report it here. Both answers, so a
+  // bundle can tell "native" from "never asked" (#16905). Loading it now also pays
+  // the dlopen off the first teardown.
+  if (process.platform === 'win32') {
+    daemonLog.log('windows-process-table', { native: isWindowsProcessTableAvailable() })
+  }
 }
 
 // Only auto-run when executed directly (not imported for testing, or for the build guard's
diff --git a/src/main/daemon/daemon-host-manifest.ts b/src/main/daemon/daemon-host-manifest.ts
new file mode 100644
index 000000000000..83d6d4984da7
--- /dev/null
+++ b/src/main/daemon/daemon-host-manifest.ts
@@ -0,0 +1,162 @@
+import { cpSync, existsSync, mkdirSync } from 'node:fs'
+import { dirname, join, win32 as winPath } from 'node:path'
+
+// What the relocated host is made of: which files are mirrored, where each lands,
+// and which of a package's files are runtime rather than bulk. The lifecycle
+// around it -- when to materialize, what keeps a host valid, pruning -- is in
+// daemon-host-relocation.ts.
+
+/**
+ * The host exe keeps the app exe's own file name, so the relocated image is a byte-for-byte,
+ * name-included copy of a signed binary — nothing for EDR to read as a renamed image (MITRE T1036).
+ * Survival comes from the path (see daemon-host-relocation.ts). The one name-sensitive updater path is the
+ * no-PowerShell `taskkill /IM` fallback, where the daemon is killed and terminals cold-restore —
+ * the documented pre-relocation outcome, not a failure.
+ */
+export const daemonHostExeName = (execPath: string): string => winPath.basename(execPath)
+
+// V8 snapshots + ICU data the Electron bootstrap reads even under ELECTRON_RUN_AS_NODE; siblings of Orca.exe.
+const RUNTIME_DATA_FILES = ['icudtl.dat', 'snapshot_blob.bin', 'v8_context_snapshot.bin']
+
+/**
+ * Everything `require('@vscode/windows-process-tree')` walks, package-relative.
+ *
+ * One list, read three times: the copy plan mirrors the package containing them,
+ * materialization refuses to start without them, and a materialized host is only
+ * valid while it still has them. Keeping those three in one place is what stops
+ * "what we copy" and "what we accept" from drifting apart -- drift there means a
+ * host that is copied, published, refused, and copied again on every launch.
+ */
+export const WINDOWS_PROCESS_TREE_REQUIRED = [
+  'package.json',
+  'lib/index.js',
+  'build/Release/windows_process_tree.node'
+] as const
+
+export type CopyOp = {
+  sourcePath: string
+  /** Destination path relative to the host root, posix-separated. */
+  destRel: string
+  kind: 'file' | 'dir'
+  /** When true, a missing source is skipped rather than failing the copy. */
+  optional?: boolean
+  /** Per-source-path predicate for dir copies: return false to skip a path. */
+  filter?: (sourcePath: string) => boolean
+}
+
+export type DaemonHostSources = {
+  appDir: string
+  execPath: string
+  resourcesPath: string
+  entrySourcePath: string
+  entryRelPath: string
+  /** The addon's package; without it the daemon forks a shell per poll (#16905). */
+  windowsProcessTreeDir: string
+}
+
+/** A required file, a directory on the way to one, or anything in lib/ (index.js requires its siblings). */
+function isRuntimeProcessTreePath(packageRel: string): boolean {
+  return (
+    packageRel === '' ||
+    packageRel.startsWith('lib/') ||
+    WINDOWS_PROCESS_TREE_REQUIRED.some(
+      (required) => required === packageRel || required.startsWith(`${packageRel}/`)
+    )
+  )
+}
+
+// win32 path semantics so Windows paths decompose correctly off-win32 in cross-platform unit tests; production runs on win32 only.
+export function toPosixRelative(fromDir: string, absPath: string): string {
+  return winPath.relative(fromDir, absPath).split(winPath.sep).join('/')
+}
+
+export function destPath(root: string, destRel: string): string {
+  return join(root, ...destRel.split('/'))
+}
+
+// Drop node-pty's .pdb symbols and non-host-arch prebuilds (its bulk); keyed on host arch so a future win32-arm64 build keeps the prebuild it needs.
+const HOST_WIN_PREBUILD_DIR = `win32-${process.arch}`.toLowerCase()
+
+function isRuntimeNodePtyPath(sourcePath: string): boolean {
+  const p = sourcePath.toLowerCase()
+  if (p.endsWith('.pdb')) {
+    return false
+  }
+  // Keep only the host arch's win32 prebuild; drop any other win32-<arch> dir.
+  const prebuild = p.match(/prebuilds[\\/](win32-[^\\/]+)/)
+  return !prebuild || prebuild[1] === HOST_WIN_PREBUILD_DIR
+}
+
+/**
+ * The ordered copy plan. Every destRel mirrors the source's win-unpacked relative path so require()
+ * and node-pty's loader resolve the mirror identically to the packaged app. Pure so tests can assert layout.
+ */
+export function buildDaemonHostManifest(sources: DaemonHostSources): CopyOp[] {
+  const { appDir, execPath, resourcesPath, entrySourcePath, entryRelPath } = sources
+  const ops: CopyOp[] = []
+
+  // Host exe (verbatim name) + V8/ICU blobs at dest root. Top-level DLLs omitted: GPU/media libs a windowless run-as-node host never loads (~48MB saved).
+  ops.push({ sourcePath: execPath, destRel: daemonHostExeName(execPath), kind: 'file' })
+  for (const name of RUNTIME_DATA_FILES) {
+    ops.push({ sourcePath: join(appDir, name), destRel: name, kind: 'file', optional: true })
+  }
+
+  // Daemon bundle: entry + sibling chunks/ + out/package.json (CJS/ESM loader resolution), mirrored verbatim.
+  ops.push({ sourcePath: entrySourcePath, destRel: entryRelPath, kind: 'file' })
+  const chunksDir = join(winPath.dirname(entrySourcePath), 'chunks')
+  ops.push({
+    sourcePath: chunksDir,
+    destRel: toPosixRelative(appDir, chunksDir),
+    kind: 'dir',
+    optional: true
+  })
+  const pkgJson = join(resourcesPath, 'app.asar.unpacked', 'out', 'package.json')
+  ops.push({
+    sourcePath: pkgJson,
+    destRel: toPosixRelative(appDir, pkgJson),
+    kind: 'file',
+    optional: true
+  })
+
+  // @vscode/windows-process-tree, mirrored so the daemon's require() resolves it; without it every snapshot forks a powershell.exe (#16905).
+  // Filtered to the runtime files: the installed package is ~25MB of gyp intermediates (.obj/.pdb) around a ~150KB addon.
+  const { windowsProcessTreeDir } = sources
+  ops.push({
+    sourcePath: windowsProcessTreeDir,
+    destRel: toPosixRelative(appDir, windowsProcessTreeDir),
+    kind: 'dir',
+    filter: (sourcePath) =>
+      isRuntimeProcessTreePath(toPosixRelative(windowsProcessTreeDir, sourcePath))
+  })
+  // node-pty tree, mirrored so require('node-pty') resolves it; filtered to drop unused .pdb/other-arch prebuilds.
+  const nodePtyDir = join(resourcesPath, 'node_modules', 'node-pty')
+  ops.push({
+    sourcePath: nodePtyDir,
+    destRel: toPosixRelative(appDir, nodePtyDir),
+    kind: 'dir',
+    filter: isRuntimeNodePtyPath
+  })
+
+  return ops
+}
+
+export function executeManifest(ops: CopyOp[], stagingRoot: string): void {
+  for (const op of ops) {
+    if (!existsSync(op.sourcePath)) {
+      if (op.optional) {
+        continue
+      }
+      throw new Error(`daemon-host relocation: missing required input ${op.sourcePath}`)
+    }
+    const dest = destPath(stagingRoot, op.destRel)
+    mkdirSync(dirname(dest), { recursive: true })
+    const { filter } = op
+    // Dereference symlinks so the copy holds no link back into the install dir.
+    cpSync(op.sourcePath, dest, {
+      recursive: op.kind === 'dir',
+      dereference: true,
+      force: true,
+      ...(filter ? { filter: (src: string) => filter(src) } : {})
+    })
+  }
+}
diff --git a/src/main/daemon/daemon-host-relocation.test.ts b/src/main/daemon/daemon-host-relocation.test.ts
index e899a67ed43b..7b81bdcfa1e0 100644
--- a/src/main/daemon/daemon-host-relocation.test.ts
+++ b/src/main/daemon/daemon-host-relocation.test.ts
@@ -5,12 +5,14 @@ import {
   mkdtempSync,
   readFileSync,
   readdirSync,
+  realpathSync,
   renameSync,
   rmSync,
   utimesSync,
   writeFileSync
 } from 'node:fs'
 import os from 'node:os'
+import { createRequire } from 'node:module'
 import { basename, dirname, join } from 'node:path'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 
@@ -37,8 +39,8 @@ function installHostApp(): void {
   } as AppEnvironment)
 }
 
+import { buildDaemonHostManifest } from './daemon-host-manifest'
 import {
-  buildDaemonHostManifest,
   collectPinnedDaemonVersions,
   getRelocatedDaemonHost,
   materializeRelocatedDaemonHost,
@@ -88,8 +90,35 @@ function buildInstallFixture(root: string): void {
     mkdirSync(join(prebuildsRoot, arch), { recursive: true })
     writeFileSync(join(prebuildsRoot, arch, 'pty.node'), `${arch}-prebuild`)
   }
+  const processTreeDir = join(root, 'resources', 'node_modules', '@vscode', 'windows-process-tree')
+  mkdirSync(join(processTreeDir, 'build', 'Release'), { recursive: true })
+  mkdirSync(join(processTreeDir, 'lib'), { recursive: true })
+  mkdirSync(join(processTreeDir, 'src'), { recursive: true })
+  writeFileSync(join(processTreeDir, 'package.json'), '{"main":"lib/index.js"}')
+  writeFileSync(join(processTreeDir, 'lib', 'index.js'), 'module.exports = {}')
+  writeFileSync(
+    join(processTreeDir, 'build', 'Release', 'windows_process_tree.node'),
+    'process-tree-native'
+  )
+  writeFileSync(join(processTreeDir, 'build', 'Release', 'windows_process_tree.pdb'), 'symbols')
+  writeFileSync(join(processTreeDir, 'src', 'process.cc'), 'source')
+  writeFileSync(join(processTreeDir, 'lib', 'promises.js'), 'require("./index")')
+  mkdirSync(join(processTreeDir, 'build', 'Release', 'obj'), { recursive: true })
+  writeFileSync(join(processTreeDir, 'build', 'Release', 'obj', 'addon.obj'), 'intermediate')
 }
 
+const PROCESS_TREE_DIR_REL = join('resources', 'node_modules', '@vscode', 'windows-process-tree')
+
+const PROCESS_TREE_ADDON_REL = join(
+  'resources',
+  'node_modules',
+  '@vscode',
+  'windows-process-tree',
+  'build',
+  'Release',
+  'windows_process_tree.node'
+)
+
 // The win32 prebuild dir the running host arch loads vs. the one that is pruned.
 const HOST_PREBUILD = `win32-${process.arch}`
 const OTHER_PREBUILD = HOST_PREBUILD === 'win32-arm64' ? 'win32-x64' : 'win32-arm64'
@@ -139,7 +168,8 @@ describe('buildDaemonHostManifest', () => {
       execPath: 'C:\\app\\Orca.exe',
       resourcesPath: 'C:\\app\\resources',
       entrySourcePath: 'C:\\app\\resources\\app.asar.unpacked\\out\\main\\daemon-entry.js',
-      entryRelPath: 'resources/app.asar.unpacked/out/main/daemon-entry.js'
+      entryRelPath: 'resources/app.asar.unpacked/out/main/daemon-entry.js',
+      windowsProcessTreeDir: 'C:\\app\\resources\\node_modules\\@vscode\\windows-process-tree'
     })
     const byDest = new Map(ops.map((op) => [op.destRel, op]))
     // The host exe keeps the source basename: a verbatim, signature-preserving copy with no
@@ -147,6 +177,9 @@ describe('buildDaemonHostManifest', () => {
     expect(byDest.get('Orca.exe')?.kind).toBe('file')
     const exeOp = ops.find((op) => op.sourcePath === 'C:\\app\\Orca.exe')
     expect(exeOp?.destRel).toBe('Orca.exe')
+    // Without this op the relocated daemon cannot resolve the native process
+    // table and falls back to a powershell.exe scan per snapshot (#16905).
+    expect(byDest.get('resources/node_modules/@vscode/windows-process-tree')?.kind).toBe('dir')
     // V8/ICU data blobs are read by the Electron bootstrap and kept.
     expect(byDest.has('icudtl.dat')).toBe(true)
     // GPU/graphics DLLs are never loaded by the windowless host, so not copied.
@@ -201,6 +234,34 @@ describe('materializeRelocatedDaemonHost', () => {
     const marker = JSON.parse(readFileSync(join(dest, '.materialized.json'), 'utf8'))
     expect(marker.version).toBe('9.9.9')
     expect(marker.entryRelPath).toBe('resources/app.asar.unpacked/out/main/daemon-entry.js')
+    // The whole package is mirrored, so require() finds every hop it walks.
+    const processTreeDest = join(
+      dest,
+      'resources',
+      'node_modules',
+      '@vscode',
+      'windows-process-tree'
+    )
+    expect(existsSync(join(processTreeDest, 'build', 'Release', 'windows_process_tree.node'))).toBe(
+      true
+    )
+    expect(existsSync(join(processTreeDest, 'lib', 'index.js'))).toBe(true)
+    expect(existsSync(join(processTreeDest, 'lib', 'promises.js'))).toBe(true)
+    // Build intermediates are ~25MB of the installed package; the loader never reads them.
+    expect(existsSync(join(processTreeDest, 'build', 'Release', 'windows_process_tree.pdb'))).toBe(
+      false
+    )
+    expect(existsSync(join(processTreeDest, 'build', 'Release', 'obj'))).toBe(false)
+    expect(existsSync(join(processTreeDest, 'src'))).toBe(false)
+    // The loader requires the BARE package, so resolution runs through the copied
+    // package.json's `main`. Asserting the .node subpath instead would still pass
+    // with package.json dropped from the filter, while the daemon's own require
+    // failed and it silently went back to the CIM scan.
+    expect(
+      createRequire(
+        join(dest, 'resources', 'app.asar.unpacked', 'out', 'main', 'chunks', 'a.js')
+      ).resolve('@vscode/windows-process-tree')
+    ).toBe(realpathSync(join(processTreeDest, 'lib', 'index.js')))
   })
 
   it('copies the exe verbatim: same file name and same bytes as the install-dir exe', () => {
@@ -225,6 +286,71 @@ describe('materializeRelocatedDaemonHost', () => {
     expect(getRelocatedDaemonHost()?.execPath).toBe(join(dest, 'Orca Nightly.exe'))
   })
 
+  it.each([
+    ['the binary', PROCESS_TREE_ADDON_REL],
+    ['package.json', join(PROCESS_TREE_DIR_REL, 'package.json')],
+    ['lib/index.js', join(PROCESS_TREE_DIR_REL, 'lib', 'index.js')]
+  ])('refuses a mirror that lost %s', (_label, relativePath) => {
+    // Any one of them missing means require() cannot reach the addon, and a host
+    // that cannot load it runs anyway -- forking a shell per snapshot (#16905).
+    materializeRelocatedDaemonHost()
+    const dest = join(localAppDataDir, 'Orca', 'daemon-host', '9.9.9')
+    expect(getRelocatedDaemonHost()).not.toBeNull()
+
+    rmSync(join(dest, relativePath))
+
+    expect(getRelocatedDaemonHost()).toBeNull()
+  })
+
+  it('rematerializes a host whose copied addon went missing', () => {
+    materializeRelocatedDaemonHost()
+    const dest = join(localAppDataDir, 'Orca', 'daemon-host', '9.9.9')
+    const relocatedAddon = join(dest, PROCESS_TREE_ADDON_REL)
+
+    rmSync(relocatedAddon)
+    // A sentinel proves the host was rebuilt rather than reused.
+    const sentinel = join(dest, 'sentinel.txt')
+    writeFileSync(sentinel, 'remove')
+
+    expect(materializeRelocatedDaemonHost()).not.toBeNull()
+    expect(readFileSync(relocatedAddon, 'utf8')).toBe('process-tree-native')
+    expect(existsSync(sentinel)).toBe(false)
+  })
+
+  it('does not read the install dir to decide an existing host is still good', () => {
+    // Relocation exists to outlive the install dir, so validity cannot depend on
+    // it: an updater mid-copy would otherwise condemn an intact host. A real
+    // upgrade changes the version keying this directory, which already forces a
+    // rebuild, and nothing else in the mirror is source-verified either.
+    materializeRelocatedDaemonHost()
+    const dest = join(localAppDataDir, 'Orca', 'daemon-host', '9.9.9')
+    const sentinel = join(dest, 'sentinel.txt')
+    writeFileSync(sentinel, 'keep')
+
+    rmSync(join(installDir, 'resources', 'node_modules', '@vscode'), {
+      recursive: true,
+      force: true
+    })
+
+    expect(getRelocatedDaemonHost()).not.toBeNull()
+    expect(existsSync(sentinel)).toBe(true)
+  })
+
+  it.each([
+    ['the binary', PROCESS_TREE_ADDON_REL],
+    ['package.json', join(PROCESS_TREE_DIR_REL, 'package.json')],
+    ['lib/index.js', join(PROCESS_TREE_DIR_REL, 'lib', 'index.js')]
+  ])('refuses to copy anything when the install lost %s', (_label, relativePath) => {
+    // Each of these would be accepted by the copy plan and then refused by the
+    // mirror check, which is a ~260MB copy per launch to reach a verdict the
+    // source could have given for free. Sharing one list is what prevents that.
+    rmSync(join(installDir, relativePath))
+
+    expect(materializeRelocatedDaemonHost()).toBeNull()
+    // Not even the host root: the source is checked before any directory is made.
+    expect(existsSync(join(localAppDataDir, 'Orca', 'daemon-host'))).toBe(false)
+  })
+
   it('is idempotent: a valid marker short-circuits without recopying', () => {
     materializeRelocatedDaemonHost()
     const dest = join(localAppDataDir, 'Orca', 'daemon-host', '9.9.9')
@@ -278,6 +404,13 @@ describe('getRelocatedDaemonHost', () => {
       join(dest, 'resources', 'app.asar.unpacked', 'out', 'main', 'daemon-entry.js'),
       'e'
     )
+    // The process-table files too, or this passes because the mirror has no addon
+    // and never exercises the version comparison it is named for.
+    mkdirSync(join(dest, PROCESS_TREE_DIR_REL, 'lib'), { recursive: true })
+    mkdirSync(dirname(join(dest, PROCESS_TREE_ADDON_REL)), { recursive: true })
+    writeFileSync(join(dest, PROCESS_TREE_DIR_REL, 'package.json'), '{}')
+    writeFileSync(join(dest, PROCESS_TREE_DIR_REL, 'lib', 'index.js'), 'm')
+    writeFileSync(join(dest, PROCESS_TREE_ADDON_REL), 'n')
     writeFileSync(
       join(dest, '.materialized.json'),
       JSON.stringify({
diff --git a/src/main/daemon/daemon-host-relocation.ts b/src/main/daemon/daemon-host-relocation.ts
index 13aab9fd8f95..51fed83530af 100644
--- a/src/main/daemon/daemon-host-relocation.ts
+++ b/src/main/daemon/daemon-host-relocation.ts
@@ -1,6 +1,5 @@
 import { randomBytes } from 'node:crypto'
 import {
-  cpSync,
   existsSync,
   mkdirSync,
   readFileSync,
@@ -9,8 +8,17 @@ import {
   rmSync,
   writeFileSync
 } from 'node:fs'
-import { dirname, join, win32 as winPath } from 'node:path'
+import { join, win32 as winPath } from 'node:path'
 import { getAppEnvironment } from '../../shared/app-environment'
+import {
+  buildDaemonHostManifest,
+  daemonHostExeName,
+  destPath,
+  executeManifest,
+  toPosixRelative,
+  WINDOWS_PROCESS_TREE_REQUIRED,
+  type DaemonHostSources
+} from './daemon-host-manifest'
 import type { ProcessLivenessVerdict } from './daemon-incarnation-evidence-types'
 import { parseDaemonPidFile } from './daemon-pid-file-parse'
 import { quarantineCorruptDaemonPidRecord } from './daemon-pid-record-quarantine'
@@ -41,52 +49,12 @@ const MARKER_NAME = '.materialized.json'
 // LOCAL appData (not roaming) so OneDrive/roaming never syncs this ~260MB runtime. Shared with NSIS uninstall (config/nsis/orca-installer-hooks.nsh) — keep in sync.
 const LOCAL_HOST_ROOT_NAME = 'Orca'
 
-/**
- * The host exe keeps the app exe's own file name, so the relocated image is a byte-for-byte,
- * name-included copy of a signed binary — nothing for EDR to read as a renamed image (MITRE T1036).
- * Survival comes from the path (see the module header). The one name-sensitive updater path is the
- * no-PowerShell `taskkill /IM` fallback, where the daemon is killed and terminals cold-restore —
- * the documented pre-relocation outcome, not a failure.
- */
-const daemonHostExeName = (execPath: string): string => winPath.basename(execPath)
-
-// V8 snapshots + ICU data the Electron bootstrap reads even under ELECTRON_RUN_AS_NODE; siblings of Orca.exe.
-const RUNTIME_DATA_FILES = ['icudtl.dat', 'snapshot_blob.bin', 'v8_context_snapshot.bin']
-
-type CopyOp = {
-  sourcePath: string
-  /** Destination path relative to the host root, posix-separated. */
-  destRel: string
-  kind: 'file' | 'dir'
-  /** When true, a missing source is skipped rather than failing the copy. */
-  optional?: boolean
-  /** Per-source-path predicate for dir copies: return false to skip a path. */
-  filter?: (sourcePath: string) => boolean
-}
-
-type DaemonHostSources = {
-  appDir: string
-  execPath: string
-  resourcesPath: string
-  entrySourcePath: string
-  entryRelPath: string
-}
-
 type MaterializeMarker = {
   version: string
   completedAt: string
   entryRelPath: string
 }
 
-// win32 path semantics so Windows paths decompose correctly off-win32 in cross-platform unit tests; production runs on win32 only.
-function toPosixRelative(fromDir: string, absPath: string): string {
-  return winPath.relative(fromDir, absPath).split(winPath.sep).join('/')
-}
-
-function destPath(root: string, destRel: string): string {
-  return join(root, ...destRel.split('/'))
-}
-
 // Mirror getDaemonEntryPath()'s resolution order so the copied entry is the exact file the in-dir fork would run.
 function resolveEntrySourcePath(resourcesPath: string): string {
   const unpackedRoot = join(resourcesPath, 'app.asar.unpacked')
@@ -132,83 +100,8 @@ function collectDaemonHostSources(): DaemonHostSources | null {
     execPath,
     resourcesPath,
     entrySourcePath,
-    entryRelPath: toPosixRelative(appDir, entrySourcePath)
-  }
-}
-
-// Drop node-pty's .pdb symbols and non-host-arch prebuilds (its bulk); keyed on host arch so a future win32-arm64 build keeps the prebuild it needs.
-const HOST_WIN_PREBUILD_DIR = `win32-${process.arch}`.toLowerCase()
-function isRuntimeNodePtyPath(sourcePath: string): boolean {
-  const p = sourcePath.toLowerCase()
-  if (p.endsWith('.pdb')) {
-    return false
-  }
-  // Keep only the host arch's win32 prebuild; drop any other win32-<arch> dir.
-  const prebuild = p.match(/prebuilds[\\/](win32-[^\\/]+)/)
-  return !prebuild || prebuild[1] === HOST_WIN_PREBUILD_DIR
-}
-
-/**
- * The ordered copy plan. Every destRel mirrors the source's win-unpacked relative path so require()
- * and node-pty's loader resolve the mirror identically to the packaged app. Pure so tests can assert layout.
- */
-export function buildDaemonHostManifest(sources: DaemonHostSources): CopyOp[] {
-  const { appDir, execPath, resourcesPath, entrySourcePath, entryRelPath } = sources
-  const ops: CopyOp[] = []
-
-  // Host exe (verbatim name) + V8/ICU blobs at dest root. Top-level DLLs omitted: GPU/media libs a windowless run-as-node host never loads (~48MB saved).
-  ops.push({ sourcePath: execPath, destRel: daemonHostExeName(execPath), kind: 'file' })
-  for (const name of RUNTIME_DATA_FILES) {
-    ops.push({ sourcePath: join(appDir, name), destRel: name, kind: 'file', optional: true })
-  }
-
-  // Daemon bundle: entry + sibling chunks/ + out/package.json (CJS/ESM loader resolution), mirrored verbatim.
-  ops.push({ sourcePath: entrySourcePath, destRel: entryRelPath, kind: 'file' })
-  const chunksDir = join(winPath.dirname(entrySourcePath), 'chunks')
-  ops.push({
-    sourcePath: chunksDir,
-    destRel: toPosixRelative(appDir, chunksDir),
-    kind: 'dir',
-    optional: true
-  })
-  const pkgJson = join(resourcesPath, 'app.asar.unpacked', 'out', 'package.json')
-  ops.push({
-    sourcePath: pkgJson,
-    destRel: toPosixRelative(appDir, pkgJson),
-    kind: 'file',
-    optional: true
-  })
-
-  // node-pty tree, mirrored so require('node-pty') resolves it; filtered to drop unused .pdb/other-arch prebuilds.
-  const nodePtyDir = join(resourcesPath, 'node_modules', 'node-pty')
-  ops.push({
-    sourcePath: nodePtyDir,
-    destRel: toPosixRelative(appDir, nodePtyDir),
-    kind: 'dir',
-    filter: isRuntimeNodePtyPath
-  })
-
-  return ops
-}
-
-function executeManifest(ops: CopyOp[], stagingRoot: string): void {
-  for (const op of ops) {
-    if (!existsSync(op.sourcePath)) {
-      if (op.optional) {
-        continue
-      }
-      throw new Error(`daemon-host relocation: missing required input ${op.sourcePath}`)
-    }
-    const dest = destPath(stagingRoot, op.destRel)
-    mkdirSync(dirname(dest), { recursive: true })
-    const { filter } = op
-    // Dereference symlinks so the copy holds no link back into the install dir.
-    cpSync(op.sourcePath, dest, {
-      recursive: op.kind === 'dir',
-      dereference: true,
-      force: true,
-      ...(filter ? { filter: (src: string) => filter(src) } : {})
-    })
+    entryRelPath: toPosixRelative(appDir, entrySourcePath),
+    windowsProcessTreeDir: join(resourcesPath, 'node_modules', '@vscode', 'windows-process-tree')
   }
 }
 
@@ -230,6 +123,17 @@ function readMarker(dir: string): MaterializeMarker | null {
   return null
 }
 
+function processTreeRelDir(sources: DaemonHostSources): string {
+  return toPosixRelative(sources.appDir, sources.windowsProcessTreeDir)
+}
+
+/** True when any file require() needs is absent from a copy of the package. */
+function missingProcessTreeFiles(packageDir: string): boolean {
+  return WINDOWS_PROCESS_TREE_REQUIRED.some(
+    (relative) => !existsSync(join(packageDir, ...relative.split('/')))
+  )
+}
+
 function hostRootDir(): string {
   // Prefer LOCAL appData (see LOCAL_HOST_ROOT_NAME); fall back to userData only if LOCALAPPDATA is unset.
   const localAppData = process.env.LOCALAPPDATA
@@ -260,6 +164,13 @@ export function getRelocatedDaemonHost(): RelocatedDaemonHost | null {
   if (!existsSync(execPath) || !existsSync(entryPath)) {
     return null
   }
+  // A mirror the daemon cannot load the addon from still runs -- it just forks a
+  // shell per snapshot (#16905) -- so treat it as unmaterialized and rebuild. Hosts
+  // from before this shipped have none of these files. Checked in the mirror, never
+  // in the install dir, which is the thing relocation exists to outlive.
+  if (missingProcessTreeFiles(destPath(dest, processTreeRelDir(sources)))) {
+    return null
+  }
   return { execPath, entryPath }
 }
 
@@ -276,6 +187,12 @@ export function materializeRelocatedDaemonHost(): RelocatedDaemonHost | null {
   if (!sources) {
     return null
   }
+  // Checked against the source before copying: the mirror check below would refuse
+  // the result anyway, and re-copying ~260MB on every launch to reach that verdict
+  // is the loop this shares its list with the copy plan to prevent.
+  if (missingProcessTreeFiles(sources.windowsProcessTreeDir)) {
+    return null
+  }
   const version = getAppEnvironment().getVersion()
   const root = hostRootDir()
   const dest = join(root, version)
diff --git a/src/main/daemon/daemon-launch-paths.ts b/src/main/daemon/daemon-launch-paths.ts
index 049800daff45..532bc75c574d 100644
--- a/src/main/daemon/daemon-launch-paths.ts
+++ b/src/main/daemon/daemon-launch-paths.ts
@@ -60,7 +60,10 @@ export function probeDaemonSocket(
   socketPath: string,
   timeoutMs = DAEMON_SOCKET_PROBE_TIMEOUT_MS
 ): Promise<boolean> {
-  const { promise, resolve } = Promise.withResolvers<boolean>()
+  let resolve!: (alive: boolean) => void
+  const promise = new Promise<boolean>((settle) => {
+    resolve = settle
+  })
   if (process.platform !== 'win32' && !existsSync(socketPath)) {
     resolve(false)
     return promise
diff --git a/src/main/daemon/daemon-process-identity-query.ts b/src/main/daemon/daemon-process-identity-query.ts
index 479aa821ecfd..d4eee6b1b84d 100644
--- a/src/main/daemon/daemon-process-identity-query.ts
+++ b/src/main/daemon/daemon-process-identity-query.ts
@@ -16,22 +16,26 @@ export type PsProcessIdentity = {
   startedAtMs: number | null
 }
 
-function parsePsProcessIdentity(output: string): PsProcessIdentity {
+function parsePsProcessIdentity(output: string, utc = false): PsProcessIdentity {
   // BSD ps formats lstart as a fixed-width 24-character timestamp.
-  const startedAtMs = Date.parse(output.slice(0, 24))
+  const startedAtMs = Date.parse(output.slice(0, 24) + (utc ? ' UTC' : ''))
   return {
     commandLine: output.slice(24).trim(),
     startedAtMs: Number.isFinite(startedAtMs) ? startedAtMs : null
   }
 }
 
-export function getPsProcessIdentity(pid: number): PsProcessIdentity | null {
+export function getPsProcessIdentity(
+  pid: number,
+  options?: { utc?: boolean }
+): PsProcessIdentity | null {
   try {
     const output = execFileSync('ps', ['-p', String(pid), '-o', 'lstart=', '-o', 'command='], {
       encoding: 'utf8',
-      timeout: 2_000
+      timeout: 2_000,
+      ...(options?.utc ? { env: { ...process.env, TZ: 'UTC', LC_ALL: 'C' } } : {})
     })
-    return parsePsProcessIdentity(output)
+    return parsePsProcessIdentity(output, options?.utc)
   } catch {
     return null
   }
diff --git a/src/main/daemon/daemon-process-identity-time-zone.test.ts b/src/main/daemon/daemon-process-identity-time-zone.test.ts
new file mode 100644
index 000000000000..aee3e4f44204
--- /dev/null
+++ b/src/main/daemon/daemon-process-identity-time-zone.test.ts
@@ -0,0 +1,32 @@
+import { afterEach, expect, it, vi } from 'vitest'
+import { getPsProcessIdentity } from './daemon-process-identity-query'
+
+const { execFileSync } = vi.hoisted(() => ({ execFileSync: vi.fn() }))
+vi.mock('node:child_process', () => ({ execFileSync, execFile: vi.fn() }))
+
+afterEach(() => {
+  vi.unstubAllEnvs()
+  vi.clearAllMocks()
+})
+
+it.each(['America/Los_Angeles', 'America/New_York', 'UTC'])(
+  'keeps the autumn clock transition unambiguous under %s',
+  (timezone) => {
+    vi.stubEnv('TZ', timezone)
+    execFileSync.mockReturnValue('Sun Nov  1 09:30:00 2026 /path/to/orca\n')
+    expect(getPsProcessIdentity(42, { utc: true })).toEqual({
+      startedAtMs: Date.parse('2026-11-01T09:30:00Z'),
+      commandLine: '/path/to/orca'
+    })
+    expect(execFileSync).toHaveBeenCalledWith(
+      'ps',
+      ['-p', '42', '-o', 'lstart=', '-o', 'command='],
+      expect.objectContaining({ env: expect.objectContaining({ TZ: 'UTC', LC_ALL: 'C' }) })
+    )
+  }
+)
+
+it('treats an unreadable UTC process start as unknown', () => {
+  execFileSync.mockReturnValue('                        /path/to/orca\n')
+  expect(getPsProcessIdentity(42, { utc: true })?.startedAtMs).toBeNull()
+})
diff --git a/src/main/daemon/daemon-pty-spawn-preparations.ts b/src/main/daemon/daemon-pty-spawn-preparations.ts
index 633f0d1c7f57..af52051a4833 100644
--- a/src/main/daemon/daemon-pty-spawn-preparations.ts
+++ b/src/main/daemon/daemon-pty-spawn-preparations.ts
@@ -33,7 +33,14 @@ export class DaemonPtySpawnPreparations {
       clientId,
       requestId
     }
-    this.cancellationByPreparation.set(preparation, Promise.withResolvers<void>())
+    let resolveCancellation!: () => void
+    const cancellation = new Promise<void>((resolve) => {
+      resolveCancellation = resolve
+    })
+    this.cancellationByPreparation.set(preparation, {
+      promise: cancellation,
+      resolve: resolveCancellation
+    })
     if (Number.isSafeInteger(cancelAfterMs) && Number(cancelAfterMs) > 0) {
       preparation.cancelTimer = setTimeout(
         () => this.cancelPreparation(preparation),
diff --git a/src/main/daemon/daemon-zsh-shell-ready-wrapper-spec.ts b/src/main/daemon/daemon-zsh-shell-ready-wrapper-spec.ts
index 70ea670966c2..2da68eef53b3 100644
--- a/src/main/daemon/daemon-zsh-shell-ready-wrapper-spec.ts
+++ b/src/main/daemon/daemon-zsh-shell-ready-wrapper-spec.ts
@@ -11,6 +11,7 @@ export function getDaemonZshWrapperSpec(): ZshStartupHookSpec {
     overlayRestoreComment:
       "# Why: ~/.zshrc can export the user's default OpenCode config after spawn.",
     restores: {
+      managedWslCli: false,
       agentTeamsPath: true,
       remoteCliBinDir: false,
       codexHome: true,
diff --git a/src/main/daemon/node-pty-error-hints.test.ts b/src/main/daemon/node-pty-error-hints.test.ts
index f43951f05a66..361d8b73ba1e 100644
--- a/src/main/daemon/node-pty-error-hints.test.ts
+++ b/src/main/daemon/node-pty-error-hints.test.ts
@@ -1,22 +1,12 @@
 import { describe, expect, it } from 'vitest'
+import {
+  LEGACY_PTY_ALLOCATION_HINT,
+  LEGACY_TERMINAL_PROCESS_LIMIT_HINT,
+  PTY_ALLOCATION_HINT,
+  TERMINAL_PROCESS_LIMIT_HINT
+} from '../../shared/terminal-spawn-error-copy'
 import { addNodePtyRecoveryHint, parseNodePtyDiagnostic } from './node-pty-error-hints'
 
-const PTY_ALLOCATION_HINT = [
-  'Your system cannot allocate any more pty devices.',
-  '',
-  'Orca requires a pty device to launch a new terminal. This error is usually due to having too many terminal windows or terminal sessions open, either in Orca or another program.',
-  '',
-  'Free up some pty devices and try again.'
-].join('\n')
-
-const TERMINAL_PROCESS_LIMIT_HINT = [
-  'Your system cannot start another terminal process.',
-  '',
-  'This is usually due to having too many terminal sessions or other processes running.',
-  '',
-  'Close unused terminals or quit unused processes and try again.'
-].join('\n')
-
 describe('node-pty diagnostic error hints', () => {
   it('parses the native step and errno without dropping the original message', () => {
     const message =
@@ -32,46 +22,71 @@ describe('node-pty diagnostic error hints', () => {
     const message =
       "node-pty: open_slave failed: EMFILE (errno 24, Too many open files) - slave='/dev/ttys003'"
 
-    expect(addNodePtyRecoveryHint(message)).toBe(`${PTY_ALLOCATION_HINT} ${message}`)
+    expect(addNodePtyRecoveryHint(message)).toBe(`${PTY_ALLOCATION_HINT}\n${message}`)
   })
 
   it('hints when the system cannot allocate a pty master', () => {
     const message =
       'node-pty: posix_openpt failed: ENFILE (errno 23, Too many open files in system)'
 
-    expect(addNodePtyRecoveryHint(message)).toBe(`${PTY_ALLOCATION_HINT} ${message}`)
+    expect(addNodePtyRecoveryHint(message)).toBe(`${PTY_ALLOCATION_HINT}\n${message}`)
   })
 
   it('hints when macOS cannot configure a pty master device', () => {
     const message = 'node-pty: posix_openpt failed: errno (errno 6, Device not configured)'
 
-    expect(addNodePtyRecoveryHint(message)).toBe(`${PTY_ALLOCATION_HINT} ${message}`)
+    expect(addNodePtyRecoveryHint(message)).toBe(`${PTY_ALLOCATION_HINT}\n${message}`)
   })
 
   it('hints local wrapped spawn errors from pty allocation failures', () => {
     const message =
       'Failed to spawn shell "/bin/zsh": node-pty: open_slave failed: EMFILE (errno 24, Too many open files) - slave=\'/dev/ttys003\' (shell: /bin/zsh, cwd: /tmp, arch: arm64, platform: darwin 25.0.0, orca: 1.4.178). If this persists, please file an issue.'
 
-    expect(addNodePtyRecoveryHint(message)).toBe(`${PTY_ALLOCATION_HINT} ${message}`)
+    expect(addNodePtyRecoveryHint(message)).toBe(`${PTY_ALLOCATION_HINT}\n${message}`)
+  })
+
+  it('keeps the whole recovery action on the first line', () => {
+    const message =
+      'Failed to spawn shell "/bin/zsh": node-pty: posix_openpt failed: errno (errno 6, Device not configured) (shell: /bin/zsh). If this persists, please file an issue.'
+
+    expect(addNodePtyRecoveryHint(message).split('\n')[0]).toBe(PTY_ALLOCATION_HINT)
   })
 
   it('hints unstructured openpty allocation failures', () => {
     const message = 'Failed to spawn shell "/bin/bash": openpty(3) failed.'
 
-    expect(addNodePtyRecoveryHint(message)).toBe(`${PTY_ALLOCATION_HINT} ${message}`)
+    expect(addNodePtyRecoveryHint(message)).toBe(`${PTY_ALLOCATION_HINT}\n${message}`)
   })
 
   it('hints when posix_spawn reports the per-user process limit', () => {
     const message =
       "node-pty: posix_spawn failed: EAGAIN (errno 35, Resource temporarily unavailable) - helper='/tmp/node-pty/spawn-helper'"
 
-    expect(addNodePtyRecoveryHint(message)).toBe(`${TERMINAL_PROCESS_LIMIT_HINT} ${message}`)
+    expect(addNodePtyRecoveryHint(message)).toBe(`${TERMINAL_PROCESS_LIMIT_HINT}\n${message}`)
   })
 
   it('does not duplicate an existing recovery hint', () => {
     const message =
       "node-pty: open_slave failed: EMFILE (errno 24, Too many open files) - slave='/dev/ttys003'"
-    const hinted = `${PTY_ALLOCATION_HINT} ${message}`
+    const hinted = `${PTY_ALLOCATION_HINT}\n${message}`
+
+    expect(addNodePtyRecoveryHint(hinted)).toBe(hinted)
+  })
+
+  it('does not duplicate hints from an older remote host', () => {
+    const ptyError = 'node-pty: open_slave failed: EMFILE (errno 24, Too many open files)'
+    const processError = 'node-pty: posix_spawn failed: EAGAIN (errno 35, Resource unavailable)'
+
+    expect(addNodePtyRecoveryHint(`${LEGACY_PTY_ALLOCATION_HINT} ${ptyError}`)).toBe(
+      `${LEGACY_PTY_ALLOCATION_HINT} ${ptyError}`
+    )
+    expect(addNodePtyRecoveryHint(`${LEGACY_TERMINAL_PROCESS_LIMIT_HINT} ${processError}`)).toBe(
+      `${LEGACY_TERMINAL_PROCESS_LIMIT_HINT} ${processError}`
+    )
+  })
+
+  it('does not duplicate a legacy hint on unstructured openpty failures', () => {
+    const hinted = `${LEGACY_PTY_ALLOCATION_HINT} Failed to spawn shell "/bin/bash": openpty(3) failed.`
 
     expect(addNodePtyRecoveryHint(hinted)).toBe(hinted)
   })
diff --git a/src/main/daemon/node-pty-error-hints.ts b/src/main/daemon/node-pty-error-hints.ts
index 022fb98c5be8..182beb41a795 100644
--- a/src/main/daemon/node-pty-error-hints.ts
+++ b/src/main/daemon/node-pty-error-hints.ts
@@ -1,3 +1,10 @@
+import {
+  LEGACY_PTY_ALLOCATION_HINT,
+  LEGACY_TERMINAL_PROCESS_LIMIT_HINT,
+  PTY_ALLOCATION_HINT,
+  TERMINAL_PROCESS_LIMIT_HINT
+} from '../../shared/terminal-spawn-error-copy'
+
 export type NodePtyDiagnostic = {
   step: string
   errno: number
@@ -25,22 +32,6 @@ const RESOURCE_EXHAUSTION_ERRNOS = new Set([
   35 // EAGAIN on macOS
 ])
 
-const PTY_ALLOCATION_HINT = [
-  'Your system cannot allocate any more pty devices.',
-  '',
-  'Orca requires a pty device to launch a new terminal. This error is usually due to having too many terminal windows or terminal sessions open, either in Orca or another program.',
-  '',
-  'Free up some pty devices and try again.'
-].join('\n')
-
-const TERMINAL_PROCESS_LIMIT_HINT = [
-  'Your system cannot start another terminal process.',
-  '',
-  'This is usually due to having too many terminal sessions or other processes running.',
-  '',
-  'Close unused terminals or quit unused processes and try again.'
-].join('\n')
-
 export function parseNodePtyDiagnostic(message: string): NodePtyDiagnostic | null {
   const match =
     NODE_PTY_DIAGNOSTIC_RE.exec(message) ?? NODE_PTY_DIAGNOSTIC_ANYWHERE_RE.exec(message)
@@ -70,18 +61,30 @@ export function getNodePtyRecoveryHint(diagnostic: NodePtyDiagnostic): string |
   return null
 }
 
+function hasPtyAllocationHint(message: string): boolean {
+  return message.startsWith(PTY_ALLOCATION_HINT) || message.startsWith(LEGACY_PTY_ALLOCATION_HINT)
+}
+
 export function addNodePtyRecoveryHint(message: string): string {
   const diagnostic = parseNodePtyDiagnostic(message)
   if (!diagnostic) {
-    if (GENERIC_PTY_ALLOCATION_RE.test(message) && !message.startsWith(PTY_ALLOCATION_HINT)) {
-      return `${PTY_ALLOCATION_HINT} ${message}`
+    if (GENERIC_PTY_ALLOCATION_RE.test(message) && !hasPtyAllocationHint(message)) {
+      return `${PTY_ALLOCATION_HINT}\n${message}`
     }
     return message
   }
 
   const hint = getNodePtyRecoveryHint(diagnostic)
-  if (hint && message.startsWith(hint)) {
+  if (
+    !hint ||
+    message.startsWith(hint) ||
+    (hint === PTY_ALLOCATION_HINT && hasPtyAllocationHint(message)) ||
+    (hint === TERMINAL_PROCESS_LIMIT_HINT && message.startsWith(LEGACY_TERMINAL_PROCESS_LIMIT_HINT))
+  ) {
     return message
   }
-  return hint ? `${hint} ${message}` : message
+  // Older clients need both stale-daemon markers before their first-line IPC truncation.
+  const separator =
+    hint === PTY_ALLOCATION_HINT || hint === TERMINAL_PROCESS_LIMIT_HINT ? '\n' : ' '
+  return `${hint}${separator}${message}`
 }
diff --git a/src/main/daemon/process-boundary-ground.test.ts b/src/main/daemon/process-boundary-ground.test.ts
index dfdf5262eddc..5cefaa0694b2 100644
--- a/src/main/daemon/process-boundary-ground.test.ts
+++ b/src/main/daemon/process-boundary-ground.test.ts
@@ -142,7 +142,7 @@ describe('process boundary ground at a proven crash', () => {
     barrier.accept({ data, rawStartSeq: 0, rawEndSeq: data.length, transformed: false })
 
     await vi.waitFor(() => expect(released).toHaveLength(3))
-    expect(released[1]).toBe(PROCESS_BOUNDARY_GROUND)
+    expect(released[1]).toBe(`\x1b]133;D;137\x07${PROCESS_BOUNDARY_GROUND}`)
     expect(released[2]).toBe('\x1b[?2004h$ ')
     expect(barrier.getOwner()).toBe('shell')
     const snapshot = live.getSnapshot()
@@ -155,4 +155,19 @@ describe('process boundary ground at a proven crash', () => {
     }
     expect(live.getBufferTailLines(24).slice(0, 2)).toEqual(['$ tui', '$ '])
   })
+
+  it('pauses on an escape boundary so a mid-proof snapshot has no open OSC', () => {
+    const live = emulator(DAEMON_SESSION_SCROLLBACK_ROWS)
+    const barrier = new TerminalShellRecoveryBarrier({
+      confirmShellForeground: () => new Promise(() => {}),
+      release: (emission) => write(live, emission.data),
+      isAlive: () => true
+    })
+
+    const data = `\x1b[?1049h${DEAD_PROCESS_ARMS}TUI\x1b]133;D;137\x07$ `
+    barrier.accept({ data, rawStartSeq: 0, rawEndSeq: data.length, transformed: false })
+
+    expect(live.getSnapshot().pendingEscapeTailAnsi).toBeUndefined()
+    barrier.dispose()
+  })
 })
diff --git a/src/main/daemon/pty-subprocess-env-inheritance.test.ts b/src/main/daemon/pty-subprocess-env-inheritance.test.ts
index f6f6cb3a056f..636b53d70a1f 100644
--- a/src/main/daemon/pty-subprocess-env-inheritance.test.ts
+++ b/src/main/daemon/pty-subprocess-env-inheritance.test.ts
@@ -125,11 +125,13 @@ describe('createPtySubprocess', () => {
     const saved = {
       ORCA_PANE_KEY: process.env.ORCA_PANE_KEY,
       ORCA_TAB_ID: process.env.ORCA_TAB_ID,
-      ORCA_WORKTREE_ID: process.env.ORCA_WORKTREE_ID
+      ORCA_WORKTREE_ID: process.env.ORCA_WORKTREE_ID,
+      ORCA_WSL_CLI_DIR: process.env.ORCA_WSL_CLI_DIR
     }
     process.env.ORCA_PANE_KEY = 'parent-tab:parent-leaf'
     process.env.ORCA_TAB_ID = 'parent-tab'
     process.env.ORCA_WORKTREE_ID = 'parent-worktree'
+    process.env.ORCA_WSL_CLI_DIR = 'C:/parent/wsl-managed-cli'
 
     try {
       await createPtySubprocess({ sessionId: 'test', cols: 80, rows: 24 })
@@ -147,6 +149,7 @@ describe('createPtySubprocess', () => {
     expect(env.ORCA_PANE_KEY).toBeUndefined()
     expect(env.ORCA_TAB_ID).toBeUndefined()
     expect(env.ORCA_WORKTREE_ID).toBeUndefined()
+    expect(env.ORCA_WSL_CLI_DIR).toBeUndefined()
   })
 
   it('preserves explicit child Orca pane identity over parent env', async () => {
diff --git a/src/main/daemon/pty-subprocess-spawn-file-foreground.test.ts b/src/main/daemon/pty-subprocess-spawn-file-foreground.test.ts
new file mode 100644
index 000000000000..94e352ce6954
--- /dev/null
+++ b/src/main/daemon/pty-subprocess-spawn-file-foreground.test.ts
@@ -0,0 +1,280 @@
+import type { IPty } from 'node-pty'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import type { ProcessTableRow } from '../../shared/process-table-snapshot'
+import type * as SnapshotReader from '../../shared/process-table-snapshot-reader'
+import { createDaemonPtySubprocessHandle } from './pty-subprocess/subprocess-handle'
+import { resolveSpawnFileForegroundFromRows } from './pty-subprocess/spawn-file-foreground-process'
+import { inspectTerminalHostProcess } from './terminal-host-process-inspection'
+import { Session } from './session'
+const { readSnapshot, readFresh, readStrict, members, readWindows, resolveWindows } = vi.hoisted(
+  () => ({
+    readSnapshot: vi.fn(),
+    readFresh: vi.fn(),
+    readStrict: vi.fn(),
+    members: vi.fn(),
+    readWindows: vi.fn(),
+    resolveWindows: vi.fn()
+  })
+)
+vi.mock('../../shared/process-table-snapshot-reader', async (importOriginal) => ({
+  ...(await importOriginal<typeof SnapshotReader>()),
+  getProcessTableSnapshot: readSnapshot,
+  getFreshProcessTableSnapshot: readFresh,
+  getStrictProcessTableSnapshotWithAge: readStrict
+}))
+vi.mock('../providers/windows-pty-job-membership', () => ({
+  readWindowsPtyJobProcessIds: members,
+  isWindowsPtyJobReadable: () => true
+}))
+vi.mock('../windows/windows-process-table', () => ({
+  readWindowsProcessIdentityTable: readWindows,
+  readWindowsProcessIdentityTableFresh: readWindows
+}))
+vi.mock('../providers/windows-agent-foreground-process', () => ({
+  shouldInspectWindowsAgentForeground: () => true,
+  resolveWindowsAgentForegroundProcessWithAvailability: resolveWindows
+}))
+
+function table(command: string | null, loginWrapper = false): ProcessTableRow[] {
+  const tpgid = command === null ? (loginWrapper ? 101 : 100) : 102
+  const root: ProcessTableRow = {
+    pid: 100,
+    ppid: 1,
+    pgid: 100,
+    tpgid,
+    tty: 'ttys004',
+    startTime: 'Thu Sep  3 16:02:01 2026',
+    stat: tpgid === 100 ? 'Ss+' : 'Ss',
+    command: loginWrapper ? '"/Applications/Orca shell login" -fp user' : '/bin/zsh'
+  }
+  return [
+    root,
+    ...(loginWrapper
+      ? [
+          {
+            ...root,
+            pid: 101,
+            ppid: 100,
+            pgid: 101,
+            stat: command === null ? 'S+' : 'S',
+            command: '-zsh'
+          }
+        ]
+      : []),
+    ...(command === null
+      ? []
+      : [{ ...root, pid: 102, ppid: loginWrapper ? 101 : 100, pgid: 102, stat: 'S+', command }])
+  ]
+}
+
+function createHandle(loginWrapper = false) {
+  const proc: IPty & { processNameIsSpawnFile: true } = {
+    pid: 100,
+    cols: 80,
+    rows: 24,
+    handleFlowControl: false,
+    process: loginWrapper ? '/Applications/Orca shell login' : '/bin/zsh',
+    processNameIsSpawnFile: true,
+    onData: () => ({ dispose() {} }),
+    onExit: () => ({ dispose() {} }),
+    write() {},
+    resize() {},
+    clear() {},
+    kill() {},
+    pause() {},
+    resume() {}
+  }
+  return createDaemonPtySubprocessHandle({
+    process: proc,
+    shellPath: '/bin/zsh',
+    spawnCwd: '/tmp',
+    env: {},
+    startupCommandDeliveredInShellArgs: false,
+    reportsChildExitStatus: true,
+    sessionId: 'static-name',
+    startupAgentRecognition: null
+  })
+}
+
+async function inspect(handle: ReturnType<typeof createHandle>) {
+  const session = new Session({
+    sessionId: 'static-name',
+    subprocess: handle,
+    shellReadySupported: false,
+    cols: 80,
+    rows: 24,
+    scrollback: 10
+  })
+  try {
+    return await inspectTerminalHostProcess({
+      sessionId: session.sessionId,
+      session,
+      authorityGeneration: 'generation',
+      nextObservationEpoch: () => 1
+    })
+  } finally {
+    session.dispose()
+  }
+}
+
+afterEach(() => {
+  vi.useRealTimers()
+  vi.restoreAllMocks()
+  vi.resetAllMocks()
+})
+
+describe.each(['linux', 'darwin'] as const)('static spawn-file foreground on %s', (platform) => {
+  it.each(['vim', 'sleep', 'node', 'npm', 'node /usr/bin/claude'])(
+    'resolves %s in both the synchronous tracker and host inspection',
+    async (command) => {
+      vi.spyOn(process, 'platform', 'get').mockReturnValue(platform)
+      const rows = table(command, platform === 'darwin')
+      readSnapshot.mockResolvedValue(rows)
+      readFresh.mockResolvedValue(rows)
+      readStrict.mockResolvedValue({ rows, capturedAgeMs: 0 })
+      const handle = createHandle(platform === 'darwin')
+      const expected = command.includes('claude') ? 'claude' : command
+      expect(handle.processNameIsSpawnFile).toBe(true)
+      expect(await handle.confirmForegroundProcess?.()).toBe(expected)
+      expect(handle.getForegroundProcess()).toBe(expected)
+      expect(await inspect(createHandle(platform === 'darwin'))).toMatchObject({
+        foregroundProcess: expected,
+        hasChildProcesses: true
+      })
+      expect(readStrict).toHaveBeenCalledTimes(1)
+    }
+  )
+
+  it('observes a command ending and returns to an idle login shell', async () => {
+    vi.spyOn(process, 'platform', 'get').mockReturnValue(platform)
+    const handle = createHandle(true)
+    readFresh.mockResolvedValue(table('vim', true))
+    expect(await handle.confirmForegroundProcess?.()).toBe('vim')
+    const rows = table(null, true)
+    readFresh.mockResolvedValue(rows)
+    readSnapshot.mockResolvedValue(rows)
+    readStrict.mockResolvedValue({ rows, capturedAgeMs: 0 })
+    expect(await handle.confirmForegroundProcess?.()).toBe('zsh')
+    const inspection = await inspect(handle)
+    expect(inspection).toMatchObject({
+      foregroundProcess: null,
+      hasChildProcesses: false,
+      childProcessEvidence: 'no-children'
+    })
+  })
+
+  it('does not interpret a failed process read as a childless shell', async () => {
+    vi.spyOn(process, 'platform', 'get').mockReturnValue(platform)
+    readFresh.mockRejectedValue(new Error('unreadable'))
+    readSnapshot.mockRejectedValue(new Error('unreadable'))
+    readStrict.mockRejectedValue(new Error('unreadable'))
+    const handle = createHandle()
+    expect(await handle.confirmForegroundProcess?.()).toBeNull()
+    const inspection = await inspect(handle)
+    expect(inspection).toMatchObject({
+      hasChildProcesses: true,
+      childProcessEvidence: 'unverifiable',
+      foregroundProcessEvidence: { verdict: 'unverifiable' }
+    })
+  })
+
+  it('retains ordinary foreground names across a failed background refresh', async () => {
+    vi.spyOn(process, 'platform', 'get').mockReturnValue(platform)
+    vi.useFakeTimers({ toFake: ['Date'] })
+    vi.setSystemTime(100_000)
+    readSnapshot.mockResolvedValue(table('vim'))
+    const handle = createHandle()
+    expect(handle.getForegroundProcess()).toBe('zsh')
+    await vi.waitFor(() => expect(handle.getForegroundProcess()).toBe('vim'))
+    readSnapshot.mockRejectedValue(new Error('unreadable'))
+    vi.setSystemTime(102_000)
+    expect(handle.getForegroundProcess()).toBe('vim')
+    await vi.waitFor(() => expect(readSnapshot).toHaveBeenCalledTimes(2))
+    expect(handle.getForegroundProcess()).toBe('vim')
+    handle.dispose()
+  })
+
+  it.each(['T', 'S'])(
+    'keeps the close guard live when the shell is foreground and a child has state %s',
+    async (stat) => {
+      vi.spyOn(process, 'platform', 'get').mockReturnValue(platform)
+      const rows = table(null, platform === 'darwin')
+      rows.push({ ...rows[0], pid: 102, ppid: rows.at(-1)!.pid, pgid: 102, stat, command: 'vim' })
+      readSnapshot.mockResolvedValue(rows)
+      readStrict.mockResolvedValue({ rows, capturedAgeMs: 0 })
+      const inspection = await inspect(createHandle(platform === 'darwin'))
+      expect(inspection).toMatchObject({
+        foregroundProcess: null,
+        hasChildProcesses: true,
+        childProcessEvidence: 'children'
+      })
+    }
+  )
+})
+
+it('ignores stopped/background children and another terminal beneath the same root', () => {
+  const rows = table(null)
+  rows.push({ ...rows[0], pid: 102, ppid: 100, pgid: 102, stat: 'T', command: 'vim' })
+  rows.push({ ...rows[0], pid: 103, ppid: 100, tty: 'ttys009', command: 'claude' })
+  expect(resolveSpawnFileForegroundFromRows(rows, 100)).toEqual({
+    available: true,
+    processName: 'zsh'
+  })
+  expect(resolveSpawnFileForegroundFromRows(rows, 999)).toEqual({
+    available: false,
+    processName: null
+  })
+})
+
+it('uses Windows job membership and the native process table for ordinary children', async () => {
+  vi.spyOn(process, 'platform', 'get').mockReturnValue('win32')
+  resolveWindows.mockResolvedValue({ available: true, processName: null })
+  members.mockReturnValue(new Set([100, 102]))
+  readWindows.mockResolvedValue([
+    { pid: 100, ppid: 1, name: 'pwsh.exe' },
+    { pid: 102, ppid: 100, name: 'vim.exe' }
+  ])
+  readStrict.mockRejectedValue(new Error('POSIX evidence unavailable'))
+  const handle = createHandle()
+  expect(await handle.confirmForegroundProcess?.()).toBe('vim.exe')
+  expect(await inspect(handle)).toMatchObject({
+    foregroundProcess: 'vim.exe',
+    hasChildProcesses: true
+  })
+})
+
+it('keeps missing Windows job membership unverifiable', async () => {
+  vi.spyOn(process, 'platform', 'get').mockReturnValue('win32')
+  resolveWindows.mockResolvedValue({ available: true, processName: null })
+  members.mockReturnValue(null)
+  readStrict.mockRejectedValue(new Error('POSIX evidence unavailable'))
+  expect(await inspect(createHandle())).toMatchObject({
+    foregroundProcess: null,
+    hasChildProcesses: true,
+    childProcessEvidence: 'unverifiable'
+  })
+})
+
+it('reports an idle Windows shell only when the owned job contains the shell alone', async () => {
+  vi.spyOn(process, 'platform', 'get').mockReturnValue('win32')
+  resolveWindows.mockResolvedValue({ available: true, processName: null })
+  members.mockReturnValue(new Set([100]))
+  readStrict.mockRejectedValue(new Error('POSIX evidence unavailable'))
+  expect(await inspect(createHandle())).toMatchObject({ hasChildProcesses: false })
+  expect(readWindows).not.toHaveBeenCalled()
+})
+
+it('keeps the Windows close guard live when a shell descendant is selected above another job', async () => {
+  vi.spyOn(process, 'platform', 'get').mockReturnValue('win32')
+  resolveWindows.mockResolvedValue({ available: true, processName: null })
+  members.mockReturnValue(new Set([100, 102, 103, 104]))
+  readWindows.mockResolvedValue([
+    { pid: 100, ppid: 1, name: 'pwsh.exe' },
+    { pid: 102, ppid: 100, name: 'vim.exe' },
+    { pid: 103, ppid: 100, name: 'cmd.exe' },
+    { pid: 104, ppid: 103, name: 'pwsh.exe' }
+  ])
+  readStrict.mockRejectedValue(new Error('POSIX evidence unavailable'))
+  const inspection = await inspect(createHandle())
+  expect(inspection).toMatchObject({ hasChildProcesses: true, childProcessEvidence: 'children' })
+})
diff --git a/src/main/daemon/pty-subprocess.ts b/src/main/daemon/pty-subprocess.ts
index 329d1ce5d6b5..1b5bc3d11021 100644
--- a/src/main/daemon/pty-subprocess.ts
+++ b/src/main/daemon/pty-subprocess.ts
@@ -84,7 +84,7 @@ export async function createPtySubprocess(opts: PtySubprocessOptions): Promise<S
 
   let spawned: SpawnedDaemonPty
   try {
-    spawned = spawnNativeDaemonPty({
+    spawned = await spawnNativeDaemonPty({
       shellPath: launch.shellPath,
       shellArgs: launch.shellArgs,
       spawnCwd: launch.spawnCwd,
diff --git a/src/main/daemon/pty-subprocess/bun-pty-job-control.integration.test.ts b/src/main/daemon/pty-subprocess/bun-pty-job-control.integration.test.ts
new file mode 100644
index 000000000000..2791f8f363b9
--- /dev/null
+++ b/src/main/daemon/pty-subprocess/bun-pty-job-control.integration.test.ts
@@ -0,0 +1,210 @@
+import { existsSync, mkdtempSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join, resolve } from 'node:path'
+import { describe, expect, it } from 'vitest'
+import { runProcess } from '../../../shared/child-process/run-process'
+import { orcadBunRuntimeFilename } from '../../../shared/orcad-artifacts'
+import { removeTreeSync } from '../../../shared/windows-transient-lock-removal'
+
+const runtimePath =
+  process.env.BUN_EXECUTABLE ??
+  resolve(__dirname, '../../../../out/orcad', orcadBunRuntimeFilename(process.platform))
+
+describe.skipIf(
+  process.platform === 'win32' || !existsSync(runtimePath) || !existsSync('/bin/bash')
+)('Bun terminal user job control', () => {
+  // Bash re-raises SIGHUP; Zsh exits with the signal number.
+  for (const [shell, expectedExitCode] of [
+    ['/bin/bash', 129],
+    ['/bin/zsh', 1]
+  ] as const) {
+    it.skipIf(!existsSync(shell))(
+      `gracefully closes an interactive ${shell} before the daemon force-kill deadline`,
+      async () => {
+        const directory = mkdtempSync(join(tmpdir(), 'orca-bun-shell-hangup-'))
+        try {
+          const entry = join(directory, 'shell-hangup.cjs')
+          writeFileSync(
+            entry,
+            `
+const {spawnBunPty} = require(${JSON.stringify(join(__dirname, 'bun-pty-process.ts'))})
+const {createDaemonPtySubprocessHandle} = require(${JSON.stringify(join(__dirname, 'subprocess-handle.ts'))})
+const {SessionTerminationController} = require(${JSON.stringify(join(__dirname, '../session-termination-controller.ts'))})
+const {existsSync} = require('node:fs')
+const {join} = require('node:path')
+const cwd = ${JSON.stringify(directory)}
+const ready = join(cwd, 'ready'), cleanup = join(cwd, 'hangup-cleanup')
+const shell = ${JSON.stringify(shell)}
+const env = {...process.env,PS1:'',ORCA_TEST_READY:ready,ORCA_TEST_CLEANUP:cleanup}
+const proc = spawnBunPty({file:shell,args:shell.endsWith('/bash')?['--noprofile','--norc','-i']:['-f','-i'],cwd,env,cols:80,rows:24})
+const subprocess = createDaemonPtySubprocessHandle({process:proc,shellPath:shell,spawnCwd:cwd,env,startupCommandDeliveredInShellArgs:false,reportsChildExitStatus:true,sessionId:'shell-hangup',startupAgentRecognition:null})
+let exited = false, forced = false, exitCode, elapsedMs, startedAt
+const forceKill = subprocess.forceKill
+subprocess.forceKill = () => {forced = true;forceKill()}
+const controller = new SessionTerminationController({sessionId:'shell-hangup',subprocess,launchAgent:null,isExited:()=>exited,releaseProducerPause:()=>proc.resume()})
+subprocess.onExit(code => {
+  exited = true
+  exitCode = code
+  elapsedMs = Date.now() - startedAt
+  controller.markPhysicalExit()
+  controller.cancelForceKillFallback()
+})
+const waitFor = async predicate => {
+  const deadline = Date.now() + 8000
+  while (!predicate()) {
+    if (Date.now() >= deadline) throw new Error('Timed out waiting for shell hangup')
+    await Bun.sleep(10)
+  }
+}
+;(async()=>{
+  try {
+    // Observe normal hangup cleanup without replacing the shell's SIGHUP handler.
+    proc.write(${JSON.stringify('trap \'printf cleaned > "$ORCA_TEST_CLEANUP"\' EXIT; printf ready > "$ORCA_TEST_READY"\r')})
+    await waitFor(() => existsSync(ready))
+    startedAt = Date.now()
+    controller.kill()
+    await waitFor(() => exited)
+    let reaped = false
+    try {process.kill(proc.pid, 0)} catch (error) {if(error.code==='ESRCH')reaped=true;else throw error}
+    console.log(JSON.stringify({cleaned:existsSync(cleanup),forced,exitCode,elapsedMs,reaped}))
+  } finally {
+    controller.cancelForceKillFallback()
+    if (!exited) {
+      subprocess.forceKill()
+      await waitFor(() => exited)
+    }
+    controller.disposeSubprocessHandle()
+  }
+})().catch(error => {console.error(error);process.exitCode=1})
+`
+          )
+          const result = await runProcess({
+            program: runtimePath,
+            args: [entry],
+            timeoutMs: 25_000
+          })
+          expect(result.timedOut).toBe(false)
+          expect(result.code, result.stderr).toBe(0)
+          const evidence = JSON.parse(result.stdout)
+          expect(evidence).toEqual({
+            cleaned: true,
+            forced: false,
+            exitCode: expectedExitCode,
+            elapsedMs: expect.any(Number),
+            reaped: true
+          })
+          expect(evidence.elapsedMs).toBeLessThan(5_000)
+        } finally {
+          removeTreeSync(directory)
+        }
+      }
+    )
+  }
+
+  it('keeps a real Ctrl-Z job suspended while pausing and resuming a background producer', async () => {
+    const directory = mkdtempSync(join(tmpdir(), 'orca-bun-job-control-'))
+    try {
+      writeFileSync(join(directory, 'producer.cjs'), 'setInterval(()=>console.log("flow-tick"),10)')
+      writeFileSync(
+        join(directory, 'sleeper.sh'),
+        'printf \'%s\' "$$" > sleeper-ready\nexec sleep 30\n'
+      )
+      const entry = join(directory, 'job-control.cjs')
+      writeFileSync(
+        entry,
+        `
+const {spawnBunPty} = require(${JSON.stringify(join(__dirname, 'bun-pty-process.ts'))})
+const {readPosixPtyProcessTable,forceKillPosixPtyProcessGroups} = require(${JSON.stringify(join(__dirname, '../../pty/posix-pty-process-groups.ts'))})
+const {existsSync,readFileSync} = require('node:fs')
+const ready = ${JSON.stringify(join(directory, 'sleeper-ready'))}
+const signals = []
+const proc = spawnBunPty({
+  file:'/bin/bash', args:['--noprofile','--norc','-i'], cwd:${JSON.stringify(directory)},
+  env:{...process.env,PS1:'',ORCA_TEST_RUNTIME:process.execPath},cols:80,rows:24
+}, {signalProcessGroup:(pgid,signal)=>{process.kill(-pgid,signal);signals.push([pgid,signal])}})
+let output = '', exited = false
+proc.onData(data => output += data)
+proc.onExit(() => {exited = true})
+const isAlive = pid => {
+  try {process.kill(pid, 0);return true}
+  catch (error) {if(error.code==='ESRCH')return false;throw error}
+}
+const rows = async () => {
+  const table = (await readPosixPtyProcessTable(proc.pid)).trim().split(/\\r?\\n/).map(row => {
+    const [pid,pgid,tty,state] = row.trim().split(/\\s+/)
+    return {pid:Number(pid),pgid:Number(pgid),tty,state}
+  }).filter(row => row.pid > 0 && row.state)
+  const root = table.find(row => row.pid === proc.pid)
+  // BusyBox discovery returns all processes; this probe owns only its shell's terminal.
+  return root ? table.filter(row => row.tty === root.tty) : []
+}
+const waitFor = async predicate => {
+  const deadline = Date.now() + 8000
+  while (Date.now() < deadline) {
+    const value = await predicate()
+    if (value) return value
+    await Bun.sleep(20)
+  }
+  throw new Error('Timed out waiting for terminal process state')
+}
+;(async()=>{
+  try {
+    proc.write('/bin/bash sleeper.sh\\r')
+    // A forked PID can appear before Bash gives its group the foreground terminal.
+    const sleeperPid = await waitFor(() => existsSync(ready) && Number(readFileSync(ready, 'utf8')))
+    const sleeper = await waitFor(async () => (await rows()).find(row => row.pid === sleeperPid))
+    proc.write('\\x1a')
+    await waitFor(async () => (await rows()).some(row => row.pid === sleeper.pid && row.state.startsWith('T')))
+    proc.write(${JSON.stringify('"$ORCA_TEST_RUNTIME" producer.cjs &\r')})
+    await waitFor(() => output.split('flow-tick').length > 5)
+    proc.pause()
+    await waitFor(() => signals.filter(([,signal]) => signal === 'SIGSTOP').length >= 2)
+    await Bun.sleep(100)
+    const pausedLength = output.length
+    await Bun.sleep(100)
+    const producerPaused = pausedLength === output.length
+    proc.resume()
+    await waitFor(() => signals.some(([,signal]) => signal === 'SIGCONT'))
+    await waitFor(() => output.length > pausedLength)
+    const sleeperAfter = (await rows()).find(row => row.pid === sleeper.pid)
+    console.log(JSON.stringify({producerPaused,producerResumed:true,userJobStopped:sleeperAfter?.state.startsWith('T')===true,userJobSignalled:signals.some(([pgid])=>pgid===sleeper.pgid)}))
+  } finally {
+    let ownedPids = []
+    try {
+      proc.resume()
+      const ownedRows = await rows()
+      ownedPids = ownedRows.map(row => row.pid)
+      const root = ownedRows.find(row => row.pid === proc.pid)
+      if (!root) throw new Error('Cleanup could not find the owned shell')
+      // Keep Bash running until it reaps its jobs; container PID 1 may not reap orphans.
+      forceKillPosixPtyProcessGroups(proc.pid, () => {throw new Error('Cleanup lost terminal ownership')}, {
+        signalProcessGroup: pgid => {if (pgid !== root.pgid) process.kill(-pgid, 'SIGKILL')}
+      })
+      process.kill(proc.pid, 'SIGCONT')
+      await waitFor(() => ownedPids.every(pid => pid === proc.pid || !isAlive(pid)))
+    } finally {
+      try {
+        forceKillPosixPtyProcessGroups(proc.pid, () => proc.kill('SIGKILL'))
+        await waitFor(() => exited && ownedPids.every(pid => !isAlive(pid)))
+      } finally {
+        proc.destroy()
+      }
+    }
+  }
+})().catch(error => {console.error(error);process.exitCode=1})
+`
+      )
+      const result = await runProcess({ program: runtimePath, args: [entry], timeoutMs: 25_000 })
+      expect(result.timedOut).toBe(false)
+      expect(result.code, result.stderr).toBe(0)
+      expect(JSON.parse(result.stdout)).toEqual({
+        producerPaused: true,
+        producerResumed: true,
+        userJobStopped: true,
+        userJobSignalled: false
+      })
+    } finally {
+      removeTreeSync(directory)
+    }
+  })
+})
diff --git a/src/main/daemon/pty-subprocess/bun-pty-process-capabilities.ts b/src/main/daemon/pty-subprocess/bun-pty-process-capabilities.ts
new file mode 100644
index 000000000000..8d236ab5aa8b
--- /dev/null
+++ b/src/main/daemon/pty-subprocess/bun-pty-process-capabilities.ts
@@ -0,0 +1,27 @@
+import type { BunRuntime } from './bun-pty-process-contract'
+
+function currentRuntime(): unknown {
+  return 'Bun' in globalThis ? globalThis.Bun : undefined
+}
+
+function isBunRuntime(runtime: unknown): runtime is BunRuntime {
+  return (
+    typeof runtime === 'object' &&
+    runtime !== null &&
+    'spawn' in runtime &&
+    typeof runtime.spawn === 'function' &&
+    'Terminal' in runtime &&
+    typeof runtime.Terminal === 'function'
+  )
+}
+
+export function canUseBunPty(runtime: unknown = currentRuntime()): boolean {
+  return isBunRuntime(runtime)
+}
+
+export function resolveBunRuntime(runtime: unknown = currentRuntime()): BunRuntime {
+  if (!isBunRuntime(runtime)) {
+    throw new Error('Bun terminal runtime is unavailable')
+  }
+  return runtime
+}
diff --git a/src/main/daemon/pty-subprocess/bun-pty-process-contract.ts b/src/main/daemon/pty-subprocess/bun-pty-process-contract.ts
new file mode 100644
index 000000000000..b43dd57a659d
--- /dev/null
+++ b/src/main/daemon/pty-subprocess/bun-pty-process-contract.ts
@@ -0,0 +1,72 @@
+import type * as pty from 'node-pty'
+import type { JobTerminationOutcome } from '../../windows/windows-pty-job'
+import type { WindowsBunPtyJob } from './windows-bun-pty-job'
+import type { createWindowsBunPtyLaunch } from './windows-bun-pty-launch'
+
+export type BunTerminal = {
+  closed: boolean
+  write(data: string | ArrayBufferView): number
+  resize(cols: number, rows: number): void
+  close(): void
+}
+
+export type BunSubprocess = {
+  pid: number
+  terminal: BunTerminal
+  exited: Promise<number>
+  signalCode?: string | null
+  kill(signal?: string | number): void
+}
+
+export type BunTerminalOptions = {
+  cols: number
+  rows: number
+  name: string
+  data(terminal: BunTerminal, data: Uint8Array<ArrayBuffer>): void
+  exit?(terminal: BunTerminal, exitCode: number, signal: string | null): void
+  drain?(terminal: BunTerminal): void
+}
+
+export type BunRuntime = {
+  Terminal: new (options: BunTerminalOptions) => BunTerminal
+  spawn(
+    command: string[],
+    options: {
+      cwd: string
+      env: Record<string, string>
+      terminal: BunTerminal | BunTerminalOptions
+      windowsVerbatimArguments?: boolean
+      onExit?(process: BunSubprocess, exitCode: number, signalCode: string | null): void
+    }
+  ): BunSubprocess
+}
+
+export type BunPtyProcess = pty.IPty & {
+  destroy(): void
+  processNameIsSpawnFile?: true
+  jobRootProcessIsWrapper?: true
+  shellProcessId?: number
+  waitForSpawn?(): Promise<void>
+  terminateOwnedTree?(): JobTerminationOutcome
+  listOwnedProcessIds?(): readonly number[] | null
+  signalProcess?(signal: string): void
+}
+
+export type BunPtySpawnArgs = {
+  file: string
+  args: string[]
+  cwd: string
+  env: Record<string, string>
+  cols: number
+  rows: number
+}
+
+export type SpawnBunPtyDeps = {
+  platform?: NodeJS.Platform
+  runtime?: BunRuntime
+  assignHostJob?: () => boolean
+  createJob?: (pid: number) => WindowsBunPtyJob | null
+  createWindowsLaunch?: typeof createWindowsBunPtyLaunch
+  readProcessTable?: () => string
+  signalProcessGroup?: (pgid: number, signal: NodeJS.Signals) => void
+}
diff --git a/src/main/daemon/pty-subprocess/bun-pty-process-flow-control.test.ts b/src/main/daemon/pty-subprocess/bun-pty-process-flow-control.test.ts
new file mode 100644
index 000000000000..5c4a438238b8
--- /dev/null
+++ b/src/main/daemon/pty-subprocess/bun-pty-process-flow-control.test.ts
@@ -0,0 +1,387 @@
+import { constants } from 'node:os'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { createBunPtyProducerFlowControl } from './bun-pty-process-flow-control'
+
+const TABLE = '4321 4321 pts/test T\n4322 4322 pts/test'
+const settled = (): Promise<void> => new Promise((resolve) => setImmediate(resolve))
+
+function createHarness() {
+  let exited = false
+  const reads: { resolve: (table: string) => void; signal: AbortSignal }[] = []
+  const readProcessTableAsync = vi.fn(
+    (signal: AbortSignal) =>
+      new Promise<string>((resolve) => {
+        reads.push({ resolve, signal })
+      })
+  )
+  const signalProcessGroup = vi.fn<(pgid: number, signal: NodeJS.Signals) => void>()
+  const kill = vi.fn()
+  const flow = createBunPtyProducerFlowControl({
+    platform: 'linux',
+    processHandle: { pid: 4321, kill, terminal: { closed: false, close() {} } },
+    windowsJob: null,
+    isExited: () => exited,
+    readProcessTable: () => TABLE,
+    readProcessTableAsync,
+    signalProcessGroup
+  })
+  return {
+    flow,
+    reads,
+    kill,
+    readProcessTableAsync,
+    signalProcessGroup,
+    exit: () => {
+      exited = true
+    }
+  }
+}
+
+afterEach(() => vi.useRealTimers())
+
+describe('asynchronous POSIX producer flow control', () => {
+  it.each(['S', 'R', ''])(
+    'leaves jobs running unless the shell is observed stopped (state %s)',
+    async (state) => {
+      const harness = createHarness()
+      harness.flow.pause()
+      expect(harness.kill.mock.calls).toEqual([[constants.signals.SIGSTOP]])
+      expect(harness.readProcessTableAsync).not.toHaveBeenCalled()
+      await settled()
+      harness.reads[0].resolve(TABLE.replace('pts/test T', `pts/test ${state}`))
+      await settled()
+      expect(harness.signalProcessGroup).not.toHaveBeenCalled()
+      harness.flow.resume()
+      await settled()
+      harness.reads[1].resolve(TABLE)
+      await settled()
+      expect(harness.kill.mock.calls).toEqual([
+        [constants.signals.SIGSTOP],
+        [constants.signals.SIGCONT]
+      ])
+      expect(harness.signalProcessGroup).not.toHaveBeenCalled()
+    }
+  )
+
+  it('does not attempt a group pause after the owned shell cannot be stopped', async () => {
+    const harness = createHarness()
+    harness.kill.mockImplementationOnce(() => {
+      throw Object.assign(new Error('denied'), { code: 'EPERM' })
+    })
+    harness.flow.pause()
+    await settled()
+    harness.flow.resume()
+    await settled()
+    expect(harness.kill.mock.calls).toEqual([[constants.signals.SIGSTOP]])
+    expect(harness.readProcessTableAsync).not.toHaveBeenCalled()
+    expect(harness.signalProcessGroup).not.toHaveBeenCalled()
+  })
+
+  it('retries a failed resume lookup without another caller resume or stale group signals', async () => {
+    vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout'] })
+    const harness = createHarness()
+    harness.flow.pause()
+    await settled()
+    harness.reads[0].resolve(TABLE)
+    await settled()
+    harness.readProcessTableAsync.mockRejectedValueOnce(new Error('temporary ps failure'))
+    harness.flow.resume()
+    await settled()
+    expect(harness.signalProcessGroup.mock.calls).toEqual([
+      [4321, 'SIGSTOP'],
+      [4322, 'SIGSTOP']
+    ])
+    expect(harness.kill.mock.calls).toEqual([[constants.signals.SIGSTOP]])
+
+    await vi.advanceTimersByTimeAsync(1_000)
+    expect(harness.readProcessTableAsync).toHaveBeenCalledTimes(3)
+    harness.reads[1].resolve('4321 4321 pts/test T\n4322 4322 pts/other\n4323 4323 pts/test')
+    await settled()
+    expect(harness.signalProcessGroup.mock.calls.slice(2)).toEqual([[4321, 'SIGCONT']])
+    await vi.advanceTimersByTimeAsync(5_000)
+    expect(harness.readProcessTableAsync).toHaveBeenCalledTimes(3)
+  })
+
+  it.each(['pause', 'shutdown', 'exit'] as const)(
+    'cancels a scheduled resume retry after %s',
+    async (action) => {
+      vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout'] })
+      const harness = createHarness()
+      harness.flow.pause()
+      await settled()
+      harness.reads[0].resolve(TABLE)
+      await settled()
+      harness.readProcessTableAsync.mockRejectedValueOnce(new Error('temporary ps failure'))
+      harness.flow.resume()
+      await settled()
+      expect(vi.getTimerCount()).toBe(1)
+      if (action === 'pause') {
+        harness.flow.pause()
+        await settled()
+        harness.reads[1].resolve(TABLE)
+        await settled()
+      } else {
+        if (action === 'exit') {
+          harness.exit()
+        }
+        harness.flow.resumeForShutdown()
+      }
+      expect(vi.getTimerCount()).toBe(0)
+      const signals = harness.signalProcessGroup.mock.calls.length
+      await vi.advanceTimersByTimeAsync(5_000)
+      expect(harness.signalProcessGroup).toHaveBeenCalledTimes(signals)
+      expect(harness.readProcessTableAsync).toHaveBeenCalledTimes(action === 'pause' ? 3 : 2)
+    }
+  )
+
+  it('bounds retries while discovery stays unavailable and resumes after it recovers', async () => {
+    vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout'] })
+    const harness = createHarness()
+    harness.flow.pause()
+    await settled()
+    harness.reads[0].resolve(TABLE)
+    await settled()
+    harness.readProcessTableAsync.mockRejectedValue(new Error('ps unavailable'))
+    harness.flow.resume()
+    await settled()
+    await vi.advanceTimersByTimeAsync(2_000)
+    expect(harness.readProcessTableAsync).toHaveBeenCalledTimes(6)
+    expect(vi.getTimerCount()).toBe(1)
+    expect(harness.kill.mock.calls).toEqual([[constants.signals.SIGSTOP]])
+    expect(harness.signalProcessGroup).toHaveBeenCalledTimes(2)
+    harness.readProcessTableAsync.mockResolvedValue(TABLE)
+    await vi.advanceTimersByTimeAsync(500)
+    expect(harness.signalProcessGroup).toHaveBeenLastCalledWith(4321, 'SIGCONT')
+    expect(vi.getTimerCount()).toBe(0)
+  })
+
+  it('resumes a root-only suspension when process group discovery is unavailable throughout', async () => {
+    vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout'] })
+    const harness = createHarness()
+    harness.readProcessTableAsync.mockRejectedValue(new Error('ps unavailable'))
+    harness.flow.pause()
+    await settled()
+    harness.flow.resume()
+    await settled()
+    expect(harness.kill.mock.calls).toEqual([
+      [constants.signals.SIGSTOP],
+      [constants.signals.SIGCONT]
+    ])
+    expect(harness.signalProcessGroup).not.toHaveBeenCalled()
+    expect(vi.getTimerCount()).toBe(0)
+  })
+
+  it('reapplies pause after a partial resume and keeps the shell stopped until all jobs resume', async () => {
+    vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout'] })
+    const harness = createHarness()
+    const table = `${TABLE}\n4323 4323 pts/test`
+    let denyOnce = true
+    harness.signalProcessGroup.mockImplementation((pgid, signal) => {
+      if (pgid === 4323 && signal === 'SIGCONT' && denyOnce) {
+        denyOnce = false
+        throw Object.assign(new Error('denied'), { code: 'EPERM' })
+      }
+    })
+    harness.flow.pause()
+    await settled()
+    harness.reads[0].resolve(table)
+    await settled()
+    harness.flow.resume()
+    await settled()
+    harness.reads[1].resolve(table)
+    await settled()
+    expect(harness.signalProcessGroup.mock.calls.slice(3)).toEqual([
+      [4322, 'SIGCONT'],
+      [4323, 'SIGCONT']
+    ])
+    expect(vi.getTimerCount()).toBe(1)
+    harness.flow.pause()
+    await settled()
+    harness.reads[2].resolve(table)
+    await settled()
+    expect(harness.signalProcessGroup.mock.calls.slice(5)).toEqual([
+      [4321, 'SIGSTOP'],
+      [4322, 'SIGSTOP'],
+      [4323, 'SIGSTOP']
+    ])
+    expect(vi.getTimerCount()).toBe(0)
+    harness.flow.resume()
+    await settled()
+    harness.reads[3].resolve(table)
+    await settled()
+    expect(harness.signalProcessGroup.mock.calls.slice(8)).toEqual([
+      [4322, 'SIGCONT'],
+      [4323, 'SIGCONT'],
+      [4321, 'SIGCONT']
+    ])
+  })
+
+  it('does not delay the shell resume for a job group that already exited', async () => {
+    vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout'] })
+    const harness = createHarness()
+    harness.flow.pause()
+    await settled()
+    harness.reads[0].resolve(TABLE)
+    await settled()
+    harness.signalProcessGroup.mockImplementationOnce(() => {
+      throw Object.assign(new Error('gone'), { code: 'ESRCH' })
+    })
+    harness.flow.resume()
+    await settled()
+    harness.reads[1].resolve(TABLE)
+    await settled()
+    expect(harness.signalProcessGroup).toHaveBeenLastCalledWith(4321, 'SIGCONT')
+    expect(vi.getTimerCount()).toBe(0)
+  })
+
+  it('coalesces repeated pressure changes while discovery is pending', async () => {
+    const harness = createHarness()
+    harness.flow.pause()
+    await settled()
+    for (let i = 0; i < 1_000; i += 1) {
+      harness.flow.resume()
+      harness.flow.pause()
+    }
+    harness.flow.resume()
+    await settled()
+    expect(harness.readProcessTableAsync).toHaveBeenCalledOnce()
+    expect(harness.signalProcessGroup).not.toHaveBeenCalled()
+
+    harness.reads[0].resolve(TABLE)
+    await settled()
+    expect(harness.signalProcessGroup).not.toHaveBeenCalled()
+    expect(harness.kill.mock.calls).toEqual([
+      [constants.signals.SIGSTOP],
+      [constants.signals.SIGCONT]
+    ])
+
+    for (let i = 0; i < 20; i += 1) {
+      harness.flow.pause()
+      await settled()
+      harness.reads[2 * i + 1].resolve(TABLE)
+      await settled()
+      harness.flow.resume()
+      await settled()
+      harness.reads[2 * i + 2].resolve(TABLE)
+      await settled()
+    }
+    expect(harness.readProcessTableAsync).toHaveBeenCalledTimes(41)
+    expect(harness.signalProcessGroup).toHaveBeenCalledTimes(80)
+    expect(harness.signalProcessGroup).toHaveBeenLastCalledWith(4321, 'SIGCONT')
+  })
+
+  it('revalidates group ownership when resuming after a process id is reused', async () => {
+    const harness = createHarness()
+    harness.flow.pause()
+    await settled()
+    harness.reads[0].resolve(TABLE)
+    await settled()
+    harness.flow.resume()
+    await settled()
+    harness.reads[1].resolve('4321 4321 pts/test T\n4322 4322 pts/other\n4323 4323 pts/test')
+    await settled()
+
+    expect(harness.signalProcessGroup.mock.calls).toEqual([
+      [4321, 'SIGSTOP'],
+      [4322, 'SIGSTOP'],
+      [4321, 'SIGCONT']
+    ])
+  })
+
+  it('does not resume a still-paused session when pressure returns during a resume scan', async () => {
+    const harness = createHarness()
+    harness.flow.pause()
+    await settled()
+    harness.reads[0].resolve(TABLE)
+    await settled()
+    harness.flow.resume()
+    await settled()
+    harness.flow.pause()
+    harness.reads[1].resolve(TABLE)
+    await settled()
+    expect(harness.signalProcessGroup.mock.calls).toEqual([
+      [4321, 'SIGSTOP'],
+      [4322, 'SIGSTOP']
+    ])
+
+    harness.flow.resume()
+    await settled()
+    harness.reads[2].resolve(TABLE)
+    await settled()
+    expect(harness.signalProcessGroup).toHaveBeenLastCalledWith(4321, 'SIGCONT')
+  })
+
+  it.each(['shutdown', 'exit'] as const)('ignores a late scan after %s', async (action) => {
+    const harness = createHarness()
+    harness.flow.pause()
+    await settled()
+    if (action === 'shutdown') {
+      harness.flow.resumeForShutdown()
+      expect(harness.reads[0].signal.aborted).toBe(true)
+    } else {
+      harness.exit()
+    }
+    harness.reads[0].resolve(TABLE)
+    await settled()
+    expect(harness.signalProcessGroup).not.toHaveBeenCalled()
+    expect(harness.kill.mock.calls).toEqual(
+      action === 'shutdown'
+        ? [[constants.signals.SIGSTOP], [constants.signals.SIGCONT]]
+        : [[constants.signals.SIGSTOP]]
+    )
+  })
+
+  it('releases stopped groups before shutdown while an asynchronous resume is pending', async () => {
+    const harness = createHarness()
+    harness.flow.pause()
+    await settled()
+    harness.reads[0].resolve(TABLE)
+    await settled()
+    harness.flow.resume()
+    await settled()
+    harness.flow.resumeForShutdown()
+    expect(harness.reads[1].signal.aborted).toBe(true)
+    expect(harness.signalProcessGroup.mock.calls).toEqual([
+      [4321, 'SIGSTOP'],
+      [4322, 'SIGSTOP'],
+      [4322, 'SIGCONT'],
+      [4321, 'SIGCONT']
+    ])
+    harness.reads[1].resolve(TABLE)
+    await settled()
+    expect(harness.signalProcessGroup).toHaveBeenCalledTimes(4)
+  })
+
+  it('automatically retries a partially failed resume of a partially stopped tree', async () => {
+    vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout'] })
+    const harness = createHarness()
+    const table = `${TABLE}\n4323 4323 pts/test S`
+    harness.signalProcessGroup.mockImplementation((pgid, signal) => {
+      if (pgid === 4323 && signal === 'SIGSTOP') {
+        throw new Error('temporary stop failure')
+      }
+    })
+    harness.flow.pause()
+    await settled()
+    harness.reads[0].resolve(table)
+    await settled()
+    harness.signalProcessGroup.mockImplementationOnce(() => {
+      throw Object.assign(new Error('denied'), { code: 'EPERM' })
+    })
+    harness.flow.resume()
+    await settled()
+    harness.reads[1].resolve(table)
+    await settled()
+    await vi.advanceTimersByTimeAsync(500)
+    harness.reads[2].resolve(table)
+    await settled()
+    expect(harness.signalProcessGroup.mock.calls).toEqual([
+      [4321, 'SIGSTOP'],
+      [4322, 'SIGSTOP'],
+      [4323, 'SIGSTOP'],
+      [4322, 'SIGCONT'],
+      [4322, 'SIGCONT'],
+      [4321, 'SIGCONT']
+    ])
+  })
+})
diff --git a/src/main/daemon/pty-subprocess/bun-pty-process-flow-control.ts b/src/main/daemon/pty-subprocess/bun-pty-process-flow-control.ts
new file mode 100644
index 000000000000..5b7dfd7a3133
--- /dev/null
+++ b/src/main/daemon/pty-subprocess/bun-pty-process-flow-control.ts
@@ -0,0 +1,185 @@
+import { constants } from 'node:os'
+import type { WindowsBunPtyJob } from './windows-bun-pty-job'
+import { isPosixPtyRootStopped, readPosixPtyProcessTable } from '../../pty/posix-pty-process-groups'
+
+import { createBunPtyProcessSuspension } from './bun-pty-process-suspension'
+
+const TRANSITION_RETRY_MS = 500
+
+type BunPtyProcessHandle = Readonly<{
+  pid: number
+  kill(signal?: string | number): void
+  terminal: Readonly<{ closed: boolean; close(): void }>
+}>
+
+export type BunPtyProducerFlowControl = Readonly<{
+  pause(): void
+  resume(): void
+  resumeForShutdown(): void
+}>
+
+export function createBunPtyProducerFlowControl(
+  options: Readonly<{
+    platform: NodeJS.Platform
+    processHandle: BunPtyProcessHandle
+    windowsJob: WindowsBunPtyJob | null
+    isExited: () => boolean
+    readProcessTable?: () => string
+    readProcessTableAsync?: (signal: AbortSignal) => Promise<string>
+    signalProcessGroup?: (pgid: number, signal: NodeJS.Signals) => void
+  }>
+): BunPtyProducerFlowControl {
+  let state: 'running' | 'paused' | 'uncertain' = 'running'
+  let pauseRequested = false
+  let shuttingDown = false
+  let pendingRead: AbortController | undefined
+  let transitionRetry: ReturnType<typeof setTimeout> | undefined
+  let pauseDenied = false
+  const signalRoot = (signal: 'SIGSTOP' | 'SIGCONT'): void => {
+    // The runtime's named STOP/CONT signals are not portable across POSIX platforms.
+    options.processHandle.kill(constants.signals[signal])
+  }
+
+  const suspension = createBunPtyProcessSuspension({
+    pid: options.processHandle.pid,
+    platform: options.platform,
+    signalRoot,
+    readProcessTable: options.readProcessTable,
+    signalProcessGroup: options.signalProcessGroup
+  })
+  const pausePermanentlyDenied = (error: unknown): boolean =>
+    error instanceof Error && 'code' in error && (error.code === 'EPERM' || error.code === 'EACCES')
+
+  const clearTransitionRetry = (): void => {
+    clearTimeout(transitionRetry)
+    transitionRetry = undefined
+  }
+
+  const needsTransition = (): boolean =>
+    !shuttingDown && !options.isExited() && state !== (pauseRequested ? 'paused' : 'running')
+
+  const retryTransition = (): void => {
+    if (!needsTransition() || transitionRetry) {
+      return
+    }
+    // Callers send transitions once; retain the obligation until fresh ownership confirms every group.
+    transitionRetry = setTimeout(() => {
+      transitionRetry = undefined
+      reconcile()
+    }, TRANSITION_RETRY_MS)
+    transitionRetry.unref?.()
+  }
+
+  const reconcile = (): void => {
+    if (!needsTransition() || pendingRead) {
+      return
+    }
+    if (options.platform === 'win32') {
+      const succeeded = pauseRequested ? options.windowsJob?.pause() : options.windowsJob?.resume()
+      state = succeeded ? (pauseRequested ? 'paused' : 'running') : 'uncertain'
+      if (pauseRequested && !succeeded) {
+        pauseRequested = false
+      }
+      retryTransition()
+      return
+    }
+    if (pauseRequested && state === 'running') {
+      try {
+        signalRoot('SIGSTOP')
+        state = 'uncertain'
+      } catch (error) {
+        if (pausePermanentlyDenied(error)) {
+          pauseDenied = true
+          pauseRequested = false
+        }
+        retryTransition()
+        return
+      }
+    }
+    const controller = new AbortController()
+    pendingRead = controller
+    // Process groups change as the shell runs jobs; revalidate them without blocking PTY output.
+    void Promise.resolve()
+      .then(() =>
+        options.readProcessTableAsync
+          ? options.readProcessTableAsync(controller.signal)
+          : options.readProcessTable
+            ? options.readProcessTable()
+            : readPosixPtyProcessTable(options.processHandle.pid, controller.signal)
+      )
+      .catch(() => '')
+      .then((table) => {
+        pendingRead = undefined
+        if (!needsTransition()) {
+          return
+        }
+        const nextPaused = pauseRequested
+        // Partial signals require a fresh transition even if the requested state changes again.
+        state = 'uncertain'
+        if (nextPaused) {
+          // Signal delivery is asynchronous; prove the shell stopped before suspending its jobs.
+          if (!isPosixPtyRootStopped(table, options.processHandle.pid)) {
+            retryTransition()
+            return
+          }
+          suspension.signal('SIGSTOP', table, true)
+        } else if (suspension.hasStoppedGroups()) {
+          suspension.signal('SIGCONT', table, true)
+        } else {
+          signalRoot('SIGCONT')
+        }
+        state = nextPaused ? 'paused' : 'running'
+      })
+      .catch((error) => {
+        if (pauseRequested && pausePermanentlyDenied(error)) {
+          pauseDenied = true
+          pauseRequested = false
+          reconcile()
+        } else {
+          retryTransition()
+        }
+      })
+  }
+
+  return {
+    pause() {
+      if (shuttingDown || options.isExited() || pauseDenied) {
+        return
+      }
+      clearTransitionRetry()
+      pauseRequested = true
+      reconcile()
+    },
+    resume() {
+      clearTransitionRetry()
+      pauseDenied = false
+      pauseRequested = false
+      reconcile()
+    },
+    resumeForShutdown() {
+      clearTransitionRetry()
+      shuttingDown = true
+      if (options.platform === 'win32') {
+        if (!options.isExited()) {
+          options.windowsJob?.resume()
+        }
+        state = 'running'
+        return
+      }
+      pendingRead?.abort()
+      try {
+        if (!options.isExited() && state !== 'running') {
+          // Teardown must release stopped jobs before the root receives its exit signal.
+          if (suspension.hasStoppedGroups()) {
+            suspension.signal('SIGCONT')
+          } else {
+            signalRoot('SIGCONT')
+          }
+        }
+      } catch {
+        // A failed resume must not prevent the caller from terminating the PTY.
+      }
+      state = 'running'
+    }
+  }
+}
diff --git a/src/main/daemon/pty-subprocess/bun-pty-process-pause-retry.test.ts b/src/main/daemon/pty-subprocess/bun-pty-process-pause-retry.test.ts
new file mode 100644
index 000000000000..cbda02305ea9
--- /dev/null
+++ b/src/main/daemon/pty-subprocess/bun-pty-process-pause-retry.test.ts
@@ -0,0 +1,128 @@
+import { constants } from 'node:os'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { createBunPtyProducerFlowControl } from './bun-pty-process-flow-control'
+
+const TABLE = '4321 4321 pts/test T\n4322 4322 pts/test S'
+const settled = (): Promise<void> => new Promise((resolve) => setImmediate(resolve))
+
+function createHarness() {
+  let exited = false
+  const kill = vi.fn()
+  const signalProcessGroup = vi.fn()
+  const readProcessTableAsync = vi.fn<(signal: AbortSignal) => Promise<string>>()
+  const flow = createBunPtyProducerFlowControl({
+    platform: 'linux',
+    processHandle: { pid: 4321, kill, terminal: { closed: false, close() {} } },
+    windowsJob: null,
+    isExited: () => exited,
+    readProcessTableAsync,
+    signalProcessGroup
+  })
+  return { flow, kill, readProcessTableAsync, signalProcessGroup, exit: () => (exited = true) }
+}
+
+afterEach(() => vi.useRealTimers())
+
+describe('Bun producer pause retry', () => {
+  it('retries a failed root suspension before attempting any group signals', async () => {
+    vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout'] })
+    const harness = createHarness()
+    harness.kill.mockImplementationOnce(() => {
+      throw new Error('temporary signal rejection')
+    })
+    harness.readProcessTableAsync.mockResolvedValue(TABLE)
+    harness.flow.pause()
+    await settled()
+    expect(harness.readProcessTableAsync).not.toHaveBeenCalled()
+    await vi.advanceTimersByTimeAsync(500)
+    expect(harness.kill.mock.calls).toEqual([
+      [constants.signals.SIGSTOP],
+      [constants.signals.SIGSTOP]
+    ])
+    expect(harness.signalProcessGroup.mock.calls).toEqual([
+      [4321, 'SIGSTOP'],
+      [4322, 'SIGSTOP']
+    ])
+    expect(vi.getTimerCount()).toBe(0)
+  })
+
+  it('keeps ownership discovery pending when the stopped root has no controlling tty', async () => {
+    vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout'] })
+    const harness = createHarness()
+    harness.readProcessTableAsync.mockResolvedValueOnce('4321 4321 ? T').mockResolvedValue(TABLE)
+    harness.flow.pause()
+    await settled()
+    expect(harness.signalProcessGroup).not.toHaveBeenCalled()
+    await vi.advanceTimersByTimeAsync(500)
+    expect(harness.signalProcessGroup.mock.calls).toEqual([
+      [4321, 'SIGSTOP'],
+      [4322, 'SIGSTOP']
+    ])
+    expect(vi.getTimerCount()).toBe(0)
+  })
+
+  it.each(['lookup failure', 'shell still running'])(
+    'eventually stops jobs after a transient %s without another pause request',
+    async (failure) => {
+      vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout'] })
+      const harness = createHarness()
+      if (failure === 'lookup failure') {
+        harness.readProcessTableAsync.mockRejectedValueOnce(new Error('ps timed out'))
+      } else {
+        harness.readProcessTableAsync.mockResolvedValueOnce(TABLE.replace('test T', 'test S'))
+      }
+      harness.readProcessTableAsync.mockResolvedValue(TABLE)
+      harness.flow.pause()
+      await settled()
+      expect(harness.kill.mock.calls).toEqual([[constants.signals.SIGSTOP]])
+      expect(harness.signalProcessGroup).not.toHaveBeenCalled()
+      await vi.advanceTimersByTimeAsync(499)
+      expect(harness.readProcessTableAsync).toHaveBeenCalledOnce()
+      await vi.advanceTimersByTimeAsync(1)
+      expect(harness.signalProcessGroup.mock.calls).toEqual([
+        [4321, 'SIGSTOP'],
+        [4322, 'SIGSTOP']
+      ])
+      expect(vi.getTimerCount()).toBe(0)
+      harness.flow.resume()
+      await settled()
+      expect(harness.signalProcessGroup.mock.calls.slice(2)).toEqual([
+        [4322, 'SIGCONT'],
+        [4321, 'SIGCONT']
+      ])
+    }
+  )
+
+  it.each(['resume', 'shutdown', 'exit'] as const)(
+    'bounds failed pause probes and cancels them after %s',
+    async (action) => {
+      vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout'] })
+      const harness = createHarness()
+      harness.readProcessTableAsync.mockRejectedValue(new Error('ps unavailable'))
+      harness.flow.pause()
+      await settled()
+      await vi.advanceTimersByTimeAsync(2_000)
+      expect(harness.readProcessTableAsync).toHaveBeenCalledTimes(5)
+      expect(vi.getTimerCount()).toBe(1)
+      expect(harness.signalProcessGroup).not.toHaveBeenCalled()
+      if (action === 'resume') {
+        harness.flow.resume()
+      } else {
+        if (action === 'exit') {
+          harness.exit()
+        }
+        harness.flow.resumeForShutdown()
+      }
+      await settled()
+      const reads = harness.readProcessTableAsync.mock.calls.length
+      await vi.advanceTimersByTimeAsync(5_000)
+      expect(harness.readProcessTableAsync).toHaveBeenCalledTimes(reads)
+      expect(vi.getTimerCount()).toBe(0)
+      expect(harness.kill.mock.calls).toEqual(
+        action === 'exit'
+          ? [[constants.signals.SIGSTOP]]
+          : [[constants.signals.SIGSTOP], [constants.signals.SIGCONT]]
+      )
+    }
+  )
+})
diff --git a/src/main/daemon/pty-subprocess/bun-pty-process-runtime.ts b/src/main/daemon/pty-subprocess/bun-pty-process-runtime.ts
new file mode 100644
index 000000000000..b64097950433
--- /dev/null
+++ b/src/main/daemon/pty-subprocess/bun-pty-process-runtime.ts
@@ -0,0 +1,311 @@
+import { constants } from 'node:os'
+import {
+  assignCurrentProcessToBunPtyHostJob,
+  createWindowsBunPtyJob,
+  type WindowsBunPtyJob
+} from './windows-bun-pty-job'
+import { createWindowsBunPtyLaunch, type WindowsBunPtyLaunch } from './windows-bun-pty-launch'
+import type {
+  BunPtyProcess,
+  BunPtySpawnArgs,
+  BunSubprocess,
+  BunTerminal,
+  BunTerminalOptions,
+  SpawnBunPtyDeps
+} from './bun-pty-process-contract'
+import { resolveBunRuntime } from './bun-pty-process-capabilities'
+import { createBunPtyProducerFlowControl } from './bun-pty-process-flow-control'
+
+export function spawnBunPty(args: BunPtySpawnArgs, deps: SpawnBunPtyDeps = {}): BunPtyProcess {
+  const runtime = resolveBunRuntime(deps.runtime)
+
+  const platform = deps.platform ?? process.platform
+  let processHandle: BunSubprocess
+  let windowsLaunch: WindowsBunPtyLaunch | null = null
+  let windowsJob: WindowsBunPtyJob | null = null
+  let windowsTerminal: BunTerminal | null = null
+  let processExitCode: number | undefined
+  let terminalFinished = false
+  let clearInFlight: Promise<number> | null = null
+  const dataListeners = new Set<(data: string) => void>()
+  const exitListeners = new Set<(event: { exitCode: number; signal?: number }) => void>()
+  const decoder = new TextDecoder()
+  let pendingData = ''
+  let exited = false
+  let exitCode = 0
+  let exitSignal: number | undefined
+  // Keep a closed Bun native handle from escaping as a daemon RPC failure.
+  let terminalUnavailable = false
+  let appliedCols = args.cols
+  let appliedRows = args.rows
+
+  const emitData = (data: string): void => {
+    if (dataListeners.size === 0) {
+      pendingData = (pendingData + data).slice(-512 * 1024)
+      return
+    }
+    for (const listener of dataListeners) {
+      listener(data)
+    }
+  }
+  const onProcessExit = (code: number): void => {
+    processExitCode = code
+    windowsLaunch?.dispose()
+    if (!windowsTerminal || terminalFinished) {
+      emitExit(code)
+      return
+    }
+    // ConPTY closes off-thread; retain listeners until its final frame reaches EOF.
+    if (!windowsTerminal.closed) {
+      windowsTerminal.close()
+    }
+  }
+
+  const emitExit = (code: number): void => {
+    if (exited) {
+      return
+    }
+    exited = true
+    producerFlowControl.resumeForShutdown()
+    windowsLaunch?.readShellProcessId()
+    exitCode = code
+    exitSignal = Object.entries(constants.signals).find(
+      ([name]) => name === processHandle.signalCode
+    )?.[1]
+    const pending = decoder.decode()
+    if (pending) {
+      emitData(pending)
+    }
+    for (const dispose of [
+      () => (processHandle.terminal.closed ? undefined : processHandle.terminal.close()),
+      () => windowsJob?.close()
+    ]) {
+      try {
+        dispose()
+      } catch (error) {
+        console.warn('[daemon/pty] PTY cleanup failed:', error)
+      }
+    }
+    for (const listener of exitListeners) {
+      listener({ exitCode: code, ...(exitSignal === undefined ? {} : { signal: exitSignal }) })
+    }
+    dataListeners.clear()
+    exitListeners.clear()
+  }
+
+  if (platform === 'win32') {
+    if (!(deps.assignHostJob ?? assignCurrentProcessToBunPtyHostJob)()) {
+      throw new Error('Windows Bun PTY host crash ownership is unavailable')
+    }
+    windowsLaunch = (deps.createWindowsLaunch ?? createWindowsBunPtyLaunch)(args)
+  }
+  try {
+    const terminalOptions: BunTerminalOptions = {
+      cols: args.cols,
+      rows: args.rows,
+      name: args.env.TERM ?? 'xterm-256color',
+      data: (_terminal, data) => {
+        const decoded = decoder.decode(data, { stream: true })
+        if (decoded) {
+          emitData(decoded)
+        }
+      },
+      exit() {
+        terminalFinished = true
+        if (processExitCode !== undefined) {
+          emitExit(processExitCode)
+        }
+      }
+    }
+    // Inline Bun terminals cannot be reused by the Windows clear command.
+    if (windowsLaunch) {
+      windowsTerminal = new runtime.Terminal(terminalOptions)
+    }
+    processHandle = runtime.spawn(windowsLaunch?.command ?? [args.file, ...args.args], {
+      cwd: args.cwd,
+      env: windowsLaunch?.env ?? args.env,
+      ...(windowsLaunch
+        ? {
+            windowsVerbatimArguments: windowsLaunch.windowsVerbatimArguments
+          }
+        : {}),
+      terminal: windowsTerminal ?? terminalOptions
+    })
+  } catch (error) {
+    windowsTerminal?.close()
+    windowsLaunch?.dispose()
+    throw error
+  }
+  if (windowsLaunch) {
+    try {
+      windowsJob = (deps.createJob ?? createWindowsBunPtyJob)(processHandle.pid)
+      if (!windowsJob) {
+        throw new Error('Windows Bun PTY job ownership is unavailable')
+      }
+      windowsLaunch.release()
+    } catch (error) {
+      windowsJob?.terminate()
+      try {
+        processHandle.kill('SIGTERM')
+      } catch {
+        // The failed gate release still owns cleanup through the job when available.
+      }
+      if (!processHandle.terminal.closed) {
+        processHandle.terminal.close()
+      }
+      windowsJob?.close()
+      windowsLaunch.dispose()
+      // A running gate can temporarily lock its private working directory on Windows.
+      const disposeLaunch = (): void => windowsLaunch?.dispose()
+      void processHandle.exited.then(disposeLaunch, disposeLaunch)
+      throw error
+    }
+  }
+  void processHandle.exited.then(onProcessExit, () => onProcessExit(1))
+
+  const producerFlowControl = createBunPtyProducerFlowControl({
+    platform,
+    processHandle,
+    windowsJob,
+    isExited: () => exited,
+    ...(deps.readProcessTable ? { readProcessTable: deps.readProcessTable } : {}),
+    ...(deps.signalProcessGroup ? { signalProcessGroup: deps.signalProcessGroup } : {})
+  })
+
+  const windowsCapabilities = windowsJob
+    ? {
+        waitForSpawn: () => windowsLaunch?.waitForSpawn(processHandle.exited) ?? Promise.resolve(),
+        terminateOwnedTree: () => windowsJob?.terminate() ?? 'unavailable',
+        listOwnedProcessIds: () => windowsJob?.listProcessIds() ?? null,
+        jobRootProcessIsWrapper: true as const,
+        signalProcess(signal: string) {
+          if (signal === 'SIGWINCH') {
+            return
+          }
+          if (windowsJob?.terminate() === 'terminated') {
+            return
+          }
+          try {
+            processHandle.kill(signal)
+          } finally {
+            if (!processHandle.terminal.closed) {
+              processHandle.terminal.close()
+            }
+          }
+        }
+      }
+    : {}
+
+  const clearCapability = windowsLaunch
+    ? {
+        clear() {
+          if (exited || clearInFlight) {
+            return
+          }
+          try {
+            const clearProcess = runtime.spawn(windowsLaunch.clearCommand, {
+              cwd: args.cwd,
+              env: args.env,
+              terminal: processHandle.terminal,
+              windowsVerbatimArguments: true
+            })
+            clearInFlight = clearProcess.exited
+            const settled = (): void => {
+              clearInFlight = null
+            }
+            void clearInFlight.then(settled, settled)
+          } catch {
+            clearInFlight = null
+          }
+        }
+      }
+    : {}
+
+  const terminate = (signal: string): void => {
+    producerFlowControl.resumeForShutdown()
+    const treeTerminated = windowsJob?.terminate() === 'terminated'
+    try {
+      processHandle.kill(signal)
+    } catch (error) {
+      if (!treeTerminated) {
+        throw error
+      }
+    }
+  }
+
+  return {
+    pid: processHandle.pid,
+    get shellProcessId() {
+      return windowsLaunch?.readShellProcessId()
+    },
+    handleFlowControl: false,
+    processNameIsSpawnFile: true,
+    clear() {},
+    process: args.file,
+    get cols() {
+      return appliedCols
+    },
+    get rows() {
+      return appliedRows
+    },
+    onData(listener) {
+      if (pendingData) {
+        const data = pendingData
+        pendingData = ''
+        listener(data)
+      }
+      if (exited) {
+        return { dispose() {} }
+      }
+      dataListeners.add(listener)
+      return { dispose: () => dataListeners.delete(listener) }
+    },
+    onExit(listener) {
+      if (exited) {
+        listener({ exitCode, ...(exitSignal === undefined ? {} : { signal: exitSignal }) })
+        return { dispose() {} }
+      }
+      exitListeners.add(listener)
+      return { dispose: () => exitListeners.delete(listener) }
+    },
+    write(data) {
+      if (exited || terminalUnavailable || processHandle.terminal.closed) {
+        return
+      }
+      try {
+        processHandle.terminal.write(data)
+      } catch {
+        terminalUnavailable = true
+      }
+    },
+    resize(cols, rows) {
+      if (exited || terminalUnavailable || processHandle.terminal.closed) {
+        return
+      }
+      try {
+        processHandle.terminal.resize(cols, rows)
+        appliedCols = cols
+        appliedRows = rows
+      } catch {
+        terminalUnavailable = true
+      }
+    },
+    ...clearCapability,
+    ...producerFlowControl,
+    ...windowsCapabilities,
+    // Interactive POSIX shells ignore SIGTERM.
+    kill(signal = platform === 'win32' ? 'SIGTERM' : 'SIGHUP') {
+      if (!exited) {
+        terminate(signal)
+      }
+    },
+    destroy() {
+      if (!exited) {
+        terminate(platform === 'win32' ? 'SIGTERM' : 'SIGHUP')
+      }
+      if (!processHandle.terminal.closed) {
+        processHandle.terminal.close()
+      }
+    }
+  }
+}
diff --git a/src/main/daemon/pty-subprocess/bun-pty-process-suspension.test.ts b/src/main/daemon/pty-subprocess/bun-pty-process-suspension.test.ts
new file mode 100644
index 000000000000..da7bf0c09e3e
--- /dev/null
+++ b/src/main/daemon/pty-subprocess/bun-pty-process-suspension.test.ts
@@ -0,0 +1,214 @@
+import { constants } from 'node:os'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { createBunPtyProducerFlowControl } from './bun-pty-process-flow-control'
+
+const TABLE = '4321 4321 pts/test T\n4322 4322 pts/test S\n4323 4323 pts/test T'
+const settled = (): Promise<void> => new Promise((resolve) => setImmediate(resolve))
+
+function harness(platform: NodeJS.Platform = 'linux') {
+  let exited = false
+  const kill = vi.fn()
+  const signalProcessGroup = vi.fn()
+  const readProcessTableAsync = vi.fn(async () => TABLE)
+  const windowsJob = {
+    listProcessIds: () => [],
+    pause: vi.fn(() => true),
+    resume: vi.fn(() => true),
+    terminate: () => 'terminated' as const,
+    close() {}
+  }
+  const flow = createBunPtyProducerFlowControl({
+    platform,
+    processHandle: { pid: 4321, kill, terminal: { closed: false, close() {} } },
+    windowsJob,
+    isExited: () => exited,
+    readProcessTable: () => TABLE,
+    readProcessTableAsync,
+    signalProcessGroup
+  })
+  return {
+    flow,
+    kill,
+    signalProcessGroup,
+    readProcessTableAsync,
+    windowsJob,
+    exit: () => (exited = true)
+  }
+}
+
+afterEach(() => vi.useRealTimers())
+
+describe('flow-control suspension ownership', () => {
+  it.each(['resume', 'shutdown'] as const)(
+    'preserves a Ctrl-Z stopped job during %s',
+    async (action) => {
+      const h = harness()
+      h.flow.pause()
+      await settled()
+      h.readProcessTableAsync.mockResolvedValue(TABLE.replace('4322 pts/test S', '4322 pts/test T'))
+      if (action === 'resume') {
+        h.flow.resume()
+      } else {
+        h.flow.resumeForShutdown()
+      }
+      await settled()
+      expect(h.signalProcessGroup.mock.calls).toEqual([
+        [4321, 'SIGSTOP'],
+        [4322, 'SIGSTOP'],
+        [4322, 'SIGCONT'],
+        [4321, 'SIGCONT']
+      ])
+    }
+  )
+
+  it('does not resume a group it already released when another group needs a retry', async () => {
+    vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout'] })
+    const h = harness()
+    h.readProcessTableAsync.mockResolvedValue(TABLE.replace('4323 pts/test T', '4323 pts/test S'))
+    let failed = false
+    h.signalProcessGroup.mockImplementation((pgid, signal) => {
+      if (pgid === 4323 && signal === 'SIGCONT' && !failed) {
+        failed = true
+        throw new Error('temporary resume failure')
+      }
+    })
+    h.flow.pause()
+    await settled()
+    h.flow.resume()
+    await settled()
+    // The user can suspend a job again after its first successful resume.
+    h.readProcessTableAsync.mockResolvedValue(TABLE.replace('4322 pts/test S', '4322 pts/test T'))
+    await vi.advanceTimersByTimeAsync(500)
+    expect(
+      h.signalProcessGroup.mock.calls.filter(
+        ([pid, signal]) => pid === 4322 && signal === 'SIGCONT'
+      )
+    ).toHaveLength(1)
+    expect(h.signalProcessGroup).toHaveBeenLastCalledWith(4321, 'SIGCONT')
+    expect(vi.getTimerCount()).toBe(0)
+  })
+
+  it.each(['EPERM', 'EACCES'])('does not retry a root pause denied with %s', async (code) => {
+    vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout'] })
+    const h = harness()
+    h.kill.mockImplementationOnce(() => {
+      throw Object.assign(new Error('denied'), { code })
+    })
+    h.flow.pause()
+    await settled()
+    h.flow.pause()
+    await vi.advanceTimersByTimeAsync(30_000)
+    expect(h.kill.mock.calls).toEqual([[constants.signals.SIGSTOP]])
+    expect(h.readProcessTableAsync).not.toHaveBeenCalled()
+    expect(vi.getTimerCount()).toBe(0)
+    h.flow.resume()
+    h.flow.pause()
+    await settled()
+    expect(h.kill).toHaveBeenCalledTimes(2)
+    h.flow.resumeForShutdown()
+  })
+
+  it('rolls back acquired stops after a denied job pause without repeatedly scanning or resuming the denied job', async () => {
+    vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout'] })
+    const h = harness()
+    h.readProcessTableAsync.mockResolvedValue(`${TABLE}\n4324 4324 pts/test S`)
+    h.signalProcessGroup.mockImplementation((pgid, signal) => {
+      if (pgid === 4324 && signal === 'SIGSTOP') {
+        throw Object.assign(new Error('denied'), { code: 'EPERM' })
+      }
+    })
+    h.flow.pause()
+    await settled()
+    await vi.advanceTimersByTimeAsync(30_000)
+    expect(h.signalProcessGroup.mock.calls).toEqual([
+      [4321, 'SIGSTOP'],
+      [4322, 'SIGSTOP'],
+      [4324, 'SIGSTOP'],
+      [4322, 'SIGCONT'],
+      [4321, 'SIGCONT']
+    ])
+    expect(h.readProcessTableAsync).toHaveBeenCalledTimes(2)
+    expect(vi.getTimerCount()).toBe(0)
+  })
+
+  it('retains the resume obligation when rollback after a denied pause also fails', async () => {
+    vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout'] })
+    const h = harness()
+    let failed = false
+    h.signalProcessGroup.mockImplementation((pgid, signal) => {
+      if (pgid === 4322 && signal === 'SIGSTOP') {
+        throw Object.assign(new Error('denied'), { code: 'EPERM' })
+      }
+      if (pgid === 4321 && signal === 'SIGCONT' && !failed) {
+        failed = true
+        throw Object.assign(new Error('resume denied'), { code: 'EPERM' })
+      }
+    })
+    h.flow.pause()
+    await settled()
+    expect(vi.getTimerCount()).toBe(1)
+    await vi.advanceTimersByTimeAsync(500)
+    expect(h.signalProcessGroup.mock.calls).toEqual([
+      [4321, 'SIGSTOP'],
+      [4322, 'SIGSTOP'],
+      [4321, 'SIGCONT'],
+      [4321, 'SIGCONT']
+    ])
+    expect(vi.getTimerCount()).toBe(0)
+  })
+})
+
+describe('Windows resume retries', () => {
+  it('releases a failed partial pause without repeatedly attempting the denied pause', async () => {
+    vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout'] })
+    const h = harness('win32')
+    h.windowsJob.pause.mockReturnValueOnce(false)
+    h.windowsJob.resume.mockReturnValueOnce(false)
+    h.flow.pause()
+    await vi.advanceTimersByTimeAsync(500)
+    expect(h.windowsJob.resume).toHaveBeenCalledOnce()
+    await vi.advanceTimersByTimeAsync(500)
+    expect(h.windowsJob.resume).toHaveBeenCalledTimes(2)
+    expect(h.windowsJob.pause).toHaveBeenCalledOnce()
+    expect(vi.getTimerCount()).toBe(0)
+    h.flow.pause()
+    expect(h.windowsJob.pause).toHaveBeenCalledTimes(2)
+    h.flow.resumeForShutdown()
+  })
+
+  it('retries a failed resume without another caller transition', async () => {
+    vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout'] })
+    const h = harness('win32')
+    h.windowsJob.resume.mockReturnValueOnce(false)
+    h.flow.pause()
+    h.flow.resume()
+    expect(h.windowsJob.resume).toHaveBeenCalledOnce()
+    await vi.advanceTimersByTimeAsync(500)
+    expect(h.windowsJob.resume).toHaveBeenCalledTimes(2)
+    expect(vi.getTimerCount()).toBe(0)
+    expect(h.readProcessTableAsync).not.toHaveBeenCalled()
+  })
+
+  it.each(['pause', 'shutdown', 'exit'] as const)(
+    'cancels stale resume retries after %s',
+    async (action) => {
+      vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout'] })
+      const h = harness('win32')
+      h.windowsJob.resume.mockReturnValue(false)
+      h.flow.pause()
+      h.flow.resume()
+      if (action === 'pause') {
+        h.flow.pause()
+      } else {
+        if (action === 'exit') {
+          h.exit()
+        }
+        h.flow.resumeForShutdown()
+      }
+      const resumes = h.windowsJob.resume.mock.calls.length
+      await vi.advanceTimersByTimeAsync(5_000)
+      expect(h.windowsJob.resume).toHaveBeenCalledTimes(resumes)
+      expect(vi.getTimerCount()).toBe(0)
+    }
+  )
+})
diff --git a/src/main/daemon/pty-subprocess/bun-pty-process-suspension.ts b/src/main/daemon/pty-subprocess/bun-pty-process-suspension.ts
new file mode 100644
index 000000000000..3fc20931d5cf
--- /dev/null
+++ b/src/main/daemon/pty-subprocess/bun-pty-process-suspension.ts
@@ -0,0 +1,78 @@
+import {
+  getPosixPtyStoppedJobGroups,
+  signalPosixPtyProcessGroups
+} from '../../pty/posix-pty-process-groups'
+
+export function createBunPtyProcessSuspension(options: {
+  pid: number
+  platform: NodeJS.Platform
+  signalRoot: (signal: 'SIGSTOP' | 'SIGCONT') => void
+  readProcessTable?: () => string
+  signalProcessGroup?: (pgid: number, signal: NodeJS.Signals) => void
+}) {
+  const stoppedGroups = new Set<number>()
+  return {
+    hasStoppedGroups: () => stoppedGroups.size > 0,
+    signal(signal: 'SIGSTOP' | 'SIGCONT', table?: string, requireGroups = false): void {
+      const alreadyStopped =
+        signal === 'SIGSTOP' && table !== undefined
+          ? getPosixPtyStoppedJobGroups(table, options.pid)
+          : new Set<number>()
+      let resumeFailed = false
+      signalPosixPtyProcessGroups(
+        options.pid,
+        signal,
+        () => {
+          if (requireGroups) {
+            throw new Error('Paused PTY group ownership is unavailable')
+          }
+          options.signalRoot(signal)
+        },
+        {
+          platform: options.platform,
+          ...(table !== undefined
+            ? { readProcessTable: () => table }
+            : options.readProcessTable
+              ? { readProcessTable: options.readProcessTable }
+              : {}),
+          signalProcessGroup(pgid) {
+            if (
+              signal === 'SIGSTOP'
+                ? alreadyStopped.has(pgid) && !stoppedGroups.has(pgid)
+                : !stoppedGroups.has(pgid)
+            ) {
+              return
+            }
+            // Keep the shell stopped until every preceding job group has resumed.
+            if (signal === 'SIGCONT' && requireGroups && resumeFailed) {
+              throw new Error('An earlier PTY group could not be resumed')
+            }
+            try {
+              if (options.signalProcessGroup) {
+                options.signalProcessGroup(pgid, signal)
+              } else {
+                process.kill(-pgid, signal)
+              }
+            } catch (error) {
+              const gone = error instanceof Error && 'code' in error && error.code === 'ESRCH'
+              if (gone) {
+                stoppedGroups.delete(pgid)
+              }
+              resumeFailed = !gone
+              throw error
+            }
+            if (signal === 'SIGSTOP') {
+              stoppedGroups.add(pgid)
+            } else {
+              stoppedGroups.delete(pgid)
+            }
+          }
+        }
+      )
+      if (signal === 'SIGCONT') {
+        // A fresh successful scan also retires groups that no longer belong to this terminal.
+        stoppedGroups.clear()
+      }
+    }
+  }
+}
diff --git a/src/main/daemon/pty-subprocess/bun-pty-process.integration.test.ts b/src/main/daemon/pty-subprocess/bun-pty-process.integration.test.ts
new file mode 100644
index 000000000000..1c4f0436d6f6
--- /dev/null
+++ b/src/main/daemon/pty-subprocess/bun-pty-process.integration.test.ts
@@ -0,0 +1,298 @@
+import { existsSync, mkdtempSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join, resolve } from 'node:path'
+import { describe, expect, it } from 'vitest'
+import { runProcess, runProcessSync } from '../../../shared/child-process/run-process'
+import { orcadBunRuntimeFilename } from '../../../shared/orcad-artifacts'
+import { ORCAD_BUN_VERSION } from '../../../shared/orcad-bun-runtime'
+import { removeTreeSync } from '../../../shared/windows-transient-lock-removal'
+
+const runtimePath =
+  process.env.BUN_EXECUTABLE ??
+  resolve(__dirname, '../../../../out/orcad', orcadBunRuntimeFilename(process.platform))
+
+async function runTerminalScript(script: string): Promise<unknown> {
+  expect(runProcessSync({ program: runtimePath, args: ['--version'] }).stdout.trim()).toBe(
+    ORCAD_BUN_VERSION
+  )
+  const directory = mkdtempSync(join(tmpdir(), 'orca-bun-terminal-'))
+  try {
+    const entry = join(directory, 'terminal.cjs')
+    writeFileSync(
+      entry,
+      [
+        `const {spawnBunPty} = require(${JSON.stringify(join(__dirname, 'bun-pty-process.ts'))})`,
+        `const args = {file: process.execPath, cwd: ${JSON.stringify(directory)}, env: process.env, cols: 80, rows: 24}`,
+        script
+      ].join('\n')
+    )
+    const result = await runProcess({ program: runtimePath, args: [entry], timeoutMs: 30_000 })
+    expect(result.timedOut).toBe(false)
+    expect(result.code, result.stderr).toBe(0)
+    return JSON.parse(result.stdout)
+  } finally {
+    removeTreeSync(directory)
+  }
+}
+
+describe.skipIf(!existsSync(runtimePath) || process.platform === 'win32')(
+  'real Bun terminal',
+  () => {
+    it('drains multi-byte output before publishing process exit and applies resize', async () => {
+      const result = await runTerminalScript(`
+      const expected = '⌘状態'.repeat(200_000)
+      const proc = spawnBunPty({...args, args: ['-e', 'process.stdout.write("⌘状態".repeat(200000));process.exitCode=17']})
+      let output = ''
+      proc.resize(103, 37)
+      proc.onData(data => output += data)
+      proc.onExit(event => {
+        console.log(JSON.stringify({event, exact: output === expected, cols:proc.cols, rows:proc.rows}))
+        proc.destroy()
+      })
+    `)
+      expect(result).toEqual({ event: { exitCode: 17 }, exact: true, cols: 103, rows: 37 })
+    })
+
+    it('receives the real shell identity from a gated Bun subprocess', async () => {
+      const result = await runTerminalScript(`
+      const {createWindowsBunPtyLaunch} = require(${JSON.stringify(join(__dirname, 'windows-bun-pty-launch.ts'))})
+      const proc = spawnBunPty({...args,args:['-e','setTimeout(()=>{process.exitCode=17},100)']}, {
+        platform:'win32', assignHostJob:()=>true,
+        createJob:()=>({listProcessIds:()=>[], pause:()=>true,resume:()=>true,terminate:()=> 'terminated',close(){}}),
+        createWindowsLaunch:launch => createWindowsBunPtyLaunch(launch, {
+          runtimePath:process.execPath,workerPath:${JSON.stringify(join(__dirname, 'windows-bun-pty-gate-entry.ts'))}
+        })
+      })
+      proc.onExit(event => {
+        console.log(JSON.stringify({event, shellIdentified:proc.shellProcessId>0 && proc.shellProcessId!==proc.pid}))
+        proc.destroy()
+      })
+    `)
+      expect(result).toEqual({ event: { exitCode: 17 }, shellIdentified: true })
+    })
+
+    it('reports signal termination distinctly from an ordinary exit', async () => {
+      const result = await runTerminalScript(`
+      const proc = spawnBunPty({...args,args:['-e', 'console.log("ready");setInterval(()=>{},1000)']})
+      proc.onData(() => proc.kill('SIGTERM'))
+      proc.onExit(event => { console.log(JSON.stringify(event));proc.destroy() })
+    `)
+      expect(result).toEqual({ exitCode: 143, signal: 15 })
+    })
+
+    it('pauses and resumes the owned process when process discovery is unavailable', async () => {
+      const result = await runTerminalScript(`
+      const expected = 'ready' + 'x'.repeat(1024 * 1024)
+      const continueOutput = require('node:path').join(args.cwd, 'continue-output')
+      const proc = spawnBunPty({...args,env:{...args.env,ORCA_TEST_CONTINUE:continueOutput},args:['-e','process.stdout.write("ready");const timer=setInterval(()=>{if(!require("node:fs").existsSync(process.env.ORCA_TEST_CONTINUE))return;clearInterval(timer);process.stdout.write("x".repeat(1024*1024))},1)']},{readProcessTable:()=>''})
+      let output = '', paused = false, stable = false
+      proc.onData(data => {
+        output += data
+        if (paused) return
+        paused = true
+        proc.pause()
+        setTimeout(() => {
+          const settled = output.length
+          require('node:fs').writeFileSync(continueOutput, 'continue')
+          setTimeout(() => { stable = output.length === settled;proc.resume() }, 150)
+        }, 150)
+      })
+      proc.onExit(event => {
+        console.log(JSON.stringify({event,stable,exact:output===expected}))
+        proc.destroy()
+      })
+    `)
+      expect(result).toEqual({ event: { exitCode: 0 }, stable: true, exact: true })
+    })
+
+    it.skipIf(!existsSync('/bin/bash')).each([
+      [false, 0],
+      [false, 100],
+      [true, 0],
+      [true, 100]
+    ] as const)(
+      'stops foreground and background floods without losing output (resume failure: %s, signal gap: %sms)',
+      async (rejectFirstResume, stopSignalGapMs) => {
+        const result = await runTerminalScript(`
+      const expected = 16 * 1024 * 1024
+      const {join} = require('node:path')
+      const {writeFileSync,existsSync} = require('node:fs')
+      const producer = join(args.cwd, 'producer.cjs')
+      const backgroundReady = join(args.cwd, 'background-ready')
+      const foregroundReady = join(args.cwd, 'foreground-ready')
+      const go = join(args.cwd, 'go')
+      const continueOutput = join(args.cwd, 'continue-output')
+      writeFileSync(producer, [
+        'const {writeFileSync,existsSync}=require("node:fs")',
+        'writeFileSync(process.argv[2],"ready")',
+        'const deadline=setTimeout(()=>process.exit(97),10000)',
+        'const ready=setInterval(()=>{if(!existsSync(process.argv[3]))return;clearInterval(ready);process.stdout.write("x".repeat(65536));const continued=setInterval(()=>{if(!existsSync(process.argv[4]))return;clearInterval(continued);clearTimeout(deadline);let count=1;const timer=setInterval(()=>{process.stdout.write("x".repeat(65536));if(++count===128)clearInterval(timer)},1)},1)},1)'
+      ].join(';'))
+      const groups = new Set()
+      let bytes = 0, paused = false, settledBytes = 0, stable = false, verifying = false, rejectedResume = false
+      const proc = spawnBunPty({
+        ...args, file:'/bin/bash',
+        args:['--noprofile','--norc','-i','-c','exec 2>/dev/null; "$ORCA_TEST_RUNTIME" "$ORCA_TEST_PRODUCER" "$ORCA_TEST_BACKGROUND_READY" "$ORCA_TEST_GO" "$ORCA_TEST_CONTINUE" & "$ORCA_TEST_RUNTIME" "$ORCA_TEST_PRODUCER" "$ORCA_TEST_FOREGROUND_READY" "$ORCA_TEST_GO" "$ORCA_TEST_CONTINUE"; wait'],
+        env:{...args.env,ORCA_TEST_RUNTIME:process.execPath,ORCA_TEST_PRODUCER:producer,ORCA_TEST_BACKGROUND_READY:backgroundReady,ORCA_TEST_FOREGROUND_READY:foregroundReady,ORCA_TEST_GO:go,ORCA_TEST_CONTINUE:continueOutput}
+      },{signalProcessGroup:(pgid,signal)=>{
+        if (signal === 'SIGCONT' && ${rejectFirstResume} && !rejectedResume) {
+          rejectedResume = true
+          throw Object.assign(new Error('transient resume failure'), {code:'EPERM'})
+        }
+        process.kill(-pgid,signal)
+        if (signal === 'SIGSTOP') {
+          groups.add(pgid)
+          // Give Bash time to react between signals; stopping its jobs first can end its wait.
+          Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ${stopSignalGapMs})
+        }
+        if (groups.size < 3 || verifying) return
+        verifying = true
+        writeFileSync(continueOutput, 'continue')
+        setTimeout(() => {
+          settledBytes = bytes
+          setTimeout(() => { stable = bytes === settledBytes;proc.resume() }, 150)
+        },150)
+      }})
+      const ready = setInterval(() => {
+        if (!existsSync(backgroundReady) || !existsSync(foregroundReady)) return
+        clearInterval(ready)
+        writeFileSync(go, 'go')
+      }, 5)
+      let beats = 0
+      const heartbeat = setInterval(() => beats++, 5)
+      proc.onData(data => {
+        bytes += data.length
+        // Drain both initial writes before measuring whether stopped producers emit more.
+        if (!paused && bytes === 2 * 65536) {
+          paused = true
+          proc.pause()
+        }
+      })
+      proc.onExit(event => {
+        clearInterval(ready)
+        clearInterval(heartbeat)
+        console.log(JSON.stringify({event,stable,exact:bytes===expected,pausedBeforeExit:settledBytes<expected,responsive:beats>10,jobControlGroups:groups.size>=3,rejectedResume}))
+        proc.destroy()
+      })
+    `)
+        expect(result).toEqual({
+          event: { exitCode: 0 },
+          stable: true,
+          exact: true,
+          pausedBeforeExit: true,
+          responsive: true,
+          jobControlGroups: true,
+          rejectedResume: rejectFirstResume
+        })
+      }
+    )
+  }
+)
+
+describe.skipIf(!existsSync(runtimePath) || process.platform !== 'win32')(
+  'native Windows Bun terminal',
+  () => {
+    it('falls back after actual shell spawn rejection and cleans each private launch directory', async () => {
+      const result = await runTerminalScript(`
+      const {spawnNativeDaemonPty} = require(${JSON.stringify(join(__dirname, 'native-pty-spawn.ts'))})
+      const {createWindowsBunPtyLaunch} = require(${JSON.stringify(join(__dirname, 'windows-bun-pty-launch.ts'))})
+      const {existsSync} = require('node:fs')
+      const {dirname,join} = require('node:path')
+      const directories = []
+      const attempts = [join(args.cwd,'missing-pwsh.exe'),join(args.cwd,'missing-powershell.exe'),process.execPath].map(shellPath=>({
+        shellPath,shellArgs:['-e','process.exitCode=17'],effectiveCwd:args.cwd,validationCwd:args.cwd,startupCommandDeliveredInShellArgs:true
+      }))
+      spawnNativeDaemonPty({
+        shellPath:attempts[0].shellPath,shellArgs:attempts[0].shellArgs,spawnCwd:args.cwd,
+        env:args.env,cols:80,rows:24,windowsFallbackAttempts:attempts
+      }, {canUseBunPty:()=>true, spawnBunPty:options=>spawnBunPty(options, {
+        createWindowsLaunch:launchArgs=>{
+          const launch = createWindowsBunPtyLaunch(launchArgs, {
+            runtimePath:process.execPath,workerPath:${JSON.stringify(join(__dirname, 'windows-bun-pty-gate-entry.ts'))}
+          })
+          directories.push(dirname(launch.command.at(-1)))
+          return launch
+        }
+      })}).then(({process:proc,shellPath})=>{
+        proc.onExit(event=>{
+          console.log(JSON.stringify({event,fallback:shellPath===process.execPath,attempts:directories.length,cleaned:directories.every(path=>!existsSync(path))}))
+          proc.destroy()
+        })
+      }).catch(error=>{console.error(error);process.exitCode=1})
+    `)
+      expect(result).toEqual({
+        event: { exitCode: 17 },
+        fallback: true,
+        attempts: 3,
+        cleaned: true
+      })
+    }, 35_000)
+
+    it('enumerates and suspends a native job with more than 64 processes', async () => {
+      const result = await runTerminalScript(`
+      const {createWindowsBunPtyLaunch} = require(${JSON.stringify(join(__dirname, 'windows-bun-pty-launch.ts'))})
+      const script = 'for(let i=0;i<65;i++)Bun.spawn([process.execPath,"-e","setInterval(()=>{},1000)"],{stdin:"ignore",stdout:"ignore",stderr:"ignore"});setInterval(()=>console.log("tick"),10)'
+      const proc = spawnBunPty({...args,args:['-e',script]}, {
+        createWindowsLaunch:launch => createWindowsBunPtyLaunch(launch, {
+          runtimePath:process.execPath,workerPath:${JSON.stringify(join(__dirname, 'windows-bun-pty-gate-entry.ts'))}
+        })
+      })
+      let bytes=0,started=false,evidence
+      proc.onData(data=>{
+        bytes+=data.length
+        if(started || !data.includes('tick'))return
+        const members=proc.listOwnedProcessIds()
+        if(!members || members.length<67)return
+        started=true
+        proc.pause()
+        setTimeout(()=>{
+          const pausedBytes=bytes
+          setTimeout(()=>{
+            const stopped=bytes===pausedBytes
+            proc.resume()
+            setTimeout(()=>{
+              evidence={members:members.length,stopped,resumed:bytes>pausedBytes}
+              proc.kill()
+            },150)
+          },150)
+        },150)
+      })
+      proc.onExit(()=>{
+        console.log(JSON.stringify(evidence))
+        proc.destroy()
+      })
+    `)
+      expect(result).toEqual({ members: 67, stopped: true, resumed: true })
+    }, 35_000)
+
+    it('opens ConPTY without IPC and identifies the shell inside its job', async () => {
+      const result = await runTerminalScript(`
+      const {createWindowsBunPtyLaunch} = require(${JSON.stringify(join(__dirname, 'windows-bun-pty-launch.ts'))})
+      const proc = spawnBunPty({...args,args:['-e','console.log("ready");setInterval(()=>{},1000)']}, {
+        createWindowsLaunch:launch => createWindowsBunPtyLaunch(launch, {
+          runtimePath:process.execPath,workerPath:${JSON.stringify(join(__dirname, 'windows-bun-pty-gate-entry.ts'))}
+        })
+      })
+      let output = '', evidence
+      proc.onData(data => output += data)
+      const timer = setInterval(() => {
+        const shell = proc.shellProcessId
+        const members = proc.listOwnedProcessIds()
+        if (!output.includes('ready') || !shell || !members?.includes(shell)) return
+        clearInterval(timer)
+        evidence = {distinctShell:shell!==proc.pid, gateOwned:members.includes(proc.pid), shellOwned:true}
+        proc.kill()
+      }, 10)
+      proc.onExit(event => {
+        clearInterval(timer)
+        console.log(JSON.stringify({evidence, exited:event.exitCode!==undefined}))
+        proc.destroy()
+      })
+    `)
+      expect(result).toEqual({
+        evidence: { distinctShell: true, gateOwned: true, shellOwned: true },
+        exited: true
+      })
+    })
+  }
+)
diff --git a/src/main/daemon/pty-subprocess/bun-pty-process.test.ts b/src/main/daemon/pty-subprocess/bun-pty-process.test.ts
new file mode 100644
index 000000000000..6726524f53d3
--- /dev/null
+++ b/src/main/daemon/pty-subprocess/bun-pty-process.test.ts
@@ -0,0 +1,652 @@
+import { constants } from 'node:os'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { canUseBunPty, spawnBunPty } from './bun-pty-process'
+import type { BunRuntime, BunTerminalOptions } from './bun-pty-process-contract'
+import { readWindowsPtyJobProcessIds } from '../../providers/windows-pty-job-membership'
+import * as posixPtyGroups from '../../pty/posix-pty-process-groups'
+
+type FakeTerminal = {
+  closed: boolean
+  write(data: string | ArrayBufferView): number
+  resize(cols: number, rows: number): void
+  close(): void
+}
+
+let testRuntime: NonNullable<Parameters<typeof spawnBunPty>[1]>['runtime']
+
+function createBunHarness({ closeImmediately = true } = {}) {
+  let resolveExit: (code: number) => void = () => {}
+  let windowsTerminalOptions: BunTerminalOptions | undefined
+  const terminal: FakeTerminal = {
+    closed: false,
+    write: vi.fn(() => 1),
+    resize: vi.fn(),
+    close: vi.fn(function (this: FakeTerminal) {
+      this.closed = true
+      if (closeImmediately) {
+        windowsTerminalOptions?.exit?.(terminal, 0, null)
+      }
+    })
+  }
+  const processHandle = {
+    pid: 4321,
+    terminal,
+    kill: vi.fn(),
+    exited: new Promise<number>((resolve) => {
+      resolveExit = resolve
+    })
+  }
+  const spawn = vi.fn(
+    (_command: string[], _options: Parameters<BunRuntime['spawn']>[1]) => processHandle
+  )
+  testRuntime = {
+    Terminal: class {
+      closed = false
+      write = terminal.write
+      resize = terminal.resize
+      close = terminal.close
+      constructor(options: BunTerminalOptions) {
+        windowsTerminalOptions = options
+        return terminal
+      }
+    },
+    spawn
+  }
+  const emitData = (data: Uint8Array<ArrayBuffer>): void => {
+    const options = spawn.mock.calls[0]?.[1]
+    const callbacks =
+      windowsTerminalOptions ??
+      (options && 'data' in options.terminal ? options.terminal : undefined)
+    if (!callbacks) {
+      throw new Error('missing terminal callbacks')
+    }
+    callbacks.data(terminal, data)
+  }
+  return {
+    processHandle,
+    resolveExit,
+    spawn,
+    terminal,
+    emitData,
+    finishTerminal: () => windowsTerminalOptions?.exit?.(terminal, 0, null)
+  }
+}
+
+function spawn(deps?: Parameters<typeof spawnBunPty>[1]) {
+  return spawnBunPty(
+    {
+      file: '/bin/sh',
+      args: ['-l'],
+      cwd: '/tmp',
+      env: { TERM: 'xterm-256color' },
+      cols: 80,
+      rows: 24
+    },
+    { platform: 'linux', runtime: testRuntime, ...deps }
+  )
+}
+
+afterEach(() => {
+  vi.useRealTimers()
+  vi.restoreAllMocks()
+  testRuntime = undefined
+})
+
+describe('Bun.Terminal PTY adapter', () => {
+  it('cancels a pending ownership lookup on natural exit without delivering a late stop', async () => {
+    const harness = createBunHarness()
+    let finishRead: (table: string) => void = () => {}
+    const read = vi.spyOn(posixPtyGroups, 'readPosixPtyProcessTable').mockImplementation(
+      () =>
+        new Promise<string>((resolve) => {
+          finishRead = resolve
+        })
+    )
+    const signalProcessGroup = vi.fn()
+    const proc = spawn({ signalProcessGroup })
+    proc.pause()
+    await new Promise<void>((resolve) => setImmediate(resolve))
+    const signal = read.mock.calls[0][1]
+    expect(signal?.aborted).toBe(false)
+    harness.resolveExit(0)
+    await harness.processHandle.exited
+    expect(signal?.aborted).toBe(true)
+    finishRead('4321 4321 pts/test T\n4322 4322 pts/test')
+    await new Promise<void>((resolve) => setImmediate(resolve))
+    expect(signalProcessGroup).not.toHaveBeenCalled()
+    expect(harness.processHandle.kill.mock.calls).toEqual([[constants.signals.SIGSTOP]])
+  })
+
+  it('cancels a queued resume retry immediately on natural exit', async () => {
+    vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout'] })
+    const harness = createBunHarness()
+    const read = vi
+      .spyOn(posixPtyGroups, 'readPosixPtyProcessTable')
+      .mockResolvedValueOnce('4321 4321 pts/test T\n4322 4322 pts/test')
+      .mockRejectedValueOnce(new Error('temporary ps failure'))
+    const signalProcessGroup = vi.fn()
+    const proc = spawn({ signalProcessGroup })
+    proc.pause()
+    await new Promise<void>((resolve) => setImmediate(resolve))
+    proc.resume()
+    await new Promise<void>((resolve) => setImmediate(resolve))
+    expect(vi.getTimerCount()).toBe(1)
+    harness.resolveExit(0)
+    await harness.processHandle.exited
+    expect(vi.getTimerCount()).toBe(0)
+    await vi.advanceTimersByTimeAsync(5_000)
+    expect(read).toHaveBeenCalledTimes(2)
+    expect(signalProcessGroup.mock.calls).toEqual([
+      [4321, 'SIGSTOP'],
+      [4322, 'SIGSTOP']
+    ])
+    expect(harness.processHandle.kill.mock.calls).toEqual([[constants.signals.SIGSTOP]])
+  })
+
+  it('exposes initial and successfully applied dimensions for terminal inspection', () => {
+    const harness = createBunHarness()
+    const proc = spawn()
+    expect({ cols: proc.cols, rows: proc.rows }).toEqual({ cols: 80, rows: 24 })
+    proc.resize(103, 37)
+    expect(harness.terminal.resize).toHaveBeenCalledWith(103, 37)
+    expect({ cols: proc.cols, rows: proc.rows }).toEqual({ cols: 103, rows: 37 })
+  })
+
+  it.each(['closed', 'exited', 'failed'] as const)(
+    'retains last applied dimensions when resize is %s',
+    async (reason) => {
+      const harness = createBunHarness()
+      const proc = spawn()
+      proc.resize(103, 37)
+      if (reason === 'closed') {
+        harness.terminal.closed = true
+      }
+      if (reason === 'exited') {
+        harness.resolveExit(0)
+        await harness.processHandle.exited
+      }
+      if (reason === 'failed') {
+        vi.mocked(harness.terminal.resize).mockImplementationOnce(() => {
+          throw new Error('closed')
+        })
+      }
+      proc.resize(120, 40)
+      expect({ cols: proc.cols, rows: proc.rows }).toEqual({ cols: 103, rows: 37 })
+    }
+  )
+
+  it('requires Bun.Terminal as well as Bun.spawn', () => {
+    const spawn = vi.fn()
+    expect(canUseBunPty({ spawn })).toBe(false)
+    expect(canUseBunPty({ Terminal: class {}, spawn })).toBe(true)
+  })
+
+  it('streams split UTF-8 and reports exit to current and late listeners', async () => {
+    const harness = createBunHarness()
+    const proc = spawn()
+    const onData = vi.fn()
+    const onExit = vi.fn()
+    proc.onData(onData)
+    proc.onExit(onExit)
+
+    const bytes = new TextEncoder().encode('⌘状')
+    harness.emitData(bytes.slice(0, 2))
+    expect(onData).not.toHaveBeenCalled()
+    harness.emitData(bytes.slice(2))
+    expect(onData).toHaveBeenCalledWith('⌘状')
+
+    harness.resolveExit(7)
+    await harness.processHandle.exited
+    await Promise.resolve()
+    expect(onExit).toHaveBeenCalledWith({ exitCode: 7 })
+
+    const lateExit = vi.fn()
+    proc.onExit(lateExit)
+    expect(lateExit).toHaveBeenCalledWith({ exitCode: 7 })
+  })
+
+  it('preserves output arriving before the first data listener', () => {
+    const harness = createBunHarness()
+    const proc = spawn()
+    harness.emitData(new TextEncoder().encode('startup output'))
+    const listener = vi.fn()
+    proc.onData(listener)
+    expect(listener).toHaveBeenCalledWith('startup output')
+  })
+
+  it('preserves signal termination and never signals the exited handle during disposal', async () => {
+    const harness = createBunHarness()
+    const proc = spawn()
+    Object.assign(harness.processHandle, { signalCode: 'SIGTERM' })
+    harness.resolveExit(143)
+    await harness.processHandle.exited
+    await Promise.resolve()
+    const listener = vi.fn()
+    proc.onExit(listener)
+    proc.destroy()
+    expect(listener).toHaveBeenCalledWith({ exitCode: 143, signal: 15 })
+    expect(harness.processHandle.kill).not.toHaveBeenCalled()
+    expect(harness.terminal.close).toHaveBeenCalledOnce()
+  })
+
+  it('disposes data and exit listeners without retaining them', async () => {
+    const harness = createBunHarness()
+    const proc = spawn()
+    const onData = vi.fn()
+    const onExit = vi.fn()
+    const dataSubscription = proc.onData(onData)
+    const exitSubscription = proc.onExit(onExit)
+
+    dataSubscription.dispose()
+    exitSubscription.dispose()
+    harness.emitData(new TextEncoder().encode('ignored'))
+    harness.resolveExit(0)
+    await harness.processHandle.exited
+    await Promise.resolve()
+
+    expect(onData).not.toHaveBeenCalled()
+    expect(onExit).not.toHaveBeenCalled()
+  })
+
+  it.each(['darwin', 'linux'] as const)(
+    'forwards input, resize, hangup, explicit signals, and destroy on %s',
+    (platform) => {
+      const harness = createBunHarness()
+      const proc = spawn({ platform })
+
+      proc.write('hello')
+      proc.resize(120, 40)
+      proc.kill()
+      proc.kill('SIGTERM')
+      proc.kill('SIGINT')
+      proc.kill('SIGKILL')
+      proc.destroy()
+
+      expect(harness.terminal.write).toHaveBeenCalledWith('hello')
+      expect(harness.terminal.resize).toHaveBeenCalledWith(120, 40)
+      expect(harness.processHandle.kill.mock.calls).toEqual([
+        ['SIGHUP'],
+        ['SIGTERM'],
+        ['SIGINT'],
+        ['SIGKILL'],
+        ['SIGHUP']
+      ])
+      expect(harness.terminal.close).toHaveBeenCalledOnce()
+    }
+  )
+
+  it('destroys a still-running process even if its terminal has already closed', () => {
+    const harness = createBunHarness()
+    const proc = spawn()
+    harness.terminal.closed = true
+    proc.destroy()
+    expect(harness.processHandle.kill).toHaveBeenCalledWith('SIGHUP')
+    expect(harness.terminal.close).not.toHaveBeenCalled()
+  })
+
+  it('contains a native terminal write failure and suppresses later writes', () => {
+    const harness = createBunHarness()
+    harness.terminal.write = vi.fn(() => {
+      throw new Error('terminal closed')
+    })
+    const proc = spawn()
+
+    expect(() => proc.write('first')).not.toThrow()
+    proc.write('second')
+
+    expect(harness.terminal.write).toHaveBeenCalledOnce()
+  })
+
+  it('contains a native terminal resize failure and suppresses later resizes', () => {
+    const harness = createBunHarness()
+    harness.terminal.resize = vi.fn(() => {
+      throw new Error('terminal closed')
+    })
+    const proc = spawn()
+
+    expect(() => proc.resize(120, 40)).not.toThrow()
+    proc.resize(100, 30)
+
+    expect(harness.terminal.resize).toHaveBeenCalledOnce()
+  })
+
+  it('pauses and resumes the POSIX producer process group once per transition', async () => {
+    createBunHarness()
+    const signalProcessGroup = vi.fn()
+    const proc = spawn({
+      readProcessTable: () => ' 4321 4321 pts/test T\n 4322 4322 pts/test',
+      signalProcessGroup
+    })
+
+    proc.pause()
+    proc.pause()
+    await vi.waitFor(() => expect(signalProcessGroup).toHaveBeenCalledTimes(2))
+    proc.resume()
+    proc.resume()
+    await vi.waitFor(() => expect(signalProcessGroup).toHaveBeenCalledTimes(4))
+
+    expect(signalProcessGroup.mock.calls).toEqual([
+      [4321, 'SIGSTOP'],
+      [4322, 'SIGSTOP'],
+      [4322, 'SIGCONT'],
+      [4321, 'SIGCONT']
+    ])
+  })
+
+  it('resumes a paused process group before graceful shutdown', async () => {
+    const harness = createBunHarness()
+    const signalProcessGroup = vi.fn()
+    const proc = spawn({
+      readProcessTable: () => ' 4321 4321 pts/test T\n 4322 4322 pts/test',
+      signalProcessGroup
+    })
+
+    proc.pause()
+    await vi.waitFor(() => expect(signalProcessGroup).toHaveBeenCalledTimes(2))
+    proc.kill()
+
+    expect(signalProcessGroup.mock.calls).toEqual([
+      [4321, 'SIGSTOP'],
+      [4322, 'SIGSTOP'],
+      [4322, 'SIGCONT'],
+      [4321, 'SIGCONT']
+    ])
+    expect(harness.processHandle.kill).toHaveBeenCalledWith('SIGHUP')
+  })
+
+  it('falls back to Bun process signals when group signaling is unavailable', async () => {
+    const harness = createBunHarness()
+    vi.spyOn(process, 'kill').mockImplementation(() => {
+      throw Object.assign(new Error('not supported'), { code: 'EINVAL' })
+    })
+    const proc = spawn({ readProcessTable: () => '' })
+
+    proc.pause()
+    await vi.waitFor(() =>
+      expect(harness.processHandle.kill).toHaveBeenCalledWith(constants.signals.SIGSTOP)
+    )
+    proc.resume()
+    await vi.waitFor(() =>
+      expect(harness.processHandle.kill).toHaveBeenCalledWith(constants.signals.SIGCONT)
+    )
+
+    expect(harness.processHandle.kill.mock.calls).toEqual([
+      [constants.signals.SIGSTOP],
+      [constants.signals.SIGCONT]
+    ])
+  })
+
+  it('gates a Windows shell behind exact job ownership and exposes owned capabilities', async () => {
+    const harness = createBunHarness({ closeImmediately: false })
+    const assignHostJob = vi.fn(() => true)
+    const release = vi.fn()
+    const dispose = vi.fn()
+    const waitForSpawn = vi.fn(async () => {})
+    let reportedShellPid: number | undefined
+    const job = {
+      listProcessIds: vi.fn(() => [4321, 4322]),
+      pause: vi.fn(() => true),
+      resume: vi.fn(() => true),
+      terminate: vi.fn(() => 'terminated' as const),
+      close: vi.fn()
+    }
+    const createJob = vi.fn(() => job)
+    const createWindowsLaunch = vi.fn(() => ({
+      command: ['cmd.exe', '/d /c launch.cmd'],
+      clearCommand: ['cmd.exe', '/d /c clear.cmd'],
+      env: { TERM: 'xterm-256color', ORCA_BUN_PTY_JOB_GATE: 'gate' },
+      windowsVerbatimArguments: true as const,
+      release,
+      dispose,
+      waitForSpawn,
+      readShellProcessId: () => reportedShellPid
+    }))
+    const proc = spawn({
+      platform: 'win32',
+      assignHostJob,
+      createJob,
+      createWindowsLaunch
+    })
+
+    expect(harness.spawn.mock.calls[0]?.[0]).toEqual(['cmd.exe', '/d /c launch.cmd'])
+    expect(harness.spawn.mock.calls[0]?.[1]).toMatchObject({
+      windowsVerbatimArguments: true,
+      env: { ORCA_BUN_PTY_JOB_GATE: 'gate' },
+      terminal: harness.terminal
+    })
+    expect(assignHostJob.mock.invocationCallOrder[0]).toBeLessThan(
+      harness.spawn.mock.invocationCallOrder[0]
+    )
+    expect(createJob).toHaveBeenCalledWith(4321)
+    expect(createJob.mock.invocationCallOrder[0]).toBeLessThan(release.mock.invocationCallOrder[0])
+    await proc.waitForSpawn?.()
+    expect(waitForSpawn).toHaveBeenCalledWith(harness.processHandle.exited)
+
+    proc.pause()
+    proc.pause()
+    proc.resume()
+    proc.resume()
+    expect(job.pause).toHaveBeenCalledOnce()
+    expect(job.resume).toHaveBeenCalledOnce()
+    expect(proc.jobRootProcessIsWrapper).toBe(true)
+    expect(readWindowsPtyJobProcessIds(proc)).toBeNull()
+    expect(harness.spawn.mock.calls[0]?.[1]).not.toHaveProperty('ipc')
+    reportedShellPid = 4322
+    expect(proc.shellProcessId).toBe(4322)
+    expect(readWindowsPtyJobProcessIds(proc)).toEqual(new Set([4322]))
+    job.listProcessIds.mockReturnValueOnce([4321, 4323])
+    expect(readWindowsPtyJobProcessIds(proc)).toBeNull()
+    expect(proc.shellProcessId).toBe(4322)
+    expect(proc.listOwnedProcessIds?.()).toEqual([4321, 4322])
+    expect(proc.terminateOwnedTree?.()).toBe('terminated')
+
+    job.terminate.mockClear()
+    proc.signalProcess?.('SIGINT')
+    expect(job.terminate).toHaveBeenCalledOnce()
+    expect(harness.processHandle.kill).not.toHaveBeenCalled()
+
+    proc.clear()
+    proc.clear()
+    expect(harness.spawn.mock.calls[1]?.[0]).toEqual(['cmd.exe', '/d /c clear.cmd'])
+    expect(harness.spawn.mock.calls[1]?.[1]).toMatchObject({
+      terminal: harness.terminal,
+      windowsVerbatimArguments: true
+    })
+    expect(harness.spawn).toHaveBeenCalledTimes(2)
+
+    const lastOutput = vi.fn()
+    const onExit = vi.fn()
+    proc.onData(lastOutput)
+    proc.onExit(onExit)
+    harness.resolveExit(0)
+    await harness.processHandle.exited
+    await Promise.resolve()
+    expect(onExit).not.toHaveBeenCalled()
+    expect(job.close).not.toHaveBeenCalled()
+    harness.emitData(new TextEncoder().encode('final ConPTY frame'))
+    harness.finishTerminal()
+    expect(lastOutput).toHaveBeenCalledWith('final ConPTY frame')
+    expect(onExit).toHaveBeenCalledOnce()
+    expect(job.close).toHaveBeenCalledOnce()
+    expect(dispose).toHaveBeenCalledOnce()
+    expect(job.resume).toHaveBeenCalledOnce()
+    job.resume.mockImplementation(() => {
+      throw new Error('job already closed')
+    })
+    expect(() => {
+      proc.pause()
+      proc.resume()
+      proc.kill()
+      proc.destroy()
+    }).not.toThrow()
+    expect(job.resume).toHaveBeenCalledOnce()
+  })
+
+  it('does not release a Windows gate without exact job ownership', async () => {
+    const harness = createBunHarness()
+    const release = vi.fn()
+    const dispose = vi.fn()
+
+    expect(() =>
+      spawn({
+        platform: 'win32',
+        assignHostJob: () => true,
+        createJob: () => null,
+        createWindowsLaunch: () => ({
+          command: ['cmd.exe', '/d /c launch.cmd'],
+          clearCommand: ['cmd.exe', '/d /c clear.cmd'],
+          env: {},
+          windowsVerbatimArguments: true,
+          waitForSpawn: async () => {},
+          readShellProcessId: () => undefined,
+          release,
+          dispose
+        })
+      })
+    ).toThrow('Windows Bun PTY job ownership is unavailable')
+
+    expect(release).not.toHaveBeenCalled()
+    expect(harness.processHandle.kill).toHaveBeenCalledWith('SIGTERM')
+    expect(harness.terminal.close).toHaveBeenCalledOnce()
+    expect(dispose).toHaveBeenCalledOnce()
+    harness.resolveExit(1)
+    await harness.processHandle.exited
+    expect(dispose).toHaveBeenCalledTimes(2)
+  })
+
+  it('does not spawn a Windows PTY without host crash ownership', () => {
+    const harness = createBunHarness()
+    const createWindowsLaunch = vi.fn()
+
+    expect(() =>
+      spawn({
+        platform: 'win32',
+        assignHostJob: () => false,
+        createWindowsLaunch
+      })
+    ).toThrow('Windows Bun PTY host crash ownership is unavailable')
+
+    expect(createWindowsLaunch).not.toHaveBeenCalled()
+    expect(harness.spawn).not.toHaveBeenCalled()
+  })
+
+  it('preserves a Windows PTY after a failed suspension and allows a retry', () => {
+    const harness = createBunHarness()
+    const job = {
+      listProcessIds: vi.fn(() => [4321]),
+      pause: vi.fn(() => true).mockReturnValueOnce(false),
+      resume: vi.fn(() => true),
+      terminate: vi.fn(() => 'terminated' as const),
+      close: vi.fn()
+    }
+    const proc = spawn({
+      platform: 'win32',
+      assignHostJob: () => true,
+      createJob: () => job,
+      createWindowsLaunch: () => ({
+        command: ['cmd.exe', '/d /c launch.cmd'],
+        clearCommand: ['cmd.exe', '/d /c clear.cmd'],
+        env: {},
+        windowsVerbatimArguments: true,
+        waitForSpawn: async () => {},
+        readShellProcessId: () => undefined,
+        release: vi.fn(),
+        dispose: vi.fn()
+      })
+    })
+
+    proc.pause()
+    proc.write('still usable')
+    proc.pause()
+    proc.resume()
+
+    expect(job.pause).toHaveBeenCalledTimes(2)
+    expect(job.resume).toHaveBeenCalledOnce()
+    expect(job.terminate).not.toHaveBeenCalled()
+    expect(harness.terminal.close).not.toHaveBeenCalled()
+    expect(harness.terminal.write).toHaveBeenCalledWith('still usable')
+
+    proc.kill()
+    proc.kill('SIGKILL')
+    proc.destroy()
+    expect(harness.processHandle.kill.mock.calls).toEqual([['SIGTERM'], ['SIGKILL'], ['SIGTERM']])
+    expect(job.terminate).toHaveBeenCalledTimes(3)
+    expect(harness.terminal.close).toHaveBeenCalledOnce()
+  })
+
+  it('delivers Windows exit after cleanup failures', async () => {
+    const harness = createBunHarness()
+    const cleanupError = new Error('job close failed')
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+    const proc = spawn({
+      platform: 'win32',
+      assignHostJob: () => true,
+      createJob: () => ({
+        listProcessIds: vi.fn(() => []),
+        pause: vi.fn(() => true),
+        resume: vi.fn(() => true),
+        terminate: vi.fn(() => 'terminated' as const),
+        close: vi.fn(() => {
+          throw cleanupError
+        })
+      }),
+      createWindowsLaunch: () => ({
+        command: ['cmd.exe', '/d /c launch.cmd'],
+        clearCommand: ['cmd.exe', '/d /c clear.cmd'],
+        env: {},
+        windowsVerbatimArguments: true,
+        waitForSpawn: async () => {},
+        readShellProcessId: () => undefined,
+        release: vi.fn(),
+        dispose: vi.fn()
+      })
+    })
+    const onExit = vi.fn()
+    proc.onExit(onExit)
+
+    harness.resolveExit(9)
+    await harness.processHandle.exited
+    await Promise.resolve()
+
+    expect(onExit).toHaveBeenCalledWith({ exitCode: 9 })
+    expect(warn).toHaveBeenCalledWith('[daemon/pty] PTY cleanup failed:', cleanupError)
+  })
+
+  it('terminates and closes Windows job state when gate release fails', () => {
+    const harness = createBunHarness()
+    const dispose = vi.fn()
+    const job = {
+      listProcessIds: vi.fn(() => [4321]),
+      pause: vi.fn(() => true),
+      resume: vi.fn(() => true),
+      terminate: vi.fn(() => 'terminated' as const),
+      close: vi.fn()
+    }
+
+    expect(() =>
+      spawn({
+        platform: 'win32',
+        assignHostJob: () => true,
+        createJob: () => job,
+        createWindowsLaunch: () => ({
+          command: ['cmd.exe', '/d /c launch.cmd'],
+          clearCommand: ['cmd.exe', '/d /c clear.cmd'],
+          env: {},
+          windowsVerbatimArguments: true,
+          waitForSpawn: async () => {},
+          readShellProcessId: () => undefined,
+          release() {
+            throw new Error('gate release failed')
+          },
+          dispose
+        })
+      })
+    ).toThrow('gate release failed')
+
+    expect(job.terminate).toHaveBeenCalledOnce()
+    expect(job.close).toHaveBeenCalledOnce()
+    expect(harness.processHandle.kill).toHaveBeenCalledWith('SIGTERM')
+    expect(harness.terminal.close).toHaveBeenCalledOnce()
+    expect(dispose).toHaveBeenCalledOnce()
+  })
+})
diff --git a/src/main/daemon/pty-subprocess/bun-pty-process.ts b/src/main/daemon/pty-subprocess/bun-pty-process.ts
new file mode 100644
index 000000000000..b8d68b65ad47
--- /dev/null
+++ b/src/main/daemon/pty-subprocess/bun-pty-process.ts
@@ -0,0 +1,2 @@
+export { canUseBunPty } from './bun-pty-process-capabilities'
+export { spawnBunPty } from './bun-pty-process-runtime'
diff --git a/src/main/daemon/pty-subprocess/foreground-process-tracker.ts b/src/main/daemon/pty-subprocess/foreground-process-tracker.ts
index 8726dc872818..7a96877c204f 100644
--- a/src/main/daemon/pty-subprocess/foreground-process-tracker.ts
+++ b/src/main/daemon/pty-subprocess/foreground-process-tracker.ts
@@ -1,6 +1,6 @@
 import type * as pty from 'node-pty'
+import { ptyShellProcessId } from '../../windows/windows-pty-job'
 import { getAgentForegroundContextPaths } from '../../providers/agent-foreground-context-paths'
-import { resolveAgentForegroundProcessWithAvailability } from '../../providers/agent-foreground-process'
 import { confirmPtyShellForeground } from './pty-shell-foreground-confirmation'
 import {
   judgeCachedAgentJobEvidence,
@@ -24,6 +24,11 @@ import {
 import { isShellProcess } from '../../../shared/shell-process-detection'
 import { resolveFallbackForegroundProcess } from './foreground-fallback-process'
 import { parsePtySessionId } from '../pty-session-id'
+import {
+  ptyProcessNameIsSpawnFile,
+  createPtyForegroundResolver,
+  shouldCachePtyForeground
+} from './spawn-file-foreground-process'
 
 const FOREGROUND_AGENT_CACHE_TTL_MS = 1000
 const SHELL_FOREGROUND_REFRESH_RETRY_MS = 5_000
@@ -52,6 +57,8 @@ export function createPtyForegroundProcessTracker(args: {
   isDead: () => boolean
 }): PtyForegroundProcessTracker {
   const proc = args.process
+  const staticName = ptyProcessNameIsSpawnFile(proc)
+  const resolveForeground = createPtyForegroundResolver(proc)
   let lastOutputAt = 0
   // `pid` anchors the identity to the row that proved it (null when ambiguous).
   let cachedAgentForeground: CachedAgentForeground | null = null
@@ -69,16 +76,12 @@ export function createPtyForegroundProcessTracker(args: {
   let foregroundRefreshInFlight = false
   let lastForegroundRefreshStartedAt = 0
   const getFallbackProcess = (): string | null =>
-    resolveFallbackForegroundProcess(proc.process, args.shellPath)
+    resolveFallbackForegroundProcess(staticName ? args.shellPath : proc.process, args.shellPath)
   const getActiveStartupAgent = (
     now = Date.now()
   ): { processName: string; expiresAt: number } | null => {
-    if (!startupAgentForeground) {
-      return null
-    }
-    if (now > startupAgentForeground.expiresAt) {
+    if (startupAgentForeground && now > startupAgentForeground.expiresAt) {
       startupAgentForeground = null
-      return null
     }
     return startupAgentForeground
   }
@@ -138,7 +141,7 @@ export function createPtyForegroundProcessTracker(args: {
       }
     }
     const anchor = cachedAgentForeground
-    void resolveAgentForegroundProcessWithAvailability(proc.pid, fallbackProcess, {
+    void resolveForeground(proc.pid, fallbackProcess, {
       contextPaths,
       ...(anchor?.pid != null
         ? { anchorProcessId: anchor.pid, anchorProcessName: anchor.processName }
@@ -148,13 +151,13 @@ export function createPtyForegroundProcessTracker(args: {
         if (args.isDead() || !available) {
           return
         }
-        if (!processName || !recognizeAgentProcess(processName)) {
+        if (!shouldCachePtyForeground(processName, staticName)) {
           if (process.platform === 'win32' && fallbackIsShell && cachedAgentForeground !== null) {
             // Job, not console: needs no console attachment, so no fork (#10857).
             const verdict = judgeCachedAgentJobEvidence({
               jobProcessIds: readWindowsPtyJobProcessIds(proc),
               jobSupported: isWindowsPtyJobReadable(),
-              shellPid: proc.pid,
+              shellPid: ptyShellProcessId(proc) ?? proc.pid,
               anchorProcessId: cachedAgentForeground.pid,
               identityAgeMs: Date.now() - cachedAgentForeground.refreshedAt
             })
@@ -248,7 +251,8 @@ export function createPtyForegroundProcessTracker(args: {
         if (
           cachedAgentForeground &&
           fallbackProcess !== null &&
-          (isAgentForegroundWrapperProcess(fallbackProcess) ||
+          (staticName ||
+            isAgentForegroundWrapperProcess(fallbackProcess) ||
             inspectOuterWrapper ||
             (process.platform === 'win32' && isShellProcess(fallbackProcess)))
         ) {
@@ -279,33 +283,30 @@ export function createPtyForegroundProcessTracker(args: {
         ) {
           return fallbackProcess
         }
-        const resolution = await resolveAgentForegroundProcessWithAvailability(
-          proc.pid,
-          fallbackProcess,
-          {
-            contextPaths,
-            fresh: true,
-            ...(process.platform === 'win32'
-              ? {
-                  forceProcessScan: true,
-                  readWindowsConsoleAttachedProcessIds: () =>
-                    readWindowsConsoleAttachedProcessIds(proc.pid)
-                }
-              : {})
-          }
-        )
+        const resolution = await resolveForeground(proc.pid, fallbackProcess, {
+          contextPaths,
+          fresh: true,
+          ...(process.platform === 'win32'
+            ? {
+                forceProcessScan: true,
+                readWindowsConsoleAttachedProcessIds: () =>
+                  readWindowsConsoleAttachedProcessIds(proc.pid)
+              }
+            : {})
+        })
         if (args.isDead() || !resolution.available) {
           return null
         }
-        const recognized = recognizeAgentProcess(resolution.processName)
-        if (recognized) {
+        const processName =
+          recognizeAgentProcess(resolution.processName)?.processName ?? resolution.processName
+        if (shouldCachePtyForeground(processName, staticName)) {
           cachedAgentForeground = {
-            processName: recognized.processName,
+            processName,
             pid: resolution.processId ?? null,
             refreshedAt: Date.now()
           }
           startupAgentForeground = null
-          return recognized.processName
+          return cachedAgentForeground.processName
         }
         cachedAgentForeground = null
         startupAgentForeground = null
diff --git a/src/main/daemon/pty-subprocess/native-pty-spawn-bun.test.ts b/src/main/daemon/pty-subprocess/native-pty-spawn-bun.test.ts
new file mode 100644
index 000000000000..26a3fcda7dc7
--- /dev/null
+++ b/src/main/daemon/pty-subprocess/native-pty-spawn-bun.test.ts
@@ -0,0 +1,109 @@
+import { describe, expect, it, vi } from 'vitest'
+
+const { nodePtyFactory, wrapShellSpawnMock } = vi.hoisted(() => ({
+  nodePtyFactory: vi.fn(() => ({ spawn: vi.fn() })),
+  wrapShellSpawnMock: vi.fn((file: string, args: string[]) => ({ file, args }))
+}))
+
+vi.mock('node-pty', nodePtyFactory)
+vi.mock('../../providers/macos-tcc-login-shell', () => ({
+  hostReportsChildExitStatus: (file: string) => file !== '/usr/bin/login',
+  wrapShellSpawnForMacosTccAttribution: wrapShellSpawnMock
+}))
+
+import { spawnNativeDaemonPty } from './native-pty-spawn'
+
+describe('native PTY runtime selection', () => {
+  it('spawns with Bun.Terminal without loading node-pty', async () => {
+    const dispose = vi.fn()
+    const spawnBunPty = vi.fn(() => ({
+      pid: 9876,
+      cols: 80,
+      rows: 24,
+      process: '/bin/zsh',
+      handleFlowControl: false,
+      onData: vi.fn(() => ({ dispose })),
+      onExit: vi.fn(() => ({ dispose })),
+      write: vi.fn(),
+      resize: vi.fn(),
+      clear: vi.fn(),
+      kill: vi.fn(),
+      destroy: vi.fn(),
+      pause: vi.fn(),
+      resume: vi.fn()
+    }))
+
+    const result = await spawnNativeDaemonPty(
+      {
+        shellPath: '/bin/zsh',
+        shellArgs: ['-l'],
+        spawnCwd: '/tmp',
+        env: { TERM: 'xterm-256color' },
+        cols: 80,
+        rows: 24,
+        windowsFallbackAttempts: []
+      },
+      { canUseBunPty: () => true, spawnBunPty }
+    )
+
+    expect(result.process.pid).toBe(9876)
+    expect(spawnBunPty).toHaveBeenCalledOnce()
+    expect(nodePtyFactory).not.toHaveBeenCalled()
+  })
+
+  it('applies the macOS login wrapper before selecting the Bun PTY runtime', async () => {
+    const platform = Object.getOwnPropertyDescriptor(process, 'platform')
+    const spawnBunPty = vi.fn(() => ({
+      pid: 9877,
+      cols: 80,
+      rows: 24,
+      process: '/usr/bin/login',
+      handleFlowControl: false,
+      onData: vi.fn(() => ({ dispose: vi.fn() })),
+      onExit: vi.fn(() => ({ dispose: vi.fn() })),
+      write: vi.fn(),
+      resize: vi.fn(),
+      clear: vi.fn(),
+      kill: vi.fn(),
+      destroy: vi.fn(),
+      pause: vi.fn(),
+      resume: vi.fn()
+    }))
+    const onMacosTccSpawnStrategy = vi.fn()
+    wrapShellSpawnMock.mockReturnValueOnce({
+      file: '/usr/bin/login',
+      args: ['-flpq', 'tester', '/bin/zsh', '-l']
+    })
+    Object.defineProperty(process, 'platform', { configurable: true, value: 'darwin' })
+
+    try {
+      const result = await spawnNativeDaemonPty(
+        {
+          shellPath: '/bin/zsh',
+          shellArgs: ['-l'],
+          spawnCwd: '/tmp',
+          env: { TERM: 'xterm-256color' },
+          cols: 80,
+          rows: 24,
+          windowsFallbackAttempts: [],
+          onMacosTccSpawnStrategy
+        },
+        { canUseBunPty: () => true, spawnBunPty }
+      )
+
+      expect(result.process.pid).toBe(9877)
+      expect(spawnBunPty).toHaveBeenCalledWith(
+        expect.objectContaining({
+          file: '/usr/bin/login',
+          args: ['-flpq', 'tester', '/bin/zsh', '-l']
+        })
+      )
+      expect(result.reportsChildExitStatus).toBe(false)
+      expect(onMacosTccSpawnStrategy).toHaveBeenCalledWith('wrapped')
+    } finally {
+      if (platform) {
+        Object.defineProperty(process, 'platform', platform)
+      }
+    }
+  })
+})
diff --git a/src/main/daemon/pty-subprocess/native-pty-spawn-windows.test.ts b/src/main/daemon/pty-subprocess/native-pty-spawn-windows.test.ts
new file mode 100644
index 000000000000..8d6f7117d081
--- /dev/null
+++ b/src/main/daemon/pty-subprocess/native-pty-spawn-windows.test.ts
@@ -0,0 +1,124 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { spawnNativeDaemonPty } from './native-pty-spawn'
+import { WindowsBunPtySpawnUnconfirmedError } from './windows-bun-pty-spawn-receipt'
+
+const attempts = ['pwsh.exe', 'powershell.exe', 'cmd.exe'].map((shellPath) => ({
+  shellPath,
+  shellArgs: [shellPath === 'cmd.exe' ? '/K' : '-NoExit'],
+  effectiveCwd: 'C:\\work',
+  validationCwd: 'C:\\work',
+  startupCommandDeliveredInShellArgs: true
+}))
+const args = {
+  shellPath: attempts[0]!.shellPath,
+  shellArgs: attempts[0]!.shellArgs,
+  spawnCwd: 'C:\\work',
+  env: {},
+  cols: 80,
+  rows: 24,
+  windowsFallbackAttempts: attempts
+}
+
+function createProcess(waitForSpawn: () => Promise<void>) {
+  return {
+    pid: 9876,
+    cols: 80,
+    rows: 24,
+    process: 'gate',
+    handleFlowControl: false,
+    onData: vi.fn(() => ({ dispose: vi.fn() })),
+    onExit: vi.fn(() => ({ dispose: vi.fn() })),
+    write: vi.fn(),
+    resize: vi.fn(),
+    clear: vi.fn(),
+    kill: vi.fn(),
+    destroy: vi.fn(),
+    pause: vi.fn(),
+    resume: vi.fn(),
+    waitForSpawn
+  }
+}
+
+describe('Windows Bun shell fallback after gated spawn', () => {
+  const platform = Object.getOwnPropertyDescriptor(process, 'platform')!
+  beforeEach(() => {
+    Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' })
+    vi.spyOn(console, 'warn').mockImplementation(() => {})
+  })
+  afterEach(() => {
+    Object.defineProperty(process, 'platform', platform)
+    vi.restoreAllMocks()
+  })
+
+  it('walks both fallback shells when gate wrappers start but their actual shells fail', async () => {
+    const spawnBunPty = vi.fn(({ file }: { file: string }) =>
+      createProcess(async () => {
+        await Promise.resolve()
+        if (file !== 'cmd.exe') {
+          throw new Error(`spawn ${file} EACCES`)
+        }
+      })
+    )
+    const result = await spawnNativeDaemonPty(args, { canUseBunPty: () => true, spawnBunPty })
+    expect(spawnBunPty.mock.calls.map(([args]) => args.file)).toEqual([
+      'pwsh.exe',
+      'powershell.exe',
+      'cmd.exe'
+    ])
+    expect(result.shellPath).toBe('cmd.exe')
+    expect(result.startupCommandDeliveredInShellArgs).toBe(true)
+    expect(spawnBunPty.mock.results[0]!.value.destroy).toHaveBeenCalledOnce()
+    expect(spawnBunPty.mock.results[1]!.value.destroy).toHaveBeenCalledOnce()
+    expect(spawnBunPty.mock.results[2]!.value.destroy).not.toHaveBeenCalled()
+  })
+
+  it('does not report a wrapper as a working shell before its actual spawn is confirmed', async () => {
+    let confirm!: () => void
+    const confirmation = new Promise<void>((resolve) => {
+      confirm = resolve
+    })
+    const finished = vi.fn()
+    const spawnBunPty = vi.fn(() => createProcess(() => confirmation))
+    const result = spawnNativeDaemonPty(args, { canUseBunPty: () => true, spawnBunPty }).then(
+      finished
+    )
+    await Promise.resolve()
+    expect(finished).not.toHaveBeenCalled()
+    confirm()
+    await result
+    expect(finished).toHaveBeenCalledOnce()
+  })
+
+  it('destroys an unconfirmed gate on cancellation without starting a fallback shell', async () => {
+    const controller = new AbortController()
+    const proc = createProcess(() => new Promise(() => {}))
+    const spawnBunPty = vi.fn(() => proc)
+    const result = spawnNativeDaemonPty(
+      { ...args, signal: controller.signal },
+      { canUseBunPty: () => true, spawnBunPty }
+    )
+    controller.abort(new Error('spawn canceled'))
+    await expect(result).rejects.toThrow('spawn canceled')
+    expect(proc.destroy).toHaveBeenCalledOnce()
+    expect(spawnBunPty).toHaveBeenCalledOnce()
+  })
+
+  it.each([0, 1])(
+    'stops at an ambiguous attempt %s to avoid running its startup command twice',
+    async (ambiguousIndex) => {
+      const spawnBunPty = vi.fn(({ file }: { file: string }) =>
+        createProcess(async () => {
+          if (file === attempts[ambiguousIndex]!.shellPath) {
+            throw new WindowsBunPtySpawnUnconfirmedError('missing receipt')
+          }
+          throw new Error('spawn ENOENT')
+        })
+      )
+      await expect(
+        spawnNativeDaemonPty(args, { canUseBunPty: () => true, spawnBunPty })
+      ).rejects.toBeInstanceOf(WindowsBunPtySpawnUnconfirmedError)
+      expect(spawnBunPty).toHaveBeenCalledTimes(ambiguousIndex + 1)
+      expect(spawnBunPty.mock.results.at(-1)!.value.destroy).toHaveBeenCalledOnce()
+    }
+  )
+})
diff --git a/src/main/daemon/pty-subprocess/native-pty-spawn.ts b/src/main/daemon/pty-subprocess/native-pty-spawn.ts
index e0332ba99218..e89e8a5aac42 100644
--- a/src/main/daemon/pty-subprocess/native-pty-spawn.ts
+++ b/src/main/daemon/pty-subprocess/native-pty-spawn.ts
@@ -1,4 +1,5 @@
-import * as pty from 'node-pty'
+import type * as pty from 'node-pty'
+import { waitForPromiseWithSignal } from '../../../shared/abort-signal-reason'
 import {
   hostReportsChildExitStatus,
   wrapShellSpawnForMacosTccAttribution
@@ -6,6 +7,12 @@ import {
 import type { WindowsShellSpawnAttempt } from '../../providers/windows-shell-fallback-chain'
 import { assignHostProcessToKillOnCloseJob } from '../../windows/windows-pty-job'
 
+import { canUseBunPty, spawnBunPty } from './bun-pty-process'
+import { WindowsBunPtySpawnUnconfirmedError } from './windows-bun-pty-spawn-receipt'
+
+async function loadNodePty(): Promise<typeof pty> {
+  return import('node-pty')
+}
 export type SpawnedDaemonPty = {
   process: pty.IPty
   shellPath: string
@@ -15,25 +22,66 @@ export type SpawnedDaemonPty = {
   reportsChildExitStatus: boolean
 }
 
+type NativePtyRuntime = {
+  canUseBunPty: typeof canUseBunPty
+  spawnBunPty: typeof spawnBunPty
+}
+
 /** Walks the Windows PowerShell -> cmd.exe fallback chain when ConPTY rejects the primary shell. */
-export function spawnNativeDaemonPty(args: {
-  shellPath: string
-  shellArgs: string[]
-  spawnCwd: string
-  env: Record<string, string>
-  cols: number
-  rows: number
-  windowsFallbackAttempts: WindowsShellSpawnAttempt[]
-  onMacosTccSpawnStrategy?: (strategy: 'wrapped' | 'direct') => void
-}): SpawnedDaemonPty {
+export async function spawnNativeDaemonPty(
+  args: {
+    shellPath: string
+    shellArgs: string[]
+    spawnCwd: string
+    env: Record<string, string>
+    cols: number
+    rows: number
+    windowsFallbackAttempts: WindowsShellSpawnAttempt[]
+    signal?: AbortSignal
+    onMacosTccSpawnStrategy?: (strategy: 'wrapped' | 'direct') => void
+  },
+  runtime: NativePtyRuntime = { canUseBunPty, spawnBunPty }
+): Promise<SpawnedDaemonPty> {
   let reportsChildExitStatus = true
-  const spawnAt = (shellPath: string, shellArgs: string[], cwd: string): pty.IPty => {
+  const spawnAt = async (
+    shellPath: string,
+    shellArgs: string[],
+    cwd: string
+  ): Promise<pty.IPty> => {
+    args.signal?.throwIfAborted()
     const wrapped = wrapShellSpawnForMacosTccAttribution(shellPath, shellArgs, args.env)
+    reportsChildExitStatus = hostReportsChildExitStatus(wrapped.file)
+    if (runtime.canUseBunPty()) {
+      const proc = runtime.spawnBunPty({
+        file: wrapped.file,
+        args: wrapped.args,
+        cwd,
+        env: args.env,
+        cols: args.cols,
+        rows: args.rows
+      })
+      try {
+        if (proc.waitForSpawn) {
+          await waitForPromiseWithSignal(proc.waitForSpawn(), args.signal)
+        }
+        args.signal?.throwIfAborted()
+      } catch (error) {
+        try {
+          proc.destroy()
+        } catch (cleanupError) {
+          console.warn('[daemon/pty] Failed shell launch cleanup failed:', cleanupError)
+        }
+        throw error
+      }
+      args.onMacosTccSpawnStrategy?.(wrapped.file === shellPath ? 'direct' : 'wrapped')
+      return proc
+    }
+    const nodePty = await loadNodePty()
     // Why: children inherit job membership, so the host job must exist before the first Windows PTY.
     if (process.platform === 'win32') {
       assignHostProcessToKillOnCloseJob()
     }
-    const proc = pty.spawn(wrapped.file, wrapped.args, {
+    const proc = nodePty.spawn(wrapped.file, wrapped.args, {
       name: args.env.TERM ?? 'xterm-256color',
       cols: args.cols,
       rows: args.rows,
@@ -48,7 +96,7 @@ export function spawnNativeDaemonPty(args: {
   }
 
   try {
-    const process_ = spawnAt(args.shellPath, args.shellArgs, args.spawnCwd)
+    const process_ = await spawnAt(args.shellPath, args.shellArgs, args.spawnCwd)
     return {
       process: process_,
       shellPath: args.shellPath,
@@ -56,12 +104,13 @@ export function spawnNativeDaemonPty(args: {
       reportsChildExitStatus
     }
   } catch (primaryErr) {
-    if (process.platform !== 'win32') {
+    args.signal?.throwIfAborted()
+    if (process.platform !== 'win32' || primaryErr instanceof WindowsBunPtySpawnUnconfirmedError) {
       throw primaryErr
     }
     for (const attempt of args.windowsFallbackAttempts.slice(1)) {
       try {
-        const process = spawnAt(attempt.shellPath, attempt.shellArgs, attempt.effectiveCwd)
+        const process = await spawnAt(attempt.shellPath, attempt.shellArgs, attempt.effectiveCwd)
         const message = primaryErr instanceof Error ? primaryErr.message : String(primaryErr)
         console.warn(
           `[daemon/pty] Primary shell "${args.shellPath}" failed (${message}), fell back to "${attempt.shellPath}"`
@@ -73,7 +122,11 @@ export function spawnNativeDaemonPty(args: {
           startupCommandDeliveredInShellArgs: attempt.startupCommandDeliveredInShellArgs,
           reportsChildExitStatus
         }
-      } catch {
+      } catch (error) {
+        args.signal?.throwIfAborted()
+        if (error instanceof WindowsBunPtySpawnUnconfirmedError) {
+          throw error
+        }
         // This fallback shell also failed -- try the next link in the chain.
       }
     }
diff --git a/src/main/daemon/pty-subprocess/pty-shell-foreground-confirmation.ts b/src/main/daemon/pty-subprocess/pty-shell-foreground-confirmation.ts
index 2fdd75e35182..978da1ac67f2 100644
--- a/src/main/daemon/pty-subprocess/pty-shell-foreground-confirmation.ts
+++ b/src/main/daemon/pty-subprocess/pty-shell-foreground-confirmation.ts
@@ -1,4 +1,5 @@
 import type * as pty from 'node-pty'
+import { ptyShellProcessId } from '../../windows/windows-pty-job'
 import { confirmShellForegroundProcess } from '../../providers/agent-foreground-process'
 import { readWindowsPtyJobProcessIds } from '../../providers/windows-pty-job-membership'
 
@@ -7,14 +8,14 @@ import { readWindowsPtyJobProcessIds } from '../../providers/windows-pty-job-mem
  *  never cached state. */
 export async function confirmPtyShellForeground(args: {
   process: pty.IPty
-  shellPath: string
+  shellPath: string | undefined
   isDead: () => boolean
 }): Promise<boolean> {
   if (args.isDead() || !args.process.pid) {
     return false
   }
   const confirmed = await confirmShellForegroundProcess(
-    args.process.pid,
+    ptyShellProcessId(args.process),
     args.shellPath,
     process.platform === 'win32'
       ? { readWindowsPtyJobProcessIds: () => readWindowsPtyJobProcessIds(args.process) }
diff --git a/src/main/daemon/pty-subprocess/spawn-environment.ts b/src/main/daemon/pty-subprocess/spawn-environment.ts
index 129747d4a0d8..c8316bb383a0 100644
--- a/src/main/daemon/pty-subprocess/spawn-environment.ts
+++ b/src/main/daemon/pty-subprocess/spawn-environment.ts
@@ -1,3 +1,4 @@
+import { restoreOrStripOverlayEnv } from '../../../shared/agent-overlay-env'
 import { delimiter } from 'node:path'
 import { dropInheritedOrcaFishHistory } from '../../fish-history-session'
 import { removeAppImageRuntimeEnv } from '../../pty/appimage-terminal-env'
@@ -21,6 +22,7 @@ import {
   expandWindowsEnvironmentVariables,
   expandWindowsPathEnvironmentVariables
 } from '../../../shared/windows-environment-expansion'
+import { applyScrubSafeAgentEnvAliases } from '../../../shared/agent-hook-scrub-safe-env'
 import type { TuiAgent } from '../../../shared/tui-agent'
 import type { PtySubprocessOptions } from '../pty-subprocess'
 
@@ -28,7 +30,9 @@ const PANE_IDENTITY_ENV_KEYS = [
   'ORCA_PANE_KEY',
   'ORCA_TAB_ID',
   'ORCA_WORKTREE_ID',
-  'ORCA_AGENT_LAUNCH_TOKEN'
+  'ORCA_AGENT_LAUNCH_TOKEN',
+  // Not identity but equally per-spawn: an inherited copy names another launch's CLI.
+  'ORCA_WSL_CLI_DIR'
 ] as const
 const WINDOWS_PATH_ENV_KEY_RE = /^path$/i
 
@@ -55,6 +59,22 @@ function deleteRequestedDaemonEnvKeys(
     keys?.includes('ORCA_CODEX_HOME') === true &&
     env.ORCA_CODEX_HOME !== undefined &&
     env.CODEX_HOME === env.ORCA_CODEX_HOME
+  // A merged caller config can supersede the daemon's recorded overlay source.
+  if (
+    keys?.includes('ORCA_OPENCODE_CONFIG_DIR') &&
+    (env.OPENCODE_CONFIG_DIR === undefined ||
+      env.OPENCODE_CONFIG_DIR === env.ORCA_OPENCODE_CONFIG_DIR)
+  ) {
+    restoreOrStripOverlayEnv(
+      env,
+      {
+        primary: 'OPENCODE_CONFIG_DIR',
+        overlay: 'ORCA_OPENCODE_CONFIG_DIR',
+        source: 'ORCA_OPENCODE_SOURCE_CONFIG_DIR'
+      },
+      {}
+    )
+  }
   for (const key of keys ?? []) {
     delete env[key]
   }
@@ -169,6 +189,9 @@ export function createDaemonPtyEnvironment(opts: PtySubprocessOptions): Record<s
   delete env.ELECTRON_RUN_AS_NODE
   removeAppImageRuntimeEnv(env)
   removeInheritedNoColor(env)
+  // Why last: the aliases mirror pane identity AFTER every strip above has settled, so an
+  // alias can never outlive the value it mirrors.
+  applyScrubSafeAgentEnvAliases(env)
   env.LANG ??= 'en_US.UTF-8'
   return env
 }
diff --git a/src/main/daemon/pty-subprocess/spawn-file-child-processes.ts b/src/main/daemon/pty-subprocess/spawn-file-child-processes.ts
new file mode 100644
index 000000000000..be70254dc12c
--- /dev/null
+++ b/src/main/daemon/pty-subprocess/spawn-file-child-processes.ts
@@ -0,0 +1,50 @@
+import type { IPty } from 'node-pty'
+import {
+  getCommandTokenPathBasename,
+  getFirstCommandToken
+} from '../../../shared/command-token-scanner'
+import {
+  collectDescendantsFromIndex,
+  getProcessTableIndex
+} from '../../../shared/process-table-index'
+import type { ProcessTableRow } from '../../../shared/process-table-snapshot'
+import type { PtyChildProcessVerdict } from '../../../shared/terminal-process-inspection'
+import { readWindowsPtyJobProcessIds } from '../../providers/windows-pty-job-membership'
+
+function executableName(command: string): string {
+  return getCommandTokenPathBasename(getFirstCommandToken(command)).replace(/^-/, '')
+}
+
+export function inspectSpawnFileChildProcessesFromRows(
+  rows: readonly ProcessTableRow[],
+  rootPid: number,
+  shellName: string | null
+): PtyChildProcessVerdict {
+  const index = getProcessTableIndex(rows)
+  const root = index.byPid.get(rootPid)
+  if (!root || !shellName || !root.tty || root.tty === '?') {
+    return 'unverifiable'
+  }
+  const tree = [{ ...root, depth: 0 }, ...collectDescendantsFromIndex(index, rootPid)]
+  const shell = tree
+    .filter((row) => executableName(row.command) === shellName && !row.stat.includes('Z'))
+    .sort((left, right) => left.depth - right.depth)[0]
+  if (!shell) {
+    return 'unverifiable'
+  }
+  // The macOS login wrapper and its spawned shell are launch plumbing, not user jobs.
+  const launchChain = new Set([rootPid])
+  let ancestor: ProcessTableRow | undefined = shell
+  while (ancestor && !launchChain.has(ancestor.pid)) {
+    launchChain.add(ancestor.pid)
+    ancestor = index.byPid.get(ancestor.ppid)
+  }
+  return tree.some((row) => !launchChain.has(row.pid) && !row.stat.includes('Z'))
+    ? 'children'
+    : 'no-children'
+}
+
+export function inspectSpawnFileWindowsChildProcesses(proc: IPty): PtyChildProcessVerdict {
+  const members = readWindowsPtyJobProcessIds(proc)
+  return members === null ? 'unverifiable' : members.size > 1 ? 'children' : 'no-children'
+}
diff --git a/src/main/daemon/pty-subprocess/spawn-file-foreground-process.ts b/src/main/daemon/pty-subprocess/spawn-file-foreground-process.ts
new file mode 100644
index 000000000000..b5763f238b1f
--- /dev/null
+++ b/src/main/daemon/pty-subprocess/spawn-file-foreground-process.ts
@@ -0,0 +1,125 @@
+import type { IPty } from 'node-pty'
+import { isShellProcess } from '../../../shared/shell-process-detection'
+import {
+  getCommandTokenPathBasename,
+  getFirstCommandToken
+} from '../../../shared/command-token-scanner'
+import {
+  collectDescendantsFromIndex,
+  getProcessTableIndex
+} from '../../../shared/process-table-index'
+import type { ProcessTableRow } from '../../../shared/process-table-snapshot'
+import {
+  getFreshProcessTableSnapshot,
+  getProcessTableSnapshot
+} from '../../../shared/process-table-snapshot-reader'
+import { selectForegroundProcessCandidate } from '../../../shared/foreground-process-selection'
+import { resolveOuterWrapperForegroundProcess } from '../../../shared/foreground-wrapper-agent'
+import { recognizeAgentProcess } from '../../../shared/agent-process-recognition'
+import {
+  resolveAgentForegroundProcessWithAvailability,
+  type AgentForegroundProcessResolution,
+  type AgentForegroundResolutionOptions
+} from '../../providers/agent-foreground-process'
+import { readWindowsPtyJobProcessIds } from '../../providers/windows-pty-job-membership'
+import { ptyShellProcessId } from '../../windows/windows-pty-job'
+import {
+  readWindowsProcessIdentityTable,
+  readWindowsProcessIdentityTableFresh
+} from '../../windows/windows-process-table'
+
+export function ptyProcessNameIsSpawnFile(proc: IPty): boolean {
+  return 'processNameIsSpawnFile' in proc && proc.processNameIsSpawnFile === true
+}
+
+export function createPtyForegroundResolver(
+  proc: IPty
+): typeof resolveAgentForegroundProcessWithAvailability {
+  return ptyProcessNameIsSpawnFile(proc)
+    ? (_pid, fallback, options) => resolveSpawnFileForegroundProcess(proc, fallback, options)
+    : resolveAgentForegroundProcessWithAvailability
+}
+
+export function shouldCachePtyForeground(name: string | null, staticName: boolean): name is string {
+  return (
+    name !== null && (recognizeAgentProcess(name) !== null || (staticName && !isShellProcess(name)))
+  )
+}
+
+export function resolveSpawnFileForegroundFromRows(
+  rows: readonly ProcessTableRow[],
+  rootPid: number
+): AgentForegroundProcessResolution {
+  const index = getProcessTableIndex(rows)
+  const root = index.byPid.get(rootPid)
+  if (!root || !root.tpgid || root.tpgid < 0 || !root.tty || root.tty === '?') {
+    return { available: false, processName: null }
+  }
+  const tree = [{ ...root, depth: 0 }, ...collectDescendantsFromIndex(index, rootPid)]
+  const candidates = tree
+    .filter((row) => row.pgid === root.tpgid && row.tty === root.tty && !/[TZ]/.test(row.stat))
+    .sort((left, right) => right.depth - left.depth)
+  const foreground = candidates[0]
+  if (!foreground) {
+    return { available: false, processName: null }
+  }
+  const name = getCommandTokenPathBasename(getFirstCommandToken(foreground.command)).replace(
+    /^-/,
+    ''
+  )
+  const selected = selectForegroundProcessCandidate(candidates, tree)
+  return {
+    available: name.length > 0,
+    processName: selected
+      ? resolveOuterWrapperForegroundProcess(selected.recognized, selected.candidate, tree)
+      : recognizeAgentProcess(name)
+        ? null
+        : name || null
+  }
+}
+
+export async function resolveSpawnFileForegroundProcess(
+  proc: IPty,
+  fallbackProcess: string | null,
+  options: AgentForegroundResolutionOptions = {}
+): Promise<AgentForegroundProcessResolution> {
+  try {
+    if (process.platform !== 'win32') {
+      const rows = options.fresh
+        ? await getFreshProcessTableSnapshot()
+        : await getProcessTableSnapshot()
+      return resolveSpawnFileForegroundFromRows(rows, proc.pid)
+    }
+    const resolution = await resolveAgentForegroundProcessWithAvailability(
+      proc.pid,
+      fallbackProcess,
+      options
+    )
+    if (!resolution.available || recognizeAgentProcess(resolution.processName)) {
+      return resolution
+    }
+    const members = readWindowsPtyJobProcessIds(proc)
+    const shellPid = ptyShellProcessId(proc)
+    if (!members || shellPid === undefined) {
+      return { available: false, processName: null }
+    }
+    if (members.size === 1) {
+      return { available: true, processName: fallbackProcess }
+    }
+    const rows = options.fresh
+      ? await readWindowsProcessIdentityTableFresh()
+      : await readWindowsProcessIdentityTable()
+    const candidate = collectDescendantsFromIndex(getProcessTableIndex(rows), shellPid)
+      .filter((row) => members.has(row.pid))
+      .sort((left, right) => right.depth - left.depth)[0]
+    // Only the agent resolver can grant an identity after ambiguity and console checks.
+    if (candidate && recognizeAgentProcess(candidate.name)) {
+      return resolution
+    }
+    return candidate
+      ? { available: true, processName: candidate.name, processId: candidate.pid }
+      : { available: false, processName: null }
+  } catch {
+    return { available: false, processName: null }
+  }
+}
diff --git a/src/main/daemon/pty-subprocess/spawn-file-foreground-rejected-agents.test.ts b/src/main/daemon/pty-subprocess/spawn-file-foreground-rejected-agents.test.ts
new file mode 100644
index 000000000000..d79dc806e5a0
--- /dev/null
+++ b/src/main/daemon/pty-subprocess/spawn-file-foreground-rejected-agents.test.ts
@@ -0,0 +1,134 @@
+import type { IPty } from 'node-pty'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { ProcessTableRow } from '../../../shared/process-table-snapshot'
+import { __setWindowsProcessTreeLoaderForTests } from '../../windows/windows-process-table'
+import {
+  resolveSpawnFileForegroundFromRows,
+  resolveSpawnFileForegroundProcess
+} from './spawn-file-foreground-process'
+
+const { members } = vi.hoisted(() => ({ members: vi.fn() }))
+vi.mock('../../providers/windows-pty-job-membership', () => ({
+  readWindowsPtyJobProcessIds: members
+}))
+
+const proc: IPty = {
+  pid: 100,
+  cols: 80,
+  rows: 24,
+  handleFlowControl: false,
+  process: 'powershell.exe',
+  onData: () => ({ dispose() {} }),
+  onExit: () => ({ dispose() {} }),
+  write() {},
+  resize() {},
+  clear() {},
+  kill() {},
+  pause() {},
+  resume() {}
+}
+
+const root: ProcessTableRow = {
+  pid: 100,
+  ppid: 1,
+  pgid: 100,
+  tpgid: 101,
+  tty: 'pts/test',
+  stat: 'S',
+  startTime: 'shell-start',
+  command: '/bin/zsh'
+}
+
+beforeEach(() => members.mockReturnValue(new Set([100, 101, 102])))
+afterEach(() => {
+  __setWindowsProcessTreeLoaderForTests()
+  vi.restoreAllMocks()
+  vi.clearAllMocks()
+})
+
+describe('POSIX static-name agent selection', () => {
+  it('does not pick a rejected sibling agent by its executable basename', () => {
+    expect(
+      resolveSpawnFileForegroundFromRows(
+        [
+          root,
+          { ...root, pid: 101, ppid: 100, pgid: 101, stat: 'S+', command: 'claude' },
+          { ...root, pid: 102, ppid: 100, pgid: 101, stat: 'S+', command: 'codex' }
+        ],
+        100
+      )
+    ).toEqual({ available: true, processName: null })
+  })
+
+  it('does not promote a headless one-shot agent from its executable basename', () => {
+    expect(
+      resolveSpawnFileForegroundFromRows(
+        [
+          root,
+          { ...root, pid: 101, ppid: 100, pgid: 101, stat: 'S+', command: 'claude -p "review"' }
+        ],
+        100
+      )
+    ).toEqual({ available: true, processName: null })
+  })
+
+  it.each(['vim', 'npm', 'sleep'])('retains the ordinary %s name', (command) => {
+    expect(
+      resolveSpawnFileForegroundFromRows(
+        [root, { ...root, pid: 101, ppid: 100, pgid: 101, stat: 'S+', command }],
+        100
+      )
+    ).toEqual({ available: true, processName: command })
+  })
+})
+
+describe('Windows static-name agent selection', () => {
+  function installRows(names: string[]): void {
+    vi.spyOn(process, 'platform', 'get').mockReturnValue('win32')
+    const rows = [
+      { pid: process.pid, ppid: 0, name: 'vitest.exe', commandLine: 'vitest' },
+      { pid: 100, ppid: 1, name: 'powershell.exe', commandLine: 'powershell.exe' },
+      ...names.map((name, index) => ({ pid: 101 + index, ppid: 100, name, commandLine: name }))
+    ]
+    __setWindowsProcessTreeLoaderForTests(() => ({
+      ProcessDataFlag: { None: 0, Memory: 1, CommandLine: 2, CreationTime: 4 },
+      getAllProcesses: (callback) => callback(rows)
+    }))
+  }
+
+  it('does not re-admit a detached agent through owned job membership', async () => {
+    installRows(['droid.exe'])
+    const consoleMembers = vi.fn(async () => new Set([100, 999]))
+    expect(
+      await resolveSpawnFileForegroundProcess(proc, 'powershell.exe', {
+        fresh: true,
+        readWindowsConsoleAttachedProcessIds: consoleMembers
+      })
+    ).toEqual({ available: true, processName: 'powershell.exe' })
+    expect(consoleMembers).toHaveBeenCalledOnce()
+  })
+
+  it('does not choose a rejected sibling agent from the identity table', async () => {
+    installRows(['claude.exe', 'codex.exe'])
+    expect(
+      await resolveSpawnFileForegroundProcess(proc, 'powershell.exe', { fresh: true })
+    ).toEqual({ available: true, processName: 'powershell.exe' })
+  })
+
+  it('retains a positively authorized agent', async () => {
+    installRows(['droid.exe'])
+    expect(
+      await resolveSpawnFileForegroundProcess(proc, 'powershell.exe', {
+        fresh: true,
+        readWindowsConsoleAttachedProcessIds: async () => new Set([100, 101])
+      })
+    ).toEqual({ available: true, processName: 'droid', processId: 101 })
+  })
+
+  it('retains an ordinary executable from the identity table', async () => {
+    installRows(['vim.exe'])
+    expect(
+      await resolveSpawnFileForegroundProcess(proc, 'powershell.exe', { fresh: true })
+    ).toEqual({ available: true, processName: 'vim.exe', processId: 101 })
+  })
+})
diff --git a/src/main/daemon/pty-subprocess/spawn-preflight-bun.test.ts b/src/main/daemon/pty-subprocess/spawn-preflight-bun.test.ts
new file mode 100644
index 000000000000..d40b30e2b324
--- /dev/null
+++ b/src/main/daemon/pty-subprocess/spawn-preflight-bun.test.ts
@@ -0,0 +1,41 @@
+import { afterEach, beforeEach, expect, it, vi } from 'vitest'
+
+const fixture = vi.hoisted((): { shellPid?: number } => ({}))
+vi.mock('./bun-pty-process', () => ({
+  canUseBunPty: () => true,
+  spawnBunPty: () => ({
+    pid: 41,
+    get shellProcessId() {
+      return fixture.shellPid
+    },
+    onExit(callback: (event: { exitCode: number }) => void) {
+      queueMicrotask(() => callback({ exitCode: 0 }))
+      return { dispose() {} }
+    }
+  })
+}))
+
+import { runPtySpawnHealthProbe } from './spawn-preflight'
+
+beforeEach(() =>
+  vi.stubGlobal(
+    'process',
+    Object.create(process, {
+      platform: { value: 'win32' }
+    })
+  )
+)
+afterEach(() => vi.unstubAllGlobals())
+
+it.each([undefined, 41, 0])(
+  'refuses successful gate exit without shell identity %s',
+  async (pid) => {
+    fixture.shellPid = pid
+    await expect(runPtySpawnHealthProbe()).rejects.toThrow('could not identify the Windows shell')
+  }
+)
+
+it('accepts successful exit with the separate original shell identity', async () => {
+  fixture.shellPid = 42
+  await expect(runPtySpawnHealthProbe()).resolves.toBeUndefined()
+})
diff --git a/src/main/daemon/pty-subprocess/spawn-preflight.ts b/src/main/daemon/pty-subprocess/spawn-preflight.ts
index facaf0a69bd4..404f5b258f04 100644
--- a/src/main/daemon/pty-subprocess/spawn-preflight.ts
+++ b/src/main/daemon/pty-subprocess/spawn-preflight.ts
@@ -1,6 +1,7 @@
-import * as pty from 'node-pty'
+import type * as pty from 'node-pty'
 import { statSync } from 'node:fs'
 import { release } from 'node:os'
+import { getCmdExePath } from '../../../shared/windows-batch-spawn'
 import {
   ensureNodePtySpawnHelperExecutable,
   getNodePtySpawnHelperCandidates,
@@ -10,9 +11,14 @@ import {
 import { resolveSafePtyDefaultCwd } from '../../providers/pty-default-cwd'
 import { TerminalAttachCanceledError } from '../daemon-errors'
 import { DaemonProtocolError } from '../types'
+import { canUseBunPty, spawnBunPty } from './bun-pty-process'
 
 const PTY_SPAWN_HEALTH_TIMEOUT_MS = 4_000
 
+async function loadNodePty(): Promise<typeof pty> {
+  return import('node-pty')
+}
+
 function daemonEnvironmentDiagSuffix(): string {
   const orca = process.env.ORCA_APP_VERSION?.trim() || '0.0.0-dev'
   const systemVersion =
@@ -79,7 +85,7 @@ function preflightDaemonCwd(): void {
 }
 
 function preflightMacNodePtySpawnEnvironment(): void {
-  if (process.platform !== 'darwin') {
+  if (process.platform !== 'darwin' || canUseBunPty()) {
     return
   }
   let candidates: string[]
@@ -119,7 +125,9 @@ export async function preflightPtySpawn(args: {
   sessionId: string
   signal?: AbortSignal
 }): Promise<void> {
-  ensureNodePtySpawnHelperExecutable()
+  if (!canUseBunPty()) {
+    ensureNodePtySpawnHelperExecutable()
+  }
   preflightUnixPtySpawnEnvironment()
   try {
     if (process.platform === 'win32') {
@@ -154,21 +162,34 @@ export function formatPtySpawnError(err: unknown, shellPath: string, spawnCwd: s
   return formatted
 }
 
-export function runPtySpawnHealthProbe(): Promise<void> {
+export async function runPtySpawnHealthProbe(): Promise<void> {
+  const requiresShellIdentity = process.platform === 'win32' && canUseBunPty()
   const cwd = isExistingDirectory(process.env.ORCA_USER_DATA_PATH)
     ? process.env.ORCA_USER_DATA_PATH
     : resolveSafePtyDefaultCwd()
+  const command =
+    process.platform === 'win32'
+      ? { file: getCmdExePath(), args: ['/d', '/c', 'exit', '0'] }
+      : { file: '/bin/sh', args: ['-c', 'exit 0'] }
   let proc: pty.IPty
   try {
-    proc = pty.spawn('/bin/sh', ['-c', 'exit 0'], {
-      name: 'xterm-256color',
-      cols: 2,
-      rows: 1,
-      cwd,
-      env: { ...process.env, TERM: 'xterm-256color' }
-    })
+    const env: Record<string, string> = { TERM: 'xterm-256color' }
+    for (const [key, value] of Object.entries(process.env)) {
+      if (value !== undefined) {
+        env[key] = value
+      }
+    }
+    proc = canUseBunPty()
+      ? spawnBunPty({ ...command, cols: 2, rows: 1, cwd, env })
+      : (await loadNodePty()).spawn(command.file, command.args, {
+          name: 'xterm-256color',
+          cols: 2,
+          rows: 1,
+          cwd,
+          env
+        })
   } catch (err) {
-    throw formatPtySpawnError(err, '/bin/sh', cwd)
+    throw formatPtySpawnError(err, command.file, cwd)
   }
 
   return new Promise<void>((resolve, reject) => {
@@ -201,7 +222,18 @@ export function runPtySpawnHealthProbe(): Promise<void> {
     }, PTY_SPAWN_HEALTH_TIMEOUT_MS)
     exitDisposable = proc.onExit(({ exitCode }) => {
       if (exitCode === 0) {
-        finish()
+        const shellPid = 'shellProcessId' in proc ? proc.shellProcessId : undefined
+        if (
+          requiresShellIdentity &&
+          (typeof shellPid !== 'number' ||
+            !Number.isSafeInteger(shellPid) ||
+            shellPid <= 0 ||
+            shellPid === proc.pid)
+        ) {
+          finish(new Error('PTY spawn health check could not identify the Windows shell'))
+        } else {
+          finish()
+        }
       } else {
         finish(new Error(`PTY spawn health check exited with code ${exitCode}`))
       }
@@ -210,10 +242,10 @@ export function runPtySpawnHealthProbe(): Promise<void> {
 }
 
 export function preflightPtySpawnHealth(): boolean {
-  if (process.platform === 'win32') {
+  if (process.platform === 'win32' && !canUseBunPty()) {
     return false
   }
-  if (process.platform === 'darwin') {
+  if (!canUseBunPty()) {
     ensureNodePtySpawnHelperExecutable()
   }
   preflightUnixPtySpawnEnvironment()
diff --git a/src/main/daemon/pty-subprocess/subprocess-handle.ts b/src/main/daemon/pty-subprocess/subprocess-handle.ts
index 5d7ef1634247..56b739bfccc0 100644
--- a/src/main/daemon/pty-subprocess/subprocess-handle.ts
+++ b/src/main/daemon/pty-subprocess/subprocess-handle.ts
@@ -9,8 +9,13 @@ import { isValidPtySize } from '../daemon-pty-size'
 import type { SubprocessHandle } from '../session-subprocess-handle'
 import { createPtyForegroundProcessTracker } from './foreground-process-tracker'
 import { PtyPreListenerEvents } from './pre-listener-events'
+import { ptyProcessNameIsSpawnFile } from './spawn-file-foreground-process'
+import { inspectSpawnFileWindowsChildProcesses } from './spawn-file-child-processes'
 
-type DisposableNativePty = pty.IPty & { destroy?: () => void }
+type DisposableNativePty = pty.IPty & {
+  destroy?: () => void
+  signalProcess?: (signal: string) => void
+}
 
 export function createDaemonPtySubprocessHandle(args: {
   process: pty.IPty
@@ -26,7 +31,7 @@ export function createDaemonPtySubprocessHandle(args: {
   const reportsChildExitStatus = args.reportsChildExitStatus
   const proc = args.process
   // node-pty exposes destroy at runtime but omits it from IPty.
-  const nativeProc = proc as DisposableNativePty
+  const nativeProc: DisposableNativePty = proc
   const events = new PtyPreListenerEvents()
   let dead = false
   // I/O failure is not exit evidence; keep termination and producer flow control available.
@@ -64,6 +69,10 @@ export function createDaemonPtySubprocessHandle(args: {
   const slavePath = readPtySlavePath(proc)
   return {
     pid: proc.pid,
+    processNameIsSpawnFile: ptyProcessNameIsSpawnFile(proc),
+    ...(process.platform === 'win32'
+      ? { inspectChildProcesses: () => inspectSpawnFileWindowsChildProcesses(proc) }
+      : {}),
     shellPath: args.shellPath,
     shellCwd: args.spawnCwd,
     shellPathEnv: args.env.PATH,
@@ -166,6 +175,14 @@ export function createDaemonPtySubprocessHandle(args: {
       if (dead) {
         return
       }
+      if (nativeProc.signalProcess) {
+        try {
+          nativeProc.signalProcess(sig)
+        } catch {
+          /* The process may have exited. */
+        }
+        return
+      }
       const signalRootPid = (): void => {
         try {
           process.kill(proc.pid, sig)
diff --git a/src/main/daemon/pty-subprocess/windows-bun-pty-gate-entry.ts b/src/main/daemon/pty-subprocess/windows-bun-pty-gate-entry.ts
new file mode 100644
index 000000000000..9c17da7fa18e
--- /dev/null
+++ b/src/main/daemon/pty-subprocess/windows-bun-pty-gate-entry.ts
@@ -0,0 +1,21 @@
+import { unlinkSync } from 'node:fs'
+import { readWindowsBunPtyGateRequest, runWindowsBunPtyGate } from './windows-bun-pty-gate'
+
+async function main(): Promise<void> {
+  const requestPath = process.argv[2]
+  if (!requestPath) {
+    throw new Error('Windows PTY gate request path is required')
+  }
+  const request = readWindowsBunPtyGateRequest(requestPath)
+  // Arguments can contain agent prompts; do not retain them for the shell's lifetime.
+  unlinkSync(requestPath)
+  process.exitCode = await runWindowsBunPtyGate(request)
+}
+
+void main().catch((error: unknown) => {
+  console.error(
+    '[pty] Windows job gate failed:',
+    error instanceof Error ? error.message : String(error)
+  )
+  process.exitCode = 1
+})
diff --git a/src/main/daemon/pty-subprocess/windows-bun-pty-gate.integration.test.ts b/src/main/daemon/pty-subprocess/windows-bun-pty-gate.integration.test.ts
new file mode 100644
index 000000000000..bb1c3d88a478
--- /dev/null
+++ b/src/main/daemon/pty-subprocess/windows-bun-pty-gate.integration.test.ts
@@ -0,0 +1,89 @@
+import { build } from 'esbuild'
+import { existsSync, mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join, resolve } from 'node:path'
+import { describe, expect, it } from 'vitest'
+import { runProcess, runProcessSync } from '../../../shared/child-process/run-process'
+import { orcadBunRuntimeFilename } from '../../../shared/orcad-artifacts'
+import { ORCAD_BUN_VERSION } from '../../../shared/orcad-bun-runtime'
+import { createWindowsBunPtyLaunch } from './windows-bun-pty-launch'
+
+const runtimePath =
+  process.env.BUN_EXECUTABLE ??
+  resolve(__dirname, '../../../../out/orcad', orcadBunRuntimeFilename(process.platform))
+const available = existsSync(runtimePath)
+
+describe.skipIf(!available)('bundled Windows job gate under Bun', () => {
+  it('executes the worker with real Bun flags and preserves long executable argv', async () => {
+    expect(runProcessSync({ program: runtimePath, args: ['--version'] }).stdout.trim()).toBe(
+      ORCAD_BUN_VERSION
+    )
+    const directory = mkdtempSync(join(tmpdir(), 'orca-gate-contract-'))
+    const workerPath = join(directory, 'windows-bun-pty-gate-entry.js')
+    try {
+      await build({
+        entryPoints: [join(__dirname, 'windows-bun-pty-gate-entry.ts')],
+        bundle: true,
+        platform: 'node',
+        format: 'cjs',
+        outfile: workerPath,
+        logLevel: 'silent'
+      })
+      const argv = ['x'.repeat(16000), 'a b', 'quote"', '%value%&!', '状態', '']
+      const env = Object.fromEntries(
+        Object.entries(process.env).filter(
+          (entry): entry is [string, string] => entry[1] !== undefined
+        )
+      )
+      const launch = createWindowsBunPtyLaunch(
+        {
+          file: runtimePath,
+          args: ['-e', 'console.log(JSON.stringify(process.argv.slice(1)))', ...argv],
+          cwd: directory,
+          env
+        },
+        { runtimePath, workerPath }
+      )
+      try {
+        launch.release()
+        const result = await runProcess({
+          program: launch.command[0]!,
+          args: launch.command.slice(1),
+          cwd: directory,
+          env: launch.env,
+          timeoutMs: 10_000
+        })
+        expect(result.timedOut).toBe(false)
+        expect(result.code, result.stderr).toBe(0)
+        expect(JSON.parse(result.stdout)).toEqual(argv)
+        await expect(launch.waitForSpawn(Promise.resolve(result.code!))).resolves.toBeUndefined()
+        expect(existsSync(launch.command.at(-1)!)).toBe(false)
+      } finally {
+        launch.dispose()
+      }
+      const failedLaunch = createWindowsBunPtyLaunch(
+        { file: join(directory, 'missing-shell.exe'), args: [], cwd: directory, env },
+        { runtimePath, workerPath }
+      )
+      try {
+        failedLaunch.release()
+        const result = await runProcess({
+          program: failedLaunch.command[0]!,
+          args: failedLaunch.command.slice(1),
+          cwd: directory,
+          env: failedLaunch.env,
+          timeoutMs: 10_000
+        })
+        expect(result.timedOut).toBe(false)
+        expect(result.code).toBe(1)
+        await expect(failedLaunch.waitForSpawn(Promise.resolve(1))).rejects.toThrow(
+          /missing-shell|ENOENT|not found/
+        )
+      } finally {
+        failedLaunch.dispose()
+      }
+    } finally {
+      rmSync(directory, { recursive: true, force: true })
+    }
+  }, 15_000)
+})
diff --git a/src/main/daemon/pty-subprocess/windows-bun-pty-gate.test.ts b/src/main/daemon/pty-subprocess/windows-bun-pty-gate.test.ts
new file mode 100644
index 000000000000..a87870f80d5b
--- /dev/null
+++ b/src/main/daemon/pty-subprocess/windows-bun-pty-gate.test.ts
@@ -0,0 +1,150 @@
+import { EventEmitter } from 'node:events'
+import { describe, expect, it, vi } from 'vitest'
+import type { spawnProcess } from '../../../shared/child-process/run-process'
+import { runWindowsBunPtyGate, type WindowsBunPtyGateRequest } from './windows-bun-pty-gate'
+
+const request: WindowsBunPtyGateRequest = {
+  file: 'C:\\Program Files\\PowerShell\\7\\pwsh.exe',
+  args: ['-NoLogo', '-NoExit', '-Command', 'A'.repeat(16000)],
+  cwd: 'C:\\work',
+  gatePath: 'gate',
+  shellPidPath: 'shell.pid',
+  runtimeOptions: {}
+}
+
+describe('Windows Bun PTY job gate worker', () => {
+  it.each(['exit', 'error'] as const)(
+    'ignores Windows console interrupts only while supervising a child (%s)',
+    async (outcome) => {
+      const platform = vi.spyOn(process, 'platform', 'get').mockReturnValue('win32')
+      const previousListeners = process.listeners('SIGINT')
+      const child = new EventEmitter()
+      try {
+        const result = runWindowsBunPtyGate(request, {
+          waitForGate: async () => {},
+          reportSpawnError: vi.fn(),
+          // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: this fixture exposes only the child events the gate consumes.
+          spawn: () => child as ReturnType<typeof spawnProcess>
+        })
+        expect(process.listeners('SIGINT')).toHaveLength(previousListeners.length + 1)
+        await Promise.resolve()
+        if (outcome === 'exit') {
+          child.emit('exit', 17)
+          await expect(result).resolves.toBe(17)
+        } else {
+          child.emit('error', new Error('spawn denied'))
+          await expect(result).rejects.toThrow('spawn denied')
+        }
+        expect(process.listeners('SIGINT')).toEqual(previousListeners)
+      } finally {
+        platform.mockRestore()
+      }
+    }
+  )
+
+  it('does not spawn before assignment and propagates the child exit code', async () => {
+    let release!: () => void
+    const waitForGate = vi.fn(
+      () =>
+        new Promise<void>((resolve) => {
+          release = resolve
+        })
+    )
+    const child = Object.assign(new EventEmitter(), { pid: 1234 })
+    const reportShellPid = vi.fn()
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: this fixture exposes only the child events and pid the gate consumes.
+    const spawn = vi.fn(() => child as ReturnType<typeof spawnProcess>)
+    const result = runWindowsBunPtyGate(request, {
+      waitForGate,
+      spawn,
+      reportShellPid,
+      env: { TERM: 'xterm-256color' }
+    })
+    await Promise.resolve()
+    expect(spawn).not.toHaveBeenCalled()
+    release()
+    await Promise.resolve()
+    expect(spawn).toHaveBeenCalledWith(
+      expect.objectContaining({
+        program: request.file,
+        args: request.args,
+        cwd: request.cwd,
+        stdio: 'inherit'
+      })
+    )
+    expect(reportShellPid).not.toHaveBeenCalled()
+    child.emit('spawn')
+    expect(reportShellPid).toHaveBeenCalledWith(1234)
+    child.emit('exit', 17)
+    await expect(result).resolves.toBe(17)
+  })
+
+  it('never starts a child after a failed job gate', async () => {
+    const spawn = vi.fn()
+    await expect(
+      runWindowsBunPtyGate(request, {
+        waitForGate: async () => {
+          throw new Error('gate missing')
+        },
+        reportSpawnError: vi.fn(),
+        spawn
+      })
+    ).rejects.toThrow('gate missing')
+    expect(spawn).not.toHaveBeenCalled()
+  })
+
+  it('keeps supervising the shell when its identity receipt cannot be published', async () => {
+    const child = Object.assign(new EventEmitter(), { pid: 1234 })
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+    const reportSpawnError = vi.fn()
+    const result = runWindowsBunPtyGate(request, {
+      waitForGate: async () => {},
+      reportSpawnError,
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the fixture exposes only the child events and pid consumed by the gate.
+      spawn: () => child as ReturnType<typeof spawnProcess>,
+      reportShellPid() {
+        throw new Error('receipt denied')
+      }
+    })
+    await Promise.resolve()
+    child.emit('spawn')
+    expect(warn).toHaveBeenCalledOnce()
+    child.emit('exit', 17)
+    await expect(result).resolves.toBe(17)
+    expect(reportSpawnError).not.toHaveBeenCalled()
+    warn.mockRestore()
+  })
+
+  it('reports a child spawn error instead of a successful wrapper exit', async () => {
+    const child = new EventEmitter()
+    const reportSpawnError = vi.fn()
+    const result = runWindowsBunPtyGate(request, {
+      waitForGate: async () => {},
+      reportSpawnError,
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: this fixture exposes the error/exit events the gate consumes.
+      spawn: () => child as ReturnType<typeof spawnProcess>
+    })
+    await Promise.resolve()
+    child.emit('error', new Error('spawn denied'))
+    await expect(result).rejects.toThrow('spawn denied')
+    expect(reportSpawnError).toHaveBeenCalledWith(
+      expect.objectContaining({ message: 'spawn denied' })
+    )
+  })
+
+  it('reports synchronous native spawn rejection without requiring a child event', async () => {
+    const reportSpawnError = vi.fn()
+    await expect(
+      runWindowsBunPtyGate(request, {
+        waitForGate: async () => {},
+        spawn: () => {
+          throw new Error('invalid executable')
+        },
+        reportSpawnError
+      })
+    ).rejects.toThrow('invalid executable')
+    expect(reportSpawnError).toHaveBeenCalledWith(
+      expect.objectContaining({ message: 'invalid executable' })
+    )
+  })
+})
diff --git a/src/main/daemon/pty-subprocess/windows-bun-pty-gate.ts b/src/main/daemon/pty-subprocess/windows-bun-pty-gate.ts
new file mode 100644
index 000000000000..384038c98f76
--- /dev/null
+++ b/src/main/daemon/pty-subprocess/windows-bun-pty-gate.ts
@@ -0,0 +1,172 @@
+import { readFileSync, statSync, unlinkSync } from 'node:fs'
+import { setTimeout as delay } from 'node:timers/promises'
+import { win32 } from 'node:path'
+import { spawnProcess, type ProcessSpec } from '../../../shared/child-process/run-process'
+import {
+  publishWindowsBunPtyShellPid,
+  publishWindowsBunPtySpawnError
+} from './windows-bun-pty-spawn-receipt'
+
+export const WINDOWS_BUN_PTY_GATE_ENV = 'ORCA_BUN_PTY_JOB_GATE'
+export const WINDOWS_BUN_PTY_RUNTIME_OPTION_KEYS = ['NODE_OPTIONS', 'BUN_OPTIONS'] as const
+
+export type WindowsBunPtyGateRequest = {
+  file: string
+  args: string[]
+  cwd: string
+  gatePath: string
+  shellPidPath: string
+  runtimeOptions: Partial<Record<(typeof WINDOWS_BUN_PTY_RUNTIME_OPTION_KEYS)[number], string>>
+}
+
+export function readWindowsBunPtyGateRequest(path: string): WindowsBunPtyGateRequest {
+  if (statSync(path).size > 1024 * 1024) {
+    throw new Error('Windows PTY gate request exceeds its size limit')
+  }
+  let value: unknown
+  try {
+    value = JSON.parse(readFileSync(path, 'utf8'))
+  } catch {
+    throw new Error('Invalid Windows PTY gate request')
+  }
+  const request = value
+  if (
+    typeof request !== 'object' ||
+    request === null ||
+    !('file' in request) ||
+    typeof request.file !== 'string' ||
+    !request.file ||
+    !('args' in request) ||
+    !Array.isArray(request.args) ||
+    !request.args.every((arg): arg is string => typeof arg === 'string') ||
+    !('cwd' in request) ||
+    typeof request.cwd !== 'string' ||
+    !request.cwd ||
+    !('gatePath' in request) ||
+    typeof request.gatePath !== 'string' ||
+    !request.gatePath ||
+    !('shellPidPath' in request) ||
+    typeof request.shellPidPath !== 'string' ||
+    !request.shellPidPath ||
+    !('runtimeOptions' in request) ||
+    typeof request.runtimeOptions !== 'object' ||
+    request.runtimeOptions === null ||
+    Array.isArray(request.runtimeOptions)
+  ) {
+    throw new Error('Invalid Windows PTY gate request')
+  }
+  const runtimeOptions: WindowsBunPtyGateRequest['runtimeOptions'] = {}
+  for (const [key, value] of Object.entries(request.runtimeOptions)) {
+    if ((key !== 'NODE_OPTIONS' && key !== 'BUN_OPTIONS') || typeof value !== 'string') {
+      throw new Error('Invalid Windows PTY gate request')
+    }
+    runtimeOptions[key] = value
+  }
+  return {
+    file: request.file,
+    args: request.args,
+    cwd: request.cwd,
+    gatePath: request.gatePath,
+    shellPidPath: request.shellPidPath,
+    runtimeOptions
+  }
+}
+
+export async function waitForWindowsBunPtyJobGate(gatePath: string): Promise<void> {
+  const deadline = Date.now() + 30_000
+  while (true) {
+    try {
+      unlinkSync(gatePath)
+      return
+    } catch (error) {
+      if (
+        typeof error !== 'object' ||
+        error === null ||
+        !('code' in error) ||
+        error.code !== 'ENOENT'
+      ) {
+        throw error
+      }
+    }
+    if (Date.now() >= deadline) {
+      throw new Error('Windows PTY job assignment timed out')
+    }
+    await delay(5)
+  }
+}
+
+export function windowsBunPtyChildSpec(
+  request: WindowsBunPtyGateRequest,
+  inheritedEnv: NodeJS.ProcessEnv
+): ProcessSpec {
+  const env: NodeJS.ProcessEnv = { ...inheritedEnv, ...request.runtimeOptions }
+  delete env[WINDOWS_BUN_PTY_GATE_ENV]
+  delete env.ORCA_BUN_PTY_CHILD_COMMAND
+  return {
+    program: request.file,
+    args: request.args,
+    cwd: request.cwd,
+    env,
+    stdio: 'inherit',
+    // cmd owns the command text following /K or /C; it must not receive CRT argv escaping.
+    ...(win32.basename(request.file).toLowerCase() === 'cmd.exe'
+      ? { windowsVerbatimArguments: true }
+      : {})
+  }
+}
+
+export async function runWindowsBunPtyGate(
+  request: WindowsBunPtyGateRequest,
+  deps: {
+    waitForGate?: (gatePath: string) => Promise<void>
+    spawn?: typeof spawnProcess
+    env?: NodeJS.ProcessEnv
+    reportShellPid?: (pid: number) => void
+    reportSpawnError?: (error: unknown) => void
+  } = {}
+): Promise<number> {
+  let spawned = false
+  // Preserve supervision when Ctrl-C reaches the entire Windows console.
+  const ignoreInterrupt = (): void => {}
+  if (process.platform === 'win32') {
+    process.on('SIGINT', ignoreInterrupt)
+  }
+  try {
+    await (deps.waitForGate ?? waitForWindowsBunPtyJobGate)(request.gatePath)
+    return await new Promise<number>((resolve, reject) => {
+      const child = (deps.spawn ?? spawnProcess)(
+        windowsBunPtyChildSpec(request, deps.env ?? process.env)
+      )
+      child.once('spawn', () => {
+        spawned = true
+        if (child.pid !== undefined) {
+          const report =
+            deps.reportShellPid ??
+            ((pid) => publishWindowsBunPtyShellPid(request.shellPidPath, pid))
+          try {
+            report(child.pid)
+          } catch (error) {
+            // Keep supervising the shell; absent identity must remain unverifiable.
+            console.warn('[pty] Failed to publish Windows shell identity:', error)
+          }
+        }
+      })
+      child.once('error', reject)
+      child.once('exit', (code) => resolve(code ?? 1))
+    })
+  } catch (error) {
+    if (!spawned) {
+      try {
+        const report =
+          deps.reportSpawnError ??
+          ((error) => publishWindowsBunPtySpawnError(request.shellPidPath, error))
+        report(error)
+      } catch (receiptError) {
+        console.warn('[pty] Failed to publish Windows shell spawn error:', receiptError)
+      }
+    }
+    throw error
+  } finally {
+    process.off('SIGINT', ignoreInterrupt)
+  }
+}
diff --git a/src/main/daemon/pty-subprocess/windows-bun-pty-job.test.ts b/src/main/daemon/pty-subprocess/windows-bun-pty-job.test.ts
new file mode 100644
index 000000000000..ccc3ebc6d1ad
--- /dev/null
+++ b/src/main/daemon/pty-subprocess/windows-bun-pty-job.test.ts
@@ -0,0 +1,158 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import {
+  __resetWindowsBunPtyJobForTests,
+  assignCurrentProcessToBunPtyHostJob,
+  createWindowsBunPtyJob,
+  type WindowsBunPtyJobNative
+} from './windows-bun-pty-job'
+
+function createNative(overrides: Partial<WindowsBunPtyJobNative> = {}): WindowsBunPtyJobNative {
+  return {
+    createJob: vi.fn(() => 7),
+    configureJob: vi.fn(() => true),
+    currentProcess: vi.fn(() => 99),
+    openProcess: vi.fn((_access, pid) => 1_000 + pid),
+    assignProcess: vi.fn(() => true),
+    isProcessInJob: vi.fn(() => true),
+    queryProcessIds: vi.fn(() => [11]),
+    suspendProcess: vi.fn(() => true),
+    resumeProcess: vi.fn(() => true),
+    terminateJob: vi.fn(() => true),
+    closeHandle: vi.fn(),
+    ...overrides
+  }
+}
+
+afterEach(() => {
+  vi.restoreAllMocks()
+  __resetWindowsBunPtyJobForTests()
+})
+
+describe('Windows Bun PTY job ownership', () => {
+  it('assigns the daemon to one kill-on-close host job', () => {
+    const native = createNative()
+
+    expect(assignCurrentProcessToBunPtyHostJob(native)).toBe(true)
+    expect(assignCurrentProcessToBunPtyHostJob(native)).toBe(true)
+
+    expect(native.createJob).toHaveBeenCalledOnce()
+    expect(native.configureJob).toHaveBeenCalledWith(7, 0x2800)
+    expect(native.assignProcess).toHaveBeenCalledWith(7, 99)
+  })
+
+  it('closes a rejected host job and caches the unavailable result', () => {
+    const native = createNative({ assignProcess: vi.fn(() => false) })
+
+    expect(assignCurrentProcessToBunPtyHostJob(native)).toBe(false)
+    expect(assignCurrentProcessToBunPtyHostJob(native)).toBe(false)
+
+    expect(native.createJob).toHaveBeenCalledOnce()
+    expect(native.closeHandle).toHaveBeenCalledWith(7)
+  })
+
+  it('assigns the gated PTY root before exposing the job', () => {
+    const native = createNative()
+
+    const job = createWindowsBunPtyJob(11, native)
+
+    expect(job).not.toBeNull()
+    expect(native.configureJob).toHaveBeenCalledWith(7, 0)
+    expect(native.openProcess).toHaveBeenCalledWith(0x1901, 11)
+    expect(native.assignProcess).toHaveBeenCalledWith(7, 1011)
+    expect(native.closeHandle).toHaveBeenCalledWith(1011)
+  })
+
+  it('suspends children that appear during the ownership fence and resumes exact handles', () => {
+    const queryProcessIds = vi
+      .fn<() => readonly number[] | null>()
+      .mockReturnValueOnce([11, 12])
+      .mockReturnValueOnce([11, 12, 13])
+      .mockReturnValueOnce([11, 12, 13])
+      .mockReturnValue([11, 12, 13])
+    const native = createNative({ queryProcessIds })
+    const job = createWindowsBunPtyJob(11, native)!
+    vi.mocked(native.closeHandle).mockClear()
+
+    expect(job.pause()).toBe(true)
+    expect(native.suspendProcess).toHaveBeenCalledWith(1011)
+    expect(native.suspendProcess).toHaveBeenCalledWith(1012)
+    expect(native.suspendProcess).toHaveBeenCalledWith(1013)
+    expect(job.resume()).toBe(true)
+
+    expect(native.resumeProcess).toHaveBeenCalledWith(1011)
+    expect(native.resumeProcess).toHaveBeenCalledWith(1012)
+    expect(native.resumeProcess).toHaveBeenCalledWith(1013)
+    expect(native.closeHandle).toHaveBeenCalledWith(1011)
+    expect(native.closeHandle).toHaveBeenCalledWith(1012)
+    expect(native.closeHandle).toHaveBeenCalledWith(1013)
+  })
+
+  it('never suspends a PID whose opened handle is outside the owned job', () => {
+    const native = createNative({
+      queryProcessIds: vi.fn(() => [11, 12]),
+      isProcessInJob: vi.fn((process) => process !== 1012)
+    })
+    const job = createWindowsBunPtyJob(11, native)!
+
+    expect(job.pause()).toBe(false)
+
+    expect(native.suspendProcess).toHaveBeenCalledWith(1011)
+    expect(native.suspendProcess).not.toHaveBeenCalledWith(1012)
+    expect(native.resumeProcess).toHaveBeenCalledWith(1011)
+    expect(native.closeHandle).toHaveBeenCalledWith(1012)
+  })
+
+  it('terminates a paused tree without resuming it first', () => {
+    const native = createNative({ queryProcessIds: vi.fn(() => [11]) })
+    const job = createWindowsBunPtyJob(11, native)!
+
+    expect(job.pause()).toBe(true)
+    expect(job.terminate()).toBe('terminated')
+    job.close()
+
+    expect(native.terminateJob).toHaveBeenCalledWith(7)
+    expect(native.resumeProcess).not.toHaveBeenCalled()
+    expect(native.closeHandle).toHaveBeenCalledWith(1011)
+    expect(native.closeHandle).toHaveBeenCalledWith(7)
+  })
+
+  it('retains an exact handle when resume fails so a later retry can recover it', () => {
+    const resumeProcess = vi.fn().mockReturnValueOnce(false).mockReturnValueOnce(true)
+    const native = createNative({ resumeProcess })
+    const job = createWindowsBunPtyJob(11, native)!
+    vi.mocked(native.closeHandle).mockClear()
+
+    expect(job.pause()).toBe(true)
+    expect(job.resume()).toBe(false)
+    expect(native.closeHandle).not.toHaveBeenCalledWith(1011)
+    expect(job.resume()).toBe(true)
+    expect(native.closeHandle).toHaveBeenCalledWith(1011)
+  })
+
+  it('keeps breakaway denied when forced termination needs kill-on-close', () => {
+    const native = createNative({
+      resumeProcess: vi.fn(() => false),
+      terminateJob: vi.fn(() => false)
+    })
+    vi.spyOn(console, 'warn').mockImplementation(() => {})
+    const job = createWindowsBunPtyJob(11, native)!
+    expect(job.pause()).toBe(true)
+    job.close()
+    expect(native.configureJob).toHaveBeenLastCalledWith(7, 0x2000)
+  })
+
+  it('terminates a still-suspended tree instead of abandoning it during close', () => {
+    const native = createNative({ resumeProcess: vi.fn(() => false) })
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+    const job = createWindowsBunPtyJob(11, native)!
+    vi.mocked(native.closeHandle).mockClear()
+
+    expect(job.pause()).toBe(true)
+    job.close()
+
+    expect(native.terminateJob).toHaveBeenCalledWith(7)
+    expect(native.closeHandle).toHaveBeenCalledWith(1011)
+    expect(native.closeHandle).toHaveBeenCalledWith(7)
+    expect(warn).toHaveBeenCalledOnce()
+  })
+})
diff --git a/src/main/daemon/pty-subprocess/windows-bun-pty-job.ts b/src/main/daemon/pty-subprocess/windows-bun-pty-job.ts
new file mode 100644
index 000000000000..5f0a7065c85e
--- /dev/null
+++ b/src/main/daemon/pty-subprocess/windows-bun-pty-job.ts
@@ -0,0 +1,218 @@
+import type { JobTerminationOutcome } from '../../windows/windows-pty-job'
+import {
+  __resetWindowsBunPtyNativeForTests,
+  loadWindowsBunPtyJobNative,
+  type WindowsBunPtyJobNative,
+  type WindowsNativeHandle
+} from './windows-bun-pty-native'
+
+export type { WindowsBunPtyJobNative } from './windows-bun-pty-native'
+
+export type WindowsBunPtyJob = {
+  listProcessIds(): readonly number[] | null
+  pause(): boolean
+  resume(): boolean
+  terminate(): JobTerminationOutcome
+  close(): void
+}
+
+const JOB_OBJECT_LIMIT_BREAKAWAY_OK = 0x0000_0800
+const JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE = 0x0000_2000
+const PROCESS_TERMINATE = 0x0001
+const PROCESS_SET_QUOTA = 0x0100
+const PROCESS_SUSPEND_RESUME = 0x0800
+const PROCESS_QUERY_LIMITED_INFORMATION = 0x1000
+const MAX_SUSPEND_PASSES = 8
+
+let hostJobAssigned: boolean | null = null
+
+export function assignCurrentProcessToBunPtyHostJob(
+  native: WindowsBunPtyJobNative | null = loadWindowsBunPtyJobNative()
+): boolean {
+  if (hostJobAssigned !== null) {
+    return hostJobAssigned
+  }
+  if (!native) {
+    hostJobAssigned = false
+    return false
+  }
+  const job = native.createJob()
+  if (
+    job === null ||
+    !native.configureJob(job, JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE | JOB_OBJECT_LIMIT_BREAKAWAY_OK) ||
+    !native.assignProcess(job, native.currentProcess())
+  ) {
+    if (job !== null) {
+      native.closeHandle(job)
+    }
+    hostJobAssigned = false
+    return false
+  }
+  // The host job deliberately lives until Windows closes it during process teardown.
+  hostJobAssigned = true
+  return true
+}
+
+class BunPtyJob implements WindowsBunPtyJob {
+  private readonly suspended = new Map<number, WindowsNativeHandle>()
+  private closed = false
+  private fullySuspended = false
+  private terminated = false
+
+  constructor(
+    private readonly rootPid: number,
+    private readonly handle: WindowsNativeHandle,
+    private readonly native: WindowsBunPtyJobNative
+  ) {}
+
+  listProcessIds(): readonly number[] | null {
+    return this.closed ? null : this.native.queryProcessIds(this.handle)
+  }
+
+  pause(): boolean {
+    if (this.closed || this.terminated) {
+      return false
+    }
+    if (this.fullySuspended) {
+      return true
+    }
+    if (this.suspended.size > 0 && !this.resume()) {
+      return false
+    }
+    for (let pass = 0; pass < MAX_SUSPEND_PASSES; pass += 1) {
+      const pids = this.listProcessIds()
+      if (!pids) {
+        this.resume()
+        return false
+      }
+      const ordered = [...pids].sort((left, right) => {
+        if (left === this.rootPid) {
+          return -1
+        }
+        if (right === this.rootPid) {
+          return 1
+        }
+        return left - right
+      })
+      let progressed = false
+      for (const pid of ordered) {
+        if (this.suspended.has(pid)) {
+          continue
+        }
+        const process = this.native.openProcess(
+          PROCESS_SUSPEND_RESUME | PROCESS_QUERY_LIMITED_INFORMATION,
+          pid
+        )
+        if (process === null) {
+          continue
+        }
+        if (!this.native.isProcessInJob(process, this.handle)) {
+          this.native.closeHandle(process)
+          continue
+        }
+        if (!this.native.suspendProcess(process)) {
+          this.native.closeHandle(process)
+          continue
+        }
+        this.suspended.set(pid, process)
+        progressed = true
+      }
+      const remaining = this.listProcessIds()
+      if (remaining && remaining.every((pid) => this.suspended.has(pid))) {
+        this.fullySuspended = true
+        return true
+      }
+      if (!remaining || !progressed) {
+        this.resume()
+        return false
+      }
+    }
+    this.resume()
+    return false
+  }
+
+  resume(): boolean {
+    this.fullySuspended = false
+    const ownedPids = this.terminated ? [] : this.listProcessIds()
+    for (const [pid, process] of this.suspended) {
+      const processExited = ownedPids !== null && !ownedPids.includes(pid)
+      if (!this.terminated && !processExited && !this.native.resumeProcess(process)) {
+        continue
+      }
+      this.native.closeHandle(process)
+      this.suspended.delete(pid)
+    }
+    return this.suspended.size === 0
+  }
+
+  terminate(): JobTerminationOutcome {
+    if (this.closed) {
+      return this.terminated ? 'terminated' : 'unavailable'
+    }
+    if (!this.terminated) {
+      this.terminated = this.native.terminateJob(this.handle)
+    }
+    if (this.terminated) {
+      this.resume()
+      return 'terminated'
+    }
+    return 'unavailable'
+  }
+
+  close(): void {
+    if (this.closed) {
+      return
+    }
+    if (!this.resume()) {
+      console.warn(
+        '[daemon/pty] Could not resume a Windows PTY tree during cleanup; terminating it'
+      )
+      this.terminated = this.native.terminateJob(this.handle)
+      if (!this.terminated) {
+        this.terminated = this.native.configureJob(this.handle, JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE)
+      }
+      this.resume()
+    }
+    this.native.closeHandle(this.handle)
+    this.closed = true
+  }
+}
+
+export function createWindowsBunPtyJob(
+  rootPid: number,
+  native: WindowsBunPtyJobNative | null = loadWindowsBunPtyJobNative()
+): WindowsBunPtyJob | null {
+  if (!native || !Number.isInteger(rootPid) || rootPid <= 0) {
+    return null
+  }
+  const job = native.createJob()
+  if (job === null || !native.configureJob(job, 0)) {
+    if (job !== null) {
+      native.closeHandle(job)
+    }
+    return null
+  }
+  const process = native.openProcess(
+    PROCESS_SET_QUOTA |
+      PROCESS_TERMINATE |
+      PROCESS_SUSPEND_RESUME |
+      PROCESS_QUERY_LIMITED_INFORMATION,
+    rootPid
+  )
+  if (process === null) {
+    native.closeHandle(job)
+    return null
+  }
+  const assigned = native.assignProcess(job, process)
+  native.closeHandle(process)
+  if (!assigned) {
+    native.closeHandle(job)
+    return null
+  }
+  return new BunPtyJob(rootPid, job, native)
+}
+
+export function __resetWindowsBunPtyJobForTests(): void {
+  __resetWindowsBunPtyNativeForTests()
+  hostJobAssigned = null
+}
diff --git a/src/main/daemon/pty-subprocess/windows-bun-pty-launch.test.ts b/src/main/daemon/pty-subprocess/windows-bun-pty-launch.test.ts
new file mode 100644
index 000000000000..1f4df4ef749f
--- /dev/null
+++ b/src/main/daemon/pty-subprocess/windows-bun-pty-launch.test.ts
@@ -0,0 +1,157 @@
+import { existsSync, readFileSync, writeFileSync } from 'node:fs'
+import { dirname, join } from 'node:path'
+import { describe, expect, it } from 'vitest'
+import { createWindowsBunPtyLaunch, resolveWindowsBunPtyGateEntry } from './windows-bun-pty-launch'
+import { readWindowsBunPtyGateRequest, windowsBunPtyChildSpec } from './windows-bun-pty-gate'
+import { publishWindowsBunPtyShellPid } from './windows-bun-pty-spawn-receipt'
+
+const workerPath = join(__dirname, 'windows-bun-pty-launch.test.ts')
+
+describe('Windows Bun PTY gated launch', () => {
+  it('reads only the atomic shell receipt and retains its first identity through cleanup', () => {
+    const launch = createWindowsBunPtyLaunch(
+      { file: 'shell.exe', args: [], env: {} },
+      { workerPath }
+    )
+    const { shellPidPath } = readWindowsBunPtyGateRequest(launch.command.at(-1)!)
+    try {
+      expect(launch.readShellProcessId()).toBeUndefined()
+      writeFileSync(`${shellPidPath}.pending`, '12')
+      expect(launch.readShellProcessId()).toBeUndefined()
+      writeFileSync(shellPidPath, 'not a PID')
+      expect(launch.readShellProcessId()).toBeUndefined()
+      for (const receipt of ['0', '-123', '4294967296', '123\n456', '1e3', '12.3']) {
+        writeFileSync(shellPidPath, receipt)
+        expect(launch.readShellProcessId()).toBeUndefined()
+      }
+      writeFileSync(shellPidPath, '1234')
+      expect(launch.readShellProcessId()).toBe(1234)
+      writeFileSync(shellPidPath, '5678')
+      expect(launch.readShellProcessId()).toBe(1234)
+    } finally {
+      launch.dispose()
+    }
+    expect(launch.readShellProcessId()).toBe(1234)
+  })
+
+  it('publishes a complete PID and leaves no intermediate receipt', () => {
+    const launch = createWindowsBunPtyLaunch(
+      { file: 'shell.exe', args: [], env: {} },
+      { workerPath }
+    )
+    const { shellPidPath } = readWindowsBunPtyGateRequest(launch.command.at(-1)!)
+    try {
+      publishWindowsBunPtyShellPid(shellPidPath, 1234)
+      expect(launch.readShellProcessId()).toBe(1234)
+      expect(existsSync(`${shellPidPath}.pending`)).toBe(false)
+    } finally {
+      launch.dispose()
+    }
+  })
+
+  it('preserves long executable argv without cmd interpretation and releases only once', () => {
+    const file = 'C:\\状 態\\%tool%&shell.exe'
+    const args = ['a b', 'c"d', 'e%F%g', 'h&i', 'j^k', 'bang!', 'line\nbreak', 'x'.repeat(16000)]
+    const launch = createWindowsBunPtyLaunch(
+      { file, args, cwd: 'C:\\work tree', env: { TERM: 'xterm-256color' } },
+      { workerPath }
+    )
+    const gate = launch.env.ORCA_BUN_PTY_JOB_GATE
+    const directory = dirname(gate)
+    try {
+      const request = readWindowsBunPtyGateRequest(launch.command.at(-1)!)
+      expect(request).toMatchObject({ file, args, cwd: 'C:\\work tree', gatePath: gate })
+      const child = windowsBunPtyChildSpec(request, launch.env)
+      expect(child.program).toBe(file)
+      expect(child.args).toEqual(args)
+      expect(child.windowsVerbatimArguments).toBeUndefined()
+      expect(child.stdio).toBe('inherit')
+      expect(child.env).not.toHaveProperty('ORCA_BUN_PTY_JOB_GATE')
+      expect(launch.windowsVerbatimArguments).toBe(false)
+      expect(launch.command).toContain('--no-env-file')
+      expect(launch.command).toContain(`--config=${join(directory, 'bunfig.toml')}`)
+      expect(launch.command).toContain(`--cwd=${directory}`)
+      expect(launch.command.join(' ').length).toBeLessThan(8191)
+      const clear = readFileSync(join(directory, 'clear.cmd'))
+      expect(clear.includes(Buffer.from('\x1b[3J\x1b[2J\x1b[H'))).toBe(true)
+      expect(existsSync(gate)).toBe(false)
+      launch.release()
+      launch.release()
+      expect(existsSync(gate)).toBe(true)
+    } finally {
+      launch.dispose()
+      launch.dispose()
+    }
+    expect(existsSync(directory)).toBe(false)
+  })
+
+  it.each(['/K', '/k', '/C', '/c'])(
+    'preserves direct cmd %s command text without CRT escaping',
+    (commandSwitch) => {
+      const file = 'C:\\Windows\\System32\\CMD.EXE'
+      const args = [commandSwitch, 'chcp 65001 > nul & echo 状態%VALUE%!']
+      const launch = createWindowsBunPtyLaunch({ file, args, env: {} }, { workerPath })
+      try {
+        const child = windowsBunPtyChildSpec(
+          readWindowsBunPtyGateRequest(launch.command.at(-1)!),
+          launch.env
+        )
+        expect(child.program).toBe(file)
+        expect(child.args).toEqual(args)
+        expect(child.windowsVerbatimArguments).toBe(true)
+      } finally {
+        launch.dispose()
+      }
+    }
+  )
+
+  it('withholds runtime preload options from the gate while preserving the shell environment', () => {
+    const env = {
+      NODE_OPTIONS: '--require C:\\workspace\\hook.js',
+      BUN_OPTIONS: '--preload hook.js',
+      TERM: 'xterm-256color'
+    }
+    const launch = createWindowsBunPtyLaunch({ file: 'shell.exe', args: [], env }, { workerPath })
+    try {
+      expect(launch.env).not.toHaveProperty('NODE_OPTIONS')
+      expect(launch.env).not.toHaveProperty('BUN_OPTIONS')
+      expect(
+        windowsBunPtyChildSpec(readWindowsBunPtyGateRequest(launch.command.at(-1)!), launch.env).env
+      ).toEqual(env)
+    } finally {
+      launch.dispose()
+    }
+  })
+
+  it('fails before launch when the gate entry is missing', () => {
+    expect(() =>
+      createWindowsBunPtyLaunch(
+        { file: 'shell.exe', args: [], env: {} },
+        { workerPath: join(workerPath, 'missing') }
+      )
+    ).toThrow('Windows PTY gate entry not found')
+  })
+
+  it('rejects a cmd-unsafe line break before creating launch state', () => {
+    expect(() =>
+      createWindowsBunPtyLaunch(
+        { file: 'C:\\Windows\\System32\\cmd.exe', args: ['/c', 'first\nsecond'], env: {} },
+        { workerPath }
+      )
+    ).toThrow('cmd.exe cannot receive an argument containing a line break')
+  })
+
+  it('resolves adjacent, factored-chunk, and unpacked desktop layouts', () => {
+    const name = 'windows-bun-pty-gate-entry.js'
+    expect(resolveWindowsBunPtyGateEntry('/orcad', () => true)).toBe(join('/orcad', name))
+    expect(
+      resolveWindowsBunPtyGateEntry(
+        '/app/out/main/chunks',
+        (path) => path === join('/app/out/main', name)
+      )
+    ).toBe(join('/app/out/main', name))
+    expect(resolveWindowsBunPtyGateEntry('/resources/app.asar/out/main', () => true)).toBe(
+      join('/resources/app.asar.unpacked/out/main', name)
+    )
+  })
+})
diff --git a/src/main/daemon/pty-subprocess/windows-bun-pty-launch.ts b/src/main/daemon/pty-subprocess/windows-bun-pty-launch.ts
new file mode 100644
index 000000000000..dda83ad021a2
--- /dev/null
+++ b/src/main/daemon/pty-subprocess/windows-bun-pty-launch.ts
@@ -0,0 +1,159 @@
+import { existsSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join, win32 } from 'node:path'
+import {
+  buildWindowsCmdShimCommandLine,
+  validateWindowsCmdArguments
+} from '../../../shared/child-process/windows-command-line'
+import { getCmdExePath } from '../../../shared/windows-batch-spawn'
+import {
+  WINDOWS_BUN_PTY_GATE_ENV,
+  WINDOWS_BUN_PTY_RUNTIME_OPTION_KEYS,
+  type WindowsBunPtyGateRequest
+} from './windows-bun-pty-gate'
+import {
+  readWindowsBunPtySpawnReceipt,
+  waitForWindowsBunPtySpawn,
+  type WindowsBunPtySpawnReceipt
+} from './windows-bun-pty-spawn-receipt'
+
+const CLEAR_SEQUENCE = '\x1b[3J\x1b[2J\x1b[H'
+const CLEANUP_MAX_RETRIES = 5
+const CLEANUP_RETRY_DELAY_MS = 50
+
+export function resolveWindowsBunPtyGateEntry(
+  runtimeDir = __dirname,
+  pathExists: (path: string) => boolean = existsSync
+): string {
+  const directory = runtimeDir.replace(/app\.asar(?=[\\/]|$)/, 'app.asar.unpacked')
+  const candidates = [
+    join(directory, 'windows-bun-pty-gate-entry.js'),
+    join(directory, '..', 'windows-bun-pty-gate-entry.js')
+  ]
+  return candidates.find(pathExists) ?? candidates[0]!
+}
+
+function removeLaunchDirectory(directory: string): boolean {
+  try {
+    rmSync(directory, {
+      recursive: true,
+      force: true,
+      maxRetries: CLEANUP_MAX_RETRIES,
+      retryDelay: CLEANUP_RETRY_DELAY_MS
+    })
+    return true
+  } catch (error) {
+    console.warn(`[pty] failed to remove Windows Bun launch directory ${directory}:`, error)
+    return false
+  }
+}
+
+export type WindowsBunPtyLaunch = {
+  command: string[]
+  clearCommand: string[]
+  env: Record<string, string>
+  windowsVerbatimArguments: boolean
+  readShellProcessId(): number | undefined
+  waitForSpawn(wrapperExited: Promise<number>): Promise<void>
+  release(): void
+  dispose(): void
+}
+
+export function createWindowsBunPtyLaunch(
+  args: {
+    file: string
+    args: string[]
+    env: Record<string, string>
+    cwd?: string
+  },
+  deps: { workerPath?: string; runtimePath?: string } = {}
+): WindowsBunPtyLaunch {
+  if (win32.basename(args.file).toLowerCase() === 'cmd.exe') {
+    validateWindowsCmdArguments([args.file, ...args.args])
+  }
+  const workerPath = deps.workerPath ?? resolveWindowsBunPtyGateEntry()
+  if (!existsSync(workerPath)) {
+    throw new Error(`Windows PTY gate entry not found: ${workerPath}`)
+  }
+  const directory = mkdtempSync(join(tmpdir(), 'orca-bun-pty-'))
+  const gatePath = join(directory, 'job-assigned')
+  const requestPath = join(directory, 'request.json')
+  const shellPidPath = join(directory, 'shell.pid')
+  const configPath = join(directory, 'bunfig.toml')
+  const clearPath = join(directory, 'clear.cmd')
+  const cmdExe = getCmdExePath()
+  let released = false
+  let disposed = false
+  let spawnReceipt: WindowsBunPtySpawnReceipt | undefined
+  const readSpawnReceipt = (): WindowsBunPtySpawnReceipt | undefined => {
+    if (!disposed) {
+      spawnReceipt ??= readWindowsBunPtySpawnReceipt(shellPidPath)
+    }
+    return spawnReceipt
+  }
+  const env: Record<string, string> = { ...args.env, [WINDOWS_BUN_PTY_GATE_ENV]: gatePath }
+  const runtimeOptions: WindowsBunPtyGateRequest['runtimeOptions'] = {}
+  for (const key of WINDOWS_BUN_PTY_RUNTIME_OPTION_KEYS) {
+    if (env[key] !== undefined) {
+      runtimeOptions[key] = env[key]
+    }
+    delete env[key]
+  }
+
+  try {
+    writeFileSync(
+      requestPath,
+      JSON.stringify({
+        file: args.file,
+        args: args.args,
+        cwd: args.cwd ?? process.cwd(),
+        gatePath,
+        shellPidPath,
+        runtimeOptions
+      } satisfies WindowsBunPtyGateRequest),
+      { encoding: 'utf8', flag: 'wx', mode: 0o600 }
+    )
+    writeFileSync(configPath, '', { flag: 'wx', mode: 0o600 })
+    writeFileSync(clearPath, `@echo off\r\n<nul set /p "=${CLEAR_SEQUENCE}"\r\n`, {
+      encoding: 'ascii',
+      flag: 'wx'
+    })
+  } catch (error) {
+    removeLaunchDirectory(directory)
+    throw error
+  }
+
+  return {
+    // Run outside the workspace so its bunfig/.env/preloads cannot execute before job assignment.
+    command: [
+      deps.runtimePath ?? process.execPath,
+      '--no-env-file',
+      `--config=${configPath}`,
+      `--cwd=${directory}`,
+      workerPath,
+      requestPath
+    ],
+    clearCommand: [cmdExe, buildWindowsCmdShimCommandLine(clearPath, [])],
+    env,
+    windowsVerbatimArguments: false,
+    readShellProcessId() {
+      const receipt = readSpawnReceipt()
+      return receipt && 'pid' in receipt ? receipt.pid : undefined
+    },
+    waitForSpawn: (wrapperExited) => waitForWindowsBunPtySpawn(readSpawnReceipt, wrapperExited),
+    release() {
+      if (released) {
+        return
+      }
+      writeFileSync(gatePath, '', { flag: 'wx' })
+      released = true
+    },
+    dispose() {
+      if (disposed) {
+        return
+      }
+      readSpawnReceipt()
+      disposed = removeLaunchDirectory(directory)
+    }
+  }
+}
diff --git a/src/main/daemon/pty-subprocess/windows-bun-pty-native.test.ts b/src/main/daemon/pty-subprocess/windows-bun-pty-native.test.ts
new file mode 100644
index 000000000000..de6ff4ee264d
--- /dev/null
+++ b/src/main/daemon/pty-subprocess/windows-bun-pty-native.test.ts
@@ -0,0 +1,53 @@
+import { describe, expect, it, vi } from 'vitest'
+import { queryWindowsBunPtyProcessIds } from './windows-bun-pty-native'
+
+function writeProcessList(bytes: Uint8Array, pids: number[]): boolean {
+  const capacity = (bytes.byteLength - 8) / 8
+  const view = new DataView(bytes.buffer)
+  view.setUint32(0, pids.length, true)
+  view.setUint32(4, Math.min(pids.length, capacity), true)
+  pids
+    .slice(0, capacity)
+    .forEach((pid, index) => view.setBigUint64(8 + index * 8, BigInt(pid), true))
+  return pids.length <= capacity
+}
+
+describe('Windows Bun job process enumeration', () => {
+  it.each([false, true])(
+    'grows an incomplete process list when the native call returns %s',
+    (result) => {
+      const pids = Array.from({ length: 257 }, (_, index) => index + 1)
+      const query = vi.fn((bytes: Uint8Array) => writeProcessList(bytes, pids) || result)
+      expect(queryWindowsBunPtyProcessIds(query)).toEqual(pids)
+      expect(query.mock.calls.map(([bytes]) => (bytes.byteLength - 8) / 8)).toEqual([64, 256, 1024])
+    }
+  )
+
+  it('does not mistake a failed native query for an empty job', () => {
+    const query = vi.fn(() => false)
+    expect(queryWindowsBunPtyProcessIds(query)).toBeNull()
+    expect(query).toHaveBeenCalledOnce()
+  })
+
+  it('returns an empty list only when the native query succeeds', () => {
+    expect(queryWindowsBunPtyProcessIds(() => true)).toEqual([])
+  })
+
+  it('bounds growth when a process tree exceeds the inventory limit', () => {
+    const query = vi.fn((bytes: Uint8Array) => {
+      new DataView(bytes.buffer).setUint32(0, 20_000, true)
+      return false
+    })
+    expect(queryWindowsBunPtyProcessIds(query)).toBeNull()
+    expect(query).toHaveBeenCalledTimes(5)
+  })
+
+  it.each([0, 0x1_0000_0000])(
+    'refuses invalid PID %s without reporting partial ownership',
+    (pid) => {
+      expect(
+        queryWindowsBunPtyProcessIds((bytes) => writeProcessList(bytes, [1234, pid]))
+      ).toBeNull()
+    }
+  )
+})
diff --git a/src/main/daemon/pty-subprocess/windows-bun-pty-native.ts b/src/main/daemon/pty-subprocess/windows-bun-pty-native.ts
new file mode 100644
index 000000000000..c9d72e9bf9d1
--- /dev/null
+++ b/src/main/daemon/pty-subprocess/windows-bun-pty-native.ts
@@ -0,0 +1,176 @@
+import { createRequire } from 'node:module'
+
+export type WindowsNativeHandle = number | bigint
+type NativePointer = number | bigint
+
+export type WindowsBunPtyJobNative = {
+  createJob(): WindowsNativeHandle | null
+  configureJob(job: WindowsNativeHandle, flags: number): boolean
+  currentProcess(): WindowsNativeHandle
+  openProcess(access: number, pid: number): WindowsNativeHandle | null
+  assignProcess(job: WindowsNativeHandle, process: WindowsNativeHandle): boolean
+  isProcessInJob(process: WindowsNativeHandle, job: WindowsNativeHandle): boolean
+  queryProcessIds(job: WindowsNativeHandle): readonly number[] | null
+  suspendProcess(process: WindowsNativeHandle): boolean
+  resumeProcess(process: WindowsNativeHandle): boolean
+  terminateJob(job: WindowsNativeHandle): boolean
+  closeHandle(handle: WindowsNativeHandle): void
+}
+
+type FfiFunction = { args: readonly string[]; returns: string }
+type FfiLibrary<T> = { symbols: T }
+type BunFfi = {
+  dlopen<T>(name: string, symbols: Record<string, FfiFunction>): FfiLibrary<T>
+  ptr(view: ArrayBufferView): NativePointer
+}
+
+type Kernel32 = {
+  CreateJobObjectW(attributes: null, name: null): WindowsNativeHandle | null
+  SetInformationJobObject(
+    job: WindowsNativeHandle,
+    infoClass: number,
+    info: NativePointer,
+    infoLength: number
+  ): number
+  GetCurrentProcess(): WindowsNativeHandle
+  OpenProcess(access: number, inherit: number, pid: number): WindowsNativeHandle | null
+  AssignProcessToJobObject(job: WindowsNativeHandle, process: WindowsNativeHandle): number
+  IsProcessInJob(
+    process: WindowsNativeHandle,
+    job: WindowsNativeHandle,
+    result: NativePointer
+  ): number
+  QueryInformationJobObject(
+    job: WindowsNativeHandle,
+    infoClass: number,
+    info: NativePointer,
+    infoLength: number,
+    returnLength: null
+  ): number
+  TerminateJobObject(job: WindowsNativeHandle, exitCode: number): number
+  CloseHandle(handle: WindowsNativeHandle): number
+}
+
+type Ntdll = {
+  NtSuspendProcess(process: WindowsNativeHandle): number
+  NtResumeProcess(process: WindowsNativeHandle): number
+}
+
+const requireFromMain = createRequire(__filename)
+const JOB_OBJECT_EXTENDED_LIMIT_INFORMATION = 9
+const JOB_OBJECT_BASIC_PROCESS_ID_LIST = 3
+const JOB_LIMIT_FLAGS_OFFSET = 16
+const JOB_EXTENDED_LIMITS_BYTES = 144
+const MAX_JOB_PROCESS_IDS = 16_384
+
+export function queryWindowsBunPtyProcessIds(
+  query: (buffer: Uint8Array) => boolean
+): readonly number[] | null {
+  for (let capacity = 64; capacity <= MAX_JOB_PROCESS_IDS; capacity *= 4) {
+    const bytes = new Uint8Array(8 + capacity * 8)
+    const queried = query(bytes)
+    const view = new DataView(bytes.buffer)
+    const assigned = view.getUint32(0, true)
+    const count = view.getUint32(4, true)
+    // These output counts survive the FFI boundary; thread-local GetLastError may not.
+    if (assigned > count) {
+      continue
+    }
+    if (!queried || count > capacity) {
+      return null
+    }
+    const pids: number[] = []
+    for (let index = 0; index < count; index += 1) {
+      const pid = Number(view.getBigUint64(8 + index * 8, true))
+      if (!Number.isSafeInteger(pid) || pid <= 0 || pid > 0xffff_ffff) {
+        return null
+      }
+      pids.push(pid)
+    }
+    return pids
+  }
+  return null
+}
+
+let cachedNative: WindowsBunPtyJobNative | null | undefined
+
+export function loadWindowsBunPtyJobNative(): WindowsBunPtyJobNative | null {
+  if (cachedNative !== undefined) {
+    return cachedNative
+  }
+  if (process.platform !== 'win32') {
+    cachedNative = null
+    return cachedNative
+  }
+  try {
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the pinned Bun runtime supplies these FFI exports; loading failures refuse job ownership.
+    const ffi = requireFromMain('bun:ffi') as BunFfi
+    const kernel = ffi.dlopen<Kernel32>('kernel32.dll', {
+      CreateJobObjectW: { args: ['ptr', 'ptr'], returns: 'ptr' },
+      SetInformationJobObject: { args: ['ptr', 'u32', 'ptr', 'u32'], returns: 'i32' },
+      GetCurrentProcess: { args: [], returns: 'ptr' },
+      OpenProcess: { args: ['u32', 'i32', 'u32'], returns: 'ptr' },
+      AssignProcessToJobObject: { args: ['ptr', 'ptr'], returns: 'i32' },
+      IsProcessInJob: { args: ['ptr', 'ptr', 'ptr'], returns: 'i32' },
+      QueryInformationJobObject: {
+        args: ['ptr', 'u32', 'ptr', 'u32', 'ptr'],
+        returns: 'i32'
+      },
+      TerminateJobObject: { args: ['ptr', 'u32'], returns: 'i32' },
+      CloseHandle: { args: ['ptr'], returns: 'i32' }
+    })
+    const ntdll = ffi.dlopen<Ntdll>('ntdll.dll', {
+      NtSuspendProcess: { args: ['ptr'], returns: 'i32' },
+      NtResumeProcess: { args: ['ptr'], returns: 'i32' }
+    })
+    const { symbols } = kernel
+    cachedNative = {
+      createJob: () => symbols.CreateJobObjectW(null, null),
+      configureJob(job, flags) {
+        const limits = new Uint8Array(JOB_EXTENDED_LIMITS_BYTES)
+        new DataView(limits.buffer).setUint32(JOB_LIMIT_FLAGS_OFFSET, flags, true)
+        return (
+          symbols.SetInformationJobObject(
+            job,
+            JOB_OBJECT_EXTENDED_LIMIT_INFORMATION,
+            ffi.ptr(limits),
+            limits.byteLength
+          ) !== 0
+        )
+      },
+      currentProcess: () => symbols.GetCurrentProcess(),
+      openProcess: (access, pid) => symbols.OpenProcess(access, 0, pid),
+      assignProcess: (job, process) => symbols.AssignProcessToJobObject(job, process) !== 0,
+      isProcessInJob(process, job) {
+        const result = new Uint32Array(1)
+        return symbols.IsProcessInJob(process, job, ffi.ptr(result)) !== 0 && result[0] !== 0
+      },
+      queryProcessIds(job) {
+        return queryWindowsBunPtyProcessIds(
+          (bytes) =>
+            symbols.QueryInformationJobObject(
+              job,
+              JOB_OBJECT_BASIC_PROCESS_ID_LIST,
+              ffi.ptr(bytes),
+              bytes.byteLength,
+              null
+            ) !== 0
+        )
+      },
+      suspendProcess: (process) => ntdll.symbols.NtSuspendProcess(process) >= 0,
+      resumeProcess: (process) => ntdll.symbols.NtResumeProcess(process) >= 0,
+      terminateJob: (job) => symbols.TerminateJobObject(job, 1) !== 0,
+      closeHandle: (handle) => {
+        symbols.CloseHandle(handle)
+      }
+    }
+    return cachedNative
+  } catch {
+    cachedNative = null
+    return cachedNative
+  }
+}
+
+export function __resetWindowsBunPtyNativeForTests(): void {
+  cachedNative = undefined
+}
diff --git a/src/main/daemon/pty-subprocess/windows-bun-pty-spawn-receipt.test.ts b/src/main/daemon/pty-subprocess/windows-bun-pty-spawn-receipt.test.ts
new file mode 100644
index 000000000000..568245219212
--- /dev/null
+++ b/src/main/daemon/pty-subprocess/windows-bun-pty-spawn-receipt.test.ts
@@ -0,0 +1,90 @@
+import { existsSync } from 'node:fs'
+import { dirname, join } from 'node:path'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { createWindowsBunPtyLaunch } from './windows-bun-pty-launch'
+import { readWindowsBunPtyGateRequest } from './windows-bun-pty-gate'
+import {
+  publishWindowsBunPtyShellPid,
+  publishWindowsBunPtySpawnError,
+  WindowsBunPtySpawnUnconfirmedError
+} from './windows-bun-pty-spawn-receipt'
+
+const workerPath = join(__dirname, 'windows-bun-pty-spawn-receipt.test.ts')
+const neverExits = new Promise<number>(() => {})
+
+describe('Windows Bun shell spawn confirmation', () => {
+  afterEach(() => vi.useRealTimers())
+
+  it('waits for the actual shell and preserves successful immediate exit through cleanup', async () => {
+    const launch = createWindowsBunPtyLaunch(
+      { file: 'shell.exe', args: [], env: {} },
+      { workerPath }
+    )
+    const { shellPidPath } = readWindowsBunPtyGateRequest(launch.command.at(-1)!)
+    const ready = vi.fn()
+    let exit!: (code: number) => void
+    const exited = new Promise<number>((resolve) => {
+      exit = resolve
+    })
+    const waiting = launch.waitForSpawn(exited).then(ready)
+    try {
+      await Promise.resolve()
+      expect(ready).not.toHaveBeenCalled()
+      publishWindowsBunPtyShellPid(shellPidPath, 1234)
+      exit(17)
+      launch.dispose()
+      await waiting
+      expect(ready).toHaveBeenCalledOnce()
+      expect(launch.readShellProcessId()).toBe(1234)
+      expect(existsSync(dirname(shellPidPath))).toBe(false)
+    } finally {
+      launch.dispose()
+    }
+  })
+
+  it('preserves a definite spawn error through cleanup so the caller can retry another shell', async () => {
+    const launch = createWindowsBunPtyLaunch(
+      { file: 'shell.exe', args: [], env: {} },
+      { workerPath }
+    )
+    const { shellPidPath } = readWindowsBunPtyGateRequest(launch.command.at(-1)!)
+    try {
+      publishWindowsBunPtySpawnError(shellPidPath, new Error('spawn ENOENT'))
+      expect(existsSync(`${shellPidPath}.error.pending`)).toBe(false)
+      launch.dispose()
+      await expect(launch.waitForSpawn(Promise.resolve(1))).rejects.toThrow('spawn ENOENT')
+    } finally {
+      launch.dispose()
+    }
+  })
+
+  it('refuses to retry an exited gate without a receipt because its shell may have run', async () => {
+    const launch = createWindowsBunPtyLaunch(
+      { file: 'shell.exe', args: [], env: {} },
+      { workerPath }
+    )
+    try {
+      await expect(launch.waitForSpawn(Promise.resolve(0))).rejects.toBeInstanceOf(
+        WindowsBunPtySpawnUnconfirmedError
+      )
+    } finally {
+      launch.dispose()
+    }
+  })
+
+  it('bounds the wait for a live gate that never publishes its shell identity', async () => {
+    vi.useFakeTimers({ toFake: ['Date'] })
+    const launch = createWindowsBunPtyLaunch(
+      { file: 'shell.exe', args: [], env: {} },
+      { workerPath }
+    )
+    try {
+      const waiting = launch.waitForSpawn(neverExits)
+      const assertion = expect(waiting).rejects.toBeInstanceOf(WindowsBunPtySpawnUnconfirmedError)
+      vi.setSystemTime(Date.now() + 30_001)
+      await assertion
+    } finally {
+      launch.dispose()
+    }
+  })
+})
diff --git a/src/main/daemon/pty-subprocess/windows-bun-pty-spawn-receipt.ts b/src/main/daemon/pty-subprocess/windows-bun-pty-spawn-receipt.ts
new file mode 100644
index 000000000000..43d193b76af0
--- /dev/null
+++ b/src/main/daemon/pty-subprocess/windows-bun-pty-spawn-receipt.ts
@@ -0,0 +1,66 @@
+import { readFileSync, renameSync, writeFileSync } from 'node:fs'
+import { setTimeout as delay } from 'node:timers/promises'
+
+export type WindowsBunPtySpawnReceipt = { pid: number } | { error: string }
+
+export class WindowsBunPtySpawnUnconfirmedError extends Error {}
+
+function publishReceipt(path: string, value: string): void {
+  const pending = `${path}.pending`
+  writeFileSync(pending, value, { flag: 'wx', mode: 0o600 })
+  // ConPTY cannot inherit Bun IPC; publish the receipt atomically.
+  renameSync(pending, path)
+}
+
+export function publishWindowsBunPtyShellPid(path: string, pid: number): void {
+  publishReceipt(path, String(pid))
+}
+
+export function publishWindowsBunPtySpawnError(path: string, error: unknown): void {
+  publishReceipt(`${path}.error`, error instanceof Error ? error.message : String(error))
+}
+
+export function readWindowsBunPtySpawnReceipt(path: string): WindowsBunPtySpawnReceipt | undefined {
+  try {
+    const receipt = readFileSync(path, 'utf8')
+    const pid = Number(receipt)
+    if (/^[1-9][0-9]{0,9}$/.test(receipt) && Number.isSafeInteger(pid) && pid <= 0xffff_ffff) {
+      return { pid }
+    }
+  } catch {
+    // Missing or unreadable identity never proves the shell failed to spawn.
+  }
+  try {
+    return { error: readFileSync(`${path}.error`, 'utf8') }
+  } catch {
+    return undefined
+  }
+}
+
+export async function waitForWindowsBunPtySpawn(
+  readReceipt: () => WindowsBunPtySpawnReceipt | undefined,
+  wrapperExited: Promise<number>
+): Promise<void> {
+  let ended = false
+  const markEnded = (): void => {
+    ended = true
+  }
+  void wrapperExited.then(markEnded, markEnded)
+  const deadline = Date.now() + 30_000
+  while (true) {
+    const receipt = readReceipt()
+    if (receipt) {
+      if ('pid' in receipt) {
+        return
+      }
+      if (ended) {
+        throw new Error(receipt.error)
+      }
+    }
+    if (ended || Date.now() >= deadline) {
+      // An unreported shell may already have run a startup command; never retry it.
+      throw new WindowsBunPtySpawnUnconfirmedError('Windows shell spawn could not be confirmed')
+    }
+    await delay(5)
+  }
+}
diff --git a/src/main/daemon/serialize-grid-transcript-replay.test.ts b/src/main/daemon/serialize-grid-transcript-replay.test.ts
index 7bd60cf02057..dca03b69a058 100644
--- a/src/main/daemon/serialize-grid-transcript-replay.test.ts
+++ b/src/main/daemon/serialize-grid-transcript-replay.test.ts
@@ -1,3 +1,4 @@
+import { createHash } from 'node:crypto'
 import { existsSync, readdirSync, readFileSync } from 'node:fs'
 import { basename, join } from 'node:path'
 import { describe, expect, it } from 'vitest'
@@ -27,9 +28,34 @@ const OLD_ADDON_PATH = process.env.ORCA_OLD_SERIALIZE_ADDON
 const SEEDS = Math.max(1, Number(process.env.SERIALIZE_TRANSCRIPT_SEEDS) || 2)
 
 // Checkpoints (default seeds) whose new replay diverges exactly as the previous
-// build's did — pre-existing upstream limitations, not regressions (verified
-// with ORCA_OLD_SERIALIZE_ADDON). Shrink when one is fixed.
-const KNOWN_PREEXISTING_I2_FAILURES: Record<string, number> = { less: 6, nano: 2, opencode: 5 }
+// build's did — pre-existing serializer limitations, not regressions (verified
+// with ORCA_OLD_SERIALIZE_ADDON): the live SGR pen leaks into the alt buffer, and
+// an alt buffer first entered after a shrink keeps hidden scrollback. Shrink when one is fixed.
+const KNOWN_PREEXISTING_I2_FAILURES: Record<string, number> = {
+  less: 6,
+  nano: 2,
+  opencode: 5,
+  // Shrink leaves the cursor one column short; also present in the pre-Qoder serializer.
+  'qoder-no-account': 2,
+  'qoder-ready': 2,
+  // Codex 0.157 header border restores with an extra attribute bit (STA-8628 fixtures).
+  'codex-0157-config-override-embedded-warning': 22,
+  'codex-0157-effort-override-embedded-warning': 4,
+  'codex-0157-no-daemon-effort-override': 16,
+  'codex-0157-plain-ready': 18,
+  'claude-dialog-trust-workspace-answered': 13,
+  // DSH-TUI's whale intro paints whole rows of 24-bit background, and every one of this
+  // transcript's divergences is the same shape: `visible-grid row=0`, a true-colour
+  // background that the round trip does not restore to default. Verified as upstream, not a
+  // regression, by replaying it against the previous build
+  // (`build-serialize-addon-at-ref.mjs --ref origin/main`): I1 and I3 both hold.
+  'dsh-tui-ready-no-key': 10
+}
+
+// Exact resize checkpoints and full GridDiff hashes from base 6835b9b4e3ea, not this branch.
+const FREEBUFF_BASELINE: Record<string, readonly string[]> = JSON.parse(
+  readFileSync(join(__dirname, '__fixtures__/freebuff-serialize-baseline.json'), 'utf8')
+)
 
 type Transcript = { name: string; data: string; cols: number; rows: number }
 type Schedule = 'none' | 'shrink' | 'shrink-grow' | 'jitter'
@@ -122,6 +148,7 @@ describe('serialize round trip over captured PTY transcripts', () => {
     async (_name, transcript) => {
       const counts: Partial<Record<Verdict | 'checks', number>> = {}
       const blocking: string[] = []
+      const failureSignatures: string[] = []
       for (const schedule of SCHEDULES) {
         for (const conpty of [false, true]) {
           for (let seed = 1; seed <= SEEDS; seed++) {
@@ -136,6 +163,14 @@ describe('serialize round trip over captured PTY transcripts', () => {
                   `  ${transcript.name} ${schedule} conpty=${conpty} seed=${seed}: ${d.stage} row=${d.row} ${JSON.stringify(d.expected)?.slice(0, 160)} -> ${JSON.stringify(d.actual)?.slice(0, 160)}`
                 )
               }
+              if (check.gridDiff.new) {
+                const signature = createHash('sha256')
+                  .update(JSON.stringify(check.gridDiff.new))
+                  .digest('hex')
+                failureSignatures.push(
+                  `${schedule}/${conpty}/${seed}/${check.stepIndex}:${signature}`
+                )
+              }
               for (const verdict of verdicts(check, serializers.length > 1)) {
                 counts[verdict] = (counts[verdict] ?? 0) + 1
                 if (verdict === 'i1-bytes-differ' || verdict === 'regression') {
@@ -152,7 +187,9 @@ describe('serialize round trip over captured PTY transcripts', () => {
         console.log(`${transcript.name} ${JSON.stringify(counts)}`)
       }
       expect(blocking).toEqual([])
-      if (!OLD_ADDON_PATH && SEEDS === 2) {
+      if (SEEDS === 2 && transcript.name.startsWith('freebuff-')) {
+        expect(failureSignatures).toEqual(FREEBUFF_BASELINE[transcript.name] ?? [])
+      } else if (!OLD_ADDON_PATH && SEEDS === 2) {
         expect(counts['new-fail'] ?? 0).toBe(KNOWN_PREEXISTING_I2_FAILURES[transcript.name] ?? 0)
       }
     },
diff --git a/src/main/daemon/session-subprocess-handle.ts b/src/main/daemon/session-subprocess-handle.ts
index 9268686d78ee..be336c998f2a 100644
--- a/src/main/daemon/session-subprocess-handle.ts
+++ b/src/main/daemon/session-subprocess-handle.ts
@@ -1,9 +1,12 @@
+import type { PtyChildProcessVerdict } from '../../shared/terminal-process-inspection'
 import type { TerminalExitCause } from '../../shared/terminal-exit-cause'
 
 import type { JobTerminationOutcome } from '../windows/windows-pty-job'
 
 export type SubprocessHandle = {
   pid: number
+  processNameIsSpawnFile?: boolean
+  inspectChildProcesses?(): PtyChildProcessVerdict
   /** Live foreground process name of the PTY (node-pty's `.process`), e.g.
    *  'claude' / 'codex' / 'zsh'. Null once the child has exited. */
   getForegroundProcess(options?: { rawFallback?: boolean }): string | null
diff --git a/src/main/daemon/session.ts b/src/main/daemon/session.ts
index a52e40a86780..e69bec7c5b1c 100644
--- a/src/main/daemon/session.ts
+++ b/src/main/daemon/session.ts
@@ -4,10 +4,7 @@ import { createSessionOutputPipeline } from './session-output-pipeline'
 import { SessionProducerPause } from './session-producer-pause'
 import { SessionShellReadyBarrier } from './session-shell-ready-barrier'
 import type { TerminalShellRecoveryBarrier } from './terminal-shell-recovery-barrier'
-import {
-  SessionTerminationController,
-  IMMEDIATE_KILL_PHYSICAL_EXIT_TIMEOUT_MS
-} from './session-termination-controller'
+import { SessionTerminationController } from './session-termination-controller'
 import type { SubprocessHandle } from './session-subprocess-handle'
 import type { JobTerminationOutcome } from '../windows/windows-pty-job'
 import type { SessionOptions } from './session-options'
@@ -21,6 +18,7 @@ import type {
   TakePendingOutputResult,
   TerminalSnapshot
 } from './types'
+import type { PtyChildProcessVerdict } from '../../shared/terminal-process-inspection'
 import type { TerminalExitCause } from '../../shared/terminal-exit-cause'
 
 export class Session {
@@ -29,6 +27,7 @@ export class Session {
   readonly terminalHandle: string | null
   readonly launchAgent: TuiAgent | null
   readonly wslDistro: string | null
+  readonly processNameIsSpawnFile: boolean
   private _state: SessionState = 'running'
   private _exitCode: number | null = null
   private _disposed = false
@@ -47,6 +46,7 @@ export class Session {
     this.launchAgent = opts.launchAgent ?? null
     this.wslDistro = opts.wslDistro ?? null
     this.subprocess = opts.subprocess
+    this.processNameIsSpawnFile = opts.subprocess.processNameIsSpawnFile === true
     this.onSessionExit = opts.onExit
     const pipeline = createSessionOutputPipeline({
       cols: opts.cols,
@@ -195,9 +195,7 @@ export class Session {
     this.termination.scheduleForceDisposeFallback()
   }
 
-  async forceKillAndWaitForExit(
-    timeoutMs = IMMEDIATE_KILL_PHYSICAL_EXIT_TIMEOUT_MS
-  ): Promise<void> {
+  async forceKillAndWaitForExit(timeoutMs?: number): Promise<void> {
     await this.termination.forceKillAndWaitForExit(timeoutMs)
   }
 
@@ -253,6 +251,10 @@ export class Session {
     return this.output.getCwd()
   }
 
+  inspectChildProcesses(): PtyChildProcessVerdict {
+    return this.subprocess.inspectChildProcesses?.() ?? 'unverifiable'
+  }
+
   getForegroundProcess(options?: { rawFallback?: boolean }): string | null {
     return this.subprocess.getForegroundProcess(options)
   }
diff --git a/src/main/daemon/terminal-armed-input-modes.ts b/src/main/daemon/terminal-armed-input-modes.ts
index e2ba02a2ca20..ca0e37a64108 100644
--- a/src/main/daemon/terminal-armed-input-modes.ts
+++ b/src/main/daemon/terminal-armed-input-modes.ts
@@ -8,7 +8,7 @@ const HOST_ARMABLE_MODE = 1004
 type ModeKey = number | 'kitty-main' | 'kitty-alt'
 // host: HOST_ARMABLE_MODE armed before any marker or by a prompt a 133;C proved; the ground keeps it.
 // prompt: armed outside a command, unproven until C.
-// command: armed after C; still on at 133;D, it triggers the ground.
+// command: armed after C; still on at any 133;D, it triggers the ground until disarmed.
 // stale: anything else still on; the ground clears it without it ever triggering.
 type ModeOwner = 'host' | 'prompt' | 'command' | 'stale'
 // Matches xterm.js's eviction limit, so the model drops the same entries.
@@ -104,13 +104,14 @@ export class TerminalArmedInputModes {
     this.enableOwner = 'prompt'
   }
 
-  /** OSC 133;D: true when the command left a mode it armed. Demoting makes it one-shot. */
+  /** OSC 133;D: true when a command's mode is still on. Not demoted: a nested shell's
+   *  stray D gets a refuted proof, and the app's real D must still trigger. */
   markCommandEnd(): boolean {
     let left = false
     for (const [key, owner] of this.owners) {
-      if (owner === 'command' || owner === 'prompt') {
-        // The other screen's kitty flags stay parked in xterm and reach no input.
-        left ||= owner === 'command' && (typeof key === 'number' || key === this.kittyKey())
+      // The other screen's kitty flags stay parked in xterm and reach no input.
+      left ||= owner === 'command' && (typeof key === 'number' || key === this.kittyKey())
+      if (owner === 'prompt') {
         this.owners.set(key, 'stale')
       }
     }
diff --git a/src/main/daemon/terminal-attach-cancellation.test.ts b/src/main/daemon/terminal-attach-cancellation.test.ts
new file mode 100644
index 000000000000..1c9fa0a1ea37
--- /dev/null
+++ b/src/main/daemon/terminal-attach-cancellation.test.ts
@@ -0,0 +1,38 @@
+import { describe, expect, it, vi } from 'vitest'
+import { waitForTerminalAttachOperation } from './terminal-attach-cancellation'
+
+describe('terminal attach cancellation', () => {
+  it('removes cancellation listeners when the operation settles first', async () => {
+    const controller = new AbortController()
+    const removeListener = vi.spyOn(controller.signal, 'removeEventListener')
+
+    await expect(
+      waitForTerminalAttachOperation(Promise.resolve('ready'), controller.signal, 'session-1')
+    ).resolves.toBe('ready')
+
+    expect(removeListener).toHaveBeenCalledTimes(1)
+  })
+
+  it('preserves operation-first ordering when settlement and abort share a turn', async () => {
+    const controller = new AbortController()
+    const operation = Promise.withResolvers<string>()
+    const waiting = waitForTerminalAttachOperation(
+      operation.promise,
+      controller.signal,
+      'session-3'
+    )
+    operation.resolve('ready')
+    controller.abort()
+    await expect(waiting).resolves.toBe('ready')
+  })
+
+  it('rejects promptly on cancellation while the operation remains pending', async () => {
+    const controller = new AbortController()
+    const operation = new Promise<void>(() => {})
+    const waiting = waitForTerminalAttachOperation(operation, controller.signal, 'session-2')
+
+    controller.abort()
+
+    await expect(waiting).rejects.toMatchObject({ name: 'TerminalAttachCanceledError' })
+  })
+})
diff --git a/src/main/daemon/terminal-attach-cancellation.ts b/src/main/daemon/terminal-attach-cancellation.ts
index 9e87cbdb1bcc..21c037d91d3a 100644
--- a/src/main/daemon/terminal-attach-cancellation.ts
+++ b/src/main/daemon/terminal-attach-cancellation.ts
@@ -1,17 +1,17 @@
 import { TerminalAttachCanceledError } from './daemon-errors'
+import { PromiseSettlementWaiters } from '../../shared/promise-settlement-waiters'
 
-/** Never resolves; only rejects, so it can bound a wait without settling it. */
-export function rejectOnAbort(signal: AbortSignal | undefined, sessionId: string): Promise<never> {
+export function waitForTerminalAttachOperation<T>(
+  operation: Promise<T>,
+  signal: AbortSignal | undefined,
+  sessionId: string
+): Promise<T> {
   if (!signal) {
-    return new Promise<never>(() => {})
+    return operation
   }
-  return new Promise<never>((_resolve, reject) => {
-    if (signal.aborted) {
-      reject(new TerminalAttachCanceledError(sessionId))
-      return
-    }
-    signal.addEventListener('abort', () => reject(new TerminalAttachCanceledError(sessionId)), {
-      once: true
-    })
+  return new PromiseSettlementWaiters(operation).wait({
+    signal,
+    abortInMicrotask: true,
+    createAbortError: () => new TerminalAttachCanceledError(sessionId)
   })
 }
diff --git a/src/main/daemon/terminal-descendant-shutdown.test.ts b/src/main/daemon/terminal-descendant-shutdown.test.ts
index 52258d0a6509..c47727f3f90a 100644
--- a/src/main/daemon/terminal-descendant-shutdown.test.ts
+++ b/src/main/daemon/terminal-descendant-shutdown.test.ts
@@ -28,9 +28,10 @@ describe('terminal shutdown process-table batching', () => {
         startedAt: 'Mon Jul 13 12:54:47 2026'
       }
     ]).flat()
+    // Each scan is stamped when it starts, after the walks that produced the snapshots.
     readProcessTable
-      .mockResolvedValueOnce({ rows, capturedAtMs: Date.now() })
-      .mockResolvedValue({ rows: [], capturedAtMs: Date.now() })
+      .mockImplementationOnce(async () => ({ rows, capturedAtMs: Date.now() + 1 }))
+      .mockImplementation(async () => ({ rows: [], capturedAtMs: Date.now() + 1 }))
     const shutdowns = Array.from({ length: 20 }, (_, index) => {
       const rootPid = 100 + index
       const snapshot = collectDescendantRows(rootPid, [
diff --git a/src/main/daemon/terminal-history-log-encode-allocation.test.ts b/src/main/daemon/terminal-history-log-encode-allocation.test.ts
new file mode 100644
index 000000000000..00d7a320810c
--- /dev/null
+++ b/src/main/daemon/terminal-history-log-encode-allocation.test.ts
@@ -0,0 +1,85 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { decodeTerminalHistoryLog, encodeLogBatch, encodeLogHeader } from './terminal-history-log'
+import type { PendingOutputRecord } from './types'
+
+afterEach(() => vi.restoreAllMocks())
+
+describe('terminal history batch encoding', () => {
+  it('preserves released bytes for empty, Unicode, resize and clear records', () => {
+    const records: PendingOutputRecord[] = [
+      { kind: 'output', data: '' },
+      { kind: 'output', data: 'Aé🐳\ud800\u0000\x1b[31m' },
+      { kind: 'resize', cols: -1, rows: 65536 },
+      { kind: 'resize', cols: 80.9, rows: 24.9 },
+      { kind: 'clear' }
+    ]
+    const encoded = encodeLogBatch(0x1_ffff_ffff, records)
+    expect(encoded.toString('hex')).toBe(
+      '0104000000ffffffff0200000000021000000041c3a9f09f90b3efbfbd001b5b33316d03040000000000ffff0304000000500018000400000000'
+    )
+    expect(decodeTerminalHistoryLog(Buffer.concat([encodeLogHeader(3), encoded]))).toEqual({
+      generation: 3,
+      truncatedTail: false,
+      batches: [
+        {
+          seq: 0xffff_ffff,
+          records: [
+            { kind: 'output', data: '' },
+            { kind: 'output', data: 'Aé🐳\ufffd\u0000\x1b[31m' },
+            { kind: 'resize', cols: 0, rows: 65535 },
+            { kind: 'resize', cols: 80, rows: 24 },
+            { kind: 'clear' }
+          ]
+        }
+      ]
+    })
+    expect(encodeLogBatch(-1, []).toString('hex')).toBe('0104000000ffffffff')
+  })
+
+  it('encodes a 4 MiB checkpoint increment without intermediate framed buffers', () => {
+    const records: PendingOutputRecord[] = Array.from({ length: 1024 }, () => ({
+      kind: 'output',
+      data: 'x'.repeat(4096)
+    }))
+    const alloc = vi.spyOn(Buffer, 'alloc')
+    const allocUnsafe = vi.spyOn(Buffer, 'allocUnsafe')
+    const from = vi.spyOn(Buffer, 'from')
+    const concat = vi.spyOn(Buffer, 'concat')
+
+    const encoded = encodeLogBatch(17, records)
+    const observed = {
+      alloc: alloc.mock.calls.length,
+      allocUnsafe: allocUnsafe.mock.calls.length,
+      from: from.mock.calls.length,
+      concat: concat.mock.calls.length,
+      concatBytes: concat.mock.results.reduce(
+        (bytes, result) =>
+          result.type === 'return' && Buffer.isBuffer(result.value)
+            ? bytes + result.value.length
+            : bytes,
+        0
+      )
+    }
+    vi.restoreAllMocks()
+    console.info(
+      JSON.stringify({ records: records.length, encodedBytes: encoded.length, ...observed })
+    )
+
+    expect(encoded.length).toBe(9 + 1024 * (5 + 4096))
+    expect(decodeTerminalHistoryLog(Buffer.concat([encodeLogHeader(0), encoded]))?.batches).toEqual(
+      [{ seq: 17, records }]
+    )
+    expect(observed).toEqual({ alloc: 0, allocUnsafe: 1, from: 1024, concat: 0, concatBytes: 0 })
+  })
+
+  it('keeps UTF-16 replacement local to each output record', () => {
+    const encoded = encodeLogBatch(1, [
+      { kind: 'output', data: '\ud800' },
+      { kind: 'output', data: '\udc00' },
+      { kind: 'output', data: '\ud800\udc00' }
+    ])
+    expect(encoded.toString('hex')).toBe(
+      '0104000000010000000203000000efbfbd0203000000efbfbd0204000000f0908080'
+    )
+  })
+})
diff --git a/src/main/daemon/terminal-history-log.ts b/src/main/daemon/terminal-history-log.ts
index 8f5fdd07c8dc..35bdf5c2921f 100644
--- a/src/main/daemon/terminal-history-log.ts
+++ b/src/main/daemon/terminal-history-log.ts
@@ -61,20 +61,43 @@ export function decodeLogHeader(buffer: Buffer): number | null {
 }
 
 export function encodeLogBatch(seq: number, records: PendingOutputRecord[]): Buffer {
-  const frames: Buffer[] = [encodeFrame(FRAME_BATCH, encodeSeqPayload(seq))]
+  let byteLength = 9
+  const outputPayloads: Buffer[] = []
   for (const record of records) {
     if (record.kind === 'output') {
-      frames.push(encodeFrame(FRAME_OUTPUT, Buffer.from(record.data, 'utf8')))
+      const payload = Buffer.from(record.data, 'utf8')
+      outputPayloads.push(payload)
+      byteLength += 5 + payload.length
+    } else {
+      byteLength += record.kind === 'resize' ? 9 : 5
+    }
+  }
+  const batch = Buffer.allocUnsafe(byteLength)
+  batch.writeUInt8(FRAME_BATCH, 0)
+  batch.writeUInt32LE(4, 1)
+  batch.writeUInt32LE(seq >>> 0, 5)
+  let offset = 9
+  let outputIndex = 0
+  for (const record of records) {
+    if (record.kind === 'output') {
+      batch.writeUInt8(FRAME_OUTPUT, offset)
+      const payload = outputPayloads[outputIndex++]
+      batch.writeUInt32LE(payload.length, offset + 1)
+      payload.copy(batch, offset + 5)
+      offset += 5 + payload.length
     } else if (record.kind === 'resize') {
-      const payload = Buffer.alloc(4)
-      payload.writeUInt16LE(clampU16(record.cols), 0)
-      payload.writeUInt16LE(clampU16(record.rows), 2)
-      frames.push(encodeFrame(FRAME_RESIZE, payload))
+      batch.writeUInt8(FRAME_RESIZE, offset)
+      batch.writeUInt32LE(4, offset + 1)
+      batch.writeUInt16LE(clampU16(record.cols), offset + 5)
+      batch.writeUInt16LE(clampU16(record.rows), offset + 7)
+      offset += 9
     } else {
-      frames.push(encodeFrame(FRAME_CLEAR, Buffer.alloc(0)))
+      batch.writeUInt8(FRAME_CLEAR, offset)
+      batch.writeUInt32LE(0, offset + 1)
+      offset += 5
     }
   }
-  return Buffer.concat(frames)
+  return batch
 }
 
 /** Returns null for missing magic / unknown format version — callers fall
@@ -150,19 +173,6 @@ export function decodeTerminalHistoryLog(buffer: Buffer): TerminalHistoryLogCont
   return { generation, batches, truncatedTail }
 }
 
-function encodeFrame(kind: number, payload: Buffer): Buffer {
-  const header = Buffer.alloc(5)
-  header.writeUInt8(kind, 0)
-  header.writeUInt32LE(payload.length, 1)
-  return Buffer.concat([header, payload])
-}
-
-function encodeSeqPayload(seq: number): Buffer {
-  const payload = Buffer.alloc(4)
-  payload.writeUInt32LE(seq >>> 0, 0)
-  return payload
-}
-
 function clampU16(value: number): number {
   return Math.max(0, Math.min(0xffff, Math.floor(value)))
 }
diff --git a/src/main/daemon/terminal-history-permission-repair.ts b/src/main/daemon/terminal-history-permission-repair.ts
index 7cb8414026eb..ffb4ea852cc3 100644
--- a/src/main/daemon/terminal-history-permission-repair.ts
+++ b/src/main/daemon/terminal-history-permission-repair.ts
@@ -116,7 +116,10 @@ export function scheduleTerminalHistoryPermissionRepair(basePath: string): Promi
     }
     scheduledBasePaths.delete(oldest.value)
   }
-  const { promise, resolve: settle } = Promise.withResolvers<boolean>()
+  let settle!: (repaired: boolean) => void
+  const promise = new Promise<boolean>((resolve) => {
+    settle = resolve
+  })
   const timer = setTimeout(() => {
     repairTerminalHistoryPermissions(key).then(settle, () => settle(false))
   }, REPAIR_START_DELAY_MS)
diff --git a/src/main/daemon/terminal-host-process-inspection.ts b/src/main/daemon/terminal-host-process-inspection.ts
index 2f9fb1491d90..e149179c1aa8 100644
--- a/src/main/daemon/terminal-host-process-inspection.ts
+++ b/src/main/daemon/terminal-host-process-inspection.ts
@@ -1,11 +1,14 @@
 import { isShellProcess } from '../../shared/agent-detection'
 import { recognizeAgentProcess } from '../../shared/agent-process-recognition'
+import type { PtyChildProcessVerdict } from '../../shared/terminal-process-inspection'
 import type { RemoteForegroundEvidence } from '../../shared/foreground-process-evidence'
 import { getCheapProcessTableSnapshot } from '../../shared/cheap-process-table-snapshot-reader'
 import { getStrictProcessTableSnapshotWithAge } from '../../shared/process-table-snapshot-reader'
 import { resolveRemoteForegroundEvidence } from '../providers/agent-foreground-process'
 import { buildPaneProcessFingerprint } from '../providers/posix-pane-foreground-fingerprint'
 import type { Session } from './session'
+import { resolveSpawnFileForegroundFromRows } from './pty-subprocess/spawn-file-foreground-process'
+import { inspectSpawnFileChildProcessesFromRows } from './pty-subprocess/spawn-file-child-processes'
 import {
   clearSteadyStateAnchor,
   getSteadyStateAnchor,
@@ -16,6 +19,7 @@ import { SessionNotFoundError } from './types'
 export type TerminalHostProcessInspection = {
   foregroundProcess: string | null
   hasChildProcesses: boolean
+  childProcessEvidence?: PtyChildProcessVerdict
   foregroundProcessEvidence?: RemoteForegroundEvidence
 }
 
@@ -76,13 +80,32 @@ export async function inspectTerminalHostProcess(args: {
   }
   args.onTier?.('full')
 
-  const foregroundProcess = session.getForegroundProcess()
+  let foregroundProcess = session.getForegroundProcess()
+  let childProcessEvidence: PtyChildProcessVerdict | undefined = session.processNameIsSpawnFile
+    ? 'unverifiable'
+    : undefined
+  if (session.processNameIsSpawnFile && process.platform === 'win32' && incarnationMatches) {
+    foregroundProcess = await session.confirmForegroundProcess()
+    childProcessEvidence = session.inspectChildProcesses()
+  }
   let evidence: RemoteForegroundEvidence
   if (!incarnationMatches) {
     evidence = unverifiableEvidence(args, session, 'incarnation_mismatch')
   } else {
     try {
       const snapshot = await getStrictProcessTableSnapshotWithAge()
+      if (session.processNameIsSpawnFile && process.platform !== 'win32') {
+        const observed = resolveSpawnFileForegroundFromRows(snapshot.rows, session.pid)
+        foregroundProcess = observed.available ? observed.processName : foregroundProcess
+        childProcessEvidence = inspectSpawnFileChildProcessesFromRows(
+          snapshot.rows,
+          session.pid,
+          session.getForegroundProcess({ rawFallback: true })
+        )
+        if (observed.available && observed.processName && !isShellProcess(observed.processName)) {
+          childProcessEvidence = 'children'
+        }
+      }
       evidence = resolveRemoteForegroundEvidence(
         { rootPid: session.pid, fallbackProcess: foregroundProcess },
         {
@@ -110,7 +133,11 @@ export async function inspectTerminalHostProcess(args: {
       evidence.verdict === 'live'
         ? (evidence.processName ?? ordinaryForeground)
         : foregroundProcess,
-    hasChildProcesses: nonShellForeground,
+    hasChildProcesses:
+      childProcessEvidence === undefined
+        ? nonShellForeground
+        : childProcessEvidence !== 'no-children',
+    ...(childProcessEvidence === undefined ? {} : { childProcessEvidence }),
     foregroundProcessEvidence: evidence
   }
 }
diff --git a/src/main/daemon/terminal-host-session-create.ts b/src/main/daemon/terminal-host-session-create.ts
index 7a8dbe379cc1..15e86a70a72c 100644
--- a/src/main/daemon/terminal-host-session-create.ts
+++ b/src/main/daemon/terminal-host-session-create.ts
@@ -12,7 +12,7 @@ import type { TerminalHostTombstones } from './terminal-host-tombstones'
 import type { TerminalSessionTeardown } from './terminal-session-teardown'
 import { resolveDaemonSessionScrollbackRows } from './daemon-session-scrollback-window'
 import { TerminalAttachCanceledError } from './daemon-errors'
-import { rejectOnAbort } from './terminal-attach-cancellation'
+import { waitForTerminalAttachOperation } from './terminal-attach-cancellation'
 import { SessionNotFoundError } from './types'
 import { resolveWslSessionContext } from './wsl-session-context'
 
@@ -47,10 +47,11 @@ export async function createOrAttachTerminalSession(
     // reaches this a beat after the attach that retired it, and refusing surfaced the raw
     // SessionNotFoundError to the user. Windows makes it the common case, where the plain-shell
     // sweep holds the claim across an OS identity probe and taskkill (#18046).
-    await Promise.race([
+    await waitForTerminalAttachOperation(
       deps.sessionTeardown.settle(opts.sessionId),
-      rejectOnAbort(opts.cancelSignal, opts.sessionId)
-    ])
+      opts.cancelSignal,
+      opts.sessionId
+    )
     deps.assertCreateAllowed()
     existing = deps.sessions.get(opts.sessionId)
     // Unkillable child, or a fresh teardown claimed it while we waited: still nobody's to recreate.
diff --git a/src/main/daemon/terminal-host.ts b/src/main/daemon/terminal-host.ts
index 8ccfe31b707b..6e8d5ceee816 100644
--- a/src/main/daemon/terminal-host.ts
+++ b/src/main/daemon/terminal-host.ts
@@ -21,7 +21,7 @@ import { TerminalHostTombstones } from './terminal-host-tombstones'
 import { listLiveTerminalHostSessions } from './terminal-host-session-listing'
 import { createOrAttachTerminalSession } from './terminal-host-session-create'
 import { TerminalAttachCanceledError } from './daemon-errors'
-import { rejectOnAbort } from './terminal-attach-cancellation'
+import { waitForTerminalAttachOperation } from './terminal-attach-cancellation'
 import { randomUUID } from 'node:crypto'
 import { pruneRetiredPtyIncarnations } from '../../shared/retired-pty-incarnations'
 import {
@@ -84,7 +84,7 @@ export class TerminalHost {
       // Why: the create ahead of us can be stuck on an unreachable share for
       // minutes. Waiting unconditionally is what let one dead path strand every
       // later create and attach for the session, so a canceled caller leaves.
-      await Promise.race([inFlight, rejectOnAbort(opts.cancelSignal, opts.sessionId)])
+      await waitForTerminalAttachOperation(inFlight, opts.cancelSignal, opts.sessionId)
       this.assertCreateOrAttachAllowed(opts)
     }
     this.assertCreateOrAttachAllowed(opts)
diff --git a/src/main/daemon/terminal-shell-armed-input-mode-recovery.test.ts b/src/main/daemon/terminal-shell-armed-input-mode-recovery.test.ts
index fef4d762c698..630fe21d0bf3 100644
--- a/src/main/daemon/terminal-shell-armed-input-mode-recovery.test.ts
+++ b/src/main/daemon/terminal-shell-armed-input-mode-recovery.test.ts
@@ -50,14 +50,14 @@ describe('armed input modes arm the unclean-death trigger', () => {
     expect(triggers(scanner, chunk)).toBe(false)
   })
 
-  it('stays one-shot until a fresh enable', () => {
+  it('re-triggers at every D until the mode is disarmed', () => {
     const scanner = new TerminalShellLifecycleScanner()
 
     expect(triggers(scanner, `${COMMAND_START}\x1b[?1004hRUN${COMMAND_DONE}`)).toBe(true)
-    // A refuted proof leaves ?1004 armed; later prompts must not pause again.
-    expect(triggers(scanner, `$ ${COMMAND_START}ls${COMMAND_DONE}`)).toBe(false)
-    expect(triggers(scanner, `$ ${COMMAND_START}ls${COMMAND_DONE}`)).toBe(false)
-    expect(triggers(scanner, `$ ${COMMAND_START}\x1b[?1000hRUN${COMMAND_DONE}`)).toBe(true)
+    // A refuted proof leaves ?1004 armed and command-owned; each later D re-asks.
+    expect(triggers(scanner, `$ ${COMMAND_START}ls${COMMAND_DONE}`)).toBe(true)
+    expect(triggers(scanner, `$ ${COMMAND_START}ls${COMMAND_DONE}`)).toBe(true)
+    expect(triggers(scanner, `\x1b[?1004l$ ${COMMAND_START}ls${COMMAND_DONE}`)).toBe(false)
   })
 
   it('treats modes the prompt armed before the command started as shell-owned', () => {
@@ -342,6 +342,25 @@ describe('Session grounds a proven normal-buffer death', () => {
     expect(snapshot?.snapshotAnsi).toContain('\x1b[?1004h')
   })
 
+  it("grounds an agent's modes when it dies after nested shells' refuted Ds", async () => {
+    const leak = { data: `${COMMAND_START}nested\r\n${COMMAND_DONE}`, confirm: false }
+    const { snapshot, records, proofs } = await runSteps([
+      { data: `${PROMPT_START}$ ${COMMAND_START}\x1b[>1u\x1b[?1003hAGENT` },
+      ...Array.from({ length: 5 }, () => leak),
+      { data: `EXIT\r\n${COMMAND_DONE}${PROMPT_START}$ `, confirm: true },
+      { data: `${COMMAND_START}ls\r\n${COMMAND_DONE}${PROMPT_START}$ ` }
+    ])
+
+    // The confirmed ground disarms the modes: the next prompt opens no episode.
+    expect(proofs).toBe(6)
+    expect(
+      records.some(
+        (record) => record.kind === 'output' && record.data.includes(PROCESS_BOUNDARY_GROUND)
+      )
+    ).toBe(true)
+    expect(snapshot?.modes.mouseTrackingMode).toBe('none')
+  })
+
   it('flushes without the ground when the proof is refuted', async () => {
     const { snapshot, records } = await runNormalBufferDeath(false)
 
diff --git a/src/main/daemon/terminal-shell-lifecycle-scanner.test.ts b/src/main/daemon/terminal-shell-lifecycle-scanner.test.ts
index 7d5136d90503..48e1658bef1f 100644
--- a/src/main/daemon/terminal-shell-lifecycle-scanner.test.ts
+++ b/src/main/daemon/terminal-shell-lifecycle-scanner.test.ts
@@ -14,6 +14,7 @@ describe('TerminalShellLifecycleScanner', () => {
       const events = scanner.scan(chunk)
 
       expect(events.uncleanDeathTriggerEnd).toBe(chunk.indexOf('shell-marker'))
+      expect(events.uncleanDeathTriggerStart).toBe(chunk.indexOf('\x1b]133;D'))
       expect(chunk.slice(events.uncleanDeathTriggerEnd)).toBe('shell-marker')
       expect(scanner.isAlternateScreenActive).toBe(true)
       expect(scanner.owner).toBeUndefined()
@@ -45,6 +46,7 @@ describe('TerminalShellLifecycleScanner', () => {
       const events = scanner.scan('37\x07tail')
 
       expect(events.uncleanDeathTriggerEnd).toBe('37\x07'.length)
+      expect(events.uncleanDeathTriggerStart).toBe(0)
       expect('37\x07tail'.slice(events.uncleanDeathTriggerEnd)).toBe('tail')
       expect(scanner.owner).toBeUndefined()
     })
@@ -268,18 +270,19 @@ describe('TerminalShellLifecycleScanner', () => {
 })
 
 describe('unclean trigger arming', () => {
-  it('fires once per alternate-screen occupancy and re-arms only on a fresh entry', () => {
+  it('fires at every D while the alternate screen stays up, and never once it is left', () => {
     const scanner = new TerminalShellLifecycleScanner()
+    const prompt = '\x1b]133;C\x07ls\r\n\x1b]133;D;0\x07'
 
     expect(scanner.scan('\x1b[?1049hTUI\x1b]133;D;137\x07').uncleanDeathTriggerEnd).toBeDefined()
-    // Refuted path: no reset scanned, alt still active — a later prompt's D must not re-trigger.
-    const second = scanner.scan('\x1b]133;C\x07ls\r\n\x1b]133;D;0\x07')
-    expect(second.uncleanDeathTriggerEnd).toBeUndefined()
-    expect(second.cleanExitCandidate).toBeUndefined()
+    // Refuted path: no reset scanned, so each later D re-asks — one may be the TUI's real death.
+    for (let index = 0; index < 5; index += 1) {
+      expect(scanner.scan(prompt).uncleanDeathTriggerEnd).toBeDefined()
+    }
     expect(scanner.isAlternateScreenActive).toBe(true)
 
-    expect(
-      scanner.scan('\x1b]133;C\x07\x1b[?1049hAGAIN\x1b]133;D;9\x07').uncleanDeathTriggerEnd
-    ).toBeDefined()
+    const left = scanner.scan(`\x1b[?1049l${prompt}`)
+    expect(left.uncleanDeathTriggerEnd).toBeUndefined()
+    expect(scanner.scan(prompt).uncleanDeathTriggerEnd).toBeUndefined()
   })
 })
diff --git a/src/main/daemon/terminal-shell-lifecycle-scanner.ts b/src/main/daemon/terminal-shell-lifecycle-scanner.ts
index f62ab47cfd35..f93f9c4df66a 100644
--- a/src/main/daemon/terminal-shell-lifecycle-scanner.ts
+++ b/src/main/daemon/terminal-shell-lifecycle-scanner.ts
@@ -34,6 +34,8 @@ export type ShellLifecycleScanEvents = {
    * and after this index were NOT consumed; the caller re-feeds them.
    */
   uncleanDeathTriggerEnd?: number
+  /** Where that OSC 133;D begins in the chunk; 0 when it began in an earlier one. */
+  uncleanDeathTriggerStart?: number
   /** An OSC 133;D closed a command that had entered the alternate screen and left it cleanly. */
   cleanExitCandidate?: { generation: number }
 }
@@ -54,11 +56,6 @@ export class TerminalShellLifecycleScanner {
   private altActive = false
   private commandEnteredAlternateScreen = false
   private readonly inputModes = new TerminalArmedInputModes()
-  // Why one-shot: a refuted proof leaves the alt screen up (no reset was ever
-  // scanned), and without disarming every later prompt's D would re-open a full
-  // pause-and-inspect episode. Only a fresh alternate-screen enable re-arms; input
-  // modes are one-shot by markCommandEnd's demotion.
-  private uncleanTriggerArmed = false
 
   get owner(): TerminalOwner | undefined {
     return this.ownerState
@@ -97,7 +94,6 @@ export class TerminalShellLifecycleScanner {
       // this a mirror seeded mid-TUI never arms its unclean-death trigger and
       // the whole occupancy loses recovery.
       this.altActive = opts.alternateScreen
-      this.uncleanTriggerArmed = opts.alternateScreen
       this.commandEnteredAlternateScreen = opts.alternateScreen
     }
   }
@@ -123,7 +119,6 @@ export class TerminalShellLifecycleScanner {
         this.inputModes.reset()
         this.altActive = false
         this.commandEnteredAlternateScreen = false
-        this.uncleanTriggerArmed = false
         continue
       }
       if (oscPayload !== undefined) {
@@ -142,13 +137,12 @@ export class TerminalShellLifecycleScanner {
         }
         // An alternate screen or a command's input mode still up at command-finished
         // means the app died without its own teardown; the caller must repair first.
-        const leftInputModes = this.inputModes.markCommandEnd()
-        const uncleanDeath = (this.uncleanTriggerArmed && this.altActive) || leftInputModes
+        // Every D re-asks: a refuted one may be a nested shell's while the app lives.
+        const uncleanDeath = this.inputModes.markCommandEnd() || this.altActive
         const cleanExit = !uncleanDeath && this.commandEnteredAlternateScreen && !this.altActive
         this.revoke()
         this.commandEnteredAlternateScreen = false
         if (uncleanDeath) {
-          this.uncleanTriggerArmed = false
           this.scanTail = ''
           // Why the clamp: a complete OSC can never sit wholly inside the
           // carried tail (extractScanTail keeps incomplete ones only), so this
@@ -158,6 +152,7 @@ export class TerminalShellLifecycleScanner {
             0,
             match.index + match[0].length - previousTailLength
           )
+          events.uncleanDeathTriggerStart = Math.max(0, match.index - previousTailLength)
           return events
         }
         if (cleanExit) {
@@ -195,7 +190,6 @@ export class TerminalShellLifecycleScanner {
           this.altActive = enabled
           if (enabled) {
             this.commandEnteredAlternateScreen = true
-            this.uncleanTriggerArmed = true
           }
         }
       }
diff --git a/src/main/daemon/terminal-shell-recovery-barrier.test.ts b/src/main/daemon/terminal-shell-recovery-barrier.test.ts
index 7cea4ed314ee..dead64c9bec8 100644
--- a/src/main/daemon/terminal-shell-recovery-barrier.test.ts
+++ b/src/main/daemon/terminal-shell-recovery-barrier.test.ts
@@ -4,6 +4,10 @@ import { TerminalShellRecoveryBarrier } from './terminal-shell-recovery-barrier'
 import type { PtyIngressEmission } from '../../shared/pty-startup-ingress'
 
 const TRIGGER = '\x1b[?1049hTUI\x1b]133;D;137\x07'
+// The barrier holds the whole D mark; the ground rides on it.
+const MARK = '\x1b]133;D;137\x07'
+const HEAD = TRIGGER.slice(0, -MARK.length)
+const GROUNDED = `${MARK}${PROCESS_BOUNDARY_GROUND}`
 
 function passthrough(data: string, rawStartSeq = 0): PtyIngressEmission {
   return { data, rawStartSeq, rawEndSeq: rawStartSeq + data.length, transformed: false }
@@ -47,14 +51,14 @@ describe('TerminalShellRecoveryBarrier', () => {
     barrier.accept(passthrough(`${TRIGGER}SHELL-PROMPT`, 100))
     expect(confirm).toHaveBeenCalledTimes(1)
     expect(released).toEqual([
-      { data: TRIGGER, rawStartSeq: 100, rawEndSeq: 100 + TRIGGER.length, transformed: false }
+      { data: HEAD, rawStartSeq: 100, rawEndSeq: 100 + HEAD.length, transformed: false }
     ])
 
     resolveConfirm?.(true)
     await vi.waitFor(() => expect(released).toHaveLength(3))
     expect(released[1]).toEqual({
-      data: PROCESS_BOUNDARY_GROUND,
-      rawStartSeq: 100 + TRIGGER.length,
+      data: GROUNDED,
+      rawStartSeq: 100 + HEAD.length,
       rawEndSeq: 100 + TRIGGER.length,
       transformed: true
     })
@@ -80,12 +84,7 @@ describe('TerminalShellRecoveryBarrier', () => {
 
     resolveConfirm?.(true)
     await vi.waitFor(() => expect(released).toHaveLength(4))
-    expect(released.map((emission) => emission.data)).toEqual([
-      TRIGGER,
-      PROCESS_BOUNDARY_GROUND,
-      'late-1',
-      'late-2'
-    ])
+    expect(released.map((emission) => emission.data)).toEqual([HEAD, GROUNDED, 'late-1', 'late-2'])
   })
 
   it('flushes unmodified with no injection when the proof is refuted', async () => {
@@ -97,8 +96,8 @@ describe('TerminalShellRecoveryBarrier', () => {
     barrier.accept(passthrough(`${TRIGGER}nested-shell`))
     resolveConfirm?.(false)
 
-    await vi.waitFor(() => expect(released).toHaveLength(2))
-    expect(released.map((emission) => emission.data)).toEqual([TRIGGER, 'nested-shell'])
+    await vi.waitFor(() => expect(released).toHaveLength(3))
+    expect(released.map((emission) => emission.data)).toEqual([HEAD, MARK, 'nested-shell'])
     expect(barrier.getOwner()).toBeUndefined()
   })
 
@@ -110,12 +109,12 @@ describe('TerminalShellRecoveryBarrier', () => {
     })
 
     barrier.accept(passthrough(`${TRIGGER}prompt`))
-    await vi.waitFor(() => expect(released).toHaveLength(2))
-    expect(released.map((emission) => emission.data)).toEqual([TRIGGER, 'prompt'])
+    await vi.waitFor(() => expect(released).toHaveLength(3))
+    expect(released.map((emission) => emission.data)).toEqual([HEAD, MARK, 'prompt'])
 
     resolveConfirm?.(true)
     await new Promise((resolve) => setTimeout(resolve, 5))
-    expect(released).toHaveLength(2)
+    expect(released).toHaveLength(3)
     expect(barrier.getOwner()).toBeUndefined()
   })
 
@@ -128,7 +127,7 @@ describe('TerminalShellRecoveryBarrier', () => {
     barrier.accept(passthrough(TRIGGER))
     barrier.accept(passthrough('0123456789'))
 
-    expect(released.map((emission) => emission.data)).toEqual([TRIGGER, '0123456789'])
+    expect(released.map((emission) => emission.data)).toEqual([HEAD, MARK, '0123456789'])
     expect(barrier.getOwner()).toBeUndefined()
   })
 
@@ -144,8 +143,8 @@ describe('TerminalShellRecoveryBarrier', () => {
     alive = false
     resolveConfirm?.(true)
 
-    await vi.waitFor(() => expect(released).toHaveLength(2))
-    expect(released.map((emission) => emission.data)).toEqual([TRIGGER, 'prompt'])
+    await vi.waitFor(() => expect(released).toHaveLength(3))
+    expect(released.map((emission) => emission.data)).toEqual([HEAD, MARK, 'prompt'])
     expect(barrier.getOwner()).toBeUndefined()
   })
 
@@ -165,11 +164,11 @@ describe('TerminalShellRecoveryBarrier', () => {
 
     await vi.waitFor(() =>
       expect(released.map((emission) => emission.data)).toEqual([
-        TRIGGER,
-        PROCESS_BOUNDARY_GROUND,
+        HEAD,
+        GROUNDED,
         'first-prompt',
-        '\x1b[?1049hAGAIN\x1b]133;D;9\x07',
-        PROCESS_BOUNDARY_GROUND,
+        '\x1b[?1049hAGAIN',
+        `\x1b]133;D;9\x07${PROCESS_BOUNDARY_GROUND}`,
         'second-prompt'
       ])
     )
@@ -274,13 +273,12 @@ describe('TerminalShellRecoveryBarrier', () => {
     await vi.waitFor(() =>
       expect(released.map((emission) => emission.data)).toEqual([
         head,
-        '37\x07',
-        PROCESS_BOUNDARY_GROUND,
+        `37\x07${PROCESS_BOUNDARY_GROUND}`,
         'PROMPT'
       ])
     )
     expect(released[1]).toMatchObject({ rawStartSeq: head.length, rawEndSeq: head.length + 3 })
-    expect(released[3]).toMatchObject({
+    expect(released[2]).toMatchObject({
       rawStartSeq: head.length + 3,
       rawEndSeq: head.length + tail.length
     })
@@ -308,34 +306,71 @@ describe('TerminalShellRecoveryBarrier', () => {
 
     await settled
     await vi.waitFor(() =>
-      expect(released.map((emission) => emission.data)).toEqual([
-        TRIGGER,
-        PROCESS_BOUNDARY_GROUND,
-        'after-poison'
-      ])
+      expect(released.map((emission) => emission.data)).toEqual([HEAD, GROUNDED, 'after-poison'])
     )
     await expect(barrier.idle()).resolves.toBeUndefined()
   })
 
-  it('opens at most one episode per alternate-screen occupancy after a refuted proof', async () => {
+  it('asks at every D of a live TUI and releases every byte, in order, unmodified', async () => {
     const { barrier, released, confirm } = createBarrier({ confirm: async () => false })
-
-    barrier.accept(passthrough(`${TRIGGER}prompt`))
-    await vi.waitFor(() => expect(released).toHaveLength(2))
-    expect(confirm).toHaveBeenCalledTimes(1)
-
-    // Why: the refuted path never scans a reset, so alt stays active — later
-    // ordinary prompts must not each re-open a pause-and-inspect episode.
+    const leak = '\x1b]133;C\x07nested\x1b]133;D;0\x07'
+    const sent = [`\x1b[?1049h\x1b[?1003hTUI${leak}frame`]
     for (let index = 0; index < 5; index += 1) {
-      const prompt = passthrough(`\x1b]133;C\x07ls\r\n\x1b]133;D;0\x07`)
-      barrier.accept(prompt)
-      expect(released.at(-1)).toBe(prompt)
+      sent.push(`${leak}frame${index}`)
     }
-    expect(confirm).toHaveBeenCalledTimes(1)
 
-    // A fresh alternate-screen entry re-arms recovery.
-    barrier.accept(passthrough(`\x1b]133;C\x07\x1b[?1049hAGAIN\x1b]133;D;9\x07`))
-    expect(confirm).toHaveBeenCalledTimes(2)
+    let seq = 0
+    for (const data of sent) {
+      barrier.accept(passthrough(data, seq))
+      seq += data.length
+    }
+    await vi.waitFor(() => expect(confirm).toHaveBeenCalledTimes(6))
+    await barrier.idle()
+
+    expect(released.map((emission) => emission.data).join('')).toBe(sent.join(''))
+    expect(released.every((emission) => !emission.transformed)).toBe(true)
+    expect(barrier.getOwner()).toBeUndefined()
+  })
+
+  it("grounds a TUI that dies after many nested shells' Ds were refuted", async () => {
+    let dead = false
+    const { barrier, released, confirm } = createBarrier({ confirm: async () => dead })
+    const leak = '\x1b]133;C\x07nested\x1b]133;D;0\x07'
+
+    barrier.accept(passthrough(`\x1b[?1049hTUI${leak.repeat(5)}`))
+    await vi.waitFor(() => expect(confirm).toHaveBeenCalledTimes(5))
+    await barrier.idle()
+    dead = true
+    barrier.accept(passthrough('\x1b]133;D;137\x07prompt'))
+
+    await vi.waitFor(() => expect(barrier.getOwner()).toBe('shell'))
+    expect(released.slice(-2).map((emission) => emission.data)).toEqual([GROUNDED, 'prompt'])
+    // Grounded once: the next prompt opens no episode.
+    barrier.accept(passthrough('\x1b]133;C\x07ls\x1b]133;D;0\x07'))
+    expect(confirm).toHaveBeenCalledTimes(6)
+  })
+
+  it('grounds a real death D that arrives while a stray D is still being proven', async () => {
+    const proofs: ((confirmed: boolean) => void)[] = []
+    const { barrier, released, confirm } = createBarrier({
+      confirm: () => new Promise((resolve) => void proofs.push(resolve))
+    })
+    const leak = '\x1b[?1049h\x1b[?1003hTUI\x1b]133;C\x07nested\x1b]133;D;0\x07'
+
+    barrier.accept(passthrough(leak, 0))
+    barrier.accept(passthrough('frame\x1b]133;D;137\x07prompt', leak.length))
+    proofs[0]?.(false)
+    await vi.waitFor(() => expect(confirm).toHaveBeenCalledTimes(2))
+    proofs[1]?.(true)
+
+    await vi.waitFor(() => expect(barrier.getOwner()).toBe('shell'))
+    expect(released.map((emission) => emission.data)).toEqual([
+      leak.slice(0, -'\x1b]133;D;0\x07'.length),
+      '\x1b]133;D;0\x07',
+      'frame',
+      GROUNDED,
+      'prompt'
+    ])
   })
 
   it('bounds awaitProofSettled by its own deadline when a clean-exit proof hangs', async () => {
@@ -359,7 +394,7 @@ describe('TerminalShellRecoveryBarrier', () => {
     const barrier = new TerminalShellRecoveryBarrier({
       confirmShellForeground: confirm,
       release: (emission) => {
-        if (!headThrown && emission.data === TRIGGER) {
+        if (!headThrown && emission.data === HEAD) {
           headThrown = true
           throw new Error('client transport died mid-broadcast')
         }
@@ -373,10 +408,7 @@ describe('TerminalShellRecoveryBarrier', () => {
     resolveConfirm?.(true)
 
     await vi.waitFor(() =>
-      expect(released.map((emission) => emission.data)).toEqual([
-        PROCESS_BOUNDARY_GROUND,
-        'SHELL-PROMPT'
-      ])
+      expect(released.map((emission) => emission.data)).toEqual([GROUNDED, 'SHELL-PROMPT'])
     )
     expect(barrier.getOwner()).toBe('shell')
   })
@@ -385,11 +417,11 @@ describe('TerminalShellRecoveryBarrier', () => {
     const { barrier, released } = createBarrier({ confirm: () => new Promise(() => {}) })
 
     barrier.accept(passthrough(`${TRIGGER}prompt`))
-    expect(released.map((emission) => emission.data)).toEqual([TRIGGER])
+    expect(released.map((emission) => emission.data)).toEqual([HEAD])
 
     barrier.flushPending()
 
-    expect(released.map((emission) => emission.data)).toEqual([TRIGGER, 'prompt'])
+    expect(released.map((emission) => emission.data)).toEqual([HEAD, MARK, 'prompt'])
     expect(barrier.getOwner()).toBeUndefined()
   })
 
@@ -398,8 +430,50 @@ describe('TerminalShellRecoveryBarrier', () => {
     barrier.accept(passthrough(`${TRIGGER}prompt`))
     barrier.dispose()
 
-    expect(released.map((emission) => emission.data)).toEqual([TRIGGER])
+    expect(released.map((emission) => emission.data)).toEqual([HEAD])
     barrier.accept(passthrough('after-dispose'))
     expect(released).toHaveLength(1)
   })
+
+  it('carries the ground on an ESC-backslash terminator split from its ESC', async () => {
+    const { barrier, released } = createBarrier()
+    const head = '\x1b[?1049hTUI\x1b]133;D;137\x1b'
+    barrier.accept(passthrough(head, 0))
+    barrier.accept(passthrough('\\PROMPT', head.length))
+
+    await vi.waitFor(() => expect(barrier.getOwner()).toBe('shell'))
+    expect(released).toEqual([
+      passthrough(head, 0),
+      {
+        data: `\\${PROCESS_BOUNDARY_GROUND}`,
+        rawStartSeq: head.length,
+        rawEndSeq: head.length + 1,
+        transformed: true
+      },
+      passthrough('PROMPT', head.length + 1)
+    ])
+  })
+
+  it.each([
+    ['confirmed', async () => true],
+    ['refuted', async () => false],
+    ['timed out', () => new Promise<boolean>(() => {})]
+  ])('covers at least one raw unit with every emission when %s', async (_, confirm) => {
+    const { barrier, released } = createBarrier({ confirm, maxPendingMs: 20 })
+    const stream = [`${TRIGGER}p1`, '\x1b[?1049h\x1b]133;D;1\x1b', '\\p2', `${TRIGGER}`, 'p3']
+    let seq = 0
+    for (const data of stream) {
+      barrier.accept(passthrough(data, seq))
+      seq += data.length
+    }
+    await vi.waitFor(() => expect(released.at(-1)?.rawEndSeq).toBe(seq))
+
+    expect(released.every((emission) => emission.rawEndSeq > emission.rawStartSeq)).toBe(true)
+    const raw = released.map((emission) =>
+      emission.transformed
+        ? emission.data.slice(0, emission.rawEndSeq - emission.rawStartSeq)
+        : emission.data
+    )
+    expect(raw.join('')).toBe(stream.join(''))
+  })
 })
diff --git a/src/main/daemon/terminal-shell-recovery-barrier.ts b/src/main/daemon/terminal-shell-recovery-barrier.ts
index 69149835216a..6fe5832dcf1a 100644
--- a/src/main/daemon/terminal-shell-recovery-barrier.ts
+++ b/src/main/daemon/terminal-shell-recovery-barrier.ts
@@ -7,6 +7,9 @@ import type { TerminalOwner } from '../../shared/terminal-owner'
 // flood or hang means the trigger misfired, so bail out and flush unmodified.
 const MAX_QUEUED_BYTES = 262_144
 const MAX_PENDING_MS = 750
+// Why bounded: the grounded mark is one indivisible span, and the relay never
+// sends a span wider than its 16K source frame.
+const MAX_HELD_MARK_CHARS = 4096
 
 export type TerminalShellRecoveryBarrierOptions = {
   /** Fresh execution-host proof that the spawned shell owns the PTY foreground. */
@@ -22,13 +25,17 @@ export type TerminalShellRecoveryBarrierOptions = {
  * Ordered output barrier for dead-TUI mode recovery. Sits between startup
  * ingress and the output plane. When a shell-integration command-done marker
  * (OSC 133;D) arrives while the alternate screen is still active, the stream
- * pauses at that exact byte boundary, the execution host proves the shell owns
- * the PTY foreground, and on proof a mode reset is injected as in-stream output
- * so every downstream consumer (host emulator, mirrors, attached renderers,
+ * holds that marker, the execution host proves the shell owns the PTY
+ * foreground, and on proof a mode reset is injected as in-stream output so
+ * every downstream consumer (host emulator, mirrors, attached renderers,
  * history) converges — and the queued shell prompt then paints onto the normal
- * buffer instead of the discarded alternate screen. Any failure (refuted proof,
- * timeout, overflow, death, disposal) flushes the queue unmodified, preserving
- * incumbent behavior. Clean alternate-screen exits prove ownership without
+ * buffer instead of the discarded alternate screen. Holding the whole marker
+ * keeps a mid-proof snapshot on an escape boundary. The reset rides on it so
+ * every emission covers at least one raw unit: a zero-raw span is never sent by
+ * credit-windowed delivery (SSH relay), and its seq would not rise above a
+ * mid-proof snapshot, so snapshot-seq dedup would drop it. Any failure (refuted
+ * proof, timeout, overflow, death, disposal) flushes the queue unmodified,
+ * preserving incumbent behavior. Clean alternate-screen exits prove ownership without
  * pausing: the model needs no correction, only snapshot metadata.
  */
 export class TerminalShellRecoveryBarrier {
@@ -43,7 +50,6 @@ export class TerminalShellRecoveryBarrier {
   private queuedBytes = 0
   private pending = false
   private pendingGeneration = 0
-  private pendingRawSeq = 0
   private pendingEpisode = 0
   private bailTimer: ReturnType<typeof setTimeout> | null = null
   private idleWaiters: (() => void)[] = []
@@ -187,12 +193,16 @@ export class TerminalShellRecoveryBarrier {
       this.releaseDownstream(emission)
       return
     }
+    // end >= 1 keeps the held mark inside this emission's raw span.
     const splittable =
-      !emission.transformed && emission.rawEndSeq - emission.rawStartSeq === emission.data.length
+      end >= 1 &&
+      !emission.transformed &&
+      emission.rawEndSeq - emission.rawStartSeq === emission.data.length
     if (!splittable) {
       // Why skip the episode: the raw-seq boundary inside a transformed emission
-      // cannot be reconstructed, so release everything and keep the scanner
-      // honest about the remainder — incumbent behavior for this rare corner.
+      // (or a mark ending outside this one) cannot be reconstructed, so release
+      // everything and keep the scanner honest about the remainder — incumbent
+      // behavior for this rare corner.
       try {
         this.releaseDownstream(emission)
       } catch {
@@ -202,20 +212,29 @@ export class TerminalShellRecoveryBarrier {
       this.consumeForStateOnly(emission.data.slice(end))
       return
     }
+    const start = Math.max(events.uncleanDeathTriggerStart ?? 0, end - MAX_HELD_MARK_CHARS)
+    const markSeq = emission.rawStartSeq + start
     const splitSeq = emission.rawStartSeq + end
-    try {
-      this.releaseDownstream({
-        data: emission.data.slice(0, end),
-        rawStartSeq: emission.rawStartSeq,
-        rawEndSeq: splitSeq,
-        transformed: false
-      })
-    } catch {
-      // Why swallowed: the emulator and records already took the head inside
-      // emit before a client's broadcast threw; aborting here would cost the
-      // post-boundary prompt its entire recovery episode.
+    if (start > 0) {
+      try {
+        this.releaseDownstream({
+          data: emission.data.slice(0, start),
+          rawStartSeq: emission.rawStartSeq,
+          rawEndSeq: markSeq,
+          transformed: false
+        })
+      } catch {
+        // Why swallowed: the emulator and records already took the head inside
+        // emit before a client's broadcast threw; aborting here would cost the
+        // post-boundary prompt its entire recovery episode.
+      }
     }
-    this.enterPending(splitSeq)
+    this.enterPending({
+      data: emission.data.slice(start, end),
+      rawStartSeq: markSeq,
+      rawEndSeq: splitSeq,
+      transformed: false
+    })
     if (end < emission.data.length) {
       this.enqueue({
         data: emission.data.slice(end),
@@ -240,14 +259,15 @@ export class TerminalShellRecoveryBarrier {
     }
   }
 
-  private enterPending(rawSeq: number): void {
+  /** Opens an episode holding `mark` as the queue head, already scanned. */
+  private enterPending(mark: PtyIngressEmission): void {
     this.pending = true
     this.pendingEpisode += 1
     this.pendingGeneration = this.scanner.generation
-    this.pendingRawSeq = rawSeq
     const episode = this.pendingEpisode
     this.bailTimer = setTimeout(() => this.finishPending(episode, false), this.maxPendingMs)
     this.bailTimer.unref?.()
+    this.enqueue(mark)
     // Why the guard: the callback is injected; a synchronous throw must not
     // escape after pending flipped true and strand the episode until the bail.
     let proof: Promise<boolean>
@@ -279,21 +299,9 @@ export class TerminalShellRecoveryBarrier {
     this.queue = []
     this.queuedBytes = 0
     try {
-      if (confirmed && this.isAlive()) {
-        // Scanned before release so alt-state stays honest.
-        const ground = this.scanner.groundProcessBoundary()
-        try {
-          this.releaseDownstream({
-            data: ground,
-            rawStartSeq: this.pendingRawSeq,
-            rawEndSeq: this.pendingRawSeq,
-            transformed: true
-          })
-        } catch {
-          // Why swallowed: a throwing downstream client must not strand the
-          // queued prompt bytes below.
-        }
-        this.scanner.trySetOwner(this.pendingGeneration)
+      const mark = queued.shift()
+      if (mark) {
+        this.releaseMark(mark, confirmed && this.isAlive())
       }
       for (let index = 0; index < queued.length; index += 1) {
         if (this.disposed) {
@@ -318,6 +326,27 @@ export class TerminalShellRecoveryBarrier {
     }
   }
 
+  private releaseMark(mark: PtyIngressEmission, grounded: boolean): void {
+    try {
+      this.releaseDownstream(
+        grounded
+          ? {
+              ...mark,
+              // Scanned before release so alt-state stays honest.
+              data: mark.data + this.scanner.groundProcessBoundary(),
+              transformed: true
+            }
+          : mark
+      )
+    } catch {
+      // Why swallowed: a throwing downstream client must not strand the
+      // queued prompt bytes behind it.
+    }
+    if (grounded) {
+      this.scanner.trySetOwner(this.pendingGeneration)
+    }
+  }
+
   private enqueue(emission: PtyIngressEmission): void {
     this.queue.push(emission)
     this.queuedBytes += emission.data.length
diff --git a/src/main/daemon/windows-conpty-warmup.test.ts b/src/main/daemon/windows-conpty-warmup.test.ts
index 1ab19b0c97ed..a10d054926cb 100644
--- a/src/main/daemon/windows-conpty-warmup.test.ts
+++ b/src/main/daemon/windows-conpty-warmup.test.ts
@@ -1,6 +1,11 @@
 import { afterEach, describe, expect, it, vi } from 'vitest'
 import type * as pty from 'node-pty'
 import { warmWindowsConptyOnce } from './windows-conpty-warmup'
+import { assignHostProcessToKillOnCloseJob } from '../windows/windows-pty-job'
+
+vi.mock('../windows/windows-pty-job', () => ({
+  assignHostProcessToKillOnCloseJob: vi.fn(() => true)
+}))
 
 function setPlatform(platform: NodeJS.Platform): () => void {
   const original = process.platform
@@ -17,6 +22,7 @@ afterEach(() => {
   restorePlatform?.()
   restorePlatform = null
   vi.restoreAllMocks()
+  vi.clearAllMocks()
 })
 
 function makeFakePty(): { proc: pty.IPty; fireExit: () => void } {
@@ -41,6 +47,7 @@ describe('warmWindowsConptyOnce', () => {
     await flushImmediates()
 
     expect(spawnPty).not.toHaveBeenCalled()
+    expect(assignHostProcessToKillOnCloseJob).not.toHaveBeenCalled()
   })
 
   it('spawns a short-lived cmd.exe with the bundled ConPTY on Windows', async () => {
@@ -52,6 +59,7 @@ describe('warmWindowsConptyOnce', () => {
     await flushImmediates()
 
     expect(spawnPty).toHaveBeenCalledTimes(1)
+    expect(assignHostProcessToKillOnCloseJob).toHaveBeenCalledBefore(vi.mocked(spawnPty))
     const [file, args, options] = vi.mocked(spawnPty).mock.calls[0]
     expect(String(file).toLowerCase()).toContain('cmd')
     expect(args).toEqual(['/c', 'exit'])
diff --git a/src/main/daemon/windows-conpty-warmup.ts b/src/main/daemon/windows-conpty-warmup.ts
index aea1c50b2dbb..98c3144380ce 100644
--- a/src/main/daemon/windows-conpty-warmup.ts
+++ b/src/main/daemon/windows-conpty-warmup.ts
@@ -1,7 +1,36 @@
 import os from 'node:os'
-import * as pty from 'node-pty'
+import type * as pty from 'node-pty'
+import { createRequire } from 'node:module'
+import { canUseBunPty, spawnBunPty } from './pty-subprocess/bun-pty-process'
+import { assignHostProcessToKillOnCloseJob } from '../windows/windows-pty-job'
 
 const WARMUP_KILL_TIMEOUT_MS = 10_000
+const requireFromMain = createRequire(__filename)
+
+const spawnWarmupPty: typeof pty.spawn = (file, args, options) => {
+  if (canUseBunPty()) {
+    if (!Array.isArray(args)) {
+      throw new Error('Bun PTY requires argument arrays')
+    }
+    const env: Record<string, string> = {}
+    for (const [key, value] of Object.entries(options.env ?? process.env)) {
+      if (value !== undefined) {
+        env[key] = value
+      }
+    }
+    return spawnBunPty({
+      file,
+      args,
+      cwd: options.cwd ?? os.homedir(),
+      env,
+      cols: options.cols ?? 2,
+      rows: options.rows ?? 1
+    })
+  }
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: node-pty's installed package implements the declared spawn contract.
+  const nodePty = requireFromMain('node-pty') as typeof pty
+  return nodePty.spawn(file, args, options)
+}
 
 /**
  * Pays the one-time cost of the first ConPTY spawn (conpty native module
@@ -9,7 +38,7 @@ const WARMUP_KILL_TIMEOUT_MS = 10_000
  * those binaries) at daemon boot instead of on the user's first terminal.
  * Measured ~2.7s on a Windows dev profile for the first spawn vs ~70ms after.
  */
-export function warmWindowsConptyOnce(spawnPty: typeof pty.spawn = pty.spawn): void {
+export function warmWindowsConptyOnce(spawnPty: typeof pty.spawn = spawnWarmupPty): void {
   if (process.platform !== 'win32') {
     return
   }
@@ -17,6 +46,10 @@ export function warmWindowsConptyOnce(spawnPty: typeof pty.spawn = pty.spawn): v
   // real spawn arriving first simply does the warming itself.
   setImmediate(() => {
     try {
+      // Warm-up children must die with the daemon, even before its first real terminal.
+      if (!canUseBunPty()) {
+        assignHostProcessToKillOnCloseJob()
+      }
       const proc = spawnPty(process.env.COMSPEC || 'cmd.exe', ['/c', 'exit'], {
         name: 'xterm-256color',
         cols: 2,
diff --git a/src/main/dsh/dsh-home-patch.test.ts b/src/main/dsh/dsh-home-patch.test.ts
new file mode 100644
index 000000000000..53ab8986715b
--- /dev/null
+++ b/src/main/dsh/dsh-home-patch.test.ts
@@ -0,0 +1,147 @@
+import { describe, expect, it } from 'vitest'
+import {
+  applyManagedDshPatch,
+  findManagedDshPatchRegion,
+  readManagedDshHooksConfigPath,
+  removeManagedDshPatch
+} from './dsh-home-patch'
+
+const HOOKS_PATH = '/home/dev/.orca/agent-hooks/dsh-hooks.json'
+
+/** applyManagedDshPatch returns null only for files it refuses to edit; these cases expect an edit. */
+function applyOrFail(text: string, hooksPath = HOOKS_PATH): string {
+  const next = applyManagedDshPatch(text, hooksPath)
+  if (next === null) {
+    throw new Error('expected the patch file to be editable')
+  }
+  return next
+}
+
+// The body DSH writes into a freshly initialized patch file.
+const PRISTINE = [
+  '# Your patch layer for this dsh profile, applied after every bundle layer:',
+  '# a top-level YAML array of loader patch entries (id-targeted config',
+  '# overrides, disables, and insert lists; `!!js` expressions allowed).',
+  '[]',
+  ''
+].join('\n')
+
+const USER_ROWS = ['- id: llm-deepseek', '  config:', "    apiKeyEnv: 'MY_KEY'", ''].join('\n')
+
+describe('applyManagedDshPatch', () => {
+  it('creates the managed block in an empty file', () => {
+    const text = applyOrFail('')
+    expect(readManagedDshHooksConfigPath(text)).toBe(HOOKS_PATH)
+    expect(text).toContain("name: '@deepseek-ai/dsh-hooks-claude-code'")
+    expect(text.endsWith('\n')).toBe(true)
+  })
+
+  it('replaces the empty flow sequence DSH ships, keeping its comments', () => {
+    const text = applyOrFail(PRISTINE)
+    // `- item` after `[]` is a YAML parse error, so the `[]` token has to go.
+    expect(text).not.toMatch(/^\[]$/m)
+    expect(text).toContain('# Your patch layer for this dsh profile')
+    expect(readManagedDshHooksConfigPath(text)).toBe(HOOKS_PATH)
+  })
+
+  it('appends after user rows without touching them', () => {
+    const text = applyOrFail(USER_ROWS)
+    expect(text.startsWith(USER_ROWS.trimEnd())).toBe(true)
+    expect(readManagedDshHooksConfigPath(text)).toBe(HOOKS_PATH)
+  })
+
+  it('rewrites its own block in place rather than stacking copies', () => {
+    const once = applyOrFail(USER_ROWS, '/old/path.json')
+    const twice = applyOrFail(once)
+    expect(twice.match(/orca-managed-dsh-hooks \(managed by Orca/g)).toHaveLength(1)
+    expect(readManagedDshHooksConfigPath(twice)).toBe(HOOKS_PATH)
+    expect(twice).not.toContain('/old/path.json')
+  })
+
+  it('is idempotent', () => {
+    const once = applyOrFail(PRISTINE)
+    expect(applyOrFail(once)).toBe(once)
+  })
+
+  it('treats `[] # comment` as the empty document it is, keeping the comment', () => {
+    // The exact-match check missed this and appended `- insert:` after the flow sequence.
+    const text = '[] # keep empty\n'
+    const next = applyOrFail(text)
+    expect(next).not.toMatch(/^\s*\[]/m)
+    expect(next).toContain('# keep empty')
+    expect(readManagedDshHooksConfigPath(next)).toBe(HOOKS_PATH)
+  })
+
+  it.each([
+    '- id: llm-deepseek\n  config: {}\n', // block sequence — editable
+    '\n',
+    '# only a comment\n'
+  ])('still edits %j', (text) => {
+    expect(applyManagedDshPatch(text, HOOKS_PATH)).not.toBeNull()
+  })
+
+  it.each(['[{ id: llm-deepseek }]\n', '[\n  { id: a },\n  { id: b }\n]\n'])(
+    'refuses to append after the non-empty flow sequence %j',
+    (text) => {
+      // YAML forbids a block entry after a flow sequence: appending would leave DSH unable
+      // to parse the user's own layer either, so there is no safe in-place edit.
+      expect(applyManagedDshPatch(text, HOOKS_PATH)).toBeNull()
+    }
+  )
+
+  it('quotes a path containing a single quote', () => {
+    const awkward = "/home/o'brien/.orca/agent-hooks/dsh-hooks.json"
+    expect(readManagedDshHooksConfigPath(applyOrFail('', awkward))).toBe(awkward)
+  })
+})
+
+describe('removeManagedDshPatch', () => {
+  it('restores the empty flow sequence when nothing else remains', () => {
+    const installed = applyOrFail(PRISTINE)
+    const { text, changed } = removeManagedDshPatch(installed)
+    expect(changed).toBe(true)
+    // Without this the file would come back as an unparseable empty document.
+    expect(text.trimEnd().endsWith('[]')).toBe(true)
+    expect(text).toContain('# Your patch layer for this dsh profile')
+  })
+
+  it('leaves user rows alone and adds no [] when they remain', () => {
+    const installed = applyOrFail(USER_ROWS)
+    const { text } = removeManagedDshPatch(installed)
+    expect(text.trimEnd()).toBe(USER_ROWS.trimEnd())
+  })
+
+  it('reports no change when the file carries no managed block', () => {
+    expect(removeManagedDshPatch(USER_ROWS)).toEqual({ text: USER_ROWS, changed: false })
+  })
+})
+
+describe('findManagedDshPatchRegion', () => {
+  const ORPHAN_START = '# >>> orca-managed-dsh-hooks (managed by Orca; do not edit) >>>'
+
+  it('fails closed on a truncated region rather than guessing its extent', () => {
+    // Splicing a guessed end marker would delete the user rows that follow.
+    const truncated = `${ORPHAN_START}\n${USER_ROWS}`
+    expect(findManagedDshPatchRegion(truncated)).toBeNull()
+    expect(removeManagedDshPatch(truncated).changed).toBe(false)
+  })
+
+  it('never pairs an orphan start with a later block\u2019s end', () => {
+    // The data-loss shape: an interrupted write leaves an orphan start above the user's
+    // rows, and the next install appends a complete block below them. Pairing the orphan
+    // with the new end marker would make the region cover the user's rows, so install
+    // (rewrite) and remove (strip) would both delete them.
+    const truncated = `${ORPHAN_START}\n${USER_ROWS}`
+    const installed = applyOrFail(truncated)
+    expect(installed).toContain('apiKeyEnv')
+
+    const region = findManagedDshPatchRegion(installed)
+    expect(region).not.toBeNull()
+    const covered = installed.split('\n').slice(region?.startLine ?? 0, (region?.endLine ?? 0) + 1)
+    expect(covered.join('\n')).not.toContain('apiKeyEnv')
+
+    // Both mutating paths must leave the user's rows intact, twice over.
+    expect(applyOrFail(installed)).toContain('apiKeyEnv')
+    expect(removeManagedDshPatch(installed).text).toContain('apiKeyEnv')
+  })
+})
diff --git a/src/main/dsh/dsh-home-patch.ts b/src/main/dsh/dsh-home-patch.ts
new file mode 100644
index 000000000000..723d030e214b
--- /dev/null
+++ b/src/main/dsh/dsh-home-patch.ts
@@ -0,0 +1,195 @@
+/**
+ * Orca's managed block inside `$DSH_HOME/cordis.patch.yml`.
+ *
+ * That file is a hand-editable top-level YAML sequence of loader patch entries, and no
+ * YAML library is vendored in the main process, so Orca manages only its own
+ * marker-delimited region: install rewrites the region, remove strips it, and everything
+ * outside the markers is copied through byte for byte. Appending sequence entries to a
+ * block sequence is always valid YAML, so the region can live at the end of any file.
+ *
+ * The one shape that is not append-safe is an empty *flow* sequence (`[]`), which is what
+ * DSH writes into a freshly initialized patch file. `- item` after `[]` is a parse error,
+ * so that token is dropped when the managed block is added and restored when it is the
+ * last thing removed — otherwise the file would come back as an unparseable empty
+ * document.
+ */
+
+const START_MARKER = '# >>> orca-managed-dsh-hooks (managed by Orca; do not edit) >>>'
+const END_MARKER = '# <<< orca-managed-dsh-hooks <<<'
+
+/** The loader row id Orca owns. A patch row is addressed by id, so this must be stable. */
+const MANAGED_ROW_ID = 'orca-agent-hooks'
+
+const EMPTY_FLOW_SEQUENCE = '[]'
+
+export type ManagedDshPatchRegion = { startLine: number; endLine: number }
+
+function splitLines(text: string): string[] {
+  return text.split('\n')
+}
+
+/** Locate the managed region, or null when the file carries none. */
+export function findManagedDshPatchRegion(text: string): ManagedDshPatchRegion | null {
+  // Why the NEAREST preceding start, not the first one: an interrupted write can leave an
+  // orphan start marker with no end. Pairing that orphan with a LATER block's end marker
+  // makes the region swallow every row in between — so the next install (which rewrites the
+  // region) or remove (which strips it) would delete the user's own rows. Walking forward
+  // and resetting the candidate on each start keeps an orphan un-paired, which leaves it as
+  // an inert comment line rather than a deletion range.
+  let startLine = -1
+  for (const [index, line] of splitLines(text).entries()) {
+    const trimmed = line.trim()
+    if (trimmed === START_MARKER) {
+      startLine = index
+    } else if (trimmed === END_MARKER && startLine !== -1) {
+      return { startLine, endLine: index }
+    }
+  }
+  return null
+}
+
+function buildManagedBlock(managedHooksPath: string): string[] {
+  return [
+    START_MARKER,
+    '- insert:',
+    `    - id: ${MANAGED_ROW_ID}`,
+    "      name: '@deepseek-ai/dsh-hooks-claude-code'",
+    '      config:',
+    `        configPath: ${quoteYamlScalar(managedHooksPath)}`,
+    END_MARKER
+  ]
+}
+
+/** Single-quoted YAML scalar: the only escape inside one is a doubled quote. */
+function quoteYamlScalar(value: string): string {
+  return `'${value.replaceAll("'", "''")}'`
+}
+
+function unquoteYamlScalar(value: string): string {
+  const trimmed = value.trim()
+  if (trimmed.startsWith("'") && trimmed.endsWith("'") && trimmed.length >= 2) {
+    return trimmed.slice(1, -1).replaceAll("''", "'")
+  }
+  if (trimmed.startsWith('"') && trimmed.endsWith('"') && trimmed.length >= 2) {
+    return trimmed.slice(1, -1)
+  }
+  return trimmed
+}
+
+/** The `configPath` Orca's managed region currently points at, if any. */
+export function readManagedDshHooksConfigPath(text: string): string | undefined {
+  const region = findManagedDshPatchRegion(text)
+  if (!region) {
+    return undefined
+  }
+  for (const line of splitLines(text).slice(region.startLine + 1, region.endLine)) {
+    const match = /^\s*configPath:\s*(.+?)\s*$/.exec(line)
+    if (match) {
+      return unquoteYamlScalar(match[1])
+    }
+  }
+  return undefined
+}
+
+function stripRegion(lines: string[], region: ManagedDshPatchRegion): string[] {
+  return [...lines.slice(0, region.startLine), ...lines.slice(region.endLine + 1)]
+}
+
+function isBlank(line: string): boolean {
+  return line.trim().length === 0
+}
+
+function isComment(line: string): boolean {
+  return line.trim().startsWith('#')
+}
+
+function documentBody(lines: readonly string[]): readonly string[] {
+  return lines.filter((line) => !isBlank(line) && !isComment(line))
+}
+
+/** Strips a trailing `# …` so `[] # keep empty` reads as the empty sequence it is. */
+function withoutTrailingComment(line: string): string {
+  const hash = line.indexOf('#')
+  return (hash === -1 ? line : line.slice(0, hash)).trim()
+}
+
+/** True when the body is the empty flow sequence, with or without a trailing comment. */
+function isEmptyFlowDocument(lines: readonly string[]): boolean {
+  const body = documentBody(lines)
+  return body.length === 1 && withoutTrailingComment(body[0]) === EMPTY_FLOW_SEQUENCE
+}
+
+/**
+ * True when Orca cannot append its block to this file: the body is a NON-EMPTY flow
+ * sequence (`[a, b]`, or one spread over lines).
+ *
+ * Why it matters: YAML forbids a block entry after a flow sequence, so appending Orca's
+ * `- insert:` would produce a file DSH cannot parse — losing the user's own patch layer as
+ * well as Orca's hooks. There is no safe in-place edit, so install refuses instead.
+ *
+ * Exported because status has to report the same refusal on every read, not just on the
+ * install that first hit it.
+ */
+export function isDshPatchFileUnappendable(text: string): boolean {
+  const lines = splitLines(text)
+  const body = documentBody(lines)
+  return body.length > 0 && body[0].trimStart().startsWith('[') && !isEmptyFlowDocument(lines)
+}
+
+function withoutTrailingBlanks(lines: readonly string[]): readonly string[] {
+  const end = lines.findLastIndex((line) => !isBlank(line))
+  return lines.slice(0, end + 1)
+}
+
+function joinPreservingTrailingNewline(lines: readonly string[]): string {
+  const text = lines.join('\n')
+  return text.endsWith('\n') || text.length === 0 ? text : `${text}\n`
+}
+
+/**
+ * Install (or refresh) Orca's managed region so the DSH hook bridge reads
+ * `managedHooksPath`. Everything outside the markers is preserved.
+ *
+ * Returns null when the file cannot be edited safely — see isNonEmptyFlowDocument. The
+ * caller reports that; it must never write a file DSH would then fail to parse.
+ */
+export function applyManagedDshPatch(text: string, managedHooksPath: string): string | null {
+  const lines = splitLines(text)
+  const block = buildManagedBlock(managedHooksPath)
+  const region = findManagedDshPatchRegion(text)
+  if (region) {
+    return joinPreservingTrailingNewline([
+      ...lines.slice(0, region.startLine),
+      ...block,
+      ...lines.slice(region.endLine + 1)
+    ])
+  }
+  if (isDshPatchFileUnappendable(text)) {
+    return null
+  }
+  // Why dropped: `- item` after `[]` is a parse error, and an empty sequence has nothing to
+  // preserve. Only the token goes — a trailing comment on that line stays.
+  const kept = isEmptyFlowDocument(lines)
+    ? lines.map((line) =>
+        withoutTrailingComment(line) === EMPTY_FLOW_SEQUENCE
+          ? line.slice(line.indexOf(EMPTY_FLOW_SEQUENCE) + EMPTY_FLOW_SEQUENCE.length)
+          : line
+      )
+    : lines
+  return joinPreservingTrailingNewline([...withoutTrailingBlanks(kept), ...block])
+}
+
+/** Strip Orca's managed region, restoring `[]` when nothing else is left. */
+export function removeManagedDshPatch(text: string): { text: string; changed: boolean } {
+  const region = findManagedDshPatchRegion(text)
+  if (!region) {
+    return { text, changed: false }
+  }
+  const kept = withoutTrailingBlanks(stripRegion(splitLines(text), region))
+  // Why restore `[]`: a document of comments alone is not a valid entry list, so removing
+  // Orca's block must not leave DSH a file it cannot parse.
+  const body = kept.every((line) => isBlank(line) || isComment(line))
+    ? [...kept, EMPTY_FLOW_SEQUENCE]
+    : kept
+  return { text: joinPreservingTrailingNewline(body), changed: true }
+}
diff --git a/src/main/dsh/hook-service.test.ts b/src/main/dsh/hook-service.test.ts
new file mode 100644
index 000000000000..331ecd978888
--- /dev/null
+++ b/src/main/dsh/hook-service.test.ts
@@ -0,0 +1,200 @@
+import {
+  chmodSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  rmSync,
+  statSync,
+  writeFileSync
+} from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+import { DshHookService } from './hook-service'
+import { DSH_HOOK_EVENTS } from './hook-settings'
+
+// Why: getSharedManagedScriptPath() writes under homedir()/.orca and the patch layer
+// resolves via DSH_HOME ?? ~/.dsh. Point the home env at a temp dir and clear DSH_HOME so
+// install/remove never touches the real ~/.orca or a developer's own DSH home.
+// Why both names: os.homedir() reads $HOME on POSIX and %USERPROFILE% on Windows, and this
+// file asserts the Windows script name too — setting only HOME would let a Windows run edit
+// the developer's real home.
+let home: string
+let originalHome: string | undefined
+let originalUserProfile: string | undefined
+let originalDshHome: string | undefined
+
+beforeEach(() => {
+  home = mkdtempSync(join(tmpdir(), 'orca-dsh-hook-'))
+  originalHome = process.env.HOME
+  originalUserProfile = process.env.USERPROFILE
+  originalDshHome = process.env.DSH_HOME
+  process.env.HOME = home
+  process.env.USERPROFILE = home
+  delete process.env.DSH_HOME
+})
+
+afterEach(() => {
+  if (originalHome === undefined) {
+    delete process.env.HOME
+  } else {
+    process.env.HOME = originalHome
+  }
+  if (originalUserProfile === undefined) {
+    delete process.env.USERPROFILE
+  } else {
+    process.env.USERPROFILE = originalUserProfile
+  }
+  if (originalDshHome === undefined) {
+    delete process.env.DSH_HOME
+  } else {
+    process.env.DSH_HOME = originalDshHome
+  }
+  rmSync(home, { recursive: true, force: true })
+})
+
+const configPath = (): string => join(home, '.dsh', 'cordis.patch.yml')
+const managedHooksPath = (): string => join(home, '.orca', 'agent-hooks', 'dsh-hooks.json')
+const scriptPath = (): string =>
+  join(home, '.orca', 'agent-hooks', process.platform === 'win32' ? 'dsh-hook.cmd' : 'dsh-hook.sh')
+
+function readManagedHooks(): { hooks: Record<string, unknown[]> } {
+  const parsed: { hooks: Record<string, unknown[]> } = JSON.parse(
+    readFileSync(managedHooksPath(), 'utf-8')
+  )
+  return parsed
+}
+
+describe('DshHookService', () => {
+  it('reports not_installed before install, with no DSH home on disk', () => {
+    expect(new DshHookService().getStatus().state).toBe('not_installed')
+  })
+
+  it('installs the patch block, the managed hooks file, and the script', () => {
+    const status = new DshHookService().install()
+    expect(status.state).toBe('installed')
+    expect(status.managedHooksPresent).toBe(true)
+    expect(status.configPath).toBe(configPath())
+
+    const patch = readFileSync(configPath(), 'utf-8')
+    expect(patch).toContain("name: '@deepseek-ai/dsh-hooks-claude-code'")
+    expect(patch).toContain(`configPath: '${managedHooksPath()}'`)
+
+    // Exactly the events DSH's bridge can fire — registering more would register nothing
+    // for them and leave the status permanently `partial`.
+    expect(Object.keys(readManagedHooks().hooks).sort()).toEqual([...DSH_HOOK_EVENTS].sort())
+    expect(readFileSync(scriptPath(), 'utf-8').length).toBeGreaterThan(0)
+  })
+
+  it('posts to the dsh hook route', () => {
+    new DshHookService().install()
+    expect(readFileSync(scriptPath(), 'utf-8')).toContain('/hook/dsh')
+  })
+
+  it('restores the pane identity DSH scrubs before anything reads it', () => {
+    // DSH drops env names containing KEY/TOKEN, so the script has to recover ORCA_PANE_KEY
+    // and ORCA_AGENT_LAUNCH_TOKEN from their aliases before the guard or the spool run.
+    new DshHookService().install()
+    const script = readFileSync(scriptPath(), 'utf-8')
+    const restoreAt = script.indexOf('ORCA_AGENT_PANE')
+    const guardAt = script.indexOf('ORCA_AGENT_HOOK_PORT')
+    expect(restoreAt).toBeGreaterThan(-1)
+    expect(script).toContain('ORCA_AGENT_LAUNCH')
+    expect(restoreAt).toBeLessThan(guardAt)
+  })
+
+  it('is idempotent', () => {
+    const service = new DshHookService()
+    service.install()
+    const first = readFileSync(configPath(), 'utf-8')
+    expect(service.install().state).toBe('installed')
+    expect(readFileSync(configPath(), 'utf-8')).toBe(first)
+  })
+
+  it('preserves an existing user patch layer through install and remove', () => {
+    const userRows = ['- id: llm-deepseek', '  config:', '    thinking: disabled', ''].join('\n')
+    mkdirSync(join(home, '.dsh'), { recursive: true })
+    writeFileSync(configPath(), userRows, 'utf-8')
+
+    const service = new DshHookService()
+    expect(service.install().state).toBe('installed')
+    expect(readFileSync(configPath(), 'utf-8')).toContain('thinking: disabled')
+
+    expect(service.remove().state).toBe('not_installed')
+    expect(readFileSync(configPath(), 'utf-8').trimEnd()).toBe(userRows.trimEnd())
+  })
+
+  it('removes the managed hooks file along with the block', () => {
+    const service = new DshHookService()
+    service.install()
+    service.remove()
+    expect(() => readFileSync(managedHooksPath(), 'utf-8')).toThrow()
+    expect(service.getStatus().state).toBe('not_installed')
+  })
+
+  it('reports partial when an event loses its managed hook', () => {
+    const service = new DshHookService()
+    service.install()
+    const managed = readManagedHooks()
+    delete managed.hooks.Stop
+    writeFileSync(managedHooksPath(), JSON.stringify(managed, null, 2), 'utf-8')
+
+    const status = service.getStatus()
+    expect(status.state).toBe('partial')
+    expect(status.detail).toContain('Stop')
+  })
+
+  it('reports not_installed when the block points somewhere else', () => {
+    const service = new DshHookService()
+    service.install()
+    writeFileSync(
+      configPath(),
+      readFileSync(configPath(), 'utf-8').replace(managedHooksPath(), '/somewhere/else.json'),
+      'utf-8'
+    )
+    const status = service.getStatus()
+    expect(status.state).toBe('not_installed')
+    expect(status.detail).toContain('/somewhere/else.json')
+  })
+
+  // Why POSIX-only: on Windows chmod toggles the read-only attribute, so `mode & 0o777`
+  // reads 0o666 for any writable file and the assertion cannot mean what it says.
+  it.skipIf(process.platform === 'win32')('keeps an owner-only patch file owner-only', () => {
+    // CWE-732: the temp+rename replacement must not widen the file to the umask default.
+    const userRows = '- id: llm-deepseek\n  config: {}\n'
+    mkdirSync(join(home, '.dsh'), { recursive: true })
+    writeFileSync(configPath(), userRows, 'utf-8')
+    chmodSync(configPath(), 0o600)
+
+    expect(new DshHookService().install().state).toBe('installed')
+    expect(statSync(configPath()).mode & 0o777).toBe(0o600)
+  })
+
+  it('refuses a flow-style patch file instead of corrupting it', () => {
+    // Appending a block entry after `[…]` is invalid YAML — DSH would then fail to load the
+    // user's own layer as well as Orca's hooks, so install must change nothing.
+    const flow = '[{ id: llm-deepseek }]\n'
+    mkdirSync(join(home, '.dsh'), { recursive: true })
+    writeFileSync(configPath(), flow, 'utf-8')
+
+    const service = new DshHookService()
+    const installed = service.install()
+    expect(installed.state).toBe('error')
+    expect(installed.detail).toContain('flow-style sequence')
+    expect(readFileSync(configPath(), 'utf-8')).toBe(flow)
+
+    // Why re-read: a later status poll must keep saying why, not decay to a bare
+    // `not_installed` that gives the user nothing to act on.
+    const polled = service.getStatus()
+    expect(polled.state).toBe('error')
+    expect(polled.detail).toContain('flow-style sequence')
+  })
+
+  it('honours DSH_HOME', () => {
+    const dshHome = join(home, 'custom-dsh-home')
+    process.env.DSH_HOME = dshHome
+    const status = new DshHookService().install()
+    expect(status.configPath).toBe(join(dshHome, 'cordis.patch.yml'))
+    expect(status.state).toBe('installed')
+  })
+})
diff --git a/src/main/dsh/hook-service.ts b/src/main/dsh/hook-service.ts
new file mode 100644
index 000000000000..0767f686f242
--- /dev/null
+++ b/src/main/dsh/hook-service.ts
@@ -0,0 +1,253 @@
+import { mkdirSync, readFileSync, rmSync } from 'node:fs'
+import { dirname } from 'node:path'
+import type { SFTPWrapper } from 'ssh2'
+
+import type { AgentHookInstallState, AgentHookInstallStatus } from '../../shared/agent-hook-types'
+import { isDefinitiveAbsence } from '../../shared/definitive-filesystem-absence'
+import {
+  buildWindowsAgentHookCurlPostCommand,
+  writeHooksJson,
+  writeManagedScript
+} from '../agent-hooks/installer-utils'
+import { refreshManagedScriptIfPresent } from '../agent-hooks/managed-hook-script-refresh'
+import {
+  readTextFileRemote,
+  writeManagedScriptRemote,
+  writeTextFileRemoteAtomic
+} from '../agent-hooks/installer-utils-remote'
+import {
+  buildPosixHookPayloadCapture,
+  buildPosixHookSpoolLines,
+  buildWindowsHookEnvironmentGuardLines,
+  buildWindowsHookStdinDrainEpilogue
+} from '../agent-hooks/hook-stdin-contract'
+import { buildPosixAgentHookPostCommand } from '../agent-hooks/hook-post-command'
+import {
+  applyManagedDshPatch,
+  isDshPatchFileUnappendable,
+  readManagedDshHooksConfigPath,
+  removeManagedDshPatch
+} from './dsh-home-patch'
+import {
+  buildDshManagedHooksFile,
+  DSH_HOOK_EVENTS,
+  getDshConfigPath,
+  getDshManagedCommand,
+  getDshManagedCommandMatcher,
+  getDshManagedHooksPath,
+  getDshManagedScriptPath,
+  getDshRemoteConfigPath,
+  getDshRemoteManagedCommand,
+  getDshRemoteManagedHooksPath,
+  readManagedDshHookEvents
+} from './hook-settings'
+
+function getManagedScript(target: 'local' | 'posix' = 'local'): string {
+  if (target === 'local' && process.platform === 'win32') {
+    return [
+      '@echo off',
+      'setlocal',
+      // Why: same scrub as POSIX — restore the canonical names from their aliases first.
+      'if not defined ORCA_PANE_KEY if defined ORCA_AGENT_PANE set "ORCA_PANE_KEY=%ORCA_AGENT_PANE%"',
+      'if not defined ORCA_AGENT_LAUNCH_TOKEN if defined ORCA_AGENT_LAUNCH set "ORCA_AGENT_LAUNCH_TOKEN=%ORCA_AGENT_LAUNCH%"',
+      'if defined ORCA_AGENT_HOOK_ENDPOINT if exist "%ORCA_AGENT_HOOK_ENDPOINT%" call "%ORCA_AGENT_HOOK_ENDPOINT%" 2>nul',
+      ...buildWindowsHookEnvironmentGuardLines(),
+      buildWindowsAgentHookCurlPostCommand('dsh'),
+      'exit /b 0',
+      ...buildWindowsHookStdinDrainEpilogue(),
+      ''
+    ].join('\r\n')
+  }
+
+  return [
+    '#!/bin/sh',
+    // Why first: DSH's shell executor drops every env var whose NAME contains KEY, TOKEN,
+    // SECRET or PASSWORD before the hook starts, which takes ORCA_PANE_KEY and
+    // ORCA_AGENT_LAUNCH_TOKEN with it. Orca mirrors both onto scrub-safe aliases at spawn
+    // (see agent-hook-scrub-safe-env.ts); restore the canonical names from them so every
+    // line below — including the shared spool and post builders — is unchanged.
+    ': "${ORCA_PANE_KEY:=${ORCA_AGENT_PANE:-}}"',
+    ': "${ORCA_AGENT_LAUNCH_TOKEN:=${ORCA_AGENT_LAUNCH:-}}"',
+    'export ORCA_PANE_KEY ORCA_AGENT_LAUNCH_TOKEN',
+    ...buildPosixHookPayloadCapture(),
+    ...buildPosixHookSpoolLines('dsh'),
+    // Why: the endpoint file holds the live port/token; a PTY that outlived an Orca
+    // restart carries stale env, so source it to reach the new server.
+    'if [ -n "$ORCA_AGENT_HOOK_ENDPOINT" ] && [ -r "$ORCA_AGENT_HOOK_ENDPOINT" ]; then',
+    '  . "$ORCA_AGENT_HOOK_ENDPOINT" 2>/dev/null || :',
+    'fi',
+    'if [ -z "$ORCA_AGENT_HOOK_PORT" ] || [ -z "$ORCA_AGENT_HOOK_TOKEN" ] || [ -z "$ORCA_PANE_KEY" ]; then',
+    '  spool_hook_event',
+    '  exit 0',
+    'fi',
+    ...buildPosixAgentHookPostCommand('dsh').map((line, index, lines) =>
+      index === lines.length - 1 ? `${line} >/dev/null 2>&1 || spool_hook_event` : line
+    ),
+    'exit 0',
+    ''
+  ].join('\n')
+}
+
+/** '' when the file is absent (both are created lazily), null when it exists but cannot be read. */
+function readTextOrAbsent(path: string): string | null {
+  try {
+    return readFileSync(path, 'utf-8')
+  } catch (error) {
+    return isDefinitiveAbsence(error) ? '' : null
+  }
+}
+
+/** null for anything that is not parseable JSON; the caller reads that as "no events". */
+function parseJsonOrNull(text: string): unknown {
+  try {
+    return JSON.parse(text)
+  } catch {
+    return null
+  }
+}
+
+function writePatchText(configPath: string, text: string): void {
+  mkdirSync(dirname(configPath), { recursive: true })
+  // Why writeHooksJson: it owns the temp+rename and the rolling .bak this file needs too.
+  // Why preserveMode: an owner-only patch file must not widen to the umask default on rewrite.
+  writeHooksJson(configPath, {}, { serialized: text, preserveMode: true })
+}
+
+/** Why one constant: status has to say exactly what install said, on every later read. */
+const FLOW_STYLE_DETAIL =
+  'The DSH home patch is a flow-style sequence ([…]); rewrite it as a block sequence (one `- ` entry per line) so Orca can add its hooks without breaking it'
+
+function status(
+  configPath: string,
+  state: AgentHookInstallState,
+  detail: string | null,
+  managedHooksPresent = false
+): AgentHookInstallStatus {
+  return { agent: 'dsh', state, configPath, managedHooksPresent, detail }
+}
+
+function buildStatus(
+  patchText: string,
+  managedHooksPath: string,
+  managedText: string | null,
+  configPath: string
+): AgentHookInstallStatus {
+  if (managedText === null) {
+    return status(configPath, 'error', 'Could not read Orca managed hooks file')
+  }
+  // Why before the pointer check: a refused file carries no managed region, so the pointer
+  // path would report a bare `not_installed` and drop the one detail that says why.
+  if (isDshPatchFileUnappendable(patchText)) {
+    return status(configPath, 'error', FLOW_STYLE_DETAIL)
+  }
+  const pointer = readManagedDshHooksConfigPath(patchText)
+  if (pointer !== managedHooksPath) {
+    return status(
+      configPath,
+      'not_installed',
+      pointer === undefined
+        ? null
+        : `The Orca patch block points at ${pointer}, not the Orca managed hooks file`
+    )
+  }
+  const present = readManagedDshHookEvents(
+    parseJsonOrNull(managedText),
+    getDshManagedCommandMatcher()
+  )
+  const missing = DSH_HOOK_EVENTS.filter((event) => !present.has(event))
+  if (missing.length === 0) {
+    return status(configPath, 'installed', null, true)
+  }
+  // Why the split: nothing present is an uninstalled agent; some present is a broken install,
+  // and naming the gap is the only way a user can tell those apart.
+  return present.size === 0
+    ? status(configPath, 'not_installed', null)
+    : status(configPath, 'partial', `Managed hook missing for events: ${missing.join(', ')}`, true)
+}
+
+/** Installs Orca's status hooks into DSH. See `docs/reference/dsh-harness-integration.md`
+ *  for the profile/patch-layer model and the env-scrub finding the aliases work around. */
+export class DshHookService {
+  async refreshManagedScripts(): Promise<void> {
+    await refreshManagedScriptIfPresent(getDshManagedScriptPath(), getManagedScript())
+  }
+
+  getStatus(): AgentHookInstallStatus {
+    const configPath = getDshConfigPath()
+    const patchText = readTextOrAbsent(configPath)
+    if (patchText === null) {
+      return status(configPath, 'error', 'Could not read the DSH home patch file')
+    }
+    const managedHooksPath = getDshManagedHooksPath()
+    return buildStatus(patchText, managedHooksPath, readTextOrAbsent(managedHooksPath), configPath)
+  }
+
+  install(): AgentHookInstallStatus {
+    const configPath = getDshConfigPath()
+    const patchText = readTextOrAbsent(configPath)
+    if (patchText === null) {
+      return status(configPath, 'error', 'Could not read the DSH home patch file')
+    }
+    const scriptPath = getDshManagedScriptPath()
+    const managedHooksPath = getDshManagedHooksPath()
+    // Write the script and the managed hooks file first so the patch layer never points at
+    // files that do not exist yet — a bridge that cannot read its config runs no hooks.
+    writeManagedScript(scriptPath, getManagedScript())
+    writeHooksJson(
+      managedHooksPath,
+      { hooks: {} },
+      { serialized: buildDshManagedHooksFile(getDshManagedCommand(scriptPath)) }
+    )
+    const nextText = applyManagedDshPatch(patchText, managedHooksPath)
+    if (nextText === null) {
+      // Why refuse rather than edit: YAML forbids a block entry after a flow sequence, so
+      // appending here would leave DSH unable to parse the user's own patch layer either.
+      return status(configPath, 'error', FLOW_STYLE_DETAIL)
+    }
+    if (nextText !== patchText) {
+      writePatchText(configPath, nextText)
+    }
+    return this.getStatus()
+  }
+
+  /** Install on an SSH execution host, where DSH's shell contract is always POSIX. */
+  async installRemote(sftp: SFTPWrapper, remoteHome: string): Promise<AgentHookInstallStatus> {
+    const remoteConfigPath = getDshRemoteConfigPath(remoteHome)
+    const remoteScriptPath = `${remoteHome.replace(/\/$/, '')}/.orca/agent-hooks/dsh-hook.sh`
+    const remoteManagedHooksPath = getDshRemoteManagedHooksPath(remoteHome)
+    try {
+      const body = (await readTextFileRemote(sftp, remoteConfigPath)) ?? ''
+      await writeManagedScriptRemote(sftp, remoteScriptPath, getManagedScript('posix'))
+      await writeTextFileRemoteAtomic(
+        sftp,
+        remoteManagedHooksPath,
+        buildDshManagedHooksFile(getDshRemoteManagedCommand(remoteScriptPath))
+      )
+      const nextText = applyManagedDshPatch(body, remoteManagedHooksPath)
+      if (nextText === null) {
+        return status(remoteConfigPath, 'error', FLOW_STYLE_DETAIL)
+      }
+      await writeTextFileRemoteAtomic(sftp, remoteConfigPath, nextText)
+      return status(remoteConfigPath, 'installed', null, true)
+    } catch (err) {
+      return status(remoteConfigPath, 'error', err instanceof Error ? err.message : String(err))
+    }
+  }
+
+  remove(): AgentHookInstallStatus {
+    const configPath = getDshConfigPath()
+    const patchText = readTextOrAbsent(configPath)
+    if (patchText === null) {
+      return status(configPath, 'error', 'Could not read the DSH home patch file')
+    }
+    const { text: nextText, changed } = removeManagedDshPatch(patchText)
+    if (changed) {
+      writePatchText(configPath, nextText)
+    }
+    // Why force: the file is Orca's own and may already be gone; its absence is the goal.
+    rmSync(getDshManagedHooksPath(), { force: true })
+    return this.getStatus()
+  }
+}
+
+export const dshHookService = new DshHookService()
diff --git a/src/main/dsh/hook-settings.ts b/src/main/dsh/hook-settings.ts
new file mode 100644
index 000000000000..8ccbb8a92832
--- /dev/null
+++ b/src/main/dsh/hook-settings.ts
@@ -0,0 +1,110 @@
+import { homedir } from 'node:os'
+import { join, posix as pathPosix } from 'node:path'
+import {
+  buildManagedCommandHook,
+  createManagedCommandMatcher,
+  getSharedManagedScriptPath,
+  wrapPosixHookCommand,
+  wrapWindowsHookCommand,
+  type HookDefinition
+} from '../agent-hooks/installer-utils'
+import { readManagedHookEventsFromJson } from '../agent-hooks/managed-hooks-json-events'
+
+const DSH_SCRIPT_BASE = 'dsh-hook'
+
+/**
+ * The events DeepSeek Harness's own Claude-Code hook bridge
+ * (`@deepseek-ai/dsh-hooks-claude-code`) can fire. This is a strict subset of Claude's:
+ * the bridge documents no `Notification`, no `PermissionRequest` and no `SessionEnd`,
+ * and registering an unsupported event name makes it register nothing for that event.
+ * `normalizeDshEvent` is written against exactly this list.
+ */
+export const DSH_HOOK_EVENTS = [
+  'SessionStart',
+  'UserPromptSubmit',
+  'PreToolUse',
+  'PostToolUse',
+  'Stop'
+] as const
+
+export const DSH_MANAGED_HOOKS_FILE_NAME = 'dsh-hooks.json'
+
+/** `$DSH_HOME`, matching the launcher's own `DSH_HOME ?? ~/.dsh` resolution. */
+export function getDshHome(): string {
+  return process.env.DSH_HOME?.trim() || join(homedir(), '.dsh')
+}
+
+/**
+ * The home-level patch layer.
+ *
+ * Why here and not in a profile: DSH composes every profile as bundle patches, then the
+ * profile's own `cordis.patch.yml`, then this file. Installing one layer above every
+ * profile means a pane the user started themselves — any profile, including one Orca
+ * never launched — still reports status, and Orca never edits a profile the user owns.
+ */
+export function getDshConfigPath(): string {
+  return join(getDshHome(), 'cordis.patch.yml')
+}
+
+export function getDshRemoteConfigPath(remoteHome: string): string {
+  // Why: a remote $DSH_HOME is unknown over SFTP; default matches the launcher's own resolution.
+  return pathPosix.join(remoteHome.replace(/\/$/, ''), '.dsh', 'cordis.patch.yml')
+}
+
+export function getDshManagedScriptFileName(): string {
+  return process.platform === 'win32' ? `${DSH_SCRIPT_BASE}.cmd` : `${DSH_SCRIPT_BASE}.sh`
+}
+
+export function getDshManagedScriptPath(): string {
+  return getSharedManagedScriptPath(getDshManagedScriptFileName())
+}
+
+export function getDshManagedHooksPath(): string {
+  return getSharedManagedScriptPath(DSH_MANAGED_HOOKS_FILE_NAME)
+}
+
+export function getDshRemoteManagedHooksPath(remoteHome: string): string {
+  return pathPosix.join(
+    remoteHome.replace(/\/$/, ''),
+    '.orca',
+    'agent-hooks',
+    DSH_MANAGED_HOOKS_FILE_NAME
+  )
+}
+
+export function getDshManagedCommand(scriptPath: string): string {
+  // Why: DSH runs hooks through `ctx.shell`, which the base profile binds to bash
+  // everywhere except Windows, where it binds to PowerShell — the same split these two
+  // wrappers already encode.
+  return process.platform === 'win32'
+    ? wrapWindowsHookCommand(scriptPath)
+    : wrapPosixHookCommand(scriptPath)
+}
+
+export function getDshRemoteManagedCommand(scriptPath: string): string {
+  return wrapPosixHookCommand(scriptPath)
+}
+
+export function getDshManagedCommandMatcher(): (command: string | undefined) => boolean {
+  return createManagedCommandMatcher(getDshManagedScriptFileName())
+}
+
+/**
+ * The managed hooks file is Orca's outright: DSH has no user-owned `hooks.json`
+ * convention of its own, and the bridge reads whatever single path it is pointed at. So
+ * generate it wholesale rather than merging into someone's file.
+ */
+export function buildDshManagedHooksFile(command: string): string {
+  const hooks: Record<string, HookDefinition[]> = {}
+  for (const event of DSH_HOOK_EVENTS) {
+    hooks[event] = [{ hooks: [buildManagedCommandHook(command)] }]
+  }
+  return `${JSON.stringify({ hooks }, null, 2)}\n`
+}
+
+export function readManagedDshHookEvents(
+  parsed: unknown,
+  isManagedCommand: (command: string | undefined) => boolean
+): Set<string> {
+  return readManagedHookEventsFromJson(parsed, DSH_HOOK_EVENTS, isManagedCommand)
+}
diff --git a/src/main/durable-file-write-syscall-proof.test.ts b/src/main/durable-file-write-syscall-proof.test.ts
index bf18d6c00928..34563b0196ad 100644
--- a/src/main/durable-file-write-syscall-proof.test.ts
+++ b/src/main/durable-file-write-syscall-proof.test.ts
@@ -1,6 +1,15 @@
 // Empirical proof that the durable write fsyncs the file, and the directory where the platform
 // allows it. Counted at the module boundary rather than inferred from reading the implementation.
-import { closeSync, fsyncSync, mkdtempSync, openSync, readFileSync, rmSync } from 'node:fs'
+import {
+  closeSync,
+  existsSync,
+  fsyncSync,
+  mkdtempSync,
+  openSync,
+  readFileSync,
+  rmSync,
+  writeFileSync
+} from 'node:fs'
 import type * as NodeFs from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
@@ -9,23 +18,57 @@ import { expect, it, vi } from 'vitest'
 /** Why the rename is recorded too: an fsync moved after the rename still fsyncs a file, so a
  *  fsync-only log reads identically for the correct and the broken order. The rename is the boundary
  *  the ordering is defined against, so it has to appear in the same sequence. */
-const syscalls: ('fsync:file' | 'fsync:directory' | 'rename')[] = []
+const syscalls: ('fsync:file' | 'fsync:directory' | 'rename' | 'link')[] = []
 
 vi.mock('node:fs', async () => {
   const actual = await vi.importActual<typeof NodeFs>('node:fs')
   return {
     ...actual,
     fsyncSync: (fd: number) => {
+      actual.fsyncSync(fd)
       syscalls.push(actual.fstatSync(fd).isDirectory() ? 'fsync:directory' : 'fsync:file')
-      return actual.fsyncSync(fd)
     },
     renameSync: (from: NodeFs.PathLike, to: NodeFs.PathLike) => {
+      actual.renameSync(from, to)
       syscalls.push('rename')
-      return actual.renameSync(from, to)
+    },
+    linkSync: (from: NodeFs.PathLike, to: NodeFs.PathLike) => {
+      actual.linkSync(from, to)
+      syscalls.push('link')
     }
   }
 })
 
+it('publishes a new file durably and cannot replace an existing destination', async () => {
+  const { publishFileDurableSync } = await import('./durable-file-write')
+  const dir = mkdtempSync(join(tmpdir(), 'orca-publish-fsync-'))
+  try {
+    const supported = directoryFsyncSupported(dir)
+    const staged = join(dir, 'staged')
+    const target = join(dir, 'target')
+    writeFileSync(staged, 'first')
+    const fd = openSync(staged, 'r+')
+    try {
+      fsyncSync(fd)
+    } finally {
+      closeSync(fd)
+    }
+    syscalls.length = 0
+    expect(publishFileDurableSync(staged, target)).toBe(true)
+    expect(syscalls).toEqual(supported ? ['link', 'fsync:directory'] : ['link'])
+    expect(existsSync(staged)).toBe(false)
+    expect(readFileSync(target, 'utf8')).toBe('first')
+    writeFileSync(staged, 'second')
+    syscalls.length = 0
+    expect(publishFileDurableSync(staged, target)).toBe(false)
+    expect(readFileSync(target, 'utf8')).toBe('first')
+    expect(readFileSync(staged, 'utf8')).toBe('second')
+    expect(syscalls).toEqual([])
+  } finally {
+    rmSync(dir, { recursive: true, force: true })
+  }
+})
+
 /** Windows cannot open a directory for fsync, and some filesystems reject it; probe rather than
  *  assume, so the expectation tracks the real platform instead of a hardcoded OS list. */
 function directoryFsyncSupported(directory: string): boolean {
diff --git a/src/main/durable-file-write.ts b/src/main/durable-file-write.ts
index 83b0eabc5ed7..05e849327b7f 100644
--- a/src/main/durable-file-write.ts
+++ b/src/main/durable-file-write.ts
@@ -4,9 +4,13 @@
 // hour's loss; fsync stops it from happening.
 
 import { closeSync, fsyncSync, openSync, rmSync, writeFileSync } from 'node:fs'
-import { copyFile, open, readdir, rename, rm, stat } from 'node:fs/promises'
+import { copyFile, open, readdir, rm, stat } from 'node:fs/promises'
 import { basename, dirname, join } from 'node:path'
-import { renameFileWithWindowsRetry } from './codex-accounts/fs-utils'
+import {
+  publishFileWithoutOverwrite,
+  renameFileWithWindowsRetry,
+  renameFileWithWindowsRetryAsync
+} from './codex-accounts/fs-utils'
 
 /**
  * fsync a directory so a rename within it is durable. Best-effort by design: Windows cannot open a
@@ -43,12 +47,28 @@ function syncDirectorySync(directory: string): void {
   }
 }
 
+/** Rename an already-fsynced file and make the containing directory durable. */
+export function renameDurableSync(tmpPath: string, finalPath: string): void {
+  renameFileWithWindowsRetry(tmpPath, finalPath)
+  syncDirectorySync(dirname(finalPath))
+}
+
+/** Publish an already-fsynced file without replacing a concurrently created destination. */
+export function publishFileDurableSync(tmpPath: string, finalPath: string): boolean {
+  if (!publishFileWithoutOverwrite(tmpPath, finalPath)) {
+    return false
+  }
+  syncDirectorySync(dirname(finalPath))
+  rmSync(tmpPath)
+  return true
+}
+
 /**
  * Rename and then fsync the containing directory. For callers that already fsynced the temp file
  * themselves and need the rename made durable.
  */
 export async function renameDurable(tmpPath: string, finalPath: string): Promise<void> {
-  await rename(tmpPath, finalPath)
+  await renameFileWithWindowsRetryAsync(tmpPath, finalPath)
   await syncDirectory(dirname(finalPath))
 }
 
@@ -96,7 +116,7 @@ export async function copyFileDurable(sourcePath: string, finalPath: string): Pr
     } finally {
       await handle.close()
     }
-    await rename(tmpPath, finalPath)
+    await renameFileWithWindowsRetryAsync(tmpPath, finalPath)
     renamed = true
     await syncDirectory(dirname(finalPath))
     return true
@@ -132,10 +152,9 @@ export async function writeFileDurableIfCurrent(
   try {
     // Why: fsync BEFORE rename. A rename that lands first can expose a zero-length file.
     await writeTempFileDurable(tmpPath, payload)
-    if (!isCurrent()) {
+    if (!(await renameFileWithWindowsRetryAsync(tmpPath, finalPath, isCurrent))) {
       return false
     }
-    await rename(tmpPath, finalPath)
     renamed = true
     await syncDirectory(dirname(finalPath))
     return true
@@ -202,9 +221,8 @@ export function writeFileDurableSync(
     } finally {
       closeSync(fd)
     }
-    renameFileWithWindowsRetry(tmpPath, finalPath)
+    renameDurableSync(tmpPath, finalPath)
     renamed = true
-    syncDirectorySync(dirname(finalPath))
   } finally {
     if (!renamed) {
       rmSync(tmpPath, { force: true })
diff --git a/src/main/git-bash.test.ts b/src/main/git-bash.test.ts
index 367c07cbe54f..bd4633b019ff 100644
--- a/src/main/git-bash.test.ts
+++ b/src/main/git-bash.test.ts
@@ -169,4 +169,66 @@ describe('Git Bash path discovery', () => {
     )
     expect(isGitForWindowsBashLauncherPath('bash.exe')).toBe(false)
   })
+
+  it('identifies a launcher in an install folder named anything else', () => {
+    // Layout confirmed against a real Git 2.x install: bin, cmd, mingw64, usr, git-bash.exe.
+    const renamedInstall = (path: string): boolean =>
+      [
+        'C:\\Tools\\Git-2.55\\bin\\bash.exe',
+        'C:\\Tools\\Git-2.55\\usr\\bin\\bash.exe',
+        'C:\\Tools\\Git-2.55\\cmd\\git.exe',
+        'C:\\Tools\\Git-2.55\\git-bash.exe'
+      ].includes(path)
+    expect(
+      isGitForWindowsBashLauncherPath('C:\\Tools\\Git-2.55\\bin\\bash.exe', {
+        exists: renamedInstall
+      })
+    ).toBe(true)
+    expect(
+      isGitForWindowsBashLauncherPath('C:\\Users\\a\\scoop\\apps\\git\\current\\bin\\bash.exe', {
+        exists: (path) => path.startsWith('C:\\Users\\a\\scoop\\apps\\git\\current\\')
+      })
+    ).toBe(true)
+  })
+
+  // Each marker is individually necessary, so dropping one from the predicate cannot stay green.
+  it.each([
+    ['usr\\bin\\bash.exe', 'C:\\Tools\\Git-2.55\\usr\\bin\\bash.exe'],
+    ['cmd\\git.exe', 'C:\\Tools\\Git-2.55\\cmd\\git.exe'],
+    ['git-bash.exe', 'C:\\Tools\\Git-2.55\\git-bash.exe']
+  ])('refuses a renamed install root missing only %s', (_label, missingMarker) => {
+    expect(
+      isGitForWindowsBashLauncherPath('C:\\Tools\\Git-2.55\\bin\\bash.exe', {
+        exists: (path) => path !== missingMarker
+      })
+    ).toBe(false)
+  })
+
+  it('refuses a bash that is not a Git for Windows launcher, even where every path exists', () => {
+    const everythingExists = (): boolean => true
+    // A directly launched MSYS bash: no install root sits inside `usr`, so the markers cannot be met.
+    expect(
+      isGitForWindowsBashLauncherPath('C:\\Program Files\\Git\\usr\\bin\\bash.exe', {
+        exists: (path) => !path.includes('\\usr\\usr\\') && !path.includes('\\usr\\cmd\\')
+      })
+    ).toBe(false)
+    // Observed on a real Cygwin root: none of the three markers is present, nor bin\bash.exe itself.
+    const observedCygwinRoot = ['C:\\cygwin64\\etc', 'C:\\cygwin64\\var']
+    expect(
+      isGitForWindowsBashLauncherPath('C:\\cygwin64\\bin\\bash.exe', {
+        exists: (path) => observedCygwinRoot.includes(path)
+      })
+    ).toBe(false)
+    // A Cygwin root carrying a bash at both marker positions is still refused: `git-bash.exe` is Git
+    // for Windows' own launcher, and no Cygwin package installs one.
+    expect(
+      isGitForWindowsBashLauncherPath('C:\\cygwin64\\bin\\bash.exe', {
+        exists: (path) => path.endsWith('bin\\bash.exe') || path.endsWith('cmd\\git.exe')
+      })
+    ).toBe(false)
+    expect(
+      isGitForWindowsBashLauncherPath('C:\\Tools\\sh\\bash.exe', { exists: everythingExists })
+    ).toBe(false)
+    expect(isGitForWindowsBashLauncherPath('bash.exe', { exists: everythingExists })).toBe(false)
+  })
 })
diff --git a/src/main/git-bash.ts b/src/main/git-bash.ts
index 40866325ae74..a57edcaee4d0 100644
--- a/src/main/git-bash.ts
+++ b/src/main/git-bash.ts
@@ -114,10 +114,46 @@ export function isGitForWindowsBashPath(shellPath: string): boolean {
   return /(?:^|\\)(?:git|portablegit)(?:\\usr)?\\bin\\bash\.exe$/.test(normalized)
 }
 
-/** Git for Windows' `bin\bash.exe` is a launcher: it runs `..\usr\bin\bash.exe` as a child and waits. */
-export function isGitForWindowsBashLauncherPath(shellPath: string): boolean {
-  return /(?:^|\\)(?:git|portablegit)\\bin\\bash\.exe$/.test(
-    pathWin32.normalize(shellPath).toLowerCase()
+/**
+ * Files only a Git for Windows install root carries. `usr\bin\bash.exe` is the launcher's own
+ * hand-off target, and the other two separate that root from a Cygwin or MSYS2 one: neither ships a
+ * `cmd\` directory, and `git-bash.exe` is Git for Windows' own launcher rather than an upstream git
+ * binary, so no Cygwin package can put it here. All three confirmed present on a real Git 2.x
+ * install and absent from a real Cygwin root.
+ */
+const GIT_FOR_WINDOWS_ROOT_MARKERS = [
+  ['usr', 'bin', 'bash.exe'],
+  ['cmd', 'git.exe'],
+  ['git-bash.exe']
+] as const
+
+/**
+ * Git for Windows' `bin\bash.exe` is a launcher: it runs `..\usr\bin\bash.exe` as a child and waits.
+ *
+ * The installer's folder is named `Git`, but a user-chosen install directory, an unzipped
+ * PortableGit, and Scoop's `apps\git\current` are equally real, so a folder this does not recognize
+ * falls back to the install layout instead of denying the hand-off.
+ */
+export function isGitForWindowsBashLauncherPath(
+  shellPath: string,
+  options: Pick<GitBashPathOptions, 'exists'> = {}
+): boolean {
+  const normalized = pathWin32.normalize(shellPath)
+  if (/(?:^|\\)(?:git|portablegit)\\bin\\bash\.exe$/.test(normalized.toLowerCase())) {
+    return true
+  }
+  const binDirectory = pathWin32.dirname(normalized)
+  if (
+    pathWin32.basename(normalized).toLowerCase() !== 'bash.exe' ||
+    pathWin32.basename(binDirectory).toLowerCase() !== 'bin'
+  ) {
+    return false
+  }
+  // `usr\bin\bash.exe` lands here too, and is refused because no install root sits inside `usr`.
+  const installRoot = pathWin32.dirname(binDirectory)
+  const exists = options.exists ?? existsSync
+  return GIT_FOR_WINDOWS_ROOT_MARKERS.every((marker) =>
+    exists(pathWin32.join(installRoot, ...marker))
   )
 }
 
diff --git a/src/main/git/worktree-create-preparation-real-git.test.ts b/src/main/git/worktree-create-preparation-real-git.test.ts
index 19c023a24032..08795fcab1f7 100644
--- a/src/main/git/worktree-create-preparation-real-git.test.ts
+++ b/src/main/git/worktree-create-preparation-real-git.test.ts
@@ -55,6 +55,137 @@ afterEach(async () => {
 })
 
 describe('prepared worktree creation with real Git', () => {
+  it.each([false, true])(
+    'attaches the prepared HEAD and runs the hook (base advanced: %s)',
+    async (advanceBase) => {
+      const { repoPath, root } = await createRepo()
+      const preparedPath = join(root, 'prepared checkout')
+      const finalPath = join(root, 'final checkout')
+      const hooksPath = join(root, 'hooks')
+      await mkdir(hooksPath)
+      await writeFile(
+        join(hooksPath, 'post-checkout'),
+        '#!/bin/sh\nprintf \'%s\\n\' "$@" >> checkout-hook.txt\ngit symbolic-ref --short HEAD >> checkout-hook.txt\n',
+        { mode: 0o755 }
+      )
+      git(repoPath, ['config', 'core.hooksPath', hooksPath])
+      git(repoPath, ['config', 'branch.autoSetupMerge', 'always'])
+      await prepareWorktreeCreateCheckout(
+        repoPath,
+        preparedPath,
+        'main',
+        createWorktreePreparationLockReason('attach-with-hook')
+      )
+      expect(existsSync(join(preparedPath, 'checkout-hook.txt'))).toBe(false)
+      if (advanceBase) {
+        await writeFile(join(repoPath, 'version.txt'), 'advanced\n')
+        git(repoPath, ['commit', '--quiet', '-am', 'advance base'])
+      }
+      const targetHead = git(repoPath, ['rev-parse', 'HEAD'])
+      await finalizePreparedWorktree(repoPath, preparedPath, finalPath, 'feature/attached', 'main')
+
+      expect(git(finalPath, ['rev-parse', 'HEAD'])).toBe(targetHead)
+      expect(git(finalPath, ['symbolic-ref', '--short', 'HEAD'])).toBe('feature/attached')
+      expect(
+        git(finalPath, ['for-each-ref', '--format=%(upstream)', 'refs/heads/feature/attached'])
+      ).toBe('')
+      expect(await readFile(join(finalPath, 'checkout-hook.txt'), 'utf8')).toBe(
+        `${targetHead}\n${targetHead}\n1\nfeature/attached\n`
+      )
+      await rm(join(finalPath, 'checkout-hook.txt'))
+      expect(await readFile(join(finalPath, 'version.txt'), 'utf8')).toBe(
+        advanceBase ? 'advanced\n' : 'one\n'
+      )
+      expect(git(finalPath, ['status', '--porcelain'])).toBe('')
+    }
+  )
+
+  it('never publishes a branch at a HEAD changed before attachment', async () => {
+    const { repoPath, root } = await createRepo()
+    const preparedPath = join(root, 'prepared-race')
+    const finalPath = join(root, 'final-race')
+    await prepareWorktreeCreateCheckout(
+      repoPath,
+      preparedPath,
+      'main',
+      createWorktreePreparationLockReason('head-race')
+    )
+    const expectedHead = git(repoPath, ['rev-parse', 'HEAD'])
+    git(repoPath, ['checkout', '--quiet', '-b', 'other'])
+    await writeFile(join(repoPath, 'version.txt'), 'other\n')
+    git(repoPath, ['commit', '--quiet', '-am', 'other commit'])
+    const otherHead = git(repoPath, ['rev-parse', 'HEAD'])
+    git(repoPath, ['checkout', '--quiet', 'main'])
+
+    const original = gitRunner.gitExecFileAsync
+    const spy = vi.spyOn(gitRunner, 'gitExecFileAsync').mockImplementation((args, options) => {
+      if (args.includes('checkout') || args.includes('switch')) {
+        git(finalPath, ['reset', '--hard', otherHead])
+      }
+      return original(args, options)
+    })
+    try {
+      await finalizePreparedWorktree(repoPath, preparedPath, finalPath, 'feature/race', 'main')
+    } finally {
+      spy.mockRestore()
+    }
+    expect(git(repoPath, ['rev-parse', 'main'])).toBe(expectedHead)
+    expect(git(finalPath, ['rev-parse', 'HEAD'])).toBe(expectedHead)
+    expect(git(finalPath, ['symbolic-ref', '--short', 'HEAD'])).toBe('feature/race')
+    expect(await readFile(join(finalPath, 'version.txt'), 'utf8')).toBe('one\n')
+  })
+
+  it('accepts a commit made by the post-checkout hook during attachment', async () => {
+    const { repoPath, root } = await createRepo()
+    const preparedPath = join(root, 'prepared-hook-commit')
+    const finalPath = join(root, 'final-hook-commit')
+    const hooksPath = join(root, 'hooks')
+    await mkdir(hooksPath)
+    await writeFile(
+      join(hooksPath, 'post-checkout'),
+      '#!/bin/sh\nprintf "invoked\\n" >> hook-invocations.txt\ngit add hook-invocations.txt\ngit commit --quiet -m "hook commit"\n',
+      { mode: 0o755 }
+    )
+    git(repoPath, ['config', 'core.hooksPath', hooksPath])
+    await prepareWorktreeCreateCheckout(
+      repoPath,
+      preparedPath,
+      'main',
+      createWorktreePreparationLockReason('hook-commit')
+    )
+    const baseHead = git(repoPath, ['rev-parse', 'HEAD'])
+
+    await finalizePreparedWorktree(repoPath, preparedPath, finalPath, 'feature/hook-commit', 'main')
+
+    expect(git(finalPath, ['symbolic-ref', '--short', 'HEAD'])).toBe('feature/hook-commit')
+    expect(git(finalPath, ['rev-parse', 'HEAD^'])).toBe(baseHead)
+    expect(git(finalPath, ['show', '-s', '--format=%s', 'HEAD'])).toBe('hook commit')
+    expect(await readFile(join(finalPath, 'hook-invocations.txt'), 'utf8')).toBe('invoked\n')
+    expect(git(finalPath, ['status', '--porcelain'])).toBe('')
+  })
+
+  it('cleans up a branch when post-checkout rejects the attachment', async () => {
+    const { repoPath, root } = await createRepo()
+    const preparedPath = join(root, 'prepared-hook-failure')
+    const finalPath = join(root, 'final-hook-failure')
+    const hooksPath = join(root, 'hooks')
+    await mkdir(hooksPath)
+    await writeFile(join(hooksPath, 'post-checkout'), '#!/bin/sh\nexit 1\n', { mode: 0o755 })
+    git(repoPath, ['config', 'core.hooksPath', hooksPath])
+    await prepareWorktreeCreateCheckout(
+      repoPath,
+      preparedPath,
+      'main',
+      createWorktreePreparationLockReason('hook-failure')
+    )
+
+    await expect(
+      finalizePreparedWorktree(repoPath, preparedPath, finalPath, 'feature/hook-failure', 'main')
+    ).rejects.toThrow()
+    expect(existsSync(finalPath)).toBe(false)
+    expect(git(repoPath, ['branch', '--list', 'feature/hook-failure'])).toBe('')
+  })
+
   it('retains preparation ownership when the removal command cannot start', async () => {
     const fixture = await createRepo()
     const repoPath = await realpath(fixture.repoPath)
@@ -65,7 +196,7 @@ describe('prepared worktree creation with real Git', () => {
     await prepareWorktreeCreateCheckout(repoPath, preparedPath, 'main', lockReason)
     const original = gitRunner.gitExecFileAsync
     const spy = vi.spyOn(gitRunner, 'gitExecFileAsync').mockImplementation((args, options) => {
-      if (args.includes('remove') && args.includes(preparedPath)) {
+      if (args.includes('remove') && args.some((arg) => areWorktreePathsEqual(arg, preparedPath))) {
         return Promise.reject(new Error('injected removal launch failure'))
       }
       return original(args, options)
@@ -113,7 +244,7 @@ describe('prepared worktree creation with real Git', () => {
     const spy = vi
       .spyOn(gitRunner, 'gitExecFileAsync')
       .mockImplementation(async (args, options) => {
-        if (args.includes('remove') && args.includes(stalePath)) {
+        if (args.includes('remove') && args.some((arg) => areWorktreePathsEqual(arg, stalePath))) {
           markRemovalStarted()
           await removalGate
         }
@@ -145,7 +276,8 @@ describe('prepared worktree creation with real Git', () => {
       expect(existsSync(stalePath)).toBe(false)
       const remaining = await listWorktrees(repoPath, { includeCreatePreparations: true })
       expect(remaining).toHaveLength(2)
-      expect(remaining.map((w) => w.path)).toEqual(expect.arrayContaining([repoPath, finalPath]))
+      expect(remaining.some((w) => areWorktreePathsEqual(w.path, repoPath))).toBe(true)
+      expect(remaining.some((w) => areWorktreePathsEqual(w.path, finalPath))).toBe(true)
       expect(hasPendingStalePreparationCleanup()).toBe(false)
     } finally {
       releaseRemoval()
diff --git a/src/main/gitea/client-scan-invalidation.test.ts b/src/main/gitea/client-scan-invalidation.test.ts
new file mode 100644
index 000000000000..b93bf4e18247
--- /dev/null
+++ b/src/main/gitea/client-scan-invalidation.test.ts
@@ -0,0 +1,169 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+vi.mock('../git/runner', () => ({
+  gitExecFileAsync: vi.fn(async () => ({
+    stdout: 'https://git.example.com/team/repo.git\n',
+    stderr: ''
+  }))
+}))
+vi.mock('../providers/ssh-git-dispatch', () => ({
+  getSSHGitProvider: vi.fn(() => undefined),
+  getSSHGitProviderGeneration: () => 0
+}))
+vi.mock('../source-control/pull-request-template', () => ({
+  readHostedPullRequestTemplate: vi.fn(async () => '')
+}))
+
+import {
+  getGiteaPullRequestForBranch,
+  getGiteaPullRequestForBranchOrThrow,
+  getGiteaRepoSlug,
+  invalidateGiteaPullRequestScanForRepo
+} from './client'
+import { createGiteaPullRequest } from './pull-request-creation'
+import { _resetGiteaRepoRefCache } from './repository-ref'
+import { _resetGiteaPullRequestScanCache } from './pull-request-scan-cache'
+
+const branch = 'feature/gitea'
+const pullRequest = {
+  number: 7,
+  title: 'Add Gitea',
+  state: 'open',
+  html_url: 'https://git.example.com/team/repo/pulls/7',
+  head: { ref: branch }
+}
+
+function createReview() {
+  return createGiteaPullRequest(
+    '/repo',
+    { provider: 'gitea', base: 'main', head: branch, title: 'Add Gitea', body: '' },
+    'local'
+  )
+}
+
+describe('Gitea scan invalidation after creation', () => {
+  beforeEach(() => {
+    vi.stubEnv('ORCA_GITEA_TOKEN', 'test-token')
+    vi.stubEnv('ORCA_GITEA_API_BASE_URL', '')
+    _resetGiteaRepoRefCache()
+    _resetGiteaPullRequestScanCache()
+  })
+
+  afterEach(() => {
+    _resetGiteaRepoRefCache()
+    _resetGiteaPullRequestScanCache()
+    vi.unstubAllGlobals()
+    vi.unstubAllEnvs()
+  })
+
+  it('refreshes cached misses in both modes after a successful create and coalesces readers', async () => {
+    let created = false
+    let listCalls = 0
+    let createCalls = 0
+    vi.stubGlobal(
+      'fetch',
+      vi.fn(async (url: URL, init?: RequestInit) => {
+        expect(url.pathname).toBe('/api/v1/repos/team/repo/pulls')
+        if (init?.method === 'POST') {
+          createCalls++
+          created = true
+          return Response.json(pullRequest)
+        }
+        listCalls++
+        return Response.json(created ? [pullRequest] : [])
+      })
+    )
+
+    expect(await getGiteaPullRequestForBranch('/repo', branch)).toBeNull()
+    expect(await getGiteaPullRequestForBranchOrThrow('/repo', branch)).toBeNull()
+    expect(listCalls).toBe(2)
+    expect(await createReview()).toMatchObject({ ok: true, number: 7 })
+
+    const refreshed = await Promise.all([
+      getGiteaPullRequestForBranchOrThrow('/repo', branch),
+      getGiteaPullRequestForBranchOrThrow('/repo', branch),
+      getGiteaPullRequestForBranch('/repo', branch),
+      getGiteaPullRequestForBranch('/repo', branch)
+    ])
+    expect(refreshed.map((review) => review?.number)).toEqual([7, 7, 7, 7])
+    expect(listCalls).toBe(4)
+    expect(createCalls).toBe(1)
+    expect(await getGiteaPullRequestForBranchOrThrow('/repo', branch)).toMatchObject({ number: 7 })
+    expect(listCalls).toBe(4)
+  })
+
+  it('retires a strict miss when a create attempt recovers an existing pull request', async () => {
+    let attempted = false
+    let listCalls = 0
+    vi.stubGlobal(
+      'fetch',
+      vi.fn(async (_url: URL, init?: RequestInit) => {
+        if (init?.method === 'POST') {
+          attempted = true
+          return Response.json({ message: 'already exists' }, { status: 409 })
+        }
+        listCalls++
+        return Response.json(attempted ? [pullRequest] : [])
+      })
+    )
+
+    expect(await getGiteaPullRequestForBranchOrThrow('/repo', branch)).toBeNull()
+    expect(await createReview()).toMatchObject({
+      ok: false,
+      code: 'already_exists',
+      existingReview: { number: 7 }
+    })
+    expect(await getGiteaPullRequestForBranchOrThrow('/repo', branch)).toMatchObject({ number: 7 })
+    expect(listCalls).toBe(3)
+  })
+
+  it.each(['before', 'after'] as const)(
+    'keeps fresh strict results when a pre-invalidation scan finishes %s its replacement',
+    async (completionOrder) => {
+      const oldResponse = Promise.withResolvers<Response>()
+      const freshResponse = Promise.withResolvers<Response>()
+      const oldStarted = Promise.withResolvers<void>()
+      const fetchMock = vi
+        .fn()
+        .mockImplementationOnce(() => {
+          oldStarted.resolve()
+          return oldResponse.promise
+        })
+        .mockImplementationOnce(() => freshResponse.promise)
+      vi.stubGlobal('fetch', fetchMock)
+
+      const stale = getGiteaPullRequestForBranchOrThrow('/repo', branch)
+      await oldStarted.promise
+      const repo = await getGiteaRepoSlug('/repo')
+      if (!repo) {
+        throw new Error('Expected test repository')
+      }
+      invalidateGiteaPullRequestScanForRepo(repo)
+      const fresh = getGiteaPullRequestForBranchOrThrow('/repo', branch)
+      const concurrent = getGiteaPullRequestForBranchOrThrow('/repo', branch)
+      try {
+        await new Promise<void>((resolve) => setImmediate(resolve))
+        expect(fetchMock).toHaveBeenCalledTimes(2)
+        if (completionOrder === 'before') {
+          oldResponse.resolve(Response.json([]))
+          expect(await stale).toBeNull()
+        }
+        freshResponse.resolve(Response.json([pullRequest]))
+        expect(await fresh).toMatchObject({ number: 7 })
+        expect(await concurrent).toMatchObject({ number: 7 })
+        if (completionOrder === 'after') {
+          oldResponse.resolve(Response.json([]))
+          expect(await stale).toBeNull()
+        }
+        expect(await getGiteaPullRequestForBranchOrThrow('/repo', branch)).toMatchObject({
+          number: 7
+        })
+        expect(fetchMock).toHaveBeenCalledTimes(2)
+      } finally {
+        oldResponse.resolve(Response.json([]))
+        freshResponse.resolve(Response.json([pullRequest]))
+        await Promise.all([stale, fresh, concurrent])
+      }
+    }
+  )
+})
diff --git a/src/main/gitea/client.ts b/src/main/gitea/client.ts
index ba9e7c3ed8f5..ba768bb81319 100644
--- a/src/main/gitea/client.ts
+++ b/src/main/gitea/client.ts
@@ -131,7 +131,9 @@ function giteaPullRequestScanKey(repo: GiteaRepoRef): string {
 /** Invalidate the shared /pulls scan after Orca itself creates a PR so the
  *  next worktree-card refresh sees it instead of a cached miss. */
 export function invalidateGiteaPullRequestScanForRepo(repo: GiteaRepoRef): void {
-  invalidateGiteaPullRequestScan(giteaPullRequestScanKey(repo))
+  const repoKey = giteaPullRequestScanKey(repo)
+  invalidateGiteaPullRequestScan(repoKey)
+  invalidateGiteaPullRequestScan(`${repoKey}::strict`)
 }
 
 async function getCommitStatus(
diff --git a/src/main/global-fetch-call-site-audit.test.ts b/src/main/global-fetch-call-site-audit.test.ts
index 0c2133f320eb..907092515f54 100644
--- a/src/main/global-fetch-call-site-audit.test.ts
+++ b/src/main/global-fetch-call-site-audit.test.ts
@@ -23,6 +23,7 @@ const AUDITED_GLOBAL_FETCH_LINES = new Map<string, number>([
   ['main/orca-profiles/profile-cloud-client.ts', 1],
   ['main/orca-profiles/profile-cloud-org-members-client.ts', 1],
   ['main/rate-limits/codex-fetcher.ts', 3],
+  ['main/rate-limits/zcode-usage-fetcher.ts', 1],
   ['main/runtime/push/push-gateway-client.ts', 1],
   ['main/runtime/relay/relay-http-client.ts', 2],
   ['main/runtime/relay/relay-region-catalog-fetch.ts', 1],
diff --git a/src/main/hermes/hermes-config-comment-boundaries.test.ts b/src/main/hermes/hermes-config-comment-boundaries.test.ts
new file mode 100644
index 000000000000..b28ad582ed91
--- /dev/null
+++ b/src/main/hermes/hermes-config-comment-boundaries.test.ts
@@ -0,0 +1,90 @@
+import { mkdtempSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { describe, expect, it, vi } from 'vitest'
+import { parseDocument } from 'yaml'
+import { createManagedHookLocalFilesystem } from '../agent-hooks/managed-hook-local-filesystem'
+import { disablePlugin, enablePlugin, updateConfigContent } from './hermes-config-yaml'
+import { HermesHookService } from './hook-service'
+
+const fixtures = [
+  ...['  ', '    '].flatMap((indent) =>
+    [true, false].map((retained) => ({
+      name: `trailing list comment (${indent.length} spaces, retained: ${retained})`,
+      list: `${indent}# list head\n${retained ? `${indent}- keep\n` : ''}${indent}- orca-status # managed entry\n${indent}# list tail\n`,
+      suffix: '  custom: "off"\nmodel: "001"\n'
+    }))
+  ),
+  {
+    name: 'comment before the next root setting',
+    list: '    - keep\n    - orca-status # managed entry\n',
+    suffix: '# Operator notes\nmodel: "001"\n'
+  },
+  {
+    name: 'comment before the next plugin setting',
+    list: '    - keep\n    - orca-status # managed entry\n',
+    suffix: '  # Plugin notes\n  custom: "off"\nmodel: "001"\n'
+  },
+  {
+    name: 'comment at the end of the document',
+    list: '    - keep\n    - orca-status # managed entry\n',
+    suffix: '# End notes\n'
+  },
+  {
+    name: 'leading comment on the first retained entry',
+    list: '    # lead\n    - orca-status\n    # between\n    - keep\n',
+    suffix: 'model: "001"\n'
+  }
+]
+
+describe.each(['\n', '\r\n'])('Hermes comment boundaries (%j)', (eol) => {
+  describe.each(['install', 'remove'])('%s', (operation) => {
+    it.each(fixtures)('preserves $name exactly once through the service', async (fixture) => {
+      const key = operation === 'install' ? 'disabled' : 'enabled'
+      const enabled = operation === 'install' ? '  enabled: [orca-status]\n' : ''
+      const input = `plugins:\n${enabled}  ${key}:\n${fixture.list}${fixture.suffix}`.replaceAll(
+        '\n',
+        eol
+      )
+      const updater = operation === 'install' ? enablePlugin : disablePlugin
+      const result = updateConfigContent(input, updater)
+      expect(result.detail).toBeUndefined()
+      const output = result.content ?? ''
+      const parsed = parseDocument(output)
+      expect(parsed.errors).toEqual([])
+      expect(parsed.warnings).toEqual([])
+      expect(parsed.toJS()).toEqual(updater(parseDocument(input).toJS()))
+      for (const comment of input.match(/#[^\r\n]*/g) ?? []) {
+        expect(output.split(comment)).toHaveLength(2)
+      }
+      expect(output.endsWith(fixture.suffix.replaceAll('\n', eol))).toBe(true)
+      expect(updateConfigContent(output, updater).content).toBe(output)
+      if (eol === '\r\n') {
+        expect(output.replaceAll(eol, '')).not.toContain('\n')
+      }
+
+      const root = mkdtempSync(join(tmpdir(), 'orca-hermes-comments-'))
+      const home = join(root, '.hermes')
+      mkdirSync(home)
+      const path = join(home, 'config.yaml')
+      vi.stubEnv('HERMES_HOME', home)
+      try {
+        writeFileSync(path, input)
+        const service = new HermesHookService()
+        const status = operation === 'install' ? service.install() : service.remove()
+        expect(status.state).toBe(operation === 'install' ? 'installed' : 'not_installed')
+        expect(readFileSync(path, 'utf8')).toBe(output)
+        expect(readFileSync(`${path}.bak`, 'utf8')).toBe(input)
+        if (operation === 'install') {
+          writeFileSync(path, input)
+          const remote = await service.installRemote(createManagedHookLocalFilesystem(), root)
+          expect(remote.state).toBe('installed')
+          expect(readFileSync(path, 'utf8')).toBe(output)
+        }
+      } finally {
+        vi.unstubAllEnvs()
+        rmSync(root, { recursive: true, force: true })
+      }
+    })
+  })
+})
diff --git a/src/main/hermes/hermes-config-document.test.ts b/src/main/hermes/hermes-config-document.test.ts
new file mode 100644
index 000000000000..744b6c23f6f5
--- /dev/null
+++ b/src/main/hermes/hermes-config-document.test.ts
@@ -0,0 +1,166 @@
+import { describe, expect, it } from 'vitest'
+import { parse } from 'yaml'
+import { disablePlugin, enablePlugin, updateConfigContent } from './hermes-config-yaml'
+
+const fixture = [
+  '# Operator documentation',
+  'model: "001" # keep quoted',
+  'prompt: |',
+  '  First line',
+  '  Second line',
+  'defaults: &defaults',
+  '  temperature: 0.25 # setting',
+  'other: *defaults',
+  '',
+  'plugins:',
+  '  enabled:',
+  '    - "zeta" # last alphabetically',
+  '    - alpha # first occurrence',
+  '    - alpha # duplicate belongs to user',
+  '  disabled: [orca-status, blocked] # disabled choices',
+  '  custom: "off" # unrelated plugin setting',
+  '# End documentation',
+  ''
+].join('\n')
+
+describe('Hermes YAML document edits', () => {
+  it.each(['\n', '\r\n'])('preserves comments and values through install/remove (%j)', (eol) => {
+    const initial = fixture.replaceAll('\n', eol)
+    const installed = updateConfigContent(initial, enablePlugin)
+    expect(installed.detail).toBeUndefined()
+    expect(installed.content).not.toBeNull()
+    const enabled = installed.content ?? ''
+    expect(parse(enabled)).toEqual({
+      ...parse(initial),
+      plugins: {
+        enabled: ['zeta', 'alpha', 'alpha', 'orca-status'],
+        disabled: ['blocked'],
+        custom: 'off'
+      }
+    })
+    const removed = updateConfigContent(enabled, disablePlugin).content ?? ''
+    expect(parse(removed)).toEqual({
+      ...parse(initial),
+      plugins: { enabled: ['zeta', 'alpha', 'alpha'], disabled: ['blocked'], custom: 'off' }
+    })
+    for (const output of [enabled, removed]) {
+      for (const comment of initial.match(/#[^\r\n]*/g) ?? []) {
+        expect(output).toContain(comment)
+      }
+      expect(output).toContain('model: "001" # keep quoted')
+      expect(output).toContain(`prompt: |${eol}  First line${eol}  Second line`)
+      expect(output).toContain('&defaults')
+      expect(output).toContain('*defaults')
+      if (eol === '\r\n') {
+        expect(output.replaceAll('\r\n', '')).not.toContain('\n')
+      }
+    }
+  })
+
+  it.each([
+    '# existing\r\nplugins:\r\n  enabled: [zeta, orca-status, alpha, alpha]\r\n',
+    'plugins: &plugins\n  enabled: [orca-status]\nother: *plugins\n'
+  ])('returns exact bytes for a semantic no-op', (input) => {
+    expect(updateConfigContent(input, enablePlugin)).toEqual({ content: input })
+  })
+
+  it.each(['# no plugins\nmodel: test\n', 'plugins:\n  disabled: [blocked]\n'])(
+    'does not add absent lists when removing',
+    (input) => expect(updateConfigContent(input, disablePlugin)).toEqual({ content: input })
+  )
+
+  it('retains comments attached to removed Orca entries', () => {
+    const input =
+      'plugins:\n  enabled:\n    # keep this note\n    - orca-status # managed entry\n    - other\n'
+    const output = updateConfigContent(input, disablePlugin).content ?? ''
+    expect(parse(output).plugins.enabled).toEqual(['other'])
+    expect(output).toContain('# keep this note')
+    expect(output).toContain('# managed entry')
+    expect(output.match(/# keep this note/g)).toHaveLength(1)
+  })
+
+  it.each([
+    'plugins: [',
+    'plugins: {}\nplugins: {}\n',
+    '- invalid root\n',
+    'plugins: unexpected\n',
+    'plugins:\n  enabled: not-a-list\n',
+    'plugins:\n  enabled: [123]\n',
+    'plugins:\n  disabled: not-a-list\n',
+    'plugins: !custom {}\n',
+    'defaults: &defaults {plugins: {enabled: [other]}}\n<<: *defaults\n',
+    'defaults: &defaults {enabled: [other]}\nplugins:\n  <<: *defaults\n',
+    'plugins: &plugins\n  enabled: [other]\nother: *plugins\n',
+    'plugins:\n  enabled: &enabled [other]\nother: *enabled\n',
+    'enabled: &enabled [other]\nplugins:\n  enabled: *enabled\n',
+    'plugins:\n  enabled: [*missing]\n'
+  ])('refuses an unsafe update without a replacement (%s)', (input) => {
+    const output = updateConfigContent(input, enablePlugin)
+    expect(output.content).toBeNull()
+    expect(output.detail).toBeTruthy()
+  })
+
+  it('keeps folded scalars, quoted strings and long lines in a real update', () => {
+    const input = `# header\nprompt: >-\n  First line\n  Second line\nquoted: 'off'\nlong: ${'word '
+      .repeat(30)
+      .trimEnd()}\nplugins: {enabled: [other]}\n`
+    const output = updateConfigContent(input, enablePlugin).content ?? ''
+    expect(output).toContain('prompt: >-\n  First line\n  Second line\n')
+    expect(output).toContain("quoted: 'off'")
+    expect(output).toContain(`long: ${'word '.repeat(30).trimEnd()}\n`)
+    expect(parse(output)).toEqual({
+      ...parse(input),
+      plugins: { enabled: ['other', 'orca-status'] }
+    })
+  })
+
+  it.each(['\n', '\r\n'])(
+    'leaves unrelated source bytes intact with unusual indentation (%j)',
+    (eol) => {
+      const prefix =
+        'model:    "001" # spacing\nprompt: >-\n    First\n    Second\n\n# plugins\nplugins:\n    custom: |-\n        Unrelated\n        text\n'.replaceAll(
+          '\n',
+          eol
+        )
+      const input = `${prefix}    enabled: [other] # choices${eol}# ending${eol}`
+      const installed = updateConfigContent(input, enablePlugin).content ?? ''
+      expect(installed.startsWith(prefix)).toBe(true)
+      expect(installed.endsWith(`# ending${eol}`)).toBe(true)
+      const removed = updateConfigContent(installed, disablePlugin).content ?? ''
+      expect(removed.startsWith(prefix)).toBe(true)
+      expect(parse(removed)).toEqual(parse(input))
+    }
+  )
+
+  it.each([
+    'model: "001"',
+    'model: "001"\n# end\n...\n',
+    '{model: "001"}\n',
+    'plugins: {} # empty\n',
+    'plugins: {custom: "off",} # flow\n',
+    'plugins:\n    custom: >-\n        First\n        Second\n# end\n'
+  ])('inserts missing plugin keys without losing other values (%s)', (input) => {
+    const installed = updateConfigContent(input, enablePlugin)
+    expect(installed.detail).toBeUndefined()
+    const output = installed.content ?? ''
+    const parsed = parse(input)
+    expect(parse(output)).toEqual({
+      ...parsed,
+      plugins: { ...parsed.plugins, enabled: ['orca-status'] }
+    })
+    for (const comment of input.match(/#[^\r\n]*/g) ?? []) {
+      expect(output).toContain(comment)
+    }
+    if (input.includes('First')) {
+      expect(output).toContain('custom: >-\n        First\n        Second\n')
+    }
+  })
+
+  it.each(['', '# empty document\n', 'null\n'])('enables a plugin in an empty config', (input) => {
+    const output = updateConfigContent(input, enablePlugin).content ?? ''
+    expect(parse(output)).toEqual({ plugins: { enabled: ['orca-status'] } })
+    if (input.includes('#')) {
+      expect(output).toContain('# empty document')
+    }
+  })
+})
diff --git a/src/main/hermes/hermes-config-document.ts b/src/main/hermes/hermes-config-document.ts
new file mode 100644
index 000000000000..71fe4ade6084
--- /dev/null
+++ b/src/main/hermes/hermes-config-document.ts
@@ -0,0 +1,141 @@
+import { isDeepStrictEqual } from 'node:util'
+import { isAlias, isMap, isNode, isScalar, isSeq, parseDocument, visit } from 'yaml'
+import type { Document, YAMLMap, YAMLSeq } from 'yaml'
+import type { HermesConfig } from './hermes-config-yaml'
+import { applyHermesPluginSourceEdits } from './hermes-config-source-edits'
+
+function preserveRemovedComments(sequence: YAMLSeq, removed: unknown[], first: unknown): void {
+  const comments = removed.flatMap((node) =>
+    isNode(node)
+      ? [node === first && !sequence.flow ? null : node.commentBefore, node.comment].filter(
+          (text) => text != null
+        )
+      : []
+  )
+  if (comments.length > 0) {
+    sequence.comment = [sequence.comment, ...comments].filter((text) => text != null).join('\n')
+  }
+}
+
+function updateStringSequence(plugins: YAMLMap, key: string, values: unknown): void {
+  if (values === undefined) {
+    return
+  }
+  if (!Array.isArray(values) || values.some((value) => typeof value !== 'string')) {
+    throw new Error(`Hermes plugins.${key} must be a string list`)
+  }
+  const sequence = plugins.get(key, true)
+  if (sequence === undefined) {
+    plugins.set(key, values)
+    return
+  }
+  if (!isSeq(sequence)) {
+    throw new Error(`Hermes plugins.${key} must be a string list`)
+  }
+  const remaining = [...values]
+  const removed: unknown[] = []
+  const first = sequence.items[0]
+  sequence.items = sequence.items.filter((item) => {
+    if (!isScalar(item) || typeof item.value !== 'string') {
+      throw new Error(`Hermes plugins.${key} must contain plain string entries`)
+    }
+    const index = remaining.indexOf(item.value)
+    if (index === -1) {
+      removed.push(item)
+      return false
+    }
+    remaining.splice(index, 1)
+    return true
+  })
+  preserveRemovedComments(sequence, removed, first)
+  for (const value of remaining) {
+    sequence.add(value)
+  }
+}
+
+export function updateHermesPluginDocument(
+  content: string,
+  next: HermesConfig
+): { content: string | null; detail?: string } {
+  try {
+    const document: Document = parseDocument(content)
+    if (document.errors.length > 0 || document.warnings.length > 0) {
+      throw new Error(
+        [...document.errors, ...document.warnings].map((item) => item.message).join('; ')
+      )
+    }
+    if (isScalar(document.contents) && document.contents.value === null) {
+      const previous = document.contents
+      document.contents = document.createNode({})
+      document.contents.commentBefore = previous.commentBefore
+      document.contents.comment = previous.comment
+    }
+    if (document.contents === null) {
+      document.contents = document.createNode({})
+    }
+    if (!isMap(document.contents)) {
+      throw new Error('Hermes config.yaml root must be a mapping')
+    }
+    if (document.contents.anchor) {
+      throw new Error('Cannot safely edit an anchored Hermes root')
+    }
+    if (document.contents.has('<<')) {
+      throw new Error('Cannot safely edit a merged Hermes root')
+    }
+
+    let plugins = document.get('plugins', true)
+    if (plugins === undefined) {
+      document.set('plugins', document.createNode({}))
+      plugins = document.get('plugins', true)
+    }
+    if (!isMap(plugins)) {
+      throw new Error('Hermes plugins must be a plain mapping')
+    }
+    // Aliases into a changed subtree could silently change unrelated settings.
+    visit(plugins, {
+      Node: (_key, node) => {
+        if (isAlias(node) || node.anchor || node.tag) {
+          throw new Error('Cannot safely edit Hermes plugins with anchors, aliases or tags')
+        }
+      },
+      Pair: (_key, pair) => {
+        if (isScalar(pair.key) && pair.key.value === '<<') {
+          throw new Error('Cannot safely edit Hermes plugins with YAML merge keys')
+        }
+      }
+    })
+    for (const key of ['enabled', 'disabled']) {
+      const existing = plugins.get(key, true)
+      if (
+        existing !== undefined &&
+        (!isSeq(existing) ||
+          existing.items.some((item) => !isScalar(item) || typeof item.value !== 'string'))
+      ) {
+        throw new Error(`Hermes plugins.${key} must be a string list`)
+      }
+    }
+    const nextPlugins = next.plugins
+    if (typeof nextPlugins !== 'object' || nextPlugins === null) {
+      throw new Error('Hermes plugins must be a mapping')
+    }
+    if ('enabled' in nextPlugins) {
+      updateStringSequence(plugins, 'enabled', nextPlugins.enabled)
+    }
+    if ('disabled' in nextPlugins) {
+      updateStringSequence(plugins, 'disabled', nextPlugins.disabled)
+    }
+    const output = applyHermesPluginSourceEdits(content, document)
+    // Re-parse to reject edits that would change any unrelated alias-resolved value.
+    const verified = parseDocument(output)
+    if (
+      verified.errors.length > 0 ||
+      verified.warnings.length > 0 ||
+      !isDeepStrictEqual(verified.toJS(), next)
+    ) {
+      throw new Error('Hermes plugin update would change unrelated configuration')
+    }
+    return { content: output }
+  } catch (error) {
+    return { content: null, detail: error instanceof Error ? error.message : String(error) }
+  }
+}
diff --git a/src/main/hermes/hermes-config-flow-insertion.test.ts b/src/main/hermes/hermes-config-flow-insertion.test.ts
new file mode 100644
index 000000000000..f00c76c8f9ef
--- /dev/null
+++ b/src/main/hermes/hermes-config-flow-insertion.test.ts
@@ -0,0 +1,184 @@
+import { describe, expect, it } from 'vitest'
+import { isMap, parseDocument } from 'yaml'
+import { enablePlugin, updateConfigContent } from './hermes-config-yaml'
+
+const pluginEntries = [
+  { name: 'empty', text: ' # empty,\n', expected: {} },
+  { name: 'nonempty', text: 'custom: keep # note\n', expected: { custom: 'keep' } },
+  {
+    name: 'trailing comma',
+    text: 'custom: keep, # separator,\n',
+    expected: { custom: 'keep' }
+  },
+  {
+    name: 'comment comma',
+    text: 'custom: keep # no separator,\n',
+    expected: { custom: 'keep' }
+  },
+  {
+    name: 'nested commas',
+    text: 'custom: {names: ["a,", b,],} # nested,\n',
+    expected: { custom: { names: ['a,', 'b'] } }
+  },
+  {
+    name: 'explicit entry key',
+    text: '? custom : keep # explicit,\n',
+    expected: { custom: 'keep' }
+  }
+]
+
+const contexts = [
+  { name: 'block root', prefix: 'plugins: {', suffix: '} # outside' },
+  {
+    name: 'indented block root',
+    prefix: '    model: "001" # before\n    plugins: {',
+    suffix: '    } # outside\n    prompt: |-\n      Keep this text',
+    settings: { model: '001', prompt: 'Keep this text' }
+  },
+  { name: 'explicit plugins key', prefix: '? "plugins"\n: {', suffix: '} # outside' },
+  {
+    name: 'indented explicit plugins key',
+    prefix: '    ? plugins\n    : {',
+    suffix: '    } # outside'
+  },
+  { name: 'flow on next line', prefix: 'plugins:\n    {', suffix: '} # outside' },
+  {
+    name: 'nested in root flow',
+    prefix: '{model: "001", plugins: {',
+    suffix: '}, extra: [one, two,]} # outside',
+    settings: { model: '001', extra: ['one', 'two'] }
+  }
+]
+
+function expectInsertion(source: string, expected: unknown, eol: string): string {
+  const original = parseDocument(source)
+  expect(original.errors).toEqual([])
+  expect(original.warnings).toEqual([])
+  const plugins = original.get('plugins', true)
+  const parent = isMap(plugins) ? plugins : original.contents
+  if (!isMap(parent) || !parent.range) {
+    throw new Error('Fixture must contain a ranged mapping')
+  }
+  const position = parent.range[1] - 1
+  const result = updateConfigContent(source, enablePlugin)
+  expect(result.detail).toBeUndefined()
+  const output = result.content ?? ''
+  const document = parseDocument(output)
+  expect(document.errors).toEqual([])
+  expect(document.warnings).toEqual([])
+  expect(document.toJS()).toEqual(expected)
+  expect(output.startsWith(source.slice(0, position))).toBe(true)
+  expect(output.endsWith(source.slice(position))).toBe(true)
+  expect(updateConfigContent(output, enablePlugin)).toEqual({ content: output })
+  if (eol === '\r\n') {
+    expect(output.replaceAll(eol, '')).not.toContain('\n')
+  }
+  return output
+}
+
+describe.each(['\n', '\r\n'])('Hermes flow insertion indentation (%j)', (eol) => {
+  describe.each([false, true])('final newline = %j', (finalNewline) => {
+    describe.each(contexts)('$name', ({ prefix, suffix, settings }) => {
+      it.each(pluginEntries)('$name plugin map', ({ text, expected }) => {
+        const source = `${prefix}${text}${suffix}${finalNewline ? '\n' : ''}`.replaceAll('\n', eol)
+        expectInsertion(
+          source,
+          { ...settings, plugins: { ...expected, enabled: ['orca-status'] } },
+          eol
+        )
+      })
+    })
+
+    it.each([
+      { name: 'empty root', text: '{ # empty,\n}', expected: {} },
+      { name: 'nonempty root', text: '{model: "001" # note,\n}', expected: { model: '001' } },
+      {
+        name: 'indented root with nested trailing comma',
+        text: '    {model: {names: ["a,", b,],}, # separator,\n}',
+        expected: { model: { names: ['a,', 'b'] } }
+      }
+    ])('$name flow map', ({ text, expected }) => {
+      const source = `${text}${finalNewline ? '\n' : ''}`.replaceAll('\n', eol)
+      expectInsertion(source, { ...expected, plugins: { enabled: ['orca-status'] } }, eol)
+    })
+  })
+})
+
+describe.each(['\n', '\r\n'])('Hermes flow insertion with tab separation (%j)', (eol) => {
+  it.each(pluginEntries.slice(0, 3))('$name map after a tab', ({ text, expected }) => {
+    const source = `plugins: {${text}\t}`.replaceAll('\n', eol)
+    expectInsertion(source, { plugins: { ...expected, enabled: ['orca-status'] } }, eol)
+  })
+
+  it.each([
+    {
+      name: 'minimal tab',
+      source: 'plugins: {custom: keep # note\n\t}',
+      padding: '\n '
+    },
+    {
+      name: 'deeper escaped quoted key',
+      source: '    "plu\\u0067ins": {custom: keep # note\n    \t}',
+      padding: '\n     '
+    },
+    {
+      name: 'mixed spaces and tabs below required indentation',
+      source: '    plugins: {custom: keep # note\n    \t  \t }',
+      padding: '\n     '
+    },
+    {
+      name: 'whitespace-only closing line',
+      source: 'plugins: {custom: keep # note\n\t \t  }',
+      padding: '\n '
+    },
+    {
+      name: 'sufficient spaces before a tab',
+      source: 'plugins: {custom: keep # note\n \t}',
+      padding: ''
+    },
+    {
+      name: 'deeper sufficient spaces before mixed separation',
+      source: '    plugins: {custom: keep # note\n     \t \t}',
+      padding: ''
+    },
+    {
+      name: 'root flow with zero required indentation',
+      source: '    {plugins: {custom: keep # note\n\t}}',
+      padding: ''
+    },
+    {
+      name: 'tab after content on the same line',
+      source: 'plugins: {custom: keep\t}',
+      padding: ''
+    },
+    {
+      name: 'explicit plugins key',
+      source: '? "plugins"\n: {custom: keep # note\n\t}',
+      padding: '\n '
+    },
+    {
+      name: 'deeper split explicit key',
+      source: '    ?\n        "plugins"\n    : {custom: keep # note\n    \t}',
+      padding: '\n     '
+    }
+  ])('preserves source around $name', ({ source: input, padding }) => {
+    const source = input.replaceAll('\n', eol)
+    const output = expectInsertion(
+      source,
+      { plugins: { custom: 'keep', enabled: ['orca-status'] } },
+      eol
+    )
+    const insertion = `${padding}, enabled: [ orca-status ]`.replaceAll('\n', eol)
+    expect(output).toBe(source.replace('}', `${insertion}}`))
+  })
+
+  it('rejects an unrelated value change after repairing tab-separated insertion', () => {
+    const source = 'model: "001"\nplugins: {custom: keep # note\n\t}'.replaceAll('\n', eol)
+    expect(
+      updateConfigContent(source, (config) => ({ ...enablePlugin(config), model: 'changed' }))
+    ).toEqual({
+      content: null,
+      detail: 'Hermes plugin update would change unrelated configuration'
+    })
+  })
+})
diff --git a/src/main/hermes/hermes-config-preservation.test.ts b/src/main/hermes/hermes-config-preservation.test.ts
new file mode 100644
index 000000000000..9756f7a3230d
--- /dev/null
+++ b/src/main/hermes/hermes-config-preservation.test.ts
@@ -0,0 +1,202 @@
+import {
+  chmodSync,
+  existsSync,
+  linkSync,
+  lstatSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  readdirSync,
+  rmSync,
+  statSync,
+  symlinkSync,
+  utimesSync,
+  writeFileSync
+} from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { parse } from 'yaml'
+import { HermesHookService } from './hook-service'
+
+const configured =
+  '# Operator comments\r\nmodel: "fixture"\r\nplugins:\r\n  enabled: [orca-status]\r\n'
+const initial =
+  '# Recovery notes\nmodel: "001"\nprompt: |\n  First\n  Second\nplugins:\n  enabled: [other] # choices\n'
+
+describe('Hermes config preservation on disk', () => {
+  let directory: string
+  let configPath: string
+  const service = new HermesHookService()
+
+  beforeEach(() => {
+    directory = mkdtempSync(join(tmpdir(), 'orca-hermes-config-'))
+    configPath = join(directory, 'config.yaml')
+    vi.stubEnv('HERMES_HOME', directory)
+  })
+
+  afterEach(() => {
+    vi.unstubAllEnvs()
+    rmSync(directory, { recursive: true, force: true })
+  })
+
+  it('leaves unchanged bytes, inode, timestamp, mode and backup untouched', () => {
+    writeFileSync(configPath, configured, { mode: 0o600 })
+    writeFileSync(`${configPath}.bak`, 'previous recovery point', { mode: 0o600 })
+    utimesSync(configPath, 1_600_000_000, 1_600_000_000)
+    const before = statSync(configPath)
+    const backup = statSync(`${configPath}.bak`)
+    expect(service.install().state).toBe('installed')
+    expect(readFileSync(configPath, 'utf8')).toBe(configured)
+    const after = statSync(configPath)
+    expect([after.ino, after.mtimeMs, after.mode]).toEqual([
+      before.ino,
+      before.mtimeMs,
+      before.mode
+    ])
+    expect(statSync(`${configPath}.bak`)).toEqual(backup)
+    expect(readFileSync(`${configPath}.bak`, 'utf8')).toBe('previous recovery point')
+  })
+
+  it('does not create a backup on a no-op', () => {
+    writeFileSync(configPath, configured)
+    service.install()
+    expect(existsSync(`${configPath}.bak`)).toBe(false)
+  })
+
+  it('does not create a config when removing an absent integration', () => {
+    expect(service.remove().state).toBe('not_installed')
+    expect(readdirSync(directory)).toEqual([])
+  })
+
+  it('preserves comments and multiline values through real install and removal', () => {
+    writeFileSync(configPath, initial)
+    expect(service.install().state).toBe('installed')
+    const installed = readFileSync(configPath, 'utf8')
+    expect(parse(installed).plugins.enabled).toEqual(['other', 'orca-status'])
+    expect(readFileSync(`${configPath}.bak`, 'utf8')).toBe(initial)
+    expect(service.remove().state).toBe('not_installed')
+    const removed = readFileSync(configPath, 'utf8')
+    for (const output of [installed, removed]) {
+      expect(output).toContain('# Recovery notes')
+      expect(output).toContain('# choices')
+      expect(output).toContain('model: "001"')
+      expect(output).toContain('prompt: |\n  First\n  Second\n')
+    }
+    expect(parse(removed)).toEqual(parse(initial))
+    expect(readFileSync(`${configPath}.bak`, 'utf8')).toBe(installed)
+  })
+
+  it.skipIf(process.platform === 'win32').each([
+    [0o600, 0o022],
+    [0o600, 0],
+    [0o640, 0o077],
+    [0o640, 0]
+  ])('preserves mode %i with umask %i and a byte-exact backup', (mode, mask) => {
+    writeFileSync(configPath, initial)
+    chmodSync(configPath, mode)
+    const previous = process.umask(mask)
+    try {
+      expect(service.install().state).toBe('installed')
+    } finally {
+      process.umask(previous)
+    }
+    expect(statSync(configPath).mode & 0o777).toBe(mode)
+    expect(statSync(`${configPath}.bak`).mode & 0o777).toBe(mode)
+    expect(readFileSync(`${configPath}.bak`, 'utf8')).toBe(initial)
+    expect(readdirSync(directory).sort()).toEqual(['config.yaml', 'config.yaml.bak', 'plugins'])
+  })
+
+  it.skipIf(process.platform === 'win32')(
+    'creates a private new config with permissive umask',
+    () => {
+      const previous = process.umask(0)
+      try {
+        expect(service.install().state).toBe('installed')
+      } finally {
+        process.umask(previous)
+      }
+      expect(statSync(configPath).mode & 0o777).toBe(0o600)
+      expect(existsSync(`${configPath}.bak`)).toBe(false)
+    }
+  )
+
+  it.skipIf(process.platform === 'win32')('keeps the config symlink and updates its target', () => {
+    const target = join(directory, 'dotfiles.yaml')
+    writeFileSync(target, initial, { mode: 0o600 })
+    symlinkSync(target, configPath)
+    expect(service.install().state).toBe('installed')
+    expect(lstatSync(configPath).isSymbolicLink()).toBe(true)
+    expect(parse(readFileSync(target, 'utf8')).plugins.enabled).toContain('orca-status')
+    expect(readFileSync(`${target}.bak`, 'utf8')).toBe(initial)
+  })
+
+  it.skipIf(process.platform === 'win32')('refuses a dangling config symlink', () => {
+    symlinkSync(join(directory, 'missing.yaml'), configPath)
+    expect(() => service.install()).toThrow()
+    expect(lstatSync(configPath).isSymbolicLink()).toBe(true)
+    expect(readdirSync(directory)).toEqual(['config.yaml'])
+  })
+
+  it.skipIf(process.platform === 'win32')(
+    'refuses a symlinked backup without touching its target',
+    () => {
+      writeFileSync(configPath, initial)
+      const target = join(directory, 'unrelated')
+      writeFileSync(target, 'preserve me')
+      symlinkSync(target, `${configPath}.bak`)
+      expect(() => service.install()).toThrow('Refusing to overwrite symlinked backup')
+      expect(readFileSync(configPath, 'utf8')).toBe(initial)
+      expect(readFileSync(target, 'utf8')).toBe('preserve me')
+      expect(readdirSync(directory).some((name) => name.endsWith('.tmp'))).toBe(false)
+    }
+  )
+
+  it('replaces a hard-linked backup without changing the unrelated inode', () => {
+    writeFileSync(configPath, initial)
+    const target = join(directory, 'unrelated')
+    writeFileSync(target, 'preserve me')
+    linkSync(target, `${configPath}.bak`)
+    expect(service.install().state).toBe('installed')
+    expect(readFileSync(target, 'utf8')).toBe('preserve me')
+    expect(readFileSync(`${configPath}.bak`, 'utf8')).toBe(initial)
+  })
+
+  it('keeps the config and cleans temporary files when backup publication fails', () => {
+    writeFileSync(configPath, initial)
+    mkdirSync(`${configPath}.bak`)
+    expect(() => service.install()).toThrow()
+    expect(readFileSync(configPath, 'utf8')).toBe(initial)
+    expect(readdirSync(directory).some((name) => name.endsWith('.tmp'))).toBe(false)
+  })
+
+  it('keeps installed plugin files if removal cannot back up the config', () => {
+    expect(service.install().state).toBe('installed')
+    const before = readFileSync(configPath, 'utf8')
+    mkdirSync(`${configPath}.bak`)
+    expect(() => service.remove()).toThrow()
+    expect(readFileSync(configPath, 'utf8')).toBe(before)
+    expect(existsSync(join(directory, 'plugins', 'orca-status', '__init__.py'))).toBe(true)
+    expect(readdirSync(directory).some((name) => name.endsWith('.tmp'))).toBe(false)
+  })
+
+  it('refuses alias-bearing removal before deleting installed plugin files', () => {
+    expect(service.install().state).toBe('installed')
+    const input = 'plugins:\n  enabled: &enabled [orca-status, other]\ncopy: *enabled\n'
+    writeFileSync(configPath, input)
+    expect(service.remove().state).toBe('error')
+    expect(readFileSync(configPath, 'utf8')).toBe(input)
+    expect(existsSync(join(directory, 'plugins', 'orca-status', '__init__.py'))).toBe(true)
+    expect(existsSync(`${configPath}.bak`)).toBe(false)
+  })
+
+  it.each(['plugins: [', 'plugins: unexpected\n', 'plugins:\n  enabled: not-a-list\n'])(
+    'does not install files or rewrite unexpected YAML (%s)',
+    (input) => {
+      writeFileSync(configPath, input)
+      expect(service.install().state).toBe('error')
+      expect(readFileSync(configPath, 'utf8')).toBe(input)
+      expect(readdirSync(directory)).toEqual(['config.yaml'])
+    }
+  )
+})
diff --git a/src/main/hermes/hermes-config-remote-adapter.test.ts b/src/main/hermes/hermes-config-remote-adapter.test.ts
new file mode 100644
index 000000000000..3005d9ef9dd4
--- /dev/null
+++ b/src/main/hermes/hermes-config-remote-adapter.test.ts
@@ -0,0 +1,118 @@
+import {
+  chmodSync,
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  readdirSync,
+  rmSync,
+  statSync,
+  writeFileSync
+} from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+import { parse } from 'yaml'
+import { createManagedHookLocalFilesystem } from '../agent-hooks/managed-hook-local-filesystem'
+import { HermesHookService } from './hook-service'
+
+describe('Hermes remote installer through a local filesystem adapter (no SSH)', () => {
+  let directory: string
+  let configPath: string
+  const service = new HermesHookService()
+
+  beforeEach(() => {
+    directory = mkdtempSync(join(tmpdir(), 'orca-hermes-remote-adapter-'))
+    mkdirSync(join(directory, '.hermes'))
+    configPath = join(directory, '.hermes', 'config.yaml')
+  })
+  afterEach(() => rmSync(directory, { recursive: true, force: true }))
+
+  it('does not rewrite a configured CRLF file or an existing backup', async () => {
+    const initial = '# operator notes\r\nplugins:\r\n  enabled: [zeta, orca-status, alpha]\r\n'
+    writeFileSync(configPath, initial)
+    writeFileSync(`${configPath}.bak`, 'recovery point')
+    const before = statSync(configPath)
+    expect((await service.installRemote(createManagedHookLocalFilesystem(), directory)).state).toBe(
+      'installed'
+    )
+    expect(readFileSync(configPath, 'utf8')).toBe(initial)
+    const after = statSync(configPath)
+    expect([after.ino, after.mtimeMs, after.mode]).toEqual([
+      before.ino,
+      before.mtimeMs,
+      before.mode
+    ])
+    expect(readFileSync(`${configPath}.bak`, 'utf8')).toBe('recovery point')
+  })
+
+  it.each(['\n', '\r\n'])(
+    'preserves comments and parsed values during real install (%j)',
+    async (eol) => {
+      const input =
+        '# notes\nmodel: "001"\nprompt: |\n  First\n  Second\nplugins:\n  enabled: [other]\n'.replaceAll(
+          '\n',
+          eol
+        )
+      writeFileSync(configPath, input)
+      const filesystem = createManagedHookLocalFilesystem()
+      expect((await service.installRemote(filesystem, directory)).state).toBe('installed')
+      const installed = readFileSync(configPath, 'utf8')
+      expect(installed).toContain('# notes')
+      expect(installed).toContain(`prompt: |${eol}  First${eol}  Second`)
+      expect(parse(installed)).toEqual({
+        ...parse(input),
+        plugins: { enabled: ['other', 'orca-status'] }
+      })
+      const before = statSync(configPath)
+      expect((await service.installRemote(filesystem, directory)).state).toBe('installed')
+      expect(statSync(configPath).ino).toBe(before.ino)
+      expect(existsSync(`${configPath}.bak`)).toBe(false)
+    }
+  )
+
+  it.skipIf(process.platform === 'win32').each([0o600, 0o640])(
+    'preserves mode %i despite umask',
+    async (mode) => {
+      writeFileSync(configPath, 'model: fixture\n')
+      chmodSync(configPath, mode)
+      const previous = process.umask(0o077)
+      try {
+        expect(
+          (await service.installRemote(createManagedHookLocalFilesystem(), directory)).state
+        ).toBe('installed')
+      } finally {
+        process.umask(previous)
+      }
+      expect(statSync(configPath).mode & 0o777).toBe(mode)
+    }
+  )
+
+  it.each(['plugins: [', 'plugins: unexpected\n', 'plugins:\n  enabled: [123]\n'])(
+    'refuses unsafe YAML before writing plugin files (%s)',
+    async (input) => {
+      writeFileSync(configPath, input)
+      expect(
+        (await service.installRemote(createManagedHookLocalFilesystem(), directory)).state
+      ).toBe('error')
+      expect(readFileSync(configPath, 'utf8')).toBe(input)
+      expect(readdirSync(join(directory, '.hermes'))).toEqual(['config.yaml'])
+    }
+  )
+
+  it('keeps the config and cleans staged files when remote rename fails', async () => {
+    writeFileSync(configPath, 'model: fixture\n')
+    const filesystem = createManagedHookLocalFilesystem()
+    const rename = filesystem.ext_openssh_rename.bind(filesystem)
+    filesystem.ext_openssh_rename = (source, destination, callback) => {
+      if (destination === configPath) {
+        callback(new Error('fixture rename refusal'))
+      } else {
+        rename(source, destination, callback)
+      }
+    }
+    expect((await service.installRemote(filesystem, directory)).state).toBe('error')
+    expect(readFileSync(configPath, 'utf8')).toBe('model: fixture\n')
+    expect(readdirSync(join(directory, '.hermes')).sort()).toEqual(['config.yaml', 'plugins'])
+  })
+})
diff --git a/src/main/hermes/hermes-config-source-edits.test.ts b/src/main/hermes/hermes-config-source-edits.test.ts
new file mode 100644
index 000000000000..01bc0a06f277
--- /dev/null
+++ b/src/main/hermes/hermes-config-source-edits.test.ts
@@ -0,0 +1,123 @@
+import { describe, expect, it } from 'vitest'
+import { parseDocument } from 'yaml'
+import { disablePlugin, enablePlugin, updateConfigContent } from './hermes-config-yaml'
+
+describe.each(['\n', '\r\n'])('Hermes source edit boundaries (%j)', (eol) => {
+  describe.each([
+    {
+      operation: 'remove',
+      key: 'enabled',
+      updater: disablePlugin,
+      expected: { enabled: [] }
+    },
+    {
+      operation: 'install',
+      key: 'disabled',
+      updater: enablePlugin,
+      expected: { disabled: [], enabled: ['orca-status'] }
+    }
+  ])('$operation with an emptied block list', ({ key, updater, expected }) => {
+    it('replaces a minimal indentless list without a final newline', () => {
+      const input = `plugins:${eol}  ${key}:${eol}  - orca-status`
+      const result = updateConfigContent(input, updater)
+      expect(result.detail).toBeUndefined()
+      const document = parseDocument(result.content ?? '')
+      expect(document.errors).toEqual([])
+      expect(document.warnings).toEqual([])
+      expect(document.toJS()).toEqual({ plugins: expected })
+    })
+
+    it.each([
+      ['indentless', '  ', '  '],
+      ['deeper indentless', '    ', '    '],
+      ['indented', '  ', '    ']
+    ])('preserves comments and unrelated settings (%s)', (_name, keyIndent, listIndent) => {
+      const prefix = [
+        'model:    "001" # untouched spacing',
+        'plugins:',
+        `${keyIndent}"${key}": # list note`,
+        `${listIndent}# first choice`,
+        ''
+      ].join(eol)
+      const custom = `${keyIndent}custom: 'off' # plugin setting${eol}`
+      const suffix = ['prompt: |-', '  First', '  Second', ''].join(eol)
+      const input = `${prefix}${listIndent}- orca-status # managed choice${eol}${custom}${suffix}`
+      const result = updateConfigContent(input, updater)
+      expect(result.detail).toBeUndefined()
+      const output = result.content ?? ''
+      const document = parseDocument(output)
+      expect(document.errors).toEqual([])
+      expect(document.warnings).toEqual([])
+      expect(document.toJS()).toEqual({
+        model: '001',
+        plugins: { ...expected, custom: 'off' },
+        prompt: 'First\nSecond'
+      })
+      expect(output.startsWith(prefix)).toBe(true)
+      expect(output).toContain(custom)
+      expect(output.endsWith(suffix)).toBe(true)
+      expect(output.match(/# managed choice/g)).toHaveLength(1)
+      if (eol === '\r\n') {
+        expect(output.replaceAll(eol, '')).not.toContain('\n')
+      }
+    })
+  })
+
+  it.each([
+    {
+      name: 'plugin trailing comma before a comment',
+      input: 'plugins: {custom: keep, # retain this comment\n  }\n',
+      expected: { plugins: { custom: 'keep', enabled: ['orca-status'] } }
+    },
+    {
+      name: 'root trailing comma before a comment',
+      input: '{model: "001", # retain this comment\n}\n',
+      expected: { model: '001', plugins: { enabled: ['orca-status'] } }
+    },
+    {
+      name: 'plugin trailing comma before several comments',
+      input: 'plugins: {custom: "keep # ,", # first\n  # last\n  } # outside\n',
+      expected: { plugins: { custom: 'keep # ,', enabled: ['orca-status'] } }
+    },
+    {
+      name: 'root trailing comma after a nested map',
+      input: '{model: {name: "001",}, # first\n # last\n}\n',
+      expected: { model: { name: '001' }, plugins: { enabled: ['orca-status'] } }
+    },
+    {
+      name: 'plugin comment ending in a comma without a separator',
+      input: 'plugins: {custom: keep # this comma is only a comment ,\n  }\n',
+      expected: { plugins: { custom: 'keep', enabled: ['orca-status'] } }
+    },
+    {
+      name: 'root comment ending in a comma without a separator',
+      input: '{model: "001" # this comma is only a comment ,\n}\n',
+      expected: { model: '001', plugins: { enabled: ['orca-status'] } }
+    },
+    {
+      name: 'earlier plugin separator without a trailing comma',
+      input: 'plugins: {custom: keep, extra: "off" # last value\n  }\n',
+      expected: { plugins: { custom: 'keep', extra: 'off', enabled: ['orca-status'] } }
+    },
+    {
+      name: 'nested sequence comma without a mapping separator',
+      input: 'plugins: {custom: [one, two,] # nested comma only\n  }\n',
+      expected: { plugins: { custom: ['one', 'two'], enabled: ['orca-status'] } }
+    }
+  ])('inserts entries with $name', ({ input, expected }) => {
+    const source = input.replaceAll('\n', eol)
+    const result = updateConfigContent(source, enablePlugin)
+    expect(result.detail).toBeUndefined()
+    const output = result.content ?? ''
+    const document = parseDocument(output)
+    expect(document.errors).toEqual([])
+    expect(document.warnings).toEqual([])
+    expect(document.toJS()).toEqual(expected)
+    const closingBrace = source.lastIndexOf('}')
+    expect(output.startsWith(source.slice(0, closingBrace))).toBe(true)
+    expect(output.endsWith(source.slice(closingBrace))).toBe(true)
+    if (eol === '\r\n') {
+      expect(output.replaceAll(eol, '')).not.toContain('\n')
+    }
+  })
+})
diff --git a/src/main/hermes/hermes-config-source-edits.ts b/src/main/hermes/hermes-config-source-edits.ts
new file mode 100644
index 000000000000..17b770e8abd7
--- /dev/null
+++ b/src/main/hermes/hermes-config-source-edits.ts
@@ -0,0 +1,158 @@
+import { isDeepStrictEqual } from 'node:util'
+import { Document, isMap, isNode, isSeq, parseDocument } from 'yaml'
+import type { Node, YAMLMap, YAMLSeq } from 'yaml'
+
+type SourceEdit = { start: number; end: number; text: string }
+
+function columnAt(source: string, offset: number): number {
+  return offset - source.lastIndexOf('\n', offset - 1) - 1
+}
+
+function indentFragment(fragment: string, difference: number): string {
+  return fragment.replace(
+    /\n( *)(?=\S)/g,
+    (_match, spaces: string) => `\n${' '.repeat(Math.max(0, spaces.length + difference))}`
+  )
+}
+
+function requireRange(node: unknown): [number, number, number] {
+  if (!isNode(node) || !node.range) {
+    throw new Error('Missing Hermes YAML source range')
+  }
+  return node.range
+}
+
+function insertPair(
+  source: string,
+  printed: string,
+  parent: YAMLMap,
+  updated: YAMLMap,
+  key: string,
+  enclosing: YAMLMap = parent
+): SourceEdit {
+  const pair = updated.items.find((item) => isNode(item.key) && item.key.toJSON() === key)
+  if (!pair) {
+    throw new Error(`Missing Hermes YAML key: ${key}`)
+  }
+  const keyRange = requireRange(pair.key)
+  const valueRange = requireRange(pair.value)
+  const parentRange = requireRange(parent)
+  if (parent.flow) {
+    const position = parentRange[1] - 1
+    if (source[position] !== '}') {
+      throw new Error('Unexpected Hermes flow mapping boundary')
+    }
+    const tail =
+      parent.srcToken?.type === 'flow-collection' ? parent.srcToken.items.at(-1) : undefined
+    const trailingComma =
+      tail?.key === undefined &&
+      tail?.sep === undefined &&
+      tail?.value === undefined &&
+      tail?.start.some((token) => token.type === 'comma')
+    const separator = parent.items.length > 0 && !trailingComma ? ', ' : ' '
+    // A flow closing brace may be outdented farther than an inserted entry or comma.
+    const minimumColumn = enclosing.flow ? 0 : columnAt(source, requireRange(enclosing)[0]) + 1
+    const column = columnAt(source, position)
+    const linePrefix = source.slice(position - column, position)
+    const spacesBeforeTab = /^( *)\t[ \t]*$/.exec(linePrefix)?.[1]?.length
+    // Tabs are separation, so insufficient leading spaces require a fresh indented line.
+    const padding =
+      spacesBeforeTab !== undefined && spacesBeforeTab < minimumColumn
+        ? `\n${' '.repeat(minimumColumn)}`
+        : ' '.repeat(Math.max(0, minimumColumn - column))
+    return {
+      start: position,
+      end: position,
+      text: padding + separator + printed.slice(keyRange[0], valueRange[1])
+    }
+  }
+  const column = columnAt(source, parentRange[0])
+  const fragment = printed.slice(keyRange[0], valueRange[2])
+  const prefix = parentRange[1] > 0 && source[parentRange[1] - 1] !== '\n' ? '\n' : ''
+  const text = `${prefix}${' '.repeat(column)}${indentFragment(fragment, column - columnAt(printed, keyRange[0]))}`
+  return {
+    start: parentRange[1],
+    end: parentRange[1],
+    text: text.endsWith('\n') ? text : `${text}\n`
+  }
+}
+
+export function applyHermesPluginSourceEdits(source: string, document: Document): string {
+  const printed = document.toString({ lineWidth: 0 })
+  const original = parseDocument(source, { keepSourceTokens: true })
+  const updated = parseDocument(printed)
+  if (!isMap(original.contents)) {
+    return source.includes('\r\n') ? printed.replaceAll('\n', '\r\n') : printed
+  }
+  if (!isMap(updated.contents)) {
+    throw new Error('Missing updated Hermes mapping')
+  }
+  const plugins = original.get('plugins', true)
+  const updatedPlugins = updated.get('plugins', true)
+  if (!isMap(updatedPlugins)) {
+    throw new Error('Missing updated Hermes plugins')
+  }
+  const edits: SourceEdit[] = []
+  if (plugins === undefined) {
+    edits.push(insertPair(source, printed, original.contents, updated.contents, 'plugins'))
+  } else {
+    if (!isMap(plugins)) {
+      throw new Error('Unexpected Hermes plugins mapping')
+    }
+    for (const key of ['enabled', 'disabled']) {
+      const previous = plugins.get(key, true)
+      const next = updatedPlugins.get(key, true)
+      if (!isNode(next)) {
+        continue
+      }
+      if (previous === undefined) {
+        edits.push(insertPair(source, printed, plugins, updatedPlugins, key, original.contents))
+      } else if (isNode(previous) && !isDeepStrictEqual(previous.toJSON(), next.toJSON())) {
+        const edited = document.createNode(document.getIn(['plugins', key], true))
+        if (!isSeq(edited)) {
+          throw new Error('Missing edited Hermes plugin list')
+        }
+        edits.push(replaceNode(source, plugins, previous, edited))
+      }
+    }
+  }
+  const newline = source.includes('\r\n') ? '\r\n' : '\n'
+  let result = source
+  for (const edit of edits.sort((a, b) => b.start - a.start)) {
+    result =
+      result.slice(0, edit.start) + edit.text.replaceAll('\n', newline) + result.slice(edit.end)
+  }
+  return result
+}
+
+function replaceNode(source: string, parent: YAMLMap, previous: Node, next: YAMLSeq): SourceEdit {
+  const before = requireRange(previous)
+  // YAML ranges can include the next key's indentation after a trailing comment.
+  const trailingIndent =
+    /(?:^|\n)([ \t]+)$/.exec(source.slice(before[0], before[2]))?.[1].length ?? 0
+  const end = before[2] - trailingIndent
+  // Printing only this list keeps neighboring comments out of its replacement.
+  const isolated = new Document()
+  const sequence = next.clone()
+  if (!isSeq(sequence)) {
+    throw new Error('Missing cloned Hermes plugin list')
+  }
+  isolated.contents = sequence
+  // The original leading comment remains outside the replaced source range.
+  isolated.contents.commentBefore = undefined
+  let fragment = isolated.toString({ lineWidth: 0 })
+  if (!source.slice(before[0], end).endsWith('\n') && !next.comment) {
+    fragment = fragment.replace(/\n$/, '')
+  }
+  const column = columnAt(source, before[0])
+  // Empty flow lists cannot use a block sequence's indentless position.
+  const replacementColumn =
+    isSeq(previous) && !previous.flow && (next.flow || next.items.length === 0)
+      ? Math.max(column, columnAt(source, requireRange(parent)[0]) + 2)
+      : column
+  return {
+    start: before[0],
+    end,
+    text: ' '.repeat(replacementColumn - column) + indentFragment(fragment, replacementColumn)
+  }
+}
diff --git a/src/main/hermes/hermes-config-yaml.ts b/src/main/hermes/hermes-config-yaml.ts
index 9641359c3ddf..c1fbdea98868 100644
--- a/src/main/hermes/hermes-config-yaml.ts
+++ b/src/main/hermes/hermes-config-yaml.ts
@@ -1,6 +1,8 @@
-import { parse, stringify } from 'yaml'
+import { isDeepStrictEqual } from 'node:util'
+import { parse } from 'yaml'
 
 import { HERMES_PLUGIN_NAME } from './hermes-managed-plugin-source'
+import { updateHermesPluginDocument } from './hermes-config-document'
 
 export type HermesConfig = Record<string, unknown>
 
@@ -41,16 +43,14 @@ export function parseHermesConfig(content: string | null): ConfigParseResult {
   }
 }
 
-export function serializeHermesConfig(config: HermesConfig): string {
-  return `${stringify(config, { lineWidth: 0 }).trimEnd()}\n`
-}
-
 export function enablePlugin(config: HermesConfig): HermesConfig {
   const next: HermesConfig = { ...config }
   const plugins = isRecord(next.plugins) ? { ...next.plugins } : {}
   const enabled = asStringArray(plugins.enabled) ?? []
   const disabled = asStringArray(plugins.disabled)
-  plugins.enabled = Array.from(new Set([...enabled, HERMES_PLUGIN_NAME])).sort()
+  plugins.enabled = enabled.includes(HERMES_PLUGIN_NAME)
+    ? enabled
+    : [...enabled, HERMES_PLUGIN_NAME]
   if (disabled === null) {
     // Why: Hermes treats a malformed disabled list as empty. Normalize it here
     // so Orca's install status matches what the real Hermes loader will do.
@@ -70,7 +70,7 @@ export function disablePlugin(config: HermesConfig): HermesConfig {
   }
   const plugins = { ...next.plugins }
   const enabled = asStringArray(plugins.enabled)
-  if (enabled !== null) {
+  if (enabled !== null && plugins.enabled !== undefined) {
     plugins.enabled = enabled.filter((name) => name !== HERMES_PLUGIN_NAME)
   }
   next.plugins = plugins
@@ -85,7 +85,11 @@ export function updateConfigContent(
   if (!parsed.ok) {
     return { content: null, detail: parsed.detail }
   }
-  return { content: serializeHermesConfig(updater(parsed.config)) }
+  const next = updater(parsed.config)
+  if (isDeepStrictEqual(parsed.config, next)) {
+    return { content: content ?? '' }
+  }
+  return updateHermesPluginDocument(content ?? '', next)
 }
 
 export function getConfigEnablement(config: HermesConfig): {
diff --git a/src/main/hermes/hermes-home-filesystem.ts b/src/main/hermes/hermes-home-filesystem.ts
index 7cd7a48a8634..9ff322d5bfa3 100644
--- a/src/main/hermes/hermes-home-filesystem.ts
+++ b/src/main/hermes/hermes-home-filesystem.ts
@@ -1,18 +1,11 @@
-import { randomUUID } from 'node:crypto'
-import {
-  copyFileSync,
-  existsSync,
-  mkdirSync,
-  readFileSync,
-  renameSync,
-  unlinkSync,
-  writeFileSync
-} from 'node:fs'
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs'
 import { homedir } from 'node:os'
-import { dirname, join } from 'node:path'
+import { join } from 'node:path'
 
 import type { ConfigParseResult, HermesConfig } from './hermes-config-yaml'
-import { parseHermesConfig, serializeHermesConfig } from './hermes-config-yaml'
+import { parseHermesConfig } from './hermes-config-yaml'
+import { resolveHooksJsonWritePath } from '../agent-hooks/hook-config-write-path'
+import { writeHooksJson } from '../agent-hooks/installer-utils'
 import {
   HERMES_PLUGIN_MARKER,
   HERMES_PLUGIN_NAME,
@@ -41,43 +34,19 @@ function getInitPath(pluginDir = getPluginDir()): string {
   return join(pluginDir, '__init__.py')
 }
 
-export function readConfigFile(configPath: string): ConfigParseResult {
-  if (!existsSync(configPath)) {
-    return { ok: true, config: {} }
-  }
-  return parseHermesConfig(readFileSync(configPath, 'utf-8'))
-}
+type ConfigFileReadResult =
+  | { ok: true; config: HermesConfig; content: string }
+  | Extract<ConfigParseResult, { ok: false }>
 
-export function writeConfigFile(configPath: string, config: HermesConfig): void {
-  const dir = dirname(configPath)
-  mkdirSync(dir, { recursive: true })
-  const serialized = serializeHermesConfig(config)
-  if (existsSync(configPath)) {
-    try {
-      if (readFileSync(configPath, 'utf-8') === serialized) {
-        return
-      }
-    } catch {
-      // Fall through to the atomic write path.
-    }
-  }
+export function readConfigFile(configPath: string): ConfigFileReadResult {
+  const readPath = resolveHooksJsonWritePath(configPath)
+  const content = existsSync(readPath) ? readFileSync(readPath, 'utf-8') : ''
+  const parsed = parseHermesConfig(content)
+  return parsed.ok ? { ...parsed, content } : parsed
+}
 
-  const tmpPath = join(dir, `.${Date.now()}-${randomUUID()}.tmp`)
-  try {
-    writeFileSync(tmpPath, serialized, 'utf-8')
-    if (existsSync(configPath)) {
-      copyFileSync(configPath, `${configPath}.bak`)
-    }
-    renameSync(tmpPath, configPath)
-  } finally {
-    if (existsSync(tmpPath)) {
-      try {
-        unlinkSync(tmpPath)
-      } catch {
-        // best effort
-      }
-    }
-  }
+export function writeConfigFile(configPath: string, content: string): void {
+  writeHooksJson(configPath, {}, { serialized: content, preserveMode: true, defaultMode: 0o600 })
 }
 
 export function getPluginFilesState(pluginDir = getPluginDir()): {
diff --git a/src/main/hermes/hook-service.test.ts b/src/main/hermes/hook-service.test.ts
index 4180caf616e5..3158b551480a 100644
--- a/src/main/hermes/hook-service.test.ts
+++ b/src/main/hermes/hook-service.test.ts
@@ -74,7 +74,7 @@ describe('HermesHookService', () => {
     expect(config.plugins.disabled).toEqual([])
   })
 
-  it('normalizes malformed plugin lists during install', () => {
+  it('refuses malformed plugin lists during install', () => {
     writeFileSync(
       join(homeDir, 'config.yaml'),
       ['plugins:', '  enabled: "not-a-list"', '  disabled: "not-a-list"', ''].join('\n'),
@@ -83,12 +83,12 @@ describe('HermesHookService', () => {
 
     const status = new HermesHookService().install()
 
-    expect(status.state).toBe('installed')
+    expect(status.state).toBe('error')
     const config = parse(readFileSync(join(homeDir, 'config.yaml'), 'utf-8')) as {
       plugins: { enabled: string[]; disabled: string[] }
     }
-    expect(config.plugins.enabled).toEqual([_internals.HERMES_PLUGIN_NAME])
-    expect(config.plugins.disabled).toEqual([])
+    expect(config.plugins.enabled).toBe('not-a-list')
+    expect(config.plugins.disabled).toBe('not-a-list')
   })
 
   it('reports partial when the plugin exists but is not enabled', () => {
diff --git a/src/main/hermes/hook-service.ts b/src/main/hermes/hook-service.ts
index 6b1b141f7214..6b6d6ec88731 100644
--- a/src/main/hermes/hook-service.ts
+++ b/src/main/hermes/hook-service.ts
@@ -96,8 +96,20 @@ export class HermesHookService {
       }
     }
 
+    const next = updateConfigContent(parsed.content, enablePlugin)
+    if (next.content === null) {
+      return {
+        agent: 'hermes',
+        state: 'error',
+        configPath,
+        managedHooksPresent: getPluginFilesState().managed,
+        detail: `Could not update Hermes config.yaml: ${next.detail ?? 'unknown error'}`
+      }
+    }
     writePluginFiles()
-    writeConfigFile(configPath, enablePlugin(parsed.config))
+    if (next.content !== parsed.content) {
+      writeConfigFile(configPath, next.content)
+    }
     return this.getStatus()
   }
 
@@ -150,11 +162,23 @@ export class HermesHookService {
         detail: `Could not parse Hermes config.yaml: ${parsed.detail}`
       }
     }
+    const next = updateConfigContent(parsed.content, disablePlugin)
+    if (next.content === null) {
+      return {
+        agent: 'hermes',
+        state: 'error',
+        configPath,
+        managedHooksPresent: getPluginFilesState().managed,
+        detail: `Could not update Hermes config.yaml: ${next.detail ?? 'unknown error'}`
+      }
+    }
+    if (next.content !== parsed.content) {
+      writeConfigFile(configPath, next.content)
+    }
     const pluginDir = getPluginDir()
     if (getPluginFilesState(pluginDir).managed) {
       rmSync(pluginDir, { recursive: true, force: true })
     }
-    writeConfigFile(configPath, disablePlugin(parsed.config))
     return this.getStatus()
   }
 }
diff --git a/src/main/index.ts b/src/main/index.ts
index 522e59b908f6..bd02d96abcc7 100644
--- a/src/main/index.ts
+++ b/src/main/index.ts
@@ -1,6 +1,7 @@
-import { app, type BrowserWindow } from 'electron'
+import { app, clipboard, dialog, type BrowserWindow } from 'electron'
 import { parseSkillShareId } from '../shared/skill-share-link'
 import { createMacAppActivationHandler } from './window/macos-app-activation'
+import { isBackgroundLaunch } from './window/foreground-activation-policy'
 import {
   focusExistingWindow as focusExistingWindowAction,
   setMainWindowOpener
@@ -13,6 +14,18 @@ import { initializeMainProcessReady } from './startup/main-process-ready'
 import { installMainProcessQuitHandlers } from './startup/main-process-quit'
 import { shouldActivateDesktopForSecondInstance } from './startup/single-instance-lock'
 import { resolveOpenedMarkdownDocuments } from './startup/os-opened-markdown-files'
+import {
+  formatProfileStateStartupFailure,
+  isDivergedProfileStateFailure,
+  profileStateStartupFailureClass
+} from './persistence/profile-state/profile-state-startup-failure'
+import { recordDurableCrashBreadcrumb } from './crash-reporting/durable-crash-breadcrumb'
+import {
+  chooseProfileStateCopy,
+  presentProfileStateStartupRecoveryDialog,
+  readProfileStateCopySavedTimes
+} from './persistence/profile-state/profile-state-startup-recovery-dialog'
+import { profileStateDesktopRecoveryArgs } from './startup/profile-state-recovery-preflight'
 
 function openMainWindow(options: { revealOnDidFinishLoad?: boolean } = {}): BrowserWindow {
   return openMainWindowController(options)
@@ -107,9 +120,55 @@ if (preflightReady) {
   registerMainProcessIpcHandlers()
   installMainProcessQuitHandlers()
   void app.whenReady().then(async () => {
-    await initializeMainProcessReady({
-      openMainWindow,
-      handleMacAppActivation
-    })
+    try {
+      await initializeMainProcessReady({
+        openMainWindow,
+        handleMacAppActivation
+      })
+    } catch (error) {
+      const message =
+        formatProfileStateStartupFailure(error) ??
+        `Orca could not finish starting: ${error instanceof Error ? error.message : String(error)}`
+      const failureClass = profileStateStartupFailureClass(error)
+      if (failureClass !== undefined) {
+        recordDurableCrashBreadcrumb('profile_state_startup_failed', {
+          failure_class: failureClass
+        })
+      }
+      console.error(`[profile-state] ${message}`)
+      if (!state.isServeMode && !isBackgroundLaunch()) {
+        try {
+          if (isDivergedProfileStateFailure(error)) {
+            const userDataPath = app.getPath('userData')
+            const choice = await chooseProfileStateCopy({
+              ...readProfileStateCopySavedTimes(userDataPath),
+              showMessageBox: (options) => dialog.showMessageBox(options)
+            })
+            if (choice !== undefined) {
+              // Recovery needs both profile locks, which only a fresh process can own safely.
+              app.relaunch({
+                args: profileStateDesktopRecoveryArgs(process.argv, {
+                  userDataPath,
+                  selector: { kind: choice }
+                })
+              })
+            }
+            app.exit(1)
+            return
+          }
+          await presentProfileStateStartupRecoveryDialog({
+            message,
+            ...(failureClass === 'recovery-required' || failureClass === 'ambiguous-authority'
+              ? { recoveryCommand: 'orca profile state exports' }
+              : {}),
+            showMessageBox: (options) => dialog.showMessageBox(options),
+            copyToClipboard: (text) => clipboard.writeText(text)
+          })
+        } catch (dialogError) {
+          console.warn('[profile-state] Recovery dialog failed; exiting safely:', dialogError)
+        }
+      }
+      app.exit(1)
+    }
   })
 }
diff --git a/src/main/ipc/agent-trust.ts b/src/main/ipc/agent-trust.ts
index 34f39570ccb9..59b7eea3cbcf 100644
--- a/src/main/ipc/agent-trust.ts
+++ b/src/main/ipc/agent-trust.ts
@@ -1,3 +1,4 @@
+import { markQoderWorkspaceTrusted } from '../qoder/workspace-trust'
 import { ipcMain } from 'electron'
 import {
   type AgentTrustPreset,
@@ -6,6 +7,7 @@ import {
   markCopilotFolderTrusted,
   markCursorWorkspaceTrusted
 } from '../agent-trust-presets'
+import { awaitAgentTrustWriteWithinDeadline } from '../agent-trust-write-deadline'
 import { markRemoteAgentWorkspaceTrusted } from '../remote-agent-trust-presets'
 
 /**
@@ -33,17 +35,25 @@ export function registerAgentTrustHandlers(): void {
         if (connectionId) {
           // Why: SSH-launched agents read trust artifacts from the remote
           // user's home, not from this desktop process.
-          await markRemoteAgentWorkspaceTrusted({
-            preset: args.preset,
-            connectionId,
-            workspacePath: args.workspacePath
-          })
+          await awaitAgentTrustWriteWithinDeadline(
+            markRemoteAgentWorkspaceTrusted({
+              preset: args.preset,
+              connectionId,
+              workspacePath: args.workspacePath
+            }),
+            { preset: args.preset, workspacePath: args.workspacePath }
+          )
+        } else if (args.preset === 'qoder') {
+          markQoderWorkspaceTrusted(args.workspacePath)
         } else if (args.preset === 'cursor') {
           markCursorWorkspaceTrusted(args.workspacePath)
         } else if (args.preset === 'copilot') {
           markCopilotFolderTrusted(args.workspacePath)
         } else if (args.preset === 'codex') {
-          markCodexProjectTrusted(args.workspacePath)
+          await awaitAgentTrustWriteWithinDeadline(markCodexProjectTrusted(args.workspacePath), {
+            preset: args.preset,
+            workspacePath: args.workspacePath
+          })
         } else if (args.preset === 'antigravity') {
           markAntigravityWorkspaceTrusted(args.workspacePath)
         }
diff --git a/src/main/ipc/ai-vault-scan-coalescing.test.ts b/src/main/ipc/ai-vault-scan-coalescing.test.ts
index d1318fa38dcf..b758aa6fc085 100644
--- a/src/main/ipc/ai-vault-scan-coalescing.test.ts
+++ b/src/main/ipc/ai-vault-scan-coalescing.test.ts
@@ -1,3 +1,4 @@
+import { EventEmitter } from 'node:events'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import type { AiVaultListResult } from '../../shared/ai-vault-types'
 import type { IFilesystemProvider } from '../providers/types'
@@ -128,37 +129,44 @@ describe('Agent Session History scan coalescing', () => {
     await expect(second).resolves.toMatchObject({ sessions: [], issues: [] })
   })
 
-  it('keeps a shared multi-window scan alive when one window cancels', async () => {
-    let resolveRelay: ((result: AiVaultListResult) => void) | undefined
-    mocks.requestActiveSshAiVaultSessionList.mockImplementation(
-      () =>
-        new Promise((resolve) => {
-          resolveRelay = resolve
-        })
-    )
-    registerAiVaultHandlers()
-    const list = ipcHandler('aiVault:listSessions')
-    const cancel = ipcHandler('aiVault:cancelListSessions')
-    const firstEvent = { sender: { id: 1 } }
-    const secondEvent = { sender: { id: 2 } }
-    const first = list(firstEvent, {
-      executionHostScope: 'ssh:dev-box',
-      requestToken: 'scan'
-    }) as Promise<AiVaultListResult>
-    const second = list(secondEvent, {
-      executionHostScope: 'ssh:dev-box',
-      requestToken: 'scan'
-    }) as Promise<AiVaultListResult>
-    await vi.waitFor(() => expect(resolveRelay).toBeDefined())
+  it.each(['cancel', 'destroyed', 'render-process-gone', 'did-navigate'])(
+    'keeps a shared multi-window scan alive when one window emits %s',
+    async (eventName) => {
+      let resolveRelay: ((result: AiVaultListResult) => void) | undefined
+      mocks.requestActiveSshAiVaultSessionList.mockImplementation(
+        () =>
+          new Promise((resolve) => {
+            resolveRelay = resolve
+          })
+      )
+      registerAiVaultHandlers()
+      const list = ipcHandler('aiVault:listSessions')
+      const cancel = ipcHandler('aiVault:cancelListSessions')
+      const firstEvent = { sender: Object.assign(new EventEmitter(), { id: 1 }) }
+      const secondEvent = { sender: Object.assign(new EventEmitter(), { id: 2 }) }
+      const first = list(firstEvent, {
+        executionHostScope: 'ssh:dev-box',
+        requestToken: 'scan'
+      }) as Promise<AiVaultListResult>
+      const second = list(secondEvent, {
+        executionHostScope: 'ssh:dev-box',
+        requestToken: 'scan'
+      }) as Promise<AiVaultListResult>
+      await vi.waitFor(() => expect(resolveRelay).toBeDefined())
 
-    cancel(firstEvent, { requestToken: 'scan' })
+      if (eventName === 'cancel') {
+        cancel(firstEvent, { requestToken: 'scan' })
+      } else {
+        firstEvent.sender.emit(eventName)
+      }
 
-    // Electron logs every rejected handler, so a cancelled scan resolves instead.
-    await expect(first).resolves.toMatchObject({ cancelled: true, sessions: [], issues: [] })
-    expect(mocks.requestActiveSshAiVaultSessionList).toHaveBeenCalledTimes(1)
-    resolveRelay?.(EMPTY_RESULT)
-    await expect(second).resolves.toEqual(EMPTY_RESULT)
-  })
+      // Electron logs every rejected handler, so a cancelled scan resolves instead.
+      await expect(first).resolves.toMatchObject({ cancelled: true, sessions: [], issues: [] })
+      expect(mocks.requestActiveSshAiVaultSessionList).toHaveBeenCalledTimes(1)
+      resolveRelay?.(EMPTY_RESULT)
+      await expect(second).resolves.toEqual(EMPTY_RESULT)
+    }
+  )
 
   it('reports a real scan failure as a host issue rather than cancellation', async () => {
     mocks.requestActiveSshAiVaultSessionList.mockRejectedValue(new Error('relay socket closed'))
@@ -169,7 +177,7 @@ describe('Agent Session History scan coalescing', () => {
     // SSH host legs convert unexpected throws into scan issues so an `all`
     // multi-host list still returns the other hosts' sessions.
     const result = await list(
-      { sender: { id: 1 } },
+      { sender: Object.assign(new EventEmitter(), { id: 1 }) },
       { executionHostScope: 'ssh:dev-box', requestToken: 'scan' }
     )
     expect(result).toMatchObject({
@@ -187,7 +195,7 @@ describe('Agent Session History scan coalescing', () => {
     // The local leg degrades like the SSH legs above: a rejection reaches the
     // renderer as a raw string painted over the list instead of an issue row.
     const result = await list(
-      { sender: { id: 1 } },
+      { sender: Object.assign(new EventEmitter(), { id: 1 }) },
       { executionHostScope: 'local', requestToken: 'scan' }
     )
     expect(result).toMatchObject({
@@ -197,6 +205,68 @@ describe('Agent Session History scan coalescing', () => {
     expect(result).not.toHaveProperty('cancelled')
   })
 
+  it('aborts local and SSH all-host legs only after the last renderer leaves', async () => {
+    const scanSignals: AbortSignal[] = []
+    const waitForAbort = (signal: AbortSignal): Promise<AiVaultListResult> => {
+      scanSignals.push(signal)
+      return new Promise((resolve) => {
+        signal.addEventListener('abort', () => resolve(EMPTY_RESULT), { once: true })
+      })
+    }
+    mocks.scanAiVaultSessionsInWorker.mockImplementation((_args, signal: AbortSignal) =>
+      waitForAbort(signal)
+    )
+    mocks.requestActiveSshAiVaultSessionList.mockImplementation(
+      (_targetId, _params, options: { signal: AbortSignal }) => waitForAbort(options.signal)
+    )
+    let resolveRuntime: ((result: AiVaultListResult) => void) | undefined
+    mocks.scanRuntimeAiVaultSessions.mockImplementation(
+      () =>
+        new Promise((resolve) => {
+          resolveRuntime = resolve
+        })
+    )
+    registerRuntimeHost()
+    const list = ipcHandler('aiVault:listSessions')
+    const firstEvent = { sender: Object.assign(new EventEmitter(), { id: 1 }) }
+    const secondEvent = { sender: Object.assign(new EventEmitter(), { id: 2 }) }
+    const first = list(firstEvent, { executionHostScope: 'all', requestToken: 'scan' })
+    const second = list(secondEvent, { executionHostScope: 'all', requestToken: 'scan' })
+    await vi.waitFor(() => expect(scanSignals).toHaveLength(2))
+    await vi.waitFor(() => expect(resolveRuntime).toBeDefined())
+
+    firstEvent.sender.emit('did-navigate')
+    await expect(first).resolves.toMatchObject({ cancelled: true })
+    expect(scanSignals.every((signal) => !signal.aborted)).toBe(true)
+    secondEvent.sender.emit('render-process-gone')
+    await expect(second).resolves.toMatchObject({ cancelled: true })
+    expect(scanSignals.every((signal) => signal.aborted)).toBe(true)
+    for (const event of [firstEvent, secondEvent]) {
+      expect(event.sender.eventNames()).toEqual([])
+    }
+    // Runtime RPC cannot be canceled; its late result remains safely observed.
+    resolveRuntime?.(EMPTY_RESULT)
+  })
+
+  it('does not start an abandoned scan after ownership initialization completes', async () => {
+    let finishOwnership: (() => void) | undefined
+    registerAiVaultHandlers({
+      ensureStructuredSessionOwnership: () =>
+        new Promise<void>((resolve) => {
+          finishOwnership = resolve
+        })
+    })
+    const event = { sender: Object.assign(new EventEmitter(), { id: 1 }) }
+    const pending = ipcHandler('aiVault:listSessions')(event, { requestToken: 'scan' })
+
+    event.sender.emit('did-navigate')
+    finishOwnership?.()
+
+    await expect(pending).resolves.toMatchObject({ cancelled: true })
+    expect(mocks.scanAiVaultSessionsInWorker).not.toHaveBeenCalled()
+    expect(event.sender.eventNames()).toEqual([])
+  })
+
   it('re-joins a preempted same-scope caller onto the forced refresh', async () => {
     const signals: AbortSignal[] = []
     let resolveForced: ((result: AiVaultListResult) => void) | undefined
diff --git a/src/main/ipc/ai-vault.test.ts b/src/main/ipc/ai-vault.test.ts
index 17f282e54bee..b9f5661e19c4 100644
--- a/src/main/ipc/ai-vault.test.ts
+++ b/src/main/ipc/ai-vault.test.ts
@@ -1,3 +1,4 @@
+import { EventEmitter } from 'node:events'
 import { homedir } from 'node:os'
 import { join, sep } from 'node:path'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
@@ -488,20 +489,17 @@ describe('listAiVaultSessions host routing', () => {
         })
     )
     registerAiVaultHandlers()
-    const event = { sender: { id: 7 } }
+    const event = { sender: Object.assign(new EventEmitter(), { id: 7 }) }
     const pending = getIpcHandler('aiVault:listSessions')(event, {
       executionHostScope: 'ssh:dev-box',
       requestToken: 'scan-1'
     })
     await vi.waitFor(() => expect(relaySignal).toBeDefined())
 
-    await getIpcHandler('aiVault:cancelListSessions')(event, {
-      requestToken: 'scan-1'
-    })
+    await getIpcHandler('aiVault:cancelListSessions')(event, { requestToken: 'scan-1' })
 
     expect(relaySignal?.aborted).toBe(true)
-    // Resolved, not rejected: Electron logs every rejected handler, and a
-    // superseded scan is normal control flow rather than a failure.
+    // Superseded scans resolve because Electron logs every rejected handler.
     await expect(pending).resolves.toMatchObject({ cancelled: true, sessions: [] })
   })
 })
diff --git a/src/main/ipc/cursor-accounts.ts b/src/main/ipc/cursor-accounts.ts
new file mode 100644
index 000000000000..78273dfb1cb2
--- /dev/null
+++ b/src/main/ipc/cursor-accounts.ts
@@ -0,0 +1,6 @@
+import { ipcMain } from 'electron'
+import { getCursorAccountStatus } from '../cursor-accounts/status'
+
+export function registerCursorAccountHandlers(): void {
+  ipcMain.handle('cursorAccounts:getStatus', () => getCursorAccountStatus())
+}
diff --git a/src/main/ipc/desktop-renderer-runtime-capabilities.ts b/src/main/ipc/desktop-renderer-runtime-capabilities.ts
index 63ba9b1d0b11..0bcfd1bd686d 100644
--- a/src/main/ipc/desktop-renderer-runtime-capabilities.ts
+++ b/src/main/ipc/desktop-renderer-runtime-capabilities.ts
@@ -1,5 +1,6 @@
 import {
   AGENT_LAUNCH_RUNTIME_CAPABILITY,
+  AGENT_SESSION_ACCEPTED_SEND_RUNTIME_CAPABILITY,
   AGENT_SESSION_BACKGROUND_TASK_ROW_STOP_CAPABILITY,
   AGENT_SESSION_BACKGROUND_TASK_STOP_CAPABILITY,
   AGENT_SESSION_PENDING_SEND_RESULT_RUNTIME_CAPABILITY,
@@ -25,6 +26,7 @@ import {
 export const DESKTOP_RENDERER_RUNTIME_CLIENT_CAPABILITIES: readonly RuntimeCapability[] = [
   AGENT_SESSION_BACKGROUND_TASK_STOP_CAPABILITY,
   AGENT_SESSION_PENDING_SEND_RESULT_RUNTIME_CAPABILITY,
+  AGENT_SESSION_ACCEPTED_SEND_RUNTIME_CAPABILITY,
   AGENT_SESSION_TURN_ITEM_CAPABILITY,
   AGENT_SESSION_BACKGROUND_TASK_ROW_STOP_CAPABILITY,
   STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY,
diff --git a/src/main/ipc/emulator-frame-stream-socket-lifetime.test.ts b/src/main/ipc/emulator-frame-stream-socket-lifetime.test.ts
new file mode 100644
index 000000000000..e09b897af932
--- /dev/null
+++ b/src/main/ipc/emulator-frame-stream-socket-lifetime.test.ts
@@ -0,0 +1,71 @@
+import { EventEmitter, once } from 'node:events'
+import { createServer, type Server } from 'node:http'
+import type { Socket } from 'node:net'
+import { afterEach, expect, it, vi } from 'vitest'
+
+const handlers = new Map<string, (event: unknown, args: unknown) => unknown>()
+vi.mock('electron', () => ({
+  ipcMain: {
+    handle: (channel: string, handler: (event: unknown, args: unknown) => unknown) => {
+      handlers.set(channel, handler)
+    }
+  },
+  BrowserWindow: { fromWebContents: () => ({}) }
+}))
+
+import { registerEmulatorFrameStreamHandlers } from './emulator-frame-stream'
+
+class Owner extends EventEmitter {
+  isDestroyed = (): boolean => false
+  send = (): void => {
+    this.emit('frame-received')
+  }
+}
+
+let server: Server | null = null
+let owner: Owner | null = null
+
+afterEach(async () => {
+  owner?.emit('destroyed')
+  owner = null
+  if (server) {
+    server.closeAllConnections()
+    await new Promise<void>((resolve) => server?.close(() => resolve()))
+    server = null
+  }
+})
+
+it.each(['did-navigate', 'render-process-gone', 'destroyed'])(
+  'closes the live MJPEG HTTP socket after %s',
+  async (goneEvent) => {
+    registerEmulatorFrameStreamHandlers()
+    const sockets = new Set<Socket>()
+    const httpServer = createServer((_request, response) => {
+      response.writeHead(200, { 'content-type': 'application/octet-stream' })
+      response.write(Buffer.from([0xff, 0xd8, 0x01, 0x02, 0xff, 0xd9]))
+    })
+    server = httpServer
+    httpServer.on('connection', (socket) => {
+      sockets.add(socket)
+      socket.once('close', () => sockets.delete(socket))
+    })
+    await new Promise<void>((resolve) => httpServer.listen(0, '127.0.0.1', resolve))
+    const address = httpServer.address()
+    if (!address || typeof address === 'string') {
+      throw new Error('Expected TCP address')
+    }
+    const sender = new Owner()
+    owner = sender
+    const frameReceived = once(sender, 'frame-received')
+    handlers.get('emulator:frameStreamStart')?.(
+      { sender },
+      { streamUrl: `http://127.0.0.1:${address.port}/stream.mjpeg` }
+    )
+    await frameReceived
+    expect(sockets.size).toBe(1)
+    const closed = Promise.all(Array.from(sockets, (socket) => once(socket, 'close')))
+    sender.emit(goneEvent)
+    await closed
+    expect(sockets.size).toBe(0)
+  }
+)
diff --git a/src/main/ipc/emulator-frame-stream.ts b/src/main/ipc/emulator-frame-stream.ts
index 4cf8eee1a5b0..9a8067041543 100644
--- a/src/main/ipc/emulator-frame-stream.ts
+++ b/src/main/ipc/emulator-frame-stream.ts
@@ -1,11 +1,11 @@
-import { BrowserWindow, ipcMain, type WebContents } from 'electron'
+import { BrowserWindow, ipcMain } from 'electron'
 import { randomUUID } from 'node:crypto'
 import { MjpegFrameStream } from '../emulator/mjpeg-frame-stream'
+import { abortWhenRendererGone } from './renderer-lifetime-abort'
 
 type FrameStreamSession = {
-  owner: WebContents
   stream: MjpegFrameStream
-  onOwnerDestroyed: () => void
+  disposeLifetime: () => void
 }
 
 const sessions = new Map<string, FrameStreamSession>()
@@ -15,11 +15,9 @@ function stopFrameStream(streamId: string): void {
   if (!session) {
     return
   }
-  session.stream.stop()
-  // Why: `.once('destroyed')` self-removes only when that event fires (window
-  // close), so an explicit stop must drop it or each show/hide cycle leaks one.
-  session.owner.removeListener('destroyed', session.onOwnerDestroyed)
   sessions.delete(streamId)
+  session.disposeLifetime()
+  session.stream.stop()
 }
 
 function frameToArrayBuffer(frame: Buffer<ArrayBufferLike>): ArrayBuffer {
@@ -45,12 +43,12 @@ export function registerEmulatorFrameStreamHandlers(): void {
         args.streamUrl,
         {
           onError: (message) => {
-            if (!owner.isDestroyed()) {
+            if (sessions.has(streamId) && !owner.isDestroyed()) {
               owner.send('emulator:frameStreamError', { streamId, message })
             }
           },
           onFrame: (frame) => {
-            if (!owner.isDestroyed()) {
+            if (sessions.has(streamId) && !owner.isDestroyed()) {
               owner.send('emulator:frameStreamFrame', {
                 streamId,
                 bytes: frameToArrayBuffer(frame)
@@ -61,10 +59,22 @@ export function registerEmulatorFrameStreamHandlers(): void {
         args.streamKey
       )
 
-      const onOwnerDestroyed = (): void => stopFrameStream(streamId)
-      sessions.set(streamId, { owner, stream, onOwnerDestroyed })
-      owner.once('destroyed', onOwnerDestroyed)
-      stream.start()
+      const lifetime = abortWhenRendererGone(owner)
+      const onRendererGone = (): void => stopFrameStream(streamId)
+      sessions.set(streamId, {
+        stream,
+        disposeLifetime: () => {
+          lifetime.signal.removeEventListener('abort', onRendererGone)
+          lifetime.dispose()
+        }
+      })
+      lifetime.signal.addEventListener('abort', onRendererGone, { once: true })
+      try {
+        stream.start()
+      } catch (error) {
+        stopFrameStream(streamId)
+        throw error
+      }
       return { streamId }
     }
   )
diff --git a/src/main/ipc/emulator-renderer-lifetime.test.ts b/src/main/ipc/emulator-renderer-lifetime.test.ts
new file mode 100644
index 000000000000..ecaa54b20ce0
--- /dev/null
+++ b/src/main/ipc/emulator-renderer-lifetime.test.ts
@@ -0,0 +1,233 @@
+import { EventEmitter } from 'node:events'
+import { afterEach, beforeEach, expect, it, vi } from 'vitest'
+import type { MjpegFrameStreamCallbacks } from '../emulator/mjpeg-frame-stream'
+import type { ScrcpyVideoSubscriber } from '../emulator/scrcpy-video-registry'
+
+const mocks = vi.hoisted(() => ({
+  handlers: new Map<string, (event: unknown, args: unknown) => unknown>(),
+  frameCallbacks: new Set<MjpegFrameStreamCallbacks>(),
+  videoSubscribers: new Set<ScrcpyVideoSubscriber>(),
+  frameStarts: vi.fn(),
+  frameStops: vi.fn(),
+  videoStarts: vi.fn(),
+  videoStops: vi.fn()
+}))
+
+vi.mock('electron', () => ({
+  ipcMain: {
+    handle: (channel: string, handler: (event: unknown, args: unknown) => unknown) => {
+      mocks.handlers.set(channel, handler)
+    }
+  },
+  BrowserWindow: { fromWebContents: () => ({}) }
+}))
+vi.mock('../emulator/mjpeg-frame-stream', () => ({
+  MjpegFrameStream: class {
+    constructor(
+      _url: string,
+      private callbacks: MjpegFrameStreamCallbacks
+    ) {}
+    start(): void {
+      mocks.frameStarts()
+      mocks.frameCallbacks.add(this.callbacks)
+    }
+    stop(): void {
+      mocks.frameStops()
+      mocks.frameCallbacks.delete(this.callbacks)
+    }
+  }
+}))
+vi.mock('../emulator/scrcpy-video-registry', () => ({
+  scrcpyVideoRegistry: {
+    subscribe: (_deviceId: string, subscriber: ScrcpyVideoSubscriber) => {
+      mocks.videoStarts()
+      mocks.videoSubscribers.add(subscriber)
+      return () => {
+        mocks.videoStops()
+        mocks.videoSubscribers.delete(subscriber)
+      }
+    }
+  }
+}))
+vi.mock('../emulator/emulator-probe', () => ({ emulatorProbe: () => {} }))
+
+import { registerEmulatorFrameStreamHandlers } from './emulator-frame-stream'
+import { registerEmulatorVideoStreamHandlers } from './emulator-video-stream'
+
+class Owner extends EventEmitter {
+  send = vi.fn()
+  isDestroyed = (): boolean => false
+}
+
+const owners: Owner[] = []
+const goneEvents = ['did-navigate', 'render-process-gone', 'destroyed'] as const
+
+function owner(): Owner {
+  const sender = new Owner()
+  owners.push(sender)
+  return sender
+}
+
+function start(sender: Owner, kind: 'frame' | 'video'): string {
+  const result = mocks.handlers.get(`emulator:${kind}StreamStart`)?.(
+    { sender },
+    kind === 'frame'
+      ? { streamUrl: 'http://127.0.0.1:0/stream.mjpeg' }
+      : { deviceId: 'emulator-5554' }
+  )
+  if (!result || typeof result !== 'object' || !('streamId' in result)) {
+    throw new Error('Missing stream result')
+  }
+  if (typeof result.streamId !== 'string') {
+    throw new Error('Missing stream id')
+  }
+  return result.streamId
+}
+
+function sendFrames(): void {
+  for (const callbacks of mocks.frameCallbacks) {
+    callbacks.onFrame(Buffer.from([0xff, 0xd8, 0xff, 0xd9]))
+  }
+  for (const subscriber of mocks.videoSubscribers) {
+    subscriber({
+      type: 'frame',
+      frame: { config: false, keyFrame: true, pts: '0', bytes: new ArrayBuffer(4) }
+    })
+  }
+}
+
+beforeEach(() => {
+  vi.useFakeTimers()
+  vi.clearAllMocks()
+  registerEmulatorFrameStreamHandlers()
+  registerEmulatorVideoStreamHandlers()
+})
+
+afterEach(() => {
+  for (const sender of owners.splice(0)) {
+    sender.emit('destroyed')
+  }
+  vi.clearAllTimers()
+  vi.useRealTimers()
+  mocks.frameCallbacks.clear()
+  mocks.videoSubscribers.clear()
+})
+
+it.each(goneEvents)('stops both live streams on %s and leaves no per-frame delivery', (event) => {
+  const sender = owner()
+  start(sender, 'frame')
+  start(sender, 'video')
+  vi.runOnlyPendingTimers()
+  sendFrames()
+  expect(sender.send).toHaveBeenCalledTimes(2)
+
+  sender.emit(event)
+  expect(mocks.frameCallbacks.size).toBe(0)
+  expect(mocks.videoSubscribers.size).toBe(0)
+  expect(mocks.frameStops).toHaveBeenCalledTimes(1)
+  expect(mocks.videoStops).toHaveBeenCalledTimes(1)
+  sendFrames()
+  expect(sender.send).toHaveBeenCalledTimes(2)
+  for (const gone of goneEvents) {
+    expect(sender.listenerCount(gone)).toBe(0)
+  }
+})
+
+it.each(goneEvents)('does not start deferred video work after %s', (event) => {
+  const sender = owner()
+  start(sender, 'video')
+  sender.emit(event)
+  vi.runOnlyPendingTimers()
+  expect(mocks.videoStarts).not.toHaveBeenCalled()
+  expect(mocks.videoSubscribers.size).toBe(0)
+})
+
+it('keeps only the current document streams after repeated reloads', () => {
+  const sender = owner()
+  for (let cycle = 0; cycle < 15; cycle++) {
+    start(sender, 'frame')
+    start(sender, 'video')
+    vi.runOnlyPendingTimers()
+    sender.emit('did-navigate')
+  }
+  start(sender, 'frame')
+  start(sender, 'video')
+  vi.runOnlyPendingTimers()
+  expect(mocks.frameCallbacks.size).toBe(1)
+  expect(mocks.videoSubscribers.size).toBe(1)
+  sendFrames()
+  expect(sender.send).toHaveBeenCalledTimes(2)
+})
+
+it('keeps streams through same-document or prevented navigation and releases on explicit stop', () => {
+  const sender = owner()
+  const frameId = start(sender, 'frame')
+  const videoId = start(sender, 'video')
+  vi.runOnlyPendingTimers()
+  sender.emit('did-start-navigation')
+  sender.emit('did-navigate-in-page')
+  sendFrames()
+  expect(sender.send).toHaveBeenCalledTimes(2)
+  mocks.handlers.get('emulator:frameStreamStop')?.({ sender }, { streamId: frameId })
+  mocks.handlers.get('emulator:videoStreamStop')?.({ sender }, { streamId: videoId })
+  expect(mocks.frameCallbacks.size).toBe(0)
+  expect(mocks.videoSubscribers.size).toBe(0)
+  for (const event of goneEvents) {
+    expect(sender.listenerCount(event)).toBe(0)
+  }
+})
+
+it('releases a failed frame-stream start without retaining renderer listeners', () => {
+  const sender = owner()
+  mocks.frameStarts.mockImplementationOnce(() => {
+    throw new Error('Stream unavailable')
+  })
+  expect(() => start(sender, 'frame')).toThrow('Stream unavailable')
+  expect(mocks.frameStops).toHaveBeenCalledTimes(1)
+  for (const event of goneEvents) {
+    expect(sender.listenerCount(event)).toBe(0)
+  }
+})
+
+it('keeps another renderer streams live when the first document reloads', () => {
+  const first = owner()
+  const second = owner()
+  for (const sender of [first, second]) {
+    start(sender, 'frame')
+    start(sender, 'video')
+  }
+  vi.runOnlyPendingTimers()
+  first.emit('did-navigate')
+  sendFrames()
+  expect(first.send).not.toHaveBeenCalled()
+  expect(second.send).toHaveBeenCalledTimes(2)
+  expect(mocks.frameCallbacks.size).toBe(1)
+  expect(mocks.videoSubscribers.size).toBe(1)
+})
+
+it.each([...goneEvents, 'explicit stop'] as const)(
+  'suppresses retired frame callbacks after %s while keeping current stream errors',
+  (event) => {
+    const sender = owner()
+    const streamId = start(sender, 'frame')
+    const callbacks = [...mocks.frameCallbacks][0]
+    callbacks.onError('active failure')
+    expect(sender.send).toHaveBeenCalledWith('emulator:frameStreamError', {
+      streamId,
+      message: 'active failure'
+    })
+    sender.send.mockClear()
+    mocks.frameStops.mockImplementationOnce(() => callbacks.onError('stop failure'))
+    if (event === 'explicit stop') {
+      mocks.handlers.get('emulator:frameStreamStop')?.({ sender }, { streamId })
+    } else {
+      sender.emit(event)
+    }
+    start(sender, 'frame')
+    callbacks.onError('late failure')
+    callbacks.onFrame(Buffer.from([0xff, 0xd8, 0xff, 0xd9]))
+    expect(sender.send).not.toHaveBeenCalled()
+    sendFrames()
+    expect(sender.send).toHaveBeenCalledOnce()
+  }
+)
diff --git a/src/main/ipc/emulator-video-stream.ts b/src/main/ipc/emulator-video-stream.ts
index 8bfe83671039..f6aeb8f2f75c 100644
--- a/src/main/ipc/emulator-video-stream.ts
+++ b/src/main/ipc/emulator-video-stream.ts
@@ -2,6 +2,7 @@ import { BrowserWindow, ipcMain, type WebContents } from 'electron'
 import { randomUUID } from 'node:crypto'
 import { scrcpyVideoRegistry } from '../emulator/scrcpy-video-registry'
 import { emulatorProbe } from '../emulator/emulator-probe'
+import { abortWhenRendererGone } from './renderer-lifetime-abort'
 
 // Bridges the main-process scrcpy video registry to renderer subscribers. The
 // renderer calls emulator:videoStreamStart with a deviceId; meta + H.264 access
@@ -11,7 +12,8 @@ export function registerEmulatorVideoStreamHandlers(): void {
   type Subscription = {
     owner: WebContents
     unsubscribe: () => void
-    onOwnerDestroyed: () => void
+    disposeLifetime: () => void
+    startTimer: ReturnType<typeof setTimeout> | null
   }
   const subscriptions = new Map<string, Subscription>()
 
@@ -20,11 +22,12 @@ export function registerEmulatorVideoStreamHandlers(): void {
     if (!subscription || (owner && subscription.owner !== owner)) {
       return
     }
-    subscription.unsubscribe()
-    // Why: `.once('destroyed')` self-removes only when that event fires (window
-    // close), so an explicit stop must drop it or each show/hide cycle leaks one.
-    subscription.owner.removeListener('destroyed', subscription.onOwnerDestroyed)
     subscriptions.delete(streamId)
+    if (subscription.startTimer !== null) {
+      clearTimeout(subscription.startTimer)
+    }
+    subscription.disposeLifetime()
+    subscription.unsubscribe()
   }
 
   ipcMain.handle(
@@ -44,14 +47,21 @@ export function registerEmulatorVideoStreamHandlers(): void {
         throw new Error('Video stream id is already in use by another renderer')
       }
       stopSubscription(streamId, owner)
-      const onOwnerDestroyed = (): void => stopSubscription(streamId, owner)
+      const lifetime = abortWhenRendererGone(owner)
+      const onRendererGone = (): void => stopSubscription(streamId, owner)
       const pendingSubscription: Subscription = {
         owner,
         unsubscribe: () => {},
-        onOwnerDestroyed
+        disposeLifetime: () => {
+          lifetime.signal.removeEventListener('abort', onRendererGone)
+          lifetime.dispose()
+        },
+        startTimer: null
       }
       subscriptions.set(streamId, pendingSubscription)
-      setTimeout(() => {
+      lifetime.signal.addEventListener('abort', onRendererGone, { once: true })
+      pendingSubscription.startTimer = setTimeout(() => {
+        pendingSubscription.startTimer = null
         if (owner.isDestroyed() || subscriptions.get(streamId) !== pendingSubscription) {
           return
         }
@@ -75,7 +85,6 @@ export function registerEmulatorVideoStreamHandlers(): void {
         })
         pendingSubscription.unsubscribe = unsubscribe
       }, 0)
-      owner.once('destroyed', onOwnerDestroyed)
       return { streamId }
     }
   )
diff --git a/src/main/ipc/filesystem-allowed-roots.ts b/src/main/ipc/filesystem-allowed-roots.ts
index fb4e9854c2e8..115e038218d6 100644
--- a/src/main/ipc/filesystem-allowed-roots.ts
+++ b/src/main/ipc/filesystem-allowed-roots.ts
@@ -1,4 +1,4 @@
-import { resolve } from 'node:path'
+import { isAbsolute, resolve } from 'node:path'
 import type { Store } from '../persistence'
 import { computeWorkspaceRoot, getWorktreePathSettings } from './worktree-logic'
 import {
@@ -14,13 +14,13 @@ import {
 import type { FolderWorkspace } from '../../shared/folder-workspace-types'
 import type { ProjectGroup } from '../../shared/project-group-types'
 import type { Repo } from '../../shared/repo-types'
+import { hasRemoteFilesystemOwner } from './remote-filesystem-owner'
 
 type FolderScopeStore = Pick<Store, 'getRepos'> &
   Partial<Pick<Store, 'getProjectGroups' | 'getFolderWorkspaces'>>
 
-// Why: SSH repo paths are remote-host paths; treating them as local roots could authorize unrelated local folders or probe SSH-only paths.
 function filterLocalRepos(repos: readonly Repo[]): Repo[] {
-  return repos.filter((repo) => !repo.connectionId)
+  return repos.filter((repo) => !hasRemoteFilesystemOwner(repo))
 }
 
 export function getLocalRepos(store: Store) {
@@ -30,11 +30,11 @@ export function getLocalRepos(store: Store) {
 function isRemoteOnlyFolderScope(
   folderPath: string,
   projectGroupId: string,
-  connectionId: string | null | undefined,
+  hasRemoteOwner: boolean,
   childGroupIndex: ProjectGroupChildIndex,
   repos: readonly Repo[]
 ): boolean {
-  if (connectionId) {
+  if (hasRemoteOwner) {
     return true
   }
   const groupIds = collectProjectGroupSubtreeIds(childGroupIndex, projectGroupId)
@@ -45,7 +45,7 @@ function isRemoteOnlyFolderScope(
       isPathInsideOrEqual(folderPath, repo.path)
     ) {
       // One local candidate settles the scope without scanning the remaining repositories.
-      if (!repo.connectionId) {
+      if (!hasRemoteFilesystemOwner(repo)) {
         return false
       }
       hasRemoteCandidate = true
@@ -54,15 +54,21 @@ function isRemoteOnlyFolderScope(
   return hasRemoteCandidate
 }
 
-function getFolderWorkspaceConnectionId(
+/**
+ * Deliberately stricter than `resolveFolderWorkspaceHost`, which lets the workspace's own
+ * `executionHostId` pin win: a workspace pinned `local` under a group carrying only a legacy
+ * `connectionId` dispatches locally but is denied here. Letting the pin win would hand out a root
+ * the store refuses today, so authorization keeps the fail-closed read of either field.
+ */
+function hasRemoteFolderWorkspaceOwner(
   workspace: FolderWorkspace,
   projectGroups: readonly ProjectGroup[]
-): string | null {
-  return (
-    workspace.connectionId ??
-    projectGroups.find((group) => group.id === workspace.projectGroupId)?.connectionId ??
-    null
-  )
+): boolean {
+  const group = projectGroups.find((group) => group.id === workspace.projectGroupId)
+  return hasRemoteFilesystemOwner({
+    connectionId: workspace.connectionId ?? group?.connectionId,
+    executionHostId: workspace.executionHostId ?? group?.executionHostId
+  })
 }
 
 function getLocalFolderScopeRoots(store: Store, repos: readonly Repo[]): string[] {
@@ -77,7 +83,7 @@ function getLocalFolderScopeRoots(store: Store, repos: readonly Repo[]): string[
       !isRemoteOnlyFolderScope(
         group.parentPath,
         group.id,
-        group.connectionId,
+        hasRemoteFilesystemOwner(group),
         childGroupIndex,
         repos
       )
@@ -90,7 +96,7 @@ function getLocalFolderScopeRoots(store: Store, repos: readonly Repo[]): string[
       !isRemoteOnlyFolderScope(
         workspace.folderPath,
         workspace.projectGroupId,
-        getFolderWorkspaceConnectionId(workspace, projectGroups),
+        hasRemoteFolderWorkspaceOwner(workspace, projectGroups),
         childGroupIndex,
         repos
       )
@@ -101,6 +107,28 @@ function getLocalFolderScopeRoots(store: Store, repos: readonly Repo[]): string[
   return roots
 }
 
+/** The single path implementation that both judges and resolves a local root. */
+type HostPathResolver = {
+  isAbsolute: (value: string) => boolean
+  resolve: (value: string) => string
+}
+
+/**
+ * The allowed root a `workspaceDir` with no local repo to anchor it may contribute, or `null`.
+ *
+ * The predicate has to be the host's own, not `isRuntimePathAbsolute`: that helper accepts either
+ * flavour, so on POSIX it calls `C:\ws` absolute while this `resolve` reads the same string as a
+ * relative name and anchors the root under the main-process cwd — authorizing an unrelated local
+ * tree. Pairing both here keeps them from diverging again; `hostPath` is injectable so the
+ * flavour matrix can run POSIX and Windows without the test choosing on `process.platform`.
+ */
+export function resolveUnanchoredWorkspaceRoot(
+  workspaceDir: string,
+  hostPath: HostPathResolver = { isAbsolute, resolve }
+): string | null {
+  return hostPath.isAbsolute(workspaceDir) ? hostPath.resolve(workspaceDir) : null
+}
+
 export function getAllowedRoots(store: Store): string[] {
   // Why one read: `getRepos` rehydrates every repo, and this runs twice per filesystem IPC.
   const repos = store.getRepos()
@@ -112,7 +140,10 @@ export function getAllowedRoots(store: Store): string[] {
   ]
   if (settings.workspaceDir) {
     if (localRepos.length === 0) {
-      roots.push(resolve(settings.workspaceDir))
+      const unanchoredRoot = resolveUnanchoredWorkspaceRoot(settings.workspaceDir)
+      if (unanchoredRoot) {
+        roots.push(unanchoredRoot)
+      }
     } else {
       const projectRuntimeByRepoId = resolveLocalProjectRuntimesForRepos(store, localRepos)
       for (const repo of localRepos) {
diff --git a/src/main/ipc/filesystem-auth.ts b/src/main/ipc/filesystem-auth.ts
index 894e39945c16..6110ea7baf20 100644
--- a/src/main/ipc/filesystem-auth.ts
+++ b/src/main/ipc/filesystem-auth.ts
@@ -183,7 +183,7 @@ async function isPathAllowedIncludingRegisteredWorktrees(
     return true
   }
 
-  if (isRegisteredWorktreePath(targetPath)) {
+  if (isRegisteredWorktreePath(targetPath, store)) {
     return true
   }
 
@@ -198,7 +198,9 @@ async function isPathAllowedIncludingRegisteredWorktrees(
     return true
   }
 
-  if (await isPathAllowedByCanonicalRegisteredRoot(targetPath, options.canonicalSourcePath)) {
+  if (
+    await isPathAllowedByCanonicalRegisteredRoot(targetPath, options.canonicalSourcePath, store)
+  ) {
     return true
   }
 
@@ -206,8 +208,8 @@ async function isPathAllowedIncludingRegisteredWorktrees(
 
   // Why: linked worktrees are already git-trusted; reuse the cached root index so reads don't spawn `git worktree list` each time.
   return (
-    isRegisteredWorktreePath(targetPath) ||
-    (await isPathAllowedByCanonicalRegisteredRoot(targetPath, options.canonicalSourcePath))
+    isRegisteredWorktreePath(targetPath, store) ||
+    (await isPathAllowedByCanonicalRegisteredRoot(targetPath, options.canonicalSourcePath, store))
   )
 }
 
diff --git a/src/main/ipc/filesystem-canonical-owner.test.ts b/src/main/ipc/filesystem-canonical-owner.test.ts
new file mode 100644
index 000000000000..ec4888a3f526
--- /dev/null
+++ b/src/main/ipc/filesystem-canonical-owner.test.ts
@@ -0,0 +1,369 @@
+import { join, posix, resolve, win32 } from 'node:path'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type { Store } from '../persistence'
+import type { Repo } from '../../shared/repo-types'
+import type { ProjectGroup } from '../../shared/project-group-types'
+import type { FolderWorkspace } from '../../shared/folder-workspace-types'
+import { resolveFolderWorkspaceHost } from '../../shared/folder-workspace-execution-host'
+import {
+  getAllowedRoots,
+  getLocalRepos,
+  resolveUnanchoredWorkspaceRoot
+} from './filesystem-allowed-roots'
+import { isPathAllowed } from './filesystem-auth'
+import {
+  __resetCreatedWorktreeRootsForTests,
+  invalidateAuthorizedRootsCache,
+  isRegisteredWorktreePath,
+  rebuildAuthorizedRootsCache,
+  registerCreatedWorktreeRoot,
+  registerWorktreeRootsForRepo
+} from './registered-worktree-roots-cache'
+
+const mocks = vi.hoisted(() => ({
+  graph: vi.fn(),
+  stat: vi.fn(),
+  realpath: vi.fn(),
+  workspaceRoot: vi.fn(),
+  pathSettings: vi.fn(),
+  projectRuntimes: vi.fn()
+}))
+vi.mock('node:fs/promises', () => ({ stat: mocks.stat, realpath: mocks.realpath }))
+vi.mock('../repo-worktrees', () => ({ listRepoWorktreeGraph: mocks.graph, isRepoRoot: vi.fn() }))
+vi.mock('./worktree-logic', () => ({
+  computeWorkspaceRoot: mocks.workspaceRoot,
+  getWorktreePathSettings: mocks.pathSettings
+}))
+vi.mock('../project-runtime-git-options', () => ({
+  getWorktreeMirrorDistroForRuntime: vi.fn(),
+  resolveLocalProjectRuntimesForRepos: mocks.projectRuntimes
+}))
+
+/**
+ * Widened past `Repo['executionHostId']` on purpose: the union names the stamps Orca writes, while a
+ * store carries whatever an older build, a hand-edited catalog or a partial migration left behind.
+ * Those are exactly the stamps authorization has to place, so the matrix must be able to build them.
+ */
+type Owner = { connectionId?: string | null; executionHostId?: string | null }
+const root = resolve('/owner-fixture')
+const linked = resolve('/linked-fixture')
+function repo(owner: Owner = {}, overrides: Partial<Repo> = {}): Repo {
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: only `executionHostId` leaves the union, and only to the malformed stamps above; every other field is a checked `Repo` field.
+  return {
+    id: 'repo',
+    path: root,
+    displayName: 'repo',
+    badgeColor: '#000',
+    addedAt: 0,
+    ...owner,
+    ...overrides
+  } as Repo
+}
+function group(owner: Owner = {}, overrides: Partial<ProjectGroup> = {}): ProjectGroup {
+  return {
+    id: 'group',
+    name: 'group',
+    parentPath: root,
+    parentGroupId: null,
+    createdFrom: 'manual',
+    tabOrder: 0,
+    isCollapsed: false,
+    color: null,
+    createdAt: 0,
+    updatedAt: 0,
+    ...owner,
+    ...overrides
+  }
+}
+function folder(owner: Owner = {}): FolderWorkspace {
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: same widened stamp as `repo`; all other fields are checked `FolderWorkspace` fields.
+  return {
+    id: 'folder',
+    projectGroupId: 'group',
+    name: 'folder',
+    folderPath: root,
+    linkedTask: null,
+    comment: '',
+    isArchived: false,
+    isUnread: false,
+    isPinned: false,
+    sortOrder: 0,
+    lastActivityAt: 0,
+    createdAt: 0,
+    updatedAt: 0,
+    ...owner
+  } as FolderWorkspace
+}
+function storeFor(
+  repos: Repo[] = [],
+  groups: ProjectGroup[] = [],
+  folders: FolderWorkspace[] = [],
+  settings: { workspaceDir?: string } = {}
+): Store {
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Authorization reads only these catalog and settings methods; fixtures omit workspaceDir unless the case is about it.
+  return {
+    getRepos: () => repos,
+    getProjectGroups: () => groups,
+    getFolderWorkspaces: () => folders,
+    getSettings: () => settings
+  } as Store
+}
+
+const deniedOwners: { name: string; owner: Owner }[] = [
+  { name: 'canonical SSH', owner: { executionHostId: 'ssh:host-a' } },
+  { name: 'encoded canonical SSH', owner: { executionHostId: 'ssh:host%20a' } },
+  { name: 'legacy SSH', owner: { connectionId: 'host-a' } },
+  {
+    name: 'explicit local with legacy SSH',
+    owner: { executionHostId: 'local', connectionId: 'host-a' }
+  },
+  {
+    name: 'runtime with legacy SSH',
+    owner: { executionHostId: 'runtime:env', connectionId: 'host-a' }
+  },
+  // Host ids the shared parser rejects. Each must fail closed: an owner we cannot place is not
+  // evidence of a local one, and a bare `getSshTargetIdForExecutionHost` answers null for all five.
+  { name: 'empty SSH target', owner: { executionHostId: 'ssh:' } },
+  { name: 'undecodable SSH target', owner: { executionHostId: 'ssh:%zz' } },
+  { name: 'alias-delimiter SSH target', owner: { executionHostId: 'ssh:host-a|alias' } },
+  { name: 'wrong-case SSH prefix', owner: { executionHostId: 'SSH:host-a' } },
+  { name: 'unknown host kind', owner: { executionHostId: 'relay:host-a' } }
+]
+const allowedOwners: { name: string; owner: Owner }[] = [
+  { name: 'unscoped local', owner: {} },
+  { name: 'explicit local', owner: { executionHostId: 'local' } },
+  { name: 'blank host stamp', owner: { executionHostId: '  ' } },
+  { name: 'own-store runtime', owner: { executionHostId: 'runtime:env' } }
+]
+
+beforeEach(() => {
+  invalidateAuthorizedRootsCache()
+  __resetCreatedWorktreeRootsForTests()
+  vi.clearAllMocks()
+  mocks.graph.mockResolvedValue([])
+  mocks.stat.mockResolvedValue({})
+  mocks.realpath.mockImplementation(async (path: string) => path)
+  mocks.projectRuntimes.mockReturnValue(new Map())
+  mocks.pathSettings.mockImplementation(
+    (_repo: Repo, settings: { workspaceDir: string }) => settings
+  )
+  mocks.workspaceRoot.mockImplementation(
+    (_repoPath: string, settings: { workspaceDir: string }) => settings.workspaceDir
+  )
+})
+
+describe.each(deniedOwners)('$name fixture matrix', ({ owner }) => {
+  it.each([
+    ['repo root', () => storeFor([repo(owner)])],
+    ['group scope', () => storeFor([], [group(owner)])],
+    ['folder scope', () => storeFor([], [], [folder(owner)])],
+    ['folder inheriting the group', () => storeFor([], [group(owner)], [folder()])],
+    [
+      'local-looking group and folder over a remote child repo',
+      () => storeFor([repo(owner, { path: join(root, 'child') })], [group()], [folder()])
+    ]
+  ])('denies the %s', (_case, build) => {
+    expect(isPathAllowed(join(root, 'file'), build())).toBe(false)
+  })
+})
+
+describe.each(deniedOwners)('$name filesystem ownership', ({ owner }) => {
+  it('does not grant a repository root or register linked roots', async () => {
+    const store = storeFor([repo(owner)])
+    expect(getLocalRepos(store)).toEqual([])
+    expect(isPathAllowed(join(root, 'file'), store)).toBe(false)
+    registerWorktreeRootsForRepo(store, 'repo', [linked])
+    registerCreatedWorktreeRoot(store, 'repo', linked)
+    expect(isRegisteredWorktreePath(linked, store)).toBe(false)
+    await rebuildAuthorizedRootsCache(store)
+    expect(isRegisteredWorktreePath(root, store)).toBe(false)
+    expect(mocks.graph).not.toHaveBeenCalled()
+    expect(mocks.stat).not.toHaveBeenCalled()
+  })
+
+  it.each(['group', 'folder', 'inherited group'] as const)(
+    'does not grant an empty %s scope',
+    (kind) => {
+      const store = storeFor(
+        [],
+        kind !== 'folder' ? [group(owner)] : [],
+        kind === 'folder' ? [folder(owner)] : kind === 'inherited group' ? [folder()] : []
+      )
+      expect(getAllowedRoots(store)).toEqual([])
+      expect(isPathAllowed(join(root, 'file'), store)).toBe(false)
+    }
+  )
+
+  it('does not infer a local group or folder from a remote child repo', () => {
+    const store = storeFor(
+      [repo(owner, { path: join(root, 'child'), projectGroupId: 'nested' })],
+      [group(), group({}, { id: 'nested', parentGroupId: 'group', parentPath: null })],
+      [folder()]
+    )
+    expect(getAllowedRoots(store)).toEqual([])
+    expect(isPathAllowed(join(root, 'file'), store)).toBe(false)
+  })
+})
+
+describe.each(allowedOwners)('$name filesystem ownership', ({ owner }) => {
+  it('preserves repo, group, folder and recovered worktree roots', () => {
+    for (const store of [
+      storeFor([repo(owner)]),
+      storeFor([], [group(owner)]),
+      storeFor([], [], [folder(owner)])
+    ]) {
+      expect(getAllowedRoots(store)).toEqual([root])
+      expect(isPathAllowed(join(root, 'file'), store)).toBe(true)
+    }
+    const store = storeFor([repo(owner)])
+    registerWorktreeRootsForRepo(store, 'repo', [root])
+    registerCreatedWorktreeRoot(store, 'repo', linked)
+    invalidateAuthorizedRootsCache()
+    expect(isRegisteredWorktreePath(linked, store)).toBe(true)
+    expect(mocks.graph).not.toHaveBeenCalled()
+    expect(mocks.stat).not.toHaveBeenCalled()
+  })
+})
+
+it('preserves an unpinned mixed local and SSH folder scope', () => {
+  const store = storeFor(
+    [
+      repo({ executionHostId: 'ssh:host-a' }, { path: join(root, 'remote') }),
+      repo({}, { id: 'local', path: join(root, 'local') })
+    ],
+    [group()],
+    [folder()]
+  )
+  expect(getAllowedRoots(store)).toEqual([join(root, 'local'), root, root])
+})
+
+it('keeps an explicit SSH folder scope remote even with a local candidate', () => {
+  const store = storeFor(
+    [repo({}, { path: join(root, 'local') })],
+    [group({ executionHostId: 'ssh:host-a' })],
+    [folder()]
+  )
+  expect(getAllowedRoots(store)).toEqual([join(root, 'local')])
+  expect(isPathAllowed(join(root, 'file'), store)).toBe(false)
+})
+
+it('preserves explicit local folder overrides and the legacy empty connection override', () => {
+  expect(
+    getAllowedRoots(
+      storeFor(
+        [],
+        [group({ executionHostId: 'ssh:host-a' })],
+        [folder({ executionHostId: 'local' })]
+      )
+    )
+  ).toEqual([root])
+  expect(
+    getAllowedRoots(
+      storeFor([], [group({ connectionId: 'host-a' })], [folder({ connectionId: '' })])
+    )
+  ).toEqual([root])
+})
+
+it('denies a workspace pinned local under a group carrying only a legacy connection', () => {
+  const pinnedFolder = folder({ executionHostId: 'local' })
+  const legacyGroup = group({ connectionId: 'host-a' })
+  const store = storeFor([], [legacyGroup], [pinnedFolder])
+  expect(getAllowedRoots(store)).toEqual([])
+  expect(isPathAllowed(join(root, 'file'), store)).toBe(false)
+  // Dispatch reads the same row as local; authorization is deliberately the stricter of the two,
+  // because agreeing would grant a root this store refuses today.
+  expect(
+    resolveFolderWorkspaceHost(
+      { folderWorkspaces: [pinnedFolder], projectGroups: [legacyGroup], repos: [] },
+      'folder'
+    )
+  ).toEqual({ kind: 'local' })
+  // The mirrored row needs no such note: the workspace's own legacy connection is remote on both sides.
+  const mirrored = storeFor(
+    [],
+    [group({ executionHostId: 'local' }, { parentPath: null })],
+    [folder({ connectionId: 'host-a' })]
+  )
+  expect(getAllowedRoots(mirrored)).toEqual([])
+  expect(isPathAllowed(join(root, 'file'), mirrored)).toBe(false)
+})
+
+it('still grants a local directory that happens to share an SSH repo path', () => {
+  const store = storeFor([
+    repo({ executionHostId: 'ssh:host-a' }),
+    repo({}, { id: 'mine', path: root })
+  ])
+  expect(getAllowedRoots(store)).toEqual([root])
+  expect(isPathAllowed(join(root, 'file'), store)).toBe(true)
+})
+
+describe('workspace-directory fallback', () => {
+  const workspaceDir = resolve('/ws-fixture')
+
+  it('does not widen past the roots a local repo of its own would grant', () => {
+    const local = getAllowedRoots(storeFor([repo()], [], [], { workspaceDir }))
+    const sshOnly = getAllowedRoots(
+      storeFor([repo({ executionHostId: 'ssh:host-a' })], [], [], { workspaceDir })
+    )
+    expect(local).toEqual([root, workspaceDir])
+    // The SSH repo's own path is gone; nothing beyond the fallback the same config already granted.
+    expect(sshOnly).toEqual([workspaceDir])
+    expect(
+      isPathAllowed(
+        join(root, 'file'),
+        storeFor([repo({ connectionId: 'host-a' })], [], [], { workspaceDir })
+      )
+    ).toBe(false)
+  })
+
+  it('grants a workspace directory this host reads as absolute, with no local repo', () => {
+    expect(getAllowedRoots(storeFor([], [], [], { workspaceDir: '/ws-fixture' }))).toEqual([
+      resolve('/ws-fixture')
+    ])
+  })
+
+  it.each([
+    ['bare name', 'orca-ws'],
+    ['parent traversal', '..'],
+    ['relative traversal', '../orca-ws']
+  ])('grants nothing for a repo-relative %s with no repo to anchor it', (_case, dir) => {
+    // `resolve` would anchor these to the main-process cwd, granting an unrelated tree.
+    expect(getAllowedRoots(storeFor([], [], [], { workspaceDir: dir }))).toEqual([])
+    expect(
+      getAllowedRoots(
+        storeFor([repo({ executionHostId: 'ssh:host-a' })], [], [], {
+          workspaceDir: dir
+        })
+      )
+    ).toEqual([])
+  })
+
+  // Why guarded rather than injected: this is the end-to-end claim that the foreign-flavour string
+  // never reaches `resolve`, so it has to run against the real host path module — and on Windows the
+  // same string is a legitimate root. The flavour matrix below covers both hosts unguarded.
+  it.skipIf(process.platform === 'win32')(
+    'does not anchor a Windows-style workspace directory under the POSIX main-process cwd',
+    () => {
+      const store = storeFor([], [], [], { workspaceDir: 'C:\\workspaces' })
+      expect(getAllowedRoots(store)).toEqual([])
+      // The cross-platform predicate used to grant exactly this: `<cwd>/C:\workspaces`.
+      expect(isPathAllowed(join(resolve('C:\\workspaces'), 'file'), store)).toBe(false)
+    }
+  )
+
+  it.each([
+    ['POSIX absolute on POSIX', posix, '/orca-ws', true],
+    ['relative on POSIX', posix, '../orca-ws', false],
+    ['Windows drive on POSIX', posix, 'C:\\orca-ws', false],
+    ['Windows UNC on POSIX', posix, '\\\\wsl$\\Ubuntu\\home\\me\\ws', false],
+    ['POSIX absolute on Windows', win32, '/orca-ws', true],
+    ['relative on Windows', win32, '..\\orca-ws', false],
+    ['Windows drive on Windows', win32, 'C:\\orca-ws', true],
+    ['Windows UNC on Windows', win32, '\\\\wsl$\\Ubuntu\\home\\me\\ws', true]
+  ])(
+    'grants an unanchored %s workspace directory only when that host reads it as absolute',
+    (_case, hostPath, dir, granted) => {
+      expect(resolveUnanchoredWorkspaceRoot(dir, hostPath) !== null).toBe(granted)
+    }
+  )
+})
diff --git a/src/main/ipc/filesystem-download-lifetime.test.ts b/src/main/ipc/filesystem-download-lifetime.test.ts
new file mode 100644
index 000000000000..037c3329be35
--- /dev/null
+++ b/src/main/ipc/filesystem-download-lifetime.test.ts
@@ -0,0 +1,342 @@
+import { EventEmitter } from 'node:events'
+import { resolve } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { Store } from '../persistence'
+
+const mocks = vi.hoisted(() => ({
+  handlers: new Map<string, (...args: unknown[]) => Promise<unknown>>(),
+  showSaveDialog: vi.fn(),
+  stat: vi.fn(),
+  open: vi.fn(),
+  rename: vi.fn(),
+  rm: vi.fn()
+}))
+vi.mock('electron', () => ({
+  BrowserWindow: { fromWebContents: () => null },
+  dialog: { showSaveDialog: mocks.showSaveDialog },
+  ipcMain: {
+    handle: (name: string, handler: (...args: unknown[]) => Promise<unknown>) =>
+      mocks.handlers.set(name, handler)
+  }
+}))
+vi.mock('node:fs/promises', () => ({ ...mocks, writeFile: vi.fn() }))
+vi.mock('./filesystem-download-folder', () => ({
+  registerFilesystemDownloadFolderHandlers: vi.fn()
+}))
+vi.mock('../providers/ssh-filesystem-dispatch', () => ({ requireSshFilesystemProvider: vi.fn() }))
+
+import { createFilesystemHandlerContext } from './filesystem/filesystem-handler-context'
+import { registerFilesystemDownloadHandlers } from './filesystem/filesystem-download-handlers'
+import { DOWNLOAD_SESSION_TTL_MS } from './filesystem/filesystem-download-promotion'
+
+const destination = resolve('fake-downloads', 'file.txt')
+const lifetimeEvents = ['destroyed', 'render-process-gone', 'did-navigate'] as const
+const senders: EventEmitter[] = []
+let context: ReturnType<typeof createFilesystemHandlerContext>
+
+function makeSender(id = 1) {
+  const sender = Object.assign(new EventEmitter(), { id, isDestroyed: vi.fn(() => false) })
+  sender.setMaxListeners(0)
+  senders.push(sender)
+  return sender
+}
+
+function makeHandle() {
+  return { close: vi.fn(async () => {}), writeFile: vi.fn(async () => {}) }
+}
+
+function invoke(name: string, sender: ReturnType<typeof makeSender>, args: unknown) {
+  const handler = mocks.handlers.get(`fs:${name}`)
+  if (!handler) {
+    throw new Error(`Missing handler: ${name}`)
+  }
+  return handler({ sender }, args)
+}
+
+async function start(sender: ReturnType<typeof makeSender>) {
+  const result = await invoke('startDownloadedFile', sender, { suggestedName: 'file.txt' })
+  if (
+    !result ||
+    typeof result !== 'object' ||
+    !('transferId' in result) ||
+    typeof result.transferId !== 'string'
+  ) {
+    throw new Error('Download did not start')
+  }
+  return result.transferId
+}
+
+function expectNoListeners(sender: ReturnType<typeof makeSender>) {
+  for (const event of lifetimeEvents) {
+    expect(sender.listenerCount(event)).toBe(0)
+  }
+}
+
+beforeEach(() => {
+  vi.resetAllMocks()
+  vi.useFakeTimers()
+  mocks.handlers.clear()
+  mocks.showSaveDialog.mockResolvedValue({ canceled: false, filePath: destination })
+  mocks.stat.mockRejectedValue(Object.assign(new Error('missing'), { code: 'ENOENT' }))
+  mocks.open.mockImplementation(async () => makeHandle())
+  mocks.rename.mockResolvedValue(undefined)
+  mocks.rm.mockResolvedValue(undefined)
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Download handlers never access the store; unrelated handlers are not registered.
+  const store = {} as Store
+  const cancellations = { begin: () => null, finish: () => {}, cancel: () => {} }
+  context = createFilesystemHandlerContext(store, undefined, cancellations, cancellations)
+  registerFilesystemDownloadHandlers(context)
+})
+
+afterEach(async () => {
+  await Promise.all(
+    [...context.downloadSessions.keys()].map((id) => context.closeDownloadSession(id, true))
+  )
+  for (const sender of senders.splice(0)) {
+    sender.removeAllListeners()
+  }
+  vi.clearAllTimers()
+  vi.useRealTimers()
+})
+
+describe('chunked download renderer ownership', () => {
+  it('releases all renderer listeners after twenty alternating finish and cancel calls', async () => {
+    const sender = makeSender()
+    for (let index = 0; index < 20; index += 1) {
+      const transferId = await start(sender)
+      await invoke(index % 2 ? 'finishDownloadedFile' : 'cancelDownloadedFile', sender, {
+        transferId
+      })
+    }
+    expect(context.downloadSessions.size).toBe(0)
+    expectNoListeners(sender)
+    expect(vi.getTimerCount()).toBe(0)
+  })
+
+  it('does not open a dialog for an already destroyed renderer', async () => {
+    const sender = makeSender()
+    sender.isDestroyed.mockReturnValue(true)
+    await expect(
+      invoke('startDownloadedFile', sender, { suggestedName: 'file.txt' })
+    ).resolves.toEqual({ canceled: true })
+    expect(mocks.showSaveDialog).not.toHaveBeenCalled()
+    expectNoListeners(sender)
+  })
+
+  it.each(
+    lifetimeEvents.flatMap((event) =>
+      (['dialog', 'stat', 'open'] as const).map((phase) => ({ event, phase }))
+    )
+  )('cancels pending $phase work after $event', async ({ event, phase }) => {
+    const sender = makeSender()
+    const held = Promise.withResolvers<unknown>()
+    const operation =
+      phase === 'dialog' ? mocks.showSaveDialog : phase === 'stat' ? mocks.stat : mocks.open
+    const callsBefore = operation.mock.calls.length
+    const opensBefore = mocks.open.mock.calls.length
+    operation.mockReturnValueOnce(held.promise)
+    const pending = invoke('startDownloadedFile', sender, { suggestedName: 'file.txt' })
+    await vi.waitFor(() => expect(operation).toHaveBeenCalledTimes(callsBefore + 1))
+    sender.emit(event)
+    expectNoListeners(sender)
+    const handle = makeHandle()
+    held.resolve(
+      phase === 'dialog'
+        ? { canceled: false, filePath: destination }
+        : phase === 'stat'
+          ? { isDirectory: () => false }
+          : handle
+    )
+    await expect(pending).resolves.toEqual({ canceled: true })
+    expect(context.downloadSessions.size).toBe(0)
+    expect(handle.close).toHaveBeenCalledTimes(phase === 'open' ? 1 : 0)
+    expect(mocks.open).toHaveBeenCalledTimes(opensBefore + (phase === 'open' ? 1 : 0))
+    if (phase === 'open') {
+      expect(mocks.rm).toHaveBeenCalledWith(mocks.open.mock.calls.at(-1)?.[0], { force: true })
+    }
+    expectNoListeners(sender)
+    expect(vi.getTimerCount()).toBe(0)
+  })
+
+  it.each(['dialog', 'stat', 'open'] as const)(
+    'releases ownership when %s rejects',
+    async (phase) => {
+      const sender = makeSender()
+      const error = new Error(`${phase} failed`)
+      const operation =
+        phase === 'dialog' ? mocks.showSaveDialog : phase === 'stat' ? mocks.stat : mocks.open
+      operation.mockRejectedValueOnce(error)
+      await expect(
+        invoke('startDownloadedFile', sender, { suggestedName: 'file.txt' })
+      ).rejects.toBe(error)
+      expectNoListeners(sender)
+      expect(context.downloadSessions.size).toBe(0)
+      expect(vi.getTimerCount()).toBe(0)
+    }
+  )
+
+  it('releases ownership when the user cancels the dialog', async () => {
+    const sender = makeSender()
+    mocks.showSaveDialog.mockResolvedValueOnce({ canceled: true })
+    await expect(
+      invoke('startDownloadedFile', sender, { suggestedName: 'file.txt' })
+    ).resolves.toEqual({ canceled: true })
+    expectNoListeners(sender)
+    expect(mocks.open).not.toHaveBeenCalled()
+  })
+
+  it.each(lifetimeEvents)(
+    'closes only live sessions owned by the renderer on %s',
+    async (event) => {
+      const first = makeSender(1),
+        second = makeSender(2)
+      const handles = [makeHandle(), makeHandle(), makeHandle()]
+      for (const handle of handles) {
+        mocks.open.mockResolvedValueOnce(handle)
+      }
+      const firstId = await start(first),
+        secondId = await start(first),
+        otherId = await start(second)
+      first.emit(event)
+      await vi.waitFor(() => expect(mocks.rm).toHaveBeenCalledTimes(2))
+      expect([...context.downloadSessions.keys()]).toEqual([otherId])
+      expect(handles[0].close).toHaveBeenCalledOnce()
+      expect(handles[1].close).toHaveBeenCalledOnce()
+      expect(handles[2].close).not.toHaveBeenCalled()
+      expectNoListeners(first)
+      await invoke('cancelDownloadedFile', first, { transferId: firstId })
+      await invoke('cancelDownloadedFile', first, { transferId: secondId })
+      expect(handles[0].close).toHaveBeenCalledOnce()
+      expect(handles[1].close).toHaveBeenCalledOnce()
+    }
+  )
+
+  it('keeps a concurrent session owned after its sibling finishes', async () => {
+    const sender = makeSender(),
+      firstHandle = makeHandle(),
+      secondHandle = makeHandle()
+    mocks.open.mockResolvedValueOnce(firstHandle).mockResolvedValueOnce(secondHandle)
+    const firstId = await start(sender),
+      secondId = await start(sender)
+    await invoke('finishDownloadedFile', sender, { transferId: firstId })
+    sender.emit('destroyed')
+    await vi.waitFor(() => expect(secondHandle.close).toHaveBeenCalledOnce())
+    expect(context.downloadSessions.has(secondId)).toBe(false)
+    expect(firstHandle.close).toHaveBeenCalledOnce()
+    expectNoListeners(sender)
+  })
+
+  it.each(['did-start-navigation', 'did-navigate-in-page'])(
+    'keeps a live document transfer across %s',
+    async (event) => {
+      const sender = makeSender(),
+        transferId = await start(sender)
+      sender.emit(event)
+      expect(context.downloadSessions.has(transferId)).toBe(true)
+      await invoke('appendDownloadedFileChunk', sender, {
+        transferId,
+        contentBase64: Buffer.from('bytes').toString('base64')
+      })
+      const handle = context.downloadSessions.get(transferId)?.handle
+      expect(handle?.writeFile).toHaveBeenCalledWith(Buffer.from('bytes'))
+    }
+  )
+
+  it('does not cancel a replacement sender with the same numeric id', async () => {
+    const oldSender = makeSender(7),
+      replacement = makeSender(7)
+    await start(oldSender)
+    const current = await start(replacement)
+    oldSender.emit('destroyed')
+    expect(context.downloadSessions.has(current)).toBe(true)
+    expect(context.downloadSessions.size).toBe(1)
+    expectNoListeners(oldSender)
+  })
+
+  it('does not let a late old-document open affect a replacement download', async () => {
+    const sender = makeSender(),
+      late = makeHandle(),
+      current = makeHandle()
+    const held = Promise.withResolvers<ReturnType<typeof makeHandle>>()
+    mocks.open.mockReturnValueOnce(held.promise).mockResolvedValueOnce(current)
+    const pending = invoke('startDownloadedFile', sender, { suggestedName: 'file.txt' })
+    await vi.waitFor(() => expect(mocks.open).toHaveBeenCalledOnce())
+    sender.emit('did-navigate')
+    const transferId = await start(sender)
+    held.resolve(late)
+    await expect(pending).resolves.toEqual({ canceled: true })
+    expect([...context.downloadSessions.keys()]).toEqual([transferId])
+    expect(late.close).toHaveBeenCalledOnce()
+    expect(current.close).not.toHaveBeenCalled()
+    await invoke('finishDownloadedFile', sender, { transferId })
+    expect(current.close).toHaveBeenCalledOnce()
+    expectNoListeners(sender)
+  })
+
+  it('cleans a late temporary path even if handle close and removal both fail', async () => {
+    const sender = makeSender(),
+      handle = makeHandle()
+    const held = Promise.withResolvers<ReturnType<typeof makeHandle>>()
+    handle.close.mockRejectedValueOnce(new Error('close failed'))
+    mocks.open.mockReturnValueOnce(held.promise)
+    mocks.rm.mockRejectedValueOnce(new Error('remove failed'))
+    const pending = invoke('startDownloadedFile', sender, { suggestedName: 'file.txt' })
+    await vi.waitFor(() => expect(mocks.open).toHaveBeenCalledOnce())
+    sender.emit('destroyed')
+    held.resolve(handle)
+    await expect(pending).resolves.toEqual({ canceled: true })
+    expectNoListeners(sender)
+    expect(handle.close).toHaveBeenCalledOnce()
+    expect(mocks.rm).toHaveBeenCalledExactlyOnceWith(mocks.open.mock.calls[0][0], { force: true })
+    expect(context.downloadSessions.size).toBe(0)
+    expect(vi.getTimerCount()).toBe(0)
+  })
+
+  it('releases owner listeners before waiting for a canceled handle to close', async () => {
+    const sender = makeSender(),
+      handle = makeHandle(),
+      held = Promise.withResolvers<void>()
+    handle.close.mockReturnValueOnce(held.promise)
+    mocks.open.mockResolvedValueOnce(handle)
+    const transferId = await start(sender)
+    const pending = invoke('cancelDownloadedFile', sender, { transferId })
+    try {
+      expectNoListeners(sender)
+      expect(context.downloadSessions.size).toBe(0)
+      sender.emit('destroyed')
+      expect(handle.close).toHaveBeenCalledOnce()
+    } finally {
+      held.resolve()
+      await pending
+    }
+  })
+
+  it('releases ownership on timeout and does not close again after later owner events', async () => {
+    const sender = makeSender(),
+      handle = makeHandle()
+    mocks.open.mockResolvedValueOnce(handle)
+    await start(sender)
+    await vi.advanceTimersByTimeAsync(DOWNLOAD_SESSION_TTL_MS)
+    expectNoListeners(sender)
+    expect(context.downloadSessions.size).toBe(0)
+    expect(handle.close).toHaveBeenCalledOnce()
+    expect(mocks.rm).toHaveBeenCalledOnce()
+    sender.emit('destroyed')
+    expect(handle.close).toHaveBeenCalledOnce()
+  })
+
+  it('keeps ownership cleanup when promotion fails or handle close rejects', async () => {
+    const sender = makeSender(),
+      handle = makeHandle()
+    handle.close.mockRejectedValueOnce(new Error('close failed'))
+    mocks.open.mockResolvedValueOnce(handle)
+    mocks.rename.mockRejectedValueOnce(new Error('promotion failed'))
+    const transferId = await start(sender)
+    await expect(invoke('finishDownloadedFile', sender, { transferId })).rejects.toThrow(
+      'promotion failed'
+    )
+    expectNoListeners(sender)
+    expect(mocks.rm).toHaveBeenCalledOnce()
+    expect(handle.close).toHaveBeenCalledOnce()
+  })
+})
diff --git a/src/main/ipc/filesystem-download-transfers.test.ts b/src/main/ipc/filesystem-download-transfers.test.ts
index 9d031ff4d399..227372c567d3 100644
--- a/src/main/ipc/filesystem-download-transfers.test.ts
+++ b/src/main/ipc/filesystem-download-transfers.test.ts
@@ -261,10 +261,9 @@ describe('registerFilesystemHandlers', () => {
     statMock.mockRejectedValue(Object.assign(new Error('missing'), { code: 'ENOENT' }))
     registerFilesystemHandlers(store as never)
 
-    const started = await handlers.get('fs:startDownloadedFile')!(
-      { sender: {} },
-      { suggestedName: 'report.pdf' }
-    )
+    const started = await handlers.get('fs:startDownloadedFile')!(folderDownloadEvent, {
+      suggestedName: 'report.pdf'
+    })
     expect(started).toMatchObject({
       canceled: false,
       destinationPath: '/downloads/report.pdf'
@@ -300,10 +299,9 @@ describe('registerFilesystemHandlers', () => {
     statMock.mockRejectedValue(Object.assign(new Error('missing'), { code: 'ENOENT' }))
     registerFilesystemHandlers(store as never)
 
-    const started = await handlers.get('fs:startDownloadedFile')!(
-      { sender: {} },
-      { suggestedName: 'report.pdf' }
-    )
+    const started = await handlers.get('fs:startDownloadedFile')!(folderDownloadEvent, {
+      suggestedName: 'report.pdf'
+    })
     if (!started || typeof started !== 'object' || !('transferId' in started)) {
       throw new Error('download did not start')
     }
diff --git a/src/main/ipc/filesystem-git-status-staging.test.ts b/src/main/ipc/filesystem-git-status-staging.test.ts
index 5cc1b4e95404..b86a75b2314a 100644
--- a/src/main/ipc/filesystem-git-status-staging.test.ts
+++ b/src/main/ipc/filesystem-git-status-staging.test.ts
@@ -1,3 +1,4 @@
+import { EventEmitter } from 'node:events'
 import path from 'node:path'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import {
@@ -305,42 +306,51 @@ describe('registerFilesystemHandlers', () => {
     })
   })
 
-  it('aborts tokenized local status without crossing renderer boundaries', async () => {
-    registerWorktreeRootsForRepo(store as never, 'repo-1', [REPO_PATH, WORKTREE_FEATURE_PATH])
-    const statusSignals: AbortSignal[] = []
-    getStatusMock.mockImplementation(
-      (_worktreePath: string, options: { signal?: AbortSignal }) =>
-        new Promise((_resolve, reject) => {
-          if (options.signal) {
-            statusSignals.push(options.signal)
-            options.signal.addEventListener('abort', () => reject(new Error('aborted')), {
-              once: true
-            })
-          }
-        })
-    )
-    registerFilesystemHandlers(store as never)
-
-    const firstEvent = { sender: { id: 7 } }
-    const secondEvent = { sender: { id: 8 } }
-    const firstRequest = handlers.get('git:status')!(firstEvent, {
-      worktreePath: WORKTREE_FEATURE_PATH,
-      requestToken: 'status-1'
-    }) as Promise<unknown>
-    const secondRequest = handlers.get('git:status')!(secondEvent, {
-      worktreePath: WORKTREE_FEATURE_PATH,
-      requestToken: 'status-1'
-    }) as Promise<unknown>
-    await vi.waitFor(() => expect(statusSignals).toHaveLength(2))
-    await handlers.get('git:cancelStatus')!(firstEvent, { requestToken: 'status-1' })
-
-    expect(statusSignals[0]?.aborted).toBe(true)
-    expect(statusSignals[1]?.aborted).toBe(false)
-    await expect(firstRequest).rejects.toThrow('aborted')
-
-    await handlers.get('git:cancelStatus')!(secondEvent, { requestToken: 'status-1' })
-    await expect(secondRequest).rejects.toThrow('aborted')
-  })
+  it.each(['cancel', 'did-navigate', 'render-process-gone', 'destroyed'])(
+    'aborts tokenized local status on %s without crossing renderer boundaries',
+    async (eventName) => {
+      registerWorktreeRootsForRepo(store as never, 'repo-1', [REPO_PATH, WORKTREE_FEATURE_PATH])
+      const statusSignals: AbortSignal[] = []
+      getStatusMock.mockImplementation(
+        (_worktreePath: string, options: { signal?: AbortSignal }) =>
+          new Promise((_resolve, reject) => {
+            if (options.signal) {
+              statusSignals.push(options.signal)
+              options.signal.addEventListener('abort', () => reject(new Error('aborted')), {
+                once: true
+              })
+            }
+          })
+      )
+      registerFilesystemHandlers(store as never)
+
+      const firstEvent = { sender: Object.assign(new EventEmitter(), { id: 7 }) }
+      const secondEvent = { sender: Object.assign(new EventEmitter(), { id: 8 }) }
+      const firstRequest = handlers.get('git:status')!(firstEvent, {
+        worktreePath: WORKTREE_FEATURE_PATH,
+        requestToken: 'status-1'
+      }) as Promise<unknown>
+      const secondRequest = handlers.get('git:status')!(secondEvent, {
+        worktreePath: WORKTREE_FEATURE_PATH,
+        requestToken: 'status-1'
+      }) as Promise<unknown>
+      await vi.waitFor(() => expect(statusSignals).toHaveLength(2))
+      if (eventName === 'cancel') {
+        await handlers.get('git:cancelStatus')!(firstEvent, { requestToken: 'status-1' })
+      } else {
+        firstEvent.sender.emit(eventName)
+      }
+
+      expect(statusSignals[0]?.aborted).toBe(true)
+      expect(statusSignals[1]?.aborted).toBe(false)
+      await expect(firstRequest).rejects.toThrow('aborted')
+
+      await handlers.get('git:cancelStatus')!(secondEvent, { requestToken: 'status-1' })
+      await expect(secondRequest).rejects.toThrow('aborted')
+      expect(firstEvent.sender.eventNames()).toEqual([])
+      expect(secondEvent.sender.eventNames()).toEqual([])
+    }
+  )
 
   it('checks ignored paths through local and SSH git providers', async () => {
     registerWorktreeRootsForRepo(store as never, 'repo-1', [REPO_PATH, WORKTREE_FEATURE_PATH])
diff --git a/src/main/ipc/filesystem-import-local-rollback.test.ts b/src/main/ipc/filesystem-import-local-rollback.test.ts
new file mode 100644
index 000000000000..364c6c88eee6
--- /dev/null
+++ b/src/main/ipc/filesystem-import-local-rollback.test.ts
@@ -0,0 +1,254 @@
+import { constants } from 'node:fs'
+import { join, resolve } from 'node:path'
+import { Readable, Writable } from 'node:stream'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { lstatMock, mkdirMock, openMock, readdirMock, rmMock, unlinkMock } = vi.hoisted(() => ({
+  lstatMock: vi.fn(),
+  mkdirMock: vi.fn(),
+  openMock: vi.fn(),
+  readdirMock: vi.fn(),
+  rmMock: vi.fn(),
+  unlinkMock: vi.fn()
+}))
+
+vi.mock('./filesystem-auth', () => ({ authorizeExternalPath: vi.fn() }))
+vi.mock('node:fs/promises', () => ({
+  lstat: lstatMock,
+  mkdir: mkdirMock,
+  open: openMock,
+  readdir: readdirMock,
+  rm: rmMock,
+  unlink: unlinkMock
+}))
+
+import { importOneSource } from './filesystem-import-local'
+import { recursiveCopyDir } from './filesystem-import-local-tree-copy'
+
+type EntryKind = 'directory' | 'file' | 'symlink' | 'unsupported'
+
+function statFor(kind: EntryKind) {
+  return {
+    size: 7,
+    ino: 1,
+    dev: 1,
+    isDirectory: () => kind === 'directory',
+    isFile: () => kind === 'file',
+    isSymbolicLink: () => kind === 'symlink'
+  }
+}
+
+const source = resolve('import-fixture', 'incoming')
+const destination = resolve('import-fixture', 'folder-workspace')
+const target = join(destination, 'incoming')
+const stats = new Map<string, ReturnType<typeof statFor>>()
+const entries = new Map<string, { name: string; kind: EntryKind }[]>()
+
+function addEntry(parent: string, name: string, kind: EntryKind): string {
+  const path = join(parent, name)
+  stats.set(path, statFor(kind))
+  entries.set(parent, [...(entries.get(parent) ?? []), { name, kind }])
+  return path
+}
+
+beforeEach(() => {
+  vi.resetAllMocks()
+  stats.clear()
+  entries.clear()
+  stats.set(source, statFor('directory'))
+  lstatMock.mockImplementation(async (path: string) => {
+    const stat = stats.get(path)
+    if (stat) {
+      return stat
+    }
+    throw Object.assign(new Error('missing'), { code: 'ENOENT' })
+  })
+  readdirMock.mockImplementation(async (path: string) =>
+    (entries.get(path) ?? []).map(({ name, kind }) => ({ name, ...statFor(kind) }))
+  )
+  mkdirMock.mockResolvedValue(undefined)
+  rmMock.mockResolvedValue(undefined)
+  unlinkMock.mockResolvedValue(undefined)
+  openMock.mockRejectedValue(new Error('unexpected file copy'))
+})
+
+describe('local directory import rollback ownership', () => {
+  it.each(['EEXIST', 'EACCES', 'EPERM'])(
+    'does not remove output after root mkdir %s',
+    async (code) => {
+      mkdirMock.mockRejectedValue(Object.assign(new Error(code), { code }))
+
+      expect(await importOneSource(source, destination, new Set())).toEqual({
+        sourcePath: source,
+        status: 'failed',
+        reason: code
+      })
+      expect(mkdirMock).toHaveBeenCalledExactlyOnceWith(target, { recursive: false })
+      expect(rmMock).not.toHaveBeenCalled()
+      expect(openMock).not.toHaveBeenCalled()
+    }
+  )
+
+  it.each(['existing', 'reserved'])(
+    'preserves a late conflict after deconflicting a %s name',
+    async (conflict) => {
+      const reserved = new Set<string>()
+      if (conflict === 'existing') {
+        stats.set(target, statFor('directory'))
+      } else {
+        reserved.add('incoming')
+      }
+      mkdirMock.mockRejectedValue(Object.assign(new Error('late conflict'), { code: 'EEXIST' }))
+
+      expect(await importOneSource(source, destination, reserved)).toMatchObject({
+        status: 'failed'
+      })
+      expect(mkdirMock).toHaveBeenCalledExactlyOnceWith(join(destination, 'incoming copy'), {
+        recursive: false
+      })
+      expect(rmMock).not.toHaveBeenCalled()
+    }
+  )
+
+  it('cleans its directory when reading it fails after creation', async () => {
+    readdirMock.mockResolvedValueOnce([]).mockRejectedValueOnce(new Error('source unreadable'))
+
+    expect(await importOneSource(source, destination, new Set())).toMatchObject({
+      status: 'failed',
+      reason: 'source unreadable'
+    })
+    expect(rmMock).toHaveBeenCalledExactlyOnceWith(target, { recursive: true, force: true })
+  })
+
+  it('keeps the copy error when best-effort cleanup also fails', async () => {
+    addEntry(source, 'lost.txt', 'file')
+    openMock.mockRejectedValue(new Error('source changed'))
+    rmMock.mockRejectedValue(new Error('cleanup denied'))
+
+    expect(await importOneSource(source, destination, new Set())).toMatchObject({
+      status: 'failed',
+      reason: 'source changed'
+    })
+    expect(rmMock).toHaveBeenCalledExactlyOnceWith(target, { recursive: true, force: true })
+  })
+
+  it('rolls back the owned root once when a nested mkdir fails', async () => {
+    addEntry(source, 'child', 'directory')
+    mkdirMock.mockResolvedValueOnce(undefined).mockRejectedValueOnce(new Error('nested conflict'))
+
+    expect(await importOneSource(source, destination, new Set())).toMatchObject({
+      status: 'failed',
+      reason: 'nested conflict'
+    })
+    expect(mkdirMock.mock.calls).toEqual([
+      [target, { recursive: false }],
+      [join(target, 'child'), { recursive: false }]
+    ])
+    expect(rmMock).toHaveBeenCalledExactlyOnceWith(target, { recursive: true, force: true })
+  })
+
+  it.each(['symlink', 'unsupported', 'missing'])(
+    'rolls back the owned root once when a nested entry becomes %s',
+    async (kind) => {
+      const child = addEntry(source, 'child', 'directory')
+      const file = addEntry(child, 'changed.txt', 'file')
+      if (kind === 'missing') {
+        stats.delete(file)
+      } else {
+        stats.set(file, statFor(kind === 'symlink' ? 'symlink' : 'unsupported'))
+      }
+
+      expect(await importOneSource(source, destination, new Set())).toMatchObject({
+        status: 'failed'
+      })
+      expect(mkdirMock).toHaveBeenCalledTimes(2)
+      expect(rmMock).toHaveBeenCalledExactlyOnceWith(target, { recursive: true, force: true })
+      expect(openMock).not.toHaveBeenCalled()
+    }
+  )
+
+  it.each(['top-level', 'nested'])(
+    'skips a %s symlink before creating output',
+    async (location) => {
+      if (location === 'top-level') {
+        stats.set(source, statFor('symlink'))
+      } else {
+        addEntry(addEntry(source, 'child', 'directory'), 'link', 'symlink')
+      }
+
+      expect(await importOneSource(source, destination, new Set())).toMatchObject({
+        status: 'skipped',
+        reason: 'symlink'
+      })
+      expect(mkdirMock).not.toHaveBeenCalled()
+      expect(rmMock).not.toHaveBeenCalled()
+    }
+  )
+
+  it('copies nested files with exclusive destinations and preserves rename metadata', async () => {
+    const file = addEntry(addEntry(source, 'child', 'directory'), 'data.txt', 'file')
+    const renamedTarget = join(destination, 'incoming copy')
+    const chunks: Buffer[] = []
+    const closeSource = vi.fn().mockResolvedValue(undefined)
+    const closeDestination = vi.fn().mockResolvedValue(undefined)
+    openMock.mockImplementation(async (_path: string, flags: unknown) => {
+      if (flags === 'wx') {
+        return {
+          createWriteStream: () =>
+            new Writable({
+              write(chunk, _encoding, callback) {
+                chunks.push(Buffer.from(chunk))
+                callback()
+              }
+            }),
+          close: closeDestination
+        }
+      }
+      return {
+        stat: async () => statFor('file'),
+        createReadStream: () => Readable.from([Buffer.from('payload')]),
+        close: closeSource
+      }
+    })
+
+    expect(await importOneSource(source, destination, new Set(['incoming']))).toEqual({
+      sourcePath: source,
+      status: 'imported',
+      destPath: renamedTarget,
+      kind: 'directory',
+      renamed: true
+    })
+    expect(mkdirMock.mock.calls).toEqual([
+      [renamedTarget, { recursive: false }],
+      [join(renamedTarget, 'child'), { recursive: false }]
+    ])
+    expect(openMock.mock.calls).toEqual([
+      [file, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0)],
+      [join(renamedTarget, 'child', 'data.txt'), 'wx']
+    ])
+    expect(Buffer.concat(chunks).toString()).toBe('payload')
+    expect(closeSource).toHaveBeenCalledOnce()
+    expect(closeDestination).toHaveBeenCalledOnce()
+    expect(rmMock).not.toHaveBeenCalled()
+    expect(unlinkMock).not.toHaveBeenCalled()
+  })
+
+  it('leaves directory cleanup out of a top-level file failure', async () => {
+    stats.set(source, statFor('file'))
+
+    expect(await importOneSource(source, destination, new Set())).toMatchObject({
+      status: 'failed'
+    })
+    expect(mkdirMock).not.toHaveBeenCalled()
+    expect(rmMock).not.toHaveBeenCalled()
+    expect(unlinkMock).not.toHaveBeenCalled()
+  })
+
+  it('cleans an owned root when the copy helper is called directly', async () => {
+    const failure = new Error('read failed')
+    readdirMock.mockRejectedValue(failure)
+
+    await expect(recursiveCopyDir(source, target)).rejects.toBe(failure)
+    expect(rmMock).toHaveBeenCalledExactlyOnceWith(target, { recursive: true, force: true })
+  })
+})
diff --git a/src/main/ipc/filesystem-import-local-tree-copy.ts b/src/main/ipc/filesystem-import-local-tree-copy.ts
index f2eb3492377f..06d68368ce91 100644
--- a/src/main/ipc/filesystem-import-local-tree-copy.ts
+++ b/src/main/ipc/filesystem-import-local-tree-copy.ts
@@ -1,5 +1,5 @@
 import { constants } from 'node:fs'
-import { lstat, mkdir, open, readdir, unlink } from 'node:fs/promises'
+import { lstat, mkdir, open, readdir, rm, unlink } from 'node:fs/promises'
 import { basename, join } from 'node:path'
 import { pipeline } from 'node:stream/promises'
 
@@ -23,13 +23,18 @@ export async function preScanForSymlinks(dirPath: string): Promise<boolean> {
   return false
 }
 
-/**
- * Recursively copy a directory and all its contents. Uses copyFile for
- * individual files to leverage native OS copy primitives instead of
- * buffering entire files into memory.
- */
 export async function recursiveCopyDir(srcDir: string, destDir: string): Promise<void> {
+  // A failed exclusive mkdir gives us no ownership to roll back.
   await mkdir(destDir, { recursive: false })
+  try {
+    await copyDirectoryContents(srcDir, destDir)
+  } catch (error) {
+    await rm(destDir, { recursive: true, force: true }).catch(() => {})
+    throw error
+  }
+}
+
+async function copyDirectoryContents(srcDir: string, destDir: string): Promise<void> {
   const entries = await readdir(srcDir, { withFileTypes: true })
   for (const entry of entries) {
     const srcPath = join(srcDir, entry.name)
@@ -39,7 +44,8 @@ export async function recursiveCopyDir(srcDir: string, destDir: string): Promise
       throw new Error(`Symlink not allowed in '${entry.name}'`)
     }
     if (statResult.isDirectory()) {
-      await recursiveCopyDir(srcPath, dstPath)
+      await mkdir(dstPath, { recursive: false })
+      await copyDirectoryContents(srcPath, dstPath)
       continue
     }
     if (!statResult.isFile()) {
diff --git a/src/main/ipc/filesystem-import-local.ts b/src/main/ipc/filesystem-import-local.ts
index 1df2b3f2fb36..c77d841a53d7 100644
--- a/src/main/ipc/filesystem-import-local.ts
+++ b/src/main/ipc/filesystem-import-local.ts
@@ -1,4 +1,4 @@
-import { lstat, rm } from 'node:fs/promises'
+import { lstat } from 'node:fs/promises'
 import { basename, join, resolve } from 'node:path'
 import { authorizeExternalPath } from './filesystem-auth'
 import { isENOENT } from './filesystem-path-containment'
@@ -82,9 +82,6 @@ export async function importOneSource(
       ? recursiveCopyDir(resolvedSource, destPath)
       : copyLocalFileNoFollow(resolvedSource, destPath))
   } catch (error) {
-    if (isDir) {
-      await rm(destPath, { recursive: true, force: true }).catch(() => {})
-    }
     return {
       sourcePath,
       status: 'failed',
diff --git a/src/main/ipc/filesystem-markdown-document-listing.test.ts b/src/main/ipc/filesystem-markdown-document-listing.test.ts
index d70d46c48e11..be94530352dd 100644
--- a/src/main/ipc/filesystem-markdown-document-listing.test.ts
+++ b/src/main/ipc/filesystem-markdown-document-listing.test.ts
@@ -1,15 +1,28 @@
 import path from 'node:path'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type * as MarkdownDocumentsModule from './markdown-documents'
 import {
   handlers,
   store,
-  dirEntry,
   WORKTREE_FEATURE_PATH,
   readdirMock,
   getSshFilesystemProviderMock,
   resetFilesystemIpcMocks
 } from './filesystem-test-harness'
 
+const { listMarkdownDocumentsMock, localOptionsMock } = vi.hoisted(() => ({
+  listMarkdownDocumentsMock: vi.fn(),
+  localOptionsMock: vi.fn()
+}))
+
+vi.mock('./markdown-documents', async (importOriginal) => ({
+  ...(await importOriginal<typeof MarkdownDocumentsModule>()),
+  listMarkdownDocuments: listMarkdownDocumentsMock
+}))
+vi.mock('./local-worktree-runtime-options', () => ({
+  getLocalGitOptionsForRegisteredWorktree: localOptionsMock
+}))
+
 vi.mock('electron', async () => (await import('./filesystem-test-harness')).electronMock)
 vi.mock('fs/promises', async () => (await import('./filesystem-test-harness')).fsPromisesMock)
 vi.mock(
@@ -64,95 +77,39 @@ import { invalidateAuthorizedRootsCache } from './registered-worktree-roots-cach
 describe('registerFilesystemHandlers', () => {
   beforeEach(() => {
     resetFilesystemIpcMocks()
+    listMarkdownDocumentsMock.mockReset().mockResolvedValue([])
+    localOptionsMock.mockReset().mockReturnValue({})
     // Reset module-level auth cache so each test starts with a fresh dirty
     // flag — prevents stale worktree data from a prior test's cache rebuild.
     invalidateAuthorizedRootsCache()
   })
 
-  it('lists markdown documents recursively for a registered worktree', async () => {
-    readdirMock.mockImplementation(async (dirPath: string) => {
-      if (dirPath === WORKTREE_FEATURE_PATH) {
-        return [
-          dirEntry({ name: 'README.md', file: true }),
-          dirEntry({ name: 'docs', directory: true }),
-          dirEntry({ name: 'script.ts', file: true })
-        ]
-      }
-      if (dirPath === path.join(WORKTREE_FEATURE_PATH, 'docs')) {
-        return [
-          dirEntry({ name: 'Guide.MDX', file: true }),
-          dirEntry({ name: 'notes.markdown', file: true })
-        ]
-      }
-      return []
-    })
-
+  it('lists local documents through the bundled discovery path after authorization', async () => {
+    const documents = [{ filePath: path.join(WORKTREE_FEATURE_PATH, 'README.md') }]
+    listMarkdownDocumentsMock.mockResolvedValue(documents)
     registerFilesystemHandlers(store as never)
 
     await expect(
-      handlers.get('fs:listMarkdownDocuments')!(null, {
-        rootPath: WORKTREE_FEATURE_PATH
-      })
-    ).resolves.toEqual([
-      {
-        filePath: path.join(WORKTREE_FEATURE_PATH, 'docs', 'Guide.MDX'),
-        relativePath: 'docs/Guide.MDX',
-        basename: 'Guide.MDX',
-        name: 'Guide'
-      },
-      {
-        filePath: path.join(WORKTREE_FEATURE_PATH, 'docs', 'notes.markdown'),
-        relativePath: 'docs/notes.markdown',
-        basename: 'notes.markdown',
-        name: 'notes'
-      },
-      {
-        filePath: path.join(WORKTREE_FEATURE_PATH, 'README.md'),
-        relativePath: 'README.md',
-        basename: 'README.md',
-        name: 'README'
-      }
-    ])
+      handlers.get('fs:listMarkdownDocuments')!(null, { rootPath: WORKTREE_FEATURE_PATH })
+    ).resolves.toBe(documents)
+    expect(localOptionsMock).toHaveBeenCalledWith(
+      store,
+      WORKTREE_FEATURE_PATH,
+      WORKTREE_FEATURE_PATH
+    )
+    expect(listMarkdownDocumentsMock).toHaveBeenCalledWith(WORKTREE_FEATURE_PATH, {})
+    expect(readdirMock).not.toHaveBeenCalled()
   })
 
-  it('skips ignored and symlinked directories when listing markdown documents', async () => {
-    readdirMock.mockImplementation(async (dirPath: string) => {
-      if (dirPath === WORKTREE_FEATURE_PATH) {
-        return [
-          dirEntry({ name: '.git', directory: true }),
-          dirEntry({ name: '.hidden', directory: true }),
-          dirEntry({ name: '.github', directory: true }),
-          dirEntry({ name: 'node_modules', directory: true }),
-          dirEntry({ name: 'linked-docs', directory: true, symlink: true }),
-          dirEntry({ name: 'visible.md', file: true })
-        ]
-      }
-      if (dirPath === path.join(WORKTREE_FEATURE_PATH, '.github')) {
-        return [dirEntry({ name: 'CONTRIBUTING.md', file: true })]
-      }
-      throw new Error(`Unexpected readdir: ${dirPath}`)
-    })
-
+  it('passes the workspace runtime distro into document discovery', async () => {
+    localOptionsMock.mockReturnValue({ wslDistro: 'Ubuntu' })
     registerFilesystemHandlers(store as never)
 
-    await expect(
-      handlers.get('fs:listMarkdownDocuments')!(null, {
-        rootPath: WORKTREE_FEATURE_PATH
-      })
-    ).resolves.toEqual([
-      {
-        filePath: path.join(WORKTREE_FEATURE_PATH, '.github', 'CONTRIBUTING.md'),
-        relativePath: '.github/CONTRIBUTING.md',
-        basename: 'CONTRIBUTING.md',
-        name: 'CONTRIBUTING'
-      },
-      {
-        filePath: path.join(WORKTREE_FEATURE_PATH, 'visible.md'),
-        relativePath: 'visible.md',
-        basename: 'visible.md',
-        name: 'visible'
-      }
-    ])
+    await handlers.get('fs:listMarkdownDocuments')!(null, { rootPath: WORKTREE_FEATURE_PATH })
+
+    expect(listMarkdownDocumentsMock).toHaveBeenCalledWith(WORKTREE_FEATURE_PATH, {
+      wslDistro: 'Ubuntu'
+    })
   })
 
   it('rejects markdown document listing for authorized but unregistered roots', async () => {
@@ -165,6 +122,7 @@ describe('registerFilesystemHandlers', () => {
     ).rejects.toThrow('Access denied: unknown repository or worktree path')
 
     expect(readdirMock).not.toHaveBeenCalled()
+    expect(listMarkdownDocumentsMock).not.toHaveBeenCalled()
   })
 
   it('lists remote markdown documents through the SSH filesystem provider', async () => {
@@ -196,5 +154,7 @@ describe('registerFilesystemHandlers', () => {
         name: 'README'
       }
     ])
+    expect(listMarkdownDocumentsMock).not.toHaveBeenCalled()
+    expect(localOptionsMock).not.toHaveBeenCalled()
   })
 })
diff --git a/src/main/ipc/filesystem-pull-request-linked-issue-lifetime.test.ts b/src/main/ipc/filesystem-pull-request-linked-issue-lifetime.test.ts
new file mode 100644
index 000000000000..e71ea22f7ba8
--- /dev/null
+++ b/src/main/ipc/filesystem-pull-request-linked-issue-lifetime.test.ts
@@ -0,0 +1,189 @@
+import { setImmediate as nextTurn } from 'node:timers/promises'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import {
+  handlers,
+  store,
+  WORKTREE_FEATURE_PATH,
+  resolveCommitMessageSettingsMock,
+  generatePullRequestFieldsFromContextMock,
+  getPullRequestDraftContextMock,
+  resolveHostedReviewBodyForGenerationMock,
+  loadPullRequestLinkedIssueMock,
+  getSshGitProviderMock,
+  resetFilesystemIpcMocks
+} from './filesystem-test-harness'
+
+const linkedLookup = vi.hoisted(() => ({ run: (): Promise<null> => Promise.resolve(null) }))
+
+vi.mock('electron', async () => (await import('./filesystem-test-harness')).electronMock)
+vi.mock('fs/promises', async () => (await import('./filesystem-test-harness')).fsPromisesMock)
+vi.mock(
+  '../wsl-unc-delete',
+  async () => (await import('./filesystem-test-harness')).wslUncDeleteMock
+)
+vi.mock(
+  '../crash-reporting/crash-breadcrumb-store',
+  async () => (await import('./filesystem-test-harness')).crashBreadcrumbMock
+)
+vi.mock(
+  '../local-downloaded-folder-promotion',
+  async () => (await import('./filesystem-test-harness')).folderPromotionMock
+)
+vi.mock(
+  '../git/status',
+  async () => (await import('./filesystem-test-harness')).gitStatusModuleMock
+)
+vi.mock(
+  '../git/check-ignored-paths',
+  async () => (await import('./filesystem-test-harness')).gitIgnoredPathsMock
+)
+vi.mock('../git/worktree', async () => (await import('./filesystem-test-harness')).gitWorktreeMock)
+vi.mock(
+  '../providers/ssh-filesystem-dispatch',
+  async () => (await import('./filesystem-test-harness')).sshFilesystemDispatchMock
+)
+vi.mock(
+  '../providers/ssh-git-dispatch',
+  async () => (await import('./filesystem-test-harness')).sshGitDispatchMock
+)
+vi.mock(
+  '../text-generation/commit-message-text-generation',
+  async () => (await import('./filesystem-test-harness')).textGenerationModuleMock
+)
+vi.mock(
+  '../text-generation/pull-request-context',
+  async () => (await import('./filesystem-test-harness')).pullRequestContextMock
+)
+vi.mock(
+  '../source-control/pull-request-template',
+  async () => (await import('./filesystem-test-harness')).pullRequestTemplateMock
+)
+vi.mock('../source-control/pull-request-linked-issue', async () => {
+  const { loadPullRequestLinkedIssueMock } = await import('./filesystem-test-harness')
+  return {
+    loadPullRequestLinkedIssue: (...args: unknown[]) => {
+      loadPullRequestLinkedIssueMock(...args)
+      // A vi.fn return observer would itself handle the rejection under test.
+      return linkedLookup.run()
+    }
+  }
+})
+
+import { registerFilesystemHandlers } from './filesystem'
+import { invalidateAuthorizedRootsCache } from './registered-worktree-roots-cache'
+
+describe.each(['local', 'SSH'])('PR linked-issue lifetime on %s', (host) => {
+  const draftContext = {
+    base: 'main',
+    branch: 'feature/ai',
+    branchChangedByPreparation: false,
+    commitSummary: 'a1b2c3d Add generation',
+    changeSummary: 'README.md | 2 +-',
+    patch: '+hello',
+    currentTitle: '',
+    currentBody: '',
+    currentDraft: false
+  }
+  const request = {
+    base: 'main',
+    title: '',
+    body: '',
+    draft: false,
+    worktreePath: host === 'SSH' ? '/remote/repo' : WORKTREE_FEATURE_PATH,
+    ...(host === 'SSH' ? { connectionId: 'conn-1' } : {})
+  }
+
+  beforeEach(() => {
+    resetFilesystemIpcMocks()
+    linkedLookup.run = () => Promise.resolve(null)
+    invalidateAuthorizedRootsCache()
+    resolveCommitMessageSettingsMock.mockReturnValue({
+      ok: true,
+      params: { agentId: 'codex', model: 'gpt-5.4-mini' }
+    })
+    resolveHostedReviewBodyForGenerationMock.mockResolvedValue('')
+    getPullRequestDraftContextMock.mockResolvedValue(draftContext)
+    getSshGitProviderMock.mockReturnValue({
+      exec: vi.fn(),
+      executeCommitMessagePlan: vi.fn()
+    })
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The existing IPC harness provides every Store member reached by this handler.
+    registerFilesystemHandlers(store as never)
+  })
+
+  it.each(['no changes', 'context error', 'template error'])(
+    'observes a late lookup rejection after %s',
+    async (outcome) => {
+      const issue = Promise.withResolvers<null>()
+      linkedLookup.run = () => issue.promise
+      const preparationError = new Error('branch preparation failed')
+      if (outcome === 'no changes') {
+        getPullRequestDraftContextMock.mockResolvedValue(null)
+      } else if (outcome === 'context error') {
+        getPullRequestDraftContextMock.mockRejectedValue(preparationError)
+      } else {
+        resolveHostedReviewBodyForGenerationMock.mockRejectedValue(preparationError)
+      }
+      const unhandled = vi.fn()
+      process.on('unhandledRejection', unhandled)
+      try {
+        await expect(
+          handlers.get('git:generatePullRequestFields')!(null, request)
+        ).resolves.toEqual({
+          success: false,
+          error:
+            outcome === 'no changes' ? 'No branch changes to summarize.' : preparationError.message
+        })
+        expect(loadPullRequestLinkedIssueMock).toHaveBeenCalledTimes(1)
+        issue.reject(new Error('Timed out waiting for a GitLab operation slot.'))
+        await nextTurn()
+        expect(unhandled).not.toHaveBeenCalled()
+        expect(generatePullRequestFieldsFromContextMock).not.toHaveBeenCalled()
+      } finally {
+        void issue.promise.catch(() => undefined)
+        process.off('unhandledRejection', unhandled)
+      }
+    }
+  )
+
+  it('observes a lookup rejection while preparation is pending and preserves the later error', async () => {
+    const issue = Promise.withResolvers<null>()
+    const preparation = Promise.withResolvers<typeof draftContext>()
+    const failure = new Error('lookup admission failed')
+    linkedLookup.run = () => issue.promise
+    getPullRequestDraftContextMock.mockReturnValue(preparation.promise)
+    const unhandled = vi.fn()
+    process.on('unhandledRejection', unhandled)
+    const result = Promise.resolve(
+      handlers.get('git:generatePullRequestFields')!(null, request)
+    ).catch((error: unknown) => error)
+    try {
+      await nextTurn()
+      expect(getPullRequestDraftContextMock).toHaveBeenCalledTimes(1)
+      issue.reject(failure)
+      await nextTurn()
+      expect(unhandled).not.toHaveBeenCalled()
+      preparation.resolve(draftContext)
+      expect(await result).toBe(failure)
+      expect(generatePullRequestFieldsFromContextMock).not.toHaveBeenCalled()
+    } finally {
+      issue.resolve(null)
+      preparation.resolve(draftContext)
+      await result
+      process.off('unhandledRejection', unhandled)
+    }
+  })
+
+  it('still rejects the caller when preparation succeeds but the lookup fails', async () => {
+    const issue = Promise.withResolvers<null>()
+    const failure = new Error('lookup failed')
+    linkedLookup.run = () => issue.promise
+    const result = Promise.resolve(
+      handlers.get('git:generatePullRequestFields')!(null, request)
+    ).catch((error: unknown) => error)
+    await nextTurn()
+    issue.reject(failure)
+    expect(await result).toBe(failure)
+    expect(generatePullRequestFieldsFromContextMock).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/main/ipc/filesystem-watcher-canonical-root-paths.test.ts b/src/main/ipc/filesystem-watcher-canonical-root-paths.test.ts
index 45c14d485e0d..9aa42e3107ee 100644
--- a/src/main/ipc/filesystem-watcher-canonical-root-paths.test.ts
+++ b/src/main/ipc/filesystem-watcher-canonical-root-paths.test.ts
@@ -1,3 +1,4 @@
+import { createWatcherSender } from './filesystem-watcher-test-sender'
 /*
  * macOS FSEvents reports OS-canonical paths (symlinks resolved, on-disk
  * casing). Before the rewrite at the watcher boundary those events reached the
@@ -80,7 +81,7 @@ describe('local filesystem watcher canonical root paths', () => {
       return { unsubscribe: vi.fn() } as never
     })
     const sendMock = vi.fn()
-    const sender = { isDestroyed: () => false, send: sendMock, once: vi.fn(), id: 1 }
+    const sender = createWatcherSender(1, sendMock)
     await handlers['fs:watchWorktree']({ sender }, { worktreePath })
     watcherCallback!(null, events)
     await vi.waitFor(
diff --git a/src/main/ipc/filesystem-watcher-document-lifetime.test.ts b/src/main/ipc/filesystem-watcher-document-lifetime.test.ts
new file mode 100644
index 000000000000..9bc42d1ef737
--- /dev/null
+++ b/src/main/ipc/filesystem-watcher-document-lifetime.test.ts
@@ -0,0 +1,299 @@
+import { EventEmitter } from 'node:events'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { createDebouncedBatch } from './filesystem-watcher-batch-control'
+
+type WatchArgs = { worktreePath: string; connectionId?: string }
+class Sender extends EventEmitter {
+  constructor(readonly id: number) {
+    super()
+  }
+  isDestroyed = () => false
+  send = vi.fn()
+}
+const { handleMock, watchRemote, createLocal, getProvider } = vi.hoisted(() => ({
+  handleMock: vi.fn(),
+  watchRemote: vi.fn(),
+  createLocal: vi.fn(),
+  getProvider: vi.fn()
+}))
+vi.mock('electron', () => ({ ipcMain: { handle: handleMock } }))
+vi.mock('node:fs/promises', () => ({ stat: async () => ({ isDirectory: () => true }) }))
+vi.mock('./filesystem-watcher-local-events', () => ({
+  createLocalWatcher: createLocal,
+  scheduleLocalBatchFlush: vi.fn()
+}))
+vi.mock('./parcel-watcher-process', () => ({ disposeWatcherProcess: vi.fn() }))
+vi.mock('../providers/ssh-filesystem-dispatch', () => ({
+  getSshFilesystemProvider: getProvider,
+  onSshFilesystemProviderRegistered: () => () => {}
+}))
+import {
+  REMOTE_WATCH_RETRY_MS,
+  watcherLifecycleState as state
+} from './filesystem-watcher-lifecycle-state'
+import { getLocalWatcherRoot, getRemoteWatcherKey } from './filesystem-watcher-paths'
+import { reinstallRemoteWatchersForConnection } from './filesystem-watcher-remote-controller'
+import { reinstallRemoteWatchersForConnectionCore } from './filesystem-watcher-remote-provider-rearm'
+import {
+  registerFilesystemWatcherHandlers,
+  closeAllWatchers,
+  closeLocalWatcherForWorktreePath,
+  closeRemoteWatcherForWorktreePath,
+  restoreLocalWatcherAfterFailedRemoval,
+  restoreRemoteWatcherAfterFailedRemoval
+} from './filesystem-watcher'
+
+const handlers = new Map<string, (event: { sender: Sender }, args: WatchArgs) => Promise<void>>()
+function invoke(channel: string, sender: Sender, args: WatchArgs): Promise<void> {
+  const handler = handlers.get(channel)
+  if (!handler) {
+    throw new Error(`Missing ${channel}`)
+  }
+  return handler({ sender }, args)
+}
+const watch = (sender: Sender, args: WatchArgs) => invoke('fs:watchWorktree', sender, args)
+const unwatch = (sender: Sender, args: WatchArgs) => invoke('fs:unwatchWorktree', sender, args)
+function deferred<T>() {
+  let resolve!: (value: T) => void
+  const promise = new Promise<T>((done) => {
+    resolve = done
+  })
+  return { promise, resolve }
+}
+function localRoot(unsubscribe = vi.fn(async () => {})) {
+  return {
+    subscription: { unsubscribe },
+    listeners: new Map(),
+    batch: createDebouncedBatch(),
+    rootPath: '/folder'
+  }
+}
+
+beforeEach(async () => {
+  await closeAllWatchers()
+  vi.clearAllMocks()
+  createLocal.mockImplementation(async () => localRoot())
+  watchRemote.mockImplementation(async () => vi.fn())
+  getProvider.mockReturnValue({ watch: watchRemote })
+  handleMock.mockImplementation((channel, handler) => handlers.set(channel, handler))
+  registerFilesystemWatcherHandlers()
+})
+afterEach(async () => {
+  await closeAllWatchers()
+  vi.useRealTimers()
+})
+
+describe('filesystem watcher renderer document ownership', () => {
+  it.each(['did-navigate', 'render-process-gone'])(
+    'releases installed local and SSH roots on %s without closing sibling owners',
+    async (event) => {
+      const sender = new Sender(1)
+      const sibling = new Sender(2)
+      const local = { worktreePath: '/folder' }
+      const remote = { ...local, connectionId: 'ssh' }
+      const root = localRoot()
+      const remoteClose = vi.fn()
+      createLocal.mockResolvedValue(root)
+      watchRemote.mockResolvedValue(remoteClose)
+      await watch(sender, local)
+      await watch(sender, remote)
+      await watch(sibling, local)
+      await watch(sibling, remote)
+      sender.emit(event)
+      await Promise.resolve()
+      expect(root.subscription.unsubscribe).not.toHaveBeenCalled()
+      expect(remoteClose).not.toHaveBeenCalled()
+      expect([...root.listeners.keys()]).toEqual([2])
+      expect([...state.desiredRemoteWatchers.values()][0].listeners.size).toBe(1)
+      sibling.emit(event)
+      await Promise.resolve()
+      expect(root.subscription.unsubscribe).toHaveBeenCalledTimes(1)
+      expect(remoteClose).toHaveBeenCalledTimes(1)
+      expect(state.watchedRoots.size).toBe(0)
+      expect(state.remoteWatchers.size).toBe(0)
+      expect(state.desiredRemoteWatchers.size).toBe(0)
+      expect(sender.eventNames()).toEqual([])
+      expect(sibling.eventNames()).toEqual([])
+    }
+  )
+
+  it('keeps same-document and blocked navigations alive, and removes lifecycle listeners at shutdown', async () => {
+    const sender = new Sender(1)
+    for (let cycle = 0; cycle < 3; cycle++) {
+      await watch(sender, { worktreePath: '/folder' })
+      sender.emit('did-start-navigation')
+      sender.emit('did-navigate-in-page')
+      expect(state.watchedRoots.size).toBe(1)
+      for (const event of ['destroyed', 'did-navigate', 'render-process-gone']) {
+        expect(sender.listenerCount(event)).toBe(1)
+      }
+      await closeAllWatchers()
+      expect(sender.eventNames()).toEqual([])
+    }
+  })
+
+  it.each(['local', 'ssh'])(
+    'does not revive a cancelled %s setup for a joiner whose document reloaded',
+    async (kind) => {
+      const sender = new Sender(1)
+      const joiner = new Sender(2)
+      const args = { worktreePath: '/folder', ...(kind === 'ssh' ? { connectionId: 'ssh' } : {}) }
+      const install = deferred<ReturnType<typeof localRoot> & (() => void)>()
+      const setup = kind === 'ssh' ? watchRemote : createLocal
+      setup.mockReturnValueOnce(install.promise)
+      const first = watch(sender, args)
+      await vi.waitFor(() => expect(setup).toHaveBeenCalledTimes(1))
+      await unwatch(sender, args)
+      await Promise.resolve()
+      const key =
+        kind === 'ssh' ? getRemoteWatcherKey('ssh', '/folder') : getLocalWatcherRoot('/folder').key
+      const token =
+        kind === 'ssh'
+          ? state.inFlightRemoteInstalls.get(key)
+          : state.inFlightLocalInstalls.get(key)
+      expect(token?.abortController.signal.aborted).toBe(true)
+      const pendingJoiner = watch(joiner, args)
+      joiner.emit('did-navigate')
+      const fresh = watch(joiner, { ...args, worktreePath: '/fresh' })
+      const closeLate = vi.fn(async () => {})
+      install.resolve(Object.assign(closeLate, localRoot(closeLate)))
+      await Promise.all([first, pendingJoiner, fresh])
+      expect(setup.mock.calls.filter(([path]) => path === '/folder')).toHaveLength(1)
+      expect(closeLate).toHaveBeenCalledTimes(1)
+      expect(kind === 'ssh' ? state.remoteWatchers.has(key) : state.watchedRoots.has(key)).toBe(
+        false
+      )
+      expect(setup).toHaveBeenCalledTimes(2)
+    }
+  )
+
+  it.each(['local', 'ssh'])(
+    'aborts pending %s setup on renderer crash and discards late success',
+    async (kind) => {
+      const sender = new Sender(1)
+      const setup = kind === 'ssh' ? watchRemote : createLocal
+      const install = deferred<ReturnType<typeof localRoot> & (() => void)>()
+      setup.mockReturnValueOnce(install.promise)
+      const pending = watch(sender, {
+        worktreePath: '/folder',
+        ...(kind === 'ssh' ? { connectionId: 'ssh' } : {})
+      })
+      await vi.waitFor(() => expect(setup).toHaveBeenCalledTimes(1))
+      const token = [
+        ...(kind === 'ssh' ? state.inFlightRemoteInstalls : state.inFlightLocalInstalls).values()
+      ][0]
+      sender.emit('render-process-gone')
+      await Promise.resolve()
+      expect(token.abortController.signal.aborted).toBe(true)
+      const closeLate = vi.fn(async () => {})
+      install.resolve(Object.assign(closeLate, localRoot(closeLate)))
+      await pending
+      expect(closeLate).toHaveBeenCalledTimes(1)
+      expect(state.watchedRoots.size + state.remoteWatchers.size).toBe(0)
+    }
+  )
+
+  it('does not re-arm stale SSH handler or retry snapshots after reload', async () => {
+    vi.useFakeTimers()
+    const sender = new Sender(1)
+    const args = { worktreePath: '/folder', connectionId: 'ssh' }
+    watchRemote.mockRejectedValueOnce(new Error('temporary unavailable'))
+    await watch(sender, args)
+    const retry = deferred<() => void>()
+    watchRemote.mockReturnValueOnce(retry.promise)
+    await vi.advanceTimersByTimeAsync(REMOTE_WATCH_RETRY_MS)
+    expect(watchRemote).toHaveBeenCalledTimes(2)
+    sender.emit('did-navigate')
+    // A fresh document can ask for the same root while the old retry is settling.
+    const fresh = watch(sender, args)
+    retry.resolve(vi.fn())
+    await fresh
+    expect(state.pendingRemoteWatcherRetries.size).toBe(0)
+    expect(state.remoteWatcherResyncStates.size).toBe(0)
+    expect(watchRemote).toHaveBeenCalledTimes(2)
+  })
+
+  it('does not re-arm an old provider snapshot into the same WebContents after replacement', async () => {
+    const sender = new Sender(1)
+    const args = { worktreePath: '/folder', connectionId: 'ssh' }
+    await watch(sender, args)
+    const pending = deferred<'unavailable'>()
+    const dependencies = {
+      install: vi.fn(() => pending.promise),
+      requestResync: vi.fn(),
+      scheduleRetry: vi.fn(),
+      scheduleDormant: vi.fn()
+    }
+    reinstallRemoteWatchersForConnectionCore('ssh', dependencies)
+    sender.emit('did-navigate')
+    await watch(sender, args)
+    pending.resolve('unavailable')
+    await pending.promise
+    await Promise.resolve()
+    expect(dependencies.scheduleRetry).not.toHaveBeenCalled()
+    expect(dependencies.requestResync).not.toHaveBeenCalled()
+    expect(dependencies.scheduleDormant).not.toHaveBeenCalled()
+  })
+
+  it.each(['local', 'ssh'])(
+    'does not restore a replaced sibling document after an awaited %s removal recovery',
+    async (kind) => {
+      const first = new Sender(1)
+      const sibling = new Sender(2)
+      const args = { worktreePath: '/folder', ...(kind === 'ssh' ? { connectionId: 'ssh' } : {}) }
+      await watch(first, args)
+      await watch(sibling, args)
+      await (kind === 'ssh'
+        ? closeRemoteWatcherForWorktreePath('ssh', '/folder')
+        : closeLocalWatcherForWorktreePath('/folder'))
+      const install = deferred<ReturnType<typeof localRoot> & (() => void)>()
+      const setup = kind === 'ssh' ? watchRemote : createLocal
+      setup.mockReturnValueOnce(install.promise)
+      const restore =
+        kind === 'ssh'
+          ? restoreRemoteWatcherAfterFailedRemoval('ssh', '/folder')
+          : restoreLocalWatcherAfterFailedRemoval('/folder')
+      await vi.waitFor(() => expect(setup).toHaveBeenCalledTimes(2))
+      sibling.emit('did-navigate')
+      install.resolve(Object.assign(vi.fn(), localRoot()))
+      await restore
+      expect(sibling.send).not.toHaveBeenCalled()
+      expect(first.send).toHaveBeenCalledTimes(1)
+      const roots = kind === 'ssh' ? state.remoteWatchers : state.watchedRoots
+      expect([...roots.values()][0].listeners.size).toBe(1)
+    }
+  )
+
+  it('retains zero roots and listeners across 15 reloads and a renderer crash', async () => {
+    const sender = new Sender(1)
+    const closeLocal = vi.fn(async () => {})
+    const closeRemote = vi.fn()
+    createLocal.mockImplementation(async () => localRoot(closeLocal))
+    watchRemote.mockResolvedValue(closeRemote)
+    for (let generation = 0; generation < 16; generation++) {
+      await watch(sender, { worktreePath: `/folder-${generation}` })
+      await watch(sender, { worktreePath: `/folder-${generation}`, connectionId: 'ssh' })
+      sender.emit(generation === 15 ? 'render-process-gone' : 'did-navigate')
+      await Promise.resolve()
+      expect(
+        state.watchedRoots.size + state.remoteWatchers.size + state.desiredRemoteWatchers.size
+      ).toBe(0)
+      expect(sender.eventNames()).toEqual([])
+    }
+    expect(closeLocal).toHaveBeenCalledTimes(16)
+    expect(closeRemote).toHaveBeenCalledTimes(16)
+  })
+
+  it('clears desired SSH roots while no provider is available and does not re-arm them on reconnect', async () => {
+    const sender = new Sender(1)
+    getProvider.mockReturnValue(undefined)
+    await watch(sender, { worktreePath: '/folder', connectionId: 'ssh' })
+    expect(state.pendingRemoteWatcherRetries.size).toBe(1)
+    sender.emit('render-process-gone')
+    getProvider.mockReturnValue({ watch: watchRemote })
+    reinstallRemoteWatchersForConnection('ssh')
+    expect(state.pendingRemoteWatcherRetries.size).toBe(0)
+    expect(state.desiredRemoteWatchers.size).toBe(0)
+    expect(watchRemote).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/main/ipc/filesystem-watcher-dormant-rearm.test.ts b/src/main/ipc/filesystem-watcher-dormant-rearm.test.ts
index 7d27d4ca780a..c4931cd7cb2b 100644
--- a/src/main/ipc/filesystem-watcher-dormant-rearm.test.ts
+++ b/src/main/ipc/filesystem-watcher-dormant-rearm.test.ts
@@ -1,3 +1,4 @@
+import { senderEvents } from './filesystem-watcher-test-sender'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 
 const { handleMock, getSshFilesystemProviderMock, providerRegistrationListeners } = vi.hoisted(
@@ -36,10 +37,11 @@ const DORMANT_FIRST_MS = 60_000
 function createSender(id: number): {
   isDestroyed: () => boolean
   send: ReturnType<typeof vi.fn>
+  removeListener: ReturnType<typeof vi.fn>
   once: ReturnType<typeof vi.fn>
   id: number
 } {
-  return { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id }
+  return { isDestroyed: () => false, send: vi.fn(), ...senderEvents(), id }
 }
 
 describe('remote filesystem watcher dormant re-arm', () => {
diff --git a/src/main/ipc/filesystem-watcher-handlers.ts b/src/main/ipc/filesystem-watcher-handlers.ts
index bac74f635891..39f9ef0c184f 100644
--- a/src/main/ipc/filesystem-watcher-handlers.ts
+++ b/src/main/ipc/filesystem-watcher-handlers.ts
@@ -1,10 +1,12 @@
 import { ipcMain } from 'electron'
+import { isCurrentWatcherSender } from './filesystem-watcher-sender-lifetime'
 import { onSshFilesystemProviderRegistered } from '../providers/ssh-filesystem-dispatch'
 import { watcherLifecycleState } from './filesystem-watcher-lifecycle-state'
 import { getRemoteWatcherKey } from './filesystem-watcher-paths'
 import {
   cancelInFlightRemoteInstallIfUnowned,
   forgetDesiredRemoteWatcher,
+  registerWatcherSenderCleanup,
   releaseRemoteWatchListener
 } from './filesystem-watcher-listener-lifecycle'
 import {
@@ -30,6 +32,7 @@ export function registerFilesystemWatcherHandlers(): void {
   ipcMain.handle(
     'fs:watchWorktree',
     async (event, args: { worktreePath: string; connectionId?: string }): Promise<void> => {
+      const senderSignal = registerWatcherSenderCleanup(event.sender)
       if (args.connectionId) {
         // Why: a real new watch reopens the subsystem after closeAllWatchers latched it shut (also resets tests between cases).
         watcherLifecycleState.remoteWatchersClosed = false
@@ -42,6 +45,9 @@ export function registerFilesystemWatcherHandlers(): void {
           args.connectionId,
           args.worktreePath
         )
+        if (!isCurrentWatcherSender(event.sender, senderSignal)) {
+          return
+        }
         if (result === 'capacity') {
           // Why straight to the dormant backoff: the cap is full until some other root is released,
           // which a 1 Hz reinstall cannot bring about — it only adds relay load per refused root.
diff --git a/src/main/ipc/filesystem-watcher-large-batch.test.ts b/src/main/ipc/filesystem-watcher-large-batch.test.ts
index 3d71581595ea..240ca6290422 100644
--- a/src/main/ipc/filesystem-watcher-large-batch.test.ts
+++ b/src/main/ipc/filesystem-watcher-large-batch.test.ts
@@ -1,3 +1,4 @@
+import { createWatcherSender } from './filesystem-watcher-test-sender'
 import { join, resolve } from 'node:path'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
@@ -68,10 +69,7 @@ describe('local filesystem watcher large batches', () => {
       return { unsubscribe: vi.fn() } as never
     })
 
-    await handlers['fs:watchWorktree'](
-      { sender: { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 1 } },
-      { worktreePath }
-    )
+    await handlers['fs:watchWorktree']({ sender: createWatcherSender(1) }, { worktreePath })
 
     const events = Array.from({ length: 200_000 }, (_, index): WatcherEvent => ({
       type: 'delete',
@@ -92,7 +90,7 @@ describe('local filesystem watcher large batches', () => {
       return { unsubscribe: vi.fn() } as never
     })
     const worktreePath = resolve('/tmp/repo')
-    const sender = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 1 }
+    const sender = createWatcherSender(1)
 
     await handlers['fs:watchWorktree']({ sender }, { worktreePath })
     watcherCallback?.(
@@ -124,7 +122,7 @@ describe('local filesystem watcher large batches', () => {
     })
     const worktreePath = resolve('/tmp/repo')
     const filePath = join(worktreePath, 'a.ts')
-    const sender = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 1 }
+    const sender = createWatcherSender(1)
 
     await handlers['fs:watchWorktree']({ sender }, { worktreePath })
     watcherCallback?.(null, [{ type: 'update', path: filePath }])
@@ -152,7 +150,7 @@ describe('local filesystem watcher large batches', () => {
       return { unsubscribe: vi.fn() } as never
     })
     const worktreePath = resolve('/tmp/repo')
-    const sender = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 1 }
+    const sender = createWatcherSender(1)
 
     await handlers['fs:watchWorktree']({ sender }, { worktreePath })
     // Step under the trailing window so only the max wait can force a flush.
diff --git a/src/main/ipc/filesystem-watcher-lifecycle-state.ts b/src/main/ipc/filesystem-watcher-lifecycle-state.ts
index 7d6a120c0a72..feef5d40373e 100644
--- a/src/main/ipc/filesystem-watcher-lifecycle-state.ts
+++ b/src/main/ipc/filesystem-watcher-lifecycle-state.ts
@@ -65,7 +65,7 @@ export const watcherLifecycleState = {
   watchedRoots: new Map<string, WatchedRoot>(),
   unwatchableRoots: new Set<string>(),
   // Why: key cleanup by sender WebContents (not per root) to avoid MaxListeners warnings when a workspace has many worktrees open.
-  senderCleanupRegistered: new Set<number>(),
+  senderLifetimes: new Map<number, { signal: AbortSignal; dispose: () => void }>(),
   pendingTeardowns: new Map<string, ReturnType<typeof setTimeout>>(),
   // Why: @parcel/watcher unsubscribe does native async work that sender-destroy can start before shutdown, so will-quit must still await it.
   pendingLocalUnsubscribes: new Set<Promise<void>>(),
diff --git a/src/main/ipc/filesystem-watcher-listener-lifecycle.ts b/src/main/ipc/filesystem-watcher-listener-lifecycle.ts
index 713305069e32..c2dd5f3dc774 100644
--- a/src/main/ipc/filesystem-watcher-listener-lifecycle.ts
+++ b/src/main/ipc/filesystem-watcher-listener-lifecycle.ts
@@ -8,6 +8,7 @@ import {
   watcherLifecycleState
 } from './filesystem-watcher-lifecycle-state'
 import { cancelLocalBatchFlush } from './filesystem-watcher-batch-control'
+import { captureWatcherSenderLifetime } from './filesystem-watcher-sender-lifetime'
 
 export function rememberUnwatchableRoot(rootKey: string): void {
   const { unwatchableRoots } = watcherLifecycleState
@@ -172,13 +173,8 @@ export function releaseRemoteWatchListener(key: string, senderId: number): void
   watcherLifecycleState.remoteWatchers.delete(key)
 }
 
-export function registerWatcherSenderCleanup(sender: WebContents): void {
-  if (watcherLifecycleState.senderCleanupRegistered.has(sender.id)) {
-    return
-  }
-  watcherLifecycleState.senderCleanupRegistered.add(sender.id)
-  sender.once('destroyed', () => {
-    watcherLifecycleState.senderCleanupRegistered.delete(sender.id)
+export function registerWatcherSenderCleanup(sender: WebContents): AbortSignal {
+  return captureWatcherSenderLifetime(sender, () => {
     cleanupLocalWatchersForSender(sender.id)
     cleanupRemoteWatchersForSender(sender.id)
   })
@@ -215,6 +211,9 @@ function cleanupRemoteWatchersForSender(senderId: number): void {
   for (const key of Array.from(watcherLifecycleState.desiredRemoteWatchers.keys())) {
     forgetDesiredRemoteWatcher(key, senderId)
   }
+  for (const resync of watcherLifecycleState.remoteWatcherResyncStates.values()) {
+    resync.listeners.delete(senderId)
+  }
   for (const [key, suspended] of watcherLifecycleState.suspendedRemoteWatcherListeners) {
     suspended.listeners.delete(senderId)
     if (suspended.listeners.size === 0) {
diff --git a/src/main/ipc/filesystem-watcher-local-events.test.ts b/src/main/ipc/filesystem-watcher-local-events.test.ts
index b5ec3eab9391..343ee2bc3ad1 100644
--- a/src/main/ipc/filesystem-watcher-local-events.test.ts
+++ b/src/main/ipc/filesystem-watcher-local-events.test.ts
@@ -336,7 +336,7 @@ describe('local filesystem watcher flush serialization', () => {
     // Why real timers: fake-timers' refresh() revives a cleared handle, but Node's is a no-op — the bug only shows on real Timeouts.
     vi.useRealTimers()
     statMock.mockResolvedValue({ isDirectory: () => true })
-    const listener = { ...sender, id: 7, once: vi.fn() }
+    const listener = { ...sender, id: 7, removeListener: vi.fn(), once: vi.fn() }
     try {
       await subscribeLocalWatcher('/repo', listener as never)
       watcherCallback?.(null, [{ type: 'delete', path: '/repo/file.ts' }])
diff --git a/src/main/ipc/filesystem-watcher-local-install.ts b/src/main/ipc/filesystem-watcher-local-install.ts
index 27cfc6dafcf0..806ab75b82d8 100644
--- a/src/main/ipc/filesystem-watcher-local-install.ts
+++ b/src/main/ipc/filesystem-watcher-local-install.ts
@@ -27,48 +27,50 @@ export async function installLocalWatcher(
 ): Promise<LocalWatcherInstallResult> {
   let root: WatchedRoot
   try {
-    const s = await stat(rootPath)
-    if (!s.isDirectory()) {
-      console.warn(`[filesystem-watcher] not a directory: ${rootKey}`)
+    try {
+      const s = await stat(rootPath)
+      if (!s.isDirectory()) {
+        console.warn(`[filesystem-watcher] not a directory: ${rootKey}`)
+        rememberUnwatchableRoot(rootKey)
+        return 'unavailable'
+      }
+    } catch {
+      console.warn(`[filesystem-watcher] cannot stat root: ${rootKey}`)
       rememberUnwatchableRoot(rootKey)
       return 'unavailable'
     }
-  } catch {
-    console.warn(`[filesystem-watcher] cannot stat root: ${rootKey}`)
-    rememberUnwatchableRoot(rootKey)
-    return 'unavailable'
-  }
 
-  try {
-    // Why: WSL paths use one snapshot subprocess inside the distro so `wsl --shutdown` can kill it; native Windows uses @parcel/watcher.
-    root = isWslPath(worktreePath)
-      ? await createWslWatcher(
-          rootKey,
-          worktreePath,
-          {
-            ignoreDirs: WATCHER_IGNORE_DIRS,
-            scheduleBatchFlush: scheduleLocalBatchFlush,
-            watchedRoots: watcherLifecycleState.watchedRoots
-          },
-          cancelToken.abortController.signal
-        )
-      : await createLocalWatcher(rootKey, rootPath, cancelToken.abortController.signal)
-  } catch (error) {
-    // Why: setup can fail after its child misses the exit deadline; retain that owner even when the renderer-facing error is swallowed.
-    retainLocalWatcherPhysicalFailure(rootKey, error)
-    if (cancelToken.cancelled) {
-      if (isWatcherProcessFailure(error) && error.code === 'process_unavailable') {
-        throw error
+    try {
+      // Why: WSL paths use one snapshot subprocess inside the distro so `wsl --shutdown` can kill it; native Windows uses @parcel/watcher.
+      root = isWslPath(worktreePath)
+        ? await createWslWatcher(
+            rootKey,
+            worktreePath,
+            {
+              ignoreDirs: WATCHER_IGNORE_DIRS,
+              scheduleBatchFlush: scheduleLocalBatchFlush,
+              watchedRoots: watcherLifecycleState.watchedRoots
+            },
+            cancelToken.abortController.signal
+          )
+        : await createLocalWatcher(rootKey, rootPath, cancelToken.abortController.signal)
+    } catch (error) {
+      // Why: setup can fail after its child misses the exit deadline; retain that owner even when the renderer-facing error is swallowed.
+      retainLocalWatcherPhysicalFailure(rootKey, error)
+      if (cancelToken.cancelled) {
+        if (isWatcherProcessFailure(error) && error.code === 'process_unavailable') {
+          throw error
+        }
+        return 'cancelled'
       }
-      return 'cancelled'
-    }
-    // Why: capacity is transient — allow retry once another child exits instead of caching this root as permanently failed.
-    if (error instanceof WatcherChildCapacityError) {
-      scheduleCapacityRetry(cancelToken.listeners)
-      return 'capacity'
+      // Why: capacity is transient — allow retry once another child exits instead of caching this root as permanently failed.
+      if (error instanceof WatcherChildCapacityError) {
+        scheduleCapacityRetry(cancelToken.listeners)
+        return 'capacity'
+      }
+      rememberUnwatchableRoot(rootKey)
+      return 'unavailable'
     }
-    rememberUnwatchableRoot(rootKey)
-    return 'unavailable'
   } finally {
     if (watcherLifecycleState.inFlightLocalInstalls.get(rootKey) === cancelToken) {
       watcherLifecycleState.inFlightLocalInstalls.delete(rootKey)
diff --git a/src/main/ipc/filesystem-watcher-local-removal.ts b/src/main/ipc/filesystem-watcher-local-removal.ts
index a3d4b6ff558b..78f015f7b941 100644
--- a/src/main/ipc/filesystem-watcher-local-removal.ts
+++ b/src/main/ipc/filesystem-watcher-local-removal.ts
@@ -1,3 +1,4 @@
+import { isCurrentWatcherSender } from './filesystem-watcher-sender-lifetime'
 import type { WebContents } from 'electron'
 import type { FsChangedPayload } from '../../shared/filesystem-entry-types'
 import {
@@ -10,6 +11,7 @@ import { getLocalWatcherRoot } from './filesystem-watcher-paths'
 import { watcherLifecycleState } from './filesystem-watcher-lifecycle-state'
 import {
   abandonLocalUnsubscribes,
+  registerWatcherSenderCleanup,
   clearLocalCapacityRetry,
   trackDetachedLocalUnsubscribe
 } from './filesystem-watcher-listener-lifecycle'
@@ -124,29 +126,40 @@ export async function restoreLocalWatcherAfterFailedRemoval(worktreePath: string
     return
   }
   watcherLifecycleState.suspendedLocalWatcherListeners.delete(rootKey)
-  const failures: unknown[] = []
-  const failedListeners = new Map<number, WebContents>()
-  for (const sender of suspended.listeners.values()) {
-    if (sender.isDestroyed()) {
+  const failures: { sender: WebContents; signal: AbortSignal; error: unknown }[] = []
+  const owners = Array.from(suspended.listeners.values(), (sender) => ({
+    sender,
+    signal: registerWatcherSenderCleanup(sender)
+  }))
+  for (const { sender, signal } of owners) {
+    if (!isCurrentWatcherSender(sender, signal)) {
       continue
     }
     try {
-      await subscribeLocalWatcher(suspended.worktreePath, sender)
+      await subscribeLocalWatcher(suspended.worktreePath, sender, undefined, signal)
+      if (!isCurrentWatcherSender(sender, signal)) {
+        continue
+      }
       sender.send('fs:changed', {
         worktreePath: suspended.worktreePath,
         events: [{ kind: 'overflow', absolutePath: suspended.worktreePath }]
       } satisfies FsChangedPayload)
     } catch (error) {
-      failures.push(error)
-      failedListeners.set(sender.id, sender)
+      if (!isCurrentWatcherSender(sender, signal)) {
+        continue
+      }
+      failures.push({ sender, signal, error })
     }
   }
-  if (failures.length > 0) {
+  const liveFailures = failures.filter(({ sender, signal }) =>
+    isCurrentWatcherSender(sender, signal)
+  )
+  if (liveFailures.length > 0) {
     watcherLifecycleState.suspendedLocalWatcherListeners.set(rootKey, {
       worktreePath: suspended.worktreePath,
-      listeners: failedListeners
+      listeners: new Map(liveFailures.map(({ sender }) => [sender.id, sender]))
     })
-    throw failures[0]
+    throw liveFailures[0].error
   }
 }
 
diff --git a/src/main/ipc/filesystem-watcher-local-subscription.ts b/src/main/ipc/filesystem-watcher-local-subscription.ts
index e888893dbf46..c667210078ae 100644
--- a/src/main/ipc/filesystem-watcher-local-subscription.ts
+++ b/src/main/ipc/filesystem-watcher-local-subscription.ts
@@ -11,21 +11,25 @@ import {
   addLocalWatchListener,
   clearLocalCapacityRetry,
   rememberUnwatchableRoot,
+  registerWatcherSenderCleanup,
   takeLocalCapacityRetryListeners,
   trackDetachedLocalUnsubscribe
 } from './filesystem-watcher-listener-lifecycle'
 import { cancelLocalBatchFlush } from './filesystem-watcher-batch-control'
 import { scheduleLocalCapacityRetry } from './filesystem-watcher-local-capacity'
 import { installLocalWatcher } from './filesystem-watcher-local-install'
+import { isCurrentWatcherSender } from './filesystem-watcher-sender-lifetime'
 
 // ── Subscribe / Unsubscribe ──────────────────────────────────────────
 
 export async function subscribeLocalWatcher(
   worktreePath: string,
   sender: WebContents,
-  generation = watcherLifecycleState.localWatcherLifecycleGeneration
+  generation = watcherLifecycleState.localWatcherLifecycleGeneration,
+  senderSignal = registerWatcherSenderCleanup(sender)
 ): Promise<void> {
   if (
+    !isCurrentWatcherSender(sender, senderSignal) ||
     watcherLifecycleState.localWatchersClosed ||
     generation !== watcherLifecycleState.localWatcherLifecycleGeneration
   ) {
@@ -33,7 +37,7 @@ export async function subscribeLocalWatcher(
   }
   const finishInstall = beginWatcherInstall(worktreePath)
   try {
-    await subscribeWhileRemovalAllowed(worktreePath, sender, generation)
+    await subscribeWhileRemovalAllowed(worktreePath, sender, generation, senderSignal)
   } finally {
     finishInstall()
   }
@@ -42,9 +46,11 @@ export async function subscribeLocalWatcher(
 async function subscribeWhileRemovalAllowed(
   worktreePath: string,
   sender: WebContents,
-  generation: number
+  generation: number,
+  senderSignal: AbortSignal
 ): Promise<void> {
   if (
+    !isCurrentWatcherSender(sender, senderSignal) ||
     watcherLifecycleState.localWatchersClosed ||
     generation !== watcherLifecycleState.localWatcherLifecycleGeneration
   ) {
@@ -70,6 +76,9 @@ async function subscribeWhileRemovalAllowed(
     watcherLifecycleState.pendingTeardowns.delete(rootKey)
   }
   const capacityRetryListeners = takeLocalCapacityRetryListeners(rootKey)
+  const retrySignals = new Map(
+    capacityRetryListeners.map((listener) => [listener.id, registerWatcherSenderCleanup(listener)])
+  )
 
   if (root) {
     for (const listener of capacityRetryListeners) {
@@ -91,6 +100,10 @@ async function subscribeWhileRemovalAllowed(
       }
     }
     const result = await pendingInstall
+    const liveCapacityListeners = capacityRetryListeners.filter((listener) =>
+      isCurrentWatcherSender(listener, retrySignals.get(listener.id)!)
+    )
+    const senderIsCurrent = isCurrentWatcherSender(sender, senderSignal)
     if (
       result === 'cancelled' &&
       !canJoinInstall &&
@@ -102,33 +115,42 @@ async function subscribeWhileRemovalAllowed(
         watcherLifecycleState.pendingLocalInstallPromises.delete(rootKey)
       }
       const retryListeners = new Map(
-        capacityRetryListeners.map((listener) => [listener.id, listener])
+        liveCapacityListeners.map((listener) => [listener.id, listener])
       )
-      retryListeners.set(sender.id, sender)
+      if (senderIsCurrent) {
+        retryListeners.set(sender.id, sender)
+      }
       for (const listener of retryListeners.values()) {
         if (!listener.isDestroyed()) {
-          await subscribeWhileRemovalAllowed(worktreePath, listener, generation)
+          await subscribeWhileRemovalAllowed(
+            worktreePath,
+            listener,
+            generation,
+            listener === sender ? senderSignal : retrySignals.get(listener.id)!
+          )
         }
       }
       return
     }
     if (!inFlight) {
       if (result === 'installed') {
-        for (const listener of capacityRetryListeners) {
+        for (const listener of liveCapacityListeners) {
           addLocalWatchListener(rootKey, listener)
         }
       } else if (result === 'capacity') {
         const retryListeners = new Map(
-          capacityRetryListeners.map((listener) => [listener.id, listener])
+          liveCapacityListeners.map((listener) => [listener.id, listener])
         )
-        retryListeners.set(sender.id, sender)
+        if (senderIsCurrent) {
+          retryListeners.set(sender.id, sender)
+        }
         scheduleLocalCapacityRetry(rootKey, worktreePath, retryListeners, subscribeLocalWatcher)
       }
     }
     if (
       result === 'installed' &&
       watcherLifecycleState.watchedRoots.has(rootKey) &&
-      !sender.isDestroyed() &&
+      senderIsCurrent &&
       (!inFlight || inFlight.listeners.has(sender.id))
     ) {
       addLocalWatchListener(rootKey, sender)
diff --git a/src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts b/src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts
index eb161c1ba30c..da8b92dbcf8b 100644
--- a/src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts
+++ b/src/main/ipc/filesystem-watcher-local-unsubscribe.test.ts
@@ -1,3 +1,4 @@
+import { createWatcherSender } from './filesystem-watcher-test-sender'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import type * as ParcelWatcherProcess from './parcel-watcher-process'
 
@@ -85,6 +86,7 @@ describe('local filesystem watcher unsubscribe cleanup', () => {
     const sender = {
       isDestroyed: () => false,
       send: vi.fn(),
+      removeListener: vi.fn(),
       once: vi.fn((event: string, callback: () => void) => {
         if (event === 'destroyed') {
           destroyedCallbacks.push(callback)
@@ -124,7 +126,7 @@ describe('local filesystem watcher unsubscribe cleanup', () => {
       watcherCallback = callback as typeof watcherCallback
       return { unsubscribe: unsubscribeMock } as never
     })
-    const sender = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 1 }
+    const sender = createWatcherSender(1)
 
     await handlers['fs:watchWorktree']({ sender }, { worktreePath: '/tmp/repo' })
     watcherCallback(new Error('root disappeared'), [])
@@ -157,6 +159,7 @@ describe('local filesystem watcher unsubscribe cleanup', () => {
     const sender = {
       isDestroyed: () => false,
       send: vi.fn(),
+      removeListener: vi.fn(),
       once: vi.fn((event: string, callback: () => void) => {
         if (event === 'destroyed') {
           destroyedCallbacks.push(callback)
@@ -197,18 +200,8 @@ describe('local filesystem watcher unsubscribe cleanup', () => {
           subscribeResolvers.push(resolve as (subscription: { unsubscribe: () => void }) => void)
         })
     )
-    const senderOne = {
-      isDestroyed: () => false,
-      send: vi.fn(),
-      once: vi.fn(),
-      id: 1
-    }
-    const senderTwo = {
-      isDestroyed: () => false,
-      send: vi.fn(),
-      once: vi.fn(),
-      id: 2
-    }
+    const senderOne = createWatcherSender(1)
+    const senderTwo = createWatcherSender(2)
 
     const watchOne = handlers['fs:watchWorktree'](
       { sender: senderOne },
@@ -248,12 +241,7 @@ describe('local filesystem watcher unsubscribe cleanup', () => {
     vi.mocked(stat).mockResolvedValue({ isDirectory: () => true } as never)
     const unsubscribeMock = vi.fn()
     vi.mocked(subscribeParcelWatcher).mockResolvedValue({ unsubscribe: unsubscribeMock } as never)
-    const sender = {
-      isDestroyed: () => false,
-      send: vi.fn(),
-      once: vi.fn(),
-      id: 1
-    }
+    const sender = createWatcherSender(1)
 
     await handlers['fs:watchWorktree']({ sender }, { worktreePath: '/tmp/repo' })
 
@@ -274,12 +262,7 @@ describe('local filesystem watcher unsubscribe cleanup', () => {
     vi.mocked(stat).mockResolvedValue({ isDirectory: () => true } as never)
     const unsubscribeMock = vi.fn()
     vi.mocked(subscribeParcelWatcher).mockResolvedValue({ unsubscribe: unsubscribeMock } as never)
-    const sender = {
-      isDestroyed: () => false,
-      send: vi.fn(),
-      once: vi.fn(),
-      id: 1
-    }
+    const sender = createWatcherSender(1)
 
     await handlers['fs:watchWorktree']({ sender }, { worktreePath: '/tmp/repo' })
     await closeLocalWatcherForWorktreePath('/tmp/repo')
@@ -294,12 +277,7 @@ describe('local filesystem watcher unsubscribe cleanup', () => {
     vi.mocked(stat).mockResolvedValue({ isDirectory: () => true } as never)
     const unsubscribeMock = vi.fn()
     vi.mocked(subscribeParcelWatcher).mockResolvedValue({ unsubscribe: unsubscribeMock } as never)
-    const sender = {
-      isDestroyed: () => false,
-      send: vi.fn(),
-      once: vi.fn(),
-      id: 1
-    }
+    const sender = createWatcherSender(1)
 
     await handlers['fs:watchWorktree']({ sender }, { worktreePath: watchPath })
     await closeLocalWatcherForWorktreePath(closePath)
@@ -323,12 +301,7 @@ describe('local filesystem watcher unsubscribe cleanup', () => {
         watcherCallback = callback as typeof watcherCallback
         return { unsubscribe: unsubscribeMock } as never
       })
-      const sender = {
-        isDestroyed: () => false,
-        send: vi.fn(),
-        once: vi.fn(),
-        id: 1
-      }
+      const sender = createWatcherSender(1)
 
       await handlers['fs:watchWorktree']({ sender }, { worktreePath: watchPath })
       watcherCallback(null, [{ type: 'update', path: `${watchPath}\\file.txt` }])
@@ -349,7 +322,7 @@ describe('local filesystem watcher unsubscribe cleanup', () => {
     const terminationError = new Error('watcher child did not exit')
     const unsubscribeMock = vi.fn().mockRejectedValue(terminationError)
     vi.mocked(subscribeParcelWatcher).mockResolvedValue({ unsubscribe: unsubscribeMock } as never)
-    const sender = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 1 }
+    const sender = createWatcherSender(1)
 
     await handlers['fs:watchWorktree']({ sender }, { worktreePath: '/tmp/repo' })
 
@@ -372,6 +345,7 @@ describe('local filesystem watcher unsubscribe cleanup', () => {
     const sender = {
       isDestroyed: () => false,
       send: vi.fn(),
+      removeListener: vi.fn(),
       once: vi.fn((event: string, callback: () => void) => {
         if (event === 'destroyed') {
           destroyedCallbacks.push(callback)
@@ -413,6 +387,7 @@ describe('local filesystem watcher unsubscribe cleanup', () => {
     const sender = {
       isDestroyed: () => false,
       send: vi.fn(),
+      removeListener: vi.fn(),
       once: vi.fn((event: string, callback: () => void) => {
         if (event === 'destroyed') {
           destroyedCallbacks.push(callback)
@@ -448,7 +423,7 @@ describe('local filesystem watcher unsubscribe cleanup', () => {
       watcherCallback = callback as typeof watcherCallback
       return { unsubscribe }
     })
-    const sender = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 1 }
+    const sender = createWatcherSender(1)
     await handlers['fs:watchWorktree']({ sender }, { worktreePath: '/tmp/repo' })
 
     watcherCallback(terminationError, [])
@@ -478,7 +453,7 @@ describe('local filesystem watcher unsubscribe cleanup', () => {
           hooks?.signal?.addEventListener('abort', () => reject(terminationError), { once: true })
         })
     )
-    const sender = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 1 }
+    const sender = createWatcherSender(1)
     const watchPromise = handlers['fs:watchWorktree'](
       { sender },
       { worktreePath: '/tmp/repo' }
@@ -499,12 +474,7 @@ describe('local filesystem watcher unsubscribe cleanup', () => {
     vi.mocked(stat).mockResolvedValue({ isDirectory: () => true } as never)
     const unsubscribeMock = vi.fn()
     vi.mocked(subscribeParcelWatcher).mockResolvedValue({ unsubscribe: unsubscribeMock } as never)
-    const sender = {
-      isDestroyed: () => false,
-      send: vi.fn(),
-      once: vi.fn(),
-      id: 1
-    }
+    const sender = createWatcherSender(1)
 
     await handlers['fs:watchWorktree']({ sender }, { worktreePath: '/tmp/repo' })
 
@@ -532,12 +502,7 @@ describe('local filesystem watcher unsubscribe cleanup', () => {
           resolveSubscribe = resolve as typeof resolveSubscribe
         })
     )
-    const sender = {
-      isDestroyed: () => false,
-      send: vi.fn(),
-      once: vi.fn(),
-      id: 1
-    }
+    const sender = createWatcherSender(1)
 
     const watchPromise = handlers['fs:watchWorktree'](
       { sender },
@@ -581,8 +546,8 @@ describe('local filesystem watcher unsubscribe cleanup', () => {
         replacementCallback = callback
         return { unsubscribe: replacementUnsubscribe }
       })
-    const firstSender = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 1 }
-    const replacementSender = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 2 }
+    const firstSender = createWatcherSender(1)
+    const replacementSender = createWatcherSender(2)
 
     const firstWatch = handlers['fs:watchWorktree'](
       { sender: firstSender },
@@ -629,9 +594,9 @@ describe('local filesystem watcher unsubscribe cleanup', () => {
       .mockImplementationOnce(install as never)
       .mockImplementationOnce(install as never)
     const lateUnsubscribe = vi.fn()
-    const firstSender = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 1 }
-    const joinerSender = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 2 }
-    const reopenSender = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 3 }
+    const firstSender = createWatcherSender(1)
+    const joinerSender = createWatcherSender(2)
+    const reopenSender = createWatcherSender(3)
     const first = handlers['fs:watchWorktree'](
       { sender: firstSender },
       { worktreePath: '/tmp/repo' }
@@ -675,12 +640,7 @@ describe('local filesystem watcher unsubscribe cleanup', () => {
           resolveSubscribe = resolve as typeof resolveSubscribe
         })
     )
-    const sender = {
-      isDestroyed: () => false,
-      send: vi.fn(),
-      once: vi.fn(),
-      id: 1
-    }
+    const sender = createWatcherSender(1)
 
     const watchPromise = handlers['fs:watchWorktree'](
       { sender },
@@ -708,12 +668,7 @@ describe('local filesystem watcher unsubscribe cleanup', () => {
     vi.mocked(subscribeParcelWatcher)
       .mockResolvedValueOnce({ unsubscribe: firstUnsubscribe } as never)
       .mockResolvedValueOnce({ unsubscribe: replacementUnsubscribe } as never)
-    const sender = {
-      isDestroyed: () => false,
-      send: vi.fn(),
-      once: vi.fn(),
-      id: 1
-    }
+    const sender = createWatcherSender(1)
 
     await handlers['fs:watchWorktree']({ sender }, { worktreePath: '/tmp/repo' })
     await closeLocalWatcherForWorktreePath('/tmp/repo')
@@ -731,7 +686,7 @@ describe('local filesystem watcher unsubscribe cleanup', () => {
     vi.mocked(stat).mockResolvedValue({ isDirectory: () => true } as never)
     const firstUnsubscribe = vi.fn()
     vi.mocked(subscribeParcelWatcher).mockResolvedValue({ unsubscribe: firstUnsubscribe } as never)
-    const sender = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 1 }
+    const sender = createWatcherSender(1)
 
     await handlers['fs:watchWorktree']({ sender }, { worktreePath: '/tmp/repo' })
     await closeLocalWatcherForWorktreePath('/tmp/repo')
@@ -751,6 +706,7 @@ describe('local filesystem watcher unsubscribe cleanup', () => {
     const sender = {
       isDestroyed: () => false,
       send: vi.fn(),
+      removeListener: vi.fn(),
       once: vi.fn((event: string, callback: () => void) => {
         if (event === 'destroyed') {
           destroyedCallbacks.push(callback)
@@ -779,12 +735,7 @@ describe('local filesystem watcher unsubscribe cleanup', () => {
           resolveSubscribe = resolve as typeof resolveSubscribe
         })
     )
-    const sender = {
-      isDestroyed: () => false,
-      send: vi.fn(),
-      once: vi.fn(),
-      id: 1
-    }
+    const sender = createWatcherSender(1)
 
     const watchPromise = handlers['fs:watchWorktree'](
       { sender },
diff --git a/src/main/ipc/filesystem-watcher-native-capacity.test.ts b/src/main/ipc/filesystem-watcher-native-capacity.test.ts
index 670b7eb2af39..9d291f7a9ee6 100644
--- a/src/main/ipc/filesystem-watcher-native-capacity.test.ts
+++ b/src/main/ipc/filesystem-watcher-native-capacity.test.ts
@@ -1,3 +1,4 @@
+import { createWatcherSender } from './filesystem-watcher-test-sender'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 
 const { handleMock, statMock, subscribeViaWatcherProcessMock, disposeWatcherProcessMock } =
@@ -71,7 +72,7 @@ describe('native filesystem watcher capacity recovery', () => {
     subscribeViaWatcherProcessMock
       .mockRejectedValueOnce(new WatcherChildCapacityError())
       .mockResolvedValueOnce({ unsubscribe })
-    const sender = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 1 }
+    const sender = createWatcherSender(1)
     const args = { worktreePath: '/tmp/native-capacity-root' }
 
     await handlers['fs:watchWorktree']({ sender }, args)
@@ -86,7 +87,7 @@ describe('native filesystem watcher capacity recovery', () => {
   it('cancels the native capacity wait when its renderer unwatches', async () => {
     const releases = fillWatcherChildCapacity()
     subscribeViaWatcherProcessMock.mockRejectedValue(new WatcherChildCapacityError())
-    const sender = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 1 }
+    const sender = createWatcherSender(1)
     const args = { worktreePath: '/tmp/native-capacity-root' }
 
     await handlers['fs:watchWorktree']({ sender }, args)
diff --git a/src/main/ipc/filesystem-watcher-real.test.ts b/src/main/ipc/filesystem-watcher-real.test.ts
index 7c9556e7ba4d..6bd5060fb0e1 100644
--- a/src/main/ipc/filesystem-watcher-real.test.ts
+++ b/src/main/ipc/filesystem-watcher-real.test.ts
@@ -1,3 +1,4 @@
+import { createWatcherSender } from './filesystem-watcher-test-sender'
 /*
  * Real (unmocked) @parcel/watcher integration test.
  *
@@ -95,12 +96,7 @@ describe('filesystem-watcher real @parcel/watcher integration', () => {
       // tmpdir() returns /var, so compare canonical paths instead of aliases.
       tempDir = await realpath(await mkdtemp(join(tmpdir(), 'orca-fswatch-real-')))
       const sendMock = vi.fn()
-      const sender = {
-        isDestroyed: () => false,
-        send: sendMock,
-        once: vi.fn(),
-        id: 1
-      }
+      const sender = createWatcherSender(1, sendMock)
 
       // Subscribe resolves only after the native watcher is installed.
       await handlers['fs:watchWorktree']({ sender }, { worktreePath: tempDir })
@@ -139,7 +135,7 @@ describe('filesystem-watcher real @parcel/watcher integration', () => {
     await mkdir(join(root.realRoot, 'src'), { recursive: true })
 
     const sendMock = vi.fn()
-    const sender = { isDestroyed: () => false, send: sendMock, once: vi.fn(), id: 1 }
+    const sender = createWatcherSender(1, sendMock)
     await handlers['fs:watchWorktree']({ sender }, { worktreePath: root.aliasRoot })
 
     const expectedPath = join(root.aliasRoot, 'src', 'agent-edit.ts')
diff --git a/src/main/ipc/filesystem-watcher-remote-batch.test.ts b/src/main/ipc/filesystem-watcher-remote-batch.test.ts
index de1f4fb3d375..fc4566b97c9d 100644
--- a/src/main/ipc/filesystem-watcher-remote-batch.test.ts
+++ b/src/main/ipc/filesystem-watcher-remote-batch.test.ts
@@ -1,3 +1,4 @@
+import { senderEvents } from './filesystem-watcher-test-sender'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import type { FsChangeEvent } from '../../shared/filesystem-entry-types'
 
@@ -34,7 +35,13 @@ describe('remote filesystem watcher batching', () => {
   const watchCallbacks: WatchCallback[] = []
 
   function makeSender(overrides: Partial<{ isDestroyed: () => boolean }> = {}) {
-    return { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 1, ...overrides }
+    return {
+      isDestroyed: () => false,
+      send: vi.fn(),
+      ...senderEvents(),
+      id: 1,
+      ...overrides
+    }
   }
 
   beforeEach(async () => {
diff --git a/src/main/ipc/filesystem-watcher-remote-cancellation.test.ts b/src/main/ipc/filesystem-watcher-remote-cancellation.test.ts
index 60e25db90403..26140876bb50 100644
--- a/src/main/ipc/filesystem-watcher-remote-cancellation.test.ts
+++ b/src/main/ipc/filesystem-watcher-remote-cancellation.test.ts
@@ -1,3 +1,4 @@
+import { createWatcherSender } from './filesystem-watcher-test-sender'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
 const { handleMock, getSshFilesystemProviderMock } = vi.hoisted(() => ({
@@ -50,8 +51,8 @@ describe('remote filesystem watcher cancellation', () => {
     )
     getSshFilesystemProviderMock.mockReturnValue({ watch: watchMock })
     const args = { worktreePath: '/home/me/repo', connectionId: 'conn-1' }
-    const senderOne = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 1 }
-    const senderTwo = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 2 }
+    const senderOne = createWatcherSender(1)
+    const senderTwo = createWatcherSender(2)
     const first = handlers['fs:watchWorktree']({ sender: senderOne }, args) as Promise<unknown>
     const second = handlers['fs:watchWorktree']({ sender: senderTwo }, args) as Promise<unknown>
 
@@ -101,8 +102,8 @@ describe('remote filesystem watcher cancellation', () => {
       })
     getSshFilesystemProviderMock.mockReturnValue({ watch: watchMock })
     const args = { worktreePath: '/home/me/repo', connectionId: 'conn-1' }
-    const firstSender = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 1 }
-    const secondSender = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 2 }
+    const firstSender = createWatcherSender(1)
+    const secondSender = createWatcherSender(2)
     const first = handlers['fs:watchWorktree']({ sender: firstSender }, args) as Promise<unknown>
 
     await Promise.resolve()
@@ -136,6 +137,7 @@ describe('remote filesystem watcher cancellation', () => {
     const destroyedSender = {
       isDestroyed: () => false,
       send: vi.fn(),
+      removeListener: vi.fn(),
       once: vi.fn((event: string, callback: () => void) => {
         if (event === 'destroyed') {
           destroyedCallbacks.push(callback)
@@ -156,7 +158,7 @@ describe('remote filesystem watcher cancellation', () => {
     installs.get('/destroyed')?.resolve(vi.fn())
     await destroyedWatch
 
-    const shutdownSender = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 2 }
+    const shutdownSender = createWatcherSender(2)
     const shutdownArgs = { worktreePath: '/shutdown', connectionId: 'conn-1' }
     const shutdownWatch = handlers['fs:watchWorktree'](
       { sender: shutdownSender },
@@ -182,8 +184,8 @@ describe('remote filesystem watcher cancellation', () => {
     )
     getSshFilesystemProviderMock.mockReturnValue({ watch: watchMock })
     const args = { worktreePath: '/home/me/repo', connectionId: 'conn-1' }
-    const senderOne = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 1 }
-    const senderTwo = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 2 }
+    const senderOne = createWatcherSender(1)
+    const senderTwo = createWatcherSender(2)
     const first = handlers['fs:watchWorktree']({ sender: senderOne }, args) as Promise<unknown>
 
     await Promise.resolve()
@@ -216,8 +218,8 @@ describe('remote filesystem watcher cancellation', () => {
     )
     getSshFilesystemProviderMock.mockReturnValue({ watch: watchMock })
     const args = { worktreePath: '/home/me/repo', connectionId: 'conn-1' }
-    const firstSender = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 1 }
-    const secondSender = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 2 }
+    const firstSender = createWatcherSender(1)
+    const secondSender = createWatcherSender(2)
     const first = handlers['fs:watchWorktree']({ sender: firstSender }, args) as Promise<unknown>
 
     await Promise.resolve()
@@ -259,9 +261,9 @@ describe('remote filesystem watcher cancellation', () => {
     const args = { worktreePath: '/home/me/repo', connectionId: 'conn-1' }
     const reopenArgs = { worktreePath: '/home/me/other', connectionId: 'conn-1' }
     const lateUnwatch = vi.fn()
-    const firstSender = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 1 }
-    const joinerSender = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 2 }
-    const reopenSender = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 3 }
+    const firstSender = createWatcherSender(1)
+    const joinerSender = createWatcherSender(2)
+    const reopenSender = createWatcherSender(3)
     const first = handlers['fs:watchWorktree']({ sender: firstSender }, args) as Promise<unknown>
 
     await Promise.resolve()
diff --git a/src/main/ipc/filesystem-watcher-remote-capacity.test.ts b/src/main/ipc/filesystem-watcher-remote-capacity.test.ts
index 97a8f82bf330..f67083f845d5 100644
--- a/src/main/ipc/filesystem-watcher-remote-capacity.test.ts
+++ b/src/main/ipc/filesystem-watcher-remote-capacity.test.ts
@@ -1,3 +1,4 @@
+import { createWatcherSender } from './filesystem-watcher-test-sender'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 
 const { handleMock, getSshFilesystemProviderMock } = vi.hoisted(() => ({
@@ -58,7 +59,7 @@ describe('remote filesystem watcher capacity refusals', () => {
       throw new Error(WATCH_ROOT_CAPACITY_REFUSAL_MESSAGE)
     })
     getSshFilesystemProviderMock.mockReturnValue({ watch: watchMock })
-    const sender = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 1 }
+    const sender = createWatcherSender(1)
     const args = { worktreePath: '/home/me/repos/one', connectionId: 'conn-capacity' }
 
     await handlers['fs:watchWorktree']({ sender }, args)
@@ -78,7 +79,7 @@ describe('remote filesystem watcher capacity refusals', () => {
       throw new Error('Relay channel lost')
     })
     getSshFilesystemProviderMock.mockReturnValue({ watch: watchMock })
-    const sender = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 2 }
+    const sender = createWatcherSender(2)
     const args = { worktreePath: '/home/me/repos/two', connectionId: 'conn-unavailable' }
 
     await handlers['fs:watchWorktree']({ sender }, args)
diff --git a/src/main/ipc/filesystem-watcher-remote-controller.ts b/src/main/ipc/filesystem-watcher-remote-controller.ts
index 1b6953cd292b..8a4f4cc2e919 100644
--- a/src/main/ipc/filesystem-watcher-remote-controller.ts
+++ b/src/main/ipc/filesystem-watcher-remote-controller.ts
@@ -1,6 +1,7 @@
 import type { WebContents } from 'electron'
 import type { RemoteWatcherInstallToken } from './filesystem-watcher-lifecycle-state'
 import { watcherLifecycleState } from './filesystem-watcher-lifecycle-state'
+import { registerWatcherSenderCleanup } from './filesystem-watcher-listener-lifecycle'
 import {
   installRemoteWatcherCore,
   type RemoteWatcherTerminalErrorHandler
@@ -14,14 +15,16 @@ export function installRemoteWatcher(
   sender: WebContents,
   connectionId: string,
   worktreePath: string,
-  generation = watcherLifecycleState.remoteWatcherLifecycleGeneration
+  generation = watcherLifecycleState.remoteWatcherLifecycleGeneration,
+  senderSignal = registerWatcherSenderCleanup(sender)
 ) {
   return installRemoteWatcherCore(
     sender,
     connectionId,
     worktreePath,
     handleRemoteWatcherTerminalError,
-    generation
+    generation,
+    senderSignal
   )
 }
 
diff --git a/src/main/ipc/filesystem-watcher-remote-dormant.ts b/src/main/ipc/filesystem-watcher-remote-dormant.ts
index 7c168114f512..11783f7bb57d 100644
--- a/src/main/ipc/filesystem-watcher-remote-dormant.ts
+++ b/src/main/ipc/filesystem-watcher-remote-dormant.ts
@@ -1,3 +1,5 @@
+import { isCurrentWatcherSender } from './filesystem-watcher-sender-lifetime'
+import { registerWatcherSenderCleanup } from './filesystem-watcher-listener-lifecycle'
 import { getSshFilesystemProvider } from '../providers/ssh-filesystem-dispatch'
 import { isWatcherRemovalInProgressError } from './watcher-removal-gate'
 import type {
@@ -74,6 +76,7 @@ async function rearmDormantRemoteWatcher(
   }
 
   const listeners = Array.from(desired.listeners.values())
+  const signals = listeners.map(registerWatcherSenderCleanup)
   let results: Awaited<ReturnType<InstallRemoteWatcher>>[]
   try {
     results = await Promise.all(
@@ -84,6 +87,9 @@ async function rearmDormantRemoteWatcher(
       // Why: removal owns the key now and either forgets the intent or restores the watch itself.
       return
     }
+    if (!listeners.some((listener, index) => isCurrentWatcherSender(listener, signals[index]))) {
+      return
+    }
     scheduleDormantRemoteWatcherRearmCore(
       connectionId,
       worktreePath,
@@ -92,10 +98,16 @@ async function rearmDormantRemoteWatcher(
     )
     return
   }
+  if (!listeners.some((listener, index) => isCurrentWatcherSender(listener, signals[index]))) {
+    return
+  }
   dependencies.requestResync(
     key,
     worktreePath,
-    listeners.filter((_, index) => results[index] === 'installed')
+    listeners.filter(
+      (listener, index) =>
+        results[index] === 'installed' && isCurrentWatcherSender(listener, signals[index])
+    )
   )
   // Why: 'cancelled' means shutdown or the last listener left, so only a refusal stays dormant.
   if (results.some((result) => result === 'unavailable' || result === 'capacity')) {
diff --git a/src/main/ipc/filesystem-watcher-remote-install.ts b/src/main/ipc/filesystem-watcher-remote-install.ts
index 3ab5babbd916..b1a6bab61fad 100644
--- a/src/main/ipc/filesystem-watcher-remote-install.ts
+++ b/src/main/ipc/filesystem-watcher-remote-install.ts
@@ -15,6 +15,7 @@ import type {
 } from './filesystem-watcher-lifecycle-state'
 import { watcherLifecycleState } from './filesystem-watcher-lifecycle-state'
 import { getRemoteWatcherKey } from './filesystem-watcher-paths'
+import { isCurrentWatcherSender } from './filesystem-watcher-sender-lifetime'
 import {
   addInFlightRemoteInstallListener,
   addRemoteWatchListener,
@@ -34,10 +35,12 @@ export async function installRemoteWatcherCore(
   connectionId: string,
   worktreePath: string,
   onTerminalError: RemoteWatcherTerminalErrorHandler,
-  generation = watcherLifecycleState.remoteWatcherLifecycleGeneration
+  generation = watcherLifecycleState.remoteWatcherLifecycleGeneration,
+  senderSignal = registerWatcherSenderCleanup(sender)
 ): Promise<RemoteWatcherInstallResult> {
   // Why: refuse installs racing in after teardown (or a waiter from an earlier lifecycle) so provider.watch() isn't called post-shutdown.
   if (
+    !isCurrentWatcherSender(sender, senderSignal) ||
     watcherLifecycleState.remoteWatchersClosed ||
     generation !== watcherLifecycleState.remoteWatcherLifecycleGeneration
   ) {
@@ -50,7 +53,8 @@ export async function installRemoteWatcherCore(
       connectionId,
       worktreePath,
       onTerminalError,
-      generation
+      generation,
+      senderSignal
     )
   } finally {
     finishInstall()
@@ -62,7 +66,8 @@ async function installRemoteWatcherWhileRemovalAllowed(
   connectionId: string,
   worktreePath: string,
   onTerminalError: RemoteWatcherTerminalErrorHandler,
-  generation: number
+  generation: number,
+  senderSignal: AbortSignal
 ): Promise<RemoteWatcherInstallResult> {
   const provider = getSshFilesystemProvider(connectionId)
   if (!provider || sender.isDestroyed()) {
@@ -85,6 +90,9 @@ async function installRemoteWatcherWhileRemovalAllowed(
       addInFlightRemoteInstallListener(inFlight, sender)
     }
     const result = await pendingInstall
+    if (!isCurrentWatcherSender(sender, senderSignal)) {
+      return 'cancelled'
+    }
     if (
       result === 'installed' &&
       watcherLifecycleState.remoteWatchers.has(key) &&
@@ -108,7 +116,8 @@ async function installRemoteWatcherWhileRemovalAllowed(
         connectionId,
         worktreePath,
         onTerminalError,
-        generation
+        generation,
+        senderSignal
       )
     }
     return result
diff --git a/src/main/ipc/filesystem-watcher-remote-provider-rearm.ts b/src/main/ipc/filesystem-watcher-remote-provider-rearm.ts
index 3cc657c4086d..5c55c537f072 100644
--- a/src/main/ipc/filesystem-watcher-remote-provider-rearm.ts
+++ b/src/main/ipc/filesystem-watcher-remote-provider-rearm.ts
@@ -1,3 +1,4 @@
+import { isCurrentWatcherSender } from './filesystem-watcher-sender-lifetime'
 import type { WebContents } from 'electron'
 import { isWatcherRemovalInProgressError } from './watcher-removal-gate'
 import type {
@@ -5,7 +6,10 @@ import type {
   RequestRemoteWatcherResync
 } from './filesystem-watcher-remote-retry'
 import { watcherLifecycleState } from './filesystem-watcher-lifecycle-state'
-import { clearDormantRemoteWatcher } from './filesystem-watcher-listener-lifecycle'
+import {
+  clearDormantRemoteWatcher,
+  registerWatcherSenderCleanup
+} from './filesystem-watcher-listener-lifecycle'
 
 type ScheduleRemoteWatcherRetry = (
   sender: WebContents,
@@ -79,24 +83,33 @@ export function reinstallRemoteWatchersForConnectionCore(
     watcherLifecycleState.loggedUnavailableRemoteWatchers.delete(key)
 
     const listeners = Array.from(desired.listeners.values())
+    const signals = listeners.map(registerWatcherSenderCleanup)
+    const liveListeners = () =>
+      listeners.filter((listener, index) => isCurrentWatcherSender(listener, signals[index]))
     void Promise.all(
       listeners.map((listener) =>
         dependencies.install(listener, desired.connectionId, desired.worktreePath)
       )
     )
       .then((results) => {
+        if (liveListeners().length === 0) {
+          return
+        }
         // Why: events between the transport dropping and this reinstall are gone for good.
         dependencies.requestResync(
           key,
           desired.worktreePath,
-          listeners.filter((_, index) => results[index] === 'installed')
+          listeners.filter(
+            (listener, index) =>
+              results[index] === 'installed' && isCurrentWatcherSender(listener, signals[index])
+          )
         )
         if (results.some((result) => result === 'capacity')) {
           dependencies.scheduleDormant(desired.connectionId, desired.worktreePath)
           return
         }
         if (results.some((result) => result === 'unavailable')) {
-          for (const listener of listeners) {
+          for (const listener of liveListeners()) {
             dependencies.scheduleRetry(
               listener,
               desired.connectionId,
@@ -111,7 +124,7 @@ export function reinstallRemoteWatchersForConnectionCore(
         if (isWatcherRemovalInProgressError(error)) {
           return
         }
-        for (const listener of listeners) {
+        for (const listener of liveListeners()) {
           dependencies.scheduleRetry(
             listener,
             desired.connectionId,
diff --git a/src/main/ipc/filesystem-watcher-remote-rearm.test.ts b/src/main/ipc/filesystem-watcher-remote-rearm.test.ts
index 0eecfbd82e93..056b10579a74 100644
--- a/src/main/ipc/filesystem-watcher-remote-rearm.test.ts
+++ b/src/main/ipc/filesystem-watcher-remote-rearm.test.ts
@@ -1,3 +1,4 @@
+import { createWatcherSender } from './filesystem-watcher-test-sender'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
 const { handleMock, getSshFilesystemProviderMock, providerRegistrationListeners } = vi.hoisted(
@@ -51,8 +52,8 @@ describe('remote filesystem watcher re-arm', () => {
   it('still resyncs when a fresh watch beat the failed reinstall to the retry slot', async () => {
     vi.useFakeTimers()
     const warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {})
-    const senderOne = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 1 }
-    const senderTwo = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 2 }
+    const senderOne = createWatcherSender(1)
+    const senderTwo = createWatcherSender(2)
     const args = { worktreePath: '/home/me/repo', connectionId: 'conn-1' }
     getSshFilesystemProviderMock.mockReturnValue({ watch: vi.fn().mockResolvedValue(vi.fn()) })
 
diff --git a/src/main/ipc/filesystem-watcher-remote-removal.ts b/src/main/ipc/filesystem-watcher-remote-removal.ts
index 0e9c741851a6..a6c7f2a66363 100644
--- a/src/main/ipc/filesystem-watcher-remote-removal.ts
+++ b/src/main/ipc/filesystem-watcher-remote-removal.ts
@@ -1,3 +1,4 @@
+import { isCurrentWatcherSender } from './filesystem-watcher-sender-lifetime'
 import type { WebContents } from 'electron'
 import type { FsChangedPayload } from '../../shared/filesystem-entry-types'
 import { getSshFilesystemProvider } from '../providers/ssh-filesystem-dispatch'
@@ -5,6 +6,7 @@ import { watcherLifecycleState } from './filesystem-watcher-lifecycle-state'
 import { getRemoteWatcherKey } from './filesystem-watcher-paths'
 import {
   clearDormantRemoteWatcher,
+  registerWatcherSenderCleanup,
   clearRemoteWatcherResync
 } from './filesystem-watcher-listener-lifecycle'
 import {
@@ -71,11 +73,18 @@ export async function restoreRemoteWatcherAfterFailedRemoval(
     return
   }
   watcherLifecycleState.suspendedRemoteWatcherListeners.delete(key)
-  for (const sender of suspended.listeners.values()) {
-    if (sender.isDestroyed()) {
+  const owners = Array.from(suspended.listeners.values(), (sender) => ({
+    sender,
+    signal: registerWatcherSenderCleanup(sender)
+  }))
+  for (const { sender, signal } of owners) {
+    if (!isCurrentWatcherSender(sender, signal)) {
+      continue
+    }
+    const result = await installRemoteWatcher(sender, connectionId, worktreePath, undefined, signal)
+    if (!isCurrentWatcherSender(sender, signal)) {
       continue
     }
-    const result = await installRemoteWatcher(sender, connectionId, worktreePath)
     if (result === 'capacity') {
       scheduleDormantRemoteWatcherRearm(connectionId, worktreePath)
     } else if (result === 'unavailable') {
diff --git a/src/main/ipc/filesystem-watcher-remote-retry.ts b/src/main/ipc/filesystem-watcher-remote-retry.ts
index d73f9ed4db4d..02c797e9c75b 100644
--- a/src/main/ipc/filesystem-watcher-remote-retry.ts
+++ b/src/main/ipc/filesystem-watcher-remote-retry.ts
@@ -1,3 +1,4 @@
+import { isCurrentWatcherSender } from './filesystem-watcher-sender-lifetime'
 import type { WebContents } from 'electron'
 import type { FsChangedPayload } from '../../shared/filesystem-entry-types'
 import { isWatcherRemovalInProgressError } from './watcher-removal-gate'
@@ -8,7 +9,10 @@ import {
   watcherLifecycleState
 } from './filesystem-watcher-lifecycle-state'
 import { getRemoteWatcherKey } from './filesystem-watcher-paths'
-import { clearRemoteWatcherResync } from './filesystem-watcher-listener-lifecycle'
+import {
+  clearRemoteWatcherResync,
+  registerWatcherSenderCleanup
+} from './filesystem-watcher-listener-lifecycle'
 import { isCurrentDesiredRemoteWatcher } from './filesystem-watcher-remote-desired'
 
 export type InstallRemoteWatcher = (
@@ -44,6 +48,9 @@ export function scheduleRemoteWatcherRetryCore(
   resyncOnInstall = false
 ): void {
   const key = getRemoteWatcherKey(connectionId, worktreePath)
+  if (watcherLifecycleState.remoteWatchersClosed || !isCurrentDesiredRemoteWatcher(key, sender)) {
+    return
+  }
   const existingRetry = watcherLifecycleState.pendingRemoteWatcherRetryListeners.get(key)
   if (existingRetry) {
     if (!sender.isDestroyed()) {
@@ -89,15 +96,24 @@ export function scheduleRemoteWatcherRetryCore(
     const listeners = Array.from(retry.listeners.values()).filter(
       (listener) => !listener.isDestroyed() && isCurrentDesiredRemoteWatcher(key, listener)
     )
+    const signals = listeners.map(registerWatcherSenderCleanup)
+    const liveListeners = () =>
+      listeners.filter((listener, index) => isCurrentWatcherSender(listener, signals[index]))
     void Promise.all(
       listeners.map((listener) => dependencies.install(listener, connectionId, worktreePath))
     )
       .then((results) => {
+        if (liveListeners().length === 0) {
+          return
+        }
         if (retry.resyncOnInstall) {
           dependencies.requestResync(
             key,
             worktreePath,
-            listeners.filter((_, index) => results[index] === 'installed')
+            listeners.filter(
+              (listener, index) =>
+                results[index] === 'installed' && isCurrentWatcherSender(listener, signals[index])
+            )
           )
         }
         // Why capacity leaves the fast window: the relay is refusing on a full watch-root cap, and a
@@ -108,7 +124,7 @@ export function scheduleRemoteWatcherRetryCore(
         }
         // Why: don't re-arm on 'cancelled' (renderer stopped watching) — it would fire a stale overflow when the 60s window expires.
         if (results.some((result) => result === 'unavailable')) {
-          for (const listener of listeners) {
+          for (const listener of liveListeners()) {
             scheduleRemoteWatcherRetryCore(
               listener,
               connectionId,
@@ -124,7 +140,7 @@ export function scheduleRemoteWatcherRetryCore(
         if (isWatcherRemovalInProgressError(error)) {
           return
         }
-        for (const listener of listeners) {
+        for (const listener of liveListeners()) {
           scheduleRemoteWatcherRetryCore(
             listener,
             connectionId,
diff --git a/src/main/ipc/filesystem-watcher-removal-deadline.test.ts b/src/main/ipc/filesystem-watcher-removal-deadline.test.ts
index 9eabdb8964e5..ca1e731c99a0 100644
--- a/src/main/ipc/filesystem-watcher-removal-deadline.test.ts
+++ b/src/main/ipc/filesystem-watcher-removal-deadline.test.ts
@@ -1,3 +1,4 @@
+import { createWatcherSender } from './filesystem-watcher-test-sender'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import type * as ParcelWatcherProcess from './parcel-watcher-process'
 
@@ -84,12 +85,7 @@ describe('local filesystem watcher removal deadline', () => {
       // subscribe that ignores the abort signal exercises the deadline rather than the cancel path.
       // Once, so the wedge cannot leak into the next test.
       vi.mocked(subscribeViaWatcherProcess).mockImplementationOnce(() => new Promise(() => {}))
-      const sender = {
-        isDestroyed: () => false,
-        send: vi.fn(),
-        once: vi.fn(),
-        id: 1
-      }
+      const sender = createWatcherSender(1)
 
       const watchPromise = handlers['fs:watchWorktree'](
         { sender },
@@ -132,7 +128,7 @@ describe('local filesystem watcher removal deadline', () => {
         })
     )
     vi.mocked(subscribeParcelWatcher).mockResolvedValue({ unsubscribe: unsubscribeMock } as never)
-    const sender = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 1 }
+    const sender = createWatcherSender(1)
 
     await handlers['fs:watchWorktree']({ sender }, { worktreePath: '/tmp/repo' })
 
@@ -160,12 +156,7 @@ describe('local filesystem watcher removal deadline', () => {
     try {
       vi.mocked(stat).mockResolvedValue({ isDirectory: () => true } as never)
       vi.mocked(subscribeViaWatcherProcess).mockImplementationOnce(() => new Promise(() => {}))
-      const sender = {
-        isDestroyed: () => false,
-        send: vi.fn(),
-        once: vi.fn(),
-        id: 1
-      }
+      const sender = createWatcherSender(1)
 
       const watchPromise = handlers['fs:watchWorktree'](
         { sender },
@@ -209,7 +200,7 @@ describe('local filesystem watcher removal deadline', () => {
         })
     )
     vi.mocked(subscribeParcelWatcher).mockResolvedValue({ unsubscribe: unsubscribeMock } as never)
-    const sender = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 1 }
+    const sender = createWatcherSender(1)
     await handlers['fs:watchWorktree']({ sender }, { worktreePath: '/tmp/repo' })
 
     vi.useFakeTimers()
diff --git a/src/main/ipc/filesystem-watcher-sender-lifetime.ts b/src/main/ipc/filesystem-watcher-sender-lifetime.ts
new file mode 100644
index 000000000000..b72948471b13
--- /dev/null
+++ b/src/main/ipc/filesystem-watcher-sender-lifetime.ts
@@ -0,0 +1,36 @@
+import type { WebContents } from 'electron'
+import { abortWhenRendererGone } from './renderer-lifetime-abort'
+import { watcherLifecycleState } from './filesystem-watcher-lifecycle-state'
+
+export function captureWatcherSenderLifetime(
+  sender: WebContents,
+  cleanup: () => void
+): AbortSignal {
+  const existing = watcherLifecycleState.senderLifetimes.get(sender.id)
+  if (existing) {
+    return existing.signal
+  }
+  if (sender.isDestroyed()) {
+    return AbortSignal.abort()
+  }
+  const lifetime = abortWhenRendererGone(sender)
+  watcherLifecycleState.senderLifetimes.set(sender.id, lifetime)
+  lifetime.signal.addEventListener(
+    'abort',
+    () => {
+      lifetime.dispose()
+      watcherLifecycleState.senderLifetimes.delete(sender.id)
+      cleanup()
+    },
+    { once: true }
+  )
+  return lifetime.signal
+}
+
+export function isCurrentWatcherSender(sender: WebContents, signal: AbortSignal): boolean {
+  return (
+    !sender.isDestroyed() &&
+    !signal.aborted &&
+    watcherLifecycleState.senderLifetimes.get(sender.id)?.signal === signal
+  )
+}
diff --git a/src/main/ipc/filesystem-watcher-shutdown.ts b/src/main/ipc/filesystem-watcher-shutdown.ts
index 9f9cd2de3539..31a57ecab100 100644
--- a/src/main/ipc/filesystem-watcher-shutdown.ts
+++ b/src/main/ipc/filesystem-watcher-shutdown.ts
@@ -8,7 +8,10 @@ export async function closeAllWatchers(): Promise<void> {
   // Why: drop the intent with the rest of the state, but keep the provider-registration
   // subscription — a new fs:watchWorktree reopens the subsystem and still needs the re-arm hook.
   watcherLifecycleState.desiredRemoteWatchers.clear()
-  watcherLifecycleState.senderCleanupRegistered.clear()
+  for (const lifetime of watcherLifecycleState.senderLifetimes.values()) {
+    lifetime.dispose()
+  }
+  watcherLifecycleState.senderLifetimes.clear()
   watcherLifecycleState.unwatchableRoots.clear()
   watcherLifecycleState.suspendedLocalWatcherListeners.clear()
   watcherLifecycleState.suspendedRemoteWatcherListeners.clear()
diff --git a/src/main/ipc/filesystem-watcher-terminal-resync.test.ts b/src/main/ipc/filesystem-watcher-terminal-resync.test.ts
index 31e87d7a4c94..e8a81d1a7ff4 100644
--- a/src/main/ipc/filesystem-watcher-terminal-resync.test.ts
+++ b/src/main/ipc/filesystem-watcher-terminal-resync.test.ts
@@ -41,6 +41,7 @@ const OVERFLOW_PAYLOAD = {
 type MockSender = {
   isDestroyed: () => boolean
   send: ReturnType<typeof vi.fn>
+  removeListener: ReturnType<typeof vi.fn>
   once: ReturnType<typeof vi.fn>
   id: number
   destroy: () => void
@@ -52,6 +53,7 @@ function createSender(id: number): MockSender {
   return {
     isDestroyed: () => destroyed,
     send: vi.fn(),
+    removeListener: vi.fn(),
     once: vi.fn((event: string, handler: () => void) => {
       if (event === 'destroyed') {
         destroyedHandlers.push(handler)
diff --git a/src/main/ipc/filesystem-watcher-test-sender.ts b/src/main/ipc/filesystem-watcher-test-sender.ts
new file mode 100644
index 000000000000..4ff5a5bbcc18
--- /dev/null
+++ b/src/main/ipc/filesystem-watcher-test-sender.ts
@@ -0,0 +1,18 @@
+import { vi, type Mock } from 'vitest'
+
+type SenderEvents = { once: Mock; removeListener: Mock }
+
+export function senderEvents(): SenderEvents {
+  return { once: vi.fn(), removeListener: vi.fn() }
+}
+
+export function createWatcherSender(
+  id: number,
+  send: Mock = vi.fn()
+): SenderEvents & {
+  id: number
+  isDestroyed: () => boolean
+  send: Mock
+} {
+  return { id, isDestroyed: () => false, send, ...senderEvents() }
+}
diff --git a/src/main/ipc/filesystem-watcher-unwatchable-roots.test.ts b/src/main/ipc/filesystem-watcher-unwatchable-roots.test.ts
index 3473caa8a732..78274bbe0282 100644
--- a/src/main/ipc/filesystem-watcher-unwatchable-roots.test.ts
+++ b/src/main/ipc/filesystem-watcher-unwatchable-roots.test.ts
@@ -1,3 +1,5 @@
+import { createWatcherSender } from './filesystem-watcher-test-sender'
+import { statSync } from 'node:fs'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
 const { handleMock } = vi.hoisted(() => ({
@@ -29,6 +31,7 @@ vi.mock('../providers/ssh-filesystem-dispatch', () => ({
 
 import { closeAllWatchers, registerFilesystemWatcherHandlers } from './filesystem-watcher'
 import { stat } from 'node:fs/promises'
+import { watcherLifecycleState } from './filesystem-watcher-lifecycle-state'
 
 type HandlerMap = Record<string, (_event: unknown, args: unknown) => unknown>
 
@@ -48,15 +51,31 @@ describe('filesystem watcher unwatchable root cache', () => {
     await closeAllWatchers()
   })
 
+  it('releases the install record when the root is a file', async () => {
+    const warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {})
+    const sender = createWatcherSender(1)
+    vi.mocked(stat).mockResolvedValue(statSync(new URL(import.meta.url)))
+    try {
+      await handlers['fs:watchWorktree']({ sender }, { worktreePath: '/tmp/not-directory' })
+      expect(watcherLifecycleState.inFlightLocalInstalls.size).toBe(0)
+      expect(watcherLifecycleState.pendingLocalInstallPromises.size).toBe(0)
+    } finally {
+      warnSpy.mockRestore()
+      await closeAllWatchers()
+    }
+  })
+
   it('evicts oldest failed local roots while suppressing recent retries', async () => {
     const warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {})
-    const sender = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 1 }
+    const sender = createWatcherSender(1)
     vi.mocked(stat).mockRejectedValue(new Error('missing'))
 
     for (let i = 0; i < 257; i += 1) {
       await handlers['fs:watchWorktree']({ sender }, { worktreePath: `/tmp/missing-${i}` })
     }
     expect(stat).toHaveBeenCalledTimes(257)
+    expect(watcherLifecycleState.inFlightLocalInstalls.size).toBe(0)
+    expect(watcherLifecycleState.pendingLocalInstallPromises.size).toBe(0)
 
     await handlers['fs:watchWorktree']({ sender }, { worktreePath: '/tmp/missing-0' })
     expect(stat).toHaveBeenCalledTimes(258)
diff --git a/src/main/ipc/filesystem-watcher.test.ts b/src/main/ipc/filesystem-watcher.test.ts
index 2d9181d1155e..db6fcf206e50 100644
--- a/src/main/ipc/filesystem-watcher.test.ts
+++ b/src/main/ipc/filesystem-watcher.test.ts
@@ -1,3 +1,4 @@
+import { createWatcherSender } from './filesystem-watcher-test-sender'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
 const { handleMock, getSshFilesystemProviderMock, providerRegistrationListeners } = vi.hoisted(
@@ -106,7 +107,7 @@ describe('registerFilesystemWatcherHandlers', () => {
     vi.mocked(subscribeParcelWatcher).mockResolvedValue({ unsubscribe: vi.fn() } as never)
 
     await handlers['fs:watchWorktree'](
-      { sender: { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 1 } },
+      { sender: createWatcherSender(1) },
       { worktreePath: 'C:\\repo' }
     )
 
@@ -140,7 +141,7 @@ describe('registerFilesystemWatcherHandlers', () => {
         rootPath: worktreePath
       }
     })
-    const sender = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 1 }
+    const sender = createWatcherSender(1)
     const args = { worktreePath: '\\\\wsl.localhost\\Ubuntu\\home\\me\\repo' }
 
     await expect(handlers['fs:watchWorktree']({ sender }, args)).resolves.toBeUndefined()
@@ -162,7 +163,7 @@ describe('registerFilesystemWatcherHandlers', () => {
       reserveWatcherChild()
     )
     vi.mocked(createWslWatcher).mockRejectedValue(new WatcherChildCapacityError())
-    const sender = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 1 }
+    const sender = createWatcherSender(1)
     const args = { worktreePath: '\\\\wsl.localhost\\Ubuntu\\home\\me\\repo' }
 
     await handlers['fs:watchWorktree']({ sender }, args)
@@ -178,7 +179,7 @@ describe('registerFilesystemWatcherHandlers', () => {
   it('rejects installs during destructive removal and allows a retry afterward', async () => {
     vi.mocked(stat).mockResolvedValue({ isDirectory: () => true } as never)
     vi.mocked(subscribeParcelWatcher).mockResolvedValue({ unsubscribe: vi.fn() } as never)
-    const sender = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 1 }
+    const sender = createWatcherSender(1)
     const removal = acquireWatcherRemovalGate('/repo')
     await removal.ready
 
@@ -201,12 +202,12 @@ describe('registerFilesystemWatcherHandlers', () => {
 
     await expect(
       handlers['fs:watchWorktree'](
-        { sender: { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 1 } },
+        { sender: createWatcherSender(1) },
         { worktreePath: '/home/me/repo', connectionId: 'conn-1' }
       )
     ).resolves.toBeUndefined()
     await handlers['fs:watchWorktree'](
-      { sender: { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 1 } },
+      { sender: createWatcherSender(1) },
       { worktreePath: '/home/me/repo', connectionId: 'conn-1' }
     )
 
@@ -226,7 +227,7 @@ describe('registerFilesystemWatcherHandlers', () => {
     vi.useFakeTimers()
     const warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {})
     const sendMock = vi.fn()
-    const sender = { isDestroyed: () => false, send: sendMock, once: vi.fn(), id: 1 }
+    const sender = createWatcherSender(1, sendMock)
     const unwatchMock = vi.fn()
     const watchMock = vi.fn().mockResolvedValue(unwatchMock)
     getSshFilesystemProviderMock.mockReturnValueOnce(undefined)
@@ -261,7 +262,7 @@ describe('registerFilesystemWatcherHandlers', () => {
     vi.useFakeTimers()
     const warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {})
     const sendMock = vi.fn()
-    const sender = { isDestroyed: () => false, send: sendMock, once: vi.fn(), id: 1 }
+    const sender = createWatcherSender(1, sendMock)
     const unwatchMock = vi.fn()
     const retryWatchMock = vi.fn().mockResolvedValue(unwatchMock)
     getSshFilesystemProviderMock
@@ -299,7 +300,7 @@ describe('registerFilesystemWatcherHandlers', () => {
     getSshFilesystemProviderMock.mockReturnValueOnce(undefined)
 
     await handlers['fs:watchWorktree'](
-      { sender: { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 1 } },
+      { sender: createWatcherSender(1) },
       { worktreePath: '/home/me/repo', connectionId: 'conn-1' }
     )
 
@@ -315,8 +316,8 @@ describe('registerFilesystemWatcherHandlers', () => {
   it('retries all live renderer owners after a terminal relay watch failure', async () => {
     vi.useFakeTimers()
     const warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {})
-    const senderOne = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 1 }
-    const senderTwo = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 2 }
+    const senderOne = createWatcherSender(1)
+    const senderTwo = createWatcherSender(2)
     const watchMock = vi.fn().mockResolvedValue(vi.fn())
     getSshFilesystemProviderMock.mockReturnValue({ watch: watchMock })
 
@@ -354,7 +355,7 @@ describe('registerFilesystemWatcherHandlers', () => {
   })
 
   it('reinstalls an SSH worktree watch when the provider is re-registered after a reconnect', async () => {
-    const sender = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 1 }
+    const sender = createWatcherSender(1)
     const staleUnwatch = vi.fn()
     const watchMock = vi.fn().mockResolvedValue(staleUnwatch)
     getSshFilesystemProviderMock.mockReturnValue({ watch: watchMock })
@@ -390,7 +391,7 @@ describe('registerFilesystemWatcherHandlers', () => {
 
   it('re-arms an SSH watch whose first install found no provider yet', async () => {
     const warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {})
-    const sender = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 1 }
+    const sender = createWatcherSender(1)
     // A connect slower than the retry window leaves the renderer subscribed with nothing installed.
     getSshFilesystemProviderMock.mockReturnValue(undefined)
 
@@ -411,7 +412,7 @@ describe('registerFilesystemWatcherHandlers', () => {
   it('resyncs after a reconnect whose reinstall only succeeded on a retry', async () => {
     vi.useFakeTimers()
     const warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {})
-    const sender = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 1 }
+    const sender = createWatcherSender(1)
     getSshFilesystemProviderMock.mockReturnValue({ watch: vi.fn().mockResolvedValue(vi.fn()) })
 
     await handlers['fs:watchWorktree'](
@@ -440,7 +441,7 @@ describe('registerFilesystemWatcherHandlers', () => {
   })
 
   it('does not resurrect an SSH watch the renderer already unwatched', async () => {
-    const sender = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 1 }
+    const sender = createWatcherSender(1)
     const watchMock = vi.fn().mockResolvedValue(vi.fn())
     getSshFilesystemProviderMock.mockReturnValue({ watch: watchMock })
 
@@ -462,7 +463,7 @@ describe('registerFilesystemWatcherHandlers', () => {
   })
 
   it('leaves watches on other connections untouched when one provider re-registers', async () => {
-    const sender = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 1 }
+    const sender = createWatcherSender(1)
     const watchMock = vi.fn().mockResolvedValue(vi.fn())
     getSshFilesystemProviderMock.mockReturnValue({ watch: watchMock })
 
@@ -480,8 +481,8 @@ describe('registerFilesystemWatcherHandlers', () => {
   })
 
   it('reinstalls one shared watch when several senders share a re-registered connection', async () => {
-    const senderOne = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 1 }
-    const senderTwo = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 2 }
+    const senderOne = createWatcherSender(1)
+    const senderTwo = createWatcherSender(2)
     const watchMock = vi.fn().mockResolvedValue(vi.fn())
     getSshFilesystemProviderMock.mockReturnValue({ watch: watchMock })
 
@@ -515,8 +516,11 @@ describe('registerFilesystemWatcherHandlers', () => {
     const sender = {
       isDestroyed: () => destroyed,
       send: vi.fn(),
-      once: vi.fn((_event: string, handler: () => void) => {
-        destroyHandlers.push(handler)
+      removeListener: vi.fn(),
+      once: vi.fn((event: string, handler: () => void) => {
+        if (event === 'destroyed') {
+          destroyHandlers.push(handler)
+        }
       }),
       id: 1
     }
@@ -545,8 +549,8 @@ describe('registerFilesystemWatcherHandlers', () => {
   it('shares SSH worktree watchers across renderer senders until the last unwatch', async () => {
     const sendOne = vi.fn()
     const sendTwo = vi.fn()
-    const senderOne = { isDestroyed: () => false, send: sendOne, once: vi.fn(), id: 1 }
-    const senderTwo = { isDestroyed: () => false, send: sendTwo, once: vi.fn(), id: 2 }
+    const senderOne = createWatcherSender(1, sendOne)
+    const senderTwo = createWatcherSender(2, sendTwo)
     const unwatchMock = vi.fn()
     const watchMock = vi.fn().mockResolvedValue(unwatchMock)
     getSshFilesystemProviderMock.mockReturnValue({ watch: watchMock })
@@ -590,7 +594,7 @@ describe('registerFilesystemWatcherHandlers', () => {
     const provider = { watch: vi.fn().mockResolvedValue(vi.fn()), closeWatch }
     getSshFilesystemProviderMock.mockReturnValue(provider)
     await handlers['fs:watchWorktree'](
-      { sender: { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 1 } },
+      { sender: createWatcherSender(1) },
       { worktreePath: '/home/me/repo', connectionId: 'conn-1' }
     )
 
@@ -615,7 +619,7 @@ describe('registerFilesystemWatcherHandlers', () => {
       .mockResolvedValueOnce(replacementUnwatch)
     const closeWatch = vi.fn().mockResolvedValue(undefined)
     getSshFilesystemProviderMock.mockReturnValue({ watch: watchMock, closeWatch })
-    const sender = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 1 }
+    const sender = createWatcherSender(1)
 
     await handlers['fs:watchWorktree'](
       { sender },
@@ -642,7 +646,7 @@ describe('registerFilesystemWatcherHandlers', () => {
     const watchMock = vi.fn().mockResolvedValue(vi.fn())
     const closeWatch = vi.fn().mockResolvedValue(undefined)
     getSshFilesystemProviderMock.mockReturnValue({ watch: watchMock, closeWatch })
-    const sender = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 1 }
+    const sender = createWatcherSender(1)
 
     await handlers['fs:watchWorktree'](
       { sender },
@@ -666,7 +670,7 @@ describe('registerFilesystemWatcherHandlers', () => {
     const watchMock = vi.fn().mockResolvedValue(firstUnwatch)
     const closeWatch = vi.fn().mockResolvedValue(undefined)
     getSshFilesystemProviderMock.mockReturnValue({ watch: watchMock, closeWatch })
-    const sender = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 1 }
+    const sender = createWatcherSender(1)
     const args = { worktreePath: '/home/me/repo', connectionId: 'conn-1' }
 
     await handlers['fs:watchWorktree']({ sender }, args)
@@ -685,14 +689,12 @@ describe('registerFilesystemWatcherHandlers', () => {
     getSshFilesystemProviderMock.mockReturnValue({ watch: watchMock, closeWatch })
     const destroyedCallbacks: (() => void)[] = []
     const sender = {
-      isDestroyed: () => false,
-      send: vi.fn(),
+      ...createWatcherSender(1),
       once: vi.fn((event: string, callback: () => void) => {
         if (event === 'destroyed') {
           destroyedCallbacks.push(callback)
         }
-      }),
-      id: 1
+      })
     }
     const args = { worktreePath: '/home/me/repo', connectionId: 'conn-1' }
 
@@ -709,8 +711,8 @@ describe('registerFilesystemWatcherHandlers', () => {
   it('preserves remote event routing when acknowledged teardown rejects', async () => {
     const sendOne = vi.fn()
     const sendTwo = vi.fn()
-    const senderOne = { isDestroyed: () => false, send: sendOne, once: vi.fn(), id: 1 }
-    const senderTwo = { isDestroyed: () => false, send: sendTwo, once: vi.fn(), id: 2 }
+    const senderOne = createWatcherSender(1, sendOne)
+    const senderTwo = createWatcherSender(2, sendTwo)
     const watchMock = vi.fn().mockResolvedValue(vi.fn())
     const closeWatch = vi
       .fn()
@@ -747,8 +749,8 @@ describe('registerFilesystemWatcherHandlers', () => {
   it('dedupes concurrent pending SSH worktree watcher installs', async () => {
     const sendOne = vi.fn()
     const sendTwo = vi.fn()
-    const senderOne = { isDestroyed: () => false, send: sendOne, once: vi.fn(), id: 1 }
-    const senderTwo = { isDestroyed: () => false, send: sendTwo, once: vi.fn(), id: 2 }
+    const senderOne = createWatcherSender(1, sendOne)
+    const senderTwo = createWatcherSender(2, sendTwo)
     const unwatchMock = vi.fn()
     let resolveWatch: (unwatch: () => void) => void = () => {}
     const watchPromise = new Promise<() => void>((resolve) => {
@@ -791,8 +793,8 @@ describe('registerFilesystemWatcherHandlers', () => {
   it('keeps a pending SSH watcher install alive when only one pending sender unwatches', async () => {
     const sendOne = vi.fn()
     const sendTwo = vi.fn()
-    const senderOne = { isDestroyed: () => false, send: sendOne, once: vi.fn(), id: 1 }
-    const senderTwo = { isDestroyed: () => false, send: sendTwo, once: vi.fn(), id: 2 }
+    const senderOne = createWatcherSender(1, sendOne)
+    const senderTwo = createWatcherSender(2, sendTwo)
     const unwatchMock = vi.fn()
     let resolveWatch: (unwatch: () => void) => void = () => {}
     const watchPromise = new Promise<() => void>((resolve) => {
@@ -833,14 +835,12 @@ describe('registerFilesystemWatcherHandlers', () => {
   it('unsubscribes if the sender is destroyed while an SSH watcher is opening', async () => {
     const destroyedCallbacks: (() => void)[] = []
     const sender = {
-      isDestroyed: () => false,
-      send: vi.fn(),
+      ...createWatcherSender(1),
       once: vi.fn((event: string, callback: () => void) => {
         if (event === 'destroyed') {
           destroyedCallbacks.push(callback)
         }
-      }),
-      id: 1
+      })
     }
     const unwatchMock = vi.fn()
     let resolveWatch: (unwatch: () => void) => void = () => {}
@@ -871,8 +871,8 @@ describe('registerFilesystemWatcherHandlers', () => {
 
   it('revives a pending SSH watcher install when a new sender joins after cancellation', async () => {
     const args = { worktreePath: '/home/me/repo', connectionId: 'conn-1' }
-    const senderOne = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 1 }
-    const senderTwo = { isDestroyed: () => false, send: vi.fn(), once: vi.fn(), id: 2 }
+    const senderOne = createWatcherSender(1)
+    const senderTwo = createWatcherSender(2)
     const unwatchMock = vi.fn()
     let resolveWatch!: (unwatch: () => void) => void
     const watchMock = vi.fn().mockReturnValue(
@@ -907,14 +907,12 @@ describe('registerFilesystemWatcherHandlers', () => {
   it('registers one destroyed listener for many SSH worktree watches', async () => {
     const destroyedCallbacks: (() => void)[] = []
     const sender = {
-      isDestroyed: () => false,
-      send: vi.fn(),
+      ...createWatcherSender(99),
       once: vi.fn((event: string, callback: () => void) => {
         if (event === 'destroyed') {
           destroyedCallbacks.push(callback)
         }
-      }),
-      id: 99
+      })
     }
     const unwatchMock = vi.fn()
     const watchMock = vi.fn().mockResolvedValue(unwatchMock)
@@ -929,7 +927,7 @@ describe('registerFilesystemWatcherHandlers', () => {
 
     // Why: WebContents warns after 10 listeners. The cleanup work still covers
     // every remote watch by scanning the shared remote watcher registry.
-    expect(sender.once).toHaveBeenCalledTimes(1)
+    expect(sender.once).toHaveBeenCalledTimes(3)
     expect(destroyedCallbacks).toHaveLength(1)
 
     destroyedCallbacks[0]()
diff --git a/src/main/ipc/filesystem.test.ts b/src/main/ipc/filesystem.test.ts
index fe1568dbf725..2d452fe4ee6a 100644
--- a/src/main/ipc/filesystem.test.ts
+++ b/src/main/ipc/filesystem.test.ts
@@ -1,3 +1,4 @@
+import { EventEmitter } from 'node:events'
 import path from 'node:path'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import {
@@ -608,38 +609,50 @@ describe('registerFilesystemHandlers', () => {
   // Why #7721: without a cancel path, every workspace switch left the previous
   // workspace's full-tree SSH scan running, stacking scans on the relay until
   // interactive fs.readDir/fs.stat starved past their 30s timeout.
-  it('fs:cancelListFiles aborts an in-flight SSH listing by request token (#7721)', async () => {
-    let capturedSignal: AbortSignal | undefined
-    const listFilesMock = vi.fn(
-      (_rootPath: string, options: { signal?: AbortSignal }) =>
-        new Promise<string[]>((_resolve, reject) => {
-          capturedSignal = options.signal
-          options.signal?.addEventListener('abort', () => reject(new Error('listing cancelled')), {
-            once: true
+  it.each(['cancel', 'did-navigate', 'render-process-gone', 'destroyed'])(
+    'aborts an in-flight SSH file listing on %s (#7721)',
+    async (eventName) => {
+      let capturedSignal: AbortSignal | undefined
+      const listFilesMock = vi.fn(
+        (_rootPath: string, options: { signal?: AbortSignal }) =>
+          new Promise<string[]>((_resolve, reject) => {
+            capturedSignal = options.signal
+            options.signal?.addEventListener(
+              'abort',
+              () => reject(new Error('listing cancelled')),
+              {
+                once: true
+              }
+            )
           })
-        })
-    )
-    getSshFilesystemProviderMock.mockReturnValue({ listFiles: listFilesMock })
+      )
+      getSshFilesystemProviderMock.mockReturnValue({ listFiles: listFilesMock })
 
-    registerFilesystemHandlers(store as never)
+      registerFilesystemHandlers(store as never)
 
-    // Why: cancellation keys are scoped to the issuing webContents, so the
-    // cancel must come from the same sender as the listing request.
-    const senderEvent = { sender: { id: 7 } }
-    const pending = handlers.get('fs:listFiles')!(senderEvent, {
-      rootPath: '/home/user/repo',
-      connectionId: 'conn-1',
-      requestToken: 'token-1'
-    }) as Promise<string[]>
-
-    expect(capturedSignal?.aborted).toBe(false)
-    await handlers.get('fs:cancelListFiles')!(senderEvent, { requestToken: 'token-1' })
-    expect(capturedSignal?.aborted).toBe(true)
-    await expect(pending).rejects.toThrow('listing cancelled')
-
-    // Unknown or already-settled tokens are a no-op, not an error.
-    expect(() =>
-      handlers.get('fs:cancelListFiles')!(senderEvent, { requestToken: 'unknown' })
-    ).not.toThrow()
-  })
+      // Why: cancellation keys are scoped to the issuing webContents, so the
+      // cancel must come from the same sender as the listing request.
+      const senderEvent = { sender: Object.assign(new EventEmitter(), { id: 7 }) }
+      const pending = handlers.get('fs:listFiles')!(senderEvent, {
+        rootPath: '/home/user/repo',
+        connectionId: 'conn-1',
+        requestToken: 'token-1'
+      }) as Promise<string[]>
+
+      expect(capturedSignal?.aborted).toBe(false)
+      if (eventName === 'cancel') {
+        await handlers.get('fs:cancelListFiles')!(senderEvent, { requestToken: 'token-1' })
+      } else {
+        senderEvent.sender.emit(eventName)
+      }
+      expect(capturedSignal?.aborted).toBe(true)
+      await expect(pending).rejects.toThrow('listing cancelled')
+      expect(senderEvent.sender.eventNames()).toEqual([])
+
+      // Unknown or already-settled tokens are a no-op, not an error.
+      expect(() =>
+        handlers.get('fs:cancelListFiles')!(senderEvent, { requestToken: 'unknown' })
+      ).not.toThrow()
+    }
+  )
 })
diff --git a/src/main/ipc/filesystem/filesystem-download-handlers.ts b/src/main/ipc/filesystem/filesystem-download-handlers.ts
index 6b73df909da6..b542b235a48d 100644
--- a/src/main/ipc/filesystem/filesystem-download-handlers.ts
+++ b/src/main/ipc/filesystem/filesystem-download-handlers.ts
@@ -5,6 +5,7 @@ import { getRuntimePathBasename } from '../../../shared/cross-platform-path'
 import { requireSshFilesystemProvider } from '../../providers/ssh-filesystem-dispatch'
 import { sanitizeLocalDownloadFilename } from '../../local-download-filename'
 import { registerFilesystemDownloadFolderHandlers } from '../filesystem-download-folder'
+import { abortWhenRendererGone } from '../renderer-lifetime-abort'
 import type { FilesystemHandlerContext } from './filesystem-handler-context'
 import {
   cleanupLocalTransferPath,
@@ -24,7 +25,7 @@ function validateRequiredString(value: unknown, label: string): string {
 }
 
 export function registerFilesystemDownloadHandlers(context: FilesystemHandlerContext): void {
-  const { downloadSessions, closeDownloadSession, cleanupDownloadSessionsForSender } = context
+  const { downloadSessions, closeDownloadSession } = context
 
   ipcMain.handle(
     'fs:downloadFile',
@@ -122,21 +123,42 @@ export function registerFilesystemDownloadHandlers(context: FilesystemHandlerCon
       const suggestedName = sanitizeLocalDownloadFilename(
         validateRequiredString(args?.suggestedName, 'suggestedName')
       )
-      const parentWindow = BrowserWindow.fromWebContents(event.sender) ?? undefined
-      const dialogResult = parentWindow
-        ? await dialog.showSaveDialog(parentWindow, { defaultPath: suggestedName })
-        : await dialog.showSaveDialog({ defaultPath: suggestedName })
-      if (dialogResult.canceled || !dialogResult.filePath) {
+      if (event.sender.isDestroyed()) {
         return { canceled: true }
       }
-
-      const destinationPath = dialogResult.filePath
-      const { existed } = await inspectDownloadDestination(destinationPath)
-      const tempPath = createSiblingTransferPath(destinationPath, 'download')
+      const lifetime = abortWhenRendererGone(event.sender)
       const transferId = randomUUID()
+      const disposeRendererLifetime = (): void => {
+        lifetime.signal.removeEventListener('abort', onRendererGone)
+        lifetime.dispose()
+      }
+      const onRendererGone = (): void => {
+        disposeRendererLifetime()
+        void closeDownloadSession(transferId, true)
+      }
+      lifetime.signal.addEventListener('abort', onRendererGone, { once: true })
+      let admitted = false
+      let tempPath: string | null = null
+      let handle: Awaited<ReturnType<typeof open>> | null = null
       try {
-        const handle = await open(tempPath, 'wx')
-        const senderId = typeof event.sender.id === 'number' ? event.sender.id : Number.NaN
+        const parentWindow = BrowserWindow.fromWebContents(event.sender) ?? undefined
+        const dialogResult = parentWindow
+          ? await dialog.showSaveDialog(parentWindow, { defaultPath: suggestedName })
+          : await dialog.showSaveDialog({ defaultPath: suggestedName })
+        if (lifetime.signal.aborted || dialogResult.canceled || !dialogResult.filePath) {
+          return { canceled: true }
+        }
+
+        const destinationPath = dialogResult.filePath
+        const { existed } = await inspectDownloadDestination(destinationPath)
+        if (lifetime.signal.aborted) {
+          return { canceled: true }
+        }
+        tempPath = createSiblingTransferPath(destinationPath, 'download')
+        handle = await open(tempPath, 'wx')
+        if (lifetime.signal.aborted) {
+          return { canceled: true }
+        }
         const cleanupTimer = setTimeout(() => {
           void closeDownloadSession(transferId, true)
         }, DOWNLOAD_SESSION_TTL_MS)
@@ -149,13 +171,16 @@ export function registerFilesystemDownloadHandlers(context: FilesystemHandlerCon
           destinationExisted: existed,
           handle,
           cleanupTimer,
-          senderId
+          disposeRendererLifetime
         })
-        event.sender.once?.('destroyed', () => cleanupDownloadSessionsForSender(senderId))
+        admitted = true
         return { canceled: false, transferId, destinationPath }
-      } catch (error) {
-        await cleanupLocalTransferPath(tempPath)
-        throw error
+      } finally {
+        if (!admitted) {
+          disposeRendererLifetime()
+          await handle?.close().catch(() => {})
+          await cleanupLocalTransferPath(tempPath)
+        }
       }
     }
   )
diff --git a/src/main/ipc/filesystem/filesystem-git-pull-request-generation-handlers.ts b/src/main/ipc/filesystem/filesystem-git-pull-request-generation-handlers.ts
index 1c16a119b3b3..2361bbb4f4ca 100644
--- a/src/main/ipc/filesystem/filesystem-git-pull-request-generation-handlers.ts
+++ b/src/main/ipc/filesystem/filesystem-git-pull-request-generation-handlers.ts
@@ -89,6 +89,8 @@ export function registerFilesystemGitPullRequestGenerationHandlers(
           repoPath: args.worktreePath,
           connectionId: args.connectionId
         })
+        // Preparation can return before this lookup settles; retain its error for the later await.
+        void linkedIssueDetailsPromise.catch(() => undefined)
         let context: Awaited<ReturnType<typeof getPullRequestDraftContext>>
         try {
           const currentBody = await resolveHostedReviewBodyForGeneration({
@@ -151,6 +153,8 @@ export function registerFilesystemGitPullRequestGenerationHandlers(
         connectionId: args.connectionId,
         localGitOptions: gitOptions
       })
+      // Preparation can return before this lookup settles; retain its error for the later await.
+      void linkedIssueDetailsPromise.catch(() => undefined)
       let context: Awaited<ReturnType<typeof getPullRequestDraftContext>>
       try {
         const currentBody = await resolveHostedReviewBodyForGeneration({
diff --git a/src/main/ipc/filesystem/filesystem-handler-context.ts b/src/main/ipc/filesystem/filesystem-handler-context.ts
index 02488931e1ef..231034d9a918 100644
--- a/src/main/ipc/filesystem/filesystem-handler-context.ts
+++ b/src/main/ipc/filesystem/filesystem-handler-context.ts
@@ -11,7 +11,7 @@ export type DownloadSession = {
   destinationExisted: boolean
   handle: FileHandle
   cleanupTimer: ReturnType<typeof setTimeout>
-  senderId: number
+  disposeRendererLifetime: () => void
 }
 
 export type FilesystemHandlerContext = {
@@ -25,7 +25,6 @@ export type FilesystemHandlerContext = {
     transferId: string,
     cleanupTemp: boolean
   ) => Promise<DownloadSession | null>
-  cleanupDownloadSessionsForSender: (senderId: number) => void
 }
 
 export function createFilesystemHandlerContext(
@@ -46,6 +45,7 @@ export function createFilesystemHandlerContext(
       return null
     }
     downloadSessions.delete(transferId)
+    session.disposeRendererLifetime()
     clearTimeout(session.cleanupTimer)
     await session.handle.close().catch(() => {})
     if (cleanupTemp) {
@@ -54,14 +54,6 @@ export function createFilesystemHandlerContext(
     return session
   }
 
-  const cleanupDownloadSessionsForSender = (senderId: number): void => {
-    for (const [transferId, session] of Array.from(downloadSessions)) {
-      if (session.senderId === senderId) {
-        void closeDownloadSession(transferId, true)
-      }
-    }
-  }
-
   return {
     store,
     commitMessageAgentEnv,
@@ -69,7 +61,6 @@ export function createFilesystemHandlerContext(
     downloadSessions,
     listFilesCancellations,
     gitStatusCancellations,
-    closeDownloadSession,
-    cleanupDownloadSessionsForSender
+    closeDownloadSession
   }
 }
diff --git a/src/main/ipc/filesystem/filesystem-read-handlers.ts b/src/main/ipc/filesystem/filesystem-read-handlers.ts
index 2850ba659b40..1d9fe681fee6 100644
--- a/src/main/ipc/filesystem/filesystem-read-handlers.ts
+++ b/src/main/ipc/filesystem/filesystem-read-handlers.ts
@@ -13,6 +13,7 @@ import { resolveRegisteredWorktreePath } from '../registered-worktree-roots-cach
 import { resolveAuthorizedPath } from '../filesystem-auth'
 import { isENOENT } from '../filesystem-path-containment'
 import { listMarkdownDocuments, markdownDocumentsFromRelativePaths } from '../markdown-documents'
+import { getLocalGitOptionsForRegisteredWorktree } from '../local-worktree-runtime-options'
 import { recordCrashBreadcrumb } from '../../crash-reporting/crash-breadcrumb-store'
 import { buildReadDirErrorBreadcrumb, type ReadDirThrowSite } from '../readdir-error-diagnostics'
 import type { FilesystemHandlerContext } from './filesystem-handler-context'
@@ -131,7 +132,10 @@ export function registerFilesystemReadHandlers(context: FilesystemHandlerContext
         return markdownDocumentsFromRelativePaths(args.rootPath, relativePaths)
       }
       const rootPath = await resolveRegisteredWorktreePath(args.rootPath, store)
-      return listMarkdownDocuments(rootPath)
+      return listMarkdownDocuments(
+        rootPath,
+        getLocalGitOptionsForRegisteredWorktree(store, args.rootPath, rootPath)
+      )
     }
   )
 
diff --git a/src/main/ipc/folder-repo-git-upgrade-lifetime.test.ts b/src/main/ipc/folder-repo-git-upgrade-lifetime.test.ts
new file mode 100644
index 000000000000..8205381f9977
--- /dev/null
+++ b/src/main/ipc/folder-repo-git-upgrade-lifetime.test.ts
@@ -0,0 +1,225 @@
+import { join } from 'node:path'
+import type { BrowserWindow } from 'electron'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { Repo } from '../../shared/repo-types'
+import type { Store } from '../persistence'
+
+const fake = vi.hoisted(() => ({
+  stat: vi.fn(),
+  git: vi.fn(),
+  root: vi.fn(),
+  prepare: vi.fn(),
+  invalidate: vi.fn(),
+  reposChanged: vi.fn(),
+  worktreesChanged: vi.fn(),
+  unsubscribe: vi.fn()
+}))
+vi.mock('node:fs/promises', () => ({ stat: fake.stat }))
+vi.mock('node:fs', () => ({ realpathSync: (path: string) => path }))
+vi.mock('../git/repo', () => ({ isGitRepo: fake.git, getGitRepoRoot: fake.root }))
+vi.mock('../worktree-root-preparation', () => ({ prepareLocalWorktreeRootForRepo: fake.prepare }))
+vi.mock('./registered-worktree-roots-cache', () => ({
+  invalidateAuthorizedRootsCache: fake.invalidate
+}))
+vi.mock('./repos/repos-changed-notification', () => ({ notifyReposChanged: fake.reposChanged }))
+vi.mock('./worktree-remote', () => ({ notifyWorktreesChanged: fake.worktreesChanged }))
+vi.mock('./worktree-base-directory-poller', () => ({
+  WORKTREE_BASE_BACKSTOP_TICKS: 15,
+  WORKTREE_BASE_POLL_INTERVAL_MS: 2000,
+  createWorktreePollerWindowVisibility: () => ({
+    isWindowVisible: () => true,
+    onWindowBecameVisible: () => fake.unsubscribe
+  })
+}))
+
+import {
+  startFolderRepoGitUpgradeWatch,
+  stopFolderRepoGitUpgradeWatch
+} from './folder-repo-git-upgrade'
+import { wakeFolderRepoGitUpgradeWatch } from './folder-repo-git-upgrade-wake'
+
+const marker = { mtimeMs: 1, ctimeMs: 1, ino: 1 }
+const root = join('mock', 'folder')
+function folder(path = root): Repo {
+  return { id: path, path, kind: 'folder', displayName: 'Folder', addedAt: 0, badgeColor: 'blue' }
+}
+function deferred<T>() {
+  let resolve: (value: T) => void = () => {}
+  let reject: (error: Error) => void = () => {}
+  const promise = new Promise<T>((yes, no) => {
+    resolve = yes
+    reject = no
+  })
+  return { promise, resolve, reject }
+}
+function begin(repos = [folder()], meta: ReturnType<Store['getAllWorktreeMeta']> = {}) {
+  const store = {
+    getRepos: () => repos,
+    getRepo: (id: string) => repos.find((repo) => repo.id === id),
+    getAllWorktreeMeta: () => meta,
+    updateRepo: vi.fn((id: string, patch: Partial<Repo>) => {
+      const repo = repos.find((row) => row.id === id)
+      return repo ? Object.assign(repo, patch) : null
+    })
+  }
+  const window = { isDestroyed: () => false }
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Every Store method reachable by this poller is supplied; root preparation is mocked.
+  const storeFixture = store as unknown as Store
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Visibility and notifiers are mocked; only isDestroyed is read on this window.
+  const windowFixture = window as BrowserWindow
+  startFolderRepoGitUpgradeWatch(storeFixture, windowFixture, { pollIntervalMs: 25 })
+  return { store, window }
+}
+async function flush(): Promise<void> {
+  for (let index = 0; index < 10; index++) {
+    await Promise.resolve()
+  }
+}
+
+beforeEach(() => {
+  vi.useFakeTimers()
+  vi.resetAllMocks()
+  fake.stat.mockResolvedValue(marker)
+  fake.git.mockReturnValue(true)
+  fake.root.mockImplementation((path: string) => path)
+  fake.prepare.mockResolvedValue(undefined)
+})
+afterEach(() => {
+  stopFolderRepoGitUpgradeWatch()
+  vi.useRealTimers()
+})
+
+describe('folder repo upgrade poll lifetime', () => {
+  it('does not start Git checks or mutations when a marker arrives after stop', async () => {
+    const pending = deferred<typeof marker>()
+    fake.stat.mockReturnValue(pending.promise)
+    const { store } = begin()
+    await vi.advanceTimersByTimeAsync(25)
+    expect(fake.stat).toHaveBeenCalledTimes(1)
+    stopFolderRepoGitUpgradeWatch()
+    pending.resolve(marker)
+    await flush()
+    expect(fake.git).not.toHaveBeenCalled()
+    expect(fake.root).not.toHaveBeenCalled()
+    expect(store.updateRepo).not.toHaveBeenCalled()
+    expect(fake.prepare).not.toHaveBeenCalled()
+    expect(fake.invalidate).not.toHaveBeenCalled()
+    expect(fake.reposChanged).not.toHaveBeenCalled()
+    expect(vi.getTimerCount()).toBe(0)
+  })
+
+  it('stops the remaining folder scan when a pending marker fails after stop', async () => {
+    const pending = deferred<typeof marker>()
+    fake.stat.mockReturnValue(pending.promise)
+    begin([folder(), folder(join('mock', 'other'))])
+    await vi.advanceTimersByTimeAsync(25)
+    stopFolderRepoGitUpgradeWatch()
+    pending.reject(new Error('ENOENT'))
+    await flush()
+    expect(fake.stat).toHaveBeenCalledTimes(1)
+    expect(fake.git).not.toHaveBeenCalled()
+    expect(vi.getTimerCount()).toBe(0)
+  })
+
+  it('does not restore a rejected marker after its owner stops', async () => {
+    fake.git.mockImplementationOnce(() => {
+      stopFolderRepoGitUpgradeWatch()
+      return false
+    })
+    begin()
+    await vi.advanceTimersByTimeAsync(25)
+    expect(fake.git).toHaveBeenCalledTimes(1)
+    begin()
+    await vi.advanceTimersByTimeAsync(25)
+    expect(fake.git).toHaveBeenCalledTimes(2)
+    expect(fake.prepare).toHaveBeenCalledTimes(1)
+  })
+
+  it('does not prune a replacement watcher cache when earlier preparation finishes', async () => {
+    const pending = deferred<void>()
+    fake.prepare.mockReturnValueOnce(pending.promise)
+    begin()
+    await vi.advanceTimersByTimeAsync(25)
+    expect(fake.prepare).toHaveBeenCalledTimes(1)
+    stopFolderRepoGitUpgradeWatch()
+    fake.git.mockReturnValue(false)
+    begin([folder(join('mock', 'replacement'))])
+    await vi.advanceTimersByTimeAsync(25)
+    expect(fake.git).toHaveBeenCalledTimes(2)
+    pending.resolve()
+    await flush()
+    await vi.advanceTimersByTimeAsync(50)
+    expect(fake.git).toHaveBeenCalledTimes(2)
+    expect(fake.reposChanged).not.toHaveBeenCalled()
+    expect(fake.invalidate).toHaveBeenCalledTimes(1)
+  })
+
+  it('keeps active upgrade preparation, cache invalidation and notifications', async () => {
+    const { store, window } = begin()
+    await vi.advanceTimersByTimeAsync(25)
+    expect(store.updateRepo).toHaveBeenCalledWith(root, {
+      kind: 'git',
+      folderUpgradeGitRootPath: root,
+      externalWorktreeVisibility: 'hide'
+    })
+    expect(fake.prepare).toHaveBeenCalledTimes(1)
+    expect(fake.invalidate).toHaveBeenCalledTimes(1)
+    expect(fake.reposChanged).toHaveBeenCalledWith(window)
+    expect(fake.worktreesChanged).toHaveBeenCalledWith(window, root)
+  })
+
+  it('retries a missing marker and dedupes stable rejected markers', async () => {
+    fake.stat.mockRejectedValueOnce(new Error('ENOENT'))
+    fake.git.mockReturnValue(false)
+    begin()
+    await vi.advanceTimersByTimeAsync(100)
+    expect(fake.stat).toHaveBeenCalledTimes(4)
+    expect(fake.git).toHaveBeenCalledTimes(1)
+    fake.stat.mockResolvedValue({ ...marker, mtimeMs: 2 })
+    await vi.advanceTimersByTimeAsync(25)
+    expect(fake.git).toHaveBeenCalledTimes(2)
+  })
+
+  it('still excludes SSH, WSL, nonlocal execution hosts and git projects', async () => {
+    begin([
+      { ...folder(), connectionId: 'ssh' },
+      folder(String.raw`\\wsl$\Ubuntu\home\project`),
+      { ...folder(), executionHostId: 'runtime:other' },
+      { ...folder(), kind: 'git' }
+    ])
+    await vi.advanceTimersByTimeAsync(25)
+    expect(fake.stat).not.toHaveBeenCalled()
+    expect(fake.git).not.toHaveBeenCalled()
+  })
+
+  it('does not upgrade a project with extra folder workspaces', async () => {
+    const { store } = begin([folder()], {
+      [`${root}::${root}::workspace:extra`]: {
+        displayName: 'Extra',
+        comment: '',
+        linkedIssue: null,
+        linkedPR: null,
+        linkedLinearIssue: null,
+        isArchived: false,
+        isUnread: false,
+        isPinned: false,
+        sortOrder: 0,
+        lastActivityAt: 0
+      }
+    })
+    await vi.advanceTimersByTimeAsync(25)
+    expect(fake.stat).toHaveBeenCalledTimes(1)
+    expect(fake.git).not.toHaveBeenCalled()
+    expect(store.updateRepo).not.toHaveBeenCalled()
+  })
+
+  it('releases timer, wake and visibility ownership on stop', async () => {
+    begin()
+    stopFolderRepoGitUpgradeWatch()
+    wakeFolderRepoGitUpgradeWatch()
+    await vi.advanceTimersByTimeAsync(1000)
+    expect(fake.unsubscribe).toHaveBeenCalledTimes(1)
+    expect(fake.stat).not.toHaveBeenCalled()
+    expect(vi.getTimerCount()).toBe(0)
+  })
+})
diff --git a/src/main/ipc/folder-repo-git-upgrade.ts b/src/main/ipc/folder-repo-git-upgrade.ts
index e393ae561589..8a0a6130c0e0 100644
--- a/src/main/ipc/folder-repo-git-upgrade.ts
+++ b/src/main/ipc/folder-repo-git-upgrade.ts
@@ -164,10 +164,17 @@ async function pollOnce(watch: UpgradeWatch): Promise<void> {
     const key = normalizeRuntimePathForComparison(repo.path)
     liveKeys.add(key)
     const signature = await readGitMarkerSignature(repo.path)
+    if (watch.disposed) {
+      return
+    }
     if (signature === null || rejectedMarkers.get(key) === signature) {
       continue
     }
-    if ((await upgradeFolderRepo(watch, repo.id)) === 'rejected') {
+    const result = await upgradeFolderRepo(watch, repo.id)
+    if (watch.disposed) {
+      return
+    }
+    if (result === 'rejected') {
       rejectedMarkers.set(key, signature)
     }
   }
diff --git a/src/main/ipc/freebuff-detection.test.ts b/src/main/ipc/freebuff-detection.test.ts
new file mode 100644
index 000000000000..6c74e6409b5f
--- /dev/null
+++ b/src/main/ipc/freebuff-detection.test.ts
@@ -0,0 +1,38 @@
+import { describe, expect, it } from 'vitest'
+import {
+  getTuiAgentDetectionProbeCommands,
+  KNOWN_TUI_AGENT_DETECTION_COMMANDS,
+  resolveDetectedTuiAgentIds
+} from './tui-agent-detection-commands'
+
+describe('Freebuff detection', () => {
+  it.each(['darwin', 'linux', 'win32', 'wsl'] as const)(
+    'detects Freebuff independently of Codebuff on %s',
+    (runtime) => {
+      expect(
+        getTuiAgentDetectionProbeCommands(KNOWN_TUI_AGENT_DETECTION_COMMANDS, runtime)
+      ).toContain('freebuff')
+      expect(
+        resolveDetectedTuiAgentIds(
+          KNOWN_TUI_AGENT_DETECTION_COMMANDS,
+          new Set(['freebuff']),
+          runtime
+        )
+      ).toEqual(['freebuff'])
+      expect(
+        resolveDetectedTuiAgentIds(
+          KNOWN_TUI_AGENT_DETECTION_COMMANDS,
+          new Set(['codebuff']),
+          runtime
+        )
+      ).toEqual(['codebuff'])
+      expect(
+        resolveDetectedTuiAgentIds(
+          KNOWN_TUI_AGENT_DETECTION_COMMANDS,
+          new Set(['freebuff', 'codebuff']),
+          runtime
+        )
+      ).toEqual(expect.arrayContaining(['freebuff', 'codebuff']))
+    }
+  )
+})
diff --git a/src/main/ipc/hooks/register-worktree-hook-check-handler.ts b/src/main/ipc/hooks/register-worktree-hook-check-handler.ts
index 6b64dbe6a6f5..443f3b108db7 100644
--- a/src/main/ipc/hooks/register-worktree-hook-check-handler.ts
+++ b/src/main/ipc/hooks/register-worktree-hook-check-handler.ts
@@ -1,3 +1,4 @@
+import { getStoredRepoSshConnectionId } from '../../repo-execution-host'
 import { ipcMain } from 'electron'
 import type { ExecutionHostId } from '../../../shared/execution-host'
 import { isFolderRepo } from '../../../shared/repo-kind'
@@ -29,8 +30,9 @@ export function registerWorktreeHookCheckHandler(context: WorktreeIpcContext): v
         return { status: 'ok', hasHooks: false, hooks: null, mayNeedUpdate: false }
       }
 
-      if (repo.connectionId) {
-        const fsProvider = getSshFilesystemProvider(repo.connectionId)
+      const connectionId = getStoredRepoSshConnectionId(repo)
+      if (connectionId) {
+        const fsProvider = getSshFilesystemProvider(connectionId)
         if (!fsProvider) {
           return { status: 'error', hasHooks: false, hooks: null, mayNeedUpdate: false }
         }
diff --git a/src/main/ipc/hooks/register-worktree-hook-file-handlers.ts b/src/main/ipc/hooks/register-worktree-hook-file-handlers.ts
index 1ddf379f7845..ca1bfbcfb78c 100644
--- a/src/main/ipc/hooks/register-worktree-hook-file-handlers.ts
+++ b/src/main/ipc/hooks/register-worktree-hook-file-handlers.ts
@@ -1,3 +1,4 @@
+import { getStoredRepoSshConnectionId } from '../../repo-execution-host'
 import { getLocalProjectWorktreeGitOptions } from '../../project-runtime-git-options'
 import { ipcMain } from 'electron'
 import type { ExecutionHostId } from '../../../shared/execution-host'
@@ -32,9 +33,10 @@ export function registerWorktreeHookFileHandlers(context: WorktreeIpcContext): v
           source: 'none' as const
         }
       }
-      if (repo.connectionId) {
+      const connectionId = getStoredRepoSshConnectionId(repo)
+      if (connectionId) {
         const issueCommandPath = joinWorktreeRelativePath(repo.path, '.orca/issue-command')
-        const fsProvider = getSshFilesystemProvider(repo.connectionId)
+        const fsProvider = getSshFilesystemProvider(connectionId)
         if (!fsProvider) {
           return {
             status: 'error',
@@ -92,9 +94,10 @@ export function registerWorktreeHookFileHandlers(context: WorktreeIpcContext): v
       if (!repo || isFolderRepo(repo)) {
         return
       }
-      if (repo.connectionId) {
+      const connectionId = getStoredRepoSshConnectionId(repo)
+      if (connectionId) {
         const issueCommandPath = joinWorktreeRelativePath(repo.path, '.orca/issue-command')
-        const fsProvider = getSshFilesystemProvider(repo.connectionId)
+        const fsProvider = getSshFilesystemProvider(connectionId)
         if (!fsProvider) {
           throw new Error(
             'Remote filesystem unavailable. Reconnect the SSH target before retrying.'
@@ -110,7 +113,7 @@ export function registerWorktreeHookFileHandlers(context: WorktreeIpcContext): v
           return
         }
         await fsProvider.createDir(joinWorktreeRelativePath(repo.path, '.orca'))
-        if (await isIssueCommandIgnoredByGit(repo.path, repo.connectionId)) {
+        if (await isIssueCommandIgnoredByGit(repo.path, connectionId)) {
           await fsProvider.writeFile(issueCommandPath, `${trimmed}\n`)
           return
         }
diff --git a/src/main/ipc/hooks/register-worktree-hook-inspection-handler.ts b/src/main/ipc/hooks/register-worktree-hook-inspection-handler.ts
index 36dcfbc12884..6df6e79dbb8d 100644
--- a/src/main/ipc/hooks/register-worktree-hook-inspection-handler.ts
+++ b/src/main/ipc/hooks/register-worktree-hook-inspection-handler.ts
@@ -1,3 +1,4 @@
+import { getStoredRepoSshConnectionId } from '../../repo-execution-host'
 import { ipcMain } from 'electron'
 import type { ExecutionHostId } from '../../../shared/execution-host'
 import { isFolderRepo } from '../../../shared/repo-kind'
@@ -23,8 +24,9 @@ export function registerWorktreeHookInspectionHandler(context: WorktreeIpcContex
       return inspectSetupScriptImportCandidates(
         async (relativePath) => {
           const filePath = joinWorktreeRelativePath(repo.path, relativePath)
-          if (repo.connectionId) {
-            const fsProvider = getSshFilesystemProvider(repo.connectionId)
+          const connectionId = getStoredRepoSshConnectionId(repo)
+          if (connectionId) {
+            const fsProvider = getSshFilesystemProvider(connectionId)
             if (!fsProvider) {
               return null
             }
@@ -48,8 +50,9 @@ export function registerWorktreeHookInspectionHandler(context: WorktreeIpcContex
         {
           fileExists: async (relativePath) => {
             const filePath = joinWorktreeRelativePath(repo.path, relativePath)
-            if (repo.connectionId) {
-              const fsProvider = getSshFilesystemProvider(repo.connectionId)
+            const connectionId = getStoredRepoSshConnectionId(repo)
+            if (connectionId) {
+              const fsProvider = getSshFilesystemProvider(connectionId)
               if (!fsProvider) {
                 return false
               }
diff --git a/src/main/ipc/hooks/worktree-hook-execution-host.test.ts b/src/main/ipc/hooks/worktree-hook-execution-host.test.ts
new file mode 100644
index 000000000000..181d5a441d56
--- /dev/null
+++ b/src/main/ipc/hooks/worktree-hook-execution-host.test.ts
@@ -0,0 +1,251 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type { Repo } from '../../../shared/repo-types'
+import { hydrateRepo } from '../../persistence/tracking-repos/repo-hydration'
+
+const mocks = vi.hoisted(() => ({
+  handlers: new Map<string, (event: unknown, args: unknown) => unknown>(),
+  hasHooks: vi.fn(),
+  loadHooks: vi.fn(),
+  effectiveHooks: vi.fn(),
+  localRead: vi.fn(),
+  localWrite: vi.fn(),
+  localFileRead: vi.fn(),
+  localStat: vi.fn(),
+  remoteRead: vi.fn(),
+  remoteWrite: vi.fn(),
+  remoteStat: vi.fn(),
+  remoteMkdir: vi.fn(),
+  provider: vi.fn(),
+  ignored: vi.fn()
+}))
+vi.mock('electron', () => ({
+  ipcMain: {
+    handle: (channel: string, handler: (event: unknown, args: unknown) => unknown) =>
+      mocks.handlers.set(channel, handler)
+  }
+}))
+vi.mock('../../hooks', () => ({
+  hasHooksFile: mocks.hasHooks,
+  loadHooks: mocks.loadHooks,
+  getEffectiveHooks: mocks.effectiveHooks,
+  hasUnrecognizedOrcaYamlKeys: () => false,
+  parseOrcaYaml: () => ({ issueCommand: 'shared' })
+}))
+vi.mock('../../issue-command-file', () => ({
+  readIssueCommand: mocks.localRead,
+  writeIssueCommand: mocks.localWrite,
+  isIssueCommandIgnoredByGit: mocks.ignored
+}))
+vi.mock('../../project-runtime-git-options', () => ({
+  getLocalProjectWorktreeGitOptions: () => ({})
+}))
+vi.mock('../../providers/ssh-filesystem-dispatch', () => ({
+  getSshFilesystemProvider: mocks.provider
+}))
+vi.mock('node:fs/promises', () => ({ readFile: mocks.localFileRead, stat: mocks.localStat }))
+vi.mock('../../../shared/setup-script-imports', () => ({
+  inspectSetupScriptImportCandidates: async (
+    read: (path: string) => Promise<unknown>,
+    options?: { fileExists: (path: string) => Promise<boolean> }
+  ) => {
+    await read('setup.sh')
+    await options?.fileExists('package.json')
+    return []
+  }
+}))
+vi.mock('../../effective-hook-config', () => ({
+  getEffectiveSetupRunPolicy: () => 'manual',
+  getDefaultTabCommandTrustContent: () => undefined
+}))
+import { RuntimeRepositoryHooksCommands } from '../../runtime/runtime-repository-hooks-commands'
+import { RuntimeRepositoryIssueCommand } from '../../runtime/runtime-repository-issue-command'
+import { getRepoExecutionHostId } from '../../../shared/execution-host'
+import { registerWorktreeHookCheckHandler } from './register-worktree-hook-check-handler'
+import { registerWorktreeHookFileHandlers } from './register-worktree-hook-file-handlers'
+import { registerWorktreeHookInspectionHandler } from './register-worktree-hook-inspection-handler'
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  mocks.handlers.clear()
+  mocks.remoteRead.mockResolvedValue({ content: 'remote command', isBinary: false })
+  mocks.remoteWrite.mockResolvedValue(undefined)
+  mocks.remoteMkdir.mockResolvedValue(undefined)
+  mocks.remoteStat.mockResolvedValue({ type: 'file' })
+  mocks.ignored.mockResolvedValue(true)
+  mocks.localRead.mockResolvedValue({ localContent: 'wrong host' })
+  mocks.localWrite.mockResolvedValue(undefined)
+  mocks.localFileRead.mockResolvedValue('wrong host')
+  mocks.localStat.mockResolvedValue({ isDirectory: () => false })
+  mocks.hasHooks.mockReturnValue(false)
+  mocks.provider.mockReturnValue({
+    readFile: mocks.remoteRead,
+    writeFile: mocks.remoteWrite,
+    createDir: mocks.remoteMkdir,
+    stat: mocks.remoteStat
+  })
+})
+
+const owners = [
+  { label: 'legacy SSH', fields: { connectionId: 'host-a' }, target: 'host-a' },
+  { label: 'canonical SSH', fields: { executionHostId: 'ssh:host-a' }, target: 'host-a' },
+  {
+    label: 'canonical SSH over stale legacy target',
+    fields: { executionHostId: 'ssh:host-a', connectionId: 'stale' },
+    target: 'host-a'
+  },
+  { label: 'local', fields: {}, target: null },
+  {
+    label: 'explicit local over stale legacy target',
+    fields: { executionHostId: 'local', connectionId: 'stale' },
+    target: null
+  },
+  { label: 'own-store runtime stamp', fields: { executionHostId: 'runtime:env' }, target: null },
+  {
+    label: 'runtime stamp with nested legacy target',
+    fields: { executionHostId: 'runtime:env', connectionId: 'nested' },
+    target: null
+  }
+] as const satisfies readonly {
+  label: string
+  fields: Pick<Repo, 'connectionId' | 'executionHostId'>
+  target: string | null
+}[]
+
+const channels = [
+  'hooks:check',
+  'hooks:readIssueCommand',
+  'hooks:writeIssueCommand',
+  'hooks:inspectSetupScriptImports'
+] as const
+
+function register(repo: Repo): void {
+  const context = { store: { getRepos: () => [repo], getRepo: () => repo } }
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: These adapters only read the provided store accessors.
+  registerWorktreeHookCheckHandler(context as never)
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: These adapters only read the provided store accessors.
+  registerWorktreeHookFileHandlers(context as never)
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: These adapters only read the provided store accessors.
+  registerWorktreeHookInspectionHandler(context as never)
+}
+
+function makeRepo(fields: Pick<Repo, 'connectionId' | 'executionHostId'>): Repo {
+  return hydrateRepo(
+    {
+      id: 'repo',
+      path: '/remote/fixture',
+      displayName: 'fixture',
+      badgeColor: '#000',
+      addedAt: 0,
+      ...fields
+    },
+    new Map()
+  )
+}
+
+function expectRoute(target: string | null): void {
+  const localCalls = [
+    mocks.hasHooks,
+    mocks.localRead,
+    mocks.localWrite,
+    mocks.localFileRead,
+    mocks.localStat,
+    mocks.effectiveHooks
+  ]
+  if (target) {
+    expect(mocks.provider).toHaveBeenCalledWith(target)
+    for (const [connectionId] of mocks.provider.mock.calls) {
+      expect(connectionId).toBe(target)
+    }
+    for (const method of localCalls) {
+      expect(method).not.toHaveBeenCalled()
+    }
+  } else {
+    expect(mocks.provider).not.toHaveBeenCalled()
+    expect(localCalls.some((method) => method.mock.calls.length > 0)).toBe(true)
+    expect(mocks.remoteRead).not.toHaveBeenCalled()
+    expect(mocks.remoteWrite).not.toHaveBeenCalled()
+    expect(mocks.remoteStat).not.toHaveBeenCalled()
+  }
+}
+
+describe.each(owners)('desktop hooks: $label', ({ fields, target }) => {
+  it.each(channels)('routes %s to the stored owner', async (channel) => {
+    const repo = makeRepo(fields)
+    register(repo)
+    await mocks.handlers.get(channel)!(null, {
+      repoId: repo.id,
+      hostId: getRepoExecutionHostId(repo),
+      content: 'save'
+    })
+    expectRoute(target)
+    if (channel === 'hooks:writeIssueCommand' && target) {
+      expect(mocks.ignored).toHaveBeenCalledWith(repo.path, target)
+      expect(mocks.remoteWrite).toHaveBeenCalledWith(
+        '/remote/fixture/.orca/issue-command',
+        'save\n'
+      )
+    }
+  })
+})
+
+describe.each(owners)('runtime hooks: $label', ({ fields, target }) => {
+  it.each(['get', 'check', 'inspect', 'read', 'write'] as const)(
+    'routes %s to the stored owner',
+    async (method) => {
+      const repo = makeRepo(fields)
+      const hooks = new RuntimeRepositoryHooksCommands({ resolveRepo: async () => repo })
+      const issue = new RuntimeRepositoryIssueCommand({
+        resolveRepo: async () => repo,
+        getLocalGitArgs: () => []
+      })
+      if (method === 'get') {
+        await hooks.getRepoHooks(repo.id)
+      } else if (method === 'check') {
+        await hooks.checkRepoHooks(repo.id)
+      } else if (method === 'inspect') {
+        await hooks.inspectRepoSetupScriptImports(repo.id)
+      } else if (method === 'read') {
+        await issue.read(repo.id)
+      } else {
+        await issue.write(repo.id, 'save')
+      }
+      expectRoute(target)
+      if (method === 'write' && target) {
+        expect(mocks.ignored).toHaveBeenCalledWith(repo.path, target)
+        expect(mocks.remoteWrite).toHaveBeenCalledWith(
+          '/remote/fixture/.orca/issue-command',
+          'save\n'
+        )
+      }
+    }
+  )
+})
+
+it('refuses an unreachable canonical SSH write without touching local files', async () => {
+  const repo = makeRepo({ executionHostId: 'ssh:host-a' })
+  register(repo)
+  mocks.provider.mockReturnValue(null)
+  await expect(
+    mocks.handlers.get('hooks:writeIssueCommand')!(null, {
+      repoId: repo.id,
+      hostId: 'ssh:host-a',
+      content: 'save'
+    })
+  ).rejects.toThrow('Remote filesystem unavailable')
+  expect(mocks.localWrite).not.toHaveBeenCalled()
+})
+
+it.each(channels)('keeps folder repositories out of %s', async (channel) => {
+  const repo = { ...makeRepo({ executionHostId: 'ssh:host-a' }), kind: 'folder' as const }
+  register(repo)
+  await mocks.handlers.get(channel)!(null, {
+    repoId: repo.id,
+    hostId: 'ssh:host-a',
+    content: 'save'
+  })
+  expect(mocks.provider).not.toHaveBeenCalled()
+  expect(mocks.hasHooks).not.toHaveBeenCalled()
+  expect(mocks.localRead).not.toHaveBeenCalled()
+  expect(mocks.localWrite).not.toHaveBeenCalled()
+  expect(mocks.localFileRead).not.toHaveBeenCalled()
+})
diff --git a/src/main/ipc/markdown-documents-ripgrep-real.test.ts b/src/main/ipc/markdown-documents-ripgrep-real.test.ts
new file mode 100644
index 000000000000..373a6502c811
--- /dev/null
+++ b/src/main/ipc/markdown-documents-ripgrep-real.test.ts
@@ -0,0 +1,114 @@
+import { mkdir, mkdtemp, rm, symlink, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { basename, dirname, extname, join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { resetBundledRipgrepPathCacheForTests } from '../ripgrep/bundled-ripgrep-path'
+import { listMarkdownDocuments } from './markdown-documents'
+
+describe('Markdown listing with bundled ripgrep', () => {
+  let root: string
+
+  beforeEach(async () => {
+    root = await mkdtemp(join(tmpdir(), 'orca Markdown 日本語 '))
+    resetBundledRipgrepPathCacheForTests()
+  })
+
+  afterEach(async () => {
+    vi.unstubAllEnvs()
+    resetBundledRipgrepPathCacheForTests()
+    await rm(root, { recursive: true, force: true })
+  })
+
+  async function put(relativePath: string, content = 'document'): Promise<void> {
+    const filePath = join(root, relativePath)
+    await mkdir(dirname(filePath), { recursive: true })
+    await writeFile(filePath, content)
+  }
+
+  it('preserves Markdown visibility independently of ignore files and rg configuration', async () => {
+    const included = [
+      'README.md',
+      'Guide.MDX',
+      'docs/Notes.MARKDOWN',
+      '.hidden.md',
+      'docs/.hidden.mdx',
+      '.github/CONTRIBUTING.md',
+      'docs/.github/nested/guide.md',
+      '.github/normal/.hidden.md',
+      'ignored-git/readme.md',
+      'ignored-rg/readme.md',
+      'ignored-dot/readme.md',
+      'space folder/日本語 document.md',
+      'uppercase/NODE_MODULES/visible.md'
+    ]
+    const excluded = [
+      'plain.txt',
+      '.md',
+      'docs/.MDX',
+      '.git/hidden.md',
+      'node_modules/hidden.md',
+      'docs/node_modules/hidden.md',
+      '.hidden/hidden.md',
+      '.hidden/.github/hidden.md',
+      '.github/.hidden/hidden.md',
+      '.github/node_modules/hidden.md',
+      '.github/.md/hidden.md',
+      '.github.txt/hidden.md',
+      'docs/.md/hidden.md'
+    ]
+    for (const filePath of [...included, ...excluded]) {
+      await put(filePath)
+    }
+    await put('.gitignore', 'ignored-git/\n')
+    await put('.rgignore', 'ignored-rg/\n')
+    await put('.ignore', 'ignored-dot/\n')
+    await put('rg-config', '--glob=!*.md\n')
+    vi.stubEnv('RIPGREP_CONFIG_PATH', join(root, 'rg-config'))
+
+    expect(await listMarkdownDocuments(root)).toEqual(
+      included
+        .sort((left, right) => left.localeCompare(right))
+        .map((relativePath) => ({
+          filePath: join(root, relativePath),
+          relativePath,
+          basename: basename(relativePath),
+          name: basename(relativePath, extname(relativePath))
+        }))
+    )
+  })
+
+  it('does not follow directory links or file links', async () => {
+    await put('docs/original.md')
+    await symlink(
+      join(root, 'docs'),
+      join(root, 'linked-docs'),
+      process.platform === 'win32' ? 'junction' : 'dir'
+    )
+    // File symlinks require privileges that Windows test runners may not have.
+    if (process.platform !== 'win32') {
+      await symlink(join(root, 'docs/original.md'), join(root, 'linked.md'))
+      await symlink(join(root, 'missing.md'), join(root, 'broken.md'))
+    }
+    expect((await listMarkdownDocuments(root)).map((document) => document.relativePath)).toEqual([
+      'docs/original.md'
+    ])
+  })
+
+  it.skipIf(process.platform === 'win32')('preserves line breaks in filenames', async () => {
+    const names = ['line\nbreak.md', 'carriage\rreturn.MDX', 'nested\nfolder/文書.md']
+    for (const name of names) {
+      await put(name)
+    }
+    expect((await listMarkdownDocuments(root)).map((document) => document.relativePath)).toEqual(
+      names.sort((left, right) => left.localeCompare(right))
+    )
+  })
+
+  it('returns an empty list for an empty ordinary folder', async () => {
+    await expect(listMarkdownDocuments(root)).resolves.toEqual([])
+  })
+
+  it('rejects a missing root rather than treating it as an empty folder', async () => {
+    await expect(listMarkdownDocuments(join(root, 'missing'))).rejects.toThrow()
+  })
+})
diff --git a/src/main/ipc/markdown-documents-ripgrep.test.ts b/src/main/ipc/markdown-documents-ripgrep.test.ts
new file mode 100644
index 000000000000..daee482bae12
--- /dev/null
+++ b/src/main/ipc/markdown-documents-ripgrep.test.ts
@@ -0,0 +1,146 @@
+import { EventEmitter } from 'node:events'
+import { PassThrough } from 'node:stream'
+import { resolve } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { spawnMock } = vi.hoisted(() => ({ spawnMock: vi.fn() }))
+vi.mock('../ripgrep/bundled-ripgrep-spawn', () => ({ spawnBundledRipgrep: spawnMock }))
+
+import { listMarkdownDocuments } from './markdown-documents'
+
+class ListingProcess extends EventEmitter {
+  stdout = new PassThrough()
+  stderr = new PassThrough()
+  pid: number | undefined = 123
+  kill = vi.fn(() => true)
+}
+
+const root = resolve('/workspace/docs')
+const originalPlatform = process.platform
+let child: ListingProcess
+
+beforeEach(() => {
+  child = new ListingProcess()
+  spawnMock.mockReset().mockReturnValue(child)
+})
+afterEach(() => {
+  vi.useRealTimers()
+  vi.restoreAllMocks()
+  Object.defineProperty(process, 'platform', { configurable: true, value: originalPlatform })
+})
+
+describe('Markdown document ripgrep lifecycle', () => {
+  it('decodes split Unicode and NUL records without splitting newline filenames', async () => {
+    const result = listMarkdownDocuments(root)
+    const bytes = Buffer.from('./日本語\nnotes.MDX\0./.md\0./script.ts\0./README.md\0')
+    for (const byte of bytes) {
+      child.stdout.write(Buffer.from([byte]))
+    }
+    child.emit('close', 0, null)
+
+    expect((await result).map((doc) => doc.basename).sort()).toEqual([
+      'README.md',
+      '日本語\nnotes.MDX'
+    ])
+    expect(child.kill).not.toHaveBeenCalled()
+    expect(child.stdout.listenerCount('data')).toBe(0)
+    expect(child.listenerCount('close')).toBe(0)
+  })
+
+  it('accepts an empty listing', async () => {
+    const result = listMarkdownDocuments(root)
+    child.emit('close', 1, null)
+    await expect(result).resolves.toEqual([])
+  })
+
+  it('rejects an unreadable subtree even after receiving valid documents', async () => {
+    const result = listMarkdownDocuments(root)
+    child.stdout.write('./README.md\0')
+    child.stderr.write('Permission denied')
+    child.emit('close', 2, null)
+    await expect(result).rejects.toThrow('Permission denied')
+  })
+
+  it('rejects a truncated final path instead of returning partial documents', async () => {
+    const result = listMarkdownDocuments(root)
+    child.stdout.write('./README.md\0./unfinished.md')
+    child.emit('close', 0, null)
+    await expect(result).rejects.toThrow('Incomplete path')
+  })
+
+  it.each(['../escape.md', '/outside.md', './dir/../escape.md'])(
+    'rejects a path outside the relative listing protocol: %s',
+    async (path) => {
+      const result = listMarkdownDocuments(root)
+      child.stdout.write(`${path}\0`)
+      await expect(result).rejects.toThrow('Invalid path')
+      expect(child.kill).toHaveBeenCalledWith('SIGKILL')
+    }
+  )
+
+  it('rejects an oversized unfinished record without retaining the process', async () => {
+    const result = listMarkdownDocuments(root)
+    child.stdout.write(`./${'a'.repeat(1024 * 1024)}`)
+    await expect(result).rejects.toThrow('path exceeds')
+    expect(child.kill).toHaveBeenCalledWith('SIGKILL')
+  })
+
+  it('rejects a spawn failure and does not signal a missing process', async () => {
+    const result = listMarkdownDocuments(root)
+    child.pid = undefined
+    child.emit('error', Object.assign(new Error('missing bundled binary'), { code: 'ENOENT' }))
+    await expect(result).rejects.toThrow('missing bundled binary')
+    expect(child.kill).not.toHaveBeenCalled()
+  })
+
+  it('rejects synchronous spawn failures', async () => {
+    spawnMock.mockImplementation(() => {
+      throw new Error('spawn refused')
+    })
+    await expect(listMarkdownDocuments(root)).rejects.toThrow('spawn refused')
+  })
+
+  it('times out, kills the child and releases listeners even if close never arrives', async () => {
+    vi.useFakeTimers()
+    const result = listMarkdownDocuments(root)
+    const rejected = expect(result).rejects.toThrow('timed out')
+    child.stdout.write('./README.md\0')
+    await vi.advanceTimersByTimeAsync(15_000)
+    await rejected
+    expect(child.kill).toHaveBeenCalledWith('SIGKILL')
+    expect(child.stdout.listenerCount('data')).toBe(0)
+    expect(child.stderr.listenerCount('data')).toBe(0)
+    expect(child.listenerCount('close')).toBe(0)
+    expect(vi.getTimerCount()).toBe(0)
+    expect(() => child.emit('error', new Error('late error'))).not.toThrow()
+    expect(() => child.stdout.emit('error', new Error('late pipe error'))).not.toThrow()
+  })
+
+  it('rejects stdout failure instead of returning an incomplete set', async () => {
+    const result = listMarkdownDocuments(root)
+    child.stdout.emit('error', new Error('broken pipe'))
+    await expect(result).rejects.toThrow('broken pipe')
+  })
+
+  it('does not confuse an unreachable WSL cwd with no matching documents', async () => {
+    const result = listMarkdownDocuments(root, { wslDistro: 'Ubuntu' })
+    child.emit('close', 97, null)
+    await expect(result).rejects.toThrow('Search root is not reachable')
+  })
+
+  it.each([
+    { path: root, options: { wslDistro: 'Ubuntu' }, distro: 'Ubuntu' },
+    { path: '\\\\wsl.localhost\\Debian\\home\\repo', options: {}, distro: 'Debian' }
+  ])('selects the Linux binary for $distro', async ({ path, options, distro }) => {
+    Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' })
+    const result = listMarkdownDocuments(path, options)
+    expect(spawnMock).toHaveBeenCalledWith(expect.any(Array), {
+      cwd: path,
+      wslDistro: options.wslDistro,
+      wslDistroForOutput: distro,
+      stdio: ['ignore', 'pipe', 'pipe']
+    })
+    child.emit('close', 1, null)
+    await result
+  })
+})
diff --git a/src/main/ipc/markdown-documents.ts b/src/main/ipc/markdown-documents.ts
index 38466da60875..3977999b9aff 100644
--- a/src/main/ipc/markdown-documents.ts
+++ b/src/main/ipc/markdown-documents.ts
@@ -1,6 +1,11 @@
-import { readdir } from 'node:fs/promises'
 import { basename as pathBasename, extname, isAbsolute, join, relative, resolve } from 'node:path'
 import type { MarkdownDocument } from '../../shared/filesystem-entry-types'
+import { spawnBundledRipgrep } from '../ripgrep/bundled-ripgrep-spawn'
+import { parseWslPath } from '../wsl'
+import {
+  isRipgrepMissingCwdExit,
+  ripgrepMissingCwdError
+} from '../../shared/ripgrep-process-availability'
 
 function normalizeRelativePath(path: string): string {
   return path.replace(/[\\/]+/g, '/').replace(/^\/+/, '')
@@ -88,34 +93,132 @@ export function markdownDocumentsFromRelativePaths(
     .sort((a, b) => a.relativePath.localeCompare(b.relativePath))
 }
 
-export async function listMarkdownDocuments(rootPath: string): Promise<MarkdownDocument[]> {
-  const documents: MarkdownDocument[] = []
+const MARKDOWN_LISTING_TIMEOUT_MS = 15_000
+const MAX_MARKDOWN_PATH_BYTES = 1024 * 1024
 
-  async function visitDirectory(dirPath: string): Promise<void> {
-    const entries = await readdir(dirPath, { withFileTypes: true })
-    for (const entry of entries) {
-      if (entry.isSymbolicLink()) {
-        continue
-      }
+export async function listMarkdownDocuments(
+  rootPath: string,
+  options: { wslDistro?: string } = {}
+): Promise<MarkdownDocument[]> {
+  const child = spawnBundledRipgrep(
+    [
+      '--files',
+      '--hidden',
+      '--no-ignore',
+      '--no-config',
+      '--null',
+      '--path-separator',
+      '/',
+      // Directory-only globs preserve hidden Markdown files without traversing hidden folders.
+      '--glob',
+      '**',
+      '--glob',
+      '!**/.*/',
+      '--glob',
+      '**/.github/',
+      '--glob',
+      '!**/node_modules/',
+      '.'
+    ],
+    {
+      cwd: rootPath,
+      wslDistro: options.wslDistro,
+      wslDistroForOutput: parseWslPath(rootPath)?.distro ?? options.wslDistro,
+      stdio: ['ignore', 'pipe', 'pipe']
+    }
+  )
 
-      const entryPath = join(dirPath, entry.name)
-      if (entry.isDirectory()) {
-        if (entry.name === '.git' || entry.name === 'node_modules') {
-          continue
+  return new Promise((resolveListing, reject) => {
+    const documents: MarkdownDocument[] = []
+    let carry = ''
+    let stderr = ''
+    let settled = false
+    const finish = (error?: Error): void => {
+      if (settled) {
+        return
+      }
+      settled = true
+      clearTimeout(timer)
+      child.stdout?.off('data', onData)
+      child.stderr?.off('data', onStderr)
+      child.stdout?.off('error', onError)
+      child.stderr?.off('error', onError)
+      child.off('close', onClose)
+      child.off('error', onError)
+      // A spawn or pipe error can arrive after a timeout has already settled the listing.
+      child.on('error', ignoreLateError)
+      child.stdout?.on('error', ignoreLateError)
+      child.stderr?.on('error', ignoreLateError)
+      carry = ''
+      if (error) {
+        if (child.pid !== undefined) {
+          try {
+            child.kill('SIGKILL')
+          } catch {
+            // The process may have exited before the timeout or stream error arrived.
+          }
+        }
+        documents.length = 0
+        child.stdout?.resume()
+        child.stderr?.resume()
+        reject(error)
+      } else {
+        resolveListing(documents.sort((a, b) => a.relativePath.localeCompare(b.relativePath)))
+      }
+    }
+    const onError = (error: Error): void => finish(error)
+    const onStderr = (chunk: string): void => {
+      stderr = (stderr + chunk).slice(0, 4096)
+    }
+    const onData = (chunk: string): void => {
+      carry += chunk
+      let start = 0
+      let end: number
+      while ((end = carry.indexOf('\0', start)) !== -1) {
+        const path = carry.slice(start, end)
+        if (Buffer.byteLength(path) > MAX_MARKDOWN_PATH_BYTES) {
+          finish(new Error('Markdown document path exceeds the listing limit'))
+          return
         }
-        if (entry.name.startsWith('.') && entry.name !== '.github') {
-          continue
+        if (!path.startsWith('./') || path.split('/').includes('..')) {
+          finish(new Error('Invalid path in Markdown document listing'))
+          return
         }
-        await visitDirectory(entryPath)
-        continue
+        if (isMarkdownDocumentName(path)) {
+          documents.push(markdownDocumentFromFilePath(rootPath, join(rootPath, path.slice(2))))
+        }
+        start = end + 1
       }
-
-      if (entry.isFile() && isMarkdownDocumentName(entry.name)) {
-        documents.push(markdownDocumentFromFilePath(rootPath, entryPath))
+      carry = carry.slice(start)
+      if (Buffer.byteLength(carry) > MAX_MARKDOWN_PATH_BYTES) {
+        finish(new Error('Markdown document path exceeds the listing limit'))
       }
     }
-  }
-
-  await visitDirectory(rootPath)
-  return documents.sort((a, b) => a.relativePath.localeCompare(b.relativePath))
+    const onClose = (code: number | null, signal: NodeJS.Signals | null): void => {
+      if (isRipgrepMissingCwdExit(code)) {
+        finish(ripgrepMissingCwdError(rootPath))
+      } else if (signal || (code !== 0 && code !== 1)) {
+        finish(new Error(`Markdown document listing failed (${signal ?? code}): ${stderr.trim()}`))
+      } else if (carry) {
+        finish(new Error('Incomplete path in Markdown document listing'))
+      } else {
+        finish()
+      }
+    }
+    const timer = setTimeout(
+      () => finish(new Error('Markdown document listing timed out')),
+      MARKDOWN_LISTING_TIMEOUT_MS
+    )
+    timer.unref?.()
+    child.stdout?.setEncoding('utf8')
+    child.stderr?.setEncoding('utf8')
+    child.stdout?.on('data', onData)
+    child.stderr?.on('data', onStderr)
+    child.stdout?.on('error', onError)
+    child.stderr?.on('error', onError)
+    child.once('error', onError)
+    child.once('close', onClose)
+  })
 }
+
+function ignoreLateError(): void {}
diff --git a/src/main/ipc/native-chat-renderer-lifetime.test.ts b/src/main/ipc/native-chat-renderer-lifetime.test.ts
new file mode 100644
index 000000000000..c35be09cf4ef
--- /dev/null
+++ b/src/main/ipc/native-chat-renderer-lifetime.test.ts
@@ -0,0 +1,184 @@
+import { EventEmitter } from 'node:events'
+import { afterEach, beforeEach, expect, it, vi } from 'vitest'
+import type {
+  NativeChatTranscriptSubscription,
+  SubscribeNativeChatTranscriptArgs
+} from '../native-chat/transcript-watch-contract'
+
+const mocks = vi.hoisted(() => ({
+  listeners: new Map<string, (event: unknown, args: unknown) => void>(),
+  subscribe:
+    vi.fn<
+      (
+        args: SubscribeNativeChatTranscriptArgs,
+        signal?: AbortSignal
+      ) => Promise<NativeChatTranscriptSubscription>
+    >()
+}))
+
+vi.mock('electron', () => ({
+  ipcMain: {
+    handle: vi.fn(),
+    on: (channel: string, listener: (event: unknown, args: unknown) => void) => {
+      mocks.listeners.set(channel, listener)
+    }
+  }
+}))
+vi.mock('../native-chat/transcript-watch', () => ({
+  subscribeNativeChatTranscript: mocks.subscribe
+}))
+vi.mock('../native-chat/transcript-read-cache', () => ({ clearNativeChatTranscriptCache: vi.fn() }))
+
+import {
+  _getNativeChatPendingSubscriptionCountForTest,
+  _getNativeChatSenderCleanupCountForTest,
+  clearNativeChatSubscriptions,
+  registerNativeChatHandlers
+} from './native-chat'
+
+class Sender extends EventEmitter {
+  send = vi.fn()
+  isDestroyed = (): boolean => false
+  constructor(readonly id: number) {
+    super()
+  }
+}
+
+const live = new Set<SubscribeNativeChatTranscriptArgs>()
+const goneEvents = ['did-navigate', 'render-process-gone', 'destroyed'] as const
+
+function subscribe(sender: Sender, subscriptionId: string): void {
+  mocks.listeners.get('nativeChat:subscribe')?.(
+    { sender },
+    { subscriptionId, agent: 'claude', sessionId: 'one-agent-session' }
+  )
+}
+
+function emitAppend(): void {
+  for (const args of live) {
+    args.onAppend([])
+  }
+}
+
+function pendingSetup() {
+  let resolve: (subscription: NativeChatTranscriptSubscription) => void = () => {}
+  const promise = new Promise<NativeChatTranscriptSubscription>((settle) => {
+    resolve = settle
+  })
+  const unsubscribe = vi.fn()
+  return { promise, resolve: () => resolve({ watching: true, unsubscribe }), unsubscribe }
+}
+
+beforeEach(() => {
+  clearNativeChatSubscriptions()
+  live.clear()
+  mocks.subscribe.mockReset().mockImplementation(async (args) => {
+    live.add(args)
+    return { watching: true, unsubscribe: () => void live.delete(args) }
+  })
+  registerNativeChatHandlers()
+})
+
+afterEach(() => {
+  clearNativeChatSubscriptions()
+})
+
+it.each(goneEvents)('releases every live viewer subscription after %s', async (event) => {
+  const sender = new Sender(1)
+  subscribe(sender, 'pane-a')
+  subscribe(sender, 'pane-b')
+  await Promise.resolve()
+  expect(live.size).toBe(2)
+  emitAppend()
+  expect(sender.send).toHaveBeenCalledTimes(2)
+
+  sender.emit(event)
+  expect(live.size).toBe(0)
+  expect(_getNativeChatSenderCleanupCountForTest()).toBe(0)
+  emitAppend()
+  expect(sender.send).toHaveBeenCalledTimes(2)
+  for (const gone of goneEvents) {
+    expect(sender.listenerCount(gone)).toBe(0)
+  }
+})
+
+it.each(goneEvents)('aborts pending setup and closes a late watcher after %s', async (event) => {
+  const pending = pendingSetup()
+  mocks.subscribe.mockReturnValueOnce(pending.promise)
+  const sender = new Sender(2)
+  subscribe(sender, 'pending')
+  const signal = mocks.subscribe.mock.calls[0]?.[1]
+  expect(signal?.aborted).toBe(false)
+
+  sender.emit(event)
+  expect(signal?.aborted).toBe(true)
+  expect(_getNativeChatPendingSubscriptionCountForTest()).toBe(0)
+  pending.resolve()
+  await Promise.resolve()
+  expect(pending.unsubscribe).toHaveBeenCalledOnce()
+})
+
+it('does not publish callbacks from a replaced document into its replacement', async () => {
+  const pending = pendingSetup()
+  mocks.subscribe.mockReturnValueOnce(pending.promise)
+  const sender = new Sender(3)
+  subscribe(sender, 'same-id')
+  const oldArgs = mocks.subscribe.mock.calls[0]?.[0]
+  if (!oldArgs) {
+    throw new Error('Subscription was not started')
+  }
+  sender.emit('did-navigate')
+  subscribe(sender, 'same-id')
+  await Promise.resolve()
+  oldArgs.onTranscriptPending?.()
+  oldArgs.onInitialSnapshot?.([], false, 0)
+  oldArgs.onReplace?.([], false, 0)
+  oldArgs.onAppend([])
+  expect(sender.send).not.toHaveBeenCalled()
+  pending.resolve()
+  await Promise.resolve()
+  expect(pending.unsubscribe).toHaveBeenCalledOnce()
+  emitAppend()
+  expect(sender.send).toHaveBeenCalledOnce()
+})
+
+it('retains only the current watcher after repeated reloads', async () => {
+  const sender = new Sender(4)
+  for (let cycle = 0; cycle < 15; cycle++) {
+    subscribe(sender, `old-${cycle}`)
+    await Promise.resolve()
+    sender.emit('did-navigate')
+  }
+  subscribe(sender, 'current')
+  await Promise.resolve()
+  expect(live.size).toBe(1)
+  emitAppend()
+  expect(sender.send).toHaveBeenCalledOnce()
+  for (const event of goneEvents) {
+    expect(sender.listenerCount(event)).toBe(1)
+  }
+})
+
+it('preserves another viewer of the same agent session when one renderer reloads', async () => {
+  const first = new Sender(5)
+  const second = new Sender(6)
+  subscribe(first, 'shared-session')
+  subscribe(second, 'shared-session')
+  await Promise.resolve()
+  first.emit('did-navigate')
+  emitAppend()
+  expect(live.size).toBe(1)
+  expect(first.send).not.toHaveBeenCalled()
+  expect(second.send).toHaveBeenCalledOnce()
+})
+
+it('preserves subscriptions through same-document and prevented navigation', async () => {
+  const sender = new Sender(7)
+  subscribe(sender, 'current')
+  await Promise.resolve()
+  sender.emit('did-start-navigation')
+  sender.emit('did-navigate-in-page')
+  emitAppend()
+  expect(live.size).toBe(1)
+  expect(sender.send).toHaveBeenCalledOnce()
+})
diff --git a/src/main/ipc/native-chat-renderer-watcher-cleanup.test.ts b/src/main/ipc/native-chat-renderer-watcher-cleanup.test.ts
new file mode 100644
index 000000000000..a2cd6bb69ac2
--- /dev/null
+++ b/src/main/ipc/native-chat-renderer-watcher-cleanup.test.ts
@@ -0,0 +1,62 @@
+import { EventEmitter } from 'node:events'
+import { mkdtemp, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, expect, it, vi } from 'vitest'
+
+const listeners = new Map<string, (event: unknown, args: unknown) => void>()
+vi.mock('electron', () => ({
+  ipcMain: {
+    handle: vi.fn(),
+    on: (channel: string, listener: (event: unknown, args: unknown) => void) => {
+      listeners.set(channel, listener)
+    }
+  }
+}))
+
+import { clearNativeChatSubscriptions, registerNativeChatHandlers } from './native-chat'
+import { getActiveNativeChatWatcherCount } from '../native-chat/transcript-watcher-count'
+
+let transcriptDirectory = ''
+let transcriptPath = ''
+
+beforeEach(async () => {
+  clearNativeChatSubscriptions()
+  registerNativeChatHandlers()
+  transcriptDirectory = await mkdtemp(join(tmpdir(), 'orca-native-chat-renderer-lifetime-'))
+  transcriptPath = join(transcriptDirectory, 'session.jsonl')
+  await writeFile(
+    transcriptPath,
+    `${JSON.stringify({
+      type: 'user',
+      uuid: 'message-1',
+      timestamp: '2026-09-25T00:00:00.000Z',
+      message: { role: 'user', content: 'Viewer fixture' }
+    })}\n`
+  )
+})
+
+afterEach(async () => {
+  clearNativeChatSubscriptions()
+  await rm(transcriptDirectory, { recursive: true, force: true })
+})
+
+it.each(['did-navigate', 'render-process-gone', 'destroyed'])(
+  'releases the installed transcript watcher on %s',
+  async (event) => {
+    const sender = Object.assign(new EventEmitter(), {
+      id: 1,
+      isDestroyed: () => false,
+      send: vi.fn()
+    })
+    const before = getActiveNativeChatWatcherCount()
+    listeners.get('nativeChat:subscribe')?.(
+      { sender },
+      { subscriptionId: 'view', agent: 'claude', sessionId: 'session', transcriptPath }
+    )
+    await vi.waitFor(() => expect(sender.send).toHaveBeenCalled())
+    expect(getActiveNativeChatWatcherCount()).toBe(before + 1)
+    sender.emit(event)
+    expect(getActiveNativeChatWatcherCount()).toBe(before)
+  }
+)
diff --git a/src/main/ipc/native-chat-subscribe-lifecycle.test.ts b/src/main/ipc/native-chat-subscribe-lifecycle.test.ts
index 1c90227cfd21..071a3c6ddb6f 100644
--- a/src/main/ipc/native-chat-subscribe-lifecycle.test.ts
+++ b/src/main/ipc/native-chat-subscribe-lifecycle.test.ts
@@ -1,3 +1,4 @@
+import { EventEmitter } from 'node:events'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import type { NativeChatTurnLifecycle } from '../../shared/native-chat-types'
 
@@ -48,6 +49,7 @@ type SenderHarness = {
     id: number
     isDestroyed: () => boolean
     once: (event: string, callback: () => void) => void
+    removeListener: (event: string, callback: () => void) => void
     send: ReturnType<typeof vi.fn>
   }
 }
@@ -78,23 +80,18 @@ function deferredSubscription(): DeferredSubscription {
 
 function createSender(id: number): SenderHarness {
   let destroyed = false
-  const destroyedCallbacks: (() => void)[] = []
+  const events = new EventEmitter()
   return {
     destroy: () => {
       destroyed = true
-      for (const callback of destroyedCallbacks) {
-        callback()
-      }
+      events.emit('destroyed')
     },
-    registeredCleanupCount: () => destroyedCallbacks.length,
+    registeredCleanupCount: () => events.listenerCount('destroyed'),
     sender: {
       id,
       isDestroyed: () => destroyed,
-      once: (event, callback) => {
-        if (event === 'destroyed') {
-          destroyedCallbacks.push(callback)
-        }
-      },
+      once: (event, callback) => void events.once(event, callback),
+      removeListener: (event, callback) => void events.removeListener(event, callback),
       send: vi.fn()
     }
   }
diff --git a/src/main/ipc/native-chat.test.ts b/src/main/ipc/native-chat.test.ts
index 680dd3153391..4892990c4aca 100644
--- a/src/main/ipc/native-chat.test.ts
+++ b/src/main/ipc/native-chat.test.ts
@@ -1,3 +1,4 @@
+import { EventEmitter } from 'node:events'
 import { appendFile, mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
@@ -188,17 +189,11 @@ describe('nativeChat:readSession handler', () => {
     expect(subscribe).toBeDefined()
 
     const sent: { channel: string; payload: unknown }[] = []
-    let destroyedCb: (() => void) | undefined
-    const sender = {
+    const sender = Object.assign(new EventEmitter(), {
       id: 1,
       isDestroyed: () => false,
-      once: (event: string, cb: () => void) => {
-        if (event === 'destroyed') {
-          destroyedCb = cb
-        }
-      },
       send: (channel: string, payload: unknown) => sent.push({ channel, payload })
-    }
+    })
 
     const previousHome = process.env.HOME
     process.env.HOME = root
@@ -241,8 +236,8 @@ describe('nativeChat:readSession handler', () => {
       expect(appendedIds()).toContain('a-1')
 
       // Destroyed window tears down the watcher without error.
-      expect(destroyedCb).toBeDefined()
-      destroyedCb!()
+      expect(sender.listenerCount('destroyed')).toBe(1)
+      sender.emit('destroyed')
     } finally {
       if (previousHome === undefined) {
         delete process.env.HOME
@@ -264,17 +259,11 @@ describe('nativeChat:readSession handler', () => {
     expect(subscribe).toBeDefined()
 
     const sent: { channel: string; payload: unknown }[] = []
-    let destroyedCb: (() => void) | undefined
-    const sender = {
+    const sender = Object.assign(new EventEmitter(), {
       id: 7,
       isDestroyed: () => false,
-      once: (event: string, cb: () => void) => {
-        if (event === 'destroyed') {
-          destroyedCb = cb
-        }
-      },
       send: (channel: string, payload: unknown) => sent.push({ channel, payload })
-    }
+    })
 
     const previousHome = process.env.HOME
     process.env.HOME = root
@@ -290,7 +279,7 @@ describe('nativeChat:readSession handler', () => {
         }
       })
 
-      destroyedCb!()
+      sender.emit('destroyed')
     } finally {
       if (previousHome === undefined) {
         delete process.env.HOME
@@ -322,17 +311,11 @@ describe('nativeChat:readSession handler', () => {
     expect(subscribe).toBeDefined()
 
     let destroyed = false
-    let destroyedCb: (() => void) | undefined
-    const sender = {
+    const sender = Object.assign(new EventEmitter(), {
       id: 41,
       isDestroyed: () => destroyed,
-      once: (event: string, cb: () => void) => {
-        if (event === 'destroyed') {
-          destroyedCb = cb
-        }
-      },
       send: vi.fn()
-    }
+    })
 
     const previousHome = process.env.HOME
     process.env.HOME = root
@@ -346,9 +329,9 @@ describe('nativeChat:readSession handler', () => {
         }
       )
 
-      expect(destroyedCb).toBeDefined()
+      expect(sender.listenerCount('destroyed')).toBe(1)
       destroyed = true
-      destroyedCb!()
+      sender.emit('destroyed')
 
       await waitFor(() => _getNativeChatSenderCleanupCountForTest() === 0)
       expect(sender.send).not.toHaveBeenCalled()
diff --git a/src/main/ipc/native-chat.ts b/src/main/ipc/native-chat.ts
index f94424b67f6c..9e5058282ef4 100644
--- a/src/main/ipc/native-chat.ts
+++ b/src/main/ipc/native-chat.ts
@@ -12,6 +12,7 @@ import {
   type NativeChatTranscriptSubscription,
   type SubscribeNativeChatTranscriptArgs
 } from '../native-chat/transcript-watch'
+import { abortWhenRendererGone } from './renderer-lifetime-abort'
 
 // Re-export so existing test imports of `clearNativeChatTranscriptCache` from
 // this module keep working after the cache moved to transcript-read-cache.ts.
@@ -89,14 +90,12 @@ type PendingSubscription = {
   controller: AbortController
 }
 
-// Why: live subscriptions are keyed by (webContents.id, subscriptionId) so the
-// same renderer can watch several panes, and a destroyed window tears down all
-// of its watchers — strict teardown to avoid fd leaks (plan U4 risk).
+// A renderer document owns its viewers; replacement, crash, or destruction releases them.
 const liveSubscriptions = new Map<number, Map<string, LiveSubscription>>()
 // Why: unsubscribe and renderer destruction must invalidate async watcher setup
 // before it can publish a late subscription into the live map.
 const pendingSubscriptions = new Map<number, Map<string, PendingSubscription>>()
-const senderCleanupRegistered = new Set<number>()
+const senderLifetimes = new Map<number, ReturnType<typeof abortWhenRendererGone>>()
 
 function teardownSubscription(senderId: number, subscriptionId: string): void {
   const pendingBySubId = pendingSubscriptions.get(senderId)
@@ -118,8 +117,9 @@ function teardownSubscription(senderId: number, subscriptionId: string): void {
 }
 
 function teardownAllForSender(senderId: number): void {
-  // The destroyed event can arrive before async subscription setup stores a watcher.
-  senderCleanupRegistered.delete(senderId)
+  const lifetime = senderLifetimes.get(senderId)
+  senderLifetimes.delete(senderId)
+  lifetime?.dispose()
   for (const pending of pendingSubscriptions.get(senderId)?.values() ?? []) {
     pending.controller.abort()
   }
@@ -134,13 +134,22 @@ function teardownAllForSender(senderId: number): void {
   liveSubscriptions.delete(senderId)
 }
 
-function registerSenderCleanup(sender: WebContents): void {
-  if (senderCleanupRegistered.has(sender.id)) {
-    return
+function registerSenderCleanup(sender: WebContents): AbortSignal {
+  const existing = senderLifetimes.get(sender.id)
+  if (existing) {
+    return existing.signal
   }
-  senderCleanupRegistered.add(sender.id)
-  // Strict teardown: a closed/reloaded window releases every watcher it owns.
-  sender.once('destroyed', () => teardownAllForSender(sender.id))
+  const lifetime = abortWhenRendererGone(sender)
+  const onRendererGone = (): void => teardownAllForSender(sender.id)
+  senderLifetimes.set(sender.id, {
+    signal: lifetime.signal,
+    dispose: () => {
+      lifetime.signal.removeEventListener('abort', onRendererGone)
+      lifetime.dispose()
+    }
+  })
+  lifetime.signal.addEventListener('abort', onRendererGone, { once: true })
+  return lifetime.signal
 }
 
 function beginPendingSubscription(senderId: number, subscriptionId: string): PendingSubscription {
@@ -177,7 +186,9 @@ async function handleSubscribe(event: IpcMainEvent, args: NativeChatSubscribeArg
   const limit = args.limit && args.limit > 0 ? Math.floor(args.limit) : DESKTOP_READ_WINDOW
   // Replace any prior subscription under the same id (session change/resubscribe).
   const pending = beginPendingSubscription(sender.id, subscriptionId)
-  registerSenderCleanup(sender)
+  const rendererSignal = registerSenderCleanup(sender)
+  const canPublish = (): boolean =>
+    !sender.isDestroyed() && !rendererSignal.aborted && !pending.controller.signal.aborted
 
   const subscribeArgs: SubscribeNativeChatTranscriptArgs = {
     agent,
@@ -185,7 +196,7 @@ async function handleSubscribe(event: IpcMainEvent, args: NativeChatSubscribeArg
     transcriptPath,
     initialLimit: limit,
     onTranscriptPending: () => {
-      if (sender.isDestroyed()) {
+      if (!canPublish()) {
         return
       }
       // `pending` marks a window with no transcript behind it yet; clients that
@@ -197,7 +208,7 @@ async function handleSubscribe(event: IpcMainEvent, args: NativeChatSubscribeArg
       sender.send('nativeChat:appended', payload)
     },
     onInitialSnapshot: (messages, hasMore, _beforeOffset, error, lifecycle) => {
-      if (sender.isDestroyed()) {
+      if (!canPublish()) {
         return
       }
       // Forward an initial-drain error so a watching client's first frame carries it
@@ -215,7 +226,7 @@ async function handleSubscribe(event: IpcMainEvent, args: NativeChatSubscribeArg
       sender.send('nativeChat:appended', payload)
     },
     onReplace: (messages, hasMore, _beforeOffset, lifecycle) => {
-      if (sender.isDestroyed()) {
+      if (!canPublish()) {
         return
       }
       sender.send('nativeChat:appended', {
@@ -229,7 +240,7 @@ async function handleSubscribe(event: IpcMainEvent, args: NativeChatSubscribeArg
       } satisfies NativeChatAppendedPayload)
     },
     onAppend: (messages, lifecycle) => {
-      if (sender.isDestroyed()) {
+      if (!canPublish()) {
         return
       }
       const payload: NativeChatAppendedPayload = {
@@ -254,7 +265,7 @@ async function handleSubscribe(event: IpcMainEvent, args: NativeChatSubscribeArg
   // Why: unmount, destruction, or a newer same-id subscribe can invalidate setup
   // while path resolution is pending; only the owning generation may publish its watcher.
   const stillCurrent = takePendingSubscription(sender.id, subscriptionId, pending)
-  if (sender.isDestroyed() || !stillCurrent) {
+  if (!canPublish() || !stillCurrent) {
     subscription.unsubscribe()
     return
   }
@@ -266,7 +277,7 @@ async function handleSubscribe(event: IpcMainEvent, args: NativeChatSubscribeArg
   }
   bySubId.set(subscriptionId, { subscription })
   liveSubscriptions.set(sender.id, bySubId)
-  if (!subscription.watching && !sender.isDestroyed()) {
+  if (!subscription.watching && canPublish()) {
     const payload: NativeChatAppendedPayload = {
       subscriptionId,
       frame: {
@@ -282,16 +293,19 @@ async function handleSubscribe(event: IpcMainEvent, args: NativeChatSubscribeArg
 
 /** Test-only: drop all live and pending transcript subscriptions between runs. */
 export function clearNativeChatSubscriptions(): void {
-  const senderIds = new Set([...liveSubscriptions.keys(), ...pendingSubscriptions.keys()])
+  const senderIds = new Set([
+    ...senderLifetimes.keys(),
+    ...liveSubscriptions.keys(),
+    ...pendingSubscriptions.keys()
+  ])
   for (const senderId of senderIds) {
     teardownAllForSender(senderId)
   }
   pendingSubscriptions.clear()
-  senderCleanupRegistered.clear()
 }
 
 export function _getNativeChatSenderCleanupCountForTest(): number {
-  return senderCleanupRegistered.size
+  return senderLifetimes.size
 }
 
 export function _getNativeChatPendingSubscriptionCountForTest(): number {
diff --git a/src/main/ipc/notebook.ts b/src/main/ipc/notebook.ts
index cb7f4e564b5a..70f8224011b6 100644
--- a/src/main/ipc/notebook.ts
+++ b/src/main/ipc/notebook.ts
@@ -49,11 +49,13 @@ export function registerNotebookHandlers(store: Store): void {
     'notebook:listPythonEnvironments',
     async (
       _event,
-      args: { filePath: string; rootPath: string | null }
+      args: { filePath: string; rootPath: string | null; runWorkspaceInterpreters: boolean }
     ): Promise<PythonEnvironments> => {
       await resolveAuthorizedPath(args.filePath, store)
       // Why the unresolved path: rootPath is in the same (possibly symlinked) form, e.g. /tmp.
-      return listPythonEnvironments(args.filePath, args.rootPath)
+      return listPythonEnvironments(args.filePath, args.rootPath, {
+        runWorkspaceInterpreters: args.runWorkspaceInterpreters === true
+      })
     }
   )
 
diff --git a/src/main/ipc/notification-options.ts b/src/main/ipc/notification-options.ts
index a19f6044a465..24d43545e138 100644
--- a/src/main/ipc/notification-options.ts
+++ b/src/main/ipc/notification-options.ts
@@ -76,7 +76,10 @@ function formatAgentNotificationStatusText(args: NotificationDispatchRequest): s
   if (args.agentState === 'working') {
     return translateMain('notifications.agentStatus.working', 'working')
   }
-  return args.agentState === 'done' && args.agentInterrupted
+  if (args.agentState === 'done' && args.agentTurnOutcome === 'failure') {
+    return translateMain('notifications.agentStatus.failed', 'failed')
+  }
+  return args.agentState === 'done' && args.agentTurnOutcome === 'cancellation'
     ? translateMain('notifications.agentStatus.stopped', 'stopped')
     : translateMain('notifications.agentStatus.finished', 'finished')
 }
@@ -104,7 +107,7 @@ function hasAgentNotificationSnapshot(args: NotificationDispatchRequest): boolea
     args.agentToolName ||
     args.agentToolInput ||
     args.agentLastAssistantMessage ||
-    args.agentInterrupted
+    args.agentTurnOutcome !== undefined
   )
 }
 
diff --git a/src/main/ipc/notifications-message-formatting.test.ts b/src/main/ipc/notifications-message-formatting.test.ts
index abf41bfae3cb..3d519293f3c8 100644
--- a/src/main/ipc/notifications-message-formatting.test.ts
+++ b/src/main/ipc/notifications-message-formatting.test.ts
@@ -217,7 +217,7 @@ describe('registerNotificationHandlers', () => {
           worktreeLabel: 'feat/notis',
           agentType: 'claude',
           agentState: 'done',
-          agentInterrupted: true,
+          agentTurnOutcome: 'cancellation',
           agentLastAssistantMessage: 'Stopped by user.'
         }
       )
@@ -316,7 +316,12 @@ describe('registerNotificationHandlers', () => {
     )
   })
 
-  it('reports an interrupted finish as stopped', async () => {
+  it.each([
+    { agentTurnOutcome: 'cancellation', word: 'stopped' },
+    { agentTurnOutcome: 'failure', word: 'failed' },
+    { agentTurnOutcome: 'success', word: 'finished' },
+    { agentTurnOutcome: undefined, word: 'finished' }
+  ] as const)('words a $agentTurnOutcome finish as $word', async ({ agentTurnOutcome, word }) => {
     registerNotificationHandlers({
       getSettings: () => ({
         notifications: {
@@ -336,14 +341,40 @@ describe('registerNotificationHandlers', () => {
         worktreeLabel: 'feat/notis',
         agentType: 'claude',
         agentState: 'done',
-        agentInterrupted: true
+        ...(agentTurnOutcome ? { agentTurnOutcome } : {})
       }
     )
 
     expect(notificationCtorMock).toHaveBeenCalledWith(
       expectedNativeNotificationOptions({
-        title: 'feat/notis - Claude stopped',
-        body: 'Claude stopped.'
+        title: `feat/notis - Claude ${word}`,
+        body: `Claude ${word}.`
+      })
+    )
+  })
+
+  it('counts a success verdict alone as an agent snapshot', async () => {
+    registerNotificationHandlers({
+      getSettings: () => ({
+        notifications: {
+          enabled: true,
+          agentTaskComplete: true,
+          terminalBell: false,
+          suppressWhenFocused: true
+        }
+      })
+    } as never)
+
+    const handler = getDispatchHandler()
+    await handler(
+      {},
+      { source: 'agent-task-complete', worktreeLabel: 'feat/notis', agentTurnOutcome: 'success' }
+    )
+
+    expect(notificationCtorMock).toHaveBeenCalledWith(
+      expectedNativeNotificationOptions({
+        title: 'feat/notis - Agent finished',
+        body: 'Agent finished.'
       })
     )
   })
diff --git a/src/main/ipc/orca-profile-project-transfer-args.ts b/src/main/ipc/orca-profile-project-transfer-args.ts
new file mode 100644
index 000000000000..c2882baf6c4f
--- /dev/null
+++ b/src/main/ipc/orca-profile-project-transfer-args.ts
@@ -0,0 +1,25 @@
+import type { TransferOrcaProfileProjectArgs } from '../../shared/orca-profiles'
+
+export function transferProjectArgsFromUnknown(args: unknown): TransferOrcaProfileProjectArgs {
+  if (
+    typeof args !== 'object' ||
+    args === null ||
+    !('sourceProfileId' in args) ||
+    typeof args.sourceProfileId !== 'string' ||
+    !('targetProfileId' in args) ||
+    typeof args.targetProfileId !== 'string' ||
+    !('repoId' in args) ||
+    typeof args.repoId !== 'string' ||
+    !('mode' in args) ||
+    (args.mode !== 'move' && args.mode !== 'copy')
+  ) {
+    throw new Error('invalid_orca_profile_project_transfer')
+  }
+  const sourceProfileId = args.sourceProfileId.trim()
+  const targetProfileId = args.targetProfileId.trim()
+  const repoId = args.repoId.trim()
+  if (!sourceProfileId || !targetProfileId || !repoId) {
+    throw new Error('invalid_orca_profile_project_transfer')
+  }
+  return { sourceProfileId, targetProfileId, repoId, mode: args.mode }
+}
diff --git a/src/main/ipc/orca-profiles-switch-persistence.test.ts b/src/main/ipc/orca-profiles-switch-persistence.test.ts
new file mode 100644
index 000000000000..e948d4054e70
--- /dev/null
+++ b/src/main/ipc/orca-profiles-switch-persistence.test.ts
@@ -0,0 +1,115 @@
+import { readFileSync } from 'node:fs'
+import { describe, expect, it, vi } from 'vitest'
+import {
+  createWorkerMaintenanceFixture,
+  maintenanceBarrier
+} from '../persistence/loading-store/profile-state-maintenance-fixture'
+import { registerOrcaProfileHandlers } from './orca-profiles'
+
+const { handlers, quit, select } = vi.hoisted(() => ({
+  handlers: new Map<string, (event: unknown, args: unknown) => Promise<unknown>>(),
+  quit: vi.fn(),
+  select: vi.fn()
+}))
+vi.mock('electron', () => ({
+  app: { quit },
+  ipcMain: {
+    handle: (channel: string, handler: (event: unknown, args: unknown) => Promise<unknown>) => {
+      handlers.set(channel, handler)
+    }
+  }
+}))
+vi.mock('../app-relaunch', () => ({ relaunchApp: vi.fn() }))
+vi.mock('../orca-profiles/profile-index-store', () => ({
+  getOrcaProfileListState: () => ({ activeProfileId: 'source', profiles: [] }),
+  setActiveOrcaProfile: select,
+  createLocalOrcaProfile: vi.fn(),
+  seedNewOrcaProfileTelemetryConsent: vi.fn()
+}))
+vi.mock('../telemetry/client', () => ({ track: vi.fn() }))
+vi.mock('../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: () => ({ nth_repo_added: 2 })
+}))
+vi.mock('../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: () => ({ hosts: [] }),
+  sshConfigHostsToTargets: () => []
+}))
+
+describe('plain profile switch persistence', () => {
+  it('preserves shutdown changes when quit starts during the switch checkpoint', async () => {
+    const { store, authority, readState } = await createWorkerMaintenanceFixture()
+    store.upsertSshRemotePtyLease({ targetId: 'remote', ptyId: 'pty', state: 'attached' })
+    await store.flushPendingOrThrowAsync()
+    const started = maintenanceBarrier()
+    const release = maintenanceBarrier()
+    const hold = async (write: () => Promise<void>) => {
+      started.resolve()
+      await release.promise
+      await write()
+    }
+    const selective = authority.writeSerializedDomains.bind(authority)
+    const complete = authority.writeCompleteSerializedDomains.bind(authority)
+    vi.spyOn(authority, 'writeSerializedDomains').mockImplementationOnce((domains) =>
+      hold(() => selective(domains))
+    )
+    vi.spyOn(authority, 'writeCompleteSerializedDomains').mockImplementationOnce((domains) =>
+      hold(() => complete(domains))
+    )
+    store.updateSettings({ theme: 'dark' })
+    registerOrcaProfileHandlers(store)
+    vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout'] })
+    const switching = handlers
+      .get('orcaProfiles:switch')?.(
+        { sender: { isDestroyed: () => false, send: vi.fn() } },
+        { profileId: 'target' }
+      )
+      .catch((error: unknown) => error)
+    await started.promise
+    store.markSshRemotePtyLeasesForShutdown('remote', 'detached')
+    const final = store.flushFinalOrThrowAsync()
+    release.resolve()
+    await final
+    await expect(switching).resolves.toEqual({ status: 'relaunching' })
+    expect(readState()).toMatchObject({
+      settings: { theme: 'dark' },
+      sshRemotePtyLeases: [expect.objectContaining({ state: 'detached' })]
+    })
+  })
+
+  it('admits pre-relaunch writes and includes SSH detach in the final source checkpoint', async () => {
+    const { store, readState, dataFile } = await createWorkerMaintenanceFixture()
+    vi.spyOn(console, 'warn').mockImplementation(() => {})
+    store.upsertSshRemotePtyLease({ targetId: 'remote', ptyId: 'pty', state: 'attached' })
+    await store.flushPendingOrThrowAsync()
+    const cleanupSaved = vi.fn()
+    let final: Promise<void> | undefined
+    quit.mockImplementation(() => {
+      store.markSshRemotePtyLeasesForShutdown('remote', 'detached')
+      final = store.flushFinalOrThrowAsync({ exportJsonCompatibility: true })
+    })
+    registerOrcaProfileHandlers(store, {
+      onBeforeRelaunch: async () => {
+        store.updateSettings({ theme: 'light' })
+        await store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
+        cleanupSaved()
+      }
+    })
+    vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout'] })
+    const switchProfile = handlers.get('orcaProfiles:switch')
+    expect(switchProfile).toBeDefined()
+    await switchProfile?.(
+      { sender: { isDestroyed: () => false, send: vi.fn() } },
+      { profileId: 'target' }
+    )
+    await vi.advanceTimersByTimeAsync(150)
+    expect(final).toBeDefined()
+    await final
+    expect(select).toHaveBeenCalledWith('target')
+    expect(cleanupSaved).toHaveBeenCalledOnce()
+    expect(readState()).toMatchObject({
+      settings: { theme: 'light' },
+      sshRemotePtyLeases: [expect.objectContaining({ state: 'detached' })]
+    })
+    expect(JSON.parse(readFileSync(dataFile, 'utf8'))).toEqual(readState())
+  })
+})
diff --git a/src/main/ipc/orca-profiles.test.ts b/src/main/ipc/orca-profiles.test.ts
index 215b559327d8..2a8b24851d3a 100644
--- a/src/main/ipc/orca-profiles.test.ts
+++ b/src/main/ipc/orca-profiles.test.ts
@@ -1,4 +1,5 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type * as ProfileStoragePaths from '../orca-profiles/profile-storage-paths'
 
 const {
   handlers,
@@ -11,7 +12,8 @@ const {
   getOrcaProfileListStateMock,
   seedNewOrcaProfileTelemetryConsentMock,
   setActiveOrcaProfileMock,
-  transferOrcaProfileProjectMock
+  transferOrcaProfileProjectMock,
+  hasOrcaProfileStateDatabaseMock
 } = vi.hoisted(() => ({
   handlers: new Map<string, (_event: unknown, args?: unknown) => unknown>(),
   appExitMock: vi.fn(),
@@ -23,7 +25,8 @@ const {
   getOrcaProfileListStateMock: vi.fn(),
   seedNewOrcaProfileTelemetryConsentMock: vi.fn(),
   setActiveOrcaProfileMock: vi.fn(),
-  transferOrcaProfileProjectMock: vi.fn()
+  transferOrcaProfileProjectMock: vi.fn(),
+  hasOrcaProfileStateDatabaseMock: vi.fn()
 }))
 
 vi.mock('electron', () => ({
@@ -54,21 +57,36 @@ vi.mock('../orca-profiles/profile-index-store', () => ({
   setActiveOrcaProfile: setActiveOrcaProfileMock
 }))
 
-function makeStoreMock(flushPendingOrThrowAsync = vi.fn()): {
-  flushPendingOrThrowAsync: typeof flushPendingOrThrowAsync
-  freezeWrites: ReturnType<typeof vi.fn>
-  getSettings: () => Record<string, never>
-} {
-  return { flushPendingOrThrowAsync, freezeWrites: vi.fn(), getSettings: () => ({}) }
+function makeStoreMock(flushPendingOrThrowAsync = vi.fn()) {
+  const freezeWrites = vi.fn()
+  const resumeMaintenance = vi.fn(async () => {})
+  return {
+    flushPendingOrThrowAsync,
+    freezeWrites,
+    resumeMaintenance,
+    beginProfileMaintenance: vi.fn(async (options: unknown) => {
+      await flushPendingOrThrowAsync(options)
+      freezeWrites()
+      return { resume: resumeMaintenance }
+    }),
+    getSettings: () => ({})
+  }
 }
 
 vi.mock('../orca-profiles/profile-project-transfer', () => ({
   transferOrcaProfileProject: transferOrcaProfileProjectMock
 }))
 
+vi.mock('../orca-profiles/profile-storage-paths', async (importOriginal) => ({
+  ...(await importOriginal<typeof ProfileStoragePaths>()),
+  hasOrcaProfileStateDatabase: hasOrcaProfileStateDatabaseMock
+}))
+
 import { registerOrcaProfileHandlers } from './orca-profiles'
 import { installFakeAppEnvironment } from '../../../config/scripts/vitest-host-ports-setup'
 
+const ipcEvent = { sender: { isDestroyed: () => false, send: vi.fn() } }
+
 describe('registerOrcaProfileHandlers', () => {
   beforeEach(() => {
     // Why the port and per-test: userData resolves through AppEnvironment now, and
@@ -76,6 +94,7 @@ describe('registerOrcaProfileHandlers', () => {
     installFakeAppEnvironment({ getPath: () => '/tmp/orca-user-data' })
     vi.useFakeTimers()
     handlers.clear()
+    ipcEvent.sender.send.mockClear()
     appExitMock.mockReset()
     appQuitMock.mockReset()
     appRelaunchMock.mockReset()
@@ -87,6 +106,7 @@ describe('registerOrcaProfileHandlers', () => {
     seedNewOrcaProfileTelemetryConsentMock.mockReset()
     setActiveOrcaProfileMock.mockReset()
     transferOrcaProfileProjectMock.mockReset()
+    hasOrcaProfileStateDatabaseMock.mockReset().mockReturnValue(false)
   })
 
   afterEach(() => {
@@ -107,12 +127,12 @@ describe('registerOrcaProfileHandlers', () => {
 
     registerOrcaProfileHandlers(makeStoreMock() as never)
 
-    await expect(Promise.resolve(handlers.get('orcaProfiles:list')?.(null))).resolves.toEqual({
+    await expect(Promise.resolve(handlers.get('orcaProfiles:list')?.(ipcEvent))).resolves.toEqual({
       ...listState,
       multiProfileUi: false
     })
     await expect(
-      Promise.resolve(handlers.get('orcaProfiles:createLocal')?.(null, { name: 'Work' }))
+      Promise.resolve(handlers.get('orcaProfiles:createLocal')?.(ipcEvent, { name: 'Work' }))
     ).resolves.toBe(createState)
     expect(createLocalOrcaProfileMock).toHaveBeenCalledWith({ name: 'Work' })
   })
@@ -127,11 +147,13 @@ describe('registerOrcaProfileHandlers', () => {
       })
       registerOrcaProfileHandlers(makeStoreMock() as never)
 
-      await expect(Promise.resolve(handlers.get('orcaProfiles:list')?.(null))).resolves.toEqual({
-        activeProfileId: 'local-default',
-        profiles: [],
-        multiProfileUi: true
-      })
+      await expect(Promise.resolve(handlers.get('orcaProfiles:list')?.(ipcEvent))).resolves.toEqual(
+        {
+          activeProfileId: 'local-default',
+          profiles: [],
+          multiProfileUi: true
+        }
+      )
     } finally {
       if (previous === undefined) {
         delete process.env.ORCA_MULTI_PROFILE_UI
@@ -155,7 +177,7 @@ describe('registerOrcaProfileHandlers', () => {
     registerOrcaProfileHandlers(makeStoreMock(flush) as never, { onBeforeRelaunch })
 
     const resultPromise = Promise.resolve(
-      handlers.get('orcaProfiles:switch')?.(null, { profileId: 'local-work' })
+      handlers.get('orcaProfiles:switch')?.(ipcEvent, { profileId: 'local-work' })
     )
 
     await expect(resultPromise).resolves.toEqual({ status: 'relaunching' })
@@ -189,7 +211,7 @@ describe('registerOrcaProfileHandlers', () => {
     registerOrcaProfileHandlers(makeStoreMock(flush) as never)
 
     await expect(
-      Promise.resolve(handlers.get('orcaProfiles:switch')?.(null, { profileId: 'local-work' }))
+      Promise.resolve(handlers.get('orcaProfiles:switch')?.(ipcEvent, { profileId: 'local-work' }))
     ).rejects.toThrow('flush_failed')
 
     expect(setActiveOrcaProfileMock).not.toHaveBeenCalled()
@@ -206,10 +228,10 @@ describe('registerOrcaProfileHandlers', () => {
     registerOrcaProfileHandlers(makeStoreMock(flush) as never, { onBeforeRelaunch })
 
     const switchProfile = Promise.resolve(
-      handlers.get('orcaProfiles:switch')?.(null, { profileId: 'local-work' })
+      handlers.get('orcaProfiles:switch')?.(ipcEvent, { profileId: 'local-work' })
     )
     const rejection = expect(switchProfile).rejects.toThrow('orca_profile_persistence_timeout')
-    await vi.advanceTimersByTimeAsync(20_000)
+    await vi.advanceTimersByTimeAsync(60_000)
     await rejection
 
     expect(setActiveOrcaProfileMock).not.toHaveBeenCalled()
@@ -225,7 +247,9 @@ describe('registerOrcaProfileHandlers', () => {
     registerOrcaProfileHandlers(makeStoreMock() as never)
 
     await expect(
-      Promise.resolve(handlers.get('orcaProfiles:switch')?.(null, { profileId: 'local-default' }))
+      Promise.resolve(
+        handlers.get('orcaProfiles:switch')?.(ipcEvent, { profileId: 'local-default' })
+      )
     ).resolves.toEqual({ status: 'already-active' })
 
     expect(setActiveOrcaProfileMock).not.toHaveBeenCalled()
@@ -236,7 +260,7 @@ describe('registerOrcaProfileHandlers', () => {
     registerOrcaProfileHandlers(makeStoreMock() as never)
 
     await expect(
-      Promise.resolve(handlers.get('orcaProfiles:switch')?.(null, { profileId: ' ' }))
+      Promise.resolve(handlers.get('orcaProfiles:switch')?.(ipcEvent, { profileId: ' ' }))
     ).rejects.toThrow('invalid_orca_profile_id')
   })
 
@@ -260,7 +284,7 @@ describe('registerOrcaProfileHandlers', () => {
 
     await expect(
       Promise.resolve(
-        handlers.get('orcaProfiles:transferProject')?.(null, {
+        handlers.get('orcaProfiles:transferProject')?.(ipcEvent, {
           sourceProfileId: ' personal ',
           targetProfileId: ' work ',
           repoId: ' repo-1 ',
@@ -302,7 +326,7 @@ describe('registerOrcaProfileHandlers', () => {
 
     await expect(
       Promise.resolve(
-        handlers.get('orcaProfiles:transferProject')?.(null, {
+        handlers.get('orcaProfiles:transferProject')?.(ipcEvent, {
           sourceProfileId: 'personal',
           targetProfileId: 'work',
           repoId: 'repo-1',
@@ -328,11 +352,56 @@ describe('registerOrcaProfileHandlers', () => {
     await vi.advanceTimersByTimeAsync(150)
 
     expect(appRelaunchMock).toHaveBeenCalledOnce()
+    expect(ipcEvent.sender.send).toHaveBeenCalledWith('app:restart-committed')
     expect(relaunchAppMock).toHaveBeenCalledWith('profile-transfer')
     expect(appQuitMock).toHaveBeenCalledOnce()
     expect(appExitMock).not.toHaveBeenCalled()
   })
 
+  it('relaunches the closed source when a completed move cannot update the profile index', async () => {
+    const store = makeStoreMock()
+    getOrcaProfileListStateMock.mockReturnValue({ activeProfileId: 'personal', profiles: [] })
+    transferOrcaProfileProjectMock.mockReturnValue({ status: 'transferred', mode: 'move' })
+    setActiveOrcaProfileMock.mockImplementationOnce(() => {
+      throw new Error('profile index disk full')
+    })
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: This fixture supplies every Store operation exercised by these IPC handlers.
+    registerOrcaProfileHandlers(store as never)
+
+    await expect(
+      handlers.get('orcaProfiles:transferProject')?.(ipcEvent, {
+        sourceProfileId: 'personal',
+        targetProfileId: 'work',
+        repoId: 'repo-1',
+        mode: 'move'
+      })
+    ).rejects.toThrow('profile index disk full')
+
+    expect(store.freezeWrites).toHaveBeenCalledOnce()
+    expect(store.resumeMaintenance).not.toHaveBeenCalled()
+    expect(ipcEvent.sender.send).toHaveBeenCalledWith('app:restart-committed')
+    await vi.advanceTimersByTimeAsync(150)
+    expect(relaunchAppMock).toHaveBeenCalledWith('profile-transfer')
+    expect(appQuitMock).toHaveBeenCalledOnce()
+  })
+
+  it('keeps the active profile writable during a transfer between inactive profiles', async () => {
+    const store = makeStoreMock()
+    getOrcaProfileListStateMock.mockReturnValue({ activeProfileId: 'active', profiles: [] })
+    transferOrcaProfileProjectMock.mockReturnValue({ status: 'transferred', mode: 'copy' })
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: This fixture supplies the Store operations exercised by the handlers.
+    registerOrcaProfileHandlers(store as never)
+    await handlers.get('orcaProfiles:transferProject')?.(ipcEvent, {
+      sourceProfileId: 'personal',
+      targetProfileId: 'work',
+      repoId: 'repo-1',
+      mode: 'copy'
+    })
+    expect(store.beginProfileMaintenance).not.toHaveBeenCalled()
+    expect(store.freezeWrites).not.toHaveBeenCalled()
+    expect(store.flushPendingOrThrowAsync).toHaveBeenCalledBefore(transferOrcaProfileProjectMock)
+  })
+
   it('rejects transfers that would mutate the active target profile offline', async () => {
     getOrcaProfileListStateMock.mockReturnValue({
       activeProfileId: 'work',
@@ -342,7 +411,7 @@ describe('registerOrcaProfileHandlers', () => {
 
     await expect(
       Promise.resolve(
-        handlers.get('orcaProfiles:transferProject')?.(null, {
+        handlers.get('orcaProfiles:transferProject')?.(ipcEvent, {
           sourceProfileId: 'personal',
           targetProfileId: 'work',
           repoId: 'repo-1',
@@ -353,4 +422,84 @@ describe('registerOrcaProfileHandlers', () => {
 
     expect(transferOrcaProfileProjectMock).not.toHaveBeenCalled()
   })
+
+  it('freezes a newly migrated source after transfer failure and reopens its current profile', async () => {
+    const store = makeStoreMock()
+    const onBeforeRelaunch = vi.fn()
+    getOrcaProfileListStateMock.mockReturnValue({ activeProfileId: 'personal', profiles: [] })
+    transferOrcaProfileProjectMock.mockImplementation(() => {
+      hasOrcaProfileStateDatabaseMock.mockReturnValue(true)
+      throw new Error('source commit interrupted')
+    })
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: This fixture supplies every Store operation exercised by these IPC handlers.
+    registerOrcaProfileHandlers(store as never, { onBeforeRelaunch })
+
+    await expect(
+      Promise.resolve(
+        handlers.get('orcaProfiles:transferProject')?.(ipcEvent, {
+          sourceProfileId: 'personal',
+          targetProfileId: 'work',
+          repoId: 'repo-1',
+          mode: 'move'
+        })
+      )
+    ).rejects.toThrow('source commit interrupted')
+
+    expect(store.flushPendingOrThrowAsync).toHaveBeenCalledBefore(transferOrcaProfileProjectMock)
+    expect(store.freezeWrites).toHaveBeenCalledOnce()
+    expect(store.freezeWrites).toHaveBeenCalledBefore(onBeforeRelaunch)
+    expect(setActiveOrcaProfileMock).not.toHaveBeenCalled()
+    await vi.advanceTimersByTimeAsync(150)
+    expect(ipcEvent.sender.send).toHaveBeenCalledWith('app:restart-committed')
+    expect(relaunchAppMock).toHaveBeenCalledWith('profile-transfer')
+    expect(appQuitMock).toHaveBeenCalledOnce()
+  })
+
+  it('keeps an active JSON source writable after validation fails without a migration', async () => {
+    const store = makeStoreMock()
+    const onBeforeRelaunch = vi.fn()
+    getOrcaProfileListStateMock.mockReturnValue({ activeProfileId: 'personal', profiles: [] })
+    transferOrcaProfileProjectMock.mockImplementation(() => {
+      throw new Error('unknown_source_repo')
+    })
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: This fixture supplies every Store operation exercised by these IPC handlers.
+    registerOrcaProfileHandlers(store as never, { onBeforeRelaunch })
+
+    await expect(
+      Promise.resolve(
+        handlers.get('orcaProfiles:transferProject')?.(ipcEvent, {
+          sourceProfileId: 'personal',
+          targetProfileId: 'work',
+          repoId: 'repo-1',
+          mode: 'move'
+        })
+      )
+    ).rejects.toThrow('unknown_source_repo')
+
+    expect(store.resumeMaintenance).toHaveBeenCalledOnce()
+    expect(onBeforeRelaunch).not.toHaveBeenCalled()
+    await vi.advanceTimersByTimeAsync(150)
+    expect(relaunchAppMock).not.toHaveBeenCalled()
+  })
+
+  it.each([
+    null,
+    {},
+    { sourceProfileId: 4 },
+    {
+      sourceProfileId: 'personal',
+      targetProfileId: 'work',
+      repoId: 'repo-1',
+      mode: 'invalid'
+    }
+  ])('rejects malformed transfer arguments before disk work: %j', async (args) => {
+    const store = makeStoreMock()
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: This fixture supplies every Store operation exercised by these IPC handlers.
+    registerOrcaProfileHandlers(store as never)
+    await expect(
+      Promise.resolve(handlers.get('orcaProfiles:transferProject')?.(ipcEvent, args))
+    ).rejects.toThrow('invalid_orca_profile_project_transfer')
+    expect(store.flushPendingOrThrowAsync).not.toHaveBeenCalled()
+    expect(transferOrcaProfileProjectMock).not.toHaveBeenCalled()
+  })
 })
diff --git a/src/main/ipc/orca-profiles.ts b/src/main/ipc/orca-profiles.ts
index 480c6f350f9b..694841e544e0 100644
--- a/src/main/ipc/orca-profiles.ts
+++ b/src/main/ipc/orca-profiles.ts
@@ -1,4 +1,4 @@
-import { app, ipcMain } from 'electron'
+import { app, ipcMain, type WebContents } from 'electron'
 import type { Store } from '../persistence'
 import { relaunchApp, type AppRelaunchReason } from '../app-relaunch'
 import type {
@@ -33,8 +33,12 @@ import {
 import { getProfileUserDataPath } from '../orca-profiles/profile-storage-paths'
 import { isMultiProfileUiEnabled } from '../orca-profiles/profile-ui-scope'
 import { transferOrcaProfileProject } from '../orca-profiles/profile-project-transfer'
+import { transferActiveProfileProject } from '../orca-profiles/profile-active-transfer'
 import { findOrcaProfileProjectsByPath } from '../orca-profiles/profile-project-presence'
-import { flushActiveProfileBeforeFileMutation } from '../orca-profiles/profile-persistence-deadline'
+import {
+  flushActiveProfileBeforeFileMutation,
+  flushActiveProfileBeforeRelaunch
+} from '../orca-profiles/profile-persistence-deadline'
 import { normalizeExecutionHostId } from '../../shared/execution-host'
 import {
   createCloudLinkedOrcaProfile,
@@ -47,6 +51,7 @@ import {
 import { registerOrcaProfileOrgMemberHandlers } from './orca-profile-org-members-handlers'
 import { onOrcaCloudSessionInvalidated } from '../orca-profiles/profile-cloud-session-invalidation'
 import { broadcastOrcaProfileAuthStatusChanged } from './orca-profile-auth-status-broadcast'
+import { transferProjectArgsFromUnknown } from './orca-profile-project-transfer-args'
 
 type RegisterOrcaProfileHandlersOptions = {
   onBeforeRelaunch?: () => void | Promise<void>
@@ -55,40 +60,16 @@ type RegisterOrcaProfileHandlersOptions = {
 }
 
 function profileIdFromArgs(args: unknown): string {
-  if (
-    !args ||
-    typeof args !== 'object' ||
-    typeof (args as SwitchOrcaProfileArgs).profileId !== 'string'
-  ) {
-    throw new Error('invalid_orca_profile_id')
-  }
-  const profileId = (args as SwitchOrcaProfileArgs).profileId.trim()
+  const profileId =
+    args && typeof args === 'object' && 'profileId' in args && typeof args.profileId === 'string'
+      ? args.profileId.trim()
+      : ''
   if (!profileId) {
     throw new Error('invalid_orca_profile_id')
   }
   return profileId
 }
 
-function transferProjectArgsFromUnknown(args: unknown): TransferOrcaProfileProjectArgs {
-  if (!args || typeof args !== 'object') {
-    throw new Error('invalid_orca_profile_project_transfer')
-  }
-  const candidate = args as TransferOrcaProfileProjectArgs
-  const sourceProfileId = candidate.sourceProfileId?.trim()
-  const targetProfileId = candidate.targetProfileId?.trim()
-  const repoId = candidate.repoId?.trim()
-  const mode = candidate.mode
-  if (!sourceProfileId || !targetProfileId || !repoId || (mode !== 'move' && mode !== 'copy')) {
-    throw new Error('invalid_orca_profile_project_transfer')
-  }
-  return {
-    sourceProfileId,
-    targetProfileId,
-    repoId,
-    mode
-  }
-}
-
 function findProjectsByPathArgsFromUnknown(args: unknown): FindOrcaProfileProjectsByPathArgs {
   if (!args || typeof args !== 'object') {
     throw new Error('invalid_orca_profile_project_path')
@@ -157,7 +138,12 @@ async function runBeforeProfileRelaunch(
   }
 }
 
-function scheduleProfileRelaunch(reason: Extract<AppRelaunchReason, `profile-${string}`>): void {
+type ProfileRelaunchReason = Extract<AppRelaunchReason, `profile-${string}`>
+
+function scheduleProfileRelaunch(reason: ProfileRelaunchReason, sender: WebContents): void {
+  if (!sender.isDestroyed()) {
+    sender.send('app:restart-committed')
+  }
   setTimeout(() => {
     relaunchApp(reason)
     // Why: app.quit() (not app.exit) so before-quit/will-quit still run —
@@ -197,7 +183,7 @@ export function registerOrcaProfileHandlers(
 
   ipcMain.handle(
     'orcaProfiles:switch',
-    async (_event, args: SwitchOrcaProfileArgs): Promise<SwitchOrcaProfileResult> => {
+    async (event, args: SwitchOrcaProfileArgs): Promise<SwitchOrcaProfileResult> => {
       const profileId = profileIdFromArgs(args)
       const current = getOrcaProfileListState()
       if (profileId === current.activeProfileId) {
@@ -217,11 +203,12 @@ export function registerOrcaProfileHandlers(
       }
       // Why: the current profile must be persisted before the global index
       // points startup at the target profile.
-      await flushActiveProfileBeforeFileMutation(store)
-      await runBeforeProfileRelaunch(options.onBeforeRelaunch)
+      // Switching leaves source files intact; relaunch cleanup still needs its live writer.
+      await flushActiveProfileBeforeRelaunch(store)
       setActiveOrcaProfile(profileId)
+      await runBeforeProfileRelaunch(options.onBeforeRelaunch)
 
-      scheduleProfileRelaunch('profile-switch')
+      scheduleProfileRelaunch('profile-switch', event.sender)
 
       return { status: 'relaunching' }
     }
@@ -230,7 +217,7 @@ export function registerOrcaProfileHandlers(
   ipcMain.handle(
     'orcaProfiles:transferProject',
     async (
-      _event,
+      event,
       rawArgs: TransferOrcaProfileProjectArgs
     ): Promise<TransferOrcaProfileProjectResult> => {
       const args = transferProjectArgsFromUnknown(rawArgs)
@@ -241,19 +228,37 @@ export function registerOrcaProfileHandlers(
       if (args.mode === 'move' && args.sourceProfileId === current.activeProfileId) {
         // Why: transfer before any relaunch side effect so a duplicate-target
         // or validation failure cannot strand the app in a quitting state.
-        await flushActiveProfileBeforeFileMutation(store)
-        const result = transferOrcaProfileProject(args, getProfileUserDataPath())
+        const result = await transferActiveProfileProject(
+          args,
+          getProfileUserDataPath(),
+          store,
+          async () => {
+            await runBeforeProfileRelaunch(options.onBeforeRelaunch)
+            scheduleProfileRelaunch('profile-transfer', event.sender)
+          }
+        )
         if (result.status === 'transferred') {
-          store.freezeWrites()
           await runBeforeProfileRelaunch(options.onBeforeRelaunch)
-          setActiveOrcaProfile(args.targetProfileId)
-          scheduleProfileRelaunch('profile-transfer')
+          try {
+            setActiveOrcaProfile(args.targetProfileId)
+          } finally {
+            // The source has already changed and its writer cannot resume.
+            scheduleProfileRelaunch('profile-transfer', event.sender)
+          }
           return { ...result, willRelaunch: true }
         }
         return result
       }
-      await flushActiveProfileBeforeFileMutation(store)
-      return transferOrcaProfileProject(args, getProfileUserDataPath())
+      if (args.sourceProfileId !== current.activeProfileId) {
+        await store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
+        return transferOrcaProfileProject(args, getProfileUserDataPath())
+      }
+      const maintenance = await flushActiveProfileBeforeFileMutation(store)
+      try {
+        return transferOrcaProfileProject(args, getProfileUserDataPath())
+      } finally {
+        await maintenance.resume()
+      }
     }
   )
 
diff --git a/src/main/ipc/parcel-watcher-in-process-fallback.ts b/src/main/ipc/parcel-watcher-in-process-fallback.ts
index bcd2812d35d1..1807ba603a5c 100644
--- a/src/main/ipc/parcel-watcher-in-process-fallback.ts
+++ b/src/main/ipc/parcel-watcher-in-process-fallback.ts
@@ -1,4 +1,5 @@
 import type * as ParcelWatcher from '@parcel/watcher'
+import { loadParcelWatcher } from './parcel-watcher-module-loader'
 import { createWatcherProcessEventDeliveryQueue } from './parcel-watcher-event-delivery'
 import { WatcherProcessFailure } from './parcel-watcher-process-failure'
 import type {
@@ -64,7 +65,7 @@ export async function subscribeWithInProcessWatcher(
   try {
     // Why: setup ownership starts before module loading; an abort or timeout
     // during the import must settle the caller just like one during the crawl.
-    watcher = await Promise.race([import('@parcel/watcher'), cancellation])
+    watcher = await Promise.race([loadParcelWatcher(), cancellation])
   } catch (error) {
     clearPendingControls()
     throw error
diff --git a/src/main/ipc/parcel-watcher-module-loader.test.ts b/src/main/ipc/parcel-watcher-module-loader.test.ts
new file mode 100644
index 000000000000..98e5eada4313
--- /dev/null
+++ b/src/main/ipc/parcel-watcher-module-loader.test.ts
@@ -0,0 +1,42 @@
+import { beforeEach, expect, it, vi } from 'vitest'
+import { loadParcelWatcher } from './parcel-watcher-module-loader'
+
+const state = vi.hoisted((): { named: unknown; fallback: unknown } => ({
+  named: undefined,
+  fallback: undefined
+}))
+vi.mock('@parcel/watcher', () => ({
+  get subscribe() {
+    return state.named
+  },
+  get default() {
+    return state.fallback
+  }
+}))
+beforeEach(() => {
+  state.named = undefined
+  state.fallback = undefined
+})
+
+it('uses named exports when the runtime exposes them', async () => {
+  const subscribe = vi.fn()
+  state.named = subscribe
+  state.fallback = { subscribe: vi.fn() }
+  expect((await loadParcelWatcher()).subscribe).toBe(subscribe)
+})
+
+it('loads the full CommonJS default when a packaged wrapper has no named exports', async () => {
+  const subscribe = vi.fn()
+  const getEventsSince = vi.fn()
+  state.fallback = { subscribe, getEventsSince }
+  expect(await loadParcelWatcher()).toBe(state.fallback)
+  expect((await loadParcelWatcher()).getEventsSince).toBe(getEventsSince)
+})
+
+it.each([undefined, null, {}, { subscribe: false }])(
+  'rejects invalid watcher exports (%j)',
+  async (fallback) => {
+    state.fallback = fallback
+    await expect(loadParcelWatcher()).rejects.toThrow('parcel_watcher_module_invalid')
+  }
+)
diff --git a/src/main/ipc/parcel-watcher-module-loader.ts b/src/main/ipc/parcel-watcher-module-loader.ts
new file mode 100644
index 000000000000..28a501363b59
--- /dev/null
+++ b/src/main/ipc/parcel-watcher-module-loader.ts
@@ -0,0 +1,11 @@
+import type * as ParcelWatcher from '@parcel/watcher'
+
+/** Native loading stays in the watcher child, across named and CommonJS exports. */
+export async function loadParcelWatcher(): Promise<typeof ParcelWatcher> {
+  const loaded = await import('@parcel/watcher')
+  const watcher = typeof loaded.subscribe === 'function' ? loaded : loaded.default
+  if (!watcher || typeof watcher.subscribe !== 'function') {
+    throw new Error('parcel_watcher_module_invalid')
+  }
+  return watcher
+}
diff --git a/src/main/ipc/parcel-watcher-process-entry.ts b/src/main/ipc/parcel-watcher-process-entry.ts
index ad0e79d6b97e..0de05010f476 100644
--- a/src/main/ipc/parcel-watcher-process-entry.ts
+++ b/src/main/ipc/parcel-watcher-process-entry.ts
@@ -8,6 +8,7 @@ import { mkdtempSync, rmSync, writeFileSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import type * as ParcelWatcher from '@parcel/watcher'
+import { loadParcelWatcher } from './parcel-watcher-module-loader'
 import { startShallowWatcher } from './parcel-watcher-shallow-subscription'
 import { detectShallowWatchDelivery } from './shallow-watch-delivery-probe'
 import {
@@ -46,7 +47,7 @@ async function startCanary(getStableActivityRevision: () => number | null): Prom
   let lastEventAt = 0
   try {
     canaryDir = configuredCanaryDir ?? mkdtempSync(join(tmpdir(), 'orca-watcher-canary-'))
-    const watcher = await import('@parcel/watcher')
+    const watcher = await loadParcelWatcher()
     // Why: pin the Windows backend like the main subscriptions do, so the
     // canary never probes for Watchman.
     const opts = (
@@ -211,7 +212,7 @@ function main(): void {
               send({ op: 'watch-error', id, message: errorMessage(error) })
             )
           }
-          const watcher = await import('@parcel/watcher')
+          const watcher = await loadParcelWatcher()
           return await watcher.subscribe(
             dir,
             (err, events) => {
diff --git a/src/main/ipc/pty-daemon-ssh-lease-lifecycle.test.ts b/src/main/ipc/pty-daemon-ssh-lease-lifecycle.test.ts
index 128f163c5b34..5ae2adb49d72 100644
--- a/src/main/ipc/pty-daemon-ssh-lease-lifecycle.test.ts
+++ b/src/main/ipc/pty-daemon-ssh-lease-lifecycle.test.ts
@@ -1,6 +1,7 @@
 import { describe, expect, it, vi } from 'vitest'
 import { openCodeClearPtyMock, piClearPtyMock } from './pty-ipc-mock-registry'
 import { setupPtyIpcSuite } from './pty-ipc-test-harness'
+import { TerminalIntentionalStops } from '../runtime/terminal-intentional-stops'
 import {
   SSH_PTY_IDENTITY_MISMATCH_ERROR,
   SSH_SESSION_EXPIRED_ERROR
@@ -359,7 +360,8 @@ describe('registerPtyHandlers', () => {
         const exitListeners = new Set<(payload: { id: string; code: number }) => void>()
         const runtime = {
           setPtyController: vi.fn(),
-          onPtyExit: vi.fn()
+          onPtyExit: vi.fn(),
+          intentionalPtyStops: new TerminalIntentionalStops()
         }
         setLocalPtyProvider({
           spawn: vi.fn(),
@@ -393,15 +395,14 @@ describe('registerPtyHandlers', () => {
         handlers.clear()
         registerPtyHandlers(mainWindow as never, runtime as never)
         const controller = runtime.setPtyController.mock.calls[0]?.[0] as {
-          markReversibleStops: (ptyIds: readonly string[]) => () => void
           stopAndWait: (ptyId: string) => Promise<boolean>
         }
-        const release = controller.markReversibleStops(['local-pty'])
+        const settleStop = runtime.intentionalPtyStops.mark('local-pty', 'reversible', null)
 
         const stopPromise = controller.stopAndWait('local-pty')
         await vi.advanceTimersByTimeAsync(1_200)
         await expect(stopPromise).resolves.toBe(true)
-        release()
+        settleStop(true)
 
         expect(
           mainWindow.webContents.send.mock.calls.filter((call) => call[0] === 'pty:exit')
diff --git a/src/main/ipc/pty-dead-owner-respawn.test.ts b/src/main/ipc/pty-dead-owner-respawn.test.ts
index 4669d7e55287..7a72c0d53b49 100644
--- a/src/main/ipc/pty-dead-owner-respawn.test.ts
+++ b/src/main/ipc/pty-dead-owner-respawn.test.ts
@@ -1,4 +1,5 @@
 import { describe, expect, it, vi } from 'vitest'
+import { withDurableRuntimeStore } from '../runtime/runtime-durable-store-fixture'
 import { setupPtyIpcSuite } from './pty-ipc-test-harness'
 import { SessionNotFoundError } from '../daemon/daemon-errors'
 import { makePaneKey } from '../../shared/stable-pane-id'
@@ -102,7 +103,7 @@ describe('registerPtyHandlers', () => {
       },
       terminalPtyIncarnationsByPaneKey: { [paneKey]: 'inc-proven-absent-owner' }
     }
-    const store = {
+    const store = withDurableRuntimeStore({
       getWorkspaceSession: vi.fn(() => session),
       setWorkspaceSession: vi.fn((next) => {
         session = next
@@ -113,7 +114,7 @@ describe('registerPtyHandlers', () => {
       getFolderWorkspaces: vi.fn(() => []),
       getProjectGroups: vi.fn(() => []),
       getRepos: vi.fn(() => [])
-    }
+    })
     const runtime = {
       setPtyController: vi.fn(),
       resolveTerminalPane: vi.fn(() => {
@@ -226,7 +227,7 @@ describe('registerPtyHandlers', () => {
       },
       terminalPtyIncarnationsByPaneKey: { [paneKey]: 'inc-probe-blip-owner' }
     }
-    const store = {
+    const store = withDurableRuntimeStore({
       getWorkspaceSession: vi.fn(() => session),
       setWorkspaceSession: vi.fn((next) => {
         session = next
@@ -237,7 +238,7 @@ describe('registerPtyHandlers', () => {
       getFolderWorkspaces: vi.fn(() => []),
       getProjectGroups: vi.fn(() => []),
       getRepos: vi.fn(() => [])
-    }
+    })
     const runtime = {
       setPtyController: vi.fn(),
       resolveTerminalPane: vi.fn(() => {
@@ -350,7 +351,7 @@ describe('registerPtyHandlers', () => {
       },
       terminalPtyIncarnationsByPaneKey: {}
     }
-    const store = {
+    const store = withDurableRuntimeStore({
       getWorkspaceSession: vi.fn(() => session),
       setWorkspaceSession: vi.fn((next) => {
         session = next
@@ -361,7 +362,7 @@ describe('registerPtyHandlers', () => {
       getFolderWorkspaces: vi.fn(() => []),
       getProjectGroups: vi.fn(() => []),
       getRepos: vi.fn(() => [])
-    }
+    })
     let runtimeOwnsPane = true
     const runtime = {
       setPtyController: vi.fn(),
diff --git a/src/main/ipc/pty-pane-reservation-settlement.test.ts b/src/main/ipc/pty-pane-reservation-settlement.test.ts
index b6aba0855e6d..30ef457a81d3 100644
--- a/src/main/ipc/pty-pane-reservation-settlement.test.ts
+++ b/src/main/ipc/pty-pane-reservation-settlement.test.ts
@@ -1,3 +1,4 @@
+import { withDurableRuntimeStore } from '../runtime/runtime-durable-store-fixture'
 import { describe, expect, it, vi } from 'vitest'
 import { spawnMock, registerPtyMock } from './pty-ipc-mock-registry'
 import { setupPtyIpcSuite } from './pty-ipc-test-harness'
@@ -112,7 +113,7 @@ describe('registerPtyHandlers', () => {
       },
       terminalPtyIncarnationsByPaneKey: { [paneKey]: 'inc-dead-ssh-owner' }
     }
-    const store = {
+    const store = withDurableRuntimeStore({
       getWorkspaceSession: vi.fn((requestedHostId?: string) => {
         expect(requestedHostId).toBe(hostId)
         return session
@@ -128,7 +129,7 @@ describe('registerPtyHandlers', () => {
       removeSshRemotePtyLease: vi.fn(),
       markSshRemotePtyLease: vi.fn(),
       clearSshRemotePtyKillIntent: vi.fn()
-    }
+    })
     const runtime = {
       setPtyController: vi.fn(),
       resolveTerminalPane: vi.fn(() => {
diff --git a/src/main/ipc/pty-pane-restart-replace.test.ts b/src/main/ipc/pty-pane-restart-replace.test.ts
index e8e91ea7d453..50558a0f8708 100644
--- a/src/main/ipc/pty-pane-restart-replace.test.ts
+++ b/src/main/ipc/pty-pane-restart-replace.test.ts
@@ -3,6 +3,7 @@ import { setupPtyIpcSuite, type PtyIpcSuiteFixtures } from './pty-ipc-test-harne
 import { SessionNotFoundError } from '../daemon/daemon-errors'
 import { makePaneKey } from '../../shared/stable-pane-id'
 import { registerPtyHandlers, setLocalPtyProvider } from './pty'
+import { TerminalIntentionalStops } from '../runtime/terminal-intentional-stops'
 
 vi.mock('electron', () => import('./pty-ipc-mock-registry').then((m) => m.electronModuleMock()))
 vi.mock('fs', () => import('./pty-ipc-mock-registry').then((m) => m.fsModuleMock()))
@@ -137,6 +138,7 @@ function installRestartHarness(
       session = next
     }),
     flushOrThrow: vi.fn(),
+    runDurableMutation: vi.fn(async <T>(mutate: () => { value: T }) => mutate().value),
     persistPtyBinding: vi.fn(),
     getFolderWorkspace: vi.fn(() => undefined),
     getFolderWorkspaces: vi.fn(() => []),
@@ -160,7 +162,8 @@ function installRestartHarness(
     seedHeadlessTerminal: vi.fn(),
     onPtySpawned: vi.fn(),
     onPtyExit: vi.fn(),
-    onPtyData: vi.fn()
+    onPtyData: vi.fn(),
+    intentionalPtyStops: new TerminalIntentionalStops()
   }
   return { providerSpawn, shutdown, store, runtime, control }
 }
diff --git a/src/main/ipc/pty-persisted-incarnation-repair.test.ts b/src/main/ipc/pty-persisted-incarnation-repair.test.ts
index 743963d01897..c057d6ec5d21 100644
--- a/src/main/ipc/pty-persisted-incarnation-repair.test.ts
+++ b/src/main/ipc/pty-persisted-incarnation-repair.test.ts
@@ -1,3 +1,4 @@
+import { withDurableRuntimeStore } from '../runtime/runtime-durable-store-fixture'
 import { describe, expect, it, vi } from 'vitest'
 import { statSyncMock } from './pty-ipc-mock-registry'
 import { setupPtyIpcSuite } from './pty-ipc-test-harness'
@@ -272,7 +273,7 @@ describe('registerPtyHandlers', () => {
         },
         terminalPtyIncarnationsByPaneKey: { [paneKey]: 'inc-dead-persisted-owner' }
       }
-      const store = {
+      const store = withDurableRuntimeStore({
         getWorkspaceSession: vi.fn(() => session),
         setWorkspaceSession: vi.fn((next) => {
           session = next
@@ -293,7 +294,7 @@ describe('registerPtyHandlers', () => {
         ]),
         getProjectGroups: vi.fn(() => []),
         getRepos: vi.fn(() => [])
-      }
+      })
       const runtime = {
         setPtyController: vi.fn(),
         resolveTerminalPane: vi.fn(() => {
@@ -434,7 +435,7 @@ describe('registerPtyHandlers', () => {
       },
       terminalPtyIncarnationsByPaneKey: { [paneKey]: 'inc-unproven-owner' }
     }
-    const store = {
+    const store = withDurableRuntimeStore({
       getWorkspaceSession: vi.fn(() => session),
       setWorkspaceSession: vi.fn((next) => {
         session = next
@@ -445,7 +446,7 @@ describe('registerPtyHandlers', () => {
       getFolderWorkspaces: vi.fn(() => []),
       getProjectGroups: vi.fn(() => []),
       getRepos: vi.fn(() => [])
-    }
+    })
     const runtime = {
       setPtyController: vi.fn(),
       resolveTerminalPane: vi.fn(() => {
diff --git a/src/main/ipc/pty-serializer-settlement-mapping.test.ts b/src/main/ipc/pty-serializer-settlement-mapping.test.ts
index 47082d6e745c..70e358a80140 100644
--- a/src/main/ipc/pty-serializer-settlement-mapping.test.ts
+++ b/src/main/ipc/pty-serializer-settlement-mapping.test.ts
@@ -3,6 +3,7 @@ import { spawnMock, openCodeClearPtyMock, piClearPtyMock } from './pty-ipc-mock-
 import { setupPtyIpcSuite } from './pty-ipc-test-harness'
 import { makePaneKey } from '../../shared/stable-pane-id'
 import { OrcaRuntimeService } from '../runtime/orca-runtime'
+import type * as WslManagedCliModule from '../cli/wsl-managed-cli'
 import {
   SSH_PTY_IDENTITY_MISMATCH_ERROR,
   SSH_SESSION_EXPIRED_ERROR
@@ -46,6 +47,13 @@ vi.mock('../telemetry/client', () =>
 vi.mock('../telemetry/classify-error', () =>
   import('./pty-ipc-mock-registry').then((m) => m.classifyErrorModuleMock())
 )
+const managedWslCliDir = vi.hoisted(() =>
+  vi.fn((): string | null => 'C:\\orca-user-data\\wsl-managed-cli\\hash')
+)
+vi.mock('../cli/wsl-managed-cli', async (importOriginal) => ({
+  ...(await importOriginal<typeof WslManagedCliModule>()),
+  getManagedWslCliDir: managedWslCliDir
+}))
 vi.mock('../cli/linux-terminal-orca-cli-shim', () =>
   import('./pty-ipc-mock-registry').then((m) => m.linuxCliShimModuleMock())
 )
@@ -248,7 +256,10 @@ describe('registerPtyHandlers', () => {
         })
       ).rejects.toThrow(/ORCA_TERMINAL_SESSION_STATE_SAVE_FAILED/)
 
-      expect(remoteShutdown).toHaveBeenCalledWith(appPtyId, { immediate: true })
+      expect(remoteShutdown).toHaveBeenCalledWith(appPtyId, {
+        immediate: true,
+        expectedIncarnationId: incarnationId
+      })
       expect(store.upsertSshRemotePtyLease).not.toHaveBeenCalled()
       expect(store.removeSshRemotePtyLease).not.toHaveBeenCalled()
       expect(openCodeClearPtyMock).toHaveBeenCalledWith(appPtyId)
@@ -455,12 +466,13 @@ describe('registerPtyHandlers', () => {
     await handlers.get('pty:spawn')!(null, {
       cols: 80,
       rows: 24,
-      env: { ORCA_TERMINAL_HANDLE: 'term_untrusted' }
+      env: { ORCA_TERMINAL_HANDLE: 'term_untrusted', ORCA_WSL_CLI_DIR: 'C:\\stale' }
     })
 
     const spawnCall = spawnMock.mock.calls.at(-1)!
     const env = spawnCall[2].env as Record<string, string>
     expect(env.ORCA_TERMINAL_HANDLE).toBe('term_trusted')
+    expect(env.ORCA_WSL_CLI_DIR).toBeUndefined()
     expect(runtime.preAllocateHandleForPty).toHaveBeenCalledWith(expect.any(String))
   })
   it('forwards the trusted Orca terminal handle into managed WSL terminals', async () => {
@@ -497,11 +509,13 @@ describe('registerPtyHandlers', () => {
     expect(env.ORCA_TERMINAL_HANDLE).toBe('term_wsl')
     expect(env.ORCA_USER_DATA_PATH).toBe('/tmp/orca-user-data')
     expect(env.ORCA_CLI_COMMAND).toBe('orca-ide')
+    expect(env.ORCA_WSL_CLI_DIR).toBe('C:\\orca-user-data\\wsl-managed-cli\\hash')
     expect(env.WSLENV?.split(':')).toEqual(
       expect.arrayContaining([
         'ORCA_TERMINAL_HANDLE/u',
         'ORCA_USER_DATA_PATH/p',
         'ORCA_CLI_COMMAND/u',
+        'ORCA_WSL_CLI_DIR/p',
         'ORCA_AGENT_HOOK_PORT/u',
         'ORCA_AGENT_HOOK_TOKEN/u',
         // Why: bare WSL shells no longer create ~/.omp; only status extension is exported (#10196).
@@ -513,7 +527,8 @@ describe('registerPtyHandlers', () => {
       expect.arrayContaining(['ORCA_OMP_SOURCE_AGENT_DIR/p'])
     )
   })
-  it('forces managed ORCA_USER_DATA_PATH for WSL spawns even when the caller provides a stale root', async () => {
+  it('forces managed WSL env over stale caller values, even when CLI setup fails', async () => {
+    managedWslCliDir.mockReturnValueOnce(null)
     const platform = Object.getOwnPropertyDescriptor(process, 'platform')
     Object.defineProperty(process, 'platform', {
       configurable: true,
@@ -534,7 +549,8 @@ describe('registerPtyHandlers', () => {
         rows: 24,
         shellOverride: 'wsl.exe',
         env: {
-          ORCA_USER_DATA_PATH: '/tmp/stale-orca-user-data'
+          ORCA_USER_DATA_PATH: '/tmp/stale-orca-user-data',
+          ORCA_WSL_CLI_DIR: '/tmp/stale-wsl-cli'
         }
       })
     } finally {
@@ -547,5 +563,6 @@ describe('registerPtyHandlers', () => {
     const env = spawnCall[2].env as Record<string, string>
     expect(spawnCall[0]).toBe('wsl.exe')
     expect(env.ORCA_USER_DATA_PATH).toBe('/tmp/orca-user-data')
+    expect(env.ORCA_WSL_CLI_DIR).toBeUndefined()
   })
 })
diff --git a/src/main/ipc/pty-ssh-undelivered-kill.test.ts b/src/main/ipc/pty-ssh-undelivered-kill.test.ts
index d59d7d8543a1..32f4da8356f3 100644
--- a/src/main/ipc/pty-ssh-undelivered-kill.test.ts
+++ b/src/main/ipc/pty-ssh-undelivered-kill.test.ts
@@ -1,5 +1,6 @@
 import { describe, expect, it, vi } from 'vitest'
 import { setupPtyIpcSuite } from './pty-ipc-test-harness'
+import { TerminalIntentionalStops } from '../runtime/terminal-intentional-stops'
 import { SSH_SESSION_EXPIRED_ERROR } from '../providers/ssh-pty-errors'
 import {
   registerPtyHandlers,
@@ -79,7 +80,8 @@ function installController(handlers: Map<string, never>) {
     setPtyController: vi.fn(),
     markPtyStopRequested: vi.fn(),
     markPtyLivenessUnverifiable: vi.fn(),
-    onPtyExit: vi.fn()
+    onPtyExit: vi.fn(),
+    intentionalPtyStops: new TerminalIntentionalStops()
   }
   handlers.clear()
   return { runtime }
@@ -91,7 +93,7 @@ describe('undelivered SSH stops', () => {
   function install(store: ReturnType<typeof createKillStore>): {
     kill: (ptyId: string) => boolean
     stopAndWait: (ptyId: string, opts?: { keepHistory?: boolean }) => Promise<boolean>
-    markReversibleStops: (ptyIds: readonly string[]) => () => void
+    recordUnconfirmedStop: (ptyId: string) => boolean
     runtime: ReturnType<typeof installController>['runtime']
   } {
     const { runtime } = installController(handlers as never)
@@ -103,15 +105,16 @@ describe('undelivered SSH stops', () => {
       undefined,
       store as never
     )
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: registerPtyHandlers installs the runtime PTY controller, which implements these members.
     const controller = runtime.setPtyController.mock.calls[0]?.[0] as {
       kill: (ptyId: string) => boolean
       stopAndWait: (ptyId: string, opts?: { keepHistory?: boolean }) => Promise<boolean>
-      markReversibleStops: (ptyIds: readonly string[]) => () => void
+      recordUnconfirmedStop: (ptyId: string) => boolean
     }
     return {
       kill: controller.kill,
       stopAndWait: controller.stopAndWait,
-      markReversibleStops: controller.markReversibleStops,
+      recordUnconfirmedStop: controller.recordUnconfirmedStop,
       runtime
     }
   }
@@ -298,15 +301,41 @@ describe('undelivered SSH stops', () => {
     )
     setPtyOwnership(SCOPED_PTY_ID, 'ssh-1')
     restorePtyIncarnation(SCOPED_PTY_ID, 'inc-f')
-    const { kill, markReversibleStops } = install(store)
-    const release = markReversibleStops([SCOPED_PTY_ID])
+    const { kill, runtime } = install(store)
+    const settleStop = runtime.intentionalPtyStops.mark(SCOPED_PTY_ID, 'reversible', null)
+
+    try {
+      kill(SCOPED_PTY_ID)
+      await new Promise((resolve) => setTimeout(resolve, 0))
+      expect(store.recordSshRemotePtyKillIntent).not.toHaveBeenCalled()
+    } finally {
+      settleStop(false)
+      unregisterSshPtyProvider('ssh-1')
+      deletePtyOwnership(SCOPED_PTY_ID)
+    }
+  })
+
+  it('records nothing while a reversible stop owns the PTY and a restart stop joins it', async () => {
+    const store = createKillStore()
+    registerSshPtyProvider(
+      'ssh-1',
+      sshProviderStub(async () => {
+        throw new Error('socket closed')
+      })
+    )
+    setPtyOwnership(SCOPED_PTY_ID, 'ssh-1')
+    restorePtyIncarnation(SCOPED_PTY_ID, 'inc-f')
+    const { kill, runtime } = install(store)
+    const settleSleep = runtime.intentionalPtyStops.mark(SCOPED_PTY_ID, 'reversible', null)
+    const settleRestart = runtime.intentionalPtyStops.mark(SCOPED_PTY_ID, 'replaced', null)
 
     try {
       kill(SCOPED_PTY_ID)
       await new Promise((resolve) => setTimeout(resolve, 0))
       expect(store.recordSshRemotePtyKillIntent).not.toHaveBeenCalled()
     } finally {
-      release()
+      settleRestart(false)
+      settleSleep(false)
       unregisterSshPtyProvider('ssh-1')
       deletePtyOwnership(SCOPED_PTY_ID)
     }
@@ -348,4 +377,44 @@ describe('undelivered SSH stops', () => {
       deletePtyOwnership('ssh:ssh-1@@pty-8')
     }
   })
+
+  // An explicit close records its order when the stop goes unconfirmed, before the follow-up kill,
+  // so its receipt can promise the reconnect retry from the record itself.
+  it("records an explicit close's unconfirmed stop and says so", () => {
+    const store = createKillStore()
+    setPtyOwnership(SCOPED_PTY_ID, 'ssh-1')
+    restorePtyIncarnation(SCOPED_PTY_ID, 'inc-g')
+    const { recordUnconfirmedStop } = install(store)
+
+    try {
+      expect(recordUnconfirmedStop(SCOPED_PTY_ID)).toBe(true)
+      expect(store.recordSshRemotePtyKillIntent).toHaveBeenCalledWith(
+        'ssh-1',
+        'pty-7',
+        expect.objectContaining({ incarnationId: 'inc-g', attempts: 0 })
+      )
+    } finally {
+      deletePtyOwnership(SCOPED_PTY_ID)
+    }
+  })
+
+  it('reports no recorded order for a local or reversibly stopped PTY', () => {
+    const store = createKillStore()
+    setPtyOwnership('local-pty', null)
+    restorePtyIncarnation('local-pty', 'inc-h')
+    setPtyOwnership(SCOPED_PTY_ID, 'ssh-1')
+    restorePtyIncarnation(SCOPED_PTY_ID, 'inc-i')
+    const { recordUnconfirmedStop, runtime } = install(store)
+    const settleStop = runtime.intentionalPtyStops.mark(SCOPED_PTY_ID, 'reversible', null)
+
+    try {
+      expect(recordUnconfirmedStop('local-pty')).toBe(false)
+      expect(recordUnconfirmedStop(SCOPED_PTY_ID)).toBe(false)
+      expect(store.recordSshRemotePtyKillIntent).not.toHaveBeenCalled()
+    } finally {
+      settleStop(false)
+      deletePtyOwnership('local-pty')
+      deletePtyOwnership(SCOPED_PTY_ID)
+    }
+  })
 })
diff --git a/src/main/ipc/pty/delivery/accept.ts b/src/main/ipc/pty/delivery/accept.ts
index 0582bed33532..979a50d3008e 100644
--- a/src/main/ipc/pty/delivery/accept.ts
+++ b/src/main/ipc/pty/delivery/accept.ts
@@ -36,7 +36,7 @@ export function acceptPtyDataForRenderer(
   const preservesSeq = !payload.transformed && rawLength === payload.data.length
   const startSeq = typeof outputSeq === 'number' ? Math.max(0, outputSeq - rawLength) : undefined
   const projectionId = projection?.identity.projectionSemanticsId
-  if (session.mainWindow.isDestroyed()) {
+  if (!session.mainWindow || session.mainWindow.isDestroyed()) {
     if (projectionId) {
       session.sshOutputIntake?.transferProjections([projectionId], 'renderer-destroyed')
     }
diff --git a/src/main/ipc/pty/delivery/accounting.ts b/src/main/ipc/pty/delivery/accounting.ts
index eddc49be3f25..16fc3520f865 100644
--- a/src/main/ipc/pty/delivery/accounting.ts
+++ b/src/main/ipc/pty/delivery/accounting.ts
@@ -132,7 +132,11 @@ export function clearDeliveryResyncProbe(session: PtyIpcSession): void {
 }
 
 export function requestDeliveryResyncForGatedPty(session: PtyIpcSession): void {
-  if (session.deliveryResyncOutstandingRequestId !== null || session.mainWindow.isDestroyed()) {
+  if (
+    session.deliveryResyncOutstandingRequestId !== null ||
+    !session.mainWindow ||
+    session.mainWindow.isDestroyed()
+  ) {
     return
   }
   session.deliveryResyncRequestSerial += 1
diff --git a/src/main/ipc/pty/delivery/debug-snapshot.ts b/src/main/ipc/pty/delivery/debug-snapshot.ts
index facc04e4e748..3388ef153f7b 100644
--- a/src/main/ipc/pty/delivery/debug-snapshot.ts
+++ b/src/main/ipc/pty/delivery/debug-snapshot.ts
@@ -46,13 +46,14 @@ export function buildMainDeliveryDiagnostics(session: PtyIpcSession): PtyMainDel
     })
   }
   perPty.sort((a, b) => b.inFlightChars + b.pendingChars - (a.inFlightChars + a.pendingChars))
-  const windowAlive = !session.mainWindow.isDestroyed()
+  const { mainWindow } = session
+  const windowAlive = mainWindow && !mainWindow.isDestroyed()
   return {
     appVersion: getAppEnvironment().getVersion(),
     mainUptimeMs: Math.round(process.uptime() * 1000),
-    windowFocused: windowAlive ? session.mainWindow.isFocused() : null,
-    windowVisible: windowAlive ? session.mainWindow.isVisible() : null,
-    windowMinimized: windowAlive ? session.mainWindow.isMinimized() : null,
+    windowFocused: windowAlive ? mainWindow.isFocused() : null,
+    windowVisible: windowAlive ? mainWindow.isVisible() : null,
+    windowMinimized: windowAlive ? mainWindow.isMinimized() : null,
     msSinceLastPowerSuspend: lastPowerSuspendAtMs === null ? null : now - lastPowerSuspendAtMs,
     msSinceLastPowerResume: lastPowerResumeAtMs === null ? null : now - lastPowerResumeAtMs,
     perPty: perPty.slice(0, DELIVERY_DIAGNOSTICS_MAX_PTYS),
diff --git a/src/main/ipc/pty/delivery/exit.ts b/src/main/ipc/pty/delivery/exit.ts
index 9aba356b3c38..ad144b4d5879 100644
--- a/src/main/ipc/pty/delivery/exit.ts
+++ b/src/main/ipc/pty/delivery/exit.ts
@@ -7,57 +7,8 @@ import { allocatePtyLifecycleSequence } from '../host-env/types'
 import { makePtyDataPayload, sendPtyDataToRenderer } from './payload'
 import { getRendererInFlightCharsForPty } from './accounting'
 import { clearFlushTimerIfIdle } from './flush'
-import { ptyIncarnationById } from '../provider/ownership-state'
 import type { PtyIpcSession } from '../session'
 
-export type ReplacedPtyStop = {
-  incarnationId: string | undefined
-  expiryTimer?: NodeJS.Timeout
-}
-
-/** Labels the exit of a PTY that main stops so a new process can take its pane. Settle with
- *  whether the stop succeeded; a failed stop leaves no label behind. */
-export function markReplacedPtyStop(
-  session: PtyIpcSession,
-  id: string
-): (stopped: boolean) => void {
-  clearTimeout(session.replacedPtyStopsById.get(id)?.expiryTimer)
-  const mark: ReplacedPtyStop = { incarnationId: ptyIncarnationById.get(id) }
-  session.replacedPtyStopsById.set(id, mark)
-  return (stopped) => {
-    if (session.replacedPtyStopsById.get(id) !== mark) {
-      return
-    }
-    if (!stopped) {
-      session.replacedPtyStopsById.delete(id)
-      return
-    }
-    // Why a window: an SSH exit can reach the renderer after the stop settles; bound it like a synthetic kill.
-    mark.expiryTimer = setTimeout(() => {
-      if (session.replacedPtyStopsById.get(id) === mark) {
-        session.replacedPtyStopsById.delete(id)
-      }
-    }, SYNTHETIC_KILL_EXIT_DUPLICATE_WINDOW_MS)
-    mark.expiryTimer.unref?.()
-  }
-}
-
-function consumeReplacedPtyStop(
-  session: PtyIpcSession,
-  payload: { id: string; incarnationId?: string }
-): boolean {
-  const mark = session.replacedPtyStopsById.get(payload.id)
-  if (
-    !mark ||
-    (mark.incarnationId && payload.incarnationId && mark.incarnationId !== payload.incarnationId)
-  ) {
-    return false
-  }
-  clearTimeout(mark.expiryTimer)
-  session.replacedPtyStopsById.delete(payload.id)
-  return true
-}
-
 export function rememberSyntheticKillExit(
   session: PtyIpcSession,
   id: string,
@@ -105,7 +56,7 @@ export function preparePtyExitForRenderer(
   session: PtyIpcSession,
   payload: { id: string; code: number; incarnationId?: string }
 ): (() => void) | null {
-  if (session.mainWindow.isDestroyed()) {
+  if (!session.mainWindow || session.mainWindow.isDestroyed()) {
     session.sshOutputIntake?.transferPtyProjections(payload.id, 'renderer-destroyed')
     return () => {}
   }
@@ -171,7 +122,7 @@ export function finalizePtyExitForRenderer(
   session: PtyIpcSession,
   payload: { id: string; code: number; incarnationId?: string }
 ): void {
-  if (session.mainWindow.isDestroyed()) {
+  if (!session.mainWindow || session.mainWindow.isDestroyed()) {
     session.rendererCreditBeforeExitByPty.delete(payload.id)
     return
   }
@@ -202,12 +153,12 @@ export function finalizePtyExitForRenderer(
       session.schedulePendingDataAfterCreditReport(true)
     }
   }
+  const intentionalStops =
+    session.runtime?.intentionalPtyStops?.claimExit(payload.id, payload.incarnationId) ?? []
   session.mainWindow.webContents.send('pty:exit', {
     ...payload,
-    ...(session.reversibleStopOwnersByPtyId.has(payload.id)
-      ? { preserveRendererBinding: true }
-      : {}),
-    ...(consumeReplacedPtyStop(session, payload) ? { replacedByRestart: true } : {})
+    ...(intentionalStops.includes('reversible') ? { preserveRendererBinding: true } : {}),
+    ...(intentionalStops.includes('replaced') ? { replacedByRestart: true } : {})
   })
 }
 
@@ -229,7 +180,7 @@ export function sendPtyExitToRenderer(
 }
 
 export function sendPtySpawnedToRenderer(session: PtyIpcSession, id: string): void {
-  if (!session.mainWindow.isDestroyed()) {
+  if (session.mainWindow && !session.mainWindow.isDestroyed()) {
     session.mainWindow.webContents.send('pty:spawned', { id })
   }
 }
diff --git a/src/main/ipc/pty/delivery/flush.ts b/src/main/ipc/pty/delivery/flush.ts
index 038d955a9327..ffe3c3014e8d 100644
--- a/src/main/ipc/pty/delivery/flush.ts
+++ b/src/main/ipc/pty/delivery/flush.ts
@@ -50,13 +50,17 @@ export function clearDispatcherReadyWatchdog(session: PtyIpcSession): void {
 
 export function armDispatcherReadyWatchdog(session: PtyIpcSession): void {
   clearDispatcherReadyWatchdog(session)
-  if (session.mainWindow.isDestroyed()) {
+  if (!session.mainWindow || session.mainWindow.isDestroyed()) {
     return
   }
   // Why: one-shot self-heal — force the gate open if the reloaded page never signals ready, so a dropped handshake can't hold it forever. Unref'd so it can't keep the process alive.
   session.dispatcherReadyWatchdogTimer = setTimeout(() => {
     session.dispatcherReadyWatchdogTimer = null
-    if (session.rendererPtyDispatcherReady || session.mainWindow.isDestroyed()) {
+    if (
+      session.rendererPtyDispatcherReady ||
+      !session.mainWindow ||
+      session.mainWindow.isDestroyed()
+    ) {
       return
     }
     session.rendererPtyDispatcherReady = true
@@ -77,7 +81,7 @@ export function clearFlushTimerIfIdle(session: PtyIpcSession): void {
 
 export function flushPendingData(session: PtyIpcSession): void {
   session.flushTimer = null
-  if (session.mainWindow.isDestroyed()) {
+  if (!session.mainWindow || session.mainWindow.isDestroyed()) {
     // Why release now: bookkeeping is being wiped, so no future drain can resume these producers — local shells would wedge.
     session.producerFlowControl.releaseAll()
     session.clearDeliveryResyncProbe()
diff --git a/src/main/ipc/pty/delivery/lifecycle-reset.ts b/src/main/ipc/pty/delivery/lifecycle-reset.ts
index 961c09188a14..475ddcadc0e8 100644
--- a/src/main/ipc/pty/delivery/lifecycle-reset.ts
+++ b/src/main/ipc/pty/delivery/lifecycle-reset.ts
@@ -1,4 +1,4 @@
-import type { WebContents } from 'electron'
+import type { PtyRendererDelivery } from '../session'
 import {
   didFinishLoadHandler,
   didFinishLoadWebContents,
@@ -60,9 +60,14 @@ export function clearRendererLifecycleResetHandlers(): void {
   setRendererLifecycleResetState({ contents: null, handler: null, navigation: null })
 }
 
-export function registerRendererLifecycleResetHandlers(webContents: WebContents): void {
+export function registerRendererLifecycleResetHandlers(
+  webContents?: PtyRendererDelivery['webContents']
+): void {
   clearRendererLifecycleResetHandlers()
   markRendererPtysHiddenForRendererLifecycleReset()
+  if (!webContents) {
+    return
+  }
   const handler = markRendererPtysHiddenForRendererLifecycleReset
   const navigationHandler = (details: { isMainFrame: boolean; isSameDocument: boolean }) => {
     if (!details.isMainFrame || details.isSameDocument) {
diff --git a/src/main/ipc/pty/delivery/payload.ts b/src/main/ipc/pty/delivery/payload.ts
index 119bb173ed7d..8be6dfd11ddf 100644
--- a/src/main/ipc/pty/delivery/payload.ts
+++ b/src/main/ipc/pty/delivery/payload.ts
@@ -38,7 +38,7 @@ export function sendModelRestoreNeededMarker(
   reason: PtyModelRestoreReason,
   markerSeq: number | undefined
 ): boolean {
-  if (session.mainWindow.isDestroyed()) {
+  if (!session.mainWindow || session.mainWindow.isDestroyed()) {
     return false
   }
   try {
@@ -61,6 +61,12 @@ export function sendPtyDataToRenderer(
   payload: PtyDataPayload,
   projectionAdmissionIds?: readonly string[]
 ): { sent: boolean; projectionsTransferred: boolean } {
+  if (!session.mainWindow) {
+    if (projectionAdmissionIds) {
+      session.sshOutputIntake?.transferProjections(projectionAdmissionIds, 'renderer-destroyed')
+    }
+    return { sent: false, projectionsTransferred: projectionAdmissionIds !== undefined }
+  }
   const charCount = getPtyPayloadCharCount(payload)
   const accounting = session.rendererDeliveryAccountingByPty.get(id)
   const hadAccounting = accounting !== undefined
diff --git a/src/main/ipc/pty/host-env/assembly.ts b/src/main/ipc/pty/host-env/assembly.ts
index dedd44e70e31..b6690b1cb83e 100644
--- a/src/main/ipc/pty/host-env/assembly.ts
+++ b/src/main/ipc/pty/host-env/assembly.ts
@@ -1,5 +1,5 @@
 import { resolveSetupAgentSequenceLaunchCommand } from '../../../../shared/setup-agent-sequencing'
-import { isOpenCode2LaunchCommand } from '../../../../shared/opencode-launch-command'
+import { selectOpenCodeHookAgent } from '../../../../shared/opencode-launch-command'
 import {
   detectExplicitPiAgentKindFromCommand,
   isPiCompatibleAgentType
@@ -11,6 +11,7 @@ import { agentHookServer } from '../../../agent-hooks/server'
 import { wslHookRelayManager } from '../../../agent-hooks/wsl-hook-relay-manager'
 import { piTitlebarExtensionService } from '../../../pi/titlebar-extension-service'
 import { prependOrcaCliDirToChildPath } from '../../../cli/orca-cli-child-path'
+import { getManagedWslCliDir, getWslCliCommandName } from '../../../cli/wsl-managed-cli'
 import { stripLegacyTerminalShimEnv } from '../../../pty/legacy-terminal-shim-dir'
 import { mergePersistedWindowsPath } from '../../../pty/windows-environment-path'
 import { resolveCodexShellLaunchPreflightCommand } from '../../../pty/codex-shell-launch-preflight'
@@ -47,12 +48,11 @@ export function buildPtyHostEnv(
   // Why: local path's baseEnv includes process.env but the daemon path doesn't (fork inheritance, not IPC); check both sources so guards stay in lock-step across spawn paths.
   const preexistingOpenCodeConfigDir = resolveOpenCodeSourceConfigDir(baseEnv)
   const launchCommandHint = resolveSetupAgentSequenceLaunchCommand(baseEnv, opts.launchCommand)
-  // Typed launches do not carry the picker identity; infer the beta binary so
-  // it receives the OpenCode 2 hook endpoint and isolated plugin overlay.
-  const openCodeAgent =
-    opts.launchAgent === 'opencode2' || isOpenCode2LaunchCommand(launchCommandHint)
-      ? 'opencode2'
-      : 'opencode'
+  const openCodeAgent = selectOpenCodeHookAgent(
+    opts.launchAgent,
+    launchCommandHint,
+    (agent) => opts.agentStatusHooksEnabled && isTuiAgentEnabled(agent, opts.disabledTuiAgents)
+  )
   const explicitPiAgentKind = isPiCompatibleAgentType(opts.launchAgent)
     ? opts.launchAgent
     : opts.launchAgent === undefined
@@ -87,12 +87,22 @@ export function buildPtyHostEnv(
       ? resolvePiAgentSourceDir(baseEnv, 'prime-agent')
       : resolveScopedPiAgentSourceDir(baseEnv, 'prime-agent')
 
-  if (opts.agentStatusHooksEnabled) {
+  restoreOrStripOverlayEnv(baseEnv, {
+    primary: 'OPENCODE_CONFIG_DIR',
+    overlay: 'ORCA_OPENCODE_CONFIG_DIR',
+    source: 'ORCA_OPENCODE_SOURCE_CONFIG_DIR',
+    preserveExplicitPrimary: true
+  })
+  delete baseEnv.ORCA_OPENCODE_AGENT
+  if (openCodeAgent) {
     // Why: OPENCODE_CONFIG_DIR is a single path, not a colon-list; mirror the user's value into an overlay so their plugins and Orca's status plugin coexist. See docs/opencode-config-dir-collision.md.
     const openCodeStatusService =
       openCodeAgent === 'opencode2' ? openCode2HookService : openCodeHookService
     baseEnv.ORCA_OPENCODE_AGENT = openCodeAgent
-    Object.assign(baseEnv, openCodeStatusService.buildPtyEnv(id, preexistingOpenCodeConfigDir))
+    // WSL owns its config writes; only the guest overlay may enter a WSL pane.
+    if (!opts.isWsl) {
+      Object.assign(baseEnv, openCodeStatusService.buildPtyEnv(id, preexistingOpenCodeConfigDir))
+    }
     if (baseEnv.OPENCODE_CONFIG_DIR) {
       // Why: ~/.zshrc can re-export the user's default after spawn; shell-ready wrappers restore this PTY-scoped value.
       baseEnv.ORCA_OPENCODE_CONFIG_DIR = baseEnv.OPENCODE_CONFIG_DIR
@@ -103,6 +113,8 @@ export function buildPtyHostEnv(
         delete baseEnv.ORCA_OPENCODE_SOURCE_CONFIG_DIR
       }
     }
+  }
+  if (opts.agentStatusHooksEnabled) {
     if (isMimoLaunchCommand(launchCommandHint)) {
       const preexistingMimocodeHome = resolveMimocodeSourceHome(baseEnv)
       Object.assign(baseEnv, mimoCodeHookService.buildPtyEnv(id, preexistingMimocodeHome))
@@ -116,11 +128,6 @@ export function buildPtyHostEnv(
       }
     }
   } else {
-    restoreOrStripOverlayEnv(baseEnv, {
-      primary: 'OPENCODE_CONFIG_DIR',
-      overlay: 'ORCA_OPENCODE_CONFIG_DIR',
-      source: 'ORCA_OPENCODE_SOURCE_CONFIG_DIR'
-    })
     restoreOrStripOverlayEnv(baseEnv, {
       primary: 'MIMOCODE_HOME',
       overlay: 'ORCA_MIMOCODE_HOME',
@@ -147,13 +154,15 @@ export function buildPtyHostEnv(
         baseEnv.ORCA_AGENT_HOOK_ENDPOINT = guestEndpoint
       }
       // Why: OpenCode loads its status plugin from a guest config overlay, so point OPENCODE_CONFIG_DIR at the guest dir the relay materialized.
-      const opencodeOverlayDir = wslHookRelayManager.getOpenCodeOverlayDir(distro, openCodeAgent)
+      const opencodeOverlayDir = openCodeAgent
+        ? wslHookRelayManager.getOpenCodeOverlayDir(distro, openCodeAgent)
+        : null
       if (opencodeOverlayDir) {
         baseEnv.OPENCODE_CONFIG_DIR = opencodeOverlayDir
         baseEnv.ORCA_OPENCODE_CONFIG_DIR = opencodeOverlayDir
         delete baseEnv.ORCA_OPENCODE_SOURCE_CONFIG_DIR
       } else {
-        // Why: relay not connected yet (or older guest bundle) — never cross the Windows overlay path into WSL; drop it so in-guest OpenCode uses its own config (pre-fix behavior, no status but no regression).
+        // Only guest overlays belong in WSL; otherwise let OpenCode use its guest config.
         delete baseEnv.OPENCODE_CONFIG_DIR
         delete baseEnv.ORCA_OPENCODE_CONFIG_DIR
         delete baseEnv.ORCA_OPENCODE_SOURCE_CONFIG_DIR
@@ -271,11 +280,17 @@ export function buildPtyHostEnv(
     delete baseEnv.ORCA_CODEX_LAUNCH_PREFLIGHT
   }
 
+  // Why: an inherited copy (e.g. Orca launched from a WSL pane) names another launch's CLI.
+  delete baseEnv.ORCA_WSL_CLI_DIR
   // Why: WSL shells need the managed userData root for shell-ready wrappers; dev-mode terminals need the same export so `orca` targets the live dev instance.
   if (opts.isWsl) {
     baseEnv.ORCA_USER_DATA_PATH = opts.userDataPath
     // Why: managed WSL registration uses `orca-ide`; exposing that literal scopes agent guidance to WSL without a bare-orca shim.
-    baseEnv.ORCA_CLI_COMMAND = opts.isPackaged ? 'orca-ide' : 'orca-dev'
+    baseEnv.ORCA_CLI_COMMAND = getWslCliCommandName(opts.isPackaged)
+    const managedCliDir = getManagedWslCliDir(opts)
+    if (managedCliDir) {
+      baseEnv.ORCA_WSL_CLI_DIR = managedCliDir
+    }
   } else {
     if (!opts.isPackaged) {
       baseEnv.ORCA_USER_DATA_PATH ??= opts.userDataPath
@@ -293,7 +308,7 @@ export function buildPtyHostEnv(
     baseEnv.BROWSER === undefined &&
     process.env.BROWSER === undefined
   ) {
-    const cliCommand = opts.isWsl ? (opts.isPackaged ? 'orca-ide' : 'orca-dev') : 'orca'
+    const cliCommand = opts.isWsl ? getWslCliCommandName(opts.isPackaged) : 'orca'
     baseEnv.BROWSER = `${cliCommand} open-url --url %s`
   }
 
diff --git a/src/main/ipc/pty/host-env/fresh-spawn-routing.ts b/src/main/ipc/pty/host-env/fresh-spawn-routing.ts
index 64034d544c2f..e03c29e79bc8 100644
--- a/src/main/ipc/pty/host-env/fresh-spawn-routing.ts
+++ b/src/main/ipc/pty/host-env/fresh-spawn-routing.ts
@@ -49,8 +49,14 @@ export function beginPtySpawnForWorktree(
     }
   } catch (error) {
     // Why: worktree ID and cwd can be different roots; release earlier admissions before rejecting.
-    finishes.toReversed().forEach((finish) => finish())
+    for (let index = finishes.length - 1; index >= 0; index -= 1) {
+      finishes[index]!()
+    }
     throw error
   }
-  return () => finishes.toReversed().forEach((finish) => finish())
+  return () => {
+    for (let index = finishes.length - 1; index >= 0; index -= 1) {
+      finishes[index]!()
+    }
+  }
 }
diff --git a/src/main/ipc/pty/host-env/opencode-hook-installation.test.ts b/src/main/ipc/pty/host-env/opencode-hook-installation.test.ts
new file mode 100644
index 000000000000..eb6b1faacd77
--- /dev/null
+++ b/src/main/ipc/pty/host-env/opencode-hook-installation.test.ts
@@ -0,0 +1,367 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import {
+  createDaemonPtyEnvironment,
+  rescrubDaemonPtyEnvironment
+} from '../../../daemon/pty-subprocess/spawn-environment'
+import { getInheritedAgentHookEnvKeysToDelete } from './pi-agent'
+import { buildPtyHostEnv } from './assembly'
+import type { BuildPtyHostEnvOptions } from './types'
+
+const fixture = vi.hoisted(() => ({ userData: '', guestOverlay: '' }))
+vi.mock('../../../../shared/app-environment', () => ({
+  getAppEnvironment: () => ({ getPath: () => fixture.userData })
+}))
+vi.mock('../../../agent-hooks/server', () => ({
+  agentHookServer: { buildPtyEnv: () => ({ ORCA_AGENT_HOOK_PORT: '12345' }) }
+}))
+vi.mock('../../../agent-hooks/wsl-hook-relay-manager', () => ({
+  wslHookRelayManager: {
+    ensureForDistro: vi.fn(),
+    getGuestEndpointFilePath: () => '/guest/endpoint.json',
+    getOpenCodeOverlayDir: () => fixture.guestOverlay,
+    getGuestAgentPath: () => null
+  }
+}))
+vi.mock('../../../pi/titlebar-extension-service', () => ({
+  piTitlebarExtensionService: { buildPtyEnv: () => ({}), buildFreshOmpEnv: () => ({}) }
+}))
+vi.mock('../../../cli/orca-cli-child-path', () => ({ prependOrcaCliDirToChildPath: () => {} }))
+vi.mock('../../../cli/wsl-managed-cli', () => ({
+  getManagedWslCliDir: () => undefined,
+  getWslCliCommandName: () => 'orca-ide'
+}))
+
+let root: string
+let config: string
+let custom: string
+let options: BuildPtyHostEnvOptions
+const plugin = (dir: string, agent: string) => join(dir, 'plugins', `orca-${agent}-status.js`)
+
+beforeEach(() => {
+  root = mkdtempSync(join(tmpdir(), 'orca-opencode-disabled-'))
+  const home = join(root, 'home')
+  const xdg = join(root, 'xdg')
+  mkdirSync(home)
+  fixture.userData = join(root, 'user-data')
+  fixture.guestOverlay = join(root, 'guest-overlay')
+  config = join(xdg, 'opencode')
+  custom = join(root, 'custom')
+  mkdirSync(join(custom, 'plugins'), { recursive: true })
+  writeFileSync(join(custom, 'opencode.json'), '{"model":"fixture"}')
+  writeFileSync(join(custom, 'plugins', 'user.js'), '// user plugin')
+  vi.stubEnv('HOME', home)
+  vi.stubEnv('USERPROFILE', home)
+  vi.stubEnv('XDG_CONFIG_HOME', xdg)
+  for (const key of [
+    'OPENCODE_CONFIG_DIR',
+    'ORCA_OPENCODE_CONFIG_DIR',
+    'ORCA_OPENCODE_SOURCE_CONFIG_DIR',
+    'ORCA_OPENCODE_AGENT',
+    'ZDOTDIR'
+  ]) {
+    vi.stubEnv(key, undefined)
+  }
+  options = {
+    isPackaged: true,
+    userDataPath: fixture.userData,
+    selectedCodexHomePath: null,
+    agentStatusHooksEnabled: true
+  }
+})
+afterEach(() => {
+  vi.unstubAllEnvs()
+  rmSync(root, { recursive: true, force: true })
+})
+
+describe('OpenCode installation uses the current enabled agents', () => {
+  const combinations = [
+    { disabled: [], fallback: 'opencode' },
+    { disabled: ['opencode'], fallback: 'opencode2' },
+    { disabled: ['opencode2'], fallback: 'opencode' },
+    { disabled: ['opencode', 'opencode2'], fallback: undefined }
+  ]
+  for (const { disabled, fallback } of combinations) {
+    it.each(['default', 'custom'])(`bare %s config with disabled ${disabled.join(',')}`, (kind) => {
+      const env = buildPtyHostEnv(
+        'pane',
+        kind === 'custom' ? { OPENCODE_CONFIG_DIR: custom } : {},
+        {
+          ...options,
+          disabledTuiAgents: disabled
+        }
+      )
+      expect(env.ORCA_OPENCODE_AGENT).toBe(fallback)
+      const selected = env.OPENCODE_CONFIG_DIR ?? config
+      for (const agent of ['opencode', 'opencode2']) {
+        expect(existsSync(plugin(selected, agent))).toBe(agent === fallback)
+      }
+      if (kind === 'custom') {
+        expect(readFileSync(join(selected, 'plugins', 'user.js'), 'utf8')).toBe('// user plugin')
+        expect(readFileSync(join(selected, 'opencode.json'), 'utf8')).toBe('{"model":"fixture"}')
+        expect(existsSync(plugin(custom, 'opencode'))).toBe(false)
+      }
+    })
+    it.each(['opencode', 'opencode2'] as const)(
+      `explicit %s with disabled ${disabled.join(',')}`,
+      (agent) => {
+        for (const selection of [
+          { launchCommand: `${agent} --session fixture` },
+          { launchAgent: agent }
+        ]) {
+          const env = buildPtyHostEnv(
+            'pane',
+            {},
+            { ...options, ...selection, disabledTuiAgents: disabled }
+          )
+          const selected = disabled.includes(agent) ? undefined : agent
+          expect(env.ORCA_OPENCODE_AGENT).toBe(selected)
+          expect(existsSync(plugin(config, agent))).toBe(selected === agent)
+          expect(existsSync(plugin(config, agent === 'opencode' ? 'opencode2' : 'opencode'))).toBe(
+            false
+          )
+        }
+      }
+    )
+  }
+
+  it('reads enable/disable changes on the same services without deleting installed files', () => {
+    buildPtyHostEnv('first', {}, options)
+    const installed = plugin(config, 'opencode')
+    writeFileSync(installed, '// already installed sentinel')
+    const env = buildPtyHostEnv('second', {}, { ...options, disabledTuiAgents: ['opencode'] })
+    expect(env.ORCA_OPENCODE_AGENT).toBe('opencode2')
+    expect(readFileSync(installed, 'utf8')).toBe('// already installed sentinel')
+    buildPtyHostEnv('third', {}, options)
+    expect(readFileSync(installed, 'utf8')).toContain('/hook/opencode')
+  })
+
+  it.each([true, false])(
+    'restores inherited source and clears markers with hooks %s',
+    (enabled) => {
+      const first = buildPtyHostEnv('first', { OPENCODE_CONFIG_DIR: custom }, options)
+      const original = readFileSync(plugin(first.OPENCODE_CONFIG_DIR, 'opencode'), 'utf8')
+      const env = buildPtyHostEnv(
+        'second',
+        { ...first },
+        {
+          ...options,
+          agentStatusHooksEnabled: enabled,
+          disabledTuiAgents: ['opencode', 'opencode2']
+        }
+      )
+      expect(env.OPENCODE_CONFIG_DIR).toBe(custom)
+      expect(env.ORCA_OPENCODE_CONFIG_DIR).toBeUndefined()
+      expect(env.ORCA_OPENCODE_SOURCE_CONFIG_DIR).toBeUndefined()
+      expect(env.ORCA_OPENCODE_AGENT).toBeUndefined()
+      expect(readFileSync(plugin(first.OPENCODE_CONFIG_DIR, 'opencode'), 'utf8')).toBe(original)
+      expect(env.ORCA_AGENT_HOOK_PORT).toBe(enabled ? '12345' : undefined)
+    }
+  )
+
+  it('drops an inherited overlay without a source and preserves an unrelated explicit config', () => {
+    for (const primary of [fixture.guestOverlay, custom]) {
+      const env = buildPtyHostEnv(
+        'pane',
+        {
+          OPENCODE_CONFIG_DIR: primary,
+          ORCA_OPENCODE_CONFIG_DIR: fixture.guestOverlay,
+          ORCA_OPENCODE_AGENT: 'opencode'
+        },
+        { ...options, disabledTuiAgents: ['opencode', 'opencode2'] }
+      )
+      expect(env.OPENCODE_CONFIG_DIR).toBe(primary === custom ? custom : undefined)
+      expect(env.ORCA_OPENCODE_AGENT).toBeUndefined()
+    }
+  })
+
+  it('does not write a native plugin for WSL or inject a disabled guest overlay', () => {
+    const enabled = buildPtyHostEnv(
+      'wsl-enabled',
+      {},
+      { ...options, isWsl: true, launchAgent: 'opencode2' }
+    )
+    expect(enabled.OPENCODE_CONFIG_DIR).toBe(fixture.guestOverlay)
+    expect(existsSync(config)).toBe(false)
+    const disabled = buildPtyHostEnv(
+      'wsl-disabled',
+      {},
+      {
+        ...options,
+        isWsl: true,
+        disabledTuiAgents: ['opencode', 'opencode2']
+      }
+    )
+    expect(disabled.OPENCODE_CONFIG_DIR).toBeUndefined()
+    expect(disabled.ORCA_AGENT_HOOK_ENDPOINT).toBe('/guest/endpoint.json')
+    expect(existsSync(config)).toBe(false)
+  })
+})
+
+it.each(['source', 'no-source', 'user-config'])(
+  'carries sparse host cleanup into daemon %s env',
+  (kind) => {
+    const prepared = buildPtyHostEnv(
+      'daemon-pane',
+      {},
+      {
+        ...options,
+        disabledTuiAgents: ['opencode', 'opencode2']
+      }
+    )
+    vi.stubEnv('OPENCODE_CONFIG_DIR', kind === 'user-config' ? custom : fixture.guestOverlay)
+    vi.stubEnv('ORCA_OPENCODE_CONFIG_DIR', fixture.guestOverlay)
+    vi.stubEnv('ORCA_OPENCODE_AGENT', 'opencode')
+    if (kind === 'source') {
+      vi.stubEnv('ORCA_OPENCODE_SOURCE_CONFIG_DIR', custom)
+    }
+    const result = createDaemonPtyEnvironment({
+      sessionId: 'fixture',
+      cols: 80,
+      rows: 24,
+      env: prepared,
+      envToDelete: getInheritedAgentHookEnvKeysToDelete(prepared)
+    })
+    expect(result.OPENCODE_CONFIG_DIR).toBe(kind === 'no-source' ? undefined : custom)
+    expect(result.ORCA_OPENCODE_AGENT).toBeUndefined()
+    expect(result.ORCA_OPENCODE_CONFIG_DIR).toBeUndefined()
+    expect(result.ORCA_OPENCODE_SOURCE_CONFIG_DIR).toBeUndefined()
+  }
+)
+
+it.each([
+  { primary: 'overlay', source: true, explicit: true, expected: 'current' },
+  { primary: 'current', source: true, explicit: false, expected: 'current' },
+  { primary: 'overlay', source: true, explicit: false, expected: 'previous' },
+  { primary: 'absent', source: true, explicit: false, expected: 'previous' },
+  { primary: 'overlay', source: false, explicit: false, expected: undefined },
+  { primary: 'overlay', source: false, explicit: true, expected: 'current' },
+  { primary: 'absent', source: false, explicit: false, expected: undefined }
+])('daemon config precedence: $primary, source $source, explicit $explicit', (scenario) => {
+  const prepared = buildPtyHostEnv(
+    'daemon-pane',
+    scenario.explicit ? { OPENCODE_CONFIG_DIR: custom } : {},
+    { ...options, disabledTuiAgents: ['opencode', 'opencode2'] }
+  )
+  const previous = join(root, 'previous')
+  mkdirSync(previous)
+  writeFileSync(join(previous, 'opencode.json'), '{"model":"previous"}')
+  vi.stubEnv(
+    'OPENCODE_CONFIG_DIR',
+    scenario.primary === 'absent'
+      ? undefined
+      : scenario.primary === 'current'
+        ? custom
+        : fixture.guestOverlay
+  )
+  vi.stubEnv('ORCA_OPENCODE_CONFIG_DIR', fixture.guestOverlay)
+  vi.stubEnv('ORCA_OPENCODE_SOURCE_CONFIG_DIR', scenario.source ? previous : undefined)
+  vi.stubEnv('ORCA_OPENCODE_AGENT', 'opencode')
+  const request = {
+    sessionId: 'fixture',
+    cols: 80,
+    rows: 24,
+    env: prepared,
+    envToDelete: getInheritedAgentHookEnvKeysToDelete(prepared)
+  }
+  const result = createDaemonPtyEnvironment(request)
+  rescrubDaemonPtyEnvironment(result, request)
+  if (scenario.expected) {
+    expect(readFileSync(join(result.OPENCODE_CONFIG_DIR, 'opencode.json'), 'utf8')).toBe(
+      scenario.expected === 'current' ? '{"model":"fixture"}' : '{"model":"previous"}'
+    )
+  } else {
+    expect(result.OPENCODE_CONFIG_DIR).toBeUndefined()
+  }
+  expect(result.ORCA_OPENCODE_CONFIG_DIR).toBeUndefined()
+  expect(result.ORCA_OPENCODE_SOURCE_CONFIG_DIR).toBeUndefined()
+  expect(result.ORCA_OPENCODE_AGENT).toBeUndefined()
+})
+
+it.each(['opencode', 'opencode2'] as const)(
+  'keeps the freshly selected %s overlay through a stale daemon',
+  (agent) => {
+    const prepared = buildPtyHostEnv(
+      'pane',
+      { OPENCODE_CONFIG_DIR: custom },
+      {
+        ...options,
+        launchAgent: agent
+      }
+    )
+    vi.stubEnv('OPENCODE_CONFIG_DIR', fixture.guestOverlay)
+    vi.stubEnv('ORCA_OPENCODE_CONFIG_DIR', fixture.guestOverlay)
+    vi.stubEnv('ORCA_OPENCODE_SOURCE_CONFIG_DIR', join(root, 'stale-source'))
+    const result = createDaemonPtyEnvironment({
+      sessionId: 'fixture',
+      cols: 80,
+      rows: 24,
+      env: prepared,
+      envToDelete: getInheritedAgentHookEnvKeysToDelete(prepared)
+    })
+    expect(readFileSync(join(result.OPENCODE_CONFIG_DIR, 'opencode.json'), 'utf8')).toBe(
+      '{"model":"fixture"}'
+    )
+    expect(existsSync(plugin(result.OPENCODE_CONFIG_DIR, agent))).toBe(true)
+    expect(result.ORCA_OPENCODE_SOURCE_CONFIG_DIR).toBe(custom)
+    expect(result.ORCA_OPENCODE_AGENT).toBe(agent)
+  }
+)
+
+it.each([true, false])(
+  'preserves explicit host config over inherited markers with hooks %s',
+  (enabled) => {
+    const stale = join(root, 'stale-source')
+    mkdirSync(stale)
+    writeFileSync(join(stale, 'opencode.json'), '{"model":"stale"}')
+    for (const inheritedFromProcess of [true, false]) {
+      const markers = {
+        ORCA_OPENCODE_CONFIG_DIR: join(root, 'old-overlay'),
+        ORCA_OPENCODE_SOURCE_CONFIG_DIR: stale
+      }
+      for (const [key, value] of Object.entries(markers)) {
+        vi.stubEnv(key, inheritedFromProcess ? value : undefined)
+      }
+      const env = buildPtyHostEnv(
+        'explicit-config',
+        {
+          ...(inheritedFromProcess ? {} : markers),
+          OPENCODE_CONFIG_DIR: custom
+        },
+        { ...options, agentStatusHooksEnabled: enabled }
+      )
+      expect(readFileSync(join(env.OPENCODE_CONFIG_DIR, 'opencode.json'), 'utf8')).toBe(
+        '{"model":"fixture"}'
+      )
+      expect(env.ORCA_OPENCODE_SOURCE_CONFIG_DIR).toBe(enabled ? custom : undefined)
+      expect(existsSync(plugin(stale, 'opencode'))).toBe(false)
+    }
+  }
+)
+
+it.each([true, false])(
+  'drops host config for disabled WSL variants with explicit primary %s',
+  (explicit) => {
+    const overlay = 'C:\\Users\\fixture\\Orca\\opencode-overlays\\old'
+    const source = 'C:\\Users\\fixture\\config\\opencode'
+    vi.stubEnv('ORCA_OPENCODE_CONFIG_DIR', overlay)
+    vi.stubEnv('ORCA_OPENCODE_SOURCE_CONFIG_DIR', source)
+    const env = buildPtyHostEnv(
+      'wsl-disabled-inherited',
+      {
+        OPENCODE_CONFIG_DIR: explicit ? source : overlay,
+        ORCA_OPENCODE_CONFIG_DIR: overlay,
+        ORCA_OPENCODE_SOURCE_CONFIG_DIR: source
+      },
+      { ...options, isWsl: true, disabledTuiAgents: ['opencode', 'opencode2'] }
+    )
+    expect(env.OPENCODE_CONFIG_DIR).toBeUndefined()
+    expect(env.ORCA_OPENCODE_CONFIG_DIR).toBeUndefined()
+    expect(env.ORCA_OPENCODE_SOURCE_CONFIG_DIR).toBeUndefined()
+    expect(env.ORCA_OPENCODE_AGENT).toBeUndefined()
+    expect(env.ORCA_AGENT_HOOK_ENDPOINT).toBe('/guest/endpoint.json')
+    expect(existsSync(config)).toBe(false)
+  }
+)
diff --git a/src/main/ipc/pty/host-env/pi-agent.ts b/src/main/ipc/pty/host-env/pi-agent.ts
index 545d04d063d1..3c33c499c89a 100644
--- a/src/main/ipc/pty/host-env/pi-agent.ts
+++ b/src/main/ipc/pty/host-env/pi-agent.ts
@@ -130,7 +130,12 @@ export function getInheritedAgentHookEnvKeysToDelete(
 ): string[] {
   const env = spawnEnv ?? {}
   // Why: providers merge process.env after cleanup; delete stale hook keys without dropping fresh coordinates buildPtyHostEnv set.
-  return AGENT_HOOK_RUNTIME_ENV_KEYS.filter((key) => env[key] === undefined)
+  return [
+    ...AGENT_HOOK_RUNTIME_ENV_KEYS,
+    'ORCA_OPENCODE_AGENT',
+    'ORCA_OPENCODE_CONFIG_DIR',
+    'ORCA_OPENCODE_SOURCE_CONFIG_DIR'
+  ].filter((key) => env[key] === undefined)
 }
 
 export function getInheritedClaudeSessionStampEnvKeysToDelete(
@@ -142,25 +147,7 @@ export function getInheritedClaudeSessionStampEnvKeysToDelete(
   return CLAUDE_CHILD_SESSION_STAMP_ENV_KEYS.filter((key) => env[key] === undefined)
 }
 
-// Why: a nested terminal can inherit prior OpenCode/Pi/OMP overlay env; restore the user's recorded source dir, else strip only Orca-owned values.
-export function restoreOrStripOverlayEnv(
-  baseEnv: Record<string, string>,
-  keys: {
-    primary: string
-    overlay: string
-    source: string
-  }
-): void {
-  const sourceValue = baseEnv[keys.source] ?? process.env[keys.source]
-  const overlayValue = baseEnv[keys.overlay] ?? process.env[keys.overlay]
-  if (sourceValue) {
-    baseEnv[keys.primary] = sourceValue
-  } else if (overlayValue && baseEnv[keys.primary] === overlayValue) {
-    delete baseEnv[keys.primary]
-  }
-  delete baseEnv[keys.overlay]
-  delete baseEnv[keys.source]
-}
+export { restoreOrStripOverlayEnv } from '../../../../shared/agent-overlay-env'
 
 export function isMimoLaunchCommand(launchCommand: string | undefined): boolean {
   const binary = getCommandTokenPathBasename(getFirstCommandToken(launchCommand ?? ''))
@@ -185,14 +172,17 @@ export function resolveMimocodeSourceHome(baseEnv: Record<string, string>): stri
 export function resolveOpenCodeSourceConfigDir(
   baseEnv: Record<string, string>
 ): string | undefined {
+  const configDir = baseEnv.OPENCODE_CONFIG_DIR ?? process.env.OPENCODE_CONFIG_DIR
+  const orcaConfigDir = baseEnv.ORCA_OPENCODE_CONFIG_DIR ?? process.env.ORCA_OPENCODE_CONFIG_DIR
+  if (configDir && orcaConfigDir && configDir !== orcaConfigDir) {
+    return configDir
+  }
   const sourceDir =
     baseEnv.ORCA_OPENCODE_SOURCE_CONFIG_DIR ?? process.env.ORCA_OPENCODE_SOURCE_CONFIG_DIR
   if (sourceDir) {
     return sourceDir
   }
 
-  const configDir = baseEnv.OPENCODE_CONFIG_DIR ?? process.env.OPENCODE_CONFIG_DIR
-  const orcaConfigDir = baseEnv.ORCA_OPENCODE_CONFIG_DIR ?? process.env.ORCA_OPENCODE_CONFIG_DIR
   // Why: with no recorded source dir, an inherited OPENCODE_CONFIG_DIR is Orca-owned, not user config; treating it as user config makes child Orcas mirror the hook dir.
   if (configDir && orcaConfigDir && configDir === orcaConfigDir) {
     return undefined
diff --git a/src/main/ipc/pty/ipc/renderer-kill.ts b/src/main/ipc/pty/ipc/renderer-kill.ts
index 8f73e72aa596..10a0ffa476e2 100644
--- a/src/main/ipc/pty/ipc/renderer-kill.ts
+++ b/src/main/ipc/pty/ipc/renderer-kill.ts
@@ -1,10 +1,11 @@
 import { getPtyIpc } from '../../pty-host-bindings'
 import type { Store } from '../../../persistence'
 import type { OrcaRuntimeService } from '../../../runtime/orca-runtime'
+import type { TerminalIntentionalStopKind } from '../../../runtime/terminal-intentional-stops'
 import type { IPtyProvider } from '../../../providers/types'
 import { parseAppSshPtyId } from '../../../providers/ssh-pty-id'
 import { SSH_PROVIDER_UNREGISTERED_REASON } from '../../../../shared/pty-liveness-verdict'
-import { ptyOwnership } from '../provider/ownership-state'
+import { ptyIncarnationById, ptyOwnership } from '../provider/ownership-state'
 import { getProviderForPty, sshProviders, tryGetProviderForPty } from '../provider/registry'
 import { finishPtyShutdown, isPtyAlreadyGoneError } from '../provider/liveness'
 import { recordUndeliveredSshPtyKill } from '../runtime/undelivered-ssh-kill'
@@ -31,25 +32,47 @@ export function installPtyKillIpcHandler(deps: PtyKillIpcDeps): void {
   )
 }
 
-/** Stops a pane's PTY for the spawn replacing it. `markReplaced` labels the exit so the renderer
- *  reads it as a handoff, not the pane dying; a failed stop removes the label with nothing sent. */
-export async function stopReplacedPanePty(
+/** Stops a pane's PTY for the spawn replacing it. The stop register labels the exit so the
+ *  renderer reads it as a handoff, not the pane dying; a failed stop leaves no label. */
+export async function stopReplacedPanePty(deps: PtyKillIpcDeps, id: string): Promise<void> {
+  await stopRendererOwnedPtyAs(deps, { id }, 'replaced')
+}
+
+/** Stops a renderer-owned PTY and settles only once its shutdown has been observed or synthesized. */
+export async function stopRendererOwnedPty(
+  deps: PtyKillIpcDeps,
+  args: { id: string; keepHistory?: boolean }
+): Promise<void> {
+  // Why: only hibernation passes keepHistory, and its exit must keep the pane's wake binding.
+  await stopRendererOwnedPtyAs(deps, args, args?.keepHistory === true ? 'reversible' : null)
+}
+
+async function stopRendererOwnedPtyAs(
   deps: PtyKillIpcDeps,
-  id: string,
-  markReplaced: (id: string) => (stopped: boolean) => void
+  args: { id: string; keepHistory?: boolean },
+  intentionalStop: TerminalIntentionalStopKind | null
 ): Promise<void> {
-  const settle = markReplaced(id)
+  if (typeof args?.id !== 'string' || !args.id || args.id.startsWith('remote:')) {
+    // Why: runtime terminal handles belong to terminal.close; unowned PTY routing could target the local provider.
+    throw new Error('Invalid PTY provider id')
+  }
+  const settleStop = intentionalStop
+    ? deps.runtime?.intentionalPtyStops?.mark(
+        args.id,
+        intentionalStop,
+        ptyIncarnationById.get(args.id) ?? null
+      )
+    : undefined
+  let stopped = false
   try {
-    await stopRendererOwnedPty(deps, { id })
-  } catch (err) {
-    settle(false)
-    throw err
+    await stopRendererOwnedPtyProcess(deps, args)
+    stopped = true
+  } finally {
+    settleStop?.(stopped)
   }
-  settle(true)
 }
 
-/** Stops a renderer-owned PTY and settles only once its shutdown has been observed or synthesized. */
-export async function stopRendererOwnedPty(
+async function stopRendererOwnedPtyProcess(
   deps: PtyKillIpcDeps,
   args: { id: string; keepHistory?: boolean }
 ): Promise<void> {
@@ -61,10 +84,6 @@ export async function stopRendererOwnedPty(
     rememberSyntheticKillExit,
     sendPtyExitToRenderer
   } = deps
-  if (typeof args?.id !== 'string' || !args.id || args.id.startsWith('remote:')) {
-    // Why: runtime terminal handles belong to terminal.close; unowned PTY routing could target the local provider.
-    throw new Error('Invalid PTY provider id')
-  }
   runtime?.markPtyStopRequested?.(args.id)
   const ownedConnectionId = ptyOwnership.get(args.id)
   const parsedSshId = ownedConnectionId === undefined ? parseAppSshPtyId(args.id) : null
diff --git a/src/main/ipc/pty/ipc/resize-visibility.ts b/src/main/ipc/pty/ipc/resize-visibility.ts
index d3326a2df6e7..c9f3e92c6207 100644
--- a/src/main/ipc/pty/ipc/resize-visibility.ts
+++ b/src/main/ipc/pty/ipc/resize-visibility.ts
@@ -180,7 +180,7 @@ export function installPtyResizeVisibilityIpc(session: PtyIpcSession): void {
   ipcMain.removeAllListeners('pty:rendererDispatcherReady')
   ipcMain.on('pty:rendererDispatcherReady', (event) => {
     // Why: the reconcile below destructively clears delivery accounting, so a straggler handshake from a dying window must not reset the new window.
-    if (!isMainWindowPtyIpcEvent(event, mainWindow, mainWindow.webContents)) {
+    if (!isMainWindowPtyIpcEvent(event, mainWindow)) {
       return
     }
     // Why: a handshake while the gate is already open means a page load whose lifecycle reset was missed; clear the dead page's stale accounting so it can't permanently gate survivors.
diff --git a/src/main/ipc/pty/ipc/serialize-buffer.ts b/src/main/ipc/pty/ipc/serialize-buffer.ts
index d7b5d35d6428..1c3148757457 100644
--- a/src/main/ipc/pty/ipc/serialize-buffer.ts
+++ b/src/main/ipc/pty/ipc/serialize-buffer.ts
@@ -39,7 +39,7 @@ export function installPtySerializeBufferIpc(session: PtyIpcSession): void {
     ) => {
       // Why: the snapshot seeds terminal restore state, so only the main window may settle it.
       if (
-        !isMainWindowPtyIpcEvent(event, session.mainWindow, session.mainWindow.webContents) ||
+        !isMainWindowPtyIpcEvent(event, session.mainWindow) ||
         typeof args?.requestId !== 'string'
       ) {
         return
@@ -88,7 +88,8 @@ export function requestSerializedBuffer(
   ptyId: string,
   opts?: { scrollbackRows?: number }
 ): Promise<SerializeResult> {
-  if (session.mainWindow.isDestroyed()) {
+  const { mainWindow } = session
+  if (!mainWindow || mainWindow.isDestroyed()) {
     return Promise.resolve(null)
   }
 
@@ -106,6 +107,6 @@ export function requestSerializedBuffer(
     if (opts) {
       payload.opts = opts
     }
-    session.mainWindow.webContents.send('pty:serializeBuffer:request', payload)
+    mainWindow.webContents.send('pty:serializeBuffer:request', payload)
   })
 }
diff --git a/src/main/ipc/pty/ipc/spawn-commit-persist.ts b/src/main/ipc/pty/ipc/spawn-commit-persist.ts
index 7aaa90bf9b82..3740e1489a05 100644
--- a/src/main/ipc/pty/ipc/spawn-commit-persist.ts
+++ b/src/main/ipc/pty/ipc/spawn-commit-persist.ts
@@ -1,29 +1,25 @@
 import { toSshExecutionHostId } from '../../../../shared/execution-host'
-import { markNativeWindowsConptyPty } from '../../../runtime/terminal-model-query-authority'
 import { closeStartupQueryAuthorityForPty, getRelayPtyId } from '../provider/registry'
 import { createTerminalSessionStateSaveFailureMessage } from '../../../../shared/terminal-session-state-save-failure'
 import { recordCodexPaneAccountForSpawn } from '../host-env/codex-home'
 import { persistAdmittedStablePaneBinding } from '../pane/stable-owner'
+import { claimSshPaneLease } from '../pane/ssh-pane-lease-claim'
 import {
   pendingByPaneKey,
   pendingPtyIdBySerializerGeneration,
   rendererSerializerReadiness
 } from '../pane/serializer-state'
-import { ptyOwnership, ptyIncarnationById, deletePtyOwnership } from '../provider/ownership-state'
+import { ptyOwnership, ptyIncarnationById } from '../provider/ownership-state'
 import { ptySizes } from '../delivery/visibility-state'
 import { resolveCommittedPtySize, type PtyGrid } from '../delivery/attached-pty-size'
-import { clearProviderPtyState } from '../provider/state-cleanup'
+import { discardUnpersistedPtySpawn } from '../pane/spawn-registration'
 import { spawnCommitBindingOrigin } from '../../../persistence/loading-store/pty-binding-span'
 import type { PtyIpcSpawnState } from './spawn-state'
 
-export async function persistPtyIpcSpawnCommit(ctx: PtyIpcSpawnState): Promise<{
-  rendererPreSignaled: boolean
-  rendererAlreadyRegistered: boolean
-  committedSize: PtyGrid
-}> {
+export async function persistPtyIpcSpawnCommit(ctx: PtyIpcSpawnState): Promise<PtyGrid> {
   const args = ctx.args
   try {
-    ctx.stablePaneBindingPersisted = persistAdmittedStablePaneBinding({
+    ctx.stablePaneBindingPersisted = await persistAdmittedStablePaneBinding({
       store: ctx.deps.store,
       owner: ctx.stablePaneOwner,
       result: ctx.result,
@@ -40,6 +36,55 @@ export async function persistPtyIpcSpawnCommit(ctx: PtyIpcSpawnState): Promise<{
       agentSessionOperationOutcome: 'unknown' as const
     })
   }
+  const committedSize = resolveCommittedPtySize({
+    result: ctx.result,
+    requested: { cols: args.cols, rows: args.rows },
+    cachedBeforeAttach: ctx.sessionSizeBeforeAttach
+  })
+  const relayResultId = getRelayPtyId(args.connectionId, ctx.result.id)
+  // Persist the binding before acknowledging spawn so the renderer debounce cannot orphan history.
+  if (
+    ctx.deps.store &&
+    typeof args.worktreeId === 'string' &&
+    typeof args.tabId === 'string' &&
+    ctx.validatedLeafId !== null &&
+    !ctx.stablePaneBindingPersisted
+  ) {
+    try {
+      const binding = {
+        worktreeId: args.worktreeId,
+        tabId: args.tabId,
+        leafId: ctx.validatedLeafId,
+        ptyId: ctx.result.id,
+        ...(ctx.result.incarnationId ? { incarnationId: ctx.result.incarnationId } : {}),
+        ...(ctx.cwd ? { startupCwd: ctx.cwd } : {}),
+        origin: spawnCommitBindingOrigin(ctx.result)
+      }
+      const persisted = args.connectionId
+        ? await ctx.deps.store.persistPtyBinding(binding, toSshExecutionHostId(args.connectionId))
+        : await ctx.deps.store.persistPtyBinding(binding)
+      if (persisted === false) {
+        throw new Error('terminal_pane_owner_changed')
+      }
+    } catch (err) {
+      console.error('[pty] failed to persist PTY binding after spawn:', err)
+      await discardUnpersistedPtySpawn(ctx.provider, ctx.result, () => {
+        if (args.connectionId && ctx.deps.store) {
+          ctx.deps.store.removeSshRemotePtyLease(args.connectionId, relayResultId)
+        }
+      })
+      throw Object.assign(new Error(createTerminalSessionStateSaveFailureMessage()), {
+        agentSessionOperationOutcome: 'unknown' as const
+      })
+    }
+  }
+  return committedSize
+}
+
+export function publishPtyIpcSpawnCommit(ctx: PtyIpcSpawnState, committedSize: PtyGrid): void {
+  const args = ctx.args
+  // Why here: every IPC spawn that survives its binding save publishes once through this point.
+  ctx.deps.runtime?.noteTerminalSpawnCommit?.(ctx.result)
   ctx.spawnTiming.log(ctx.result.id, {
     daemon: ctx.isDaemonHostSpawn,
     reattach: ctx.result.isReattach ?? false
@@ -59,7 +104,7 @@ export async function persistPtyIpcSpawnCommit(ctx: PtyIpcSpawnState): Promise<{
     ptyIncarnationById.set(ctx.result.id, ctx.result.incarnationId)
   }
   if (ctx.initiallyHidden) {
-    // Why marked synchronously here: provider data events dispatch on later tasks, so this still lands ahead of the first byte's delivery decision (idempotent if already marked pre-spawn).
+    // Refresh the pre-spawn hidden mark only after this incarnation survives its save.
     ctx.deps.transitionSpawnHiddenRendererPtyDeliveryState(ctx.result.id, true)
     if (ctx.preSpawnHiddenMarkId !== null && ctx.preSpawnHiddenMarkId !== ctx.result.id) {
       // Defense: never strand a mark on an id the provider renamed.
@@ -69,88 +114,24 @@ export async function persistPtyIpcSpawnCommit(ctx: PtyIpcSpawnState): Promise<{
     ctx.deps.syncPtyBackgroundedDelivery(ctx.result.id, 'spawn')
     closeStartupQueryAuthorityForPty(ctx.result.id)
   }
-  // Why: record the native-Windows-ConPTY determination before the headless seed so the emulator's DA1 override exists from byte zero.
-  if (ctx.nativeWindowsConptySpawn) {
-    markNativeWindowsConptyPty(ctx.result.id)
-  }
-  const relayResultId = getRelayPtyId(args.connectionId, ctx.result.id)
-  if (ctx.deps.store && args.connectionId) {
-    // Why: remote PTYs live in the SSH relay grace window after Orca detaches; persist IDs immediately so reconnect reattaches instead of spawning a fresh shell.
-    ctx.deps.store.upsertSshRemotePtyLease({
-      targetId: args.connectionId,
-      ptyId: relayResultId,
-      ...(typeof args.worktreeId === 'string' ? { worktreeId: args.worktreeId } : {}),
-      ...(typeof args.tabId === 'string' ? { tabId: args.tabId } : {}),
-      ...(ctx.validatedLeafId ? { leafId: ctx.validatedLeafId } : {}),
-      state: 'attached',
-      lastAttachedAt: Date.now()
-    })
-  }
   if (ctx.preAllocatedHandle && !ctx.stablePaneOwner?.handle) {
     if (ctx.deps.runtime?.registerPreAllocatedHandleForPty) {
       ctx.deps.runtime.registerPreAllocatedHandleForPty(ctx.result.id, ctx.preAllocatedHandle)
       ctx.agentTeamsLeaderHandle = null
     }
   }
-  const committedSize = resolveCommittedPtySize({
-    result: ctx.result,
-    requested: { cols: args.cols, rows: args.rows },
-    cachedBeforeAttach: ctx.sessionSizeBeforeAttach
-  })
   ptySizes.set(ctx.result.id, committedSize)
   if (ctx.effectiveSessionAppId !== undefined && ctx.effectiveSessionAppId !== ctx.result.id) {
     ptySizes.delete(ctx.effectiveSessionAppId)
   }
-  // Why: patch the load-bearing ptyId binding synchronously so a force-quit in the renderer's ~450 ms debounce window can't orphan daemon history or an SSH relay lease (Issue #217).
-  if (
-    ctx.deps.store &&
-    typeof args.worktreeId === 'string' &&
-    typeof args.tabId === 'string' &&
-    ctx.validatedLeafId !== null &&
-    !ctx.stablePaneBindingPersisted
-  ) {
-    try {
-      const binding = {
-        worktreeId: args.worktreeId,
-        tabId: args.tabId,
-        leafId: ctx.validatedLeafId,
-        ptyId: ctx.result.id,
-        ...(ctx.result.incarnationId ? { incarnationId: ctx.result.incarnationId } : {}),
-        ...(ctx.cwd ? { startupCwd: ctx.cwd } : {}),
-        origin: spawnCommitBindingOrigin(ctx.result)
-      }
-      if (args.connectionId) {
-        ctx.deps.store.persistPtyBinding(binding, toSshExecutionHostId(args.connectionId))
-      } else {
-        ctx.deps.store.persistPtyBinding(binding)
-      }
-    } catch (err) {
-      console.error('[pty] failed to persist PTY binding after spawn:', err)
-      if (!ctx.result.isReattach) {
-        try {
-          await ctx.provider.shutdown(ctx.result.id, { immediate: true })
-        } catch (shutdownErr) {
-          console.warn('[pty] failed to clean up PTY after persistence failure:', shutdownErr)
-        }
-        clearProviderPtyState(ctx.result.id)
-        deletePtyOwnership(ctx.result.id)
-      }
-      if (!ctx.result.isReattach && args.connectionId && ctx.deps.store) {
-        ctx.deps.store.removeSshRemotePtyLease(args.connectionId, relayResultId)
-      }
-      throw Object.assign(new Error(createTerminalSessionStateSaveFailureMessage()), {
-        agentSessionOperationOutcome: 'unknown' as const
-      })
-    }
-  }
-  // Why here and not at the upsert: this path leases before it binds, so supersession fenced on the
-  // pane's binding still named the predecessor and bailed on every reconnect — one more reattachable
-  // lease, and one more `pty.attach`, per reconnect forever. Runs after whichever binding write this
-  // commit made, so the lease/binding order no longer decides.
-  if (ctx.deps.store && args.connectionId && ctx.validatedLeafId !== null) {
-    ctx.deps.store.supersedeSshRemotePtyLeasesForBoundPane(args.connectionId, ctx.validatedLeafId)
-  }
-  // Why: when the renderer has declared it will own the serializer for this paneKey, suppress the daemon-snapshot seed so its hydration path is sole authority (keyed on paneKey since the ptyId isn't known yet). See docs/mobile-prefer-renderer-scrollback.md.
+  claimSshPaneLease({
+    store: ctx.deps.store,
+    connectionId: args.connectionId,
+    ptyId: ctx.result.id,
+    worktreeId: args.worktreeId,
+    tabId: args.tabId,
+    leafId: ctx.validatedLeafId ?? undefined
+  })
   const rendererPreSignaled = ctx.validatedPaneKey
     ? pendingByPaneKey.has(ctx.validatedPaneKey)
     : false
@@ -166,5 +147,4 @@ export async function persistPtyIpcSpawnCommit(ctx: PtyIpcSpawnState): Promise<{
       pendingPtyIdBySerializerGeneration.set(pending.gen, ctx.result.id)
     }
   }
-  return { rendererPreSignaled, rendererAlreadyRegistered, committedSize }
 }
diff --git a/src/main/ipc/pty/ipc/spawn-commit-run-facts.test.ts b/src/main/ipc/pty/ipc/spawn-commit-run-facts.test.ts
new file mode 100644
index 000000000000..40cd636896ab
--- /dev/null
+++ b/src/main/ipc/pty/ipc/spawn-commit-run-facts.test.ts
@@ -0,0 +1,79 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { OrcaRuntimeWithRuntimeId } from '../../../runtime/orca-runtime-runtime-id'
+import { TerminalIntentionalStops } from '../../../runtime/terminal-intentional-stops'
+import { TerminalRunFactsRegister } from '../../../runtime/terminal-run-facts'
+import { ptySizes } from '../delivery/visibility-state'
+import { ptyIncarnationById, ptyOwnership } from '../provider/ownership-state'
+import { commitPtyIpcSpawn } from './spawn-commit'
+import { createPtyIpcSpawnState } from './spawn-state'
+import type { PtySpawnIpcDeps } from './spawn-types'
+
+const PTY_ID = 'orca-ipc-pty-run-facts'
+const INCARNATION_ID = 'inc-ipc-run-facts'
+
+async function commit(persistPtyBinding: ReturnType<typeof vi.fn>) {
+  const facts = new TerminalRunFactsRegister()
+  const stops = new TerminalIntentionalStops()
+  stops.mark(PTY_ID, 'reversible', null)(true)
+  const runtime = {
+    terminalRunFacts: facts,
+    intentionalPtyStops: stops,
+    // Why the real method: the case under test is what the runtime does with each commit.
+    noteTerminalSpawnCommit: OrcaRuntimeWithRuntimeId.prototype.noteTerminalSpawnCommit,
+    registerPreAllocatedHandleForPty: vi.fn(),
+    registerPty: vi.fn(),
+    cancelPendingPtyRegistration: vi.fn(),
+    reflowHeadlessTerminalToPtyGrid: vi.fn(),
+    seedHeadlessTerminal: vi.fn(),
+    noteTerminalSpawnCommand: vi.fn()
+  }
+  const ports = {
+    runtime,
+    store: { persistPtyBinding },
+    options: {},
+    sendPtySpawnedToRenderer: vi.fn()
+  }
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the commit reads only the ports above, and the store only for its binding save.
+  const deps = ports as unknown as PtySpawnIpcDeps
+  const ctx = createPtyIpcSpawnState(deps, {
+    worktreeId: 'wt-1',
+    tabId: 'tab-1',
+    leafId: 'leaf-1',
+    cols: 120,
+    rows: 40
+  })
+  ctx.validatedLeafId = 'leaf-1'
+  ctx.provider = { ...ctx.provider, shutdown: vi.fn().mockResolvedValue(undefined) }
+  ctx.result = { id: PTY_ID, incarnationId: INCARNATION_ID }
+  const outcome = await commitPtyIpcSpawn(ctx).then(
+    () => 'committed',
+    () => 'discarded'
+  )
+  return { outcome, facts, stops }
+}
+
+describe('renderer spawn commit: run facts', () => {
+  afterEach(() => {
+    ptySizes.delete(PTY_ID)
+    ptyOwnership.delete(PTY_ID)
+    ptyIncarnationById.delete(PTY_ID)
+  })
+
+  it('records a committed spawn and lets it supersede a landed stop no exit pinned', async () => {
+    const { outcome, facts, stops } = await commit(vi.fn().mockResolvedValue(true))
+
+    expect(outcome).toBe('committed')
+    expect(facts.read(PTY_ID, INCARNATION_ID).freshSpawn).toBe(true)
+    expect(stops.claimExit(PTY_ID, INCARNATION_ID)).toEqual([])
+  })
+
+  it('records nothing for a spawn discarded because its binding save failed', async () => {
+    const persistPtyBinding = vi.fn().mockRejectedValue(new Error('disk full'))
+    const { outcome, facts, stops } = await commit(persistPtyBinding)
+
+    expect(outcome).toBe('discarded')
+    expect(persistPtyBinding).toHaveBeenCalledOnce()
+    expect(facts.read(PTY_ID, INCARNATION_ID).freshSpawn).toBe(false)
+    expect(stops.claimExit(PTY_ID, INCARNATION_ID)).toEqual(['reversible'])
+  })
+})
diff --git a/src/main/ipc/pty/ipc/spawn-commit-ssh-lease-cardinality.test.ts b/src/main/ipc/pty/ipc/spawn-commit-ssh-lease-cardinality.test.ts
index 6266faf0c02b..aa726fdc6856 100644
--- a/src/main/ipc/pty/ipc/spawn-commit-ssh-lease-cardinality.test.ts
+++ b/src/main/ipc/pty/ipc/spawn-commit-ssh-lease-cardinality.test.ts
@@ -9,7 +9,7 @@ import { toAppSshPtyId } from '../../../providers/ssh-pty-id'
 import { toSshExecutionHostId } from '../../../../shared/execution-host'
 import type { PtySpawnIpcArgs, PtySpawnIpcDeps } from './spawn-types'
 import { createPtyIpcSpawnState } from './spawn-state'
-import { persistPtyIpcSpawnCommit } from './spawn-commit-persist'
+import { persistPtyIpcSpawnCommit, publishPtyIpcSpawnCommit } from './spawn-commit-persist'
 
 vi.mock('electron', () => ({
   app: { getPath: () => testState.dir },
@@ -20,15 +20,7 @@ const TARGET = 'ssh-1'
 const WORKTREE = 'repo1::/worktree'
 const TAB = 'tab-1'
 
-/**
- * Drives the shipped IPC spawn commit rather than the store primitives it calls.
- *
- * The store-level suite could not catch this: it exercised bind-then-upsert, and this path does the
- * opposite — it writes the lease row first so a force-quit in the renderer's debounce window cannot
- * strand a running remote shell without one, then binds the pane. Supersession is fenced on the
- * pane's binding, so under this real order it bailed on the predecessor every time and never re-ran,
- * and each reconnect left one more reattachable lease for `reattachKnownPtys` to `pty.attach`.
- */
+/** Exercises the shipped binding-then-publication order so reconnects retire earlier leases. */
 async function commitSshSpawn(
   store: ReturnType<typeof createStore>,
   args: { relayPtyId: string; leafId: string }
@@ -45,7 +37,7 @@ async function commitSshSpawn(
   const ctx = createPtyIpcSpawnState(deps, spawnArgs)
   ctx.result = { id: toAppSshPtyId(TARGET, args.relayPtyId) }
   ctx.validatedLeafId = args.leafId
-  await persistPtyIpcSpawnCommit(ctx)
+  publishPtyIpcSpawnCommit(ctx, await persistPtyIpcSpawnCommit(ctx))
 }
 
 /** One pane's layout, so the two host partitions can be given different bindings for one leaf. */
@@ -150,7 +142,7 @@ describe('the IPC spawn commit keeps one reattachable lease per SSH pane', () =>
       state: 'attached'
     })
     expect(bulkReattachPtyIds(store)).toEqual(['pty2:aaa:1', 'pty2:bbb:1'])
-    store.persistPtyBinding({
+    await store.persistPtyBinding({
       worktreeId: WORKTREE,
       tabId: TAB,
       leafId: TEST_LEAF_1,
@@ -226,7 +218,7 @@ describe('the IPC spawn commit keeps one reattachable lease per SSH pane', () =>
     })
     // Production's writer for an SSH pane binding, and the whole point: it updates ONLY the host
     // partition, so `local` is left naming the predecessor until the renderer republishes.
-    store.persistPtyBinding(
+    await store.persistPtyBinding(
       { worktreeId: WORKTREE, tabId: TAB, leafId: TEST_LEAF_1, ptyId: successor },
       hostId
     )
diff --git a/src/main/ipc/pty/ipc/spawn-commit.ts b/src/main/ipc/pty/ipc/spawn-commit.ts
index 90b700f24b2e..77491c9fb11b 100644
--- a/src/main/ipc/pty/ipc/spawn-commit.ts
+++ b/src/main/ipc/pty/ipc/spawn-commit.ts
@@ -4,13 +4,7 @@ import { markClaudePtySpawned } from '../../../claude-accounts/live-pty-gate'
 import { registerPty } from '../../../memory/pty-registry'
 import type { PtySpawnResult } from '../../../providers/types'
 import { clearMigrationUnsupportedPtysForPaneKey } from '../../../agent-hooks/migration-unsupported-pty-state'
-import { track } from '../../../telemetry/client'
-import { getCohortAtEmit } from '../../../telemetry/cohort-classifier'
-import {
-  agentKindSchema,
-  launchSourceSchema,
-  requestKindSchema
-} from '../../../../shared/telemetry-events'
+import { recordPtySpawnTelemetry } from '../pane/spawn-telemetry'
 import {
   shouldSkipCodexHomeEnvForWindowsShell,
   codexReattachedHomeRouteField
@@ -23,65 +17,22 @@ import {
   admitRendererAgentLaunchAuthority
 } from '../pane/launch-authority'
 import type { PtyIpcSpawnState } from './spawn-state'
-import { persistPtyIpcSpawnCommit } from './spawn-commit-persist'
+import { persistPtyIpcSpawnCommit, publishPtyIpcSpawnCommit } from './spawn-commit-persist'
+import { admitPtyReattachOwnership, registerPersistedPtySpawn } from '../pane/spawn-registration'
 import { reflowHeadlessTerminalToCommittedGrid } from '../delivery/attached-pty-size'
+import { seedHeadlessTerminalFromSpawnResult } from '../pane/terminal-spawn-restore'
+import { markNativeWindowsConptyPty } from '../../../runtime/terminal-model-query-authority'
 
 export async function commitPtyIpcSpawn(ctx: PtyIpcSpawnState): Promise<PtySpawnResult> {
   const args = ctx.args
-  const { rendererPreSignaled, rendererAlreadyRegistered, committedSize } =
-    await persistPtyIpcSpawnCommit(ctx)
-
-  // Why: seed the headless emulator before registerPty so concurrent live PTY data lands on top of the seed, not replacing it (mobile keeps the daemon-restored scrollback).
-  // Skip when the renderer will be authoritative — its xterm buffer is richer than the daemon snapshot.
-  if (ctx.deps.runtime && !rendererPreSignaled && !rendererAlreadyRegistered) {
-    const snapshotSeedSize =
-      typeof ctx.result.snapshotCols === 'number' && typeof ctx.result.snapshotRows === 'number'
-        ? { cols: ctx.result.snapshotCols, rows: ctx.result.snapshotRows }
-        : undefined
-    if (typeof ctx.result.snapshot === 'string' && ctx.result.snapshot.length > 0) {
-      // Why kitty flags ride seed metadata: the snapshot omits them, but the re-seeded emulator must answer hidden `CSI ? u` with the running app's flags (terminal-query-authority.md).
-      ctx.deps.runtime.seedHeadlessTerminal(ctx.result.id, ctx.result.snapshot, snapshotSeedSize, {
-        ...(typeof ctx.result.snapshotKittyKeyboardFlags === 'number'
-          ? { kittyKeyboardFlags: ctx.result.snapshotKittyKeyboardFlags }
-          : {}),
-        ...(ctx.result.snapshotTerminalOwner
-          ? { terminalOwner: ctx.result.snapshotTerminalOwner }
-          : {})
-      })
-    } else if (
-      ctx.result.coldRestore &&
-      typeof ctx.result.coldRestore.scrollback === 'string' &&
-      ctx.result.coldRestore.scrollback.length > 0
-    ) {
-      const coldRestoreSeedSize =
-        typeof ctx.result.coldRestore.cols === 'number' &&
-        typeof ctx.result.coldRestore.rows === 'number'
-          ? { cols: ctx.result.coldRestore.cols, rows: ctx.result.coldRestore.rows }
-          : undefined
-      ctx.deps.runtime.seedHeadlessTerminal(
-        ctx.result.id,
-        ctx.result.coldRestore.scrollback,
-        coldRestoreSeedSize,
-        {
-          cwd: ctx.result.coldRestore.cwd,
-          oscLinks: ctx.result.coldRestore.oscLinks,
-          preferProviderIfExisting: true
-        }
-      )
-    } else if (typeof ctx.result.replay === 'string' && ctx.result.replay.length > 0) {
-      // Why: relay reattach replay is the only restore main never ingests; skip this seed and park-reveal would replace it with a suffix fragment.
-      ctx.deps.runtime.seedHeadlessTerminal(ctx.result.id, ctx.result.replay)
-    }
+  admitPtyReattachOwnership(ctx.deps.runtime, ctx.result, args.connectionId)
+  if (ctx.nativeWindowsConptySpawn) {
+    markNativeWindowsConptyPty(ctx.result.id)
   }
-  // Why after the seed: a seed skips an existing model, and live bytes may have lazily created
-  // one at the 80x24 default before the spawn reply revealed the session's real grid.
-  reflowHeadlessTerminalToCommittedGrid({
-    result: ctx.result,
-    committedSize,
-    reflowHeadlessTerminalToPtyGrid: ctx.deps.runtime?.reflowHeadlessTerminalToPtyGrid?.bind(
-      ctx.deps.runtime
-    )
-  })
+  // Seed before the first disk await so live output appends to the restored history.
+  seedHeadlessTerminalFromSpawnResult(ctx.deps.runtime, ctx.result, ctx.validatedPaneKey)
+  seedTerminalRestoreRecordsFromSpawnResult(ctx.deps.runtime, ctx.result)
+  const committedSize = await persistPtyIpcSpawnCommit(ctx)
   if (
     typeof args.worktreeId === 'string' &&
     args.worktreeId.length > 0 &&
@@ -101,7 +52,9 @@ export async function commitPtyIpcSpawn(ctx: PtyIpcSpawnState): Promise<PtySpawn
       launchAgent: ctx.result.launchAgent,
       incarnationId: ctx.result.incarnationId
     })
-    ctx.deps.runtime?.registerPty(
+    const rejectedRegistration = registerPersistedPtySpawn(
+      ctx.deps.runtime,
+      ctx.deps.store,
       ctx.result.id,
       args.worktreeId,
       args.connectionId ?? null,
@@ -123,6 +76,21 @@ export async function commitPtyIpcSpawn(ctx: PtyIpcSpawnState): Promise<PtySpawn
         ? shouldSkipCodexHomeEnvForWindowsShell(ctx.effectiveShellOverride, ctx.cwd)
         : undefined
     )
+    if (rejectedRegistration) {
+      await rejectedRegistration.catch((error: unknown) => {
+        if (!(error instanceof Error) || error.message !== 'agent_session_exited_during_start') {
+          throw error
+        }
+      })
+      ctx.deps.runtime?.cancelPendingPtyRegistration?.(ctx.result.id, ctx.result.incarnationId)
+      ctx.pendingRegistrationPtyId = null
+      // The renderer drains this incarnation's buffered output and exit without publishing it live.
+      return resolvePaneSpawnReservation(
+        ctx.paneSpawnReservationKey,
+        ctx.paneSpawnReservation,
+        ctx.result
+      )
+    }
     ctx.pendingRegistrationPtyId = null
   } else if (ctx.pendingRegistrationPtyId) {
     ctx.deps.runtime?.cancelPendingPtyRegistration?.(
@@ -131,6 +99,15 @@ export async function commitPtyIpcSpawn(ctx: PtyIpcSpawnState): Promise<PtySpawn
     )
     ctx.pendingRegistrationPtyId = null
   }
+  publishPtyIpcSpawnCommit(ctx, committedSize)
+  // Admission must precede reflow: a replaced spawn cannot resize its successor's model.
+  reflowHeadlessTerminalToCommittedGrid({
+    result: ctx.result,
+    committedSize,
+    reflowHeadlessTerminalToPtyGrid: ctx.deps.runtime?.reflowHeadlessTerminalToPtyGrid?.bind(
+      ctx.deps.runtime
+    )
+  })
   // Why: seed after registerPty binds the worktree — including on
   // desktop, where the renderer-authority gate above skips the emulator
   // seed but the list/read records still live main-side.
@@ -201,17 +178,7 @@ export async function commitPtyIpcSpawn(ctx: PtyIpcSpawnState): Promise<PtySpawn
   }
   // Why: telemetry-plan.md§Agent launch semantics — fire agent_started only after spawn resolved; safeParse each field so a spoofed IPC payload can't poison the event (missing required field skips it).
   if (args.telemetry && !ctx.stablePaneOwner) {
-    const agentKindParse = agentKindSchema.safeParse(args.telemetry.agent_kind)
-    const launchSourceParse = launchSourceSchema.safeParse(args.telemetry.launch_source)
-    const requestKindParse = requestKindSchema.safeParse(args.telemetry.request_kind)
-    if (agentKindParse.success && launchSourceParse.success && requestKindParse.success) {
-      track('agent_started', {
-        agent_kind: agentKindParse.data,
-        launch_source: launchSourceParse.data,
-        request_kind: requestKindParse.data,
-        ...getCohortAtEmit()
-      })
-    }
+    recordPtySpawnTelemetry(args.telemetry)
   }
   const response = {
     ...ctx.result,
diff --git a/src/main/ipc/pty/ipc/write-input-chunk-yield.test.ts b/src/main/ipc/pty/ipc/write-input-chunk-yield.test.ts
index ceeb5127b7df..4afd2b008f17 100644
--- a/src/main/ipc/pty/ipc/write-input-chunk-yield.test.ts
+++ b/src/main/ipc/pty/ipc/write-input-chunk-yield.test.ts
@@ -68,7 +68,7 @@ describe('chunked pty write yield', () => {
     }) as typeof setImmediate)
 
     const outcome = await Promise.race([
-      createWriteInput()({ id: PTY_ID, data: THREE_CHUNK_INPUT }),
+      createWriteInput()({ inputKind: 'driving', id: PTY_ID, data: THREE_CHUNK_INPUT }),
       afterImmediateTurns(50)
     ])
 
@@ -88,6 +88,7 @@ describe('chunked pty write yield', () => {
     const immediate = vi.spyOn(globalThis, 'setImmediate')
 
     const outcome = createWriteInput()({
+      inputKind: 'driving',
       id: PTY_ID,
       data: 'x'.repeat(TERMINAL_INPUT_CHUNK_MAX_BYTES)
     })
diff --git a/src/main/ipc/pty/ipc/write-input-user-input.test.ts b/src/main/ipc/pty/ipc/write-input-user-input.test.ts
new file mode 100644
index 000000000000..d4f20f00a680
--- /dev/null
+++ b/src/main/ipc/pty/ipc/write-input-user-input.test.ts
@@ -0,0 +1,63 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { TerminalRunFactsRegister } from '../../../runtime/terminal-run-facts'
+import { ptyOwnership } from '../provider/ownership-state'
+import { createPtyWriteInput } from './write-input'
+
+const PTY_ID = 'pty-user-input'
+
+const { provider } = vi.hoisted(() => ({
+  provider: { write: vi.fn(), hasPty: vi.fn(() => true) }
+}))
+
+vi.mock('../provider/registry', () => ({
+  tryGetProviderForPty: (id: string) => (id === PTY_ID ? provider : undefined)
+}))
+
+function createWriteInput(facts: TerminalRunFactsRegister) {
+  const runtime = { getDriver: () => ({ kind: 'desktop' }), terminalRunFacts: facts }
+  const mainWindow = { isDestroyed: () => false, webContents: { send: vi.fn() } }
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: write input reads only getDriver and terminalRunFacts from the runtime, and isDestroyed/webContents from the window.
+  return createPtyWriteInput({ mainWindow: mainWindow as never, runtime: runtime as never })
+}
+
+beforeEach(() => {
+  ptyOwnership.set(PTY_ID, null)
+  provider.write.mockReset()
+})
+
+afterEach(() => {
+  ptyOwnership.delete(PTY_ID)
+})
+
+describe('renderer PTY writes: input kind', () => {
+  it.each(['writePtyInput', 'writePtyInputAccepted'] as const)(
+    '%s records driving input before the provider write',
+    async (writer) => {
+      const facts = new TerminalRunFactsRegister()
+      facts.recordSpawnCommit({ id: PTY_ID, incarnationId: 'inc-1' })
+      const recordedAtWrite: (number | null)[] = []
+      provider.write.mockImplementation(() => {
+        recordedAtWrite.push(facts.read(PTY_ID, 'inc-1').firstUserInputAt)
+      })
+
+      await createWriteInput(facts)[writer]({ id: PTY_ID, data: 'exit\r', inputKind: 'driving' })
+
+      expect(recordedAtWrite).toEqual([expect.any(Number)])
+    }
+  )
+
+  it.each([
+    ['a launch write', 'launch', 'echo startup\r'],
+    ['a query reply', 'query-reply', '\x1b[3;4R'],
+    ['a driving write that is only a reply', 'driving', '\x1b[3;4R'],
+    ['a driving write that is only focus reports', 'driving', '\x1b[I\x1b[O']
+  ] as const)('records nothing for %s', async (_label, inputKind, data) => {
+    const facts = new TerminalRunFactsRegister()
+    facts.recordSpawnCommit({ id: PTY_ID, incarnationId: 'inc-1' })
+
+    await createWriteInput(facts).writePtyInput({ id: PTY_ID, data, inputKind })
+
+    expect(provider.write).toHaveBeenCalledOnce()
+    expect(facts.read(PTY_ID, 'inc-1').firstUserInputAt).toBeNull()
+  })
+})
diff --git a/src/main/ipc/pty/ipc/write-input.ts b/src/main/ipc/pty/ipc/write-input.ts
index c7348ddfaeff..2f8ea72cd9b0 100644
--- a/src/main/ipc/pty/ipc/write-input.ts
+++ b/src/main/ipc/pty/ipc/write-input.ts
@@ -1,4 +1,5 @@
-import type { BrowserWindow, IpcMainEvent, IpcMainInvokeEvent, WebContents } from 'electron'
+import type { IpcMainEvent, IpcMainInvokeEvent } from 'electron'
+import type { PtyRendererDelivery } from '../session'
 import type { OrcaRuntimeService } from '../../../runtime/orca-runtime'
 import type { IPtyProvider } from '../../../providers/types'
 import { isPtyWriteUnavailableError } from '../../../providers/pty-write-unavailable-error'
@@ -8,41 +9,42 @@ import {
 } from '../../../../shared/terminal-input'
 import { ptyOwnership } from '../provider/ownership-state'
 import { tryGetProviderForPty } from '../provider/registry'
+import type { TerminalInputKind } from '../../../../shared/terminal-input-kind'
 import { interactiveOutputCharsByPty, lastInputAtByPty } from '../delivery/visibility-state'
 
 export function isMainWindowPtyIpcEvent(
   event: IpcMainEvent | IpcMainInvokeEvent,
-  mainWindow: BrowserWindow,
-  mainWebContents: WebContents
+  mainWindow: PtyRendererDelivery | undefined
 ): boolean {
+  const mainWebContents = mainWindow?.webContents
   return (
+    !!mainWindow &&
+    !!mainWebContents &&
     event.sender === mainWebContents &&
     !mainWindow.isDestroyed() &&
     !(typeof mainWebContents.isDestroyed === 'function' && mainWebContents.isDestroyed())
   )
 }
 
-export type PtyWritePayload = { id: string; data: string }
+export type PtyWritePayload = { id: string; data: string; inputKind: TerminalInputKind }
 export type PtyViewportClaimPayload = { id: string; cols: number; rows: number }
 
 export function createPtyWriteInput(deps: {
-  mainWindow: BrowserWindow
+  mainWindow?: PtyRendererDelivery
   runtime?: OrcaRuntimeService
 }): {
   writePtyInput: (args: PtyWritePayload) => boolean | Promise<boolean>
   writePtyInputAccepted: (args: PtyWritePayload) => boolean | Promise<boolean>
   isPtyWritePayload: (value: unknown) => value is PtyWritePayload
   isPtyViewportClaimPayload: (value: unknown) => value is PtyViewportClaimPayload
-  isPtyWriteEventFromMainWindow: (
-    event: IpcMainEvent | IpcMainInvokeEvent,
-    mainWebContents: WebContents
-  ) => boolean
+  isPtyWriteEventFromMainWindow: (event: IpcMainEvent | IpcMainInvokeEvent) => boolean
 } {
   const { mainWindow, runtime } = deps
 
   const reportUnavailablePtyWrite = (id: string, error: unknown): void => {
     if (
       !isPtyWriteUnavailableError(error) ||
+      !mainWindow ||
       mainWindow.isDestroyed() ||
       (typeof mainWindow.webContents.isDestroyed === 'function' &&
         mainWindow.webContents.isDestroyed())
@@ -144,10 +146,14 @@ export function createPtyWriteInput(deps: {
     (value as { cols: number }).cols > 0 &&
     (value as { rows: number }).rows > 0
 
-  const isPtyWriteEventFromMainWindow = (
-    event: IpcMainEvent | IpcMainInvokeEvent,
-    mainWebContents: WebContents
-  ): boolean => isMainWindowPtyIpcEvent(event, mainWindow, mainWebContents)
+  const isPtyWriteEventFromMainWindow = (event: IpcMainEvent | IpcMainInvokeEvent): boolean =>
+    isMainWindowPtyIpcEvent(event, mainWindow)
+
+  const noteRendererPtyInput = (args: PtyWritePayload): void => {
+    lastInputAtByPty.set(args.id, performance.now())
+    interactiveOutputCharsByPty.set(args.id, 0)
+    runtime?.terminalRunFacts?.recordInput(args.id, args.inputKind, args.data)
+  }
 
   const writePtyInput = (args: PtyWritePayload): boolean | Promise<boolean> => {
     // Why: mobile-presence-lock defense-in-depth — the renderer's onData guard can let one keystroke slip during the state-flip lag, so catch it server-side. See docs/mobile-presence-lock.md.
@@ -159,9 +165,7 @@ export function createPtyWriteInput(deps: {
       return false
     }
     try {
-      const now = performance.now()
-      lastInputAtByPty.set(args.id, now)
-      interactiveOutputCharsByPty.set(args.id, 0)
+      noteRendererPtyInput(args)
       return writePtyProviderInput(provider, args.id, args.data)
     } catch {
       return false
@@ -181,9 +185,7 @@ export function createPtyWriteInput(deps: {
       return false
     }
     try {
-      const now = performance.now()
-      lastInputAtByPty.set(args.id, now)
-      interactiveOutputCharsByPty.set(args.id, 0)
+      noteRendererPtyInput(args)
       return writePtyProviderInput(provider, args.id, args.data)
     } catch {
       return false
diff --git a/src/main/ipc/pty/ipc/write.ts b/src/main/ipc/pty/ipc/write.ts
index 62adcd02113d..04065921d074 100644
--- a/src/main/ipc/pty/ipc/write.ts
+++ b/src/main/ipc/pty/ipc/write.ts
@@ -1,14 +1,14 @@
-import type { BrowserWindow } from 'electron'
+import type { PtyRendererDelivery } from '../session'
 import { getPtyIpc } from '../../pty-host-bindings'
 import type { OrcaRuntimeService } from '../../../runtime/orca-runtime'
 import { createPtyWriteInput } from './write-input'
 
 export function installPtyWriteIpcHandlers(deps: {
-  mainWindow: BrowserWindow
+  mainWindow?: PtyRendererDelivery
   runtime?: OrcaRuntimeService
 }): void {
   const ipcMain = getPtyIpc()
-  const { mainWindow, runtime } = deps
+  const { runtime } = deps
   const {
     writePtyInput,
     writePtyInputAccepted,
@@ -20,7 +20,7 @@ export function installPtyWriteIpcHandlers(deps: {
   const hostViewportClaimTails = new Map<string, Promise<boolean>>()
 
   ipcMain.on('pty:write', (event, args: unknown) => {
-    if (!isPtyWriteEventFromMainWindow(event, mainWindow.webContents) || !isPtyWritePayload(args)) {
+    if (!isPtyWriteEventFromMainWindow(event) || !isPtyWritePayload(args)) {
       return
     }
     const claimTail = hostViewportClaimTails.get(args.id)
@@ -31,7 +31,7 @@ export function installPtyWriteIpcHandlers(deps: {
     writePtyInput(args)
   })
   ipcMain.handle('pty:writeAccepted', (event, args: unknown): boolean | Promise<boolean> => {
-    if (!isPtyWriteEventFromMainWindow(event, mainWindow.webContents) || !isPtyWritePayload(args)) {
+    if (!isPtyWriteEventFromMainWindow(event) || !isPtyWritePayload(args)) {
       return false
     }
     const claimTail = hostViewportClaimTails.get(args.id)
@@ -42,11 +42,7 @@ export function installPtyWriteIpcHandlers(deps: {
 
   ipcMain.removeAllListeners('pty:claimViewport')
   ipcMain.on('pty:claimViewport', (event, args: unknown) => {
-    if (
-      !isPtyWriteEventFromMainWindow(event, mainWindow.webContents) ||
-      !runtime ||
-      !isPtyViewportClaimPayload(args)
-    ) {
+    if (!isPtyWriteEventFromMainWindow(event) || !runtime || !isPtyViewportClaimPayload(args)) {
       return
     }
     const prior = hostViewportClaimTails.get(args.id)
diff --git a/src/main/ipc/pty/pane/spawn-registration.ts b/src/main/ipc/pty/pane/spawn-registration.ts
new file mode 100644
index 000000000000..d96154f7df86
--- /dev/null
+++ b/src/main/ipc/pty/pane/spawn-registration.ts
@@ -0,0 +1,81 @@
+import type { Store } from '../../../persistence'
+import type { OrcaRuntimeService } from '../../../runtime/orca-runtime'
+import type { IPtyProvider, PtySpawnResult } from '../../../providers/types'
+import { isCurrentPtyExit, ptyIncarnationById, ptyOwnership } from '../provider/ownership-state'
+import { clearProviderPtyState } from '../provider/state-cleanup'
+import { retirePersistedStablePaneOwner } from './stable-owner'
+
+export function admitPtyReattachOwnership(
+  runtime: OrcaRuntimeService | undefined,
+  result: PtySpawnResult,
+  connectionId: string | null | undefined
+): void {
+  if (!result.isReattach && result.agentSessionEnsure?.disposition !== 'adopted') {
+    return
+  }
+  runtime?.assertPtyRegistrationAllowed?.(result.id, result.incarnationId)
+  // A failed local save must not strand a live process already admitted by its host.
+  ptyOwnership.set(result.id, connectionId ?? ptyOwnership.get(result.id) ?? null)
+  if (result.incarnationId) {
+    ptyIncarnationById.set(result.id, result.incarnationId)
+  }
+}
+
+export async function discardUnpersistedPtySpawn(
+  provider: IPtyProvider,
+  result: PtySpawnResult,
+  onDiscarded?: () => void
+): Promise<void> {
+  if (
+    result.isReattach ||
+    result.agentSessionEnsure?.disposition === 'adopted' ||
+    !isCurrentPtyExit(result)
+  ) {
+    return
+  }
+  try {
+    await provider.shutdown(result.id, {
+      immediate: true,
+      ...(result.incarnationId ? { expectedIncarnationId: result.incarnationId } : {})
+    })
+  } catch (error) {
+    console.warn('[pty] failed to clean up PTY after persistence failure:', error)
+  }
+  // A replacement may arrive while the execution host finishes shutting down the predecessor.
+  if (isCurrentPtyExit(result)) {
+    clearProviderPtyState(result.id)
+    ptyOwnership.delete(result.id)
+    onDiscarded?.()
+  }
+}
+
+// Successful registration must not yield before the remaining spawn publication.
+export function registerPersistedPtySpawn(
+  runtime: OrcaRuntimeService | undefined,
+  store: Store | undefined,
+  ...args: Parameters<OrcaRuntimeService['registerPty']>
+): Promise<never> | undefined {
+  try {
+    runtime?.registerPty(...args)
+  } catch (error) {
+    const [ptyId, worktreeId, connectionId, binding] = args
+    // An exit during the binding write precedes runtime surface registration.
+    if (
+      error instanceof Error &&
+      error.message === 'agent_session_exited_during_start' &&
+      runtime?.getPtyLivenessVerdict?.(ptyId)?.status === 'exited' &&
+      binding
+    ) {
+      return retirePersistedStablePaneOwner(
+        store,
+        { ...binding, ptyId, persistedIncarnationId: binding.incarnationId },
+        worktreeId,
+        connectionId
+      ).then(() => {
+        throw error
+      })
+    }
+    throw error
+  }
+  return undefined
+}
diff --git a/src/main/ipc/pty/pane/spawn-telemetry.ts b/src/main/ipc/pty/pane/spawn-telemetry.ts
new file mode 100644
index 000000000000..ccd3c3d582d5
--- /dev/null
+++ b/src/main/ipc/pty/pane/spawn-telemetry.ts
@@ -0,0 +1,24 @@
+import { track } from '../../../telemetry/client'
+import { getCohortAtEmit } from '../../../telemetry/cohort-classifier'
+import {
+  agentKindSchema,
+  launchSourceSchema,
+  requestKindSchema
+} from '../../../../shared/telemetry-events'
+import type { PtySpawnIpcArgs } from '../ipc/spawn-types'
+
+export function recordPtySpawnTelemetry(
+  telemetry: NonNullable<PtySpawnIpcArgs['telemetry']>
+): void {
+  const agentKind = agentKindSchema.safeParse(telemetry.agent_kind)
+  const launchSource = launchSourceSchema.safeParse(telemetry.launch_source)
+  const requestKind = requestKindSchema.safeParse(telemetry.request_kind)
+  if (agentKind.success && launchSource.success && requestKind.success) {
+    track('agent_started', {
+      agent_kind: agentKind.data,
+      launch_source: launchSource.data,
+      request_kind: requestKind.data,
+      ...getCohortAtEmit()
+    })
+  }
+}
diff --git a/src/main/ipc/pty/pane/stable-owner.ts b/src/main/ipc/pty/pane/stable-owner.ts
index 5d25e11f57cb..83ebdd50364d 100644
--- a/src/main/ipc/pty/pane/stable-owner.ts
+++ b/src/main/ipc/pty/pane/stable-owner.ts
@@ -1,3 +1,5 @@
+import { rollbackWorkspaceSessionAfterFailedAsyncWrite } from '../../../persistence/restoring-sessions/workspace-session-write-rollback'
+import { cloneWorkspaceSessionState } from '../../../persistence/restoring-sessions/session-owner-fields'
 import { toSshExecutionHostId } from '../../../../shared/execution-host'
 import { makePaneKey, parsePaneKey } from '../../../../shared/stable-pane-id'
 import { UNVERIFIED_PROCESS_EXIT_CODE } from '../../../../shared/terminal-exit-cause'
@@ -98,8 +100,7 @@ export function resolveStablePaneOwner(
   }
   const registeredConnectionId = ptyOwnership.get(ptyId)
   const parsedSshId = registeredConnectionId === undefined ? parseAppSshPtyId(ptyId) : null
-  const ownerConnectionId = registeredConnectionId ?? parsedSshId?.connectionId ?? null
-  if (ownerConnectionId !== (connectionId ?? null)) {
+  if ((registeredConnectionId ?? parsedSshId?.connectionId ?? null) !== (connectionId ?? null)) {
     throw new Error('terminal_pane_owner_host_mismatch')
   }
   const runtimeIncarnationId = ptyIncarnationById.get(ptyId)
@@ -121,41 +122,50 @@ export function resolveStablePaneOwner(
   }
 }
 
-export function retirePersistedStablePaneOwner(
+export async function retirePersistedStablePaneOwner(
   store: Store | undefined,
   owner: StablePaneOwner,
   worktreeId: string,
   connectionId: string | null | undefined
-): boolean {
+): Promise<boolean> {
   if (!store) {
     return false
   }
-  const paneKey = makePaneKey(owner.tabId, owner.leafId)
-  const hostId = connectionId ? toSshExecutionHostId(connectionId) : undefined
-  const current = resolvePersistedStablePaneOwner(store, paneKey, worktreeId, connectionId)
-  if (!current) {
-    // Why: persistence already dropped this pane binding (an earlier stop retired it while the
-    // runtime kept history), so there is nothing left to clear — that is a completed retirement,
-    // not a competing owner. Reporting failure here strands the pane after its PTY is proven dead.
-    return true
-  }
-  if (current.ptyId !== owner.ptyId || current.incarnationId !== owner.persistedIncarnationId) {
-    return false
-  }
-  const session = store.getWorkspaceSession(hostId)
-  const retired = retireTerminalSurfaceFromPersistence(session, {
-    worktreeId,
-    parentTabId: owner.tabId,
-    leafId: owner.leafId,
-    ptyId: owner.ptyId,
-    ...(current.incarnationId ? { incarnationId: current.incarnationId } : {})
+  return store.runDurableMutation(() => {
+    const paneKey = makePaneKey(owner.tabId, owner.leafId)
+    const hostId = connectionId ? toSshExecutionHostId(connectionId) : undefined
+    const current = resolvePersistedStablePaneOwner(store, paneKey, worktreeId, connectionId)
+    if (!current) {
+      // A renderer removal may still be waiting for its debounced write.
+      return { value: true, persist: 'if-dirty' }
+    }
+    if (current.ptyId !== owner.ptyId || current.incarnationId !== owner.persistedIncarnationId) {
+      return { value: false, persist: false }
+    }
+    const session = cloneWorkspaceSessionState(store.getWorkspaceSession(hostId))
+    const retired = retireTerminalSurfaceFromPersistence(session, {
+      worktreeId,
+      parentTabId: owner.tabId,
+      leafId: owner.leafId,
+      ptyId: owner.ptyId,
+      ...(current.incarnationId ? { incarnationId: current.incarnationId } : {})
+    })
+    if (retired === session) {
+      return { value: false, persist: false }
+    }
+    store.setWorkspaceSession(retired, hostId)
+    const staged = cloneWorkspaceSessionState(store.getWorkspaceSession(hostId))
+    return {
+      value: true,
+      rollback: () => {
+        const current = store.getWorkspaceSession(hostId)
+        const rolledBack = rollbackWorkspaceSessionAfterFailedAsyncWrite(session, staged, current)
+        if (rolledBack !== current) {
+          store.setWorkspaceSession(rolledBack, hostId)
+        }
+      }
+    }
   })
-  if (retired === session) {
-    return false
-  }
-  store.setWorkspaceSession(retired, hostId)
-  store.flushOrThrow()
-  return true
 }
 
 export type StablePaneSpawnContext = {
@@ -181,19 +191,19 @@ export function stablePanePersistenceFence(
     : undefined
 }
 
-export function persistAdmittedStablePaneBinding(args: {
+export async function persistAdmittedStablePaneBinding(args: {
   store: Store | undefined
   owner: StablePaneOwner | null
   result: PtySpawnResult
   worktreeId: string | undefined
   startupCwd: string | undefined
   connectionId: string | null | undefined
-}): boolean {
+}): Promise<boolean> {
   const expectedBinding = stablePanePersistenceFence(args.owner)
   if (!args.store || !args.owner || !args.worktreeId || !expectedBinding) {
     return false
   }
-  const persisted = args.store.persistPtyBinding(
+  const persisted = await args.store.persistPtyBinding(
     {
       worktreeId: args.worktreeId,
       tabId: args.owner.tabId,
@@ -270,7 +280,7 @@ export async function attachStablePaneOwner(
     ptyOwnership.delete(owner.ptyId)
     if (
       args.worktreeId &&
-      !retirePersistedStablePaneOwner(args.store, owner, args.worktreeId, args.connectionId)
+      !(await retirePersistedStablePaneOwner(args.store, owner, args.worktreeId, args.connectionId))
     ) {
       throw new Error('terminal_pane_owner_changed')
     }
diff --git a/src/main/ipc/pty/pane/stable-pane-absence-death-certificate.test.ts b/src/main/ipc/pty/pane/stable-pane-absence-death-certificate.test.ts
index 972f479b4927..390bcdd451a2 100644
--- a/src/main/ipc/pty/pane/stable-pane-absence-death-certificate.test.ts
+++ b/src/main/ipc/pty/pane/stable-pane-absence-death-certificate.test.ts
@@ -9,6 +9,7 @@
 // same rule here, and pin that the marked half — the one refusal the relay backed with a pid probe
 // — still earns the certificate, so a genuinely dead PTY is not left `unverifiable` forever.
 import { describe, expect, it, vi } from 'vitest'
+import { withDurableRuntimeStore } from '../../../runtime/runtime-durable-store-fixture'
 import { getDefaultWorkspaceSession } from '../../../../shared/constants'
 import { makePaneKey } from '../../../../shared/stable-pane-id'
 import { SSH_EXIT_UNCONFIRMED_REASON } from '../../../../shared/pty-liveness-verdict'
@@ -54,7 +55,8 @@ function paneStore(): { store: Store; read: () => WorkspaceSessionState } {
   } as unknown as WorkspaceSessionState
   return {
     read: () => session,
-    store: {
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: This fixture supplies the persistence methods used by stable-pane retirement and exit bookkeeping.
+    store: withDurableRuntimeStore({
       getWorkspaceSession: () => session,
       setWorkspaceSession: (next: WorkspaceSessionState) => {
         session = next
@@ -75,7 +77,7 @@ function paneStore(): { store: Store; read: () => WorkspaceSessionState } {
       removeWorktreeMeta: () => {},
       getSettings: () => ({ workspaceDir: '/tmp/workspaces' }),
       getProjects: () => []
-    } as unknown as Store
+    }) as unknown as Store
   }
 }
 
diff --git a/src/main/ipc/pty/pane/stable-pane-relay-absence-respawn.test.ts b/src/main/ipc/pty/pane/stable-pane-relay-absence-respawn.test.ts
index e68bcf6ec997..ce3c578cfa03 100644
--- a/src/main/ipc/pty/pane/stable-pane-relay-absence-respawn.test.ts
+++ b/src/main/ipc/pty/pane/stable-pane-relay-absence-respawn.test.ts
@@ -1,4 +1,5 @@
 import { describe, expect, it, vi } from 'vitest'
+import { withDurableRuntimeStore } from '../../../runtime/runtime-durable-store-fixture'
 import type { WorkspaceSessionState } from '../../../../shared/workspace-session-state-types'
 import { TerminalSessionOwnerUnverifiedError } from '../../../daemon/daemon-errors'
 import {
@@ -70,13 +71,14 @@ function sessionStore(leaves: string[]): { store: Store; read: () => WorkspaceSe
   } as unknown as WorkspaceSessionState
   return {
     read: () => session,
-    store: {
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: This fixture supplies every persistence method used by stable-pane retirement.
+    store: withDurableRuntimeStore({
       getWorkspaceSession: () => session,
       setWorkspaceSession: (next: WorkspaceSessionState) => {
         session = next
       },
       flushOrThrow: () => {}
-    } as unknown as Store
+    }) as unknown as Store
   }
 }
 
diff --git a/src/main/ipc/pty/pane/terminal-spawn-restore.ts b/src/main/ipc/pty/pane/terminal-spawn-restore.ts
new file mode 100644
index 000000000000..cbe3d337ae3f
--- /dev/null
+++ b/src/main/ipc/pty/pane/terminal-spawn-restore.ts
@@ -0,0 +1,46 @@
+import type { PtySpawnResult } from '../../../providers/types'
+import type { OrcaRuntimeService } from '../../../runtime/orca-runtime'
+import { pendingByPaneKey, rendererSerializerReadiness } from './serializer-state'
+
+export function seedHeadlessTerminalFromSpawnResult(
+  runtime: OrcaRuntimeService | undefined,
+  result: PtySpawnResult,
+  paneKey: string | null
+): void {
+  // A mounted renderer owns richer history than the provider snapshot.
+  if (
+    !runtime ||
+    (paneKey && pendingByPaneKey.has(paneKey)) ||
+    (result.isReattach === true && rendererSerializerReadiness.has(result.id))
+  ) {
+    return
+  }
+  if (typeof result.snapshot === 'string' && result.snapshot.length > 0) {
+    const size =
+      typeof result.snapshotCols === 'number' && typeof result.snapshotRows === 'number'
+        ? { cols: result.snapshotCols, rows: result.snapshotRows }
+        : undefined
+    runtime.seedHeadlessTerminal(result.id, result.snapshot, size, {
+      ...(typeof result.snapshotKittyKeyboardFlags === 'number'
+        ? { kittyKeyboardFlags: result.snapshotKittyKeyboardFlags }
+        : {}),
+      ...(result.snapshotTerminalOwner ? { terminalOwner: result.snapshotTerminalOwner } : {})
+    })
+  } else if (
+    result.coldRestore &&
+    typeof result.coldRestore.scrollback === 'string' &&
+    result.coldRestore.scrollback.length > 0
+  ) {
+    const size =
+      typeof result.coldRestore.cols === 'number' && typeof result.coldRestore.rows === 'number'
+        ? { cols: result.coldRestore.cols, rows: result.coldRestore.rows }
+        : undefined
+    runtime.seedHeadlessTerminal(result.id, result.coldRestore.scrollback, size, {
+      cwd: result.coldRestore.cwd,
+      oscLinks: result.coldRestore.oscLinks,
+      preferProviderIfExisting: true
+    })
+  } else if (typeof result.replay === 'string' && result.replay.length > 0) {
+    runtime.seedHeadlessTerminal(result.id, result.replay)
+  }
+}
diff --git a/src/main/ipc/pty/provider/bind-listeners.ts b/src/main/ipc/pty/provider/bind-listeners.ts
index 935d7f60432f..31bacec82f7f 100644
--- a/src/main/ipc/pty/provider/bind-listeners.ts
+++ b/src/main/ipc/pty/provider/bind-listeners.ts
@@ -28,6 +28,7 @@ export function bindProviderListeners(session: PtyIpcSession): void {
   setLocalWriteUnavailableUnsub(
     localProvider.onWriteUnavailable?.((payload) => {
       if (
+        !session.mainWindow ||
         session.mainWindow.isDestroyed() ||
         (typeof session.mainWindow.webContents.isDestroyed === 'function' &&
           session.mainWindow.webContents.isDestroyed())
diff --git a/src/main/ipc/pty/provider/listener-lifecycle.ts b/src/main/ipc/pty/provider/listener-lifecycle.ts
index 2b31257234ee..815749582f8b 100644
--- a/src/main/ipc/pty/provider/listener-lifecycle.ts
+++ b/src/main/ipc/pty/provider/listener-lifecycle.ts
@@ -1,4 +1,4 @@
-import type { WebContents } from 'electron'
+import type { PtyRendererDelivery } from '../session'
 
 // Why: localProvider.onData/onExit return unsubscribe functions. Without
 // storing and calling these on re-registration, macOS app re-activation
@@ -9,13 +9,13 @@ export let localExitUnsub: (() => void) | null = null
 export let localBackgroundStreamUnsub: (() => void) | null = null
 export let localWriteUnavailableUnsub: (() => void) | null = null
 export let didFinishLoadHandler: (() => void) | null = null
-export let didFinishLoadWebContents: WebContents | null = null
-export let rendererLifecycleResetWebContents: WebContents | null = null
+export let didFinishLoadWebContents: PtyRendererDelivery['webContents'] | null = null
+export let rendererLifecycleResetWebContents: PtyRendererDelivery['webContents'] | null = null
 export let rendererLifecycleResetHandler: (() => void) | null = null
 // Why: the hidden-delivery gate registries mirror renderer state; a reload/crash destroys owners without unregistering, so they reset when the renderer is replaced (drop memory preserved).
 export let rendererGateResetLoadHandler: (() => void) | null = null
 export let rendererGateResetGoneHandler: (() => void) | null = null
-export let rendererGateResetWebContents: WebContents | null = null
+export let rendererGateResetWebContents: PtyRendererDelivery['webContents'] | null = null
 // Why: the backgrounded-delivery dedupe map lives in the registerPtyHandlers closure but teardown funnels through module-scope clearProviderPtyState.
 // Why null-init + wrapper fn: see delivery/debug.ts — rolldown const-folds `export let fn = noop` bridges (STA-5661).
 let clearBackgroundedDeliverySyncForPtyImpl: ((id: string) => void) | null = null
@@ -72,14 +72,14 @@ export function setLocalWriteUnavailableUnsub(fn: (() => void) | null): void {
 
 export function setDidFinishLoadHandler(
   handler: (() => void) | null,
-  contents: WebContents | null
+  contents: PtyRendererDelivery['webContents'] | null
 ): void {
   didFinishLoadHandler = handler
   didFinishLoadWebContents = contents
 }
 
 export function setRendererLifecycleResetState(args: {
-  contents: WebContents | null
+  contents: PtyRendererDelivery['webContents'] | null
   handler: (() => void) | null
   navigation: ((details: RendererNavigationDetails) => void) | null
 }): void {
@@ -89,7 +89,7 @@ export function setRendererLifecycleResetState(args: {
 }
 
 export function setRendererGateResetState(args: {
-  contents: WebContents | null
+  contents: PtyRendererDelivery['webContents'] | null
   load: (() => void) | null
   gone: (() => void) | null
 }): void {
diff --git a/src/main/ipc/pty/register-handlers.ts b/src/main/ipc/pty/register-handlers.ts
index 7794a8ef60a4..5c7c897474a9 100644
--- a/src/main/ipc/pty/register-handlers.ts
+++ b/src/main/ipc/pty/register-handlers.ts
@@ -1,4 +1,3 @@
-import type { BrowserWindow } from 'electron'
 import { getAppEnvironment } from '../../../shared/app-environment'
 import type { OrcaRuntimeService } from '../../runtime/orca-runtime'
 import type { Store } from '../../persistence'
@@ -18,7 +17,6 @@ import {
   stopReplacedPanePty,
   type PtyKillIpcDeps
 } from './ipc/renderer-kill'
-import { markReplacedPtyStop } from './delivery/exit'
 import { installPtyWriteIpcHandlers } from './ipc/write'
 import { installPtySpawnIpcHandler } from './ipc/spawn'
 import { installPtyRuntimeController } from './runtime/controller'
@@ -48,7 +46,7 @@ import {
   clearRendererGateResetHandlers,
   clearDidFinishLoadHandler
 } from './delivery/lifecycle-reset'
-import { createPtyIpcSession, type PtyIpcSessionOptions } from './session'
+import { createPtyIpcSession, type PtyIpcSessionOptions, type PtyRendererDelivery } from './session'
 import { wirePtyIpcSession } from './delivery/wire-session'
 import { configureLocalPtyProvider } from './provider/local-configure'
 import { bindProviderListeners } from './provider/bind-listeners'
@@ -67,7 +65,7 @@ import {
 import { ensureLinuxTerminalOrcaCliShimDir } from '../../cli/linux-terminal-orca-cli-shim'
 
 export function registerPtyHandlers(
-  mainWindow: BrowserWindow,
+  mainWindow?: PtyRendererDelivery,
   runtime?: OrcaRuntimeService,
   getSelectedCodexHomePath?: GetSelectedCodexHomePath,
   getSettings?: () => GlobalSettings,
@@ -92,7 +90,7 @@ export function registerPtyHandlers(
   setInvalidatePendingPtyDrainPolicy(() => {})
   // Why: neutralize rebind at the same moment as drain so a daemon replace in this window cannot attach the old accept/exit closures.
   setRebindProviderListeners(() => {})
-  registerRendererLifecycleResetHandlers(mainWindow.webContents)
+  registerRendererLifecycleResetHandlers(mainWindow?.webContents)
 
   const getLocalPtyStartupPromise = (connectionId?: string | null): Promise<void> | undefined => {
     if (connectionId) {
@@ -169,17 +167,19 @@ export function registerPtyHandlers(
     // Why: the daemon pacer must not keep throttling ptys whose hidden marks died with the renderer; the fresh renderer's sync re-marks the still-hidden ones.
     session.resyncBackgroundedDeliveriesAfterGateReset()
   }
-  setRendererGateResetState({
-    contents: mainWindow.webContents,
-    load: resetRendererPtyDeliveryGateState,
-    gone: resetRendererPtyDeliveryGateState
-  })
-  mainWindow.webContents.on('did-finish-load', resetRendererPtyDeliveryGateState)
-  mainWindow.webContents.on('render-process-gone', resetRendererPtyDeliveryGateState)
+  if (mainWindow) {
+    setRendererGateResetState({
+      contents: mainWindow.webContents,
+      load: resetRendererPtyDeliveryGateState,
+      gone: resetRendererPtyDeliveryGateState
+    })
+    mainWindow.webContents.on('did-finish-load', resetRendererPtyDeliveryGateState)
+    mainWindow.webContents.on('render-process-gone', resetRendererPtyDeliveryGateState)
+  }
 
   // Why: only LocalPtyProvider PTYs (main-process) can be orphaned on reload; daemon sessions survive by design and cleanup would kill them.
   clearDidFinishLoadHandler()
-  if (localProvider instanceof LocalPtyProvider) {
+  if (mainWindow && localProvider instanceof LocalPtyProvider) {
     const lp = localProvider
     const finishLoadHandler = () => {
       // Why: always advance to keep the generation monotonic, but skip the sweep on crash/freeze-recovery reload — it would kill live local PTYs before session restore (#5787).
@@ -236,7 +236,6 @@ export function registerPtyHandlers(
     options,
     trustedTerminalHandleEnv: session.trustedTerminalHandleEnv,
     retiredRejectedPtyIds: session.retiredRejectedPtyIds,
-    reversibleStopOwnersByPtyId: session.reversibleStopOwnersByPtyId,
     mainWindow,
     transitionSpawnHiddenRendererPtyDeliveryState:
       session.transitionSpawnHiddenRendererPtyDeliveryState,
@@ -274,8 +273,7 @@ export function registerPtyHandlers(
     trustedTerminalHandleEnv: session.trustedTerminalHandleEnv,
     sendPtySpawnedToRenderer: session.sendPtySpawnedToRenderer,
     syncPtyBackgroundedDelivery: session.syncPtyBackgroundedDelivery,
-    stopReplacedPty: (id) =>
-      stopReplacedPanePty(killDeps, id, (ptyId) => markReplacedPtyStop(session, ptyId))
+    stopReplacedPty: (id) => stopReplacedPanePty(killDeps, id)
   })
   installPtyWriteIpcHandlers({ mainWindow, runtime })
   installPtyResizeVisibilityIpc(session)
diff --git a/src/main/ipc/pty/register-headless-runtime.test.ts b/src/main/ipc/pty/register-headless-runtime.test.ts
index 7063ec2454d1..a1b6f7234834 100644
--- a/src/main/ipc/pty/register-headless-runtime.test.ts
+++ b/src/main/ipc/pty/register-headless-runtime.test.ts
@@ -33,6 +33,7 @@ describe('registerHeadlessPtyRuntime', () => {
 
     expect(events).toEqual(['handlers', 'hydrate'])
     expect(registerHandlersMock).toHaveBeenCalledOnce()
+    expect(registerHandlersMock.mock.calls[0]?.[0]).toBeUndefined()
     expect(hydrateMock).toHaveBeenCalledWith(store)
 
     resolveHydration()
diff --git a/src/main/ipc/pty/register-headless-runtime.ts b/src/main/ipc/pty/register-headless-runtime.ts
index 2212fbfac3a3..424cb40facdb 100644
--- a/src/main/ipc/pty/register-headless-runtime.ts
+++ b/src/main/ipc/pty/register-headless-runtime.ts
@@ -1,4 +1,3 @@
-import type { BrowserWindow } from 'electron'
 import type { OrcaRuntimeService } from '../../runtime/orca-runtime'
 import type { Store } from '../../persistence'
 import type { GlobalSettings } from '../../../shared/global-settings-types'
@@ -23,21 +22,8 @@ export function registerHeadlessPtyRuntime(
     onPtyExit?: (id: string, exitSequence: number) => void
   }
 ): Promise<void> {
-  // Why: headless `orca serve` has no renderer window but still needs the same PTY handlers so remote clients can drive terminals.
-  // Why a fake rather than null: `registerPtyHandlers` takes a non-null BrowserWindow. `isDestroyed: () => true`
-  // is what makes that safe — every renderer-liveness guard reads it and skips, so no send is ever attempted.
-  // Keep `webContents.isDestroyed` in step with it: guards check both, and a missing method reads as "alive".
-  const headlessWindow = {
-    isDestroyed: () => true,
-    webContents: {
-      isDestroyed: () => true,
-      send: () => {},
-      on: () => {},
-      removeListener: () => {}
-    }
-  } as unknown as BrowserWindow
   registerPtyHandlers(
-    headlessWindow,
+    undefined,
     runtime,
     getSelectedCodexHomePath,
     getSettings,
diff --git a/src/main/ipc/pty/register-without-renderer.test.ts b/src/main/ipc/pty/register-without-renderer.test.ts
new file mode 100644
index 000000000000..a5d19f020fc0
--- /dev/null
+++ b/src/main/ipc/pty/register-without-renderer.test.ts
@@ -0,0 +1,231 @@
+import { EventEmitter } from 'node:events'
+import { describe, expect, it, vi } from 'vitest'
+import { OrcaRuntimeService } from '../../runtime/orca-runtime'
+import { setupPtyIpcSuite } from '../pty-ipc-test-harness'
+import {
+  getLocalPtyProvider,
+  getPtyRendererDeliveryDebugSnapshot,
+  registerPtyHandlers,
+  registerSshPtyProvider,
+  setPtyOwnership,
+  unregisterSshPtyProvider
+} from '../pty'
+import { registerHeadlessPtyRuntime } from './register-headless-runtime'
+import { onMock } from '../pty-ipc-mock-registry'
+
+vi.mock('electron', () => import('../pty-ipc-mock-registry').then((m) => m.electronModuleMock()))
+vi.mock('fs', () => import('../pty-ipc-mock-registry').then((m) => m.fsModuleMock()))
+vi.mock('node-pty', () => import('../pty-ipc-mock-registry').then((m) => m.nodePtyModuleMock()))
+vi.mock('node:child_process', async (importOriginal) =>
+  (await import('../pty-ipc-mock-registry')).childProcessModuleMock(await importOriginal())
+)
+vi.mock('../../opencode/hook-service', () =>
+  import('../pty-ipc-mock-registry').then((m) => m.openCodeHookServiceModuleMock())
+)
+vi.mock('../../mimo/hook-service', () =>
+  import('../pty-ipc-mock-registry').then((m) => m.mimoHookServiceModuleMock())
+)
+vi.mock('../../agent-hooks/server', () =>
+  import('../pty-ipc-mock-registry').then((m) => m.agentHookServerModuleMock())
+)
+vi.mock('../../pi/titlebar-extension-service', () =>
+  import('../pty-ipc-mock-registry').then((m) => m.piTitlebarExtensionModuleMock())
+)
+vi.mock('../../pwsh', () => import('../pty-ipc-mock-registry').then((m) => m.pwshModuleMock()))
+vi.mock('../../wsl', async (importOriginal) =>
+  (await import('../pty-ipc-mock-registry')).wslModuleMock(await importOriginal())
+)
+vi.mock('../../telemetry/client', () =>
+  import('../pty-ipc-mock-registry').then((m) => m.telemetryClientModuleMock())
+)
+vi.mock('../../telemetry/classify-error', () =>
+  import('../pty-ipc-mock-registry').then((m) => m.classifyErrorModuleMock())
+)
+vi.mock('../../cli/linux-terminal-orca-cli-shim', () =>
+  import('../pty-ipc-mock-registry').then((m) => m.linuxCliShimModuleMock())
+)
+vi.mock('../../memory/pty-registry', () =>
+  import('../pty-ipc-mock-registry').then((m) => m.ptyRegistryModuleMock())
+)
+vi.mock('../../agent-hooks/migration-unsupported-pty-state', () =>
+  import('../pty-ipc-mock-registry').then((m) => m.migrationUnsupportedPtyModuleMock())
+)
+vi.mock('../../codex/codex-pane-account-registry', () =>
+  import('../pty-ipc-mock-registry').then((m) => m.codexPaneAccountRegistryModuleMock())
+)
+vi.mock('../../codex/codex-state-db-backfill-recovery', () =>
+  import('../pty-ipc-mock-registry').then((m) => m.codexBackfillRecoveryModuleMock())
+)
+
+describe('PTY registration without renderer delivery', () => {
+  const {
+    handlers,
+    mainWindow,
+    mainWindowIpcEvent,
+    installObservableDaemonTestProvider,
+    getPtyWriteListener
+  } = setupPtyIpcSuite()
+
+  it('keeps daemon output and exits flowing to the runtime without renderer work', async () => {
+    vi.useFakeTimers()
+    const daemon = installObservableDaemonTestProvider()
+    const runtime = new OrcaRuntimeService()
+    const setController = vi.spyOn(runtime, 'setPtyController')
+    const onData = vi.spyOn(runtime, 'onPtyData').mockReturnValue(6)
+    const onExit = vi.spyOn(runtime, 'onPtyExit').mockImplementation(() => {})
+    const onLifecycleExit = vi.fn()
+    setPtyOwnership('daemon-pty', null)
+    const initialTimerCount = vi.getTimerCount()
+
+    await registerHeadlessPtyRuntime(
+      runtime,
+      undefined,
+      undefined,
+      undefined,
+      undefined,
+      undefined,
+      { onPtyExit: onLifecycleExit }
+    )
+    const controller = setController.mock.calls[0]?.[0]
+    expect(controller).toBeDefined()
+    expect(vi.getTimerCount()).toBe(initialTimerCount)
+    daemon.emitData('daemon-pty', 'output')
+    daemon.emitDataGap('daemon-pty', 3)
+    daemon.emitExit('daemon-pty', 0)
+
+    expect(onData).toHaveBeenCalledWith('daemon-pty', 'output', expect.any(Number), 6, undefined)
+    expect(onExit).toHaveBeenCalledWith('daemon-pty', 0, undefined, { providerExitObserved: true })
+    expect(onLifecycleExit).toHaveBeenCalledWith('daemon-pty', expect.any(Number))
+    await expect(controller?.serializeBuffer?.('daemon-pty')).resolves.toBeNull()
+    expect(getPtyRendererDeliveryDebugSnapshot()).toMatchObject({
+      pendingChars: 0,
+      rendererInFlightChars: 0,
+      flushScheduled: false,
+      diagnostics: { windowFocused: null, windowVisible: null, windowMinimized: null }
+    })
+    expect(mainWindow.webContents.on).not.toHaveBeenCalled()
+    expect(mainWindow.webContents.send).not.toHaveBeenCalled()
+    expect(daemon.pauseProducer).not.toHaveBeenCalled()
+  })
+
+  it('routes local and SSH control to their providers, including attach and buffer snapshots', async () => {
+    const remote = installObservableDaemonTestProvider()
+    const remoteProvider = getLocalPtyProvider()
+    registerSshPtyProvider('ssh-a', remoteProvider)
+    const local = installObservableDaemonTestProvider()
+    const localProvider = getLocalPtyProvider()
+    const localClear = vi.spyOn(localProvider, 'clearBuffer')
+    const remoteClear = vi.spyOn(remoteProvider, 'clearBuffer')
+    const attach = vi.spyOn(localProvider, 'attach').mockResolvedValue({})
+    const runtime = new OrcaRuntimeService()
+    const setController = vi.spyOn(runtime, 'setPtyController')
+    const remoteId = 'ssh:ssh-a@@remote-pty'
+    local.getBufferSnapshot.mockResolvedValue({ data: 'local history', cols: 80, rows: 24 })
+    remote.getBufferSnapshot.mockResolvedValue({ data: 'remote history', cols: 100, rows: 30 })
+    await registerHeadlessPtyRuntime(runtime)
+    const controller = setController.mock.calls[0]?.[0]
+    if (!controller) {
+      throw new Error('missing runtime PTY controller')
+    }
+
+    expect(controller.write('daemon-pty', 'local input', 'driving')).toBe(true)
+    expect(controller.write(remoteId, 'remote input', 'driving')).toBe(true)
+    await controller.clearBuffer?.('daemon-pty')
+    await controller.clearBuffer?.(remoteId)
+    await expect(controller.attach?.('daemon-pty')).resolves.toBe(true)
+    await expect(controller.attach?.(remoteId)).resolves.toBe(false)
+    await expect(controller.serializeProviderBuffer?.('daemon-pty')).resolves.toMatchObject({
+      data: 'local history'
+    })
+    await expect(controller.serializeProviderBuffer?.(remoteId)).resolves.toMatchObject({
+      data: 'remote history'
+    })
+    expect(local.write).toHaveBeenCalledExactlyOnceWith('daemon-pty', 'local input')
+    expect(remote.write).toHaveBeenCalledExactlyOnceWith(remoteId, 'remote input')
+    expect(localClear).toHaveBeenCalledExactlyOnceWith('daemon-pty')
+    expect(remoteClear).toHaveBeenCalledExactlyOnceWith(remoteId)
+    expect(attach).toHaveBeenCalledExactlyOnceWith('daemon-pty')
+
+    unregisterSshPtyProvider('ssh-a')
+    expect(controller.write(remoteId, 'disconnected input', 'driving')).toBe(false)
+    await expect(controller.probePtyLiveness?.(remoteId)).resolves.toBeNull()
+    expect(local.write).toHaveBeenCalledTimes(1)
+  })
+
+  it('rejects renderer input when no renderer owns the registration', async () => {
+    const daemon = installObservableDaemonTestProvider()
+    const runtime = new OrcaRuntimeService()
+    setPtyOwnership('daemon-pty', null)
+    await registerHeadlessPtyRuntime(runtime)
+
+    getPtyWriteListener()(mainWindowIpcEvent, { id: 'daemon-pty', data: 'untrusted' })
+    expect(
+      handlers.get('pty:writeAccepted')?.(mainWindowIpcEvent, {
+        id: 'daemon-pty',
+        data: 'untrusted'
+      })
+    ).toBe(false)
+    expect(daemon.write).not.toHaveBeenCalled()
+    expect(mainWindow.webContents.send).not.toHaveBeenCalled()
+  })
+
+  it('detaches desktop lifecycle listeners and restores delivery after headless re-registration', async () => {
+    vi.useFakeTimers()
+    const daemon = installObservableDaemonTestProvider()
+    const provider = getLocalPtyProvider()
+    const subscribe = vi.mocked(provider.onData).getMockImplementation()
+    if (!subscribe) {
+      throw new Error('missing daemon data subscription')
+    }
+    const unsubscribe = vi.fn()
+    const onDataSubscribe = vi.spyOn(provider, 'onData').mockImplementation((listener) => {
+      const dispose = subscribe(listener)
+      return () => {
+        unsubscribe()
+        dispose()
+      }
+    })
+    const runtime = new OrcaRuntimeService()
+    const onData = vi.spyOn(runtime, 'onPtyData').mockReturnValue(6)
+    const rendererEvents = new EventEmitter()
+    mainWindow.webContents.on.mockImplementation((event, listener) =>
+      rendererEvents.on(event, listener)
+    )
+    mainWindow.webContents.removeListener.mockImplementation((event, listener) =>
+      rendererEvents.removeListener(event, listener)
+    )
+    const renderer = {
+      ...mainWindow,
+      webContents: Object.assign(mainWindow.webContents, { id: 1 })
+    }
+    registerPtyHandlers(renderer, runtime)
+    expect(rendererEvents.listenerCount('did-finish-load')).toBe(1)
+    expect(rendererEvents.listenerCount('render-process-gone')).toBe(2)
+
+    await registerHeadlessPtyRuntime(runtime)
+    expect(rendererEvents.eventNames()).toEqual([])
+    expect(onDataSubscribe).toHaveBeenCalledTimes(2)
+    expect(unsubscribe).toHaveBeenCalledOnce()
+    mainWindow.webContents.send.mockClear()
+    daemon.emitData('daemon-pty', 'output')
+    vi.advanceTimersByTime(20)
+    expect(onData).toHaveBeenCalledTimes(1)
+    expect(mainWindow.webContents.send).not.toHaveBeenCalled()
+
+    registerPtyHandlers(renderer, runtime)
+    expect(unsubscribe).toHaveBeenCalledTimes(2)
+    const ready = onMock.mock.calls.findLast(
+      ([channel]) => channel === 'pty:rendererDispatcherReady'
+    )?.[1]
+    ready(mainWindowIpcEvent)
+    daemon.emitData('daemon-pty', 'output')
+    vi.advanceTimersByTime(20)
+    expect(onData).toHaveBeenCalledTimes(2)
+    expect(rendererEvents.listenerCount('did-finish-load')).toBe(1)
+    expect(rendererEvents.listenerCount('render-process-gone')).toBe(2)
+    expect(mainWindow.webContents.send).toHaveBeenCalledWith(
+      'pty:data',
+      expect.objectContaining({ id: 'daemon-pty', data: 'output' })
+    )
+  })
+})
diff --git a/src/main/ipc/pty/runtime/controller-deps.ts b/src/main/ipc/pty/runtime/controller-deps.ts
index db55b637e57a..e1bfd5d7f104 100644
--- a/src/main/ipc/pty/runtime/controller-deps.ts
+++ b/src/main/ipc/pty/runtime/controller-deps.ts
@@ -1,4 +1,4 @@
-import type { BrowserWindow } from 'electron'
+import type { PtyRendererDelivery } from '../session'
 import type { OrcaRuntimeService } from '../../../runtime/orca-runtime'
 import type { Store } from '../../../persistence'
 import type { IPtyProvider } from '../../../providers/types'
@@ -82,8 +82,7 @@ export type PtyRuntimeControllerDeps = {
   }
   trustedTerminalHandleEnv: Set<string>
   retiredRejectedPtyIds: Map<string, NodeJS.Timeout>
-  reversibleStopOwnersByPtyId: Map<string, number>
-  mainWindow: BrowserWindow
+  mainWindow?: PtyRendererDelivery
   transitionSpawnHiddenRendererPtyDeliveryState?: (id: string, hidden: boolean) => void
   syncPtyBackgroundedDelivery?: (id: string, caller: string) => void
 }
diff --git a/src/main/ipc/pty/runtime/controller.ts b/src/main/ipc/pty/runtime/controller.ts
index 8512bc7c16bc..75ff168a6460 100644
--- a/src/main/ipc/pty/runtime/controller.ts
+++ b/src/main/ipc/pty/runtime/controller.ts
@@ -4,7 +4,6 @@ import type { PtyRuntimeControllerDeps } from './controller-deps'
 import { spawnPtyFromRuntimeController } from './spawn'
 import {
   killPtyFromRuntimeController,
-  markReversibleStopsFromRuntimeController,
   retireRejectedPtyFromRuntimeController,
   stopAndWaitPtyFromRuntimeController
 } from './kill'
@@ -27,6 +26,7 @@ import {
   waitForRendererSerializerFromRuntimeController,
   writePtyFromRuntimeController
 } from './operations'
+import { recordUnconfirmedExplicitSshStop } from './undelivered-ssh-kill'
 import { supportsForegroundProcessEvidenceFromRuntimeController } from './foreground-process-evidence-capability'
 import {
   listProcessesFromRuntimeController,
@@ -44,9 +44,9 @@ export function installPtyRuntimeController(deps: PtyRuntimeControllerDeps): voi
     },
     adoptStablePane,
     spawn: async (args) => spawnPtyFromRuntimeController(deps, args),
-    write: (ptyId, data) => writePtyFromRuntimeController(ptyId, data),
-    writeWithSettlement: (ptyId, data) =>
-      writePtyFromRuntimeController(ptyId, data, { waitForSettlement: true }),
+    write: (ptyId, data, inputKind) => writePtyFromRuntimeController(deps, ptyId, data, inputKind),
+    writeWithSettlement: (ptyId, data, inputKind) =>
+      writePtyFromRuntimeController(deps, ptyId, data, inputKind, { waitForSettlement: true }),
     probePtyLiveness: (ptyId) => probePtyLivenessFromRuntimeController(deps, ptyId),
     // Why: subscriber-driven ingestion for daemon sessions no renderer pane
     // ever attached. Local daemon sessions only — SSH panes have their own
@@ -56,8 +56,13 @@ export function installPtyRuntimeController(deps: PtyRuntimeControllerDeps): voi
     kill: (ptyId) => killPtyFromRuntimeController(deps, ptyId),
     retireRejectedPty: (ptyId, stopConfirmed) =>
       retireRejectedPtyFromRuntimeController(deps, ptyId, stopConfirmed),
-    markReversibleStops: (ptyIds) => markReversibleStopsFromRuntimeController(deps, ptyIds),
     stopAndWait: (ptyId, opts) => stopAndWaitPtyFromRuntimeController(deps, ptyId, opts),
+    recordUnconfirmedStop: (ptyId) =>
+      recordUnconfirmedExplicitSshStop({
+        store: deps.store,
+        ptyId,
+        reversible: runtime?.intentionalPtyStops?.isReversibleStopInFlight(ptyId) ?? false
+      }),
     getForegroundProcess: (ptyId) => getForegroundProcessFromRuntimeController(ptyId),
     inspectProcess: (ptyId, options) => inspectProcessFromRuntimeController(ptyId, options),
     confirmForegroundProcess: (ptyId) => confirmForegroundProcessFromRuntimeController(ptyId),
diff --git a/src/main/ipc/pty/runtime/kill.ts b/src/main/ipc/pty/runtime/kill.ts
index 98bdc1e97aef..edbd12b0b182 100644
--- a/src/main/ipc/pty/runtime/kill.ts
+++ b/src/main/ipc/pty/runtime/kill.ts
@@ -19,8 +19,7 @@ export function killPtyFromRuntimeController(
     rememberSyntheticKillExit,
     sendPtyExitToRenderer,
     finishPtyShutdown,
-    retiredRejectedPtyIds,
-    reversibleStopOwnersByPtyId
+    retiredRejectedPtyIds
   } = deps
   runtime?.markPtyStopRequested?.(ptyId)
   let connectionId: string | null | undefined = ptyOwnership.get(ptyId)
@@ -31,7 +30,7 @@ export function killPtyFromRuntimeController(
       store,
       ptyId,
       connectionId,
-      reversible: reversibleStopOwnersByPtyId.has(ptyId),
+      reversible: runtime?.intentionalPtyStops?.isReversibleStopInFlight(ptyId) ?? false,
       incarnationId
     })
   }
@@ -184,31 +183,6 @@ export function retireRejectedPtyFromRuntimeController(
   })
 }
 
-export function markReversibleStopsFromRuntimeController(
-  deps: PtyRuntimeControllerDeps,
-  ptyIds: readonly string[]
-): () => void {
-  const { reversibleStopOwnersByPtyId } = deps
-  for (const ptyId of ptyIds) {
-    reversibleStopOwnersByPtyId.set(ptyId, (reversibleStopOwnersByPtyId.get(ptyId) ?? 0) + 1)
-  }
-  let released = false
-  return () => {
-    if (released) {
-      return
-    }
-    released = true
-    for (const ptyId of ptyIds) {
-      const owners = (reversibleStopOwnersByPtyId.get(ptyId) ?? 0) - 1
-      if (owners > 0) {
-        reversibleStopOwnersByPtyId.set(ptyId, owners)
-      } else {
-        reversibleStopOwnersByPtyId.delete(ptyId)
-      }
-    }
-  }
-}
-
 /**
  * Deliberately records no undelivered-stop intent, unlike `killPtyFromRuntimeController`.
  *
diff --git a/src/main/ipc/pty/runtime/operations.ts b/src/main/ipc/pty/runtime/operations.ts
index 703fa009b7d2..5fec2c25e26f 100644
--- a/src/main/ipc/pty/runtime/operations.ts
+++ b/src/main/ipc/pty/runtime/operations.ts
@@ -12,16 +12,28 @@ import {
   writeUnverifiable,
   type WriteSettlement
 } from '../../../../shared/pty-write-settlement'
+import type { TerminalInputKind } from '../../../../shared/terminal-input-kind'
+
+type RuntimeWriteDeps = Pick<PtyRuntimeControllerDeps, 'runtime'>
 
-export function writePtyFromRuntimeController(ptyId: string, data: string): boolean
 export function writePtyFromRuntimeController(
+  deps: RuntimeWriteDeps,
   ptyId: string,
   data: string,
+  inputKind: TerminalInputKind
+): boolean
+export function writePtyFromRuntimeController(
+  deps: RuntimeWriteDeps,
+  ptyId: string,
+  data: string,
+  inputKind: TerminalInputKind,
   options: { waitForSettlement: true }
 ): WriteSettlement | Promise<WriteSettlement>
 export function writePtyFromRuntimeController(
+  deps: RuntimeWriteDeps,
   ptyId: string,
   data: string,
+  inputKind: TerminalInputKind,
   options?: { waitForSettlement: true }
 ): boolean | WriteSettlement | Promise<WriteSettlement> {
   let provider: IPtyProvider
@@ -36,6 +48,7 @@ export function writePtyFromRuntimeController(
     if (!provider.writeWithSettlement) {
       return writeRefused('provider_cannot_settle')
     }
+    deps.runtime?.terminalRunFacts?.recordInput(ptyId, inputKind, data)
     try {
       return provider.writeWithSettlement(ptyId, data)
     } catch {
@@ -43,6 +56,7 @@ export function writePtyFromRuntimeController(
       return writeUnverifiable('provider_threw_after_handoff', true)
     }
   }
+  deps.runtime?.terminalRunFacts?.recordInput(ptyId, inputKind, data)
   try {
     return provider.write(ptyId, data) !== false
   } catch {
@@ -169,7 +183,9 @@ export async function clearBufferFromRuntimeController(
   ptyId: string
 ): Promise<void> {
   // Why: desktop xterm and daemon/SSH providers hold separate buffers; clear both so mobile resubscribe can't resurrect cleared history.
-  deps.mainWindow.webContents.send('pty:clearBuffer:request', { ptyId })
+  if (deps.mainWindow && !deps.mainWindow.isDestroyed()) {
+    deps.mainWindow.webContents.send('pty:clearBuffer:request', { ptyId })
+  }
   try {
     await getProviderForPty(ptyId).clearBuffer(ptyId)
   } catch {
diff --git a/src/main/ipc/pty/runtime/spawn-commit-run-facts.test.ts b/src/main/ipc/pty/runtime/spawn-commit-run-facts.test.ts
new file mode 100644
index 000000000000..5701b9f82c9d
--- /dev/null
+++ b/src/main/ipc/pty/runtime/spawn-commit-run-facts.test.ts
@@ -0,0 +1,147 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { OrcaRuntimeWithRuntimeId } from '../../../runtime/orca-runtime-runtime-id'
+import { TerminalIntentionalStops } from '../../../runtime/terminal-intentional-stops'
+import { TerminalRunFactsRegister } from '../../../runtime/terminal-run-facts'
+import { ptySizes } from '../delivery/visibility-state'
+import { ptyIncarnationById, ptyOwnership } from '../provider/ownership-state'
+import { commitRuntimePtySpawn } from './spawn-commit'
+import { createRuntimePtySpawnState, type RuntimePtySpawnArgs } from './spawn-state'
+import type { PtyRuntimeControllerDeps } from './controller-deps'
+
+const PTY_ID = 'orca-pty-run-facts'
+const INCARNATION_ID = 'inc-run-facts'
+
+const ADOPTED = {
+  disposition: 'adopted',
+  owner: {
+    claim: { kind: 'terminal' },
+    generation: 'g1',
+    phase: 'live',
+    ptyId: PTY_ID,
+    surface: { worktreeId: 'wt-1', tabId: 'tab-1', leafId: 'leaf-1', terminalHandle: 'h1' }
+  }
+}
+
+async function commit(
+  result: Record<string, unknown>,
+  facts = new TerminalRunFactsRegister(),
+  intentionalPtyStops = new TerminalIntentionalStops(),
+  prepare?: (ctx: ReturnType<typeof createRuntimePtySpawnState>) => void
+) {
+  const runtime = {
+    terminalRunFacts: facts,
+    intentionalPtyStops,
+    // Why the real method: the case under test is what the runtime does with each commit.
+    noteTerminalSpawnCommit: OrcaRuntimeWithRuntimeId.prototype.noteTerminalSpawnCommit,
+    registerPreAllocatedHandleForPty: vi.fn(),
+    registerPty: vi.fn(),
+    cancelPendingPtyRegistration: vi.fn(),
+    reflowHeadlessTerminalToPtyGrid: vi.fn(),
+    seedHeadlessTerminal: vi.fn(),
+    noteTerminalSpawnCommand: vi.fn()
+  }
+  const ports = { runtime, store: undefined, options: {}, sendPtySpawnedToRenderer: vi.fn() }
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the commit reads only the ports above; store-less deps skip every persistence branch.
+  const deps = ports as unknown as PtyRuntimeControllerDeps
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: a worktree-less spawn needs only its grid.
+  const args = { cols: 120, rows: 40 } as unknown as RuntimePtySpawnArgs
+  const ctx = createRuntimePtySpawnState(deps, args)
+  const spawned = { id: PTY_ID, incarnationId: INCARNATION_ID, ...result }
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: each case sets the spawn-result fields the commit reads.
+  ctx.result = spawned as unknown as typeof ctx.result
+  prepare?.(ctx)
+  await commitRuntimePtySpawn(ctx)
+  return facts.read(PTY_ID, INCARNATION_ID)
+}
+
+describe('runtime spawn commit: run facts', () => {
+  afterEach(() => {
+    ptySizes.delete(PTY_ID)
+    ptyOwnership.delete(PTY_ID)
+    ptyIncarnationById.delete(PTY_ID)
+  })
+
+  it('records a new process as a fresh spawn', async () => {
+    expect((await commit({})).freshSpawn).toBe(true)
+  })
+
+  it('never reads an SSH adoption that omits isReattach as fresh', async () => {
+    expect((await commit({ agentSessionEnsure: ADOPTED })).freshSpawn).toBe(false)
+  })
+
+  it('never reads a cold restore as fresh', async () => {
+    const coldRestore = { scrollback: 'prior output', cwd: '/tmp' }
+
+    expect((await commit({ coldRestore })).freshSpawn).toBe(false)
+  })
+
+  it('keeps a process run facts when the same incarnation commits again', async () => {
+    const facts = new TerminalRunFactsRegister()
+    await commit({}, facts)
+    facts.recordInput(PTY_ID, 'driving', 'ls\r', 100)
+
+    expect(await commit({ isReattach: true }, facts)).toEqual({
+      freshSpawn: true,
+      firstUserInputAt: 100
+    })
+  })
+
+  it.each([
+    { spawn: 'new process', result: {} },
+    { spawn: 'adoption', result: { agentSessionEnsure: ADOPTED } }
+  ])('lets a committed $spawn supersede a landed stop that no exit pinned', async ({ result }) => {
+    const stops = new TerminalIntentionalStops()
+    stops.mark(PTY_ID, 'reversible', null)(true)
+
+    await commit(result, new TerminalRunFactsRegister(), stops)
+
+    expect(stops.claimExit(PTY_ID, INCARNATION_ID)).toEqual([])
+  })
+
+  it('records nothing for a spawn discarded because its binding save failed', async () => {
+    const facts = new TerminalRunFactsRegister()
+    const stops = new TerminalIntentionalStops()
+    stops.mark(PTY_ID, 'reversible', null)(true)
+    const persistPtyBinding = vi.fn().mockRejectedValue(new Error('disk full'))
+
+    await expect(
+      commit({}, facts, stops, (ctx) => {
+        ctx.provider = { ...ctx.provider, shutdown: vi.fn().mockResolvedValue(undefined) }
+        ctx.hostSessionBinding = {
+          // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the commit calls only persistPtyBinding on this store.
+          store: { persistPtyBinding } as unknown as NonNullable<
+            typeof ctx.hostSessionBinding
+          >['store'],
+          worktreeId: 'wt-1',
+          tabId: 'tab-1',
+          leafId: 'leaf-1'
+        }
+      })
+    ).rejects.toThrow()
+
+    expect(persistPtyBinding).toHaveBeenCalledOnce()
+    expect(facts.read(PTY_ID, INCARNATION_ID).freshSpawn).toBe(false)
+    expect(stops.claimExit(PTY_ID, INCARNATION_ID)).toEqual(['reversible'])
+  })
+
+  it.each([
+    { spawn: 'new process', result: {} },
+    { spawn: 'adoption', result: { agentSessionEnsure: ADOPTED } }
+  ])('records nothing for a $spawn that exited during start', async ({ result }) => {
+    const facts = new TerminalRunFactsRegister()
+    const stops = new TerminalIntentionalStops()
+    stops.mark(PTY_ID, 'reversible', null)(true)
+
+    await expect(
+      commit(result, facts, stops, (ctx) => {
+        ctx.args.worktreeId = 'wt-1'
+        ctx.deps.runtime!.registerPty = vi.fn(() => {
+          throw new Error('agent_session_exited_during_start')
+        })
+      })
+    ).rejects.toThrow('agent_session_exited_during_start')
+
+    expect(facts.read(PTY_ID, INCARNATION_ID).freshSpawn).toBe(false)
+    expect(stops.claimExit(PTY_ID, INCARNATION_ID)).toEqual(['reversible'])
+  })
+})
diff --git a/src/main/ipc/pty/runtime/spawn-commit.ts b/src/main/ipc/pty/runtime/spawn-commit.ts
index 09d414602636..95994e0effc6 100644
--- a/src/main/ipc/pty/runtime/spawn-commit.ts
+++ b/src/main/ipc/pty/runtime/spawn-commit.ts
@@ -1,5 +1,5 @@
 import { isValidTerminalTabId } from '../../../../shared/terminal-tab-id'
-import { ptyOwnership, ptyIncarnationById, deletePtyOwnership } from '../provider/ownership-state'
+import { ptyOwnership, ptyIncarnationById } from '../provider/ownership-state'
 import { ptySizes } from '../delivery/visibility-state'
 import { commitRuntimePtySize } from './spawn-commit-pty-size'
 import {
@@ -16,13 +16,8 @@ import {
   rendererSerializerReadiness
 } from '../pane/serializer-state'
 import { seedTerminalRestoreRecordsFromSpawnResult } from '../pane/agent-session-owners'
-import { track } from '../../../telemetry/client'
-import { getCohortAtEmit } from '../../../telemetry/cohort-classifier'
-import {
-  agentKindSchema,
-  launchSourceSchema,
-  requestKindSchema
-} from '../../../../shared/telemetry-events'
+import { seedHeadlessTerminalFromSpawnResult } from '../pane/terminal-spawn-restore'
+import { recordPtySpawnTelemetry } from '../pane/spawn-telemetry'
 import { persistAdmittedStablePaneBinding } from '../pane/stable-owner'
 import { claimSshPaneLease } from '../pane/ssh-pane-lease-claim'
 import {
@@ -31,17 +26,34 @@ import {
 } from '../../../runtime/terminal-model-query-authority'
 import { toSshExecutionHostId } from '../../../../shared/execution-host'
 import { createTerminalSessionStateSaveFailureMessage } from '../../../../shared/terminal-session-state-save-failure'
-import { clearProviderPtyState } from '../provider/state-cleanup'
 import { resolvePaneSpawnReservation } from '../pane/spawn-reservation'
 import { admitProviderReattachLaunchIdentity } from '../pane/launch-authority'
 import { spawnCommitBindingOrigin } from '../../../persistence/loading-store/pty-binding-span'
 import type { RuntimePtySpawnState } from './spawn-state'
+import {
+  admitPtyReattachOwnership,
+  discardUnpersistedPtySpawn,
+  registerPersistedPtySpawn
+} from '../pane/spawn-registration'
 
 export async function commitRuntimePtySpawn(ctx: RuntimePtySpawnState) {
   const args = ctx.args
+  admitPtyReattachOwnership(ctx.deps.runtime, ctx.result, args.connectionId)
   const providerReattachLaunchIdentity = admitProviderReattachLaunchIdentity(ctx.result)
+  if (
+    isNativeWindowsLocalPtySpawn({
+      connectionId: args.connectionId,
+      cwd: args.cwd,
+      shellOverride: ctx.daemonShellOverride
+    })
+  ) {
+    markNativeWindowsConptyPty(ctx.result.id)
+  }
+  // Seed before the first disk await so live output appends to the restored history.
+  seedHeadlessTerminalFromSpawnResult(ctx.deps.runtime, ctx.result, ctx.spawnIdentityPaneKey)
+  seedTerminalRestoreRecordsFromSpawnResult(ctx.deps.runtime, ctx.result)
   try {
-    ctx.stablePaneBindingPersisted = persistAdmittedStablePaneBinding({
+    ctx.stablePaneBindingPersisted = await persistAdmittedStablePaneBinding({
       store: ctx.hostSessionBinding?.store,
       owner: ctx.stablePaneOwner,
       result: ctx.result,
@@ -63,12 +75,9 @@ export async function commitRuntimePtySpawn(ctx: RuntimePtySpawnState) {
     // reply omits isReattach; derive it once so the size commit and the reservation agree.
     const adoptedResult = { ...ctx.result, isReattach: true }
     const owner = ctx.result.agentSessionEnsure.owner
-    ptyOwnership.set(ctx.result.id, args.connectionId ?? ptyOwnership.get(ctx.result.id) ?? null)
-    ctx.deps.runtime?.registerPreAllocatedHandleForPty(ctx.result.id, owner.surface.terminalHandle)
-    if (ctx.result.incarnationId) {
-      ptyIncarnationById.set(ctx.result.id, ctx.result.incarnationId)
-    }
-    ctx.deps.runtime?.registerPty(
+    const rejectedRegistration = registerPersistedPtySpawn(
+      ctx.deps.runtime,
+      ctx.hostSessionBinding?.store ?? ctx.deps.store,
       ctx.result.id,
       owner.surface.worktreeId,
       args.connectionId ?? null,
@@ -80,6 +89,19 @@ export async function commitRuntimePtySpawn(ctx: RuntimePtySpawnState) {
         ...(providerReattachLaunchIdentity ? { providerReattachLaunchIdentity } : {})
       }
     )
+    if (rejectedRegistration) {
+      await rejectedRegistration
+    }
+    // Why here: an adoption returns before the commit site below.
+    ctx.deps.runtime?.noteTerminalSpawnCommit?.(
+      ctx.result,
+      ctx.hostSessionBinding?.expectedSourceBinding
+    )
+    ptyOwnership.set(ctx.result.id, args.connectionId ?? ptyOwnership.get(ctx.result.id) ?? null)
+    ctx.deps.runtime?.registerPreAllocatedHandleForPty(ctx.result.id, owner.surface.terminalHandle)
+    if (ctx.result.incarnationId) {
+      ptyIncarnationById.set(ctx.result.id, ctx.result.incarnationId)
+    }
     if (!args.connectionId) {
       ctx.deps.options?.onCodexHomePtySpawned?.({
         id: ctx.result.id,
@@ -108,81 +130,29 @@ export async function commitRuntimePtySpawn(ctx: RuntimePtySpawnState) {
       agentSessionEnsure: ctx.result.agentSessionEnsure
     }
   }
-  ptyOwnership.set(ctx.result.id, args.connectionId ?? null)
-  if (ctx.result.incarnationId) {
-    ptyIncarnationById.set(ctx.result.id, ctx.result.incarnationId)
-  }
-  // Why: record the native-Windows-local-PTY determination before any byte reaches the emulator, so its ConPTY DA1 override exists from byte zero.
-  if (
-    isNativeWindowsLocalPtySpawn({
-      connectionId: args.connectionId,
-      cwd: args.cwd,
-      shellOverride: ctx.daemonShellOverride
-    })
-  ) {
-    markNativeWindowsConptyPty(ctx.result.id)
-  }
-  const persistSshLease = (): void =>
-    claimSshPaneLease({
-      store: ctx.deps.store,
-      connectionId: args.connectionId,
-      ptyId: ctx.result.id,
-      worktreeId: args.worktreeId,
-      tabId: args.tabId,
-      leafId: args.leafId
-    })
-  if (!ctx.hostSessionBinding) {
-    persistSshLease()
-  }
-  commitRuntimePtySize(ctx, ctx.result)
-  if (ctx.effectiveSessionAppId !== undefined && ctx.effectiveSessionAppId !== ctx.result.id) {
-    ptySizes.delete(ctx.effectiveSessionAppId)
-  }
-  recordCodexPaneAccountForSpawn({
-    ptyId: ctx.result.id,
-    isDaemonHostSpawn: ctx.isDaemonHostSpawn,
-    isReattach: ctx.result.isReattach === true,
-    pinnedByResume: ctx.codexResumeHomeSelected,
-    launchCodexHomePath: ctx.selectedCodexHomePath,
-    launchEnv: args.env,
-    target: ctx.codexSelectionTarget,
-    settings: ctx.deps.getSettings?.()
-  })
   if (ctx.hostSessionBinding && !ctx.stablePaneBindingPersisted) {
     try {
+      const { store, worktreeId, tabId, leafId, expectedSourceBinding } = ctx.hostSessionBinding
       const binding = {
-        worktreeId: ctx.hostSessionBinding.worktreeId,
-        tabId: ctx.hostSessionBinding.tabId,
-        leafId: ctx.hostSessionBinding.leafId,
+        worktreeId,
+        tabId,
+        leafId,
         ptyId: ctx.result.id,
         hostAdmittedMembership: true,
         ...(ctx.result.incarnationId ? { incarnationId: ctx.result.incarnationId } : {}),
         ...(ctx.cwd ? { startupCwd: ctx.cwd } : {}),
-        ...(ctx.hostSessionBinding.expectedSourceBinding
-          ? { expectedSourceBinding: ctx.hostSessionBinding.expectedSourceBinding }
-          : {}),
-        origin: spawnCommitBindingOrigin(ctx.result, ctx.hostSessionBinding.expectedSourceBinding)
+        ...(expectedSourceBinding ? { expectedSourceBinding } : {}),
+        origin: spawnCommitBindingOrigin(ctx.result, expectedSourceBinding)
       }
       const persisted = args.connectionId
-        ? ctx.hostSessionBinding.store.persistPtyBinding(
-            binding,
-            toSshExecutionHostId(args.connectionId)
-          )
-        : ctx.hostSessionBinding.store.persistPtyBinding(binding)
+        ? await store.persistPtyBinding(binding, toSshExecutionHostId(args.connectionId))
+        : await store.persistPtyBinding(binding)
       if (persisted === false) {
         throw new Error('terminal_split_source_not_found')
       }
     } catch (err) {
       console.error('[pty] failed to persist runtime PTY binding after spawn:', err)
-      if (!ctx.result.isReattach) {
-        deletePtyOwnership(ctx.result.id)
-        try {
-          await ctx.provider.shutdown(ctx.result.id, { immediate: true })
-        } catch (shutdownErr) {
-          console.warn('[pty] failed to clean up PTY after persistence failure:', shutdownErr)
-        }
-        clearProviderPtyState(ctx.result.id)
-      }
+      await discardUnpersistedPtySpawn(ctx.provider, ctx.result)
       if (err instanceof Error && err.message === 'terminal_split_source_not_found') {
         throw err
       }
@@ -190,13 +160,11 @@ export async function commitRuntimePtySpawn(ctx: RuntimePtySpawnState) {
         agentSessionOperationOutcome: 'unknown' as const
       })
     }
-    persistSshLease()
-  }
-  if (args.preAllocatedHandle && !ctx.stablePaneOwner?.handle) {
-    ctx.deps.runtime?.registerPreAllocatedHandleForPty(ctx.result.id, args.preAllocatedHandle)
   }
   if (args.worktreeId) {
-    ctx.deps.runtime?.registerPty(
+    const rejectedRegistration = registerPersistedPtySpawn(
+      ctx.deps.runtime,
+      ctx.hostSessionBinding?.store ?? ctx.deps.store,
       ctx.result.id,
       args.worktreeId,
       args.connectionId ?? null,
@@ -217,10 +185,48 @@ export async function commitRuntimePtySpawn(ctx: RuntimePtySpawnState) {
         ? shouldSkipCodexHomeEnvForWindowsShell(ctx.daemonShellOverride, ctx.cwd)
         : undefined
     )
+    if (rejectedRegistration) {
+      await rejectedRegistration
+    }
   } else {
     // Why: non-worktree PTYs have no later surface-registration phase to clear admission intent.
     ctx.deps.runtime?.cancelPendingPtyRegistration?.(ctx.result.id, ctx.result.incarnationId)
   }
+  // Why after registration: a spawn discarded for a failed save or rejected for exiting during
+  // start must not record facts or end a stop.
+  ctx.deps.runtime?.noteTerminalSpawnCommit?.(
+    ctx.result,
+    ctx.hostSessionBinding?.expectedSourceBinding
+  )
+  if (args.preAllocatedHandle && !ctx.stablePaneOwner?.handle) {
+    ctx.deps.runtime?.registerPreAllocatedHandleForPty(ctx.result.id, args.preAllocatedHandle)
+  }
+  ptyOwnership.set(ctx.result.id, args.connectionId ?? null)
+  if (ctx.result.incarnationId) {
+    ptyIncarnationById.set(ctx.result.id, ctx.result.incarnationId)
+  }
+  claimSshPaneLease({
+    store: ctx.deps.store,
+    connectionId: args.connectionId,
+    ptyId: ctx.result.id,
+    worktreeId: args.worktreeId,
+    tabId: args.tabId,
+    leafId: args.leafId
+  })
+  commitRuntimePtySize(ctx, ctx.result)
+  if (ctx.effectiveSessionAppId !== undefined && ctx.effectiveSessionAppId !== ctx.result.id) {
+    ptySizes.delete(ctx.effectiveSessionAppId)
+  }
+  recordCodexPaneAccountForSpawn({
+    ptyId: ctx.result.id,
+    isDaemonHostSpawn: ctx.isDaemonHostSpawn,
+    isReattach: ctx.result.isReattach === true,
+    pinnedByResume: ctx.codexResumeHomeSelected,
+    launchCodexHomePath: ctx.selectedCodexHomePath,
+    launchEnv: args.env,
+    target: ctx.codexSelectionTarget,
+    settings: ctx.deps.getSettings?.()
+  })
   // Why: runtime-controller creates (headless serve, CLI, splits) adopt surviving daemon sessions too; without this seed their records stay blank.
   seedTerminalRestoreRecordsFromSpawnResult(ctx.deps.runtime, ctx.result)
   // Why: arms main's per-PTY Command Code output detector from the launch command (renderer startupCommand parity).
@@ -231,17 +237,7 @@ export async function commitRuntimePtySpawn(ctx: RuntimePtySpawnState) {
     markClaudePtySpawned(ctx.result.id)
   }
   if (args.telemetry && !ctx.stablePaneOwner) {
-    const agentKindParse = agentKindSchema.safeParse(args.telemetry.agent_kind)
-    const launchSourceParse = launchSourceSchema.safeParse(args.telemetry.launch_source)
-    const requestKindParse = requestKindSchema.safeParse(args.telemetry.request_kind)
-    if (agentKindParse.success && launchSourceParse.success && requestKindParse.success) {
-      track('agent_started', {
-        agent_kind: agentKindParse.data,
-        launch_source: launchSourceParse.data,
-        request_kind: requestKindParse.data,
-        ...getCohortAtEmit()
-      })
-    }
+    recordPtySpawnTelemetry(args.telemetry)
   }
   // Why: runtime-owned CLI PTYs bypass the renderer pty:spawn handler; record paneKey here too since hook titles and cache cleanup need this reverse lookup.
   const paneKey = rememberPaneKeyForPty(ctx.result.id, ctx.env?.ORCA_PANE_KEY)
diff --git a/src/main/ipc/pty/runtime/spawn-preflight-requested-shell.test.ts b/src/main/ipc/pty/runtime/spawn-preflight-requested-shell.test.ts
index 46f16081efae..a299327fc3f2 100644
--- a/src/main/ipc/pty/runtime/spawn-preflight-requested-shell.test.ts
+++ b/src/main/ipc/pty/runtime/spawn-preflight-requested-shell.test.ts
@@ -43,7 +43,6 @@ function makeDeps(): PtyRuntimeControllerDeps {
     finishPtyShutdown,
     trustedTerminalHandleEnv: new Set(),
     retiredRejectedPtyIds: new Map(),
-    reversibleStopOwnersByPtyId: new Map(),
     // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: only `operations.ts` (write/clearBuffer) reads `mainWindow`; the spawn preflight and option build never touch it, and a real BrowserWindow cannot exist in vitest.
     mainWindow: {} as BrowserWindow
   }
diff --git a/src/main/ipc/pty/runtime/undelivered-ssh-kill.ts b/src/main/ipc/pty/runtime/undelivered-ssh-kill.ts
index e41b16290979..00d23478eaac 100644
--- a/src/main/ipc/pty/runtime/undelivered-ssh-kill.ts
+++ b/src/main/ipc/pty/runtime/undelivered-ssh-kill.ts
@@ -1,5 +1,6 @@
 import type { Store } from '../../../persistence'
-import { ptyIncarnationById } from '../provider/ownership-state'
+import { parseAppSshPtyId } from '../../../providers/ssh-pty-id'
+import { ptyIncarnationById, ptyOwnership } from '../provider/ownership-state'
 import { getRelayPtyId } from '../provider/registry'
 
 export type UndeliveredSshPtyKill = {
@@ -30,24 +31,38 @@ export type UndeliveredSshPtyKill = {
  *    or worse, guessed at.
  *  - **an id naming another connection**: `getRelayPtyId` throws on those, and this runs inside
  *    promise `.catch` handlers where that would surface as an unhandled rejection. */
-export function recordUndeliveredSshPtyKill(args: UndeliveredSshPtyKill): void {
+export function recordUndeliveredSshPtyKill(args: UndeliveredSshPtyKill): boolean {
   const { store, ptyId, connectionId } = args
   if (!store || !connectionId || args.reversible) {
-    return
+    return false
   }
   const incarnationId = args.incarnationId ?? ptyIncarnationById.get(ptyId)
   if (!incarnationId) {
-    return
+    return false
   }
   let relayPtyId: string
   try {
     relayPtyId = getRelayPtyId(connectionId, ptyId)
   } catch {
-    return
+    return false
   }
   store.recordSshRemotePtyKillIntent(connectionId, relayPtyId, {
     requestedAt: args.now ?? Date.now(),
     incarnationId,
     attempts: 0
   })
+  return true
+}
+
+/** Records the replay order for an explicit close whose stop went unconfirmed, before its follow-up
+ *  kill is sent, so the close receipt can promise the retry only when an order really exists. */
+export function recordUnconfirmedExplicitSshStop(args: {
+  store: Store | undefined
+  ptyId: string
+  reversible: boolean
+}): boolean {
+  return recordUndeliveredSshPtyKill({
+    ...args,
+    connectionId: ptyOwnership.get(args.ptyId) ?? parseAppSshPtyId(args.ptyId)?.connectionId
+  })
 }
diff --git a/src/main/ipc/pty/session.ts b/src/main/ipc/pty/session.ts
index 30c6735cde27..be666fc62482 100644
--- a/src/main/ipc/pty/session.ts
+++ b/src/main/ipc/pty/session.ts
@@ -1,4 +1,4 @@
-import type { BrowserWindow } from 'electron'
+import type { BrowserWindow, WebContents } from 'electron'
 import type { OrcaRuntimeService } from '../../runtime/orca-runtime'
 import type { Store } from '../../persistence'
 import type { GlobalSettings } from '../../../shared/global-settings-types'
@@ -10,7 +10,6 @@ import type {
   PtyRendererDeliveryStateReport
 } from '../../../shared/pty-renderer-delivery-health'
 import type { PtyRendererDeliveryDebugSnapshot } from './delivery/debug'
-import type { ReplacedPtyStop } from './delivery/exit'
 import { PtyProducerFlowController } from '../pty-producer-flow-control'
 import { PtyPendingDataDrainQueue, type PendingPtyData } from '../pty-pending-data-drain-queue'
 import type { SshPtyOutputIntake } from '../ssh-pty-output-intake'
@@ -58,8 +57,15 @@ export type PtyIpcSessionOptions = {
   onPtyExit?: (id: string, exitSequence: number) => void
 }
 
+export type PtyRendererDelivery = Pick<
+  BrowserWindow,
+  'isDestroyed' | 'isFocused' | 'isVisible' | 'isMinimized'
+> & {
+  webContents: Pick<WebContents, 'id' | 'isDestroyed' | 'send' | 'on' | 'removeListener'>
+}
+
 export type PtyIpcSession = {
-  mainWindow: BrowserWindow
+  mainWindow?: PtyRendererDelivery
   runtime?: OrcaRuntimeService
   store?: Store
   getSettings?: () => GlobalSettings
@@ -101,8 +107,6 @@ export type PtyIpcSession = {
     string,
     { cleanupTimer: NodeJS.Timeout; incarnationId: string | undefined }
   >
-  reversibleStopOwnersByPtyId: Map<string, number>
-  replacedPtyStopsById: Map<string, ReplacedPtyStop>
   retiredRejectedPtyIds: Map<string, NodeJS.Timeout>
   pendingSerializeRequests: Map<
     string,
@@ -182,7 +186,7 @@ const unsetSessionFn = (): never => {
 }
 
 export function createPtyIpcSession(args: {
-  mainWindow: BrowserWindow
+  mainWindow?: PtyRendererDelivery
   runtime?: OrcaRuntimeService
   store?: Store
   getSettings?: () => GlobalSettings
@@ -231,8 +235,6 @@ export function createPtyIpcSession(args: {
     sourceCreditPendingPtys: new Set(),
     backgroundedDeliverySyncByPty: new Map(),
     syntheticKillExitPtyIds: new Map(),
-    reversibleStopOwnersByPtyId: new Map(),
-    replacedPtyStopsById: new Map(),
     retiredRejectedPtyIds: new Map(),
     pendingSerializeRequests: new Map(),
     canSendPtyDataToRenderer: unsetSessionFn,
diff --git a/src/main/ipc/register-core-handlers/register-core-handlers.test.ts b/src/main/ipc/register-core-handlers/register-core-handlers.test.ts
index 0d4f04046b02..22fe84caba63 100644
--- a/src/main/ipc/register-core-handlers/register-core-handlers.test.ts
+++ b/src/main/ipc/register-core-handlers/register-core-handlers.test.ts
@@ -38,6 +38,7 @@ const {
   registerClaudeAccountHandlersMock,
   registerMiniMaxCredentialsHandlersMock,
   registerGrokAccountHandlersMock,
+  registerCursorAccountHandlersMock,
   registerClipboardHandlersMock,
   setTrustedClipboardRendererWebContentsIdMock,
   registerUpdaterHandlersMock,
@@ -105,6 +106,7 @@ const {
   registerClaudeAccountHandlersMock: vi.fn(),
   registerMiniMaxCredentialsHandlersMock: vi.fn(),
   registerGrokAccountHandlersMock: vi.fn(),
+  registerCursorAccountHandlersMock: vi.fn(),
   registerClipboardHandlersMock: vi.fn(),
   setTrustedClipboardRendererWebContentsIdMock: vi.fn(),
   registerUpdaterHandlersMock: vi.fn(),
@@ -344,6 +346,10 @@ vi.mock('../grok-accounts', () => ({
   registerGrokAccountHandlers: registerGrokAccountHandlersMock
 }))
 
+vi.mock('../cursor-accounts', () => ({
+  registerCursorAccountHandlers: registerCursorAccountHandlersMock
+}))
+
 vi.mock('../../window/attach-main-window-services', () => ({
   registerUpdaterHandlers: registerUpdaterHandlersMock
 }))
@@ -528,6 +534,7 @@ describe('registerCoreHandlers', () => {
     expect(registerClaudeAccountHandlersMock).toHaveBeenCalledWith(claudeAccounts)
     expect(registerMiniMaxCredentialsHandlersMock).toHaveBeenCalledWith(rateLimits)
     expect(registerGrokAccountHandlersMock).toHaveBeenCalled()
+    expect(registerCursorAccountHandlersMock).toHaveBeenCalled()
     expect(registerRateLimitHandlersMock).toHaveBeenCalledWith(rateLimits, codexAccounts)
     expect(registerGitHubHandlersMock).toHaveBeenCalledWith(store, stats)
     expect(registerLinearHandlersMock).toHaveBeenCalled()
@@ -552,7 +559,7 @@ describe('registerCoreHandlers', () => {
     expect(registerLocalhostWorktreeLabelHandlersMock).toHaveBeenCalledWith(store)
     expect(registerTelemetryHandlersMock).toHaveBeenCalledWith(store)
     expect(registerOrcaProfileHandlersMock).toHaveBeenCalledWith(store, { onBeforeRelaunch })
-    expect(registerSessionHandlersMock).toHaveBeenCalledWith(store)
+    expect(registerSessionHandlersMock).toHaveBeenCalledWith(store, runtime)
     expect(registerUIHandlersMock).toHaveBeenCalledWith(store, {
       isDashboardPopoutRenderer: isDashboardPopoutRendererMock
     })
diff --git a/src/main/ipc/register-core-handlers/register-core-handlers.ts b/src/main/ipc/register-core-handlers/register-core-handlers.ts
index 0b329335755a..e692cc9c5e89 100644
--- a/src/main/ipc/register-core-handlers/register-core-handlers.ts
+++ b/src/main/ipc/register-core-handlers/register-core-handlers.ts
@@ -64,6 +64,7 @@ import { registerAgentTrustHandlers } from '../agent-trust'
 import { registerClaudeAccountHandlers } from '../claude-accounts'
 import { registerMiniMaxCredentialsHandlers } from '../minimax-credentials'
 import { registerGrokAccountHandlers } from '../grok-accounts'
+import { registerCursorAccountHandlers } from '../cursor-accounts'
 import { registerUpdaterHandlers } from '../../window/attach-main-window-services'
 import {
   registerClipboardHandlers,
@@ -152,6 +153,7 @@ export function registerCoreHandlers(
   registerClaudeAccountHandlers(claudeAccounts)
   registerMiniMaxCredentialsHandlers(rateLimits)
   registerGrokAccountHandlers()
+  registerCursorAccountHandlers()
   registerRateLimitHandlers(rateLimits, codexAccounts)
   registerGitHubHandlers(store, stats)
   registerGitLabHandlers(store)
@@ -202,7 +204,7 @@ export function registerCoreHandlers(
   registerBrowserHandlers()
   registerShellHandlers(store)
   registerPetHandlers()
-  registerSessionHandlers(store)
+  registerSessionHandlers(store, runtime)
   registerUIHandlers(store, { isDashboardPopoutRenderer })
   registerEmulatorFrameStreamHandlers()
   registerEmulatorVideoStreamHandlers()
diff --git a/src/main/ipc/registered-worktree-root-owner.ts b/src/main/ipc/registered-worktree-root-owner.ts
new file mode 100644
index 000000000000..37b1ed25e38a
--- /dev/null
+++ b/src/main/ipc/registered-worktree-root-owner.ts
@@ -0,0 +1,35 @@
+import { resolve } from 'node:path'
+import { getRepoExecutionHostId } from '../../shared/execution-host'
+import type { Repo } from '../../shared/repo-types'
+import { hasRemoteFilesystemOwner } from './remote-filesystem-owner'
+
+export function getWorktreeRootOwnerKey(repo: Repo): string {
+  return JSON.stringify([repo.id, resolve(repo.path), getRepoExecutionHostId(repo)])
+}
+
+// Why the shared predicate: an unplaceable host stamp must not register roots either — the same
+// allow-list, reached through `git worktree list` instead of the repo path.
+export function getLocalWorktreeRootOwners(repos: readonly Repo[]): Map<string, Repo> {
+  return new Map(
+    repos
+      .filter((repo) => !hasRemoteFilesystemOwner(repo))
+      .map((repo) => [getWorktreeRootOwnerKey(repo), repo])
+  )
+}
+
+export function resolveWorktreeRootOwner(
+  repos: readonly Repo[],
+  repo: Repo | string,
+  owners: ReadonlyMap<string, Repo>
+): string | undefined {
+  // ID-only callers are safe only when the entire catalog has one matching row.
+  if (typeof repo === 'string') {
+    const matches = repos.filter((candidate) => candidate.id === repo)
+    if (matches.length !== 1) {
+      return undefined
+    }
+    repo = matches[0]
+  }
+  const key = getWorktreeRootOwnerKey(repo)
+  return !repo.connectionId && owners.has(key) ? key : undefined
+}
diff --git a/src/main/ipc/registered-worktree-root-ownership.test.ts b/src/main/ipc/registered-worktree-root-ownership.test.ts
new file mode 100644
index 000000000000..c03f923d7ec4
--- /dev/null
+++ b/src/main/ipc/registered-worktree-root-ownership.test.ts
@@ -0,0 +1,294 @@
+import { join, resolve } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { Store } from '../persistence'
+import type { Repo } from '../../shared/repo-types'
+
+const mocks = vi.hoisted(() => ({ graph: vi.fn(), stat: vi.fn(), realpath: vi.fn() }))
+vi.mock('node:fs', () => ({ realpathSync: (path: string) => path, statSync: mocks.stat }))
+vi.mock('node:fs/promises', () => ({ stat: mocks.stat, realpath: mocks.realpath }))
+vi.mock('../repo-worktrees', () => ({
+  listRepoWorktreeGraph: mocks.graph,
+  isRepoRoot: vi.fn(() => false)
+}))
+vi.mock('./worktree-logic', () => ({
+  computeWorkspaceRoot: vi.fn(),
+  getWorktreePathSettings: vi.fn()
+}))
+vi.mock('../project-runtime-git-options', () => ({
+  getWorktreeMirrorDistroForRuntime: vi.fn(),
+  resolveLocalProjectRuntimesForRepos: vi.fn()
+}))
+import { resolveAuthorizedPath } from './filesystem-auth'
+import {
+  __resetCreatedWorktreeRootsForTests,
+  invalidateAuthorizedRootsCache,
+  rebuildAuthorizedRootsCache,
+  registerCreatedWorktreeRoot,
+  registerWorktreeRootsForRepo
+} from './registered-worktree-roots-cache'
+
+const root = resolve('/registry-review-repo')
+const linked = resolve('/registry-review-linked')
+const canonical = resolve('/registry-review-canonical')
+const replacement = resolve('/registry-review-replacement')
+const local: Repo = { id: 'owner', path: root, displayName: 'repo', badgeColor: '#000', addedAt: 0 }
+function fixture(repos: Repo[]): Store {
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The actual authorization APIs only read these four store methods; filesystem and graph boundaries are mocked.
+  return {
+    getRepos: () => repos,
+    getProjectGroups: () => [],
+    getFolderWorkspaces: () => [],
+    getSettings: () => ({})
+  } as unknown as Store
+}
+function deferred<T>() {
+  let resolvePromise!: (value: T) => void
+  let rejectPromise!: (error: unknown) => void
+  const promise = new Promise<T>((resolve, reject) => {
+    resolvePromise = resolve
+    rejectPromise = reject
+  })
+  return { promise, resolve: resolvePromise, reject: rejectPromise }
+}
+async function deferredAlias(store: Store) {
+  const normalization = deferred<string>()
+  mocks.realpath.mockImplementation((path: string) => {
+    if (path === linked) {
+      return normalization.promise
+    }
+    if (path === join(linked, 'file')) {
+      return Promise.resolve(join(canonical, 'file'))
+    }
+    return Promise.resolve(path)
+  })
+  const authorization = resolveAuthorizedPath(join(linked, 'file'), store)
+  await vi.waitFor(() => expect(mocks.realpath).toHaveBeenCalledWith(linked))
+  return { authorization, normalization }
+}
+async function expectDenied(path: string, store: Store) {
+  await expect(resolveAuthorizedPath(path, store)).rejects.toThrow('Access denied')
+}
+beforeEach(() => {
+  invalidateAuthorizedRootsCache()
+  __resetCreatedWorktreeRootsForTests()
+  vi.resetAllMocks()
+  mocks.graph.mockResolvedValue([])
+  mocks.stat.mockResolvedValue({})
+  mocks.realpath.mockImplementation(async (path: string) => path)
+})
+afterEach(() => vi.useRealTimers())
+
+describe('canonical alias publication respects current registration', () => {
+  it.each(['canonical', 'legacy'] as const)(
+    'retires an in-flight alias after %s SSH ownership',
+    async (hostEncoding) => {
+      const repos = [{ ...local }]
+      const store = fixture(repos)
+      registerWorktreeRootsForRepo(store, local.id, [linked])
+      const { authorization, normalization } = await deferredAlias(store)
+      repos[0] =
+        hostEncoding === 'canonical'
+          ? { ...local, executionHostId: 'ssh:remote' }
+          : { ...local, connectionId: 'remote' }
+      invalidateAuthorizedRootsCache()
+      normalization.resolve(canonical)
+      await expect(authorization).rejects.toThrow('Access denied')
+      await expectDenied(join(canonical, 'later'), store)
+    }
+  )
+  it('does not let an obsolete alias outlive a replacement listing', async () => {
+    const store = fixture([local])
+    registerWorktreeRootsForRepo(store, local.id, [linked])
+    const { authorization, normalization } = await deferredAlias(store)
+    registerWorktreeRootsForRepo(store, local.id, [replacement])
+    normalization.resolve(canonical)
+    await expect(authorization).rejects.toThrow('Access denied')
+    await expectDenied(join(canonical, 'later'), store)
+    await expect(resolveAuthorizedPath(join(replacement, 'file'), store)).resolves.toBe(
+      join(replacement, 'file')
+    )
+  })
+  it('does not cache an alias from an invalidated listing', async () => {
+    const store = fixture([local])
+    registerWorktreeRootsForRepo(store, local.id, [linked])
+    const { authorization, normalization } = await deferredAlias(store)
+    invalidateAuthorizedRootsCache()
+    normalization.resolve(canonical)
+    await expect(authorization).rejects.toThrow('Access denied')
+    await expectDenied(join(canonical, 'later'), store)
+  })
+  it('retains a completed alias while its original owner remains local', async () => {
+    const store = fixture([local])
+    registerWorktreeRootsForRepo(store, local.id, [linked])
+    const { authorization, normalization } = await deferredAlias(store)
+    normalization.resolve(canonical)
+    await expect(authorization).resolves.toBe(join(canonical, 'file'))
+    await expect(resolveAuthorizedPath(join(canonical, 'later'), store)).resolves.toBe(
+      join(canonical, 'later')
+    )
+  })
+})
+
+describe('recovered grant ownership and prune completion', () => {
+  it('does not apply old ENOENT evidence to a renewed recovered grant', async () => {
+    const probe = deferred<object>()
+    mocks.stat.mockReturnValueOnce(probe.promise)
+    const store = fixture([local])
+    registerCreatedWorktreeRoot(store, local.id, linked)
+    const rebuilding = rebuildAuthorizedRootsCache(store)
+    await vi.waitFor(() => expect(mocks.stat).toHaveBeenCalledWith(linked))
+    registerCreatedWorktreeRoot(store, local.id, linked)
+    probe.reject(Object.assign(new Error('old absence'), { code: 'ENOENT' }))
+    await rebuilding
+    await expect(resolveAuthorizedPath(join(linked, 'file'), store)).resolves.toBe(
+      join(linked, 'file')
+    )
+  })
+  it.each([false, true])(
+    'retires recovered roots after same-ID local path replacement (invalidate=%s)',
+    async (invalidate) => {
+      const repos = [{ ...local }]
+      const store = fixture(repos)
+      registerCreatedWorktreeRoot(store, local.id, linked)
+      repos[0] = { ...local, path: replacement }
+      if (invalidate) {
+        invalidateAuthorizedRootsCache()
+      }
+      await expectDenied(join(linked, 'file'), store)
+    }
+  )
+  it.each(['listed', 'created'] as const)(
+    'rejects ambiguous %s registration for one ID and two local paths',
+    async (kind) => {
+      const store = fixture([local, { ...local, path: replacement }])
+      if (kind === 'listed') {
+        registerWorktreeRootsForRepo(store, local.id, [linked])
+      } else {
+        registerCreatedWorktreeRoot(store, local.id, linked)
+      }
+      await expectDenied(join(linked, 'file'), store)
+    }
+  )
+  it('preserves a still-local recovered root across ordinary invalidation', async () => {
+    const store = fixture([local])
+    registerCreatedWorktreeRoot(store, local.id, linked)
+    invalidateAuthorizedRootsCache()
+    await expect(resolveAuthorizedPath(join(linked, 'file'), store)).resolves.toBe(
+      join(linked, 'file')
+    )
+  })
+  it('preserves a recovered root when its filesystem probe returns EIO', async () => {
+    const store = fixture([local])
+    registerCreatedWorktreeRoot(store, local.id, linked)
+    mocks.stat.mockRejectedValue(Object.assign(new Error('unavailable'), { code: 'EIO' }))
+    await rebuildAuthorizedRootsCache(store)
+    await expect(resolveAuthorizedPath(join(linked, 'file'), store)).resolves.toBe(
+      join(linked, 'file')
+    )
+  })
+  it('preserves a recovered root on timeout and after late ENOENT', async () => {
+    vi.useFakeTimers()
+    const probe = deferred<object>()
+    mocks.stat.mockReturnValueOnce(probe.promise)
+    const store = fixture([local])
+    registerCreatedWorktreeRoot(store, local.id, linked)
+    const rebuilding = rebuildAuthorizedRootsCache(store)
+    await vi.advanceTimersByTimeAsync(1_001)
+    await rebuilding
+    probe.reject(Object.assign(new Error('late absence'), { code: 'ENOENT' }))
+    await Promise.resolve()
+    await expect(resolveAuthorizedPath(join(linked, 'file'), store)).resolves.toBe(
+      join(linked, 'file')
+    )
+  })
+  it('keeps the newer registration when an older graph listing completes', async () => {
+    const graph = deferred<{ path: string }[]>()
+    mocks.graph.mockReturnValueOnce(graph.promise)
+    const store = fixture([local])
+    const rebuilding = rebuildAuthorizedRootsCache(store)
+    expect(mocks.graph).toHaveBeenCalledOnce()
+    registerWorktreeRootsForRepo(store, local.id, [replacement])
+    graph.resolve([{ path: linked }])
+    await rebuilding
+    await expectDenied(join(linked, 'file'), store)
+    await expect(resolveAuthorizedPath(join(replacement, 'file'), store)).resolves.toBe(
+      join(replacement, 'file')
+    )
+  })
+})
+
+describe('qualified registration', () => {
+  it.each(['listed', 'created'] as const)(
+    'keeps legitimate %s roots with overlapping local and SSH IDs',
+    async (kind) => {
+      const remote: Repo = { ...local, executionHostId: 'ssh:remote' }
+      const store = fixture([local, remote])
+      if (kind === 'listed') {
+        registerWorktreeRootsForRepo(store, local, [linked])
+        registerWorktreeRootsForRepo(store, remote, [replacement])
+      } else {
+        registerCreatedWorktreeRoot(store, local, linked)
+        registerCreatedWorktreeRoot(store, remote, replacement)
+      }
+      await expect(resolveAuthorizedPath(join(linked, 'file'), store)).resolves.toBe(
+        join(linked, 'file')
+      )
+      await expectDenied(join(replacement, 'file'), store)
+    }
+  )
+  it('preserves a root still owned by another qualified local repository', async () => {
+    const second = { ...local, path: replacement }
+    const repos = [local, second]
+    const store = fixture(repos)
+    registerCreatedWorktreeRoot(store, local, linked)
+    registerCreatedWorktreeRoot(store, second, linked)
+    repos[0] = { ...local, executionHostId: 'ssh:remote' }
+    invalidateAuthorizedRootsCache()
+    await expect(resolveAuthorizedPath(join(linked, 'file'), store)).resolves.toBe(
+      join(linked, 'file')
+    )
+  })
+  it('keeps recovered roots across harmless display metadata changes', async () => {
+    const repos = [{ ...local }]
+    const store = fixture(repos)
+    registerCreatedWorktreeRoot(store, local, linked)
+    repos[0] = { ...local, displayName: 'Renamed' }
+    invalidateAuthorizedRootsCache()
+    await expect(resolveAuthorizedPath(join(linked, 'file'), store)).resolves.toBe(
+      join(linked, 'file')
+    )
+    expect(mocks.graph).not.toHaveBeenCalled()
+    expect(mocks.stat).not.toHaveBeenCalled()
+  })
+  it('preserves own-store runtime roots but retires a changed runtime identity', async () => {
+    const runtime: Repo = { ...local, executionHostId: 'runtime:a' }
+    const repos = [runtime]
+    const store = fixture(repos)
+    registerCreatedWorktreeRoot(store, runtime, linked)
+    await expect(resolveAuthorizedPath(join(linked, 'file'), store)).resolves.toBe(
+      join(linked, 'file')
+    )
+    repos[0] = { ...runtime, executionHostId: 'runtime:b' }
+    await expectDenied(join(linked, 'file'), store)
+  })
+  it.each(['canonical', 'legacy'] as const)(
+    'discards obsolete %s SSH graph results',
+    async (hostEncoding) => {
+      const graph = deferred<{ path: string }[]>()
+      mocks.graph.mockReturnValueOnce(graph.promise)
+      const repos = [{ ...local }]
+      const store = fixture(repos)
+      const rebuilding = rebuildAuthorizedRootsCache(store)
+      repos[0] =
+        hostEncoding === 'canonical'
+          ? { ...local, executionHostId: 'ssh:remote' }
+          : { ...local, connectionId: 'remote' }
+      invalidateAuthorizedRootsCache()
+      graph.resolve([{ path: linked }])
+      await rebuilding
+      await expectDenied(join(linked, 'file'), store)
+      expect(mocks.graph).toHaveBeenCalledOnce()
+      expect(mocks.stat).not.toHaveBeenCalled()
+    }
+  )
+})
diff --git a/src/main/ipc/registered-worktree-root-probes.ts b/src/main/ipc/registered-worktree-root-probes.ts
new file mode 100644
index 000000000000..ca295f02dd1f
--- /dev/null
+++ b/src/main/ipc/registered-worktree-root-probes.ts
@@ -0,0 +1,70 @@
+import { stat } from 'node:fs/promises'
+import { resolve } from 'node:path'
+import { withTimeout } from '../../shared/promise-timeout-fallback'
+import type { Repo } from '../../shared/repo-types'
+import { getErrorCode } from '../git/worktree-operation-options'
+import { listRepoWorktreeGraph } from '../repo-worktrees'
+
+const CREATED_WORKTREE_ROOT_PROBE_TIMEOUT_MS = 1_000
+const AUTHORIZED_ROOTS_REBUILD_CONCURRENCY = 8
+
+type ListedRoots = { roots: Set<string>; listingFailed: boolean }
+
+export async function listWorktreeRootsWithConcurrency(
+  repos: readonly Repo[]
+): Promise<ListedRoots[]> {
+  const results: ListedRoots[] = []
+  let nextIndex = 0
+  await Promise.all(
+    Array.from(
+      { length: Math.min(AUTHORIZED_ROOTS_REBUILD_CONCURRENCY, repos.length) },
+      async () => {
+        while (nextIndex < repos.length) {
+          const index = nextIndex++
+          const repo = repos[index]
+          const roots = new Set([resolve(repo.path)])
+          let listingFailed = false
+          try {
+            for (const worktree of await listRepoWorktreeGraph(repo)) {
+              roots.add(resolve(worktree.path))
+            }
+          } catch (error) {
+            console.warn(
+              `[filesystem-auth] skipping repo ${repo.path} during cache rebuild:`,
+              error
+            )
+            listingFailed = true
+          }
+          results[index] = { roots, listingFailed }
+        }
+      }
+    )
+  )
+  return results
+}
+
+/** An unavailable mount is not evidence that a recovered worktree disappeared. */
+export async function pruneCreatedWorktreeRoots(
+  recoveredRoots: ReadonlySet<string>,
+  listed: ListedRoots
+): Promise<Set<string>> {
+  const recovered = new Set(recoveredRoots)
+  if (!listed.listingFailed) {
+    await Promise.all(
+      [...recovered].map(async (root) => {
+        if (listed.roots.has(root) || (await isRootGoneFromDisk(root))) {
+          recovered.delete(root)
+        }
+      })
+    )
+  }
+  return recovered
+}
+
+async function isRootGoneFromDisk(targetPath: string): Promise<boolean> {
+  const probe = stat(targetPath).then(
+    () => false,
+    (error: unknown) => getErrorCode(error) === 'ENOENT'
+  )
+  return withTimeout(probe, CREATED_WORKTREE_ROOT_PROBE_TIMEOUT_MS, false)
+}
diff --git a/src/main/ipc/registered-worktree-root-refresh.test.ts b/src/main/ipc/registered-worktree-root-refresh.test.ts
new file mode 100644
index 000000000000..f33221adb05a
--- /dev/null
+++ b/src/main/ipc/registered-worktree-root-refresh.test.ts
@@ -0,0 +1,128 @@
+import { join, resolve } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { Store } from '../persistence'
+import type { Repo } from '../../shared/repo-types'
+
+const mocks = vi.hoisted(() => ({ graph: vi.fn(), stat: vi.fn(), realpath: vi.fn() }))
+vi.mock('node:fs', () => ({ realpathSync: (path: string) => path, statSync: mocks.stat }))
+vi.mock('node:fs/promises', () => ({ stat: mocks.stat, realpath: mocks.realpath }))
+vi.mock('../repo-worktrees', () => ({
+  listRepoWorktreeGraph: mocks.graph,
+  isRepoRoot: vi.fn(() => false)
+}))
+vi.mock('./worktree-logic', () => ({
+  computeWorkspaceRoot: vi.fn(),
+  getWorktreePathSettings: vi.fn()
+}))
+vi.mock('../project-runtime-git-options', () => ({
+  getWorktreeMirrorDistroForRuntime: vi.fn(),
+  resolveLocalProjectRuntimesForRepos: vi.fn()
+}))
+import { resolveAuthorizedPath } from './filesystem-auth'
+import {
+  __resetCreatedWorktreeRootsForTests,
+  invalidateAuthorizedRootsCache,
+  rebuildAuthorizedRootsCache,
+  registerWorktreeRootsForRepo
+} from './registered-worktree-roots-cache'
+
+const root = resolve('/registry-review-repo')
+const linked = resolve('/registry-review-linked')
+const replacement = resolve('/registry-review-replacement')
+const local: Repo = { id: 'owner', path: root, displayName: 'repo', badgeColor: '#000', addedAt: 0 }
+function fixture(repos: Repo[]): Store {
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The actual authorization APIs only read these four store methods; filesystem and graph boundaries are mocked.
+  return {
+    getRepos: () => repos,
+    getProjectGroups: () => [],
+    getFolderWorkspaces: () => [],
+    getSettings: () => ({})
+  } as unknown as Store
+}
+function deferred<T>() {
+  let resolvePromise!: (value: T) => void
+  let rejectPromise!: (error: unknown) => void
+  const promise = new Promise<T>((resolve, reject) => {
+    resolvePromise = resolve
+    rejectPromise = reject
+  })
+  return { promise, resolve: resolvePromise, reject: rejectPromise }
+}
+beforeEach(() => {
+  invalidateAuthorizedRootsCache()
+  __resetCreatedWorktreeRootsForTests()
+  vi.resetAllMocks()
+  mocks.graph.mockResolvedValue([])
+  mocks.stat.mockResolvedValue({})
+  mocks.realpath.mockImplementation(async (path: string) => path)
+})
+afterEach(() => vi.useRealTimers())
+
+describe('current request follows a superseded rebuild', () => {
+  it('rebuilds the current local catalog before deciding a request that joined obsolete work', async () => {
+    const graph = deferred<{ path: string }[]>()
+    mocks.graph.mockReturnValueOnce(graph.promise)
+    const repos = [{ ...local }]
+    const store = fixture(repos)
+    const first = resolveAuthorizedPath(join(linked, 'file'), store)
+    const firstResult = first.then(
+      (value) => ({ value }),
+      (error) => ({ error })
+    )
+    await vi.waitFor(() => expect(mocks.graph).toHaveBeenCalledOnce())
+    repos[0] = { ...local, path: replacement }
+    invalidateAuthorizedRootsCache()
+    mocks.graph.mockResolvedValue([{ path: linked }])
+    const current = resolveAuthorizedPath(join(linked, 'file'), store)
+    const currentResult = current.then(
+      (value) => ({ value }),
+      (error) => ({ error })
+    )
+    await Promise.resolve()
+    await Promise.resolve()
+    await Promise.resolve()
+    graph.resolve([])
+    const [, result] = await Promise.all([firstResult, currentResult])
+    expect(result).toEqual({ value: join(linked, 'file') })
+    expect(mocks.graph).toHaveBeenCalledTimes(2)
+  })
+})
+
+it.each([1, 64, 256])('records catalog work for %s cold-rebuild repositories', async (count) => {
+  let pathReads = 0
+  const repos: Repo[] = Array.from({ length: count }, (_, i) => ({
+    id: `repo-${i}`,
+    get path() {
+      pathReads++
+      return resolve(`/review-repo-${i}`)
+    },
+    displayName: 'repo',
+    badgeColor: '#000',
+    addedAt: 0
+  }))
+  const store = fixture(repos)
+  const getRepos = vi.spyOn(store, 'getRepos')
+  await rebuildAuthorizedRootsCache(store)
+  expect(mocks.graph).toHaveBeenCalledTimes(count)
+  expect(getRepos.mock.calls.length).toBeLessThanOrEqual(3)
+  expect(pathReads).toBeLessThanOrEqual(4 * count)
+})
+it('records catalog work for one warm linked-file authorization', async () => {
+  const repo: Repo = {
+    id: 'repo',
+    path: resolve('/review-repo'),
+    displayName: 'repo',
+    badgeColor: '#000',
+    addedAt: 0
+  }
+  const store = fixture([repo])
+  const getRepos = vi.spyOn(store, 'getRepos')
+  const linked = resolve('/review-linked')
+  registerWorktreeRootsForRepo(store, repo.id, [linked])
+  getRepos.mockClear()
+  await expect(resolveAuthorizedPath(resolve(linked, 'file'), store)).resolves.toBe(
+    resolve(linked, 'file')
+  )
+  expect(mocks.graph).not.toHaveBeenCalled()
+  expect(getRepos.mock.calls.length).toBeLessThanOrEqual(3)
+})
diff --git a/src/main/ipc/registered-worktree-roots-cache.ts b/src/main/ipc/registered-worktree-roots-cache.ts
index ad8c40535cff..30d89fce2dd4 100644
--- a/src/main/ipc/registered-worktree-roots-cache.ts
+++ b/src/main/ipc/registered-worktree-roots-cache.ts
@@ -1,313 +1,244 @@
-import { stat } from 'node:fs/promises'
 import { resolve } from 'node:path'
-import { withTimeout } from '../../shared/promise-timeout-fallback'
-import { getErrorCode } from '../git/worktree-operation-options'
+import type { Repo } from '../../shared/repo-types'
 import type { Store } from '../persistence'
-import { isRepoRoot, listRepoWorktreeGraph } from '../repo-worktrees'
-import { getLocalRepos } from './filesystem-allowed-roots'
+import {
+  listWorktreeRootsWithConcurrency,
+  pruneCreatedWorktreeRoots
+} from './registered-worktree-root-probes'
 import { isDescendantOrEqual, normalizeExistingPath } from './filesystem-path-containment'
+import {
+  getLocalWorktreeRootOwners,
+  resolveWorktreeRootOwner
+} from './registered-worktree-root-owner'
+
+type RegisteredOwner = {
+  repoId: string
+  listed: Set<string> | null
+  recovered: Set<string>
+  aliases: Set<string>
+  revision: number
+  dirty: boolean
+}
 
 const registeredWorktreeRoots = new Set<string>()
-const registeredWorktreeRootsByRepo = new Map<string, Set<string>>()
-/**
- * Roots Git confirmed by direct read while `git worktree list` could not see them.
- *
- * Why a layer of its own: everything in `registeredWorktreeRootsByRepo` is derived from the listing,
- * so a rebuild recomputes it from the very listing that failed and would re-deny a worktree the
- * create just recovered. This layer survives rebuilds and is pruned only on evidence (#16520).
- */
-const createdWorktreeRootsByRepo = new Map<string, Set<string>>()
-/** A recovered create is rare (Git's listing must be broken); cap the layer so it can never grow unbounded. */
-const CREATED_WORKTREE_ROOTS_MAX = 64
-/** The prune runs inside filesystem-auth resolution, so a hung mount must not stall it. */
-const CREATED_WORKTREE_ROOT_PROBE_TIMEOUT_MS = 1_000
-const registeredWorktreeRootRepoIds = new Set<string>()
+const registeredOwners = new Map<string, RegisteredOwner>()
 const registeredWorktreeRootsRevisionByRepo = new Map<string, number>()
-let registeredWorktreeRootsRevisionSequence = 0
-let registeredWorktreeRootsBaseRevision = 0
+const CREATED_WORKTREE_ROOTS_MAX = 64
+let revisionSequence = 0
+let baseRevision = 0
+let invalidationGeneration = 0
+let registryStore: Store | null = null
+let currentOwners = new Map<string, Repo>()
 let registeredWorktreeRootsDirty = true
 let registeredWorktreeRootsRefresh: Promise<void> | null = null
-const AUTHORIZED_ROOTS_REBUILD_CONCURRENCY = 8
 
-export function invalidateAuthorizedRootsCache(): void {
-  registeredWorktreeRootsDirty = true
-  // Why: dirty roots can't be trusted for auth short-circuits; fresh worktrees:list seeds safe per-repo roots before a full rebuild.
-  registeredWorktreeRoots.clear()
-  registeredWorktreeRootsByRepo.clear()
-  registeredWorktreeRootRepoIds.clear()
-  // The recovered layer is deliberately not cleared: repo mutations are frequent, and dropping it here
-  // would re-deny a recovered worktree every time an unrelated repo is added or removed.
-  refreshRegisteredWorktreeRoots()
-  registeredWorktreeRootsBaseRevision = ++registeredWorktreeRootsRevisionSequence
-  registeredWorktreeRootsRevisionByRepo.clear()
+function advanceOwner(owner: RegisteredOwner): void {
+  owner.revision = ++revisionSequence
+  owner.aliases.clear()
+  registeredWorktreeRootsRevisionByRepo.set(owner.repoId, owner.revision)
 }
 
-export async function rebuildAuthorizedRootsCache(store: Store): Promise<void> {
-  // Why: bounded parallelism keeps the Windows speedup without one git process per repo.
-  // Why no realpath here: canonicalizing every root on invalidation would trigger macOS TCC prompts; handlers still canonicalize the target before any operation.
-  const repos = getLocalRepos(store)
-  const perProjectResults = await mapWithConcurrency(
-    repos,
-    AUTHORIZED_ROOTS_REBUILD_CONCURRENCY,
-    async (repo) => {
-      const roots: string[] = []
-      try {
-        roots.push(resolve(repo.path))
-
-        for (const worktree of await listRepoWorktreeGraph(repo)) {
-          roots.push(resolve(worktree.path))
-        }
-      } catch (error) {
-        // Why: one inaccessible repo (EACCES/EIO) must not break the whole rebuild and disable File Explorer/Quick Open for the rest; skip it.
-        console.warn(`[filesystem-auth] skipping repo ${repo.path} during cache rebuild:`, error)
-        return { repoId: repo.id, roots, listingFailed: true }
-      }
-      return { repoId: repo.id, roots, listingFailed: false }
-    }
-  )
-  await pruneCreatedWorktreeRoots(perProjectResults, new Set(repos.map((repo) => repo.id)))
-
-  registeredWorktreeRoots.clear()
-  registeredWorktreeRootsByRepo.clear()
-  registeredWorktreeRootRepoIds.clear()
-  for (const { repoId, roots } of perProjectResults) {
-    const normalizedRoots = new Set<string>()
-    for (const root of roots) {
-      normalizedRoots.add(root)
-      registeredWorktreeRoots.add(root)
-    }
-    registeredWorktreeRootsByRepo.set(repoId, normalizedRoots)
-    registeredWorktreeRootRepoIds.add(repoId)
+function synchronizeOwners(store: Store): Repo[] {
+  const repos = store.getRepos()
+  const owners = getLocalWorktreeRootOwners(repos)
+  if (registryStore !== store) {
+    registeredOwners.clear()
+    registryStore = store
+    invalidationGeneration++
   }
-  for (const roots of createdWorktreeRootsByRepo.values()) {
-    for (const root of roots) {
-      registeredWorktreeRoots.add(root)
+  let changed = currentOwners.size !== owners.size
+  for (const [key, owner] of registeredOwners) {
+    if (!owners.has(key)) {
+      advanceOwner(owner)
+      registeredOwners.delete(key)
+      changed = true
     }
   }
-  registeredWorktreeRootsDirty = false
-  registeredWorktreeRootsBaseRevision = ++registeredWorktreeRootsRevisionSequence
-  registeredWorktreeRootsRevisionByRepo.clear()
-}
-
-/**
- * Retire recovered roots on evidence: the listing can see the worktree again, or it is gone from disk.
- *
- * Nothing is retired for want of evidence. A repo whose listing threw is left untouched, and so is a
- * root whose probe hangs or errors for any reason but ENOENT — a dead mount fails the listing and the
- * probe alike, and pruning on that would revoke the worktree in the very outage this layer exists for.
- */
-async function pruneCreatedWorktreeRoots(
-  results: readonly { repoId: string; roots: string[]; listingFailed: boolean }[],
-  localRepoIds: Set<string>
-): Promise<void> {
-  const listedByRepo = new Map(
-    results.filter((result) => !result.listingFailed).map((r) => [r.repoId, new Set(r.roots)])
-  )
-  const probes: Promise<void>[] = []
-  for (const [repoId, roots] of createdWorktreeRootsByRepo) {
-    if (!localRepoIds.has(repoId)) {
-      createdWorktreeRootsByRepo.delete(repoId)
-      continue
-    }
-    const listed = listedByRepo.get(repoId)
-    if (!listed) {
-      continue
-    }
-    for (const root of roots) {
-      if (listed.has(root)) {
-        roots.delete(root)
-        continue
-      }
-      // Probe in parallel: a repo may hold up to CREATED_WORKTREE_ROOTS_MAX roots, and serial
-      // timeouts would multiply into a rebuild stall of their own.
-      probes.push(
-        isRootGoneFromDisk(root).then((gone) => {
-          if (gone) {
-            roots.delete(root)
-          }
-        })
-      )
+  for (const [key, repo] of owners) {
+    if (!registeredOwners.has(key)) {
+      registeredOwners.set(key, {
+        repoId: repo.id,
+        listed: null,
+        recovered: new Set(),
+        aliases: new Set(),
+        revision: ++revisionSequence,
+        dirty: true
+      })
+      changed = true
     }
   }
-  await Promise.all(probes)
-  for (const [repoId, roots] of createdWorktreeRootsByRepo) {
-    if (roots.size === 0) {
-      createdWorktreeRootsByRepo.delete(repoId)
-    }
+  currentOwners = owners
+  if (changed) {
+    refreshRegisteredWorktreeRoots()
   }
+  registeredWorktreeRootsDirty = [...registeredOwners.values()].some((owner) => owner.dirty)
+  return repos
 }
 
-/** Only a definitive ENOENT counts as removal; the timeout unblocks the rebuild but cannot cancel the syscall. */
-async function isRootGoneFromDisk(targetPath: string): Promise<boolean> {
-  const probe = stat(targetPath).then(
-    () => false,
-    (error: unknown) => getErrorCode(error) === 'ENOENT'
-  )
-  return withTimeout(probe, CREATED_WORKTREE_ROOT_PROBE_TIMEOUT_MS, false)
+export function invalidateAuthorizedRootsCache(): void {
+  invalidationGeneration++
+  for (const owner of registeredOwners.values()) {
+    owner.listed = null
+    owner.dirty = true
+    advanceOwner(owner)
+  }
+  refreshRegisteredWorktreeRoots()
+  registeredWorktreeRootsDirty = true
+  baseRevision = ++revisionSequence
+  registeredWorktreeRootsRevisionByRepo.clear()
 }
 
-async function mapWithConcurrency<T, R>(
-  items: readonly T[],
-  maxConcurrent: number,
-  mapper: (item: T) => Promise<R>
-): Promise<R[]> {
-  const results: R[] = []
-  let nextIndex = 0
-  const workerCount = Math.min(maxConcurrent, items.length)
-  await Promise.all(
-    Array.from({ length: workerCount }, async () => {
-      while (nextIndex < items.length) {
-        const index = nextIndex
-        nextIndex += 1
-        results[index] = await mapper(items[index])
+export async function rebuildAuthorizedRootsCache(store: Store): Promise<void> {
+  synchronizeOwners(store)
+  const generation = invalidationGeneration
+  const pending = [...currentOwners].map(([key, repo]) => ({
+    key,
+    repo,
+    owner: registeredOwners.get(key),
+    revision: registeredOwners.get(key)?.revision
+  }))
+  const listings = await listWorktreeRootsWithConcurrency(pending.map((entry) => entry.repo))
+  const results = pending.map((entry, index) => ({ ...entry, ...listings[index] }))
+  const isCurrent = (entry: (typeof pending)[number]): boolean =>
+    generation === invalidationGeneration &&
+    registeredOwners.get(entry.key) === entry.owner &&
+    entry.owner?.revision === entry.revision
+  synchronizeOwners(store)
+  const pruned = await Promise.all(
+    results.map(async (entry) => {
+      if (!entry.owner || !isCurrent(entry)) {
+        return null
       }
+      const recovered = await pruneCreatedWorktreeRoots(entry.owner.recovered, entry)
+      return { ...entry, recovered }
     })
   )
-  return results
+  synchronizeOwners(store)
+  for (const entry of pruned) {
+    // A fresh create or ownership change makes both the graph and absence probes obsolete.
+    if (!entry || !entry.owner || !isCurrent(entry)) {
+      continue
+    }
+    entry.owner.listed = entry.roots
+    entry.owner.dirty = false
+    entry.owner.recovered = entry.recovered
+    advanceOwner(entry.owner)
+  }
+  refreshRegisteredWorktreeRoots()
+  registeredWorktreeRootsDirty = [...registeredOwners.values()].some((owner) => owner.dirty)
 }
 
 export function registerWorktreeRootsForRepo(
   store: Store,
-  repoId: string,
+  repo: Repo | string,
   worktreeRoots: string[]
 ): void {
-  const localRepoIds = new Set(getLocalRepos(store).map((repo) => repo.id))
-  for (const registeredRepoId of registeredWorktreeRootsByRepo.keys()) {
-    if (!localRepoIds.has(registeredRepoId)) {
-      registeredWorktreeRootsByRepo.delete(registeredRepoId)
-      registeredWorktreeRootRepoIds.delete(registeredRepoId)
-      registeredWorktreeRootsRevisionByRepo.set(
-        registeredRepoId,
-        ++registeredWorktreeRootsRevisionSequence
-      )
-    }
-  }
-
-  if (!localRepoIds.has(repoId)) {
-    refreshRegisteredWorktreeRoots()
-    registeredWorktreeRootsDirty = !allLocalRepoRootsRegistered(localRepoIds)
+  const repos = synchronizeOwners(store)
+  const key = resolveWorktreeRootOwner(repos, repo, currentOwners)
+  const owner = key === undefined ? undefined : registeredOwners.get(key)
+  if (!owner) {
     return
   }
-
-  registeredWorktreeRootsByRepo.set(repoId, new Set(worktreeRoots.map((root) => resolve(root))))
-  registeredWorktreeRootRepoIds.add(repoId)
-  registeredWorktreeRootsRevisionByRepo.set(repoId, ++registeredWorktreeRootsRevisionSequence)
+  owner.listed = new Set(worktreeRoots.map((root) => resolve(root)))
+  owner.dirty = false
+  advanceOwner(owner)
   refreshRegisteredWorktreeRoots()
-  registeredWorktreeRootsDirty = !allLocalRepoRootsRegistered(localRepoIds)
+  registeredWorktreeRootsDirty = [...registeredOwners.values()].some((entry) => entry.dirty)
 }
 
-/**
- * Authorize one worktree root that Git confirmed by direct read but could not list.
- *
- * Why not `registerWorktreeRootsForRepo`: that replaces the repo's set, and a create recovered without
- * a listing has no full set to put there. The root goes in the recovered layer instead, so the next
- * rebuild cannot drop it while Git's listing is still broken (#16520).
- */
+/** Preserve directly confirmed creates when an unavailable listing cannot name them. */
 export function registerCreatedWorktreeRoot(
   store: Store,
-  repoId: string,
+  repo: Repo | string,
   worktreeRoot: string
 ): void {
-  const localRepoIds = new Set(getLocalRepos(store).map((repo) => repo.id))
-  if (!localRepoIds.has(repoId)) {
+  const repos = synchronizeOwners(store)
+  const key = resolveWorktreeRootOwner(repos, repo, currentOwners)
+  const owner = key === undefined ? undefined : registeredOwners.get(key)
+  if (!owner) {
     return
   }
-  const roots = createdWorktreeRootsByRepo.get(repoId) ?? new Set<string>()
   const root = resolve(worktreeRoot)
-  if (!roots.has(root) && roots.size >= CREATED_WORKTREE_ROOTS_MAX) {
-    // Refuse rather than evict: dropping an already-authorized root denies a worktree the user is
-    // using, while declining this one only leaves the new create as unauthorized as it is today.
+  if (!owner.recovered.has(root) && owner.recovered.size >= CREATED_WORKTREE_ROOTS_MAX) {
     console.warn(
-      `[filesystem-auth] recovered-root layer full for repo ${repoId}; not authorizing ${root}`
+      `[filesystem-auth] recovered-root layer full for repo ${owner.repoId}; not authorizing ${root}`
     )
     return
   }
-  roots.add(root)
-  createdWorktreeRootsByRepo.set(repoId, roots)
-  registeredWorktreeRootsRevisionByRepo.set(repoId, ++registeredWorktreeRootsRevisionSequence)
+  owner.recovered.add(root)
+  owner.dirty = true
+  advanceOwner(owner)
   refreshRegisteredWorktreeRoots()
   registeredWorktreeRootsDirty = true
 }
 
-/** The recovered layer outlives cache invalidation by design, so suites need an explicit reset. */
 export function __resetCreatedWorktreeRootsForTests(): void {
-  createdWorktreeRootsByRepo.clear()
+  for (const owner of registeredOwners.values()) {
+    owner.recovered.clear()
+    advanceOwner(owner)
+  }
   refreshRegisteredWorktreeRoots()
 }
 
 export function getRegisteredWorktreeRootsRevision(repoId: string): number {
-  return registeredWorktreeRootsRevisionByRepo.get(repoId) ?? registeredWorktreeRootsBaseRevision
+  return registeredWorktreeRootsRevisionByRepo.get(repoId) ?? baseRevision
 }
 
 export async function ensureAuthorizedRootsCache(store: Store): Promise<void> {
-  if (!registeredWorktreeRootsDirty) {
-    return
-  }
-  if (!registeredWorktreeRootsRefresh) {
-    registeredWorktreeRootsRefresh = rebuildAuthorizedRootsCache(store).finally(() => {
-      registeredWorktreeRootsRefresh = null
-    })
+  synchronizeOwners(store)
+  // Follow one superseded refresh; continuous catalog churn must not pin authorization forever.
+  for (let attempt = 0; registeredWorktreeRootsDirty && attempt < 2; attempt++) {
+    if (!registeredWorktreeRootsRefresh) {
+      registeredWorktreeRootsRefresh = rebuildAuthorizedRootsCache(store).finally(() => {
+        registeredWorktreeRootsRefresh = null
+      })
+    }
+    await registeredWorktreeRootsRefresh
   }
-  await registeredWorktreeRootsRefresh
 }
 
-/**
- * Resolve and verify that a worktree path belongs to a registered repo.
- *
- * Why not resolveAuthorizedPath: linked worktrees can live outside repo/workspace roots; git trusts exact `git worktree list` registration, not containment.
- */
 export async function resolveRegisteredWorktreePath(
   worktreePath: string,
   store: Store
 ): Promise<string> {
-  // Reject malformed paths (null byte) early to prevent probing via realpath.
   if (!worktreePath || worktreePath.includes('\0')) {
     throw new Error('Access denied: invalid worktree path')
   }
-
+  synchronizeOwners(store)
   const resolvedTarget = resolve(worktreePath)
-  if (registeredWorktreeRoots.has(resolvedTarget) || isRepoRoot(store.getRepos(), resolvedTarget)) {
+  if (
+    registeredWorktreeRoots.has(resolvedTarget) ||
+    [...currentOwners.values()].some((repo) => resolve(repo.path) === resolvedTarget)
+  ) {
     return resolvedTarget
   }
-
-  if (registeredWorktreeRootsDirty) {
-    await ensureAuthorizedRootsCache(store)
-  }
-
+  await ensureAuthorizedRootsCache(store)
   if (registeredWorktreeRoots.has(resolvedTarget)) {
     return resolvedTarget
   }
-
-  // Resolve symlinks only after the cheap registered-root check: on macOS realpath() can trigger TCC prompts.
   const normalizedTarget = await normalizeExistingPath(resolvedTarget)
+  synchronizeOwners(store)
   if (registeredWorktreeRoots.has(normalizedTarget)) {
     return normalizedTarget
   }
-
   throw new Error('Access denied: unknown repository or worktree path')
 }
 
 function refreshRegisteredWorktreeRoots(): void {
   registeredWorktreeRoots.clear()
-  for (const byRepo of [registeredWorktreeRootsByRepo, createdWorktreeRootsByRepo]) {
-    for (const roots of byRepo.values()) {
-      for (const root of roots) {
-        registeredWorktreeRoots.add(root)
+  for (const owner of registeredOwners.values()) {
+    for (const roots of [owner.listed, owner.recovered, owner.aliases]) {
+      if (roots) {
+        for (const root of roots) {
+          registeredWorktreeRoots.add(root)
+        }
       }
     }
   }
 }
 
-function allLocalRepoRootsRegistered(localRepoIds: Set<string>): boolean {
-  for (const repoId of localRepoIds) {
-    if (!registeredWorktreeRootRepoIds.has(repoId)) {
-      return false
-    }
-  }
-  return true
-}
-
-export function isRegisteredWorktreePath(targetPath: string): boolean {
+export function isRegisteredWorktreePath(targetPath: string, store: Store): boolean {
+  synchronizeOwners(store)
   for (const root of registeredWorktreeRoots) {
     if (isDescendantOrEqual(targetPath, root)) {
       return true
@@ -318,31 +249,49 @@ export function isRegisteredWorktreePath(targetPath: string): boolean {
 
 export async function isPathAllowedByCanonicalRegisteredRoot(
   targetPath: string,
-  sourcePath: string | undefined
+  sourcePath: string | undefined,
+  store: Store
 ): Promise<boolean> {
   if (!sourcePath) {
     return false
   }
+  synchronizeOwners(store)
   const textualRoot = findRegisteredWorktreeRoot(sourcePath)
   if (!textualRoot) {
     return false
   }
+  const generation = invalidationGeneration
+  const owners = [...registeredOwners.values()]
+    .filter(
+      (owner) =>
+        owner.listed?.has(textualRoot) ||
+        owner.recovered.has(textualRoot) ||
+        owner.aliases.has(textualRoot)
+    )
+    .map((owner) => ({ owner, revision: owner.revision }))
   const canonicalRoot = await normalizeExistingPath(textualRoot)
-  if (!isDescendantOrEqual(targetPath, canonicalRoot)) {
+  synchronizeOwners(store)
+  if (generation !== invalidationGeneration || !isDescendantOrEqual(targetPath, canonicalRoot)) {
     return false
   }
-  // Why: #1524 stopped realpath'ing every root (macOS privacy prompts); cache only the actively-accessed root so /var→/private/var aliases resolve.
-  registeredWorktreeRoots.add(canonicalRoot)
-  return true
+  let allowed = false
+  for (const { owner, revision } of owners) {
+    if (owner.revision !== revision) {
+      continue
+    }
+    owner.aliases.add(canonicalRoot)
+    allowed = true
+  }
+  if (allowed) {
+    registeredWorktreeRoots.add(canonicalRoot)
+  }
+  return allowed
 }
 
 function findRegisteredWorktreeRoot(targetPath: string): string | null {
   let bestRoot: string | null = null
   for (const root of registeredWorktreeRoots) {
-    if (!isDescendantOrEqual(targetPath, root)) {
-      continue
-    }
-    if (!bestRoot || root.length > bestRoot.length) {
+    if (isDescendantOrEqual(targetPath, root) && (!bestRoot || root.length > bestRoot.length)) {
       bestRoot = root
     }
   }
diff --git a/src/main/ipc/remote-filesystem-owner.ts b/src/main/ipc/remote-filesystem-owner.ts
new file mode 100644
index 000000000000..9fc17f83bad4
--- /dev/null
+++ b/src/main/ipc/remote-filesystem-owner.ts
@@ -0,0 +1,25 @@
+import { parseExecutionHostId } from '../../shared/execution-host'
+
+/**
+ * Whether another machine holds this row's files, so its path must not authorize local reads.
+ *
+ * Fails closed on a stamp the parser rejects — empty `ssh:`, a bad escape, an embedded `|` (refused
+ * so an alias cannot be rebound), an unknown prefix. `getSshTargetIdForExecutionHost` answers null
+ * for all of them, and in an allow-list "cannot place this owner" must not read as "this machine".
+ * A `runtime:` stamp stays local: on a repo row it names the store's own runtime, never a peer.
+ */
+export function hasRemoteFilesystemOwner(scope: {
+  connectionId?: string | null
+  executionHostId?: string | null
+}): boolean {
+  // Keep legacy exclusions, including runtime rows whose connection belongs to that runtime.
+  if (scope.connectionId) {
+    return true
+  }
+  const stampedHostId = scope.executionHostId?.trim()
+  if (!stampedHostId) {
+    return false
+  }
+  const host = parseExecutionHostId(stampedHostId)
+  return host === null || host.kind === 'ssh'
+}
diff --git a/src/main/ipc/remote-workspace-relay-sync.ts b/src/main/ipc/remote-workspace-relay-sync.ts
index b4dcab5a0bff..428522240900 100644
--- a/src/main/ipc/remote-workspace-relay-sync.ts
+++ b/src/main/ipc/remote-workspace-relay-sync.ts
@@ -2,7 +2,8 @@ import type {
   RemoteWorkspaceObservedPatchResult,
   RemoteWorkspaceObservedSnapshot,
   RemoteWorkspacePatchResult,
-  RemoteWorkspaceSession
+  RemoteWorkspaceSession,
+  RemoteWorkspaceSnapshot
 } from '../../shared/remote-workspace-types'
 import type { SshTarget } from '../../shared/ssh-types'
 import { getActiveMultiplexer } from './ssh'
@@ -18,9 +19,11 @@ import {
   remoteWorkspaceSessionMatchesSnapshot
 } from './remote-workspace-snapshot-normalization'
 
-export async function getRemoteSnapshot(
-  target: SshTarget
-): Promise<RemoteWorkspaceObservedSnapshot | null> {
+// Keep comparison and cache mutation together in the response continuation.
+export async function readRemoteSnapshot<Result>(
+  target: SshTarget,
+  receive: (snapshot: RemoteWorkspaceSnapshot) => Result
+): Promise<Result | null> {
   const mux = getActiveMultiplexer(target.id)
   if (!mux) {
     return null
@@ -28,8 +31,7 @@ export async function getRemoteSnapshot(
   const namespace = getRemoteWorkspaceNamespace(target)
   try {
     const raw = await mux.request('workspace.get', { namespace })
-    const snapshot = normalizeSnapshot(raw, namespace)
-    return rememberRemoteWorkspaceSnapshot(target.id, snapshot)
+    return receive(normalizeSnapshot(raw, namespace))
   } catch (err) {
     if ((err as { code?: unknown })?.code === -32601) {
       return null
@@ -38,6 +40,14 @@ export async function getRemoteSnapshot(
   }
 }
 
+export function getRemoteSnapshot(
+  target: SshTarget
+): Promise<RemoteWorkspaceObservedSnapshot | null> {
+  return readRemoteSnapshot(target, (snapshot) =>
+    rememberRemoteWorkspaceSnapshot(target.id, snapshot)
+  )
+}
+
 function observePatchResult(
   targetId: string,
   result: RemoteWorkspacePatchResult
diff --git a/src/main/ipc/remote-workspace-snapshot-cache.ts b/src/main/ipc/remote-workspace-snapshot-cache.ts
index 36be88e633a2..2f9e26c5e81a 100644
--- a/src/main/ipc/remote-workspace-snapshot-cache.ts
+++ b/src/main/ipc/remote-workspace-snapshot-cache.ts
@@ -17,11 +17,12 @@ type RemoteWorkspaceSnapshotCacheEntry = {
 
 const latestSnapshotByTargetId = new Map<string, RemoteWorkspaceSnapshotCacheEntry>()
 
-function snapshotsAreIdentical(
-  previous: RemoteWorkspaceObservedSnapshot,
+export function remoteWorkspaceSnapshotsAreIdentical(
+  previous: RemoteWorkspaceSnapshot | undefined,
   next: RemoteWorkspaceSnapshot
 ): boolean {
   return (
+    previous !== undefined &&
     previous.namespace === next.namespace &&
     previous.revision === next.revision &&
     previous.updatedAt === next.updatedAt &&
@@ -59,7 +60,7 @@ export function rememberRemoteWorkspaceSnapshot(
   // observations do not revoke an in-flight upload authority.
   const normalizedSnapshot = normalizeSnapshot(snapshot, snapshot.namespace)
   const current = latestSnapshotByTargetId.get(targetId)
-  if (current && snapshotsAreIdentical(current.snapshot, normalizedSnapshot)) {
+  if (current && remoteWorkspaceSnapshotsAreIdentical(current.snapshot, normalizedSnapshot)) {
     // Re-reading an unchanged revision is not a new host observation. Keep the
     // token (and the contiguous local-patch authorization window) stable so a
     // polling read cannot invalidate an upload that is already in flight.
diff --git a/src/main/ipc/remote-workspace-stale-resync.test.ts b/src/main/ipc/remote-workspace-stale-resync.test.ts
index 2c7ceece9d44..07950563a940 100644
--- a/src/main/ipc/remote-workspace-stale-resync.test.ts
+++ b/src/main/ipc/remote-workspace-stale-resync.test.ts
@@ -1,9 +1,13 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import type { Store } from '../persistence'
+import { SshChannelMultiplexer } from '../ssh/ssh-channel-multiplexer'
+import { encodeJsonRpcFrame } from '../ssh/relay-protocol'
 import {
   REMOTE_WORKSPACE_STALE_NOTIFICATION,
+  REMOTE_WORKSPACE_CHANGED_NOTIFICATION,
   type RemoteWorkspaceChangedEvent,
-  type RemoteWorkspaceSession
+  type RemoteWorkspaceSession,
+  type RemoteWorkspaceSnapshot
 } from '../../shared/remote-workspace-types'
 
 const { getActiveMultiplexerMock, getSshConnectionStoreMock } = vi.hoisted(() => ({
@@ -29,6 +33,13 @@ import {
   handleRemoteWorkspaceNotification,
   registerRemoteWorkspaceHandlers
 } from './remote-workspace'
+import {
+  getCachedRemoteWorkspaceSnapshot,
+  rememberLocallyPatchedRemoteWorkspaceSnapshot,
+  rememberRemoteWorkspaceSnapshot
+} from './remote-workspace-snapshot-cache'
+import { isRemoteWorkspaceResyncInFlight } from './remote-workspace-stale-resync'
+import { CLIENT_ID } from './remote-workspace-client-identity'
 
 function session(activeTabId: string): RemoteWorkspaceSession {
   return {
@@ -41,6 +52,16 @@ function session(activeTabId: string): RemoteWorkspaceSession {
   }
 }
 
+function snapshot(revision: number, tabId: string): RemoteWorkspaceSnapshot {
+  return {
+    namespace: 'target-1',
+    revision,
+    updatedAt: revision,
+    schemaVersion: 1,
+    session: session(tabId)
+  }
+}
+
 describe('workspace.stale resync', () => {
   const sent: RemoteWorkspaceChangedEvent[] = []
   const request = vi.fn()
@@ -150,4 +171,271 @@ describe('workspace.stale resync', () => {
     await Promise.resolve()
     expect(sent).toHaveLength(1)
   })
+
+  it.each(['own', 'peer'] as const)(
+    'checks a %s snapshot against the own patch reply received during its pending read',
+    async (source) => {
+      rememberRemoteWorkspaceSnapshot('target-1', snapshot(1, 'tab-before-patch'))
+      const ownSnapshot = snapshot(2, 'tab-from-own-patch')
+      const readSnapshot = source === 'own' ? ownSnapshot : snapshot(3, 'tab-from-peer')
+      request.mockResolvedValue(readSnapshot)
+      let releaseRead: ((value: RemoteWorkspaceSnapshot) => void) | undefined
+      request.mockImplementationOnce(
+        () =>
+          new Promise<RemoteWorkspaceSnapshot>((resolve) => {
+            releaseRead = resolve
+          })
+      )
+
+      handleRemoteWorkspaceNotification('target-1', REMOTE_WORKSPACE_STALE_NOTIFICATION, {
+        namespace: 'target-1'
+      })
+      expect(request).toHaveBeenCalledTimes(1)
+      expect(isRemoteWorkspaceResyncInFlight('target-1')).toBe(true)
+
+      // The relay publishes the stale marker before returning this client's patch reply.
+      rememberLocallyPatchedRemoteWorkspaceSnapshot('target-1', ownSnapshot)
+      releaseRead?.(readSnapshot)
+      await vi.waitFor(() => expect(isRemoteWorkspaceResyncInFlight('target-1')).toBe(false))
+
+      expect(sent.map((event) => event.snapshot.session.activeTabId)).toEqual(
+        source === 'own' ? [] : ['tab-from-peer']
+      )
+    }
+  )
+
+  it('delivers a peer snapshot cached by a stale-revision patch reply during the read', async () => {
+    rememberRemoteWorkspaceSnapshot('target-1', snapshot(1, 'tab-before-peer'))
+    const peerSnapshot = snapshot(2, 'tab-from-peer')
+    let releaseRead: ((value: RemoteWorkspaceSnapshot) => void) | undefined
+    request.mockImplementationOnce(
+      () =>
+        new Promise<RemoteWorkspaceSnapshot>((resolve) => {
+          releaseRead = resolve
+        })
+    )
+
+    handleRemoteWorkspaceNotification('target-1', REMOTE_WORKSPACE_STALE_NOTIFICATION, {
+      namespace: 'target-1'
+    })
+    // A rejected local patch caches the peer snapshot, but the renderer only records a conflict.
+    rememberRemoteWorkspaceSnapshot('target-1', peerSnapshot)
+    releaseRead?.(peerSnapshot)
+    await vi.waitFor(() => expect(isRemoteWorkspaceResyncInFlight('target-1')).toBe(false))
+
+    expect(sent.map((event) => event.snapshot.session.activeTabId)).toEqual(['tab-from-peer'])
+    expect(request).toHaveBeenCalledTimes(1)
+  })
+
+  it('suppresses an own reply already acknowledged before the marker', async () => {
+    const ownSnapshot = snapshot(2, 'tab-from-own-patch')
+    rememberLocallyPatchedRemoteWorkspaceSnapshot('target-1', ownSnapshot)
+    request.mockResolvedValue(ownSnapshot)
+
+    handleRemoteWorkspaceNotification('target-1', REMOTE_WORKSPACE_STALE_NOTIFICATION, {
+      namespace: 'target-1'
+    })
+    await vi.waitFor(() => expect(isRemoteWorkspaceResyncInFlight('target-1')).toBe(false))
+
+    expect(sent).toEqual([])
+  })
+
+  it('still reads a queued peer change after suppressing the own echo', async () => {
+    const ownSnapshot = snapshot(2, 'tab-from-own-patch')
+    let releaseRead: ((value: RemoteWorkspaceSnapshot) => void) | undefined
+    request.mockImplementationOnce(
+      () =>
+        new Promise<RemoteWorkspaceSnapshot>((resolve) => {
+          releaseRead = resolve
+        })
+    )
+    request.mockResolvedValue(snapshot(3, 'tab-from-peer'))
+
+    for (let index = 0; index < 2; index += 1) {
+      handleRemoteWorkspaceNotification('target-1', REMOTE_WORKSPACE_STALE_NOTIFICATION, {
+        namespace: 'target-1'
+      })
+    }
+
+    rememberLocallyPatchedRemoteWorkspaceSnapshot('target-1', ownSnapshot)
+    releaseRead?.(ownSnapshot)
+    await vi.waitFor(() => expect(isRemoteWorkspaceResyncInFlight('target-1')).toBe(false))
+
+    expect(request).toHaveBeenCalledTimes(2)
+    expect(sent.map((event) => event.snapshot.session.activeTabId)).toEqual(['tab-from-peer'])
+  })
+
+  it('keeps an own acknowledgement from suppressing another target', async () => {
+    const releases: ((value: RemoteWorkspaceSnapshot) => void)[] = []
+    request.mockImplementation(
+      () => new Promise<RemoteWorkspaceSnapshot>((resolve) => releases.push(resolve))
+    )
+    for (const targetId of ['target-1', 'target-2']) {
+      handleRemoteWorkspaceNotification(targetId, REMOTE_WORKSPACE_STALE_NOTIFICATION, {
+        namespace: 'target-1'
+      })
+    }
+    const ownSnapshot = snapshot(2, 'same-tab')
+    rememberLocallyPatchedRemoteWorkspaceSnapshot('target-1', ownSnapshot)
+    releases[0]?.(ownSnapshot)
+    releases[1]?.(ownSnapshot)
+    await vi.waitFor(() => {
+      expect(isRemoteWorkspaceResyncInFlight('target-1')).toBe(false)
+      expect(isRemoteWorkspaceResyncInFlight('target-2')).toBe(false)
+    })
+
+    expect(sent.map((event) => event.targetId)).toEqual(['target-2'])
+  })
+
+  it('does not deliver a captured read after a same-token own acknowledgement advances the cache', async () => {
+    rememberRemoteWorkspaceSnapshot('target-1', snapshot(1, 'initial-tab'))
+    request.mockResolvedValue(snapshot(3, 'newer-own-tab'))
+    let releaseRead: ((value: RemoteWorkspaceSnapshot) => void) | undefined
+    request.mockImplementationOnce(
+      () =>
+        new Promise<RemoteWorkspaceSnapshot>((resolve) => {
+          releaseRead = resolve
+        })
+    )
+    handleRemoteWorkspaceNotification('target-1', REMOTE_WORKSPACE_STALE_NOTIFICATION, {
+      namespace: 'target-1'
+    })
+
+    releaseRead?.(snapshot(2, 'peer-tab'))
+    queueMicrotask(() => {
+      rememberLocallyPatchedRemoteWorkspaceSnapshot('target-1', snapshot(3, 'newer-own-tab'))
+    })
+    await vi.waitFor(() => expect(isRemoteWorkspaceResyncInFlight('target-1')).toBe(false))
+
+    expect(getCachedRemoteWorkspaceSnapshot('target-1')?.revision).toBe(3)
+    expect(sent.map((event) => event.snapshot.revision)).toEqual([])
+    expect(request).toHaveBeenCalledTimes(2)
+  })
+
+  it.each([
+    { source: 'peer', order: 'response-first' },
+    { source: 'peer', order: 'notification-first' },
+    { source: 'own', order: 'response-first' },
+    { source: 'own', order: 'notification-first' }
+  ])(
+    'never publishes an older read after a newer $source notification ($order)',
+    async ({ source, order }) => {
+      let receive: ((data: Buffer) => void) | undefined
+      const mux = new SshChannelMultiplexer({
+        write: () => {},
+        onData: (callback) => {
+          receive = callback
+        },
+        onClose: () => {}
+      })
+      const read = vi.spyOn(mux, 'request')
+      getActiveMultiplexerMock.mockReturnValue(mux)
+      mux.onNotification((method, params) =>
+        handleRemoteWorkspaceNotification('target-1', method, params)
+      )
+      const initial = rememberRemoteWorkspaceSnapshot('target-1', snapshot(2, 'initial-tab'))
+      const sourceClientId = source === 'own' ? CLIENT_ID : 'peer-client'
+      try {
+        handleRemoteWorkspaceNotification('target-1', REMOTE_WORKSPACE_STALE_NOTIFICATION, {
+          namespace: 'target-1'
+        })
+        const reply = { jsonrpc: '2.0', id: 1, result: snapshot(2, 'older-read') } as const
+        const changed = {
+          jsonrpc: '2.0',
+          method: REMOTE_WORKSPACE_CHANGED_NOTIFICATION,
+          params: { snapshot: snapshot(3, 'newer-source'), sourceClientId }
+        } as const
+        const messages = order === 'response-first' ? [reply, changed] : [changed, reply]
+        receive?.(
+          Buffer.concat(messages.map((message, index) => encodeJsonRpcFrame(message, index + 1, 0)))
+        )
+        if (source === 'own') {
+          expect(getCachedRemoteWorkspaceSnapshot('target-1')?.hostObservationToken).toBe(
+            initial.hostObservationToken
+          )
+        }
+        await new Promise((resolve) => setImmediate(resolve))
+        expect(getCachedRemoteWorkspaceSnapshot('target-1')?.revision).toBe(3)
+        expect(sent.map((event) => event.snapshot.revision)).toEqual([3])
+        await vi.waitFor(() => expect(read).toHaveBeenCalledTimes(2))
+        receive?.(
+          encodeJsonRpcFrame({ jsonrpc: '2.0', id: 2, result: snapshot(3, 'newer-source') }, 3, 0)
+        )
+        await vi.waitFor(() => expect(isRemoteWorkspaceResyncInFlight('target-1')).toBe(false))
+        expect(sent.map((event) => event.snapshot.revision)).toEqual([3])
+        expect(sent[0].sourceClientId).toBe(sourceClientId)
+      } finally {
+        mux.dispose()
+      }
+    }
+  )
+
+  it.each([2, 3])(
+    'does not deliver a captured read after peer revision %i replaces it',
+    async (peerRevision) => {
+      rememberRemoteWorkspaceSnapshot('target-1', snapshot(1, 'initial-tab'))
+      const peer = snapshot(peerRevision, 'newer-peer')
+      request.mockResolvedValue(peer)
+      let releaseRead: ((value: RemoteWorkspaceSnapshot) => void) | undefined
+      request.mockImplementationOnce(
+        () =>
+          new Promise<RemoteWorkspaceSnapshot>((resolve) => {
+            releaseRead = resolve
+          })
+      )
+      handleRemoteWorkspaceNotification('target-1', REMOTE_WORKSPACE_STALE_NOTIFICATION, {
+        namespace: 'target-1'
+      })
+
+      releaseRead?.(snapshot(2, 'older-read'))
+      queueMicrotask(() => {
+        handleRemoteWorkspaceNotification('target-1', REMOTE_WORKSPACE_CHANGED_NOTIFICATION, {
+          snapshot: peer,
+          sourceClientId: 'peer-client'
+        })
+      })
+      await vi.waitFor(() => expect(isRemoteWorkspaceResyncInFlight('target-1')).toBe(false))
+
+      expect(getCachedRemoteWorkspaceSnapshot('target-1')?.session.activeTabId).toBe('newer-peer')
+      expect(sent.map((event) => event.snapshot.session.activeTabId)).toEqual(['newer-peer'])
+      expect(request).toHaveBeenCalledTimes(2)
+    }
+  )
+
+  it('accepts a relay reset after rereading a response that raced a host change', async () => {
+    rememberRemoteWorkspaceSnapshot('target-1', snapshot(40, 'before-reset'))
+    request.mockResolvedValue(snapshot(1, 'after-reset'))
+    let releaseRead: ((value: RemoteWorkspaceSnapshot) => void) | undefined
+    request.mockImplementationOnce(
+      () =>
+        new Promise<RemoteWorkspaceSnapshot>((resolve) => {
+          releaseRead = resolve
+        })
+    )
+    handleRemoteWorkspaceNotification('target-1', REMOTE_WORKSPACE_STALE_NOTIFICATION, {
+      namespace: 'target-1'
+    })
+    handleRemoteWorkspaceNotification('target-1', REMOTE_WORKSPACE_CHANGED_NOTIFICATION, {
+      snapshot: snapshot(41, 'last-before-reset'),
+      sourceClientId: 'peer-client'
+    })
+    releaseRead?.(snapshot(1, 'after-reset'))
+    await vi.waitFor(() => expect(isRemoteWorkspaceResyncInFlight('target-1')).toBe(false))
+
+    expect(getCachedRemoteWorkspaceSnapshot('target-1')?.revision).toBe(1)
+    expect(sent.map((event) => event.snapshot.revision)).toEqual([41, 1])
+    expect(request).toHaveBeenCalledTimes(2)
+  })
+
+  it('still accepts a lower revision after a relay reset', async () => {
+    rememberRemoteWorkspaceSnapshot('target-1', snapshot(40, 'before-reset'))
+    request.mockResolvedValue(snapshot(1, 'after-reset'))
+    handleRemoteWorkspaceNotification('target-1', REMOTE_WORKSPACE_STALE_NOTIFICATION, {
+      namespace: 'target-1'
+    })
+    await vi.waitFor(() => expect(isRemoteWorkspaceResyncInFlight('target-1')).toBe(false))
+    expect(getCachedRemoteWorkspaceSnapshot('target-1')?.revision).toBe(1)
+    expect(sent.map((event) => event.snapshot.session.activeTabId)).toEqual(['after-reset'])
+    expect(request).toHaveBeenCalledTimes(1)
+  })
 })
diff --git a/src/main/ipc/remote-workspace-stale-resync.ts b/src/main/ipc/remote-workspace-stale-resync.ts
index 38c96977e976..93f25722df24 100644
--- a/src/main/ipc/remote-workspace-stale-resync.ts
+++ b/src/main/ipc/remote-workspace-stale-resync.ts
@@ -1,7 +1,11 @@
 import type { RemoteWorkspaceObservedSnapshot } from '../../shared/remote-workspace-types'
 import type { SshTarget } from '../../shared/ssh-types'
-import { getRemoteSnapshot } from './remote-workspace-relay-sync'
-import { getCachedRemoteWorkspaceSnapshot } from './remote-workspace-snapshot-cache'
+import { readRemoteSnapshot } from './remote-workspace-relay-sync'
+import {
+  getCachedRemoteWorkspaceSnapshot,
+  remoteWorkspaceSnapshotsAreIdentical,
+  rememberRemoteWorkspaceSnapshot
+} from './remote-workspace-snapshot-cache'
 import { remoteWorkspaceSessionMatchesSnapshot } from './remote-workspace-snapshot-normalization'
 
 type PendingResync = { promise: Promise<void>; requeued: boolean }
@@ -39,17 +43,48 @@ export function resyncStaleRemoteWorkspace(
     try {
       do {
         pending.requeued = false
-        const previous = getCachedRemoteWorkspaceSnapshot(target.id)
-        const snapshot = await getRemoteSnapshot(target)
-        if (!snapshot) {
-          return
+        const cachedBeforeRead = getCachedRemoteWorkspaceSnapshot(target.id)
+        const observation = await readRemoteSnapshot(target, (snapshot) => {
+          // An own patch reply can update the cache while this read is pending.
+          const previous = getCachedRemoteWorkspaceSnapshot(target.id)
+          const changedDuringRead = cachedBeforeRead
+            ? !remoteWorkspaceSnapshotsAreIdentical(previous, cachedBeforeRead)
+            : previous !== undefined
+          if (changedDuringRead) {
+            if (!remoteWorkspaceSnapshotsAreIdentical(previous, snapshot)) {
+              // Reread a conflicting observation; revision comparisons would reject valid relay resets.
+              pending.requeued = true
+              return null
+            }
+            // Only a same-token own ack proves the renderer has this; a stale-revision reply caches undelivered peer state.
+            if (
+              !cachedBeforeRead ||
+              previous?.hostObservationToken === cachedBeforeRead.hostObservationToken
+            ) {
+              return null
+            }
+          }
+          return {
+            unchanged:
+              !changedDuringRead &&
+              remoteWorkspaceSessionMatchesSnapshot(previous, snapshot.session),
+            snapshot: rememberRemoteWorkspaceSnapshot(target.id, snapshot)
+          }
+        })
+        if (!observation) {
+          continue
         }
         // Suppress the echo: our own patch response already cached this session, and re-publishing it
         // makes the renderer rehydrate a state it authored.
-        if (remoteWorkspaceSessionMatchesSnapshot(previous, snapshot.session)) {
+        if (observation.unchanged) {
+          continue
+        }
+        const latest = getCachedRemoteWorkspaceSnapshot(target.id)
+        if (!remoteWorkspaceSnapshotsAreIdentical(latest, observation.snapshot)) {
+          pending.requeued = true
           continue
         }
-        deliver(snapshot)
+        deliver(observation.snapshot)
       } while (pending.requeued)
     } catch (error) {
       onError(error)
diff --git a/src/main/ipc/runtime-environment-cli-removal-routing.test.ts b/src/main/ipc/runtime-environment-cli-removal-routing.test.ts
new file mode 100644
index 000000000000..d0dd7de03e2d
--- /dev/null
+++ b/src/main/ipc/runtime-environment-cli-removal-routing.test.ts
@@ -0,0 +1,180 @@
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { encodePairingOffer } from '../../shared/pairing'
+import { REMOTE_RUNTIME_SHARED_CONTROL_CAPABILITY } from '../../shared/protocol-version'
+import type { RemoteRuntimeSubscription } from '../../shared/remote-runtime-client'
+import {
+  addEnvironmentFromPairingCode,
+  getEnvironmentStorePath,
+  removeEnvironment
+} from '../../shared/runtime-environment-store'
+import {
+  getPreferredPairingOffer,
+  type KnownRuntimeEnvironment
+} from '../../shared/runtime-environments'
+import type { RuntimeRpcResponse } from '../../shared/runtime-rpc-envelope'
+import {
+  applyRuntimeEnvironmentCapabilityVerdict,
+  captureRuntimeEnvironmentCapabilityEvidence,
+  resetRuntimeEnvironmentCapabilityEvidence,
+  runtimeEnvironmentCapabilityOutcome
+} from './runtime-environment-capability-evidence'
+
+type ResponseCallbacks = {
+  onResponse: (response: RuntimeRpcResponse<unknown>) => void
+}
+
+const { subscribeMock, supportsMock } = vi.hoisted(() => ({
+  subscribeMock: vi.fn(),
+  supportsMock: vi.fn()
+}))
+
+vi.mock('electron', () => ({ BrowserWindow: { getAllWindows: () => [] } }))
+vi.mock('../../shared/remote-runtime-client', async (importOriginal) => ({
+  ...(await importOriginal()),
+  subscribeRemoteRuntimeRequest: subscribeMock
+}))
+vi.mock('./runtime-environment-shared-control-support', async (importOriginal) => ({
+  ...(await importOriginal()),
+  supportsSharedControl: supportsMock
+}))
+
+import { createRuntimeEnvironmentStatusOwner } from './runtime-environment-status-owner'
+import { subscribeRuntimeEnvironment } from './runtime-environment-transport-routing'
+
+let userDataPath: string
+
+beforeEach(() => {
+  userDataPath = mkdtempSync(join(tmpdir(), 'orca-cli-removal-routing-'))
+  resetRuntimeEnvironmentCapabilityEvidence()
+  subscribeMock.mockReset()
+  supportsMock.mockReset()
+})
+
+afterEach(() => {
+  rmSync(userDataPath, { recursive: true, force: true })
+})
+
+describe('runtime responses the app can no longer attribute to a saved server', () => {
+  it('keeps verifying status after the store stops resolving the environment', () => {
+    const environment = seedEnvironment()
+    const transport = {
+      isReady: () => false,
+      request: vi.fn(),
+      establish: vi.fn(),
+      pause: vi.fn()
+    }
+    const owner = createRuntimeEnvironmentStatusOwner(userDataPath, environment, transport)
+    removeEnvironment(userDataPath, environment.id)
+
+    // A throw here escapes `void verify()` as an unhandled rejection and skips settleWaiters(),
+    // hanging every refresh() caller until its own 15s timeout.
+    expect(() => owner.acceptVerified(statusResponse())).not.toThrow()
+    // Teardown for a removed environment belongs to the removal watcher, not to a status reader.
+    expect(transport.establish).toHaveBeenCalledOnce()
+    owner.dispose()
+  })
+
+  it.each([
+    ['direct subscription', 'browser.screencast'],
+    ['support-routed subscription on a host without shared control', 'files.watch']
+  ])('forwards a %s response after `orca environment rm`', async (_label, method) => {
+    const { deliver, onEvent, environment } = await subscribed(method)
+    // Mirrors the CLI: it edits the store without telling the running app.
+    removeEnvironment(userDataPath, environment.id)
+    const response = {
+      id: method,
+      ok: true as const,
+      result: {},
+      _meta: { runtimeId: 'r' }
+    }
+
+    expect(() => deliver(response)).not.toThrow()
+    expect(onEvent).toHaveBeenCalledWith({ type: 'response', response })
+  })
+
+  it.each([
+    ['direct subscription', 'browser.screencast'],
+    ['support-routed subscription on a host without shared control', 'files.watch']
+  ])('forwards a %s response when the store file is unreadable', async (_label, method) => {
+    const { deliver, onEvent } = await subscribed(method)
+    // Any store failure is fatal on this path, not just a removal: a half-written or
+    // ACL-hardened settings file reaches the same unguarded socket callback.
+    writeFileSync(getEnvironmentStorePath(userDataPath), '{not json')
+    const response = {
+      id: method,
+      ok: true as const,
+      result: {},
+      _meta: { runtimeId: 'r' }
+    }
+
+    expect(() => deliver(response)).not.toThrow()
+    expect(onEvent).toHaveBeenCalledWith({ type: 'response', response })
+  })
+})
+
+function statusResponse() {
+  return {
+    id: 'status.get',
+    ok: true as const,
+    result: {
+      runtimeId: 'r',
+      rendererGraphEpoch: 1,
+      graphStatus: 'ready' as const,
+      authoritativeWindowId: 1,
+      liveTabCount: 0,
+      liveLeafCount: 0,
+      capabilities: [REMOTE_RUNTIME_SHARED_CONTROL_CAPABILITY]
+    },
+    _meta: { runtimeId: 'r' }
+  }
+}
+
+async function subscribed(method: string) {
+  const environment = seedEnvironment()
+  supportsMock.mockResolvedValue(absentOutcome(environment))
+  let callbacks: ResponseCallbacks | null = null
+  subscribeMock.mockImplementation(
+    async (_pairing, _method, _params, _timeoutMs, received: ResponseCallbacks) => {
+      callbacks = received
+      return { close: () => {} } satisfies Partial<RemoteRuntimeSubscription>
+    }
+  )
+  const onEvent = vi.fn()
+  await subscribeRuntimeEnvironment(userDataPath, environment.id, method, {}, 1000, {
+    onEvent,
+    onClose: () => {}
+  })
+  return {
+    deliver: (response: RuntimeRpcResponse<unknown>) => callbacks?.onResponse(response),
+    onEvent,
+    environment
+  }
+}
+
+function seedEnvironment(): KnownRuntimeEnvironment {
+  return addEnvironmentFromPairingCode(userDataPath, {
+    name: 'dev box',
+    pairingCode: encodePairingOffer({
+      v: 2,
+      endpoint: 'ws://127.0.0.1:6768',
+      deviceToken: 'device-token',
+      publicKeyB64: Buffer.from(new Uint8Array(32).fill(1)).toString('base64')
+    })
+  })
+}
+
+function absentOutcome(environment: KnownRuntimeEnvironment) {
+  const evidence = captureRuntimeEnvironmentCapabilityEvidence(
+    environment.id,
+    getPreferredPairingOffer(environment)
+  )
+  applyRuntimeEnvironmentCapabilityVerdict({
+    evidence,
+    verdict: 'absent',
+    runtimeId: 'r'
+  })
+  return runtimeEnvironmentCapabilityOutcome(evidence, 'absent', 'r')
+}
diff --git a/src/main/ipc/runtime-environment-status-owner.ts b/src/main/ipc/runtime-environment-status-owner.ts
index 4ac3c067f741..26b5264ef9fd 100644
--- a/src/main/ipc/runtime-environment-status-owner.ts
+++ b/src/main/ipc/runtime-environment-status-owner.ts
@@ -8,7 +8,7 @@ import {
   getPreferredPairingOffer,
   type KnownRuntimeEnvironment
 } from '../../shared/runtime-environments'
-import { markEnvironmentUsed } from '../../shared/runtime-environment-store'
+import { recordRuntimeEnvironmentUsage } from './runtime-environment-usage-record'
 import { RuntimeHostStatusOwner } from '../../shared/runtime-host-status-owner'
 import {
   RUNTIME_HOST_STATUS_CHANNEL,
@@ -61,7 +61,7 @@ export function createRuntimeEnvironmentStatusOwner(
         runtimeId: response._meta.runtimeId
       })
       if (accepted && active && !isRuntimeEnvironmentManuallyDisconnected(environment.id)) {
-        markEnvironmentUsed(userDataPath, environment.id, {
+        recordRuntimeEnvironmentUsage(userDataPath, environment.id, {
           runtimeId: response._meta.runtimeId,
           pairedDeviceId: response.result.pairedDeviceId
         })
diff --git a/src/main/ipc/runtime-environment-support-routing.ts b/src/main/ipc/runtime-environment-support-routing.ts
index 9566b2fc1b78..f81d045a568d 100644
--- a/src/main/ipc/runtime-environment-support-routing.ts
+++ b/src/main/ipc/runtime-environment-support-routing.ts
@@ -7,6 +7,7 @@ import type {
 import type { KnownRuntimeEnvironment } from '../../shared/runtime-environments'
 import { getPreferredPairingOffer } from '../../shared/runtime-environments'
 import { markEnvironmentUsed, resolveEnvironment } from '../../shared/runtime-environment-store'
+import { recordRuntimeEnvironmentUsage } from './runtime-environment-usage-record'
 import { ELECTRON_REMOTE_RUNTIME_CLIENT_CAPABILITIES } from '../../shared/protocol-version'
 import {
   subscribeRemoteRuntimeRequest,
@@ -262,7 +263,7 @@ function subscriptionCallbacks(
   return {
     onResponse: (response: RuntimeRpcResponse<unknown>) => {
       if (response.ok && shouldMarkUsed()) {
-        markEnvironmentUsed(args.userDataPath, args.environment.id, {
+        recordRuntimeEnvironmentUsage(args.userDataPath, args.environment.id, {
           runtimeId: response._meta.runtimeId
         })
       }
diff --git a/src/main/ipc/runtime-environment-transport-routing.ts b/src/main/ipc/runtime-environment-transport-routing.ts
index f39962c20cb1..327f1428ea78 100644
--- a/src/main/ipc/runtime-environment-transport-routing.ts
+++ b/src/main/ipc/runtime-environment-transport-routing.ts
@@ -1,6 +1,7 @@
 import { getPreferredPairingOffer } from '../../shared/runtime-environments'
 import { ELECTRON_REMOTE_RUNTIME_CLIENT_CAPABILITIES } from '../../shared/protocol-version'
 import { resolveEnvironment, markEnvironmentUsed } from '../../shared/runtime-environment-store'
+import { recordRuntimeEnvironmentUsage } from './runtime-environment-usage-record'
 import { isOrchestrationMutation } from '../../shared/orchestration-rpc-contract'
 import type {
   RuntimeOrchestrationEnvelope,
@@ -195,7 +196,7 @@ export async function subscribeRuntimeEnvironment(
       return
     }
     markedUsed = true
-    markEnvironmentUsed(userDataPath, environment.id, { runtimeId })
+    recordRuntimeEnvironmentUsage(userDataPath, environment.id, { runtimeId })
   }
   const callbacksWithMarkUsed = {
     onResponse: (response: RuntimeRpcResponse<unknown>) => {
diff --git a/src/main/ipc/runtime-environment-usage-record.ts b/src/main/ipc/runtime-environment-usage-record.ts
new file mode 100644
index 000000000000..af56ede3a30a
--- /dev/null
+++ b/src/main/ipc/runtime-environment-usage-record.ts
@@ -0,0 +1,26 @@
+import { markEnvironmentUsed } from '../../shared/runtime-environment-store'
+
+/**
+ * Records `lastUsedAt` for callers that cannot report a failure to anyone.
+ *
+ * Why: subscription frames arrive on a websocket callback with no promise to reject and no
+ * caller to observe the result, so a throw from the store unwinds into the socket emitter and
+ * kills the main process. `orca environment rm` makes that routine — it edits the store behind
+ * the running app's back, so every later response resolves an environment that is gone. Usage
+ * bookkeeping has no consumer, so nothing here is worth an exception. Awaited request paths keep
+ * calling `markEnvironmentUsed` directly: there the rejection is observable and correct.
+ */
+export function recordRuntimeEnvironmentUsage(
+  userDataPath: string,
+  selector: string,
+  args: { runtimeId?: string | null; pairedDeviceId?: string } = {}
+): void {
+  try {
+    markEnvironmentUsed(userDataPath, selector, args)
+  } catch (error) {
+    console.warn(
+      `Skipped last-used bookkeeping for runtime environment ${selector}:`,
+      error instanceof Error ? error.message : error
+    )
+  }
+}
diff --git a/src/main/ipc/sender-scoped-request-cancellation.test.ts b/src/main/ipc/sender-scoped-request-cancellation.test.ts
new file mode 100644
index 000000000000..e8bfc6b8d6b9
--- /dev/null
+++ b/src/main/ipc/sender-scoped-request-cancellation.test.ts
@@ -0,0 +1,148 @@
+import { EventEmitter } from 'node:events'
+import type { IpcMainInvokeEvent } from 'electron'
+import { describe, expect, it } from 'vitest'
+import { createSenderScopedRequestCancellations } from './sender-scoped-request-cancellation'
+
+function requestEvent(id = 1) {
+  const sender = Object.assign(new EventEmitter(), { id })
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The registry only reads sender.id and its EventEmitter lifetime methods.
+  const event = { sender } as unknown as IpcMainInvokeEvent
+  return { sender, event }
+}
+
+const lifetimeEvents = ['destroyed', 'render-process-gone', 'did-navigate'] as const
+
+describe('sender-scoped request lifetime', () => {
+  it.each(lifetimeEvents)(
+    'aborts every owned request on %s and preserves another sender',
+    (name) => {
+      const registry = createSenderScopedRequestCancellations()
+      const first = requestEvent(1)
+      const second = requestEvent(2)
+      const firstRequests = ['one', 'two'].map((token) => registry.begin(first.event, token))
+      const secondRequest = registry.begin(second.event, 'one')
+
+      first.sender.emit(name)
+
+      expect(firstRequests.map((request) => request?.signal.aborted)).toEqual([true, true])
+      expect(secondRequest?.signal.aborted).toBe(false)
+      for (const eventName of lifetimeEvents) {
+        expect(first.sender.listenerCount(eventName)).toBe(0)
+      }
+      registry.finish(second.event, 'one', secondRequest)
+    }
+  )
+
+  it('keeps only one set of lifecycle listeners for concurrent requests', () => {
+    const registry = createSenderScopedRequestCancellations()
+    const { event, sender } = requestEvent()
+    const controllers = Array.from({ length: 100 }, (_, index) => registry.begin(event, `${index}`))
+
+    for (const name of lifetimeEvents) {
+      expect(sender.listenerCount(name)).toBe(1)
+    }
+    controllers.forEach((controller, index) => registry.finish(event, `${index}`, controller))
+    for (const name of lifetimeEvents) {
+      expect(sender.listenerCount(name)).toBe(0)
+    }
+    expect(controllers.some((controller) => controller?.signal.aborted)).toBe(false)
+  })
+
+  it('does not accumulate live requests across repeated document replacements', () => {
+    const registry = createSenderScopedRequestCancellations()
+    const { event, sender } = requestEvent()
+    const controllers: AbortController[] = []
+    for (let generation = 0; generation < 16; generation++) {
+      if (generation > 0) {
+        sender.emit('did-navigate')
+      }
+      for (let request = 0; request < 100; request++) {
+        const controller = registry.begin(event, `${generation}:${request}`)
+        if (controller) {
+          controllers.push(controller)
+        }
+      }
+    }
+
+    expect(controllers.filter((controller) => !controller.signal.aborted)).toHaveLength(100)
+    for (const name of lifetimeEvents) {
+      expect(sender.listenerCount(name)).toBe(1)
+    }
+    sender.emit('destroyed')
+    expect(controllers.every((controller) => controller.signal.aborted)).toBe(true)
+  })
+
+  it('preserves requests across same-document or prevented navigation', () => {
+    const registry = createSenderScopedRequestCancellations()
+    const { event, sender } = requestEvent()
+    const controller = registry.begin(event, 'one')
+
+    sender.emit('did-start-navigation')
+    sender.emit('will-navigate', { defaultPrevented: true })
+    sender.emit('did-navigate-in-page')
+
+    expect(controller?.signal.aborted).toBe(false)
+    registry.finish(event, 'one', controller)
+  })
+
+  it('keeps the replacement when an old request finishes late', () => {
+    const registry = createSenderScopedRequestCancellations()
+    const { event, sender } = requestEvent()
+    const old = registry.begin(event, 'one')
+    const replacement = registry.begin(event, 'one')
+    expect(old?.signal.aborted).toBe(true)
+
+    registry.finish(event, 'one', old)
+    registry.cancel(event, 'one')
+
+    expect(replacement?.signal.aborted).toBe(true)
+    registry.finish(event, 'one', replacement)
+    for (const name of lifetimeEvents) {
+      expect(sender.listenerCount(name)).toBe(0)
+    }
+  })
+
+  it('does not let a prior document finish remove the current document owner', () => {
+    const registry = createSenderScopedRequestCancellations()
+    const { event, sender } = requestEvent()
+    const old = registry.begin(event, 'one')
+    sender.emit('did-navigate')
+    const current = registry.begin(event, 'one')
+
+    registry.finish(event, 'one', old)
+    expect(current?.signal.aborted).toBe(false)
+    sender.emit('render-process-gone')
+
+    expect(current?.signal.aborted).toBe(true)
+  })
+
+  it('allows synchronous finish callbacks while aborting the owner', () => {
+    const registry = createSenderScopedRequestCancellations()
+    const { event, sender } = requestEvent()
+    const first = registry.begin(event, 'one')
+    const second = registry.begin(event, 'two')
+    first?.signal.addEventListener('abort', () => registry.finish(event, 'one', first))
+    second?.signal.addEventListener('abort', () => registry.finish(event, 'two', second))
+
+    sender.emit('destroyed')
+
+    expect(first?.signal.aborted).toBe(true)
+    expect(second?.signal.aborted).toBe(true)
+    for (const name of lifetimeEvents) {
+      expect(sender.listenerCount(name)).toBe(0)
+    }
+  })
+
+  it('preserves the no-token opt-out and ignores unknown cancellation', () => {
+    const registry = createSenderScopedRequestCancellations()
+    const { event, sender } = requestEvent()
+
+    expect(registry.begin(event, undefined)).toBeNull()
+    expect(registry.begin(event, '')).toBeNull()
+    registry.finish(event, undefined, null)
+    registry.cancel(event, 'unknown')
+    for (const name of lifetimeEvents) {
+      expect(sender.listenerCount(name)).toBe(0)
+    }
+  })
+})
diff --git a/src/main/ipc/sender-scoped-request-cancellation.ts b/src/main/ipc/sender-scoped-request-cancellation.ts
index 9700be9c3da4..229bc33c7fd9 100644
--- a/src/main/ipc/sender-scoped-request-cancellation.ts
+++ b/src/main/ipc/sender-scoped-request-cancellation.ts
@@ -1,4 +1,5 @@
 import type { IpcMainInvokeEvent } from 'electron'
+import { abortWhenRendererGone } from './renderer-lifetime-abort'
 
 export type SenderScopedRequestCancellations = {
   /** Registers a cancellable request; aborts any previous request that reused the token. */
@@ -13,38 +14,67 @@ export type SenderScopedRequestCancellations = {
   cancel: (event: IpcMainInvokeEvent, requestToken: string) => void
 }
 
-/**
- * Registry for renderer-cancellable IPC requests. Keys are scoped to the
- * issuing webContents so one window's token can never cancel another window's
- * request, and reusing a token aborts the previous request before the new one
- * registers.
- */
+type SenderRequests = {
+  controllers: Map<string, AbortController>
+  lifetime: ReturnType<typeof abortWhenRendererGone>
+}
+
+/** Requests belong to the issuing document; one window cannot cancel another's work. */
 export function createSenderScopedRequestCancellations(): SenderScopedRequestCancellations {
-  const controllers = new Map<string, AbortController>()
-  const keyFor = (event: IpcMainInvokeEvent, requestToken: string): string =>
-    `${event.sender.id}\0${requestToken}`
+  const senders = new Map<number, SenderRequests>()
+  const release = (senderId: number, requests: SenderRequests): void => {
+    if (senders.get(senderId) === requests) {
+      senders.delete(senderId)
+    }
+    requests.lifetime.dispose()
+  }
+  const requestsFor = (event: IpcMainInvokeEvent): SenderRequests => {
+    const senderId = event.sender.id
+    let requests = senders.get(senderId)
+    if (!requests) {
+      const lifetime = abortWhenRendererGone(event.sender)
+      const owned: SenderRequests = { controllers: new Map(), lifetime }
+      senders.set(senderId, owned)
+      lifetime.signal.addEventListener(
+        'abort',
+        () => {
+          // Detach before abort callbacks can finish old requests or register new ones.
+          release(senderId, owned)
+          for (const controller of owned.controllers.values()) {
+            controller.abort()
+          }
+          owned.controllers.clear()
+        },
+        { once: true }
+      )
+      requests = owned
+    }
+    return requests
+  }
   return {
     begin: (event, requestToken) => {
       if (!requestToken) {
         return null
       }
-      const key = keyFor(event, requestToken)
-      controllers.get(key)?.abort()
+      senders.get(event.sender.id)?.controllers.get(requestToken)?.abort()
       const controller = new AbortController()
-      controllers.set(key, controller)
+      requestsFor(event).controllers.set(requestToken, controller)
       return controller
     },
     finish: (event, requestToken, controller) => {
       if (!requestToken || !controller) {
         return
       }
-      const key = keyFor(event, requestToken)
-      if (controllers.get(key) === controller) {
-        controllers.delete(key)
+      const requests = senders.get(event.sender.id)
+      if (requests?.controllers.get(requestToken) === controller) {
+        requests.controllers.delete(requestToken)
+        if (requests.controllers.size === 0) {
+          release(event.sender.id, requests)
+        }
       }
     },
     cancel: (event, requestToken) => {
-      controllers.get(keyFor(event, requestToken))?.abort()
+      senders.get(event.sender.id)?.controllers.get(requestToken)?.abort()
     }
   }
 }
diff --git a/src/main/ipc/session.ts b/src/main/ipc/session.ts
index 9fdfd8214b27..cfc60e7ade60 100644
--- a/src/main/ipc/session.ts
+++ b/src/main/ipc/session.ts
@@ -1,11 +1,13 @@
 import { ipcMain } from 'electron'
 import type { Store } from '../persistence'
+import type { OrcaRuntimeService } from '../runtime/orca-runtime'
+import { parseTerminalSurfaceCloseTarget } from '../../shared/terminal-surface-close-target'
 import type {
   WorkspaceSessionPatch,
   WorkspaceSessionState
 } from '../../shared/workspace-session-state-types'
 
-export function registerSessionHandlers(store: Store): void {
+export function registerSessionHandlers(store: Store, runtime: OrcaRuntimeService): void {
   // Why: hostId is an optional second arg so an older renderer that invokes
   // these channels without it keeps reading/writing the 'local' partition
   // exactly as before. Channel names stay stable.
@@ -28,20 +30,37 @@ export function registerSessionHandlers(store: Store): void {
     store.patchWorkspaceSession(args, hostId)
   })
 
+  // Why: a renderer save cannot shrink membership main owns, so each close commits it explicitly.
+  ipcMain.handle(
+    'session:close-terminal-surface',
+    (_event, args: { worktreeId?: unknown; target?: unknown } | undefined) => {
+      const target = parseTerminalSurfaceCloseTarget(args?.target)
+      if (typeof args?.worktreeId !== 'string' || !target) {
+        throw new Error('invalid_terminal_surface')
+      }
+      return runtime.closeTerminalSurfaceFromRenderer(args.worktreeId, target)
+    }
+  )
+
   ipcMain.handle('session:flush', () => {
     // Why: durable lifecycle RPCs must propagate disk failures instead of
     // returning success through Store.flush(), which intentionally only logs.
-    store.flushOrThrow()
+    return store.flushPendingOrThrowAsync()
   })
 
-  // Synchronous variant for the renderer's beforeunload handler.
-  // sendSync blocks the renderer until this returns, guaranteeing the
-  // data (including terminal scrollback buffers) is persisted to disk
-  // before the window closes — regardless of before-quit ordering.
+  // Older renderers block on the reply; main remains free to await the writer.
   ipcMain.on('session:set-sync', (event, args: WorkspaceSessionState, hostId?: string | null) => {
-    store.setWorkspaceSession(args, hostId)
-    store.flush()
-    event.returnValue = true
+    void (async () => {
+      try {
+        store.setWorkspaceSession(args, hostId)
+        await store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
+      } catch (error) {
+        console.error('[persistence] Failed to flush legacy session checkpoint:', error)
+      } finally {
+        // This legacy response has always been best effort, including on disk errors.
+        event.returnValue = true
+      }
+    })()
   })
 
   ipcMain.on(
diff --git a/src/main/ipc/shallow-watch-delivery-probe-lifetime.test.ts b/src/main/ipc/shallow-watch-delivery-probe-lifetime.test.ts
new file mode 100644
index 000000000000..6ca703305183
--- /dev/null
+++ b/src/main/ipc/shallow-watch-delivery-probe-lifetime.test.ts
@@ -0,0 +1,145 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+const h = vi.hoisted(() => ({
+  watch: vi.fn(),
+  mkdir: vi.fn(),
+  write: vi.fn(),
+  remove: vi.fn(),
+  close: vi.fn(),
+  on: vi.fn(),
+  deliver: () => {},
+  fail: () => {}
+}))
+
+vi.mock('node:fs', () => ({ watch: h.watch }))
+vi.mock('node:fs/promises', () => ({
+  mkdtemp: h.mkdir,
+  writeFile: h.write,
+  rm: h.remove
+}))
+
+import {
+  detectShallowWatchDelivery,
+  measureShallowWatchDelivery,
+  resetShallowWatchDeliveryProbeForTests
+} from './shallow-watch-delivery-probe'
+
+beforeEach(() => {
+  vi.useFakeTimers()
+  vi.resetAllMocks()
+  resetShallowWatchDeliveryProbeForTests()
+  h.deliver = () => {}
+  h.fail = () => {}
+  h.mkdir.mockResolvedValue('/fake-shallow-probe')
+  h.write.mockResolvedValue(undefined)
+  h.remove.mockResolvedValue(undefined)
+  h.on.mockImplementation((_event: string, callback: () => void) => {
+    h.fail = callback
+  })
+  h.watch.mockImplementation((_path: string, _options: unknown, callback: () => void) => {
+    h.deliver = callback
+    return { on: h.on, close: h.close }
+  })
+})
+
+afterEach(() => {
+  vi.clearAllTimers()
+  vi.useRealTimers()
+  resetShallowWatchDeliveryProbeForTests()
+})
+
+function expectReleased(): void {
+  expect(h.close).toHaveBeenCalledOnce()
+  expect(vi.getTimerCount()).toBe(0)
+  expect(h.remove).toHaveBeenCalledExactlyOnceWith('/fake-shallow-probe', {
+    recursive: true,
+    force: true
+  })
+}
+
+describe('shallow probe resource ownership', () => {
+  it.each([1, 2])('closes the watcher and clears the timer when write %i fails', async (write) => {
+    if (write === 2) {
+      h.write.mockResolvedValueOnce(undefined)
+    }
+    h.write.mockRejectedValueOnce(new Error('ENOSPC'))
+
+    await expect(measureShallowWatchDelivery()).resolves.toBe(false)
+
+    expect(h.write).toHaveBeenCalledTimes(write)
+    expectReleased()
+    expect(h.close.mock.invocationCallOrder[0]).toBeLessThan(h.remove.mock.invocationCallOrder[0])
+  })
+
+  it('releases resources after successful delivery', async () => {
+    h.write.mockImplementation(async () => h.deliver())
+
+    await expect(measureShallowWatchDelivery()).resolves.toBe(true)
+
+    expect(h.write).toHaveBeenCalledTimes(2)
+    expectReleased()
+  })
+
+  it('releases resources after the delivery deadline', async () => {
+    const result = measureShallowWatchDelivery(20)
+    await vi.advanceTimersByTimeAsync(20)
+
+    await expect(result).resolves.toBe(false)
+    expectReleased()
+  })
+
+  it('releases resources when the watcher reports an error', async () => {
+    h.write.mockImplementation(async () => h.fail())
+
+    await expect(measureShallowWatchDelivery()).resolves.toBe(false)
+    expectReleased()
+  })
+
+  it.each(['delivery', 'write failure'])(
+    'preserves false fallback when close throws after %s',
+    async (outcome) => {
+      h.close.mockImplementation(() => {
+        throw new Error('close failed')
+      })
+      if (outcome === 'delivery') {
+        h.write.mockImplementation(async () => h.deliver())
+      } else {
+        h.write.mockRejectedValueOnce(new Error('write failed'))
+      }
+
+      await expect(measureShallowWatchDelivery()).resolves.toBe(false)
+      expectReleased()
+    }
+  )
+
+  it('removes the directory when watcher creation fails', async () => {
+    h.watch.mockImplementation(() => {
+      throw new Error('EMFILE')
+    })
+
+    await expect(measureShallowWatchDelivery()).resolves.toBe(false)
+
+    expect(h.close).not.toHaveBeenCalled()
+    expect(vi.getTimerCount()).toBe(0)
+    expect(h.remove).toHaveBeenCalledOnce()
+  })
+
+  it('keeps successful delivery when temporary-directory removal fails', async () => {
+    h.write.mockImplementation(async () => h.deliver())
+    h.remove.mockRejectedValue(new Error('cleanup failed'))
+
+    await expect(measureShallowWatchDelivery()).resolves.toBe(true)
+    expectReleased()
+  })
+
+  it('caches a failed probe once per process after releasing its resources', async () => {
+    h.write.mockRejectedValueOnce(new Error('write failed'))
+
+    await expect(detectShallowWatchDelivery()).resolves.toBe(false)
+    await expect(detectShallowWatchDelivery()).resolves.toBe(false)
+
+    expect(h.watch).toHaveBeenCalledOnce()
+    expect(h.write).toHaveBeenCalledOnce()
+    expectReleased()
+  })
+})
diff --git a/src/main/ipc/shallow-watch-delivery-probe.ts b/src/main/ipc/shallow-watch-delivery-probe.ts
index ed32ff39ab1d..09970e4c0828 100644
--- a/src/main/ipc/shallow-watch-delivery-probe.ts
+++ b/src/main/ipc/shallow-watch-delivery-probe.ts
@@ -19,17 +19,22 @@ export async function measureShallowWatchDelivery(timeoutMs = PROBE_TIMEOUT_MS):
     directory = await mkdtemp(join(tmpdir(), 'orca-shallow-probe-'))
     const { promise, resolve } = Promise.withResolvers<boolean>()
     const watcher = watch(directory, { persistent: false }, () => resolve(true))
-    watcher.on('error', () => resolve(false))
-    // Deliberately not unref'd: this one-shot must resolve even if the child
-    // has no other pending work at probe time.
-    const timer = setTimeout(() => resolve(false), timeoutMs)
-    // Two writes: some backends coalesce the creation of the first entry.
-    await writeFile(join(directory, 'probe'), '1')
-    await writeFile(join(directory, 'probe'), '2')
-    const delivered = await promise
-    clearTimeout(timer)
-    watcher.close()
-    return delivered
+    let timer: ReturnType<typeof setTimeout> | undefined
+    try {
+      watcher.on('error', () => resolve(false))
+      // Deliberately not unref'd: this one-shot must resolve even if the child
+      // has no other pending work at probe time.
+      timer = setTimeout(() => resolve(false), timeoutMs)
+      // Two writes: some backends coalesce the creation of the first entry.
+      await writeFile(join(directory, 'probe'), '1')
+      await writeFile(join(directory, 'probe'), '2')
+      return await promise
+    } finally {
+      if (timer !== undefined) {
+        clearTimeout(timer)
+      }
+      watcher.close()
+    }
   } catch {
     return false
   } finally {
diff --git a/src/main/ipc/speech-worker-exit-lifetime.test.ts b/src/main/ipc/speech-worker-exit-lifetime.test.ts
new file mode 100644
index 000000000000..dc0cfb4a210f
--- /dev/null
+++ b/src/main/ipc/speech-worker-exit-lifetime.test.ts
@@ -0,0 +1,288 @@
+import { EventEmitter } from 'node:events'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { Store } from '../persistence'
+import type { ModelManager } from '../speech/model-manager'
+import type { SttService } from '../speech/stt-service'
+import type { RuntimeStore } from '../runtime/runtime-store-contract'
+
+type SpeechHandler = (
+  event: { sender: { id: number } },
+  modelOrSession: string,
+  hotwords?: string[],
+  sessionId?: string
+) => Promise<void>
+
+type TestWorker = EventEmitter & {
+  emitStoppedOnStop: boolean
+  postMessage: (message: { type: string }) => void
+}
+
+const environment = vi.hoisted(
+  (): {
+    handlers: Map<string, SpeechHandler>
+    window: TestWindow | null
+    service: SttService | null
+    workers: TestWorker[]
+    readyOnInit: boolean
+  } => ({
+    handlers: new Map<string, SpeechHandler>(),
+    window: null,
+    service: null,
+    workers: [],
+    readyOnInit: true
+  })
+)
+
+vi.mock('electron', () => ({
+  ipcMain: {
+    handle: (name: string, callback: SpeechHandler) => environment.handlers.set(name, callback)
+  },
+  BrowserWindow: { fromWebContents: () => environment.window },
+  systemPreferences: {
+    getMediaAccessStatus: () => 'granted',
+    askForMediaAccess: async () => true
+  }
+}))
+vi.mock('../speech/speech-runtime-service', () => ({
+  getSpeechModelManager: () => ({ getModelState: async () => ({ status: 'ready' }) }),
+  getSpeechSttService: () => environment.service
+}))
+vi.mock('../speech/openai-api-key-store', () => ({
+  readOpenAiSpeechApiKey: vi.fn(),
+  clearOpenAiSpeechApiKey: vi.fn(),
+  hasOpenAiSpeechApiKey: () => false,
+  saveOpenAiSpeechApiKey: vi.fn()
+}))
+vi.mock('../speech/model-catalog', () => ({
+  SPEECH_MODEL_CATALOG: [],
+  getCatalogModel: () => ({
+    id: 'test-model',
+    provider: 'local',
+    type: 'transducer',
+    streaming: true,
+    sampleRate: 16000,
+    files: []
+  })
+}))
+vi.mock('../speech/stt-worker-paths', () => ({
+  getSttWorkerPath: () => 'unused-worker',
+  getSherpaModulePath: () => 'unused-module'
+}))
+vi.mock('node:worker_threads', async () => {
+  const { EventEmitter: WorkerEvents } = await import('node:events')
+  return {
+    Worker: class extends WorkerEvents implements TestWorker {
+      emitStoppedOnStop = true
+      constructor() {
+        super()
+        environment.workers.push(this)
+      }
+      postMessage(message: { type: string }): void {
+        if (message.type === 'init' && environment.readyOnInit) {
+          queueMicrotask(() => this.emit('message', { type: 'ready' }))
+        }
+        if (message.type === 'stop' && this.emitStoppedOnStop) {
+          queueMicrotask(() => this.emit('message', { type: 'stopped' }))
+        }
+      }
+      async terminate(): Promise<number> {
+        this.emit('exit', 0)
+        return 0
+      }
+    }
+  }
+})
+
+import { registerSpeechHandlers } from './speech'
+import { SttService as SpeechService } from '../speech/stt-service'
+import { RuntimeMobileDictationController } from '../runtime/runtime-mobile-dictation-controller'
+
+class TestWindow extends EventEmitter {
+  destroyed = false
+  webContents = { send: vi.fn() }
+  isDestroyed(): boolean {
+    return this.destroyed
+  }
+}
+
+function handler(name: string): SpeechHandler {
+  const callback = environment.handlers.get(name)
+  if (!callback) {
+    throw new Error(`Missing handler: ${name}`)
+  }
+  return callback
+}
+
+function worker(): TestWorker {
+  const current = environment.workers.at(-1)
+  if (!current) {
+    throw new Error('No worker created')
+  }
+  return current
+}
+
+function service(): SttService {
+  if (!environment.service) {
+    throw new Error('No service created')
+  }
+  return environment.service
+}
+
+const sender = { sender: { id: 9 } }
+const start = (session = 'one'): Promise<void> =>
+  handler('speech:startDictation')(sender, 'test-model', undefined, session)
+const stop = (session = 'one'): Promise<void> => handler('speech:stopDictation')(sender, session)
+
+describe('speech worker exit ownership', () => {
+  let window: TestWindow
+  beforeEach(() => {
+    environment.handlers.clear()
+    environment.workers = []
+    environment.readyOnInit = true
+    window = new TestWindow()
+    environment.window = window
+    const modelManager: Pick<ModelManager, 'getModelState' | 'getModelDir'> = {
+      getModelState: async () => ({ id: 'test-model', status: 'ready' as const }),
+      getModelDir: () => 'unused-model'
+    }
+    environment.service = new SpeechService(
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Local startup reads only these two model-manager methods.
+      modelManager as ModelManager
+    )
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Mocked runtime accessors do not read the store.
+    registerSpeechHandlers({} as Store)
+  })
+  afterEach(async () => {
+    window.destroyed = true
+    window.emit('closed')
+    await Promise.resolve()
+    await Promise.resolve()
+    await service().prepareModelForDeletion('test-model')
+  })
+
+  it.each([0, 1])('releases the window listener after unexpected exit code %i', async (code) => {
+    for (let cycle = 0; cycle < 15; cycle++) {
+      await start(String(cycle))
+      expect(window.listenerCount('closed')).toBe(1)
+      const current = worker()
+      current.emit('exit', code)
+      expect(service().isActive()).toBe(false)
+      expect(window.listenerCount('closed')).toBe(0)
+      expect(current.listenerCount('message')).toBe(0)
+      expect(current.listenerCount('error')).toBe(0)
+      expect(current.listenerCount('exit')).toBe(0)
+      await stop(String(cycle))
+    }
+    expect(
+      window.webContents.send.mock.calls.filter(([name]) => name === 'speech:stopped')
+    ).toHaveLength(15)
+  })
+
+  it('does not duplicate the in-flight stop notification', async () => {
+    await start()
+    worker().emitStoppedOnStop = false
+    const pendingStop = stop()
+    worker().emit('exit', 1)
+    await pendingStop
+    expect(window.listenerCount('closed')).toBe(0)
+    expect(
+      window.webContents.send.mock.calls.filter(([name]) => name === 'speech:stopped')
+    ).toHaveLength(1)
+  })
+
+  it('keeps a normal stop reusable and ignores a later idle-worker exit', async () => {
+    await start()
+    const current = worker()
+    await stop()
+    expect(window.listenerCount('closed')).toBe(0)
+    await start('two')
+    expect(worker()).toBe(current)
+    await stop('two')
+    current.emit('exit', 0)
+    expect(
+      window.webContents.send.mock.calls.filter(([name]) => name === 'speech:stopped')
+    ).toHaveLength(2)
+  })
+
+  it('cleans a failed startup and allows a new session', async () => {
+    environment.readyOnInit = false
+    const pendingStart = start()
+    const rejected = expect(pendingStart).rejects.toThrow('Speech worker exited before ready: 1')
+    await Promise.resolve()
+    worker().emit('exit', 1)
+    await rejected
+    expect(window.listenerCount('closed')).toBe(0)
+    environment.readyOnInit = true
+    await start('two')
+    expect(service().isActive()).toBe(true)
+    await stop('two')
+  })
+
+  it('preserves error delivery and listener cleanup', async () => {
+    await start()
+    const current = worker()
+    current.emit('error', new Error('synthetic failure'))
+    await vi.waitFor(() => expect(window.listenerCount('closed')).toBe(0))
+    expect(window.webContents.send).toHaveBeenCalledWith('speech:error', {
+      error: 'Error: synthetic failure',
+      sessionId: 'one'
+    })
+    current.emit('exit', 1)
+    expect(service().isActive()).toBe(false)
+  })
+
+  it('preserves startup cancellation without duplicate stopped events', async () => {
+    environment.readyOnInit = false
+    const pendingStart = start()
+    const rejected = expect(pendingStart).rejects.toThrow('Speech worker exited before ready: 1')
+    await Promise.resolve()
+    worker().emitStoppedOnStop = false
+    const pendingStop = stop()
+    worker().emit('exit', 1)
+    await Promise.all([pendingStop, rejected])
+    expect(window.listenerCount('closed')).toBe(0)
+    expect(
+      window.webContents.send.mock.calls.filter(([name]) => name === 'speech:stopped')
+    ).toHaveLength(1)
+  })
+
+  it('preserves mobile partial text and completion after worker exit', async () => {
+    const store = { getSettings: () => ({ voice: { enabled: true, sttModel: 'test-model' } }) }
+    const controller = new RuntimeMobileDictationController(
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The controller reads settings; mocked speech accessors ignore the rest of the store.
+      () => store as RuntimeStore
+    )
+    const params = { dictationId: 'mobile', clientId: 'client', connectionId: 'connection' }
+    await controller.start(params)
+    worker().emit('message', { type: 'partial', text: 'keep these words' })
+    worker().emit('exit', 0)
+    await expect(controller.finish(params)).resolves.toEqual({
+      dictationId: 'mobile',
+      text: 'keep these words'
+    })
+    expect(service().isActive()).toBe(false)
+  })
+
+  it('clears old ownership before notifying a sink that immediately starts again', async () => {
+    let restarted: Promise<void> | undefined
+    await service().startDictation(
+      'test-model',
+      (event) => {
+        if (event.type === 'stopped') {
+          restarted = service().startDictation('test-model', vi.fn(), undefined, 'replacement')
+        }
+      },
+      undefined,
+      'original'
+    )
+    const retired = worker()
+    retired.emit('exit', 0)
+    expect(restarted).toBeDefined()
+    await restarted
+    expect(worker()).not.toBe(retired)
+    retired.emit('exit', 0)
+    retired.emit('message', { type: 'stopped' })
+    expect(service().isActive()).toBe(true)
+    await service().stopDictation('replacement')
+  })
+})
diff --git a/src/main/ipc/ssh-connection-state-callbacks.ts b/src/main/ipc/ssh-connection-state-callbacks.ts
index e42b164cae8f..5daa25ed2b17 100644
--- a/src/main/ipc/ssh-connection-state-callbacks.ts
+++ b/src/main/ipc/ssh-connection-state-callbacks.ts
@@ -120,9 +120,9 @@ export function handleSshConnectionStateChange(targetId: string, state: SshConne
 
 export function createSshConnectionCallbacks(): SshConnectionCallbacks {
   return {
-    onCredentialRequest: (targetId, kind, detail, signal) => {
+    onCredentialRequest: (targetId, kind, detail, echo, signal) => {
       credentialRequestedForTarget.add(targetId)
-      return requestCredential(getCurrentMainWindow, targetId, kind, detail, signal)
+      return requestCredential(getCurrentMainWindow, targetId, kind, detail, echo, signal)
     },
     onStateChange: handleSshConnectionStateChange
   }
diff --git a/src/main/ipc/ssh-host-partition-session-export.test.ts b/src/main/ipc/ssh-host-partition-session-export.test.ts
index 39a85658ae0a..1ec5167f866b 100644
--- a/src/main/ipc/ssh-host-partition-session-export.test.ts
+++ b/src/main/ipc/ssh-host-partition-session-export.test.ts
@@ -1,3 +1,4 @@
+import { closeTestStores, createSqliteTestStore } from '../persistence-test-harness'
 /**
  * What the remote-workspace export publishes when the renderer omits `session`, against the real
  * `Store`.
@@ -10,7 +11,7 @@
  * Drives the real `Store` rather than a `getWorkspaceSession` fake: the whole defect is which
  * partition the read reaches, and a fake answers whatever the test tells it to.
  */
-import { mkdtempSync, realpathSync } from 'node:fs'
+import { mkdtempSync, realpathSync, rmSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
@@ -105,12 +106,13 @@ function runtimeAuthoredTab(): TerminalTab {
   }
 }
 
-const stores: InstanceType<typeof Store>[] = []
+const directories: string[] = []
 let hostSnapshot: RemoteWorkspaceSnapshot
 
-afterEach(() => {
-  for (const store of stores.splice(0)) {
-    store.flush()
+afterEach(async () => {
+  await closeTestStores()
+  for (const directory of directories.splice(0)) {
+    rmSync(directory, { recursive: true, force: true })
   }
   vi.restoreAllMocks()
 })
@@ -162,8 +164,8 @@ beforeEach(() => {
  *  local blob still carries the worktree key with an empty list. */
 function createStrandedStore(): InstanceType<typeof Store> {
   const dir = realpathSync(mkdtempSync(join(tmpdir(), 'orca-ssh-partition-export-')))
-  const store = new Store({ dataFile: join(dir, 'orca-data.json') })
-  stores.push(store)
+  directories.push(dir)
+  const store = createSqliteTestStore(Store, { dataFile: join(dir, 'orca-data.json') })
   store.addRepo(remoteRepo(REPO_ID, '/remote/checkout', TARGET_ID))
   // A second populated SSH partition: the fallback has to reach the publishing target's own
   // partition, not merely "some" partition that happens to hold tabs.
diff --git a/src/main/ipc/ssh-passphrase.test.ts b/src/main/ipc/ssh-passphrase.test.ts
index 560ddd6d6f39..f3d2a65f9ed8 100644
--- a/src/main/ipc/ssh-passphrase.test.ts
+++ b/src/main/ipc/ssh-passphrase.test.ts
@@ -25,6 +25,7 @@ describe('SSH credential requests', () => {
       'target-1',
       'keyboard-interactive',
       'Duo response',
+      undefined,
       controller.signal
     )
     const request = vi.mocked(window.webContents.send).mock.calls[0][1] as { requestId: string }
diff --git a/src/main/ipc/ssh-passphrase.ts b/src/main/ipc/ssh-passphrase.ts
index 6de7d483bcd0..abebfa3a3aef 100644
--- a/src/main/ipc/ssh-passphrase.ts
+++ b/src/main/ipc/ssh-passphrase.ts
@@ -18,6 +18,7 @@ export function requestCredential(
   targetId: string,
   kind: SshCredentialKind,
   detail: string,
+  echo?: boolean,
   signal?: AbortSignal
 ): Promise<string | null> {
   const requestId = randomUUID()
@@ -43,7 +44,7 @@ export function requestCredential(
 
   const win = getMainWindow()
   if (win && !win.isDestroyed()) {
-    win.webContents.send('ssh:credential-request', { requestId, targetId, kind, detail })
+    win.webContents.send('ssh:credential-request', { requestId, targetId, kind, detail, echo })
   } else {
     finish(null)
   }
diff --git a/src/main/ipc/telemetry.test.ts b/src/main/ipc/telemetry.test.ts
index 9b28270551a0..b49e1882e98b 100644
--- a/src/main/ipc/telemetry.test.ts
+++ b/src/main/ipc/telemetry.test.ts
@@ -161,6 +161,7 @@ describe('telemetry IPC handlers', () => {
       bucket_source: 'crossed_now'
     })
     handler({}, 'daemon_audit_eligibility', {})
+    handler({}, 'agent_token_usage', {})
     expect(trackMock).not.toHaveBeenCalled()
     expect(getCohortAtEmitMock).not.toHaveBeenCalled()
   })
diff --git a/src/main/ipc/telemetry.ts b/src/main/ipc/telemetry.ts
index 767ebed598fe..ad954b20ce19 100644
--- a/src/main/ipc/telemetry.ts
+++ b/src/main/ipc/telemetry.ts
@@ -23,6 +23,7 @@ import type { EventName, EventProps, OptInVia } from '../../shared/telemetry-eve
 let storeRef: Store | null = null
 
 const MAIN_OWNED_TELEMETRY_EVENTS = new Set<EventName>([
+  'agent_token_usage',
   'app_starred_orca',
   'daemon_adopted',
   'daemon_audit_eligibility',
diff --git a/src/main/ipc/terminal-render-desync-evidence.ts b/src/main/ipc/terminal-render-desync-evidence.ts
index 9ea822465394..dc536faf1f85 100644
--- a/src/main/ipc/terminal-render-desync-evidence.ts
+++ b/src/main/ipc/terminal-render-desync-evidence.ts
@@ -1,9 +1,10 @@
 import { mkdir, readdir, rm, stat, writeFile } from 'node:fs/promises'
 import path from 'node:path'
 import { app, ipcMain } from 'electron'
-import type {
-  WriteTerminalRenderDesyncEvidenceArgs,
-  WriteTerminalRenderDesyncEvidenceResult
+import {
+  TERMINAL_RENDER_DESYNC_CAPTURE_ID_PATTERN,
+  type WriteTerminalRenderDesyncEvidenceArgs,
+  type WriteTerminalRenderDesyncEvidenceResult
 } from '../../shared/terminal-render-desync-evidence'
 import { isTrustedUIRenderer } from './ui'
 
@@ -12,7 +13,6 @@ const MAX_PNG_DATA_URL_BYTES = 40 * 1024 * 1024
 const MAX_METADATA_BYTES = 1024 * 1024
 const MAX_CAPTURE_DIRECTORIES = 4
 const MAX_EVIDENCE_BYTES = 96 * 1024 * 1024
-const CAPTURE_ID_PATTERN = /^[a-zA-Z0-9_-]{1,120}$/
 const PNG_DATA_URL_PREFIX = 'data:image/png;base64,'
 let evidenceWriteQueue = Promise.resolve()
 
@@ -41,7 +41,7 @@ export async function writeTerminalRenderDesyncEvidence(
   userDataPath: string,
   args: WriteTerminalRenderDesyncEvidenceArgs
 ): Promise<WriteTerminalRenderDesyncEvidenceResult> {
-  if (!CAPTURE_ID_PATTERN.test(args.captureId)) {
+  if (!TERMINAL_RENDER_DESYNC_CAPTURE_ID_PATTERN.test(args.captureId)) {
     throw new Error('Invalid render-desync capture id')
   }
   if (args.phase !== 'corrupt' && args.phase !== 'healed') {
diff --git a/src/main/ipc/worktree-head-identity-reader.ts b/src/main/ipc/worktree-head-identity-reader.ts
index 644594033413..37471496999d 100644
--- a/src/main/ipc/worktree-head-identity-reader.ts
+++ b/src/main/ipc/worktree-head-identity-reader.ts
@@ -310,6 +310,12 @@ export async function readGitCommonHeadIdentities(
         cache.entries.delete(name)
       }
     }
+    // Failed entries may have no cached identity; retire their retry markers on the same evidence.
+    for (const name of cache.unverified) {
+      if (!present.has(name)) {
+        cache.unverified.delete(name)
+      }
+    }
   }
   if (entryNames === null || scope.all || scope.listing) {
     await relist()
diff --git a/src/main/ipc/worktree-head-identity-retirement.test.ts b/src/main/ipc/worktree-head-identity-retirement.test.ts
new file mode 100644
index 000000000000..71830e7f3127
--- /dev/null
+++ b/src/main/ipc/worktree-head-identity-retirement.test.ts
@@ -0,0 +1,264 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { join } from 'node:path'
+
+const fake = vi.hoisted(() => ({
+  files: new Map<string, string>(),
+  failures: new Set<string>(),
+  names: new Set<string>(),
+  readFile: vi.fn<(path: string) => Promise<string>>(),
+  readdir: vi.fn<() => Promise<{ name: string; isDirectory: () => boolean }[]>>()
+}))
+vi.mock('node:fs/promises', () => ({ readFile: fake.readFile, readdir: fake.readdir }))
+vi.mock('./worktree-remote', () => ({ notifyWorktreeHeadIdentitiesChanged: vi.fn() }))
+
+import {
+  createWorktreeHeadIdentityCache,
+  readGitCommonHeadIdentities
+} from './worktree-head-identity-reader'
+import {
+  createWorktreeHeadIdentityRefreshState,
+  disposeWorktreeHeadIdentityRefreshState,
+  refreshWorktreeHeadIdentities
+} from './worktree-head-identity-refresh'
+import {
+  FULL_HEAD_IDENTITY_SCOPE,
+  headIdentityScopeForEntry,
+  LISTING_HEAD_IDENTITY_SCOPE,
+  PRIMARY_HEAD_IDENTITY_SCOPE
+} from './worktree-head-identity-scope'
+
+const COMMON = join('/mock', 'project', '.git')
+const OID = 'a'.repeat(40)
+const NEW_OID = 'b'.repeat(40)
+const entryFile = (name: string, file: string): string => join(COMMON, 'worktrees', name, file)
+const worktreePath = (name: string): string => join('/mock', name)
+
+function addEntry(name: string, oid = OID): void {
+  fake.names.add(name)
+  fake.files.set(entryFile(name, 'gitdir'), join(worktreePath(name), '.git'))
+  fake.files.set(entryFile(name, 'HEAD'), oid)
+}
+
+function fsError(code: string): Error {
+  return Object.assign(new Error(`synthetic ${code}`), { code })
+}
+
+beforeEach(() => {
+  vi.useFakeTimers()
+  vi.setSystemTime(1_000_000)
+  vi.resetAllMocks()
+  fake.files.clear()
+  fake.failures.clear()
+  fake.names.clear()
+  fake.files.set(join(COMMON, 'HEAD'), OID)
+  fake.readdir.mockImplementation(async () =>
+    [...fake.names].map((name) => ({ name, isDirectory: () => true }))
+  )
+  fake.readFile.mockImplementation(async (path) => {
+    if (fake.failures.has(path)) {
+      throw fsError('EIO')
+    }
+    const value = fake.files.get(path)
+    if (value === undefined) {
+      throw fsError('ENOENT')
+    }
+    return value
+  })
+})
+
+afterEach(() => {
+  vi.useRealTimers()
+})
+
+describe('head identity failed-entry retirement', () => {
+  it.each([true, false])(
+    'retires removed failure markers with a prior identity: %s',
+    async (seed) => {
+      const name = 'wt-e\u0301'
+      addEntry(name)
+      const cache = createWorktreeHeadIdentityCache()
+      if (seed) {
+        await readGitCommonHeadIdentities(COMMON, cache)
+      }
+      fake.failures.add(entryFile(name, 'HEAD'))
+      const failed = await readGitCommonHeadIdentities(COMMON, cache)
+      expect(failed.complete).toBe(false)
+      expect(cache.unverified.has(name)).toBe(true)
+      expect(cache.entries.has(name)).toBe(seed)
+      fake.names.delete(name)
+
+      const recovered = await readGitCommonHeadIdentities(
+        COMMON,
+        cache,
+        LISTING_HEAD_IDENTITY_SCOPE
+      )
+
+      expect(recovered.complete).toBe(true)
+      expect(cache.unverified.size).toBe(0)
+      expect(cache.entries.size).toBe(0)
+      expect(recovered.identities.map((identity) => identity.worktreePath)).toEqual([
+        join('/mock', 'project')
+      ])
+    }
+  )
+
+  it.each(['EIO', 'ENOTDIR'])(
+    'preserves failure markers when the listing rejects with %s',
+    async (code) => {
+      addEntry('pending')
+      const cache = createWorktreeHeadIdentityCache()
+      await readGitCommonHeadIdentities(COMMON, cache)
+      fake.failures.add(entryFile('pending', 'HEAD'))
+      await readGitCommonHeadIdentities(COMMON, cache)
+      fake.names.delete('pending')
+      fake.readdir.mockRejectedValue(fsError(code))
+
+      const result = await readGitCommonHeadIdentities(COMMON, cache, LISTING_HEAD_IDENTITY_SCOPE)
+
+      expect(result.complete).toBe(false)
+      expect(cache.unverified.has('pending')).toBe(true)
+      expect(cache.entries.get('pending')?.head).toBe(OID)
+      expect(cache.entryNames).toBeNull()
+    }
+  )
+
+  it('retires failures when the worktrees directory is confirmed absent', async () => {
+    addEntry('removed')
+    const cache = createWorktreeHeadIdentityCache()
+    fake.failures.add(entryFile('removed', 'HEAD'))
+    await readGitCommonHeadIdentities(COMMON, cache)
+    fake.readdir.mockRejectedValue(fsError('ENOENT'))
+
+    const result = await readGitCommonHeadIdentities(COMMON, cache, FULL_HEAD_IDENTITY_SCOPE)
+
+    expect(result.complete).toBe(true)
+    expect(cache.unverified.size).toBe(0)
+    expect(cache.entryNames).toEqual([])
+  })
+
+  it('keeps a listed failed entry retryable and preserves its last verified identity', async () => {
+    addEntry('pending')
+    const cache = createWorktreeHeadIdentityCache()
+    await readGitCommonHeadIdentities(COMMON, cache)
+    fake.failures.add(entryFile('pending', 'HEAD'))
+    await readGitCommonHeadIdentities(COMMON, cache)
+
+    const stillFailed = await readGitCommonHeadIdentities(
+      COMMON,
+      cache,
+      LISTING_HEAD_IDENTITY_SCOPE
+    )
+
+    expect(stillFailed.complete).toBe(false)
+    expect(cache.unverified.has('pending')).toBe(true)
+    expect(cache.entries.get('pending')?.head).toBe(OID)
+    fake.failures.clear()
+    fake.files.set(entryFile('pending', 'HEAD'), NEW_OID)
+    const recovered = await readGitCommonHeadIdentities(COMMON, cache, PRIMARY_HEAD_IDENTITY_SCOPE)
+    expect(recovered.complete).toBe(true)
+    expect(cache.entries.get('pending')?.head).toBe(NEW_OID)
+    expect(cache.unverified.size).toBe(0)
+  })
+
+  it('removes only failure markers absent from the successful listing', async () => {
+    addEntry('removed')
+    addEntry('pending')
+    const cache = createWorktreeHeadIdentityCache()
+    fake.failures.add(entryFile('removed', 'gitdir'))
+    fake.failures.add(entryFile('pending', 'gitdir'))
+    await readGitCommonHeadIdentities(COMMON, cache)
+    fake.names.delete('removed')
+
+    const result = await readGitCommonHeadIdentities(COMMON, cache, LISTING_HEAD_IDENTITY_SCOPE)
+
+    expect(result.complete).toBe(false)
+    expect([...cache.unverified]).toEqual(['pending'])
+  })
+
+  it('reads a reused admin-entry name after its failed predecessor was removed', async () => {
+    addEntry('reused')
+    const cache = createWorktreeHeadIdentityCache()
+    fake.failures.add(entryFile('reused', 'HEAD'))
+    await readGitCommonHeadIdentities(COMMON, cache)
+    fake.names.delete('reused')
+    await readGitCommonHeadIdentities(COMMON, cache, LISTING_HEAD_IDENTITY_SCOPE)
+    fake.failures.clear()
+    addEntry('reused', NEW_OID)
+
+    const result = await readGitCommonHeadIdentities(
+      COMMON,
+      cache,
+      headIdentityScopeForEntry('reused')
+    )
+
+    expect(result.complete).toBe(true)
+    expect(cache.entries.get('reused')?.head).toBe(NEW_OID)
+  })
+
+  it('does not retain historical failures after twenty confirmed removals', async () => {
+    const cache = createWorktreeHeadIdentityCache()
+    for (let index = 0; index < 20; index++) {
+      const name = `removed-${index}`
+      addEntry(name)
+      fake.failures.add(entryFile(name, 'HEAD'))
+      await readGitCommonHeadIdentities(COMMON, cache, FULL_HEAD_IDENTITY_SCOPE)
+      fake.names.delete(name)
+      await readGitCommonHeadIdentities(COMMON, cache, LISTING_HEAD_IDENTITY_SCOPE)
+    }
+
+    expect(cache.unverified.size).toBe(0)
+    expect((await readGitCommonHeadIdentities(COMMON, cache)).complete).toBe(true)
+  })
+
+  it('keeps retirement scoped to the cache that received a successful listing', async () => {
+    addEntry('pending')
+    fake.failures.add(entryFile('pending', 'HEAD'))
+    const first = createWorktreeHeadIdentityCache()
+    const second = createWorktreeHeadIdentityCache()
+    await readGitCommonHeadIdentities(COMMON, first)
+    await readGitCommonHeadIdentities(COMMON, second)
+    fake.names.clear()
+
+    await readGitCommonHeadIdentities(COMMON, first, LISTING_HEAD_IDENTITY_SCOPE)
+
+    expect(first.unverified.size).toBe(0)
+    expect([...second.unverified]).toEqual(['pending'])
+  })
+
+  it('restores scoped refresh costs and drops retired baseline rows after recovery', async () => {
+    for (let index = 0; index < 8; index++) {
+      addEntry(`live-${index}`)
+    }
+    addEntry('retired')
+    const state = createWorktreeHeadIdentityRefreshState()
+    const host: Parameters<typeof refreshWorktreeHeadIdentities>[0] = {
+      path: COMMON,
+      repos: new Map([['repo', {}]]),
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Refresh reads only isDestroyed; the window notifier is mocked.
+      mainWindow: { isDestroyed: () => false } as never,
+      disposed: false
+    }
+    try {
+      await refreshWorktreeHeadIdentities(host, state, false)
+      fake.failures.add(entryFile('retired', 'HEAD'))
+      await refreshWorktreeHeadIdentities(host, state, true, headIdentityScopeForEntry('retired'))
+      fake.names.delete('retired')
+      vi.setSystemTime(1_061_000)
+      await refreshWorktreeHeadIdentities(host, state, false, FULL_HEAD_IDENTITY_SCOPE)
+      fake.readFile.mockClear()
+      fake.readdir.mockClear()
+
+      for (let index = 0; index < 4; index++) {
+        await refreshWorktreeHeadIdentities(host, state, true, headIdentityScopeForEntry('live-0'))
+      }
+
+      expect(fake.readFile).toHaveBeenCalledTimes(8)
+      expect(fake.readdir).not.toHaveBeenCalled()
+      expect(state.cache.unverified.size).toBe(0)
+      expect(state.baseline?.size).toBe(9)
+      expect(state.baseline?.has(worktreePath('retired'))).toBe(false)
+    } finally {
+      disposeWorktreeHeadIdentityRefreshState(state)
+    }
+  })
+})
diff --git a/src/main/ipc/worktree-remote.ts b/src/main/ipc/worktree-remote.ts
index ec77b7e900f4..767c6ece2460 100644
--- a/src/main/ipc/worktree-remote.ts
+++ b/src/main/ipc/worktree-remote.ts
@@ -1,3 +1,4 @@
+import { markQoderWorkspaceTrusted } from '../qoder/workspace-trust'
 /* eslint-disable max-lines */
 // Why: worktree create helpers (local + remote) split out of worktrees.ts; the cohesive create flow runs this file just over the per-file line limit.
 
@@ -157,6 +158,7 @@ import {
   markCopilotFolderTrusted,
   markCursorWorkspaceTrusted
 } from '../agent-trust-presets'
+import { awaitAgentTrustWriteWithinDeadline } from '../agent-trust-write-deadline'
 import {
   getLocalProjectGitExecOptions,
   getLocalProjectWorktreeGitOptions,
@@ -438,12 +440,21 @@ async function spawnLocalStartupAndSetupTerminals(args: {
     if (isTuiAgent(createdWithAgent)) {
       const preset = TUI_AGENT_CONFIG[createdWithAgent].preflightTrust
       try {
-        if (preset === 'cursor') {
+        if (preset === 'qoder') {
+          markQoderWorkspaceTrusted(worktree.path)
+        } else if (preset === 'cursor') {
           markCursorWorkspaceTrusted(worktree.path)
         } else if (preset === 'copilot') {
           markCopilotFolderTrusted(worktree.path)
         } else if (preset === 'codex') {
-          markCodexProjectTrusted(worktree.path)
+          // Why: the PTY below spawns Codex immediately; a discarded Promise let
+          // it reach the trust menu before the write landed, and its rejection
+          // escaped this synchronous catch. Bounded so a wedged config lane
+          // cannot stall worktree creation.
+          await awaitAgentTrustWriteWithinDeadline(markCodexProjectTrusted(worktree.path), {
+            preset,
+            workspacePath: worktree.path
+          })
         }
       } catch {
         // Best-effort: launch still proceeds and the agent can ask interactively.
@@ -2741,7 +2752,8 @@ async function performLocalWorktreeCreate(
             branch: branchName,
             baseBranch,
             refreshLocalBaseRef: settings.refreshLocalBaseRefOnWorktreeCreate,
-            options: preparedWorktreeOptions
+            options: preparedWorktreeOptions,
+            timing
           })
           timing.recordPreparedCheckout(
             prepared.status === 'hit'
@@ -2754,6 +2766,9 @@ async function performLocalWorktreeCreate(
             rearm.fire = prepared.rearm
             return prepared.result
           }
+          if (prepared.rearm) {
+            rearm.fire = prepared.rearm
+          }
         } else {
           timing.recordPreparedCheckout({
             status: 'miss',
@@ -2940,14 +2955,14 @@ async function performLocalWorktreeCreate(
   // Why gated: registration replaces the repo's root set, so registering a create recovered without
   // a listing would revoke filesystem access to every worktree that listing would have named.
   if (listingComplete) {
-    registerWorktreeRootsForRepo(store, repo.id, [
+    registerWorktreeRootsForRepo(store, repo, [
       repo.path,
       ...gitWorktrees.map((worktree) => worktree.path)
     ])
   } else {
     // Recovered without a listing: authorize just the new root, or the create the user just made
     // is rejected by filesystem/git-status IPC until a full scan repopulates the cache.
-    registerCreatedWorktreeRoot(store, repo.id, created.path)
+    registerCreatedWorktreeRoot(store, repo, created.path)
   }
 
   // Why: link user-configured shared paths (e.g. `node_modules`, `.env`) before setup runs so setup scripts see them in place.
diff --git a/src/main/ipc/worktrees-authoritative-local-metadata-pruning.test.ts b/src/main/ipc/worktrees-authoritative-local-metadata-pruning.test.ts
index d7549def4ed5..fdeea389d611 100644
--- a/src/main/ipc/worktrees-authoritative-local-metadata-pruning.test.ts
+++ b/src/main/ipc/worktrees-authoritative-local-metadata-pruning.test.ts
@@ -319,7 +319,10 @@ describe('authoritative local worktree metadata pruning integration', () => {
 
       expect(store.removeWorktreeLineage).not.toHaveBeenCalled()
       // Only the detected listing re-derives; its fresh re-scan is what registers the roots.
-      expect(isRegisteredWorktreePath(REPO_PATH)).toBe(channel === 'worktrees:listDetected')
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The fixture supplies the local repository rows read by this registry check.
+      expect(isRegisteredWorktreePath(REPO_PATH, store as never)).toBe(
+        channel === 'worktrees:listDetected'
+      )
     }
   )
 
@@ -357,7 +360,8 @@ describe('authoritative local worktree metadata pruning integration', () => {
     await pending
 
     expect(store.removeWorktreeLineage).not.toHaveBeenCalled()
-    expect(isRegisteredWorktreePath(newPath)).toBe(true)
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The fixture supplies the local repository rows read by this registry check.
+    expect(isRegisteredWorktreePath(newPath, store as never)).toBe(true)
   })
 
   it.each(['scan generation', 'caller request'] as const)(
@@ -406,7 +410,8 @@ describe('authoritative local worktree metadata pruning integration', () => {
 
       expect(store.pruneSessionlessMissingLocalWorktreeMetadataForRepo).not.toHaveBeenCalled()
       expect(store.removeWorktreeLineage).not.toHaveBeenCalled()
-      expect(isRegisteredWorktreePath(REPO_PATH)).toBe(false)
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The fixture supplies the local repository rows read by this registry check.
+      expect(isRegisteredWorktreePath(REPO_PATH, store as never)).toBe(false)
       expect(pruneCleanupScanSnapshotsMock).not.toHaveBeenCalled()
       expect(pruneSpaceAnalysisSnapshotsMock).not.toHaveBeenCalled()
     }
@@ -454,7 +459,8 @@ describe('authoritative local worktree metadata pruning integration', () => {
 
     expect(store.pruneSessionlessMissingLocalWorktreeMetadataForRepo).toHaveBeenCalledTimes(1)
     expect(store.removeWorktreeLineage).not.toHaveBeenCalled()
-    expect(isRegisteredWorktreePath(newPath)).toBe(true)
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The fixture supplies the local repository rows read by this registry check.
+    expect(isRegisteredWorktreePath(newPath, store as never)).toBe(true)
   })
 
   it('does not capture or prune on an initial WSL scan', async () => {
diff --git a/src/main/ipc/worktrees-canonical-ssh-listing.test.ts b/src/main/ipc/worktrees-canonical-ssh-listing.test.ts
new file mode 100644
index 000000000000..31a2b43a9681
--- /dev/null
+++ b/src/main/ipc/worktrees-canonical-ssh-listing.test.ts
@@ -0,0 +1,230 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { hydrateRepo } from '../persistence/tracking-repos/repo-hydration'
+import type { Repo } from '../../shared/repo-types'
+import {
+  getSshProviderAuthority,
+  resetSshProviderAuthorities,
+  rotateSshProviderAuthority
+} from '../ssh/ssh-provider-authority'
+
+const mocks = vi.hoisted(() => ({
+  handlers: new Map<string, (event: unknown, args?: unknown) => unknown>(),
+  provider: vi.fn(),
+  remoteList: vi.fn(),
+  git: vi.fn(),
+  roots: vi.fn(),
+  rootsRevision: vi.fn(),
+  pruneLineage: vi.fn()
+}))
+vi.mock('electron', () => ({
+  ipcMain: {
+    handle: (channel: string, handler: (event: unknown, args?: unknown) => unknown) =>
+      mocks.handlers.set(channel, handler)
+  },
+  app: { getPath: () => '/test' }
+}))
+vi.mock('../git/runner', async (original) => ({
+  ...(await original<Record<string, unknown>>()),
+  gitExecFileAsync: mocks.git
+}))
+vi.mock('../providers/ssh-git-dispatch', () => ({
+  getSshGitProvider: mocks.provider,
+  getSshGitProviderGeneration: () => 1
+}))
+vi.mock('../project-runtime-git-options', () => ({ getLocalProjectWorktreeGitOptions: () => ({}) }))
+vi.mock('./registered-worktree-roots-cache', () => ({
+  getRegisteredWorktreeRootsRevision: mocks.rootsRevision,
+  registerWorktreeRootsForRepo: mocks.roots
+}))
+vi.mock('../worktree-lineage-pruning', () => ({
+  pruneLineageForMissingRepoWorktrees: mocks.pruneLineage
+}))
+vi.mock('./worktrees/listing/authoritative-local-worktree-metadata-pruning', () => ({
+  pruneMetadataMissingFromAuthoritativeLocalScan: vi.fn()
+}))
+import { registerDetectedWorktreeHandlers } from './worktrees/listing/register-detected-worktree-handlers'
+import { registerWorktreeCatalogHandlers } from './worktrees/listing/register-worktree-catalog-handlers'
+import { registerHostCatalogHandlers } from './worktrees/listing/register-host-catalog-handlers'
+import {
+  __resetDetectedWorktreeScanCacheForTests,
+  __getDetectedWorktreeScanCacheStatsForTests,
+  invalidateDetectedWorktreeScanCache,
+  listDetectedGitWorktrees,
+  rememberLocalWorktreeRoots
+} from './worktrees/listing/detected-worktree-scan-cache'
+
+const path = '/remote/repository'
+const rows = [{ path, head: 'abc', branch: 'main', isBare: false, isMainWorktree: true }]
+const channels = ['legacyDetected', 'hostDetected', 'list', 'listAll', 'known'] as const
+function fixture(fields: Pick<Repo, 'connectionId' | 'executionHostId'>) {
+  const repo = hydrateRepo(
+    { id: 'repo', path, displayName: 'repo', badgeColor: '#000', addedAt: 0, ...fields },
+    new Map()
+  )
+  const store = {
+    getRepo: () => repo,
+    getRepos: () => [repo],
+    getProjects: () => [],
+    getSettings: () => ({}),
+    getAllWorktreeMeta: () => ({}),
+    getProjectHostSetups: () => [],
+    getWorktreeMeta: () => undefined,
+    setWorktreeMeta: vi.fn(),
+    getAllWorktreeLineage: () => ({}),
+    getAllWorkspaceLineage: () => ({}),
+    removeWorktreeLineage: vi.fn(),
+    captureNativeLocalWorktreeMetadataScanExpectation: () => undefined
+  }
+  const context = {
+    store,
+    detectedWorktreeCancellations: {
+      begin: () => new AbortController(),
+      finish: () => {},
+      cancel: () => {}
+    }
+  }
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: These handlers only use this store and request cancellation surface.
+  registerDetectedWorktreeHandlers(context as never)
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Catalog listing uses only the supplied store accessors.
+  registerWorktreeCatalogHandlers(context as never)
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Known-host reading uses only the supplied store accessors.
+  registerHostCatalogHandlers(context as never)
+  return { repo, store }
+}
+function invoke(channel: (typeof channels)[number]) {
+  const hostArgs = {
+    repoId: 'repo',
+    executionHostId: 'ssh:host-a',
+    providerRequestId: 'request',
+    expectedAuthority: getSshProviderAuthority('host-a')
+  }
+  if (channel === 'legacyDetected') {
+    return mocks.handlers.get('worktrees:listDetected')!(null, { repoId: 'repo' })
+  }
+  if (channel === 'hostDetected') {
+    return mocks.handlers.get('worktrees:listDetected')!(null, hostArgs)
+  }
+  if (channel === 'known') {
+    return mocks.handlers.get('worktrees:listKnownForExecutionHost')!(null, hostArgs)
+  }
+  return mocks.handlers.get(`worktrees:${channel}`)!(null, { repoId: 'repo' })
+}
+beforeEach(() => {
+  vi.clearAllMocks()
+  mocks.handlers.clear()
+  __resetDetectedWorktreeScanCacheForTests()
+  resetSshProviderAuthorities()
+  mocks.provider.mockReturnValue({ listWorktrees: mocks.remoteList })
+  mocks.remoteList.mockResolvedValue(rows)
+  mocks.rootsRevision.mockReturnValue(1)
+  mocks.git.mockRejectedValue(new Error('unexpected local Git'))
+})
+
+describe.each([
+  { hostEncoding: 'canonical', fields: { executionHostId: 'ssh:host-a' as const } },
+  { hostEncoding: 'legacy', fields: { connectionId: 'host-a' } }
+])('$hostEncoding SSH listing', ({ fields }) => {
+  it.each(channels)('keeps %s on the direct SSH boundary', async (channel) => {
+    fixture(fields)
+    const result = await invoke(channel)
+    if (channel === 'known') {
+      expect(result).toMatchObject({ status: 'complete', result: { authoritative: false } })
+      expect(mocks.remoteList).not.toHaveBeenCalled()
+    } else {
+      expect(mocks.remoteList).toHaveBeenCalledTimes(1)
+      expect(mocks.remoteList.mock.calls[0][0]).toBe(path)
+      if (channel === 'hostDetected') {
+        expect(result).toMatchObject({ status: 'complete', result: { authoritative: true } })
+      } else if (channel === 'legacyDetected') {
+        expect(result).toMatchObject({ authoritative: true })
+      } else {
+        expect(result).toHaveLength(1)
+        expect(mocks.pruneLineage).toHaveBeenCalledTimes(1)
+      }
+    }
+    expect(mocks.git).not.toHaveBeenCalled()
+    expect(mocks.roots).not.toHaveBeenCalled()
+    expect(__getDetectedWorktreeScanCacheStatsForTests()).toEqual({ cacheSize: 0, inFlightSize: 0 })
+  })
+
+  it('reports disconnection without replaying an authoritative local-cache answer', async () => {
+    fixture(fields)
+    await invoke('legacyDetected')
+    mocks.provider.mockReturnValue(undefined)
+    expect(await invoke('legacyDetected')).toMatchObject({ authoritative: false })
+    expect(mocks.git).not.toHaveBeenCalled()
+  })
+
+  it('rejects a legacy listing after provider authority rotates', async () => {
+    fixture(fields)
+    let finish = (_rows: typeof rows): void => {}
+    mocks.remoteList.mockReturnValue(
+      new Promise<typeof rows>((resolve) => {
+        finish = resolve
+      })
+    )
+    const pending = invoke('legacyDetected')
+    await Promise.resolve()
+    rotateSshProviderAuthority('host-a')
+    finish(rows)
+    expect(await pending).toMatchObject({ authoritative: false })
+    expect(mocks.roots).not.toHaveBeenCalled()
+    expect(mocks.pruneLineage).not.toHaveBeenCalled()
+  })
+
+  it('bypasses local cache when the lower scan entry point is called directly', async () => {
+    const { repo, store } = fixture(fields)
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Remote scan bypass only needs the mocked Git options and provider.
+    await listDetectedGitWorktrees(store as never, repo)
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Remote scan bypass only needs the mocked Git options and provider.
+    await listDetectedGitWorktrees(store as never, repo)
+    expect(mocks.remoteList).toHaveBeenCalledTimes(2)
+    expect(__getDetectedWorktreeScanCacheStatsForTests()).toEqual({ cacheSize: 0, inFlightSize: 0 })
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: A remote row must return before reading the store.
+    rememberLocalWorktreeRoots(store as never, repo, rows)
+    expect(mocks.roots).not.toHaveBeenCalled()
+  })
+
+  it.each([
+    ['list', 'mutation'],
+    ['listAll', 'mutation'],
+    ['list', 'roots revision'],
+    ['listAll', 'roots revision']
+  ] as const)('preserves lineage when %s is overtaken by a %s', async (channel, change) => {
+    const { repo } = fixture(fields)
+    let finish = (_rows: typeof rows): void => {}
+    mocks.remoteList.mockReturnValue(
+      new Promise<typeof rows>((resolve) => {
+        finish = resolve
+      })
+    )
+    const pending = invoke(channel)
+    expect(mocks.remoteList).toHaveBeenCalledTimes(1)
+    if (change === 'mutation') {
+      invalidateDetectedWorktreeScanCache(repo.id)
+    } else {
+      mocks.rootsRevision.mockReturnValue(2)
+    }
+    finish(rows)
+    expect(await pending).toHaveLength(1)
+    expect(mocks.pruneLineage).not.toHaveBeenCalled()
+    expect(mocks.roots).not.toHaveBeenCalled()
+  })
+})
+
+it.each([undefined, 'nested'])(
+  'keeps runtime rows out of local cache and root registration: %s',
+  async (connectionId) => {
+    const { repo, store } = fixture({ executionHostId: 'runtime:env', connectionId })
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Runtime scan must reject before any listing or store side effects.
+    await expect(listDetectedGitWorktrees(store as never, repo)).rejects.toThrow(
+      'not reachable from this process'
+    )
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: A nonlocal row must return before reading the store.
+    rememberLocalWorktreeRoots(store as never, repo, rows)
+    expect(mocks.provider).not.toHaveBeenCalled()
+    expect(mocks.git).not.toHaveBeenCalled()
+    expect(mocks.roots).not.toHaveBeenCalled()
+    expect(__getDetectedWorktreeScanCacheStatsForTests()).toEqual({ cacheSize: 0, inFlightSize: 0 })
+  }
+)
diff --git a/src/main/ipc/worktrees-removal-recovery.test.ts b/src/main/ipc/worktrees-removal-recovery.test.ts
index cfe962cc09a3..d3231d50bd87 100644
--- a/src/main/ipc/worktrees-removal-recovery.test.ts
+++ b/src/main/ipc/worktrees-removal-recovery.test.ts
@@ -279,6 +279,60 @@ describe('registerWorktreeHandlers', () => {
     })
   })
 
+  it.each(['unproven', 'removal-fails'] as const)(
+    'keeps desktop orphan cleanup retryable when the directory is %s',
+    async (mode) => {
+      const parentDir = await mkdtemp(join(tmpdir(), 'orca-ipc-orphan-retention-'))
+      const repoPath = join(parentDir, 'repo')
+      const orphanPath = join(parentDir, 'orphan')
+      const worktreeId = `repo-1::${orphanPath}`
+      await mkdir(orphanPath, { recursive: true })
+      if (mode === 'removal-fails') {
+        const adminPath = join(repoPath, '.git', 'worktrees', 'orphan')
+        await mkdir(adminPath, { recursive: true })
+        await writeFile(join(orphanPath, '.git'), `gitdir: ${adminPath}\n`)
+        await writeFile(join(adminPath, 'gitdir'), `${join(orphanPath, '.git')}\n`)
+      }
+      const repo = { id: 'repo-1', path: repoPath, displayName: 'repo', badgeColor: '', addedAt: 0 }
+      store.getRepos.mockReturnValue([repo])
+      store.getRepo.mockReturnValue(repo)
+      mockKnownFeatureWorktree(orphanPath, repoPath)
+      getEffectiveHooksMock.mockReturnValue(null)
+      removeWorktreeMock.mockRejectedValue(
+        Object.assign(new Error('Git remove failed'), {
+          stderr: `fatal: '${orphanPath}' is not a working tree`
+        })
+      )
+      const finish = vi.fn().mockResolvedValue(undefined)
+      runtimeStub.acquireFileWatcherRemoval.mockResolvedValue({ finish })
+      const removePath = vi
+        .spyOn(localWorktreeFilesystem, 'removeLocalWorktreePath')
+        .mockRejectedValue(new Error('injected removal failure'))
+      try {
+        await expect(handlers['worktrees:remove'](null, { worktreeId })).rejects.toThrow(
+          'Worktree is no longer registered with Git but its directory remains.'
+        )
+        await expect(lstat(orphanPath)).resolves.toBeTruthy()
+        expect(store.removeWorktreeMeta).not.toHaveBeenCalled()
+        expect(gitExecFileAsyncMock).not.toHaveBeenCalledWith(
+          ['worktree', 'prune'],
+          expect.anything()
+        )
+        expect(finish).toHaveBeenCalledWith(false)
+        expect(removePath).toHaveBeenCalledTimes(mode === 'removal-fails' ? 1 : 0)
+        await rm(orphanPath, { recursive: true, force: true })
+        await expect(handlers['worktrees:remove'](null, { worktreeId })).resolves.toEqual({
+          catalogVersion: anyCatalogVersion
+        })
+        expect(store.removeWorktreeMeta).toHaveBeenCalledWith(worktreeId, 'local')
+        expect(finish).toHaveBeenLastCalledWith(true)
+      } finally {
+        removePath.mockRestore()
+        await rm(parentDir, { recursive: true, force: true })
+      }
+    }
+  )
+
   it('recovers forced Windows long-path worktree removal through local deletion and prune', async () => {
     setPlatform('win32')
     const parentDir = await mkdtemp(join(tmpdir(), 'orca-ipc-long-path-'))
diff --git a/src/main/ipc/worktrees-ssh-provider-authority.test.ts b/src/main/ipc/worktrees-ssh-provider-authority.test.ts
index 8c2d6b0edd7e..8d14755ab18d 100644
--- a/src/main/ipc/worktrees-ssh-provider-authority.test.ts
+++ b/src/main/ipc/worktrees-ssh-provider-authority.test.ts
@@ -264,51 +264,59 @@ describe('registerWorktreeHandlers', () => {
     expect(store.removeWorktreeLineage).not.toHaveBeenCalled()
   })
 
-  it('cancels an SSH provider request by sender-scoped provider request ID', async () => {
-    let providerSignal: AbortSignal | undefined
-    const provider = {
-      listWorktrees: vi.fn(
-        (_repoPath: string, options?: { signal?: AbortSignal }) =>
-          new Promise<GitWorktreeInfo[]>((_resolve, reject) => {
-            providerSignal = options?.signal
-            providerSignal?.addEventListener(
-              'abort',
-              () => reject(new DOMException('Canceled', 'AbortError')),
-              { once: true }
-            )
-          })
-      )
-    }
-    const sshRepo = {
-      id: 'repo-1',
-      path: '/remote/repo',
-      displayName: 'repo',
-      badgeColor: '#000',
-      addedAt: 0,
-      connectionId: 'target-a'
-    }
-    store.getRepos.mockReturnValue([sshRepo])
-    getSshGitProviderMock.mockReturnValue(provider)
+  it.each(['cancel', 'did-navigate', 'render-process-gone', 'destroyed'])(
+    'cancels an SSH provider request on %s',
+    async (eventName) => {
+      let providerSignal: AbortSignal | undefined
+      const provider = {
+        listWorktrees: vi.fn(
+          (_repoPath: string, options?: { signal?: AbortSignal }) =>
+            new Promise<GitWorktreeInfo[]>((_resolve, reject) => {
+              providerSignal = options?.signal
+              providerSignal?.addEventListener(
+                'abort',
+                () => reject(new DOMException('Canceled', 'AbortError')),
+                { once: true }
+              )
+            })
+        )
+      }
+      const sshRepo = {
+        id: 'repo-1',
+        path: '/remote/repo',
+        displayName: 'repo',
+        badgeColor: '#000',
+        addedAt: 0,
+        connectionId: 'target-a'
+      }
+      store.getRepos.mockReturnValue([sshRepo])
+      getSshGitProviderMock.mockReturnValue(provider)
 
-    const pending = handlers['worktrees:listDetected'](ipcEvent, {
-      providerRequestId: 'request-1' as ProviderRequestId,
-      repoId: sshRepo.id,
-      executionHostId: toSshExecutionHostId('target-a'),
-      expectedAuthority: getSshProviderAuthority('target-a')
-    })
-    await Promise.resolve()
-    handlers['worktrees:cancelListDetected'](ipcEvent, {
-      providerRequestId: 'request-1' as ProviderRequestId
-    })
+      const pending = handlers['worktrees:listDetected'](ipcEvent, {
+        providerRequestId: 'request-1' as ProviderRequestId,
+        repoId: sshRepo.id,
+        executionHostId: toSshExecutionHostId('target-a'),
+        expectedAuthority: getSshProviderAuthority('target-a')
+      })
+      await Promise.resolve()
+      if (eventName === 'cancel') {
+        handlers['worktrees:cancelListDetected'](ipcEvent, {
+          providerRequestId: 'request-1' as ProviderRequestId
+        })
+      } else {
+        ipcEvent.sender.emit(eventName)
+      }
 
-    expect(providerSignal?.aborted).toBe(true)
-    await expect(pending).resolves.toMatchObject({
-      status: 'canceled',
-      providerRequestId: 'request-1'
-    })
-    expect(store.setWorktreeMeta).not.toHaveBeenCalled()
-    expect(store.removeWorktreeLineage).not.toHaveBeenCalled()
-  })
+      expect(providerSignal?.aborted).toBe(true)
+      await expect(pending).resolves.toMatchObject({
+        status: 'canceled',
+        providerRequestId: 'request-1'
+      })
+      expect(store.setWorktreeMeta).not.toHaveBeenCalled()
+      expect(store.removeWorktreeLineage).not.toHaveBeenCalled()
+      expect(ipcEvent.sender.eventNames()).toEqual([])
+    }
+  )
 
   it('settles a noncooperative SSH provider at the main-owned deadline and cleans up', async () => {
     vi.useFakeTimers()
diff --git a/src/main/ipc/worktrees-test-ipc-surface.ts b/src/main/ipc/worktrees-test-ipc-surface.ts
index 7df4f6cda0a9..985107b067e0 100644
--- a/src/main/ipc/worktrees-test-ipc-surface.ts
+++ b/src/main/ipc/worktrees-test-ipc-surface.ts
@@ -1,3 +1,4 @@
+import { EventEmitter } from 'node:events'
 import { type Mock, vi } from 'vitest'
 import type { WorktreeMeta } from '../../shared/worktree/meta-types'
 
@@ -50,7 +51,7 @@ export const mainWindow: TestMainWindow = {
     send: vi.fn()
   }
 }
-export const ipcEvent = { sender: { id: 1 } }
+export const ipcEvent = { sender: Object.assign(new EventEmitter(), { id: 1 }) }
 export const store: TestStore = {
   getProfileStorageDirectory: vi.fn(() => '/profile-a'),
   getRepos: vi.fn(),
diff --git a/src/main/ipc/worktrees/listing/detected-provider-listing.ts b/src/main/ipc/worktrees/listing/detected-provider-listing.ts
index 84243189b0b8..975cb5eeb783 100644
--- a/src/main/ipc/worktrees/listing/detected-provider-listing.ts
+++ b/src/main/ipc/worktrees/listing/detected-provider-listing.ts
@@ -1,3 +1,7 @@
+import {
+  getRepoExecutionHostId,
+  getSshTargetIdForExecutionHost
+} from '../../../../shared/execution-host'
 import type { Store } from '../../../persistence/loading-store/store'
 import type { Repo } from '../../../../shared/repo-types'
 import { getSshGitProvider } from '../../../providers/ssh-git-dispatch'
@@ -61,9 +65,11 @@ export async function listDetectedWorktreesForCapturedRepo(
   store: Store,
   repo: Repo,
   isCurrent: () => boolean,
-  capturedProvider = repo.connectionId ? getSshGitProvider(repo.connectionId) : undefined,
+  capturedProvider?: SshGitProvider,
   providerAbort?: { signal: AbortSignal; status: () => 'canceled' | 'timed-out' }
 ): Promise<DetectedWorktreeListResult | { providerAbortStatus: 'canceled' | 'timed-out' } | null> {
+  const connectionId = getSshTargetIdForExecutionHost(getRepoExecutionHostId(repo))
+  const provider = capturedProvider ?? (connectionId ? getSshGitProvider(connectionId) : undefined)
   const abortedResult = () =>
     providerAbort?.signal.aborted
       ? ({ providerAbortStatus: providerAbort.status() } as const)
@@ -105,7 +111,7 @@ export async function listDetectedWorktreesForCapturedRepo(
         )
       }
     }
-    if (repo.connectionId && !capturedProvider) {
+    if (connectionId && !provider) {
       const aborted = abortedResult()
       if (aborted) {
         return aborted
@@ -124,8 +130,8 @@ export async function listDetectedWorktreesForCapturedRepo(
     }
     const scan = await scanUntilNotOvertaken(
       repo.id,
-      repo.connectionId && capturedProvider
-        ? () => listSshWorktreesWithMutationWitness(capturedProvider, repo, providerAbort?.signal)
+      connectionId && provider
+        ? () => listSshWorktreesWithMutationWitness(provider, repo, providerAbort?.signal)
         : () => listDetectedGitWorktrees(store, repo),
       () => isCurrent() && !providerAbort?.signal.aborted
     )
@@ -197,7 +203,7 @@ export async function listDetectedWorktreesForCapturedRepo(
     // Why: retention alone leaves inert rows with no explanation; the cause rides with the listing.
     const unavailableReason = describeWorktreeScanFailure(err)
     const failureKind = classifyWorktreeScanFailure(unavailableReason)
-    if (repo.connectionId) {
+    if (connectionId) {
       const worktrees = listDisconnectedSshWorktrees(store, repo, sshWorktreeMetaIndex())
       return {
         repoId: repo.id,
diff --git a/src/main/ipc/worktrees/listing/detected-scan-failure-authority.test.ts b/src/main/ipc/worktrees/listing/detected-scan-failure-authority.test.ts
index 4e436b8dcf13..5c600a0f8ffd 100644
--- a/src/main/ipc/worktrees/listing/detected-scan-failure-authority.test.ts
+++ b/src/main/ipc/worktrees/listing/detected-scan-failure-authority.test.ts
@@ -56,8 +56,10 @@ function wslHostFailure(): Error {
   })
 }
 
+const store = createStore()
+
 async function listDetected(): Promise<DetectedWorktreeListResult> {
-  const result = await listDetectedWorktreesForCapturedRepo(createStore(), repo, () => true)
+  const result = await listDetectedWorktreesForCapturedRepo(store, repo, () => true)
   return result as DetectedWorktreeListResult
 }
 
@@ -81,7 +83,7 @@ describe('detected worktree listing authority', () => {
     // Why: the retained rows must carry the cause, or the user sees inert worktrees with no explanation.
     expect(result.unavailableReason).toContain('Command failed: wsl.exe')
     // The destructive halves of a fresh scan must not run against a listing that failed.
-    expect(isRegisteredWorktreePath(REPO_PATH)).toBe(false)
+    expect(isRegisteredWorktreePath(REPO_PATH, store)).toBe(false)
     expect(removeWorktreeLineage).not.toHaveBeenCalled()
   })
 
@@ -118,7 +120,7 @@ describe('detected worktree listing authority', () => {
 
     expect(result.authoritative).toBe(false)
     expect(result.unavailableReason).toContain('No such file or directory')
-    expect(isRegisteredWorktreePath(REPO_PATH)).toBe(false)
+    expect(isRegisteredWorktreePath(REPO_PATH, store)).toBe(false)
     expect(removeWorktreeLineage).not.toHaveBeenCalled()
   })
 
@@ -136,7 +138,7 @@ describe('detected worktree listing authority', () => {
     expect(result.source).toBe('git')
     expect(result.worktrees).toEqual([])
     expect(result.unavailableReason).toBeUndefined()
-    expect(isRegisteredWorktreePath(REPO_PATH)).toBe(true)
+    expect(isRegisteredWorktreePath(REPO_PATH, store)).toBe(true)
   })
 
   it('keeps an empty listing authoritative when the repo path is gone', async () => {
@@ -161,6 +163,6 @@ describe('detected worktree listing authority', () => {
 
     expect(result.authoritative).toBe(true)
     expect(result.worktrees.map((worktree) => worktree.path)).toEqual([REPO_PATH])
-    expect(isRegisteredWorktreePath(REPO_PATH)).toBe(true)
+    expect(isRegisteredWorktreePath(REPO_PATH, store)).toBe(true)
   })
 })
diff --git a/src/main/ipc/worktrees/listing/detected-worktree-scan-cache.ts b/src/main/ipc/worktrees/listing/detected-worktree-scan-cache.ts
index 4ed0b88ffced..dad44c64a692 100644
--- a/src/main/ipc/worktrees/listing/detected-worktree-scan-cache.ts
+++ b/src/main/ipc/worktrees/listing/detected-worktree-scan-cache.ts
@@ -1,3 +1,4 @@
+import { getRepoExecutionHostId, LOCAL_EXECUTION_HOST_ID } from '../../../../shared/execution-host'
 import type { GitWorktreeInfo } from '../../../../shared/worktree/types'
 import type { Store } from '../../../persistence/loading-store/store'
 import type { Repo } from '../../../../shared/repo-types'
@@ -119,7 +120,7 @@ export async function listDetectedGitWorktrees(
   repo: Repo
 ): Promise<DetectedWorktreeScanResult> {
   const localWorktreeGitOptions = getLocalProjectWorktreeGitOptions(store, repo)
-  if (repo.connectionId || isFolderRepo(repo)) {
+  if (getRepoExecutionHostId(repo) !== LOCAL_EXECUTION_HOST_ID || isFolderRepo(repo)) {
     const generation = getLocalWorktreeScanGeneration(repo.id)
     return {
       gitWorktrees: await listRepoWorktreesForDetectedScan(repo, localWorktreeGitOptions),
@@ -295,11 +296,11 @@ export function rememberLocalWorktreeRoots(
   repo: Repo,
   gitWorktrees: GitWorktreeInfo[]
 ): void {
-  if (repo.connectionId) {
+  if (getRepoExecutionHostId(repo) !== LOCAL_EXECUTION_HOST_ID) {
     return
   }
   // Why: reuse the `git worktree list` result so later git/file IPC validation skips a second scan that can trigger macOS folder-permission prompts.
-  registerWorktreeRootsForRepo(store, repo.id, [
+  registerWorktreeRootsForRepo(store, repo, [
     repo.path,
     ...gitWorktrees.map((worktree) => worktree.path)
   ])
diff --git a/src/main/ipc/worktrees/listing/host-qualified-worktree-listing.ts b/src/main/ipc/worktrees/listing/host-qualified-worktree-listing.ts
index 3026a1b06527..57800d63bab6 100644
--- a/src/main/ipc/worktrees/listing/host-qualified-worktree-listing.ts
+++ b/src/main/ipc/worktrees/listing/host-qualified-worktree-listing.ts
@@ -1,3 +1,9 @@
+import {
+  getRepoExecutionHostId,
+  getSshTargetIdForExecutionHost,
+  parseExecutionHostId,
+  LOCAL_EXECUTION_HOST_ID
+} from '../../../../shared/execution-host'
 import type { Store } from '../../../persistence/loading-store/store'
 import { PROVIDER_REQUEST_ID_MAX_UTF8_BYTES } from '../../../../shared/detected-worktree-provider-contract'
 import type {
@@ -5,7 +11,6 @@ import type {
   HostQualifiedDetectedWorktreeResult,
   DirectSshDetectedWorktreeRequest
 } from '../../../../shared/detected-worktree-provider-contract'
-import { parseExecutionHostId, LOCAL_EXECUTION_HOST_ID } from '../../../../shared/execution-host'
 import { isCurrentSshProviderAuthority } from '../../../ssh/ssh-provider-authority'
 import { getSshGitProvider } from '../../../providers/ssh-git-dispatch'
 import {
@@ -63,9 +68,10 @@ export async function listHostQualifiedDetectedWorktrees(
   if (!repo) {
     return rejected('ambiguous-owner')
   }
+  const connectionId = getSshTargetIdForExecutionHost(getRepoExecutionHostId(repo))
   if (
-    (parsedHost.kind === 'local' && repo.connectionId) ||
-    (parsedHost.kind === 'ssh' && repo.connectionId !== parsedHost.targetId)
+    (parsedHost.kind === 'local' && connectionId) ||
+    (parsedHost.kind === 'ssh' && connectionId !== parsedHost.targetId)
   ) {
     return rejected('rejected')
   }
@@ -75,8 +81,8 @@ export async function listHostQualifiedDetectedWorktrees(
       return false
     }
     if (
-      (parsedHost.kind === 'local' && repo.connectionId) ||
-      (parsedHost.kind === 'ssh' && repo.connectionId !== parsedHost.targetId)
+      (parsedHost.kind === 'local' && connectionId) ||
+      (parsedHost.kind === 'ssh' && connectionId !== parsedHost.targetId)
     ) {
       return false
     }
diff --git a/src/main/ipc/worktrees/listing/register-detected-worktree-handlers.ts b/src/main/ipc/worktrees/listing/register-detected-worktree-handlers.ts
index 66e8e85a4a5b..442a70985c8d 100644
--- a/src/main/ipc/worktrees/listing/register-detected-worktree-handlers.ts
+++ b/src/main/ipc/worktrees/listing/register-detected-worktree-handlers.ts
@@ -5,7 +5,11 @@ import type {
   DirectSshDetectedWorktreeRequest,
   ProviderRequestId
 } from '../../../../shared/detected-worktree-provider-contract'
-import { parseExecutionHostId } from '../../../../shared/execution-host'
+import {
+  parseExecutionHostId,
+  getRepoExecutionHostId,
+  getSshTargetIdForExecutionHost
+} from '../../../../shared/execution-host'
 import {
   registerSshProviderRequestAbort,
   getSshProviderAuthority,
@@ -99,17 +103,16 @@ export function registerDetectedWorktreeHandlers(context: WorktreeIpcContext): v
           worktrees: []
         }
       }
-      const provider = repo.connectionId ? getSshGitProvider(repo.connectionId) : undefined
-      const authority = repo.connectionId
-        ? { ...getSshProviderAuthority(repo.connectionId) }
-        : undefined
+      const connectionId = getSshTargetIdForExecutionHost(getRepoExecutionHostId(repo))
+      const provider = connectionId ? getSshGitProvider(connectionId) : undefined
+      const authority = connectionId ? { ...getSshProviderAuthority(connectionId) } : undefined
       const result = await listDetectedWorktreesForCapturedRepo(
         store,
         repo,
         () =>
           isCapturedRepoCurrent(store, repo) &&
-          (!repo.connectionId ||
-            (getSshGitProvider(repo.connectionId) === provider &&
+          (!connectionId ||
+            (getSshGitProvider(connectionId) === provider &&
               authority !== undefined &&
               isCurrentSshProviderAuthority(authority))),
         provider
diff --git a/src/main/ipc/worktrees/listing/register-host-catalog-handlers.ts b/src/main/ipc/worktrees/listing/register-host-catalog-handlers.ts
index 4467506e790c..ac231a4c697f 100644
--- a/src/main/ipc/worktrees/listing/register-host-catalog-handlers.ts
+++ b/src/main/ipc/worktrees/listing/register-host-catalog-handlers.ts
@@ -1,3 +1,8 @@
+import {
+  getRepoExecutionHostId,
+  getSshTargetIdForExecutionHost,
+  parseExecutionHostId
+} from '../../../../shared/execution-host'
 import { ipcMain } from 'electron'
 import type {
   ListKnownWorktreesForExecutionHostArgs,
@@ -5,7 +10,6 @@ import type {
   ForgetRemovedWorktreesForExecutionHostArgs,
   ForgetRemovedWorktreesForExecutionHostResult
 } from '../../../../shared/detected-worktree-provider-contract'
-import { parseExecutionHostId } from '../../../../shared/execution-host'
 import type { DetectedWorktree } from '../../../../shared/worktree/types'
 import { isFolderRepo } from '../../../../shared/repo-kind'
 import { projectResolvedWorktreeLineage } from '../../../../shared/resolved-worktree-lineage'
@@ -47,7 +51,10 @@ export function registerHostCatalogHandlers(context: WorktreeIpcContext): void {
       // Why: findExactRepoOwner repeats this same all-candidates-owned check, and getRepos() re-hydrates the
       // whole catalog, so a separate pass here is pure cost.
       const repo = findExactRepoOwner(store, requestedRepoId, requestedExecutionHostId)
-      if (!repo || repo.connectionId !== parsedHost.targetId) {
+      if (
+        !repo ||
+        getSshTargetIdForExecutionHost(getRepoExecutionHostId(repo)) !== parsedHost.targetId
+      ) {
         return rejected()
       }
       const complete = (worktrees: DetectedWorktree[]): HostQualifiedKnownWorktreeResult => ({
diff --git a/src/main/ipc/worktrees/listing/register-worktree-catalog-handlers.ts b/src/main/ipc/worktrees/listing/register-worktree-catalog-handlers.ts
index 4f3055c63a2e..89de29f30e84 100644
--- a/src/main/ipc/worktrees/listing/register-worktree-catalog-handlers.ts
+++ b/src/main/ipc/worktrees/listing/register-worktree-catalog-handlers.ts
@@ -1,6 +1,10 @@
 import { ipcMain } from 'electron'
 import { isFolderRepo } from '../../../../shared/repo-kind'
-import { getRepoExecutionHostId, type ExecutionHostId } from '../../../../shared/execution-host'
+import {
+  getRepoExecutionHostId,
+  getSshTargetIdForExecutionHost,
+  type ExecutionHostId
+} from '../../../../shared/execution-host'
 import { getSshGitProvider } from '../../../providers/ssh-git-dispatch'
 import { EMPTY_RETIRED_NAME_REGISTRY } from '../../../../shared/worktree/retired-name-registry'
 import { getRetiredNameRegistryForRepo } from '../../../worktree-name-retirement'
@@ -28,6 +32,8 @@ import {
   readAllWorktreeMetaForRepo
 } from '../../../persistence/host-qualified-worktree-meta'
 import type { WorktreeMeta } from '../../../../shared/worktree/meta-types'
+import { getLocalWorktreeScanGeneration } from '../../../local-worktree-scan-generation'
+import { getRegisteredWorktreeRootsRevision } from '../../registered-worktree-roots-cache'
 
 const WORKTREE_LIST_ALL_CONCURRENCY = 8
 
@@ -89,6 +95,7 @@ export function registerWorktreeCatalogHandlers(context: WorktreeIpcContext): vo
 
     // Why: each local repo listing can spawn `git worktree list`; cap fan-out so large fleets don't start unbounded subprocesses.
     const results = await mapWithConcurrency(repos, WORKTREE_LIST_ALL_CONCURRENCY, async (repo) => {
+      const connectionId = getSshTargetIdForExecutionHost(getRepoExecutionHostId(repo))
       try {
         let gitWorktrees
         let freshScan = true
@@ -97,18 +104,22 @@ export function registerWorktreeCatalogHandlers(context: WorktreeIpcContext): vo
         let hygieneDue: boolean | undefined
         if (isFolderRepo(repo)) {
           return listVisibleFolderWorkspaces(store, repo)
-        } else if (repo.connectionId) {
-          const provider = getSshGitProvider(repo.connectionId)
+        } else if (connectionId) {
+          const provider = getSshGitProvider(connectionId)
           if (!provider) {
             warnOnce(
               loggedUnavailableSshGitProviders,
-              `${repo.connectionId}:${repo.id}`,
-              `[worktrees] SSH git provider unavailable; skipping worktree list for repo "${repo.displayName}" (${repo.id}) at ${repo.path} on connection ${repo.connectionId}`
+              `${connectionId}:${repo.id}`,
+              `[worktrees] SSH git provider unavailable; skipping worktree list for repo "${repo.displayName}" (${repo.id}) at ${repo.path} on connection ${connectionId}`
             )
             return listDisconnectedSshWorktrees(store, repo, sshMetaIndexForRepo(repo))
           }
-          loggedUnavailableSshGitProviders.delete(`${repo.connectionId}:${repo.id}`)
+          loggedUnavailableSshGitProviders.delete(`${connectionId}:${repo.id}`)
           try {
+            sideEffectToken = {
+              generation: getLocalWorktreeScanGeneration(repo.id),
+              authorizedRootsRevision: getRegisteredWorktreeRootsRevision(repo.id)
+            }
             gitWorktrees = await provider.listWorktrees(repo.path)
           } catch (err) {
             warnOnce(
@@ -177,8 +188,9 @@ export function registerWorktreeCatalogHandlers(context: WorktreeIpcContext): vo
     if (!repo) {
       return []
     }
-    const allMeta = repo.connectionId ? readAllWorktreeMetaForRepo(store, repo) : undefined
-    const sshWorktreeMetaIndex = repo.connectionId
+    const connectionId = getSshTargetIdForExecutionHost(getRepoExecutionHostId(repo))
+    const allMeta = connectionId ? readAllWorktreeMetaForRepo(store, repo) : undefined
+    const sshWorktreeMetaIndex = connectionId
       ? createSshWorktreeMetaIndex(Object.entries(allMeta ?? {}))
       : new Map()
 
@@ -190,18 +202,22 @@ export function registerWorktreeCatalogHandlers(context: WorktreeIpcContext): vo
       let hygieneDue: boolean | undefined
       if (isFolderRepo(repo)) {
         return listVisibleFolderWorkspaces(store, repo)
-      } else if (repo.connectionId) {
-        const provider = getSshGitProvider(repo.connectionId)
+      } else if (connectionId) {
+        const provider = getSshGitProvider(connectionId)
         if (!provider) {
           warnOnce(
             loggedUnavailableSshGitProviders,
-            `${repo.connectionId}:${repo.id}`,
-            `[worktrees] SSH git provider unavailable; skipping worktree list for repo "${repo.displayName}" (${repo.id}) at ${repo.path} on connection ${repo.connectionId}`
+            `${connectionId}:${repo.id}`,
+            `[worktrees] SSH git provider unavailable; skipping worktree list for repo "${repo.displayName}" (${repo.id}) at ${repo.path} on connection ${connectionId}`
           )
           return listDisconnectedSshWorktrees(store, repo, sshWorktreeMetaIndex)
         }
-        loggedUnavailableSshGitProviders.delete(`${repo.connectionId}:${repo.id}`)
+        loggedUnavailableSshGitProviders.delete(`${connectionId}:${repo.id}`)
         try {
+          sideEffectToken = {
+            generation: getLocalWorktreeScanGeneration(repo.id),
+            authorizedRootsRevision: getRegisteredWorktreeRootsRevision(repo.id)
+          }
           gitWorktrees = await provider.listWorktrees(repo.path)
         } catch (err) {
           warnOnce(
diff --git a/src/main/ipc/worktrees/metadata/workspace-lineage-candidate-scan.test.ts b/src/main/ipc/worktrees/metadata/workspace-lineage-candidate-scan.test.ts
new file mode 100644
index 000000000000..e3ccee070865
--- /dev/null
+++ b/src/main/ipc/worktrees/metadata/workspace-lineage-candidate-scan.test.ts
@@ -0,0 +1,158 @@
+import { describe, expect, it, vi } from 'vitest'
+import type { Repo } from '../../../../shared/repo-types'
+import type { FolderWorkspace } from '../../../../shared/folder-workspace-types'
+import type { ProjectGroup } from '../../../../shared/project-group-types'
+import { createLineageResolutionContext } from './lineage-owner-resolution'
+import { getFolderLineageCandidateRepos } from './workspace-lineage-filtering'
+
+vi.mock('../../worktree-logic', () => ({ parseWorktreeId: vi.fn() }))
+
+function repo(id: string, fields: Partial<Repo> = {}): Repo {
+  return { id, path: `/root/${id}`, displayName: id, badgeColor: '#000', addedAt: 0, ...fields }
+}
+
+function group(id = 'group', fields: Partial<ProjectGroup> = {}): ProjectGroup {
+  return {
+    id,
+    name: id,
+    parentPath: null,
+    parentGroupId: null,
+    createdFrom: 'manual',
+    tabOrder: 0,
+    isCollapsed: false,
+    color: null,
+    createdAt: 0,
+    updatedAt: 0,
+    ...fields
+  }
+}
+
+function folder(fields: Partial<FolderWorkspace> = {}): FolderWorkspace {
+  return {
+    id: 'folder',
+    projectGroupId: 'group',
+    name: 'folder',
+    folderPath: '/root',
+    linkedTask: null,
+    comment: '',
+    isArchived: false,
+    isUnread: false,
+    isPinned: false,
+    sortOrder: 0,
+    lastActivityAt: 0,
+    createdAt: 0,
+    updatedAt: 0,
+    ...fields
+  }
+}
+
+function context(repos: Repo[], groups = [group()]) {
+  const store = {
+    getRepos: () => repos,
+    getFolderWorkspaces: () => [],
+    getProjectGroups: () => groups
+  }
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Context construction only reads these three store catalogs.
+  return createLineageResolutionContext(store as never)
+}
+
+describe('folder lineage candidate lookup', () => {
+  it('reads grouped target membership once across a large path-candidate list', () => {
+    let targetReads = 0
+    const grouped = Array.from({ length: 300 }, (_, index): Repo => ({
+      ...repo(`grouped-${index}`, { projectGroupId: 'group', path: `/elsewhere/${index}` }),
+      get connectionId() {
+        targetReads += 1
+        return null
+      }
+    }))
+    const candidates = Array.from({ length: 1_000 }, (_, index) => repo(`path-${index}`))
+    const result = getFolderLineageCandidateRepos(context([...grouped, ...candidates]), folder())
+
+    expect(result).toEqual([...grouped, ...candidates])
+    expect(targetReads).toBe(300)
+  })
+
+  it('preserves descendant-group priority, path boundaries and local/SSH membership', () => {
+    const entries = [
+      repo('path-a', { connectionId: 'a' }),
+      repo('group-b', { projectGroupId: 'nested', path: '/elsewhere', connectionId: 'b' }),
+      repo('local-null', { connectionId: null }),
+      repo('group-local', { projectGroupId: 'group' }),
+      repo('path-b', { connectionId: 'b' }),
+      repo('local-absent'),
+      repo('sibling', { path: '/root-other/repo', connectionId: 'b' }),
+      repo('root', { path: '/root', connectionId: 'b' })
+    ]
+    const snapshot = structuredClone(entries)
+    const result = getFolderLineageCandidateRepos(
+      context(entries, [group(), group('nested', { parentGroupId: 'group' })]),
+      folder()
+    )
+
+    expect(result.map((entry) => entry.id)).toEqual([
+      'group-b',
+      'group-local',
+      'local-null',
+      'path-b',
+      'local-absent',
+      'root'
+    ])
+    expect(result[0]).toBe(entries[1])
+    expect(entries).toEqual(snapshot)
+  })
+
+  it.each([
+    { folderTarget: 'a', groupTarget: 'b', expected: ['grouped', 'a'] },
+    { folderTarget: null, groupTarget: 'b', expected: ['grouped', 'b'] },
+    { folderTarget: undefined, groupTarget: undefined, expected: ['grouped', 'local'] }
+  ])(
+    'keeps explicit target precedence: $folderTarget / $groupTarget',
+    ({ folderTarget, groupTarget, expected }) => {
+      const entries = [
+        repo('a', { connectionId: 'a' }),
+        repo('b', { connectionId: 'b' }),
+        repo('local'),
+        repo('grouped', { projectGroupId: 'group', path: '/outside' })
+      ]
+      expect(
+        getFolderLineageCandidateRepos(
+          context(entries, [group('group', { connectionId: groupTarget })]),
+          folder({ connectionId: folderTarget })
+        ).map((entry) => entry.id)
+      ).toEqual(expected)
+    }
+  )
+
+  it('keeps every contained target when the folder has no grouped repositories', () => {
+    const entries = [
+      repo('local'),
+      repo('remote', { connectionId: 'a' }),
+      repo('outside', { path: '/elsewhere' })
+    ]
+    expect(getFolderLineageCandidateRepos(context(entries), folder())).toEqual(entries.slice(0, 2))
+  })
+
+  it('does not read grouped targets when there are no path candidates', () => {
+    let targetReads = 0
+    const grouped: Repo = {
+      ...repo('grouped', { projectGroupId: 'group' }),
+      get connectionId() {
+        targetReads += 1
+        return 'a'
+      }
+    }
+    expect(getFolderLineageCandidateRepos(context([grouped]), folder())).toEqual([grouped])
+    expect(targetReads).toBe(0)
+  })
+
+  it('rebuilds target membership after a later change in the same context', () => {
+    const grouped = repo('grouped', { projectGroupId: 'group', connectionId: 'a' })
+    const a = repo('a', { connectionId: 'a' })
+    const b = repo('b', { connectionId: 'b' })
+    const current = context([grouped, a, b])
+    expect(getFolderLineageCandidateRepos(current, folder())).toEqual([grouped, a])
+    grouped.connectionId = 'b'
+    expect(getFolderLineageCandidateRepos(current, folder())).toEqual([grouped, b])
+  })
+})
diff --git a/src/main/ipc/worktrees/metadata/workspace-lineage-filtering.ts b/src/main/ipc/worktrees/metadata/workspace-lineage-filtering.ts
index 3106812418ca..c478b59b81a9 100644
--- a/src/main/ipc/worktrees/metadata/workspace-lineage-filtering.ts
+++ b/src/main/ipc/worktrees/metadata/workspace-lineage-filtering.ts
@@ -36,18 +36,20 @@ export function getFolderLineageCandidateRepos(
   )
   const group = context.groupsById.get(folder.projectGroupId)?.[0]
   const connectionId = folder.connectionId ?? group?.connectionId ?? null
-  return connectionId
-    ? [...grouped, ...pathRepos.filter((repo) => (repo.connectionId ?? null) === connectionId)]
-    : grouped.length > 0
-      ? [
-          ...grouped,
-          ...pathRepos.filter((repo) =>
-            new Set(grouped.map((candidate) => candidate.connectionId ?? null)).has(
-              repo.connectionId ?? null
-            )
-          )
-        ]
-      : pathRepos
+  if (connectionId) {
+    return [...grouped, ...pathRepos.filter((repo) => (repo.connectionId ?? null) === connectionId)]
+  }
+  if (grouped.length === 0) {
+    return pathRepos
+  }
+  if (pathRepos.length === 0) {
+    return grouped
+  }
+  const groupedConnectionIds = new Set(grouped.map((repo) => repo.connectionId ?? null))
+  return [
+    ...grouped,
+    ...pathRepos.filter((repo) => groupedConnectionIds.has(repo.connectionId ?? null))
+  ]
 }
 
 export function resolveFolderLineageOwner(
diff --git a/src/main/ipc/worktrees/removal/remove-registered-local-worktree.ts b/src/main/ipc/worktrees/removal/remove-registered-local-worktree.ts
index c22e6b0ad969..5a36199c8e3d 100644
--- a/src/main/ipc/worktrees/removal/remove-registered-local-worktree.ts
+++ b/src/main/ipc/worktrees/removal/remove-registered-local-worktree.ts
@@ -11,17 +11,10 @@ import {
 } from '../../../git/worktree'
 import { gitExecFileAsync } from '../../../git/runner'
 import { getWorktreeSharedLinkPaths } from '../../../git/worktree-shared-directories'
-import {
-  getLocalWorktreePathAccess,
-  removeLocalWorktreePath,
-  toLocalWorktreeRuntimePath
-} from '../../../local-worktree-filesystem'
+import { cleanupLocalOrphanedWorktreeDirectory } from '../../../local-orphaned-worktree-cleanup'
 import { recoverLocalWindowsWorktreeRemoval } from '../../../local-worktree-removal-recovery'
 import { withWorktreeRemoveStageSpan } from '../../../observability/instrumentation'
-import {
-  canSafelyRemoveOrphanedWorktreeDirectory,
-  findRegisteredDeletableWorktree
-} from '../../../worktree-removal-safety'
+import { findRegisteredDeletableWorktree } from '../../../worktree-removal-safety'
 import { CLIENT_REMOVAL_HOME } from '../../../worktree-removal-home-guard'
 import {
   cleanupUnusedWorktreePushTargetRemote,
@@ -162,25 +155,12 @@ export async function removeRegisteredLocalWorktree(
         console.warn(
           `[worktrees] Orphaned worktree detected at ${canonicalWorktreePath}, cleaning up`
         )
-        const access = getLocalWorktreePathAccess(localWorktreeGitOptions)
-        if (
-          await canSafelyRemoveOrphanedWorktreeDirectory(
-            toLocalWorktreeRuntimePath(canonicalWorktreePath, localWorktreeGitOptions),
-            toLocalWorktreeRuntimePath(repo.path, localWorktreeGitOptions),
-            CLIENT_REMOVAL_HOME,
-            access.statPath,
-            access.readPath
-          )
-        ) {
-          await runtime.closeFileWatchersForRemoval(canonicalWorktreePath)
-          await removeLocalWorktreePath(canonicalWorktreePath, localWorktreeGitOptions).catch(
-            () => {}
-          )
-        } else {
-          console.warn(
-            `[worktrees] Refusing recursive cleanup for unproven worktree directory: ${canonicalWorktreePath}`
-          )
-        }
+        await cleanupLocalOrphanedWorktreeDirectory(
+          repo.path,
+          canonicalWorktreePath,
+          localWorktreeGitOptions,
+          (path) => runtime.closeFileWatchersForRemoval(path)
+        )
         // Why: remove failed so git still tracks it (.git/worktrees/<name>); prune or the stale entry keeps its branch locked.
         await gitExecFileAsync(['worktree', 'prune'], {
           cwd: repo.path,
diff --git a/src/main/kimi/hook-service-config-delete-race.test.ts b/src/main/kimi/hook-service-config-delete-race.test.ts
new file mode 100644
index 000000000000..6a801cef4c0a
--- /dev/null
+++ b/src/main/kimi/hook-service-config-delete-race.test.ts
@@ -0,0 +1,91 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type * as NodeFs from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+
+const deleteRace = vi.hoisted((): { path: string | null; code: string } => ({
+  path: null,
+  code: 'ENOENT'
+}))
+
+// Why: simulates the config file (or an ancestor directory) vanishing between
+// writeConfigToml's existsSync check and its statSync mode read — e.g. a
+// concurrent uninstall, user delete, or a directory replaced by a file.
+vi.mock('node:fs', async (importOriginal) => {
+  const actual = await importOriginal<typeof NodeFs>()
+  const statSync = (
+    target: NodeFs.PathLike,
+    options?: NodeFs.StatSyncOptions
+  ): NodeFs.Stats | NodeFs.BigIntStats | undefined => {
+    if (typeof target === 'string' && target === deleteRace.path) {
+      throw Object.assign(new Error(`${deleteRace.code}: simulated race`), {
+        code: deleteRace.code
+      })
+    }
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: forwarding actual.statSync's own overload signature.
+    return actual.statSync(target, options as NodeFs.StatSyncOptions)
+  }
+  const patched = { ...actual, statSync }
+  return { ...patched, default: patched }
+})
+
+const fs = await vi.importActual<typeof NodeFs>('node:fs')
+const { KimiHookService } = await import('./hook-service')
+const { KIMI_HOOK_EVENTS } = await import('./kimi-hook-config-toml')
+
+let home: string
+let originalHome: string | undefined
+let originalKimiHome: string | undefined
+let originalUserProfile: string | undefined
+
+const configPath = (): string => join(home, '.kimi-code', 'config.toml')
+
+beforeEach(() => {
+  home = fs.mkdtempSync(join(tmpdir(), 'orca-kimi-hook-delete-race-'))
+  originalHome = process.env.HOME
+  originalKimiHome = process.env.KIMI_CODE_HOME
+  originalUserProfile = process.env.USERPROFILE
+  process.env.HOME = home
+  process.env.KIMI_CODE_HOME = join(home, '.kimi-code')
+  process.env.USERPROFILE = home
+})
+
+afterEach(() => {
+  deleteRace.path = null
+  deleteRace.code = 'ENOENT'
+  if (originalHome === undefined) {
+    delete process.env.HOME
+  } else {
+    process.env.HOME = originalHome
+  }
+  if (originalKimiHome === undefined) {
+    delete process.env.KIMI_CODE_HOME
+  } else {
+    process.env.KIMI_CODE_HOME = originalKimiHome
+  }
+  if (originalUserProfile === undefined) {
+    delete process.env.USERPROFILE
+  } else {
+    process.env.USERPROFILE = originalUserProfile
+  }
+  fs.rmSync(home, { recursive: true, force: true })
+})
+
+describe('KimiHookService config delete race', () => {
+  it.each(['ENOENT', 'ENOTDIR'])(
+    'still writes the config when the mode stat fails with %s',
+    (code) => {
+      fs.mkdirSync(join(home, '.kimi-code'), { recursive: true })
+      fs.writeFileSync(configPath(), 'api_key = "fixture-only"\n')
+      deleteRace.path = configPath()
+      deleteRace.code = code
+
+      expect(() => new KimiHookService().install()).not.toThrow()
+
+      const config = fs.readFileSync(configPath(), 'utf-8')
+      for (const event of KIMI_HOOK_EVENTS) {
+        expect(config).toContain(`event = "${event}"`)
+      }
+    }
+  )
+})
diff --git a/src/main/kimi/hook-service-mode-read-failure.test.ts b/src/main/kimi/hook-service-mode-read-failure.test.ts
new file mode 100644
index 000000000000..4e82137e832d
--- /dev/null
+++ b/src/main/kimi/hook-service-mode-read-failure.test.ts
@@ -0,0 +1,70 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type * as NodeFs from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+
+const modeReadFailure = vi.hoisted((): { path: string | null } => ({ path: null }))
+
+vi.mock('node:fs', async (importOriginal) => {
+  const actual = await importOriginal<typeof NodeFs>()
+  const statSync = (target: NodeFs.PathLike): NodeFs.Stats | NodeFs.BigIntStats => {
+    if (typeof target === 'string' && target === modeReadFailure.path) {
+      throw new Error('mode unavailable')
+    }
+    return actual.statSync(target)
+  }
+  const patched = { ...actual, statSync }
+  return { ...patched, default: patched }
+})
+
+const fs = await vi.importActual<typeof NodeFs>('node:fs')
+const { KimiHookService } = await import('./hook-service')
+
+let home: string
+let originalHome: string | undefined
+let originalKimiHome: string | undefined
+let originalUserProfile: string | undefined
+
+const configPath = (): string => join(home, '.kimi-code', 'config.toml')
+
+beforeEach(() => {
+  home = fs.mkdtempSync(join(tmpdir(), 'orca-kimi-hook-mode-read-'))
+  originalHome = process.env.HOME
+  originalKimiHome = process.env.KIMI_CODE_HOME
+  originalUserProfile = process.env.USERPROFILE
+  process.env.HOME = home
+  process.env.KIMI_CODE_HOME = join(home, '.kimi-code')
+  process.env.USERPROFILE = home
+})
+
+afterEach(() => {
+  modeReadFailure.path = null
+  if (originalHome === undefined) {
+    delete process.env.HOME
+  } else {
+    process.env.HOME = originalHome
+  }
+  if (originalKimiHome === undefined) {
+    delete process.env.KIMI_CODE_HOME
+  } else {
+    process.env.KIMI_CODE_HOME = originalKimiHome
+  }
+  if (originalUserProfile === undefined) {
+    delete process.env.USERPROFILE
+  } else {
+    process.env.USERPROFILE = originalUserProfile
+  }
+  fs.rmSync(home, { recursive: true, force: true })
+})
+
+describe('KimiHookService config mode preservation', () => {
+  it('does not replace an existing config when its mode cannot be read', () => {
+    fs.mkdirSync(join(home, '.kimi-code'), { recursive: true })
+    const original = 'api_key = "fixture-only"\n'
+    fs.writeFileSync(configPath(), original)
+    modeReadFailure.path = configPath()
+
+    expect(() => new KimiHookService().install()).toThrow('mode unavailable')
+    expect(fs.readFileSync(configPath(), 'utf-8')).toBe(original)
+  })
+})
diff --git a/src/main/kimi/hook-service.test.ts b/src/main/kimi/hook-service.test.ts
index 24a77444e193..a88c68f3d04d 100644
--- a/src/main/kimi/hook-service.test.ts
+++ b/src/main/kimi/hook-service.test.ts
@@ -1,4 +1,13 @@
-import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import {
+  chmodSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  readdirSync,
+  rmSync,
+  statSync,
+  writeFileSync
+} from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, beforeEach, describe, expect, it } from 'vitest'
@@ -8,17 +17,20 @@ import { KIMI_HOOK_EVENTS } from './kimi-hook-config-toml'
 // Why: getSharedManagedScriptPath() writes the managed script under
 // homedir()/.orca, and getKimiHome() honors KIMI_CODE_HOME. Point both at a
 // temp dir so the local install/remove cycle never touches the real ~/.orca or
-// ~/.kimi-code. os.homedir() resolves $HOME on POSIX (verified at write time).
+// ~/.kimi-code. os.homedir() resolves HOME on POSIX and USERPROFILE on Windows.
 let home: string
 let originalHome: string | undefined
 let originalKimiHome: string | undefined
+let originalUserProfile: string | undefined
 
 beforeEach(() => {
   home = mkdtempSync(join(tmpdir(), 'orca-kimi-hook-'))
   originalHome = process.env.HOME
   originalKimiHome = process.env.KIMI_CODE_HOME
+  originalUserProfile = process.env.USERPROFILE
   process.env.HOME = home
   process.env.KIMI_CODE_HOME = join(home, '.kimi-code')
+  process.env.USERPROFILE = home
 })
 
 afterEach(() => {
@@ -32,11 +44,17 @@ afterEach(() => {
   } else {
     process.env.KIMI_CODE_HOME = originalKimiHome
   }
+  if (originalUserProfile === undefined) {
+    delete process.env.USERPROFILE
+  } else {
+    process.env.USERPROFILE = originalUserProfile
+  }
   rmSync(home, { recursive: true, force: true })
 })
 
 const configPath = (): string => join(home, '.kimi-code', 'config.toml')
 const scriptPath = (): string => join(home, '.orca', 'agent-hooks', 'kimi-hook.sh')
+const supportsPosixFileModes = process.platform !== 'win32'
 
 describe('KimiHookService', () => {
   it('reports not_installed before install', () => {
@@ -89,4 +107,41 @@ describe('KimiHookService', () => {
     const afterRemove = readFileSync(configPath(), 'utf-8')
     expect(afterRemove).toBe(userConfig)
   })
+
+  it.skipIf(!supportsPosixFileModes)(
+    'preserves an existing config mode while installing and removing hooks',
+    () => {
+      mkdirSync(join(home, '.kimi-code'), { recursive: true })
+      writeFileSync(configPath(), 'api_key = "sk-secret"\n')
+      const existingMode = 0o640
+      chmodSync(configPath(), existingMode)
+
+      const service = new KimiHookService()
+      const originalUmask = process.umask(0o077)
+      try {
+        service.install()
+        expect(statSync(configPath()).mode & 0o777).toBe(existingMode)
+        expect(statSync(`${configPath()}.bak`).mode & 0o777).toBe(existingMode)
+        expect(
+          readdirSync(join(home, '.kimi-code')).filter((name) => name.endsWith('.tmp'))
+        ).toEqual([])
+
+        service.remove()
+        expect(statSync(configPath()).mode & 0o777).toBe(existingMode)
+      } finally {
+        process.umask(originalUmask)
+      }
+    }
+  )
+
+  it.skipIf(!supportsPosixFileModes)('creates a new config with an owner-only mode', () => {
+    const originalUmask = process.umask(0o022)
+    try {
+      new KimiHookService().install()
+
+      expect(statSync(configPath()).mode & 0o777).toBe(0o600)
+    } finally {
+      process.umask(originalUmask)
+    }
+  })
 })
diff --git a/src/main/kimi/hook-service.ts b/src/main/kimi/hook-service.ts
index 21fee64d2768..f4f4dfbe534f 100644
--- a/src/main/kimi/hook-service.ts
+++ b/src/main/kimi/hook-service.ts
@@ -1,9 +1,11 @@
 import {
   copyFileSync,
+  chmodSync,
   existsSync,
   mkdirSync,
   readFileSync,
   renameSync,
+  statSync,
   unlinkSync,
   writeFileSync
 } from 'node:fs'
@@ -12,6 +14,7 @@ import { dirname, join, posix as pathPosix } from 'node:path'
 import { randomUUID } from 'node:crypto'
 import type { SFTPWrapper } from 'ssh2'
 import type { AgentHookInstallState, AgentHookInstallStatus } from '../../shared/agent-hook-types'
+import { isDefinitiveAbsence } from '../../shared/definitive-filesystem-absence'
 import {
   createManagedCommandMatcher,
   getSharedManagedScriptPath,
@@ -137,6 +140,8 @@ function readConfigToml(configPath: string): string | null {
 function writeConfigToml(configPath: string, text: string): void {
   const dir = dirname(configPath)
   mkdirSync(dir, { recursive: true })
+  // Why: renameSync replaces the inode, so the temp mode becomes the config mode.
+  let mode = 0o600
   if (existsSync(configPath)) {
     try {
       if (readFileSync(configPath, 'utf-8') === text) {
@@ -145,10 +150,19 @@ function writeConfigToml(configPath: string, text: string): void {
     } catch {
       // Fall through to the atomic write path.
     }
+    try {
+      mode = statSync(configPath).mode & 0o777
+    } catch (error) {
+      // Why: file was deleted between the existsSync check and here — nothing to preserve.
+      if (!isDefinitiveAbsence(error)) {
+        throw error
+      }
+    }
   }
   const tmpPath = join(dir, `.${Date.now()}-${randomUUID()}.tmp`)
   try {
-    writeFileSync(tmpPath, text, 'utf-8')
+    writeFileSync(tmpPath, text, { encoding: 'utf-8', mode: 0o600 })
+    chmodSync(tmpPath, mode)
     if (existsSync(configPath)) {
       copyFileSync(configPath, `${configPath}.bak`)
     }
diff --git a/src/main/lazy-worker-thread-host.ts b/src/main/lazy-worker-thread-host.ts
index 01f15eb1c66c..2de02689afc7 100644
--- a/src/main/lazy-worker-thread-host.ts
+++ b/src/main/lazy-worker-thread-host.ts
@@ -1,6 +1,12 @@
 import type { Worker } from 'node:worker_threads'
 
-export type WorkerThreadFactory = () => Worker
+export type WorkerRequestTransport = Pick<Worker, 'unref' | 'postMessage' | 'terminate'> & {
+  on(...args: Parameters<Worker['on']>): unknown
+  off(...args: Parameters<Worker['off']>): unknown
+  removeAllListeners(): unknown
+}
+
+export type WorkerThreadFactory = () => WorkerRequestTransport
 
 /**
  * Owns the lifetime of one lazily-spawned worker thread: spawn on demand,
@@ -10,7 +16,7 @@ export type WorkerThreadFactory = () => Worker
  * queued calls closed instead of moving the work back onto the main thread.
  */
 export class LazyWorkerThreadHost<TResponse> {
-  private worker: Worker | null = null
+  private worker: WorkerRequestTransport | null = null
   private idleTimer: NodeJS.Timeout | null = null
   private cleanupListeners: (() => void) | null = null
   private reportedUnavailable = false
@@ -29,12 +35,12 @@ export class LazyWorkerThreadHost<TResponse> {
     }
   ) {}
 
-  get current(): Worker | null {
+  get current(): WorkerRequestTransport | null {
     return this.worker
   }
 
   /** The live worker, spawning one if needed; null when no worker can be had. */
-  ensure(): Worker | null {
+  ensure(): WorkerRequestTransport | null {
     if (this.worker) {
       return this.worker
     }
diff --git a/src/main/lib/html-to-pdf.test.ts b/src/main/lib/html-to-pdf.test.ts
new file mode 100644
index 000000000000..03ead7c66f14
--- /dev/null
+++ b/src/main/lib/html-to-pdf.test.ts
@@ -0,0 +1,315 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { join } from 'node:path'
+
+const fake = vi.hoisted(() => ({
+  files: new Map<string, string>(),
+  handlers: new Map<string, (...args: unknown[]) => void>(),
+  write: vi.fn<(path: string, html: string, options: unknown) => Promise<void>>(),
+  unlink: vi.fn<(path: string) => Promise<void>>(),
+  construct: vi.fn<(options: unknown) => void>(),
+  load: vi.fn<(path: string) => Promise<void>>(),
+  images: vi.fn<(script: string, userGesture: boolean) => Promise<void>>(),
+  print: vi.fn<(options: unknown) => Promise<Buffer>>(),
+  isDestroyed: vi.fn<() => boolean>(),
+  destroy: vi.fn<() => void>(),
+  uuid: vi.fn<() => string>()
+}))
+
+vi.mock('electron', () => ({
+  app: { getPath: () => '/mock-export-temp' },
+  BrowserWindow: class {
+    constructor(options: unknown) {
+      fake.construct(options)
+    }
+    webContents = {
+      once: (event: string, listener: (...args: unknown[]) => void) => {
+        fake.handlers.set(event, listener)
+      },
+      executeJavaScript: fake.images,
+      printToPDF: fake.print
+    }
+    loadFile = fake.load
+    isDestroyed = fake.isDestroyed
+    destroy = fake.destroy
+  }
+}))
+vi.mock('node:fs/promises', () => ({ writeFile: fake.write, unlink: fake.unlink }))
+vi.mock('node:crypto', () => ({ randomUUID: fake.uuid }))
+
+import { ExportTimeoutError, htmlToPdf } from './html-to-pdf'
+
+const HTML = '<p>synthetic export</p>'
+const TEMP_PATH = join('/mock-export-temp', 'orca-export-test-export.html')
+const PDF = Buffer.from('synthetic PDF buffer')
+
+beforeEach(() => {
+  vi.useFakeTimers()
+  vi.resetAllMocks()
+  fake.files.clear()
+  fake.handlers.clear()
+  fake.uuid.mockReturnValue('test-export')
+  fake.write.mockImplementation(async (path, html) => {
+    fake.files.set(path, html)
+  })
+  fake.unlink.mockImplementation(async (path) => {
+    fake.files.delete(path)
+  })
+  fake.load.mockImplementation(async () => {
+    fake.handlers.get('did-finish-load')?.()
+  })
+  fake.images.mockResolvedValue()
+  fake.print.mockResolvedValue(PDF)
+  fake.isDestroyed.mockReturnValue(false)
+})
+
+afterEach(() => {
+  vi.useRealTimers()
+})
+
+describe('htmlToPdf resource ownership', () => {
+  it('removes the temporary document when window construction throws', async () => {
+    const error = new Error('window construction failed')
+    fake.construct.mockImplementation(() => {
+      throw error
+    })
+
+    await expect(htmlToPdf(HTML)).rejects.toBe(error)
+
+    expect(fake.write).toHaveBeenCalledWith(TEMP_PATH, HTML, { encoding: 'utf-8', flag: 'wx' })
+    expect(fake.unlink).toHaveBeenCalledExactlyOnceWith(TEMP_PATH)
+    expect(fake.files.size).toBe(0)
+    expect(fake.destroy).not.toHaveBeenCalled()
+    expect(vi.getTimerCount()).toBe(0)
+  })
+
+  it('removes a partial document when writing rejects', async () => {
+    const error = new Error('disk full')
+    fake.write.mockImplementation(async (path) => {
+      fake.files.set(path, '<partial')
+      throw error
+    })
+
+    await expect(htmlToPdf(HTML)).rejects.toBe(error)
+
+    expect(fake.files.size).toBe(0)
+    expect(fake.unlink).toHaveBeenCalledExactlyOnceWith(TEMP_PATH)
+    expect(fake.construct).not.toHaveBeenCalled()
+  })
+
+  it('preserves the write error when no file exists and cleanup also rejects', async () => {
+    const error = new Error('write denied')
+    fake.write.mockRejectedValue(error)
+    fake.unlink.mockRejectedValue(new Error('ENOENT'))
+
+    await expect(htmlToPdf(HTML)).rejects.toBe(error)
+
+    expect(fake.unlink).toHaveBeenCalledExactlyOnceWith(TEMP_PATH)
+    expect(fake.construct).not.toHaveBeenCalled()
+  })
+
+  it('preserves the construction error when best-effort cleanup fails', async () => {
+    const error = new Error('window construction failed')
+    fake.construct.mockImplementation(() => {
+      throw error
+    })
+    fake.unlink.mockRejectedValue(new Error('unlink denied'))
+
+    await expect(htmlToPdf(HTML)).rejects.toBe(error)
+
+    expect(fake.unlink).toHaveBeenCalledExactlyOnceWith(TEMP_PATH)
+    expect(fake.files.size).toBe(1)
+  })
+
+  it('does not accumulate temporary documents across repeated failed exports', async () => {
+    fake.construct.mockImplementation(() => {
+      throw new Error('window construction failed')
+    })
+    for (let index = 0; index < 10; index++) {
+      fake.uuid.mockReturnValue(`export-${index}`)
+      await expect(htmlToPdf(HTML)).rejects.toThrow('window construction failed')
+    }
+
+    expect(fake.files.size).toBe(0)
+    expect(fake.unlink).toHaveBeenCalledTimes(10)
+  })
+
+  it('keeps window security, print settings and the returned PDF unchanged', async () => {
+    await expect(htmlToPdf(HTML)).resolves.toBe(PDF)
+
+    expect(fake.construct).toHaveBeenCalledExactlyOnceWith({
+      show: false,
+      webPreferences: {
+        sandbox: true,
+        contextIsolation: true,
+        nodeIntegration: false,
+        javascript: true
+      }
+    })
+    expect(fake.load).toHaveBeenCalledExactlyOnceWith(TEMP_PATH)
+    expect(fake.images).toHaveBeenCalledWith(expect.stringContaining('document.images'), true)
+    expect(fake.print).toHaveBeenCalledExactlyOnceWith({
+      printBackground: true,
+      pageSize: 'A4',
+      margins: { top: 0.75, bottom: 0.75, left: 0.75, right: 0.75 }
+    })
+    expect(fake.destroy).toHaveBeenCalledOnce()
+    expect(fake.unlink).toHaveBeenCalledExactlyOnceWith(TEMP_PATH)
+    expect(fake.files.size).toBe(0)
+    expect(vi.getTimerCount()).toBe(0)
+  })
+
+  it('waits for images before printing', async () => {
+    const images = Promise.withResolvers<void>()
+    fake.images.mockReturnValue(images.promise)
+    const result = htmlToPdf(HTML)
+    await vi.advanceTimersByTimeAsync(0)
+
+    expect(fake.images).toHaveBeenCalledOnce()
+    expect(fake.print).not.toHaveBeenCalled()
+    expect(fake.unlink).not.toHaveBeenCalled()
+
+    images.resolve()
+    await expect(result).resolves.toBe(PDF)
+    expect(fake.print).toHaveBeenCalledOnce()
+    expect(vi.getTimerCount()).toBe(0)
+  })
+
+  it.each(['images', 'print'] as const)('cleans up after %s failure', async (stage) => {
+    const error = new Error(`${stage} failed`)
+    fake[stage].mockRejectedValue(error)
+
+    await expect(htmlToPdf(HTML)).rejects.toBe(error)
+
+    expect(fake.destroy).toHaveBeenCalledOnce()
+    expect(fake.files.size).toBe(0)
+    expect(vi.getTimerCount()).toBe(0)
+  })
+
+  it('cleans up after a load rejection', async () => {
+    const error = new Error('load failed')
+    fake.load.mockRejectedValue(error)
+
+    await expect(htmlToPdf(HTML)).rejects.toBe(error)
+
+    expect(fake.destroy).toHaveBeenCalledOnce()
+    expect(fake.files.size).toBe(0)
+    expect(fake.images).not.toHaveBeenCalled()
+  })
+
+  it('keeps the render timeout type and clears its resources', async () => {
+    const images = Promise.withResolvers<void>()
+    fake.images.mockReturnValue(images.promise)
+    const result = expect(htmlToPdf(HTML)).rejects.toBeInstanceOf(ExportTimeoutError)
+    await vi.advanceTimersByTimeAsync(60_000)
+    await result
+
+    expect(fake.destroy).toHaveBeenCalledOnce()
+    expect(fake.files.size).toBe(0)
+    expect(vi.getTimerCount()).toBe(0)
+    images.reject(new Error('late renderer failure'))
+    await Promise.resolve()
+  })
+
+  it('does not destroy an already-destroyed window again', async () => {
+    fake.isDestroyed.mockReturnValue(true)
+
+    await expect(htmlToPdf(HTML)).resolves.toBe(PDF)
+
+    expect(fake.destroy).not.toHaveBeenCalled()
+    expect(fake.files.size).toBe(0)
+  })
+
+  it('still removes the document if window destruction throws', async () => {
+    const error = new Error('window destruction failed')
+    fake.destroy.mockImplementation(() => {
+      throw error
+    })
+
+    await expect(htmlToPdf(HTML)).rejects.toBe(error)
+
+    expect(fake.unlink).toHaveBeenCalledExactlyOnceWith(TEMP_PATH)
+    expect(fake.files.size).toBe(0)
+    expect(vi.getTimerCount()).toBe(0)
+  })
+
+  it('keeps a successful export successful when best-effort cleanup rejects', async () => {
+    fake.unlink.mockRejectedValue(new Error('unlink denied'))
+
+    await expect(htmlToPdf(HTML)).resolves.toBe(PDF)
+
+    expect(fake.destroy).toHaveBeenCalledOnce()
+    expect(fake.unlink).toHaveBeenCalledExactlyOnceWith(TEMP_PATH)
+    expect(vi.getTimerCount()).toBe(0)
+  })
+  it('leaves a pre-existing file at the temp path in place instead of deleting it', async () => {
+    const error = Object.assign(new Error('file already exists'), { code: 'EEXIST' })
+    fake.files.set(TEMP_PATH, 'FILE THIS EXPORT DID NOT CREATE')
+    fake.write.mockRejectedValue(error)
+
+    await expect(htmlToPdf(HTML)).rejects.toBe(error)
+
+    expect(fake.unlink).not.toHaveBeenCalled()
+    expect(fake.files.get(TEMP_PATH)).toBe('FILE THIS EXPORT DID NOT CREATE')
+    expect(fake.construct).not.toHaveBeenCalled()
+  })
+
+  it('times out and cleans up when loading never settles', async () => {
+    fake.load.mockReturnValue(new Promise<void>(() => {}))
+
+    const result = expect(htmlToPdf(HTML)).rejects.toBeInstanceOf(ExportTimeoutError)
+    await vi.advanceTimersByTimeAsync(60_000)
+    await result
+
+    expect(fake.images).not.toHaveBeenCalled()
+    expect(fake.destroy).toHaveBeenCalledOnce()
+    expect(fake.unlink).toHaveBeenCalledExactlyOnceWith(TEMP_PATH)
+    expect(fake.files.size).toBe(0)
+    expect(vi.getTimerCount()).toBe(0)
+  })
+
+  it('times out and cleans up when neither load event ever fires', async () => {
+    fake.load.mockResolvedValue()
+
+    const result = expect(htmlToPdf(HTML)).rejects.toBeInstanceOf(ExportTimeoutError)
+    await vi.advanceTimersByTimeAsync(60_000)
+    await result
+
+    expect(fake.print).not.toHaveBeenCalled()
+    expect(fake.destroy).toHaveBeenCalledOnce()
+    expect(fake.files.size).toBe(0)
+    expect(vi.getTimerCount()).toBe(0)
+  })
+
+  it('cleans up after a did-fail-load event', async () => {
+    fake.load.mockImplementation(async () => {
+      fake.handlers.get('did-fail-load')?.({}, -6, 'ERR_FILE_NOT_FOUND')
+    })
+
+    await expect(htmlToPdf(HTML)).rejects.toThrow('ERR_FILE_NOT_FOUND (-6)')
+
+    expect(fake.images).not.toHaveBeenCalled()
+    expect(fake.destroy).toHaveBeenCalledOnce()
+    expect(fake.files.size).toBe(0)
+    expect(vi.getTimerCount()).toBe(0)
+  })
+
+  it('never removes a temp path belonging to a concurrent export', async () => {
+    const images = Promise.withResolvers<void>()
+    fake.images.mockReturnValueOnce(images.promise)
+    fake.uuid.mockReturnValueOnce('first-export').mockReturnValueOnce('second-export')
+    const firstPath = join('/mock-export-temp', 'orca-export-first-export.html')
+    const secondPath = join('/mock-export-temp', 'orca-export-second-export.html')
+
+    const first = htmlToPdf(HTML)
+    await vi.advanceTimersByTimeAsync(0)
+    await expect(htmlToPdf(HTML)).resolves.toBe(PDF)
+
+    expect(fake.unlink).toHaveBeenCalledExactlyOnceWith(secondPath)
+    expect(fake.files.has(firstPath)).toBe(true)
+
+    images.resolve()
+    await expect(first).resolves.toBe(PDF)
+    expect(fake.unlink).toHaveBeenCalledWith(firstPath)
+    expect(fake.files.size).toBe(0)
+  })
+})
diff --git a/src/main/lib/html-to-pdf.ts b/src/main/lib/html-to-pdf.ts
index f0cc467e5152..a375e7ef7c73 100644
--- a/src/main/lib/html-to-pdf.ts
+++ b/src/main/lib/html-to-pdf.ts
@@ -33,66 +33,93 @@ new Promise((resolve) => {
 export async function htmlToPdf(html: string): Promise<Buffer> {
   const tempDir = app.getPath('temp')
   const tempPath = path.join(tempDir, `orca-export-${randomUUID()}.html`)
-  await writeFile(tempPath, html, 'utf-8')
 
-  const win = new BrowserWindow({
-    show: false,
-    webPreferences: {
-      sandbox: true,
-      contextIsolation: true,
-      nodeIntegration: false,
-      // Why: image-wait needs to run a short script inside the export page, and
-      // the exported renderer DOM may already embed scripts/SVGs (e.g. Mermaid)
-      // that need JS to paint correctly. The window stays sandboxed and
-      // isolated so this is safe.
-      javascript: true
+  // Why: 'wx' is an exclusive create, so the shared temp dir cannot pre-seat this
+  // path as a symlink and have the export write through it. EEXIST is the one
+  // failure where the path is not ours, so it must not be unlinked below.
+  try {
+    await writeFile(tempPath, html, { encoding: 'utf-8', flag: 'wx' })
+  } catch (error) {
+    if (isAlreadyExists(error)) {
+      throw error
     }
-  })
-
-  let timer: NodeJS.Timeout | undefined
+    await removeOwnTempDocument(tempPath)
+    throw error
+  }
 
   try {
-    const loadPromise = new Promise<void>((resolve, reject) => {
-      win.webContents.once('did-finish-load', () => resolve())
-      win.webContents.once('did-fail-load', (_event, errorCode, errorDescription) => {
-        reject(new Error(`Failed to load export document: ${errorDescription} (${errorCode})`))
-      })
+    const win = new BrowserWindow({
+      show: false,
+      webPreferences: {
+        sandbox: true,
+        contextIsolation: true,
+        nodeIntegration: false,
+        // Why: image-wait needs to run a short script inside the export page, and
+        // the exported renderer DOM may already embed scripts/SVGs (e.g. Mermaid)
+        // that need JS to paint correctly. The window stays sandboxed and
+        // isolated so this is safe.
+        javascript: true
+      }
     })
 
-    await win.loadFile(tempPath)
-    await loadPromise
+    let timer: NodeJS.Timeout | undefined
 
-    const renderAndPrint = (async (): Promise<Buffer> => {
-      await win.webContents.executeJavaScript(WAIT_FOR_IMAGES_SCRIPT, true)
-      return win.webContents.printToPDF({
-        printBackground: true,
-        pageSize: 'A4',
-        margins: {
-          top: 0.75,
-          bottom: 0.75,
-          left: 0.75,
-          right: 0.75
-        }
+    try {
+      // Why: the timeout has to cover loading too. An export document whose script
+      // never yields fires neither did-finish-load nor did-fail-load, so a
+      // render-only timeout would leave this window and its temp file forever.
+      const timeoutPromise = new Promise<never>((_resolve, reject) => {
+        timer = setTimeout(() => reject(new ExportTimeoutError()), EXPORT_TIMEOUT_MS)
       })
-    })()
 
-    const timeoutPromise = new Promise<never>((_resolve, reject) => {
-      timer = setTimeout(() => reject(new ExportTimeoutError()), EXPORT_TIMEOUT_MS)
-    })
+      const loadAndPrint = (async (): Promise<Buffer> => {
+        const loadPromise = new Promise<void>((resolve, reject) => {
+          win.webContents.once('did-finish-load', () => resolve())
+          win.webContents.once('did-fail-load', (_event, errorCode, errorDescription) => {
+            reject(new Error(`Failed to load export document: ${errorDescription} (${errorCode})`))
+          })
+        })
 
-    return await Promise.race([renderAndPrint, timeoutPromise])
-  } finally {
-    if (timer) {
-      clearTimeout(timer)
-    }
-    if (!win.isDestroyed()) {
-      win.destroy()
-    }
-    try {
-      await unlink(tempPath)
-    } catch {
-      // Why: best-effort cleanup — losing the temp file should not surface
-      // as a user-facing export failure.
+        await win.loadFile(tempPath)
+        await loadPromise
+        await win.webContents.executeJavaScript(WAIT_FOR_IMAGES_SCRIPT, true)
+        return win.webContents.printToPDF({
+          printBackground: true,
+          pageSize: 'A4',
+          margins: {
+            top: 0.75,
+            bottom: 0.75,
+            left: 0.75,
+            right: 0.75
+          }
+        })
+      })()
+
+      return await Promise.race([loadAndPrint, timeoutPromise])
+    } finally {
+      if (timer) {
+        clearTimeout(timer)
+      }
+      if (!win.isDestroyed()) {
+        win.destroy()
+      }
     }
+  } finally {
+    await removeOwnTempDocument(tempPath)
+  }
+}
+
+function isAlreadyExists(error: unknown): boolean {
+  return error instanceof Error && 'code' in error && error.code === 'EEXIST'
+}
+
+// unlink never follows a symlink, so this removes the entry this export created
+// and never the target of one swapped in underneath it.
+async function removeOwnTempDocument(tempPath: string): Promise<void> {
+  try {
+    await unlink(tempPath)
+  } catch {
+    // Why: best-effort cleanup — losing the temp file should not surface
+    // as a user-facing export failure.
   }
 }
diff --git a/src/main/linear/teams.test.ts b/src/main/linear/teams.test.ts
index d0d8986373d8..55808711824f 100644
--- a/src/main/linear/teams.test.ts
+++ b/src/main/linear/teams.test.ts
@@ -72,16 +72,15 @@ function makeConnection<TNode>(pages: TNode[][]) {
   return {
     nodes,
     pageInfo: { hasNextPage: pages.length > 1 },
-    fetchNext: vi
-      .fn()
-      .mockImplementation(
-        async function fetchNext(this: { nodes: TNode[]; pageInfo: { hasNextPage: boolean } }) {
-          pageIndex += 1
-          this.nodes.push(...(pages[pageIndex] ?? []))
-          this.pageInfo.hasNextPage = pageIndex < pages.length - 1
-          return this
-        }
-      )
+    fetchNext: vi.fn().mockImplementation(async function fetchNext(this: {
+      nodes: TNode[]
+      pageInfo: { hasNextPage: boolean }
+    }) {
+      pageIndex += 1
+      this.nodes.push(...(pages[pageIndex] ?? []))
+      this.pageInfo.hasNextPage = pageIndex < pages.length - 1
+      return this
+    })
   }
 }
 
diff --git a/src/main/linux-update-package-type.test.ts b/src/main/linux-update-package-type.test.ts
index 7453c727bb88..ed1abf90b476 100644
--- a/src/main/linux-update-package-type.test.ts
+++ b/src/main/linux-update-package-type.test.ts
@@ -221,7 +221,7 @@ describe('getLinuxRootPackageType', () => {
   })
 
   it('returns unusable when the marker is unreadable', async () => {
-    // A directory in the marker's place makes readFileSync fail with EISDIR.
+    // A directory in the marker's place makes fail with EISDIR.
     await fsp.mkdir(path.join(resourcesDir, 'package-type'))
     const module = await loadPackageType()
     expect(module.getLinuxPackageType()).toBe('unusable')
diff --git a/src/main/local-orphaned-worktree-cleanup.ts b/src/main/local-orphaned-worktree-cleanup.ts
new file mode 100644
index 000000000000..9ed666e50212
--- /dev/null
+++ b/src/main/local-orphaned-worktree-cleanup.ts
@@ -0,0 +1,39 @@
+import type { LocalWorktreeFilesystemOptions } from './local-worktree-filesystem'
+import {
+  getLocalWorktreePathAccess,
+  removeLocalWorktreePath,
+  toLocalWorktreeRuntimePath
+} from './local-worktree-filesystem'
+import {
+  canSafelyRemoveOrphanedWorktreeDirectory,
+  isWorktreePathMissing,
+  ORPHANED_WORKTREE_DIRECTORY_MESSAGE
+} from './worktree-removal-safety'
+import { CLIENT_REMOVAL_HOME } from './worktree-removal-home-guard'
+
+export async function cleanupLocalOrphanedWorktreeDirectory(
+  repoPath: string,
+  path: string,
+  options: LocalWorktreeFilesystemOptions,
+  closeWatchers: (path: string) => Promise<void>
+): Promise<void> {
+  const access = getLocalWorktreePathAccess(options)
+  const runtimePath = toLocalWorktreeRuntimePath(path, options)
+  if (
+    await canSafelyRemoveOrphanedWorktreeDirectory(
+      runtimePath,
+      toLocalWorktreeRuntimePath(repoPath, options),
+      CLIENT_REMOVAL_HOME,
+      access.statPath,
+      access.readPath
+    )
+  ) {
+    await closeWatchers(path)
+    await removeLocalWorktreePath(path, options).catch(() => {})
+  } else {
+    console.warn(`[worktrees] Refusing recursive cleanup for unproven worktree directory: ${path}`)
+  }
+  if (!(await isWorktreePathMissing(runtimePath, access.statPath))) {
+    throw new Error(ORPHANED_WORKTREE_DIRECTORY_MESSAGE)
+  }
+}
diff --git a/src/main/local-worktree-filesystem.test.ts b/src/main/local-worktree-filesystem.test.ts
index c9e97f72e904..d69d82b914fc 100644
--- a/src/main/local-worktree-filesystem.test.ts
+++ b/src/main/local-worktree-filesystem.test.ts
@@ -25,17 +25,18 @@ import {
   toHostFilesystemPath,
   toHostRemovalPath
 } from './local-worktree-filesystem'
+import { isWorktreePathMissing } from './worktree-removal-safety'
 
 function completeExecFile(stdout = ''): void {
   runProcessMock.mockResolvedValue({ code: 0, signal: null, stdout, stderr: '', timedOut: false })
 }
 
-function failExecFile(exitCode: number): void {
+function failExecFile(exitCode: number, stderr = 'missing'): void {
   runProcessMock.mockResolvedValue({
     code: exitCode,
     signal: null,
     stdout: '',
-    stderr: 'missing',
+    stderr,
     timedOut: false
   })
 }
@@ -171,7 +172,7 @@ describe('local worktree filesystem runtime access', () => {
 
   it('uses the selected WSL distro for stat, read, and removal on Windows', async () => {
     await withPlatform('win32', async () => {
-      completeExecFile('file')
+      completeExecFile('regular file')
       const access = getLocalWorktreePathAccess({ wslDistro: 'Ubuntu' })
       await expect(access.statPath('/home/me/repo/.git')).resolves.toEqual({ type: 'file' })
 
@@ -218,14 +219,68 @@ describe('local worktree filesystem runtime access', () => {
     })
   })
 
-  it('reports missing WSL stat targets with an ENOENT-shaped error', async () => {
+  // Captured verbatim from live hosts: GNU coreutils 9.4 (Ubuntu 24.04) and BusyBox v1.36.1.
+  it.each([
+    ['GNU', "stat: cannot statx '/mnt/c/repo/missing/.git': No such file or directory\n"],
+    ['GNU', "stat: cannot statx '/mnt/c/repo/missing/.git': Not a directory\n"],
+    ['BusyBox', "stat: can't stat '/mnt/c/repo/missing/.git': No such file or directory\n"],
+    ['BusyBox', "stat: can't stat '/mnt/c/repo/missing/.git': Not a directory\n"]
+  ])('reports a missing WSL stat target as ENOENT on %s userland', async (_userland, stderr) => {
     await withPlatform('win32', async () => {
-      failExecFile(2)
+      failExecFile(1, stderr)
       const access = getLocalWorktreePathAccess({ wslDistro: 'Ubuntu' })
 
       await expect(access.statPath('/mnt/c/repo/missing/.git')).rejects.toMatchObject({
         code: 'ENOENT'
       })
+      await expect(isWorktreePathMissing('/mnt/c/repo/missing', access.statPath)).resolves.toBe(
+        true
+      )
+    })
+  })
+
+  it.each([
+    ['GNU', "stat: cannot statx '/mnt/c/repo/locked': Permission denied\n"],
+    ['BusyBox', "stat: can't stat '/mnt/c/repo/locked': Permission denied\n"]
+  ])(
+    'does not treat an unreadable WSL stat target as missing on %s userland',
+    async (_userland, stderr) => {
+      await withPlatform('win32', async () => {
+        failExecFile(1, stderr)
+        const access = getLocalWorktreePathAccess({ wslDistro: 'Ubuntu' })
+
+        await expect(access.statPath('/mnt/c/repo/locked')).rejects.toThrow('Permission denied')
+        // A delete that did not happen still has to look like a failure, or cleanup silently "succeeds".
+        await expect(isWorktreePathMissing('/mnt/c/repo/locked', access.statPath)).resolves.toBe(
+          false
+        )
+      })
+    }
+  )
+
+  it('pins the stat probe to the C locale so its error text stays English', async () => {
+    await withPlatform('win32', async () => {
+      completeExecFile('directory')
+      await getLocalWorktreePathAccess({ wslDistro: 'Ubuntu' }).statPath('/mnt/c/repo/feature')
+
+      const args = runProcessMock.mock.calls[0]?.[0].args as string[]
+      expect(args.at(-1)).toContain('LC_ALL=C stat -c %F --')
+    })
+  })
+
+  it('reports a translated stat failure as a failure rather than as absence', async () => {
+    await withPlatform('win32', async () => {
+      // Synthetic: no host available here ships a non-English locale, and the probe pins LC_ALL=C
+      // anyway. The point is the direction it errs if that pin ever comes off.
+      failExecFile(1, "stat: <translated verb> '/mnt/c/repo/missing': <translated errno>\n")
+      const access = getLocalWorktreePathAccess({ wslDistro: 'Ubuntu' })
+
+      await expect(access.statPath('/mnt/c/repo/missing')).rejects.not.toMatchObject({
+        code: 'ENOENT'
+      })
+      await expect(isWorktreePathMissing('/mnt/c/repo/missing', access.statPath)).resolves.toBe(
+        false
+      )
     })
   })
 })
diff --git a/src/main/local-worktree-filesystem.ts b/src/main/local-worktree-filesystem.ts
index 1078b1f50bc3..d6820dd5b146 100644
--- a/src/main/local-worktree-filesystem.ts
+++ b/src/main/local-worktree-filesystem.ts
@@ -18,8 +18,6 @@ type LocalWorktreePathAccess = {
 }
 
 const WSL_FILE_OPERATION_TIMEOUT_MS = 30_000
-/** The stat probe's explicit "missing path" branch. */
-const WSL_MISSING_PATH_EXIT_CODE = 2
 
 function shouldUseWslFilesystem(options: LocalWorktreeFilesystemOptions): boolean {
   return process.platform === 'win32' && !!options.wslDistro?.trim()
@@ -48,18 +46,27 @@ async function runWslCommand(distro: string, command: string): Promise<string> {
   }
   if (result.code !== 0) {
     throw Object.assign(new Error(result.stderr.trim() || `wsl.exe exited ${result.code}`), {
-      exitCode: result.code
+      exitCode: result.code,
+      stderr: result.stderr
     })
   }
   return result.stdout
 }
 
+/**
+ * Only stat's trailing strerror text is portable: GNU coreutils says `cannot statx`,
+ * BusyBox says `can't stat`, so matching the verb made a BusyBox distro report a
+ * successful cleanup as a permanent failure. The tail stays English because the probe
+ * pins LC_ALL=C, and stat is the only thing in that probe that writes to stderr.
+ */
+const WSL_MISSING_PATH_STDERR = /: (?:No such file or directory|Not a directory)\r?\n?$/
+
 function isWslMissingPathError(error: unknown): boolean {
-  return (
-    typeof error === 'object' &&
-    error !== null &&
-    (error as { exitCode?: unknown }).exitCode === WSL_MISSING_PATH_EXIT_CODE
-  )
+  if (typeof error !== 'object' || error === null || !('exitCode' in error)) {
+    return false
+  }
+  const stderr = 'stderr' in error && typeof error.stderr === 'string' ? error.stderr : ''
+  return error.exitCode === 1 && WSL_MISSING_PATH_STDERR.test(stderr)
 }
 
 export function toLocalWorktreeRuntimePath(
@@ -83,19 +90,26 @@ export function getLocalWorktreePathAccess(
   return {
     statPath: async (path) => {
       const target = quotePosixShell(toLinuxPath(path))
-      const stdout = await runWslCommand(
-        distro,
-        [
-          `target=${target}`,
-          'if [ -L "$target" ]; then printf symlink; elif [ -f "$target" ]; then printf file; elif [ -d "$target" ]; then printf directory; else exit 2; fi'
-        ].join('\n')
-      ).catch((error) => {
-        if (isWslMissingPathError(error)) {
-          throw Object.assign(new Error(`missing ${path}`), { code: 'ENOENT' })
+      // Shell file tests conflate permission failures with absence; stat preserves the reason.
+      const stdout = await runWslCommand(distro, `LC_ALL=C stat -c %F -- ${target}`).catch(
+        (error: unknown) => {
+          if (isWslMissingPathError(error)) {
+            throw Object.assign(new Error(`missing ${path}`), { code: 'ENOENT' })
+          }
+          throw error
         }
-        throw error
-      })
-      return { type: stdout.trim() }
+      )
+      const kind = stdout.trim()
+      return {
+        type:
+          kind === 'symbolic link'
+            ? 'symlink'
+            : kind === 'regular file' || kind === 'regular empty file'
+              ? 'file'
+              : kind === 'directory'
+                ? 'directory'
+                : 'other'
+      }
     },
     readPath: async (path) => {
       const target = quotePosixShell(toLinuxPath(path))
diff --git a/src/main/macos-keychain/generic-password.test.ts b/src/main/macos-keychain/generic-password.test.ts
new file mode 100644
index 000000000000..38ec1b05a723
--- /dev/null
+++ b/src/main/macos-keychain/generic-password.test.ts
@@ -0,0 +1,101 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+const execFileMock = vi.hoisted(() => vi.fn())
+
+vi.mock('node:child_process', () => ({ execFile: execFileMock }))
+
+import {
+  deleteKeychainPassword,
+  isKeychainNotFoundError,
+  readKeychainPassword,
+  writeKeychainPassword
+} from './generic-password'
+
+const originalPlatform = process.platform
+
+function setPlatform(platform: NodeJS.Platform): void {
+  Object.defineProperty(process, 'platform', { value: platform, configurable: true })
+}
+
+function respond(stdout: string): void {
+  execFileMock.mockImplementation((_file, _args, _options, callback) => {
+    callback(null, stdout, '')
+    return { kill: vi.fn() }
+  })
+}
+
+function fail(error: unknown): void {
+  execFileMock.mockImplementation((_file, _args, _options, callback) => {
+    callback(error, '', '')
+    return { kill: vi.fn() }
+  })
+}
+
+beforeEach(() => {
+  execFileMock.mockReset()
+  setPlatform('darwin')
+})
+
+afterEach(() => {
+  setPlatform(originalPlatform)
+})
+
+describe('readKeychainPassword', () => {
+  it('returns the trimmed secret for a stored item', async () => {
+    respond('  secret-value\n')
+    await expect(readKeychainPassword('cursor-access-token', 'cursor-user')).resolves.toBe(
+      'secret-value'
+    )
+    expect(execFileMock.mock.calls[0]?.[1]).toEqual([
+      'find-generic-password',
+      '-s',
+      'cursor-access-token',
+      '-a',
+      'cursor-user',
+      '-w'
+    ])
+  })
+
+  it('returns null rather than throwing when the item does not exist', async () => {
+    fail(Object.assign(new Error('The specified item could not be found'), { code: 44 }))
+    await expect(readKeychainPassword('svc', 'acct')).resolves.toBeNull()
+  })
+
+  it('rethrows a denied or locked keychain so callers can report it', async () => {
+    fail(new Error('User interaction is not allowed'))
+    await expect(readKeychainPassword('svc', 'acct')).rejects.toThrow(
+      'User interaction is not allowed'
+    )
+  })
+
+  it('never shells out off macOS', async () => {
+    setPlatform('win32')
+    await expect(readKeychainPassword('svc', 'acct')).resolves.toBeNull()
+    await writeKeychainPassword('svc', 'acct', 'value')
+    await deleteKeychainPassword('svc', 'acct')
+    expect(execFileMock).not.toHaveBeenCalled()
+  })
+})
+
+describe('deleteKeychainPassword', () => {
+  it('swallows a missing item', async () => {
+    fail(Object.assign(new Error('could not be found'), { code: 44 }))
+    await expect(deleteKeychainPassword('svc', 'acct')).resolves.toBeUndefined()
+  })
+
+  it('surfaces an access failure only when the caller asks for it', async () => {
+    fail(new Error('User interaction is not allowed'))
+    await expect(deleteKeychainPassword('svc', 'acct')).resolves.toBeUndefined()
+    await expect(
+      deleteKeychainPassword('svc', 'acct', { failOnAccessError: true })
+    ).rejects.toThrow('User interaction is not allowed')
+  })
+})
+
+describe('isKeychainNotFoundError', () => {
+  it('recognizes the security(1) not-found signals', () => {
+    expect(isKeychainNotFoundError({ code: 44 })).toBe(true)
+    expect(isKeychainNotFoundError(new Error('The specified item could not be found'))).toBe(true)
+    expect(isKeychainNotFoundError(new Error('User interaction is not allowed'))).toBe(false)
+  })
+})
diff --git a/src/main/macos-keychain/generic-password.ts b/src/main/macos-keychain/generic-password.ts
new file mode 100644
index 000000000000..8a805edd809b
--- /dev/null
+++ b/src/main/macos-keychain/generic-password.ts
@@ -0,0 +1,147 @@
+// Why execFile and not runProcess: this is a relocation of the Claude keychain
+// reader's existing exception, kept byte-for-byte so Claude's credential path and
+// its tests are unchanged. See the child_process import allowlist.
+import { execFile } from 'node:child_process'
+
+const KEYCHAIN_COMMAND_TIMEOUT_MS = 3_000
+
+type SecurityCommandResult = {
+  stdout: string
+  stderr: string
+}
+
+export function isKeychainNotFoundError(error: unknown): boolean {
+  const code =
+    error && typeof error === 'object' && 'code' in error
+      ? (error as { code?: unknown }).code
+      : undefined
+  const message =
+    error && typeof error === 'object'
+      ? `${String((error as { stderr?: unknown }).stderr ?? '')} ${String(
+          (error as { message?: unknown }).message ?? ''
+        )}`.toLowerCase()
+      : String(error).toLowerCase()
+  return code === 44 || message.includes('could not be found') || message.includes('not be found')
+}
+
+export function execSecurityCommand(args: string[]): Promise<SecurityCommandResult> {
+  return new Promise((resolve, reject) => {
+    let settled = false
+    let child: ReturnType<typeof execFile> | undefined
+    const timer = setTimeout(() => {
+      if (settled) {
+        return
+      }
+      settled = true
+      child?.kill()
+      reject(
+        Object.assign(new Error(`security timed out after ${KEYCHAIN_COMMAND_TIMEOUT_MS}ms`), {
+          code: 'ETIMEDOUT',
+          stderr: ''
+        })
+      )
+    }, KEYCHAIN_COMMAND_TIMEOUT_MS)
+
+    const settle = (callback: () => void): void => {
+      if (settled) {
+        return
+      }
+      settled = true
+      clearTimeout(timer)
+      callback()
+    }
+
+    // Why: Node's execFile timeout only signals the `security` process; a
+    // stuck callback would otherwise leave auth/keychain operations pending.
+    try {
+      child = execFile(
+        'security',
+        args,
+        { timeout: KEYCHAIN_COMMAND_TIMEOUT_MS },
+        (error, stdout, stderr) => {
+          if (error) {
+            settle(() =>
+              reject(
+                Object.assign(error, {
+                  stdout: String(stdout),
+                  stderr: String(stderr)
+                })
+              )
+            )
+            return
+          }
+          settle(() => resolve({ stdout: String(stdout), stderr: String(stderr) }))
+        }
+      )
+    } catch (error) {
+      settle(() => reject(error))
+    }
+  })
+}
+
+export function execSecurity(
+  args: string[],
+  options?: { ignoreFailure?: boolean; ignoreNotFound?: boolean }
+): Promise<void> {
+  return execSecurityCommand(args).then(undefined, (error: unknown) => {
+    if (options?.ignoreNotFound && isKeychainNotFoundError(error)) {
+      return
+    }
+    if (!options?.ignoreFailure) {
+      throw error
+    }
+  })
+}
+
+export async function readKeychainPassword(
+  service: string,
+  account: string
+): Promise<string | null> {
+  if (process.platform !== 'darwin') {
+    return null
+  }
+  try {
+    const { stdout } = await execSecurityCommand([
+      'find-generic-password',
+      '-s',
+      service,
+      '-a',
+      account,
+      '-w'
+    ])
+    if (stdout.trim()) {
+      return stdout.trim()
+    }
+    throw new Error(`Could not read macOS Keychain item ${service}/${account}.`)
+  } catch (error) {
+    if (isKeychainNotFoundError(error)) {
+      return null
+    }
+    throw error
+  }
+}
+
+export async function writeKeychainPassword(
+  service: string,
+  account: string,
+  contents: string
+): Promise<void> {
+  if (process.platform !== 'darwin') {
+    return
+  }
+  await execSecurity(['add-generic-password', '-U', '-s', service, '-a', account, '-w', contents])
+}
+
+export async function deleteKeychainPassword(
+  service: string,
+  account: string,
+  options?: { failOnAccessError?: boolean }
+): Promise<void> {
+  if (process.platform !== 'darwin') {
+    return
+  }
+  await execSecurity(['delete-generic-password', '-s', service, '-a', account], {
+    ignoreNotFound: true,
+    ignoreFailure: !options?.failOnAccessError
+  })
+}
diff --git a/src/main/menu/register-app-menu.test.ts b/src/main/menu/register-app-menu.test.ts
index 08b5a489a9c2..b5a127180584 100644
--- a/src/main/menu/register-app-menu.test.ts
+++ b/src/main/menu/register-app-menu.test.ts
@@ -72,6 +72,20 @@ function getSubmenu(
 }
 
 describe('registerAppMenu', () => {
+  it('shows the Settings hint when the user assigns a shortcut', () => {
+    registerAppMenu({
+      ...buildMenuOptions(),
+      getKeybindings: () => ({ 'app.settings': ['Mod+Comma'] })
+    })
+
+    const submenu = getSubmenu(getTemplate(), isMac ? 'Orca' : 'File')
+    expect(submenu).toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({ label: `Settings\t${isMac ? '⌘,' : 'Ctrl+,'}` })
+      ])
+    )
+  })
+
   it('toggles missing default-on appearance settings from visible to hidden', () => {
     expect(getNextDefaultOnAppearanceSettingValue(undefined)).toBe(false)
     expect(getNextDefaultOnAppearanceSettingValue(true)).toBe(false)
@@ -381,10 +395,8 @@ describe('registerAppMenu', () => {
 
     const fileLabels = getSubmenu(template, 'File').map((item) => item.label)
     expect(fileLabels).not.toContain(`Export as PDF...\t${isMac ? '⌘⇧E' : 'Ctrl+Shift+E'}`)
-    expect(fileLabels[0]).toBe(`Settings\t${isMac ? '⌘,' : 'Ctrl+,'}`)
-    expect(fileLabels).toEqual(
-      expect.arrayContaining([`Settings\t${isMac ? '⌘,' : 'Ctrl+,'}`, 'Exit'])
-    )
+    expect(fileLabels[0]).toBe('Settings')
+    expect(fileLabels).toEqual(expect.arrayContaining(['Settings', 'Exit']))
 
     const helpLabels = getSubmenu(template, 'Help').map((item) => item.label)
     expect(helpLabels).toEqual(
@@ -403,9 +415,7 @@ describe('registerAppMenu', () => {
     const template = getTemplate()
     const appSubmenu = getSubmenu(template, 'Orca')
     const appLabels = appSubmenu.map((item) => item.label)
-    expect(appLabels).toEqual(
-      expect.arrayContaining(['Check for Updates...', `Settings\t${isMac ? '⌘,' : 'Ctrl+,'}`])
-    )
+    expect(appLabels).toEqual(expect.arrayContaining(['Check for Updates...', 'Settings']))
     // Why: on macOS File should NOT duplicate Settings/Exit — those live in
     // the system app menu. Without global Export, there is no File item left.
     expect(template.find((item) => item.label === 'File')).toBeUndefined()
diff --git a/src/main/menu/register-app-menu.ts b/src/main/menu/register-app-menu.ts
index 2f77e7f8941f..889e0cd0b080 100644
--- a/src/main/menu/register-app-menu.ts
+++ b/src/main/menu/register-app-menu.ts
@@ -113,8 +113,16 @@ function buildAndApplyMenu(options: RegisterAppMenuOptions): void {
     click: checkForUpdatesClick
   }
 
+  const settingsBindings = getEffectiveKeybindingsForAction(
+    'app.settings',
+    process.platform,
+    getKeybindings?.()
+  )
+  const settingsShortcut = settingsBindings.length
+    ? `\t${formatKeybindingList(settingsBindings, process.platform)}`
+    : ''
   const settingsItem: Electron.MenuItemConstructorOptions = {
-    label: `${translateMain('menu.settings', 'Settings')}\t${shortcutLabel('app.settings')}`,
+    label: `${translateMain('menu.settings', 'Settings')}${settingsShortcut}`,
     click: () => onOpenSettings()
   }
 
diff --git a/src/main/muse-usage/store-snapshot-filtering.test.ts b/src/main/muse-usage/store-snapshot-filtering.test.ts
new file mode 100644
index 000000000000..0db268083d90
--- /dev/null
+++ b/src/main/muse-usage/store-snapshot-filtering.test.ts
@@ -0,0 +1,106 @@
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, expect, it, vi } from 'vitest'
+import { MuseUsageStore } from './store'
+import { museUsageAggregation } from './scanner'
+import * as filters from '../usage/usage-scope-filters'
+import type { MuseUsageAttributedEvent } from './types'
+
+const fake = vi.hoisted(() => ({ directory: '' }))
+vi.mock('electron', () => ({ app: { getPath: () => fake.directory } }))
+vi.mock('../usage-cache-snapshot-writer', () => ({
+  UsageCacheSnapshotWriter: class {
+    flush = async () => {}
+    write = async () => {}
+  }
+}))
+
+class FixtureStore extends MuseUsageStore {
+  constructor(count: number) {
+    super({ getRepos: () => [], getAllWorktreeMeta: () => ({}) })
+    const events: MuseUsageAttributedEvent[] = Array.from({ length: count }, (_, index) => {
+      const day = ['2026-09-25', '2026-08-01', '2026-05-01'][index % 3]
+      const inside = index % 2 === 0
+      return {
+        sessionId: `session-${index}`,
+        timestamp: `${day}T12:00:00.000Z`,
+        day,
+        eventKey: String(index),
+        cwd: null,
+        model: index % 4 === 0 ? null : `model-${index % 3}`,
+        projectKey: `project-${index % 4}`,
+        projectLabel: `Project ${index % 4}`,
+        repoId: inside ? 'repo' : null,
+        worktreeId: inside ? `folder-${index % 4}` : null,
+        inputTokens: 100,
+        cachedInputTokens: 20,
+        outputTokens: 10,
+        reasoningOutputTokens: 2,
+        totalTokens: 110
+      }
+    })
+    const projection = museUsageAggregation.aggregate(events)
+    this.state = { ...this.state, ...projection }
+  }
+}
+
+beforeEach(() => {
+  fake.directory = mkdtempSync(join(tmpdir(), 'orca-muse-snapshot-'))
+  vi.useFakeTimers()
+  vi.setSystemTime(new Date(2026, 8, 26, 12))
+})
+afterEach(() => {
+  vi.restoreAllMocks()
+  vi.useRealTimers()
+  rmSync(fake.directory, { recursive: true, force: true })
+})
+
+it('filters each accumulated projection once per snapshot', () => {
+  const store = new FixtureStore(20_000)
+  const daily = vi.spyOn(filters, 'filterUsageDaily')
+  const sessions = vi.spyOn(filters, 'filterUsageSessions')
+  const result = store.getSnapshot('orca', '30d')
+  expect(result.summary.sessions).toBeGreaterThan(0)
+  expect(result.recentSessions).toHaveLength(10)
+  expect(sessions.mock.calls[0]?.[0]).toHaveLength(20_000)
+  expect({ daily: daily.mock.calls.length, sessions: sessions.mock.calls.length }).toEqual({
+    daily: 1,
+    sessions: 1
+  })
+})
+
+it.each(['orca', 'all'] as const)(
+  'keeps snapshot projections equal to individual %s reads',
+  async (scope) => {
+    const store = new FixtureStore(30)
+    for (const range of ['7d', '30d', '90d', 'all'] as const) {
+      for (const limit of [0, 1, 10]) {
+        const snapshot = store.getSnapshot(scope, range, limit)
+        expect(snapshot).toEqual({
+          scanState: store.getScanState(),
+          summary: await store.getSummary(scope, range),
+          daily: await store.getDaily(scope, range),
+          modelBreakdown: await store.getBreakdown(scope, range, 'model'),
+          projectBreakdown: await store.getBreakdown(scope, range, 'project'),
+          recentSessions: await store.getRecentSessions(scope, range, limit)
+        })
+      }
+    }
+  }
+)
+
+it('keeps empty snapshots and later calls independent', () => {
+  const store = new FixtureStore(0)
+  const first = store.getSnapshot('all', 'all')
+  const next = store.getSnapshot('orca', '7d', 0)
+  expect(first.daily).toEqual([])
+  expect(first.recentSessions).toEqual([])
+  expect(next.summary).toMatchObject({
+    sessions: 0,
+    events: 0,
+    totalTokens: 0,
+    scope: 'orca',
+    range: '7d'
+  })
+})
diff --git a/src/main/muse-usage/store.ts b/src/main/muse-usage/store.ts
index 95f13f3ec8c5..b1b22996848f 100644
--- a/src/main/muse-usage/store.ts
+++ b/src/main/muse-usage/store.ts
@@ -56,16 +56,15 @@ export class MuseUsageStore extends UsageProviderStoreLifecycle<
     range: MuseUsageRange,
     recentSessionLimit = 10
   ): MuseUsageSnapshot {
+    const daily = this.getFilteredDaily(scope, range)
+    const sessions = this.getFilteredSessions(scope, range)
     return {
       scanState: this.getScanState(),
-      summary: this.buildSummary(scope, range),
-      daily: buildMuseUsageDailyPoints(this.getFilteredDaily(scope, range)),
-      modelBreakdown: this.buildBreakdown(scope, range, 'model'),
-      projectBreakdown: this.buildBreakdown(scope, range, 'project'),
-      recentSessions: buildMuseUsageRecentSessions(
-        this.getFilteredSessions(scope, range),
-        recentSessionLimit
-      )
+      summary: buildMuseUsageSummary(scope, range, daily, sessions),
+      daily: buildMuseUsageDailyPoints(daily),
+      modelBreakdown: buildMuseUsageBreakdownRows('model', scope, daily, sessions),
+      projectBreakdown: buildMuseUsageBreakdownRows('project', scope, daily, sessions),
+      recentSessions: buildMuseUsageRecentSessions(sessions, recentSessionLimit)
     }
   }
 
diff --git a/src/main/muse/hook-settings.ts b/src/main/muse/hook-settings.ts
index 5b5fe3f63fd5..0ef3d5d462bb 100644
--- a/src/main/muse/hook-settings.ts
+++ b/src/main/muse/hook-settings.ts
@@ -4,11 +4,11 @@ import {
   buildManagedCommandHook,
   createManagedCommandMatcher,
   getSharedManagedScriptPath,
-  isPlainObject,
   wrapPosixHookCommand,
   wrapWindowsHookCommand,
   type HookDefinition
 } from '../agent-hooks/installer-utils'
+import { readManagedHookEventsFromJson } from '../agent-hooks/managed-hooks-json-events'
 
 const MUSE_SCRIPT_BASE = 'muse-hook'
 
@@ -87,45 +87,9 @@ export function readManagedMuseHookEvents(
   parsed: unknown,
   isManagedCommand: (command: string | undefined) => boolean
 ): Set<string> {
-  const present = new Set<string>()
-  if (!isPlainObject(parsed) || !isPlainObject(parsed.hooks)) {
-    return present
-  }
-  for (const event of MUSE_HOOK_EVENTS) {
-    const definitions = parsed.hooks[event]
-    if (!Array.isArray(definitions)) {
-      continue
-    }
-    // Why: a hand-edited managed file can hold null definitions, non-array
-    // hook lists, or null entries — treat all of them as absent so status
-    // calculation never throws on user content.
-    if (
-      definitions.some((definition) =>
-        managedHookEntries(definition).some((hook) => isManagedCommand(hookEntryCommand(hook)))
-      )
-    ) {
-      present.add(event)
-    }
-  }
-  return present
+  return readManagedHookEventsFromJson(parsed, MUSE_HOOK_EVENTS, isManagedCommand)
 }
 
 export function getMuseManagedCommandMatcher(): (command: string | undefined) => boolean {
   return createManagedCommandMatcher(getMuseManagedScriptFileName())
 }
-
-function managedHookEntries(definition: unknown): readonly unknown[] {
-  if (!isPlainObject(definition)) {
-    return []
-  }
-  const hooks = definition.hooks
-  return Array.isArray(hooks) ? hooks : []
-}
-
-function hookEntryCommand(hook: unknown): string | undefined {
-  if (!isPlainObject(hook)) {
-    return undefined
-  }
-  const command = hook.command
-  return typeof command === 'string' ? command : undefined
-}
diff --git a/src/main/native-chat/agent-session-journal/journal-crash-boundary.test.ts b/src/main/native-chat/agent-session-journal/journal-crash-boundary.test.ts
index d142672f8e5c..6cc267a90547 100644
--- a/src/main/native-chat/agent-session-journal/journal-crash-boundary.test.ts
+++ b/src/main/native-chat/agent-session-journal/journal-crash-boundary.test.ts
@@ -16,7 +16,8 @@ import type {
   AgentSessionJournalIdentity
 } from '../../../shared/agent-session-journal-types'
 import { hasUnansweredStructuredAgentSessionDispatch } from '../../../shared/structured-agent-session-projection'
-import { dispatchWriteFailureReason } from '../../../shared/structured-agent-session-dispatch-rejection'
+import { agentSessionFailureFact } from '../../../shared/agent-session-failure'
+import { agentSessionFailureWords } from '../../../shared/agent-session-failure-words'
 import { digestPayload } from './journal-payload-bounds'
 import {
   reconcileSubmissions,
@@ -180,7 +181,7 @@ describe('crash between provider accept and journal commit', () => {
     await journal.resolveDispatch({
       clientMessageId: 'cm_write_failed',
       state: 'rejected',
-      reason: dispatchWriteFailureReason(new Error('broken pipe')),
+      ...agentSessionFailureWords(agentSessionFailureFact('writeFailed'), { surface: 'rejection' }),
       fence: 1
     })
 
@@ -191,7 +192,7 @@ describe('crash between provider accept and journal commit', () => {
     // so recovery must not reopen it as doubt.
     expect(restarted.submissions()[0]).toMatchObject({
       dispatchState: 'rejected',
-      reason: 'provider_write_failed: broken pipe'
+      reason: 'provider_write_failed'
     })
     expect(restarted.submissions()[0]?.recovered).toBeUndefined()
     expect(hasUnansweredStructuredAgentSessionDispatch(restarted.submissions())).toBe(false)
@@ -250,7 +251,9 @@ describe('crash between provider accept and journal commit', () => {
     await restarted.resolveDispatch({
       clientMessageId: 'cm_1',
       state: 'rejected',
-      reason: 'not_delivered',
+      ...agentSessionFailureWords(agentSessionFailureFact('notDelivered'), {
+        surface: 'rejection'
+      }),
       fence: 2,
       recovered: true
     })
diff --git a/src/main/native-chat/agent-session-journal/journal-dispatch-reason-bound.test.ts b/src/main/native-chat/agent-session-journal/journal-dispatch-reason-bound.test.ts
index 70052865242d..668232e607d9 100644
--- a/src/main/native-chat/agent-session-journal/journal-dispatch-reason-bound.test.ts
+++ b/src/main/native-chat/agent-session-journal/journal-dispatch-reason-bound.test.ts
@@ -4,9 +4,9 @@ import { join } from 'node:path'
 import { afterEach, beforeEach, describe, expect, it } from 'vitest'
 import type { AgentSessionJournalIdentity } from '../../../shared/agent-session-journal-types'
 import {
+  classifyDispatchRejection,
   DISPATCH_REJECTED_WRITE_FAILED,
-  dispatchRejectionReasonIsInternal,
-  dispatchRejectionWasTransportWriteFailure
+  isWriteFailureSubmission
 } from '../../../shared/structured-agent-session-dispatch-rejection'
 import { DEFAULT_JOURNAL_PAYLOAD_LIMITS } from './journal-payload-bounds'
 import type { openAgentSessionJournal } from './journal-store-factory'
@@ -45,7 +45,14 @@ async function settle(reason: string): Promise<string | null> {
     body: { kind: 'message', role: 'user', blocks: [{ type: 'text', text: 'hi' }] },
     fence: 1
   })
-  await journal.resolveDispatch({ clientMessageId: 'msg-1', state: 'rejected', reason, fence: 1 })
+  await journal.resolveDispatch({
+    clientMessageId: 'msg-1',
+    // A rejection's reason comes only from `agentSessionFailureWords`; an unknown's is still free
+    // text (an adapter's error), so it is what reaches the bound.
+    state: 'unknown',
+    reason,
+    fence: 1
+  })
   return journal.snapshot().submissions[0]?.reason ?? null
 }
 
@@ -81,7 +88,8 @@ describe('dispatch reason bounding', () => {
   it('keeps a clipped transport failure classifiable', async () => {
     const stored = await settle(`${DISPATCH_REJECTED_WRITE_FAILED}: ${HUGE}`)
     expect(stored).not.toBe(`${DISPATCH_REJECTED_WRITE_FAILED}: ${HUGE}`)
-    expect(dispatchRejectionWasTransportWriteFailure(stored)).toBe(true)
-    expect(dispatchRejectionReasonIsInternal(stored)).toBe(true)
+    // Read as an older host wrote it: by the reason alone.
+    expect(isWriteFailureSubmission({ reason: stored })).toBe(true)
+    expect(classifyDispatchRejection({ reason: stored })).toMatchObject({ kind: 'writeFailed' })
   })
 })
diff --git a/src/main/native-chat/agent-session-journal/journal-dispatch-reducer.ts b/src/main/native-chat/agent-session-journal/journal-dispatch-reducer.ts
new file mode 100644
index 000000000000..470ed3dfcb24
--- /dev/null
+++ b/src/main/native-chat/agent-session-journal/journal-dispatch-reducer.ts
@@ -0,0 +1,68 @@
+// How a `dispatch` row settles its submission. Field by field, so a key the row gains must be
+// copied here to reach any reader.
+
+import {
+  readAgentSessionFailureFact,
+  type UnreadAgentSessionFailureFact
+} from '../../../shared/agent-session-failure'
+import { agentJournalSubmissionKey } from '../../../shared/agent-session-journal-item-key'
+import type { JournalReducerState } from './journal-reducer'
+import type { JournalRow } from './journal-row-schema'
+
+export function applyJournalDispatchRow(
+  state: JournalReducerState,
+  row: Extract<JournalRow, { kind: 'dispatch' }>
+): void {
+  const submission = state.submissions.get(row.clientMessageId)
+  if (!submission) {
+    return
+  }
+  // `rejected` is terminal; a late `unknown` must not reopen a settled answer.
+  if (submission.dispatchState === 'rejected' || submission.dispatchState === 'accepted') {
+    return
+  }
+  submission.fence = row.fence
+  submission.dispatchState = row.state
+  submission.providerItemId = row.providerItemId
+  submission.reason = row.reason
+  // Read where it can be placed; a kind it cannot place is kept as written, so the classifier
+  // still knows a fact was there without this build claiming what it says.
+  const rejection =
+    row.state === 'rejected'
+      ? (readAgentSessionFailureFact(row.rejection) ?? unreadFailureFact(row.rejection))
+      : undefined
+  if (rejection) {
+    submission.rejection = rejection
+  } else {
+    delete submission.rejection
+  }
+  submission.resolvedAt = row.state === 'pending' ? null : row.ts
+  if (row.state === 'pending') {
+    submission.handedOverAt = row.ts
+  }
+  if (row.recovered) {
+    submission.recovered = row.recovered
+  } else {
+    delete submission.recovered
+  }
+  if (row.state !== 'accepted' || !row.providerItemId) {
+    return
+  }
+  state.aliases.set(row.providerItemId, agentJournalSubmissionKey(row.clientMessageId))
+  state.receipts.set(row.clientMessageId, {
+    clientMessageId: row.clientMessageId,
+    providerItemId: row.providerItemId,
+    cursor: { epoch: row.epoch, sequence: row.seq },
+    acceptedAt: row.ts
+  })
+}
+
+function unreadFailureFact(value: unknown): UnreadAgentSessionFailureFact | undefined {
+  return typeof value === 'object' &&
+    value !== null &&
+    'kind' in value &&
+    typeof value.kind === 'string' &&
+    value.kind
+    ? { kind: value.kind }
+    : undefined
+}
diff --git a/src/main/native-chat/agent-session-journal/journal-open-failure.test.ts b/src/main/native-chat/agent-session-journal/journal-open-failure.test.ts
new file mode 100644
index 000000000000..d2e1bf3b3501
--- /dev/null
+++ b/src/main/native-chat/agent-session-journal/journal-open-failure.test.ts
@@ -0,0 +1,106 @@
+import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+import { openJournalDatabase } from './journal-database'
+import { classifyJournalOpenFailure } from './journal-open-failure'
+import { loadJournal } from './journal-open'
+import { journalDatabaseFile } from './journal-paths'
+
+let root: string
+
+beforeEach(async () => {
+  root = await mkdtemp(join(tmpdir(), 'orca-journal-open-failure-'))
+})
+
+afterEach(async () => {
+  await rm(root, { recursive: true, force: true })
+})
+
+/** What the journal's own open throws for the file as it stands. */
+function openFailure(): unknown {
+  try {
+    loadJournal(root, 'session-1')
+  } catch (error) {
+    return error
+  }
+  throw new Error('the journal opened')
+}
+
+/** A thrown value shaped as node:sqlite shapes one, with the result code it reports. */
+function nodeSqliteError(errcode: number): Error {
+  return Object.assign(new Error('sqlite'), { code: 'ERR_SQLITE_ERROR', errcode })
+}
+
+function systemError(code: string, errno: number): Error {
+  return Object.assign(new Error(`${code}: open`), { code, errno })
+}
+
+describe('classifyJournalOpenFailure', () => {
+  it('calls a journal that is not a database corrupt', async () => {
+    await writeFile(journalDatabaseFile(root), 'not a database '.repeat(64))
+    const error = openFailure()
+    expect(error).toMatchObject({ errcode: 26 })
+    expect(classifyJournalOpenFailure(error)).toBe('journalCorrupt')
+  })
+
+  it('calls a journal whose pages are damaged corrupt', async () => {
+    const path = journalDatabaseFile(root)
+    const opened = openJournalDatabase(path)
+    opened.db.exec('PRAGMA journal_mode = DELETE')
+    opened.db.close()
+    const bytes = await readFile(path)
+    // Page 1 holds the header and schema; every table's root page follows it.
+    bytes.fill(0xab, 4096)
+    await writeFile(path, bytes)
+    const error = openFailure()
+    expect(error).toMatchObject({ errcode: 11 })
+    expect(classifyJournalOpenFailure(error)).toBe('journalCorrupt')
+  })
+
+  it.each([
+    ['SQLITE_CORRUPT_VTAB', 267],
+    ['SQLITE_CORRUPT_SEQUENCE', 523],
+    ['SQLITE_CORRUPT_INDEX', 779]
+  ])('reads an extended corrupt code as corrupt: %s', (_name, errcode) => {
+    expect(classifyJournalOpenFailure(nodeSqliteError(errcode))).toBe('journalCorrupt')
+  })
+
+  it("reads the Bun driver's corrupt code as corrupt", () => {
+    const error = Object.assign(new Error('file is not a database'), {
+      name: 'SQLiteError',
+      code: 'SQLITE_NOTADB',
+      errno: 26
+    })
+    expect(classifyJournalOpenFailure(error)).toBe('journalCorrupt')
+  })
+
+  it('finds corruption a wrapper names as its cause', () => {
+    const wrapped = new Error('opening the conversation failed', {
+      cause: new Error('the journal would not open', { cause: nodeSqliteError(11) })
+    })
+    expect(classifyJournalOpenFailure(wrapped)).toBe('journalCorrupt')
+  })
+
+  it.each([
+    ['a busy database', nodeSqliteError(5)],
+    ['a locked database', nodeSqliteError(6)],
+    ['a database SQLite cannot open', nodeSqliteError(14)],
+    ['a disk I/O error', nodeSqliteError(10)],
+    ['permission denied', systemError('EACCES', -13)],
+    ['too many open files', systemError('EMFILE', -24)],
+    ['a Windows error whose low byte reads as corrupt', systemError('EUNKNOWN', -4085)],
+    ['an error that only claims a corrupt code', Object.assign(new Error('x'), { errcode: 11 })],
+    ['a thrown string', 'database disk image is malformed'],
+    ['nothing at all', undefined]
+  ])('calls any other failure one that can clear: %s', (_label, error) => {
+    expect(classifyJournalOpenFailure(error)).toBe('journalUnavailable')
+  })
+
+  it('stops on a cause chain that loops back on itself', () => {
+    const first = new Error('first')
+    const second = new Error('second', { cause: first })
+    Object.assign(first, { cause: second })
+    expect(classifyJournalOpenFailure(first)).toBe('journalUnavailable')
+  })
+})
diff --git a/src/main/native-chat/agent-session-journal/journal-open-failure.ts b/src/main/native-chat/agent-session-journal/journal-open-failure.ts
new file mode 100644
index 000000000000..1835f691cb72
--- /dev/null
+++ b/src/main/native-chat/agent-session-journal/journal-open-failure.ts
@@ -0,0 +1,22 @@
+// What a failed journal open means for the chat: its history is damaged, which no retry reads
+// past, or the open failed in a way that can clear (a lock, permissions, too many open files).
+
+import type { AgentSessionRefusalReason } from '../../../shared/agent-session-refusal-details'
+import { isSqliteCorruption } from '../../sqlite/sqlite-read-failure'
+
+export type JournalOpenFailure = AgentSessionRefusalReason<'agent_session_journal_unreadable'>
+
+// Bounds a cause chain that loops back on itself.
+const MAX_CAUSE_DEPTH = 8
+
+/** Damage only where the storage says so; anything unproven can clear. */
+export function classifyJournalOpenFailure(error: unknown): JournalOpenFailure {
+  let current = error
+  for (let depth = 0; depth < MAX_CAUSE_DEPTH && current !== undefined; depth += 1) {
+    if (isSqliteCorruption(current)) {
+      return 'journalCorrupt'
+    }
+    current = current instanceof Error ? current.cause : undefined
+  }
+  return 'journalUnavailable'
+}
diff --git a/src/main/native-chat/agent-session-journal/journal-pending-submission-recovery.ts b/src/main/native-chat/agent-session-journal/journal-pending-submission-recovery.ts
index c4138ba22418..c252a57d8a57 100644
--- a/src/main/native-chat/agent-session-journal/journal-pending-submission-recovery.ts
+++ b/src/main/native-chat/agent-session-journal/journal-pending-submission-recovery.ts
@@ -1,8 +1,12 @@
+import type { AgentJournalDispatchRejection } from '../../../shared/agent-session-failure-words'
+import type { AgentJournalSubmission } from '../../../shared/agent-session-journal-types'
+import { isQueuedAgentJournalSubmission } from '../../../shared/agent-session-queued-submission'
 import { DISPATCH_DOUBT_HOST_RESTARTED } from './journal-dispatch-doubt-reasons'
 import type { AgentSessionJournal } from './journal-store'
 
 /** Settles every submission a process fact left unanswerable. Doubt is never
- *  proof of non-delivery, so nothing here ever becomes re-deliverable. */
+ *  proof of non-delivery, so nothing here ever becomes re-deliverable. A queued
+ *  submission was never handed over, so it is not in doubt and is left alone. */
 export async function markJournalPendingSubmissionsUnknown(
   journal: AgentSessionJournal,
   fence: number,
@@ -12,8 +16,9 @@ export async function markJournalPendingSubmissionsUnknown(
     .submissions()
     .filter(
       (entry) =>
-        entry.dispatchState === 'pending' ||
-        (entry.dispatchState === 'unknown' && entry.recovered !== true)
+        !isQueuedAgentJournalSubmission(entry) &&
+        (entry.dispatchState === 'pending' ||
+          (entry.dispatchState === 'unknown' && entry.recovered !== true))
     )
   for (const entry of unresolved) {
     // An earlier reason already names a sharper fact than "the host restarted".
@@ -31,27 +36,51 @@ export async function markJournalPendingSubmissionsUnknown(
 }
 
 /** Settles every submission a child that never proved its start left unanswered as `rejected`:
- *  such a child accepted nothing, so each is provably unwritten and safe to send again. */
+ *  such a child accepted nothing, so each is provably unwritten and safe to send again. A queued
+ *  submission was never handed to that child; the delivery loop settles it. */
 export async function rejectJournalPendingSubmissions(
   journal: AgentSessionJournal,
   fence: number,
-  reason: string
+  rejection: AgentJournalDispatchRejection
 ): Promise<string[]> {
   const unwritten = journal
     .submissions()
     .filter(
       (entry) =>
-        entry.dispatchState === 'pending' ||
-        (entry.dispatchState === 'unknown' && entry.recovered !== true)
+        !isQueuedAgentJournalSubmission(entry) &&
+        (entry.dispatchState === 'pending' ||
+          (entry.dispatchState === 'unknown' && entry.recovered !== true))
     )
   for (const entry of unwritten) {
     await journal.resolveDispatch({
       clientMessageId: entry.clientMessageId,
       state: 'rejected',
-      reason,
+      ...rejection,
       fence,
       recovered: true
     })
   }
   return unwritten.map((entry) => entry.clientMessageId)
 }
+
+/** Rejects queued submissions — accepted, never handed over, so provably unwritten. */
+export async function rejectJournalQueuedSubmissions(
+  journal: AgentSessionJournal,
+  fence: number,
+  rejection: AgentJournalDispatchRejection,
+  which: (submission: AgentJournalSubmission) => boolean = () => true
+): Promise<string[]> {
+  const queued = journal
+    .submissions()
+    .filter((entry) => isQueuedAgentJournalSubmission(entry) && which(entry))
+  for (const entry of queued) {
+    await journal.resolveDispatch({
+      clientMessageId: entry.clientMessageId,
+      state: 'rejected',
+      ...rejection,
+      fence,
+      recovered: true
+    })
+  }
+  return queued.map((entry) => entry.clientMessageId)
+}
diff --git a/src/main/native-chat/agent-session-journal/journal-reducer-rejection-fact.test.ts b/src/main/native-chat/agent-session-journal/journal-reducer-rejection-fact.test.ts
new file mode 100644
index 000000000000..3332e53b0b3e
--- /dev/null
+++ b/src/main/native-chat/agent-session-journal/journal-reducer-rejection-fact.test.ts
@@ -0,0 +1,100 @@
+// A dispatch row's typed rejection fact, as the reducer folds it onto the submission.
+
+import { describe, expect, it } from 'vitest'
+import {
+  classifyDispatchRejection,
+  DISPATCH_REJECTED_QUEUE_FULL
+} from '../../../shared/structured-agent-session-dispatch-rejection'
+import {
+  applyJournalRow,
+  createJournalReducerState,
+  type JournalReducerState
+} from './journal-reducer'
+import type { JournalRow } from './journal-row-schema'
+
+const EPOCH = 'epoch-1'
+
+function base(seq: number): { v: number; epoch: string; seq: number; fence: number; ts: number } {
+  return { v: 1, epoch: EPOCH, seq, fence: 1, ts: 1_000 + seq }
+}
+
+function fold(rows: JournalRow[]): JournalReducerState {
+  const state = createJournalReducerState('session-1', EPOCH)
+  for (const row of rows) {
+    applyJournalRow(state, row)
+  }
+  return state
+}
+
+describe('a rejected dispatch', () => {
+  const submission: JournalRow = {
+    kind: 'submission',
+    clientMessageId: 'cm_1',
+    payloadFingerprint: 'fp_1',
+    providerHandle: { kind: 'codex', threadId: 'thread-1' },
+    body: { kind: 'message', role: 'user', blocks: [{ type: 'text', text: 'hi' }] },
+    ...base(1)
+  }
+
+  it("copies a rejection's typed fact onto the submission, and only on `rejected`", () => {
+    const rejection = { kind: 'providerRejected', detail: { text: 'Too long', audience: 'person' } }
+    const state = fold([
+      submission,
+      {
+        kind: 'dispatch',
+        clientMessageId: 'cm_1',
+        state: 'rejected',
+        providerItemId: null,
+        reason: 'The provider did not accept this message.',
+        rejection: { kind: 'providerRejected', detail: { text: 'Too long', audience: 'person' } },
+        ...base(2)
+      }
+    ])
+    expect(state.submissions.get('cm_1')).toMatchObject({
+      dispatchState: 'rejected',
+      reason: 'The provider did not accept this message.',
+      rejection
+    })
+
+    const doubt = fold([
+      { ...submission, clientMessageId: 'cm_2' },
+      {
+        kind: 'dispatch',
+        clientMessageId: 'cm_2',
+        state: 'unknown',
+        providerItemId: null,
+        reason: 'provider_exited_before_acknowledgement',
+        rejection: { kind: 'writeFailed' },
+        ...base(2)
+      }
+    ])
+    expect(doubt.submissions.get('cm_2')).not.toHaveProperty('rejection')
+  })
+
+  it('keeps only the kind of a rejection fact it cannot place, so it reads as no verdict', () => {
+    const rejected = (rejection: unknown): JournalRow => {
+      const row: JournalRow = {
+        kind: 'dispatch',
+        clientMessageId: 'cm_1',
+        state: 'rejected',
+        providerItemId: null,
+        reason: DISPATCH_REJECTED_QUEUE_FULL,
+        ...base(2)
+      }
+      // A row read from disk carries whatever the host that wrote it did.
+      return Object.assign(row, { rejection })
+    }
+    // A newer host's kind: the marker beside it must not decide.
+    const newer = fold([submission, rejected({ kind: 'futureKind', detail: 'x' })])
+    const settled = newer.submissions.get('cm_1')
+    expect(settled).toMatchObject({ dispatchState: 'rejected', rejection: { kind: 'futureKind' } })
+    expect(settled && classifyDispatchRejection(settled)).toEqual({
+      category: 'undelivered',
+      verdict: null
+    })
+    // Not a fact at all: dropped, leaving the reason.
+    const malformed = fold([submission, rejected('queueFull')]).submissions.get('cm_1')
+    expect(malformed).not.toHaveProperty('rejection')
+    expect(malformed && classifyDispatchRejection(malformed)).toMatchObject({ kind: 'queueFull' })
+  })
+})
diff --git a/src/main/native-chat/agent-session-journal/journal-reducer.test.ts b/src/main/native-chat/agent-session-journal/journal-reducer.test.ts
index 825c5aaf3473..eea740e754d8 100644
--- a/src/main/native-chat/agent-session-journal/journal-reducer.test.ts
+++ b/src/main/native-chat/agent-session-journal/journal-reducer.test.ts
@@ -118,6 +118,39 @@ describe('ordering', () => {
     expect(renderJournalState(state).items.map((item) => item.itemId)).toEqual(['earlier', 'later'])
   })
 
+  it("places a batch's writes by their order in it, and keeps that place on revision", () => {
+    // One Codex ask writes all its questions in one batch; their ids are not their order.
+    const state = fold([
+      {
+        kind: 'lifecycle-batch',
+        settlementId: 'ask',
+        mutations: [
+          { kind: 'item', itemId: 'scope', revision: 1, body: text('first') },
+          { kind: 'item', itemId: 'priority', revision: 1, body: text('second') },
+          { kind: 'item', itemId: 'deadline', revision: 1, body: text('third') }
+        ],
+        ...base(1)
+      },
+      {
+        kind: 'lifecycle-batch',
+        settlementId: 'answer',
+        mutations: [{ kind: 'item', itemId: 'deadline', revision: 2, body: text('answered') }],
+        ...base(2)
+      }
+    ])
+    expect(
+      renderJournalState(state).items.map(({ itemId, sequence, sequenceIndex }) => ({
+        itemId,
+        sequence,
+        sequenceIndex
+      }))
+    ).toEqual([
+      { itemId: 'scope', sequence: 1, sequenceIndex: undefined },
+      { itemId: 'priority', sequence: 1, sequenceIndex: 1 },
+      { itemId: 'deadline', sequence: 1, sequenceIndex: 2 }
+    ])
+  })
+
   it('orders by sequence even when the observed timestamp runs backwards', () => {
     const state = fold([
       { kind: 'item', itemId: 'late', revision: 1, body: text('late'), ...base(1), ts: 9_000 },
diff --git a/src/main/native-chat/agent-session-journal/journal-reducer.ts b/src/main/native-chat/agent-session-journal/journal-reducer.ts
index 273502c8cf2b..7ce1f4ef1c1d 100644
--- a/src/main/native-chat/agent-session-journal/journal-reducer.ts
+++ b/src/main/native-chat/agent-session-journal/journal-reducer.ts
@@ -4,9 +4,10 @@
 //
 // Rules: highest revision wins, a tombstone removes, a late lower revision is
 // dropped rather than resurrecting stale content, and ordering is by the
-// sequence of the row that CREATED an item (a later revision updates the body,
-// it does not move the bubble). Producer linkage is likewise the creating
-// write's: a revision naming no producer keeps it, one naming any replaces it.
+// position (sequence, then place in the row) of the write that CREATED an item
+// (a later revision updates the body, it does not move the bubble). Producer
+// linkage is likewise the creating write's: a revision naming no producer keeps
+// it, one naming any replaces it.
 
 import type {
   AgentJournalAcceptanceReceipt,
@@ -15,6 +16,7 @@ import type {
   AgentJournalSubmission
 } from '../../../shared/agent-session-journal-types'
 import { journalBatchMutationProducer, journalRenderItem } from './journal-render-item'
+import { compareAgentJournalItems } from '../../../shared/agent-session-journal-position'
 import {
   agentJournalSubmissionKey,
   parseAgentJournalItemKey
@@ -26,7 +28,8 @@ import {
 import { structuredAgentSessionPayloadFingerprint } from '../../../shared/structured-agent-session-mutation'
 import { journalItemRevisionIsStale } from './journal-item-revision'
 import type { JournalRow } from './journal-row-schema'
-import { dispatchRejectionWasTransportWriteFailure } from '../../../shared/structured-agent-session-dispatch-rejection'
+import { applyJournalDispatchRow } from './journal-dispatch-reducer'
+import { isWriteFailureSubmission } from '../../../shared/structured-agent-session-dispatch-rejection'
 
 export const MAX_JOURNAL_APPLIED_SETTLEMENT_IDS = 4_096
 
@@ -90,25 +93,17 @@ export function applyJournalRow(state: JournalReducerState, row: JournalRow): vo
     if (state.appliedSettlementIds.has(row.settlementId)) {
       return
     }
-    for (const mutation of row.mutations) {
+    for (const [sequenceIndex, mutation] of row.mutations.entries()) {
       if (mutation.kind === 'item') {
         if (journalItemRevisionIsStale(state, mutation.itemId, mutation.revision)) {
           continue
         }
-        const itemId = resolveJournalItemId(state, mutation.itemId, mutation.body)
+        const { revision, body } = mutation
+        const itemId = resolveJournalItemId(state, mutation.itemId, body)
         acceptSubmissionFromProviderItem(state, mutation.itemId, itemId, row)
-        upsertItem(
-          state,
-          itemId,
-          mutation.revision,
-          journalRenderItem(
-            itemId,
-            mutation.revision,
-            mutation.body,
-            row,
-            journalBatchMutationProducer(row, mutation)
-          )
-        )
+        const producer = journalBatchMutationProducer(row, mutation)
+        const item = journalRenderItem(itemId, revision, body, row, producer, sequenceIndex)
+        upsertItem(state, itemId, revision, item)
       } else {
         removeItem(state, resolveItemId(state, mutation.itemId), mutation.revision)
       }
@@ -120,7 +115,7 @@ export function applyJournalRow(state: JournalReducerState, row: JournalRow): vo
     applySubmission(state, row)
     return
   }
-  applyDispatch(state, row)
+  applyJournalDispatchRow(state, row)
 }
 
 export function rememberAppliedSettlementId(
@@ -172,7 +167,7 @@ export function resolveJournalItemId(
     .find(
       (candidate) =>
         candidate.dispatchState !== 'rejected' &&
-        !dispatchRejectionWasTransportWriteFailure(candidate.reason) &&
+        !isWriteFailureSubmission(candidate) &&
         candidate.payloadFingerprint === fingerprint &&
         state.items.get(agentJournalSubmissionKey(candidate.clientMessageId))?.revision === 0
     )
@@ -216,14 +211,16 @@ function upsertItem(
     existing.body.kind === 'message' &&
     existing.body.role === 'user' &&
     parseAgentJournalItemKey(itemId)?.provider === 'orca'
+  const { sequenceIndex: _revisedAt, ...revised } = next
   state.items.set(itemId, {
-    ...next,
+    ...revised,
     // Settlements, prompt answers and reopen sweeps revise rows any agent wrote
     // without naming one; each would otherwise hand a subagent's row to the session.
     ...(namesAgentJournalProducer(next) ? {} : agentJournalLinkageFields(existing)),
     // Provider history may normalize text or omit local attachments from the original send.
     body: submitted ? existing.body : next.body,
     sequence: existing.sequence,
+    ...(existing.sequenceIndex !== undefined ? { sequenceIndex: existing.sequenceIndex } : {}),
     observedAt: existing.observedAt
   })
   state.tombstones.delete(itemId)
@@ -254,46 +251,13 @@ function applySubmission(
     providerItemId: null,
     reason: null,
     submittedAt: row.ts,
-    resolvedAt: null
+    resolvedAt: null,
+    ...(row.handoverRecorded ? { handoverRecorded: true, acceptedSequence: row.seq } : {})
   })
   const itemId = agentJournalSubmissionKey(row.clientMessageId)
   upsertItem(state, itemId, 0, journalRenderItem(itemId, 0, row.body, row))
 }
 
-function applyDispatch(
-  state: JournalReducerState,
-  row: Extract<JournalRow, { kind: 'dispatch' }>
-): void {
-  const submission = state.submissions.get(row.clientMessageId)
-  if (!submission) {
-    return
-  }
-  // `rejected` is terminal; a late `unknown` must not reopen a settled answer.
-  if (submission.dispatchState === 'rejected' || submission.dispatchState === 'accepted') {
-    return
-  }
-  submission.fence = row.fence
-  submission.dispatchState = row.state
-  submission.providerItemId = row.providerItemId
-  submission.reason = row.reason
-  submission.resolvedAt = row.state === 'pending' ? null : row.ts
-  if (row.recovered) {
-    submission.recovered = row.recovered
-  } else {
-    delete submission.recovered
-  }
-  if (row.state !== 'accepted' || !row.providerItemId) {
-    return
-  }
-  state.aliases.set(row.providerItemId, agentJournalSubmissionKey(row.clientMessageId))
-  state.receipts.set(row.clientMessageId, {
-    clientMessageId: row.clientMessageId,
-    providerItemId: row.providerItemId,
-    cursor: { epoch: row.epoch, sequence: row.seq },
-    acceptedAt: row.ts
-  })
-}
-
 function acceptSubmissionFromProviderItem(
   state: JournalReducerState,
   providerItemId: string,
@@ -329,9 +293,9 @@ function acceptSubmissionFromProviderItem(
 
 /** Project the folded state into the client-facing snapshot. */
 export function renderJournalState(state: JournalReducerState): AgentJournalSnapshot {
-  // Sequence is the sole ordering key; map insertion order is not, because a
-  // re-created item re-enters the map after the items that followed it.
-  const items = [...state.items.values()].sort((a, b) => a.sequence - b.sequence)
+  // The journal position is the sole ordering key; map insertion order is not,
+  // because a re-created item re-enters the map after the items that followed it.
+  const items = [...state.items.values()].sort(compareAgentJournalItems)
   return {
     sessionId: state.sessionId,
     cursor: { epoch: state.epoch, sequence: state.lastSequence },
diff --git a/src/main/native-chat/agent-session-journal/journal-render-item.ts b/src/main/native-chat/agent-session-journal/journal-render-item.ts
index 6f41ff3e8627..516086eed3d0 100644
--- a/src/main/native-chat/agent-session-journal/journal-render-item.ts
+++ b/src/main/native-chat/agent-session-journal/journal-render-item.ts
@@ -19,13 +19,16 @@ export function journalRenderItem(
   revision: number,
   body: AgentJournalItemBody,
   row: JournalRow,
-  producer: AgentJournalProducerLinkage = row
+  producer: AgentJournalProducerLinkage = row,
+  /** Which of the row's writes this is; only a lifecycle batch has more than one. */
+  sequenceIndex = 0
 ): AgentJournalRenderItem {
   return {
     itemId,
     revision,
     body,
     sequence: row.seq,
+    ...(sequenceIndex > 0 ? { sequenceIndex } : {}),
     observedAt: row.ts,
     ...(row.recovered ? { recoveredAt: row.ts } : {}),
     ...(row.recovered ? { recovered: row.recovered } : {}),
diff --git a/src/main/native-chat/agent-session-journal/journal-restart-reconciliation.test.ts b/src/main/native-chat/agent-session-journal/journal-restart-reconciliation.test.ts
index 46d161b1172b..4428e13953e1 100644
--- a/src/main/native-chat/agent-session-journal/journal-restart-reconciliation.test.ts
+++ b/src/main/native-chat/agent-session-journal/journal-restart-reconciliation.test.ts
@@ -15,6 +15,9 @@ import { digestPayload } from './journal-payload-bounds'
 import { reconcileJournalSubmissionsAgainstHistory } from './journal-restart-reconciliation'
 import type { ProviderHistoryItem, ProviderHistoryWindow } from './journal-submission-reconciler'
 import { createTrackedJournalOpener } from './journal-store-test-open'
+import { agentSessionFailureFact } from '../../../shared/agent-session-failure'
+import { agentSessionFailureWords } from '../../../shared/agent-session-failure-words'
+import { classifyDispatchRejection } from '../../../shared/structured-agent-session-dispatch-rejection'
 
 const IDENTITY: AgentSessionJournalIdentity = {
   sessionId: 'session-1',
@@ -122,7 +125,18 @@ describe('reconcileJournalSubmissionsAgainstHistory', () => {
     expect(settled).toEqual(['cm_1'])
     const submission = journal.submissions()[0]
     expect(submission?.dispatchState).toBe('rejected')
-    expect(submission?.reason).toBe('not_delivered')
+    // A sentence, since released clients print the reason as it is, and the fact beside it.
+    expect(submission?.reason).toBe(
+      agentSessionFailureWords(agentSessionFailureFact('notDelivered'), { surface: 'rejection' })
+        .reason
+    )
+    expect(submission?.rejection).toEqual({ kind: 'notDelivered' })
+    // Nobody failed: the crash stranded it before the provider took it.
+    expect(submission && classifyDispatchRejection(submission)).toEqual({
+      category: 'undelivered',
+      verdict: null,
+      kind: 'notDelivered'
+    })
   })
 
   it('leaves a submission unknown while the provider reports a turn in flight', async () => {
@@ -254,7 +268,7 @@ describe('reconcileJournalSubmissionsAgainstHistory', () => {
       'accepted',
       'rejected'
     ])
-    expect(restarted.submissions()[1]?.reason).toBe('not_delivered')
+    expect(restarted.submissions()[1]?.rejection).toEqual({ kind: 'notDelivered' })
   })
 
   it('leaves two identical unsettled sends unknown rather than guessing between them', async () => {
diff --git a/src/main/native-chat/agent-session-journal/journal-restart-reconciliation.ts b/src/main/native-chat/agent-session-journal/journal-restart-reconciliation.ts
index 626baa9820aa..7b36fc88dc63 100644
--- a/src/main/native-chat/agent-session-journal/journal-restart-reconciliation.ts
+++ b/src/main/native-chat/agent-session-journal/journal-restart-reconciliation.ts
@@ -10,6 +10,8 @@
 // through the user's Retry, which rotates the client message id; Orca still
 // never puts a message back on the wire on the user's behalf.
 
+import { agentSessionFailureFact } from '../../../shared/agent-session-failure'
+import { agentSessionFailureWords } from '../../../shared/agent-session-failure-words'
 import type {
   AgentJournalMessageItem,
   AgentJournalSubmission
@@ -18,6 +20,7 @@ import {
   agentJournalItemKey,
   agentJournalSubmissionKey
 } from '../../../shared/agent-session-journal-item-key'
+import { isQueuedAgentJournalSubmission } from '../../../shared/agent-session-queued-submission'
 import type { AgentSessionJournal } from './journal-store'
 import { reconcileSubmissions, type ProviderHistoryWindow } from './journal-submission-reconciler'
 
@@ -42,7 +45,11 @@ function comparableSubmissions(journal: AgentSessionJournal): AgentJournalSubmis
   const { items, submissions } = journal.snapshot()
   const bodies = new Map(items.map((item) => [item.itemId, item.body]))
   return submissions.filter((submission) => {
-    if (submission.dispatchState !== 'pending' && submission.dispatchState !== 'unknown') {
+    if (
+      (submission.dispatchState !== 'pending' && submission.dispatchState !== 'unknown') ||
+      // Never handed over, so provider history cannot hold it.
+      isQueuedAgentJournalSubmission(submission)
+    ) {
       return false
     }
     const body = bodies.get(agentJournalSubmissionKey(submission.clientMessageId))
@@ -111,7 +118,9 @@ export async function reconcileJournalSubmissionsAgainstHistory(input: {
         : {
             clientMessageId: outcome.clientMessageId,
             state: 'rejected',
-            reason: outcome.reason,
+            ...agentSessionFailureWords(agentSessionFailureFact('notDelivered'), {
+              surface: 'rejection'
+            }),
             fence: input.fence,
             recovered: true
           }
diff --git a/src/main/native-chat/agent-session-journal/journal-row-builders.ts b/src/main/native-chat/agent-session-journal/journal-row-builders.ts
index e17ccf0cdf87..ee56f28f8a25 100644
--- a/src/main/native-chat/agent-session-journal/journal-row-builders.ts
+++ b/src/main/native-chat/agent-session-journal/journal-row-builders.ts
@@ -1,5 +1,4 @@
 import type {
-  AgentJournalDispatchState,
   AgentJournalItemBody,
   AgentJournalItemIdentity,
   AgentJournalMessageItem,
@@ -65,6 +64,7 @@ export function journalSubmissionRowBuilder(
     payloadFingerprint: string
     body: AgentJournalMessageItem
     fence: number
+    handoverRecorded?: true
   }
 ): RowBuilder<JournalSubmissionRow> {
   return (seq, ts) =>
@@ -77,23 +77,22 @@ export function journalDispatchRowBuilder(
 ): RowBuilder<JournalDispatchRow> {
   const providerItemId =
     input.state === 'accepted' ? agentJournalItemKey(input.providerIdentity) : null
-  return (seq, ts) =>
-    buildJournalDispatchRow({
-      state: state(),
-      clientMessageId: input.clientMessageId,
-      dispatchState: input.state,
-      providerItemId,
-      reason: boundedDispatchReason(input),
-      seq,
-      fence: input.fence,
-      ts,
-      recovered: input.recovered
-    })
+  // The only dispatch-row builder: its input type is what makes a rejected row carry its fact.
+  return (seq, ts) => ({
+    kind: 'dispatch',
+    clientMessageId: input.clientMessageId,
+    state: input.state,
+    providerItemId,
+    reason: boundedDispatchReason(input),
+    ...(input.state === 'rejected' ? { rejection: input.rejection } : {}),
+    ...journalRowBase(state().epoch, seq, input.fence, ts),
+    ...(input.recovered ? { recovered: input.recovered } : {})
+  })
 }
 
 /** `reason` is the only unbounded field written by Orca's own code: a provider error is
  *  arbitrary text, and a multi-megabyte one reached the row verbatim. Bounded head-first,
- *  because `dispatchRejectionWasTransportWriteFailure` prefix-matches the value. Rows
+ *  because `isWriteFailureSubmission` prefix-matches the value. Rows
  *  written before this keep their full text, so readers still meet unbounded ones. */
 function boundedDispatchReason(input: ResolveDispatchInput): string | null {
   if (input.state === 'accepted' || input.state === 'pending' || !input.reason) {
@@ -267,6 +266,7 @@ export function buildJournalSubmissionRow(input: {
   seq: number
   fence: number
   ts: number
+  handoverRecorded?: true
 }): JournalSubmissionRow {
   return {
     kind: 'submission',
@@ -274,28 +274,7 @@ export function buildJournalSubmissionRow(input: {
     payloadFingerprint: input.payloadFingerprint,
     providerHandle: input.providerHandle,
     body: input.body,
-    ...journalRowBase(input.state.epoch, input.seq, input.fence, input.ts)
-  }
-}
-
-export function buildJournalDispatchRow(input: {
-  state: JournalReducerState
-  clientMessageId: string
-  dispatchState: AgentJournalDispatchState
-  providerItemId: string | null
-  reason: string | null
-  seq: number
-  fence: number
-  ts: number
-  recovered?: true
-}): JournalDispatchRow {
-  return {
-    kind: 'dispatch',
-    clientMessageId: input.clientMessageId,
-    state: input.dispatchState,
-    providerItemId: input.providerItemId,
-    reason: input.reason,
     ...journalRowBase(input.state.epoch, input.seq, input.fence, input.ts),
-    ...(input.recovered ? { recovered: input.recovered } : {})
+    ...(input.handoverRecorded ? { handoverRecorded: true } : {})
   }
 }
diff --git a/src/main/native-chat/agent-session-journal/journal-row-schema.ts b/src/main/native-chat/agent-session-journal/journal-row-schema.ts
index 99cb47971e95..786d422876cb 100644
--- a/src/main/native-chat/agent-session-journal/journal-row-schema.ts
+++ b/src/main/native-chat/agent-session-journal/journal-row-schema.ts
@@ -5,6 +5,7 @@
 // UNREADABLE, not skippable: the caller must degrade to read-only rather than
 // render a partial timeline or compact past a row it cannot interpret.
 
+import type { AgentSessionFailureFact } from '../../../shared/agent-session-failure'
 import {
   AGENT_SESSION_JOURNAL_SCHEMA_VERSION,
   type AgentJournalDispatchState,
@@ -77,6 +78,9 @@ export type JournalSubmissionRow = JournalRowBase & {
   payloadFingerprint: string
   providerHandle: AgentSessionProviderHandle
   body: AgentJournalMessageItem
+  /** Accepted to be handed over by a later `dispatch{pending}` row; absent on rows whose writer
+   *  dispatched in the same step. Older readers keep the key and ignore it. */
+  handoverRecorded?: true
 }
 
 export type JournalDispatchRow = JournalRowBase & {
@@ -86,6 +90,9 @@ export type JournalDispatchRow = JournalRowBase & {
   /** Provider item identity adopted on accept. */
   providerItemId: string | null
   reason: string | null
+  /** On `rejected`: why, typed. Older readers keep the key and ignore it; a malformed one is
+   *  dropped when read, never the row. */
+  rejection?: AgentSessionFailureFact
 }
 
 /** An item mutation may name its own producer, because one batch can CREATE
diff --git a/src/main/native-chat/agent-session-journal/journal-store-close.test.ts b/src/main/native-chat/agent-session-journal/journal-store-close.test.ts
index 960c65a638a3..af53cd16d3db 100644
--- a/src/main/native-chat/agent-session-journal/journal-store-close.test.ts
+++ b/src/main/native-chat/agent-session-journal/journal-store-close.test.ts
@@ -13,6 +13,8 @@ import type {
   AgentJournalItemIdentity,
   AgentSessionJournalIdentity
 } from '../../../shared/agent-session-journal-types'
+import { agentSessionFailureFact } from '../../../shared/agent-session-failure'
+import { agentSessionFailureWords } from '../../../shared/agent-session-failure-words'
 import { journalDatabaseFile } from './journal-paths'
 import type { AgentSessionJournal } from './journal-store'
 import { createTrackedJournalOpener } from './journal-store-test-open'
@@ -117,7 +119,16 @@ describe('closed-state admission happens at enqueue', () => {
           fence: 1
         })
       ),
-      settle(journal.resolveDispatch({ clientMessageId: 'cm_1', state: 'rejected', fence: 1 })),
+      settle(
+        journal.resolveDispatch({
+          clientMessageId: 'cm_1',
+          state: 'rejected',
+          ...agentSessionFailureWords(agentSessionFailureFact('hostFault'), {
+            surface: 'rejection'
+          }),
+          fence: 1
+        })
+      ),
       settle(
         journal.appendLifecycleBatch({
           settlementId: 'settle',
diff --git a/src/main/native-chat/agent-session-journal/journal-store-contracts.ts b/src/main/native-chat/agent-session-journal/journal-store-contracts.ts
index cea47e381fe4..c2210efb253b 100644
--- a/src/main/native-chat/agent-session-journal/journal-store-contracts.ts
+++ b/src/main/native-chat/agent-session-journal/journal-store-contracts.ts
@@ -1,3 +1,4 @@
+import type { AgentJournalDispatchRejection } from '../../../shared/agent-session-failure-words'
 import type {
   AgentJournalCursor,
   AgentJournalItemBody,
@@ -31,7 +32,10 @@ export type ResolveDispatchInput = {
 } & (
   | { state: 'accepted'; providerIdentity: AgentJournalItemIdentity }
   | { state: 'pending' }
-  | { state: 'rejected' | 'unknown'; reason?: string | null }
+  /** `reason` is what released clients print, `rejection` what newer ones read: both from
+   *  `agentSessionFailureWords`, never written by hand. */
+  | ({ state: 'rejected' } & AgentJournalDispatchRejection)
+  | { state: 'unknown'; reason?: string | null }
 )
 
 export type JournalAppendResult = {
@@ -59,6 +63,8 @@ export type JournalSubmissionInput = {
   payloadFingerprint: string
   body: AgentJournalMessageItem
   fence: number
+  /** The send is accepted now and handed over later, by a `dispatch{pending}` row. */
+  handoverRecorded?: true
 }
 
 export type JournalItemAppendInput = {
diff --git a/src/main/native-chat/agent-session-journal/journal-store.test.ts b/src/main/native-chat/agent-session-journal/journal-store.test.ts
index ffaea5c5d6f1..3637f03dab6c 100644
--- a/src/main/native-chat/agent-session-journal/journal-store.test.ts
+++ b/src/main/native-chat/agent-session-journal/journal-store.test.ts
@@ -424,3 +424,31 @@ async function withJournalDatabase(
     opened.db.close()
   }
 }
+
+describe('what a handle found on disk when it opened', () => {
+  const submission = (clientMessageId: string) => ({
+    clientMessageId,
+    payloadFingerprint: 'fp',
+    body: { kind: 'message' as const, role: 'user' as const, blocks: [] },
+    fence: 1,
+    handoverRecorded: true as const
+  })
+
+  it('names rows an earlier handle wrote, and never a row of a later epoch', async () => {
+    const earlier = await open()
+    await earlier.appendItem(item(1), body('one'), { fence: 1 })
+    await earlier.appendSubmission(submission('earlier'))
+    await earlier.close()
+
+    const journal = await open()
+    const leftover = journal.submissions().find((entry) => entry.clientMessageId === 'earlier')
+    expect(journal.wroteBeforeOpen(leftover?.acceptedSequence)).toBe(true)
+
+    // Sequences restart with an epoch, so a row accepted after it can sit below the open cursor.
+    await journal.replaceEpochItems('handle_forked', 1, [])
+    await journal.appendSubmission(submission('later'))
+    const later = journal.submissions().find((entry) => entry.clientMessageId === 'later')
+    expect(later?.acceptedSequence).toBeLessThanOrEqual(2)
+    expect(journal.wroteBeforeOpen(later?.acceptedSequence)).toBe(false)
+  })
+})
diff --git a/src/main/native-chat/agent-session-journal/journal-store.ts b/src/main/native-chat/agent-session-journal/journal-store.ts
index ec445cb70048..45c42b45f8ad 100644
--- a/src/main/native-chat/agent-session-journal/journal-store.ts
+++ b/src/main/native-chat/agent-session-journal/journal-store.ts
@@ -1,5 +1,6 @@
 // Append-only journal store for one agent session.
 
+import type { AgentJournalDispatchRejection } from '../../../shared/agent-session-failure-words'
 import { randomUUID } from 'node:crypto'
 import type {
   AgentJournalAcceptanceReceipt,
@@ -28,7 +29,8 @@ import { readJournalRowsAfterCursor, type JournalLoad } from './journal-open'
 import { journalDatabaseFile } from './journal-paths'
 import {
   markJournalPendingSubmissionsUnknown,
-  rejectJournalPendingSubmissions
+  rejectJournalPendingSubmissions,
+  rejectJournalQueuedSubmissions
 } from './journal-pending-submission-recovery'
 import {
   applyJournalRow,
@@ -75,7 +77,9 @@ export class AgentSessionJournal {
   private state: JournalReducerState
   private readOnly = false
   private malformedRows = 0
+  private openedThrough: AgentJournalCursor = { epoch: '', sequence: 0 }
   private database: OpenJournalDatabase | null = null
+  private onCommitted: (() => void) | null = null
   private readonly queue: JournalWriteQueue
   private readonly closer: JournalConnectionCloser
   private readonly rowWriter: JournalRowWriter
@@ -111,8 +115,14 @@ export class AgentSessionJournal {
         this.readOnly = readOnly
       },
       cursor: this.cursor,
-      adopt: (loaded) => this.adoptLoadedJournal(loaded),
-      commit: (row) => applyJournalRow(this.state, row),
+      adopt: (loaded) => {
+        this.adoptLoadedJournal(loaded)
+        this.onCommitted?.()
+      },
+      commit: (row) => {
+        applyJournalRow(this.state, row)
+        this.onCommitted?.()
+      },
       loaded: () => this.loaded,
       malformedRows: () => this.malformedRows,
       setMalformedRows: (count) => {
@@ -140,6 +150,16 @@ export class AgentSessionJournal {
     return this.journalDir
   }
 
+  /** Whether a row at this sequence was on disk when this handle opened, so an earlier handle
+   *  wrote it. Sequences restart with each epoch, so a row of a later epoch never was. */
+  wroteBeforeOpen(sequence: number | undefined): boolean {
+    return (
+      sequence !== undefined &&
+      this.state.epoch === this.openedThrough.epoch &&
+      sequence <= this.openedThrough.sequence
+    )
+  }
+
   /** What the last open's repair did. */
   get repair(): { malformedRows: number } {
     return { malformedRows: this.malformedRows }
@@ -150,6 +170,7 @@ export class AgentSessionJournal {
     this.database = openJournalDatabase(this.dbPath)
     try {
       await this.restore()
+      this.openedThrough = this.cursor()
     } catch (error) {
       // Nothing else holds a reference to this connection, so a throw here is
       // the leak site unless the store releases it itself — and a close that
@@ -167,6 +188,12 @@ export class AgentSessionJournal {
     return this.closer.close()
   }
 
+  /** Told of every durable change, epoch replacements included, so a reader learns of a write
+   *  without its writer saying so. One listener: a later call replaces it. It must not throw. */
+  observeCommits(listener: () => void): void {
+    this.onCommitted = listener
+  }
+
   cursor = (): AgentJournalCursor => ({
     epoch: this.state.epoch,
     sequence: this.state.lastSequence
@@ -293,8 +320,20 @@ export class AgentSessionJournal {
   }
 
   /** Reject unanswered sends after an owner that never proved its start ended: none was written. */
-  async rejectPendingSubmissions(fence: number, reason: string): Promise<string[]> {
-    return rejectJournalPendingSubmissions(this, fence, reason)
+  async rejectPendingSubmissions(
+    fence: number,
+    rejection: AgentJournalDispatchRejection
+  ): Promise<string[]> {
+    return rejectJournalPendingSubmissions(this, fence, rejection)
+  }
+
+  /** Reject sends accepted but never handed over, optionally only those `which` names. */
+  async rejectQueuedSubmissions(
+    fence: number,
+    rejection: AgentJournalDispatchRejection,
+    which?: (submission: AgentJournalSubmission) => boolean
+  ): Promise<string[]> {
+    return rejectJournalQueuedSubmissions(this, fence, rejection, which)
   }
 
   /** The escape hatch for corruption, an unreconcilable prefix, a forked handle,
diff --git a/src/main/native-chat/agent-session-journal/journal-submission-reconciler.ts b/src/main/native-chat/agent-session-journal/journal-submission-reconciler.ts
index 16999de0363e..4647ba1e0e37 100644
--- a/src/main/native-chat/agent-session-journal/journal-submission-reconciler.ts
+++ b/src/main/native-chat/agent-session-journal/journal-submission-reconciler.ts
@@ -18,6 +18,7 @@ import type {
   AgentJournalSubmission
 } from '../../../shared/agent-session-journal-types'
 import { agentJournalItemKey } from '../../../shared/agent-session-journal-item-key'
+import { DISPATCH_REJECTED_NOT_DELIVERED } from '../../../shared/structured-agent-session-dispatch-rejection'
 
 export type ProviderHistoryItem = {
   /** The provider's own id for this item. Used to claim it at most once; the
@@ -55,7 +56,7 @@ export type SubmissionReconciliation =
   | { clientMessageId: string; outcome: 'rejected'; reason: SubmissionRejectionReason }
   | { clientMessageId: string; outcome: 'unknown'; reason: SubmissionUnknownReason }
 
-export type SubmissionRejectionReason = 'not_delivered'
+export type SubmissionRejectionReason = typeof DISPATCH_REJECTED_NOT_DELIVERED
 
 export type SubmissionUnknownReason =
   | 'history_boundary_inconsistent'
@@ -197,6 +198,6 @@ function resolveOne(
   return {
     clientMessageId: submission.clientMessageId,
     outcome: 'rejected',
-    reason: 'not_delivered'
+    reason: DISPATCH_REJECTED_NOT_DELIVERED
   }
 }
diff --git a/src/main/native-chat/agent-session-wire/agent-session-empty-delta-retention.test.ts b/src/main/native-chat/agent-session-wire/agent-session-empty-delta-retention.test.ts
index 3907fa7a6458..5a859fb2e81f 100644
--- a/src/main/native-chat/agent-session-wire/agent-session-empty-delta-retention.test.ts
+++ b/src/main/native-chat/agent-session-wire/agent-session-empty-delta-retention.test.ts
@@ -24,15 +24,16 @@ describe('empty streamed deltas', () => {
       }
       const originalJoin = Array.prototype.join
       let retainedSlots = -1
-      const spy = vi
-        .spyOn(Array.prototype, 'join')
-        .mockImplementation(function (this: unknown[], separator) {
-          // Byte counters cannot detect empty entries retained by the stream's chunk array.
-          if (separator === '' && this[0] === prefix) {
-            retainedSlots = this.length
-          }
-          return originalJoin.call(this, separator)
-        })
+      const spy = vi.spyOn(Array.prototype, 'join').mockImplementation(function (
+        this: unknown[],
+        separator
+      ) {
+        // Byte counters cannot detect empty entries retained by the stream's chunk array.
+        if (separator === '' && this[0] === prefix) {
+          retainedSlots = this.length
+        }
+        return originalJoin.call(this, separator)
+      })
       let snapshot: ReturnType<typeof streams.snapshot>
       try {
         snapshot = streams.snapshot('thread', 'item')
diff --git a/src/main/native-chat/agent-session-wire/agent-session-journal-batch.ts b/src/main/native-chat/agent-session-wire/agent-session-journal-batch.ts
index 57f2291e4762..b70a18a83861 100644
--- a/src/main/native-chat/agent-session-wire/agent-session-journal-batch.ts
+++ b/src/main/native-chat/agent-session-wire/agent-session-journal-batch.ts
@@ -6,6 +6,7 @@
 // key instead of appearing as a second copy of the user's own message.
 
 import { agentJournalSubmissionKey } from '../../../shared/agent-session-journal-item-key'
+import { compareAgentJournalItems } from '../../../shared/agent-session-journal-position'
 import type {
   AgentJournalRenderItem,
   AgentJournalSnapshot,
@@ -65,7 +66,7 @@ export function projectJournalBatch(input: {
   const items = [...touchedItemIds]
     .map((itemId) => live.get(itemId))
     .filter((item) => item !== undefined)
-    .sort((a, b) => a.sequence - b.sequence)
+    .sort(compareAgentJournalItems)
   return {
     ok: true,
     batch: {
diff --git a/src/main/native-chat/agent-session-wire/agent-session-journal-recovery.test.ts b/src/main/native-chat/agent-session-wire/agent-session-journal-recovery.test.ts
index 214c889b5c9d..1c60029c7d32 100644
--- a/src/main/native-chat/agent-session-wire/agent-session-journal-recovery.test.ts
+++ b/src/main/native-chat/agent-session-wire/agent-session-journal-recovery.test.ts
@@ -6,14 +6,14 @@
 import { mkdtemp, rm, writeFile } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
-import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import type {
   AgentJournalItemIdentity,
   AgentSessionJournalIdentity
 } from '../../../shared/agent-session-journal-types'
 import { openJournalDatabase } from '../agent-session-journal/journal-database'
 import { JOURNAL_DB_SCHEMA_VERSION } from '../agent-session-journal/journal-database-schema'
-import { loadJournal } from '../agent-session-journal/journal-open'
+import { loadJournal, replayJournal } from '../agent-session-journal/journal-open'
 import { journalDatabaseFile } from '../agent-session-journal/journal-paths'
 import { readJournalEpochRows } from '../agent-session-journal/journal-row-table'
 import { createTrackedJournalOpener } from '../agent-session-journal/journal-store-test-open'
@@ -24,6 +24,12 @@ import {
   recoveryJournalDir
 } from './agent-session-journal-recovery'
 
+// Only the store's own replay goes through the mock; the probe's, inside the same module, does not.
+vi.mock('../agent-session-journal/journal-open', async (importOriginal) => {
+  const actual = await importOriginal<{ replayJournal: typeof replayJournal }>()
+  return { ...actual, replayJournal: vi.fn(actual.replayJournal) }
+})
+
 const CODEX_SESSION = '019fd532-7c11-7a90-b6de-4e1a2c3d5f60'
 
 const IDENTITY: AgentSessionJournalIdentity = {
@@ -160,6 +166,21 @@ describe('openAgentSessionJournalWithRecovery', () => {
     expect(opened.snapshot().items).toHaveLength(2)
   })
 
+  it('reads the journal once: the probe is the open', async () => {
+    await seedJournal(2)
+    vi.mocked(replayJournal).mockClear()
+    const opened = journals.track(
+      await openAgentSessionJournalWithRecovery({
+        identity: IDENTITY,
+        journalDir,
+        fence: 1,
+        historyFilePath
+      }).then((result) => result.journal)
+    )
+    expect(opened.snapshot().items).toHaveLength(2)
+    expect(replayJournal).not.toHaveBeenCalled()
+  })
+
   it('rebuilds a holed journal in place on a fresh epoch', async () => {
     await seedJournal(3)
     await deleteRow(3)
diff --git a/src/main/native-chat/agent-session-wire/agent-session-journal-recovery.ts b/src/main/native-chat/agent-session-wire/agent-session-journal-recovery.ts
index 6e771a318092..29d324be9718 100644
--- a/src/main/native-chat/agent-session-wire/agent-session-journal-recovery.ts
+++ b/src/main/native-chat/agent-session-wire/agent-session-journal-recovery.ts
@@ -67,7 +67,9 @@ export async function openAgentSessionJournalWithRecovery(input: {
   }
   const journal = await openAgentSessionJournal({
     identity: input.identity,
-    journalDir: input.journalDir
+    journalDir: input.journalDir,
+    // The probe is this open's replay; omitted, not `null`, when there was nothing to load.
+    ...(probe ? { loaded: probe } : {})
   })
   if (!probe?.corrupt) {
     return { journal, recovery: null }
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-accept-then-deliver.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-accept-then-deliver.test.ts
new file mode 100644
index 000000000000..fb4ee607e38d
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-accept-then-deliver.test.ts
@@ -0,0 +1,862 @@
+// A send is accepted, then delivered: the host answers once the message is recorded, and the
+// session's delivery loop starts a provider child for it and hands it over. Against the real host,
+// store and journal; each assertion reads what an open chat or the journal's next reader sees.
+
+import type { AgentSessionFailureFact } from '../../../shared/agent-session-failure'
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi, type Mock } from 'vitest'
+import { computeAgentSessionPayloadFingerprint } from '../../../shared/agent-session-mutation-envelope'
+import { agentJournalSubmissionKey } from '../../../shared/agent-session-journal-item-key'
+import type { AgentJournalSubmission } from '../../../shared/agent-session-journal-types'
+import type {
+  AgentSessionSubscribeEvent,
+  AgentSessionTurnCompletionEvent
+} from '../../../shared/agent-session-wire'
+import {
+  classifyDispatchRejection,
+  DISPATCH_REJECTED_CANCELLED
+} from '../../../shared/structured-agent-session-dispatch-rejection'
+import { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
+import { journalDirectoryFor } from '../agent-session-journal/journal-paths'
+import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
+import { openAgentSessionJournal } from '../agent-session-journal/journal-store-factory'
+import {
+  AgentSessionPreSpawnError,
+  type StructuredAgentSessionAdapter
+} from './structured-agent-session-adapter'
+import { journalIdentityFor } from './structured-agent-session-attach'
+import { attachParamsForRecord } from './structured-agent-session-conversation-open'
+import { StructuredAgentSessionHost } from './structured-agent-session-host'
+import type { StructuredAgentSessionChildEndCause } from './structured-agent-session-host-types'
+import { persistRewindRecord } from './structured-rewind-recovery'
+import {
+  HOST_TEST_NOW as NOW,
+  HOST_TEST_SESSION as SESSION,
+  HOST_TEST_THREAD as THREAD,
+  hostTestAttachParams,
+  hostTestDrawnRowIds,
+  hostTestMessage,
+  hostTestOperationId,
+  resetHostTestOperationIds
+} from './structured-agent-session-host-test-data'
+import { agentSessionFailureFact } from '../../../shared/agent-session-failure'
+import { agentSessionFailureWords } from '../../../shared/agent-session-failure-words'
+
+const CALLER = { callerKey: 'client-1' }
+
+function eventually(assertion: () => void | Promise<void>): Promise<void> {
+  return vi.waitFor(assertion, { timeout: 10_000 })
+}
+
+let root: string
+let store: AgentSessionRecordStore
+let host: StructuredAgentSessionHost
+let acquire: Mock<StructuredAgentSessionAdapter['acquire']>
+let dispatch: Mock<StructuredAgentSessionAdapter['dispatch']>
+let adapterExtras: Partial<StructuredAgentSessionAdapter>
+let idleMs: number
+
+const spawnChild: StructuredAgentSessionAdapter['acquire'] = async ({ fence, spawnToken }) => ({
+  process: { hostId: 'local', pid: 4242, processStartTimeMs: 1_700_000_000_000, spawnToken },
+  acquisitionGeneration: `generation-${acquire.mock.calls.length}`,
+  link: {
+    linkId: `link-${fence}`,
+    handle: { provider: 'codex' as const, threadId: THREAD },
+    origin: store.getRecord(SESSION)?.providerHandleChain.length
+      ? ('resumed' as const)
+      : ('created' as const),
+    mintedAtFence: fence,
+    observedAt: NOW
+  }
+})
+
+async function startHost(): Promise<void> {
+  host = new StructuredAgentSessionHost({
+    store,
+    adapter: {
+      acquire,
+      dispatch,
+      closeSession: vi.fn(async () => true),
+      releaseAcquisition: vi.fn(async () => true),
+      cancelTurn: vi.fn(async () => ({ cancelled: false })),
+      answerPrompt: vi.fn(async () => undefined),
+      setOption: vi.fn(async () => undefined),
+      ...adapterExtras
+    },
+    journalRoot: root,
+    claimKeyId: 'key-1',
+    mintSpawnToken: () => `spawn-${acquire.mock.calls.length}`,
+    idleSweep: { intervalMs: 5, idleMs },
+    now: () => NOW
+  })
+}
+
+beforeEach(async () => {
+  root = await mkdtemp(join(tmpdir(), 'orca-accept-deliver-'))
+  resetHostTestOperationIds()
+  adapterExtras = {}
+  idleMs = 60 * 60_000
+  acquire = vi.fn(spawnChild)
+  dispatch = vi.fn(async () => ({
+    state: 'accepted' as const,
+    providerIdentity: {
+      provider: 'codex' as const,
+      threadId: THREAD,
+      turnId: `turn-${dispatch.mock.calls.length}`,
+      ordinal: dispatch.mock.calls.length
+    }
+  }))
+  store = await AgentSessionRecordStore.open({ directory: join(root, 'store'), hostId: 'local' })
+  await startHost()
+  expect(await host.attach(CALLER, hostTestAttachParams(null))).toMatchObject({ ok: true })
+})
+
+afterEach(async () => {
+  await host.flushAllStreamedEvents()
+  await rm(root, { recursive: true, force: true })
+})
+
+function sendParams(text: string) {
+  const body = hostTestMessage(text)
+  return {
+    envelope: {
+      sessionId: SESSION,
+      clientOperationId: hostTestOperationId(),
+      expectedRuntimeFence: 1,
+      payloadFingerprint: computeAgentSessionPayloadFingerprint({
+        method: 'agentSession.send',
+        sessionId: SESSION,
+        fields: { body }
+      })
+    },
+    body
+  }
+}
+
+/** Accepted at once, whatever the child is doing; answers the message id. */
+async function accept(text: string): Promise<string> {
+  const params = sendParams(text)
+  expect(await host.send(CALLER, params)).toMatchObject({
+    ok: true,
+    value: { submission: { dispatchState: 'pending', handoverRecorded: true } }
+  })
+  return params.envelope.clientOperationId
+}
+
+function stop() {
+  const turnId = 'turn-none'
+  return host.cancel(CALLER, {
+    envelope: {
+      sessionId: SESSION,
+      clientOperationId: hostTestOperationId(),
+      expectedRuntimeFence: null,
+      payloadFingerprint: computeAgentSessionPayloadFingerprint({
+        method: 'agentSession.cancel',
+        sessionId: SESSION,
+        fields: { turnId }
+      })
+    },
+    turnId
+  })
+}
+
+async function submission(id: string): Promise<AgentJournalSubmission | undefined> {
+  return (await host.journalSnapshot(SESSION)).submissions.find(
+    (entry) => entry.clientMessageId === id
+  )
+}
+
+/** Read back after the conversation was closed, through the same open any reader takes. */
+async function reopened(id: string): Promise<AgentJournalSubmission | undefined> {
+  await host.revealSession(SESSION)
+  return submission(id)
+}
+
+async function errorRows(): Promise<string[]> {
+  return (await host.journalSnapshot(SESSION)).items.flatMap((item) =>
+    item.body.kind === 'status' && item.body.tone === 'error' ? [item.body.text] : []
+  )
+}
+
+async function errorFailures(): Promise<(AgentSessionFailureFact | undefined)[]> {
+  return (await host.journalSnapshot(SESSION)).items.flatMap((item) =>
+    item.body.kind === 'status' && item.body.tone === 'error' ? [item.body.failure] : []
+  )
+}
+
+let subscriptions = 0
+
+async function subscribe(): Promise<AgentSessionSubscribeEvent[]> {
+  const events: AgentSessionSubscribeEvent[] = []
+  subscriptions += 1
+  // Cloned as received: a frame shares the journal's live objects, which later rows revise.
+  await host.subscribe({
+    id: `sub-${subscriptions}`,
+    sessionId: SESSION,
+    emit: (event) => events.push(structuredClone(event))
+  })
+  return events
+}
+
+/** What an open chat was told about one message, in frame order. */
+function framedStates(events: AgentSessionSubscribeEvent[], id: string): string[] {
+  return events.flatMap((event) =>
+    event.type === 'batch'
+      ? event.batch.submissions
+          .filter((entry) => entry.clientMessageId === id)
+          .map((entry) =>
+            entry.dispatchState === 'pending' && entry.handedOverAt !== undefined
+              ? 'handed-over'
+              : entry.dispatchState
+          )
+      : []
+  )
+}
+
+function deferred<T>() {
+  let resolve!: (value: T) => void
+  let reject!: (error: unknown) => void
+  const promise = new Promise<T>((next, fail) => {
+    resolve = next
+    reject = fail
+  })
+  return { promise, resolve, reject }
+}
+
+/** Rows written by an earlier host process that ended before handing them over. */
+async function writeAsEarlierProcess(
+  write: (journal: AgentSessionJournal, fence: number) => Promise<void>
+): Promise<void> {
+  await host.close(SESSION)
+  const record = store.getRecord(SESSION)!
+  const params = attachParamsForRecord(record, {
+    clientOperationId: 'earlier',
+    expectedRuntimeFence: record.lease.runtimeFence
+  })
+  const journal = await openAgentSessionJournal({
+    identity: journalIdentityFor(record, params),
+    journalDir: journalDirectoryFor(root, {
+      workspaceId: record.location.workspaceId,
+      sessionId: SESSION
+    })
+  })
+  await write(journal, record.lease.runtimeFence)
+  await journal.close()
+}
+
+function earlierSubmission(id: string, text: string, handoverRecorded?: true) {
+  const body = hostTestMessage(text)
+  return {
+    clientMessageId: id,
+    payloadFingerprint: computeAgentSessionPayloadFingerprint({
+      method: 'agentSession.send',
+      sessionId: SESSION,
+      fields: { body }
+    }),
+    body,
+    ...(handoverRecorded ? { handoverRecorded } : {})
+  }
+}
+
+describe('a send is answered at acceptance', () => {
+  it('answers before the child starts, then an open chat sees the handover and the reply (W2)', async () => {
+    await host.close(SESSION)
+    const starting = deferred<void>()
+    acquire.mockImplementationOnce(async (input) => {
+      await starting.promise
+      return spawnChild(input)
+    })
+
+    const answering = deferred<void>()
+    const answer = dispatch.getMockImplementation()!
+    dispatch.mockImplementationOnce(async (input) => {
+      await answering.promise
+      return answer(input)
+    })
+
+    const id = await accept('hello')
+    const events = await subscribe()
+    await eventually(async () => expect(acquire).toHaveBeenCalledTimes(2))
+    expect(dispatch).not.toHaveBeenCalled()
+
+    starting.resolve()
+    await eventually(async () => expect(framedStates(events, id)).toEqual(['handed-over']))
+    answering.resolve()
+    await eventually(async () =>
+      expect(framedStates(events, id)).toEqual(['handed-over', 'accepted'])
+    )
+  })
+
+  it('accepts a second send while the first one starts the child, before handing either over (W6)', async () => {
+    await host.close(SESSION)
+    const starting = deferred<void>()
+    acquire.mockImplementationOnce(async (input) => {
+      await starting.promise
+      return spawnChild(input)
+    })
+    const first = await accept('first')
+    await eventually(async () => expect(acquire).toHaveBeenCalledTimes(2))
+    const second = host.send(CALLER, sendParams('second'))
+
+    starting.resolve()
+    const secondResult = await second
+    if (!secondResult.ok) {
+      throw new Error('the second send was refused')
+    }
+    const secondId = secondResult.value.clientMessageId
+    await eventually(async () =>
+      expect((await submission(secondId))?.dispatchState).toBe('accepted')
+    )
+    expect(dispatch.mock.calls.map(([input]) => input.clientMessageId)).toEqual([first, secondId])
+    // The second was accepted while the start held the queue — before the first was handed over.
+    expect((await submission(secondId))!.submittedAt).toBeLessThanOrEqual(
+      (await submission(first))!.handedOverAt!
+    )
+    const rows = (await host.journalSnapshot(SESSION)).submissions
+    expect(rows.map((row) => row.clientMessageId)).toEqual([first, secondId])
+  })
+})
+
+describe('a start the chat needed and did not get', () => {
+  it('writes one error row and rejects every queued message with it; the next send starts (W3)', async () => {
+    await host.close(SESSION)
+    acquire.mockRejectedValueOnce(new Error('spawn codex ENOENT'))
+    const first = await accept('first')
+    const second = await accept('second')
+
+    await eventually(async () => expect((await submission(second))?.dispatchState).toBe('rejected'))
+    const rows = await errorRows()
+    expect(rows).toHaveLength(1)
+    // Orca's spawn error goes to the log; the row and every message say what failed, typed. The
+    // child is gone, but no exit was observed, so nothing blames the provider.
+    expect(rows[0]).toBe("Codex couldn't restart. Send your message to try again.")
+    const failure = {
+      kind: 'restartFailed',
+      refusal: { code: 'agent_session_operation_invalid', details: { ownerVerdict: 'exited' } }
+    }
+    expect(await errorFailures()).toEqual([failure])
+    for (const id of [first, second]) {
+      expect(await submission(id)).toMatchObject({
+        dispatchState: 'rejected',
+        reason: rows[0],
+        rejection: failure
+      })
+    }
+
+    const next = await accept('after the fix')
+    await eventually(async () => expect((await submission(next))?.dispatchState).toBe('accepted'))
+    expect(await errorRows()).toHaveLength(1)
+  })
+
+  it('draws the messages it failed above the error row, since they were accepted first', async () => {
+    await host.close(SESSION)
+    acquire.mockRejectedValueOnce(new Error('spawn codex ENOENT'))
+    const first = await accept('first')
+    const second = await accept('second')
+    await eventually(async () => expect((await submission(second))?.dispatchState).toBe('rejected'))
+
+    const snapshot = await host.journalSnapshot(SESSION)
+    const errorRow = snapshot.items.find(
+      (item) => item.body.kind === 'status' && item.body.tone === 'error'
+    )?.itemId
+    const shown = [agentJournalSubmissionKey(first), agentJournalSubmissionKey(second), errorRow]
+    const drawn = hostTestDrawnRowIds(snapshot, [
+      { clientMessageId: first, text: 'first' },
+      { clientMessageId: second, text: 'second' }
+    ])
+    expect(drawn.filter((id) => shown.includes(id))).toEqual(shown)
+  })
+
+  it('notifies failed once for the queued messages one start failure refused', async () => {
+    await host.close(SESSION)
+    acquire.mockRejectedValueOnce(new Error('spawn codex ENOENT'))
+    const completions: AgentSessionTurnCompletionEvent[] = []
+    host.subscribeTurnCompletions({ id: 'dot-1', emit: (event) => completions.push(event) })
+    await accept('first')
+    const second = await accept('second')
+
+    await eventually(async () => expect((await submission(second))?.dispatchState).toBe('rejected'))
+    await host.flushAllStreamedEvents()
+    expect(completions).toEqual([
+      {
+        type: 'completion',
+        completion: expect.objectContaining({
+          sessionId: SESSION,
+          turnId: agentJournalSubmissionKey(second),
+          outcome: 'failure'
+        })
+      }
+    ])
+  })
+
+  it.each([
+    [
+      'eligibility',
+      () => {
+        adapterExtras = { supportsLocation: () => false }
+      },
+      {
+        text: "Codex couldn't restart. Start a new chat to continue.",
+        failure: {
+          kind: 'restartFailed',
+          refusal: {
+            code: 'structured_agent_session_unsupported',
+            details: { reason: 'hostUnsupported' }
+          }
+        }
+      }
+    ],
+    [
+      'spawn',
+      () => acquire.mockRejectedValueOnce(new Error('spawn codex ENOENT')),
+      {
+        text: "Codex couldn't restart. Send your message to try again.",
+        failure: {
+          kind: 'restartFailed',
+          refusal: { code: 'agent_session_operation_invalid', details: { ownerVerdict: 'exited' } }
+        }
+      }
+    ],
+    [
+      'auth',
+      () =>
+        acquire.mockRejectedValueOnce(
+          new AgentSessionPreSpawnError(new Error('Not logged in. Please run /login.'))
+        ),
+      {
+        // No process ever started, so nothing says the provider stopped.
+        text: "Codex couldn't restart. Send your message to try again.",
+        failure: {
+          kind: 'restartFailed',
+          refusal: { code: 'agent_session_operation_invalid', details: { ownerVerdict: 'exited' } }
+        }
+      }
+    ]
+  ])('writes one row a live chat sees for a %s refusal (W14)', async (_source, arrange, row) => {
+    await host.close(SESSION)
+    arrange()
+    await host.flushAllStreamedEvents()
+    await startHost()
+    const id = await accept('hello')
+    const events = await subscribe()
+
+    await eventually(async () => expect((await submission(id))?.dispatchState).toBe('rejected'))
+    expect(await errorRows()).toEqual([row.text])
+    expect(await errorFailures()).toEqual([row.failure])
+    const framedRows = events.flatMap((event) =>
+      event.type === 'batch' || event.type === 'snapshot'
+        ? (event.type === 'batch' ? event.batch.items : event.page.items).filter(
+            (item) => item.body.kind === 'status' && item.body.tone === 'error'
+          )
+        : []
+    )
+    expect(framedRows.length).toBeGreaterThan(0)
+  })
+
+  it('names the start failure on queued messages when the attach fails after acquiring (W4′a)', async () => {
+    await host.close(SESSION)
+    const id = await accept('hello')
+    // The attach's own success record is the post-acquisition step that fails.
+    const record = vi.spyOn(store, 'recordOperationOutcome')
+    record.mockImplementation(async (input) => {
+      if (input.operationId !== id && input.outcome.status === 'succeeded') {
+        record.mockRestore()
+        throw new Error('record store write failed')
+      }
+      return AgentSessionRecordStore.prototype.recordOperationOutcome.call(store, input)
+    })
+
+    // Read through the open any reader takes, so a conversation the failure dropped is reopened
+    // and its message read as that reopen settles it.
+    let settled: AgentJournalSubmission | undefined
+    await eventually(async () => {
+      settled = await reopened(id)
+      expect(settled?.dispatchState).not.toBe('pending')
+    })
+    // The message names the start that failed, not a close or a restart it never met — and never
+    // the store's own error, which is Orca's and goes to the log.
+    expect(settled).toMatchObject({
+      dispatchState: 'rejected',
+      rejection: (await errorFailures())[0]
+    })
+    expect(settled?.reason).not.toContain('record store write failed')
+    expect(await errorRows()).toEqual([settled?.reason])
+  })
+})
+
+describe('an attach that fails after indexing its child', () => {
+  it('leaves no child behind, so the next send starts one and is delivered', async () => {
+    await host.close(SESSION)
+    const owned: boolean[] = []
+    host.subscribeStatus({
+      id: 'list-1',
+      emit: (event) => {
+        if (event.type === 'status') {
+          owned.push(event.session.hostExecutionOwned === true)
+        }
+      }
+    })
+    const first = await accept('hello')
+    // The attach's own success record is the step after `onAttached` indexed the child.
+    const record = vi.spyOn(store, 'recordOperationOutcome')
+    record.mockImplementation(async (input) => {
+      if (input.operationId !== first && input.outcome.status === 'succeeded') {
+        record.mockRestore()
+        throw new Error('record store write failed')
+      }
+      return AgentSessionRecordStore.prototype.recordOperationOutcome.call(store, input)
+    })
+    await eventually(async () => expect((await submission(first))?.dispatchState).toBe('rejected'))
+    // Nothing was indexed, so nothing had to be taken back: no list ever showed a child.
+    expect(host['sessions'].get(SESSION)?.child).toBeNull()
+    expect(owned).not.toContain(true)
+    const acquiresBefore = acquire.mock.calls.length
+
+    const next = await accept('after the failure')
+
+    await eventually(async () => expect((await submission(next))?.dispatchState).toBe('accepted'))
+    expect(acquire).toHaveBeenCalledTimes(acquiresBefore + 1)
+    expect(dispatch.mock.calls.map(([input]) => input.clientMessageId)).toEqual([next])
+  })
+})
+
+describe('what an earlier host process left behind', () => {
+  it('rejects a message it accepted and never handed over, as not sent (W4′b)', async () => {
+    await writeAsEarlierProcess(async (journal, fence) => {
+      await journal.appendSubmission({ ...earlierSubmission('queued', 'q', true), fence })
+    })
+
+    await host.revealSession(SESSION)
+
+    expect(await submission('queued')).toMatchObject({
+      dispatchState: 'rejected',
+      ...agentSessionFailureWords(agentSessionFailureFact('hostRestarted'), {
+        surface: 'rejection'
+      })
+    })
+    expect(dispatch).not.toHaveBeenCalled()
+  })
+
+  it('leaves a legacy pending message and a handed-over one in doubt, never re-sent (W4′c)', async () => {
+    const providerHistoryWindow = vi.fn(async () => null)
+    adapterExtras = { providerHistoryWindow }
+    await writeAsEarlierProcess(async (journal, fence) => {
+      await journal.appendSubmission({ ...earlierSubmission('legacy', 'l'), fence })
+      await journal.appendSubmission({ ...earlierSubmission('handed', 'h', true), fence })
+      await journal.resolveDispatch({ clientMessageId: 'handed', state: 'pending', fence })
+    })
+    await host.flushAllStreamedEvents()
+    await startHost()
+
+    await host.revealSession(SESSION)
+
+    expect(await submission('legacy')).toMatchObject({ dispatchState: 'unknown', recovered: true })
+    expect(await submission('handed')).toMatchObject({ dispatchState: 'unknown', recovered: true })
+    // Deciding them from provider history waits for a won lease (W4′d).
+    expect(providerHistoryWindow).not.toHaveBeenCalled()
+    expect(dispatch).not.toHaveBeenCalled()
+  })
+})
+
+describe('a child that exits before its message is handed over', () => {
+  it('rejects the message with the exit reason instead of starting another child (W24)', async () => {
+    // Each child the loop starts dies between its start step and its handover step.
+    const awaitStarted = vi.fn(async (sessionId: string) => {
+      await host.handleAdapterEvent({
+        type: 'ended',
+        sessionId,
+        fence: store.getRecord(sessionId)!.lease.runtimeFence,
+        acquisitionGeneration: `generation-${acquire.mock.calls.length}`,
+        reason: 'codex app-server crashed',
+        cause: 'unexpected-exit'
+      })
+    })
+    adapterExtras = { awaitStarted }
+    await host.close(SESSION)
+    await startHost()
+
+    const id = await accept('hello')
+
+    await eventually(async () => expect((await submission(id))?.dispatchState).toBe('rejected'))
+    expect(await submission(id)).toMatchObject({
+      reason: 'Codex stopped before this message was sent.',
+      rejection: { kind: 'providerExited' }
+    })
+    expect(acquire).toHaveBeenCalledTimes(2)
+    expect(dispatch).not.toHaveBeenCalled()
+  })
+})
+
+describe('a start whose failure the delivery loop settles before the exit is published', () => {
+  it('keeps one row in the words its rejected messages carry', async () => {
+    // The adapter's startup answer and its later exit event word the same start differently.
+    const awaitStarted = vi.fn(async () => agentSessionFailureFact('startFailed'))
+    adapterExtras = { awaitStarted }
+    acquire.mockImplementation(async (input) => ({
+      ...(await spawnChild(input)),
+      providerChildPhase: 'starting' as const
+    }))
+    await host.close(SESSION)
+    await startHost()
+
+    const first = await accept('first')
+    const second = await accept('second')
+    await eventually(async () => expect((await submission(second))?.dispatchState).toBe('rejected'))
+    await host.handleAdapterEvent({
+      type: 'ended',
+      sessionId: SESSION,
+      fence: store.getRecord(SESSION)!.lease.runtimeFence,
+      acquisitionGeneration: `generation-${acquire.mock.calls.length}`,
+      reason: 'codex app-server exited with code 1',
+      failure: agentSessionFailureFact('providerStartFailed', {
+        detail: { text: 'codex: config.toml is invalid', audience: 'person' }
+      }),
+      cause: 'unexpected-exit',
+      startupUnproven: true
+    })
+    await host.flushStreamedEvents(SESSION)
+
+    const rows = (await host.journalSnapshot(SESSION)).items.filter((item) =>
+      item.itemId.includes('start-failure')
+    )
+    expect(rows).toHaveLength(1)
+    const words = agentSessionFailureWords(agentSessionFailureFact('startFailed'), {
+      surface: 'rejection',
+      agentName: 'Codex',
+      provider: 'codex'
+    })
+    expect(rows[0].body).toMatchObject({ text: words.reason, failure: words.rejection })
+    for (const id of [first, second]) {
+      expect(await submission(id)).toMatchObject({
+        dispatchState: 'rejected',
+        reason: words.reason,
+        rejection: words.rejection
+      })
+    }
+  })
+})
+
+describe('Stop withdraws what is queued', () => {
+  it('withdraws a crash leftover ahead of any delivery step (W17a)', async () => {
+    await writeAsEarlierProcess(async (journal, fence) => {
+      await journal.appendSubmission({ ...earlierSubmission('leftover', 'l', true), fence })
+    })
+
+    // Stop's own open wakes the delivery loop, whose first step queues behind this Stop.
+    expect(await stop()).toMatchObject({ ok: true })
+
+    expect(await submission('leftover')).toMatchObject({
+      dispatchState: 'rejected',
+      reason: DISPATCH_REJECTED_CANCELLED
+    })
+    expect(acquire).toHaveBeenCalledTimes(1)
+  })
+
+  it('withdraws a message whose start holds the queue: nothing is handed over (W17b)', async () => {
+    await host.close(SESSION)
+    const starting = deferred<void>()
+    acquire.mockImplementationOnce(async (input) => {
+      await starting.promise
+      return spawnChild(input)
+    })
+    const id = await accept('hello')
+    await eventually(async () => expect(acquire).toHaveBeenCalledTimes(2))
+    const stopped = stop()
+
+    starting.resolve()
+    expect(await stopped).toMatchObject({ ok: true })
+    await eventually(async () => expect((await submission(id))?.dispatchState).toBe('rejected'))
+    expect(await submission(id)).toMatchObject({ reason: DISPATCH_REJECTED_CANCELLED })
+    expect((await submission(id))?.handedOverAt).toBeUndefined()
+    expect(dispatch).not.toHaveBeenCalled()
+  })
+
+  it('stops a child still proving its start, and the delivery loop ends with it (W17c)', async () => {
+    const ended = deferred<void>()
+    const awaitStarted = vi.fn(() => ended.promise)
+    const closeSession = vi.fn(async () => {
+      ended.resolve()
+      return true
+    })
+    adapterExtras = { awaitStarted, closeSession }
+    await host.close(SESSION)
+    await startHost()
+    acquire.mockImplementationOnce(async (input) => ({
+      ...(await spawnChild(input)),
+      providerChildPhase: 'starting' as const
+    }))
+    const id = await accept('hello')
+    await eventually(async () => expect(awaitStarted).toHaveBeenCalled())
+
+    expect(await stop()).toMatchObject({ ok: true, value: { cancelled: true } })
+
+    expect(await reopened(id)).toMatchObject({
+      dispatchState: 'rejected',
+      reason: DISPATCH_REJECTED_CANCELLED
+    })
+    expect(closeSession).toHaveBeenCalled()
+    // A loop still waiting on that start would swallow this send; it starts a new child instead.
+    awaitStarted.mockImplementation(async () => undefined)
+    const next = await accept('after stop')
+    await eventually(async () => expect((await submission(next))?.dispatchState).toBe('accepted'))
+    expect(dispatch).toHaveBeenCalledTimes(1)
+  })
+})
+
+describe('an eviction between acceptance and handover', () => {
+  it('rejects the message as not sent, never leaves it in doubt (W24)', async () => {
+    const started = deferred<void>()
+    adapterExtras = { awaitStarted: () => started.promise }
+    await host.close(SESSION)
+    await startHost()
+    const id = await accept('hello')
+    await eventually(async () => expect(acquire).toHaveBeenCalledTimes(2))
+    // Between the delivery loop's start step and its handover step.
+    await host.close(SESSION)
+    started.resolve()
+
+    expect(await reopened(id)).toMatchObject({
+      dispatchState: 'rejected',
+      ...agentSessionFailureWords(agentSessionFailureFact('chatClosed'), { surface: 'rejection' })
+    })
+    expect(dispatch).not.toHaveBeenCalled()
+  })
+
+  it('rejects a queued message behind a handed-over one, which alone stays in doubt (W24)', async () => {
+    const second = deferred<void>()
+    const awaitStarted = vi.fn(async (): Promise<void> => undefined)
+    adapterExtras = { awaitStarted }
+    await host.close(SESSION)
+    await startHost()
+    dispatch.mockResolvedValueOnce({ state: 'admitted' })
+    const handed = await accept('handed over')
+    await eventually(async () => expect((await submission(handed))?.handedOverAt).toBeDefined())
+    awaitStarted.mockImplementation(() => second.promise)
+    const queued = await accept('still queued')
+    await eventually(async () => expect(awaitStarted).toHaveBeenCalledTimes(2))
+
+    await host.close(SESSION)
+    second.resolve()
+
+    expect(await reopened(queued)).toMatchObject({
+      dispatchState: 'rejected',
+      ...agentSessionFailureWords(agentSessionFailureFact('chatClosed'), { surface: 'rejection' })
+    })
+    expect(await submission(handed)).toMatchObject({ dispatchState: 'unknown' })
+    expect(dispatch).toHaveBeenCalledTimes(1)
+  })
+
+  it('does not stop an idle child while a message is still queued for it (W24)', async () => {
+    idleMs = 0
+    const started = deferred<void>()
+    adapterExtras = { awaitStarted: () => started.promise }
+    await host.close(SESSION)
+    await startHost()
+    const id = await accept('hello')
+    await eventually(async () => expect(acquire).toHaveBeenCalledTimes(2))
+    // The idle sweep ticks every few milliseconds meanwhile.
+    await new Promise((resolve) => setTimeout(resolve, 20))
+
+    started.resolve()
+    // Handed to the child it was queued for; the eviction may follow once nothing is owed.
+    await eventually(async () => expect(dispatch).toHaveBeenCalledTimes(1))
+    expect(dispatch.mock.calls[0]?.[0].clientMessageId).toBe(id)
+    expect(acquire).toHaveBeenCalledTimes(2)
+  })
+})
+
+// A close abandons what is queued before it stops the child, so a release that then fails still
+// leaves every queued message rejected as closed, never blamed on the provider.
+describe('a close that stops the child and then fails', () => {
+  const END_CHILD = {
+    evict: () => host.close(SESSION)
+  } satisfies Partial<Record<StructuredAgentSessionChildEndCause, () => Promise<void>>>
+
+  it.each([
+    { end: 'evict', starting: true, kind: 'chatClosed', verdict: null },
+    { end: 'evict', starting: false, kind: 'chatClosed', verdict: null }
+  ] as const)(
+    'rejects what is queued as $kind after a $end (during startup: $starting)',
+    async ({ end, starting, kind, verdict }) => {
+      const started = deferred<void>()
+      adapterExtras = {
+        awaitStarted: () => started.promise,
+        // Once: the host's own teardown acknowledges again.
+        acknowledgeSessionRelease: vi.fn().mockImplementationOnce(() => {
+          throw new Error('release acknowledgement failed')
+        })
+      }
+      await host.close(SESSION)
+      await startHost()
+      acquire.mockImplementationOnce(async (input) => ({
+        ...(await spawnChild(input)),
+        ...(starting ? { providerChildPhase: 'starting' as const } : {})
+      }))
+      const id = await accept('hello')
+      await eventually(() => expect(acquire).toHaveBeenCalledTimes(2))
+
+      await expect(END_CHILD[end]()).rejects.toThrow()
+      expect(host.hasSession(SESSION)).toBe(true)
+      started.resolve()
+
+      await eventually(async () => expect((await submission(id))?.dispatchState).toBe('rejected'))
+      const rejected = (await submission(id))!
+      expect(rejected.rejection).toMatchObject({ kind })
+      expect(classifyDispatchRejection(rejected).verdict).toBe(verdict)
+      expect(dispatch).not.toHaveBeenCalled()
+    }
+  )
+})
+
+describe('a compaction or rewind an earlier child left prepared', () => {
+  async function leftPrepared(prepare: (fence: number) => Promise<unknown>): Promise<void> {
+    await host.close(SESSION)
+    await prepare(store.getRecord(SESSION)!.lease.runtimeFence)
+    // A new process: nothing is open and no view attaches.
+    await host.flushAllStreamedEvents()
+    await startHost()
+  }
+
+  it('settles an interrupted compaction at open, so a send is accepted and delivered (R16)', async () => {
+    await leftPrepared((fence) =>
+      store.setConversationCommand(SESSION, fence, {
+        command: 'compact',
+        runtimeFence: fence,
+        operationId: 'compact-op',
+        callerKey: 'client-1',
+        phase: 'prepared',
+        state: 'unknown'
+      })
+    )
+
+    const id = await accept('after the compaction')
+
+    await eventually(async () => expect((await submission(id))?.dispatchState).toBe('accepted'))
+    expect(store.getRecord(SESSION)?.conversationCommand).toMatchObject({
+      phase: 'committed',
+      state: 'unknown'
+    })
+  })
+
+  it('completes a rewind the provider already applied at open, so a send is accepted (R16)', async () => {
+    await leftPrepared((fence) =>
+      persistRewindRecord(store, SESSION, fence, {
+        operationId: 'rewind-op',
+        callerKey: 'client-1',
+        itemId: 'orca:rewound',
+        providerItemId: `codex:${THREAD}:turn-1:0`,
+        expectedEpoch: 'epoch-before',
+        phase: 'provider-succeeded',
+        hydrationVerified: true,
+        retained: []
+      })
+    )
+
+    const id = await accept('after the rewind')
+
+    await eventually(async () => expect((await submission(id))?.dispatchState).toBe('accepted'))
+    expect(store.getRecord(SESSION)?.rewind).toMatchObject({ phase: 'completed' })
+  })
+})
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-acquisition-options.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-acquisition-options.test.ts
index e0549e1816e9..7c12909e0363 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-acquisition-options.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-acquisition-options.test.ts
@@ -15,6 +15,7 @@ import {
   attachFingerprintFields,
   type AgentSessionAttachParams
 } from './structured-agent-session-attach'
+import { openTestAttachConversation } from './structured-agent-session-attach-test-conversation'
 import { performAttach } from './structured-agent-session-attach-flow'
 import type { AgentSessionCreatePhaseRecorder } from '../../observability/agent-session-instrumentation'
 
@@ -107,7 +108,7 @@ function expectSettledAttachLease(record: AgentSessionRecord | null): void {
   expect(record).not.toBeNull()
   const lease = record!.lease
   const durableState = lease.handoffStage ?? lease.claimStatus
-  expect(['live', 'released', 'recovering', 'manual-recovery']).toContain(durableState)
+  expect(['live', 'released', 'recovering']).toContain(durableState)
   expect(lease.handoffStage).not.toBe('new-owner-proving')
 }
 
@@ -154,6 +155,7 @@ describe('structured session acquisition options', () => {
       store: initialStore,
       adapter: withHistory('created'),
       journalRoot: root,
+      openConversation: openTestAttachConversation(root!),
       authority: {
         spawnToken: 'spawn-a',
         claimKeyId: 'key-1',
@@ -194,6 +196,7 @@ describe('structured session acquisition options', () => {
       store,
       adapter: withHistory('resumed'),
       journalRoot: root,
+      openConversation: openTestAttachConversation(root!),
       authority: {
         spawnToken: 'spawn-b',
         claimKeyId: 'key-1',
@@ -228,6 +231,7 @@ describe('structured session acquisition options', () => {
       store,
       adapter: sessionAdapter,
       journalRoot: root,
+      openConversation: openTestAttachConversation(root!),
       authority: {
         spawnToken: 'spawn-a',
         claimKeyId: 'key-1',
@@ -260,6 +264,7 @@ describe('structured session acquisition options', () => {
         store,
         adapter: sessionAdapter,
         journalRoot: root!,
+        openConversation: openTestAttachConversation(root!),
         authority: {
           spawnToken,
           claimKeyId: 'key-1',
@@ -291,6 +296,7 @@ describe('structured session acquisition options', () => {
       store,
       adapter: adapter({ origin: 'created' }),
       journalRoot: root,
+      openConversation: openTestAttachConversation(root!),
       authority: {
         spawnToken: 'spawn-a',
         claimKeyId: 'key-1',
@@ -330,6 +336,7 @@ describe('structured session acquisition options', () => {
         }
       }),
       journalRoot: root,
+      openConversation: openTestAttachConversation(root!),
       authority: {
         spawnToken: 'spawn-b',
         claimKeyId: 'key-1',
@@ -369,6 +376,7 @@ describe('structured session acquisition options', () => {
       store,
       adapter: sessionAdapter,
       journalRoot: root,
+      openConversation: openTestAttachConversation(root!),
       authority: {
         spawnToken: 'spawn-a',
         claimKeyId: 'key-1',
@@ -408,6 +416,7 @@ describe('structured session acquisition options', () => {
         store,
         adapter: failingAdapter,
         journalRoot: root,
+        openConversation: openTestAttachConversation(root!),
         authority: {
           spawnToken: 'spawn-a',
           claimKeyId: 'key-1',
@@ -421,7 +430,10 @@ describe('structured session acquisition options', () => {
       })
     ).resolves.toEqual({
       ok: false,
-      refusal: { code: 'agent_session_operation_invalid', message: 'model list unavailable' }
+      refusal: {
+        code: 'agent_session_operation_invalid',
+        message: "Codex couldn't restart. Send your message to try again."
+      }
     })
     expect(releaseAcquisition).toHaveBeenCalledOnce()
     expect(store.getRecord(SESSION)?.lease.ownerProcess).toBeNull()
@@ -499,6 +511,7 @@ describe('structured session acquisition options', () => {
           store: target,
           adapter: failingAdapter,
           journalRoot: root!,
+          openConversation: openTestAttachConversation(root!, failingAdapter),
           authority: {
             spawnToken: operationId === CREATE_OPERATION ? 'spawn-a' : 'spawn-b',
             claimKeyId: 'key-1',
@@ -511,12 +524,16 @@ describe('structured session acquisition options', () => {
           onAttached: () => {}
         })
 
-      // A proven exit before the journal opens is answered once, as the refusal its replay gives.
+      // A proven exit before the journal opens is answered once, as the refusal its replay gives;
+      // no exit was observed, so it names no situation.
       const failed = perform(store, CREATE_OPERATION, null)
       await (exitProven && failurePoint !== 'journal'
         ? expect(failed).resolves.toEqual({
             ok: false,
-            refusal: { code: 'agent_session_operation_invalid', message: injected.message }
+            refusal: {
+              code: 'agent_session_operation_invalid',
+              message: "Codex couldn't restart. Send your message to try again."
+            }
           })
         : expect(failed).rejects.toThrow(
             exitProven ? injected.message : 'agent_session_acquisition_exit_unproven'
@@ -553,14 +570,12 @@ describe('structured session acquisition options', () => {
         })
         await expect(perform(reopened, RESUME_OPERATION, 2)).resolves.toMatchObject({ ok: true })
         expectSettledAttachLease(reopened.getRecord(SESSION))
-      } else {
+      } else if (failurePoint === 'proof' || failurePoint === 'journal') {
+        // A recorded owner goes to recovery, which concludes about it before the next start.
         expect(failedRecord?.lease).toMatchObject({
           runtimeFence: 1,
           claimStatus: failurePoint === 'journal' ? 'live' : 'reserved',
-          handoffStage:
-            failurePoint === 'proof' || failurePoint === 'journal'
-              ? 'recovering'
-              : 'manual-recovery',
+          handoffStage: 'recovering',
           // The settled operation must not stay named by the lease as an in-flight transfer.
           handoffOperationId: null,
           reservedSpawnToken: 'spawn-a'
@@ -569,12 +584,25 @@ describe('structured session acquisition options', () => {
           ok: false,
           refusal: { code: 'agent_session_ownership_unknown' }
         })
+      } else {
+        // No owner was recorded, and the adapter closed the stdio of anything it spawned: released,
+        // with no death evidence, since nothing proved one.
+        expect(failedRecord?.lease).toMatchObject({
+          runtimeFence: 2,
+          claimStatus: 'released',
+          handoffStage: null,
+          handoffOperationId: null,
+          ownerProcess: null,
+          reservedSpawnToken: null,
+          deathEvidence: null
+        })
+        await expect(perform(reopened, RESUME_OPERATION, 2)).resolves.toMatchObject({ ok: true })
       }
     })
   })
 })
 
-describe('the tab id a create records', () => {
+describe('the tab a create reserves', () => {
   async function openStore() {
     root = await mkdtemp(join(tmpdir(), 'orca-surface-tab-id-'))
     return AgentSessionRecordStore.open({ directory: join(root, 'store'), hostId: 'local' })
@@ -585,6 +613,7 @@ describe('the tab id a create records', () => {
       store,
       adapter: adapter({ origin: 'created' }),
       journalRoot: root!,
+      openConversation: openTestAttachConversation(root!),
       authority: {
         spawnToken: 'spawn-a',
         claimKeyId: 'key-1',
@@ -603,30 +632,18 @@ describe('the tab id a create records', () => {
     })
   }
 
-  it('pins the id the caller reserved on the record and answers with it', async () => {
+  it('takes no tab at attach, then answers a retry naming another tab with the one it was given', async () => {
     const store = await openStore()
-    const result = await attachWith(store, 'chat-tab-1')
-
-    expect(result).toMatchObject({ ok: true, value: { tabId: 'chat-tab-1' } })
-    expect(store.getRecord(SESSION)?.surfaceTabId).toBe('chat-tab-1')
-  })
-
-  it('records the id clients derive when the caller reserved none', async () => {
-    const store = await openStore()
-    const result = await attachWith(store)
-
-    // Every reader still keys by the derived id, so an unreserved chat must not record another.
-    const derived = `structured-agent-session-${SESSION}`
-    expect(result).toMatchObject({ ok: true, value: { tabId: derived } })
-    expect(store.getRecord(SESSION)?.surfaceTabId).toBe(derived)
-  })
-
-  it('answers a retry that names another tab with the one the record holds', async () => {
-    const store = await openStore()
-    await attachWith(store, 'chat-tab-1')
-    const retried = await attachWith(store, 'chat-tab-2')
-
-    expect(retried).toMatchObject({ ok: true, value: { tabId: 'chat-tab-1' } })
-    expect(store.getRecord(SESSION)?.surfaceTabId).toBe('chat-tab-1')
+    const created = await attachWith(store, 'chat-tab-1')
+    // Publishing the tab takes the id, so a create that never gets there leaves nothing behind.
+    expect(created.ok && created.value.tabId).toBeUndefined()
+    expect(store.getSessionTabId(SESSION)).toBeNull()
+
+    await store.setSessionTabVisibility(SESSION, true, 'chat-tab-1')
+    expect(await attachWith(store, 'chat-tab-2')).toMatchObject({
+      ok: true,
+      value: { tabId: 'chat-tab-1' }
+    })
+    expect(store.getSessionTabId(SESSION)).toBe('chat-tab-1')
   })
 })
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-acquisition.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-acquisition.ts
index 7968176a5a9a..ac2f1823e5fc 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-acquisition.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-acquisition.ts
@@ -26,16 +26,8 @@ export async function acquireOwner(
   if (!spawnToken) {
     throw new Error('agent_session_ownership_unknown')
   }
-  // Pre-spawn proof is single-use: this retry may create a child after the durable clear.
   try {
     try {
-      record = await input.store.setReservationProcesslessProof({
-        sessionId: record.sessionId,
-        fence,
-        spawnToken,
-        processlessAt: null,
-        now: input.now()
-      })
       await input.onAcquiring?.()
     } catch (error) {
       throw new AgentSessionPreSpawnError(error)
@@ -47,7 +39,15 @@ export async function acquireOwner(
       spawnToken,
       ...(record.options ? { options: record.options } : {}),
       ...(input.eventSink ? { events: input.eventSink } : {}),
-      ...(input.recordPhase ? { recordPhase: input.recordPhase } : {})
+      ...(input.recordPhase ? { recordPhase: input.recordPhase } : {}),
+      onSpawned: async (process) => {
+        record = await input.store.commitProcessIdentity({
+          sessionId: record.sessionId,
+          fence,
+          process,
+          now: input.now()
+        })
+      }
     })
     const providerChildPhase = acquired.providerChildPhase ?? 'ready'
     // A starting child has proven nothing: the record keeps the reservation's saved options as
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-adapter-router.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-adapter-router.ts
index 7fa1446d6c53..bb003f93427d 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-adapter-router.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-adapter-router.ts
@@ -1,3 +1,4 @@
+import type { SubmissionRejectionFact } from '../../../shared/agent-session-failure'
 import type { AgentSessionJournalIdentity } from '../../../shared/agent-session-journal-types'
 import type {
   AgentSessionAccountHome,
@@ -61,8 +62,8 @@ export class StructuredAgentSessionAdapterRouter implements StructuredAgentSessi
   dispatch: StructuredAgentSessionAdapter['dispatch'] = (input) =>
     this.owner(input.sessionId).dispatch(input)
 
-  rewindSupport: NonNullable<StructuredAgentSessionAdapter['rewindSupport']> = (sessionId) =>
-    this.liveOwnerOrNull(sessionId)?.rewindSupport?.(sessionId) ?? {
+  rewindSupport: NonNullable<StructuredAgentSessionAdapter['rewindSupport']> = (sessionId, agent) =>
+    this.capabilityOwner(sessionId, agent)?.rewindSupport?.(sessionId) ?? {
       supported: false,
       reason: 'unsupported'
     }
@@ -94,11 +95,11 @@ export class StructuredAgentSessionAdapterRouter implements StructuredAgentSessi
     return change(input)
   }
 
-  supportsThreadGoal = (sessionId: string): boolean =>
-    this.liveOwnerOrNull(sessionId)?.supportsThreadGoal?.(sessionId) ?? false
+  supportsThreadGoal = (sessionId: string, agent?: string): boolean =>
+    this.capabilityOwner(sessionId, agent)?.supportsThreadGoal?.(sessionId) ?? false
 
-  recordsContextUsage = (sessionId: string): boolean =>
-    this.liveOwnerOrNull(sessionId)?.recordsContextUsage?.(sessionId) ?? false
+  recordsContextUsage = (sessionId: string, agent?: string): boolean =>
+    this.capabilityOwner(sessionId, agent)?.recordsContextUsage?.(sessionId) ?? false
 
   stopBackgroundTasks: NonNullable<StructuredAgentSessionAdapter['stopBackgroundTasks']> = (
     input
@@ -122,6 +123,8 @@ export class StructuredAgentSessionAdapterRouter implements StructuredAgentSessi
 
   awaitOptionWritable = (sessionId: string): Promise<void> =>
     this.liveOwnerOrNull(sessionId)?.awaitOptionWritable?.(sessionId) ?? Promise.resolve()
+  awaitStarted = (sessionId: string): Promise<void | SubmissionRejectionFact> =>
+    this.liveOwnerOrNull(sessionId)?.awaitStarted?.(sessionId) ?? Promise.resolve()
 
   readOptions = (input: { sessionId: string; fence: number }) => {
     const reader = this.owner(input.sessionId).readOptions
@@ -214,6 +217,11 @@ export class StructuredAgentSessionAdapterRouter implements StructuredAgentSessi
     return adapter
   }
 
+  /** The live owner, or for a session at rest the provider it would start under. */
+  private capabilityOwner(sessionId: string, agent?: string): StructuredAgentSessionAdapter | null {
+    return this.liveOwnerOrNull(sessionId) ?? (agent ? this.adapterForAgent(agent) : null)
+  }
+
   private liveOwnerOrNull(sessionId: string): StructuredAgentSessionAdapter | null {
     const route = this.routes.get(sessionId)
     return route?.state === 'live' ? route.adapter : null
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-adapter.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-adapter.ts
index 7085700cdcbc..bc3c27ca5b13 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-adapter.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-adapter.ts
@@ -27,22 +27,37 @@ import type {
   AgentSessionBackgroundTaskState,
   AgentSessionOptionsResult,
   AgentSessionSlashCommand,
-  AgentSessionThreadGoalChange,
-  AgentSessionWireRefusalCode
+  AgentSessionThreadGoalChange
 } from '../../../shared/agent-session-wire'
-import { isAgentSessionWireRefusalCode } from '../../../shared/agent-session-wire-refusals'
+import {
+  isAgentSessionWireRefusalCode,
+  type AgentSessionRefusalReason
+} from '../../../shared/agent-session-wire-refusals'
+import type { SubmissionRejectionFact } from '../../../shared/agent-session-failure'
+import type { AgentJournalDispatchRejection } from '../../../shared/agent-session-failure-words'
+import type { AgentSessionPromptResponse } from '../../../shared/agent-session-question-answer'
 import type { ProviderHistoryWindow } from '../agent-session-journal/journal-submission-reconciler'
 import type { StructuredAgentSessionEventSink } from './structured-agent-session-event-sink'
+import type { StructuredSessionCompactionResult } from './structured-session-compaction'
 import type { AgentSessionCreatePhaseRecorder } from '../../observability/agent-session-instrumentation'
 
 export class AgentSessionAcquisitionRefusal extends Error {
+  readonly code = 'agent_session_operation_invalid'
+
   constructor(
     message: string,
-    readonly code: AgentSessionWireRefusalCode = 'agent_session_operation_invalid'
+    /** The situation, so the chat can say what to do; the message is Orca's log wording. Absent,
+     *  the provider refused its own start. */
+    readonly reason: AgentSessionRefusalReason<'agent_session_operation_invalid'> = 'providerStartFailed'
   ) {
     super(message)
     this.name = 'AgentSessionAcquisitionRefusal'
   }
+
+  /** The conversation's history is more than this host can restore. */
+  static historyTooLarge(message: string): AgentSessionAcquisitionRefusal {
+    return new AgentSessionAcquisitionRefusal(message, 'historyTooLarge')
+  }
 }
 
 export class AgentSessionPromptUnavailableError extends Error {
@@ -52,11 +67,19 @@ export class AgentSessionPromptUnavailableError extends Error {
   }
 }
 
+/** The provider cannot take this answer. Thrown before the journal commit, so nothing is recorded. */
+export class AgentSessionPromptAnswerRejectedError extends Error {
+  constructor(message: string) {
+    super(message)
+    this.name = 'AgentSessionPromptAnswerRejectedError'
+  }
+}
+
 /**
  * The provider's own root process was observed to exit, but its descendant tree
- * could not be verified. The lease keys on the root's pid and start time, so its
- * observed death releases the reservation; nothing is claimed about descendants.
- * Never thrown when a descendant was observed still alive — that stays unproven.
+ * was not proven gone. The lease keys on the root's pid and start time, so its
+ * observed death releases the reservation; nothing is claimed about descendants,
+ * including one seen still alive.
  */
 export class AgentSessionAcquisitionRootExitObservedError extends Error {
   constructor(cause: unknown) {
@@ -94,11 +117,24 @@ export type AgentSessionAcquisition = {
   providerChildPhase?: StructuredAgentSessionProviderChildPhase
 }
 
+/** A refusal before spawn that a person can act on; the site that refused names it. */
+export type AgentSessionPreSpawnReason = Extract<
+  AgentSessionRefusalReason<'agent_session_operation_invalid'>,
+  'managedAccountEnvOverride' | 'accountSwitchInProgress' | 'managedAccountUnsupported'
+>
+
 /** Acquisition failed with first-hand proof that no provider process existed. */
 export class AgentSessionPreSpawnError extends Error {
-  constructor(cause: unknown) {
-    super(cause instanceof Error ? cause.message : String(cause), { cause })
+  /** Absent: Orca's own reason, which only the log reads. A wrapped pre-spawn error keeps its. */
+  readonly reason: AgentSessionPreSpawnReason | undefined
+
+  constructor(
+    cause: unknown,
+    options: { reason?: AgentSessionPreSpawnReason; message?: string } = {}
+  ) {
+    super(options.message ?? (cause instanceof Error ? cause.message : String(cause)), { cause })
     this.name = 'AgentSessionPreSpawnError'
+    this.reason = options.reason ?? (isAgentSessionPreSpawnError(cause) ? cause.reason : undefined)
   }
 }
 
@@ -116,21 +152,24 @@ export type AgentSessionDispatchOutcome =
    * anything and never promotes this to `unknown`.
    */
   | { state: 'admitted' }
-  | { state: 'rejected'; reason: string }
+  /** Words from `agentSessionFailureWords`, never written by hand. */
+  | ({ state: 'rejected' } & AgentJournalDispatchRejection)
   /** The call did not settle. Never re-send on the user's behalf. */
   | { state: 'unknown'; reason: string }
 
 export type StructuredAgentSessionEndedEvent = {
   type: 'ended'
   sessionId: string
+  /** Log text only; the chat's words come from `failure`. */
   reason: string
+  /** Why it ended, as the adapter knows it: the provider's exit with its own diagnostic, or an
+   *  Orca fault. Absent reads as a provider exit with nothing to add. */
+  failure?: SubmissionRejectionFact
   cause: 'unexpected-exit' | 'requested-close'
   fence: number
   acquisitionGeneration: string
-  /** Host receipt of the child exit, retained across settlement retries. */
+  /** Host receipt of the child exit: the end time of a turn it interrupted. */
   observedAt?: number
-  /** Translator could not admit terminal rows; host recovery must append its bounded fallback. */
-  settlementRetryRequired?: boolean
   /** The provider ended before it finished starting, so resuming it would repeat the failure. */
   startupUnproven?: true
 }
@@ -165,6 +204,9 @@ export type StructuredAgentSessionAcquireInput = {
   /** Provider events may begin before acquisition returns. */
   events?: StructuredAgentSessionEventSink
   recordPhase?: AgentSessionCreatePhaseRecorder
+  /** Durably records the child's identity the moment it exists, before any handshake, so a crash
+   *  mid-start leaves an owner recovery can stop. The acquisition's `process` must match it. */
+  onSpawned?: (process: AgentSessionProcessIdentity) => Promise<void>
 }
 
 export type StructuredAgentSessionSetOptionInput = {
@@ -186,7 +228,7 @@ export type StructuredAgentSessionAdapter = {
   /** Reaps an acquired provider when the host cannot commit or prove its lease.
    *  Returns true only after provider child exit is proven. Throws
    *  `AgentSessionAcquisitionRootExitObservedError` when the provider root's own
-   *  exit was observed first-hand but its descendants could not be verified. */
+   *  exit was observed first-hand but its descendants were not proven gone. */
   releaseAcquisition?(input: { sessionId: string }): Promise<boolean>
   dispatch(input: {
     sessionId: string
@@ -199,7 +241,8 @@ export type StructuredAgentSessionAdapter = {
     /** Revalidate after preparation, immediately before writing to the provider. */
     beforeDispatch?: () => Promise<void>
   }): Promise<AgentSessionDispatchOutcome>
-  rewindSupport?(sessionId: string): AgentSessionRewindSupport
+  /** `agent` answers for a session with no child running, from the provider alone. */
+  rewindSupport?(sessionId: string, agent?: string): AgentSessionRewindSupport
   recoverRewind?(input: {
     sessionId: string
     fence: number
@@ -224,8 +267,8 @@ export type StructuredAgentSessionAdapter = {
     turnId: string
     sessionId: string
     fence: number
-    onLateResult?: (result: { error?: string }) => Promise<void>
-  }): Promise<{ error?: string }>
+    onLateResult?: (result: StructuredSessionCompactionResult) => Promise<void>
+  }): Promise<StructuredSessionCompactionResult>
   /** Cancels one turn, not the session: a session-wide interrupt would also kill
    *  a turn the client never asked to stop. */
   cancelTurn(input: {
@@ -250,10 +293,10 @@ export type StructuredAgentSessionAdapter = {
      *  start a new goal rather than rewrite that one's objective in place. */
     replacesGoal: boolean
   }): Promise<{ ok: true } | { ok: false; rejected: string }>
-  /** Whether this live session can change its goal. */
-  supportsThreadGoal?(sessionId: string): boolean
-  /** Whether this live session writes context facts to its turn rows. */
-  recordsContextUsage?(sessionId: string): boolean
+  /** Whether this session can change its goal; `agent` answers one at rest. */
+  supportsThreadGoal?(sessionId: string, agent?: string): boolean
+  /** Whether this session writes context facts to its turn rows; `agent` answers one at rest. */
+  recordsContextUsage?(sessionId: string, agent?: string): boolean
   stopBackgroundTasks?(input: {
     sessionId: string
     fence: number
@@ -263,13 +306,14 @@ export type StructuredAgentSessionAdapter = {
   /** The `/` surface the running provider reports for itself. Undefined when the
    *  provider never reports one, which is what keeps the client on its catalog. */
   readCommands?(sessionId: string): AgentSessionSlashCommand[] | undefined
-  /** Claims the live callback, commits the journal CAS while that claim is held, then answers it.
-   *  A prompt cancel claims the same callback, so only one operation can commit. */
+  /** Claims the live callback, builds the provider reply, commits the journal CAS while that claim is
+   *  held, then answers it. A reply that cannot be built throws `AgentSessionPromptAnswerRejectedError`
+   *  before the commit. A prompt cancel claims the same callback, so only one operation can commit. */
   answerPrompt(input: {
     sessionId: string
     itemId: string
     kind: 'approval' | 'question'
-    optionId: string
+    response: AgentSessionPromptResponse
     fence: number
     commit: () => Promise<void>
   }): Promise<void>
@@ -278,6 +322,10 @@ export type StructuredAgentSessionAdapter = {
   ): Promise<void | Readonly<Record<string, string>>>
   /** Resolves once a live session can take an option write, or after a bound; never rejects. */
   awaitOptionWritable?(sessionId: string): Promise<void>
+  /** Resolves once a session published before it proved its start has proven it, failed, or been
+   *  closed; at once for any other. A start that did not land resolves with the chat's words for
+   *  why. Never rejects. */
+  awaitStarted?(sessionId: string): Promise<void | SubmissionRejectionFact>
   readOptions?(input: { sessionId: string; fence: number }): Promise<AgentSessionOptionsResult>
   /** Option keys skipped after a provider rejected their persisted restore value. */
   readOptionRestoreFailures?(sessionId: string): readonly string[]
@@ -343,8 +391,8 @@ function provenExitAcquisitionFailure(cause: unknown): unknown {
 }
 
 /** Whether a stop left the provider root gone. The lease follows the root, so a first-hand root
- *  exit or a processless child ends the session even with descendants unverified; any other
- *  failure, including known-live descendants, still throws. */
+ *  exit or a processless child ends the session whatever its descendants did; any other
+ *  failure still throws. */
 export async function stopAgentSessionProviderRoot(stop: () => Promise<boolean>): Promise<boolean> {
   try {
     return (await stop()) === true
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-adopted-import.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-adopted-import.test.ts
index 0248799980a7..4b8e1d87ba39 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-adopted-import.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-adopted-import.test.ts
@@ -11,10 +11,12 @@ import {
   attachFingerprintFields,
   type AgentSessionAttachParams
 } from './structured-agent-session-attach'
+import { openTestAttachConversation } from './structured-agent-session-attach-test-conversation'
 import { performAttach, type AttachFlowInput } from './structured-agent-session-attach-flow'
 import { AgentSessionJournal } from '../agent-session-journal/journal-store'
 import { agentSessionJournalCloseRetries } from '../agent-session-journal/journal-close-retry'
 import * as legacyImport from '../agent-session-journal/journal-legacy-import'
+import { StructuredAgentSessionHost } from './structured-agent-session-host'
 
 const NOW = 1_800_000_000_000
 const SESSION = 'codex_adopting_session'
@@ -121,6 +123,7 @@ async function attach(
     store,
     adapter: sessionAdapter,
     journalRoot: root!,
+    openConversation: openTestAttachConversation(root!),
     authority: {
       spawnToken: 'spawn-a',
       claimKeyId: 'key-1',
@@ -210,7 +213,7 @@ describe('adopting a provider conversation on create', () => {
     }
   )
 
-  it('still releases acquisition and closes the provisional journal on an import write failure', async () => {
+  it('still releases acquisition on an import write failure, and leaves the conversation open', async () => {
     root = await mkdtemp(join(tmpdir(), 'orca-adopt-write-failure-'))
     const transcriptPath = join(root, 'rollout.jsonl')
     await writeCodexRollout(transcriptPath, 'valid source')
@@ -222,7 +225,51 @@ describe('adopting a provider conversation on create', () => {
     await expect(attach(transcriptPath, sessionAdapter)).rejects.toThrow('disk write failed')
     expect(sessionAdapter.acquire).toHaveBeenCalledTimes(1)
     expect(sessionAdapter.releaseAcquisition).toHaveBeenCalledTimes(1)
-    expect(close).toHaveBeenCalledTimes(1)
+    // The journal is the conversation's, not the attach's: a failed import closes nothing.
+    expect(close).not.toHaveBeenCalled()
+  })
+
+  it('leaves the conversation writable when the import fails after acquiring', async () => {
+    root = await mkdtemp(join(tmpdir(), 'orca-adopt-host-failure-'))
+    const transcriptPath = join(root, 'rollout.jsonl')
+    await writeCodexRollout(transcriptPath, 'valid source')
+    store = await AgentSessionRecordStore.open({ directory: join(root, 'store'), hostId: 'local' })
+    const host = new StructuredAgentSessionHost({
+      store,
+      adapter: adapter(),
+      journalRoot: root,
+      claimKeyId: 'key-1',
+      mintSpawnToken: () => 'spawn-a',
+      now: () => NOW
+    })
+    vi.spyOn(AgentSessionJournal.prototype, 'replaceEpochItems').mockRejectedValueOnce(
+      new Error('disk write failed')
+    )
+    const attached = await host
+      .attach({ callerKey: 'client-1' }, attachParams(transcriptPath))
+      .catch(() => null)
+    expect(attached?.ok).not.toBe(true)
+
+    const body = { kind: 'message' as const, role: 'user' as const, blocks: [] }
+    const sent = await host.send(
+      { callerKey: 'client-1' },
+      {
+        envelope: {
+          sessionId: SESSION,
+          clientOperationId: `${NOW}-${'2'.padStart(32, '0')}`,
+          expectedRuntimeFence: null,
+          payloadFingerprint: computeAgentSessionPayloadFingerprint({
+            method: 'agentSession.send',
+            sessionId: SESSION,
+            fields: { body }
+          })
+        },
+        body
+      }
+    )
+    // The failed attach kept the conversation's own journal open, so the send is recorded.
+    expect(sent).toMatchObject({ ok: true, value: { submission: { dispatchState: 'pending' } } })
+    await host.flushAllStreamedEvents()
   })
 
   it('prepares a valid source once before acquisition and imports those exact items', async () => {
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-adopted-import.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-adopted-import.ts
index 459d21b1f3b7..3eccc4f94571 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-adopted-import.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-adopted-import.ts
@@ -1,7 +1,11 @@
-import type { AgentSessionWireRefusal } from '../../../shared/agent-session-wire'
+import {
+  agentSessionRefusalError,
+  isAgentSessionRefusalError,
+  refuse,
+  type AgentSessionWireRefusal
+} from '../../../shared/agent-session-wire'
 import type { AgentSessionRecord } from '../../../shared/agent-session-record'
 import type { AgentSessionAttachParams, AttachedJournal } from './structured-agent-session-attach'
-import { agentSessionJournalCloseRetries } from '../agent-session-journal/journal-close-retry'
 import type { JournalReplacementItem } from '../agent-session-journal/journal-epoch-replacement'
 import {
   importLegacyTranscriptIntoJournal,
@@ -19,10 +23,13 @@ export async function prepareAdoptedTranscript(
   } catch (error) {
     return {
       ok: false,
-      refusal: {
-        code: 'agent_session_identity_required',
-        message: error instanceof Error ? error.message : String(error)
-      }
+      refusal: isAgentSessionRefusalError(error)
+        ? error.refusal
+        : refuse(
+            'agent_session_identity_required',
+            { reason: 'transcriptUnreadable' },
+            error instanceof Error ? error.message : String(error)
+          )
     }
   }
 }
@@ -36,7 +43,9 @@ async function readAdoptedTranscript(
     return null
   }
   if (!adopt.transcriptPath) {
-    throw new Error('agent_session_identity_required')
+    throw agentSessionRefusalError('agent_session_identity_required', {
+      reason: 'transcriptNotFound'
+    })
   }
   const prepared = await prepareLegacyTranscriptImport({
     agent: params.agent,
@@ -50,7 +59,9 @@ async function readAdoptedTranscript(
     throw new Error(prepared.error)
   }
   if (prepared.items.length === 0) {
-    throw new Error('agent_session_identity_required')
+    throw agentSessionRefusalError('agent_session_identity_required', {
+      reason: 'transcriptUnreadable'
+    })
   }
   return prepared.items
 }
@@ -62,13 +73,8 @@ export async function importAdoptedTranscript(
   record: AgentSessionRecord,
   prepared: JournalReplacementItem[] | null
 ): Promise<void> {
-  try {
-    await applyAdoptedTranscript(params, attached, record, prepared)
-  } catch (error) {
-    // Publication has not taken ownership of this provisional journal yet.
-    await agentSessionJournalCloseRetries.closeOrRetain(attached.journal)
-    throw error
-  }
+  // The journal is the conversation's, which outlives a failed import; nothing here closes it.
+  await applyAdoptedTranscript(params, attached, record, prepared)
 }
 
 async function applyAdoptedTranscript(
@@ -87,7 +93,9 @@ async function applyAdoptedTranscript(
     return
   }
   if (!adopt.transcriptPath) {
-    throw new Error('agent_session_identity_required')
+    throw agentSessionRefusalError('agent_session_identity_required', {
+      reason: 'transcriptNotFound'
+    })
   }
   const imported = await importLegacyTranscriptIntoJournal({
     journal: attached.journal,
@@ -105,6 +113,8 @@ async function applyAdoptedTranscript(
   // `replaced: false` means the transcript decoded to nothing. The row promised a conversation and
   // the provider resumed one, so an empty journal here is a disagreement, not an empty chat.
   if (!imported.replaced) {
-    throw new Error('agent_session_identity_required')
+    throw agentSessionRefusalError('agent_session_identity_required', {
+      reason: 'transcriptUnreadable'
+    })
   }
 }
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-agent-start.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-agent-start.ts
new file mode 100644
index 000000000000..a4c93fa00f88
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-agent-start.ts
@@ -0,0 +1,212 @@
+// Giving a session its provider child back.
+//
+// Only work starts one: the delivery loop for a queued message, and the few operations that need
+// the provider itself — never a view, and never the app launching. It runs inside the session's
+// serialize, with the attach it is given, so the eligibility it reads is the one the attach acts
+// on.
+
+import {
+  providerDiagnosticOf,
+  type ProviderDiagnostic
+} from '../../../shared/agent-session-failure'
+import {
+  agentSessionRefusalFromReference,
+  readAgentSessionRefusalReference,
+  refuse,
+  refuseUnclassified,
+  type AgentSessionRefusalDetailsByCode,
+  type AgentSessionWireRefusalCode
+} from '../../../shared/agent-session-wire-refusals'
+import { agentSessionWriteNoticeEnglish } from '../../../shared/agent-session-refusal-notice'
+import type {
+  AgentSessionAttachResult,
+  AgentSessionMutationResult,
+  AgentSessionWireRefusal
+} from '../../../shared/agent-session-wire'
+import { terminalOwnerRefusalMessage } from '../../../shared/agent-session-legacy-handoff-lease'
+import type { StructuredAgentSessionAttachContext } from './structured-agent-session-attach-context'
+import { attachStructuredAgentSessionUnderSerialize } from './structured-agent-session-attach-orchestration'
+import { failedCreateRefusal } from './structured-agent-session-failed-create-refusal'
+import { adapterSupportsRecord } from './structured-agent-session-provider-support'
+import {
+  structuredAgentSessionResumeOperationId,
+  structuredAgentSessionResumeParams
+} from './structured-agent-session-resume-eligibility'
+
+/** A resume answers with the attach's own refusal, verdict and all, so the asker can tell a lease
+ *  someone else is settling from an owner that will not come back. */
+export type StructuredAgentSessionResumeOutcome =
+  | { ok: true }
+  | {
+      ok: false
+      refusal: AgentSessionWireRefusal
+      /** What the provider said about the failed start, for the chat's own record; host-side
+       *  only, never on the refusal. */
+      diagnostic?: ProviderDiagnostic
+    }
+
+/** The attach's caller key: the ledger row a start settles is Orca's own. */
+const AGENT_START_CALLER_KEY = 'trusted-local:agent-start'
+
+/**
+ * Gives the session a provider child if it has none, for a caller inside its serialize — which is
+ * what makes "if it has none" exact: two askers run this in turn, and the second finds the first
+ * one's child. A failed start leaves the next asker to make its own.
+ */
+export async function ensureStructuredAgentSessionAgent(
+  context: StructuredAgentSessionAttachContext,
+  sessionId: string,
+  startedFor?: string
+): Promise<StructuredAgentSessionResumeOutcome> {
+  if (context.sessions.get(sessionId)?.child) {
+    return { ok: true }
+  }
+  const started = await startStructuredAgentSessionAgent(context, sessionId, startedFor)
+  if (!started.ok || context.sessions.get(sessionId)?.child) {
+    return started
+  }
+  return refuseResume(
+    'agent_session_ownership_unknown',
+    { reason: 'noProviderChild' },
+    'The session attached without a provider child to write to.'
+  )
+}
+
+/** The same, for an operation's admission: a start that throws is that operation's refusal. */
+export function ensureStructuredAgentSessionAgentForOperation(
+  context: StructuredAgentSessionAttachContext,
+  sessionId: string
+): Promise<StructuredAgentSessionResumeOutcome> {
+  return ensureStructuredAgentSessionAgent(context, sessionId).catch((error: unknown) => {
+    // The error is Orca's own and goes to the log; the refusal says only that the start failed.
+    console.warn('[agent-session] starting the agent for an operation failed:', error)
+    return {
+      ok: false,
+      refusal: refuseUnclassified(
+        'agent_session_owner_restart_failed',
+        agentSessionWriteNoticeEnglish(['restartFailed'])
+      )
+    }
+  })
+}
+
+async function startStructuredAgentSessionAgent(
+  context: StructuredAgentSessionAttachContext,
+  sessionId: string,
+  startedFor: string | undefined
+): Promise<StructuredAgentSessionResumeOutcome> {
+  const callerKey = AGENT_START_CALLER_KEY
+  // The record is read only once this host has adjudicated it and recovery resolution has
+  // concluded about any owner a failed attempt left in `recovering`, so the eligibility below sees
+  // the lease the resolver handed back.
+  const unreconciled = await context.reconcileLeases(sessionId)
+  if (unreconciled) {
+    return { ok: false, refusal: unreconciled }
+  }
+  await context.runtimeState.resolveRecovery(sessionId)
+  const record = context.deps.store.getRecord(sessionId)
+  if (!record) {
+    return refuseResume(
+      'agent_session_identity_required',
+      { reason: 'recordMissing' },
+      'No structured session exists by that id.'
+    )
+  }
+  if (!adapterSupportsRecord(context.deps.adapter, record)) {
+    return refuseResume(
+      'structured_agent_session_unsupported',
+      { reason: 'hostUnsupported' },
+      'This execution host cannot resume the requested structured agent session.'
+    )
+  }
+  const params = structuredAgentSessionResumeParams(
+    record,
+    structuredAgentSessionResumeOperationId(context.now())
+  )
+  if (!params) {
+    return record.lease.unreconciled
+      ? refuseResume(
+          'execution_owner_reconciling',
+          { reason: 'hostReconciling' },
+          'This host has not yet adjudicated the session lease.'
+        )
+      : record.lease.claimStatus === 'conflicted'
+        ? refuseResume(
+            'agent_session_conflict',
+            { reason: 'claimConflicted' },
+            terminalOwnerRefusalMessage(record.lease)
+          )
+        : refuseResume(
+            'agent_session_ownership_unknown',
+            { reason: 'notResumable' },
+            'The session lease is not one this host may resume.'
+          )
+  }
+  let attached: AgentSessionMutationResult<AgentSessionAttachResult>
+  let acquisitionError: unknown
+  try {
+    attached = await attachStructuredAgentSessionUnderSerialize(context, callerKey, params, {
+      ...(startedFor === undefined ? {} : { startedFor }),
+      onAcquisitionFailed: (error) => {
+        acquisitionError = error
+      }
+    })
+  } catch (error) {
+    // The attach settles an acquisition that failed — the ledger row, the released lease — before
+    // it rethrows the cause. That row is the answer: a failure it recorded is this resume's
+    // refusal, verdict and all. Only an error it did not record is a fault for the caller.
+    const settled = settledResumeRefusal(
+      context,
+      callerKey,
+      params.envelope.clientOperationId,
+      sessionId,
+      error
+    )
+    if (settled) {
+      return withDiagnostic(settled.refusal, error)
+    }
+    throw error
+  }
+  return attached.ok ? { ok: true } : withDiagnostic(attached.refusal, acquisitionError)
+}
+
+function withDiagnostic(
+  refusal: AgentSessionWireRefusal,
+  error: unknown
+): StructuredAgentSessionResumeOutcome {
+  const diagnostic = providerDiagnosticOf(error)
+  return { ok: false, refusal, ...(diagnostic ? { diagnostic } : {}) }
+}
+
+function settledResumeRefusal(
+  context: Pick<StructuredAgentSessionAttachContext, 'deps'>,
+  callerKey: string,
+  operationId: string,
+  sessionId: string,
+  error: unknown
+): { ok: false; refusal: AgentSessionWireRefusal } | null {
+  const outcome = context.deps.store.getOperationRow(callerKey, operationId)?.outcome
+  const reference =
+    outcome?.status === 'failed'
+      ? readAgentSessionRefusalReference({ code: outcome.code, details: outcome.details })
+      : undefined
+  if (outcome?.status !== 'failed' || !reference) {
+    return null
+  }
+  return failedCreateRefusal(
+    agentSessionRefusalFromReference(
+      reference,
+      outcome.message ?? (error instanceof Error ? error.message : String(error))
+    ),
+    outcome.status,
+    context.deps.store.getRecord(sessionId)
+  )
+}
+
+function refuseResume<C extends AgentSessionWireRefusalCode>(
+  code: C,
+  details: NoInfer<AgentSessionRefusalDetailsByCode[C]>,
+  message: string
+): StructuredAgentSessionResumeOutcome {
+  return { ok: false, refusal: refuse(code, details, message) }
+}
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-append-delivery.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-append-delivery.test.ts
new file mode 100644
index 000000000000..55128a23c9c5
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-append-delivery.test.ts
@@ -0,0 +1,244 @@
+// What an open chat receives, asserted at its subscriber rather than in the journal: a fresh
+// subscribe re-reads the journal and hides a write that never reached the readers already open.
+
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi, type Mock } from 'vitest'
+import { computeAgentSessionPayloadFingerprint } from '../../../shared/agent-session-mutation-envelope'
+import type {
+  AgentJournalRenderItem,
+  AgentJournalSubmission
+} from '../../../shared/agent-session-journal-types'
+import type { AgentSessionSubscribeEvent } from '../../../shared/agent-session-wire'
+import { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
+import type { StructuredAgentSessionAdapter } from './structured-agent-session-adapter'
+import { StructuredAgentSessionHost } from './structured-agent-session-host'
+import {
+  HOST_TEST_NOW as NOW,
+  HOST_TEST_SESSION as SESSION,
+  HOST_TEST_THREAD as THREAD,
+  hostTestAttachParams,
+  hostTestMessage,
+  hostTestOperationId,
+  resetHostTestOperationIds
+} from './structured-agent-session-host-test-data'
+
+const CALLER = { callerKey: 'client-1' }
+const EXIT_REASON = 'Claude Code is not signed in. Sign in with the Claude CLI'
+
+let root: string
+let store: AgentSessionRecordStore
+let host: StructuredAgentSessionHost
+let acquire: Mock<StructuredAgentSessionAdapter['acquire']>
+let generation = 0
+
+/** Everything a live subscriber was sent after it opened. */
+function liveReader() {
+  const events: AgentSessionSubscribeEvent[] = []
+  host.subscribe({ id: 'pane', sessionId: SESSION, emit: (event) => events.push(event) })
+  const opened = events.length
+  const received = () => {
+    const items: AgentJournalRenderItem[] = []
+    const submissions: AgentJournalSubmission[] = []
+    for (const event of events.slice(opened)) {
+      if (event.type === 'batch') {
+        items.push(...event.batch.items)
+        submissions.push(...event.batch.submissions)
+      } else if (event.type === 'snapshot' || event.type === 'reset') {
+        items.push(...event.page.items)
+        submissions.push(...event.page.submissions)
+      }
+    }
+    const rows = new Map<string, string>()
+    for (const item of items) {
+      if (item.body.kind === 'status') {
+        rows.set(item.itemId, item.body.text)
+      }
+    }
+    return {
+      statuses: items.flatMap((item) => (item.body.kind === 'status' ? [item.body.text] : [])),
+      /** Each status row as the chat renders it: its latest revision, once. */
+      statusRows: [...rows.values()],
+      submissions,
+      batches: events.slice(opened).filter((event) => event.type === 'batch').length
+    }
+  }
+  return { received }
+}
+
+async function send(text: string): Promise<string> {
+  const body = hostTestMessage(text)
+  const sent = await host.send(CALLER, {
+    envelope: {
+      sessionId: SESSION,
+      clientOperationId: hostTestOperationId(),
+      expectedRuntimeFence: store.getRecord(SESSION)?.lease.runtimeFence ?? 0,
+      payloadFingerprint: computeAgentSessionPayloadFingerprint({
+        method: 'agentSession.send',
+        sessionId: SESSION,
+        fields: { body }
+      })
+    },
+    body
+  })
+  expect(sent, JSON.stringify(sent)).toMatchObject({ ok: true })
+  return sent.ok ? sent.value.clientMessageId : ''
+}
+
+function exitBeforeProof(): Promise<void> {
+  return host.handleAdapterEvent({
+    type: 'ended',
+    sessionId: SESSION,
+    fence: store.getRecord(SESSION)?.lease.runtimeFence ?? 0,
+    acquisitionGeneration: `generation-${generation}`,
+    reason: EXIT_REASON,
+    failure: { kind: 'providerExited', detail: { text: EXIT_REASON, audience: 'log' } },
+    cause: 'unexpected-exit',
+    startupUnproven: true
+  })
+}
+
+function providerSink() {
+  const events = acquire.mock.calls.at(-1)?.[0].events
+  if (!events) {
+    throw new Error('no acquired provider sink')
+  }
+  return events
+}
+
+beforeEach(async () => {
+  root = await mkdtemp(join(tmpdir(), 'orca-append-delivery-'))
+  resetHostTestOperationIds()
+  generation = 0
+  acquire = vi.fn(async ({ fence, spawnToken }) => ({
+    process: { hostId: 'local', pid: 4242, processStartTimeMs: 1_700_000_000_000, spawnToken },
+    link: {
+      linkId: `link-${fence}`,
+      handle: { provider: 'codex', threadId: THREAD },
+      origin: generation === 0 ? ('created' as const) : ('resumed' as const),
+      mintedAtFence: fence,
+      observedAt: NOW
+    },
+    acquisitionGeneration: `generation-${++generation}`,
+    providerChildPhase: 'starting' as const
+  }))
+  store = await AgentSessionRecordStore.open({ directory: join(root, 'store'), hostId: 'local' })
+  host = new StructuredAgentSessionHost({
+    store,
+    adapter: {
+      acquire,
+      releaseAcquisition: vi.fn(async () => true),
+      closeSession: vi.fn(async () => true),
+      dispatch: vi.fn(async () => ({ state: 'admitted' as const })),
+      cancelTurn: vi.fn(async () => ({ cancelled: true })),
+      answerPrompt: vi.fn(async () => undefined),
+      setOption: vi.fn(async () => undefined)
+    },
+    journalRoot: root,
+    claimKeyId: 'key-1',
+    mintSpawnToken: () => `spawn-${generation + 1}`,
+    now: () => NOW
+  })
+  await expect(host.attach(CALLER, hostTestAttachParams(null))).resolves.toMatchObject({
+    ok: true
+  })
+})
+
+afterEach(async () => {
+  await host.flushAllStreamedEvents()
+  await rm(root, { recursive: true, force: true })
+})
+
+describe('an open chat receives every row its journal commits', () => {
+  it('shows a failed start whose lease could not be handed back', async () => {
+    const held = await send('hello')
+    const pane = liveReader()
+    // The exit settles the journal, then fails to release the lease: nothing moves the fence.
+    vi.spyOn(store, 'transitionHandoff').mockRejectedValueOnce(new Error('record store busy'))
+
+    await exitBeforeProof()
+
+    // The exit ends the child; the delivery loop, which reads why, rejects what it had queued.
+    await vi.waitFor(() =>
+      expect(pane.received().submissions).toContainEqual(
+        expect.objectContaining({ clientMessageId: held, dispatchState: 'rejected' })
+      )
+    )
+    // One row, however many of its writers reported the start.
+    expect(pane.received().statusRows).toEqual([
+      'Codex stopped before it finished starting. Send your message to try again.'
+    ])
+  })
+
+  it('shows a revision the provider queued with no publish behind it', async () => {
+    const pane = liveReader()
+    const identity = { provider: 'orca' as const, clientMessageId: 'context-usage' }
+    const body = { kind: 'status' as const, text: 'context usage answered after the turn' }
+
+    expect(providerSink().tryReviseResolvedItem?.(4_096, () => ({ identity, body }))).toEqual({
+      accepted: true
+    })
+    await host.flushStreamedEvents(SESSION)
+
+    expect(pane.received().statuses).toEqual(['context usage answered after the turn'])
+  })
+
+  it('shows a row appended straight to the journal', async () => {
+    const pane = liveReader()
+    const journal = host['sessions'].get(SESSION)?.journal
+    if (!journal) {
+      throw new Error('the attached chat has no journal')
+    }
+
+    await journal.appendItem(
+      { provider: 'orca', clientMessageId: 'host-note' },
+      { kind: 'status', text: 'written by a writer that publishes nothing' },
+      { fence: store.getRecord(SESSION)?.lease.runtimeFence ?? 0 }
+    )
+
+    expect(pane.received().statuses).toEqual(['written by a writer that publishes nothing'])
+  })
+})
+
+describe('an open chat receives each row once', () => {
+  it('when the provider frame that wrote it also publishes', async () => {
+    const pane = liveReader()
+    const sink = providerSink()
+    const journal = host['sessions'].get(SESSION)?.journal
+    if (!journal) {
+      throw new Error('the attached chat has no journal')
+    }
+    const readSince = vi.spyOn(journal, 'readSince')
+
+    sink.appendItem(
+      { provider: 'orca', clientMessageId: 'streamed' },
+      { kind: 'status', text: 'streamed row' }
+    )
+    sink.publish()
+    await host.flushStreamedEvents(SESSION)
+
+    expect(pane.received().statuses).toEqual(['streamed row'])
+    // The frame's publish finds the reader caught up and reads no rows: streaming stays one read.
+    expect(readSince).toHaveBeenCalledOnce()
+  })
+
+  it('when a writer publishes the row it appended', async () => {
+    const pane = liveReader()
+    const journal = host['sessions'].get(SESSION)?.journal
+    if (!journal) {
+      throw new Error('the attached chat has no journal')
+    }
+
+    await journal.appendItem(
+      { provider: 'orca', clientMessageId: 'host-row' },
+      { kind: 'status', text: 'host row' },
+      { fence: store.getRecord(SESSION)?.lease.runtimeFence ?? 0 }
+    )
+    host['subscribers'].publish(SESSION, journal)
+
+    expect(pane.received().statuses).toEqual(['host row'])
+    // The second publish found nothing past the reader's cursor, so it sent nothing at all.
+    expect(pane.received().batches).toBe(1)
+  })
+})
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-attach-context.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-attach-context.ts
index 4b9b46716cb2..90c638c23fb9 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-attach-context.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-attach-context.ts
@@ -15,6 +15,7 @@ import type {
 } from './structured-agent-session-host-types'
 import type { StructuredAgentSessionHostRuntimeState } from './structured-agent-session-host-runtime-state'
 import type { StructuredAgentSessionTaskQueue } from './structured-agent-session-task-queue'
+import type { StructuredAgentSessionConversationOpenOptions } from './structured-agent-session-conversation-open'
 
 export type StructuredAgentSessionAttachContext = {
   deps: StructuredAgentSessionHostDeps
@@ -38,8 +39,10 @@ export type StructuredAgentSessionAttachContext = {
   reconcileLeases: (sessionId: string) => Promise<AgentSessionWireRefusal | null>
   serialize: <T>(sessionId: string, task: () => Promise<T>) => Promise<T>
   now: () => number
-  /** Paired with `sessions.delete` by `forgetStructuredAgentSession`; a failed attach that only
-   *  deleted would leave the store's row behind. */
-  forgetStatus: (sessionId: string) => void
-  publishStatus?: (sessionId: string) => void
+  publishStatus: (sessionId: string) => void
+  /** The conversation's one open journal, opened when closed; see `conversation-open`. */
+  openConversation: (
+    sessionId: string,
+    options?: StructuredAgentSessionConversationOpenOptions
+  ) => Promise<StructuredAgentSessionHostSession | null>
 }
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-attach-failure.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-attach-failure.ts
index 3a77aa2d6cca..16af00e32ea5 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-attach-failure.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-attach-failure.ts
@@ -24,8 +24,7 @@ export async function settlePostAcquisitionAttachFailure(
           ? 'root-exit-observed'
           : 'exit-proven'
   }
-  // A failed close must not prevent durable failure settlement.
-  await Promise.resolve(input.onAttachFailed?.()).catch(() => undefined)
+  input.onAcquisitionReleased?.(cause, { rootGone: exitProof !== 'unproven' })
   try {
     await input.store.settleFailedPostAcquisitionAttachment({
       sessionId: record.sessionId,
@@ -36,6 +35,7 @@ export async function settlePostAcquisitionAttachFailure(
       outcome: {
         status: 'failed',
         code: 'agent_session_operation_invalid',
+        details: { reason: 'attachFailed' },
         message: cause instanceof Error ? cause.message : String(cause)
       },
       exitProof,
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-attach-flow.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-attach-flow.ts
index ab9c44949e00..8fdee5c62bdb 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-attach-flow.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-attach-flow.ts
@@ -1,7 +1,9 @@
+import { refuse } from '../../../shared/agent-session-wire-refusals'
 import { settlePostAcquisitionAttachFailure } from './structured-agent-session-attach-failure'
 import {
   failedAcquisitionRefusal,
-  failedAcquisitionSettlement
+  failedAcquisitionSettlement,
+  preSpawnFailureInWords
 } from './structured-agent-session-failed-create-refusal'
 import type {
   StructuredAgentSessionAdapter,
@@ -41,6 +43,7 @@ import {
   type AgentSessionCreatePhaseRecorder
 } from '../../observability/agent-session-instrumentation'
 import type { ProviderHistoryWindow } from '../agent-session-journal/journal-submission-reconciler'
+import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
 
 export type AttachFlowInput = {
   store: AgentSessionRecordStore
@@ -66,8 +69,14 @@ export type AttachFlowInput = {
   onAcquiring?: () => Promise<void> | void
   /** Settles writes already captured by the superseded journal before opening another. */
   beforeJournalOpen?: () => Promise<void> | void
-  /** Closes and removes partial publication after journal attachment fails. */
-  onAttachFailed?: () => Promise<void>
+  /** The conversation's own open journal, which the attach adopts: it never opens one itself. */
+  openConversation: (record: AgentSessionRecord) => Promise<AgentSessionJournal>
+  /** A failure after acquisition released the session's acquisition; `cause` is that failure and
+   *  `rootGone` whether the release saw the provider root go. */
+  onAcquisitionReleased?: (cause: unknown, verdict: { rootGone: boolean }) => void
+  /** The error an acquisition failed with, for a host-side reader of the provider's words; the
+   *  refusal never carries them. */
+  onAcquisitionFailed?: (error: unknown) => void
 }
 
 export async function performAttach(
@@ -76,10 +85,11 @@ export async function performAttach(
   const { params, store } = input
   const unsupported = (): AgentSessionMutationResult<AgentSessionAttachResult> => ({
     ok: false,
-    refusal: {
-      code: 'structured_agent_session_unsupported',
-      message: 'This execution host cannot create the requested structured agent session.'
-    }
+    refusal: refuse(
+      'structured_agent_session_unsupported',
+      { reason: 'hostUnsupported' },
+      'This execution host cannot create the requested structured agent session.'
+    )
   })
   const sessionId = params.envelope.sessionId
   const admitted = admitAttachOrRefuse(params)
@@ -168,6 +178,10 @@ export async function performAttach(
       acquiredOwner = true
     }
   } catch (error) {
+    const wording = {
+      record: reservedRecord ?? store.getRecord(sessionId),
+      newSession: !params.providerHandle
+    }
     const spawnToken = reservedRecord?.lease.reservedSpawnToken
     if (reservedRecord && spawnToken && !unsupportedReservationSettlementAttempted) {
       // Settle processless proof and failed operation atomically.
@@ -178,7 +192,7 @@ export async function performAttach(
           spawnToken,
           callerKey: input.callerKey,
           operationId: params.envelope.clientOperationId,
-          ...failedAcquisitionSettlement(error),
+          ...failedAcquisitionSettlement(error, wording),
           now: input.now()
         })
       } catch (settlementError) {
@@ -188,11 +202,18 @@ export async function performAttach(
         )
       }
     }
+    input.onAcquisitionFailed?.(error)
+    const failed = failedAcquisitionRefusal(error, wording)
+    const thrown = failed ? error : preSpawnFailureInWords(error, wording)
+    if (failed || thrown !== error) {
+      // The answer carries only its sentence, so what failed is kept here.
+      console.warn('[agent-session] provider start failed:', error)
+    }
     return (
-      failedAcquisitionRefusal(error) ?? {
+      failed ?? {
         ok: false,
         refusal: classifyStoreFailure(
-          error,
+          thrown,
           store.getRecord(sessionId)?.lease.runtimeFence ?? null,
           store.getRecord(sessionId)
         )
@@ -208,6 +229,7 @@ export async function performAttach(
       params,
       journalRoot: input.journalRoot,
       adapter: input.adapter,
+      openConversation: input.openConversation,
       providerHistoryWindow
     })
     await importAdoptedTranscript(params, attached, record, preparedTranscript.items)
@@ -222,6 +244,7 @@ export async function performAttach(
   }
 
   const fence = record.lease.runtimeFence
+  const tabId = store.getSessionTabId(sessionId)
   return {
     ok: true,
     replayed,
@@ -232,7 +255,7 @@ export async function performAttach(
       fence,
       page: readAgentSessionHydrationPage(attached.journal, fence),
       unconfirmedClientMessageIds: attached.unconfirmedClientMessageIds,
-      ...(record.surfaceTabId ? { tabId: record.surfaceTabId } : {})
+      ...(tabId ? { tabId } : {})
     }
   }
 }
@@ -276,6 +299,7 @@ async function settleUnsupportedReservation(
       outcome: {
         status: 'failed',
         code: 'structured_agent_session_unsupported',
+        details: { reason: 'hostUnsupported' },
         message: 'Structured session support changed before the provider could start.'
       },
       exitProof: 'processless',
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-attach-orchestration.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-attach-orchestration.ts
index 5482826d0725..40804bf55e2e 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-attach-orchestration.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-attach-orchestration.ts
@@ -1,3 +1,4 @@
+import { agentSessionFailureFact } from '../../../shared/agent-session-failure'
 import { recoverStructuredRewind } from './structured-rewind-recovery'
 import { recoverInterruptedCompaction } from './structured-compaction-recovery'
 // The host's attach, lifted out of the host class.
@@ -14,20 +15,26 @@ import type {
   AgentSessionTurnActivity
 } from '../../../shared/agent-session-wire'
 import type { AgentSessionAttachParams } from './structured-agent-session-attach'
-import { performAttach } from './structured-agent-session-attach-flow'
+import { performAttach, type AttachFlowInput } from './structured-agent-session-attach-flow'
 import { stampFailedCreateOwnerVerdict } from './structured-agent-session-failed-create-refusal'
 import {
   pinnedAgentSessionLaunchArgs,
   pinnedAgentSessionLaunchEnv
 } from './structured-agent-session-launch-env'
 import { refuseAgentSessionMutation } from './structured-agent-session-mutation-admission'
-import { isResumableStructuredAgentSessionRecord } from './structured-agent-session-resume-eligibility'
-import { retryPendingStructuredAgentSessionSettlement } from './structured-agent-session-settlement-retry'
-import { settleStaleSessionStateOnAcquire } from './structured-agent-session-stale-turn-verdict'
+import { settleStaleStructuredAgentSessionState } from './structured-agent-session-dead-generation-settlement'
+import { structuredAgentSessionFailureWordsContext } from './structured-agent-session-send-preparation'
 import type { StructuredAgentSessionAttachContext } from './structured-agent-session-attach-context'
-import { forgetStructuredAgentSession } from './structured-agent-session-host-lifetime'
+import type {
+  StructuredAgentSessionProviderChild,
+  StructuredAgentSessionStopVerdict
+} from './structured-agent-session-host-types'
+import {
+  endProviderChild,
+  indexProviderChild,
+  structuredAgentSessionConversationFence
+} from './structured-agent-session-provider-child'
 import type { DeferredStructuredAgentSessionEventSink } from './structured-agent-session-event-sink'
-import { agentSessionJournalCloseRetries } from '../agent-session-journal/journal-close-retry'
 import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
 import {
   addAgentSessionCreatePhaseAttributes,
@@ -37,17 +44,18 @@ import {
 } from '../../observability/agent-session-instrumentation'
 
 export type StructuredAgentSessionAttachOptions = {
-  /** Provider-exit recovery: refuses once the ticket the restart was issued for is stale. */
-  admitRecoveryTicket?: () => boolean
   recordPhase?: AgentSessionCreatePhaseRecorder
+  onAcquisitionFailed?: AttachFlowInput['onAcquisitionFailed']
+  /** The queued message a start is for; see `StructuredAgentSessionProviderChild.startedFor`. */
+  startedFor?: string
 }
 
 /**
  * The attach itself, for a caller already inside the session's serialize.
  *
- * That is every caller that has to know what the session looks like RIGHT NOW: a hold, a send
- * making sure it has an owner, provider-exit recovery. They run their
- * check and this attach in one serialized step, so "the session has no child" is still true when
+ * That is every caller that has to know what the session looks like RIGHT NOW: the delivery loop,
+ * and an operation that needs the provider. They run their check and this attach in one serialized
+ * step, so "the session has no child" is still true when
  * the attach starts. `attachStructuredAgentSession` is this under `serialize`, for a client.
  */
 export function attachStructuredAgentSessionUnderSerialize(
@@ -96,12 +104,10 @@ async function runAttach(
 ): Promise<AgentSessionMutationResult<AgentSessionAttachResult>> {
   const sessionId = params.envelope.sessionId
   const recordPhase = options.recordPhase
-  if (options.admitRecoveryTicket && !options.admitRecoveryTicket()) {
-    return refuseAgentSessionMutation({
-      code: 'agent_session_checkpoint_stale',
-      message: 'The provider-exit recovery ticket is no longer current.'
-    })
-  }
+  // Readers of a conversation already open are re-baselined when this attach moves its fence.
+  const fenceBefore = context.sessions.has(sessionId)
+    ? structuredAgentSessionConversationFence(context.deps.store, sessionId)
+    : null
   const unreconciled = await withAgentSessionCreatePhase('reconcile_leases', recordPhase, () =>
     context.reconcileLeases(sessionId)
   )
@@ -111,42 +117,23 @@ async function runAttach(
   await withAgentSessionCreatePhase('resolve_recovery', recordPhase, () =>
     context.runtimeState.resolveRecovery(sessionId)
   )
-  // Retries a durable provider-exit journal settlement before a new owner is reserved. Answers
-  // settled when the record has none pending, so every attach can ask unconditionally.
-  const settled = await withAgentSessionCreatePhase('settlement_retry', recordPhase, () =>
-    retryPendingStructuredAgentSessionSettlement({
-      deps: context.deps,
-      sessions: context.sessions,
-      sessionId,
-      params,
-      now: () => context.now()
-    })
-  )
-  if (!settled) {
-    return refuseAgentSessionMutation({
-      code: 'agent_session_ownership_unknown',
-      message: 'The provider-exit terminal journal settlement is still pending; retry attach.'
-    })
-  }
   const probe = await withAgentSessionCreatePhase('probe_owner', recordPhase, () =>
     context.runtimeState.probeOwner(sessionId)
   )
   // A child this attach spawns writes through a sink this attempt owns. Only a successful
-  // attach makes it the session's; any other exit closes it with whatever the child queued.
+  // attach makes the child and its sink the session's; any other exit closes the sink with
+  // whatever the child queued, and leaves the conversation's child as it was.
   const attemptSink = context.runtimeState.mintEventSink(sessionId)
-  let attemptSinkAdopted = false
-  // A lease handed back cleanly is what a resume replaces. A writer current as of that owner is
-  // rebased onto the fence this attach publishes, since the restart is the only thing that moved it.
-  const released = context.deps.store.getRecord(sessionId)
-  const resumedFromFence =
-    released && isResumableStructuredAgentSessionRecord(released)
-      ? released.lease.runtimeFence
-      : undefined
-  const attached = stampFailedCreateOwnerVerdict(
-    context.deps.store,
-    callerKey,
-    params.envelope,
-    await performAttach({
+  // Read before the reserve clears it: how the previous generation ended decides how whatever it
+  // left running is settled.
+  const priorRecord = context.deps.store.getRecord(sessionId)
+  const priorDeathEvidence = priorRecord?.lease.deathEvidence ?? null
+  const attempt: { candidate: AttachCandidate | null; committed: boolean } = {
+    candidate: null,
+    committed: false
+  }
+  try {
+    const attached = await performAttach({
       store: context.deps.store,
       adapter: context.deps.adapter,
       journalRoot: context.deps.journalRoot,
@@ -170,66 +157,51 @@ async function runAttach(
       params,
       now: () => context.now(),
       recordPhase,
-      // Site 9: this closes the PRIOR map entry it drops, never the provisional
-      // journal — it has no reference to that one. `onAttached` owns that.
-      onAttachFailed: async () => {
-        await forgetStructuredAgentSession(context, sessionId)
-        context.runtimeState.currentEventSink(sessionId)?.close()
-        context.runtimeState.discardEventSink(sessionId)
+      ...(options.onAcquisitionFailed ? { onAcquisitionFailed: options.onAcquisitionFailed } : {}),
+      openConversation: async (record) => {
+        const conversation = await context.openConversation(record.sessionId, {
+          acquisition: true
+        })
+        if (!conversation) {
+          throw new Error('agent_session_identity_required')
+        }
+        return conversation.journal
       },
+      // The cleanup released the acquisition, which for a re-attach is the live child itself.
+      onAcquisitionReleased: (cause, verdict) =>
+        endReleasedChild(context, sessionId, cause, verdict),
       onAttached: async (attached, acquisitionGeneration, acquiredOwner, providerChildPhase) => {
-        const fence = context.deps.store.getRecord(sessionId)?.lease.runtimeFence ?? 0
-        const previous = context.sessions.get(sessionId)
-        const previousFence = previous?.fence
+        const fence = structuredAgentSessionConversationFence(context.deps.store, sessionId)
+        const current = context.sessions.get(sessionId)?.child ?? null
+        const startedFor = acquiredOwner ? options.startedFor : current?.startedFor
         // A re-attach to a live child keeps the sink that child already writes through.
         const eventSink = acquiredOwner
           ? attemptSink
           : (context.runtimeState.currentEventSink(sessionId) ?? attemptSink)
-        // Site 8: the provisional journal has no owner until the map takes it,
-        // and the barrier below throws by design.
-        try {
-          if (acquiredOwner) {
-            // Before the drain: the buffered events are the new child's, never a stale row's.
-            await settleStaleSessionStateOnAcquire({
-              journal: attached.journal,
-              sessionId,
-              fence,
-              acquisitionGeneration
-            })
-          }
-          await bindAndDrain(eventSink, attached.journal, fence, (activity) =>
-            context.subscribers.publish(sessionId, attached.journal, activity)
-          )
-        } catch (error) {
-          await agentSessionJournalCloseRetries.closeOrRetain(attached.journal)
-          throw error
+        if (acquiredOwner) {
+          // Before the drain: the buffered events are the new child's, never a stale row's.
+          await settleStaleStructuredAgentSessionState({
+            journal: attached.journal,
+            sessionId,
+            fence,
+            acquisitionGeneration,
+            deathEvidence: priorDeathEvidence,
+            failureTextContext: structuredAgentSessionFailureWordsContext(priorRecord)
+          })
         }
-        // Site 10: a `set` over a live entry would orphan its handle — and a
-        // close that REJECTED did not release it. The replacement is therefore
-        // ABORTED rather than completed over a handle nothing can reach again:
-        // `previous` stays indexed, so teardown still owns it and can retry.
-        if (previous && previous.journal !== attached.journal) {
-          try {
-            await previous.journal.close()
-          } catch (error) {
-            await agentSessionJournalCloseRetries.closeOrRetain(attached.journal)
-            throw error
+        await bindAndDrain(eventSink, attached.journal, fence, (activity) =>
+          context.subscribers.publish(sessionId, attached.journal, activity)
+        )
+        attempt.candidate = {
+          sink: eventSink,
+          child: {
+            generation: acquisitionGeneration ?? current?.generation ?? null,
+            fence,
+            // A re-attach to a live child keeps what that child already proved, and its cause.
+            phase: acquiredOwner ? providerChildPhase : (current?.phase ?? 'ready'),
+            ...(startedFor === undefined ? {} : { startedFor })
           }
         }
-        context.runtimeState.adoptEventSink(sessionId, eventSink)
-        attemptSinkAdopted = eventSink === attemptSink
-        context.sessions.set(sessionId, {
-          journal: attached.journal,
-          params,
-          fence,
-          hasProviderChild: true,
-          // A re-attach to a live child keeps what that child already proved.
-          providerChildPhase: acquiredOwner
-            ? providerChildPhase
-            : (previous?.providerChildPhase ?? 'ready'),
-          acquisitionGeneration: acquisitionGeneration ?? previous?.acquisitionGeneration ?? null,
-          resumedFromFence: acquiredOwner ? resumedFromFence : previous?.resumedFromFence
-        })
         await recoverStructuredRewind(
           context.deps.store,
           sessionId,
@@ -239,21 +211,61 @@ async function runAttach(
           context.now
         )
         await recoverInterruptedCompaction(context.deps.store, sessionId, attached.journal, fence)
-        if (attached.recovery) {
-          context.subscribers.reset(sessionId, attached.journal, attached.recovery.reset, fence)
-        } else if (previousFence !== undefined && previousFence !== fence) {
+        if (fenceBefore !== null && fence !== fenceBefore) {
           context.subscribers.snapshot(sessionId, attached.journal, fence)
         } else {
           context.subscribers.publish(sessionId, attached.journal)
         }
       }
-    }).finally(() => {
-      if (!attemptSinkAdopted) {
-        attemptSink.close()
-      }
     })
-  )
-  return attached
+    const { candidate } = attempt
+    const conversation = context.sessions.get(sessionId)
+    if (attached.ok && candidate && conversation) {
+      context.runtimeState.adoptEventSink(sessionId, candidate.sink)
+      attempt.committed = candidate.sink === attemptSink
+      indexProviderChild(conversation, candidate.child)
+      context.publishStatus?.(sessionId)
+    }
+    return stampFailedCreateOwnerVerdict(context.deps.store, callerKey, params.envelope, attached)
+  } finally {
+    if (!attempt.committed) {
+      attemptSink.close()
+    }
+  }
+}
+
+type AttachCandidate = {
+  child: StructuredAgentSessionProviderChild
+  sink: DeferredStructuredAgentSessionEventSink
+}
+
+function endReleasedChild(
+  context: StructuredAgentSessionAttachContext,
+  sessionId: string,
+  cause: unknown,
+  verdict: StructuredAgentSessionStopVerdict
+): void {
+  const session = context.sessions.get(sessionId)
+  const child = session?.child
+  if (
+    !session ||
+    !child ||
+    !endProviderChild(session, {
+      generation: child.generation,
+      fence: child.fence,
+      cause: 'attach-failed',
+      reason: cause instanceof Error ? cause.message : String(cause),
+      // Orca failed to attach; the provider said nothing.
+      failure: agentSessionFailureFact('hostFault'),
+      duringStartup: child.phase === 'starting',
+      ...verdict
+    })
+  ) {
+    return
+  }
+  context.runtimeState.currentEventSink(sessionId)?.close()
+  context.runtimeState.discardEventSink(sessionId)
+  context.publishStatus?.(sessionId)
 }
 
 /** Binds the sink to the journal and waits for the barrier the host publishes
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-attach-reconciliation.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-attach-reconciliation.test.ts
index 97f429933d87..36f6ebc79e85 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-attach-reconciliation.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-attach-reconciliation.test.ts
@@ -8,11 +8,13 @@ import { join } from 'node:path'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { agentSessionRecordFixture } from '../../../shared/agent-session-record.test-fixture'
 import type { AgentJournalMessageItem } from '../../../shared/agent-session-journal-types'
+import { projectStructuredAgentSessionStatusState } from '../../../shared/structured-agent-session-projection'
 import { digestPayload } from '../agent-session-journal/journal-payload-bounds'
 import { journalDirectoryFor } from '../agent-session-journal/journal-paths'
 import type { ProviderHistoryWindow } from '../agent-session-journal/journal-submission-reconciler'
 import { createTrackedJournalOpener } from '../agent-session-journal/journal-store-test-open'
 import type { StructuredAgentSessionAdapter } from './structured-agent-session-adapter'
+import { openTestAttachConversation } from './structured-agent-session-attach-test-conversation'
 import {
   attachJournal,
   journalIdentityFor,
@@ -85,6 +87,7 @@ async function attach(adapter: StructuredAgentSessionAdapter) {
     record: RECORD,
     params: PARAMS,
     journalRoot: root,
+    openConversation: openTestAttachConversation(root),
     adapter
   })
   journals.track(attached.journal)
@@ -110,11 +113,24 @@ describe('attachJournal restart reconciliation', () => {
     expect(attached.unconfirmedClientMessageIds).toEqual([])
     const submission = attached.journal.submissions()[0]
     expect(submission?.dispatchState).toBe('rejected')
-    expect(submission?.reason).toBe('not_delivered')
+    expect(submission?.rejection).toEqual({ kind: 'notDelivered' })
     // Deciding is not sending: nothing here puts the message back on the wire.
     expect(dispatch).not.toHaveBeenCalled()
   })
 
+  it('gives a send the provider never received no verdict and no listing', async () => {
+    await crashedJournal()
+    const { adapter } = adapterWith(async () => window())
+
+    const attached = await attach(adapter)
+
+    // Nobody failed: the crash stranded it, so the chat must not read Failed or be listed by it.
+    const { items, submissions } = attached.journal.snapshot()
+    expect(
+      projectStructuredAgentSessionStatusState(items, submissions, RECORD.lease.runtimeFence)
+    ).toMatchObject({ summary: { status: null }, latestRequest: null })
+  })
+
   it('still reports a submission unconfirmed when the window cannot decide it', async () => {
     await crashedJournal()
     const { adapter, dispatch } = adapterWith(async () => window({ turnInFlight: true }))
@@ -147,4 +163,37 @@ describe('attachJournal restart reconciliation', () => {
     expect(attached.unconfirmedClientMessageIds).toEqual(['cm_1'])
     expect(attached.journal.submissions()[0]?.dispatchState).toBe('unknown')
   })
+
+  it('leaves a message the open conversation still has queued alone (W4′e)', async () => {
+    const journal = await journals.open({
+      identity: IDENTITY,
+      journalDir: journalDirectoryFor(root, {
+        workspaceId: IDENTITY.workspaceId,
+        sessionId: IDENTITY.sessionId
+      })
+    })
+    await journal.appendSubmission({
+      clientMessageId: 'queued',
+      payloadFingerprint: digestPayload('still queued'),
+      body: userMessage('still queued'),
+      fence: RECORD.lease.runtimeFence,
+      handoverRecorded: true
+    })
+    // History that holds nothing: absence would prove a handed-over message undelivered.
+    const { adapter, dispatch } = adapterWith(async () => window())
+
+    const attached = await attachJournal({
+      record: RECORD,
+      params: PARAMS,
+      journalRoot: root,
+
+      adapter,
+      openConversation: async () => journal
+    })
+
+    expect(attached.journal).toBe(journal)
+    expect(journal.submissions()[0]).toMatchObject({ dispatchState: 'pending' })
+    expect(journal.submissions()[0]?.handedOverAt).toBeUndefined()
+    expect(dispatch).not.toHaveBeenCalled()
+  })
 })
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-attach-test-conversation.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-attach-test-conversation.ts
new file mode 100644
index 000000000000..1e2322cbc6d8
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-attach-test-conversation.ts
@@ -0,0 +1,18 @@
+import type { AgentSessionRecord } from '../../../shared/agent-session-record'
+import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
+import type { StructuredAgentSessionAdapter } from './structured-agent-session-adapter'
+import { openStructuredAgentSessionConversationJournal } from './structured-agent-session-conversation-open'
+
+/** For a test that attaches without a host: the conversation's journal, through the one open a
+ *  host would take, so the attach under test adopts it the way it adopts the host's. */
+export function openTestAttachConversation(
+  journalRoot: string,
+  adapter: Pick<StructuredAgentSessionAdapter, 'historyFilePath'> = {}
+): (record: AgentSessionRecord) => Promise<AgentSessionJournal> {
+  return async (record) =>
+    (
+      await openStructuredAgentSessionConversationJournal({ journalRoot, adapter }, record, {
+        acquisition: true
+      })
+    ).session.journal
+}
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-attach.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-attach.ts
index 2e42ffe9893d..10c4866cea3f 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-attach.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-attach.ts
@@ -23,12 +23,15 @@ import type {
   AgentSessionLaunchEnv,
   AgentSessionRecord
 } from '../../../shared/agent-session-record'
-import { structuredAgentSessionTabId } from '../../../shared/structured-agent-session-projection'
 import {
-  AGENT_SESSION_WIRE_REFUSAL_CODES,
+  AgentSessionRefusalError,
+  agentSessionRefusalFromReference,
+  agentSessionRefusalReference,
+  isAgentSessionWireRefusalCode,
+  refuse,
   type AgentSessionMutationEnvelope,
-  type AgentSessionWireRefusal,
-  type AgentSessionWireRefusalCode
+  type AgentSessionRefusalReference,
+  type AgentSessionWireRefusal
 } from '../../../shared/agent-session-wire'
 import {
   agentSessionFingerprintConflict,
@@ -36,15 +39,9 @@ import {
 } from '../../../shared/agent-session-mutation-envelope'
 import type { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
 import { agentSessionProviderHandleChainHead } from '../../../shared/agent-session-provider-handle'
-import { agentSessionJournalCloseRetries } from '../agent-session-journal/journal-close-retry'
-import { journalDirectoryFor } from '../agent-session-journal/journal-paths'
 import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
 import { reconcileJournalSubmissionsAgainstHistory } from '../agent-session-journal/journal-restart-reconciliation'
 import type { ProviderHistoryWindow } from '../agent-session-journal/journal-submission-reconciler'
-import {
-  openAgentSessionJournalWithRecovery,
-  type AgentSessionJournalRecovery
-} from './agent-session-journal-recovery'
 import type { StructuredAgentSessionAdapter } from './structured-agent-session-adapter'
 import { structuredAgentSessionRefusalMessage } from './structured-agent-session-refusal-message'
 
@@ -64,8 +61,8 @@ export type AgentSessionAttachParams = {
   runtimeKind: 'native'
   /** Host-resolved defaults for a create-by-intent; remote attach schemas do not accept them. */
   options?: Readonly<Record<string, string>>
-  /** The tab id a create reserves for this chat; absent records the id clients derive. Never on
-   *  the attach fingerprint: which tab shows the chat is not which conversation it attaches to. */
+  /** The tab id a create reserves for this chat, taken when its tab is published. Never on the
+   *  attach fingerprint: which tab shows the chat is not which conversation it attaches to. */
   surfaceTabId?: string
   launchArgs?: string[]
   /** Omitted only for create-by-intent; the adapter proves the durable handle. */
@@ -125,10 +122,11 @@ export function admitAttachOrRefuse(
   if (params.providerHandle && params.providerHandle.kind !== params.provider) {
     return {
       ok: false,
-      refusal: {
-        code: 'agent_session_operation_invalid',
-        message: `A ${params.provider} session requires a ${params.provider} provider handle.`
-      }
+      refusal: refuse(
+        'agent_session_operation_invalid',
+        { reason: 'requestMalformed' },
+        `A ${params.provider} session requires a ${params.provider} provider handle.`
+      )
     }
   }
   const fingerprint = computeAgentSessionPayloadFingerprint({
@@ -166,16 +164,13 @@ export function journalIdentityFor(
 
 export type AttachedJournal = {
   journal: AgentSessionJournal
-  recovery: AgentSessionJournalRecovery | null
-  /** Submissions still `unknown` after this open: the crash boundary settled
-   *  them there and provider history could not decide them either. */
+  /** Submissions the crash boundary left `unknown` that provider history could not decide. */
   unconfirmedClientMessageIds: string[]
 }
 
 /**
- * Open the session's journal, recovering it when the stored one is unusable,
- * settle every submission left in flight by a previous process, then let
- * provider history decide the ones it can prove.
+ * The conversation's journal — opened, and its crash boundary settled, by the conversation's own
+ * open — with provider history deciding the submissions that boundary could only doubt.
  *
  * Why the reconciliation belongs HERE and nowhere else: this runs after the
  * record store handed this host the lease and before `onAttached` starts a
@@ -183,54 +178,44 @@ export type AttachedJournal = {
  * is read, and the window stays valid until the resume consumes it. Every other
  * settlement site — a proven child exit — runs while the host
  * may still start another child, and a read there could be overtaken before it
- * is acted on. Orca still never re-sends: this decides state only.
+ * is acted on. Orca still never re-sends: this decides state only. A queued
+ * submission is left alone: it was never handed over, so history cannot hold it.
  */
 export async function attachJournal(input: {
   record: AgentSessionRecord
   params: AgentSessionAttachParams
   journalRoot: string
   adapter: StructuredAgentSessionAdapter
+  /** The host's open conversation, whose journal the attach adopts. */
+  openConversation: (record: AgentSessionRecord) => Promise<AgentSessionJournal>
   /** Provider history sampled before a new child is acquired. `null` means the
    *  adapter had no usable history; omit to read lazily for direct callers. */
   providerHistoryWindow?: ProviderHistoryWindow | null
 }): Promise<AttachedJournal> {
   const identity = journalIdentityFor(input.record, input.params)
   const fence = input.record.lease.runtimeFence
-  const historyFilePath = input.adapter.historyFilePath
-    ? await input.adapter.historyFilePath({ identity })
-    : null
-  const opened = await openAgentSessionJournalWithRecovery({
+  const journal = await input.openConversation(input.record)
+  const settled = await reconcileAgainstProviderHistory({
+    adapter: input.adapter,
     identity,
-    journalDir: journalDirectoryFor(input.journalRoot, {
-      workspaceId: identity.workspaceId,
-      sessionId: identity.sessionId
-    }),
+    journal,
     fence,
-    historyFilePath
+    accountHome: input.record.accountHome,
+    ...(Object.hasOwn(input, 'providerHistoryWindow')
+      ? { history: input.providerHistoryWindow }
+      : {})
   })
-  try {
-    // That await is a WRITE. A failure in it leaves the journal with no caller
-    // holding a reference to close it.
-    const unconfirmed = await opened.journal.markPendingSubmissionsUnknown(fence)
-    const settled = await reconcileAgainstProviderHistory({
-      adapter: input.adapter,
-      identity,
-      journal: opened.journal,
-      fence,
-      accountHome: input.record.accountHome,
-      ...(Object.hasOwn(input, 'providerHistoryWindow')
-        ? { history: input.providerHistoryWindow }
-        : {})
-    })
-    return {
-      ...opened,
-      unconfirmedClientMessageIds: unconfirmed.filter((id) => !settled.includes(id))
-    }
-  } catch (error) {
-    // A rejected close leaves the handle open, so the journal is retained for a
-    // later retry rather than dropped along with the only reference to it.
-    await agentSessionJournalCloseRetries.closeOrRetain(opened.journal)
-    throw error
+  return {
+    journal,
+    unconfirmedClientMessageIds: journal
+      .submissions()
+      .filter(
+        (entry) =>
+          entry.dispatchState === 'unknown' &&
+          entry.recovered === true &&
+          !settled.includes(entry.clientMessageId)
+      )
+      .map((entry) => entry.clientMessageId)
   }
 }
 
@@ -317,10 +302,8 @@ export function reserveRequestFor(input: {
     provider: params.provider,
     accountHome: params.accountHome,
     ...(params.options ? { options: params.options } : {}),
-    // Create path only: an existing record keeps its own. Unreserved, it is the id every client
-    // still derives, so nothing keyed by it moves until those readers copy the recorded one.
-    ...(params.envelope.expectedRuntimeFence === null
-      ? { surfaceTabId: params.surfaceTabId ?? structuredAgentSessionTabId(input.sessionId) }
+    ...(params.envelope.expectedRuntimeFence === null && params.surfaceTabId
+      ? { surfaceTabId: params.surfaceTabId }
       : {}),
     ...(authority.launchArgs ? { launchArgs: authority.launchArgs } : {}),
     ...(authority.launchEnv ? { launchEnv: authority.launchEnv } : {}),
@@ -353,16 +336,21 @@ export function classifyStoreFailure(
   record: AgentSessionRecord | null = null
 ): AgentSessionWireRefusal {
   const rawCode = error instanceof Error ? error.message : String(error)
-  if (!(AGENT_SESSION_WIRE_REFUSAL_CODES as readonly string[]).includes(rawCode)) {
+  if (!isAgentSessionWireRefusalCode(rawCode)) {
     throw error
   }
-  const code = rawCode as AgentSessionWireRefusalCode
-  return {
-    code,
-    // Why: a latched session is exactly where a bare store code strands the user.
-    message:
-      structuredAgentSessionRefusalMessage(code, record) ??
-      `The session store refused this call: ${code}.`,
-    ...(code === 'agent_session_checkpoint_stale' && currentFence !== null ? { currentFence } : {})
-  }
+  // A refusal error's message is its code, so its details are this code's.
+  const emitted: AgentSessionRefusalReference =
+    error instanceof AgentSessionRefusalError
+      ? agentSessionRefusalReference(error.refusal)
+      : { code: rawCode }
+  // Why: a latched session is exactly where a bare store code strands the user.
+  const told = structuredAgentSessionRefusalMessage(emitted, record)
+  const reference = told?.reference ?? emitted
+  return agentSessionRefusalFromReference(
+    reference.code === 'agent_session_checkpoint_stale' && currentFence !== null
+      ? { code: reference.code, details: { ...reference.details, currentFence } }
+      : reference,
+    told?.message ?? `The session store refused this call: ${rawCode}.`
+  )
 }
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-background-task-channel.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-background-task-channel.ts
index 5d922d723503..a88949a296f5 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-background-task-channel.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-background-task-channel.ts
@@ -12,21 +12,25 @@ import type {
   StructuredAgentSessionHostDeps,
   StructuredAgentSessionHostSession
 } from './structured-agent-session-host-types'
+import { structuredAgentSessionConversationFence } from './structured-agent-session-provider-child'
 
 export class StructuredAgentSessionBackgroundTaskChannel {
   constructor(
     private readonly deps: StructuredAgentSessionHostDeps,
     private readonly sessions: Map<string, StructuredAgentSessionHostSession>,
     private readonly subscribers: AgentSessionSubscribers,
-    private readonly requireSession: (sessionId: string) => StructuredAgentSessionHostSession,
+    /** The host's accessor: opens a conversation at rest, and never starts an agent. */
+    private readonly conversation: (
+      sessionId: string
+    ) => Promise<StructuredAgentSessionHostSession>,
     /** Task edges change the status summary too; the feed's equality check
      *  keeps a no-op re-projection from reaching subscribers. */
     private readonly onPublished: (sessionId: string) => void
   ) {}
 
-  history(request: AgentSessionHistoryRequest): AgentSessionHistoryResult {
+  async history(request: AgentSessionHistoryRequest): Promise<AgentSessionHistoryResult> {
     const result = readStructuredAgentSessionHistoryResult({
-      journal: this.requireSession(request.sessionId).journal,
+      journal: (await this.conversation(request.sessionId)).journal,
       record: this.deps.store.getRecord(request.sessionId),
       request
     })
@@ -42,13 +46,14 @@ export class StructuredAgentSessionBackgroundTaskChannel {
     }
   }
 
-  subscribe(input: AgentSessionSubscribeInput): () => void {
-    const session = this.requireSession(input.sessionId)
+  /** Resolves once the conversation is open and the subscriber holds its opening frame. */
+  async subscribe(input: AgentSessionSubscribeInput): Promise<() => void> {
+    const session = await this.conversation(input.sessionId)
     const backgroundTasks = this.state(input.sessionId)
     return this.subscribers.open({
       ...input,
       journal: session.journal,
-      fence: this.deps.store.getRecord(input.sessionId)?.lease.runtimeFence ?? 0,
+      fence: structuredAgentSessionConversationFence(this.deps.store, input.sessionId),
       ...(backgroundTasks !== undefined ? { backgroundTasks } : {})
     })
   }
@@ -57,7 +62,11 @@ export class StructuredAgentSessionBackgroundTaskChannel {
     const session = this.sessions.get(sessionId)
     const state = publishedState !== undefined ? publishedState : this.state(sessionId)
     if (session && state !== undefined) {
-      this.subscribers.backgroundTasks(sessionId, state, session.fence)
+      this.subscribers.backgroundTasks(
+        sessionId,
+        state,
+        structuredAgentSessionConversationFence(this.deps.store, sessionId)
+      )
       this.onPublished(sessionId)
     }
   }
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-claude-root-exit.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-claude-root-exit.test.ts
index a73e46b898e7..4a8f0a1440f9 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-claude-root-exit.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-claude-root-exit.test.ts
@@ -11,7 +11,7 @@ import {
 import { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
 import { createTrackedJournalOpener } from '../agent-session-journal/journal-store-test-open'
 import type { AgentSessionAttachParams } from './structured-agent-session-attach'
-import { evictHeldStructuredAgentSession } from './structured-agent-session-host-lifetime'
+import { stopStructuredAgentSessionAgentUnderSerialize } from './structured-agent-session-host-lifetime'
 import { StructuredAgentSessionHostRuntimeState } from './structured-agent-session-host-runtime-state'
 import type { StructuredAgentSessionHostSession } from './structured-agent-session-host-types'
 
@@ -24,7 +24,7 @@ afterEach(async () => {
   await Promise.all(roots.splice(0).map((root) => rm(root, { recursive: true, force: true })))
 })
 
-describe('Claude root-exit eviction', () => {
+describe('Claude root-exit stop', () => {
   it('releases a captured live claim after the provider root exits', async () => {
     const root = await mkdtemp(join(tmpdir(), 'orca-claude-root-exit-'))
     roots.push(root)
@@ -78,6 +78,7 @@ describe('Claude root-exit eviction', () => {
       journalDir: join(root, 'journal')
     })
     const close = vi.spyOn(journal, 'close')
+    const publishStatus = vi.fn()
     const params: AgentSessionAttachParams = {
       envelope: {
         sessionId: 'session-1',
@@ -103,10 +104,11 @@ describe('Claude root-exit eviction', () => {
         {
           journal,
           params,
-          fence,
-          hasProviderChild: true,
-          providerChildPhase: 'ready',
-          acquisitionGeneration: acquisition.acquisitionGeneration ?? null
+          child: {
+            generation: acquisition.acquisitionGeneration ?? null,
+            fence,
+            phase: 'ready'
+          }
         }
       ]
     ])
@@ -115,13 +117,13 @@ describe('Claude root-exit eviction', () => {
 
     claude.connections[0]!.handlers.onExit?.(new Error('provider exited'))
     await expect(
-      evictHeldStructuredAgentSession(
+      stopStructuredAgentSessionAgentUnderSerialize(
         {
           deps,
           runtimeState,
           sessions,
           now: () => NOW + 30 * 60_000,
-          forgetStatus: vi.fn()
+          publishStatus
         },
         'session-1'
       )
@@ -132,8 +134,10 @@ describe('Claude root-exit eviction', () => {
       ownerProcess: null,
       deathEvidence: { kind: 'exit-observed' }
     })
-    expect(sessions.size).toBe(0)
-    expect(close).toHaveBeenCalledOnce()
+    // The agent went to rest; the conversation stays open and listed.
+    expect(sessions.get('session-1')?.child).toBeNull()
+    expect(close).not.toHaveBeenCalled()
+    expect(publishStatus).toHaveBeenCalledWith('session-1')
     // The adapter agrees the session is over: nothing is left to refuse the next start.
     await expect(adapter.closeSession('session-1')).resolves.toBe(true)
   })
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-client-delivery.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-client-delivery.ts
index aa3f298a0778..f5c7fb825f3d 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-client-delivery.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-client-delivery.ts
@@ -1,3 +1,4 @@
+import { AgentSessionRefusalError } from '../../../shared/agent-session-wire-refusals'
 import type { AgentChildWorkEvidence } from '../../../shared/agent-status-child-work-evidence'
 import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
 import { AgentSessionSubscribers } from './structured-agent-session-subscribers'
@@ -28,10 +29,20 @@ export class StructuredAgentSessionClientDelivery {
     private readonly sessions: Map<string, StructuredAgentSessionHostSession>,
     now: () => number,
     deps: () => StructuredAgentSessionHostDeps,
-    private readonly onJournalActivity?: (sessionId: string) => void
+    private readonly onJournalActivity?: (sessionId: string) => void,
+    onAgentStarted?: (sessionId: string) => void
   ) {
-    this.statusFeed = createStructuredAgentSessionHostStatusFeed({ sessions, now, deps })
-    this.turnCompletionFeed = new StructuredAgentSessionTurnCompletionFeed({ sessions, now })
+    this.statusFeed = createStructuredAgentSessionHostStatusFeed({
+      sessions,
+      now,
+      deps,
+      ...(onAgentStarted ? { onAgentStarted } : {})
+    })
+    this.turnCompletionFeed = new StructuredAgentSessionTurnCompletionFeed({
+      sessions,
+      now,
+      readStatusState: (sessionId, journal) => this.statusFeed.statusState(sessionId, journal)
+    })
     this.sendSettlement = new StructuredAgentSessionSendSettlement((sessionId) =>
       this.requireJournal(sessionId)
     )
@@ -66,10 +77,16 @@ export class StructuredAgentSessionClientDelivery {
     subscriber: StructuredAgentSessionTurnCompletionSubscriber
   ): (() => void) => this.turnCompletionFeed.subscribe(subscriber)
 
-  closeSession(sessionId: string): void {
+  /** The conversation's handle closed. Its status row stays in every session list; the
+   *  agent-status store keeps it too while the chat still has a tab to show it in. */
+  closeSession(sessionId: string, options: { listed: boolean }): void {
     this.sendSettlement.closeSession(sessionId)
-    this.statusFeed.close(sessionId)
-    // The next attach re-baselines rather than announcing the turn it was already holding.
+    if (options.listed) {
+      this.statusFeed.revokeLive(sessionId)
+    } else {
+      this.statusFeed.close(sessionId)
+    }
+    // The next open re-baselines rather than announcing the turn it was already holding.
     this.turnCompletionFeed.forget(sessionId)
   }
 
@@ -81,7 +98,8 @@ export class StructuredAgentSessionClientDelivery {
     this.statusFeed.publish(sessionId, journal)
     this.sendSettlement.publish(sessionId, journal)
     // Derived here rather than per-subscriber: this edge runs whether or not anyone is
-    // subscribed, which is the whole reason a backgrounded chat can complete at all.
+    // subscribed, which is the whole reason a backgrounded chat can complete at all. After the
+    // status publish, so it reads the projection that publish cached.
     this.turnCompletionFeed.observe(sessionId, journal)
     this.onJournalActivity?.(sessionId)
   }
@@ -89,7 +107,7 @@ export class StructuredAgentSessionClientDelivery {
   private requireJournal(sessionId: string): AgentSessionJournal {
     const journal = this.sessions.get(sessionId)?.journal
     if (!journal) {
-      throw new Error(AGENT_SESSION_NOT_ATTACHED.code)
+      throw new AgentSessionRefusalError(AGENT_SESSION_NOT_ATTACHED)
     }
     return journal
   }
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-close-retry.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-close-retry.test.ts
index b9e8f8e506d7..f5410de74f62 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-close-retry.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-close-retry.test.ts
@@ -78,10 +78,7 @@ function hostSession(journal: AgentSessionJournal): StructuredAgentSessionHostSe
   return {
     journal,
     params: {} as StructuredAgentSessionHostSession['params'],
-    fence: 1,
-    hasProviderChild: false,
-    providerChildPhase: 'ready',
-    acquisitionGeneration: null
+    child: null
   }
 }
 
@@ -138,7 +135,7 @@ function attachContext(
     reconcileLeases: async () => null,
     serialize: <T>(_sessionId: string, task: () => Promise<T>) => task(),
     now: () => 1,
-    forgetStatus: () => undefined
+    publishStatus: () => undefined
   } as unknown as StructuredAgentSessionAttachContext
 }
 
@@ -178,40 +175,34 @@ describe('the registry', () => {
 })
 
 describe('the attach orchestration', () => {
-  it('ABORTS the map replacement when the previous journal will not close', async () => {
-    const previousDir = join(root, 'previous')
-    const provisionalDir = join(root, 'provisional')
-    const previous = flakyClose(
-      await journals.open({ identity: IDENTITY, journalDir: previousDir }),
-      1
-    )
-    const provisional = await journals.open({
-      identity: IDENTITY,
-      journalDir: provisionalDir
-    })
-    attachFlow.journal = provisional
-    const sessions = new Map([[SESSION, hostSession(previous)]])
+  // The attach adopts the conversation's one open journal; it never opens a second handle, so
+  // there is no replacement to abort and no provisional journal to close.
+  it('keeps the journal it adopted indexed and open when an attach succeeds', async () => {
+    const directory = join(root, 'adopted')
+    const journal = await journals.open({ identity: IDENTITY, journalDir: directory })
+    attachFlow.journal = journal
+    const sessions = new Map([[SESSION, hostSession(journal)]])
 
-    await expect(
-      attachStructuredAgentSession(attachContext(sessions), 'caller-1', attachParams)
-    ).rejects.toThrow('close rejected')
+    await attachStructuredAgentSession(attachContext(sessions), 'caller-1', attachParams)
 
-    // The live entry is UNTOUCHED: overwriting it would have left its handle
-    // open with nothing able to reach it again.
-    expect(sessions.get(SESSION)?.journal).toBe(previous)
-    // And the provisional journal is owned by the registry, not orphaned.
+    expect(sessions.get(SESSION)?.journal).toBe(journal)
+    await expect(
+      journal.appendItem(
+        { provider: 'orca', clientMessageId: 'after-attach' },
+        {
+          kind: 'status',
+          text: 'still writable'
+        }
+      )
+    ).resolves.toBeDefined()
     expect(agentSessionJournalCloseRetries.pendingDirectories).toEqual([])
-    await expectNothingHoldsTheDirectory(provisionalDir)
   })
 
-  it('retains the provisional journal when its own close rejects on the barrier path', async () => {
-    const provisionalDir = join(root, 'provisional-barrier')
-    const provisional = flakyClose(
-      await journals.open({ identity: IDENTITY, journalDir: provisionalDir }),
-      1
-    )
-    attachFlow.journal = provisional
-    const sessions = new Map<string, StructuredAgentSessionHostSession>()
+  it('leaves the conversation indexed and open when the sink barrier fails', async () => {
+    const directory = join(root, 'adopted-barrier')
+    const journal = await journals.open({ identity: IDENTITY, journalDir: directory })
+    attachFlow.journal = journal
+    const sessions = new Map([[SESSION, hostSession(journal)]])
     const context = attachContext(sessions)
     const failing = {
       sink: {},
@@ -229,9 +220,19 @@ describe('the attach orchestration', () => {
       'sink barrier failed'
     )
 
-    expect(sessions.size).toBe(0)
-    // Retained rather than dropped, so teardown can still release the handle.
-    expect(agentSessionJournalCloseRetries.pendingDirectories).toEqual([provisionalDir])
+    // A failed attach does not end the conversation: its queued messages and the failure row
+    // are written into this same journal.
+    expect(sessions.get(SESSION)?.journal).toBe(journal)
+    await expect(
+      journal.appendItem(
+        { provider: 'orca', clientMessageId: 'after-failure' },
+        {
+          kind: 'status',
+          text: 'still writable'
+        }
+      )
+    ).resolves.toBeDefined()
+    expect(agentSessionJournalCloseRetries.pendingDirectories).toEqual([])
   })
 })
 
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-conversation-close.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-conversation-close.test.ts
new file mode 100644
index 000000000000..bf3cd1f96a60
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-conversation-close.test.ts
@@ -0,0 +1,326 @@
+// Stopping an agent and closing its conversation's handle are two things, and a reader, a session
+// list and a send each see only the one that happened. Ticks are driven by hand.
+
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { AgentSessionJournal } from '../agent-session-journal/journal-store'
+import type { AgentSessionStatusSummary } from '../../../shared/agent-session-wire'
+import { readStructuredSessionGateFacts } from '../../runtime/orchestration/structured-mailbox-pointer-host'
+import type { StructuredAgentSessionHostSession } from './structured-agent-session-host-types'
+import { setStructuredAgentSessionHost } from './structured-agent-session-registry'
+import {
+  collectSubscriber,
+  createRestTestRig,
+  foundRestTestChat,
+  IDLE_MS,
+  readerSaw,
+  REST_TEST_CALLER as CALLER,
+  REST_TEST_SESSION as SESSION,
+  restTestSend,
+  sweepOnce,
+  type RestTestRig
+} from './structured-agent-session-rest-test-rig'
+import { StructuredAgentSessionIdleSweep } from './structured-agent-session-idle-sweep'
+import { hostTestAttachParams } from './structured-agent-session-host-test-data'
+
+let rig: RestTestRig
+
+const COLD_START = { timeout: 10_000 }
+
+beforeEach(async () => {
+  rig = await createRestTestRig({ idleSweep: { intervalMs: 3_600_000 } })
+  setStructuredAgentSessionHost(rig.host)
+})
+
+afterEach(async () => {
+  setStructuredAgentSessionHost(null)
+  await rig.dispose()
+})
+
+function fence(): number {
+  return rig.store.getRecord(SESSION)?.lease.runtimeFence ?? 1
+}
+
+function openSession(): StructuredAgentSessionHostSession | undefined {
+  return rig.host.collaboratorsForTests().sessions.get(SESSION)
+}
+
+function statusRows(): AgentSessionStatusSummary[] {
+  return rig.statusEvents
+    .flatMap((event) => (event.type === 'status' ? [event.session] : []))
+    .filter((summary) => summary.sessionId === SESSION)
+}
+
+describe('a stop that fails', () => {
+  it('is retried on the next tick (P2-11 a)', async () => {
+    await foundRestTestChat(rig)
+    rig.adapter.closeSession.mockResolvedValueOnce(false)
+    rig.clock.now += IDLE_MS + 1
+
+    await sweepOnce(rig.host)
+    expect(openSession()?.owesProviderChildWindDown).toMatchObject({
+      generation: expect.any(String)
+    })
+    await sweepOnce(rig.host)
+
+    expect(rig.adapter.closeSession).toHaveBeenCalledTimes(2)
+    expect(rig.store.getRecord(SESSION)?.lease.claimStatus).toBe('released')
+    expect(statusRows().at(-1)?.hostExecutionOwned).toBeUndefined()
+  })
+
+  it('finishes its wind-down on the next tick, whatever its own writes did to the clock (P2-11 b)', async () => {
+    await foundRestTestChat(rig)
+    rig.clock.now += IDLE_MS + 1
+    // The child is proven gone and its work settled, then handing the lease back fails.
+    const transition = vi
+      .spyOn(rig.store, 'transitionHandoff')
+      .mockRejectedValueOnce(new Error('store unavailable'))
+
+    await sweepOnce(rig.host)
+    expect(transition).toHaveBeenCalledOnce()
+    expect(rig.store.getRecord(SESSION)?.lease.claimStatus).toBe('live')
+    // Five minutes later, not thirty.
+    rig.clock.now += 5 * 60_000
+    await sweepOnce(rig.host)
+
+    expect(rig.store.getRecord(SESSION)?.lease.claimStatus).toBe('released')
+    expect(rig.adapter.closeSession).toHaveBeenCalledOnce()
+  })
+})
+
+describe('closing the handle', () => {
+  it('keeps a tabbed chat listed and its reader open, and a send reopens it for that reader (P2-14)', async () => {
+    await foundRestTestChat(rig)
+    const reader = collectSubscriber()
+    await rig.host.subscribe({ id: 'reader', sessionId: SESSION, emit: reader.emit })
+    rig.clock.now += IDLE_MS + 1
+
+    await sweepOnce(rig.host)
+    expect(rig.host.hasSession(SESSION)).toBe(false)
+    // The row stays in the agent-status store, idle and no longer running here, and a session
+    // list that connects now still gets it.
+    expect(rig.sink.forget).not.toHaveBeenCalled()
+    expect(rig.sink.publish.mock.calls.at(-1)?.[0]).toMatchObject({ sessionId: SESSION })
+    expect(statusRows().at(-1)?.hostExecutionOwned).toBeUndefined()
+    const late: { type: string; sessions?: AgentSessionStatusSummary[] }[] = []
+    rig.host.subscribeStatus({ id: 'late', emit: (event) => late.push(event) })
+    expect(late[0]?.sessions?.map((summary) => summary.sessionId)).toContain(SESSION)
+    expect(reader.events.some((event) => event.type === 'end')).toBe(false)
+
+    const sent = await rig.host.send(CALLER, restTestSend('after the close', fence()))
+    expect(sent.ok).toBe(true)
+    // A cold start: reopen, reconcile and acquire.
+    await vi.waitFor(() => expect(rig.adapter.dispatch).toHaveBeenCalledTimes(2), COLD_START)
+    // The reader opened on the first handle is fed by the second.
+    await vi.waitFor(() => expect(readerSaw(reader.events).texts).toContain('after the close'))
+  })
+
+  it('drops the agent-status row of a chat whose tab is gone (P2-14, retired)', async () => {
+    await foundRestTestChat(rig)
+    await rig.store.setSessionTabVisibility(SESSION, false)
+    rig.clock.now += IDLE_MS + 1
+
+    await sweepOnce(rig.host)
+    expect(rig.host.hasSession(SESSION)).toBe(false)
+    expect(rig.sink.forget).toHaveBeenCalled()
+  })
+
+  it('forgets the row of a resting chat once its tab closes (P2-32)', async () => {
+    await foundRestTestChat(rig)
+    rig.clock.now += IDLE_MS + 1
+    await sweepOnce(rig.host)
+    expect(rig.sink.forget).not.toHaveBeenCalled()
+
+    await rig.host.setSessionTabVisibility(SESSION, false)
+    expect(rig.sink.forget).toHaveBeenCalled()
+  })
+
+  it('keeps the row when a chat with an open tab is evicted, and forgets it once the tab closes', async () => {
+    await foundRestTestChat(rig)
+
+    await rig.host.close(SESSION)
+    expect(rig.adapter.closeSession).toHaveBeenCalledWith(SESSION)
+    // The stop says not-running; the row belongs to the tab, so nothing forgets it.
+    expect(rig.sink.forget).not.toHaveBeenCalled()
+    expect(rig.sink.publish.mock.calls.at(-1)?.[0]).toMatchObject({ sessionId: SESSION })
+    expect(rig.sink.publish.mock.calls.at(-1)?.[0].hostExecutionOwned).toBeUndefined()
+
+    await rig.host.setSessionTabVisibility(SESSION, false)
+    expect(rig.sink.forget).toHaveBeenCalledOnce()
+  })
+
+  it('never hands a reader a handle it is closing (P2-25)', async () => {
+    await foundRestTestChat(rig)
+    const journal = openSession()?.journal
+    if (!journal) {
+      throw new Error('the conversation should be open')
+    }
+    const closing = Promise.withResolvers<void>()
+    const gate = Promise.withResolvers<void>()
+    const close = journal.close.bind(journal)
+    vi.spyOn(journal, 'close').mockImplementation(async () => {
+      await close()
+      closing.resolve()
+      await gate.promise
+    })
+    rig.clock.now += IDLE_MS + 1
+    const tick = sweepOnce(rig.host)
+    await closing.promise
+
+    const history = rig.host.history({ sessionId: SESSION, direction: 'tail' })
+    const facts = readStructuredSessionGateFacts(SESSION)
+    gate.resolve()
+    await tick
+
+    const page = await history
+    expect(page.ok && page.page.items.length).toBeGreaterThan(0)
+    await expect(facts).resolves.not.toBeNull()
+    // And the handle a write finds is a live one.
+    const sent = await rig.host.send(CALLER, restTestSend('after the close', fence()))
+    expect(sent.ok).toBe(true)
+    // A cold start: reopen, reconcile and acquire.
+    await vi.waitFor(() => expect(rig.adapter.dispatch).toHaveBeenCalledTimes(2), COLD_START)
+  })
+
+  it('never re-enters the session lock: a send and a Stop right after still finish (P2-28)', async () => {
+    await foundRestTestChat(rig)
+    rig.clock.now += IDLE_MS + 1
+    const tick = sweepOnce(rig.host)
+    const within = <T>(work: Promise<T>) =>
+      Promise.race([
+        work,
+        new Promise<never>((_, reject) => setTimeout(() => reject(new Error('wedged')), 2_000))
+      ])
+    const sent = within(rig.host.send(CALLER, restTestSend('right after', fence())))
+
+    await within(tick)
+    expect(await sent).toMatchObject({ ok: true })
+    await vi.waitFor(() => expect(rig.adapter.dispatch).toHaveBeenCalledTimes(2))
+    await expect(within(sweepOnce(rig.host))).resolves.toBeUndefined()
+  })
+})
+
+describe('the sweep and the lease (P2-20)', () => {
+  it('reads only open conversations and never probes or resolves a lease', async () => {
+    await foundRestTestChat(rig)
+    const probeOwner = vi.fn(async () => ({ outcome: 'pid-absent' as const }))
+    await rig.restart({ probeOwner })
+    setStructuredAgentSessionHost(rig.host)
+    await rig.store.transitionHandoff(SESSION, (current) => ({
+      ...current,
+      lease: { ...current.lease, handoffStage: 'recovering' }
+    }))
+    const resolveRecovery = vi.spyOn(
+      rig.host.collaboratorsForTests().runtimeState,
+      'resolveRecovery'
+    )
+    // Open, at rest, on a lease still recovering.
+    await rig.host.journalSnapshot(SESSION)
+    expect(rig.host.hasSession(SESSION)).toBe(true)
+    rig.clock.now += IDLE_MS + 1
+
+    await sweepOnce(rig.host)
+    expect(rig.host.hasSession(SESSION)).toBe(false)
+    expect(probeOwner).not.toHaveBeenCalled()
+    expect(resolveRecovery).not.toHaveBeenCalled()
+  })
+})
+
+describe('a start that never finishes (P2-15)', () => {
+  it('is stopped by the sweep, and the delivery loop alone writes its one row and rejection', async () => {
+    const stopReason = 'Codex never finished starting, so Orca stopped it.'
+    const order: string[] = []
+    const started = Promise.withResolvers<void>()
+    rig.adapter.closeSession.mockImplementation(async () => {
+      order.push('stopped')
+      started.resolve()
+      return true
+    })
+    const spawn = rig.adapter.acquire.getMockImplementation()!
+    rig.adapter.acquire.mockImplementationOnce(async (input) => ({
+      ...(await spawn(input)),
+      providerChildPhase: 'starting' as const
+    }))
+    Object.assign(rig.host.deps.adapter, { awaitStarted: () => started.promise })
+    const reject = AgentSessionJournal.prototype.rejectQueuedSubmissions
+    vi.spyOn(AgentSessionJournal.prototype, 'rejectQueuedSubmissions').mockImplementation(function (
+      this: AgentSessionJournal,
+      ...args
+    ) {
+      // Not the open's sweep of an earlier process's leftovers.
+      if (args[1].rejection.kind !== 'hostRestarted') {
+        order.push(`rejected: ${args[1].reason}`)
+      }
+      return reject.apply(this, args)
+    })
+    const reader = collectSubscriber()
+    const attached = await rig.host.attach(CALLER, hostTestAttachParams(null))
+    expect(attached.ok).toBe(true)
+    await rig.host.subscribe({ id: 'reader', sessionId: SESSION, emit: reader.emit })
+    const sent = await rig.host.send(CALLER, restTestSend('stuck behind the start', fence()))
+    expect(sent.ok).toBe(true)
+    rig.clock.now += IDLE_MS + 1
+
+    await sweepOnce(rig.host)
+    expect(rig.adapter.closeSession).toHaveBeenCalledWith(SESSION)
+    await vi.waitFor(() =>
+      expect(readerSaw(reader.events).submissions).toContainEqual(
+        expect.objectContaining({ dispatchState: 'rejected', reason: stopReason })
+      )
+    )
+    // One rejection, written after the stop by the loop, with the stop's own words.
+    expect(order).toEqual(['stopped', `rejected: ${stopReason}`])
+    const errorRows = reader.events.flatMap((event) =>
+      event.type === 'batch'
+        ? event.batch.items.filter(
+            (item) => item.body.kind === 'status' && item.body.tone === 'error'
+          )
+        : []
+    )
+    expect(errorRows.map((item) => (item.body.kind === 'status' ? item.body.text : null))).toEqual([
+      stopReason
+    ])
+    expect(rig.adapter.dispatch).not.toHaveBeenCalled()
+
+    const again = await rig.host.send(CALLER, restTestSend('try again', fence()))
+    expect(again.ok).toBe(true)
+    await vi.waitFor(() => expect(rig.adapter.dispatch).toHaveBeenCalledOnce(), COLD_START)
+    await expect(sweepOnce(rig.host)).resolves.toBeUndefined()
+  })
+})
+
+describe('the wind-down retry with a message queued (P2-31)', () => {
+  it('waits for the delivery rather than rejecting a message accepted after the failed stop', async () => {
+    const queued = { clientMessageId: 'm', dispatchState: 'pending', handoverRecorded: true }
+    const session = {
+      journal: {
+        submissions: () => [queued],
+        pendingSubmissions: () => [queued],
+        snapshot: () => ({ items: [] })
+      },
+      child: null,
+      owesProviderChildWindDown: { generation: 'generation-1', fence: 1 }
+    }
+    const stopAgent = vi.fn(async () => undefined)
+    const sweep = new StructuredAgentSessionIdleSweep({
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: a session fixture carrying only the journal and child facts the sweep reads.
+      sessions: Object.assign(new Map([[SESSION, session as never]]), {
+        lastActivityAt: () => 0,
+        touch: () => undefined
+      }),
+      serialize: (_id, task) => task(),
+      now: () => IDLE_MS + 1,
+      isDisposed: () => false,
+      deliveryActive: () => true,
+      backgroundTaskState: () => undefined,
+      hasOpenDispatch: () => false,
+      stopAgent,
+      stopStartingAgent: stopAgent,
+      closeConversation: vi.fn(async () => false),
+      onError: (_id, error) => {
+        throw error
+      }
+    })
+    await sweep.tick()
+    expect(stopAgent).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-conversation-lifetime.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-conversation-lifetime.ts
new file mode 100644
index 000000000000..e81eb9ae9763
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-conversation-lifetime.ts
@@ -0,0 +1,143 @@
+// How a conversation is reached, closed and swept — the host's lifetime rules in one place.
+//
+// A conversation is reached only through `conversation`, which opens it at rest and starts no
+// agent. It closes when its tab closes or the idle sweep finds its handle is only a cache. Every
+// public entry point here takes the session's serialize once and calls the under-serialize forms,
+// because the queue is not reentrant.
+
+import { TUI_AGENT_DISPLAY_NAMES } from '../../../shared/tui-agent-display-names'
+import {
+  AgentSessionRefusalError,
+  agentSessionRefusalError
+} from '../../../shared/agent-session-wire-refusals'
+import type { StructuredAgentSessionConversations } from './structured-agent-session-conversations'
+import {
+  abandonQueuedStructuredAgentSessionMessages,
+  closeStructuredAgentSessionConversationUnderSerialize,
+  stopStructuredAgentSessionAgentUnderSerialize,
+  type StructuredAgentSessionLifetimeContext
+} from './structured-agent-session-host-lifetime'
+import type { StructuredAgentSessionHostSession } from './structured-agent-session-host-types'
+import { StructuredAgentSessionIdleSweep } from './structured-agent-session-idle-sweep'
+import { AGENT_SESSION_NOT_ATTACHED } from './structured-agent-session-mutation-admission'
+import { adapterSupportsRecord } from './structured-agent-session-provider-support'
+
+export type StructuredAgentSessionConversationLifetime = ReturnType<
+  typeof createStructuredAgentSessionConversationLifetime
+>
+
+export function createStructuredAgentSessionConversationLifetime(host: {
+  /** Resolved per call: the host's collaborators are assigned after this is built. */
+  context: () => StructuredAgentSessionLifetimeContext
+  sessions: StructuredAgentSessionConversations
+  serialize: <T>(sessionId: string, task: () => Promise<T>) => Promise<T>
+  /** PR 1's one open function, for a caller inside the session's serialize. */
+  open: (sessionId: string) => Promise<StructuredAgentSessionHostSession | null>
+  deliveryActive: (sessionId: string) => boolean
+  /** The handle closed: `listed` keeps the chat's row in the agent-status store for its tab. */
+  closeStatus: (sessionId: string, options: { listed: boolean }) => void
+}) {
+  let disposed = false
+  const { sessions, serialize } = host
+  const deps = () => host.context().deps
+  // The sweep's stop puts an idle agent to rest: nothing is queued, so no loop reads its cause.
+  const stopAgent = (sessionId: string) =>
+    stopStructuredAgentSessionAgentUnderSerialize(host.context(), sessionId)
+
+  const closeConversation = (sessionId: string): Promise<boolean> =>
+    closeStructuredAgentSessionConversationUnderSerialize(
+      {
+        sessions,
+        closeStatus: (id) => {
+          const tabs = deps().store.getVisibleSessionTabIndex()
+          // A legacy store cannot say, so the row stays; restart is the boundary that forgets.
+          host.closeStatus(id, { listed: !tabs.present || tabs.sessionIds.includes(id) })
+        }
+      },
+      sessionId
+    )
+
+  const idleSweep = new StructuredAgentSessionIdleSweep({
+    sessions,
+    serialize,
+    now: () => host.context().now(),
+    isDisposed: () => disposed,
+    deliveryActive: host.deliveryActive,
+    backgroundTaskState: (sessionId) => deps().adapter.backgroundTaskState?.(sessionId),
+    hasOpenDispatch: (sessionId) => {
+      const record = deps().store.getRecord(sessionId)
+      return record !== null && deps().hasOpenDispatch?.(record) === true
+    },
+    stopAgent,
+    // A host stop with its reason: the delivery loop waiting on this child writes the one error
+    // row and rejects what is queued with it.
+    stopStartingAgent: (sessionId) =>
+      stopStructuredAgentSessionAgentUnderSerialize(host.context(), sessionId, {
+        cause: 'host-stop',
+        reason: `${TUI_AGENT_DISPLAY_NAMES[sessions.get(sessionId)?.params.provider ?? 'claude']} never finished starting, so Orca stopped it.`
+      }),
+    closeConversation,
+    onError: (sessionId, error) => deps().onEventSinkError?.({ sessionId, error }),
+    ...deps().idleSweep
+  })
+
+  return {
+    idleSweep,
+    stopAgent,
+    /** Quit has begun: nothing opens a conversation or sweeps one after this. */
+    dispose: (): void => {
+      disposed = true
+      idleSweep.dispose()
+    },
+    /**
+     * The only way any code reaches a session. An open conversation answers without the lock, so
+     * a read never waits behind a start; a closed one is opened once, under it. Nothing here
+     * touches the lease or starts a child. Use the result before the next `await`: a close can
+     * drop it after.
+     */
+    conversation: async (sessionId: string): Promise<StructuredAgentSessionHostSession> => {
+      const open = sessions.get(sessionId)
+      if (open) {
+        return open
+      }
+      const record = deps().store.getRecord(sessionId)
+      if (!record) {
+        throw agentSessionRefusalError('agent_session_identity_required', {
+          reason: 'recordMissing'
+        })
+      }
+      if (!adapterSupportsRecord(deps().adapter, record)) {
+        throw agentSessionRefusalError('structured_agent_session_unsupported', {
+          reason: 'hostUnsupported'
+        })
+      }
+      return serialize(sessionId, async () => {
+        // Read at the open itself: a read queued before quit began runs after it.
+        if (disposed) {
+          throw new AgentSessionRefusalError(AGENT_SESSION_NOT_ATTACHED)
+        }
+        const session = await host.open(sessionId)
+        if (!session) {
+          throw agentSessionRefusalError('agent_session_identity_required', {
+            reason: 'recordMissing'
+          })
+        }
+        return session
+      })
+    },
+    /** Ends a chat's resources, not the chat: its record and journal stay on disk, and what is
+     *  still queued will not be sent. */
+    close: (sessionId: string): Promise<void> =>
+      serialize(sessionId, async () => {
+        const session = sessions.get(sessionId)
+        if (session) {
+          // Abandoned before the stop, so no start delivers it.
+          await abandonQueuedStructuredAgentSessionMessages(deps(), sessionId, session.journal)
+        }
+        await stopStructuredAgentSessionAgentUnderSerialize(host.context(), sessionId, {
+          cause: 'evict'
+        })
+        await closeConversation(sessionId)
+      })
+  }
+}
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-conversation-open.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-conversation-open.ts
new file mode 100644
index 000000000000..bce79ca71f87
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-conversation-open.ts
@@ -0,0 +1,161 @@
+// The one way a conversation's journal becomes open on this host: for a send, for a reader, and
+// for an attach that finds none open.
+//
+// It opens with recovery, so an unusable journal is rebuilt rather than refused, and it marks what
+// an earlier host process handed over and left unanswered as in doubt, and settles what it left
+// running — the crash boundary. That
+// needs no lease: provider history decides such a row later, under a won lease, in the attach. A
+// row an earlier process accepted and never handed over is the delivery loop's, which the open
+// wakes. Nothing here starts a provider child.
+
+import type { AgentJournalResetReason } from '../../../shared/agent-session-journal-types'
+import { journalDirectoryFor } from '../agent-session-journal/journal-paths'
+import { openAgentSessionJournalWithRecovery } from './agent-session-journal-recovery'
+import { computeAgentSessionPayloadFingerprint } from '../../../shared/agent-session-mutation-envelope'
+import type { AgentSessionRecord } from '../../../shared/agent-session-record'
+import {
+  attachFingerprintFields,
+  journalIdentityFor,
+  type AgentSessionAttachParams
+} from './structured-agent-session-attach'
+import type { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
+import type { StructuredAgentSessionAdapter } from './structured-agent-session-adapter'
+import { settleStaleStructuredAgentSessionState } from './structured-agent-session-dead-generation-settlement'
+import { structuredAgentSessionFailureWordsContext } from './structured-agent-session-send-preparation'
+import type {
+  StructuredAgentSessionHostDeps,
+  StructuredAgentSessionHostSession
+} from './structured-agent-session-host-types'
+
+export type OpenedStructuredAgentSessionConversation = {
+  session: StructuredAgentSessionHostSession
+  /** Set when the journal was rebuilt on the way; readers reload from a snapshot. */
+  reset: AgentJournalResetReason | null
+}
+
+export type StructuredAgentSessionConversationOpenDeps = {
+  store: Pick<AgentSessionRecordStore, 'getRecord'>
+  adapter: Pick<StructuredAgentSessionAdapter, 'historyFilePath'>
+  journalRoot: string
+  onEventSinkError?: StructuredAgentSessionHostDeps['onEventSinkError']
+}
+
+/** An acquisition's own open: its reserve cleared the record's death evidence, so it settles
+ *  what the gone generation left running itself, from what it read before. */
+export type StructuredAgentSessionConversationOpenOptions = { acquisition?: boolean }
+
+export type StructuredAgentSessionConversationOpenContext = {
+  deps: StructuredAgentSessionConversationOpenDeps
+  sessions: Map<string, StructuredAgentSessionHostSession>
+  /** Indexes a conversation that just became open; the host publishes it and wakes delivery. */
+  adoptOpened: (
+    sessionId: string,
+    opened: OpenedStructuredAgentSessionConversation
+  ) => Promise<void>
+}
+
+/** The open conversation, or null when this host has no record of it. For a caller inside the
+ *  session's serialize, which is what makes "not open yet" exact. */
+export async function openStructuredAgentSessionConversation(
+  context: StructuredAgentSessionConversationOpenContext,
+  sessionId: string,
+  options: StructuredAgentSessionConversationOpenOptions = {}
+): Promise<StructuredAgentSessionHostSession | null> {
+  const open = context.sessions.get(sessionId)
+  if (open) {
+    return open
+  }
+  const record = context.deps.store.getRecord(sessionId)
+  if (!record) {
+    return null
+  }
+  const opened = await openStructuredAgentSessionConversationJournal(context.deps, record, options)
+  await context.adoptOpened(sessionId, opened)
+  return opened.session
+}
+
+/** The open itself, indexed by nobody yet: the caller adopts the result. */
+export async function openStructuredAgentSessionConversationJournal(
+  deps: Omit<StructuredAgentSessionConversationOpenDeps, 'store'>,
+  record: AgentSessionRecord,
+  options: StructuredAgentSessionConversationOpenOptions = {}
+): Promise<OpenedStructuredAgentSessionConversation> {
+  const { sessionId } = record
+  const fence = record.lease.runtimeFence
+  const params = attachParamsForRecord(record, {
+    clientOperationId: `read-restore:${sessionId}`,
+    expectedRuntimeFence: fence
+  })
+  const identity = journalIdentityFor(record, params)
+  const opened = await openAgentSessionJournalWithRecovery({
+    identity,
+    journalDir: journalDirectoryFor(deps.journalRoot, {
+      workspaceId: record.location.workspaceId,
+      sessionId
+    }),
+    fence,
+    historyFilePath: (await deps.adapter.historyFilePath?.({ identity })) ?? null
+  })
+  try {
+    // A queued row found here is a leftover the delivery loop's first step rejects; a handed-over
+    // one is only doubt, which provider history decides under a won lease.
+    await opened.journal.markPendingSubmissionsUnknown(fence)
+  } catch (error) {
+    deps.onEventSinkError?.({ sessionId, error })
+  }
+  try {
+    // No child in this process writes to a journal nobody had open, so whatever it shows running
+    // belongs to a generation that is gone, whatever the lease still claims. Settled before any
+    // reader or child sees it.
+    if (!options.acquisition) {
+      await settleStaleStructuredAgentSessionState({
+        journal: opened.journal,
+        sessionId,
+        fence,
+        acquisitionGeneration: null,
+        deathEvidence: record.lease.deathEvidence ?? null,
+        failureTextContext: structuredAgentSessionFailureWordsContext(record)
+      })
+    }
+  } catch (error) {
+    // Best effort: the next acquire re-derives it.
+    deps.onEventSinkError?.({ sessionId, error })
+  }
+  return {
+    session: { journal: opened.journal, params, child: null },
+    reset: opened.recovery?.reset ?? null
+  }
+}
+
+export function attachParamsForRecord(
+  record: AgentSessionRecord,
+  input: {
+    clientOperationId: string
+    expectedRuntimeFence: number
+  }
+): AgentSessionAttachParams {
+  const params: AgentSessionAttachParams = {
+    envelope: {
+      sessionId: record.sessionId,
+      clientOperationId: input.clientOperationId,
+      expectedRuntimeFence: input.expectedRuntimeFence,
+      payloadFingerprint: ''
+    },
+    location: record.location,
+    provider: record.provider,
+    agent: record.provider,
+    accountHome: record.accountHome,
+    runtimeKind: 'native'
+  }
+  return {
+    ...params,
+    envelope: {
+      ...params.envelope,
+      payloadFingerprint: computeAgentSessionPayloadFingerprint({
+        method: 'agentSession.attach',
+        sessionId: record.sessionId,
+        fields: attachFingerprintFields(params)
+      })
+    }
+  }
+}
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-conversations.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-conversations.test.ts
new file mode 100644
index 000000000000..b294540990d9
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-conversations.test.ts
@@ -0,0 +1,160 @@
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import type { AgentSessionJournalIdentity } from '../../../shared/agent-session-journal-types'
+import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
+import { createTrackedJournalOpener } from '../agent-session-journal/journal-store-test-open'
+import { StructuredAgentSessionConversations } from './structured-agent-session-conversations'
+import type { StructuredAgentSessionHostSession } from './structured-agent-session-host-types'
+import { hostTestAttachParams } from './structured-agent-session-host-test-data'
+
+const IDENTITY: AgentSessionJournalIdentity = {
+  sessionId: 'session-1',
+  workspaceId: 'workspace-1',
+  hostId: 'host-1',
+  agent: 'codex',
+  providerHandle: { kind: 'codex', threadId: 'thread-1' }
+}
+
+const journals = createTrackedJournalOpener()
+let root: string | null = null
+
+afterEach(async () => {
+  await journals.closeAll()
+  if (root) {
+    await rm(root, { recursive: true, force: true })
+    root = null
+  }
+})
+
+async function openJournal(name: string): Promise<AgentSessionJournal> {
+  root ??= await mkdtemp(join(tmpdir(), 'orca-conversations-'))
+  return journals.open({ identity: IDENTITY, journalDir: join(root, name) })
+}
+
+function session(journal: AgentSessionJournal) {
+  return {
+    journal,
+    params: hostTestAttachParams(null),
+    child: null
+  }
+}
+
+function appendStatus(journal: AgentSessionJournal, text: string) {
+  return journal.appendItem(
+    { provider: 'orca', clientMessageId: text },
+    { kind: 'status', text },
+    { fence: 0 }
+  )
+}
+
+describe('a conversation delivers what its journal commits', () => {
+  it('delivers an append that no writer published', async () => {
+    const deliver = vi.fn()
+    const conversations = new StructuredAgentSessionConversations({
+      deliver,
+      onDeliveryError: vi.fn(),
+      now: () => 0
+    })
+    const journal = await openJournal('a')
+    conversations.set('session-1', session(journal))
+
+    await appendStatus(journal, 'written')
+
+    // Already delivered when the writer's await returns, as an explicit publish would have been.
+    expect(deliver).toHaveBeenCalledOnce()
+    expect(deliver).toHaveBeenCalledWith('session-1', journal)
+  })
+
+  it('binds a handle set through a plain map reference', async () => {
+    const deliver = vi.fn()
+    // Collaborators hold the host's map as a plain `Map`; `set` still reaches the binding.
+    const sessions: Map<string, StructuredAgentSessionHostSession> =
+      new StructuredAgentSessionConversations({
+        deliver,
+        onDeliveryError: vi.fn(),
+        now: () => 0
+      })
+    const journal = await openJournal('a')
+    sessions.set('session-1', session(journal))
+
+    await appendStatus(journal, 'through the plain map')
+
+    expect(deliver).toHaveBeenCalledExactlyOnceWith('session-1', journal)
+  })
+
+  it('delivers an epoch replacement, which readers must reload from', async () => {
+    const deliver = vi.fn()
+    const conversations = new StructuredAgentSessionConversations({
+      deliver,
+      onDeliveryError: vi.fn(),
+      now: () => 0
+    })
+    const journal = await openJournal('a')
+    conversations.set('session-1', session(journal))
+
+    await journal.replaceEpochItems('handle_forked', 0, [])
+
+    expect(deliver).toHaveBeenCalledExactlyOnceWith('session-1', journal)
+  })
+
+  it('delivers nothing for a handle the conversation has replaced', async () => {
+    const deliver = vi.fn()
+    const conversations = new StructuredAgentSessionConversations({
+      deliver,
+      onDeliveryError: vi.fn(),
+      now: () => 0
+    })
+    const replaced = await openJournal('a')
+    const current = await openJournal('b')
+    conversations.set('session-1', session(replaced))
+    conversations.set('session-1', session(current))
+
+    await appendStatus(replaced, 'stale')
+    expect(deliver).not.toHaveBeenCalled()
+
+    await appendStatus(current, 'live')
+    expect(deliver).toHaveBeenCalledExactlyOnceWith('session-1', current)
+  })
+
+  it('delivers nothing once the conversation is dropped', async () => {
+    const deliver = vi.fn()
+    const conversations = new StructuredAgentSessionConversations({
+      deliver,
+      onDeliveryError: vi.fn(),
+      now: () => 0
+    })
+    const journal = await openJournal('a')
+    conversations.set('session-1', session(journal))
+    conversations.delete('session-1')
+
+    await appendStatus(journal, 'after close')
+
+    expect(deliver).not.toHaveBeenCalled()
+  })
+
+  it('reports a reader failure without failing the durable write', async () => {
+    const failure = new Error('reader failed')
+    const onDeliveryError = vi.fn()
+    const conversations = new StructuredAgentSessionConversations({
+      deliver: () => {
+        throw failure
+      },
+      onDeliveryError,
+      now: () => 0
+    })
+    const journal = await openJournal('a')
+    conversations.set('session-1', session(journal))
+
+    await expect(appendStatus(journal, 'durable')).resolves.toMatchObject({
+      itemId: expect.any(String)
+    })
+
+    expect(onDeliveryError).toHaveBeenCalledExactlyOnceWith('session-1', failure)
+    expect(journal.snapshot().items.map((item) => item.body)).toContainEqual({
+      kind: 'status',
+      text: 'durable'
+    })
+  })
+})
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-conversations.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-conversations.ts
new file mode 100644
index 000000000000..6fcaef07483a
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-conversations.ts
@@ -0,0 +1,69 @@
+import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
+import type { StructuredAgentSessionHostSession } from './structured-agent-session-host-types'
+
+/**
+ * The host's open conversations. A journal handle becomes a conversation's when it is set here,
+ * and from then on every change it commits reaches that conversation's readers: no writer
+ * publishes what it appended, so none can forget to.
+ *
+ * Delivery runs a microtask after the commit, so a reader that throws cannot fail a write that is
+ * already durable. A handle this map has since replaced or dropped delivers nothing.
+ *
+ * Each entry also carries when it last saw activity — its open, then every journal publish — which
+ * is the idle sweep's clock. In memory only, so it dies with the entry.
+ */
+export class StructuredAgentSessionConversations extends Map<
+  string,
+  StructuredAgentSessionHostSession
+> {
+  private readonly activity = new Map<string, number>()
+
+  constructor(
+    private readonly delivery: {
+      deliver: (sessionId: string, journal: AgentSessionJournal) => void
+      onDeliveryError: (sessionId: string, error: unknown) => void
+      now: () => number
+    }
+  ) {
+    super()
+  }
+
+  override set(sessionId: string, session: StructuredAgentSessionHostSession): this {
+    const { journal } = session
+    let queued = false
+    journal.observeCommits(() => {
+      if (queued) {
+        return
+      }
+      queued = true
+      queueMicrotask(() => {
+        queued = false
+        if (this.get(sessionId)?.journal !== journal) {
+          return
+        }
+        try {
+          this.delivery.deliver(sessionId, journal)
+        } catch (error) {
+          this.delivery.onDeliveryError(sessionId, error)
+        }
+      })
+    })
+    this.activity.set(sessionId, this.delivery.now())
+    return super.set(sessionId, session)
+  }
+
+  override delete(sessionId: string): boolean {
+    this.activity.delete(sessionId)
+    return super.delete(sessionId)
+  }
+
+  touch(sessionId: string): void {
+    if (this.has(sessionId)) {
+      this.activity.set(sessionId, this.delivery.now())
+    }
+  }
+
+  lastActivityAt(sessionId: string): number | undefined {
+    return this.activity.get(sessionId)
+  }
+}
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-crash-mid-start.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-crash-mid-start.test.ts
new file mode 100644
index 000000000000..6e364ccb477b
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-crash-mid-start.test.ts
@@ -0,0 +1,237 @@
+// A host that dies while its Codex child is still starting leaves a lease behind. The child's
+// identity is committed the moment it spawns, before the handshake, so the next host can stop that
+// exact process and start over instead of guessing whether anything is running.
+
+import { cp, mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import {
+  AGENT_SESSION_MAX_NEW_OPERATION_AGE_MS,
+  AGENT_SESSION_OPERATION_FUTURE_SKEW_MS
+} from '../../../shared/agent-session-host-authority'
+import type { AgentSessionOwnerProbe } from '../../../shared/agent-session-lease-adjudication'
+import type { openCodexAppServerConnection } from '../../codex/codex-app-server-connection'
+import { adapterFor, fakeCodex } from '../../codex/codex-structured-session-adapter-fixture'
+import { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
+import type { StructuredAgentSessionAdapter } from './structured-agent-session-adapter'
+import { StructuredAgentSessionHost } from './structured-agent-session-host'
+import type { StructuredAgentSessionHostDeps } from './structured-agent-session-host-types'
+import {
+  HOST_TEST_NOW as NOW,
+  HOST_TEST_SESSION as SESSION,
+  hostTestAttachParams,
+  resetHostTestOperationIds
+} from './structured-agent-session-host-test-data'
+
+const CALLER = { callerKey: 'client-1' }
+const CHILD_PID = 4321
+
+let root: string
+
+beforeEach(async () => {
+  root = await mkdtemp(join(tmpdir(), 'orca-crash-mid-start-'))
+  resetHostTestOperationIds()
+})
+
+afterEach(async () => {
+  await rm(root, { recursive: true, force: true })
+})
+
+type HostGeneration = 'dying' | 'relaunched'
+
+/** Each generation's files. The relaunch opens a copy taken at the crash: the dying host stays in
+ *  this process with its attach still pending, and a dead process writes nothing after it dies. */
+function generationRoot(generation: HostGeneration): string {
+  return join(root, generation)
+}
+
+async function crash(dying: AgentSessionRecordStore): Promise<void> {
+  // An empty renewal queues behind every write the dying host committed, so they are on disk.
+  await dying.renewLeases([])
+  await cp(generationRoot('dying'), generationRoot('relaunched'), {
+    recursive: true,
+    // A write still in flight at the crash never landed, and a dead process holds no lock.
+    filter: (source) => !source.endsWith('.tmp') && !source.includes('.lock')
+  })
+}
+
+function openStore(generation: HostGeneration): Promise<AgentSessionRecordStore> {
+  return AgentSessionRecordStore.open({
+    directory: join(generationRoot(generation), 'store'),
+    hostId: 'local'
+  })
+}
+
+/** A Codex adapter whose child spawns, reports its pid the way the real connection does, and then
+ *  never answers the thread handshake: the host dies in that window. */
+function adapterThatNeverFinishesStarting(): StructuredAgentSessionAdapter {
+  const codex = fakeCodex({
+    'thread/start': () => new Promise(() => {}),
+    'thread/resume': () => new Promise(() => {})
+  })
+  const openConnection: typeof openCodexAppServerConnection = async (launch, handlers = {}) => {
+    const connection = await codex.openConnection(launch, handlers)
+    await handlers.onSpawned?.(CHILD_PID)
+    return connection
+  }
+  return Object.assign(adapterFor({ ...codex, openConnection }), { supportsCreate: () => true })
+}
+
+/** A Codex adapter whose child never gets as far as reporting its pid: the reservation is all the
+ *  next host finds. */
+function adapterThatNeverSpawns(): StructuredAgentSessionAdapter {
+  const codex = fakeCodex()
+  const openConnection: typeof openCodexAppServerConnection = () => new Promise(() => {})
+  return Object.assign(adapterFor({ ...codex, openConnection }), { supportsCreate: () => true })
+}
+
+function host(
+  generation: HostGeneration,
+  store: AgentSessionRecordStore,
+  adapter: StructuredAgentSessionAdapter,
+  overrides: Partial<StructuredAgentSessionHostDeps> = {}
+): StructuredAgentSessionHost {
+  return new StructuredAgentSessionHost({
+    store,
+    adapter,
+    journalRoot: generationRoot(generation),
+    claimKeyId: 'key-1',
+    mintSpawnToken: () => 'spawn-a',
+    now: () => NOW,
+    ...overrides
+  })
+}
+
+describe('a host that dies while its Codex child is starting', () => {
+  it('leaves the spawned child recorded, so the next host stops it by identity and starts over', async () => {
+    const first = await openStore('dying')
+    const dying = host('dying', first, adapterThatNeverFinishesStarting())
+    void dying.attach(CALLER, hostTestAttachParams(null)).catch(() => {})
+    await vi.waitFor(() => expect(first.getRecord(SESSION)?.lease.ownerProcess).toBeTruthy())
+    // Durable before the handshake returned: the only record the next host will have.
+    expect(first.getRecord(SESSION)?.lease).toMatchObject({
+      claimStatus: 'reserved',
+      handoffStage: 'new-owner-proving',
+      ownerProcess: { pid: CHILD_PID, spawnToken: 'spawn-a' }
+    })
+
+    // The relaunch. The orphan is still alive until something stops it.
+    let orphanAlive = true
+    const stopOwnerProcess = vi.fn(() => {
+      orphanAlive = false
+    })
+    const restarted = fakeCodex()
+    await crash(first)
+    const store = await openStore('relaunched')
+    const relaunched = host(
+      'relaunched',
+      store,
+      Object.assign(adapterFor(restarted), { supportsCreate: () => true }),
+      {
+        mintSpawnToken: () => 'spawn-b',
+        probeOwner: async () =>
+          orphanAlive
+            ? { outcome: 'identity-matched', matchedOn: ['spawn-token'] }
+            : { outcome: 'pid-absent' },
+        stopOwnerProcess
+      }
+    )
+    await relaunched.restoreReadableSessions()
+
+    expect(stopOwnerProcess).toHaveBeenCalledWith(CHILD_PID, 'SIGTERM')
+    expect(store.getRecord(SESSION)?.lease).toMatchObject({
+      claimStatus: 'released',
+      handoffStage: null,
+      ownerProcess: null,
+      deathEvidence: { kind: 'pid-absent' }
+    })
+    // What the next send's delivery does: start at the record's current fence.
+    const fence = store.getRecord(SESSION)?.lease.runtimeFence ?? null
+    expect(await relaunched.attach(CALLER, hostTestAttachParams(fence))).toMatchObject({ ok: true })
+    expect(restarted.connections).toHaveLength(1)
+    expect(store.getRecord(SESSION)?.lease).toMatchObject({
+      claimStatus: 'live',
+      ownerProcess: { spawnToken: 'spawn-b' }
+    })
+  })
+})
+
+// The client keeps a create it never heard back from and retries it under the same operation id, so
+// that replay, not a fresh start, is what the user's Retry and first send go through.
+describe('a create replayed after the host that ran it died', () => {
+  const PAST_OPERATION_EXPIRY =
+    AGENT_SESSION_MAX_NEW_OPERATION_AGE_MS + AGENT_SESSION_OPERATION_FUTURE_SKEW_MS + 60_000
+
+  it.each([
+    ['its child was recorded', adapterThatNeverFinishesStarting, 0],
+    [
+      'its child was recorded, and its operation row has since expired',
+      adapterThatNeverFinishesStarting,
+      PAST_OPERATION_EXPIRY
+    ],
+    ['nothing was recorded beyond the reservation', adapterThatNeverSpawns, 0],
+    [
+      'nothing was recorded, and its operation row has since expired',
+      adapterThatNeverSpawns,
+      PAST_OPERATION_EXPIRY
+    ]
+  ] as const)('starts an agent when %s', async (_case, dyingAdapter, elapsedMs) => {
+    const params = hostTestAttachParams(null)
+    const first = await openStore('dying')
+    const dying = host('dying', first, dyingAdapter())
+    void dying.attach(CALLER, params).catch(() => {})
+    await vi.waitFor(() =>
+      expect(first.getRecord(SESSION)?.lease).toMatchObject(
+        dyingAdapter === adapterThatNeverSpawns
+          ? { claimStatus: 'reserved' }
+          : { claimStatus: 'reserved', ownerProcess: { pid: CHILD_PID } }
+      )
+    )
+
+    const restarted = fakeCodex()
+    await crash(first)
+    const store = await openStore('relaunched')
+    const relaunched = host(
+      'relaunched',
+      store,
+      Object.assign(adapterFor(restarted), { supportsCreate: () => true }),
+      {
+        mintSpawnToken: () => 'spawn-b',
+        // A reservation with no pid probes indeterminate: no token scan off Linux.
+        probeOwner: async (record): Promise<AgentSessionOwnerProbe> =>
+          record.lease.ownerProcess
+            ? { outcome: 'pid-absent' }
+            : { outcome: 'indeterminate', reason: 'spawn token scan unavailable' },
+        now: () => NOW + elapsedMs
+      }
+    )
+    await relaunched.restoreReadableSessions()
+    expect(store.getRecord(SESSION)?.lease).toMatchObject({
+      claimStatus: 'released',
+      handoffStage: null,
+      runtimeFence: 2
+    })
+
+    const replayed = await relaunched.attach(CALLER, params)
+    // Before, `agent_session_ownership_unknown` while the row was pending, then `_operation_expired`.
+    expect(replayed.ok ? null : replayed.refusal.code).toBeNull()
+    expect(replayed).toMatchObject({ ok: true, value: { sessionId: SESSION, fence: 3 } })
+    expect(restarted.connections).toHaveLength(1)
+    expect(store.getRecord(SESSION)?.lease).toMatchObject({
+      claimStatus: 'live',
+      runtimeFence: 3,
+      ownerProcess: { spawnToken: 'spawn-b' }
+    })
+    expect(
+      store.getOperationRow(CALLER.callerKey, params.envelope.clientOperationId)?.outcome
+    ).toEqual({ status: 'succeeded', sessionId: SESSION })
+
+    // Settled now: the same id replays that answer and never starts a second agent.
+    await expect(relaunched.attach(CALLER, params)).resolves.toMatchObject({
+      ok: true,
+      replayed: true
+    })
+    expect(restarted.connections).toHaveLength(1)
+  })
+})
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-dead-generation-settlement.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-dead-generation-settlement.test.ts
index d553fbaecf37..4a0febb6ceb9 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-dead-generation-settlement.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-dead-generation-settlement.test.ts
@@ -4,16 +4,21 @@ import { join } from 'node:path'
 import { afterEach, beforeEach, describe, expect, it } from 'vitest'
 import { openAgentSessionJournal } from '../agent-session-journal/journal-store-factory'
 import type { AgentJournalRenderItem } from '../../../shared/agent-session-journal-types'
-import { dispatchRejectionReasonIsInternal } from '../../../shared/structured-agent-session-dispatch-rejection'
+import {
+  agentSessionFailureFact,
+  MAX_PROVIDER_DIAGNOSTIC_CHARS,
+  providerDiagnostic
+} from '../../../shared/agent-session-failure'
 import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
 import {
   captureUnfinishedStructuredAgentSessionWork,
-  MAX_UNEXPECTED_EXIT_REASON_CHARS,
   settleStructuredAgentSessionDeadGeneration,
-  UNEXPECTED_PROVIDER_EXIT_OUTCOME,
   unfinishedStructuredAgentSessionWorkWasInterrupted
 } from './structured-agent-session-dead-generation-settlement'
 
+const UNEXPECTED_PROVIDER_EXIT_OUTCOME =
+  'The agent stopped while this response was in progress. You can continue in this conversation.'
+
 const SESSION = 'session-dead-generation'
 const THREAD = 'thread-1'
 let root: string
@@ -143,7 +148,7 @@ describe('dead structured-session generation settlement', () => {
     ).toHaveLength(1)
   })
 
-  it('keeps the actionable tail when the provider dumps a stderr wall into its exit reason', async () => {
+  it('keeps a stderr wall out of the sentence, as a bounded detail for a log', async () => {
     await seedUnfinishedWork()
 
     await expect(
@@ -155,19 +160,47 @@ describe('dead structured-session generation settlement', () => {
         pendingSubmissionReason: 'provider_exited_before_acknowledgement',
         verdict: { state: 'interrupted', completedAt: 1_000 },
         showUnexpectedExitOutcome: true,
-        unexpectedExitReason: 'stack frame '.repeat(4_000)
+        exitFailure: agentSessionFailureFact('providerExited', {
+          detail: providerDiagnostic('stack frame '.repeat(4_000), 'log')
+        })
       })
     ).resolves.toBe(true)
 
     const statuses = journal
       .snapshot()
-      .items.flatMap((item) => (item.body.kind === 'status' ? [item.body.text] : []))
+      .items.flatMap((item) => (item.body.kind === 'status' ? [item.body] : []))
     expect(statuses).toHaveLength(1)
-    // The cause is bounded before composing, so the row never reaches the byte cap that would
-    // truncate the sentence telling the user the conversation is still usable.
-    expect(statuses[0]).toContain('stack frame')
-    expect(statuses[0]).toMatch(/You can continue in this conversation\.$/)
-    expect(statuses[0]?.length).toBeLessThan(MAX_UNEXPECTED_EXIT_REASON_CHARS * 2)
+    expect(statuses[0]?.text).toBe(UNEXPECTED_PROVIDER_EXIT_OUTCOME)
+    expect(statuses[0]?.failure?.kind).toBe('providerExited')
+    expect(statuses[0]?.failure?.detail?.audience).toBe('log')
+    expect(statuses[0]?.failure?.detail?.text.length).toBe(MAX_PROVIDER_DIAGNOSTIC_CHARS)
+  })
+
+  it("words Orca's own fault as Orca's, never as the provider stopping", async () => {
+    await seedUnfinishedWork()
+
+    await settleStructuredAgentSessionDeadGeneration({
+      journal,
+      sessionId: SESSION,
+      fence: 7,
+      settlementId: `provider-exit:${SESSION}:7:generation-1`,
+      pendingSubmissionReason: 'provider_exited_before_acknowledgement',
+      verdict: { state: 'interrupted', completedAt: 1_000 },
+      showUnexpectedExitOutcome: true,
+      // Orca stopped the provider because its own journal failed.
+      exitFailure: agentSessionFailureFact('hostFault')
+    })
+
+    const statuses = journal
+      .snapshot()
+      .items.flatMap((item) => (item.body.kind === 'status' ? [item.body] : []))
+    expect(statuses).toEqual([
+      {
+        kind: 'status',
+        text: "Orca ran into a problem, so this didn't go through. Try again.",
+        failure: { kind: 'hostFault' }
+      }
+    ])
   })
 
   it('retries an already settled expected close without writing through a closed journal gate', async () => {
@@ -190,6 +223,7 @@ describe('dead structured-session generation settlement', () => {
       | 'submissions'
       | 'markPendingSubmissionsUnknown'
       | 'rejectPendingSubmissions'
+      | 'rejectQueuedSubmissions'
       | 'appendLifecycleBatch'
     > = {
       snapshot: () => ({
@@ -203,6 +237,9 @@ describe('dead structured-session generation settlement', () => {
       rejectPendingSubmissions: async () => {
         throw new Error('journal_closed')
       },
+      rejectQueuedSubmissions: async () => {
+        throw new Error('journal_closed')
+      },
       appendLifecycleBatch: async () => {
         throw new Error('journal_closed')
       }
@@ -272,16 +309,24 @@ describe('dead structured-session generation settlement', () => {
       settlementId: `provider-exit:${SESSION}:7:generation-1`,
       pendingSubmissionReason: 'provider_closed_before_acknowledgement',
       verdict: { state: 'interrupted', completedAt: 1_000 },
-      unexpectedExitReason: 'claude stream-json exited (code 1): not signed in',
-      exitedDuringStartup: true
+      exitFailure: agentSessionFailureFact('providerExited', {
+        detail: providerDiagnostic('code 1\nnot signed in', 'log')
+      }),
+      exitedDuringStartup: { generation: 'generation-1' }
     })
 
-    const reason =
-      'The provider stopped before it finished starting: claude stream-json exited (code 1): not signed in.'
+    // The sentence is Orca's; the stderr the exit carried rides as a log detail only.
     expect(journal.submissions()).toEqual([
-      expect.objectContaining({ clientMessageId: 'client-held', dispatchState: 'rejected', reason })
+      expect.objectContaining({
+        clientMessageId: 'client-held',
+        dispatchState: 'rejected',
+        reason: 'The agent stopped before it finished starting. Send your message to try again.',
+        rejection: {
+          kind: 'providerStartFailed',
+          detail: { text: 'code 1\nnot signed in', audience: 'log' }
+        }
+      })
     ])
-    expect(dispatchRejectionReasonIsInternal(reason)).toBe(false)
   })
 
   it("keeps a subagent's settled rows the subagent's, in one batch and after a reopen", async () => {
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-dead-generation-settlement.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-dead-generation-settlement.ts
index 1b5f73fdbdae..f6a166c7c02d 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-dead-generation-settlement.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-dead-generation-settlement.ts
@@ -1,4 +1,10 @@
+import {
+  agentSessionFailureFact,
+  MAX_PROVIDER_DIAGNOSTIC_CHARS,
+  type SubmissionRejectionFact
+} from '../../../shared/agent-session-failure'
 import { parseAgentJournalItemKey } from '../../../shared/agent-session-journal-item-key'
+import { isQueuedAgentJournalSubmission } from '../../../shared/agent-session-queued-submission'
 import type {
   AgentJournalItemBody,
   AgentJournalRenderItem
@@ -6,73 +12,31 @@ import type {
 import { readAgentJournalTurn } from '../../../shared/agent-session-turn-record'
 import { partitionJournalLifecycleMutations } from '../agent-session-journal/journal-lifecycle-batch-partition'
 import type { JournalLifecycleMutationInput } from '../agent-session-journal/journal-row-builders'
-import {
-  boundJournalStatusText,
-  cancelledJournalPromptBody
-} from '../agent-session-journal/journal-prompt-body-bounds'
+import { cancelledJournalPromptBody } from '../agent-session-journal/journal-prompt-body-bounds'
 import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
+import {
+  agentSessionFailureWords,
+  type AgentSessionFailureWordsContext
+} from '../../../shared/agent-session-failure-words'
+import { structuredAgentSessionStartFailure } from './structured-agent-session-failure-text'
+import {
+  hasStructuredAgentSessionStartFailureRow,
+  structuredAgentSessionStartFailureRow
+} from './structured-agent-session-start-failure-row'
+import type { AgentSessionDeathEvidence } from '../../../shared/agent-session-record'
 import {
   runningTurnLifecycleRevisions,
+  turnVerdictFromDeathEvidence,
   type StructuredAgentSessionTurnVerdict
 } from './structured-agent-session-stale-turn-verdict'
 
-export const UNEXPECTED_PROVIDER_EXIT_OUTCOME =
-  'The provider stopped while this response was in progress. You can continue in this conversation.'
-
-/** A provider may put a whole stderr dump in its exit reason; unbounded it would push the
- *  actionable tail past the row's byte cap and lose it to truncation. */
-export const MAX_UNEXPECTED_EXIT_REASON_CHARS = 512
-
-/** The cause is the only thing separating an auth failure from an OOM kill, so it is carried
- *  into the copy rather than left in the durable record nothing renders. */
-export function unexpectedProviderExitOutcome(reason?: string): string {
-  const detail = exitReasonDetail(reason)
-  return detail
-    ? `The provider stopped while this response was in progress: ${detail}. You can continue in this conversation.`
-    : UNEXPECTED_PROVIDER_EXIT_OUTCOME
-}
-
-/** A restart that produced no child, answered to the send that asked for it; its cause is the
- *  whole story, and nothing is remembered, so the next try is a fresh one. A new chat is offered
- *  only when the host holds nothing this chat could restart from. */
-export function ownerRestartFailedOutcome(input: {
-  agentName: string
-  reason?: string
-  resumable: boolean
-}): string {
-  const detail = exitReasonDetail(input.reason)
-  const failed = detail
-    ? `${input.agentName} couldn't restart: ${detail}.`
-    : `${input.agentName} couldn't restart.`
-  return input.resumable ? failed : `${failed} Start a new chat to continue.`
-}
-
-/** A start that never finished has no response to interrupt; its cause is the whole story. */
-export function providerStartupFailureOutcome(reason?: string): string {
-  const detail = exitReasonDetail(reason)
-  return detail
-    ? `The provider stopped before it finished starting: ${detail}.`
-    : 'The provider stopped before it finished starting.'
-}
-
-/** Why a send a child that never started left unwritten was rejected. The child's own diagnostic is
- *  the cause the user can act on, so it is the reason, in the words the chat row uses. */
-export function providerStartupFailureRejection(cause?: unknown): string {
-  return providerStartupFailureOutcome(
-    cause === undefined ? undefined : cause instanceof Error ? cause.message : String(cause)
-  )
-}
-
-function exitReasonDetail(reason: string | undefined): string | undefined {
-  return reason
-    ?.slice(0, MAX_UNEXPECTED_EXIT_REASON_CHARS)
-    .trim()
-    .replace(/[.\s]+$/, '')
-}
+/** Bounds the exit reason the lease keeps as log evidence; a provider diagnostic is held to the
+ *  same cap. */
+export const MAX_UNEXPECTED_EXIT_REASON_CHARS = MAX_PROVIDER_DIAGNOSTIC_CHARS
 
 type DeadGenerationSubmission = Pick<
   ReturnType<AgentSessionJournal['submissions']>[number],
-  'clientMessageId' | 'dispatchState' | 'recovered'
+  'clientMessageId' | 'dispatchState' | 'recovered' | 'handoverRecorded' | 'handedOverAt'
 >
 
 export type DeadGenerationJournal = {
@@ -140,10 +104,13 @@ export async function settleStructuredAgentSessionDeadGeneration(input: {
   verdict: StructuredAgentSessionTurnVerdict
   pendingSubmissionReason: string
   showUnexpectedExitOutcome?: boolean
-  /** Why the provider stopped, when the host has it. Rendered with the outcome copy. */
-  unexpectedExitReason?: string
-  /** The provider never finished starting; the outcome says so instead of naming a response. */
-  exitedDuringStartup?: boolean
+  /** Why the provider stopped, as the adapter told it; the row's sentence is this fact's. */
+  exitFailure?: SubmissionRejectionFact
+  /** Who a failed start's sentence names. */
+  failureTextContext?: AgentSessionFailureWordsContext
+  /** The provider never finished starting: the start that failed, keyed by the child's
+   *  generation. Its row is the one the delivery loop writes for the same start. */
+  exitedDuringStartup?: { generation: string | null }
   onError?: (sessionId: string, error: unknown) => void
 }): Promise<boolean> {
   try {
@@ -152,27 +119,41 @@ export async function settleStructuredAgentSessionDeadGeneration(input: {
     if (!showUnexpectedExitOutcome && !hasUnfinishedWork) {
       return true
     }
-    // A child that never proved its start accepted nothing — input is written only after it
-    // initializes — so every send it left unanswered is provably unwritten and is rejected with the
-    // child's own diagnostic. A proven child's unanswered sends stay in doubt.
-    await (input.exitedDuringStartup
-      ? input.journal.rejectPendingSubmissions(
-          input.fence,
-          providerStartupFailureRejection(input.unexpectedExitReason)
-        )
+    // A queued message is the delivery loop's to settle: it was never handed to this child. A
+    // child that never proved its start accepted nothing either — input is written only after it
+    // initializes — so every send it was handed is rejected with the child's own diagnostic. A
+    // proven child's handed-over sends stay in doubt.
+    const startupFailure = input.exitedDuringStartup
+      ? structuredAgentSessionStartFailure({ exit: input.exitFailure }, input.failureTextContext)
+      : null
+    await (startupFailure
+      ? input.journal.rejectPendingSubmissions(input.fence, startupFailure)
       : input.journal.markPendingSubmissionsUnknown(input.fence, input.pendingSubmissionReason))
     const items = input.journal.snapshot().items
     const mutations: JournalLifecycleMutationInput[] = []
-    if (showUnexpectedExitOutcome) {
+    if (showUnexpectedExitOutcome && input.exitedDuringStartup && startupFailure) {
+      const startKey = input.exitedDuringStartup.generation ?? input.settlementId
+      // A start a message waited on is the delivery loop's to record, before or after this exit,
+      // in the words it rejected the message with; this row is for a command, goal or rewind start.
+      // A row already written stays: rejected is terminal, so its words are not reworded.
+      const recordedByDeliveryLoop =
+        input.journal.submissions?.().some(isQueuedAgentJournalSubmission) ||
+        hasStructuredAgentSessionStartFailureRow(items, startKey)
+      if (!recordedByDeliveryLoop) {
+        mutations.push(structuredAgentSessionStartFailureRow(startKey, startupFailure))
+      }
+    } else if (showUnexpectedExitOutcome) {
       mutations.push({
         kind: 'item',
         identity: { provider: 'orca', clientMessageId: input.settlementId },
         body: {
           kind: 'status',
-          text: boundJournalStatusText(
-            input.exitedDuringStartup
-              ? providerStartupFailureOutcome(input.unexpectedExitReason)
-              : unexpectedProviderExitOutcome(input.unexpectedExitReason)
+          ...agentSessionFailureWords(
+            input.exitFailure ?? agentSessionFailureFact('providerExited'),
+            {
+              ...input.failureTextContext,
+              surface: 'row'
+            }
           )
         }
       })
@@ -201,6 +182,62 @@ export async function settleStructuredAgentSessionDeadGeneration(input: {
   }
 }
 
+/**
+ * Settles whatever a generation with no child in this process left running: found when a new child
+ * is acquired, or when a chat is reopened for reading. Derived from the journal and the lease's
+ * death evidence each time, so nothing is owed in between. Only an observed exit earns an end time
+ * and the exit copy. Must run before a new child's buffered events land, or a live turn would be
+ * judged.
+ */
+export async function settleStaleStructuredAgentSessionState(input: {
+  journal: AgentSessionJournal
+  sessionId: string
+  fence: number
+  acquisitionGeneration: string | null
+  deathEvidence: AgentSessionDeathEvidence | null
+  /** Who the exit row names. */
+  failureTextContext?: AgentSessionFailureWordsContext
+}): Promise<number> {
+  const { journal } = input
+  const items = journal.snapshot().items
+  const verdict = turnVerdictFromDeathEvidence(input.deathEvidence)
+  const generation = input.acquisitionGeneration ?? `seq-${journal.cursor().sequence}`
+  const settlementId = `stale-session:${input.sessionId}:${input.fence}:${generation}`
+  const mutations: JournalLifecycleMutationInput[] = []
+  for (const item of items) {
+    const identity = parseAgentJournalItemKey(item.itemId)
+    const body = terminalDeadGenerationBody(item)
+    if (identity && body) {
+      mutations.push({ kind: 'item', identity, body })
+    }
+  }
+  mutations.push(...runningTurnLifecycleRevisions(items, verdict))
+  if (verdict.state === 'interrupted' && items.some(isInProgressItem)) {
+    mutations.unshift({
+      kind: 'item',
+      identity: { provider: 'orca', clientMessageId: settlementId },
+      // The death evidence is Orca's log text, never a sentence for a person: the row says only
+      // that the provider stopped.
+      body: {
+        kind: 'status',
+        ...agentSessionFailureWords(agentSessionFailureFact('providerExited'), {
+          ...input.failureTextContext,
+          surface: 'row'
+        })
+      }
+    })
+  }
+  for (const chunk of partitionJournalLifecycleMutations(settlementId, mutations)) {
+    await journal.appendLifecycleBatch({
+      settlementId: chunk.settlementId,
+      fence: input.fence,
+      recovered: true,
+      mutations: chunk.mutations
+    })
+  }
+  return mutations.length
+}
+
 function terminalDeadGenerationBody(item: AgentJournalRenderItem): AgentJournalItemBody | null {
   if (item.body.kind === 'tool-call' && item.body.state === 'running') {
     return { ...item.body, state: 'failed' }
@@ -247,7 +284,9 @@ function hasUnsettledSubmission(journal: DeadGenerationJournal): boolean {
   return submissions
     ? submissions.some(
         (submission) =>
-          submission.dispatchState === 'pending' ||
+          // A queued message is not work in progress: nothing has it yet.
+          (submission.dispatchState === 'pending' &&
+            !(submission.handoverRecorded && submission.handedOverAt === undefined)) ||
           (submission.dispatchState === 'unknown' && submission.recovered !== true)
       )
     : (journal.pendingSubmissions?.().length ?? 0) > 0
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-delivery-loop.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-delivery-loop.test.ts
new file mode 100644
index 000000000000..242daf74faf6
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-delivery-loop.test.ts
@@ -0,0 +1,57 @@
+import { describe, expect, it } from 'vitest'
+import { agentSessionFailureFact } from '../../../shared/agent-session-failure'
+import { structuredAgentSessionEndedChildFailure } from './structured-agent-session-delivery-loop'
+import type {
+  StructuredAgentSessionChildEndCause,
+  StructuredAgentSessionEndedChild
+} from './structured-agent-session-host-types'
+
+const EXIT_FAILURE = agentSessionFailureFact('providerExited', {
+  detail: { text: 'crashed', audience: 'log' }
+})
+
+function ended(
+  cause: StructuredAgentSessionChildEndCause,
+  duringStartup: boolean
+): StructuredAgentSessionEndedChild {
+  return {
+    generation: 'generation-1',
+    fence: 2,
+    rootGone: true,
+    cause,
+    reason: null,
+    failure: EXIT_FAILURE,
+    duringStartup,
+    endedAt: { epoch: 'epoch-1', sequence: 3 }
+  }
+}
+
+describe('what a child end means for the messages queued behind it', () => {
+  it.each([false, true])("fails nothing after a user's Stop (during startup: %s)", (starting) => {
+    expect(structuredAgentSessionEndedChildFailure(ended('user-stop', starting))).toBeNull()
+  })
+
+  it.each([false, true])(
+    'is a start Orca stopped after a host stop (during startup: %s)',
+    (starting) => {
+      expect(structuredAgentSessionEndedChildFailure(ended('host-stop', starting))).toEqual({
+        failure: { kind: 'hostStopped' }
+      })
+    }
+  )
+
+  it.each(['exit', 'attach-failed', 'evict'] as const)(
+    'carries the recorded failure of a %s, as a failed start while starting',
+    (cause) => {
+      expect(structuredAgentSessionEndedChildFailure(ended(cause, true))).toEqual({
+        exit: EXIT_FAILURE
+      })
+      expect(structuredAgentSessionEndedChildFailure(ended(cause, false))).toEqual({
+        failure: EXIT_FAILURE
+      })
+      expect(
+        structuredAgentSessionEndedChildFailure({ ...ended(cause, false), failure: undefined })
+      ).toEqual({ failure: agentSessionFailureFact('providerExited') })
+    }
+  )
+})
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-delivery-loop.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-delivery-loop.ts
new file mode 100644
index 000000000000..7dd17306105d
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-delivery-loop.ts
@@ -0,0 +1,290 @@
+// The one thing that starts a provider child for a send, the one thing that hands a message to
+// it, and the one thing that settles a queued message because of a start, a child or a leftover.
+//
+// A send is accepted on its own serialized step and returns; this loop does the rest. It exists
+// for a session exactly while a message is queued there — accepted, not yet handed over — and
+// every step re-reads the journal and the conversation's child record to decide, so there is no
+// loop state to disagree with them. Each step is its own serialized task. That is what lets a Stop
+// that arrives while a start holds the queue withdraw the queued messages before the handover that
+// would have written them. Stop and the conversation's close are the only other writers of a
+// queued message: a child's exit only ends the child, and this loop reads why.
+
+import {
+  agentSessionFailureFact,
+  type SubmissionRejectionFact
+} from '../../../shared/agent-session-failure'
+import {
+  agentSessionFailureWords,
+  type AgentSessionFailureWordsContext
+} from '../../../shared/agent-session-failure-words'
+import type { StructuredAgentSessionAdapter } from './structured-agent-session-adapter'
+import {
+  structuredAgentSessionStartFailure,
+  type StructuredAgentSessionStartFailureCause
+} from './structured-agent-session-failure-text'
+import type { StructuredAgentSessionResumeOutcome } from './structured-agent-session-agent-start'
+import type {
+  StructuredAgentSessionChildEndCause,
+  StructuredAgentSessionEndedChild,
+  StructuredAgentSessionHostSession,
+  StructuredAgentSessionProviderChildIdentity
+} from './structured-agent-session-host-types'
+import {
+  oldestQueuedSubmission,
+  recordStructuredAgentSessionStartFailure
+} from './structured-agent-session-start-failure-row'
+import { failedProviderChildStart } from './structured-agent-session-provider-child'
+import { handOverSubmission } from './structured-agent-session-turns'
+
+export type StructuredAgentSessionDeliveryLoopDeps = {
+  sessions: ReadonlyMap<string, StructuredAgentSessionHostSession>
+  adapter: StructuredAgentSessionAdapter
+  serialize: <T>(sessionId: string, task: () => Promise<T>) => Promise<T>
+  /** A start step, tracked from enqueue so quit waits for the child it may produce. */
+  trackStart: <T>(start: Promise<T>) => Promise<T>
+  /** Gives the session a provider child if it has none; for a caller inside `serialize`. */
+  /** Starts a child for `startedFor`, the queued message at the head, if the session has none. */
+  ensureProviderChild: (
+    sessionId: string,
+    startedFor: string
+  ) => Promise<StructuredAgentSessionResumeOutcome>
+  /** The fence the conversation's own writes carry; see `structuredAgentSessionConversationFence`. */
+  conversationFence: (sessionId: string) => number
+  /** Who the chat's failure sentences name. */
+  failureTextContext: (sessionId: string) => AgentSessionFailureWordsContext
+  onError: (sessionId: string, error: unknown) => void
+}
+
+type Step = 'continue' | 'stop'
+
+type Prepared =
+  | 'stop'
+  | Extract<StructuredAgentSessionResumeOutcome, { ok: false }>
+  | { ok: true; awaited: StructuredAgentSessionProviderChildIdentity | null }
+
+/** A failed start before it is worded; `fail` words it once, through the one wording point. */
+type StartFailure = { startKey: string | null; cause: StructuredAgentSessionStartFailureCause }
+
+export class StructuredAgentSessionDeliveryLoop {
+  private readonly running = new Set<string>()
+  private disposed = false
+
+  constructor(private readonly deps: StructuredAgentSessionDeliveryLoopDeps) {}
+
+  isRunning(sessionId: string): boolean {
+    return this.running.has(sessionId)
+  }
+
+  /** Quit: no step after this one starts a child or hands a message over. */
+  dispose(): void {
+    this.disposed = true
+  }
+
+  /** From inside the session's serialize, after a message was accepted or the conversation
+   *  opened. A loop already running re-reads the journal on its next step. */
+  wake(sessionId: string): void {
+    if (this.disposed || this.running.has(sessionId)) {
+      return
+    }
+    this.running.add(sessionId)
+    void this.run(sessionId)
+  }
+
+  private async run(sessionId: string): Promise<void> {
+    try {
+      for (;;) {
+        const prepared = await this.deps.trackStart(
+          this.deps.serialize(sessionId, () => this.prepare(sessionId))
+        )
+        if (prepared === 'stop') {
+          return
+        }
+        if (!prepared.ok) {
+          const { refusal, diagnostic } = prepared
+          const cause = { refusal, ...(diagnostic ? { diagnostic } : {}) }
+          await this.deps.serialize(sessionId, () =>
+            this.fail(sessionId, { startKey: null, cause })
+          )
+          return
+        }
+        // A child published before it proved its start takes no input yet; waited for outside
+        // the queue so a Stop can reach it meanwhile.
+        const failure = await this.deps.adapter.awaitStarted?.(sessionId)
+        const handed = await this.deps.serialize(sessionId, () =>
+          this.handOver(sessionId, prepared.awaited, failure || null)
+        )
+        if (handed === 'stop') {
+          return
+        }
+      }
+    } catch (error) {
+      // The error is Orca's own and goes to the log; the chat says only that Orca failed.
+      this.deps.onError(sessionId, error)
+      const cause = { hostFault: true } as const
+      await this.deps
+        .serialize(sessionId, () => this.fail(sessionId, { startKey: null, cause }))
+        .catch((failure: unknown) => {
+          // Rows left queued are rejected by the next open, or by the next loop an accept wakes.
+          this.running.delete(sessionId)
+          this.deps.onError(sessionId, failure)
+        })
+    }
+  }
+
+  /** Settles what an earlier host process left queued, then makes the session ready. */
+  private async prepare(sessionId: string): Promise<Prepared> {
+    const session = this.deps.sessions.get(sessionId)
+    if (!session || this.disposed) {
+      return this.stop(sessionId)
+    }
+    await session.journal.rejectQueuedSubmissions(
+      this.deps.conversationFence(sessionId),
+      agentSessionFailureWords(agentSessionFailureFact('hostRestarted'), { surface: 'rejection' }),
+      // A handle closes only with nothing queued, so one an earlier handle wrote is a leftover.
+      (submission) => session.journal.wroteBeforeOpen(submission.acceptedSequence)
+    )
+    const oldest = oldestQueuedSubmission(session)
+    if (!oldest) {
+      return this.stop(sessionId)
+    }
+    const failedStart = startThatFailedWhileQueued(session, oldest)
+    if (failedStart) {
+      return this.fail(sessionId, failedStart)
+    }
+    const ready = await this.deps.ensureProviderChild(sessionId, oldest.clientMessageId)
+    if (!ready.ok) {
+      return ready
+    }
+    const child = this.deps.sessions.get(sessionId)?.child
+    // The child this run waits on; handover checks it is still the one there.
+    return {
+      ok: true,
+      awaited: child ? { generation: child.generation, fence: child.fence } : null
+    }
+  }
+
+  private async handOver(
+    sessionId: string,
+    awaited: StructuredAgentSessionProviderChildIdentity | null,
+    startFailure: SubmissionRejectionFact | null
+  ): Promise<Step> {
+    const session = this.deps.sessions.get(sessionId)
+    if (!session || this.disposed) {
+      return this.stop(sessionId)
+    }
+    // Re-derived here, not carried from the start: the child may have ended, or another may have
+    // taken its place, since.
+    const { child } = session
+    const awaitedChild =
+      child && awaited && child.generation === awaited.generation && child.fence === awaited.fence
+        ? child
+        : null
+    // The host's `starting` trails the adapter's `started` by one serialized step, so for the child
+    // waited on, the adapter's own answer decides whether its start landed.
+    if (!awaitedChild || (awaitedChild.phase === 'starting' && startFailure !== null)) {
+      // The child waited on is gone, replaced by another, or settled its start without proving it.
+      const ended = awaitedChild ? undefined : session.lastEndedChild
+      const endedFailure = ended ? structuredAgentSessionEndedChildFailure(ended) : undefined
+      // A user's Stop is not a failure: the next step starts, or waits on, a child for what is
+      // queued.
+      if (endedFailure === null) {
+        return 'continue'
+      }
+      return this.fail(sessionId, {
+        startKey: awaited?.generation ?? null,
+        cause: endedFailure ??
+          // Gone with no end observed: nothing says the provider stopped.
+          { failure: startFailure ?? agentSessionFailureFact('startFailed') }
+      })
+    }
+    const next = oldestQueuedSubmission(session)
+    if (!next) {
+      return this.stop(sessionId)
+    }
+    await handOverSubmission(
+      {
+        sessionId,
+        journal: session.journal,
+        fence: awaitedChild.fence,
+        adapter: this.deps.adapter,
+        providerChildPhase: () => this.deps.sessions.get(sessionId)?.child?.phase,
+        failureTextContext: this.deps.failureTextContext(sessionId)
+      },
+      next
+    )
+    return 'continue'
+  }
+
+  private async fail(sessionId: string, failure: StartFailure): Promise<'stop'> {
+    const session = this.deps.sessions.get(sessionId)
+    if (session) {
+      await recordStructuredAgentSessionStartFailure(
+        { journal: session.journal, fence: this.deps.conversationFence(sessionId) },
+        {
+          startKey: failure.startKey,
+          ...structuredAgentSessionStartFailure(
+            failure.cause,
+            this.deps.failureTextContext(sessionId)
+          )
+        }
+      )
+    }
+    return this.stop(sessionId)
+  }
+
+  /** Inside the serialized step that found nothing to do, so an accept after it wakes anew. */
+  private stop(sessionId: string): 'stop' {
+    this.running.delete(sessionId)
+    return 'stop'
+  }
+}
+
+/** A start that died while this message waited on it — a view's, say — is the message's failed
+ *  start: settled with it, under its key, rather than started again into the same failure. */
+function startThatFailedWhileQueued(
+  session: StructuredAgentSessionHostSession,
+  oldest: NonNullable<ReturnType<typeof oldestQueuedSubmission>>
+): StartFailure | null {
+  const ended = failedProviderChildStart(session)
+  if (
+    !ended ||
+    oldest.acceptedSequence === undefined ||
+    ended.endedAt.epoch !== session.journal.cursor().epoch ||
+    ended.endedAt.sequence < oldest.acceptedSequence
+  ) {
+    return null
+  }
+  const cause = structuredAgentSessionEndedChildFailure(ended)
+  return cause ? { startKey: ended.generation, cause } : null
+}
+
+function providerEndFailure(
+  ended: StructuredAgentSessionEndedChild
+): StructuredAgentSessionStartFailureCause {
+  if (ended.duringStartup) {
+    return { exit: ended.failure }
+  }
+  return { failure: ended.failure ?? agentSessionFailureFact('providerExited') }
+}
+
+// Every end cause, so a new one does not compile until it says whether it fails what is queued.
+const ENDED_CHILD_FAILURE = {
+  'user-stop': () => null,
+  // The host stopping the child is Orca's cause, never the provider's: a start that never finished.
+  'host-stop': () => ({ failure: agentSessionFailureFact('hostStopped') }),
+  exit: providerEndFailure,
+  // The attach records its own fault as the end's failure.
+  'attach-failed': providerEndFailure,
+  // Reached only when an eviction's stop landed and a later step failed, leaving the conversation.
+  evict: providerEndFailure
+} satisfies Record<
+  StructuredAgentSessionChildEndCause,
+  (ended: StructuredAgentSessionEndedChild) => StructuredAgentSessionStartFailureCause | null
+>
+
+/** Why a queued message the child never took is rejected; null when its end fails nothing. */
+export function structuredAgentSessionEndedChildFailure(
+  ended: StructuredAgentSessionEndedChild
+): StructuredAgentSessionStartFailureCause | null {
+  return ENDED_CHILD_FAILURE[ended.cause](ended)
+}
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-event-recovery.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-event-recovery.ts
index 19989e107119..f7a50627370e 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-event-recovery.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-event-recovery.ts
@@ -1,3 +1,4 @@
+import { agentSessionFailureFact } from '../../../shared/agent-session-failure'
 import {
   stopAgentSessionProviderRoot,
   type StructuredAgentSessionLifecycleEvent
@@ -7,12 +8,8 @@ import type {
   StructuredAgentSessionHostSession
 } from './structured-agent-session-host-types'
 import type { StructuredAgentSessionSinkBarrier } from './structured-agent-session-event-sink'
-import type { StructuredAgentSessionHolds } from './structured-agent-session-holds'
 import { settleStructuredAgentSessionProviderStarted } from './structured-agent-session-provider-started'
-import {
-  isStructuredAgentSessionRecoveryTicketCurrent,
-  settleUnexpectedStructuredAgentSessionExit
-} from './structured-agent-session-unexpected-exit'
+import { settleUnexpectedStructuredAgentSessionExit } from './structured-agent-session-unexpected-exit'
 
 export class StructuredAgentSessionEventRecovery {
   private readonly sinkFailures = new Set<string>()
@@ -25,12 +22,8 @@ export class StructuredAgentSessionEventRecovery {
       flushLifecycle: (sessionId: string) => Promise<StructuredAgentSessionSinkBarrier>
       publishFence: (sessionId: string, session: StructuredAgentSessionHostSession) => void
       publishStatus?: (sessionId: string) => void
-      hasResumeCapableHolder: (sessionId: string) => boolean
-      restartReleaseGrace: (sessionId: string) => void
       serialize: <T>(sessionId: string, task: () => Promise<T>) => Promise<T>
       now: () => number
-      /** The one restart every asker shares; the holds put an unheld child on the idle clock. */
-      ensureProviderChild: StructuredAgentSessionHolds['ensureProviderChild']
       onBarrierError: (sessionId: string, error: unknown) => void
     }
   ) {}
@@ -42,14 +35,13 @@ export class StructuredAgentSessionEventRecovery {
     this.sinkFailures.add(sessionId)
     void this.context
       .serialize(sessionId, async () => {
-        const session = this.context.sessions.get(sessionId)
+        const child = this.context.sessions.get(sessionId)?.child
         const stop =
           this.context.deps.adapter.forceCloseSession ?? this.context.deps.adapter.closeSession
-        if (!session?.hasProviderChild || !stop) {
+        if (!child || !stop) {
           return null
         }
-        const fence = session.fence
-        const acquisitionGeneration = session.acquisitionGeneration
+        const { fence, generation: acquisitionGeneration } = child
         const stopped = await stopAgentSessionProviderRoot(() => stop(sessionId))
         if (!stopped || !acquisitionGeneration) {
           return null
@@ -58,6 +50,8 @@ export class StructuredAgentSessionEventRecovery {
           type: 'ended',
           sessionId,
           reason: `journal sink failure: ${error instanceof Error ? error.message : String(error)}`,
+          // Orca stopped the provider because its own journal failed.
+          failure: agentSessionFailureFact('hostFault'),
           cause: 'unexpected-exit',
           fence,
           acquisitionGeneration
@@ -68,34 +62,12 @@ export class StructuredAgentSessionEventRecovery {
       .finally(() => this.sinkFailures.delete(sessionId))
   }
 
+  /** An exit is settled and shown; nothing restarts the child. The next send does, through the
+   *  delivery loop, which also owns any message still queued. */
   async handle(event: StructuredAgentSessionLifecycleEvent): Promise<void> {
     if (event.type === 'started') {
       return settleStructuredAgentSessionProviderStarted(this.context, event)
     }
-    const ticket = await settleUnexpectedStructuredAgentSessionExit(this.context, event)
-    if (!ticket) {
-      return
-    }
-    // One serialized step with the ticket check inside it: a hold or a send that got there first
-    // has already replaced the owner, and this step finds that child and attaches nothing — or,
-    // once the lease has moved on, refuses on the stale ticket rather than spawning a second child.
-    try {
-      const resumed = await this.context.serialize(ticket.sessionId, () =>
-        this.context.ensureProviderChild(ticket.sessionId, {
-          admitRecoveryTicket: () =>
-            isStructuredAgentSessionRecoveryTicketCurrent(this.context, ticket)
-        })
-      )
-      if (!resumed.ok && isStructuredAgentSessionRecoveryTicketCurrent(this.context, ticket)) {
-        this.context.onBarrierError(
-          ticket.sessionId,
-          new Error(`${resumed.refusal.code}: ${resumed.refusal.message}`)
-        )
-      }
-    } catch (error) {
-      if (isStructuredAgentSessionRecoveryTicketCurrent(this.context, ticket)) {
-        this.context.onBarrierError(ticket.sessionId, error)
-      }
-    }
+    await settleUnexpectedStructuredAgentSessionExit(this.context, event)
   }
 }
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-eviction.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-eviction.test.ts
index cb0cb2fb2334..8fc810de2a4d 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-eviction.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-eviction.test.ts
@@ -30,8 +30,8 @@ function context(): StructuredAgentSessionEvictionContext & { order: string[] }
         return true
       })
     } as unknown as StructuredAgentSessionEvictionContext['adapter'],
-    forget: vi.fn(async () => {
-      order.push('forget')
+    acknowledgeRelease: vi.fn(() => {
+      order.push('acknowledgeRelease')
     }),
     discardSink: vi.fn(() => order.push('discardSink')),
     settleWork: vi.fn(async () => {
@@ -51,7 +51,7 @@ function runtimeState(): StructuredAgentSessionHostRuntimeState {
 }
 
 describe('structured agent session eviction', () => {
-  it('stops the child before it lets the sink go, then forgets the session', async () => {
+  it('stops the child before it lets the sink go, then acknowledges the release', async () => {
     const ctx = context()
     await evictStructuredAgentSession(ctx)
     expect(ctx.order).toEqual([
@@ -62,7 +62,7 @@ describe('structured agent session eviction', () => {
       'close',
       'discardSink',
       'releaseLease',
-      'forget'
+      'acknowledgeRelease'
     ])
   })
 
@@ -90,7 +90,7 @@ describe('structured agent session eviction', () => {
       'close-sink',
       'discard-sink',
       'release-lease',
-      'forget-session'
+      'acknowledge-release'
     ])
   })
 
@@ -114,7 +114,7 @@ describe('structured agent session eviction', () => {
     }
   })
 
-  it('aborts after a failed drain barrier without unbinding or forgetting the session', async () => {
+  it('aborts after a failed drain barrier without unbinding or acknowledging the release', async () => {
     const ctx = context()
     ctx.eventSink.drained = vi.fn(async () => {
       ctx.order.push('drained')
@@ -128,7 +128,7 @@ describe('structured agent session eviction', () => {
     expect(ctx.eventSink.close).not.toHaveBeenCalled()
     expect(ctx.discardSink).not.toHaveBeenCalled()
     expect(ctx.releaseLease).not.toHaveBeenCalled()
-    expect(ctx.forget).not.toHaveBeenCalled()
+    expect(ctx.acknowledgeRelease).not.toHaveBeenCalled()
     expect(ctx.order).toEqual(['closeSession', 'drained'])
   })
 })
@@ -154,9 +154,9 @@ describe('rows the provider emits while closing', () => {
           return true
         }
       } as never,
-      forget: async () => {},
       discardSink: () => state.discardEventSink(sessionId),
-      releaseLease: async () => {}
+      releaseLease: async () => {},
+      acknowledgeRelease: () => {}
     })
 
     expect(published).toEqual(['final-flush'])
@@ -174,9 +174,13 @@ describe('a child that will not stop', () => {
     ctx.adapter.closeSession = vi.fn(async () => {
       throw error
     })
+    const stopped = vi.fn()
+    ctx.onProviderChildStopped = stopped
 
     await evictStructuredAgentSession(ctx)
 
+    // The host ends its child on the one reading of the verdict, not a second one of its own.
+    expect(stopped).toHaveBeenCalledWith({ rootGone: true })
     expect(ctx.order).toEqual([
       'drained',
       'settleWork',
@@ -184,18 +188,18 @@ describe('a child that will not stop', () => {
       'close',
       'discardSink',
       'releaseLease',
-      'forget'
+      'acknowledgeRelease'
     ])
   })
 
-  it('aborts without forgetting the session, so the next close is a real retry', async () => {
+  it('aborts without acknowledging the release, so the next stop is a real retry', async () => {
     const ctx = context()
     ctx.adapter.closeSession = vi.fn(async () => false)
 
     await expect(evictStructuredAgentSession(ctx)).rejects.toMatchObject({
       step: 'stop-provider-child'
     })
-    expect(ctx.forget).not.toHaveBeenCalled()
+    expect(ctx.acknowledgeRelease).not.toHaveBeenCalled()
     expect(ctx.discardSink).not.toHaveBeenCalled()
     expect(ctx.order).toEqual([])
   })
@@ -210,7 +214,7 @@ describe('a child that will not stop', () => {
       StructuredAgentSessionEvictionError
     )
     expect(ctx.eventSink.close).not.toHaveBeenCalled()
-    expect(ctx.forget).not.toHaveBeenCalled()
+    expect(ctx.acknowledgeRelease).not.toHaveBeenCalled()
   })
 })
 
@@ -225,9 +229,9 @@ describe('eviction against the real sink cache', () => {
       sessionId,
       eventSink: state.eventSinkFor(sessionId),
       adapter: { closeSession: async () => true } as never,
-      forget: async () => {},
       discardSink: () => state.discardEventSink(sessionId),
-      releaseLease: async () => {}
+      releaseLease: async () => {},
+      acknowledgeRelease: () => {}
     })
 
     const published: string[] = []
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-eviction.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-eviction.ts
index e5a1d942818c..2c03143ff417 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-eviction.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-eviction.ts
@@ -1,4 +1,4 @@
-// Releasing one structured session's resources.
+// Stopping one structured session's provider child and handing its lease back.
 //
 // Teardown is a DATA list, not a method body, for the reason this file exists at all: the host
 // tracked which sessions were live in a map, and tore them down at three unrelated call sites
@@ -22,6 +22,7 @@ import {
   type StructuredAgentSessionAdapter
 } from './structured-agent-session-adapter'
 import type { DeferredStructuredAgentSessionEventSink } from './structured-agent-session-event-sink'
+import type { StructuredAgentSessionStopVerdict } from './structured-agent-session-host-types'
 import { withTimeout } from '../../../shared/promise-timeout-fallback'
 
 export type StructuredAgentSessionEvictionContext = {
@@ -29,17 +30,17 @@ export type StructuredAgentSessionEvictionContext = {
   hasProviderChild?: boolean
   eventSink: DeferredStructuredAgentSessionEventSink
   adapter: StructuredAgentSessionAdapter
-  /** Closes the session's journal handle and drops the map entry. Async and
-   *  awaited: `close()` is ordered behind queued writes, and a delete that
-   *  returns while the close is still queued leaves nothing to retry. */
-  forget: () => Promise<void>
+  /** Tells the adapter the released lease is done with, so it drops this child's route and index.
+   *  The conversation stays: stopping the agent never closes its journal. */
+  acknowledgeRelease: () => Promise<void> | void
   /** Drops the cached sink so a later attach mints a fresh one. */
   discardSink: () => void
   /** Fires right before the stop, while the child's turn and background roster are still live. A
    *  throw is logged, never allowed to abort the stop. */
   beforeProviderChildStop?: () => void
-  /** Fires once the adapter has PROVEN the child gone, so host bookkeeping stops claiming one. */
-  onProviderChildStopped?: () => void
+  /** Fires with the stop's verdict once `stopAgentSessionProviderRoot` read the root gone, so host
+   *  bookkeeping stops claiming a child. */
+  onProviderChildStopped?: (verdict: StructuredAgentSessionStopVerdict) => void
   /** Whether this host still owes the child's wind-down. Distinct from `hasProviderChild`, which a
    *  proven exit retires mid-run: the two disagree for exactly the steps a retry has to repeat. */
   owesProviderChildWindDown?: boolean
@@ -84,13 +85,13 @@ export const STRUCTURED_AGENT_SESSION_EVICTION_STEPS: readonly StructuredAgentSe
         }
         // An adapter with no close has nothing to stop; anything else must PROVE the exit.
         const stop = context.adapter.disposeSession ?? context.adapter.closeSession
-        if (
-          stop &&
-          !(await stopAgentSessionProviderRoot(() => stop.call(context.adapter, context.sessionId)))
-        ) {
+        const rootGone = stop
+          ? await stopAgentSessionProviderRoot(() => stop.call(context.adapter, context.sessionId))
+          : true
+        if (!rootGone) {
           throw new Error('provider child exit was not proven')
         }
-        context.onProviderChildStopped?.()
+        context.onProviderChildStopped?.({ rootGone })
       }
     },
     {
@@ -115,11 +116,11 @@ export const STRUCTURED_AGENT_SESSION_EVICTION_STEPS: readonly StructuredAgentSe
     // these two; eviction has to as well.
     { name: 'discard-sink', run: (context) => context.discardSink() },
     // Why here and not last: the durable lease still names a process this host just stopped, and a
-    // record left claiming a live owner is one nothing can resume — the next surface to open the
-    // chat would find a session it may not acquire. Placed BEFORE forget so a release that cannot
-    // be written aborts while the session is still indexed, which is what makes the retry real.
+    // record left claiming a live owner is one nothing can resume — the next send would find a
+    // session it may not acquire. Placed BEFORE the acknowledgement so a release that cannot be
+    // written aborts while the adapter still routes the session, which is what makes the retry real.
     { name: 'release-lease', run: (context) => context.releaseLease() },
-    { name: 'forget-session', run: (context) => context.forget() }
+    { name: 'acknowledge-release', run: (context) => context.acknowledgeRelease() }
   ]
 
 export class StructuredAgentSessionEvictionError extends Error {
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-failed-create-owner-verdict.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-failed-create-owner-verdict.test.ts
index 3d064eed7e0b..317e7ca81a0d 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-failed-create-owner-verdict.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-failed-create-owner-verdict.test.ts
@@ -13,6 +13,7 @@ import {
   type StructuredAgentSessionAdapter
 } from './structured-agent-session-adapter'
 import { StructuredAgentSessionHost } from './structured-agent-session-host'
+import { withObservedProviderExit } from './structured-agent-session-failure-text'
 import {
   HOST_TEST_NOW as NOW,
   HOST_TEST_SESSION as SESSION,
@@ -23,6 +24,10 @@ import {
 
 const CALLER = { callerKey: 'client-1' }
 const EXIT_REASON = 'claude stream-json exited (code 1): stderr tail'
+// The refusal says what the chat's start failure says; the error text stays in the log.
+const COULD_NOT_RESTART = "Codex couldn't restart. Send your message to try again."
+const PROVIDER_STOPPED =
+  'Codex stopped before it finished starting. Send your message to try again.'
 
 let root: string
 let store: AgentSessionRecordStore
@@ -66,47 +71,75 @@ afterEach(async () => {
 })
 
 describe('failed create owner verdict', () => {
-  it('answers an exit-proven failure as exited on the first call and its replay, and a new operation starts fresh', async () => {
-    // The cleanup's release proves the whole tree gone: the common failed start.
-    acquire.mockRejectedValueOnce(new Error(EXIT_REASON))
-    const first = hostTestAttachParams(null)
-    const refusal = {
-      code: 'agent_session_operation_invalid',
-      message: EXIT_REASON,
-      ownerVerdict: 'exited'
-    }
-
-    await expect(host.attach(CALLER, first)).resolves.toEqual({ ok: false, refusal })
-    await expect(host.attach(CALLER, first)).resolves.toEqual({ ok: false, refusal })
-    expect(acquire).toHaveBeenCalledOnce()
+  it.each([
+    // The cleanup's release proves the whole tree gone, which says nothing about why it failed.
+    ['a failure the cleanup proved gone', () => new Error(EXIT_REASON), {}, COULD_NOT_RESTART],
+    // Only an exit the adapter saw says the provider stopped.
+    [
+      'an exit the adapter observed',
+      () => withObservedProviderExit(new Error(EXIT_REASON)),
+      { reason: 'providerStartFailed' },
+      PROVIDER_STOPPED
+    ]
+  ])(
+    'answers %s as exited on the first call and its replay, and a new operation starts fresh',
+    async (_case, failure, situation, message) => {
+      acquire.mockRejectedValueOnce(failure())
+      const first = hostTestAttachParams(null)
+      // The replay names the same details as the first answer: the ledger kept them beside the code,
+      // and the verdict reaches released clients at the top level exactly as before.
+      const refusal = {
+        code: 'agent_session_operation_invalid',
+        details: { ...situation, ownerVerdict: 'exited' },
+        message,
+        ownerVerdict: 'exited'
+      }
 
-    const retry = hostTestAttachParams(null)
-    expect(retry.envelope.clientOperationId).not.toBe(first.envelope.clientOperationId)
-    await expect(host.attach(CALLER, retry)).resolves.toMatchObject({ ok: true })
-    expect(acquire).toHaveBeenCalledTimes(2)
-    expect(store.getRecord(SESSION)?.lease.claimStatus).toBe('live')
-  })
+      await expect(host.attach(CALLER, first)).resolves.toEqual({ ok: false, refusal })
+      await expect(host.attach(CALLER, first)).resolves.toEqual({ ok: false, refusal })
+      expect(acquire).toHaveBeenCalledOnce()
 
-  it('answers a first-hand root exit as exited on the first call, in the shape its replay takes', async () => {
-    acquire.mockRejectedValueOnce(
-      new AgentSessionAcquisitionRootExitObservedError(new Error(EXIT_REASON))
-    )
-    const first = hostTestAttachParams(null)
-    const refusal = {
-      code: 'agent_session_operation_invalid',
-      message: EXIT_REASON,
-      ownerVerdict: 'exited'
+      const retry = hostTestAttachParams(null)
+      expect(retry.envelope.clientOperationId).not.toBe(first.envelope.clientOperationId)
+      await expect(host.attach(CALLER, retry)).resolves.toMatchObject({ ok: true })
+      expect(acquire).toHaveBeenCalledTimes(2)
+      expect(store.getRecord(SESSION)?.lease.claimStatus).toBe('live')
     }
+  )
+
+  it.each([
+    // A cleanup that saw the root go may have stopped it itself.
+    ['a root exit the cleanup saw', () => new Error(EXIT_REASON), {}, COULD_NOT_RESTART],
+    [
+      'a root exit the adapter observed',
+      () => withObservedProviderExit(new Error(EXIT_REASON)),
+      { reason: 'providerStartFailed' },
+      PROVIDER_STOPPED
+    ]
+  ])(
+    'answers %s as exited on the first call, in the shape its replay takes',
+    async (_case, cause, situation, message) => {
+      acquire.mockRejectedValueOnce(new AgentSessionAcquisitionRootExitObservedError(cause()))
+      const first = hostTestAttachParams(null)
+      // The replay names the same details as the first answer: the ledger kept them beside the code,
+      // and the verdict reaches released clients at the top level exactly as before.
+      const refusal = {
+        code: 'agent_session_operation_invalid',
+        details: { ...situation, ownerVerdict: 'exited' },
+        message,
+        ownerVerdict: 'exited'
+      }
 
-    await expect(host.attach(CALLER, first)).resolves.toEqual({ ok: false, refusal })
-    await expect(host.attach(CALLER, first)).resolves.toEqual({ ok: false, refusal })
-    expect(acquire).toHaveBeenCalledOnce()
+      await expect(host.attach(CALLER, first)).resolves.toEqual({ ok: false, refusal })
+      await expect(host.attach(CALLER, first)).resolves.toEqual({ ok: false, refusal })
+      expect(acquire).toHaveBeenCalledOnce()
 
-    await expect(host.attach(CALLER, hostTestAttachParams(null))).resolves.toMatchObject({
-      ok: true
-    })
-    expect(acquire).toHaveBeenCalledTimes(2)
-  })
+      await expect(host.attach(CALLER, hostTestAttachParams(null))).resolves.toMatchObject({
+        ok: true
+      })
+      expect(acquire).toHaveBeenCalledTimes(2)
+    }
+  )
 
   it('answers an acquisition refusal with its verdict directly', async () => {
     acquire.mockRejectedValueOnce(new AgentSessionAcquisitionRefusal('not signed in'))
@@ -115,7 +148,8 @@ describe('failed create owner verdict', () => {
       ok: false,
       refusal: {
         code: 'agent_session_operation_invalid',
-        message: 'not signed in',
+        details: { reason: 'providerStartFailed', ownerVerdict: 'exited' },
+        message: PROVIDER_STOPPED,
         ownerVerdict: 'exited'
       }
     })
@@ -132,6 +166,10 @@ describe('failed create owner verdict', () => {
       ok: false,
       refusal: { code: 'agent_session_ownership_unknown', ownerVerdict: 'unverifiable' }
     })
-    expect(store.getRecord(SESSION)?.lease.claimStatus).not.toBe('released')
+    // Released so the next start can go ahead, but with no death evidence: nothing proved it.
+    expect(store.getRecord(SESSION)?.lease).toMatchObject({
+      claimStatus: 'released',
+      deathEvidence: null
+    })
   })
 })
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-failed-create-refusal.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-failed-create-refusal.ts
index a5e00fde53c0..90f52db3d095 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-failed-create-refusal.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-failed-create-refusal.ts
@@ -1,7 +1,12 @@
-import type {
-  AgentSessionAttachResult,
-  AgentSessionMutationResult,
-  AgentSessionWireRefusal
+import {
+  isAgentSessionWireRefusalCode,
+  refuse,
+  refuseUnclassified,
+  withAgentSessionRefusalFacts,
+  type AgentSessionAttachResult,
+  type AgentSessionMutationResult,
+  type AgentSessionRefusalDetailsByCode,
+  type AgentSessionWireRefusal
 } from '../../../shared/agent-session-wire'
 import type {
   AgentSessionOperationOutcome,
@@ -15,16 +20,50 @@ import {
   AgentSessionAcquisitionExitUnprovenError,
   AgentSessionAcquisitionRefusal,
   AgentSessionAcquisitionRootExitObservedError,
+  AgentSessionPreSpawnError,
   isAgentSessionPreSpawnError
 } from './structured-agent-session-adapter'
+import {
+  providerExitObserved,
+  structuredAgentSessionStartFailure
+} from './structured-agent-session-failure-text'
+import { structuredAgentSessionFailureWordsContext } from './structured-agent-session-send-preparation'
+
+/** Who a failed acquisition's sentence names, and whether it was the session's first start. */
+export type FailedAcquisitionWording = {
+  record: AgentSessionRecord | null
+  newSession: boolean
+}
+
+/** The refusal a failed acquisition answers with, worded as the start failure it records: its
+ *  error text is Orca's or the provider's log wording, so it goes to the log, never the wire. */
+function failedAcquisitionWireRefusal(
+  details: AgentSessionRefusalDetailsByCode['agent_session_operation_invalid'] | undefined,
+  wording: FailedAcquisitionWording
+): AgentSessionWireRefusal {
+  const code = 'agent_session_operation_invalid'
+  const refusal = details ? refuse(code, details, code) : refuseUnclassified(code, code)
+  const { reason } = structuredAgentSessionStartFailure(
+    { refusal, ...(wording.newSession ? { newSession: true as const } : {}) },
+    structuredAgentSessionFailureWordsContext(wording.record)
+  )
+  return { ...refusal, message: reason }
+}
 
 /** What a failed acquisition proved about its process, and the outcome its operation settles to. */
-export function failedAcquisitionSettlement(error: unknown): {
+export function failedAcquisitionSettlement(
+  error: unknown,
+  wording: FailedAcquisitionWording
+): {
   exitProof: AgentSessionAcquisitionExitProof
   outcome: Extract<AgentSessionOperationOutcome, { status: 'failed' }>
 } {
   if (error instanceof AgentSessionAcquisitionExitUnprovenError) {
-    const outcome = { code: 'agent_session_ownership_unknown', message: error.message }
+    const outcome = {
+      code: 'agent_session_ownership_unknown',
+      details: { reason: 'ownerUnproven' as const },
+      message: error.message
+    }
     return { exitProof: 'unproven', outcome: { status: 'failed', ...outcome } }
   }
   const exitProof = isAgentSessionPreSpawnError(error)
@@ -32,33 +71,79 @@ export function failedAcquisitionSettlement(error: unknown): {
     : error instanceof AgentSessionAcquisitionRootExitObservedError
       ? 'root-exit-observed'
       : 'exit-proven'
-  const message = error instanceof Error ? error.message : String(error)
-  const code =
-    error instanceof AgentSessionAcquisitionRefusal ? error.code : 'agent_session_operation_invalid'
-  return { exitProof, outcome: { status: 'failed', code, message } }
+  const raw = error instanceof Error ? error.message : String(error)
+  const details = failedAcquisitionDetails(error)
+  const message =
+    failedAcquisitionRefusal(error, wording)?.refusal.message ??
+    // A store refusal's message is its code, which its replay has always carried.
+    (isAgentSessionWireRefusalCode(raw)
+      ? raw
+      : failedAcquisitionWireRefusal(details, wording).message)
+  return {
+    exitProof,
+    outcome: {
+      status: 'failed',
+      code: 'agent_session_operation_invalid',
+      ...(details ? { details } : {}),
+      message
+    }
+  }
+}
+
+/** Cleanup proved the child gone after the start failed, whatever failed it. */
+function isExitProvenAcquisitionFailure(error: unknown): error is Error {
+  return (
+    error instanceof AgentSessionAcquisitionRootExitObservedError ||
+    error instanceof AgentSessionAcquisitionExitProvenError
+  )
+}
+
+/** The situation a failed acquisition stands for: what the adapter typed, or a provider the
+ *  adapter saw exit while starting. A provider refusing a request, a timeout, a store refusal or
+ *  Orca's own fault names none: the child being gone now says nothing about why. */
+function failedAcquisitionDetails(
+  error: unknown
+): AgentSessionRefusalDetailsByCode['agent_session_operation_invalid'] | undefined {
+  if (error instanceof AgentSessionAcquisitionRefusal) {
+    return { reason: error.reason }
+  }
+  if (isAgentSessionPreSpawnError(error) && error.reason) {
+    return { reason: error.reason }
+  }
+  if (isExitProvenAcquisitionFailure(error) && providerExitObserved(error)) {
+    return { reason: 'providerStartFailed' }
+  }
+  return undefined
 }
 
 /** A failed acquisition answered as a refusal on the first call, in the shape its replay takes;
  *  null leaves the error to the store-failure classification. */
 export function failedAcquisitionRefusal(
-  error: unknown
+  error: unknown,
+  wording: FailedAcquisitionWording
 ): { ok: false; refusal: AgentSessionWireRefusal } | null {
-  if (error instanceof AgentSessionAcquisitionRefusal) {
-    return { ok: false, refusal: { code: error.code, message: error.message } }
-  }
-  // A proven exit is a settled fact; its message is the provider's own diagnostic.
-  if (
-    error instanceof AgentSessionAcquisitionRootExitObservedError ||
-    error instanceof AgentSessionAcquisitionExitProvenError
-  ) {
+  // A proven exit is a settled failure, answered in the shape its ledger row replays.
+  if (error instanceof AgentSessionAcquisitionRefusal || isExitProvenAcquisitionFailure(error)) {
     return {
       ok: false,
-      refusal: { code: 'agent_session_operation_invalid', message: error.message }
+      refusal: failedAcquisitionWireRefusal(failedAcquisitionDetails(error), wording)
     }
   }
   return null
 }
 
+/** A start that failed before any process still throws, in the sentence its replay reads: the
+ *  error's own text is Orca's or the refusing site's, so it goes to the log. A message that is
+ *  itself a code keeps it, since the wire routes on it. */
+export function preSpawnFailureInWords(error: unknown, wording: FailedAcquisitionWording): unknown {
+  if (!isAgentSessionPreSpawnError(error) || /^[a-z0-9_]+$/.test(error.message)) {
+    return error
+  }
+  return new AgentSessionPreSpawnError(error, {
+    message: failedAcquisitionSettlement(error, wording).outcome.message
+  })
+}
+
 /** Only a durably failed operation says anything about retrying under a new one. */
 export function failedCreateRefusal(
   refusal: AgentSessionWireRefusal,
@@ -68,7 +153,9 @@ export function failedCreateRefusal(
   return status === 'failed' && record
     ? {
         ok: false,
-        refusal: { ...refusal, ownerVerdict: agentSessionLeaseOwnerVerdict(record.lease) }
+        refusal: withAgentSessionRefusalFacts(refusal, {
+          ownerVerdict: agentSessionLeaseOwnerVerdict(record.lease)
+        })
       }
     : { ok: false, refusal }
 }
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-failed-create-sink-release.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-failed-create-sink-release.test.ts
index c61d93cbb8fd..69f9b95c03a3 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-failed-create-sink-release.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-failed-create-sink-release.test.ts
@@ -82,8 +82,11 @@ describe('a create that fails after its child wrote through the unbound sink', (
 
       const failed = host.attach(CALLER, hostTestAttachParams(null))
       await (cause instanceof AgentSessionPreSpawnError
-        ? expect(failed).rejects.toThrow(EXIT_REASON)
-        : expect(failed).resolves.toMatchObject({ ok: false, refusal: { message: EXIT_REASON } }))
+        ? expect(failed).rejects.toThrow("Codex couldn't restart. Send your message to try again.")
+        : expect(failed).resolves.toMatchObject({
+            ok: false,
+            refusal: { message: "Codex couldn't restart. Send your message to try again." }
+          }))
 
       await expect(host.attach(CALLER, hostTestAttachParams(null))).resolves.toMatchObject({
         ok: true
@@ -118,7 +121,7 @@ describe('a create that fails after its child wrote through the unbound sink', (
     // The session stays indexed across this failure: it is a resume, not a create.
     const failed = host.attach(CALLER, hostTestAttachParams(releasedFence))
     await (cause instanceof AgentSessionPreSpawnError
-      ? expect(failed).rejects.toThrow(EXIT_REASON)
+      ? expect(failed).rejects.toThrow("Codex couldn't restart. Send your message to try again.")
       : expect(failed).resolves.toMatchObject({ ok: false }))
 
     const fence = store.getRecord(SESSION)?.lease.runtimeFence ?? 0
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-failure-text.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-failure-text.test.ts
new file mode 100644
index 000000000000..fcebdda77266
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-failure-text.test.ts
@@ -0,0 +1,201 @@
+import { describe, expect, it } from 'vitest'
+import {
+  MAX_PROVIDER_DIAGNOSTIC_CHARS,
+  providerDiagnostic,
+  withProviderDiagnostic
+} from '../../../shared/agent-session-failure'
+import {
+  AgentSessionRefusalError,
+  refuse,
+  refuseUnclassified
+} from '../../../shared/agent-session-wire-refusals'
+import { AgentSessionAcquisitionRefusal } from './structured-agent-session-adapter'
+import { MAX_UNEXPECTED_EXIT_REASON_CHARS } from './structured-agent-session-dead-generation-settlement'
+import {
+  structuredAgentSessionStartFailure,
+  withObservedProviderExit
+} from './structured-agent-session-failure-text'
+
+/** What Orca's own error text looks like: a code, a marker, a uuid, a path, an exception. */
+const ORCA_INTERNAL =
+  /agent_session_|execution_owner|provider_[a-z_]+|[0-9a-f]{8}-[0-9a-f]{4}-|[/\\][\w.-]+[/\\]|Error:|ENOENT/
+
+describe('structuredAgentSessionStartFailure', () => {
+  it('keeps a provider diagnostic only when the error carried one', () => {
+    const carried = withProviderDiagnostic(
+      new Error('claude stream-json exited (code 1): boom'),
+      providerDiagnostic('code 1\nboom', 'log')
+    )
+    expect(structuredAgentSessionStartFailure({ error: carried }, { agentName: 'Claude' })).toEqual(
+      {
+        reason: "Claude couldn't start. Send your message to try again.",
+        rejection: { kind: 'startFailed', detail: { text: 'code 1\nboom', audience: 'log' } }
+      }
+    )
+    // Orca's own words, however provider-like, are never promoted to a detail.
+    expect(
+      structuredAgentSessionStartFailure({ error: new Error('Not logged in. Run /login.') })
+        .rejection
+    ).toEqual({ kind: 'startFailed' })
+  })
+
+  it('keeps a start refusal the adapter typed', () => {
+    const refusal = new AgentSessionAcquisitionRefusal(
+      'Claude is not signed in for the selected account.',
+      'notSignedIn'
+    )
+    expect(structuredAgentSessionStartFailure({ error: refusal }, { agentName: 'Claude' })).toEqual(
+      {
+        reason:
+          'Claude is not signed in for the selected account. Sign in, then send your message again.',
+        rejection: { kind: 'notSignedIn' }
+      }
+    )
+  })
+
+  it.each([
+    [
+      'managedAccountEnvOverride',
+      'This Claude launch sets its own Anthropic sign-in variables. Remove them to use a managed Claude account.'
+    ],
+    [
+      'accountSwitchInProgress',
+      'A Claude account switch is in progress. Try again after it finishes.'
+    ],
+    [
+      'managedAccountUnsupported',
+      'While a Claude account is added in WSL, Claude chats need a Windows Claude account. Choose or add one in Claude Accounts settings, then send your message again.'
+    ]
+  ] as const)('words a start refused for %s by that situation', (reason, sentence) => {
+    const code = 'agent_session_operation_invalid'
+    expect(
+      structuredAgentSessionStartFailure(
+        { refusal: refuse(code, { reason }, code) },
+        { agentName: 'Claude' }
+      )
+    ).toEqual({ reason: sentence, rejection: { kind: reason } })
+  })
+
+  it('words a refused restart by its situation, never its message', () => {
+    const words = structuredAgentSessionStartFailure(
+      {
+        refusal: refuse(
+          'agent_session_ownership_unknown',
+          { reason: 'ownerUnproven' },
+          'Orca cannot prove that process 4242 on host-1 has exited.'
+        )
+      },
+      { agentName: 'Claude' }
+    )
+    expect(words).toEqual({
+      reason: "Claude couldn't restart. Send your message to try again.",
+      rejection: {
+        kind: 'restartFailed',
+        refusal: {
+          code: 'agent_session_ownership_unknown',
+          details: { reason: 'ownerUnproven' }
+        }
+      }
+    })
+  })
+
+  it("reads an exit before the start as a failed start, and an Orca fault as Orca's", () => {
+    expect(
+      structuredAgentSessionStartFailure({
+        exit: { kind: 'providerExited', detail: { text: 'stderr', audience: 'log' } }
+      }).rejection
+    ).toEqual({ kind: 'providerStartFailed', detail: { text: 'stderr', audience: 'log' } })
+    expect(structuredAgentSessionStartFailure({ exit: { kind: 'hostFault' } }).rejection).toEqual({
+      kind: 'hostFault'
+    })
+    expect(structuredAgentSessionStartFailure({ hostFault: true }).reason).not.toMatch(
+      ORCA_INTERNAL
+    )
+  })
+
+  it("holds any provider detail to the lease record's cap", () => {
+    expect(MAX_PROVIDER_DIAGNOSTIC_CHARS).toBe(512)
+    expect(MAX_UNEXPECTED_EXIT_REASON_CHARS).toBe(MAX_PROVIDER_DIAGNOSTIC_CHARS)
+    const long = 'x'.repeat(4_000)
+    // However the caller built the detail, the fact stores at most the cap.
+    const words = structuredAgentSessionStartFailure({
+      diagnostic: { text: long, audience: 'log' }
+    })
+    expect(words.rejection.detail?.text).toHaveLength(MAX_UNEXPECTED_EXIT_REASON_CHARS)
+    expect(
+      structuredAgentSessionStartFailure({
+        exit: { kind: 'providerExited', detail: { text: long, audience: 'log' } }
+      }).rejection.detail?.text
+    ).toHaveLength(MAX_UNEXPECTED_EXIT_REASON_CHARS)
+  })
+
+  it('says the provider stopped only when an exit was observed', () => {
+    // An `exited` verdict says only that nothing runs now, not that the provider stopped.
+    const gone = refuseUnclassified('agent_session_operation_invalid', 'thread gone', {
+      ownerVerdict: 'exited'
+    })
+    const person = { text: 'no rollout found for thread id T', audience: 'person' } as const
+    expect(
+      structuredAgentSessionStartFailure(
+        { refusal: gone, diagnostic: person },
+        { agentName: 'Codex' }
+      )
+    ).toEqual({
+      reason: "Codex couldn't restart. Send your message to try again.",
+      rejection: {
+        kind: 'restartFailed',
+        detail: person,
+        refusal: {
+          code: 'agent_session_operation_invalid',
+          details: { ownerVerdict: 'exited' }
+        }
+      }
+    })
+    const observed = refuse(
+      'agent_session_operation_invalid',
+      { reason: 'providerStartFailed', ownerVerdict: 'exited' },
+      'exited (code 1)'
+    )
+    expect(
+      structuredAgentSessionStartFailure({
+        refusal: observed,
+        diagnostic: { text: 'code 1', audience: 'log' }
+      })
+    ).toEqual({
+      reason: 'The agent stopped before it finished starting. Send your message to try again.',
+      rejection: { kind: 'providerStartFailed', detail: { text: 'code 1', audience: 'log' } }
+    })
+    // A start that threw proves nothing about the provider: it may be Orca's, or a failed spawn.
+    expect(
+      structuredAgentSessionStartFailure({ error: new Error('spawn claude ENOENT') }, {})
+    ).toEqual({
+      reason: "The agent couldn't start. Send your message to try again.",
+      rejection: { kind: 'startFailed' }
+    })
+    // The same error, once the adapter that observed the child's exit marked it, blames the provider.
+    const exit = withObservedProviderExit(
+      withProviderDiagnostic(new Error('exited (code 1)'), providerDiagnostic('code 1', 'log'))
+    )
+    expect(
+      structuredAgentSessionStartFailure({ error: new Error('wrapped', { cause: exit }) })
+    ).toEqual({
+      reason: 'The agent stopped before it finished starting. Send your message to try again.',
+      rejection: { kind: 'providerStartFailed', detail: { text: 'code 1', audience: 'log' } }
+    })
+  })
+
+  it('reads a thrown refusal the same as a returned one', () => {
+    const thrown = new AgentSessionRefusalError(
+      refuse(
+        'agent_session_conflict',
+        { reason: 'claimConflicted' },
+        'Another process claims this session.'
+      )
+    )
+    expect(thrown.message).toBe('agent_session_conflict')
+    expect(structuredAgentSessionStartFailure({ refusal: thrown.refusal }).rejection).toEqual({
+      kind: 'restartFailed',
+      refusal: { code: 'agent_session_conflict', details: { reason: 'claimConflicted' } }
+    })
+  })
+})
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-failure-text.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-failure-text.ts
new file mode 100644
index 000000000000..c0c2172230dc
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-failure-text.ts
@@ -0,0 +1,163 @@
+// The facts a start or an exit reduces to, and the one place a failed start is worded. The
+// sentence itself comes from `agentSessionFailureWords`, beside the fact it states.
+
+import {
+  agentSessionFailureFact,
+  providerDiagnosticOf,
+  type SubmissionRejectionFact,
+  type AgentSessionFailureKind,
+  type ProviderDiagnostic
+} from '../../../shared/agent-session-failure'
+import type { AgentSessionRefusalReason } from '../../../shared/agent-session-refusal-details'
+import {
+  agentSessionFailureWords,
+  type AgentJournalDispatchRejection,
+  type AgentSessionFailureWordsContext
+} from '../../../shared/agent-session-failure-words'
+import {
+  agentSessionRefusalReference,
+  type AgentSessionWireRefusal
+} from '../../../shared/agent-session-wire-refusals'
+import { AgentSessionAcquisitionRefusal } from './structured-agent-session-adapter'
+
+/** Start refusals whose situation is itself what the person reads, with its own next step. */
+const TYPED_START_REFUSALS = [
+  'notSignedIn',
+  'historyTooLarge',
+  'managedAccountEnvOverride',
+  'accountSwitchInProgress',
+  'managedAccountUnsupported'
+] as const satisfies readonly (AgentSessionFailureKind &
+  AgentSessionRefusalReason<'agent_session_operation_invalid'>)[]
+
+function typedStartRefusal(
+  reason: string | undefined
+): (typeof TYPED_START_REFUSALS)[number] | undefined {
+  return TYPED_START_REFUSALS.find((typed) => typed === reason)
+}
+
+/** Marks the error an adapter observed its child's exit with, where it observed it. */
+export function withObservedProviderExit<TError extends Error>(error: TError): TError {
+  return Object.assign(error, { providerExitObserved: true })
+}
+
+/** Whether the adapter saw the child exit on its own. Follows `cause` and the errors a cleanup
+ *  aggregated, since the acquisition errors wrap what the adapter threw. */
+export function providerExitObserved(error: unknown, depth = 0): boolean {
+  if (depth >= 6 || !(error instanceof Error)) {
+    return false
+  }
+  if ('providerExitObserved' in error && error.providerExitObserved === true) {
+    return true
+  }
+  if (
+    error instanceof AggregateError &&
+    error.errors.some((inner) => providerExitObserved(inner, depth + 1))
+  ) {
+    return true
+  }
+  return providerExitObserved(error.cause, depth + 1)
+}
+
+/** A start that did not land. A refusal the adapter typed keeps its situation, and an exit the
+ *  adapter observed says the provider stopped; anything else blames no one — it may be Orca's, or
+ *  a spawn that failed. Either keeps the provider's diagnostic when the error carried one. */
+export function providerStartupFailureFact(cause?: unknown): SubmissionRejectionFact {
+  const typed = typedStartRefusal(
+    cause instanceof AgentSessionAcquisitionRefusal ? cause.reason : undefined
+  )
+  if (typed) {
+    return agentSessionFailureFact(typed)
+  }
+  return agentSessionFailureFact(
+    providerExitObserved(cause) ? 'providerStartFailed' : 'startFailed',
+    { detail: providerDiagnosticOf(cause) }
+  )
+}
+
+/** A child that ended before it proved its start: an exit is a start that failed, keeping the
+ *  provider's diagnostic; an Orca fault or a typed start refusal stays what it was. */
+function startupFailureFromExit(
+  failure: SubmissionRejectionFact | undefined
+): SubmissionRejectionFact {
+  if (!failure || failure.kind === 'providerExited') {
+    return agentSessionFailureFact('providerStartFailed', { detail: failure?.detail })
+  }
+  return failure
+}
+
+/** What the chat records when a session could not be made ready. Only a refusal the host typed as
+ *  an observed exit says the provider stopped; a verdict of `exited` means only that nothing runs
+ *  now. */
+function refusedStartFailureFact(
+  cause: Extract<StructuredAgentSessionStartFailureCause, { refusal: unknown }>
+): SubmissionRejectionFact {
+  const { refusal, diagnostic } = cause
+  const reason = refusal.details?.reason
+  const typed = typedStartRefusal(reason)
+  if (typed) {
+    return agentSessionFailureFact(typed)
+  }
+  if (reason === 'providerStartFailed') {
+    return agentSessionFailureFact('providerStartFailed', { detail: diagnostic })
+  }
+  return agentSessionFailureFact(cause.newSession ? 'startFailed' : 'restartFailed', {
+    detail: diagnostic,
+    refusal: agentSessionRefusalReference(refusal)
+  })
+}
+
+/** Why a start the chat needed did not land, as the place that saw it knows it. */
+export type StructuredAgentSessionStartFailureCause =
+  /** The session could not be made ready; the provider's words, if any, are kept host-side, off
+   *  the refusal. `newSession`: one that never ran, so it failed to start rather than restart. */
+  | { refusal: AgentSessionWireRefusal; diagnostic?: ProviderDiagnostic; newSession?: true }
+  /** A start that threw, or an adapter's own startup failure; any diagnostic it carries. */
+  | { error: unknown }
+  /** The child ended before it proved its start, as its ended event told it. */
+  | { exit: SubmissionRejectionFact | undefined }
+  /** The provider exited while starting; only its words are known, and the caller names their
+   *  audience. */
+  | { diagnostic: ProviderDiagnostic | undefined }
+  /** Orca's own fault; its error belongs in the log. */
+  | { hostFault: true }
+  /** Already typed where it was observed. */
+  | { failure: SubmissionRejectionFact }
+
+/** A start failure's row repeats the sentence its rejected messages carry: both are about the
+ *  messages the start was for. */
+export type StructuredAgentSessionStartFailureWords = AgentJournalDispatchRejection
+
+/** The fact a failed start records, for a writer that words it on its own surface. */
+export function structuredAgentSessionStartFailureFact(
+  cause: StructuredAgentSessionStartFailureCause
+): SubmissionRejectionFact {
+  if ('refusal' in cause) {
+    return refusedStartFailureFact(cause)
+  }
+  if ('error' in cause) {
+    return providerStartupFailureFact(cause.error)
+  }
+  if ('exit' in cause) {
+    return startupFailureFromExit(cause.exit)
+  }
+  if ('diagnostic' in cause) {
+    return agentSessionFailureFact('providerStartFailed', { detail: cause.diagnostic })
+  }
+  if ('hostFault' in cause) {
+    return agentSessionFailureFact('hostFault')
+  }
+  return cause.failure
+}
+
+/** The one place a failed start is worded: the error row and every message it rejects carry this
+ *  sentence and this fact, whichever writer saw the start fail. */
+export function structuredAgentSessionStartFailure(
+  cause: StructuredAgentSessionStartFailureCause,
+  context: AgentSessionFailureWordsContext = {}
+): StructuredAgentSessionStartFailureWords {
+  return agentSessionFailureWords(structuredAgentSessionStartFailureFact(cause), {
+    ...context,
+    surface: 'rejection'
+  })
+}
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-forget-status.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-forget-status.test.ts
index 20531bd64653..90e07ddf88ca 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-forget-status.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-forget-status.test.ts
@@ -21,11 +21,10 @@ import type { StructuredAgentSessionAttachContext } from './structured-agent-ses
 import type { StructuredAgentSessionHostSession } from './structured-agent-session-host-types'
 import { StructuredAgentSessionStatusFeed } from './structured-agent-session-status-feed'
 
-// Everything before the journal is out of scope here; what matters is that the orchestration's
-// own `onAttachFailed` runs, which is the real one.
+// Everything before the journal is out of scope here; what matters is what the orchestration does
+// when the attach throws after acquisition.
 vi.mock('./structured-agent-session-attach-flow', () => ({
-  performAttach: async (input: { onAttachFailed?: () => Promise<void> }) => {
-    await input.onAttachFailed?.()
+  performAttach: async () => {
     throw new Error('attach failed after acquisition')
   }
 }))
@@ -136,10 +135,7 @@ async function workingSession(): Promise<{
           accountHome: ownerRecord().accountHome,
           runtimeKind: 'native'
         },
-        fence: 1,
-        hasProviderChild: true,
-        providerChildPhase: 'ready',
-        acquisitionGeneration: null
+        child: { generation: null, fence: 1, phase: 'ready' }
       }
     ]
   ])
@@ -190,7 +186,7 @@ function attachContext(
     reconcileLeases: async () => null,
     serialize: <T>(_sessionId: string, task: () => Promise<T>) => task(),
     now: () => 1,
-    forgetStatus: (sessionId: string) => feed.forget(sessionId)
+    publishStatus: (sessionId: string) => feed.publish(sessionId)
   } as unknown as StructuredAgentSessionAttachContext
 }
 
@@ -230,15 +226,19 @@ describe('a session that leaves the host without an explicit close', () => {
     expect(server.getStatusSnapshot()).toEqual([expect.objectContaining({ prompt: 'other host' })])
   })
 
-  it('leaves the agent-status store with it when an attach fails', async () => {
+  // A failed attach no longer drops the session: the conversation stays open for the failure to be
+  // written into, so its row stays with it and the later close forgets both together.
+  it('keeps the session and its status row together when an attach fails', async () => {
     const { server, feed, sessions } = await workingSession()
+    const drop = vi.spyOn(server, 'dropStructuredStatus')
 
     await expect(
       attachStructuredAgentSession(attachContext(sessions, feed), 'caller-1', attachParams)
     ).rejects.toThrow('attach failed after acquisition')
 
-    expect(sessions.has(SESSION)).toBe(false)
-    expect(server.getStatusSnapshot()).toEqual([])
+    expect(sessions.has(SESSION)).toBe(true)
+    expect(drop).not.toHaveBeenCalled()
+    expect(server.getStatusSnapshot()).toHaveLength(1)
   })
 
   // The feed's own cache deliberately retains the projection for reload history; only the store
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-grouped-prompt.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-grouped-prompt.test.ts
index bbc1ec49d4c4..8181110a5a6b 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-grouped-prompt.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-grouped-prompt.test.ts
@@ -96,7 +96,7 @@ async function seedGroupedQuestion(): Promise<{ itemId: string; revision: number
   })
   await host.flushStreamedEvents(SESSION)
   const itemId = agentJournalItemKey(identity)
-  const page = host.history({ sessionId: SESSION, direction: 'tail' })
+  const page = await host.history({ sessionId: SESSION, direction: 'tail' })
   const appended = page.ok ? page.page.items.find((item) => item.itemId === itemId) : null
   if (!appended) {
     throw new Error('provider question was not written to the journal')
@@ -141,23 +141,78 @@ afterEach(async () => {
 })
 
 describe('grouped question admission', () => {
-  it('admits renderer question-group payloads with child ids and multi-select answers', async () => {
+  it('reads the packed answer an older client sends into structured answers', async () => {
     const attached = await host.attach(CALLER, attachParams())
     expect(attached.ok).toBe(true)
     const prompt = await seedGroupedQuestion()
-    const optionId = encodeAgentSessionQuestionAnswers([
+    const answers = [
       { questionId: 'q1', optionIds: ['target-web', 'target-mobile'] },
       { questionId: 'q2', optionIds: [], other: 'SSH host' }
-    ])
+    ]
+    const optionId = encodeAgentSessionQuestionAnswers(answers)
     const fields = { itemId: prompt.itemId, expectedRevision: prompt.revision, optionId }
     const result = await host.respondToPrompt(CALLER, {
       envelope: envelope('agentSession.respondTo:question', fields),
       kind: 'question',
       ...fields
     })
-    expect(result).toMatchObject({ ok: true, value: { resolution: { state: 'resolved' } } })
+    expect(result).toMatchObject({
+      ok: true,
+      value: { resolution: { state: 'resolved', selectedOptionId: optionId, answers } }
+    })
+    expect(answerPrompt).toHaveBeenCalledWith(
+      expect.objectContaining({ itemId: prompt.itemId, response: { kind: 'answers', answers } })
+    )
+  })
+
+  it('takes structured answers past the old option-id bound and keeps the packed form for older readers', async () => {
+    const attached = await host.attach(CALLER, attachParams())
+    expect(attached.ok).toBe(true)
+    const prompt = await seedGroupedQuestion()
+    const typed = 'Proceed with the replacement, but wait for the capture. '.repeat(40)
+    const answers = [
+      { questionId: 'q1', optionIds: ['target-web'] },
+      { questionId: 'q2', optionIds: [], other: typed }
+    ]
+    const fields = { itemId: prompt.itemId, expectedRevision: prompt.revision, answers }
+    const result = await host.respondToPrompt(CALLER, {
+      envelope: envelope('agentSession.respondTo:question', fields),
+      kind: 'question',
+      ...fields
+    })
+
+    expect(typed.length).toBeGreaterThan(1024)
+    expect(result).toMatchObject({
+      ok: true,
+      value: {
+        resolution: {
+          state: 'resolved',
+          selectedOptionId: encodeAgentSessionQuestionAnswers(answers),
+          answers
+        }
+      }
+    })
     expect(answerPrompt).toHaveBeenCalledWith(
-      expect.objectContaining({ itemId: prompt.itemId, optionId })
+      expect.objectContaining({ response: { kind: 'answers', answers } })
     )
   })
+
+  it('refuses answers that do not match the questions without reaching the provider', async () => {
+    const attached = await host.attach(CALLER, attachParams())
+    expect(attached.ok).toBe(true)
+    const prompt = await seedGroupedQuestion()
+    const answers = [{ questionId: 'q1', optionIds: ['target-web'] }]
+    const fields = { itemId: prompt.itemId, expectedRevision: prompt.revision, answers }
+    const result = await host.respondToPrompt(CALLER, {
+      envelope: envelope('agentSession.respondTo:question', fields),
+      kind: 'question',
+      ...fields
+    })
+
+    expect(result).toMatchObject({
+      ok: false,
+      refusal: { code: 'agent_session_operation_invalid' }
+    })
+    expect(answerPrompt).not.toHaveBeenCalled()
+  })
 })
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-hold-resume-race.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-hold-resume-race.test.ts
deleted file mode 100644
index 974a69b1c3c8..000000000000
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-hold-resume-race.test.ts
+++ /dev/null
@@ -1,260 +0,0 @@
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import { runKeyedSerializedOperation } from '../../cli/keyed-promise-queue'
-import type { StructuredAgentSessionResumeOutcome } from './structured-agent-session-hold-resume'
-import { StructuredAgentSessionHolds } from './structured-agent-session-holds'
-
-const GRACE_MS = 15_000
-const pendingHolds: StructuredAgentSessionHolds[] = []
-
-/** The host's per-session queue: a second hold waits for the attach the first one is running. */
-function keyedSerialize() {
-  const chains = new Map<string, Promise<void>>()
-  return <T>(sessionId: string, task: () => Promise<T>) =>
-    runKeyedSerializedOperation(chains, sessionId, task)
-}
-
-function resumeHarness() {
-  const resumeGate = Promise.withResolvers<void>()
-  let child = false
-  let turnActive = false
-  const evict = vi.fn(async () => {
-    child = false
-  })
-  const resume = vi.fn(async () => {
-    await resumeGate.promise
-    child = true
-    return { ok: true as const }
-  })
-  const holds = new StructuredAgentSessionHolds({
-    resume,
-    serialize: keyedSerialize(),
-    hasProviderChild: () => child,
-    hasOwedWork: () => turnActive,
-    evict,
-    graceMs: GRACE_MS
-  })
-  pendingHolds.push(holds)
-  return {
-    holds,
-    resume,
-    resumeGate,
-    evict,
-    hasChild: () => child,
-    setTurnActive: (value: boolean) => {
-      turnActive = value
-    }
-  }
-}
-
-beforeEach(() => vi.useFakeTimers())
-afterEach(() => {
-  for (const holds of pendingHolds.splice(0)) {
-    holds.dispose()
-  }
-  vi.useRealTimers()
-})
-
-describe('a surface leaving while its structured session resumes', () => {
-  it('releases the acquired child after the last surface disconnects during resume', async () => {
-    const { holds, resumeGate, evict, hasChild } = resumeHarness()
-    const hold = holds.hold('session-1', 'connection-1:chat')
-
-    holds.release('session-1', 'connection-1:chat')
-    expect(holds.isReleasePending('session-1')).toBe(false)
-    resumeGate.resolve()
-    await hold
-
-    expect(hasChild()).toBe(true)
-    expect(holds.isHeld('session-1')).toBe(false)
-    expect(holds.isReleasePending('session-1')).toBe(true)
-    await vi.advanceTimersByTimeAsync(GRACE_MS - 1)
-    expect(evict).not.toHaveBeenCalled()
-    await vi.advanceTimersByTimeAsync(1)
-    expect(evict).toHaveBeenCalledExactlyOnceWith('session-1')
-    expect(hasChild()).toBe(false)
-  })
-
-  it('waits for an active turn before releasing the late child', async () => {
-    const { holds, resumeGate, evict, setTurnActive } = resumeHarness()
-    const hold = holds.hold('session-1', 'connection-1:chat')
-    holds.release('session-1', 'connection-1:chat')
-    setTurnActive(true)
-    resumeGate.resolve()
-    await hold
-
-    await vi.advanceTimersByTimeAsync(GRACE_MS * 2)
-    expect(evict).not.toHaveBeenCalled()
-    expect(holds.isReleasePending('session-1')).toBe(true)
-
-    setTurnActive(false)
-    await vi.advanceTimersByTimeAsync(GRACE_MS)
-    expect(evict).toHaveBeenCalledExactlyOnceWith('session-1')
-  })
-
-  it.each([false, true])('preserves an arriving holder with resume=%s', async (resume) => {
-    const { holds, resumeGate, evict } = resumeHarness()
-    const first = holds.hold('session-1', 'connection-1:chat')
-    holds.release('session-1', 'connection-1:chat')
-    const replacement = holds.hold('session-1', 'connection-2:chat', { resume })
-    resumeGate.resolve()
-    await Promise.all([first, replacement])
-
-    await vi.advanceTimersByTimeAsync(GRACE_MS * 2)
-    expect(holds.isHeld('session-1')).toBe(true)
-    expect(holds.isReleasePending('session-1')).toBe(false)
-    expect(evict).not.toHaveBeenCalled()
-
-    holds.release('session-1', 'connection-2:chat')
-    await vi.advanceTimersByTimeAsync(GRACE_MS)
-    expect(evict).toHaveBeenCalledExactlyOnceWith('session-1')
-  })
-
-  it('cancels the late-child release when a surface reconnects during grace', async () => {
-    const { holds, resumeGate, evict } = resumeHarness()
-    const hold = holds.hold('session-1', 'connection-1:chat')
-    holds.release('session-1', 'connection-1:chat')
-    resumeGate.resolve()
-    await hold
-    expect(holds.isReleasePending('session-1')).toBe(true)
-
-    await holds.hold('session-1', 'connection-2:chat')
-    await vi.advanceTimersByTimeAsync(GRACE_MS * 2)
-    expect(holds.isReleasePending('session-1')).toBe(false)
-    expect(evict).not.toHaveBeenCalled()
-  })
-
-  it('preserves a failed resume without scheduling eviction', async () => {
-    const { holds, resumeGate, evict, hasChild } = resumeHarness()
-    const failure = new Error('provider acquisition failed')
-    const hold = holds.hold('session-1', 'connection-1:chat')
-    const rejected = expect(hold).rejects.toBe(failure)
-    holds.release('session-1', 'connection-1:chat')
-    resumeGate.reject(failure)
-    await rejected
-
-    await vi.advanceTimersByTimeAsync(GRACE_MS * 2)
-    expect(hasChild()).toBe(false)
-    expect(holds.isHeld('session-1')).toBe(false)
-    expect(holds.isReleasePending('session-1')).toBe(false)
-    expect(evict).not.toHaveBeenCalled()
-  })
-
-  it('leaves late acquisition cleanup to host teardown after disposal', async () => {
-    const { holds, resumeGate, evict } = resumeHarness()
-    const hold = holds.hold('session-1', 'connection-1:chat')
-    holds.release('session-1', 'connection-1:chat')
-    holds.dispose()
-    resumeGate.resolve()
-    await hold
-
-    await vi.advanceTimersByTimeAsync(GRACE_MS * 2)
-    expect(holds.isReleasePending('session-1')).toBe(false)
-    expect(evict).not.toHaveBeenCalled()
-  })
-
-  it('does not restart release timers when a surface leaves after disposal', async () => {
-    const { holds, resumeGate, evict } = resumeHarness()
-    const hold = holds.hold('session-1', 'connection-1:chat')
-    resumeGate.resolve()
-    await hold
-    holds.dispose()
-    holds.release('session-1', 'connection-1:chat')
-
-    await vi.advanceTimersByTimeAsync(GRACE_MS * 2)
-    expect(holds.isHeld('session-1')).toBe(false)
-    expect(holds.isReleasePending('session-1')).toBe(false)
-    expect(evict).not.toHaveBeenCalled()
-  })
-
-  it('releases a late child acquired after explicit close forgot its holders', async () => {
-    const { holds, resumeGate, evict } = resumeHarness()
-    const hold = holds.hold('session-1', 'connection-1:chat')
-    holds.forget('session-1')
-    resumeGate.resolve()
-    await hold
-
-    await vi.advanceTimersByTimeAsync(GRACE_MS)
-    expect(holds.isHeld('session-1')).toBe(false)
-    expect(evict).toHaveBeenCalledExactlyOnceWith('session-1')
-  })
-
-  it('lets a holder that left and came back make its own attempt behind a failing one, and its failure releases it', async () => {
-    const { holds, resume, resumeGate, evict } = resumeHarness()
-    const first = holds.hold('session-1', 'same-holder')
-    const firstRejected = expect(first).rejects.toThrow('acquisition failed')
-    holds.release('session-1', 'same-holder')
-    const replacement = holds.hold('session-1', 'same-holder')
-    const replacementRejected = expect(replacement).rejects.toThrow('acquisition failed')
-    await vi.advanceTimersByTimeAsync(0)
-    expect(holds.isHeld('session-1')).toBe(true)
-    expect(resume).toHaveBeenCalledOnce()
-
-    // The gate stays rejected, so the replacement's own attempt fails the same way.
-    resumeGate.reject(new Error('acquisition failed'))
-    await Promise.all([firstRejected, replacementRejected])
-
-    expect(resume).toHaveBeenCalledTimes(2)
-    expect(holds.isHeld('session-1')).toBe(false)
-    expect(holds.isReleasePending('session-1')).toBe(false)
-    await vi.advanceTimersByTimeAsync(GRACE_MS * 2)
-    expect(evict).not.toHaveBeenCalled()
-  })
-
-  it('keeps a re-hold that finds the child the failing attempt ahead of it left behind', async () => {
-    const gate = Promise.withResolvers<void>()
-    let child = false
-    const holds = new StructuredAgentSessionHolds({
-      // The child is up before the attempt settles, and then the attempt fails behind it.
-      resume: async () => {
-        child = true
-        await gate.promise
-        return { ok: true as const }
-      },
-      serialize: keyedSerialize(),
-      hasProviderChild: () => child,
-      hasOwedWork: () => false,
-      evict: async () => {},
-      graceMs: GRACE_MS
-    })
-    pendingHolds.push(holds)
-    const first = holds.hold('session-1', 'same-holder')
-    const rejected = expect(first).rejects.toThrow('acquisition failed')
-    holds.release('session-1', 'same-holder')
-    const replacement = holds.hold('session-1', 'same-holder')
-
-    gate.reject(new Error('acquisition failed'))
-    await rejected
-    // The first hold's failure released only the holder it added, at the incarnation it added;
-    // the replacement then ran, found the child, and kept the holder it re-took.
-    await replacement
-
-    expect(holds.isHeld('session-1')).toBe(true)
-    expect(holds.isReleasePending('session-1')).toBe(false)
-  })
-
-  it('starts a fresh resume once the failed one has settled', async () => {
-    let child = false
-    const resume = vi
-      .fn<() => Promise<StructuredAgentSessionResumeOutcome>>()
-      .mockRejectedValueOnce(new Error('first acquisition failed'))
-      .mockImplementationOnce(async () => {
-        child = true
-        return { ok: true }
-      })
-    const holds = new StructuredAgentSessionHolds({
-      resume,
-      serialize: keyedSerialize(),
-      hasProviderChild: () => child,
-      hasOwedWork: () => false,
-      evict: async () => {},
-      graceMs: GRACE_MS
-    })
-    pendingHolds.push(holds)
-
-    await expect(holds.hold('session-1', 'chat-1')).rejects.toThrow('first acquisition failed')
-    await holds.hold('session-1', 'chat-1')
-
-    expect(resume).toHaveBeenCalledTimes(2)
-    expect(holds.isHeld('session-1')).toBe(true)
-  })
-})
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-hold-resume.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-hold-resume.ts
deleted file mode 100644
index 9ea59e18487c..000000000000
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-hold-resume.ts
+++ /dev/null
@@ -1,130 +0,0 @@
-// Giving a session its provider child back.
-//
-// This is the replacement for the startup resume, and the difference is only in WHO asks: the same
-// eligibility rule, run when a surface binds, when a send finds the owner gone, or when a child
-// exits under an open surface — never when the app launches. It runs inside the session's
-// serialize, with the attach it is given, so the eligibility it reads is the one the attach acts
-// on. A write-capable hold must fail when acquisition is refused so the surface never mistakes a
-// readable journal for a live provider child.
-
-import type {
-  AgentSessionAttachResult,
-  AgentSessionMutationResult,
-  AgentSessionWireRefusal
-} from '../../../shared/agent-session-wire'
-import { isAgentSessionWireRefusalCode } from '../../../shared/agent-session-wire-refusals'
-import type { StructuredAgentSessionAttachContext } from './structured-agent-session-attach-context'
-import {
-  attachStructuredAgentSessionUnderSerialize,
-  type StructuredAgentSessionAttachOptions
-} from './structured-agent-session-attach-orchestration'
-import { failedCreateRefusal } from './structured-agent-session-failed-create-refusal'
-import { adapterSupportsRecord } from './structured-agent-session-provider-support'
-import {
-  structuredAgentSessionResumeOperationId,
-  structuredAgentSessionResumeParams
-} from './structured-agent-session-resume-eligibility'
-
-/** A resume answers with the attach's own refusal, verdict and all, so the asker can tell a lease
- *  someone else is settling from an owner that will not come back. */
-export type StructuredAgentSessionResumeOutcome =
-  | { ok: true }
-  | { ok: false; refusal: AgentSessionWireRefusal }
-
-export async function resumeHeldStructuredAgentSession(input: {
-  sessionId: string
-  context: StructuredAgentSessionAttachContext
-  /** Who is asking; the attach keys the ledger row it settles by it. */
-  callerKey: string
-  attachOptions?: StructuredAgentSessionAttachOptions
-}): Promise<StructuredAgentSessionResumeOutcome> {
-  const { sessionId, context, callerKey } = input
-  // The record is read only once this host has adjudicated it and exited any recovery stage a
-  // failed attempt latched — a lease left in `manual-recovery` by an unproven exit is one the
-  // resolver hands back, and the eligibility below must see it that way.
-  const unreconciled = await context.reconcileLeases(sessionId)
-  if (unreconciled) {
-    return { ok: false, refusal: unreconciled }
-  }
-  await context.runtimeState.resolveRecovery(sessionId)
-  const record = context.deps.store.getRecord(sessionId)
-  if (!record) {
-    return refuse('agent_session_identity_required', 'No structured session exists by that id.')
-  }
-  if (!adapterSupportsRecord(context.deps.adapter, record)) {
-    return refuse(
-      'structured_agent_session_unsupported',
-      'This execution host cannot resume the requested structured agent session.'
-    )
-  }
-  const params = structuredAgentSessionResumeParams(
-    record,
-    structuredAgentSessionResumeOperationId(context.now())
-  )
-  if (!params) {
-    return record.lease.unreconciled
-      ? refuse(
-          'execution_owner_reconciling',
-          'This host has not yet adjudicated the session lease.'
-        )
-      : record.lease.claimStatus === 'conflicted'
-        ? refuse('agent_session_conflict', 'Another process claims this session.')
-        : refuse(
-            'agent_session_ownership_unknown',
-            'The session lease is not one this host may resume.'
-          )
-  }
-  let attached: AgentSessionMutationResult<AgentSessionAttachResult>
-  try {
-    attached = await attachStructuredAgentSessionUnderSerialize(
-      context,
-      callerKey,
-      params,
-      input.attachOptions
-    )
-  } catch (error) {
-    // The attach settles an acquisition that failed — the ledger row, the released lease — before
-    // it rethrows the cause. That row is the answer: a failure it recorded is this resume's
-    // refusal, verdict and all. Only an error it did not record is a fault for the caller.
-    const settled = settledResumeRefusal(
-      context,
-      callerKey,
-      params.envelope.clientOperationId,
-      sessionId,
-      error
-    )
-    if (settled) {
-      return settled
-    }
-    throw error
-  }
-  return attached.ok ? { ok: true } : { ok: false, refusal: attached.refusal }
-}
-
-function settledResumeRefusal(
-  context: Pick<StructuredAgentSessionAttachContext, 'deps'>,
-  callerKey: string,
-  operationId: string,
-  sessionId: string,
-  error: unknown
-): StructuredAgentSessionResumeOutcome | null {
-  const outcome = context.deps.store.getOperationRow(callerKey, operationId)?.outcome
-  if (outcome?.status !== 'failed' || !isAgentSessionWireRefusalCode(outcome.code)) {
-    return null
-  }
-  return failedCreateRefusal(
-    {
-      code: outcome.code,
-      message: outcome.message ?? (error instanceof Error ? error.message : String(error))
-    },
-    outcome.status,
-    context.deps.store.getRecord(sessionId)
-  )
-}
-
-function refuse(
-  code: AgentSessionWireRefusal['code'],
-  message: string
-): StructuredAgentSessionResumeOutcome {
-  return { ok: false, refusal: { code, message } }
-}
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-holders.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-holders.ts
deleted file mode 100644
index 531717168b17..000000000000
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-holders.ts
+++ /dev/null
@@ -1,71 +0,0 @@
-// Who WANTS this session alive, as a set of ids rather than a count.
-//
-// A refcount is the obvious shape and the wrong one. Every path that decrements it — a chat tab
-// closing, a transport dying, a client retrying a release it already sent — can fire twice or not
-// at all, and an integer cannot tell those apart: a duplicate release evicts a session somebody is
-// still looking at, and a lost one leaks the child forever. A set answers both idempotently,
-// because it records WHICH surface holds the session, not how many do.
-
-type Holder = { resumeCapable: boolean; incarnation: symbol }
-
-export class StructuredAgentSessionHolders {
-  private readonly bySession = new Map<string, Map<string, Holder>>()
-
-  /** True when the session gained its FIRST holder — the edge that ends a pending release. */
-  add(sessionId: string, holderId: string, resumeCapable = true): boolean {
-    const holders = this.bySession.get(sessionId)
-    if (!holders) {
-      this.bySession.set(sessionId, new Map([[holderId, { resumeCapable, incarnation: Symbol() }]]))
-      return true
-    }
-    const previous = holders.get(holderId)
-    holders.set(holderId, {
-      resumeCapable: (previous?.resumeCapable ?? false) || resumeCapable,
-      incarnation: previous?.incarnation ?? Symbol()
-    })
-    return false
-  }
-
-  /** True when the session lost its LAST holder — the edge that starts one. */
-  remove(sessionId: string, holderId: string, expectedIncarnation?: symbol): boolean {
-    const holders = this.bySession.get(sessionId)
-    if (
-      expectedIncarnation !== undefined &&
-      holders?.get(holderId)?.incarnation !== expectedIncarnation
-    ) {
-      return false
-    }
-    if (!holders?.delete(holderId) || holders.size > 0) {
-      return false
-    }
-    this.bySession.delete(sessionId)
-    return true
-  }
-
-  isHeld(sessionId: string): boolean {
-    return (this.bySession.get(sessionId)?.size ?? 0) > 0
-  }
-
-  has(sessionId: string, holderId: string): boolean {
-    return this.bySession.get(sessionId)?.has(holderId) ?? false
-  }
-
-  incarnation(sessionId: string, holderId: string): symbol | undefined {
-    return this.bySession.get(sessionId)?.get(holderId)?.incarnation
-  }
-
-  holderIds(sessionId: string): string[] {
-    return [...(this.bySession.get(sessionId)?.keys() ?? [])]
-  }
-
-  hasResumeCapableHolder(sessionId: string): boolean {
-    return [...(this.bySession.get(sessionId)?.values() ?? [])].some(
-      (holder) => holder.resumeCapable
-    )
-  }
-
-  /** Drops every holder of one session without evaluating the edge, for a session that is gone. */
-  forget(sessionId: string): void {
-    this.bySession.delete(sessionId)
-  }
-}
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-holds.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-holds.test.ts
deleted file mode 100644
index 68027f81887c..000000000000
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-holds.test.ts
+++ /dev/null
@@ -1,346 +0,0 @@
-// The parts a session's lifetime is assembled from: the holder set, the release clock, and the
-// deadline that keeps teardown from hanging.
-
-import { afterEach, describe, expect, it, vi } from 'vitest'
-import { runKeyedSerializedOperation } from '../../cli/keyed-promise-queue'
-import { StructuredAgentSessionHolders } from './structured-agent-session-holders'
-import { StructuredAgentSessionReleaseClock } from './structured-agent-session-release-clock'
-import { StructuredAgentSessionHolds } from './structured-agent-session-holds'
-import {
-  STRUCTURED_AGENT_SESSION_EVICTION_STEPS,
-  evictStructuredAgentSession
-} from './structured-agent-session-eviction'
-import {
-  StructuredAgentSessionEvictionTimeoutError,
-  withStructuredAgentSessionEvictionDeadline
-} from './structured-agent-session-eviction-deadline'
-
-const clocks: StructuredAgentSessionReleaseClock[] = []
-
-/** The host's per-session queue, so a hold and a writer really take turns. */
-function keyedSerialize() {
-  const chains = new Map<string, Promise<void>>()
-  return <T>(sessionId: string, task: () => Promise<T>) =>
-    runKeyedSerializedOperation(chains, sessionId, task)
-}
-
-function clock(deps: {
-  hasOwedWork?: () => boolean
-  isHeld?: () => boolean
-  evict: (sessionId: string) => Promise<void>
-  onError?: (input: { sessionId: string; error: unknown }) => void
-}): StructuredAgentSessionReleaseClock {
-  const created = new StructuredAgentSessionReleaseClock({
-    hasOwedWork: deps.hasOwedWork ?? (() => false),
-    isHeld: deps.isHeld ?? (() => false),
-    evict: deps.evict,
-    ...(deps.onError ? { onError: deps.onError } : {}),
-    graceMs: 1
-  })
-  clocks.push(created)
-  return created
-}
-
-afterEach(() => {
-  for (const created of clocks.splice(0)) {
-    created.dispose()
-  }
-})
-
-describe('the holder set', () => {
-  it('reports the first and last holder, and nothing in between', () => {
-    const holders = new StructuredAgentSessionHolders()
-
-    expect(holders.add('session-1', 'a')).toBe(true)
-    expect(holders.add('session-1', 'b')).toBe(false)
-    expect(holders.remove('session-1', 'a')).toBe(false)
-    expect(holders.remove('session-1', 'b')).toBe(true)
-    expect(holders.isHeld('session-1')).toBe(false)
-  })
-
-  // The reason this is a set and not a count: every release path can fire twice or not at all.
-  it('absorbs a duplicate hold and a duplicate release', () => {
-    const holders = new StructuredAgentSessionHolders()
-
-    holders.add('session-1', 'a')
-    holders.add('session-1', 'a')
-    expect(holders.remove('session-1', 'a')).toBe(true)
-    expect(holders.remove('session-1', 'a')).toBe(false)
-    expect(holders.holderIds('session-1')).toEqual([])
-  })
-
-  it('keeps one session holders out of another session holders', () => {
-    const holders = new StructuredAgentSessionHolders()
-
-    holders.add('session-1', 'a')
-    holders.add('session-2', 'a')
-    holders.remove('session-1', 'a')
-
-    expect(holders.isHeld('session-1')).toBe(false)
-    expect(holders.isHeld('session-2')).toBe(true)
-  })
-
-  it('distinguishes retaining holders from holders that may resume a provider', () => {
-    const holders = new StructuredAgentSessionHolders()
-
-    holders.add('session-1', 'subscriber', false)
-    expect(holders.hasResumeCapableHolder('session-1')).toBe(false)
-
-    holders.add('session-1', 'chat', true)
-    expect(holders.hasResumeCapableHolder('session-1')).toBe(true)
-    holders.remove('session-1', 'chat')
-    expect(holders.hasResumeCapableHolder('session-1')).toBe(false)
-  })
-})
-
-describe('the release clock', () => {
-  it('waits out a running turn instead of evicting into it', async () => {
-    const evict = vi.fn(async () => {})
-    let turnRunning = true
-    const releasing = clock({ hasOwedWork: () => turnRunning, evict })
-
-    releasing.arm('session-1')
-    await new Promise((resolve) => setTimeout(resolve, 30))
-    expect(evict).not.toHaveBeenCalled()
-
-    turnRunning = false
-    await vi.waitFor(() => expect(evict).toHaveBeenCalledWith('session-1'))
-  })
-
-  it('stands down when a holder arrives during the wait', async () => {
-    const evict = vi.fn(async () => {})
-    const releasing = clock({ isHeld: () => true, evict })
-
-    releasing.arm('session-1')
-    await new Promise((resolve) => setTimeout(resolve, 30))
-
-    expect(evict).not.toHaveBeenCalled()
-  })
-
-  it('keeps an idle unheld child for thirty minutes, and activity starts the window over', async () => {
-    vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout'] })
-    try {
-      const evict = vi.fn(async () => {})
-      const idle = new StructuredAgentSessionReleaseClock({
-        hasOwedWork: () => false,
-        isHeld: () => false,
-        evict
-      })
-      clocks.push(idle)
-      const minutes = (count: number) => vi.advanceTimersByTimeAsync(count * 60_000)
-
-      idle.arm('session-1')
-      await minutes(20)
-      idle.renew('session-1')
-      await minutes(29)
-      expect(evict).not.toHaveBeenCalled()
-
-      await minutes(1)
-      expect(evict).toHaveBeenCalledWith('session-1')
-    } finally {
-      vi.useRealTimers()
-    }
-  })
-
-  it('does not start a window for a session nothing released', async () => {
-    const evict = vi.fn(async () => {})
-    const releasing = clock({ evict })
-
-    releasing.renew('session-1')
-    await new Promise((resolve) => setTimeout(resolve, 30))
-
-    expect(releasing.isArmed('session-1')).toBe(false)
-    expect(evict).not.toHaveBeenCalled()
-  })
-
-  it('reports a failed eviction rather than swallowing it', async () => {
-    const onError = vi.fn()
-    const releasing = clock({
-      evict: async () => {
-        throw new Error('child would not stop')
-      },
-      onError
-    })
-
-    releasing.arm('session-1')
-
-    await vi.waitFor(() =>
-      expect(onError).toHaveBeenCalledWith({
-        sessionId: 'session-1',
-        error: expect.objectContaining({ message: 'child would not stop' })
-      })
-    )
-  })
-})
-
-describe('holds', () => {
-  it('resumes a session on its first hold and not on a retained one', async () => {
-    let child = false
-    const resume = vi.fn(async () => {
-      child = true
-      return { ok: true as const }
-    })
-    const holds = new StructuredAgentSessionHolds({
-      resume,
-      serialize: keyedSerialize(),
-      hasProviderChild: () => child,
-      hasOwedWork: () => false,
-      evict: async () => {},
-      graceMs: 1
-    })
-
-    await holds.hold('session-1', 'stream-1', { resume: false })
-    expect(resume).not.toHaveBeenCalled()
-
-    await holds.hold('session-1', 'chat-1')
-    expect(resume).toHaveBeenCalledOnce()
-
-    child = true
-    await holds.hold('session-1', 'chat-2')
-    expect(resume).toHaveBeenCalledOnce()
-    holds.dispose()
-  })
-
-  it('runs one resume for a writer and a hold that ask in the same gap', async () => {
-    const gate = Promise.withResolvers<void>()
-    let child = false
-    const resume = vi.fn(async () => {
-      await gate.promise
-      child = true
-      return { ok: true as const }
-    })
-    const serialize = keyedSerialize()
-    const holds = new StructuredAgentSessionHolds({
-      resume,
-      serialize,
-      hasProviderChild: () => child,
-      hasOwedWork: () => false,
-      evict: async () => {},
-      graceMs: 1
-    })
-
-    // A send's ensure-owner step: already inside the session's serialize when it asks.
-    const writer = serialize('session-1', () => holds.ensureProviderChild('session-1'))
-    const hold = holds.hold('session-1', 'chat-1')
-    gate.resolve()
-
-    await expect(writer).resolves.toEqual({ ok: true })
-    await hold
-    // The hold ran after the writer's step and found the child: nothing to resume.
-    expect(resume).toHaveBeenCalledOnce()
-    // The surface arrived while the writer's resume ran, so the child it got is held, not idle.
-    expect(holds.isHeld('session-1')).toBe(true)
-    expect(holds.isReleasePending('session-1')).toBe(false)
-    holds.dispose()
-  })
-
-  it('puts a child a writer resumed with no surface on the idle clock', async () => {
-    let child = false
-    const serialize = keyedSerialize()
-    const holds = new StructuredAgentSessionHolds({
-      resume: async () => {
-        child = true
-        return { ok: true as const }
-      },
-      serialize,
-      hasProviderChild: () => child,
-      hasOwedWork: () => false,
-      evict: async () => {},
-      graceMs: 60_000
-    })
-
-    await serialize('session-1', () => holds.ensureProviderChild('session-1'))
-
-    expect(holds.isHeld('session-1')).toBe(false)
-    expect(holds.isReleasePending('session-1')).toBe(true)
-    holds.dispose()
-  })
-
-  it('never arms the clock for a session with nothing to stop', async () => {
-    const evict = vi.fn(async () => {})
-    const holds = new StructuredAgentSessionHolds({
-      resume: async () => ({ ok: true as const }),
-      serialize: keyedSerialize(),
-      hasProviderChild: () => false,
-      hasOwedWork: () => false,
-      evict,
-      graceMs: 1
-    })
-
-    await holds.hold('session-1', 'chat-1', { resume: false })
-    holds.release('session-1', 'chat-1')
-    await new Promise((resolve) => setTimeout(resolve, 20))
-
-    expect(evict).not.toHaveBeenCalled()
-    expect(holds.isReleasePending('session-1')).toBe(false)
-    holds.dispose()
-  })
-
-  it('fails a write-capable hold when resume proves no provider child', async () => {
-    const holds = new StructuredAgentSessionHolds({
-      resume: async () => ({ ok: true as const }),
-      serialize: keyedSerialize(),
-      hasProviderChild: () => false,
-      hasOwedWork: () => false,
-      evict: async () => {},
-      graceMs: 1
-    })
-
-    await expect(holds.hold('session-1', 'chat-1')).rejects.toThrow(
-      'agent_session_ownership_unknown'
-    )
-    expect(holds.isHeld('session-1')).toBe(false)
-    holds.dispose()
-  })
-})
-
-describe('the teardown deadline', () => {
-  it('leaves the child loaded instead of forcing it, and keeps the session indexed', async () => {
-    const forget = vi.fn()
-    const releaseLease = vi.fn(async () => {})
-
-    await expect(
-      evictStructuredAgentSession(
-        {
-          sessionId: 'session-1',
-          eventSink: {
-            unbind: vi.fn(),
-            drained: vi.fn(async () => {}),
-            close: vi.fn()
-          } as never,
-          adapter: { closeSession: () => new Promise<void>(() => {}) } as never,
-          forget,
-          discardSink: vi.fn(),
-          releaseLease
-        },
-        withStructuredAgentSessionEvictionDeadline(STRUCTURED_AGENT_SESSION_EVICTION_STEPS, 5)
-      )
-    ).rejects.toMatchObject({ step: 'stop-provider-child' })
-
-    expect(forget).not.toHaveBeenCalled()
-    expect(releaseLease).not.toHaveBeenCalled()
-  })
-
-  it('names the step that ran out of time', async () => {
-    const [step] = withStructuredAgentSessionEvictionDeadline(
-      [{ name: 'slow-step', run: () => new Promise<void>(() => {}) }],
-      5
-    )
-
-    await expect(step?.run({} as never)).rejects.toBeInstanceOf(
-      StructuredAgentSessionEvictionTimeoutError
-    )
-  })
-
-  it('does not delay a step that finishes', async () => {
-    const ran: string[] = []
-    const steps = withStructuredAgentSessionEvictionDeadline(
-      [{ name: 'fast-step', run: () => void ran.push('fast-step') }],
-      5_000
-    )
-
-    await steps[0]?.run({} as never)
-
-    expect(ran).toEqual(['fast-step'])
-  })
-})
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-holds.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-holds.ts
deleted file mode 100644
index 0acbccb6b55f..000000000000
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-holds.ts
+++ /dev/null
@@ -1,179 +0,0 @@
-// The lifetime of a structured session, tied to the surfaces that want one.
-//
-// Nothing used to tell the host that a chat WANTED a session, and nothing told it when a chat
-// stopped wanting one. Both halves of that gap cost real processes: sessions nobody had opened got
-// an app-server at every launch, and sessions the user closed kept theirs until the app quit.
-//
-// A surface takes a hold when it binds and drops it when it goes away. The first hold on a session
-// with no child resumes it — that, and not the shape of a lease on disk, is what makes a provider
-// process exist. The last hold leaving starts the idle release clock. Transport close is the BACKSTOP,
-// not the mechanism: a client that vanishes mid-flight never sends its release, so the caller
-// registers one against the connection and the holder set absorbs the duplicate.
-//
-// A send to a childless session resumes it too, and so does provider-exit recovery under an open
-// surface. All three go through `ensureProviderChild` inside the session's serialize, so they take
-// turns: the first to run attaches, and the next finds the child and attaches nothing. Two attaches
-// for one session would race against the same released fence, and the loser's stale fence refused
-// it — a hold that lost dropped its holder, a send that lost was refused.
-
-import {
-  StructuredAgentSessionReleaseClock,
-  type StructuredAgentSessionReleaseClockDeps
-} from './structured-agent-session-release-clock'
-import { StructuredAgentSessionHolders } from './structured-agent-session-holders'
-import type { StructuredAgentSessionResumeOutcome } from './structured-agent-session-hold-resume'
-import type { StructuredAgentSessionAttachOptions } from './structured-agent-session-attach-orchestration'
-
-export type StructuredAgentSessionHoldsDeps = {
-  /** Attaches a provider child, for a caller already inside `serialize`. */
-  resume: (
-    sessionId: string,
-    attachOptions?: StructuredAgentSessionAttachOptions
-  ) => Promise<StructuredAgentSessionResumeOutcome>
-  serialize: <T>(sessionId: string, task: () => Promise<T>) => Promise<T>
-  /** Whether evicting this session would actually free anything. */
-  hasProviderChild: (sessionId: string) => boolean
-  hasOwedWork: (sessionId: string) => boolean
-  evict: (sessionId: string) => Promise<void>
-  onError?: (input: { sessionId: string; error: unknown }) => void
-  graceMs?: number
-}
-
-export type StructuredAgentSessionHoldOptions = {
-  /** False for a hold that only RETAINS — a subscription stream, which must not make a child
-   *  exist just by reading history. */
-  resume?: boolean
-}
-
-export class StructuredAgentSessionHolds {
-  private readonly holders = new StructuredAgentSessionHolders()
-  private readonly clock: StructuredAgentSessionReleaseClock
-  private disposed = false
-
-  constructor(private readonly deps: StructuredAgentSessionHoldsDeps) {
-    const clockDeps: StructuredAgentSessionReleaseClockDeps = {
-      hasOwedWork: deps.hasOwedWork,
-      isHeld: (sessionId) => this.holders.isHeld(sessionId),
-      evict: (sessionId) => this.deps.evict(sessionId),
-      ...(deps.onError ? { onError: deps.onError } : {}),
-      ...(deps.graceMs === undefined ? {} : { graceMs: deps.graceMs })
-    }
-    this.clock = new StructuredAgentSessionReleaseClock(clockDeps)
-  }
-
-  async hold(
-    sessionId: string,
-    holderId: string,
-    options: StructuredAgentSessionHoldOptions = {}
-  ): Promise<void> {
-    const alreadyHeld = this.holders.has(sessionId, holderId)
-    this.holders.add(sessionId, holderId, options.resume !== false)
-    const incarnation = this.holders.incarnation(sessionId, holderId)
-    // Unconditional, not only on the first-holder edge: a second surface arriving during the grace
-    // window must cancel the pending release too.
-    this.clock.cancel(sessionId)
-    if (options.resume === false) {
-      return
-    }
-    let resumed: StructuredAgentSessionResumeOutcome
-    try {
-      resumed = await this.deps.serialize(sessionId, () => this.ensureProviderChild(sessionId))
-    } catch (error) {
-      this.releaseFailedHold(sessionId, holderId, alreadyHeld, incarnation)
-      throw error
-    }
-    if (!resumed.ok) {
-      this.releaseFailedHold(sessionId, holderId, alreadyHeld, incarnation)
-      // The RPC surface raises a refusal as its code.
-      throw new Error(resumed.refusal.code)
-    }
-  }
-
-  /** Only the holder this call added, at the incarnation it added: a same-ID hold that left and
-   *  came back while this one waited owns the holder now, and its own attempt decides it. */
-  private releaseFailedHold(
-    sessionId: string,
-    holderId: string,
-    alreadyHeld: boolean,
-    incarnation: symbol | undefined
-  ): void {
-    if (!alreadyHeld && incarnation !== undefined) {
-      this.release(sessionId, holderId, incarnation)
-    }
-  }
-
-  /**
-   * Gives the session a provider child if it has none.
-   *
-   * For a caller already inside the session's serialize, which is what makes "if it has none"
-   * exact: a hold and a send that both find the owner gone run this in turn, and the second sees
-   * the first one's child. Each caller makes at most one attach, and a failed one leaves the
-   * next caller to make its own. With no surface holding the session afterwards, the child goes
-   * on the same clock a departed surface would start — including the surface that held it when
-   * provider-exit recovery began and left while the attach ran.
-   */
-  async ensureProviderChild(
-    sessionId: string,
-    attachOptions?: StructuredAgentSessionAttachOptions
-  ): Promise<StructuredAgentSessionResumeOutcome> {
-    if (this.deps.hasProviderChild(sessionId)) {
-      return { ok: true }
-    }
-    const resumed = await this.deps.resume(sessionId, attachOptions)
-    if (!resumed.ok) {
-      return resumed
-    }
-    if (!this.deps.hasProviderChild(sessionId)) {
-      return {
-        ok: false,
-        refusal: {
-          code: 'agent_session_ownership_unknown',
-          message: 'The session attached without a provider child to write to.'
-        }
-      }
-    }
-    // The last surface can disconnect before acquisition makes a child available to release.
-    if (!this.disposed && !this.holders.isHeld(sessionId)) {
-      this.clock.arm(sessionId)
-    }
-    return { ok: true }
-  }
-
-  /** Activity — a journal write, or a start reaching the work it held; only a pending release
-   *  notices, and it restarts its full window. */
-  renew(sessionId: string): void {
-    this.clock.renew(sessionId)
-  }
-
-  release(sessionId: string, holderId: string, expectedIncarnation?: symbol): void {
-    if (!this.holders.remove(sessionId, holderId, expectedIncarnation)) {
-      return
-    }
-    if (!this.disposed && this.deps.hasProviderChild(sessionId)) {
-      this.clock.arm(sessionId)
-    }
-  }
-
-  /** Drops the holders of a session that is gone, whoever evicted it. */
-  forget(sessionId: string): void {
-    this.clock.cancel(sessionId)
-    this.holders.forget(sessionId)
-  }
-
-  isHeld(sessionId: string): boolean {
-    return this.holders.isHeld(sessionId)
-  }
-
-  hasResumeCapableHolder(sessionId: string): boolean {
-    return this.holders.hasResumeCapableHolder(sessionId)
-  }
-
-  isReleasePending(sessionId: string): boolean {
-    return this.clock.isArmed(sessionId)
-  }
-
-  dispose(): void {
-    this.disposed = true
-    this.clock.dispose()
-  }
-}
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-host-delivery.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-host-delivery.ts
new file mode 100644
index 000000000000..dace93edc621
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-host-delivery.ts
@@ -0,0 +1,105 @@
+// The host's conversations: how one becomes open, and the delivery loop that hands its accepted
+// messages to a provider child. Bundled because they share one invariant — a conversation open
+// with a message queued has a delivery loop — and the open is where a loop for leftovers wakes.
+
+import { isQueuedAgentJournalSubmission } from '../../../shared/agent-session-queued-submission'
+import type { AgentJournalResetReason } from '../../../shared/agent-session-journal-types'
+import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
+import {
+  openStructuredAgentSessionConversation,
+  type OpenedStructuredAgentSessionConversation,
+  type StructuredAgentSessionConversationOpenOptions
+} from './structured-agent-session-conversation-open'
+import { StructuredAgentSessionDeliveryLoop } from './structured-agent-session-delivery-loop'
+import type { StructuredAgentSessionResumeOutcome } from './structured-agent-session-agent-start'
+import type {
+  StructuredAgentSessionHostDeps,
+  StructuredAgentSessionHostSession
+} from './structured-agent-session-host-types'
+import { structuredAgentSessionConversationFence } from './structured-agent-session-provider-child'
+import { structuredAgentSessionFailureWordsContext } from './structured-agent-session-send-preparation'
+import { settleInterruptedCompaction } from './structured-compaction-recovery'
+import { recoverStructuredRewind } from './structured-rewind-recovery'
+
+export type StructuredAgentSessionConversationDelivery = {
+  loop: StructuredAgentSessionDeliveryLoop
+  /** For a caller inside the session's serialize. */
+  open: (
+    sessionId: string,
+    options?: StructuredAgentSessionConversationOpenOptions
+  ) => Promise<StructuredAgentSessionHostSession | null>
+  /** Indexes a conversation some other open produced, as `open` would have. */
+  adoptOpened: (
+    sessionId: string,
+    opened: OpenedStructuredAgentSessionConversation
+  ) => Promise<void>
+}
+
+export function createStructuredAgentSessionConversationDelivery(input: {
+  deps: StructuredAgentSessionHostDeps
+  sessions: Map<string, StructuredAgentSessionHostSession>
+  serialize: <T>(sessionId: string, task: () => Promise<T>) => Promise<T>
+  trackStart: <T>(start: Promise<T>) => Promise<T>
+  /** Starts a child for `startedFor`, the queued message at the head, if the session has none. */
+  ensureProviderChild: (
+    sessionId: string,
+    startedFor: string
+  ) => Promise<StructuredAgentSessionResumeOutcome>
+  reset: (sessionId: string, journal: AgentSessionJournal, reset: AgentJournalResetReason) => void
+  publishRestored: (sessionId: string) => void
+}): StructuredAgentSessionConversationDelivery {
+  const { deps, sessions } = input
+  const loop = new StructuredAgentSessionDeliveryLoop({
+    sessions,
+    adapter: deps.adapter,
+    serialize: input.serialize,
+    trackStart: input.trackStart,
+    ensureProviderChild: input.ensureProviderChild,
+    conversationFence: (sessionId) =>
+      structuredAgentSessionConversationFence(deps.store, sessionId),
+    failureTextContext: (sessionId) =>
+      structuredAgentSessionFailureWordsContext(deps.store.getRecord(sessionId)),
+    onError: (sessionId, error) => deps.onEventSinkError?.({ sessionId, error })
+  })
+  const adoptOpened = async (
+    sessionId: string,
+    opened: OpenedStructuredAgentSessionConversation
+  ): Promise<void> => {
+    const { session, reset } = opened
+    sessions.set(sessionId, session)
+    if (reset) {
+      input.reset(sessionId, session.journal, reset)
+    }
+    input.publishRestored(sessionId)
+    await settleInterruptedCommands(deps, sessionId, session)
+    if (session.journal.submissions().some(isQueuedAgentJournalSubmission)) {
+      loop.wake(sessionId)
+    }
+  }
+  return {
+    loop,
+    adoptOpened,
+    open: (sessionId, options) =>
+      openStructuredAgentSessionConversation({ deps, sessions, adoptOpened }, sessionId, options)
+  }
+}
+
+/**
+ * A compaction or rewind found prepared when the conversation opens was started under a child
+ * this process no longer has — the open runs only when none is indexed — so nothing will finish
+ * it, and left alone it refuses every send, so no agent would ever start to. Settled here instead
+ * of by a start inside acceptance. A Codex rewind only its provider can prove stays for the attach.
+ */
+async function settleInterruptedCommands(
+  deps: StructuredAgentSessionHostDeps,
+  sessionId: string,
+  session: StructuredAgentSessionHostSession
+): Promise<void> {
+  const fence = structuredAgentSessionConversationFence(deps.store, sessionId)
+  try {
+    await settleInterruptedCompaction(deps.store, sessionId, session.journal, fence)
+    await recoverStructuredRewind(deps.store, sessionId, session.journal, fence)
+  } catch (error) {
+    deps.onEventSinkError?.({ sessionId, error })
+  }
+}
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-host-lifetime.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-host-lifetime.ts
index 0eed19031c7b..c9ba8714b4ee 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-host-lifetime.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-host-lifetime.ts
@@ -1,27 +1,34 @@
-// The host's half of a session's lifetime: what a close does, and what a hold is wired to.
+// The host's half of a session's lifetime: stopping its agent, and closing its conversation.
 //
-// Lifted out of the host for the same reason attaching was — the host is a coordinator, and the
-// sequence that stops a provider child and hands its lease back reads better next to the holder
-// bookkeeping that decides when to run it than buried among the twenty other things a session can
-// do.
+// Two operations, because they end two different things. Stopping the agent ends the provider
+// child and hands the lease back; the conversation — its open journal, its status row and its
+// readers — stays, and the next send starts a new child. Closing the conversation drops the open
+// journal handle, a cache the next read or write reopens.
+//
+// Both are written for a caller already inside the session's serialize: the queue is not
+// reentrant, so every public entry point takes it once and calls these.
 
-import { agentChildWorkLiveness } from '../../../shared/agent-status-child-work-liveness'
-import { activeStructuredAgentSessionTurnId } from '../../../shared/structured-agent-session-projection'
+import { isQueuedAgentJournalSubmission } from '../../../shared/agent-session-queued-submission'
+import { agentSessionFailureFact } from '../../../shared/agent-session-failure'
+import { agentSessionFailureWords } from '../../../shared/agent-session-failure-words'
 import {
   evictStructuredAgentSession,
   STRUCTURED_AGENT_SESSION_EVICTION_STEPS,
   type StructuredAgentSessionEvictionContext
 } from './structured-agent-session-eviction'
 import { withStructuredAgentSessionEvictionDeadline } from './structured-agent-session-eviction-deadline'
-import { StructuredAgentSessionHolds } from './structured-agent-session-holds'
 import type { StructuredAgentSessionHostRuntimeState } from './structured-agent-session-host-runtime-state'
 import type {
+  StructuredAgentSessionChildEndCause,
   StructuredAgentSessionHostDeps,
-  StructuredAgentSessionHostSession
+  StructuredAgentSessionHostSession,
+  StructuredAgentSessionProviderChildIdentity
 } from './structured-agent-session-host-types'
+import {
+  endProviderChild,
+  structuredAgentSessionConversationFence
+} from './structured-agent-session-provider-child'
 import { releaseStoredStructuredAgentSessionOwner } from './structured-agent-session-lease-release'
-import { resumeHeldStructuredAgentSession } from './structured-agent-session-hold-resume'
-import type { StructuredAgentSessionAttachContext } from './structured-agent-session-attach-context'
 import { settleStructuredAgentSessionDeadGeneration } from './structured-agent-session-dead-generation-settlement'
 
 export type StructuredAgentSessionLifetimeContext = {
@@ -29,8 +36,8 @@ export type StructuredAgentSessionLifetimeContext = {
   runtimeState: StructuredAgentSessionHostRuntimeState
   sessions: Map<string, StructuredAgentSessionHostSession>
   now: () => number
-  /** Drops the session's row from the agent-status store; see `forgetStructuredAgentSession`. */
-  forgetStatus: (sessionId: string) => void
+  /** Re-projects the session's status after its agent stopped and the chat stays. */
+  publishStatus?: (sessionId: string) => void
   /** Quit-only snapshot taken immediately before the provider child is stopped. */
   restartWitness?: {
     beforeStop: (sessionId: string) => void
@@ -38,73 +45,96 @@ export type StructuredAgentSessionLifetimeContext = {
   }
 }
 
-/** Dropping a session and dropping its status row are ONE operation: the store keeps the row until
- *  told, so a caller that only deletes strands a live-looking row no reader can ever decay. */
-export async function forgetStructuredAgentSession(
-  context: StructuredAgentSessionLifetimeContext,
-  sessionId: string
-): Promise<void> {
-  await context.sessions.get(sessionId)?.journal.close()
-  context.sessions.delete(sessionId)
-  context.forgetStatus(sessionId)
+type ConversationCloseDeps = Pick<StructuredAgentSessionHostDeps, 'onEventSinkError'> & {
+  store: Pick<StructuredAgentSessionHostDeps['store'], 'getRecord'>
 }
 
-function hasProviderChild(
-  context: StructuredAgentSessionLifetimeContext,
-  sessionId: string
-): boolean {
-  return context.sessions.get(sessionId)?.hasProviderChild === true
+/** A conversation's handle closes with nothing queued: what is still queued when the chat closes,
+ *  or the app quits, will not be handed over. Best effort: the next open's delivery loop rejects a
+ *  leftover itself. */
+export async function abandonQueuedStructuredAgentSessionMessages(
+  deps: ConversationCloseDeps,
+  sessionId: string,
+  journal: StructuredAgentSessionHostSession['journal']
+): Promise<void> {
+  await journal
+    .rejectQueuedSubmissions(
+      structuredAgentSessionConversationFence(deps.store, sessionId),
+      agentSessionFailureWords(agentSessionFailureFact('chatClosed'), { surface: 'rejection' })
+    )
+    .catch((error: unknown) => deps.onEventSinkError?.({ sessionId, error }))
 }
 
 /** The wind-down this host owes for the session's child. A live child always owes one, whatever a
- *  previous childless eviction recorded: a remembered `false` must never outrank the child in front
- *  of it. */
-function owesProviderChildWindDown(session: StructuredAgentSessionHostSession): boolean {
-  return session.hasProviderChild || session.owesProviderChildWindDown === true
+ *  previous childless eviction recorded: a remembered tombstone must never outrank the child in
+ *  front of it. */
+function owedProviderChildWindDown(
+  session: StructuredAgentSessionHostSession
+): StructuredAgentSessionProviderChildIdentity | undefined {
+  return session.child
+    ? { generation: session.child.generation, fence: session.child.fence }
+    : session.owesProviderChildWindDown
 }
 
-/** Runs the eviction steps under a deadline. A step that fails — or runs out of time — aborts the
- *  rest, which leaves the session indexed and the child loaded so the next close is a real retry. */
-export async function evictHeldStructuredAgentSession(
+/**
+ * The agent goes to rest; the conversation stays. Runs the eviction steps under a deadline. A step
+ * that fails — or runs out of time — aborts the rest and leaves the wind-down owed, so the next
+ * stop is a real retry. `ending` is how the child's end is told: a user's Stop, the host stopping it
+ * for a cause (with its text), or an eviction the conversation's close follows.
+ */
+export async function stopStructuredAgentSessionAgentUnderSerialize(
   context: StructuredAgentSessionLifetimeContext,
-  sessionId: string
+  sessionId: string,
+  ending: {
+    cause: Extract<StructuredAgentSessionChildEndCause, 'user-stop' | 'host-stop' | 'evict'>
+    reason?: string
+  } = { cause: 'user-stop' }
 ): Promise<void> {
   const session = context.sessions.get(sessionId)
   if (!session) {
     return
   }
-  // The obligation OUTLIVES the child. `hasProviderChild` is retired the instant the adapter
-  // proves the exit, so a step that aborts after that point would otherwise leave the retry
-  // reading "no child here" and skipping the settlement and the lease release it still owes.
-  const owesWindDown = owesProviderChildWindDown(session)
-  session.owesProviderChildWindDown = owesWindDown
+  // The obligation OUTLIVES the child. `child` is ended the instant the adapter proves the exit,
+  // so a step that aborts after that point would otherwise leave the retry reading "no child
+  // here" and skipping the settlement and the lease release it still owes.
+  const owed = owedProviderChildWindDown(session)
+  session.owesProviderChildWindDown = owed
+  const stopping = session.child
   let settlementError: unknown
   const eviction: StructuredAgentSessionEvictionContext = {
     sessionId,
     // The retry must not re-stop a child the adapter already proved gone, so this stays honest.
-    hasProviderChild: session.hasProviderChild,
-    owesProviderChildWindDown: owesWindDown,
+    hasProviderChild: stopping !== null,
+    owesProviderChildWindDown: owed !== undefined,
     eventSink: context.runtimeState.eventSinkFor(sessionId),
     adapter: context.deps.adapter,
     ...(context.restartWitness
       ? { beforeProviderChildStop: () => context.restartWitness?.beforeStop(sessionId) }
       : {}),
-    // Host state must not disagree with the adapter for the seven steps in between.
-    onProviderChildStopped: () => {
-      session.hasProviderChild = false
+    // Host state must not disagree with the adapter for the steps in between.
+    onProviderChildStopped: (verdict) => {
+      if (stopping) {
+        endProviderChild(session, {
+          generation: stopping.generation,
+          fence: stopping.fence,
+          cause: ending.cause,
+          reason: ending.reason ?? null,
+          duringStartup: stopping.phase === 'starting',
+          ...verdict
+        })
+      }
       context.restartWitness?.stopped(sessionId)
     },
-    forget: async () => {
-      await forgetStructuredAgentSession(context, sessionId)
-      context.deps.adapter.acknowledgeSessionRelease?.(sessionId)
-    },
+    acknowledgeRelease: () => context.deps.adapter.acknowledgeSessionRelease?.(sessionId),
     discardSink: () => context.runtimeState.discardEventSink(sessionId),
     settleWork: async () => {
+      const fence =
+        owed?.fence ?? structuredAgentSessionConversationFence(context.deps.store, sessionId)
       const settled = await settleStructuredAgentSessionDeadGeneration({
         journal: session.journal,
         sessionId,
-        fence: session.fence,
-        settlementId: `expected-close:${sessionId}:${session.fence}:${session.acquisitionGeneration ?? 'unknown'}`,
+        fence,
+        settlementId: `expected-close:${sessionId}:${fence}:${owed?.generation ?? 'unknown'}`,
         pendingSubmissionReason: 'provider_closed_before_acknowledgement',
         verdict: { state: 'interrupted', completedAt: context.now() },
         showUnexpectedExitOutcome: false,
@@ -114,20 +144,24 @@ export async function evictHeldStructuredAgentSession(
         }
       })
       if (!settled) {
-        // Without the cause the quit log names the step and nothing else.
+        // Without the cause the log names the step and nothing else.
         throw new Error('dead generation work settlement failed', { cause: settlementError })
       }
     },
     releaseLease: async () => {
-      await releaseStoredStructuredAgentSessionOwner({
-        store: context.deps.store,
-        sessionId,
-        hasProviderChild: owesWindDown,
-        expectedFence: session.fence,
-        now: context.now()
-      })
-      session.owesProviderChildWindDown = false
-      context.forgetStatus(sessionId)
+      if (owed) {
+        await releaseStoredStructuredAgentSessionOwner({
+          store: context.deps.store,
+          sessionId,
+          hasProviderChild: true,
+          expectedFence: owed.fence,
+          now: context.now()
+        })
+      }
+      session.owesProviderChildWindDown = undefined
+      // Whatever ended the child, the row belongs to the conversation: it shows not-running, and
+      // only the conversation's close forgets it.
+      context.publishStatus?.(sessionId)
     }
   }
   await evictStructuredAgentSession(
@@ -136,6 +170,41 @@ export async function evictHeldStructuredAgentSession(
   )
 }
 
+/** Whether the conversation's handle is only a cache now: no child, no wind-down owed, and nothing
+ *  queued or waiting on the provider. */
+export function structuredAgentSessionConversationClosable(
+  session: StructuredAgentSessionHostSession
+): boolean {
+  return (
+    owedProviderChildWindDown(session) === undefined &&
+    !session.journal.submissions().some(isQueuedAgentJournalSubmission) &&
+    session.journal.pendingSubmissions().length === 0
+  )
+}
+
+/**
+ * Drops the conversation's open handle. The entry leaves the map BEFORE the handle closes, so a
+ * lock-free reader sees an open handle or none — never one that is closing — and one arriving
+ * after the delete waits behind this step and reopens. Answers false, closing nothing, when the
+ * handle is still more than a cache.
+ */
+export async function closeStructuredAgentSessionConversationUnderSerialize(
+  context: Pick<StructuredAgentSessionLifetimeContext, 'sessions'> & {
+    /** The status row outlives the handle; see `StructuredAgentSessionClientDelivery`. */
+    closeStatus: (sessionId: string) => void
+  },
+  sessionId: string
+): Promise<boolean> {
+  const session = context.sessions.get(sessionId)
+  if (!session || !structuredAgentSessionConversationClosable(session)) {
+    return false
+  }
+  context.sessions.delete(sessionId)
+  context.closeStatus(sessionId)
+  await session.journal.close()
+  return true
+}
+
 /** Stops every provider child owned by this host while keeping failed evictions reachable. A
  *  session whose child is already stopped but whose wind-down aborted is still in scope — that is
  *  the retry. */
@@ -146,9 +215,9 @@ export async function evictOwnedStructuredAgentSessions(
   retainOnFailure: Set<string>
 ): Promise<void> {
   const ownedSessionIds = [...context.sessions]
-    .filter(([, session]) => owesProviderChildWindDown(session))
+    .filter(([, session]) => owedProviderChildWindDown(session) !== undefined)
     .map(([sessionId]) => sessionId)
-  // Retained up front and cleared only once an eviction settles: the quit phase is bounded, and a
+  // Retained up front and cleared only once a stop settles: the quit phase is bounded, and a
   // timeout leaves these still running. Closing their journals underneath them is the one outcome
   // the retain set exists to prevent.
   for (const sessionId of ownedSessionIds) {
@@ -159,7 +228,7 @@ export async function evictOwnedStructuredAgentSessions(
     ownedSessionIds.map(async (sessionId) => {
       try {
         await context.serialize(sessionId, () =>
-          evictHeldStructuredAgentSession(context, sessionId)
+          stopStructuredAgentSessionAgentUnderSerialize(context, sessionId)
         )
         retainOnFailure.delete(sessionId)
       } catch (error) {
@@ -171,47 +240,3 @@ export async function evictOwnedStructuredAgentSessions(
     throw new AggregateError(failures, 'structured agent-session child eviction failed')
   }
 }
-
-/** The holds resume through the host's own attach, inside the session's serialize: a hold's
- *  resume and a send's ensure-owner step are the same serialized attach with a different asker. */
-export function createStructuredAgentSessionHolds(
-  attachContext: () => StructuredAgentSessionAttachContext,
-  close: (sessionId: string) => Promise<void>
-): StructuredAgentSessionHolds {
-  const context = attachContext()
-  return new StructuredAgentSessionHolds({
-    resume: (sessionId, attachOptions) =>
-      resumeHeldStructuredAgentSession({
-        sessionId,
-        context: attachContext(),
-        callerKey: attachOptions?.admitRecoveryTicket
-          ? 'trusted-local:provider-exit-recovery'
-          : 'trusted-local:surface-hold',
-        ...(attachOptions ? { attachOptions } : {})
-      }),
-    // Tracked from enqueue: a quit drains a queued resume before it evicts, so no child is
-    // spawned behind the eviction and orphaned.
-    serialize: (sessionId, task) => {
-      const current = attachContext()
-      return current.tasks.trackAttach(current.serialize(sessionId, task))
-    },
-    evict: close,
-    hasProviderChild: (sessionId) => hasProviderChild(context, sessionId),
-    // A send pending while the child is still starting is held for that start; evicting would
-    // refuse it. Any other pending send may wait on an echo that never comes, so eviction retires it.
-    // Subagents, commands and monitors outlive the lead's turn inside the child, so the live roster
-    // the sidebar shows as working is owed too; stopping the child would end them silently.
-    hasOwedWork: (sessionId) => {
-      const session = context.sessions.get(sessionId)
-      return session
-        ? activeStructuredAgentSessionTurnId(session.journal.snapshot().items) !== null ||
-            (session.providerChildPhase === 'starting' &&
-              session.journal.pendingSubmissions().length > 0) ||
-            agentChildWorkLiveness(context.deps.adapter.backgroundTaskState?.(sessionId)?.tasks) !==
-              null
-        : false
-    },
-    onError: (error) => context.deps.onEventSinkError?.(error),
-    ...(context.deps.releaseGraceMs === undefined ? {} : { graceMs: context.deps.releaseGraceMs })
-  })
-}
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-host-mutations.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-host-mutations.ts
index 364f1e7c0dd0..35782b676c2e 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-host-mutations.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-host-mutations.ts
@@ -1,10 +1,11 @@
-// Everything a client can ask an ATTACHED session to do: send a turn, cancel one, answer a prompt,
-// change an option, read the options back.
+// Everything a client can ask a session to do: send a turn, cancel one, answer a prompt, change an
+// option, read the options back.
 //
 // They share one shape — admit the envelope against the lease, run a plan, publish the journal — so
-// they share one path here rather than five copies in the host. The host keeps attach, holds and
-// teardown. A send is the one mutation that may need those first: it makes sure the session has
-// an owner as a step of its own serialized admission, see `structured-agent-session-send-preparation`.
+// they share one path here rather than five copies in the host. The host keeps attach and teardown.
+// Each opens the conversation first. A send, a Stop and an option pick are conversation writes,
+// admitted without the writer lease; the delivery loop starts the provider child a send needs, and
+// an operation only the provider can perform starts it before admission.
 
 import type {
   AgentJournalItemIdentity,
@@ -15,20 +16,28 @@ import type {
   AgentSessionMutationEnvelope,
   AgentSessionMutationResult,
   AgentSessionOptionResult,
-  AgentSessionOptionsResult,
   AgentSessionPromptResult,
   AgentSessionSendResult,
   AgentSessionThreadGoalChange,
   AgentSessionThreadGoalResult
 } from '../../../shared/agent-session-wire'
-import type { StructuredAgentSessionHolds } from './structured-agent-session-holds'
+import {
+  agentSessionFailureWords,
+  type AgentJournalDispatchRejection
+} from '../../../shared/agent-session-failure-words'
+import { agentSessionFailureFact } from '../../../shared/agent-session-failure'
+import type { AgentSessionPromptRequest } from './structured-agent-session-turns-prompt'
 import { threadGoalPlan } from './structured-agent-session-thread-goal'
+import { structuredAgentSessionConversationFence } from './structured-agent-session-provider-child'
 import {
   admitAndRunAgentSessionMutation,
-  type AgentSessionMutationRequest
+  type AgentSessionMutationRequest,
+  type AgentSessionMutationSessionPreparation
 } from './structured-agent-session-mutation-admission'
 import {
-  prepareStructuredAgentSessionSend,
+  openForWrite,
+  openWithAgent,
+  sendPreparation,
   structuredAgentSessionSendBlock
 } from './structured-agent-session-send-preparation'
 import {
@@ -43,19 +52,27 @@ import type {
   StructuredAgentSessionHostDeps,
   StructuredAgentSessionHostSession
 } from './structured-agent-session-host-types'
+import {
+  readStructuredAgentSessionOptions,
+  recordStructuredAgentSessionOptionIntent
+} from './structured-agent-session-options-read'
 
 export type StructuredAgentSessionMutationContext = {
   deps: StructuredAgentSessionHostDeps
   sessions: Map<string, StructuredAgentSessionHostSession>
   publish: (sessionId: string, journal: StructuredAgentSessionHostSession['journal']) => void
   flushStreamedEvents: (sessionId: string) => Promise<void>
-  requireSession: (sessionId: string) => StructuredAgentSessionHostSession
+  /** The host's accessor, for a caller outside the session's serialize. */
+  conversation: (sessionId: string) => Promise<StructuredAgentSessionHostSession>
   serialize: <T>(sessionId: string, task: () => Promise<T>) => Promise<T>
-  /** A send that finds the owner gone brings it back through here, inside its own serialize. */
-  holds: Pick<StructuredAgentSessionHolds, 'ensureProviderChild'>
-  /** Makes a closed session's journal readable again, inside the caller's serialize, for a send
-   *  the ledger answers without an owner. */
-  restoreReadable: (sessionId: string) => Promise<boolean>
+  /** The session's conversation, opened when closed; inside the caller's serialize. */
+  openConversation: (sessionId: string) => Promise<StructuredAgentSessionHostSession | null>
+  /** Gives the session a provider child; inside the caller's serialize. */
+  ensureAgent: (sessionId: string) => Promise<AgentSessionMutationSessionPreparation>
+  /** A message was accepted: the session's delivery loop hands it over. */
+  wakeDelivery: (sessionId: string) => void
+  /** Stops the session's provider child, keeping its conversation; inside the caller's serialize. */
+  stopAgent: (sessionId: string) => Promise<void>
   now: () => number
 }
 
@@ -77,7 +94,7 @@ function mutate<TValue>(
       prepareSession,
       publish: (journal) => context.publish(envelope.sessionId, journal),
       flushStreamedEvents: context.flushStreamedEvents,
-      providerChildPhase: () => context.sessions.get(envelope.sessionId)?.providerChildPhase,
+      providerChildPhase: () => context.sessions.get(envelope.sessionId)?.child?.phase,
       now: () => context.now()
     })
   )
@@ -100,12 +117,19 @@ export function sendStructuredAgentSessionTurn(
     params.envelope,
     {
       ...plan,
-      run: (ctx) => {
+      run: async (ctx) => {
         const blocked = structuredAgentSessionSendBlock(context.deps.store.getRecord(ctx.sessionId))
-        return blocked ? Promise.resolve(blocked) : plan.run(ctx)
+        if (blocked) {
+          return blocked
+        }
+        const accepted = await plan.run(ctx)
+        if (accepted.ok) {
+          context.wakeDelivery(ctx.sessionId)
+        }
+        return accepted
       }
     },
-    (ledger, record) => prepareStructuredAgentSessionSend(context, params.envelope, ledger, record)
+    sendPreparation(context, params.envelope)
   )
 }
 
@@ -130,21 +154,55 @@ export function cancelStructuredAgentSessionTurn(
             context.serialize(`compact-cancel:${sessionId}`, task)
         }
       : context
-  return mutate(cancellationContext, caller, params.envelope, cancelPlan(params))
+  const plan = cancelPlan(params)
+  if (params.scope || params.prompt) {
+    return mutate(
+      cancellationContext,
+      caller,
+      params.envelope,
+      plan,
+      openForWrite(context, params.envelope)
+    )
+  }
+  return mutate(
+    cancellationContext,
+    caller,
+    params.envelope,
+    {
+      ...plan,
+      run: async (ctx) => {
+        // Stop withdraws every queued message first, whatever the start or the child is doing.
+        const withdrawn = await ctx.journal.rejectQueuedSubmissions(
+          ctx.fence,
+          agentSessionFailureWords(agentSessionFailureFact('cancelled'), { surface: 'rejection' })
+        )
+        const child = context.sessions.get(ctx.sessionId)?.child
+        if (child?.phase === 'starting') {
+          // A start that may never land is the one thing here Stop has to end; the chat stays.
+          await context.stopAgent(ctx.sessionId)
+          return { ok: true, value: { turnId: params.turnId, cancelled: true } }
+        }
+        return child
+          ? plan.run(ctx)
+          : { ok: true, value: { turnId: params.turnId, cancelled: withdrawn.length > 0 } }
+      }
+    },
+    openForWrite(context, params.envelope)
+  )
 }
 
 export function respondToStructuredAgentSessionPrompt(
   context: StructuredAgentSessionMutationContext,
   caller: StructuredAgentSessionCaller,
-  params: {
-    envelope: AgentSessionMutationEnvelope
-    kind: 'approval' | 'question'
-    itemId: string
-    expectedRevision: number
-    optionId: string
-  }
+  params: AgentSessionPromptRequest & { envelope: AgentSessionMutationEnvelope }
 ): Promise<AgentSessionMutationResult<AgentSessionPromptResult>> {
-  return mutate(context, caller, params.envelope, promptPlan(params))
+  return mutate(
+    context,
+    caller,
+    params.envelope,
+    promptPlan(params),
+    openForWrite(context, params.envelope)
+  )
 }
 
 export async function setStructuredAgentSessionOption(
@@ -154,7 +212,26 @@ export async function setStructuredAgentSessionOption(
 ): Promise<AgentSessionMutationResult<AgentSessionOptionResult>> {
   // Outside the queue: a pick made while the provider starts then queues behind what its start persists.
   await context.deps.adapter.awaitOptionWritable?.(params.envelope.sessionId)
-  return mutate(context, caller, params.envelope, setOptionPlan(params))
+  const plan = setOptionPlan(params)
+  const atRest = () => !context.sessions.get(params.envelope.sessionId)?.child
+  return mutate(
+    context,
+    caller,
+    params.envelope,
+    {
+      ...plan,
+      // Read as the call is admitted: with no child running, the pick is a conversation write —
+      // intent the next start replays. A running child's pick is still its owner's to make.
+      get conversationWrite() {
+        return atRest() ? (true as const) : undefined
+      },
+      run: (ctx) =>
+        atRest()
+          ? recordStructuredAgentSessionOptionIntent(context.deps.store, ctx, params)
+          : plan.run(ctx)
+    },
+    openForWrite(context, params.envelope)
+  )
 }
 
 export function changeStructuredAgentSessionThreadGoal(
@@ -162,38 +239,13 @@ export function changeStructuredAgentSessionThreadGoal(
   caller: StructuredAgentSessionCaller,
   params: { envelope: AgentSessionMutationEnvelope; change: AgentSessionThreadGoalChange }
 ): Promise<AgentSessionMutationResult<AgentSessionThreadGoalResult>> {
-  return mutate(context, caller, params.envelope, threadGoalPlan(params))
-}
-
-export function readStructuredAgentSessionOptions(
-  context: StructuredAgentSessionMutationContext,
-  sessionId: string
-): Promise<AgentSessionOptionsResult> {
-  return context.serialize(sessionId, async () => {
-    const session = context.requireSession(sessionId)
-    if (!context.deps.adapter.readOptions) {
-      throw new Error('structured_agent_session_options_unsupported')
-    }
-    const options = await context.deps.adapter.readOptions({ sessionId, fence: session.fence })
-    return {
-      ...options,
-      rewind:
-        context.deps.store.getRecord(sessionId)?.rewind?.phase === 'prepared' ||
-        context.deps.store.getRecord(sessionId)?.rewind?.phase === 'provider-succeeded'
-          ? { supported: false, reason: 'outcome-unknown' }
-          : (context.deps.adapter.rewindSupport?.(sessionId) ?? {
-              supported: false,
-              reason: 'unsupported'
-            }),
-      conversationCommands: context.deps.adapter.compact ? ['clear', 'compact'] : ['clear'],
-      ...(context.deps.adapter.supportsThreadGoal?.(sessionId)
-        ? { threadGoal: { current: session.journal.threadGoal() } }
-        : {}),
-      ...(context.deps.adapter.recordsContextUsage?.(sessionId)
-        ? { contextUsage: { current: session.journal.contextUsage() } }
-        : {})
-    }
-  })
+  return mutate(
+    context,
+    caller,
+    params.envelope,
+    threadGoalPlan(params),
+    openWithAgent(context, params.envelope)
+  )
 }
 
 /** Settle provider-proven delivery independently of an in-flight client mutation. */
@@ -202,12 +254,16 @@ export async function settleStructuredAgentSessionLateDispatch(
   input: {
     sessionId: string
     clientMessageId: string
-  } & ({ providerIdentity: AgentJournalItemIdentity } | { state: 'rejected'; reason: string })
+  } & (
+    | { providerIdentity: AgentJournalItemIdentity }
+    | ({ state: 'rejected' } & AgentJournalDispatchRejection)
+  )
 ): Promise<void> {
   const session = context.sessions.get(input.sessionId)
   if (!session) {
     return
   }
+  const fence = structuredAgentSessionConversationFence(context.deps.store, input.sessionId)
   // The journal queue drains before close; the host queue would defer this past teardown.
   await session.journal.resolveDispatch(
     'providerIdentity' in input
@@ -215,55 +271,16 @@ export async function settleStructuredAgentSessionLateDispatch(
           clientMessageId: input.clientMessageId,
           state: 'accepted',
           providerIdentity: input.providerIdentity,
-          fence: session.fence
+          fence
         }
       : {
           clientMessageId: input.clientMessageId,
           state: 'rejected',
           reason: input.reason,
-          fence: session.fence
+          rejection: input.rejection,
+          fence
         }
   )
-  context.publish(input.sessionId, session.journal)
-}
-
-/**
- * Releases sends the provider can no longer be holding.
- *
- * A dispatch whose RPC timed out is recorded `unknown` — doubt, never proof of
- * non-delivery — and a live `unknown` reads as work still owed, so the session
- * shows working until something re-derives it. The provider reporting its thread
- * not running, with no turn open, IS that re-derivation.
- *
- * `pending` is deliberately untouched: that send's dispatch has not returned yet
- * and may be in flight right now. And `recovered` only retires the obligation —
- * it never makes a send re-deliverable, because the provider may well have run it.
- */
-export async function releaseStructuredAgentSessionUnansweredDispatches(
-  context: Pick<StructuredAgentSessionMutationContext, 'sessions' | 'publish'>,
-  input: { sessionId: string; reason: string }
-): Promise<void> {
-  const session = context.sessions.get(input.sessionId)
-  if (!session) {
-    return
-  }
-  const stranded = session.journal
-    .submissions()
-    .filter((entry) => entry.dispatchState === 'unknown' && entry.recovered !== true)
-  if (stranded.length === 0) {
-    return
-  }
-  for (const entry of stranded) {
-    await session.journal.resolveDispatch({
-      clientMessageId: entry.clientMessageId,
-      state: 'unknown',
-      // The earlier reason names a sharper fact than this one does.
-      reason: entry.reason ?? input.reason,
-      fence: session.fence,
-      recovered: true
-    })
-  }
-  context.publish(input.sessionId, session.journal)
 }
 
 /** The host's thin mutation surface. Each call re-reads the context, so a session
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-host-runtime-state.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-host-runtime-state.ts
index 39fe7c3fc22a..63f37a37590e 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-host-runtime-state.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-host-runtime-state.ts
@@ -34,8 +34,9 @@ export class StructuredAgentSessionHostRuntimeState {
     this.leaseRenewer.start()
   }
 
-  stopLeaseRenewal(): void {
-    this.leaseRenewer.stop()
+  /** Resolves once a renewal tick already in flight has finished writing. */
+  stopLeaseRenewal(): Promise<void> {
+    return this.leaseRenewer.stop()
   }
 
   /** The sink the session's current child writes through, created on first use. */
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-host-tabs.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-host-tabs.ts
index 3bd6e46b98eb..8a18040daf35 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-host-tabs.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-host-tabs.ts
@@ -9,19 +9,26 @@ import type { AgentSessionRecord } from '../../../shared/agent-session-record'
 export function setStructuredAgentSessionTabVisibility(
   host: {
     deps: {
-      store: { setSessionTabVisibility: (sessionId: string, visible: boolean) => Promise<void> }
+      store: {
+        setSessionTabVisibility: (
+          sessionId: string,
+          visible: boolean,
+          tabId?: string
+        ) => Promise<void>
+      }
     }
     restartResume: { dismiss: (sessionIds: readonly string[]) => Promise<number> }
   },
   sessionId: string,
-  visible: boolean
+  visible: boolean,
+  tabId?: string
 ): Promise<void> {
   if (!visible) {
     void host.restartResume.dismiss([sessionId]).catch(() => {
       console.warn('[structured-agent-session] forgetting recovery records on chat close failed')
     })
   }
-  return host.deps.store.setSessionTabVisibility(sessionId, visible)
+  return host.deps.store.setSessionTabVisibility(sessionId, visible, tabId)
 }
 
 export type StructuredAgentSessionTab = {
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-host-teardown.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-host-teardown.test.ts
index d04e17d2d26c..5fd0440a1fe1 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-host-teardown.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-host-teardown.test.ts
@@ -5,7 +5,7 @@ describe('structured agent-session host teardown', () => {
   it('names every phase, so the quit-path order is pinned rather than incidental', () => {
     const noop = async (): Promise<void> => undefined
     const phases = structuredAgentSessionHostTeardownPhases({
-      holds: { dispose: noop },
+      idleSweep: { dispose: noop },
       runtimeState: { stopLeaseRenewal: () => undefined, flushAllEventSinks: noop },
       tasks: { drainAttaches: noop },
       evictOwnedSessions: noop,
@@ -14,7 +14,7 @@ describe('structured agent-session host teardown', () => {
     })
     expect(phases.map((phase) => phase.name)).toEqual([
       'begin-resume-markers',
-      'dispose-holds',
+      'dispose-idle-sweep',
       'stop-lease-renewal',
       'drain-attaches',
       'evict-owned-sessions',
@@ -30,7 +30,7 @@ describe('structured agent-session host teardown', () => {
     const cleaned = vi.fn(async () => {})
     const flush = vi.fn(async () => cleaned())
     const phases = structuredAgentSessionHostTeardownPhases({
-      holds: { dispose: cleaned },
+      idleSweep: { dispose: cleaned },
       runtimeState: { stopLeaseRenewal: () => {}, flushAllEventSinks: flush },
       tasks: { drainAttaches: cleaned },
       evictOwnedSessions: cleaned,
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-host-teardown.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-host-teardown.ts
index 6b1693c3dca2..97a27d5c246c 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-host-teardown.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-host-teardown.ts
@@ -9,6 +9,7 @@
 import type { AgentSessionResumeTrigger } from '../../../shared/agent-session-resume-marker'
 import type { StructuredAgentSessionRestartResume } from './structured-agent-session-restart-resume-host'
 import {
+  abandonQueuedStructuredAgentSessionMessages,
   evictOwnedStructuredAgentSessions,
   type StructuredAgentSessionLifetimeContext
 } from './structured-agent-session-host-lifetime'
@@ -46,9 +47,9 @@ async function withPhaseTimeout(run: () => Promise<void>, timeoutMs: number): Pr
 
 /** The quit-path phase order, which is load-bearing rather than incidental. */
 export function structuredAgentSessionHostTeardownPhases(collaborators: {
-  holds: { dispose: () => Promise<void> | void }
+  idleSweep: { dispose: () => Promise<void> | void }
   runtimeState: {
-    stopLeaseRenewal: () => void
+    stopLeaseRenewal: () => Promise<void> | void
     flushAllEventSinks: () => Promise<void>
   }
   tasks: { drainAttaches: () => Promise<void> }
@@ -68,7 +69,7 @@ export function structuredAgentSessionHostTeardownPhases(collaborators: {
         }
       }
     },
-    { name: 'dispose-holds', run: () => collaborators.holds.dispose() },
+    { name: 'dispose-idle-sweep', run: () => collaborators.idleSweep.dispose() },
     { name: 'stop-lease-renewal', run: () => collaborators.runtimeState.stopLeaseRenewal() },
     { name: 'drain-attaches', run: () => collaborators.tasks.drainAttaches() },
     {
@@ -93,6 +94,8 @@ export async function tearDownStructuredAgentSessionHost(input: {
   sessions: Map<string, StructuredAgentSessionHostSession>
   retainSessionIds?: ReadonlySet<string>
   acknowledgeSessionRelease?: (sessionId: string) => void
+  /** Quit closes every conversation, so it settles what they still queue as a close does. */
+  abandonQueued?: (sessionId: string, session: StructuredAgentSessionHostSession) => Promise<void>
 }): Promise<void> {
   const failures: unknown[] = []
   for (const phase of input.phases) {
@@ -107,7 +110,12 @@ export async function tearDownStructuredAgentSessionHost(input: {
     ([sessionId]) => !input.retainSessionIds?.has(sessionId)
   )
   // `allSettled`, so one rejected close cannot skip the others.
-  const closed = await Promise.allSettled(entries.map(([, session]) => session.journal.close()))
+  const closed = await Promise.allSettled(
+    entries.map(async ([sessionId, session]) => {
+      await input.abandonQueued?.(sessionId, session)
+      await session.journal.close()
+    })
+  )
   closed.forEach((result, index) => {
     const sessionId = entries[index]?.[0]
     if (result.status === 'fulfilled') {
@@ -133,7 +141,7 @@ export async function tearDownStructuredAgentSessionHost(input: {
 
 export async function flushStructuredAgentSessionHost(
   context: StructuredAgentSessionLifetimeContext &
-    Pick<Parameters<typeof structuredAgentSessionHostTeardownPhases>[0], 'holds' | 'tasks'> & {
+    Pick<Parameters<typeof structuredAgentSessionHostTeardownPhases>[0], 'idleSweep' | 'tasks'> & {
       restartResume: StructuredAgentSessionRestartResume
       serialize: (sessionId: string, task: () => Promise<void>) => Promise<void>
       trigger: AgentSessionResumeTrigger
@@ -160,6 +168,8 @@ export async function flushStructuredAgentSessionHost(
     sessions: context.sessions,
     retainSessionIds,
     acknowledgeSessionRelease: (sessionId) =>
-      context.deps.adapter.acknowledgeSessionRelease?.(sessionId)
+      context.deps.adapter.acknowledgeSessionRelease?.(sessionId),
+    abandonQueued: (sessionId, session) =>
+      abandonQueuedStructuredAgentSessionMessages(context.deps, sessionId, session.journal)
   })
 }
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-host-test-abandon.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-host-test-abandon.test.ts
new file mode 100644
index 000000000000..b069fecd1bb1
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-host-test-abandon.test.ts
@@ -0,0 +1,123 @@
+// The helper is what the restart specs remove their temp directory behind, so what it waits for is
+// load-bearing: a store commit that lands afterwards re-creates the directory it just removed.
+
+import { existsSync } from 'node:fs'
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { describe, expect, it } from 'vitest'
+import { computeAgentSessionPayloadFingerprint } from '../../../shared/agent-session-mutation-envelope'
+import { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
+import type { StructuredAgentSessionAdapter } from './structured-agent-session-adapter'
+import { StructuredAgentSessionHost } from './structured-agent-session-host'
+import { abandonStructuredAgentSessionHost } from './structured-agent-session-host-test-abandon'
+import {
+  HOST_TEST_NOW as NOW,
+  HOST_TEST_SESSION as SESSION,
+  HOST_TEST_THREAD as THREAD,
+  hostTestAttachParams,
+  hostTestMessage
+} from './structured-agent-session-host-test-data'
+
+const CALLER = { callerKey: 'client-1' }
+
+describe('abandoning a structured agent-session host', () => {
+  it('waits for the restart the delivery loop woke for an accepted send', async () => {
+    const root = await mkdtemp(join(tmpdir(), 'orca-abandon-'))
+    const store = await AgentSessionRecordStore.open({
+      directory: join(root, 'store'),
+      hostId: 'local'
+    })
+    // Holds the restart inside its provider acquisition, so the point teardown must not run past
+    // is exact rather than a timing window.
+    let gate: Promise<void> | null = null
+    let openGate = (): void => {}
+    let reportEntered = (): void => {}
+    const entered = new Promise<void>((resolve) => {
+      reportEntered = resolve
+    })
+    const adapter: StructuredAgentSessionAdapter = {
+      acquire: async ({ fence }) => {
+        if (gate) {
+          reportEntered()
+          await gate
+        }
+        return {
+          process: {
+            hostId: 'local',
+            pid: 4242,
+            processStartTimeMs: NOW - 1_000,
+            spawnToken: store.getRecord(SESSION)?.lease.reservedSpawnToken ?? 'spawn-a'
+          },
+          link: {
+            linkId: `link-${fence}`,
+            handle: { provider: 'codex', threadId: THREAD },
+            origin: 'created',
+            mintedAtFence: fence,
+            observedAt: NOW
+          }
+        }
+      },
+      dispatch: async () => ({
+        state: 'accepted',
+        providerIdentity: { provider: 'codex', threadId: THREAD, turnId: 'turn-1', ordinal: 1 }
+      }),
+      cancelTurn: async () => ({ cancelled: true }),
+      answerPrompt: async () => undefined,
+      releaseAcquisition: async () => true,
+      setOption: async () => undefined
+    }
+    const host = new StructuredAgentSessionHost({
+      store,
+      adapter,
+      probeOwner: async () => ({
+        outcome: 'identity-matched',
+        matchedOn: ['process-start-time']
+      }),
+      journalRoot: root,
+      claimKeyId: 'key-1',
+      mintSpawnToken: () => 'spawn-a',
+      now: () => NOW
+    })
+    expect(await host.attach(CALLER, hostTestAttachParams(null))).toMatchObject({ ok: true })
+    // The conversation stays and its provider child does not, so the next send makes the delivery
+    // loop start one — the shape the refusal-oracle spec ends on.
+    await host.close(SESSION)
+    gate = new Promise<void>((resolve) => {
+      openGate = resolve
+    })
+
+    const body = hostTestMessage('delivery loop')
+    expect(
+      await host.send(CALLER, {
+        envelope: {
+          sessionId: SESSION,
+          clientOperationId: `${NOW}-000000000000000000000000000003e9`,
+          expectedRuntimeFence: store.getRecord(SESSION)?.lease.runtimeFence ?? 1,
+          payloadFingerprint: computeAgentSessionPayloadFingerprint({
+            method: 'agentSession.send',
+            sessionId: SESSION,
+            fields: { body }
+          })
+        },
+        body
+      })
+    ).toMatchObject({ ok: true })
+    await entered
+
+    let abandoned = false
+    const abandoning = abandonStructuredAgentSessionHost(host).then(() => {
+      abandoned = true
+    })
+    await new Promise((resolve) => setTimeout(resolve, 20))
+    expect(abandoned).toBe(false)
+
+    openGate()
+    await abandoning
+
+    // Nothing is left to put the directory back after this returns.
+    await rm(root, { recursive: true })
+    await new Promise((resolve) => setTimeout(resolve, 200))
+    expect(existsSync(root)).toBe(false)
+  })
+})
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-host-test-abandon.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-host-test-abandon.ts
new file mode 100644
index 000000000000..de928eb32e7f
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-host-test-abandon.ts
@@ -0,0 +1,25 @@
+// What a host that VANISHES without a clean quit has to release, for the tests that model one.
+//
+// Deliberately not the quit path: quit evicts provider children and releases leases, and that is
+// the state a restart test is checking gets re-derived from disk. It stops short of ownership.
+//
+// What it cannot skip is work already in flight, which is what every copy of this helper used to
+// get wrong. Two producers reach the session store after the last awaited call has returned — a
+// lease-renewal tick, and the restart the delivery loop wakes for an accepted send — and the store
+// re-creates its own directory before every commit. A commit landing after the test removed its
+// temp directory therefore puts that directory back, and the removal fails with ENOTEMPTY. Quit
+// waits for both, in its `stop-lease-renewal` and `drain-attaches` phases; so does this.
+
+import type { StructuredAgentSessionHost } from './structured-agent-session-host'
+
+export async function abandonStructuredAgentSessionHost(
+  host: StructuredAgentSessionHost
+): Promise<void> {
+  // First, so the drain below cannot race the loop into enqueueing another step.
+  host['conversationDelivery'].loop.dispose()
+  host['lifetime'].dispose()
+  await host['runtimeState'].stopLeaseRenewal()
+  await host['tasks'].drainAttaches()
+  await Promise.all([...host['sessions'].values()].map((session) => session.journal.close()))
+  host['sessions'].clear()
+}
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-host-test-data.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-host-test-data.ts
index 69e6d029d607..959a02919a23 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-host-test-data.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-host-test-data.ts
@@ -1,6 +1,12 @@
-import type { AgentJournalMessageItem } from '../../../shared/agent-session-journal-types'
+import type {
+  AgentJournalMessageItem,
+  AgentJournalSnapshot
+} from '../../../shared/agent-session-journal-types'
 import { computeAgentSessionPayloadFingerprint } from '../../../shared/agent-session-mutation-envelope'
 import type { AgentSessionExecutionLocation } from '../../../shared/agent-session-record'
+import { projectNativeChatTranscriptMessages } from '../../../shared/native-chat-transcript-projection'
+import { projectStructuredAgentSessionMessages } from '../../../shared/structured-agent-session-message-projection'
+import { createStructuredAgentSessionOutboxEntry } from '../../../shared/structured-agent-session-outbox'
 import { attachFingerprintFields } from './structured-agent-session-attach'
 import type { AgentSessionAttachParams } from './structured-agent-session-attach'
 
@@ -61,3 +67,23 @@ export function hostTestAttachParams(
     }
   }
 }
+
+/** The row ids a chat draws from `snapshot`, top to bottom, while its composer still holds `sent`
+ *  as dispatched, as it does until the journal accepts them. */
+export function hostTestDrawnRowIds(
+  snapshot: AgentJournalSnapshot,
+  sent: readonly { clientMessageId: string; text: string }[]
+): string[] {
+  const outbox = sent.map((message) => ({
+    ...createStructuredAgentSessionOutboxEntry({
+      ...message,
+      sessionId: HOST_TEST_SESSION,
+      attachments: [],
+      queuedAt: HOST_TEST_NOW
+    }),
+    state: 'dispatching' as const
+  }))
+  return projectNativeChatTranscriptMessages(
+    projectStructuredAgentSessionMessages(snapshot.items, outbox, snapshot.submissions)
+  ).map(({ id }) => id)
+}
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-host-test-harness.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-host-test-harness.ts
index e0ac9c00d88a..1e0d77b0d524 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-host-test-harness.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-host-test-harness.ts
@@ -107,7 +107,7 @@ async function seedApproval(optionId = 'allow'): Promise<{ itemId: string; revis
   })
   await host.flushStreamedEvents(SESSION)
   const itemId = agentJournalItemKey(identity)
-  const page = host.history({ sessionId: SESSION, direction: 'tail' })
+  const page = await host.history({ sessionId: SESSION, direction: 'tail' })
   const appended = page.ok ? page.page.items.find((item) => item.itemId === itemId) : null
   if (!appended) {
     throw new Error('provider approval was not written to the journal')
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-host-types.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-host-types.ts
index 574ced3cc383..44699536a6fe 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-host-types.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-host-types.ts
@@ -1,4 +1,6 @@
+import type { SubmissionRejectionFact } from '../../../shared/agent-session-failure'
 import type { AgentSessionOwnerProbe } from '../../../shared/agent-session-lease-adjudication'
+import type { AgentJournalCursor } from '../../../shared/agent-session-journal-types'
 import type { AgentSessionRecord } from '../../../shared/agent-session-record'
 import type { AgentSessionStatusSummary } from '../../../shared/agent-session-wire'
 import type { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
@@ -18,7 +20,7 @@ export type StructuredAgentSessionCaller = { callerKey: string }
 /** What the host believes about a session it just made addressable again. The workspace and agent
  *  come from the record, so a caller publishes the host's view rather than a client's assertion.
  *  `readable` is false when the journal could not be opened — the tab is still worth publishing,
- *  because attach recovers what read restore cannot. */
+ *  because the chat shows that failure and its Retry. */
 export type StructuredAgentSessionReveal = {
   sessionId: string
   workspaceId: string
@@ -26,28 +28,66 @@ export type StructuredAgentSessionReveal = {
   readable: boolean
 }
 
+/** Which provider child: the adapter acquisition and the lease fence it writes at. */
+export type StructuredAgentSessionProviderChildIdentity = {
+  readonly generation: string | null
+  readonly fence: number
+}
+
+/** The provider process behind a conversation. Written only in
+ *  `structured-agent-session-provider-child`. */
+export type StructuredAgentSessionProviderChild = StructuredAgentSessionProviderChildIdentity & {
+  /** A publish-first acquire is `starting` until the adapter's `started` event; only then are its
+   *  reported options fact. */
+  phase: StructuredAgentSessionProviderChildPhase
+  /** The queued message whose delivery started this child, fixed when the start is made; absent
+   *  for any other start. In memory only: it tells a restart offer its own start from another. */
+  readonly startedFor?: string
+}
+
+/** What ending a child established about its provider root. A stop's comes only from
+ *  `stopAgentSessionProviderRoot`; an observed exit's root is gone by definition. */
+export type StructuredAgentSessionStopVerdict = { rootGone: boolean }
+
+export type StructuredAgentSessionChildEndCause =
+  | 'user-stop'
+  | 'host-stop'
+  | 'exit'
+  | 'attach-failed'
+  | 'evict'
+
+/** How the conversation's last child ended. In memory only: the delivery loop reads it to tell a
+ *  Stop from a failure. */
+export type StructuredAgentSessionEndedChild = StructuredAgentSessionProviderChildIdentity &
+  StructuredAgentSessionStopVerdict & {
+    /** `user-stop` is a Stop the user asked for; `host-stop` is the host stopping the child for a
+     *  cause of its own, which fails the start the delivery loop was waiting on. */
+    cause: StructuredAgentSessionChildEndCause
+    /** Descriptive text only — the provider's diagnostic, or the host's cause. Decides nothing. */
+    reason: string | null
+    /** What the chat records about this end; absent reads as a provider exit with no detail. */
+    failure?: SubmissionRejectionFact
+    duringStartup: boolean
+    startedFor?: string
+    /** Where the conversation's journal stood when the child ended, to order the end against a
+     *  message's acceptance. */
+    endedAt: AgentJournalCursor
+  }
+
+/** The conversation: its journal, params and readers outlive any child that serves it. */
 export type StructuredAgentSessionHostSession = {
-  journal: AgentSessionJournal
+  /** Readonly: a new handle enters only through the session map's `set`, which binds its delivery. */
+  readonly journal: AgentSessionJournal
   params: AgentSessionAttachParams
-  fence: number
-  /** Whether THIS host generation is running the provider process behind the session. A journal
-   *  restored for reading has none — so it may not be evicted to free a child, nor have its lease
-   *  released as an observed exit. */
-  hasProviderChild: boolean
-  /** Whether the child behind `hasProviderChild` has proven its start. A publish-first acquire
-   *  is `starting` until the adapter's `started` event; only then are its reported options fact. */
-  providerChildPhase: StructuredAgentSessionProviderChildPhase
+  /** The child THIS host generation runs for the conversation. A conversation opened for reading
+   *  has none — so it may not be evicted to free a child, nor have its lease released as an
+   *  observed exit. */
+  child: StructuredAgentSessionProviderChild | null
   /** The wind-down this host still owes for a child it started: settling that generation's work
-   *  and handing the lease back. A separate fact from `hasProviderChild`, which goes false the
-   *  moment the adapter proves the exit — an eviction that aborts after that point must still be
-   *  able to finish the wind-down on the next close. */
-  owesProviderChildWindDown?: boolean
-  /** Exact adapter acquisition behind `hasProviderChild`; retained after exit to fence recovery. */
-  acquisitionGeneration: string | null
-  /** The fence of the released owner this child replaced, when it was resumed into a lease handed
-   *  back cleanly. A writer current as of that owner is admitted at `fence`: the restart is the
-   *  only thing that moved it. Absent for a create or a journal restored for reading. */
-  resumedFromFence?: number
+   *  and handing the lease back. Outlives `child`, which ends the moment the adapter proves the
+   *  exit — an eviction that aborts after that point must still finish it on the next close. */
+  owesProviderChildWindDown?: StructuredAgentSessionProviderChildIdentity
+  lastEndedChild?: StructuredAgentSessionEndedChild
 }
 
 export type StructuredAgentSessionHostDeps = {
@@ -73,8 +113,10 @@ export type StructuredAgentSessionHostDeps = {
     provider: AgentSessionRecord['provider']
   ) => Promise<Record<string, string> | undefined> | Record<string, string> | undefined
   now?: () => number
-  /** How long a session outlives its last surface. Tests drive this; production takes the default. */
-  releaseGraceMs?: number
+  /** The idle sweep's period and window. Tests drive these; production takes the defaults. */
+  idleSweep?: { intervalMs?: number; idleMs?: number }
+  /** Whether an orchestration dispatch still owns this session's worker; absent answers no. */
+  hasOpenDispatch?: (record: AgentSessionRecord) => boolean
   onEventSinkError?: (input: { sessionId: string; error: unknown }) => void
   /** Every status projection this host publishes. `replay` marks a re-projection of state the host
    *  already knew (restore, an arriving subscriber) rather than a fresh journal edge. */
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-host.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-host.test.ts
index 62f88672342c..58a84cecd5f7 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-host.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-host.test.ts
@@ -8,6 +8,7 @@ import { AgentSessionRecordStore } from '../../runtime/agent-session-record-stor
 import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
 import type { StructuredAgentSessionAdapter } from './structured-agent-session-adapter'
 import { StructuredAgentSessionHost } from './structured-agent-session-host'
+import type { StructuredAgentSessionHostDeps } from './structured-agent-session-host-types'
 import {
   adapter,
   attach,
@@ -138,11 +139,13 @@ describe('attach', () => {
     })
     const params = attachParams()
 
+    // Orca's own store fault: the child is gone, but nothing blames the provider.
     const refused = {
       ok: false,
       refusal: {
         code: 'agent_session_operation_invalid',
-        message: 'agent_session_provider_handle_stale_fence',
+        details: { ownerVerdict: 'exited' },
+        message: "Codex couldn't restart. Send your message to try again.",
         ownerVerdict: 'exited'
       }
     }
@@ -160,7 +163,10 @@ describe('attach', () => {
 
     await expect(host.attach(CALLER, attachParams())).resolves.toMatchObject({
       ok: false,
-      refusal: { message: 'commit failed', ownerVerdict: 'exited' }
+      refusal: {
+        message: "Codex couldn't restart. Send your message to try again.",
+        ownerVerdict: 'exited'
+      }
     })
 
     expect(releaseAcquisition).toHaveBeenCalledWith({ sessionId: SESSION })
@@ -208,7 +214,7 @@ describe('cancel', () => {
       turnId: 'turn-1'
     })
     expect(result).toMatchObject({ ok: true, value: { cancelled: true } })
-    const page = host.history({ sessionId: SESSION, direction: 'tail' })
+    const page = await host.history({ sessionId: SESSION, direction: 'tail' })
     expect(page.ok && page.page.items[0]?.body).toMatchObject({
       kind: 'status',
       text: 'Cancellation requested.'
@@ -332,7 +338,7 @@ describe('cancel', () => {
       refusal: { code: 'agent_session_operation_unknown' }
     })
     expect(cancelTurn).toHaveBeenCalledTimes(1)
-    expect(host.history({ sessionId: SESSION, direction: 'tail' })).toMatchObject({
+    expect(await host.history({ sessionId: SESSION, direction: 'tail' })).toMatchObject({
       ok: true,
       page: {
         items: [
@@ -395,7 +401,7 @@ describe('respondToPrompt', () => {
       ...fields
     })
 
-    const page = host.history({ sessionId: SESSION, direction: 'tail' })
+    const page = await host.history({ sessionId: SESSION, direction: 'tail' })
     const answered = page.ok ? page.page.items.find((item) => item.itemId === itemId) : null
     expect(answered).toMatchObject({
       revision: 2,
@@ -490,7 +496,7 @@ describe('respondToPrompt', () => {
       ...fields
     })
     expect(result.ok).toBe(true)
-    const page = host.history({ sessionId: SESSION, direction: 'tail' })
+    const page = await host.history({ sessionId: SESSION, direction: 'tail' })
     const statusId = agentJournalItemKey({
       provider: 'orca',
       clientMessageId: `${prompt.itemId}#delivery`
@@ -520,7 +526,7 @@ describe('setOption', () => {
     })
     expect(setOption).toHaveBeenCalledTimes(1)
     expect(store.getRecord(SESSION)?.options).toEqual({ model: 'gpt-5', effort: 'high' })
-    const page = host.history({ sessionId: SESSION, direction: 'tail' })
+    const page = await host.history({ sessionId: SESSION, direction: 'tail' })
     expect(page.ok && page.page.items).toHaveLength(0)
   })
 
@@ -547,16 +553,19 @@ describe('restart', () => {
    *  them. Every lease loads unreconciled, so this is the state that decides
    *  whether a persisted session is reachable at all. */
   async function reboot(
-    probeOwner: (record: AgentSessionRecord) => Promise<AgentSessionOwnerProbe>
+    probeOwner: (record: AgentSessionRecord) => Promise<AgentSessionOwnerProbe>,
+    adapterOverrides: Partial<StructuredAgentSessionAdapter> = {},
+    stopOwnerProcess?: StructuredAgentSessionHostDeps['stopOwnerProcess']
   ) {
     store = await AgentSessionRecordStore.open({ directory: join(root, 'store'), hostId: 'local' })
     host = new StructuredAgentSessionHost({
       store,
-      adapter: adapter(),
+      adapter: { ...adapter(), ...adapterOverrides },
       journalRoot: root,
       claimKeyId: 'key-1',
       mintSpawnToken: () => 'spawn-b',
       probeOwner,
+      ...(stopOwnerProcess ? { stopOwnerProcess } : {}),
       now: () => NOW
     })
     replaceHostTestState({ store, host })
@@ -601,13 +610,13 @@ describe('restart', () => {
     expect(host.listSessionTabs()).toEqual([
       { sessionId: SESSION, workspaceId: 'workspace-1', agent: 'codex' }
     ])
-    const history = host.history({ sessionId: SESSION, direction: 'tail' })
+    const history = await host.history({ sessionId: SESSION, direction: 'tail' })
     expect(history.ok && history.page.items).not.toHaveLength(0)
     expect(acquire).not.toHaveBeenCalled()
     expect(listRecords).toHaveBeenCalledTimes(restoreReads)
   })
 
-  it('clears a stale conflicted recovery at restart, and reacquires the native owner when a surface holds it', async () => {
+  it('clears a stale conflicted recovery at restart, and reacquires the native owner on the next start', async () => {
     await attach()
     await store.transitionHandoff(SESSION, (record) => ({
       ...record,
@@ -615,16 +624,17 @@ describe('restart', () => {
         ...record.lease,
         // How a terminal owner an older build recorded loads.
         claimStatus: 'conflicted',
-        handoffStage: 'manual-recovery'
+        handoffStage: 'recovering'
       }
     }))
     await reboot(async () => ({ outcome: 'pid-absent' }))
     acquire.mockClear()
 
     await host.restoreReadableSessions()
-    // The recovery stage clears on evidence at startup; the child comes back only once a surface
-    // holds the session (see structured-agent-session-surface-lifetime.test.ts).
-    await host.hold(SESSION, 'surface-1')
+    // The recovery stage clears on evidence at startup; the child comes back only once work
+    // starts it — here the explicit attach a send's delivery would make.
+    const fence = store.getRecord(SESSION)?.lease.runtimeFence ?? 0
+    expect(await host.attach(CALLER, ensureParams(fence))).toMatchObject({ ok: true })
 
     expect(acquire).toHaveBeenCalledOnce()
     expect(store.getRecord(SESSION)?.lease).toMatchObject({
@@ -633,14 +643,14 @@ describe('restart', () => {
       handoffStage: null,
       handoffOperationId: null
     })
-    await expect(host.handoffStatus(SESSION)).resolves.toMatchObject({
+    expect(host.handoffStatus(SESSION)).toMatchObject({
       owner: 'native',
       phase: 'idle',
       stage: null
     })
   })
 
-  it('answers the owner status of a starting chat once its start settles', async () => {
+  it('answers native for a chat whose start is still in flight', async () => {
     await attach()
     await reboot(async () => ({ outcome: 'pid-absent' }))
     await host.restoreReadableSessions()
@@ -656,24 +666,45 @@ describe('restart', () => {
       return settled(input)
     })
 
-    const hold = host.hold(SESSION, 'surface-1')
+    const start = host.attach(
+      CALLER,
+      ensureParams(store.getRecord(SESSION)?.lease.runtimeFence ?? 0)
+    )
     await started.promise
+    const claimMidStart = store.getRecord(SESSION)?.lease.claimStatus
     const status = host.handoffStatus(SESSION)
     release.resolve()
-    await hold
+    await start
+
+    // Mid-start the lease is only reserved; ownership does not wait for the agent.
+    expect(claimMidStart).toBe('reserved')
+    expect(status).toMatchObject({ owner: 'native' })
+  })
+
+  it('vouches for no owner of a chat this host cannot run', async () => {
+    await attach()
 
-    await expect(status).resolves.toMatchObject({ owner: 'native', stage: null })
+    await reboot(async () => ({ outcome: 'pid-absent' }), { supportsCreate: () => false })
+    expect(() => host.handoffStatus(SESSION)).toThrow('structured_agent_session_unsupported')
   })
 
-  it("keeps a session whose owner cannot be probed out of a live writer's hands", async () => {
+  it('releases a session whose owner can never be probed, signalling nothing, and starts over', async () => {
     await attach()
     const held = store.getRecord(SESSION)?.lease.runtimeFence ?? 0
-    await reboot(async () => ({ outcome: 'indeterminate', reason: 'no probe on this host' }))
+    const stopOwnerProcess = vi.fn()
+    await reboot(
+      async () => ({ outcome: 'indeterminate', reason: 'no probe on this host' }),
+      {},
+      stopOwnerProcess
+    )
+    acquire.mockClear()
 
-    expect(await host.attach(CALLER, ensureParams(held))).toMatchObject({
-      ok: false,
-      refusal: { code: 'agent_session_ownership_unknown' }
+    expect(await host.attach(CALLER, ensureParams(await staleFenceFrom(held)))).toMatchObject({
+      ok: true
     })
+    expect(acquire).toHaveBeenCalledOnce()
+    // An unverifiable pid may already belong to an unrelated process.
+    expect(stopOwnerProcess).not.toHaveBeenCalled()
   })
 
   it('does not remember a failed adjudication as done', async () => {
@@ -696,7 +727,7 @@ describe('subscribe', () => {
   it('opens with a snapshot and then streams cursor-qualified batches', async () => {
     await attach()
     const events: AgentSessionSubscribeEvent[] = []
-    const dispose = host.subscribe({
+    const dispose = await host.subscribe({
       id: 'sub-1',
       sessionId: SESSION,
       emit: (event) => events.push(event)
@@ -726,7 +757,7 @@ describe('subscribe', () => {
     }
 
     const events: AgentSessionSubscribeEvent[] = []
-    host.subscribe({
+    await host.subscribe({
       id: 'sub-2',
       sessionId: SESSION,
       emit: (event) => events.push(event),
@@ -747,14 +778,14 @@ describe('subscribe', () => {
   it('drops a failed transport without aborting the mutation or other subscribers', async () => {
     await attach()
     const events: AgentSessionSubscribeEvent[] = []
-    host.subscribe({
+    await host.subscribe({
       id: 'dead-sub',
       sessionId: SESSION,
       emit: () => {
         throw new Error('socket closed')
       }
     })
-    host.subscribe({
+    await host.subscribe({
       id: 'live-sub',
       sessionId: SESSION,
       emit: (event) => events.push(event)
@@ -766,15 +797,25 @@ describe('subscribe', () => {
       body
     })
 
-    expect(result).toMatchObject({ ok: true, value: { submission: { dispatchState: 'accepted' } } })
-    expect(dispatch).toHaveBeenCalledTimes(1)
-    expect(events.some((event) => event.type === 'batch')).toBe(true)
+    expect(result).toMatchObject({ ok: true, value: { submission: { dispatchState: 'pending' } } })
+    // The failed transport does not stop the delivery loop either: the handover still lands and
+    // reaches the live subscriber.
+    await vi.waitFor(() => expect(dispatch).toHaveBeenCalledTimes(1))
+    await vi.waitFor(() =>
+      expect(
+        events.some(
+          (event) =>
+            event.type === 'batch' &&
+            event.batch.submissions?.some((entry) => entry.dispatchState === 'accepted')
+        )
+      ).toBe(true)
+    )
   })
 
   it('resets a subscriber whose epoch is gone', async () => {
     await attach()
     const events: AgentSessionSubscribeEvent[] = []
-    host.subscribe({
+    await host.subscribe({
       id: 'sub-3',
       sessionId: SESSION,
       emit: (event) => events.push(event),
@@ -786,7 +827,7 @@ describe('subscribe', () => {
   it('publishes the replacement fence when the owner generation changes', async () => {
     const record = await attach()
     const events: AgentSessionSubscribeEvent[] = []
-    host.subscribe({
+    await host.subscribe({
       id: 'sub-4',
       sessionId: SESSION,
       emit: (event) => events.push(event)
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-host.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-host.ts
index 4ba2e6db4780..eba441430749 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-host.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-host.ts
@@ -2,53 +2,59 @@ import type { AgentSessionRewindParams } from '../../../shared/agent-session-rew
 import { rewindStructuredAgentSession } from './structured-agent-session-rewind'
 import { StructuredConversationCommandController } from './structured-conversation-command-controller'
 // Structured agent-session host: where the lease, journal, and provider adapter meet.
-// Mutations share one durable admission path and serialize per session.
+// Mutations share one durable admission path and serialize per session. A conversation is reached
+// only through `conversation`, which opens it at rest; an agent is started only by work that needs
+// it, and the idle sweep is the one thing that puts it to rest.
 
 import type { AgentJournalSnapshot } from '../../../shared/agent-session-journal-types'
 import type { AgentSessionExecutionLocation } from '../../../shared/agent-session-record'
 import type * as SessionWire from '../../../shared/agent-session-wire'
 import type { AgentSessionAttachParams } from './structured-agent-session-attach'
-import { AGENT_SESSION_NOT_ATTACHED } from './structured-agent-session-mutation-admission'
 import { createRestartReconciler } from './structured-agent-session-restart-reconcile'
 import type { AgentSessionSubscribeInput } from './structured-agent-session-subscribers'
 import { StructuredAgentSessionTaskQueue } from './structured-agent-session-task-queue'
 import * as providerSupport from './structured-agent-session-provider-support'
-import { createStructuredAgentSessionHostRestore } from './structured-agent-session-reveal'
+import {
+  createStructuredAgentSessionHostRestore,
+  revealStructuredAgentSession
+} from './structured-agent-session-reveal'
 import { structuredAgentSessionOwnerStatus } from './structured-agent-session-owner-status'
 import { StructuredAgentSessionHostRuntimeState } from './structured-agent-session-host-runtime-state'
 import { attachStructuredAgentSession } from './structured-agent-session-attach-orchestration'
+import type { StructuredAgentSessionLifetimeContext } from './structured-agent-session-host-lifetime'
 import {
-  createStructuredAgentSessionHolds,
-  evictHeldStructuredAgentSession,
-  type StructuredAgentSessionLifetimeContext
-} from './structured-agent-session-host-lifetime'
-import type {
-  StructuredAgentSessionHolds,
-  StructuredAgentSessionHoldOptions
-} from './structured-agent-session-holds'
+  ensureStructuredAgentSessionAgent,
+  ensureStructuredAgentSessionAgentForOperation
+} from './structured-agent-session-agent-start'
+import {
+  createStructuredAgentSessionConversationLifetime,
+  type StructuredAgentSessionConversationLifetime
+} from './structured-agent-session-conversation-lifetime'
 import type { StructuredAgentSessionAttachContext } from './structured-agent-session-attach-context'
 import * as sessionTabs from './structured-agent-session-host-tabs'
 import {
   structuredAgentSessionMutationDelegates,
   settleStructuredAgentSessionLateDispatch,
-  type StructuredAgentSessionMutationContext,
-  releaseStructuredAgentSessionUnansweredDispatches
+  type StructuredAgentSessionMutationContext
 } from './structured-agent-session-host-mutations'
+import { releaseStructuredAgentSessionUnansweredDispatches } from './structured-agent-session-unanswered-dispatch-release'
 import { flushStructuredAgentSessionHost } from './structured-agent-session-host-teardown'
 import type {
   StructuredAgentSessionCaller,
   StructuredAgentSessionHostDeps,
-  StructuredAgentSessionHostSession,
   StructuredAgentSessionReveal
 } from './structured-agent-session-host-types'
 import { StructuredAgentSessionEventRecovery } from './structured-agent-session-event-recovery'
 import { StructuredAgentSessionBackgroundTaskChannel } from './structured-agent-session-background-task-channel'
 import { StructuredAgentSessionClientDelivery } from './structured-agent-session-client-delivery'
+import { StructuredAgentSessionConversations } from './structured-agent-session-conversations'
 import {
   createStructuredAgentSessionRestartResume,
   type StructuredAgentSessionRestartResume
 } from './structured-agent-session-restart-resume-host'
 import { structuredAgentSessionRestartResumeSurfaces } from './structured-agent-session-restart-resume-wiring'
+import { createStructuredAgentSessionConversationDelivery } from './structured-agent-session-host-delivery'
+import { structuredAgentSessionConversationFence } from './structured-agent-session-provider-child'
 export type { StructuredAgentSessionHostDeps } from './structured-agent-session-host-types'
 
 export class StructuredAgentSessionHost {
@@ -56,12 +62,18 @@ export class StructuredAgentSessionHost {
     () => this.mutationContext(),
     this
   )
-  private readonly sessions = new Map<string, StructuredAgentSessionHostSession>()
+  private readonly sessions = new StructuredAgentSessionConversations({
+    deliver: (sessionId, journal) => this.subscribers.publish(sessionId, journal),
+    onDeliveryError: (sessionId, error) => this.deps.onEventSinkError?.({ sessionId, error }),
+    now: () => this.now()
+  })
+  // Every journal publish is activity: the one renewal the idle sweep reads.
   private readonly clientDelivery = new StructuredAgentSessionClientDelivery(
     this.sessions,
     () => this.now(),
     () => this.deps,
-    (sessionId) => this.holds.renew(sessionId)
+    (sessionId) => this.sessions.touch(sessionId),
+    (sessionId) => this.restartResume.onAgentStarted(sessionId)
   )
   private readonly subscribers = this.clientDelivery.subscribers
   private readonly tasks = new StructuredAgentSessionTaskQueue()
@@ -70,7 +82,10 @@ export class StructuredAgentSessionHost {
     sessionId: string
   ) => Promise<SessionWire.AgentSessionWireRefusal | null>
   private readonly restore: ReturnType<typeof createStructuredAgentSessionHostRestore>
-  private readonly holds: StructuredAgentSessionHolds
+  private readonly lifetime: StructuredAgentSessionConversationLifetime
+  private readonly conversationDelivery: ReturnType<
+    typeof createStructuredAgentSessionConversationDelivery
+  >
   private readonly eventRecovery: StructuredAgentSessionEventRecovery
   private readonly backgroundTasks: StructuredAgentSessionBackgroundTaskChannel
   /** Public because the RPC surface addresses it directly; see the restart-resume collaborator. */
@@ -81,7 +96,7 @@ export class StructuredAgentSessionHost {
       deps,
       this.sessions,
       this.subscribers,
-      (sessionId) => this.requireSession(sessionId),
+      (sessionId) => this.lifetime.conversation(sessionId),
       this.clientDelivery.publishStatus
     )
     this.runtimeState = new StructuredAgentSessionHostRuntimeState(deps, (sessionId, error) =>
@@ -93,21 +108,31 @@ export class StructuredAgentSessionHost {
       ...(deps.probeOwners ? { probeMany: deps.probeOwners } : {}),
       now: () => this.now()
     })
-    this.holds = createStructuredAgentSessionHolds(
-      () => this.attachContext(),
-      (sessionId) => this.close(sessionId)
-    )
-    this.restore = createStructuredAgentSessionHostRestore(deps, this.sessions, () => this.now(), {
+    this.conversationDelivery = createStructuredAgentSessionConversationDelivery({
+      deps,
+      sessions: this.sessions,
+      serialize: (sessionId, task) => this.serialize(sessionId, task),
+      // Quit drains a delivery start before it evicts, so the child it produces is stopped.
+      trackStart: (start) => this.tasks.trackAttach(start),
+      ensureProviderChild: (sessionId, startedFor) =>
+        ensureStructuredAgentSessionAgent(this.attachContext(), sessionId, startedFor),
+      reset: (sessionId, journal, reset) =>
+        this.subscribers.reset(
+          sessionId,
+          journal,
+          reset,
+          structuredAgentSessionConversationFence(deps.store, sessionId)
+        ),
+      publishRestored: this.clientDelivery.publishRestored
+    })
+    this.restore = createStructuredAgentSessionHostRestore(deps, {
       reconcile: this.reconcileLeases,
       resolveRecovery: (sessionId) => this.runtimeState.resolveRecovery(sessionId),
       serialize: (sessionId, task) => this.serialize(sessionId, task),
       hasSession: this.hasSession,
       // Site 10: cannot overwrite a live entry — the restorer returns early on
       // `hasSession` inside the same serialized step as this `set`.
-      onReadable: (sessionId, restored) => {
-        this.sessions.set(sessionId, restored)
-        this.clientDelivery.publishRestored(sessionId)
-      }
+      onReadable: this.conversationDelivery.adoptOpened
     })
     this.eventRecovery = new StructuredAgentSessionEventRecovery({
       deps,
@@ -115,38 +140,36 @@ export class StructuredAgentSessionHost {
       sessions: this.sessions,
       flushLifecycle: (sessionId) => this.runtimeState.lifecycleBarrier(sessionId),
       publishFence: (sessionId, session) =>
-        this.subscribers.snapshot(sessionId, session.journal, session.fence),
+        this.subscribers.snapshot(
+          sessionId,
+          session.journal,
+          structuredAgentSessionConversationFence(deps.store, sessionId)
+        ),
       publishStatus: this.clientDelivery.publishStatusAndSettlement,
-      hasResumeCapableHolder: (sessionId) => this.holds.hasResumeCapableHolder(sessionId),
-      restartReleaseGrace: (sessionId) => this.holds.renew(sessionId),
-      // Tracked: a quit drains a queued restart before it evicts, so no child outlives it.
       serialize: (sessionId, task) => this.tasks.trackAttach(this.serialize(sessionId, task)),
       now: () => this.now(),
-      ensureProviderChild: (id, options) => this.holds.ensureProviderChild(id, options),
       onBarrierError: (sessionId, error) => deps.onEventSinkError?.({ sessionId, error })
     })
-    this.restartResume = createStructuredAgentSessionRestartResume(deps, this.sessions, {
-      ...structuredAgentSessionRestartResumeSurfaces(this, this.now),
-      publish: this.subscribers.publish.bind(this.subscribers)
+    this.restartResume = createStructuredAgentSessionRestartResume(
+      deps,
+      this.sessions,
+      structuredAgentSessionRestartResumeSurfaces(this, this.now)
+    )
+    this.lifetime = createStructuredAgentSessionConversationLifetime({
+      context: () => this.lifetimeContext(),
+      sessions: this.sessions,
+      serialize: (sessionId, task) => this.serialize(sessionId, task),
+      open: (sessionId) => this.conversationDelivery.open(sessionId),
+      deliveryActive: (sessionId) => this.conversationDelivery.loop.isRunning(sessionId),
+      closeStatus: (sessionId, options) => this.clientDelivery.closeSession(sessionId, options)
     })
     this.runtimeState.startLeaseRenewal()
+    this.lifetime.idleSweep.start()
   }
 
   private now = (): number => this.deps.now?.() ?? Date.now()
 
   hasSession = (sessionId: string): boolean => this.sessions.has(sessionId)
-  isHeld = (sessionId: string): boolean => this.holds.isHeld(sessionId)
-
-  /** A surface bound to this session and wants it live. The FIRST hold on a session with no
-   *  provider child is what resumes one; a retained hold (a subscription) only keeps it. */
-  hold = (
-    sessionId: string,
-    holderId: string,
-    options?: StructuredAgentSessionHoldOptions
-  ): Promise<void> => this.holds.hold(sessionId, holderId, options)
-
-  /** That surface is gone. The child outlives it by the idle window, and by any running turn. */
-  release = (sessionId: string, holderId: string): void => this.holds.release(sessionId, holderId)
 
   handleAdapterEvent = (event: Parameters<StructuredAgentSessionEventRecovery['handle']>[0]) =>
     this.eventRecovery.handle(event)
@@ -157,7 +180,7 @@ export class StructuredAgentSessionHost {
       runtimeState: this.runtimeState,
       sessions: this.sessions,
       now: () => this.now(),
-      forgetStatus: this.clientDelivery.forgetStatus
+      publishStatus: this.clientDelivery.publishStatus
     }
   }
 
@@ -169,28 +192,31 @@ export class StructuredAgentSessionHost {
       tasks: this.tasks,
       reconcileLeases: (sessionId) => this.reconcileLeases(sessionId),
       serialize: (sessionId, task) => this.serialize(sessionId, task),
-      publishStatus: this.clientDelivery.publishStatus
+      publishStatus: this.clientDelivery.publishStatus,
+      openConversation: this.conversationDelivery.open
     }
   }
-  /** Releases a session's resources without ending the conversation: the record and journal stay
-   *  on disk, so the same session can be attached again. */
-  close(sessionId: string): Promise<void> {
-    return this.serialize(sessionId, async () => {
-      await evictHeldStructuredAgentSession(this.lifetimeContext(), sessionId)
-      this.clientDelivery.closeSession(sessionId)
-      // The holders now look at a session that is gone; a failed eviction throws above, keeping them.
-      this.holds.forget(sessionId)
-    })
-  }
+  /** Releases a session's resources without ending the conversation; see the lifetime's close. */
+  close = (sessionId: string): Promise<void> => this.lifetime.close(sessionId)
 
   supportsCreate = (location: AgentSessionExecutionLocation, agent: string): boolean =>
     providerSupport.adapterSupportsCreate(this.deps.adapter, location, agent)
 
   listSessionTabs = () => sessionTabs.listStructuredAgentSessionTabs(this.sessions)
   getPersistedVisibleSessionTabIndex = () => this.deps.store.getVisibleSessionTabIndex()
+  getSessionTabId = (sessionId: string): string | null => this.deps.store.getSessionTabId(sessionId)
 
-  setSessionTabVisibility = (sessionId: string, visible: boolean): Promise<void> =>
-    sessionTabs.setStructuredAgentSessionTabVisibility(this, sessionId, visible)
+  setSessionTabVisibility = async (
+    sessionId: string,
+    visible: boolean,
+    tabId?: string
+  ): Promise<void> => {
+    await sessionTabs.setStructuredAgentSessionTabVisibility(this, sessionId, visible, tabId)
+    // The tab edge of the row's lifetime; the handle close is the other.
+    if (!visible && !this.sessions.get(sessionId)?.child) {
+      this.clientDelivery.forgetStatus(sessionId)
+    }
+  }
 
   reconcileRestartLeases = async (): Promise<void> => {
     const refusal = await this.reconcileLeases('startup')
@@ -204,7 +230,7 @@ export class StructuredAgentSessionHost {
 
   /** Make one persisted session addressable again; see `structured-agent-session-reveal`. */
   revealSession = (sessionId: string): Promise<StructuredAgentSessionReveal> =>
-    this.restore.revealSession(sessionId)
+    revealStructuredAgentSession(this.deps, sessionId, (id) => this.lifetime.conversation(id))
 
   private serialize = this.tasks.serialize.bind(this.tasks)
 
@@ -221,9 +247,10 @@ export class StructuredAgentSessionHost {
   // Trigger inlined rather than imported: `AgentSessionResumeTrigger` in shared is the canonical
   // type, and this file has no line budget left for the import.
   async flushAllStreamedEvents(options?: { trigger?: 'quit' | 'update' }): Promise<void> {
+    this.conversationDelivery.loop.dispose()
     await flushStructuredAgentSessionHost({
       ...this.lifetimeContext(),
-      holds: this.holds,
+      idleSweep: this.lifetime,
       tasks: this.tasks,
       restartResume: this.restartResume,
       serialize: this.serialize,
@@ -237,10 +264,13 @@ export class StructuredAgentSessionHost {
       sessions: this.sessions,
       publish: (sessionId, journal) => this.subscribers.publish(sessionId, journal),
       flushStreamedEvents: this.flushStreamedEvents,
-      requireSession: (sessionId) => this.requireSession(sessionId),
+      conversation: this.lifetime.conversation,
       serialize: (sessionId, task) => this.serialize(sessionId, task),
-      holds: this.holds,
-      restoreReadable: (sessionId) => this.restore.restoreReadableUnderSerialize(sessionId),
+      openConversation: this.conversationDelivery.open,
+      ensureAgent: (sessionId) =>
+        ensureStructuredAgentSessionAgentForOperation(this.attachContext(), sessionId),
+      wakeDelivery: (sessionId) => this.conversationDelivery.loop.wake(sessionId),
+      stopAgent: this.lifetime.stopAgent,
       now: () => this.now()
     }
   }
@@ -267,27 +297,19 @@ export class StructuredAgentSessionHost {
     commands: this.deps.adapter.readCommands?.(sessionId)
   })
 
-  async handoffStatus(sessionId: string): Promise<SessionWire.AgentSessionHandoffStatus> {
-    this.requireSession(sessionId)
-    // Queued behind an in-flight attach, so a starting chat answers with its settled owner.
-    return this.serialize(sessionId, async () => {
-      const record = this.deps.store.getRecord(sessionId)
-      if (!record) {
-        throw new Error('agent_session_identity_required')
-      }
-      return structuredAgentSessionOwnerStatus(record)
-    })
-  }
+  /** From the record store, never the session map: an idle-released chat has no map entry. */
+  handoffStatus = (sessionId: string): SessionWire.AgentSessionHandoffStatus =>
+    structuredAgentSessionOwnerStatus(this.deps, sessionId)
 
   history: StructuredAgentSessionBackgroundTaskChannel['history'] = (request) =>
     this.backgroundTasks.history(request)
 
   /** The fully reduced timeline, for readers that cannot tolerate a page's ambiguity — rows are
    *  revised or tombstoned in place, so an item's ABSENCE from a bounded page proves nothing. */
-  journalSnapshot = (sessionId: string): AgentJournalSnapshot =>
-    this.requireSession(sessionId).journal.snapshot()
+  journalSnapshot = async (sessionId: string): Promise<AgentJournalSnapshot> =>
+    (await this.lifetime.conversation(sessionId)).journal.snapshot()
 
-  subscribe = (input: AgentSessionSubscribeInput): (() => void) =>
+  subscribe = (input: AgentSessionSubscribeInput): Promise<() => void> =>
     this.backgroundTasks.subscribe(input)
 
   settleLateDispatch = (input: Parameters<typeof settleStructuredAgentSessionLateDispatch>[1]) =>
@@ -308,11 +330,13 @@ export class StructuredAgentSessionHost {
   /** Turns that settle from now on. Live-only: nothing missed is replayed. */
   subscribeTurnCompletions = this.clientDelivery.subscribeTurnCompletions
 
-  private requireSession(sessionId: string): StructuredAgentSessionHostSession {
-    const session = this.sessions.get(sessionId)
-    if (!session) {
-      throw new Error(AGENT_SESSION_NOT_ATTACHED.code)
-    }
-    return session
-  }
+  /** Test rigs only: the collaborators the host builds itself, typed, for tests that drive them. */
+  collaboratorsForTests = () => ({
+    sessions: this.sessions,
+    subscribers: this.subscribers,
+    runtimeState: this.runtimeState,
+    conversationDelivery: this.conversationDelivery,
+    lifetime: this.lifetime,
+    serialize: this.serialize
+  })
 }
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-idle-sweep.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-idle-sweep.test.ts
new file mode 100644
index 000000000000..ebc2009fa7db
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-idle-sweep.test.ts
@@ -0,0 +1,314 @@
+// The idle sweep on a real host: what puts an agent to rest, what keeps it running, and what a
+// reader and the session lists see when it does.
+
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { AgentSessionStatusSummary } from '../../../shared/agent-session-wire'
+import {
+  collectSubscriber,
+  createRestTestRig,
+  foundRestTestChat,
+  readerSaw,
+  IDLE_MS,
+  REST_TEST_CALLER as CALLER,
+  REST_TEST_SESSION as SESSION,
+  REST_TEST_THREAD as THREAD,
+  restTestSend,
+  sweepTicks,
+  type RestTestRig
+} from './structured-agent-session-rest-test-rig'
+import { StructuredAgentSessionIdleSweep } from './structured-agent-session-idle-sweep'
+
+let rig: RestTestRig
+
+beforeEach(async () => {
+  rig = await createRestTestRig()
+})
+
+afterEach(async () => {
+  await rig.dispose()
+})
+
+function providerEvents() {
+  const events = rig.adapter.acquire.mock.calls.at(-1)?.[0].events
+  if (!events) {
+    throw new Error('no provider child was started')
+  }
+  return events
+}
+
+function lastStatus(): AgentSessionStatusSummary | undefined {
+  return rig.statusEvents
+    .flatMap((event) => (event.type === 'status' ? [event.session] : []))
+    .findLast((summary) => summary.sessionId === SESSION)
+}
+
+function fence(): number {
+  return rig.store.getRecord(SESSION)?.lease.runtimeFence ?? 1
+}
+
+describe('the idle sweep', () => {
+  it('stops an idle agent and keeps the conversation, its status row and its reader (P2-07)', async () => {
+    await foundRestTestChat(rig)
+    const reader = collectSubscriber()
+    await rig.host.subscribe({ id: 'reader', sessionId: SESSION, emit: reader.emit })
+    rig.clock.now += IDLE_MS + 1
+
+    await vi.waitFor(() => expect(rig.adapter.closeSession).toHaveBeenCalledWith(SESSION))
+    await vi.waitFor(() => expect(rig.store.getRecord(SESSION)?.lease.claimStatus).toBe('released'))
+    await vi.waitFor(() => expect(rig.adapter.acknowledgeSessionRelease).toHaveBeenCalledOnce())
+    expect(rig.adapter.acknowledgeSessionRelease).toHaveBeenCalledWith(SESSION)
+    // Listed, idle, and no longer running on this host — never dropped from any list.
+    expect(lastStatus()).toMatchObject({ status: 'idle' })
+    expect(lastStatus()?.hostExecutionOwned).toBeUndefined()
+    expect(rig.sink.forget).not.toHaveBeenCalled()
+    expect(reader.events.some((event) => event.type === 'end')).toBe(false)
+
+    // Everything a chat at rest answers still answers, and the next send starts a new agent.
+    await expect(rig.host.readOptions(SESSION)).resolves.toMatchObject({ current: {} })
+    const sent = await rig.host.send(CALLER, restTestSend('carry on', fence()))
+    expect(sent.ok).toBe(true)
+    await vi.waitFor(() => expect(rig.adapter.acquire).toHaveBeenCalledTimes(2))
+    await vi.waitFor(() => expect(rig.adapter.dispatch).toHaveBeenCalledTimes(2))
+    await vi.waitFor(() => expect(readerSaw(reader.events).texts).toContain('carry on'))
+  })
+
+  it('never stops an agent a message is queued for, and hands the message over (P2-08)', async () => {
+    await foundRestTestChat(rig)
+    rig.adapter.closeSession.mockClear()
+    // The loop takes the message and waits on the child's start, outside the lock.
+    const started = Promise.withResolvers<void>()
+    const awaitStarted = vi.fn(() => started.promise)
+    Object.assign(rig.host.deps.adapter, { awaitStarted })
+    const reader = collectSubscriber()
+    await rig.host.subscribe({ id: 'reader', sessionId: SESSION, emit: reader.emit })
+    const sent = await rig.host.send(CALLER, restTestSend('queued one', fence()))
+    expect(sent.ok).toBe(true)
+    await vi.waitFor(() => expect(awaitStarted).toHaveBeenCalled())
+    rig.clock.now += IDLE_MS + 1
+
+    await sweepTicks()
+    expect(rig.adapter.closeSession).not.toHaveBeenCalled()
+    started.resolve()
+    await vi.waitFor(() => expect(rig.adapter.dispatch).toHaveBeenCalledTimes(2))
+    const settled = (await rig.host.journalSnapshot(SESSION)).submissions.at(-1)
+    expect(settled?.dispatchState).toBe('accepted')
+    const seen = readerSaw(reader.events).submissions
+    expect(seen.some((row) => row.dispatchState === 'accepted')).toBe(true)
+    expect(
+      seen.some((row) => row.dispatchState === 'rejected' || row.dispatchState === 'unknown')
+    ).toBe(false)
+  })
+
+  it('never stops an agent whose background work still runs (P2-09)', async () => {
+    await foundRestTestChat(rig)
+    // A Codex subagent thread is one of these tasks; the tracker projects both kinds alike.
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: a background roster fixture; the sweep reads only whether live tasks exist.
+    rig.adapter.backgroundTaskState.mockReturnValue({
+      state: 'monitoring',
+      tasks: [
+        {
+          taskId: 'subagent-1',
+          kind: 'subagent',
+          status: 'running',
+          title: 'reviewer',
+          startedAt: rig.clock.now
+        }
+      ]
+    } as never)
+    rig.clock.now += IDLE_MS + 1
+
+    await sweepTicks()
+    expect(rig.adapter.closeSession).not.toHaveBeenCalled()
+    rig.adapter.backgroundTaskState.mockReturnValue(undefined)
+    rig.clock.now += IDLE_MS + 1
+    await vi.waitFor(() => expect(rig.adapter.closeSession).toHaveBeenCalledWith(SESSION))
+  })
+
+  // A finished child reads done before the lead's wake-up turn writes its first row; stopping the
+  // agent in that gap would lose the wake-up. Owed work is activity, as main's release clock had it.
+  it('gives an agent a full idle window after its background work ends', async () => {
+    await foundRestTestChat(rig)
+    rig.adapter.backgroundTaskState.mockReturnValue({
+      state: 'monitoring',
+      tasks: [{ id: 'subagent-1', kind: 'agent', state: 'working' }]
+    })
+    rig.clock.now += IDLE_MS + 1
+    await sweepTicks()
+    rig.adapter.backgroundTaskState.mockReturnValue({
+      state: 'monitoring',
+      tasks: [{ id: 'subagent-1', kind: 'agent', state: 'done' }]
+    })
+
+    await sweepTicks()
+    expect(rig.adapter.closeSession).not.toHaveBeenCalled()
+    rig.clock.now += IDLE_MS + 1
+    await vi.waitFor(() => expect(rig.adapter.closeSession).toHaveBeenCalledWith(SESSION))
+  })
+
+  // Owed work is read every tick, not once a window: work that ends just before a window would
+  // have closed still leaves the agent a full window after it.
+  it('gives a full window after background work that ends late in a window', async () => {
+    await foundRestTestChat(rig)
+    const subagent = (state: 'working' | 'done') => ({
+      state: 'monitoring' as const,
+      tasks: [{ id: 'subagent-1', kind: 'agent' as const, state }]
+    })
+    rig.adapter.backgroundTaskState.mockReturnValue(subagent('working'))
+    rig.clock.now += IDLE_MS + 1
+    await sweepTicks()
+    rig.clock.now += IDLE_MS - 60_000
+    await sweepTicks()
+    rig.adapter.backgroundTaskState.mockReturnValue(subagent('done'))
+    rig.clock.now += 60_000 + 1
+
+    await sweepTicks()
+    expect(rig.adapter.closeSession).not.toHaveBeenCalled()
+    rig.clock.now += IDLE_MS
+    await vi.waitFor(() => expect(rig.adapter.closeSession).toHaveBeenCalledWith(SESSION))
+  })
+
+  it('stops an agent whose roster holds only children that went idle or finished', async () => {
+    await foundRestTestChat(rig)
+    rig.adapter.backgroundTaskState.mockReturnValue({
+      state: 'monitoring',
+      tasks: [
+        { id: 'subagent-1', kind: 'agent', state: 'idle' },
+        { id: 'command-1', kind: 'command', state: 'done' }
+      ]
+    })
+    rig.clock.now += IDLE_MS + 1
+
+    await vi.waitFor(() => expect(rig.adapter.closeSession).toHaveBeenCalledWith(SESSION))
+  })
+
+  it('never stops an agent while its lead turn runs, however quiet (P2-10)', async () => {
+    await foundRestTestChat(rig)
+    providerEvents().appendItem(
+      { provider: 'codex', threadId: THREAD, turnId: 'working', ordinal: 50 },
+      { kind: 'turn', turnId: 'working', state: 'running' }
+    )
+    await rig.host.flushStreamedEvents(SESSION)
+    rig.clock.now += IDLE_MS + 1
+
+    await sweepTicks()
+    expect(rig.adapter.closeSession).not.toHaveBeenCalled()
+  })
+
+  it('stops an agent whose chat is still open on screen (P2-12)', async () => {
+    await foundRestTestChat(rig)
+    const reader = collectSubscriber()
+    await rig.host.subscribe({ id: 'on-screen', sessionId: SESSION, emit: reader.emit })
+    rig.clock.now += IDLE_MS + 1
+
+    await vi.waitFor(() => expect(rig.adapter.closeSession).toHaveBeenCalledWith(SESSION))
+    expect(reader.events.some((event) => event.type === 'end')).toBe(false)
+  })
+
+  it('counts the idle window from the last activity (P2-13)', async () => {
+    await foundRestTestChat(rig)
+    rig.clock.now += IDLE_MS - 60_000
+    // Activity at 29 minutes: a provider row reaching the journal.
+    providerEvents().appendItem(
+      { provider: 'codex', threadId: THREAD, turnId: 'turn-1', ordinal: 60 },
+      { kind: 'status', text: 'still thinking' }
+    )
+    await rig.host.flushStreamedEvents(SESSION)
+    rig.clock.now += 60_001
+
+    await sweepTicks()
+    expect(rig.adapter.closeSession).not.toHaveBeenCalled()
+    rig.clock.now += IDLE_MS
+    await vi.waitFor(() => expect(rig.adapter.closeSession).toHaveBeenCalledWith(SESSION))
+  })
+
+  it('never stops a worker whose orchestration dispatch is open, and stops it once it settles (P2-19 i)', async () => {
+    await rig.dispose()
+    let open = true
+    const hasOpenDispatch = vi.fn(() => open)
+    rig = await createRestTestRig({ hasOpenDispatch })
+    await foundRestTestChat(rig)
+    rig.clock.now += 2 * IDLE_MS
+
+    await sweepTicks(12)
+    expect(rig.adapter.closeSession).not.toHaveBeenCalled()
+    expect(hasOpenDispatch).toHaveBeenCalledWith(expect.objectContaining({ sessionId: SESSION }))
+    open = false
+    rig.clock.now += IDLE_MS + 1
+    await vi.waitFor(() => expect(rig.adapter.closeSession).toHaveBeenCalledWith(SESSION))
+  })
+
+  it('keeps a child an unanswered prompt waits on (P2-22 i)', async () => {
+    await foundRestTestChat(rig)
+    providerEvents().appendItem(
+      { provider: 'codex', threadId: THREAD, turnId: 'subagent-turn', ordinal: 70 },
+      {
+        kind: 'approval',
+        title: 'Run the command?',
+        detail: null,
+        options: [{ id: 'allow', label: 'Allow' }],
+        resolution: { state: 'pending', selectedOptionId: null, resolvedBy: null, resolvedAt: null }
+      }
+    )
+    await rig.host.flushStreamedEvents(SESSION)
+    rig.clock.now += IDLE_MS + 1
+
+    await sweepTicks()
+    expect(rig.adapter.closeSession).not.toHaveBeenCalled()
+  })
+})
+
+describe('the idle sweep with no child running (P2-22 ii)', () => {
+  it('closes a handle whose only leftover is a prompt nobody can answer', async () => {
+    const journal = {
+      submissions: () => [],
+      pendingSubmissions: () => [],
+      snapshot: () => ({
+        items: [
+          {
+            itemId: 'prompt',
+            revision: 1,
+            sequence: 1,
+            observedAt: 0,
+            body: {
+              kind: 'approval',
+              title: 'Run?',
+              detail: null,
+              options: [],
+              resolution: {
+                state: 'pending',
+                selectedOptionId: null,
+                resolvedBy: null,
+                resolvedAt: null
+              }
+            }
+          }
+        ]
+      })
+    }
+    const sessions = Object.assign(
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: a session fixture carrying only the journal and child facts the sweep reads.
+      new Map([[SESSION, { journal, child: null } as never]]),
+      { lastActivityAt: () => 0, touch: () => undefined }
+    )
+    const stopAgent = vi.fn(async () => undefined)
+    const closeConversation = vi.fn(async () => true)
+    const sweep = new StructuredAgentSessionIdleSweep({
+      sessions,
+      serialize: (_id, task) => task(),
+      now: () => IDLE_MS + 1,
+      isDisposed: () => false,
+      deliveryActive: () => false,
+      backgroundTaskState: () => undefined,
+      hasOpenDispatch: () => false,
+      stopAgent,
+      stopStartingAgent: stopAgent,
+      closeConversation,
+      onError: (_id, error) => {
+        throw error
+      }
+    })
+    await sweep.tick()
+    expect(stopAgent).not.toHaveBeenCalled()
+    expect(closeConversation).toHaveBeenCalledWith(SESSION)
+  })
+})
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-idle-sweep.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-idle-sweep.ts
new file mode 100644
index 000000000000..2394b604171c
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-idle-sweep.ts
@@ -0,0 +1,151 @@
+// The one thing that puts an idle agent to rest.
+//
+// Nothing a viewer does keeps an agent alive or starts one: a chat on screen and a chat in a
+// background tab are the same to this sweep. Every few minutes it looks at each open conversation
+// and stops the provider child of one that has been quiet for the idle window and owes no work,
+// then drops the open journal handle of one that is only a cache. The conversation itself — its
+// record, tab, status row and readers — is untouched, and the next send starts a new child.
+//
+// Owed work is derived on every tick, never stored, so there is nothing to disagree with it.
+
+import { agentChildWorkLiveness } from '../../../shared/agent-status-child-work-liveness'
+import { activeStructuredAgentSessionTurnId } from '../../../shared/structured-agent-session-projection'
+import { isQueuedAgentJournalSubmission } from '../../../shared/agent-session-queued-submission'
+import type { AgentJournalRenderItem } from '../../../shared/agent-session-journal-types'
+import type { AgentSessionBackgroundTaskState } from '../../../shared/agent-session-wire'
+import type { StructuredAgentSessionHostSession } from './structured-agent-session-host-types'
+
+export const STRUCTURED_AGENT_SESSION_IDLE_SWEEP_INTERVAL_MS = 5 * 60_000
+export const STRUCTURED_AGENT_SESSION_IDLE_MS = 30 * 60_000
+
+export type StructuredAgentSessionIdleSweepDeps = {
+  sessions: ReadonlyMap<string, StructuredAgentSessionHostSession> & {
+    lastActivityAt: (sessionId: string) => number | undefined
+    touch: (sessionId: string) => void
+  }
+  serialize: <T>(sessionId: string, task: () => Promise<T>) => Promise<T>
+  now: () => number
+  isDisposed: () => boolean
+  deliveryActive: (sessionId: string) => boolean
+  backgroundTaskState: (sessionId: string) => AgentSessionBackgroundTaskState | null | undefined
+  /** An orchestration dispatch that still owns this session's worker; derived from its database. */
+  hasOpenDispatch: (sessionId: string) => boolean
+  /** Each of these runs inside the session's serialize and never takes it again. */
+  stopAgent: (sessionId: string) => Promise<void>
+  stopStartingAgent: (sessionId: string) => Promise<void>
+  closeConversation: (sessionId: string) => Promise<boolean>
+  onError: (sessionId: string, error: unknown) => void
+  intervalMs?: number
+  idleMs?: number
+}
+
+/** A prompt the user has not answered. A subagent can raise one the lead turn cannot see. */
+export function hasPendingStructuredAgentSessionPrompt(
+  items: readonly AgentJournalRenderItem[]
+): boolean {
+  return items.some(
+    (item) =>
+      (item.body.kind === 'approval' || item.body.kind === 'question') &&
+      item.body.resolution.state === 'pending'
+  )
+}
+
+export class StructuredAgentSessionIdleSweep {
+  private timer: ReturnType<typeof setInterval> | null = null
+  private running = false
+
+  constructor(private readonly deps: StructuredAgentSessionIdleSweepDeps) {}
+
+  start(): void {
+    this.timer = setInterval(
+      () => void this.tick(),
+      this.deps.intervalMs ?? STRUCTURED_AGENT_SESSION_IDLE_SWEEP_INTERVAL_MS
+    )
+    // An idle sweep must never be the reason a process stays alive at quit.
+    this.timer.unref?.()
+  }
+
+  dispose(): void {
+    if (this.timer) {
+      clearInterval(this.timer)
+      this.timer = null
+    }
+  }
+
+  /** One pass over every open conversation. Sessions run concurrently, so one waiting behind a
+   *  locked start does not hold up the rest; a pass still running skips the next. */
+  async tick(): Promise<void> {
+    if (this.running || this.deps.isDisposed()) {
+      return
+    }
+    this.running = true
+    try {
+      await Promise.allSettled(
+        [...this.deps.sessions.keys()].map((sessionId) =>
+          this.deps
+            .serialize(sessionId, () => this.tickUnderSerialize(sessionId))
+            .catch((error: unknown) => this.deps.onError(sessionId, error))
+        )
+      )
+    } finally {
+      this.running = false
+    }
+  }
+
+  /** Re-derives everything inside the session's lock, so an accept already queued ahead is seen. */
+  private async tickUnderSerialize(sessionId: string): Promise<void> {
+    const session = this.deps.sessions.get(sessionId)
+    if (!session || this.deps.isDisposed()) {
+      return
+    }
+    // A stop that failed after the child was proven gone: finish it now, before the idle test, so
+    // the rows its settlement wrote cannot push the retry out. A message accepted since goes first.
+    if (
+      session.owesProviderChildWindDown !== undefined &&
+      !session.child &&
+      !this.queuedOrDelivering(sessionId, session)
+    ) {
+      await this.deps.stopAgent(sessionId)
+      return
+    }
+    // Owed work is activity, read every tick, so the agent gets a full window once it ends: a child
+    // can read done before the lead's wake-up turn writes anything.
+    if (session.child && session.child.phase !== 'starting' && this.owesWork(sessionId, session)) {
+      this.deps.sessions.touch(sessionId)
+      return
+    }
+    const lastActivityAt = this.deps.sessions.lastActivityAt(sessionId) ?? this.deps.now()
+    if (this.deps.now() - lastActivityAt < (this.deps.idleMs ?? STRUCTURED_AGENT_SESSION_IDLE_MS)) {
+      return
+    }
+    if (session.child) {
+      // A start that has been quiet this long is not coming: the host stops it, with its reason.
+      if (session.child.phase === 'starting') {
+        await this.deps.stopStartingAgent(sessionId)
+        return
+      }
+      await this.deps.stopAgent(sessionId)
+    }
+    await this.deps.closeConversation(sessionId)
+  }
+
+  private queuedOrDelivering(sessionId: string, session: StructuredAgentSessionHostSession) {
+    return (
+      this.deps.deliveryActive(sessionId) ||
+      session.journal.submissions().some(isQueuedAgentJournalSubmission)
+    )
+  }
+
+  /** Work the running child still owes. Scoped to the child: with none, nothing here can pin the
+   *  handle, and a leftover prompt or turn row is only history. */
+  private owesWork(sessionId: string, session: StructuredAgentSessionHostSession): boolean {
+    const items = session.journal.snapshot().items
+    return (
+      activeStructuredAgentSessionTurnId(items) !== null ||
+      this.queuedOrDelivering(sessionId, session) ||
+      agentChildWorkLiveness(this.deps.backgroundTaskState(sessionId)?.tasks) !== null ||
+      this.deps.hasOpenDispatch(sessionId) ||
+      hasPendingStructuredAgentSessionPrompt(items)
+    )
+  }
+}
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-journal-handles.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-journal-handles.test.ts
index 1c9f271004c3..8dabd942705e 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-journal-handles.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-journal-handles.test.ts
@@ -15,11 +15,7 @@ import { journalDatabaseFile } from '../agent-session-journal/journal-paths'
 import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
 import { createTrackedJournalOpener } from '../agent-session-journal/journal-store-test-open'
 import { openAgentSessionJournalWithRecovery } from './agent-session-journal-recovery'
-import {
-  evictStructuredAgentSession,
-  STRUCTURED_AGENT_SESSION_EVICTION_STEPS,
-  type StructuredAgentSessionEvictionContext
-} from './structured-agent-session-eviction'
+import { closeStructuredAgentSessionConversationUnderSerialize } from './structured-agent-session-host-lifetime'
 import { tearDownStructuredAgentSessionHost } from './structured-agent-session-host-teardown'
 import type { StructuredAgentSessionHostSession } from './structured-agent-session-host-types'
 
@@ -73,29 +69,7 @@ function hostSession(journal: AgentSessionJournal): StructuredAgentSessionHostSe
   return {
     journal,
     params: {} as StructuredAgentSessionHostSession['params'],
-    fence: 1,
-    hasProviderChild: false,
-    providerChildPhase: 'ready',
-    acquisitionGeneration: null
-  }
-}
-
-function evictionContext(
-  overrides: Partial<StructuredAgentSessionEvictionContext>
-): StructuredAgentSessionEvictionContext {
-  return {
-    sessionId: SESSION,
-    hasProviderChild: false,
-    eventSink: {
-      drained: async () => ({ ok: true }) as const,
-      unbind: () => undefined,
-      close: () => undefined
-    } as unknown as StructuredAgentSessionEvictionContext['eventSink'],
-    adapter: {} as StructuredAgentSessionEvictionContext['adapter'],
-    forget: async () => undefined,
-    discardSink: () => undefined,
-    releaseLease: async () => undefined,
-    ...overrides
+    child: null
   }
 }
 
@@ -140,46 +114,44 @@ describe('site 6: recovery rehydration', () => {
   })
 })
 
-describe('sites 9 and 10: the delete and overwrite callbacks', () => {
-  it('awaits the journal close before dropping the map entry', async () => {
+describe('sites 9 and 10: closing a conversation handle', () => {
+  it('drops the map entry before the close, and releases the handle', async () => {
     const journal = await journals.open({ identity: IDENTITY, journalDir })
     const sessions = new Map([[SESSION, hostSession(journal)]])
     const order: string[] = []
+    const close = journal.close.bind(journal)
+    journal.close = async () => {
+      // A lock-free reader arriving now must find no entry, never a closing handle.
+      order.push(sessions.has(SESSION) ? 'close-while-indexed' : 'close-after-delete')
+      await close()
+      order.push('closed')
+    }
 
-    await evictStructuredAgentSession(
-      evictionContext({
-        forget: async () => {
-          order.push('close-started')
-          await sessions.get(SESSION)?.journal.close()
-          order.push('closed')
-          sessions.delete(SESSION)
-          order.push('forgotten')
-        }
-      }),
-      STRUCTURED_AGENT_SESSION_EVICTION_STEPS
-    )
+    await expect(
+      closeStructuredAgentSessionConversationUnderSerialize(
+        { sessions, closeStatus: () => order.push('status') },
+        SESSION
+      )
+    ).resolves.toBe(true)
 
-    expect(order).toEqual(['close-started', 'closed', 'forgotten'])
+    expect(order).toEqual(['status', 'close-after-delete', 'closed'])
     expect(sessions.size).toBe(0)
     await expectNothingHoldsTheDirectory(journalDir)
   })
 
-  it('aborts the eviction with the session still indexed when the close rejects', async () => {
+  it('surfaces a rejected close to its caller', async () => {
     const journal = await journals.open({ identity: IDENTITY, journalDir })
     const sessions = new Map([[SESSION, hostSession(journal)]])
+    const close = journal.close.bind(journal)
+    journal.close = () => Promise.reject(new Error('close rejected'))
 
     await expect(
-      evictStructuredAgentSession(
-        evictionContext({
-          forget: async () => {
-            await Promise.reject(new Error('close rejected'))
-          }
-        }),
-        STRUCTURED_AGENT_SESSION_EVICTION_STEPS
+      closeStructuredAgentSessionConversationUnderSerialize(
+        { sessions, closeStatus: () => undefined },
+        SESSION
       )
-    ).rejects.toMatchObject({ step: 'forget-session' })
-    // Still indexed, so the next close is a real retry.
-    expect(sessions.has(SESSION)).toBe(true)
+    ).rejects.toThrow('close rejected')
+    journal.close = close
   })
 })
 
@@ -242,9 +214,13 @@ describe('site 11: host teardown is failure-complete', () => {
     const failing = sessions.get(SESSION)
     const closeError = new Error('close rejected')
     if (failing) {
-      failing.journal = {
-        close: () => Promise.reject(closeError)
-      } as unknown as AgentSessionJournal
+      sessions.set(SESSION, {
+        ...failing,
+        // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: teardown calls only `close`, and this map is a plain `Map` that binds no delivery.
+        journal: {
+          close: () => Promise.reject(closeError)
+        } as unknown as AgentSessionJournal
+      })
     }
 
     await expect(
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-late-settlement.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-late-settlement.test.ts
index 1874f7ee1c67..2194b992fb0e 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-late-settlement.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-late-settlement.test.ts
@@ -24,6 +24,8 @@ import {
   hostTestOperationId,
   resetHostTestOperationIds
 } from './structured-agent-session-host-test-data'
+import { agentSessionFailureFact } from '../../../shared/agent-session-failure'
+import { agentSessionFailureWords } from '../../../shared/agent-session-failure-words'
 
 const CALLER = { callerKey: 'client-1' }
 
@@ -60,8 +62,8 @@ function sendParams(text: string): {
   }
 }
 
-function submissions(): unknown {
-  const state = host.history({ sessionId: SESSION, direction: 'tail' })
+async function submissions(): Promise<unknown> {
+  const state = await host.history({ sessionId: SESSION, direction: 'tail' })
   return state.ok ? state.page.submissions : null
 }
 
@@ -71,6 +73,18 @@ function journal(): AgentSessionJournal {
   ).sessions.get(SESSION)!.journal
 }
 
+/** A send is accepted first; this waits for the delivery loop to hand it to the provider. */
+async function handedOver(clientMessageId: string): Promise<void> {
+  await vi.waitFor(async () => {
+    expect(
+      journal()
+        .submissions()
+        .find((entry) => entry.clientMessageId === clientMessageId)?.handedOverAt
+    ).toBeDefined()
+    expect(dispatch).toHaveBeenCalled()
+  })
+}
+
 beforeEach(async () => {
   root = await mkdtemp(join(tmpdir(), 'orca-wire-late-settle-'))
   resetHostTestOperationIds()
@@ -126,14 +140,14 @@ describe('settling a send the provider proves it received after the ack window',
         })
     )
     const events: AgentSessionSubscribeEvent[] = []
-    const unsubscribe = host.subscribe({
+    const unsubscribe = await host.subscribe({
       id: 'late-receipt',
       sessionId: SESSION,
       emit: (event) => events.push(event)
     })
     const params = sendParams('echo before send completes')
     const pending = host.send(CALLER, params)
-    await vi.waitFor(() => expect(dispatch).toHaveBeenCalledTimes(1))
+    await vi.waitFor(async () => expect(dispatch).toHaveBeenCalledTimes(1))
     try {
       await host.settleLateDispatch({
         sessionId: SESSION,
@@ -152,10 +166,13 @@ describe('settling a send the provider proves it received after the ack window',
       finishDispatch({ state: 'unknown', reason: 'ack timeout' })
       unsubscribe()
     }
-    await expect(pending).resolves.toMatchObject({
-      ok: true,
-      value: { submission: { dispatchState: 'accepted' } }
-    })
+    await expect(pending).resolves.toMatchObject({ ok: true })
+    // The late `unknown` from the handover does not reopen the proven acceptance.
+    await vi.waitFor(async () =>
+      expect(await submissions()).toMatchObject([
+        { clientMessageId: params.envelope.clientOperationId, dispatchState: 'accepted' }
+      ])
+    )
     await expect(host.send(CALLER, { ...params, retryUnknown: true })).resolves.toMatchObject({
       ok: true,
       value: { submission: { dispatchState: 'accepted' } }
@@ -167,6 +184,10 @@ describe('settling a send the provider proves it received after the ack window',
     dispatch.mockResolvedValueOnce({ state: 'unknown', reason: 'ack timeout' })
     const params = sendParams('received just before shutdown')
     await host.send(CALLER, params)
+    await handedOver(params.envelope.clientOperationId)
+    await vi.waitFor(async () =>
+      expect(await submissions()).toMatchObject([{ dispatchState: 'unknown' }])
+    )
     let settlement: Promise<void> | undefined
     closeSession.mockImplementationOnce(async () => {
       settlement = host.settleLateDispatch({
@@ -181,15 +202,18 @@ describe('settling a send the provider proves it received after the ack window',
     await host.close(SESSION)
     await expect(settlement).resolves.toBeUndefined()
     await host.revealSession(SESSION)
-    expect(submissions()).toMatchObject([{ dispatchState: 'accepted' }])
+    expect(await submissions()).toMatchObject([{ dispatchState: 'accepted' }])
     expect(dispatch).toHaveBeenCalledTimes(1)
   })
 
   it('moves a durable unknown to accepted so nothing offers to send it again', async () => {
     dispatch.mockRejectedValueOnce(new Error('socket closed'))
     const params = sendParams('sent while a turn was running')
-    const first = await host.send(CALLER, params)
-    expect(first).toMatchObject({ ok: true, value: { submission: { dispatchState: 'unknown' } } })
+    await host.send(CALLER, params)
+    await handedOver(params.envelope.clientOperationId)
+    await vi.waitFor(async () =>
+      expect(await submissions()).toMatchObject([{ dispatchState: 'unknown' }])
+    )
 
     await host.settleLateDispatch({
       sessionId: SESSION,
@@ -197,7 +221,7 @@ describe('settling a send the provider proves it received after the ack window',
       providerIdentity: { provider: 'claude', sessionId: THREAD, uuid: 'late-uuid' }
     })
 
-    expect(submissions()).toMatchObject([
+    expect(await submissions()).toMatchObject([
       { clientMessageId: params.envelope.clientOperationId, dispatchState: 'accepted' }
     ])
     // The point of the fix: the client stops rendering Retry, and Retry is what
@@ -209,19 +233,21 @@ describe('settling a send the provider proves it received after the ack window',
     dispatch.mockResolvedValueOnce({ state: 'admitted' })
     const params = sendParams('queued behind the active turn')
     await host.send(CALLER, params)
+    await handedOver(params.envelope.clientOperationId)
 
     await host.settleLateDispatch({
       sessionId: SESSION,
       clientMessageId: params.envelope.clientOperationId,
       state: 'rejected',
-      reason: DISPATCH_REJECTED_CANCELLED
+      ...agentSessionFailureWords(agentSessionFailureFact('cancelled'), { surface: 'rejection' })
     })
 
-    expect(submissions()).toMatchObject([
+    expect(await submissions()).toMatchObject([
       {
         clientMessageId: params.envelope.clientOperationId,
         dispatchState: 'rejected',
-        reason: DISPATCH_REJECTED_CANCELLED
+        reason: DISPATCH_REJECTED_CANCELLED,
+        rejection: { kind: 'cancelled' }
       }
     ])
   })
@@ -230,6 +256,7 @@ describe('settling a send the provider proves it received after the ack window',
     dispatch.mockResolvedValueOnce({ state: 'admitted' })
     const params = sendParams('settle from provider echo')
     await host.send(CALLER, params)
+    await handedOver(params.envelope.clientOperationId)
     vi.spyOn(journal(), 'resolveDispatch').mockRejectedValueOnce(
       new Error('direct settlement write failed')
     )
@@ -247,7 +274,7 @@ describe('settling a send the provider proves it received after the ack window',
       { fence: store.getRecord(SESSION)?.lease.runtimeFence ?? 1 }
     )
 
-    expect(submissions()).toMatchObject([
+    expect(await submissions()).toMatchObject([
       {
         clientMessageId: params.envelope.clientOperationId,
         dispatchState: 'accepted',
@@ -259,6 +286,9 @@ describe('settling a send the provider proves it received after the ack window',
   it('leaves an already accepted send alone', async () => {
     const params = sendParams('ordinary send')
     await host.send(CALLER, params)
+    await vi.waitFor(async () =>
+      expect(await submissions()).toMatchObject([{ dispatchState: 'accepted' }])
+    )
 
     await host.settleLateDispatch({
       sessionId: SESSION,
@@ -266,7 +296,7 @@ describe('settling a send the provider proves it received after the ack window',
       providerIdentity: { provider: 'claude', sessionId: THREAD, uuid: 'a-different-uuid' }
     })
 
-    expect(submissions()).toMatchObject([
+    expect(await submissions()).toMatchObject([
       { clientMessageId: params.envelope.clientOperationId, dispatchState: 'accepted' }
     ])
   })
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-launch-send-after-create.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-launch-send-after-create.test.ts
index 300f1423cb3c..cd26b96e5cd1 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-launch-send-after-create.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-launch-send-after-create.test.ts
@@ -57,12 +57,19 @@ async function launchAndDeliver(): Promise<{
     text: 'fix the failing test'
   })
   const sent = await send.mock.results[0]!.value
-  return {
-    messageId,
-    dispatchState: sent.ok
-      ? sent.value.submission.dispatchState
-      : `refused:${sent.refusal.code}:${sent.refusal.message}`
+  if (!sent.ok) {
+    return { messageId, dispatchState: `refused:${sent.refusal.code}:${sent.refusal.message}` }
   }
+  // Accepted first; the delivery loop hands it over, and that outcome is what reached the agent.
+  let dispatchState = sent.value.submission.dispatchState
+  await vi.waitFor(async () => {
+    dispatchState =
+      (await host.journalSnapshot(created.value.sessionId)).submissions.find(
+        (entry) => entry.clientMessageId === sent.value.clientMessageId
+      )?.dispatchState ?? 'missing'
+    expect(dispatchState).not.toBe('pending')
+  })
+  return { messageId, dispatchState }
 }
 
 beforeEach(() => {
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-lease-release.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-lease-release.ts
index bacc56fbcafc..fe584a50fcee 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-lease-release.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-lease-release.ts
@@ -51,7 +51,7 @@ export async function releaseStoredStructuredAgentSessionOwnerAfterUnexpectedExi
   acquisitionGeneration: string | null
   now: number
   exitObservedAt?: number
-  settlementRetry?: { settlementId: string; detail: string }
+  exitReason?: string
 }): Promise<AgentSessionRecord> {
   if (input.acquisitionGeneration !== input.expectedAcquisitionGeneration) {
     throw new Error('agent_session_checkpoint_stale')
@@ -69,6 +69,6 @@ export async function releaseStoredStructuredAgentSessionOwnerAfterUnexpectedExi
     expectedFence: input.expectedFence,
     now: input.now,
     exitObservedAt: input.exitObservedAt,
-    ...(input.settlementRetry ? { settlementRetry: input.settlementRetry } : {})
+    ...(input.exitReason ? { exitReason: input.exitReason } : {})
   })
 }
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-lease-renewer.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-lease-renewer.test.ts
index f969e3c0bbf7..9545e42b051c 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-lease-renewer.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-lease-renewer.test.ts
@@ -190,11 +190,36 @@ describe('structured agent-session lease renewal', () => {
         { timeout: 5000 }
       )
     } finally {
-      renewer.stop()
+      await renewer.stop()
       vi.useRealTimers()
     }
   })
 
+  it('stops only once a renewal already in flight has finished writing', async () => {
+    const store = await liveStore()
+    let releaseProbe = (): void => {}
+    const probing = new Promise<void>((resolve) => {
+      releaseProbe = resolve
+    })
+    const renewer = new StructuredAgentSessionLeaseRenewer({
+      store,
+      probe: async () => {
+        await probing
+        return { outcome: 'identity-matched', matchedOn: ['process-start-time'] }
+      },
+      now: () => NOW + 10_000
+    })
+
+    void renewer.renewNow()
+    // Nothing has been written yet: the tick is parked in its probe.
+    expect(store.getRecord('session-renewal')?.lease.lastRenewedAt).toBe(NOW)
+    const stopped = renewer.stop()
+    releaseProbe()
+    await stopped
+
+    expect(store.getRecord('session-renewal')?.lease.lastRenewedAt).toBe(NOW + 10_000)
+  })
+
   it('renews every live owner only after re-proving its child identity', async () => {
     const store = await liveStore()
     const probe = vi.fn(async () => ({
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-lease-renewer.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-lease-renewer.ts
index f1e5ca98305d..a61e11b6f4f1 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-lease-renewer.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-lease-renewer.ts
@@ -10,6 +10,9 @@ const RENEW_INTERVAL_MS = Math.floor(AGENT_SESSION_LEASE_TTL_MS / 3)
 export class StructuredAgentSessionLeaseRenewer {
   private timer: ReturnType<typeof setInterval> | null = null
   private running = false
+  /** The tick in flight. Never rejects: the timer path reports renewal failures through `onError`,
+   *  and stopping must not turn one into a teardown failure as well. */
+  private inFlight: Promise<void> = Promise.resolve()
 
   constructor(
     private readonly input: {
@@ -32,71 +35,81 @@ export class StructuredAgentSessionLeaseRenewer {
     this.timer.unref?.()
   }
 
-  stop(): void {
+  /** Clearing the interval only stops the NEXT tick. A tick already past its guard still has a
+   *  store transaction to commit, and that transaction re-creates the store directory, so a stop
+   *  that returned before it landed would let the write outlive whatever tore the host down. */
+  stop(): Promise<void> {
     if (this.timer) {
       clearInterval(this.timer)
       this.timer = null
     }
+    return this.inFlight
   }
 
-  async renewNow(): Promise<void> {
+  renewNow(): Promise<void> {
     if (this.running) {
-      return
+      return this.inFlight
     }
     this.running = true
+    const attempt = this.renewOnce().finally(() => {
+      this.running = false
+    })
+    this.inFlight = attempt.then(
+      () => undefined,
+      () => undefined
+    )
+    return attempt
+  }
+
+  private async renewOnce(): Promise<void> {
+    const records = this.input.store.listRecords().filter(
+      (record) =>
+        !record.lease.unreconciled &&
+        record.lease.claimStatus === 'live' &&
+        record.lease.ownerProcess !== null &&
+        // A record parked in recovery has no transport the host can vouch for; renewing it
+        // keeps an orphan pid's lease reading as a healthy owner.
+        record.lease.handoffStage !== 'recovering'
+    )
+    const probes = await this.probe(records)
+    const renewals: {
+      sessionId: string
+      fence: number
+      childProbe: AgentSessionOwnerProbe
+      now: number
+    }[] = []
+    const now = this.input.now()
+    for (const record of records) {
+      const probe = probes.get(record.sessionId)
+      if (!probe) {
+        continue
+      }
+      renewals.push({
+        sessionId: record.sessionId,
+        fence: record.lease.runtimeFence,
+        childProbe: probe,
+        now
+      })
+    }
+    // The store persists the whole record file per transaction, so keep the healthy path to
+    // one commit. If one renewal is superseded, retrying individually preserves isolation.
+    let results: PromiseSettledResult<AgentSessionRecord>[]
     try {
-      const records = this.input.store.listRecords().filter(
-        (record) =>
-          !record.lease.unreconciled &&
-          record.lease.claimStatus === 'live' &&
-          record.lease.ownerProcess !== null &&
-          // A record parked in recovery has no transport the host can vouch for; renewing it
-          // keeps an orphan pid's lease reading as a healthy owner.
-          record.lease.handoffStage !== 'recovering' &&
-          record.lease.handoffStage !== 'manual-recovery'
+      const renewed = await this.input.store.renewLeases(renewals)
+      results = renewed.map((record) => ({ status: 'fulfilled', value: record }) as const)
+    } catch {
+      results = await Promise.allSettled(
+        renewals.map((renewal) => this.input.store.renewLease(renewal))
       )
-      const probes = await this.probe(records)
-      const renewals: {
-        sessionId: string
-        fence: number
-        childProbe: AgentSessionOwnerProbe
-        now: number
-      }[] = []
-      const now = this.input.now()
-      for (const record of records) {
-        const probe = probes.get(record.sessionId)
-        if (!probe) {
-          continue
+    }
+    results.forEach((result, index) => {
+      if (result.status === 'rejected') {
+        const renewal = renewals[index]
+        if (renewal) {
+          this.input.onError?.({ sessionId: renewal.sessionId, error: result.reason })
         }
-        renewals.push({
-          sessionId: record.sessionId,
-          fence: record.lease.runtimeFence,
-          childProbe: probe,
-          now
-        })
       }
-      // The store persists the whole record file per transaction, so keep the healthy path to
-      // one commit. If one renewal is superseded, retrying individually preserves isolation.
-      let results: PromiseSettledResult<AgentSessionRecord>[]
-      try {
-        const renewed = await this.input.store.renewLeases(renewals)
-        results = renewed.map((record) => ({ status: 'fulfilled', value: record }) as const)
-      } catch {
-        results = await Promise.allSettled(
-          renewals.map((renewal) => this.input.store.renewLease(renewal))
-        )
-      }
-      results.forEach((result, index) => {
-        if (result.status === 'rejected') {
-          const renewal = renewals[index]
-          if (renewal) {
-            this.input.onError?.({ sessionId: renewal.sessionId, error: result.reason })
-          }
-        }
-      })
-    } finally {
-      this.running = false
-    }
+    })
   }
 
   private async probe(
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-legacy-handoff-record.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-legacy-handoff-record.test.ts
index 42ffe172cd70..213126fb5eb5 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-legacy-handoff-record.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-legacy-handoff-record.test.ts
@@ -25,12 +25,18 @@ import {
 
 const CALLER = { callerKey: 'client-1' }
 
+/** Delivery runs on its own serialized steps; under a loaded runner they take more than a second. */
+function eventually(assertion: () => void | Promise<void>): Promise<void> {
+  return vi.waitFor(assertion, { timeout: 10_000 })
+}
+
 let root: string
 let store: AgentSessionRecordStore
 let host: StructuredAgentSessionHost
 let acquire: Mock<StructuredAgentSessionAdapter['acquire']>
 let probe: Mock<() => Promise<AgentSessionOwnerProbe>>
 let stopOwnerProcess: Mock<(pid: number, signal: 'SIGTERM' | 'SIGKILL') => void>
+let dispatch: Mock<StructuredAgentSessionAdapter['dispatch']>
 
 function openHost(): void {
   host = new StructuredAgentSessionHost({
@@ -39,7 +45,7 @@ function openHost(): void {
       acquire,
       closeSession: vi.fn(async () => true),
       releaseAcquisition: vi.fn(async () => true),
-      dispatch: vi.fn(async () => ({ state: 'admitted' as const })),
+      dispatch,
       cancelTurn: vi.fn(async () => ({ cancelled: false })),
       answerPrompt: vi.fn(async () => undefined),
       setOption: vi.fn(async () => undefined)
@@ -54,7 +60,13 @@ function openHost(): void {
 }
 
 /** Writes the lease an older build left behind, then starts a fresh app generation over it. */
-async function persistFromOlderBuild(lease: Partial<PersistedAgentSessionLease>): Promise<void> {
+/** Older builds also wrote the retired settlement latch fields. */
+type OlderBuildLease = Partial<PersistedAgentSessionLease> & {
+  settlementRetryRequired?: boolean
+  settlementRetryId?: string
+}
+
+async function persistFromOlderBuild(lease: OlderBuildLease): Promise<void> {
   expect(await host.attach(CALLER, hostTestAttachParams(null))).toMatchObject({ ok: true })
   const attached = store.getRecord(SESSION)?.lease
   await host.flushAllStreamedEvents()
@@ -65,6 +77,23 @@ async function persistFromOlderBuild(lease: Partial<PersistedAgentSessionLease>)
   openHost()
 }
 
+/** A send is accepted at once; what became of it is the submission's state once the host's
+ *  delivery settles it — handed over, or rejected with the reason the chat shows. */
+async function delivered(text: string) {
+  const sent = await send(text)
+  expect(sent).toMatchObject({ ok: true })
+  const clientMessageId = sent.ok ? sent.value.clientMessageId : ''
+  const submission = async () =>
+    (await host.journalSnapshot(SESSION)).submissions.find(
+      (candidate) => candidate.clientMessageId === clientMessageId
+    )
+  await eventually(async () => {
+    const current = await submission()
+    expect(current?.dispatchState !== 'pending' || current?.handedOverAt !== undefined).toBe(true)
+  })
+  return submission()
+}
+
 async function send(text: string) {
   const body = hostTestMessage(text)
   return host.send(CALLER, {
@@ -87,6 +116,7 @@ beforeEach(async () => {
   resetHostTestOperationIds()
   probe = vi.fn(async () => ({ outcome: 'pid-absent' as const }))
   stopOwnerProcess = vi.fn()
+  dispatch = vi.fn(async () => ({ state: 'admitted' as const }))
   acquire = vi.fn(async ({ fence, spawnToken }) => ({
     process: { hostId: 'local', pid: 4242, processStartTimeMs: NOW - 1_000, spawnToken },
     link: {
@@ -134,10 +164,11 @@ describe('a record an older build left mid terminal handoff', () => {
 
     expect(store.getRecord(SESSION)?.lease).toMatchObject({
       handoffStage: null,
-      handoffOperationId: null,
-      settlementRetryRequired: undefined
+      handoffOperationId: null
     })
-    expect(await send('after the upgrade')).toMatchObject({ ok: true })
+    expect(store.getRecord(SESSION)?.lease).not.toHaveProperty('settlementRetryRequired')
+    expect(await delivered('after the upgrade')).toMatchObject({ dispatchState: 'pending' })
+    expect(dispatch).toHaveBeenCalledOnce()
     expect(acquire).toHaveBeenCalledOnce()
     expect(store.getRecord(SESSION)?.lease).toMatchObject({
       runtimeKind: 'native',
@@ -169,7 +200,8 @@ describe('a record an older build left mid terminal handoff', () => {
       handoffStage: null,
       handoffOperationId: null
     })
-    expect(await send('after the upgrade')).toMatchObject({ ok: true })
+    expect(await delivered('after the upgrade')).toMatchObject({ dispatchState: 'pending' })
+    expect(dispatch).toHaveBeenCalledOnce()
     expect(store.getRecord(SESSION)?.lease).toMatchObject({ claimStatus: 'live' })
   })
 
@@ -188,7 +220,8 @@ describe('a record an older build left mid terminal handoff', () => {
       handoffStage: null,
       claimStatus: 'released'
     })
-    expect(await send('after the upgrade')).toMatchObject({ ok: true })
+    expect(await delivered('after the upgrade')).toMatchObject({ dispatchState: 'pending' })
+    expect(dispatch).toHaveBeenCalledOnce()
     expect(store.getRecord(SESSION)?.lease).toMatchObject({
       runtimeKind: 'native',
       claimStatus: 'live'
@@ -208,21 +241,40 @@ describe('a record an older build left mid terminal handoff', () => {
 
     expect(store.getRecord(SESSION)?.lease).toMatchObject({
       claimStatus: 'conflicted',
-      handoffStage: 'manual-recovery'
+      handoffStage: 'recovering'
     })
-    expect(await send('while the terminal still runs')).toMatchObject({
+    // Sending and opening the chat both say what frees it: quitting that terminal agent. A send is
+    // accepted, then rejected by the start that cannot take the lease, and the chat's row says why,
+    // worded from the refusal's details; only the live refusal names the process.
+    const quitTerminal =
+      'This chat is still open in a terminal agent (process 4242). Quit that agent to continue the chat here.'
+    expect(await delivered('while the terminal still runs')).toMatchObject({
+      dispatchState: 'rejected'
+    })
+    expect(
+      (await host.journalSnapshot(SESSION)).items.flatMap((item) =>
+        item.body.kind === 'status' && item.body.tone === 'error' ? [item.body.text] : []
+      )
+    ).toEqual([
+      "Codex couldn't restart. This chat is still open in a terminal agent. Quit that agent to continue the chat here."
+    ])
+    const fence = store.getRecord(SESSION)?.lease.runtimeFence ?? null
+    expect(await host.attach(CALLER, hostTestAttachParams(fence))).toMatchObject({
       ok: false,
-      refusal: { code: 'agent_session_conflict' }
+      refusal: { code: 'agent_session_conflict', message: quitTerminal }
     })
+    expect(dispatch).not.toHaveBeenCalled()
     expect(stopOwnerProcess).not.toHaveBeenCalled()
     expect(acquire).not.toHaveBeenCalled()
 
-    // The user closes the terminal; the next open proves it gone and the chat takes over.
+    // The user closes the terminal; the next send's start proves it gone and the chat takes over.
     probe.mockResolvedValue({ outcome: 'pid-absent' })
-    await host.hold(SESSION, 'surface-1')
 
     expect(stopOwnerProcess).not.toHaveBeenCalled()
-    expect(await send('after the terminal closed')).toMatchObject({ ok: true })
+    expect(await delivered('after the terminal closed')).toMatchObject({
+      dispatchState: 'pending'
+    })
+    expect(dispatch).toHaveBeenCalledOnce()
     expect(store.getRecord(SESSION)?.lease).toMatchObject({
       runtimeKind: 'native',
       claimStatus: 'live',
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-mutation-admission.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-mutation-admission.ts
index 040014506219..6a623428e4f0 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-mutation-admission.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-mutation-admission.ts
@@ -5,8 +5,8 @@
 //
 // Admission is two-phase for a call that brings a `prepareSession`. The ledger's
 // answer comes first and places nothing; a call it will admit may then give the
-// session an owner, and only after that are the row placed and the lease and
-// fence checked — against the lease as it stands once the owner is there.
+// session an owner, and only after that are the row placed and the lease
+// checked — against the lease as it stands once the owner is there.
 
 import {
   admitAgentSessionMutation,
@@ -15,10 +15,11 @@ import {
 } from '../../../shared/agent-session-mutation-envelope'
 import type { AgentSessionOperationDecision } from '../../../shared/agent-session-operation-ledger'
 import type { AgentSessionRecord } from '../../../shared/agent-session-record'
-import type {
-  AgentSessionMutationEnvelope,
-  AgentSessionMutationResult,
-  AgentSessionWireRefusal
+import {
+  refuse,
+  type AgentSessionMutationEnvelope,
+  type AgentSessionMutationResult,
+  type AgentSessionWireRefusal
 } from '../../../shared/agent-session-wire'
 import { AGENT_SESSION_UNATTACHED_REFUSAL_CODE } from '../../../shared/structured-agent-session-read-refusal'
 import type { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
@@ -31,10 +32,11 @@ import type { AgentSessionTurnContext } from './structured-agent-session-turns'
 
 // The code is shared with the client so a read that refuses this way can be told apart from a
 // transcript that failed to load; the two must never drift apart.
-export const AGENT_SESSION_NOT_ATTACHED: AgentSessionWireRefusal = {
-  code: AGENT_SESSION_UNATTACHED_REFUSAL_CODE,
-  message: 'This host holds no attached session by that id.'
-}
+export const AGENT_SESSION_NOT_ATTACHED: AgentSessionWireRefusal = refuse(
+  AGENT_SESSION_UNATTACHED_REFUSAL_CODE,
+  { reason: 'sessionNotAttached' },
+  'This host holds no attached session by that id.'
+)
 
 export function refuseAgentSessionMutation(refusal: AgentSessionWireRefusal): {
   ok: false
@@ -44,7 +46,7 @@ export function refuseAgentSessionMutation(refusal: AgentSessionWireRefusal): {
 }
 
 export type AgentSessionMutationSessionPreparation =
-  | { ok: true; envelope: AgentSessionMutationEnvelope }
+  | { ok: true }
   | { ok: false; refusal: AgentSessionWireRefusal }
 
 export type AgentSessionMutationRequest<TValue> = {
@@ -56,8 +58,7 @@ export type AgentSessionMutationRequest<TValue> = {
   /** Journal of the attached session, read after `prepareSession`; absent when this host holds none. */
   journal: () => AgentSessionJournal | undefined
   /** Between the ledger's answer and the lease check, for a call that may first have to make the
-   *  session ready for itself. Answers with the envelope to admit — the caller's, or one moved
-   *  onto a fence the preparation itself published — or with the refusal that ends the call. */
+   *  session ready for itself. Answers with the refusal that ends the call, if any. */
   prepareSession?: (
     ledger: Exclude<AgentSessionOperationDecision['decision'], 'refused'>,
     record: AgentSessionRecord
@@ -71,8 +72,7 @@ export type AgentSessionMutationRequest<TValue> = {
 export async function admitAndRunAgentSessionMutation<TValue>(
   request: AgentSessionMutationRequest<TValue>
 ): Promise<AgentSessionMutationResult<TValue>> {
-  const { plan } = request
-  let { envelope } = request
+  const { plan, envelope } = request
   const hostFingerprint = computeAgentSessionPayloadFingerprint({
     method: plan.method,
     sessionId: envelope.sessionId,
@@ -98,7 +98,6 @@ export async function admitAndRunAgentSessionMutation<TValue>(
       if (!prepared.ok) {
         return prepared
       }
-      envelope = prepared.envelope
     }
   }
   const journal = request.journal()
@@ -110,7 +109,8 @@ export async function admitAndRunAgentSessionMutation<TValue>(
     envelope,
     hostFingerprint,
     now: request.now(),
-    ...(plan.operationIdScope ? { operationIdScope: plan.operationIdScope } : {})
+    ...(plan.operationIdScope ? { operationIdScope: plan.operationIdScope } : {}),
+    ...(plan.conversationWrite ? { conversationWrite: true } : {})
   })
   if (!admitted) {
     return refuseAgentSessionMutation(AGENT_SESSION_NOT_ATTACHED)
@@ -137,14 +137,15 @@ export async function admitAndRunAgentSessionMutation<TValue>(
       return { ok: true, replayed: true, fence, cursor: journal.cursor(), value: replay.value }
     }
     // Nothing durable landed, so this id is about to run for the first time. A
-    // refused call leaves its ledger row behind, and replaying past the lease and
-    // the fence would let a resend act under an owner that has since changed — so
-    // a first run pays the full admission price either way.
+    // refused call leaves its ledger row behind, and replaying past the lease
+    // would let a resend act with no live owner — so a first run pays the full
+    // admission price either way.
     const rerun = admitAgentSessionMutation({
       envelope,
       hostFingerprint,
       ledger: { decision: 'admit', row: admission.row },
-      lease: record.lease
+      lease: record.lease,
+      ...(plan.conversationWrite ? { conversationWrite: true } : {})
     })
     if (rerun.decision === 'refused') {
       return refuseAgentSessionMutation(rerun.refusal)
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-mutation-plans.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-mutation-plans.ts
index d8d2876d272e..fd56944f3bd6 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-mutation-plans.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-mutation-plans.ts
@@ -23,13 +23,15 @@ import {
   type AgentSessionTurnContext,
   type TurnOutcome
 } from './structured-agent-session-turns'
+import type { AgentSessionPromptRequest } from './structured-agent-session-turns-prompt'
 
 export type MutationPlan<TValue> = {
   method: string
   fields: Record<string, unknown>
   operationIdScope?: 'global'
+  /** Admitted without the writer lease: see `admitAgentSessionMutation`. */
+  conversationWrite?: true
   markUnknownBeforeRun?: boolean
-  beforeRun?: () => void
   run: (ctx: AgentSessionTurnContext) => Promise<TurnOutcome<TValue>>
   replay: (ctx: AgentSessionTurnContext, outcome: AgentSessionOperationOutcome) => TValue | null
   rerunWhenReplayMissing?: (ctx: AgentSessionTurnContext) => boolean
@@ -49,19 +51,22 @@ export function sendPlan(params: {
   return {
     method: 'agentSession.send',
     operationIdScope: 'global',
+    conversationWrite: true,
     markUnknownBeforeRun: true,
     // A control signal is not payload; it cannot alter durable replay.
     fields: { body: params.body },
-    ...(params.beforeRun ? { beforeRun: params.beforeRun } : {}),
     recoverUnknownFromDurableState: true,
     // `retryUnknown` is a compatibility-only client signal. A recorded send
     // always replays and never reaches the provider twice.
-    run: (ctx) =>
-      performSend(ctx, {
+    run: (ctx) => {
+      // Asked at acceptance: a send accepted after this one is queued behind it.
+      params.beforeRun?.()
+      return performSend(ctx, {
         clientMessageId,
         payloadFingerprint: params.envelope.payloadFingerprint,
         body: params.body
-      }),
+      })
+    },
     replay: (ctx, outcome) => {
       const submission = ctx.journal
         .submissions()
@@ -100,6 +105,8 @@ export function cancelPlan(params: {
 }): MutationPlan<AgentSessionCancelResult> {
   return {
     method: 'agentSession.cancel',
+    // Stop is a conversation write; a prompt or background-task cancel needs the live child.
+    ...(params.scope || params.prompt ? {} : { conversationWrite: true as const }),
     fields: {
       turnId: params.turnId,
       ...(params.scope ? { scope: params.scope } : {}),
@@ -120,18 +127,17 @@ export function cancelPlan(params: {
   }
 }
 
-export function promptPlan(params: {
-  kind: 'approval' | 'question'
-  itemId: string
-  expectedRevision: number
-  optionId: string
-}): MutationPlan<AgentSessionPromptResult> {
+export function promptPlan(
+  params: AgentSessionPromptRequest
+): MutationPlan<AgentSessionPromptResult> {
   return {
     method: `agentSession.respondTo:${params.kind}`,
+    // The client hashes exactly what it sent; the absent one of these two drops out of the digest.
     fields: {
       itemId: params.itemId,
       expectedRevision: params.expectedRevision,
-      optionId: params.optionId
+      optionId: params.optionId,
+      answers: params.answers
     },
     run: (ctx) => performPrompt(ctx, params),
     replay: (ctx) => {
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-operation-settlement.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-operation-settlement.test.ts
index b1eb5704f015..094ddffdcb27 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-operation-settlement.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-operation-settlement.test.ts
@@ -2,7 +2,6 @@ import { join } from 'node:path'
 import { afterEach, expect, it, vi } from 'vitest'
 import {
   AgentSessionPreDispatchError,
-  AGENT_SESSION_ADMISSION_BARRIER_TIMEOUT_MS,
   runSettledAgentSessionMutation
 } from './structured-agent-session-operation-settlement'
 import {
@@ -42,6 +41,9 @@ async function context(): Promise<AgentSessionTurnContext> {
   }
 }
 
+/** Longer than any bookkeeping bound: a refusal must already be answered by then. */
+const SETTLED_WAIT_MS = 2_000
+
 afterEach(() => {
   vi.useRealTimers()
   vi.restoreAllMocks()
@@ -80,7 +82,7 @@ it('returns a pre-dispatch refusal without waiting on redundant uncertainty pers
   })
   try {
     await refusing.promise
-    await vi.advanceTimersByTimeAsync(AGENT_SESSION_ADMISSION_BARRIER_TIMEOUT_MS)
+    await vi.advanceTimersByTimeAsync(SETTLED_WAIT_MS)
     expect(returned).toBe(true)
     expect(writes).toHaveBeenCalledOnce()
     expect(hostTestState().dispatch).not.toHaveBeenCalled()
@@ -129,9 +131,10 @@ it.each([1, 2])(
   }
 )
 
-// The pre-dispatch check judges only what the journal already holds; the send path never waits on
-// the provider's stream barrier, so a sink that stalls or fails cannot delay or double a send.
-it('dispatches without touching the event-stream barrier', async () => {
+// A send's plan only accepts: it records the submission and never waits on the provider's stream
+// barrier, so a sink that stalls or fails cannot delay or double a send. Handing it over is the
+// delivery loop's.
+it('accepts without touching the event-stream barrier or the provider', async () => {
   const ctx = await context()
   const { store } = hostTestState()
   vi.spyOn(store, 'recordOperationOutcome').mockResolvedValue()
@@ -149,42 +152,33 @@ it('dispatches without touching the event-stream barrier', async () => {
   })
   expect(result).toMatchObject({ ok: true })
   expect(beforeRun).toHaveBeenCalledOnce()
-  expect(hostTestState().dispatch).toHaveBeenCalledOnce()
-  expect(ctx.journal.submissions()[0]?.dispatchState).toBe('accepted')
+  expect(hostTestState().dispatch).not.toHaveBeenCalled()
+  expect(ctx.journal.submissions()[0]).toMatchObject({
+    dispatchState: 'pending',
+    handoverRecorded: true
+  })
   expect(barrier).not.toHaveBeenCalled()
 })
 
-it('refuses a superseded send without waiting on a stalled refusal write, and never dispatches late', async () => {
+it('refuses a superseded send at acceptance, recording and dispatching nothing', async () => {
   const ctx = await context()
   const { store } = hostTestState()
   vi.spyOn(store, 'recordOperationOutcome').mockResolvedValue()
-  const pending = Promise.withResolvers<void>()
-  const refusing = Promise.withResolvers<void>()
-  vi.spyOn(ctx.journal, 'resolveDispatch').mockImplementationOnce(() => {
-    refusing.resolve()
-    return pending.promise.then(() => ctx.journal.cursor())
-  })
-  vi.spyOn(console, 'warn').mockImplementation(() => {})
   const beforeRun = vi.fn(() => {
     throw new AgentSessionPreDispatchError('agent_session_restart_work_superseded')
   })
   const body = hostTestMessage('Continue the interrupted work')
   const operation = envelope('agentSession.send', { body })
   vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout'] })
-  const result = runSettledAgentSessionMutation({
+  const result = await runSettledAgentSessionMutation({
     store,
     operationCallerKey: 'test',
     envelope: operation,
     context: ctx,
     plan: sendPlan({ envelope: operation, body, beforeRun })
   }).catch((error: unknown) => error)
-  await refusing.promise
-  await vi.advanceTimersByTimeAsync(AGENT_SESSION_ADMISSION_BARRIER_TIMEOUT_MS)
-  expect(await result).toBeInstanceOf(AgentSessionPreDispatchError)
-  expect(hostTestState().dispatch).not.toHaveBeenCalled()
-  expect(ctx.journal.submissions()[0]?.dispatchState).toBe('pending')
-  pending.resolve()
-  await vi.advanceTimersByTimeAsync(0)
+  expect(result).toBeInstanceOf(AgentSessionPreDispatchError)
+  expect(ctx.journal.submissions()).toEqual([])
   expect(hostTestState().dispatch).not.toHaveBeenCalled()
   expect(vi.getTimerCount()).toBe(0)
 })
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-operation-settlement.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-operation-settlement.ts
index baf871aef65e..e4675bfefb14 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-operation-settlement.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-operation-settlement.ts
@@ -11,8 +11,6 @@ export class AgentSessionPreDispatchError extends Error {
   }
 }
 
-export const AGENT_SESSION_ADMISSION_BARRIER_TIMEOUT_MS = 2_000
-
 export async function runSettledAgentSessionMutation<TValue>(input: {
   store: AgentSessionRecordStore
   operationCallerKey: string
@@ -33,10 +31,7 @@ export async function runSettledAgentSessionMutation<TValue>(input: {
     if (input.plan.markUnknownBeforeRun) {
       await settle({ status: 'unknown' })
     }
-    outcome = await input.plan.run({
-      ...input.context,
-      ...(input.plan.beforeRun ? { beforeDispatch: input.plan.beforeRun } : {})
-    })
+    outcome = await input.plan.run(input.context)
     await settle(
       outcome.ok
         ? (input.plan.settledOutcome?.(outcome.value) ?? {
@@ -46,6 +41,8 @@ export async function runSettledAgentSessionMutation<TValue>(input: {
         : {
             status: 'failed',
             code: outcome.refusal.code,
+            ...(outcome.refusal.details ? { details: outcome.refusal.details } : {}),
+            // The row's own field, which builds before details read; copied from the legacy mirror.
             ...(outcome.refusal.rewindReason ? { rewindReason: outcome.refusal.rewindReason } : {})
           }
     )
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-operation-start-refusal.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-operation-start-refusal.test.ts
new file mode 100644
index 000000000000..7700a616b382
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-operation-start-refusal.test.ts
@@ -0,0 +1,61 @@
+// What an operation that needs the agent is told when it cannot have one: a typed refusal in
+// words a person can read, never Orca's own error text.
+
+import { describe, expect, it, vi } from 'vitest'
+import type { AgentSessionRecord } from '../../../shared/agent-session-record'
+import type { StructuredAgentSessionAttachContext } from './structured-agent-session-attach-context'
+import { ensureStructuredAgentSessionAgentForOperation } from './structured-agent-session-agent-start'
+import { recordStructuredAgentSessionOptionIntent } from './structured-agent-session-options-read'
+
+const SESSION = 'session-1'
+
+describe('an operation whose agent start throws', () => {
+  it('is refused as a failed restart, with the error only in the log', async () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+    const cause = new Error('EACCES: permission denied, open /Users/me/.orca/leases.json')
+    const context = {
+      sessions: new Map(),
+      reconcileLeases: () => Promise.reject(cause)
+    }
+
+    const refused = await ensureStructuredAgentSessionAgentForOperation(
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: a partial context double; the start throws at `reconcileLeases`, before any other member is read.
+      context as unknown as StructuredAgentSessionAttachContext,
+      SESSION
+    )
+
+    expect(refused).toEqual({
+      ok: false,
+      refusal: {
+        code: 'agent_session_owner_restart_failed',
+        message: "The agent couldn't restart."
+      }
+    })
+    expect(warn).toHaveBeenCalledWith(expect.stringContaining('starting the agent'), cause)
+    warn.mockRestore()
+  })
+})
+
+describe('an option picked while the chat is at rest', () => {
+  it('refuses a key the provider would not accept as a rejected option', async () => {
+    const persistOptions = vi.fn(async () => {})
+    const refused = await recordStructuredAgentSessionOptionIntent(
+      {
+        getRecord: () =>
+          // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the intent reads only the record's provider and options.
+          ({ provider: 'codex', options: {} }) as unknown as AgentSessionRecord
+      },
+      { sessionId: SESSION, persistOptions, publish: () => {} },
+      { key: 'notAnOption', value: 'x' }
+    )
+
+    expect(refused).toMatchObject({
+      ok: false,
+      refusal: {
+        code: 'agent_session_operation_invalid',
+        details: { reason: 'optionRejected' }
+      }
+    })
+    expect(persistOptions).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-option-error.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-option-error.ts
index 607db1e6c4ba..47f67910cf97 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-option-error.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-option-error.ts
@@ -1,6 +1,10 @@
 /** Option validation failed before the provider session was mutated. */
 export class AgentSessionOptionRejectedError extends Error {
-  constructor(cause: unknown) {
+  constructor(
+    cause: unknown,
+    /** `providerStarting`: nothing is wrong with the value; the session cannot take it yet. */
+    readonly refusalReason: 'optionRejected' | 'providerStarting' = 'optionRejected'
+  ) {
     super(cause instanceof Error ? cause.message : String(cause), { cause })
     this.name = 'AgentSessionOptionRejectedError'
   }
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-option-settlement.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-option-settlement.test.ts
index 7957ed326a8e..3eae8a7ae08f 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-option-settlement.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-option-settlement.test.ts
@@ -152,6 +152,11 @@ describe('structured session options and close', () => {
       envelope: envelope('agentSession.send', { body }),
       body
     })
+    // Accepted, then handed over by the delivery loop; the status is read once it answered.
+    await vi.waitFor(() => expect(dispatchedModels).toEqual([DEFAULT_MODEL]))
+    await vi.waitFor(async () =>
+      expect((await host.journalSnapshot(SESSION)).submissions[0]?.dispatchState).toBe('accepted')
+    )
     const events: AgentSessionStatusEvent[] = []
     host.subscribeStatus({ id: 'session-list', emit: (event) => events.push(event) })
     expect(events).toEqual([
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-options-read.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-options-read.ts
new file mode 100644
index 000000000000..2391ffa0205e
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-options-read.ts
@@ -0,0 +1,123 @@
+// A chat's options, live or at rest.
+//
+// At rest nothing here needs a child. The pick is the record's own `options` — what the next start replays —
+// and the list is the host's model catalog, the same one the picker already reads before a chat
+// exists. A pick made at rest is written to the record as intent, through the same transition a live
+// pick takes, so the next start applies it.
+
+import {
+  refuse,
+  type AgentSessionOptionResult,
+  type AgentSessionOptionsResult
+} from '../../../shared/agent-session-wire'
+import { decodeStructuredAgentSessionOptionValue } from '../../../shared/structured-agent-session-option-codec'
+import type { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
+import { isClaudeStructuredOptionKey } from '../../claude/claude-structured-options'
+import { isCodexTurnOptionKey } from '../../codex/codex-structured-turn-start'
+import type { StructuredAgentSessionHostDeps } from './structured-agent-session-host-types'
+import type { AgentSessionTurnContext, TurnOutcome } from './structured-agent-session-turns'
+import type { StructuredAgentSessionMutationContext } from './structured-agent-session-host-mutations'
+
+type RestingOptions = Pick<AgentSessionOptionsResult, 'models' | 'fastModeSupport' | 'current'>
+
+async function readStructuredAgentSessionOptionsAtRest(
+  deps: Pick<StructuredAgentSessionHostDeps, 'store' | 'modelCatalog'>,
+  sessionId: string
+): Promise<RestingOptions> {
+  const record = deps.store.getRecord(sessionId)
+  if (!record) {
+    throw new Error('agent_session_identity_required')
+  }
+  const catalog = (await deps.modelCatalog
+    ?.read({ agent: record.provider, sessionId })
+    .catch(() => null)) ?? { origin: 'unknown' as const }
+  const models = catalog.origin === 'unknown' ? [] : catalog.models
+  const saved = record.options ?? {}
+  const fastMode =
+    saved.fastMode === undefined
+      ? null
+      : decodeStructuredAgentSessionOptionValue('fastMode', saved.fastMode)
+  return {
+    models,
+    ...(catalog.origin !== 'unknown' && catalog.fastModeSupport
+      ? { fastModeSupport: catalog.fastModeSupport }
+      : {}),
+    current: {
+      // An unknown model is one the client already treats as unconfirmed.
+      model: saved.model ?? models.find((model) => model.isDefault)?.id ?? '',
+      ...(saved.effort ? { effort: saved.effort } : {}),
+      ...(typeof fastMode === 'boolean' ? { fastMode } : {})
+    }
+  }
+}
+
+/** Records a pick for the next start. Only a key the provider would accept is kept. */
+export async function recordStructuredAgentSessionOptionIntent(
+  store: Pick<AgentSessionRecordStore, 'getRecord'>,
+  ctx: Pick<AgentSessionTurnContext, 'sessionId' | 'persistOptions' | 'publish'>,
+  input: { key: string; value: string }
+): Promise<TurnOutcome<AgentSessionOptionResult>> {
+  const record = store.getRecord(ctx.sessionId)
+  const accepted =
+    record?.provider === 'codex'
+      ? isCodexTurnOptionKey(input.key)
+      : record?.provider === 'claude' && isClaudeStructuredOptionKey(input.key)
+  if (!record || !accepted) {
+    return {
+      ok: false,
+      refusal: refuse(
+        'agent_session_operation_invalid',
+        { reason: 'optionRejected' },
+        `${record?.provider ?? 'This session'} has no session option named ${input.key}`
+      )
+    }
+  }
+  const options = { ...record.options, [input.key]: input.value }
+  await ctx.persistOptions(options)
+  ctx.publish()
+  return { ok: true, value: { ...input, options } }
+}
+
+/** A live child's own answer, or the answer at rest; the goal, usage and rewind either way. */
+export async function readStructuredAgentSessionOptions(
+  context: Pick<
+    StructuredAgentSessionMutationContext,
+    'deps' | 'serialize' | 'openConversation' | 'conversation'
+  >,
+  sessionId: string
+): Promise<AgentSessionOptionsResult> {
+  const { adapter, store } = context.deps
+  const live = await context.serialize(sessionId, async () => {
+    const session = await context.openConversation(sessionId)
+    const child = session?.child
+    if (!child) {
+      return null
+    }
+    if (!adapter.readOptions) {
+      throw new Error('structured_agent_session_options_unsupported')
+    }
+    return adapter.readOptions({ sessionId, fence: child.fence })
+  })
+  const options = live ?? (await readStructuredAgentSessionOptionsAtRest(context.deps, sessionId))
+  // Re-acquired after the reads above: the handle they saw may have closed and reopened since.
+  const session = await context.conversation(sessionId)
+  const phase = store.getRecord(sessionId)?.rewind?.phase
+  const agent = session.params.provider
+  return {
+    ...options,
+    rewind:
+      phase === 'prepared' || phase === 'provider-succeeded'
+        ? { supported: false, reason: 'outcome-unknown' }
+        : (adapter.rewindSupport?.(sessionId, agent) ?? {
+            supported: false,
+            reason: 'unsupported'
+          }),
+    conversationCommands: adapter.compact ? ['clear', 'compact'] : ['clear'],
+    ...(adapter.supportsThreadGoal?.(sessionId, agent)
+      ? { threadGoal: { current: session.journal.threadGoal() } }
+      : {}),
+    ...(adapter.recordsContextUsage?.(sessionId, agent)
+      ? { contextUsage: { current: session.journal.contextUsage() } }
+      : {})
+  }
+}
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-owed-work-release.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-owed-work-release.test.ts
index d2d5d746469b..9da47ae1f22d 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-owed-work-release.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-owed-work-release.test.ts
@@ -1,10 +1,12 @@
-// Switching away from a chat starts the release clock, and the clock must never stop a provider
-// child that still owes the user work.
+// The idle sweep must never stop a provider child that still owes the user work.
 //
 // A Claude chat is published before its CLI answers initialize, and a message sent in that window
-// is held until it does; evicting then refuses a message the user already sent. And a lead whose
-// turn has settled can leave subagents, commands and monitors running inside the child; evicting
-// then ends them silently.
+// is accepted and stays queued until it does; the delivery loop hands it over once startup lands.
+// The idle sweep ticks meanwhile. Inside the idle window it must leave that queued message and the
+// starting child alone, and every journal publish — the handover included — starts the window
+// again; only a chat quiet for the whole window loses its agent. And a lead whose turn has settled
+// can leave subagents, commands and monitors running inside the child; stopping it then ends them
+// silently.
 
 import { mkdtemp, rm } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
@@ -29,8 +31,8 @@ import {
 } from './structured-agent-session-host-test-data'
 
 const CALLER = { callerKey: 'client-1' }
-const SURFACE = 'desktop-chat:1'
-const GRACE_MS = 5
+const SWEEP_MS = 5
+const IDLE_MS = 1_000
 
 let root: string
 let store: AgentSessionRecordStore
@@ -39,12 +41,14 @@ let adapter: ClaudeStructuredSessionAdapter
 let claude: ReturnType<typeof fakeClaude>
 let landInit: () => void
 let lifecycle: Promise<void>[]
+let clock: number
 
 beforeEach(async () => {
   root = await mkdtemp(join(tmpdir(), 'orca-owed-work-release-'))
   resetHostTestOperationIds()
   claude = fakeClaude()
   lifecycle = []
+  clock = NOW
   const initLanded = new Promise<void>((resolve) => {
     landInit = resolve
   })
@@ -65,7 +69,7 @@ beforeEach(async () => {
         lifecycle.push(host.handleAdapterEvent(mapped))
       }
     },
-    // As the runtime wires it: a held prompt's outcome reaches the journal out of band.
+    // As the runtime wires it: an admitted prompt's outcome reaches the journal out of band.
     onDispatchSettledLate: (settlement) => void host.settleLateDispatch(settlement),
     // Initialize answers only when the test says so.
     openConnection: async (launch, handlers) => {
@@ -87,8 +91,8 @@ beforeEach(async () => {
     journalRoot: root,
     claimKeyId: 'key-1',
     mintSpawnToken: () => 'spawn-a',
-    releaseGraceMs: GRACE_MS,
-    now: () => NOW
+    idleSweep: { intervalMs: SWEEP_MS, idleMs: IDLE_MS },
+    now: () => clock
   })
 })
 
@@ -111,7 +115,6 @@ async function attachStarting(): Promise<void> {
     })
   )
   expect(created).toMatchObject({ ok: true })
-  await host.hold(SESSION, SURFACE)
 }
 
 async function send(text: string, dispatchState = 'pending'): Promise<string> {
@@ -133,38 +136,48 @@ async function send(text: string, dispatchState = 'pending'): Promise<string> {
   return sent.ok ? sent.value.clientMessageId : ''
 }
 
-function dispatchState(clientMessageId: string): string | undefined {
-  return host
-    .journalSnapshot(SESSION)
-    .submissions.find((entry) => entry.clientMessageId === clientMessageId)?.dispatchState
+async function dispatchState(clientMessageId: string): Promise<string | undefined> {
+  return (await host.journalSnapshot(SESSION)).submissions.find(
+    (entry) => entry.clientMessageId === clientMessageId
+  )?.dispatchState
+}
+
+/** The delivery loop hands a message over on its own serialized steps after startup lands; this
+ *  yields to them without moving the host clock. */
+async function untilSent(connection: { sent: unknown[] }): Promise<void> {
+  for (let turn = 0; turn < 2000 && connection.sent.length === 0; turn += 1) {
+    await new Promise((resolve) => setImmediate(resolve))
+  }
 }
 
-/** Long enough for several grace windows to elapse, so "not evicted" means the clock declined. */
-function waitOutSeveralGraceWindows(): Promise<void> {
-  return new Promise((resolve) => setTimeout(resolve, GRACE_MS * 20))
+/** Long enough for many sweep ticks, so "not stopped" means the sweep declined. */
+function waitOutSeveralSweeps(): Promise<void> {
+  return new Promise((resolve) => setTimeout(resolve, SWEEP_MS * 20))
 }
 
-describe('a chat left while its Claude CLI is still starting', () => {
-  it('keeps the session for a message it is holding, and delivers it once startup lands', async () => {
+describe('a Claude chat whose CLI is still starting', () => {
+  it('keeps a message queued inside the idle window, and delivers it once startup lands', async () => {
     await attachStarting()
     const held = await send('sent while starting')
 
-    host.release(SESSION, SURFACE)
-    await waitOutSeveralGraceWindows()
+    clock += IDLE_MS - 1
+    await waitOutSeveralSweeps()
 
     expect(host.hasSession(SESSION)).toBe(true)
     expect(claude.connections[0].closeCount).toBe(0)
-    expect(dispatchState(held)).toBe('pending')
+    expect(await dispatchState(held)).toBe('pending')
 
     landInit()
-    await adapter.drainStartup(SESSION)
+    await adapter.awaitStarted(SESSION)
 
-    expect(claude.connections[0].sent).toEqual([expect.objectContaining({ type: 'user' })])
-    await vi.waitFor(() => expect(dispatchState(held)).toBe('accepted'))
+    await vi.waitFor(
+      () => expect(claude.connections[0].sent).toEqual([expect.objectContaining({ type: 'user' })]),
+      { timeout: 3000 }
+    )
+    await vi.waitFor(async () => expect(await dispatchState(held)).toBe('accepted'))
   })
 
-  it('gives the message it wrote at startup a full grace to open its turn', async () => {
-    vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout'] })
+  it('gives the message it hands over at startup a full idle window to open its turn', async () => {
     await attachStarting()
     const held = await send('sent while starting')
     const connection = claude.connections[0]
@@ -172,31 +185,34 @@ describe('a chat left while its Claude CLI is still starting', () => {
     connection.send = async (message) => {
       connection.sent.push(message)
     }
-    host.release(SESSION, SURFACE)
-    await vi.advanceTimersByTimeAsync(GRACE_MS * 3 - 1)
+    clock += IDLE_MS - 1
+    await waitOutSeveralSweeps()
     expect(host.hasSession(SESSION)).toBe(true)
 
-    // Startup lands just before the clock's next tick.
+    // Startup lands just before the window closes; the handover's publish starts it again.
     landInit()
-    await adapter.drainStartup(SESSION)
+    await adapter.awaitStarted(SESSION)
     await Promise.all(lifecycle)
+    await untilSent(connection)
     expect(connection.sent).toEqual([expect.objectContaining({ type: 'user' })])
-    await vi.advanceTimersByTimeAsync(GRACE_MS - 1)
+    clock += IDLE_MS - 1
+    await waitOutSeveralSweeps()
 
     expect(host.hasSession(SESSION)).toBe(true)
     expect(connection.closeCount).toBe(0)
     connection.handlers.onMessage?.(connection.sent[0])
     await host.flushStreamedEvents(SESSION)
-    await vi.advanceTimersByTimeAsync(GRACE_MS * 3)
+    await waitOutSeveralSweeps()
     expect(host.hasSession(SESSION)).toBe(true)
-    expect(dispatchState(held)).toBe('accepted')
+    expect(await dispatchState(held)).toBe('accepted')
   })
 
-  it('is released after the grace once its turn has finished', async () => {
+  it('stops the agent and closes the conversation once its turn has finished and it idled', async () => {
     await attachStarting()
     landInit()
-    await adapter.drainStartup(SESSION)
-    await send('answered', 'accepted')
+    await adapter.awaitStarted(SESSION)
+    const answered = await send('answered')
+    await vi.waitFor(async () => expect(await dispatchState(answered)).toBe('accepted'))
     claude.connections[0].handlers.onMessage?.({
       type: 'result',
       subtype: 'success',
@@ -206,25 +222,25 @@ describe('a chat left while its Claude CLI is still starting', () => {
       result: 'done'
     })
     await host.flushStreamedEvents(SESSION)
-    expect(host.journalSnapshot(SESSION).submissions).toHaveLength(1)
+    expect((await host.journalSnapshot(SESSION)).submissions).toHaveLength(1)
 
-    host.release(SESSION, SURFACE)
+    clock += IDLE_MS
 
     await vi.waitFor(() => expect(host.hasSession(SESSION)).toBe(false))
     expect(claude.connections[0].closeCount).toBe(1)
   })
 
-  it('is released after the grace when it owes nothing', async () => {
+  it('stops a start that stayed quiet for the whole window when it owes nothing', async () => {
     await attachStarting()
 
-    host.release(SESSION, SURFACE)
+    clock += IDLE_MS
 
     await vi.waitFor(() => expect(host.hasSession(SESSION)).toBe(false))
     expect(claude.connections[0].closeCount).toBe(1)
   })
 })
 
-describe('a chat left while its settled lead still has background work running', () => {
+describe('a chat whose settled lead still has background work running', () => {
   function frame(message: Record<string, unknown>): void {
     claude.connections[0].handlers.onMessage?.({ session_id: PROVIDER_SESSION_ID, ...message })
   }
@@ -232,8 +248,9 @@ describe('a chat left while its settled lead still has background work running',
   async function settleTurnLeavingTask(taskType: string): Promise<void> {
     await attachStarting()
     landInit()
-    await adapter.drainStartup(SESSION)
-    await send('fan out', 'accepted')
+    await adapter.awaitStarted(SESSION)
+    const fanOut = await send('fan out')
+    await vi.waitFor(async () => expect(await dispatchState(fanOut)).toBe('accepted'))
     frame({
       type: 'system',
       subtype: 'task_started',
@@ -253,11 +270,11 @@ describe('a chat left while its settled lead still has background work running',
     ['a subagent', 'local_agent'],
     ['a background command', 'local_bash'],
     ['a monitor', 'monitor']
-  ])('keeps the session while %s runs, then releases it once that settles', async (_, type) => {
+  ])('keeps the agent while %s runs, then stops it once that settles', async (_, type) => {
     await settleTurnLeavingTask(type)
 
-    host.release(SESSION, SURFACE)
-    await waitOutSeveralGraceWindows()
+    clock += IDLE_MS
+    await waitOutSeveralSweeps()
 
     expect(host.hasSession(SESSION)).toBe(true)
     expect(claude.connections[0].closeCount).toBe(0)
@@ -272,6 +289,7 @@ describe('a chat left while its settled lead still has background work running',
     // A finished background task can wake the lead; that turn is owed too until it settles.
     frame({ type: 'result', subtype: 'success', uuid: 'result-2', is_error: false, result: 'ok' })
     await host.flushStreamedEvents(SESSION)
+    clock += IDLE_MS
 
     await vi.waitFor(() => expect(host.hasSession(SESSION)).toBe(false))
     expect(claude.connections[0].closeCount).toBe(1)
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-owner-status.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-owner-status.ts
index 890b8f34feec..b9db10c1579f 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-owner-status.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-owner-status.ts
@@ -1,27 +1,25 @@
-import type { AgentSessionRecord } from '../../../shared/agent-session-record'
 import type { AgentSessionHandoffStatus } from '../../../shared/agent-session-wire'
+import type { StructuredAgentSessionHostDeps } from './structured-agent-session-host-types'
+import { adapterSupportsRecord } from './structured-agent-session-provider-support'
 
 /** The `agentSession.handoffStatus` answer. Released desktop clients gate worktree activation on
- *  `owner`, so the method outlives the terminal handoff it was named for. */
+ *  `owner`, so the method outlives the terminal handoff it was named for. It reports ownership, not
+ *  liveness: a chat whose agent is stopped, idle-released or still starting is owned all the same. */
 export function structuredAgentSessionOwnerStatus(
-  record: AgentSessionRecord
+  deps: Pick<StructuredAgentSessionHostDeps, 'store' | 'adapter'>,
+  sessionId: string
 ): AgentSessionHandoffStatus {
-  const { handoffStage: stage, handoffOperationId: operationId } = record.lease
-  if (stage === 'manual-recovery') {
-    return {
-      owner: 'none',
-      direction: 'to-native',
-      phase: 'failed',
-      stage,
-      operationId,
-      error: {
-        message: "Couldn't verify which runtime owns this session — manual recovery is required",
-        recoverableOwner: 'none'
-      }
-    }
+  const record = deps.store.getRecord(sessionId)
+  if (!record) {
+    throw new Error('agent_session_identity_required')
+  }
+  // Same refusal as reveal: a host that cannot run this chat vouches for no owner.
+  if (!adapterSupportsRecord(deps.adapter, record)) {
+    throw new Error('structured_agent_session_unsupported')
   }
+  const { handoffStage: stage, handoffOperationId: operationId } = record.lease
   return {
-    owner: record.lease.claimStatus === 'live' && record.lease.ownerProcess ? 'native' : 'none',
+    owner: 'native',
     direction: stage ? 'to-native' : null,
     phase: stage ? 'switching' : 'idle',
     stage,
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-pre-spawn-first-answer.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-pre-spawn-first-answer.test.ts
new file mode 100644
index 000000000000..89772d454690
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-pre-spawn-first-answer.test.ts
@@ -0,0 +1,185 @@
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { computeAgentSessionPayloadFingerprint } from '../../../shared/agent-session-mutation-envelope'
+import { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
+import { mapRuntimeError } from '../../runtime/rpc/errors'
+import {
+  AgentSessionPreSpawnError,
+  type AgentSessionPreSpawnReason,
+  type StructuredAgentSessionAdapter
+} from './structured-agent-session-adapter'
+import {
+  attachFingerprintFields,
+  type AgentSessionAttachParams
+} from './structured-agent-session-attach'
+import { openTestAttachConversation } from './structured-agent-session-attach-test-conversation'
+import { performAttach } from './structured-agent-session-attach-flow'
+
+const NOW = 1_800_000_000_000
+const SESSION = 'session-alpha'
+const OPERATION = `${NOW}-${'1'.padStart(32, '0')}`
+let root: string | null = null
+
+afterEach(async () => {
+  vi.restoreAllMocks()
+  if (root) {
+    await rm(root, { recursive: true, force: true })
+  }
+  root = null
+})
+
+function createParams(): AgentSessionAttachParams {
+  const params: AgentSessionAttachParams = {
+    envelope: {
+      sessionId: SESSION,
+      clientOperationId: OPERATION,
+      expectedRuntimeFence: null,
+      payloadFingerprint: ''
+    },
+    location: {
+      executionHostId: 'local',
+      wslDistro: null,
+      workspaceId: 'workspace-1',
+      workspaceKind: 'folder'
+    },
+    provider: 'claude',
+    agent: 'claude',
+    accountHome: { variable: 'CLAUDE_CONFIG_DIR', path: '/home/dev/.claude' },
+    runtimeKind: 'native'
+  }
+  return {
+    ...params,
+    envelope: {
+      ...params.envelope,
+      payloadFingerprint: computeAgentSessionPayloadFingerprint({
+        method: 'agentSession.attach',
+        sessionId: SESSION,
+        fields: attachFingerprintFields(params)
+      })
+    }
+  }
+}
+
+/** The thrown first answer as the wire sends it, and the ledger's replay of the same operation. */
+async function firstAnswerAndReplay(thrown: AgentSessionPreSpawnError) {
+  root = await mkdtemp(join(tmpdir(), 'orca-pre-spawn-first-answer-'))
+  const store = await AgentSessionRecordStore.open({
+    directory: join(root, 'store'),
+    hostId: 'local'
+  })
+  const unused = async (): Promise<never> => {
+    throw new Error('not reached before a spawn')
+  }
+  const adapter: StructuredAgentSessionAdapter = {
+    acquire: async () => {
+      throw thrown
+    },
+    dispatch: unused,
+    cancelTurn: unused,
+    answerPrompt: unused,
+    setOption: unused
+  }
+  const input = {
+    store,
+    adapter,
+    journalRoot: root,
+    openConversation: openTestAttachConversation(root),
+    authority: {
+      spawnToken: 'spawn-a',
+      claimKeyId: 'key-1',
+      handoffOperationId: OPERATION,
+      probe: { outcome: 'reservation-unused' as const }
+    },
+    callerKey: 'client-1',
+    params: createParams(),
+    now: () => NOW,
+    onAttached: () => {}
+  }
+  const first = await performAttach(input).then(
+    () => null,
+    (error: unknown) => error
+  )
+  expect(first).toBeInstanceOf(AgentSessionPreSpawnError)
+  return {
+    first: mapRuntimeError('req-1', { runtimeId: 'runtime-1' }, first),
+    replay: await performAttach(input)
+  }
+}
+
+describe('a create that fails before any process spawns', () => {
+  it.each<[string, string, AgentSessionPreSpawnReason | undefined, string]>([
+    [
+      'the managed account env override',
+      'This Claude launch defines explicit Anthropic auth environment variables.',
+      'managedAccountEnvOverride',
+      'This Claude launch sets its own Anthropic sign-in variables. Remove them to use a managed Claude account.'
+    ],
+    [
+      'an account switch in progress',
+      'A Claude account switch is in progress. Try again after it finishes.',
+      'accountSwitchInProgress',
+      'A Claude account switch is in progress. Try again after it finishes.'
+    ],
+    [
+      'a Claude account added in WSL',
+      'structured Claude is not offered under the active managed Claude account',
+      'managedAccountUnsupported',
+      'While a Claude account is added in WSL, Claude chats need a Windows Claude account. Choose or add one in Claude Accounts settings, then send your message again.'
+    ],
+    [
+      "Orca's own reason",
+      'claude sessions pin CLAUDE_CONFIG_DIR, not CODEX_HOME',
+      undefined,
+      "Claude couldn't start. Send your message to try again."
+    ]
+  ])('answers %s first in the words its replay reads', async (_, raw, reason, sentence) => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => undefined)
+
+    const { first, replay } = await firstAnswerAndReplay(
+      new AgentSessionPreSpawnError(new Error(raw), reason ? { reason } : {})
+    )
+
+    // Thrown as before: the wire code is unchanged, only the words are the replay's.
+    expect(first).toMatchObject({ ok: false, error: { code: 'runtime_error', message: sentence } })
+    expect(replay).toMatchObject({
+      ok: false,
+      refusal: {
+        code: 'agent_session_operation_invalid',
+        message: sentence,
+        ...(reason ? { details: { reason } } : {})
+      }
+    })
+    if (!reason) {
+      expect(replay).not.toHaveProperty('refusal.details')
+    }
+    if (raw !== sentence) {
+      expect(JSON.stringify([first, replay])).not.toContain(raw)
+    }
+    // What failed is kept for the log.
+    expect(warn).toHaveBeenCalledWith(
+      '[agent-session] provider start failed:',
+      expect.objectContaining({ message: raw })
+    )
+  })
+
+  it('keeps a message that is itself a code, and the wire code it maps to', async () => {
+    const { first } = await firstAnswerAndReplay(
+      new AgentSessionPreSpawnError(new Error('runtime_unavailable'))
+    )
+
+    expect(first).toMatchObject({
+      ok: false,
+      error: { code: 'runtime_unavailable', message: 'runtime_unavailable' }
+    })
+  })
+
+  it('keeps the situation of a pre-spawn error it wraps', () => {
+    const typed = new AgentSessionPreSpawnError(new Error('switching'), {
+      reason: 'accountSwitchInProgress'
+    })
+
+    expect(new AgentSessionPreSpawnError(typed).reason).toBe('accountSwitchInProgress')
+  })
+})
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-processless-reservation.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-processless-reservation.test.ts
index 0f115da5ebdc..348d5a3d90cb 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-processless-reservation.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-processless-reservation.test.ts
@@ -12,6 +12,7 @@ import {
   attachFingerprintFields,
   type AgentSessionAttachParams
 } from './structured-agent-session-attach'
+import { openTestAttachConversation } from './structured-agent-session-attach-test-conversation'
 import { performAttach } from './structured-agent-session-attach-flow'
 
 const NOW = 1_800_000_000_000
@@ -86,6 +87,7 @@ describe('processless structured session reservation', () => {
         store,
         adapter,
         journalRoot: root,
+        openConversation: openTestAttachConversation(root!),
         authority: {
           spawnToken: 'spawn-a',
           claimKeyId: 'key-1',
@@ -133,6 +135,7 @@ describe('processless structured session reservation', () => {
       store,
       adapter,
       journalRoot: root,
+      openConversation: openTestAttachConversation(root!),
       authority: {
         spawnToken: 'spawn-a',
         claimKeyId: 'key-1',
@@ -172,6 +175,7 @@ describe('processless structured session reservation', () => {
       store,
       adapter,
       journalRoot: root,
+      openConversation: openTestAttachConversation(root!),
       authority: {
         spawnToken: 'spawn-drift',
         claimKeyId: 'key-1',
@@ -194,7 +198,6 @@ describe('processless structured session reservation', () => {
       claimStatus: 'released',
       handoffStage: null,
       reservedSpawnToken: null,
-      processlessAt: null,
       runtimeFence: 2,
       deathEvidence: { kind: 'pid-absent', detail: 'reservation failed before spawn' }
     })
@@ -218,7 +221,6 @@ describe('processless structured session reservation', () => {
         throw new AgentSessionPreSpawnError(new Error('workspace no longer exists'))
       })
     } as unknown as StructuredAgentSessionAdapter
-    const processlessProof = vi.spyOn(store, 'setReservationProcesslessProof')
     const settlement = vi.spyOn(store, 'settleFailedAcquisition')
 
     await expect(
@@ -226,6 +228,7 @@ describe('processless structured session reservation', () => {
         store,
         adapter,
         journalRoot: root,
+        openConversation: openTestAttachConversation(root!),
         authority: {
           spawnToken: 'spawn-a',
           claimKeyId: 'key-1',
@@ -237,20 +240,15 @@ describe('processless structured session reservation', () => {
         now: () => NOW,
         onAttached: () => {}
       })
-    ).rejects.toThrow('workspace no longer exists')
+    ).rejects.toThrow("Codex couldn't restart. Send your message to try again.")
     expect(settlement).toHaveBeenCalledExactlyOnceWith(
       expect.objectContaining({ exitProof: 'processless', spawnToken: 'spawn-a' })
     )
-    // No separate durable proof write: the only proof call is acquisition's single-use clear.
-    expect(processlessProof).toHaveBeenCalledExactlyOnceWith(
-      expect.objectContaining({ processlessAt: null })
-    )
     expect(store.getRecord(SESSION)?.lease).toMatchObject({
       claimStatus: 'released',
       handoffStage: null,
       handoffOperationId: null,
       runtimeFence: 2,
-      processlessAt: null,
       reservedSpawnToken: null,
       deathEvidence: { kind: 'pid-absent', detail: 'reservation failed before spawn' }
     })
@@ -297,6 +295,7 @@ describe('processless structured session reservation', () => {
       store,
       adapter,
       journalRoot: root,
+      openConversation: openTestAttachConversation(root!),
       authority: {
         spawnToken: 'spawn-a',
         claimKeyId: 'key-1',
@@ -309,7 +308,9 @@ describe('processless structured session reservation', () => {
       onAttached: () => {}
     }
 
-    await expect(performAttach(input)).rejects.toThrow('launch not ready')
+    await expect(performAttach(input)).rejects.toThrow(
+      "Codex couldn't restart. Send your message to try again."
+    )
     await expect(performAttach(input)).resolves.toMatchObject({
       ok: false,
       refusal: { code: 'agent_session_operation_invalid' }
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-prompt-state.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-prompt-state.ts
index 7f71a9c28ce4..7324e3be9ec5 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-prompt-state.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-prompt-state.ts
@@ -2,7 +2,7 @@ import type {
   AgentJournalItemBody,
   AgentJournalRenderItem
 } from '../../../shared/agent-session-journal-types'
-import type { AgentSessionWireRefusal } from '../../../shared/agent-session-wire'
+import { refuse, type AgentSessionWireRefusal } from '../../../shared/agent-session-wire'
 import type { AgentSessionTurnContext } from './structured-agent-session-turns'
 
 type PendingPromptBody = Extract<AgentJournalItemBody, { kind: 'approval' | 'question' }>
@@ -11,8 +11,12 @@ export type PendingPromptValidation =
   | { ok: true; item: AgentJournalRenderItem; prompt: PendingPromptBody }
   | { ok: false; refusal: AgentSessionWireRefusal }
 
-function invalid(message: string): PendingPromptValidation {
-  return { ok: false, refusal: { code: 'agent_session_operation_invalid', message } }
+/** The prompt the client named is not one waiting on the user: nothing to answer. */
+function promptGone(message: string): PendingPromptValidation {
+  return {
+    ok: false,
+    refusal: refuse('agent_session_operation_invalid', { reason: 'promptGone' }, message)
+  }
 }
 
 export function validatePendingPrompt(
@@ -25,34 +29,36 @@ export function validatePendingPrompt(
 ): PendingPromptValidation {
   const item = ctx.journal.snapshot().items.find((entry) => entry.itemId === input.itemId)
   if (!item) {
-    return invalid(`No item ${input.itemId} in session ${ctx.sessionId}.`)
+    return promptGone(`No item ${input.itemId} in session ${ctx.sessionId}.`)
   }
   const prompt = item.body.kind === 'approval' || item.body.kind === 'question' ? item.body : null
   if (!prompt || (input.kind !== undefined && prompt.kind !== input.kind)) {
-    return invalid(
+    return promptGone(
       `Item ${input.itemId} is not a pending${input.kind ? ` ${input.kind}` : ' prompt'}.`
     )
   }
   if (item.revision !== input.expectedRevision) {
     return {
       ok: false,
-      refusal: {
-        code: 'agent_session_item_revision_stale',
-        message: `Item ${input.itemId} has moved on.`,
-        currentRevision: item.revision,
-        resolution: prompt.resolution
-      }
+      refusal: refuse(
+        'agent_session_item_revision_stale',
+        { reason: 'promptMoved', currentRevision: item.revision, resolution: prompt.resolution },
+        `Item ${input.itemId} has moved on.`
+      )
     }
   }
   if (prompt.resolution.state !== 'pending') {
     return {
       ok: false,
-      refusal: {
-        code: 'agent_session_already_resolved',
-        message: `Item ${input.itemId} was already ${prompt.resolution.state}.`,
-        currentRevision: item.revision,
-        resolution: prompt.resolution
-      }
+      refusal: refuse(
+        'agent_session_already_resolved',
+        {
+          reason: 'promptAlreadyResolved',
+          currentRevision: item.revision,
+          resolution: prompt.resolution
+        },
+        `Item ${input.itemId} was already ${prompt.resolution.state}.`
+      )
     }
   }
   return { ok: true, item, prompt }
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-provider-child-record.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-provider-child-record.test.ts
new file mode 100644
index 000000000000..fb66a1e1a8fd
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-provider-child-record.test.ts
@@ -0,0 +1,742 @@
+// The provider child is its own record on the conversation: stopping it, losing it or failing to
+// start it ends the child, never the conversation. Against the real host, store and journal, with a
+// live subscriber opened before each action.
+
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi, type Mock } from 'vitest'
+import { computeAgentSessionPayloadFingerprint } from '../../../shared/agent-session-mutation-envelope'
+import type { AgentJournalSubmission } from '../../../shared/agent-session-journal-types'
+import type {
+  AgentSessionStatusSummary,
+  AgentSessionSubscribeEvent
+} from '../../../shared/agent-session-wire'
+import { DISPATCH_REJECTED_CANCELLED } from '../../../shared/structured-agent-session-dispatch-rejection'
+import {
+  agentSessionFailureFact,
+  type AgentSessionFailureFact,
+  type SubmissionRejectionFact
+} from '../../../shared/agent-session-failure'
+import { agentSessionFailureWords } from '../../../shared/agent-session-failure-words'
+import { readAgentJournalTurn } from '../../../shared/agent-session-turn-record'
+import { openAgentSessionJournal } from '../agent-session-journal/journal-store-factory'
+import { journalDirectoryFor } from '../agent-session-journal/journal-paths'
+import { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
+import type { StructuredAgentSessionAdapter } from './structured-agent-session-adapter'
+import { ensureStructuredAgentSessionAgent } from './structured-agent-session-agent-start'
+import { StructuredAgentSessionHost } from './structured-agent-session-host'
+import { stopStructuredAgentSessionAgentUnderSerialize } from './structured-agent-session-host-lifetime'
+import {
+  HOST_TEST_LOCATION,
+  HOST_TEST_NOW as NOW,
+  HOST_TEST_SESSION as SESSION,
+  HOST_TEST_THREAD as THREAD,
+  hostTestAttachParams,
+  hostTestMessage,
+  hostTestOperationId,
+  resetHostTestOperationIds
+} from './structured-agent-session-host-test-data'
+
+const CALLER = { callerKey: 'client-1' }
+
+let root: string
+let store: AgentSessionRecordStore
+let host: StructuredAgentSessionHost
+let acquire: Mock<StructuredAgentSessionAdapter['acquire']>
+let dispatch: Mock<StructuredAgentSessionAdapter['dispatch']>
+let adapterExtras: Partial<StructuredAgentSessionAdapter>
+
+function eventually(assertion: () => void | Promise<void>): Promise<void> {
+  return vi.waitFor(assertion, { timeout: 10_000 })
+}
+
+function generation(): string {
+  return `generation-${acquire.mock.calls.length}`
+}
+
+const spawnChild: StructuredAgentSessionAdapter['acquire'] = async ({ fence, spawnToken }) => ({
+  process: { hostId: 'local', pid: 4242, processStartTimeMs: 1_700_000_000_000, spawnToken },
+  acquisitionGeneration: generation(),
+  link: {
+    linkId: `link-${fence}`,
+    handle: { provider: 'codex' as const, threadId: THREAD },
+    origin: store.getRecord(SESSION)?.providerHandleChain.length
+      ? ('resumed' as const)
+      : ('created' as const),
+    mintedAtFence: fence,
+    observedAt: NOW
+  }
+})
+
+/** A Claude-shaped child: published at spawn, so it is `starting` until `started`. */
+const spawnStartingChild: StructuredAgentSessionAdapter['acquire'] = async (input) => ({
+  ...(await spawnChild(input)),
+  providerChildPhase: 'starting' as const
+})
+
+function startHost(): void {
+  host = new StructuredAgentSessionHost({
+    store,
+    adapter: {
+      acquire,
+      dispatch,
+      closeSession: vi.fn(async () => true),
+      releaseAcquisition: vi.fn(async () => true),
+      cancelTurn: vi.fn(async () => ({ cancelled: false })),
+      answerPrompt: vi.fn(async () => undefined),
+      setOption: vi.fn(async () => undefined),
+      ...adapterExtras
+    },
+    journalRoot: root,
+    claimKeyId: 'key-1',
+    mintSpawnToken: () => `spawn-${acquire.mock.calls.length}`,
+    now: () => NOW
+  })
+}
+
+async function restartHost(): Promise<void> {
+  await host.flushAllStreamedEvents()
+  startHost()
+}
+
+beforeEach(async () => {
+  root = await mkdtemp(join(tmpdir(), 'orca-child-record-'))
+  resetHostTestOperationIds()
+  adapterExtras = {}
+  acquire = vi.fn(spawnChild)
+  dispatch = vi.fn(async (input) => ({
+    state: 'accepted' as const,
+    providerIdentity: {
+      provider: 'codex' as const,
+      threadId: THREAD,
+      turnId: `turn-${input.clientMessageId}`,
+      ordinal: dispatch.mock.calls.length
+    }
+  }))
+  store = await AgentSessionRecordStore.open({ directory: join(root, 'store'), hostId: 'local' })
+  startHost()
+  expect(await host.attach(CALLER, hostTestAttachParams(null))).toMatchObject({ ok: true })
+  await host.close(SESSION)
+})
+
+afterEach(async () => {
+  await host.flushAllStreamedEvents()
+  await rm(root, { recursive: true, force: true })
+})
+
+function sendParams(text: string) {
+  const body = hostTestMessage(text)
+  return {
+    envelope: {
+      sessionId: SESSION,
+      clientOperationId: hostTestOperationId(),
+      expectedRuntimeFence: 1,
+      payloadFingerprint: computeAgentSessionPayloadFingerprint({
+        method: 'agentSession.send',
+        sessionId: SESSION,
+        fields: { body }
+      })
+    },
+    body
+  }
+}
+
+async function accept(text: string): Promise<string> {
+  const params = sendParams(text)
+  const sent = await host.send(CALLER, params)
+  expect(sent).toMatchObject({ ok: true, value: { submission: { dispatchState: 'pending' } } })
+  return params.envelope.clientOperationId
+}
+
+function stop() {
+  const turnId = 'turn-none'
+  return host.cancel(CALLER, {
+    envelope: {
+      sessionId: SESSION,
+      clientOperationId: hostTestOperationId(),
+      expectedRuntimeFence: null,
+      payloadFingerprint: computeAgentSessionPayloadFingerprint({
+        method: 'agentSession.cancel',
+        sessionId: SESSION,
+        fields: { turnId }
+      })
+    },
+    turnId
+  })
+}
+
+async function submission(id: string): Promise<AgentJournalSubmission | undefined> {
+  return (await host.journalSnapshot(SESSION)).submissions.find(
+    (entry) => entry.clientMessageId === id
+  )
+}
+
+async function statusRows(): Promise<
+  {
+    itemId: string
+    text: string
+    tone?: string
+    failure?: AgentSessionFailureFact
+  }[]
+> {
+  return (await host.journalSnapshot(SESSION)).items.flatMap((item) =>
+    item.body.kind === 'status'
+      ? [
+          {
+            itemId: item.itemId,
+            text: item.body.text,
+            ...(item.body.tone ? { tone: item.body.tone } : {}),
+            ...(item.body.failure ? { failure: item.body.failure } : {})
+          }
+        ]
+      : []
+  )
+}
+
+/** The child the conversation has now, as its lifecycle events name it. */
+function currentChild() {
+  const child = conversation()?.child
+  if (!child?.generation) {
+    throw new Error('no child indexed')
+  }
+  return { sessionId: SESSION, fence: child.fence, acquisitionGeneration: child.generation }
+}
+
+function exit(child: ReturnType<typeof currentChild>, reason: string, startupUnproven?: true) {
+  return host.handleAdapterEvent({
+    type: 'ended',
+    ...child,
+    reason,
+    // As an adapter reports it: the exit's stderr as a log detail.
+    failure: { kind: 'providerExited', detail: { text: reason, audience: 'log' } },
+    cause: 'unexpected-exit',
+    ...(startupUnproven ? { startupUnproven } : {})
+  })
+}
+
+function rejectedIn(events: AgentSessionSubscribeEvent[], id: string): boolean {
+  return events.some(
+    (event) =>
+      event.type === 'batch' &&
+      event.batch.submissions.some(
+        (entry) => entry.clientMessageId === id && entry.dispatchState === 'rejected'
+      )
+  )
+}
+
+function conversation() {
+  return host['sessions'].get(SESSION)
+}
+
+async function subscribe(): Promise<AgentSessionSubscribeEvent[]> {
+  const events: AgentSessionSubscribeEvent[] = []
+  await host.subscribe({
+    id: 'sub-1',
+    sessionId: SESSION,
+    emit: (event) => events.push(structuredClone(event))
+  })
+  return events
+}
+
+/** The chat's status row as a session list sees it, frame by frame. */
+function watchStatus(): AgentSessionStatusSummary[] {
+  const frames: AgentSessionStatusSummary[] = []
+  host.subscribeStatus({
+    id: 'list-1',
+    emit: (event) => {
+      if (event.type === 'status' && event.session.sessionId === SESSION) {
+        frames.push(event.session)
+      }
+    }
+  })
+  return frames
+}
+
+function deferred<T>() {
+  let resolve!: (value: T) => void
+  const promise = new Promise<T>((next) => {
+    resolve = next
+  })
+  return { promise, resolve }
+}
+
+describe('Stop on a child still proving its start', () => {
+  it('ends the child and keeps the conversation and its readers (R1)', async () => {
+    const ended = deferred<void>()
+    adapterExtras = {
+      awaitStarted: vi.fn(() => ended.promise),
+      closeSession: vi.fn(async () => {
+        ended.resolve()
+        return true
+      })
+    }
+    await restartHost()
+    acquire.mockImplementationOnce(spawnStartingChild)
+    const first = await accept('hello')
+    const journal = conversation()?.journal
+    const events = await subscribe()
+    const frames = watchStatus()
+    await eventually(() => expect(conversation()?.child?.phase).toBe('starting'))
+
+    expect(await stop()).toMatchObject({ ok: true, value: { cancelled: true } })
+
+    // The same conversation: no reopen, and the chat told it is idle again.
+    expect(conversation()?.journal).toBe(journal)
+    expect(conversation()?.child).toBeNull()
+    expect(conversation()?.lastEndedChild).toMatchObject({ cause: 'user-stop', rootGone: true })
+    expect(frames.at(-1)).not.toHaveProperty('hostExecutionPhase')
+    expect(frames.at(-1)).not.toHaveProperty('hostExecutionOwned')
+    expect(await submission(first)).toMatchObject({
+      dispatchState: 'rejected',
+      reason: DISPATCH_REJECTED_CANCELLED
+    })
+    // A Stop is not a failure: no row, and the loop is gone.
+    expect(await statusRows()).toEqual([])
+    await eventually(() => expect(host['conversationDelivery'].loop.isRunning(SESSION)).toBe(false))
+
+    const next = await accept('after stop')
+    await eventually(async () => expect((await submission(next))?.dispatchState).toBe('accepted'))
+    expect(conversation()?.journal).toBe(journal)
+    expect(dispatch.mock.calls.map(([input]) => input.clientMessageId)).toEqual([next])
+    // The reader opened before the Stop saw the next message delivered on the same stream.
+    expect(
+      events.some(
+        (event) =>
+          event.type === 'batch' &&
+          event.batch.submissions.some(
+            (entry) => entry.clientMessageId === next && entry.dispatchState === 'accepted'
+          )
+      )
+    ).toBe(true)
+  })
+})
+
+describe('settling an earlier child before the next one takes its message', () => {
+  it("settles the earlier child's turn from its death evidence and leaves the queued message to the new child (R1)", async () => {
+    // The earlier child exited mid-turn; the released lease keeps only its death evidence.
+    await store.transitionHandoff(SESSION, (record) => ({
+      ...record,
+      lease: {
+        ...record.lease,
+        deathEvidence: { kind: 'exit-observed', detail: 'provider exited', observedAt: NOW - 1_000 }
+      }
+    }))
+    const releasedFence = store.getRecord(SESSION)!.lease.runtimeFence
+    const journal = await openAgentSessionJournal({
+      identity: {
+        sessionId: SESSION,
+        workspaceId: HOST_TEST_LOCATION.workspaceId,
+        hostId: HOST_TEST_LOCATION.executionHostId,
+        agent: 'codex',
+        providerHandle: { kind: 'codex', threadId: THREAD }
+      },
+      journalDir: journalDirectoryFor(root, {
+        workspaceId: HOST_TEST_LOCATION.workspaceId,
+        sessionId: SESSION
+      })
+    })
+    await journal.appendItem(
+      { provider: 'codex', threadId: THREAD, turnId: 'earlier-turn', ordinal: 0 },
+      { kind: 'turn', turnId: 'earlier-turn', state: 'running', startedAt: NOW - 5_000 },
+      { fence: releasedFence }
+    )
+    await journal.close()
+    const id = await accept('for the next child')
+
+    await eventually(async () => expect((await submission(id))?.dispatchState).toBe('accepted'))
+    // The exit was observed, so its receipt ends the turn, and the chat says why it stopped.
+    const items = conversation()!.journal.snapshot().items
+    expect(items.map((item) => readAgentJournalTurn(item.body)).filter(Boolean)).toContainEqual(
+      expect.objectContaining({
+        turnId: 'earlier-turn',
+        state: 'interrupted',
+        completedAt: NOW - 1_000
+      })
+    )
+    expect(
+      items.flatMap((item) => (item.body.kind === 'status' ? [item.body.text] : []))
+    ).toContain(
+      'Codex stopped while this response was in progress. You can continue in this conversation.'
+    )
+    // Handed over at the new child's fence, which the attach reserved after settling.
+    const newFence = store.getRecord(SESSION)!.lease.runtimeFence
+    expect(newFence).toBeGreaterThan(releasedFence)
+    expect((await submission(id))?.fence).toBe(newFence)
+    expect(conversation()?.child).toMatchObject({ generation: generation(), fence: newFence })
+  })
+})
+
+const START_EXIT = 'claude stream-json exited (code 1)'
+const START_TEXT = 'Codex stopped before it finished starting. Send your message to try again.'
+const START_FAILURE: SubmissionRejectionFact = {
+  kind: 'providerStartFailed',
+  detail: { text: START_EXIT, audience: 'log' }
+}
+
+describe('a published child that dies while it proves its start', () => {
+  const EXIT = START_EXIT
+  const TEXT = START_TEXT
+
+  it.each([['the loop sees the start fail first'], ['the exit is processed first']])(
+    'leaves one error row keyed by the start, and every queued message rejected with it: %s (R2)',
+    async (order) => {
+      const settled = deferred<SubmissionRejectionFact>()
+      adapterExtras = { awaitStarted: vi.fn(() => settled.promise) }
+      await restartHost()
+      acquire.mockImplementation(spawnStartingChild)
+      const first = await accept('first')
+      const events = await subscribe()
+      const second = await accept('second')
+      await eventually(() => expect(adapterExtras.awaitStarted).toHaveBeenCalled())
+      const child = currentChild()
+
+      if (order === 'the exit is processed first') {
+        await exit(child, EXIT, true)
+        settled.resolve(START_FAILURE)
+      } else {
+        settled.resolve(START_FAILURE)
+        await eventually(async () =>
+          expect((await submission(second))?.dispatchState).toBe('rejected')
+        )
+        await exit(child, EXIT, true)
+      }
+
+      await eventually(async () =>
+        expect((await submission(second))?.dispatchState).toBe('rejected')
+      )
+      expect(await statusRows()).toEqual([
+        {
+          itemId: `orca:${encodeURIComponent(`start-failure:${child.acquisitionGeneration}`)}`,
+          text: TEXT,
+          tone: 'error',
+          failure: START_FAILURE
+        }
+      ])
+      for (const id of [first, second]) {
+        expect(await submission(id)).toMatchObject({
+          dispatchState: 'rejected',
+          reason: TEXT,
+          rejection: START_FAILURE
+        })
+      }
+      expect(rejectedIn(events, second)).toBe(true)
+      expect(dispatch).not.toHaveBeenCalled()
+      expect(acquire).toHaveBeenCalledTimes(2)
+    }
+  )
+})
+
+/** A start by an operation that needs the agent, such as a goal change, outside the loop. */
+function startForOperation() {
+  return host['serialize'](SESSION, () =>
+    ensureStructuredAgentSessionAgent(host['attachContext'](), SESSION)
+  )
+}
+
+describe('a start another operation made that dies while a sent message waits on it', () => {
+  const EXIT = START_EXIT
+  const TEXT = START_TEXT
+
+  it("is the message's own failed start: one error row, the message rejected, no second start (R2)", async () => {
+    adapterExtras = { awaitStarted: vi.fn(async () => START_FAILURE) }
+    await restartHost()
+    acquire.mockImplementation(spawnStartingChild)
+    // An operation that needs the agent starts a child that has not proven its start.
+    await startForOperation()
+    const operationChild = currentChild()
+    const events = await subscribe()
+    const params = sendParams('hello')
+
+    // Accepted first; that child's exit is settled before the loop's first step.
+    const sent = host.send(CALLER, params)
+    const exited = exit(operationChild, EXIT, true)
+    expect(await sent).toMatchObject({
+      ok: true,
+      value: { submission: { dispatchState: 'pending' } }
+    })
+    await exited
+    const id = params.envelope.clientOperationId
+
+    await eventually(async () => expect((await submission(id))?.dispatchState).toBe('rejected'))
+    await settleLoop()
+    expect((await submission(id))?.reason).toBe(TEXT)
+    expect(await statusRows()).toEqual([
+      {
+        itemId: `orca:${encodeURIComponent(`start-failure:${operationChild.acquisitionGeneration}`)}`,
+        text: TEXT,
+        tone: 'error',
+        failure: START_FAILURE
+      }
+    ])
+    expect(rejectedIn(events, id)).toBe(true)
+    // The setup's child and the operation's: nothing started again into the same failure.
+    expect(acquire).toHaveBeenCalledTimes(2)
+    expect(dispatch).not.toHaveBeenCalled()
+  })
+
+  it('leaves a message sent after that start failed to a fresh start (R2)', async () => {
+    await restartHost()
+    acquire.mockImplementationOnce(spawnStartingChild)
+    await startForOperation()
+    await exit(currentChild(), EXIT, true)
+    expect(await statusRows()).toHaveLength(1)
+
+    const id = await accept('after the failure')
+
+    await eventually(async () => expect((await submission(id))?.dispatchState).toBe('accepted'))
+    expect(acquire).toHaveBeenCalledTimes(3)
+  })
+
+  it('starts again for a message whose proven child crashed: only a failed start settles it (R2)', async () => {
+    await restartHost()
+    await startForOperation()
+    const params = sendParams('hello')
+
+    const sent = host.send(CALLER, params)
+    const exited = exit(currentChild(), 'codex app-server crashed')
+    await sent
+    await exited
+    const id = params.envelope.clientOperationId
+
+    await eventually(async () => expect((await submission(id))?.dispatchState).not.toBe('pending'))
+    expect((await submission(id))?.dispatchState).toBe('accepted')
+    expect(acquire).toHaveBeenCalledTimes(3)
+  })
+
+  it('waits on a child started since the failed one, not on the failure (R2)', async () => {
+    adapterExtras = { awaitStarted: vi.fn(async () => undefined) }
+    await restartHost()
+    acquire.mockImplementation(spawnStartingChild)
+    await startForOperation()
+    const params = sendParams('hello')
+
+    // A second operation's start lands after the first child's exit, before the loop's first step.
+    const sent = host.send(CALLER, params)
+    const exited = exit(currentChild(), EXIT, true)
+    const held = startForOperation()
+    await sent
+    await exited
+    await held
+    const id = params.envelope.clientOperationId
+
+    await eventually(async () => expect((await submission(id))?.dispatchState).not.toBe('pending'))
+    expect((await submission(id))?.dispatchState).toBe('accepted')
+    expect(acquire).toHaveBeenCalledTimes(3)
+  })
+})
+
+describe('a child that ends before its message is handed over', () => {
+  it('starts one child for the message, then rejects it and stops (R2)', async () => {
+    // The child the loop starts exits between its start step and its handover step.
+    adapterExtras = {
+      awaitStarted: vi.fn(async () => {
+        await exit(currentChild(), 'codex app-server crashed')
+      })
+    }
+    await restartHost()
+    const id = await accept('hello')
+    const events = await subscribe()
+
+    await eventually(async () => expect((await submission(id))?.dispatchState).toBe('rejected'))
+    // The exit's stderr rides beside the sentence, never in it.
+    const failure = {
+      kind: 'providerExited',
+      detail: { text: 'codex app-server crashed', audience: 'log' }
+    }
+    expect(await submission(id)).toMatchObject({
+      reason: 'Codex stopped before this message was sent.',
+      rejection: failure
+    })
+    expect(await statusRows()).toEqual([
+      { itemId: expect.any(String), text: (await submission(id))?.reason, tone: 'error', failure }
+    ])
+    expect(rejectedIn(events, id)).toBe(true)
+    await eventually(() => expect(host['conversationDelivery'].loop.isRunning(SESSION)).toBe(false))
+    expect(acquire).toHaveBeenCalledTimes(2)
+    expect(dispatch).not.toHaveBeenCalled()
+  })
+})
+
+describe('another child indexed while the loop waits on the one it started', () => {
+  it('hands nothing over until the child now there has proven its start (R2)', async () => {
+    const starts = new Map<string, ReturnType<typeof deferred<void>>>()
+    const startOf = (generation: string) => {
+      const start = starts.get(generation) ?? deferred<void>()
+      starts.set(generation, start)
+      return start
+    }
+    adapterExtras = {
+      awaitStarted: vi.fn(() => startOf(currentChild().acquisitionGeneration).promise),
+      // The stop ends the child without settling the start the loop is waiting on.
+      closeSession: vi.fn(async () => true)
+    }
+    await restartHost()
+    acquire.mockImplementation(spawnStartingChild)
+    const first = await accept('first')
+    await eventually(() => expect(adapterExtras.awaitStarted).toHaveBeenCalledTimes(1))
+    const stopped = currentChild()
+    expect(await stop()).toMatchObject({ ok: true })
+    const second = await accept('second')
+    // An operation that needs the agent starts its own child before the loop's handover step runs.
+    await host['serialize'](SESSION, () =>
+      ensureStructuredAgentSessionAgent(host['attachContext'](), SESSION)
+    )
+    const replacement = currentChild()
+    expect(replacement.acquisitionGeneration).not.toBe(stopped.acquisitionGeneration)
+
+    startOf(stopped.acquisitionGeneration).resolve()
+    await eventually(() => expect(adapterExtras.awaitStarted).toHaveBeenCalledTimes(2))
+    expect(dispatch).not.toHaveBeenCalled()
+
+    await host.handleAdapterEvent({
+      type: 'started',
+      ...replacement,
+      reportedOptions: { model: 'sonnet' },
+      restoreSkippedOptions: []
+    })
+    startOf(replacement.acquisitionGeneration).resolve()
+
+    await eventually(async () => expect((await submission(second))?.dispatchState).toBe('accepted'))
+    expect(dispatch.mock.calls.map(([input]) => input.clientMessageId)).toEqual([second])
+    expect(await submission(first)).toMatchObject({ reason: DISPATCH_REJECTED_CANCELLED })
+  })
+})
+
+describe('a quit with a message still queued', () => {
+  /** Read by the next launch, through the same open any reader takes. */
+  async function afterRelaunch(id: string): Promise<AgentJournalSubmission | undefined> {
+    startHost()
+    await host.revealSession(SESSION)
+    return await submission(id)
+  }
+
+  it('settles a message no child ever had the way a chat close does (R2)', async () => {
+    // Quit has begun — its first step stops the delivery loops — when this message is accepted.
+    host['conversationDelivery'].loop.dispose()
+    const id = await accept('hello')
+    expect(conversation()?.child).toBeNull()
+    await host.flushAllStreamedEvents()
+
+    expect(await afterRelaunch(id)).toMatchObject({
+      dispatchState: 'rejected',
+      ...agentSessionFailureWords(agentSessionFailureFact('chatClosed'), { surface: 'rejection' })
+    })
+  })
+
+  it('waits for the start already in flight and stops the child it produced (R2)', async () => {
+    const starting = deferred<void>()
+    const closeSession = vi.fn(async () => true)
+    adapterExtras = { closeSession }
+    await restartHost()
+    // The loop's start step is under way, but has not reached its attach yet.
+    const resolveRecovery = host['runtimeState'].resolveRecovery.bind(host['runtimeState'])
+    const recovering = vi.spyOn(host['runtimeState'], 'resolveRecovery')
+    recovering.mockImplementationOnce(async (sessionId) => {
+      await starting.promise
+      return resolveRecovery(sessionId)
+    })
+    const id = await accept('hello')
+    await eventually(() => expect(recovering).toHaveBeenCalled())
+
+    const quit = host.flushAllStreamedEvents()
+    starting.resolve()
+    await quit
+
+    expect(closeSession).toHaveBeenCalledWith(SESSION)
+    expect(store.getRecord(SESSION)?.lease).toMatchObject({ claimStatus: 'released' })
+    expect(dispatch).not.toHaveBeenCalled()
+    expect(await afterRelaunch(id)).toMatchObject({
+      dispatchState: 'rejected',
+      ...agentSessionFailureWords(agentSessionFailureFact('chatClosed'), { surface: 'rejection' })
+    })
+  })
+})
+
+describe('a send whose start failed, sent again with the same operation id', () => {
+  it('replays the recorded rejection and starts no second agent (R2)', async () => {
+    acquire.mockRejectedValueOnce(new Error('spawn claude ENOENT'))
+    const fenceBefore = store.getRecord(SESSION)!.lease.runtimeFence
+    const params = sendParams('hello')
+    // A failed start is a rejected message, never a refused send.
+    expect(await host.send(CALLER, params)).toMatchObject({
+      ok: true,
+      value: { submission: { dispatchState: 'pending' } }
+    })
+    const id = params.envelope.clientOperationId
+    await eventually(async () => expect((await submission(id))?.dispatchState).toBe('rejected'))
+    // The start moved the fence while the message was out.
+    expect(store.getRecord(SESSION)!.lease.runtimeFence).toBeGreaterThan(fenceBefore)
+    const starts = acquire.mock.calls.length
+
+    const replay = await host.send(CALLER, params)
+
+    expect(replay).toMatchObject({
+      ok: true,
+      replayed: true,
+      value: { submission: { clientMessageId: id, dispatchState: 'rejected' } }
+    })
+    await settleLoop()
+    expect(acquire).toHaveBeenCalledTimes(starts)
+    expect(dispatch).not.toHaveBeenCalled()
+  })
+})
+
+async function settleLoop(): Promise<void> {
+  await eventually(() => expect(host['conversationDelivery'].loop.isRunning(SESSION)).toBe(false))
+}
+
+describe('how a stopped child ends the start its loop was waiting on', () => {
+  /** A child the loop waits on, whose start the stop below does not settle, so a message sent
+   *  after the stop is queued when the loop next looks. */
+  async function stoppedWhileStarting(stop: () => Promise<void>) {
+    const start = deferred<void>()
+    adapterExtras = {
+      awaitStarted: vi.fn(() => start.promise),
+      closeSession: vi.fn(async () => true)
+    }
+    await restartHost()
+    acquire.mockImplementationOnce(spawnStartingChild)
+    await accept('first')
+    await eventually(() => expect(adapterExtras.awaitStarted).toHaveBeenCalledTimes(1))
+    await stop()
+    const second = await accept('second')
+    adapterExtras.awaitStarted = undefined
+    start.resolve()
+    return second
+  }
+
+  it("goes on after a user's Stop and delivers what was sent since (R2)", async () => {
+    const second = await stoppedWhileStarting(async () => {
+      expect(await stop()).toMatchObject({ ok: true })
+    })
+
+    await eventually(async () => expect((await submission(second))?.dispatchState).toBe('accepted'))
+    expect(conversation()?.lastEndedChild).toMatchObject({ cause: 'user-stop', reason: null })
+    expect(await statusRows()).toEqual([])
+  })
+
+  it("fails the start after a host stop, as a start Orca stopped rather than the provider's (R2)", async () => {
+    const reason = 'the start watchdog fired'
+    const second = await stoppedWhileStarting(() =>
+      host['serialize'](SESSION, () =>
+        stopStructuredAgentSessionAgentUnderSerialize(host['lifetimeContext'](), SESSION, {
+          cause: 'host-stop',
+          reason
+        })
+      )
+    )
+
+    await eventually(async () => expect((await submission(second))?.dispatchState).toBe('rejected'))
+    // The sentence is the constructor's, not the reason the stop was given.
+    const text = 'Codex never finished starting, so Orca stopped it.'
+    expect(await submission(second)).toMatchObject({
+      reason: text,
+      rejection: { kind: 'hostStopped' }
+    })
+    expect(await statusRows()).toEqual([
+      { itemId: expect.any(String), text, tone: 'error', failure: { kind: 'hostStopped' } }
+    ])
+    expect(dispatch).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-provider-child.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-provider-child.ts
new file mode 100644
index 000000000000..da5e491e1d18
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-provider-child.ts
@@ -0,0 +1,83 @@
+// The provider child behind a conversation, kept as its own record on the conversation's entry.
+//
+// The entry is the conversation and outlives any number of children. A child enters only when an
+// attach has fully succeeded, and leaves only through `endProviderChild`, which every ending shares:
+// an exit, a failed re-attach, a Stop and an eviction. Each is matched on the child's generation
+// and fence, so an ending that arrives late for an older child cannot end a newer one.
+
+import type { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
+import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
+import type {
+  StructuredAgentSessionEndedChild,
+  StructuredAgentSessionHostSession,
+  StructuredAgentSessionProviderChild,
+  StructuredAgentSessionProviderChildIdentity
+} from './structured-agent-session-host-types'
+
+type ChildBearer = Pick<StructuredAgentSessionHostSession, 'child' | 'lastEndedChild'> & {
+  journal: Pick<AgentSessionJournal, 'cursor'>
+}
+
+/** The fence a conversation write carries: the record's, which is where the next child starts. A
+ *  child's own writes carry `child.fence`, which equals it while that child holds the lease. */
+export function structuredAgentSessionConversationFence(
+  store: Pick<AgentSessionRecordStore, 'getRecord'>,
+  sessionId: string
+): number {
+  return store.getRecord(sessionId)?.lease.runtimeFence ?? 0
+}
+
+/** For the end of a successful attach only: a failed one never wrote a child to take back. */
+export function indexProviderChild(
+  session: ChildBearer,
+  child: StructuredAgentSessionProviderChild
+): void {
+  session.child = child
+}
+
+export function markProviderChildStarted(
+  session: ChildBearer,
+  identity: StructuredAgentSessionProviderChildIdentity
+): boolean {
+  const child = matchingChild(session, identity)
+  if (child) {
+    child.phase = 'ready'
+  }
+  return child !== null
+}
+
+export function endProviderChild(
+  session: ChildBearer,
+  ended: Omit<StructuredAgentSessionEndedChild, 'endedAt' | 'startedFor'>
+): boolean {
+  const child = matchingChild(session, ended)
+  if (!child) {
+    return false
+  }
+  session.child = null
+  session.lastEndedChild = {
+    ...ended,
+    ...(child.startedFor === undefined ? {} : { startedFor: child.startedFor }),
+    endedAt: session.journal.cursor()
+  }
+  return true
+}
+
+/** The conversation's last start died before it proved itself, and nothing started since. Only a
+ *  send retries it: a view or an exit recovery would respawn into the same failure, adding a row. */
+export function failedProviderChildStart(
+  session: Pick<ChildBearer, 'child' | 'lastEndedChild'>
+): StructuredAgentSessionEndedChild | null {
+  const ended = session.lastEndedChild
+  return !session.child && ended?.duringStartup && ended.cause !== 'user-stop' ? ended : null
+}
+
+function matchingChild(
+  session: ChildBearer,
+  identity: StructuredAgentSessionProviderChildIdentity
+): StructuredAgentSessionProviderChild | null {
+  const { child } = session
+  return child && child.generation === identity.generation && child.fence === identity.fence
+    ? child
+    : null
+}
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-provider-restore.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-provider-restore.test.ts
index c8a2e4bba14f..5da0861aa197 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-provider-restore.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-provider-restore.test.ts
@@ -5,12 +5,15 @@ import { afterEach, describe, expect, it } from 'vitest'
 import { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
 import type { StructuredAgentSessionAdapter } from './structured-agent-session-adapter'
 import { StructuredAgentSessionHost } from './structured-agent-session-host'
+import { abandonStructuredAgentSessionHost } from './structured-agent-session-host-test-abandon'
 import {
   HOST_TEST_NOW,
   HOST_TEST_SESSION,
   hostTestAttachParams,
   resetHostTestOperationIds
 } from './structured-agent-session-host-test-data'
+import { agentSessionFailureFact } from '../../../shared/agent-session-failure'
+import { agentSessionFailureWords } from '../../../shared/agent-session-failure-words'
 
 const CLAUDE_SESSION = 'claude-session'
 const hosts: StructuredAgentSessionHost[] = []
@@ -34,7 +37,12 @@ function claudeAdapter(): StructuredAgentSessionAdapter {
         observedAt: HOST_TEST_NOW
       }
     }),
-    dispatch: async () => ({ state: 'rejected', reason: 'unused' }),
+    dispatch: async () => ({
+      state: 'rejected',
+      ...agentSessionFailureWords(agentSessionFailureFact('providerRejected'), {
+        surface: 'rejection'
+      })
+    }),
     cancelTurn: async () => ({ cancelled: false }),
     answerPrompt: async () => undefined,
     setOption: async () => undefined
@@ -58,15 +66,8 @@ function createHost(
   return host
 }
 
-async function abandonHost(host: StructuredAgentSessionHost): Promise<void> {
-  host['runtimeState'].stopLeaseRenewal()
-  host['holds'].dispose()
-  await Promise.all([...host['sessions'].values()].map((session) => session.journal.close()))
-  host['sessions'].clear()
-}
-
 afterEach(async () => {
-  await Promise.all(hosts.splice(0).map(abandonHost))
+  await Promise.all(hosts.splice(0).map(abandonStructuredAgentSessionHost))
   await rm(root, { recursive: true, force: true })
   root = ''
 })
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-provider-started.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-provider-started.test.ts
index 52699fd062f6..7c195a9a1243 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-provider-started.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-provider-started.test.ts
@@ -80,8 +80,8 @@ afterEach(async () => {
   await rm(root, { recursive: true, force: true })
 })
 
-function claudeParams() {
-  return hostTestAttachParams(null, {
+function claudeParams(expectedRuntimeFence: number | null = null) {
+  return hostTestAttachParams(expectedRuntimeFence, {
     provider: 'claude',
     agent: 'claude',
     accountHome: { variable: 'CLAUDE_CONFIG_DIR', path: join(root, 'claude-home') },
@@ -102,7 +102,7 @@ describe('a publish-first Claude create whose init is slow', () => {
     expect(store.getRecord(SESSION)?.options?.model).toBeUndefined()
     expect(lastPhase()).toBe('starting')
 
-    await adapter.drainStartup(SESSION)
+    await adapter.awaitStarted(SESSION)
     await Promise.all(lifecycle)
 
     expect(store.getRecord(SESSION)?.options?.model).toBe('claude-opus-9')
@@ -116,7 +116,7 @@ describe('a publish-first Claude create whose init is slow', () => {
     ).resolves.toMatchObject({ ok: true })
     expect(store.getRecord(SESSION)?.options?.model).toBe('opus')
 
-    await adapter.drainStartup(SESSION)
+    await adapter.awaitStarted(SESSION)
     await Promise.all(lifecycle)
 
     expect(store.getRecord(SESSION)?.options?.model).toBe('opus')
@@ -126,19 +126,21 @@ describe('a publish-first Claude create whose init is slow', () => {
   it('keeps the picked model across a resume whose new child starts on its own default', async () => {
     const params = claudeParams()
     await host.attach(CALLER, { ...params, options: { model: 'opus' } })
-    await adapter.drainStartup(SESSION)
+    await adapter.awaitStarted(SESSION)
     await Promise.all(lifecycle)
     await host.close(SESSION)
     const releasedFence = store.getRecord(SESSION)?.lease.runtimeFence ?? 0
 
-    // Reopening the chat: the surface's first hold resumes the session.
-    await host.hold(SESSION, 'chat-1')
+    // Starting the chat again resumes the session under a new fence.
+    await expect(host.attach(CALLER, claudeParams(releasedFence))).resolves.toMatchObject({
+      ok: true
+    })
     expect(store.getRecord(SESSION)?.lease.runtimeFence).toBeGreaterThan(releasedFence)
     // The new child's init reports its CLI default; the saved pick is restored over it.
     expect(store.getRecord(SESSION)?.options?.model).toBe('opus')
     expect(lastPhase()).toBe('starting')
 
-    await adapter.drainStartup(SESSION)
+    await adapter.awaitStarted(SESSION)
     await Promise.all(lifecycle)
 
     expect(store.getRecord(SESSION)?.options?.model).toBe('opus')
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-provider-started.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-provider-started.ts
index 55c718f967b9..8f3c0390aaa1 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-provider-started.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-provider-started.ts
@@ -16,6 +16,7 @@ import type {
   StructuredAgentSessionHostSession
 } from './structured-agent-session-host-types'
 import { nativeSessionOptionsFromReport } from './structured-agent-session-option-restoration'
+import { markProviderChildStarted } from './structured-agent-session-provider-child'
 
 export type StructuredAgentSessionProviderStartedContext = {
   deps: StructuredAgentSessionHostDeps
@@ -23,7 +24,6 @@ export type StructuredAgentSessionProviderStartedContext = {
   serialize: <T>(sessionId: string, task: () => Promise<T>) => Promise<T>
   now: () => number
   publishStatus?: (sessionId: string) => void
-  restartReleaseGrace: (sessionId: string) => void
   onBarrierError: (sessionId: string, error: unknown) => void
 }
 
@@ -35,16 +35,14 @@ export function settleStructuredAgentSessionProviderStarted(
   return context.serialize(event.sessionId, async () => {
     const session = context.sessions.get(event.sessionId)
     if (
-      !session?.hasProviderChild ||
-      session.fence !== event.fence ||
-      session.acquisitionGeneration !== event.acquisitionGeneration
+      !session ||
+      !markProviderChildStarted(session, {
+        generation: event.acquisitionGeneration,
+        fence: event.fence
+      })
     ) {
       return
     }
-    session.providerChildPhase = 'ready'
-    // Prompts held for the start are written now but open a turn only on their echo; a release
-    // tick in between would stop the child before it runs them.
-    context.restartReleaseGrace(event.sessionId)
     try {
       await persistStartedOptions(context, event)
     } catch (error) {
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-read-restore.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-read-restore.test.ts
index 34e3fb8a4cf8..514008e49f9b 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-read-restore.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-read-restore.test.ts
@@ -48,6 +48,11 @@ const store = {
 } as unknown as AgentSessionRecordStore
 
 let journalRoot: string
+const openDeps = () => ({
+  store,
+  journalRoot,
+  adapter: {}
+})
 const opened: AgentSessionJournal[] = []
 
 async function writeRemnant(name: string): Promise<string> {
@@ -73,29 +78,29 @@ describe('a session whose journal is still the pre-SQLite format', () => {
   it('is published, carrying the message that explains it', async () => {
     const transcript = await writeRemnant('log.jsonl')
 
-    const restored = await restoreStructuredAgentSessionRead(store, journalRoot, SESSION_ID)
+    const restored = await restoreStructuredAgentSessionRead(openDeps(), SESSION_ID)
 
     expect(restored).not.toBeNull()
-    opened.push(restored!.journal)
-    const disclosed = restored!.journal
+    opened.push(restored!.session.journal)
+    const disclosed = restored!.session.journal
       .snapshot()
       .items.map((entry) => (entry.body.kind === 'status' ? entry.body.text : ''))
     expect(disclosed.join('')).toContain(transcript)
     // Publishing it costs no agent process; acquisition still waits for the user.
-    expect(restored!.hasProviderChild).toBe(false)
+    expect(restored!.session.child).toBeNull()
   })
 
   it('is published for a remnant whose log is gone', async () => {
     await writeRemnant('snapshot.json')
 
-    const restored = await restoreStructuredAgentSessionRead(store, journalRoot, SESSION_ID)
+    const restored = await restoreStructuredAgentSessionRead(openDeps(), SESSION_ID)
 
     expect(restored).not.toBeNull()
-    opened.push(restored!.journal)
+    opened.push(restored!.session.journal)
   })
 
   it('still drops a session with neither a journal nor a remnant', async () => {
-    const restored = await restoreStructuredAgentSessionRead(store, journalRoot, SESSION_ID)
+    const restored = await restoreStructuredAgentSessionRead(openDeps(), SESSION_ID)
 
     expect(restored).toBeNull()
   })
@@ -103,7 +108,7 @@ describe('a session whose journal is still the pre-SQLite format', () => {
   it('still drops a session with no record', async () => {
     await writeRemnant('log.jsonl')
 
-    const restored = await restoreStructuredAgentSessionRead(store, journalRoot, 'unknown-session')
+    const restored = await restoreStructuredAgentSessionRead(openDeps(), 'unknown-session')
 
     expect(restored).toBeNull()
   })
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-read-restore.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-read-restore.ts
index 65b913daf42a..0e1441b729c7 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-read-restore.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-read-restore.ts
@@ -1,104 +1,32 @@
-import type { AgentSessionRecord } from '../../../shared/agent-session-record'
-import type { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
 import { findJournalFileFormatRemnant } from '../agent-session-journal/journal-file-format-remnant'
-import { loadJournal } from '../agent-session-journal/journal-open'
-import { journalDirectoryFor } from '../agent-session-journal/journal-paths'
-import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
-import { openAgentSessionJournal } from '../agent-session-journal/journal-store-factory'
+import { existsSync } from 'node:fs'
+import { journalDatabaseFile, journalDirectoryFor } from '../agent-session-journal/journal-paths'
 import {
-  attachFingerprintFields,
-  journalIdentityFor,
-  type AgentSessionAttachParams
-} from './structured-agent-session-attach'
-import { computeAgentSessionPayloadFingerprint } from '../../../shared/agent-session-mutation-envelope'
-
-export type RestoredStructuredAgentSessionRead = {
-  journal: AgentSessionJournal
-  params: AgentSessionAttachParams
-  fence: number
-  hasProviderChild: false
-  providerChildPhase: 'ready'
-  acquisitionGeneration: null
-}
+  openStructuredAgentSessionConversationJournal,
+  type OpenedStructuredAgentSessionConversation,
+  type StructuredAgentSessionConversationOpenDeps
+} from './structured-agent-session-conversation-open'
 
+/**
+ * A reader's open: the conversation's own open, for a session that has a journal to read. One
+ * with none — never written, or gone — stays unpublished rather than founding an empty one.
+ * Opening can still write: the crash boundary, and the row explaining an old-format history.
+ */
 export async function restoreStructuredAgentSessionRead(
-  store: AgentSessionRecordStore,
-  journalRoot: string,
+  deps: StructuredAgentSessionConversationOpenDeps,
   sessionId: string
-): Promise<RestoredStructuredAgentSessionRead | null> {
-  const record = store.getRecord(sessionId)
+): Promise<OpenedStructuredAgentSessionConversation | null> {
+  const record = deps.store.getRecord(sessionId)
   if (!record) {
     return null
   }
-  const params = attachParamsForRecord(record, {
-    clientOperationId: `read-restore:${record.sessionId}`,
-    expectedRuntimeFence: record.lease.runtimeFence
-  })
-  const journalDir = journalDirectoryFor(journalRoot, {
+  const journalDir = journalDirectoryFor(deps.journalRoot, {
     workspaceId: record.location.workspaceId,
     sessionId
   })
-  const loaded = loadJournal(journalDir, sessionId)
-  if (loaded?.corrupt) {
+  // A session still in the pre-SQLite format has no `journal.db`; the open imports it.
+  if (!existsSync(journalDatabaseFile(journalDir)) && !findJournalFileFormatRemnant(journalDir)) {
     return null
   }
-  // A session still in the pre-SQLite format has no `journal.db` to load. Dropping
-  // it here leaves it unpublished, which is also what prunes its tab out of the
-  // saved workspace — so the chat disappears with nowhere to explain itself.
-  if (!loaded && !findJournalFileFormatRemnant(journalDir)) {
-    return null
-  }
-  const journal = await openAgentSessionJournal({
-    identity: journalIdentityFor(record, params),
-    journalDir,
-    // Omitted, not `null`: the store reads `null` as "replay already ran and
-    // found nothing" and founds a fresh epoch. In process the probe above is the
-    // previous statement, so the window is zero-width; this holds the line for a
-    // database another process creates in between.
-    ...(loaded ? { loaded } : {})
-  })
-  // Read restore opens the journal and nothing else: no adapter call, so no
-  // provider child. Opening it can still write — a session whose history is in
-  // the old format founds its epoch and commits the row explaining that here.
-  return {
-    journal,
-    params,
-    fence: record.lease.runtimeFence,
-    hasProviderChild: false,
-    providerChildPhase: 'ready',
-    acquisitionGeneration: null
-  }
-}
-
-export function attachParamsForRecord(
-  record: AgentSessionRecord,
-  input: {
-    clientOperationId: string
-    expectedRuntimeFence: number
-  }
-): AgentSessionAttachParams {
-  const params: AgentSessionAttachParams = {
-    envelope: {
-      sessionId: record.sessionId,
-      clientOperationId: input.clientOperationId,
-      expectedRuntimeFence: input.expectedRuntimeFence,
-      payloadFingerprint: ''
-    },
-    location: record.location,
-    provider: record.provider,
-    agent: record.provider,
-    accountHome: record.accountHome,
-    runtimeKind: 'native'
-  }
-  return {
-    ...params,
-    envelope: {
-      ...params.envelope,
-      payloadFingerprint: computeAgentSessionPayloadFingerprint({
-        method: 'agentSession.attach',
-        sessionId: record.sessionId,
-        fields: attachFingerprintFields(params)
-      })
-    }
-  }
+  return openStructuredAgentSessionConversationJournal(deps, record)
 }
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-readable-restorer.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-readable-restorer.test.ts
index 5d579fbe256e..d1cc9408a62e 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-readable-restorer.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-readable-restorer.test.ts
@@ -19,15 +19,17 @@ describe('StructuredAgentSessionReadableRestorer', () => {
       (sessionId) => ({ sessionId }) as AgentSessionRecord
     )
     const restorer = new StructuredAgentSessionReadableRestorer({
-      store: { listRecords: () => records } as never,
-      journalRoot: '/tmp/journals',
+      openDeps: {
+        store: { getRecord: () => null, listRecords: () => records },
+        journalRoot: '/tmp/journals',
+        adapter: {}
+      },
       supportsRecord: () => true,
       reconcile: async () => null,
       resolveRecovery: async () => undefined,
       serialize: async (_sessionId, task) => task(),
       hasSession: () => false,
-      onReadable: () => undefined,
-      retrySettlement: async () => true
+      onReadable: () => undefined
     })
 
     await restorer.restore(['visible-a', 'visible-b', 'background-a', 'background-b'])
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-readable-restorer.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-readable-restorer.ts
index a11c3a85b6c1..06bd043aec0c 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-readable-restorer.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-readable-restorer.ts
@@ -1,30 +1,13 @@
 import type { AgentSessionRecord } from '../../../shared/agent-session-record'
-import type { AgentSessionWireRefusal } from '../../../shared/agent-session-wire'
-import type { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
-import type { RestoredStructuredAgentSessionRead } from './structured-agent-session-read-restore'
-import {
-  restoreOneStructuredAgentSessionRead,
-  restoreOneStructuredAgentSessionReadUnderSerialize,
-  restoreStructuredAgentSessionsOnRestart
-} from './structured-agent-session-restart-restore'
+import type { StructuredAgentSessionReadRestoreDeps } from './structured-agent-session-restart-restore'
+import { restoreStructuredAgentSessionsOnRestart } from './structured-agent-session-restart-restore'
 
 export class StructuredAgentSessionReadableRestorer {
   private restorePromise: Promise<void> | null = null
 
   constructor(
-    private readonly input: {
-      store: AgentSessionRecordStore
-      journalRoot: string
+    private readonly input: StructuredAgentSessionReadRestoreDeps & {
       supportsRecord: (record: AgentSessionRecord) => boolean
-      reconcile: (sessionId: string) => Promise<AgentSessionWireRefusal | null>
-      resolveRecovery: (sessionId: string) => Promise<unknown>
-      serialize: <T>(sessionId: string, task: () => Promise<T>) => Promise<T>
-      hasSession: (sessionId: string) => boolean
-      onReadable: (sessionId: string, restored: RestoredStructuredAgentSessionRead) => void
-      retrySettlement: (
-        sessionId: string,
-        params: RestoredStructuredAgentSessionRead['params']
-      ) => Promise<boolean>
     }
   ) {}
 
@@ -36,46 +19,11 @@ export class StructuredAgentSessionReadableRestorer {
     return this.restorePromise
   }
 
-  /**
-   * One session, on demand, after startup.
-   *
-   * Deliberately outside `restorePromise`: that latch answers "has the startup sweep run", and a
-   * surface asking for a session the sweep never covered — or that was closed since — must not be
-   * told yes because the sweep finished. Needs no dedupe of its own; the per-session task queue
-   * `serialize` runs on already orders concurrent callers, and the second one sees `hasSession`.
-   *
-   * Provider-agnostic by construction: eligibility is `supportsRecord`, which the adapter router
-   * answers for Claude and Codex from the record's own provider.
-   */
-  async restoreOne(sessionId: string): Promise<boolean> {
-    if (!this.supports(sessionId)) {
-      return false
-    }
-    await restoreOneStructuredAgentSessionRead(this.input, sessionId)
-    return this.input.hasSession(sessionId)
-  }
-
-  /** `restoreOne` for a caller already inside the session's serialize. Reconciliation is skipped
-   *  on purpose: a lease this host has not adjudicated is the attach's problem, and a replay
-   *  needs only the journal. */
-  async restoreOneUnderSerialize(sessionId: string): Promise<boolean> {
-    if (!this.supports(sessionId)) {
-      return false
-    }
-    await restoreOneStructuredAgentSessionReadUnderSerialize(this.input, sessionId)
-    return this.input.hasSession(sessionId)
-  }
-
-  private supports(sessionId: string): boolean {
-    const record = this.input.store.getRecord(sessionId)
-    return record !== null && this.input.supportsRecord(record)
-  }
-
   private async restoreReadableSessions(sessionIds?: readonly string[]): Promise<void> {
     const targetOrder = sessionIds
       ? new Map(sessionIds.map((sessionId, index) => [sessionId, index]))
       : null
-    const records = this.input.store
+    const records = this.input.openDeps.store
       .listRecords()
       .filter(
         (record) =>
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-recovered-turn-clock.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-recovered-turn-clock.test.ts
index a239e4a51544..a2be16103274 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-recovered-turn-clock.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-recovered-turn-clock.test.ts
@@ -14,11 +14,11 @@ import type {
 import { AgentHookServer, _internals } from '../../agent-hooks/server'
 import { createTrackedJournalOpener } from '../agent-session-journal/journal-store-test-open'
 import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
-import { settleStructuredAgentSessionDeadGeneration } from './structured-agent-session-dead-generation-settlement'
 import {
-  settleStaleSessionStateOnAcquire,
-  type StructuredAgentSessionTurnVerdict
-} from './structured-agent-session-stale-turn-verdict'
+  settleStaleStructuredAgentSessionState,
+  settleStructuredAgentSessionDeadGeneration
+} from './structured-agent-session-dead-generation-settlement'
+import type { StructuredAgentSessionTurnVerdict } from './structured-agent-session-stale-turn-verdict'
 import { StructuredAgentSessionStatusFeed } from './structured-agent-session-status-feed'
 import { indexedStatusFeedSession } from './structured-agent-session-status-feed-test-session'
 import { StructuredAgentSessionTurnCompletionFeed } from './structured-agent-session-turn-completion-feed'
@@ -88,7 +88,11 @@ async function sessionWithRunningTurn() {
       }
     }
   })
-  const completions = new StructuredAgentSessionTurnCompletionFeed({ sessions, now: () => clock })
+  const completions = new StructuredAgentSessionTurnCompletionFeed({
+    sessions,
+    now: () => clock,
+    readStatusState: (sessionId, source) => feed.statusState(sessionId, source)
+  })
   const completionEvents: AgentSessionTurnCompletionEvent[] = []
   completions.subscribe({ id: 'dot-1', emit: (event) => completionEvents.push(event) })
   // Both feeds have seen the turn running, so its settlement is a transition they must judge.
@@ -157,11 +161,12 @@ describe('a turn recovery settled after its host went away', () => {
   it('is dated the same way when a new provider child finds the turn still running', async () => {
     const session = await sessionWithRunningTurn()
     session.recoverAt(RECOVERED)
-    await settleStaleSessionStateOnAcquire({
+    await settleStaleStructuredAgentSessionState({
       journal: session.journal,
       sessionId: SESSION,
       fence: 2,
-      acquisitionGeneration: 'generation-2'
+      acquisitionGeneration: 'generation-2',
+      deathEvidence: null
     })
     session.publish()
 
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-recovery-exits.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-recovery-exits.test.ts
index 7cd92bf521bf..2da22f958733 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-recovery-exits.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-recovery-exits.test.ts
@@ -11,6 +11,7 @@ import { readProcessStartTimeMs } from '../../runtime/agent-session-process-iden
 import { createStructuredAgentSessionOwnerProbe } from '../../runtime/structured-agent-session-owner-probe'
 import type { StructuredAgentSessionAdapter } from './structured-agent-session-adapter'
 import { StructuredAgentSessionHost } from './structured-agent-session-host'
+import { abandonStructuredAgentSessionHost } from './structured-agent-session-host-test-abandon'
 import type { StructuredAgentSessionHostDeps } from './structured-agent-session-host-types'
 import {
   HOST_TEST_NOW as NOW,
@@ -59,6 +60,12 @@ async function stopOwner(child: ReturnType<typeof spawnProcess>): Promise<void>
   spawnedOwners.delete(child)
 }
 
+/** What a send's delivery or `agentSession.ensure` does: attach at the record's current fence. */
+async function startAgent(): Promise<void> {
+  const fence = store.getRecord(SESSION)?.lease.runtimeFence ?? null
+  expect((await host.attach(CALLER, hostTestAttachParams(fence))).ok).toBe(true)
+}
+
 function adapter(): StructuredAgentSessionAdapter {
   return {
     acquire,
@@ -82,17 +89,8 @@ function openHost(overrides: Partial<StructuredAgentSessionHostDeps> = {}): void
   })
 }
 
-async function abandonHost(abandonedHost: StructuredAgentSessionHost): Promise<void> {
-  abandonedHost['runtimeState'].stopLeaseRenewal()
-  abandonedHost['holds'].dispose()
-  await Promise.all(
-    [...abandonedHost['sessions'].values()].map((session) => session.journal.close())
-  )
-  abandonedHost['sessions'].clear()
-}
-
 async function reopenStore(): Promise<void> {
-  await abandonHost(host)
+  await abandonStructuredAgentSessionHost(host)
   store = await AgentSessionRecordStore.open({ directory: join(root, 'store'), hostId: 'local' })
 }
 
@@ -119,37 +117,35 @@ beforeEach(async () => {
 })
 
 afterEach(async () => {
-  await abandonHost(host)
-  await Promise.all([...supersededHosts].map(abandonHost))
+  await abandonStructuredAgentSessionHost(host)
+  await Promise.all([...supersededHosts].map(abandonStructuredAgentSessionHost))
   supersededHosts.clear()
   await Promise.all([...spawnedOwners].map((child) => stopOwner(child)))
   await rm(root, { recursive: true, force: true })
 })
 
 describe('recovery exits', () => {
-  it('keeps an ownerless unproven acquisition in manual recovery across restart', async () => {
+  it('releases an ownerless unproven acquisition, so the next start goes ahead', async () => {
     acquire.mockRejectedValueOnce(new Error('simulated crash before identity commit'))
     await expect(host.attach(CALLER, hostTestAttachParams(null))).rejects.toThrow(
       'agent_session_acquisition_exit_unproven'
     )
+    // No owner was recorded, and the adapter closed the stdio of anything it spawned.
     expect(store.getRecord(SESSION)?.lease).toMatchObject({
-      claimStatus: 'reserved',
-      handoffStage: 'manual-recovery',
+      claimStatus: 'released',
+      handoffStage: null,
       handoffOperationId: null,
       ownerProcess: null,
-      runtimeFence: 1,
-      reservedSpawnToken: 'spawn-a'
+      runtimeFence: 2,
+      reservedSpawnToken: null,
+      deathEvidence: null
     })
 
     await reopenStore()
     openHost({ mintSpawnToken: () => 'spawn-b' })
 
-    const refused = await host.attach(CALLER, hostTestAttachParams(1))
-    expect(refused).toMatchObject({
-      ok: false,
-      refusal: { code: 'agent_session_ownership_unknown' }
-    })
-    expect(acquire).toHaveBeenCalledOnce()
+    expect(await host.attach(CALLER, hostTestAttachParams(2))).toMatchObject({ ok: true })
+    expect(acquire).toHaveBeenCalledTimes(2)
   })
 
   it('releases an unproven acquisition whose owner later dies, without replaying it as a handoff', async () => {
@@ -197,8 +193,8 @@ describe('recovery exits', () => {
       runtimeFence: 4
     })
 
-    // The ordinary native recovery path remains: the first surface hold resumes it.
-    await host.hold(SESSION, 'surface-1')
+    // The ordinary native recovery path remains: the next start resumes it.
+    await startAgent()
     expect(acquire).toHaveBeenCalledTimes(3)
     expect(store.getRecord(SESSION)?.lease).toMatchObject({
       claimStatus: 'live',
@@ -242,7 +238,7 @@ describe('recovery exits', () => {
     })
   })
 
-  it('heals a stranded native owner during startup restore, and spawns nothing until a surface asks', async () => {
+  it('heals a stranded native owner during startup restore, and spawns nothing until work asks', async () => {
     expect((await host.attach(CALLER, hostTestAttachParams(null))).ok).toBe(true)
     await reopenStore()
 
@@ -262,7 +258,7 @@ describe('recovery exits', () => {
     await host.restoreReadableSessions()
 
     // Healing is startup's job; spawning is not. The orphan is stopped and the lease is free, but
-    // nothing has asked to look at this session, so no replacement child exists yet.
+    // nothing has asked this session for work, so no replacement child exists yet.
     expect(stopOwnerProcess).toHaveBeenCalledWith(4242, 'SIGTERM')
     expect(acquire).toHaveBeenCalledTimes(1)
     expect(store.getRecord(SESSION)?.lease).toMatchObject({
@@ -271,7 +267,7 @@ describe('recovery exits', () => {
       ownerProcess: null
     })
 
-    await host.hold(SESSION, 'surface-1')
+    await startAgent()
 
     expect(acquire).toHaveBeenCalledTimes(2)
     expect(store.getRecord(SESSION)?.lease).toMatchObject({
@@ -340,7 +336,7 @@ describe('recovery exits', () => {
       }
     })
 
-    await host.hold(SESSION, 'surface-overlap')
+    await startAgent()
 
     expect(store.getRecord(SESSION)?.lease).toMatchObject({
       runtimeFence: 3,
@@ -348,6 +344,6 @@ describe('recovery exits', () => {
       handoffStage: null,
       ownerProcess: { pid: replacement.process.pid, spawnToken: 'spawn-b' }
     })
-    expect(host.history({ sessionId: SESSION, direction: 'tail' }).ok).toBe(true)
+    expect((await host.history({ sessionId: SESSION, direction: 'tail' })).ok).toBe(true)
   })
 })
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-recovery-resolution.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-recovery-resolution.test.ts
index b647ed018838..7fbd785894d8 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-recovery-resolution.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-recovery-resolution.test.ts
@@ -90,10 +90,10 @@ async function liveOwner(store: AgentSessionRecordStore) {
   })
 }
 
-async function latch(store: AgentSessionRecordStore, stage: 'recovering' | 'manual-recovery') {
+async function latch(store: AgentSessionRecordStore) {
   return store.transitionHandoff(SESSION, (record) => ({
     ...record,
-    lease: { ...record.lease, handoffStage: stage }
+    lease: { ...record.lease, handoffStage: 'recovering' }
   }))
 }
 
@@ -117,29 +117,30 @@ function deps(
 }
 
 describe('structured session recovery resolution', () => {
-  it('does not release an ownerless native reservation without processless proof', async () => {
+  it('releases an ownerless reservation: nothing it recorded can be holding it', async () => {
     const store = await openStore()
     await reserve(store)
-    await latch(store, 'recovering')
+    await latch(store)
 
     const result = await resolveStructuredSessionRecovery(
       deps(store, () => ({ outcome: 'indeterminate', reason: 'no scan' })),
       SESSION
     )
 
-    expect(result).toBe('unresolved')
+    expect(result).toBe('resolved')
     expect(store.getRecord(SESSION)?.lease).toMatchObject({
-      claimStatus: 'reserved',
-      handoffStage: 'recovering',
-      runtimeFence: 1,
-      reservedSpawnToken: 'spawn-recovery'
+      claimStatus: 'released',
+      handoffStage: null,
+      runtimeFence: 2,
+      reservedSpawnToken: null,
+      deathEvidence: null
     })
   })
 
   it('evicts a latched owner the probe now proves dead, without a stop request', async () => {
     const store = await openStore()
     await liveOwner(store)
-    await latch(store, 'manual-recovery')
+    await latch(store)
     const stopOwnerProcess = vi.fn()
 
     const result = await resolveStructuredSessionRecovery(
@@ -160,7 +161,7 @@ describe('structured session recovery resolution', () => {
   it('stops a live identity-matched orphan and evicts only after absence is proven', async () => {
     const store = await openStore()
     await liveOwner(store)
-    await latch(store, 'recovering')
+    await latch(store)
     let alive = true
     const stopOwnerProcess = vi.fn(() => {
       alive = false
@@ -188,10 +189,10 @@ describe('structured session recovery resolution', () => {
     })
   })
 
-  it('escalates the stop request but never evicts an owner that stays alive', async () => {
+  it('releases an owner that survives the stop ladder, with no death evidence', async () => {
     const store = await openStore()
     await liveOwner(store)
-    await latch(store, 'recovering')
+    await latch(store)
     const stopOwnerProcess = vi.fn()
 
     const result = await resolveStructuredSessionRecovery(
@@ -201,22 +202,25 @@ describe('structured session recovery resolution', () => {
       SESSION
     )
 
-    expect(result).toBe('unresolved')
-    expect(stopOwnerProcess).toHaveBeenCalledWith(4242, 'SIGTERM')
-    expect(stopOwnerProcess).toHaveBeenCalledWith(4242, 'SIGKILL')
-    // The latch is preserved verbatim: no fence move, no cleared owner, no lost state.
+    expect(result).toBe('resolved')
+    expect(stopOwnerProcess.mock.calls).toEqual([
+      [4242, 'SIGTERM'],
+      [4242, 'SIGKILL']
+    ])
+    // Its transport died with the runtime that held it; nothing proved it gone, so no evidence.
     expect(store.getRecord(SESSION)?.lease).toMatchObject({
-      claimStatus: 'live',
-      handoffStage: 'recovering',
-      runtimeFence: 1,
-      ownerProcess: { pid: 4242 }
+      claimStatus: 'released',
+      handoffStage: null,
+      runtimeFence: 2,
+      ownerProcess: null,
+      deathEvidence: null
     })
   })
 
-  it('leaves an unverifiable owner latched and requests no stop', async () => {
+  it('releases an owner whose identity cannot be verified, and signals nothing', async () => {
     const store = await openStore()
     await liveOwner(store)
-    await latch(store, 'recovering')
+    await latch(store)
     const stopOwnerProcess = vi.fn()
 
     const result = await resolveStructuredSessionRecovery(
@@ -226,11 +230,15 @@ describe('structured session recovery resolution', () => {
       SESSION
     )
 
-    expect(result).toBe('unresolved')
+    expect(result).toBe('resolved')
+    // The pid may have been reused by an unrelated process.
     expect(stopOwnerProcess).not.toHaveBeenCalled()
     expect(store.getRecord(SESSION)?.lease).toMatchObject({
-      handoffStage: 'recovering',
-      runtimeFence: 1
+      claimStatus: 'released',
+      handoffStage: null,
+      runtimeFence: 2,
+      ownerProcess: null,
+      deathEvidence: null
     })
   })
 
@@ -255,7 +263,7 @@ describe('structured session recovery resolution', () => {
     expect(await readPersistedLease(directory, SESSION)).toMatchObject({
       runtimeKind: 'native',
       claimStatus: 'conflicted',
-      handoffStage: 'manual-recovery'
+      handoffStage: 'recovering'
     })
 
     expect(
@@ -270,7 +278,7 @@ describe('structured session recovery resolution', () => {
     })
   })
 
-  it('resolves a terminal reservation an older build left naming nobody', async () => {
+  it('releases a terminal reservation an older build left naming nobody at restart', async () => {
     const directory = await newStoreDirectory()
     await reserve(await openStore(directory))
     await writeOlderBuildLease(directory, SESSION, { runtimeKind: 'tui' })
@@ -279,63 +287,18 @@ describe('structured session recovery resolution', () => {
       probe: async () => ({ outcome: 'indeterminate', reason: 'no scan' }),
       now: NOW
     })
-    // Only the kind changes: no process is recorded for a conflict to name.
+    // No process is recorded for a conflict to name, so there is nothing to wait out.
     expect(store.getRecord(SESSION)?.lease).toMatchObject({
       runtimeKind: 'native',
-      claimStatus: 'reserved',
-      handoffStage: 'manual-recovery'
-    })
-
-    expect(
-      await resolveStructuredSessionRecovery(
-        deps(store, () => ({ outcome: 'reservation-unused' })),
-        SESSION
-      )
-    ).toBe('resolved')
-    expect(store.getRecord(SESSION)?.lease).toMatchObject({
+      claimStatus: 'released',
       handoffStage: null,
-      claimStatus: 'released'
+      deathEvidence: null
     })
-  })
-
-  it('frees a conflicted claim once its named owner is proven gone', async () => {
-    const store = await openStore()
-    await liveOwner(store)
-    await store.markClaimConflicted(SESSION, NOW)
-
     expect(
       await resolveStructuredSessionRecovery(
-        deps(store, () => ({ outcome: 'pid-absent' })),
+        deps(store, () => ({ outcome: 'reservation-unused' })),
         SESSION
       )
-    ).toBe('resolved')
-    expect(store.getRecord(SESSION)?.lease).toMatchObject({
-      handoffStage: null,
-      claimStatus: 'released',
-      deathEvidence: { kind: 'pid-absent' }
-    })
-  })
-
-  it('never stops the process a conflicted claim names, and keeps the conflict without proof', async () => {
-    const store = await openStore()
-    await liveOwner(store)
-    await store.markClaimConflicted(SESSION, NOW)
-    const stopOwnerProcess = vi.fn()
-
-    const result = await resolveStructuredSessionRecovery(
-      deps(store, () => ({ outcome: 'identity-matched', matchedOn: ['spawn-token'] }), {
-        stopOwnerProcess
-      }),
-      SESSION
-    )
-
-    // Ownership was never settled, so the process on the other side of the conflict is not
-    // Orca's to kill; only the user can decide which claimant wins.
-    expect(stopOwnerProcess).not.toHaveBeenCalled()
-    expect(result).toBe('unresolved')
-    expect(store.getRecord(SESSION)?.lease).toMatchObject({
-      claimStatus: 'conflicted',
-      handoffStage: 'manual-recovery'
-    })
+    ).toBe('not-applicable')
   })
 })
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-recovery-resolution.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-recovery-resolution.ts
index 40317552d6e4..5e04cbdf90ef 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-recovery-resolution.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-recovery-resolution.ts
@@ -1,8 +1,12 @@
 /**
- * Exits from latched recovery stages. A session lands in `recovering` / `manual-recovery`
- * when evidence about its owner was UNAVAILABLE; this module re-asks with present-time
- * evidence and releases the lease only on proof. A stop is a request — the lease moves only
- * after a later probe proves the process absent, never on a timeout.
+ * Exits from the `recovering` stage. A session lands there when evidence about its owner was
+ * unavailable; this re-asks with present-time evidence and always concludes. A dead owner is
+ * evicted on proof. A live one is stopped by identity and evicted once
+ * proven gone. One that outlives the stop, or whose identity cannot be verified, is released
+ * anyway: its transport died with the runtime that held it, so nothing can drive it, and no signal
+ * is sent to a pid that cannot be verified as the one recorded. Only a conflicted claim, which is
+ * how a terminal owner an older build recorded now loads, is waited out and never stopped: it is
+ * the user's own agent, and its exit is its way out.
  */
 
 import {
@@ -11,6 +15,7 @@ import {
   type AgentSessionOwnerProbe
 } from '../../../shared/agent-session-lease-adjudication'
 import type { AgentSessionRecord } from '../../../shared/agent-session-record'
+import { releaseUnprovenAgentSessionOwner } from '../../runtime/agent-session-lease-transitions'
 import type { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
 
 export type StructuredSessionRecoveryStopSignal = 'SIGTERM' | 'SIGKILL'
@@ -33,62 +38,46 @@ const UNRESOLVED_REFUSALS: ReadonlySet<string> = new Set([
   'agent_session_identity_required'
 ])
 
-/** Which latched records this module may re-ask about. */
-export function structuredSessionRecoveryIsResolvable(record: AgentSessionRecord): boolean {
-  if (record.lease.settlementRetryRequired) {
-    // Settlement latches are cleared only by a successful journal retry, never by owner probing.
-    return false
-  }
-  const { claimStatus, handoffStage, ownerProcess } = record.lease
-  if (handoffStage !== 'recovering' && handoffStage !== 'manual-recovery') {
-    return false
-  }
-  if (claimStatus === 'conflicted') {
-    // A conflict names one process. Re-asking is only meaningful against that name; with none
-    // recorded there is nothing present-time evidence could settle, and the user decides.
-    return ownerProcess !== null
-  }
-  return true
-}
-
-/** Stopping a matched owner is only Orca's call when Orca owned its transport. A conflicted claim
- *  means ownership was never settled — including a terminal an older build recorded as owner. */
-function recoveryMayStopOwner(record: AgentSessionRecord): boolean {
-  return record.lease.claimStatus !== 'conflicted'
-}
-
 export async function resolveStructuredSessionRecovery(
   deps: StructuredSessionRecoveryResolutionDeps,
   sessionId: string
 ): Promise<'resolved' | 'unresolved' | 'not-applicable'> {
   const record = deps.store.getRecord(sessionId)
-  if (!record || !structuredSessionRecoveryIsResolvable(record)) {
+  if (record?.lease.handoffStage !== 'recovering') {
     return 'not-applicable'
   }
   let probe = await deps.probeRecord(record)
   const owner = record.lease.ownerProcess
-  if (
-    owner &&
-    owner.hostId === deps.store.hostId &&
-    isProvenAliveProbe(probe) &&
-    recoveryMayStopOwner(record)
-  ) {
-    // The owner is a live child of a runtime that no longer exists; its transport cannot be
-    // reconstructed, so the only way forward is to stop it and prove it gone.
+  if (owner && record.lease.claimStatus === 'conflicted' && !isProvenDeadProbe(probe)) {
+    // A terminal agent keeps its transport across a restart, so only proof of its exit is a way in.
+    return 'unresolved'
+  }
+  if (owner && isProvenAliveProbe(probe)) {
+    if (owner.hostId !== deps.store.hostId) {
+      return 'unresolved'
+    }
     probe = await stopOwnerAndReprobe(deps, record, owner.pid)
   }
   try {
-    await deps.store.evictProvenDeadOwner({
-      sessionId,
-      expectedFence: record.lease.runtimeFence,
-      probe,
-      now: deps.now()
-    })
+    await (owner && !isProvenDeadProbe(probe)
+      ? deps.store.transitionHandoff(sessionId, (latest) =>
+          releaseUnprovenAgentSessionOwner({
+            record: latest,
+            expectedFence: record.lease.runtimeFence,
+            now: deps.now()
+          })
+        )
+      : deps.store.evictProvenDeadOwner({
+          sessionId,
+          expectedFence: record.lease.runtimeFence,
+          probe,
+          now: deps.now()
+        }))
     return 'resolved'
   } catch (error) {
     const code = error instanceof Error ? error.message : String(error)
     if (UNRESOLVED_REFUSALS.has(code)) {
-      // No proof yet; the record is preserved untouched and the next attempt re-asks.
+      // The record moved under this resolution; the next attempt re-asks against what it is now.
       return 'unresolved'
     }
     throw error
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-refusal-details.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-refusal-details.test.ts
new file mode 100644
index 000000000000..505bec74c23d
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-refusal-details.test.ts
@@ -0,0 +1,274 @@
+// A refusal's details name the situation, so every place that answers for a refusal — the first
+// reply, a ledger replay, the store fallback copy — must name the same one.
+
+import { describe, expect, it } from 'vitest'
+import {
+  agentSessionRecordFixture,
+  agentSessionLeaseFixture
+} from '../../../shared/agent-session-record.test-fixture'
+import { agentSessionRefusalError } from '../../../shared/agent-session-wire-refusals'
+import { classifyStoreFailure } from './structured-agent-session-attach'
+import {
+  AgentSessionAcquisitionExitProvenError,
+  AgentSessionAcquisitionExitUnprovenError,
+  AgentSessionAcquisitionRefusal,
+  AgentSessionPreSpawnError
+} from './structured-agent-session-adapter'
+import {
+  failedAcquisitionRefusal,
+  failedAcquisitionSettlement
+} from './structured-agent-session-failed-create-refusal'
+import { withObservedProviderExit } from './structured-agent-session-failure-text'
+import { resolveAgentSessionReplayOutcome } from './structured-agent-session-replay-outcome'
+
+const CLAUDE_CREATE = {
+  record: agentSessionRecordFixture(),
+  newSession: true
+}
+
+function replay(outcome: Parameters<typeof resolveAgentSessionReplayOutcome>[0]['outcome']) {
+  return resolveAgentSessionReplayOutcome({
+    operationId: 'op-1',
+    outcome,
+    reconstruct: () => null
+  })
+}
+
+describe('a ledger replay names the details its first answer did', () => {
+  it.each([
+    [new AgentSessionAcquisitionRefusal('not signed in', 'notSignedIn'), 'notSignedIn'],
+    [
+      new AgentSessionAcquisitionExitProvenError(
+        withObservedProviderExit(new Error('exited (code 1)'))
+      ),
+      'providerStartFailed'
+    ],
+    // Gone now, with no exit observed: no situation, on the first answer or the replay.
+    [new AgentSessionAcquisitionExitProvenError(new Error('spawn codex ENOENT')), undefined]
+  ])('for a failed create: %s', (error, reason) => {
+    const first = failedAcquisitionRefusal(error, CLAUDE_CREATE)
+    const replayed = replay(failedAcquisitionSettlement(error, CLAUDE_CREATE).outcome)
+    expect(first?.refusal.details?.reason).toBe(reason)
+    expect(replayed).toMatchObject({
+      decision: 'refuse',
+      refusal: { code: first?.refusal.code, ...(reason ? { details: first?.refusal.details } : {}) }
+    })
+    if (!reason) {
+      expect(replayed).not.toHaveProperty('refusal.details')
+    }
+  })
+
+  it('for a create whose cleanup could not prove the child gone', () => {
+    const outcome = failedAcquisitionSettlement(
+      new AgentSessionAcquisitionExitUnprovenError(new Error('probe failed')),
+      CLAUDE_CREATE
+    ).outcome
+    expect(replay(outcome)).toMatchObject({
+      refusal: { code: 'agent_session_ownership_unknown', details: { reason: 'ownerUnproven' } }
+    })
+  })
+
+  it.each([
+    [
+      new AgentSessionAcquisitionExitProvenError(
+        withObservedProviderExit(
+          new Error('claude stream-json exited (code 1): claude: not signed in (rig)')
+        )
+      ),
+      'Claude stopped before it finished starting. Send your message to try again.'
+    ],
+    [
+      new AgentSessionAcquisitionExitProvenError(new Error('spawn claude ENOENT')),
+      "Claude couldn't start. Send your message to try again."
+    ],
+    [
+      new AgentSessionAcquisitionRefusal(
+        'Claude is not signed in for the selected account. Sign in with the Claude CLI for this CLAUDE_CONFIG_DIR, then retry.',
+        'notSignedIn'
+      ),
+      'Claude is not signed in for the selected account. Sign in, then send your message again.'
+    ],
+    [
+      AgentSessionAcquisitionRefusal.historyTooLarge(
+        'Codex thread history exceeds the bounded restore queue; history was not partially imported.'
+      ),
+      "This conversation's history is too large to restore here. Start a new chat to continue."
+    ]
+  ])('answers and replays %s in the sentence its start failure reads as', (error, sentence) => {
+    const first = failedAcquisitionRefusal(error, CLAUDE_CREATE)
+    const replayed = replay(failedAcquisitionSettlement(error, CLAUDE_CREATE).outcome)
+    expect(first?.refusal.message).toBe(sentence)
+    expect(replayed).toMatchObject({ decision: 'refuse', refusal: { message: sentence } })
+    for (const message of [
+      first?.refusal.message,
+      failedAcquisitionSettlement(error, CLAUDE_CREATE).outcome.message
+    ]) {
+      expect(message).not.toMatch(
+        /stream-json|exited \(code|ENOENT|CLAUDE_CONFIG_DIR|restore queue/
+      )
+    }
+  })
+
+  it('replays a spawn that failed before any process in a sentence, not its error', () => {
+    const outcome = failedAcquisitionSettlement(
+      new AgentSessionPreSpawnError(new Error('spawn claude ENOENT')),
+      CLAUDE_CREATE
+    ).outcome
+    expect(replay(outcome)).toMatchObject({
+      refusal: { message: "Claude couldn't start. Send your message to try again." }
+    })
+  })
+
+  it('keeps the code a store refusal replays with, and the unproven-exit marker', () => {
+    expect(
+      failedAcquisitionSettlement(new Error('agent_session_conflict'), CLAUDE_CREATE).outcome
+        .message
+    ).toBe('agent_session_conflict')
+    expect(
+      failedAcquisitionSettlement(
+        new AgentSessionAcquisitionExitUnprovenError(new Error('probe failed')),
+        CLAUDE_CREATE
+      ).outcome.message
+    ).toBe('agent_session_acquisition_exit_unproven')
+  })
+
+  it('replays the facts beside the reason, and mirrors them where released clients read', () => {
+    const resolution = {
+      state: 'resolved' as const,
+      selectedOptionId: 'allow',
+      resolvedBy: 'phone',
+      resolvedAt: 5
+    }
+    const replayed = replay({
+      status: 'failed',
+      code: 'agent_session_item_revision_stale',
+      details: { reason: 'promptMoved', currentRevision: 3, resolution }
+    })
+    expect(replayed).toMatchObject({
+      refusal: {
+        code: 'agent_session_item_revision_stale',
+        details: { reason: 'promptMoved', currentRevision: 3, resolution },
+        currentRevision: 3,
+        resolution
+      }
+    })
+  })
+
+  it('reads a row an older host wrote, with no details, as naming none', () => {
+    const replayed = replay({ status: 'failed', code: 'agent_session_conflict' })
+    expect(replayed).toMatchObject({ refusal: { code: 'agent_session_conflict' } })
+    expect(replayed.decision === 'refuse' && replayed.refusal).not.toHaveProperty('details')
+  })
+
+  it('drops the cause an unreleased build wrote, and a reason the code does not list', () => {
+    for (const row of [
+      { status: 'failed' as const, code: 'agent_session_conflict', cause: 'claimConflicted' },
+      {
+        status: 'failed' as const,
+        code: 'agent_session_conflict',
+        details: { reason: 'promptGone' as const }
+      }
+    ]) {
+      const replayed = replay(row)
+      expect(replayed).toMatchObject({ refusal: { code: 'agent_session_conflict' } })
+      expect(replayed.decision === 'refuse' && replayed.refusal).not.toHaveProperty('details')
+    }
+  })
+
+  it('names a code this build cannot place as refused earlier', () => {
+    expect(replay({ status: 'failed', code: 'agent_session_future_code' })).toMatchObject({
+      refusal: {
+        code: 'agent_session_operation_invalid',
+        details: { reason: 'operationRefusedEarlier' }
+      }
+    })
+  })
+
+  it('names a lost outcome and a lost result', () => {
+    expect(replay({ status: 'unknown' })).toMatchObject({
+      refusal: { details: { reason: 'outcomeUnknown' } }
+    })
+    expect(replay({ status: 'succeeded', sessionId: 's' })).toMatchObject({
+      refusal: { details: { reason: 'resultLost' } }
+    })
+  })
+})
+
+describe('the store fallback copy', () => {
+  const record = agentSessionRecordFixture(
+    agentSessionLeaseFixture({
+      ownerProcess: { hostId: 'local', pid: 4242, processStartTimeMs: 1, spawnToken: 'spawn-1' }
+    })
+  )
+
+  it('words a situation its code would misdescribe by the situation', () => {
+    const refusal = classifyStoreFailure(
+      agentSessionRefusalError('agent_session_ownership_unknown', { reason: 'replaySuperseded' }),
+      null,
+      record
+    )
+    expect(refusal).toMatchObject({
+      code: 'agent_session_ownership_unknown',
+      details: { reason: 'replaySuperseded' }
+    })
+    // Not the latched-owner story: this owner is not in doubt, the replay is just stale.
+    expect(refusal.message).not.toContain('4242')
+  })
+
+  it('keeps the latched-owner story, with its reason, for an owner it cannot prove gone', () => {
+    const refusal = classifyStoreFailure(
+      agentSessionRefusalError('agent_session_ownership_unknown', { reason: 'ownerUnproven' }),
+      null,
+      record
+    )
+    expect(refusal.details?.reason).toBe('ownerUnproven')
+    expect(refusal.message).toContain('4242')
+  })
+
+  it('does not promise an update fixes a record this build cannot read', () => {
+    // Unreadable covers a damaged record as well as one a newer build wrote.
+    expect(
+      classifyStoreFailure(
+        agentSessionRefusalError('execution_owner_reconciling', { reason: 'recordUnreadable' }),
+        null,
+        null
+      )
+    ).toEqual({
+      code: 'execution_owner_reconciling',
+      details: { reason: 'recordUnreadable' },
+      message:
+        "Orca can't read this chat's saved state. If a newer version of Orca saved it, update Orca to open it; otherwise start a new chat."
+    })
+  })
+
+  it('names the latch for a bare code an older path still throws', () => {
+    expect(
+      classifyStoreFailure(new Error('agent_session_conflict'), null, {
+        ...record,
+        lease: { ...record.lease, claimStatus: 'conflicted' }
+      }).details
+    ).toEqual({ reason: 'claimConflicted' })
+    expect(
+      classifyStoreFailure(new Error('agent_session_conflict'), null, null)
+    ).not.toHaveProperty('details')
+  })
+
+  it('puts the current fence in the details of a stale checkpoint, and mirrors it', () => {
+    expect(
+      classifyStoreFailure(
+        agentSessionRefusalError('agent_session_checkpoint_stale', { reason: 'fenceStale' }),
+        7,
+        null
+      )
+    ).toEqual({
+      code: 'agent_session_checkpoint_stale',
+      details: { reason: 'fenceStale', currentFence: 7 },
+      currentFence: 7,
+      message: 'The session store refused this call: agent_session_checkpoint_stale.'
+    })
+    // A bare code names no reason, but the fence is still a fact.
+    expect(
+      classifyStoreFailure(new Error('agent_session_checkpoint_stale'), 7, null)
+    ).toMatchObject({ details: { currentFence: 7 }, currentFence: 7 })
+  })
+})
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-refusal-message.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-refusal-message.ts
index 0184366e3445..7a7a9e289ef5 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-refusal-message.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-refusal-message.ts
@@ -7,8 +7,12 @@
  * the action that supplies it.
  */
 
+import { terminalOwnerRefusalMessage } from '../../../shared/agent-session-legacy-handoff-lease'
 import type { AgentSessionRecord } from '../../../shared/agent-session-record'
-import type { AgentSessionWireRefusalCode } from '../../../shared/agent-session-wire'
+import type {
+  AgentSessionAnyRefusalReason,
+  AgentSessionRefusalReference
+} from '../../../shared/agent-session-wire'
 
 function ownerDescription(record: AgentSessionRecord): string {
   const owner = record.lease.ownerProcess
@@ -16,33 +20,71 @@ function ownerDescription(record: AgentSessionRecord): string {
 }
 
 function latchedMessage(record: AgentSessionRecord): string {
-  const owner = record.lease.ownerProcess
-  if (record.lease.settlementRetryRequired) {
-    return 'The provider exited, but Orca has not finished settling the terminal chat state. Reopen this chat to retry the settlement.'
-  }
   if (record.lease.claimStatus === 'conflicted') {
-    return owner
-      ? `Two runtimes claimed this session and Orca cannot yet prove that ${ownerDescription(record)} has exited. Quit that process, or reopen this chat once it is gone, and Orca will take the session back.`
-      : 'Two runtimes claimed this session and the record names no process to check. Quit any other Orca or agent process using this workspace, then reopen this chat.'
+    return terminalOwnerRefusalMessage(record.lease)
   }
-  return owner
+  return record.lease.ownerProcess
     ? `Orca cannot prove that ${ownerDescription(record)} — the previous owner of this session — has exited, so it will not start a second agent on the same conversation. Quit that process and reopen this chat.`
     : 'Orca cannot tell whether an agent started for this session before the app stopped, so it will not start a second one on the same conversation. Quit any leftover agent process for this workspace and reopen this chat.'
 }
 
-/** Null when the code has no session-specific story to tell; the caller keeps its own wording. */
+/**
+ * A situation whose own words the store's code would get wrong: each of these reaches the chat as
+ * `ownership_unknown` or `conflict`, which by code alone would read as the latched-owner story.
+ */
+const SITUATION_MESSAGES: Partial<Record<AgentSessionAnyRefusalReason, string>> = {
+  replaySuperseded: 'A newer start of this chat replaced this one. Try again.',
+  leaseMoved: 'This chat changed hands while Orca was starting it. Try again.',
+  spawnIdentityMismatch:
+    'The agent that started was not the one Orca launched, so Orca did not use it. Try again.',
+  identityMismatch:
+    'This chat belongs to a different workspace, agent or account. Start a new chat to continue.',
+  sessionExists: 'This chat already exists. Open it to continue.',
+  tabIdTaken: 'Another chat already uses this tab. Try again.',
+  conversationHeldElsewhere:
+    'Another chat is already working in this conversation. Open that chat to continue.',
+  // Also a damaged record, which no update opens.
+  recordUnreadable:
+    "Orca can't read this chat's saved state. If a newer version of Orca saved it, update Orca to open it; otherwise start a new chat."
+}
+
+/**
+ * The words and the situation for a store refusal. The reason is what the emitter named, when it
+ * named one; the latched branches name their own. Null when neither has a story to tell, and the
+ * caller keeps its own wording.
+ */
 export function structuredAgentSessionRefusalMessage(
-  code: AgentSessionWireRefusalCode,
+  emitted: AgentSessionRefusalReference,
   record: AgentSessionRecord | null
-): string | null {
+): { message: string; reference: AgentSessionRefusalReference } | null {
+  const reason = emitted.details?.reason
+  const situational = reason ? SITUATION_MESSAGES[reason] : undefined
+  if (situational) {
+    return { message: situational, reference: emitted }
+  }
   if (!record) {
     return null
   }
+  const { code } = emitted
   if (code === 'agent_session_ownership_unknown' || code === 'agent_session_conflict') {
-    return latchedMessage(record)
+    const message = latchedMessage(record)
+    if (record.lease.claimStatus === 'conflicted') {
+      return { message, reference: { code, details: { reason: 'claimConflicted' } } }
+    }
+    return {
+      message,
+      reference:
+        code === 'agent_session_conflict' && reason === 'ownerAlive'
+          ? { code, details: { reason: 'ownerAlive' } }
+          : { code, details: { reason: 'ownerUnproven' } }
+    }
   }
   if (code === 'execution_owner_reconciling') {
-    return 'Orca is still working out who owns this session on this machine. Reopen the chat in a moment.'
+    return {
+      message:
+        'Orca is still working out who owns this session on this machine. Reopen the chat in a moment.',
+      reference: { code, details: { reason: 'hostReconciling' } }
+    }
   }
   return null
 }
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-refusal-retry.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-refusal-retry.test.ts
index 566156e096f6..4043e27b30c7 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-refusal-retry.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-refusal-retry.test.ts
@@ -19,6 +19,7 @@ import {
 import { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
 import type { StructuredAgentSessionAdapter } from './structured-agent-session-adapter'
 import { StructuredAgentSessionHost } from './structured-agent-session-host'
+import { abandonStructuredAgentSessionHost } from './structured-agent-session-host-test-abandon'
 import {
   HOST_TEST_NOW as NOW,
   HOST_TEST_SESSION as SESSION,
@@ -103,16 +104,9 @@ async function createHarness(options: { attached?: boolean } = {}) {
   return harness
 }
 
-async function abandonHost(host: StructuredAgentSessionHost): Promise<void> {
-  host['runtimeState'].stopLeaseRenewal()
-  host['holds'].dispose()
-  await Promise.all([...host['sessions'].values()].map((session) => session.journal.close()))
-  host['sessions'].clear()
-}
-
 afterEach(async () => {
   const completed = harnesses.splice(0)
-  await Promise.all(completed.map(async ({ host }) => abandonHost(host)))
+  await Promise.all(completed.map(async ({ host }) => abandonStructuredAgentSessionHost(host)))
   await Promise.all(completed.map(async ({ root }) => rm(root, { recursive: true })))
 })
 
@@ -225,13 +219,20 @@ const UNREACHABLE = new Set<Pair>([
   // StructuredAgentSessionHost.mutate maps an absent record to AGENT_SESSION_NOT_ATTACHED.
   'agentSession.setOption:agent_session_identity_required',
   'agentSession.send:agent_session_identity_required',
-  // No structured-agent-session host branch emits agent_session_journal_unreadable.
+  // Only a send opens the conversation it writes to.
   'agentSession.setOption:agent_session_journal_unreadable',
-  'agentSession.send:agent_session_journal_unreadable',
   // Send reconstructs doubt from its global tombstone instead of refusing it.
   'agentSession.send:agent_session_operation_unknown',
   // Only a send restarts a lost owner.
-  'agentSession.setOption:agent_session_owner_restart_failed'
+  'agentSession.setOption:agent_session_owner_restart_failed',
+  // A write names its target, not an owner generation; only an attach compares fences.
+  'agentSession.setOption:agent_session_checkpoint_stale',
+  'agentSession.send:agent_session_checkpoint_stale',
+  // A send is a conversation write: admitted whoever owns the lease, and a start it needs that
+  // fails rejects the accepted message rather than refusing the call.
+  'agentSession.send:agent_session_conflict',
+  'agentSession.send:execution_owner_reconciling',
+  'agentSession.send:agent_session_owner_restart_failed'
 ])
 
 describe('agentSessionRefusalOperationState host oracle', () => {
@@ -242,25 +243,13 @@ describe('agentSessionRefusalOperationState host oracle', () => {
 
     const stale = await createHarness()
     for (const method of METHODS) {
-      const spec = {
-        method,
-        operationId: operationId(),
-        expectedRuntimeFence: 99
-      }
-      record(
-        await assertHostAgreement(stale, spec, 'agent_session_checkpoint_stale', async () => ({
-          harness: stale,
-          spec: {
-            ...spec,
-            expectedRuntimeFence: stale.store.getRecord(SESSION)?.lease.runtimeFence ?? 1
-          }
-        }))
-      )
+      const spec = { method, operationId: operationId(), expectedRuntimeFence: 99 }
+      await expect(invoke(stale, spec), method).resolves.toMatchObject({ ok: true })
     }
     expect(stale.setOption).toHaveBeenCalledTimes(1)
 
     const conflict = await createHarness()
-    for (const method of ['agentSession.setOption', 'agentSession.send'] as const) {
+    for (const method of ['agentSession.setOption'] as const) {
       await setLease(conflict, (current) => ({
         ...current,
         lease: { ...current.lease, handoffStage: 'new-owner-proving' }
@@ -340,7 +329,7 @@ describe('agentSessionRefusalOperationState host oracle', () => {
     record(await assertHostAgreement(unknown, optionUnknown, 'agent_session_operation_unknown'))
 
     const reconciling = await createHarness()
-    for (const method of ['agentSession.setOption', 'agentSession.send'] as const) {
+    for (const method of ['agentSession.setOption'] as const) {
       await setLease(reconciling, (current) => ({
         ...current,
         lease: { ...current.lease, unreconciled: true }
@@ -357,16 +346,21 @@ describe('agentSessionRefusalOperationState host oracle', () => {
       )
     }
 
-    const unrecoverable = await createHarness()
-    await unrecoverable.host.close(SESSION)
-    unrecoverable.host.deps.adapter.acquire = async () => {
-      throw new Error('no provider thread to resume')
+    const unreadable = await createHarness()
+    await unreadable.host.close(SESSION)
+    unreadable.host.deps.adapter.historyFilePath = async () => {
+      throw new Error('transcript unreadable')
     }
+    const unreadableSend = { method: 'agentSession.send' as const, operationId: operationId() }
     record(
       await assertHostAgreement(
-        unrecoverable,
-        { method: 'agentSession.send', operationId: operationId() },
-        'agent_session_owner_restart_failed'
+        unreadable,
+        unreadableSend,
+        'agent_session_journal_unreadable',
+        async () => {
+          delete unreadable.host.deps.adapter.historyFilePath
+          return { harness: unreadable, spec: unreadableSend }
+        }
       )
     )
 
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-release-clock.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-release-clock.ts
deleted file mode 100644
index 91daa5606a81..000000000000
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-release-clock.ts
+++ /dev/null
@@ -1,85 +0,0 @@
-// The delay between "nothing holds this session and nothing has happened in it" and "stop its
-// provider child".
-//
-// It is an IDLE window, not a short grace. A surface that reconnects — a mobile socket dropping on
-// a network switch, a renderer remounting a tab, a worktree switch hiding the pane — releases and
-// re-holds, and a send to a chat nobody is looking at restarts its owner; stopping the child soon
-// after either costs the user a respawn plus a resume on the next message. And a turn the user
-// already asked for must finish: stopping the child mid-answer strands the open turn marker.
-//
-// So the clock arms when the last holder leaves, every journal write while it is armed starts it
-// again, and a tick that finds work still owed — a turn running, a message sent but not yet
-// taken by the provider, or a subagent, command or monitor still running — re-arms instead of
-// evicting. The child goes only after a full window
-// with no holder and no owed work. Quit still stops every child at once.
-
-export const STRUCTURED_AGENT_SESSION_RELEASE_GRACE_MS = 30 * 60_000
-
-export type StructuredAgentSessionReleaseClockDeps = {
-  /** Never evict while work is owed; a true answer re-arms the clock instead. */
-  hasOwedWork: (sessionId: string) => boolean
-  /** Re-checked at fire time: a holder may have arrived while the timer ran. */
-  isHeld: (sessionId: string) => boolean
-  evict: (sessionId: string) => Promise<void>
-  onError?: (input: { sessionId: string; error: unknown }) => void
-  graceMs?: number
-}
-
-export class StructuredAgentSessionReleaseClock {
-  private readonly timers = new Map<string, ReturnType<typeof setTimeout>>()
-  private readonly graceMs: number
-
-  constructor(private readonly deps: StructuredAgentSessionReleaseClockDeps) {
-    this.graceMs = deps.graceMs ?? STRUCTURED_AGENT_SESSION_RELEASE_GRACE_MS
-  }
-
-  arm(sessionId: string): void {
-    this.cancel(sessionId)
-    const timer = setTimeout(() => {
-      this.timers.delete(sessionId)
-      this.fire(sessionId)
-    }, this.graceMs)
-    // A pending release must never be the reason a process stays alive at quit.
-    timer.unref?.()
-    this.timers.set(sessionId, timer)
-  }
-
-  /** Activity in an unheld session: the idle window starts over. */
-  renew(sessionId: string): void {
-    if (this.timers.has(sessionId)) {
-      this.arm(sessionId)
-    }
-  }
-
-  cancel(sessionId: string): void {
-    const timer = this.timers.get(sessionId)
-    if (timer) {
-      clearTimeout(timer)
-      this.timers.delete(sessionId)
-    }
-  }
-
-  isArmed(sessionId: string): boolean {
-    return this.timers.has(sessionId)
-  }
-
-  dispose(): void {
-    for (const timer of this.timers.values()) {
-      clearTimeout(timer)
-    }
-    this.timers.clear()
-  }
-
-  private fire(sessionId: string): void {
-    if (this.deps.isHeld(sessionId)) {
-      return
-    }
-    if (this.deps.hasOwedWork(sessionId)) {
-      this.arm(sessionId)
-      return
-    }
-    void this.deps.evict(sessionId).catch((error: unknown) => {
-      this.deps.onError?.({ sessionId, error })
-    })
-  }
-}
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-replay-outcome.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-replay-outcome.ts
index c81c45dfba50..00fa33a30fb4 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-replay-outcome.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-replay-outcome.ts
@@ -1,9 +1,11 @@
 import { rewindRefusal } from './structured-rewind-refusal'
 import type { AgentSessionOperationOutcome } from '../../../shared/agent-session-operation-ledger'
 import {
-  AGENT_SESSION_WIRE_REFUSAL_CODES,
-  type AgentSessionWireRefusal,
-  type AgentSessionWireRefusalCode
+  agentSessionRefusalFromReference,
+  readAgentSessionRefusalReference,
+  refuse,
+  type AgentSessionRefusalReference,
+  type AgentSessionWireRefusal
 } from '../../../shared/agent-session-wire'
 
 export type AgentSessionReplayOutcomeDecision<TValue> =
@@ -23,15 +25,12 @@ export function resolveAgentSessionReplayOutcome<TValue>(input: {
     if (outcome.rewindReason) {
       return { decision: 'refuse', refusal: rewindRefusal(outcome.rewindReason).refusal }
     }
-    const code = (AGENT_SESSION_WIRE_REFUSAL_CODES as readonly string[]).includes(outcome.code)
-      ? (outcome.code as AgentSessionWireRefusalCode)
-      : 'agent_session_operation_invalid'
     return {
       decision: 'refuse',
-      refusal: {
-        code,
-        message: outcome.message ?? `Operation ${operationId} was already refused: ${outcome.code}.`
-      }
+      refusal: agentSessionRefusalFromReference(
+        recordedRefusal(outcome.code, outcome.details),
+        outcome.message ?? `Operation ${operationId} was already refused: ${outcome.code}.`
+      )
     }
   }
   if (outcome.status === 'unknown') {
@@ -44,10 +43,11 @@ export function resolveAgentSessionReplayOutcome<TValue>(input: {
     }
     return {
       decision: 'refuse',
-      refusal: {
-        code: 'agent_session_operation_unknown',
-        message: `The outcome of operation ${operationId} is unknown; it was not run again.`
-      }
+      refusal: refuse(
+        'agent_session_operation_unknown',
+        { reason: 'outcomeUnknown' },
+        `The outcome of operation ${operationId} is unknown; it was not run again.`
+      )
     }
   }
   const recorded = input.reconstruct()
@@ -60,10 +60,22 @@ export function resolveAgentSessionReplayOutcome<TValue>(input: {
   return outcome.status === 'succeeded'
     ? {
         decision: 'refuse',
-        refusal: {
-          code: 'agent_session_operation_unknown',
-          message: `Operation ${operationId} succeeded, but its result is no longer reconstructable.`
-        }
+        refusal: refuse(
+          'agent_session_operation_unknown',
+          { reason: 'resultLost' },
+          `Operation ${operationId} succeeded, but its result is no longer reconstructable.`
+        )
       }
     : { decision: 'rerun' }
 }
+
+/** The refusal a failed row recorded, so a replay says what the first answer said. A code this
+ *  build does not know was refused for a reason it cannot name. */
+function recordedRefusal(code: string, details: unknown): AgentSessionRefusalReference {
+  return (
+    readAgentSessionRefusalReference({ code, details }) ?? {
+      code: 'agent_session_operation_invalid',
+      details: { reason: 'operationRefusedEarlier' }
+    }
+  )
+}
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-rest-test-rig.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-rest-test-rig.ts
new file mode 100644
index 000000000000..3ea116fa361d
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-rest-test-rig.ts
@@ -0,0 +1,224 @@
+// A real host over a real store and journal, with a scripted provider and a clock the test moves,
+// for the tests of a conversation that outlives its agent. The idle sweep runs on its own short
+// interval; a test moves `clock.now` past the idle window and waits for the outcome.
+
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { expect, vi, type Mock } from 'vitest'
+import { computeAgentSessionPayloadFingerprint } from '../../../shared/agent-session-mutation-envelope'
+import type { AgentJournalMessageItem } from '../../../shared/agent-session-journal-types'
+import type {
+  AgentSessionMutationEnvelope,
+  AgentSessionStatusEvent,
+  AgentSessionSubscribeEvent
+} from '../../../shared/agent-session-wire'
+import { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
+import type {
+  AgentSessionDispatchOutcome,
+  StructuredAgentSessionAdapter
+} from './structured-agent-session-adapter'
+import { StructuredAgentSessionHost } from './structured-agent-session-host'
+import type { StructuredAgentSessionHostDeps } from './structured-agent-session-host-types'
+import {
+  HOST_TEST_NOW,
+  HOST_TEST_SESSION as SESSION,
+  HOST_TEST_THREAD as THREAD,
+  hostTestAttachParams,
+  hostTestMessage,
+  hostTestOperationId,
+  resetHostTestOperationIds
+} from './structured-agent-session-host-test-data'
+import { STRUCTURED_AGENT_SESSION_IDLE_MS } from './structured-agent-session-idle-sweep'
+
+export const REST_TEST_CALLER = { callerKey: 'client-1' }
+export const IDLE_MS = STRUCTURED_AGENT_SESSION_IDLE_MS
+export const SWEEP_INTERVAL_MS = 5
+
+export type RestTestAdapter = {
+  acquire: Mock<StructuredAgentSessionAdapter['acquire']>
+  closeSession: Mock<NonNullable<StructuredAgentSessionAdapter['closeSession']>>
+  dispatch: Mock<StructuredAgentSessionAdapter['dispatch']>
+  acknowledgeSessionRelease: Mock<
+    NonNullable<StructuredAgentSessionAdapter['acknowledgeSessionRelease']>
+  >
+  backgroundTaskState: Mock<NonNullable<StructuredAgentSessionAdapter['backgroundTaskState']>>
+  readOptions: Mock<NonNullable<StructuredAgentSessionAdapter['readOptions']>>
+}
+
+export type RestTestRig = {
+  root: string
+  store: AgentSessionRecordStore
+  host: StructuredAgentSessionHost
+  adapter: RestTestAdapter
+  clock: { now: number }
+  statusEvents: AgentSessionStatusEvent[]
+  sink: { publish: Mock; forget: Mock }
+  /** Opens a fresh host over the same store and journals: what a restart leaves behind. */
+  restart: (deps?: Partial<StructuredAgentSessionHostDeps>) => Promise<StructuredAgentSessionHost>
+  dispose: () => Promise<void>
+}
+
+let ordinal = 0
+let generations = 0
+
+export function acceptedDispatch(): AgentSessionDispatchOutcome {
+  ordinal += 1
+  return {
+    state: 'accepted',
+    providerIdentity: { provider: 'codex', threadId: THREAD, turnId: `turn-${ordinal}`, ordinal }
+  }
+}
+
+export function restTestSend(
+  text: string,
+  fence = 1
+): { envelope: AgentSessionMutationEnvelope; body: AgentJournalMessageItem } {
+  const body = hostTestMessage(text)
+  return {
+    body,
+    envelope: {
+      sessionId: SESSION,
+      clientOperationId: hostTestOperationId(),
+      expectedRuntimeFence: fence,
+      payloadFingerprint: computeAgentSessionPayloadFingerprint({
+        method: 'agentSession.send',
+        sessionId: SESSION,
+        fields: { body }
+      })
+    }
+  }
+}
+
+/** Every item and submission a reader was sent, whatever frame carried it. */
+export function readerSaw(events: readonly AgentSessionSubscribeEvent[]) {
+  const items = events.flatMap((event) =>
+    event.type === 'batch' ? event.batch.items : event.type === 'end' ? [] : event.page.items
+  )
+  const submissions = events.flatMap((event) =>
+    event.type === 'batch' ? event.batch.submissions : []
+  )
+  return {
+    texts: items.flatMap((item) =>
+      item.body.kind === 'message'
+        ? item.body.blocks.flatMap((block) => (block.type === 'text' ? [block.text] : []))
+        : []
+    ),
+    submissions
+  }
+}
+
+export function collectSubscriber(): {
+  events: AgentSessionSubscribeEvent[]
+  emit: (event: AgentSessionSubscribeEvent) => void
+} {
+  const events: AgentSessionSubscribeEvent[] = []
+  return { events, emit: (event) => events.push(event) }
+}
+
+export async function createRestTestRig(
+  deps: Partial<StructuredAgentSessionHostDeps> = {}
+): Promise<RestTestRig> {
+  resetHostTestOperationIds()
+  ordinal = 0
+  const root = await mkdtemp(join(tmpdir(), 'orca-rest-'))
+  const clock = { now: HOST_TEST_NOW }
+  const statusEvents: AgentSessionStatusEvent[] = []
+  const sink = { publish: vi.fn(), forget: vi.fn() }
+  let store = await AgentSessionRecordStore.open({
+    directory: join(root, 'store'),
+    hostId: 'local'
+  })
+  const adapter: RestTestAdapter = {
+    acquire: vi.fn(async ({ fence, spawnToken }) => ({
+      acquisitionGeneration: `generation-${++generations}`,
+      process: { hostId: 'local', pid: 4242, processStartTimeMs: 1_700_000_000_000, spawnToken },
+      link: {
+        linkId: `link-${fence}`,
+        handle: { provider: 'codex' as const, threadId: THREAD },
+        origin: store.getRecord(SESSION)?.providerHandleChain.length
+          ? ('resumed' as const)
+          : ('created' as const),
+        mintedAtFence: fence,
+        observedAt: clock.now
+      }
+    })),
+    closeSession: vi.fn(async () => true),
+    dispatch: vi.fn(async () => acceptedDispatch()),
+    acknowledgeSessionRelease: vi.fn(),
+    backgroundTaskState: vi.fn(() => undefined),
+    readOptions: vi.fn(async () => ({ models: [], current: { model: 'gpt-live' } }))
+  }
+  const hostFor = (overrides: Partial<StructuredAgentSessionHostDeps>) =>
+    new StructuredAgentSessionHost({
+      store,
+      adapter: {
+        ...adapter,
+        releaseAcquisition: vi.fn(async () => true),
+        cancelTurn: async () => ({ cancelled: true }),
+        answerPrompt: async ({ commit }) => commit(),
+        setOption: async () => undefined
+      },
+      journalRoot: root,
+      claimKeyId: 'key-1',
+      mintSpawnToken: () => 'spawn-a',
+      probeOwner: async () => ({ outcome: 'pid-absent' }),
+      now: () => clock.now,
+      statusSink: sink,
+      idleSweep: { intervalMs: SWEEP_INTERVAL_MS },
+      ...deps,
+      ...overrides
+    })
+  const rig: RestTestRig = {
+    root,
+    store,
+    host: hostFor({}),
+    adapter,
+    clock,
+    statusEvents,
+    sink,
+    restart: async (overrides = {}) => {
+      await rig.host.flushAllStreamedEvents().catch(() => undefined)
+      store = await AgentSessionRecordStore.open({
+        directory: join(root, 'store'),
+        hostId: 'local'
+      })
+      rig.store = store
+      rig.host = hostFor(overrides)
+      rig.host.subscribeStatus({ id: 'status', emit: (event) => statusEvents.push(event) })
+      return rig.host
+    },
+    dispose: async () => {
+      await rig.host.flushAllStreamedEvents().catch(() => undefined)
+      await rm(root, { recursive: true, force: true })
+    }
+  }
+  rig.host.subscribeStatus({ id: 'status', emit: (event) => statusEvents.push(event) })
+  return rig
+}
+
+/** Creates the chat, lists its tab, and sends one message so its journal is on disk. */
+export async function foundRestTestChat(rig: RestTestRig): Promise<void> {
+  const attached = await rig.host.attach(REST_TEST_CALLER, hostTestAttachParams(null))
+  if (!attached.ok) {
+    throw new Error(`attach refused: ${attached.refusal.code}`)
+  }
+  await rig.store.setSessionTabVisibility(SESSION, true)
+  const sent = await rig.host.send(REST_TEST_CALLER, restTestSend('hello', attached.fence))
+  if (!sent.ok) {
+    throw new Error(`send refused: ${sent.refusal.code}`)
+  }
+  await vi.waitFor(() => expect(rig.adapter.dispatch).toHaveBeenCalled())
+}
+
+/** Runs one sweep pass now, for a test that set `idleSweep.intervalMs` out of reach. */
+export function sweepOnce(host: StructuredAgentSessionHost): Promise<void> {
+  return host.collaboratorsForTests().lifetime.idleSweep.tick()
+}
+
+/** Waits long enough for several sweep ticks to have run. */
+export function sweepTicks(count = 6): Promise<void> {
+  return new Promise((resolve) => setTimeout(resolve, SWEEP_INTERVAL_MS * count))
+}
+
+export { SESSION as REST_TEST_SESSION, THREAD as REST_TEST_THREAD }
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-candidates.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-candidates.ts
index 46879aefe49a..50008ce79c44 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-candidates.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-candidates.ts
@@ -2,16 +2,11 @@
 //
 // A different question from storage: the durable record decides which markers are still present;
 // this decides which of those a resume may act on. The offer, the click and the pre-send check all
-// ask it, and all get the same answer: the marker stands until the user sends a newer message.
+// ask it, and all get the same answer.
 
-import { agentJournalSubmissionKey } from '../../../shared/agent-session-journal-item-key'
-import type { AgentJournalRenderItem } from '../../../shared/agent-session-journal-types'
 import type { AgentSessionRecord } from '../../../shared/agent-session-record'
 import type { AgentSessionResumeMarker } from '../../../shared/agent-session-resume-marker'
-import {
-  latestStructuredAgentSessionPrompt,
-  latestStructuredAgentSessionUserItem
-} from '../../../shared/structured-agent-session-projection'
+import { latestStructuredAgentSessionPrompt } from '../../../shared/structured-agent-session-projection'
 import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
 import type { StructuredAgentSessionAdapter } from './structured-agent-session-adapter'
 import { adapterSupportsRecord } from './structured-agent-session-provider-support'
@@ -23,61 +18,29 @@ import {
 /** The only part of a live session this reads. */
 export type StructuredAgentSessionRestartJournalSource = { journal: AgentSessionJournal }
 
-export type StructuredAgentSessionRestartCandidateOptions = {
-  /** A continuation already in flight; its own submission is not newer user work. */
-  pendingContinuationId?: string
-}
-
 export type StructuredAgentSessionRestartCandidateReader = (
   markers: readonly AgentSessionResumeMarker[],
-  leaseState: 'must-be-released' | 'may-be-held',
-  options?: StructuredAgentSessionRestartCandidateOptions
+  leaseState: 'must-be-released' | 'may-be-held'
 ) => StructuredAgentSessionResumableSet
 
-/** The newest user message in a live session's journal, the same fact the predicate compares
- *  against a marker. Undefined when the session is not readable here, which decides nothing. */
-export function liveStructuredAgentSessionLatestUserItemId(
-  sessions: ReadonlyMap<string, StructuredAgentSessionRestartJournalSource>,
-  sessionId: string
-): string | null | undefined {
-  const session = sessions.get(sessionId)
-  return session
-    ? (latestStructuredAgentSessionUserItem(session.journal.snapshot().items)?.itemId ?? null)
-    : undefined
-}
-
 export function createStructuredAgentSessionRestartCandidateReader(deps: {
   /** The host's live session map; a marker's chat is readable once listing has revealed it. */
   sessions: ReadonlyMap<string, StructuredAgentSessionRestartJournalSource>
   getRecord: (sessionId: string) => AgentSessionRecord | null
   adapter: StructuredAgentSessionAdapter
+  /** Whether the chat moved on since the offer was taken; see the offer withdrawal. */
+  movedOn: (marker: AgentSessionResumeMarker) => boolean
 }): StructuredAgentSessionRestartCandidateReader {
-  return (markers, leaseState, options = {}) => {
-    const items = new Map<string, AgentJournalRenderItem[] | undefined>()
-    const itemsFor = (sessionId: string): AgentJournalRenderItem[] | undefined => {
-      if (items.has(sessionId)) {
-        return items.get(sessionId)
-      }
-      let snapshot = deps.sessions.get(sessionId)?.journal.snapshot().items
-      if (snapshot && options.pendingContinuationId) {
-        const ownItemId = agentJournalSubmissionKey(options.pendingContinuationId)
-        snapshot = snapshot.filter((item) => item.itemId !== ownItemId)
-      }
-      items.set(sessionId, snapshot)
-      return snapshot
-    }
-    return structuredAgentSessionResumableSet({
+  return (markers, leaseState) =>
+    structuredAgentSessionResumableSet({
       markers,
       getRecord: deps.getRecord,
       supportsRecord: (record) => adapterSupportsRecord(deps.adapter, record),
-      latestPrompt: (sessionId) => latestStructuredAgentSessionPrompt(itemsFor(sessionId) ?? []),
-      latestUserItemId: (sessionId) => {
-        const snapshot = itemsFor(sessionId)
-        return snapshot === undefined
-          ? undefined
-          : (latestStructuredAgentSessionUserItem(snapshot)?.itemId ?? null)
-      },
+      movedOn: deps.movedOn,
+      latestPrompt: (sessionId) =>
+        latestStructuredAgentSessionPrompt(
+          deps.sessions.get(sessionId)?.journal.snapshot().items ?? []
+        ),
       leaseState
     })
-  }
 }
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-cap.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-cap.test.ts
new file mode 100644
index 000000000000..9ded5b54d983
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-cap.test.ts
@@ -0,0 +1,86 @@
+// "Resume all" starts agents a few at a time. A continuation is a send, so a chat counts as started
+// once its agent took the message or its start failed — not when the message was accepted, which
+// is instant and would let every agent start at once.
+
+import { expect, it, vi } from 'vitest'
+import {
+  startStructuredAgentSessionContinuation,
+  type StructuredAgentSessionContinuationDeps
+} from './structured-agent-session-restart-continuation'
+import {
+  resumeStructuredAgentSessionsFromRestart,
+  STRUCTURED_AGENT_SESSION_RESUME_CONCURRENCY,
+  StructuredAgentSessionResumeAdmission
+} from './structured-agent-session-restart-resume-runner'
+import { marker } from './structured-agent-session-restart-resume-test-harness'
+
+type Handover = { dispatchState: string; reason?: string | null } | undefined
+
+it('holds each slot from accept until handover or rejection, and frees it when the wait ends (P2-27)', async () => {
+  const handovers = new Map<string, PromiseWithResolvers<Handover>>()
+  let waiting = 0
+  let mostWaiting = 0
+  const deps = (sessionId: string): StructuredAgentSessionContinuationDeps => ({
+    currentFence: () => 1,
+    send: vi.fn(async () => ({ ok: true, value: { submission: { dispatchState: 'pending' } } })),
+    awaitHandedOver: async () => {
+      const handover = Promise.withResolvers<Handover>()
+      handovers.set(sessionId, handover)
+      waiting += 1
+      mostWaiting = Math.max(mostWaiting, waiting)
+      try {
+        return await handover.promise
+      } finally {
+        waiting -= 1
+      }
+    },
+    awaitSettlement: async () => ({ dispatchState: 'accepted' }),
+    note: async () => undefined,
+    onNoteFailed: () => undefined
+  })
+  const sessions = Array.from({ length: 8 }, (_, index) => `session-${index}`)
+  const outcomes = resumeStructuredAgentSessionsFromRestart(
+    {
+      admission: new StructuredAgentSessionResumeAdmission(),
+      consumeMarker: async () => true,
+      resume: async (sessionId) => {
+        const started = await startStructuredAgentSessionContinuation(
+          deps(sessionId),
+          sessionId,
+          marker(),
+          'operation-1'
+        )
+        if ('done' in started && started.done.outcome === 'refused') {
+          throw new Error(started.done.reason ?? 'refused')
+        }
+      }
+    },
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the runner reads only each candidate's session id.
+    sessions.map((sessionId) => ({ sessionId }) as never),
+    'modal'
+  )
+  const settle = async (sessionId: string, handover: Handover) => {
+    await vi.waitFor(() => expect(handovers.has(sessionId)).toBe(true))
+    handovers.get(sessionId)!.resolve(handover)
+  }
+
+  await vi.waitFor(() => expect(waiting).toBe(STRUCTURED_AGENT_SESSION_RESUME_CONCURRENCY))
+  // Accepted but not yet handed over: a slow start keeps its slot.
+  await new Promise((resolve) => setTimeout(resolve, 20))
+  expect(handovers.size).toBe(STRUCTURED_AGENT_SESSION_RESUME_CONCURRENCY)
+  await settle('session-0', { dispatchState: 'pending' })
+  await settle('session-1', { dispatchState: 'rejected', reason: 'Codex could not start.' })
+  // The session closed, or too many waited: the wait proves nothing, and the slot is freed.
+  await settle('session-2', undefined)
+  for (const sessionId of sessions.slice(3)) {
+    await settle(sessionId, { dispatchState: 'pending' })
+  }
+
+  const results = await outcomes
+  expect(mostWaiting).toBe(STRUCTURED_AGENT_SESSION_RESUME_CONCURRENCY)
+  expect(results.find((result) => result.sessionId === 'session-1')).toMatchObject({
+    outcome: 'refused',
+    reason: 'Codex could not start.'
+  })
+  expect(results.filter((result) => result.outcome === 'resumed')).toHaveLength(7)
+})
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-child-work.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-child-work.test.ts
index 63c778144eef..6d8514c830e9 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-child-work.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-child-work.test.ts
@@ -2,10 +2,7 @@
 
 import { expect, it, vi } from 'vitest'
 import { interruptedRestart } from './structured-agent-session-restart-interruption-test-harness'
-import {
-  HOST_TEST_SESSION as SESSION,
-  HOST_TEST_THREAD as THREAD
-} from './structured-agent-session-host-test-data'
+import { HOST_TEST_SESSION as SESSION } from './structured-agent-session-host-test-data'
 
 // What the user hit: the lead had finished, its subagent had not. The offer names the subagent
 // from the roster snapshot taken BEFORE the child stopped — the close that follows settles the
@@ -21,65 +18,22 @@ it('offers a chat whose subagent the restart stopped, named from the stop-time s
   ])
 })
 
-// On resume the provider restates what it lost in its own words, rewriting the row before the
-// continuation is dispatched. What the offer was admitted for still stands.
-it('continues a stopped subagent after the provider restates its row', async () => {
-  const { host, acquire, dispatch } = await interruptedRestart('children')
-  await host.hold(SESSION, 'pane')
-  const events = acquire.mock.calls[0]?.[0].events
-  if (!events) {
-    throw new Error('missing resumed provider event sink')
-  }
-  const admit = vi.spyOn(host.deps.store, 'admitMutationOperation')
-  admit.mockImplementationOnce(async (input) => {
-    events.appendItem(
-      { provider: 'codex', threadId: THREAD, turnId: 'settled-turn', ordinal: 2 },
-      {
-        kind: 'message',
-        role: 'system',
-        blocks: [
-          {
-            type: 'subagent-group',
-            groupId: 'settled-turn',
-            agents: [{ id: 'child-1', label: 'Review loop 4', state: 'completed' }]
-          }
-        ]
-      }
-    )
-    await host.flushStreamedEvents(SESSION)
-    admit.mockRestore()
-    return host.deps.store.admitMutationOperation(input)
-  })
+// The offer was admitted for the subagent's work; the continuation asks the agent to carry it on.
+it('continues a chat whose subagent the restart stopped', async () => {
+  const { host, dispatch } = await interruptedRestart('children')
   expect(
     (await host.restartResume.continueAfterRestart([SESSION], 'modal')).continued
   ).toMatchObject([{ outcome: 'continued' }])
   expect(dispatch).toHaveBeenCalledTimes(1)
-  host.release(SESSION, 'pane')
 })
 
-// The user opens the chat before choosing Resume, and the reattached provider restates its row.
+// The user opens the chat before choosing Resume: reading it starts nothing, so the offer stands.
 it('still offers and continues a chat the user opened before resuming', async () => {
   const { host, acquire, dispatch } = await interruptedRestart('children')
-  await host.hold(SESSION, 'pane')
-  const events = acquire.mock.calls[0]?.[0].events
-  if (!events) {
-    throw new Error('missing resumed provider event sink')
-  }
-  events.appendItem(
-    { provider: 'codex', threadId: THREAD, turnId: 'settled-turn', ordinal: 2 },
-    {
-      kind: 'message',
-      role: 'system',
-      blocks: [
-        {
-          type: 'subagent-group',
-          groupId: 'settled-turn',
-          agents: [{ id: 'child-1', label: 'Review loop 4', state: 'completed' }]
-        }
-      ]
-    }
-  )
-  await host.flushStreamedEvents(SESSION)
+  const unsubscribe = await host.subscribe({ id: 'pane', sessionId: SESSION, emit: vi.fn() })
+  await host.history({ sessionId: SESSION, direction: 'tail' })
+  unsubscribe()
+  expect(acquire).not.toHaveBeenCalled()
   expect(await host.restartResume.list()).toMatchObject([
     { sessionId: SESSION, activity: { tasks: [{ kind: 'agent', label: 'Review loop 4' }] } }
   ])
@@ -87,5 +41,4 @@ it('still offers and continues a chat the user opened before resuming', async ()
     (await host.restartResume.continueAfterRestart([SESSION], 'modal')).continued
   ).toMatchObject([{ outcome: 'continued' }])
   expect(dispatch).toHaveBeenCalledTimes(1)
-  host.release(SESSION, 'pane')
 })
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-continuation-envelope.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-continuation-envelope.ts
new file mode 100644
index 000000000000..cfa2c7b502ee
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-continuation-envelope.ts
@@ -0,0 +1,77 @@
+// The restart continuation as a message: its body, which depends on the marker alone, and its
+// identity, which is one per resume action.
+
+import { createHash } from 'node:crypto'
+import type { AgentJournalMessageItem } from '../../../shared/agent-session-journal-types'
+import { computeAgentSessionPayloadFingerprint } from '../../../shared/agent-session-mutation-envelope'
+import { restartContinuationMessage } from '../../../shared/agent-session-restart-continuation'
+import type { AgentSessionResumeMarker } from '../../../shared/agent-session-resume-marker'
+import type { AgentSessionMutationEnvelope } from '../../../shared/agent-session-wire'
+
+/** The message body, built once so both the send and any test read the same text. */
+export function restartContinuationBody(marker: AgentSessionResumeMarker): AgentJournalMessageItem {
+  return {
+    kind: 'message',
+    role: 'user',
+    blocks: [{ type: 'text', text: restartContinuationMessage(marker) }]
+  }
+}
+
+const hex16 = (parts: readonly unknown[]): string =>
+  createHash('sha256').update(JSON.stringify(parts)).digest('hex').slice(0, 16)
+
+/** Names the offer: every continuation any of its actions sends carries it, and nothing else does. */
+function restartOfferTag(marker: AgentSessionResumeMarker): string {
+  return hex16([marker.teardownId, marker.sessionId])
+}
+
+/** One resume action's continuation: the offer's tag, then the action's own part, so a retry is a
+ *  new message, never a replay of the one that failed. Dated by the action, not the quit: the
+ *  ledger refuses a new id dated more than a day back, and an offer has no expiry. */
+export function restartContinuationId(
+  marker: AgentSessionResumeMarker,
+  operationId: string,
+  actionAt: number
+): string {
+  return `${Math.trunc(actionAt).toString().padStart(13, '0')}-${restartOfferTag(marker)}${hex16([
+    marker.teardownId,
+    marker.sessionId,
+    marker.work.kind,
+    marker.work.id,
+    marker.providerHandleRoot,
+    operationId
+  ])}`
+}
+
+/** Whether a message is a continuation one of this offer's resume actions sent, read off its id. */
+export function isRestartContinuationOf(
+  marker: AgentSessionResumeMarker,
+  clientMessageId: string
+): boolean {
+  return /^\d{13}-[0-9a-f]{32}$/.test(clientMessageId)
+    ? clientMessageId.slice(14, 30) === restartOfferTag(marker)
+    : false
+}
+
+/** The fence only fills the envelope: admission names this send by its operation id, not a fence. */
+export function restartContinuationEnvelope(
+  sessionId: string,
+  fence: number,
+  marker: AgentSessionResumeMarker,
+  continuationId: string
+): { envelope: AgentSessionMutationEnvelope; body: AgentJournalMessageItem } {
+  const body = restartContinuationBody(marker)
+  return {
+    body,
+    envelope: {
+      sessionId,
+      clientOperationId: continuationId,
+      expectedRuntimeFence: fence,
+      payloadFingerprint: computeAgentSessionPayloadFingerprint({
+        method: 'agentSession.send',
+        sessionId,
+        fields: { body }
+      })
+    }
+  }
+}
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-continuation-wait.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-continuation-wait.test.ts
new file mode 100644
index 000000000000..cfbdd9ce35e1
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-continuation-wait.test.ts
@@ -0,0 +1,112 @@
+// The restart continuation is accepted like any send, so its verdict is its delivery: a cold start
+// longer than the legacy client wait must not turn a continuation that went through into an
+// "unconfirmed" one.
+
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { AgentJournalSubmission } from '../../../shared/agent-session-journal-types'
+import { structuredAgentSessionRestartResumeSurfaces } from './structured-agent-session-restart-resume-wiring'
+import { StructuredAgentSessionSendSettlement } from './structured-agent-session-send-settlement'
+
+const SESSION = 'session-1'
+const MESSAGE = 'continuation-1'
+
+let submission: AgentJournalSubmission
+const journal = {
+  submissions: (): AgentJournalSubmission[] => [submission],
+  cursor: () => ({ epoch: 'epoch-1', sequence: 1 })
+}
+
+beforeEach(() => {
+  vi.useFakeTimers()
+  submission = {
+    clientMessageId: MESSAGE,
+    fence: 2,
+    payloadFingerprint: 'fingerprint',
+    dispatchState: 'pending',
+    providerItemId: null,
+    reason: null,
+    submittedAt: 1,
+    resolvedAt: null,
+    handoverRecorded: true
+  }
+})
+
+afterEach(() => {
+  vi.useRealTimers()
+})
+
+describe('the restart continuation waits for its delivery (W18)', () => {
+  it('reaches accepted after a 40 s cold start, with nothing filed as unconfirmed', async () => {
+    const settlement = new StructuredAgentSessionSendSettlement(() => journal)
+    const surfaces = structuredAgentSessionRestartResumeSurfaces(
+      {
+        revealSession: async () => ({ readable: true }),
+        send: async () => {
+          throw new Error('not used')
+        },
+        waitForSendSettlement: settlement.wait
+      },
+      () => 0
+    )
+
+    const verdict = surfaces.awaitSendSettlement(SESSION, MESSAGE)
+    await vi.advanceTimersByTimeAsync(40_000)
+    submission = { ...submission, dispatchState: 'accepted', providerItemId: 'item-1' }
+    settlement.publish(SESSION, journal)
+
+    await expect(verdict).resolves.toMatchObject({
+      value: { submission: { dispatchState: 'accepted' } }
+    })
+  })
+})
+
+describe('a restart batch holds a chat until its continuation is handed over', () => {
+  function surfacesOver(settlement: StructuredAgentSessionSendSettlement) {
+    return structuredAgentSessionRestartResumeSurfaces(
+      {
+        revealSession: async () => ({ readable: true }),
+        send: async () => {
+          throw new Error('not used')
+        },
+        waitForSendSettlement: settlement.wait
+      },
+      () => 0
+    )
+  }
+
+  it('keeps waiting through a slow start and resolves once the agent takes the message', async () => {
+    const settlement = new StructuredAgentSessionSendSettlement(() => journal)
+    let released = false
+    const handedOver = surfacesOver(settlement)
+      .awaitSendHandedOver(SESSION, MESSAGE)
+      .then((result) => {
+        released = true
+        return result
+      })
+    await vi.advanceTimersByTimeAsync(5 * 60_000)
+    expect(released).toBe(false)
+    // Handed over: still pending at the provider, no longer queued.
+    submission = { ...submission, handedOverAt: 2 }
+    settlement.publish(SESSION, journal)
+    await expect(handedOver).resolves.toMatchObject({
+      value: { submission: { dispatchState: 'pending', handedOverAt: 2 } }
+    })
+  })
+
+  it('resolves once the start fails and the message is rejected', async () => {
+    const settlement = new StructuredAgentSessionSendSettlement(() => journal)
+    const handedOver = surfacesOver(settlement).awaitSendHandedOver(SESSION, MESSAGE)
+    submission = { ...submission, dispatchState: 'rejected', reason: 'Codex could not start.' }
+    settlement.publish(SESSION, journal)
+    await expect(handedOver).resolves.toMatchObject({
+      value: { submission: { dispatchState: 'rejected' } }
+    })
+  })
+
+  it('resolves undefined when the session closes first', async () => {
+    const settlement = new StructuredAgentSessionSendSettlement(() => journal)
+    const handedOver = surfacesOver(settlement).awaitSendHandedOver(SESSION, MESSAGE)
+    settlement.closeSession(SESSION)
+    await expect(handedOver).resolves.toBeUndefined()
+  })
+})
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-continuation.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-continuation.test.ts
index 2d558f8f0287..0fe36994cd7c 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-continuation.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-continuation.test.ts
@@ -6,13 +6,22 @@ import {
   AGENT_SESSION_RESTART_NOT_CONNECTED_NOTE
 } from '../../../shared/agent-session-restart-continuation'
 import {
-  continueStructuredAgentSessionAfterRestart,
   RestartContinuationSupersededError,
+  startStructuredAgentSessionContinuation,
   type StructuredAgentSessionContinuationDeps
 } from './structured-agent-session-restart-continuation'
 
+/** The whole continuation: handed over, then its verdict. */
+async function continueStructuredAgentSessionAfterRestart(
+  ...args: Parameters<typeof startStructuredAgentSessionContinuation>
+) {
+  const started = await startStructuredAgentSessionContinuation(...args)
+  return 'done' in started ? started.done : started.verdict()
+}
+
 function dependencies(
-  settledDispatch: 'accepted' | 'pending' | 'unknown' | 'rejected'
+  settledDispatch: 'accepted' | 'pending' | 'unknown' | 'rejected',
+  handedOver: 'pending' | 'rejected' | undefined = 'pending'
 ): StructuredAgentSessionContinuationDeps & {
   note: ReturnType<typeof vi.fn>
   send: ReturnType<typeof vi.fn>
@@ -27,6 +36,14 @@ function dependencies(
       dispatchState: settledDispatch,
       reason: settledDispatch === 'rejected' ? 'provider_refused' : null
     })),
+    awaitHandedOver: vi.fn(async () =>
+      handedOver
+        ? {
+            dispatchState: handedOver,
+            reason: handedOver === 'rejected' ? 'Codex could not start.' : null
+          }
+        : undefined
+    ),
     note: vi.fn(async () => undefined),
     onNoteFailed: vi.fn()
   }
@@ -36,7 +53,7 @@ it('reports an accepted continuation and records its note', async () => {
   const deps = dependencies('accepted')
 
   await expect(
-    continueStructuredAgentSessionAfterRestart(deps, SESSION, marker())
+    continueStructuredAgentSessionAfterRestart(deps, SESSION, marker(), 'operation-1')
   ).resolves.toEqual({
     sessionId: SESSION,
     outcome: 'continued'
@@ -58,20 +75,20 @@ it.each([
     const deps = dependencies(settled)
 
     await expect(
-      continueStructuredAgentSessionAfterRestart(deps, SESSION, marker())
+      continueStructuredAgentSessionAfterRestart(deps, SESSION, marker(), 'operation-1')
     ).resolves.toEqual(expected)
     expect(deps.note).toHaveBeenCalledExactlyOnceWith(...note)
   }
 )
 
-it('notes a superseded continuation in the chat and still reports the refusal', async () => {
+it("writes nothing in the chat when the user's own message came first, and still refuses", async () => {
   const deps = dependencies('accepted')
   deps.send.mockRejectedValue(new RestartContinuationSupersededError())
 
   await expect(
-    continueStructuredAgentSessionAfterRestart(deps, SESSION, marker())
+    continueStructuredAgentSessionAfterRestart(deps, SESSION, marker(), 'operation-1')
   ).rejects.toBeInstanceOf(RestartContinuationSupersededError)
-  expect(deps.note).toHaveBeenCalledExactlyOnceWith(...REFUSED)
+  expect(deps.note).not.toHaveBeenCalled()
 })
 
 // An ownership refusal would meet the user's own message too, so the note gives no advice to send one.
@@ -83,7 +100,7 @@ it.each([
   deps.send.mockResolvedValue({ ok: false, refusal: { code } })
 
   await expect(
-    continueStructuredAgentSessionAfterRestart(deps, SESSION, marker())
+    continueStructuredAgentSessionAfterRestart(deps, SESSION, marker(), 'operation-1')
   ).resolves.toEqual({
     sessionId: SESSION,
     outcome: 'refused',
@@ -98,7 +115,7 @@ it('reports an unattached chat without sending', async () => {
   deps.currentFence = () => null
 
   await expect(
-    continueStructuredAgentSessionAfterRestart(deps, SESSION, marker())
+    continueStructuredAgentSessionAfterRestart(deps, SESSION, marker(), 'operation-1')
   ).resolves.toEqual({
     sessionId: SESSION,
     outcome: 'refused',
@@ -106,3 +123,45 @@ it('reports an unattached chat without sending', async () => {
   })
   expect(deps.send).not.toHaveBeenCalled()
 })
+
+// A start that failed rejects the continuation before any provider saw it: that is the verdict.
+it('reports a continuation rejected at handover without waiting for the provider', async () => {
+  const deps = dependencies('accepted', 'rejected')
+
+  await expect(
+    continueStructuredAgentSessionAfterRestart(deps, SESSION, marker(), 'operation-1')
+  ).resolves.toEqual({ sessionId: SESSION, outcome: 'refused', reason: 'Codex could not start.' })
+  expect(deps.awaitSettlement).not.toHaveBeenCalled()
+  expect(deps.note).toHaveBeenCalledExactlyOnceWith(...REFUSED)
+})
+
+// The start completes once the agent took the message; the provider's answer is a later verdict.
+it('returns at handover and leaves the provider verdict to be awaited', async () => {
+  const deps = dependencies('accepted')
+
+  const started = await startStructuredAgentSessionContinuation(
+    deps,
+    SESSION,
+    marker(),
+    'operation-1'
+  )
+
+  expect(deps.awaitHandedOver).toHaveBeenCalledOnce()
+  expect(deps.awaitSettlement).not.toHaveBeenCalled()
+  if (!('verdict' in started)) {
+    throw new Error('expected a handed-over continuation')
+  }
+  await expect(started.verdict()).resolves.toEqual({ sessionId: SESSION, outcome: 'continued' })
+  expect(deps.note).toHaveBeenCalledOnce()
+})
+
+// A handover wait that ends without an answer — the session closed, or too many waited — proves
+// nothing, so the provider's verdict still decides.
+it('still awaits the verdict when the handover wait ends unanswered', async () => {
+  const deps = dependencies('unknown', undefined)
+
+  await expect(
+    continueStructuredAgentSessionAfterRestart(deps, SESSION, marker(), 'operation-1')
+  ).resolves.toEqual({ sessionId: SESSION, outcome: 'unknown' })
+  expect(deps.note).toHaveBeenCalledExactlyOnceWith(...UNCONFIRMED)
+})
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-continuation.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-continuation.ts
index 58d104a651c2..9dd049293856 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-continuation.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-continuation.ts
@@ -1,27 +1,31 @@
 // Asking an interrupted agent to carry on, on the user's opt-in.
 //
-// Reattaching and continuing are SEPARATE operations: `resume` reattaches and sends nothing; this
-// adds one message on top of it. Both the restart prompt and an opted-in launch come here, so a
-// SETTING can reach this send — acceptable because the work is the user's own, the message asks the
-// agent to verify its last action before repeating it, and the launch toast reports what happened.
+// The continuation is a send like any other: accepted into the conversation, and delivered by the
+// session's delivery loop, which starts the agent. Both the restart prompt and an opted-in launch
+// come here, so a SETTING can reach this send — acceptable because the work is the user's own, the
+// message asks the agent to verify its last action before repeating it, and the launch toast
+// reports what happened.
 
 import type { AgentJournalMessageItem } from '../../../shared/agent-session-journal-types'
+import {
+  readAgentSessionFailureFact,
+  type UnreadAgentSessionFailureFact
+} from '../../../shared/agent-session-failure'
+import type { AgentSessionRefusalReference } from '../../../shared/agent-session-wire-refusals'
 import type {
   AgentSessionMutationEnvelope,
   AgentSessionMutationResult,
   AgentSessionSendResult
 } from '../../../shared/agent-session-wire'
 import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
-import { computeAgentSessionPayloadFingerprint } from '../../../shared/agent-session-mutation-envelope'
 import {
   AGENT_SESSION_RESTART_CONTINUATION_NOTE,
   AGENT_SESSION_RESTART_CONTINUATION_REFUSED_NOTE,
   AGENT_SESSION_RESTART_CONTINUATION_UNCONFIRMED_NOTE,
-  AGENT_SESSION_RESTART_NOT_CONNECTED_NOTE,
-  restartContinuationMessage
+  AGENT_SESSION_RESTART_NOT_CONNECTED_NOTE
 } from '../../../shared/agent-session-restart-continuation'
 import { AgentSessionPreDispatchError } from './structured-agent-session-operation-settlement'
-import { createHash } from 'node:crypto'
+import { restartContinuationEnvelope } from './structured-agent-session-restart-continuation-envelope'
 import type { AgentSessionResumeMarker } from '../../../shared/agent-session-resume-marker'
 
 /**
@@ -40,11 +44,16 @@ export type StructuredAgentSessionContinuationOutcome = {
   sessionId: string
   outcome: 'continued' | 'pending' | 'unknown' | 'refused'
   reason?: string
+  /** The refusal that kept the agent from starting; `reason` is then its code. */
+  refusal?: AgentSessionRefusalReference
 }
 
 /** The slice of the host one continuation needs. Structural so this module never imports the host. */
 export type StructuredAgentSessionContinuationHost = {
-  sessions: ReadonlyMap<string, { journal: AgentSessionJournal; fence: number }>
+  sessions: ReadonlyMap<string, { journal: AgentSessionJournal }>
+  /** The fence a conversation write carries; null when this host has no record of the session.
+   *  The send opens the conversation itself, so a closed one still answers. */
+  conversationFence: (sessionId: string) => number | null
   send: (input: {
     envelope: AgentSessionMutationEnvelope
     body: AgentJournalMessageItem
@@ -54,16 +63,15 @@ export type StructuredAgentSessionContinuationHost = {
     sessionId: string,
     clientMessageId: string
   ) => Promise<{ value: AgentSessionSendResult } | undefined>
+  awaitSendHandedOver: (
+    sessionId: string,
+    clientMessageId: string
+  ) => Promise<{ value: AgentSessionSendResult } | undefined>
   onNoteFailed: (sessionId: string, error: unknown) => void
-  publish: (sessionId: string, journal: AgentSessionJournal) => void
   now: () => number
-  /** Whether the marker is still an offer, with the continuation's own submission set aside.
-   *  Re-asked right before dispatch, so a newer user message refuses the send; a provider turn
-   *  running then does not, since both providers queue a message sent mid-turn. */
-  stillResumable: (
-    marker: AgentSessionResumeMarker,
-    options: { pendingContinuationId: string }
-  ) => boolean
+  /** Whether the marker is still an offer. Asked at acceptance, inside the session lock, so the
+   *  first message accepted since the restart decides: the user's, or this continuation. */
+  stillResumable: (marker: AgentSessionResumeMarker) => boolean
 }
 
 /** Binds one continuation to the host: the superseded check before dispatch, the settlement
@@ -73,54 +81,40 @@ export function restartContinuationDeps(
   marker: AgentSessionResumeMarker
 ): StructuredAgentSessionContinuationDeps {
   return {
-    currentFence: (sessionId) => host.sessions.get(sessionId)?.fence ?? null,
+    currentFence: host.conversationFence,
     send: (input) =>
       host.send({
         ...input,
         beforeRun: () => {
-          if (
-            !host.stillResumable(marker, {
-              pendingContinuationId: input.envelope.clientOperationId
-            })
-          ) {
+          if (!host.stillResumable(marker)) {
             throw new RestartContinuationSupersededError()
           }
         }
       }),
     awaitSettlement: async (sessionId, clientMessageId) =>
       (await host.awaitSendSettlement(sessionId, clientMessageId))?.value.submission,
+    awaitHandedOver: async (sessionId, clientMessageId) =>
+      (await host.awaitSendHandedOver(sessionId, clientMessageId))?.value.submission,
     onNoteFailed: host.onNoteFailed,
     note: restartNoteWriter(host)
   }
 }
 
-/** The note for a reattach that failed before any continuation was attempted. */
-export function noteRestartReattachFailed(
-  host: StructuredAgentSessionContinuationHost,
-  sessionId: string
-): Promise<void> {
-  return noteNotContinued(
-    { note: restartNoteWriter(host), onNoteFailed: host.onNoteFailed },
-    sessionId,
-    'not-connected'
-  )
-}
-
-/** Writes a host-authored status note into the chat and publishes it to open panes. */
+/** Writes a host-authored status note into the chat. */
 function restartNoteWriter(
-  host: Pick<StructuredAgentSessionContinuationHost, 'sessions' | 'publish' | 'now'>
+  host: Pick<StructuredAgentSessionContinuationHost, 'sessions' | 'conversationFence' | 'now'>
 ): StructuredAgentSessionContinuationDeps['note'] {
   return async (sessionId, text, tone) => {
     const session = host.sessions.get(sessionId)
-    if (!session) {
+    const fence = host.conversationFence(sessionId)
+    if (!session || fence === null) {
       return
     }
     await session.journal.appendItem(
       { provider: 'orca', clientMessageId: `restart-continuation:${sessionId}:${host.now()}` },
       { kind: 'status', text, ...(tone ? { tone } : {}) },
-      { fence: session.fence }
+      { fence }
     )
-    host.publish(sessionId, session.journal)
   }
 }
 
@@ -131,60 +125,25 @@ const OWNERSHIP_REFUSALS = new Set([
   'execution_owner_reconciling'
 ])
 
+/** The user's own message was accepted first; the offer is spent, and nothing failed. */
+export const RESTART_CONTINUATION_SUPERSEDED = 'agent_session_restart_work_superseded'
+
 /** Only this pre-dispatch failure proves a thrown send did not deliver. */
 export class RestartContinuationSupersededError extends AgentSessionPreDispatchError {
   constructor() {
-    super('agent_session_restart_work_superseded')
+    super(RESTART_CONTINUATION_SUPERSEDED)
     this.name = 'RestartContinuationSupersededError'
   }
 }
 
-/** The message body, built once so both the send and any test read the same text. */
-export function restartContinuationBody(marker: AgentSessionResumeMarker): AgentJournalMessageItem {
-  return {
-    kind: 'message',
-    role: 'user',
-    blocks: [{ type: 'text', text: restartContinuationMessage(marker) }]
-  }
-}
-
-/** The fence is read AFTER the reconnect: reattaching mints a new one, and the pre-reconnect value
- *  would be refused by the mutation admission. */
-export function restartContinuationEnvelope(
-  sessionId: string,
-  fence: number,
-  marker: AgentSessionResumeMarker
-): { envelope: AgentSessionMutationEnvelope; body: AgentJournalMessageItem } {
-  const body = restartContinuationBody(marker)
-  return {
-    body,
-    envelope: {
-      sessionId,
-      // The same interrupted work must reach the durable ledger with the same message identity.
-      clientOperationId: `${marker.recordedAt.toString().padStart(13, '0')}-${createHash('sha256')
-        .update(
-          JSON.stringify([
-            marker.teardownId,
-            sessionId,
-            marker.work.kind,
-            marker.work.id,
-            marker.providerHandleRoot
-          ])
-        )
-        .digest('hex')
-        .slice(0, 32)}`,
-      expectedRuntimeFence: fence,
-      payloadFingerprint: computeAgentSessionPayloadFingerprint({
-        method: 'agentSession.send',
-        sessionId,
-        fields: { body }
-      })
-    }
-  }
+type ContinuationSubmission = {
+  dispatchState?: string
+  reason?: string | null
+  rejection?: UnreadAgentSessionFailureFact
 }
 
 export type StructuredAgentSessionContinuationDeps = {
-  /** Runtime fence as it stands now; null when the session is not attached. */
+  /** Runtime fence as it stands now; null when this host has no record of the session. */
   currentFence: (sessionId: string) => number | null
   send: (input: {
     envelope: AgentSessionMutationEnvelope
@@ -205,7 +164,13 @@ export type StructuredAgentSessionContinuationDeps = {
   awaitSettlement: (
     sessionId: string,
     clientMessageId: string
-  ) => Promise<{ dispatchState?: string; reason?: string | null } | undefined>
+  ) => Promise<ContinuationSubmission | undefined>
+  /** Waits until the send is handed to a started agent or rejected. Undefined when the wait ended
+   *  first — the session closed, or too many waited — which proves neither. */
+  awaitHandedOver: (
+    sessionId: string,
+    clientMessageId: string
+  ) => Promise<ContinuationSubmission | undefined>
   /** Records a host-authored journal note: that this send was Orca's, not the user's, or that the
    *  chat did not carry on. `tone` is a display hint older clients render as plain text. */
   note: (sessionId: string, text: string, tone?: 'error' | 'warning') => Promise<void>
@@ -214,26 +179,61 @@ export type StructuredAgentSessionContinuationDeps = {
   onNoteFailed: (sessionId: string, error: unknown) => void
 }
 
+/** A continuation handed to its agent, or already decided. */
+export type StartedStructuredAgentSessionContinuation =
+  | { done: StructuredAgentSessionContinuationOutcome }
+  | { verdict: () => Promise<StructuredAgentSessionContinuationOutcome> }
+
 /**
- * Sends the continuation to ONE already-reconnected session.
- *
- * The caller must have reconnected it first: this deliberately does not reconnect, so that every
- * eligibility check, the admission gate and the consume-once ordering stay in the resume path and
- * are not re-implemented here.
+ * Sends the continuation to ONE session and returns once the agent has taken it or its start
+ * failed — the point a restart batch counts a start as done. What the provider then answered is
+ * the `verdict`, awaited separately so a slow answer does not hold the batch.
  */
-export async function continueStructuredAgentSessionAfterRestart(
+export async function startStructuredAgentSessionContinuation(
   deps: StructuredAgentSessionContinuationDeps,
   sessionId: string,
-  marker: AgentSessionResumeMarker
-): Promise<StructuredAgentSessionContinuationOutcome> {
-  let result: StructuredAgentSessionContinuationOutcome
+  marker: AgentSessionResumeMarker,
+  /** This action's continuation, as its offer recorded it. */
+  continuationId: string
+): Promise<StartedStructuredAgentSessionContinuation> {
+  let started: StartedStructuredAgentSessionContinuation
   try {
-    result = await sendContinuation(deps, sessionId, marker)
+    started = await sendContinuation(deps, sessionId, marker, continuationId)
   } catch (error) {
-    await noteNotContinued(deps, sessionId, 'refused')
+    // The user's own message came first: nothing failed, so the chat says nothing.
+    if (!(error instanceof RestartContinuationSupersededError)) {
+      await noteNotContinued(deps, sessionId, 'refused')
+    }
     throw error
   }
-  if (result.outcome !== 'continued') {
+  if ('done' in started) {
+    await noteOutcome(deps, sessionId, started.done)
+    return started
+  }
+  const { verdict } = started
+  return {
+    verdict: async () => {
+      const outcome = await verdict()
+      await noteOutcome(deps, sessionId, outcome)
+      return outcome
+    }
+  }
+}
+
+async function noteOutcome(
+  deps: Pick<StructuredAgentSessionContinuationDeps, 'note' | 'onNoteFailed'>,
+  sessionId: string,
+  result: StructuredAgentSessionContinuationOutcome
+): Promise<void> {
+  if (result.outcome === 'continued') {
+    // Only an accepted dispatch gets the note: it is a durable claim that Orca asked this agent to
+    // carry on. Best effort — losing it must not turn a delivered continuation into a failure.
+    try {
+      await deps.note(sessionId, AGENT_SESSION_RESTART_CONTINUATION_NOTE)
+    } catch (error) {
+      deps.onNoteFailed(sessionId, error)
+    }
+  } else {
     await noteNotContinued(
       deps,
       sessionId,
@@ -244,7 +244,6 @@ export async function continueStructuredAgentSessionAfterRestart(
           : 'refused'
     )
   }
-  return result
 }
 
 /** The chat itself carries the failure, so it survives the toast, a dismissed record and a restart,
@@ -272,13 +271,14 @@ async function noteNotContinued(
 async function sendContinuation(
   deps: StructuredAgentSessionContinuationDeps,
   sessionId: string,
-  marker: AgentSessionResumeMarker
-): Promise<StructuredAgentSessionContinuationOutcome> {
+  marker: AgentSessionResumeMarker,
+  continuationId: string
+): Promise<StartedStructuredAgentSessionContinuation> {
   const fence = deps.currentFence(sessionId)
   if (fence === null) {
-    return { sessionId, outcome: 'refused', reason: 'agent_session_not_attached' }
+    return { done: { sessionId, outcome: 'refused', reason: 'agent_session_not_attached' } }
   }
-  const { envelope, body } = restartContinuationEnvelope(sessionId, fence, marker)
+  const { envelope, body } = restartContinuationEnvelope(sessionId, fence, marker, continuationId)
   const sent = await deps.send({ envelope, body }).catch((error: unknown) => {
     if (error instanceof AgentSessionPreDispatchError) {
       throw error
@@ -288,46 +288,64 @@ async function sendContinuation(
     return null
   })
   if (!sent) {
-    return { sessionId, outcome: 'unknown' }
+    return { done: { sessionId, outcome: 'unknown' } }
   }
   if (!sent.ok) {
     return {
-      sessionId,
-      outcome: 'refused',
-      reason: sent.refusal?.code ?? 'agent_session_send_failed'
+      done: {
+        sessionId,
+        outcome: 'refused',
+        reason: sent.refusal?.code ?? 'agent_session_send_failed'
+      }
     }
   }
-  // The send result carries the dispatch as it stood when Orca took the message, which for a normal
-  // successful send is `pending`. Judging it here would report every delivered continuation as
-  // pending and never write the note, so the settled value is what decides.
-  const submission =
-    (await deps.awaitSettlement(sessionId, envelope.clientOperationId).catch(() => undefined)) ??
-    sent.value?.submission
+  const clientMessageId = envelope.clientOperationId
+  const handedOver = await deps.awaitHandedOver(sessionId, clientMessageId).catch(() => undefined)
+  if (handedOver?.dispatchState === 'rejected') {
+    return { done: refusedBy(sessionId, handedOver) }
+  }
+  return {
+    verdict: async () =>
+      verdictOf(
+        sessionId,
+        // The send result carries the dispatch as it stood when Orca took the message, which for
+        // a normal successful send is `pending`, so the settled value is what decides.
+        (await deps.awaitSettlement(sessionId, clientMessageId).catch(() => undefined)) ??
+          handedOver ??
+          sent.value?.submission
+      )
+  }
+}
+
+function refusedBy(
+  sessionId: string,
+  submission: ContinuationSubmission
+): StructuredAgentSessionContinuationOutcome {
+  // A start the agent was refused files that refusal's code, which the failure guidance keys on.
+  const refusal = readAgentSessionFailureFact(submission.rejection)?.refusal
+  return {
+    sessionId,
+    outcome: 'refused',
+    reason: refusal?.code ?? submission.reason ?? 'agent_session_dispatch_rejected',
+    ...(refusal ? { refusal } : {})
+  }
+}
+
+function verdictOf(
+  sessionId: string,
+  submission: ContinuationSubmission | undefined
+): StructuredAgentSessionContinuationOutcome {
   const dispatch = submission?.dispatchState
-  if (dispatch === 'rejected') {
-    return {
-      sessionId,
-      outcome: 'refused',
-      reason: submission?.reason ?? 'agent_session_dispatch_rejected'
-    }
+  if (submission && dispatch === 'rejected') {
+    return refusedBy(sessionId, submission)
   }
   if (dispatch === 'pending') {
     // Still pending after settlement gave up: handed off, never confirmed.
     return { sessionId, outcome: 'pending' }
   }
-  if (dispatch !== 'accepted') {
-    // `unknown`, or a peer that reported no state at all. Delivery is unverifiable, so this claims
-    // neither success nor failure — and writes no note saying the agent was asked to continue.
-    return { sessionId, outcome: 'unknown' }
-  }
-  // Only an accepted dispatch gets the note: it is a durable claim that Orca asked this agent to
-  // carry on, and it must not sit beside a message the provider refused or never confirmed. Best
-  // effort beyond that — losing the note must not turn a delivered continuation into a failure —
-  // but reported, never swallowed.
-  try {
-    await deps.note(sessionId, AGENT_SESSION_RESTART_CONTINUATION_NOTE)
-  } catch (error) {
-    deps.onNoteFailed(sessionId, error)
-  }
-  return { sessionId, outcome: 'continued' }
+  // `unknown`, or a peer that reported no state at all: delivery is unverifiable, so this claims
+  // neither success nor failure — and writes no note saying the agent was asked to continue.
+  return dispatch === 'accepted'
+    ? { sessionId, outcome: 'continued' }
+    : { sessionId, outcome: 'unknown' }
 }
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-failure-filing.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-failure-filing.test.ts
index 5dcc3ca7690c..f1fe0a40b421 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-failure-filing.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-failure-filing.test.ts
@@ -2,21 +2,18 @@ import { afterEach, expect, it, vi } from 'vitest'
 import { AgentSessionRecoveryCapsule } from '../../runtime/agent-session-recovery-capsule'
 import {
   AGENT_SESSION_RESTART_CONTINUATION_REFUSED_NOTE,
-  AGENT_SESSION_RESTART_CONTINUATION_UNCONFIRMED_NOTE,
-  AGENT_SESSION_RESTART_NOT_CONNECTED_NOTE
+  AGENT_SESSION_RESTART_CONTINUATION_UNCONFIRMED_NOTE
 } from '../../../shared/agent-session-restart-continuation'
-import { agentJournalSubmissionKey } from '../../../shared/agent-session-journal-item-key'
-import { AgentSessionJournal } from '../agent-session-journal/journal-store'
-import { latestStructuredAgentSessionUserItem } from '../../../shared/structured-agent-session-projection'
 import { StructuredAgentSessionResumeAdmission } from './structured-agent-session-restart-resume-runner'
+import { STRUCTURED_AGENT_SESSION_RESTART_CONTINUATION_CALLER } from './structured-agent-session-restart-resume-wiring'
 import {
   interruptedRestart,
   statusNotes
 } from './structured-agent-session-restart-interruption-test-harness'
+import { CALLER, envelope } from './structured-agent-session-host-test-harness'
 import {
   HOST_TEST_NOW as NOW,
   HOST_TEST_SESSION as SESSION,
-  HOST_TEST_THREAD as THREAD,
   hostTestMessage
 } from './structured-agent-session-host-test-data'
 
@@ -24,206 +21,71 @@ import {
 
 afterEach(() => vi.restoreAllMocks())
 
-function providerEvents(acquire: Awaited<ReturnType<typeof interruptedRestart>>['acquire']) {
-  const events = acquire.mock.calls[0]?.[0].events
-  if (!events) {
-    throw new Error('missing resumed provider event sink')
-  }
-  return events
-}
-
-// The reported case: after the reattach the provider replays a queued message, which the chat
-// journals as a newer user turn, so the continuation is refused just before dispatch.
-it('files a continuation superseded by a replayed message, lists it and says so in the chat', async () => {
-  const { host, acquire, dispatch, root } = await interruptedRestart()
-  await host.restartResume.list()
-  await host.hold(SESSION, 'pane')
-  const events = providerEvents(acquire)
-  const append = AgentSessionJournal.prototype.appendSubmission
-  vi.spyOn(AgentSessionJournal.prototype, 'appendSubmission').mockImplementationOnce(
-    async function (this: AgentSessionJournal, input) {
-      const cursor = await append.call(this, input)
-      events.appendItem(
-        { provider: 'codex', threadId: THREAD, turnId: 'replayed-turn', ordinal: 1 },
-        hostTestMessage('A queued notification the provider replayed')
-      )
-      return cursor
-    }
-  )
-
-  const result = await host.restartResume.continueAfterRestart([SESSION], 'modal')
-
-  expect(dispatch).not.toHaveBeenCalled()
-  expect(result.resumed).toMatchObject([
-    { outcome: 'refused', reason: 'agent_session_restart_work_superseded' }
-  ])
-  const failure = {
-    sessionId: SESSION,
-    outcome: 'refused',
-    reason: 'agent_session_restart_work_superseded'
-  }
-  expect(result.failed).toMatchObject([failure])
-  expect(await host.restartResume.listFailures()).toMatchObject([failure])
-  expect(await new AgentSessionRecoveryCapsule(root).listFailed(NOW)).toHaveLength(1)
-  expect(statusNotes(host)).toContainEqual({
-    text: AGENT_SESSION_RESTART_CONTINUATION_REFUSED_NOTE,
-    tone: 'error'
-  })
-  host.release(SESSION, 'pane')
-})
-
-// Nothing was attempted and nothing is owed: the user moved on between listing and acting.
+// Nothing was owed once the user's own message came first: the offer is spent and nothing is filed.
 it('files nothing for a chat the user moved on in before its attempt, and spends the offer', async () => {
-  const { host, acquire, root } = await interruptedRestart()
+  const { host, root, dispatch } = await interruptedRestart()
   await host.restartResume.list()
-  await host.hold(SESSION, 'pane')
-  const events = providerEvents(acquire)
   const admit = StructuredAgentSessionResumeAdmission.prototype.run
   vi.spyOn(StructuredAgentSessionResumeAdmission.prototype, 'run').mockImplementationOnce(
     async function (this, ...args) {
-      events.appendItem(
-        { provider: 'codex', threadId: THREAD, turnId: 'newer-turn', ordinal: 1 },
-        hostTestMessage('A newer task from another client')
-      )
-      await host.flushStreamedEvents(SESSION)
+      const body = hostTestMessage('A newer task from another client')
+      await host.send(CALLER, { envelope: envelope('agentSession.send', { body }), body })
       return admit.apply(this, args)
     }
   )
 
   const result = await host.restartResume.continueAfterRestart([SESSION], 'modal')
 
-  expect(result.resumed).toMatchObject([{ reason: 'agent_session_resume_not_eligible' }])
+  expect(result.continued.filter((entry) => entry.outcome === 'continued')).toEqual([])
   expect(result.failed).toEqual([])
+  await vi.waitFor(() => expect(dispatch).toHaveBeenCalledOnce())
   const capsule = new AgentSessionRecoveryCapsule(root)
   expect(await capsule.listFailed(NOW)).toEqual([])
   expect(await capsule.list(NOW)).toEqual([])
-  expect(statusNotes(host)).toEqual([])
-  host.release(SESSION, 'pane')
+  expect(await statusNotes(host)).toEqual([])
 })
 
-it.each(['resume', 'continueAfterRestart'] as const)(
-  'says so in the chat when the reattach itself fails (%s)',
-  async (action) => {
-    const { host, acquire } = await interruptedRestart()
-    await host.restartResume.list()
-    acquire.mockRejectedValueOnce(new Error('provider could not reconnect'))
+// The continuation is accepted and its agent then fails to start: the message is rejected with the
+// cause, the failure is filed, and the chat says the agent did not carry on.
+it('says so in the chat when the agent cannot start for the continuation', async () => {
+  const { host, acquire } = await interruptedRestart()
+  await host.restartResume.list()
+  acquire.mockRejectedValueOnce(new Error('provider could not reconnect'))
 
-    await host.restartResume[action]([SESSION], 'modal')
+  await host.restartResume.continueAfterRestart([SESSION], 'modal')
 
-    expect(await host.restartResume.listFailures()).toMatchObject([
-      { sessionId: SESSION, outcome: 'refused' }
-    ])
-    // The fix depends on why it failed, which the dialog explains; "send a message" would not work.
-    expect(statusNotes(host)).toEqual([
-      { text: AGENT_SESSION_RESTART_NOT_CONNECTED_NOTE, tone: 'error' }
-    ])
-  }
-)
+  expect(await host.restartResume.listFailures()).toMatchObject([
+    { sessionId: SESSION, outcome: 'refused', retryable: true }
+  ])
+  expect(await statusNotes(host)).toContainEqual({
+    text: AGENT_SESSION_RESTART_CONTINUATION_REFUSED_NOTE,
+    tone: 'error'
+  })
+})
 
-/** A continuation the provider accepted whose settlement could not be written: filed unconfirmed. */
-async function unconfirmedContinuation() {
-  const state = await interruptedRestart()
-  const { host, store } = state
+// A send that throws after Orca may have taken it cannot be proven undelivered: filed unconfirmed,
+// and it stays on record while the agent that may be carrying on keeps running.
+it('keeps an unconfirmed failure while the agent the continuation started keeps running', async () => {
+  const { host, store } = await interruptedRestart()
   vi.spyOn(console, 'warn').mockImplementation(() => {})
   await host.restartResume.list()
-  await host.hold(SESSION, 'pane')
   const settle = store.recordOperationOutcome.bind(store)
   vi.spyOn(store, 'recordOperationOutcome').mockImplementation(async (input) => {
-    if (input.outcome.status === 'succeeded') {
+    if (
+      input.callerKey === STRUCTURED_AGENT_SESSION_RESTART_CONTINUATION_CALLER &&
+      input.outcome.status === 'succeeded'
+    ) {
       throw new Error('operation outcome could not be persisted')
     }
     return settle(input)
   })
+
   const result = await host.restartResume.continueAfterRestart([SESSION], 'modal')
+
   expect(result.failed).toMatchObject([{ sessionId: SESSION, outcome: 'unconfirmed' }])
-  expect(statusNotes(host)).toContainEqual({
+  expect(await statusNotes(host)).toContainEqual({
     text: AGENT_SESSION_RESTART_CONTINUATION_UNCONFIRMED_NOTE,
     tone: 'warning'
   })
-  const continuation = host.journalSnapshot(SESSION).submissions.at(-1)
-  const providerItemId = continuation?.providerItemId
-  if (!continuation || !providerItemId) {
-    throw new Error('missing accepted continuation')
-  }
-  return { ...state, continuation, providerItemId, events: providerEvents(state.acquire) }
-}
-
-// The warning asked the user to check the agent's reply; a turn opened by the continuation's own
-// message is that reply starting, however the provider names the message.
-it.each(['submission key', 'provider key'] as const)(
-  'retires an unconfirmed failure once the continuation opens a turn (%s)',
-  async (naming) => {
-    const { host, root, continuation, providerItemId, events } = await unconfirmedContinuation()
-    events.appendItem(
-      { provider: 'codex', threadId: THREAD, turnId: 'continued-turn', ordinal: 1 },
-      {
-        kind: 'turn',
-        turnId: 'continued-turn',
-        state: 'running',
-        userItemId:
-          naming === 'submission key'
-            ? agentJournalSubmissionKey(continuation.clientMessageId)
-            : providerItemId
-      },
-      { lifecycle: true }
-    )
-    await host.flushStreamedEvents(SESSION)
-
-    expect(await host.restartResume.listFailures()).toEqual([])
-    await vi.waitFor(async () => {
-      expect(await new AgentSessionRecoveryCapsule(root).listFailed(NOW)).toEqual([])
-    })
-    host.release(SESSION, 'pane')
-  }
-)
-
-it('keeps an unconfirmed failure while the newest turn is not the continuation’s', async () => {
-  const { host, events } = await unconfirmedContinuation()
-  // Provider output opened this turn, keyed by its own row rather than by any user message.
-  events.appendItem(
-    { provider: 'codex', threadId: THREAD, turnId: 'provider-turn', ordinal: 1 },
-    { kind: 'turn', turnId: 'provider-turn', state: 'running', userItemId: 'provider-turn-row' },
-    { lifecycle: true }
-  )
-  await host.flushStreamedEvents(SESSION)
-
-  expect(await host.restartResume.listFailures()).toMatchObject([{ outcome: 'unconfirmed' }])
-  host.release(SESSION, 'pane')
-})
-
-// Nothing journaled the continuation, so the newest user message is still the interrupted one and
-// the turn it opened is the interrupted work reporting in, not the agent carrying on.
-it('keeps an unconfirmed failure whose continuation was never journaled while the interrupted turn runs', async () => {
-  const { host, acquire, store, marker } = await interruptedRestart('submission', false)
-  vi.spyOn(console, 'warn').mockImplementation(() => {})
-  await host.restartResume.list()
-  await host.hold(SESSION, 'pane')
-  const events = providerEvents(acquire)
-  events.appendItem(
-    { provider: 'codex', threadId: THREAD, turnId: 'original-turn', ordinal: 1 },
-    hostTestMessage('Perform the original task')
-  )
-  await host.flushStreamedEvents(SESSION)
-  // A send that throws before recording anything cannot be proven undelivered.
-  vi.spyOn(store, 'admitMutationOperation').mockRejectedValueOnce(new Error('store unavailable'))
-  const result = await host.restartResume.continueAfterRestart([SESSION], 'modal')
-  expect(result.failed).toMatchObject([{ sessionId: SESSION, outcome: 'unconfirmed' }])
-  const submissions = host.journalSnapshot(SESSION).submissions
-  const original = submissions[0]?.providerItemId
-  if (submissions.length !== 1 || !original) {
-    throw new Error('expected only the original submission, accepted by the provider')
-  }
-  expect(latestStructuredAgentSessionUserItem(host.journalSnapshot(SESSION).items)?.itemId).toBe(
-    marker?.latestUserItemId
-  )
-
-  events.appendItem(
-    { provider: 'codex', threadId: THREAD, turnId: 'original-turn', ordinal: 2 },
-    { kind: 'turn', turnId: 'original-turn', state: 'running', userItemId: original },
-    { lifecycle: true }
-  )
-  await host.flushStreamedEvents(SESSION)
-
   expect(await host.restartResume.listFailures()).toMatchObject([{ outcome: 'unconfirmed' }])
-  host.release(SESSION, 'pane')
 })
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-failure-ledger.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-failure-ledger.ts
index 3b8fad40de09..ee769b9e8c33 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-failure-ledger.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-failure-ledger.ts
@@ -4,9 +4,8 @@
 // the offer, so without this record nothing durable would point at the chat the user has to
 // continue by hand. The capsule holds the record; this decides what goes in and when it leaves.
 //
-// Whether a record is still current is derived, never cached: it is current only while the chat's
-// newest user message is the one it had when the failure was filed. The user's own send, from any
-// client, therefore retires it without a hook on the send path.
+// A record ends when the chat's agent is started again outside a resume action — the host retires
+// it at that start, with the offer — or by a successful retry, or a dismissal.
 
 import type {
   AgentSessionRecoveryCapsule,
@@ -18,19 +17,10 @@ import type {
   AgentSessionResumeFailureOutcome,
   AgentSessionResumeMarker
 } from '../../../shared/agent-session-resume-marker'
-import type { AgentJournalSnapshot } from '../../../shared/agent-session-journal-types'
-import { agentJournalSubmissionKey } from '../../../shared/agent-session-journal-item-key'
-import { isRootAgentJournalItem } from '../../../shared/agent-session-journal-producer'
-import { readAgentJournalTurn } from '../../../shared/agent-session-turn-record'
-import { latestStructuredAgentSessionUserItem } from '../../../shared/structured-agent-session-projection'
 import { normalizeOptionalField } from '../../../shared/agent-status-field-normalization'
 import { AGENT_MODEL_MAX_LENGTH } from '../../../shared/agent-status-types'
 import type { StructuredAgentSessionAdapter } from './structured-agent-session-adapter'
 import { adapterSupportsRecord } from './structured-agent-session-provider-support'
-import {
-  liveStructuredAgentSessionLatestUserItemId,
-  type StructuredAgentSessionRestartJournalSource
-} from './structured-agent-session-restart-candidates'
 import type { StructuredAgentSessionContinuationOutcome } from './structured-agent-session-restart-continuation'
 import type {
   StructuredAgentSessionResumeCandidate,
@@ -40,37 +30,18 @@ import {
   STRUCTURED_AGENT_SESSION_RESUME_NOT_ELIGIBLE,
   type StructuredAgentSessionResumeOutcome
 } from './structured-agent-session-restart-resume-runner'
+import { RESTART_CONTINUATION_SUPERSEDED } from './structured-agent-session-restart-continuation'
 
 type FailureCapsule = Pick<
   AgentSessionRecoveryCapsule,
-  | 'listFailed'
-  | 'completeResume'
-  | 'failResume'
-  | 'rollbackResume'
-  | 'dismiss'
-  | 'clearAll'
-  | 'forgetSuperseded'
+  'listFailed' | 'completeResume' | 'failResume' | 'rollbackResume' | 'dismiss' | 'clearAll'
 >
 
-/** What a failure is filed against: the chat's newest user message as its own attempt ended. Kept
- *  per chat rather than read at settlement, because the rest of a batch can take a while and a
- *  message the user sends meanwhile answers the failure rather than belongs to it. */
-export type StructuredAgentSessionRestartAttempts = {
-  observe: (sessionId: string) => void
-  latestUserItemId: (sessionId: string) => string | null
-}
-
 export type StructuredAgentSessionRestartFailureLedger = {
   /** The stored records, current or not. */
   read: () => Promise<AgentSessionResumeFailureRecord[]>
-  /** The current records as rows a surface can show; sessions this host no longer holds are left
-   *  out, and records the chat has since superseded are dropped and pruned. */
+  /** The records as rows a surface can show; sessions this build cannot run are left out. */
   list: () => Promise<StructuredAgentSessionResumeFailure[]>
-  /** One action's attempts; a chat never observed after an attempt falls back to its reserved
-   *  marker. */
-  attempts: (
-    markers: ReadonlyMap<string, AgentSessionResumeMarker>
-  ) => StructuredAgentSessionRestartAttempts
   /** Settles one operation's reservations: the agent carried on, or the failure is filed. Rows the
    *  operation still owns after that are reopened. */
   settle: (
@@ -78,7 +49,8 @@ export type StructuredAgentSessionRestartFailureLedger = {
     outcomes: readonly StructuredAgentSessionResumeOutcome[],
     action: {
       candidates: readonly StructuredAgentSessionResumeCandidate[]
-      attempts: StructuredAgentSessionRestartAttempts
+      /** The reserved markers; a failure carries its marker's message id for older readers. */
+      markers: ReadonlyMap<string, AgentSessionResumeMarker>
       /** How a reattached session's action ended; null when the agent carried on. Reattaching alone
        *  is not the whole action, so the runner's own outcome cannot decide this. */
       failureAfterResume: (sessionId: string) => AgentSessionResumeFailureOutcome | null
@@ -99,54 +71,14 @@ export function continuationFailureOutcome(
   return outcome === 'continued' ? null : outcome === 'refused' ? 'refused' : 'unconfirmed'
 }
 
-/** Whether the chat itself has moved past a failure: a newer user message, or, for a delivery
- *  nobody confirmed, a turn the continuation's own message opened. */
-function failureAnsweredByChat(
-  failure: AgentSessionResumeFailureRecord,
-  snapshot: AgentJournalSnapshot
-): boolean {
-  const latest = latestStructuredAgentSessionUserItem(snapshot.items)?.itemId ?? null
-  if (latest !== failure.latestUserItemId) {
-    return true
-  }
-  // Only when the continuation's message was journaled: otherwise the newest user message is the
-  // interrupted one, whose own turn proves nothing about the continuation.
-  return (
-    failure.outcome === 'unconfirmed' &&
-    latest !== null &&
-    latest !== failure.marker.latestUserItemId &&
-    newestTurnUserItemId(snapshot) === latest
-  )
-}
-
-/** The user message that opened the newest root turn, resolved through a provider key the send was
- *  accepted under. */
-function newestTurnUserItemId(snapshot: AgentJournalSnapshot): string | null {
-  for (let index = snapshot.items.length - 1; index >= 0; index -= 1) {
-    const item = snapshot.items[index]
-    const turn = isRootAgentJournalItem(item) ? readAgentJournalTurn(item?.body) : null
-    if (!turn) {
-      continue
-    }
-    const key = turn.userItemId
-    if (key === undefined) {
-      return null
-    }
-    const accepted = snapshot.submissions.find((entry) => entry.providerItemId === key)
-    return accepted ? agentJournalSubmissionKey(accepted.clientMessageId) : key
-  }
-  return null
-}
-
 export function createStructuredAgentSessionRestartFailureLedger(deps: {
   capsule?: FailureCapsule
-  sessions: ReadonlyMap<string, StructuredAgentSessionRestartJournalSource>
-  /** Makes a persisted chat's journal readable here, as listing an offer does. */
-  reveal: (sessionId: string) => Promise<void>
   getRecord: (sessionId: string) => AgentSessionRecord | null
   adapter: StructuredAgentSessionAdapter
   /** The predicate a retry applies to the failure's marker. */
   retryable: (marker: AgentSessionResumeMarker) => boolean
+  /** Makes the failed chats readable here, so `retryable` reads each one's journal. */
+  reveal: (markers: readonly AgentSessionResumeMarker[]) => Promise<void>
   now: () => number
   /** The capsule's single mutation lane, shared with the offer's own operations. */
   enqueue: <T>(operation: () => Promise<T>) => Promise<T>
@@ -184,41 +116,16 @@ export function createStructuredAgentSessionRestartFailureLedger(deps: {
         failedAt: failure.failedAt,
         outcome: failure.outcome,
         reason: failure.reason,
+        ...(failure.details ? { details: failure.details } : {}),
         retryable: deps.retryable(failure.marker)
       }
     ]
   }
 
   const list = async (): Promise<StructuredAgentSessionResumeFailure[]> => {
-    const current: AgentSessionResumeFailureRecord[] = []
-    const superseded: AgentSessionResumeFailureRecord[] = []
-    for (const failure of await read()) {
-      const sessionId = failure.marker.sessionId
-      if (!deps.sessions.has(sessionId)) {
-        await deps.reveal(sessionId)
-      }
-      const snapshot = deps.sessions.get(sessionId)?.journal.snapshot()
-      // An unreadable journal decides nothing; the record stays until something that can decide.
-      if (snapshot && failureAnsweredByChat(failure, snapshot)) {
-        superseded.push(failure)
-      } else {
-        current.push(failure)
-      }
-    }
-    const capsule = deps.capsule
-    if (capsule && superseded.length > 0) {
-      const gone = superseded.map((failure) => ({
-        sessionId: failure.marker.sessionId,
-        recordedAt: failure.marker.recordedAt,
-        failedAt: failure.failedAt
-      }))
-      void deps
-        .enqueue(() => capsule.forgetSuperseded(gone, deps.now()))
-        .catch(() => {
-          console.warn('[structured-agent-session] pruning superseded restart failures failed')
-        })
-    }
-    return current.flatMap(toRow)
+    const failures = await read()
+    await deps.reveal(failures.map((failure) => failure.marker))
+    return failures.flatMap(toRow)
   }
 
   const settle: StructuredAgentSessionRestartFailureLedger['settle'] = async (
@@ -232,16 +139,22 @@ export function createStructuredAgentSessionRestartFailureLedger(deps: {
     }
     const completed: string[] = []
     const failures: AgentSessionResumeFailureInput[] = []
-    const promptBySession = new Map(
-      action.candidates.map((candidate) => [candidate.sessionId, candidate.latestPrompt])
-    )
+    // A retry keeps the prompt its first failure named: the chat's newest user message since then
+    // is the rejected continuation, and a message of the user's own would have ended the offer.
+    const promptBySession = new Map([
+      ...action.candidates.map(
+        (candidate) => [candidate.sessionId, candidate.latestPrompt] as const
+      ),
+      ...(await read()).map((filed) => [filed.marker.sessionId, filed.latestPrompt] as const)
+    ])
     for (const outcome of outcomes) {
       const resumed = outcome.outcome === 'resumed'
-      // Ineligible means the user moved on or the offer no longer applies (record gone,
-      // conversation forked), so there is nothing to retry and the offer is spent.
+      // Ineligible means the offer no longer applies (record gone, conversation forked), and
+      // superseded means the user's own message came first: nothing to retry, and the offer is spent.
       const failure = resumed
         ? action.failureAfterResume(outcome.sessionId)
-        : outcome.reason === STRUCTURED_AGENT_SESSION_RESUME_NOT_ELIGIBLE
+        : outcome.reason === STRUCTURED_AGENT_SESSION_RESUME_NOT_ELIGIBLE ||
+            outcome.reason === RESTART_CONTINUATION_SUPERSEDED
           ? null
           : 'refused'
       if (failure === null) {
@@ -255,8 +168,9 @@ export function createStructuredAgentSessionRestartFailureLedger(deps: {
         reason: resumed
           ? action.failureReason(outcome.sessionId)
           : (outcome.reason ?? 'agent_session_resume_refused'),
+        ...(!resumed && outcome.details ? { details: outcome.details } : {}),
         latestPrompt: promptBySession.get(outcome.sessionId) ?? '',
-        latestUserItemId: action.attempts.latestUserItemId(outcome.sessionId)
+        latestUserItemId: action.markers.get(outcome.sessionId)?.latestUserItemId ?? null
       })
     }
     await deps
@@ -280,27 +194,9 @@ export function createStructuredAgentSessionRestartFailureLedger(deps: {
       })
   }
 
-  const attempts: StructuredAgentSessionRestartFailureLedger['attempts'] = (markers) => {
-    const observed = new Map<string, string | null>()
-    return {
-      // Observed after the attempt, so the continuation's own message is part of the filed state.
-      observe: (sessionId) => {
-        const latest = liveStructuredAgentSessionLatestUserItemId(deps.sessions, sessionId)
-        if (latest !== undefined) {
-          observed.set(sessionId, latest)
-        }
-      },
-      latestUserItemId: (sessionId) => {
-        const latest = observed.get(sessionId)
-        return latest !== undefined ? latest : (markers.get(sessionId)?.latestUserItemId ?? null)
-      }
-    }
-  }
-
   return {
     read,
     list,
-    attempts,
     settle,
     dismiss: (sessionIds, beforeClearAll) =>
       deps.enqueue(async () => {
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-interruption-test-harness.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-interruption-test-harness.ts
index 1bcb27ca4a2e..d88a6330e789 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-interruption-test-harness.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-interruption-test-harness.ts
@@ -10,8 +10,8 @@ import {
 } from '../../runtime/agent-session-recovery-capsule'
 import { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
 import { parseAgentSessionResumeMarker } from '../../../shared/agent-session-resume-marker'
-import { AgentSessionJournal } from '../agent-session-journal/journal-store'
 import { StructuredAgentSessionHost } from './structured-agent-session-host'
+import type { StructuredAgentSessionHostDeps } from './structured-agent-session-host-types'
 import { StructuredAgentSessionResumeAdmission } from './structured-agent-session-restart-resume-runner'
 import {
   adapter,
@@ -25,14 +25,30 @@ import {
   HOST_TEST_NOW as NOW,
   HOST_TEST_SESSION as SESSION,
   HOST_TEST_THREAD as THREAD,
+  hostTestAttachParams,
   hostTestMessage
 } from './structured-agent-session-host-test-data'
 
-export const GRACE = 15_000
+/** Starts the agent explicitly — the attach a client's ensure makes — for a test that needs a
+ *  running child before its next step. Nothing else starts one ahead of a send. */
+export async function startAgent(state: {
+  host: StructuredAgentSessionHost
+  store: AgentSessionRecordStore
+}): Promise<void> {
+  const result = await state.host.attach(
+    CALLER,
+    hostTestAttachParams(state.store.getRecord(SESSION)?.lease.runtimeFence ?? null)
+  )
+  expect(result.ok).toBe(true)
+}
 
 export async function interruptedRestart(
   work: 'turn' | 'submission' | 'send-after-reply' | 'children' = 'turn',
-  historyBoundaryConsistent = true
+  historyBoundaryConsistent = true,
+  /** What the restarted host proves about the recorded owner; gone unless a test says otherwise. */
+  probeOwner: NonNullable<StructuredAgentSessionHostDeps['probeOwner']> = async () => ({
+    outcome: 'pid-absent'
+  })
 ) {
   const previous = hostTestState()
   await attach()
@@ -52,6 +68,8 @@ export async function interruptedRestart(
     previous.dispatch.mockResolvedValueOnce({ state: 'admitted' })
     const body = hostTestMessage('Perform the original task')
     await previous.host.send(CALLER, { envelope: envelope('agentSession.send', { body }), body })
+    // Accepted first, handed over after: the work in flight is a send the provider took.
+    await vi.waitFor(() => expect(previous.dispatch).toHaveBeenCalledOnce())
   } else if (work === 'children') {
     events.appendItem(
       { provider: 'codex', threadId: THREAD, turnId: 'settled-turn', ordinal: 1 },
@@ -97,6 +115,8 @@ export async function interruptedRestart(
     hostId: 'local'
   })
   const closeSession = vi.fn(async () => true)
+  // The relaunch comes after the quit that recorded the offer.
+  const clock = { now: NOW + 1 }
   const host = new StructuredAgentSessionHost({
     store,
     adapter: {
@@ -115,10 +135,9 @@ export async function interruptedRestart(
     journalRoot: previous.root,
     claimKeyId: 'key-1',
     mintSpawnToken: () => 'spawn-next',
-    probeOwner: async () => ({ outcome: 'pid-absent' }),
+    probeOwner,
     recoveryCapsule: new AgentSessionRecoveryCapsule(previous.root),
-    releaseGraceMs: GRACE,
-    now: () => NOW
+    now: () => clock.now
   })
   replaceHostTestState({ store, host })
   previous.acquire.mockClear()
@@ -128,43 +147,34 @@ export async function interruptedRestart(
     await readFile(join(previous.root, AGENT_SESSION_RECOVERY_CAPSULE_FILE), 'utf8')
   )
   const marker = parseAgentSessionResumeMarker(capsule.entries[0]?.marker)
-  return { ...hostTestState(), host, store, closeSession, marker }
+  return { ...hostTestState(), host, store, closeSession, marker, clock }
 }
 
-export function statusNotes(host: StructuredAgentSessionHost) {
-  return host
-    .journalSnapshot(SESSION)
-    .items.flatMap((item) =>
-      item.body.kind === 'status' ? [{ text: item.body.text, tone: item.body.tone }] : []
-    )
+export async function statusNotes(host: StructuredAgentSessionHost) {
+  return (await host.journalSnapshot(SESSION)).items.flatMap((item) =>
+    item.body.kind === 'status' ? [{ text: item.body.text, tone: item.body.tone }] : []
+  )
 }
 
-/** A reattach that succeeds and a continuation the host refuses: a message from another client
- *  lands while the continuation is being recorded. `userAnswers` has the user reply in the chat
- *  just before or after its own attempt, while the rest of a batch would still be running. */
+/** A continuation the host refuses because the user's own message was accepted first: another
+ *  client's send lands after the action reserved the offer, just before the continuation is
+ *  accepted. `userAnswers` instead has the user send before or after the whole attempt. */
 export async function supersededRefusal(userAnswers?: 'before' | 'after') {
-  const { host, acquire, dispatch, root } = await interruptedRestart()
+  const { host, store, acquire, dispatch, root } = await interruptedRestart()
   await host.restartResume.list()
-  await host.hold(SESSION, 'pane')
-  const events = acquire.mock.calls[0]?.[0].events
-  if (!events) {
-    throw new Error('missing resumed provider event sink')
+  const body = hostTestMessage('A newer task from another client')
+  const answer = () =>
+    host.send(CALLER, { envelope: envelope('agentSession.send', { body }), body })
+  const send = host.send
+  const writing = vi.spyOn(host, 'send')
+  if (!userAnswers) {
+    writing.mockImplementationOnce(async (caller, params) => {
+      await answer()
+      return send(caller, params)
+    })
   }
-  const append = AgentSessionJournal.prototype.appendSubmission
-  const writing = vi.spyOn(AgentSessionJournal.prototype, 'appendSubmission')
-  writing.mockImplementationOnce(async function (this: AgentSessionJournal, input) {
-    const cursor = await append.call(this, input)
-    events.appendItem(
-      { provider: 'codex', threadId: THREAD, turnId: 'newer-turn', ordinal: 1 },
-      hostTestMessage('A newer task from another client')
-    )
-    return cursor
-  })
   const admit = StructuredAgentSessionResumeAdmission.prototype.run
   const admitting = vi.spyOn(StructuredAgentSessionResumeAdmission.prototype, 'run')
-  const body = hostTestMessage('Carry on from where you stopped')
-  const answer = () =>
-    host.send(CALLER, { envelope: envelope('agentSession.send', { body }), body })
   if (userAnswers) {
     admitting.mockImplementationOnce(async function (this, ...args) {
       await (userAnswers === 'before' ? answer() : null)
@@ -177,9 +187,7 @@ export async function supersededRefusal(userAnswers?: 'before' | 'after') {
   }
   try {
     const result = await host.restartResume.continueAfterRestart([SESSION], 'modal')
-    expect(result.continued).toMatchObject([{ outcome: 'refused' }])
-    expect(dispatch).toHaveBeenCalledTimes(userAnswers ? 1 : 0)
-    return { host, root, result }
+    return { host, store, acquire, dispatch, root, result }
   } finally {
     writing.mockRestore()
     admitting.mockRestore()
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-offer-after-reattach.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-offer-after-reattach.test.ts
index 912594a1737b..032b0e07b2af 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-offer-after-reattach.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-offer-after-reattach.test.ts
@@ -1,99 +1,42 @@
-// An offer across the provider reattaching and rewriting the chat in its own words: a notice turn
-// of its own, restated rows. None of it withdraws the offer or changes the message Resume sends.
+// An offer across a failed attempt and its retry, and across builds: the message Resume sends
+// depends on the marker alone, and each action sends its own.
 
 import { expect, it } from 'vitest'
 import { AgentSessionRecoveryCapsule } from '../../runtime/agent-session-recovery-capsule'
 import { AGENT_SESSION_RESTART_CONTINUATION_MESSAGE } from '../../../shared/agent-session-restart-continuation'
-import { restartContinuationBody } from './structured-agent-session-restart-continuation'
+import { restartContinuationBody } from './structured-agent-session-restart-continuation-envelope'
 import { interruptedRestart } from './structured-agent-session-restart-interruption-test-harness'
 import {
   HOST_TEST_NOW as NOW,
-  HOST_TEST_SESSION as SESSION,
-  HOST_TEST_THREAD as THREAD
+  HOST_TEST_SESSION as SESSION
 } from './structured-agent-session-host-test-data'
 
-function resumedEvents(state: Awaited<ReturnType<typeof interruptedRestart>>) {
-  // The latest acquisition: an earlier one may have been refused.
-  const events = state.acquire.mock.calls.at(-1)?.[0].events
-  if (!events) {
-    throw new Error('missing resumed provider event sink')
-  }
-  return events
-}
-
-// THE REPORTED REFUSAL: opening the chat reattached Claude, which opened a turn of its own to say
-// the previous session did not finish, and closed it. The chat is still offered and Resume sends —
-// including when the offer is a send that had not become a turn, where that closed notice turn is
-// the newest turn in the journal.
-it.each(['turn', 'submission'] as const)(
-  'still offers and continues a %s offer after the provider opens and closes a notice turn',
-  async (work) => {
-    const state = await interruptedRestart(work, false)
-    const { host, dispatch } = state
-    await host.hold(SESSION, 'pane')
-    const events = resumedEvents(state)
-    const notice = { provider: 'codex', threadId: THREAD, turnId: 'notice-turn' } as const
-    events.appendItem(
-      { ...notice, ordinal: 1 },
-      { kind: 'turn', turnId: 'notice-turn', state: 'running', userItemId: 'turn:notice-turn' }
-    )
-    events.appendItem(
-      { ...notice, ordinal: 2 },
-      {
-        kind: 'message',
-        role: 'assistant',
-        blocks: [{ type: 'text', text: "didn't finish before the previous session ended" }]
-      }
-    )
-    events.appendItem(
-      { ...notice, ordinal: 1 },
-      { kind: 'turn', turnId: 'notice-turn', state: 'completed', userItemId: 'turn:notice-turn' }
-    )
-    await host.flushStreamedEvents(SESSION)
-
-    expect(await host.restartResume.list()).toMatchObject([{ sessionId: SESSION }])
-    expect(
-      (await host.restartResume.continueAfterRestart([SESSION], 'modal')).continued
-    ).toMatchObject([{ outcome: 'continued' }])
-    expect(dispatch).toHaveBeenCalledTimes(1)
-    host.release(SESSION, 'pane')
-  }
-)
-
-// A retry after the first attempt never reached the provider, with the rows restated in between:
-// the body depends on the marker alone, so the ledger fingerprint stays the offer's.
-it('sends the same continuation body on a retry after the provider restates its rows', async () => {
-  const state = await interruptedRestart('children')
-  const { host, acquire, dispatch, marker } = state
+// The first attempt's start failed, so its continuation was rejected and never reached the agent.
+// A retry is a new action with a new message, not a replay of the rejected one, and it is
+// delivered with the same body.
+it("delivers a retry as a new continuation after the first one's start failed", async () => {
+  const { host, acquire, dispatch, marker } = await interruptedRestart('children')
   if (!marker) {
     throw new Error('missing interrupted restart marker')
   }
   acquire.mockRejectedValueOnce(new Error('provider could not reconnect'))
-  await host.restartResume.continueAfterRestart([SESSION], 'modal')
-  expect(await host.restartResume.listFailures()).toMatchObject([{ retryable: true }])
+  const first = await host.restartResume.continueAfterRestart([SESSION], 'modal')
+  expect(first.failed).toMatchObject([{ sessionId: SESSION, outcome: 'refused', retryable: true }])
+  const [rejected] = (await host.journalSnapshot(SESSION)).submissions
+  expect(rejected).toMatchObject({ dispatchState: 'rejected' })
 
-  await host.hold(SESSION, 'pane')
-  resumedEvents(state).appendItem(
-    { provider: 'codex', threadId: THREAD, turnId: 'settled-turn', ordinal: 2 },
-    {
-      kind: 'message',
-      role: 'system',
-      blocks: [
-        {
-          type: 'subagent-group',
-          groupId: 'settled-turn',
-          agents: [{ id: 'child-1', label: 'Review loop 4', state: 'completed' }]
-        }
-      ]
-    }
-  )
-  await host.flushStreamedEvents(SESSION)
   const retried = await host.restartResume.continueAfterRestart([SESSION], 'retry')
 
   expect(retried.continued).toMatchObject([{ outcome: 'continued' }])
-  expect(dispatch).toHaveBeenCalledTimes(1)
-  expect(dispatch.mock.calls[0]?.[0].body).toEqual(restartContinuationBody(marker))
-  host.release(SESSION, 'pane')
+  expect(dispatch).toHaveBeenCalledOnce()
+  const sent = dispatch.mock.calls[0]?.[0]
+  expect(sent?.clientMessageId).not.toBe(rejected?.clientMessageId)
+  expect(sent?.body).toEqual(restartContinuationBody(marker))
+  expect((await host.journalSnapshot(SESSION)).submissions).toMatchObject([
+    { clientMessageId: rejected?.clientMessageId, dispatchState: 'rejected' },
+    { clientMessageId: sent?.clientMessageId, dispatchState: 'accepted' }
+  ])
+  expect(retried.failed).toEqual([])
 })
 
 // A marker from a build that recorded only a working lead: no snapshot, so no activity to name,
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-offer-endings.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-offer-endings.test.ts
index 69f6f661c370..aefa34f4b673 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-offer-endings.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-offer-endings.test.ts
@@ -1,10 +1,11 @@
-// The ways an offer ends. Every ending is the user's own act, and every ending DELETES the
-// durable record — nothing stays behind to be re-filtered on every later read.
+// The ways an offer ends. Every ending DELETES the durable record — nothing stays behind to be
+// re-filtered on every later read.
 
 import { expect, it, vi } from 'vitest'
 import { AgentSessionRecoveryCapsule } from '../../runtime/agent-session-recovery-capsule'
-import { StructuredAgentSessionReadableRestorer } from './structured-agent-session-readable-restorer'
+import { rename, writeFile, rm } from 'node:fs/promises'
 import { interruptedRestart } from './structured-agent-session-restart-interruption-test-harness'
+import { journalDirectoryFor } from '../agent-session-journal/journal-paths'
 import { CALLER, envelope } from './structured-agent-session-host-test-harness'
 import {
   HOST_TEST_NOW as NOW,
@@ -12,36 +13,47 @@ import {
   hostTestMessage
 } from './structured-agent-session-host-test-data'
 
-// The user answering the chat themselves is the one signal the offer is moot. The next listing
-// notices and deletes the durable record, not merely hides it.
+// The user's own message starts the chat's agent again, which ends the offer: the durable record
+// is deleted, not merely hidden (R-04).
 it('deletes the offer once the user sends their own message in that chat', async () => {
   const { host, root, dispatch } = await interruptedRestart()
   const capsule = new AgentSessionRecoveryCapsule(root)
   expect(await capsule.list(NOW)).toHaveLength(1)
 
-  await host.hold(SESSION, 'pane')
   dispatch.mockResolvedValueOnce({ state: 'admitted' })
   const body = hostTestMessage('Never mind, do this instead')
   await host.send(CALLER, { envelope: envelope('agentSession.send', { body }), body })
 
+  // Written when the agent's start is proven: a cold start.
+  await vi.waitFor(
+    async () => {
+      expect(await capsule.list(NOW)).toEqual([])
+    },
+    { timeout: 10_000 }
+  )
   expect(await host.restartResume.list()).toEqual([])
-  await vi.waitFor(async () => {
-    expect(await capsule.list(NOW)).toEqual([])
-  })
-  host.release(SESSION, 'pane')
 })
 
-// A journal this host cannot read says nothing about the user moving on, so it must not end the offer.
+// A journal this host cannot read decides nothing, so it must not end the offer.
 it('keeps the offer when the chat cannot be read on this host', async () => {
-  const { host, root } = await interruptedRestart('submission')
+  const { host, root, store } = await interruptedRestart('submission')
   const capsule = new AgentSessionRecoveryCapsule(root)
-  const restoring = vi
-    .spyOn(StructuredAgentSessionReadableRestorer.prototype, 'restoreOne')
-    .mockRejectedValue(new Error('journal unreadable'))
+  const location = store.getRecord(SESSION)?.location
+  if (!location) {
+    throw new Error('missing session record')
+  }
+  // A file where the journal directory belongs: this host cannot open the conversation at all.
+  const journalDir = journalDirectoryFor(root, {
+    workspaceId: location.workspaceId,
+    sessionId: SESSION
+  })
+  await rename(journalDir, `${journalDir}.aside`)
+  await writeFile(journalDir, 'not a journal')
   try {
     expect(await host.restartResume.list()).toMatchObject([{ sessionId: SESSION }])
   } finally {
-    restoring.mockRestore()
+    await rm(journalDir)
+    await rename(`${journalDir}.aside`, journalDir)
   }
   expect(await capsule.list(NOW)).toHaveLength(1)
   expect(await host.restartResume.list()).toMatchObject([{ sessionId: SESSION }])
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-offer-withdrawal.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-offer-withdrawal.test.ts
new file mode 100644
index 000000000000..d36e5702d1dc
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-offer-withdrawal.test.ts
@@ -0,0 +1,548 @@
+// A restart offer ends when the chat moves on after the restart: another message accepted, or its
+// agent started, other than by the offer's own continuation. Each case reads the offer list and the
+// capsule, never only an in-memory set.
+
+import { mkdtemp, readFile, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { agentSessionFailureFact } from '../../../shared/agent-session-failure'
+import { agentSessionFailureWords } from '../../../shared/agent-session-failure-words'
+import {
+  AgentSessionRecoveryCapsule,
+  AGENT_SESSION_RECOVERY_CAPSULE_FILE
+} from '../../runtime/agent-session-recovery-capsule'
+import { parseAgentSessionResumeMarker } from '../../../shared/agent-session-resume-marker'
+import { AgentSessionJournal } from '../agent-session-journal/journal-store'
+import type { AgentSessionSubscribeEvent } from '../../../shared/agent-session-wire'
+import {
+  interruptedRestart,
+  statusNotes
+} from './structured-agent-session-restart-interruption-test-harness'
+import { CALLER, envelope } from './structured-agent-session-host-test-harness'
+import { STRUCTURED_AGENT_SESSION_IDLE_MS } from './structured-agent-session-idle-sweep'
+import { createStructuredAgentSessionRestartOfferWithdrawal } from './structured-agent-session-restart-offer-withdrawal'
+import { restartContinuationId } from './structured-agent-session-restart-continuation-envelope'
+import { sweepOnce } from './structured-agent-session-rest-test-rig'
+import {
+  HOST_TEST_NOW as NOW,
+  HOST_TEST_SESSION as SESSION,
+  hostTestMessage
+} from './structured-agent-session-host-test-data'
+
+afterEach(() => vi.restoreAllMocks())
+
+const SUPERSEDED = 'agent_session_restart_work_superseded'
+
+/** A start under a loaded machine: reconcile, acquire, hand over. */
+const COLD_START = { timeout: 10_000 }
+
+async function offered(work: 'turn' | 'submission' = 'turn') {
+  const state = await interruptedRestart(work, false)
+  expect(await state.host.restartResume.list()).toHaveLength(1)
+  return state
+}
+
+function offersIn(root: string) {
+  return new AgentSessionRecoveryCapsule(root).list(NOW)
+}
+
+function userSend(text: string) {
+  const body = hostTestMessage(text)
+  return { envelope: envelope('agentSession.send', { body }), body }
+}
+
+function compactParams() {
+  return {
+    command: 'compact' as const,
+    envelope: envelope('agentSession.conversationCommand', { command: 'compact' })
+  }
+}
+
+function sentTexts(dispatch: Awaited<ReturnType<typeof offered>>['dispatch']): string[] {
+  return dispatch.mock.calls.map(([input]) =>
+    input.body.blocks.flatMap((block) => (block.type === 'text' ? [block.text] : [])).join('')
+  )
+}
+
+it('withdraws the offer when /compact starts the agent at rest (R-01)', async () => {
+  const { host, root, acquire } = await offered()
+  Object.assign(host.deps.adapter, { compact: vi.fn(async () => ({})) })
+
+  expect(await host.conversationCommand(CALLER, compactParams())).toMatchObject({ ok: true })
+
+  expect(acquire).toHaveBeenCalledOnce()
+  await vi.waitFor(async () => expect(await offersIn(root)).toEqual([]), COLD_START)
+  expect(await host.restartResume.list()).toEqual([])
+})
+
+it('keeps the offer through every way of looking at the chat (R-02)', async () => {
+  const { host, root, acquire } = await offered()
+  const unsubscribe = await host.subscribe({ id: 'pane', sessionId: SESSION, emit: vi.fn() })
+  await host.history({ sessionId: SESSION, direction: 'tail' })
+  await host.readOptions(SESSION)
+  host.readCommands(SESSION)
+  await host.handoffStatus(SESSION)
+  await host.revealSession(SESSION)
+  unsubscribe()
+
+  expect(acquire).not.toHaveBeenCalled()
+  expect(await host.restartResume.list()).toHaveLength(1)
+  expect(await offersIn(root)).toHaveLength(1)
+})
+
+it("does not let the offer's own continuation withdraw it (R-03)", async () => {
+  const { host, root, dispatch } = await offered()
+  const dismiss = vi.spyOn(AgentSessionRecoveryCapsule.prototype, 'dismiss')
+
+  const result = await host.restartResume.continueAfterRestart([SESSION], 'modal')
+
+  expect(result.continued).toMatchObject([{ outcome: 'continued' }])
+  expect(dispatch).toHaveBeenCalledOnce()
+  // The start was the continuation's own: whatever asked, it withdrew nothing.
+  for (const call of dismiss.mock.results) {
+    expect(await call.value).toBe(0)
+  }
+  // Ended by the success path instead.
+  expect(await offersIn(root)).toEqual([])
+})
+
+it('refuses the continuation when another start lands inside its action (R-03b)', async () => {
+  const { host, root, dispatch } = await offered()
+  Object.assign(host.deps.adapter, { compact: vi.fn(async () => ({})) })
+  const send = host.send
+  vi.spyOn(host, 'send').mockImplementationOnce(async (caller, params) => {
+    // Another client's /compact starts the agent after the action reserved the offer.
+    expect(await host.conversationCommand(CALLER, compactParams())).toMatchObject({ ok: true })
+    return send(caller, params)
+  })
+
+  const result = await host.restartResume.continueAfterRestart([SESSION], 'modal')
+
+  expect(result.continued).toMatchObject([{ outcome: 'refused', reason: SUPERSEDED }])
+  expect(dispatch).not.toHaveBeenCalled()
+  expect(await offersIn(root)).toEqual([])
+  expect(result.failed).toEqual([])
+})
+
+it('keeps the offer when a tabbed chat is restored at boot (R-05)', async () => {
+  const { host, store, root, acquire } = await offered()
+  await store.setSessionTabVisibility(SESSION, true)
+
+  await host.restoreReadableSessions([SESSION])
+
+  expect(acquire).not.toHaveBeenCalled()
+  expect(await host.restartResume.list()).toHaveLength(1)
+  expect(await offersIn(root)).toHaveLength(1)
+})
+
+it('reads an older build’s marker whose message id no longer matches, and one with none (R-06)', async () => {
+  const { host, root, dispatch, marker } = await offered('submission')
+  if (!marker) {
+    throw new Error('missing interrupted restart marker')
+  }
+  // The older build compared this id with the chat's newest message; nothing does now.
+  await host.restartResume.dismiss([SESSION])
+  await new AgentSessionRecoveryCapsule(root).record(
+    [{ ...marker, latestUserItemId: 'user-sent-under-the-older-build' }],
+    NOW
+  )
+  expect(await host.restartResume.list()).toHaveLength(1)
+  const { latestUserItemId: _dropped, ...withoutId } = marker
+  expect(parseAgentSessionResumeMarker(withoutId)).toEqual(withoutId)
+
+  await host.send(CALLER, userSend('Carry on'))
+  await vi.waitFor(() => expect(dispatch).toHaveBeenCalledOnce(), COLD_START)
+  await vi.waitFor(async () => expect(await offersIn(root)).toEqual([]), COLD_START)
+})
+
+it('still writes the message id the previous build requires on every marker', async () => {
+  const { root } = await offered('submission')
+  const capsule = JSON.parse(
+    await readFile(join(root, AGENT_SESSION_RECOVERY_CAPSULE_FILE), 'utf8')
+  )
+  expect(capsule.entries[0]?.marker).toHaveProperty('latestUserItemId')
+})
+
+/** Sends a message whose start fails, and waits for it to be rejected. */
+async function sendWhoseStartFails(state: Awaited<ReturnType<typeof offered>>) {
+  state.acquire.mockRejectedValueOnce(new Error('Not signed in'))
+  const params = userSend('while signed out')
+  await state.host.send(CALLER, params)
+  await vi.waitFor(async () =>
+    expect(
+      (await state.host.journalSnapshot(SESSION)).submissions.find(
+        (entry) => entry.clientMessageId === params.envelope.clientOperationId
+      )
+    ).toMatchObject({ dispatchState: 'rejected' })
+  )
+}
+
+// A message the user sent is activity even when its start then failed.
+it('withdraws the offer when the user sends a message whose start then fails (R-08)', async () => {
+  const state = await offered()
+  const { host, root, dispatch } = state
+
+  await sendWhoseStartFails(state)
+
+  expect(await host.restartResume.list()).toEqual([])
+  await vi.waitFor(async () => expect(await offersIn(root)).toEqual([]), COLD_START)
+  // A click from a surface that still shows the offer finds nothing to act on.
+  expect(await host.restartResume.continueAfterRestart([SESSION], 'stale-click')).toMatchObject({
+    resumed: [],
+    continued: []
+  })
+  expect(dispatch).not.toHaveBeenCalled()
+})
+
+// The idle sweep closes a chat's open handle, and the next read opens a new one: the user's message
+// still counts, because it is read against where the journal stood when the offer was taken.
+it('keeps the offer withdrawn after the idle sweep closes the chat and it is read again', async () => {
+  const state = await offered()
+  const { host, root, clock } = state
+  await sendWhoseStartFails(state)
+  clock.now += STRUCTURED_AGENT_SESSION_IDLE_MS + 1
+
+  await sweepOnce(host)
+  expect(host.hasSession(SESSION)).toBe(false)
+  await host.revealSession(SESSION)
+
+  expect(await host.restartResume.list()).toEqual([])
+  // The listing retires what it finds moved on; the write trails the answer.
+  await vi.waitFor(async () => expect(await offersIn(root)).toEqual([]))
+})
+
+// A failure the chat moved on from is read from its journal like an offer is, open or not.
+it('keeps a failure not retryable after the user moved on and the sweep closed the chat', async () => {
+  const state = await offered()
+  const { host, clock } = state
+  state.acquire.mockRejectedValueOnce(new Error('provider could not reconnect'))
+  const resumed = await host.restartResume.continueAfterRestart([SESSION], 'modal')
+  expect(resumed.failed).toMatchObject([{ sessionId: SESSION, retryable: true }])
+  await sendWhoseStartFails(state)
+  expect(await host.restartResume.listFailures()).toMatchObject([{ retryable: false }])
+  clock.now += STRUCTURED_AGENT_SESSION_IDLE_MS + 1
+
+  await sweepOnce(host)
+  expect(host.hasSession(SESSION)).toBe(false)
+
+  expect(await host.restartResume.listFailures()).toMatchObject([{ retryable: false }])
+})
+
+const DAY_AND_AN_HOUR = 25 * 60 * 60 * 1000
+
+// An offer has no expiry; the ledger refuses a new id dated more than a day back.
+it('resumes more than a day after the quit', async () => {
+  const state = await offered()
+  const { host, clock, dispatch } = state
+  clock.now += DAY_AND_AN_HOUR
+
+  const resumed = await host.restartResume.continueAfterRestart([SESSION], 'modal')
+
+  expect(resumed.continued).toMatchObject([{ sessionId: SESSION, outcome: 'continued' }])
+  expect(sentTexts(dispatch)).toHaveLength(1)
+  expect(await host.restartResume.listFailures()).toEqual([])
+})
+
+// The offer remembers its own continuations; nothing about them expires before the offer does.
+it('keeps a failed resume retryable more than a day later, after the ledger pruned its row', async () => {
+  const state = await offered()
+  const { host, clock, store } = state
+  state.acquire.mockRejectedValueOnce(new Error('provider could not reconnect'))
+  const first = await host.restartResume.continueAfterRestart([SESSION], 'modal')
+  expect(first.failed).toMatchObject([{ sessionId: SESSION, retryable: true }])
+  clock.now += DAY_AND_AN_HOUR
+  // What an app restart does to the operation ledger a day on.
+  await store.reconcileOnRestart({
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: reconciliation only reads the probe outcome.
+    probe: async () => ({ outcome: 'pid-absent' }) as never,
+    now: clock.now
+  })
+
+  expect(await host.restartResume.listFailures()).toMatchObject([
+    { sessionId: SESSION, retryable: true }
+  ])
+  const retried = await host.restartResume.continueAfterRestart([SESSION], 'retry')
+  expect(retried.continued).toMatchObject([{ sessionId: SESSION, outcome: 'continued' }])
+})
+
+// The start was the continuation's own even after the provider refused it: the child it started,
+// running or since stopped, is still the offer's, so the offer stays retryable.
+it('keeps a resume retryable when its agent started but refused the continuation', async () => {
+  const state = await offered()
+  const { host, store } = state
+  const acquire = state.acquire.getMockImplementation()
+  if (!acquire) {
+    throw new Error('the harness acquire has no implementation')
+  }
+  state.acquire.mockImplementationOnce(async (input) => ({
+    ...(await acquire(input)),
+    acquisitionGeneration: 'generation-continuation'
+  }))
+  state.dispatch.mockResolvedValueOnce({
+    state: 'rejected',
+    ...agentSessionFailureWords(
+      agentSessionFailureFact('providerRejected', {
+        detail: { text: 'the provider refused the turn', audience: 'log' }
+      }),
+      { surface: 'rejection' }
+    )
+  })
+
+  const first = await host.restartResume.continueAfterRestart([SESSION], 'modal')
+
+  expect(state.acquire).toHaveBeenCalledOnce()
+  expect(first.failed).toMatchObject([{ sessionId: SESSION, retryable: true }])
+  expect(await host.restartResume.listFailures()).toMatchObject([
+    { sessionId: SESSION, retryable: true }
+  ])
+  // The child the continuation started exits after proving its start.
+  await host.handleAdapterEvent({
+    type: 'ended',
+    sessionId: SESSION,
+    fence: store.getRecord(SESSION)?.lease.runtimeFence ?? 0,
+    acquisitionGeneration: 'generation-continuation',
+    reason: 'codex app-server exited',
+    cause: 'unexpected-exit'
+  })
+  expect(await host.restartResume.listFailures()).toMatchObject([
+    { sessionId: SESSION, retryable: true }
+  ])
+  const retried = await host.restartResume.continueAfterRestart([SESSION], 'retry')
+  expect(retried.continued).toMatchObject([{ sessionId: SESSION, outcome: 'continued' }])
+})
+
+// A continuation handed to the agent may have landed even with no answer yet, so a retry could send
+// it twice: the failure it files is not retryable, as for one whose dispatch is in doubt.
+it('keeps an unanswered continuation the agent was handed from being sent again', async () => {
+  const state = await offered()
+  const { host } = state
+  // The agent took it and never answered; the wait for that answer ended first (too many waited).
+  state.dispatch.mockResolvedValueOnce({ state: 'admitted' })
+  const wait = host.waitForSendSettlement
+  vi.spyOn(host, 'waitForSendSettlement').mockImplementation(async (...args) =>
+    args[2]?.until === 'handed-over' ? wait(...args) : undefined
+  )
+
+  const first = await host.restartResume.continueAfterRestart([SESSION], 'modal')
+
+  expect(first.continued).toMatchObject([{ sessionId: SESSION, outcome: 'pending' }])
+  expect(await host.restartResume.listFailures()).toMatchObject([
+    { sessionId: SESSION, outcome: 'unconfirmed', retryable: false }
+  ])
+  expect(await host.restartResume.continueAfterRestart([SESSION], 'retry')).toMatchObject({
+    continued: []
+  })
+  expect(state.dispatch).toHaveBeenCalledOnce()
+})
+
+// The rejected continuation is the chat's newest user message; the row still names the user's.
+it("names the user's prompt on a failed retry, not the rejected continuation", async () => {
+  const state = await offered('submission')
+  const { host } = state
+  state.acquire.mockRejectedValueOnce(new Error('provider could not reconnect'))
+  const first = await host.restartResume.continueAfterRestart([SESSION], 'modal')
+  expect(first.failed).toMatchObject([{ latestPrompt: 'Perform the original task' }])
+
+  state.acquire.mockRejectedValueOnce(new Error('provider could not reconnect'))
+  const retried = await host.restartResume.continueAfterRestart([SESSION], 'retry')
+
+  expect(retried.failed).toMatchObject([
+    { latestPrompt: 'Perform the original task', retryable: true }
+  ])
+})
+
+// Resume that runs by itself at launch goes through the same call a click does, and the same rule
+// decides: whichever of the two was accepted first since the restart wins.
+it("refuses an automatic continuation when the user's message was accepted first, and writes nothing", async () => {
+  const { host, root, dispatch } = await offered()
+  const events: AgentSessionSubscribeEvent[] = []
+  const unsubscribe = await host.subscribe({
+    id: 'pane',
+    sessionId: SESSION,
+    emit: (event) => events.push(structuredClone(event))
+  })
+  const send = host.send
+  vi.spyOn(host, 'send').mockImplementationOnce(async (caller, params) => {
+    // Both accepted before any start, the user's first: the continuation queues behind the user's
+    // acceptance, ahead of the start that acceptance wakes.
+    let continuation: ReturnType<typeof send> | undefined
+    const append = AgentSessionJournal.prototype.appendSubmission
+    vi.spyOn(AgentSessionJournal.prototype, 'appendSubmission').mockImplementationOnce(
+      async function (this: AgentSessionJournal, ...args) {
+        continuation = send(caller, params)
+        await new Promise((resolve) => setTimeout(resolve, 50))
+        return append.apply(this, args)
+      }
+    )
+    await send(CALLER, userSend('A new request'))
+    return continuation!
+  })
+
+  const result = await host.restartResume.continueAfterRestart(undefined, 'launch')
+
+  expect(result.continued).toMatchObject([{ outcome: 'refused', reason: SUPERSEDED }])
+  await vi.waitFor(() => expect(dispatch).toHaveBeenCalledOnce(), COLD_START)
+  expect(sentTexts(dispatch)).toEqual(['A new request'])
+  // Nothing the user did failed: no row reached the reader, and nothing is kept.
+  expect(await statusNotes(host)).toEqual([])
+  expect(
+    events.some(
+      (event) =>
+        event.type === 'batch' && event.batch.items.some((item) => item.body.kind === 'status')
+    )
+  ).toBe(false)
+  expect(await offersIn(root)).toEqual([])
+  expect(await new AgentSessionRecoveryCapsule(root).listFailed(NOW)).toEqual([])
+  unsubscribe()
+})
+
+it('delivers a clicked continuation and a message sent right after it, in the order accepted', async () => {
+  const { host, root, dispatch } = await offered()
+  const send = host.send
+  vi.spyOn(host, 'send').mockImplementationOnce(async (caller, params) => {
+    const continuation = send(caller, params)
+    const user = send(CALLER, userSend('And then this'))
+    await user
+    return continuation
+  })
+
+  const result = await host.restartResume.continueAfterRestart([SESSION], 'modal')
+
+  expect(result.continued).toMatchObject([{ outcome: 'continued' }])
+  await vi.waitFor(() => expect(dispatch).toHaveBeenCalledTimes(2), COLD_START)
+  const [first, second] = sentTexts(dispatch)
+  expect(first).not.toBe('And then this')
+  expect(second).toBe('And then this')
+  expect(await offersIn(root)).toEqual([])
+})
+
+describe('reading the chat against where the offer was taken', () => {
+  const TAKEN = { epoch: 'epoch-1', sequence: 5 }
+
+  const OFFER = {
+    sessionId: SESSION,
+    work: { kind: 'turn' as const, id: 'turn-1' },
+    recordedAt: NOW,
+    trigger: 'quit' as const,
+    providerHandleRoot: 'codex:"thread"',
+    teardownId: 'teardown-1'
+  }
+
+  function movedOn(
+    input: {
+      epoch?: string
+      submissions?: {
+        clientMessageId: string
+        acceptedSequence: number
+        dispatchState: string
+        handoverRecorded?: boolean
+        handedOverAt?: number
+      }[]
+    },
+    journalCursor: { epoch: string; sequence: number } | null = TAKEN
+  ): boolean {
+    const session = {
+      child: null,
+      journal: {
+        cursor: () => ({ epoch: input.epoch ?? TAKEN.epoch, sequence: 9 }),
+        submissions: () => input.submissions ?? []
+      }
+    }
+    const withdrawal = createStructuredAgentSessionRestartOfferWithdrawal({
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the fact reads only the journal's cursor and submissions and the child fields given here.
+      sessions: new Map([[SESSION, session as never]]),
+      now: () => NOW,
+      enqueue: (operation) => operation()
+    })
+    return withdrawal.movedOn({ ...OFFER, ...(journalCursor ? { journalCursor } : {}) })
+  }
+
+  it('counts a message accepted after that position, and nothing before it', () => {
+    const at = (acceptedSequence: number) => ({
+      clientMessageId: `m-${acceptedSequence}`,
+      acceptedSequence,
+      dispatchState: 'rejected'
+    })
+    expect(movedOn({ submissions: [at(4), at(5)] })).toBe(false)
+    expect(movedOn({ submissions: [at(4), at(6)] })).toBe(true)
+  })
+
+  it('counts a journal on another epoch as moved on', () => {
+    expect(movedOn({ epoch: 'epoch-2' })).toBe(true)
+  })
+
+  it("does not count the offer's own continuation while queued or rejected, so a retry still runs", () => {
+    const own = restartContinuationId(OFFER, 'operation-1', NOW)
+    const rejected = { clientMessageId: own, acceptedSequence: 7, dispatchState: 'rejected' }
+    const queued = { ...rejected, dispatchState: 'pending', handoverRecorded: true }
+    expect(movedOn({ submissions: [rejected] })).toBe(false)
+    expect(movedOn({ submissions: [queued] })).toBe(false)
+    // Handed over, it may have reached the agent, answered or not.
+    expect(movedOn({ submissions: [{ ...queued, handedOverAt: NOW }] })).toBe(true)
+    expect(movedOn({ submissions: [{ ...rejected, dispatchState: 'accepted' }] })).toBe(true)
+    // Another offer's continuation, and any other message, is the chat moving on.
+    const other = restartContinuationId({ ...OFFER, teardownId: 'teardown-2' }, 'operation-1', NOW)
+    expect(movedOn({ submissions: [{ ...rejected, clientMessageId: other }] })).toBe(true)
+  })
+
+  // The retry's reservation lapses with the app, and the capsule hands back the failure's marker,
+  // written before the retry ran. The next launch rejects the retry's queued continuation.
+  it('keeps a failure retryable after the app crashed during its retry', async () => {
+    const root = await mkdtemp(join(tmpdir(), 'orca-crash-during-retry-'))
+    try {
+      const capsule = new AgentSessionRecoveryCapsule(root)
+      await capsule.record([{ ...OFFER, journalCursor: TAKEN }], NOW)
+      await capsule.beginResume([SESSION], 'operation-a', NOW)
+      await capsule.failResume(
+        'operation-a',
+        [
+          {
+            sessionId: SESSION,
+            failedAt: NOW,
+            outcome: 'refused',
+            reason: 'x',
+            latestPrompt: '',
+            latestUserItemId: null
+          }
+        ],
+        NOW
+      )
+      const [retrying] = await capsule.beginResume([SESSION], 'operation-b', NOW + 1)
+      if (!retrying) {
+        throw new Error('the retry reserved nothing')
+      }
+      const retry = restartContinuationId(retrying, 'operation-b', NOW + 1)
+      const afterCrash = NOW + 60 * 60_000
+      expect(await capsule.list(afterCrash)).toEqual([])
+      const [failed] = await capsule.listFailed(afterCrash)
+
+      const session = {
+        child: null,
+        journal: {
+          cursor: () => ({ epoch: TAKEN.epoch, sequence: 9 }),
+          submissions: () => [
+            { clientMessageId: retry, acceptedSequence: 7, dispatchState: 'rejected' }
+          ]
+        }
+      }
+      const withdrawal = createStructuredAgentSessionRestartOfferWithdrawal({
+        // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the fact reads only the journal's cursor and submissions and the child fields given here.
+        sessions: new Map([[SESSION, session as never]]),
+        now: () => afterCrash,
+        enqueue: (operation) => operation()
+      })
+      if (!failed) {
+        throw new Error('the failure did not outlive the crash')
+      }
+      expect(withdrawal.movedOn(failed.marker)).toBe(false)
+    } finally {
+      await rm(root, { recursive: true, force: true })
+    }
+  })
+
+  it('leaves an older build’s offer, which recorded no position, to a start', () => {
+    const after = { clientMessageId: 'm-7', acceptedSequence: 7, dispatchState: 'accepted' }
+    expect(movedOn({ submissions: [after], epoch: 'epoch-2' }, null)).toBe(false)
+  })
+})
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-offer-withdrawal.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-offer-withdrawal.ts
new file mode 100644
index 000000000000..76d8006d9a1a
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-offer-withdrawal.ts
@@ -0,0 +1,92 @@
+// When a restart offer ends without being acted on: the chat moved on.
+//
+// One derived fact decides it, for the offer list and for the continuation's own acceptance alike:
+// since the offer was taken, another message was accepted in the chat, or its agent proved a start.
+// A message is read against the journal position the offer recorded, so the answer survives any
+// number of handle closes. A start is known only to the host that saw it, so it is also written
+// to the recovery file when it happens. A restored row, a replayed row or a view carries neither,
+// so opening a chat withdraws nothing. The rest of a resume action does not count: its own
+// continuation, and the start that continuation waits on.
+
+import type { AgentSessionRecoveryCapsule } from '../../runtime/agent-session-recovery-capsule'
+import type { AgentSessionResumeMarker } from '../../../shared/agent-session-resume-marker'
+import { isQueuedAgentJournalSubmission } from '../../../shared/agent-session-queued-submission'
+import type { StructuredAgentSessionHostSession } from './structured-agent-session-host-types'
+import { isRestartContinuationOf } from './structured-agent-session-restart-continuation-envelope'
+
+export type StructuredAgentSessionRestartOfferWithdrawal = ReturnType<
+  typeof createStructuredAgentSessionRestartOfferWithdrawal
+>
+
+export type StructuredAgentSessionRestartOfferSession = Pick<
+  StructuredAgentSessionHostSession,
+  'journal' | 'child' | 'lastEndedChild'
+>
+
+export function createStructuredAgentSessionRestartOfferWithdrawal(deps: {
+  sessions: ReadonlyMap<string, StructuredAgentSessionRestartOfferSession>
+  capsule?: Pick<AgentSessionRecoveryCapsule, 'dismiss'>
+  now: () => number
+  /** The capsule's single mutation lane, shared with the offer's own operations. */
+  enqueue: <T>(operation: () => Promise<T>) => Promise<T>
+}) {
+  const movedOn = (marker: AgentSessionResumeMarker): boolean => {
+    const session = deps.sessions.get(marker.sessionId)
+    if (!session) {
+      return false
+    }
+    const taken = marker.journalCursor
+    // An older build's offer recorded no position: only a start withdraws it.
+    const accepted =
+      taken !== undefined &&
+      (session.journal.cursor().epoch !== taken.epoch ||
+        session.journal.submissions().some(
+          (submission) =>
+            (submission.acceptedSequence ?? 0) > taken.sequence &&
+            // The offer's own continuation, still queued or rejected, never reached the agent: a
+            // retry sends a new one. One handed over may have, answered or not.
+            !(
+              (isQueuedAgentJournalSubmission(submission) ||
+                submission.dispatchState === 'rejected') &&
+              isRestartContinuationOf(marker, submission.clientMessageId)
+            )
+        ))
+    // Proven, not merely spawned: a start that failed during startup never ran the agent. Whose
+    // start it was is fixed when it was made, so a continuation rejected since still owns it.
+    const started =
+      session.child?.phase === 'ready'
+        ? session.child
+        : session.lastEndedChild?.duringStartup === false
+          ? session.lastEndedChild
+          : undefined
+    return (
+      accepted ||
+      (started !== undefined &&
+        !(started.startedFor !== undefined && isRestartContinuationOf(marker, started.startedFor)))
+    )
+  }
+
+  return {
+    movedOn,
+    /** The chat's agent proved a start: the offer and any failure record go from the recovery file,
+     *  unless the start was for one of that offer's own continuations. Advisory: a failed write is
+     *  logged, never raised. */
+    onAgentStarted: (sessionId: string): void => {
+      const session = deps.sessions.get(sessionId)
+      const capsule = deps.capsule
+      if (!capsule || !session) {
+        return
+      }
+      const startedFor = session.child?.startedFor
+      void deps
+        .enqueue(() =>
+          capsule.dismiss([sessionId], deps.now(), (marker) =>
+            startedFor === undefined ? false : isRestartContinuationOf(marker, startedFor)
+          )
+        )
+        .catch(() => {
+          console.warn('[structured-agent-session] withdrawing a restart offer failed')
+        })
+    }
+  }
+}
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-ownership.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-ownership.test.ts
index c3301861c010..b45e08314a0d 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-ownership.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-ownership.test.ts
@@ -7,8 +7,6 @@ import { parseAgentSessionResumeMarker } from '../../../shared/agent-session-res
 import { join } from 'node:path'
 import { afterEach, expect, it, vi } from 'vitest'
 import { AgentSessionJournal } from '../agent-session-journal/journal-store'
-import { pendingApproval } from './structured-agent-session-restart-resume-test-harness'
-import { restartContinuationEnvelope } from './structured-agent-session-restart-continuation'
 import {
   AGENT_SESSION_RESTART_CONTINUATION_NOTE,
   AGENT_SESSION_RESTART_CONTINUATION_REFUSED_NOTE,
@@ -16,8 +14,8 @@ import {
 } from '../../../shared/agent-session-restart-continuation'
 import { STRUCTURED_AGENT_SESSION_RESTART_CONTINUATION_CALLER } from './structured-agent-session-restart-resume-wiring'
 import {
-  GRACE,
   interruptedRestart,
+  startAgent,
   statusNotes,
   supersededRefusal
 } from './structured-agent-session-restart-interruption-test-harness'
@@ -33,6 +31,8 @@ import {
   HOST_TEST_THREAD as THREAD,
   hostTestMessage
 } from './structured-agent-session-host-test-data'
+import { agentSessionFailureFact } from '../../../shared/agent-session-failure'
+import { agentSessionFailureWords } from '../../../shared/agent-session-failure-words'
 
 afterEach(() => vi.useRealTimers())
 
@@ -40,7 +40,7 @@ it('publishes continuation attribution to the subscribed chat without another pr
   const { host } = await interruptedRestart()
   await host.restartResume.list()
   const emit = vi.fn()
-  const unsubscribe = host.subscribe({ id: 'pane', sessionId: SESSION, emit })
+  const unsubscribe = await host.subscribe({ id: 'pane', sessionId: SESSION, emit })
   try {
     expect(
       (await host.restartResume.continueAfterRestart([SESSION], 'modal')).continued
@@ -81,273 +81,75 @@ it.each(['turn', 'submission'] as const)(
   async (work) => {
     const { host, dispatch } = await interruptedRestart(work, false)
     expect(await host.restartResume.list()).toHaveLength(1)
-    await host.hold(SESSION, 'pane')
+    await startAgent(hostTestState())
     dispatch.mockResolvedValueOnce({ state: 'admitted' })
     const body = hostTestMessage('Stop the old task and do this instead')
     await host.send(CALLER, { envelope: envelope('agentSession.send', { body }), body })
     await host.restartResume.continueAfterRestart([SESSION], 'modal')
     expect(dispatch).toHaveBeenCalledTimes(1)
-    expect(host.journalSnapshot(SESSION).submissions).toHaveLength(work === 'turn' ? 1 : 2)
-    host.release(SESSION, 'pane')
-    expect(host.isHeld(SESSION)).toBe(false)
+    expect((await host.journalSnapshot(SESSION)).submissions).toHaveLength(work === 'turn' ? 1 : 2)
   }
 )
 
-it('preserves the offer when the original submission receives its provider echo', async () => {
-  const { host, acquire, dispatch } = await interruptedRestart('submission', false)
-  expect(await host.restartResume.list()).toHaveLength(1)
-  await host.hold(SESSION, 'pane')
-  const events = acquire.mock.calls[0]?.[0].events
-  if (!events) {
-    throw new Error('missing resumed provider event sink')
-  }
-  events.appendItem(
-    { provider: 'codex', threadId: THREAD, turnId: 'original-turn', ordinal: 1 },
-    hostTestMessage('Perform the original task')
-  )
-  await host.flushStreamedEvents(SESSION)
-  expect(host.journalSnapshot(SESSION).submissions[0]?.dispatchState).toBe('accepted')
-  expect(
-    (await host.restartResume.continueAfterRestart([SESSION], 'modal')).continued
-  ).toMatchObject([{ outcome: 'continued' }])
-  expect(acquire).toHaveBeenCalledTimes(1)
-  expect(dispatch).toHaveBeenCalledTimes(1)
-  host.release(SESSION, 'pane')
-  expect(host.isHeld(SESSION)).toBe(false)
-})
-
-// Teardown judged the chat working, and only the user moving on withdraws that. A send the
-// provider proves it never received is still the chat Orca stopped; the continuation asks the agent
+// Teardown judged the chat working. A send the provider proves it never received is still the chat
+// Orca stopped; the continuation asks the agent
 // to check what finished rather than refusing.
 it('still continues a chat whose last send acquisition proves was never delivered', async () => {
   const { host, acquire, dispatch } = await interruptedRestart('submission')
   expect(await host.restartResume.list()).toHaveLength(1)
   const result = await host.restartResume.continueAfterRestart([SESSION], 'modal')
-  expect(host.journalSnapshot(SESSION).submissions[0]).toMatchObject({
+  expect((await host.journalSnapshot(SESSION)).submissions[0]).toMatchObject({
     dispatchState: 'rejected',
-    reason: 'not_delivered'
+    rejection: { kind: 'notDelivered' }
   })
   expect(acquire).toHaveBeenCalledTimes(1)
   expect(dispatch).toHaveBeenCalledTimes(1)
   expect(result.continued).toMatchObject([{ outcome: 'continued' }])
-  expect(host.isHeld(SESSION)).toBe(false)
-})
-
-/** Holds the continuation at send admission while `during` runs, then lets it proceed. */
-async function continueAcross(
-  state: Awaited<ReturnType<typeof interruptedRestart>>,
-  during: (events: NonNullable<ReturnType<typeof resumedEvents>>) => void
-) {
-  const { host, store } = state
-  expect(await host.restartResume.list()).toHaveLength(1)
-  await host.hold(SESSION, 'pane')
-  const events = resumedEvents(state)
-  if (!events) {
-    throw new Error('missing resumed provider event sink')
-  }
-  const admitting = Promise.withResolvers<void>()
-  const proceed = Promise.withResolvers<void>()
-  const admit = store.admitMutationOperation
-  vi.spyOn(store, 'admitMutationOperation').mockImplementationOnce(async (input) => {
-    admitting.resolve()
-    await proceed.promise
-    return admit(input)
-  })
-  const continuing = host.restartResume.continueAfterRestart([SESSION], 'modal')
-  await admitting.promise
-  during(events)
-  await host.flushStreamedEvents(SESSION)
-  proceed.resolve()
-  return continuing
-}
-
-function resumedEvents(state: Awaited<ReturnType<typeof interruptedRestart>>) {
-  return state.acquire.mock.calls[0]?.[0].events
-}
-
-it('refuses at send admission once the user has sent a newer message', async () => {
-  const state = await interruptedRestart()
-  const { host, dispatch } = state
-  const result = await continueAcross(state, (events) =>
-    events.appendItem(
-      { provider: 'codex', threadId: THREAD, turnId: 'newer-turn', ordinal: 1 },
-      hostTestMessage('A newer task from another client')
-    )
-  )
-  expect(result.resumed).toMatchObject([
-    { outcome: 'refused', reason: 'agent_session_restart_work_superseded' }
-  ])
-  expect(dispatch).not.toHaveBeenCalled()
-  expect(host.journalSnapshot(SESSION).submissions).toMatchObject([
-    { dispatchState: 'rejected', reason: 'agent_session_restart_work_superseded' }
-  ])
-  host.release(SESSION, 'pane')
-  expect(host.isHeld(SESSION)).toBe(false)
-})
-
-// Claude opens a turn of its own on reattach to say the last session did not finish. Resume is
-// pressed while that turn still runs: the continuation is sent and the provider queues it.
-it('sends the continuation while a turn the provider opened is still running', async () => {
-  const state = await interruptedRestart()
-  const { host, dispatch } = state
-  const result = await continueAcross(state, (events) =>
-    events.appendItem(
-      { provider: 'codex', threadId: THREAD, turnId: 'notice-turn', ordinal: 1 },
-      { kind: 'turn', turnId: 'notice-turn', state: 'running' }
-    )
-  )
-  expect(result.continued).toMatchObject([{ outcome: 'continued' }])
-  expect(dispatch).toHaveBeenCalledTimes(1)
-  host.release(SESSION, 'pane')
 })
 
-// The send the user made just before quitting, after an earlier exchange had finished. Neither
-// that finished turn nor the provider completing the send's own turn after the restart withdraws it.
+// The send the user made just before quitting, after an earlier exchange had finished: that
+// finished turn does not withdraw it.
 it('offers and continues a send made after an earlier completed turn', async () => {
-  const state = await interruptedRestart('send-after-reply', false)
-  const { host, dispatch, marker } = state
+  const { host, dispatch, marker } = await interruptedRestart('send-after-reply', false)
   expect(marker?.work.kind).toBe('submission')
-  const result = await continueAcross(state, (events) =>
-    events.appendItem(
-      { provider: 'codex', threadId: THREAD, turnId: 'original-turn', ordinal: 1 },
-      { kind: 'turn', turnId: 'original-turn', state: 'completed' }
-    )
-  )
+  const result = await host.restartResume.continueAfterRestart([SESSION], 'modal')
   expect(result.continued).toMatchObject([{ outcome: 'continued' }])
   expect(dispatch).toHaveBeenCalledTimes(1)
-  host.release(SESSION, 'pane')
 })
 
-it.each([false, true])(
-  'refuses a queued newer message before dispatch even if later settlement fails: %s',
-  async (settlementFails) => {
-    const { host, store, acquire, dispatch } = await interruptedRestart('submission', false)
-    expect(await host.restartResume.list()).toHaveLength(1)
-    await host.hold(SESSION, 'pane')
-    const events = acquire.mock.calls[0]?.[0].events
-    if (!events) {
-      throw new Error('missing resumed provider event sink')
-    }
-    const warning = vi.spyOn(console, 'warn').mockImplementation(() => {})
-    const settle = store.recordOperationOutcome.bind(store)
-    let admitted = false
-    vi.spyOn(store, 'recordOperationOutcome').mockImplementation(async (input) => {
-      if (admitted) {
-        if (settlementFails) {
-          throw new Error('operation outcome could not be persisted')
-        }
-        return settle(input)
-      }
-      await settle(input)
-      admitted = true
-      events.appendItem(
-        { provider: 'codex', threadId: THREAD, turnId: 'original-turn', ordinal: 2 },
-        { kind: 'status', text: 'Provider finished its last action' }
-      )
-      events.appendItem(
-        { provider: 'codex', threadId: THREAD, turnId: 'original-turn', ordinal: 1 },
-        hostTestMessage('A newer task from another client'),
-        { lifecycle: true }
-      )
-    })
-
-    const result = await host.restartResume.continueAfterRestart([SESSION], 'modal')
-
-    expect(result.continued).toMatchObject([
-      { outcome: 'refused', reason: 'agent_session_restart_work_superseded' }
-    ])
-    expect(dispatch).not.toHaveBeenCalled()
-    expect(host.journalSnapshot(SESSION).submissions).toHaveLength(2)
-    expect(host.journalSnapshot(SESSION).submissions[1]?.dispatchState).toBe('rejected')
-    host.release(SESSION, 'pane')
-    expect(host.isHeld(SESSION)).toBe(false)
-    // The offer is spent, but the refusal is kept as a durable failure: a retry finds it, and the
-    // superseded chat is still not eligible, so nothing runs and the record stays for the user.
-    expect(await host.restartResume.continueAfterRestart([SESSION], 'retry')).toMatchObject({
-      resumed: [],
-      continued: [],
-      sessions: [],
-      failed: [
-        { sessionId: SESSION, outcome: 'refused', reason: 'agent_session_restart_work_superseded' }
-      ]
-    })
-    expect(dispatch).not.toHaveBeenCalled()
-    if (settlementFails) {
-      expect(store.recordOperationOutcome).toHaveBeenCalledOnce()
-      expect(warning).not.toHaveBeenCalled()
-    }
-    warning.mockRestore()
-  }
-)
-
-// What the provider says after reattaching does not re-judge the offer.
-it.each(['completed', 'approval', 'question'] as const)(
-  'continues past provider %s evidence accepted while recording the continuation',
-  async (event) => {
-    const { host, acquire, dispatch } = await interruptedRestart()
-    await host.restartResume.list()
-    await host.hold(SESSION, 'pane')
-    const events = acquire.mock.calls[0]?.[0].events
-    if (!events) {
-      throw new Error('missing resumed provider event sink')
-    }
-    const append = AgentSessionJournal.prototype.appendSubmission
-    const writing = vi.spyOn(AgentSessionJournal.prototype, 'appendSubmission')
-    writing.mockImplementationOnce(async function (this: AgentSessionJournal, input) {
-      const cursor = await append.call(this, input)
-      events.appendItem(
-        { provider: 'codex', threadId: THREAD, turnId: 'interrupted-turn', ordinal: 1 },
-        event === 'completed'
-          ? { kind: 'turn', turnId: 'interrupted-turn', state: 'completed' }
-          : { ...pendingApproval().body, question: 'Which action?', kind: event },
-        { lifecycle: true }
-      )
-      return cursor
-    })
-    try {
-      const result = await host.restartResume.continueAfterRestart([SESSION], 'modal')
-      expect(result.continued).toMatchObject([{ outcome: 'continued' }])
-      expect(dispatch).toHaveBeenCalledTimes(1)
-    } finally {
-      writing.mockRestore()
-      host.release(SESSION, 'pane')
-    }
-  }
-)
-
 it('replays the same logical continuation through the durable send ledger', async () => {
-  const { host, store, dispatch, marker } = await interruptedRestart()
-  if (!marker) {
-    throw new Error('missing interrupted restart marker')
-  }
+  const { host, dispatch } = await interruptedRestart()
+  const sending = vi.spyOn(host, 'send')
   await host.restartResume.continueAfterRestart([SESSION], 'modal')
-  const fence = store.getRecord(SESSION)?.lease.runtimeFence
-  if (fence === undefined) {
-    throw new Error('missing resumed lease')
+  const sent = sending.mock.calls[0]?.[1]
+  sending.mockRestore()
+  if (!sent) {
+    throw new Error('the continuation was not sent')
   }
   const replay = await host.send(
     { callerKey: STRUCTURED_AGENT_SESSION_RESTART_CONTINUATION_CALLER },
-    restartContinuationEnvelope(SESSION, fence, marker)
+    { envelope: sent.envelope, body: sent.body }
   )
   expect(replay).toMatchObject({ ok: true, replayed: true })
-  expect(host.journalSnapshot(SESSION).submissions).toHaveLength(1)
+  expect((await host.journalSnapshot(SESSION)).submissions).toHaveLength(1)
   expect(dispatch).toHaveBeenCalledTimes(1)
 })
 
+// A send that throws after Orca may have taken it is not proof it was not delivered.
 it.each([false, true])(
-  'keeps dispatched delivery unconfirmed when settlement fails (uncertainty write fails: %s)',
+  'keeps a continuation unconfirmed when its acceptance cannot be recorded (uncertainty write fails: %s)',
   async (uncertaintyFails) => {
-    const { host, store, dispatch } = await interruptedRestart()
+    const { host, store } = await interruptedRestart()
     const warning = vi.spyOn(console, 'warn').mockImplementation(() => {})
     expect(await host.restartResume.list()).toHaveLength(1)
-    await host.hold(SESSION, 'pane')
     const settle = store.recordOperationOutcome.bind(store)
-    let dispatched = false
-    vi.spyOn(store, 'recordOperationOutcome').mockImplementation(async (input) => {
-      if (input.outcome.status === 'succeeded') {
-        dispatched = true
-      }
-      if (dispatched && (input.outcome.status === 'succeeded' || uncertaintyFails)) {
+    const recording = vi.spyOn(store, 'recordOperationOutcome')
+    recording.mockImplementation(async (input) => {
+      // Only the continuation's own record: the start it makes records its attach as usual.
+      if (
+        input.callerKey === STRUCTURED_AGENT_SESSION_RESTART_CONTINUATION_CALLER &&
+        (input.outcome.status === 'succeeded' || uncertaintyFails)
+      ) {
         throw new Error('operation outcome could not be persisted')
       }
       return settle(input)
@@ -355,127 +157,96 @@ it.each([false, true])(
 
     const result = await host.restartResume.continueAfterRestart([SESSION], 'modal')
 
-    expect(dispatch).toHaveBeenCalledTimes(1)
-    expect(host.journalSnapshot(SESSION).submissions[0]?.dispatchState).toBe('accepted')
     expect(result.continued).toMatchObject([{ sessionId: SESSION, outcome: 'unknown' }])
-    // Filed as unconfirmed, with a warning in the chat; the continuation's own message is part of
-    // the filed state, so it does not retire the record it caused.
+    // Filed as unconfirmed, with a warning in the chat.
     expect(result.failed).toMatchObject([{ sessionId: SESSION, outcome: 'unconfirmed' }])
-    expect(statusNotes(host)).toContainEqual({
+    expect(await statusNotes(host)).toContainEqual({
       text: AGENT_SESSION_RESTART_CONTINUATION_UNCONFIRMED_NOTE,
       tone: 'warning'
     })
-    host.release(SESSION, 'pane')
-    expect(host.isHeld(SESSION)).toBe(false)
-    await host.restartResume.continueAfterRestart([SESSION], 'retry')
-    expect(dispatch).toHaveBeenCalledTimes(1)
-    expect(await host.restartResume.listFailures()).toMatchObject([{ outcome: 'unconfirmed' }])
-    expect(warning.mock.calls.flat()).not.toContainEqual(
-      expect.objectContaining({ message: 'operation outcome could not be persisted' })
-    )
+    recording.mockRestore()
     warning.mockRestore()
   }
 )
 
-it('releases a failed acquisition and leaves the offer retryable', async () => {
+// The continuation is accepted, then its start fails: the message is rejected with the cause and
+// the failure is filed, and nothing is stopped because nothing started.
+it('rejects the continuation when its start fails, and files a retryable refusal', async () => {
   const { host, acquire, dispatch, closeSession } = await interruptedRestart()
   acquire.mockRejectedValueOnce(new Error('provider could not reconnect'))
-  expect(await host.restartResume.resume([SESSION], 'modal')).toMatchObject([
-    { outcome: 'refused' }
+  const result = await host.restartResume.continueAfterRestart([SESSION], 'modal')
+  expect(result.resumed).toMatchObject([{ outcome: 'refused' }])
+  expect(result.continued).toMatchObject([{ outcome: 'refused' }])
+  // Nothing ran, so the offer stands as a failure a retry can act on.
+  expect(result.failed).toMatchObject([{ sessionId: SESSION, outcome: 'refused', retryable: true }])
+  expect(await statusNotes(host)).toContainEqual({
+    text: AGENT_SESSION_RESTART_CONTINUATION_REFUSED_NOTE,
+    tone: 'error'
+  })
+  expect((await host.journalSnapshot(SESSION)).submissions).toMatchObject([
+    { dispatchState: 'rejected' }
   ])
-  expect(host.isHeld(SESSION)).toBe(false)
-  await host.restartResume.continueAfterRestart([SESSION], 'retry')
-  expect(acquire).toHaveBeenCalledTimes(2)
-  expect(dispatch).toHaveBeenCalledTimes(1)
+  expect(acquire).toHaveBeenCalledTimes(1)
+  expect(dispatch).not.toHaveBeenCalled()
   expect(closeSession).not.toHaveBeenCalled()
 })
 
-it.each([false, true])(
-  'admits one durable continuation under concurrent calls (pane already live: %s)',
-  async (alreadyLive) => {
-    const { host, root, acquire, dispatch } = await interruptedRestart()
-    if (alreadyLive) {
-      expect(await host.restartResume.list()).toHaveLength(1)
-      await host.hold(SESSION, 'pane')
-    }
-    const results = await Promise.all([
-      host.restartResume.continueAfterRestart([SESSION], 'window-one'),
-      host.restartResume.continueAfterRestart([SESSION], 'window-two')
-    ])
-    expect(
-      results.flatMap((result) => result.resumed).filter((r) => r.outcome === 'resumed')
-    ).toHaveLength(1)
-    expect(
-      results.flatMap((result) => result.continued).filter((r) => r.outcome === 'continued')
-    ).toHaveLength(1)
-    expect(acquire).toHaveBeenCalledTimes(1)
-    expect(dispatch).toHaveBeenCalledTimes(1)
-    expect(host.journalSnapshot(SESSION).submissions).toHaveLength(1)
-    expect(await new AgentSessionRecoveryCapsule(root).list(NOW)).toEqual([])
-    await host.restartResume.continueAfterRestart([SESSION], 'later-click')
-    expect(dispatch).toHaveBeenCalledTimes(1)
-    host.release(SESSION, 'pane')
-  }
-)
-
-it.each([false, true])(
-  'releases reconnect acquisition to idle eviction (pane: %s)',
-  async (pane) => {
-    const { host, acquire, dispatch, closeSession } = await interruptedRestart()
-    vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout'] })
-    expect(await host.restartResume.resume([SESSION], 'modal')).toMatchObject([
-      { outcome: 'resumed' }
-    ])
-    expect(host.isHeld(SESSION)).toBe(false)
-    if (pane) {
-      await host.hold(SESSION, 'pane')
-      await vi.advanceTimersByTimeAsync(GRACE * 2)
-      expect(closeSession).not.toHaveBeenCalled()
-      host.release(SESSION, 'pane')
-    }
-    await vi.advanceTimersByTimeAsync(GRACE)
-    await vi.waitFor(() => expect(closeSession).toHaveBeenCalledTimes(1))
-    expect(acquire).toHaveBeenCalledTimes(1)
-    expect(dispatch).not.toHaveBeenCalled()
-  }
-)
+it('admits one durable continuation under concurrent calls', async () => {
+  const { host, root, acquire, dispatch } = await interruptedRestart()
+  const results = await Promise.all([
+    host.restartResume.continueAfterRestart([SESSION], 'window-one'),
+    host.restartResume.continueAfterRestart([SESSION], 'window-two')
+  ])
+  expect(
+    results.flatMap((result) => result.resumed).filter((r) => r.outcome === 'resumed')
+  ).toHaveLength(1)
+  expect(
+    results.flatMap((result) => result.continued).filter((r) => r.outcome === 'continued')
+  ).toHaveLength(1)
+  expect(acquire).toHaveBeenCalledTimes(1)
+  expect(dispatch).toHaveBeenCalledTimes(1)
+  expect((await host.journalSnapshot(SESSION)).submissions).toHaveLength(1)
+  expect(await new AgentSessionRecoveryCapsule(root).list(NOW)).toEqual([])
+  await host.restartResume.continueAfterRestart([SESSION], 'later-click')
+  expect(dispatch).toHaveBeenCalledTimes(1)
+})
 
-it('retains acquisition through slow continuation settlement, then releases it', async () => {
-  const { host, dispatch, closeSession } = await interruptedRestart()
-  vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout'] })
+// The batch counts a chat done once its agent took the continuation; the provider's slow answer is
+// awaited after, and decides the outcome.
+it('waits out a slow provider answer before reporting the continuation', async () => {
+  const { host, dispatch } = await interruptedRestart()
   const settlement = Promise.withResolvers<Awaited<ReturnType<typeof dispatch>>>()
   const dispatched = Promise.withResolvers<void>()
   dispatch.mockImplementationOnce(() => {
     dispatched.resolve()
     return settlement.promise
   })
-  const continuing = host.restartResume.continueAfterRestart([SESSION], 'modal')
+  let settled = false
+  const continuing = host.restartResume
+    .continueAfterRestart([SESSION], 'modal')
+    .finally(() => (settled = true))
   await dispatched.promise
-  await vi.advanceTimersByTimeAsync(GRACE * 2)
-  expect(host.isHeld(SESSION)).toBe(true)
-  expect(closeSession).not.toHaveBeenCalled()
-  settlement.resolve({ state: 'rejected', reason: 'provider refused' })
+  await new Promise((resolve) => setTimeout(resolve, 20))
+  expect(settled).toBe(false)
+  settlement.resolve({
+    state: 'rejected',
+    ...agentSessionFailureWords(agentSessionFailureFact('providerRejected'), {
+      surface: 'rejection'
+    })
+  })
   expect((await continuing).continued).toMatchObject([{ outcome: 'refused' }])
-  expect(host.isHeld(SESSION)).toBe(false)
-  await vi.advanceTimersByTimeAsync(GRACE)
-  await vi.waitFor(() => expect(closeSession).toHaveBeenCalledTimes(1))
   expect(dispatch).toHaveBeenCalledTimes(1)
 })
 
-// Opening the chat is inspection only. The explicit restart action is what removes the durable
-// offer, so ordinary pane lifecycle must not make this status disappear.
+// Opening the chat is inspection only: it starts nothing, and the explicit restart action is what
+// removes the durable offer, so reading the chat must not make this status disappear.
 it('keeps offering a chat after the user opens it', async () => {
-  const { host, root, store } = await interruptedRestart()
+  const { host, root, acquire } = await interruptedRestart()
   expect(await host.restartResume.list()).toHaveLength(1)
-  vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout'] })
-  await host.hold(SESSION, 'pane')
-  host.release(SESSION, 'pane')
-  await vi.advanceTimersByTimeAsync(GRACE)
-  // The whole eviction, not just the provider stop: the lease returns to `released` on the step
-  // before the last, and until it does the offer is refused for a reason that is not recovery.
-  await vi.waitFor(() => expect(host.hasSession(SESSION)).toBe(false))
-  expect(store.getRecord(SESSION)?.lease.claimStatus).toBe('released')
-  vi.useRealTimers()
+  const unsubscribe = await host.subscribe({ id: 'pane', sessionId: SESSION, emit: vi.fn() })
+  await host.history({ sessionId: SESSION, direction: 'tail' })
+  unsubscribe()
+  expect(acquire).not.toHaveBeenCalled()
 
   expect(await host.restartResume.list()).toHaveLength(1)
   await host.restartResume.recordMarkers()
@@ -544,7 +315,7 @@ it('keeps concurrent recovery reads independent and non-destructive', async () =
   list.mockRestore()
 })
 
-it('fails closed on corrupt recovery storage while ordinary hold and send still work', async () => {
+it('fails closed on corrupt recovery storage while an ordinary send still works', async () => {
   const { host, root, dispatch } = await interruptedRestart()
   await writeFile(join(root, AGENT_SESSION_RECOVERY_CAPSULE_FILE), '{')
   const warning = vi.spyOn(console, 'warn').mockImplementation(() => {})
@@ -555,81 +326,56 @@ it('fails closed on corrupt recovery storage while ordinary hold and send still
     sessions: [],
     failed: []
   })
-  await host.hold(SESSION, 'pane')
   const body = hostTestMessage('A fresh ordinary request')
   expect(
     await host.send(CALLER, { envelope: envelope('agentSession.send', { body }), body })
   ).toMatchObject({ ok: true })
-  expect(dispatch).toHaveBeenCalledTimes(1)
-  // list; the action's read of offers and of failures; the post-action refresh of both.
-  expect(warning).toHaveBeenCalledTimes(5)
+  await vi.waitFor(() => expect(dispatch).toHaveBeenCalledTimes(1))
+  // list; the action's read of offers and of failures; the post-action refresh of both. The send
+  // cannot withdraw an offer it cannot read either, and says so.
+  const withdrawing = '[structured-agent-session] withdrawing a restart offer failed'
+  await vi.waitFor(() => expect(warning).toHaveBeenLastCalledWith(withdrawing))
+  expect(warning.mock.calls.filter(([message]) => message !== withdrawing)).toHaveLength(5)
   warning.mockRestore()
-  host.release(SESSION, 'pane')
 })
 
-// The toast is gone in seconds and the offer is spent by the reattach, so without this record
-// nothing on any surface would still name the chat the user has to continue by hand.
-it('keeps a refused continuation as a durable failure that names the chat and the reason', async () => {
-  const { host, root, result } = await supersededRefusal()
-  const failure = {
-    sessionId: SESSION,
-    outcome: 'refused',
-    reason: 'agent_session_restart_work_superseded',
-    latestPrompt: expect.any(String),
-    agent: 'codex',
-    retryable: false
-  }
-  expect(result).toMatchObject({ sessions: [], failed: [failure] })
-  // The chat itself says what happened and what to do.
-  expect(statusNotes(host)).toContainEqual({
-    text: AGENT_SESSION_RESTART_CONTINUATION_REFUSED_NOTE,
-    tone: 'error'
+// The user's own message was accepted first: the continuation is refused, and since nothing the
+// user did failed, the chat says nothing and no failure is kept.
+it("refuses a continuation quietly when the user's own message was accepted first", async () => {
+  const { host, root, dispatch, result } = await supersededRefusal()
+  expect(result).toMatchObject({
+    continued: [{ outcome: 'refused', reason: 'agent_session_restart_work_superseded' }],
+    sessions: [],
+    failed: []
   })
-  expect(await host.restartResume.list()).toEqual([])
-  expect(await host.restartResume.listFailures()).toMatchObject([failure])
-  // Durable: a fresh reader of the same file sees it too.
-  expect(await new AgentSessionRecoveryCapsule(root).listFailed(NOW)).toMatchObject([
-    { marker: { sessionId: SESSION }, outcome: 'refused' }
-  ])
-  host.release(SESSION, 'pane')
+  await vi.waitFor(() => expect(dispatch).toHaveBeenCalledOnce())
+  expect(await statusNotes(host)).toEqual([])
+  expect(await new AgentSessionRecoveryCapsule(root).list(NOW)).toEqual([])
+  expect(await new AgentSessionRecoveryCapsule(root).listFailed(NOW)).toEqual([])
 })
 
-// The failure asked the user to continue the chat themselves; their own message is that
-// continuation. Nothing on the send path clears it: the listing sees the newer message.
+/** A continuation whose start failed, filed as a retryable failure. */
+async function failedContinuation() {
+  const state = await interruptedRestart()
+  state.acquire.mockRejectedValueOnce(new Error('provider could not reconnect'))
+  const result = await state.host.restartResume.continueAfterRestart([SESSION], 'modal')
+  expect(result.failed).toMatchObject([{ sessionId: SESSION, outcome: 'refused' }])
+  return state
+}
+
+// Starting the chat's agent again answers a failure, as it ends an offer.
 it('retires a recorded failure once the user sends in that chat, with no send hook', async () => {
-  const { host, root } = await supersededRefusal()
+  const { host, root, dispatch } = await failedContinuation()
   const body = hostTestMessage('Carry on from where you stopped')
   await host.send(CALLER, { envelope: envelope('agentSession.send', { body }), body })
-  expect(await host.restartResume.listFailures()).toEqual([])
-  // Pruned from the file too, not only hidden.
+  await vi.waitFor(() => expect(dispatch).toHaveBeenCalledOnce())
+  // Pruned from the file, not only hidden.
   await vi.waitFor(async () => {
     expect(await new AgentSessionRecoveryCapsule(root).listFailed(NOW)).toEqual([])
   })
-  host.release(SESSION, 'pane')
+  expect(await host.restartResume.listFailures()).toEqual([])
 })
 
-// The user can reply in a chat while other chats in the same action are still being continued,
-// before its turn in the batch or after its own note asks them to. Either reply answers the failure.
-it.each(['before', 'after'] as const)(
-  'retires a failure the user answered %s its own attempt, before the action settled',
-  async (userAnswers) => {
-    const { host, root, result } = await supersededRefusal(userAnswers)
-    expect(result.resumed).toMatchObject([
-      userAnswers === 'before' ? { reason: 'agent_session_resume_not_eligible' } : {}
-    ])
-    expect(
-      statusNotes(host).some(
-        (note) => note.text === AGENT_SESSION_RESTART_CONTINUATION_REFUSED_NOTE
-      )
-    ).toBe(userAnswers === 'after')
-    expect(result.failed).toEqual([])
-    await vi.waitFor(async () => {
-      expect(await new AgentSessionRecoveryCapsule(root).listFailed(NOW)).toEqual([])
-    })
-    host.release(SESSION, 'pane')
-  }
-)
-
 it('removes a failure when a named retry succeeds', async () => {
   const { host, root, dispatch } = await interruptedRestart()
   const capsule = new AgentSessionRecoveryCapsule(root)
@@ -645,7 +391,7 @@ it('removes a failure when a named retry succeeds', async () => {
         outcome: 'refused',
         reason: 'agent_session_conflict',
         latestPrompt: '',
-        latestUserItemId: pending!.latestUserItemId
+        latestUserItemId: pending!.latestUserItemId ?? null
       }
     ],
     NOW
@@ -661,7 +407,7 @@ it('removes a failure when a named retry succeeds', async () => {
 })
 
 it('dismisses one failure by name and leaves the rest of the durable records alone', async () => {
-  const { host, root } = await supersededRefusal()
+  const { host, root } = await failedContinuation()
   const capsule = new AgentSessionRecoveryCapsule(root)
   const other = parseAgentSessionResumeMarker({
     sessionId: 'session-other',
@@ -680,7 +426,6 @@ it('dismisses one failure by name and leaves the rest of the durable records alo
   expect(await host.restartResume.dismiss([SESSION])).toBe(1)
   expect(await host.restartResume.listFailures()).toEqual([])
   expect(await capsule.list(NOW)).toEqual([other])
-  host.release(SESSION, 'pane')
 })
 
 it('logs teardown capsule publication failure and still releases the provider', async () => {
@@ -699,7 +444,9 @@ it('logs teardown capsule publication failure and still releases the provider',
   await mkdir(capsulePath)
   const warning = vi.spyOn(console, 'warn').mockImplementation(() => {})
   await expect(previous.host.flushAllStreamedEvents()).resolves.toBeUndefined()
-  expect(() => previous.host.journalSnapshot(SESSION)).toThrow('agent_session_ownership_unknown')
+  await expect(previous.host.journalSnapshot(SESSION)).rejects.toThrow(
+    'agent_session_ownership_unknown'
+  )
   expect(warning).toHaveBeenCalledWith(
     '[structured-agent-session] recording recovery capsule failed'
   )
@@ -708,3 +455,29 @@ it('logs teardown capsule publication failure and still releases the provider',
   warning.mockRestore()
   await rm(capsulePath, { recursive: true })
 })
+
+// The resume ledger's reason stays the refusal code, which is what every renderer's guidance keys
+// on; the details are filed beside it, never in its place.
+it('files a restart refused by a conflicted claim under its code, with its details beside it', async () => {
+  // The terminal agent that holds the claim is still running, so nothing may take it over.
+  const { host, store } = await interruptedRestart('turn', true, async () => ({
+    outcome: 'identity-matched',
+    matchedOn: ['spawn-token']
+  }))
+  await store.transitionHandoff(SESSION, (record) => ({
+    ...record,
+    lease: {
+      ...record.lease,
+      claimStatus: 'conflicted',
+      ownerProcess: { hostId: 'local', pid: 4242, processStartTimeMs: 1, spawnToken: 'terminal' }
+    }
+  }))
+
+  await host.restartResume.continueAfterRestart([SESSION], 'modal')
+
+  await vi.waitFor(async () =>
+    expect(await host.restartResume.listFailures()).toMatchObject([
+      { reason: 'agent_session_conflict', details: { reason: 'claimConflicted' } }
+    ])
+  )
+})
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-restore.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-restore.test.ts
index f46ff48ce15b..90875832c8f2 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-restore.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-restore.test.ts
@@ -10,10 +10,13 @@ vi.mock('./structured-agent-session-read-restore', () => ({
   restoreStructuredAgentSessionRead: restoreRead
 }))
 
-import {
-  restoreOneStructuredAgentSessionRead,
-  restoreStructuredAgentSessionsOnRestart
-} from './structured-agent-session-restart-restore'
+import { restoreStructuredAgentSessionsOnRestart } from './structured-agent-session-restart-restore'
+
+const NO_OPEN_DEPS = {
+  store: { getRecord: () => null, listRecords: () => [] },
+  journalRoot: '/tmp/journals',
+  adapter: {}
+}
 
 describe('restart journal restoration', () => {
   beforeEach(() => restoreRead.mockReset())
@@ -22,17 +25,19 @@ describe('restart journal restoration', () => {
     const gate = Promise.withResolvers<void>()
     let active = 0
     let peak = 0
-    restoreRead.mockImplementation(async (_store, _root, sessionId: string) => {
+    restoreRead.mockImplementation(async (_deps, sessionId: string) => {
       active += 1
       peak = Math.max(peak, active)
       await gate.promise
       active -= 1
       return {
-        journal: {},
-        params: { location: { workspaceId: 'workspace-1' }, provider: 'codex' },
-        fence: 1,
-        hasProviderChild: false,
-        sessionId
+        session: {
+          journal: {},
+          params: { location: { workspaceId: 'workspace-1' }, provider: 'codex' },
+          child: null,
+          sessionId
+        },
+        reset: null
       }
     })
     const records = Array.from(
@@ -41,15 +46,13 @@ describe('restart journal restoration', () => {
     )
 
     const restoration = restoreStructuredAgentSessionsOnRestart({
-      store: {} as never,
-      journalRoot: '/tmp/journals',
+      openDeps: NO_OPEN_DEPS,
       records,
       reconcile: async () => null,
       resolveRecovery: async () => undefined,
       serialize: async (_sessionId, task) => task(),
       hasSession: () => false,
-      onReadable: () => undefined,
-      retrySettlement: async () => true
+      onReadable: () => undefined
     })
 
     await vi.waitFor(() => expect(active).toBe(4))
@@ -61,7 +64,7 @@ describe('restart journal restoration', () => {
     expect(peak).toBe(4)
   })
 
-  it('runs pending settlement retry after recovery resolution', async () => {
+  it('settles what a gone generation left running after recovery resolution, before publishing', async () => {
     const calls: string[] = []
     const params: AgentSessionAttachParams = {
       envelope: {
@@ -81,64 +84,52 @@ describe('restart journal restoration', () => {
       accountHome: { variable: 'CODEX_HOME', path: '/tmp/codex' },
       runtimeKind: 'native'
     }
-    restoreRead.mockResolvedValue({
-      journal: {},
-      params,
-      fence: 4,
-      hasProviderChild: false,
-      acquisitionGeneration: null
+    const restored = {
+      session: { journal: {}, params, child: null },
+      reset: null
+    }
+    // The open is what settles: it runs after recovery resolution and before the publish.
+    restoreRead.mockImplementation(async () => {
+      calls.push('open')
+      return restored
     })
 
-    await restoreOneStructuredAgentSessionRead(
-      {
-        store: {} as never,
-        journalRoot: '/tmp/journals',
-        reconcile: async () => null,
-        resolveRecovery: async () => {
-          calls.push('resolveRecovery')
-        },
-        serialize: async (_sessionId, task) => task(),
-        hasSession: () => false,
-        onReadable: () => {
-          calls.push('onReadable')
-        },
-        retrySettlement: async (_sessionId, restoredParams) => {
-          calls.push(
-            restoredParams === params ? 'retrySettlement:restored-params' : 'retrySettlement'
-          )
-          return true
-        }
+    await restoreStructuredAgentSessionsOnRestart({
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the restore reads only the record's session id here.
+      records: [{ sessionId: 'session-1' } as AgentSessionRecord],
+      openDeps: NO_OPEN_DEPS,
+      reconcile: async () => null,
+      resolveRecovery: async () => {
+        calls.push('resolveRecovery')
       },
-      'session-1'
-    )
+      serialize: async (_sessionId, task) => task(),
+      hasSession: () => false,
+      onReadable: (_sessionId, readable) => {
+        calls.push(readable === restored ? 'onReadable:restored' : 'onReadable')
+      }
+    })
 
-    expect(calls).toEqual(['resolveRecovery', 'onReadable', 'retrySettlement:restored-params'])
+    expect(calls).toEqual(['resolveRecovery', 'open', 'onReadable:restored'])
   })
 
-  it('does not rerun settlement retry when a second restore finds the session already open', async () => {
-    const retrySettlement = vi.fn(async () => true)
+  it('does not settle again when a second restore finds the session already open', async () => {
     restoreRead.mockResolvedValue({
-      journal: {},
-      params: {},
-      fence: 4,
-      hasProviderChild: false,
-      acquisitionGeneration: null
+      session: { journal: {}, params: {}, child: null },
+      reset: null
     })
 
-    await restoreOneStructuredAgentSessionRead(
-      {
-        store: {} as never,
-        journalRoot: '/tmp/journals',
-        reconcile: async () => null,
-        resolveRecovery: async () => undefined,
-        serialize: async (_sessionId, task) => task(),
-        hasSession: () => true,
-        onReadable: () => undefined,
-        retrySettlement
-      },
-      'session-1'
-    )
+    await restoreStructuredAgentSessionsOnRestart({
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the restore reads only the record's session id here.
+      records: [{ sessionId: 'session-1' } as AgentSessionRecord],
+      openDeps: NO_OPEN_DEPS,
+      reconcile: async () => null,
+      resolveRecovery: async () => undefined,
+      serialize: async (_sessionId, task) => task(),
+      hasSession: () => true,
+      onReadable: () => undefined
+    })
 
-    expect(retrySettlement).not.toHaveBeenCalled()
+    // The open is where the settlement runs, and a session already open is not opened again.
+    expect(restoreRead).not.toHaveBeenCalled()
   })
 })
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-restore.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-restore.ts
index 38c04d2a5973..d54687c25a64 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-restore.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-restore.ts
@@ -8,42 +8,37 @@
 // It does not owe a provider child. This used to resume every record whose lease was `released`,
 // which is the normal end state of a chat the user closed cleanly — so a
 // healthy profile started an app-server per session it had ever used, in parallel, at every launch,
-// with no client attached and nothing on screen. A child now exists because a surface asked for the
-// session (see `structured-agent-session-holds`), not because a record survived on disk.
+// with no client attached and nothing on screen. A child now exists because work asked for it — a
+// send, through the delivery loop — not because a record survived on disk.
 
 import type { AgentSessionRecord } from '../../../shared/agent-session-record'
 import type { AgentSessionWireRefusal } from '../../../shared/agent-session-wire'
-import type { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
 import { mapWithConcurrency } from '../../../shared/map-with-concurrency'
-import {
-  restoreStructuredAgentSessionRead,
-  type RestoredStructuredAgentSessionRead
-} from './structured-agent-session-read-restore'
+import type { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
+import type {
+  OpenedStructuredAgentSessionConversation,
+  StructuredAgentSessionConversationOpenDeps
+} from './structured-agent-session-conversation-open'
+import { restoreStructuredAgentSessionRead } from './structured-agent-session-read-restore'
 
 const JOURNAL_RESTORE_CONCURRENCY = 4
 
 export type StructuredAgentSessionReadRestoreDeps = {
-  store: AgentSessionRecordStore
-  journalRoot: string
+  openDeps: StructuredAgentSessionConversationOpenDeps & {
+    store: Pick<AgentSessionRecordStore, 'getRecord' | 'listRecords'>
+  }
   reconcile: (sessionId: string) => Promise<AgentSessionWireRefusal | null>
   resolveRecovery: (sessionId: string) => Promise<unknown>
   serialize: <T>(sessionId: string, task: () => Promise<T>) => Promise<T>
   hasSession: (sessionId: string) => boolean
-  onReadable: (sessionId: string, restored: RestoredStructuredAgentSessionRead) => void
-  retrySettlement: (
+  onReadable: (
     sessionId: string,
-    params: RestoredStructuredAgentSessionRead['params']
-  ) => Promise<boolean>
+    opened: OpenedStructuredAgentSessionConversation
+  ) => Promise<void> | void
 }
 
-/**
- * One session's share of the restart restore, and the whole of an on-demand one.
- *
- * Startup maps this over every supported record; a surface asking for a session it cannot see
- * calls it for one id. The CALLER decides which records are eligible — startup filters by
- * `supportsRecord` before mapping, so an on-demand caller owes the same check.
- */
-export async function restoreOneStructuredAgentSessionRead(
+/** One session's share of the restart restore. Startup maps this over every supported record. */
+async function restoreOneStructuredAgentSessionRead(
   input: StructuredAgentSessionReadRestoreDeps,
   sessionId: string
 ): Promise<void> {
@@ -57,29 +52,21 @@ export async function restoreOneStructuredAgentSessionRead(
   )
 }
 
-/** The serialized half of the restore, for a caller already inside the session's serialize — a
- *  send replaying into a session this host has closed, which needs the journal and no child. */
-export async function restoreOneStructuredAgentSessionReadUnderSerialize(
-  input: Pick<
-    StructuredAgentSessionReadRestoreDeps,
-    'store' | 'journalRoot' | 'hasSession' | 'onReadable' | 'retrySettlement'
-  >,
+/** The serialized half of the restore. */
+async function restoreOneStructuredAgentSessionReadUnderSerialize(
+  input: Pick<StructuredAgentSessionReadRestoreDeps, 'openDeps' | 'hasSession' | 'onReadable'>,
   sessionId: string
 ): Promise<void> {
   if (input.hasSession(sessionId)) {
-    // A surface that took a hold mid-restore already attached this one.
+    // A read or a send mid-restore already opened this one.
     return
   }
-  const restored = await restoreStructuredAgentSessionRead(
-    input.store,
-    input.journalRoot,
-    sessionId
-  )
-  if (!restored) {
+  const opened = await restoreStructuredAgentSessionRead(input.openDeps, sessionId)
+  if (!opened) {
     return
   }
-  input.onReadable(sessionId, restored)
-  await input.retrySettlement(sessionId, restored.params)
+  // The open settled what a gone generation left running, so no reader sees it run.
+  await input.onReadable(sessionId, opened)
 }
 
 export async function restoreStructuredAgentSessionsOnRestart(
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-resume-host.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-resume-host.ts
index 0770190c2f4f..d053caf006b2 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-resume-host.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-resume-host.ts
@@ -1,21 +1,18 @@
 // Restart offers are durable per-session records. Listing reserves nothing and removes only offers
 // the chat has provably moved past; an explicit action reserves records, and only a completed
-// action removes them — or files what went wrong.
+// action removes them — or files what went wrong. Starting the chat's agent again withdraws them.
 
 import { randomUUID } from 'node:crypto'
+import {
+  AgentSessionRefusalError,
+  agentSessionRefusalFromReference
+} from '../../../shared/agent-session-wire-refusals'
 import type { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
 import type { AgentSessionRecoveryCapsule } from '../../runtime/agent-session-recovery-capsule'
 import type {
   AgentSessionResumeMarker,
   AgentSessionResumeTrigger
 } from '../../../shared/agent-session-resume-marker'
-import type { AgentJournalMessageItem } from '../../../shared/agent-session-journal-types'
-import type {
-  AgentSessionMutationEnvelope,
-  AgentSessionMutationResult,
-  AgentSessionSendResult
-} from '../../../shared/agent-session-wire'
-import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
 import type { StructuredAgentSessionAdapter } from './structured-agent-session-adapter'
 import { createStructuredAgentSessionRestartCandidateReader } from './structured-agent-session-restart-candidates'
 import {
@@ -34,33 +31,21 @@ import {
   type StructuredAgentSessionResumeOutcome
 } from './structured-agent-session-restart-resume-runner'
 import {
-  continueStructuredAgentSessionAfterRestart,
-  noteRestartReattachFailed,
   restartContinuationDeps,
+  startStructuredAgentSessionContinuation,
   type StructuredAgentSessionContinuationHost,
   type StructuredAgentSessionContinuationOutcome
 } from './structured-agent-session-restart-continuation'
+import { restartContinuationId } from './structured-agent-session-restart-continuation-envelope'
+import {
+  createStructuredAgentSessionRestartOfferWithdrawal,
+  type StructuredAgentSessionRestartOfferSession
+} from './structured-agent-session-restart-offer-withdrawal'
+import type { StructuredAgentSessionRestartResumeSurfaces } from './structured-agent-session-restart-resume-wiring'
 import { createStructuredAgentSessionRestartWitnesses } from './structured-agent-session-restart-witnesses'
+import { structuredAgentSessionConversationFence } from './structured-agent-session-provider-child'
 
-type LiveSession = { journal: AgentSessionJournal; hasProviderChild: boolean; fence: number }
-
-export type StructuredAgentSessionRestartResumeSurfaces = {
-  publish: (sessionId: string, journal: AgentSessionJournal) => void
-  revealSession: (sessionId: string) => Promise<{ readable: boolean }>
-  hold: (sessionId: string, holderId: string) => Promise<void>
-  release: (sessionId: string, holderId: string) => void
-  send: (input: {
-    envelope: AgentSessionMutationEnvelope
-    body: AgentJournalMessageItem
-    beforeRun?: () => void
-  }) => Promise<AgentSessionMutationResult<AgentSessionSendResult>>
-  awaitSendSettlement: (
-    sessionId: string,
-    clientMessageId: string
-  ) => Promise<{ value: AgentSessionSendResult } | undefined>
-  onNoteFailed: (sessionId: string, error: unknown) => void
-  now: () => number
-}
+type LiveSession = StructuredAgentSessionRestartOfferSession
 
 export type StructuredAgentSessionRestartResume = {
   /** Teardown: begin, then per session a snapshot right before its child stops and a confirmation
@@ -72,10 +57,6 @@ export type StructuredAgentSessionRestartResume = {
   list: () => Promise<StructuredAgentSessionResumeCandidate[]>
   /** Offers already acted on whose agent did not carry on. Read-only; nothing here is spent. */
   listFailures: () => Promise<StructuredAgentSessionResumeFailure[]>
-  resume: (
-    sessionIds: readonly string[] | undefined,
-    owner: string
-  ) => Promise<StructuredAgentSessionResumeOutcome[]>
   continueAfterRestart: (
     sessionIds: readonly string[] | undefined,
     owner: string
@@ -87,6 +68,8 @@ export type StructuredAgentSessionRestartResume = {
   }>
   /** Named sessions forget their offer or failure; unnamed, every durable record goes. */
   dismiss: (sessionIds?: readonly string[]) => Promise<number>
+  /** The chat's agent proved a start: its offer ends unless the start is a resume's own. */
+  onAgentStarted: (sessionId: string) => void
 }
 
 export function createStructuredAgentSessionRestartResume(
@@ -101,11 +84,6 @@ export function createStructuredAgentSessionRestartResume(
   const admission = new StructuredAgentSessionResumeAdmission()
   const enqueueRecoveryOperation = createStructuredAgentSessionRestartOperationQueue()
 
-  const derive = createStructuredAgentSessionRestartCandidateReader({
-    sessions,
-    getRecord: deps.store.getRecord,
-    adapter: deps.adapter
-  })
   const witnesses = createStructuredAgentSessionRestartWitnesses({
     sessions,
     getRecord: deps.store.getRecord,
@@ -115,15 +93,24 @@ export function createStructuredAgentSessionRestartResume(
     now: surfaces.now,
     enqueue: enqueueRecoveryOperation
   })
-  const failures = createStructuredAgentSessionRestartFailureLedger({
+  const withdrawal = createStructuredAgentSessionRestartOfferWithdrawal({
+    sessions,
     ...(deps.recoveryCapsule ? { capsule: deps.recoveryCapsule } : {}),
+    now: surfaces.now,
+    enqueue: enqueueRecoveryOperation
+  })
+  const derive = createStructuredAgentSessionRestartCandidateReader({
     sessions,
-    reveal: async (sessionId) => {
-      await surfaces.revealSession(sessionId).catch(() => null)
-    },
+    getRecord: deps.store.getRecord,
+    adapter: deps.adapter,
+    movedOn: withdrawal.movedOn
+  })
+  const failures = createStructuredAgentSessionRestartFailureLedger({
+    ...(deps.recoveryCapsule ? { capsule: deps.recoveryCapsule } : {}),
     getRecord: deps.store.getRecord,
     adapter: deps.adapter,
     retryable: (marker) => derive([marker], 'may-be-held').candidates.length === 1,
+    reveal: (markers) => revealMarkers(markers),
     now: surfaces.now,
     enqueue: enqueueRecoveryOperation
   })
@@ -153,19 +140,20 @@ export function createStructuredAgentSessionRestartResume(
   const continuationHost: StructuredAgentSessionContinuationHost = {
     ...surfaces,
     sessions,
-    stillResumable: (marker, options) =>
-      derive([marker], 'may-be-held', options).candidates.length === 1
+    conversationFence: (sessionId) =>
+      deps.store.getRecord(sessionId)
+        ? structuredAgentSessionConversationFence(deps.store, sessionId)
+        : null,
+    stillResumable: (marker) => derive([marker], 'may-be-held').candidates.length === 1
   }
 
+  /** One explicit action: reserve the offers, then continue each through `continueOne`, a few at
+   *  a time. The runner counts a chat as done once `continueOne` returns. */
   const run = async (
     sessionIds: readonly string[] | undefined,
     owner: string,
-    afterAcquire?: (marker: AgentSessionResumeMarker) => Promise<void>,
-    settlement: Omit<Parameters<typeof failures.settle>[2], 'candidates' | 'attempts'> = {
-      failureAfterResume: () => null,
-      failureReason: () => 'agent_session_resume_refused'
-    }
-  ): Promise<StructuredAgentSessionResumeOutcome[]> => {
+    continueOne: (marker: AgentSessionResumeMarker, continuationId: string) => Promise<void>
+  ) => {
     // An explicit action supersedes teardown witnesses captured by this host. The durable mutation
     // lane below also drains a publication already in flight before completion.
     witnesses.clear()
@@ -176,25 +164,26 @@ export function createStructuredAgentSessionRestartResume(
     retireSuperseded(derived.superseded)
     const eligible = derived.candidates.filter((candidate) => requested.has(candidate.sessionId))
     if (eligible.length === 0) {
-      return []
+      return null
     }
     const operationId = randomUUID()
+    const actionAt = surfaces.now()
+    // Tagged with its offer, so a rejected one is told apart for as long as the offer lasts.
+    const continuationFor = (marker: AgentSessionResumeMarker) =>
+      restartContinuationId(marker, operationId, actionAt)
     const reserved =
       (await enqueueRecoveryOperation(
         () =>
           deps.recoveryCapsule?.beginResume(
             eligible.map((candidate) => candidate.sessionId),
             operationId,
-            surfaces.now()
+            actionAt
           ) ?? Promise.resolve([])
       )) ?? []
     const markersBySession = new Map(reserved.map((marker) => [marker.sessionId, marker]))
     const candidates = derive(reserved, 'may-be-held').candidates
-    const attempts = failures.attempts(markersBySession)
-
-    let outcomes: StructuredAgentSessionResumeOutcome[]
     try {
-      outcomes = await resumeStructuredAgentSessionsFromRestart(
+      const outcomes = await resumeStructuredAgentSessionsFromRestart(
         {
           admission,
           consumeMarker: async (sessionId) => {
@@ -202,26 +191,16 @@ export function createStructuredAgentSessionRestartResume(
             return marker !== undefined && derive([marker], 'may-be-held').candidates.length === 1
           },
           resume: async (sessionId) => {
-            const holder = `restart-resume:${sessionId}`
-            try {
-              await surfaces.hold(sessionId, holder).catch(async (error: unknown) => {
-                // The reattach failure is filed like any other, so the chat must say so too.
-                await noteRestartReattachFailed(continuationHost, sessionId)
-                throw error
-              })
-              const marker = markersBySession.get(sessionId)
-              if (marker) {
-                await afterAcquire?.(marker)
-              }
-            } finally {
-              attempts.observe(sessionId)
-              surfaces.release(sessionId, holder)
+            const marker = markersBySession.get(sessionId)
+            if (marker) {
+              await continueOne(marker, continuationFor(marker))
             }
           }
         },
         candidates,
         owner
       )
+      return { operationId, outcomes, candidates, markers: markersBySession }
     } catch (error) {
       if (deps.recoveryCapsule) {
         await enqueueRecoveryOperation(() =>
@@ -232,8 +211,6 @@ export function createStructuredAgentSessionRestartResume(
       }
       throw error
     }
-    await failures.settle(operationId, outcomes, { candidates, attempts, ...settlement })
-    return outcomes
   }
 
   const continueAfterRestart = async (
@@ -246,34 +223,50 @@ export function createStructuredAgentSessionRestartResume(
     failed?: StructuredAgentSessionResumeFailure[]
   }> => {
     const continued: StructuredAgentSessionContinuationOutcome[] = []
-    const continuationFor = (sessionId: string) =>
-      continued.find((outcome) => outcome.sessionId === sessionId)
-    const resumed = await run(
-      sessionIds,
-      owner,
-      async (marker) => {
-        continued.push(
-          await continueStructuredAgentSessionAfterRestart(
-            restartContinuationDeps(continuationHost, marker),
-            marker.sessionId,
-            marker
-          )
-        )
-      },
-      {
+    const verdicts: Promise<void>[] = []
+    // A chat holds its slot until its agent took the continuation or its start failed, so a batch
+    // never starts more agents at once than the runner allows; the provider's answer comes after.
+    const action = await run(sessionIds, owner, async (marker, continuationId) => {
+      const started = await startStructuredAgentSessionContinuation(
+        restartContinuationDeps(continuationHost, marker),
+        marker.sessionId,
+        marker,
+        continuationId
+      )
+      if ('done' in started) {
+        continued.push(started.done)
+        const { outcome, reason, refusal } = started.done
+        if (outcome === 'refused') {
+          // Thrown as a refusal so the filed failure keeps its details beside the code.
+          throw refusal
+            ? new AgentSessionRefusalError(agentSessionRefusalFromReference(refusal, refusal.code))
+            : new Error(reason ?? 'agent_session_continuation_refused')
+        }
+        return
+      }
+      verdicts.push(started.verdict().then((outcome) => void continued.push(outcome)))
+    })
+    await Promise.all(verdicts)
+    const resumed = action?.outcomes ?? []
+    if (action) {
+      await failures.settle(action.operationId, resumed, {
+        candidates: action.candidates,
+        markers: action.markers,
         failureAfterResume: (sessionId) => {
-          const outcome = continuationFor(sessionId)
-          // Reattached but never asked to continue: nothing confirms the agent carried on.
-          return outcome ? continuationFailureOutcome(outcome.outcome) : 'unconfirmed'
+          const outcome = continued.find((entry) => entry.sessionId === sessionId)
+          return outcome ? continuationFailureOutcome(outcome.outcome) : null
         },
         failureReason: (sessionId) => {
-          const outcome = continuationFor(sessionId)
+          const outcome = continued.find((entry) => entry.sessionId === sessionId)
           return outcome?.reason ?? outcome?.outcome ?? 'agent_session_continuation_unknown'
         }
-      }
-    )
+      })
+    }
     for (const outcome of resumed) {
-      if (outcome.outcome !== 'resumed') {
+      if (
+        outcome.outcome !== 'resumed' &&
+        !continued.some((entry) => entry.sessionId === outcome.sessionId)
+      ) {
         continued.push({
           sessionId: outcome.sessionId,
           outcome: 'refused',
@@ -307,7 +300,7 @@ export function createStructuredAgentSessionRestartResume(
     // Do not let a teardown witness already captured in this host republish after explicit
     // dismissal. A later capture is a new interruption and may create a fresh offer normally.
     dismiss: (sessionIds) => failures.dismiss(sessionIds, witnesses.clear),
-    resume: (sessionIds, owner) => run(sessionIds, owner),
-    continueAfterRestart
+    continueAfterRestart,
+    onAgentStarted: withdrawal.onAgentStarted
   }
 }
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-resume-runner.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-resume-runner.ts
index 33a07e80335c..a298e23f454e 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-resume-runner.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-resume-runner.ts
@@ -1,14 +1,17 @@
 // Delivering the explicit restart action: the one path that turns a resumable candidate back into
-// a live agent.
+// a working agent.
 //
 // The manual "Resume" button and the automatic setting both land here, so the two can never drift
 // into different eligibility or different double-fire protection.
 //
-// Resume itself acquires a provider child, not a new send. The first resume-capable hold on a
-// childless session re-acquires the provider's own conversation — Claude's `resume` by session id,
-// Codex's thread id — which is native continuation. Nothing re-sends the user's prompt: that is
-// what makes an agent redo work it already finished.
+// A resume is the continuation send. Its delivery starts the provider on its own conversation —
+// Claude's `resume` by session id, Codex's thread id — which is native continuation. Nothing
+// re-sends the user's prompt: that is what makes an agent redo work it already finished.
 
+import {
+  isAgentSessionRefusalError,
+  type AgentSessionAnyRefusalDetails
+} from '../../../shared/agent-session-wire-refusals'
 import { forEachWithConcurrency } from '../../../shared/map-with-concurrency'
 import type { StructuredAgentSessionResumeCandidate } from './structured-agent-session-restart-resume-set'
 
@@ -27,6 +30,8 @@ export type StructuredAgentSessionResumeOutcome = {
   outcome: 'resumed' | 'refused'
   /** Refusal code; `agent_session_resume_already_in_progress` names the live owner in `owner`. */
   reason?: string
+  /** A thrown refusal's details, kept apart so `reason` stays the code readers match. */
+  details?: AgentSessionAnyRefusalDetails
   owner?: string
 }
 
@@ -52,7 +57,7 @@ function resumeAdmissionOwner(error: unknown): string | null {
  * One resume per session at a time, whoever is asking.
  *
  * Two surfaces can reach for the same chat at once — the banner's "Resume all" and a user clicking
- * one row — and both would otherwise take a hold, race the acquisition, and leave the loser's
+ * one row — and both would otherwise send the continuation twice, and leave the loser's
  * refusal looking like a real failure. The second caller is told who holds it instead.
  */
 export class StructuredAgentSessionResumeAdmission {
@@ -80,7 +85,7 @@ export type StructuredAgentSessionResumeRunnerDeps = {
   admission: StructuredAgentSessionResumeAdmission
   /** Validates this action's durable reservation. False means the candidate is no longer eligible. */
   consumeMarker: (sessionId: string) => Promise<boolean>
-  /** Acquires the provider child for the reserved session. */
+  /** Continues the reserved session; resolves once its agent took the message or refused it. */
   resume: (sessionId: string) => Promise<void>
   concurrency?: number
 }
@@ -123,10 +128,12 @@ async function resumeOne(
   } catch (error) {
     const reason = error instanceof Error ? error.message : String(error)
     const owner = resumeAdmissionOwner(error)
+    const details = isAgentSessionRefusalError(error) ? error.refusal.details : undefined
     return {
       sessionId,
       outcome: 'refused',
       reason,
+      ...(details ? { details } : {}),
       ...(owner === null ? {} : { owner })
     }
   }
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-resume-set.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-resume-set.ts
index 245fbcf4bbf1..3c91a9732b9b 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-resume-set.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-resume-set.ts
@@ -7,12 +7,12 @@
 // restored thread), and every reading of those rewrites as "the work is done" dropped chats that
 // were owed a resume.
 //
-// An offer ends only by the user's own actions. The ones this predicate can see — a newer message
-// of theirs in that chat, or the conversation forked — are reported back as `superseded` so the
-// caller DELETES the record rather than filtering it forever. What remains are structural checks
-// that are not about work at all: the record still exists and this build supports it, and the
-// lease is free.
+// An offer ends when the chat moves on after the restart — another message accepted, or its agent
+// started — or when the conversation forked. Both are reported back as `superseded` so the caller
+// DELETES the record rather than filtering it forever. What remains are structural checks that are not about work at all: the record still
+// exists and this build supports it, and the lease is free.
 
+import type { AgentSessionAnyRefusalDetails } from '../../../shared/agent-session-wire-refusals'
 import type { AgentSessionRecord } from '../../../shared/agent-session-record'
 import {
   agentSessionProviderHandleChainHead,
@@ -57,6 +57,8 @@ export type StructuredAgentSessionResumeFailure = StructuredAgentSessionResumeCa
   outcome: AgentSessionResumeFailureOutcome
   /** The host's or provider's refusal code, verbatim, so it can be quoted in a report. */
   reason: string
+  /** The refusal's details beside its code in `reason`; absent on older records and non-refusals. */
+  details?: AgentSessionAnyRefusalDetails
   /** Whether naming it in an action would run it again: whether it is still an offer. A
    *  continuation the chat already holds, or the user having moved on, makes a retry a no-op no
    *  matter what the reason says. */
@@ -65,8 +67,8 @@ export type StructuredAgentSessionResumeFailure = StructuredAgentSessionResumeCa
 
 export type StructuredAgentSessionResumableSet = {
   candidates: StructuredAgentSessionResumeCandidate[]
-  /** Markers the chat has provably moved past — a newer user message, or a forked conversation.
-   *  Every ending deletes: the caller retires these rather than re-filtering them forever. */
+  /** Markers the chat has provably moved past, or whose conversation forked. Every ending deletes:
+   *  the caller retires these rather than re-filtering them forever. */
   superseded: AgentSessionResumeMarker[]
 }
 
@@ -75,8 +77,8 @@ export type StructuredAgentSessionResumeSetInput = {
   getRecord: (sessionId: string) => AgentSessionRecord | null
   supportsRecord: (record: AgentSessionRecord) => boolean
   latestPrompt: (sessionId: string) => string
-  /** Undefined when the chat's journal is not readable here, which decides nothing. */
-  latestUserItemId: (sessionId: string) => string | null | undefined
+  /** Whether the chat moved on since the offer was taken; false when its journal is not open here. */
+  movedOn: (marker: AgentSessionResumeMarker) => boolean
   /**
    * Whether the lease must be free.
    *
@@ -103,7 +105,7 @@ export function structuredAgentSessionResumableSet(
       continue
     }
     // A conversation that FORKED since teardown is not the one we marked, and can never be again:
-    // deleted like a newer message, so it cannot sit unseen forever. Compared by identity root,
+    // deleted, so it cannot sit unseen forever. Compared by identity root,
     // because a resume legitimately advances Claude's leaf and that is not a fork.
     const head = agentSessionProviderHandleChainHead(record.providerHandleChain)
     if (!head) {
@@ -113,10 +115,7 @@ export function structuredAgentSessionResumableSet(
       superseded.push(marker)
       continue
     }
-    // The user moving on is the one thing that withdraws the offer. Anything the provider does on
-    // its own after reattaching — a turn it opens, a prompt, restated rows — is not.
-    const latestUserItemId = input.latestUserItemId(marker.sessionId)
-    if (latestUserItemId !== undefined && latestUserItemId !== marker.latestUserItemId) {
+    if (input.movedOn(marker)) {
       superseded.push(marker)
       continue
     }
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-resume-test-harness.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-resume-test-harness.ts
index e5b65009634a..e359e31157b9 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-resume-test-harness.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-resume-test-harness.ts
@@ -145,7 +145,7 @@ export type HarnessJournal = {
   appendItem: (envelope: unknown, body: { kind: string; text: string }) => Promise<void>
 }
 
-export type HarnessSession = { journal: HarnessJournal; hasProviderChild: boolean; fence?: number }
+export type HarnessSession = { journal: HarnessJournal; child: { fence: number } | null }
 
 export function journal(
   items: AgentJournalRenderItem[],
@@ -203,13 +203,12 @@ export function resumableSet(input: {
   markers: AgentSessionResumeMarker[]
   items?: AgentJournalRenderItem[]
   chain?: AgentSessionRecord['providerHandleChain']
-  latestUserItemId?: string | null
 }) {
   return structuredAgentSessionResumableSet({
     markers: input.markers,
     getRecord: () => record(input.chain === undefined ? {} : { chain: input.chain }),
     supportsRecord: () => true,
     latestPrompt: () => 'fix the auth bug',
-    latestUserItemId: () => input.latestUserItemId ?? null
+    movedOn: () => false
   })
 }
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-resume-wiring.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-resume-wiring.ts
index 4494392fb485..4004502e4081 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-resume-wiring.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-resume-wiring.ts
@@ -11,7 +11,27 @@ import type {
   AgentSessionMutationResult,
   AgentSessionSendResult
 } from '../../../shared/agent-session-wire'
-import type { StructuredAgentSessionRestartResumeSurfaces } from './structured-agent-session-restart-resume-host'
+import { MAX_TIMER_DELAY_MS } from '../../../shared/timer-delay'
+import type { SendSettlementWaitOptions } from './structured-agent-session-send-settlement'
+
+export type StructuredAgentSessionRestartResumeSurfaces = {
+  revealSession: (sessionId: string) => Promise<{ readable: boolean }>
+  send: (input: {
+    envelope: AgentSessionMutationEnvelope
+    body: AgentJournalMessageItem
+    beforeRun?: () => void
+  }) => Promise<AgentSessionMutationResult<AgentSessionSendResult>>
+  awaitSendSettlement: (
+    sessionId: string,
+    clientMessageId: string
+  ) => Promise<{ value: AgentSessionSendResult } | undefined>
+  awaitSendHandedOver: (
+    sessionId: string,
+    clientMessageId: string
+  ) => Promise<{ value: AgentSessionSendResult } | undefined>
+  onNoteFailed: (sessionId: string, error: unknown) => void
+  now: () => number
+}
 
 /** The caller key the continuation sends under, so its writes are attributable to Orca itself. */
 export const STRUCTURED_AGENT_SESSION_RESTART_CONTINUATION_CALLER =
@@ -21,8 +41,6 @@ export const STRUCTURED_AGENT_SESSION_RESTART_CONTINUATION_CALLER =
  *  dependency, and nothing outside this list is reachable from here. */
 type RestartResumeHostBindings = {
   revealSession: (sessionId: string) => Promise<{ readable: boolean }>
-  hold: (sessionId: string, holderId: string) => Promise<void>
-  release: (sessionId: string, holderId: string) => void
   send: (
     caller: { callerKey: string },
     params: {
@@ -34,21 +52,30 @@ type RestartResumeHostBindings = {
   /** The host's existing settlement waiter; a send returns while its dispatch is still pending. */
   waitForSendSettlement: (
     sessionId: string,
-    clientMessageId: string
+    clientMessageId: string,
+    options: SendSettlementWaitOptions
   ) => Promise<{ value: AgentSessionSendResult } | undefined>
 }
 
 export function structuredAgentSessionRestartResumeSurfaces(
   host: RestartResumeHostBindings,
   now: () => number
-): Omit<StructuredAgentSessionRestartResumeSurfaces, 'publish'> {
+): StructuredAgentSessionRestartResumeSurfaces {
   return {
     revealSession: host.revealSession,
-    hold: host.hold,
-    release: host.release,
     send: (params) =>
       host.send({ callerKey: STRUCTURED_AGENT_SESSION_RESTART_CONTINUATION_CALLER }, params),
-    awaitSendSettlement: host.waitForSendSettlement,
+    // Accepted like any send, so its verdict is its delivery, however long the start takes; the
+    // wait ends when the submission settles or the session closes.
+    awaitSendSettlement: (sessionId, clientMessageId) =>
+      host.waitForSendSettlement(sessionId, clientMessageId, { budgetMs: MAX_TIMER_DELAY_MS }),
+    // How long a restart batch holds a chat's slot: until the agent took the message or its start
+    // failed. Undefined — the session closed, or too many waited — frees the slot too.
+    awaitSendHandedOver: (sessionId, clientMessageId) =>
+      host.waitForSendSettlement(sessionId, clientMessageId, {
+        until: 'handed-over',
+        budgetMs: MAX_TIMER_DELAY_MS
+      }),
     onNoteFailed: () =>
       console.warn('[structured-agent-session] restart continuation attribution failed'),
     now
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-resume.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-resume.test.ts
index 1d6a8a1fc5ec..efcd70345a83 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-resume.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-resume.test.ts
@@ -17,6 +17,7 @@ import { structuredAgentSessionWorkingAtStop } from './structured-agent-session-
 import {
   CLAUDE_ROOT,
   claudeRecord,
+  EPOCH,
   HANDLE_ROOT,
   journal,
   TEARDOWN_CURRENT,
@@ -48,7 +49,7 @@ describe('deriving what was working at teardown', () => {
   it('marks a session this host was running a turn for', () => {
     const markers = markersAtTeardown({
       sessions: new Map([
-        [SESSION, { journal: journal([turnItem('turn-1', 'running')]), hasProviderChild: true }]
+        [SESSION, { journal: journal([turnItem('turn-1', 'running')]), child: { fence: 1 } }]
       ]),
       getRecord: () => record(),
       backgroundTasks: () => undefined,
@@ -64,6 +65,7 @@ describe('deriving what was working at teardown', () => {
         recordedAt: NOW,
         trigger: 'quit',
         teardownId: TEARDOWN_CURRENT,
+        journalCursor: { epoch: EPOCH, sequence: 1 },
         providerHandleRoot: HANDLE_ROOT,
         latestUserItemId: null,
         activity: { state: 'working', prompts: [], tasks: [] }
@@ -74,7 +76,7 @@ describe('deriving what was working at teardown', () => {
   it('carries the update trigger so the surface can say the restart was not the user choice', () => {
     const [recorded] = markersAtTeardown({
       sessions: new Map([
-        [SESSION, { journal: journal([turnItem('turn-1', 'running')]), hasProviderChild: true }]
+        [SESSION, { journal: journal([turnItem('turn-1', 'running')]), child: { fence: 1 } }]
       ]),
       getRecord: () => record(),
       backgroundTasks: () => undefined,
@@ -89,7 +91,7 @@ describe('deriving what was working at teardown', () => {
   it('marks nothing for an idle session', () => {
     expect(
       markersAtTeardown({
-        sessions: new Map([[SESSION, { journal: journal([]), hasProviderChild: true }]]),
+        sessions: new Map([[SESSION, { journal: journal([]), child: { fence: 1 } }]]),
         getRecord: () => record(),
         backgroundTasks: () => undefined,
         trigger: 'quit',
@@ -103,7 +105,7 @@ describe('deriving what was working at teardown', () => {
     expect(
       markersAtTeardown({
         sessions: new Map([
-          [SESSION, { journal: journal([turnItem('turn-1', 'completed')]), hasProviderChild: true }]
+          [SESSION, { journal: journal([turnItem('turn-1', 'completed')]), child: { fence: 1 } }]
         ]),
         getRecord: () => record(),
         backgroundTasks: () => undefined,
@@ -115,12 +117,12 @@ describe('deriving what was working at teardown', () => {
   })
 
   // The user's stated fear. A journal restored for READING carries whatever `running` row an older
-  // crash left behind, and it is the live `hasProviderChild` — not that row — that decides.
+  // crash left behind, and it is the live `child` — not that row — that decides.
   it('marks nothing for a stale running row this host was not executing', () => {
     expect(
       markersAtTeardown({
         sessions: new Map([
-          [SESSION, { journal: journal([turnItem('turn-1', 'running')]), hasProviderChild: false }]
+          [SESSION, { journal: journal([turnItem('turn-1', 'running')]), child: null }]
         ]),
         getRecord: () => record(),
         backgroundTasks: () => undefined,
@@ -141,7 +143,7 @@ describe('deriving what was working at teardown', () => {
           SESSION,
           {
             journal: journal([turnItem('turn-1', 'running'), pendingApproval()]),
-            hasProviderChild: true
+            child: { fence: 1 }
           }
         ]
       ]),
@@ -165,7 +167,7 @@ describe('deriving what was working at teardown', () => {
   it('marks a settled lead whose subagent was still running, anchored on its last turn', () => {
     const markers = markersAtTeardown({
       sessions: new Map([
-        [SESSION, { journal: journal([turnItem('turn-1', 'completed')]), hasProviderChild: true }]
+        [SESSION, { journal: journal([turnItem('turn-1', 'completed')]), child: { fence: 1 } }]
       ]),
       getRecord: () => record(),
       backgroundTasks: () => [
@@ -188,7 +190,7 @@ describe('deriving what was working at teardown', () => {
   it('records only the live rows of the roster, bounded', () => {
     const [recorded] = markersAtTeardown({
       sessions: new Map([
-        [SESSION, { journal: journal([turnItem('turn-1', 'completed')]), hasProviderChild: true }]
+        [SESSION, { journal: journal([turnItem('turn-1', 'completed')]), child: { fence: 1 } }]
       ]),
       getRecord: () => record(),
       backgroundTasks: () => [
@@ -213,7 +215,7 @@ describe('deriving what was working at teardown', () => {
   it('marks a settled lead whose only live work is a monitor', () => {
     const markers = markersAtTeardown({
       sessions: new Map([
-        [SESSION, { journal: journal([turnItem('turn-1', 'completed')]), hasProviderChild: true }]
+        [SESSION, { journal: journal([turnItem('turn-1', 'completed')]), child: { fence: 1 } }]
       ]),
       getRecord: () => record(),
       backgroundTasks: () => [{ id: 'task-m', kind: 'monitor', name: 'ci-watch' }],
@@ -230,7 +232,7 @@ describe('deriving what was working at teardown', () => {
     expect(
       markersAtTeardown({
         sessions: new Map([
-          [SESSION, { journal: journal([turnItem('turn-1', 'completed')]), hasProviderChild: true }]
+          [SESSION, { journal: journal([turnItem('turn-1', 'completed')]), child: { fence: 1 } }]
         ]),
         getRecord: () => record(),
         backgroundTasks: () => [
@@ -248,7 +250,7 @@ describe('deriving what was working at teardown', () => {
   it('records the identity root so an advancing Claude leaf cannot invalidate the marker', () => {
     const [recorded] = markersAtTeardown({
       sessions: new Map([
-        [SESSION, { journal: journal([turnItem('turn-1', 'running')]), hasProviderChild: true }]
+        [SESSION, { journal: journal([turnItem('turn-1', 'running')]), child: { fence: 1 } }]
       ]),
       getRecord: () => claudeRecord(null),
       backgroundTasks: () => undefined,
@@ -264,7 +266,7 @@ describe('deriving what was working at teardown', () => {
     expect(
       markersAtTeardown({
         sessions: new Map([
-          [SESSION, { journal: journal([turnItem('turn-1', 'running')]), hasProviderChild: true }]
+          [SESSION, { journal: journal([turnItem('turn-1', 'running')]), child: { fence: 1 } }]
         ]),
         getRecord: () => record({ chain: [] }),
         backgroundTasks: () => undefined,
@@ -285,7 +287,7 @@ describe('deriving what was working at teardown', () => {
           SESSION,
           {
             journal: journal([], false, [submission('msg-1', 'pending')]),
-            hasProviderChild: true
+            child: { fence: 1 }
           }
         ]
       ]),
@@ -310,7 +312,7 @@ describe('deriving what was working at teardown', () => {
             journal: journal([turnItem('turn-0', 'completed')], false, [
               submission('msg-1', 'pending')
             ]),
-            hasProviderChild: true
+            child: { fence: 1 }
           }
         ]
       ]),
@@ -324,6 +326,67 @@ describe('deriving what was working at teardown', () => {
     expect(recorded?.work).toEqual({ kind: 'submission', id: 'msg-1' })
   })
 
+  // Accepted while the agent was starting and never handed over: the chat shows working, but no
+  // agent had the message, and quit rejects it as never sent.
+  it('marks nothing for a session whose only work is a message still queued', () => {
+    const queued = { ...submission('msg-1', 'pending'), handoverRecorded: true as const }
+    expect(
+      markersAtTeardown({
+        sessions: new Map([
+          [
+            SESSION,
+            {
+              journal: journal([turnItem('turn-0', 'completed')], false, [queued]),
+              child: { fence: 1 }
+            }
+          ]
+        ]),
+        getRecord: () => claudeRecord(null),
+        backgroundTasks: () => undefined,
+        trigger: 'quit',
+        teardownId: TEARDOWN_CURRENT,
+        now: NOW
+      })
+    ).toEqual([])
+  })
+
+  it('marks a handed-over message over a newer queued one, and a turn a queued one waits behind', () => {
+    const handedOver = {
+      ...submission('msg-1', 'pending'),
+      handoverRecorded: true as const,
+      handedOverAt: NOW
+    }
+    const queued = { ...submission('msg-2', 'pending'), handoverRecorded: true as const }
+    const markers = markersAtTeardown({
+      sessions: new Map([
+        [
+          SESSION,
+          {
+            journal: journal([turnItem('turn-0', 'completed')], false, [handedOver, queued]),
+            child: { fence: 1 }
+          }
+        ],
+        [
+          'session-running',
+          {
+            journal: journal([turnItem('turn-1', 'running')], false, [queued]),
+            child: { fence: 1 }
+          }
+        ]
+      ]),
+      getRecord: () => claudeRecord(null),
+      backgroundTasks: () => undefined,
+      trigger: 'quit',
+      teardownId: TEARDOWN_CURRENT,
+      now: NOW
+    })
+
+    expect(markers.map((entry) => entry.work)).toEqual([
+      { kind: 'submission', id: 'msg-1' },
+      { kind: 'turn', id: 'turn-1' }
+    ])
+  })
+
   // Once a turn exists it is the better identity: it is what eviction rewrites, so it is what the
   // journal can be asked about at launch.
   it('prefers the running turn over the send that opened it', () => {
@@ -335,7 +398,7 @@ describe('deriving what was working at teardown', () => {
             journal: journal([turnItem('turn-1', 'running')], false, [
               submission('msg-1', 'accepted')
             ]),
-            hasProviderChild: true
+            child: { fence: 1 }
           }
         ]
       ]),
@@ -390,7 +453,7 @@ describe('the resumable set', () => {
       getRecord: () => claudeRecord('5aed93d6-advanced-leaf'),
       supportsRecord: () => true,
       latestPrompt: () => '',
-      latestUserItemId: () => null
+      movedOn: () => false
     })
 
     expect(candidates).toHaveLength(1)
@@ -405,14 +468,14 @@ describe('the resumable set', () => {
       getRecord: () => claudeRecord(null, 'prov-session-2'),
       supportsRecord: () => true,
       latestPrompt: () => '',
-      latestUserItemId: () => null
+      movedOn: () => false
     })
 
     expect(set.candidates).toEqual([])
     expect(set.superseded).toEqual([forked])
   })
 
-  // An offer has no expiry: it ends only by the user's own actions, however old it is.
+  // An offer has no expiry, however old it is.
   it('still offers a months-old marker', () => {
     const monthsAgo = NOW - 90 * 24 * 60 * 60 * 1000
     expect(resumableSet({ markers: [marker({ recordedAt: monthsAgo })] }).candidates).toHaveLength(
@@ -420,16 +483,6 @@ describe('the resumable set', () => {
     )
   })
 
-  // The user moving on is what withdraws an offer — and it is reported for DELETION, not merely
-  // filtered, so the record does not have to be re-filtered on every read forever.
-  it('withdraws and reports for deletion once the user has sent a newer message', () => {
-    const withdrawn = marker()
-    const set = resumableSet({ markers: [withdrawn], latestUserItemId: 'user-newer' })
-
-    expect(set.candidates).toEqual([])
-    expect(set.superseded).toEqual([withdrawn])
-  })
-
   // Structural refusals are NOT endings: a record this host cannot see right now must not delete
   // a durable offer the user still owns.
   it('does not report a structurally refused marker for deletion', () => {
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-status-publication.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-status-publication.test.ts
index 884fba78a4ec..524d8943fac2 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-status-publication.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-status-publication.test.ts
@@ -95,7 +95,12 @@ async function restartWithPersistedTurn(): Promise<StructuredAgentSessionHost> {
   const host = createHost(store)
   expect(await host.attach(CALLER, hostTestAttachParams(null))).toMatchObject({ ok: true })
   const body = hostTestMessage('persisted conversation')
-  await host.send(CALLER, { envelope: sendEnvelope(store, { body }), body })
+  const sent = await host.send(CALLER, { envelope: sendEnvelope(store, { body }), body })
+  if (!sent.ok) {
+    throw new Error('send was refused')
+  }
+  // Delivered, not just accepted: a message still queued at the restart was never a request.
+  await host.waitForSendSettlement(SESSION, sent.value.clientMessageId)
   await host.flushAllStreamedEvents()
   return createHost(await AgentSessionRecordStore.open({ directory, hostId: 'local' }))
 }
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-teardown.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-teardown.test.ts
index cc40d4831875..bf740ac405b2 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-restart-teardown.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-restart-teardown.test.ts
@@ -30,7 +30,7 @@ it.each(['beginTeardown', 'captureBeforeStop', 'recordMarkers'] as const)(
       )
       expect(warning.mock.calls.flat().map(String).join(' ')).not.toContain(failure.message)
       expect(store.getRecord(SESSION)?.lease.claimStatus).toBe('released')
-      expect(() => host.journalSnapshot(SESSION)).toThrow('agent_session_ownership_unknown')
+      await expect(host.journalSnapshot(SESSION)).rejects.toThrow('agent_session_ownership_unknown')
     } finally {
       operation.mockRestore()
       warning.mockRestore()
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-resume-eligibility.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-resume-eligibility.ts
index 1b0540183710..93a7962d4a20 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-resume-eligibility.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-resume-eligibility.ts
@@ -7,17 +7,14 @@
 // it answers "may this be resumed", not "should it be" — so it lives here now and the caller that
 // knows a surface is asking is the only one that acts on it.
 
+import { agentSessionLeaseIsReleased } from '../../../shared/agent-session-lease-adjudication'
 import type { AgentSessionRecord } from '../../../shared/agent-session-record'
 import { randomUUID } from 'node:crypto'
 import type { AgentSessionAttachParams } from './structured-agent-session-attach'
-import { attachParamsForRecord } from './structured-agent-session-read-restore'
+import { attachParamsForRecord } from './structured-agent-session-conversation-open'
 
 export function isResumableStructuredAgentSessionRecord(record: AgentSessionRecord): boolean {
-  return (
-    !record.lease.unreconciled &&
-    record.lease.claimStatus === 'released' &&
-    record.lease.handoffStage === null
-  )
+  return agentSessionLeaseIsReleased(record.lease)
 }
 
 /** Attach params for a resume, or null when this record's lease is somebody else's problem. */
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-reveal.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-reveal.test.ts
index 291a6e0c53eb..49a116ec7f7a 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-reveal.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-reveal.test.ts
@@ -3,8 +3,8 @@
  *
  * The reveal path is the only way an Agent Session History row reaches a chat whose tab this
  * process never published — a chat closed cleanly, or one this process has not opened since
- * launch. It is exercised here through the readable restorer rather than the whole host, because
- * what it must get right is which records it accepts and what it does when the journal is gone.
+ * launch. It opens the conversation through the host's accessor and starts no agent; what it must
+ * get right is which records it accepts and what it answers when the journal cannot be opened.
  */
 
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
@@ -13,8 +13,6 @@ import {
   agentSessionLeaseFixture,
   agentSessionRecordFixture
 } from '../../../shared/agent-session-record.test-fixture'
-import { StructuredAgentSessionReadableRestorer } from './structured-agent-session-readable-restorer'
-import * as readRestore from './structured-agent-session-read-restore'
 import * as providerSupport from './structured-agent-session-provider-support'
 import { revealStructuredAgentSession } from './structured-agent-session-reveal'
 
@@ -35,114 +33,10 @@ function recordFor(provider: 'claude' | 'codex', sessionId: string): AgentSessio
   }
 }
 
-function harness(
-  records: AgentSessionRecord[],
-  options: { supports?: (record: AgentSessionRecord) => boolean } = {}
-) {
-  const live = new Map<string, unknown>()
-  const serializedIds: string[] = []
-  const serialize = <T>(sessionId: string, task: () => Promise<T>): Promise<T> => {
-    serializedIds.push(sessionId)
-    return task()
-  }
-  const restorer = new StructuredAgentSessionReadableRestorer({
-    store: {
-      getRecord: (sessionId: string) => records.find((r) => r.sessionId === sessionId) ?? null,
-      listRecords: () => records
-    } as never,
-    journalRoot: '/journals',
-    supportsRecord: options.supports ?? (() => true),
-    reconcile: async () => null,
-    resolveRecovery: async () => undefined,
-    serialize,
-    hasSession: (sessionId) => live.has(sessionId),
-    onReadable: (sessionId, restored) => live.set(sessionId, restored),
-    retrySettlement: async () => true
-  })
-  return { restorer, live, serializedIds }
-}
-
-const readable = { journal: {}, params: {}, fence: 1 } as never
-
 afterEach(() => {
   vi.restoreAllMocks()
 })
 
-describe('revealing one structured session on demand', () => {
-  beforeEach(() => {
-    vi.spyOn(readRestore, 'restoreStructuredAgentSessionRead').mockResolvedValue(readable)
-  })
-
-  it.each(['claude', 'codex'] as const)('restores a persisted %s chat', async (provider) => {
-    const sessionId = `session-${provider}`
-    const { restorer, live } = harness([recordFor(provider, sessionId)])
-
-    await expect(restorer.restoreOne(sessionId)).resolves.toBe(true)
-    expect(live.has(sessionId)).toBe(true)
-  })
-
-  it('does not need the startup sweep to have run, or run it', async () => {
-    // The whole point: `restore()` is latched to once per process, and a surface asking later must
-    // not be answered from that latch — nor trip it, which would skip every other record.
-    const records = [recordFor('codex', 'session-asked'), recordFor('claude', 'session-untouched')]
-    const { restorer, live } = harness(records)
-
-    await restorer.restoreOne('session-asked')
-
-    expect(live.has('session-asked')).toBe(true)
-    expect(live.has('session-untouched')).toBe(false)
-  })
-
-  it('serializes against the session it restores', async () => {
-    const { restorer, serializedIds } = harness([recordFor('claude', 'session-serialized')])
-
-    await restorer.restoreOne('session-serialized')
-
-    // Ordering against close/eviction is the task queue's job, so the restore must be inside it.
-    expect(serializedIds).toEqual(['session-serialized'])
-  })
-
-  it('returns the live session instead of restoring over it', async () => {
-    const { restorer, live } = harness([recordFor('codex', 'session-live')])
-    live.set('session-live', readable)
-
-    await expect(restorer.restoreOne('session-live')).resolves.toBe(true)
-    expect(readRestore.restoreStructuredAgentSessionRead).not.toHaveBeenCalled()
-  })
-
-  it('refuses a record no adapter supports', async () => {
-    const { restorer } = harness([recordFor('codex', 'session-unsupported')], {
-      supports: () => false
-    })
-
-    await expect(restorer.restoreOne('session-unsupported')).resolves.toBe(false)
-    expect(readRestore.restoreStructuredAgentSessionRead).not.toHaveBeenCalled()
-  })
-
-  it('refuses a session this host holds no record for', async () => {
-    const { restorer } = harness([])
-
-    await expect(restorer.restoreOne('session-absent')).resolves.toBe(false)
-  })
-})
-
-describe('a record whose journal cannot be read', () => {
-  it('reports not-readable without throwing, for either provider', async () => {
-    // A chat whose journal predates the SQLite store restores to nothing here. That is not a
-    // refusal: attach still recovers it, so the caller publishes the tab and lets the pane's hold
-    // finish the job. Throwing, or reporting success, would both be wrong.
-    vi.spyOn(readRestore, 'restoreStructuredAgentSessionRead').mockResolvedValue(null)
-    const { restorer, live } = harness([
-      recordFor('claude', 'session-no-journal-claude'),
-      recordFor('codex', 'session-no-journal-codex')
-    ])
-
-    await expect(restorer.restoreOne('session-no-journal-claude')).resolves.toBe(false)
-    await expect(restorer.restoreOne('session-no-journal-codex')).resolves.toBe(false)
-    expect(live.size).toBe(0)
-  })
-})
-
 describe('the host answer a client acts on', () => {
   beforeEach(() => {
     // Eligibility is the router's call; these cases are about what the answer carries.
@@ -154,39 +48,45 @@ describe('the host answer a client acts on', () => {
     return { ...base, location: { ...base.location, workspaceId } }
   }
 
-  it("answers with the record's own workspace and provider, never a caller's", async () => {
-    // The security property: a client sends only a session id, so the tab cannot be aimed at
-    // another workspace by asking for one.
-    const stored = record('claude', 'workspace-from-record')
-
-    await expect(
-      revealStructuredAgentSession(
-        { store: { getRecord: () => stored } as never, adapter: {} as never },
-        'session-answered',
-        () => true,
-        async () => true
-      )
-    ).resolves.toEqual({
-      sessionId: 'session-answered',
-      workspaceId: 'workspace-from-record',
-      agent: 'claude',
-      readable: true
-    })
-  })
-
-  it('refuses a session this host holds no record for', async () => {
+  it.each(['claude', 'codex'] as const)(
+    "answers a %s chat with the record's own workspace and provider, never a caller's",
+    async (provider) => {
+      // The security property: a client sends only a session id, so the tab cannot be aimed at
+      // another workspace by asking for one.
+      const stored = record(provider, 'workspace-from-record')
+      const open = vi.fn(async () => undefined)
+
+      await expect(
+        revealStructuredAgentSession(
+          { store: { getRecord: () => stored } as never, adapter: {} as never },
+          'session-answered',
+          open
+        )
+      ).resolves.toEqual({
+        sessionId: 'session-answered',
+        workspaceId: 'workspace-from-record',
+        agent: provider,
+        readable: true
+      })
+      expect(open).toHaveBeenCalledExactlyOnceWith('session-answered')
+    }
+  )
+
+  it('refuses a session this host holds no record for, opening nothing', async () => {
+    const open = vi.fn(async () => undefined)
     await expect(
       revealStructuredAgentSession(
         { store: { getRecord: () => null } as never, adapter: {} as never },
         'session-absent',
-        () => false,
-        async () => false
+        open
       )
     ).rejects.toThrow('agent_session_identity_required')
+    expect(open).not.toHaveBeenCalled()
   })
 
   it('refuses a record no adapter of this host supports', async () => {
     vi.mocked(providerSupport.adapterSupportsRecord).mockReturnValue(false)
+    const open = vi.fn(async () => undefined)
 
     await expect(
       revealStructuredAgentSession(
@@ -195,14 +95,14 @@ describe('the host answer a client acts on', () => {
           adapter: {} as never
         },
         'session-answered',
-        () => false,
-        async () => false
+        open
       )
     ).rejects.toThrow('structured_agent_session_unsupported')
+    expect(open).not.toHaveBeenCalled()
   })
 
-  it('answers not-readable without refusing when the journal could not be restored', async () => {
-    // The tab is still worth publishing: attach recovers what read restore cannot.
+  it('answers not-readable without refusing when the journal could not be opened', async () => {
+    // The tab is still worth publishing: the chat shows the failure and keeps retrying the read.
     await expect(
       revealStructuredAgentSession(
         {
@@ -210,26 +110,10 @@ describe('the host answer a client acts on', () => {
           adapter: {} as never
         },
         'session-answered',
-        () => false,
-        async () => false
+        async () => {
+          throw new Error('journal unreadable')
+        }
       )
     ).resolves.toMatchObject({ readable: false, agent: 'codex' })
   })
-
-  it('does not restore over a session that is already live', async () => {
-    const restoreReadable = vi.fn(async () => true)
-
-    await expect(
-      revealStructuredAgentSession(
-        {
-          store: { getRecord: () => record('codex', 'workspace-1') } as never,
-          adapter: {} as never
-        },
-        'session-answered',
-        () => true,
-        restoreReadable
-      )
-    ).resolves.toMatchObject({ readable: true })
-    expect(restoreReadable).not.toHaveBeenCalled()
-  })
 })
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-reveal.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-reveal.ts
index bc36df76df8a..2a1899ab1ccd 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-reveal.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-reveal.ts
@@ -6,39 +6,41 @@
 // launch — is reachable in Agent Session History by id and by nothing else. This is the lookup that
 // turns that id back into something a client can publish.
 //
-// It is deliberately the whole of what reveal does on the host. It takes no hold: a provider child
-// exists because a surface asked for one, and the chat pane asks when it binds. And a journal it
-// cannot read is not a refusal — a chat whose journal predates the SQLite store restores to nothing
-// here, yet attach still recovers it, so the tab is worth publishing either way.
+// It is deliberately the whole of what reveal does on the host. It starts no provider child: only
+// a send does. And a journal it cannot open is not a refusal — the chat shows that failure with a
+// Retry, so the tab is worth publishing either way.
 
+import { agentSessionRefusalError } from '../../../shared/agent-session-wire-refusals'
 import { adapterSupportsRecord } from './structured-agent-session-provider-support'
 import { StructuredAgentSessionReadableRestorer } from './structured-agent-session-readable-restorer'
 import { StructuredAgentSessionRestartRestoreGate } from './structured-agent-session-restart-restore-gate'
 import type {
   StructuredAgentSessionHostDeps,
-  StructuredAgentSessionHostSession,
   StructuredAgentSessionReveal
 } from './structured-agent-session-host-types'
-import { retryPendingStructuredAgentSessionSettlement } from './structured-agent-session-settlement-retry'
 
-/** Throws its refusal as the code itself, matching `resumeHeldStructuredAgentSession`. */
+/** Throws its refusal as the code itself. */
 export async function revealStructuredAgentSession(
   deps: Pick<StructuredAgentSessionHostDeps, 'store' | 'adapter'>,
   sessionId: string,
-  hasSession: (sessionId: string) => boolean,
-  restoreReadable: (sessionId: string) => Promise<boolean>
+  openConversation: (sessionId: string) => Promise<unknown>
 ): Promise<StructuredAgentSessionReveal> {
   const record = deps.store.getRecord(sessionId)
   if (!record) {
-    throw new Error('agent_session_identity_required')
+    throw agentSessionRefusalError('agent_session_identity_required', { reason: 'recordMissing' })
   }
   if (!adapterSupportsRecord(deps.adapter, record)) {
-    throw new Error('structured_agent_session_unsupported')
+    throw agentSessionRefusalError('structured_agent_session_unsupported', {
+      reason: 'hostUnsupported'
+    })
   }
   // Lease state is not consulted on purpose: this neither claims the lease nor spawns a child, so a
-  // contested or reconciling chat still reveals and the hold that follows adjudicates it. Refusing
+  // contested or reconciling chat still reveals and the send that follows adjudicates it. Refusing
   // here would hide the one view of a session a user needs when its ownership is in doubt.
-  const readable = hasSession(sessionId) || (await restoreReadable(sessionId))
+  const readable = await openConversation(sessionId).then(
+    () => true,
+    () => false
+  )
   return {
     sessionId,
     // From the record, never from a caller: a client that knows only a session id must not be able
@@ -49,41 +51,23 @@ export async function revealStructuredAgentSession(
   }
 }
 
-/**
- * The host's whole readable-restore surface: the startup sweep and the on-demand reveal.
- *
- * Bundled the way the lifetime collaborators are, because the two share the restorer
- * and differ only in who is asking — startup, once, for everything; a surface, later, for one.
- */
+/** The host's startup readable-restore sweep: reconcile, resolve, then open each chat's journal. */
 export function createStructuredAgentSessionHostRestore(
   deps: StructuredAgentSessionHostDeps,
-  sessions: Map<string, StructuredAgentSessionHostSession>,
-  now: () => number,
   wiring: Omit<
     ConstructorParameters<typeof StructuredAgentSessionReadableRestorer>[0],
-    'store' | 'journalRoot' | 'supportsRecord' | 'retrySettlement'
+    'openDeps' | 'supportsRecord'
   >
 ): {
   restoreReadableSessions: (sessionIds?: readonly string[]) => Promise<void>
-  revealSession: (sessionId: string) => Promise<StructuredAgentSessionReveal>
-  /** One session, for a caller already inside its serialize. */
-  restoreReadableUnderSerialize: (sessionId: string) => Promise<boolean>
 } {
   const restorer = new StructuredAgentSessionReadableRestorer({
-    store: deps.store,
-    journalRoot: deps.journalRoot,
+    openDeps: deps,
     supportsRecord: (record) => adapterSupportsRecord(deps.adapter, record),
-    retrySettlement: (sessionId, params) =>
-      retryPendingStructuredAgentSessionSettlement({ deps, sessions, sessionId, params, now }),
     ...wiring
   })
   const gate = new StructuredAgentSessionRestartRestoreGate()
   return {
-    restoreReadableSessions: (sessionIds) => gate.run(() => restorer.restore(sessionIds)),
-    revealSession: (sessionId) =>
-      revealStructuredAgentSession(deps, sessionId, wiring.hasSession, (id) =>
-        restorer.restoreOne(id)
-      ),
-    restoreReadableUnderSerialize: (sessionId) => restorer.restoreOneUnderSerialize(sessionId)
+    restoreReadableSessions: (sessionIds) => gate.run(() => restorer.restore(sessionIds))
   }
 }
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-rewind-at-rest.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-rewind-at-rest.test.ts
new file mode 100644
index 000000000000..a596cc5c9edb
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-rewind-at-rest.test.ts
@@ -0,0 +1,225 @@
+// A Codex rewind whose outcome only the provider can prove, found on a chat at rest: nothing on
+// screen will start the agent that settles it, so the next send does, and its message is kept.
+
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { agentJournalItemKey } from '../../../shared/agent-session-journal-item-key'
+import { computeAgentSessionPayloadFingerprint } from '../../../shared/agent-session-mutation-envelope'
+import { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
+import type {
+  AgentSessionDispatchOutcome,
+  StructuredAgentSessionAdapter
+} from './structured-agent-session-adapter'
+import { StructuredAgentSessionHost } from './structured-agent-session-host'
+import type { StructuredAgentSessionEventSink } from './structured-agent-session-event-sink'
+import {
+  HOST_TEST_NOW,
+  HOST_TEST_SESSION as SESSION,
+  HOST_TEST_THREAD as THREAD,
+  hostTestAttachParams,
+  hostTestMessage,
+  hostTestOperationId,
+  resetHostTestOperationIds
+} from './structured-agent-session-host-test-data'
+
+const caller = { callerKey: 'desktop' }
+const KEPT = { provider: 'codex' as const, threadId: THREAD, turnId: 'kept', ordinal: 0 }
+
+let directory: string
+let store: AgentSessionRecordStore
+let host: StructuredAgentSessionHost
+let sink: StructuredAgentSessionEventSink
+let acquires = 0
+const rewind = vi.fn<NonNullable<StructuredAgentSessionAdapter['rewind']>>()
+const recoverRewind = vi.fn<NonNullable<StructuredAgentSessionAdapter['recoverRewind']>>()
+const rewindSupport = vi.fn<NonNullable<StructuredAgentSessionAdapter['rewindSupport']>>()
+const dispatch = vi.fn<StructuredAgentSessionAdapter['dispatch']>()
+
+function adapter(): StructuredAgentSessionAdapter {
+  return {
+    supportsCreate: (_location, agent) => agent === 'codex',
+    supportsLocation: () => true,
+    acquire: async (input) => {
+      acquires += 1
+      sink = input.events!
+      return {
+        process: {
+          hostId: 'local',
+          pid: 4000 + acquires,
+          processStartTimeMs: HOST_TEST_NOW,
+          spawnToken: input.spawnToken
+        },
+        acquisitionGeneration: `generation-${acquires}`,
+        link: {
+          linkId: `link-${acquires}`,
+          mintedAtFence: input.fence,
+          observedAt: HOST_TEST_NOW,
+          origin: acquires === 1 ? 'created' : 'resumed',
+          handle: { provider: 'codex', threadId: THREAD }
+        }
+      }
+    },
+    dispatch,
+    cancelTurn: async () => ({ cancelled: false }),
+    answerPrompt: async () => {},
+    setOption: async () => {},
+    rewindSupport,
+    rewind,
+    recoverRewind,
+    releaseAcquisition: async () => true,
+    closeSession: async () => true
+  }
+}
+
+function openHost(): StructuredAgentSessionHost {
+  return new StructuredAgentSessionHost({
+    store,
+    adapter: adapter(),
+    journalRoot: directory,
+    claimKeyId: 'key',
+    now: () => HOST_TEST_NOW,
+    probeOwner: async () => ({ outcome: 'exit-observed' }),
+    idleSweep: { intervalMs: 3_600_000 }
+  })
+}
+
+beforeEach(async () => {
+  resetHostTestOperationIds()
+  acquires = 0
+  rewind.mockReset()
+  recoverRewind.mockReset().mockResolvedValue({
+    ok: true,
+    items: [{ identity: KEPT, body: hostTestMessage('verified history') }]
+  })
+  rewindSupport.mockReset().mockReturnValue({ supported: true })
+  dispatch.mockReset().mockImplementation(async (input): Promise<AgentSessionDispatchOutcome> => ({
+    state: 'accepted',
+    providerIdentity: {
+      provider: 'codex',
+      threadId: THREAD,
+      turnId: input.clientMessageId,
+      ordinal: 1
+    }
+  }))
+  directory = await mkdtemp(join(tmpdir(), 'orca-rewind-rest-'))
+  store = await AgentSessionRecordStore.open({
+    directory: join(directory, 'store'),
+    hostId: 'local'
+  })
+  host = openHost()
+})
+
+afterEach(async () => {
+  await host.flushAllStreamedEvents()
+  await rm(directory, { recursive: true, force: true })
+})
+
+function fence(): number {
+  return store.getRecord(SESSION)!.lease.runtimeFence
+}
+
+function rewindParams(itemId: string, expectedEpoch: string) {
+  return {
+    itemId,
+    expectedEpoch,
+    envelope: {
+      sessionId: SESSION,
+      clientOperationId: hostTestOperationId(),
+      expectedRuntimeFence: fence(),
+      payloadFingerprint: computeAgentSessionPayloadFingerprint({
+        method: 'agentSession.rewind',
+        sessionId: SESSION,
+        fields: { itemId, expectedEpoch }
+      })
+    }
+  }
+}
+
+function sendParams(text: string) {
+  const body = hostTestMessage(text)
+  return {
+    body,
+    envelope: {
+      sessionId: SESSION,
+      clientOperationId: hostTestOperationId(),
+      expectedRuntimeFence: fence(),
+      payloadFingerprint: computeAgentSessionPayloadFingerprint({
+        method: 'agentSession.send',
+        sessionId: SESSION,
+        fields: { body }
+      })
+    }
+  }
+}
+
+/** A chat whose rewind the provider applied, whose Orca side never finished, reopened at rest. */
+async function interruptedRewindAtRest(): Promise<void> {
+  expect(await host.attach(caller, hostTestAttachParams(null))).toMatchObject({ ok: true })
+  const drop = { ...KEPT, turnId: 'drop' }
+  sink.appendItem(KEPT, hostTestMessage('verified history'))
+  sink.appendItem(drop, hostTestMessage('to be rewound'))
+  await host.flushStreamedEvents(SESSION)
+  rewind.mockImplementation(async (input) => {
+    await input.onReverted?.()
+    throw new Error('history unavailable')
+  })
+  const epoch = (await host.journalSnapshot(SESSION)).cursor.epoch
+  await expect(host.rewind(caller, rewindParams(agentJournalItemKey(drop), epoch))).rejects.toThrow(
+    'history unavailable'
+  )
+  expect(store.getRecord(SESSION)?.rewind).toMatchObject({ phase: 'prepared' })
+  await host.flushAllStreamedEvents()
+  store = await AgentSessionRecordStore.open({
+    directory: join(directory, 'store'),
+    hostId: 'local'
+  })
+  host = openHost()
+}
+
+describe('an interrupted Codex rewind on a chat at rest (R16)', () => {
+  it('is settled by the start a send makes, and the message is delivered after it', async () => {
+    await interruptedRewindAtRest()
+    expect(host.hasSession(SESSION)).toBe(false)
+    const before = acquires
+
+    const sent = await host.send(caller, sendParams('after the rewind'))
+    expect(sent).toMatchObject({ ok: true })
+    expect(acquires - before).toBe(1)
+    expect(recoverRewind).toHaveBeenCalledOnce()
+    expect(store.getRecord(SESSION)?.rewind?.phase).toBe('completed')
+    await vi.waitFor(() => expect(dispatch).toHaveBeenCalledOnce())
+    const snapshot = await host.journalSnapshot(SESSION)
+    const texts = snapshot.items.flatMap((item) =>
+      item.body.kind === 'message'
+        ? item.body.blocks.flatMap((block) => (block.type === 'text' ? [block.text] : []))
+        : []
+    )
+    // The recovered history, then the new message — nothing the rewind dropped, nothing lost.
+    expect(texts).toEqual(['verified history', 'after the rewind'])
+    expect(snapshot.submissions.at(-1)?.dispatchState).toBe('accepted')
+  })
+})
+
+describe('a rewind asked of a chat at rest (P2-23)', () => {
+  it('starts the agent first and answers with what the provider says', async () => {
+    expect(await host.attach(caller, hostTestAttachParams(null))).toMatchObject({ ok: true })
+    sink.appendItem(KEPT, hostTestMessage('kept'))
+    await host.flushStreamedEvents(SESSION)
+    const epoch = (await host.journalSnapshot(SESSION)).cursor.epoch
+    await host.flushAllStreamedEvents()
+    store = await AgentSessionRecordStore.open({
+      directory: join(directory, 'store'),
+      hostId: 'local'
+    })
+    host = openHost()
+    const before = acquires
+    rewindSupport.mockReturnValue({ supported: false, reason: 'history-not-paginated' })
+
+    const result = await host.rewind(caller, rewindParams(agentJournalItemKey(KEPT), epoch))
+    expect(acquires - before).toBe(1)
+    expect(result).toMatchObject({ ok: false, refusal: { rewindReason: 'history-not-paginated' } })
+    expect(rewind).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-rewind.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-rewind.test.ts
index 19ae18dd5f44..a8ded60e6ffb 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-rewind.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-rewind.test.ts
@@ -139,6 +139,14 @@ async function seed(acceptedSubmissions = false) {
           }
         })
       ).toMatchObject({ ok: true })
+      // Accepted into the conversation first; the delivery loop hands it over after.
+      await vi.waitFor(async () =>
+        expect(
+          (await host.journalSnapshot(HOST_TEST_SESSION)).submissions.find(
+            (entry) => entry.clientMessageId === clientOperationId
+          )?.dispatchState
+        ).toBe('accepted')
+      )
       if (i === 1) {
         selectedItemId = agentJournalSubmissionKey(clientOperationId)
       }
@@ -149,10 +157,8 @@ async function seed(acceptedSubmissions = false) {
   await host.flushStreamedEvents(HOST_TEST_SESSION)
   return selectedItemId
 }
-function params(
-  itemId: string,
-  expectedEpoch = host.journalSnapshot(HOST_TEST_SESSION).cursor.epoch
-) {
+async function params(itemId: string, epoch?: string) {
+  const expectedEpoch = epoch ?? (await host.journalSnapshot(HOST_TEST_SESSION)).cursor.epoch
   return {
     itemId,
     expectedEpoch,
@@ -173,14 +179,14 @@ describe('host rewind', () => {
   it('resolves accepted codex user submissions to provider targets', async () => {
     const target = await seed(true)
     expect(target.startsWith('orca:')).toBe(true)
-    expect(await host.rewind(caller, params(target))).toMatchObject({ ok: true })
-    expect(host.journalSnapshot(HOST_TEST_SESSION).items).toHaveLength(1)
+    expect(await host.rewind(caller, await params(target))).toMatchObject({ ok: true })
+    expect((await host.journalSnapshot(HOST_TEST_SESSION)).items).toHaveLength(1)
     expect(rewind).toHaveBeenCalledWith(expect.objectContaining({ beforeTurnId: 'drop' }))
   })
 
   it('finishes a durable provider success on reattach without repeating the provider mutation', async () => {
     const target = await seed()
-    const request = params(target)
+    const request = await params(target)
     const replace = vi
       .spyOn(AgentSessionJournal.prototype, 'replaceEpochItems')
       .mockRejectedValueOnce(new Error('disk failed'))
@@ -189,7 +195,7 @@ describe('host rewind', () => {
     replace.mockRestore()
     const fence = store.getRecord(HOST_TEST_SESSION)!.lease.runtimeFence
     expect(await host.attach(caller, hostTestAttachParams(fence))).toMatchObject({ ok: true })
-    expect(host.journalSnapshot(HOST_TEST_SESSION).items).toHaveLength(1)
+    expect((await host.journalSnapshot(HOST_TEST_SESSION)).items).toHaveLength(1)
     expect(store.getRecord(HOST_TEST_SESSION)?.rewind?.phase).toBe('completed')
     expect(await host.rewind(caller, request)).toMatchObject({ ok: true, replayed: true })
     expect(rewind).toHaveBeenCalledTimes(1)
@@ -197,13 +203,13 @@ describe('host rewind', () => {
 
   it('retries complete hydration after native acknowledgement without committing partial history', async () => {
     const target = await seed()
-    const before = host.journalSnapshot(HOST_TEST_SESSION)
+    const before = await host.journalSnapshot(HOST_TEST_SESSION)
     rewind.mockImplementation(async (input) => {
       await input.onReverted?.()
       throw new Error('history unavailable')
     })
-    await expect(host.rewind(caller, params(target))).rejects.toThrow('history unavailable')
-    expect(host.journalSnapshot(HOST_TEST_SESSION)).toEqual(before)
+    await expect(host.rewind(caller, await params(target))).rejects.toThrow('history unavailable')
+    expect(await host.journalSnapshot(HOST_TEST_SESSION)).toEqual(before)
     expect(store.getRecord(HOST_TEST_SESSION)?.rewind).toMatchObject({
       phase: 'prepared',
       providerApplied: true
@@ -222,21 +228,15 @@ describe('host rewind', () => {
         hostTestAttachParams(store.getRecord(HOST_TEST_SESSION)!.lease.runtimeFence)
       )
     ).toMatchObject({ ok: true })
-    expect(host.journalSnapshot(HOST_TEST_SESSION).items).toHaveLength(1)
-    expect(host.journalSnapshot(HOST_TEST_SESSION).items[0]?.body).toEqual(
+    expect((await host.journalSnapshot(HOST_TEST_SESSION)).items).toHaveLength(1)
+    expect((await host.journalSnapshot(HOST_TEST_SESSION)).items[0]?.body).toEqual(
       hostTestMessage('verified history')
     )
     expect(recoverRewind).toHaveBeenCalledTimes(2)
     expect(rewind).toHaveBeenCalledTimes(1)
   })
-  it('fences stale owners and the second of two concurrent rewinds', async () => {
+  it('refuses the second of two concurrent rewinds by the epoch it targets', async () => {
     const target = await seed()
-    const stale = params(target)
-    stale.envelope.expectedRuntimeFence++
-    expect(await host.rewind(caller, stale)).toMatchObject({
-      ok: false,
-      refusal: { code: 'agent_session_checkpoint_stale' }
-    })
     let finish!: () => void
     rewind.mockImplementation(
       () =>
@@ -244,9 +244,9 @@ describe('host rewind', () => {
           finish = () => resolve({ ok: true })
         })
     )
-    const first = host.rewind(caller, params(target))
-    const second = host.rewind(caller, params(target))
-    await vi.waitFor(() => expect(finish).toBeTypeOf('function'))
+    const first = host.rewind(caller, await params(target))
+    const second = host.rewind(caller, await params(target))
+    await vi.waitFor(async () => expect(finish).toBeTypeOf('function'))
     finish()
     expect(await first).toMatchObject({ ok: true })
     expect(await second).toMatchObject({ ok: false, refusal: { rewindReason: 'stale-epoch' } })
@@ -254,11 +254,13 @@ describe('host rewind', () => {
   })
   it('replaces the epoch with the retained prefix and replays without another provider call', async () => {
     const target = await seed()
-    const request = params(target)
+    const request = await params(target)
     const result = await host.rewind(caller, request)
     expect(result).toMatchObject({ ok: true })
-    expect(host.journalSnapshot(HOST_TEST_SESSION).items).toHaveLength(1)
-    expect(host.journalSnapshot(HOST_TEST_SESSION).cursor.epoch).not.toBe(request.expectedEpoch)
+    expect((await host.journalSnapshot(HOST_TEST_SESSION)).items).toHaveLength(1)
+    expect((await host.journalSnapshot(HOST_TEST_SESSION)).cursor.epoch).not.toBe(
+      request.expectedEpoch
+    )
     expect(await host.rewind(caller, request)).toMatchObject({ ok: true, replayed: true })
     expect(rewind).toHaveBeenCalledTimes(1)
   })
@@ -268,7 +270,7 @@ describe('host rewind', () => {
       { provider: 'orca', clientMessageId: 'active' },
       { kind: 'status', text: 'working', turnLifecycle: { turnId: 'active', state: 'running' } }
     )
-    expect(await host.rewind(caller, params(target))).toMatchObject({
+    expect(await host.rewind(caller, await params(target))).toMatchObject({
       ok: false,
       refusal: { rewindReason: 'busy' }
     })
@@ -276,11 +278,11 @@ describe('host rewind', () => {
   })
   it('refuses stale epochs and targets from another provider', async () => {
     const target = await seed()
-    expect(await host.rewind(caller, params(target, 'old-epoch'))).toMatchObject({
+    expect(await host.rewind(caller, await params(target, 'old-epoch'))).toMatchObject({
       ok: false,
       refusal: { rewindReason: 'stale-epoch' }
     })
-    expect(await host.rewind(caller, params('claude:foreign'))).toMatchObject({
+    expect(await host.rewind(caller, await params('claude:foreign'))).toMatchObject({
       ok: false,
       refusal: { rewindReason: 'invalid-target' }
     })
@@ -288,18 +290,18 @@ describe('host rewind', () => {
   })
   it('keeps a failed hydration epoch intact and blocks sends and duplicate rewind', async () => {
     const target = await seed()
-    const request = params(target)
-    const before = host.journalSnapshot(HOST_TEST_SESSION)
+    const request = await params(target)
+    const before = await host.journalSnapshot(HOST_TEST_SESSION)
     rewind.mockRejectedValue(new Error('hydration failed'))
     await expect(host.rewind(caller, request)).rejects.toThrow('hydration failed')
-    expect(host.journalSnapshot(HOST_TEST_SESSION)).toEqual(before)
+    expect(await host.journalSnapshot(HOST_TEST_SESSION)).toEqual(before)
     expect(await host.rewind(caller, request)).toMatchObject({
       ok: false,
       refusal: { code: 'agent_session_operation_unknown' }
     })
     const body = hostTestMessage('new prompt')
     const envelope = {
-      ...params(target).envelope,
+      ...(await params(target)).envelope,
       payloadFingerprint: computeAgentSessionPayloadFingerprint({
         method: 'agentSession.send',
         sessionId: HOST_TEST_SESSION,
@@ -324,9 +326,9 @@ describe('host rewind', () => {
 
   it('clears an unapplied prepared rewind after observing the target still present', async () => {
     const target = await seed()
-    const before = host.journalSnapshot(HOST_TEST_SESSION)
+    const before = await host.journalSnapshot(HOST_TEST_SESSION)
     rewind.mockRejectedValueOnce(new Error('read failed before revert'))
-    await expect(host.rewind(caller, params(target))).rejects.toThrow('read failed')
+    await expect(host.rewind(caller, await params(target))).rejects.toThrow('read failed')
     recoverRewind.mockResolvedValueOnce({ ok: false, reason: 'provider-refused' })
     expect(
       await host.attach(
@@ -334,9 +336,9 @@ describe('host rewind', () => {
         hostTestAttachParams(store.getRecord(HOST_TEST_SESSION)!.lease.runtimeFence)
       )
     ).toMatchObject({ ok: true })
-    expect(host.journalSnapshot(HOST_TEST_SESSION)).toEqual(before)
+    expect(await host.journalSnapshot(HOST_TEST_SESSION)).toEqual(before)
     expect(store.getRecord(HOST_TEST_SESSION)?.rewind?.phase).toBe('refused')
-    expect(await host.rewind(caller, params(target))).toMatchObject({ ok: true })
+    expect(await host.rewind(caller, await params(target))).toMatchObject({ ok: true })
   })
 
   it('keeps host-stamped turn and goal rows through a Codex provider hydration', async () => {
@@ -390,12 +392,17 @@ describe('host rewind', () => {
       return { ok: true, items }
     })
 
-    expect(await host.rewind(caller, params(agentJournalItemKey(message('drop'))))).toMatchObject({
+    expect(
+      await host.rewind(caller, await params(agentJournalItemKey(message('drop'))))
+    ).toMatchObject({
       ok: true
     })
 
     expect(
-      host.journalSnapshot(HOST_TEST_SESSION).items.map(({ itemId, body }) => ({ itemId, body }))
+      (await host.journalSnapshot(HOST_TEST_SESSION)).items.map(({ itemId, body }) => ({
+        itemId,
+        body
+      }))
     ).toEqual([
       { itemId: agentJournalItemKey(message('kept')), body: hostTestMessage('kept from provider') },
       { itemId: agentJournalItemKey(goalRow), body: goalBody },
@@ -435,9 +442,9 @@ describe('host rewind', () => {
       throw new Error('lost after provider revert')
     })
 
-    await expect(host.rewind(caller, params(agentJournalItemKey(message('drop'))))).rejects.toThrow(
-      'lost after provider revert'
-    )
+    await expect(
+      host.rewind(caller, await params(agentJournalItemKey(message('drop'))))
+    ).rejects.toThrow('lost after provider revert')
     recoverRewind.mockResolvedValueOnce({
       ok: true,
       items: [{ identity: message('kept'), body: hostTestMessage('kept from recovery') }]
@@ -450,7 +457,10 @@ describe('host rewind', () => {
     ).toMatchObject({ ok: true })
 
     expect(
-      host.journalSnapshot(HOST_TEST_SESSION).items.map(({ itemId, body }) => ({ itemId, body }))
+      (await host.journalSnapshot(HOST_TEST_SESSION)).items.map(({ itemId, body }) => ({
+        itemId,
+        body
+      }))
     ).toEqual([
       { itemId: agentJournalItemKey(message('kept')), body: hostTestMessage('kept from recovery') },
       { itemId: agentJournalItemKey(goalRow), body: goalBody }
@@ -469,7 +479,7 @@ describe('host rewind', () => {
       await input.onReverted?.()
       throw new Error('lost after revert')
     })
-    await expect(host.rewind(caller, params(target))).rejects.toThrow('lost after revert')
+    await expect(host.rewind(caller, await params(target))).rejects.toThrow('lost after revert')
     recoverRewind.mockResolvedValueOnce({ ok: true, items })
     expect(
       await host.attach(
@@ -477,7 +487,7 @@ describe('host rewind', () => {
         hostTestAttachParams(store.getRecord(HOST_TEST_SESSION)!.lease.runtimeFence)
       )
     ).toMatchObject({ ok: true })
-    expect(host.journalSnapshot(HOST_TEST_SESSION).items).toHaveLength(2)
+    expect((await host.journalSnapshot(HOST_TEST_SESSION)).items).toHaveLength(2)
     expect(store.getRecord(HOST_TEST_SESSION)?.rewind?.phase).toBe('completed')
   })
 
@@ -485,7 +495,7 @@ describe('host rewind', () => {
     'never commits a recovered prefix that omits an expected retained %s',
     async (missing) => {
       const target = await seed()
-      const before = host.journalSnapshot(HOST_TEST_SESSION)
+      const before = await host.journalSnapshot(HOST_TEST_SESSION)
       const items = [0, 1].map((ordinal) => ({
         identity: {
           provider: 'codex' as const,
@@ -499,7 +509,7 @@ describe('host rewind', () => {
         await input.onPrepared?.(items)
         throw new Error('reply lost')
       })
-      await expect(host.rewind(caller, params(target))).rejects.toThrow('reply lost')
+      await expect(host.rewind(caller, await params(target))).rejects.toThrow('reply lost')
       recoverRewind.mockResolvedValueOnce({
         ok: true,
         items: missing === 'turn' ? [] : items.slice(0, 1)
@@ -520,7 +530,7 @@ describe('host rewind', () => {
 
   it('settles the existing epoch after a crash between journal commit and record completion', async () => {
     const target = await seed()
-    const request = params(target)
+    const request = await params(target)
     const transition = store.transitionHandoff.bind(store)
     const checkpoint = vi
       .spyOn(store, 'transitionHandoff')
@@ -534,7 +544,7 @@ describe('host rewind', () => {
         })
       )
     await expect(host.rewind(caller, request)).rejects.toThrow('completion write failed')
-    const committed = host.journalSnapshot(HOST_TEST_SESSION)
+    const committed = await host.journalSnapshot(HOST_TEST_SESSION)
     expect(committed.cursor.epoch).not.toBe(request.expectedEpoch)
     checkpoint.mockRestore()
     const replace = vi.spyOn(AgentSessionJournal.prototype, 'replaceEpochItems')
@@ -544,7 +554,7 @@ describe('host rewind', () => {
         hostTestAttachParams(store.getRecord(HOST_TEST_SESSION)!.lease.runtimeFence)
       )
     ).toMatchObject({ ok: true })
-    expect(host.journalSnapshot(HOST_TEST_SESSION)).toEqual(committed)
+    expect(await host.journalSnapshot(HOST_TEST_SESSION)).toEqual(committed)
     expect(replace).not.toHaveBeenCalled()
     replace.mockRestore()
     expect(await host.rewind(caller, request)).toMatchObject({ ok: true, replayed: true })
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-rewind.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-rewind.ts
index baedbe7c4d19..45dd7244896e 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-rewind.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-rewind.ts
@@ -13,6 +13,7 @@ import type {
 import type { AgentSessionMutationResult } from '../../../shared/agent-session-wire'
 import { AGENT_SESSION_HISTORY_MAX_PAGE_BYTES } from './agent-session-history-page-bounds'
 import type { StructuredAgentSessionMutationContext } from './structured-agent-session-host-mutations'
+import { openWithAgent } from './structured-agent-session-send-preparation'
 import type { StructuredAgentSessionAttachContext } from './structured-agent-session-attach-context'
 import type { StructuredAgentSessionCaller } from './structured-agent-session-host-types'
 import { admitAndRunAgentSessionMutation } from './structured-agent-session-mutation-admission'
@@ -35,6 +36,8 @@ export async function rewindStructuredAgentSession(
       adapter: context.deps.adapter,
       callerKey: caller.callerKey,
       envelope: params.envelope,
+      // Only the provider can do this, so an agent at rest is started first.
+      prepareSession: openWithAgent(context, params.envelope),
       journal: () => context.sessions.get(sessionId)?.journal,
       publish: (journal) => context.publish(sessionId, journal),
       flushStreamedEvents: context.flushStreamedEvents,
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-send-block.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-send-block.test.ts
new file mode 100644
index 000000000000..798820258897
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-send-block.test.ts
@@ -0,0 +1,120 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import type { AgentSessionConversationCommandRecord } from '../../../shared/agent-session-conversation-command'
+import { agentSessionRecordFixture } from '../../../shared/agent-session-record.test-fixture'
+import {
+  openConversationForWrite,
+  structuredAgentSessionSendBlock
+} from './structured-agent-session-send-preparation'
+
+function withCommand(command: AgentSessionConversationCommandRecord) {
+  return { ...agentSessionRecordFixture(), conversationCommand: command }
+}
+
+const COMMAND = { operationId: 'operation-1', callerKey: 'client-1', runtimeFence: 7 }
+
+describe('a send refused by the conversation command it follows', () => {
+  it('says a /clear that never committed did not finish, not that the chat was cleared', () => {
+    const blocked = structuredAgentSessionSendBlock(
+      withCommand({
+        ...COMMAND,
+        command: 'clear',
+        state: 'unknown',
+        phase: 'prepared',
+        replacementSessionId: 'clear-replacement-1'
+      })
+    )
+
+    expect(blocked?.refusal).toMatchObject({
+      code: 'agent_session_operation_invalid',
+      details: { reason: 'clearUnconfirmed' },
+      message: "The last /clear didn't finish. Start a new chat to continue."
+    })
+  })
+
+  it('says a committed /clear cleared the conversation', () => {
+    const blocked = structuredAgentSessionSendBlock(
+      withCommand({
+        ...COMMAND,
+        command: 'clear',
+        state: 'completed',
+        phase: 'committed',
+        replacementSessionId: 'clear-replacement-1'
+      })
+    )
+
+    expect(blocked?.refusal).toMatchObject({
+      code: 'agent_session_operation_invalid',
+      details: { reason: 'conversationCleared' }
+    })
+  })
+
+  it('keeps an unconfirmed /compact as an unconfirmed command', () => {
+    const blocked = structuredAgentSessionSendBlock(
+      withCommand({ ...COMMAND, command: 'compact', state: 'unknown', phase: 'prepared' })
+    )
+
+    expect(blocked?.refusal).toMatchObject({
+      details: { reason: 'conversationCommandUnconfirmed' }
+    })
+  })
+
+  it('lets a send follow a /clear whose new conversation failed to start', () => {
+    expect(
+      structuredAgentSessionSendBlock(
+        withCommand({ ...COMMAND, command: 'clear', state: 'completed', phase: 'committed' })
+      )
+    ).toBeNull()
+  })
+})
+
+describe('a write whose conversation the host could not open', () => {
+  afterEach(() => {
+    vi.restoreAllMocks()
+  })
+
+  const ENVELOPE = {
+    sessionId: 'session-1',
+    clientOperationId: 'operation-1',
+    expectedRuntimeFence: 1,
+    payloadFingerprint: ''
+  }
+
+  function refusedBy(error: unknown) {
+    vi.spyOn(console, 'warn').mockImplementation(() => {})
+    return openConversationForWrite(async () => {
+      throw error
+    }, ENVELOPE)
+  }
+
+  it('says a corrupt history is final, in words and not the error', async () => {
+    const corrupt = Object.assign(new Error('/Users/me/journal.db: file is not a database'), {
+      code: 'ERR_SQLITE_ERROR',
+      errcode: 26
+    })
+
+    expect(await refusedBy(corrupt)).toEqual({
+      ok: false,
+      refusal: {
+        code: 'agent_session_journal_unreadable',
+        details: { reason: 'journalCorrupt' },
+        message: 'Unable to load this chat.'
+      }
+    })
+  })
+
+  it('says any other failed open can clear', async () => {
+    const denied = Object.assign(new Error('EACCES: permission denied, open /Users/me'), {
+      code: 'EACCES',
+      errno: -13
+    })
+
+    expect(await refusedBy(denied)).toEqual({
+      ok: false,
+      refusal: {
+        code: 'agent_session_journal_unreadable',
+        details: { reason: 'journalUnavailable' },
+        message: "Orca couldn't open this chat's history right now. Try again."
+      }
+    })
+  })
+})
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-send-idempotency.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-send-idempotency.test.ts
index 0f75c9a33224..2494535e019b 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-send-idempotency.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-send-idempotency.test.ts
@@ -120,11 +120,16 @@ describe('structured send idempotency', () => {
     await performSend(context, input)
     const replay = await performSend(context, input)
 
+    // Acceptance records the one submission; the reused id answers with it and writes nothing.
+    // Handing it over is the delivery loop's, never a second accept's.
     expect(replay).toMatchObject({
       ok: true,
-      value: { clientMessageId: 'shared-send-id', submission: { dispatchState: 'accepted' } }
+      value: {
+        clientMessageId: 'shared-send-id',
+        submission: { dispatchState: 'pending', handoverRecorded: true }
+      }
     })
-    expect(dispatch).toHaveBeenCalledOnce()
+    expect(dispatch).not.toHaveBeenCalled()
     expect(journal.submissions()).toHaveLength(1)
   })
 })
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-send-open-stale-turn.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-send-open-stale-turn.test.ts
new file mode 100644
index 000000000000..a1f196d8b612
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-send-open-stale-turn.test.ts
@@ -0,0 +1,154 @@
+// A send can be what opens a conversation this process has not read yet: a chat nobody has on
+// screen after the app died, sent to from a phone or the CLI. Whatever that journal shows running
+// belongs to a generation that is gone, so it is settled when the journal opens, not only when a
+// new child starts: a start that then fails would leave the turn running for every reader.
+
+import { cp, rm } from 'node:fs/promises'
+import { join } from 'node:path'
+import { afterEach, expect, it, vi } from 'vitest'
+import type { AgentSessionOwnerProbe } from '../../../shared/agent-session-lease-adjudication'
+import { readAgentJournalTurn } from '../../../shared/agent-session-turn-record'
+import { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
+import { StructuredAgentSessionHost } from './structured-agent-session-host'
+import {
+  adapter,
+  attach,
+  CALLER,
+  envelope,
+  hostTestState,
+  replaceHostTestState
+} from './structured-agent-session-host-test-harness'
+import {
+  HOST_TEST_NOW as NOW,
+  HOST_TEST_SESSION as SESSION,
+  HOST_TEST_THREAD as THREAD,
+  hostTestMessage
+} from './structured-agent-session-host-test-data'
+
+/** Delivery runs on its own serialized steps; under a loaded runner they take more than a second. */
+function eventually(assertion: () => unknown): Promise<unknown> {
+  return vi.waitFor(assertion, { timeout: 10_000 })
+}
+
+const relaunchedRoots: string[] = []
+
+afterEach(async () => {
+  await Promise.all(
+    relaunchedRoots.splice(0).map((dir) => rm(dir, { recursive: true, force: true }))
+  )
+})
+
+/** A host that dies mid-turn, relaunched over a copy of its files taken at the crash. */
+async function relaunchAfterCrashMidTurn(
+  probe: AgentSessionOwnerProbe,
+  { reconcile = true }: { reconcile?: boolean } = {}
+) {
+  const dying = hostTestState()
+  await attach()
+  const events = dying.acquire.mock.calls[0]?.[0].events
+  if (!events) {
+    throw new Error('missing provider event sink')
+  }
+  events.appendItem(
+    { provider: 'codex', threadId: THREAD, turnId: 'crashed-turn', ordinal: 1 },
+    { kind: 'turn', turnId: 'crashed-turn', state: 'running' }
+  )
+  await dying.host.flushStreamedEvents(SESSION)
+  // An empty renewal queues behind every record write, so they are on disk.
+  await dying.store.renewLeases([])
+  const relaunched = `${dying.root}-relaunched`
+  relaunchedRoots.push(relaunched)
+  // A dead process holds no lock.
+  await cp(dying.root, relaunched, {
+    recursive: true,
+    filter: (source) => !source.includes('.lock')
+  })
+  const store = await AgentSessionRecordStore.open({
+    directory: join(relaunched, 'store'),
+    hostId: 'local'
+  })
+  const acquire = vi.fn(async () => {
+    throw new Error('claude: command not found')
+  })
+  const host = new StructuredAgentSessionHost({
+    store,
+    adapter: { ...adapter(), acquire },
+    journalRoot: relaunched,
+    claimKeyId: 'key-1',
+    mintSpawnToken: () => 'spawn-next',
+    probeOwner: async () => probe,
+    now: () => NOW
+  })
+  if (reconcile) {
+    await host.reconcileRestartLeases()
+  }
+  replaceHostTestState({ store, host })
+  return { host, acquire }
+}
+
+/** Neither proof of the old owner's death is an observed exit, so the turn ends `unverifiable`. */
+async function turnStates(host: StructuredAgentSessionHost) {
+  return (await host.journalSnapshot(SESSION)).items
+    .flatMap((item) => readAgentJournalTurn(item.body) ?? [])
+    .map((turn) => turn.state)
+}
+
+// A host that cannot prove the old owner gone leaves its lease in recovery, still claimed, until
+// the next acquire resolves it: the open is not that acquire, and the turn is no less gone.
+const PROBES = [
+  ['the old owner is proven gone', { outcome: 'pid-absent' }],
+  [
+    'nothing proves the old owner gone',
+    { outcome: 'indeterminate', reason: 'This host cannot probe structured session owners.' }
+  ]
+] as const satisfies readonly (readonly [string, AgentSessionOwnerProbe])[]
+
+it.each(PROBES)(
+  'settles a turn a dead generation left running when a send opens the chat and its start fails, when %s',
+  async (_when, probe) => {
+    const { host, acquire } = await relaunchAfterCrashMidTurn(probe)
+    expect(host.hasSession(SESSION)).toBe(false)
+
+    const body = hostTestMessage('sent to a chat nobody has open')
+    const sendEnvelope = envelope('agentSession.send', { body })
+    await expect(host.send(CALLER, { envelope: sendEnvelope, body })).resolves.toMatchObject({
+      ok: true
+    })
+    await eventually(async () =>
+      expect(
+        (await host.journalSnapshot(SESSION)).submissions.find(
+          (entry) => entry.clientMessageId === sendEnvelope.clientOperationId
+        )
+      ).toMatchObject({ dispatchState: 'rejected' })
+    )
+
+    expect(acquire).toHaveBeenCalledOnce()
+    expect(await turnStates(host)).toEqual(['unverifiable'])
+    await host.flushAllStreamedEvents()
+  }
+)
+
+it.each(PROBES)(
+  'settles the same turn when a reader opens the chat, when %s',
+  async (_when, probe) => {
+    const { host } = await relaunchAfterCrashMidTurn(probe)
+
+    await host.revealSession(SESSION)
+
+    expect(await turnStates(host)).toEqual(['unverifiable'])
+    await host.flushAllStreamedEvents()
+  }
+)
+
+// On desktop the chat on screen at relaunch reads before startup reconciles the leases.
+it('settles it when a read reaches the chat before the startup reconcile', async () => {
+  const { host } = await relaunchAfterCrashMidTurn({ outcome: 'pid-absent' }, { reconcile: false })
+  expect(hostTestState().store.getRecord(SESSION)?.lease.claimStatus).toBe('live')
+
+  await host.history({ sessionId: SESSION, direction: 'tail' })
+  await host.reconcileRestartLeases()
+  await host.restoreReadableSessions([SESSION])
+
+  expect(await turnStates(host)).toEqual(['unverifiable'])
+  await host.flushAllStreamedEvents()
+})
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-send-preparation.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-send-preparation.test.ts
index f48af3b4d4b3..259ad16c858e 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-send-preparation.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-send-preparation.test.ts
@@ -1,15 +1,19 @@
-// A send, or a hold, that finds the session's provider child gone, against the real host.
+// A send, or a hold, that finds the session's provider child gone, against the real host. The
+// send is accepted at once; its delivery restarts the child, or rejects it with the reason.
 
 import { mkdtemp, rm } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, beforeEach, describe, expect, it, vi, type Mock } from 'vitest'
 import { computeAgentSessionPayloadFingerprint } from '../../../shared/agent-session-mutation-envelope'
-import { agentSessionRefusalOperationState } from '../../../shared/agent-session-refusal-retry'
-import type { AgentSessionMutationEnvelope } from '../../../shared/agent-session-wire'
+import type {
+  AgentSessionMutationEnvelope,
+  AgentSessionSubscribeEvent
+} from '../../../shared/agent-session-wire'
 import { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
 import type { StructuredAgentSessionAdapter } from './structured-agent-session-adapter'
 import { StructuredAgentSessionHost } from './structured-agent-session-host'
+import { CodexAppServerRequestError } from '../../codex/codex-app-server-request-error'
 import {
   HOST_TEST_NOW as NOW,
   HOST_TEST_SESSION as SESSION,
@@ -21,8 +25,11 @@ import {
 } from './structured-agent-session-host-test-data'
 
 const CALLER = { callerKey: 'client-1' }
-// Long enough that no release fires mid-test; whether one is pending is asserted directly.
-const GRACE_MS = 60_000
+
+/** Delivery runs on its own serialized steps; under a loaded runner they take more than a second. */
+function eventually(assertion: () => void | Promise<void>): Promise<void> {
+  return vi.waitFor(assertion, { timeout: 10_000 })
+}
 
 let root: string
 let store: AgentSessionRecordStore
@@ -75,7 +82,6 @@ beforeEach(async () => {
     journalRoot: root,
     claimKeyId: 'key-1',
     mintSpawnToken: () => `spawn-${acquire.mock.calls.length}`,
-    releaseGraceMs: GRACE_MS,
     now: () => NOW,
     onEventSinkError: ({ error }) => hostErrors.push(error)
   })
@@ -102,15 +108,37 @@ function sendParams(text: string, operationId = hostTestOperationId()) {
   return { envelope, body }
 }
 
-/** Every status row the chat shows, oldest first; none when the session is not even readable. */
-function journalStatuses(): string[] {
-  if (!host.hasSession(SESSION)) {
-    return []
-  }
-  const history = host.history({ sessionId: SESSION, direction: 'tail' })
-  return history.ok
-    ? history.page.items.flatMap((item) => (item.body.kind === 'status' ? [item.body.text] : []))
-    : []
+/** Accepted at once, before any owner exists for it; answers the message id. */
+async function accept(params: ReturnType<typeof sendParams>): Promise<string> {
+  const result = await host.send(CALLER, params)
+  expect(result, JSON.stringify(result)).toMatchObject({
+    ok: true,
+    replayed: false,
+    value: { submission: { dispatchState: 'pending', handoverRecorded: true } }
+  })
+  return params.envelope.clientOperationId
+}
+
+async function submission(clientMessageId: string) {
+  return (await host.journalSnapshot(SESSION)).submissions.find(
+    (entry) => entry.clientMessageId === clientMessageId
+  )
+}
+
+/** The submission once delivery is done with it: handed over, or rejected unwritten. */
+async function settled(clientMessageId: string) {
+  await eventually(async () => {
+    const current = await submission(clientMessageId)
+    expect(current?.dispatchState !== 'pending' || current.handedOverAt !== undefined).toBe(true)
+  })
+  return submission(clientMessageId)
+}
+
+/** The failure rows a start the chat needed left, oldest first. */
+async function errorStatuses(): Promise<string[]> {
+  return (await host.journalSnapshot(SESSION)).items.flatMap((item) =>
+    item.body.kind === 'status' && item.body.tone === 'error' ? [item.body.text] : []
+  )
 }
 
 /** The child timed out or exited: its lease is handed back and the host holds no session. */
@@ -127,15 +155,14 @@ describe('a send with no live owner', () => {
   it('restarts the owner once and delivers against it', async () => {
     await loseOwner()
 
-    const result = await host.send(CALLER, sendParams('after the child died'))
+    await accept(sendParams('after the child died'))
 
-    expect(result).toMatchObject({ ok: true, replayed: false })
+    await eventually(async () => expect(dispatch).toHaveBeenCalledOnce())
     expect(acquire).toHaveBeenCalledOnce()
-    expect(dispatch).toHaveBeenCalledOnce()
     expect(store.getRecord(SESSION)?.lease.claimStatus).toBe('live')
   })
 
-  it('restarts the owner before the send is admitted, so the send is admitted once', async () => {
+  it('accepts the send before anything restarts, and the restart hands it over', async () => {
     await loseOwner()
     const order: string[] = []
     const spawnChild = acquire.getMockImplementation()!
@@ -149,21 +176,18 @@ describe('a send with no live owner', () => {
       return admit(args)
     })
 
-    await expect(host.send(CALLER, sendParams('ensure first'))).resolves.toMatchObject({
-      ok: true,
-      replayed: false
-    })
+    await accept(sendParams('accept first'))
+    await eventually(async () => expect(dispatch).toHaveBeenCalledOnce())
 
-    expect(order).toEqual(['acquire', 'admit'])
+    expect(order).toEqual(['admit', 'acquire'])
   })
 
   it('leaves a live owner alone', async () => {
     acquire.mockClear()
 
-    await expect(host.send(CALLER, sendParams('owner is live'))).resolves.toMatchObject({
-      ok: true
-    })
+    await accept(sendParams('owner is live'))
 
+    await eventually(async () => expect(dispatch).toHaveBeenCalledOnce())
     expect(acquire).not.toHaveBeenCalled()
   })
 
@@ -181,37 +205,12 @@ describe('a send with no live owner', () => {
       }
     }))
 
-    await host.send(CALLER, sendParams('into a cleared chat'))
-
-    expect(acquire).not.toHaveBeenCalled()
-  })
-
-  it('renews the idle window on journal activity in an unheld session', async () => {
-    await loseOwner()
-    await expect(host.send(CALLER, sendParams('restart'))).resolves.toMatchObject({ ok: true })
-    const arm = vi.spyOn(host['holds']['clock'], 'arm')
-
-    await expect(host.send(CALLER, sendParams('more activity'))).resolves.toMatchObject({
-      ok: true
-    })
-
-    expect(arm).toHaveBeenCalledWith(SESSION)
-  })
-
-  it('releases the restarted child on the usual clock only when no surface holds it', async () => {
-    await loseOwner()
-    await expect(host.send(CALLER, sendParams('nobody is watching'))).resolves.toMatchObject({
-      ok: true
+    await expect(host.send(CALLER, sendParams('into a cleared chat'))).resolves.toMatchObject({
+      ok: false,
+      refusal: { code: 'agent_session_operation_invalid' }
     })
-    expect(host['holds'].isReleasePending(SESSION)).toBe(true)
 
-    await host.close(SESSION)
-    // A reading surface that does not itself restart the agent.
-    await host.hold(SESSION, 'desktop-chat:1', { resume: false })
-    await expect(host.send(CALLER, sendParams('the chat is open'))).resolves.toMatchObject({
-      ok: true
-    })
-    expect(host['holds'].isReleasePending(SESSION)).toBe(false)
+    expect(acquire).not.toHaveBeenCalled()
   })
 
   it('restarts an owner that exited while the session stayed readable', async () => {
@@ -228,15 +227,15 @@ describe('a send with no live owner', () => {
     expect(store.getRecord(SESSION)?.lease.claimStatus).toBe('released')
     acquire.mockClear()
 
-    await expect(host.send(CALLER, sendParams('after an exit'))).resolves.toMatchObject({
-      ok: true
-    })
+    await accept(sendParams('after an exit'))
+    await eventually(async () => expect(dispatch).toHaveBeenCalledOnce())
     expect(acquire).toHaveBeenCalledOnce()
   })
 
   it('restarts nothing for a resend the journal already answers', async () => {
     const params = sendParams('sent once')
-    await expect(host.send(CALLER, params)).resolves.toMatchObject({ ok: true, replayed: false })
+    await accept(params)
+    await eventually(async () => expect(dispatch).toHaveBeenCalledOnce())
     // The child died during startup: the lease is handed back, the fence moves, and the session
     // stays readable. The client resends against the new fence.
     await host.handleAdapterEvent({
@@ -265,12 +264,9 @@ describe('a send with no live owner', () => {
     expect(store.getRecord(SESSION)?.lease.claimStatus).toBe('released')
 
     // Retry rotates the id: a genuinely new send restarts the owner once.
-    await expect(host.send(CALLER, sendParams('sent once'))).resolves.toMatchObject({
-      ok: true,
-      replayed: false
-    })
+    await accept(sendParams('sent once'))
+    await eventually(async () => expect(dispatch).toHaveBeenCalledTimes(2))
     expect(acquire).toHaveBeenCalledOnce()
-    expect(dispatch).toHaveBeenCalledTimes(2)
   })
 
   it('restarts nothing for a send the ledger holds but the journal never saw', async () => {
@@ -317,7 +313,7 @@ describe('a send with no live owner', () => {
     expect(dispatch).not.toHaveBeenCalled()
   })
 
-  it('rebases a send that arrives after the restart has already claimed the lease', async () => {
+  it('accepts a send that arrives while a restart holds the queue, and hands both over in order', async () => {
     await loseOwner()
     const lostFence = store.getRecord(SESSION)?.lease.runtimeFence ?? 0
     let claimed = () => {}
@@ -331,18 +327,22 @@ describe('a send with no live owner', () => {
       return spawnChild!(input)
     })
 
-    const first = host.send(CALLER, sendParams('first'))
+    const first = await accept(sendParams('first'))
     await claim
     expect(store.getRecord(SESSION)?.lease.runtimeFence).toBe(lostFence + 1)
+    // Written against the lost owner's fence, which admits it: a send is a conversation write.
     const late = sendParams('second')
     late.envelope.expectedRuntimeFence = lostFence
     const second = host.send(CALLER, late)
     release()
 
-    expect(await first).toMatchObject({ ok: true })
     expect(await second).toMatchObject({ ok: true })
+    await eventually(async () => expect(dispatch).toHaveBeenCalledTimes(2))
     expect(acquire).toHaveBeenCalledOnce()
-    expect(dispatch).toHaveBeenCalledTimes(2)
+    expect(dispatch.mock.calls.map(([input]) => input.clientMessageId)).toEqual([
+      first,
+      late.envelope.clientOperationId
+    ])
   })
 
   it('shares one restart between concurrent sends', async () => {
@@ -355,142 +355,151 @@ describe('a send with no live owner', () => {
     ])
 
     expect(results.map((result) => result.ok)).toEqual([true, true, true])
+    await eventually(async () => expect(dispatch).toHaveBeenCalledTimes(3))
     expect(acquire).toHaveBeenCalledOnce()
-    expect(dispatch).toHaveBeenCalledTimes(3)
-  })
-
-  it('shares one restart between a hold and a send that arrive in the same gap', async () => {
-    await loseOwner()
-
-    const [held, sent] = await Promise.allSettled([
-      host.hold(SESSION, 'desktop-chat:1'),
-      host.send(CALLER, sendParams('while the chat opens'))
-    ])
-
-    expect(held).toMatchObject({ status: 'fulfilled' })
-    expect(sent).toMatchObject({ status: 'fulfilled', value: { ok: true } })
-    expect(acquire).toHaveBeenCalledOnce()
-    expect(dispatch).toHaveBeenCalledOnce()
-    expect(host['holds'].isHeld(SESSION)).toBe(true)
-    expect(host['holds'].isReleasePending(SESSION)).toBe(false)
   })
 
   it('replays into a closed session without spawning anything', async () => {
     const params = sendParams('sent once')
-    await expect(host.send(CALLER, params)).resolves.toMatchObject({ ok: true, replayed: false })
+    await accept(params)
+    await eventually(async () => expect(dispatch).toHaveBeenCalledOnce())
     await loseOwner()
 
     await expect(host.send(CALLER, params)).resolves.toMatchObject({ ok: true, replayed: true })
     await expect(host.send(CALLER, params)).resolves.toMatchObject({ ok: true, replayed: true })
 
-    // The journal was made readable for the answer; the record's lease was left as it was.
+    // The conversation was opened for the answer; the record's lease was left as it was.
     expect(host.hasSession(SESSION)).toBe(true)
     expect(acquire).not.toHaveBeenCalled()
     expect(dispatch).toHaveBeenCalledOnce()
     expect(store.getRecord(SESSION)?.lease.claimStatus).toBe('released')
-    expect(host['holds'].isReleasePending(SESSION)).toBe(false)
   })
 
-  it("refuses with the restart's own cause, in the answer and in the chat", async () => {
+  it("rejects the accepted message with the restart's own cause, and says so in the chat once", async () => {
     await loseOwner()
     acquire.mockRejectedValue(new Error('Not signed in. Run codex login'))
     const params = sendParams('while signed out')
+    // The acquire's error is Orca's wrapper, not the provider's words: it goes to the log. No exit
+    // was observed, so the chat does not say the provider stopped.
+    const cause = "Codex couldn't restart. Send your message to try again."
 
-    const result = await host.send(CALLER, params)
+    const id = await accept(params)
 
-    expect(result).toEqual({
-      ok: false,
-      refusal: {
-        code: 'agent_session_owner_restart_failed',
-        message: "Codex couldn't restart: Not signed in. Run codex login.",
-        // The failed attach proved its child gone: nothing runs for this session.
-        ownerVerdict: 'exited'
-      }
+    expect(await settled(id)).toMatchObject({
+      dispatchState: 'rejected',
+      reason: cause,
+      rejection: { kind: 'restartFailed' }
     })
     expect(dispatch).not.toHaveBeenCalled()
-    expect(hostErrors).not.toEqual([])
-    expect(agentSessionRefusalOperationState('agent_session_owner_restart_failed')).toBe(
-      'settled-rejected'
+    // Accepted, so the ledger answers a resend with the rejection rather than a second attempt.
+    expect(
+      store.getOperationRow(CALLER.callerKey, params.envelope.clientOperationId)
+    ).toMatchObject({ outcome: { status: 'succeeded' } })
+    // One row, in the error tone, so the reason outlives the error strip.
+    expect(await errorStatuses()).toEqual([cause])
+  })
+
+  it("keeps Codex's own words behind a refused resume without saying the provider stopped", async () => {
+    await loseOwner()
+    const said = `no rollout found for thread id ${THREAD}`
+    acquire.mockRejectedValue(
+      new CodexAppServerRequestError('thread/resume', -32600, `thread/resume failed: ${said}`, said)
     )
-    // Refused before admission: the ledger holds nothing a resend would replay.
-    expect(store.getOperationRow(CALLER.callerKey, params.envelope.clientOperationId)).toBeNull()
-    // The same status row a failed start leaves, so the reason outlives the error strip.
-    expect(journalStatuses()).toEqual([
-      'The provider stopped before it finished starting: Not signed in. Run codex login.'
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => undefined)
+
+    const id = await accept(sendParams('after the thread went away'))
+
+    // The sentence names no cause and quotes nothing; Codex's words ride in the fact for Details.
+    const rejection = {
+      kind: 'restartFailed',
+      detail: { text: said, audience: 'person' },
+      refusal: { code: 'agent_session_operation_invalid', details: { ownerVerdict: 'exited' } }
+    }
+    expect(await settled(id)).toMatchObject({
+      dispatchState: 'rejected',
+      reason: "Codex couldn't restart. Send your message to try again.",
+      rejection
+    })
+    expect(await errorStatuses()).toEqual([
+      "Codex couldn't restart. Send your message to try again."
     ])
+    // Orca's own text is logged once where the start failed.
+    expect(warn).toHaveBeenCalledWith(
+      '[agent-session] provider start failed:',
+      expect.objectContaining({ message: `thread/resume failed: ${said}` })
+    )
+    warn.mockRestore()
   })
 
-  it('restarts again for a Retry of the refused send, under its own id or a new one', async () => {
+  it('restarts again for a Retry under a new id, and replays a resend of the same id', async () => {
     await loseOwner()
     acquire.mockRejectedValue(new Error('Not signed in'))
     const params = sendParams('while signed out')
-    await expect(host.send(CALLER, params)).resolves.toMatchObject({
-      ok: false,
-      refusal: { code: 'agent_session_owner_restart_failed' }
-    })
+    await settled(await accept(params))
+    expect(acquire).toHaveBeenCalledTimes(1)
 
-    // A client that resends the same id gets another attempt, and the chat no second row.
+    // A client that resends the same id gets the recorded rejection, and the chat no second row.
     await expect(host.send(CALLER, params)).resolves.toMatchObject({
-      ok: false,
-      refusal: { code: 'agent_session_owner_restart_failed' }
+      ok: true,
+      replayed: true,
+      value: { submission: { dispatchState: 'rejected' } }
     })
-    expect(acquire).toHaveBeenCalledTimes(2)
-    expect(journalStatuses()).toHaveLength(1)
+    expect(acquire).toHaveBeenCalledTimes(1)
+    expect(await errorStatuses()).toHaveLength(1)
 
-    // The outbox's Retry rotates the id: also a fresh attempt.
-    await expect(host.send(CALLER, sendParams('while signed out'))).resolves.toMatchObject({
-      ok: false,
-      refusal: { code: 'agent_session_owner_restart_failed' }
+    // The outbox's Retry rotates the id: a fresh attempt, with its own row.
+    expect(await settled(await accept(sendParams('while signed out')))).toMatchObject({
+      dispatchState: 'rejected'
     })
-    expect(acquire).toHaveBeenCalledTimes(3)
+    expect(acquire).toHaveBeenCalledTimes(2)
+    expect(await errorStatuses()).toHaveLength(2)
     expect(dispatch).not.toHaveBeenCalled()
   })
 
   it('restarts and delivers a later send once the cause clears', async () => {
     await loseOwner()
     acquire.mockRejectedValueOnce(new Error('Not signed in'))
-    await expect(host.send(CALLER, sendParams('while signed out'))).resolves.toMatchObject({
-      ok: false,
-      refusal: { code: 'agent_session_owner_restart_failed' }
+    expect(await settled(await accept(sendParams('while signed out')))).toMatchObject({
+      dispatchState: 'rejected'
     })
 
     // The user signed in; nothing about the failed attempt is remembered.
-    await expect(host.send(CALLER, sendParams('signed in now'))).resolves.toMatchObject({
-      ok: true,
-      replayed: false
-    })
+    await accept(sendParams('signed in now'))
+    await eventually(async () => expect(dispatch).toHaveBeenCalledOnce())
     expect(acquire).toHaveBeenCalledTimes(2)
-    expect(dispatch).toHaveBeenCalledOnce()
     expect(store.getRecord(SESSION)?.lease.claimStatus).toBe('live')
   })
 
   it('suggests a new chat only when this host has nothing to restart the chat from', async () => {
     await loseOwner()
     acquire.mockRejectedValue(new Error('Not signed in'))
-    const failed = await host.send(CALLER, sendParams('restart fails'))
-    expect(failed).toMatchObject({
-      ok: false,
-      refusal: { code: 'agent_session_owner_restart_failed' }
-    })
-    expect(failed.ok ? '' : failed.refusal.message).not.toMatch(/new chat/)
+    const failed = await settled(await accept(sendParams('restart fails')))
+    expect(failed).toMatchObject({ dispatchState: 'rejected' })
+    expect(failed?.reason).not.toMatch(/new chat/)
 
     // The adapter cannot run this record where it lives: no retry would bring it back.
     host.deps.adapter.supportsLocation = () => false
-    const unresumable = await host.send(CALLER, sendParams('cannot resume here'))
+    const unresumable = await settled(await accept(sendParams('cannot resume here')))
 
     expect(unresumable).toMatchObject({
-      ok: false,
-      refusal: {
-        code: 'agent_session_owner_restart_failed',
-        message:
-          "Codex couldn't restart: This execution host cannot resume the requested structured agent session. Start a new chat to continue."
+      dispatchState: 'rejected',
+      reason: "Codex couldn't restart. Start a new chat to continue.",
+      rejection: {
+        kind: 'restartFailed',
+        refusal: {
+          code: 'structured_agent_session_unsupported',
+          details: { reason: 'hostUnsupported' }
+        }
       }
     })
   })
 
-  it('runs the send as the lease stands when the restart met a lease someone else is settling', async () => {
+  it('rejects the message with the cause when the restart met a lease someone else is settling', async () => {
     await loseOwner()
-    vi.spyOn(host['holds'], 'ensureProviderChild').mockResolvedValueOnce({
+    vi.spyOn(
+      host['conversationDelivery'].loop['deps'],
+      'ensureProviderChild'
+    ).mockResolvedValueOnce({
       ok: false,
       refusal: {
         code: 'execution_owner_reconciling',
@@ -498,181 +507,165 @@ describe('a send with no live owner', () => {
       }
     })
 
-    const result = await host.send(CALLER, sendParams('owner being settled'))
+    const id = await accept(sendParams('owner being settled'))
 
-    // The ordinary lease check answers, retryably; nothing terminal and nothing in the chat.
-    expect(result).toMatchObject({
-      ok: false,
-      refusal: { code: 'agent_session_ownership_unknown' }
+    // The refusal's prose stays out of the chat; its code rides in the fact.
+    const cause = "Codex couldn't restart. Send your message to try again."
+    expect(await settled(id)).toMatchObject({
+      dispatchState: 'rejected',
+      reason: cause,
+      rejection: { kind: 'restartFailed', refusal: { code: 'execution_owner_reconciling' } }
     })
     expect(acquire).not.toHaveBeenCalled()
-    expect(journalStatuses()).toEqual([])
+    expect(await errorStatuses()).toEqual([cause])
   })
 
-  it('runs the send as the lease stands when the restart itself faults', async () => {
+  it('rejects the message, and reports the fault, when the restart itself faults', async () => {
     await loseOwner()
-    vi.spyOn(host['holds'], 'ensureProviderChild').mockRejectedValueOnce(
-      new Error('spawn-token mint failed')
-    )
+    vi.spyOn(
+      host['conversationDelivery'].loop['deps'],
+      'ensureProviderChild'
+    ).mockRejectedValueOnce(new Error('spawn-token mint failed'))
 
-    const result = await host.send(CALLER, sendParams('bookkeeping failed'))
+    const id = await accept(sendParams('bookkeeping failed'))
 
-    expect(result).toMatchObject({
-      ok: false,
-      refusal: { code: 'agent_session_ownership_unknown' }
+    // Orca's own fault: reported to the log, and the chat says only that Orca failed.
+    expect(await settled(id)).toMatchObject({
+      dispatchState: 'rejected',
+      reason: "Orca ran into a problem, so this didn't go through. Try again.",
+      rejection: { kind: 'hostFault' }
     })
     expect(hostErrors).toContainEqual(
       expect.objectContaining({ message: 'spawn-token mint failed' })
     )
-    expect(journalStatuses()).toEqual([])
+    expect(await errorStatuses()).toHaveLength(1)
   })
 
-  it('keeps a second surface holder taken during an auto-restart, and starts nothing for it', async () => {
-    await host.hold(SESSION, 'desktop-chat:1')
-    const exitedFence = store.getRecord(SESSION)?.lease.runtimeFence ?? 0
-    acquire.mockClear()
-    const entered = Promise.withResolvers<void>()
-    const gate = Promise.withResolvers<void>()
-    const spawnChild = acquire.getMockImplementation()!
-    acquire.mockImplementationOnce(async (input) => {
-      entered.resolve()
-      await gate.promise
-      return spawnChild(input)
-    })
-
-    // The held child exits: the host restarts it on its own, under the surface that holds it.
-    const restarted = host.handleAdapterEvent({
-      type: 'ended',
-      sessionId: SESSION,
-      reason: 'provider exited',
-      cause: 'unexpected-exit',
-      fence: exitedFence,
-      acquisitionGeneration: 'generation-1'
-    })
-    await entered.promise
-    const second = host.hold(SESSION, 'paired-phone:1')
-    gate.resolve()
-    await Promise.all([restarted, second])
-
-    expect(acquire).toHaveBeenCalledOnce()
-    expect(host['holds']['holders'].holderIds(SESSION)).toEqual([
-      'desktop-chat:1',
-      'paired-phone:1'
-    ])
-    expect(host['holds'].isReleasePending(SESSION)).toBe(false)
-    expect(store.getRecord(SESSION)?.lease.claimStatus).toBe('live')
-  })
-
-  it('puts the child of an auto-restart on the idle clock when its surface left mid-attach', async () => {
-    await host.hold(SESSION, 'desktop-chat:1')
-    const exitedFence = store.getRecord(SESSION)?.lease.runtimeFence ?? 0
-    acquire.mockClear()
-    const entered = Promise.withResolvers<void>()
-    const gate = Promise.withResolvers<void>()
-    const spawnChild = acquire.getMockImplementation()!
-    acquire.mockImplementationOnce(async (input) => {
-      entered.resolve()
-      await gate.promise
-      return spawnChild(input)
-    })
+  it('exits the recovery stage a failed attempt latched before its delivery resumes it', async () => {
+    await loseOwner()
+    // What an acquisition whose exit could not be proven leaves behind: nobody's, but latched.
+    await store.transitionHandoff(SESSION, (current) => ({
+      ...current,
+      lease: { ...current.lease, handoffStage: 'recovering' }
+    }))
+    host.deps.probeOwner = async () => ({ outcome: 'pid-absent' })
 
-    const restarted = host.handleAdapterEvent({
-      type: 'ended',
-      sessionId: SESSION,
-      reason: 'provider exited',
-      cause: 'unexpected-exit',
-      fence: exitedFence,
-      acquisitionGeneration: 'generation-1'
-    })
-    await entered.promise
-    // The only surface leaves while the host is still spawning the child it asked for.
-    host.release(SESSION, 'desktop-chat:1')
-    gate.resolve()
-    await restarted
+    await accept(sendParams('latched owner'))
 
+    await eventually(async () => expect(dispatch).toHaveBeenCalledOnce())
     expect(acquire).toHaveBeenCalledOnce()
-    expect(host['holds'].isHeld(SESSION)).toBe(false)
-    // Nobody holds the child, so it goes on the same clock a departed surface would start.
-    expect(host['holds'].isReleasePending(SESSION)).toBe(true)
-    expect(hostErrors).toEqual([])
-  })
-
-  it('counts a queued restart as in flight from the moment it is asked for, so a quit drains it', async () => {
-    const closeSession = vi.mocked(host.deps.adapter.closeSession!)
-    acquire.mockClear()
-    const gate = Promise.withResolvers<void>()
-    closeSession.mockImplementationOnce(async () => {
-      await gate.promise
-      return true
-    })
-    const closing = host.close(SESSION)
-    const hold = host.hold(SESSION, 'desktop-chat:1')
-    let drained = false
-    void host['tasks'].drainAttaches().then(() => {
-      drained = true
+    expect(store.getRecord(SESSION)?.lease).toMatchObject({
+      handoffStage: null,
+      claimStatus: 'live'
     })
-    await new Promise<void>((resolve) => setImmediate(resolve))
-
-    // The hold waits its turn behind the close, and the quit's drain waits for the hold: the
-    // child it is about to spawn must exist before the quit decides what to evict.
-    expect(acquire).not.toHaveBeenCalled()
-    expect(drained).toBe(false)
-
-    gate.resolve()
-    await Promise.all([closing, hold])
-    await new Promise<void>((resolve) => setImmediate(resolve))
-    expect(acquire).toHaveBeenCalledOnce()
-    expect(drained).toBe(true)
   })
 
-  it('adjudicates a lease this host has not reconciled before a hold resumes it', async () => {
+  it('adjudicates a lease this host has not reconciled before its delivery resumes it', async () => {
     await loseOwner()
     await store.transitionHandoff(SESSION, (current) => ({
       ...current,
       lease: { ...current.lease, unreconciled: true }
     }))
-    host.deps.probeOwner = async () => ({ outcome: 'pid-absent' })
 
-    await host.hold(SESSION, 'desktop-chat:1')
+    // The send's start is the same serialized resume a hold runs, reconciliation first.
+    await accept(sendParams('owner unverified'))
 
+    await eventually(async () => expect(dispatch).toHaveBeenCalledOnce())
     expect(acquire).toHaveBeenCalledOnce()
     expect(store.getRecord(SESSION)?.lease).toMatchObject({
       unreconciled: false,
       claimStatus: 'live'
     })
   })
+})
 
-  it('exits the recovery stage a failed attempt latched before a hold resumes', async () => {
+// A pane keeps the fence of the last frame it read. An idle release and the restart after it
+// each move the lease, so that fence can be several generations behind the one a write lands on.
+describe('a write fenced to an owner the pane has not seen replaced', () => {
+  it('delivers a send fenced to the owner an idle release retired', async () => {
+    const seenFence = store.getRecord(SESSION)?.lease.runtimeFence ?? 0
     await loseOwner()
-    // What an acquisition whose exit could not be proven leaves behind: nobody's, but latched.
-    await store.transitionHandoff(SESSION, (current) => ({
-      ...current,
-      lease: { ...current.lease, handoffStage: 'manual-recovery' }
-    }))
-    host.deps.probeOwner = async () => ({ outcome: 'pid-absent' })
+    const params = sendParams('after the release')
+    params.envelope.expectedRuntimeFence = seenFence
 
-    await host.hold(SESSION, 'desktop-chat:1')
+    const id = await accept(params)
+    expect(await settled(id)).toMatchObject({ dispatchState: 'accepted' })
 
     expect(acquire).toHaveBeenCalledOnce()
-    expect(store.getRecord(SESSION)?.lease).toMatchObject({
-      handoffStage: null,
-      claimStatus: 'live'
+    expect(dispatch).toHaveBeenCalledOnce()
+    expect(store.getRecord(SESSION)?.lease.runtimeFence).toBeGreaterThan(seenFence + 1)
+  })
+
+  // Clients resend a refused message when the fence they hold moves. A failed start is a
+  // rejected message now, never a refused send, and the pane keeps the fence it subscribed under.
+  it("keeps the pane's fence on the rows a failed start publishes, and rejects the message", async () => {
+    const seenFence = store.getRecord(SESSION)?.lease.runtimeFence ?? 0
+    const frames: AgentSessionSubscribeEvent[] = []
+    await host.subscribe({ id: 'pane', sessionId: SESSION, emit: (event) => frames.push(event) })
+    await loseOwner()
+    acquire.mockRejectedValueOnce(new Error('Not signed in'))
+    const subscribed = frames.length
+
+    const id = await accept(sendParams('while signed out'))
+
+    expect(await settled(id)).toMatchObject({
+      dispatchState: 'rejected',
+      rejection: { kind: 'restartFailed' }
     })
+    expect(store.getRecord(SESSION)?.lease.runtimeFence).toBeGreaterThan(seenFence + 1)
+    const published = frames.slice(subscribed)
+    expect(published.length).toBeGreaterThan(0)
+    for (const frame of published) {
+      expect(frame).toMatchObject({ fence: seenFence })
+    }
   })
 
-  it('leaves a lease it cannot adjudicate alone', async () => {
+  it('admits a Stop and a send queued behind the cold start that replaced their owner', async () => {
     await loseOwner()
-    await store.transitionHandoff(SESSION, (current) => ({
-      ...current,
-      lease: { ...current.lease, unreconciled: true }
-    }))
+    const lostFence = store.getRecord(SESSION)?.lease.runtimeFence ?? 0
+    let claimed = () => {}
+    let release = () => {}
+    const claim = new Promise<void>((resolve) => (claimed = resolve))
+    const spawn = new Promise<void>((resolve) => (release = resolve))
+    acquire.mockImplementationOnce(async (input) => {
+      claimed()
+      await spawn
+      return spawnChild(input)
+    })
 
-    const result = await host.send(CALLER, sendParams('owner unverifiable'))
+    const firstParams = sendParams('starts the agent')
+    const first = host.send(CALLER, firstParams)
+    await claim
+    const cancelFields = { turnId: 'turn-1' }
+    const stop = host.cancel(CALLER, {
+      envelope: {
+        sessionId: SESSION,
+        clientOperationId: hostTestOperationId(),
+        expectedRuntimeFence: lostFence,
+        payloadFingerprint: computeAgentSessionPayloadFingerprint({
+          method: 'agentSession.cancel',
+          sessionId: SESSION,
+          fields: cancelFields
+        })
+      },
+      ...cancelFields
+    })
+    const late = sendParams('typed during the start')
+    late.envelope.expectedRuntimeFence = lostFence - 1
+    const second = host.send(CALLER, late)
+    release()
 
-    expect(result).toMatchObject({
-      ok: false,
-      refusal: { code: 'agent_session_ownership_unknown' }
+    expect(await first).toMatchObject({ ok: true })
+    expect(await stop).toMatchObject({ ok: true, replayed: false })
+    expect(await second).toMatchObject({ ok: true, replayed: false })
+    // The Stop withdrew the message its start held; the one typed after it is delivered.
+    expect(await settled(late.envelope.clientOperationId)).toMatchObject({
+      dispatchState: 'accepted'
     })
-    expect(acquire).not.toHaveBeenCalled()
+    expect(await submission(firstParams.envelope.clientOperationId)).toMatchObject({
+      dispatchState: 'rejected'
+    })
+    expect(acquire).toHaveBeenCalledOnce()
+    expect(dispatch).toHaveBeenCalledTimes(1)
   })
 })
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-send-preparation.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-send-preparation.ts
index e4a332f7acf8..a7a0e9710556 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-send-preparation.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-send-preparation.ts
@@ -1,75 +1,29 @@
-// What a send needs from the session before its lease is checked.
-//
-// A provider child that exits or fails to start hands its lease back. Before this, a send to that
-// session was refused `agent_session_ownership_unknown` — which a client reads as "not admitted
-// yet" and resends forever — and only a surface hold could ever make a new child. Now the send
-// makes sure it has an owner as a step of its own serialized admission: a released lease where
-// resume is allowed gets a child first; anything else runs as it is and meets the lease check.
-// A restart that fails refuses with a code the client stops auto-retrying on, carrying the
-// restart's own cause, and writes that cause into the chat the way a start that failed does, so
-// the user sees why. A manual Retry or a new send is a fresh attempt: a refusal before admission
-// leaves no ledger row behind.
-//
-// The ledger's answer comes first, so a send it already holds a row for restarts nothing:
-// admission replays or refuses it whoever owns the session now, and a closed session is made
-// readable for that, never given a child. Otherwise a child that dies at startup moves the fence,
-// the client resends the same message against the new fence, and each replay spawns another
-// child that dies the same way.
-//
-// Running inside the send's serialize is what makes "no child" exact and the fence bookkeeping
-// simple: the owner this send (or a hold just ahead of it) replaced is the one the client was
-// current as of, so the send is admitted at the fence the restart published.
-//
-// A child that has not proven its start is still the owner: the send is admitted against it and
-// the adapter holds the message until startup lands, or rejects it with the child's own reason
-// when the child dies first. The exit settlement writes that reason into the chat.
+// What a send or a Stop needs from the session before the ledger places its row: the
+// conversation open. Nothing here needs an owner — a send is accepted into the conversation and
+// the delivery loop makes the session ready — so a refusal before acceptance is only one the
+// conversation itself makes: a rewind or conversation command in doubt, a cleared conversation,
+// or a journal that cannot be opened.
 
 import type { AgentSessionRecord } from '../../../shared/agent-session-record'
-import type {
-  AgentSessionMutationEnvelope,
-  AgentSessionWireRefusal
+import {
+  refuse,
+  type AgentSessionMutationEnvelope,
+  type AgentSessionWireRefusal
 } from '../../../shared/agent-session-wire'
-import type { AgentSessionWireRefusalCode } from '../../../shared/agent-session-wire-refusals'
-import { boundJournalStatusText } from '../agent-session-journal/journal-prompt-body-bounds'
 import { TUI_AGENT_DISPLAY_NAMES } from '../../../shared/tui-agent-display-names'
+import type { AgentSessionFailureWordsContext } from '../../../shared/agent-session-failure-words'
+import { agentSessionWriteNoticeEnglish } from '../../../shared/agent-session-refusal-notice'
 import {
-  ownerRestartFailedOutcome,
-  providerStartupFailureOutcome
-} from './structured-agent-session-dead-generation-settlement'
+  classifyJournalOpenFailure,
+  type JournalOpenFailure
+} from '../agent-session-journal/journal-open-failure'
 import type { StructuredAgentSessionHostSession } from './structured-agent-session-host-types'
-import type { StructuredAgentSessionMutationContext } from './structured-agent-session-host-mutations'
-import type { AgentSessionMutationSessionPreparation } from './structured-agent-session-mutation-admission'
-import { isResumableStructuredAgentSessionRecord } from './structured-agent-session-resume-eligibility'
+import {
+  AGENT_SESSION_NOT_ATTACHED,
+  type AgentSessionMutationSessionPreparation
+} from './structured-agent-session-mutation-admission'
 import { rewindRefusal } from './structured-rewind-refusal'
-
-/**
- * What a refused resume means for the send that ran it. `transient`: the resume met a lease
- * someone else is settling, which is not proof it cannot resume — the send runs as the lease
- * stands and admission reports it. `failed`: the restart itself failed; the send answers with the
- * cause and stops the client's retry loop, and the user may clear the cause and retry.
- * `unresumable`: this host has nothing to restart the chat from — no record, or none it can run —
- * so only a new chat continues. A new wire code does not compile until it is classified here.
- */
-const RESUME_REFUSAL_OUTCOME: Record<
-  AgentSessionWireRefusalCode,
-  'transient' | 'failed' | 'unresumable'
-> = {
-  execution_owner_reconciling: 'transient',
-  agent_session_conflict: 'transient',
-  agent_session_checkpoint_stale: 'transient',
-  agent_session_ownership_unknown: 'transient',
-  agent_session_operation_capacity: 'transient',
-  structured_agent_session_unsupported: 'unresumable',
-  agent_session_operation_conflict: 'failed',
-  agent_session_operation_expired: 'failed',
-  agent_session_operation_invalid: 'failed',
-  agent_session_operation_unknown: 'failed',
-  agent_session_item_revision_stale: 'failed',
-  agent_session_already_resolved: 'failed',
-  agent_session_identity_required: 'unresumable',
-  agent_session_journal_unreadable: 'failed',
-  agent_session_owner_restart_failed: 'failed'
-}
+import type { StructuredAgentSessionMutationContext } from './structured-agent-session-host-mutations'
 
 /** Why the record refuses any send right now, whoever owns it; null when a send may run. */
 export function structuredAgentSessionSendBlock(
@@ -87,158 +41,93 @@ export function structuredAgentSessionSendBlock(
   ) {
     return {
       ok: false,
-      refusal: {
-        code: 'agent_session_operation_invalid',
-        message: command.replacementSessionId
-          ? 'This conversation has been cleared. Use the current conversation.'
-          : 'The conversation operation is unconfirmed.'
-      }
+      refusal:
+        command.phase === 'committed' && command.replacementSessionId
+          ? refuse(
+              'agent_session_operation_invalid',
+              { reason: 'conversationCleared' },
+              'This conversation has been cleared. Use the current conversation.'
+            )
+          : // A prepared /clear names its replacement before that conversation exists.
+            command.command === 'clear'
+            ? refuse(
+                'agent_session_operation_invalid',
+                { reason: 'clearUnconfirmed' },
+                "The last /clear didn't finish. Start a new chat to continue."
+              )
+            : refuse(
+                'agent_session_operation_invalid',
+                { reason: 'conversationCommandUnconfirmed' },
+                'The conversation operation is unconfirmed.'
+              )
     }
   }
   return null
 }
 
-/** Whether this send is the one that must bring the owner back: no child, a lease handed back
- *  cleanly, and nothing on the record that refuses the send anyway. Live, unverifiable, still
- *  reserved, or handed off: that lease is not this send's to replace. */
-export function structuredAgentSessionSendNeedsOwner(
-  session: StructuredAgentSessionHostSession | undefined,
-  record: AgentSessionRecord
-): boolean {
-  return (
-    session?.hasProviderChild !== true &&
-    isResumableStructuredAgentSessionRecord(record) &&
-    structuredAgentSessionSendBlock(record) === null
-  )
-}
-
-type SendPreparationContext = Pick<
-  StructuredAgentSessionMutationContext,
-  'deps' | 'sessions' | 'holds' | 'restoreReadable' | 'publish'
->
-
-export async function prepareStructuredAgentSessionSend(
-  context: SendPreparationContext,
-  envelope: AgentSessionMutationEnvelope,
-  ledger: 'admit' | 'replay',
-  record: AgentSessionRecord
+/** The conversation a send or a Stop writes to, opened when this host holds it closed. */
+export async function openConversationForWrite(
+  openConversation: (sessionId: string) => Promise<StructuredAgentSessionHostSession | null>,
+  envelope: AgentSessionMutationEnvelope
 ): Promise<AgentSessionMutationSessionPreparation> {
-  const { sessionId } = record
-  if (ledger !== 'admit') {
-    if (!context.sessions.has(sessionId)) {
-      await context.restoreReadable(sessionId)
+  try {
+    if (await openConversation(envelope.sessionId)) {
+      return { ok: true }
     }
-    return { ok: true, envelope }
-  }
-  if (structuredAgentSessionSendNeedsOwner(context.sessions.get(sessionId), record)) {
-    const refusal = await restartOwnerForSend(context, envelope, record)
-    if (refusal) {
-      return { ok: false, refusal }
+    return { ok: false, refusal: AGENT_SESSION_NOT_ATTACHED }
+  } catch (error) {
+    console.warn('[agent-session] opening the conversation for a write failed:', error)
+    const reason = classifyJournalOpenFailure(error)
+    return {
+      ok: false,
+      refusal: refuse('agent_session_journal_unreadable', { reason }, JOURNAL_OPEN_MESSAGE[reason])
     }
   }
-  return { ok: true, envelope: admitAtResumedFence(context.sessions.get(sessionId), envelope) }
 }
 
-/** One restart attempt. Answers with the refusal that ends the send, or null when the send goes
- *  on to admission — after a child, after a transient refusal, or after a fault in the restart's
- *  own bookkeeping, which is reported and never gates the user's action. */
-async function restartOwnerForSend(
-  context: SendPreparationContext,
-  envelope: AgentSessionMutationEnvelope,
-  record: AgentSessionRecord
-): Promise<AgentSessionWireRefusal | null> {
-  const { sessionId } = envelope
-  let resumed: Awaited<ReturnType<typeof context.holds.ensureProviderChild>>
-  try {
-    resumed = await context.holds.ensureProviderChild(sessionId)
-  } catch (error) {
-    context.deps.onEventSinkError?.({ sessionId, error })
-    return null
-  }
-  const outcome = resumed.ok ? null : RESUME_REFUSAL_OUTCOME[resumed.refusal.code]
-  if (resumed.ok || outcome === 'transient') {
-    return null
-  }
-  const refusal = ownerRestartFailedRefusal(record, resumed.refusal, outcome !== 'unresumable')
-  context.deps.onEventSinkError?.({
-    sessionId,
-    error: new Error(`${resumed.refusal.code}: ${resumed.refusal.message}`)
-  })
-  // A restart whose child died starting leaves the row any start that died leaves, so the chat
-  // reads the same whether the send met that death before admission or after it.
-  await recordFailedRestart(
-    context,
-    envelope,
-    resumed.refusal.ownerVerdict === 'exited'
-      ? providerStartupFailureOutcome(resumed.refusal.message)
-      : refusal.message
-  )
-  return refusal
+// Released clients print a refusal's message for a send; it fits a Stop too.
+const JOURNAL_OPEN_MESSAGE: Record<JournalOpenFailure, string> = {
+  journalCorrupt: agentSessionWriteNoticeEnglish(['historyUnusable']),
+  journalUnavailable: agentSessionWriteNoticeEnglish(['historyUnavailable', 'tryAgain'])
 }
 
-/** The client stops on the code; the message carries the restart's own cause, and the verdict —
- *  when the failed attach proved its child gone — tells a client nothing runs for the session. */
-function ownerRestartFailedRefusal(
-  record: AgentSessionRecord,
-  cause: AgentSessionWireRefusal,
-  resumable: boolean
-): AgentSessionWireRefusal {
-  return {
-    code: 'agent_session_owner_restart_failed',
-    message: ownerRestartFailedOutcome({
-      agentName: TUI_AGENT_DISPLAY_NAMES[record.provider],
-      reason: cause.message,
-      resumable
-    }),
-    ...(cause.ownerVerdict ? { ownerVerdict: cause.ownerVerdict } : {})
-  }
+/** The conversation a write lands in, opened when this host holds it closed. */
+export function openForWrite(
+  context: Pick<StructuredAgentSessionMutationContext, 'openConversation'>,
+  envelope: AgentSessionMutationEnvelope
+): () => Promise<AgentSessionMutationSessionPreparation> {
+  return () => openConversationForWrite(context.openConversation, envelope)
 }
 
-/** The same status row a start that failed leaves in the chat, so the reason outlives the error
- *  strip. The journal is made readable for it when the failed attach left none behind. Keyed by
- *  the send, not the clock: a resend of the same id that fails again adds no second row. */
-async function recordFailedRestart(
-  context: SendPreparationContext,
-  envelope: AgentSessionMutationEnvelope,
-  text: string
-): Promise<void> {
-  const { sessionId } = envelope
-  try {
-    if (!context.sessions.has(sessionId)) {
-      await context.restoreReadable(sessionId)
-    }
-    const session = context.sessions.get(sessionId)
-    if (!session) {
-      return
-    }
-    const settlementId = `failed-restart:${envelope.clientOperationId}`
-    await session.journal.appendLifecycleBatch({
-      settlementId,
-      fence: session.fence,
-      recovered: true,
-      mutations: [
-        {
-          kind: 'item',
-          identity: { provider: 'orca', clientMessageId: settlementId },
-          body: { kind: 'status', text: boundJournalStatusText(text) }
-        }
-      ]
-    })
-    context.publish(sessionId, session.journal)
-  } catch (error) {
-    context.deps.onEventSinkError?.({ sessionId, error })
+/** For an operation only the provider can perform: the conversation, then its agent. */
+export function openWithAgent(
+  context: Pick<StructuredAgentSessionMutationContext, 'openConversation' | 'ensureAgent'>,
+  envelope: AgentSessionMutationEnvelope
+): () => Promise<AgentSessionMutationSessionPreparation> {
+  return async () => {
+    const opened = await openConversationForWrite(context.openConversation, envelope)
+    return opened.ok ? context.ensureAgent(envelope.sessionId) : opened
   }
 }
 
-/** A writer current as of the owner this child replaced is current now: the restart was the only
- *  thing that moved the fence, whether this send ran it or one just ahead of it did. */
-function admitAtResumedFence(
-  session: StructuredAgentSessionHostSession | undefined,
+/** A rewind still in doubt once the conversation is open is one only its provider can settle —
+ *  the open settles every other — so a send starts the agent, whose attach recovers it. */
+export function sendPreparation(
+  context: Pick<StructuredAgentSessionMutationContext, 'openConversation' | 'ensureAgent' | 'deps'>,
   envelope: AgentSessionMutationEnvelope
-): AgentSessionMutationEnvelope {
-  return session?.hasProviderChild &&
-    session.resumedFromFence !== undefined &&
-    envelope.expectedRuntimeFence === session.resumedFromFence
-    ? { ...envelope, expectedRuntimeFence: session.fence }
-    : envelope
+): () => Promise<AgentSessionMutationSessionPreparation> {
+  return async () => {
+    const opened = await openConversationForWrite(context.openConversation, envelope)
+    const phase = context.deps.store.getRecord(envelope.sessionId)?.rewind?.phase
+    return opened.ok && (phase === 'prepared' || phase === 'provider-succeeded')
+      ? context.ensureAgent(envelope.sessionId)
+      : opened
+  }
+}
+
+/** Who a failure sentence names: the chat's agent, when the record says. */
+export function structuredAgentSessionFailureWordsContext(
+  record: AgentSessionRecord | null
+): AgentSessionFailureWordsContext {
+  return record ? { agentName: TUI_AGENT_DISPLAY_NAMES[record.provider] } : {}
 }
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-send-restarts-failed-start.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-send-restarts-failed-start.test.ts
index 181b40660f8f..f339aa1113fc 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-send-restarts-failed-start.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-send-restarts-failed-start.test.ts
@@ -1,17 +1,17 @@
 // A session that published and then lost its child before startup (not signed in, say) keeps a
 // released lease and a chat the user can still type into. The send is the user asking for the
-// child back: the host restarts it before admitting the write and delivers against the new owner,
-// instead of parking the message behind a lease nothing would ever re-acquire.
+// child back: the host accepts the message, and its delivery restarts the child and hands the
+// message to the new owner, instead of parking it behind a lease nothing would ever re-acquire.
 //
 // A child is published before it has proven its start, and it owns the send from that moment: the
-// message is admitted against it and the adapter holds it for the start. When the child exits
-// first, the exit settlement rejects the message and writes the cause into the chat, once, and
-// the next send is a fresh restart.
+// message is handed to it. When the child exits first, the exit settlement rejects the message and
+// writes the cause into the chat, once, and the next send is a fresh restart.
 
 import { mkdtemp, rm } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, beforeEach, describe, expect, it, vi, type Mock } from 'vitest'
+import { agentJournalSubmissionKey } from '../../../shared/agent-session-journal-item-key'
 import { computeAgentSessionPayloadFingerprint } from '../../../shared/agent-session-mutation-envelope'
 import type { AgentSessionMutationEnvelope } from '../../../shared/agent-session-wire'
 import { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
@@ -22,12 +22,18 @@ import {
   HOST_TEST_SESSION as SESSION,
   HOST_TEST_THREAD as THREAD,
   hostTestAttachParams,
+  hostTestDrawnRowIds,
   hostTestMessage,
   hostTestOperationId,
   resetHostTestOperationIds
 } from './structured-agent-session-host-test-data'
 
 const CALLER = { callerKey: 'client-1' }
+
+/** Delivery runs on its own serialized steps; under a loaded runner they take more than a second. */
+function eventually(assertion: () => void | Promise<void>): Promise<void> {
+  return vi.waitFor(assertion, { timeout: 10_000 })
+}
 const EXIT_REASON = 'Claude Code is not signed in. Sign in with the Claude CLI'
 
 let root: string
@@ -53,7 +59,7 @@ function sendEnvelope(
   }
 }
 
-/** A send is admitted against the child it meets, proven or not; the adapter holds the rest. */
+/** A send is accepted at once and handed to the child delivery finds or starts. */
 async function send(
   text: string,
   fence = store.getRecord(SESSION)?.lease.runtimeFence ?? 0
@@ -63,9 +69,13 @@ async function send(
   expect(sent, JSON.stringify(sent)).toMatchObject({
     ok: true,
     replayed: false,
-    value: { submission: { dispatchState: 'pending' } }
+    value: { submission: { dispatchState: 'pending', handoverRecorded: true } }
   })
-  return sent.ok ? sent.value.clientMessageId : ''
+  const clientMessageId = sent.ok ? sent.value.clientMessageId : ''
+  await eventually(async () =>
+    expect((await submission(clientMessageId))?.handedOverAt).toBeDefined()
+  )
+  return clientMessageId
 }
 
 /** The child of the current acquisition, as the adapter would identify it in a lifecycle event. */
@@ -91,21 +101,27 @@ function exitBeforeProof(): Promise<void> {
     type: 'ended',
     ...currentChild(),
     reason: EXIT_REASON,
+    failure: { kind: 'providerExited', detail: { text: EXIT_REASON, audience: 'log' } },
     cause: 'unexpected-exit',
     startupUnproven: true
   })
 }
 
-function journalStatuses(): string[] {
-  return host
-    .journalSnapshot(SESSION)
-    .items.flatMap((item) => (item.body.kind === 'status' ? [item.body.text] : []))
+const STARTUP_FAILURE = {
+  kind: 'providerStartFailed',
+  detail: { text: EXIT_REASON, audience: 'log' }
 }
 
-function submission(clientMessageId: string) {
-  return host
-    .journalSnapshot(SESSION)
-    .submissions.find((entry) => entry.clientMessageId === clientMessageId)
+async function journalStatuses(): Promise<string[]> {
+  return (await host.journalSnapshot(SESSION)).items.flatMap((item) =>
+    item.body.kind === 'status' ? [item.body.text] : []
+  )
+}
+
+async function submission(clientMessageId: string) {
+  return (await host.journalSnapshot(SESSION)).submissions.find(
+    (entry) => entry.clientMessageId === clientMessageId
+  )
 }
 
 beforeEach(async () => {
@@ -166,8 +182,7 @@ describe('a send into a published session whose child ended before startup', ()
 
     await send('hello again', releasedFence)
 
-    // The client was current as of the lost owner, so the send is rebased onto the fence the
-    // resume published and admitted once, with no stale round trip.
+    // Accepted at the lost owner's fence and handed to the child delivery started, once.
     expect(acquire).toHaveBeenCalledTimes(2)
     expect(store.getRecord(SESSION)?.lease.claimStatus).toBe('live')
     expect(dispatch).toHaveBeenCalledOnce()
@@ -183,40 +198,50 @@ describe('a send into a published session whose child ended before startup', ()
 
   it('retires the held message with the cause when the restarted child exits before proving its start', async () => {
     const releasedFence = store.getRecord(SESSION)?.lease.runtimeFence ?? 0
-    const rowsBefore = journalStatuses().length
+    const rowsBefore = (await journalStatuses()).length
 
     const held = await send('still not signed in', releasedFence)
     await exitBeforeProof()
 
     // The child never proved its start, so it accepted nothing: the exit rejects the message this
     // host admitted, so nothing pins the session and Retry stays offered, and one row names the cause.
-    expect(submission(held)).toMatchObject({
+    expect(await submission(held)).toMatchObject({
       dispatchState: 'rejected',
-      reason: expect.stringContaining(EXIT_REASON),
+      reason: 'Codex stopped before it finished starting. Send your message to try again.',
+      rejection: STARTUP_FAILURE,
       recovered: true
     })
     expect(
-      host.journalSnapshot(SESSION).submissions.filter((e) => e.dispatchState === 'pending')
+      (await host.journalSnapshot(SESSION)).submissions.filter((e) => e.dispatchState === 'pending')
     ).toEqual([])
-    expect(journalStatuses().slice(rowsBefore)).toEqual([
-      expect.stringMatching(/stopped before it finished starting: .*not signed in/)
+    expect((await journalStatuses()).slice(rowsBefore)).toEqual([
+      'Codex stopped before it finished starting. Send your message to try again.'
     ])
+    // Accepted before the restart it needed, so the chat draws it above the row naming the cause.
+    const snapshot = await host.journalSnapshot(SESSION)
+    const causeRow = snapshot.items.findLast((item) => item.body.kind === 'status')?.itemId
+    const shown = [agentJournalSubmissionKey(held), causeRow]
+    expect(
+      hostTestDrawnRowIds(snapshot, [
+        { clientMessageId: held, text: 'still not signed in' }
+      ]).filter((id) => shown.includes(id))
+    ).toEqual(shown)
     // The failed restart moved the fence twice: the acquisition, and the exit that released it.
     expect(store.getRecord(SESSION)?.lease.runtimeFence).toBe(releasedFence + 2)
     expect(store.getRecord(SESSION)?.lease.claimStatus).toBe('released')
     // One spawn per user action: nothing restarted it a second time.
     expect(acquire).toHaveBeenCalledTimes(2)
 
-    // Retry is a fresh action: it restarts once and is admitted against the new child.
+    // Retry is a fresh action: it restarts once and is handed to the new child.
     await send('signed in now')
     expect(acquire).toHaveBeenCalledTimes(3)
     expect(dispatch).toHaveBeenCalledTimes(2)
-    expect(journalStatuses().slice(rowsBefore)).toHaveLength(1)
+    expect((await journalStatuses()).slice(rowsBefore)).toHaveLength(1)
   })
 })
 
 describe('a send while the child of the first start is still proving itself', () => {
-  it('is admitted against the starting child, and nothing restarts it', async () => {
+  it('is handed to the starting child, and nothing restarts it', async () => {
     await send('hello')
 
     expect(dispatch).toHaveBeenCalledOnce()
@@ -225,7 +250,7 @@ describe('a send while the child of the first start is still proving itself', ()
     await proveStarted()
 
     expect(acquire).toHaveBeenCalledOnce()
-    expect(journalStatuses()).toEqual([])
+    expect(await journalStatuses()).toEqual([])
   })
 
   it('is retired with the cause when that child exits first, and restarts nothing', async () => {
@@ -234,14 +259,15 @@ describe('a send while the child of the first start is still proving itself', ()
 
     await exitBeforeProof()
 
-    expect(submission(held)).toMatchObject({
+    expect(await submission(held)).toMatchObject({
       dispatchState: 'rejected',
-      reason: expect.stringContaining(EXIT_REASON),
+      reason: 'Codex stopped before it finished starting. Send your message to try again.',
+      rejection: STARTUP_FAILURE,
       recovered: true
     })
     expect(acquire).toHaveBeenCalledOnce()
-    expect(journalStatuses()).toEqual([
-      expect.stringMatching(/stopped before it finished starting: .*not signed in/)
+    expect(await journalStatuses()).toEqual([
+      'Codex stopped before it finished starting. Send your message to try again.'
     ])
     expect(store.getRecord(SESSION)?.lease.runtimeFence).toBe(fence + 1)
   })
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-send-settlement.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-send-settlement.test.ts
index b461d508f42a..ff9765d1cee7 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-send-settlement.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-send-settlement.test.ts
@@ -61,7 +61,7 @@ describe('structured send settlement compatibility wait', () => {
   it('removes an abandoned wait on transport cancellation', async () => {
     const settlements = new StructuredAgentSessionSendSettlement(() => journal('pending'))
     const controller = new AbortController()
-    const pending = settlements.wait('session-1', 'client-1', controller.signal)
+    const pending = settlements.wait('session-1', 'client-1', { signal: controller.signal })
 
     controller.abort(new Error('transport closed'))
     await expect(pending).rejects.toThrow('transport closed')
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-send-settlement.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-send-settlement.ts
index 6150e3412a69..bc265833c429 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-send-settlement.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-send-settlement.ts
@@ -3,8 +3,12 @@ import type {
   AgentJournalSubmission
 } from '../../../shared/agent-session-journal-types'
 import type { AgentSessionSendResult } from '../../../shared/agent-session-wire'
+import { isQueuedAgentJournalSubmission } from '../../../shared/agent-session-queued-submission'
 import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
 
+/** What a settlement read needs of a journal. */
+type SendSettlementJournal = Pick<AgentSessionJournal, 'submissions' | 'cursor'>
+
 type SettledSend = {
   cursor: AgentJournalCursor
   value: AgentSessionSendResult
@@ -12,8 +16,19 @@ type SettledSend = {
 
 type SendSettlement = SettledSend | 'pending' | 'missing'
 
+/** What ends a wait: the provider's answer, or only the host handing the message over. */
+export type SendSettlementPoint = 'answered' | 'handed-over'
+
+export type SendSettlementWaitOptions = {
+  signal?: AbortSignal
+  /** How long to observe; unanswered by then resolves undefined. */
+  budgetMs?: number
+  until?: SendSettlementPoint
+}
+
 type SendSettlementWaiter = {
   clientMessageId: string
+  until: SendSettlementPoint
   resolve: (result: SettledSend | undefined) => void
   reject: (error: Error) => void
   timer: ReturnType<typeof setTimeout>
@@ -23,12 +38,15 @@ type SendSettlementWaiter = {
 
 // Known legacy clients abandon the RPC after 15s without cancelling its socket dispatch.
 const SEND_SETTLEMENT_WAIT_TIMEOUT_MS = 30_000
+/** Long enough for a cold provider start; a longer one replays through the same wait. */
+export const STRUCTURED_AGENT_SESSION_START_WAIT_MS = 120_000
 const MAX_SEND_SETTLEMENT_WAITERS_PER_SESSION = 64
 const MAX_SEND_SETTLEMENT_WAITERS = 1_024
 
 function settledSend(
-  journal: AgentSessionJournal,
+  journal: SendSettlementJournal,
   clientMessageId: string,
+  until: SendSettlementPoint,
   submission: AgentJournalSubmission | undefined = journal
     .submissions()
     .find((candidate) => candidate.clientMessageId === clientMessageId)
@@ -36,9 +54,11 @@ function settledSend(
   if (!submission) {
     return 'missing'
   }
-  return submission.dispatchState === 'pending'
-    ? 'pending'
-    : { cursor: journal.cursor(), value: { clientMessageId, submission } }
+  const waiting =
+    until === 'handed-over'
+      ? isQueuedAgentJournalSubmission(submission)
+      : submission.dispatchState === 'pending'
+  return waiting ? 'pending' : { cursor: journal.cursor(), value: { clientMessageId, submission } }
 }
 
 function abortError(signal: AbortSignal): Error {
@@ -52,17 +72,19 @@ export class StructuredAgentSessionSendSettlement {
   private readonly waiters = new Map<string, Set<SendSettlementWaiter>>()
   private waiterCount = 0
 
-  constructor(private readonly journalFor: (sessionId: string) => AgentSessionJournal) {}
+  constructor(private readonly journalFor: (sessionId: string) => SendSettlementJournal) {}
 
   wait = (
     sessionId: string,
     clientMessageId: string,
-    signal?: AbortSignal
+    options: SendSettlementWaitOptions = {}
   ): Promise<SettledSend | undefined> => {
+    const { signal } = options
+    const until = options.until ?? 'answered'
     if (signal?.aborted) {
       return Promise.reject(abortError(signal))
     }
-    const immediate = settledSend(this.journalFor(sessionId), clientMessageId)
+    const immediate = settledSend(this.journalFor(sessionId), clientMessageId, until)
     if (immediate === 'missing') {
       return Promise.reject(new Error('agent session send disappeared before settlement'))
     }
@@ -79,12 +101,13 @@ export class StructuredAgentSessionSendSettlement {
     return new Promise((resolve, reject) => {
       const waiter: SendSettlementWaiter = {
         clientMessageId,
+        until,
         resolve,
         reject,
         timer: setTimeout(() => {
           this.remove(sessionId, waiter)
           resolve(undefined)
-        }, SEND_SETTLEMENT_WAIT_TIMEOUT_MS)
+        }, options.budgetMs ?? SEND_SETTLEMENT_WAIT_TIMEOUT_MS)
       }
       waiter.timer.unref?.()
       const session = existingSession ?? new Set<SendSettlementWaiter>()
@@ -106,7 +129,7 @@ export class StructuredAgentSessionSendSettlement {
     })
   }
 
-  publish(sessionId: string, journal: AgentSessionJournal): void {
+  publish(sessionId: string, journal: SendSettlementJournal): void {
     const waiters = this.waiters.get(sessionId)
     if (!waiters) {
       return
@@ -118,6 +141,7 @@ export class StructuredAgentSessionSendSettlement {
       const result = settledSend(
         journal,
         waiter.clientMessageId,
+        waiter.until,
         submissions.get(waiter.clientMessageId)
       )
       if (result !== 'pending') {
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-send.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-send.test.ts
index f2d1ab122300..d2b9d27c1a04 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-send.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-send.test.ts
@@ -23,6 +23,8 @@ import {
   HOST_TEST_THREAD as THREAD,
   hostTestMessage
 } from './structured-agent-session-host-test-data'
+import { agentSessionFailureFact } from '../../../shared/agent-session-failure'
+import { agentSessionFailureWords } from '../../../shared/agent-session-failure-words'
 
 let store: AgentSessionRecordStore
 let host: StructuredAgentSessionHost
@@ -32,6 +34,28 @@ beforeEach(() => {
   ;({ store, host, dispatch } = hostTestState())
 })
 
+function hostJournal(): AgentSessionJournal {
+  return (
+    host as unknown as { sessions: Map<string, { journal: AgentSessionJournal }> }
+  ).sessions.get(SESSION)!.journal
+}
+
+/** A send is accepted, then the session's delivery loop hands it over: wait for the handover's
+ *  outcome, or with `handedOver`, only for the handover itself (an admitted send stays pending). */
+async function delivered(clientMessageId: string, options: { handedOver?: true } = {}) {
+  let submission: ReturnType<AgentSessionJournal['submissions']>[number] | undefined
+  await vi.waitFor(() => {
+    submission = hostJournal()
+      .submissions()
+      .find((entry) => entry.clientMessageId === clientMessageId)
+    expect(submission?.handedOverAt).toBeDefined()
+    if (!options.handedOver) {
+      expect(submission?.dispatchState).not.toBe('pending')
+    }
+  })
+  return submission!
+}
+
 describe('send', () => {
   it('writes the submission before dispatching and resolves it accepted', async () => {
     await attach()
@@ -43,9 +67,17 @@ describe('send', () => {
     if (!result.ok) {
       throw new Error(`expected a send, got ${result.refusal.code}`)
     }
-    expect(result.value.submission.dispatchState).toBe('accepted')
+    // Answered once accepted; the delivery loop hands it over after.
+    expect(result.value.submission).toMatchObject({
+      dispatchState: 'pending',
+      handoverRecorded: true
+    })
+    expect(result.value.submission.handedOverAt).toBeUndefined()
+    await expect(delivered(result.value.clientMessageId)).resolves.toMatchObject({
+      dispatchState: 'accepted'
+    })
     expect(dispatch).toHaveBeenCalledTimes(1)
-    const page = host.history({ sessionId: SESSION, direction: 'tail' })
+    const page = await host.history({ sessionId: SESSION, direction: 'tail' })
     expect(page.ok && page.page.items).toHaveLength(1)
     expect(page.ok && page.page.fence).toBe(1)
     expect(page.page.hostNow).toBe(NOW)
@@ -75,11 +107,11 @@ describe('send', () => {
     await attach()
     dispatch.mockRejectedValueOnce(new Error('socket closed'))
     const body = hostTestMessage('add a retry')
-    const result = await host.send(CALLER, {
-      envelope: envelope('agentSession.send', { body }),
-      body
+    const params = { envelope: envelope('agentSession.send', { body }), body }
+    await host.send(CALLER, params)
+    await expect(delivered(params.envelope.clientOperationId)).resolves.toMatchObject({
+      dispatchState: 'unknown'
     })
-    expect(result).toMatchObject({ ok: true, value: { submission: { dispatchState: 'unknown' } } })
   })
 
   it('replays a retried send from the journal without dispatching twice', async () => {
@@ -87,6 +119,7 @@ describe('send', () => {
     const body = hostTestMessage('add a retry')
     const params = { envelope: envelope('agentSession.send', { body }), body }
     await host.send(CALLER, params)
+    await delivered(params.envelope.clientOperationId)
     const retry = await host.send(CALLER, params)
     expect(retry).toMatchObject({ ok: true, replayed: true })
     expect(dispatch).toHaveBeenCalledTimes(1)
@@ -98,10 +131,9 @@ describe('send', () => {
     const body = hostTestMessage('possibly delivered')
     const params = { envelope: envelope('agentSession.send', { body }), body }
 
-    const first = await host.send(CALLER, params)
-    expect(first).toMatchObject({
-      ok: true,
-      value: { submission: { dispatchState: 'unknown' } }
+    await host.send(CALLER, params)
+    await expect(delivered(params.envelope.clientOperationId)).resolves.toMatchObject({
+      dispatchState: 'unknown'
     })
     // A thrown adapter call is indistinguishable from a lost reply, so Retry
     // replays the recorded outcome.
@@ -110,7 +142,7 @@ describe('send', () => {
       value: { submission: { dispatchState: 'unknown' } }
     })
     expect(dispatch).toHaveBeenCalledTimes(1)
-    const state = host.history({ sessionId: SESSION, direction: 'tail' })
+    const state = await host.history({ sessionId: SESSION, direction: 'tail' })
     expect(state.ok && state.page.submissions).toHaveLength(1)
   })
 
@@ -129,6 +161,7 @@ describe('send', () => {
     const params = { envelope: envelope('agentSession.send', { body }), body }
 
     await host.send(CALLER, params)
+    await delivered(params.envelope.clientOperationId)
     await expect(host.send(CALLER, { ...params, retryUnknown: true })).resolves.toMatchObject({
       ok: true,
       value: {
@@ -136,7 +169,7 @@ describe('send', () => {
       }
     })
     expect(dispatch).toHaveBeenCalledTimes(1)
-    const state = host.history({ sessionId: SESSION, direction: 'tail' })
+    const state = await host.history({ sessionId: SESSION, direction: 'tail' })
     expect(state.ok && state.page.submissions).toHaveLength(1)
   })
 
@@ -145,30 +178,29 @@ describe('send', () => {
     dispatch
       .mockImplementationOnce(async () => ({
         state: 'rejected' as const,
-        reason: 'provider_write_failed: broken pipe'
+        ...agentSessionFailureWords(agentSessionFailureFact('writeFailed'), {
+          surface: 'rejection'
+        })
       }))
       .mockImplementationOnce(async () => accepted())
     const body = hostTestMessage('never written')
     const params = { envelope: envelope('agentSession.send', { body }), body }
 
-    await expect(host.send(CALLER, params)).resolves.toMatchObject({
-      ok: true,
-      value: {
-        submission: { dispatchState: 'rejected', reason: 'provider_write_failed: broken pipe' }
-      }
+    await host.send(CALLER, params)
+    await expect(delivered(params.envelope.clientOperationId)).resolves.toMatchObject({
+      dispatchState: 'rejected',
+      reason: 'provider_write_failed'
     })
     // What the user's Retry does with a rejection: a fresh client message id,
     // which is a first delivery by construction and cannot duplicate the frame
     // that never left the process.
-    await expect(
-      host.send(CALLER, { envelope: envelope('agentSession.send', { body }), body })
-    ).resolves.toMatchObject({
-      ok: true,
-      replayed: false,
-      value: { submission: { dispatchState: 'accepted' } }
+    const rotated = { envelope: envelope('agentSession.send', { body }), body }
+    await expect(host.send(CALLER, rotated)).resolves.toMatchObject({ ok: true, replayed: false })
+    await expect(delivered(rotated.envelope.clientOperationId)).resolves.toMatchObject({
+      dispatchState: 'accepted'
     })
     expect(dispatch).toHaveBeenCalledTimes(2)
-    const state = host.history({ sessionId: SESSION, direction: 'tail' })
+    const state = await host.history({ sessionId: SESSION, direction: 'tail' })
     expect(state.ok && state.page.submissions).toHaveLength(2)
   })
 
@@ -183,10 +215,9 @@ describe('send', () => {
     const body = hostTestMessage('a message the provider may already hold')
     const params = { envelope: envelope('agentSession.send', { body }), body }
 
-    const first = await host.send(CALLER, params)
-    expect(first).toMatchObject({
-      ok: true,
-      value: { submission: { dispatchState: 'unknown' } }
+    await host.send(CALLER, params)
+    await expect(delivered(params.envelope.clientOperationId)).resolves.toMatchObject({
+      dispatchState: 'unknown'
     })
     // No `unknown` is re-delivered under its own id, whatever its reason says,
     // so Retry replays the recorded outcome instead of writing again.
@@ -203,6 +234,7 @@ describe('send', () => {
     const body = hostTestMessage('settled for good')
     const params = { envelope: envelope('agentSession.send', { body }), body }
     await host.send(CALLER, params)
+    await delivered(params.envelope.clientOperationId)
     const journal = (
       host as unknown as { sessions: Map<string, { journal: AgentSessionJournal }> }
     ).sessions.get(SESSION)!.journal
@@ -223,7 +255,7 @@ describe('send', () => {
     expect(journal.receiptFor(params.envelope.clientOperationId)).not.toBeNull()
   })
 
-  it('leaves an admitted send pending and writes no dispatch row', async () => {
+  it('leaves an admitted send pending once handed over', async () => {
     await attach()
     dispatch.mockImplementationOnce(async () => ({ state: 'admitted' as const }))
     const body = hostTestMessage('queued behind a running turn')
@@ -233,9 +265,9 @@ describe('send', () => {
       ok: true,
       value: { submission: { dispatchState: 'pending', reason: null, resolvedAt: null } }
     })
-    const journal = (
-      host as unknown as { sessions: Map<string, { journal: AgentSessionJournal }> }
-    ).sessions.get(SESSION)!.journal
+    await delivered(params.envelope.clientOperationId, { handedOver: true })
+    await vi.waitFor(() => expect(dispatch).toHaveBeenCalledTimes(1))
+    const journal = hostJournal()
     expect(journal.pendingSubmissions()).toHaveLength(1)
   })
 
@@ -245,6 +277,8 @@ describe('send', () => {
     const body = hostTestMessage('written, never acknowledged')
     const params = { envelope: envelope('agentSession.send', { body }), body }
     await host.send(CALLER, params)
+    await delivered(params.envelope.clientOperationId, { handedOver: true })
+    await vi.waitFor(() => expect(dispatch).toHaveBeenCalledTimes(1))
     const journal = (
       host as unknown as { sessions: Map<string, { journal: AgentSessionJournal }> }
     ).sessions.get(SESSION)!.journal
@@ -281,6 +315,8 @@ describe('send', () => {
     const params = { envelope: envelope('agentSession.send', { body }), body }
 
     await expect(host.send(CALLER, params)).rejects.toThrow('operation settlement failed')
+    // The submission was recorded before the ledger write failed, so it is still delivered.
+    await delivered(params.envelope.clientOperationId)
     await expect(host.send(CALLER, params)).resolves.toMatchObject({
       ok: true,
       replayed: true,
@@ -333,9 +369,8 @@ describe('send', () => {
 
     await expect(host.send(CALLER, params)).rejects.toThrow('operation settlement failed')
     settlement.mockRestore()
-    const journal = (
-      host as unknown as { sessions: Map<string, { journal: AgentSessionJournal }> }
-    ).sessions.get(SESSION)!.journal
+    await delivered(params.envelope.clientOperationId)
+    const journal = hostJournal()
     await journal.rollEpoch('schema_unreadable', store.getRecord(SESSION)?.lease.runtimeFence ?? 1)
     expect(journal.submissions()).toHaveLength(0)
 
@@ -362,6 +397,7 @@ describe('send', () => {
     const params = { envelope: envelope('agentSession.send', { body }), body }
 
     await host.send(CALLER, params)
+    await delivered(params.envelope.clientOperationId)
     expect(dispatch).toHaveBeenCalledTimes(1)
     await store.recordOperationOutcome({
       callerKey: CALLER.callerKey,
@@ -393,6 +429,8 @@ describe('send', () => {
     const body = hostTestMessage('written, then the child died')
     const params = { envelope: envelope('agentSession.send', { body }), body }
     await host.send(CALLER, params)
+    await delivered(params.envelope.clientOperationId, { handedOver: true })
+    await vi.waitFor(() => expect(dispatch).toHaveBeenCalledTimes(1))
     const journal = (
       host as unknown as { sessions: Map<string, { journal: AgentSessionJournal }> }
     ).sessions.get(SESSION)!.journal
@@ -411,21 +449,25 @@ describe('send', () => {
 
   it('advances an explicit retry after a ledger-unknown send is reconciled in the journal', async () => {
     await attach()
-    const journal = (
-      host as unknown as { sessions: Map<string, { journal: AgentSessionJournal }> }
-    ).sessions.get(SESSION)!.journal
-    vi.spyOn(journal, 'resolveDispatch').mockRejectedValueOnce(new Error('journal resolve failed'))
+    const journal = hostJournal()
+    const resolve = journal.resolveDispatch.bind(journal)
+    // The handover row lands; the provider's answer, written after the adapter took the
+    // message, does not.
+    vi.spyOn(journal, 'resolveDispatch')
+      .mockImplementationOnce(resolve)
+      .mockRejectedValueOnce(new Error('journal resolve failed'))
     const body = hostTestMessage('possibly delivered before persistence failed')
     const params = { envelope: envelope('agentSession.send', { body }), body }
 
-    await expect(host.send(CALLER, params)).rejects.toThrow('journal resolve failed')
-    expect(journal.submissions()).toMatchObject([
-      { clientMessageId: params.envelope.clientOperationId, dispatchState: 'unknown' }
-    ])
+    await expect(host.send(CALLER, params)).resolves.toMatchObject({ ok: true })
+    await expect(delivered(params.envelope.clientOperationId)).resolves.toMatchObject({
+      dispatchState: 'unknown'
+    })
+    // Acceptance is what the ledger answers for; delivery is the journal's to say.
     expect(
       store.listOperationRows().find((row) => row.operationId === params.envelope.clientOperationId)
         ?.outcome
-    ).toEqual({ status: 'unknown' })
+    ).toMatchObject({ status: 'succeeded' })
     expect(dispatch).toHaveBeenCalledTimes(1)
 
     await journal.markPendingSubmissionsUnknown(store.getRecord(SESSION)?.lease.runtimeFence ?? 1)
@@ -446,24 +488,7 @@ describe('send', () => {
     expect(journal.submissions()).toHaveLength(1)
   })
 
-  it('refuses a stale fence and hands back the current one', async () => {
-    const record = await attach()
-    const body = hostTestMessage('add a retry')
-    const result = await host.send(CALLER, {
-      envelope: envelope(
-        'agentSession.send',
-        { body },
-        { expectedRuntimeFence: (record?.lease.runtimeFence ?? 1) + 5 }
-      ),
-      body
-    })
-    expect(result).toMatchObject({
-      ok: false,
-      refusal: { code: 'agent_session_checkpoint_stale', currentFence: record?.lease.runtimeFence }
-    })
-  })
-
-  it('reuses a pending send admission after the client refreshes its fence', async () => {
+  it('admits a send fenced to another generation, delivers it once, and replays it by id', async () => {
     const record = await attach()
     const body = hostTestMessage('add a retry')
     const params = {
@@ -474,27 +499,14 @@ describe('send', () => {
       ),
       body
     }
-    expect(await host.send(CALLER, params)).toMatchObject({
-      ok: false,
-      refusal: { code: 'agent_session_checkpoint_stale' }
+    expect(await host.send(CALLER, params)).toMatchObject({ ok: true, replayed: false })
+    await expect(delivered(params.envelope.clientOperationId)).resolves.toMatchObject({
+      dispatchState: 'accepted'
     })
-    expect(
-      store
-        .listOperationRows()
-        .filter((row) => row.operationId === params.envelope.clientOperationId)
-    ).toEqual([])
     const retry = {
       ...params,
-      envelope: {
-        ...params.envelope,
-        expectedRuntimeFence: record?.lease.runtimeFence ?? 1
-      }
+      envelope: { ...params.envelope, expectedRuntimeFence: record?.lease.runtimeFence ?? 1 }
     }
-    expect(await host.send(CALLER, retry)).toMatchObject({
-      ok: true,
-      replayed: false,
-      value: { submission: { dispatchState: 'accepted' } }
-    })
     expect(await host.send(CALLER, retry)).toMatchObject({ ok: true, replayed: true })
     expect(dispatch).toHaveBeenCalledTimes(1)
   })
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-settled-attach-retry.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-settled-attach-retry.test.ts
index 5780359a8aec..7602afa230be 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-settled-attach-retry.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-settled-attach-retry.test.ts
@@ -125,6 +125,11 @@ afterEach(async () => {
   await rm(root, { recursive: true, force: true })
 })
 
+/** The host starting the agent with no message to deliver, as an operation that needs it does. */
+function startAgent(): Promise<unknown> {
+  return host['serialize'](SESSION, () => host['mutationContext']().ensureAgent(SESSION))
+}
+
 describe('settled attach retry', () => {
   it('settles a post-acquisition journal failure and retries without a restart', async () => {
     const historyFilePath = vi
@@ -207,7 +212,7 @@ describe('settled attach retry', () => {
     expect(spawnTokens).toEqual(['spawn-safe', 'spawn-safe'])
   })
 
-  it('fences a crash-interrupted reservation replay until positive recovery', async () => {
+  it('releases a reservation a crash left ownerless at restart, so the next start goes ahead', async () => {
     const spawnTokens: string[] = []
     acquire.mockImplementation(async ({ fence, spawnToken }) => {
       spawnTokens.push(spawnToken)
@@ -232,17 +237,17 @@ describe('settled attach retry', () => {
     })
     let token = 0
     const mintSpawnToken = vi.fn(() => `spawn-${++token}`)
-    let reservationUnused = false
     host = new StructuredAgentSessionHost({
       store,
       adapter: adapter(),
       journalRoot: root,
       claimKeyId: 'key-1',
       mintSpawnToken,
-      probeOwner: async () =>
-        reservationUnused
-          ? { outcome: 'reservation-unused' }
-          : { outcome: 'indeterminate', reason: 'spawn token scan unavailable' },
+      // A host that cannot read another process's environment, so no scan can prove anything.
+      probeOwner: async () => ({
+        outcome: 'indeterminate',
+        reason: 'spawn token scan unavailable'
+      }),
       now: () => NOW
     })
     const params = hostTestAttachParams(null)
@@ -268,36 +273,28 @@ describe('settled attach retry', () => {
       journalRoot: root,
       claimKeyId: 'key-1',
       mintSpawnToken,
-      probeOwner: async () =>
-        reservationUnused
-          ? { outcome: 'reservation-unused' }
-          : { outcome: 'indeterminate', reason: 'spawn token scan unavailable' },
+      // A host that cannot read another process's environment, so no scan can prove anything.
+      probeOwner: async () => ({
+        outcome: 'indeterminate',
+        reason: 'spawn token scan unavailable'
+      }),
       now: () => NOW
     })
 
-    const refused = await host.attach(CALLER, params)
-    if (refused.ok) {
-      throw new Error('expected the replayed reservation to stay fenced')
-    }
-    expect(refused.refusal.code).toBe('agent_session_ownership_unknown')
-    expect(acquire).toHaveBeenCalledTimes(1)
+    await host.restoreReadableSessions()
     expect(releaseAcquisition).toHaveBeenCalledTimes(1)
-    expect(mintSpawnToken).toHaveBeenCalledTimes(1)
-    expect(spawnTokens).toEqual(['spawn-1'])
+    // No owner was recorded: released at restart, with no evidence, since nothing proved one.
     expect(store.getRecord(SESSION)?.lease).toMatchObject({
-      claimStatus: 'reserved',
-      handoffStage: 'manual-recovery',
-      runtimeFence: 1,
-      reservedSpawnToken: 'spawn-1',
-      ownerProcess: null
+      claimStatus: 'released',
+      handoffStage: null,
+      runtimeFence: 2,
+      reservedSpawnToken: null,
+      ownerProcess: null,
+      deathEvidence: null
     })
-    expect(
-      store.listOperationRows().find((row) => row.operationId === params.envelope.clientOperationId)
-        ?.outcome
-    ).toEqual({ status: 'pending' })
 
-    reservationUnused = true
-    await host.hold(SESSION, 'desktop-chat:retry')
+    // The interrupted operation's own retry continues it as a fresh reservation.
+    await expect(host.attach(CALLER, params)).resolves.toMatchObject({ ok: true })
     expect(mintSpawnToken).toHaveBeenCalledTimes(2)
     expect(spawnTokens).toEqual(['spawn-1', 'spawn-2'])
     expect(store.getRecord(SESSION)?.lease).toMatchObject({
@@ -322,6 +319,8 @@ describe('settled attach retry', () => {
     }
     const first = await host.send(CALLER, unknownParams)
     expect(first).toMatchObject({ ok: true, value: { submission: { dispatchState: 'pending' } } })
+    // Handed over before the host dies: that is what makes the restart's answer doubt.
+    await vi.waitFor(() => expect(dispatch).toHaveBeenCalledTimes(1))
 
     await host.flushAllStreamedEvents()
     store = await AgentSessionRecordStore.open({ directory: join(root, 'store'), hostId: 'local' })
@@ -335,7 +334,7 @@ describe('settled attach retry', () => {
       now: () => NOW
     })
     await host.restoreReadableSessions()
-    await host.hold(SESSION, 'desktop-chat:restart')
+    await startAgent()
     expect(store.getRecord(SESSION)?.lease).toMatchObject({
       claimStatus: 'live',
       handoffStage: null,
@@ -351,8 +350,8 @@ describe('settled attach retry', () => {
     if (!sent.ok) {
       throw new Error(`unexpected restored send refusal: ${sent.refusal.message}`)
     }
-    expect(dispatch).toHaveBeenCalledTimes(2)
-    const restoredHistory = host.history({ sessionId: SESSION, direction: 'tail' })
+    await vi.waitFor(() => expect(dispatch).toHaveBeenCalledTimes(2))
+    const restoredHistory = await host.history({ sessionId: SESSION, direction: 'tail' })
     if (!restoredHistory.ok) {
       throw new Error(`unexpected restored history reset: ${restoredHistory.reset}`)
     }
@@ -384,7 +383,10 @@ describe('settled attach retry', () => {
 
     await expect(host.attach(CALLER, hostTestAttachParams(null))).resolves.toMatchObject({
       ok: false,
-      refusal: { message: 'resume rejected', ownerVerdict: 'exited' }
+      refusal: {
+        message: "Codex couldn't restart. Send your message to try again.",
+        ownerVerdict: 'exited'
+      }
     })
 
     expect(releaseAcquisition).toHaveBeenCalledTimes(1)
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-settlement-retry.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-settlement-retry.test.ts
deleted file mode 100644
index c0d29f6b9efe..000000000000
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-settlement-retry.test.ts
+++ /dev/null
@@ -1,190 +0,0 @@
-// The settlement latch governs EVERY unclean restart — SIGKILL, force quit, OOM, a quit that blew
-// its deadline — so the evidence it reads decides whether the user sees a failure notice at all.
-
-import { mkdtemp, rm } from 'node:fs/promises'
-import { tmpdir } from 'node:os'
-import { join } from 'node:path'
-import { afterEach, beforeEach, describe, expect, it } from 'vitest'
-import type {
-  AgentSessionDeathEvidence,
-  AgentSessionRecord
-} from '../../../shared/agent-session-record'
-import { agentSessionRecordFixture } from '../../../shared/agent-session-record.test-fixture'
-import { openAgentSessionJournal } from '../agent-session-journal/journal-store-factory'
-import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
-import type { StructuredAgentSessionLeaseStore } from './structured-agent-session-lease-release'
-import { retryLoadedStructuredAgentSessionSettlement } from './structured-agent-session-settlement-retry'
-
-const SESSION = 'session-alpha-1'
-const THREAD = 'thread-1'
-const FENCE = 8
-
-let root: string
-let journal: AgentSessionJournal
-let record: AgentSessionRecord
-
-function store(): StructuredAgentSessionLeaseStore {
-  return {
-    getRecord: () => record,
-    transitionHandoff: async (_sessionId, transition) => {
-      record = transition(record)
-      return record
-    }
-  }
-}
-
-function retry(settlementId: string, deathEvidence: AgentSessionDeathEvidence) {
-  record = agentSessionRecordFixture({
-    ...agentSessionRecordFixture().lease,
-    runtimeKind: 'native',
-    runtimeFence: FENCE,
-    deathEvidence,
-    settlementRetryRequired: true,
-    settlementRetryId: settlementId
-  })
-  return retryLoadedStructuredAgentSessionSettlement({
-    deps: { store: store() },
-    sessionId: SESSION,
-    session: { journal, fence: FENCE, acquisitionGeneration: null },
-    now: () => 2_000
-  })
-}
-
-function statusTexts(): string[] {
-  return journal
-    .snapshot()
-    .items.flatMap((item) => (item.body.kind === 'status' ? [item.body.text] : []))
-}
-
-beforeEach(async () => {
-  root = await mkdtemp(join(tmpdir(), 'orca-settlement-retry-'))
-  journal = await openAgentSessionJournal({
-    identity: {
-      sessionId: SESSION,
-      workspaceId: 'workspace-1',
-      hostId: 'local',
-      agent: 'codex',
-      providerHandle: { kind: 'codex', threadId: THREAD }
-    },
-    journalDir: root,
-    now: () => 1_000
-  })
-})
-
-/** A turn the dead generation left running: work to settle either way. */
-async function seedRunningTurn(): Promise<void> {
-  await journal.appendItem(
-    { provider: 'codex', threadId: THREAD, turnId: 'turn-1', ordinal: 1 },
-    { kind: 'turn', turnId: 'turn-1', state: 'running', startedAt: 900 },
-    { fence: FENCE }
-  )
-}
-
-/** The provider died while the user, not the provider, held the conversation. */
-async function seedIdlePendingApproval(): Promise<void> {
-  await journal.appendItem(
-    { provider: 'codex', threadId: THREAD, turnId: 'turn-1', ordinal: 1 },
-    {
-      kind: 'approval',
-      title: 'Run command?',
-      detail: null,
-      options: [{ id: 'yes', label: 'Allow' }],
-      resolution: { state: 'pending', selectedOptionId: null, resolvedBy: null, resolvedAt: null }
-    },
-    { fence: FENCE }
-  )
-}
-
-afterEach(async () => {
-  await journal.close()
-  await rm(root, { recursive: true, force: true })
-})
-
-describe('pending settlement retry', () => {
-  it('writes no status row when the death was only adjudicated, not witnessed', async () => {
-    await seedRunningTurn()
-
-    await expect(
-      retry(`restart-eviction:${SESSION}:${FENCE}`, {
-        kind: 'pid-absent',
-        detail: 'recorded pid absent on host',
-        observedAt: 1_500
-      })
-    ).resolves.toBe(true)
-
-    expect(statusTexts()).toEqual([])
-    expect(journal.snapshot().items.map((item) => item.body)).toContainEqual(
-      expect.objectContaining({ kind: 'turn', state: 'unverifiable' })
-    )
-    expect(record.lease.settlementRetryRequired).toBeUndefined()
-  })
-
-  it('writes no status row for an identity mismatch either', async () => {
-    await seedRunningTurn()
-
-    await expect(
-      retry(`restart-eviction:${SESSION}:${FENCE}`, {
-        kind: 'identity-mismatch',
-        detail: 'mismatched spawn-token',
-        observedAt: 1_500
-      })
-    ).resolves.toBe(true)
-
-    expect(statusTexts()).toEqual([])
-  })
-
-  it('reads the evidence, not the settlement id, when deciding to speak', async () => {
-    // Pins the discriminator: the id shape that normally accompanies a witnessed exit must not
-    // earn the notice on its own.
-    await seedRunningTurn()
-
-    await expect(
-      retry(`provider-exit:${SESSION}:${FENCE}:generation-1`, {
-        kind: 'pid-absent',
-        detail: 'recorded pid absent on host',
-        observedAt: 1_500
-      })
-    ).resolves.toBe(true)
-
-    expect(statusTexts()).toEqual([])
-  })
-
-  it('writes user-facing copy carrying the cause when the exit was observed', async () => {
-    await seedRunningTurn()
-
-    await expect(
-      retry(`provider-exit:${SESSION}:${FENCE}:generation-1`, {
-        kind: 'exit-observed',
-        detail: 'transport closed',
-        observedAt: 1_500
-      })
-    ).resolves.toBe(true)
-
-    expect(statusTexts()).toEqual([
-      'The provider stopped while this response was in progress: transport closed. You can continue in this conversation.'
-    ])
-    expect(journal.snapshot().items.map((item) => item.body)).toContainEqual(
-      expect.objectContaining({ kind: 'turn', state: 'interrupted', completedAt: 1_500 })
-    )
-  })
-
-  it('stays silent about a witnessed exit that interrupted nothing but a waiting prompt', async () => {
-    await seedIdlePendingApproval()
-
-    await expect(
-      retry(`provider-exit:${SESSION}:${FENCE}:generation-1`, {
-        kind: 'exit-observed',
-        detail: 'transport closed',
-        observedAt: 1_500
-      })
-    ).resolves.toBe(true)
-
-    expect(statusTexts()).toEqual([])
-    expect(journal.snapshot().items.map((item) => item.body)).toContainEqual(
-      expect.objectContaining({
-        kind: 'approval',
-        resolution: expect.objectContaining({ state: 'cancelled' })
-      })
-    )
-  })
-})
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-settlement-retry.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-settlement-retry.ts
deleted file mode 100644
index 1000881220e9..000000000000
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-settlement-retry.ts
+++ /dev/null
@@ -1,130 +0,0 @@
-import type { AgentSessionAttachParams } from './structured-agent-session-attach'
-import { attachJournal } from './structured-agent-session-attach'
-import type {
-  StructuredAgentSessionHostDeps,
-  StructuredAgentSessionHostSession
-} from './structured-agent-session-host-types'
-import type { StructuredAgentSessionLeaseStore } from './structured-agent-session-lease-release'
-import { turnVerdictFromDeathEvidence } from './structured-agent-session-stale-turn-verdict'
-import {
-  captureUnfinishedStructuredAgentSessionWork,
-  settleStructuredAgentSessionDeadGeneration,
-  unfinishedStructuredAgentSessionWorkWasInterrupted
-} from './structured-agent-session-dead-generation-settlement'
-
-export async function retryPendingStructuredAgentSessionSettlement(input: {
-  deps: StructuredAgentSessionHostDeps
-  sessions: Map<string, StructuredAgentSessionHostSession>
-  sessionId: string
-  params: AgentSessionAttachParams
-  now: () => number
-}): Promise<boolean> {
-  const record = input.deps.store.getRecord(input.sessionId)
-  if (!record?.lease.settlementRetryRequired || !record.lease.settlementRetryId) {
-    return true
-  }
-  let journal = input.sessions.get(input.sessionId)?.journal
-  if (!journal) {
-    try {
-      journal = (
-        await attachJournal({
-          record,
-          params: input.params,
-          journalRoot: input.deps.journalRoot,
-          adapter: input.deps.adapter
-        })
-      ).journal
-    } catch (error) {
-      input.deps.onEventSinkError?.({ sessionId: input.sessionId, error })
-      return false
-    }
-  }
-  const current = input.sessions.get(input.sessionId)
-  const retrySession =
-    current ??
-    ({
-      journal,
-      params: input.params,
-      fence: record.lease.runtimeFence,
-      hasProviderChild: false,
-      acquisitionGeneration: null
-    } as StructuredAgentSessionHostSession)
-  return retryLoadedStructuredAgentSessionSettlement({
-    deps: input.deps,
-    sessionId: input.sessionId,
-    session: retrySession,
-    now: input.now
-  })
-}
-
-export async function retryLoadedStructuredAgentSessionSettlement(input: {
-  deps: {
-    store: StructuredAgentSessionLeaseStore
-    onEventSinkError?: StructuredAgentSessionHostDeps['onEventSinkError']
-  }
-  sessionId: string
-  session: Pick<StructuredAgentSessionHostSession, 'journal' | 'fence' | 'acquisitionGeneration'>
-  now: () => number
-}): Promise<boolean> {
-  const record = input.deps.store.getRecord(input.sessionId)
-  if (!record?.lease.settlementRetryRequired || !record.lease.settlementRetryId) {
-    return true
-  }
-  const retrySession = input.session
-  retrySession.fence = record.lease.runtimeFence
-  const onError = (id: string, error: unknown): void =>
-    input.deps.onEventSinkError?.({ sessionId: id, error })
-  // Only an observed exit earns an end time; a probe-proven death never saw one.
-  const verdict = turnVerdictFromDeathEvidence(record.lease.deathEvidence)
-  const ok = await settleStructuredAgentSessionDeadGeneration({
-    journal: retrySession.journal,
-    sessionId: input.sessionId,
-    fence: retrySession.fence,
-    settlementId: record.lease.settlementRetryId,
-    pendingSubmissionReason: 'provider_exited_before_acknowledgement',
-    verdict,
-    // The same evidence decides the copy: only a witnessed death is worth telling the user
-    // about. An unverifiable one is a restart artefact, and the session stays sendable. The
-    // work check matches the live exit path — a provider that died waiting on a prompt
-    // interrupted no response, so it must not claim one was in progress.
-    showUnexpectedExitOutcome:
-      verdict.state === 'interrupted' &&
-      unfinishedStructuredAgentSessionWorkWasInterrupted(
-        captureUnfinishedStructuredAgentSessionWork(retrySession.journal),
-        retrySession.journal,
-        verdict.completedAt
-      ),
-    ...(record.lease.deathEvidence?.detail
-      ? { unexpectedExitReason: record.lease.deathEvidence.detail }
-      : {}),
-    onError
-  })
-  if (!ok) {
-    return false
-  }
-  try {
-    await input.deps.store.transitionHandoff(input.sessionId, (latest) => {
-      if (
-        latest.lease.runtimeFence !== record.lease.runtimeFence ||
-        !latest.lease.settlementRetryRequired
-      ) {
-        throw new Error('agent_session_checkpoint_stale')
-      }
-      return {
-        ...latest,
-        lease: {
-          ...latest.lease,
-          handoffStage: null,
-          handoffOperationId: null,
-          settlementRetryRequired: undefined,
-          settlementRetryId: undefined,
-          lastRenewedAt: input.now()
-        }
-      }
-    })
-    return true
-  } catch (error) {
-    input.deps.onEventSinkError?.({ sessionId: input.sessionId, error })
-    return false
-  }
-}
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-stale-turn-open.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-stale-turn-open.test.ts
new file mode 100644
index 000000000000..5598cd3c4f72
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-stale-turn-open.test.ts
@@ -0,0 +1,97 @@
+// A turn an exited agent left running, whose settlement write failed, is settled by the next open of
+// the conversation, not only by the next send: a reader reopening a chat the idle sweep closed, or
+// reading it before the restart restore reaches it.
+
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { readAgentJournalTurn } from '../../../shared/agent-session-turn-record'
+import { setStructuredAgentSessionHost } from './structured-agent-session-registry'
+import {
+  collectSubscriber,
+  createRestTestRig,
+  foundRestTestChat,
+  IDLE_MS,
+  REST_TEST_SESSION as SESSION,
+  REST_TEST_THREAD,
+  sweepOnce,
+  type RestTestRig
+} from './structured-agent-session-rest-test-rig'
+
+let rig: RestTestRig
+
+beforeEach(async () => {
+  rig = await createRestTestRig({ idleSweep: { intervalMs: 3_600_000 } })
+  setStructuredAgentSessionHost(rig.host)
+})
+
+afterEach(async () => {
+  setStructuredAgentSessionHost(null)
+  await rig.dispose()
+})
+
+/** A turn in flight whose agent exits, and whose exit settlement the journal refuses. */
+async function exitWithUnwrittenSettlement(): Promise<void> {
+  await foundRestTestChat(rig)
+  const open = rig.host.collaboratorsForTests().sessions.get(SESSION)!
+  const running = open.child!
+  rig.adapter.acquire.mock.calls
+    .at(-1)?.[0]
+    .events?.appendItem(
+      { provider: 'codex', threadId: REST_TEST_THREAD, turnId: 'working', ordinal: 50 },
+      { kind: 'turn', turnId: 'working', state: 'running' }
+    )
+  await rig.host.flushStreamedEvents(SESSION)
+  vi.spyOn(open.journal, 'appendLifecycleBatch').mockRejectedValueOnce(new Error('disk full'))
+  await rig.host.handleAdapterEvent({
+    type: 'ended',
+    sessionId: SESSION,
+    reason: 'killed',
+    cause: 'unexpected-exit',
+    fence: running.fence,
+    acquisitionGeneration: running.generation!
+  })
+  await vi.waitFor(() =>
+    expect(rig.store.getRecord(SESSION)?.lease).toMatchObject({
+      claimStatus: 'released',
+      deathEvidence: { kind: 'exit-observed' }
+    })
+  )
+}
+
+async function workingTurnState(): Promise<string | undefined> {
+  const items = (await rig.host.journalSnapshot(SESSION)).items
+  return items
+    .map((item) => readAgentJournalTurn(item.body))
+    .find((turn) => turn?.turnId === 'working')?.state
+}
+
+describe('a turn its gone agent left running', () => {
+  it('is settled when the idle-closed conversation is opened again, and its reader sees it', async () => {
+    await exitWithUnwrittenSettlement()
+    expect(await workingTurnState()).toBe('running')
+    rig.clock.now += IDLE_MS + 1
+    await sweepOnce(rig.host)
+    expect(rig.host.collaboratorsForTests().sessions.has(SESSION)).toBe(false)
+
+    const reader = collectSubscriber()
+    await rig.host.subscribe({ id: 'reader', sessionId: SESSION, emit: reader.emit })
+
+    expect(await workingTurnState()).toBe('interrupted')
+    // The death evidence is Orca's log text: the row says only that the provider stopped.
+    expect(JSON.stringify(reader.events)).toContain(
+      'Codex stopped while this response was in progress. You can continue in this conversation.'
+    )
+    expect(rig.adapter.acquire).toHaveBeenCalledOnce()
+  })
+
+  it('is settled by a read after a restart that reaches the chat before the restore does', async () => {
+    await exitWithUnwrittenSettlement()
+    await rig.restart()
+    setStructuredAgentSessionHost(rig.host)
+
+    // The client's read opens the chat first; the restore then finds it open and skips it.
+    expect(await workingTurnState()).toBe('interrupted')
+    await rig.host.restoreReadableSessions([SESSION])
+    expect(await workingTurnState()).toBe('interrupted')
+    expect(rig.adapter.acquire).toHaveBeenCalledOnce()
+  })
+})
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-stale-turn-verdict.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-stale-turn-verdict.test.ts
index 3264a55fff25..4ab7b3ad010c 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-stale-turn-verdict.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-stale-turn-verdict.test.ts
@@ -6,9 +6,9 @@ import { agentJournalItemKey } from '../../../shared/agent-session-journal-item-
 import type { AgentJournalRenderItem } from '../../../shared/agent-session-journal-types'
 import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
 import { createTrackedJournalOpener } from '../agent-session-journal/journal-store-test-open'
+import { settleStaleStructuredAgentSessionState } from './structured-agent-session-dead-generation-settlement'
 import {
   runningTurnLifecycleRevisions,
-  settleStaleSessionStateOnAcquire,
   turnVerdictFromDeathEvidence,
   UNVERIFIABLE_TURN_VERDICT
 } from './structured-agent-session-stale-turn-verdict'
@@ -198,11 +198,12 @@ describe('stale session state on a cold acquire', () => {
     ])
 
     await expect(
-      settleStaleSessionStateOnAcquire({
+      settleStaleStructuredAgentSessionState({
         journal,
         sessionId: 'session-1',
         fence: 14,
-        acquisitionGeneration: 'generation-2'
+        acquisitionGeneration: 'generation-2',
+        deathEvidence: null
       })
     ).resolves.toBe(1)
 
@@ -226,11 +227,12 @@ describe('stale session state on a cold acquire', () => {
     const { journal, appendLifecycleBatch } = journalWith([pending, resolved])
 
     await expect(
-      settleStaleSessionStateOnAcquire({
+      settleStaleStructuredAgentSessionState({
         journal,
         sessionId: 'session-1',
         fence: 14,
-        acquisitionGeneration: 'generation-2'
+        acquisitionGeneration: 'generation-2',
+        deathEvidence: null
       })
     ).resolves.toBe(1)
 
@@ -288,11 +290,12 @@ describe('stale session state on a cold acquire', () => {
       await journal.appendItem(prompt('thread-child'), body, { fence: 1, ...child })
       await journal.appendItem(prompt(THREAD), body, { fence: 1 })
 
-      await settleStaleSessionStateOnAcquire({
+      await settleStaleStructuredAgentSessionState({
         journal,
         sessionId: 'session-1',
         fence: 2,
-        acquisitionGeneration: 'generation-2'
+        acquisitionGeneration: 'generation-2',
+        deathEvidence: null
       })
 
       expect(
@@ -312,21 +315,23 @@ describe('stale session state on a cold acquire', () => {
       lifecycleItem('turn-1', 'completed', 1, { startedAt: 10, completedAt: 20 })
     ])
     await expect(
-      settleStaleSessionStateOnAcquire({
+      settleStaleStructuredAgentSessionState({
         journal: idle.journal,
         sessionId: 'session-1',
         fence: 14,
-        acquisitionGeneration: null
+        acquisitionGeneration: null,
+        deathEvidence: null
       })
     ).resolves.toBe(0)
     expect(idle.appendLifecycleBatch).not.toHaveBeenCalled()
 
     const running = journalWith([lifecycleItem('turn-2', 'running', 2)])
-    await settleStaleSessionStateOnAcquire({
+    await settleStaleStructuredAgentSessionState({
       journal: running.journal,
       sessionId: 'session-1',
       fence: 14,
-      acquisitionGeneration: null
+      acquisitionGeneration: null,
+      deathEvidence: null
     })
     expect(running.appendLifecycleBatch).toHaveBeenCalledWith(
       expect.objectContaining({ settlementId: 'stale-session:session-1:14:seq-8' })
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-stale-turn-verdict.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-stale-turn-verdict.ts
index 784067b303ca..b6e9b9bde5ea 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-stale-turn-verdict.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-stale-turn-verdict.ts
@@ -2,7 +2,7 @@
 //
 // `interrupted` requires the host to have seen the child exit; that receipt is the only end time it
 // is allowed to record. Everything weaker — a pid probe, an identity mismatch, a journal found
-// running on a cold acquire — is `unverifiable` and carries no end at all.
+// running with no observed exit on the record — is `unverifiable` and carries no end at all.
 
 import { parseAgentJournalItemKey } from '../../../shared/agent-session-journal-item-key'
 import type {
@@ -14,10 +14,7 @@ import {
   readAgentJournalTurn
 } from '../../../shared/agent-session-turn-record'
 import type { AgentSessionDeathEvidence } from '../../../shared/agent-session-record'
-import { partitionJournalLifecycleMutations } from '../agent-session-journal/journal-lifecycle-batch-partition'
 import type { JournalLifecycleMutationInput } from '../agent-session-journal/journal-row-builders'
-import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
-import { cancelledJournalPromptBody } from '../agent-session-journal/journal-prompt-body-bounds'
 
 export type StructuredAgentSessionTurnVerdict =
   | { state: 'interrupted'; completedAt: number }
@@ -59,28 +56,6 @@ export function runningTurnLifecycleRevisions(
   return revisions
 }
 
-function staleSessionLifecycleRevisions(
-  items: readonly AgentJournalRenderItem[]
-): JournalLifecycleMutationInput[] {
-  const revisions: JournalLifecycleMutationInput[] = []
-  for (const item of items) {
-    const identity = parseAgentJournalItemKey(item.itemId)
-    if (!identity) {
-      continue
-    }
-    const cancelled =
-      (item.body.kind === 'approval' || item.body.kind === 'question') &&
-      item.body.resolution.state === 'pending'
-        ? cancelledJournalPromptBody(item.body)
-        : null
-    if (cancelled) {
-      revisions.push({ kind: 'item', identity, body: cancelled })
-    }
-  }
-  revisions.push(...runningTurnLifecycleRevisions(items, UNVERIFIABLE_TURN_VERDICT))
-  return revisions
-}
-
 /** The verdict owns the turn's end and nothing else; every other field the row
  *  carries, including ones this build does not know, stays as it was. */
 function settledLifecycle(
@@ -98,26 +73,3 @@ function settledLifecycle(
     ? { ...kept, state: verdict.state, completedAt: verdict.completedAt }
     : { ...kept, state: verdict.state }
 }
-
-/** A running row found when a NEW child is acquired belongs to a generation whose exit nobody
- *  observed. Must run before that child's buffered events land, or a live turn would be judged. */
-export async function settleStaleSessionStateOnAcquire(input: {
-  journal: AgentSessionJournal
-  sessionId: string
-  fence: number
-  acquisitionGeneration: string | null
-}): Promise<number> {
-  const { journal } = input
-  const revisions = staleSessionLifecycleRevisions(journal.snapshot().items)
-  const generation = input.acquisitionGeneration ?? `seq-${journal.cursor().sequence}`
-  const settlementId = `stale-session:${input.sessionId}:${input.fence}:${generation}`
-  for (const chunk of partitionJournalLifecycleMutations(settlementId, revisions)) {
-    await journal.appendLifecycleBatch({
-      settlementId: chunk.settlementId,
-      fence: input.fence,
-      recovered: true,
-      mutations: chunk.mutations
-    })
-  }
-  return revisions.length
-}
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-start-failure-row.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-start-failure-row.ts
new file mode 100644
index 000000000000..c0660eb9791a
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-start-failure-row.ts
@@ -0,0 +1,83 @@
+import { agentJournalItemKey } from '../../../shared/agent-session-journal-item-key'
+import { isQueuedAgentJournalSubmission } from '../../../shared/agent-session-queued-submission'
+import type { JournalLifecycleMutationInput } from '../agent-session-journal/journal-row-builders'
+import type { StructuredAgentSessionHostSession } from './structured-agent-session-host-types'
+import type { StructuredAgentSessionStartFailureWords } from './structured-agent-session-failure-text'
+
+/** A start that failed, keyed like its row, in the words `structuredAgentSessionStartFailure` gave. */
+export type StructuredAgentSessionStartFailure = StructuredAgentSessionStartFailureWords & {
+  startKey: string | null
+}
+
+/**
+ * The one row a start that failed leaves in the chat, whoever saw it fail: an error row, so the
+ * reason outlives any error strip. Keyed by the start — the child's generation, or the oldest
+ * message it was for when no child was ever published — so a second report of the same failure
+ * lands on the same row instead of adding one.
+ */
+export function structuredAgentSessionStartFailureRow(
+  startKey: string,
+  words: StructuredAgentSessionStartFailureWords
+): JournalLifecycleMutationInput {
+  return {
+    kind: 'item',
+    identity: startFailureRowIdentity(startKey),
+    // The row repeats the sentence the start's rejected messages carry.
+    body: { kind: 'status', text: words.reason, tone: 'error', failure: words.rejection }
+  }
+}
+
+/** Whether the start's row is already written. Its words are the ones its rejected messages carry,
+ *  and rejected is terminal, so the exit's later report of the same start must not reword it. */
+export function hasStructuredAgentSessionStartFailureRow(
+  items: readonly { itemId: string }[],
+  startKey: string
+): boolean {
+  const itemId = agentJournalItemKey(startFailureRowIdentity(startKey))
+  return items.some((item) => item.itemId === itemId)
+}
+
+function startFailureRowIdentity(startKey: string) {
+  return { provider: 'orca' as const, clientMessageId: `start-failure:${startKey}` }
+}
+
+/**
+ * A start the delivery loop needed and did not get: the start's row, and every queued message
+ * rejected with the same words. Writes nothing when nothing is still queued: a start whose
+ * messages Stop withdrew did not fail anyone.
+ */
+export async function recordStructuredAgentSessionStartFailure(
+  session: Pick<StructuredAgentSessionHostSession, 'journal'> & { fence: number },
+  failure: StructuredAgentSessionStartFailure
+): Promise<void> {
+  const oldest = oldestQueuedSubmission(session)
+  if (!oldest) {
+    return
+  }
+  const startKey = failure.startKey ?? oldest.clientMessageId
+  await session.journal.appendLifecycleBatch({
+    settlementId: `start-failure:${startKey}`,
+    fence: session.fence,
+    recovered: true,
+    mutations: [structuredAgentSessionStartFailureRow(startKey, failure)]
+  })
+  await session.journal.rejectQueuedSubmissions(session.fence, {
+    reason: failure.reason,
+    rejection: failure.rejection
+  })
+}
+
+export function oldestQueuedSubmission(
+  session: Pick<StructuredAgentSessionHostSession, 'journal'>
+): ReturnType<StructuredAgentSessionHostSession['journal']['submissions']>[number] | undefined {
+  let oldest: ReturnType<typeof oldestQueuedSubmission>
+  for (const submission of session.journal.submissions()) {
+    if (
+      isQueuedAgentJournalSubmission(submission) &&
+      (oldest === undefined || (submission.acceptedSequence ?? 0) < (oldest.acceptedSequence ?? 0))
+    ) {
+      oldest = submission
+    }
+  }
+  return oldest
+}
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-start-failure-writer.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-start-failure-writer.test.ts
new file mode 100644
index 000000000000..5ce1fdb3694e
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-start-failure-writer.test.ts
@@ -0,0 +1,194 @@
+// A start a queued message waited on can be seen failing twice: by the delivery loop, when the
+// adapter settles the start without proving it, and by the exit settlement, when the child's exit
+// lands. The chat gets one row for that start, the loop's, in the words the message was rejected
+// with — whichever of the two reports first.
+
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import {
+  agentSessionFailureFact,
+  type SubmissionRejectionFact
+} from '../../../shared/agent-session-failure'
+import { agentJournalItemKey } from '../../../shared/agent-session-journal-item-key'
+import { computeAgentSessionPayloadFingerprint } from '../../../shared/agent-session-mutation-envelope'
+import type { AgentSessionSubscribeEvent } from '../../../shared/agent-session-wire'
+import { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
+import { StructuredAgentSessionHost } from './structured-agent-session-host'
+import {
+  HOST_TEST_NOW as NOW,
+  HOST_TEST_SESSION as SESSION,
+  HOST_TEST_THREAD as THREAD,
+  hostTestAttachParams,
+  hostTestMessage,
+  hostTestOperationId,
+  resetHostTestOperationIds
+} from './structured-agent-session-host-test-data'
+
+const CALLER = { callerKey: 'client-1' }
+const EXIT_REASON = 'Claude Code is not signed in. Sign in with the Claude CLI'
+const ADAPTER_FAILURE = agentSessionFailureFact('notSignedIn')
+const ADAPTER_FAILURE_TEXT =
+  'Codex is not signed in for the selected account. Sign in, then send your message again.'
+// The exit's reason is Orca's log text; the row says only that the start stopped.
+const EXIT_TEXT = 'Codex stopped before it finished starting. Send your message to try again.'
+// The first child (generation-1) is lost at setup; the send starts generation-2.
+const START_ROW = agentJournalItemKey({
+  provider: 'orca',
+  clientMessageId: 'start-failure:generation-2'
+})
+
+function eventually(assertion: () => void | Promise<void>): Promise<void> {
+  return vi.waitFor(assertion, { timeout: 10_000 })
+}
+
+let root: string
+let store: AgentSessionRecordStore
+let host: StructuredAgentSessionHost
+let generation = 0
+let settleStart: (failure: SubmissionRejectionFact | undefined) => void = () => {}
+let awaitStarted = vi.fn<() => Promise<SubmissionRejectionFact | undefined>>()
+let frames: AgentSessionSubscribeEvent[] = []
+
+function exitBeforeProof(): Promise<void> {
+  return host.handleAdapterEvent({
+    type: 'ended',
+    sessionId: SESSION,
+    fence: store.getRecord(SESSION)?.lease.runtimeFence ?? 0,
+    acquisitionGeneration: `generation-${generation}`,
+    reason: EXIT_REASON,
+    cause: 'unexpected-exit',
+    startupUnproven: true
+  })
+}
+
+async function sendQueued(text: string): Promise<string> {
+  const body = hostTestMessage(text)
+  const sent = await host.send(CALLER, {
+    envelope: {
+      sessionId: SESSION,
+      clientOperationId: hostTestOperationId(),
+      expectedRuntimeFence: store.getRecord(SESSION)?.lease.runtimeFence ?? 0,
+      payloadFingerprint: computeAgentSessionPayloadFingerprint({
+        method: 'agentSession.send',
+        sessionId: SESSION,
+        fields: { body }
+      })
+    },
+    body
+  })
+  expect(sent).toMatchObject({ ok: true })
+  // The loop started a child and waits on its start with the message still queued.
+  await eventually(() => expect(awaitStarted).toHaveBeenCalledOnce())
+  expect(generation).toBe(2)
+  return sent.ok ? sent.value.clientMessageId : ''
+}
+
+async function submission(clientMessageId: string) {
+  return (await host.journalSnapshot(SESSION)).submissions.find(
+    (entry) => entry.clientMessageId === clientMessageId
+  )
+}
+
+/** Every text the subscriber was sent for the start's row, in order. */
+function publishedStartRows(): string[] {
+  return frames.flatMap((frame) =>
+    frame.type === 'batch'
+      ? frame.batch.items.flatMap((item) =>
+          item.itemId === START_ROW && item.body.kind === 'status' ? [item.body.text] : []
+        )
+      : []
+  )
+}
+
+async function startRows(): Promise<string[]> {
+  return (await host.journalSnapshot(SESSION)).items.flatMap((item) =>
+    item.itemId === START_ROW && item.body.kind === 'status' ? [item.body.text] : []
+  )
+}
+
+beforeEach(async () => {
+  root = await mkdtemp(join(tmpdir(), 'orca-start-failure-writer-'))
+  resetHostTestOperationIds()
+  generation = 0
+  frames = []
+  awaitStarted = vi.fn(
+    () => new Promise<SubmissionRejectionFact | undefined>((resolve) => (settleStart = resolve))
+  )
+  store = await AgentSessionRecordStore.open({ directory: join(root, 'store'), hostId: 'local' })
+  host = new StructuredAgentSessionHost({
+    store,
+    adapter: {
+      acquire: vi.fn(async ({ fence, spawnToken }) => ({
+        process: { hostId: 'local', pid: 4242, processStartTimeMs: 1_700_000_000_000, spawnToken },
+        link: {
+          linkId: `link-${fence}`,
+          handle: { provider: 'codex' as const, threadId: THREAD },
+          origin: generation === 0 ? ('created' as const) : ('resumed' as const),
+          mintedAtFence: fence,
+          observedAt: NOW
+        },
+        acquisitionGeneration: `generation-${++generation}`,
+        providerChildPhase: 'starting' as const
+      })),
+      awaitStarted,
+      releaseAcquisition: vi.fn(async () => true),
+      closeSession: vi.fn(async () => true),
+      dispatch: vi.fn(async () => ({ state: 'admitted' as const })),
+      cancelTurn: vi.fn(async () => ({ cancelled: true })),
+      answerPrompt: vi.fn(async () => undefined),
+      setOption: vi.fn(async () => undefined)
+    },
+    journalRoot: root,
+    claimKeyId: 'key-1',
+    mintSpawnToken: () => `spawn-${generation + 1}`,
+    now: () => NOW
+  })
+  await expect(host.attach(CALLER, hostTestAttachParams(null))).resolves.toMatchObject({
+    ok: true
+  })
+  await exitBeforeProof()
+  await host.subscribe({ id: 'pane', sessionId: SESSION, emit: (event) => frames.push(event) })
+})
+
+afterEach(async () => {
+  await host.flushAllStreamedEvents()
+  await rm(root, { recursive: true, force: true })
+})
+
+describe('a queued message whose start fails and whose child then exits', () => {
+  it("keeps the loop's row when the loop saw the failure first", async () => {
+    const queued = await sendQueued('hello')
+
+    settleStart(ADAPTER_FAILURE)
+    await eventually(async () =>
+      expect(await submission(queued)).toMatchObject({
+        dispatchState: 'rejected',
+        reason: ADAPTER_FAILURE_TEXT,
+        rejection: ADAPTER_FAILURE
+      })
+    )
+    await exitBeforeProof()
+    await host.flushStreamedEvents(SESSION)
+
+    expect(await startRows()).toEqual([ADAPTER_FAILURE_TEXT])
+    expect(publishedStartRows()).toEqual([ADAPTER_FAILURE_TEXT])
+  })
+
+  it('leaves the row to the loop when the exit lands while the message still waits', async () => {
+    const queued = await sendQueued('hello')
+
+    await exitBeforeProof()
+    expect(await submission(queued)).toMatchObject({ dispatchState: 'pending' })
+    settleStart(undefined)
+    await eventually(async () =>
+      expect(await submission(queued)).toMatchObject({ dispatchState: 'rejected' })
+    )
+    await host.flushStreamedEvents(SESSION)
+
+    expect(await startRows()).toEqual([EXIT_TEXT])
+    // Written once, after the message was settled, not first by the exit and again by the loop.
+    expect(publishedStartRows()).toEqual([EXIT_TEXT])
+  })
+})
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-startup-failure-exit.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-startup-failure-exit.test.ts
index 0fd544ec9eea..dae8635cd69d 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-startup-failure-exit.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-startup-failure-exit.test.ts
@@ -4,7 +4,6 @@ import {
   agentSessionLeaseFixture,
   agentSessionRecordFixture
 } from '../../../shared/agent-session-record.test-fixture'
-import { providerStartupFailureOutcome } from './structured-agent-session-dead-generation-settlement'
 import {
   settleUnexpectedStructuredAgentSessionExit,
   type StructuredAgentSessionUnexpectedExitContext,
@@ -13,16 +12,16 @@ import {
 
 const SESSION = 'session-1'
 const GENERATION = 'generation-1'
-const REASON = 'Claude Code is not signed in. Sign in with the Claude CLI'
+const REASON = 'claude stream-json exited (code 1): session limit reached'
+const STARTUP_TEXT = 'Claude stopped before it finished starting. Send your message to try again.'
 
 function startedSession(): StructuredAgentSessionUnexpectedExitSession & {
   journal: { appendLifecycleBatch: ReturnType<typeof vi.fn> }
 } {
   return {
-    hasProviderChild: true,
-    fence: 7,
-    acquisitionGeneration: GENERATION,
+    child: { generation: GENERATION, fence: 7, phase: 'ready' },
     journal: {
+      cursor: () => ({ epoch: 'epoch-1', sequence: 0 }),
       // Nothing ran: the start failed before any response or acknowledged prompt.
       snapshot: () => ({ items: [] }),
       appendLifecycleBatch: vi.fn(async () => ({ epoch: 'epoch-1', sequence: 1 })),
@@ -56,7 +55,6 @@ function contextFor(session: StructuredAgentSessionUnexpectedExitSession) {
     sessions: new Map([[SESSION, session]]),
     flushLifecycle: async () => ({ ok: true }),
     publishFence: vi.fn(),
-    hasResumeCapableHolder: () => true,
     serialize: async <T>(_sessionId: string, task: () => Promise<T>) => task(),
     now: () => 1
   }
@@ -73,47 +71,70 @@ const ended = {
 }
 
 describe('a provider that ends before it finished starting', () => {
-  it('tells the user why, even with no response in progress, and does not auto-resume', async () => {
+  it('tells the user why, even with no response in progress', async () => {
     const session = startedSession()
 
-    const ticket = await settleUnexpectedStructuredAgentSessionExit(contextFor(session), {
+    await settleUnexpectedStructuredAgentSessionExit(contextFor(session), {
       ...ended,
+      // The adapter typed the start's own failure; the host keeps it rather than reword it.
+      failure: { kind: 'notSignedIn' },
       startupUnproven: true
     })
 
-    expect(ticket).toBeNull()
     expect(session.journal.appendLifecycleBatch).toHaveBeenCalledWith(
       expect.objectContaining({
         mutations: [
           expect.objectContaining({
-            body: { kind: 'status', text: providerStartupFailureOutcome(REASON) }
+            // The same row the delivery loop writes for a failed start: an error, keyed by it.
+            identity: { provider: 'orca', clientMessageId: `start-failure:${GENERATION}` },
+            body: {
+              kind: 'status',
+              text: 'Claude is not signed in for the selected account. Sign in, then send your message again.',
+              tone: 'error',
+              failure: { kind: 'notSignedIn' }
+            }
           })
         ]
       })
     )
-    expect(providerStartupFailureOutcome(REASON)).toContain('not signed in')
   })
 
-  it('keeps an ordinary idle exit silent and resumable', async () => {
+  it('keeps an ordinary idle exit silent', async () => {
     const session = startedSession()
 
-    const ticket = await settleUnexpectedStructuredAgentSessionExit(contextFor(session), ended)
+    await settleUnexpectedStructuredAgentSessionExit(contextFor(session), ended)
 
-    expect(ticket).not.toBeNull()
+    expect(session.child).toBeNull()
     expect(session.journal.appendLifecycleBatch).not.toHaveBeenCalled()
   })
 
   it("reads a start that failed off the host's own phase when the provider omits the flag", async () => {
-    const session = { ...startedSession(), providerChildPhase: 'starting' as const }
+    const session = {
+      ...startedSession(),
+      child: { generation: GENERATION, fence: 7, phase: 'starting' as const }
+    }
 
-    const ticket = await settleUnexpectedStructuredAgentSessionExit(contextFor(session), ended)
+    await settleUnexpectedStructuredAgentSessionExit(contextFor(session), {
+      ...ended,
+      failure: { kind: 'providerExited', detail: { text: REASON, audience: 'log' } }
+    })
 
-    expect(ticket).toBeNull()
     expect(session.journal.appendLifecycleBatch).toHaveBeenCalledWith(
       expect.objectContaining({
         mutations: [
           expect.objectContaining({
-            body: { kind: 'status', text: providerStartupFailureOutcome(REASON) }
+            // The same row the delivery loop writes for a failed start: an error, keyed by it.
+            identity: { provider: 'orca', clientMessageId: `start-failure:${GENERATION}` },
+            // The exit's stderr stays out of the sentence, as a log detail beside it.
+            body: {
+              kind: 'status',
+              text: STARTUP_TEXT,
+              tone: 'error',
+              failure: {
+                kind: 'providerStartFailed',
+                detail: { text: REASON, audience: 'log' }
+              }
+            }
           })
         ]
       })
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-status-feed-test-session.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-status-feed-test-session.ts
index e4fa6ebed1bf..c130aaf9d597 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-status-feed-test-session.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-status-feed-test-session.ts
@@ -2,17 +2,11 @@ import type { AgentSessionJournal } from '../agent-session-journal/journal-store
 
 export function indexedStatusFeedSession(session: {
   journal: AgentSessionJournal
-  hasProviderChild?: boolean
-  providerChildPhase?: 'starting' | 'ready'
-  fence?: number
+  child?: { phase: 'starting' | 'ready' } | null
 }) {
   return {
     journal: session.journal,
-    fence: session.fence ?? 1,
-    ...(session.hasProviderChild !== undefined
-      ? { hasProviderChild: session.hasProviderChild }
-      : {}),
-    ...(session.providerChildPhase ? { providerChildPhase: session.providerChildPhase } : {}),
+    ...(session.child !== undefined ? { child: session.child } : {}),
     params: {
       location: {
         executionHostId: 'local' as const,
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-status-feed.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-status-feed.test.ts
index 65c7f54fb305..a26cd324217f 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-status-feed.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-status-feed.test.ts
@@ -3,6 +3,7 @@ import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import type { AgentSessionRecord } from '../../../shared/agent-session-record'
+import { agentSessionRecordFixture } from '../../../shared/agent-session-record.test-fixture'
 import type {
   AgentSessionBackgroundTask,
   AgentSessionStatusEvent,
@@ -33,6 +34,8 @@ const USER_IDENTITY = {
   ordinal: 1
 } as const
 
+type Indexed = Parameters<typeof indexed>[0]
+
 let root: string
 const journals = createTrackedJournalOpener()
 
@@ -82,7 +85,8 @@ function feedFor(
         }
       }
     } as unknown as ReadonlyMap<string, ReturnType<typeof indexed>>,
-    getRecord: () => record as AgentSessionRecord | null,
+    // A partial record still has a lease: the feed reads the conversation's fence off it.
+    getRecord: () => (record ? { ...agentSessionRecordFixture(), ...record } : null),
     now: () => (now += 1)
   })
   const events: AgentSessionStatusEvent[] = []
@@ -93,17 +97,17 @@ function feedFor(
 describe('StructuredAgentSessionStatusFeed', () => {
   it('projects whether the owned child has proven its start, and nothing once it is not owned', async () => {
     const journal = await openJournal()
-    const session = { journal, hasProviderChild: true, providerChildPhase: 'starting' as const }
+    const session = { journal, child: { phase: 'starting' as const } }
     const sessions = new Map<string, Parameters<typeof indexed>[0]>([[SESSION, session]])
     const { feed, events, dispose } = feedFor(sessions)
     expect(events.at(-1)).toMatchObject({
       type: 'snapshot',
       sessions: [{ hostExecutionOwned: true, hostExecutionPhase: 'starting' }]
     })
-    sessions.set(SESSION, { ...session, providerChildPhase: 'ready' })
+    sessions.set(SESSION, { ...session, child: { phase: 'ready' } })
     feed.publish(SESSION, journal)
     expect(events.at(-1)).toMatchObject({ session: { hostExecutionPhase: 'ready' } })
-    sessions.set(SESSION, { ...session, hasProviderChild: false })
+    sessions.set(SESSION, { ...session, child: null })
     feed.publish(SESSION, journal)
     expect(events.at(-1)).not.toMatchObject({ session: { hostExecutionPhase: expect.any(String) } })
     dispose()
@@ -111,7 +115,7 @@ describe('StructuredAgentSessionStatusFeed', () => {
 
   it('publishes provider ownership transitions without changing journal time', async () => {
     const journal = await openJournal()
-    const sessions = new Map([[SESSION, { journal, hasProviderChild: true }]])
+    const sessions = new Map<string, Indexed>([[SESSION, { journal, child: { phase: 'ready' } }]])
     const { feed, events, dispose } = feedFor(sessions)
     events.length = 0
     await journal.appendItem(
@@ -130,7 +134,7 @@ describe('StructuredAgentSessionStatusFeed', () => {
       throw new Error('status publication missing')
     }
     const journalTime = firstStatus.session.updatedAt
-    sessions.get(SESSION)!.hasProviderChild = false
+    sessions.get(SESSION)!.child = null
     feed.publish(SESSION, journal)
     expect(events.at(-1)).toEqual({
       type: 'status',
@@ -167,8 +171,10 @@ describe('StructuredAgentSessionStatusFeed', () => {
 
   it('stops projecting an old-host unknown submission after the owner fence advances', async () => {
     const journal = await openJournal()
-    const session = { journal, fence: 1 }
-    const { feed, events } = feedFor(new Map([[SESSION, session]]))
+    // The conversation's fence is the record's: a child's end moves it.
+    const lease = agentSessionRecordFixture().lease
+    const record = agentSessionRecordFixture({ ...lease, runtimeFence: 1 })
+    const { feed, events } = feedFor(new Map([[SESSION, { journal }]]), record)
     await journal.appendSubmission({
       clientMessageId: 'old-host',
       payloadFingerprint: 'fp',
@@ -183,9 +189,10 @@ describe('StructuredAgentSessionStatusFeed', () => {
     })
     feed.publish(SESSION)
     expect(events.at(-1)).toMatchObject({ session: { status: 'working' } })
-    session.fence = 2
+    record.lease.runtimeFence = 2
     feed.publish(SESSION)
-    expect(events.at(-1)).toMatchObject({ session: { status: 'idle' } })
+    // Its only send outlived the host that sent it and became no turn: nothing left to list.
+    expect(events.at(-1)).toMatchObject({ session: { status: null } })
   })
 
   it('publishes working from the pending submission, before the provider replays the turn', async () => {
@@ -793,7 +800,7 @@ describe('the status sink sees the roster the broadcast cache deliberately lacks
 
   it('receives every change once, ownership revocation, and the forget edge', async () => {
     const journal = await openJournal()
-    const sessions = new Map([[SESSION, { journal, hasProviderChild: true }]])
+    const sessions = new Map<string, Indexed>([[SESSION, { journal, child: { phase: 'ready' } }]])
     const { sink, published, forgotten } = sinkFor()
     const { feed } = feedFor(sessions, null, undefined, undefined, sink)
     await journal.appendItem(
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-status-feed.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-status-feed.ts
index eef1c0e06f98..05937aca5148 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-status-feed.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-status-feed.ts
@@ -22,7 +22,7 @@ import {
   type AgentSessionStatusSummary
 } from '../../../shared/agent-session-wire'
 import type { AgentChildWorkEvidence } from '../../../shared/agent-status-child-work-evidence'
-import { projectStructuredAgentSessionStatusSummary } from '../../../shared/structured-agent-session-projection'
+import { projectStructuredAgentSessionStatusState } from '../../../shared/structured-agent-session-projection'
 import { structuredAgentSessionAgentStatus } from '../../../shared/structured-agent-session-agent-status'
 import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
 import type { StructuredAgentSessionProviderChildPhase } from './structured-agent-session-adapter'
@@ -34,6 +34,10 @@ import {
 
 export type { StructuredAgentSessionStatusSink } from './structured-agent-session-status-ownership'
 
+export type StructuredAgentSessionStatusState = ReturnType<
+  typeof projectStructuredAgentSessionStatusState
+>
+
 export type StructuredAgentSessionStatusSubscriber = {
   id: string
   emit: (event: AgentSessionStatusEvent) => void
@@ -42,9 +46,7 @@ export type StructuredAgentSessionStatusSubscriber = {
 type StatusFeedSession = {
   journal: AgentSessionJournal
   params: { location: AgentSessionRecord['location']; provider: AgentSessionRecord['provider'] }
-  hasProviderChild?: boolean
-  providerChildPhase?: StructuredAgentSessionProviderChildPhase
-  fence?: number
+  child?: { phase: StructuredAgentSessionProviderChildPhase } | null
 }
 
 export type StructuredAgentSessionStatusFeedDeps = {
@@ -60,6 +62,8 @@ export type StructuredAgentSessionStatusFeedDeps = {
   /** Live provider-owned background tasks for the summary, so session lists can
    *  render subagent children. Optional: a provider without the hook projects none. */
   readBackgroundTasks?: (sessionId: string) => AgentSessionBackgroundTaskState | null | undefined
+  /** The session's agent proved a start: its row's phase became `ready`. */
+  onAgentStarted?: (sessionId: string) => void
 }
 
 function summariesEqual(a: AgentSessionStatusSummary, b: AgentSessionStatusSummary): boolean {
@@ -117,6 +121,7 @@ export function createStructuredAgentSessionHostStatusFeed(args: {
     onSessionStatusChanged?: StructuredAgentSessionStatusFeedDeps['onStatusChanged']
     statusSink?: StructuredAgentSessionStatusSink
   }
+  onAgentStarted?: (sessionId: string) => void
 }): StructuredAgentSessionStatusFeed {
   return new StructuredAgentSessionStatusFeed({
     sessions: args.sessions,
@@ -126,7 +131,8 @@ export function createStructuredAgentSessionHostStatusFeed(args: {
     readBackgroundTasks: (sessionId) => args.deps().adapter.backgroundTaskState?.(sessionId),
     // Resolved per call for the same reason the other deps are: the host builds this feed in a
     // field initializer, before its constructor parameters are assigned.
-    statusSink: () => args.deps().statusSink
+    statusSink: () => args.deps().statusSink,
+    ...(args.onAgentStarted ? { onAgentStarted: args.onAgentStarted } : {})
   })
 }
 
@@ -144,7 +150,7 @@ export class StructuredAgentSessionStatusFeed {
       sequence: number
       readOnly: boolean
       fence: number | undefined
-      summary: ReturnType<typeof projectStructuredAgentSessionStatusSummary>
+      state: StructuredAgentSessionStatusState
     }
   >()
 
@@ -206,6 +212,17 @@ export class StructuredAgentSessionStatusFeed {
     })
   }
 
+  /** The projection behind the session's row and the latest request it read, cached per commit,
+   *  so the completion feed follows the same request without snapshotting the journal again. */
+  statusState(
+    sessionId: string,
+    journal?: AgentSessionJournal
+  ): StructuredAgentSessionStatusState | null {
+    const session = this.deps.sessions.get(sessionId)
+    const source = journal ?? session?.journal
+    return source ? this.projectionFor(source, this.deps.getRecord(sessionId)) : null
+  }
+
   /** Re-projects one session after its journal changed; equal projections are not re-sent. */
   publish(sessionId: string, journal?: AgentSessionJournal, options?: { replay?: boolean }): void {
     const session = this.deps.sessions.get(sessionId)
@@ -223,6 +240,9 @@ export class StructuredAgentSessionStatusFeed {
     this.published.set(sessionId, summary)
     this.sink(summary, session.params.location)
     this.broadcast({ type: 'status', session: summary })
+    if (summary.hostExecutionPhase === 'ready' && previous?.hostExecutionPhase !== 'ready') {
+      this.deps.onAgentStarted?.(sessionId)
+    }
     try {
       this.deps.onStatusChanged?.(summary, { replay: options?.replay === true })
     } catch (error) {
@@ -236,34 +256,8 @@ export class StructuredAgentSessionStatusFeed {
     session: StatusFeedSession,
     journal: AgentSessionJournal
   ): AgentSessionStatusSummary {
-    // An unreadable journal projects as "no turn": the chat itself shows the reset.
-    const cursor = journal.cursor()
-    const readOnly = journal.isReadOnly
-    const fence = session.fence
-    let projection = this.journalProjections.get(journal)
-    if (
-      !projection ||
-      projection.epoch !== cursor.epoch ||
-      projection.sequence !== cursor.sequence ||
-      projection.readOnly !== readOnly ||
-      projection.fence !== fence
-    ) {
-      // A journalled submission bumps `lastSequence`, so the send-time working
-      // signal reaches the cache; the lease fence does not, hence the extra key.
-      const snapshot = readOnly ? null : journal.snapshot()
-      projection = {
-        ...cursor,
-        readOnly,
-        fence,
-        summary: projectStructuredAgentSessionStatusSummary(
-          snapshot?.items ?? [],
-          snapshot?.submissions ?? [],
-          fence
-        )
-      }
-      this.journalProjections.set(journal, projection)
-    }
     const record = this.deps.getRecord(sessionId)
+    const { summary: projected } = this.projectionFor(journal, record)
     const providerSession = structuredAgentSessionProviderSessionMetadata(record)
     // The journal has no model: the record's acknowledged options are where a mid-session
     // switch lands, so the row follows whichever is in force.
@@ -278,15 +272,10 @@ export class StructuredAgentSessionStatusFeed {
       sessionId,
       workspaceId: session.params.location.workspaceId,
       agent: session.params.provider,
-      ...(session.hasProviderChild
-        ? {
-            hostExecutionOwned: true as const,
-            ...(session.providerChildPhase
-              ? { hostExecutionPhase: session.providerChildPhase }
-              : {})
-          }
+      ...(session.child
+        ? { hostExecutionOwned: true as const, hostExecutionPhase: session.child.phase }
         : {}),
-      ...projection.summary,
+      ...projected,
       ...(record?.rewind?.phase === 'prepared' || record?.rewind?.phase === 'provider-succeeded'
         ? { rewindBlockedReason: 'outcome-unknown' as const }
         : {}),
@@ -310,6 +299,41 @@ export class StructuredAgentSessionStatusFeed {
     }
   }
 
+  private projectionFor(
+    journal: AgentSessionJournal,
+    record: AgentSessionRecord | null
+  ): StructuredAgentSessionStatusState {
+    // An unreadable journal projects as "no turn": the chat itself shows the reset.
+    const cursor = journal.cursor()
+    const readOnly = journal.isReadOnly
+    // The conversation's fence, which a child's end moves: its unanswered sends stop counting.
+    const fence = record?.lease.runtimeFence
+    let projection = this.journalProjections.get(journal)
+    if (
+      !projection ||
+      projection.epoch !== cursor.epoch ||
+      projection.sequence !== cursor.sequence ||
+      projection.readOnly !== readOnly ||
+      projection.fence !== fence
+    ) {
+      // A journalled submission bumps `lastSequence`, so the send-time working
+      // signal reaches the cache; the lease fence does not, hence the extra key.
+      const snapshot = readOnly ? null : journal.snapshot()
+      projection = {
+        ...cursor,
+        readOnly,
+        fence,
+        state: projectStructuredAgentSessionStatusState(
+          snapshot?.items ?? [],
+          snapshot?.submissions ?? [],
+          fence
+        )
+      }
+      this.journalProjections.set(journal, projection)
+    }
+    return projection.state
+  }
+
   /** A failing sink must never cost the subscribers their status event. */
   private sink(
     summary: AgentSessionStatusSummary,
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-subagent-recency.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-subagent-recency.test.ts
index cf9089326671..4053988233ff 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-subagent-recency.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-subagent-recency.test.ts
@@ -63,7 +63,9 @@ async function openSession() {
   const roster: { tasks: AgentSessionBackgroundTask[] } = { tasks: [] }
   const server = new AgentHookServer()
   const feed = new StructuredAgentSessionStatusFeed({
-    sessions: new Map([[SESSION, indexedStatusFeedSession({ journal, hasProviderChild: true })]]),
+    sessions: new Map([
+      [SESSION, indexedStatusFeedSession({ journal, child: { phase: 'ready' } })]
+    ]),
     getRecord: () => null,
     now: () => 1,
     readBackgroundTasks: () => ({ state: 'monitoring', tasks: roster.tasks }),
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-subscribers.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-subscribers.ts
index af5e231730c6..f600d6dd9bba 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-subscribers.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-subscribers.ts
@@ -15,6 +15,7 @@ import {
   type AgentSessionSubscribeEvent,
   type AgentSessionTurnActivity
 } from '../../../shared/agent-session-wire'
+import { sameJournalCursor } from '../agent-session-journal/journal-cursor'
 import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
 import { emptyAgentSessionBatch } from './agent-session-empty-batch'
 import {
@@ -57,6 +58,10 @@ export class AgentSessionSubscribers {
     return this.activityBySession.size
   }
 
+  subscriberCountForTests(sessionId: string): number {
+    return this.bySession.get(sessionId)?.size ?? 0
+  }
+
   open(input: {
     id: string
     sessionId: string
@@ -213,6 +218,11 @@ export class AgentSessionSubscribers {
       ? this.activityField(subscriber.sessionId).activity
       : undefined
     const publishedActivity = activity !== undefined ? activity : checkpointActivity
+    // Caught up, so there are no rows to read: every publish behind a commit's own delivery.
+    if (!journal.isReadOnly && sameJournalCursor(subscriber.cursor, journal.cursor())) {
+      this.emitCaughtUp(subscriber, hostNow, emitCheckpoint, backgroundTasks, publishedActivity)
+      return
+    }
     const readPage = createAgentSessionCatchUpReader(journal)
     while (true) {
       const result = readPage({
@@ -239,20 +249,7 @@ export class AgentSessionSubscribers {
       const page = result.page
       const advanced = page.window.nextCursor.sequence > subscriber.cursor.sequence
       if (!advanced) {
-        const commandsChanged =
-          this.hooks.readCommands !== undefined &&
-          (this.hooks.readCommands(subscriber.sessionId) ?? null) !== subscriber.commands
-        if (emitCheckpoint || publishedActivity !== undefined || commandsChanged) {
-          this.emit(subscriber, {
-            type: 'batch',
-            sessionId: subscriber.sessionId,
-            batch: emptyAgentSessionBatch(page.window.nextCursor),
-            fence: subscriber.fence,
-            hostNow,
-            ...(backgroundTasks !== undefined ? { backgroundTasks } : {}),
-            ...(publishedActivity !== undefined ? { activity: publishedActivity } : {})
-          })
-        }
+        this.emitCaughtUp(subscriber, hostNow, emitCheckpoint, backgroundTasks, publishedActivity)
         return
       }
       this.emit(subscriber, {
@@ -276,6 +273,29 @@ export class AgentSessionSubscribers {
     }
   }
 
+  private emitCaughtUp(
+    subscriber: Subscriber,
+    hostNow: number,
+    emitCheckpoint: boolean,
+    backgroundTasks: AgentSessionBackgroundTaskState | null | undefined,
+    activity: AgentSessionTurnActivity | null | undefined
+  ): void {
+    const commandsChanged =
+      this.hooks.readCommands !== undefined &&
+      (this.hooks.readCommands(subscriber.sessionId) ?? null) !== subscriber.commands
+    if (emitCheckpoint || activity !== undefined || commandsChanged) {
+      this.emit(subscriber, {
+        type: 'batch',
+        sessionId: subscriber.sessionId,
+        batch: emptyAgentSessionBatch(subscriber.cursor),
+        fence: subscriber.fence,
+        hostNow,
+        ...(backgroundTasks !== undefined ? { backgroundTasks } : {}),
+        ...(activity !== undefined ? { activity } : {})
+      })
+    }
+  }
+
   private now = (): number => this.hooks.now?.() ?? Date.now()
 
   private isActive = (subscriber: Subscriber): boolean =>
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-surface-lifetime.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-surface-lifetime.test.ts
index 661da1ed8447..98e50783bdf3 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-surface-lifetime.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-surface-lifetime.test.ts
@@ -1,7 +1,8 @@
-// The lifetime of a provider child, from the surfaces that hold the session.
+// The lifetime of a provider child, against the real host rather than a double.
 //
-// Two leaks meet here and each has to be tested against the real host, not a double: a chat that
-// closes without stopping its app-server, and a launch that starts one for every record on disk.
+// Two leaks meet here: a chat that closes without stopping its app-server, and a launch that
+// starts one for every record on disk. A view never starts or keeps a child; work starts one, the
+// idle sweep stops it, and an exit is settled and left for the next send.
 
 import { mkdtemp, rm } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
@@ -16,7 +17,6 @@ import type {
   AgentSessionMutationEnvelope,
   AgentSessionSubscribeEvent
 } from '../../../shared/agent-session-wire'
-import { AGENT_SESSION_UNATTACHED_REFUSAL_CODE } from '../../../shared/structured-agent-session-read-refusal'
 import { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
 import {
   AgentSessionAcquisitionRootExitObservedError,
@@ -24,7 +24,8 @@ import {
 } from './structured-agent-session-adapter'
 import type { StructuredAgentSessionEventSink } from './structured-agent-session-event-sink'
 import { StructuredAgentSessionHost } from './structured-agent-session-host'
-import { unexpectedProviderExitOutcome } from './structured-agent-session-dead-generation-settlement'
+import { abandonStructuredAgentSessionHost } from './structured-agent-session-host-test-abandon'
+import { readAgentJournalTurn } from '../../../shared/agent-session-turn-record'
 import type { StructuredAgentSessionStatusSink } from './structured-agent-session-status-feed'
 import {
   HOST_TEST_NOW as NOW,
@@ -35,11 +36,16 @@ import {
   hostTestOperationId,
   resetHostTestOperationIds
 } from './structured-agent-session-host-test-data'
+import { agentSessionFailureFact } from '../../../shared/agent-session-failure'
+import { agentSessionFailureWords } from '../../../shared/agent-session-failure-words'
+
+const UNEXPECTED_PROVIDER_EXIT_OUTCOME =
+  'Codex stopped while this response was in progress. You can continue in this conversation.'
 
 const CALLER = { callerKey: 'client-1' }
-const SURFACE = 'desktop-chat:1'
-/** Short enough to keep the suite fast, long enough that an eviction is a decision and not a race. */
-const GRACE_MS = 5
+/** Short enough to keep the suite fast; the host clock below decides what is idle. */
+const SWEEP_MS = 5
+const IDLE_MS = 1_000
 
 let root: string
 let store: AgentSessionRecordStore
@@ -50,6 +56,7 @@ let dispatch: Mock<StructuredAgentSessionAdapter['dispatch']>
 let sink: StructuredAgentSessionEventSink | null
 let hostErrors: unknown[]
 let statusSink: StructuredAgentSessionStatusSink
+let clock: number
 function adapter(): StructuredAgentSessionAdapter {
   return {
     acquire,
@@ -71,8 +78,8 @@ function openHost(
     journalRoot: root,
     claimKeyId: 'key-1',
     mintSpawnToken: () => `spawn-${acquire.mock.calls.length}`,
-    releaseGraceMs: GRACE_MS,
-    now: () => NOW,
+    idleSweep: { intervalMs: SWEEP_MS, idleMs: IDLE_MS },
+    now: () => clock,
     onEventSinkError: ({ error }) => hostErrors.push(error),
     statusSink,
     ...(probeOwner ? { probeOwner } : {})
@@ -92,6 +99,12 @@ async function attach(): Promise<void> {
   expect(await host.attach(CALLER, hostTestAttachParams(null))).toMatchObject({ ok: true })
 }
 
+/** What a send's delivery or `agentSession.ensure` does: attach at the record's current fence. */
+async function startAgent(): Promise<void> {
+  const fence = store.getRecord(SESSION)?.lease.runtimeFence ?? null
+  expect(await host.attach(CALLER, hostTestAttachParams(fence))).toMatchObject({ ok: true })
+}
+
 function envelope(method: string, fields: Record<string, unknown>): AgentSessionMutationEnvelope {
   return {
     sessionId: SESSION,
@@ -112,7 +125,7 @@ function emitTurnLifecycle(state: 'running' | 'completed', ordinal: number): voi
   )
 }
 
-/** Eviction is a sequence, not an event: the child stops first and the session is forgotten last. */
+/** The sweep stops the child first and closes the conversation last. */
 function waitForEviction(): Promise<void> {
   return vi.waitFor(() => {
     expect(closeSession).toHaveBeenCalledWith(SESSION)
@@ -120,9 +133,9 @@ function waitForEviction(): Promise<void> {
   })
 }
 
-/** Long enough for several grace windows to elapse, so "not evicted" means the clock declined. */
-function waitOutSeveralGraceWindows(): Promise<void> {
-  return new Promise((resolve) => setTimeout(resolve, GRACE_MS * 20))
+/** Long enough for many sweep ticks, so "not stopped" means the sweep declined. */
+function waitOutSeveralSweeps(): Promise<void> {
+  return new Promise((resolve) => setTimeout(resolve, SWEEP_MS * 20))
 }
 
 /** Fails the next eviction at `drain-published`, which leaves the session indexed for a retry. */
@@ -188,6 +201,7 @@ beforeEach(async () => {
   resetHostTestOperationIds()
   sink = null
   hostErrors = []
+  clock = NOW
   statusSink = { publish: vi.fn(), forget: vi.fn() }
   let generation = 0
   acquire = vi.fn(async ({ fence, spawnToken, events }) => {
@@ -207,7 +221,12 @@ beforeEach(async () => {
     }
   })
   closeSession = vi.fn(async () => true)
-  dispatch = vi.fn(async () => ({ state: 'rejected' as const, reason: 'unused' }))
+  dispatch = vi.fn(async () => ({
+    state: 'rejected' as const,
+    ...agentSessionFailureWords(agentSessionFailureFact('providerRejected'), {
+      surface: 'rejection'
+    })
+  }))
   store = await AgentSessionRecordStore.open({ directory: join(root, 'store'), hostId: 'local' })
   openHost()
 })
@@ -218,13 +237,13 @@ afterEach(async () => {
 })
 
 describe('a chat that closes', () => {
-  it('releases the provider child it was holding', async () => {
+  it('stops the provider child it started', async () => {
     await attach()
-    await host.hold(SESSION, SURFACE)
 
-    host.release(SESSION, SURFACE)
+    await host.close(SESSION)
 
-    await waitForEviction()
+    expect(closeSession).toHaveBeenCalledWith(SESSION)
+    expect(host.hasSession(SESSION)).toBe(false)
     expect(hostErrors).toEqual([])
     // The record and its journal stay; only the process and the claim on it go.
     expect(store.getRecord(SESSION)?.lease).toMatchObject({
@@ -234,52 +253,27 @@ describe('a chat that closes', () => {
     })
   })
 
-  it('keeps the child while another surface still holds the session', async () => {
-    await attach()
-    await host.hold(SESSION, SURFACE)
-    await host.hold(SESSION, 'paired-phone:1')
-
-    host.release(SESSION, SURFACE)
-    await waitOutSeveralGraceWindows()
-
-    expect(closeSession).not.toHaveBeenCalled()
-    expect(host.hasSession(SESSION)).toBe(true)
-  })
-
   // The pane outlives the close by a few frames — a workspace delete closes the chats inside it
-  // while their panes are still mounted — so whatever a read raises in that window is what the user
-  // sees. This is the code the client narrows on to keep that window off the pane; a host that
-  // starts raising a different one there puts the red error back.
-  it('answers a read from the pane that outlived it with the code the client treats as transitional', async () => {
+  // while their panes are still mounted. A read in that window reopens the conversation as a cache
+  // and is answered, never refused; it starts nothing.
+  it('answers a read from the pane that outlived it without starting a child', async () => {
     await attach()
-    await host.hold(SESSION, SURFACE)
 
     await host.close(SESSION)
-
     expect(host.hasSession(SESSION)).toBe(false)
-    expect(() => host.history({ sessionId: SESSION, direction: 'tail' })).toThrow(
-      AGENT_SESSION_UNATTACHED_REFUSAL_CODE
-    )
-    expect(() =>
-      host.subscribe({ id: 'sub-1', sessionId: SESSION, emit: () => undefined })
-    ).toThrow(AGENT_SESSION_UNATTACHED_REFUSAL_CODE)
-  })
-
-  it('does not lose the session to a release the client sent twice', async () => {
-    await attach()
-    await host.hold(SESSION, SURFACE)
-    await host.hold(SESSION, 'paired-phone:1')
-
-    // A retried release must retire ONE holder, which is what a set gets right and a count does not.
-    host.release(SESSION, SURFACE)
-    host.release(SESSION, SURFACE)
-    await waitOutSeveralGraceWindows()
 
-    expect(closeSession).not.toHaveBeenCalled()
-    expect(host.hasSession(SESSION)).toBe(true)
+    expect((await host.history({ sessionId: SESSION, direction: 'tail' })).ok).toBe(true)
+    const unsubscribe = await host.subscribe({
+      id: 'sub-1',
+      sessionId: SESSION,
+      emit: () => undefined
+    })
+    unsubscribe()
+    expect(acquire).toHaveBeenCalledOnce()
+    expect(store.getRecord(SESSION)?.lease.claimStatus).toBe('released')
   })
 
-  it('releases a compatibility wait when the session is evicted', async () => {
+  it('answers a compatibility wait with what eviction recorded', async () => {
     await attach()
     dispatch.mockResolvedValueOnce({ state: 'admitted' })
     const body = hostTestMessage('pending until close')
@@ -294,14 +288,21 @@ describe('a chat that closes', () => {
     if (!result.ok) {
       throw new Error('send was refused')
     }
+    // Handed over first: a message still queued at close is rejected as never sent instead.
+    await vi.waitFor(() => expect(dispatch).toHaveBeenCalled())
     const settlement = host.waitForSendSettlement(SESSION, result.value.clientMessageId)
 
     await host.close(SESSION)
 
-    await expect(settlement).resolves.toBeUndefined()
+    // Eviction's settlement is a journal write, so the wait sees it rather than timing out.
+    await expect(settlement).resolves.toMatchObject({
+      value: {
+        submission: { dispatchState: 'unknown', reason: 'provider_closed_before_acknowledgement' }
+      }
+    })
   })
 
-  it('retries teardown after journal close loses its result', async () => {
+  it('keeps the stop it made when the journal close loses its result', async () => {
     await attach()
     const session = host['sessions'].get(SESSION)
     expect(session).toBeDefined()
@@ -313,27 +314,16 @@ describe('a chat that closes', () => {
       })
       .mockImplementation(closeJournal)
 
-    await expect(host.close(SESSION)).rejects.toMatchObject({
-      step: 'forget-session',
-      cause: expect.objectContaining({ message: 'journal close result lost' })
-    })
-    expect(host.hasSession(SESSION)).toBe(true)
-    expect(host['sessions'].get(SESSION)?.hasProviderChild).toBe(false)
+    // The child is stopped and the lease released before the handle closes; the entry is dropped
+    // before that close, so a lost result leaves no closing handle for a reader to find.
+    await expect(host.close(SESSION)).rejects.toThrow('journal close result lost')
+    expect(host.hasSession(SESSION)).toBe(false)
     expect(store.getRecord(SESSION)?.lease).toMatchObject({
       claimStatus: 'released',
       ownerProcess: null
     })
-    expect(statusSink.forget).toHaveBeenCalledWith({
-      kind: 'structured-session',
-      sessionId: SESSION,
-      executionHostId: 'local',
-      wslDistro: null,
-      workspaceId: 'workspace-1',
-      workspaceKind: 'git-worktree'
-    })
 
     await expect(host.close(SESSION)).resolves.toBeUndefined()
-    expect(host.hasSession(SESSION)).toBe(false)
     expect(closeSession).toHaveBeenCalledOnce()
   })
 
@@ -356,7 +346,7 @@ describe('a chat that closes', () => {
 
     await expect(host.close(SESSION)).rejects.toMatchObject({ step: 'drain-published' })
     // The child is proven gone, but the wind-down it owes is not done: nothing settled, no release.
-    expect(session!.hasProviderChild).toBe(false)
+    expect(session!.child).toBeNull()
     expect(store.getRecord(SESSION)?.lease.claimStatus).not.toBe('released')
 
     await expect(host.close(SESSION)).resolves.toBeUndefined()
@@ -370,31 +360,31 @@ describe('a chat that closes', () => {
 })
 
 describe('a session with a turn in flight', () => {
-  it('is not evicted while the turn runs, and is once it ends', async () => {
+  it('is not stopped while the turn runs, and is once it ends and idles', async () => {
     await attach()
-    await host.hold(SESSION, SURFACE)
     emitTurnLifecycle('running', 1)
     await host.flushStreamedEvents(SESSION)
 
-    host.release(SESSION, SURFACE)
-    await waitOutSeveralGraceWindows()
+    clock += IDLE_MS
+    await waitOutSeveralSweeps()
 
     expect(closeSession).not.toHaveBeenCalled()
     expect(host.hasSession(SESSION)).toBe(true)
 
     emitTurnLifecycle('completed', 2)
     await host.flushStreamedEvents(SESSION)
+    clock += IDLE_MS
 
     await waitForEviction()
   })
 
-  // Codex settles an admitted send only on its echo, which may never come; eviction retires it.
-  it('is evicted with an admitted send outstanding once no turn runs', async () => {
+  // Codex settles an admitted send only on its echo, which may never come; the stop retires it.
+  it('is stopped with an admitted send outstanding once no turn runs', async () => {
     await attach()
-    await host.hold(SESSION, SURFACE)
     await sendPending('admitted, never echoed')
+    await vi.waitFor(() => expect(dispatch).toHaveBeenCalledOnce())
 
-    host.release(SESSION, SURFACE)
+    clock += IDLE_MS
 
     await waitForEviction()
   })
@@ -404,26 +394,22 @@ describe('startup', () => {
   it('settles an idle absent owner without chat pollution and resumes the same provider identity', async () => {
     await attach()
     const beforeRestart = store.getRecord(SESSION)
-    host['runtimeState'].stopLeaseRenewal()
-    host['holds'].dispose()
-    await host['sessions'].get(SESSION)?.journal.close()
-    host['sessions'].clear()
+    await abandonStructuredAgentSessionHost(host)
 
     store = await AgentSessionRecordStore.open({ directory: join(root, 'store'), hostId: 'local' })
     openHost(async () => ({ outcome: 'pid-absent' }))
     await host.restoreReadableSessions()
 
-    const restored = host.history({ sessionId: SESSION, direction: 'tail' })
+    const restored = await host.history({ sessionId: SESSION, direction: 'tail' })
     expect(restored.ok && restored.page.items.some((item) => item.body.kind === 'status')).toBe(
       false
     )
     expect(store.getRecord(SESSION)?.lease).toMatchObject({
       claimStatus: 'released',
-      ownerProcess: null,
-      settlementRetryRequired: undefined
+      ownerProcess: null
     })
 
-    await host.hold(SESSION, SURFACE)
+    await startAgent()
     expect(store.getRecord(SESSION)?.providerHandleChain.at(-1)?.handle).toEqual(
       beforeRestart?.providerHandleChain.at(-1)?.handle
     )
@@ -441,16 +427,23 @@ describe('startup', () => {
     expect(host.listSessionTabs()).toEqual([
       { sessionId: SESSION, workspaceId: 'workspace-1', agent: 'codex' }
     ])
-    expect(host.history({ sessionId: SESSION, direction: 'tail' }).ok).toBe(true)
+    expect((await host.history({ sessionId: SESSION, direction: 'tail' })).ok).toBe(true)
     expect(store.getRecord(SESSION)?.lease.claimStatus).toBe('released')
   })
 
-  it('gives the child back to a chat a surface actually opens', async () => {
+  it('gives the child back for work, never for a read', async () => {
     await attach()
     await reboot()
     await host.restoreReadableSessions()
 
-    await host.hold(SESSION, SURFACE)
+    const unsubscribe = await host.subscribe({
+      id: 'viewer-1',
+      sessionId: SESSION,
+      emit: () => undefined
+    })
+    expect(acquire).not.toHaveBeenCalled()
+    await startAgent()
+    unsubscribe()
 
     expect(acquire).toHaveBeenCalledOnce()
     expect(store.getRecord(SESSION)?.lease).toMatchObject({
@@ -461,16 +454,15 @@ describe('startup', () => {
   })
 })
 
-describe('a session evicted and opened again', () => {
+describe('a session closed and started again', () => {
   it('publishes provider events to the reattached chat', async () => {
     await attach()
-    await host.hold(SESSION, SURFACE)
-    host.release(SESSION, SURFACE)
-    await waitForEviction()
+    await host.close(SESSION)
+    expect(host.hasSession(SESSION)).toBe(false)
 
-    await host.hold(SESSION, 'desktop-chat:2')
+    await startAgent()
     const events: AgentSessionSubscribeEvent[] = []
-    const unsubscribe = host.subscribe({
+    const unsubscribe = await host.subscribe({
       id: 'subscriber-1',
       sessionId: SESSION,
       emit: (event) => events.push(event)
@@ -487,6 +479,12 @@ describe('a session evicted and opened again', () => {
   })
 })
 
+async function submissionState(clientMessageId: string): Promise<string | undefined> {
+  return (await host.journalSnapshot(SESSION)).submissions.find(
+    (entry) => entry.clientMessageId === clientMessageId
+  )?.dispatchState
+}
+
 describe('an unexpected provider exit', () => {
   it('publishes terminal settlement to a waiting older client', async () => {
     await attach()
@@ -503,6 +501,8 @@ describe('an unexpected provider exit', () => {
     if (!result.ok) {
       throw new Error('send was refused')
     }
+    // Accepted first; the exit must meet a message the provider was handed.
+    await vi.waitFor(() => expect(dispatch).toHaveBeenCalledOnce())
     const settlement = host.waitForSendSettlement(SESSION, result.value.clientMessageId)
     const exitedFence = store.getRecord(SESSION)?.lease.runtimeFence ?? 0
 
@@ -526,7 +526,7 @@ describe('an unexpected provider exit', () => {
     await failJournalSinkUntilReleased()
 
     expect(dispatch).not.toHaveBeenCalled()
-    const history = host.history({ sessionId: SESSION, direction: 'tail' })
+    const history = await host.history({ sessionId: SESSION, direction: 'tail' })
     expect(
       history.ok &&
         history.page.items.some(
@@ -548,17 +548,18 @@ describe('an unexpected provider exit', () => {
     replaceFailedSink()
   })
 
-  it('releases the exact generation, reacquires outside the queue, and dispatches a new message', async () => {
+  it('releases the exact generation, starts nothing, and the next message starts a child', async () => {
     await attach()
-    await host.hold(SESSION, SURFACE)
     dispatch.mockRejectedValueOnce(new Error('provider delivery became unknown'))
     const unknownBody = hostTestMessage('message with unknown delivery')
+    const unknownEnvelope = envelope('agentSession.send', { body: unknownBody })
     await expect(
-      host.send(CALLER, {
-        envelope: envelope('agentSession.send', { body: unknownBody }),
-        body: unknownBody
-      })
-    ).resolves.toMatchObject({ ok: true, value: { submission: { dispatchState: 'unknown' } } })
+      host.send(CALLER, { envelope: unknownEnvelope, body: unknownBody })
+    ).resolves.toMatchObject({ ok: true, value: { submission: { dispatchState: 'pending' } } })
+    // Accepted, then handed over by the delivery loop, where the thrown dispatch becomes doubt.
+    await vi.waitFor(async () =>
+      expect(await submissionState(unknownEnvelope.clientOperationId)).toBe('unknown')
+    )
     const exitedFence = store.getRecord(SESSION)?.lease.runtimeFence ?? 0
 
     await host.handleAdapterEvent({
@@ -570,32 +571,42 @@ describe('an unexpected provider exit', () => {
       acquisitionGeneration: 'generation-1'
     })
 
-    const recoveredHistory = host.history({ sessionId: SESSION, direction: 'tail' })
+    const recoveredHistory = await host.history({ sessionId: SESSION, direction: 'tail' })
     expect(
       recoveredHistory.ok &&
         hasUnansweredStructuredAgentSessionDispatch(recoveredHistory.page.submissions)
     ).toBe(false)
-    expect(acquire).toHaveBeenCalledTimes(2)
+    // No respawn: the exit is settled and shown, and the conversation waits for work.
+    expect(acquire).toHaveBeenCalledOnce()
     expect(dispatch).toHaveBeenCalledOnce()
     expect(store.getRecord(SESSION)?.lease).toMatchObject({
-      claimStatus: 'live',
-      runtimeFence: exitedFence + 2,
-      ownerProcess: { pid: 4242 }
+      claimStatus: 'released',
+      runtimeFence: exitedFence + 1
     })
     dispatch.mockResolvedValueOnce({
       state: 'accepted',
       providerIdentity: { provider: 'codex', threadId: THREAD, turnId: 'turn-next', ordinal: 1 }
     })
     const body = hostTestMessage('a distinct next message')
-    await expect(
-      host.send(CALLER, { envelope: envelope('agentSession.send', { body }), body })
-    ).resolves.toMatchObject({ ok: true, value: { submission: { dispatchState: 'accepted' } } })
+    const nextEnvelope = envelope('agentSession.send', { body })
+    await expect(host.send(CALLER, { envelope: nextEnvelope, body })).resolves.toMatchObject({
+      ok: true,
+      value: { submission: { dispatchState: 'pending' } }
+    })
+    await vi.waitFor(async () =>
+      expect(await submissionState(nextEnvelope.clientOperationId)).toBe('accepted')
+    )
+    expect(acquire).toHaveBeenCalledTimes(2)
     expect(dispatch).toHaveBeenCalledTimes(2)
   })
 
-  it('does not reacquire for a subscription-only hold or a stale child generation', async () => {
+  it('does not reacquire for a live reader or a stale child generation', async () => {
     await attach()
-    await host.hold(SESSION, 'subscriber-1', { resume: false })
+    const unsubscribe = await host.subscribe({
+      id: 'subscriber-1',
+      sessionId: SESSION,
+      emit: () => undefined
+    })
     const exitedFence = store.getRecord(SESSION)?.lease.runtimeFence ?? 0
 
     await host.handleAdapterEvent({
@@ -623,11 +634,11 @@ describe('an unexpected provider exit', () => {
       runtimeFence: exitedFence + 1,
       deathEvidence: { kind: 'exit-observed' }
     })
+    unsubscribe()
   })
 
   it('keeps a requested close out of recovery', async () => {
     await attach()
-    await host.hold(SESSION, SURFACE)
     const fence = store.getRecord(SESSION)?.lease.runtimeFence ?? 0
 
     await host.handleAdapterEvent({
@@ -645,7 +656,6 @@ describe('an unexpected provider exit', () => {
 
   it('recovers after a failed lifecycle barrier and dispatches a distinct next message', async () => {
     await attach()
-    await host.hold(SESSION, SURFACE)
     dispatch.mockRejectedValueOnce(new Error('provider delivery became unknown'))
     const unknownBody = hostTestMessage('message with unknown delivery')
     const unknownParams = {
@@ -654,8 +664,11 @@ describe('an unexpected provider exit', () => {
     }
     await expect(host.send(CALLER, unknownParams)).resolves.toMatchObject({
       ok: true,
-      value: { submission: { dispatchState: 'unknown' } }
+      value: { submission: { dispatchState: 'pending' } }
     })
+    await vi.waitFor(async () =>
+      expect(await submissionState(unknownParams.envelope.clientOperationId)).toBe('unknown')
+    )
     const runtimeState = (
       host as unknown as {
         runtimeState: { lifecycleBarrier: () => Promise<{ ok: false; error: Error }> }
@@ -677,21 +690,20 @@ describe('an unexpected provider exit', () => {
     })
 
     expect(store.getRecord(SESSION)?.lease).toMatchObject({
-      claimStatus: 'live',
-      runtimeFence: exitedFence + 2,
-      ownerProcess: { pid: 4242 }
+      claimStatus: 'released',
+      runtimeFence: exitedFence + 1
     })
-    expect(acquire).toHaveBeenCalledTimes(2)
+    expect(acquire).toHaveBeenCalledOnce()
     expect(dispatch).toHaveBeenCalledOnce()
     expect(hostErrors).toContainEqual(expect.objectContaining({ message: 'journal failed' }))
-    const history = host.history({ sessionId: SESSION, direction: 'tail' })
+    const history = await host.history({ sessionId: SESSION, direction: 'tail' })
     expect(history.ok && history.page.submissions[0]?.dispatchState).toBe('unknown')
     // A send whose delivery outcome is unknown IS work in progress, so the reassuring outcome is
-    // written — carrying the cause, and never the old bare `Provider exited: <reason>` row.
+    // written — its failure fact beside it, and never the old bare `Provider exited: <reason>` row.
     const statuses = history.ok
       ? history.page.items.flatMap((item) => (item.body.kind === 'status' ? [item.body.text] : []))
       : []
-    expect(statuses).toEqual([unexpectedProviderExitOutcome('provider exited')])
+    expect(statuses).toEqual([UNEXPECTED_PROVIDER_EXIT_OUTCOME])
     expect(statuses.some((text) => text.startsWith('Provider exited'))).toBe(false)
 
     dispatch.mockResolvedValueOnce({
@@ -699,15 +711,19 @@ describe('an unexpected provider exit', () => {
       providerIdentity: { provider: 'codex', threadId: THREAD, turnId: 'turn-next', ordinal: 1 }
     })
     const body = hostTestMessage('a distinct next message after failed-barrier recovery')
-    await expect(
-      host.send(CALLER, { envelope: envelope('agentSession.send', { body }), body })
-    ).resolves.toMatchObject({ ok: true, value: { submission: { dispatchState: 'accepted' } } })
+    const nextEnvelope = envelope('agentSession.send', { body })
+    await expect(host.send(CALLER, { envelope: nextEnvelope, body })).resolves.toMatchObject({
+      ok: true,
+      value: { submission: { dispatchState: 'pending' } }
+    })
+    await vi.waitFor(async () =>
+      expect(await submissionState(nextEnvelope.clientOperationId)).toBe('accepted')
+    )
     expect(dispatch).toHaveBeenCalledTimes(2)
   })
 
-  it('latches a failed exit settlement and blocks attach until the terminal batch is written', async () => {
+  it('releases the lease when the exit settlement cannot be written, and the next send settles the turn it left', async () => {
     await attach()
-    await host.hold(SESSION, SURFACE)
     emitTurnLifecycle('running', 1)
     await host.flushStreamedEvents(SESSION)
     const runtimeState = (
@@ -728,7 +744,8 @@ describe('an unexpected provider exit', () => {
       }
     ).sessions.get(SESSION)
     expect(session).toBeDefined()
-    const appendSettlement = vi
+    // The conversation's one handle refuses every write of the exit's settlement.
+    const refusing = vi
       .spyOn(session!.journal, 'appendLifecycleBatch')
       .mockRejectedValue(new Error('settlement still unavailable'))
     const exitedFence = store.getRecord(SESSION)?.lease.runtimeFence ?? 0
@@ -742,30 +759,45 @@ describe('an unexpected provider exit', () => {
       acquisitionGeneration: 'generation-1'
     })
 
-    expect(store.getRecord(SESSION)?.lease).toMatchObject({
+    const released = store.getRecord(SESSION)?.lease
+    expect(released).toMatchObject({
       claimStatus: 'released',
-      handoffStage: 'recovering',
-      settlementRetryRequired: true,
-      settlementRetryId: `provider-exit:${SESSION}:${exitedFence}:generation-1`,
+      handoffStage: null,
       ownerProcess: null,
-      runtimeFence: exitedFence + 1
-    })
-    expect(await host.attach(CALLER, hostTestAttachParams(exitedFence + 1))).toMatchObject({
-      ok: false,
-      refusal: { code: 'agent_session_ownership_unknown' }
+      runtimeFence: exitedFence + 1,
+      deathEvidence: { kind: 'exit-observed', detail: 'provider exited', observedAt: NOW }
     })
-    expect(acquire).toHaveBeenCalledOnce()
+    // Nothing retries the settlement; the journal writes again, and the next acquire re-derives it.
+    refusing.mockRestore()
 
-    appendSettlement.mockRestore()
-    expect(await host.attach(CALLER, hostTestAttachParams(exitedFence + 1))).toMatchObject({
-      ok: true
+    dispatch.mockResolvedValueOnce({
+      state: 'accepted',
+      providerIdentity: { provider: 'codex', threadId: THREAD, turnId: 'turn-next', ordinal: 1 }
     })
-    expect(store.getRecord(SESSION)?.lease).toMatchObject({
-      claimStatus: 'live',
-      handoffStage: null,
-      settlementRetryRequired: undefined
+    const body = hostTestMessage('sent after a settlement that never landed')
+    const sentEnvelope = envelope('agentSession.send', { body })
+    await expect(host.send(CALLER, { envelope: sentEnvelope, body })).resolves.toMatchObject({
+      ok: true,
+      value: { submission: { dispatchState: 'pending' } }
     })
+    await vi.waitFor(async () =>
+      expect(await submissionState(sentEnvelope.clientOperationId)).toBe('accepted')
+    )
     expect(acquire).toHaveBeenCalledTimes(2)
+    // The new child's acquire settled the turn from the release's evidence: ended at the exit's
+    // receipt. The evidence is Orca's log text, so the row says only that the provider stopped.
+    const history = await host.history({ sessionId: SESSION, direction: 'tail' })
+    const items = history.ok ? history.page.items : []
+    expect(items.map((item) => readAgentJournalTurn(item.body)).filter(Boolean)).toContainEqual(
+      expect.objectContaining({ turnId: 'turn-1', state: 'interrupted', completedAt: NOW })
+    )
+    const statuses = items.flatMap((item) => (item.body.kind === 'status' ? [item.body] : []))
+    expect(statuses).toContainEqual({
+      kind: 'status',
+      text: UNEXPECTED_PROVIDER_EXIT_OUTCOME,
+      failure: { kind: 'providerExited' }
+    })
+    expect(statuses.map((status) => status.text).join('\n')).not.toContain('provider exited')
   })
 })
 
@@ -780,7 +812,7 @@ describe('a quit over an eviction that never got its retry', () => {
     failNextDrain()
 
     await expect(host.close(SESSION)).rejects.toMatchObject({ step: 'drain-published' })
-    expect(host['sessions'].get(SESSION)?.hasProviderChild).toBe(false)
+    expect(host['sessions'].get(SESSION)?.child).toBeNull()
     expect(store.getRecord(SESSION)?.lease.claimStatus).not.toBe('released')
 
     await host.flushAllStreamedEvents()
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-thread-goal.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-thread-goal.test.ts
index 3d4e84919861..f490eb2e9cdf 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-thread-goal.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-thread-goal.test.ts
@@ -125,7 +125,11 @@ describe('performThreadGoalChange', () => {
 
     expect(result).toEqual({
       ok: false,
-      refusal: { code: 'agent_session_operation_invalid', message: 'goals feature is disabled' }
+      refusal: {
+        code: 'agent_session_operation_invalid',
+        details: { reason: 'providerRejected' },
+        message: 'goals feature is disabled'
+      }
     })
     expect(journal.snapshot().items).toEqual([])
   })
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-thread-goal.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-thread-goal.ts
index 4e49e00f587e..639daf6ab30b 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-thread-goal.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-thread-goal.ts
@@ -1,6 +1,7 @@
 // `agentSession.threadGoal`: change the provider thread's goal through the same
 // admission, ledger and journal path every other session mutation takes.
 
+import { refuse, type AgentSessionRefusalReason } from '../../../shared/agent-session-wire-refusals'
 import type {
   AgentJournalItemIdentity,
   AgentJournalThreadGoal
@@ -13,8 +14,11 @@ import type {
 import type { MutationPlan } from './structured-agent-session-mutation-plans'
 import type { AgentSessionTurnContext, TurnOutcome } from './structured-agent-session-turns'
 
-function refused(message: string): TurnOutcome<AgentSessionThreadGoalResult> {
-  return { ok: false, refusal: { code: 'agent_session_operation_invalid', message } }
+function refused(
+  reason: AgentSessionRefusalReason<'agent_session_operation_invalid'>,
+  message: string
+): TurnOutcome<AgentSessionThreadGoalResult> {
+  return { ok: false, refusal: refuse('agent_session_operation_invalid', { reason }, message) }
 }
 
 /** Keyed by the operation, so a replayed set upserts its one objective row. */
@@ -44,7 +48,7 @@ export async function performThreadGoalChange(
   input: { clientOperationId: string; change: AgentSessionThreadGoalChange }
 ): Promise<TurnOutcome<AgentSessionThreadGoalResult>> {
   if (!ctx.adapter.changeThreadGoal || !ctx.adapter.supportsThreadGoal?.(ctx.sessionId)) {
-    return refused('Goals are unavailable for this chat session.')
+    return refused('goalsUnsupported', 'Goals are unavailable for this chat session.')
   }
   const { change } = input
   const identity = objectiveIdentity(input.clientOperationId)
@@ -68,13 +72,11 @@ export async function performThreadGoalChange(
       },
       { fence: ctx.fence }
     )
-    ctx.publish()
   }
   const withdrawObjective = async (): Promise<void> => {
     if (change.kind === 'set') {
       // Nothing was sent as a goal.
       await ctx.journal.appendTombstone(identity, { fence: ctx.fence })
-      ctx.publish()
     }
   }
   let result: Awaited<ReturnType<typeof ctx.adapter.changeThreadGoal>>
@@ -91,7 +93,7 @@ export async function performThreadGoalChange(
   }
   if (!result.ok) {
     await withdrawObjective()
-    return refused(result.rejected)
+    return refused('providerRejected', result.rejected)
   }
   return { ok: true, value: { change: change.kind } }
 }
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-turn-completion-feed.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-turn-completion-feed.test.ts
index c0e652724af8..93d4a54cdc92 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-turn-completion-feed.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-turn-completion-feed.test.ts
@@ -1,6 +1,18 @@
 import { describe, expect, it, vi } from 'vitest'
-import type { AgentJournalTurnLifecycle } from '../../../shared/agent-session-journal-types'
+import type {
+  AgentJournalRenderItem,
+  AgentJournalSubmission,
+  AgentJournalTurnLifecycle
+} from '../../../shared/agent-session-journal-types'
+import { agentJournalSubmissionKey } from '../../../shared/agent-session-journal-item-key'
 import type { AgentSessionTurnCompletionEvent } from '../../../shared/agent-session-wire'
+import {
+  DISPATCH_REJECTED_CANCELLED,
+  DISPATCH_REJECTED_HOST_RESTARTED,
+  DISPATCH_REJECTED_NOT_DELIVERED,
+  DISPATCH_REJECTED_PROVIDER_CLOSED
+} from '../../../shared/structured-agent-session-dispatch-rejection'
+import { projectStructuredAgentSessionStatusState } from '../../../shared/structured-agent-session-projection'
 import { StructuredAgentSessionTurnCompletionFeed } from './structured-agent-session-turn-completion-feed'
 
 const LOCATION = {
@@ -10,6 +22,8 @@ const LOCATION = {
   workspaceKind: 'git-worktree'
 } as const
 
+const START_FAILURE = 'Claude is not signed in.'
+
 function turn(
   turnId: string,
   state: AgentJournalTurnLifecycle['state'],
@@ -18,33 +32,102 @@ function turn(
   return { turnId, state, ...(outcome ? { outcome } : {}) }
 }
 
+function turnItem(lifecycle: AgentJournalTurnLifecycle, sequence: number): AgentJournalRenderItem {
+  return {
+    itemId: `codex:turn:${lifecycle.turnId}`,
+    revision: 1,
+    sequence,
+    observedAt: sequence,
+    body: { kind: 'turn', ...lifecycle }
+  }
+}
+
+function userEntry(clientMessageId: string, sequence: number): AgentJournalRenderItem {
+  return {
+    itemId: agentJournalSubmissionKey(clientMessageId),
+    revision: 0,
+    sequence,
+    observedAt: sequence,
+    body: { kind: 'message', role: 'user', blocks: [{ type: 'text', text: clientMessageId }] }
+  }
+}
+
+function sent(
+  clientMessageId: string,
+  fields: Partial<AgentJournalSubmission> & Pick<AgentJournalSubmission, 'dispatchState'>
+): AgentJournalSubmission {
+  return {
+    clientMessageId,
+    fence: 1,
+    payloadFingerprint: clientMessageId,
+    providerItemId: null,
+    reason: null,
+    submittedAt: 10,
+    resolvedAt: 20,
+    handoverRecorded: true,
+    ...fields
+  }
+}
+
+const pending = (clientMessageId: string, fence = 1) =>
+  sent(clientMessageId, { dispatchState: 'pending', fence, handedOverAt: 11, resolvedAt: null })
+const refused = (clientMessageId: string, reason = START_FAILURE) =>
+  sent(clientMessageId, { dispatchState: 'rejected', reason })
+
 function harness(): {
   feed: StructuredAgentSessionTurnCompletionFeed
   setTurn: (next: AgentJournalTurnLifecycle | null) => void
+  setJournal: (
+    items: AgentJournalRenderItem[],
+    submissions: AgentJournalSubmission[],
+    fence?: number
+  ) => void
   setCursor: (next: { epoch: string; sequence: number }) => void
   observe: () => void
   events: AgentSessionTurnCompletionEvent[]
+  outcomes: () => [string, string][]
+  /** Whether each completion said the user is being asked something. */
+  awaitingUser: () => boolean[]
   listen: () => () => void
 } {
-  let current: AgentJournalTurnLifecycle | null = null
+  let items: AgentJournalRenderItem[] = []
+  let submissions: AgentJournalSubmission[] = []
+  let fence: number | undefined
   let cursor = { epoch: 'epoch-1', sequence: 0 }
-  const journal = {
-    newestTurn: () => current,
-    cursor: () => cursor
-  }
+  const journal = { cursor: () => cursor }
   const sessions = new Map([['session-1', { journal, params: { location: LOCATION } }]])
-  const feed = new StructuredAgentSessionTurnCompletionFeed({ sessions, now: () => 1_700 })
+  const feed = new StructuredAgentSessionTurnCompletionFeed({
+    sessions,
+    now: () => 1_700,
+    // The status feed's projection, computed as it computes it.
+    readStatusState: () => projectStructuredAgentSessionStatusState(items, submissions, fence)
+  })
   const events: AgentSessionTurnCompletionEvent[] = []
   return {
     feed,
     setTurn: (next) => {
-      current = next
+      items = next ? [turnItem(next, 1)] : []
+      submissions = []
+    },
+    setJournal: (nextItems, nextSubmissions, nextFence) => {
+      items = nextItems
+      submissions = nextSubmissions
+      fence = nextFence
+      cursor = { ...cursor, sequence: cursor.sequence + 1 }
     },
     setCursor: (next) => {
       cursor = next
     },
     observe: () => feed.observe('session-1'),
     events,
+    outcomes: () =>
+      events.flatMap((event): [string, string][] =>
+        event.type === 'completion' ? [[event.completion.turnId, event.completion.outcome]] : []
+      ),
+    awaitingUser: () =>
+      events.flatMap((event) =>
+        event.type === 'completion' ? [event.completion.awaitingUser === true] : []
+      ),
     listen: () => feed.subscribe({ id: 'sub', emit: (event) => events.push(event) })
   }
 }
@@ -59,7 +142,8 @@ describe('StructuredAgentSessionTurnCompletionFeed', () => {
     h.setTurn(turn('turn-1', 'completed', 'success'))
     h.setCursor({ epoch: 'epoch-1', sequence: 2 })
     h.observe()
-    expect(h.events).toEqual([
+    // Strict: an idle settle omits `awaitingUser` rather than sending it undefined.
+    expect(h.events).toStrictEqual([
       {
         type: 'completion',
         completion: {
@@ -261,3 +345,318 @@ describe('StructuredAgentSessionTurnCompletionFeed', () => {
     expect(emit).not.toHaveBeenCalled()
   })
 })
+
+describe('a request the agent or its start refused', () => {
+  const M1 = agentJournalSubmissionKey('m1')
+  const M2 = agentJournalSubmissionKey('m2')
+  const M3 = agentJournalSubmissionKey('m3')
+  const settledTurn = turnItem(turn('t1', 'completed', 'success'), 2)
+
+  /** A session whose first turn succeeded, as the feed saw it happen. */
+  function afterSuccessfulTurn() {
+    const h = harness()
+    h.listen()
+    h.setJournal([userEntry('m1', 1), turnItem(turn('t1', 'running'), 2)], [])
+    h.observe()
+    h.setJournal([userEntry('m1', 1), settledTurn], [sent('m1', { dispatchState: 'accepted' })])
+    h.observe()
+    expect(h.outcomes()).toEqual([['t1', 'success']])
+    return h
+  }
+
+  it('notifies failed once when the only send fails to start, named by its item key', () => {
+    const h = harness()
+    h.listen()
+    h.observe()
+    h.setJournal([userEntry('m1', 1)], [pending('m1')])
+    h.observe()
+    h.setJournal([userEntry('m1', 1)], [refused('m1')])
+    h.observe()
+    h.observe()
+    expect(h.events).toEqual([
+      {
+        type: 'completion',
+        completion: {
+          scope: LOCATION,
+          sessionId: 'session-1',
+          turnId: M1,
+          outcome: 'failure',
+          completedAt: 1_700
+        }
+      }
+    ])
+  })
+
+  it('stays silent on a first observation of a send that had already failed', () => {
+    // A restart, reopen or re-attach: the failure is history, not news.
+    const h = harness()
+    h.listen()
+    h.setJournal([userEntry('m1', 1)], [refused('m1')])
+    h.observe()
+    h.observe()
+    expect(h.events).toEqual([])
+  })
+
+  it('re-baselines an epoch replacement that surfaces an older failure', () => {
+    const h = afterSuccessfulTurn()
+    h.setJournal([userEntry('m1', 1)], [refused('m1')])
+    h.setCursor({ epoch: 'epoch-2', sequence: 1 })
+    h.observe()
+    expect(h.outcomes()).toEqual([['t1', 'success']])
+  })
+
+  it.each([
+    DISPATCH_REJECTED_CANCELLED,
+    DISPATCH_REJECTED_HOST_RESTARTED,
+    DISPATCH_REJECTED_PROVIDER_CLOSED,
+    DISPATCH_REJECTED_NOT_DELIVERED
+  ])('never notifies a send %s, alone or after a turn', (reason) => {
+    const alone = harness()
+    alone.listen()
+    alone.observe()
+    alone.setJournal([userEntry('m1', 1)], [pending('m1')])
+    alone.observe()
+    alone.setJournal([userEntry('m1', 1)], [refused('m1', reason)])
+    alone.observe()
+    expect(alone.events).toEqual([])
+
+    // The latest request falls back to the turn already announced, which must not announce again.
+    const h = afterSuccessfulTurn()
+    const accepted = sent('m1', { dispatchState: 'accepted' })
+    h.setJournal([userEntry('m1', 1), settledTurn, userEntry('m2', 3)], [accepted, pending('m2')])
+    h.observe()
+    h.setJournal(
+      [userEntry('m1', 1), settledTurn, userEntry('m2', 3)],
+      [accepted, refused('m2', reason)]
+    )
+    h.observe()
+    expect(h.outcomes()).toEqual([['t1', 'success']])
+  })
+
+  it('never notifies a crash-stranded send that restart reconciliation finds undelivered', () => {
+    const h = afterSuccessfulTurn()
+    const items = [userEntry('m1', 1), settledTurn, userEntry('m2', 3)]
+    const accepted = sent('m1', { dispatchState: 'accepted' })
+    h.setJournal(items, [accepted, sent('m2', { dispatchState: 'unknown', recovered: true })], 2)
+    h.observe()
+    h.setJournal(
+      items,
+      [
+        accepted,
+        sent('m2', {
+          dispatchState: 'rejected',
+          reason: DISPATCH_REJECTED_NOT_DELIVERED,
+          fence: 2,
+          recovered: true
+        })
+      ],
+      2
+    )
+    h.observe()
+    expect(h.outcomes()).toEqual([['t1', 'success']])
+  })
+
+  it('notifies failed, then success, when a failed start is retried and the retry succeeds', () => {
+    const h = harness()
+    h.listen()
+    h.observe()
+    h.setJournal([userEntry('m1', 1)], [refused('m1')])
+    h.observe()
+    h.setJournal([userEntry('m1', 1), userEntry('m2', 2)], [refused('m1'), pending('m2')])
+    h.observe()
+    const accepted = sent('m2', { dispatchState: 'accepted' })
+    h.setJournal(
+      [userEntry('m1', 1), userEntry('m2', 2), turnItem(turn('t2', 'running'), 3)],
+      [refused('m1'), accepted]
+    )
+    h.observe()
+    h.setJournal(
+      [userEntry('m1', 1), userEntry('m2', 2), turnItem(turn('t2', 'completed', 'success'), 3)],
+      [refused('m1'), accepted]
+    )
+    h.observe()
+    expect(h.outcomes()).toEqual([
+      [M1, 'failure'],
+      ['t2', 'success']
+    ])
+  })
+
+  it('notifies each failed start that follows another', () => {
+    const h = harness()
+    h.listen()
+    h.observe()
+    h.setJournal([userEntry('m1', 1)], [refused('m1')])
+    h.observe()
+    h.setJournal([userEntry('m1', 1), userEntry('m2', 2)], [refused('m1'), pending('m2')])
+    h.observe()
+    h.setJournal([userEntry('m1', 1), userEntry('m2', 2)], [refused('m1'), refused('m2')])
+    h.observe()
+    expect(h.outcomes()).toEqual([
+      [M1, 'failure'],
+      [M2, 'failure']
+    ])
+  })
+
+  it.each([
+    ['in one commit', [['m2', 'm3']]],
+    ['oldest first, across commits', [['m2'], ['m3']]],
+    ['newest first, across commits', [['m3'], ['m2']]]
+  ])('notifies once for queued sends one start failure refused %s', (_name, batches) => {
+    const h = afterSuccessfulTurn()
+    const items = [userEntry('m1', 1), settledTurn, userEntry('m2', 3), userEntry('m3', 4)]
+    const accepted = sent('m1', { dispatchState: 'accepted' })
+    const queued = (id: string) => sent(id, { dispatchState: 'pending', resolvedAt: null })
+    const answered = new Set<string>()
+    const submissions = () => [
+      accepted,
+      ...['m2', 'm3'].map((id) => (answered.has(id) ? refused(id) : queued(id)))
+    ]
+    h.setJournal(items, submissions())
+    h.observe()
+    for (const batch of batches) {
+      batch.forEach((id) => answered.add(id))
+      h.setJournal(items, submissions())
+      h.observe()
+    }
+    expect(h.outcomes()).toEqual([
+      ['t1', 'success'],
+      [M3, 'failure']
+    ])
+  })
+
+  it('does not wait on a send left pending at an older fence', () => {
+    const h = harness()
+    h.listen()
+    h.setJournal([userEntry('m1', 1), userEntry('m2', 2)], [pending('m1', 1), pending('m2', 2)], 2)
+    h.observe()
+    h.setJournal([userEntry('m1', 1), userEntry('m2', 2)], [pending('m1', 1), refused('m2')], 2)
+    h.observe()
+    expect(h.outcomes()).toEqual([[M2, 'failure']])
+  })
+})
+
+describe('a request that settles while the user is asked something', () => {
+  const M1 = agentJournalSubmissionKey('m1')
+
+  /** An approval the user has not answered; `agentId` makes it a subagent's. */
+  function approval(
+    itemId: string,
+    sequence: number,
+    state: 'pending' | 'resolved',
+    agentId?: string
+  ): AgentJournalRenderItem {
+    return {
+      itemId,
+      revision: state === 'pending' ? 1 : 2,
+      sequence,
+      observedAt: sequence,
+      ...(agentId ? { agentId } : {}),
+      body: {
+        kind: 'approval',
+        title: 'Run command?',
+        detail: null,
+        options: [{ id: 'yes', label: 'Allow' }],
+        resolution: { state, selectedOptionId: null, resolvedBy: null, resolvedAt: null }
+      }
+    }
+  }
+
+  it('notifies once when the main turn settles while a subagent waits on an approval', () => {
+    const h = harness()
+    h.listen()
+    const user = userEntry('m1', 1)
+    const accepted = [sent('m1', { dispatchState: 'accepted' })]
+    h.setJournal([user, turnItem(turn('t1', 'running'), 2)], accepted)
+    h.observe()
+    h.setJournal(
+      [user, turnItem(turn('t1', 'running'), 2), approval('a1', 3, 'pending', 'child-1')],
+      accepted
+    )
+    h.observe()
+    h.setJournal(
+      [
+        user,
+        turnItem(turn('t1', 'completed', 'success'), 2),
+        approval('a1', 3, 'pending', 'child-1')
+      ],
+      accepted
+    )
+    h.observe()
+    expect(h.outcomes()).toEqual([['t1', 'success']])
+    expect(h.awaitingUser()).toEqual([true])
+
+    // Answering the prompt settles the session idle on the request already announced.
+    h.setJournal(
+      [
+        user,
+        turnItem(turn('t1', 'completed', 'success'), 2),
+        approval('a1', 3, 'resolved', 'child-1')
+      ],
+      accepted
+    )
+    h.observe()
+    expect(h.outcomes()).toEqual([['t1', 'success']])
+  })
+
+  it('notifies a refused send once while a prompt is pending', () => {
+    const h = harness()
+    h.listen()
+    const prompt = approval('a1', 1, 'pending', 'child-1')
+    h.setJournal([prompt, userEntry('m1', 2)], [pending('m1')])
+    h.observe()
+    h.setJournal([prompt, userEntry('m1', 2)], [refused('m1')])
+    h.observe()
+    expect(h.outcomes()).toEqual([[M1, 'failure']])
+    expect(h.awaitingUser()).toEqual([true])
+    h.setJournal([approval('a1', 1, 'resolved', 'child-1'), userEntry('m1', 2)], [refused('m1')])
+    h.observe()
+    expect(h.outcomes()).toEqual([[M1, 'failure']])
+  })
+
+  it('sends nothing while the main turn asks for permission, and one event when it settles', () => {
+    const h = harness()
+    h.listen()
+    const user = userEntry('m1', 1)
+    const accepted = [sent('m1', { dispatchState: 'accepted' })]
+    h.setJournal([user, turnItem(turn('t1', 'running'), 2)], accepted)
+    h.observe()
+    h.setJournal([user, turnItem(turn('t1', 'running'), 2), approval('a1', 3, 'pending')], accepted)
+    h.observe()
+    expect(h.events).toEqual([])
+    h.setJournal(
+      [user, turnItem(turn('t1', 'running'), 2), approval('a1', 3, 'resolved')],
+      accepted
+    )
+    h.observe()
+    h.setJournal(
+      [user, turnItem(turn('t1', 'completed', 'success'), 2), approval('a1', 3, 'resolved')],
+      accepted
+    )
+    h.observe()
+    expect(h.outcomes()).toEqual([['t1', 'success']])
+    // Idle when it settles: the prompt was already answered.
+    expect(h.awaitingUser()).toEqual([false])
+  })
+
+  it('still waits on a queued send the prompt hides, so the queue notifies once', () => {
+    const h = harness()
+    h.listen()
+    const prompt = approval('a1', 3, 'pending', 'child-1')
+    const items = [userEntry('m1', 1), turnItem(turn('t1', 'running'), 2), prompt]
+    const queued = sent('m2', { dispatchState: 'pending', resolvedAt: null })
+    const accepted = sent('m1', { dispatchState: 'accepted' })
+    h.setJournal([...items, userEntry('m2', 4)], [accepted, queued])
+    h.observe()
+    h.setJournal(
+      [
+        userEntry('m1', 1),
+        turnItem(turn('t1', 'completed', 'success'), 2),
+        prompt,
+        userEntry('m2', 4)
+      ],
+      [accepted, queued]
+    )
+    h.observe()
+    expect(h.events).toEqual([])
+  })
+})
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-turn-completion-feed.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-turn-completion-feed.ts
index 1281fbec49bf..ca9f64c05731 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-turn-completion-feed.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-turn-completion-feed.ts
@@ -1,4 +1,5 @@
-// The host's answer to "a turn just finished", derived once per journal commit.
+// The host's answer to "a request just finished", derived once per journal commit. A request is
+// the one the status row reports: a turn, or a send the agent or its start refused.
 //
 // WHY THE HOST DERIVES IT: a structured session runs on the execution host and keeps journalling
 // whether or not any renderer has a reader mounted. A client that derived completions itself would
@@ -10,41 +11,45 @@
 // needs, a completion is an edge that has already passed. Keeping a queue would create a durable
 // obligation with nothing to retire it.
 
-import type { AgentJournalTurnLifecycle } from '../../../shared/agent-session-journal-types'
 import type { AgentSessionRecord } from '../../../shared/agent-session-record'
-import { readAgentJournalTurnOutcome } from '../../../shared/agent-session-turn-record'
 import type {
   AgentSessionTurnCompletion,
   AgentSessionTurnCompletionEvent
 } from '../../../shared/agent-session-wire'
+import type { StructuredAgentSessionLatestRequest } from '../../../shared/structured-agent-session-latest-request'
 import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
+import type { StructuredAgentSessionStatusState } from './structured-agent-session-status-feed'
 
 export type StructuredAgentSessionTurnCompletionSubscriber = {
   id: string
   emit: (event: AgentSessionTurnCompletionEvent) => void
 }
 
-/** Only the newest-turn reader and cursor are needed here; asking for the whole journal would overstate it. */
 type CompletionFeedCursor = { epoch: string; sequence: number }
 
-type CompletionFeedJournal = Pick<AgentSessionJournal, 'newestTurn' | 'cursor'>
-
 type CompletionFeedSession = {
-  journal: CompletionFeedJournal
+  journal: Pick<AgentSessionJournal, 'cursor'>
   params: { location: AgentSessionRecord['location'] }
 }
 
 export type StructuredAgentSessionTurnCompletionFeedDeps = {
   sessions: ReadonlyMap<string, CompletionFeedSession>
   now: () => number
+  /** The status feed's projection for this commit, so the event follows the request its row reports. */
+  readStatusState: (
+    sessionId: string,
+    journal?: AgentSessionJournal
+  ) => StructuredAgentSessionStatusState | null
 }
 
-/** Per-session baseline. `settledTurnId` is the last settled turn this feed has accounted for;
+type RequestMark = Pick<StructuredAgentSessionLatestRequest, 'kind' | 'id'>
+
+/** Per-session baseline. `settled` is the last settled request this feed has accounted for;
  *  absence of the whole entry — not a null field — is what makes the first observation silent. */
-type SessionBaseline = CompletionFeedCursor & { settledTurnId: string | null }
+type SessionBaseline = CompletionFeedCursor & { settled: RequestMark | null }
 
-function isSettled(turn: AgentJournalTurnLifecycle | null): turn is AgentJournalTurnLifecycle {
-  return turn !== null && turn.state !== 'running'
+function settledMark(request: StructuredAgentSessionLatestRequest | null): RequestMark | null {
+  return request && !request.running ? { kind: request.kind, id: request.id } : null
 }
 
 export class StructuredAgentSessionTurnCompletionFeed {
@@ -80,29 +85,24 @@ export class StructuredAgentSessionTurnCompletionFeed {
 
   /**
    * One journal publication. Emits at most one completion, and only on the transition into a
-   * settled turn this feed has not already accounted for.
+   * settled request this feed has not already accounted for.
    *
    * The first observation of a session only records where it is, so restore, restart, rewind and
-   * a re-read of history all pass through silently. An already-settled turn republished by an
-   * in-place revision carries the same turn id and so cannot fire twice.
+   * a re-read of history all pass through silently. An already-settled request republished by an
+   * in-place revision carries the same identity and so cannot fire twice.
    */
-  observe(sessionId: string, journal?: CompletionFeedJournal): void {
+  observe(sessionId: string, journal?: AgentSessionJournal): void {
     const session = this.deps.sessions.get(sessionId)
-    if (!session) {
+    const state = session ? this.deps.readStatusState(sessionId, journal) : null
+    if (!session || !state) {
       return
     }
-    const source = journal ?? session.journal
-    const cursor = source.cursor()
-    const turn = source.newestTurn()
-    const settled = isSettled(turn) ? turn : null
+    const cursor = (journal ?? session.journal).cursor()
+    const request = state.latestRequest
     const baseline = this.baselines.get(sessionId)
     if (!baseline) {
       // Baseline only. Whatever the session was already holding is history, not news.
-      this.baselines.set(sessionId, {
-        epoch: cursor.epoch,
-        sequence: cursor.sequence,
-        settledTurnId: settled?.turnId ?? null
-      })
+      this.baselines.set(sessionId, { ...cursor, settled: settledMark(request) })
       return
     }
     if (baseline.epoch !== cursor.epoch || cursor.sequence < baseline.sequence) {
@@ -111,24 +111,31 @@ export class StructuredAgentSessionTurnCompletionFeed {
       // newest settled row as a fresh completion.
       baseline.epoch = cursor.epoch
       baseline.sequence = cursor.sequence
-      baseline.settledTurnId = settled?.turnId ?? null
+      baseline.settled = settledMark(request)
       return
     }
     baseline.sequence = cursor.sequence
-    if (!settled) {
+    if (request?.running) {
       // A running turn clears the mark, so this detector fires on each running → settled
       // transition rather than on an id it happens not to have seen.
-      baseline.settledTurnId = null
+      baseline.settled = null
       return
     }
-    if (baseline.settledTurnId === settled.turnId) {
+    // Owed work waits, so sends refused one commit at a time announce once, when the last is
+    // answered. A pending prompt does not wait (structured chat has no other attention producer):
+    // the event says so itself, and answering it keeps the same identity.
+    // A withdrawn send leaves the older request latest.
+    if (
+      state.owesWork ||
+      !request ||
+      (baseline.settled?.kind === request.kind && baseline.settled.id === request.id)
+    ) {
       return
     }
-    baseline.settledTurnId = settled.turnId
+    baseline.settled = settledMark(request)
     // ABSENT OUTCOME IS UNKNOWN: a turn the host only saw stop carries no verdict and gets no
     // event. Inferring success here is the one mistake that would light the dot on a failure.
-    const outcome = readAgentJournalTurnOutcome(settled)
-    if (!outcome) {
+    if (!request.outcome) {
       return
     }
     this.broadcast({
@@ -136,9 +143,11 @@ export class StructuredAgentSessionTurnCompletionFeed {
       completion: {
         scope: session.params.location,
         sessionId,
-        turnId: settled.turnId,
-        outcome,
-        completedAt: this.deps.now()
+        turnId: request.id,
+        outcome: request.outcome,
+        completedAt: this.deps.now(),
+        // Stated here, not joined from the status stream: remote clients receive the two unordered.
+        ...(state.summary.status === 'attention' ? { awaitingUser: true } : {})
       }
     })
   }
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-turns-options.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-turns-options.ts
index cb1685405a1b..9230e56cbe83 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-turns-options.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-turns-options.ts
@@ -1,4 +1,4 @@
-import type { AgentSessionOptionResult } from '../../../shared/agent-session-wire'
+import { refuse, type AgentSessionOptionResult } from '../../../shared/agent-session-wire'
 import { isAgentSessionOptionRejectedError } from './structured-agent-session-option-error'
 import type { AgentSessionTurnContext, TurnOutcome } from './structured-agent-session-turns'
 
@@ -17,7 +17,11 @@ export async function performSetOption(
     if (isAgentSessionOptionRejectedError(error)) {
       return {
         ok: false,
-        refusal: { code: 'agent_session_operation_invalid', message: error.message }
+        refusal: refuse(
+          'agent_session_operation_invalid',
+          { reason: error.refusalReason },
+          error.message
+        )
       }
     }
     throw error
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-turns-prompt.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-turns-prompt.ts
index 6ac29cab0ab5..f10b64be1dbd 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-turns-prompt.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-turns-prompt.ts
@@ -1,59 +1,103 @@
+import { agentSessionFailureFact } from '../../../shared/agent-session-failure'
+import { agentSessionFailureWords } from '../../../shared/agent-session-failure-words'
 import { parseAgentJournalItemKey } from '../../../shared/agent-session-journal-item-key'
 import {
-  decodeAgentSessionQuestionAnswers,
-  isValidAgentSessionQuestionAnswers
+  agentSessionPromptQuestions,
+  isValidAgentSessionQuestionAnswers,
+  legacyAgentSessionQuestionAnswers,
+  legacyAgentSessionSelectedOptionId,
+  type AgentSessionPromptResponse,
+  type AgentSessionQuestionAnswer
 } from '../../../shared/agent-session-question-answer'
-import type { AgentJournalResolution } from '../../../shared/agent-session-journal-types'
-import type { AgentSessionPromptResult } from '../../../shared/agent-session-wire'
-import { decodeCodexQuestionOptionId } from '../../codex/codex-structured-prompt-replies'
-import { AgentSessionPromptUnavailableError } from './structured-agent-session-adapter'
+import type {
+  AgentJournalApprovalItem,
+  AgentJournalQuestionItem,
+  AgentJournalResolution
+} from '../../../shared/agent-session-journal-types'
+import {
+  refuse,
+  type AgentSessionPromptResult,
+  type AgentSessionRefusalReason
+} from '../../../shared/agent-session-wire'
+import {
+  AgentSessionPromptAnswerRejectedError,
+  AgentSessionPromptUnavailableError
+} from './structured-agent-session-adapter'
 import { validatePendingPrompt } from './structured-agent-session-prompt-state'
 import type { AgentSessionTurnContext, TurnOutcome } from './structured-agent-session-turns'
 
-function invalid(message: string): TurnOutcome<never> {
-  return { ok: false, refusal: { code: 'agent_session_operation_invalid', message } }
+export type AgentSessionPromptRequest = {
+  itemId: string
+  expectedRevision: number
+  kind: 'approval' | 'question'
+  /** A decision id; or, from a client that predates `answers`, a question answer packed into one id. */
+  optionId?: string
+  answers?: AgentSessionQuestionAnswer[]
+}
+
+function invalid(
+  reason: AgentSessionRefusalReason<'agent_session_operation_invalid'>,
+  message: string
+): TurnOutcome<never> {
+  return { ok: false, refusal: refuse('agent_session_operation_invalid', { reason }, message) }
+}
+
+/** The one place a client's choice is read; an answer an older client packed into `optionId` is unpacked here, once. */
+function readPromptChoice(
+  prompt: AgentJournalApprovalItem | AgentJournalQuestionItem,
+  input: AgentSessionPromptRequest
+): { response: AgentSessionPromptResponse; selectedOptionId: string } | null {
+  if (prompt.kind === 'approval') {
+    const optionId = input.optionId
+    return optionId !== undefined && prompt.options.some((option) => option.id === optionId)
+      ? { response: { kind: 'option', optionId }, selectedOptionId: optionId }
+      : null
+  }
+  const answers =
+    input.answers ??
+    (input.optionId === undefined
+      ? null
+      : legacyAgentSessionQuestionAnswers(prompt, input.optionId))
+  if (
+    !answers ||
+    !isValidAgentSessionQuestionAnswers(agentSessionPromptQuestions(prompt), answers)
+  ) {
+    return null
+  }
+  const selectedOptionId = legacyAgentSessionSelectedOptionId(prompt, answers)
+  return selectedOptionId === null
+    ? null
+    : { response: { kind: 'answers', answers }, selectedOptionId }
 }
 
 export async function performPrompt(
   ctx: AgentSessionTurnContext,
-  input: {
-    itemId: string
-    expectedRevision: number
-    optionId: string
-    kind: 'approval' | 'question'
-  }
+  input: AgentSessionPromptRequest
 ): Promise<TurnOutcome<AgentSessionPromptResult>> {
   const validated = validatePendingPrompt(ctx, input)
   if (!validated.ok) {
     return validated
   }
   const { prompt } = validated
-  const question = prompt.kind === 'question' ? prompt : null
-  const freeText = decodeCodexQuestionOptionId(input.optionId)
-  const acceptsFreeText =
-    question?.freeTextQuestionId !== undefined &&
-    freeText?.questionId === question.freeTextQuestionId &&
-    freeText.answer.trim().length > 0
-  const grouped = question?.questions ? decodeAgentSessionQuestionAnswers(input.optionId) : null
-  const acceptsGrouped =
-    grouped !== null &&
-    question?.questions !== undefined &&
-    isValidAgentSessionQuestionAnswers(question.questions, grouped)
-  if (
-    !acceptsFreeText &&
-    !acceptsGrouped &&
-    !prompt.options.some((option) => option.id === input.optionId)
-  ) {
-    return invalid(`Option ${input.optionId} is not offered by item ${input.itemId}.`)
+  const choice = readPromptChoice(prompt, input)
+  if (!choice) {
+    return invalid(
+      'optionRejected',
+      input.optionId !== undefined
+        ? `Option ${input.optionId} is not offered by item ${input.itemId}.`
+        : `The answers do not match the questions on item ${input.itemId}.`
+    )
   }
+  const { response } = choice
   const identity = parseAgentJournalItemKey(input.itemId)
   if (!identity) {
-    return invalid(`Item id ${input.itemId} is not a well-formed item key.`)
+    return invalid('requestMalformed', `Item id ${input.itemId} is not a well-formed item key.`)
   }
 
   const resolution: AgentJournalResolution = {
     state: 'resolved',
-    selectedOptionId: input.optionId,
+    selectedOptionId: choice.selectedOptionId,
+    ...(response.kind === 'answers' ? { answers: response.answers } : {}),
     resolvedBy: ctx.resolvedBy,
     resolvedAt: ctx.now()
   }
@@ -63,7 +107,7 @@ export async function performPrompt(
       sessionId: ctx.sessionId,
       itemId: input.itemId,
       kind: input.kind,
-      optionId: input.optionId,
+      response,
       fence: ctx.fence,
       commit: async () => {
         committed.item = await ctx.journal.appendItem(
@@ -73,27 +117,29 @@ export async function performPrompt(
             fence: ctx.fence
           }
         )
-        ctx.publish()
       }
     })
   } catch (error) {
     if (!committed.item && error instanceof AgentSessionPromptUnavailableError) {
-      return invalid(error.message)
+      return invalid('promptGone', error.message)
+    }
+    if (!committed.item && error instanceof AgentSessionPromptAnswerRejectedError) {
+      return invalid('optionRejected', error.message)
     }
     if (!committed.item) {
       throw error
     }
+    // The adapter's error is Orca's; the row says only what the user needs to know.
     await ctx.journal.appendItem(
       { provider: 'orca', clientMessageId: `${input.itemId}#delivery` },
       {
         kind: 'status',
-        text: `Your answer was recorded but the agent did not confirm it: ${
-          error instanceof Error ? error.message : String(error)
-        }`
+        ...agentSessionFailureWords(agentSessionFailureFact('answerUnconfirmed'), {
+          surface: 'row'
+        })
       },
       { fence: ctx.fence }
     )
-    ctx.publish()
   }
   const appended = committed.item
   if (!appended) {
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-turns.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-turns.ts
index bea393eddbbb..49642b9a897e 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-turns.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-turns.ts
@@ -1,19 +1,27 @@
 // The effects behind send / cancel / respond / setOption.
 //
-// Admission (lease, fence, idempotency) has already passed by the time anything
+// Admission (writer lease, idempotency) has already passed by the time anything
 // here runs; these functions own only the journal writes and the adapter call,
 // in that order. Journal first is deliberate: a crash between the two leaves a
 // row the next attach settles as `unknown`, whereas the reverse would lose a
 // turn the provider already accepted.
 
+import { agentSessionFailureFact } from '../../../shared/agent-session-failure'
+import {
+  agentSessionFailureWords,
+  type AgentSessionFailureWordsContext
+} from '../../../shared/agent-session-failure-words'
 import type {
   AgentJournalMessageItem,
+  AgentJournalStatusItem,
   AgentJournalSubmission
 } from '../../../shared/agent-session-journal-types'
-import type {
-  AgentSessionCancelResult,
-  AgentSessionSendResult,
-  AgentSessionWireRefusal
+import {
+  refuse,
+  type AgentSessionCancelResult,
+  type AgentSessionRefusalReason,
+  type AgentSessionSendResult,
+  type AgentSessionWireRefusal
 } from '../../../shared/agent-session-wire'
 import { DISPATCH_DOUBT_PERSISTENCE_FAILED } from '../agent-session-journal/journal-dispatch-doubt-reasons'
 import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
@@ -23,13 +31,9 @@ import type {
   StructuredAgentSessionAdapter,
   StructuredAgentSessionProviderChildPhase
 } from './structured-agent-session-adapter'
-import { providerStartupFailureRejection } from './structured-agent-session-dead-generation-settlement'
+import { structuredAgentSessionStartFailure } from './structured-agent-session-failure-text'
 import { validatePendingPrompt } from './structured-agent-session-prompt-state'
-import { withTimeout } from '../../../shared/promise-timeout-fallback'
-import {
-  AgentSessionPreDispatchError,
-  AGENT_SESSION_ADMISSION_BARRIER_TIMEOUT_MS
-} from './structured-agent-session-operation-settlement'
+import { agentJournalSubmissionKey } from '../../../shared/agent-session-journal-item-key'
 export { performSetOption } from './structured-agent-session-turns-options'
 export { performPrompt } from './structured-agent-session-turns-prompt'
 
@@ -42,11 +46,11 @@ export type AgentSessionTurnContext = {
   persistOptions: (options: Readonly<Record<string, string>>) => Promise<void>
   /** Opaque client identity recorded as the resolver of a prompt. */
   resolvedBy: string
+  /** Republishes state kept outside the journal, such as the record's options or rewind phase.
+   *  Journal appends reach readers on their own. */
   publish: () => void
   /** Drains provider lifecycle already accepted by the execution host. */
   flushStreamedEvents: () => Promise<void>
-  /** Re-derives authorization after submission persistence, immediately before provider dispatch. */
-  beforeDispatch?: () => void
   /** What the host holds about the child this dispatch is for, read at the moment it is needed. */
   providerChildPhase?: () => StructuredAgentSessionProviderChildPhase | undefined
   now: () => number
@@ -56,8 +60,11 @@ export type TurnOutcome<TValue> =
   | { ok: true; value: TValue }
   | { ok: false; refusal: AgentSessionWireRefusal }
 
-function invalid(message: string): { ok: false; refusal: AgentSessionWireRefusal } {
-  return { ok: false, refusal: { code: 'agent_session_operation_invalid', message } }
+function invalid(
+  reason: AgentSessionRefusalReason<'agent_session_operation_invalid'>,
+  message: string
+): { ok: false; refusal: AgentSessionWireRefusal } {
+  return { ok: false, refusal: refuse('agent_session_operation_invalid', { reason }, message) }
 }
 
 /** A thrown adapter error is indistinguishable from a lost reply, so it settles as `unknown`
@@ -65,10 +72,10 @@ function invalid(message: string): { ok: false; refusal: AgentSessionWireRefusal
  *  accepted nothing (input is written only after it initializes), so a dispatch it could not
  *  take is provably unwritten and is rejected with the cause the adapter gave. */
 async function dispatchSafely(
-  ctx: AgentSessionTurnContext,
+  ctx: AgentSessionHandoverContext,
   clientMessageId: string,
   body: AgentJournalMessageItem,
-  requestedAt: number | undefined
+  requestedAt: number
 ): Promise<AgentSessionDispatchOutcome> {
   try {
     return await ctx.adapter.dispatch({
@@ -76,15 +83,14 @@ async function dispatchSafely(
       clientMessageId,
       body,
       fence: ctx.fence,
-      ...(ctx.beforeDispatch ? { beforeDispatch: async () => ctx.beforeDispatch?.() } : {}),
-      ...(requestedAt === undefined ? {} : { requestedAt })
+      requestedAt
     })
   } catch (error) {
-    if (error instanceof AgentSessionPreDispatchError) {
-      throw error
-    }
     if (ctx.providerChildPhase?.() === 'starting') {
-      return { state: 'rejected', reason: providerStartupFailureRejection(error) }
+      return {
+        state: 'rejected',
+        ...structuredAgentSessionStartFailure({ error }, ctx.failureTextContext)
+      }
     }
     return { state: 'unknown', reason: error instanceof Error ? error.message : String(error) }
   }
@@ -93,14 +99,9 @@ async function dispatchSafely(
 async function appendStatus(
   ctx: AgentSessionTurnContext,
   clientMessageId: string,
-  text: string
+  body: AgentJournalStatusItem
 ): Promise<void> {
-  await ctx.journal.appendItem(
-    { provider: 'orca', clientMessageId },
-    { kind: 'status', text },
-    { fence: ctx.fence }
-  )
-  ctx.publish()
+  await ctx.journal.appendItem({ provider: 'orca', clientMessageId }, body, { fence: ctx.fence })
 }
 
 /**
@@ -110,6 +111,8 @@ async function appendStatus(
  * the whole content of the word — and one message reached the model five times
  * when this was a judgement call instead of an invariant. A distinct send after
  * a terminal rejection uses a fresh id, which is a first delivery.
+ *
+ * Accepting only records the message; the session's delivery loop hands it over.
  */
 export async function performSend(
   ctx: AgentSessionTurnContext,
@@ -123,7 +126,10 @@ export async function performSend(
     .submissions()
     .find((entry) => entry.clientMessageId === input.clientMessageId)
   if (existing && existing.payloadFingerprint !== input.payloadFingerprint) {
-    return invalid(`Message id ${input.clientMessageId} was already used for another send.`)
+    return invalid(
+      'messageIdReused',
+      `Message id ${input.clientMessageId} was already used for another send.`
+    )
   }
   if (existing) {
     return {
@@ -132,91 +138,88 @@ export async function performSend(
     }
   }
   try {
-    await ctx.journal.appendSubmission({ ...input, fence: ctx.fence })
+    await ctx.journal.appendSubmission({ ...input, fence: ctx.fence, handoverRecorded: true })
   } catch {
-    return invalid('The message could not be recorded and was not sent.')
+    return invalid('journalWriteFailed', 'The message could not be recorded and was not sent.')
+  }
+  return {
+    ok: true,
+    value: {
+      clientMessageId: input.clientMessageId,
+      submission: requireSubmission(ctx, input.clientMessageId)
+    }
   }
-  ctx.publish()
+}
+
+export type AgentSessionHandoverContext = Pick<
+  AgentSessionTurnContext,
+  'sessionId' | 'journal' | 'fence' | 'adapter' | 'providerChildPhase'
+> & {
+  /** Who a start failure met at dispatch names, as the start's own row does. */
+  failureTextContext?: AgentSessionFailureWordsContext
+}
 
-  // The row just written is the send's instant on the host clock; the turn this
+/**
+ * Hands one queued submission to the provider. The `dispatch{pending}` row goes first: a crash
+ * after it leaves a message in doubt, never one that reads as queued and so provably unwritten.
+ */
+export async function handOverSubmission(
+  ctx: AgentSessionHandoverContext,
+  submission: AgentJournalSubmission
+): Promise<void> {
+  const { clientMessageId } = submission
+  const body = ctx.journal.itemBody(agentJournalSubmissionKey(clientMessageId))
+  if (body?.kind !== 'message') {
+    await ctx.journal.resolveDispatch({
+      clientMessageId,
+      state: 'rejected',
+      ...agentSessionFailureWords(agentSessionFailureFact('hostFault'), { surface: 'rejection' }),
+      fence: ctx.fence
+    })
+    return
+  }
+  await ctx.journal.resolveDispatch({ clientMessageId, state: 'pending', fence: ctx.fence })
+  // The row written at acceptance is the send's instant on the host clock; the turn this
   // dispatch opens records it so the live counter never re-anchors at turn-open.
-  const requestedAt = ctx.journal
-    .submissions()
-    .find((entry) => entry.clientMessageId === input.clientMessageId)?.submittedAt
-  const outcome = await dispatchSafely(ctx, input.clientMessageId, input.body, requestedAt).catch(
-    async (error: unknown) => {
-      if (error instanceof AgentSessionPreDispatchError) {
-        const recorded = await withTimeout(
-          ctx.journal
-            .resolveDispatch({
-              clientMessageId: input.clientMessageId,
-              state: 'rejected',
-              reason: error.message,
-              fence: ctx.fence
-            })
-            .then(() => true),
-          AGENT_SESSION_ADMISSION_BARRIER_TIMEOUT_MS,
-          false
-        )
-        if (!recorded) {
-          console.warn('[structured-agent-session] pre-dispatch refusal persistence failed')
-        }
-        ctx.publish()
-      }
-      throw error
-    }
-  )
+  const outcome = await dispatchSafely(ctx, clientMessageId, body, submission.submittedAt)
   // An admission needs no dispatch row: the submission is already pending.
   if (outcome.state === 'admitted') {
-    ctx.publish()
-    return {
-      ok: true,
-      value: {
-        clientMessageId: input.clientMessageId,
-        submission: requireSubmission(ctx, input.clientMessageId)
-      }
-    }
+    return
   }
   try {
     await ctx.journal.resolveDispatch(
       outcome.state === 'accepted'
         ? {
-            clientMessageId: input.clientMessageId,
+            clientMessageId,
             state: 'accepted',
             providerIdentity: outcome.providerIdentity,
             fence: ctx.fence
           }
-        : {
-            clientMessageId: input.clientMessageId,
-            state: outcome.state,
-            reason: outcome.reason,
-            fence: ctx.fence
-          }
+        : outcome.state === 'rejected'
+          ? {
+              clientMessageId,
+              state: 'rejected',
+              reason: outcome.reason,
+              rejection: outcome.rejection,
+              fence: ctx.fence
+            }
+          : { clientMessageId, state: 'unknown', reason: outcome.reason, fence: ctx.fence }
     )
   } catch (error) {
     // A failed resolution must not strand a pending row; an unknown result is
     // explicitly replayable.
     try {
       await ctx.journal.resolveDispatch({
-        clientMessageId: input.clientMessageId,
+        clientMessageId,
         state: 'unknown',
         reason: DISPATCH_DOUBT_PERSISTENCE_FAILED,
         fence: ctx.fence
       })
     } catch {
-      // Nothing further to record; the pending row is settled on the next attach.
+      // Nothing further to record; the pending row is settled on the next open.
     }
-    ctx.publish()
     throw error
   }
-  ctx.publish()
-  return {
-    ok: true,
-    value: {
-      clientMessageId: input.clientMessageId,
-      submission: requireSubmission(ctx, input.clientMessageId)
-    }
-  }
 }
 
 function requireSubmission(
@@ -249,7 +252,7 @@ export async function performCancel(
     }
   }
   let cancelled = false
-  let note = 'Cancellation requested.'
+  let note: AgentJournalStatusItem = { kind: 'status', text: 'Cancellation requested.' }
   try {
     const dispatchStatus = latestJournalDispatchObservation(ctx.journal, ctx.fence)
     cancelled = input.scope
@@ -272,15 +275,17 @@ export async function performCancel(
           })
         ).cancelled
     if (!cancelled) {
-      note = 'The provider had already finished this turn.'
+      note = { kind: 'status', text: 'The provider had already finished this turn.' }
     }
   } catch (error) {
     if (input.prompt) {
       throw error
     }
-    note = `Cancellation was not confirmed: ${
-      error instanceof Error ? error.message : String(error)
-    }`
+    // The adapter's error is Orca's; the row says only that the stop is unconfirmed.
+    note = {
+      kind: 'status',
+      ...agentSessionFailureWords(agentSessionFailureFact('cancelUnconfirmed'), { surface: 'row' })
+    }
   }
   if (cancelled && input.prompt) {
     await ctx.flushStreamedEvents()
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-unanswered-dispatch-release.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-unanswered-dispatch-release.test.ts
index fc8440500a44..9a27415dc711 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-unanswered-dispatch-release.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-unanswered-dispatch-release.test.ts
@@ -1,7 +1,7 @@
 import { describe, expect, it, vi } from 'vitest'
 import type { AgentJournalSubmission } from '../../../shared/agent-session-journal-types'
 import { projectStructuredAgentSessionStatus } from '../../../shared/structured-agent-session-projection'
-import { releaseStructuredAgentSessionUnansweredDispatches } from './structured-agent-session-host-mutations'
+import { releaseStructuredAgentSessionUnansweredDispatches } from './structured-agent-session-unanswered-dispatch-release'
 
 const FENCE = 7
 
@@ -32,12 +32,13 @@ function contextWith(submissions: AgentJournalSubmission[]) {
       return { epoch: 'e', sequence: 1 }
     })
   }
-  // The mutation reads only `journal.submissions`, `journal.resolveDispatch` and `fence`.
-  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: all three are supplied here; the rest of the host session is unreachable from this mutation.
-  const session = { journal, fence: FENCE } as unknown as ReleaseSession
-  const publish = vi.fn()
-  const context: ReleaseContext = { sessions: new Map([['s-1', session]]), publish }
-  return { context, resolved, publish, journal }
+  // The mutation reads only `journal.submissions`, `journal.resolveDispatch` and the record fence.
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: all three are supplied here; the rest of the session and the record is unreachable from this mutation.
+  const context = {
+    sessions: new Map([['s-1', { journal }]]),
+    deps: { store: { getRecord: () => ({ lease: { runtimeFence: FENCE } }) } }
+  } as unknown as ReleaseContext
+  return { context, resolved, journal }
 }
 
 describe('releasing dispatches the provider can no longer answer', () => {
@@ -45,7 +46,7 @@ describe('releasing dispatches the provider can no longer answer', () => {
     const live = [submission({})]
     // POSITIVE CONTROL: this is the latch being dissolved.
     expect(projectStructuredAgentSessionStatus([], live, FENCE)).toBe('working')
-    const { context, resolved, publish } = contextWith(live)
+    const { context, resolved } = contextWith(live)
 
     await releaseStructuredAgentSessionUnansweredDispatches(context, {
       sessionId: 's-1',
@@ -62,14 +63,13 @@ describe('releasing dispatches the provider can no longer answer', () => {
         recovered: true
       }
     ])
-    expect(publish).toHaveBeenCalledOnce()
     expect(projectStructuredAgentSessionStatus([], [submission({ recovered: true })], FENCE)).toBe(
       'idle'
     )
   })
 
   it('never touches a pending send, whose dispatch may still be in flight', async () => {
-    const { context, resolved, publish } = contextWith([
+    const { context, resolved } = contextWith([
       submission({ clientMessageId: 'm-2', dispatchState: 'pending', reason: null })
     ])
 
@@ -79,7 +79,6 @@ describe('releasing dispatches the provider can no longer answer', () => {
     })
 
     expect(resolved).toEqual([])
-    expect(publish).not.toHaveBeenCalled()
   })
 
   it('leaves an already recovered unknown alone', async () => {
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-unanswered-dispatch-release.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-unanswered-dispatch-release.ts
new file mode 100644
index 000000000000..713838c177ec
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-unanswered-dispatch-release.ts
@@ -0,0 +1,43 @@
+import { structuredAgentSessionConversationFence } from './structured-agent-session-provider-child'
+import type { StructuredAgentSessionHostDeps } from './structured-agent-session-host-types'
+import type { StructuredAgentSessionMutationContext } from './structured-agent-session-host-mutations'
+
+/**
+ * Releases sends the provider can no longer be holding.
+ *
+ * A dispatch whose RPC timed out is recorded `unknown` — doubt, never proof of
+ * non-delivery — and a live `unknown` reads as work still owed, so the session
+ * shows working until something re-derives it. The provider reporting its thread
+ * not running, with no turn open, IS that re-derivation.
+ *
+ * `pending` is deliberately untouched: that send's dispatch has not returned yet
+ * and may be in flight right now. And `recovered` only retires the obligation —
+ * it never makes a send re-deliverable, because the provider may well have run it.
+ */
+export async function releaseStructuredAgentSessionUnansweredDispatches(
+  context: Pick<StructuredAgentSessionMutationContext, 'sessions'> & {
+    deps: { store: Pick<StructuredAgentSessionHostDeps['store'], 'getRecord'> }
+  },
+  input: { sessionId: string; reason: string }
+): Promise<void> {
+  const session = context.sessions.get(input.sessionId)
+  if (!session) {
+    return
+  }
+  const stranded = session.journal
+    .submissions()
+    .filter((entry) => entry.dispatchState === 'unknown' && entry.recovered !== true)
+  if (stranded.length === 0) {
+    return
+  }
+  for (const entry of stranded) {
+    await session.journal.resolveDispatch({
+      clientMessageId: entry.clientMessageId,
+      state: 'unknown',
+      // The earlier reason names a sharper fact than this one does.
+      reason: entry.reason ?? input.reason,
+      fence: structuredAgentSessionConversationFence(context.deps.store, input.sessionId),
+      recovered: true
+    })
+  }
+}
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-unexpected-exit.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-unexpected-exit.test.ts
index 4ba1a93169b0..0685af605499 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-unexpected-exit.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-unexpected-exit.test.ts
@@ -7,50 +7,19 @@ import {
   agentSessionRecordFixture
 } from '../../../shared/agent-session-record.test-fixture'
 import type { StructuredAgentSessionHostSession } from './structured-agent-session-host-types'
-import { unexpectedProviderExitOutcome } from './structured-agent-session-dead-generation-settlement'
-import { retryLoadedStructuredAgentSessionSettlement } from './structured-agent-session-settlement-retry'
+import { settleStaleStructuredAgentSessionState } from './structured-agent-session-dead-generation-settlement'
 import {
-  isStructuredAgentSessionRecoveryTicketCurrent,
   settleUnexpectedStructuredAgentSessionExit,
   type StructuredAgentSessionUnexpectedExitContext,
-  type StructuredAgentSessionUnexpectedExitSession,
-  type StructuredAgentSessionRecoveryTicket
+  type StructuredAgentSessionUnexpectedExitSession
 } from './structured-agent-session-unexpected-exit'
 
+const exitOutcome = (agent: string): string =>
+  `${agent} stopped while this response was in progress. You can continue in this conversation.`
+
 const SESSION = 'session-1'
 const GENERATION = 'generation-1'
 
-const ticket: StructuredAgentSessionRecoveryTicket = {
-  sessionId: SESSION,
-  releasedFence: 8,
-  deadAcquisitionGeneration: GENERATION,
-  stableSettlementId: 'settlement-1'
-}
-
-function recoveryContext(input: {
-  generation?: string
-  handoffStage?: AgentSessionRecord['lease']['handoffStage']
-  resumeCapable?: boolean
-}) {
-  const session = {
-    hasProviderChild: false,
-    fence: 8,
-    acquisitionGeneration: input.generation ?? GENERATION
-  } as StructuredAgentSessionHostSession
-  const record = {
-    lease: {
-      runtimeFence: 8,
-      claimStatus: 'released',
-      handoffStage: input.handoffStage ?? null
-    }
-  } as AgentSessionRecord
-  return {
-    sessions: new Map([[SESSION, session]]),
-    store: { getRecord: () => record },
-    hasResumeCapableHolder: () => input.resumeCapable ?? true
-  } as never
-}
-
 function lifecycleItem(
   turnId: string,
   sequence: number,
@@ -102,20 +71,12 @@ function mutableStore() {
   }
 }
 
-describe('provider-exit recovery tickets', () => {
-  it.each([undefined, 2_000])('keeps exit receipt %s on retry', async (observedAt) => {
+describe('provider-exit settlement', () => {
+  it.each([undefined, 2_000])('keeps exit receipt %s when settling fails', async (observedAt) => {
     let now = observedAt === undefined ? 2_000 : 30_000
-    let record = {
-      lease: {
-        handoffStage: null,
-        runtimeFence: 7,
-        runtimeKind: 'native',
-        claimStatus: 'live',
-        ownerProcess: 'provider',
-        reservedSpawnToken: null,
-        processlessAt: null
-      }
-    } as unknown as AgentSessionRecord
+    let record = agentSessionRecordFixture(
+      agentSessionLeaseFixture({ runtimeKind: 'native', reservedSpawnToken: null })
+    )
     const store = {
       getRecord: () => record,
       transitionHandoff: async (
@@ -127,11 +88,11 @@ describe('provider-exit recovery tickets', () => {
       .fn()
       .mockRejectedValueOnce(new Error('journal unavailable'))
       .mockResolvedValue({ epoch: 'epoch-1', sequence: 2 })
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the exit reads only the child record and these journal methods; the rest of the session is unreachable from it.
     const session = {
-      hasProviderChild: true,
-      fence: 7,
-      acquisitionGeneration: GENERATION,
+      child: { generation: GENERATION, fence: 7, phase: 'ready' },
       journal: {
+        cursor: () => ({ epoch: 'epoch-1', sequence: 0 }),
         snapshot: () => ({
           items: [lifecycleItem('turn-1', 1, { state: 'running', startedAt: 1_000 })]
         }),
@@ -149,7 +110,6 @@ describe('provider-exit recovery tickets', () => {
           return { ok: false, error: new Error('sink unavailable') }
         },
         publishFence: vi.fn(),
-        hasResumeCapableHolder: () => true,
         serialize: async (_sessionId, task) => task(),
         now: () => now
       } as never,
@@ -163,20 +123,23 @@ describe('provider-exit recovery tickets', () => {
         observedAt
       }
     )
-    expect(record.lease.settlementRetryRequired).toBe(true)
-    expect(record.lease.deathEvidence?.observedAt).toBe(2_000)
+    // Released, not latched: the next acquire or read restore settles what this write left.
+    expect(record.lease).toMatchObject({
+      claimStatus: 'released',
+      handoffStage: null,
+      deathEvidence: { kind: 'exit-observed', detail: 'provider exited', observedAt: 2_000 }
+    })
     expect(record.lease.lastRenewedAt).toBe(60_000)
     expect(record.updatedAt).toBe(60_000)
 
     now = 120_000
-    await expect(
-      retryLoadedStructuredAgentSessionSettlement({
-        deps: { store } as never,
-        sessionId: SESSION,
-        session: { journal: session.journal, fence: 8, acquisitionGeneration: null },
-        now: () => now
-      })
-    ).resolves.toBe(true)
+    await settleStaleStructuredAgentSessionState({
+      journal: session.journal,
+      sessionId: SESSION,
+      fence: 8,
+      acquisitionGeneration: 'generation-2',
+      deathEvidence: record.lease.deathEvidence
+    })
     expect(appendLifecycleBatch.mock.calls.at(-1)?.[0].mutations).toContainEqual(
       expect.objectContaining({
         body: {
@@ -188,7 +151,6 @@ describe('provider-exit recovery tickets', () => {
         }
       })
     )
-    expect(record.lease.settlementRetryRequired).toBeUndefined()
   })
 
   it('uses the fallback when the one-shot translator admission was rejected, revising the running turn in place', async () => {
@@ -197,11 +159,11 @@ describe('provider-exit recovery tickets', () => {
       lifecycleItem('turn-1', 1, { state: 'completed', startedAt: 10, completedAt: 20 }),
       lifecycleItem('turn-2', 2, { state: 'running', startedAt: 30 })
     ]
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the exit reads only the child record and these journal methods; the rest of the session is unreachable from it.
     const session = {
-      hasProviderChild: true,
-      fence: 7,
-      acquisitionGeneration: GENERATION,
+      child: { generation: GENERATION, fence: 7, phase: 'ready' },
       journal: {
+        cursor: () => ({ epoch: 'epoch-1', sequence: 0 }),
         snapshot: () => ({ items }),
         appendLifecycleBatch,
         markPendingSubmissionsUnknown: vi.fn(async () => [])
@@ -215,20 +177,18 @@ describe('provider-exit recovery tickets', () => {
           runtimeKind: 'native',
           claimStatus: 'live',
           ownerProcess: 'provider',
-          reservedSpawnToken: null,
-          processlessAt: null
+          reservedSpawnToken: null
         }
       }),
       transitionHandoff: async () => ({ lease: { runtimeFence: 8 } })
     }
 
-    const result = await settleUnexpectedStructuredAgentSessionExit(
+    await settleUnexpectedStructuredAgentSessionExit(
       {
         store,
         sessions: new Map([[SESSION, session]]),
         flushLifecycle: async () => ({ ok: true }),
         publishFence: vi.fn(),
-        hasResumeCapableHolder: () => true,
         serialize: async (_sessionId, task) => task(),
         now: () => 1_234
       } as never,
@@ -238,17 +198,15 @@ describe('provider-exit recovery tickets', () => {
         reason: 'provider exited',
         cause: 'unexpected-exit',
         fence: 7,
-        acquisitionGeneration: GENERATION,
-        settlementRetryRequired: true
+        acquisitionGeneration: GENERATION
       }
     )
 
-    expect(result).toMatchObject({ releasedFence: 8 })
     expect(session.journal.markPendingSubmissionsUnknown).toHaveBeenCalledWith(
       7,
       'provider_exited_before_acknowledgement'
     )
-    expect(session.hasProviderChild).toBe(false)
+    expect(session.child).toBeNull()
     // The running row is revised to interrupted at exit receipt, never tombstoned.
     expect(appendLifecycleBatch).toHaveBeenCalledExactlyOnceWith({
       settlementId: `dead-generation:provider-exit:${SESSION}:7:${GENERATION}`,
@@ -261,7 +219,11 @@ describe('provider-exit recovery tickets', () => {
             provider: 'orca',
             clientMessageId: `provider-exit:${SESSION}:7:${GENERATION}`
           },
-          body: { kind: 'status', text: unexpectedProviderExitOutcome('provider exited') }
+          body: {
+            kind: 'status',
+            text: exitOutcome('The agent'),
+            failure: { kind: 'providerExited' }
+          }
         },
         {
           kind: 'item',
@@ -305,10 +267,9 @@ describe('provider-exit recovery tickets', () => {
         sequence: 3
       }))
       const session: StructuredAgentSessionUnexpectedExitSession = {
-        hasProviderChild: true,
-        fence: 7,
-        acquisitionGeneration: GENERATION,
+        child: { generation: GENERATION, fence: 7, phase: 'ready' },
         journal: {
+          cursor: () => ({ epoch: 'epoch-1', sequence: 0 }),
           snapshot: () => ({ items }),
           appendLifecycleBatch,
           markPendingSubmissionsUnknown: vi.fn(async () => []),
@@ -331,7 +292,6 @@ describe('provider-exit recovery tickets', () => {
           return { ok: true }
         },
         publishFence: vi.fn(),
-        hasResumeCapableHolder: () => true,
         serialize: async <T>(_sessionId: string, task: () => Promise<T>) => task(),
         now: () => 1_234
       }
@@ -351,7 +311,8 @@ describe('provider-exit recovery tickets', () => {
           expect.objectContaining({
             body: {
               kind: 'status',
-              text: unexpectedProviderExitOutcome('provider exited after completing the turn')
+              text: exitOutcome('Claude'),
+              failure: { kind: 'providerExited' }
             }
           })
         ])
@@ -362,10 +323,9 @@ describe('provider-exit recovery tickets', () => {
   it('settles a submission the dead child never acknowledged', async () => {
     const markPendingSubmissionsUnknown = vi.fn(async () => ['client-1'])
     const session: StructuredAgentSessionUnexpectedExitSession = {
-      hasProviderChild: true,
-      fence: 7,
-      acquisitionGeneration: GENERATION,
+      child: { generation: GENERATION, fence: 7, phase: 'ready' },
       journal: {
+        cursor: () => ({ epoch: 'epoch-1', sequence: 0 }),
         snapshot: () => ({ items: [] }),
         appendLifecycleBatch: vi.fn(async () => ({ epoch: 'epoch-1', sequence: 1 })),
         markPendingSubmissionsUnknown,
@@ -380,7 +340,6 @@ describe('provider-exit recovery tickets', () => {
       sessions: new Map([[SESSION, session]]),
       flushLifecycle: async () => ({ ok: true }),
       publishFence: vi.fn(),
-      hasResumeCapableHolder: () => true,
       serialize: async <T>(_sessionId: string, task: () => Promise<T>) => task(),
       now: () => 1
     }
@@ -401,19 +360,22 @@ describe('provider-exit recovery tickets', () => {
       expect.objectContaining({
         mutations: [
           expect.objectContaining({
-            body: { kind: 'status', text: unexpectedProviderExitOutcome('provider exited') }
+            body: {
+              kind: 'status',
+              text: exitOutcome('Claude'),
+              failure: { kind: 'providerExited' }
+            }
           })
         ]
       })
     )
   })
 
-  it('does not release or reacquire while terminal settlement retry is still failing', async () => {
+  it('releases without offering a restart while terminal settlement is failing', async () => {
     const session: StructuredAgentSessionUnexpectedExitSession = {
-      hasProviderChild: true,
-      fence: 7,
-      acquisitionGeneration: GENERATION,
+      child: { generation: GENERATION, fence: 7, phase: 'ready' },
       journal: {
+        cursor: () => ({ epoch: 'epoch-1', sequence: 0 }),
         markPendingSubmissionsUnknown: vi.fn(async () => []),
         rejectPendingSubmissions: vi.fn(async () => []),
         snapshot: () => ({
@@ -440,45 +402,14 @@ describe('provider-exit recovery tickets', () => {
       sessions: new Map([[SESSION, session]]),
       flushLifecycle: async () => ({ ok: false, error: new Error('sink failed') }),
       publishFence,
-      hasResumeCapableHolder: () => true,
       serialize: async (_sessionId, task) => task(),
       now: () => 1,
       onBarrierError: release
     }
-    const result = await settleUnexpectedStructuredAgentSessionExit(context, event)
+    await settleUnexpectedStructuredAgentSessionExit(context, event)
 
-    expect(result).toBeNull()
-    expect(session.hasProviderChild).toBe(false)
-    expect(session.fence).toBe(8)
+    expect(session.child).toBeNull()
     expect(publishFence).toHaveBeenCalledTimes(1)
     expect(release).toHaveBeenCalledTimes(2)
   })
-
-  it('admits the exact released generation for a resume-capable holder', () => {
-    expect(isStructuredAgentSessionRecoveryTicketCurrent(recoveryContext({}), ticket)).toBe(true)
-  })
-
-  it('is cancelled by a latched stage before reattachment', () => {
-    expect(
-      isStructuredAgentSessionRecoveryTicketCurrent(
-        recoveryContext({ handoffStage: 'recovering' }),
-        ticket
-      )
-    ).toBe(false)
-  })
-
-  it('is cancelled when its holder or dead acquisition generation is no longer current', () => {
-    expect(
-      isStructuredAgentSessionRecoveryTicketCurrent(
-        recoveryContext({ resumeCapable: false }),
-        ticket
-      )
-    ).toBe(false)
-    expect(
-      isStructuredAgentSessionRecoveryTicketCurrent(
-        recoveryContext({ generation: 'generation-new' }),
-        ticket
-      )
-    ).toBe(false)
-  })
 })
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-unexpected-exit.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-unexpected-exit.ts
index 5363b8588e74..3a47d1240f24 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-unexpected-exit.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-unexpected-exit.ts
@@ -1,8 +1,9 @@
-import type {
-  StructuredAgentSessionEndedEvent,
-  StructuredAgentSessionProviderChildPhase
-} from './structured-agent-session-adapter'
+import type { AgentSessionFailureWordsContext } from '../../../shared/agent-session-failure-words'
+import { structuredAgentSessionFailureWordsContext } from './structured-agent-session-send-preparation'
+import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
+import type { StructuredAgentSessionEndedEvent } from './structured-agent-session-adapter'
 import type { StructuredAgentSessionHostSession } from './structured-agent-session-host-types'
+import { endProviderChild } from './structured-agent-session-provider-child'
 import {
   releaseStoredStructuredAgentSessionOwnerAfterUnexpectedExit,
   type StructuredAgentSessionLeaseStore
@@ -21,20 +22,10 @@ type UnexpectedExitLifecycleEvent = StructuredAgentSessionEndedEvent & {
   cause: 'unexpected-exit'
 }
 
-export type StructuredAgentSessionRecoveryTicket = {
-  sessionId: string
-  releasedFence: number
-  deadAcquisitionGeneration: string
-  stableSettlementId: string
-}
-
-export type StructuredAgentSessionUnexpectedExitSession = {
-  journal: DeadGenerationJournal
-  hasProviderChild: boolean
-  fence: number
-  acquisitionGeneration: string | null
-  providerChildPhase?: StructuredAgentSessionProviderChildPhase
-}
+export type StructuredAgentSessionUnexpectedExitSession = Pick<
+  StructuredAgentSessionHostSession,
+  'child' | 'lastEndedChild'
+> & { journal: DeadGenerationJournal & Pick<AgentSessionJournal, 'cursor'> }
 
 export type StructuredAgentSessionUnexpectedExitContext<
   TSession extends StructuredAgentSessionUnexpectedExitSession = StructuredAgentSessionHostSession
@@ -44,7 +35,6 @@ export type StructuredAgentSessionUnexpectedExitContext<
   flushLifecycle: (sessionId: string) => Promise<StructuredAgentSessionSinkBarrier>
   publishFence: (sessionId: string, session: TSession) => void
   publishStatus?: (sessionId: string) => void
-  hasResumeCapableHolder: (sessionId: string) => boolean
   serialize: <T>(sessionId: string, task: () => Promise<T>) => Promise<T>
   now: () => number
   onBarrierError?: (sessionId: string, error: unknown) => void
@@ -55,40 +45,50 @@ export async function settleUnexpectedStructuredAgentSessionExit<
 >(
   context: StructuredAgentSessionUnexpectedExitContext<TSession>,
   event: StructuredAgentSessionEndedEvent
-): Promise<StructuredAgentSessionRecoveryTicket | null> {
+): Promise<void> {
   if (event.cause !== 'unexpected-exit') {
-    return null
+    return
   }
   const unexpectedEvent = event as UnexpectedExitLifecycleEvent
   // Receipt of the exit is the one end time the host may record for a running turn.
   const observedAt = event.observedAt ?? context.now()
   return context.serialize(unexpectedEvent.sessionId, async () => {
     const session = context.sessions.get(unexpectedEvent.sessionId)
+    const child = session?.child
     if (
-      !session?.hasProviderChild ||
-      session.fence !== unexpectedEvent.fence ||
-      session.acquisitionGeneration !== unexpectedEvent.acquisitionGeneration
+      !session ||
+      !child ||
+      child.fence !== unexpectedEvent.fence ||
+      child.generation !== unexpectedEvent.acquisitionGeneration
     ) {
-      return null
+      return
+    }
+    // The host's own phase decides, so a provider that omits the flag still gets a start that
+    // failed told as one: the row says so.
+    const exitedDuringStartup =
+      unexpectedEvent.startupUnproven === true || child.phase === 'starting'
+    const endChild = (): void => {
+      endProviderChild(session, {
+        generation: child.generation,
+        fence: child.fence,
+        cause: 'exit',
+        reason: unexpectedEvent.reason,
+        ...(unexpectedEvent.failure ? { failure: unexpectedEvent.failure } : {}),
+        duringStartup: exitedDuringStartup,
+        // The adapter publishes an exit only once it saw the root go, first-hand or proven.
+        rootGone: true
+      })
+      context.publishStatus?.(unexpectedEvent.sessionId)
     }
     const record = context.store.getRecord(unexpectedEvent.sessionId)
     if (!record || record.lease.handoffStage !== null) {
       // An acquisition or recovery already owns this lease's transition.
-      session.hasProviderChild = false
-      context.publishStatus?.(unexpectedEvent.sessionId)
-      return null
+      endChild()
+      return
     }
-    // The host's own phase decides, so a provider that omits the flag still gets a start that
-    // failed told as one: the row says so, and nothing resumes into the same failure.
-    const exitedDuringStartup =
-      unexpectedEvent.startupUnproven === true || session.providerChildPhase === 'starting'
 
-    let settlementFailed = false
     const stableSettlementId = providerExitSettlementId(unexpectedEvent)
     const unfinishedWork = captureUnfinishedStructuredAgentSessionWork(session.journal)
-    let released: Awaited<
-      ReturnType<typeof releaseStoredStructuredAgentSessionOwnerAfterUnexpectedExit>
-    > | null = null
     try {
       try {
         const barrier = await context.flushLifecycle(unexpectedEvent.sessionId)
@@ -98,13 +98,15 @@ export async function settleUnexpectedStructuredAgentSessionExit<
       } catch (error) {
         context.onBarrierError?.(unexpectedEvent.sessionId, error)
       }
-      settlementFailed = !(await retryUnexpectedExitSettlement({
+      await retryUnexpectedExitSettlement({
         context,
         event: unexpectedEvent,
-        session,
+        journal: session.journal,
+        fence: child.fence,
         stableSettlementId,
         verdict: { state: 'interrupted', completedAt: observedAt },
         exitedDuringStartup,
+        failureTextContext: structuredAgentSessionFailureWordsContext(record),
         // A failed start always says why: no response was running to carry the reason.
         showUnexpectedExitOutcome:
           exitedDuringStartup ||
@@ -113,102 +115,62 @@ export async function settleUnexpectedStructuredAgentSessionExit<
             session.journal,
             observedAt
           )
-      }))
+      })
     } finally {
       // Provider exit was positively observed, so release the owner even when
       // terminal settlement could not be durably accepted.
+      let released: Awaited<
+        ReturnType<typeof releaseStoredStructuredAgentSessionOwnerAfterUnexpectedExit>
+      > | null = null
       try {
         released = await releaseStoredStructuredAgentSessionOwnerAfterUnexpectedExit({
           store: context.store,
           sessionId: unexpectedEvent.sessionId,
           expectedFence: unexpectedEvent.fence,
           expectedAcquisitionGeneration: unexpectedEvent.acquisitionGeneration,
-          acquisitionGeneration: session.acquisitionGeneration,
+          acquisitionGeneration: child.generation,
           now: context.now(),
           exitObservedAt: observedAt,
-          ...(settlementFailed
-            ? {
-                settlementRetry: {
-                  settlementId: stableSettlementId,
-                  // Bare cause: the retry renders it, and `exit-observed` already says the rest.
-                  detail: unexpectedEvent.reason.slice(0, MAX_UNEXPECTED_EXIT_REASON_CHARS)
-                }
-              }
-            : {})
+          // Bare cause: whatever this settlement could not write is settled from it later, by the
+          // next acquire or read restore, and `exit-observed` already says the rest.
+          exitReason: unexpectedEvent.reason.slice(0, MAX_UNEXPECTED_EXIT_REASON_CHARS)
         })
       } catch (error) {
         context.onBarrierError?.(unexpectedEvent.sessionId, error)
       } finally {
-        session.hasProviderChild = false
-        context.publishStatus?.(unexpectedEvent.sessionId)
+        endChild()
         if (released) {
-          session.fence = released.lease.runtimeFence
           context.publishFence(unexpectedEvent.sessionId, session)
         }
       }
     }
-    if (settlementFailed || !released) {
-      return null
-    }
-    // Resuming a start that failed would respawn into the same failure; the next send retries.
-    if (exitedDuringStartup || !context.hasResumeCapableHolder(unexpectedEvent.sessionId)) {
-      return null
-    }
-    return {
-      sessionId: unexpectedEvent.sessionId,
-      releasedFence: released.lease.runtimeFence,
-      deadAcquisitionGeneration: unexpectedEvent.acquisitionGeneration,
-      stableSettlementId
-    }
   })
 }
 
-export function isStructuredAgentSessionRecoveryTicketCurrent(
-  context: {
-    store: Pick<StructuredAgentSessionLeaseStore, 'getRecord'>
-    sessions: Map<
-      string,
-      Pick<
-        StructuredAgentSessionUnexpectedExitSession,
-        'hasProviderChild' | 'fence' | 'acquisitionGeneration'
-      >
-    >
-    hasResumeCapableHolder: (sessionId: string) => boolean
-  },
-  ticket: StructuredAgentSessionRecoveryTicket
-): boolean {
-  const session = context.sessions.get(ticket.sessionId)
-  const record = context.store.getRecord(ticket.sessionId)
-  return (
-    session?.hasProviderChild === false &&
-    session.fence === ticket.releasedFence &&
-    session.acquisitionGeneration === ticket.deadAcquisitionGeneration &&
-    record?.lease.runtimeFence === ticket.releasedFence &&
-    record.lease.claimStatus === 'released' &&
-    record.lease.handoffStage === null &&
-    context.hasResumeCapableHolder(ticket.sessionId)
-  )
-}
-
 async function retryUnexpectedExitSettlement(input: {
   context: Pick<StructuredAgentSessionUnexpectedExitContext, 'onBarrierError'>
   event: UnexpectedExitLifecycleEvent
-  session: Pick<StructuredAgentSessionUnexpectedExitSession, 'journal' | 'fence'>
+  journal: DeadGenerationJournal
+  fence: number
   stableSettlementId: string
   verdict: StructuredAgentSessionTurnVerdict
   exitedDuringStartup: boolean
+  failureTextContext: AgentSessionFailureWordsContext
   showUnexpectedExitOutcome?: boolean
 }): Promise<boolean> {
   return settleStructuredAgentSessionDeadGeneration({
-    journal: input.session.journal,
+    journal: input.journal,
     sessionId: input.event.sessionId,
-    fence: input.session.fence,
+    fence: input.fence,
     settlementId: input.stableSettlementId,
     verdict: input.verdict,
     pendingSubmissionReason: 'provider_exited_before_acknowledgement',
     showUnexpectedExitOutcome: input.showUnexpectedExitOutcome,
-    unexpectedExitReason: input.event.reason,
-    exitedDuringStartup: input.exitedDuringStartup,
+    ...(input.event.failure ? { exitFailure: input.event.failure } : {}),
+    failureTextContext: input.failureTextContext,
+    ...(input.exitedDuringStartup
+      ? { exitedDuringStartup: { generation: input.event.acquisitionGeneration } }
+      : {}),
     onError: input.context.onBarrierError
   })
 }
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-view-start-after-failed-start.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-view-start-after-failed-start.test.ts
new file mode 100644
index 000000000000..957ac2f275db
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-view-start-after-failed-start.test.ts
@@ -0,0 +1,212 @@
+// A Claude chat whose CLI exits before it finishes starting leaves one red row per start. A view
+// opening, or coming back to, a chat whose last start failed used to start the CLI again, so every
+// look at the chat added an identical row. Only a send retries a failed start: it is the user asking.
+
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { computeAgentSessionPayloadFingerprint } from '../../../shared/agent-session-mutation-envelope'
+import { ClaudeStructuredSessionAdapter } from '../../claude/claude-structured-session-adapter'
+import {
+  fakeClaude,
+  PROVIDER_SESSION_ID
+} from '../../claude/claude-structured-session-test-support'
+import { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
+import { structuredClaudeLifecycleEvent } from '../../runtime/structured-claude-runtime-adapter'
+import { StructuredAgentSessionHost } from './structured-agent-session-host'
+import {
+  HOST_TEST_NOW as NOW,
+  HOST_TEST_SESSION as SESSION,
+  hostTestAttachParams,
+  hostTestMessage,
+  hostTestOperationId,
+  resetHostTestOperationIds
+} from './structured-agent-session-host-test-data'
+
+/** Delivery runs on its own serialized steps; under a loaded runner they take more than a second. */
+function eventually(assertion: () => unknown): Promise<unknown> {
+  return vi.waitFor(assertion, { timeout: 10_000 })
+}
+
+const CALLER = { callerKey: 'client-1' }
+const SURFACE = 'desktop-chat:1'
+const LAUNCH_FAILURE =
+  'claude stream-json exited (code 1): qa-shim: simulated claude launch failure'
+
+let root: string
+let store: AgentSessionRecordStore
+let host: StructuredAgentSessionHost
+let adapter: ClaudeStructuredSessionAdapter
+let claude: ReturnType<typeof fakeClaude>
+let lifecycle: Promise<void>[]
+/** Every initialize waits on it: a start that must outlast a step does not race a timer. */
+let initGate: Promise<void>
+
+beforeEach(async () => {
+  root = await mkdtemp(join(tmpdir(), 'orca-view-start-after-failed-start-'))
+  resetHostTestOperationIds()
+  lifecycle = []
+  initGate = Promise.resolve()
+  // Every start spawns, is published, and exits before it answers initialize.
+  claude = fakeClaude({ initDelayMs: 20, exitBeforeInit: LAUNCH_FAILURE })
+  adapter = new ClaudeStructuredSessionAdapter({
+    resolveLaunch: async () => ({
+      pathToClaudeCodeExecutable: 'claude',
+      options: {},
+      cwd: root,
+      claudeConfigDir: join(root, 'claude-home'),
+      providerSessionId: PROVIDER_SESSION_ID,
+      resumeLeafUuid: null,
+      resumesTranscript: (store.getRecord(SESSION)?.providerHandleChain.length ?? 0) > 0,
+      continuesChain: (store.getRecord(SESSION)?.providerHandleChain.length ?? 0) > 0
+    }),
+    onEvent: (event) => {
+      const mapped = structuredClaudeLifecycleEvent(event)
+      if (mapped) {
+        lifecycle.push(host.handleAdapterEvent(mapped))
+      }
+    },
+    openConnection: async (launch, handlers) => {
+      const connection = await claude.openConnection(launch, handlers)
+      const initialize = connection.initializationResult
+      return Object.assign(connection, {
+        initializationResult: async () => {
+          await initGate
+          return initialize()
+        }
+      })
+    },
+    readProcessStartTime: async () => 1_700_000_000_000,
+    now: () => NOW
+  })
+  store = await AgentSessionRecordStore.open({ directory: join(root, 'store'), hostId: 'local' })
+  host = new StructuredAgentSessionHost({
+    store,
+    adapter: Object.assign(adapter, { supportsCreate: () => true }),
+    journalRoot: root,
+    claimKeyId: 'key-1',
+    mintSpawnToken: () => `spawn-${claude.connections.length + 1}`,
+    now: () => NOW
+  })
+})
+
+afterEach(async () => {
+  await adapter.closeAll()
+  await host.flushAllStreamedEvents()
+  await rm(root, { recursive: true, force: true })
+})
+
+/** Waits until the adapter has published every exit it saw and the host settled each one. */
+async function settleExits(): Promise<void> {
+  await eventually(async () => {
+    await adapter.drainObservedExits()
+    await Promise.all(lifecycle)
+    expect((await host.journalSnapshot(SESSION)).items.length).toBeGreaterThan(0)
+  })
+  await Promise.all(lifecycle)
+}
+
+/** A view of the chat: a subscription, which reads the chat and starts nothing. */
+function view(id: string): Promise<() => void> {
+  return host.subscribe({ id, sessionId: SESSION, emit: () => undefined })
+}
+
+/** The chat as it renders: the user's messages and the error rows, in journal order. */
+async function timeline(): Promise<string[]> {
+  return (await host.journalSnapshot(SESSION)).items.flatMap((item) =>
+    item.body.kind === 'message'
+      ? ['message']
+      : item.body.kind === 'status' && item.body.tone === 'error'
+        ? [item.body.text]
+        : []
+  )
+}
+
+async function send(text: string): Promise<string> {
+  const body = hostTestMessage(text)
+  const sent = await host.send(CALLER, {
+    envelope: {
+      sessionId: SESSION,
+      clientOperationId: hostTestOperationId(),
+      expectedRuntimeFence: store.getRecord(SESSION)?.lease.runtimeFence ?? 1,
+      payloadFingerprint: computeAgentSessionPayloadFingerprint({
+        method: 'agentSession.send',
+        sessionId: SESSION,
+        fields: { body }
+      })
+    },
+    body
+  })
+  expect(sent).toMatchObject({ ok: true })
+  return sent.ok ? sent.value.clientMessageId : ''
+}
+
+describe('a fresh chat whose Claude start fails', () => {
+  // QA saw three failed starts from opening the chat alone: the create's, and the view's.
+  it.each([
+    ['after the create already died', false],
+    ['while the create is still starting', true]
+  ] as const)(
+    'starts once for the open and once for a send, one row each, when the view binds %s',
+    async (_when, createStillStarting) => {
+      // Released only once the views bound, so no runner is slow enough to let the create die first.
+      let releaseCreate = (): void => {}
+      const createGate = new Promise<void>((resolve) => {
+        releaseCreate = resolve
+      })
+      if (!createStillStarting) {
+        releaseCreate()
+      }
+      initGate = createGate
+      claude = fakeClaude({ exitBeforeInit: LAUNCH_FAILURE })
+      await expect(
+        host.attach(
+          CALLER,
+          hostTestAttachParams(null, {
+            provider: 'claude',
+            agent: 'claude',
+            accountHome: { variable: 'CLAUDE_CONFIG_DIR', path: join(root, 'claude-home') },
+            providerHandle: { kind: 'claude', sessionId: PROVIDER_SESSION_ID, leafUuid: null }
+          })
+        )
+      ).resolves.toMatchObject({ ok: true })
+      if (!createStillStarting) {
+        await settleExits()
+      }
+      // Two surfaces bind, as a pane and a second window do.
+      const unsubscribe = await view(SURFACE)
+      await view('desktop-chat:2')
+      if (createStillStarting) {
+        // The views bound to the create's child itself, before it exited.
+        expect(await timeline()).toEqual([])
+        releaseCreate()
+      }
+      await settleExits()
+      // The row says the provider stopped; its stderr stays out of the sentence.
+      const startFailure =
+        'Claude stopped before it finished starting. Send your message to try again.'
+      // Opening the chat: the create's start, once, and its row.
+      expect(claude.connections).toHaveLength(1)
+      expect(await timeline()).toEqual([startFailure])
+
+      const sent = await send('reply with exactly: alpha')
+      await eventually(async () =>
+        expect(
+          (await host.journalSnapshot(SESSION)).submissions.find((s) => s.clientMessageId === sent)
+        ).toMatchObject({ dispatchState: 'rejected', reason: startFailure })
+      )
+      await settleExits()
+      // The send's own start, once, and one row for it below the message.
+      expect(claude.connections).toHaveLength(2)
+      expect(await timeline()).toEqual([startFailure, 'message', startFailure])
+
+      // Switching away and back re-subscribes; it starts nothing and adds no row.
+      unsubscribe()
+      await view(SURFACE)
+      await settleExits()
+      expect(claude.connections).toHaveLength(2)
+      expect(await timeline()).toEqual([startFailure, 'message', startFailure])
+    }
+  )
+})
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-wedged-profile-migration.test.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-wedged-profile-migration.test.ts
index 21a5fe4e49d4..98b212a8606c 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-wedged-profile-migration.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-wedged-profile-migration.test.ts
@@ -6,16 +6,20 @@
 // conversation — the journal, the provider handle chain, and the recorded evidence all survive.
 //
 // "Usable" means ACQUIRABLE, not acquired. Startup no longer resumes a provider child for a record
-// nobody is looking at; a surface taking a hold is what spawns one. So the migration's job is to
-// leave the lease in a state a hold can claim, and these tests prove that by adjudicating it rather
-// than by reading fields off it.
+// nobody is looking at; work that needs the agent is what spawns one. So the migration's job is to
+// leave the lease in a state an attach can claim, and these tests prove that by adjudicating it
+// rather than by reading fields off it.
 
 import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, beforeEach, describe, expect, it, vi, type Mock } from 'vitest'
-import { evaluateAgentSessionAcquisition } from '../../../shared/agent-session-lease-adjudication'
+import {
+  evaluateAgentSessionAcquisition,
+  type AgentSessionOwnerProbe
+} from '../../../shared/agent-session-lease-adjudication'
 import { activeStructuredAgentSessionTurnId } from '../../../shared/structured-agent-session-projection'
+import type { AgentSessionStatusSummary } from '../../../shared/agent-session-wire'
 import { readAgentJournalTurn } from '../../../shared/agent-session-turn-record'
 import type {
   AgentSessionClaimStatus,
@@ -31,7 +35,7 @@ import { AGENT_SESSION_STORE_FILE_NAME } from '../../runtime/agent-session-recor
 import type { StructuredAgentSessionAdapter } from './structured-agent-session-adapter'
 import { openAgentSessionJournal } from '../agent-session-journal/journal-store-factory'
 import { journalDirectoryFor } from '../agent-session-journal/journal-paths'
-import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
+import { AgentSessionJournal } from '../agent-session-journal/journal-store'
 import { StructuredAgentSessionHost } from './structured-agent-session-host'
 import type { StructuredAgentSessionHostDeps } from './structured-agent-session-host-types'
 import {
@@ -145,6 +149,11 @@ function openHost(overrides: Partial<StructuredAgentSessionHostDeps> = {}): void
   })
 }
 
+/** The host starting the agent with no message to deliver, as an operation that needs it does. */
+function startAgent(): Promise<unknown> {
+  return host['serialize'](SESSION, () => host['mutationContext']().ensureAgent(SESSION))
+}
+
 beforeEach(async () => {
   root = await mkdtemp(join(tmpdir(), 'orca-wedged-profile-'))
   resetHostTestOperationIds()
@@ -265,9 +274,7 @@ describe('already-wedged profiles become usable on load', () => {
       expect(activeStructuredAgentSessionTurnId(restoredJournal().snapshot().items)).toBe(null)
       expect(store.getRecord(SESSION)?.lease).toMatchObject({
         claimStatus: 'released',
-        handoffStage: null,
-        settlementRetryRequired: undefined,
-        settlementRetryId: undefined
+        handoffStage: null
       })
       expect(acquire).not.toHaveBeenCalled()
 
@@ -284,14 +291,62 @@ describe('already-wedged profiles become usable on load', () => {
     }
   )
 
-  it('settles restart eviction through attach when a hold arrives before the boot sweep', async () => {
+  it.each([
+    [
+      'an exit the host saw but could not settle before quitting',
+      wedgedRecord({ claimStatus: 'released', handoffStage: null }),
+      {
+        kind: 'exit-observed',
+        detail: 'provider exited: transport closed',
+        observedAt: NOW - 1_000
+      } as const,
+      { state: 'interrupted', completedAt: NOW - 1_000 }
+    ],
+    [
+      'a quit that left the owner for a probe to prove gone',
+      wedgedRecord({ claimStatus: 'live', handoffStage: null, ownerProcess: DEAD_OWNER }),
+      null,
+      { state: 'unverifiable' }
+    ]
+  ] as const)(
+    'reopens a chat that was mid-turn at %s with nothing running and no working status',
+    async (_quit, seeded, deathEvidence, verdict) => {
+      await seedStore({ ...seeded, lease: { ...seeded.lease, deathEvidence } })
+      await seedRunningTurn()
+      const published: AgentSessionStatusSummary[] = []
+      openHost({
+        statusSink: { publish: (summary) => published.push(summary), forget: () => {} }
+      })
+
+      await host.restoreReadableSessions()
+
+      expect(acquire).not.toHaveBeenCalled()
+      expect(turnLifecycle('turn-1')).toEqual({
+        turnId: 'turn-1',
+        startedAt: NOW - 5_000,
+        recovered: true,
+        ...verdict
+      })
+      expect(activeStructuredAgentSessionTurnId(restoredJournal().snapshot().items)).toBe(null)
+      // What the sidebar reads: every status this restart published says the chat is not working.
+      expect(published.filter((summary) => summary.sessionId === SESSION)).not.toEqual([])
+      expect(published.map((summary) => summary.status)).not.toContain('working')
+    }
+  )
+
+  it('settles restart eviction through attach when a start arrives before the boot sweep', async () => {
     await seedStore(
       wedgedRecord({ claimStatus: 'live', handoffStage: null, ownerProcess: DEAD_OWNER })
     )
     await seedRunningTurn()
     openHost()
 
-    await host.hold(SESSION, 'desktop-chat:restart')
+    // The attach adjudicates the dead owner first, which moves the fence; like a client's ensure,
+    // it is retried at the fence the refusal names.
+    const stale = await host.attach(CALLER, hostTestAttachParams(13))
+    const fence = stale.ok ? 13 : (stale.refusal.currentFence ?? 13)
+    expect(stale.ok || stale.refusal.code === 'agent_session_checkpoint_stale').toBe(true)
+    expect(stale.ok || (await host.attach(CALLER, hostTestAttachParams(fence))).ok).toBe(true)
 
     expect(acquire).toHaveBeenCalledOnce()
     expect(activeStructuredAgentSessionTurnId(restoredJournal().snapshot().items)).toBe(null)
@@ -304,20 +359,25 @@ describe('already-wedged profiles become usable on load', () => {
     })
     expect(store.getRecord(SESSION)?.lease).toMatchObject({
       claimStatus: 'live',
-      handoffStage: null,
-      settlementRetryRequired: undefined,
-      settlementRetryId: undefined
+      handoffStage: null
     })
   })
 
   it('settles an observed-exit latch through attach before the boot sweep', async () => {
     const record = wedgedRecord({ claimStatus: 'released', handoffStage: 'recovering' })
-    record.lease.settlementRetryRequired = true
-    record.lease.settlementRetryId = `provider-exit:${SESSION}:12:generation-1`
-    record.lease.deathEvidence = {
-      kind: 'exit-observed',
-      detail: 'provider exited: transport closed',
-      observedAt: NOW - 1_000
+    // The settlement latch an older build wrote; this build derives the settlement instead.
+    const olderBuildLatch = {
+      settlementRetryRequired: true,
+      settlementRetryId: `provider-exit:${SESSION}:12:generation-1`
+    }
+    record.lease = {
+      ...record.lease,
+      ...olderBuildLatch,
+      deathEvidence: {
+        kind: 'exit-observed',
+        detail: 'provider exited: transport closed',
+        observedAt: NOW - 1_000
+      }
     }
     await seedStore(record)
     await seedRunningTurn()
@@ -337,12 +397,113 @@ describe('already-wedged profiles become usable on load', () => {
     })
     expect(store.getRecord(SESSION)?.lease).toMatchObject({
       claimStatus: 'live',
+      handoffStage: null
+    })
+    // The older build's latch is dropped at load, so a downgrade never sees it again.
+    expect(store.getRecord(SESSION)?.lease).not.toHaveProperty('settlementRetryRequired')
+    expect(store.getRecord(SESSION)?.lease).not.toHaveProperty('settlementRetryId')
+  })
+
+  it.each([
+    ['a restart eviction', false],
+    ['a proven eviction by recovery', true]
+  ] as const)(
+    'settles the turn %s left at the next acquire when the read restore could not write it',
+    async (_origin, ownerOutlivedRestart) => {
+      await seedStore(
+        wedgedRecord({ claimStatus: 'live', handoffStage: null, ownerProcess: DEAD_OWNER })
+      )
+      await seedRunningTurn()
+      let ownerAlive = ownerOutlivedRestart
+      const stopOwnerProcess = vi.fn(() => {
+        ownerAlive = false
+      })
+      openHost({
+        probeOwner: async () =>
+          ownerAlive
+            ? { outcome: 'identity-matched', matchedOn: ['spawn-token'] }
+            : { outcome: 'pid-absent' },
+        stopOwnerProcess
+      })
+      // The read restore's settlement fails, and nothing retries it.
+      const failing = vi
+        .spyOn(AgentSessionJournal.prototype, 'appendLifecycleBatch')
+        .mockRejectedValue(new Error('journal unavailable'))
+      await host.restoreReadableSessions()
+      failing.mockRestore()
+      expect(activeStructuredAgentSessionTurnId(restoredJournal().snapshot().items)).toBe('turn-1')
+      expect(stopOwnerProcess).toHaveBeenCalledTimes(ownerOutlivedRestart ? 1 : 0)
+      expect(store.getRecord(SESSION)?.lease).toMatchObject({
+        claimStatus: 'released',
+        handoffStage: null,
+        deathEvidence: { kind: 'pid-absent' }
+      })
+
+      await startAgent()
+
+      expect(acquire).toHaveBeenCalledOnce()
+      expect(store.getRecord(SESSION)?.lease).toMatchObject({ claimStatus: 'live' })
+      // A pid probe proved the owner gone; nobody saw it exit, so the turn has no end.
+      expect(turnLifecycle('turn-1')).toEqual({
+        turnId: 'turn-1',
+        state: 'unverifiable',
+        startedAt: NOW - 5_000,
+        recovered: true
+      })
+    }
+  )
+
+  it('releases an owner that survives every stop signal, and the chat starts again', async () => {
+    await seedStore(
+      wedgedRecord({ claimStatus: 'live', handoffStage: null, ownerProcess: DEAD_OWNER })
+    )
+    const stopOwnerProcess = vi.fn()
+    openHost({
+      probeOwner: async () => ({ outcome: 'identity-matched', matchedOn: ['spawn-token'] }),
+      stopOwnerProcess
+    })
+
+    await host.restoreReadableSessions()
+
+    expect(stopOwnerProcess.mock.calls).toEqual([
+      [DEAD_OWNER.pid, 'SIGTERM'],
+      [DEAD_OWNER.pid, 'SIGKILL']
+    ])
+    expect(store.getRecord(SESSION)?.lease).toMatchObject({
+      claimStatus: 'released',
       handoffStage: null,
-      settlementRetryRequired: undefined,
-      settlementRetryId: undefined
+      ownerProcess: null,
+      deathEvidence: null
     })
+    expect(await host.attach(CALLER, hostTestAttachParams(14))).toMatchObject({ ok: true })
+    expect(acquire).toHaveBeenCalledOnce()
   })
 
+  it.each([
+    ['a conflicted claim naming no process', { claimStatus: 'conflicted', ownerProcess: null }],
+    [
+      'an unproven reservation left in manual recovery',
+      { claimStatus: 'reserved', ownerProcess: null, reservedSpawnToken: 'spawn-lost' }
+    ]
+  ] as const)(
+    'releases %s an older build left, and the chat starts again',
+    async (_legacyRecord, lease) => {
+      await seedStore(wedgedRecord({ handoffStage: 'manual-recovery', ...lease }))
+      openHost({ probeOwner: async () => ({ outcome: 'indeterminate', reason: 'no scan here' }) })
+
+      await host.restoreReadableSessions()
+
+      expect(store.getRecord(SESSION)?.lease).toMatchObject({
+        claimStatus: 'released',
+        handoffStage: null,
+        runtimeFence: 14,
+        deathEvidence: null
+      })
+      expect(await host.attach(CALLER, hostTestAttachParams(14))).toMatchObject({ ok: true })
+      expect(acquire).toHaveBeenCalledOnce()
+    }
+  )
+
   it('marks a running turn left behind by a released lease unverifiable on a cold acquire', async () => {
     // No settlement latch: the record was released cleanly, but the journal still says a turn is
     // running. The child that wrote it is gone and nothing observed its exit.
@@ -419,27 +580,6 @@ describe('already-wedged profiles become usable on load', () => {
     expect(acquire).not.toHaveBeenCalled()
   })
 
-  it('leaves a conflicted record alone while its owner cannot be proven gone', async () => {
-    await seedStore(
-      wedgedRecord({
-        claimStatus: 'conflicted',
-        handoffStage: 'manual-recovery',
-        ownerProcess: DEAD_OWNER
-      })
-    )
-    openHost({
-      probeOwner: async () => ({ outcome: 'identity-matched', matchedOn: ['spawn-token'] })
-    })
-
-    await host.restoreReadableSessions()
-
-    expect(store.getRecord(SESSION)?.lease).toMatchObject({
-      claimStatus: 'conflicted',
-      handoffStage: 'manual-recovery',
-      ownerProcess: { pid: DEAD_OWNER.pid }
-    })
-  })
-
   it('unlatches a released record that reloaded into recovery with nothing outstanding', async () => {
     // An evicted lease has no owner and no token, so a restart has nothing to probe. Treating that
     // as an unproven reservation re-latched it to `recovering` on every single boot.
@@ -523,12 +663,13 @@ describe('already-wedged profiles become usable on load', () => {
     await host.restoreReadableSessions()
     expect(order).toEqual([])
     expect(scan).not.toHaveBeenCalled()
-    await host.hold(SESSION, 'holder-1')
+    const fence = store.getRecord(SESSION)?.lease.runtimeFence ?? null
+    expect(await host.attach(CALLER, hostTestAttachParams(fence))).toMatchObject({ ok: true })
 
     expect(order).toEqual(['acquire'])
   })
 
-  it('names the missing evidence when a latched record still cannot be freed', async () => {
+  it('waits out a conflicted owner it cannot verify, signalling nothing, until it is proven gone', async () => {
     await seedStore(
       wedgedRecord({
         claimStatus: 'conflicted',
@@ -536,14 +677,23 @@ describe('already-wedged profiles become usable on load', () => {
         ownerProcess: DEAD_OWNER
       })
     )
-    openHost({ probeOwner: async () => ({ outcome: 'indeterminate', reason: 'no answer' }) })
+    const stopOwnerProcess = vi.fn()
+    let probe: AgentSessionOwnerProbe = { outcome: 'indeterminate', reason: 'no answer' }
+    openHost({ probeOwner: async () => probe, stopOwnerProcess })
     await host.restoreReadableSessions()
 
-    const refused = await host.attach(CALLER, hostTestAttachParams(13))
+    // A terminal agent keeps its transport across a restart, so an unanswered probe is not a way in.
+    const fence = store.getRecord(SESSION)?.lease.runtimeFence ?? null
+    expect(await host.attach(CALLER, hostTestAttachParams(fence))).toMatchObject({
+      ok: false,
+      refusal: { code: 'agent_session_conflict' }
+    })
+    expect(acquire).not.toHaveBeenCalled()
 
-    expect(refused.ok).toBe(false)
-    const message = refused.ok ? '' : refused.refusal.message
-    expect(message).toContain('process 12546 on local')
-    expect(message).not.toContain('The session store refused this call')
+    // The user quits that terminal: the next start proves it gone and the chat takes over.
+    probe = { outcome: 'pid-absent' }
+    await startAgent()
+    expect(acquire).toHaveBeenCalledOnce()
+    expect(stopOwnerProcess).not.toHaveBeenCalled()
   })
 })
diff --git a/src/main/native-chat/agent-session-wire/structured-agent-session-working-at-teardown.ts b/src/main/native-chat/agent-session-wire/structured-agent-session-working-at-teardown.ts
index 8eac02dc17b7..366ce1cf948e 100644
--- a/src/main/native-chat/agent-session-wire/structured-agent-session-working-at-teardown.ts
+++ b/src/main/native-chat/agent-session-wire/structured-agent-session-working-at-teardown.ts
@@ -17,6 +17,7 @@ import {
   agentSessionProviderHandleRoot
 } from '../../../shared/agent-session-provider-handle'
 import { latestStructuredAgentSessionUserItem } from '../../../shared/structured-agent-session-projection'
+import { isQueuedAgentJournalSubmission } from '../../../shared/agent-session-queued-submission'
 import type { AgentSessionRecord } from '../../../shared/agent-session-record'
 import type {
   AgentSessionResumeMarker,
@@ -135,8 +136,7 @@ function liveTasks(
 type WorkingCandidateSession = {
   journal: AgentSessionJournal
   /** Only this host generation's own child counts. A restored-for-reading journal has none. */
-  hasProviderChild: boolean
-  fence?: number
+  child: { fence: number } | null
 }
 
 /** The offer one session is owed, taken right before teardown stops its provider child; null when
@@ -154,16 +154,24 @@ export function structuredAgentSessionWorkingAtStop(input: {
 }): AgentSessionResumeMarker | null {
   const { sessionId, session } = input
   // A journal this host cannot read tells us nothing about what the turn was doing.
-  if (!session?.hasProviderChild || session.journal.isReadOnly) {
+  if (!session?.child || session.journal.isReadOnly) {
     return null
   }
   const snapshot = session.journal.snapshot()
+  // A queued message reached no agent, so it is no work to resume: quit rejects it as never sent.
+  const handedOver = snapshot.submissions.filter(
+    (submission) => !isQueuedAgentJournalSubmission(submission)
+  )
   const roster = input.backgroundTasks(sessionId)
-  const status = structuredAgentSessionShownStatus(snapshot, roster, session.fence)
+  const status = structuredAgentSessionShownStatus(
+    { items: snapshot.items, submissions: handedOver },
+    roster,
+    session.child.fence
+  )
   if (status.state === 'done') {
     return null
   }
-  const work = structuredAgentSessionResumeWork(snapshot.items, snapshot.submissions)
+  const work = structuredAgentSessionResumeWork(snapshot.items, handedOver)
   const head = agentSessionProviderHandleChainHead(
     input.getRecord(sessionId)?.providerHandleChain ?? []
   )
@@ -184,6 +192,7 @@ export function structuredAgentSessionWorkingAtStop(input: {
     recordedAt: input.now,
     trigger: input.trigger,
     teardownId: input.teardownId,
+    journalCursor: snapshot.cursor,
     // Root, not key: the close path advances Claude's leaf moments after this runs, and a key
     // comparison would then refuse the session forever.
     providerHandleRoot: agentSessionProviderHandleRoot(head.handle),
diff --git a/src/main/native-chat/agent-session-wire/structured-compaction-recovery.test.ts b/src/main/native-chat/agent-session-wire/structured-compaction-recovery.test.ts
new file mode 100644
index 000000000000..4c565bcf4e2f
--- /dev/null
+++ b/src/main/native-chat/agent-session-wire/structured-compaction-recovery.test.ts
@@ -0,0 +1,48 @@
+import { describe, expect, it, vi } from 'vitest'
+import type { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
+import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
+import { settleInterruptedCompaction } from './structured-compaction-recovery'
+
+describe('settleInterruptedCompaction', () => {
+  it("records the unconfirmed compaction in its fact's own words, on the row and the command", async () => {
+    const command = {
+      command: 'compact' as const,
+      state: 'unknown' as const,
+      phase: 'prepared' as const,
+      operationId: 'op-1',
+      callerKey: 'client-1',
+      runtimeFence: 1
+    }
+    const setConversationCommand = vi.fn(async () => undefined)
+    const store = {
+      getRecord: () => ({ conversationCommand: command }),
+      setConversationCommand,
+      recordOperationOutcome: vi.fn(async () => undefined)
+    }
+    const appendItem = vi.fn(async () => ({ cursor: { epoch: 'e', sequence: 1 } }))
+
+    await settleInterruptedCompaction(
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the function reads only the members stubbed above.
+      store as unknown as AgentSessionRecordStore,
+      'session-1',
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the function calls only `appendItem`.
+      { appendItem } as unknown as AgentSessionJournal,
+      2
+    )
+
+    const words = {
+      text: 'Compaction completion is unconfirmed.',
+      failure: { kind: 'compactionUnconfirmed' }
+    }
+    expect(appendItem).toHaveBeenCalledWith(
+      { provider: 'orca', clientMessageId: 'compact:op-1' },
+      { kind: 'status', ...words },
+      { fence: 2 }
+    )
+    expect(setConversationCommand).toHaveBeenCalledWith(
+      'session-1',
+      2,
+      expect.objectContaining({ error: words.text, failure: words.failure, state: 'unknown' })
+    )
+  })
+})
diff --git a/src/main/native-chat/agent-session-wire/structured-compaction-recovery.ts b/src/main/native-chat/agent-session-wire/structured-compaction-recovery.ts
index 2199da053922..b581d746f620 100644
--- a/src/main/native-chat/agent-session-wire/structured-compaction-recovery.ts
+++ b/src/main/native-chat/agent-session-wire/structured-compaction-recovery.ts
@@ -1,3 +1,5 @@
+import { agentSessionFailureFact } from '../../../shared/agent-session-failure'
+import { agentSessionFailureWords } from '../../../shared/agent-session-failure-words'
 import type { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
 import type { AgentSessionJournal } from '../agent-session-journal/journal-store'
 
@@ -9,21 +11,38 @@ export async function recoverInterruptedCompaction(
   fence: number
 ): Promise<void> {
   const command = store.getRecord(sessionId)?.conversationCommand
-  if (
-    command?.command !== 'compact' ||
-    command.phase !== 'prepared' ||
-    command.runtimeFence === undefined ||
-    command.runtimeFence === fence
-  ) {
+  if (command?.runtimeFence === undefined || command.runtimeFence === fence) {
     return
   }
-  const error = 'Previous compaction completion could not be confirmed after session recovery.'
+  await settleInterruptedCompaction(store, sessionId, journal, fence)
+}
+
+/** A compaction still prepared whose child can no longer finish it: its outcome is unknown. */
+export async function settleInterruptedCompaction(
+  store: AgentSessionRecordStore,
+  sessionId: string,
+  journal: AgentSessionJournal,
+  fence: number
+): Promise<void> {
+  const command = store.getRecord(sessionId)?.conversationCommand
+  if (command?.command !== 'compact' || command.phase !== 'prepared') {
+    return
+  }
+  const words = agentSessionFailureWords(agentSessionFailureFact('compactionUnconfirmed'), {
+    surface: 'row'
+  })
   await journal.appendItem(
     { provider: 'orca', clientMessageId: `compact:${command.operationId}` },
-    { kind: 'status', text: error },
+    { kind: 'status', ...words },
     { fence }
   )
-  const recovered = { ...command, phase: 'committed' as const, state: 'unknown' as const, error }
+  const recovered = {
+    ...command,
+    phase: 'committed' as const,
+    state: 'unknown' as const,
+    error: words.text,
+    failure: words.failure
+  }
   await store.setConversationCommand(sessionId, fence, recovered)
   await store.recordOperationOutcome({
     callerKey: command.callerKey,
diff --git a/src/main/native-chat/agent-session-wire/structured-conversation-command-admission.test.ts b/src/main/native-chat/agent-session-wire/structured-conversation-command-admission.test.ts
index 5a3370c910f5..fe3e443c4959 100644
--- a/src/main/native-chat/agent-session-wire/structured-conversation-command-admission.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-conversation-command-admission.test.ts
@@ -29,12 +29,12 @@ describe('conversationCommandBlocked background tasks', () => {
       contextWith({ state: 'monitoring', supportsTaskStop: true }),
       RECORD
     )
-    expect(blocked).toBe('Stop background tasks before using this command.')
+    expect(blocked?.message).toBe('Stop background tasks before using this command.')
   })
 
   it('asks for a stop on a host that predates the stop-capability field', () => {
     const blocked = conversationCommandBlocked(contextWith({ state: 'monitoring' }), RECORD)
-    expect(blocked).toBe('Stop background tasks before using this command.')
+    expect(blocked?.message).toBe('Stop background tasks before using this command.')
   })
 
   it('asks the user to wait when the provider exposes no stop at all', () => {
@@ -43,7 +43,7 @@ describe('conversationCommandBlocked background tasks', () => {
       contextWith({ state: 'monitoring', supportsStopAll: false }),
       RECORD
     )
-    expect(blocked).toBe('Wait for background tasks to finish before using this command.')
+    expect(blocked?.message).toBe('Wait for background tasks to finish before using this command.')
   })
 
   it('still refuses on the open turn, not on the work the strip now shows', () => {
@@ -63,7 +63,7 @@ describe('conversationCommandBlocked background tasks', () => {
           }
         ]
       }) as unknown as ReturnType<typeof ctx.journal.snapshot>
-    expect(conversationCommandBlocked(ctx, RECORD)).toBe(
+    expect(conversationCommandBlocked(ctx, RECORD)?.message).toBe(
       'Wait for the current turn to finish before using this command.'
     )
   })
diff --git a/src/main/native-chat/agent-session-wire/structured-conversation-command-admission.ts b/src/main/native-chat/agent-session-wire/structured-conversation-command-admission.ts
index 78b9f4a59d0f..cecdbbf0b139 100644
--- a/src/main/native-chat/agent-session-wire/structured-conversation-command-admission.ts
+++ b/src/main/native-chat/agent-session-wire/structured-conversation-command-admission.ts
@@ -1,33 +1,51 @@
 import type { AgentSessionRecord } from '../../../shared/agent-session-record'
 import { activeStructuredAgentSessionTurnId } from '../../../shared/structured-agent-session-projection'
 import type { AgentSessionTurnContext } from './structured-agent-session-turns'
+import {
+  refuse,
+  type AgentSessionRefusalReason,
+  type AgentSessionWireRefusal
+} from '../../../shared/agent-session-wire-refusals'
+
+function blocked(
+  reason: AgentSessionRefusalReason<'agent_session_operation_invalid'>,
+  message: string
+): AgentSessionWireRefusal {
+  return refuse('agent_session_operation_invalid', { reason }, message)
+}
 
 export function conversationCommandBlocked(
   ctx: AgentSessionTurnContext,
   record: AgentSessionRecord
-): string | null {
+): AgentSessionWireRefusal | null {
   const items = ctx.journal.snapshot().items
   if (record.rewind?.phase === 'prepared' || record.rewind?.phase === 'provider-succeeded') {
-    return 'agent_session_rewind:outcome-unknown'
+    return blocked('rewindUnconfirmed', 'agent_session_rewind:outcome-unknown')
   }
   if (
     record.conversationCommand?.command === 'clear' &&
     record.conversationCommand.phase === 'committed' &&
     record.conversationCommand.replacementSessionId
   ) {
-    return 'This conversation has been cleared. Open the current conversation to continue.'
+    return blocked(
+      'conversationCleared',
+      'This conversation has been cleared. Open the current conversation to continue.'
+    )
   }
   if (
     record.conversationCommand?.state === 'unknown' &&
     record.conversationCommand.phase === 'prepared'
   ) {
-    return 'The previous conversation operation is unconfirmed.'
+    return blocked(
+      'conversationCommandUnconfirmed',
+      'The previous conversation operation is unconfirmed.'
+    )
   }
   if (record.lease.handoffStage || record.lease.handoffOperationId) {
-    return 'Wait for the session handoff to finish.'
+    return blocked('handoffInFlight', 'Wait for the session handoff to finish.')
   }
   if (activeStructuredAgentSessionTurnId(items)) {
-    return 'Wait for the current turn to finish before using this command.'
+    return blocked('turnActive', 'Wait for the current turn to finish before using this command.')
   }
   if (
     items.some(
@@ -36,23 +54,35 @@ export function conversationCommandBlocked(
         item.body.resolution.state === 'pending'
     )
   ) {
-    return 'Resolve the pending question or approval before using this command.'
+    return blocked(
+      'promptPending',
+      'Resolve the pending question or approval before using this command.'
+    )
   }
   const backgroundTasks = ctx.adapter.backgroundTaskState?.(ctx.sessionId)
   if (backgroundTasks?.state === 'monitoring') {
     // Only ask for a stop the host can actually perform. A provider that
     // exposes neither a targeted nor an untargeted stop would otherwise leave
     // the command refused behind an instruction nobody can follow.
-    return backgroundTasks.supportsTaskStop || backgroundTasks.supportsStopAll !== false
-      ? 'Stop background tasks before using this command.'
-      : 'Wait for background tasks to finish before using this command.'
+    return blocked(
+      'backgroundTasksRunning',
+      backgroundTasks.supportsTaskStop || backgroundTasks.supportsStopAll !== false
+        ? 'Stop background tasks before using this command.'
+        : 'Wait for background tasks to finish before using this command.'
+    )
   }
   if (
-    ctx.journal
-      .submissions()
-      .some((entry) => entry.dispatchState === 'pending' || entry.dispatchState === 'unknown')
+    ctx.journal.submissions().some(
+      (entry) =>
+        entry.dispatchState === 'pending' ||
+        // Doubt left by an earlier child is not this one's work in flight.
+        (entry.dispatchState === 'unknown' && entry.recovered !== true && entry.fence === ctx.fence)
+    )
   ) {
-    return 'Resolve pending or unconfirmed messages before using this command.'
+    return blocked(
+      'messagesUnsettled',
+      'Resolve pending or unconfirmed messages before using this command.'
+    )
   }
   return null
 }
diff --git a/src/main/native-chat/agent-session-wire/structured-conversation-command-controller.ts b/src/main/native-chat/agent-session-wire/structured-conversation-command-controller.ts
index e5a0283ba836..662ec70e8dd9 100644
--- a/src/main/native-chat/agent-session-wire/structured-conversation-command-controller.ts
+++ b/src/main/native-chat/agent-session-wire/structured-conversation-command-controller.ts
@@ -1,3 +1,4 @@
+import { refuse } from '../../../shared/agent-session-wire-refusals'
 import { sendStructuredAgentSessionTurn } from './structured-agent-session-host-mutations'
 import {
   runStructuredConversationCommand,
@@ -20,10 +21,11 @@ export class StructuredConversationCommandController {
     this.pending.has(params.envelope.sessionId)
       ? Promise.resolve({
           ok: false,
-          refusal: {
-            code: 'agent_session_operation_invalid',
-            message: 'Wait for the conversation operation to finish.'
-          }
+          refusal: refuse(
+            'agent_session_operation_invalid',
+            { reason: 'conversationCommandInFlight' },
+            'Wait for the conversation operation to finish.'
+          )
         })
       : sendStructuredAgentSessionTurn(this.context(), caller, params)
 
@@ -33,10 +35,11 @@ export class StructuredConversationCommandController {
     if (pending && pending.key !== key) {
       return Promise.resolve({
         ok: false as const,
-        refusal: {
-          code: 'agent_session_operation_invalid' as const,
-          message: 'Wait for the conversation operation to finish.'
-        }
+        refusal: refuse(
+          'agent_session_operation_invalid',
+          { reason: 'conversationCommandInFlight' },
+          'Wait for the conversation operation to finish.'
+        )
       })
     }
     const entry = pending ?? { key, count: 0 }
diff --git a/src/main/native-chat/agent-session-wire/structured-conversation-command.test.ts b/src/main/native-chat/agent-session-wire/structured-conversation-command.test.ts
index a261c6dd1517..445326f60b09 100644
--- a/src/main/native-chat/agent-session-wire/structured-conversation-command.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-conversation-command.test.ts
@@ -6,7 +6,11 @@ import { computeAgentSessionPayloadFingerprint } from '../../../shared/agent-ses
 import type { AgentSessionConversationCommand } from '../../../shared/agent-session-conversation-command'
 import { AgentSessionRecordStore } from '../../runtime/agent-session-record-store'
 import { StructuredAgentSessionHost } from './structured-agent-session-host'
-import type { StructuredAgentSessionAdapter } from './structured-agent-session-adapter'
+import {
+  AgentSessionAcquisitionRefusal,
+  type StructuredAgentSessionAdapter
+} from './structured-agent-session-adapter'
+import type { StructuredSessionCompactionResult } from './structured-session-compaction'
 import {
   HOST_TEST_NOW,
   HOST_TEST_SESSION,
@@ -43,7 +47,7 @@ function commandParams(command: AgentSessionConversationCommand) {
 beforeEach(async () => {
   resetHostTestOperationIds()
   acquisitions = 0
-  compact.mockReset().mockResolvedValue({})
+  compact.mockReset().mockResolvedValue({ outcome: 'compacted' })
   directory = await mkdtemp(join(tmpdir(), 'orca-conversation-command-'))
   store = await AgentSessionRecordStore.open({
     directory: join(directory, 'store'),
@@ -117,7 +121,7 @@ describe('host conversation commands', () => {
     })
     expect(compact).toHaveBeenCalledTimes(1)
     expect(adapter.dispatch).not.toHaveBeenCalled()
-    const history = host.history({ sessionId: HOST_TEST_SESSION, direction: 'tail' })
+    const history = await host.history({ sessionId: HOST_TEST_SESSION, direction: 'tail' })
     expect(history.page.submissions).toEqual([])
     expect(
       history.page.items.some(
@@ -127,12 +131,47 @@ describe('host conversation commands', () => {
   })
 
   it('reports provider compaction failure without a stuck lifecycle', async () => {
-    compact.mockResolvedValue({ error: 'Not enough messages to compact.' })
+    const detail = { text: 'Not enough messages to compact.', audience: 'person' as const }
+    compact.mockResolvedValue({ outcome: 'failed', detail })
+    const failure = { kind: 'compactionFailed', detail }
     expect(await host.conversationCommand(caller, commandParams('compact'))).toMatchObject({
       ok: true,
-      value: { state: 'completed', error: 'Not enough messages to compact.' }
+      value: {
+        state: 'completed',
+        error: 'Compaction failed: Not enough messages to compact.',
+        failure
+      }
     })
     expect(store.getRecord(HOST_TEST_SESSION)?.conversationCommand?.state).toBe('completed')
+    const rows = await host.history({ sessionId: HOST_TEST_SESSION, direction: 'tail' })
+    expect(rows.ok && rows.page.items.map((item) => item.body)).toContainEqual({
+      kind: 'status',
+      text: 'Compaction failed: Not enough messages to compact.',
+      failure
+    })
+  })
+
+  it('says only that compaction failed when the provider gave no words', async () => {
+    compact.mockResolvedValue({ outcome: 'failed' })
+    expect(await host.conversationCommand(caller, commandParams('compact'))).toMatchObject({
+      ok: true,
+      value: { error: 'Compaction failed.', failure: { kind: 'compactionFailed' } }
+    })
+  })
+
+  it('records a compaction the provider never confirmed as unconfirmed, not failed', async () => {
+    compact.mockResolvedValue({ outcome: 'unconfirmed' })
+    const failure = { kind: 'compactionUnconfirmed' }
+    expect(await host.conversationCommand(caller, commandParams('compact'))).toMatchObject({
+      ok: true,
+      value: { error: 'Compaction completion is unconfirmed.', failure }
+    })
+    const rows = await host.history({ sessionId: HOST_TEST_SESSION, direction: 'tail' })
+    expect(rows.ok && rows.page.items.map((item) => item.body)).toContainEqual({
+      kind: 'status',
+      text: 'Compaction completion is unconfirmed.',
+      failure
+    })
   })
 
   it('keeps an unknown compaction from being executed again', async () => {
@@ -204,7 +243,7 @@ describe('host conversation commands', () => {
     })
     expect(store.getRecord(HOST_TEST_SESSION)).not.toBeNull()
     expect(store.listVisibleSessionIds()).toEqual([nextId])
-    expect(host.history({ sessionId: nextId, direction: 'tail' }).page.items).toEqual([])
+    expect((await host.history({ sessionId: nextId, direction: 'tail' })).page.items).toEqual([])
     expect(await host.conversationCommand(caller, params)).toMatchObject({
       ok: true,
       replayed: true,
@@ -236,7 +275,13 @@ describe('host conversation commands', () => {
     })
     expect(await host.conversationCommand(caller, commandParams('clear'))).toMatchObject({
       ok: true,
-      value: { state: 'completed', replacementSessionId: undefined, error: expect.any(String) }
+      value: {
+        state: 'completed',
+        replacementSessionId: undefined,
+        // The refusal's message is Orca's log text; the result words its situation.
+        error: "Codex couldn't start. Start a new chat to continue.",
+        failure: { kind: 'startFailed', refusal: { code: 'structured_agent_session_unsupported' } }
+      }
     })
     expect(store.listVisibleSessionIds()).toEqual([HOST_TEST_SESSION])
     expect(acquisitions).toBe(1)
@@ -245,17 +290,39 @@ describe('host conversation commands', () => {
     })
   })
 
-  it('rejects stale fences before provider execution', async () => {
+  it('tells the user to run /clear again when the replacement could not start', async () => {
+    vi.mocked(adapter.acquire).mockRejectedValueOnce(new Error('spawn codex ENOENT'))
+    expect(await host.conversationCommand(caller, commandParams('clear'))).toMatchObject({
+      ok: true,
+      value: { state: 'completed', error: "Codex couldn't start. Run /clear again." }
+    })
+  })
+
+  it('keeps the situation a refused replacement start named', async () => {
+    vi.mocked(adapter.acquire).mockRejectedValueOnce(
+      new AgentSessionAcquisitionRefusal('Codex is not signed in.', 'notSignedIn')
+    )
+    expect(await host.conversationCommand(caller, commandParams('clear'))).toMatchObject({
+      ok: true,
+      value: {
+        state: 'completed',
+        replacementSessionId: undefined,
+        // The next step is the command the user ran, not a message into the old conversation.
+        error: 'Codex is not signed in for the selected account. Sign in, then run /clear again.',
+        failure: { kind: 'notSignedIn' }
+      }
+    })
+    expect(store.listVisibleSessionIds()).toEqual([HOST_TEST_SESSION])
+  })
+
+  it('runs a command whose fence the client has not caught up to', async () => {
     const params = commandParams('compact')
     params.envelope.expectedRuntimeFence++
-    expect(await host.conversationCommand(caller, params)).toMatchObject({
-      ok: false,
-      refusal: { code: 'agent_session_checkpoint_stale' }
-    })
-    expect(compact).not.toHaveBeenCalled()
+    expect(await host.conversationCommand(caller, params)).toMatchObject({ ok: true })
+    expect(compact).toHaveBeenCalledTimes(1)
   })
   it('allows cancellation while compaction is awaiting completion and refuses a second client', async () => {
-    let finish!: (value: {}) => void
+    let finish!: (value: StructuredSessionCompactionResult) => void
     compact.mockImplementation(
       () =>
         new Promise((resolve) => {
@@ -283,7 +350,7 @@ describe('host conversation commands', () => {
     })
     expect(cancel).toMatchObject({ ok: true, value: { cancelled: true } })
     expect(adapter.cancelTurn).toHaveBeenCalled()
-    finish({})
+    finish({ outcome: 'compacted' })
     await running
   })
 
@@ -309,7 +376,7 @@ describe('host conversation commands', () => {
     compact.mockRejectedValue(new Error('connection lost'))
     const params = commandParams('compact')
     await expect(host.conversationCommand(caller, params)).rejects.toThrow()
-    await compact.mock.calls[0]![0].onLateResult?.({})
+    await compact.mock.calls[0]![0].onLateResult?.({ outcome: 'compacted' })
     expect(await host.conversationCommand(caller, params)).toMatchObject({
       ok: true,
       replayed: true,
@@ -346,7 +413,7 @@ describe('host conversation commands', () => {
       replayed: true,
       value: { state: 'unknown' }
     })
-    compact.mockResolvedValue({})
+    compact.mockResolvedValue({ outcome: 'compacted' })
     expect(await host.conversationCommand(caller, commandParams('compact'))).toMatchObject({
       ok: true,
       value: { state: 'completed' }
diff --git a/src/main/native-chat/agent-session-wire/structured-conversation-command.ts b/src/main/native-chat/agent-session-wire/structured-conversation-command.ts
index 022343d94070..2075c24d7bb0 100644
--- a/src/main/native-chat/agent-session-wire/structured-conversation-command.ts
+++ b/src/main/native-chat/agent-session-wire/structured-conversation-command.ts
@@ -16,9 +16,55 @@ import {
 } from './structured-agent-session-attach'
 import { admitAndRunAgentSessionMutation } from './structured-agent-session-mutation-admission'
 import type { StructuredAgentSessionMutationContext } from './structured-agent-session-host-mutations'
+import {
+  openWithAgent,
+  structuredAgentSessionFailureWordsContext
+} from './structured-agent-session-send-preparation'
 import type { StructuredAgentSessionCaller } from './structured-agent-session-host-types'
 import type { StructuredAgentSessionHost } from './structured-agent-session-host'
 import { conversationCommandBlocked } from './structured-conversation-command-admission'
+import {
+  agentSessionFailureFact,
+  type AgentSessionFailureFact
+} from '../../../shared/agent-session-failure'
+import {
+  agentSessionFailureWords,
+  type AgentSessionFailureWordsContext
+} from '../../../shared/agent-session-failure-words'
+import { structuredAgentSessionStartFailureFact } from './structured-agent-session-failure-text'
+import type { StructuredSessionCompactionResult } from './structured-session-compaction'
+
+/** A compaction that did not succeed, keeping only what the provider wrote for a person. */
+function compactionFailure(
+  result: StructuredSessionCompactionResult
+): AgentSessionFailureFact | undefined {
+  switch (result.outcome) {
+    case 'compacted':
+      return undefined
+    case 'unconfirmed':
+      return agentSessionFailureFact('compactionUnconfirmed')
+    case 'failed':
+      return agentSessionFailureFact('compactionFailed', { detail: result.detail })
+  }
+}
+
+function compactionStatusBody(failure: AgentSessionFailureFact | undefined) {
+  return failure
+    ? { kind: 'status' as const, ...agentSessionFailureWords(failure, { surface: 'row' }) }
+    : { kind: 'status' as const, text: 'Conversation compacted.' }
+}
+
+/** A command's `error` is the sentence its row shows. */
+function conversationCommandFailure(
+  failure: AgentSessionFailureFact | undefined,
+  context: AgentSessionFailureWordsContext = {}
+) {
+  if (!failure) {
+    return {}
+  }
+  const words = agentSessionFailureWords(failure, { ...context, surface: 'row' })
+  return { error: words.text, failure: words.failure }
+}
 
 export type ConversationCommandParams = {
   envelope: AgentSessionMutationEnvelope
@@ -52,6 +98,8 @@ export function runStructuredConversationCommand(
       adapter: context.deps.adapter,
       callerKey: caller.callerKey,
       envelope,
+      // Only the provider can do this, so an agent at rest is started first.
+      prepareSession: openWithAgent(context, params.envelope),
       journal: () => context.sessions.get(sessionId)?.journal,
       publish: (journal) => context.publish(sessionId, journal),
       flushStreamedEvents: context.flushStreamedEvents,
@@ -90,10 +138,7 @@ export function runStructuredConversationCommand(
               ? null
               : conversationCommandBlocked(ctx, record)
           if (blocked) {
-            return {
-              ok: false,
-              refusal: { code: 'agent_session_operation_invalid', message: blocked }
-            }
+            return { ok: false, refusal: blocked }
           }
           const replacementSessionId =
             command === 'clear'
@@ -113,7 +158,7 @@ export function runStructuredConversationCommand(
             ...(replacementSessionId ? { replacementSessionId } : {})
           }
           await store.setConversationCommand(sessionId, ctx.fence, prepared)
-          let error: string | undefined
+          let failure: AgentSessionFailureFact | undefined
           if (command === 'clear' && replacementSessionId) {
             const attach: AgentSessionAttachParams = {
               envelope: {
@@ -149,12 +194,19 @@ export function runStructuredConversationCommand(
               ) {
                 throw new Error(acquired.refusal.message)
               }
+              // The refusal's message is Orca's log text; the result keeps its situation instead.
               const failed = {
                 ...prepared,
                 replacementSessionId: undefined,
                 phase: 'committed' as const,
                 state: 'completed' as const,
-                error: acquired.refusal.message.slice(0, 4096)
+                ...conversationCommandFailure(
+                  structuredAgentSessionStartFailureFact({
+                    refusal: acquired.refusal,
+                    newSession: true
+                  }),
+                  { ...structuredAgentSessionFailureWordsContext(record), command: 'clear' }
+                )
               }
               await store.setConversationCommand(sessionId, ctx.fence, failed)
               return { ok: true, value: failed }
@@ -176,9 +228,8 @@ export function runStructuredConversationCommand(
               },
               { fence: ctx.fence }
             )
-            ctx.publish()
             try {
-              error = (
+              failure = compactionFailure(
                 await ctx.adapter.compact({
                   turnId: `compact:${clientOperationId}`,
                   sessionId,
@@ -192,16 +243,15 @@ export function runStructuredConversationCommand(
                         return
                       }
                       await host.flushStreamedEvents(sessionId)
-                      await ctx.journal.appendItem(
-                        identity,
-                        { kind: 'status', text: result.error ?? 'Conversation compacted.' },
-                        { fence: ctx.fence }
-                      )
+                      const late = compactionFailure(result)
+                      await ctx.journal.appendItem(identity, compactionStatusBody(late), {
+                        fence: ctx.fence
+                      })
                       await store.setConversationCommand(sessionId, ctx.fence, {
                         ...prepared,
                         phase: 'committed',
                         state: 'completed',
-                        ...(result.error ? { error: result.error.slice(0, 4096) } : {})
+                        ...conversationCommandFailure(late)
                       })
                       await store.recordOperationOutcome({
                         callerKey: caller.callerKey,
@@ -212,32 +262,27 @@ export function runStructuredConversationCommand(
                           conversationCommand: matching()!
                         }
                       })
-                      ctx.publish()
                     })
                 })
-              ).error
+              )
               await host.flushStreamedEvents(sessionId)
             } catch (cause) {
               await ctx.journal.appendItem(
                 identity,
-                { kind: 'status', text: 'Compaction completion is unconfirmed.' },
+                compactionStatusBody(agentSessionFailureFact('compactionUnconfirmed')),
                 { fence: ctx.fence }
               )
-              ctx.publish()
               throw cause
             }
-            await ctx.journal.appendItem(
-              identity,
-              { kind: 'status', text: error ?? 'Conversation compacted.' },
-              { fence: ctx.fence }
-            )
-            ctx.publish()
+            await ctx.journal.appendItem(identity, compactionStatusBody(failure), {
+              fence: ctx.fence
+            })
           }
           const completed = {
             ...prepared,
             phase: 'committed' as const,
             state: 'completed' as const,
-            ...(error ? { error: error.slice(0, 4096) } : {})
+            ...conversationCommandFailure(failure)
           }
           await store.setConversationCommand(sessionId, ctx.fence, completed)
           return { ok: true, value: completed }
diff --git a/src/main/native-chat/agent-session-wire/structured-rewind-journal-body.test.ts b/src/main/native-chat/agent-session-wire/structured-rewind-journal-body.test.ts
index 6fa4d32293b9..9de1925791fa 100644
--- a/src/main/native-chat/agent-session-wire/structured-rewind-journal-body.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-rewind-journal-body.test.ts
@@ -2,6 +2,13 @@ import { describe, expect, it } from 'vitest'
 import { AgentSessionRewindRecordSchema } from '../../../shared/agent-session-rewind'
 import { restoreRewindJournalBody } from './structured-rewind-journal-body'
 
+/** A row this build cannot place: still a row, never its stored JSON, and not a failure — a
+ *  hostFault's "Try again" would be false for a placeholder. */
+const UNPLACEABLE = {
+  kind: 'status',
+  text: 'Orca could not show this item after the rewind.'
+}
+
 describe('rewind recovery of newer durable records', () => {
   it('keeps an unknown message role and block readable without discarding the row', () => {
     expect(
@@ -43,16 +50,13 @@ describe('rewind recovery of newer durable records', () => {
       input: { path: 'file' },
       state: 'paused-by-provider'
     }
-    expect(restoreRewindJournalBody(body)).toEqual({ kind: 'status', text: JSON.stringify(body) })
+    expect(restoreRewindJournalBody(body)).toEqual(UNPLACEABLE)
     const status = {
       kind: 'status' as const,
       text: 'state',
       turnLifecycle: { turnId: 'turn', state: 'future-state' }
     }
-    expect(restoreRewindJournalBody(status)).toEqual({
-      kind: 'status',
-      text: JSON.stringify(status)
-    })
+    expect(restoreRewindJournalBody(status)).toEqual(UNPLACEABLE)
   })
   it.each(['interrupted', 'unverifiable'] as const)(
     'keeps a %s turn and its recorded endpoints',
@@ -82,10 +86,7 @@ describe('rewind recovery of newer durable records', () => {
     }
     expect(restoreRewindJournalBody(turn)).toEqual(turn)
     const unknown = { ...turn, state: 'future-state' }
-    expect(restoreRewindJournalBody(unknown)).toEqual({
-      kind: 'status',
-      text: JSON.stringify(unknown)
-    })
+    expect(restoreRewindJournalBody(unknown)).toEqual(UNPLACEABLE)
   })
   it('keeps a known turn outcome across rewind recovery in both journal shapes', () => {
     const turn = {
diff --git a/src/main/native-chat/agent-session-wire/structured-rewind-journal-body.ts b/src/main/native-chat/agent-session-wire/structured-rewind-journal-body.ts
index addc234e2a13..99489b18769a 100644
--- a/src/main/native-chat/agent-session-wire/structured-rewind-journal-body.ts
+++ b/src/main/native-chat/agent-session-wire/structured-rewind-journal-body.ts
@@ -9,10 +9,15 @@ import { NATIVE_CHAT_ROLES } from '../../../shared/native-chat-types'
 
 type StoredBody = AgentSessionRewindRecord['retained'][number]['body']
 
-/** Unknown future values remain visible evidence, never invented turn or prompt state. */
+/** A row this build cannot place stays visible as a row, never invented turn or prompt state —
+ *  and never as its stored JSON, which is Orca's record, not something a person reads. */
 export function restoreRewindJournalBody(body: StoredBody): AgentJournalItemBody {
   let normalized: unknown = body
-  const fallback = () => ({ kind: 'status', text: JSON.stringify(body) })
+  // A placeholder, not a failure anyone can act on, so it carries no fact.
+  const fallback = () => ({
+    kind: 'status',
+    text: 'Orca could not show this item after the rewind.'
+  })
   if (body.kind === 'message') {
     normalized = {
       ...body,
diff --git a/src/main/native-chat/agent-session-wire/structured-rewind-refusal.ts b/src/main/native-chat/agent-session-wire/structured-rewind-refusal.ts
index 5ea205a527cd..af309b13f405 100644
--- a/src/main/native-chat/agent-session-wire/structured-rewind-refusal.ts
+++ b/src/main/native-chat/agent-session-wire/structured-rewind-refusal.ts
@@ -2,23 +2,28 @@ import {
   AGENT_SESSION_REWIND_REASONS,
   type AgentSessionRewindReason
 } from '../../../shared/agent-session-rewind'
-import type { AgentSessionWireRefusal } from '../../../shared/agent-session-wire'
+import { refuse, type AgentSessionWireRefusal } from '../../../shared/agent-session-wire'
 
 export function rewindRefusal(reason: AgentSessionRewindReason): {
   ok: false
   refusal: AgentSessionWireRefusal
 } {
-  const knownReason =
+  const rewindReason =
     AGENT_SESSION_REWIND_REASONS.find((value) => value === reason) ?? 'outcome-unknown'
+  const message = `agent_session_rewind:${rewindReason}`
   return {
     ok: false,
-    refusal: {
-      code:
-        knownReason === 'outcome-unknown'
-          ? 'agent_session_operation_unknown'
-          : 'agent_session_operation_invalid',
-      message: `agent_session_rewind:${knownReason}`,
-      rewindReason: knownReason
-    }
+    refusal:
+      rewindReason === 'outcome-unknown'
+        ? refuse(
+            'agent_session_operation_unknown',
+            { reason: 'rewindUnconfirmed', rewindReason },
+            message
+          )
+        : refuse(
+            'agent_session_operation_invalid',
+            { reason: 'rewindRefused', rewindReason },
+            message
+          )
   }
 }
diff --git a/src/main/native-chat/agent-session-wire/structured-session-compaction.test.ts b/src/main/native-chat/agent-session-wire/structured-session-compaction.test.ts
index 13a22b655b31..8936a4a28d07 100644
--- a/src/main/native-chat/agent-session-wire/structured-session-compaction.test.ts
+++ b/src/main/native-chat/agent-session-wire/structured-session-compaction.test.ts
@@ -6,7 +6,7 @@ describe('structured compaction lifecycle', () => {
     const tracker = new StructuredSessionCompaction()
     const finished = vi.fn()
     const result = tracker
-      .run('session', 'thread', async () => ({}))
+      .run('session', 'thread', async () => undefined)
       .then((value) => {
         finished()
         return value
@@ -28,7 +28,7 @@ describe('structured compaction lifecycle', () => {
       threadId: 'thread',
       turn: { id: 'compact-turn', status: 'completed' }
     })
-    await expect(result).resolves.toEqual({})
+    await expect(result).resolves.toEqual({ outcome: 'compacted' })
   })
 
   it('observes notifications arriving before the request acknowledgment', async () => {
@@ -41,7 +41,10 @@ describe('structured compaction lifecycle', () => {
           turn: { id: 'c', status: 'failed', error: { message: 'Unavailable' } }
         })
       })
-    ).resolves.toEqual({ error: 'Unavailable' })
+    ).resolves.toEqual({
+      outcome: 'failed',
+      detail: { text: 'Unavailable', audience: 'person' }
+    })
   })
 
   it.each(['success', 'failed'])(
@@ -63,7 +66,12 @@ describe('structured compaction lifecycle', () => {
         result: ''
       })
       await expect(result).resolves.toEqual(
-        state === 'success' ? {} : { error: 'Not enough messages to compact.' }
+        state === 'success'
+          ? { outcome: 'compacted' }
+          : {
+              outcome: 'failed',
+              detail: { text: 'Not enough messages to compact.', audience: 'person' }
+            }
       )
     }
   )
@@ -72,26 +80,26 @@ describe('structured compaction lifecycle', () => {
     const tracker = new StructuredSessionCompaction()
     const pending = tracker.run('s', 'p', async () => {})
     tracker.ended('s')
-    await expect(pending).resolves.toEqual({ error: 'The provider exited during compaction.' })
+    await expect(pending).resolves.toEqual({ outcome: 'unconfirmed' })
     const next = tracker.run('s', 'p', async () => {
       tracker.claude('s', { type: 'system', subtype: 'compact_boundary', session_id: 'p' })
       tracker.claude('s', { type: 'result', subtype: 'success', session_id: 'p' })
     })
-    await expect(next).resolves.toEqual({})
+    await expect(next).resolves.toEqual({ outcome: 'compacted' })
   })
   it('reconciles a terminal frame after timeout without repeating the provider request', async () => {
     vi.useFakeTimers()
     try {
       const tracker = new StructuredSessionCompaction(10)
       const late = vi.fn(async () => {})
-      const invoke = vi.fn(async () => ({}))
+      const invoke = vi.fn(async () => undefined)
       const result = tracker.run('s', 'p', invoke, late)
       const rejected = expect(result).rejects.toThrow('unconfirmed')
       await vi.advanceTimersByTimeAsync(11)
       await rejected
       tracker.claude('s', { type: 'system', subtype: 'compact_boundary', session_id: 'p' })
       tracker.claude('s', { type: 'result', subtype: 'success', session_id: 'p' })
-      expect(late).toHaveBeenCalledWith({})
+      expect(late).toHaveBeenCalledWith({ outcome: 'compacted' })
       expect(invoke).toHaveBeenCalledTimes(1)
     } finally {
       vi.useRealTimers()
@@ -100,9 +108,34 @@ describe('structured compaction lifecycle', () => {
 
   it('does not mistake an unrelated completed turn for compaction', async () => {
     const tracker = new StructuredSessionCompaction()
-    const result = tracker.run('s', 't', async () => ({}))
+    const result = tracker.run('s', 't', async () => undefined)
     tracker.codex('s', 'turn/started', { threadId: 't', turn: { id: 'c' } })
     tracker.codex('s', 'turn/completed', { threadId: 't', turn: { id: 'c', status: 'completed' } })
-    await expect(result).resolves.toEqual({ error: 'Compaction did not complete.' })
+    await expect(result).resolves.toEqual({ outcome: 'unconfirmed' })
+  })
+
+  it('fails, not merely unconfirmed, a Codex compaction turn that did not complete', async () => {
+    const tracker = new StructuredSessionCompaction()
+    const result = tracker.run('s', 't', async () => undefined)
+    tracker.codex('s', 'turn/started', { threadId: 't', turn: { id: 'c' } })
+    tracker.codex('s', 'turn/completed', {
+      threadId: 't',
+      turn: { id: 'c', status: 'interrupted' }
+    })
+    await expect(result).resolves.toEqual({ outcome: 'failed' })
+  })
+
+  it('leaves a Claude turn that ended without confirming compaction unconfirmed', async () => {
+    const tracker = new StructuredSessionCompaction()
+    const result = tracker.run('s', 'p', async () => {})
+    tracker.claude('s', { type: 'result', subtype: 'success', session_id: 'p' })
+    await expect(result).resolves.toEqual({ outcome: 'unconfirmed' })
+  })
+
+  it('fails a Claude compaction whose turn ended in error', async () => {
+    const tracker = new StructuredSessionCompaction()
+    const result = tracker.run('s', 'p', async () => {})
+    tracker.claude('s', { type: 'result', subtype: 'error_during_execution', session_id: 'p' })
+    await expect(result).resolves.toEqual({ outcome: 'failed' })
   })
 })
diff --git a/src/main/native-chat/agent-session-wire/structured-session-compaction.ts b/src/main/native-chat/agent-session-wire/structured-session-compaction.ts
index 328c283dc118..5f5c88d0b075 100644
--- a/src/main/native-chat/agent-session-wire/structured-session-compaction.ts
+++ b/src/main/native-chat/agent-session-wire/structured-session-compaction.ts
@@ -1,10 +1,32 @@
+import { providerDiagnostic, type ProviderDiagnostic } from '../../../shared/agent-session-failure'
+
+/** How a compaction ended. `unconfirmed`: the provider never said whether it compacted, so it may
+ *  have. `detail` is the provider's own words for a failure, when it gave any. */
+export type StructuredSessionCompactionResult =
+  | { outcome: 'compacted' }
+  | { outcome: 'failed'; detail?: ProviderDiagnostic }
+  | { outcome: 'unconfirmed' }
+
+/** A compaction that never began: refused before it was sent, or by the provider at the request. */
+export type StructuredSessionCompactionRefusal = Extract<
+  StructuredSessionCompactionResult,
+  { outcome: 'failed' }
+>
+
+function compactionFailed(
+  detail: ProviderDiagnostic | undefined
+): StructuredSessionCompactionRefusal {
+  return { outcome: 'failed', ...(detail ? { detail } : {}) }
+}
+
 type PendingCompaction = {
   identity: string
   commandTurnId?: string
   turnId?: string
-  error?: string
+  /** The provider reported the compaction failed, with its words when it gave any. */
+  failed?: { detail?: ProviderDiagnostic }
   compacted: boolean
-  finish: (result: { error?: string }) => void
+  finish: (result: StructuredSessionCompactionResult) => void
 }
 
 function record(value: unknown): Record<string, unknown> {
@@ -26,17 +48,17 @@ export class StructuredSessionCompaction {
   async run(
     sessionId: string,
     identity: string,
-    invoke: () => Promise<unknown>,
-    onLateResult?: (result: { error?: string }) => Promise<void>,
+    invoke: () => Promise<StructuredSessionCompactionRefusal | undefined>,
+    onLateResult?: (result: StructuredSessionCompactionResult) => Promise<void>,
     commandTurnId?: string
-  ): Promise<{ error?: string }> {
+  ): Promise<StructuredSessionCompactionResult> {
     if (this.pending.has(sessionId)) {
       throw new Error('Compaction is already running.')
     }
     let timer: ReturnType<typeof setTimeout>
     let expired = false
-    const completion = new Promise<{ error?: string }>((resolve, reject) => {
-      const finish = (result: { error?: string }) => {
+    const completion = new Promise<StructuredSessionCompactionResult>((resolve, reject) => {
+      const finish = (result: StructuredSessionCompactionResult) => {
         this.pending.delete(sessionId)
         if (expired && onLateResult) {
           void onLateResult(result).catch((error) =>
@@ -60,9 +82,9 @@ export class StructuredSessionCompaction {
     // Observe rejection even while invoke is waiting for its own receipt.
     void completion.catch(() => {})
     try {
-      const admission = record(await invoke())
-      if (typeof admission.error === 'string') {
-        this.pending.get(sessionId)?.finish({ error: admission.error })
+      const refusal = await invoke()
+      if (refusal) {
+        this.pending.get(sessionId)?.finish(compactionFailed(refusal.detail))
       }
       return await completion
     } catch (error) {
@@ -89,7 +111,8 @@ export class StructuredSessionCompaction {
   }
 
   ended(sessionId: string): void {
-    this.pending.get(sessionId)?.finish({ error: 'The provider exited during compaction.' })
+    // It may have compacted before it exited.
+    this.pending.get(sessionId)?.finish({ outcome: 'unconfirmed' })
   }
 
   codex(sessionId: string, method: string, value: unknown): void {
@@ -108,9 +131,11 @@ export class StructuredSessionCompaction {
     if (method === 'turn/completed' && turn.id === pending.turnId) {
       const error = record(turn.error).message
       pending.finish(
-        turn.status === 'completed' && pending.compacted
-          ? {}
-          : { error: typeof error === 'string' ? error : 'Compaction did not complete.' }
+        turn.status !== 'completed'
+          ? compactionFailed(
+              typeof error === 'string' ? providerDiagnostic(error, 'person') : undefined
+            )
+          : { outcome: pending.compacted ? 'compacted' : 'unconfirmed' }
       )
     }
   }
@@ -121,8 +146,12 @@ export class StructuredSessionCompaction {
       return
     }
     if (message.compact_result === 'failed') {
-      pending.error =
-        typeof message.compact_error === 'string' ? message.compact_error : 'Compaction failed.'
+      pending.failed = {
+        detail:
+          typeof message.compact_error === 'string'
+            ? providerDiagnostic(message.compact_error, 'person')
+            : undefined
+      }
     }
     if (message.compact_result === 'success' || message.subtype === 'compact_boundary') {
       pending.compacted = true
@@ -132,12 +161,13 @@ export class StructuredSessionCompaction {
         message.is_error === true ||
         (typeof message.subtype === 'string' && message.subtype.startsWith('error'))
       ) {
-        pending.error ??= 'Compaction did not complete.'
+        pending.failed ??= {}
       }
-      const error =
-        pending.error ??
-        (pending.compacted ? undefined : 'Compaction was not confirmed by the provider.')
-      pending.finish(error ? { error } : {})
+      pending.finish(
+        pending.failed
+          ? compactionFailed(pending.failed.detail)
+          : { outcome: pending.compacted ? 'compacted' : 'unconfirmed' }
+      )
     }
   }
 }
diff --git a/src/main/native-chat/agent-session-wire/unhandled-provider-frame.ts b/src/main/native-chat/agent-session-wire/unhandled-provider-frame.ts
index cbb0857c8591..915bbad5e545 100644
--- a/src/main/native-chat/agent-session-wire/unhandled-provider-frame.ts
+++ b/src/main/native-chat/agent-session-wire/unhandled-provider-frame.ts
@@ -1,4 +1,4 @@
-import type { AgentJournalStatusItem } from '../../../shared/agent-session-journal-types'
+import type { AgentJournalPlainStatusItem } from '../../../shared/agent-session-journal-types'
 import {
   boundInlineText,
   boundPayload,
@@ -12,7 +12,7 @@ import {
 } from './provider-frame-disposition'
 
 export type UnhandledProviderFrameJournalItem = {
-  body: AgentJournalStatusItem
+  body: AgentJournalPlainStatusItem
   /** Why the frame surfaced. Error frames are exempt from generic-row caps. */
   classification: 'timeline-substantive' | 'error-surface'
 }
diff --git a/src/main/native-chat/claude-structured-managed-account-support.ts b/src/main/native-chat/claude-structured-managed-account-support.ts
index dccf6216bda8..3b42c44c443f 100644
--- a/src/main/native-chat/claude-structured-managed-account-support.ts
+++ b/src/main/native-chat/claude-structured-managed-account-support.ts
@@ -43,12 +43,19 @@ export function structuredClaudeMatchesActiveManagedAccount(
     // apart after the fact: honest deselection, where ambient auth is the truth and the UI names no
     // identity, and the WSL-only case, where the prune emptied the host slot and persisted null
     // while the UI still names the WSL account. The presence of any WSL-bound account decides.
-    return !accounts.some((candidate) => candidate.managedAuthRuntime === 'wsl')
+    return !hasWslBoundClaudeAccount(settings)
   }
   const active = accounts.find((candidate) => candidate.id === activeHostId)
   return active ? active.managedAuthRuntime !== 'wsl' : false
 }
 
+/** Whether any managed Claude account lives in WSL, the account shape the gate refuses over. */
+export function hasWslBoundClaudeAccount(settings: ClaudeManagedAccountGateSettings): boolean {
+  return (settings.claudeManagedAccounts ?? []).some(
+    (candidate) => candidate.managedAuthRuntime === 'wsl'
+  )
+}
+
 /** Reads the gate's settings, answering null when they cannot be read so callers refuse. */
 export function readClaudeManagedAccountGateSettings(
   getSettings: () => ClaudeManagedAccountGateSettings
diff --git a/src/main/native-chat/structured-agent-session-history-adoption.ts b/src/main/native-chat/structured-agent-session-history-adoption.ts
index d470735b0320..e64e8f799d8f 100644
--- a/src/main/native-chat/structured-agent-session-history-adoption.ts
+++ b/src/main/native-chat/structured-agent-session-history-adoption.ts
@@ -5,6 +5,7 @@
 // journal, and a call site written there would compile however wrong it was. The runtime hands over
 // the facts it owns — the account homes it recognises, the records it holds — and this decides.
 
+import { agentSessionRefusalError } from '../../shared/agent-session-wire-refusals'
 import type { AgentSessionOperationRow } from '../../shared/agent-session-operation-ledger'
 import type { AgentSessionProviderHandle } from '../../shared/agent-session-journal-types'
 import type { AgentSessionLease, AgentSessionRecord } from '../../shared/agent-session-record'
@@ -106,10 +107,11 @@ export function findConflictingStructuredAdoption(input: {
 export function structuredAdoptionConflictError(
   ownership: StructuredAgentSessionAdoptionOwnership
 ): Error {
-  return new Error(
+  return agentSessionRefusalError(
     agentSessionLeaseAdmitsWriter(ownership.lease)
       ? 'agent_session_conflict'
-      : 'agent_session_ownership_unknown'
+      : 'agent_session_ownership_unknown',
+    { reason: 'conversationHeldElsewhere' }
   )
 }
 
@@ -152,5 +154,7 @@ export async function resolveStructuredAgentSessionAdoption(input: {
   }
   // Refuse rather than fall back to the default home. Resuming under a home that does not hold the
   // conversation is how a "resume" silently becomes a blank chat wearing the old chat's name.
-  throw new Error('agent_session_identity_required')
+  throw agentSessionRefusalError('agent_session_identity_required', {
+    reason: 'transcriptNotFound'
+  })
 }
diff --git a/src/main/native-chat/transcript-read-cache-inflight.test.ts b/src/main/native-chat/transcript-read-cache-inflight.test.ts
new file mode 100644
index 000000000000..47abc8b3e426
--- /dev/null
+++ b/src/main/native-chat/transcript-read-cache-inflight.test.ts
@@ -0,0 +1,215 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type { ReadTranscriptResult } from './transcript-reader'
+
+const mocks = vi.hoisted(() => ({
+  resolve: vi.fn<(...args: unknown[]) => Promise<string | null>>(),
+  stat: vi.fn<() => Promise<{ mtimeMs: number; size: number }>>(),
+  read: vi.fn<() => Promise<ReadTranscriptResult>>()
+}))
+
+vi.mock('./session-file-resolver', () => ({ resolveSessionFilePath: mocks.resolve }))
+vi.mock('./wsl-transcript-fs-access', () => ({ wslGatedStat: mocks.stat }))
+vi.mock('./transcript-reader', () => ({ readNativeChatTranscript: mocks.read }))
+
+import {
+  clearNativeChatTranscriptCache,
+  readNativeChatTranscriptCached
+} from './transcript-read-cache'
+import {
+  WSL_TRANSCRIPT_FS_SLOW_MESSAGE,
+  wslTranscriptFsTimeoutError
+} from './wsl-transcript-fs-error'
+
+beforeEach(() => {
+  clearNativeChatTranscriptCache()
+  vi.resetAllMocks()
+  mocks.resolve.mockResolvedValue('/repo/session.jsonl')
+  mocks.stat.mockResolvedValue({ mtimeMs: 1, size: 10 })
+})
+
+describe('concurrent transcript cache reads', () => {
+  it('parses a shared file generation once across simultaneous clients and session aliases', async () => {
+    const pending = Promise.withResolvers<ReadTranscriptResult>()
+    const result: ReadTranscriptResult = { messages: [] }
+    mocks.read.mockReturnValue(pending.promise)
+    const calls = Array.from({ length: 8 }, (_, i) =>
+      readNativeChatTranscriptCached('claude', `session-alias-${i}`)
+    )
+
+    await vi.waitFor(() => expect(mocks.stat).toHaveBeenCalledTimes(8))
+    pending.resolve(result)
+
+    expect((await Promise.all(calls)).every((value) => value === result)).toBe(true)
+    expect(mocks.read).toHaveBeenCalledTimes(1)
+    await expect(readNativeChatTranscriptCached('claude', 'session')).resolves.toBe(result)
+    expect(mocks.read).toHaveBeenCalledTimes(1)
+    expect(mocks.stat).toHaveBeenCalledTimes(9)
+  })
+
+  it('does not share a session id across distinct resolved files or agents', async () => {
+    const first = Promise.withResolvers<ReadTranscriptResult>()
+    const second = Promise.withResolvers<ReadTranscriptResult>()
+    const third = Promise.withResolvers<ReadTranscriptResult>()
+    mocks.resolve
+      .mockResolvedValueOnce('/repo-a/session.jsonl')
+      .mockResolvedValueOnce('/repo-b/session.jsonl')
+      .mockResolvedValueOnce('/repo-a/session.jsonl')
+    mocks.read
+      .mockReturnValueOnce(first.promise)
+      .mockReturnValueOnce(second.promise)
+      .mockReturnValueOnce(third.promise)
+    const calls = [
+      readNativeChatTranscriptCached('claude', 'session'),
+      readNativeChatTranscriptCached('claude', 'session'),
+      readNativeChatTranscriptCached('codex', 'session')
+    ]
+    const results: ReadTranscriptResult[] = [{ messages: [] }, { messages: [] }, { messages: [] }]
+    first.resolve(results[0])
+    second.resolve(results[1])
+    third.resolve(results[2])
+
+    const actual = await Promise.all(calls)
+    actual.forEach((value, i) => expect(value).toBe(results[i]))
+    expect(mocks.read).toHaveBeenCalledTimes(3)
+  })
+
+  it.each([
+    { mtimeMs: 2, size: 10 },
+    { mtimeMs: 1, size: 20 }
+  ])('does not let an older parse overwrite changed file stats %j', async (changedStat) => {
+    const oldRead = Promise.withResolvers<ReadTranscriptResult>()
+    const oldResult: ReadTranscriptResult = { messages: [] }
+    const newResult: ReadTranscriptResult = { messages: [] }
+    mocks.read.mockReturnValueOnce(oldRead.promise).mockResolvedValueOnce(newResult)
+    const first = readNativeChatTranscriptCached('claude', 'session')
+    await vi.waitFor(() => expect(mocks.read).toHaveBeenCalledTimes(1))
+
+    mocks.stat.mockResolvedValue(changedStat)
+    await expect(readNativeChatTranscriptCached('claude', 'session')).resolves.toBe(newResult)
+    oldRead.resolve(oldResult)
+    await expect(first).resolves.toBe(oldResult)
+    await expect(readNativeChatTranscriptCached('claude', 'session')).resolves.toBe(newResult)
+    expect(mocks.read).toHaveBeenCalledTimes(2)
+  })
+
+  it('invalidates a completed parse when size changes without an mtime change', async () => {
+    const first: ReadTranscriptResult = { messages: [] }
+    const second: ReadTranscriptResult = { messages: [] }
+    mocks.read.mockResolvedValueOnce(first).mockResolvedValueOnce(second)
+    await expect(readNativeChatTranscriptCached('claude', 'session')).resolves.toBe(first)
+    mocks.stat.mockResolvedValue({ mtimeMs: 1, size: 20 })
+
+    await expect(readNativeChatTranscriptCached('claude', 'session')).resolves.toBe(second)
+    expect(mocks.read).toHaveBeenCalledTimes(2)
+  })
+
+  it('rechecks the cache when another read completes during stat', async () => {
+    const slowStat = Promise.withResolvers<{ mtimeMs: number; size: number }>()
+    const result: ReadTranscriptResult = { messages: [] }
+    mocks.stat.mockReturnValueOnce(slowStat.promise)
+    mocks.read.mockResolvedValue(result)
+    const delayed = readNativeChatTranscriptCached('claude', 'session')
+    await vi.waitFor(() => expect(mocks.stat).toHaveBeenCalledTimes(1))
+    await expect(readNativeChatTranscriptCached('claude', 'session')).resolves.toBe(result)
+    slowStat.resolve({ mtimeMs: 1, size: 10 })
+
+    await expect(delayed).resolves.toBe(result)
+    expect(mocks.read).toHaveBeenCalledTimes(1)
+  })
+
+  it('serves the latest completed parse if a concurrent stat is refused', async () => {
+    const first: ReadTranscriptResult = { messages: [] }
+    const latest: ReadTranscriptResult = { messages: [] }
+    mocks.read.mockResolvedValueOnce(first).mockResolvedValueOnce(latest)
+    await readNativeChatTranscriptCached('claude', 'session')
+
+    const slowStat = Promise.withResolvers<{ mtimeMs: number; size: number }>()
+    mocks.stat.mockReturnValueOnce(slowStat.promise).mockResolvedValue({ mtimeMs: 2, size: 20 })
+    const delayed = readNativeChatTranscriptCached('claude', 'session')
+    await vi.waitFor(() => expect(mocks.stat).toHaveBeenCalledTimes(2))
+    await expect(readNativeChatTranscriptCached('claude', 'session')).resolves.toBe(latest)
+    slowStat.reject(wslTranscriptFsTimeoutError())
+
+    await expect(delayed).resolves.toBe(latest)
+    await expect(readNativeChatTranscriptCached('claude', 'session')).resolves.toBe(latest)
+    expect(mocks.read).toHaveBeenCalledTimes(2)
+  })
+
+  it.each(['resolve', 'stat', 'read'] as const)(
+    'clear fences work waiting on %s',
+    async (stage) => {
+      const oldResult: ReadTranscriptResult = { messages: [] }
+      const freshResult: ReadTranscriptResult = { messages: [] }
+      const pending = Promise.withResolvers<void>()
+      if (stage === 'resolve') {
+        mocks.resolve.mockImplementationOnce(async () => {
+          await pending.promise
+          return '/repo/session.jsonl'
+        })
+      } else if (stage === 'stat') {
+        mocks.stat.mockImplementationOnce(async () => {
+          await pending.promise
+          return { mtimeMs: 1, size: 10 }
+        })
+      } else {
+        mocks.read.mockImplementationOnce(async () => {
+          await pending.promise
+          return oldResult
+        })
+      }
+      const oldCall = readNativeChatTranscriptCached('claude', 'session')
+      await vi.waitFor(() => expect(mocks[stage]).toHaveBeenCalledTimes(1))
+      clearNativeChatTranscriptCache()
+      mocks.read.mockResolvedValue(freshResult)
+      await expect(readNativeChatTranscriptCached('claude', 'session')).resolves.toBe(freshResult)
+      mocks.read.mockResolvedValue(oldResult)
+      pending.resolve()
+
+      await expect(oldCall).resolves.toBe(oldResult)
+      await expect(readNativeChatTranscriptCached('claude', 'session')).resolves.toBe(freshResult)
+      expect(mocks.read).toHaveBeenCalledTimes(2)
+    }
+  )
+
+  it.each([
+    { error: WSL_TRANSCRIPT_FS_SLOW_MESSAGE },
+    { error: 'File was rotated', notFound: true } as const
+  ])('shares a retryable result only while in flight: %j', async (error) => {
+    const pending = Promise.withResolvers<ReadTranscriptResult>()
+    mocks.read.mockReturnValueOnce(pending.promise).mockResolvedValue({ messages: [] })
+    const first = readNativeChatTranscriptCached('claude', 'session')
+    const second = readNativeChatTranscriptCached('claude', 'session')
+    await vi.waitFor(() => expect(mocks.stat).toHaveBeenCalledTimes(2))
+    pending.resolve(error)
+
+    expect(await Promise.all([first, second])).toEqual([error, error])
+    expect(mocks.read).toHaveBeenCalledTimes(1)
+    await expect(readNativeChatTranscriptCached('claude', 'session')).resolves.toEqual({
+      messages: []
+    })
+    expect(mocks.read).toHaveBeenCalledTimes(2)
+  })
+
+  it('retries a rejected body read', async () => {
+    mocks.read.mockRejectedValueOnce(new Error('read failure')).mockResolvedValue({ messages: [] })
+    await expect(readNativeChatTranscriptCached('claude', 'session')).rejects.toThrow(
+      'read failure'
+    )
+    await expect(readNativeChatTranscriptCached('claude', 'session')).resolves.toEqual({
+      messages: []
+    })
+    expect(mocks.read).toHaveBeenCalledTimes(2)
+  })
+
+  it('does not share or cache reads whose file generation could not be determined', async () => {
+    mocks.stat.mockRejectedValue(new Error('stat failed'))
+    mocks.read.mockImplementation(async () => ({ messages: [] }))
+    const [first, second] = await Promise.all([
+      readNativeChatTranscriptCached('claude', 'session'),
+      readNativeChatTranscriptCached('claude', 'session')
+    ])
+    expect(first).not.toBe(second)
+    await readNativeChatTranscriptCached('claude', 'session')
+    expect(mocks.read).toHaveBeenCalledTimes(3)
+  })
+})
diff --git a/src/main/native-chat/transcript-read-cache.ts b/src/main/native-chat/transcript-read-cache.ts
index ab5c220bfd13..828521e2e3d5 100644
--- a/src/main/native-chat/transcript-read-cache.ts
+++ b/src/main/native-chat/transcript-read-cache.ts
@@ -1,4 +1,5 @@
 import type { AgentType } from '../../shared/native-chat-types'
+import { InFlightPromiseDedupe, stableInFlightKey } from '../../shared/in-flight-promise-dedupe'
 import { resolveSessionFilePath } from './session-file-resolver'
 import { readNativeChatTranscript, type ReadTranscriptResult } from './transcript-reader'
 import { wslGatedStat } from './wsl-transcript-fs-access'
@@ -24,14 +25,18 @@ import {
 
 type CachedTranscript = {
   result: ReadTranscriptResult
-  /** mtime of the resolved file when cached; a newer mtime invalidates it. */
+  /** mtime of the resolved file when cached; changed mtime or size invalidates it. */
   mtimeMs: number
   /** On-disk byte size of the resolved file — a cheap, monotonic proxy for this
    *  entry's parsed memory footprint, used to bound the cache by total bytes. */
   bytes: number
+  readOrder: number
 }
 
 const cache = new Map<string, CachedTranscript>()
+const inFlightReads = new InFlightPromiseDedupe<ReadTranscriptResult>()
+let cacheEpoch = 0
+let nextReadOrder = 0
 
 // Why: cap the cache so a long-lived process browsing many sessions can't grow
 // it unbounded. Map preserves insertion order, so evicting the first key drops
@@ -90,7 +95,7 @@ async function fileStat(filePath: string): Promise<{ mtimeMs: number; bytes: num
 
 /**
  * Read the full transcript for an agent + session, returning the cached parse on
- * an mtime hit and re-reading (and re-caching) when the file changed. Returns the
+ * an mtime/size hit and re-reading (and re-caching) when the file changed. Returns the
  * canonical, unwindowed result; callers apply their own windowing/truncation.
  */
 export async function readNativeChatTranscriptCached(
@@ -99,6 +104,7 @@ export async function readNativeChatTranscriptCached(
   /** Hook-reported authoritative transcript path, preferred over the id glob. */
   transcriptPath?: string
 ): Promise<ReadTranscriptResult> {
+  const epoch = cacheEpoch
   let filePath: string | null
   try {
     filePath = await resolveSessionFilePath(agent, sessionId, { transcriptPath })
@@ -114,7 +120,7 @@ export async function readNativeChatTranscriptCached(
   }
 
   const key = cacheKey(agent, filePath)
-  const cached = cache.get(key)
+  let cached = epoch === cacheEpoch ? cache.get(key) : undefined
   let mtimeMs: number
   let bytes: number
   try {
@@ -123,6 +129,7 @@ export async function readNativeChatTranscriptCached(
     // Why: the refusal says the distro stalled, not that this parse went stale —
     // a complete cached transcript beats a retry banner. With nothing cached the
     // error stands, and no `notFound`, so the next call re-stats a woken distro.
+    cached = epoch === cacheEpoch ? (cache.get(key) ?? cached) : undefined
     if (cached) {
       // Bump recency so a session read through a stall survives eviction.
       setCached(key, cached)
@@ -130,30 +137,43 @@ export async function readNativeChatTranscriptCached(
     }
     return { error: wslTranscriptFsRefusal(err).message }
   }
-  if (cached && Number.isFinite(mtimeMs) && cached.mtimeMs === mtimeMs) {
+  // Another reader can populate the cache while this caller waits for stat.
+  cached = epoch === cacheEpoch ? cache.get(key) : undefined
+  if (cached && Number.isFinite(mtimeMs) && cached.mtimeMs === mtimeMs && cached.bytes === bytes) {
     // Bump recency so a frequently-read session survives eviction.
     setCached(key, cached)
     return cached.result
   }
 
-  const result = await readNativeChatTranscript(agent, sessionId, { filePath })
-  // Why: a body-read refusal is transient unavailability, but the file's mtime
-  // is unchanged by it — caching it would serve the retryable error to every
-  // later call until the transcript itself changes, even after the distro woke.
-  if (Number.isFinite(mtimeMs) && !isGateRefusal(result)) {
-    setCached(key, { result, mtimeMs, bytes })
+  if (!Number.isFinite(mtimeMs) || epoch !== cacheEpoch) {
+    return readNativeChatTranscript(agent, sessionId, { filePath })
   }
-  return result
+
+  return inFlightReads.run(stableInFlightKey([key, mtimeMs, bytes, epoch]), async () => {
+    const readOrder = ++nextReadOrder
+    const result = await readNativeChatTranscript(agent, sessionId, { filePath })
+    // Late parses must not overwrite a newer completed read or repopulate a cleared cache.
+    if (
+      epoch === cacheEpoch &&
+      (cache.get(key)?.readOrder ?? 0) < readOrder &&
+      !isRetryableReadError(result)
+    ) {
+      setCached(key, { result, mtimeMs, bytes, readOrder })
+    }
+    return result
+  })
 }
 
-// The reader flattens a refusal into its message, so that is the only handle
-// this layer has on one.
-function isGateRefusal(result: ReadTranscriptResult): boolean {
-  return 'error' in result && isWslTranscriptFsRefusalMessage(result.error)
+function isRetryableReadError(result: ReadTranscriptResult): boolean {
+  return (
+    'error' in result && (result.notFound === true || isWslTranscriptFsRefusalMessage(result.error))
+  )
 }
 
 /** Test-only: drop the transcript parse cache between runs. */
 export function clearNativeChatTranscriptCache(): void {
+  cacheEpoch += 1
+  inFlightReads.clear()
   cache.clear()
 }
 
diff --git a/src/main/network/macos-tailscale-dns-diagnostic.ts b/src/main/network/macos-tailscale-dns-diagnostic.ts
index a4dc948c0bdb..a8e5a92ef584 100644
--- a/src/main/network/macos-tailscale-dns-diagnostic.ts
+++ b/src/main/network/macos-tailscale-dns-diagnostic.ts
@@ -14,8 +14,28 @@ type CacheEntry = {
 
 let cache: CacheEntry | null = null
 
+// Symbolic errno/Chromium codes carry the weight because they are locale-independent; the
+// English phrases only add coverage, so a localized or reworded string costs the hint, never
+// a wrong message. Deliberately over-inclusive: a false candidate re-reads cached DNS state,
+// a missed one silently drops the diagnostic that explains a broken connection.
 const NETWORK_LOOKUP_FAILURE_RE =
-  /\b(?:ENOTFOUND|EAI_AGAIN|ESERVFAIL|ERR_NAME_NOT_RESOLVED)\b|lookup address|nodename nor servname|name resolution|dns|websocket|connection refused/i
+  /\b(?:ENOTFOUND|ENODATA|EAI_AGAIN|EAI_FAIL|EAI_NODATA|EAI_NONAME|ESERVFAIL|ERR_NAME_NOT_RESOLVED|ERR_NAME_RESOLUTION_FAILED|getaddrinfo)\b|lookup address|nodename nor servname|name resolution|name or service not known|no address associated with hostname|(?:could not|couldn't|cannot|can't|unable to|failed to) resolve|dns|websocket|connection refused/i
+
+const MAGIC_DNS_HINT =
+  'macOS is using Tailscale MagicDNS (100.100.100.100) as the only global DNS resolver; add an upstream DNS server to the active network service or configure Tailscale global nameservers, then retry.'
+
+/**
+ * Single source of truth for "could a DNS sample explain this failure?". The probe-admission
+ * gate and the hint decision must never disagree — a gate stricter than the hint test silently
+ * loses the diagnostic for a genuine DNS failure.
+ */
+export function isMacTailscaleDnsHintCandidate(message: string, detail?: string | null): boolean {
+  // Already hinted: re-wrapping a hinted message would match on its own "DNS" text.
+  if (message.endsWith(MAGIC_DNS_HINT)) {
+    return false
+  }
+  return NETWORK_LOOKUP_FAILURE_RE.test(`${message}\n${detail ?? ''}`)
+}
 
 function globalDnsSection(scutilOutput: string): string {
   const scopedStart = scutilOutput.indexOf('\nDNS configuration (for scoped queries)')
@@ -66,26 +86,31 @@ function readMacTailscaleDnsDiagnostic(now = Date.now()): DnsDiagnostic | null {
   return diagnostic
 }
 
+// Why: Claude/Codex own the failing API transports, so Orca can only point
+// users at the macOS resolver configuration that makes those transports fail.
+function appendMagicDnsHint(message: string, diagnostic: DnsDiagnostic | null): string {
+  return diagnostic ? `${message} ${MAGIC_DNS_HINT}` : message
+}
+
 export function withMacTailscaleDnsHintForDiagnostic(
   message: string,
   detail: string | null | undefined,
   diagnostic: DnsDiagnostic | null
 ): string {
-  const probeText = `${message}\n${detail ?? ''}`
-  if (!NETWORK_LOOKUP_FAILURE_RE.test(probeText)) {
+  return isMacTailscaleDnsHintCandidate(message, detail)
+    ? appendMagicDnsHint(message, diagnostic)
+    : message
+}
+
+export function withMacTailscaleDnsHint(message: string, detail?: string | null): string {
+  // The hint only describes macOS resolver state, so nothing off darwin can produce it.
+  if (process.platform !== 'darwin') {
     return message
   }
-  if (!diagnostic) {
+  if (!isMacTailscaleDnsHintCandidate(message, detail)) {
     return message
   }
-
-  // Why: Claude/Codex own the failing API transports, so Orca can only point
-  // users at the macOS resolver configuration that makes those transports fail.
-  return `${message} macOS is using Tailscale MagicDNS (100.100.100.100) as the only global DNS resolver; add an upstream DNS server to the active network service or configure Tailscale global nameservers, then retry.`
-}
-
-export function withMacTailscaleDnsHint(message: string, detail?: string | null): string {
-  return withMacTailscaleDnsHintForDiagnostic(message, detail, readMacTailscaleDnsDiagnostic())
+  return appendMagicDnsHint(message, readMacTailscaleDnsDiagnostic())
 }
 
 export function __resetMacTailscaleDnsDiagnosticCacheForTests(): void {
diff --git a/src/main/network/macos-tailscale-dns-probe-admission.test.ts b/src/main/network/macos-tailscale-dns-probe-admission.test.ts
new file mode 100644
index 000000000000..9297c356f138
--- /dev/null
+++ b/src/main/network/macos-tailscale-dns-probe-admission.test.ts
@@ -0,0 +1,160 @@
+import { execFileSync } from 'node:child_process'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { formatAgentCliFailureMessage } from '../text-generation/source-control-agent-failure'
+import {
+  __resetMacTailscaleDnsDiagnosticCacheForTests,
+  parseMacTailscaleDnsDiagnostic,
+  withMacTailscaleDnsHint,
+  withMacTailscaleDnsHintForDiagnostic
+} from './macos-tailscale-dns-diagnostic'
+
+vi.mock('node:child_process', () => ({ execFileSync: vi.fn() }))
+
+const MAGIC_DNS = 'DNS configuration\n  nameserver[0] : 100.100.100.100\n'
+const PUBLIC_DNS = 'DNS configuration\n  nameserver[0] : 1.1.1.1\n'
+
+beforeEach(() => {
+  vi.spyOn(process, 'platform', 'get').mockReturnValue('darwin')
+  vi.spyOn(Date, 'now').mockReturnValue(1_000)
+  vi.mocked(execFileSync).mockReset().mockReturnValue(MAGIC_DNS)
+  __resetMacTailscaleDnsDiagnosticCacheForTests()
+})
+
+afterEach(() => {
+  vi.restoreAllMocks()
+  __resetMacTailscaleDnsDiagnosticCacheForTests()
+})
+
+describe('macOS DNS probe admission', () => {
+  it.each(['permission denied', 'authentication failed', 'PTY timeout', '', 'invalid JSON'])(
+    'does not probe for an unrelated error: %s',
+    (detail) => {
+      expect(withMacTailscaleDnsHint('Codex failed.', detail)).toBe('Codex failed.')
+      expect(execFileSync).not.toHaveBeenCalled()
+    }
+  )
+
+  it.each([
+    'ENOTFOUND',
+    'eai_again',
+    'lookup address',
+    'DNS failure',
+    'websocket',
+    'connection refused'
+  ])('still diagnoses a relevant detail: %s', (detail) => {
+    expect(withMacTailscaleDnsHint('Codex failed.', detail)).toContain('Tailscale MagicDNS')
+    expect(execFileSync).toHaveBeenCalledOnce()
+  })
+
+  it('recognizes a relevant message without detail', () => {
+    expect(withMacTailscaleDnsHint('ERR_NAME_NOT_RESOLVED')).toContain('Tailscale MagicDNS')
+    expect(execFileSync).toHaveBeenCalledOnce()
+  })
+
+  it.each(['linux', 'win32'] as const)('never probes on %s', (platform) => {
+    vi.spyOn(process, 'platform', 'get').mockReturnValue(platform)
+    expect(withMacTailscaleDnsHint('ENOTFOUND')).toBe('ENOTFOUND')
+    expect(execFileSync).not.toHaveBeenCalled()
+  })
+
+  it('does not warm the diagnostic cache for an unrelated failure', () => {
+    vi.mocked(execFileSync).mockReturnValue(PUBLIC_DNS)
+    withMacTailscaleDnsHint('permission denied')
+    expect(execFileSync).not.toHaveBeenCalled()
+
+    vi.mocked(execFileSync).mockReturnValue(MAGIC_DNS)
+    expect(withMacTailscaleDnsHint('ENOTFOUND')).toContain('Tailscale MagicDNS')
+    expect(execFileSync).toHaveBeenCalledOnce()
+  })
+
+  it('reuses the sample inside the five-minute window and refreshes it after', () => {
+    expect(withMacTailscaleDnsHint('ENOTFOUND')).toContain('Tailscale MagicDNS')
+
+    vi.mocked(Date.now).mockReturnValue(300_999)
+    vi.mocked(execFileSync).mockReturnValue(PUBLIC_DNS)
+    expect(withMacTailscaleDnsHint('ENOTFOUND')).toContain('Tailscale MagicDNS')
+
+    vi.mocked(Date.now).mockReturnValue(301_000)
+    expect(withMacTailscaleDnsHint('permission denied')).toBe('permission denied')
+    // The invariant is the resolver state the next relevant error reports, not the probe count.
+    expect(withMacTailscaleDnsHint('ENOTFOUND')).toBe('ENOTFOUND')
+  })
+
+  it.each(['empty output', 'failed command'])('retains negative caching for %s', (failure) => {
+    vi.mocked(execFileSync).mockImplementation(() => {
+      if (failure === 'failed command') {
+        throw new Error('probe failed')
+      }
+      return ''
+    })
+    expect(withMacTailscaleDnsHint('ENOTFOUND')).toBe('ENOTFOUND')
+    expect(withMacTailscaleDnsHint('EAI_AGAIN')).toBe('EAI_AGAIN')
+    expect(execFileSync).toHaveBeenCalledOnce()
+  })
+
+  it.each([
+    'EAI_NONAME',
+    'EAI_FAIL',
+    'ENODATA',
+    'getaddrinfo failed',
+    'could not resolve host orca.example',
+    'Name or service not known',
+    'ERR_NAME_RESOLUTION_FAILED',
+    'Temporary failure in name resolution'
+  ])('diagnoses the resolution failure wording %s', (detail) => {
+    expect(withMacTailscaleDnsHint('Codex failed.', detail)).toContain('Tailscale MagicDNS')
+  })
+
+  it('never lets probe admission change the message the hint decision would produce', () => {
+    const diagnostic = parseMacTailscaleDnsDiagnostic(MAGIC_DNS)
+    const details = [
+      'permission denied',
+      'authentication failed',
+      'PTY timeout',
+      'invalid JSON',
+      '',
+      'ENOTFOUND',
+      'EAI_AGAIN',
+      'EAI_NONAME',
+      'getaddrinfo failed',
+      'could not resolve host orca.example',
+      'connection refused',
+      'websocket closed'
+    ]
+
+    for (const detail of details) {
+      __resetMacTailscaleDnsDiagnosticCacheForTests()
+      expect(withMacTailscaleDnsHint('Codex failed.', detail)).toBe(
+        withMacTailscaleDnsHintForDiagnostic('Codex failed.', detail, diagnostic)
+      )
+    }
+  })
+
+  it('does not append or re-probe for a message that already carries the hint', () => {
+    const hinted = withMacTailscaleDnsHint('Codex failed.', 'ENOTFOUND')
+    expect(execFileSync).toHaveBeenCalledOnce()
+    // Past the cache window, so a second probe would run if the hint were re-admitted.
+    vi.mocked(Date.now).mockReturnValue(301_000)
+
+    expect(withMacTailscaleDnsHint(hinted, 'ENOTFOUND')).toBe(hinted)
+    expect(execFileSync).toHaveBeenCalledOnce()
+  })
+
+  it('avoids probing while formatting a local CLI permission failure', () => {
+    expect(formatAgentCliFailureMessage('Codex', '', 'permission denied', 1)).toBe(
+      'Codex CLI command failed with code 1: permission denied'
+    )
+    expect(execFileSync).not.toHaveBeenCalled()
+  })
+
+  it('keeps local network hints and honors the remote host opt-out', () => {
+    expect(
+      formatAgentCliFailureMessage('Codex', '', 'ENOTFOUND', 1, { includeLocalMacDnsHint: false })
+    ).toBe('Codex CLI command failed with code 1: ENOTFOUND')
+    expect(execFileSync).not.toHaveBeenCalled()
+    expect(formatAgentCliFailureMessage('Codex', '', 'ENOTFOUND', 1)).toContain(
+      'Tailscale MagicDNS'
+    )
+    expect(execFileSync).toHaveBeenCalledOnce()
+  })
+})
diff --git a/src/main/notebook/notebook-kernel.test.ts b/src/main/notebook/notebook-kernel.test.ts
index 899205dc2fe4..1ed290e3f9e9 100644
--- a/src/main/notebook/notebook-kernel.test.ts
+++ b/src/main/notebook/notebook-kernel.test.ts
@@ -8,21 +8,189 @@ vi.mock('../../../resources/notebook/kernel-bridge.py?asset&asarUnpack', () => (
 
 import { createFrameReader, startNotebookKernel } from './notebook-kernel'
 
+function collect(chunks: string[]): unknown[] {
+  const frames: unknown[] = []
+  const read = createFrameReader((frame) => frames.push(frame))
+  for (const chunk of chunks) {
+    read(chunk)
+  }
+  return frames
+}
+
 describe('createFrameReader', () => {
   it('reassembles frames split across chunks and skips stray lines', () => {
-    const frames: unknown[] = []
-    const read = createFrameReader((frame) => frames.push(frame))
-    read('warning: something printed\n{"type": "rea')
-    read('dy"}\n{"type": "stream", "content": {"name": "stdout", "text": "hi"}}\n[1, 2]\n')
-    read('{"type": "missing", "externallyManaged": true}\n{"type": "missing"}\n')
-    read('{"type": "unknown"}\n{"type": "done", "status": "ok", "execution_count": 3}\n{"partial')
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+    try {
+      expect(
+        collect([
+          'warning: something printed\n{"type": "rea',
+          'dy"}\n{"type": "stream", "content": {"name": "stdout", "text": "hi"}}\n[1, 2]\n',
+          '{"type": "missing", "externallyManaged": true}\n{"type": "missing"}\n',
+          '{"type": "unknown"}\n{"type": "done", "status": "ok", "execution_count": 3}\n{"partial'
+        ])
+      ).toEqual([
+        { type: 'ready' },
+        { type: 'stream', content: { name: 'stdout', text: 'hi' } },
+        { type: 'missing', externallyManaged: true },
+        { type: 'missing', externallyManaged: false },
+        { type: 'done', status: 'ok', execution_count: 3 }
+      ])
+    } finally {
+      warn.mockRestore()
+    }
+  })
+
+  it('avoids repeatedly scanning an incomplete image record for newlines', () => {
+    const frame = { type: 'display_data', content: { data: { 'image/png': 'x'.repeat(524_288) } } }
+    const wire = `${JSON.stringify(frame)}\n`
+    const chunks: string[] = []
+    for (let offset = 0; offset < wire.length; offset += 4096) {
+      chunks.push(wire.slice(offset, offset + 4096))
+    }
+    const originalSplit: { split(separator: unknown, limit?: number): string[] }['split'] =
+      String.prototype.split
+    const originalIndexOf = String.prototype.indexOf
+    let scannedCharacters = 0
+    const split = vi.spyOn(String.prototype, 'split').mockImplementation(function (
+      this: string,
+      separator: unknown,
+      limit?: number
+    ) {
+      if (separator === '\n') {
+        scannedCharacters += this.length
+      }
+      return originalSplit.call(this, separator, limit)
+    })
+    const indexOf = vi.spyOn(String.prototype, 'indexOf').mockImplementation(function (
+      this: string,
+      search: string,
+      position = 0
+    ) {
+      const found = originalIndexOf.call(this, search, position)
+      if (search === '\n') {
+        scannedCharacters += (found === -1 ? this.length : found + 1) - position
+      }
+      return found
+    })
+    let frames: unknown[]
+    try {
+      frames = collect(chunks)
+    } finally {
+      split.mockRestore()
+      indexOf.mockRestore()
+    }
+    expect(frames).toEqual([frame])
+    expect(scannedCharacters).toBeLessThanOrEqual(wire.length * 2)
+  })
+
+  it('does not measure record bytes when no size limit applies', () => {
+    const frame = { type: 'display_data', content: { data: { 'image/png': 'x'.repeat(65_536) } } }
+    const byteLength = vi.spyOn(Buffer, 'byteLength')
+    let frames: unknown[]
+    let measurements: number
+    try {
+      frames = collect([`${JSON.stringify(frame)}\n`])
+      measurements = byteLength.mock.calls.length
+    } finally {
+      byteLength.mockRestore()
+    }
+    expect(frames).toEqual([frame])
+    expect(measurements).toBe(0)
+  })
+
+  it('preserves code units at every split boundary', () => {
+    const frames = [
+      { type: 'stream', content: { text: 'café 漢字 🐋\n\u0000' } },
+      { type: 'execute_result', content: { data: { 'text/plain': '42' } } },
+      { type: 'done', status: 'ok', execution_count: 3 }
+    ]
+    const wire = `${frames.map((frame) => JSON.stringify(frame)).join('\n')}\n`
+    for (let offset = 0; offset <= wire.length; offset++) {
+      expect(collect([wire.slice(0, offset), '', wire.slice(offset)])).toEqual(frames)
+    }
+    expect(collect(wire.split(''))).toEqual(frames)
+  })
+
+  it('skips malformed and unsupported records without losing valid neighbors', () => {
+    const wire = [
+      'startup warning',
+      '',
+      '  ',
+      'null',
+      '[]',
+      '{"type":"ready"}',
+      '{"type":"missing","externallyManaged":true}',
+      '{"type":"missing","externallyManaged":"true"}',
+      '{"type":"stream","content":[]}',
+      '{"type":"unknown","content":{}}',
+      '{"type":"done","status":12,"execution_count":"3"}',
+      ''
+    ].join('\r\n')
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+    let frames: unknown[]
+    let reported: number
+    try {
+      frames = collect([wire])
+      reported = warn.mock.calls.length
+    } finally {
+      warn.mockRestore()
+    }
     expect(frames).toEqual([
       { type: 'ready' },
-      { type: 'stream', content: { name: 'stdout', text: 'hi' } },
       { type: 'missing', externallyManaged: true },
       { type: 'missing', externallyManaged: false },
-      { type: 'done', status: 'ok', execution_count: 3 }
+      { type: 'done', status: '12', execution_count: null }
     ])
+    // The unreadable line is reported; a parsed record of an unknown shape is not.
+    expect(reported).toBe(1)
+  })
+
+  it('does not apply the shared transport size limit to notebook display data', () => {
+    const frame = {
+      type: 'display_data',
+      content: { data: { 'image/png': 'x'.repeat(16 * 1024 * 1024 + 1) } }
+    }
+    expect(collect([JSON.stringify(frame), '\n'])).toEqual([frame])
+  })
+
+  it('waits for the final newline before delivering a record', () => {
+    const frames: unknown[] = []
+    const read = createFrameReader((frame) => frames.push(frame))
+    read('{"type":"rea')
+    expect(frames).toEqual([])
+    read('dy"}\n{"type":"missing"}')
+    expect(frames).toEqual([{ type: 'ready' }])
+    read('')
+    expect(frames).toHaveLength(1)
+    read('\n')
+    expect(frames).toEqual([{ type: 'ready' }, { type: 'missing', externallyManaged: false }])
+  })
+
+  it('holds a never-terminated record without emitting or rejecting it', () => {
+    const frames: unknown[] = []
+    const text = 'x'.repeat(200_000)
+    const wire = JSON.stringify({ type: 'stream', content: { name: 'stdout', text } })
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+    const read = createFrameReader((frame) => frames.push(frame))
+    try {
+      for (let offset = 0; offset < wire.length; offset += 4096) {
+        read(wire.slice(offset, offset + 4096))
+      }
+      expect(frames).toEqual([])
+      expect(warn).not.toHaveBeenCalled()
+      read('\n')
+    } finally {
+      warn.mockRestore()
+    }
+    expect(frames).toEqual([{ type: 'stream', content: { name: 'stdout', text } }])
+  })
+
+  it('does not swallow a consumer exception as malformed JSON', () => {
+    const error = new Error('consumer failed')
+    const read = createFrameReader(() => {
+      throw error
+    })
+    expect(() => read('{"type":"ready"}\n')).toThrow(error)
   })
 })
 
diff --git a/src/main/notebook/notebook-kernel.ts b/src/main/notebook/notebook-kernel.ts
index 6e50542f1f97..413b3bfeb653 100644
--- a/src/main/notebook/notebook-kernel.ts
+++ b/src/main/notebook/notebook-kernel.ts
@@ -1,6 +1,7 @@
 import bridgePath from '../../../resources/notebook/kernel-bridge.py?asset&asarUnpack'
 import { spawnProcess } from '../../shared/child-process/run-process'
 import { forceTerminateProcessTree } from '../../shared/child-process/process-tree-termination'
+import { createNdjsonParser } from '../../shared/main-process-ndjson-framer'
 import {
   KERNEL_OUTPUT_TYPES,
   type KernelFrame,
@@ -16,13 +17,7 @@ function isRecord(value: unknown): value is Record<string, unknown> {
   return typeof value === 'object' && value !== null && !Array.isArray(value)
 }
 
-function parseFrame(line: string): BridgeFrame | null {
-  let value: unknown
-  try {
-    value = JSON.parse(line)
-  } catch {
-    return null
-  }
+function parseFrame(value: unknown): BridgeFrame | null {
   if (!isRecord(value)) {
     return null
   }
@@ -46,17 +41,20 @@ function parseFrame(line: string): BridgeFrame | null {
 
 /** Splits bridge stdout into frames, skipping any line that is not one. */
 export function createFrameReader(onFrame: (frame: BridgeFrame) => void): (text: string) => void {
-  let partial = ''
-  return (text) => {
-    const lines = (partial + text).split('\n')
-    partial = lines.pop() ?? ''
-    for (const line of lines) {
-      const frame = parseFrame(line)
+  // Each frame ships as its line completes; a consumer throw escapes the stdout listener and is fatal anyway.
+  const parser = createNdjsonParser(
+    (value) => {
+      const frame = parseFrame(value)
       if (frame) {
         onFrame(frame)
       }
-    }
-  }
+    },
+    // The bridge keeps fd 1 to itself, so an unreadable line means the frame channel is damaged.
+    (error) => console.warn('[notebook-kernel] Dropped an unreadable bridge record:', error),
+    // Notebook display frames can contain large images; preserve the existing unrestricted size.
+    { maxLineBytes: Number.POSITIVE_INFINITY }
+  )
+  return (text) => parser.feed(text)
 }
 
 export type NotebookKernel = {
diff --git a/src/main/notebook/python-environments.test.ts b/src/main/notebook/python-environments.test.ts
index 05088d8236b0..eb69d981493d 100644
--- a/src/main/notebook/python-environments.test.ts
+++ b/src/main/notebook/python-environments.test.ts
@@ -9,7 +9,8 @@ vi.mock('../../shared/child-process/run-process', () => ({ runProcess: runProces
 import {
   createNotebookVenv,
   findWorkspaceInterpreters,
-  installIpykernel
+  installIpykernel,
+  listPythonEnvironments
 } from './python-environments'
 
 function existing(...paths: string[]): (path: string) => boolean {
@@ -47,6 +48,96 @@ describe('findWorkspaceInterpreters', () => {
   })
 })
 
+describe('listPythonEnvironments', () => {
+  let root = ''
+  const windows = process.platform === 'win32'
+  const venvPython = (): string =>
+    join(root, '.venv', ...(windows ? ['Scripts', 'python.exe'] : ['bin', 'python']))
+  const condaPython = (): string =>
+    join(root, 'nb', '.conda', ...(windows ? ['python.exe'] : ['bin', 'python']))
+  const programs = (): string[] => runProcessMock.mock.calls.map(([spec]) => spec.program)
+
+  beforeEach(() => {
+    runProcessMock.mockReset()
+    runProcessMock.mockImplementation(async ({ program }: { program: string }) => ({
+      code: 0,
+      stdout: `${program}\n3.13.0\n`,
+      stderr: ''
+    }))
+    root = mkdtempSync(join(tmpdir(), 'orca-pyenvs-'))
+    for (const interpreter of [venvPython(), condaPython()]) {
+      mkdirSync(dirname(interpreter), { recursive: true })
+      writeFileSync(interpreter, '')
+    }
+    writeFileSync(
+      join(root, '.venv', 'pyvenv.cfg'),
+      'home = /usr/bin\nversion_info = 3.12.1.final.0\n'
+    )
+    const condaMeta = join(root, 'nb', '.conda', 'conda-meta')
+    mkdirSync(condaMeta)
+    writeFileSync(join(condaMeta, 'python-dateutil-2.9.0-pyhd8ed1ab_0.json'), '{}')
+    writeFileSync(join(condaMeta, 'python-3.11.9-h8d4a6d2_0.json'), '{}')
+    return () => rmSync(root, { recursive: true, force: true })
+  })
+
+  it('lists workspace envs from disk without running them before trust', async () => {
+    const found = await listPythonEnvironments(join(root, 'nb', 'a.ipynb'), root, {
+      runWorkspaceInterpreters: false
+    })
+    expect(programs()).not.toContain(venvPython())
+    expect(programs()).not.toContain(condaPython())
+    expect(programs().length).toBeGreaterThan(0)
+    expect(found.workspace).toEqual([
+      { path: condaPython(), name: '.conda', version: '3.11.9' },
+      { path: venvPython(), name: '.venv', version: '3.12.1' }
+    ])
+  })
+
+  it('reads the stdlib venv version key and omits a version it cannot find', async () => {
+    writeFileSync(join(root, '.venv', 'pyvenv.cfg'), 'home = /usr/bin\nversion = 3.10.4\n')
+    const found = await listPythonEnvironments(join(root, 'a.ipynb'), root, {
+      runWorkspaceInterpreters: false
+    })
+    expect(found.workspace).toEqual([{ path: venvPython(), name: '.venv', version: '3.10.4' }])
+
+    writeFileSync(join(root, '.venv', 'pyvenv.cfg'), 'home = /usr/bin\n')
+    const unversioned = await listPythonEnvironments(join(root, 'a.ipynb'), root, {
+      runWorkspaceInterpreters: false
+    })
+    expect(unversioned.workspace).toEqual([{ path: venvPython(), name: '.venv' }])
+  })
+
+  it('reads only the head of pyvenv.cfg, whatever size it reports', async () => {
+    // procfs files report size 0 yet never end, so the read must be bounded, not size-gated.
+    const padding = `# ${'x'.repeat(1022)}\n`.repeat(128)
+    const cfg = join(root, '.venv', 'pyvenv.cfg')
+    const list = () =>
+      listPythonEnvironments(join(root, 'a.ipynb'), root, { runWorkspaceInterpreters: false })
+
+    writeFileSync(cfg, `version_info = 3.12.1.final.0\n${padding}`)
+    expect((await list()).workspace).toEqual([
+      { path: venvPython(), name: '.venv', version: '3.12.1' }
+    ])
+
+    writeFileSync(cfg, `${padding}version_info = 3.12.1.final.0\n`)
+    expect((await list()).workspace).toEqual([{ path: venvPython(), name: '.venv' }])
+  })
+
+  it('probes workspace envs once the notebook is trusted, dropping ones that fail', async () => {
+    runProcessMock.mockImplementation(async ({ program }: { program: string }) =>
+      program === condaPython()
+        ? { code: 1, stdout: '', stderr: 'broken' }
+        : { code: 0, stdout: `${program}\n3.13.0\n`, stderr: '' }
+    )
+    const found = await listPythonEnvironments(join(root, 'nb', 'a.ipynb'), root, {
+      runWorkspaceInterpreters: true
+    })
+    expect(programs()).toContain(venvPython())
+    expect(programs()).toContain(condaPython())
+    expect(found.workspace).toEqual([{ path: venvPython(), name: '.venv', version: '3.13.0' }])
+  })
+})
+
 describe('installIpykernel', () => {
   beforeEach(() => runProcessMock.mockReset())
   const result = (code: number | null, stderr = '', extra = {}) => ({
diff --git a/src/main/notebook/python-environments.ts b/src/main/notebook/python-environments.ts
index 4270f9ca62db..116e20e9e1b5 100644
--- a/src/main/notebook/python-environments.ts
+++ b/src/main/notebook/python-environments.ts
@@ -1,4 +1,4 @@
-import { existsSync } from 'node:fs'
+import { closeSync, existsSync, openSync, readdirSync, readSync, statSync } from 'node:fs'
 import { basename, dirname, isAbsolute, join, relative } from 'node:path'
 import { runProcess } from '../../shared/child-process/run-process'
 import type { ProcessResult } from '../../shared/child-process/process-spec'
@@ -15,6 +15,7 @@ const WORKSPACE_ENV_DIRS = ['.venv', '.conda']
 const INSTALL_TIMEOUT_MS = 10 * 60_000
 const INSTALL_DETAIL_CHARS = 4000
 const VENV_TIMEOUT_MS = 2 * 60_000
+const PYVENV_CFG_MAX_BYTES = 64 * 1024
 
 /** `.venv`/`.conda` interpreters from the notebook's folder up to the workspace root, nearest first. */
 export function findWorkspaceInterpreters(
@@ -62,27 +63,86 @@ async function probe(
   }
 }
 
-/** Names an interpreter after its environment folder when it lives in one. */
-function environmentName(executable: string): string {
+/** The environment folder an interpreter lives in, when it lives in one. */
+function environmentDir(executable: string): string | undefined {
   // venvs keep python in bin/ or Scripts\; Windows conda envs keep it at the env root.
-  const envDir = [dirname(dirname(executable)), dirname(executable)].find(
+  return [dirname(dirname(executable)), dirname(executable)].find(
     (dir) => existsSync(join(dir, 'pyvenv.cfg')) || existsSync(join(dir, 'conda-meta'))
   )
-  return basename(envDir ?? executable)
+}
+
+/** Names an interpreter after its environment folder when it lives in one. */
+function environmentName(executable: string): string {
+  return basename(environmentDir(executable) ?? executable)
+}
+
+/** The head of a regular file, read once into a fixed buffer. */
+function readFileHead(path: string, maxBytes: number): string | undefined {
+  // Why not a FIFO or device: opening one can block; a symlinked procfs file passes and reports size 0.
+  if (!existsSync(path) || !statSync(path).isFile()) {
+    return undefined
+  }
+  const fd = openSync(path, 'r')
+  try {
+    const buffer = Buffer.alloc(maxBytes)
+    return buffer.toString('utf8', 0, readSync(fd, buffer, 0, maxBytes, 0))
+  } finally {
+    closeSync(fd)
+  }
+}
+
+/** The Python version an environment records on disk: venv `pyvenv.cfg`, else conda's `conda-meta`. */
+function recordedVersion(envDir: string): string | undefined {
+  try {
+    // Why bounded, not size-checked: a hostile repo can point pyvenv.cfg at an endless file.
+    const cfg = readFileHead(join(envDir, 'pyvenv.cfg'), PYVENV_CFG_MAX_BYTES)
+    const match = cfg && /^\s*version(?:_info)?\s*=\s*(\d+\.\d+(?:\.\d+)?)/m.exec(cfg)
+    if (match) {
+      return match[1]
+    }
+    const condaMeta = join(envDir, 'conda-meta')
+    if (existsSync(condaMeta)) {
+      for (const entry of readdirSync(condaMeta)) {
+        const match = /^python-(\d+\.\d+(?:\.\d+)?)-.*\.json$/.exec(entry)
+        if (match) {
+          return match[1]
+        }
+      }
+    }
+  } catch {
+    // Unreadable metadata just leaves the version unknown.
+  }
+  return undefined
+}
+
+/** Describes a workspace interpreter from its files alone, without running it. */
+function describeWithoutRunning(interpreter: string): PythonEnvironment {
+  const envDir = environmentDir(interpreter)
+  const version = envDir === undefined ? undefined : recordedVersion(envDir)
+  const name = basename(envDir ?? interpreter)
+  return version ? { path: interpreter, name, version } : { path: interpreter, name }
 }
 
 export function describePython(path: string): Promise<PythonEnvironment | null> {
   return probe(path, [], environmentName)
 }
 
+/**
+ * Pythons a notebook can use. `runWorkspaceInterpreters` is false until the notebook is trusted:
+ * a repo can ship its own `.venv/bin/python`, so those are then read from disk, never run.
+ */
 export async function listPythonEnvironments(
   notebookPath: string,
-  rootPath: string | null
+  rootPath: string | null,
+  { runWorkspaceInterpreters }: { runWorkspaceInterpreters: boolean }
 ): Promise<PythonEnvironments> {
   const pathCommands =
     process.platform === 'win32' ? [['py', '-3'], ['python']] : [['python3'], ['python']]
+  const workspaceInterpreters = findWorkspaceInterpreters(notebookPath, rootPath)
   const [workspace, onPath] = await Promise.all([
-    Promise.all(findWorkspaceInterpreters(notebookPath, rootPath).map(describePython)),
+    runWorkspaceInterpreters
+      ? Promise.all(workspaceInterpreters.map(describePython))
+      : workspaceInterpreters.map(describeWithoutRunning),
     Promise.all(
       pathCommands.map(([program, ...args]) =>
         probe(program, args, () => [program, ...args].join(' '))
diff --git a/src/main/observability/agent-session-instrumentation.ts b/src/main/observability/agent-session-instrumentation.ts
index dc57bd69d0e4..693d96a28c20 100644
--- a/src/main/observability/agent-session-instrumentation.ts
+++ b/src/main/observability/agent-session-instrumentation.ts
@@ -3,7 +3,6 @@ import { withSpan, type ActiveSpan } from './tracer'
 export type AgentSessionCreatePhase =
   | 'reconcile_leases'
   | 'resolve_recovery'
-  | 'settlement_retry'
   | 'probe_owner'
   | 'reserve_owner'
   | 'acquire_owner'
diff --git a/src/main/observability/instrumentation.test.ts b/src/main/observability/instrumentation.test.ts
index 9bdbfd91d026..139bb2494dd4 100644
--- a/src/main/observability/instrumentation.test.ts
+++ b/src/main/observability/instrumentation.test.ts
@@ -261,8 +261,7 @@ describe('agentSession.create tracing', () => {
         totalDurationMs: 57,
         phases: [
           { phase: 'reconcile_leases', startedAtMs: 0, durationMs: 1 },
-          { phase: 'resolve_recovery', startedAtMs: 1, durationMs: 2 },
-          { phase: 'settlement_retry', startedAtMs: 3, durationMs: 3 },
+          { phase: 'resolve_recovery', startedAtMs: 1, durationMs: 5 },
           { phase: 'probe_owner', startedAtMs: 6, durationMs: 4 },
           { phase: 'reserve_owner', startedAtMs: 10, durationMs: 5 },
           { phase: 'acquire_owner', startedAtMs: 15, durationMs: 6 },
diff --git a/src/main/opencode-usage/store.ts b/src/main/opencode-usage/store.ts
index 5dc8a87c67b1..3bdcefeb0a77 100644
--- a/src/main/opencode-usage/store.ts
+++ b/src/main/opencode-usage/store.ts
@@ -1,3 +1,4 @@
+import { codexOpenCodeTokenSessions } from '../usage/agent-token-usage'
 import { app } from 'electron'
 import { join } from 'node:path'
 import type {
@@ -50,6 +51,10 @@ export class OpenCodeUsageStore extends UsageProviderStoreLifecycle<
 > {
   constructor(store: Pick<Store, 'getRepos' | 'getAllWorktreeMeta'>) {
     super(store, {
+      tokenUsage: {
+        provider: 'opencode',
+        selectSessions: (state) => codexOpenCodeTokenSessions(state.sessions)
+      },
       logTag: '[opencode-usage]',
       resolveCacheFile: getOpenCodeUsageFile,
       createDefaultState: getDefaultState,
diff --git a/src/main/opencode/hook-service.test.ts b/src/main/opencode/hook-service.test.ts
index 920c0b5e392e..9b0db3b0621a 100644
--- a/src/main/opencode/hook-service.test.ts
+++ b/src/main/opencode/hook-service.test.ts
@@ -93,7 +93,7 @@ describe('OpenCode hook plugin source', () => {
     const digest = (source: string): string => createHash('sha256').update(source).digest('hex')
 
     expect(digest(getOpenCodePluginSource())).toBe(
-      'f2c469ff2d360ed94955d715705b9d4dd633dd334887906fbb534c1925ec81c9'
+      'c81893814f08bfb2f9b5c133c5355b53d485982402d89e92ff15fc4e7d543079'
     )
     expect(
       digest(getOpenCodeFamilyPluginSource('/hook/mimo-code', { emitSessionStart: false }))
diff --git a/src/main/opencode2/status-plugin-setup-lifetime.test.ts b/src/main/opencode2/status-plugin-setup-lifetime.test.ts
new file mode 100644
index 000000000000..5a2c4280ced5
--- /dev/null
+++ b/src/main/opencode2/status-plugin-setup-lifetime.test.ts
@@ -0,0 +1,204 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { getOpenCode2SetupSource } from './status-plugin-setup-source'
+
+type Hooks = { event: (event: unknown) => Promise<void>; dispose?: () => Promise<void> }
+
+function createSetup(factory: () => Promise<Hooks>) {
+  const setup: unknown = new Function(
+    'OrcaOpenCodeStatusPlugin',
+    'AbortController',
+    'console',
+    `${getOpenCode2SetupSource().join('\n')}\nreturn setupOpenCode2Status;`
+  )(factory, AbortController, { warn: vi.fn() })
+  if (typeof setup !== 'function') {
+    throw new Error('Missing generated setup')
+  }
+  return async (context: unknown) => {
+    const cleanup: unknown = await setup(context)
+    if (typeof cleanup !== 'function') {
+      throw new Error('Missing generated cleanup')
+    }
+    return cleanup
+  }
+}
+
+function deferred() {
+  let finish = () => {}
+  const promise = new Promise<void>((resolve) => {
+    finish = resolve
+  })
+  return { promise, finish }
+}
+
+beforeEach(() => {
+  vi.stubGlobal(
+    'fetch',
+    vi.fn(async () => new Response('{}', { status: 200 }))
+  )
+})
+afterEach(() => {
+  expect(fetch).not.toHaveBeenCalled()
+  vi.unstubAllGlobals()
+})
+
+describe('generated OpenCode 2 setup ownership', () => {
+  it.each(['throw', 'reject'] as const)(
+    'disposes the factory after prompt registration %s',
+    async (failure) => {
+      const hooks = { event: vi.fn(async () => {}), dispose: vi.fn(async () => {}) }
+      const subscribe = vi.fn(async function* () {})
+      const hook = () => {
+        if (failure === 'throw') {
+          throw new Error('Registration failed')
+        }
+        return Promise.reject(new Error('Registration failed'))
+      }
+      const cleanup = await createSetup(async () => hooks)({
+        session: { hook },
+        event: { subscribe }
+      })
+      expect(hooks.dispose).toHaveBeenCalledOnce()
+      expect(subscribe).not.toHaveBeenCalled()
+      await cleanup()
+      expect(hooks.dispose).toHaveBeenCalledOnce()
+    }
+  )
+
+  it.each(['throw', 'reject'] as const)(
+    'disposes the factory after prompt cleanup %s',
+    async (failure) => {
+      const hooks = { event: vi.fn(async () => {}), dispose: vi.fn(async () => {}) }
+      const promptDispose = vi.fn(() => {
+        if (failure === 'throw') {
+          throw new Error('Prompt cleanup failed')
+        }
+        return Promise.reject(new Error('Prompt cleanup failed'))
+      })
+      let signal: AbortSignal | undefined
+      const cleanup = await createSetup(async () => hooks)({
+        session: { hook: async () => ({ dispose: promptDispose }) },
+        event: {
+          subscribe: (options: { signal: AbortSignal }) => {
+            signal = options.signal
+            return []
+          }
+        }
+      })
+      await cleanup()
+      expect(signal?.aborted).toBe(true)
+      expect(promptDispose).toHaveBeenCalledOnce()
+      expect(hooks.dispose).toHaveBeenCalledOnce()
+    }
+  )
+
+  it('waits for in-flight delivery before factory cleanup after a prompt cleanup failure', async () => {
+    const delivery = deferred()
+    const started = deferred()
+    const order: string[] = []
+    const hooks = {
+      event: vi.fn(async () => {
+        started.finish()
+        await delivery.promise
+        order.push('event')
+      }),
+      dispose: vi.fn(async () => {
+        order.push('factory')
+      })
+    }
+    const cleanup = await createSetup(async () => hooks)({
+      session: {
+        hook: async () => ({
+          dispose: async () => {
+            order.push('prompt')
+            throw new Error('Failed')
+          }
+        })
+      },
+      event: {
+        subscribe: async function* ({ signal }: { signal: AbortSignal }) {
+          try {
+            yield { type: 'session.execution.started', data: { sessionID: 'synthetic' } }
+            if (!signal.aborted) {
+              yield { type: 'session.execution.succeeded', data: { sessionID: 'synthetic' } }
+            }
+          } finally {
+            order.push('subscription')
+          }
+        }
+      }
+    })
+    await started.promise
+    const disposing = cleanup()
+    await Promise.resolve()
+    expect(hooks.dispose).not.toHaveBeenCalled()
+    delivery.finish()
+    await disposing
+    expect(order).toEqual(['prompt', 'event', 'subscription', 'factory'])
+    expect(hooks.event).toHaveBeenCalledOnce()
+    expect(hooks.dispose).toHaveBeenCalledOnce()
+  })
+
+  it.each(['setup', 'unload'] as const)(
+    'keeps %s fail-open when factory cleanup also rejects',
+    async (stage) => {
+      const hooks = {
+        event: vi.fn(async () => {}),
+        dispose: vi.fn(async () => {
+          throw new Error('Factory cleanup failed')
+        })
+      }
+      const cleanup = await createSetup(async () => hooks)({
+        session: {
+          hook: async () => {
+            if (stage === 'setup') {
+              throw new Error('Registration failed')
+            }
+            return {
+              dispose: async () => {
+                throw new Error('Prompt cleanup failed')
+              }
+            }
+          }
+        },
+        event: { subscribe: async function* () {} }
+      })
+      await cleanup()
+      expect(hooks.dispose).toHaveBeenCalledOnce()
+    }
+  )
+
+  it('disposes both owners once on ordinary unload', async () => {
+    const hooks = { event: vi.fn(async () => {}), dispose: vi.fn(async () => {}) }
+    const promptDispose = vi.fn(async () => {})
+    const cleanup = await createSetup(async () => hooks)({
+      session: { hook: async () => ({ dispose: promptDispose }) },
+      event: { subscribe: async function* () {} }
+    })
+    expect(hooks.dispose).not.toHaveBeenCalled()
+    await cleanup()
+    expect(promptDispose).toHaveBeenCalledOnce()
+    expect(hooks.dispose).toHaveBeenCalledOnce()
+  })
+
+  it('accepts absent optional disposers', async () => {
+    const cleanup = await createSetup(async () => ({ event: async () => {} }))({
+      session: { hook: async () => undefined },
+      event: { subscribe: async function* () {} }
+    })
+    await cleanup()
+  })
+
+  it('skips allocation for an unusable context and tolerates factory rejection', async () => {
+    const factory = vi.fn(async (): Promise<Hooks> => {
+      throw new Error('Factory failed')
+    })
+    await (
+      await createSetup(factory)(undefined)
+    )()
+    expect(factory).not.toHaveBeenCalled()
+    await (
+      await createSetup(factory)({ session: { hook: vi.fn() }, event: { subscribe: vi.fn() } })
+    )()
+    expect(factory).toHaveBeenCalledOnce()
+  })
+})
diff --git a/src/main/opencode2/status-plugin-setup-source.ts b/src/main/opencode2/status-plugin-setup-source.ts
index c4bf8d0ea724..c68c15cbda2c 100644
--- a/src/main/opencode2/status-plugin-setup-source.ts
+++ b/src/main/opencode2/status-plugin-setup-source.ts
@@ -10,6 +10,7 @@ const NON_SESSION_FORM_OWNERS = new Set(["global"]);
 
 async function setupOpenCode2Status(ctx) {
   const noop = async () => {};
+  let hooks;
   // Why: OpenCode may probe setup() with no context during startup, and the setup
   // API shape can drift between releases. Never throw from setup — a throw surfaces
   // as an 'orca-opencode-status' plugin failed error in the TUI, which is worse
@@ -23,7 +24,7 @@ async function setupOpenCode2Status(ctx) {
     // Without it, resolveRootSessionID returns null for every session and a
     // subagent's work publishes as if it were the root's.
     const client = { session: { get: async (input, options) => { const result = await ctx.session.get(input, options); return result && typeof result.id === "string" ? { data: result } : result; } } };
-    const hooks = await OrcaOpenCodeStatusPlugin({ client });
+    hooks = await OrcaOpenCodeStatusPlugin({ client });
     if (!hooks || typeof hooks.event !== "function") return noop;
     const promptRegistration = await ctx.session.hook("prompt", async (properties) => {
       await hooks.event({ event: { type: "session.next.prompt.admitted", properties } });
@@ -79,14 +80,22 @@ async function setupOpenCode2Status(ctx) {
     return async () => {
       try {
         controller.abort();
-        await promptRegistration?.dispose?.();
-        await consuming;
-        await hooks.dispose?.();
+        // Each owner must finish cleanup even when an earlier disposer rejects.
+        try {
+          await promptRegistration?.dispose?.();
+        } finally {
+          try {
+            await consuming;
+          } finally {
+            await hooks.dispose?.();
+          }
+        }
       } catch {
         // Why: cleanup runs during plugin unload; a throw here also fails the plugin.
       }
     };
   } catch {
+    try { await hooks?.dispose?.(); } catch {}
     return noop;
   }
 }
diff --git a/src/main/orca-profiles/profile-active-transfer-worker.test.ts b/src/main/orca-profiles/profile-active-transfer-worker.test.ts
new file mode 100644
index 000000000000..2e19eaf73f0b
--- /dev/null
+++ b/src/main/orca-profiles/profile-active-transfer-worker.test.ts
@@ -0,0 +1,127 @@
+import { mkdtempSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { describe, expect, it, vi } from 'vitest'
+import { getDefaultPersistedState } from '../../shared/constants'
+import { ORCA_PROFILE_INDEX_SCHEMA_VERSION } from '../../shared/orca-profiles'
+import { createWorkerMaintenanceFixture } from '../persistence/loading-store/profile-state-maintenance-fixture'
+import { ProfileStateSqliteAuthority } from '../persistence/profile-state/profile-state-sqlite-authority'
+import { transferActiveProfileProject } from './profile-active-transfer'
+import * as domainState from './profile-project-domain-state'
+import {
+  profileHasPendingProjectMove,
+  recoverPendingProfileProjectMoves
+} from './profile-project-move-intent'
+import { readProfileStateWithRevision } from './profile-project-state-file'
+
+vi.mock('../telemetry/client', () => ({ track: vi.fn() }))
+vi.mock('../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: () => ({ nth_repo_added: 2 })
+}))
+vi.mock('../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: () => ({ hosts: [] }),
+  sshConfigHostsToTargets: () => []
+}))
+
+async function fixture() {
+  const root = mkdtempSync(join(tmpdir(), 'orca-worker-profile-transfer-'))
+  writeFileSync(
+    join(root, 'orca-profile-index.json'),
+    JSON.stringify({
+      schemaVersion: ORCA_PROFILE_INDEX_SCHEMA_VERSION,
+      activeProfileId: 'source',
+      profiles: ['source', 'target'].map((id) => ({
+        id,
+        name: id,
+        avatar: { kind: 'initials', initials: id[0], color: 'neutral' },
+        kind: 'local',
+        createdAt: 1,
+        updatedAt: 1,
+        lastOpenedAt: 1
+      }))
+    })
+  )
+  const current = await createWorkerMaintenanceFixture({
+    directory: join(root, 'profiles', 'source'),
+    profileId: 'source',
+    cleanupRoot: root
+  })
+  const target = new ProfileStateSqliteAuthority(
+    join(root, 'profiles', 'target', 'profile-state.db'),
+    'target'
+  )
+  try {
+    target.writeSerializedState(Buffer.from(JSON.stringify(getDefaultPersistedState(root))))
+  } finally {
+    target.close()
+  }
+  const args = {
+    sourceProfileId: 'source',
+    targetProfileId: 'target',
+    repoId: 'repo-remote',
+    mode: 'move'
+  } as const
+  const read = (id: string) => readProfileStateWithRevision(id, root)
+  return { ...current, root, args, read }
+}
+
+describe('active profile transfers with the live writer', () => {
+  it('resumes the exact source revision after a validation failure', async () => {
+    const { store, root, args, read } = await fixture()
+    const reopen = vi.fn(async () => {})
+    await expect(
+      transferActiveProfileProject({ ...args, repoId: 'missing' }, root, store, reopen)
+    ).rejects.toThrow('unknown_source_repo')
+    expect(reopen).not.toHaveBeenCalled()
+    store.updateSettings({ theme: 'dark' })
+    await store.flushPendingOrThrowAsync()
+    expect(read('source').state.settings.theme).toBe('dark')
+  })
+
+  it('keeps the source frozen after moving a remote project and its persisted state', async () => {
+    const { store, root, args, read } = await fixture()
+    const result = await transferActiveProfileProject(args, root, store, async () => {})
+    expect(result.status).toBe('transferred')
+    expect(read('source').state.repos.some((repo) => repo.id === args.repoId)).toBe(false)
+    expect(read('target').state.repos.some((repo) => repo.id === args.repoId)).toBe(true)
+    const source = read('source')
+    store.updateSettings({ theme: 'dark' })
+    await expect(store.flushPendingOrThrowAsync()).rejects.toThrow('finalized')
+    expect(read('source')).toEqual(source)
+  })
+
+  it('resumes when a copy makes a later move a duplicate', async () => {
+    const { store, root, args, read } = await fixture()
+    await transferActiveProfileProject({ ...args, mode: 'copy' }, root, store, async () => {})
+    const result = await transferActiveProfileProject(args, root, store, async () => {})
+    expect(result.status).toBe('duplicate-target')
+    store.updateSettings({ theme: 'dark' })
+    await store.flushPendingOrThrowAsync()
+    expect(read('source').state.settings.theme).toBe('dark')
+    expect(read('source').state.repos.some((repo) => repo.id === args.repoId)).toBe(true)
+  })
+
+  it('leaves an interrupted move frozen until journal recovery runs with the writer closed', async () => {
+    const { store, root, args, read } = await fixture()
+    const original = domainState.writeProfileProjectDomainChanges
+    const fault = vi
+      .spyOn(domainState, 'writeProfileProjectDomainChanges')
+      .mockImplementation((id, ...rest) => {
+        if (id === args.sourceProfileId) {
+          throw new Error('source commit interrupted')
+        }
+        return original(id, ...rest)
+      })
+    const reopen = vi.fn(async () => {})
+    await expect(transferActiveProfileProject(args, root, store, reopen)).rejects.toThrow(
+      'source commit interrupted'
+    )
+    expect(reopen).toHaveBeenCalledOnce()
+    expect(profileHasPendingProjectMove('source', root)).toBe(true)
+    await expect(store.flushPendingOrThrowAsync()).rejects.toThrow('finalized')
+    fault.mockRestore()
+    expect(recoverPendingProfileProjectMoves(root)).toBe(1)
+    expect(read('source').state.repos.some((repo) => repo.id === args.repoId)).toBe(false)
+    expect(read('target').state.repos.some((repo) => repo.id === args.repoId)).toBe(true)
+  })
+})
diff --git a/src/main/orca-profiles/profile-active-transfer.test.ts b/src/main/orca-profiles/profile-active-transfer.test.ts
new file mode 100644
index 000000000000..0cfd80d7eefb
--- /dev/null
+++ b/src/main/orca-profiles/profile-active-transfer.test.ts
@@ -0,0 +1,232 @@
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { getDefaultPersistedState } from '../../shared/constants'
+import { ORCA_PROFILE_INDEX_SCHEMA_VERSION } from '../../shared/orca-profiles'
+import { openProfileStateDatabase } from '../persistence/profile-state/profile-state-database'
+import { importProfileStateJson } from '../persistence/profile-state/profile-state-documents'
+import { ProfileStateSqliteAuthority } from '../persistence/profile-state/profile-state-sqlite-authority'
+import * as stateFiles from './profile-project-state-file'
+import * as domainState from './profile-project-domain-state'
+import * as moveIntents from './profile-project-move-intent'
+import { transferActiveProfileProject } from './profile-active-transfer'
+import { transferOrcaProfileProject } from './profile-project-transfer'
+
+vi.mock('electron', () => ({
+  app: {
+    getPath: () => tmpdir(),
+    getName: () => 'orca-test',
+    getVersion: () => '0.0.0-test',
+    isPackaged: false,
+    on: () => {},
+    whenReady: () => Promise.resolve()
+  },
+  safeStorage: { isEncryptionAvailable: () => false },
+  ipcMain: { on: () => {}, handle: () => {} },
+  BrowserWindow: { getAllWindows: () => [] }
+}))
+vi.mock('../telemetry/client', () => ({ track: vi.fn() }))
+vi.mock('../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: vi.fn(() => ({ nth_repo_added: 2 }))
+}))
+vi.mock('../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: vi.fn(() => ({ hosts: [] })),
+  sshConfigHostsToTargets: vi.fn(() => [])
+}))
+
+const { Store } = await import('../persistence/loading-store/store')
+const stores: InstanceType<typeof Store>[] = []
+let directory: string
+const args = {
+  sourceProfileId: 'source',
+  targetProfileId: 'target',
+  repoId: 'repo-1',
+  mode: 'move'
+} as const
+
+function snapshot(profileId: string) {
+  return stateFiles.readProfileStateWithRevision(profileId, directory)
+}
+
+function openStore() {
+  const profileDirectory = join(directory, 'profiles', 'source')
+  const store = new Store({
+    dataFile: join(profileDirectory, 'orca-data.json'),
+    profileStateAuthority: new ProfileStateSqliteAuthority(
+      join(profileDirectory, 'profile-state.db'),
+      'source'
+    )
+  })
+  stores.push(store)
+  store.flushOrThrow()
+  return store
+}
+
+function interruptSourceCommit() {
+  const originalWrite = domainState.writeProfileProjectDomainChanges
+  return vi
+    .spyOn(domainState, 'writeProfileProjectDomainChanges')
+    .mockImplementation((profileId, ...rest) => {
+      if (profileId === 'source') {
+        throw new Error('source commit interrupted')
+      }
+      return originalWrite(profileId, ...rest)
+    })
+}
+
+beforeEach(() => {
+  directory = mkdtempSync(join(tmpdir(), 'orca-active-profile-transfer-'))
+  vi.spyOn(ProfileStateSqliteAuthority.prototype, 'scheduleBackup').mockImplementation(() => {})
+  writeFileSync(
+    join(directory, 'orca-profile-index.json'),
+    JSON.stringify({
+      schemaVersion: ORCA_PROFILE_INDEX_SCHEMA_VERSION,
+      activeProfileId: 'source',
+      profiles: ['source', 'target'].map((id) => ({
+        id,
+        name: id,
+        avatar: { kind: 'initials', initials: id[0], color: 'neutral' },
+        kind: 'local',
+        createdAt: 1,
+        updatedAt: 1,
+        lastOpenedAt: 1
+      }))
+    })
+  )
+  for (const profileId of ['source', 'target']) {
+    const profileDirectory = join(directory, 'profiles', profileId)
+    mkdirSync(profileDirectory, { recursive: true })
+    const db = openProfileStateDatabase(join(profileDirectory, 'profile-state.db'), profileId).db
+    try {
+      importProfileStateJson(
+        db,
+        JSON.stringify({
+          ...getDefaultPersistedState('/home/test'),
+          repos:
+            profileId === 'source'
+              ? [{ id: 'repo-1', path: '/projects/folder', kind: 'folder', addedAt: 1 }]
+              : []
+        })
+      )
+    } finally {
+      db.close()
+    }
+  }
+})
+
+afterEach(() => {
+  for (const store of stores.splice(0)) {
+    store.freezeWrites()
+  }
+  vi.restoreAllMocks()
+  rmSync(directory, { recursive: true, force: true })
+})
+
+describe('active profile transfer recovery', () => {
+  it.each(['source commit', 'intent cleanup'] as const)(
+    'fences an existing SQLite Store after interrupted %s until recovery and reopen',
+    async (failure) => {
+      const store = openStore()
+      const before = snapshot('source')
+      const interrupted =
+        failure === 'source commit'
+          ? interruptSourceCommit()
+          : vi.spyOn(moveIntents, 'removeProfileProjectMoveIntent').mockImplementation(() => {
+              throw new Error('intent cleanup interrupted')
+            })
+      const reopen = vi.fn(async () => {
+        const retained = snapshot('source')
+        store.updateSettings({ theme: 'light' })
+        expect(() => store.flushOrThrow()).toThrow('final persistence')
+        expect(snapshot('source')).toEqual(retained)
+      })
+
+      await expect(transferActiveProfileProject(args, directory, store, reopen)).rejects.toThrow(
+        `${failure} interrupted`
+      )
+      expect(reopen).toHaveBeenCalledOnce()
+      expect(snapshot('source').revision).toBe(
+        (before.revision ?? 0) + (failure === 'source commit' ? 0 : 1)
+      )
+      expect(snapshot('target').state.repos).toHaveLength(1)
+      interrupted.mockRestore()
+
+      expect(moveIntents.recoverPendingProfileProjectMoves(directory)).toBe(1)
+      expect(moveIntents.recoverPendingProfileProjectMoves(directory)).toBe(0)
+      expect(snapshot('source').state.repos).toHaveLength(0)
+      expect(snapshot('target').state.repos).toHaveLength(1)
+      const reloaded = openStore()
+      reloaded.updateSettings({ theme: 'light' })
+      reloaded.flushOrThrow()
+      expect(snapshot('source').state.settings.theme).toBe('light')
+      expect(moveIntents.recoverPendingProfileProjectMoves(directory)).toBe(0)
+    }
+  )
+
+  it('leaves an unchanged SQLite Store writable after validation fails', async () => {
+    const store = openStore()
+    const before = snapshot('source')
+    const reopen = vi.fn(async () => {})
+    await expect(
+      transferActiveProfileProject({ ...args, repoId: 'missing' }, directory, store, reopen)
+    ).rejects.toThrow('unknown_source_repo')
+    expect(reopen).not.toHaveBeenCalled()
+    store.updateSettings({ theme: 'light' })
+    store.flushOrThrow()
+    expect(snapshot('source').revision).toBe((before.revision ?? 0) + 1)
+    expect(snapshot('source').state.settings.theme).toBe('light')
+  })
+
+  it('keeps writes fenced when reopening after a partial transfer fails', async () => {
+    const store = openStore()
+    const before = snapshot('source')
+    const interrupted = interruptSourceCommit()
+    await expect(
+      transferActiveProfileProject(args, directory, store, async () => {
+        throw new Error('reopen failed')
+      })
+    ).rejects.toThrow('reopen failed')
+    store.updateSettings({ theme: 'light' })
+    expect(() => store.flushOrThrow()).toThrow('final persistence')
+    expect(snapshot('source')).toEqual(before)
+    interrupted.mockRestore()
+    expect(moveIntents.recoverPendingProfileProjectMoves(directory)).toBe(1)
+  })
+
+  it('reopens before an outstanding move can change the active Store behind its revision', async () => {
+    const store = openStore()
+    const interrupted = interruptSourceCommit()
+    expect(() => transferOrcaProfileProject(args, directory)).toThrow('source commit interrupted')
+    interrupted.mockRestore()
+    const reopen = vi.fn(async () => {
+      expect(moveIntents.recoverPendingProfileProjectMoves(directory)).toBe(1)
+    })
+    await expect(transferActiveProfileProject(args, directory, store, reopen)).rejects.toThrow(
+      'active_source_orca_profile_move_requires_recovery'
+    )
+    const recovered = snapshot('source')
+    store.updateSettings({ theme: 'light' })
+    expect(() => store.flushOrThrow()).toThrow('final persistence')
+    expect(snapshot('source')).toEqual(recovered)
+    expect(reopen).toHaveBeenCalledOnce()
+  })
+
+  it('keeps the Store frozen when an unreadable intent cannot identify its participants', async () => {
+    const store = openStore()
+    const before = snapshot('source')
+    const intentDirectory = join(directory, 'profile-move-intents')
+    mkdirSync(intentDirectory)
+    writeFileSync(join(intentDirectory, '11111111-1111-4111-8111-111111111111.json'), '{')
+    const reopen = vi.fn(async () => {
+      moveIntents.recoverPendingProfileProjectMoves(directory)
+    })
+    await expect(transferActiveProfileProject(args, directory, store, reopen)).rejects.toThrow(
+      'Profile move intent is unreadable'
+    )
+    store.updateSettings({ theme: 'light' })
+    expect(() => store.flushOrThrow()).toThrow('final persistence')
+    expect(snapshot('source')).toEqual(before)
+    expect(reopen).toHaveBeenCalledOnce()
+  })
+})
diff --git a/src/main/orca-profiles/profile-active-transfer.ts b/src/main/orca-profiles/profile-active-transfer.ts
new file mode 100644
index 000000000000..53ba8481da5b
--- /dev/null
+++ b/src/main/orca-profiles/profile-active-transfer.ts
@@ -0,0 +1,39 @@
+import type {
+  TransferOrcaProfileProjectArgs,
+  TransferOrcaProfileProjectResult
+} from '../../shared/orca-profiles'
+import type { Store } from '../persistence/loading-store/store'
+import { transferOrcaProfileProject } from './profile-project-transfer'
+import { hasOrcaProfileStateDatabase } from './profile-storage-paths'
+import { profileHasPendingProjectMove } from './profile-project-move-intent'
+import { flushActiveProfileBeforeFileMutation } from './profile-persistence-deadline'
+
+/** Keep the active Store stopped until file mutation either succeeds or proves unchanged. */
+export async function transferActiveProfileProject(
+  args: TransferOrcaProfileProjectArgs,
+  userDataPath: string,
+  store: Pick<Store, 'beginProfileMaintenance'>,
+  reopenSource: () => Promise<void>
+): Promise<TransferOrcaProfileProjectResult> {
+  const hadDatabase = hasOrcaProfileStateDatabase(args.sourceProfileId, userDataPath)
+  const pendingMove = profileHasPendingProjectMove(args.sourceProfileId, userDataPath)
+  const maintenance = await flushActiveProfileBeforeFileMutation(store, { flush: !pendingMove })
+  let result: TransferOrcaProfileProjectResult
+  try {
+    if (profileHasPendingProjectMove(args.sourceProfileId, userDataPath)) {
+      throw new Error('active_source_orca_profile_move_requires_recovery')
+    }
+    result = transferOrcaProfileProject(args, userDataPath)
+  } catch (error) {
+    const needsRecovery =
+      (!hadDatabase && hasOrcaProfileStateDatabase(args.sourceProfileId, userDataPath)) ||
+      profileHasPendingProjectMove(args.sourceProfileId, userDataPath)
+    // Further writes would invalidate a retained move's recovery revision.
+    await (needsRecovery ? reopenSource() : maintenance.resume())
+    throw error
+  }
+  if (result.status !== 'transferred' || args.mode !== 'move') {
+    await maintenance.resume()
+  }
+  return result
+}
diff --git a/src/main/orca-profiles/profile-cloud-auth-status.test.ts b/src/main/orca-profiles/profile-cloud-auth-status.test.ts
index 7a28783e9a97..3db3ccb92e95 100644
--- a/src/main/orca-profiles/profile-cloud-auth-status.test.ts
+++ b/src/main/orca-profiles/profile-cloud-auth-status.test.ts
@@ -38,6 +38,7 @@ function activeProfile(linked: boolean): ActiveOrcaProfileState {
     profile,
     index: { schemaVersion: 1, activeProfileId: profile.id, profiles: [profile] },
     dataFile: '',
+    stateDatabaseFile: '',
     profileDirectory: ''
   }
 }
diff --git a/src/main/orca-profiles/profile-index-store.test.ts b/src/main/orca-profiles/profile-index-store.test.ts
index 1d02c4d7dcc0..84a6927a8a7d 100644
--- a/src/main/orca-profiles/profile-index-store.test.ts
+++ b/src/main/orca-profiles/profile-index-store.test.ts
@@ -1,9 +1,17 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { installFakeAppEnvironment } from '../../../config/scripts/vitest-host-ports-setup'
-import { existsSync, mkdtempSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs'
+import {
+  existsSync,
+  mkdtempSync,
+  readFileSync,
+  writeFileSync,
+  mkdirSync,
+  renameSync
+} from 'node:fs'
 import { removeTreeSync } from '../../shared/windows-transient-lock-removal'
 import { join } from 'node:path'
 import { tmpdir } from 'node:os'
+import { openProfileStateDatabase } from '../persistence/profile-state/profile-state-database'
 import {
   createDefaultLocalOrcaProfile,
   DEFAULT_LOCAL_ORCA_PROFILE_ID,
@@ -66,6 +74,9 @@ describe('profile index store', () => {
     expect(activeProfile.dataFile).toBe(
       join(testState.dir, 'profiles', DEFAULT_LOCAL_ORCA_PROFILE_ID, 'orca-data.json')
     )
+    expect(activeProfile.stateDatabaseFile).toBe(
+      join(testState.dir, 'profiles', DEFAULT_LOCAL_ORCA_PROFILE_ID, 'profile-state.db')
+    )
     expect(readJson(activeProfile.dataFile)).toEqual(legacyState)
     expect(readJson(`${activeProfile.dataFile}.bak.0`)).toEqual(legacyBackup)
     expect(
@@ -115,9 +126,59 @@ describe('profile index store', () => {
 
     expect(activeProfile.profile.id).toBe(profileId)
     expect(activeProfile.dataFile).toBe(join(profileDirectory, 'orca-data.json'))
+    expect(activeProfile.stateDatabaseFile).toBe(join(profileDirectory, 'profile-state.db'))
     expect(readJson(activeProfile.dataFile)).toEqual(profileData)
   })
 
+  it('does not copy legacy JSON into a database-only default profile', async () => {
+    writeFileSync(
+      join(testState.dir, 'orca-data.json'),
+      JSON.stringify({ settings: { theme: 'legacy' } }),
+      'utf-8'
+    )
+    const profileDirectory = join(testState.dir, 'profiles', DEFAULT_LOCAL_ORCA_PROFILE_ID)
+    mkdirSync(profileDirectory, { recursive: true })
+    const database = openProfileStateDatabase(
+      join(profileDirectory, 'profile-state.db'),
+      DEFAULT_LOCAL_ORCA_PROFILE_ID
+    )
+    database.db.close()
+
+    const { ensureActiveOrcaProfile } = await loadProfileIndexStore()
+    const activeProfile = ensureActiveOrcaProfile()
+
+    expect(activeProfile.stateDatabaseFile).toBe(join(profileDirectory, 'profile-state.db'))
+    expect(existsSync(activeProfile.dataFile)).toBe(false)
+    expect(readFileSync(join(testState.dir, 'orca-data.json'), 'utf-8')).toContain('legacy')
+  })
+
+  it.each([
+    'orca-data.json.sqlite-export.1.json',
+    'profile-state.db.backup.1789999999999-00000000-0000-4000-8000-000000000000.db',
+    'profile-state.db-wal',
+    'profile-state.db-shm',
+    'profile-state.db-journal'
+  ])('does not seed a stale mirror when %s exists without the database', async (artifact) => {
+    writeFileSync(
+      join(testState.dir, 'orca-data.json'),
+      JSON.stringify({ settings: { theme: 'legacy' } }),
+      'utf-8'
+    )
+    const profileDirectory = join(testState.dir, 'profiles', DEFAULT_LOCAL_ORCA_PROFILE_ID)
+    mkdirSync(profileDirectory, { recursive: true })
+    writeFileSync(
+      join(profileDirectory, artifact),
+      JSON.stringify({ settings: { theme: 'migrated' } }),
+      'utf-8'
+    )
+
+    const { ensureActiveOrcaProfile } = await loadProfileIndexStore()
+    const activeProfile = ensureActiveOrcaProfile()
+
+    expect(existsSync(activeProfile.dataFile)).toBe(false)
+    expect(readFileSync(join(testState.dir, 'orca-data.json'), 'utf-8')).toContain('legacy')
+  })
+
   it('creates an empty local profile without copying legacy state into it', async () => {
     writeFileSync(
       join(testState.dir, 'orca-data.json'),
@@ -195,6 +256,45 @@ describe('profile index store', () => {
     expect(recovered.profiles.length).toBeGreaterThanOrEqual(2)
   })
 
+  it('retains the selected profile when only its backup index remains', async () => {
+    const store = await loadProfileIndexStore()
+    store.ensureActiveOrcaProfile()
+    const created = store.createLocalOrcaProfile({ name: 'Work' })
+    store.setActiveOrcaProfile(created.profile.id)
+    const indexPath = store.getOrcaProfileIndexPath()
+    renameSync(indexPath, `${indexPath}.bak`)
+
+    expect(store.loadOrCreateProfileIndex(testState.dir).activeProfileId).toBe(created.profile.id)
+    expect(store.ensureActiveOrcaProfile().profile.id).toBe(created.profile.id)
+    expect(readJson(indexPath)).toMatchObject({ activeProfileId: created.profile.id })
+  })
+
+  it.each(['primary', 'backup', 'both'] as const)(
+    'refuses an unreadable %s index without replacing it',
+    async (source) => {
+      const store = await loadProfileIndexStore()
+      const indexPath = store.getOrcaProfileIndexPath()
+      if (source !== 'backup') {
+        writeFileSync(indexPath, '{broken-primary')
+      }
+      if (source !== 'primary') {
+        writeFileSync(`${indexPath}.bak`, '{broken-backup')
+      }
+
+      expect(() => store.loadOrCreateProfileIndex(testState.dir)).toThrow(
+        'Could not read active profile index'
+      )
+      expect(() => store.ensureActiveOrcaProfile()).toThrow('Could not read active profile index')
+      if (source !== 'backup') {
+        expect(readFileSync(indexPath, 'utf8')).toBe('{broken-primary')
+      }
+      if (source !== 'primary') {
+        expect(readFileSync(`${indexPath}.bak`, 'utf8')).toBe('{broken-backup')
+      }
+      expect(existsSync(join(testState.dir, 'profiles'))).toBe(false)
+    }
+  )
+
   it('rejects profile ids that are not safe path segments', async () => {
     const store = await loadProfileIndexStore()
     const indexPath = store.getOrcaProfileIndexPath()
@@ -216,8 +316,7 @@ describe('profile index store', () => {
     mkdirSync(testState.dir, { recursive: true })
     writeFileSync(indexPath, JSON.stringify(index), 'utf-8')
 
-    // The tampered entry is filtered; startup falls back to a fresh default.
-    const state = store.ensureActiveOrcaProfile()
-    expect(state.profile.id).toBe(DEFAULT_LOCAL_ORCA_PROFILE_ID)
+    expect(() => store.ensureActiveOrcaProfile()).toThrow('Could not read active profile index')
+    expect(readJson(indexPath)).toEqual(index)
   })
 })
diff --git a/src/main/orca-profiles/profile-index-store.ts b/src/main/orca-profiles/profile-index-store.ts
index 7897e299a210..8f852581ce85 100644
--- a/src/main/orca-profiles/profile-index-store.ts
+++ b/src/main/orca-profiles/profile-index-store.ts
@@ -9,7 +9,6 @@ import {
 import { randomUUID } from 'node:crypto'
 import { dirname } from 'node:path'
 import { bestEffortFsyncDirectorySync, fsyncFileSync } from '../../shared/secure-file'
-import type { GlobalSettings } from '../../shared/global-settings-types'
 import {
   createDefaultLocalOrcaProfile,
   DEFAULT_LOCAL_ORCA_PROFILE_ID,
@@ -22,23 +21,24 @@ import {
   type OrcaProfileSummary
 } from '../../shared/orca-profiles'
 import {
-  getOrcaProfileBrowserSessionMetaFile,
   getOrcaProfileDataFile,
   getOrcaProfileDirectory,
   getOrcaProfileIndexPath,
-  getProfileUserDataPath,
-  LEGACY_BACKUP_COUNT,
-  legacyBackupPath,
-  legacyBrowserSessionMetaPath,
-  legacyDataFilePath,
-  profileBackupPath
+  getOrcaProfileStateDatabaseFile,
+  hasOrcaProfileStateDatabase,
+  getProfileUserDataPath
 } from './profile-storage-paths'
+import { copyLegacyStateToProfile } from './profile-legacy-state-import'
+import { profileStateJsonExportPaths } from '../persistence/profile-state/legacy-json/profile-state-export-path'
+import { profileStateDatabaseBackups } from '../persistence/profile-state/profile-state-backup-path'
 
 export {
   getOrcaProfileBrowserSessionMetaFile,
   getOrcaProfileDataFile,
   getOrcaProfileDirectory,
   getOrcaProfileIndexPath,
+  getOrcaProfileStateDatabaseFile,
+  hasOrcaProfileStateDatabase,
   getOrcaProfilesDirectory,
   initOrcaProfilePaths
 } from './profile-storage-paths'
@@ -47,6 +47,7 @@ export type ActiveOrcaProfileState = {
   index: OrcaProfileIndex
   profile: OrcaProfileSummary
   dataFile: string
+  stateDatabaseFile: string
   profileDirectory: string
 }
 
@@ -118,6 +119,14 @@ export function readProfileIndex(indexPath: string): OrcaProfileIndex | null {
   return readProfileIndexFile(indexPath) ?? readProfileIndexFile(`${indexPath}.bak`)
 }
 
+function readExistingProfileIndex(indexPath: string): OrcaProfileIndex | null {
+  const index = readProfileIndex(indexPath)
+  if (!index && (existsSync(indexPath) || existsSync(`${indexPath}.bak`))) {
+    throw new Error(`Could not read active profile index ${indexPath}`)
+  }
+  return index
+}
+
 export function writeProfileIndex(indexPath: string, index: OrcaProfileIndex): void {
   mkdirSync(dirname(indexPath), { recursive: true })
   // Why: only a still-parseable current index may refresh the backup;
@@ -136,51 +145,7 @@ export function writeProfileIndex(indexPath: string, index: OrcaProfileIndex): v
   bestEffortFsyncDirectorySync(dirname(indexPath))
 }
 
-function copyIfPresent(source: string, target: string): void {
-  if (!existsSync(source) || existsSync(target)) {
-    return
-  }
-  mkdirSync(dirname(target), { recursive: true })
-  // Why: tmp+rename so a crash mid-copy cannot leave a truncated target that
-  // the exists() guard above would then treat as a completed migration.
-  const tmpTarget = `${target}.tmp`
-  copyFileSync(source, tmpTarget)
-  renameSync(tmpTarget, target)
-}
-
-function copyLegacyStateToProfile(userDataPath: string, profileId: string): void {
-  const profileDataFile = getOrcaProfileDataFile(profileId, userDataPath)
-  copyIfPresent(legacyDataFilePath(userDataPath), profileDataFile)
-  copyIfPresent(
-    legacyBrowserSessionMetaPath(userDataPath),
-    getOrcaProfileBrowserSessionMetaFile(profileId, userDataPath)
-  )
-  for (let i = 0; i < LEGACY_BACKUP_COUNT; i++) {
-    copyIfPresent(legacyBackupPath(userDataPath, i), profileBackupPath(profileDataFile, i))
-  }
-}
-
-// Why: a brand-new profile has no data file, which the telemetry cohort
-// migration reads as a fresh install and defaults to opted-in. Copying the
-// active profile's consent block keeps an opted-out user opted out (and keeps
-// one installId per install) when they create additional profiles.
-export function seedNewOrcaProfileTelemetryConsent(
-  profileId: string,
-  telemetry: GlobalSettings['telemetry'],
-  userDataPath = getProfileUserDataPath()
-): void {
-  if (!telemetry) {
-    return
-  }
-  const dataFile = getOrcaProfileDataFile(profileId, userDataPath)
-  if (existsSync(dataFile)) {
-    return
-  }
-  mkdirSync(dirname(dataFile), { recursive: true })
-  const tmpPath = `${dataFile}.tmp`
-  writeFileSync(tmpPath, JSON.stringify({ settings: { telemetry } }, null, 2), 'utf-8')
-  renameSync(tmpPath, dataFile)
-}
+export { seedNewOrcaProfileTelemetryConsent } from './profile-telemetry-consent-seed'
 
 function createInitialProfileIndex(now = Date.now()): OrcaProfileIndex {
   const profile = createDefaultLocalOrcaProfile(now)
@@ -193,7 +158,7 @@ function createInitialProfileIndex(now = Date.now()): OrcaProfileIndex {
 
 export function loadOrCreateProfileIndex(userDataPath: string): OrcaProfileIndex {
   const indexPath = getOrcaProfileIndexPath(userDataPath)
-  const index = existsSync(indexPath) ? readProfileIndex(indexPath) : null
+  const index = readExistingProfileIndex(indexPath)
   if (index) {
     return index
   }
@@ -214,8 +179,8 @@ export function ensureActiveOrcaProfile(
   userDataPath = getProfileUserDataPath()
 ): ActiveOrcaProfileState {
   const indexPath = getOrcaProfileIndexPath(userDataPath)
-  let index = existsSync(indexPath) ? readProfileIndex(indexPath) : null
-  let shouldWriteIndex = false
+  let index = readExistingProfileIndex(indexPath)
+  let shouldWriteIndex = !existsSync(indexPath)
 
   if (!index) {
     index = createInitialProfileIndex()
@@ -230,7 +195,22 @@ export function ensureActiveOrcaProfile(
 
   const profileDirectory = getOrcaProfileDirectory(activeProfile.id, userDataPath)
   mkdirSync(profileDirectory, { recursive: true })
-  if (activeProfile.id === DEFAULT_LOCAL_ORCA_PROFILE_ID) {
+  const profileDatabaseFile = getOrcaProfileStateDatabaseFile(activeProfile.id, userDataPath)
+  const profileDataFile = getOrcaProfileDataFile(activeProfile.id, userDataPath)
+  let hasRetainedProfileStateExport = false
+  try {
+    hasRetainedProfileStateExport =
+      profileStateJsonExportPaths(profileDataFile).length > 0 ||
+      profileStateDatabaseBackups(profileDatabaseFile).length > 0
+  } catch {
+    // An unreadable profile directory must never trigger a fallback copy of legacy state.
+    hasRetainedProfileStateExport = true
+  }
+  if (
+    activeProfile.id === DEFAULT_LOCAL_ORCA_PROFILE_ID &&
+    !hasOrcaProfileStateDatabase(activeProfile.id, userDataPath) &&
+    !hasRetainedProfileStateExport
+  ) {
     copyLegacyStateToProfile(userDataPath, activeProfile.id)
   }
 
@@ -241,7 +221,8 @@ export function ensureActiveOrcaProfile(
   return {
     index,
     profile: activeProfile,
-    dataFile: getOrcaProfileDataFile(activeProfile.id, userDataPath),
+    dataFile: profileDataFile,
+    stateDatabaseFile: profileDatabaseFile,
     profileDirectory
   }
 }
diff --git a/src/main/orca-profiles/profile-legacy-state-import.ts b/src/main/orca-profiles/profile-legacy-state-import.ts
new file mode 100644
index 000000000000..03500f74e267
--- /dev/null
+++ b/src/main/orca-profiles/profile-legacy-state-import.ts
@@ -0,0 +1,35 @@
+import { copyFileSync, existsSync, mkdirSync, renameSync } from 'node:fs'
+import { dirname } from 'node:path'
+import {
+  getOrcaProfileBrowserSessionMetaFile,
+  getOrcaProfileDataFile,
+  LEGACY_BACKUP_COUNT,
+  legacyBackupPath,
+  legacyBrowserSessionMetaPath,
+  legacyDataFilePath,
+  profileBackupPath
+} from './profile-storage-paths'
+
+function copyIfPresent(source: string, target: string): void {
+  if (!existsSync(source) || existsSync(target)) {
+    return
+  }
+  mkdirSync(dirname(target), { recursive: true })
+  // Why: tmp+rename so a crash mid-copy cannot leave a truncated target that
+  // the exists() guard above would then treat as a completed migration.
+  const tmpTarget = `${target}.tmp`
+  copyFileSync(source, tmpTarget)
+  renameSync(tmpTarget, target)
+}
+
+export function copyLegacyStateToProfile(userDataPath: string, profileId: string): void {
+  const profileDataFile = getOrcaProfileDataFile(profileId, userDataPath)
+  copyIfPresent(legacyDataFilePath(userDataPath), profileDataFile)
+  copyIfPresent(
+    legacyBrowserSessionMetaPath(userDataPath),
+    getOrcaProfileBrowserSessionMetaFile(profileId, userDataPath)
+  )
+  for (let i = 0; i < LEGACY_BACKUP_COUNT; i++) {
+    copyIfPresent(legacyBackupPath(userDataPath, i), profileBackupPath(profileDataFile, i))
+  }
+}
diff --git a/src/main/orca-profiles/profile-persistence-deadline.test.ts b/src/main/orca-profiles/profile-persistence-deadline.test.ts
new file mode 100644
index 000000000000..87e0507c5072
--- /dev/null
+++ b/src/main/orca-profiles/profile-persistence-deadline.test.ts
@@ -0,0 +1,37 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import type { ProfileStateMaintenance } from '../persistence/loading-store/profile-state-authority'
+import type { ProfileStateMaintenanceOptions } from '../persistence/loading-store/profile-state-maintenance'
+import { flushActiveProfileBeforeFileMutation } from './profile-persistence-deadline'
+
+afterEach(() => vi.useRealTimers())
+
+describe('profile persistence deadline', () => {
+  it('allows the writer request deadline to finish before imposing maintenance cancellation', async () => {
+    vi.useFakeTimers()
+    const result = Promise.withResolvers<ProfileStateMaintenance>()
+    const beginProfileMaintenance = vi.fn(
+      (_options?: ProfileStateMaintenanceOptions) => result.promise
+    )
+    const pending = flushActiveProfileBeforeFileMutation({ beginProfileMaintenance })
+    await vi.advanceTimersByTimeAsync(30_000)
+    expect(beginProfileMaintenance.mock.calls[0]?.[0]?.signal?.aborted).not.toBe(true)
+    const handle = { resume: vi.fn(async () => {}) }
+    result.resolve(handle)
+    await expect(pending).resolves.toBe(handle)
+    expect(handle.resume).not.toHaveBeenCalled()
+  })
+
+  it('resumes a clean pause that finishes after the caller times out', async () => {
+    vi.useFakeTimers()
+    const result = Promise.withResolvers<ProfileStateMaintenance>()
+    const beginProfileMaintenance = vi.fn(() => result.promise)
+    const pending = flushActiveProfileBeforeFileMutation({ beginProfileMaintenance })
+    const rejected = expect(pending).rejects.toThrow('orca_profile_persistence_timeout')
+    await vi.advanceTimersByTimeAsync(60_000)
+    await rejected
+    const handle = { resume: vi.fn(async () => {}) }
+    result.resolve(handle)
+    await vi.advanceTimersByTimeAsync(0)
+    expect(handle.resume).toHaveBeenCalledOnce()
+  })
+})
diff --git a/src/main/orca-profiles/profile-persistence-deadline.ts b/src/main/orca-profiles/profile-persistence-deadline.ts
index 084a53c40fef..73280914e4aa 100644
--- a/src/main/orca-profiles/profile-persistence-deadline.ts
+++ b/src/main/orca-profiles/profile-persistence-deadline.ts
@@ -1,8 +1,33 @@
 import type { Store } from '../persistence'
+import type { ProfileStateMaintenance } from '../persistence/loading-store/profile-state-authority'
+import type { ProfileStateMaintenanceOptions } from '../persistence/loading-store/profile-state-maintenance'
 
-const PROFILE_PERSISTENCE_TIMEOUT_MS = 20_000
+const PROFILE_PERSISTENCE_TIMEOUT_MS = 60_000
 
-export async function flushActiveProfileBeforeFileMutation(store: Store): Promise<void> {
+export async function flushActiveProfileBeforeFileMutation(
+  store: Pick<Store, 'beginProfileMaintenance'>,
+  options: Pick<ProfileStateMaintenanceOptions, 'flush'> = {}
+): Promise<ProfileStateMaintenance> {
+  return withinProfilePersistenceDeadline((signal) =>
+    store.beginProfileMaintenance({ ...options, signal }).then(async (handle) => {
+      if (signal.aborted && options.flush !== false) {
+        await handle.resume()
+        throw new Error('orca_profile_persistence_timeout')
+      }
+      return handle
+    })
+  )
+}
+
+export function flushActiveProfileBeforeRelaunch(
+  store: Pick<Store, 'flushPendingOrThrowAsync'>
+): Promise<void> {
+  return withinProfilePersistenceDeadline((signal) => store.flushPendingOrThrowAsync({ signal }))
+}
+
+async function withinProfilePersistenceDeadline<T>(
+  operation: (signal: AbortSignal) => Promise<T>
+): Promise<T> {
   const controller = new AbortController()
   let timeout: ReturnType<typeof setTimeout> | null = null
   const deadline = new Promise<never>((_resolve, reject) => {
@@ -12,7 +37,7 @@ export async function flushActiveProfileBeforeFileMutation(store: Store): Promis
     }, PROFILE_PERSISTENCE_TIMEOUT_MS)
   })
   try {
-    await Promise.race([store.flushPendingOrThrowAsync({ signal: controller.signal }), deadline])
+    return await Promise.race([operation(controller.signal), deadline])
   } finally {
     if (timeout) {
       clearTimeout(timeout)
diff --git a/src/main/orca-profiles/profile-project-domain-changes.ts b/src/main/orca-profiles/profile-project-domain-changes.ts
new file mode 100644
index 000000000000..30f5aef805e7
--- /dev/null
+++ b/src/main/orca-profiles/profile-project-domain-changes.ts
@@ -0,0 +1,144 @@
+import { hashProfileStateJson } from '../persistence/profile-state/profile-state-documents'
+import {
+  isRecord,
+  type ProfileStateParsedDocument
+} from '../persistence/profile-state/profile-state-document-validation'
+import { prepareProfileStateDomainMutation } from '../persistence/profile-state/profile-state-domain-write-validation'
+import type { ProfileStateDomainMutation } from '../persistence/profile-state/profile-state-domain-writes'
+import type { PersistedState } from '../../shared/persisted-state-types'
+
+export type ProfileProjectDomainDigest = { domain: string; hash: string }
+
+export type ProfileProjectDomainChanges = {
+  expectedRevision: number
+  before: ProfileProjectDomainDigest[]
+  afterHash: string
+  replacements: { domain: string; payload: string | null }[]
+}
+
+export function profileProjectDomainFingerprint(
+  domains: readonly ProfileProjectDomainDigest[]
+): string {
+  const pairs = domains.map(({ domain, hash }) => [domain, hash])
+  pairs.sort(([left = ''], [right = '']) => (left < right ? -1 : left > right ? 1 : 0))
+  return hashProfileStateJson(`orca-profile-move-domains-v2:${JSON.stringify(pairs)}`)
+}
+
+export function profileProjectDomainDigests(
+  documents: readonly ProfileStateParsedDocument[]
+): ProfileProjectDomainDigest[] {
+  return documents.map(({ domain, contentHash }) => ({ domain, hash: contentHash }))
+}
+
+export function prepareProfileProjectDomainChanges(
+  revision: number,
+  documents: readonly ProfileStateParsedDocument[],
+  state: PersistedState
+): ProfileProjectDomainChanges {
+  const originals = new Map(documents.map((document) => [document.domain, document]))
+  const replacements: ProfileProjectDomainChanges['replacements'] = []
+  for (const [domain, value] of Object.entries(state)) {
+    const original = originals.get(domain)
+    // Transfer projections retain unchanged values; do not serialize unrelated history/output.
+    if (original && Object.is(original.value, value)) {
+      continue
+    }
+    const payload = JSON.stringify(value) ?? null
+    if (
+      payload === null
+        ? original !== undefined
+        : hashProfileStateJson(payload) !== original?.contentHash
+    ) {
+      replacements.push({ domain, payload })
+    }
+  }
+  for (const domain of originals.keys()) {
+    if (!Object.hasOwn(state, domain)) {
+      replacements.push({ domain, payload: null })
+    }
+  }
+  const before = profileProjectDomainDigests(documents)
+  return {
+    expectedRevision: revision,
+    before,
+    afterHash: profileProjectDomainFingerprint(applyDomainDigests(before, replacements)),
+    replacements
+  }
+}
+
+function applyDomainDigests(
+  before: readonly ProfileProjectDomainDigest[],
+  replacements: readonly ProfileStateDomainMutation[]
+): ProfileProjectDomainDigest[] {
+  const digests = new Map(before.map(({ domain, hash }) => [domain, hash]))
+  for (const { domain, payload } of replacements) {
+    if (payload === null) {
+      digests.delete(domain)
+    } else {
+      digests.set(domain, hashProfileStateJson(payload))
+    }
+  }
+  return [...digests].map(([domain, hash]) => ({ domain, hash }))
+}
+
+export function validateProfileProjectDomainChanges(
+  value: unknown
+): asserts value is ProfileProjectDomainChanges {
+  if (
+    !isRecord(value) ||
+    typeof value.expectedRevision !== 'number' ||
+    !Number.isSafeInteger(value.expectedRevision) ||
+    value.expectedRevision < 0 ||
+    !Number.isSafeInteger(value.expectedRevision + 1) ||
+    !Array.isArray(value.before) ||
+    !Array.isArray(value.replacements) ||
+    value.replacements.length === 0 ||
+    !isHash(value.afterHash)
+  ) {
+    throw new Error('Profile move domain changes are malformed')
+  }
+  const before: ProfileProjectDomainDigest[] = []
+  const domains = new Set<string>()
+  for (const digest of value.before) {
+    if (
+      !isRecord(digest) ||
+      typeof digest.domain !== 'string' ||
+      !isHash(digest.hash) ||
+      domains.has(digest.domain)
+    ) {
+      throw new Error('Profile move domain manifest is malformed')
+    }
+    domains.add(digest.domain)
+    before.push({ domain: digest.domain, hash: digest.hash })
+  }
+  const replacements: ProfileStateDomainMutation[] = []
+  domains.clear()
+  for (const replacement of value.replacements) {
+    if (
+      !isRecord(replacement) ||
+      !isDomain(replacement.domain) ||
+      (replacement.payload !== null && typeof replacement.payload !== 'string') ||
+      domains.has(replacement.domain)
+    ) {
+      throw new Error('Profile move domain replacement is malformed')
+    }
+    domains.add(replacement.domain)
+    const mutation = { domain: replacement.domain, payload: replacement.payload }
+    prepareProfileStateDomainMutation(mutation)
+    replacements.push(mutation)
+  }
+  if (
+    profileProjectDomainFingerprint(applyDomainDigests(before, replacements)) !== value.afterHash ||
+    profileProjectDomainFingerprint(before) === value.afterHash
+  ) {
+    throw new Error('Profile move domain changes do not match their fingerprint')
+  }
+}
+
+function isDomain(value: unknown): value is string {
+  return typeof value === 'string' && value.length > 0
+}
+
+function isHash(value: unknown): value is string {
+  return typeof value === 'string' && /^[a-f0-9]{64}$/.test(value)
+}
diff --git a/src/main/orca-profiles/profile-project-domain-move-intent.ts b/src/main/orca-profiles/profile-project-domain-move-intent.ts
new file mode 100644
index 000000000000..3441b2d8f3a3
--- /dev/null
+++ b/src/main/orca-profiles/profile-project-domain-move-intent.ts
@@ -0,0 +1,58 @@
+import { randomUUID } from 'node:crypto'
+import type { ProfileProjectDomainMoveIntent } from './profile-project-move-record'
+export type { ProfileProjectDomainMoveIntent } from './profile-project-move-record'
+import {
+  profileProjectDomainDigests,
+  profileProjectDomainFingerprint,
+  type ProfileProjectDomainChanges
+} from './profile-project-domain-changes'
+import {
+  readProfileProjectTransferState,
+  type ReadProfileProjectTransferResult
+} from './profile-project-domain-state'
+
+export function createProfileProjectDomainMoveIntent(args: {
+  sourceProfileId: string
+  targetProfileId: string
+  source: ProfileProjectDomainChanges
+  target: ProfileProjectDomainChanges
+}): ProfileProjectDomainMoveIntent {
+  return { version: 2, id: randomUUID(), ...args }
+}
+
+export function readProfileProjectDomainMoveState(
+  userDataPath: string,
+  intent: ProfileProjectDomainMoveIntent
+): { sourceBefore: boolean; sourceAfter: boolean; targetBefore: boolean; targetAfter: boolean } {
+  const source = readProfileProjectTransferState(intent.sourceProfileId, userDataPath)
+  const target = readProfileProjectTransferState(intent.targetProfileId, userDataPath)
+  if (source.documents === undefined || target.documents === undefined) {
+    throw new Error(`Profile move ${intent.id} no longer has two SQLite participants`)
+  }
+  return {
+    sourceBefore: matches(
+      source,
+      intent.source.expectedRevision,
+      profileProjectDomainFingerprint(intent.source.before)
+    ),
+    targetBefore: matches(
+      target,
+      intent.target.expectedRevision,
+      profileProjectDomainFingerprint(intent.target.before)
+    ),
+    sourceAfter: matches(source, intent.source.expectedRevision + 1, intent.source.afterHash),
+    targetAfter: matches(target, intent.target.expectedRevision + 1, intent.target.afterHash)
+  }
+}
+
+function matches(
+  snapshot: ReadProfileProjectTransferResult,
+  revision: number,
+  hash: string
+): boolean {
+  return (
+    snapshot.revision === revision &&
+    snapshot.documents !== undefined &&
+    profileProjectDomainFingerprint(profileProjectDomainDigests(snapshot.documents)) === hash
+  )
+}
diff --git a/src/main/orca-profiles/profile-project-domain-state.ts b/src/main/orca-profiles/profile-project-domain-state.ts
new file mode 100644
index 000000000000..e788b4b0def1
--- /dev/null
+++ b/src/main/orca-profiles/profile-project-domain-state.ts
@@ -0,0 +1,84 @@
+import {
+  openProfileStateDatabase,
+  openProfileStateDatabaseReadOnly
+} from '../persistence/profile-state/profile-state-database'
+import {
+  readProfileStateDocuments,
+  readProfileStateRevision
+} from '../persistence/profile-state/profile-state-documents'
+import type { ProfileStateParsedDocument } from '../persistence/profile-state/profile-state-document-validation'
+import { writeProfileStateDomains } from '../persistence/profile-state/profile-state-domain-writes'
+import { withProfileStateReadSnapshot } from '../persistence/profile-state/profile-state-read-snapshot'
+import { getOrcaProfileStateDatabaseFile } from './profile-storage-paths'
+import {
+  normalizeProfileProjectState,
+  profileStateStorage,
+  readProfileStateWithRevision,
+  type ReadProfileStateResult
+} from './profile-project-state-file'
+import {
+  validateProfileProjectDomainChanges,
+  type ProfileProjectDomainChanges
+} from './profile-project-domain-changes'
+
+export type ReadProfileProjectTransferResult = ReadProfileStateResult & {
+  documents?: readonly ProfileStateParsedDocument[]
+}
+
+/** Keep checked domain values for transfer without joining and reparsing the complete profile. */
+export function readProfileProjectTransferState(
+  profileId: string,
+  userDataPath: string
+): ReadProfileProjectTransferResult {
+  if (profileStateStorage(profileId, userDataPath) === 'json') {
+    return readProfileStateWithRevision(profileId, userDataPath)
+  }
+  const opened = openProfileStateDatabaseReadOnly(
+    getOrcaProfileStateDatabaseFile(profileId, userDataPath),
+    profileId
+  )
+  try {
+    return withProfileStateReadSnapshot(opened.db, () => {
+      const revision = readProfileStateRevision(opened.db)
+      const documents = readProfileStateDocuments(opened.db, {
+        profileRevision: revision,
+        representation: 'parsed'
+      })
+      return {
+        revision,
+        documents,
+        state: normalizeProfileProjectState(
+          Object.fromEntries(documents.map(({ domain, value }) => [domain, value]))
+        )
+      }
+    })
+  } finally {
+    opened.db.close()
+  }
+}
+
+export function writeProfileProjectDomainChanges(
+  profileId: string,
+  userDataPath: string,
+  changes: ProfileProjectDomainChanges
+): void {
+  validateProfileProjectDomainChanges(changes)
+  if (profileStateStorage(profileId, userDataPath) !== 'sqlite') {
+    throw new Error('Profile domain transfer requires an established SQLite participant')
+  }
+  const opened = openProfileStateDatabase(
+    getOrcaProfileStateDatabaseFile(profileId, userDataPath),
+    profileId
+  )
+  try {
+    const result = writeProfileStateDomains(opened.db, {
+      expectedRevision: changes.expectedRevision,
+      replacements: changes.replacements.map(({ domain, payload }) => ({ domain, payload }))
+    })
+    if (!result.changed || result.revision !== changes.expectedRevision + 1) {
+      throw new Error('Profile domain transfer did not commit its expected revision')
+    }
+  } finally {
+    opened.db.close()
+  }
+}
diff --git a/src/main/orca-profiles/profile-project-domain-transfer.test.ts b/src/main/orca-profiles/profile-project-domain-transfer.test.ts
new file mode 100644
index 000000000000..00ceb64455ee
--- /dev/null
+++ b/src/main/orca-profiles/profile-project-domain-transfer.test.ts
@@ -0,0 +1,546 @@
+import { mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, it, vi } from 'vitest'
+import { buildSync } from 'esbuild'
+import { runProcess } from '../../shared/child-process/run-process'
+import { getDefaultPersistedState } from '../../shared/constants'
+import { ORCA_PROFILE_INDEX_SCHEMA_VERSION } from '../../shared/orca-profiles'
+import type { Repo } from '../../shared/repo-types'
+import { openProfileStateDatabase } from '../persistence/profile-state/profile-state-database'
+import {
+  hashProfileStateJson,
+  importProfileStateJson,
+  readProfileStateSnapshot
+} from '../persistence/profile-state/profile-state-documents'
+import { writeProfileStateDomain } from '../persistence/profile-state/profile-state-domain-writes'
+import {
+  prepareProfileProjectDomainChanges,
+  profileProjectDomainFingerprint,
+  validateProfileProjectDomainChanges
+} from './profile-project-domain-changes'
+import * as domainState from './profile-project-domain-state'
+import { createProfileProjectDomainMoveIntent } from './profile-project-domain-move-intent'
+import {
+  persistProfileProjectMoveIntent,
+  recoverPendingProfileProjectMoves
+} from './profile-project-move-intent'
+import { normalizeProfileProjectState } from './profile-project-state-file'
+import { removeSourceRepo } from './profile-project-source-removal'
+import {
+  applyPayloadToTarget,
+  createTargetRepo,
+  createTransferPayload
+} from './profile-project-transfer-payload'
+import { transferOrcaProfileProject } from './profile-project-transfer'
+
+let root: string
+let crashRoot: string
+let crashBundle: string
+let crashScript: string
+const repo: Repo = {
+  id: 'repo-1',
+  path: '/project',
+  displayName: 'Project',
+  badgeColor: 'neutral',
+  addedAt: 1,
+  kind: 'git',
+  connectionId: null
+}
+
+function dbPath(id: string): string {
+  return join(root, 'profiles', id, 'profile-state.db')
+}
+
+function withDatabase<T>(
+  id: string,
+  action: (db: ReturnType<typeof openProfileStateDatabase>['db']) => T
+): T {
+  const opened = openProfileStateDatabase(dbPath(id), id)
+  try {
+    return action(opened.db)
+  } finally {
+    opened.db.close()
+  }
+}
+
+function seed(id: string, repos: Repo[] = []): void {
+  mkdirSync(join(root, 'profiles', id), { recursive: true })
+  withDatabase(id, (db) =>
+    importProfileStateJson(
+      db,
+      JSON.stringify({
+        futureOpaque: { z: ['\ud800', null, id], a: 'x'.repeat(100_000) },
+        ['']: { keep: true },
+        ['__proto__']: { inert: true },
+        settings: { opencodeSessionCookie: 'enc:v1:sealed-inactive', unknownSetting: [2, 1] },
+        repos,
+        projects: null,
+        projectHostSetups: null,
+        workspaceSessionsByHostId: null,
+        automationRuns: [],
+        futureNull: null,
+        futureDelete: { remove: true }
+      })
+    )
+  )
+}
+
+function raw(id: string) {
+  return withDatabase(id, (db) => readProfileStateSnapshot(db))
+}
+
+function transfer(mode: 'copy' | 'move' = 'move') {
+  return transferOrcaProfileProject(
+    { sourceProfileId: 'source', targetProfileId: 'target', repoId: repo.id, mode },
+    root
+  )
+}
+
+function frozen<T>(value: T): T {
+  if (value !== null && typeof value === 'object') {
+    for (const nested of Object.values(value)) {
+      frozen(nested)
+    }
+    Object.freeze(value)
+  }
+  return value
+}
+
+function preparedMove() {
+  const source = domainState.readProfileProjectTransferState('source', root)
+  const target = domainState.readProfileProjectTransferState('target', root)
+  if (
+    source.revision === undefined ||
+    target.revision === undefined ||
+    !source.documents ||
+    !target.documents
+  ) {
+    throw new Error('Missing SQL fixture')
+  }
+  const sourceRepo = source.state.repos[0]
+  if (!sourceRepo) {
+    throw new Error('Missing source repo')
+  }
+  const targetRepo = createTargetRepo(sourceRepo, target.state, false)
+  const payload = createTransferPayload({
+    sourceState: source.state,
+    sourceRepo,
+    targetRepo,
+    includeSessions: true
+  })
+  const sourceAfter = removeSourceRepo(source.state, sourceRepo.id)
+  const targetAfter = applyPayloadToTarget(target.state, payload)
+  const intent = createProfileProjectDomainMoveIntent({
+    sourceProfileId: 'source',
+    targetProfileId: 'target',
+    source: prepareProfileProjectDomainChanges(source.revision, source.documents, sourceAfter),
+    target: prepareProfileProjectDomainChanges(target.revision, target.documents, targetAfter)
+  })
+  return { intent, sourceAfter, targetAfter }
+}
+
+beforeAll(() => {
+  crashRoot = mkdtempSync(join(tmpdir(), 'orca-domain-move-crash-api-'))
+  crashBundle = join(crashRoot, 'api.cjs')
+  crashScript = join(crashRoot, 'crash.cjs')
+  buildSync({
+    stdin: {
+      contents:
+        "export { transferOrcaProfileProject } from './src/main/orca-profiles/profile-project-transfer'",
+      loader: 'ts',
+      resolveDir: process.cwd()
+    },
+    outfile: crashBundle,
+    bundle: true,
+    platform: 'node',
+    format: 'cjs',
+    packages: 'external'
+  })
+  writeFileSync(
+    crashScript,
+    `
+const fs = require('node:fs')
+const path = require('node:path')
+const [bundle, root, stage] = process.argv.slice(2)
+const barrier = label => {
+  if (label !== stage) return
+  fs.writeSync(1, label + '\\n')
+  process.kill(process.pid, 'SIGKILL')
+  throw new Error('SIGKILL returned')
+}
+const sqlite = require('node:sqlite')
+const exec = sqlite.DatabaseSync.prototype.exec
+const writers = new WeakSet()
+sqlite.DatabaseSync.prototype.exec = function(sql) {
+  const writing = writers.has(this)
+  const participant = writing ? this.prepare("SELECT value FROM profile_state_meta WHERE key = 'profile_id'").get().value : ''
+  if (writing && sql === 'COMMIT') barrier(participant + '-before-commit')
+  const result = exec.call(this, sql)
+  if (sql === 'BEGIN IMMEDIATE') writers.add(this)
+  if (sql === 'COMMIT' || sql === 'ROLLBACK') writers.delete(this)
+  if (writing && sql === 'COMMIT') barrier(participant + '-committed')
+  return result
+}
+let published = false
+let removed = false
+const rename = fs.renameSync
+fs.renameSync = (from, to) => {
+  const intent = path.dirname(to) === path.join(root, 'profile-move-intents') && to.endsWith('.json')
+  if (intent) barrier('intent-before-publish')
+  rename(from, to)
+  if (intent) { published = true; barrier('intent-published') }
+}
+const rm = fs.rmSync
+fs.rmSync = (target, ...rest) => {
+  const intent = path.dirname(target) === path.join(root, 'profile-move-intents') && target.endsWith('.json')
+  if (intent) barrier('cleanup-before-remove')
+  rm(target, ...rest)
+  if (intent) { removed = true; barrier('cleanup-removed') }
+}
+const fsync = fs.fsyncSync
+fs.fsyncSync = fd => {
+  fsync(fd)
+  if (fs.fstatSync(fd).isDirectory()) {
+    if (removed) barrier('cleanup-durable')
+    else if (published) barrier('intent-durable')
+  }
+}
+require(bundle).transferOrcaProfileProject({ sourceProfileId: 'source', targetProfileId: 'target', repoId: 'repo-1', mode: 'move' }, root)
+throw new Error('Crash boundary not reached: ' + stage)
+`
+  )
+})
+
+afterAll(() => rmSync(crashRoot, { recursive: true, force: true }))
+
+beforeEach(() => {
+  root = mkdtempSync(join(tmpdir(), 'orca-domain-transfer-'))
+  writeFileSync(
+    join(root, 'orca-profile-index.json'),
+    JSON.stringify({
+      schemaVersion: ORCA_PROFILE_INDEX_SCHEMA_VERSION,
+      activeProfileId: 'source',
+      profiles: ['source', 'target'].map((id) => ({
+        id,
+        name: id,
+        avatar: { kind: 'initials', initials: id[0], color: 'neutral' },
+        kind: 'local',
+        createdAt: 1,
+        updatedAt: 1,
+        lastOpenedAt: 1
+      }))
+    })
+  )
+  seed('source', [repo])
+  seed('target')
+})
+
+afterEach(() => {
+  vi.restoreAllMocks()
+  rmSync(root, { recursive: true, force: true })
+})
+
+describe('profile domain transfers', () => {
+  it.each(['copy', 'move'] as const)(
+    '%s preserves the full normalized projection and unchanged physical rows',
+    (mode) => {
+      const beforeSource = domainState.readProfileProjectTransferState('source', root).state
+      const beforeTarget = domainState.readProfileProjectTransferState('target', root).state
+      const physicalBefore = withDatabase('target', (db) =>
+        db
+          .prepare(
+            "SELECT * FROM profile_state_documents WHERE domain IN ('futureOpaque', '', '__proto__', 'futureNull') ORDER BY domain"
+          )
+          .all()
+      )
+      const result = transfer(mode)
+      expect(result.status).toBe('transferred')
+      const afterTarget = JSON.parse(raw('target').json)
+      const targetRepo: Repo = afterTarget.repos[0]
+      const payload = createTransferPayload({
+        sourceState: beforeSource,
+        sourceRepo: repo,
+        targetRepo,
+        includeSessions: mode === 'move'
+      })
+      expect(afterTarget).toEqual(
+        JSON.parse(JSON.stringify(applyPayloadToTarget(beforeTarget, payload)))
+      )
+      expect(afterTarget.settings.opencodeSessionCookie).toBe('enc:v1:sealed-inactive')
+      expect(
+        withDatabase('target', (db) =>
+          db
+            .prepare(
+              "SELECT * FROM profile_state_documents WHERE domain IN ('futureOpaque', '', '__proto__', 'futureNull') ORDER BY domain"
+            )
+            .all()
+        )
+      ).toEqual(physicalBefore)
+      expect(raw('target').revision).toBe(2)
+      expect(raw('source').revision).toBe(mode === 'move' ? 2 : 1)
+      if (mode === 'move') {
+        expect(JSON.parse(raw('source').json)).toEqual(
+          JSON.parse(JSON.stringify(removeSourceRepo(beforeSource, repo.id)))
+        )
+      }
+    }
+  )
+
+  it.each(['git', 'folder', 'ssh'] as const)(
+    'normalization and %s projections do not mutate raw nested values',
+    (kind) => {
+      const snapshot = domainState.readProfileProjectTransferState('source', root)
+      const input = Object.fromEntries(
+        (snapshot.documents ?? []).map(({ domain, value }) => [domain, value])
+      )
+      input.repos = [
+        {
+          ...repo,
+          kind: kind === 'folder' ? 'folder' : 'git',
+          connectionId: kind === 'ssh' ? 'remote' : null
+        }
+      ]
+      input.projects = [
+        {
+          id: 'old-project',
+          displayName: 'Previous',
+          badgeColor: 'neutral',
+          sourceRepoIds: ['repo-1'],
+          createdAt: 1,
+          updatedAt: 1,
+          localWindowsRuntimePreference: { kind: 'wsl', distro: 'Ubuntu' }
+        }
+      ]
+      input.workspaceSession = {
+        ...getDefaultPersistedState('/test').workspaceSession,
+        tabsByWorktree: {
+          'repo-1::/project/branch': [
+            {
+              id: 'tab',
+              ptyId: 'pty',
+              worktreeId: 'repo-1::/project/branch',
+              title: 'Shell',
+              customTitle: null,
+              color: null,
+              sortOrder: 0,
+              createdAt: 1
+            }
+          ]
+        }
+      }
+      if (kind === 'ssh') {
+        input.workspaceSessionsByHostId = { 'runtime:remote': input.workspaceSession }
+      }
+      const before = JSON.stringify(input)
+      frozen(input)
+      const source = frozen(normalizeProfileProjectState(input))
+      const target = frozen(normalizeProfileProjectState({ repos: [] }))
+      const sourceRepo = source.repos[0]
+      if (!sourceRepo) {
+        throw new Error('Missing source repo')
+      }
+      const payload = frozen(
+        createTransferPayload({
+          sourceState: source,
+          sourceRepo,
+          targetRepo: createTargetRepo(sourceRepo, target, false),
+          includeSessions: true
+        })
+      )
+      expect(() => applyPayloadToTarget(target, payload)).not.toThrow()
+      expect(() => removeSourceRepo(source, sourceRepo.id)).not.toThrow()
+      expect(JSON.stringify(input)).toBe(before)
+      expect(Object.entries(source).find(([domain]) => domain === 'futureOpaque')?.[1]).toBe(
+        input.futureOpaque
+      )
+    }
+  )
+
+  it('journals only changed domains and replays target-first with exact revisions', () => {
+    const { intent, sourceAfter, targetAfter } = preparedMove()
+    expect(intent.source.replacements.map(({ domain }) => domain)).not.toContain('futureOpaque')
+    expect(JSON.stringify(intent).length).toBeLessThan(40_000)
+    persistProfileProjectMoveIntent(root, intent)
+    domainState.writeProfileProjectDomainChanges('target', root, intent.target)
+    expect(recoverPendingProfileProjectMoves(root)).toBe(1)
+    expect(JSON.parse(raw('source').json)).toEqual(JSON.parse(JSON.stringify(sourceAfter)))
+    expect(JSON.parse(raw('target').json)).toEqual(JSON.parse(JSON.stringify(targetAfter)))
+    expect(raw('source').revision).toBe(2)
+    expect(raw('target').revision).toBe(2)
+    expect(recoverPendingProfileProjectMoves(root)).toBe(0)
+  })
+
+  it.each(['source', 'target'] as const)(
+    'refuses an unrelated %s write and retains the move intent',
+    (participant) => {
+      const { intent } = preparedMove()
+      persistProfileProjectMoveIntent(root, intent)
+      domainState.writeProfileProjectDomainChanges('target', root, intent.target)
+      withDatabase(participant, (db) =>
+        writeProfileStateDomain(db, {
+          expectedRevision: participant === 'source' ? 1 : 2,
+          domain: 'unrelated',
+          payload: 'true'
+        })
+      )
+      expect(() => recoverPendingProfileProjectMoves(root)).toThrow(/conflicts|unrecognized/)
+      expect(readdirSync(join(root, 'profile-move-intents'))).toContain(`${intent.id}.json`)
+      expect(JSON.parse(raw('source').json).repos).toHaveLength(1)
+    }
+  )
+
+  it('leaves conflicted moves between inactive profiles for those profiles to recover', () => {
+    const { intent } = preparedMove()
+    persistProfileProjectMoveIntent(root, intent)
+    domainState.writeProfileProjectDomainChanges('target', root, intent.target)
+    withDatabase('source', (db) =>
+      writeProfileStateDomain(db, {
+        expectedRevision: 1,
+        domain: 'unrelated',
+        payload: 'true'
+      })
+    )
+    expect(recoverPendingProfileProjectMoves(root, 'third-profile')).toBe(0)
+    expect(() => recoverPendingProfileProjectMoves(root, 'source')).toThrow(/conflicts/)
+    expect(readdirSync(join(root, 'profile-move-intents'))).toContain(`${intent.id}.json`)
+  })
+
+  it('refuses a malformed move record even when its header names inactive profiles', () => {
+    const { intent } = preparedMove()
+    persistProfileProjectMoveIntent(root, intent)
+    const path = join(root, 'profile-move-intents', `${intent.id}.json`)
+    writeFileSync(path, JSON.stringify({ ...intent, source: null }))
+    expect(() => recoverPendingProfileProjectMoves(root, 'third-profile')).toThrow('malformed')
+    expect(JSON.parse(readFileSync(path, 'utf8')).source).toBeNull()
+  })
+
+  it('refuses independently hashed malformed unrelated data before a copy writes anything', () => {
+    const before = raw('target').json
+    withDatabase('source', (db) =>
+      db
+        .prepare(
+          'UPDATE profile_state_documents SET payload = ?, content_hash = ? WHERE domain = ?'
+        )
+        .run('null,"extra":true', hashProfileStateJson('null,"extra":true'), 'futureNull')
+    )
+    expect(() => transfer('copy')).toThrow(/JSON/)
+    expect(raw('target').json).toBe(before)
+  })
+
+  it('distinguishes deletions and null while ignoring extra executable mutation options', () => {
+    const snapshot = domainState.readProfileProjectTransferState('target', root)
+    if (!snapshot.documents || snapshot.revision === undefined) {
+      throw new Error('Missing SQL fixture')
+    }
+    const after = { ...snapshot.state, futureDelete: undefined, futureNull: null, addedNull: null }
+    const changes = prepareProfileProjectDomainChanges(snapshot.revision, snapshot.documents, after)
+    const poisoned = {
+      ...changes,
+      automationRunsAfter: [{}],
+      replacements: changes.replacements.map((replacement) => ({
+        ...replacement,
+        domainVersion: -1
+      }))
+    }
+    domainState.writeProfileProjectDomainChanges('target', root, poisoned)
+    const saved = JSON.parse(raw('target').json)
+    expect(saved.futureNull).toBeNull()
+    expect(saved.addedNull).toBeNull()
+    expect(saved).not.toHaveProperty('futureDelete')
+    expect(saved.automationRuns).toEqual([])
+  })
+
+  it.each(['payload', 'afterHash', 'duplicate', 'revision', 'before'] as const)(
+    'rejects %s tampering before recovery modifies either participant',
+    (kind) => {
+      const { intent } = preparedMove()
+      persistProfileProjectMoveIntent(root, intent)
+      domainState.writeProfileProjectDomainChanges('target', root, intent.target)
+      const before = raw('source').json
+      if (kind === 'payload') {
+        intent.source.replacements[0]!.payload = 'null'
+      }
+      if (kind === 'afterHash') {
+        intent.source.afterHash = 'a'.repeat(64)
+      }
+      if (kind === 'duplicate') {
+        intent.source.replacements.push(intent.source.replacements[0]!)
+      }
+      if (kind === 'revision') {
+        intent.source.expectedRevision = Number.MAX_SAFE_INTEGER
+      }
+      if (kind === 'before') {
+        intent.source.before.push(intent.source.before[0]!)
+      }
+      writeFileSync(join(root, 'profile-move-intents', `${intent.id}.json`), JSON.stringify(intent))
+      expect(() => recoverPendingProfileProjectMoves(root)).toThrow()
+      expect(raw('source').json).toBe(before)
+      expect(readFileSync(join(root, 'profile-move-intents', `${intent.id}.json`), 'utf8')).toBe(
+        JSON.stringify(intent)
+      )
+    }
+  )
+
+  it('canonicalizes only domain ordering in fingerprints', () => {
+    const a = { domain: 'a', hash: hashProfileStateJson('{"x":1,"y":2}') }
+    const b = { domain: 'b', hash: hashProfileStateJson('[2,1]') }
+    expect(profileProjectDomainFingerprint([a, b])).toBe(profileProjectDomainFingerprint([b, a]))
+    expect(profileProjectDomainFingerprint([a, b])).not.toBe(
+      profileProjectDomainFingerprint([{ ...a, hash: hashProfileStateJson('{"y":2,"x":1}') }, b])
+    )
+    const { intent } = preparedMove()
+    expect(() => validateProfileProjectDomainChanges(intent.source)).not.toThrow()
+  })
+
+  const crashStages = [
+    'intent-before-publish',
+    'intent-published',
+    ...(process.platform === 'win32' ? [] : ['intent-durable']),
+    'target-before-commit',
+    'target-committed',
+    'source-before-commit',
+    'source-committed',
+    'cleanup-before-remove',
+    'cleanup-removed',
+    ...(process.platform === 'win32' ? [] : ['cleanup-durable'])
+  ]
+  it.each(crashStages)('recovers exact state after actual SIGKILL at %s', async (stage) => {
+    const sourceBefore = raw('source').json
+    const targetBefore = raw('target').json
+    const { sourceAfter, targetAfter } = preparedMove()
+    const child = await runProcess({
+      program: process.execPath,
+      args: [crashScript, crashBundle, root, stage],
+      env: {
+        ...process.env,
+        ORCA_BACKGROUND_LAUNCH: '1',
+        NODE_PATH: join(process.cwd(), 'node_modules')
+      },
+      timeoutMs: 10_000,
+      maxOutputBytes: 16_384
+    })
+    expect(child.timedOut, child.stderr).toBe(false)
+    expect(child.stdout, child.stderr).toBe(`${stage}\n`)
+    expect(child.code).not.toBe(0)
+    if (process.platform !== 'win32') {
+      expect(child.signal).toBe('SIGKILL')
+    }
+    recoverPendingProfileProjectMoves(root)
+    const targetCommitted = ![
+      'intent-before-publish',
+      'intent-published',
+      'intent-durable',
+      'target-before-commit'
+    ].includes(stage)
+    expect(JSON.parse(raw('source').json)).toEqual(
+      targetCommitted ? JSON.parse(JSON.stringify(sourceAfter)) : JSON.parse(sourceBefore)
+    )
+    expect(JSON.parse(raw('target').json)).toEqual(
+      targetCommitted ? JSON.parse(JSON.stringify(targetAfter)) : JSON.parse(targetBefore)
+    )
+    expect(raw('source').revision).toBe(targetCommitted ? 2 : 1)
+    expect(raw('target').revision).toBe(targetCommitted ? 2 : 1)
+    expect(recoverPendingProfileProjectMoves(root)).toBe(0)
+  })
+})
diff --git a/src/main/orca-profiles/profile-project-move-intent.ts b/src/main/orca-profiles/profile-project-move-intent.ts
new file mode 100644
index 000000000000..51fd796e5ffb
--- /dev/null
+++ b/src/main/orca-profiles/profile-project-move-intent.ts
@@ -0,0 +1,124 @@
+import { randomUUID } from 'node:crypto'
+import { mkdirSync, renameSync, rmSync, writeFileSync } from 'node:fs'
+import { bestEffortFsyncDirectorySync, fsyncFileSync } from '../../shared/secure-file'
+import { hashProfileStateJson } from '../persistence/profile-state/profile-state-documents'
+import {
+  readProfileStateWithRevision,
+  writeSerializedProfileState,
+  type ReadProfileStateResult
+} from './profile-project-state-file'
+import { getOrcaProfileMoveIntentDirectory } from './profile-storage-paths'
+import { readProfileProjectDomainMoveState } from './profile-project-domain-move-intent'
+import { writeProfileProjectDomainChanges } from './profile-project-domain-state'
+import {
+  profileProjectMoveIntentPath,
+  readPendingProfileProjectMoveIntents,
+  validateProfileProjectMoveIntent,
+  type ProfileProjectMoveIntent,
+  type ProfileProjectMoveIntentV1
+} from './profile-project-move-record'
+export { profileHasPendingProjectMove } from './profile-project-move-record'
+export type {
+  ProfileProjectMoveIdentity,
+  ProfileProjectMoveIntent
+} from './profile-project-move-record'
+
+export function persistProfileProjectMoveIntent(
+  userDataPath: string,
+  intent: ProfileProjectMoveIntent
+): void {
+  validateProfileProjectMoveIntent(intent)
+  const directory = getOrcaProfileMoveIntentDirectory(userDataPath)
+  mkdirSync(directory, { recursive: true, mode: 0o700 })
+  const path = profileProjectMoveIntentPath(userDataPath, intent.id)
+  const temporaryPath = `${path}.${process.pid}.${randomUUID()}.tmp`
+  writeFileSync(temporaryPath, JSON.stringify(intent), { encoding: 'utf8', mode: 0o600 })
+  fsyncFileSync(temporaryPath)
+  renameSync(temporaryPath, path)
+  bestEffortFsyncDirectorySync(directory)
+}
+
+export function removeProfileProjectMoveIntent(userDataPath: string, intentId: string): void {
+  rmSync(profileProjectMoveIntentPath(userDataPath, intentId), { force: true })
+  bestEffortFsyncDirectorySync(getOrcaProfileMoveIntentDirectory(userDataPath))
+}
+
+export function recoverPendingProfileProjectMoves(
+  userDataPath: string,
+  profileId?: string
+): number {
+  const intents = readPendingProfileProjectMoveIntents(userDataPath).filter(
+    (intent) =>
+      profileId === undefined ||
+      intent.sourceProfileId === profileId ||
+      intent.targetProfileId === profileId
+  )
+  for (const intent of intents) {
+    recoverProfileProjectMoveIntent(userDataPath, intent)
+  }
+  return intents.length
+}
+
+function recoverProfileProjectMoveIntent(
+  userDataPath: string,
+  intent: ProfileProjectMoveIntent
+): void {
+  const { sourceBefore, targetBefore, sourceAfter, targetAfter } =
+    intent.version === 2
+      ? readProfileProjectDomainMoveState(userDataPath, intent)
+      : readLegacyMoveState(userDataPath, intent)
+
+  if (sourceAfter && targetAfter) {
+    removeProfileProjectMoveIntent(userDataPath, intent.id)
+    return
+  }
+  if (sourceBefore && targetBefore) {
+    removeProfileProjectMoveIntent(userDataPath, intent.id)
+    return
+  }
+  if (sourceBefore && targetAfter) {
+    if (intent.version === 2) {
+      writeProfileProjectDomainChanges(intent.sourceProfileId, userDataPath, intent.source)
+    } else {
+      writeSerializedProfileState(intent.sourceProfileId, userDataPath, intent.sourceAfterJson, {
+        expectedRevision: intent.expectedSourceRevision
+      })
+    }
+    removeProfileProjectMoveIntent(userDataPath, intent.id)
+    return
+  }
+  if (sourceBefore && !targetAfter && !targetBefore) {
+    throw new Error(`Profile move ${intent.id} has an unrecognized target state`)
+  }
+  if (targetAfter && !sourceAfter) {
+    // Preserve the journal when an independent write makes replay unsafe.
+    throw new Error(`Profile move ${intent.id} conflicts with a source profile write`)
+  }
+  if (sourceAfter && targetBefore) {
+    throw new Error(`Profile move ${intent.id} has a source commit without its target commit`)
+  }
+  throw new Error(`Profile move ${intent.id} has an unrecognized participant state`)
+}
+
+function readLegacyMoveState(userDataPath: string, intent: ProfileProjectMoveIntentV1) {
+  const source = readProfileStateWithRevision(intent.sourceProfileId, userDataPath)
+  const target = readProfileStateWithRevision(intent.targetProfileId, userDataPath)
+  if (source.revision === undefined || target.revision === undefined) {
+    throw new Error(`Profile move ${intent.id} no longer has two SQLite participants`)
+  }
+
+  return {
+    sourceBefore: matches(source, intent.expectedSourceRevision, intent.sourceBeforeHash),
+    targetBefore: matches(target, intent.expectedTargetRevision, intent.targetBeforeHash),
+    sourceAfter: matches(source, intent.expectedSourceRevision + 1, intent.sourceAfterHash),
+    targetAfter: matches(target, intent.expectedTargetRevision + 1, intent.targetAfterHash)
+  }
+}
+
+function matches(snapshot: ReadProfileStateResult, revision: number, hash: string): boolean {
+  return (
+    snapshot.revision === revision &&
+    snapshot.serialized !== undefined &&
+    hashProfileStateJson(snapshot.serialized) === hash
+  )
+}
diff --git a/src/main/orca-profiles/profile-project-move-record.ts b/src/main/orca-profiles/profile-project-move-record.ts
new file mode 100644
index 000000000000..68391cd117df
--- /dev/null
+++ b/src/main/orca-profiles/profile-project-move-record.ts
@@ -0,0 +1,141 @@
+import { existsSync, readdirSync, readFileSync } from 'node:fs'
+import { basename, join } from 'node:path'
+import { hashProfileStateJson } from '../persistence/profile-state/profile-state-documents'
+import { isRecord } from '../persistence/profile-state/profile-state-document-validation'
+import { getOrcaProfileMoveIntentDirectory } from './profile-storage-paths'
+import {
+  validateProfileProjectDomainChanges,
+  type ProfileProjectDomainChanges
+} from './profile-project-domain-changes'
+
+const PROFILE_MOVE_INTENT_VERSION = 1
+const INTENT_FILE_PATTERN = /^[0-9a-f-]{36}\.json$/
+const PROFILE_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/
+
+export type ProfileProjectMoveIdentity = {
+  id: string
+  sourceProfileId: string
+  targetProfileId: string
+}
+
+export type ProfileProjectMoveIntentV1 = ProfileProjectMoveIdentity & {
+  version: typeof PROFILE_MOVE_INTENT_VERSION
+  expectedSourceRevision: number
+  expectedTargetRevision: number
+  sourceBeforeHash: string
+  targetBeforeHash: string
+  sourceAfterHash: string
+  targetAfterHash: string
+  sourceAfterJson: string
+  targetAfterJson: string
+}
+
+export type ProfileProjectDomainMoveIntent = ProfileProjectMoveIdentity & {
+  version: 2
+  source: ProfileProjectDomainChanges
+  target: ProfileProjectDomainChanges
+}
+
+export type ProfileProjectMoveIntent = ProfileProjectMoveIntentV1 | ProfileProjectDomainMoveIntent
+
+export function profileHasPendingProjectMove(profileId: string, userDataPath: string): boolean {
+  try {
+    return readPendingProfileProjectMoveIntents(userDataPath).some(
+      (intent) => intent.sourceProfileId === profileId || intent.targetProfileId === profileId
+    )
+  } catch {
+    // An unreadable intent cannot rule this profile out as a participant.
+    return true
+  }
+}
+
+export function readPendingProfileProjectMoveIntents(
+  userDataPath: string
+): ProfileProjectMoveIntent[] {
+  const directory = getOrcaProfileMoveIntentDirectory(userDataPath)
+  return existsSync(directory)
+    ? readdirSync(directory)
+        .filter((file) => INTENT_FILE_PATTERN.test(file))
+        .map((file) => readProfileProjectMoveIntent(join(directory, file)))
+    : []
+}
+
+export function profileProjectMoveIntentPath(userDataPath: string, intentId: string): string {
+  if (!/^[0-9a-f-]{36}$/.test(intentId)) {
+    throw new Error('Invalid profile move intent ID')
+  }
+  return join(getOrcaProfileMoveIntentDirectory(userDataPath), `${intentId}.json`)
+}
+
+function readProfileProjectMoveIntent(path: string): ProfileProjectMoveIntent {
+  let parsed: unknown
+  try {
+    parsed = JSON.parse(readFileSync(path, 'utf8'))
+  } catch (error) {
+    throw new Error(
+      `Profile move intent is unreadable: ${path}: ${error instanceof Error ? error.message : String(error)}`
+    )
+  }
+  if (!isRecord(parsed)) {
+    throw new Error(`Profile move intent is malformed: ${path}`)
+  }
+  validateProfileProjectMoveIntent(parsed)
+  if (basename(path) !== `${parsed.id}.json`) {
+    throw new Error(`Profile move intent ID does not match its file: ${path}`)
+  }
+  return parsed
+}
+
+export function validateProfileProjectMoveIntent(
+  value: unknown
+): asserts value is ProfileProjectMoveIntent {
+  validateMoveIdentity(value)
+  if (value.version === 2) {
+    validateProfileProjectDomainChanges(value.source)
+    validateProfileProjectDomainChanges(value.target)
+    return
+  }
+  const intent = value
+  const expectedSourceRevision = intent.expectedSourceRevision
+  const expectedTargetRevision = intent.expectedTargetRevision
+  if (
+    intent.version !== PROFILE_MOVE_INTENT_VERSION ||
+    !Number.isSafeInteger(expectedSourceRevision) ||
+    !Number.isSafeInteger(expectedTargetRevision) ||
+    typeof expectedSourceRevision !== 'number' ||
+    typeof expectedTargetRevision !== 'number' ||
+    expectedSourceRevision < 0 ||
+    expectedTargetRevision < 0 ||
+    !isHash(intent.sourceBeforeHash) ||
+    !isHash(intent.targetBeforeHash) ||
+    !isHash(intent.sourceAfterHash) ||
+    !isHash(intent.targetAfterHash) ||
+    typeof intent.sourceAfterJson !== 'string' ||
+    typeof intent.targetAfterJson !== 'string' ||
+    hashProfileStateJson(intent.sourceAfterJson) !== intent.sourceAfterHash ||
+    hashProfileStateJson(intent.targetAfterJson) !== intent.targetAfterHash
+  ) {
+    throw new Error('Profile move intent is malformed')
+  }
+}
+
+function validateMoveIdentity(
+  value: unknown
+): asserts value is ProfileProjectMoveIdentity & Record<string, unknown> {
+  if (
+    !isRecord(value) ||
+    typeof value.id !== 'string' ||
+    !/^[0-9a-f-]{36}$/.test(value.id) ||
+    typeof value.sourceProfileId !== 'string' ||
+    typeof value.targetProfileId !== 'string' ||
+    !PROFILE_ID_PATTERN.test(value.sourceProfileId) ||
+    !PROFILE_ID_PATTERN.test(value.targetProfileId) ||
+    value.sourceProfileId === value.targetProfileId
+  ) {
+    throw new Error('Profile move intent is malformed')
+  }
+}
+
+function isHash(value: unknown): value is string {
+  return typeof value === 'string' && /^[a-f0-9]{64}$/.test(value)
+}
diff --git a/src/main/orca-profiles/profile-project-state-file.ts b/src/main/orca-profiles/profile-project-state-file.ts
index d4f291a09e4e..87d3cdd36c82 100644
--- a/src/main/orca-profiles/profile-project-state-file.ts
+++ b/src/main/orca-profiles/profile-project-state-file.ts
@@ -1,7 +1,5 @@
-import { randomUUID } from 'node:crypto'
-import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs'
+import { existsSync, readFileSync } from 'node:fs'
 import { homedir } from 'node:os'
-import { dirname } from 'node:path'
 import { getDefaultPersistedState, getDefaultWorkspaceSession } from '../../shared/constants'
 import { projectHostSetupProjectionFromRepos } from '../../shared/project-host-setup-projection'
 import {
@@ -15,29 +13,116 @@ import type { Repo } from '../../shared/repo-types'
 import type { WorkspaceSessionState } from '../../shared/workspace-session-state-types'
 import type { SparsePreset } from '../../shared/worktree/create-types'
 import type { RetiredNameRegistry } from '../../shared/worktree/retired-name-registry'
-import { getOrcaProfileDataFile } from './profile-index-store'
+import { getOrcaProfileDataFile, getOrcaProfileStateDatabaseFile } from './profile-index-store'
+import {
+  importProfileStateJson,
+  profileStateJsonMatchesAcceptance,
+  readProfileStateRevision,
+  readProfileStateSnapshot
+} from '../persistence/profile-state/profile-state-documents'
+import {
+  openProfileStateDatabase,
+  openProfileStateDatabaseReadOnly
+} from '../persistence/profile-state/profile-state-database'
+import { parseProfileStateRoot } from '../persistence/profile-state/profile-state-document-validation'
+import { assertProfileStateCanInitialize } from '../persistence/profile-state/profile-state-recovery-required'
+import { hasProfileStateDatabaseFiles } from '../persistence/profile-state/profile-state-storage-classification'
 
 export type TransferProfileState = PersistedState
 
-function isRecord<T>(value: unknown): value is Record<string, T> {
-  return typeof value === 'object' && value !== null && !Array.isArray(value)
+export type ReadProfileStateResult = {
+  state: TransferProfileState
+  /** SQLite profile revision observed with the state snapshot; absent for legacy JSON. */
+  revision?: number
+  /** Exact compact JSON projection observed with the state snapshot. */
+  serialized?: string
 }
 
-function arrayOrEmpty<T>(value: unknown): T[] {
-  return Array.isArray(value) ? value : []
-}
+/** A profile must have one unambiguous transfer source. */
+export class AmbiguousProfileStateStorageError extends Error {
+  readonly code = 'ambiguous_profile_state_storage' as const
 
-function recordOrEmpty<T>(value: unknown): Record<string, T> {
-  return isRecord<T>(value) ? value : {}
+  constructor(profileId: string, message?: string) {
+    super(message ?? `Profile ${profileId} has both SQLite and legacy JSON state`)
+    this.name = 'AmbiguousProfileStateStorageError'
+  }
 }
 
-export function readProfileState(profileId: string, userDataPath: string): TransferProfileState {
-  const defaults = getDefaultPersistedState(homedir())
+export type ProfileStateStorage = 'json' | 'sqlite'
+
+export function profileStateStorage(profileId: string, userDataPath: string): ProfileStateStorage {
   const dataFile = getOrcaProfileDataFile(profileId, userDataPath)
-  if (!existsSync(dataFile)) {
-    return structuredClone(defaults)
+  const databaseFile = getOrcaProfileStateDatabaseFile(profileId, userDataPath)
+  const hasJson = existsSync(dataFile)
+  const hasDatabase = hasProfileStateDatabaseFiles(databaseFile)
+  if (hasJson && hasDatabase) {
+    assertAcceptedLegacyJsonMirror(profileId, dataFile, databaseFile)
+    return 'sqlite'
+  }
+  if (!hasDatabase) {
+    assertProfileStateCanInitialize({ dataFile, databaseFile, profileId })
+  }
+  return hasDatabase ? 'sqlite' : 'json'
+}
+
+/**
+ * A migrated profile may retain its JSON export during the rollback window.
+ * Select SQLite only when its acceptance marker still names the exact export;
+ * any edit, missing marker, or corrupt database remains fail-closed.
+ */
+function assertAcceptedLegacyJsonMirror(
+  profileId: string,
+  dataFile: string,
+  databaseFile: string
+): void {
+  const rawJson = readFileSync(dataFile, 'utf-8')
+  const opened = openProfileStateDatabaseReadOnly(databaseFile, profileId)
+  try {
+    if (!profileStateJsonMatchesAcceptance(opened.db, rawJson)) {
+      throw new AmbiguousProfileStateStorageError(profileId)
+    }
+  } finally {
+    opened.db.close()
+  }
+}
+
+/** Read one profile state and retain the SQLite revision that fenced that snapshot. */
+export function readProfileStateWithRevision(
+  profileId: string,
+  userDataPath: string
+): ReadProfileStateResult {
+  const storage = profileStateStorage(profileId, userDataPath)
+  if (storage === 'json') {
+    const dataFile = getOrcaProfileDataFile(profileId, userDataPath)
+    const serialized = existsSync(dataFile) ? readFileSync(dataFile, 'utf-8') : undefined
+    return { state: parseProfileState(serialized), ...(serialized ? { serialized } : {}) }
+  }
+
+  const databaseFile = getOrcaProfileStateDatabaseFile(profileId, userDataPath)
+  const opened = openProfileStateDatabaseReadOnly(databaseFile, profileId)
+  try {
+    const snapshot = readProfileStateSnapshot(opened.db)
+    return {
+      state: parseProfileState(snapshot.json),
+      revision: snapshot.revision,
+      serialized: snapshot.json
+    }
+  } finally {
+    opened.db.close()
+  }
+}
+
+function parseProfileState(rawJson: string | undefined): TransferProfileState {
+  if (rawJson === undefined) {
+    return structuredClone(getDefaultPersistedState(homedir()))
   }
-  const parsed: Partial<PersistedState> = JSON.parse(readFileSync(dataFile, 'utf-8'))
+  return normalizeProfileProjectState(parseProfileStateRoot(rawJson))
+}
+
+export function normalizeProfileProjectState(
+  parsed: Partial<PersistedState>
+): TransferProfileState {
+  const defaults = getDefaultPersistedState(homedir())
   return rebuildRepoBackedProjectState({
     ...defaults,
     ...parsed,
@@ -91,16 +176,50 @@ export function readProfileState(profileId: string, userDataPath: string): Trans
   })
 }
 
+function isRecord<T>(value: unknown): value is Record<string, T> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value)
+}
+
+function arrayOrEmpty<T>(value: unknown): T[] {
+  return Array.isArray(value) ? value : []
+}
+
+function recordOrEmpty<T>(value: unknown): Record<string, T> {
+  return isRecord<T>(value) ? value : {}
+}
+
+export function readProfileState(profileId: string, userDataPath: string): TransferProfileState {
+  return readProfileStateWithRevision(profileId, userDataPath).state
+}
+
 export function writeProfileState(
   profileId: string,
   userDataPath: string,
-  state: TransferProfileState
+  state: TransferProfileState,
+  options: { expectedRevision?: number } = {}
 ): void {
-  const dataFile = getOrcaProfileDataFile(profileId, userDataPath)
-  mkdirSync(dirname(dataFile), { recursive: true })
-  const tmpPath = `${dataFile}.${process.pid}.${randomUUID()}.tmp`
-  writeFileSync(tmpPath, JSON.stringify(state, null, 2), 'utf-8')
-  renameSync(tmpPath, dataFile)
+  writeSerializedProfileState(profileId, userDataPath, JSON.stringify(state), options)
+}
+
+/** Write an already validated JSON projection while preserving its exact bytes in SQLite. */
+export function writeSerializedProfileState(
+  profileId: string,
+  userDataPath: string,
+  serialized: string,
+  options: { expectedRevision?: number } = {}
+): void {
+  if (profileStateStorage(profileId, userDataPath) !== 'sqlite') {
+    throw new Error('Profile transfer write requires an established SQLite participant')
+  }
+  const databaseFile = getOrcaProfileStateDatabaseFile(profileId, userDataPath)
+  const opened = openProfileStateDatabase(databaseFile, profileId)
+  try {
+    importProfileStateJson(opened.db, serialized, {
+      expectedRevision: options.expectedRevision ?? readProfileStateRevision(opened.db)
+    })
+  } finally {
+    opened.db.close()
+  }
 }
 
 function isRepoBackedProjectHostSetup(
diff --git a/src/main/orca-profiles/profile-project-transfer-migration.test.ts b/src/main/orca-profiles/profile-project-transfer-migration.test.ts
new file mode 100644
index 000000000000..46bef280333e
--- /dev/null
+++ b/src/main/orca-profiles/profile-project-transfer-migration.test.ts
@@ -0,0 +1,366 @@
+import {
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  readdirSync,
+  rmSync,
+  writeFileSync
+} from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { getDefaultPersistedState } from '../../shared/constants'
+import { ORCA_PROFILE_INDEX_SCHEMA_VERSION } from '../../shared/orca-profiles'
+import type { Repo } from '../../shared/repo-types'
+import * as profileStateDocuments from '../persistence/profile-state/profile-state-documents'
+import { openProfileStateDatabase } from '../persistence/profile-state/profile-state-database'
+import { ProfileStateSqliteAuthority } from '../persistence/profile-state/profile-state-sqlite-authority'
+import {
+  createProfileStateDatabaseBackupId,
+  profileStateDatabaseBackupPath
+} from '../persistence/profile-state/profile-state-backup-path'
+import { transferOrcaProfileProject } from './profile-project-transfer'
+import {
+  readProfileStateWithRevision,
+  writeSerializedProfileState
+} from './profile-project-state-file'
+import { recoverPendingProfileProjectMoves } from './profile-project-move-intent'
+import * as profileProjectDomainState from './profile-project-domain-state'
+
+vi.mock('../persistence/loading-store/store', () => {
+  throw new Error('Profile transfers must not load inactive Stores')
+})
+
+const repo: Repo = {
+  id: 'repo-1',
+  path: '/projects/folder',
+  displayName: 'Folder',
+  badgeColor: 'neutral',
+  addedAt: 1,
+  kind: 'folder',
+  connectionId: null
+}
+let directory: string
+
+function paths(profileId: string): { dataFile: string; databaseFile: string } {
+  return {
+    dataFile: join(directory, 'profiles', profileId, 'orca-data.json'),
+    databaseFile: join(directory, 'profiles', profileId, 'profile-state.db')
+  }
+}
+
+function writeState(profileId: string, sqlite: boolean, repos: Repo[] = []): string {
+  const defaults = getDefaultPersistedState('/home/test')
+  const source = JSON.stringify(
+    {
+      ...defaults,
+      repos,
+      futureDomain: { profileId },
+      settings: { ...defaults.settings, opencodeSessionCookie: 'enc:v1:sealed-inactive-secret' }
+    },
+    null,
+    2
+  )
+  const location = paths(profileId)
+  mkdirSync(join(location.dataFile, '..'), { recursive: true })
+  if (sqlite) {
+    const opened = openProfileStateDatabase(location.databaseFile, profileId)
+    try {
+      profileStateDocuments.importProfileStateJson(opened.db, source)
+    } finally {
+      opened.db.close()
+    }
+  } else {
+    writeFileSync(location.dataFile, source)
+  }
+  return source
+}
+
+function transfer(mode: 'copy' | 'move' = 'move') {
+  return transferOrcaProfileProject(
+    {
+      sourceProfileId: 'source',
+      targetProfileId: 'target',
+      repoId: repo.id,
+      mode
+    },
+    directory
+  )
+}
+
+beforeEach(() => {
+  directory = mkdtempSync(join(tmpdir(), 'orca-profile-transfer-migration-'))
+  writeFileSync(
+    join(directory, 'orca-profile-index.json'),
+    JSON.stringify({
+      schemaVersion: ORCA_PROFILE_INDEX_SCHEMA_VERSION,
+      activeProfileId: 'source',
+      profiles: ['source', 'target'].map((id) => ({
+        id,
+        name: id,
+        avatar: { kind: 'initials', initials: id[0], color: 'neutral' },
+        kind: 'local',
+        createdAt: 1,
+        updatedAt: 1,
+        lastOpenedAt: 1
+      }))
+    })
+  )
+})
+
+afterEach(() => {
+  vi.restoreAllMocks()
+  rmSync(directory, { recursive: true, force: true })
+})
+
+describe('profile transfer migration', () => {
+  it.each(['copy', 'move'] as const)(
+    '%s adopts an unopened JSON target without loading Store',
+    (mode) => {
+      writeState('source', true, [repo])
+      const targetJson = writeState('target', false)
+      expect(transfer(mode)).toMatchObject({ status: 'transferred', mode })
+
+      const target = readProfileStateWithRevision('target', directory)
+      expect(target.revision).toBe(2)
+      expect(target.state.repos).toHaveLength(1)
+      expect(target.state.repos[0]).toMatchObject({ kind: 'folder', path: repo.path })
+      expect(target.state.settings.opencodeSessionCookie).toBe('enc:v1:sealed-inactive-secret')
+      expect(JSON.parse(target.serialized ?? '{}').futureDomain).toEqual({ profileId: 'target' })
+      expect(readFileSync(paths('target').dataFile, 'utf8')).toBe(targetJson)
+      expect(existsSync(`${paths('target').dataFile}.sqlite-export.1.json`)).toBe(true)
+      expect(readProfileStateWithRevision('source', directory).state.repos).toHaveLength(
+        mode === 'move' ? 0 : 1
+      )
+    }
+  )
+
+  it('initializes a target with no saved JSON before its move intent is created', () => {
+    writeState('source', true, [repo])
+    expect(transfer()).toMatchObject({ status: 'transferred' })
+    expect(readProfileStateWithRevision('target', directory).state.repos).toHaveLength(1)
+    expect(existsSync(paths('target').dataFile)).toBe(false)
+    expect(existsSync(paths('target').databaseFile)).toBe(true)
+  })
+
+  it.each(['copy', 'move'] as const)(
+    '%s refuses an apparently empty target that retains a legacy JSON backup',
+    (mode) => {
+      writeState('source', true, [repo])
+      const sourceRevision = readProfileStateWithRevision('source', directory).revision
+      const targetJson = writeState('target', false)
+      const target = paths('target')
+      writeFileSync(`${target.dataFile}.bak.0`, targetJson)
+      rmSync(target.dataFile)
+
+      expect(() => transfer(mode)).toThrow('restore a selected backup')
+      expect(readProfileStateWithRevision('source', directory)).toMatchObject({
+        revision: sourceRevision,
+        state: { repos: [repo] }
+      })
+      expect(existsSync(target.dataFile)).toBe(false)
+      expect(existsSync(target.databaseFile)).toBe(false)
+      expect(readFileSync(`${target.dataFile}.bak.0`, 'utf8')).toBe(targetJson)
+    }
+  )
+
+  it.each(['[]', '7', '"invalid"', 'true'])(
+    'refuses a non-object JSON target (%s) without replacing its contents',
+    (raw) => {
+      writeState('source', false, [repo])
+      writeState('target', false)
+      const target = paths('target')
+      writeFileSync(target.dataFile, raw)
+
+      expect(() => transfer()).toThrow('Profile state JSON root must be an object')
+      expect(readFileSync(target.dataFile, 'utf8')).toBe(raw)
+      expect(existsSync(target.databaseFile)).toBe(false)
+      expect(readProfileStateWithRevision('source', directory).state.repos).toHaveLength(1)
+    }
+  )
+
+  it('migrates a JSON source before moving into SQLite and retains its exact rollback bytes', () => {
+    const sourceJson = writeState('source', false, [repo])
+    writeState('target', true)
+    expect(transfer()).toMatchObject({ status: 'transferred' })
+    expect(readProfileStateWithRevision('source', directory)).toMatchObject({
+      revision: 2,
+      state: { repos: [] }
+    })
+    expect(readProfileStateWithRevision('target', directory).state.repos).toHaveLength(1)
+    expect(readFileSync(paths('source').dataFile, 'utf8')).toBe(sourceJson)
+  })
+
+  it('copies from JSON into SQLite without migrating or changing the source', () => {
+    const sourceJson = writeState('source', false, [repo])
+    writeState('target', true)
+    expect(transfer('copy')).toMatchObject({ status: 'transferred' })
+    expect(readFileSync(paths('source').dataFile, 'utf8')).toBe(sourceJson)
+    expect(existsSync(paths('source').databaseFile)).toBe(false)
+    expect(readProfileStateWithRevision('target', directory).state.repos).toHaveLength(1)
+  })
+
+  it.each(['copy', 'move'] as const)(
+    '%s migrates every mutated JSON participant while preserving storage-form values',
+    (mode) => {
+      const sourceJson = writeState('source', false, [repo])
+      const targetJson = writeState('target', false)
+      expect(transfer(mode)).toMatchObject({ status: 'transferred', mode })
+      expect(existsSync(paths('source').databaseFile)).toBe(mode === 'move')
+      expect(existsSync(paths('target').databaseFile)).toBe(true)
+      expect(readProfileStateWithRevision('source', directory).state.repos).toHaveLength(
+        mode === 'move' ? 0 : 1
+      )
+      expect(readProfileStateWithRevision('target', directory)).toMatchObject({
+        revision: 2,
+        state: { repos: [expect.objectContaining({ path: repo.path })] }
+      })
+      for (const [profileId, rawJson] of [
+        ['source', sourceJson],
+        ['target', targetJson]
+      ]) {
+        expect(readFileSync(paths(profileId).dataFile, 'utf8')).toBe(rawJson)
+        const current = readProfileStateWithRevision(profileId, directory)
+        expect(current.state.settings.opencodeSessionCookie).toBe('enc:v1:sealed-inactive-secret')
+        expect(JSON.parse(current.serialized ?? '{}').futureDomain).toEqual({ profileId })
+      }
+    }
+  )
+
+  it.each(['copy', 'move'] as const)(
+    '%s rejects JSON-only mutation without SQLite and preserves both legacy sources',
+    (mode) => {
+      const sourceJson = writeState('source', false, [repo])
+      const targetJson = writeState('target', false)
+      const getBuiltin = process.getBuiltinModule
+      vi.spyOn(process, 'getBuiltinModule').mockImplementation((name) =>
+        name === 'node:sqlite' ? undefined : getBuiltin(name)
+      )
+      expect(() => transfer(mode)).toThrow('Unable to open profile state database')
+      expect(existsSync(paths('source').databaseFile)).toBe(false)
+      expect(existsSync(paths('target').databaseFile)).toBe(false)
+      expect(readFileSync(paths('source').dataFile, 'utf8')).toBe(sourceJson)
+      expect(readFileSync(paths('target').dataFile, 'utf8')).toBe(targetJson)
+      expect(readProfileStateWithRevision('source', directory).state.repos).toHaveLength(1)
+    }
+  )
+
+  it('refuses a legacy JSON write outside participant migration', () => {
+    const sourceJson = writeState('source', false, [repo])
+    expect(() => writeSerializedProfileState('source', directory, '{}')).toThrow(
+      'established SQLite participant'
+    )
+    expect(readFileSync(paths('source').dataFile, 'utf8')).toBe(sourceJson)
+    expect(() => writeSerializedProfileState('target', directory, '{}')).toThrow(
+      'established SQLite participant'
+    )
+    expect(existsSync(paths('target').dataFile)).toBe(false)
+    expect(existsSync(paths('target').databaseFile)).toBe(false)
+  })
+
+  it('refuses mixed storage on a runtime without SQLite before migrating or editing JSON', () => {
+    const sourceJson = writeState('source', false, [repo])
+    writeState('target', true)
+    const getBuiltin = process.getBuiltinModule
+    vi.spyOn(process, 'getBuiltinModule').mockImplementation((name) =>
+      name === 'node:sqlite' ? undefined : getBuiltin(name)
+    )
+    expect(() => transfer()).toThrow('Unable to open profile state database')
+    expect(readFileSync(paths('source').dataFile, 'utf8')).toBe(sourceJson)
+    expect(existsSync(paths('source').databaseFile)).toBe(false)
+  })
+
+  it('refuses to adopt stale target JSON when a retained database backup proves missing authority', () => {
+    writeState('source', true, [repo])
+    writeState('target', false)
+    const backupPath = profileStateDatabaseBackupPath(
+      paths('target').databaseFile,
+      createProfileStateDatabaseBackupId(1)
+    )
+    writeFileSync(backupPath, 'retained recovery evidence')
+    expect(() => transfer()).toThrowError(
+      expect.objectContaining({
+        code: 'profile-state-recovery-required',
+        backupPaths: [backupPath]
+      })
+    )
+    expect(existsSync(paths('target').databaseFile)).toBe(false)
+    expect(readProfileStateWithRevision('source', directory).state.repos).toHaveLength(1)
+  })
+
+  it('does not migrate a duplicate target', () => {
+    writeState('source', true, [repo])
+    writeState('target', false, [repo])
+    expect(transfer()).toMatchObject({ status: 'duplicate-target' })
+    expect(existsSync(paths('target').databaseFile)).toBe(false)
+  })
+
+  it('leaves both participants untouched when the import fails before publication', () => {
+    writeState('source', true, [repo])
+    const targetJson = writeState('target', false)
+    vi.spyOn(profileStateDocuments, 'importProfileStateJson').mockImplementation(() => {
+      throw new Error('import failure')
+    })
+    expect(() => transfer()).toThrow('import failure')
+    expect(readProfileStateWithRevision('source', directory).state.repos).toHaveLength(1)
+    expect(readFileSync(paths('target').dataFile, 'utf8')).toBe(targetJson)
+    expect(existsSync(paths('target').databaseFile)).toBe(false)
+    expect(readdirSync(join(paths('target').dataFile, '..'))).toEqual(['orca-data.json'])
+  })
+
+  it('rejects a JSON edit during migration before publishing SQLite', () => {
+    writeState('source', true, [repo])
+    writeState('target', false)
+    const originalImport = profileStateDocuments.importProfileStateJson
+    vi.spyOn(profileStateDocuments, 'importProfileStateJson').mockImplementation((...args) => {
+      const revision = originalImport(...args)
+      writeFileSync(paths('target').dataFile, '{"settings":{"theme":"light"}}')
+      return revision
+    })
+    expect(() => transfer()).toThrow('JSON changed while importing')
+    expect(existsSync(paths('target').databaseFile)).toBe(false)
+    expect(readProfileStateWithRevision('source', directory).state.repos).toHaveLength(1)
+  })
+
+  it('keeps a valid migrated participant after export failure without moving the project', () => {
+    writeState('source', true, [repo])
+    const targetJson = writeState('target', false)
+    vi.spyOn(ProfileStateSqliteAuthority.prototype, 'writeJsonExport').mockImplementation(() => {
+      throw new Error('export failure')
+    })
+    expect(() => transfer()).toThrow('export failure')
+    expect(readProfileStateWithRevision('source', directory).state.repos).toHaveLength(1)
+    expect(readProfileStateWithRevision('target', directory).state.repos).toHaveLength(0)
+    expect(readFileSync(paths('target').dataFile, 'utf8')).toBe(targetJson)
+  })
+
+  it.each([
+    [true, false],
+    [false, true],
+    [false, false]
+  ])(
+    'replays an interrupted move with initial SQLite source=%s target=%s',
+    (sourceSqlite, targetSqlite) => {
+      writeState('source', sourceSqlite, [repo])
+      writeState('target', targetSqlite)
+      const originalWrite = profileProjectDomainState.writeProfileProjectDomainChanges
+      const write = vi
+        .spyOn(profileProjectDomainState, 'writeProfileProjectDomainChanges')
+        .mockImplementation((profileId, ...rest) => {
+          if (profileId === 'source') {
+            throw new Error('source commit interrupted')
+          }
+          return originalWrite(profileId, ...rest)
+        })
+      expect(() => transfer()).toThrow('source commit interrupted')
+      expect(readProfileStateWithRevision('source', directory).state.repos).toHaveLength(1)
+      expect(readProfileStateWithRevision('target', directory).state.repos).toHaveLength(1)
+      write.mockRestore()
+      expect(recoverPendingProfileProjectMoves(directory)).toBe(1)
+      expect(readProfileStateWithRevision('source', directory).state.repos).toHaveLength(0)
+      expect(readProfileStateWithRevision('target', directory).state.repos).toHaveLength(1)
+      expect(recoverPendingProfileProjectMoves(directory)).toBe(0)
+    }
+  )
+})
diff --git a/src/main/orca-profiles/profile-project-transfer-migration.ts b/src/main/orca-profiles/profile-project-transfer-migration.ts
new file mode 100644
index 000000000000..1b380030c653
--- /dev/null
+++ b/src/main/orca-profiles/profile-project-transfer-migration.ts
@@ -0,0 +1,27 @@
+import { migrateProfileStateToSqlite } from '../persistence/profile-state/profile-state-migration'
+import { getOrcaProfileDataFile, getOrcaProfileStateDatabaseFile } from './profile-storage-paths'
+import type { ReadProfileStateResult } from './profile-project-state-file'
+import {
+  readProfileProjectTransferState,
+  type ReadProfileProjectTransferResult
+} from './profile-project-domain-state'
+
+/** Adopt inactive storage without running Store's active-profile listeners or secret transforms. */
+export function migrateProfileProjectTransferParticipant(
+  profileId: string,
+  userDataPath: string,
+  snapshot: ReadProfileStateResult
+): ReadProfileProjectTransferResult {
+  const migrated = migrateProfileStateToSqlite({
+    dataFile: getOrcaProfileDataFile(profileId, userDataPath),
+    databaseFile: getOrcaProfileStateDatabaseFile(profileId, userDataPath),
+    profileId,
+    expectedLegacyJson: snapshot.serialized,
+    serializedState: snapshot.serialized ?? '{}'
+  })
+  try {
+    return readProfileProjectTransferState(profileId, userDataPath)
+  } finally {
+    migrated.authority.close()
+  }
+}
diff --git a/src/main/orca-profiles/profile-project-transfer.test.ts b/src/main/orca-profiles/profile-project-transfer.test.ts
index fc40cd03bb67..06c3cb74c638 100644
--- a/src/main/orca-profiles/profile-project-transfer.test.ts
+++ b/src/main/orca-profiles/profile-project-transfer.test.ts
@@ -1,4 +1,12 @@
-import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import {
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  readdirSync,
+  rmSync,
+  writeFileSync
+} from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { beforeEach, afterEach, describe, expect, it, vi } from 'vitest'
@@ -11,6 +19,50 @@ import type { PersistedState } from '../../shared/persisted-state-types'
 import type { Repo } from '../../shared/repo-types'
 import type { WorktreeMeta } from '../../shared/worktree/meta-types'
 import type { SshTarget } from '../../shared/ssh-types'
+import {
+  exportProfileStateJson,
+  hashProfileStateJson,
+  importProfileStateJson
+} from '../persistence/profile-state/profile-state-documents'
+import { openProfileStateDatabase } from '../persistence/profile-state/profile-state-database'
+import {
+  persistProfileProjectMoveIntent,
+  recoverPendingProfileProjectMoves,
+  type ProfileProjectMoveIntent
+} from './profile-project-move-intent'
+import type { ReadProfileStateResult } from './profile-project-state-file'
+
+function createProfileProjectMoveIntent(args: {
+  sourceProfileId: string
+  targetProfileId: string
+  source: ReadProfileStateResult
+  target: ReadProfileStateResult
+  sourceAfterJson: string
+  targetAfterJson: string
+}): Extract<ProfileProjectMoveIntent, { version: 1 }> {
+  if (
+    args.source.revision === undefined ||
+    args.target.revision === undefined ||
+    args.source.serialized === undefined ||
+    args.target.serialized === undefined
+  ) {
+    throw new Error('Legacy move fixture requires two serialized SQLite snapshots')
+  }
+  return {
+    version: 1,
+    id: '11111111-1111-1111-1111-111111111111',
+    sourceProfileId: args.sourceProfileId,
+    targetProfileId: args.targetProfileId,
+    expectedSourceRevision: args.source.revision,
+    expectedTargetRevision: args.target.revision,
+    sourceBeforeHash: hashProfileStateJson(args.source.serialized),
+    targetBeforeHash: hashProfileStateJson(args.target.serialized),
+    sourceAfterHash: hashProfileStateJson(args.sourceAfterJson),
+    targetAfterHash: hashProfileStateJson(args.targetAfterJson),
+    sourceAfterJson: args.sourceAfterJson,
+    targetAfterJson: args.targetAfterJson
+  }
+}
 
 const testState = { dir: '' }
 
@@ -50,13 +102,53 @@ function profileDataPath(profileId: string): string {
   return join(testState.dir, 'profiles', profileId, 'orca-data.json')
 }
 
+function profileDatabasePath(profileId: string): string {
+  return join(testState.dir, 'profiles', profileId, 'profile-state.db')
+}
+
 function writeProfileState(profileId: string, state: PersistedState): void {
   const dataFile = profileDataPath(profileId)
   mkdirSync(join(dataFile, '..'), { recursive: true })
   writeFileSync(dataFile, JSON.stringify(state, null, 2), 'utf-8')
 }
 
+function writeProfileStateDatabase(profileId: string, state: PersistedState): void {
+  const databasePath = profileDatabasePath(profileId)
+  mkdirSync(join(databasePath, '..'), { recursive: true })
+  const opened = openProfileStateDatabase(databasePath, profileId)
+  try {
+    importProfileStateJson(opened.db, JSON.stringify(state))
+  } finally {
+    opened.db.close()
+  }
+}
+
+function writeProfileStateDatabaseWithAcceptedLegacyJson(profileId: string, rawJson: string): void {
+  const databasePath = profileDatabasePath(profileId)
+  mkdirSync(join(databasePath, '..'), { recursive: true })
+  const opened = openProfileStateDatabase(databasePath, profileId)
+  try {
+    importProfileStateJson(opened.db, rawJson, {
+      acceptedLegacyJsonHash: hashProfileStateJson(rawJson)
+    })
+  } finally {
+    opened.db.close()
+  }
+}
+
+function readProfileStateDatabase(profileId: string): PersistedState {
+  const opened = openProfileStateDatabase(profileDatabasePath(profileId), profileId)
+  try {
+    return JSON.parse(exportProfileStateJson(opened.db))
+  } finally {
+    opened.db.close()
+  }
+}
+
 function readProfileState(profileId: string): PersistedState {
+  if (existsSync(profileDatabasePath(profileId))) {
+    return readProfileStateDatabase(profileId)
+  }
   return JSON.parse(readFileSync(profileDataPath(profileId), 'utf-8')) as PersistedState
 }
 
@@ -324,4 +416,353 @@ describe('profile project transfer', () => {
     })
     expect(readProfileState('work').repos.map((repo) => repo.id)).toEqual(['repo-existing'])
   })
+
+  it('transfers between SQLite-backed profiles without creating legacy JSON or touching sidecars', async () => {
+    const sourceState = makeState({ repos: [makeRepo()] })
+    writeProfileStateDatabase('personal', sourceState)
+    writeProfileStateDatabase('work', makeState())
+    const sidecarPath = join(testState.dir, 'profiles', 'work', 'browser-session-meta.json')
+    writeFileSync(sidecarPath, '{"preserve":true}', 'utf-8')
+
+    const { transferOrcaProfileProject } = await loadTransferModule()
+    const result = transferOrcaProfileProject(
+      {
+        sourceProfileId: 'personal',
+        targetProfileId: 'work',
+        repoId: 'repo-1',
+        mode: 'copy'
+      },
+      testState.dir
+    )
+
+    expect(result.status).toBe('transferred')
+    expect(readProfileStateDatabase('work').repos).toEqual([
+      expect.objectContaining({ path: '/workspace/orca' })
+    ])
+    expect(existsSync(profileDataPath('personal'))).toBe(false)
+    expect(existsSync(profileDataPath('work'))).toBe(false)
+    expect(readFileSync(sidecarPath, 'utf-8')).toBe('{"preserve":true}')
+  })
+
+  it('migrates the mutated target when both participants have only legacy JSON', async () => {
+    writeProfileState('personal', makeState({ repos: [makeRepo()] }))
+    writeProfileState('work', makeState())
+
+    const { transferOrcaProfileProject } = await loadTransferModule()
+    const result = transferOrcaProfileProject(
+      {
+        sourceProfileId: 'personal',
+        targetProfileId: 'work',
+        repoId: 'repo-1',
+        mode: 'copy'
+      },
+      testState.dir
+    )
+
+    expect(result.status).toBe('transferred')
+    expect(readProfileState('work').repos).toEqual([
+      expect.objectContaining({ path: '/workspace/orca' })
+    ])
+    expect(existsSync(profileDatabasePath('personal'))).toBe(false)
+    expect(existsSync(profileDatabasePath('work'))).toBe(true)
+  })
+
+  it('fails closed when a profile has both database and legacy JSON state', async () => {
+    const sourceState = makeState({ repos: [makeRepo()] })
+    writeProfileState('personal', sourceState)
+    writeProfileStateDatabase('personal', sourceState)
+    writeProfileState('work', makeState())
+
+    const { transferOrcaProfileProject } = await loadTransferModule()
+    expect(() =>
+      transferOrcaProfileProject(
+        {
+          sourceProfileId: 'personal',
+          targetProfileId: 'work',
+          repoId: 'repo-1',
+          mode: 'copy'
+        },
+        testState.dir
+      )
+    ).toThrowError(expect.objectContaining({ code: 'ambiguous_profile_state_storage' }))
+  })
+
+  it('uses SQLite when the retained legacy JSON is the accepted migration export', async () => {
+    const sourceState = makeState({ repos: [makeRepo()] })
+    writeProfileState('personal', sourceState)
+    const sourceJson = readFileSync(profileDataPath('personal'), 'utf-8')
+    writeProfileStateDatabaseWithAcceptedLegacyJson('personal', sourceJson)
+    writeProfileState('work', makeState())
+
+    const { transferOrcaProfileProject } = await loadTransferModule()
+    const result = transferOrcaProfileProject(
+      {
+        sourceProfileId: 'personal',
+        targetProfileId: 'work',
+        repoId: 'repo-1',
+        mode: 'copy'
+      },
+      testState.dir
+    )
+
+    expect(result.status).toBe('transferred')
+    expect(readProfileStateDatabase('work').repos).toEqual([
+      expect.objectContaining({ path: '/workspace/orca' })
+    ])
+    expect(readFileSync(profileDataPath('personal'), 'utf-8')).toBe(sourceJson)
+    expect(readProfileStateDatabase('personal').repos).toEqual([
+      expect.objectContaining({ path: '/workspace/orca' })
+    ])
+  })
+
+  it('rejects a missing SQLite database when a retained export proves JSON is stale', async () => {
+    const sourceState = makeState({ repos: [makeRepo()] })
+    writeProfileState('personal', sourceState)
+    const sourceJson = readFileSync(profileDataPath('personal'), 'utf-8')
+    writeProfileStateDatabaseWithAcceptedLegacyJson('personal', sourceJson)
+    rmSync(profileDatabasePath('personal'))
+    writeFileSync(`${profileDataPath('personal')}.sqlite-export.1.json`, sourceJson)
+    writeProfileState('work', makeState())
+
+    const { transferOrcaProfileProject } = await loadTransferModule()
+    expect(() =>
+      transferOrcaProfileProject(
+        {
+          sourceProfileId: 'personal',
+          targetProfileId: 'work',
+          repoId: 'repo-1',
+          mode: 'copy'
+        },
+        testState.dir
+      )
+    ).toThrowError(expect.objectContaining({ code: 'profile-state-recovery-required' }))
+  })
+
+  it.each(['-wal', '-shm', '-journal'])(
+    'refuses a transfer from an orphaned %s',
+    async (suffix) => {
+      writeProfileState('personal', makeState({ repos: [makeRepo()] }))
+      writeProfileState('work', makeState())
+      const sourceJson = readFileSync(profileDataPath('personal'), 'utf8')
+      const targetJson = readFileSync(profileDataPath('work'), 'utf8')
+      const sidecar = `${profileDatabasePath('personal')}${suffix}`
+      writeFileSync(sidecar, 'orphaned recovery evidence')
+
+      const { transferOrcaProfileProject } = await loadTransferModule()
+      expect(() =>
+        transferOrcaProfileProject(
+          { sourceProfileId: 'personal', targetProfileId: 'work', repoId: 'repo-1', mode: 'move' },
+          testState.dir
+        )
+      ).toThrow()
+      expect(readFileSync(profileDataPath('personal'), 'utf8')).toBe(sourceJson)
+      expect(readFileSync(profileDataPath('work'), 'utf8')).toBe(targetJson)
+      expect(readFileSync(sidecar, 'utf8')).toBe('orphaned recovery evidence')
+      expect(existsSync(profileDatabasePath('personal'))).toBe(false)
+      expect(existsSync(profileDatabasePath('work'))).toBe(false)
+    }
+  )
+
+  it.each(['copy', 'move'] as const)(
+    '%s transfers between SQLite-only profiles while retaining rollback exports',
+    async (mode) => {
+      const sourceState = makeState({ repos: [makeRepo()] })
+      const targetState = makeState()
+      writeProfileStateDatabase('personal', sourceState)
+      writeProfileStateDatabase('work', targetState)
+      const sourceExport = JSON.stringify(sourceState)
+      const targetExport = JSON.stringify(targetState)
+      const sourceExportPath = `${profileDataPath('personal')}.sqlite-export.1.json`
+      const targetExportPath = `${profileDataPath('work')}.sqlite-export.1.json`
+      writeFileSync(sourceExportPath, sourceExport)
+      writeFileSync(targetExportPath, targetExport)
+
+      const { transferOrcaProfileProject } = await loadTransferModule()
+      const result = transferOrcaProfileProject(
+        {
+          sourceProfileId: 'personal',
+          targetProfileId: 'work',
+          repoId: 'repo-1',
+          mode
+        },
+        testState.dir
+      )
+
+      expect(result.status).toBe('transferred')
+      expect(readProfileStateDatabase('personal').repos).toHaveLength(mode === 'move' ? 0 : 1)
+      expect(readProfileStateDatabase('work').repos).toEqual([
+        expect.objectContaining({ path: '/workspace/orca' })
+      ])
+      expect(existsSync(profileDataPath('personal'))).toBe(false)
+      expect(existsSync(profileDataPath('work'))).toBe(false)
+      expect(readFileSync(sourceExportPath, 'utf8')).toBe(sourceExport)
+      expect(readFileSync(targetExportPath, 'utf8')).toBe(targetExport)
+    }
+  )
+
+  it('fences a SQLite transfer write against the revision that was read', async () => {
+    writeProfileStateDatabase('work', makeState())
+
+    await loadTransferModule()
+    const stateFile = await import('./profile-project-state-file')
+    const observed = stateFile.readProfileStateWithRevision('work', testState.dir)
+    expect(observed.revision).toBeGreaterThan(0)
+
+    const opened = openProfileStateDatabase(profileDatabasePath('work'), 'work')
+    try {
+      importProfileStateJson(
+        opened.db,
+        JSON.stringify(makeState({ settings: { ...makeState().settings, theme: 'dark' } }))
+      )
+    } finally {
+      opened.db.close()
+    }
+
+    expect(() =>
+      stateFile.writeProfileState('work', testState.dir, makeState(), {
+        expectedRevision: observed.revision
+      })
+    ).toThrowError(expect.objectContaining({ code: 'profile-state-revision-conflict' }))
+    expect(readProfileStateDatabase('work').settings.theme).toBe('dark')
+  })
+
+  it('moves between SQLite-backed profiles through a durable cross-profile intent', async () => {
+    writeProfileStateDatabase('personal', makeState({ repos: [makeRepo()] }))
+    writeProfileStateDatabase('work', makeState())
+
+    const { transferOrcaProfileProject } = await loadTransferModule()
+    const result = transferOrcaProfileProject(
+      {
+        sourceProfileId: 'personal',
+        targetProfileId: 'work',
+        repoId: 'repo-1',
+        mode: 'move'
+      },
+      testState.dir
+    )
+    expect(result.status).toBe('transferred')
+    expect(readProfileStateDatabase('personal').repos).toHaveLength(0)
+    expect(readProfileStateDatabase('work').repos).toHaveLength(1)
+    expect(
+      readdirSync(join(testState.dir, 'profile-move-intents')).filter((file) =>
+        file.endsWith('.json')
+      )
+    ).toEqual([])
+  })
+
+  it('moves between rollback-window profiles while retaining their JSON exports', async () => {
+    const sourceState = makeState({ repos: [makeRepo()] })
+    writeProfileState('personal', sourceState)
+    writeProfileState('work', makeState())
+    const sourceJson = readFileSync(profileDataPath('personal'), 'utf-8')
+    const targetJson = readFileSync(profileDataPath('work'), 'utf-8')
+    writeProfileStateDatabaseWithAcceptedLegacyJson('personal', sourceJson)
+    writeProfileStateDatabaseWithAcceptedLegacyJson('work', targetJson)
+
+    const { transferOrcaProfileProject } = await loadTransferModule()
+    const result = transferOrcaProfileProject(
+      {
+        sourceProfileId: 'personal',
+        targetProfileId: 'work',
+        repoId: 'repo-1',
+        mode: 'move'
+      },
+      testState.dir
+    )
+
+    expect(result.status).toBe('transferred')
+    expect(readProfileStateDatabase('personal').repos).toHaveLength(0)
+    expect(readProfileStateDatabase('work').repos).toHaveLength(1)
+    expect(readFileSync(profileDataPath('personal'), 'utf-8')).toBe(sourceJson)
+    expect(readFileSync(profileDataPath('work'), 'utf-8')).toBe(targetJson)
+  })
+
+  it('migrates a legacy JSON target before moving a SQLite-backed project', async () => {
+    const sourceState = makeState({ repos: [makeRepo()] })
+    writeProfileStateDatabase('personal', sourceState)
+    writeProfileState('work', makeState())
+    const targetJson = readFileSync(profileDataPath('work'), 'utf-8')
+
+    const { transferOrcaProfileProject } = await loadTransferModule()
+    expect(
+      transferOrcaProfileProject(
+        {
+          sourceProfileId: 'personal',
+          targetProfileId: 'work',
+          repoId: 'repo-1',
+          mode: 'move'
+        },
+        testState.dir
+      )
+    ).toMatchObject({ status: 'transferred', mode: 'move' })
+    expect(readProfileStateDatabase('personal').repos).toHaveLength(0)
+    expect(readProfileStateDatabase('work').repos).toHaveLength(1)
+    expect(readFileSync(profileDataPath('work'), 'utf-8')).toBe(targetJson)
+  })
+
+  it.each([undefined, 'prepared', 'target-committed'])(
+    'replays a move after the target commit with legacy phase=%s',
+    async (phase) => {
+      writeProfileStateDatabase('personal', makeState({ repos: [makeRepo()] }))
+      writeProfileStateDatabase('work', makeState())
+      const stateFile = await import('./profile-project-state-file')
+      const source = stateFile.readProfileStateWithRevision('personal', testState.dir)
+      const target = stateFile.readProfileStateWithRevision('work', testState.dir)
+      const sourceAfter = makeState()
+      const targetAfter = makeState({ repos: [makeRepo()] })
+      const intent = createProfileProjectMoveIntent({
+        sourceProfileId: 'personal',
+        targetProfileId: 'work',
+        source,
+        target,
+        sourceAfterJson: JSON.stringify(sourceAfter),
+        targetAfterJson: JSON.stringify(targetAfter)
+      })
+      const historicalIntent = phase === undefined ? intent : { ...intent, phase }
+      persistProfileProjectMoveIntent(testState.dir, historicalIntent)
+      stateFile.writeProfileState('work', testState.dir, targetAfter, {
+        expectedRevision: target.revision
+      })
+
+      expect(recoverPendingProfileProjectMoves(testState.dir)).toBe(1)
+      expect(recoverPendingProfileProjectMoves(testState.dir)).toBe(0)
+      expect(readProfileStateDatabase('personal').repos).toHaveLength(0)
+      expect(readProfileStateDatabase('work').repos).toHaveLength(1)
+      expect(
+        readdirSync(join(testState.dir, 'profile-move-intents')).filter((file) =>
+          file.endsWith('.json')
+        )
+      ).toEqual([])
+    }
+  )
+
+  it('refuses a move intent whose after-state bytes no longer match their hashes', async () => {
+    writeProfileStateDatabase('personal', makeState({ repos: [makeRepo()] }))
+    writeProfileStateDatabase('work', makeState())
+    const stateFile = await import('./profile-project-state-file')
+    const source = stateFile.readProfileStateWithRevision('personal', testState.dir)
+    const target = stateFile.readProfileStateWithRevision('work', testState.dir)
+    const intent = createProfileProjectMoveIntent({
+      sourceProfileId: 'personal',
+      targetProfileId: 'work',
+      source,
+      target,
+      sourceAfterJson: JSON.stringify(makeState()),
+      targetAfterJson: JSON.stringify(makeState({ repos: [makeRepo()] }))
+    })
+    persistProfileProjectMoveIntent(testState.dir, intent)
+    stateFile.writeProfileState('work', testState.dir, makeState({ repos: [makeRepo()] }), {
+      expectedRevision: target.revision
+    })
+    const intentPath = join(testState.dir, 'profile-move-intents', `${intent.id}.json`)
+    const tampered = JSON.parse(readFileSync(intentPath, 'utf8'))
+    tampered.sourceAfterJson = JSON.stringify(
+      makeState({ settings: { ...makeState().settings, theme: 'light' } })
+    )
+    writeFileSync(intentPath, JSON.stringify(tampered), 'utf8')
+
+    expect(() => recoverPendingProfileProjectMoves(testState.dir)).toThrow(/intent is malformed/)
+    expect(readProfileStateDatabase('personal').repos).toHaveLength(1)
+    expect(existsSync(intentPath)).toBe(true)
+  })
 })
diff --git a/src/main/orca-profiles/profile-project-transfer.ts b/src/main/orca-profiles/profile-project-transfer.ts
index 75022d3ad656..ed7d51e6acfc 100644
--- a/src/main/orca-profiles/profile-project-transfer.ts
+++ b/src/main/orca-profiles/profile-project-transfer.ts
@@ -3,7 +3,15 @@ import type {
   TransferOrcaProfileProjectResult
 } from '../../shared/orca-profiles'
 import { getOrcaProfileListState } from './profile-index-store'
-import { readProfileState, writeProfileState } from './profile-project-state-file'
+import {
+  readProfileProjectTransferState,
+  writeProfileProjectDomainChanges
+} from './profile-project-domain-state'
+import {
+  prepareProfileProjectDomainChanges,
+  type ProfileProjectDomainChanges
+} from './profile-project-domain-changes'
+import { createProfileProjectDomainMoveIntent } from './profile-project-domain-move-intent'
 import { removeSourceRepo } from './profile-project-source-removal'
 import {
   applyPayloadToTarget,
@@ -11,6 +19,13 @@ import {
   createTransferPayload
 } from './profile-project-transfer-payload'
 import { repoPhysicalKey } from './profile-project-worktree-identity'
+import { migrateProfileProjectTransferParticipant } from './profile-project-transfer-migration'
+import {
+  persistProfileProjectMoveIntent,
+  recoverPendingProfileProjectMoves,
+  removeProfileProjectMoveIntent,
+  type ProfileProjectMoveIntent
+} from './profile-project-move-intent'
 
 function assertKnownProfiles(args: TransferOrcaProfileProjectArgs, userDataPath: string): void {
   const profiles = getOrcaProfileListState(userDataPath).profiles
@@ -30,14 +45,15 @@ export function transferOrcaProfileProject(
   args: TransferOrcaProfileProjectArgs,
   userDataPath: string
 ): TransferOrcaProfileProjectResult {
+  recoverPendingProfileProjectMoves(userDataPath)
   assertKnownProfiles(args, userDataPath)
-  const sourceState = readProfileState(args.sourceProfileId, userDataPath)
-  const targetState = readProfileState(args.targetProfileId, userDataPath)
-  const sourceRepo = sourceState.repos.find((repo) => repo.id === args.repoId)
+  let sourceSnapshot = readProfileProjectTransferState(args.sourceProfileId, userDataPath)
+  let targetSnapshot = readProfileProjectTransferState(args.targetProfileId, userDataPath)
+  const sourceRepo = sourceSnapshot.state.repos.find((repo) => repo.id === args.repoId)
   if (!sourceRepo) {
     throw new Error('unknown_source_repo')
   }
-  const duplicate = targetState.repos.find(
+  const duplicate = targetSnapshot.state.repos.find(
     (repo) => repoPhysicalKey(repo) === repoPhysicalKey(sourceRepo)
   )
   if (duplicate) {
@@ -50,6 +66,24 @@ export function transferOrcaProfileProject(
     }
   }
 
+  let moveIntent: ProfileProjectMoveIntent | undefined
+  if (targetSnapshot.revision === undefined) {
+    targetSnapshot = migrateProfileProjectTransferParticipant(
+      args.targetProfileId,
+      userDataPath,
+      targetSnapshot
+    )
+  }
+  if (args.mode === 'move' && sourceSnapshot.revision === undefined) {
+    sourceSnapshot = migrateProfileProjectTransferParticipant(
+      args.sourceProfileId,
+      userDataPath,
+      sourceSnapshot
+    )
+  }
+
+  const sourceState = sourceSnapshot.state
+  const targetState = targetSnapshot.state
   const targetRepo = createTargetRepo(sourceRepo, targetState, args.mode === 'copy')
   const payload = createTransferPayload({
     sourceState,
@@ -57,14 +91,44 @@ export function transferOrcaProfileProject(
     targetRepo,
     includeSessions: args.mode === 'move'
   })
-  writeProfileState(args.targetProfileId, userDataPath, applyPayloadToTarget(targetState, payload))
-  if (args.mode === 'move') {
-    writeProfileState(
-      args.sourceProfileId,
-      userDataPath,
-      removeSourceRepo(sourceState, sourceRepo.id)
+  const targetAfterState = applyPayloadToTarget(targetState, payload)
+  const sourceAfterState =
+    args.mode === 'move' ? removeSourceRepo(sourceState, sourceRepo.id) : undefined
+  if (targetSnapshot.documents === undefined || targetSnapshot.revision === undefined) {
+    throw new Error('Profile transfer requires an established SQLite target')
+  }
+  const targetChanges = prepareProfileProjectDomainChanges(
+    targetSnapshot.revision,
+    targetSnapshot.documents,
+    targetAfterState
+  )
+  let sourceChanges: ProfileProjectDomainChanges | undefined
+  if (sourceAfterState !== undefined) {
+    if (sourceSnapshot.documents === undefined || sourceSnapshot.revision === undefined) {
+      throw new Error('Profile move requires an established SQLite source')
+    }
+    sourceChanges = prepareProfileProjectDomainChanges(
+      sourceSnapshot.revision,
+      sourceSnapshot.documents,
+      sourceAfterState
     )
   }
+  if (sourceChanges !== undefined) {
+    moveIntent = createProfileProjectDomainMoveIntent({
+      sourceProfileId: args.sourceProfileId,
+      targetProfileId: args.targetProfileId,
+      source: sourceChanges,
+      target: targetChanges
+    })
+    persistProfileProjectMoveIntent(userDataPath, moveIntent)
+  }
+  writeProfileProjectDomainChanges(args.targetProfileId, userDataPath, targetChanges)
+  if (sourceChanges !== undefined) {
+    writeProfileProjectDomainChanges(args.sourceProfileId, userDataPath, sourceChanges)
+    if (moveIntent) {
+      removeProfileProjectMoveIntent(userDataPath, moveIntent.id)
+    }
+  }
   return {
     status: 'transferred',
     mode: args.mode,
diff --git a/src/main/orca-profiles/profile-storage-paths.ts b/src/main/orca-profiles/profile-storage-paths.ts
index 81dc990b0e1c..1e8de1a367e6 100644
--- a/src/main/orca-profiles/profile-storage-paths.ts
+++ b/src/main/orca-profiles/profile-storage-paths.ts
@@ -1,12 +1,17 @@
 import { getAppEnvironment } from '../../shared/app-environment'
+import {
+  getOrcaProfileDataFile as getSharedOrcaProfileDataFile,
+  getOrcaProfileStateDatabaseFile as getSharedOrcaProfileStateDatabaseFile
+} from '../../shared/profile-state-storage-paths'
+import { hasProfileStateDatabaseFiles } from '../persistence/profile-state/profile-state-storage-classification'
 import { join } from 'node:path'
 
 const LEGACY_DATA_FILE_NAME = 'orca-data.json'
 const LEGACY_BROWSER_SESSION_META_FILE_NAME = 'browser-session-meta.json'
 const PROFILE_INDEX_FILE_NAME = 'orca-profile-index.json'
-const PROFILE_DATA_FILE_NAME = 'orca-data.json'
 const PROFILE_BROWSER_SESSION_META_FILE_NAME = 'browser-session-meta.json'
 const PROFILE_DIRECTORY_NAME = 'profiles'
+const PROFILE_MOVE_INTENT_DIRECTORY_NAME = 'profile-move-intents'
 
 export const LEGACY_BACKUP_COUNT = 5
 
@@ -31,6 +36,11 @@ export function getOrcaProfilesDirectory(userDataPath = getProfileUserDataPath()
   return join(userDataPath, PROFILE_DIRECTORY_NAME)
 }
 
+/** Durable cross-profile move intents live outside either profile database. */
+export function getOrcaProfileMoveIntentDirectory(userDataPath = getProfileUserDataPath()): string {
+  return join(userDataPath, PROFILE_MOVE_INTENT_DIRECTORY_NAME)
+}
+
 export function getOrcaProfileDirectory(
   profileId: string,
   userDataPath = getProfileUserDataPath()
@@ -42,7 +52,26 @@ export function getOrcaProfileDataFile(
   profileId: string,
   userDataPath = getProfileUserDataPath()
 ): string {
-  return join(getOrcaProfileDirectory(profileId, userDataPath), PROFILE_DATA_FILE_NAME)
+  return getSharedOrcaProfileDataFile(profileId, userDataPath)
+}
+
+/**
+ * Return the future profile-state database path without changing the legacy
+ * JSON path used by the current Store and its sidecars.
+ */
+export function getOrcaProfileStateDatabaseFile(
+  profileId: string,
+  userDataPath = getProfileUserDataPath()
+): string {
+  return getSharedOrcaProfileStateDatabaseFile(profileId, userDataPath)
+}
+
+export function hasOrcaProfileStateDatabase(
+  profileId: string,
+  userDataPath = getProfileUserDataPath()
+): boolean {
+  const databaseFile = getOrcaProfileStateDatabaseFile(profileId, userDataPath)
+  return hasProfileStateDatabaseFiles(databaseFile)
 }
 
 export function getOrcaProfileBrowserSessionMetaFile(
diff --git a/src/main/orca-profiles/profile-telemetry-consent-seed.test.ts b/src/main/orca-profiles/profile-telemetry-consent-seed.test.ts
new file mode 100644
index 000000000000..aad1bd9c8126
--- /dev/null
+++ b/src/main/orca-profiles/profile-telemetry-consent-seed.test.ts
@@ -0,0 +1,118 @@
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { dirname, join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { removeTreeSync } from '../../shared/windows-transient-lock-removal'
+import {
+  acquireProfileStateMaintenance,
+  acquireProfileStateRuntimeAdmission
+} from '../persistence/profile-state/profile-state-access'
+import * as database from '../persistence/profile-state/profile-state-database'
+import { exportProfileStateJson } from '../persistence/profile-state/profile-state-documents'
+import {
+  getOrcaProfileDataFile,
+  getOrcaProfileStateDatabaseFile,
+  seedNewOrcaProfileTelemetryConsent
+} from './profile-index-store'
+
+const telemetry = {
+  optedIn: false,
+  installId: 'retained-install-id',
+  existedBeforeTelemetryRelease: true
+}
+let root: string
+const profileId = 'new-profile'
+
+beforeEach(() => {
+  root = mkdtempSync(join(tmpdir(), 'orca-profile-consent-'))
+})
+
+afterEach(() => {
+  vi.restoreAllMocks()
+  removeTreeSync(root)
+})
+
+describe('new profile consent seeding', () => {
+  it('inherits consent and install identity directly into SQLite alongside the active runtime', () => {
+    const runtime = acquireProfileStateRuntimeAdmission(root)
+    try {
+      seedNewOrcaProfileTelemetryConsent(profileId, telemetry, root)
+      const opened = database.openProfileStateDatabaseReadOnly(
+        getOrcaProfileStateDatabaseFile(profileId, root),
+        profileId
+      )
+      try {
+        expect(JSON.parse(exportProfileStateJson(opened.db))).toEqual({ settings: { telemetry } })
+      } finally {
+        opened.db.close()
+      }
+      expect(existsSync(getOrcaProfileDataFile(profileId, root))).toBe(false)
+      expect(() => runtime.assertActive()).not.toThrow()
+    } finally {
+      runtime.release()
+    }
+    const maintenance = acquireProfileStateMaintenance(root)
+    maintenance.release()
+  })
+
+  it('preserves established SQLite consent on a repeated seed', () => {
+    seedNewOrcaProfileTelemetryConsent(profileId, telemetry, root)
+    seedNewOrcaProfileTelemetryConsent(profileId, { ...telemetry, installId: 'replacement' }, root)
+    const opened = database.openProfileStateDatabaseReadOnly(
+      getOrcaProfileStateDatabaseFile(profileId, root),
+      profileId
+    )
+    try {
+      expect(JSON.parse(exportProfileStateJson(opened.db))).toEqual({ settings: { telemetry } })
+    } finally {
+      opened.db.close()
+    }
+  })
+
+  it('preserves existing JSON as input for its later import', () => {
+    const path = getOrcaProfileDataFile(profileId, root)
+    const original = '{"settings":{"telemetry":{"installId":"older"}}}'
+    mkdirSync(dirname(path), { recursive: true })
+    writeFileSync(path, original)
+
+    seedNewOrcaProfileTelemetryConsent(profileId, telemetry, root)
+
+    expect(readFileSync(path, 'utf8')).toBe(original)
+    expect(existsSync(getOrcaProfileStateDatabaseFile(profileId, root))).toBe(false)
+  })
+
+  it('refuses an incapable runtime before admission or profile creation', () => {
+    vi.spyOn(database, 'isProfileStateSqliteAvailable').mockReturnValue(false)
+    expect(() => seedNewOrcaProfileTelemetryConsent(profileId, telemetry, root)).toThrow(
+      'bundled Orca runtime'
+    )
+    expect(existsSync(join(root, '.profile-state-access'))).toBe(false)
+    expect(existsSync(join(root, 'profiles'))).toBe(false)
+  })
+
+  it('refuses seeding while maintenance owns the root', () => {
+    const maintenance = acquireProfileStateMaintenance(root)
+    try {
+      expect(() => seedNewOrcaProfileTelemetryConsent(profileId, telemetry, root)).toThrow()
+      expect(existsSync(getOrcaProfileStateDatabaseFile(profileId, root))).toBe(false)
+    } finally {
+      maintenance.release()
+    }
+  })
+
+  it.each(['orca-data.json.bak.0', 'orca-data.json.sqlite-export.1.json', 'profile-state.db-wal'])(
+    'retains missing-authority evidence in %s',
+    (name) => {
+      const directory = dirname(getOrcaProfileDataFile(profileId, root))
+      mkdirSync(directory, { recursive: true })
+      const evidence = join(directory, name)
+      writeFileSync(evidence, 'retained recovery evidence')
+
+      expect(() => seedNewOrcaProfileTelemetryConsent(profileId, telemetry, root)).toThrow()
+
+      expect(existsSync(getOrcaProfileDataFile(profileId, root))).toBe(false)
+      expect(existsSync(getOrcaProfileStateDatabaseFile(profileId, root))).toBe(false)
+      expect(readFileSync(evidence, 'utf8')).toBe('retained recovery evidence')
+    }
+  )
+})
diff --git a/src/main/orca-profiles/profile-telemetry-consent-seed.ts b/src/main/orca-profiles/profile-telemetry-consent-seed.ts
new file mode 100644
index 000000000000..c73a6de63fa2
--- /dev/null
+++ b/src/main/orca-profiles/profile-telemetry-consent-seed.ts
@@ -0,0 +1,42 @@
+import { existsSync } from 'node:fs'
+import type { GlobalSettings } from '../../shared/global-settings-types'
+import { acquireProfileStateRuntimeAdmission } from '../persistence/profile-state/profile-state-access'
+import { isProfileStateSqliteAvailable } from '../persistence/profile-state/profile-state-database'
+import { migrateProfileStateToSqlite } from '../persistence/profile-state/profile-state-migration'
+import {
+  getOrcaProfileDataFile,
+  getOrcaProfileStateDatabaseFile,
+  getProfileUserDataPath
+} from './profile-storage-paths'
+
+// Keep the active install's consent and anonymous identity when creating another profile.
+export function seedNewOrcaProfileTelemetryConsent(
+  profileId: string,
+  telemetry: GlobalSettings['telemetry'],
+  userDataPath = getProfileUserDataPath()
+): void {
+  if (!telemetry) {
+    return
+  }
+  if (!isProfileStateSqliteAvailable()) {
+    throw new Error('Creating profile state requires the bundled Orca runtime.')
+  }
+  const admission = acquireProfileStateRuntimeAdmission(userDataPath)
+  try {
+    const dataFile = getOrcaProfileDataFile(profileId, userDataPath)
+    const databaseFile = getOrcaProfileStateDatabaseFile(profileId, userDataPath)
+    if (existsSync(dataFile) || existsSync(databaseFile)) {
+      return
+    }
+    const migrated = migrateProfileStateToSqlite({
+      dataFile,
+      databaseFile,
+      profileId,
+      expectedLegacyJson: undefined,
+      serializedState: JSON.stringify({ settings: { telemetry } })
+    })
+    migrated.authority.close()
+  } finally {
+    admission.release()
+  }
+}
diff --git a/src/main/orcad/main-preflight-order.test.ts b/src/main/orcad/main-preflight-order.test.ts
index bd130bfb33fe..e746be8cc5e6 100644
--- a/src/main/orcad/main-preflight-order.test.ts
+++ b/src/main/orcad/main-preflight-order.test.ts
@@ -1,11 +1,35 @@
-import { describe, expect, it, vi } from 'vitest'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import {
+  ORCAD_PROFILE_PREFLIGHT_FLAG,
+  ORCAD_STARTUP_PREFLIGHT_FLAG
+} from '../../shared/orcad-profile-preflight'
 
 /**
  * The precondition is only worth anything if it runs first. A loader failure is not
  * catchable, so a preflight that lands after `main()` has already reached
  * `await import('../ipc/pty')` prevents nothing.
  */
-const order: string[] = []
+const { order, profileProbe } = vi.hoisted(() => {
+  const order: string[] = []
+  return { order, profileProbe: vi.fn(async () => {}) }
+})
+
+vi.mock('./orcad-bundled-runtime', () => ({ handoffToBundledOrcad: () => false }))
+vi.mock('./orcad-profile-preflight', () => ({
+  preflightBundledOrcadStartup: async () => {
+    order.push('profile-admission')
+  },
+  runOrcadProfilePreflight: profileProbe
+}))
+
+beforeEach(() => {
+  vi.resetModules()
+  order.length = 0
+})
+afterEach(() => {
+  vi.restoreAllMocks()
+  vi.clearAllMocks()
+})
 
 vi.mock('./orcad-native-preflight', () => ({
   runOrcadNativePreflight: () => {
@@ -21,10 +45,23 @@ vi.mock('./orcad-entry', () => ({
 }))
 
 describe('orcad entry', () => {
+  it.each([
+    { flag: ORCAD_PROFILE_PREFLIGHT_FLAG, nativeFeatures: true },
+    { flag: ORCAD_STARTUP_PREFLIGHT_FLAG, nativeFeatures: false }
+  ])(
+    'runs the selected disposable probe without starting a server: $flag',
+    async ({ flag, nativeFeatures }) => {
+      vi.spyOn(process, 'argv', 'get').mockReturnValue(['runtime', 'orcad.js', flag, 'nonce'])
+      await import('./main')
+      expect(profileProbe).toHaveBeenCalledExactlyOnceWith('nonce', { nativeFeatures })
+      expect(order).toEqual([])
+    }
+  )
+
   it('runs the native preflight before starting the runtime', async () => {
     await import('./main')
     await vi.waitFor(() => expect(order).toContain('main'))
 
-    expect(order).toEqual(['preflight', 'main'])
+    expect(order).toEqual(['profile-admission', 'preflight', 'main'])
   })
 })
diff --git a/src/main/orcad/main.ts b/src/main/orcad/main.ts
index 73a973c7b242..79fc667fd22a 100644
--- a/src/main/orcad/main.ts
+++ b/src/main/orcad/main.ts
@@ -2,6 +2,12 @@
 import process from 'node:process'
 import { main, resolveOrcadExitCode } from './orcad-entry'
 import { runOrcadNativePreflight } from './orcad-native-preflight'
+import {
+  ORCAD_PROFILE_PREFLIGHT_FLAG,
+  ORCAD_STARTUP_PREFLIGHT_FLAG
+} from '../../shared/orcad-profile-preflight'
+import { preflightBundledOrcadStartup, runOrcadProfilePreflight } from './orcad-profile-preflight'
+import { handoffToBundledOrcad } from './orcad-bundled-runtime'
 
 // Why exit before the preflight: reaching this line means the whole module graph resolved
 // under plain Node, which is all the build guard needs to prove. Probing natives or
@@ -16,12 +22,33 @@ if (process.argv.includes('--orcad-smoke-load-check')) {
 // evaluated before this statement, so the guarantee is that no module in the graph
 // requires node-pty at import time — which the bundle's lazy `require("node-pty")` in
 // local-pty-provider satisfies. See ./node-pty-precondition.ts for why a child process.
-runOrcadNativePreflight()
-
-main().catch((error: unknown) => {
+function failStartup(error: unknown): void {
   console.error('orcad: failed to start:', error)
   // Why a resolved code and not a bare 1: a data-root or bind-address refusal is a
   // configuration fault that restarting cannot fix, and a supervisor needs to tell the two
   // apart to avoid restart-spinning on it.
   process.exit(resolveOrcadExitCode(error))
-})
+}
+
+try {
+  if (!handoffToBundledOrcad()) {
+    const flag = process.argv[2]
+    if (
+      (flag === ORCAD_PROFILE_PREFLIGHT_FLAG || flag === ORCAD_STARTUP_PREFLIGHT_FLAG) &&
+      process.argv.length === 4
+    ) {
+      void runOrcadProfilePreflight(process.argv[3], {
+        nativeFeatures: flag === ORCAD_PROFILE_PREFLIGHT_FLAG
+      }).catch(failStartup)
+    } else {
+      void preflightBundledOrcadStartup()
+        .then(() => {
+          runOrcadNativePreflight()
+          return main()
+        })
+        .catch(failStartup)
+    }
+  }
+} catch (error) {
+  failStartup(error)
+}
diff --git a/src/main/orcad/orcad-artifact-identity.ts b/src/main/orcad/orcad-artifact-identity.ts
new file mode 100644
index 000000000000..0049ef10ffaa
--- /dev/null
+++ b/src/main/orcad/orcad-artifact-identity.ts
@@ -0,0 +1,41 @@
+import { createHash } from 'node:crypto'
+import { createReadStream, existsSync } from 'node:fs'
+import { readFile } from 'node:fs/promises'
+import { join } from 'node:path'
+import { z } from 'zod'
+import {
+  ORCAD_BUILD_TARGET_FILENAME,
+  ORCAD_VERSION,
+  orcadArtifactFilenames,
+  orcadArtifactHashPrefix
+} from '../../shared/orcad-artifacts'
+import { ORCAD_BUN_TARGETS } from '../../shared/orcad-bun-runtime'
+import { orcadAgentBrowserNativeName } from '../../shared/orcad-agent-browser-name'
+
+/** Hash installed bytes in the build's order; a version marker is not proof of delivery. */
+export async function readOrcadArtifactIdentity(directory: string): Promise<string> {
+  const target = z
+    .enum(ORCAD_BUN_TARGETS)
+    .parse((await readFile(join(directory, ORCAD_BUILD_TARGET_FILENAME), 'utf8')).trim())
+  const platform = target.startsWith('win32-')
+    ? 'win32'
+    : target.startsWith('darwin-')
+      ? 'darwin'
+      : 'linux'
+  const browser = orcadAgentBrowserNativeName(
+    platform,
+    target.split('-')[1] ?? '',
+    target.endsWith('-musl') ? 'musl' : 'glibc'
+  )
+  const filenames = orcadArtifactFilenames(target)
+  if (existsSync(join(directory, browser))) {
+    filenames.push(browser)
+  }
+  const hash = createHash('sha256').update(orcadArtifactHashPrefix(target))
+  for (const filename of filenames) {
+    for await (const chunk of createReadStream(join(directory, filename))) {
+      hash.update(chunk)
+    }
+  }
+  return `${ORCAD_VERSION}+${hash.digest('hex').slice(0, 12)}`
+}
diff --git a/src/main/orcad/orcad-artifact-preflight.test.ts b/src/main/orcad/orcad-artifact-preflight.test.ts
new file mode 100644
index 000000000000..f48a1436a929
--- /dev/null
+++ b/src/main/orcad/orcad-artifact-preflight.test.ts
@@ -0,0 +1,66 @@
+import { randomUUID } from 'node:crypto'
+import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { dirname, join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { orcadArtifactFilenames } from '../../shared/orcad-artifacts'
+import { runOrcadProfilePreflight } from './orcad-profile-preflight'
+import { readOrcadArtifactIdentity } from './orcad-artifact-identity'
+import { resolveOrcadExitCode } from './orcad-exit-code'
+
+const fixture = vi.hoisted(() => ({
+  directory: '',
+  sqlite: vi.fn(async () => ({ sqliteVersion: '3.53.2', revision: 1 }))
+}))
+vi.mock('./orcad-app-paths', () => ({ resolveOrcadInstallRoot: () => fixture.directory }))
+vi.mock('../persistence/profile-state/profile-state-runtime-preflight', () => ({
+  preflightProfileStateRuntime: fixture.sqlite
+}))
+vi.mock('./orcad-bun-native-preflight', () => ({
+  preflightOrcadBunNativeRuntime: vi.fn(async () => {})
+}))
+
+beforeEach(async () => {
+  fixture.directory = await mkdtemp(join(tmpdir(), 'orcad-artifact-preflight-'))
+  for (const filename of orcadArtifactFilenames('linux-x64-glibc')) {
+    const path = join(fixture.directory, filename)
+    await mkdir(dirname(path), { recursive: true })
+    await writeFile(path, filename === '.build-target' ? 'linux-x64-glibc\n' : filename)
+  }
+  vi.spyOn(console, 'log').mockImplementation(() => {})
+})
+afterEach(async () => {
+  vi.restoreAllMocks()
+  vi.clearAllMocks()
+  await rm(fixture.directory, { recursive: true, force: true })
+})
+
+describe('installed artifact admission', () => {
+  it('qualifies build output before its version marker is published', async () => {
+    await runOrcadProfilePreflight(randomUUID())
+    expect(fixture.sqlite).toHaveBeenCalledOnce()
+    expect(console.log).toHaveBeenCalledWith(
+      expect.stringContaining(await readOrcadArtifactIdentity(fixture.directory))
+    )
+  })
+
+  it.each(['.build-target', 'node_modules/@parcel/watcher/watcher.node', 'bun-runtime'])(
+    'refuses a missing %s as configuration before any profile probe',
+    async (filename) => {
+      await rm(join(fixture.directory, filename))
+      const error = await runOrcadProfilePreflight(randomUUID()).catch(
+        (failure: unknown) => failure
+      )
+      expect(resolveOrcadExitCode(error)).toBe(78)
+      expect(fixture.sqlite).not.toHaveBeenCalled()
+      expect(console.log).not.toHaveBeenCalled()
+    }
+  )
+
+  it('refuses a malformed target even though all named files exist', async () => {
+    await writeFile(join(fixture.directory, '.build-target'), 'not-a-runtime-target')
+    const error = await runOrcadProfilePreflight(randomUUID()).catch((failure: unknown) => failure)
+    expect(resolveOrcadExitCode(error)).toBe(78)
+    expect(fixture.sqlite).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/main/orcad/orcad-bun-launcher.integration.test.ts b/src/main/orcad/orcad-bun-launcher.integration.test.ts
new file mode 100644
index 000000000000..8ee18d53293f
--- /dev/null
+++ b/src/main/orcad/orcad-bun-launcher.integration.test.ts
@@ -0,0 +1,298 @@
+import { build } from 'esbuild'
+import { existsSync, readFileSync } from 'node:fs'
+import { copyFile, mkdtemp, readFile, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join, resolve } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { spawnProcess } from '../../shared/child-process/run-process'
+import { orcadBunRuntimeFilename } from '../../shared/orcad-artifacts'
+import { ORCAD_BUN_VERSION } from '../../shared/orcad-bun-runtime'
+import { removeTreeSync } from '../../shared/windows-transient-lock-removal'
+
+const runtimePath =
+  process.env.BUN_EXECUTABLE ?? resolve('out/orcad', orcadBunRuntimeFilename(process.platform))
+const nodePath =
+  process.env.ORCA_TEST_NODE_EXECUTABLE ?? (process.versions.bun ? 'node' : process.execPath)
+let directory = ''
+const children = new Set<ReturnType<typeof spawnProcess>>()
+const runtimes = new Set<number>()
+
+describe.skipIf(!existsSync(runtimePath))('real Bun launcher lifecycle', () => {
+  beforeEach(async () => {
+    directory = await mkdtemp(join(tmpdir(), 'orca-bun-launcher-'))
+    await copyFile(runtimePath, join(directory, orcadBunRuntimeFilename(process.platform)))
+    await writeFile(join(directory, '.build-target'), `${process.platform}-${process.arch}\n`)
+    await build({
+      // Record entry before imports without relying on either process's stdout.
+      banner: {
+        js: `
+          function traceLauncherPhase(phase) {
+            const runtime = process.versions.bun ? 'bun' : 'node'
+            try {
+              require('node:fs').appendFileSync(process.env.ORCA_TEST_PHASES + '.' + runtime,
+                JSON.stringify({ at: Date.now(), phase, pid: process.pid, runtime, arch: process.arch }) + '\\n')
+            } catch (error) {
+              console.error('launcher fixture trace failed:', error)
+            }
+          }
+          traceLauncherPhase('entry')
+          process.once('exit', code => traceLauncherPhase('exit:' + code))
+        `
+      },
+      stdin: {
+        contents: `
+          import {handoffToBundledOrcad, OrcadBundledRuntimeError} from './src/main/orcad/orcad-bundled-runtime'
+          import {installOrcadShutdownSignals} from './src/main/orcad/orcad-lifecycle'
+          import {resolveOrcadExitCode} from './src/main/orcad/orcad-exit-code'
+          import {writeFile} from 'node:fs/promises'
+          if (!process.versions.bun) {
+            traceLauncherPhase('before-handoff')
+            if (!handoffToBundledOrcad()) throw new Error('Missing bundled runtime')
+            traceLauncherPhase('after-handoff')
+            process.on('message', signal => process.emit(signal))
+          } else {
+            traceLauncherPhase('before-booting')
+            console.log('booting:' + process.pid)
+            console.log('runtime:' + process.versions.bun)
+            console.log('channel-env:' + (process.env.ORCA_BUNDLED_LAUNCHER_CHANNEL ?? 'absent'))
+            traceLauncherPhase('booting-written')
+            process.on('exit', code => console.log('runtime-exit:' + code))
+            const keepalive = setInterval(() => {}, 1_000)
+            const install = async () => {
+              if (process.env.ORCA_TEST_FAIL_STARTUP === '1') {
+                const startup = new Promise((_, reject) => setTimeout(() =>
+                  reject(new OrcadBundledRuntimeError('startup configuration failed')), 100))
+                installOrcadShutdownSignals(async () => (await startup).stop())
+                await startup
+                return
+              }
+              installOrcadShutdownSignals(async () => {
+                console.log('flushing')
+                clearInterval(keepalive)
+                if (process.env.ORCA_TEST_STALL === '1') await new Promise(() => {})
+                await new Promise(resolve => setTimeout(resolve, 150))
+                await writeFile(process.env.ORCA_TEST_DONE, 'flushed')
+              }, process.env.ORCA_TEST_STALL === '1' ? 100 : undefined)
+              console.log('ready')
+            }
+            // Exercise the shutdown observer before the outer startup-failure reporter.
+            const start = () => Promise.resolve().then(install)
+              .catch(error => setImmediate(() => process.exit(resolveOrcadExitCode(error))))
+            if (process.env.ORCA_TEST_DELAY_INSTALL === '1') setTimeout(start, 300)
+            else start()
+          }
+        `,
+        resolveDir: process.cwd(),
+        loader: 'ts'
+      },
+      outfile: join(directory, 'orcad.js'),
+      bundle: true,
+      platform: 'node',
+      target: 'node18',
+      format: 'cjs'
+    })
+  })
+
+  afterEach(() => {
+    for (const child of children) {
+      child.kill('SIGKILL')
+    }
+    children.clear()
+    for (const pid of runtimes) {
+      try {
+        process.kill(pid, 'SIGKILL')
+      } catch {}
+    }
+    runtimes.clear()
+    removeTreeSync(directory)
+  })
+
+  function launch(
+    options: {
+      direct?: boolean
+      nohup?: boolean
+      delay?: boolean
+      stall?: boolean
+      failStartup?: boolean
+    } = {}
+  ) {
+    const runtime = options.direct
+      ? join(directory, orcadBunRuntimeFilename(process.platform))
+      : nodePath
+    const startedAt = Date.now()
+    const events: { at: number; event: string }[] = []
+    const record = (event: string): void => {
+      if (events.length < 16) {
+        events.push({ at: Date.now(), event })
+      }
+    }
+    const child = spawnProcess({
+      program: options.nohup ? 'nohup' : runtime,
+      args: [...(options.nohup ? [runtime] : []), join(directory, 'orcad.js')],
+      env: {
+        ...process.env,
+        ORCA_BACKGROUND_LAUNCH: '1',
+        ORCA_TEST_DONE: join(directory, 'done'),
+        ORCA_TEST_PHASES: join(directory, 'phases'),
+        ORCA_TEST_DELAY_INSTALL: options.delay ? '1' : '0',
+        ORCA_TEST_STALL: options.stall ? '1' : '0',
+        ORCA_TEST_FAIL_STARTUP: options.failStartup ? '1' : '0'
+      },
+      detached: process.platform !== 'win32',
+      stdio: ['ignore', 'pipe', 'pipe', 'ipc']
+    })
+    children.add(child)
+    child.once('spawn', () => record('spawn'))
+    let closed = false
+    child.once('close', () => {
+      record('close')
+      closed = true
+    })
+    let output = ''
+    const capture = (chunk: Buffer): void => {
+      output += chunk.toString()
+      const pid = /booting:(\d+)/.exec(output)?.[1]
+      if (pid && !output.includes('runtime-exit:')) {
+        runtimes.add(Number(pid))
+      } else if (pid) {
+        runtimes.delete(Number(pid))
+      }
+    }
+    const streams = [
+      ['stdout', child.stdout],
+      ['stderr', child.stderr]
+    ] as const
+    for (const [name, stream] of streams) {
+      stream.on('data', capture)
+      stream.once('data', () => record(`${name}:data`))
+      stream.once('end', () => record(`${name}:end`))
+      stream.once('close', () => record(`${name}:close`))
+    }
+    const exit = new Promise<{ code: number | null; signal: NodeJS.Signals | null }>(
+      (resolve, reject) => {
+        child.once('error', (error) => {
+          record(`error:${error.message}`)
+          reject(error)
+        })
+        child.once('exit', (code, signal) => {
+          record(`exit:${code}:${signal}`)
+          children.delete(child)
+          resolve({ code, signal })
+        })
+      }
+    )
+    const diagnostics = () => ({
+      startedAt,
+      elapsedMs: Date.now() - startedAt,
+      events,
+      pid: child.pid,
+      exitCode: child.exitCode,
+      signalCode: child.signalCode,
+      connected: child.connected,
+      closed,
+      streams: streams.map(([name, stream]) => ({
+        name,
+        ended: stream.readableEnded,
+        destroyed: stream.destroyed,
+        error: stream.errored?.message,
+        bufferedBytes: stream.readableLength
+      })),
+      phases: ['node', 'bun'].map((runtime) => {
+        try {
+          return {
+            runtime,
+            trace: readFileSync(join(directory, `phases.${runtime}`), 'utf8').slice(0, 4096)
+          }
+        } catch (error) {
+          return { runtime, error: String(error) }
+        }
+      })
+    })
+    return { child, output: () => output, exit, isClosed: () => closed, diagnostics }
+  }
+
+  it.each([false, true])(
+    'drains Bun after its launcher is killed (startup pending: %s)',
+    async (delay) => {
+      const h = launch({ delay })
+      await vi.waitFor(
+        () => {
+          expect(h.output()).toContain(delay ? 'booting:' : 'ready')
+          expect(h.output()).toContain(`runtime:${ORCAD_BUN_VERSION}`)
+          expect(h.output()).toContain('channel-env:absent')
+        },
+        { timeout: 5_000 }
+      )
+      h.child.kill('SIGKILL')
+      await h.exit
+      await vi.waitFor(
+        async () => expect(await readFile(join(directory, 'done'), 'utf8')).toBe('flushed'),
+        { timeout: 5_000 }
+      )
+      expect(h.output().match(/flushing/g)).toHaveLength(1)
+      await vi.waitFor(() => expect(h.output()).toContain('runtime-exit:0'))
+      await vi.waitFor(() => expect(h.isClosed()).toBe(true), { timeout: 5_000 })
+    }
+  )
+
+  it.skipIf(process.platform === 'win32').each([false, true])(
+    'survives nohup hangups and drains on TERM (direct Bun: %s)',
+    async (direct) => {
+      const h = launch({ direct, nohup: true })
+      await vi.waitFor(() => expect(h.output()).toContain('ready'), { timeout: 5_000 })
+      if (!h.child.pid) {
+        throw new Error('Missing launcher pid')
+      }
+      process.kill(-h.child.pid, 'SIGHUP')
+      await new Promise((resolve) => setTimeout(resolve, 100))
+      expect(h.child.exitCode).toBeNull()
+      expect(h.child.signalCode).toBeNull()
+      expect(h.output()).not.toContain('flushing')
+      h.child.kill('SIGTERM')
+      expect(await h.exit).toEqual({ code: 0, signal: null })
+      expect(await readFile(join(directory, 'done'), 'utf8')).toBe('flushed')
+      await vi.waitFor(() => expect(h.isClosed()).toBe(true), { timeout: 5_000 })
+    }
+  )
+
+  it('keeps an unfinished shutdown alive until its failure deadline', async () => {
+    const h = launch({ stall: true })
+    await vi.waitFor(() => expect(h.output()).toContain('ready'), { timeout: 5_000 })
+    h.child.kill('SIGKILL')
+    await h.exit
+    await vi.waitFor(() => expect(h.output()).toContain('runtime-exit:1'))
+    expect(h.output()).toContain('exceeded 100ms')
+    await vi.waitFor(() => expect(h.isClosed()).toBe(true), { timeout: 5_000 })
+  })
+
+  it.each(process.platform === 'win32' ? [false, true] : [false])(
+    'forwards launcher stop requests and drains once (startup pending: %s)',
+    async (delay) => {
+      const h = launch({ delay })
+      await vi.waitFor(() => expect(h.output()).toContain(delay ? 'booting:' : 'ready'), {
+        timeout: 5_000
+      })
+      h.child.send('SIGINT')
+      h.child.send('SIGTERM')
+      expect(await h.exit).toEqual({ code: 0, signal: null })
+      expect(await readFile(join(directory, 'done'), 'utf8')).toBe('flushed')
+      expect(h.output().match(/flushing/g)).toHaveLength(1)
+      await vi.waitFor(() => expect(h.isClosed()).toBe(true), { timeout: 5_000 })
+    }
+  )
+
+  it('preserves a startup configuration verdict after early launcher loss', async () => {
+    const h = launch({ delay: true, failStartup: true })
+    try {
+      await vi.waitFor(() => expect(h.output()).toContain('booting:'), { timeout: 5_000 })
+    } catch (error) {
+      console.error('Bun launcher startup diagnostics:', JSON.stringify(h.diagnostics()))
+      throw error
+    }
+    h.child.kill('SIGKILL')
+    await h.exit
+    await vi.waitFor(() => expect(h.output()).toContain('runtime-exit:78'), { timeout: 5_000 })
+    expect(h.output()).toContain('shutdown after launcher disconnect failed')
+    await vi.waitFor(() => expect(h.isClosed()).toBe(true), { timeout: 5_000 })
+  })
+})
diff --git a/src/main/orcad/orcad-bun-native-preflight.test.ts b/src/main/orcad/orcad-bun-native-preflight.test.ts
new file mode 100644
index 000000000000..3e6df8402c1f
--- /dev/null
+++ b/src/main/orcad/orcad-bun-native-preflight.test.ts
@@ -0,0 +1,165 @@
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type {
+  WatcherProcessCallback,
+  WatcherProcessHooks
+} from '../ipc/parcel-watcher-process-subscription'
+import { preflightOrcadBunNativeRuntime } from './orcad-bun-native-preflight'
+
+const fixture = vi.hoisted(() => ({
+  temp: vi.fn(),
+  pty: vi.fn(),
+  available: vi.fn(),
+  startTime: vi.fn(),
+  rows: vi.fn(),
+  subscribe: vi.fn(),
+  unsubscribe: vi.fn(),
+  dispose: vi.fn(),
+  write: vi.fn(),
+  remove: vi.fn()
+}))
+vi.mock('../daemon/pty-subprocess/spawn-preflight', () => ({ runPtySpawnHealthProbe: fixture.pty }))
+vi.mock('../windows/windows-process-table', () => ({
+  isWindowsProcessTableAvailable: fixture.available,
+  isWindowsProcessStartTimeAvailable: fixture.startTime,
+  readWindowsProcessIdentityTableFresh: fixture.rows
+}))
+vi.mock('node:fs/promises', () => ({
+  mkdtemp: fixture.temp,
+  writeFile: fixture.write,
+  rm: fixture.remove
+}))
+vi.mock('../ipc/parcel-watcher-process-supervisor', () => ({
+  WatcherProcessSupervisor: class {
+    subscribe = fixture.subscribe
+    dispose = fixture.dispose
+  }
+}))
+
+beforeEach(() => {
+  vi.useFakeTimers()
+  fixture.temp.mockResolvedValue('/temp/probe')
+  fixture.pty.mockResolvedValue(undefined)
+  fixture.available.mockReturnValue(true)
+  fixture.startTime.mockReturnValue(true)
+  fixture.rows.mockResolvedValue([{ pid: process.pid, creationTimeMs: Date.now() - 1_000 }])
+  fixture.unsubscribe.mockResolvedValue(undefined)
+  fixture.remove.mockResolvedValue(undefined)
+  fixture.subscribe.mockImplementation(
+    async (directory: string, callback: WatcherProcessCallback) => {
+      fixture.write.mockImplementation(async () =>
+        callback(null, [{ path: join(directory, 'ready'), type: 'create' }])
+      )
+      return { unsubscribe: fixture.unsubscribe }
+    }
+  )
+})
+afterEach(() => {
+  vi.useRealTimers()
+  vi.restoreAllMocks()
+  vi.resetAllMocks()
+})
+
+describe('bundled native readiness', () => {
+  it('keeps runtime startup independent of PTY or watcher probe availability', async () => {
+    fixture.pty.mockRejectedValue(new Error('PTY spawn health check timed out'))
+    fixture.subscribe.mockRejectedValue(new Error('ENOSPC: watch limit reached'))
+    await preflightOrcadBunNativeRuntime({ nativeFeatures: false })
+    expect(fixture.pty).not.toHaveBeenCalled()
+    expect(fixture.subscribe).not.toHaveBeenCalled()
+  })
+
+  it('still requires Windows ownership support on normal startup', async () => {
+    vi.spyOn(process, 'platform', 'get').mockReturnValue('win32')
+    fixture.startTime.mockReturnValue(false)
+    await expect(preflightOrcadBunNativeRuntime({ nativeFeatures: false })).rejects.toThrow(
+      'Windows process table'
+    )
+  })
+
+  it('does not admit a failed PTY in explicit qualification', async () => {
+    fixture.pty.mockRejectedValue(new Error('PTY spawn health check timed out'))
+    await expect(preflightOrcadBunNativeRuntime()).rejects.toThrow(
+      'PTY spawn health check timed out'
+    )
+  })
+
+  it('awaits actual watcher delivery and unsubscribe before disposing temporary state', async () => {
+    await preflightOrcadBunNativeRuntime()
+    expect(fixture.pty).toHaveBeenCalledOnce()
+    expect(fixture.unsubscribe).toHaveBeenCalledOnce()
+    expect(fixture.dispose).toHaveBeenCalledOnce()
+    expect(fixture.remove).toHaveBeenCalledWith('/temp/probe', { recursive: true, force: true })
+    expect(vi.getTimerCount()).toBe(0)
+  })
+
+  it('cancels a subscribe blocked on capacity by the same readiness deadline', async () => {
+    fixture.subscribe.mockImplementation(
+      (
+        _directory: string,
+        _callback: WatcherProcessCallback,
+        _options: unknown,
+        hooks: WatcherProcessHooks
+      ) =>
+        new Promise((_resolve, reject) => {
+          hooks.signal?.addEventListener('abort', () => reject(hooks.signal?.reason), {
+            once: true
+          })
+        })
+    )
+    const readiness = preflightOrcadBunNativeRuntime()
+    const rejected = expect(readiness).rejects.toThrow('readiness timed out')
+    await vi.advanceTimersByTimeAsync(5_000)
+    await rejected
+    expect(fixture.dispose).toHaveBeenCalledOnce()
+    expect(fixture.remove).toHaveBeenCalledOnce()
+    expect(vi.getTimerCount()).toBe(0)
+  })
+
+  it('cleans up when native delivery fails before subscribe resolves', async () => {
+    fixture.subscribe.mockImplementation(
+      async (_directory: string, callback: WatcherProcessCallback) => {
+        callback(new Error('native watcher failed'), [])
+        return { unsubscribe: fixture.unsubscribe }
+      }
+    )
+    await expect(preflightOrcadBunNativeRuntime()).rejects.toThrow('native watcher failed')
+    expect(fixture.unsubscribe).toHaveBeenCalledOnce()
+    expect(fixture.dispose).toHaveBeenCalledOnce()
+  })
+
+  it('still disposes temporary state when unsubscribe fails', async () => {
+    fixture.unsubscribe.mockRejectedValue(new Error('watcher did not exit'))
+    await expect(preflightOrcadBunNativeRuntime()).rejects.toThrow('watcher did not exit')
+    expect(fixture.dispose).toHaveBeenCalledOnce()
+    expect(fixture.remove).toHaveBeenCalledOnce()
+  })
+
+  it.each(['missing-addon', 'missing-creation-time', 'invalid-self-row'])(
+    'refuses %s on Windows before spawning a PTY or allowing CIM fallback',
+    async (reason) => {
+      vi.spyOn(process, 'platform', 'get').mockReturnValue('win32')
+      if (reason === 'missing-addon') {
+        fixture.available.mockReturnValue(false)
+      }
+      if (reason === 'missing-creation-time') {
+        fixture.startTime.mockReturnValue(false)
+      }
+      if (reason === 'invalid-self-row') {
+        fixture.rows.mockResolvedValue([{ pid: process.pid }])
+      }
+      await expect(preflightOrcadBunNativeRuntime()).rejects.toThrow('Windows process table')
+      expect(fixture.pty).not.toHaveBeenCalled()
+      if (reason !== 'invalid-self-row') {
+        expect(fixture.rows).not.toHaveBeenCalled()
+      }
+    }
+  )
+
+  it('reads a fresh self identity on Windows before qualifying the PTY', async () => {
+    vi.spyOn(process, 'platform', 'get').mockReturnValue('win32')
+    await preflightOrcadBunNativeRuntime()
+    expect(fixture.rows).toHaveBeenCalledOnce()
+    expect(fixture.pty).toHaveBeenCalledOnce()
+  })
+})
diff --git a/src/main/orcad/orcad-bun-native-preflight.ts b/src/main/orcad/orcad-bun-native-preflight.ts
new file mode 100644
index 000000000000..163f6ce29877
--- /dev/null
+++ b/src/main/orcad/orcad-bun-native-preflight.ts
@@ -0,0 +1,83 @@
+import { mkdtemp, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { runPtySpawnHealthProbe } from '../daemon/pty-subprocess/spawn-preflight'
+import { WatcherProcessSupervisor } from '../ipc/parcel-watcher-process-supervisor'
+import { resolveWatcherProcessEntryPath } from '../ipc/parcel-watcher-entry-path'
+import { resolveOrcadInstallRoot } from './orcad-app-paths'
+import {
+  isWindowsProcessTableAvailable,
+  isWindowsProcessStartTimeAvailable,
+  readWindowsProcessIdentityTableFresh
+} from '../windows/windows-process-table'
+
+/** The candidate process owns disposable PTY and watcher probes before it touches user state. */
+export async function preflightOrcadBunNativeRuntime(
+  options: { nativeFeatures?: boolean } = {}
+): Promise<void> {
+  if (process.platform === 'win32') {
+    await preflightWindowsProcessIdentity()
+  }
+  // Runtime health checks can degrade independently; artifact qualification remains strict.
+  if (options.nativeFeatures === false) {
+    return
+  }
+  await runPtySpawnHealthProbe()
+  const directory = await mkdtemp(join(tmpdir(), 'orca-native-ready-'))
+  const supervisor = new WatcherProcessSupervisor({
+    entryPath: resolveWatcherProcessEntryPath(resolveOrcadInstallRoot(), false),
+    useInProcessVitestFallback: false
+  })
+  const cancellation = new AbortController()
+  let subscription: { unsubscribe(): Promise<void> } | undefined
+  let timer: ReturnType<typeof setTimeout> | undefined
+  try {
+    let resolveDelivery: () => void = () => {}
+    let rejectDelivery: (error: unknown) => void = () => {}
+    const delivered = new Promise<void>((resolve, reject) => {
+      resolveDelivery = resolve
+      rejectDelivery = reject
+    })
+    // A native callback can fail while subscribe is pending.
+    void delivered.catch(() => {})
+    timer = setTimeout(() => {
+      const error = new Error('Bun file watcher readiness timed out')
+      cancellation.abort(error)
+      rejectDelivery(error)
+    }, 5_000)
+    subscription = await supervisor.subscribe(
+      directory,
+      (error, events) => {
+        if (error) {
+          rejectDelivery(error)
+        } else if (events.some((event) => event.path === join(directory, 'ready'))) {
+          resolveDelivery()
+        }
+      },
+      process.platform === 'win32' ? { backend: 'windows' } : {},
+      { signal: cancellation.signal, subscribeTimeoutMs: 5_000, onTerminalError: rejectDelivery }
+    )
+    await writeFile(join(directory, 'ready'), '')
+    await delivered
+  } finally {
+    clearTimeout(timer)
+    try {
+      await subscription?.unsubscribe()
+    } finally {
+      supervisor.dispose()
+      await rm(directory, { recursive: true, force: true })
+    }
+  }
+}
+
+async function preflightWindowsProcessIdentity(): Promise<void> {
+  if (!isWindowsProcessTableAvailable() || !isWindowsProcessStartTimeAvailable()) {
+    throw new Error('The bundled Windows process table must support process creation times')
+  }
+  const rows = await readWindowsProcessIdentityTableFresh()
+  const self = rows.find((row) => row.pid === process.pid)
+  const created = self?.creationTimeMs
+  if (created === undefined || !Number.isFinite(created) || created <= 0 || created > Date.now()) {
+    throw new Error('The bundled Windows process table could not identify this process')
+  }
+}
diff --git a/src/main/orcad/orcad-bundle-native-load-order.test.ts b/src/main/orcad/orcad-bundle-native-load-order.test.ts
index 1c26501b6a68..5ed9085fa369 100644
--- a/src/main/orcad/orcad-bundle-native-load-order.test.ts
+++ b/src/main/orcad/orcad-bundle-native-load-order.test.ts
@@ -1,91 +1,70 @@
 import { existsSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
-import { afterEach, describe, expect, it } from 'vitest'
+import { pathToFileURL } from 'node:url'
+import { afterEach, expect, it } from 'vitest'
 import { runProcessSync } from '../../shared/child-process/run-process'
 
-/**
- * The preflight only prevents a loader crash if nothing in the bundle's import graph has
- * already required node-pty by the time it runs. esbuild wraps `local-pty-provider` in a
- * lazy initializer because `orcad-entry` reaches it through `await import('../ipc/pty')`,
- * and that laziness is load-bearing rather than incidental — a single top-level static
- * import anywhere in the graph would hoist `require("node-pty")` above every statement in
- * `main.ts`, including the preflight.
- *
- * Why this builds the bundle instead of skipping without one: no CI job builds orcad and
- * runs vitest. `smoke:orcad-terminal` builds it in the static-analysis job, which never
- * runs vitest; the `orcad_browser` job runs vitest but deliberately does not build orcad.
- * A `runIf(existsSync(...))` guard therefore skips in every shard, forever — the same way
- * an unset ORCA_BROWSER_EXECUTABLE kept the browser provider uncovered.
- *
- * Why not fail-when-CI instead: the wiring that would satisfy it lives in `.github/`, so
- * that turns a silent gap into a red build someone else has to fix. Building costs well
- * under a second (esbuild), works in every shard and on every machine, and needs no job
- * to cooperate. What it must never do is skip.
- */
 const REPO_ROOT = join(__dirname, '..', '..', '..')
-const BUNDLE = join(REPO_ROOT, 'out', 'orcad', 'orcad.js')
-const BUILD_SCRIPT = join(REPO_ROOT, 'config', 'scripts', 'build-orcad.mjs')
+const directories: string[] = []
 
-/**
- * Why it throws rather than skipping when the build fails: a bundle that cannot be built
- * is a louder problem than the one this test checks, and swallowing it here is exactly
- * how the assertion would go missing.
- */
-function ensureOrcadBundle(): void {
-  if (existsSync(BUNDLE)) {
-    return
+afterEach(() => {
+  for (const directory of directories.splice(0)) {
+    rmSync(directory, { recursive: true, force: true })
   }
-  const build = runProcessSync({
+})
+
+it('loads a fresh production import graph before requiring native PTY code', () => {
+  const directory = mkdtempSync(join(tmpdir(), 'orcad-load-order-'))
+  directories.push(directory)
+  const bundle = join(directory, 'orcad.js')
+  const builder = pathToFileURL(join(REPO_ROOT, 'config/scripts/orcad-entry-build.mjs')).href
+  const built = runProcessSync({
     program: process.execPath,
-    args: [BUILD_SCRIPT],
+    args: [
+      '--input-type=module',
+      '-e',
+      `import { buildOrcadEntry } from ${JSON.stringify(builder)}; await buildOrcadEntry(${JSON.stringify(bundle)})`
+    ],
     cwd: REPO_ROOT,
-    timeoutMs: 300_000
-  })
-  if (!existsSync(BUNDLE)) {
-    const output = `${build.stdout}${build.stderr}`.slice(0, 4000)
-    throw new Error(
-      `could not build ${BUNDLE} (exit ${build.code}); the load-order assertion cannot run:\n${output}`
-    )
-  }
-}
-
-describe('orcad bundle native load order', () => {
-  const dirs: string[] = []
-  afterEach(() => {
-    for (const dir of dirs.splice(0)) {
-      rmSync(dir, { recursive: true, force: true })
-    }
+    env: { ...process.env, ORCA_BACKGROUND_LAUNCH: '1' },
+    timeoutMs: 60_000
   })
+  expect(built.code, built.stderr.slice(0, 2_000)).toBe(0)
+  expect(existsSync(bundle)).toBe(true)
 
-  it('does not require node-pty in-process before the entry rejects its argv', () => {
-    ensureOrcadBundle()
-    const dir = mkdtempSync(join(tmpdir(), 'orcad-load-order-'))
-    dirs.push(dir)
-    const harness = join(dir, 'harness.cjs')
-    writeFileSync(
-      harness,
-      [
-        "const Module = require('module')",
-        'const original = Module._load',
-        'Module._load = function (request, ...rest) {',
-        "  if (request === 'node-pty') { console.log('IN_PROCESS_NODE_PTY_REQUIRE') }",
-        '  return original.call(this, request, ...rest)',
-        '}',
-        "process.argv.push('--orcad-load-order-check')",
-        `require(${JSON.stringify(BUNDLE)})`
-      ].join('\n')
-    )
-
-    const result = runProcessSync({
+  const marker = join(directory, 'premature-native-load')
+  const preload = join(directory, 'preload.cjs')
+  writeFileSync(
+    preload,
+    [
+      "const Module = require('node:module')",
+      'const original = Module._load',
+      'Module._load = function (request, ...rest) {',
+      "  if (request === 'node-pty') {",
+      `    require('node:fs').writeFileSync(${JSON.stringify(marker)}, request)`,
+      "    throw new Error('native PTY required before preflight')",
+      '  }',
+      '  return original.call(this, request, ...rest)',
+      '}'
+    ].join('\n')
+  )
+  const run = (extraArgs: string[] = []) =>
+    runProcessSync({
       program: process.execPath,
-      args: [harness],
-      timeoutMs: 120_000
+      // The production load-check exits after module evaluation, before runtime handoff or probes.
+      args: ['--require', preload, ...extraArgs, bundle, '--orcad-smoke-load-check'],
+      env: { ...process.env, ORCA_BACKGROUND_LAUNCH: '1' },
+      timeoutMs: 30_000
     })
-    const output = `${result.stdout}${result.stderr}`
 
-    // Proof the graph fully loaded and reached argv parsing rather than dying early.
-    expect(output).toContain('Unknown argument: --orcad-load-order-check')
-    expect(output).not.toContain('IN_PROCESS_NODE_PTY_REQUIRE')
-  }, 360_000)
-})
+  const loaded = run()
+  expect(loaded.code, loaded.stderr.slice(0, 2_000)).toBe(0)
+  expect(existsSync(marker)).toBe(false)
+
+  // Prove the interception works without relying on minified source echoed in an error.
+  const eagerNative = join(directory, 'eager-native.cjs')
+  writeFileSync(eagerNative, "require('node-pty')")
+  expect(run(['--require', eagerNative]).code).not.toBe(0)
+  expect(existsSync(marker)).toBe(true)
+}, 90_000)
diff --git a/src/main/orcad/orcad-bundled-runtime.integration.test.ts b/src/main/orcad/orcad-bundled-runtime.integration.test.ts
new file mode 100644
index 000000000000..9db0d5000c97
--- /dev/null
+++ b/src/main/orcad/orcad-bundled-runtime.integration.test.ts
@@ -0,0 +1,221 @@
+import { build } from 'esbuild'
+import { chmod, mkdir, mkdtemp, readFile, rm, symlink, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { runProcess, spawnProcess } from '../../shared/child-process/run-process'
+import { shellEscape } from '../ssh/ssh-connection-utils'
+
+let directory = ''
+const children = new Set<ReturnType<typeof spawnProcess>>()
+
+beforeEach(async () => {
+  directory = await mkdtemp(join(tmpdir(), 'orca-handoff-'))
+  await build({
+    stdin: {
+      contents: `
+        import { handoffToBundledOrcad, OrcadBundledRuntimeError } from './src/main/orcad/orcad-bundled-runtime'
+        import { installOrcadShutdownSignals, flushOrcadProfileStoreForShutdown } from './src/main/orcad/orcad-lifecycle'
+        import { writeFile } from 'node:fs/promises'
+        if (process.env.ORCA_TEST_HANDOFF_CHILD === '1') {
+          if (process.env.ORCA_TEST_HANDOFF_DURABLE === '1') {
+            installOrcadShutdownSignals(() => flushOrcadProfileStoreForShutdown({
+              flushFinalOrThrowAsync: async () => {
+                console.log('flushing')
+                await new Promise(resolve => setTimeout(resolve, 250))
+                await writeFile(process.env.ORCA_TEST_SHUTDOWN_FILE, 'flushed')
+              },
+              freezeWritesAsync: async () => console.log('closed')
+            }))
+          }
+          for (const signal of ['SIGINT', 'SIGTERM']) {
+            process.on(signal, () => {
+              console.log('received:' + signal)
+              if (process.env.ORCA_TEST_HANDOFF_DURABLE !== '1') process.exit(29)
+            })
+          }
+          console.log('ready:' + JSON.stringify(process.argv.slice(2)))
+          console.log('child-pid:' + process.pid)
+          setTimeout(() => process.exit(99), 4_000)
+        } else {
+          try {
+            if (!handoffToBundledOrcad()) throw new Error('handoff failed')
+          } catch (error) {
+            console.error(error.message)
+            process.exit(error instanceof OrcadBundledRuntimeError ? 78 : 1)
+          }
+        }
+      `,
+      resolveDir: process.cwd(),
+      loader: 'ts'
+    },
+    outfile: join(directory, 'orcad.js'),
+    bundle: true,
+    platform: 'node',
+    target: 'node18',
+    format: 'cjs'
+  })
+  await writeFile(join(directory, '.build-target'), 'darwin-arm64\n')
+  const runtime = join(directory, 'bun-runtime')
+  await writeFile(
+    runtime,
+    `#!/bin/sh\nORCA_TEST_HANDOFF_CHILD=1 exec ${shellEscape(process.execPath)} "$@"\n`
+  )
+  await chmod(runtime, 0o700)
+})
+
+afterEach(async () => {
+  for (const child of children) {
+    child.kill('SIGKILL')
+  }
+  children.clear()
+  await rm(directory, { recursive: true, force: true })
+})
+
+function launch(
+  args: string[],
+  env: NodeJS.ProcessEnv = {},
+  options: { entry?: string; nohup?: boolean } = {}
+) {
+  const child = spawnProcess({
+    program: options.nohup ? 'nohup' : process.execPath,
+    args: [
+      ...(options.nohup ? [process.execPath] : []),
+      options.entry ?? join(directory, 'orcad.js'),
+      ...args
+    ],
+    env: { ...process.env, ORCA_BACKGROUND_LAUNCH: '1', ...env },
+    stdio: ['ignore', 'pipe', 'pipe'],
+    detached: true
+  })
+  children.add(child)
+  let output = ''
+  child.stdout.on('data', (data: Buffer) => {
+    output += data.toString()
+  })
+  child.stderr.on('data', (data: Buffer) => {
+    output += data.toString()
+  })
+  const exit = new Promise<{ code: number | null; signal: NodeJS.Signals | null }>(
+    (resolve, reject) => {
+      child.once('error', reject)
+      child.once('exit', (code, signal) => {
+        children.delete(child)
+        resolve({ code, signal })
+      })
+    }
+  )
+  return { child, output: () => output, exit }
+}
+
+describe.skipIf(process.platform === 'win32')('bundled handoff process lifecycle', () => {
+  it('refuses a partial installation before launching its adjacent runtime', async () => {
+    await rm(join(directory, '.build-target'))
+    const result = await runProcess({
+      program: process.execPath,
+      args: [join(directory, 'orcad.js')],
+      env: { ...process.env, ORCA_BACKGROUND_LAUNCH: '1' },
+      timeoutMs: 5_000
+    })
+    expect(result.code).toBe(78)
+    expect(result.stderr).toContain('bundled Orca runtime target is missing')
+    expect(result.stdout).not.toContain('ready:')
+  })
+
+  it.each(['SIGINT', 'SIGTERM'] as const)(
+    'forwards %s to the actual child and mirrors its exit',
+    async (signal) => {
+      const args = ['--label', 'two words', 'quote"$literal']
+      const { child, output, exit } = launch(args)
+      await vi.waitFor(() => expect(output()).toContain(`ready:${JSON.stringify(args)}`), {
+        timeout: 2_000
+      })
+      child.kill(signal)
+      expect(await exit).toEqual({ code: 29, signal: null })
+      expect(output()).toContain(`received:${signal}`)
+    }
+  )
+
+  it.each(
+    (['SIGINT', 'SIGTERM'] as const).flatMap((signal) =>
+      (['process group', 'separate service deliveries'] as const).map((delivery) => ({
+        signal,
+        delivery
+      }))
+    )
+  )(
+    'finishes a pending durable flush after duplicate $signal from $delivery',
+    async ({ signal, delivery }) => {
+      const shutdownFile = join(directory, 'shutdown-complete')
+      const { child, output, exit } = launch([], {
+        ORCA_TEST_HANDOFF_DURABLE: '1',
+        ORCA_TEST_SHUTDOWN_FILE: shutdownFile
+      })
+      await vi.waitFor(() => expect(output()).toContain('child-pid:'), { timeout: 2_000 })
+      const runtimePid = Number(output().match(/child-pid:(\d+)/)?.[1])
+      expect(runtimePid).toBeGreaterThan(0)
+      if (!child.pid) {
+        throw new Error('Launcher has no process ID')
+      }
+      if (delivery === 'process group') {
+        process.kill(-child.pid, signal)
+      } else {
+        process.kill(runtimePid, signal)
+        await vi.waitFor(() => expect(output()).toContain('flushing'))
+        child.kill(signal)
+      }
+      expect(await exit).toEqual({ code: 0, signal: null })
+      expect(await readFile(shutdownFile, 'utf8')).toBe('flushed')
+      expect(output().match(/flushing/g)).toHaveLength(1)
+      expect(output()).toContain('closed')
+      if (delivery === 'separate service deliveries') {
+        expect(output().match(new RegExp(`received:${signal}`, 'g'))).toHaveLength(2)
+      }
+    }
+  )
+
+  it('hands off a symlinked entry to its adjacent runtime', async () => {
+    const aliases = join(directory, 'aliases')
+    await mkdir(aliases)
+    const entry = join(aliases, 'orcad.js')
+    await symlink(join(directory, 'orcad.js'), entry)
+    const { child, output, exit } = launch([], {}, { entry })
+    await vi.waitFor(() => expect(output()).toContain('child-pid:'), { timeout: 2_000 })
+    child.kill('SIGTERM')
+    expect(await exit).toEqual({ code: 29, signal: null })
+  })
+
+  it('drains the child after its launcher is force-killed', async () => {
+    const shutdownFile = join(directory, 'shutdown-complete')
+    const { child, output, exit } = launch([], {
+      ORCA_TEST_HANDOFF_DURABLE: '1',
+      ORCA_TEST_SHUTDOWN_FILE: shutdownFile
+    })
+    await vi.waitFor(() => expect(output()).toContain('child-pid:'), { timeout: 2_000 })
+    child.kill('SIGKILL')
+    expect(await exit).toEqual({ code: null, signal: 'SIGKILL' })
+    await vi.waitFor(async () => expect(await readFile(shutdownFile, 'utf8')).toBe('flushed'))
+    expect(output().match(/flushing/g)).toHaveLength(1)
+  })
+
+  it('preserves nohup across a terminal hangup and still stops gracefully on SIGTERM', async () => {
+    const shutdownFile = join(directory, 'shutdown-complete')
+    const { child, output, exit } = launch(
+      [],
+      { ORCA_TEST_HANDOFF_DURABLE: '1', ORCA_TEST_SHUTDOWN_FILE: shutdownFile },
+      { nohup: true }
+    )
+    await vi.waitFor(() => expect(output()).toContain('child-pid:'), { timeout: 2_000 })
+    if (!child.pid) {
+      throw new Error('Launcher has no process ID')
+    }
+    process.kill(-child.pid, 'SIGHUP')
+    await new Promise((resolve) => setTimeout(resolve, 100))
+    expect(child.exitCode).toBeNull()
+    expect(child.signalCode).toBeNull()
+    expect(output()).not.toContain('flushing')
+    child.kill('SIGTERM')
+    expect(await exit).toEqual({ code: 0, signal: null })
+    expect(await readFile(shutdownFile, 'utf8')).toBe('flushed')
+  })
+})
diff --git a/src/main/orcad/orcad-bundled-runtime.test.ts b/src/main/orcad/orcad-bundled-runtime.test.ts
new file mode 100644
index 000000000000..5541314057e7
--- /dev/null
+++ b/src/main/orcad/orcad-bundled-runtime.test.ts
@@ -0,0 +1,176 @@
+import { EventEmitter } from 'node:events'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { handoffToBundledOrcad } from './orcad-bundled-runtime'
+import { ORCAD_BUN_VERSION } from '../../shared/orcad-bun-runtime'
+import { ORCAD_VERSION_FILENAME } from '../../shared/orcad-artifacts'
+
+const fixture = vi.hoisted(() => ({
+  exists: vi.fn<(path: string) => boolean>(),
+  realpath: vi.fn<(path: string) => string>(),
+  spawn: vi.fn()
+}))
+vi.mock('node:fs', () => ({ existsSync: fixture.exists, realpathSync: fixture.realpath }))
+vi.mock('../../shared/child-process/run-process', () => ({ spawnProcess: fixture.spawn }))
+
+class RuntimeChild extends EventEmitter {
+  kill = vi.fn()
+  disconnect = vi.fn()
+  connected = true
+}
+
+let child: RuntimeChild
+const signalNames = ['SIGINT', 'SIGTERM', 'SIGHUP'] as const
+let oldListeners: Map<NodeJS.Signals, ReturnType<typeof process.rawListeners>>
+
+beforeEach(() => {
+  oldListeners = new Map(signalNames.map((signal) => [signal, process.rawListeners(signal)]))
+  child = new RuntimeChild()
+  fixture.exists.mockReturnValue(true)
+  fixture.realpath.mockImplementation((path) => path)
+  fixture.spawn.mockReturnValue(child)
+  vi.spyOn(process, 'exit').mockImplementation(() => {
+    throw new Error('test process exit')
+  })
+  vi.spyOn(process, 'kill').mockReturnValue(true)
+  vi.spyOn(console, 'error').mockImplementation(() => {})
+  vi.spyOn(process, 'argv', 'get').mockReturnValue(['/node', '/slot/orcad.js', '--port', '0'])
+})
+
+afterEach(() => {
+  for (const signal of signalNames) {
+    for (const listener of process.rawListeners(signal)) {
+      if (!oldListeners.get(signal)?.includes(listener)) {
+        process.off(signal, listener)
+      }
+    }
+  }
+  vi.restoreAllMocks()
+  vi.clearAllMocks()
+})
+
+describe('bundled Orca runtime handoff', () => {
+  it('leaves nonpackaged entries on their existing runtime', () => {
+    fixture.exists.mockReturnValue(false)
+    expect(handoffToBundledOrcad()).toBe(false)
+    expect(fixture.spawn).not.toHaveBeenCalled()
+  })
+
+  it('refuses an incomplete slot before starting a process', () => {
+    fixture.exists.mockImplementation((path) => path.endsWith('.build-target'))
+    expect(() => handoffToBundledOrcad()).toThrow('bundled Orca runtime is missing')
+    expect(fixture.spawn).not.toHaveBeenCalled()
+  })
+
+  it('refuses a versioned slot missing both its runtime and target marker', () => {
+    fixture.exists.mockImplementation((path) => path.endsWith(ORCAD_VERSION_FILENAME))
+    expect(() => handoffToBundledOrcad()).toThrow('bundled Orca runtime target is missing')
+    expect(fixture.spawn).not.toHaveBeenCalled()
+  })
+
+  it('refuses a remaining bundled runtime without its target marker', () => {
+    fixture.exists.mockImplementation((path) => !path.endsWith('.build-target'))
+    expect(() => handoffToBundledOrcad()).toThrow('bundled Orca runtime target is missing')
+    expect(fixture.realpath).toHaveBeenCalledExactlyOnceWith('/slot/orcad.js')
+    expect(fixture.spawn).not.toHaveBeenCalled()
+  })
+
+  it('accepts only the pinned version when already executing the bundled runtime', () => {
+    fixture.realpath.mockReturnValue('/real/runtime')
+    vi.spyOn(process, 'versions', 'get').mockReturnValue({
+      ...process.versions,
+      bun: ORCAD_BUN_VERSION
+    })
+    expect(handoffToBundledOrcad()).toBe(false)
+    expect(fixture.spawn).not.toHaveBeenCalled()
+  })
+
+  it('refuses an adjacent runtime that reports the wrong Bun version', () => {
+    fixture.realpath.mockReturnValue('/real/runtime')
+    vi.spyOn(process, 'versions', 'get').mockReturnValue({ ...process.versions, bun: '0.0.0' })
+    expect(() => handoffToBundledOrcad()).toThrow(`must be Bun ${ORCAD_BUN_VERSION}`)
+  })
+
+  it.each(['linux', 'darwin', 'win32'] as const)(
+    'hands off arguments and respects %s signal delivery',
+    (platform) => {
+      vi.spyOn(process, 'platform', 'get').mockReturnValue(platform)
+      expect(handoffToBundledOrcad()).toBe(true)
+      expect(fixture.spawn).toHaveBeenCalledWith({
+        program: expect.stringMatching(/bun-runtime(?:\.exe)?$/),
+        args: ['/slot/orcad.js', '--port', '0'],
+        env: expect.objectContaining({ ORCA_BUNDLED_LAUNCHER_CHANNEL: '1' }),
+        detached: true,
+        stdio: ['inherit', 'inherit', 'inherit', 'ipc']
+      })
+      for (const signal of signalNames) {
+        const listener = process
+          .rawListeners(signal)
+          .find((candidate) => !oldListeners.get(signal)?.includes(candidate))
+        if (signal === 'SIGHUP' && platform === 'win32') {
+          expect(listener).toBeUndefined()
+          continue
+        }
+        expect(listener).toBeDefined()
+        if (listener) {
+          listener.call(process, signal)
+        }
+        if (signal === 'SIGHUP') {
+          expect(child.kill).not.toHaveBeenCalledWith('SIGHUP')
+        } else if (platform === 'win32') {
+          expect(child.kill).not.toHaveBeenCalled()
+          expect(child.disconnect).toHaveBeenCalled()
+        } else {
+          expect(child.kill).toHaveBeenLastCalledWith(signal)
+        }
+      }
+    }
+  )
+
+  it('propagates a child exit code and removes every signal listener', () => {
+    handoffToBundledOrcad()
+    expect(() => child.emit('exit', 23, null)).toThrow('test process exit')
+    expect(process.exit).toHaveBeenCalledWith(23)
+    expect(process.kill).not.toHaveBeenCalled()
+    for (const signal of signalNames) {
+      expect(process.rawListeners(signal)).toEqual(oldListeners.get(signal))
+    }
+  })
+
+  it('locates the runtime beside the resolved entry rather than its symlink', () => {
+    fixture.realpath.mockImplementation((path) =>
+      path === '/slot/orcad.js' ? '/real/slot/orcad.js' : path
+    )
+    handoffToBundledOrcad()
+    expect(fixture.spawn).toHaveBeenCalledWith(
+      expect.objectContaining({
+        program: expect.stringMatching(/real\/slot\/bun-runtime(?:\.exe)?$/),
+        args: ['/real/slot/orcad.js', '--port', '0']
+      })
+    )
+  })
+
+  it('reports failed spawn as a configuration failure and removes listeners', () => {
+    handoffToBundledOrcad()
+    expect(() => child.emit('error', new Error('ENOENT'))).toThrow('test process exit')
+    expect(process.exit).toHaveBeenCalledWith(78)
+    for (const signal of signalNames) {
+      expect(process.rawListeners(signal)).toEqual(oldListeners.get(signal))
+    }
+  })
+
+  it('mirrors a POSIX signal exit without exiting before the signal is delivered', () => {
+    vi.spyOn(process, 'platform', 'get').mockReturnValue('linux')
+    handoffToBundledOrcad()
+    child.emit('exit', null, 'SIGTERM')
+    expect(process.kill).toHaveBeenCalledWith(process.pid, 'SIGTERM')
+    expect(process.exit).not.toHaveBeenCalled()
+  })
+
+  it('preserves a signal exit without sending unsupported signals on Windows', () => {
+    vi.spyOn(process, 'platform', 'get').mockReturnValue('win32')
+    handoffToBundledOrcad()
+    expect(() => child.emit('exit', null, 'SIGTERM')).toThrow('test process exit')
+    expect(process.exit).toHaveBeenCalledWith(143)
+    expect(process.kill).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/main/orcad/orcad-bundled-runtime.ts b/src/main/orcad/orcad-bundled-runtime.ts
new file mode 100644
index 000000000000..05b86387124b
--- /dev/null
+++ b/src/main/orcad/orcad-bundled-runtime.ts
@@ -0,0 +1,90 @@
+import { existsSync, realpathSync } from 'node:fs'
+import { dirname, join } from 'node:path'
+import { constants } from 'node:os'
+import { spawnProcess } from '../../shared/child-process/run-process'
+import {
+  ORCAD_BUILD_TARGET_FILENAME,
+  ORCAD_VERSION_FILENAME,
+  orcadBunRuntimeFilename
+} from '../../shared/orcad-artifacts'
+import { ORCAD_BUN_VERSION } from '../../shared/orcad-bun-runtime'
+
+export class OrcadBundledRuntimeError extends Error {}
+export const ORCAD_BUNDLED_LAUNCHER_ENV = 'ORCA_BUNDLED_LAUNCHER_CHANNEL'
+
+/** Keep old Node service commands usable without letting Node open the profile. */
+export function handoffToBundledOrcad(): boolean {
+  const script = process.argv[1]
+  if (!script) {
+    return false
+  }
+  const entry = realpathSync(script)
+  const directory = dirname(entry)
+  const runtime = join(directory, orcadBunRuntimeFilename(process.platform))
+  const hasTarget = existsSync(join(directory, ORCAD_BUILD_TARGET_FILENAME))
+  const hasRuntime = existsSync(runtime)
+  if (!hasTarget && !hasRuntime && !existsSync(join(directory, ORCAD_VERSION_FILENAME))) {
+    return false
+  }
+  if (!hasTarget) {
+    throw new OrcadBundledRuntimeError('The bundled Orca runtime target is missing')
+  }
+  if (!hasRuntime) {
+    throw new OrcadBundledRuntimeError('The bundled Orca runtime is missing')
+  }
+  if (realpathSync(process.execPath) === realpathSync(runtime)) {
+    if (process.versions.bun !== ORCAD_BUN_VERSION) {
+      throw new OrcadBundledRuntimeError(
+        `The bundled Orca runtime must be Bun ${ORCAD_BUN_VERSION}`
+      )
+    }
+    return false
+  }
+  const child = spawnProcess({
+    program: runtime,
+    args: [entry, ...process.argv.slice(2)],
+    env: { ...process.env, [ORCAD_BUNDLED_LAUNCHER_ENV]: '1' },
+    // Windows' default child job kills Bun before it can drain on launcher disconnect.
+    detached: true,
+    stdio: ['inherit', 'inherit', 'inherit', 'ipc']
+  })
+  // Node resets nohup's disposition; headless runtimes stop through INT/TERM or owner loss.
+  const ignoreHangup = (): void => {}
+  if (process.platform !== 'win32') {
+    process.on('SIGHUP', ignoreHangup)
+  }
+  const forwards = (['SIGINT', 'SIGTERM'] as const).map((signal) => {
+    const forward = (): void => {
+      if (process.platform === 'win32') {
+        // Detached Windows children have a separate console; kill() skips durable shutdown.
+        if (child.connected) {
+          child.disconnect()
+        }
+      } else {
+        child.kill(signal)
+      }
+    }
+    process.on(signal, forward)
+    return { signal, forward }
+  })
+  const cleanup = (): void => {
+    process.off('SIGHUP', ignoreHangup)
+    for (const { signal, forward } of forwards) {
+      process.off(signal, forward)
+    }
+  }
+  child.once('error', (error) => {
+    cleanup()
+    console.error('orcad: could not start the bundled runtime:', error.message)
+    process.exit(78)
+  })
+  child.once('exit', (code, signal) => {
+    cleanup()
+    if (signal && process.platform !== 'win32') {
+      process.kill(process.pid, signal)
+      return
+    }
+    process.exit(code ?? (signal ? 128 + constants.signals[signal] : 1))
+  })
+  return true
+}
diff --git a/src/main/orcad/orcad-entry.test.ts b/src/main/orcad/orcad-entry.test.ts
new file mode 100644
index 000000000000..5b0fe6fa560f
--- /dev/null
+++ b/src/main/orcad/orcad-entry.test.ts
@@ -0,0 +1,70 @@
+import { describe, expect, it, vi } from 'vitest'
+import {
+  flushOrcadProfileStoreForShutdown,
+  installOrcadShutdownSignals,
+  ORCAD_SHUTDOWN_DEADLINE_MS
+} from './orcad-lifecycle'
+
+describe('orcad profile-state shutdown', () => {
+  it('keeps one bounded shutdown even when stop signals repeat', () => {
+    vi.useFakeTimers()
+    let signal: (() => void) | undefined
+    vi.spyOn(process, 'on').mockImplementation((event, listener) => {
+      if (event === 'SIGTERM') {
+        signal = listener
+      }
+      return process
+    })
+    const exit = vi.spyOn(process, 'exit').mockImplementation(() => {
+      throw new Error('shutdown deadline')
+    })
+    vi.spyOn(console, 'error').mockImplementation(() => {})
+    const stop = vi.fn(() => new Promise<void>(() => {}))
+    try {
+      installOrcadShutdownSignals(stop)
+      signal?.()
+      signal?.()
+      expect(stop).toHaveBeenCalledOnce()
+      expect(exit).not.toHaveBeenCalled()
+      expect(() => vi.advanceTimersByTime(ORCAD_SHUTDOWN_DEADLINE_MS)).toThrow('shutdown deadline')
+      expect(exit).toHaveBeenCalledWith(1)
+    } finally {
+      vi.restoreAllMocks()
+      vi.useRealTimers()
+    }
+  })
+
+  it('flushes durably before closing the profile store', async () => {
+    const events: string[] = []
+    const store = {
+      flushFinalOrThrowAsync: vi.fn(async () => {
+        events.push('flush')
+      }),
+      freezeWritesAsync: vi.fn(async () => {
+        events.push('freeze')
+      })
+    }
+
+    await flushOrcadProfileStoreForShutdown(store)
+
+    expect(store.flushFinalOrThrowAsync).toHaveBeenCalledExactlyOnceWith({
+      exportJsonCompatibility: true
+    })
+    expect(store.freezeWritesAsync).toHaveBeenCalledOnce()
+    expect(events).toEqual(['flush', 'freeze'])
+  })
+
+  it('closes the profile store even when the durable flush fails', async () => {
+    const flushError = new Error('profile flush failed')
+    const freezeWritesAsync = vi.fn(async () => {})
+    const store = {
+      flushFinalOrThrowAsync: vi.fn(async () => {
+        throw flushError
+      }),
+      freezeWritesAsync
+    }
+
+    await expect(flushOrcadProfileStoreForShutdown(store)).rejects.toBe(flushError)
+    expect(freezeWritesAsync).toHaveBeenCalledOnce()
+  })
+})
diff --git a/src/main/orcad/orcad-entry.ts b/src/main/orcad/orcad-entry.ts
index edc4426a2a93..02533588e9dd 100644
--- a/src/main/orcad/orcad-entry.ts
+++ b/src/main/orcad/orcad-entry.ts
@@ -1,13 +1,12 @@
 /**
- * `orcad` — the Orca runtime served from plain Node, with no Electron.
+ * `orcad` — the Orca runtime served without Electron.
  *
  * Installs the Node host adapters, constructs the same `OrcaRuntimeService` the
  * desktop uses, installs a PTY controller via `registerHeadlessPtyRuntime`, and
  * serves runtime RPC. See docs/design/node-only-runtime-backend.html.
  *
- * Desktop UI surfaces stay uninstalled: no native notifications, no renderer window. The
- * renderer window is faked as a destroyed one because `registerPtyHandlers` takes a
- * non-null `BrowserWindow`. Browser automation is different — it is installed through
+ * Desktop UI surfaces stay uninstalled: no native notifications or renderer delivery.
+ * Browser automation is installed through
  * the runtime factory, but only when an Electron serve sidecar or an operator-supplied
  * Chromium proves available at startup.
  */
@@ -15,16 +14,13 @@ import process from 'node:process'
 import { setAppEnvironment, type AppEnvironment } from '../../shared/app-environment'
 import { setSecretStore, type SecretStore } from '../../shared/secret-store'
 import type { ServeReadiness } from '../server/serve-readiness'
-import { setRuntimeBrowserCommandsFactory } from '../runtime/runtime-browser-commands-factory'
-import { resolveOrcadBrowserProvider } from './orcad-browser-provider'
 import { resolveOrcadInstallRoot, resolveOrcadPath, resolveUserDataPath } from './orcad-app-paths'
+import { describeOrcadBindExposure, resolveOrcadBindHost } from './orcad-bind-address'
 import {
-  describeOrcadBindExposure,
-  OrcadBindAddressError,
-  resolveOrcadBindHost
-} from './orcad-bind-address'
-import { acquireOrcadInstanceLock, OrcadInstanceLockError } from './orcad-instance-lock'
-import { startOrcadWithLifecycle } from './orcad-lifecycle'
+  flushOrcadProfileStoreForShutdown,
+  installOrcadShutdownSignals,
+  startOrcadWithHost
+} from './orcad-lifecycle'
 import { parseArgs } from './orcad-command-arguments'
 import {
   changedAiVaultSearchSettings,
@@ -110,27 +106,10 @@ export type OrcadHandle = {
  */
 export async function startOrcad(options: OrcadOptions = {}): Promise<OrcadHandle> {
   installOrcadHostAdapters()
-  const userDataPath = resolveUserDataPath()
-  // Why before anything else touches the root: the profile index, the store and the daemon
-  // runtime dir all live under it, and two orcads sharing them corrupt state silently. This
-  // is also the last point at which refusing costs nothing.
-  const instanceLock = acquireOrcadInstanceLock(userDataPath)
-  const browserProvider = await resolveOrcadBrowserProvider({ userDataPath })
-  setRuntimeBrowserCommandsFactory(browserProvider?.factory ?? null, {
-    headless: browserProvider !== null,
-    ...(browserProvider ? { isAvailable: () => browserProvider.isAvailable() } : {})
-  })
-  return startOrcadWithLifecycle(
+  return startOrcadWithHost(
+    resolveUserDataPath(),
     (registerCleanup) => startOrcadRuntime(options, registerCleanup),
-    async () => {
-      try {
-        await browserProvider?.stop()
-      } finally {
-        setRuntimeBrowserCommandsFactory(null)
-        runOrcadQuitHandlers()
-        instanceLock.release()
-      }
-    }
+    () => runOrcadQuitHandlers()
   )
 }
 
@@ -145,10 +124,7 @@ async function startOrcadRuntime(
   const { getAppEnvironment } = await import('../../shared/app-environment')
   const { resolveAdvertisedPairingEndpoint } = await import('../runtime/pairing-endpoint')
   const { ServeReadinessPublisher } = await import('../server/serve-readiness')
-  const { Store } = await import('../persistence/loading-store/store')
-  const { ensureActiveOrcaProfile, initOrcaProfilePaths } =
-    await import('../orca-profiles/profile-index-store')
-  const { initSshHostKeyStoreFile } = await import('../ssh/ssh-host-key-store')
+  const { createOrcadProfileStateStartup } = await import('./orcad-profile-state-startup')
   const { startOrcadDaemon, stopOrcadDaemon } = await import('./orcad-daemon-supervision')
   const { daemonOwnsFreshPersistentPtys } = await import('../daemon/daemon-init')
   const { collectOrcadHealth } = await import('./orcad-health')
@@ -162,6 +138,9 @@ async function startOrcadRuntime(
     await import('../runtime/agent-status-observed-pane-identity')
 
   let rpc: InstanceType<typeof OrcaRuntimeRpcServer> | null = null
+  let profileStoreForShutdown:
+    | { flushFinalOrThrowAsync(): Promise<void>; freezeWritesAsync(): Promise<void> }
+    | undefined
   let uninstallHookStatusRepublish = (): void => {}
   let uninstallObservedStatusIdentity = (): void => {}
   registerCleanup(async () => {
@@ -169,13 +148,21 @@ async function startOrcadRuntime(
       await rpc?.stop()
     } finally {
       try {
-        // Why disconnect and not shut down: the daemon must outlive this process, or an
-        // orcad restart goes back to killing every running terminal.
-        await stopOrcadDaemon()
+        // Stop accepting RPC writes before the final persistence barrier. A SQLite-backed
+        // orcad has no JSON mirror to absorb a debounced write after SIGTERM.
+        if (profileStoreForShutdown) {
+          await flushOrcadProfileStoreForShutdown(profileStoreForShutdown)
+        }
       } finally {
-        uninstallObservedStatusIdentity()
-        uninstallHookStatusRepublish()
-        agentHookServer.stop()
+        try {
+          // Why disconnect and not shut down: the daemon must outlive this process, or an
+          // orcad restart goes back to killing every running terminal.
+          await stopOrcadDaemon()
+        } finally {
+          uninstallObservedStatusIdentity()
+          uninstallHookStatusRepublish()
+          agentHookServer.stop()
+        }
       }
     }
   })
@@ -183,8 +170,8 @@ async function startOrcadRuntime(
   const { resolvePushGatewayOrigin } = await import('../runtime/push/push-gateway-origin')
 
   const runtimeUserDataPath = getAppEnvironment().getPath('userData')
-  initOrcaProfilePaths()
-  const profile = ensureActiveOrcaProfile(runtimeUserDataPath)
+  const { store: profileStore, authority: profileStateAuthority } =
+    await createOrcadProfileStateStartup(runtimeUserDataPath)
   const observedPaneIdentities = new AgentStatusObservedPaneIdentities()
   const observedStatusCapture = new AgentStatusObservedPaneIdentityCapture(observedPaneIdentities)
   // Why a real Store: without one every persistence-backed RPC throws `runtime_unavailable`
@@ -192,15 +179,14 @@ async function startOrcadRuntime(
   // a server that pairs and lists nothing looks healthy and is not.
   // Why: orcad IS the runtime authority — loading as 'desktop' would classify its
   // own runtime-scheduled automations as ambiguous mirrors and orphan them.
-  const store = new Store({ dataFile: profile.dataFile, storageAuthority: 'runtime' })
+  profileStoreForShutdown = profileStore
   // Why: every SSH connect consults this sidecar. Left unbound it reports nothing trusted,
   // which is safe but silently discards accept records on every launch.
-  initSshHostKeyStoreFile(profile.dataFile)
 
   uninstallObservedStatusIdentity = agentHookServer.subscribeEnrichedStatus((enriched) =>
     observedStatusCapture.observe(enriched)
   )
-  if (isAgentStatusHooksEnabled(store.getSettings())) {
+  if (isAgentStatusHooksEnabled(profileStore.getSettings())) {
     await agentHookServer.start({ env: 'production', userDataPath: runtimeUserDataPath })
   }
 
@@ -213,7 +199,7 @@ async function startOrcadRuntime(
   // constructed, and the deps hook is only ever called later, from an RPC.
   let sessionSearch: { apply(settings: AiVaultSearchSettings): void; dispose(): void } | null = null
 
-  const runtime = new OrcaRuntimeService(store, undefined, {
+  const runtime = new OrcaRuntimeService(profileStore, undefined, {
     // Why lazy: a daemon swap replaces the provider after construction, so an eager
     // reference would freeze the pre-daemon one.
     getLocalProvider: () => getLocalPtyProvider(),
@@ -252,7 +238,7 @@ async function startOrcadRuntime(
     reconcileAgentStatusForEndedProcess: (paneKeys) =>
       agentHookServer.reconcileEndedProcessForPaneKeys(paneKeys),
     buildAgentHookPtyEnv: () =>
-      isAgentStatusHooksEnabled(store.getSettings()) ? agentHookServer.buildPtyEnv() : {},
+      isAgentStatusHooksEnabled(profileStore.getSettings()) ? agentHookServer.buildPtyEnv() : {},
     // Why the dedupe here and not in the instance: `apply` closes and reconstructs
     // unconditionally, so an unchanged value would restart a healthy index.
     applySessionSearchSettings: (before, after) => {
@@ -266,7 +252,7 @@ async function startOrcadRuntime(
   const { installOrcadSessionSearchService } = await import('./orcad-session-search')
   sessionSearch = await installOrcadSessionSearchService({
     userDataPath: runtimeUserDataPath,
-    getSettings: () => store.getSettings()
+    getSettings: () => profileStore.getSettings()
   })
   getAppEnvironment().onWillQuit(() => sessionSearch?.dispose())
 
@@ -284,7 +270,13 @@ async function startOrcadRuntime(
   // Codex-home and Claude-auth preparation are left unset: both are desktop account
   // flows. A launch that needs one fails with its own message rather than silently
   // spawning an unauthenticated agent.
-  await registerHeadlessPtyRuntime(runtime, undefined, () => store.getSettings(), undefined, store)
+  await registerHeadlessPtyRuntime(
+    runtime,
+    undefined,
+    () => profileStore.getSettings(),
+    undefined,
+    profileStore
+  )
 
   // Why: same post-registration reconciliation `--serve` performs. Skipping it leaves
   // restored orchestration rows claiming an authority this host never took over.
@@ -356,7 +348,7 @@ async function startOrcadRuntime(
     // Why in the readiness payload: this is the one message a supervisor and a deploy
     // transaction both read, and a green orcad with a dead daemon is exactly the
     // looks-healthy-but-useless state they must not activate.
-    health: await collectOrcadHealth(getAppEnvironment().getVersion())
+    health: await collectOrcadHealth(getAppEnvironment().getVersion(), profileStateAuthority)
   }
 
   await new ServeReadinessPublisher().publish(readiness, {
@@ -374,50 +366,18 @@ async function startOrcadRuntime(
  * supervision contract has to prevent, so systemd's `RestartPreventExitStatus` needs a code
  * that means "do not retry" and nothing else does.
  */
-export const ORCAD_EXIT_OK = 0
-export const ORCAD_EXIT_FAILED = 1
-export const ORCAD_EXIT_CONFIGURATION = 78
+export {
+  ORCAD_EXIT_OK,
+  ORCAD_EXIT_FAILED,
+  ORCAD_EXIT_CONFIGURATION,
+  resolveOrcadExitCode
+} from './orcad-exit-code'
 
 /** Bounded so a wedged transport cannot hold a supervisor's stop past its own deadline. */
-export const ORCAD_SHUTDOWN_DEADLINE_MS = 15_000
-
-export function resolveOrcadExitCode(error: unknown): number {
-  return error instanceof OrcadInstanceLockError || error instanceof OrcadBindAddressError
-    ? ORCAD_EXIT_CONFIGURATION
-    : ORCAD_EXIT_FAILED
-}
+export { ORCAD_SHUTDOWN_DEADLINE_MS } from './orcad-lifecycle'
 
 export async function main(argv: string[] = process.argv.slice(2)): Promise<void> {
-  const handle = await startOrcad(parseArgs(argv))
-  let stopping = false
-  const shutdown = (signal: NodeJS.Signals): void => {
-    if (stopping) {
-      // Why escalate rather than ignore: a supervisor's second signal means the first
-      // deadline elapsed. Continuing to wait silently is what makes a stop hang until
-      // SIGKILL, which is the one teardown that skips the daemon handoff entirely.
-      console.error(`orcad: second ${signal} during shutdown — exiting immediately`)
-      process.exit(ORCAD_EXIT_FAILED)
-    }
-    stopping = true
-    // Why a self-imposed deadline as well: the supervisor's SIGKILL leaves no exit code and
-    // no log line. Exiting ourselves keeps the failure attributable.
-    const deadline = setTimeout(() => {
-      console.error(
-        `orcad: shutdown after ${signal} exceeded ${ORCAD_SHUTDOWN_DEADLINE_MS}ms — exiting`
-      )
-      process.exit(ORCAD_EXIT_FAILED)
-    }, ORCAD_SHUTDOWN_DEADLINE_MS)
-    deadline.unref()
-    handle
-      .stop()
-      .then(() => process.exit(ORCAD_EXIT_OK))
-      // Why not rethrow: we are already tearing down on a signal, and an exit code is
-      // the only thing a supervisor can act on.
-      .catch((error) => {
-        console.error(`orcad: shutdown after ${signal} failed:`, error)
-        process.exit(ORCAD_EXIT_FAILED)
-      })
-  }
-  process.on('SIGINT', () => shutdown('SIGINT'))
-  process.on('SIGTERM', () => shutdown('SIGTERM'))
+  const startup = startOrcad(parseArgs(argv))
+  installOrcadShutdownSignals(async () => (await startup).stop())
+  await startup
 }
diff --git a/src/main/orcad/orcad-exit-code.ts b/src/main/orcad/orcad-exit-code.ts
new file mode 100644
index 000000000000..8b07dd2f5c96
--- /dev/null
+++ b/src/main/orcad/orcad-exit-code.ts
@@ -0,0 +1,18 @@
+import { OrcadBindAddressError } from './orcad-bind-address'
+import { OrcadBundledRuntimeError } from './orcad-bundled-runtime'
+import { OrcadInstanceLockError } from './orcad-instance-lock'
+import { ProfileStateAccessError } from '../persistence/profile-state/profile-state-access'
+
+export const ORCAD_EXIT_OK = 0
+export const ORCAD_EXIT_FAILED = 1
+export const ORCAD_EXIT_CONFIGURATION = 78
+
+/** Configuration faults cannot be repaired by a supervisor restart. */
+export function resolveOrcadExitCode(error: unknown): number {
+  return error instanceof OrcadInstanceLockError ||
+    error instanceof OrcadBindAddressError ||
+    error instanceof OrcadBundledRuntimeError ||
+    error instanceof ProfileStateAccessError
+    ? ORCAD_EXIT_CONFIGURATION
+    : ORCAD_EXIT_FAILED
+}
diff --git a/src/main/orcad/orcad-health.test.ts b/src/main/orcad/orcad-health.test.ts
index c77f18477f06..70e02b37e878 100644
--- a/src/main/orcad/orcad-health.test.ts
+++ b/src/main/orcad/orcad-health.test.ts
@@ -134,6 +134,24 @@ describe('collectOrcadHealth', () => {
     expect(health.platform).toBe(process.platform)
     expect(health.terminalDaemon.state).toBe('live')
   })
+
+  it('includes bounded profile-state authority metadata when supplied', async () => {
+    const health = await collectOrcadHealth('1.2.3', {
+      backend: 'sqlite',
+      classification: 'sqlite-only',
+      authority_mode: 'sqlite-established',
+      runtime: 'orcad',
+      migrated: false
+    })
+
+    expect(health.profileStateAuthority).toEqual({
+      backend: 'sqlite',
+      classification: 'sqlite-only',
+      authority_mode: 'sqlite-established',
+      runtime: 'orcad',
+      migrated: false
+    })
+  })
 })
 
 describe('computeOrcadBuildHash', () => {
diff --git a/src/main/orcad/orcad-health.ts b/src/main/orcad/orcad-health.ts
index d9a567531ac4..0c3a3525171f 100644
--- a/src/main/orcad/orcad-health.ts
+++ b/src/main/orcad/orcad-health.ts
@@ -17,6 +17,7 @@ import {
   getDaemonEndpointFacts,
   readDaemonPidRecord
 } from '../daemon/daemon-init'
+import type { OrcadProfileStateAuthoritySelection } from './orcad-profile-state-telemetry'
 
 /**
  * How much a green self-test actually proves.
@@ -64,6 +65,8 @@ export type OrcadHealth = {
   arch: string
   pid: number
   terminalDaemon: TerminalDaemonHealth
+  /** The low-cardinality profile-state authority selected during startup, when available. */
+  profileStateAuthority?: OrcadProfileStateAuthoritySelection
 }
 
 /**
@@ -146,7 +149,10 @@ export async function collectTerminalDaemonHealth(): Promise<TerminalDaemonHealt
   }
 }
 
-export async function collectOrcadHealth(buildVersion: string): Promise<OrcadHealth> {
+export async function collectOrcadHealth(
+  buildVersion: string,
+  profileStateAuthority?: OrcadProfileStateAuthoritySelection
+): Promise<OrcadHealth> {
   return {
     buildHash: computeOrcadBuildHash(),
     buildVersion,
@@ -155,6 +161,7 @@ export async function collectOrcadHealth(buildVersion: string): Promise<OrcadHea
     platform: process.platform,
     arch: process.arch,
     pid: process.pid,
-    terminalDaemon: await collectTerminalDaemonHealth()
+    terminalDaemon: await collectTerminalDaemonHealth(),
+    ...(profileStateAuthority ? { profileStateAuthority } : {})
   }
 }
diff --git a/src/main/orcad/orcad-launch-contract.test.ts b/src/main/orcad/orcad-launch-contract.test.ts
index 2d2e4e6157ec..26f2f28cbed7 100644
--- a/src/main/orcad/orcad-launch-contract.test.ts
+++ b/src/main/orcad/orcad-launch-contract.test.ts
@@ -12,6 +12,8 @@ import {
 import { startOrcadWithLifecycle } from './orcad-lifecycle'
 import { OrcadBindAddressError } from './orcad-bind-address'
 import { OrcadInstanceLockError } from './orcad-instance-lock'
+import { ProfileStateAccessError } from '../persistence/profile-state/profile-state-access'
+import { OrcadBundledRuntimeError } from './orcad-bundled-runtime'
 
 describe('parseArgs', () => {
   it('accepts --bind and leaves it unset when absent', () => {
@@ -38,7 +40,13 @@ describe('resolveOrcadExitCode', () => {
       resolveOrcadExitCode(new OrcadInstanceLockError('orcad_instance_lock_held', 'held'))
     ).toBe(ORCAD_EXIT_CONFIGURATION)
     expect(resolveOrcadExitCode(new OrcadBindAddressError('bad'))).toBe(ORCAD_EXIT_CONFIGURATION)
+    expect(resolveOrcadExitCode(new ProfileStateAccessError('recovery interrupted'))).toBe(
+      ORCAD_EXIT_CONFIGURATION
+    )
     expect(resolveOrcadExitCode(new Error('port in use'))).toBe(ORCAD_EXIT_FAILED)
+    expect(resolveOrcadExitCode(new OrcadBundledRuntimeError('partial installation'))).toBe(
+      ORCAD_EXIT_CONFIGURATION
+    )
     expect(ORCAD_EXIT_CONFIGURATION).not.toBe(ORCAD_EXIT_FAILED)
   })
 })
@@ -57,7 +65,7 @@ describe('orcad lifecycle cleanup', () => {
     ).rejects.toThrow('startup failed')
 
     expect(cleanupRuntime).toHaveBeenCalledOnce()
-    expect(cleanupHost).toHaveBeenCalledOnce()
+    expect(cleanupHost).toHaveBeenCalledExactlyOnceWith(true)
   })
 
   it('preserves the startup error when rollback also fails', async () => {
@@ -96,4 +104,17 @@ describe('orcad lifecycle cleanup', () => {
     expect(cleanupRuntime).toHaveBeenCalledOnce()
     expect(cleanupHost).toHaveBeenCalledOnce()
   })
+
+  it('keeps the host aware of failed runtime teardown so it cannot release profile admission', async () => {
+    const failure = new Error('profile writer still running')
+    const cleanupHost = vi.fn(async () => {})
+    const handle = await startOrcadWithLifecycle(async (registerCleanup) => {
+      registerCleanup(async () => {
+        throw failure
+      })
+      return {}
+    }, cleanupHost)
+    await expect(handle.stop()).rejects.toBe(failure)
+    expect(cleanupHost).toHaveBeenCalledExactlyOnceWith(false)
+  })
 })
diff --git a/src/main/orcad/orcad-lifecycle.ts b/src/main/orcad/orcad-lifecycle.ts
index 913a21c48741..bfff3b7f14ed 100644
--- a/src/main/orcad/orcad-lifecycle.ts
+++ b/src/main/orcad/orcad-lifecycle.ts
@@ -1,3 +1,16 @@
+import { setRuntimeBrowserCommandsFactory } from '../runtime/runtime-browser-commands-factory'
+import { resolveOrcadBrowserProvider } from './orcad-browser-provider'
+import { acquireOrcadInstanceLock } from './orcad-instance-lock'
+import { ORCAD_BUNDLED_LAUNCHER_ENV } from './orcad-bundled-runtime'
+import { resolveOrcadExitCode } from './orcad-exit-code'
+import {
+  acquireProfileStateRuntimeAdmission,
+  type ProfileStateRuntimeAdmission
+} from '../persistence/profile-state/profile-state-access'
+
+const bundledLauncherChannel = process.env[ORCAD_BUNDLED_LAUNCHER_ENV] === '1'
+delete process.env[ORCAD_BUNDLED_LAUNCHER_ENV]
+
 function createIdempotentOrcadCleanup(cleanup: () => Promise<void>): () => Promise<void> {
   let completion: Promise<void> | null = null
   return () => {
@@ -6,16 +19,56 @@ function createIdempotentOrcadCleanup(cleanup: () => Promise<void>): () => Promi
   }
 }
 
+export const ORCAD_SHUTDOWN_DEADLINE_MS = 15_000
+
+/** A launcher and its child can both receive the same process-group or service stop signal. */
+export function installOrcadShutdownSignals(
+  stop: () => Promise<void>,
+  deadlineMs = ORCAD_SHUTDOWN_DEADLINE_MS
+): void {
+  let stopping = false
+  const shutdown = (signal: string): void => {
+    if (stopping) {
+      return
+    }
+    stopping = true
+    setTimeout(() => {
+      console.error(`orcad: shutdown after ${signal} exceeded ${deadlineMs}ms — exiting`)
+      process.exit(1)
+    }, deadlineMs)
+    stop()
+      .then(() => process.exit(0))
+      .catch((error) => {
+        console.error(`orcad: shutdown after ${signal} failed:`, error)
+        process.exit(resolveOrcadExitCode(error))
+      })
+  }
+  process.on('SIGINT', () => shutdown('SIGINT'))
+  process.on('SIGTERM', () => shutdown('SIGTERM'))
+  // Headless runtimes survive terminal hangups; INT/TERM are the graceful stop contract.
+  if (process.platform !== 'win32') {
+    process.on('SIGHUP', () => {})
+  }
+  if (bundledLauncherChannel && typeof process.send === 'function') {
+    process.once('disconnect', () => shutdown('launcher disconnect'))
+    if (!process.connected) {
+      shutdown('launcher disconnect')
+    }
+  }
+}
+
 export async function startOrcadWithLifecycle<T extends object>(
   start: (registerRuntimeCleanup: (cleanup: () => Promise<void>) => void) => Promise<T>,
-  cleanupHost: () => Promise<void>
+  cleanupHost: (runtimeCleanupSucceeded: boolean) => Promise<void>
 ): Promise<T & { stop(): Promise<void> }> {
   let cleanupRuntime = async (): Promise<void> => {}
   const cleanup = createIdempotentOrcadCleanup(async () => {
+    let runtimeCleanupSucceeded = false
     try {
       await cleanupRuntime()
+      runtimeCleanupSucceeded = true
     } finally {
-      await cleanupHost()
+      await cleanupHost(runtimeCleanupSucceeded)
     }
   })
   try {
@@ -33,3 +86,53 @@ export async function startOrcadWithLifecycle<T extends object>(
     throw error
   }
 }
+
+/** Keep profile admission until every runtime writer has stopped. */
+export async function startOrcadWithHost<T extends object>(
+  userDataPath: string,
+  start: (registerCleanup: (cleanup: () => Promise<void>) => void) => Promise<T>,
+  runQuitHandlers: () => void
+): Promise<T & { stop(): Promise<void> }> {
+  const instanceLock = acquireOrcadInstanceLock(userDataPath)
+  let admission: ProfileStateRuntimeAdmission | undefined
+  let browserProvider: Awaited<ReturnType<typeof resolveOrcadBrowserProvider>> | undefined
+  return startOrcadWithLifecycle(
+    async (registerCleanup) => {
+      admission = acquireProfileStateRuntimeAdmission(userDataPath)
+      browserProvider = await resolveOrcadBrowserProvider({ userDataPath })
+      const provider = browserProvider
+      setRuntimeBrowserCommandsFactory(provider?.factory ?? null, {
+        headless: provider !== null,
+        ...(provider ? { isAvailable: () => provider.isAvailable() } : {})
+      })
+      return start(registerCleanup)
+    },
+    async (runtimeCleanupSucceeded) => {
+      try {
+        await browserProvider?.stop()
+      } finally {
+        setRuntimeBrowserCommandsFactory(null)
+        runQuitHandlers()
+        try {
+          // Failed teardown excludes recovery until the process actually exits.
+          if (runtimeCleanupSucceeded) {
+            admission?.release()
+          }
+        } finally {
+          instanceLock.release()
+        }
+      }
+    }
+  )
+}
+
+export async function flushOrcadProfileStoreForShutdown(store: {
+  flushFinalOrThrowAsync(options?: { exportJsonCompatibility?: boolean }): Promise<void>
+  freezeWritesAsync(): Promise<void>
+}): Promise<void> {
+  try {
+    await store.flushFinalOrThrowAsync({ exportJsonCompatibility: true })
+  } finally {
+    await store.freezeWritesAsync()
+  }
+}
diff --git a/src/main/orcad/orcad-native-preflight.ts b/src/main/orcad/orcad-native-preflight.ts
index 0f3c2cf89702..ee2f323dbe5c 100644
--- a/src/main/orcad/orcad-native-preflight.ts
+++ b/src/main/orcad/orcad-native-preflight.ts
@@ -5,6 +5,7 @@
  * testable apart from the detection (what the verdict is).
  */
 import process from 'node:process'
+import { canUseBunPty } from '../daemon/pty-subprocess/bun-pty-process-capabilities'
 import { setRuntimeTerminalUnavailableCause } from '../runtime/native-terminal-availability'
 import { terminalUnavailableMessage } from '../../shared/runtime-types'
 import {
@@ -37,6 +38,10 @@ export type NativePreflightHooks = {
  * sentence printed here.
  */
 export function runOrcadNativePreflight(hooks: NativePreflightHooks = {}): boolean {
+  if (!hooks.check && canUseBunPty()) {
+    setRuntimeTerminalUnavailableCause(null)
+    return true
+  }
   const check = hooks.check ?? checkNodePtyPrecondition
   const warn = hooks.warn ?? ((message: string) => console.warn(message))
   const fail = hooks.fail ?? ((message: string) => console.error(message))
diff --git a/src/main/orcad/orcad-profile-preflight.test.ts b/src/main/orcad/orcad-profile-preflight.test.ts
new file mode 100644
index 000000000000..9c51e1a349ea
--- /dev/null
+++ b/src/main/orcad/orcad-profile-preflight.test.ts
@@ -0,0 +1,197 @@
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { ProcessResult, ProcessSpec } from '../../shared/child-process/run-process'
+import { ORCAD_BUN_VERSION } from '../../shared/orcad-bun-runtime'
+import { ORCAD_STARTUP_PREFLIGHT_FLAG } from '../../shared/orcad-profile-preflight'
+import { OrcadBundledRuntimeError } from './orcad-bundled-runtime'
+import { resolveOrcadExitCode } from './orcad-exit-code'
+import { preflightBundledOrcadStartup, runOrcadProfilePreflight } from './orcad-profile-preflight'
+
+const fixture = vi.hoisted(() => ({
+  identity: vi.fn(),
+  readVersion: vi.fn(),
+  sql: vi.fn(),
+  native: vi.fn(),
+  run: vi.fn<(spec: ProcessSpec) => Promise<ProcessResult>>()
+}))
+vi.mock('./orcad-artifact-identity', () => ({ readOrcadArtifactIdentity: fixture.identity }))
+vi.mock('./orcad-app-paths', () => ({ resolveOrcadInstallRoot: () => '/slot' }))
+vi.mock('node:fs/promises', () => ({ readFile: fixture.readVersion }))
+vi.mock('../persistence/profile-state/profile-state-runtime-preflight', () => ({
+  preflightProfileStateRuntime: fixture.sql
+}))
+vi.mock('./orcad-bun-native-preflight', () => ({
+  preflightOrcadBunNativeRuntime: fixture.native
+}))
+vi.mock('../../shared/child-process/run-process', () => ({ runProcess: fixture.run }))
+
+const identity = '0.1.0+aaaaaaaaaaaa'
+const nonce = '743bf9c8-2e58-4c79-a0ac-52c8d3e8e103'
+
+function readyResult(challenge: string | undefined): ProcessResult {
+  return {
+    code: 0,
+    signal: null,
+    timedOut: false,
+    stderr: '',
+    stdout: JSON.stringify({
+      type: 'orca_profile_state_ready',
+      nonce: challenge,
+      runtime: 'bun',
+      runtimeVersion: ORCAD_BUN_VERSION,
+      artifactVersion: identity,
+      sqliteVersion: '3.53.2',
+      revision: 1
+    })
+  }
+}
+
+beforeEach(() => {
+  vi.spyOn(process, 'versions', 'get').mockReturnValue({
+    ...process.versions,
+    bun: ORCAD_BUN_VERSION
+  })
+  fixture.identity.mockResolvedValue(identity)
+  fixture.readVersion.mockResolvedValue(`${identity}\n`)
+  fixture.sql.mockResolvedValue({ sqliteVersion: '3.53.2', revision: 1 })
+  fixture.native.mockResolvedValue(undefined)
+  fixture.run.mockImplementation(async (spec) => readyResult(spec.args?.[2]))
+})
+
+afterEach(() => {
+  vi.restoreAllMocks()
+  vi.resetAllMocks()
+})
+
+describe('bundled Orca startup readiness', () => {
+  it.each(['win32', 'darwin', 'linux'] as const)(
+    'isolates native process state in the exact bundled %s executable',
+    async (platform) => {
+      vi.spyOn(process, 'platform', 'get').mockReturnValue(platform)
+      await preflightBundledOrcadStartup()
+      expect(fixture.run).toHaveBeenCalledOnce()
+      expect(fixture.run).toHaveBeenCalledWith({
+        program: join('/slot', platform === 'win32' ? 'bun-runtime.exe' : 'bun-runtime'),
+        args: [join('/slot', 'orcad.js'), ORCAD_STARTUP_PREFLIGHT_FLAG, expect.any(String)],
+        env: expect.objectContaining({ ORCA_BACKGROUND_LAUNCH: '1' }),
+        timeoutMs: 90_000,
+        maxOutputBytes: 64 * 1024,
+        terminationBarrier: true
+      })
+      expect(fixture.sql).not.toHaveBeenCalled()
+      expect(fixture.native).not.toHaveBeenCalled()
+    }
+  )
+
+  it('leaves legacy Node startup on its existing readiness path', async () => {
+    const { bun: _bun, ...versions } = process.versions
+    vi.spyOn(process, 'versions', 'get').mockReturnValue(versions)
+    await preflightBundledOrcadStartup()
+    expect(fixture.identity).not.toHaveBeenCalled()
+    expect(fixture.run).not.toHaveBeenCalled()
+  })
+
+  it('hashes installed bytes only in the isolated child', async () => {
+    await preflightBundledOrcadStartup()
+    expect(fixture.identity).not.toHaveBeenCalled()
+    vi.spyOn(console, 'log').mockImplementation(() => {})
+    await runOrcadProfilePreflight(nonce, { nativeFeatures: false })
+    expect(fixture.identity).toHaveBeenCalledOnce()
+  })
+
+  it.each(['missing artifact', 'corrupt build target'])(
+    'classifies %s as a configuration fault before testing SQLite',
+    async (message) => {
+      fixture.identity.mockRejectedValue(new Error(message))
+      const failure = await runOrcadProfilePreflight(nonce).catch((error: unknown) => error)
+      expect(failure).toBeInstanceOf(OrcadBundledRuntimeError)
+      expect(resolveOrcadExitCode(failure)).toBe(78)
+      expect(fixture.sql).not.toHaveBeenCalled()
+    }
+  )
+
+  it('classifies changed artifact bytes as configuration faults on normal startup', async () => {
+    fixture.readVersion.mockResolvedValue('0.1.0+bbbbbbbbbbbb')
+    await expect(preflightBundledOrcadStartup()).rejects.toThrow(OrcadBundledRuntimeError)
+  })
+
+  it.each([undefined, 'broken-version'])(
+    'classifies an unreadable or malformed version marker as configuration: %s',
+    async (version) => {
+      if (version === undefined) {
+        fixture.readVersion.mockRejectedValue(new Error('ENOENT'))
+      } else {
+        fixture.readVersion.mockResolvedValue(version)
+      }
+      await expect(preflightBundledOrcadStartup()).rejects.toThrow(OrcadBundledRuntimeError)
+      expect(fixture.run).not.toHaveBeenCalled()
+    }
+  )
+
+  it('awaits probe termination before permitting server startup', async () => {
+    const exit = Promise.withResolvers<ProcessResult>()
+    fixture.run.mockReturnValue(exit.promise)
+    let admitted = false
+    const startup = preflightBundledOrcadStartup().then(() => {
+      admitted = true
+    })
+    await vi.waitFor(() => expect(fixture.run).toHaveBeenCalledOnce())
+    expect(admitted).toBe(false)
+    exit.resolve(readyResult(fixture.run.mock.calls[0]?.[0].args?.[2]))
+    await startup
+    expect(admitted).toBe(true)
+  })
+
+  it.each([{ code: 78 }, { timedOut: true }, { outputTruncated: true }])(
+    'refuses a failed child even if it emitted a valid readiness reply: %j',
+    async (failure) => {
+      fixture.run.mockImplementation(async (spec) => ({
+        ...readyResult(spec.args?.[2]),
+        ...failure,
+        stderr: 'native probe failed'
+      }))
+      await expect(preflightBundledOrcadStartup()).rejects.toThrow('native probe failed')
+    }
+  )
+
+  it('preserves configuration exit status from the isolated child', async () => {
+    fixture.run.mockImplementation(async (spec) => ({ ...readyResult(spec.args?.[2]), code: 78 }))
+    const failure = await preflightBundledOrcadStartup().catch((error: unknown) => error)
+    expect(resolveOrcadExitCode(failure)).toBe(78)
+  })
+
+  it('keeps transient SQLite readiness failures retryable', async () => {
+    fixture.sql.mockRejectedValue(new Error('SQLITE_BUSY'))
+    const failure = await runOrcadProfilePreflight(nonce).catch((error: unknown) => error)
+    expect(resolveOrcadExitCode(failure)).toBe(1)
+  })
+
+  it('leaves optional native probes to runtime health on normal startup', async () => {
+    vi.spyOn(console, 'log').mockImplementation(() => {})
+    await runOrcadProfilePreflight(nonce, { nativeFeatures: false })
+    expect(fixture.sql).toHaveBeenCalledOnce()
+    expect(fixture.native).toHaveBeenCalledWith({ nativeFeatures: false })
+  })
+
+  it('rejects stale output from a different challenge', async () => {
+    fixture.run.mockResolvedValue(readyResult(nonce))
+    await expect(preflightBundledOrcadStartup()).rejects.toThrow('invalid readiness identity')
+  })
+
+  it('rechecks the child artifact identity against the verified installed version', async () => {
+    fixture.run.mockImplementation(async (spec) => {
+      const result = readyResult(spec.args?.[2])
+      return { ...result, stdout: result.stdout.replace(identity, '0.1.0+bbbbbbbbbbbb') }
+    })
+    await expect(preflightBundledOrcadStartup()).rejects.toThrow('invalid readiness identity')
+  })
+
+  it('runs disposable probes directly in the command child without recursive spawning', async () => {
+    const output = vi.spyOn(console, 'log').mockImplementation(() => {})
+    await runOrcadProfilePreflight(nonce)
+    expect(fixture.sql).toHaveBeenCalledOnce()
+    expect(fixture.native).toHaveBeenCalledOnce()
+    expect(fixture.run).not.toHaveBeenCalled()
+    expect(output).toHaveBeenCalledWith(readyResult(nonce).stdout)
+  })
+})
diff --git a/src/main/orcad/orcad-profile-preflight.ts b/src/main/orcad/orcad-profile-preflight.ts
new file mode 100644
index 000000000000..eeb5bb611dd9
--- /dev/null
+++ b/src/main/orcad/orcad-profile-preflight.ts
@@ -0,0 +1,93 @@
+import { z } from 'zod'
+import { randomUUID } from 'node:crypto'
+import { readFile } from 'node:fs/promises'
+import { join } from 'node:path'
+import { preflightProfileStateRuntime } from '../persistence/profile-state/profile-state-runtime-preflight'
+import {
+  ORCAD_STARTUP_PREFLIGHT_FLAG,
+  ORCAD_PROFILE_PREFLIGHT_TIMEOUT_MS,
+  parseOrcadProfilePreflight,
+  orcadProfilePreflightResponseSchema,
+  type OrcadProfilePreflightResponse
+} from '../../shared/orcad-profile-preflight'
+import { readOrcadArtifactIdentity } from './orcad-artifact-identity'
+import { resolveOrcadInstallRoot } from './orcad-app-paths'
+import { ORCAD_VERSION_FILENAME, orcadBunRuntimeFilename } from '../../shared/orcad-artifacts'
+import { ORCAD_BUN_VERSION } from '../../shared/orcad-bun-runtime'
+import { runProcess } from '../../shared/child-process/run-process'
+import { preflightOrcadBunNativeRuntime } from './orcad-bun-native-preflight'
+import { OrcadBundledRuntimeError } from './orcad-bundled-runtime'
+
+/** Check every packaged start before a profile index, data-root lock or import is touched. */
+export async function preflightBundledOrcadStartup(): Promise<void> {
+  if (!process.versions.bun) {
+    return
+  }
+  const directory = resolveOrcadInstallRoot()
+  const identity = await readInstalledVersion(directory)
+  const nonce = randomUUID()
+  // Keep disposable SQLite ownership and native state out of the serving process.
+  const result = await runProcess({
+    program: join(directory, orcadBunRuntimeFilename(process.platform)),
+    args: [join(directory, 'orcad.js'), ORCAD_STARTUP_PREFLIGHT_FLAG, nonce],
+    env: { ...process.env, ORCA_BACKGROUND_LAUNCH: '1' },
+    timeoutMs: ORCAD_PROFILE_PREFLIGHT_TIMEOUT_MS,
+    maxOutputBytes: 64 * 1024,
+    terminationBarrier: true
+  })
+  if (result.code !== 0 || result.timedOut || result.outputTruncated) {
+    const Failure = result.code === 78 ? OrcadBundledRuntimeError : Error
+    throw new Failure(`The bundled Orca runtime failed readiness: ${result.stderr}`)
+  }
+  try {
+    parseOrcadProfilePreflight(result.stdout, nonce, ORCAD_BUN_VERSION, identity)
+  } catch (cause) {
+    throw new OrcadBundledRuntimeError('The bundled runtime returned invalid readiness identity', {
+      cause
+    })
+  }
+}
+
+/** Only disposable state is opened; no server, profile index or host adapters are installed. */
+export async function runOrcadProfilePreflight(
+  nonce: string | undefined,
+  options: { nativeFeatures?: boolean } = {}
+): Promise<void> {
+  const checkedNonce = z.string().uuid().parse(nonce)
+  let artifactVersion: string
+  try {
+    artifactVersion = await readOrcadArtifactIdentity(resolveOrcadInstallRoot())
+  } catch (cause) {
+    throw new OrcadBundledRuntimeError('The bundled Orca artifacts are incomplete or altered', {
+      cause
+    })
+  }
+  const result = await preflightProfileStateRuntime()
+  if (process.versions.bun) {
+    await preflightOrcadBunNativeRuntime(options)
+  }
+  const response: OrcadProfilePreflightResponse = {
+    type: 'orca_profile_state_ready',
+    nonce: checkedNonce,
+    runtime: process.versions.bun ? 'bun' : 'node',
+    runtimeVersion: process.versions.bun ?? process.versions.node,
+    artifactVersion,
+    ...result
+  }
+  console.log(JSON.stringify(response))
+}
+
+async function readInstalledVersion(directory: string): Promise<string> {
+  try {
+    return orcadProfilePreflightResponseSchema.shape.artifactVersion.parse(
+      (await readFile(join(directory, ORCAD_VERSION_FILENAME), 'utf8')).trim()
+    )
+  } catch (cause) {
+    throw new OrcadBundledRuntimeError(
+      'The installed Orca artifact version is missing or invalid',
+      {
+        cause
+      }
+    )
+  }
+}
diff --git a/src/main/orcad/orcad-profile-state-startup.test.ts b/src/main/orcad/orcad-profile-state-startup.test.ts
new file mode 100644
index 000000000000..32939c2e078a
--- /dev/null
+++ b/src/main/orcad/orcad-profile-state-startup.test.ts
@@ -0,0 +1,110 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const {
+  createProfileStateStoreForStartupMock,
+  emitMock,
+  ensureActiveOrcaProfileMock,
+  initOrcaProfilePathsMock,
+  initSshHostKeyStoreFileMock
+} = vi.hoisted(() => ({
+  createProfileStateStoreForStartupMock: vi.fn(),
+  emitMock: vi.fn(),
+  ensureActiveOrcaProfileMock: vi.fn(),
+  initOrcaProfilePathsMock: vi.fn(),
+  initSshHostKeyStoreFileMock: vi.fn()
+}))
+
+vi.mock('../persistence/profile-state/profile-state-startup-authority', () => ({
+  createProfileStateStoreForStartup: createProfileStateStoreForStartupMock
+}))
+vi.mock('../orca-profiles/profile-index-store', () => ({
+  ensureActiveOrcaProfile: ensureActiveOrcaProfileMock,
+  initOrcaProfilePaths: initOrcaProfilePathsMock
+}))
+vi.mock('../ssh/ssh-host-key-store', () => ({
+  initSshHostKeyStoreFile: initSshHostKeyStoreFileMock
+}))
+vi.mock('./orcad-profile-state-telemetry', () => ({
+  emitOrcadProfileStateAuthoritySelected: emitMock
+}))
+
+const { createOrcadProfileStateStartup } = await import('./orcad-profile-state-startup')
+
+beforeEach(() => {
+  vi.resetAllMocks()
+  ensureActiveOrcaProfileMock.mockReturnValue({
+    dataFile: '/tmp/profile/orca-data.json',
+    stateDatabaseFile: '/tmp/profile/profile-state.db',
+    profile: { id: 'profile-1' }
+  })
+})
+
+describe('orcad profile-state startup', () => {
+  it('selects the capable authority once and publishes bounded metadata', async () => {
+    const store = { getSettings: vi.fn() }
+    createProfileStateStoreForStartupMock.mockReturnValue({
+      store,
+      authority: { readSerializedState: vi.fn() },
+      backend: 'sqlite',
+      classification: 'json-only',
+      migrated: true
+    })
+
+    const result = await createOrcadProfileStateStartup('/tmp/user-data')
+
+    expect(initOrcaProfilePathsMock).toHaveBeenCalledOnce()
+    expect(ensureActiveOrcaProfileMock).toHaveBeenCalledWith('/tmp/user-data')
+    expect(initSshHostKeyStoreFileMock).toHaveBeenCalledWith('/tmp/profile/orca-data.json')
+
+    expect(createProfileStateStoreForStartupMock).toHaveBeenCalledWith({
+      dataFile: '/tmp/profile/orca-data.json',
+      databaseFile: '/tmp/profile/profile-state.db',
+      profileId: 'profile-1',
+      runtime: 'orcad',
+      storageAuthority: 'runtime'
+    })
+    expect(result.store).toBe(store)
+    expect(result.authority).toEqual({
+      backend: 'sqlite',
+      classification: 'json-only',
+      authority_mode: 'sqlite-established',
+      runtime: 'orcad',
+      migrated: true
+    })
+    expect(emitMock).toHaveBeenCalledWith(result.authority)
+  })
+
+  it('publishes nothing before the profile writer is ready', async () => {
+    let refuse = (_error: Error) => {}
+    createProfileStateStoreForStartupMock.mockImplementationOnce(
+      () =>
+        new Promise((_resolve, reject) => {
+          refuse = reject
+        })
+    )
+    const startup = createOrcadProfileStateStartup('/tmp/user-data')
+    const failure = new Error('writer startup refused')
+    const rejected = expect(startup).rejects.toBe(failure)
+    expect(initSshHostKeyStoreFileMock).not.toHaveBeenCalled()
+    expect(emitMock).not.toHaveBeenCalled()
+    refuse(failure)
+    await rejected
+  })
+
+  it('closes a ready writer if sidecar initialization fails', async () => {
+    const store = { freezeWritesAsync: vi.fn(async () => {}) }
+    createProfileStateStoreForStartupMock.mockResolvedValueOnce({
+      store,
+      backend: 'sqlite',
+      classification: 'sqlite-only',
+      migrated: false
+    })
+    const failure = new Error('sidecar initialization refused')
+    initSshHostKeyStoreFileMock.mockImplementationOnce(() => {
+      throw failure
+    })
+    await expect(createOrcadProfileStateStartup('/tmp/user-data')).rejects.toBe(failure)
+    expect(store.freezeWritesAsync).toHaveBeenCalledOnce()
+    expect(emitMock).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/main/orcad/orcad-profile-state-startup.ts b/src/main/orcad/orcad-profile-state-startup.ts
new file mode 100644
index 000000000000..dba093659931
--- /dev/null
+++ b/src/main/orcad/orcad-profile-state-startup.ts
@@ -0,0 +1,59 @@
+import { createProfileStateStoreForStartup } from '../persistence/profile-state/profile-state-startup-authority'
+import type { ProfileStateStoreFactoryResult } from '../persistence/profile-state/profile-state-store-factory'
+import { ensureActiveOrcaProfile, initOrcaProfilePaths } from '../orca-profiles/profile-index-store'
+import { initSshHostKeyStoreFile } from '../ssh/ssh-host-key-store'
+import { emitOrcadProfileStateAuthoritySelected } from './orcad-profile-state-telemetry'
+
+export type OrcadProfileStateProfile = {
+  dataFile: string
+  stateDatabaseFile: string
+  profile: { id: string }
+}
+
+export type OrcadProfileStateStartup = {
+  store: ProfileStateStoreFactoryResult['store']
+  authority: {
+    backend: ProfileStateStoreFactoryResult['backend']
+    classification: ProfileStateStoreFactoryResult['classification']
+    authority_mode: 'sqlite-established'
+    runtime: 'orcad'
+    migrated: boolean
+  }
+}
+
+/** Build the headless Store and publish its authority selection at one Node-only seam. */
+export async function createOrcadProfileStateStartup(
+  userDataPath: string
+): Promise<OrcadProfileStateStartup> {
+  initOrcaProfilePaths()
+  const profile = ensureActiveOrcaProfile(userDataPath)
+  const result = await createProfileStateStoreForStartup({
+    dataFile: profile.dataFile,
+    databaseFile: profile.stateDatabaseFile,
+    profileId: profile.profile.id,
+    runtime: 'orcad',
+    storageAuthority: 'runtime'
+  })
+  const authority = {
+    backend: result.backend,
+    classification: result.classification,
+    authority_mode: 'sqlite-established' as const,
+    runtime: 'orcad' as const,
+    migrated: result.migrated
+  }
+  try {
+    initSshHostKeyStoreFile(profile.dataFile)
+    emitOrcadProfileStateAuthoritySelected(authority)
+    return { store: result.store, authority }
+  } catch (error) {
+    try {
+      await result.store.freezeWritesAsync()
+    } catch (closeError) {
+      console.error(
+        '[persistence] Failed to close profile persistence after startup failure:',
+        closeError
+      )
+    }
+    throw error
+  }
+}
diff --git a/src/main/orcad/orcad-profile-state-telemetry.test.ts b/src/main/orcad/orcad-profile-state-telemetry.test.ts
new file mode 100644
index 000000000000..9302990de1b5
--- /dev/null
+++ b/src/main/orcad/orcad-profile-state-telemetry.test.ts
@@ -0,0 +1,46 @@
+import { describe, expect, it, vi } from 'vitest'
+import {
+  emitOrcadProfileStateAuthoritySelected,
+  formatOrcadProfileStateAuthoritySelected,
+  type OrcadProfileStateAuthoritySelection
+} from './orcad-profile-state-telemetry'
+
+const selection: OrcadProfileStateAuthoritySelection = {
+  backend: 'sqlite',
+  classification: 'json-only',
+  authority_mode: 'sqlite-established',
+  runtime: 'orcad',
+  migrated: true
+}
+
+describe('orcad profile-state telemetry', () => {
+  it('formats a bounded machine-readable authority selection event', () => {
+    expect(JSON.parse(formatOrcadProfileStateAuthoritySelected(selection).slice(18))).toEqual({
+      event: 'profile_state_authority_selected',
+      ...selection
+    })
+  })
+
+  it('strips unexpected runtime fields before writing the record', () => {
+    const selectionWithRuntimeFields = Object.assign({}, selection, {
+      database_path: '/private/profile-state.db'
+    })
+    const line = formatOrcadProfileStateAuthoritySelected(selectionWithRuntimeFields)
+    expect(line).not.toContain('database_path')
+  })
+
+  it('sends the event to the supplied sink', () => {
+    const sink = vi.fn()
+    emitOrcadProfileStateAuthoritySelected(selection, sink)
+    expect(sink).toHaveBeenCalledOnce()
+    expect(sink).toHaveBeenCalledWith(formatOrcadProfileStateAuthoritySelected(selection))
+  })
+
+  it('never lets a failing sink block startup', () => {
+    expect(() =>
+      emitOrcadProfileStateAuthoritySelected(selection, () => {
+        throw new Error('closed stderr')
+      })
+    ).not.toThrow()
+  })
+})
diff --git a/src/main/orcad/orcad-profile-state-telemetry.ts b/src/main/orcad/orcad-profile-state-telemetry.ts
new file mode 100644
index 000000000000..0e53dc31a67c
--- /dev/null
+++ b/src/main/orcad/orcad-profile-state-telemetry.ts
@@ -0,0 +1,46 @@
+import type { ProfileStateStorageClassification } from '../persistence/profile-state/profile-state-storage-classification'
+
+/**
+ * The low-cardinality profile-state selection facts that a headless host can publish safely.
+ * Paths, profile IDs, and serialized state deliberately stay out of this record.
+ */
+export type OrcadProfileStateAuthoritySelection = {
+  backend: 'sqlite'
+  classification: ProfileStateStorageClassification
+  authority_mode: 'sqlite-established'
+  runtime: 'orcad'
+  migrated: boolean
+}
+
+export type OrcadProfileStateTelemetrySink = (line: string) => void
+
+/** Render one machine-readable stderr line for fleet log collection. */
+export function formatOrcadProfileStateAuthoritySelected(
+  selection: OrcadProfileStateAuthoritySelection
+): string {
+  // Keep the wire shape explicit even if a future caller passes a structurally-compatible
+  // object with extra runtime fields. Paths, IDs, and serialized state must never leak here.
+  return `[orcad-telemetry] ${JSON.stringify({
+    event: 'profile_state_authority_selected',
+    backend: selection.backend,
+    classification: selection.classification,
+    authority_mode: selection.authority_mode,
+    runtime: selection.runtime,
+    migrated: selection.migrated
+  })}`
+}
+
+/**
+ * Publish authority selection without importing Electron or the desktop PostHog client.
+ * Logging is best-effort: observability must never prevent an orcad host from serving.
+ */
+export function emitOrcadProfileStateAuthoritySelected(
+  selection: OrcadProfileStateAuthoritySelection,
+  sink: OrcadProfileStateTelemetrySink = (line) => console.error(line)
+): void {
+  try {
+    sink(formatOrcadProfileStateAuthoritySelected(selection))
+  } catch {
+    // A closed stderr or custom supervisor sink cannot turn a successful startup into a failure.
+  }
+}
diff --git a/src/main/orcad/orcad-push-startup.test.ts b/src/main/orcad/orcad-push-startup.test.ts
index a8fbbc9fe162..21ad507c0164 100644
--- a/src/main/orcad/orcad-push-startup.test.ts
+++ b/src/main/orcad/orcad-push-startup.test.ts
@@ -1,4 +1,4 @@
-import { mkdtempSync, rmSync } from 'node:fs'
+import { mkdtempSync, readdirSync, rmSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, expect, it, vi } from 'vitest'
@@ -6,12 +6,15 @@ import { DeviceRegistry } from '../runtime/device-registry'
 import { RuntimeMobileNotificationController } from '../runtime/runtime-mobile-notification-controller'
 import { PushUnregisterOutbox } from '../runtime/push/push-unregister-outbox'
 import { createPushHostKeypair } from '../runtime/push/push-host-challenge-fixtures'
+import { acquireProfileStateMaintenance } from '../persistence/profile-state/profile-state-access'
+import { profileStateAccessPaths } from '../persistence/profile-state/profile-state-access-owner'
 
 const state = vi.hoisted(() => ({
   root: '',
   controller: null as RuntimeMobileNotificationController | null,
   registry: null as DeviceRegistry | null,
   rpcStarted: false,
+  browserProvider: vi.fn(async () => null),
   register: vi.fn(async () => ({ ok: true, registrationId: 'headless-registration' })),
   send: vi.fn(async () => ({ ok: true, results: [] }))
 }))
@@ -20,7 +23,7 @@ vi.mock('./orcad-app-paths', () => ({
   resolveOrcadPath: () => state.root,
   resolveUserDataPath: () => state.root
 }))
-vi.mock('./orcad-browser-provider', () => ({ resolveOrcadBrowserProvider: async () => null }))
+vi.mock('./orcad-browser-provider', () => ({ resolveOrcadBrowserProvider: state.browserProvider }))
 vi.mock('./orcad-instance-lock', () => ({ acquireOrcadInstanceLock: () => ({ release() {} }) }))
 vi.mock('./orcad-daemon-supervision', () => ({
   startOrcadDaemon: async () => {},
@@ -33,16 +36,29 @@ vi.mock('../ipc/pty', () => ({
   getLocalPtyProvider: () => null,
   getSshPtyProvider: () => null
 }))
-vi.mock('../persistence/loading-store/store', () => ({
-  Store: class {
-    getSettings() {
-      return {}
+vi.mock('./orcad-profile-state-startup', () => ({
+  createOrcadProfileStateStartup: async () => ({
+    store: {
+      getSettings: () => ({}),
+      flushFinalOrThrowAsync: async () => {},
+      freezeWritesAsync: async () => {}
+    },
+    authority: {
+      backend: 'sqlite',
+      classification: 'neither',
+      authority_mode: 'sqlite-candidate',
+      runtime: 'orcad',
+      migrated: false
     }
-  }
+  })
 }))
 vi.mock('../orca-profiles/profile-index-store', () => ({
   initOrcaProfilePaths() {},
-  ensureActiveOrcaProfile: () => ({ dataFile: join(state.root, 'profile.json') })
+  ensureActiveOrcaProfile: () => ({
+    dataFile: join(state.root, 'profile.json'),
+    stateDatabaseFile: join(state.root, 'profile-state.db'),
+    profile: { id: 'headless-profile' }
+  })
 }))
 vi.mock('../ssh/ssh-host-key-store', () => ({ initSshHostKeyStoreFile() {} }))
 vi.mock('../server/serve-readiness', () => ({
@@ -109,6 +125,19 @@ afterEach(() => {
   vi.clearAllMocks()
 })
 
+it('refuses recovery overlap before initializing the browser provider or runtime', async () => {
+  state.root = mkdtempSync(join(tmpdir(), 'orca-headless-recovery-'))
+  const maintenance = acquireProfileStateMaintenance(state.root)
+  const { startOrcad } = await import('./orcad-entry')
+  try {
+    await expect(startOrcad({ noPairing: true, json: true })).rejects.toThrow()
+    expect(state.browserProvider).not.toHaveBeenCalled()
+    expect(state.rpcStarted).toBe(false)
+  } finally {
+    maintenance.release()
+  }
+})
+
 it('starts push after RPC identity is available and stops dispatch on shutdown', async () => {
   state.root = mkdtempSync(join(tmpdir(), 'orca-headless-push-'))
   state.controller = new RuntimeMobileNotificationController()
@@ -140,8 +169,19 @@ it('starts push after RPC identity is available and stops dispatch on shutdown',
   } finally {
     await host.stop()
   }
+  expect(readdirSync(profileStateAccessPaths(state.root).participants)).toEqual([])
+  acquireProfileStateMaintenance(state.root).release()
   expect(state.controller.getListenerCount()).toBe(0)
   expect(await state.controller.registerPushDevice({} as never)).toMatchObject({
     registered: false
   })
 })
+
+it('releases admission when host setup fails before a runtime exists', async () => {
+  state.root = mkdtempSync(join(tmpdir(), 'orca-headless-setup-failure-'))
+  state.browserProvider.mockRejectedValueOnce(new Error('browser setup failed'))
+  const { startOrcad } = await import('./orcad-entry')
+  await expect(startOrcad()).rejects.toThrow('browser setup failed')
+  expect(readdirSync(profileStateAccessPaths(state.root).participants)).toEqual([])
+  acquireProfileStateMaintenance(state.root).release()
+})
diff --git a/src/main/orcad/orcad-sidecar-runtime-client.test.ts b/src/main/orcad/orcad-sidecar-runtime-client.test.ts
index 1ec2055c0d24..64d81444c541 100644
--- a/src/main/orcad/orcad-sidecar-runtime-client.test.ts
+++ b/src/main/orcad/orcad-sidecar-runtime-client.test.ts
@@ -39,14 +39,16 @@ describe('sidecar response framing', () => {
     const wire = `${JSON.stringify({ id, ok: true, result: 'x'.repeat(1024 * 1024) })}\n`
     const originalIndexOf = String.prototype.indexOf
     let searchedCharacters = 0
-    const search = vi
-      .spyOn(String.prototype, 'indexOf')
-      .mockImplementation(function (this: string, value, position) {
-        if (value === '\n') {
-          searchedCharacters += this.length - (position ?? 0)
-        }
-        return originalIndexOf.call(this, value, position)
-      })
+    const search = vi.spyOn(String.prototype, 'indexOf').mockImplementation(function (
+      this: string,
+      value,
+      position
+    ) {
+      if (value === '\n') {
+        searchedCharacters += this.length - (position ?? 0)
+      }
+      return originalIndexOf.call(this, value, position)
+    })
     try {
       for (let offset = 0; offset < wire.length; offset += 256) {
         socket.emit('data', wire.slice(offset, offset + 256))
diff --git a/src/main/persistence-async-write-syscalls.test.ts b/src/main/persistence-async-write-syscalls.test.ts
index 282dc1e29882..27943f12faca 100644
--- a/src/main/persistence-async-write-syscalls.test.ts
+++ b/src/main/persistence-async-write-syscalls.test.ts
@@ -1,166 +1,106 @@
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
-import {
-  existsSync,
-  mkdtempSync,
-  readFileSync,
-  readdirSync,
-  rmSync,
-  utimesSync,
-  writeFileSync
-} from 'node:fs'
+import { existsSync } from 'node:fs'
 import type * as NodeFs from 'node:fs'
 import type * as NodeFsPromises from 'node:fs/promises'
-import { join } from 'node:path'
-import { tmpdir } from 'node:os'
-import type { SshRemotePtyLeaseState } from '../shared/ssh-types'
-import { installFakeAppEnvironment } from '../../config/scripts/vitest-host-ports-setup'
+import {
+  createWorkerMaintenanceFixture,
+  createSqliteMaintenanceFixture,
+  maintenanceBarrier
+} from './persistence/loading-store/profile-state-maintenance-fixture'
+import { profileStateDatabaseBackups } from './persistence/profile-state/profile-state-backup-path'
+import { ProfileStateSqliteAuthority } from './persistence/profile-state/profile-state-sqlite-authority'
+import type { ProfileStateWorkerAuthority } from './persistence/profile-state/profile-state-worker-authority'
+
+type FilesystemCalls = {
+  directory: string
+  recording: boolean
+  sync: string[]
+  waitAsync: ((name: string, path: string) => Promise<void> | undefined) | undefined
+}
 
-const testState = { dir: '' }
+const fsCalls = vi.hoisted((): FilesystemCalls => ({
+  directory: '',
+  recording: false,
+  sync: [],
+  waitAsync: undefined
+}))
 
-const fsCalls = vi.hoisted(() => {
-  const blocker = new Int32Array(new SharedArrayBuffer(4))
-  const calls = {
-    recording: false,
-    dirPrefix: '',
-    /** When > 0, every recorded sync call parks the main thread this long — a stalled mount in miniature. */
-    stallMs: 0,
-    syncCalls: [] as string[],
-    asyncCalls: [] as string[],
-    failAsync: null as ((fn: string, target: string) => NodeJS.ErrnoException | null) | null,
-    beforeAsync: null as ((fn: string, target: string) => void) | null,
-    waitAsync: null as ((fn: string, target: string) => Promise<void> | null) | null,
-    reset(): void {
-      calls.syncCalls.length = 0
-      calls.asyncCalls.length = 0
-      calls.stallMs = 0
-      calls.failAsync = null
-      calls.beforeAsync = null
-      calls.waitAsync = null
-    },
-    inScope(target: unknown): target is string {
-      return (
-        calls.recording &&
-        typeof target === 'string' &&
-        calls.dirPrefix !== '' &&
-        target.startsWith(calls.dirPrefix)
-      )
-    },
-    recordSync(fn: string, target: unknown): void {
-      if (!calls.inScope(target)) {
-        return
-      }
-      calls.syncCalls.push(`${fn}:${target}`)
-      if (calls.stallMs > 0) {
-        // Atomics.wait blocks the thread the way an uninterruptible syscall does.
-        Atomics.wait(blocker, 0, 0, calls.stallMs)
-      }
-    },
-    recordAsync(fn: string, target: unknown): NodeJS.ErrnoException | null {
-      if (!calls.inScope(target)) {
-        return null
-      }
-      calls.asyncCalls.push(`${fn}:${target}`)
-      calls.beforeAsync?.(fn, target)
-      return calls.failAsync?.(fn, target) ?? null
-    }
+vi.mock('node:fs', async (importOriginal) => {
+  function isSynchronousFilesystemCall(
+    name: string,
+    value: unknown
+  ): value is (...args: unknown[]) => unknown {
+    return name.endsWith('Sync') && typeof value === 'function'
   }
-  return calls
-})
 
-vi.mock('node:fs', async (importOriginal) => {
   const actual = await importOriginal<typeof NodeFs>()
   const patched: Record<string, unknown> = { ...actual }
-  for (const name of Object.keys(actual)) {
-    const original = (actual as unknown as Record<string, unknown>)[name]
-    if (!name.endsWith('Sync') || typeof original !== 'function') {
+  for (const [name, original] of Object.entries(actual)) {
+    if (!isSynchronousFilesystemCall(name, original)) {
       continue
     }
-    const fn = original as (...args: unknown[]) => unknown
-    const wrapper = (...args: unknown[]): unknown => {
-      fsCalls.recordSync(name, args[0])
-      return fn(...args)
-    }
-    patched[name] = Object.assign(wrapper, fn)
+    patched[name] = Object.assign((...args: unknown[]) => {
+      const path = args[0]
+      if (fsCalls.recording && typeof path === 'string' && path.startsWith(fsCalls.directory)) {
+        fsCalls.sync.push(`${name}:${path}`)
+      }
+      return original(...args)
+    }, original)
   }
   return { ...patched, default: patched }
 })
 
 vi.mock('node:fs/promises', async (importOriginal) => {
   const actual = await importOriginal<typeof NodeFsPromises>()
-  const patched: Record<string, unknown> = { ...actual }
-  for (const name of ['stat', 'access', 'rename', 'copyFile', 'rm', 'mkdir', 'open']) {
-    const fn = (actual as unknown as Record<string, (...args: unknown[]) => unknown>)[name]
-    patched[name] = async (...args: unknown[]): Promise<unknown> => {
-      const failure = fsCalls.recordAsync(name, args[0])
-      if (failure) {
-        throw failure
-      }
+  return {
+    ...actual,
+    rename: async (...args: Parameters<typeof actual.rename>) => {
       if (typeof args[0] === 'string') {
-        await fsCalls.waitAsync?.(name, args[0])
+        await fsCalls.waitAsync?.('rename', args[0])
       }
-      return fn(...args)
+      return actual.rename(...args)
     }
   }
-  return { ...patched, default: patched }
 })
-
+vi.mock('./telemetry/client', () => ({ track: vi.fn() }))
+vi.mock('./telemetry/cohort-classifier', () => ({ getCohortAtEmit: () => ({ nth_repo_added: 2 }) }))
 vi.mock('./ssh/ssh-config-parser', () => ({
-  loadUserSshConfig: vi.fn(),
-  sshConfigHostsToTargets: vi.fn()
+  loadUserSshConfig: () => ({ hosts: [] }),
+  sshConfigHostsToTargets: () => []
 }))
 
-vi.mock('./telemetry/client', () => ({ track: vi.fn() }))
+beforeEach(() => {
+  fsCalls.recording = false
+  fsCalls.directory = ''
+  fsCalls.sync = []
+  fsCalls.waitAsync = undefined
+})
+afterEach(() => {
+  fsCalls.recording = false
+})
 
-vi.mock('./telemetry/cohort-classifier', () => ({
-  getCohortAtEmit: vi.fn().mockReturnValue({ nth_repo_added: 2 })
-}))
+function record(directory: string): void {
+  fsCalls.directory = directory
+  fsCalls.sync = []
+  fsCalls.recording = true
+}
 
-// Deterministic cipher so two stores driven through identical mutations produce identical bytes.
-vi.mock('electron', () => ({
-  app: { getPath: () => testState.dir },
-  safeStorage: {
-    isEncryptionAvailable: () => true,
-    encryptString: (plaintext: string) => Buffer.from(`enc:${plaintext}`, 'utf-8'),
-    decryptString: (ciphertext: Buffer) => ciphertext.toString('utf-8').slice('enc:'.length)
+function pauseCommit(authority: ProfileStateWorkerAuthority) {
+  const started = maintenanceBarrier()
+  const finish = maintenanceBarrier()
+  let held = false
+  for (const name of ['writeSerializedDomains', 'writeCompleteSerializedDomains'] as const) {
+    const original = authority[name].bind(authority)
+    vi.spyOn(authority, name).mockImplementation(async (replacements) => {
+      if (!held) {
+        held = true
+        started.resolve()
+        await finish.promise
+      }
+      await original(replacements)
+    })
   }
-}))
-
-const BACKUP_COUNT = 5
-const BACKUP_MIN_INTERVAL_MS = 60 * 60 * 1000
-const PAST_ROTATION_INTERVAL_MS = BACKUP_MIN_INTERVAL_MS * 2
-const SAVE_DEBOUNCE_MS = 1_000
-
-const ROTATION_INTERLEAVE_CASES = [
-  ['initial access', 'access', ''],
-  ['oldest removal', 'rm', '.bak.4'],
-  ['slot access', 'access', '.bak.0'],
-  ['slot rename', 'rename', '.bak.0'],
-  ['final copy', 'copyFile', '']
-] as const
-
-type TestStore = {
-  updateUI(updates: { sidebarWidth: number }): void
-  setGitHubCache(cache: { pr: Record<string, never>; issue: Record<string, never> }): void
-  waitForPendingWrite(): Promise<void>
-  flushOrThrow(): void
-  flushPendingAsync(): Promise<void>
-  flushPendingOrThrowAsync(options?: { drainToStableGeneration?: boolean }): Promise<void>
-  upsertSshPtyConsumerRecovery(record: {
-    targetId: string
-    clientInstanceId: string
-    serverBuildId: string
-    clientGeneration: number
-    ownerGeneration: number
-    ownerLease: string
-  }): Promise<void>
-  removeSshPtyConsumerRecovery(targetId: string): Promise<void>
-  upsertSshRemotePtyLease(lease: {
-    targetId: string
-    ptyId: string
-    state: SshRemotePtyLeaseState
-  }): void
-  markSshRemotePtyLeasesAsync(targetId: string, state: SshRemotePtyLeaseState): Promise<void>
-  markSshRemotePtyLeasesAttachedAsync(targetId: string, ptyIds: readonly string[]): Promise<void>
+  return { started: started.promise, release: finish.resolve }
 }
 
 function consumerRecovery(clientInstanceId: string) {
@@ -174,655 +114,221 @@ function consumerRecovery(clientInstanceId: string) {
   }
 }
 
-async function createStore(dir: string): Promise<TestStore> {
-  testState.dir = dir
-  vi.resetModules()
-  const { Store, initDataPath } = await import('./persistence')
-  // Why here: userData resolves through AppEnvironment, and this must point at this
-  // file's temp dir rather than the global fake's shared one, after resetModules.
-  installFakeAppEnvironment({ getPath: () => testState.dir })
-  initDataPath()
-  return new Store() as unknown as TestStore
-}
-
-function dataFile(dir: string): string {
-  return join(dir, 'orca-data.json')
-}
-
-function deferred(): { promise: Promise<void>; resolve: () => void } {
-  let resolve!: () => void
-  const promise = new Promise<void>((next) => {
-    resolve = next
-  })
-  return { promise, resolve }
-}
-
-function recordFsCalls(dir: string): void {
-  fsCalls.dirPrefix = dir
-  fsCalls.recording = true
-}
-
-function delayNextDataFileRename(dir: string): ReturnType<typeof deferred> & {
-  started: Promise<void>
-} {
-  const release = deferred()
-  const started = deferred()
-  let held = false
-  fsCalls.waitAsync = (fn, target) => {
-    if (held || fn !== 'rename' || !target.startsWith(dataFile(dir))) {
-      return null
-    }
-    held = true
-    started.resolve()
-    return release.promise
-  }
-  return { ...release, started: started.promise }
-}
-
-function seedStaleBackup(dir: string): void {
-  const path = `${dataFile(dir)}.bak.0`
-  writeFileSync(path, '{"stale":true}', 'utf-8')
-  const staleSeconds = (Date.now() - PAST_ROTATION_INTERVAL_MS) / 1000
-  utimesSync(path, staleSeconds, staleSeconds)
-}
-
-function ringSnapshot(dir: string): Record<string, string> {
-  const snapshot: Record<string, string> = {}
-  for (const name of readdirSync(dir).sort()) {
-    if (name === 'orca-data.json' || name.startsWith('orca-data.json.bak.')) {
-      snapshot[name] = readFileSync(join(dir, name), 'utf-8')
-    }
+function readBackup(path: string) {
+  const reader = new ProfileStateSqliteAuthority(path, 'maintenance-test')
+  try {
+    return JSON.parse(reader.readSerializedState() ?? '{}')
+  } finally {
+    reader.close()
   }
-  return snapshot
 }
 
-describe('async persistence write path avoids synchronous fs syscalls', () => {
-  const dirs: string[] = []
-
-  function makeDir(): string {
-    const dir = mkdtempSync(join(tmpdir(), 'orca-async-write-'))
-    dirs.push(dir)
-    return dir
-  }
-
-  beforeEach(() => {
+describe('worker persistence avoids synchronous profile filesystem calls', () => {
+  it('commits and creates a real SQLite backup without synchronous profile syscalls', async () => {
+    const { store, authority, directory, databaseFile, dataFile, readState } =
+      await createWorkerMaintenanceFixture()
+    record(directory)
+    store.updateUI({ sidebarWidth: 301 })
+    await store.flushPendingOrThrowAsync()
+    await authority.drainBackups()
     fsCalls.recording = false
-    fsCalls.dirPrefix = ''
-    fsCalls.reset()
-    vi.useFakeTimers()
+    expect(fsCalls.sync).toEqual([])
+    expect(readState().ui.sidebarWidth).toBe(301)
+    const backups = profileStateDatabaseBackups(databaseFile)
+    expect(backups).toHaveLength(1)
+    expect(readBackup(backups[0].path).ui.sidebarWidth).toBe(301)
+    expect(existsSync(dataFile)).toBe(false)
+    expect(existsSync(`${dataFile}.bak.0`)).toBe(false)
   })
 
-  afterEach(() => {
+  it('keeps five hourly SQL backups and skips rotation within the hour without sync syscalls', async () => {
+    const start = Date.now()
+    vi.spyOn(Date, 'now').mockReturnValue(start)
+    const { store, authority, directory, databaseFile } = await createWorkerMaintenanceFixture()
+    record(directory)
+    for (let index = 0; index < 6; index++) {
+      vi.mocked(Date.now).mockReturnValue(start + index * 3_600_001)
+      store.updateUI({ sidebarWidth: 310 + index })
+      await store.flushPendingOrThrowAsync()
+      await authority.drainBackups()
+    }
+    store.updateUI({ sidebarWidth: 399 })
+    await store.flushPendingOrThrowAsync()
+    await authority.drainBackups()
     fsCalls.recording = false
-    vi.useRealTimers()
-    while (dirs.length > 0) {
-      rmSync(dirs.pop() as string, { recursive: true, force: true })
-    }
-  })
-
-  async function recordAsyncSave(
-    store: TestStore,
-    dir: string,
-    sidebarWidth: number
-  ): Promise<void> {
-    store.updateUI({ sidebarWidth })
-    recordFsCalls(dir)
-    try {
-      vi.advanceTimersByTime(PAST_ROTATION_INTERVAL_MS)
-      await store.waitForPendingWrite()
-    } finally {
-      fsCalls.recording = false
-    }
-  }
-
-  it('issues no sync fs syscall under the profile dir when rotation runs with an empty ring', async () => {
-    const dir = makeDir()
-    const store = await createStore(dir)
-
-    await recordAsyncSave(store, dir, 301)
-
-    expect(fsCalls.syncCalls).toEqual([])
-    // Rotation must actually have happened, else the assertion above is vacuous.
-    expect(ringSnapshot(dir)['orca-data.json.bak.0']).toBe(readFileSync(dataFile(dir), 'utf-8'))
-  })
-
-  it('uses an awaited stat, not statSync, for the backup rotation interval check', async () => {
-    const dir = makeDir()
-    const store = await createStore(dir)
-    seedStaleBackup(dir)
-
-    await recordAsyncSave(store, dir, 302)
-
-    expect(fsCalls.syncCalls).toEqual([])
-    expect(fsCalls.asyncCalls).toContain(`stat:${dataFile(dir)}.bak.0`)
-  })
-
-  it('issues no sync fs syscall while rotating a saturated ring', async () => {
-    const dir = makeDir()
-    const store = await createStore(dir)
-
-    // One more save than the ring holds, so the oldest slot is evicted and every slot renames.
-    for (let i = 0; i <= BACKUP_COUNT; i++) {
-      await recordAsyncSave(store, dir, 310 + i)
-    }
-
-    expect(fsCalls.syncCalls).toEqual([])
-    const ring = ringSnapshot(dir)
-    expect(Object.keys(ring)).toContain(`orca-data.json.bak.${BACKUP_COUNT - 1}`)
-    expect(Object.keys(ring)).not.toContain(`orca-data.json.bak.${BACKUP_COUNT}`)
-  })
-
-  it('lets a main-thread timer keep firing while a rotating save is in flight', async () => {
-    // A recorded sync call stalls long enough for the heartbeat to catch it.
-    vi.useRealTimers()
-    const dir = makeDir()
-    const store = await createStore(dir)
-    seedStaleBackup(dir)
-    // Generous stall so ordinary scheduler/GC jitter can't reach the threshold on a loaded CI box.
-    const stallMs = 500
-
-    let lastTick = Date.now()
-    let worstGapMs = 0
-    const heartbeat = setInterval(() => {
-      const now = Date.now()
-      worstGapMs = Math.max(worstGapMs, now - lastTick)
-      lastTick = now
-    }, 10)
-
-    try {
-      store.updateUI({ sidebarWidth: 341 })
-      fsCalls.dirPrefix = dir
-      fsCalls.stallMs = stallMs
-      fsCalls.recording = true
-      lastTick = Date.now()
-      await new Promise((resolve) => setTimeout(resolve, SAVE_DEBOUNCE_MS + 200))
-      await store.waitForPendingWrite()
-    } finally {
-      fsCalls.recording = false
-      clearInterval(heartbeat)
-    }
-
-    expect(worstGapMs).toBeLessThan(stallMs)
-    // The save really happened, so a small gap isn't just an absent write.
-    expect(ringSnapshot(dir)['orca-data.json.bak.0']).toBe(readFileSync(dataFile(dir), 'utf-8'))
-  }, 20_000)
-
-  it('skips rotation when a sync flush rotated during the rotation-interval await', async () => {
-    // The acquired owner keeps rotation when the flush skips the ring.
-    const dir = makeDir()
-    const store = await createStore(dir)
-    seedStaleBackup(dir)
-    const staleBackup = readFileSync(`${dataFile(dir)}.bak.0`, 'utf-8')
-
-    store.updateUI({ sidebarWidth: 361 })
-    recordFsCalls(dir)
-    let flushed = false
-    fsCalls.beforeAsync = (fn, target) => {
-      if (flushed || fn !== 'stat' || !target.endsWith('.bak.0')) {
-        return
-      }
-      flushed = true
-      store.updateUI({ sidebarWidth: 362 })
-      store.flushOrThrow()
-    }
-    try {
-      vi.advanceTimersByTime(PAST_ROTATION_INTERVAL_MS)
-      await store.waitForPendingWrite()
-    } finally {
-      fsCalls.recording = false
-      fsCalls.beforeAsync = null
-    }
-
-    expect(flushed).toBe(true)
-    const ring = ringSnapshot(dir)
-    expect(ring['orca-data.json.bak.0']).toBe(ring['orca-data.json'])
-    expect(ring['orca-data.json.bak.1']).toBe(staleBackup)
-    expect(ring['orca-data.json.bak.2']).toBeUndefined()
+    expect(fsCalls.sync).toEqual([])
+    const backups = profileStateDatabaseBackups(databaseFile)
+    expect(backups).toHaveLength(5)
+    expect(backups.map((backup) => readBackup(backup.path).ui.sidebarWidth)).toEqual([
+      315, 314, 313, 312, 311
+    ])
   })
 
-  it('a sync checkpoint vetoes an async write already parked on rename', async () => {
-    const dir = makeDir()
-    const store = await createStore(dir)
-    const rename = delayNextDataFileRename(dir)
-
-    recordFsCalls(dir)
-    store.updateUI({ sidebarWidth: 501 })
-    vi.advanceTimersByTime(SAVE_DEBOUNCE_MS)
-    const pending = store.waitForPendingWrite()
-    await rename.started
-
-    store.updateUI({ sidebarWidth: 502 })
-    store.flushOrThrow()
-    expect(JSON.parse(readFileSync(dataFile(dir), 'utf-8')).ui.sidebarWidth).toBe(502)
-
-    rename.resolve()
+  it('keeps the event loop live while a SQL acknowledgement is stalled', async () => {
+    const { store, authority, directory, readState } = await createWorkerMaintenanceFixture()
+    const gate = pauseCommit(authority)
+    record(directory)
+    const pending = store.upsertSshPtyConsumerRecovery(consumerRecovery('client-1'))
+    await gate.started
+    let complete = false
+    void pending.then(() => {
+      complete = true
+    })
+    await new Promise((resolve) => setTimeout(resolve, 20))
+    expect(complete).toBe(false)
+    expect(fsCalls.sync).toEqual([])
+    gate.release()
     await pending
     fsCalls.recording = false
-    fsCalls.waitAsync = null
-
-    expect(JSON.parse(readFileSync(dataFile(dir), 'utf-8')).ui.sidebarWidth).toBe(502)
-    expect(readdirSync(dir).filter((name) => name.endsWith('.tmp'))).toHaveLength(0)
+    expect(readState().sshPtyConsumerRecoveries[0].clientInstanceId).toBe('client-1')
   })
 
-  it('retries a genuine ENOENT instead of marking the state persisted', async () => {
-    const dir = makeDir()
-    const store = await createStore(dir)
-    const errors = vi.spyOn(console, 'error').mockImplementation(() => {})
-    recordFsCalls(dir)
-    fsCalls.failAsync = (fn, target) =>
-      fn === 'rename' && target.startsWith(dataFile(dir)) && !target.includes('.bak.')
-        ? Object.assign(new Error('mount disappeared'), { code: 'ENOENT' })
-        : null
-
-    store.updateUI({ sidebarWidth: 511 })
-    await store.flushPendingAsync()
-    expect(existsSync(dataFile(dir))).toBe(false)
-
-    fsCalls.failAsync = null
-    await store.flushPendingAsync()
-    fsCalls.recording = false
-    errors.mockRestore()
-
-    expect(JSON.parse(readFileSync(dataFile(dir), 'utf-8')).ui.sidebarWidth).toBe(511)
-  })
-
-  it('the throwing async barrier drains mutations made during its write', async () => {
-    const dir = makeDir()
-    const store = await createStore(dir)
-    const rename = delayNextDataFileRename(dir)
-    recordFsCalls(dir)
-
+  it('drains a newer mutation before resolving a stable-generation barrier', async () => {
+    const { store, authority, readState } = await createWorkerMaintenanceFixture()
+    const gate = pauseCommit(authority)
     store.updateUI({ sidebarWidth: 601 })
     const barrier = store.flushPendingOrThrowAsync()
-    await rename.started
+    await gate.started
     store.updateUI({ sidebarWidth: 602 })
-    rename.resolve()
+    gate.release()
     await barrier
-    fsCalls.recording = false
-
-    expect(JSON.parse(readFileSync(dataFile(dir), 'utf-8')).ui.sidebarWidth).toBe(602)
+    expect(readState().ui.sidebarWidth).toBe(602)
   })
 
-  it('bounds a best-effort flush to one state generation', async () => {
-    const dir = makeDir()
-    const store = await createStore(dir)
-    const rename = delayNextDataFileRename(dir)
-    recordFsCalls(dir)
-
+  it('bounds a best-effort flush to its captured generation and retains later dirtiness', async () => {
+    const { store, authority, readState } = await createWorkerMaintenanceFixture()
+    const gate = pauseCommit(authority)
     store.updateUI({ sidebarWidth: 621 })
-    const flush = store.flushPendingAsync()
-    await rename.started
+    const pending = store.flushPendingAsync()
+    await gate.started
     store.updateUI({ sidebarWidth: 622 })
-    rename.resolve()
-    await flush
-    fsCalls.recording = false
-
-    expect(JSON.parse(readFileSync(dataFile(dir), 'utf-8')).ui.sidebarWidth).toBe(621)
-
+    gate.release()
+    await pending
+    expect(readState().ui.sidebarWidth).toBe(621)
     await store.flushPendingOrThrowAsync()
-    expect(JSON.parse(readFileSync(dataFile(dir), 'utf-8')).ui.sidebarWidth).toBe(622)
-  })
-
-  it('keeps a bounded barrier open when its staged writer is superseded before rename', async () => {
-    const dir = makeDir()
-    const store = await createStore(dir)
-    const openRelease = deferred()
-    const openStarted = deferred()
-    const renameRelease = deferred()
-    const renameStarted = deferred()
-    let heldOpen = false
-    let heldRename = false
-    fsCalls.waitAsync = (fn, target) => {
-      if (
-        !heldOpen &&
-        fn === 'open' &&
-        target.startsWith(dataFile(dir)) &&
-        target.endsWith('.tmp')
-      ) {
-        heldOpen = true
-        openStarted.resolve()
-        return openRelease.promise
-      }
-      if (!heldRename && fn === 'rename' && target.startsWith(dataFile(dir))) {
-        heldRename = true
-        renameStarted.resolve()
-        return renameRelease.promise
-      }
-      return null
-    }
-    recordFsCalls(dir)
-
-    store.updateUI({ sidebarWidth: 631 })
-    const barrier = store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
-    await openStarted.promise
-    store.updateUI({ sidebarWidth: 632 })
-    openRelease.resolve()
-    const firstOutcome = await Promise.race([
-      barrier.then(() => 'settled' as const),
-      renameStarted.promise.then(() => 'retrying' as const)
-    ])
-
-    expect(firstOutcome).toBe('retrying')
-    renameRelease.resolve()
-    await barrier
-    fsCalls.recording = false
-
-    expect(JSON.parse(readFileSync(dataFile(dir), 'utf-8')).ui.sidebarWidth).toBe(632)
+    expect(readState().ui.sidebarWidth).toBe(622)
   })
 
-  it('rewrites a matching hash after a superseded rename installed stale state', async () => {
-    const dir = makeDir()
-    const store = await createStore(dir)
+  it('rewrites an earlier value after a captured stale generation commits', async () => {
+    const { store, authority, readState } = await createWorkerMaintenanceFixture()
     store.updateUI({ sidebarWidth: 641 })
     await store.flushPendingOrThrowAsync()
-    const rename = delayNextDataFileRename(dir)
-    recordFsCalls(dir)
-
+    const gate = pauseCommit(authority)
     store.updateUI({ sidebarWidth: 642 })
-    vi.advanceTimersByTime(SAVE_DEBOUNCE_MS)
-    const staleWrite = store.waitForPendingWrite()
-    await rename.started
+    const pending = store.flushPendingAsync()
+    await gate.started
     store.updateUI({ sidebarWidth: 641 })
-    rename.resolve()
-    await staleWrite
-
-    expect(JSON.parse(readFileSync(dataFile(dir), 'utf-8')).ui.sidebarWidth).toBe(642)
+    gate.release()
+    await pending
+    expect(readState().ui.sidebarWidth).toBe(642)
     await store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
-    fsCalls.recording = false
+    expect(readState().ui.sidebarWidth).toBe(641)
+  })
 
-    expect(JSON.parse(readFileSync(dataFile(dir), 'utf-8')).ui.sidebarWidth).toBe(641)
+  it('retains dirty state when a SQL commit fails and persists an explicit retry', async () => {
+    const { store, authority, readState } = await createWorkerMaintenanceFixture()
+    vi.spyOn(console, 'error').mockImplementation(() => {})
+    vi.spyOn(authority, 'writeCompleteSerializedDomains').mockRejectedValueOnce(
+      new Error('disk refused')
+    )
+    const original = readState().ui.sidebarWidth
+    store.updateUI({ sidebarWidth: 511 })
+    await store.flushPendingAsync()
+    expect(readState().ui.sidebarWidth).toBe(original)
+    await store.flushPendingOrThrowAsync()
+    expect(readState().ui.sidebarWidth).toBe(511)
   })
 
-  it('the throwing async barrier drains mutations made during sidecar I/O', async () => {
-    const dir = makeDir()
-    const store = await createStore(dir)
-    const renameRelease = deferred()
-    const renameStarted = deferred()
-    fsCalls.waitAsync = (fn, target) => {
-      if (fn !== 'rename' || !target.includes('orca-github-cache.json.')) {
-        return null
+  it('drains mutations made while a sidecar rename is stalled', async () => {
+    const { store, readState } = await createWorkerMaintenanceFixture()
+    const started = maintenanceBarrier()
+    const finish = maintenanceBarrier()
+    fsCalls.waitAsync = (name, path) => {
+      if (name !== 'rename' || !path.includes('orca-github-cache.json.')) {
+        return
       }
-      renameStarted.resolve()
-      return renameRelease.promise
+      started.resolve()
+      return finish.promise
     }
-    recordFsCalls(dir)
-
     store.updateUI({ sidebarWidth: 611 })
     store.setGitHubCache({ pr: {}, issue: {} })
     const barrier = store.flushPendingOrThrowAsync()
-    await renameStarted.promise
+    await started.promise
     store.updateUI({ sidebarWidth: 612 })
-    renameRelease.resolve()
+    finish.resolve()
     await barrier
-    fsCalls.recording = false
-
-    expect(JSON.parse(readFileSync(dataFile(dir), 'utf-8')).ui.sidebarWidth).toBe(612)
-  })
-
-  it('serializes a second writer behind the owned rotation', async () => {
-    const dir = makeDir()
-    const store = await createStore(dir)
-    seedStaleBackup(dir)
-    const almostDueSeconds = (Date.now() - (BACKUP_MIN_INTERVAL_MS - SAVE_DEBOUNCE_MS - 100)) / 1000
-    utimesSync(`${dataFile(dir)}.bak.0`, almostDueSeconds, almostDueSeconds)
-    const staleBackup = readFileSync(`${dataFile(dir)}.bak.0`, 'utf-8')
-    const statCall = `stat:${dataFile(dir)}.bak.0`
-    const rotationRelease = deferred()
-    const rotationStarted = deferred()
-    let held = false
-    fsCalls.waitAsync = (fn, target) => {
-      if (held || fn !== 'stat' || target !== `${dataFile(dir)}.bak.0`) {
-        return null
-      }
-      held = true
-      rotationStarted.resolve()
-      return rotationRelease.promise
-    }
-
-    recordFsCalls(dir)
-    store.updateUI({ sidebarWidth: 371 })
-    vi.advanceTimersByTime(SAVE_DEBOUNCE_MS)
-    const firstWrite = store.waitForPendingWrite()
-    let allWrites = firstWrite
-    try {
-      await rotationStarted.promise
-      store.updateUI({ sidebarWidth: 372 })
-      store.flushOrThrow()
-      store.updateUI({ sidebarWidth: 373 })
-      vi.advanceTimersByTime(SAVE_DEBOUNCE_MS)
-      allWrites = store.waitForPendingWrite()
-      expect(fsCalls.asyncCalls.filter((call) => call === statCall)).toHaveLength(1)
-      rotationRelease.resolve()
-      await Promise.all([firstWrite, allWrites])
-    } finally {
-      rotationRelease.resolve()
-      await allWrites
-      fsCalls.recording = false
-      fsCalls.waitAsync = null
-    }
-    const ring = ringSnapshot(dir)
-    expect(JSON.parse(ring['orca-data.json']).ui.sidebarWidth).toBe(373)
-    expect(JSON.parse(ring['orca-data.json.bak.0']).ui.sidebarWidth).toBe(372)
-    expect(ring['orca-data.json.bak.1']).toBe(staleBackup)
-    expect(ring['orca-data.json.bak.2']).toBeUndefined()
-  })
-
-  it.each(ROTATION_INTERLEAVE_CASES)(
-    'keeps one rotation owner when a sync flush lands during %s',
-    async (_phase, expectedFn, targetSuffix) => {
-      const dir = makeDir()
-      const store = await createStore(dir)
-      seedStaleBackup(dir)
-      const staleBackup = readFileSync(`${dataFile(dir)}.bak.0`, 'utf-8')
-      const expectedTarget = `${dataFile(dir)}${targetSuffix}`
-
-      store.updateUI({ sidebarWidth: 363 })
-      recordFsCalls(dir)
-      let flushed = false
-      fsCalls.beforeAsync = (fn, target) => {
-        if (flushed || fn !== expectedFn || target !== expectedTarget) {
-          return
-        }
-        flushed = true
-        store.updateUI({ sidebarWidth: 364 })
-        store.flushOrThrow()
-      }
-      try {
-        vi.advanceTimersByTime(PAST_ROTATION_INTERVAL_MS)
-        await store.waitForPendingWrite()
-      } finally {
-        fsCalls.recording = false
-        fsCalls.beforeAsync = null
-      }
-
-      expect(flushed).toBe(true)
-      const ring = ringSnapshot(dir)
-      expect(ring['orca-data.json.bak.0']).toBe(ring['orca-data.json'])
-      expect(ring['orca-data.json.bak.1']).toBe(staleBackup)
-      expect(ring['orca-data.json.bak.2']).toBeUndefined()
-    }
-  )
-
-  it('does not log for absent ring slots even when the mount rejects renames non-ENOENT', async () => {
-    // Probing keeps degraded mounts from logging one error per absent slot.
-    const dir = makeDir()
-    const store = await createStore(dir)
-    const errors = vi.spyOn(console, 'error').mockImplementation(() => {})
-    fsCalls.failAsync = (fn, target) =>
-      fn === 'rename' && target.includes('.bak.')
-        ? Object.assign(new Error('stale NFS file handle'), { code: 'ESTALE' })
-        : null
-
-    try {
-      await recordAsyncSave(store, dir, 351)
-      expect(errors).not.toHaveBeenCalled()
-    } finally {
-      errors.mockRestore()
-    }
-  })
-
-  it('logs when a ring slot that exists fails to rotate', async () => {
-    const dir = makeDir()
-    const store = await createStore(dir)
-    seedStaleBackup(dir)
-    const errors = vi.spyOn(console, 'error').mockImplementation(() => {})
-    fsCalls.failAsync = (fn, target) =>
-      fn === 'rename' && target.endsWith('.bak.0')
-        ? Object.assign(new Error('permission denied'), { code: 'EPERM' })
-        : null
-
-    try {
-      await recordAsyncSave(store, dir, 352)
-      expect(errors).toHaveBeenCalledWith(
-        '[persistence] Failed to rotate backup',
-        `${dataFile(dir)}.bak.0`,
-        '->',
-        `${dataFile(dir)}.bak.1`,
-        expect.objectContaining({ code: 'EPERM' })
-      )
-    } finally {
-      errors.mockRestore()
-    }
-  })
-
-  it('produces a .bak ring byte-identical to the sync path, at capacity and with ring holes', async () => {
-    const asyncDir = makeDir()
-    const syncDir = makeDir()
-    // Match generated IDs so only rotation behavior can differ.
-    const seedDir = makeDir()
-    const seedStore = await createStore(seedDir)
-    seedStore.updateUI({ sidebarWidth: 320 })
-    seedStore.flushOrThrow()
-    const seed = readFileSync(dataFile(seedDir), 'utf-8')
-    for (const dir of [asyncDir, syncDir]) {
-      writeFileSync(dataFile(dir), seed, 'utf-8')
-      // Holes: slots 1 and 3 occupied, 0 and 2 missing — exercises the per-slot existence branch.
-      writeFileSync(`${dataFile(dir)}.bak.1`, '{"old":1}', 'utf-8')
-      writeFileSync(`${dataFile(dir)}.bak.3`, '{"old":3}', 'utf-8')
-    }
-
-    const widths = [321, 322, 323, 324, 325, 326]
-    const asyncStore = await createStore(asyncDir)
-    for (const width of widths) {
-      asyncStore.updateUI({ sidebarWidth: width })
-      vi.advanceTimersByTime(PAST_ROTATION_INTERVAL_MS)
-      await asyncStore.waitForPendingWrite()
-    }
-
-    const syncStore = await createStore(syncDir)
-    for (const width of widths) {
-      syncStore.updateUI({ sidebarWidth: width })
-      syncStore.flushOrThrow()
-      vi.advanceTimersByTime(PAST_ROTATION_INTERVAL_MS)
-    }
-
-    const ring = ringSnapshot(asyncDir)
-    expect(ring).toEqual(ringSnapshot(syncDir))
-    expect(Object.keys(ring)).toContain(`orca-data.json.bak.${BACKUP_COUNT - 1}`)
+    expect(readState().ui.sidebarWidth).toBe(612)
   })
 
-  it('persists SSH PTY consumer recovery without a sync syscall, durable once awaited', async () => {
-    const dir = makeDir()
-    const store = await createStore(dir)
-
-    recordFsCalls(dir)
-    try {
-      await store.upsertSshPtyConsumerRecovery(consumerRecovery('client-1'))
-    } finally {
-      fsCalls.recording = false
-    }
-
-    expect(fsCalls.syncCalls).toEqual([])
-    // Durability is awaited, not merely debounced: the record is on disk when the promise resolves.
-    const persisted = JSON.parse(readFileSync(dataFile(dir), 'utf-8')) as {
-      sshPtyConsumerRecoveries: { clientInstanceId: string }[]
-    }
-    expect(persisted.sshPtyConsumerRecoveries).toHaveLength(1)
-    expect(persisted.sshPtyConsumerRecoveries[0]?.clientInstanceId).toBe('client-1')
+  it('persists SSH consumer recovery without sync syscalls before acknowledging it', async () => {
+    const { store, authority, directory, readState } = await createWorkerMaintenanceFixture()
+    record(directory)
+    await store.upsertSshPtyConsumerRecovery(consumerRecovery('client-1'))
+    await authority.drainBackups()
+    fsCalls.recording = false
+    expect(fsCalls.sync).toEqual([])
+    expect(readState().sshPtyConsumerRecoveries).toEqual([
+      expect.objectContaining({ clientInstanceId: 'client-1' })
+    ])
   })
 
-  it('rejects the consumer-recovery durability barrier when the primary write fails', async () => {
-    const dir = makeDir()
-    const store = await createStore(dir)
-    const writeError = Object.assign(new Error('profile mount rejected write'), { code: 'EIO' })
-    const errors = vi.spyOn(console, 'error').mockImplementation(() => {})
-    recordFsCalls(dir)
-    fsCalls.failAsync = (fn, target) =>
-      fn === 'open' && target.startsWith(`${dataFile(dir)}.`) ? writeError : null
-
-    try {
-      await expect(store.upsertSshPtyConsumerRecovery(consumerRecovery('client-1'))).rejects.toBe(
-        writeError
-      )
-    } finally {
-      fsCalls.recording = false
-      errors.mockRestore()
-    }
+  it('rejects failed consumer recovery and preserves the prior durable state', async () => {
+    const { store, authority, readState } = await createWorkerMaintenanceFixture()
+    const before = readState().sshPtyConsumerRecoveries
+    const failure = new Error('profile mount rejected write')
+    vi.spyOn(authority, 'writeCompleteSerializedDomains').mockRejectedValueOnce(failure)
+    await expect(store.upsertSshPtyConsumerRecovery(consumerRecovery('client-1'))).rejects.toBe(
+      failure
+    )
+    expect(readState().sshPtyConsumerRecoveries).toEqual(before)
   })
 
-  it('removes SSH PTY consumer recovery without a sync syscall, durable once awaited', async () => {
-    const dir = makeDir()
-    const store = await createStore(dir)
+  it('durably removes SSH consumer recovery without sync syscalls', async () => {
+    const { store, authority, directory, readState } = await createWorkerMaintenanceFixture()
     await store.upsertSshPtyConsumerRecovery(consumerRecovery('client-1'))
-
-    recordFsCalls(dir)
-    try {
-      await store.removeSshPtyConsumerRecovery('ssh-1')
-    } finally {
-      fsCalls.recording = false
-    }
-
-    expect(fsCalls.syncCalls).toEqual([])
-    const persisted = JSON.parse(readFileSync(dataFile(dir), 'utf-8')) as {
-      sshPtyConsumerRecoveries: unknown[]
-    }
-    expect(persisted.sshPtyConsumerRecoveries).toEqual([])
-  })
-
-  it('persists failed-session lease detachment without a sync syscall', async () => {
-    const dir = makeDir()
-    const store = await createStore(dir)
-    store.upsertSshRemotePtyLease({ targetId: 'ssh-1', ptyId: 'pty-1', state: 'attached' })
-
-    recordFsCalls(dir)
-    try {
-      await store.markSshRemotePtyLeasesAsync('ssh-1', 'detached')
-    } finally {
-      fsCalls.recording = false
-    }
-
-    expect(fsCalls.syncCalls).toEqual([])
-    const persisted = JSON.parse(readFileSync(dataFile(dir), 'utf-8')) as {
-      sshRemotePtyLeases: { state: string }[]
-    }
-    expect(persisted.sshRemotePtyLeases[0]?.state).toBe('detached')
+    await authority.drainBackups()
+    record(directory)
+    await store.removeSshPtyConsumerRecovery('ssh-1')
+    await authority.drainBackups()
+    fsCalls.recording = false
+    expect(fsCalls.sync).toEqual([])
+    expect(readState().sshPtyConsumerRecoveries).toEqual([])
   })
 
-  it('persists selected reattach leases in one async write', async () => {
-    const dir = makeDir()
-    const store = await createStore(dir)
-    store.upsertSshRemotePtyLease({ targetId: 'ssh-1', ptyId: 'pty-1', state: 'detached' })
+  it('persists lease detachment and selected reattachments without sync syscalls', async () => {
+    const { store, authority, directory, readState } = await createWorkerMaintenanceFixture()
+    for (const [ptyId, state] of [
+      ['pty-1', 'attached'],
+      ['pty-2', 'expired'],
+      ['pty-3', 'detached'],
+      ['pty-4', 'terminated']
+    ] as const) {
+      store.upsertSshRemotePtyLease({ targetId: 'ssh-1', ptyId, state })
+    }
+    record(directory)
+    await store.markSshRemotePtyLeasesAsync('ssh-1', 'detached')
+    await authority.drainBackups()
+    fsCalls.recording = false
+    expect(fsCalls.sync).toEqual([])
+    expect(
+      readState().sshRemotePtyLeases.filter(
+        (lease: { targetId: string }) => lease.targetId === 'ssh-1'
+      )
+    ).toEqual(
+      expect.arrayContaining([expect.objectContaining({ ptyId: 'pty-1', state: 'detached' })])
+    )
     store.upsertSshRemotePtyLease({ targetId: 'ssh-1', ptyId: 'pty-2', state: 'expired' })
-    store.upsertSshRemotePtyLease({ targetId: 'ssh-1', ptyId: 'pty-3', state: 'detached' })
-    // Why: a PTY that exits mid-reattach is terminated before the batch write lands; it must stay dead.
     store.upsertSshRemotePtyLease({ targetId: 'ssh-1', ptyId: 'pty-4', state: 'terminated' })
-
-    recordFsCalls(dir)
-    try {
-      await store.markSshRemotePtyLeasesAttachedAsync('ssh-1', ['pty-1', 'pty-2', 'pty-4'])
-    } finally {
-      fsCalls.recording = false
-    }
-
-    expect(fsCalls.syncCalls).toEqual([])
-    const persisted = JSON.parse(readFileSync(dataFile(dir), 'utf-8')) as {
-      sshRemotePtyLeases: { ptyId: string; state: string }[]
-    }
-    expect(persisted.sshRemotePtyLeases).toEqual(
+    record(directory)
+    const write = vi.spyOn(authority, 'writeSerializedDomains')
+    await store.markSshRemotePtyLeasesAttachedAsync('ssh-1', ['pty-1', 'pty-2', 'pty-4'])
+    await authority.drainBackups()
+    fsCalls.recording = false
+    expect(fsCalls.sync).toEqual([])
+    expect(write).toHaveBeenCalledOnce()
+    expect(readState().sshRemotePtyLeases).toEqual(
       expect.arrayContaining([
         expect.objectContaining({ ptyId: 'pty-1', state: 'attached' }),
-        // An id-qualified reattach named this pty and succeeded, which is the one thing that can
-        // settle what `expired` meant: the client had lost its route, not that the shell died.
         expect.objectContaining({ ptyId: 'pty-2', state: 'attached' }),
         expect.objectContaining({ ptyId: 'pty-3', state: 'detached' }),
         expect.objectContaining({ ptyId: 'pty-4', state: 'terminated' })
@@ -830,97 +336,30 @@ describe('async persistence write path avoids synchronous fs syscalls', () => {
     )
   })
 
-  it('keeps async writers serialized across a synchronous shutdown flush', async () => {
-    const dir = makeDir()
-    const store = await createStore(dir)
-    const firstOpen = deferred()
-    const firstOpenRelease = deferred()
-    let held = false
-    fsCalls.waitAsync = (fn, target) => {
-      if (held || fn !== 'open' || !target.endsWith('.tmp')) {
-        return null
-      }
-      held = true
-      firstOpen.resolve()
-      return firstOpenRelease.promise
-    }
-
-    recordFsCalls(dir)
-    try {
-      const firstWrite = store.upsertSshPtyConsumerRecovery(consumerRecovery('client-1'))
-      await firstOpen.promise
-      store.flushOrThrow()
-      const secondWrite = store.upsertSshPtyConsumerRecovery(consumerRecovery('client-2'))
-      await Promise.resolve()
-      await Promise.resolve()
-
-      expect(fsCalls.asyncCalls.filter((call) => call.startsWith('open:'))).toHaveLength(1)
-      firstOpenRelease.resolve()
-      await Promise.all([firstWrite, secondWrite])
-    } finally {
-      firstOpenRelease.resolve()
-      fsCalls.recording = false
-      fsCalls.waitAsync = null
-    }
-
-    const persisted = JSON.parse(readFileSync(dataFile(dir), 'utf-8')) as {
-      sshPtyConsumerRecoveries: { clientInstanceId: string }[]
-    }
-    expect(persisted.sshPtyConsumerRecoveries[0]?.clientInstanceId).toBe('client-2')
+  it('serializes queued durable mutations and refuses a synchronous live flush', async () => {
+    const { store, authority, readState } = await createWorkerMaintenanceFixture()
+    const gate = pauseCommit(authority)
+    const first = store.upsertSshPtyConsumerRecovery(consumerRecovery('client-1'))
+    await gate.started
+    expect(() => store.flushOrThrow()).toThrow('awaited flush')
+    const second = store.upsertSshPtyConsumerRecovery(consumerRecovery('client-2'))
+    await Promise.resolve()
+    expect(
+      vi.mocked(authority.writeSerializedDomains).mock.calls.length +
+        vi.mocked(authority.writeCompleteSerializedDomains).mock.calls.length
+    ).toBe(1)
+    gate.release()
+    await Promise.all([first, second])
+    expect(readState().sshPtyConsumerRecoveries[0].clientInstanceId).toBe('client-2')
   })
 
-  it('lets a main-thread timer keep firing while a consumer-recovery write is in flight', async () => {
-    // The P1-A freeze itself: a stalled profile mount must not park the main thread on establish.
-    vi.useRealTimers()
-    const dir = makeDir()
-    const store = await createStore(dir)
-    const stallMs = 1_000
-    // Why half: a sync write parks the loop for at least stallMs while the async path ticks every
-    // ~10ms, so this leaves room for scheduler jitter on a loaded runner without going vacuous.
-    const maxAcceptableGapMs = stallMs / 2
-
-    let lastTick = Date.now()
-    let worstGapMs = 0
-    const heartbeat = setInterval(() => {
-      const now = Date.now()
-      worstGapMs = Math.max(worstGapMs, now - lastTick)
-      lastTick = now
-    }, 10)
-
-    try {
-      fsCalls.dirPrefix = dir
-      fsCalls.stallMs = stallMs
-      fsCalls.recording = true
-      lastTick = Date.now()
-      const write = store.upsertSshPtyConsumerRecovery(consumerRecovery('client-1'))
-      // Why not await first: a fully synchronous write finishes before the interval can fire, so the
-      // heartbeat would never observe the stall it exists to detect.
-      await new Promise((resolve) => setTimeout(resolve, stallMs + 200))
-      await write
-    } finally {
-      fsCalls.recording = false
-      clearInterval(heartbeat)
-    }
-
-    expect(worstGapMs).toBeLessThan(maxAcceptableGapMs)
-    expect(readFileSync(dataFile(dir), 'utf-8')).toContain('client-1')
-  }, 20_000)
-
-  it('keeps the sync quit/crash fallback on synchronous syscalls', async () => {
-    const dir = makeDir()
-    const store = await createStore(dir)
-    seedStaleBackup(dir)
-
+  it('keeps admitted offline SQL checkpoints synchronous and durable', () => {
+    const { store, authority, dataFile } = createSqliteMaintenanceFixture()
+    const write = vi.spyOn(authority, 'writeCompleteSerializedDomains')
     store.updateUI({ sidebarWidth: 331 })
-    recordFsCalls(dir)
-    try {
-      store.flushOrThrow()
-    } finally {
-      fsCalls.recording = false
-    }
-
-    expect(fsCalls.syncCalls).toContain(`statSync:${dataFile(dir)}.bak.0`)
-    expect(fsCalls.syncCalls).toContain(`existsSync:${dataFile(dir)}`)
-    expect(fsCalls.asyncCalls).toEqual([])
+    store.flushOrThrow()
+    expect(write).toHaveBeenCalledOnce()
+    expect(JSON.parse(authority.readSerializedState() ?? '{}').ui.sidebarWidth).toBe(331)
+    expect(existsSync(dataFile)).toBe(false)
   })
 })
diff --git a/src/main/persistence-automations.test.ts b/src/main/persistence-automations.test.ts
index 9db16b7e6815..fcd61b77ec39 100644
--- a/src/main/persistence-automations.test.ts
+++ b/src/main/persistence-automations.test.ts
@@ -1,16 +1,17 @@
-import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
-import { rmSync, mkdtempSync } from 'node:fs'
-import { join } from 'node:path'
-import { tmpdir } from 'node:os'
-import type { PersistedState } from '../shared/persisted-state-types'
-import { toRuntimeExecutionHostId, toSshExecutionHostId } from '../shared/execution-host'
 import {
+  closeTestStores,
   testState,
   createStore,
   writeDataFile,
   readDataFile,
   makeRepo
 } from './persistence-test-harness'
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
+import { rmSync, mkdtempSync } from 'node:fs'
+import { join } from 'node:path'
+import { tmpdir } from 'node:os'
+import type { PersistedState } from '../shared/persisted-state-types'
+import { toRuntimeExecutionHostId, toSshExecutionHostId } from '../shared/execution-host'
 
 // Stub the ~/.ssh/config parser so the SSH-import test drives the real Store with deterministic hosts, not the operator's actual ~/.ssh/config.
 const { loadUserSshConfigMock, sshConfigHostsToTargetsMock } = vi.hoisted(() => ({
@@ -60,7 +61,8 @@ describe('Store', () => {
     getCohortAtEmitMock.mockReturnValue({ nth_repo_added: 2 })
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
   it('can clear an automation back to the project default branch', async () => {
diff --git a/src/main/persistence-clipboard-selection-migration.test.ts b/src/main/persistence-clipboard-selection-migration.test.ts
index c04b4d5bdd60..552aa10b6f76 100644
--- a/src/main/persistence-clipboard-selection-migration.test.ts
+++ b/src/main/persistence-clipboard-selection-migration.test.ts
@@ -1,14 +1,15 @@
-import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
-import { rmSync, mkdtempSync } from 'node:fs'
-import { join } from 'node:path'
-import { tmpdir } from 'node:os'
 import {
+  closeTestStores,
   testState,
   createStore,
   withPlatform,
   writeDataFile,
   readDataFile
 } from './persistence-test-harness'
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
+import { rmSync, mkdtempSync } from 'node:fs'
+import { join } from 'node:path'
+import { tmpdir } from 'node:os'
 
 // Stub the ~/.ssh/config parser so the SSH-import test drives the real Store with deterministic hosts, not the operator's actual ~/.ssh/config.
 const { loadUserSshConfigMock, sshConfigHostsToTargetsMock } = vi.hoisted(() => ({
@@ -58,7 +59,8 @@ describe('Store', () => {
     getCohortAtEmitMock.mockReturnValue({ nth_repo_added: 2 })
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
   it('migrates the legacy floating terminal disabled default to enabled', async () => {
diff --git a/src/main/persistence-cohort-and-identity-migration.test.ts b/src/main/persistence-cohort-and-identity-migration.test.ts
index a894b8a4c637..02afa7e3da57 100644
--- a/src/main/persistence-cohort-and-identity-migration.test.ts
+++ b/src/main/persistence-cohort-and-identity-migration.test.ts
@@ -1,11 +1,5 @@
-import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
-import { writeFileSync, rmSync, mkdtempSync, mkdirSync } from 'node:fs'
-import { join } from 'node:path'
-import { tmpdir } from 'node:os'
-import type { WorkspaceSessionState } from '../shared/workspace-session-state-types'
-import { getDefaultWorkspaceSession } from '../shared/constants'
-import { folderWorkspaceKey, worktreeWorkspaceKey } from '../shared/workspace-scope'
 import {
+  closeTestStores,
   testState,
   createStore,
   dataFile,
@@ -15,6 +9,14 @@ import {
   makeWorktreeLineage,
   makeWorkspaceLineage
 } from './persistence-test-harness'
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
+import { writeFileSync, rmSync, mkdtempSync, readFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { tmpdir } from 'node:os'
+import type { WorkspaceSessionState } from '../shared/workspace-session-state-types'
+import { getDefaultWorkspaceSession } from '../shared/constants'
+import { folderWorkspaceKey, worktreeWorkspaceKey } from '../shared/workspace-scope'
+import { createProfileStateStore } from './persistence/profile-state/profile-state-store-factory'
 
 // Stub the ~/.ssh/config parser so the SSH-import test drives the real Store with deterministic hosts, not the operator's actual ~/.ssh/config.
 const { loadUserSshConfigMock, sshConfigHostsToTargetsMock } = vi.hoisted(() => ({
@@ -64,7 +66,8 @@ describe('Store', () => {
     getCohortAtEmitMock.mockReturnValue({ nth_repo_added: 2 })
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
   // ── Telemetry cohort migration ─────────────────────────────────────
@@ -105,19 +108,16 @@ describe('Store', () => {
     expect(store.getSettings().theme).toBe('dark')
   })
 
-  it('still classifies as existing-user cohort when the data file is corrupt', async () => {
-    // Load-bearing: the corrupt-file catch path keeps `fileExistedOnLoad` true so a corrupted install isn't silently opted in as fresh.
-    mkdirSync(testState.dir, { recursive: true })
-    writeFileSync(dataFile(), '{{{corrupt json', 'utf-8')
-    const store = await createStore()
-    const t = store.getSettings().telemetry
-    expect(t).toBeDefined()
-    expect(t!.existedBeforeTelemetryRelease).toBe(true)
-    expect(t!.optedIn).toBeNull()
-    expect(t!.installId).toMatch(
-      /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/
-    )
-    expect(store.getSettings().experimentalNewWorktreeCardStyle).toBe(false)
+  it('retains the existing-user cohort when a corrupt legacy primary recovers from backup', async () => {
+    await withRecoveredLegacyProfile((store) => {
+      const telemetry = store.getSettings().telemetry
+      expect(telemetry?.existedBeforeTelemetryRelease).toBe(true)
+      expect(telemetry?.optedIn).toBeNull()
+      expect(telemetry?.installId).toMatch(
+        /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/
+      )
+      expect(store.getSettings().experimentalNewWorktreeCardStyle).toBe(false)
+    })
   })
 
   it('preserves an already-migrated telemetry block on subsequent launches', async () => {
@@ -152,7 +152,8 @@ describe('Store.migrateTabSwitchKeybindings', () => {
     testState.dir = mkdtempSync(join(tmpdir(), 'orca-test-'))
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
 
@@ -176,11 +177,10 @@ describe('Store.migrateTabSwitchKeybindings', () => {
     expect(store.getSettings().theme).toBe('dark')
   })
 
-  it('treats a corrupt data file as a pre-existing install', async () => {
-    mkdirSync(testState.dir, { recursive: true })
-    writeFileSync(dataFile(), '{{{corrupt json', 'utf-8')
-    const store = await createStore()
-    expect(store.getSettings().tabSwitchKeybindingSeed).toBe('pending')
+  it('retains the existing keybinding cohort when recovering a legacy backup', async () => {
+    await withRecoveredLegacyProfile((store) => {
+      expect(store.getSettings().tabSwitchKeybindingSeed).toBe('pending')
+    })
   })
 
   it('preserves an already-frozen cohort on subsequent launches', async () => {
@@ -209,7 +209,8 @@ describe('Store.migrateWorktreeIdentity', () => {
     testState.dir = mkdtempSync(join(tmpdir(), 'orca-test-'))
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
 
@@ -442,3 +443,21 @@ describe('Store.migrateWorktreeIdentity', () => {
     expect(store.getWorktreeMeta(OLD)?.priorWorktreeIds).toBeUndefined()
   })
 })
+
+async function withRecoveredLegacyProfile(
+  verify: (store: ReturnType<typeof createProfileStateStore>['store']) => void
+): Promise<void> {
+  writeDataFile({ schemaVersion: 1, repos: [], worktreeMeta: {}, settings: {}, ui: {} })
+  writeFileSync(`${dataFile()}.bak.0`, readFileSync(dataFile()))
+  writeFileSync(dataFile(), '{{{corrupt json')
+  const { store } = createProfileStateStore({
+    dataFile: dataFile(),
+    databaseFile: join(testState.dir, 'profile-state.db'),
+    profileId: 'cohort-recovery'
+  })
+  try {
+    verify(store)
+  } finally {
+    await store.freezeWritesAsync()
+  }
+}
diff --git a/src/main/persistence-cross-host-pane-identity.test.ts b/src/main/persistence-cross-host-pane-identity.test.ts
index 479d3727837a..d3bdab23d6bc 100644
--- a/src/main/persistence-cross-host-pane-identity.test.ts
+++ b/src/main/persistence-cross-host-pane-identity.test.ts
@@ -1,11 +1,5 @@
-import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
-import { rmSync, mkdtempSync } from 'node:fs'
-import { join } from 'node:path'
-import { tmpdir } from 'node:os'
-import type { WorkspaceSessionState } from '../shared/workspace-session-state-types'
-import { getDefaultWorkspaceSession } from '../shared/constants'
-import { isTerminalLeafId } from '../shared/stable-pane-id'
 import {
+  closeTestStores,
   testState,
   createStore,
   writeDataFile,
@@ -13,6 +7,13 @@ import {
   makeRepo,
   makeTerminalTab
 } from './persistence-test-harness'
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
+import { rmSync, mkdtempSync } from 'node:fs'
+import { join } from 'node:path'
+import { tmpdir } from 'node:os'
+import type { WorkspaceSessionState } from '../shared/workspace-session-state-types'
+import { getDefaultWorkspaceSession } from '../shared/constants'
+import { isTerminalLeafId } from '../shared/stable-pane-id'
 
 vi.mock('electron', () => ({
   app: { getPath: () => testState.dir },
@@ -47,7 +48,8 @@ describe('cross-host pane identity migration', () => {
     testState.dir = mkdtempSync(join(tmpdir(), 'orca-test-'))
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
 
diff --git a/src/main/persistence-deregistered-repo-residue.test.ts b/src/main/persistence-deregistered-repo-residue.test.ts
index a7fb4d7353f1..3e4d380e4ee8 100644
--- a/src/main/persistence-deregistered-repo-residue.test.ts
+++ b/src/main/persistence-deregistered-repo-residue.test.ts
@@ -1,3 +1,12 @@
+import {
+  closeTestStores,
+  testState,
+  createStore,
+  writeDataFile,
+  readDataFile,
+  makeRepo,
+  makeTerminalTab
+} from './persistence-test-harness'
 // Why this file exists: deregistering a project used to strand every row it owned. No sweeper could
 // reach them because the missing-directory prune is gated on the repo still being registered.
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
@@ -8,14 +17,6 @@ import { getDefaultWorkspaceSession } from '../shared/constants'
 import { composeWorktreeHostIdentity } from '../shared/worktree/host-qualified-identity'
 import { folderWorkspaceKey, worktreeWorkspaceKey } from '../shared/workspace-scope'
 import type { PersistedState } from '../shared/persisted-state-types'
-import {
-  testState,
-  createStore,
-  writeDataFile,
-  readDataFile,
-  makeRepo,
-  makeTerminalTab
-} from './persistence-test-harness'
 
 vi.mock('./ssh/ssh-config-parser', () => ({
   loadUserSshConfig: vi.fn(),
@@ -67,7 +68,8 @@ describe('deregistered repo residue', () => {
     testState.dir = mkdtempSync(join(tmpdir(), 'orca-orphan-sweep-'))
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
 
diff --git a/src/main/persistence-duplicate-repo-id-host-scope.test.ts b/src/main/persistence-duplicate-repo-id-host-scope.test.ts
index 0da93c3a9791..48cb826f909d 100644
--- a/src/main/persistence-duplicate-repo-id-host-scope.test.ts
+++ b/src/main/persistence-duplicate-repo-id-host-scope.test.ts
@@ -1,3 +1,4 @@
+import { closeTestStores, createSqliteTestStore } from './persistence-test-harness'
 /**
  * The same repo id may be registered on two execution hosts (see `removeProjectForHost`).
  * Every deletion that resolves a *row* must therefore delete only that row: `removeProject`
@@ -57,7 +58,7 @@ async function createStoreFromState(state: Record<string, unknown>) {
   // file's temp dir rather than the global fake's shared one, after resetModules.
   installFakeAppEnvironment({ getPath: () => testState.dir })
   initDataPath()
-  return new Store()
+  return createSqliteTestStore(Store, { dataFile: join(testState.dir, 'orca-data.json') })
 }
 
 function createStoreWithDuplicateRepoId() {
@@ -98,7 +99,8 @@ beforeEach(() => {
   testState.dir = mkdtempSync(join(tmpdir(), 'orca-dup-repo-id-'))
 })
 
-afterEach(() => {
+afterEach(async () => {
+  await closeTestStores()
   rmSync(testState.dir, { recursive: true, force: true })
 })
 
diff --git a/src/main/persistence-feature-interaction-broadcast.benchmark.test.ts b/src/main/persistence-feature-interaction-broadcast.benchmark.test.ts
index cfb7f555b082..95f4836d692d 100644
--- a/src/main/persistence-feature-interaction-broadcast.benchmark.test.ts
+++ b/src/main/persistence-feature-interaction-broadcast.benchmark.test.ts
@@ -1,4 +1,9 @@
-import { mkdtempSync, readFileSync, rmSync } from 'node:fs'
+import {
+  closeTestStores,
+  createSqliteTestStore,
+  readPersistedStateJson
+} from './persistence-test-harness'
+import { mkdtempSync, rmSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { performance } from 'node:perf_hooks'
@@ -27,11 +32,12 @@ function createStore(name: string): { dataFile: string; store: Store } {
   const dir = mkdtempSync(join(tmpdir(), `orca-ui-broadcast-${name}-`))
   tempDirs.push(dir)
   const dataFile = join(dir, 'orca-data.json')
-  return { dataFile, store: new Store({ dataFile }) }
+  return { dataFile, store: createSqliteTestStore(Store, { dataFile }) }
 }
 
 describe('feature interaction UI broadcast benchmark', () => {
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     for (const dir of tempDirs.splice(0)) {
       rmSync(dir, { recursive: true, force: true })
     }
@@ -76,9 +82,12 @@ describe('feature interaction UI broadcast benchmark', () => {
     ).toBe(INTERACTIONS)
     optimizedStore.flush()
     expect(
-      new Store({ dataFile }).getUI().featureInteractions?.['agent-orchestration']?.interactionCount
+      createSqliteTestStore(Store, { dataFile }).getUI().featureInteractions?.[
+        'agent-orchestration'
+      ]?.interactionCount
     ).toBe(INTERACTIONS)
-    const persisted = JSON.parse(readFileSync(dataFile, 'utf8')) as PersistedState
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The preceding Store save produced the PersistedState snapshot read by this test.
+    const persisted = JSON.parse(readPersistedStateJson(dataFile)) as PersistedState
     expect(persisted.featureInteractionTelemetryBuckets?.['agent-orchestration']).toBe(
       'count_200_499'
     )
diff --git a/src/main/persistence-floating-terminal-trust.test.ts b/src/main/persistence-floating-terminal-trust.test.ts
index 630a1c165590..49ea6457e6da 100644
--- a/src/main/persistence-floating-terminal-trust.test.ts
+++ b/src/main/persistence-floating-terminal-trust.test.ts
@@ -1,15 +1,16 @@
-import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
-import { rmSync, mkdtempSync, mkdirSync, realpathSync } from 'node:fs'
-import { join } from 'node:path'
-import { tmpdir } from 'node:os'
-import type { PersistedState } from '../shared/persisted-state-types'
 import {
+  closeTestStores,
   testState,
   createStore,
   writeDataFile,
   readDataFile,
   symlinkDirectorySync
 } from './persistence-test-harness'
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
+import { rmSync, mkdtempSync, mkdirSync, realpathSync } from 'node:fs'
+import { join } from 'node:path'
+import { tmpdir } from 'node:os'
+import type { PersistedState } from '../shared/persisted-state-types'
 
 // Stub the ~/.ssh/config parser so the SSH-import test drives the real Store with deterministic hosts, not the operator's actual ~/.ssh/config.
 const { loadUserSshConfigMock, sshConfigHostsToTargetsMock } = vi.hoisted(() => ({
@@ -59,7 +60,8 @@ describe('Store', () => {
     getCohortAtEmitMock.mockReturnValue({ nth_repo_added: 2 })
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
   it('seeds trusted floating workspace directories from legacy explicit cwd values', async () => {
diff --git a/src/main/persistence-flush-and-save-scheduling.test.ts b/src/main/persistence-flush-and-save-scheduling.test.ts
index 2d6180d5fa8b..dbe4ce8262f1 100644
--- a/src/main/persistence-flush-and-save-scheduling.test.ts
+++ b/src/main/persistence-flush-and-save-scheduling.test.ts
@@ -1,10 +1,13 @@
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
-import { rmSync, mkdtempSync, mkdirSync, existsSync, statSync } from 'node:fs'
+import { rmSync, mkdtempSync, mkdirSync, existsSync } from 'node:fs'
 import { join } from 'node:path'
 import { tmpdir } from 'node:os'
 import type { PersistedState } from '../shared/persisted-state-types'
 import type { Repo } from '../shared/repo-types'
 import {
+  closeTestStores,
+  createSqliteTestStore,
+  readPersistedStateJson,
   testState,
   createStore,
   withPlatform,
@@ -68,9 +71,10 @@ describe('Store', () => {
     getCohortAtEmitMock.mockReturnValue({ nth_repo_added: 2 })
   })
 
-  afterEach(() => {
+  afterEach(async () => {
     vi.restoreAllMocks()
     _resetPtyBindingSpanSamplingForTests()
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
   // ── 10. flush writes synchronously ─────────────────────────────────
@@ -85,6 +89,26 @@ describe('Store', () => {
     expect(persisted.repos[0].id).toBe('r1')
   })
 
+  it('durably commits an exact JSON operation before a following microtask changes generation', async () => {
+    const store = await createStore()
+    const originalTabId = store.getWorkspaceSession().activeTabId
+    await store.runDurableMutation(() => {
+      store.updateSettings({ theme: 'dark' })
+      queueMicrotask(() => {
+        store.setWorkspaceSession({ ...store.getWorkspaceSession(), activeTabId: 'newer-tab' })
+      })
+      return { value: undefined }
+    })
+    expect(readDataFile()).toMatchObject({
+      settings: { theme: 'dark' },
+      workspaceSession: { activeTabId: originalTabId }
+    })
+    expect(store.getWorkspaceSession().activeTabId).toBe('newer-tab')
+    await store.flushPendingOrThrowAsync()
+    expect(readDataFile()).toHaveProperty(['workspaceSession', 'activeTabId'], 'newer-tab')
+    store.freezeWrites()
+  })
+
   it('flush remains safe when a debounced save is also pending', async () => {
     vi.useFakeTimers()
     try {
@@ -126,7 +150,7 @@ describe('Store', () => {
   })
 
   // ── Content-hash write skipping ────────────────────────────────────
-  // Why inode comparison: every real write is a tmp+rename (new inode), so an unchanged inode proves no write happened.
+  // Retained ciphertext makes an unintended secret rewrite visible in the SQL projection.
 
   it('skips the disk write when a mutation burst nets out to already-persisted state', async () => {
     vi.useFakeTimers()
@@ -135,14 +159,14 @@ describe('Store', () => {
       store.updateUI({ sidebarWidth: 400 })
       vi.advanceTimersByTime(1000)
       await store.waitForPendingWrite()
-      const inoBefore = statSync(dataFile()).ino
+      const stateBefore = readPersistedStateJson(dataFile())
 
       store.updateUI({ sidebarWidth: 500 })
       store.updateUI({ sidebarWidth: 400 })
       vi.advanceTimersByTime(2000)
       await store.waitForPendingWrite()
 
-      expect(statSync(dataFile()).ino).toBe(inoBefore)
+      expect(readPersistedStateJson(dataFile())).toBe(stateBefore)
     } finally {
       vi.useRealTimers()
     }
@@ -155,11 +179,11 @@ describe('Store', () => {
       store.updateUI({ sidebarWidth: 420 })
       vi.advanceTimersByTime(1000)
       await store.waitForPendingWrite()
-      const inoBefore = statSync(dataFile()).ino
+      const stateBefore = readPersistedStateJson(dataFile())
 
       store.flush()
 
-      expect(statSync(dataFile()).ino).toBe(inoBefore)
+      expect(readPersistedStateJson(dataFile())).toBe(stateBefore)
     } finally {
       vi.useRealTimers()
     }
@@ -177,7 +201,7 @@ describe('Store', () => {
       }
       await store.waitForPendingWrite()
 
-      expect(existsSync(dataFile())).toBe(true)
+      expect(existsSync(join(testState.dir, 'profile-state.db'))).toBe(true)
       const persisted = readDataFile() as { ui: { sidebarWidth: number } }
       expect(persisted.ui.sidebarWidth).toBeGreaterThanOrEqual(400)
     } finally {
@@ -220,13 +244,13 @@ describe('Store', () => {
       leafId: TEST_LEAF_1,
       ptyId: 'daemon-pty'
     }
-    store.persistPtyBinding(binding)
-    const inoBefore = statSync(dataFile()).ino
+    await store.persistPtyBinding(binding)
+    const stateBefore = readPersistedStateJson(dataFile())
 
     // Warm-restart re-bind storm: an identical binding re-asserted with a sync flush must not rewrite.
-    store.persistPtyBinding(binding)
+    await store.persistPtyBinding(binding)
 
-    expect(statSync(dataFile()).ino).toBe(inoBefore)
+    expect(readPersistedStateJson(dataFile())).toBe(stateBefore)
   })
 
   // ── worktreeMeta startup GC ────────────────────────────────────────
@@ -326,14 +350,14 @@ describe('Store', () => {
       store.updateUI({ sidebarWidth: 411 })
       vi.advanceTimersByTime(1000)
       await store.waitForPendingWrite()
-      const inoBefore = statSync(dataFile()).ino
+      const stateBefore = readPersistedStateJson(dataFile())
       expect((readDataFile() as { githubCache?: unknown }).githubCache).toBeUndefined()
 
       store.setGitHubCache({ pr: { 'o/r#1': { fetchedAt: 123 } as never }, issue: {} })
       vi.advanceTimersByTime(6000)
       await store.waitForPendingWrite()
 
-      expect(statSync(dataFile()).ino).toBe(inoBefore)
+      expect(readPersistedStateJson(dataFile())).toBe(stateBefore)
     } finally {
       vi.useRealTimers()
     }
@@ -360,17 +384,17 @@ describe('Store', () => {
     vi.resetModules()
     const { Store, initDataPath } = await import('./persistence')
     initDataPath()
-    const profileAStore = new Store({ dataFile: profileADataFile })
+    const profileAStore = createSqliteTestStore(Store, { dataFile: profileADataFile })
     profileAStore.setGitHubCache({ pr: { 'o/r#a': { fetchedAt: 10 } as never }, issue: {} })
     profileAStore.flush()
 
-    const profileBStore = new Store({ dataFile: profileBDataFile })
+    const profileBStore = createSqliteTestStore(Store, { dataFile: profileBDataFile })
     expect(profileBStore.getGitHubCache().pr['o/r#a']).toBeUndefined()
     profileBStore.setGitHubCache({ pr: { 'o/r#b': { fetchedAt: 20 } as never }, issue: {} })
     profileBStore.flush()
 
-    const restartedProfileA = new Store({ dataFile: profileADataFile })
-    const restartedProfileB = new Store({ dataFile: profileBDataFile })
+    const restartedProfileA = createSqliteTestStore(Store, { dataFile: profileADataFile })
+    const restartedProfileB = createSqliteTestStore(Store, { dataFile: profileBDataFile })
     expect(restartedProfileA.getGitHubCache().pr['o/r#a']).toEqual({ fetchedAt: 10 })
     expect(restartedProfileA.getGitHubCache().pr['o/r#b']).toBeUndefined()
     expect(restartedProfileB.getGitHubCache().pr['o/r#b']).toEqual({ fetchedAt: 20 })
@@ -423,7 +447,7 @@ describe('Store', () => {
       }
     }
 
-    afterEach(() => {
+    afterEach(async () => {
       _resetTracerForTests()
     })
 
@@ -432,47 +456,53 @@ describe('Store', () => {
       async (hostId) => {
         const store = await createStore()
         store.setWorkspaceSession(boundSession(), hostId)
-        expect(store.persistPtyBinding(binding, hostId)).toBe(true)
-        const inoBefore = statSync(dataFile()).ino
-        const flushSpy = vi.spyOn(store, 'flushOrThrow')
+        expect(await store.persistPtyBinding(binding, hostId)).toBe(true)
+        const stateBefore = readPersistedStateJson(dataFile())
+        const durableGenerationBefore = runtimeCounters(store).lastDurableWriteGeneration
         const cloneSpy = vi.spyOn(globalThis, 'structuredClone')
 
-        expect(store.persistPtyBinding(binding, hostId)).toBe(true)
+        expect(await store.persistPtyBinding(binding, hostId)).toBe(true)
 
-        expect(flushSpy).not.toHaveBeenCalled()
+        expect(runtimeCounters(store).lastDurableWriteGeneration).toBe(durableGenerationBefore)
         expect(cloneSpy).not.toHaveBeenCalled()
-        expect(statSync(dataFile()).ino).toBe(inoBefore)
+        expect(readPersistedStateJson(dataFile())).toBe(stateBefore)
       }
     )
 
     it('flushes while a save is pending, and the sync hash match makes the next call durable', async () => {
       const store = await createStore()
       store.setWorkspaceSession(boundSession())
-      store.persistPtyBinding(binding)
-      const inoBefore = statSync(dataFile()).ino
+      await store.persistPtyBinding(binding)
+      const stateBefore = readPersistedStateJson(dataFile())
       // Bumps the write generation without changing any binding.
       store.setWorkspaceSession({ ...store.getWorkspaceSession() })
-      const flushSpy = vi.spyOn(store, 'flushOrThrow')
+      const durableGenerationBefore = runtimeCounters(store).lastDurableWriteGeneration
 
-      expect(store.persistPtyBinding(binding)).toBe(true)
-      expect(flushSpy).toHaveBeenCalledTimes(1)
-      expect(statSync(dataFile()).ino).toBe(inoBefore)
+      expect(await store.persistPtyBinding(binding)).toBe(true)
+      expect(runtimeCounters(store).lastDurableWriteGeneration).toBeGreaterThan(
+        durableGenerationBefore
+      )
+      expect(readPersistedStateJson(dataFile())).toBe(stateBefore)
 
       // Without the writeToDiskSync counter fix the hash-match flush leaves the durable
       // generation one behind and this third bind would flush again.
-      expect(store.persistPtyBinding(binding)).toBe(true)
-      expect(flushSpy).toHaveBeenCalledTimes(1)
+      expect(await store.persistPtyBinding(binding)).toBe(true)
+      expect(runtimeCounters(store).lastDurableWriteGeneration).toBeGreaterThan(
+        durableGenerationBefore
+      )
     })
 
     it('falls through on an incarnation change and persists the new incarnation', async () => {
       const store = await createStore()
       store.setWorkspaceSession(boundSession())
-      store.persistPtyBinding({ ...binding, incarnationId: 'a' })
-      const flushSpy = vi.spyOn(store, 'flushOrThrow')
+      await store.persistPtyBinding({ ...binding, incarnationId: 'a' })
+      const durableGenerationBefore = runtimeCounters(store).lastDurableWriteGeneration
 
-      expect(store.persistPtyBinding({ ...binding, incarnationId: 'b' })).toBe(true)
+      expect(await store.persistPtyBinding({ ...binding, incarnationId: 'b' })).toBe(true)
 
-      expect(flushSpy).toHaveBeenCalledTimes(1)
+      expect(runtimeCounters(store).lastDurableWriteGeneration).toBeGreaterThan(
+        durableGenerationBefore
+      )
       expect(readDataFile()).toHaveProperty(
         ['workspaceSession', 'terminalPtyIncarnationsByPaneKey', paneKey],
         'b'
@@ -482,18 +512,19 @@ describe('Store', () => {
     it('does not acknowledge an unpersisted binding published after the final flush', async () => {
       const store = await createStore()
       store.setWorkspaceSession(boundSession())
-      store.persistPtyBinding(binding)
+      await store.persistPtyBinding(binding)
       await store.flushAsync()
 
       const next = boundSession()
       next.tabsByWorktree[WORKTREE][0].ptyId = 'pty-after-quit'
       next.terminalLayoutsByTabId.tab1.ptyIdsByLeafId = { [TEST_LEAF_1]: 'pty-after-quit' }
-      store.setWorkspaceSession(next)
+      expect(() => store.setWorkspaceSession(next)).toThrow('finalization')
+      Object.assign(store.getWorkspaceSession(), next)
       expect(store.getWorkspaceSession().tabsByWorktree[WORKTREE][0].ptyId).toBe('pty-after-quit')
 
-      expect(() => store.persistPtyBinding({ ...binding, ptyId: 'pty-after-quit' })).toThrow(
-        'Cannot synchronously flush after final persistence has started'
-      )
+      await expect(
+        store.persistPtyBinding({ ...binding, ptyId: 'pty-after-quit' })
+      ).rejects.toThrow('Cannot mutate finalized profile persistence')
       expect(readDataFile()).toHaveProperty(
         ['workspaceSession', 'tabsByWorktree', WORKTREE, '0', 'ptyId'],
         'pty-1'
@@ -503,12 +534,14 @@ describe('Store', () => {
     it('treats an undefined incarnation against a recorded one as a miss', async () => {
       const store = await createStore()
       store.setWorkspaceSession(boundSession())
-      store.persistPtyBinding({ ...binding, incarnationId: 'a' })
-      const flushSpy = vi.spyOn(store, 'flushOrThrow')
+      await store.persistPtyBinding({ ...binding, incarnationId: 'a' })
+      const durableGenerationBefore = runtimeCounters(store).lastDurableWriteGeneration
 
-      expect(store.persistPtyBinding(binding)).toBe(true)
+      expect(await store.persistPtyBinding(binding)).toBe(true)
 
-      expect(flushSpy).toHaveBeenCalledTimes(1)
+      expect(runtimeCounters(store).lastDurableWriteGeneration).toBeGreaterThan(
+        durableGenerationBefore
+      )
     })
 
     it('falls through on a tombstone and lets the write path clear it', async () => {
@@ -532,11 +565,13 @@ describe('Store', () => {
       expect(
         store.getWorkspaceSession().terminalSurfaceTombstonesByPaneKey?.[paneKey]
       ).toBeDefined()
-      const flushSpy = vi.spyOn(store, 'flushOrThrow')
+      const durableGenerationBefore = runtimeCounters(store).lastDurableWriteGeneration
 
-      expect(store.persistPtyBinding({ ...binding, incarnationId: 'inc-1' })).toBe(true)
+      expect(await store.persistPtyBinding({ ...binding, incarnationId: 'inc-1' })).toBe(true)
 
-      expect(flushSpy).toHaveBeenCalledTimes(1)
+      expect(runtimeCounters(store).lastDurableWriteGeneration).toBeGreaterThan(
+        durableGenerationBefore
+      )
       expect(
         store.getWorkspaceSession().terminalSurfaceTombstonesByPaneKey?.[paneKey]
       ).toBeUndefined()
@@ -547,20 +582,22 @@ describe('Store', () => {
       store.setWorkspaceSession(
         boundSession({ terminalPtyIncarnationsByPaneKey: { [paneKey]: 'inc-stale' } })
       )
-      store.persistPtyBinding({ ...binding, incarnationId: 'inc-stale' })
+      await store.persistPtyBinding({ ...binding, incarnationId: 'inc-stale' })
       const revisionBefore =
         store.getWorkspaceSession().terminalTopologyRevisionByRepoId?.repo1 ?? 0
-      const flushSpy = vi.spyOn(store, 'flushOrThrow')
+      const durableGenerationBefore = runtimeCounters(store).lastDurableWriteGeneration
 
       expect(
-        store.persistPtyBinding({
+        await store.persistPtyBinding({
           ...binding,
           incarnationId: 'inc-live',
           expectedBinding: { ptyId: 'pty-1', incarnationId: 'inc-stale' }
         })
       ).toBe(true)
 
-      expect(flushSpy).toHaveBeenCalledTimes(1)
+      expect(runtimeCounters(store).lastDurableWriteGeneration).toBeGreaterThan(
+        durableGenerationBefore
+      )
       expect(store.getWorkspaceSession().terminalTopologyRevisionByRepoId?.repo1).toBe(
         revisionBefore + 1
       )
@@ -571,8 +608,8 @@ describe('Store', () => {
       store.setWorkspaceSession(
         boundSession({ terminalPtyIncarnationsByPaneKey: { [paneKey]: 'inc-1' } })
       )
-      store.persistPtyBinding({ ...binding, incarnationId: 'inc-1' })
-      const flushSpy = vi.spyOn(store, 'flushOrThrow')
+      await store.persistPtyBinding({ ...binding, incarnationId: 'inc-1' })
+      const durableGenerationBefore = runtimeCounters(store).lastDurableWriteGeneration
 
       const refusals = [
         {
@@ -583,9 +620,9 @@ describe('Store', () => {
         { ...binding, tabId: 'missing-tab', mayCreate: false }
       ]
       for (const refusal of refusals) {
-        expect(store.persistPtyBinding(refusal)).toBe(false)
+        expect(await store.persistPtyBinding(refusal)).toBe(false)
       }
-      expect(flushSpy).not.toHaveBeenCalled()
+      expect(runtimeCounters(store).lastDurableWriteGeneration).toBe(durableGenerationBefore)
     })
 
     it.each([undefined, 'ssh:ssh-1', 'runtime:runtime-1'])(
@@ -593,14 +630,16 @@ describe('Store', () => {
       async (hostId) => {
         const store = await createStore()
         store.setWorkspaceSession(boundSession(), hostId)
-        expect(store.persistPtyBinding(binding, hostId)).toBe(true)
+        expect(await store.persistPtyBinding(binding, hostId)).toBe(true)
         store.addRepo(makeRepo({ id: 'r-dirty', path: '/dirty' }))
-        const flushSpy = vi.spyOn(store, 'flushOrThrow')
+        const durableGenerationBefore = runtimeCounters(store).lastDurableWriteGeneration
 
-        expect(store.persistPtyBinding(binding, hostId)).toBe(true)
-        expect(store.persistPtyBinding(binding, hostId)).toBe(true)
+        expect(await store.persistPtyBinding(binding, hostId)).toBe(true)
+        expect(await store.persistPtyBinding(binding, hostId)).toBe(true)
 
-        expect(flushSpy).toHaveBeenCalledTimes(1)
+        expect(runtimeCounters(store).lastDurableWriteGeneration).toBeGreaterThan(
+          durableGenerationBefore
+        )
         expect(readDataFile()).toMatchObject({
           repos: expect.arrayContaining([expect.objectContaining({ id: 'r-dirty' })])
         })
@@ -610,27 +649,31 @@ describe('Store', () => {
     it('flushes again once the session object is replaced', async () => {
       const store = await createStore()
       store.setWorkspaceSession(boundSession())
-      store.persistPtyBinding(binding)
+      await store.persistPtyBinding(binding)
       // A renderer publish schedules another save, so global durability must be re-established.
       store.setWorkspaceSession({ ...store.getWorkspaceSession() })
       store.addRepo(makeRepo({ id: 'r-dirty', path: '/dirty' }))
-      const flushSpy = vi.spyOn(store, 'flushOrThrow')
+      const durableGenerationBefore = runtimeCounters(store).lastDurableWriteGeneration
 
-      expect(store.persistPtyBinding(binding)).toBe(true)
+      expect(await store.persistPtyBinding(binding)).toBe(true)
 
-      expect(flushSpy).toHaveBeenCalledTimes(1)
+      expect(runtimeCounters(store).lastDurableWriteGeneration).toBeGreaterThan(
+        durableGenerationBefore
+      )
     })
 
     it('flushes a changed pty for a pane whose old binding was durable', async () => {
       const store = await createStore()
       store.setWorkspaceSession(boundSession())
-      store.persistPtyBinding(binding)
+      await store.persistPtyBinding(binding)
       store.addRepo(makeRepo({ id: 'r-dirty', path: '/dirty' }))
-      const flushSpy = vi.spyOn(store, 'flushOrThrow')
+      const durableGenerationBefore = runtimeCounters(store).lastDurableWriteGeneration
 
-      expect(store.persistPtyBinding({ ...binding, ptyId: 'pty-next' })).toBe(true)
+      expect(await store.persistPtyBinding({ ...binding, ptyId: 'pty-next' })).toBe(true)
 
-      expect(flushSpy).toHaveBeenCalledTimes(1)
+      expect(runtimeCounters(store).lastDurableWriteGeneration).toBeGreaterThan(
+        durableGenerationBefore
+      )
       expect(readDataFile()).toHaveProperty(
         ['workspaceSession', 'terminalLayoutsByTabId', 'tab1', 'ptyIdsByLeafId', TEST_LEAF_1],
         'pty-next'
@@ -658,16 +701,16 @@ describe('Store', () => {
       )
       const sibling = { ...binding, leafId: TEST_LEAF_2, ptyId: 'pty-2' }
       // First remount after a cold park: both panes reattach back to back.
-      expect(store.persistPtyBinding(binding)).toBe(true)
-      expect(store.persistPtyBinding(sibling)).toBe(true)
+      expect(await store.persistPtyBinding(binding)).toBe(true)
+      expect(await store.persistPtyBinding(sibling)).toBe(true)
       expect(store.getWorkspaceSession().tabsByWorktree?.[WORKTREE]?.[0]?.ptyId).toBe('pty-1')
-      const flushSpy = vi.spyOn(store, 'flushOrThrow')
+      const durableGenerationBefore = runtimeCounters(store).lastDurableWriteGeneration
 
       // Second remount: neither pane may rewrite the tab row, so neither flushes.
-      expect(store.persistPtyBinding(sibling)).toBe(true)
-      expect(store.persistPtyBinding(binding)).toBe(true)
+      expect(await store.persistPtyBinding(sibling)).toBe(true)
+      expect(await store.persistPtyBinding(binding)).toBe(true)
 
-      expect(flushSpy).not.toHaveBeenCalled()
+      expect(runtimeCounters(store).lastDurableWriteGeneration).toBe(durableGenerationBefore)
       expect(store.getWorkspaceSession().tabsByWorktree?.[WORKTREE]?.[0]?.ptyId).toBe('pty-1')
     })
 
@@ -675,14 +718,14 @@ describe('Store', () => {
       const store = await createStore()
       const hostId = 'ssh:ssh-1'
       store.setWorkspaceSession(boundSession(), hostId)
-      expect(store.persistPtyBinding(binding, hostId)).toBe(true)
+      expect(await store.persistPtyBinding(binding, hostId)).toBe(true)
       const partitionBefore = store.getWorkspaceSession(hostId)
       const partitionsBefore = store['runtime'].state.workspaceSessionsByHostId
-      const flushSpy = vi.spyOn(store, 'flushOrThrow')
+      const durableGenerationBefore = runtimeCounters(store).lastDurableWriteGeneration
 
-      expect(store.persistPtyBinding(binding, hostId)).toBe(true)
+      expect(await store.persistPtyBinding(binding, hostId)).toBe(true)
 
-      expect(flushSpy).not.toHaveBeenCalled()
+      expect(runtimeCounters(store).lastDurableWriteGeneration).toBe(durableGenerationBefore)
       expect(store.getWorkspaceSession(hostId)).toBe(partitionBefore)
       expect(store['runtime'].state.workspaceSessionsByHostId).toBe(partitionsBefore)
       expect(store.getWorkspaceSession().tabsByWorktree?.[WORKTREE]).toBeUndefined()
@@ -692,13 +735,13 @@ describe('Store', () => {
       const store = await createStore()
       store.addRepo(makeRepo())
       store.flushOrThrow()
-      const inoBefore = statSync(dataFile()).ino
+      const stateBefore = readPersistedStateJson(dataFile())
       const after = runtimeCounters(store)
       expect(after.lastDurableWriteGeneration).toBe(after.writeGeneration)
 
       store.flushOrThrow()
 
-      expect(statSync(dataFile()).ino).toBe(inoBefore)
+      expect(readPersistedStateJson(dataFile())).toBe(stateBefore)
       const counters = runtimeCounters(store)
       expect(counters.writeGeneration).toBe(after.writeGeneration + 1)
       expect(counters.lastDurableWriteGeneration).toBe(counters.writeGeneration)
@@ -716,9 +759,9 @@ describe('Store', () => {
       const store = await createStore()
       store.setWorkspaceSession(boundSession())
 
-      store.persistPtyBinding(binding)
-      store.persistPtyBinding(binding)
-      store.persistPtyBinding({ ...binding, tabId: 'missing-tab', mayCreate: false })
+      await store.persistPtyBinding(binding)
+      await store.persistPtyBinding(binding)
+      await store.persistPtyBinding({ ...binding, tabId: 'missing-tab', mayCreate: false })
 
       const spans = records.filter(
         (record) =>
diff --git a/src/main/persistence-folder-workspace-notes.test.ts b/src/main/persistence-folder-workspace-notes.test.ts
index 762cdb2df01e..43abe5b74125 100644
--- a/src/main/persistence-folder-workspace-notes.test.ts
+++ b/src/main/persistence-folder-workspace-notes.test.ts
@@ -1,3 +1,10 @@
+import {
+  closeTestStores,
+  testState,
+  createStore,
+  writeDataFile,
+  readDataFile
+} from './persistence-test-harness'
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
 import { rmSync, mkdtempSync } from 'node:fs'
 import { join } from 'node:path'
@@ -5,7 +12,6 @@ import { tmpdir } from 'node:os'
 import type { PersistedState } from '../shared/persisted-state-types'
 import { folderWorkspaceKey } from '../shared/workspace-scope'
 import { folderWorkspaceToWorktree } from '../shared/folder-workspace-worktree'
-import { testState, createStore, writeDataFile, readDataFile } from './persistence-test-harness'
 
 // Stub the ~/.ssh/config parser so the SSH-import test drives the real Store with deterministic hosts, not the operator's actual ~/.ssh/config.
 const { loadUserSshConfigMock, sshConfigHostsToTargetsMock } = vi.hoisted(() => ({
@@ -55,7 +61,8 @@ describe('Store', () => {
     getCohortAtEmitMock.mockReturnValue({ nth_repo_added: 2 })
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
   // ── 8b. Folder-workspace review notes across a build rollback ──
diff --git a/src/main/persistence-host-admitted-terminal-membership.test.ts b/src/main/persistence-host-admitted-terminal-membership.test.ts
index d71dbc9882c0..3470215a5152 100644
--- a/src/main/persistence-host-admitted-terminal-membership.test.ts
+++ b/src/main/persistence-host-admitted-terminal-membership.test.ts
@@ -1,3 +1,9 @@
+import {
+  closeTestStores,
+  createStore,
+  makeTerminalTab,
+  testState
+} from './persistence-test-harness'
 import { mkdtempSync, rmSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
@@ -6,7 +12,6 @@ import { getDefaultWorkspaceSession } from '../shared/constants'
 import type { WorkspaceSessionState } from '../shared/workspace-session-state-types'
 import { retireTerminalSurfaceFromPersistence } from './runtime/mobile-session-terminal-persistence-retirement'
 import { TEST_LEAF_1, TEST_LEAF_2 } from './persistence-session-fixtures'
-import { createStore, makeTerminalTab, testState } from './persistence-test-harness'
 
 vi.mock('electron', () => ({
   app: { getPath: () => testState.dir },
@@ -47,7 +52,8 @@ describe('host-admitted terminal membership survives a stale renderer replay', (
     testState.dir = mkdtempSync(join(tmpdir(), 'orca-host-membership-'))
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
 
@@ -57,7 +63,7 @@ describe('host-admitted terminal membership survives a stale renderer replay', (
 
     // `orca terminal create`: the host mints a tab the renderer has never seen.
     expect(
-      store.persistPtyBinding({
+      await store.persistPtyBinding({
         worktreeId: WORKTREE,
         tabId: 'host-tab',
         leafId: TEST_LEAF_2,
@@ -77,7 +83,7 @@ describe('host-admitted terminal membership survives a stale renderer replay', (
     const store = await createStore()
     store.setWorkspaceSession(rendererSession())
 
-    store.persistPtyBinding({
+    await store.persistPtyBinding({
       worktreeId: OTHER_WORKTREE,
       tabId: 'host-tab-other',
       leafId: TEST_LEAF_2,
@@ -94,7 +100,7 @@ describe('host-admitted terminal membership survives a stale renderer replay', (
     store.setWorkspaceSession(rendererSession())
 
     expect(
-      store.persistPtyBinding({
+      await store.persistPtyBinding({
         worktreeId: WORKTREE,
         tabId: 'host-tab',
         leafId: TEST_LEAF_2,
@@ -118,7 +124,7 @@ describe('host-admitted terminal membership survives a stale renderer replay', (
     const store = await createStore()
     store.setWorkspaceSession(rendererSession())
 
-    store.persistPtyBinding({
+    await store.persistPtyBinding({
       worktreeId: WORKTREE,
       tabId: 'renderer-second-tab',
       leafId: TEST_LEAF_2,
@@ -135,7 +141,7 @@ describe('host-admitted terminal membership survives a stale renderer replay', (
   it('still lets the authoritative retirement path close the host-admitted tab', async () => {
     const store = await createStore()
     store.setWorkspaceSession(rendererSession())
-    store.persistPtyBinding({
+    await store.persistPtyBinding({
       worktreeId: WORKTREE,
       tabId: 'host-tab',
       leafId: TEST_LEAF_2,
diff --git a/src/main/persistence-host-partitioned-sessions.test.ts b/src/main/persistence-host-partitioned-sessions.test.ts
index d831ec85883a..9c3aad9620f5 100644
--- a/src/main/persistence-host-partitioned-sessions.test.ts
+++ b/src/main/persistence-host-partitioned-sessions.test.ts
@@ -1,11 +1,5 @@
-import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
-import { readFileSync, rmSync, mkdtempSync } from 'node:fs'
-import { join } from 'node:path'
-import { tmpdir } from 'node:os'
-import type { WorkspaceSessionState } from '../shared/workspace-session-state-types'
-import { getDefaultWorkspaceSession } from '../shared/constants'
-import { isTerminalLeafId } from '../shared/stable-pane-id'
 import {
+  closeTestStores,
   testState,
   createStore,
   dataFile,
@@ -16,6 +10,14 @@ import {
   makeWorktreeLineage,
   makeWorkspaceLineage
 } from './persistence-test-harness'
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
+import { readFileSync, rmSync, mkdtempSync } from 'node:fs'
+import { join } from 'node:path'
+import { tmpdir } from 'node:os'
+import type { WorkspaceSessionState } from '../shared/workspace-session-state-types'
+import { getDefaultWorkspaceSession } from '../shared/constants'
+import { isTerminalLeafId } from '../shared/stable-pane-id'
+
 import { worktreeWorkspaceKey } from '../shared/workspace-scope'
 
 // Stub the ~/.ssh/config parser so the SSH-import test drives the real Store with deterministic hosts, not the operator's actual ~/.ssh/config.
@@ -63,7 +65,8 @@ describe('Store host-partitioned workspace sessions', () => {
     testState.dir = mkdtempSync(join(tmpdir(), 'orca-test-'))
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
 
diff --git a/src/main/persistence-host-partitioned-ssh-pty-bindings.test.ts b/src/main/persistence-host-partitioned-ssh-pty-bindings.test.ts
index ff819432c54b..9010f11285ac 100644
--- a/src/main/persistence-host-partitioned-ssh-pty-bindings.test.ts
+++ b/src/main/persistence-host-partitioned-ssh-pty-bindings.test.ts
@@ -1,10 +1,13 @@
+import { closeTestStores, testState, createStore } from './persistence-test-harness'
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
+
 import { rmSync, mkdtempSync } from 'node:fs'
 import { join } from 'node:path'
 import { tmpdir } from 'node:os'
+import { ProfileStateSqliteAuthority } from './persistence/profile-state/profile-state-sqlite-authority'
 import type { WorkspaceSessionState } from '../shared/workspace-session-state-types'
 import { getDefaultWorkspaceSession } from '../shared/constants'
-import { testState, createStore } from './persistence-test-harness'
+
 import { TEST_LEAF_1 } from './persistence-session-fixtures'
 
 const { trackMock, getCohortAtEmitMock } = vi.hoisted(() => ({
@@ -42,7 +45,8 @@ describe('Store SSH remote PTY bindings across host partitions', () => {
     testState.dir = mkdtempSync(join(tmpdir(), 'orca-test-'))
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
 
@@ -80,7 +84,7 @@ describe('Store SSH remote PTY bindings across host partitions', () => {
     store.setWorkspaceSession(makeBoundHostSession(null), 'local')
     store.setWorkspaceSession(makeBoundHostSession(null), 'ssh:ssh-1')
 
-    store.persistPtyBinding(
+    await store.persistPtyBinding(
       {
         worktreeId: 'repo-1::/worktree',
         tabId: 'tab-1',
@@ -102,11 +106,14 @@ describe('Store SSH remote PTY bindings across host partitions', () => {
     const store = await createStore()
     store.setWorkspaceSession(makeBoundHostSession(null), 'local')
     store.setWorkspaceSession(makeBoundHostSession(null), 'ssh:ssh-1')
-    const flush = vi.spyOn(store, 'flushOrThrow').mockImplementationOnce(() => {
-      throw new Error('disk unavailable')
-    })
+    store.flushOrThrow()
+    const flush = vi
+      .spyOn(ProfileStateSqliteAuthority.prototype, 'writeSerializedDomains')
+      .mockImplementationOnce(() => {
+        throw new Error('disk unavailable')
+      })
 
-    expect(() =>
+    await expect(
       store.persistPtyBinding(
         {
           worktreeId: 'repo-1::/worktree',
@@ -116,7 +123,7 @@ describe('Store SSH remote PTY bindings across host partitions', () => {
         },
         'ssh:ssh-1'
       )
-    ).toThrow('disk unavailable')
+    ).rejects.toThrow('disk unavailable')
     flush.mockRestore()
 
     expect(
diff --git a/src/main/persistence-initial-load.test.ts b/src/main/persistence-initial-load.test.ts
index 934ab44e1cb6..13beae7932c7 100644
--- a/src/main/persistence-initial-load.test.ts
+++ b/src/main/persistence-initial-load.test.ts
@@ -1,21 +1,26 @@
-import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
-import { writeFileSync, rmSync, mkdtempSync, mkdirSync } from 'node:fs'
-import { join } from 'node:path'
-import { tmpdir } from 'node:os'
-import type { PersistedState } from '../shared/persisted-state-types'
-import type { WorkspaceSessionState } from '../shared/workspace-session-state-types'
-import { getDefaultPersistedState, getDefaultWorkspaceSession } from '../shared/constants'
-import { closeTerminalTabInWorkspaceSession } from '../shared/workspace-session-terminal-tab-close'
 import {
+  closeTestStores,
   testState,
   createStore,
   writeDataFile,
   readDataFile,
   makeRepo,
   makeProject,
-  makeProjectHostSetup
+  makeProjectHostSetup,
+  createSqliteTestStore
 } from './persistence-test-harness'
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
+import { writeFileSync, rmSync, mkdtempSync, mkdirSync } from 'node:fs'
+import { join } from 'node:path'
+import { tmpdir } from 'node:os'
+import type { PersistedState } from '../shared/persisted-state-types'
+import type { WorkspaceSessionState } from '../shared/workspace-session-state-types'
+import { getDefaultPersistedState, getDefaultWorkspaceSession } from '../shared/constants'
+import { closeTerminalTabInWorkspaceSession } from '../shared/workspace-session-terminal-tab-close'
+
 import { TEST_LEAF_1 } from './persistence-session-fixtures'
+import { ProfileStateSqliteAuthority } from './persistence/profile-state/profile-state-sqlite-authority'
+
 import {
   getLocalWorktreeScanGeneration,
   isLocalWorktreeScanGenerationCurrent
@@ -69,7 +74,8 @@ describe('Store', () => {
     getCohortAtEmitMock.mockReturnValue({ nth_repo_added: 2 })
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
   // ── 1. Defaults when no file exists ──────────────────────────────────
@@ -79,7 +85,7 @@ describe('Store', () => {
     expect(store.getRepos()).toEqual([])
   }, 15_000)
 
-  it('clone-reads and synchronously persists the main-owned Codex reset ledger', async () => {
+  it('clone-reads and durably persists the main-owned Codex reset ledger', async () => {
     const store = await createStore()
     const ledger = {
       version: 1 as const,
@@ -97,7 +103,7 @@ describe('Store', () => {
       ]
     }
 
-    store.replaceCodexResetCreditAttemptLedgerAndFlush(ledger)
+    await store.replaceCodexResetCreditAttemptLedgerAndFlush(ledger)
     const firstRead = store.getCodexResetCreditAttemptLedger()
     firstRead.attempts.splice(0, 1)
 
@@ -105,32 +111,37 @@ describe('Store', () => {
     expect((readDataFile() as PersistedState).codexResetCreditAttemptLedger).toEqual(ledger)
   })
 
-  it('rolls the in-memory Codex reset ledger back when its sync flush fails', async () => {
+  it('rolls the in-memory Codex reset ledger back when its durable write fails', async () => {
     const store = await createStore()
     const before = store.getCodexResetCreditAttemptLedger()
-    vi.spyOn(store, 'flushOrThrow').mockImplementationOnce(() => {
-      throw new Error('disk full')
-    })
-
-    expect(() =>
-      store.replaceCodexResetCreditAttemptLedgerAndFlush({
-        version: 1,
-        attempts: [
-          {
-            idempotencyKey: '11111111-1111-4111-8111-111111111111',
-            expectedScope: {
-              target: { runtime: 'host', wslDistro: null },
-              accountId: 'account-host',
-              accountRevision: 42,
-              offerRevision: 'v1:offer'
-            },
-            state: 'providerPending'
-          }
-        ]
+    const write = vi
+      .spyOn(ProfileStateSqliteAuthority.prototype, 'writeCompleteSerializedDomains')
+      .mockImplementationOnce(() => {
+        throw new Error('disk full')
       })
-    ).toThrow('disk full')
 
-    expect(store.getCodexResetCreditAttemptLedger()).toEqual(before)
+    try {
+      await expect(
+        store.replaceCodexResetCreditAttemptLedgerAndFlush({
+          version: 1,
+          attempts: [
+            {
+              idempotencyKey: '11111111-1111-4111-8111-111111111111',
+              expectedScope: {
+                target: { runtime: 'host', wslDistro: null },
+                accountId: 'account-host',
+                accountRevision: 42,
+                offerRevision: 'v1:offer'
+              },
+              state: 'providerPending'
+            }
+          ]
+        })
+      ).rejects.toThrow('disk full')
+      expect(store.getCodexResetCreditAttemptLedger()).toEqual(before)
+    } finally {
+      write.mockRestore()
+    }
   })
 
   it('preserves a corrupt Codex reset ledger as a fail-closed read error', async () => {
@@ -222,7 +233,7 @@ describe('Store', () => {
     vi.resetModules()
     const { Store, initDataPath } = await import('./persistence')
     initDataPath()
-    const store = new Store({ dataFile: profileDataFile })
+    const store = createSqliteTestStore(Store, { dataFile: profileDataFile })
 
     expect(store.getRepos().map((repo) => repo.id)).toEqual(['profile-repo'])
   }, 15_000)
diff --git a/src/main/persistence-layout-binding-recovery.test.ts b/src/main/persistence-layout-binding-recovery.test.ts
index c539f3dd47b9..7f3998eb58ba 100644
--- a/src/main/persistence-layout-binding-recovery.test.ts
+++ b/src/main/persistence-layout-binding-recovery.test.ts
@@ -1,9 +1,10 @@
+import { closeTestStores, testState, createStore, makeRepo } from './persistence-test-harness'
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
 import { rmSync, mkdtempSync } from 'node:fs'
 import { join } from 'node:path'
 import { tmpdir } from 'node:os'
 import { isTerminalLeafId } from '../shared/stable-pane-id'
-import { testState, createStore, makeRepo } from './persistence-test-harness'
+
 import {
   TEST_LEAF_1,
   TEST_LEAF_2,
@@ -59,7 +60,8 @@ describe('Store', () => {
     getCohortAtEmitMock.mockReturnValue({ nth_repo_added: 2 })
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
   it('drops legacy leaf-keyed records from mixed-version writes before binding preservation', async () => {
diff --git a/src/main/persistence-load-repair-durability.test.ts b/src/main/persistence-load-repair-durability.test.ts
index 31ed5d5b4514..5cb2bbe8f4f1 100644
--- a/src/main/persistence-load-repair-durability.test.ts
+++ b/src/main/persistence-load-repair-durability.test.ts
@@ -1,3 +1,10 @@
+import {
+  closeTestStores,
+  testState,
+  createStore,
+  writeDataFile,
+  readDataFile
+} from './persistence-test-harness'
 /**
  * Load-time normalization repairs the in-memory state; without a matching dirty mark the bad value
  * stays on disk and the repair reruns on every launch. Each case here reloads a profile the current
@@ -10,7 +17,6 @@ import { rmSync, mkdtempSync } from 'node:fs'
 import { join } from 'node:path'
 import { tmpdir } from 'node:os'
 import type { PersistedState } from '../shared/persisted-state-types'
-import { testState, createStore, writeDataFile, readDataFile } from './persistence-test-harness'
 
 const { loadUserSshConfigMock, sshConfigHostsToTargetsMock } = vi.hoisted(() => ({
   loadUserSshConfigMock: vi.fn(),
@@ -81,7 +87,8 @@ describe('load-time normalization durability', () => {
     getCohortAtEmitMock.mockReturnValue({ nth_repo_added: 2 })
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
 
diff --git a/src/main/persistence-loading-store-extraction.test.ts b/src/main/persistence-loading-store-extraction.test.ts
index a3c5e2489096..3acec0d56a47 100644
--- a/src/main/persistence-loading-store-extraction.test.ts
+++ b/src/main/persistence-loading-store-extraction.test.ts
@@ -1,23 +1,34 @@
+import {
+  closeTestStores,
+  createSqliteTestStore,
+  readPersistedStateJson,
+  writePersistedStateJson,
+  createStore,
+  dataFile,
+  makeRepo,
+  testState
+} from './persistence-test-harness'
 import { afterEach, beforeEach, describe, expect, expectTypeOf, it, vi } from 'vitest'
-import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { createProfileStateStore } from './persistence/profile-state/profile-state-store-factory'
+import type * as FsModule from 'node:fs'
+import {
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  rmSync,
+  writeFileSync,
+  writeSync
+} from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { getDefaultPersistedState, getDefaultWorkspaceSession } from '../shared/constants'
 import type { PersistedState } from '../shared/persisted-state-types'
-import type * as StartupDiagnosticsModule from './startup/startup-diagnostics'
 import type { Store as PersistenceStore } from './persistence/loading-store/store'
-import {
-  createStore,
-  dataFile,
-  makeRepo,
-  testState,
-  writeDataFile
-} from './persistence-test-harness'
 
-const { trackMock, getCohortAtEmitMock, logStartupDiagnosticMock } = vi.hoisted(() => ({
+const { trackMock, getCohortAtEmitMock } = vi.hoisted(() => ({
   trackMock: vi.fn(),
-  getCohortAtEmitMock: vi.fn(() => ({ nth_repo_added: 2 })),
-  logStartupDiagnosticMock: vi.fn()
+  getCohortAtEmitMock: vi.fn(() => ({ nth_repo_added: 2 }))
 }))
 
 vi.mock('electron', () => ({
@@ -41,19 +52,30 @@ vi.mock('./ssh/ssh-config-parser', () => ({
   loadUserSshConfig: vi.fn(() => ({ hosts: [] })),
   sshConfigHostsToTargets: vi.fn(() => [])
 }))
-vi.mock('./startup/startup-diagnostics', async (importOriginal) => {
-  const actual = await importOriginal<typeof StartupDiagnosticsModule>()
-  return { ...actual, logStartupDiagnostic: logStartupDiagnosticMock }
+vi.mock('node:fs', async (importOriginal) => {
+  const actual = await importOriginal<typeof FsModule>()
+  return { ...actual, writeSync: vi.fn(actual.writeSync) }
 })
 
+function getLoadDoneLines(): string[] {
+  return vi
+    .mocked(writeSync)
+    .mock.calls.flatMap(([fd, text]) =>
+      fd === 2 && typeof text === 'string' && text.startsWith('[startup] persistence-load-done ')
+        ? [text]
+        : []
+    )
+}
+
 describe('loading Store extraction seams', () => {
   beforeEach(() => {
     testState.dir = mkdtempSync(join(tmpdir(), 'orca-loading-store-'))
   })
 
-  afterEach(() => {
+  afterEach(async () => {
     vi.unstubAllEnvs()
-    logStartupDiagnosticMock.mockReset()
+    vi.mocked(writeSync).mockClear()
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
 
@@ -62,7 +84,7 @@ describe('loading Store extraction seams', () => {
     vi.stubEnv('ORCA_STARTUP_DIAGNOSTICS', '')
     const state = getDefaultPersistedState(testState.dir)
     state.workspaceSession = { ...state.workspaceSession, activeTabId: sentinel }
-    writeDataFile(state)
+    writePersistedStateJson(dataFile(), JSON.stringify(state))
 
     const stringifySpy = vi.spyOn(JSON, 'stringify')
     const store = createStore()
@@ -78,9 +100,7 @@ describe('loading Store extraction seams', () => {
 
     expect(store.getWorkspaceSession().activeTabId).toBe(sentinel)
     expect(workspaceSessionStringifyCalls).toHaveLength(0)
-    expect(
-      logStartupDiagnosticMock.mock.calls.some(([event]) => event === 'persistence-load-done')
-    ).toBe(false)
+    expect(getLoadDoneLines()).toEqual([])
   })
 
   it('reports the unchanged workspace-session byte count when startup diagnostics are enabled', () => {
@@ -88,7 +108,7 @@ describe('loading Store extraction seams', () => {
     vi.stubEnv('ORCA_STARTUP_DIAGNOSTICS', '1')
     const state = getDefaultPersistedState(testState.dir)
     state.workspaceSession = { ...state.workspaceSession, activeTabId: sentinel }
-    writeDataFile(state)
+    writePersistedStateJson(dataFile(), JSON.stringify(state))
 
     const stringifySpy = vi.spyOn(JSON, 'stringify')
     const store = createStore()
@@ -104,16 +124,14 @@ describe('loading Store extraction seams', () => {
 
     expect(store.getWorkspaceSession().activeTabId).toBe(sentinel)
     expect(workspaceSessionStringifyCalls).toHaveLength(1)
-    const loadDoneCall = logStartupDiagnosticMock.mock.calls.find(
-      ([event]) => event === 'persistence-load-done'
-    )
-    expect(loadDoneCall).toBeDefined()
-    const details = loadDoneCall?.[1] as Record<string, unknown> | undefined
-    expect(details).toEqual({
-      t: expect.any(Number),
-      repos: state.repos.length,
-      workspaceSessionBytes: Buffer.byteLength(JSON.stringify(store.getWorkspaceSession()))
-    })
+    const expectedBytes = Buffer.byteLength(JSON.stringify(store.getWorkspaceSession()))
+    expect(getLoadDoneLines()).toEqual([
+      expect.stringMatching(
+        new RegExp(
+          `^\\[startup\\] persistence-load-done t=\\d+ repos=${state.repos.length} workspaceSessionBytes=${expectedBytes}\\n$`
+        )
+      )
+    ])
   })
 
   it('timestamps persistence-load-done before resolving its details closure', () => {
@@ -121,7 +139,7 @@ describe('loading Store extraction seams', () => {
     vi.stubEnv('ORCA_STARTUP_DIAGNOSTICS', '1')
     const state = getDefaultPersistedState(testState.dir)
     state.workspaceSession = { ...state.workspaceSession, activeTabId: sentinel }
-    writeDataFile(state)
+    writePersistedStateJson(dataFile(), JSON.stringify(state))
 
     // Fake clock only the details closure advances, so a post-closure timestamp is unambiguous.
     let clock = 0
@@ -149,16 +167,14 @@ describe('loading Store extraction seams', () => {
       nowSpy.mockRestore()
     }
 
-    const loadDoneCall = logStartupDiagnosticMock.mock.calls.find(
-      ([event]) => event === 'persistence-load-done'
-    )
-    const details = loadDoneCall?.[1] as Record<string, unknown> | undefined
-    expect(details?.workspaceSessionBytes).toEqual(expect.any(Number))
-    expect(details?.t).toBe(0)
+    expect(getLoadDoneLines()).toEqual([
+      expect.stringMatching(
+        /^\[startup\] persistence-load-done t=0 repos=\d+ workspaceSessionBytes=\d+\n$/
+      )
+    ])
   })
 
-  it('accepts the first JSON-parseable backup even when an older backup has richer state', async () => {
-    mkdirSync(testState.dir, { recursive: true })
+  it('imports the first usable legacy backup without overwriting the damaged source', () => {
     writeFileSync(dataFile(), '{{corrupt-primary', 'utf-8')
     writeFileSync(`${dataFile()}.bak.0`, '{}', 'utf-8')
     writeFileSync(
@@ -166,31 +182,33 @@ describe('loading Store extraction seams', () => {
       JSON.stringify({ repos: [makeRepo({ id: 'older-complete-profile' })] }),
       'utf-8'
     )
-
-    const store = await createStore()
-
-    expect(store.getRepos()).toEqual([])
-    expect(readFileSync(dataFile(), 'utf-8')).toBe('{}')
+    const { store } = createProfileStateStore({
+      dataFile: dataFile(),
+      databaseFile: join(testState.dir, 'profile-state.db'),
+      profileId: 'backup-import'
+    })
+    try {
+      expect(store.getRepos()).toEqual([])
+      expect(readFileSync(dataFile(), 'utf-8')).toBe('{{corrupt-primary')
+      expect(readPersistedStateJson(dataFile(), 'backup-import')).toContain('"repos":[]')
+    } finally {
+      store.freezeWrites()
+    }
   })
 
-  it('leaves backup bytes reusable when publishing recovery to the primary path fails', async () => {
+  it('leaves backup bytes reusable when the legacy source cannot be read', () => {
     mkdirSync(dataFile(), { recursive: true })
-    writeFileSync(
-      `${dataFile()}.bak.0`,
-      JSON.stringify({ repos: [makeRepo({ id: 'recovery-survives-publish-failure' })] }),
-      'utf-8'
-    )
-
-    const failedRecovery = await createStore()
-    expect(failedRecovery.getRepos()).toEqual([])
-    failedRecovery.freezeWrites()
-    expect(existsSync(`${dataFile()}.bak.0`)).toBe(true)
-
-    rmSync(dataFile(), { recursive: true, force: true })
-    const recovered = await createStore()
-    expect(recovered.getRepos().map((repo) => repo.id)).toEqual([
-      'recovery-survives-publish-failure'
-    ])
+    const backup = JSON.stringify({ repos: [makeRepo({ id: 'recovery-survives-read-failure' })] })
+    writeFileSync(`${dataFile()}.bak.0`, backup, 'utf-8')
+    expect(() =>
+      createProfileStateStore({
+        dataFile: dataFile(),
+        databaseFile: join(testState.dir, 'profile-state.db'),
+        profileId: 'backup-import'
+      })
+    ).toThrow()
+    expect(readFileSync(`${dataFile()}.bak.0`, 'utf-8')).toBe(backup)
+    expect(existsSync(join(testState.dir, 'profile-state.db'))).toBe(false)
   })
 
   it('aliases blank host reads, writes, and patches to the local disk partition', async () => {
@@ -205,7 +223,8 @@ describe('loading Store extraction seams', () => {
     expect(store.getWorkspaceSession('  ').activeRepoId).toBe('from-blank-patch')
     expect(store.getWorkspaceSessionHostIds()).toEqual(['local'])
 
-    const persisted = JSON.parse(readFileSync(dataFile(), 'utf-8')) as PersistedState
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The preceding Store save produced the PersistedState snapshot read by this test.
+    const persisted = JSON.parse(readPersistedStateJson(dataFile())) as PersistedState
     expect(persisted.workspaceSession?.activeRepoId).toBe('from-blank-patch')
     expect(persisted.workspaceSessionsByHostId).toEqual({})
   })
@@ -216,7 +235,7 @@ describe('loading Store extraction seams', () => {
     const { setMigrationUnsupportedPty } =
       await import('./agent-hooks/migration-unsupported-pty-state')
     const secondDataFile = join(testState.dir, 'second-profile', 'orca-data.json')
-    const second = new Store({ dataFile: secondDataFile })
+    const second = createSqliteTestStore(Store, { dataFile: secondDataFile })
 
     setMigrationUnsupportedPty({
       ptyId: 'listener-owner-pty',
@@ -227,8 +246,10 @@ describe('loading Store extraction seams', () => {
     first.flushOrThrow()
     second.flushOrThrow()
 
-    const firstState = JSON.parse(readFileSync(dataFile(), 'utf-8')) as PersistedState
-    const secondState = JSON.parse(readFileSync(secondDataFile, 'utf-8')) as PersistedState
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The preceding Store save produced the PersistedState snapshot read by this test.
+    const firstState = JSON.parse(readPersistedStateJson(dataFile())) as PersistedState
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The preceding Store save produced the PersistedState snapshot read by this test.
+    const secondState = JSON.parse(readPersistedStateJson(secondDataFile)) as PersistedState
     expect(
       firstState.migrationUnsupportedPtyEntries?.some(
         (entry) => entry.ptyId === 'listener-owner-pty'
@@ -249,7 +270,8 @@ describe('loading Store extraction seams', () => {
 
     store.updateUI({ sidebarWidth: 732 })
     expect(store.flushAsync()).toBe(finalFlush)
-    const persisted = JSON.parse(readFileSync(dataFile(), 'utf-8')) as PersistedState
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The preceding Store save produced the PersistedState snapshot read by this test.
+    const persisted = JSON.parse(readPersistedStateJson(dataFile())) as PersistedState
     expect(persisted.ui.sidebarWidth).toBe(731)
     expect(store.getUI().sidebarWidth).toBe(732)
   })
@@ -262,7 +284,8 @@ describe('loading Store extraction seams', () => {
     store.updateUI({ sidebarWidth: 742 })
     await finalFlush
 
-    const persisted = JSON.parse(readFileSync(dataFile(), 'utf-8')) as PersistedState
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The preceding Store save produced the PersistedState snapshot read by this test.
+    const persisted = JSON.parse(readPersistedStateJson(dataFile())) as PersistedState
     expect(persisted.ui.sidebarWidth).toBe(742)
   })
 
@@ -300,7 +323,7 @@ describe('loading Store extraction seams', () => {
         return 47
       }
     }
-    const overridden = new StoreWithRepoCountOverride({
+    const overridden = createSqliteTestStore(StoreWithRepoCountOverride, {
       dataFile: join(testState.dir, 'override-profile', 'orca-data.json')
     })
     expect(overridden.getRepoCount()).toBe(47)
diff --git a/src/main/persistence-loading-store-write-risks.test.ts b/src/main/persistence-loading-store-write-risks.test.ts
index 422573516f1b..d7dd84f35a53 100644
--- a/src/main/persistence-loading-store-write-risks.test.ts
+++ b/src/main/persistence-loading-store-write-risks.test.ts
@@ -1,122 +1,63 @@
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import { mkdtempSync, readFileSync, rmSync } from 'node:fs'
-import type * as NodeFsPromises from 'node:fs/promises'
-import { join } from 'node:path'
-import { tmpdir } from 'node:os'
-import { installFakeAppEnvironment } from '../../config/scripts/vitest-host-ports-setup'
-import { Store } from './persistence/loading-store/store'
-import { initDataPath } from './persistence/loading-store/user-data-path'
+import { describe, expect, it, vi } from 'vitest'
+import {
+  createWorkerMaintenanceFixture,
+  maintenanceBarrier
+} from './persistence/loading-store/profile-state-maintenance-fixture'
 
-const testState = { dir: '' }
-
-const writeControl = vi.hoisted(() => {
-  let releaseRename: (() => void) | null = null
-  let markRenameStarted: (() => void) | null = null
-  return {
-    blockPrimaryRename: false,
-    failPrimaryOpen: false,
-    renameStarted: Promise.resolve(),
-    renameRelease: Promise.resolve(),
-    reset(): void {
-      this.blockPrimaryRename = false
-      this.failPrimaryOpen = false
-      this.renameStarted = new Promise<void>((resolve) => {
-        markRenameStarted = resolve
-      })
-      this.renameRelease = new Promise<void>((resolve) => {
-        releaseRename = resolve
-      })
-    },
-    markRenameStarted(): void {
-      markRenameStarted?.()
-    },
-    releaseRename(): void {
-      releaseRename?.()
-    }
-  }
-})
-
-vi.mock('node:fs/promises', async (importOriginal) => {
-  const actual = await importOriginal<typeof NodeFsPromises>()
-  return {
-    ...actual,
-    open: async (...args: Parameters<typeof actual.open>) => {
-      const target = String(args[0])
-      if (
-        writeControl.failPrimaryOpen &&
-        target.includes('orca-data.json.') &&
-        target.endsWith('.tmp')
-      ) {
-        throw Object.assign(new Error('profile mount rejected write'), { code: 'EIO' })
-      }
-      return actual.open(...args)
-    },
-    rename: async (...args: Parameters<typeof actual.rename>) => {
-      const target = String(args[1])
-      if (writeControl.blockPrimaryRename && target.endsWith('orca-data.json')) {
-        writeControl.markRenameStarted()
-        await writeControl.renameRelease
-      }
-      return actual.rename(...args)
-    }
-  }
-})
-
-vi.mock('electron', () => ({
-  app: { getPath: () => testState.dir },
-  safeStorage: {
-    isEncryptionAvailable: () => true,
-    encryptString: (plaintext: string) => Buffer.from(`encrypted:${plaintext}`, 'utf-8'),
-    decryptString: (ciphertext: Buffer) => ciphertext.toString('utf-8').slice('encrypted:'.length)
-  }
-}))
 vi.mock('./ssh/ssh-config-parser', () => ({
   loadUserSshConfig: vi.fn(),
   sshConfigHostsToTargets: vi.fn()
 }))
 vi.mock('./telemetry/client', () => ({ track: vi.fn() }))
 vi.mock('./telemetry/cohort-classifier', () => ({
-  getCohortAtEmit: vi.fn(() => ({ nth_repo_added: 2 }))
+  getCohortAtEmit: () => ({ nth_repo_added: 2 })
 }))
 
-function createStore(): Store {
-  installFakeAppEnvironment({ getPath: () => testState.dir })
-  initDataPath()
-  return new Store({ dataFile: join(testState.dir, 'orca-data.json') })
-}
-
 describe('loading Store write-risk characterization', () => {
-  beforeEach(() => {
-    testState.dir = mkdtempSync(join(tmpdir(), 'orca-write-risk-'))
-    writeControl.reset()
-    vi.useFakeTimers()
-  })
-
-  afterEach(() => {
-    vi.useRealTimers()
-    rmSync(testState.dir, { recursive: true, force: true })
-  })
+  it('awaits an accepted worker commit before freezing and rejects later writes', async () => {
+    const { store, authority, readState } = await createWorkerMaintenanceFixture()
+    const committed = maintenanceBarrier()
+    const acknowledge = maintenanceBarrier()
+    const writeDomains = authority.writeCompleteSerializedDomains.bind(authority)
+    vi.spyOn(authority, 'writeCompleteSerializedDomains').mockImplementationOnce(
+      async (replacements) => {
+        await writeDomains(replacements)
+        committed.resolve()
+        await acknowledge.promise
+      }
+    )
+    const close = vi.spyOn(authority, 'close')
 
-  it('allows an already-started primary rename to publish after writes are frozen', async () => {
-    const store = await createStore()
-    writeControl.blockPrimaryRename = true
     store.updateUI({ sidebarWidth: 712 })
-    vi.advanceTimersByTime(1_000)
-    await writeControl.renameStarted
-
-    store.freezeWrites()
-    writeControl.releaseRename()
-    await store.waitForPendingWrite()
+    const writing = store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
+    await committed.promise
+    const frozen = store.freezeWritesAsync()
+    await Promise.resolve()
+    expect(close).not.toHaveBeenCalled()
+    await expect(store.runDurableMutation(() => ({ value: undefined }))).rejects.toThrow(
+      'finalized'
+    )
 
-    const persisted = JSON.parse(readFileSync(join(testState.dir, 'orca-data.json'), 'utf-8')) as {
-      ui: { sidebarWidth: number }
-    }
-    expect(persisted.ui.sidebarWidth).toBe(712)
+    acknowledge.resolve()
+    await writing
+    await frozen
+    expect(close).toHaveBeenCalledOnce()
+    expect(readState().ui.sidebarWidth).toBe(712)
+    store.updateUI({ sidebarWidth: 999 })
+    await expect(store.flushPendingOrThrowAsync()).rejects.toThrow('finalized')
+    expect(readState().ui.sidebarWidth).toBe(712)
   })
 
   it('keeps a rejected durable mutation in memory for a later unrelated flush', async () => {
-    const store = await createStore()
-    writeControl.failPrimaryOpen = true
+    const { store, authority, readState } = await createWorkerMaintenanceFixture()
+    const before = readState().sshPtyConsumerRecoveries
+    const writeDomains = authority.writeCompleteSerializedDomains.bind(authority)
+    const rejectedWrite = vi
+      .spyOn(authority, 'writeCompleteSerializedDomains')
+      .mockImplementationOnce(() =>
+        writeDomains([{ domain: 'sshPtyConsumerRecoveries', payload: '{' }])
+      )
+    vi.spyOn(console, 'error').mockImplementation(() => {})
     await expect(
       store.upsertSshPtyConsumerRecovery({
         targetId: 'ssh-1',
@@ -126,14 +67,16 @@ describe('loading Store write-risk characterization', () => {
         ownerGeneration: 5,
         ownerLease: 'secret-owner-lease'
       })
-    ).rejects.toThrow('profile mount rejected write')
+    ).rejects.toMatchObject({ outcome: 'known-failure' })
+    expect(readState().sshPtyConsumerRecoveries).toEqual(before)
+    expect(store.getSshPtyConsumerRecovery('ssh-1')?.clientInstanceId).toBe('client-1')
 
-    writeControl.failPrimaryOpen = false
+    rejectedWrite.mockRestore()
     store.updateUI({ sidebarWidth: 713 })
     await store.flushPendingOrThrowAsync()
-    const persisted = JSON.parse(readFileSync(join(testState.dir, 'orca-data.json'), 'utf-8')) as {
-      sshPtyConsumerRecoveries: { clientInstanceId: string }[]
-    }
-    expect(persisted.sshPtyConsumerRecoveries[0]?.clientInstanceId).toBe('client-1')
+    expect(readState()).toMatchObject({
+      ui: { sidebarWidth: 713 },
+      sshPtyConsumerRecoveries: [expect.objectContaining({ clientInstanceId: 'client-1' })]
+    })
   })
 })
diff --git a/src/main/persistence-native-chat-tab-view-mode.test.ts b/src/main/persistence-native-chat-tab-view-mode.test.ts
index 9bcaab154945..96de2f21f678 100644
--- a/src/main/persistence-native-chat-tab-view-mode.test.ts
+++ b/src/main/persistence-native-chat-tab-view-mode.test.ts
@@ -1,8 +1,14 @@
+import {
+  closeTestStores,
+  testState,
+  createStore,
+  writeDataFile,
+  makeRepo
+} from './persistence-test-harness'
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
 import { rmSync, mkdtempSync } from 'node:fs'
 import { join } from 'node:path'
 import { tmpdir } from 'node:os'
-import { testState, createStore, writeDataFile, makeRepo } from './persistence-test-harness'
 
 // Stub the ~/.ssh/config parser so the SSH-import test drives the real Store with deterministic hosts, not the operator's actual ~/.ssh/config.
 const { loadUserSshConfigMock, sshConfigHostsToTargetsMock } = vi.hoisted(() => ({
@@ -49,7 +55,8 @@ describe('Store native-chat tab viewMode persistence', () => {
     testState.dir = mkdtempSync(join(tmpdir(), 'orca-test-'))
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
 
diff --git a/src/main/persistence-pane-identity-migration.test.ts b/src/main/persistence-pane-identity-migration.test.ts
index c9a6fc4e5929..d93244cbc421 100644
--- a/src/main/persistence-pane-identity-migration.test.ts
+++ b/src/main/persistence-pane-identity-migration.test.ts
@@ -1,10 +1,17 @@
+import {
+  closeTestStores,
+  testState,
+  createStore,
+  writeDataFile,
+  readDataFile
+} from './persistence-test-harness'
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
 import { writeFileSync, rmSync, mkdtempSync, mkdirSync } from 'node:fs'
 import { join } from 'node:path'
 import { tmpdir } from 'node:os'
 import type { PersistedState } from '../shared/persisted-state-types'
 import { isTerminalLeafId, makePaneKey } from '../shared/stable-pane-id'
-import { testState, createStore, writeDataFile, readDataFile } from './persistence-test-harness'
+
 import {
   TEST_LEAF_1,
   TEST_LEAF_2,
@@ -59,7 +66,8 @@ describe('Store', () => {
     getCohortAtEmitMock.mockReturnValue({ nth_repo_added: 2 })
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
   it('hydrates split-pane legacy numeric agent status rows onto the matching remapped leaves', async () => {
diff --git a/src/main/persistence-protected-secret-fail-closed.test.ts b/src/main/persistence-protected-secret-fail-closed.test.ts
index 26f49ea2e442..1bd42aa6ef31 100644
--- a/src/main/persistence-protected-secret-fail-closed.test.ts
+++ b/src/main/persistence-protected-secret-fail-closed.test.ts
@@ -1,5 +1,10 @@
+import {
+  closeTestStores,
+  createSqliteTestStore,
+  readPersistedStateJson
+} from './persistence-test-harness'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { randomUUID } from 'node:crypto'
@@ -61,7 +66,7 @@ async function createStore() {
   // file's temp dir rather than the global fake's shared one, after resetModules.
   installFakeAppEnvironment({ getPath: () => testState.dir })
   initDataPath()
-  return new Store()
+  return createSqliteTestStore(Store, { dataFile: join(testState.dir, 'orca-data.json') })
 }
 
 function dataFile(): string {
@@ -79,7 +84,7 @@ type ProtectedState = {
 }
 
 function readState(path = dataFile()): ProtectedState {
-  return JSON.parse(readFileSync(path, 'utf-8'))
+  return JSON.parse(readPersistedStateJson(path))
 }
 
 const ORIGINAL = {
@@ -142,7 +147,8 @@ describe('protected persistence when safeStorage fails', () => {
     vi.useFakeTimers()
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     vi.useRealTimers()
     rmSync(testState.dir, { recursive: true, force: true })
   })
@@ -154,7 +160,7 @@ describe('protected persistence when safeStorage fails', () => {
       const store = await createStore()
       await writeProtectedState(store, PENDING, 'non-secret-saved')
 
-      const raw = readFileSync(dataFile(), 'utf-8')
+      const raw = readPersistedStateJson(dataFile())
       const persisted = readState()
       expectPlaintextsAbsent(raw, PENDING)
       expect(persisted.settings.httpProxyUrl).toBe('')
@@ -384,14 +390,14 @@ describe('protected persistence when safeStorage fails', () => {
       const store = await createStore()
       await writeProtectedState(store, ORIGINAL, 'before')
       const originalCiphertext = readState()
-      expectPlaintextsAbsent(readFileSync(dataFile(), 'utf-8'), ORIGINAL)
+      expectPlaintextsAbsent(readPersistedStateJson(dataFile()), ORIGINAL)
 
       vi.advanceTimersByTime(60 * 60 * 1_000 + 1)
       setFailure(failureMode)
       await writeProtectedState(store, PENDING, 'during-failure')
 
-      const primaryRaw = readFileSync(dataFile(), 'utf-8')
-      const backupRaw = readFileSync(`${dataFile()}.bak.0`, 'utf-8')
+      const primaryRaw = readPersistedStateJson(dataFile())
+      const backupRaw = store.prepareProfileStateExport().json
       const persisted = readState()
       expectPlaintextsAbsent(primaryRaw, PENDING)
       expectPlaintextsAbsent(backupRaw, PENDING)
@@ -410,7 +416,7 @@ describe('protected persistence when safeStorage fails', () => {
       const loadedDuringFailure = await createStore()
       expect(loadedDuringFailure.getSettings().httpProxyBypassRules).toBe('during-failure')
       await settleSave(loadedDuringFailure)
-      expectPlaintextsAbsent(readFileSync(dataFile(), 'utf-8'), PENDING)
+      expectPlaintextsAbsent(readPersistedStateJson(dataFile()), PENDING)
 
       cipherState.availability = 'available'
       cipherState.encryptionThrows = false
diff --git a/src/main/persistence-protected-secret-write-race.test.ts b/src/main/persistence-protected-secret-write-race.test.ts
index 21aa20d13b82..8388a3ba1deb 100644
--- a/src/main/persistence-protected-secret-write-race.test.ts
+++ b/src/main/persistence-protected-secret-write-race.test.ts
@@ -1,112 +1,78 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import { mkdtempSync, rmSync } from 'node:fs'
-import type * as NodeFsPromises from 'node:fs/promises'
-import { tmpdir } from 'node:os'
-import { join } from 'node:path'
-import { installFakeAppEnvironment } from '../../config/scripts/vitest-host-ports-setup'
-
-const testState = { dir: '' }
-const cipherState = { available: true }
-
-const renameGate = vi.hoisted(() => ({
-  sourcePrefix: '',
-  release: null as Promise<void> | null,
-  started: null as (() => void) | null
-}))
-
-vi.mock('node:fs/promises', async (importOriginal) => {
-  const actual = await importOriginal<typeof NodeFsPromises>()
-  return {
-    ...actual,
-    rename: async (source: string, destination: string) => {
-      if (renameGate.release && source.startsWith(renameGate.sourcePrefix)) {
-        const release = renameGate.release
-        renameGate.release = null
-        renameGate.started?.()
-        await release
-      }
-      return actual.rename(source, destination)
-    }
-  }
-})
+import { getSecretStore, setSecretStore } from '../shared/secret-store'
+import {
+  createWorkerMaintenanceFixture,
+  maintenanceBarrier
+} from './persistence/loading-store/profile-state-maintenance-fixture'
+import { Store } from './persistence/loading-store/store'
 
 vi.mock('./ssh/ssh-config-parser', () => ({
   loadUserSshConfig: vi.fn(),
   sshConfigHostsToTargets: vi.fn()
 }))
-
 vi.mock('./telemetry/client', () => ({ track: vi.fn() }))
 vi.mock('./telemetry/cohort-classifier', () => ({
-  getCohortAtEmit: vi.fn().mockReturnValue({ nth_repo_added: 2 })
+  getCohortAtEmit: () => ({ nth_repo_added: 2 })
 }))
 
-vi.mock('electron', () => ({
-  app: { getPath: () => testState.dir }
-}))
+let encryptionAvailable = true
+let previousSecretStore: ReturnType<typeof getSecretStore>
 
-async function createStore() {
-  vi.resetModules()
-  const { setSecretStore } = await import('../shared/secret-store')
+beforeEach(() => {
+  encryptionAvailable = true
+  previousSecretStore = getSecretStore()
   setSecretStore({
-    isEncryptionAvailable: () => cipherState.available,
-    encryptString: (plaintext) => Buffer.from(`enc:${plaintext}`, 'utf-8'),
-    decryptString: (ciphertext) => ciphertext.toString('utf-8').slice('enc:'.length),
+    isEncryptionAvailable: () => encryptionAvailable,
+    encryptString: (plaintext) => Buffer.from(`enc:${plaintext}`, 'utf8'),
+    decryptString: (ciphertext) => ciphertext.toString('utf8').slice('enc:'.length),
     describeProtectionGap: () => null
   })
-  const { Store, initDataPath } = await import('./persistence')
-  // Why here: userData resolves through AppEnvironment, and this must point at this
-  // file's temp dir rather than the global fake's shared one, after resetModules.
-  installFakeAppEnvironment({ getPath: () => testState.dir })
-  initDataPath()
-  return new Store()
-}
-
-function deferred(): { promise: Promise<void>; resolve: () => void } {
-  let resolve!: () => void
-  const promise = new Promise<void>((next) => {
-    resolve = next
-  })
-  return { promise, resolve }
-}
+})
+afterEach(() => setSecretStore(previousSecretStore))
 
 describe('protected-secret async write retention', () => {
-  beforeEach(() => {
-    testState.dir = mkdtempSync(join(tmpdir(), 'orca-protected-secret-write-race-'))
-    cipherState.available = true
-    renameGate.sourcePrefix = join(testState.dir, 'orca-data.json')
-    renameGate.release = null
-    renameGate.started = null
-    vi.useFakeTimers()
-  })
-
-  afterEach(() => {
-    vi.useRealTimers()
-    rmSync(testState.dir, { recursive: true, force: true })
-  })
-
-  it('does not retain ciphertext from a superseded async secret write', async () => {
-    const store = await createStore()
+  it('does not retain ciphertext from a rejected worker write after a newer secret arrives', async () => {
+    const { store, authority, peer, dataFile, readState } = await createWorkerMaintenanceFixture()
     store.updateSettings({ opencodeSessionCookie: 'durable-cookie' })
-    vi.advanceTimersByTime(1_000)
-    await store.waitForPendingWrite()
-
-    const renameRelease = deferred()
-    const renameStarted = deferred()
-    renameGate.release = renameRelease.promise
-    renameGate.started = renameStarted.resolve
+    await store.flushPendingOrThrowAsync()
+    const durableCiphertext = readState().settings.opencodeSessionCookie
+    const entered = maintenanceBarrier()
+    const release = maintenanceBarrier()
+    const writeDomains = authority.writeSerializedDomains.bind(authority)
+    const pendingWrite = vi
+      .spyOn(authority, 'writeSerializedDomains')
+      .mockImplementationOnce(async () => {
+        entered.resolve()
+        await release.promise
+        await writeDomains([{ domain: 'settings', payload: '{' }])
+      })
+    vi.spyOn(console, 'error').mockImplementation(() => {})
 
     store.updateSettings({ opencodeSessionCookie: 'intermediate-cookie' })
-    vi.advanceTimersByTime(1_000)
-    await renameStarted.promise
-
+    const writing = store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
+    const rejected = expect(writing).rejects.toMatchObject({ outcome: 'known-failure' })
+    await entered.promise
     store.updateSettings({ opencodeSessionCookie: 'replacement-cookie' })
-    cipherState.available = false
-    vi.advanceTimersByTime(1_000)
-    renameRelease.resolve()
-    await store.waitForPendingWrite()
+    encryptionAvailable = false
+    release.resolve()
+    await rejected
+    pendingWrite.mockRestore()
+    await store.flushPendingOrThrowAsync()
+
+    expect(readState().settings.opencodeSessionCookie).toBe(durableCiphertext)
+    expect(store.getSettings().opencodeSessionCookie).toBe('replacement-cookie')
+    encryptionAvailable = true
+    const restarted = new Store({ dataFile, profileStateAuthority: peer() })
+    try {
+      expect(restarted.getSettings().opencodeSessionCookie).toBe('durable-cookie')
+    } finally {
+      restarted.freezeWrites()
+    }
 
-    cipherState.available = true
-    const restarted = await createStore()
-    expect(restarted.getSettings().opencodeSessionCookie).toBe('durable-cookie')
+    store.updateSettings({ theme: 'dark' })
+    await store.flushPendingOrThrowAsync()
+    expect(readState().settings.opencodeSessionCookie).toBe(
+      Buffer.from('enc:replacement-cookie').toString('base64')
+    )
   })
 })
diff --git a/src/main/persistence-proxy-secret-recovery.test.ts b/src/main/persistence-proxy-secret-recovery.test.ts
index 176113192c74..ee75c72c5a0b 100644
--- a/src/main/persistence-proxy-secret-recovery.test.ts
+++ b/src/main/persistence-proxy-secret-recovery.test.ts
@@ -1,3 +1,8 @@
+import {
+  closeTestStores,
+  createSqliteTestStore,
+  readPersistedStateJson
+} from './persistence-test-harness'
 // STA-3442: httpProxyUrl is the only network setting stored via safeStorage.
 // On macOS a keychain reset/denial makes decryptString throw at load, and the
 // raw ciphertext then masqueraded as a configured proxy: applyElectronProxySettings
@@ -6,7 +11,7 @@
 // or destroyed), plaintext values survive as the upgrade path, and safeStorage
 // failures cannot expose the proxy secret or kill unrelated saves.
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
-import { existsSync, mkdirSync, readFileSync, rmSync, mkdtempSync, writeFileSync } from 'node:fs'
+import { existsSync, mkdirSync, rmSync, mkdtempSync, writeFileSync } from 'node:fs'
 import { dirname, join } from 'node:path'
 import { tmpdir } from 'node:os'
 import { randomUUID } from 'node:crypto'
@@ -68,7 +73,7 @@ async function createStore() {
   // file's temp dir rather than the global fake's shared one, after resetModules.
   installFakeAppEnvironment({ getPath: () => testState.dir })
   initDataPath()
-  return new Store()
+  return createSqliteTestStore(Store, { dataFile: join(testState.dir, 'orca-data.json') })
 }
 
 function dataFile(): string {
@@ -87,7 +92,8 @@ describe('httpProxyUrl secret recovery (STA-3442)', () => {
     vi.useFakeTimers()
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     vi.useRealTimers()
     rmSync(testState.dir, { recursive: true, force: true })
   })
@@ -103,7 +109,8 @@ describe('httpProxyUrl secret recovery (STA-3442)', () => {
   it('persists the configured proxy across a restart and applies it as fixed_servers', async () => {
     await seedConfiguredProxy()
 
-    const persisted = JSON.parse(readFileSync(dataFile(), 'utf-8')) as {
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The preceding Store save produced the PersistedState snapshot read by this test.
+    const persisted = JSON.parse(readPersistedStateJson(dataFile())) as {
       settings: { httpProxyUrl: string; httpProxyBypassRules: string }
     }
     // On disk the URL is ciphertext (base64 of the mock's enc: payload), never plaintext.
@@ -139,7 +146,7 @@ describe('httpProxyUrl secret recovery (STA-3442)', () => {
 
   it('seals an undecryptable httpProxyUrl without destroying its ciphertext', async () => {
     await seedConfiguredProxy()
-    const originalCiphertext = JSON.parse(readFileSync(dataFile(), 'utf-8')).settings.httpProxyUrl
+    const originalCiphertext = JSON.parse(readPersistedStateJson(dataFile())).settings.httpProxyUrl
 
     // Keychain reset/denial: every decrypt now fails.
     cipherState.decryptAlwaysThrows = true
@@ -153,7 +160,8 @@ describe('httpProxyUrl secret recovery (STA-3442)', () => {
     reloaded.updateSettings({ httpProxyBypassRules: 'localhost' })
     vi.advanceTimersByTime(2000)
     await reloaded.waitForPendingWrite()
-    const persisted = JSON.parse(readFileSync(dataFile(), 'utf-8')) as {
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The preceding Store save produced the PersistedState snapshot read by this test.
+    const persisted = JSON.parse(readPersistedStateJson(dataFile())) as {
       settings: { httpProxyUrl: string }
     }
     expect(persisted.settings.httpProxyUrl).toBe(originalCiphertext)
@@ -180,8 +188,9 @@ describe('httpProxyUrl secret recovery (STA-3442)', () => {
     vi.advanceTimersByTime(1000)
     await store.waitForPendingWrite()
 
-    expect(existsSync(dataFile())).toBe(true)
-    const persisted = JSON.parse(readFileSync(dataFile(), 'utf-8')) as {
+    expect(existsSync(join(testState.dir, 'profile-state.db'))).toBe(true)
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The preceding Store save produced the PersistedState snapshot read by this test.
+    const persisted = JSON.parse(readPersistedStateJson(dataFile())) as {
       settings: { httpProxyUrl: string; httpProxyBypassRules: string }
     }
     expect(persisted.settings.httpProxyUrl).toBe('')
diff --git a/src/main/persistence-pty-binding-leaf-tab-resolution.test.ts b/src/main/persistence-pty-binding-leaf-tab-resolution.test.ts
index 2f0dc41daaf8..14ac4de0a12f 100644
--- a/src/main/persistence-pty-binding-leaf-tab-resolution.test.ts
+++ b/src/main/persistence-pty-binding-leaf-tab-resolution.test.ts
@@ -1,10 +1,16 @@
+import {
+  closeTestStores,
+  testState,
+  createStore,
+  makeTerminalTab
+} from './persistence-test-harness'
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
 import { rmSync, mkdtempSync } from 'node:fs'
 import { join } from 'node:path'
 import { tmpdir } from 'node:os'
 import { getDefaultWorkspaceSession } from '../shared/constants'
 import { findTerminalTabIdForLeaf } from './runtime/workspace-session-terminal-membership-authority'
-import { testState, createStore, makeTerminalTab } from './persistence-test-harness'
+
 import { TEST_LEAF_1, TEST_LEAF_2 } from './persistence-session-fixtures'
 
 vi.mock('electron', () => ({
@@ -19,7 +25,8 @@ describe('findTerminalTabIdForLeaf after persistPtyBinding grafts a leaf', () =>
   beforeEach(() => {
     testState.dir = mkdtempSync(join(tmpdir(), 'orca-test-'))
   })
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
 
@@ -46,7 +53,7 @@ describe('findTerminalTabIdForLeaf after persistPtyBinding grafts a leaf', () =>
     expect(findTerminalTabIdForLeaf(store.getWorkspaceSession(), TEST_LEAF_1)).toBe('tab1')
 
     expect(
-      store.persistPtyBinding({
+      await store.persistPtyBinding({
         worktreeId: 'wt1',
         tabId: 'tab1',
         leafId: TEST_LEAF_2,
@@ -73,7 +80,7 @@ describe('findTerminalTabIdForLeaf after persistPtyBinding grafts a leaf', () =>
     expect(findTerminalTabIdForLeaf(store.getWorkspaceSession(), TEST_LEAF_1)).toBeUndefined()
 
     expect(
-      store.persistPtyBinding({
+      await store.persistPtyBinding({
         worktreeId: 'wt1',
         tabId: 'tab1',
         leafId: TEST_LEAF_1,
diff --git a/src/main/persistence-pty-binding-reconciliation.test.ts b/src/main/persistence-pty-binding-reconciliation.test.ts
index f72234b6823f..c4fbf61f07b4 100644
--- a/src/main/persistence-pty-binding-reconciliation.test.ts
+++ b/src/main/persistence-pty-binding-reconciliation.test.ts
@@ -1,9 +1,16 @@
+import {
+  closeTestStores,
+  testState,
+  createStore,
+  writeDataFile,
+  makeTerminalTab
+} from './persistence-test-harness'
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
 import { rmSync, mkdtempSync } from 'node:fs'
 import { join } from 'node:path'
 import { tmpdir } from 'node:os'
 import { getDefaultWorkspaceSession } from '../shared/constants'
-import { testState, createStore, writeDataFile, makeTerminalTab } from './persistence-test-harness'
+
 import { TEST_LEAF_1, TEST_LEAF_2 } from './persistence-session-fixtures'
 
 // Stub the ~/.ssh/config parser so the SSH-import test drives the real Store with deterministic hosts, not the operator's actual ~/.ssh/config.
@@ -54,7 +61,8 @@ describe('Store', () => {
     getCohortAtEmitMock.mockReturnValue({ nth_repo_added: 2 })
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
   it('remaps legacy SSH lease leaf ids by PTY when the layout is already normalized', async () => {
@@ -204,7 +212,7 @@ describe('Store', () => {
       }
     })
 
-    store.persistPtyBinding({
+    await store.persistPtyBinding({
       worktreeId: 'wt1',
       tabId: 'tab1',
       leafId: TEST_LEAF_1,
@@ -228,7 +236,7 @@ describe('Store', () => {
       terminalTopologyRevisionByRepoId: { wt1: 1 }
     })
 
-    store.persistPtyBinding({
+    await store.persistPtyBinding({
       worktreeId: 'wt1',
       tabId: 'fresh-tab',
       leafId: TEST_LEAF_1,
@@ -330,7 +338,7 @@ describe('Store', () => {
     })
 
     expect(
-      store.persistPtyBinding({
+      await store.persistPtyBinding({
         worktreeId: 'wt1',
         tabId: 'tab1',
         leafId: TEST_LEAF_1,
@@ -370,7 +378,7 @@ describe('Store', () => {
       const staleRendererSession = structuredClone(store.getWorkspaceSession(hostId))
 
       expect(
-        store.persistPtyBinding(
+        await store.persistPtyBinding(
           {
             worktreeId: 'wt1',
             tabId: 'different-target-tab',
@@ -393,7 +401,7 @@ describe('Store', () => {
       ).toBe(false)
 
       expect(
-        store.persistPtyBinding(
+        await store.persistPtyBinding(
           {
             worktreeId: 'wt-canonical',
             tabId: 'tab1',
@@ -425,7 +433,7 @@ describe('Store', () => {
       })
 
       expect(
-        store.persistPtyBinding(
+        await store.persistPtyBinding(
           {
             worktreeId: 'wt1',
             tabId: 'rejected-tab',
diff --git a/src/main/persistence-remote-session-startup.test.ts b/src/main/persistence-remote-session-startup.test.ts
index ddb3f57827b4..c46f50699bb4 100644
--- a/src/main/persistence-remote-session-startup.test.ts
+++ b/src/main/persistence-remote-session-startup.test.ts
@@ -1,10 +1,10 @@
+import { closeTestStores, createStore, makeRepo, testState } from './persistence-test-harness'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { mkdtempSync, rmSync } from 'node:fs'
 import { join } from 'node:path'
 import { tmpdir } from 'node:os'
 import { getDefaultWorkspaceSession } from '../shared/constants'
 import type { BrowserPage, BrowserWorkspace } from '../shared/browser-workspace-types'
-import { createStore, makeRepo, testState } from './persistence-test-harness'
 
 vi.mock('./ssh/ssh-config-parser', () => ({
   loadUserSshConfig: vi.fn(),
@@ -65,7 +65,8 @@ describe('remote session startup ownership', () => {
   beforeEach(() => {
     testState.dir = mkdtempSync(join(tmpdir(), 'orca-remote-session-'))
   })
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
 
diff --git a/src/main/persistence-repo-lifecycle.test.ts b/src/main/persistence-repo-lifecycle.test.ts
index 150f1106d143..f70e1825348e 100644
--- a/src/main/persistence-repo-lifecycle.test.ts
+++ b/src/main/persistence-repo-lifecycle.test.ts
@@ -1,11 +1,5 @@
-import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
-import { rmSync, mkdtempSync } from 'node:fs'
-import { join } from 'node:path'
-import { tmpdir } from 'node:os'
-import type { PersistedState } from '../shared/persisted-state-types'
-import type { ProjectGroup } from '../shared/project-group-types'
-import { getDefaultWorkspaceSession } from '../shared/constants'
 import {
+  closeTestStores,
   testState,
   createStore,
   writeDataFile,
@@ -14,6 +8,14 @@ import {
   makeTerminalTab,
   makeWorktreeLineage
 } from './persistence-test-harness'
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
+import { rmSync, mkdtempSync } from 'node:fs'
+import { join } from 'node:path'
+import { tmpdir } from 'node:os'
+import type { PersistedState } from '../shared/persisted-state-types'
+import type { ProjectGroup } from '../shared/project-group-types'
+import { getDefaultWorkspaceSession } from '../shared/constants'
+
 import {
   advanceSshConnectionGeneration,
   assertSshMutationExpectation,
@@ -74,7 +76,8 @@ describe('Store', () => {
     getCohortAtEmitMock.mockReturnValue({ nth_repo_added: 2 })
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
   // ── 5. addRepo and getRepo ──────────────────────────────────────────
diff --git a/src/main/persistence-settings-ui-defaults.test.ts b/src/main/persistence-settings-ui-defaults.test.ts
index 42dc42423b75..f947b55b5c87 100644
--- a/src/main/persistence-settings-ui-defaults.test.ts
+++ b/src/main/persistence-settings-ui-defaults.test.ts
@@ -1,3 +1,11 @@
+import {
+  closeTestStores,
+  testState,
+  createStore,
+  withPlatform,
+  writeDataFile,
+  readDataFile
+} from './persistence-test-harness'
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
 import { rmSync, mkdtempSync } from 'node:fs'
 import { join } from 'node:path'
@@ -9,13 +17,6 @@ import {
   ONBOARDING_FINAL_STEP,
   ONBOARDING_FLOW_VERSION
 } from '../shared/constants'
-import {
-  testState,
-  createStore,
-  withPlatform,
-  writeDataFile,
-  readDataFile
-} from './persistence-test-harness'
 
 // Stub the ~/.ssh/config parser so the SSH-import test drives the real Store with deterministic hosts, not the operator's actual ~/.ssh/config.
 const { loadUserSshConfigMock, sshConfigHostsToTargetsMock } = vi.hoisted(() => ({
@@ -65,7 +66,8 @@ describe('Store', () => {
     getCohortAtEmitMock.mockReturnValue({ nth_repo_added: 2 })
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
   it('returns default settings when no data file exists', async () => {
diff --git a/src/main/persistence-settings-update.test.ts b/src/main/persistence-settings-update.test.ts
index 9af63ca7ccd8..aced61e0ac40 100644
--- a/src/main/persistence-settings-update.test.ts
+++ b/src/main/persistence-settings-update.test.ts
@@ -1,11 +1,5 @@
-import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
-import { writeFileSync, rmSync, mkdtempSync } from 'node:fs'
-import { join } from 'node:path'
-import { tmpdir } from 'node:os'
-import type { GlobalSettings } from '../shared/global-settings-types'
-import type { PersistedState } from '../shared/persisted-state-types'
-import { getDefaultWorkspaceSession } from '../shared/constants'
 import {
+  closeTestStores,
   testState,
   createStore,
   writeDataFile,
@@ -14,6 +8,14 @@ import {
   makeRepo,
   makeTerminalTab
 } from './persistence-test-harness'
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
+import { writeFileSync, rmSync, mkdtempSync } from 'node:fs'
+import { join } from 'node:path'
+import { tmpdir } from 'node:os'
+import type { GlobalSettings } from '../shared/global-settings-types'
+import type { PersistedState } from '../shared/persisted-state-types'
+import { getDefaultWorkspaceSession } from '../shared/constants'
+
 import {
   getLocalWorktreeScanGeneration,
   isLocalWorktreeScanGenerationCurrent
@@ -67,7 +69,8 @@ describe('Store', () => {
     getCohortAtEmitMock.mockReturnValue({ nth_repo_added: 2 })
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
   // ── 9. Settings: get/update ────────────────────────────────────────
diff --git a/src/main/persistence-single-serialize.test.ts b/src/main/persistence-single-serialize.test.ts
index 1293bb30f48b..b70c2c01573f 100644
--- a/src/main/persistence-single-serialize.test.ts
+++ b/src/main/persistence-single-serialize.test.ts
@@ -1,10 +1,15 @@
+import {
+  closeTestStores,
+  createSqliteTestStore,
+  readPersistedStateJson
+} from './persistence-test-harness'
 // Why this file exists: persistence.test.ts mocks safeStorage.encryptString
 // deterministically, which cannot catch the real-world hazard the single-
 // stringify save guard must survive — encrypt() uses a random IV, so identical
 // state produces different on-disk bytes each save. These tests mock a
 // nondeterministic cipher and pin the guard + payload invariants.
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
-import { readFileSync, rmSync, mkdtempSync, statSync } from 'node:fs'
+import { rmSync, mkdtempSync } from 'node:fs'
 import { join } from 'node:path'
 import { tmpdir } from 'node:os'
 import { randomUUID } from 'node:crypto'
@@ -63,7 +68,7 @@ async function createStore() {
   // file's temp dir rather than the global fake's shared one, after resetModules.
   installFakeAppEnvironment({ getPath: () => testState.dir })
   initDataPath()
-  return new Store()
+  return createSqliteTestStore(Store, { dataFile: join(testState.dir, 'orca-data.json') })
 }
 
 function dataFile(): string {
@@ -84,7 +89,8 @@ describe('persistence single-serialize save guard', () => {
     vi.useFakeTimers()
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     vi.useRealTimers()
     rmSync(testState.dir, { recursive: true, force: true })
   })
@@ -100,7 +106,7 @@ describe('persistence single-serialize save guard', () => {
 
   it('skips the disk write when state is identical, even with secrets set (random-IV cipher)', async () => {
     const store = await seedStoreWithSecrets()
-    const inoBefore = statSync(dataFile()).ino
+    const stateBefore = readPersistedStateJson(dataFile())
 
     // Net no-op mutation burst: the encrypted payload bytes would differ
     // (random IV), but the normalized guard hash must not.
@@ -111,29 +117,29 @@ describe('persistence single-serialize save guard', () => {
     vi.advanceTimersByTime(2000)
     await store.waitForPendingWrite()
 
-    expect(statSync(dataFile()).ino).toBe(inoBefore)
+    expect(readPersistedStateJson(dataFile())).toBe(stateBefore)
   })
 
   it('still writes when state actually changes (including a secret change)', async () => {
     const store = await seedStoreWithSecrets()
-    const inoBefore = statSync(dataFile()).ino
+    const stateBefore = readPersistedStateJson(dataFile())
 
     store.updateSettings({ opencodeSessionCookie: 'rotated-cookie' })
     vi.advanceTimersByTime(2000)
     await store.waitForPendingWrite()
-    const inoAfter = statSync(dataFile()).ino
-    expect(inoAfter).not.toBe(inoBefore)
+    const stateAfter = readPersistedStateJson(dataFile())
+    expect(stateAfter).not.toBe(stateBefore)
 
     store.updateUI({ sidebarWidth: 777 })
     vi.advanceTimersByTime(2000)
     await store.waitForPendingWrite()
-    expect(statSync(dataFile()).ino).not.toBe(inoAfter)
+    expect(readPersistedStateJson(dataFile())).not.toBe(stateAfter)
   })
 
   it('writes encrypted secrets to disk and round-trips them through a reload', async () => {
     await seedStoreWithSecrets()
 
-    const raw = readFileSync(dataFile(), 'utf-8')
+    const raw = readPersistedStateJson(dataFile())
     const persisted = JSON.parse(raw) as {
       settings: { opencodeSessionCookie: string; httpProxyUrl: string }
       ui: { browserKagiSessionLink: string }
@@ -158,29 +164,30 @@ describe('persistence single-serialize save guard', () => {
     vi.advanceTimersByTime(1000)
     await store.waitForPendingWrite()
 
-    const persisted = JSON.parse(readFileSync(dataFile(), 'utf-8')) as {
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The preceding Store save produced the PersistedState snapshot read by this test.
+    const persisted = JSON.parse(readPersistedStateJson(dataFile())) as {
       settings: { opencodeSessionCookie: string; httpProxyUrl: string }
     }
     expect(persisted.settings.opencodeSessionCookie).toBe('')
     expect(persisted.settings.httpProxyUrl).toBe('')
 
-    const inoBefore = statSync(dataFile()).ino
+    const stateBefore = readPersistedStateJson(dataFile())
     store.updateSettings({ httpProxyUrl: SECRETS.httpProxyUrl })
     vi.advanceTimersByTime(2000)
     await store.waitForPendingWrite()
-    expect(statSync(dataFile()).ino).toBe(inoBefore)
+    expect(readPersistedStateJson(dataFile())).toBe(stateBefore)
   })
 
   it('sync flush also skips on identical state with secrets set', async () => {
     const store = await seedStoreWithSecrets()
-    const inoBefore = statSync(dataFile()).ino
+    const stateBefore = readPersistedStateJson(dataFile())
 
     store.flushOrThrow()
 
-    expect(statSync(dataFile()).ino).toBe(inoBefore)
+    expect(readPersistedStateJson(dataFile())).toBe(stateBefore)
   })
 
-  it('performs exactly one full-state JSON.stringify per save (was two)', async () => {
+  it('does not serialize the complete profile for a UI domain save', async () => {
     const store = await seedStoreWithSecrets()
 
     // Count full-state serializations: only the durable-state payload is
@@ -188,17 +195,20 @@ describe('persistence single-serialize save guard', () => {
     // stay far below the threshold).
     const original = JSON.stringify.bind(JSON)
     let fullStateSerializations = 0
-    const spy = vi.spyOn(JSON, 'stringify').mockImplementation(((
-      value: unknown,
-      ...rest: unknown[]
-    ) => {
-      // eslint-disable-next-line @typescript-eslint/no-explicit-any
-      const out = original(value as any, ...(rest as [any?, any?]))
-      if (typeof out === 'string' && out.length > 1_000) {
+    const spy = vi.spyOn(JSON, 'stringify').mockImplementation((...args) => {
+      const [value] = args
+      const out = original(...args)
+      if (
+        value &&
+        typeof value === 'object' &&
+        'repos' in value &&
+        'settings' in value &&
+        'ui' in value
+      ) {
         fullStateSerializations++
       }
       return out
-    }) as typeof JSON.stringify)
+    })
     try {
       store.updateUI({ sidebarWidth: 640 })
       vi.advanceTimersByTime(2000)
@@ -207,7 +217,7 @@ describe('persistence single-serialize save guard', () => {
       spy.mockRestore()
     }
 
-    expect(fullStateSerializations).toBe(1)
+    expect(fullStateSerializations).toBe(0)
   })
 
   // Regression (adversarial review, gpt-5.6-sol round 1): the guard hash
@@ -227,11 +237,7 @@ describe('persistence single-serialize save guard', () => {
     store.updateSettings({ opencodeSessionCookie: P })
     vi.advanceTimersByTime(1000)
     await store.waitForPendingWrite()
-    const C = (
-      JSON.parse(readFileSync(dataFile(), 'utf-8')) as {
-        settings: { opencodeSessionCookie: string }
-      }
-    ).settings.opencodeSessionCookie
+    const C: string = JSON.parse(readPersistedStateJson(dataFile())).settings.opencodeSessionCookie
     expect(C).not.toBe(P) // C is ciphertext
 
     // State 1: the plaintext bypass-rules field literally holds ciphertext C;
@@ -239,13 +245,13 @@ describe('persistence single-serialize save guard', () => {
     store.updateSettings({ httpProxyBypassRules: C, opencodeSessionCookie: P })
     vi.advanceTimersByTime(2000)
     await store.waitForPendingWrite()
-    const inoState1 = statSync(dataFile()).ino
+    const inoState1 = readPersistedStateJson(dataFile())
 
     // State 2 (distinct): swap the two values. Must be written, not skipped.
     store.updateSettings({ httpProxyBypassRules: P, opencodeSessionCookie: C })
     vi.advanceTimersByTime(2000)
     await store.waitForPendingWrite()
-    expect(statSync(dataFile()).ino).not.toBe(inoState1)
+    expect(readPersistedStateJson(dataFile())).not.toBe(inoState1)
 
     // The swap round-trips through a reload — nothing was lost.
     const reloaded = await createStore()
@@ -268,11 +274,7 @@ describe('persistence single-serialize save guard', () => {
     store.updateUI({ browserKagiSessionLink: K })
     vi.advanceTimersByTime(1000)
     await store.waitForPendingWrite()
-    const C = (
-      JSON.parse(readFileSync(dataFile(), 'utf-8')) as {
-        ui: { browserKagiSessionLink: string }
-      }
-    ).ui.browserKagiSessionLink
+    const C: string = JSON.parse(readPersistedStateJson(dataFile())).ui.browserKagiSessionLink
     expect(C).not.toBe(K) // C is ciphertext
 
     // State 1: env var literally named after the secret field, value = C; the
@@ -281,14 +283,14 @@ describe('persistence single-serialize save guard', () => {
     store.updateUI({ browserKagiSessionLink: K })
     vi.advanceTimersByTime(2000)
     await store.waitForPendingWrite()
-    const inoState1 = statSync(dataFile()).ino
+    const inoState1 = readPersistedStateJson(dataFile())
 
     // State 2 (distinct): swap — env var value = K, ui secret = C. Must write.
     store.updateSettings({ agentDefaultEnv: { claude: { browserKagiSessionLink: K } } })
     store.updateUI({ browserKagiSessionLink: C })
     vi.advanceTimersByTime(2000)
     await store.waitForPendingWrite()
-    expect(statSync(dataFile()).ino).not.toBe(inoState1)
+    expect(readPersistedStateJson(dataFile())).not.toBe(inoState1)
 
     const reloaded = await createStore()
     expect(reloaded.getSettings().agentDefaultEnv?.claude?.browserKagiSessionLink).toBe(K)
diff --git a/src/main/persistence-source-control-ai-migration.test.ts b/src/main/persistence-source-control-ai-migration.test.ts
index ffc7d5b6ebae..f3969da6ef0c 100644
--- a/src/main/persistence-source-control-ai-migration.test.ts
+++ b/src/main/persistence-source-control-ai-migration.test.ts
@@ -1,17 +1,19 @@
-import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
-import { writeFileSync, readFileSync, rmSync, mkdtempSync, mkdirSync } from 'node:fs'
-import { join } from 'node:path'
-import { tmpdir } from 'node:os'
-import type { PersistedState } from '../shared/persisted-state-types'
-import { setSourceControlActionDefault } from '../shared/source-control-ai-actions'
 import {
+  closeTestStores,
   testState,
   createStore,
   dataFile,
   writeDataFile,
   readDataFile,
+  readPersistedStateJson,
   makeRepo
 } from './persistence-test-harness'
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
+import { writeFileSync, readFileSync, rmSync, mkdtempSync, mkdirSync } from 'node:fs'
+import { join } from 'node:path'
+import { tmpdir } from 'node:os'
+import type { PersistedState } from '../shared/persisted-state-types'
+import { setSourceControlActionDefault } from '../shared/source-control-ai-actions'
 
 // Stub the ~/.ssh/config parser so the SSH-import test drives the real Store with deterministic hosts, not the operator's actual ~/.ssh/config.
 const { loadUserSshConfigMock, sshConfigHostsToTargetsMock } = vi.hoisted(() => ({
@@ -61,19 +63,18 @@ describe('Store', () => {
     getCohortAtEmitMock.mockReturnValue({ nth_repo_added: 2 })
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
-  // ── 3. Corrupt JSON → falls back to defaults ────────────────────────
+  // Invalid profile state must not silently replace user settings with defaults.
 
-  it('falls back to defaults when data file contains invalid JSON', async () => {
+  it('refuses invalid legacy JSON without replacing it with defaults', () => {
     mkdirSync(testState.dir, { recursive: true })
     writeFileSync(dataFile(), '{{{invalid json', 'utf-8')
 
-    const store = await createStore()
-    expect(store.getRepos()).toEqual([])
-    expect(store.getSettings().theme).toBe('system')
-    expect(store.getSettings().experimentalNewWorktreeCardStyle).toBe(false)
+    expect(() => createStore()).toThrow('Profile state JSON is invalid')
+    expect(readFileSync(dataFile(), 'utf8')).toBe('{{{invalid json')
   })
 
   // ── 4. Schema migration: merges with defaults ───────────────────────
@@ -347,7 +348,7 @@ describe('Store', () => {
       customAgentCommand: 'claude'
     })
     store.flush()
-    const persisted = JSON.parse(readFileSync(join(testState.dir, 'orca-data.json'), 'utf-8'))
+    const persisted = JSON.parse(readPersistedStateJson(dataFile()))
     expect(persisted.settings.sourceControlAi.actions.commitMessage).toEqual({
       agentId: 'claude',
       commandInputTemplate: '{basePrompt}\n\nRollback commit prompt'
diff --git a/src/main/persistence-split-pane-incarnation.test.ts b/src/main/persistence-split-pane-incarnation.test.ts
index b092c3d7d9e8..b628c28384bb 100644
--- a/src/main/persistence-split-pane-incarnation.test.ts
+++ b/src/main/persistence-split-pane-incarnation.test.ts
@@ -1,10 +1,18 @@
+import {
+  closeTestStores,
+  testState,
+  createStore,
+  makeTerminalTab
+} from './persistence-test-harness'
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
+
 import { rmSync, mkdtempSync } from 'node:fs'
 import { join } from 'node:path'
 import { tmpdir } from 'node:os'
+import { ProfileStateSqliteAuthority } from './persistence/profile-state/profile-state-sqlite-authority'
 import type { WorkspaceSessionState } from '../shared/workspace-session-state-types'
 import { getDefaultWorkspaceSession } from '../shared/constants'
-import { testState, createStore, makeTerminalTab } from './persistence-test-harness'
+
 import { TEST_LEAF_1, TEST_LEAF_2 } from './persistence-session-fixtures'
 
 // Stub the ~/.ssh/config parser so the SSH-import test drives the real Store with deterministic hosts, not the operator's actual ~/.ssh/config.
@@ -55,7 +63,8 @@ describe('Store', () => {
     getCohortAtEmitMock.mockReturnValue({ nth_repo_added: 2 })
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
   it('rejects a split source incarnation mismatch', async () => {
@@ -77,7 +86,7 @@ describe('Store', () => {
     })
 
     expect(
-      store.persistPtyBinding({
+      await store.persistPtyBinding({
         worktreeId: 'wt1',
         tabId: 'tab1',
         leafId: TEST_LEAF_2,
@@ -127,7 +136,7 @@ describe('Store', () => {
       store.setWorkspaceSession(sourceSession, hostId)
 
       expect(
-        store.persistPtyBinding(
+        await store.persistPtyBinding(
           {
             worktreeId: 'wt1',
             tabId: 'tab1',
@@ -174,7 +183,7 @@ describe('Store', () => {
     )
 
     expect(
-      store.persistPtyBinding({
+      await store.persistPtyBinding({
         worktreeId: 'wt1',
         tabId: 'tab1',
         leafId: TEST_LEAF_2,
@@ -213,7 +222,7 @@ describe('Store', () => {
       { ptyId: 'pty-current', expectedIncarnationId: 'inc-replaced' }
     ]) {
       expect(
-        store.persistPtyBinding({
+        await store.persistPtyBinding({
           worktreeId: 'wt1',
           tabId: 'tab1',
           leafId: TEST_LEAF_1,
@@ -253,7 +262,7 @@ describe('Store', () => {
     store.setWorkspaceSession(structuredClone(session), 'ssh:ssh-1')
 
     expect(
-      store.persistPtyBinding(
+      await store.persistPtyBinding(
         {
           worktreeId: 'wt1',
           tabId: 'tab1',
@@ -302,7 +311,7 @@ describe('Store', () => {
       )
 
       expect(
-        store.persistPtyBinding(
+        await store.persistPtyBinding(
           {
             worktreeId: 'wt1',
             tabId: 'tab1',
@@ -348,11 +357,15 @@ describe('Store', () => {
       },
       terminalPtyIncarnationsByPaneKey: { [paneKey]: 'inc-stale' }
     })
-    vi.spyOn(store, 'flushOrThrow').mockImplementationOnce(() => {
+    store.flushOrThrow()
+    vi.spyOn(
+      ProfileStateSqliteAuthority.prototype,
+      'writeSerializedDomains'
+    ).mockImplementationOnce(() => {
       throw new Error('disk full')
     })
 
-    expect(() =>
+    await expect(
       store.persistPtyBinding({
         worktreeId: 'wt1',
         tabId: 'tab1',
@@ -361,7 +374,7 @@ describe('Store', () => {
         incarnationId: 'inc-live',
         expectedBinding: { ptyId: 'pty-1', incarnationId: 'inc-stale' }
       })
-    ).toThrow('disk full')
+    ).rejects.toThrow('disk full')
     expect(store.getWorkspaceSession().terminalPtyIncarnationsByPaneKey?.[paneKey]).toBe(
       'inc-stale'
     )
diff --git a/src/main/persistence-ssh-lease-reattach-reclaim.test.ts b/src/main/persistence-ssh-lease-reattach-reclaim.test.ts
index b2088fa616b8..adc6946725b4 100644
--- a/src/main/persistence-ssh-lease-reattach-reclaim.test.ts
+++ b/src/main/persistence-ssh-lease-reattach-reclaim.test.ts
@@ -1,8 +1,9 @@
+import { closeTestStores, createStore, testState } from './persistence-test-harness'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { mkdtempSync, rmSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
-import { createStore, testState } from './persistence-test-harness'
+
 import { sshRemotePtyLeaseAllowsReattach } from '../shared/ssh-types'
 
 vi.mock('electron', () => ({
@@ -24,7 +25,8 @@ describe('ssh remote pty lease reclaim after a proven reattach', () => {
   beforeEach(() => {
     testState.dir = mkdtempSync(join(tmpdir(), 'orca-test-'))
   })
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
 
diff --git a/src/main/persistence-ssh-lease-tombstone-retention.test.ts b/src/main/persistence-ssh-lease-tombstone-retention.test.ts
index feafdd766e40..1e52c6ad41c8 100644
--- a/src/main/persistence-ssh-lease-tombstone-retention.test.ts
+++ b/src/main/persistence-ssh-lease-tombstone-retention.test.ts
@@ -1,8 +1,9 @@
+import { closeTestStores, createStore, testState } from './persistence-test-harness'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { mkdtempSync, rmSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
-import { createStore, testState } from './persistence-test-harness'
+
 import { TEST_LEAF_1 } from './persistence-session-fixtures'
 
 vi.mock('electron', () => ({
@@ -18,7 +19,8 @@ describe('operator-closed SSH lease tombstones', () => {
     testState.dir = mkdtempSync(join(tmpdir(), 'orca-test-'))
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
 
diff --git a/src/main/persistence-ssh-pending-pty-kill.test.ts b/src/main/persistence-ssh-pending-pty-kill.test.ts
index 627d9f38de05..1d9c665c56f6 100644
--- a/src/main/persistence-ssh-pending-pty-kill.test.ts
+++ b/src/main/persistence-ssh-pending-pty-kill.test.ts
@@ -1,8 +1,9 @@
+import { closeTestStores, testState, createStore } from './persistence-test-harness'
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
 import { rmSync, mkdtempSync } from 'node:fs'
 import { join } from 'node:path'
 import { tmpdir } from 'node:os'
-import { testState, createStore } from './persistence-test-harness'
+
 import {
   MAX_SSH_PENDING_PTY_KILLS_PER_TARGET,
   SSH_PENDING_PTY_KILL_TTL_MS
@@ -27,7 +28,8 @@ describe('Store SSH pending PTY kills', () => {
     testState.dir = mkdtempSync(join(tmpdir(), 'orca-test-'))
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
 
diff --git a/src/main/persistence-ssh-readoption-automation-migration.test.ts b/src/main/persistence-ssh-readoption-automation-migration.test.ts
index 172c854cfd02..886b5475983c 100644
--- a/src/main/persistence-ssh-readoption-automation-migration.test.ts
+++ b/src/main/persistence-ssh-readoption-automation-migration.test.ts
@@ -1,3 +1,4 @@
+import { closeTestStores, createSqliteTestStore } from './persistence-test-harness'
 /**
  * SSH re-adoption has to repair the automation with the workspace.
  *
@@ -145,7 +146,7 @@ async function createStoreFromState(state: Record<string, unknown>) {
   installFakeAppEnvironment({ getPath: () => testState.dir })
   const { Store, initDataPath } = await import('./persistence')
   initDataPath()
-  return new Store()
+  return createSqliteTestStore(Store, { dataFile: join(testState.dir, 'orca-data.json') })
 }
 
 /** Re-read whatever is on disk now — no fixture rewrite. */
@@ -154,7 +155,7 @@ async function reloadStore() {
   installFakeAppEnvironment({ getPath: () => testState.dir })
   const { Store, initDataPath } = await import('./persistence')
   initDataPath()
-  return new Store()
+  return createSqliteTestStore(Store, { dataFile: join(testState.dir, 'orca-data.json') })
 }
 
 async function createSshStore(state: Record<string, unknown>) {
@@ -172,7 +173,8 @@ beforeEach(() => {
   testState.dir = mkdtempSync(join(tmpdir(), 'orca-readopt-'))
 })
 
-afterEach(() => {
+afterEach(async () => {
+  await closeTestStores()
   rmSync(testState.dir, { recursive: true, force: true })
   vi.resetModules()
 })
diff --git a/src/main/persistence-ssh-remote-pty-binding-replay.test.ts b/src/main/persistence-ssh-remote-pty-binding-replay.test.ts
index 8cfbd7b20571..f32f38368270 100644
--- a/src/main/persistence-ssh-remote-pty-binding-replay.test.ts
+++ b/src/main/persistence-ssh-remote-pty-binding-replay.test.ts
@@ -1,8 +1,9 @@
+import { closeTestStores, testState, createStore } from './persistence-test-harness'
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
 import { rmSync, mkdtempSync } from 'node:fs'
 import { join } from 'node:path'
 import { tmpdir } from 'node:os'
-import { testState, createStore } from './persistence-test-harness'
+
 import { TEST_LEAF_1, TEST_LEAF_2 } from './persistence-session-fixtures'
 import type { WorkspaceSessionState } from '../shared/workspace-session-state-types'
 
@@ -54,7 +55,8 @@ describe('Store', () => {
     getCohortAtEmitMock.mockReturnValue({ nth_repo_added: 2 })
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
   it('retains an SSH host binding when a stale renderer clears its pty map', async () => {
diff --git a/src/main/persistence-ssh-remote-pty-leases.test.ts b/src/main/persistence-ssh-remote-pty-leases.test.ts
index d4cdc79285c5..ea0d8fe350dd 100644
--- a/src/main/persistence-ssh-remote-pty-leases.test.ts
+++ b/src/main/persistence-ssh-remote-pty-leases.test.ts
@@ -1,8 +1,9 @@
+import { closeTestStores, testState, createStore, writeDataFile } from './persistence-test-harness'
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
 import { rmSync, mkdtempSync } from 'node:fs'
 import { join } from 'node:path'
 import { tmpdir } from 'node:os'
-import { testState, createStore, writeDataFile } from './persistence-test-harness'
+
 import { getDefaultPersistedState } from '../shared/constants'
 import { sshRemotePtyLeaseAllowsReattach } from '../shared/ssh-types'
 import { TEST_LEAF_1, TEST_LEAF_2 } from './persistence-session-fixtures'
@@ -96,7 +97,8 @@ describe('Store', () => {
     getCohortAtEmitMock.mockReturnValue({ nth_repo_added: 2 })
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
   it('merges missing prior layout bindings into partial renderer snapshots', async () => {
@@ -794,7 +796,8 @@ describe('ssh remote pty lease route-retirement marks survive the disk round tri
   beforeEach(() => {
     testState.dir = mkdtempSync(join(tmpdir(), 'orca-test-'))
   })
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
 
diff --git a/src/main/persistence-ssh-targets-and-pane-keys.test.ts b/src/main/persistence-ssh-targets-and-pane-keys.test.ts
index c11ecbf0bc28..4a1da77dc102 100644
--- a/src/main/persistence-ssh-targets-and-pane-keys.test.ts
+++ b/src/main/persistence-ssh-targets-and-pane-keys.test.ts
@@ -1,11 +1,5 @@
-import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
-import { rmSync, mkdtempSync } from 'node:fs'
-import { join } from 'node:path'
-import { tmpdir } from 'node:os'
-import { isTerminalLeafId, makePaneKey } from '../shared/stable-pane-id'
-import { SshConnectionStore } from './ssh/ssh-connection-store'
-import { LEGACY_DEFAULT_SSH_RELAY_GRACE_PERIOD_SECONDS } from '../shared/ssh-types'
 import {
+  closeTestStores,
   testState,
   createStore,
   writeDataFile,
@@ -13,6 +7,14 @@ import {
   makeRepo,
   makeTerminalTab
 } from './persistence-test-harness'
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
+import { rmSync, mkdtempSync } from 'node:fs'
+import { join } from 'node:path'
+import { tmpdir } from 'node:os'
+import { isTerminalLeafId, makePaneKey } from '../shared/stable-pane-id'
+import { SshConnectionStore } from './ssh/ssh-connection-store'
+import { LEGACY_DEFAULT_SSH_RELAY_GRACE_PERIOD_SECONDS } from '../shared/ssh-types'
+
 import { TEST_LEAF_1 } from './persistence-session-fixtures'
 
 // Stub the ~/.ssh/config parser so the SSH-import test drives the real Store with deterministic hosts, not the operator's actual ~/.ssh/config.
@@ -63,7 +65,8 @@ describe('Store', () => {
     getCohortAtEmitMock.mockReturnValue({ nth_repo_added: 2 })
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
   // ── 2. Load from existing valid file ─────────────────────────────────
diff --git a/src/main/persistence-terminal-option-key-migration.test.ts b/src/main/persistence-terminal-option-key-migration.test.ts
index e9219c41bfa2..9d1711783229 100644
--- a/src/main/persistence-terminal-option-key-migration.test.ts
+++ b/src/main/persistence-terminal-option-key-migration.test.ts
@@ -1,15 +1,16 @@
-import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
-import { rmSync, mkdtempSync } from 'node:fs'
-import { join } from 'node:path'
-import { tmpdir } from 'node:os'
-import type { PersistedState } from '../shared/persisted-state-types'
 import {
+  closeTestStores,
   testState,
   createStore,
   withPlatform,
   writeDataFile,
   readDataFile
 } from './persistence-test-harness'
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
+import { rmSync, mkdtempSync } from 'node:fs'
+import { join } from 'node:path'
+import { tmpdir } from 'node:os'
+import type { PersistedState } from '../shared/persisted-state-types'
 
 // Stub the ~/.ssh/config parser so the SSH-import test drives the real Store with deterministic hosts, not the operator's actual ~/.ssh/config.
 const { loadUserSshConfigMock, sshConfigHostsToTargetsMock } = vi.hoisted(() => ({
@@ -59,7 +60,8 @@ describe('Store', () => {
     getCohortAtEmitMock.mockReturnValue({ nth_repo_added: 2 })
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
   // ── terminalMacOptionAsAlt migration (issue #903) ───────────────────
diff --git a/src/main/persistence-test-harness.ts b/src/main/persistence-test-harness.ts
index e2c04495e92a..5a146da6e1da 100644
--- a/src/main/persistence-test-harness.ts
+++ b/src/main/persistence-test-harness.ts
@@ -1,5 +1,5 @@
-import { mkdirSync, readFileSync, symlinkSync, writeFileSync } from 'node:fs'
-import { join } from 'node:path'
+import { existsSync, mkdirSync, readFileSync, symlinkSync, writeFileSync } from 'node:fs'
+import { dirname, join } from 'node:path'
 import { installFakeAppEnvironment } from '../../config/scripts/vitest-host-ports-setup'
 import type { Project, ProjectHostSetup } from '../shared/project-types'
 import type { Repo } from '../shared/repo-types'
@@ -9,16 +9,84 @@ import { folderWorkspaceKey, worktreeWorkspaceKey } from '../shared/workspace-sc
 import type { PersistedState } from '../shared/persisted-state-types'
 import { hydrateWorktreeMetaAliasProjection } from './persistence/loading-store/worktree-meta-alias-projection'
 import { Store } from './persistence/loading-store/store'
-import { initDataPath } from './persistence/loading-store/user-data-path'
+import { getDataFile, initDataPath } from './persistence/loading-store/user-data-path'
+import type { StoreRuntimeOptions } from './persistence/loading-store/store-runtime-state'
+import { ProfileStateSqliteAuthority } from './persistence/profile-state/profile-state-sqlite-authority'
+import {
+  openProfileStateDatabaseReadOnly,
+  profileStateDatabaseFile
+} from './persistence/profile-state/profile-state-database'
+import { exportProfileStateJson } from './persistence/profile-state/profile-state-documents'
 
 // Shared mutable state so the electron mock can reference a per-test directory
 export const testState = { dir: '' }
+const stores = new Set<Store>()
+
+class UnitTestProfileStateAuthority extends ProfileStateSqliteAuthority {
+  // Worker backup coverage uses the dedicated real-worker fixtures.
+  override scheduleBackup(): void {}
+}
+
+export function createSqliteTestStore(
+  StoreConstructor: typeof Store,
+  options: Omit<StoreRuntimeOptions, 'profileStateAuthority'> = {}
+): Store {
+  const path = options.dataFile ?? getDataFile()
+  const databaseFile = profileStateDatabaseFile(dirname(path))
+  mkdirSync(dirname(path), { recursive: true })
+  const authority = new UnitTestProfileStateAuthority(databaseFile, 'persistence-test')
+  try {
+    if (!existsSync(databaseFile) && existsSync(path)) {
+      authority.writeSerializedState(readFileSync(path))
+    }
+    const store = new StoreConstructor({
+      ...options,
+      dataFile: path,
+      profileStateAuthority: authority
+    })
+    stores.add(store)
+    return store
+  } catch (error) {
+    authority.close()
+    throw error
+  }
+}
+
+export function writePersistedStateJson(path: string, json: string): void {
+  mkdirSync(dirname(path), { recursive: true })
+  const databaseFile = profileStateDatabaseFile(dirname(path))
+  const authority = new UnitTestProfileStateAuthority(databaseFile, 'persistence-test')
+  try {
+    authority.writeSerializedState(Buffer.from(json))
+  } finally {
+    authority.close()
+  }
+}
+
+export async function closeTestStores(): Promise<void> {
+  const opened = [...stores]
+  stores.clear()
+  await Promise.all(opened.map((store) => store.freezeWritesAsync()))
+}
+
+export function readPersistedStateJson(path = dataFile(), profileId = 'persistence-test'): string {
+  const databaseFile = profileStateDatabaseFile(dirname(path))
+  if (!existsSync(databaseFile)) {
+    return readFileSync(path, 'utf8')
+  }
+  const opened = openProfileStateDatabaseReadOnly(databaseFile, profileId)
+  try {
+    return exportProfileStateJson(opened.db)
+  } finally {
+    opened.db.close()
+  }
+}
 
 /** Create a profile store without rebuilding its large module graph inside each test timeout. */
 export function createStore(): Store {
   installFakeAppEnvironment({ getPath: () => testState.dir })
   initDataPath()
-  return new Store({ dataFile: dataFile() })
+  return createSqliteTestStore(Store, { dataFile: dataFile() })
 }
 
 export async function withPlatform<T>(platform: NodeJS.Platform, fn: () => Promise<T>): Promise<T> {
@@ -37,7 +105,12 @@ export function dataFile(): string {
 
 export function writeDataFile(data: unknown): void {
   mkdirSync(testState.dir, { recursive: true })
-  writeFileSync(dataFile(), JSON.stringify(data, null, 2), 'utf-8')
+  const json = JSON.stringify(data, null, 2)
+  if (existsSync(profileStateDatabaseFile(testState.dir))) {
+    writePersistedStateJson(dataFile(), json)
+    return
+  }
+  writeFileSync(dataFile(), json, 'utf-8')
 }
 
 /**
@@ -47,7 +120,8 @@ export function writeDataFile(data: unknown): void {
  * the literal bytes parse the file themselves (see `worktree-meta-alias-projection.test.ts`).
  */
 export function readDataFile(): unknown {
-  const parsed = JSON.parse(readFileSync(dataFile(), 'utf-8')) as PersistedState
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Store exports use PersistedState; this fixture reader restores only its omitted aliases.
+  const parsed = JSON.parse(readPersistedStateJson()) as PersistedState
   hydrateWorktreeMetaAliasProjection(parsed)
   return parsed
 }
diff --git a/src/main/persistence-ui-state.test.ts b/src/main/persistence-ui-state.test.ts
index 1b092293c682..71f313c3a23f 100644
--- a/src/main/persistence-ui-state.test.ts
+++ b/src/main/persistence-ui-state.test.ts
@@ -1,11 +1,14 @@
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
-import { readFileSync, rmSync, mkdtempSync, existsSync } from 'node:fs'
+import { rmSync, mkdtempSync, existsSync } from 'node:fs'
 import { join } from 'node:path'
 import { tmpdir } from 'node:os'
 import type { PersistedState } from '../shared/persisted-state-types'
 import { getDefaultPersistedState } from '../shared/constants'
 import { createDefaultWorkspaceCleanupBrowseState } from '../shared/workspace-cleanup-browse-state'
 import {
+  closeTestStores,
+  createSqliteTestStore,
+  readPersistedStateJson,
   testState,
   dataFile,
   writeDataFile,
@@ -55,7 +58,7 @@ async function createStore() {
   // file's temp dir rather than the global fake's shared one, after resetModules.
   installFakeAppEnvironment({ getPath: () => testState.dir })
   initDataPath()
-  return new Store()
+  return createSqliteTestStore(Store, { dataFile: join(testState.dir, 'orca-data.json') })
 }
 
 vi.mock('./telemetry/client', () => ({
@@ -74,7 +77,8 @@ describe('Store', () => {
     getCohortAtEmitMock.mockReturnValue({ nth_repo_added: 2 })
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
   // ── UI state ───────────────────────────────────────────────────────
@@ -165,7 +169,7 @@ describe('Store', () => {
       })
       vi.advanceTimersByTime(1000)
       await store.waitForPendingWrite()
-      const persistedBefore = readFileSync(dataFile(), 'utf-8')
+      const persistedBefore = readPersistedStateJson(dataFile())
       store.onUIChanged((ui) => notifications.push(ui))
 
       store.updateUI({
@@ -181,7 +185,7 @@ describe('Store', () => {
       await store.waitForPendingWrite()
 
       expect(notifications).toEqual([])
-      expect(readFileSync(dataFile(), 'utf-8')).toBe(persistedBefore)
+      expect(readPersistedStateJson(dataFile())).toBe(persistedBefore)
     } finally {
       vi.useRealTimers()
     }
@@ -193,7 +197,7 @@ describe('Store', () => {
     store.updateUI({ sidebarWidth: 321 })
     store.flush()
 
-    const raw = readFileSync(dataFile(), 'utf-8')
+    const raw = readPersistedStateJson(dataFile())
     // Compact payload: no newline-plus-indentation from JSON.stringify(_, null, 2).
     expect(raw).not.toMatch(/\n\s+"/)
     const parsed = JSON.parse(raw) as PersistedState
@@ -782,4 +786,39 @@ describe('Store', () => {
     const store = await createStore()
     expect(store.getUI().browserKagiSessionLink).toBe(sessionLink)
   })
+
+  it.each(['shutdown', 'freeze', 'maintenance'] as const)(
+    'rejects legacy SSH mutations before changing memory during %s',
+    async (gate) => {
+      const store = await createStore()
+      const recovery = {
+        targetId: 'ssh-1',
+        clientInstanceId: 'client-1',
+        serverBuildId: 'relay-build-1',
+        clientGeneration: 3,
+        ownerGeneration: 5,
+        ownerLease: 'secret-owner-lease'
+      }
+      await store.upsertSshPtyConsumerRecovery(recovery)
+      store.upsertSshRemotePtyLease({ targetId: 'ssh-1', ptyId: 'pty-1', state: 'detached' })
+      await store.flushPendingOrThrowAsync()
+      const closing =
+        gate === 'shutdown'
+          ? store.flushAsync()
+          : gate === 'freeze'
+            ? store.freezeWritesAsync()
+            : store.beginProfileMaintenance()
+      await Promise.all(
+        [
+          store.upsertSshPtyConsumerRecovery({ ...recovery, clientInstanceId: 'refused-owner' }),
+          store.removeSshPtyConsumerRecovery('ssh-1'),
+          store.markSshRemotePtyLeasesAsync('ssh-1', 'terminated'),
+          store.markSshRemotePtyLeasesAttachedAsync('ssh-1', ['pty-1'])
+        ].map((operation) => expect(operation).rejects.toThrow('finalized profile persistence'))
+      )
+      expect(store.getSshPtyConsumerRecovery('ssh-1')).toEqual(recovery)
+      expect(store.getSshRemotePtyLeases('ssh-1')[0]?.state).toBe('detached')
+      await closing
+    }
+  )
 })
diff --git a/src/main/persistence-update-repo.test.ts b/src/main/persistence-update-repo.test.ts
index d24267296588..b60e43df8403 100644
--- a/src/main/persistence-update-repo.test.ts
+++ b/src/main/persistence-update-repo.test.ts
@@ -1,9 +1,5 @@
-import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
-import { rmSync, mkdtempSync } from 'node:fs'
-import { join } from 'node:path'
-import { tmpdir } from 'node:os'
-import { getDefaultPersistedState } from '../shared/constants'
 import {
+  closeTestStores,
   testState,
   createStore,
   writeDataFile,
@@ -11,6 +7,12 @@ import {
   makeProject,
   makeProjectHostSetup
 } from './persistence-test-harness'
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
+import { rmSync, mkdtempSync } from 'node:fs'
+import { join } from 'node:path'
+import { tmpdir } from 'node:os'
+import { getDefaultPersistedState } from '../shared/constants'
+
 import {
   getLocalWorktreeScanGeneration,
   isLocalWorktreeScanGenerationCurrent
@@ -64,7 +66,8 @@ describe('Store', () => {
     getCohortAtEmitMock.mockReturnValue({ nth_repo_added: 2 })
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
   // ── 7. updateRepo ──────────────────────────────────────────────────
diff --git a/src/main/persistence-workspace-pinned-automation-fence.test.ts b/src/main/persistence-workspace-pinned-automation-fence.test.ts
index 977aed0692de..1eaf04739a9c 100644
--- a/src/main/persistence-workspace-pinned-automation-fence.test.ts
+++ b/src/main/persistence-workspace-pinned-automation-fence.test.ts
@@ -1,3 +1,9 @@
+import {
+  closeTestStores,
+  createSqliteTestStore,
+  readPersistedStateJson,
+  writePersistedStateJson
+} from './persistence-test-harness'
 /**
  * A `local`-typed automation whose folder workspace pins it to an SSH host is
  * projected as SSH-owned, so it must be fenceable like any other SSH-owned row.
@@ -8,7 +14,7 @@
  * different machine. These tests drive the real Store through create and reload.
  */
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'
 import { join } from 'node:path'
 import { tmpdir } from 'node:os'
 import type { Automation, AutomationCreateInput } from '../shared/automations-types'
@@ -116,7 +122,7 @@ async function createStoreFromState(state: Record<string, unknown>) {
   installFakeAppEnvironment({ getPath: () => testState.dir })
   const { Store, initDataPath } = await import('./persistence')
   initDataPath()
-  return new Store()
+  return createSqliteTestStore(Store, { dataFile: join(testState.dir, 'orca-data.json') })
 }
 
 async function reloadStore() {
@@ -124,16 +130,16 @@ async function reloadStore() {
   installFakeAppEnvironment({ getPath: () => testState.dir })
   const { Store, initDataPath } = await import('./persistence')
   initDataPath()
-  return new Store()
+  return createSqliteTestStore(Store, { dataFile: join(testState.dir, 'orca-data.json') })
 }
 
 /** The same target id now carries a different registration incarnation. */
 function replaceStoredTargetGeneration(generation: number): void {
   const file = join(testState.dir, 'orca-data.json')
-  const state = JSON.parse(readFileSync(file, 'utf-8'))
+  const state = JSON.parse(readPersistedStateJson(file))
   state.sshTargets = [prodTarget(generation)]
   state.sshTargetGenerationCounter = generation
-  writeFileSync(file, JSON.stringify(state), 'utf-8')
+  writePersistedStateJson(file, JSON.stringify(state))
 }
 
 const PINNED_CREATE_INPUT: AutomationCreateInput = {
@@ -158,7 +164,8 @@ beforeEach(() => {
   testState.dir = mkdtempSync(join(tmpdir(), 'orca-pinned-fence-'))
 })
 
-afterEach(() => {
+afterEach(async () => {
+  await closeTestStores()
   rmSync(testState.dir, { recursive: true, force: true })
   vi.resetModules()
 })
diff --git a/src/main/persistence-workspace-repin-automation-owner.test.ts b/src/main/persistence-workspace-repin-automation-owner.test.ts
index 14f33c5db297..4f17c14ec47b 100644
--- a/src/main/persistence-workspace-repin-automation-owner.test.ts
+++ b/src/main/persistence-workspace-repin-automation-owner.test.ts
@@ -1,3 +1,9 @@
+import {
+  closeTestStores,
+  createSqliteTestStore,
+  readPersistedStateJson,
+  writePersistedStateJson
+} from './persistence-test-harness'
 /**
  * A folder workspace can be re-pointed at another SSH host outside the automation
  * editor — the workspace's scope connection moves, and every record inside it
@@ -10,7 +16,7 @@
  * a host removed and re-added under the same id still cannot re-adopt the record.
  */
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'
 import { join } from 'node:path'
 import { tmpdir } from 'node:os'
 import type { FolderWorkspace } from '../shared/folder-workspace-types'
@@ -140,25 +146,26 @@ async function loadStore(state: Record<string, unknown>) {
   installFakeAppEnvironment({ getPath: () => testState.dir })
   const { Store, initDataPath } = await import('./persistence')
   initDataPath()
-  return new Store()
+  return createSqliteTestStore(Store, { dataFile: join(testState.dir, 'orca-data.json') })
 }
 
 /** The workspace's execution host changes without any automation being edited. */
 function repinWorkspace(connectionId: string, sshTargets?: SshTarget[]): void {
   const file = join(testState.dir, 'orca-data.json')
-  const state = JSON.parse(readFileSync(file, 'utf-8'))
+  const state = JSON.parse(readPersistedStateJson(file))
   state.folderWorkspaces = [folderWorkspace(connectionId)]
   if (sshTargets) {
     state.sshTargets = sshTargets
   }
-  writeFileSync(file, JSON.stringify(state), 'utf-8')
+  writePersistedStateJson(file, JSON.stringify(state))
 }
 
 beforeEach(() => {
   testState.dir = mkdtempSync(join(tmpdir(), 'orca-workspace-repin-'))
 })
 
-afterEach(() => {
+afterEach(async () => {
+  await closeTestStores()
   rmSync(testState.dir, { recursive: true, force: true })
   vi.resetModules()
 })
@@ -183,7 +190,9 @@ describe('a workspace re-pinned outside the automation editor', () => {
     installFakeAppEnvironment({ getPath: () => testState.dir })
     const { Store, initDataPath } = await import('./persistence')
     initDataPath()
-    const reloaded = new Store()
+    const reloaded = createSqliteTestStore(Store, {
+      dataFile: join(testState.dir, 'orca-data.json')
+    })
 
     expect(reloaded.listAutomations()[0].executionTargetGeneration).toBe(STAGING_GENERATION)
     expect(reloaded.listAutomationsForScope().items[0].selector).toEqual({
@@ -205,7 +214,9 @@ describe('a workspace re-pinned outside the automation editor', () => {
     installFakeAppEnvironment({ getPath: () => testState.dir })
     const { Store, initDataPath } = await import('./persistence')
     initDataPath()
-    const reloaded = new Store()
+    const reloaded = createSqliteTestStore(Store, {
+      dataFile: join(testState.dir, 'orca-data.json')
+    })
 
     expect(reloaded.listAutomations()[0].executionTargetGeneration).toBe(PROD_GENERATION)
     expect(reloaded.listAutomationsForScope().items[0].selector).toEqual({
diff --git a/src/main/persistence-workspace-session-scrollback.test.ts b/src/main/persistence-workspace-session-scrollback.test.ts
index 29c664be49b6..8afd69d70b07 100644
--- a/src/main/persistence-workspace-session-scrollback.test.ts
+++ b/src/main/persistence-workspace-session-scrollback.test.ts
@@ -1,12 +1,15 @@
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
-import { writeFileSync, readFileSync, rmSync, mkdtempSync, mkdirSync, existsSync } from 'node:fs'
-import type * as NodeFsPromises from 'node:fs/promises'
+import { writeFileSync, rmSync, mkdtempSync, mkdirSync, existsSync } from 'node:fs'
+import { ProfileStateSqliteAuthority } from './persistence/profile-state/profile-state-sqlite-authority'
 import { join } from 'node:path'
 import { tmpdir } from 'node:os'
 import { isTerminalLeafId, makePaneKey } from '../shared/stable-pane-id'
 import { TERMINAL_SCROLLBACK_REPLAY_BYTE_LIMIT } from '../shared/terminal-scrollback-limits'
 import { MAX_BROWSER_HISTORY_ENTRIES } from '../shared/workspace-session-browser-history'
 import {
+  closeTestStores,
+  createSqliteTestStore,
+  readPersistedStateJson,
   testState,
   createStore,
   dataFile,
@@ -29,29 +32,6 @@ const { loadUserSshConfigMock, sshConfigHostsToTargetsMock } = vi.hoisted(() =>
   sshConfigHostsToTargetsMock: vi.fn()
 }))
 
-const asyncPrimaryWriteFailure = vi.hoisted(() => ({
-  error: null as Error | null,
-  targetPrefix: ''
-}))
-
-vi.mock('node:fs/promises', async (importOriginal) => {
-  const actual = await importOriginal<typeof NodeFsPromises>()
-  return {
-    ...actual,
-    open: async (...args: Parameters<typeof actual.open>) => {
-      const target = args[0]
-      if (
-        asyncPrimaryWriteFailure.error &&
-        typeof target === 'string' &&
-        target.startsWith(asyncPrimaryWriteFailure.targetPrefix)
-      ) {
-        throw asyncPrimaryWriteFailure.error
-      }
-      return actual.open(...args)
-    }
-  }
-})
-
 vi.mock('./ssh/ssh-config-parser', () => ({
   loadUserSshConfig: loadUserSshConfigMock,
   sshConfigHostsToTargets: sshConfigHostsToTargetsMock
@@ -92,14 +72,11 @@ describe('Store', () => {
     trackMock.mockReset()
     getCohortAtEmitMock.mockReset()
     getCohortAtEmitMock.mockReturnValue({ nth_repo_added: 2 })
-    asyncPrimaryWriteFailure.error = null
-    asyncPrimaryWriteFailure.targetPrefix = ''
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
-    asyncPrimaryWriteFailure.error = null
-    asyncPrimaryWriteFailure.targetPrefix = ''
   })
   // ── GitHub Cache ───────────────────────────────────────────────────
 
@@ -222,7 +199,7 @@ describe('Store', () => {
     // AppEnvironment — without this it points at the global fake's shared dir.
     installFakeAppEnvironment({ getPath: () => testState.dir })
     initDataPath()
-    const store = new Store({ dataFile: profileDataFile })
+    const store = createSqliteTestStore(Store, { dataFile: profileDataFile })
     store.addRepo(makeRepo({ id: 'remote-repo', connectionId: 'ssh-target-1' }))
     const session = makeSessionWithTerminalBuffers()
     store.setWorkspaceSession({
@@ -253,7 +230,7 @@ describe('Store', () => {
     // AppEnvironment — without this it points at the global fake's shared dir.
     installFakeAppEnvironment({ getPath: () => testState.dir })
     initDataPath()
-    const store = new Store({ dataFile: profileDataFile })
+    const store = createSqliteTestStore(Store, { dataFile: profileDataFile })
 
     expect(store.readTerminalScrollbackSnapshot(ref)).toBe('legacy-scrollback')
   })
@@ -342,7 +319,8 @@ describe('Store', () => {
     })
 
     expect(existsSync(join(testState.dir, 'terminal-scrollback', `${ref}.bin`))).toBe(false)
-    const stillPublished = JSON.parse(readFileSync(dataFile(), 'utf-8')) as {
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The preceding Store save produced the PersistedState snapshot read by this test.
+    const stillPublished = JSON.parse(readPersistedStateJson(dataFile())) as {
       workspaceSession: {
         terminalLayoutsByTabId: Record<string, { scrollbackRefsByLeafId?: Record<string, string> }>
       }
@@ -353,7 +331,7 @@ describe('Store', () => {
     ).toBe(ref)
   })
 
-  it('leaves durable JSON pointing at deleted scrollback when the replacement write fails', async () => {
+  it('leaves durable state pointing at deleted scrollback when the replacement write fails', async () => {
     const store = await createStore()
     store.addRepo(makeRepo({ id: 'remote-repo', connectionId: 'ssh-target-1' }))
     const session = makeSessionWithTerminalBuffers()
@@ -375,14 +353,17 @@ describe('Store', () => {
     }
     const snapshotPath = join(testState.dir, 'terminal-scrollback', `${ref}.bin`)
     store.flushOrThrow()
-    const durableBeforeRemoval = readFileSync(dataFile(), 'utf-8')
+    const durableBeforeRemoval = readPersistedStateJson(dataFile())
     expect(existsSync(snapshotPath)).toBe(true)
 
     const writeError = Object.assign(new Error('profile mount rejected replacement write'), {
       code: 'EIO'
     })
-    asyncPrimaryWriteFailure.error = writeError
-    asyncPrimaryWriteFailure.targetPrefix = `${dataFile()}.`
+    const failure = vi
+      .spyOn(ProfileStateSqliteAuthority.prototype, 'writeSerializedDomains')
+      .mockImplementation(() => {
+        throw writeError
+      })
     const errors = vi.spyOn(console, 'error').mockImplementation(() => {})
     try {
       store.setWorkspaceSession({
@@ -397,10 +378,11 @@ describe('Store', () => {
       expect(store.getWorkspaceSession().terminalLayoutsByTabId).toEqual({})
       await expect(store.flushPendingOrThrowAsync()).rejects.toBe(writeError)
     } finally {
+      failure.mockRestore()
       errors.mockRestore()
     }
 
-    expect(readFileSync(dataFile(), 'utf-8')).toBe(durableBeforeRemoval)
+    expect(readPersistedStateJson(dataFile())).toBe(durableBeforeRemoval)
     const stillPublished = JSON.parse(durableBeforeRemoval) as {
       workspaceSession: {
         terminalLayoutsByTabId: Record<string, { scrollbackRefsByLeafId?: Record<string, string> }>
diff --git a/src/main/persistence-workspace-status-workflow.test.ts b/src/main/persistence-workspace-status-workflow.test.ts
index 9b6d5d4c9bb1..1804d04dc410 100644
--- a/src/main/persistence-workspace-status-workflow.test.ts
+++ b/src/main/persistence-workspace-status-workflow.test.ts
@@ -1,9 +1,16 @@
+import {
+  closeTestStores,
+  testState,
+  createStore,
+  writeDataFile,
+  readDataFile
+} from './persistence-test-harness'
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
 import { rmSync, mkdtempSync } from 'node:fs'
 import { join } from 'node:path'
 import { tmpdir } from 'node:os'
 import type { PersistedState } from '../shared/persisted-state-types'
-import { testState, createStore, writeDataFile, readDataFile } from './persistence-test-harness'
+
 import {
   REORDERED_DEFAULT_WORKSPACE_STATUSES,
   REORDERED_DONE_DEFAULT_WORKSPACE_STATUSES,
@@ -59,7 +66,8 @@ describe('Store', () => {
     getCohortAtEmitMock.mockReturnValue({ nth_repo_added: 2 })
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
   it('preserves persisted smart sort value', async () => {
diff --git a/src/main/persistence-worktree-card-properties.test.ts b/src/main/persistence-worktree-card-properties.test.ts
index 37a6fbe5e1f4..e370168af4f4 100644
--- a/src/main/persistence-worktree-card-properties.test.ts
+++ b/src/main/persistence-worktree-card-properties.test.ts
@@ -1,8 +1,8 @@
+import { closeTestStores, testState, createStore, writeDataFile } from './persistence-test-harness'
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
 import { rmSync, mkdtempSync } from 'node:fs'
 import { join } from 'node:path'
 import { tmpdir } from 'node:os'
-import { testState, createStore, writeDataFile } from './persistence-test-harness'
 
 // Stub the ~/.ssh/config parser so the SSH-import test drives the real Store with deterministic hosts, not the operator's actual ~/.ssh/config.
 const { loadUserSshConfigMock, sshConfigHostsToTargetsMock } = vi.hoisted(() => ({
@@ -52,7 +52,8 @@ describe('Store', () => {
     getCohortAtEmitMock.mockReturnValue({ nth_repo_added: 2 })
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
   // ── worktree-card property migration ───────────────────────────────
diff --git a/src/main/persistence-worktree-deletion-fencing.test.ts b/src/main/persistence-worktree-deletion-fencing.test.ts
index 62619bbd05bb..40a4c50e9f44 100644
--- a/src/main/persistence-worktree-deletion-fencing.test.ts
+++ b/src/main/persistence-worktree-deletion-fencing.test.ts
@@ -1,9 +1,15 @@
+import {
+  closeTestStores,
+  testState,
+  createStore,
+  makeTerminalTab
+} from './persistence-test-harness'
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
 import { rmSync, mkdtempSync } from 'node:fs'
 import { join } from 'node:path'
 import { tmpdir } from 'node:os'
 import { getDefaultWorkspaceSession } from '../shared/constants'
-import { testState, createStore, makeTerminalTab } from './persistence-test-harness'
+
 import { TEST_LEAF_1, TEST_LEAF_2 } from './persistence-session-fixtures'
 
 // Stub the ~/.ssh/config parser so the SSH-import test drives the real Store with deterministic hosts, not the operator's actual ~/.ssh/config.
@@ -54,7 +60,8 @@ describe('Store', () => {
     getCohortAtEmitMock.mockReturnValue({ nth_repo_added: 2 })
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
   it('adds a missing split leaf to the durable root when a new pane spawns before layout debounce', async () => {
@@ -87,7 +94,7 @@ describe('Store', () => {
       }
     })
 
-    store.persistPtyBinding({
+    await store.persistPtyBinding({
       worktreeId: 'wt1',
       tabId: 'tab1',
       leafId: TEST_LEAF_2,
@@ -132,7 +139,7 @@ describe('Store', () => {
       terminalTopologyRevisionByRepoId: { wt1: 1 }
     })
 
-    store.persistPtyBinding({
+    await store.persistPtyBinding({
       worktreeId: 'wt1',
       tabId: 'tab1',
       leafId: TEST_LEAF_2,
@@ -179,7 +186,7 @@ describe('Store', () => {
     store.setWorkspaceSession(stale)
     expect(store.getWorkspaceSession().tabsByWorktree.wt1).toEqual([])
 
-    store.persistPtyBinding({
+    await store.persistPtyBinding({
       worktreeId: 'wt1',
       tabId: 'fresh-tab',
       leafId: TEST_LEAF_2,
@@ -261,7 +268,7 @@ describe('Store', () => {
     expect(store.getWorkspaceSession().tabsByWorktree[worktreeA]?.[0]?.id).toBe('tab-a')
     expect(store.getWorkspaceSession().tabsByWorktree[worktreeB]?.[0]?.id).toBe('tab-b')
 
-    store.persistPtyBinding({
+    await store.persistPtyBinding({
       worktreeId: worktreeB,
       tabId: 'fresh-tab',
       leafId: TEST_LEAF_1,
@@ -281,7 +288,7 @@ describe('Store', () => {
     for (let index = 0; index < 25; index += 1) {
       const worktreeId = `repo::/worktree-${index}`
       store.setWorktreeMeta(worktreeId, { displayName: `Worktree ${index}` })
-      store.persistPtyBinding({
+      await store.persistPtyBinding({
         worktreeId,
         tabId: `tab-${index}`,
         leafId: TEST_LEAF_1,
@@ -364,7 +371,7 @@ describe('Store', () => {
       }
     })
 
-    store.persistPtyBinding({
+    await store.persistPtyBinding({
       worktreeId: 'wt1',
       tabId: 'tab1',
       leafId: TEST_LEAF_1,
diff --git a/src/main/persistence-worktree-lineage-and-backups.test.ts b/src/main/persistence-worktree-lineage-and-backups.test.ts
index 372e8b0e33b4..0c38ca2f32f9 100644
--- a/src/main/persistence-worktree-lineage-and-backups.test.ts
+++ b/src/main/persistence-worktree-lineage-and-backups.test.ts
@@ -1,10 +1,6 @@
-import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
-import { writeFileSync, readFileSync, rmSync, mkdtempSync, mkdirSync, existsSync } from 'node:fs'
-import { join } from 'node:path'
-import { tmpdir } from 'node:os'
-import type { Repo } from '../shared/repo-types'
-import { folderWorkspaceKey, worktreeWorkspaceKey } from '../shared/workspace-scope'
 import {
+  closeTestStores,
+  readPersistedStateJson,
   testState,
   createStore,
   dataFile,
@@ -14,6 +10,16 @@ import {
   makeWorktreeLineage,
   makeWorkspaceLineage
 } from './persistence-test-harness'
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
+import { writeFileSync, readFileSync, rmSync, mkdtempSync, mkdirSync, existsSync } from 'node:fs'
+import { join } from 'node:path'
+import { tmpdir } from 'node:os'
+import { createProfileStateStore } from './persistence/profile-state/profile-state-store-factory'
+import { ProfileStateAuthorityBootstrapError } from './persistence/profile-state/profile-state-authority-bootstrap'
+import { restoreProfileStateJsonExport } from './persistence/profile-state/legacy-json/profile-state-recovery'
+import { acquireProfileStateMaintenance } from './persistence/profile-state/profile-state-access'
+import type { Repo } from '../shared/repo-types'
+import { folderWorkspaceKey, worktreeWorkspaceKey } from '../shared/workspace-scope'
 
 // Stub the ~/.ssh/config parser so the SSH-import test drives the real Store with deterministic hosts, not the operator's actual ~/.ssh/config.
 const { loadUserSshConfigMock, sshConfigHostsToTargetsMock } = vi.hoisted(() => ({
@@ -63,7 +69,8 @@ describe('Store', () => {
     getCohortAtEmitMock.mockReturnValue({ nth_repo_added: 2 })
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
   // ── getAllWorktreeMeta ─────────────────────────────────────────────
@@ -331,282 +338,129 @@ describe('Store', () => {
     })
   })
 
-  // ── Rolling backups (issue #1158) ──────────────────────────────────
-
-  describe('rolling backups', () => {
-    function backupFile(index: number): string {
-      return `${dataFile()}.bak.${index}`
-    }
-
-    function readBackup(index: number): { repos: Repo[] } {
-      return JSON.parse(readFileSync(backupFile(index), 'utf-8'))
-    }
-
-    function advanceMockedTime(advanceFn: () => void, ms: number): void {
-      vi.setSystemTime(new Date(Date.now() + ms))
-      advanceFn()
-    }
-
-    it('snapshots the just-written file to .bak.0 on the very first write', async () => {
-      const s = await createStore()
-      s.addRepo(makeRepo())
-      s.flush()
-      expect(existsSync(dataFile())).toBe(true)
-      expect(existsSync(backupFile(0))).toBe(true)
-      expect(readBackup(0).repos.map((r) => r.id)).toEqual(['r1'])
-    })
-
-    it('rotates older .bak.0 to .bak.1 when the interval elapses', async () => {
-      vi.useFakeTimers()
-      try {
-        const first = await createStore()
-        first.addRepo(makeRepo({ id: 'r1' }))
-        first.flush()
-        expect(readBackup(0).repos.map((r) => r.id)).toEqual(['r1'])
-
-        vi.setSystemTime(new Date(Date.now() + 61 * 60 * 1000))
-
-        const second = await createStore()
-        second.addRepo(makeRepo({ id: 'r2', path: '/repo2' }))
-        second.flush()
-
-        const current = readDataFile() as { repos: Repo[] }
-        expect(current.repos.map((r) => r.id).sort()).toEqual(['r1', 'r2'])
-        expect(
-          readBackup(0)
-            .repos.map((r) => r.id)
-            .sort()
-        ).toEqual(['r1', 'r2'])
-        expect(readBackup(1).repos.map((r) => r.id)).toEqual(['r1'])
-      } finally {
-        vi.useRealTimers()
-      }
-    })
-
-    it('keeps at most 5 rotating backups', async () => {
-      vi.useFakeTimers()
-      try {
-        writeDataFile({
-          schemaVersion: 1,
-          repos: [makeRepo({ id: 'seed' })],
-          worktreeMeta: {},
-          settings: {},
-          ui: {},
-          githubCache: { pr: {}, issue: {} },
-          workspaceSession: {}
-        })
-
-        for (let i = 0; i < 6; i++) {
-          vi.setSystemTime(new Date(Date.now() + 61 * 60 * 1000))
-          const s = await createStore()
-          s.addRepo(makeRepo({ id: `gen-${i}`, path: `/gen-${i}` }))
-          s.flush()
+  describe('retired JSON backups', () => {
+    it.each(['sync', 'async'] as const)(
+      'leaves legacy JSON and backups unchanged during %s SQL writes',
+      async (flush) => {
+        writeDataFile({ repos: [makeRepo({ id: 'seed' })] })
+        const retained = readFileSync(dataFile())
+        const backup = `${dataFile()}.bak.0`
+        writeFileSync(backup, retained)
+        const store = createStore()
+        store.addRepo(makeRepo({ id: 'updated', path: '/updated' }))
+        if (flush === 'sync') {
+          store.flushOrThrow()
+        } else {
+          await store.flushPendingOrThrowAsync()
         }
 
-        for (let i = 0; i < 5; i++) {
-          expect(existsSync(backupFile(i))).toBe(true)
-        }
-        expect(existsSync(backupFile(5))).toBe(false)
-      } finally {
-        vi.useRealTimers()
+        expect(readFileSync(dataFile())).toEqual(retained)
+        expect(readFileSync(backup)).toEqual(retained)
+        expect(existsSync(`${dataFile()}.bak.1`)).toBe(false)
+        const persisted = readDataFile() as { repos: Repo[] }
+        expect(persisted.repos.map((repo) => repo.id).sort()).toEqual(['seed', 'updated'])
       }
-    })
+    )
 
-    it('does not rotate more than once per hour', async () => {
-      vi.useFakeTimers()
-      try {
-        writeDataFile({
-          schemaVersion: 1,
-          repos: [makeRepo({ id: 'seed' })],
-          worktreeMeta: {},
-          settings: {},
-          ui: {},
-          githubCache: { pr: {}, issue: {} },
-          workspaceSession: {}
-        })
-
-        const store = await createStore()
-        store.addRepo(makeRepo({ id: 'after-seed' }))
-        store.flush()
-
-        const bak0After1 = readBackup(0)
-        expect(bak0After1.repos.map((r) => r.id).sort()).toEqual(['after-seed', 'seed'])
-
-        advanceMockedTime(
-          () => {
-            store.addRepo(makeRepo({ id: 'within-hour', path: '/within' }))
-            store.flush()
-          },
-          5 * 60 * 1000
-        )
-
-        const bak0After2 = readBackup(0)
-        expect(bak0After2.repos.map((r) => r.id).sort()).toEqual(['after-seed', 'seed'])
-      } finally {
-        vi.useRealTimers()
-      }
+    it('does not create a JSON primary or backup for a fresh SQL profile', () => {
+      const store = createStore()
+      store.addRepo(makeRepo())
+      store.flushOrThrow()
+      expect(existsSync(dataFile())).toBe(false)
+      expect(existsSync(`${dataFile()}.bak.0`)).toBe(false)
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The fixture registered r1 before flushing; its exported repos are Repo records.
+      expect((readDataFile() as { repos: Repo[] }).repos.map((repo) => repo.id)).toEqual(['r1'])
     })
+  })
 
-    it('does not rotate on the async write path within the 1-hour window', async () => {
-      vi.useFakeTimers()
-      try {
-        writeDataFile({
-          schemaVersion: 1,
-          repos: [makeRepo({ id: 'seed' })],
-          worktreeMeta: {},
-          settings: {},
-          ui: {},
-          githubCache: { pr: {}, issue: {} },
-          workspaceSession: {}
-        })
-
-        const store = await createStore()
-        store.addRepo(makeRepo({ id: 'first-async' }))
-        vi.advanceTimersByTime(1000)
-        await store.waitForPendingWrite()
-
-        const bak0AfterFirst = readBackup(0)
-        expect(bak0AfterFirst.repos.map((r) => r.id).sort()).toEqual(['first-async', 'seed'])
-
-        vi.setSystemTime(new Date(Date.now() + 5 * 60 * 1000))
-        store.addRepo(makeRepo({ id: 'within-hour-async', path: '/within-async' }))
-        vi.advanceTimersByTime(1000)
-        await store.waitForPendingWrite()
+  describe('legacy backup import and recovery', () => {
+    const recoveredStores: ReturnType<typeof createProfileStateStore>['store'][] = []
+    afterEach(async () => {
+      await Promise.all(recoveredStores.splice(0).map((store) => store.freezeWritesAsync()))
+    })
 
-        const bak0AfterSecond = readBackup(0)
-        expect(bak0AfterSecond.repos.map((r) => r.id).sort()).toEqual(['first-async', 'seed'])
-      } finally {
-        vi.useRealTimers()
+    function recoveryOptions() {
+      const directory = join(testState.dir, 'profiles', 'recovery-test')
+      mkdirSync(directory, { recursive: true })
+      return {
+        dataFile: join(directory, 'orca-data.json'),
+        databaseFile: join(directory, 'profile-state.db'),
+        profileId: 'recovery-test'
       }
-    })
+    }
 
-    it('rotates on the async write path after the 1-hour window elapses', async () => {
-      vi.useFakeTimers()
+    function importRecoveredProfile(options: ReturnType<typeof recoveryOptions>) {
+      const { store } = createProfileStateStore(options)
+      recoveredStores.push(store)
+      return store
+    }
+
+    function restoreSelectedBackup(options: ReturnType<typeof recoveryOptions>, index: number) {
+      expect(() => createProfileStateStore(options)).toThrow(ProfileStateAuthorityBootstrapError)
+      const maintenance = acquireProfileStateMaintenance(testState.dir)
       try {
-        writeDataFile({
-          schemaVersion: 1,
-          repos: [makeRepo({ id: 'seed' })],
-          worktreeMeta: {},
-          settings: {},
-          ui: {},
-          githubCache: { pr: {}, issue: {} },
-          workspaceSession: {}
+        restoreProfileStateJsonExport({
+          ...options,
+          databasePath: options.databaseFile,
+          exportPath: `${options.dataFile}.bak.${index}`,
+          maintenance
         })
-
-        const store = await createStore()
-        store.addRepo(makeRepo({ id: 'first-async' }))
-        vi.advanceTimersByTime(1000)
-        await store.waitForPendingWrite()
-
-        expect(
-          readBackup(0)
-            .repos.map((r) => r.id)
-            .sort()
-        ).toEqual(['first-async', 'seed'])
-
-        vi.setSystemTime(new Date(Date.now() + 61 * 60 * 1000))
-        store.addRepo(makeRepo({ id: 'after-hour-async', path: '/after-async' }))
-        vi.advanceTimersByTime(1000)
-        await store.waitForPendingWrite()
-
-        expect(
-          readBackup(0)
-            .repos.map((r) => r.id)
-            .sort()
-        ).toEqual(['after-hour-async', 'first-async', 'seed'])
-        expect(existsSync(backupFile(1))).toBe(true)
-        expect(
-          readBackup(1)
-            .repos.map((r) => r.id)
-            .sort()
-        ).toEqual(['first-async', 'seed'])
       } finally {
-        vi.useRealTimers()
+        maintenance.release()
       }
-    })
-
-    function writeBackup(index: number, data: unknown): void {
-      mkdirSync(testState.dir, { recursive: true })
-      writeFileSync(backupFile(index), JSON.stringify(data, null, 2), 'utf-8')
+      return importRecoveredProfile(options)
     }
 
-    it('recovers from .bak.0 when the primary file is corrupt', async () => {
-      mkdirSync(testState.dir, { recursive: true })
-      writeFileSync(dataFile(), '{{{corrupt-json', 'utf-8')
-      writeBackup(0, {
-        schemaVersion: 1,
-        repos: [makeRepo({ id: 'recovered' })],
-        worktreeMeta: {},
-        settings: {},
-        ui: {},
-        githubCache: { pr: {}, issue: {} },
-        workspaceSession: {}
-      })
-
-      const store = await createStore()
-      expect(store.getRepos().map((r) => r.id)).toEqual(['recovered'])
-    })
-
-    it('falls through to .bak.1 when both primary and .bak.0 are corrupt', async () => {
-      mkdirSync(testState.dir, { recursive: true })
-      writeFileSync(dataFile(), '{{{corrupt-json', 'utf-8')
-      writeFileSync(backupFile(0), '{{also-corrupt', 'utf-8')
-      writeBackup(1, {
-        schemaVersion: 1,
-        repos: [makeRepo({ id: 'from-bak1' })],
-        worktreeMeta: {},
-        settings: {},
-        ui: {},
-        githubCache: { pr: {}, issue: {} },
-        workspaceSession: {}
-      })
-
-      const store = await createStore()
-      expect(store.getRepos().map((r) => r.id)).toEqual(['from-bak1'])
-    })
-
-    it('falls back to defaults only when every backup is also unusable', async () => {
-      mkdirSync(testState.dir, { recursive: true })
-      writeFileSync(dataFile(), '{{{corrupt', 'utf-8')
-      for (let i = 0; i < 5; i++) {
-        writeFileSync(backupFile(i), `{{slot-${i}-corrupt`, 'utf-8')
+    it.each([
+      { primary: 'corrupt', index: 0, repoId: 'recovered' },
+      { primary: 'corrupt', index: 1, repoId: 'from-bak1' },
+      { primary: 'missing', index: 0, repoId: 'rescued' }
+    ] as const)('imports backup $index with a $primary primary', (scenario) => {
+      const options = recoveryOptions()
+      if (scenario.primary === 'corrupt') {
+        writeFileSync(options.dataFile, '{{corrupt')
+      }
+      if (scenario.index === 1) {
+        writeFileSync(`${options.dataFile}.bak.0`, '{{also-corrupt')
+      }
+      const backup = `${options.dataFile}.bak.${scenario.index}`
+      const retained = JSON.stringify({ repos: [makeRepo({ id: scenario.repoId })] })
+      writeFileSync(backup, retained)
+      const store =
+        scenario.primary === 'missing'
+          ? restoreSelectedBackup(options, scenario.index)
+          : importRecoveredProfile(options)
+      expect(store.getRepos().map((repo) => repo.id)).toEqual([scenario.repoId])
+      expect(readFileSync(backup, 'utf8')).toBe(retained)
+      if (scenario.primary === 'corrupt') {
+        expect(readFileSync(options.dataFile, 'utf8')).toBe('{{corrupt')
       }
-
-      const store = await createStore()
-      expect(store.getRepos()).toEqual([])
     })
 
-    it('uses .bak.0 even when primary file is missing entirely', async () => {
-      mkdirSync(testState.dir, { recursive: true })
-      writeBackup(0, {
-        schemaVersion: 1,
-        repos: [makeRepo({ id: 'rescued' })],
-        worktreeMeta: {},
-        settings: {},
-        ui: {},
-        githubCache: { pr: {}, issue: {} },
-        workspaceSession: {}
-      })
-
-      const store = await createStore()
-      expect(store.getRepos().map((r) => r.id)).toEqual(['rescued'])
+    it('refuses defaults when the primary and every backup are unusable', () => {
+      const options = recoveryOptions()
+      writeFileSync(options.dataFile, '{{corrupt')
+      for (let index = 0; index < 5; index++) {
+        writeFileSync(`${options.dataFile}.bak.${index}`, `{{slot-${index}-corrupt`)
+      }
+      expect(() => createProfileStateStore(options)).toThrow(ProfileStateAuthorityBootstrapError)
+      expect(existsSync(options.databaseFile)).toBe(false)
+      expect(readFileSync(options.dataFile, 'utf8')).toBe('{{corrupt')
     })
 
-    it('still recovers repos/worktrees from a backup with corrupt workspaceSession', async () => {
-      mkdirSync(testState.dir, { recursive: true })
-      writeFileSync(dataFile(), '{{{corrupt', 'utf-8')
-      writeBackup(0, {
-        schemaVersion: 1,
-        repos: [makeRepo({ id: 'survives' })],
-        worktreeMeta: {},
-        settings: { theme: 'dark' },
-        ui: {},
-        githubCache: { pr: {}, issue: {} },
-        workspaceSession: { activeRepoId: 12345 }
-      })
-
-      const store = await createStore()
-      expect(store.getRepos().map((r) => r.id)).toEqual(['survives'])
+    it('recovers repos and settings from a selected backup with a malformed session', () => {
+      const options = recoveryOptions()
+      writeFileSync(options.dataFile, '{{corrupt')
+      writeFileSync(
+        `${options.dataFile}.bak.0`,
+        JSON.stringify({
+          repos: [makeRepo({ id: 'survives' })],
+          settings: { theme: 'dark' },
+          workspaceSession: { activeRepoId: 12345 }
+        })
+      )
+      const store = importRecoveredProfile(options)
+      expect(store.getRepos().map((repo) => repo.id)).toEqual(['survives'])
       expect(store.getSettings().theme).toBe('dark')
     })
   })
@@ -624,7 +478,8 @@ describe('Store', () => {
         vi.advanceTimersByTime(1000)
         await store.waitForPendingWrite()
 
-        const persisted = JSON.parse(readFileSync(dataFile(), 'utf-8')) as { repos: Repo[] }
+        // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The preceding Store save produced the PersistedState snapshot read by this test.
+        const persisted = JSON.parse(readPersistedStateJson()) as { repos: Repo[] }
         expect(persisted.repos.map((r) => r.id).sort()).toEqual(['first', 'second'])
       } finally {
         vi.useRealTimers()
diff --git a/src/main/persistence-worktree-meta-and-folder-workspaces.test.ts b/src/main/persistence-worktree-meta-and-folder-workspaces.test.ts
index 85795ac0c982..632e4ebf25a4 100644
--- a/src/main/persistence-worktree-meta-and-folder-workspaces.test.ts
+++ b/src/main/persistence-worktree-meta-and-folder-workspaces.test.ts
@@ -1,11 +1,5 @@
-import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
-import { rmSync, mkdtempSync } from 'node:fs'
-import { join } from 'node:path'
-import { tmpdir } from 'node:os'
-import type { PersistedState } from '../shared/persisted-state-types'
-import { getDefaultWorkspaceSession } from '../shared/constants'
-import { folderWorkspaceKey } from '../shared/workspace-scope'
 import {
+  closeTestStores,
   testState,
   createStore,
   writeDataFile,
@@ -13,6 +7,13 @@ import {
   makeRepo,
   makeTerminalTab
 } from './persistence-test-harness'
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
+import { rmSync, mkdtempSync } from 'node:fs'
+import { join } from 'node:path'
+import { tmpdir } from 'node:os'
+import type { PersistedState } from '../shared/persisted-state-types'
+import { getDefaultWorkspaceSession } from '../shared/constants'
+import { folderWorkspaceKey } from '../shared/workspace-scope'
 
 // Stub the ~/.ssh/config parser so the SSH-import test drives the real Store with deterministic hosts, not the operator's actual ~/.ssh/config.
 const { loadUserSshConfigMock, sshConfigHostsToTargetsMock } = vi.hoisted(() => ({
@@ -62,7 +63,8 @@ describe('Store', () => {
     getCohortAtEmitMock.mockReturnValue({ nth_repo_added: 2 })
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
   // ── 8. setWorktreeMeta and getWorktreeMeta ─────────────────────────
diff --git a/src/main/persistence-worktree-name-retirement.test.ts b/src/main/persistence-worktree-name-retirement.test.ts
index 2f89775ce87c..ebe4db5feec8 100644
--- a/src/main/persistence-worktree-name-retirement.test.ts
+++ b/src/main/persistence-worktree-name-retirement.test.ts
@@ -1,3 +1,4 @@
+import { closeTestStores, createSqliteTestStore } from './persistence-test-harness'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'
 import { tmpdir } from 'node:os'
@@ -50,7 +51,7 @@ async function reloadStore() {
   // file's temp dir rather than the global fake's shared one, after resetModules.
   installFakeAppEnvironment({ getPath: () => testState.dir })
   initDataPath()
-  return new Store()
+  return createSqliteTestStore(Store, { dataFile: join(testState.dir, 'orca-data.json') })
 }
 
 async function createStore(persisted: Record<string, unknown> = {}) {
@@ -67,7 +68,8 @@ beforeEach(() => {
   testState.dir = mkdtempSync(join(tmpdir(), 'orca-worktree-name-retirement-'))
 })
 
-afterEach(() => {
+afterEach(async () => {
+  await closeTestStores()
   rmSync(testState.dir, { force: true, recursive: true })
 })
 
diff --git a/src/main/persistence-worktree-visibility.test.ts b/src/main/persistence-worktree-visibility.test.ts
index 55f81617c03a..ab593396b72b 100644
--- a/src/main/persistence-worktree-visibility.test.ts
+++ b/src/main/persistence-worktree-visibility.test.ts
@@ -1,3 +1,10 @@
+import {
+  closeTestStores,
+  testState,
+  createStore,
+  writeDataFile,
+  makeRepo
+} from './persistence-test-harness'
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
 import { rmSync, mkdtempSync } from 'node:fs'
 import { join } from 'node:path'
@@ -5,7 +12,6 @@ import { tmpdir } from 'node:os'
 import type { GlobalSettings } from '../shared/global-settings-types'
 import type { ExternalWorktreeVisibility } from '../shared/repo-types'
 import { getDefaultPersistedState } from '../shared/constants'
-import { testState, createStore, writeDataFile, makeRepo } from './persistence-test-harness'
 
 // Stub the ~/.ssh/config parser so the SSH-import test drives the real Store with deterministic hosts, not the operator's actual ~/.ssh/config.
 const { loadUserSshConfigMock, sshConfigHostsToTargetsMock } = vi.hoisted(() => ({
@@ -55,7 +61,8 @@ describe('Store', () => {
     getCohortAtEmitMock.mockReturnValue({ nth_repo_added: 2 })
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
   it('updateRepo stamps legacy external-worktree visibility before changing old repos', async () => {
diff --git a/src/main/persistence/applying-settings/feature-interaction-recording.ts b/src/main/persistence/applying-settings/feature-interaction-recording.ts
index 2a29bc64f66b..662e79bd40fd 100644
--- a/src/main/persistence/applying-settings/feature-interaction-recording.ts
+++ b/src/main/persistence/applying-settings/feature-interaction-recording.ts
@@ -12,7 +12,7 @@ import { getCohortAtEmit } from '../../telemetry/cohort-classifier'
 
 export type FeatureInteractionOperations = {
   state: PersistedState
-  scheduleSave: () => void
+  scheduleSave: (domains?: readonly string[]) => void
   notifyUIChanged: () => void
   getUI: () => PersistedState['ui']
 }
@@ -49,7 +49,7 @@ export function recordFeatureInteraction(
   operations.state.featureInteractionTelemetryBuckets = shouldEmit
     ? { ...telemetryBuckets, [id]: nextBucket }
     : telemetryBuckets
-  operations.scheduleSave()
+  operations.scheduleSave(['ui', 'featureInteractionTelemetryBuckets'])
   // Why: live UI only consumes the seen transition; count-only telemetry must not re-hydrate the renderer.
   if (!existing) {
     operations.notifyUIChanged()
diff --git a/src/main/persistence/applying-settings/ui-state-update.ts b/src/main/persistence/applying-settings/ui-state-update.ts
index db06a2738fd8..5aad240e554b 100644
--- a/src/main/persistence/applying-settings/ui-state-update.ts
+++ b/src/main/persistence/applying-settings/ui-state-update.ts
@@ -57,7 +57,9 @@ export function updatePersistedUI(
   operations: UIUpdateOperations,
   updates: Partial<PersistedState['ui']>
 ): void {
-  if ('browserKagiSessionLink' in updates && !updates.browserKagiSessionLink) {
+  const clearsProtectedSecret =
+    'browserKagiSessionLink' in updates && !updates.browserKagiSessionLink
+  if (clearsProtectedSecret) {
     operations.removeRetainedBlob(PROTECTED_SECRET_SLOT.browserKagiSessionLink)
   }
   const sanitizedUpdates = stripMainOwnedTelemetryMarkerFromUI(updates)
@@ -192,7 +194,8 @@ export function updatePersistedUI(
           )
         : normalizeFeatureInteractions(operations.state.ui?.featureInteractions)
   }
-  if (persistedUIValuesEqual(previousUI, nextUI)) {
+  // A sealed secret looks empty in memory; an explicit clear must still reach disk.
+  if (!clearsProtectedSecret && persistedUIValuesEqual(previousUI, nextUI)) {
     if (activeViewChanged) {
       operations.notifyUIChanged()
     }
diff --git a/src/main/persistence/leasing-ssh-ptys/ssh-pty-consumer-recovery.ts b/src/main/persistence/leasing-ssh-ptys/ssh-pty-consumer-recovery.ts
index 3b259989906e..07770fe70b91 100644
--- a/src/main/persistence/leasing-ssh-ptys/ssh-pty-consumer-recovery.ts
+++ b/src/main/persistence/leasing-ssh-ptys/ssh-pty-consumer-recovery.ts
@@ -1,3 +1,4 @@
+import type { StoreRuntimeState } from '../loading-store/store-runtime-state'
 import type { SshPtyConsumerRecovery } from '../../../shared/ssh-types'
 import type { PersistedState } from '../../../shared/persisted-state-types'
 import type { ProtectedSecretPersistence } from '../../protected-secret-persistence'
@@ -7,16 +8,7 @@ import { normalizeSshPtyConsumerRecovery } from './ssh-normalization'
 export type SshPtyConsumerRecoveryOperations = {
   state: PersistedState
   protectedSecrets: Pick<ProtectedSecretPersistence, 'isSealed' | 'removeRetainedBlob'>
-  flushDurableStateOrThrowAsync: () => Promise<void>
-}
-
-async function flushSshPtyConsumerRecovery(
-  operations: SshPtyConsumerRecoveryOperations
-): Promise<void> {
-  // Why: ownership must be durable before relay setup continues, but this runs on the live
-  // establish/reconnect path — a sync flush would park the main thread on a stalled profile mount.
-  // Why not caught here: the failure must reach the awaiting caller.
-  await operations.flushDurableStateOrThrowAsync()
+  runDurableMutation: StoreRuntimeState['runDurableMutation']
 }
 
 export function getSshPtyConsumerRecovery(
@@ -46,24 +38,37 @@ export async function upsertSshPtyConsumerRecovery(
   if (!normalized) {
     throw new Error('Invalid SSH PTY consumer recovery record')
   }
-  const recoveries = operations.state.sshPtyConsumerRecoveries ?? []
-  operations.state.sshPtyConsumerRecoveries = [
-    ...recoveries.filter((candidate) => candidate.targetId !== normalized.targetId),
-    normalized
-  ]
-  await flushSshPtyConsumerRecovery(operations)
+  await operations.runDurableMutation(() => {
+    const recoveries = operations.state.sshPtyConsumerRecoveries ?? []
+    operations.state.sshPtyConsumerRecoveries = [
+      ...recoveries.filter((candidate) => candidate.targetId !== normalized.targetId),
+      normalized
+    ]
+    return { value: undefined }
+  })
 }
 
 export async function removeSshPtyConsumerRecovery(
   operations: SshPtyConsumerRecoveryOperations,
-  targetId: string
+  targetId: string,
+  expectedClientInstanceId?: string
 ): Promise<void> {
-  const recoveries = operations.state.sshPtyConsumerRecoveries ?? []
-  const next = recoveries.filter((record) => record.targetId !== targetId)
-  if (next.length === recoveries.length) {
-    return
+  await operations.runDurableMutation(() => {
+    const recoveries = operations.state.sshPtyConsumerRecoveries ?? []
+    const current = recoveries.find((record) => record.targetId === targetId)
+    if (
+      expectedClientInstanceId !== undefined &&
+      current &&
+      current.clientInstanceId !== expectedClientInstanceId
+    ) {
+      return { value: undefined, persist: false }
+    }
+    operations.state.sshPtyConsumerRecoveries = recoveries.filter(
+      (record) => record.targetId !== targetId
+    )
+    return { value: undefined }
+  })
+  if (!operations.state.sshPtyConsumerRecoveries?.some((record) => record.targetId === targetId)) {
+    operations.protectedSecrets.removeRetainedBlob(sshPtyOwnerLeaseSecretSlot(targetId))
   }
-  operations.state.sshPtyConsumerRecoveries = next
-  operations.protectedSecrets.removeRetainedBlob(sshPtyOwnerLeaseSecretSlot(targetId))
-  await flushSshPtyConsumerRecovery(operations)
 }
diff --git a/src/main/persistence/leasing-ssh-ptys/ssh-pty-lease-operations.ts b/src/main/persistence/leasing-ssh-ptys/ssh-pty-lease-operations.ts
index f06e5b0ece71..b2e3cef030b9 100644
--- a/src/main/persistence/leasing-ssh-ptys/ssh-pty-lease-operations.ts
+++ b/src/main/persistence/leasing-ssh-ptys/ssh-pty-lease-operations.ts
@@ -1,3 +1,4 @@
+import type { StoreRuntimeState } from '../loading-store/store-runtime-state'
 import type { PersistedState } from '../../../shared/persisted-state-types'
 import type { SshRemotePtyLease } from '../../../shared/ssh-types'
 import { isTerminalLeafId } from '../../../shared/stable-pane-id'
@@ -12,7 +13,7 @@ export type SshPtyLeaseOperations = {
   clearBindingsForTarget: (targetId: string) => void
   clearBindingsForLeases: (targetId: string, leases: SshRemotePtyLease[]) => boolean
   flush: () => void
-  flushDurableStateOrThrowAsync: () => Promise<void>
+  runDurableMutation: StoreRuntimeState['runDurableMutation']
 }
 
 /**
@@ -93,7 +94,8 @@ function updateSshRemotePtyLeaseStates(
   operations: SshPtyLeaseOperations,
   targetId: string,
   state: SshRemotePtyLease['state'],
-  ptyIds?: ReadonlySet<string>
+  ptyIds?: ReadonlySet<string>,
+  admittedLeases?: ReadonlySet<SshRemotePtyLease>
 ): boolean {
   const now = Date.now()
   let changed = false
@@ -101,7 +103,11 @@ function updateSshRemotePtyLeaseStates(
   const leasesToClear: SshRemotePtyLease[] = []
   operations.state.sshRemotePtyLeases ??= []
   for (const lease of operations.state.sshRemotePtyLeases) {
-    if (lease.targetId !== targetId || (ptyIds && !ptyIds.has(lease.ptyId))) {
+    if (
+      lease.targetId !== targetId ||
+      (ptyIds && !ptyIds.has(lease.ptyId)) ||
+      (admittedLeases && !admittedLeases.has(lease))
+    ) {
       continue
     }
     if (state === 'attached' && lease.state === 'terminated') {
@@ -179,9 +185,12 @@ export async function markSshRemotePtyLeasesAsync(
   targetId: string,
   state: SshRemotePtyLease['state']
 ): Promise<void> {
-  if (updateSshRemotePtyLeaseStates(operations, targetId, state)) {
-    await operations.flushDurableStateOrThrowAsync()
-  }
+  // A newer connection can replace a lease while this operation waits for the writer.
+  const admittedLeases = new Set(getSshRemotePtyLeases(operations.state, targetId))
+  await operations.runDurableMutation(() => {
+    updateSshRemotePtyLeaseStates(operations, targetId, state, undefined, admittedLeases)
+    return { value: undefined }
+  })
 }
 
 export async function markSshRemotePtyLeasesAttachedAsync(
@@ -190,9 +199,12 @@ export async function markSshRemotePtyLeasesAttachedAsync(
   ptyIds: readonly string[]
 ): Promise<void> {
   const relayPtyIds = new Set(ptyIds.map((ptyId) => operations.toStoredPtyId(targetId, ptyId)))
-  if (updateSshRemotePtyLeaseStates(operations, targetId, 'attached', relayPtyIds)) {
-    await operations.flushDurableStateOrThrowAsync()
-  }
+  // A newer connection can replace a lease while this operation waits for the writer.
+  const admittedLeases = new Set(getSshRemotePtyLeases(operations.state, targetId))
+  await operations.runDurableMutation(() => {
+    updateSshRemotePtyLeaseStates(operations, targetId, 'attached', relayPtyIds, admittedLeases)
+    return { value: undefined }
+  })
 }
 
 /** `relayIdRecycled` is the pending-stop replay's evidence that the host now lists this id under a
diff --git a/src/main/persistence/loading-store/automation-persistence.ts b/src/main/persistence/loading-store/automation-persistence.ts
index 2bed89ff09b9..64abd8ed2a9b 100644
--- a/src/main/persistence/loading-store/automation-persistence.ts
+++ b/src/main/persistence/loading-store/automation-persistence.ts
@@ -53,7 +53,11 @@ import type { ProfilePreferences } from './profile-preferences'
 
 type AutomationPersistenceRuntime = Pick<
   StoreRuntimeState,
-  'automationListProjectionCache' | 'state' | 'storageAuthority'
+  | 'automationListProjectionCache'
+  | 'dirtyProfileStateDomains'
+  | 'pendingAutomationRunsAfter'
+  | 'state'
+  | 'storageAuthority'
 >
 
 const automationPersistenceContext = Symbol('AutomationPersistence')
@@ -195,7 +199,10 @@ export class AutomationPersistence {
   advanceAutomationNextRun(id: string, now = Date.now()): Automation {
     return advanceAutomationNextRunOperation(
       this[automationPersistenceContext].runtime.state,
-      () => this[automationPersistenceContext].flushBarriers.flush(),
+      () => {
+        markAutomationDefinitionDomain(this)
+        this[automationPersistenceContext].flushBarriers.flush()
+      },
       id,
       now
     )
@@ -212,16 +219,31 @@ export function getAutomationDefinitionOperations(
   return {
     state: owner[automationPersistenceContext].runtime.state,
     storageAuthority: owner[automationPersistenceContext].runtime.storageAuthority,
-    flush: () => owner[automationPersistenceContext].flushBarriers.flush(),
+    flush: () => {
+      markAutomationDefinitionDomain(owner)
+      owner[automationPersistenceContext].flushBarriers.flush()
+    },
     recordCreated: () =>
-      owner[automationPersistenceContext].preferences.recordFeatureInteraction('automation-created')
+      owner[automationPersistenceContext].preferences.recordFeatureInteraction(
+        'automation-created'
+      ),
+    recordAutomationRunsMutation: (runs) => {
+      owner[automationPersistenceContext].runtime.pendingAutomationRunsAfter = runs
+      owner[automationPersistenceContext].runtime.dirtyProfileStateDomains?.add('automationRuns')
+    }
   }
 }
 
 export function getAutomationRunOperations(owner: AutomationPersistence): AutomationRunOperations {
   return {
     state: owner[automationPersistenceContext].runtime.state,
-    flush: () => owner[automationPersistenceContext].flushBarriers.flush(),
+    flush: () => {
+      markAutomationDomains(owner)
+      owner[automationPersistenceContext].flushBarriers.flush()
+    },
+    recordAutomationRunsMutation: (runs) => {
+      owner[automationPersistenceContext].runtime.pendingAutomationRunsAfter = runs
+    },
     recordManualRun: () =>
       owner[automationPersistenceContext].preferences.recordFeatureInteraction('automation-run'),
     getWorkspaceDisplayName: (workspaceId) =>
@@ -242,6 +264,18 @@ export function getAutomationRunWorkspaceDisplayName(
   )
 }
 
+function markAutomationDomains(owner: AutomationPersistence): void {
+  const dirtyDomains = owner[automationPersistenceContext].runtime.dirtyProfileStateDomains
+  if (dirtyDomains !== null) {
+    dirtyDomains.add('automations')
+    dirtyDomains.add('automationRuns')
+  }
+}
+
+function markAutomationDefinitionDomain(owner: AutomationPersistence): void {
+  owner[automationPersistenceContext].runtime.dirtyProfileStateDomains?.add('automations')
+}
+
 export function installAutomationPersistenceContext(
   target: AutomationPersistence,
   source: AutomationPersistence
diff --git a/src/main/persistence/loading-store/backup-recovery-rotation.ts b/src/main/persistence/loading-store/backup-recovery-rotation.ts
deleted file mode 100644
index 7cf0a7a80781..000000000000
--- a/src/main/persistence/loading-store/backup-recovery-rotation.ts
+++ /dev/null
@@ -1,147 +0,0 @@
-import {
-  copyFileSync,
-  existsSync,
-  mkdirSync,
-  readFileSync,
-  renameSync,
-  statSync,
-  unlinkSync,
-  writeFileSync
-} from 'node:fs'
-import { access, copyFile, rename, rm, stat } from 'node:fs/promises'
-import { dirname } from 'node:path'
-
-const BACKUP_COUNT = 5
-const BACKUP_MIN_INTERVAL_MS = 60 * 60 * 1000
-
-function backupPath(dataFile: string, index: number): string {
-  return `${dataFile}.bak.${index}`
-}
-
-/** existsSync's non-blocking twin: existsSync is an access(F_OK) probe, so access() is the exact analogue. */
-async function exists(path: string): Promise<boolean> {
-  return access(path).then(
-    () => true,
-    () => false
-  )
-}
-
-export function hasStateBackup(dataFile: string): boolean {
-  for (let index = 0; index < BACKUP_COUNT; index += 1) {
-    if (existsSync(backupPath(dataFile, index))) {
-      return true
-    }
-  }
-  return false
-}
-
-import type { StoreRuntimeState } from './store-runtime-state'
-
-type BackupRecoveryRotationOperationsRuntime = Pick<StoreRuntimeState, 'backupRotationInFlight'>
-
-export class BackupRecoveryRotationOperations {
-  constructor(private readonly runtime: BackupRecoveryRotationOperationsRuntime) {}
-
-  shouldRotateBackups(now: number, dataFile: string): boolean {
-    try {
-      const mtime = statSync(backupPath(dataFile, 0)).mtimeMs
-      return now - mtime >= BACKUP_MIN_INTERVAL_MS
-    } catch {
-      return true
-    }
-  }
-
-  async shouldRotateBackupsAsync(dataFile: string): Promise<boolean> {
-    try {
-      const mtime = (await stat(backupPath(dataFile, 0))).mtimeMs
-      return Date.now() - mtime >= BACKUP_MIN_INTERVAL_MS
-    } catch {
-      return true
-    }
-  }
-
-  async rotateBackupsAsync(dataFile: string): Promise<void> {
-    if (this.runtime.backupRotationInFlight) {
-      return
-    }
-    this.runtime.backupRotationInFlight = true
-    try {
-      if (!(await this.shouldRotateBackupsAsync(dataFile))) {
-        return
-      }
-      if (!(await exists(dataFile))) {
-        return
-      }
-      await rm(backupPath(dataFile, BACKUP_COUNT - 1)).catch((err: unknown) => {
-        if (err && (err as NodeJS.ErrnoException).code !== 'ENOENT') {
-          console.error('[persistence] Failed to remove oldest backup:', err)
-        }
-      })
-      for (let i = BACKUP_COUNT - 2; i >= 0; i--) {
-        const src = backupPath(dataFile, i)
-        const dst = backupPath(dataFile, i + 1)
-        // Why probe instead of rename-then-swallow-ENOENT: a degraded mount rejects a rename of an
-        // absent slot with ESTALE/EIO, which would log once per empty slot on every debounced save.
-        if (await exists(src)) {
-          await rename(src, dst).catch((err) => {
-            console.error('[persistence] Failed to rotate backup', src, '->', dst, err)
-          })
-        }
-      }
-      await copyFile(dataFile, backupPath(dataFile, 0)).catch((err) => {
-        console.error('[persistence] Failed to snapshot current file to .bak.0:', err)
-      })
-    } finally {
-      this.runtime.backupRotationInFlight = false
-    }
-  }
-
-  rotateBackupsSync(dataFile: string): void {
-    if (!existsSync(dataFile)) {
-      return
-    }
-    try {
-      unlinkSync(backupPath(dataFile, BACKUP_COUNT - 1))
-    } catch (err) {
-      if (err && (err as NodeJS.ErrnoException).code !== 'ENOENT') {
-        console.error('[persistence] Failed to remove oldest backup:', err)
-      }
-    }
-    for (let i = BACKUP_COUNT - 2; i >= 0; i--) {
-      const src = backupPath(dataFile, i)
-      const dst = backupPath(dataFile, i + 1)
-      if (existsSync(src)) {
-        try {
-          renameSync(src, dst)
-        } catch (err) {
-          console.error('[persistence] Failed to rotate backup', src, '->', dst, err)
-        }
-      }
-    }
-    try {
-      copyFileSync(dataFile, backupPath(dataFile, 0))
-    } catch (err) {
-      console.error('[persistence] Failed to snapshot current file to .bak.0:', err)
-    }
-  }
-
-  restoreFromBackup(dataFile: string): boolean {
-    for (let i = 0; i < BACKUP_COUNT; i++) {
-      const path = backupPath(dataFile, i)
-      if (!existsSync(path)) {
-        continue
-      }
-      try {
-        const raw = readFileSync(path, 'utf-8')
-        JSON.parse(raw)
-        mkdirSync(dirname(dataFile), { recursive: true })
-        writeFileSync(dataFile, raw, 'utf-8')
-        console.warn(`[persistence] Recovered state from backup slot ${i}: ${path}`)
-        return true
-      } catch (err) {
-        console.error(`[persistence] Backup slot ${i} unusable, trying next:`, err)
-      }
-    }
-    return false
-  }
-}
diff --git a/src/main/persistence/loading-store/loaded-state-parsing.ts b/src/main/persistence/loading-store/loaded-state-parsing.ts
index d2a31419a039..b93dc2515001 100644
--- a/src/main/persistence/loading-store/loaded-state-parsing.ts
+++ b/src/main/persistence/loading-store/loaded-state-parsing.ts
@@ -1,4 +1,3 @@
-import { readFileSync, existsSync } from 'node:fs'
 import { homedir } from 'node:os'
 import { normalizeProxyUrl } from '../../../shared/network-proxy'
 import { normalizeKagiSessionLink } from '../../../shared/browser-url'
@@ -9,10 +8,7 @@ import { pruneLocalTerminalScrollbackBuffers } from '../../../shared/workspace-s
 import { pruneWorkspaceSessionBrowserHistory } from '../../../shared/workspace-session-browser-history'
 import { clearMissingProjectGroupMemberships } from '../../../shared/project-groups'
 import { migrateWorkspaceSessionTerminalScrollbackSnapshots } from '../../terminal-scrollback-snapshots'
-import {
-  isStartupDiagnosticsEnabled,
-  logStartupDiagnostic
-} from '../../startup/startup-diagnostics'
+import { logStartupMilestone } from '../../startup/startup-diagnostics'
 import {
   PROTECTED_SECRET_SLOT,
   sshPtyOwnerLeaseSecretSlot
@@ -38,28 +34,11 @@ import {
   projectHostSetupCompatibilityStateEqual
 } from '../tracking-repos/project-host-compatibility'
 import { backfillFolderScopeConnectionIds } from '../restoring-sessions/folder-scope-migration'
-import { hasStateBackup } from './backup-recovery-rotation'
 import { prepareLoadedTerminalSettings } from './prepare-loaded-terminal-settings'
 import { prepareLoadedProfileSettings } from './prepare-loaded-profile-settings'
 import { normalizeLoadedProfileState } from './normalize-loaded-profile-state'
 
-type PersistenceStartupDetails = Record<string, unknown> | (() => Record<string, unknown>)
-
-function logPersistenceStartupMilestone(
-  event: string,
-  details: PersistenceStartupDetails = {}
-): void {
-  if (!isStartupDiagnosticsEnabled()) {
-    return
-  }
-  // Why: snapshot `t` before resolving lazy details — otherwise an expensive details closure is billed to the milestone it measures.
-  const t = Math.round(performance.now())
-  const resolvedDetails = typeof details === 'function' ? details() : details
-  logStartupDiagnostic(event, { t, ...resolvedDetails })
-}
-
 import type { StoreRuntimeState } from './store-runtime-state'
-import type { BackupRecoveryRotationOperations } from './backup-recovery-rotation'
 import type { LoadedCohortMigrationOperations } from './loaded-cohort-migrations'
 
 type LoadedStateParsingOperationsRuntime = Pick<
@@ -75,31 +54,57 @@ type LoadedStateParsingOperationsRuntime = Pick<
 export class LoadedStateParsingOperations {
   constructor(
     private readonly runtime: LoadedStateParsingOperationsRuntime,
-    private readonly backups: BackupRecoveryRotationOperations,
     private readonly cohorts: LoadedCohortMigrationOperations
   ) {}
 
-  load(allowBackupRecovery = true): PersistedState {
+  /**
+   * Load the legacy storage representation supplied by a migration/importer.
+   *
+   * This deliberately uses the same decrypt, normalization, migration, and
+   * sidecar handling as a file load. An invalid imported document must fail
+   * closed instead of falling back to an unrelated on-disk backup.
+   */
+  loadSerialized(raw: string): PersistedState {
+    return this.loadInternal(raw)
+  }
+
+  /** Load only from an injected authority; never consult the legacy JSON path. */
+  loadFromAuthority(raw: string | undefined): PersistedState {
+    return this.loadInternal(raw)
+  }
+
+  loadParsedFromAuthority(parsed: Record<string, unknown> | undefined): PersistedState {
+    return this.loadInternal(undefined, parsed)
+  }
+
+  private loadInternal(serialized?: string, parsedInput?: Record<string, unknown>): PersistedState {
     // Capture "has run Orca before?" for telemetry cohort; the telemetry field is new, so field inference misclassifies old users as fresh.
-    const dataFile = this.runtime.dataFile
-    const fileExistedOnLoad = existsSync(dataFile)
-    logPersistenceStartupMilestone('persistence-load-start', {
+    const fileExistedOnLoad = serialized !== undefined || parsedInput !== undefined
+    logStartupMilestone('persistence-load-start', {
       fileExists: fileExistedOnLoad
     })
 
     let result: PersistedState | null = null
+    let parsed: PersistedState | undefined
     try {
       if (fileExistedOnLoad) {
         const readStartedAt = performance.now()
-        const raw = readFileSync(dataFile, 'utf-8')
-        logPersistenceStartupMilestone('persistence-read-done', {
-          bytes: Buffer.byteLength(raw),
-          durationMs: Math.round(performance.now() - readStartedAt)
-        })
-        logPersistenceStartupMilestone('persistence-json-parse-start')
-        const parsed = JSON.parse(raw) as PersistedState
-        logPersistenceStartupMilestone('persistence-json-parse-done')
-
+        const raw = parsedInput === undefined ? serialized : undefined
+        if (raw !== undefined) {
+          logStartupMilestone('persistence-read-done', {
+            bytes: Buffer.byteLength(raw),
+            durationMs: Math.round(performance.now() - readStartedAt)
+          })
+          logStartupMilestone('persistence-json-parse-start')
+          parsed = JSON.parse(raw)
+          logStartupMilestone('persistence-json-parse-done')
+        } else {
+          // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Legacy partial records enter the existing domain normalizers through this loader type.
+          parsed = parsedInput as PersistedState
+        }
+        if (parsed === undefined) {
+          throw new Error('Profile state startup snapshot is missing')
+        }
         // Why: secrets are stored encrypted via safeStorage; decrypt at the load boundary so the app sees plaintext.
         if (parsed.settings?.opencodeSessionCookie) {
           parsed.settings.opencodeSessionCookie = this.runtime.protectedSecrets.decrypt(
@@ -188,18 +193,8 @@ export class LoadedStateParsingOperations {
         })
       }
     } catch (err) {
-      console.error('[persistence] Failed to load primary state, trying backups:', err)
-    }
-
-    // Corrupt-file and no-file paths converge here; a corrupted install counts as existing, so it sees the opt-in banner.
-    if (result === null && allowBackupRecovery) {
-      const hasBackup = hasStateBackup(dataFile)
-      if (fileExistedOnLoad || hasBackup) {
-        if (this.backups.restoreFromBackup(dataFile)) {
-          return this.load(false)
-        }
-        console.error('[persistence] No usable state file or backup found, using defaults')
-      }
+      console.error('[persistence] Failed to load imported profile state:', err)
+      throw new Error('Failed to load imported profile state', { cause: err })
     }
 
     if (result === null) {
@@ -216,7 +211,6 @@ export class LoadedStateParsingOperations {
     if (migratedScrollback.changed) {
       this.runtime.loadNeedsSave = true
     }
-
     const repos = clearMissingProjectGroupMemberships(result.repos, result.projectGroups ?? [])
     const projectHostSetupCompatibility = mergeProjectHostSetupCompatibilityState(result, repos)
     if (!projectHostSetupCompatibilityStateEqual(result, projectHostSetupCompatibility)) {
@@ -293,7 +287,7 @@ export class LoadedStateParsingOperations {
       migrated.githubCache = readGithubCacheSnapshot(this.runtime.dataFile) ?? migrated.githubCache
     }
 
-    logPersistenceStartupMilestone('persistence-load-done', () => ({
+    logStartupMilestone('persistence-load-done', () => ({
       repos: migrated.repos.length,
       workspaceSessionBytes: Buffer.byteLength(JSON.stringify(migrated.workspaceSession))
     }))
diff --git a/src/main/persistence/loading-store/metadata-lineage-operations.ts b/src/main/persistence/loading-store/metadata-lineage-operations.ts
index 2532ff3b2d3e..9800b541373a 100644
--- a/src/main/persistence/loading-store/metadata-lineage-operations.ts
+++ b/src/main/persistence/loading-store/metadata-lineage-operations.ts
@@ -27,7 +27,8 @@ import {
   getWorktreeMetaForHost as getWorktreeMetaForHostOperation,
   migrateWorktreeMetadataLocator,
   removeWorktreeMetadataForHost,
-  setWorktreeMetaForHost as setWorktreeMetaForHostOperation
+  setWorktreeMetaForHost as setWorktreeMetaForHostOperation,
+  WORKTREE_METADATA_DOMAINS
 } from './worktree-identity-metadata'
 import { mergeWorktreeMetaForWrite } from './worktree-meta-write-normalization'
 import {
@@ -122,7 +123,7 @@ export class MetadataLineageOperations {
     }
     const updated = mergeWorktreeMetaForWrite(stored, meta)
     state.worktreeMeta[worktreeId] = updated
-    scheduleSave(this[metadataLineageOperationsContext].scheduling)
+    scheduleSave(this[metadataLineageOperationsContext].scheduling, ['worktreeMeta'])
     return updated
   }
 
@@ -269,7 +270,11 @@ export class MetadataLineageOperations {
       mover
     )
     if (legacyChanged || canonicalChanged) {
-      scheduleSave(this[metadataLineageOperationsContext].scheduling)
+      // Legacy identity moves also re-key sessions, lineage, mobile selections, and UI state.
+      scheduleSave(
+        this[metadataLineageOperationsContext].scheduling,
+        legacyChanged ? undefined : WORKTREE_METADATA_DOMAINS
+      )
     }
   }
 
diff --git a/src/main/persistence/loading-store/persisted-state-redundancy.test.ts b/src/main/persistence/loading-store/persisted-state-redundancy.test.ts
index 9a30b26da388..8b9414f4fb8d 100644
--- a/src/main/persistence/loading-store/persisted-state-redundancy.test.ts
+++ b/src/main/persistence/loading-store/persisted-state-redundancy.test.ts
@@ -1,3 +1,8 @@
+import {
+  closeTestStores,
+  createSqliteTestStore,
+  readPersistedStateJson
+} from '../../persistence-test-harness'
 /**
  * The store file re-serializes in full on a 1s debounce and re-parses in full at launch, so every
  * byte it carries is paid for on both. Two kinds of byte were provably redundant on a 4.2 MB real
@@ -8,7 +13,7 @@
  * rows, 200 browser history entries) and pin the only property that makes the omission safe: a file
  * written by the OLD serializer and a file written by the NEW one load to the same in-memory state.
  */
-import { mkdtempSync, readFileSync, realpathSync, writeFileSync } from 'node:fs'
+import { mkdtempSync, realpathSync, writeFileSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, describe, expect, it, vi } from 'vitest'
@@ -48,15 +53,16 @@ const LINKED_ROW_STRIDE = 40
 const RECENTLY = Date.now()
 
 const stores: InstanceType<typeof Store>[] = []
-afterEach(() => {
+afterEach(async () => {
   for (const store of stores.splice(0)) {
     store.freezeWrites()
   }
+  await closeTestStores()
   vi.restoreAllMocks()
 })
 
 function openStore(dataFile: string): InstanceType<typeof Store> {
-  const store = new Store({ dataFile })
+  const store = createSqliteTestStore(Store, { dataFile })
   stores.push(store)
   return store
 }
@@ -191,7 +197,7 @@ describe('persisted-state redundancy', () => {
     }
 
     loaded.flush()
-    const rewritten = readFileSync(dataFile, 'utf-8')
+    const rewritten = readPersistedStateJson(dataFile)
 
     // Only rows that actually hold a value still carry a slot: linkedPR + isPinned, 1 row in 40.
     expect(defaultedSlotOccurrences(rewritten)).toBe(
@@ -220,7 +226,7 @@ describe('persisted-state redundancy', () => {
 
     // A quiet app does not rewrite the file with new content on the next flush.
     reloaded.flush()
-    expect(readFileSync(dataFile, 'utf-8')).toBe(rewritten)
+    expect(readPersistedStateJson(dataFile)).toBe(rewritten)
   })
 
   it('loads an old-serializer file and a new-serializer file to the same state', () => {
@@ -231,7 +237,7 @@ describe('persisted-state redundancy', () => {
     fromLegacy.flush()
 
     const compactFile = tempDataFile()
-    writeFileSync(compactFile, readFileSync(legacyFile))
+    writeFileSync(compactFile, readPersistedStateJson(legacyFile))
     const fromCompact = openStore(compactFile)
 
     expect(fromCompact.getAllWorktreeMeta()).toEqual(fromLegacy.getAllWorktreeMeta())
diff --git a/src/main/persistence/loading-store/primary-state-write-context.ts b/src/main/persistence/loading-store/primary-state-write-context.ts
new file mode 100644
index 000000000000..bd7fbc737cb4
--- /dev/null
+++ b/src/main/persistence/loading-store/primary-state-write-context.ts
@@ -0,0 +1,15 @@
+import type { PrimaryStateWriteOperationsRuntime } from './primary-state-write-runtime'
+import type { StateSerializationSecretHandlingOperations } from './state-serialization-secret-handling'
+
+export type PrimaryStateWriteOperationsContext = {
+  runtime: PrimaryStateWriteOperationsRuntime
+  serialization: StateSerializationSecretHandlingOperations
+  queuedSnapshot?: {
+    completion: Promise<void>
+    capture: {
+      skipIfClean: boolean
+      fullCheckpoint: boolean
+      pendingSnapshotFileWork: Promise<void> | null
+    }
+  }
+}
diff --git a/src/main/persistence/loading-store/primary-state-write-runtime.ts b/src/main/persistence/loading-store/primary-state-write-runtime.ts
new file mode 100644
index 000000000000..b538831a9959
--- /dev/null
+++ b/src/main/persistence/loading-store/primary-state-write-runtime.ts
@@ -0,0 +1,66 @@
+import type { StoreRuntimeState } from './store-runtime-state'
+
+export type PrimaryStateWriteOperationsRuntime = Pick<
+  StoreRuntimeState,
+  | 'activeViewPreference'
+  | 'dataFile'
+  | 'dirtyProfileStateDomains'
+  | 'durableMutationPhase'
+  | 'fatalMutationError'
+  | 'flushOrThrow'
+  | 'runDurableMutation'
+  | 'firstPendingSaveAt'
+  | 'lastDurableWriteGeneration'
+  | 'lastWrittenStateHash'
+  | 'pendingSnapshotFileWork'
+  | 'pendingAutomationRunsAfter'
+  | 'pendingWrite'
+  | 'profileMaintenancePending'
+  | 'profileStateAuthority'
+  | 'protectedSecrets'
+  | 'quitFlushStarted'
+  | 'state'
+  | 'writeGeneration'
+  | 'writeTimer'
+  | 'writesFrozen'
+>
+
+export function markPrimaryStateWriteDurable(
+  runtime: Pick<StoreRuntimeState, 'lastDurableWriteGeneration'>,
+  generation: number
+): void {
+  runtime.lastDurableWriteGeneration = Math.max(runtime.lastDurableWriteGeneration, generation)
+}
+
+export function canReuseDurableProfileState(
+  runtime: Pick<StoreRuntimeState, 'lastWrittenStateHash' | 'profileStateAuthority'>,
+  stateHash: string
+): boolean {
+  if (stateHash !== runtime.lastWrittenStateHash) {
+    return false
+  }
+  const authority = runtime.profileStateAuthority
+  if (authority?.asynchronous) {
+    throw new Error('Live profile persistence requires an awaited revision check')
+  }
+  if (authority && !authority.assertCurrentRevision) {
+    return false
+  }
+  authority?.assertCurrentRevision?.()
+  return true
+}
+
+export async function stopAfterFailedPrimaryStateMutation(
+  runtime: PrimaryStateWriteOperationsRuntime,
+  error: unknown
+): Promise<void> {
+  // A throwing callback never returns its rollback; do not persist a partial edit.
+  runtime.writesFrozen = true
+  runtime.quitFlushStarted = true
+  runtime.fatalMutationError = error instanceof Error ? error : new Error(String(error))
+  if (runtime.writeTimer) {
+    clearTimeout(runtime.writeTimer)
+    runtime.writeTimer = null
+  }
+  await runtime.profileStateAuthority?.close?.()
+}
diff --git a/src/main/persistence/loading-store/primary-state-write-sync.ts b/src/main/persistence/loading-store/primary-state-write-sync.ts
new file mode 100644
index 000000000000..c1e8480063d4
--- /dev/null
+++ b/src/main/persistence/loading-store/primary-state-write-sync.ts
@@ -0,0 +1,80 @@
+import { writeSelectiveProfileState } from './profile-state-selective-write'
+import type { PrimaryStateWriteOperationsContext } from './primary-state-write-context'
+import {
+  canReuseDurableProfileState,
+  markPrimaryStateWriteDurable
+} from './primary-state-write-runtime'
+
+export function writeToDiskSync(
+  context: PrimaryStateWriteOperationsContext,
+  opts: { expectedGeneration?: number } = {}
+): boolean {
+  const { runtime, serialization } = context
+  if (runtime.fatalMutationError) {
+    throw runtime.fatalMutationError
+  }
+  if (runtime.writesFrozen) {
+    return false
+  }
+  const authority = runtime.profileStateAuthority
+  if (!authority) {
+    throw new Error('Writable Store construction requires a SQLite profile-state authority')
+  }
+  if (authority.asynchronous) {
+    throw new Error('Live profile persistence requires an awaited flush')
+  }
+  const isCurrent =
+    opts.expectedGeneration === undefined
+      ? undefined
+      : () => runtime.writeGeneration === opts.expectedGeneration
+  const selective = writeSelectiveProfileState(
+    authority,
+    serialization,
+    runtime.dirtyProfileStateDomains,
+    runtime.pendingAutomationRunsAfter,
+    isCurrent
+  )
+  if (selective.handled) {
+    if (selective.aborted) {
+      return false
+    }
+    if (selective.consumedAutomationRuns) {
+      runtime.pendingAutomationRunsAfter = undefined
+    }
+    runtime.lastWrittenStateHash = null
+    runtime.protectedSecrets.commitRetentionUpdates(selective.protectedSecretUpdates)
+    markPrimaryStateWriteDurable(runtime, opts.expectedGeneration ?? runtime.writeGeneration)
+    authority.scheduleBackup?.()
+    return true
+  }
+  const built = serialization.buildStateToSave(
+    authority.writeCompleteSerializedDomains !== undefined
+  )
+  const { stateHash, protectedSecretUpdates } = built
+  if (isCurrent && !isCurrent()) {
+    return false
+  }
+  // The authority fences the revision even when the complete state is unchanged.
+  if (canReuseDurableProfileState(runtime, stateHash)) {
+    runtime.dirtyProfileStateDomains = new Set()
+    runtime.pendingAutomationRunsAfter = undefined
+    markPrimaryStateWriteDurable(runtime, opts.expectedGeneration ?? runtime.writeGeneration)
+    return true
+  }
+  if (built.domains && authority.writeCompleteSerializedDomains) {
+    authority.writeCompleteSerializedDomains(built.domains)
+  } else {
+    authority.writeSerializedState(built.payload)
+  }
+  runtime.dirtyProfileStateDomains = new Set()
+  runtime.pendingAutomationRunsAfter = undefined
+  if (!isCurrent || isCurrent()) {
+    runtime.lastWrittenStateHash = stateHash
+    runtime.protectedSecrets.commitRetentionUpdates(protectedSecretUpdates)
+  } else {
+    runtime.lastWrittenStateHash = null
+  }
+  markPrimaryStateWriteDurable(runtime, opts.expectedGeneration ?? runtime.writeGeneration)
+  authority.scheduleBackup?.()
+  return true
+}
diff --git a/src/main/persistence/loading-store/primary-state-write-worker.ts b/src/main/persistence/loading-store/primary-state-write-worker.ts
new file mode 100644
index 000000000000..71862bc3b443
--- /dev/null
+++ b/src/main/persistence/loading-store/primary-state-write-worker.ts
@@ -0,0 +1,106 @@
+import type { AsyncProfileStateAuthority } from './profile-state-authority'
+import type { PrimaryStateWriteOperationsContext } from './primary-state-write-context'
+import { markPrimaryStateWriteDurable } from './primary-state-write-runtime'
+import { prepareSelectiveProfileStateWrite } from './profile-state-selective-write'
+
+/** The queued operation owns its captured intent; later edits belong to the next write. */
+export async function writeProfileStateInWorker(
+  { runtime, serialization }: PrimaryStateWriteOperationsContext,
+  authority: AsyncProfileStateAuthority
+): Promise<boolean> {
+  authority.assertWritable()
+  const generation = runtime.writeGeneration
+  const dirtyDomains = runtime.dirtyProfileStateDomains
+  const automationRuns = runtime.pendingAutomationRunsAfter
+  runtime.dirtyProfileStateDomains = new Set()
+  runtime.pendingAutomationRunsAfter = undefined
+
+  const restoreIntent = (): void => {
+    if (dirtyDomains === null) {
+      runtime.dirtyProfileStateDomains = null
+    } else if (runtime.dirtyProfileStateDomains !== null) {
+      for (const domain of dirtyDomains) {
+        runtime.dirtyProfileStateDomains.add(domain)
+      }
+    }
+    runtime.pendingAutomationRunsAfter ??= automationRuns
+  }
+
+  try {
+    const prepared = beginWrite(
+      authority,
+      serialization,
+      dirtyDomains,
+      automationRuns,
+      runtime.lastWrittenStateHash,
+      () => runtime.writeGeneration === generation
+    )
+    if (!prepared) {
+      restoreIntent()
+      return false
+    }
+    await prepared.completion
+    runtime.protectedSecrets.commitRetentionUpdates(prepared.protectedSecretUpdates)
+    runtime.lastWrittenStateHash =
+      runtime.writeGeneration === generation ? prepared.stateHash : null
+    markPrimaryStateWriteDurable(runtime, generation)
+    if (runtime.writeGeneration === generation) {
+      if (runtime.writeTimer) {
+        clearTimeout(runtime.writeTimer)
+        runtime.writeTimer = null
+      }
+      runtime.firstPendingSaveAt = null
+    }
+  } catch (error) {
+    restoreIntent()
+    throw error
+  }
+  try {
+    authority.scheduleBackup?.()
+  } catch (error) {
+    console.error('[persistence] Failed to schedule profile state backup:', error)
+  }
+  return true
+}
+
+/** Release copied payloads before the acknowledgement; retain only commit bookkeeping. */
+function beginWrite(
+  authority: AsyncProfileStateAuthority,
+  serialization: PrimaryStateWriteOperationsContext['serialization'],
+  dirtyDomains: ReadonlySet<string> | null,
+  automationRuns: PrimaryStateWriteOperationsContext['runtime']['pendingAutomationRunsAfter'],
+  lastWrittenStateHash: string | null,
+  isCurrent: () => boolean
+) {
+  const selective = prepareSelectiveProfileStateWrite(
+    authority,
+    serialization,
+    dirtyDomains,
+    automationRuns
+  )
+  if (selective) {
+    if (!isCurrent()) {
+      return undefined
+    }
+    const completion =
+      selective.automationRuns !== undefined
+        ? authority.writeSerializedAutomationRuns(selective.replacements, selective.automationRuns)
+        : authority.writeSerializedDomains(selective.replacements)
+    return { completion, stateHash: null, protectedSecretUpdates: selective.protectedSecretUpdates }
+  }
+  const complete = serialization.buildStateToSave(true)
+  if (!isCurrent()) {
+    return undefined
+  }
+  const unchanged = complete.stateHash === lastWrittenStateHash
+  const completion = unchanged
+    ? authority.assertCurrentRevision()
+    : complete.domains
+      ? authority.writeCompleteSerializedDomains(complete.domains)
+      : authority.writeSerializedState(complete.payload)
+  return {
+    completion,
+    stateHash: complete.stateHash,
+    protectedSecretUpdates: unchanged ? [] : complete.protectedSecretUpdates
+  }
+}
diff --git a/src/main/persistence/loading-store/primary-state-writes.ts b/src/main/persistence/loading-store/primary-state-writes.ts
index 3820723fffbb..014cda309582 100644
--- a/src/main/persistence/loading-store/primary-state-writes.ts
+++ b/src/main/persistence/loading-store/primary-state-writes.ts
@@ -1,88 +1,116 @@
-import { mkdirSync, existsSync, unlinkSync } from 'node:fs'
-import { mkdir, open, rm } from 'node:fs/promises'
-import { durableWriteTempPath, renameDurable, writeFileDurableSync } from '../../durable-file-write'
-import { dirname } from 'node:path'
+import { waitForPromiseWithSignal } from '../../../shared/abort-signal-reason'
 import {
   parseCodexResetCreditAttemptLedger,
   type CodexResetCreditAttemptLedger
 } from '../../../shared/codex-reset-credit-attempt-ledger'
-
-import type { StoreRuntimeState } from './store-runtime-state'
+import {
+  stopAfterFailedPrimaryStateMutation,
+  type PrimaryStateWriteOperationsRuntime
+} from './primary-state-write-runtime'
 import type { StateSerializationSecretHandlingOperations } from './state-serialization-secret-handling'
-import type { BackupRecoveryRotationOperations } from './backup-recovery-rotation'
-
-type PrimaryStateWriteOperationsRuntime = Pick<
-  StoreRuntimeState,
-  | 'activeViewPreference'
-  | 'backupRotationInFlight'
-  | 'dataFile'
-  | 'flushOrThrow'
-  | 'firstPendingSaveAt'
-  | 'inFlightAsyncTmpFile'
-  | 'lastDurableWriteGeneration'
-  | 'lastWrittenStateHash'
-  | 'pendingSnapshotFileWork'
-  | 'pendingWrite'
-  | 'protectedSecrets'
-  | 'quitFlushStarted'
-  | 'staleTempCleanup'
-  | 'state'
-  | 'writeGeneration'
-  | 'writeTimer'
-  | 'writesFrozen'
->
+import type { PrimaryStateWriteOperationsContext } from './primary-state-write-context'
+import { writeToDiskSync } from './primary-state-write-sync'
+import { writeProfileStateInWorker } from './primary-state-write-worker'
+import type { DurableProfileStateMutation } from './store-runtime-state'
+import { profileStateWriterFailureOutcome } from '../profile-state/profile-state-writer-errors'
 
 const primaryStateWriteOperationsContext = Symbol('PrimaryStateWriteOperations')
-type PrimaryStateWriteOperationsContext = {
-  runtime: PrimaryStateWriteOperationsRuntime
-  serialization: StateSerializationSecretHandlingOperations
-  backups: BackupRecoveryRotationOperations
-}
-
 export class PrimaryStateWriteOperations {
   readonly [primaryStateWriteOperationsContext]: PrimaryStateWriteOperationsContext
 
   constructor(
     runtime: PrimaryStateWriteOperationsRuntime,
-    serialization: StateSerializationSecretHandlingOperations,
-    backups: BackupRecoveryRotationOperations
+    serialization: StateSerializationSecretHandlingOperations
   ) {
-    this[primaryStateWriteOperationsContext] = { runtime, serialization, backups }
+    this[primaryStateWriteOperationsContext] = { runtime, serialization }
   }
 
   flushOrThrow(): void {
-    if (this[primaryStateWriteOperationsContext].runtime.quitFlushStarted) {
+    const context = this[primaryStateWriteOperationsContext]
+    const { runtime } = context
+    if (runtime.quitFlushStarted || runtime.profileMaintenancePending) {
       throw new Error('Cannot synchronously flush after final persistence has started')
     }
-    if (this[primaryStateWriteOperationsContext].runtime.writeTimer) {
-      clearTimeout(this[primaryStateWriteOperationsContext].runtime.writeTimer)
-      this[primaryStateWriteOperationsContext].runtime.writeTimer = null
+    if (runtime.profileStateAuthority?.asynchronous) {
+      throw new Error('Live profile persistence requires an awaited flush')
+    }
+    if (runtime.writeTimer) {
+      clearTimeout(runtime.writeTimer)
+      runtime.writeTimer = null
+    }
+    runtime.firstPendingSaveAt = null
+    runtime.writeGeneration++
+    writeToDiskSync(context)
+  }
+
+  flushActiveViewPreferenceOrThrow(): void {
+    if (this[primaryStateWriteOperationsContext].runtime.profileMaintenancePending) {
+      throw new Error('Cannot flush active-view persistence during profile maintenance')
+    }
+    this[primaryStateWriteOperationsContext].runtime.activeViewPreference.flushOrThrow()
+  }
+
+  /** Expected refusals return persist: false; thrown callbacks stop saving to protect partial state. */
+  runDurableMutation<T>(mutate: () => DurableProfileStateMutation<T>): Promise<T> {
+    const { runtime } = this[primaryStateWriteOperationsContext]
+    if (runtime.writesFrozen || runtime.quitFlushStarted || runtime.profileMaintenancePending) {
+      return Promise.reject(new Error('Cannot mutate finalized profile persistence'))
     }
-    this[primaryStateWriteOperationsContext].runtime.firstPendingSaveAt = null
-    const asyncWriteWasInFlight =
-      this[primaryStateWriteOperationsContext].runtime.pendingWrite !== null
-    // Why: bump writeGeneration so an in-flight async write skips its rename and can't overwrite this sync write.
-    this[primaryStateWriteOperationsContext].runtime.writeGeneration++
-    if (this[primaryStateWriteOperationsContext].runtime.inFlightAsyncTmpFile) {
+    return enqueuePrimaryStateOperation(this, async () => {
+      if (runtime.profileStateAuthority?.asynchronous) {
+        runtime.profileStateAuthority.assertWritable()
+      }
+      let mutation: DurableProfileStateMutation<T>
+      try {
+        mutation = this.runAdmittedMutationCallback('mutate', mutate)
+      } catch (error) {
+        await stopAfterFailedPrimaryStateMutation(runtime, error)
+        throw error
+      }
+      if (
+        mutation.persist === false ||
+        (mutation.persist === 'if-dirty' &&
+          runtime.lastDurableWriteGeneration >= runtime.writeGeneration)
+      ) {
+        return mutation.value
+      }
+      runtime.writeGeneration++
+      const requiredGeneration = runtime.writeGeneration
       try {
-        unlinkSync(this[primaryStateWriteOperationsContext].runtime.inFlightAsyncTmpFile)
-        this[primaryStateWriteOperationsContext].runtime.inFlightAsyncTmpFile = null
+        const captured = runtime.profileStateAuthority?.asynchronous
+          ? await writeToDiskAsync(this)
+          : writeToDiskSync(this[primaryStateWriteOperationsContext], {
+              expectedGeneration: requiredGeneration
+            })
+        if (!captured || runtime.lastDurableWriteGeneration < requiredGeneration) {
+          throw new Error('Profile mutation changed while preparing its durable snapshot')
+        }
       } catch (error) {
-        if ((error as NodeJS.ErrnoException).code !== 'ENOENT') {
-          void enqueueWrite(this).catch(() => {})
-          throw error
+        if (profileStateWriterFailureOutcome(error) !== 'indeterminate') {
+          if (mutation.rollback) {
+            try {
+              this.runAdmittedMutationCallback('rollback', mutation.rollback)
+            } catch (rollbackError) {
+              await stopAfterFailedPrimaryStateMutation(runtime, rollbackError)
+              throw rollbackError
+            }
+          }
         }
+        throw error
       }
-    }
-    // Why: later async flushes must remain serialized behind the invalidated writer.
-    writeToDiskSync(this, {
-      force: asyncWriteWasInFlight,
-      skipBackupRotation: this[primaryStateWriteOperationsContext].runtime.backupRotationInFlight
+      return mutation.value
     })
   }
 
-  flushActiveViewPreferenceOrThrow(): void {
-    this[primaryStateWriteOperationsContext].runtime.activeViewPreference.flushOrThrow()
+  private runAdmittedMutationCallback<T>(phase: 'mutate' | 'rollback', callback: () => T): T {
+    const { runtime } = this[primaryStateWriteOperationsContext]
+    // Finalization drains admitted mutations; the disk wait must not admit new snapshots.
+    runtime.durableMutationPhase = phase
+    try {
+      return callback()
+    } finally {
+      runtime.durableMutationPhase = null
+    }
   }
 
   getCodexResetCreditAttemptLedger(): CodexResetCreditAttemptLedger {
@@ -91,192 +119,128 @@ export class PrimaryStateWriteOperations {
     )
   }
 
-  replaceCodexResetCreditAttemptLedgerAndFlush(ledger: CodexResetCreditAttemptLedger): void {
-    if (this[primaryStateWriteOperationsContext].runtime.writesFrozen) {
-      throw new Error('Cannot persist Codex reset-credit attempts while writes are frozen')
-    }
+  replaceCodexResetCreditAttemptLedgerAndFlush(
+    ledger: CodexResetCreditAttemptLedger
+  ): Promise<void> {
+    const { runtime } = this[primaryStateWriteOperationsContext]
     const next = parseCodexResetCreditAttemptLedger(ledger)
-    const previous = this[primaryStateWriteOperationsContext].runtime.state
-      .codexResetCreditAttemptLedger
-      ? structuredClone(
-          this[primaryStateWriteOperationsContext].runtime.state.codexResetCreditAttemptLedger
-        )
-      : undefined
-    this[primaryStateWriteOperationsContext].runtime.state.codexResetCreditAttemptLedger = next
-    try {
-      this[primaryStateWriteOperationsContext].runtime.flushOrThrow()
-    } catch (error) {
-      // Why: callers use a successful return as the durability barrier before
-      // handing a scarce-credit mutation to the provider.
-      this[primaryStateWriteOperationsContext].runtime.state.codexResetCreditAttemptLedger =
-        previous
-      throw error
+    return this.runDurableMutation(() => {
+      const previous = runtime.state.codexResetCreditAttemptLedger
+      runtime.state.codexResetCreditAttemptLedger = next
+      runtime.dirtyProfileStateDomains?.add('codexResetCreditAttemptLedger')
+      return {
+        value: undefined,
+        rollback: () => {
+          if (runtime.state.codexResetCreditAttemptLedger === next) {
+            runtime.state.codexResetCreditAttemptLedger = previous
+          }
+        }
+      }
+    })
+  }
+}
+
+export function enqueueWrite(
+  owner: PrimaryStateWriteOperations,
+  options: { fullCheckpoint?: boolean; skipIfClean?: boolean; signal?: AbortSignal } = {}
+): Promise<void> {
+  const context = owner[primaryStateWriteOperationsContext]
+  const { runtime } = context
+  const batchable =
+    runtime.profileStateAuthority?.asynchronous && !options.fullCheckpoint && !options.signal
+  const queued = context.queuedSnapshot
+  if (batchable && queued) {
+    queued.capture.skipIfClean &&= options.skipIfClean === true
+    // Merged explicit flushes must retain the full capture that covered untracked getter edits.
+    queued.capture.fullCheckpoint ||= !queued.capture.skipIfClean
+    queued.capture.pendingSnapshotFileWork = runtime.pendingSnapshotFileWork
+    return queued.completion
+  }
+  const capture = {
+    skipIfClean: options.skipIfClean === true,
+    fullCheckpoint: options.fullCheckpoint === true,
+    pendingSnapshotFileWork: runtime.pendingSnapshotFileWork
+  }
+  const completion = enqueuePrimaryStateOperation(owner, async () => {
+    // Later flushes must capture edits made after this batch starts, even without a new generation.
+    if (context.queuedSnapshot?.capture === capture) {
+      context.queuedSnapshot = undefined
+    }
+    if (batchable) {
+      await capture.pendingSnapshotFileWork
     }
+    const { signal } = options
+    if (signal?.aborted) {
+      throw new Error('Persistence flush aborted')
+    }
+    if (
+      capture.skipIfClean &&
+      runtime.dirtyProfileStateDomains?.size === 0 &&
+      runtime.pendingAutomationRunsAfter === undefined &&
+      runtime.lastDurableWriteGeneration >= runtime.writeGeneration
+    ) {
+      return
+    }
+    // A queued predecessor can clear dirty domains before this checkpoint runs.
+    if (capture.fullCheckpoint) {
+      runtime.dirtyProfileStateDomains = null
+    }
+    await writeToDiskAsync(owner)
+  })
+  if (batchable) {
+    context.queuedSnapshot = { completion, capture }
   }
+  // A caller may stop waiting; the admitted write must retain its acknowledgement and ordering.
+  return waitForPromiseWithSignal(completion, options.signal)
 }
 
-export function enqueueWrite(owner: PrimaryStateWriteOperations): Promise<void> {
+export function enqueuePrimaryStateOperation<T>(
+  owner: PrimaryStateWriteOperations,
+  operation: () => Promise<T>
+): Promise<T> {
+  const context = owner[primaryStateWriteOperationsContext]
+  const { runtime } = context
+  // A durable mutation, export, or independent checkpoint separates adjacent snapshot batches.
+  context.queuedSnapshot = undefined
   const previousWrite = Promise.all([
-    owner[primaryStateWriteOperationsContext].runtime.pendingWrite ??
-      owner[primaryStateWriteOperationsContext].runtime.staleTempCleanup,
-    owner[primaryStateWriteOperationsContext].runtime.pendingSnapshotFileWork ?? Promise.resolve()
+    runtime.pendingWrite,
+    runtime.pendingSnapshotFileWork ?? Promise.resolve()
   ]).then(() => {})
-  const write = previousWrite.then(() => writeToDiskAsync(owner))
+  const write = previousWrite.then(operation).finally(() => {
+    if (context.queuedSnapshot?.completion === write) {
+      context.queuedSnapshot = undefined
+    }
+  })
   const trackedWrite = write
+    .then(() => {})
     .catch((err) => {
       console.error('[persistence] Failed to write state:', err)
     })
     .finally(() => {
-      if (owner[primaryStateWriteOperationsContext].runtime.pendingWrite === trackedWrite) {
-        owner[primaryStateWriteOperationsContext].runtime.pendingWrite = null
+      if (runtime.pendingWrite === trackedWrite) {
+        runtime.pendingWrite = null
       }
     })
-  owner[primaryStateWriteOperationsContext].runtime.pendingWrite = trackedWrite
+  runtime.pendingWrite = trackedWrite
   return write
 }
 
-export async function writeToDiskAsync(owner: PrimaryStateWriteOperations): Promise<void> {
-  if (owner[primaryStateWriteOperationsContext].runtime.writesFrozen) {
-    return
+export async function writeToDiskAsync(owner: PrimaryStateWriteOperations): Promise<boolean> {
+  const { runtime } = owner[primaryStateWriteOperationsContext]
+  if (runtime.fatalMutationError) {
+    throw runtime.fatalMutationError
   }
-  const gen = owner[primaryStateWriteOperationsContext].runtime.writeGeneration
-  const { payload, stateHash, protectedSecretUpdates } =
-    owner[primaryStateWriteOperationsContext].serialization.buildStateToSave()
-  // Why: don't rewrite a byte-identical multi-MB file when state nets out to already-persisted.
-  if (stateHash === owner[primaryStateWriteOperationsContext].runtime.lastWrittenStateHash) {
-    owner[primaryStateWriteOperationsContext].runtime.lastDurableWriteGeneration = Math.max(
-      owner[primaryStateWriteOperationsContext].runtime.lastDurableWriteGeneration,
-      gen
-    )
-    return
+  if (runtime.writesFrozen) {
+    return false
   }
-  const dataFile = owner[primaryStateWriteOperationsContext].runtime.dataFile
-  const dir = dirname(dataFile)
-  await mkdir(dir, { recursive: true }).catch(() => {})
-  const tmpFile = durableWriteTempPath(dataFile)
-
-  // Why: on any write/rename failure, remove the tmp file so it doesn't leave a multi-MB orphan.
-  let renamed = false
-  try {
-    // Why: fsync before rename, then fsync the directory; see writeFileDurable.
-    const handle = await open(tmpFile, 'w')
-    try {
-      // Already UTF-8 bytes: passing the string here would re-encode the whole state on the main thread.
-      await handle.writeFile(payload)
-      await handle.sync()
-    } finally {
-      await handle.close()
-    }
-    // Why: if flush() bumped writeGeneration mid-write, it already wrote fresher state; don't overwrite it.
-    if (owner[primaryStateWriteOperationsContext].runtime.writeGeneration !== gen) {
-      return
-    }
-    owner[primaryStateWriteOperationsContext].runtime.inFlightAsyncTmpFile = tmpFile
-    try {
-      await renameDurable(tmpFile, dataFile)
-      renamed = true
-    } catch (error) {
-      if (
-        (error as NodeJS.ErrnoException).code !== 'ENOENT' ||
-        owner[primaryStateWriteOperationsContext].runtime.writeGeneration === gen
-      ) {
-        throw error
-      }
-    } finally {
-      if (owner[primaryStateWriteOperationsContext].runtime.inFlightAsyncTmpFile === tmpFile) {
-        owner[primaryStateWriteOperationsContext].runtime.inFlightAsyncTmpFile = null
-      }
-    }
-    // Why re-check gen: a mutation or sync flush during rename makes the installed hash ambiguous; invalidate the no-op guard.
-    if (renamed && owner[primaryStateWriteOperationsContext].runtime.writeGeneration === gen) {
-      owner[primaryStateWriteOperationsContext].runtime.lastWrittenStateHash = stateHash
-      owner[primaryStateWriteOperationsContext].runtime.protectedSecrets.commitRetentionUpdates(
-        protectedSecretUpdates
-      )
-    } else if (renamed) {
-      owner[primaryStateWriteOperationsContext].runtime.lastWrittenStateHash = null
-    }
-    if (renamed) {
-      owner[primaryStateWriteOperationsContext].runtime.lastDurableWriteGeneration = Math.max(
-        owner[primaryStateWriteOperationsContext].runtime.lastDurableWriteGeneration,
-        gen
-      )
-    }
-  } finally {
-    if (!renamed) {
-      await rm(tmpFile).catch(() => {})
-    }
-  }
-  if (!renamed) {
-    return
-  }
-  // Why (#1158): rotate only after the primary rename while this write still owns its generation.
-  if (owner[primaryStateWriteOperationsContext].runtime.writeGeneration !== gen) {
-    return
-  }
-  await owner[primaryStateWriteOperationsContext].backups.rotateBackupsAsync(dataFile)
-}
-
-export function writeToDiskSync(
-  owner: PrimaryStateWriteOperations,
-  opts: { force?: boolean; skipBackupRotation?: boolean } = {}
-): void {
-  if (owner[primaryStateWriteOperationsContext].runtime.writesFrozen) {
-    return
-  }
-  const { payload, stateHash, protectedSecretUpdates } =
-    owner[primaryStateWriteOperationsContext].serialization.buildStateToSave()
-  // Why: matching hash means the file already holds this state; force overrides when an async rename may be racing past the gen check.
-  if (
-    !opts.force &&
-    stateHash === owner[primaryStateWriteOperationsContext].runtime.lastWrittenStateHash
-  ) {
-    // Why: flushOrThrow already bumped writeGeneration; the file holds this state, so record it
-    // durable or persistPtyBinding's fast lane stays parked one generation behind forever.
-    owner[primaryStateWriteOperationsContext].runtime.lastDurableWriteGeneration = Math.max(
-      owner[primaryStateWriteOperationsContext].runtime.lastDurableWriteGeneration,
-      owner[primaryStateWriteOperationsContext].runtime.writeGeneration
+  const gen = runtime.writeGeneration
+  if (runtime.profileStateAuthority?.asynchronous) {
+    return writeProfileStateInWorker(
+      owner[primaryStateWriteOperationsContext],
+      runtime.profileStateAuthority
     )
-    return
-  }
-  const dataFile = owner[primaryStateWriteOperationsContext].runtime.dataFile
-  const dir = dirname(dataFile)
-  if (!existsSync(dir)) {
-    mkdirSync(dir, { recursive: true })
-  }
-  const tmpFile = `${dataFile}.${process.pid}.${Date.now()}.${Math.random().toString(16).slice(2)}.tmp`
-
-  // Why: on any write/rename failure, remove the tmp file so shutdown crashes don't leak orphans.
-  let renamed = false
-  try {
-    // Why: fsync the temp file and the directory; a bare rename can survive as stale or empty
-    // content after power loss, losing projects/tabs back to the newest usable .bak slot.
-    writeFileDurableSync(tmpFile, dataFile, payload)
-    renamed = true
-    owner[primaryStateWriteOperationsContext].runtime.lastWrittenStateHash = stateHash
-    owner[primaryStateWriteOperationsContext].runtime.protectedSecrets.commitRetentionUpdates(
-      protectedSecretUpdates
-    )
-    owner[primaryStateWriteOperationsContext].runtime.lastDurableWriteGeneration = Math.max(
-      owner[primaryStateWriteOperationsContext].runtime.lastDurableWriteGeneration,
-      owner[primaryStateWriteOperationsContext].runtime.writeGeneration
-    )
-  } finally {
-    if (!renamed) {
-      try {
-        unlinkSync(tmpFile)
-      } catch {
-        // Best-effort cleanup; the write already failed, swallow secondary error.
-      }
-    }
-  }
-  const now = Date.now()
-  if (
-    !opts.skipBackupRotation &&
-    owner[primaryStateWriteOperationsContext].backups.shouldRotateBackups(now, dataFile)
-  ) {
-    owner[primaryStateWriteOperationsContext].backups.rotateBackupsSync(dataFile)
   }
+  return writeToDiskSync(owner[primaryStateWriteOperationsContext], { expectedGeneration: gen })
 }
 
 export function installPrimaryStateWriteOperationsContext(
diff --git a/src/main/persistence/loading-store/profile-preferences.ts b/src/main/persistence/loading-store/profile-preferences.ts
index 8e910ed235d2..b52e748f1908 100644
--- a/src/main/persistence/loading-store/profile-preferences.ts
+++ b/src/main/persistence/loading-store/profile-preferences.ts
@@ -159,7 +159,7 @@ export function getSettingsMutationOperations(
     bumpLocalWorktreeScanGeneration,
     removeRetainedBlob: (slot) =>
       owner[profilePreferencesContext].runtime.protectedSecrets.removeRetainedBlob(slot),
-    scheduleSave: () => scheduleSave(owner[profilePreferencesContext].scheduling),
+    scheduleSave: () => scheduleSave(owner[profilePreferencesContext].scheduling, ['settings']),
     notifySettingsChanged: (updates, originWebContentsId) =>
       notifySettingsChanged(owner, updates, originWebContentsId)
   }
@@ -183,7 +183,7 @@ export function getFeatureInteractionOperations(
 ): FeatureInteractionOperations {
   return {
     state: owner[profilePreferencesContext].runtime.state,
-    scheduleSave: () => scheduleSave(owner[profilePreferencesContext].scheduling),
+    scheduleSave: (domains) => scheduleSave(owner[profilePreferencesContext].scheduling, domains),
     notifyUIChanged: () => notifyUIChanged(owner),
     getUI: () => owner.getUI()
   }
diff --git a/src/main/persistence/loading-store/profile-state-authority-writes.ts b/src/main/persistence/loading-store/profile-state-authority-writes.ts
new file mode 100644
index 000000000000..0628dbb76073
--- /dev/null
+++ b/src/main/persistence/loading-store/profile-state-authority-writes.ts
@@ -0,0 +1,84 @@
+import { createHash } from 'node:crypto'
+import { types } from 'node:util'
+import {
+  applySecretSentinelSubstitutions,
+  type SecretSentinelSubstitution
+} from './secret-sentinel-substitution'
+import type { ProfileStateDomainReplacement } from './profile-state-authority'
+
+export function serializeSelectiveProfileStateDomains(
+  state: Record<string, unknown>,
+  dirtyDomains: ReadonlySet<string>
+): ProfileStateDomainReplacement[] {
+  const payloads = new Map<string, string>()
+  // Capture keys up front, but read values after preceding getters and toJSON hooks.
+  for (const domain of Object.keys(state)) {
+    const fragment = serializeSelectiveProfileStateDomainFragment(domain, state[domain])
+    if (fragment !== '{}') {
+      payloads.set(domain, extractProfileStateDomainPayload(domain, fragment))
+    }
+  }
+  return [...dirtyDomains].map((domain) => {
+    return { domain, payload: payloads.get(domain) ?? null }
+  })
+}
+
+export function serializeCompleteProfileStateDomains(
+  state: Record<string, unknown>,
+  substitutions: readonly SecretSentinelSubstitution[],
+  degradedPrefix: string
+): { payload: Buffer; stateHash: string; domains: readonly ProfileStateDomainReplacement[] } {
+  const domains: ProfileStateDomainReplacement[] = []
+  const hash = createHash('sha1').update(degradedPrefix)
+  for (const [domain, value] of Object.entries(state)) {
+    const fragment = serializeProfileStateDomainFragment(domain, value)
+    if (fragment === '{}') {
+      continue
+    }
+    const serialized = applySecretSentinelSubstitutions(fragment, substitutions, '', 'text')
+    hash.update(serialized.stateHash)
+    domains.push({
+      domain,
+      payload: extractProfileStateDomainPayload(domain, serialized.payload)
+    })
+  }
+  return {
+    domains,
+    stateHash: hash.digest('hex'),
+    get payload() {
+      return Buffer.from(
+        `{${domains.map(({ domain, payload }) => `${JSON.stringify(domain)}:${payload}`).join(',')}}`,
+        'utf8'
+      )
+    }
+  }
+}
+
+function serializeSelectiveProfileStateDomainFragment(domain: string, value: unknown): string {
+  let needsNormalization = false
+  const fragment = serializeProfileStateDomainFragment(domain, value, (_key, entry) => {
+    if (entry !== null && typeof entry === 'object') {
+      needsNormalization ||=
+        types.isProxy(entry) ||
+        ('isRawJSON' in JSON &&
+          typeof JSON.isRawJSON === 'function' &&
+          JSON.isRawJSON(entry) === true)
+    }
+    return entry
+  })
+  // Raw JSON and proxy key order still need the old UTF-8/parse/stringify normalization.
+  return needsNormalization ? JSON.stringify(JSON.parse(fragment.toWellFormed())) : fragment
+}
+
+function serializeProfileStateDomainFragment(
+  domain: string,
+  value: unknown,
+  replacer?: (key: string, value: unknown) => unknown
+): string {
+  // The wrapper preserves the original property name passed to a value's toJSON.
+  return JSON.stringify({ [domain]: value }, replacer)
+}
+
+function extractProfileStateDomainPayload(domain: string, fragment: string): string {
+  return fragment.slice(JSON.stringify(domain).length + 2, -1)
+}
diff --git a/src/main/persistence/loading-store/profile-state-authority.ts b/src/main/persistence/loading-store/profile-state-authority.ts
new file mode 100644
index 000000000000..0ced5ba32485
--- /dev/null
+++ b/src/main/persistence/loading-store/profile-state-authority.ts
@@ -0,0 +1,127 @@
+import type { LegacyPaneKeyAliasEntry } from '../../../shared/persisted-state-types'
+import type { AutomationRun } from '../../../shared/automations-types'
+import type { ProfileStateDatabaseQuarantine } from '../profile-state/profile-state-database-quarantine'
+
+export type ProfileStateMaintenance = {
+  /** Re-admit the unchanged profile before permitting any new persistence work. */
+  resume(): Promise<void>
+}
+
+/** Keep offline/compatibility persistence loadable without eagerly importing SQLite. */
+export type ProfileStateAuthority = {
+  readonly asynchronous?: false
+  /** Return storage-form JSON, or undefined when this authority has no state yet. */
+  readSerializedState(): string | undefined
+
+  /** Fence a hash-identical checkpoint without rereading or rewriting its payload. */
+  assertCurrentRevision?: () => void
+
+  /**
+   * Optionally commit only the explicitly dirty top-level domains. Authorities
+   * without this capability retain the complete-document fallback below.
+   */
+  writeSerializedDomains?: (replacements: readonly ProfileStateDomainReplacement[]) => void
+
+  /**
+   * Commit automation definition replacements and the changed run projection
+   * in one profile-revision transaction without serializing unrelated domains.
+   */
+  writeSerializedAutomationRuns?: (
+    replacements: readonly ProfileStateDomainReplacement[],
+    runs: readonly AutomationRun[]
+  ) => void
+
+  /**
+   * Durably replace the complete storage-form document. Implementations may
+   * reject a stale read instead of allowing last-writer-wins replacement.
+   */
+  writeSerializedState(payload: Buffer): void
+
+  /** Replace the whole profile; omitted domains and null payloads are deleted. */
+  writeCompleteSerializedDomains?: (replacements: readonly ProfileStateDomainReplacement[]) => void
+
+  /** Schedule bounded recovery protection after a successful primary commit. */
+  scheduleBackup?: () => void
+
+  /** Drain owned backup handles before shutdown or profile file mutations. */
+  drainBackups?: (cancel?: boolean) => Promise<void>
+
+  /** Optionally publish a durable JSON export for rollback or a compatibility runtime. */
+  writeJsonExport?: (targetPath: string) => number
+
+  /** Publish canonical JSON for an older build and advance its SQLite acceptance marker. */
+  writeJsonCompatibilityExport?: (targetPath: string) => number | undefined
+
+  /** Refresh compatibility JSON after the final flush with asynchronous JSON file writes. */
+  writeJsonCompatibilityExportAsync?: (targetPath: string) => Promise<number | undefined>
+
+  /** Optionally preserve the database family before an explicit recovery decision. */
+  quarantineDatabase?: (quarantineRoot?: string, reason?: string) => ProfileStateDatabaseQuarantine
+
+  /** Release any process-local database handle before a profile is switched or removed. */
+  close?: () => void
+
+  /** Only a clean maintenance close may provide an explicit resume capability. */
+  pauseForMaintenance?: () => Promise<ProfileStateMaintenance>
+}
+
+export type AsyncProfileStateAuthority = Omit<
+  ProfileStateAuthority,
+  | 'asynchronous'
+  | 'assertCurrentRevision'
+  | 'writeSerializedDomains'
+  | 'writeSerializedAutomationRuns'
+  | 'writeSerializedState'
+  | 'writeCompleteSerializedDomains'
+  | 'writeJsonExport'
+  | 'writeJsonCompatibilityExport'
+  | 'quarantineDatabase'
+  | 'close'
+> & {
+  readonly asynchronous: true
+  assertWritable(): void
+  abort(): Promise<void>
+  assertCurrentRevision(): Promise<void>
+  writeSerializedDomains(replacements: readonly ProfileStateDomainReplacement[]): Promise<void>
+  writeSerializedAutomationRuns(
+    replacements: readonly ProfileStateDomainReplacement[],
+    runs: readonly AutomationRun[]
+  ): Promise<void>
+  writeSerializedState(payload: Buffer): Promise<void>
+  writeCompleteSerializedDomains(
+    replacements: readonly ProfileStateDomainReplacement[]
+  ): Promise<void>
+  writeJsonExport(targetPath: string): Promise<number>
+  writeLatestJsonExport(dataFile: string): Promise<number | undefined>
+  writeJsonCompatibilityExport(targetPath: string): Promise<number | undefined>
+  quarantineDatabase(
+    quarantineRoot?: string,
+    reason?: string
+  ): Promise<ProfileStateDatabaseQuarantine>
+  close(): Promise<void>
+}
+
+export type ProfileStatePersistenceAuthority = ProfileStateAuthority | AsyncProfileStateAuthority
+
+export type ProfileStateDomainReplacement = {
+  domain: string
+  /** Storage-form JSON for the domain, or null to remove its row. */
+  payload: string | null
+}
+
+export type ProfileStateStartupPaneAlias = Omit<LegacyPaneKeyAliasEntry, 'ptyId'>
+
+/** A startup read paired with the authority that observed its revision. */
+export type ProfileStateAuthorityInitialState<
+  Authority extends ProfileStatePersistenceAuthority = ProfileStateAuthority
+> = {
+  readonly authority: Authority
+  readonly unboundPaneAliases?: readonly ProfileStateStartupPaneAlias[]
+} & (
+  | { readonly serializedState: string | undefined; readonly takeParsedState?: never }
+  | {
+      readonly serializedState?: never
+      /** Transfer this storage-form object once, before the loader can decrypt or mutate it. */
+      readonly takeParsedState: () => Record<string, unknown> | undefined
+    }
+)
diff --git a/src/main/persistence/loading-store/profile-state-caller-cancellation.test.ts b/src/main/persistence/loading-store/profile-state-caller-cancellation.test.ts
new file mode 100644
index 000000000000..728c63f6b8d0
--- /dev/null
+++ b/src/main/persistence/loading-store/profile-state-caller-cancellation.test.ts
@@ -0,0 +1,87 @@
+import { describe, expect, it, vi } from 'vitest'
+import {
+  createWorkerMaintenanceFixture,
+  maintenanceBarrier
+} from './profile-state-maintenance-fixture'
+
+vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
+vi.mock('../../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: () => ({ nth_repo_added: 2 })
+}))
+vi.mock('../../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: () => ({ hosts: [] }),
+  sshConfigHostsToTargets: () => []
+}))
+
+describe('profile flush caller cancellation', () => {
+  it('releases a canceled waiter while its admitted write completes and later saving continues', async () => {
+    const { store, authority, readState } = await createWorkerMaintenanceFixture()
+    const started = maintenanceBarrier()
+    const release = maintenanceBarrier()
+    const write = authority.writeSerializedDomains.bind(authority)
+    vi.spyOn(authority, 'writeSerializedDomains').mockImplementationOnce(async (domains) => {
+      await write(domains)
+      started.resolve()
+      await release.promise
+    })
+    const abort = vi.spyOn(authority, 'abort')
+    const controller = new AbortController()
+    store.updateSettings({ theme: 'dark' })
+    const pending = store.flushPendingOrThrowAsync({ signal: controller.signal })
+    const rejected = expect(pending).rejects.toThrow('aborted')
+    let settled = false
+    void pending.catch(() => {
+      settled = true
+    })
+    await started.promise
+    controller.abort()
+    try {
+      await new Promise<void>((resolve) => setImmediate(resolve))
+      expect(abort).not.toHaveBeenCalled()
+      expect(settled).toBe(true)
+      expect(() => authority.assertWritable()).not.toThrow()
+    } finally {
+      release.resolve()
+      await rejected
+    }
+    await store.runDurableMutation(() => {
+      store.updateSettings({ theme: 'light' })
+      return { value: undefined }
+    })
+    expect(readState().settings.theme).toBe('light')
+  })
+
+  it('keeps an abandoned write ordered before the final checkpoint', async () => {
+    const { store, authority, readState } = await createWorkerMaintenanceFixture()
+    const started = maintenanceBarrier()
+    const release = maintenanceBarrier()
+    const write = authority.writeSerializedDomains.bind(authority)
+    vi.spyOn(authority, 'writeSerializedDomains').mockImplementationOnce(async (domains) => {
+      started.resolve()
+      await release.promise
+      await write(domains)
+    })
+    const controller = new AbortController()
+    store.updateSettings({ theme: 'dark' })
+    const abandoned = store.flushPendingOrThrowAsync({ signal: controller.signal })
+    const rejected = expect(abandoned).rejects.toThrow('aborted')
+    await started.promise
+    controller.abort()
+    store.getWorkspaceSession().activeTabId = 'shutdown-edit'
+    const capture = vi.spyOn(authority, 'writeCompleteSerializedDomains')
+    const final = store.flushFinalOrThrowAsync()
+    const result = final.catch((error: unknown) => error)
+    try {
+      await new Promise<void>((resolve) => setImmediate(resolve))
+      expect(capture).not.toHaveBeenCalled()
+    } finally {
+      release.resolve()
+      await rejected
+    }
+    await expect(result).resolves.toBeUndefined()
+    expect(readState()).toMatchObject({
+      settings: { theme: 'dark' },
+      workspaceSession: { activeTabId: 'shutdown-edit' }
+    })
+  })
+})
diff --git a/src/main/persistence/loading-store/profile-state-checkpoints.test.ts b/src/main/persistence/loading-store/profile-state-checkpoints.test.ts
new file mode 100644
index 000000000000..3b32f7702aa6
--- /dev/null
+++ b/src/main/persistence/loading-store/profile-state-checkpoints.test.ts
@@ -0,0 +1,238 @@
+import { mkdtempSync, readFileSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { buildProfileStateCutoverFixture } from '../profile-state-cutover-fixture'
+import { openProfileStateDatabaseReadOnly } from '../profile-state/profile-state-database'
+import { parseProfileStateRoot } from '../profile-state/profile-state-document-validation'
+import { readProfileStateSnapshot } from '../profile-state/profile-state-documents'
+import { profileStateJsonExportPath } from '../profile-state/legacy-json/profile-state-export-path'
+import { ProfileStateSqliteAuthority } from '../profile-state/profile-state-sqlite-authority'
+import { Store } from './store'
+import { scheduleSave } from './write-scheduling'
+
+vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
+vi.mock('../../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: () => ({ nth_repo_added: 2 })
+}))
+vi.mock('../../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: () => ({ hosts: [] }),
+  sshConfigHostsToTargets: () => []
+}))
+
+const PROFILE_ID = 'checkpoint-test'
+const fixtures: { directory: string; store: Store }[] = []
+
+afterEach(async () => {
+  for (const { directory, store } of fixtures.splice(0)) {
+    store.freezeWrites()
+    await store.flushAsync()
+    rmSync(directory, { recursive: true, force: true })
+  }
+  vi.restoreAllMocks()
+})
+
+function fixture() {
+  const directory = mkdtempSync(join(tmpdir(), 'orca-profile-checkpoint-'))
+  const databasePath = join(directory, 'profile-state.db')
+  const dataFile = join(directory, 'orca-data.json')
+  const authority = new ProfileStateSqliteAuthority(databasePath, PROFILE_ID)
+  const backup = vi.spyOn(authority, 'scheduleBackup').mockImplementation(() => {})
+  authority.writeSerializedState(
+    Buffer.from(JSON.stringify(buildProfileStateCutoverFixture(directory)))
+  )
+  const store = new Store({ dataFile, profileStateAuthority: authority })
+  fixtures.push({ directory, store })
+  store.flushOrThrow()
+  return {
+    directory,
+    dataFile,
+    store,
+    authority,
+    backup,
+    readState: () => {
+      const opened = openProfileStateDatabaseReadOnly(databasePath, PROFILE_ID)
+      try {
+        return parseProfileStateRoot(readProfileStateSnapshot(opened.db).json)
+      } finally {
+        opened.db.close()
+      }
+    }
+  }
+}
+
+function mutateThroughGetters(store: Store): void {
+  store.getWorkspaceSession().activeTabId = 'direct-local-tab'
+  store.getWorkspaceSession('ssh:build-host').activeTabId = 'direct-remote-tab'
+}
+
+const EXPECTED_CHECKPOINT = {
+  settings: { theme: 'dark' },
+  workspaceSession: { activeTabId: 'direct-local-tab' },
+  workspaceSessionsByHostId: { 'ssh:build-host': { activeTabId: 'direct-remote-tab' } }
+}
+
+describe('complete profile state checkpoints', () => {
+  it('does not retain a save timer after writes are frozen', () => {
+    const { store } = fixture()
+    store.freezeWrites()
+    const setTimer = vi.spyOn(globalThis, 'setTimeout')
+    scheduleSave(store)
+    expect(setTimer).not.toHaveBeenCalled()
+  })
+
+  it.each(['sync', 'async'] as const)(
+    'rejects a stale %s checkpoint even when the local hash is unchanged',
+    async (mode) => {
+      const { store, directory, readState } = fixture()
+      const other = new ProfileStateSqliteAuthority(join(directory, 'profile-state.db'), PROFILE_ID)
+      try {
+        other.readSerializedState()
+        other.writeSerializedDomains([{ domain: 'futureDomain', payload: '{"external":true}' }])
+        scheduleSave(store)
+        if (mode === 'sync') {
+          expect(() => store.flushOrThrow()).toThrow(/Profile state revision changed/)
+        } else {
+          await expect(store.flushPendingOrThrowAsync()).rejects.toThrow(
+            /Profile state revision changed/
+          )
+        }
+        expect(readState()).toMatchObject({ futureDomain: { external: true } })
+      } finally {
+        other.close()
+      }
+    }
+  )
+
+  it('captures nested history mutations after an unchanged checkpoint', async () => {
+    const { store, directory, readState } = fixture()
+    store.writeProfileStateJsonExport(join(directory, 'before.json'))
+    const run = store.listAutomationRuns()[0]
+    if (!run?.outputSnapshot) {
+      throw new Error('Expected a fixture run with output')
+    }
+    run.outputSnapshot.content = 'changed through a nested getter'
+    store.updateSettings({ theme: 'dark' })
+    await store.flushPendingOrThrowAsync()
+
+    await store.flushAsync()
+
+    expect(readState()).toMatchObject({
+      settings: { theme: 'dark' },
+      automationRuns: expect.arrayContaining([
+        expect.objectContaining({
+          id: run.id,
+          outputSnapshot: expect.objectContaining({ content: 'changed through a nested getter' })
+        })
+      ])
+    })
+  })
+
+  it.each([false, true])(
+    'captures getter mutations alongside pending settings on quit (compatibility export: %s)',
+    async (exportJsonCompatibility) => {
+      const { store, dataFile, readState } = fixture()
+      mutateThroughGetters(store)
+      store.updateSettings({ theme: 'dark' })
+
+      await store.flushAsync({ exportJsonCompatibility })
+
+      expect(readState()).toMatchObject(EXPECTED_CHECKPOINT)
+      if (exportJsonCompatibility) {
+        expect(parseProfileStateRoot(readFileSync(dataFile, 'utf8'))).toMatchObject(
+          EXPECTED_CHECKPOINT
+        )
+      }
+    }
+  )
+
+  it.each(['explicit', 'revisioned', 'compatibility'] as const)(
+    'includes getter mutations in the %s JSON export',
+    (mode) => {
+      const { store, directory, dataFile, readState } = fixture()
+      mutateThroughGetters(store)
+      store.updateSettings({ theme: 'dark' })
+      let exportPath = join(directory, 'rollback.json')
+
+      if (mode === 'explicit') {
+        store.writeProfileStateJsonExport(exportPath)
+      } else if (mode === 'revisioned') {
+        const revision = store.writeLatestProfileStateJsonExport()
+        if (revision === undefined) {
+          throw new Error('Expected a revisioned export')
+        }
+        exportPath = profileStateJsonExportPath(dataFile, revision)
+      } else {
+        store.writeLatestProfileStateJsonCompatibilityExport()
+        exportPath = dataFile
+      }
+
+      expect(readState()).toMatchObject(EXPECTED_CHECKPOINT)
+      expect(parseProfileStateRoot(readFileSync(exportPath, 'utf8'))).toMatchObject(
+        EXPECTED_CHECKPOINT
+      )
+    }
+  )
+
+  it('takes the final checkpoint after an earlier queued writer clears its dirty domains', async () => {
+    const { store, backup, readState } = fixture()
+    store.updateSettings({ theme: 'light' })
+    backup.mockImplementationOnce(() => {
+      queueMicrotask(() => {
+        mutateThroughGetters(store)
+        store.updateSettings({ theme: 'dark' })
+      })
+    })
+
+    const previous = store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
+    const final = store.flushAsync()
+    await Promise.all([previous, final])
+
+    expect(readState()).toMatchObject(EXPECTED_CHECKPOINT)
+  })
+
+  it('keeps normal pending and synchronous writes selective', async () => {
+    const { store, authority } = fixture()
+    const fullWrite = vi.spyOn(authority, 'writeSerializedState')
+    const selectiveWrite = vi.spyOn(authority, 'writeSerializedDomains')
+
+    store.updateSettings({ theme: 'dark' })
+    await store.flushPendingOrThrowAsync()
+    store.patchWorkspaceSession({ activeTabId: 'scheduled-tab' })
+    store.flushOrThrow()
+
+    expect(fullWrite).not.toHaveBeenCalled()
+    expect(
+      selectiveWrite.mock.calls.map(([domains]) => domains.map(({ domain }) => domain))
+    ).toEqual([['settings'], ['workspaceSession']])
+  })
+
+  it('clears full-checkpoint mode after a synchronous hash no-op', () => {
+    const { store, authority } = fixture()
+    store.writeLatestProfileStateJsonExport()
+
+    const completeWrite = vi.spyOn(authority, 'writeCompleteSerializedDomains')
+    const selectiveWrite = vi.spyOn(authority, 'writeSerializedDomains')
+    store.updateSettings({ theme: 'light' })
+    store.flushOrThrow()
+
+    expect(completeWrite).not.toHaveBeenCalled()
+    expect(
+      selectiveWrite.mock.calls.map(([domains]) => domains.map(({ domain }) => domain))
+    ).toEqual([['settings']])
+  })
+
+  it('does not write a frozen profile when final persistence requests a checkpoint', async () => {
+    const { store, authority, readState } = fixture()
+    const before = readState()
+    const fullWrite = vi.spyOn(authority, 'writeSerializedState')
+    mutateThroughGetters(store)
+    store.updateSettings({ theme: 'dark' })
+    store.freezeWrites()
+
+    await store.flushAsync()
+
+    expect(fullWrite).not.toHaveBeenCalled()
+    expect(readState()).toEqual(before)
+  })
+})
diff --git a/src/main/persistence/loading-store/profile-state-delayed-authority-fixture.ts b/src/main/persistence/loading-store/profile-state-delayed-authority-fixture.ts
new file mode 100644
index 000000000000..cebd91b05389
--- /dev/null
+++ b/src/main/persistence/loading-store/profile-state-delayed-authority-fixture.ts
@@ -0,0 +1,130 @@
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, vi } from 'vitest'
+import type { AutomationRun } from '../../../shared/automations-types'
+import { buildProfileStateCutoverFixture } from '../profile-state-cutover-fixture'
+import { ProfileStateSqliteAuthority } from '../profile-state/profile-state-sqlite-authority'
+import { writeVersionedProfileStateExport } from '../profile-state/legacy-json/profile-state-versioned-export'
+import type {
+  AsyncProfileStateAuthority,
+  ProfileStateDomainReplacement
+} from './profile-state-authority'
+import { Store } from './store'
+
+export function deferred<T>() {
+  let resolve!: (value: T) => void
+  let reject!: (error: Error) => void
+  const promise = new Promise<T>((accept, refuse) => {
+    resolve = accept
+    reject = refuse
+  })
+  return { promise, resolve, reject }
+}
+
+/** Delay the authority boundary while retaining real SQLite and Store serialization. */
+export class DelayedAuthority implements AsyncProfileStateAuthority {
+  readonly asynchronous = true
+  private next:
+    | { started: ReturnType<typeof deferred<void>>; finish: ReturnType<typeof deferred<void>> }
+    | undefined
+  readonly captures: ProfileStateDomainReplacement[][] = []
+  readonly close = vi.fn(async () => {
+    this.inner.close()
+  })
+
+  constructor(readonly inner: ProfileStateSqliteAuthority) {}
+
+  pause() {
+    const gate = { started: deferred<void>(), finish: deferred<void>() }
+    this.next = gate
+    return gate
+  }
+
+  assertWritable() {}
+  async abort() {}
+  readSerializedState() {
+    return this.inner.readSerializedState()
+  }
+  async assertCurrentRevision() {
+    await this.dispatch(() => this.inner.assertCurrentRevision())
+  }
+  async writeSerializedState(payload: Buffer) {
+    const captured = Buffer.from(payload)
+    await this.dispatch(() => this.inner.writeSerializedState(captured))
+  }
+  async writeSerializedDomains(replacements: readonly ProfileStateDomainReplacement[]) {
+    const captured = structuredClone(replacements)
+    this.captures.push([...captured])
+    await this.dispatch(() => this.inner.writeSerializedDomains(captured))
+  }
+  async writeCompleteSerializedDomains(replacements: readonly ProfileStateDomainReplacement[]) {
+    const captured = structuredClone(replacements)
+    this.captures.push([...captured])
+    await this.dispatch(() => this.inner.writeCompleteSerializedDomains(captured))
+  }
+  async writeSerializedAutomationRuns(
+    replacements: readonly ProfileStateDomainReplacement[],
+    runs: readonly AutomationRun[]
+  ) {
+    const captured = structuredClone(replacements)
+    const capturedRuns = structuredClone(runs)
+    await this.dispatch(() => this.inner.writeSerializedAutomationRuns(captured, capturedRuns))
+  }
+  async writeJsonExport(path: string) {
+    return this.inner.writeJsonExport(path)
+  }
+  async writeLatestJsonExport(path: string) {
+    return writeVersionedProfileStateExport(path, this.inner.writeJsonExport.bind(this.inner))
+  }
+  async writeJsonCompatibilityExport(path: string) {
+    return this.inner.writeJsonCompatibilityExportAsync(path)
+  }
+  async quarantineDatabase(root?: string, reason?: string) {
+    return this.inner.quarantineDatabase(root, reason)
+  }
+  private async dispatch(operation: () => void) {
+    const gate = this.next
+    this.next = undefined
+    gate?.started.resolve()
+    await gate?.finish.promise
+    operation()
+  }
+}
+
+const cleanups: (() => Promise<void>)[] = []
+afterEach(async () => {
+  for (const cleanup of cleanups.splice(0)) {
+    await cleanup()
+  }
+  vi.restoreAllMocks()
+})
+
+export async function fixture() {
+  const directory = mkdtempSync(join(tmpdir(), 'orca-worker-coordination-'))
+  const path = join(directory, 'profile-state.db')
+  const inner = new ProfileStateSqliteAuthority(path, 'coordination-test')
+  inner.writeSerializedState(
+    Buffer.from(JSON.stringify(buildProfileStateCutoverFixture(directory)))
+  )
+  const authority = new DelayedAuthority(inner)
+  const store = new Store({
+    dataFile: join(directory, 'orca-data.json'),
+    profileStateAuthority: authority
+  })
+  cleanups.push(async () => {
+    await store.freezeWritesAsync()
+    rmSync(directory, { recursive: true, force: true })
+  })
+  await store.flushPendingOrThrowAsync()
+  authority.captures.length = 0
+  const readState = () => {
+    const reader = new ProfileStateSqliteAuthority(path, 'coordination-test')
+    try {
+      return JSON.parse(reader.readSerializedState() ?? '{}')
+    } finally {
+      reader.close()
+    }
+  }
+  return { store, authority, readState }
+}
diff --git a/src/main/persistence/loading-store/profile-state-direct-flush.test.ts b/src/main/persistence/loading-store/profile-state-direct-flush.test.ts
new file mode 100644
index 000000000000..9cf3d1ec2d1c
--- /dev/null
+++ b/src/main/persistence/loading-store/profile-state-direct-flush.test.ts
@@ -0,0 +1,188 @@
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import type { CodexResetCreditAttemptLedger } from '../../../shared/codex-reset-credit-attempt-ledger'
+import { ProfileStateSqliteAuthority } from '../profile-state/profile-state-sqlite-authority'
+import { readProfileStateDomain } from '../profile-state/profile-state-domain-reader'
+import { buildProfileStateCutoverFixture } from '../profile-state-cutover-fixture'
+import { Store } from './store'
+
+vi.mock('electron', () => ({
+  app: {
+    getPath: () => tmpdir(),
+    getName: () => 'orca-test',
+    getVersion: () => '0.0.0-test',
+    isPackaged: false,
+    on: () => {},
+    whenReady: () => Promise.resolve()
+  },
+  safeStorage: {
+    isEncryptionAvailable: () => true,
+    encryptString: (value: string) => Buffer.from(`encrypted:${value}`),
+    decryptString: (value: Buffer) => value.toString().slice('encrypted:'.length)
+  },
+  ipcMain: { on: () => {}, handle: () => {} },
+  BrowserWindow: { getAllWindows: () => [] }
+}))
+vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
+vi.mock('../../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: () => ({ nth_repo_added: 2 })
+}))
+vi.mock('../../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: () => ({ hosts: [] }),
+  sshConfigHostsToTargets: () => []
+}))
+
+const PROFILE_ID = 'direct-flush-test'
+const fixtures: { directory: string; store: Store }[] = []
+
+afterEach(async () => {
+  for (const fixture of fixtures.splice(0)) {
+    fixture.store.freezeWrites()
+    await fixture.store.flushAsync()
+    rmSync(fixture.directory, { recursive: true, force: true })
+  }
+  vi.restoreAllMocks()
+})
+
+function fixture(seedState?: unknown) {
+  const directory = mkdtempSync(join(tmpdir(), 'orca-direct-flush-'))
+  const databasePath = join(directory, 'profile-state.db')
+  const authority = new ProfileStateSqliteAuthority(databasePath, PROFILE_ID)
+  vi.spyOn(authority, 'scheduleBackup').mockImplementation(() => {})
+  if (seedState !== undefined) {
+    authority.writeSerializedState(Buffer.from(JSON.stringify(seedState)))
+  }
+  const store = new Store({
+    dataFile: join(directory, 'orca-data.json'),
+    profileStateAuthority: authority
+  })
+  fixtures.push({ directory, store })
+  store.flushOrThrow()
+  return {
+    store,
+    read: (domain: string) => readProfileStateDomain(databasePath, PROFILE_ID, domain),
+    pendSession: () => store.patchWorkspaceSession({ activeWorktreeId: 'pending-workspace' })
+  }
+}
+
+describe('SQLite durability barriers with another selective write pending', () => {
+  it('commits a reset-credit claim before returning to its provider caller', async () => {
+    const state = fixture()
+    const ledger: CodexResetCreditAttemptLedger = {
+      version: 1,
+      attempts: [
+        {
+          idempotencyKey: '158a0d86-8d8e-4589-b9c5-f53a59bdcdd8',
+          expectedScope: {
+            target: { runtime: 'host', wslDistro: null },
+            accountId: 'account',
+            accountRevision: 1,
+            offerRevision: 'v1:offer'
+          },
+          state: 'providerPending'
+        }
+      ]
+    }
+    state.pendSession()
+    await state.store.replaceCodexResetCreditAttemptLedgerAndFlush(ledger)
+    expect(state.read('codexResetCreditAttemptLedger')).toMatchObject({
+      kind: 'value',
+      value: ledger
+    })
+  })
+
+  it('commits Claude live-PTY admission before returning', () => {
+    const state = fixture()
+    state.pendSession()
+    state.store.addClaudeLivePtySessionId('claude-session')
+    expect(state.read('claudeLivePtySessionIds')).toMatchObject({
+      kind: 'value',
+      value: ['claude-session']
+    })
+  })
+
+  it('commits SSH lease admission before returning', () => {
+    const state = fixture()
+    state.pendSession()
+    state.store.upsertSshRemotePtyLease({ targetId: 'ssh-test', ptyId: 'pty-1', state: 'attached' })
+    expect(state.read('sshRemotePtyLeases')).toMatchObject({
+      kind: 'value',
+      value: [{ targetId: 'ssh-test', ptyId: 'pty-1', state: 'attached' }]
+    })
+  })
+
+  it.each(['async', 'shutdown'] as const)(
+    'persists SSH detachment through the %s barrier',
+    async (barrier) => {
+      const state = fixture()
+      state.store.upsertSshRemotePtyLease({
+        targetId: 'ssh-test',
+        ptyId: 'pty-1',
+        state: 'attached'
+      })
+      state.pendSession()
+      if (barrier === 'async') {
+        await state.store.markSshRemotePtyLeasesAsync('ssh-test', 'detached')
+      } else {
+        state.store.markSshRemotePtyLeasesForShutdown('ssh-test', 'detached')
+        await state.store.flushAsync()
+      }
+      expect(state.read('sshRemotePtyLeases')).toMatchObject({
+        kind: 'value',
+        value: [{ targetId: 'ssh-test', ptyId: 'pty-1', state: 'detached' }]
+      })
+    }
+  )
+
+  it('persists sealed SSH consumer recovery before relay setup continues', async () => {
+    const state = fixture()
+    state.pendSession()
+    await state.store.upsertSshPtyConsumerRecovery({
+      targetId: 'ssh-test',
+      clientInstanceId: 'client-test',
+      serverBuildId: 'build-test',
+      clientGeneration: 1,
+      ownerGeneration: 1,
+      ownerLease: 'secret-owner-lease'
+    })
+    const stored = state.read('sshPtyConsumerRecoveries')
+    expect(stored).toMatchObject({ kind: 'value', value: [{ targetId: 'ssh-test' }] })
+    expect(JSON.stringify(stored)).not.toContain('secret-owner-lease')
+    state.pendSession()
+    await state.store.removeSshPtyConsumerRecovery('ssh-test')
+    expect(state.read('sshPtyConsumerRecoveries')).toMatchObject({ kind: 'value', value: [] })
+  })
+
+  it('deletes an automation and its retained runs in the same commit', () => {
+    const state = fixture(buildProfileStateCutoverFixture())
+    const automation = state.store.listAutomations()[0]
+    if (!automation) {
+      throw new Error('Fixture automation is absent')
+    }
+    expect(state.store.listAutomationRuns(automation.id)).not.toHaveLength(0)
+    state.store.deleteAutomation(automation.id)
+    expect(state.read('automations')).toMatchObject({ kind: 'value', value: [] })
+    expect(state.read('automationRuns')).toMatchObject({ kind: 'value', value: [] })
+  })
+
+  it('persists the session and UI identities moved with worktree metadata', () => {
+    const seed = buildProfileStateCutoverFixture()
+    const oldId = 'repo-local::/fixture/local'
+    const newId = 'repo-local::/fixture/renamed'
+    seed.workspaceSession.activeWorktreeId = oldId
+    seed.ui.showDotfilesByWorktree = { [oldId]: true }
+    const state = fixture(seed)
+    state.store.migrateWorktreeIdentity(oldId, newId)
+    state.store.flushOrThrow()
+    expect(state.read('workspaceSession')).toMatchObject({
+      kind: 'value',
+      value: { activeWorktreeId: newId }
+    })
+    expect(state.read('ui')).toMatchObject({
+      kind: 'value',
+      value: { showDotfilesByWorktree: { [newId]: true } }
+    })
+  })
+})
diff --git a/src/main/persistence/loading-store/profile-state-flush-lifetime.ts b/src/main/persistence/loading-store/profile-state-flush-lifetime.ts
new file mode 100644
index 000000000000..215c1babe854
--- /dev/null
+++ b/src/main/persistence/loading-store/profile-state-flush-lifetime.ts
@@ -0,0 +1,34 @@
+import type { StoreRuntimeState } from './store-runtime-state'
+
+/** Lifecycle cleanup must join every accepted operation before closing its writer. */
+export async function drainProfileStateOperations(
+  operations: Iterable<Promise<unknown> | null | undefined>
+): Promise<void> {
+  const settled = await Promise.allSettled(
+    Array.from(operations, (operation) => Promise.resolve(operation))
+  )
+  for (const result of settled) {
+    if (result.status === 'rejected') {
+      throw result.reason
+    }
+  }
+}
+
+/** A flush may dispatch again after SQL completes while its sidecars are still pending. */
+export async function runProfileStateFlush(
+  runtime: Pick<StoreRuntimeState, 'pendingProfileFlushes'>,
+  operation: () => Promise<void>
+): Promise<void> {
+  let finish!: () => void
+  const pending = new Promise<void>((resolve) => {
+    finish = resolve
+  })
+  runtime.pendingProfileFlushes.add(pending)
+  try {
+    await operation()
+  } finally {
+    // Each caller owns its result; lifecycle barriers may retry a known failed capture.
+    runtime.pendingProfileFlushes.delete(pending)
+    finish()
+  }
+}
diff --git a/src/main/persistence/loading-store/profile-state-import-lifetime.test.ts b/src/main/persistence/loading-store/profile-state-import-lifetime.test.ts
new file mode 100644
index 000000000000..dd201c81cd3b
--- /dev/null
+++ b/src/main/persistence/loading-store/profile-state-import-lifetime.test.ts
@@ -0,0 +1,124 @@
+import { createSqliteTestStore } from '../../persistence-test-harness'
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, expect, it, vi } from 'vitest'
+import { agentHookServer } from '../../agent-hooks/server'
+import {
+  clearMigrationUnsupportedPty,
+  setMigrationUnsupportedPty,
+  setMigrationUnsupportedPtyPersistenceListener
+} from '../../agent-hooks/migration-unsupported-pty-state'
+import { buildProfileStateCutoverFixture } from '../profile-state-cutover-fixture'
+import * as composition from './store-domain-composition'
+import { scheduleSave } from './write-scheduling'
+import { Store } from './store'
+
+vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
+vi.mock('../../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: () => ({ nth_repo_added: 2 })
+}))
+vi.mock('../../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: () => ({ hosts: [] }),
+  sshConfigHostsToTargets: () => []
+}))
+
+const directories: string[] = []
+const stores: Store[] = []
+const livePaneKey = 'live-tab:11111111-1111-4111-8111-111111111111'
+
+it('refuses a writable Store before constructing domains without an authority', () => {
+  const createDomains = vi.spyOn(composition, 'createStoreDomains')
+  expect(() => new Store()).toThrow('requires a SQLite profile-state authority')
+  expect(createDomains).not.toHaveBeenCalled()
+})
+
+afterEach(async () => {
+  agentHookServer.setPaneKeyAliasPersistenceListener(null)
+  setMigrationUnsupportedPtyPersistenceListener(null)
+  agentHookServer.clearPaneKeyAliasesForPty('later-live-pty')
+  clearMigrationUnsupportedPty('later-live-pty')
+  for (const store of stores.splice(0)) {
+    await store.freezeWritesAsync()
+  }
+  for (const directory of directories.splice(0)) {
+    rmSync(directory, { recursive: true, force: true })
+  }
+  vi.restoreAllMocks()
+  vi.useRealTimers()
+})
+
+it.each([false, true])('isolates imported aliases and live listeners (load failure=%s)', (fail) => {
+  vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout'] })
+  const directory = mkdtempSync(join(tmpdir(), 'orca-import-lifetime-'))
+  directories.push(directory)
+  const live = createSqliteTestStore(Store, { dataFile: join(directory, 'live', 'orca-data.json') })
+  stores.push(live)
+  const source = buildProfileStateCutoverFixture(directory)
+  for (const session of [
+    source.workspaceSession,
+    ...Object.values(source.workspaceSessionsByHostId ?? {})
+  ]) {
+    if (!session) {
+      continue
+    }
+    for (const [tabId, layout] of Object.entries(session.terminalLayoutsByTabId)) {
+      layout.root = { type: 'leaf', leafId: 'pane:1' }
+      layout.activeLeafId = 'pane:1'
+      layout.ptyIdsByLeafId = { 'pane:1': `imported-${tabId}` }
+    }
+  }
+  const registerAlias = vi.spyOn(agentHookServer, 'registerPaneKeyAlias')
+  const replaceListener = vi.spyOn(agentHookServer, 'setPaneKeyAliasPersistenceListener')
+  if (fail) {
+    const createDomains = composition.createStoreDomains
+    vi.spyOn(composition, 'createStoreDomains').mockImplementationOnce((runtime) => {
+      const domains = createDomains(runtime)
+      vi.spyOn(domains.adaptation, 'hydrateFolderWorkspaceDiffComments').mockImplementationOnce(
+        () => {
+          scheduleSave(domains.scheduling)
+          throw new Error('normalization refused')
+        }
+      )
+      return domains
+    })
+  }
+  const pendingTimers = vi.getTimerCount()
+  const createImport = () =>
+    new Store({
+      dataFile: join(directory, 'imported', 'orca-data.json'),
+      serializedState: JSON.stringify(source)
+    })
+  if (fail) {
+    expect(createImport).toThrow('normalization refused')
+  } else {
+    const imported = createImport()
+    stores.push(imported)
+    expect(JSON.parse(imported.prepareProfileStateExport().json).legacyPaneKeyAliasEntries).toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({ legacyPaneKey: 'tab-local:1', ptyId: 'imported-tab-local' }),
+        expect.objectContaining({ legacyPaneKey: 'tab-remote:1', ptyId: 'imported-tab-remote' })
+      ])
+    )
+  }
+  expect(registerAlias).not.toHaveBeenCalled()
+  expect(replaceListener).not.toHaveBeenCalled()
+  expect(vi.getTimerCount()).toBe(pendingTimers)
+  agentHookServer.registerPaneKeyAlias('live-tab:1', livePaneKey, 'later-live-pty')
+  setMigrationUnsupportedPty({
+    ptyId: 'later-live-pty',
+    paneKey: livePaneKey,
+    tabId: 'live-tab',
+    worktreeId: 'live-worktree',
+    reason: 'legacy-numeric-pane-key',
+    source: 'local',
+    updatedAt: 1
+  })
+  const persisted = JSON.parse(live.prepareProfileStateExport().json)
+  expect(persisted.legacyPaneKeyAliasEntries).toEqual([
+    expect.objectContaining({ legacyPaneKey: 'live-tab:1', ptyId: 'later-live-pty' })
+  ])
+  expect(persisted.migrationUnsupportedPtyEntries).toEqual([
+    expect.objectContaining({ ptyId: 'later-live-pty', paneKey: livePaneKey })
+  ])
+})
diff --git a/src/main/persistence/loading-store/profile-state-maintenance-compatibility.test.ts b/src/main/persistence/loading-store/profile-state-maintenance-compatibility.test.ts
new file mode 100644
index 000000000000..e3313f60eb5d
--- /dev/null
+++ b/src/main/persistence/loading-store/profile-state-maintenance-compatibility.test.ts
@@ -0,0 +1,125 @@
+import { existsSync, mkdirSync, readFileSync, rmSync } from 'node:fs'
+import { describe, expect, it, vi } from 'vitest'
+import { createWorkerMaintenanceFixture } from './profile-state-maintenance-fixture'
+import { profileStateJsonExportPaths } from '../profile-state/legacy-json/profile-state-export-path'
+import { openProfileStateDatabase } from '../profile-state/profile-state-database'
+
+vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
+vi.mock('../../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: () => ({ nth_repo_added: 2 })
+}))
+vi.mock('../../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: () => ({ hosts: [] }),
+  sshConfigHostsToTargets: () => []
+}))
+
+describe('maintenance compatibility checkpoint', () => {
+  it('exports the current worker state before a clean profile switch releases its writer', async () => {
+    const { store, dataFile, readState } = await createWorkerMaintenanceFixture()
+    expect(existsSync(dataFile)).toBe(false)
+    store.updateSettings({ theme: 'dark' })
+    store.getWorkspaceSession().activeTabId = 'latest-tab'
+    const maintenance = await store.beginProfileMaintenance()
+    const snapshot = JSON.parse(readFileSync(dataFile, 'utf8'))
+    expect(snapshot).toEqual(readState())
+    expect(snapshot.settings.theme).toBe('dark')
+    expect(snapshot.workspaceSession.activeTabId).toBe('latest-tab')
+    const [retained] = profileStateJsonExportPaths(dataFile)
+    expect(JSON.parse(readFileSync(retained, 'utf8'))).toEqual(snapshot)
+    await maintenance.resume()
+    await store.runDurableMutation(() => {
+      store.updateSettings({ theme: 'light' })
+      return { value: undefined }
+    })
+    expect(readState().settings.theme).toBe('light')
+  })
+
+  it('does not publish compatibility files for a recovery pause', async () => {
+    const { store, dataFile } = await createWorkerMaintenanceFixture()
+    store.updateSettings({ theme: 'dark' })
+    await store.beginProfileMaintenance({ flush: false })
+    expect(existsSync(dataFile)).toBe(false)
+    expect(profileStateJsonExportPaths(dataFile)).toEqual([])
+  })
+
+  it('resumes admission after a known export failure while preserving the committed state', async () => {
+    const { store, authority, dataFile, readState } = await createWorkerMaintenanceFixture()
+    vi.spyOn(authority, 'writeJsonCompatibilityExportAsync').mockRejectedValueOnce(
+      new Error('export disk refused')
+    )
+    store.updateSettings({ theme: 'dark' })
+    await expect(store.beginProfileMaintenance()).rejects.toThrow('export disk refused')
+    expect(existsSync(dataFile)).toBe(false)
+    expect(readState().settings.theme).toBe('dark')
+    await store.runDurableMutation(() => {
+      store.updateSettings({ theme: 'light' })
+      return { value: undefined }
+    })
+    expect(readState().settings.theme).toBe('light')
+    await (await store.beginProfileMaintenance()).resume()
+    expect(JSON.parse(readFileSync(dataFile, 'utf8')).settings.theme).toBe('light')
+  })
+
+  it('resumes after the worker cannot read JSON before staging compatibility acceptance', async () => {
+    const { store, dataFile, readState } = await createWorkerMaintenanceFixture()
+    vi.spyOn(console, 'error').mockImplementation(() => {})
+    mkdirSync(dataFile)
+    store.updateSettings({ theme: 'dark' })
+
+    await expect(store.beginProfileMaintenance()).rejects.toMatchObject({
+      outcome: 'known-failure'
+    })
+    expect(readState().settings.theme).toBe('dark')
+    rmSync(dataFile, { recursive: true })
+    await store.runDurableMutation(() => {
+      store.updateSettings({ theme: 'light' })
+      return { value: undefined }
+    })
+    expect(readState().settings.theme).toBe('light')
+    await (await store.beginProfileMaintenance()).resume()
+    expect(JSON.parse(readFileSync(dataFile, 'utf8')).settings.theme).toBe('light')
+  })
+
+  it.each(['maintenance', 'update-preflight'] as const)(
+    'resumes saving after a rolled-back %s export leaves both JSON versions accepted',
+    async (phase) => {
+      const { store, authority, dataFile, databaseFile, profileId, readState } =
+        await createWorkerMaintenanceFixture()
+      vi.spyOn(console, 'error').mockImplementation(() => {})
+      await authority.writeJsonCompatibilityExportAsync(dataFile)
+      const opened = openProfileStateDatabase(databaseFile, profileId)
+      try {
+        opened.db.exec(`
+        CREATE TRIGGER reject_acceptance BEFORE INSERT ON profile_state_meta
+        WHEN NEW.key = 'legacy_json_acceptance'
+          AND json_type(NEW.value, '$.pending') IS NULL
+        BEGIN SELECT RAISE(ABORT, 'injected promotion failure'); END
+      `)
+      } finally {
+        opened.db.close()
+      }
+      store.updateSettings({ theme: 'dark' })
+
+      await expect(
+        phase === 'maintenance'
+          ? store.beginProfileMaintenance()
+          : store.writeLatestProfileStateJsonCompatibilityExportAsync()
+      ).rejects.toMatchObject({ outcome: 'known-failure' })
+      expect(JSON.parse(readFileSync(dataFile, 'utf8')).settings.theme).toBe('dark')
+      expect(readState().settings.theme).toBe('dark')
+      await store.runDurableMutation(() => {
+        store.updateSettings({ theme: 'light' })
+        return { value: undefined }
+      })
+      expect(readState().settings.theme).toBe('light')
+      const repaired = openProfileStateDatabase(databaseFile, profileId)
+      try {
+        repaired.db.exec('DROP TRIGGER reject_acceptance')
+      } finally {
+        repaired.db.close()
+      }
+      await (await store.beginProfileMaintenance()).resume()
+      expect(JSON.parse(readFileSync(dataFile, 'utf8')).settings.theme).toBe('light')
+    }
+  )
+})
diff --git a/src/main/persistence/loading-store/profile-state-maintenance-final-failure.test.ts b/src/main/persistence/loading-store/profile-state-maintenance-final-failure.test.ts
new file mode 100644
index 000000000000..7b9a5e16fa98
--- /dev/null
+++ b/src/main/persistence/loading-store/profile-state-maintenance-final-failure.test.ts
@@ -0,0 +1,89 @@
+import { readFileSync } from 'node:fs'
+import { describe, expect, it, vi } from 'vitest'
+import { ProfileStateWriterError } from '../profile-state/profile-state-writer-errors'
+import {
+  createWorkerMaintenanceFixture,
+  maintenanceBarrier
+} from './profile-state-maintenance-fixture'
+
+vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
+vi.mock('../../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: () => ({ nth_repo_added: 2 })
+}))
+vi.mock('../../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: () => ({ hosts: [] }),
+  sshConfigHostsToTargets: () => []
+}))
+
+describe('quit during failed profile maintenance', () => {
+  it('retries a known failed checkpoint and persists shutdown edits before closing', async () => {
+    const { store, authority, readState, dataFile } = await createWorkerMaintenanceFixture()
+    vi.spyOn(console, 'error').mockImplementation(() => {})
+    store.upsertSshRemotePtyLease({ targetId: 'remote', ptyId: 'pty', state: 'attached' })
+    await store.flushPendingOrThrowAsync()
+    const started = maintenanceBarrier()
+    const release = maintenanceBarrier()
+    const checkpoint = vi
+      .spyOn(authority, 'writeCompleteSerializedDomains')
+      .mockImplementationOnce(async () => {
+        started.resolve()
+        await release.promise
+        throw new Error('SQLITE_BUSY')
+      })
+    store.updateSettings({ theme: 'dark' })
+    const failed = expect(store.beginProfileMaintenance()).rejects.toThrow('SQLITE_BUSY')
+    await started.promise
+    store.markSshRemotePtyLeasesForShutdown('remote', 'detached')
+    const final = store.flushFinalOrThrowAsync({ exportJsonCompatibility: true })
+    const result = final.catch((error: unknown) => error)
+    release.resolve()
+    await failed
+    await expect(result).resolves.toBeUndefined()
+    expect(checkpoint).toHaveBeenCalledTimes(2)
+    expect(readState()).toMatchObject({
+      settings: { theme: 'dark' },
+      sshRemotePtyLeases: [expect.objectContaining({ state: 'detached' })]
+    })
+    expect(JSON.parse(readFileSync(dataFile, 'utf8'))).toEqual(readState())
+  })
+
+  it.each(['indeterminate', 'changed-source'] as const)(
+    'keeps %s maintenance fenced during quit',
+    async (kind) => {
+      const { store, authority, readState, peer } = await createWorkerMaintenanceFixture()
+      vi.spyOn(console, 'error').mockImplementation(() => {})
+      const durable = readState()
+      const started = maintenanceBarrier()
+      const release = maintenanceBarrier()
+      const failure =
+        kind === 'indeterminate'
+          ? new ProfileStateWriterError('test-unknown-commit', 'commit outcome unknown', kind)
+          : new Error('SQLITE_BUSY')
+      const checkpoint = vi
+        .spyOn(authority, 'writeCompleteSerializedDomains')
+        .mockImplementationOnce(async () => {
+          started.resolve()
+          await release.promise
+          if (kind === 'changed-source') {
+            const other = peer()
+            try {
+              other.writeSerializedDomains([{ domain: 'peer', payload: '{"preserved":true}' }])
+            } finally {
+              other.close()
+            }
+          }
+          throw failure
+        })
+      store.updateSettings({ theme: 'dark' })
+      const failed = expect(store.beginProfileMaintenance()).rejects.toBe(failure)
+      await started.promise
+      const final = expect(store.flushFinalOrThrowAsync()).rejects.toBe(failure)
+      release.resolve()
+      await Promise.all([failed, final])
+      expect(checkpoint).toHaveBeenCalledOnce()
+      expect(readState()).toEqual(
+        kind === 'changed-source' ? { ...durable, peer: { preserved: true } } : durable
+      )
+    }
+  )
+})
diff --git a/src/main/persistence/loading-store/profile-state-maintenance-fixture.ts b/src/main/persistence/loading-store/profile-state-maintenance-fixture.ts
new file mode 100644
index 000000000000..ba36635cc9f1
--- /dev/null
+++ b/src/main/persistence/loading-store/profile-state-maintenance-fixture.ts
@@ -0,0 +1,112 @@
+import { build } from 'esbuild'
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join, resolve } from 'node:path'
+import { afterAll, afterEach, beforeAll, vi } from 'vitest'
+import { buildProfileStateCutoverFixture } from '../profile-state-cutover-fixture'
+import { ProfileStateSqliteAuthority } from '../profile-state/profile-state-sqlite-authority'
+import { ProfileStateWorkerAuthority } from '../profile-state/profile-state-worker-authority'
+import { Store } from './store'
+
+let bundleRoot: string
+let workerOptions: { workerPath: string; backupWorkerPath: string }
+const stores: Store[] = []
+const roots: string[] = []
+const releases: (() => void)[] = []
+type ProfileFixtureLocation = { directory: string; profileId: string; cleanupRoot?: string }
+
+beforeAll(async () => {
+  bundleRoot = mkdtempSync(join(tmpdir(), 'orca-maintenance-worker-'))
+  workerOptions = {
+    workerPath: join(bundleRoot, 'profile-state-writer-worker-entry.js'),
+    backupWorkerPath: join(bundleRoot, 'profile-state-backup-worker-entry.js')
+  }
+  await build({
+    entryPoints: [
+      resolve('src/main/persistence/profile-state/profile-state-writer-worker-entry.ts'),
+      resolve('src/main/persistence/profile-state/profile-state-backup-worker-entry.ts')
+    ],
+    outdir: bundleRoot,
+    bundle: true,
+    platform: 'node',
+    format: 'cjs',
+    logLevel: 'silent'
+  })
+})
+
+afterEach(async () => {
+  for (const release of releases.splice(0)) {
+    release()
+  }
+  await Promise.all(stores.splice(0).map((store) => store.freezeWritesAsync().catch(() => {})))
+  for (const root of roots.splice(0)) {
+    rmSync(root, { recursive: true, force: true })
+  }
+  vi.restoreAllMocks()
+  vi.useRealTimers()
+})
+afterAll(() => rmSync(bundleRoot, { recursive: true, force: true }))
+
+export function maintenanceBarrier() {
+  const gate = Promise.withResolvers<void>()
+  releases.push(gate.resolve)
+  return gate
+}
+
+function paths(profile?: ProfileFixtureLocation) {
+  const directory = profile?.directory ?? mkdtempSync(join(tmpdir(), 'orca-maintenance-profile-'))
+  roots.push(profile?.cleanupRoot ?? directory)
+  return {
+    directory,
+    dataFile: join(directory, 'orca-data.json'),
+    databaseFile: join(directory, 'profile-state.db'),
+    profileId: profile?.profileId ?? 'maintenance-test'
+  }
+}
+
+export async function createWorkerMaintenanceFixture(
+  profile?: ProfileFixtureLocation,
+  onFailure?: (error: Error) => void
+) {
+  const input = paths(profile)
+  const bootstrap = new ProfileStateSqliteAuthority(input.databaseFile, input.profileId)
+  bootstrap.writeSerializedState(
+    Buffer.from(JSON.stringify(buildProfileStateCutoverFixture(input.directory)))
+  )
+  const state = bootstrap.readInitialState().takeParsedState?.()
+  const authority = new ProfileStateWorkerAuthority(bootstrap.retireForWorker(), {
+    ...workerOptions,
+    onFailure
+  })
+  await authority.ready
+  const store = new Store({
+    dataFile: input.dataFile,
+    profileStateAuthority: authority,
+    initialAuthorityState: { authority, takeParsedState: () => state }
+  })
+  stores.push(store)
+  const backup = vi.spyOn(authority, 'scheduleBackup').mockImplementation(() => {})
+  await store.flushPendingOrThrowAsync()
+  backup.mockRestore()
+  const peer = () => new ProfileStateSqliteAuthority(input.databaseFile, input.profileId)
+  const readState = () => {
+    const reader = peer()
+    try {
+      return JSON.parse(reader.readSerializedState() ?? '{}')
+    } finally {
+      reader.close()
+    }
+  }
+  return { ...input, store, authority, peer, readState }
+}
+
+export function createSqliteMaintenanceFixture() {
+  const input = paths()
+  const authority = new ProfileStateSqliteAuthority(input.databaseFile, input.profileId)
+  authority.writeSerializedState(
+    Buffer.from(JSON.stringify(buildProfileStateCutoverFixture(input.directory)))
+  )
+  const store = new Store({ dataFile: input.dataFile, profileStateAuthority: authority })
+  stores.push(store)
+  return { ...input, store, authority }
+}
diff --git a/src/main/persistence/loading-store/profile-state-maintenance-recovery.test.ts b/src/main/persistence/loading-store/profile-state-maintenance-recovery.test.ts
new file mode 100644
index 000000000000..84a849b3b264
--- /dev/null
+++ b/src/main/persistence/loading-store/profile-state-maintenance-recovery.test.ts
@@ -0,0 +1,145 @@
+import { describe, expect, it, vi } from 'vitest'
+import * as backupWorker from '../profile-state/profile-state-backup-worker'
+import {
+  createWorkerMaintenanceFixture,
+  maintenanceBarrier
+} from './profile-state-maintenance-fixture'
+
+vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
+vi.mock('../../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: () => ({ nth_repo_added: 2 })
+}))
+vi.mock('../../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: () => ({ hosts: [] }),
+  sshConfigHostsToTargets: () => []
+}))
+
+describe('failed maintenance recovery', () => {
+  it.each(['maintenance', 'final', 'freeze'] as const)(
+    '%s cancels an active backup after a routine flush completes',
+    async (kind) => {
+      const { store } = await createWorkerMaintenanceFixture()
+      const started = maintenanceBarrier()
+      const canceled = maintenanceBarrier()
+      vi.spyOn(backupWorker, 'runProfileStateBackupWorker').mockImplementationOnce(
+        async (_job, options) => {
+          started.resolve()
+          await new Promise<void>((resolve) =>
+            options?.signal?.addEventListener('abort', () => resolve(), { once: true })
+          )
+          canceled.resolve()
+          throw new Error('backup aborted')
+        }
+      )
+      await store.runDurableMutation(() => {
+        store.updateSettings({ theme: 'dark' })
+        return { value: undefined }
+      })
+      await started.promise
+      await store.flushPendingOrThrowAsync()
+      const stop =
+        kind === 'maintenance'
+          ? store.beginProfileMaintenance()
+          : kind === 'final'
+            ? store.flushFinalOrThrowAsync()
+            : store.freezeWritesAsync()
+      await canceled.promise
+      await stop
+    }
+  )
+
+  it('cancels between checkpoints without aborting an acknowledged write', async () => {
+    const { store, authority, readState } = await createWorkerMaintenanceFixture()
+    vi.spyOn(console, 'error').mockImplementation(() => {})
+    const started = maintenanceBarrier()
+    const release = maintenanceBarrier()
+    const write = authority.writeCompleteSerializedDomains.bind(authority)
+    vi.spyOn(authority, 'writeCompleteSerializedDomains').mockImplementationOnce(
+      async (domains) => {
+        started.resolve()
+        await release.promise
+        await write(domains)
+      }
+    )
+    const abort = vi.spyOn(authority, 'abort')
+    const controller = new AbortController()
+    store.updateSettings({ theme: 'dark' })
+    const pending = store.beginProfileMaintenance({ signal: controller.signal })
+    const rejected = expect(pending).rejects.toThrow('aborted')
+    await started.promise
+    controller.abort()
+    release.resolve()
+    await rejected
+    expect(abort).not.toHaveBeenCalled()
+    store.setWorkspaceSession({ ...store.getWorkspaceSession(), activeTabId: 'after-cancellation' })
+    await store.flushPendingOrThrowAsync()
+    expect(readState()).toMatchObject({
+      settings: { theme: 'dark' },
+      workspaceSession: { activeTabId: 'after-cancellation' }
+    })
+  })
+
+  it('restores the writer and snapshot admission after a known failed checkpoint', async () => {
+    const { store, authority, readState } = await createWorkerMaintenanceFixture()
+    vi.spyOn(console, 'error').mockImplementation(() => {})
+    vi.spyOn(authority, 'writeCompleteSerializedDomains').mockRejectedValueOnce(
+      new Error('disk refused')
+    )
+    store.updateSettings({ theme: 'dark' })
+    await expect(store.beginProfileMaintenance()).rejects.toThrow('disk refused')
+
+    store.setWorkspaceSession({ ...store.getWorkspaceSession(), activeTabId: 'after-failure' })
+    await store.runDurableMutation(() => {
+      store.updateSettings({ theme: 'light' })
+      return { value: undefined }
+    })
+    expect(readState()).toMatchObject({
+      settings: { theme: 'light' },
+      workspaceSession: { activeTabId: 'after-failure' }
+    })
+    await (await store.beginProfileMaintenance()).resume()
+  })
+
+  it('keeps changed storage fenced when recovering a known failure', async () => {
+    const { store, authority, peer, readState } = await createWorkerMaintenanceFixture()
+    vi.spyOn(console, 'error').mockImplementation(() => {})
+    store.updateSettings({ theme: 'dark' })
+    vi.spyOn(authority, 'writeCompleteSerializedDomains').mockImplementationOnce(async () => {
+      const writer = peer()
+      writer.writeSerializedDomains([{ domain: 'peer', payload: '{"preserved":true}' }])
+      writer.close()
+      throw new Error('disk refused')
+    })
+    await expect(store.beginProfileMaintenance()).rejects.toThrow('disk refused')
+    await expect(store.runDurableMutation(() => ({ value: undefined }))).rejects.toThrow(
+      'finalized'
+    )
+    expect(readState().peer).toEqual({ preserved: true })
+  })
+
+  it('does not extend the maintenance checkpoint for unadmitted saves', async () => {
+    const { store, authority, readState } = await createWorkerMaintenanceFixture()
+    store.updateSettings({ theme: 'dark' })
+    const started = maintenanceBarrier()
+    const release = maintenanceBarrier()
+    const write = authority.writeCompleteSerializedDomains.bind(authority)
+    const checkpoint = vi
+      .spyOn(authority, 'writeCompleteSerializedDomains')
+      .mockImplementationOnce(async (domains) => {
+        started.resolve()
+        await release.promise
+        await write(domains)
+      })
+    const pending = store.beginProfileMaintenance()
+    await started.promise
+    for (let terminalFontSize = 12; terminalFontSize < 32; terminalFontSize++) {
+      store.updateSettings({ terminalFontSize })
+    }
+    release.resolve()
+    const maintenance = await pending
+    expect(checkpoint).toHaveBeenCalledOnce()
+    await maintenance.resume()
+    await store.flushPendingOrThrowAsync()
+    expect(readState().settings.terminalFontSize).toBe(31)
+  })
+})
diff --git a/src/main/persistence/loading-store/profile-state-maintenance.test.ts b/src/main/persistence/loading-store/profile-state-maintenance.test.ts
new file mode 100644
index 000000000000..62b785ce7f94
--- /dev/null
+++ b/src/main/persistence/loading-store/profile-state-maintenance.test.ts
@@ -0,0 +1,301 @@
+import { ProfileStateSqliteAuthority } from '../profile-state/profile-state-sqlite-authority'
+import { readFileSync } from 'node:fs'
+import { describe, expect, it, vi } from 'vitest'
+import { ActiveViewPreference, getActiveViewPreferenceFile } from '../../active-view-preference'
+import * as backupWorker from '../profile-state/profile-state-backup-worker'
+import { profileStateDatabaseBackups } from '../profile-state/profile-state-backup-path'
+import {
+  createSqliteMaintenanceFixture,
+  createWorkerMaintenanceFixture,
+  maintenanceBarrier
+} from './profile-state-maintenance-fixture'
+
+vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
+vi.mock('../../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: () => ({ nth_repo_added: 2 })
+}))
+vi.mock('../../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: () => ({ hosts: [] }),
+  sshConfigHostsToTargets: () => []
+}))
+
+describe('profile maintenance admission', () => {
+  it('drains accepted writes and captures newer edits after blocking new durable operations', async () => {
+    const { store, authority, readState } = await createWorkerMaintenanceFixture()
+    const gate = maintenanceBarrier()
+    const started = maintenanceBarrier()
+    const write = authority.writeSerializedDomains.bind(authority)
+    vi.spyOn(authority, 'writeSerializedDomains').mockImplementationOnce(async (domains) => {
+      started.resolve()
+      await gate.promise
+      await write(domains)
+    })
+    const accepted = store.runDurableMutation(() => {
+      store.updateSettings({ theme: 'dark' })
+      return { value: 'accepted' }
+    })
+    await started.promise
+    const stopped = vi.spyOn(authority, 'close')
+    const paused = store.beginProfileMaintenance()
+    const refused = vi.fn(() => ({ value: undefined }))
+    await expect(store.runDurableMutation(refused)).rejects.toThrow('finalized')
+    expect(refused).not.toHaveBeenCalled()
+    await expect(store.flushPendingOrThrowAsync()).rejects.toThrow('finalized')
+    await expect(store.writeLatestProfileStateJsonExportAsync()).rejects.toThrow('finalized')
+    expect(() => store.stageWorkspaceSessionBeforeUnload(store.getWorkspaceSession())).toThrow(
+      'maintenance'
+    )
+    store.updateSettings({ theme: 'light' })
+    store.getWorkspaceSession().activeTabId = 'during-maintenance'
+    expect(stopped).not.toHaveBeenCalled()
+    gate.resolve()
+    await expect(accepted).resolves.toBe('accepted')
+    const maintenance = await paused
+    expect(stopped).toHaveBeenCalledOnce()
+    expect(readState()).toMatchObject({
+      settings: { theme: 'light' },
+      workspaceSession: { activeTabId: 'during-maintenance' }
+    })
+    store.updateSettings({ theme: 'dark' })
+    await maintenance.resume()
+    await store.flushPendingOrThrowAsync()
+    expect(readState().settings.theme).toBe('dark')
+    await expect(maintenance.resume()).rejects.toThrow('finalization')
+  })
+
+  it('refuses re-admission after a competing write without adopting its revision', async () => {
+    const { store, peer, readState } = await createWorkerMaintenanceFixture()
+    store.updateSettings({ theme: 'dark' })
+    const maintenance = await store.beginProfileMaintenance()
+    const writer = peer()
+    try {
+      writer.readSerializedState()
+      writer.writeSerializedDomains([{ domain: 'peer', payload: '{"preserved":true}' }])
+    } finally {
+      writer.close()
+    }
+    await expect(maintenance.resume()).rejects.toThrow('Profile state revision changed')
+    const mutate = vi.fn(() => ({ value: undefined }))
+    await expect(store.runDurableMutation(mutate)).rejects.toThrow('finalized')
+    expect(mutate).not.toHaveBeenCalled()
+    expect(readState().peer).toEqual({ preserved: true })
+  })
+
+  it.each(['maintenance', 'freeze', 'final'] as const)(
+    '%s waits for an admitted flush between SQL passes',
+    async (kind) => {
+      const { store, authority, readState } = await createWorkerMaintenanceFixture()
+      const started = maintenanceBarrier()
+      const release = maintenanceBarrier()
+      vi.spyOn(ActiveViewPreference.prototype, 'flushPendingAsync').mockImplementationOnce(
+        async () => {
+          started.resolve()
+          await release.promise
+        }
+      )
+      store.updateSettings({ theme: 'dark' })
+      const older = store.flushPendingOrThrowAsync()
+      await started.promise
+      store.updateSettings({ theme: 'light' })
+      const capture = vi.spyOn(authority, 'writeCompleteSerializedDomains')
+      const close = vi.spyOn(authority, 'close')
+      const paused =
+        kind === 'maintenance'
+          ? store.beginProfileMaintenance()
+          : kind === 'freeze'
+            ? store.freezeWritesAsync()
+            : store.flushFinalOrThrowAsync()
+      await new Promise<void>((resolve) => setImmediate(resolve))
+      expect(capture).not.toHaveBeenCalled()
+      expect(close).not.toHaveBeenCalled()
+      release.resolve()
+      await older
+      await paused
+      expect(close).toHaveBeenCalled()
+      expect(readState().settings.theme).toBe('light')
+    }
+  )
+
+  it.each(['maintenance', 'freeze', 'final'] as const)(
+    '%s waits for accepted retries after another flush reports a known failure',
+    async (kind) => {
+      const { store, authority, readState } = await createWorkerMaintenanceFixture()
+      vi.spyOn(console, 'error').mockImplementation(() => {})
+      const started = maintenanceBarrier()
+      const release = maintenanceBarrier()
+      vi.spyOn(ActiveViewPreference.prototype, 'flushPendingAsync').mockImplementationOnce(
+        async () => {
+          started.resolve()
+          await release.promise
+        }
+      )
+      store.updateSettings({ theme: 'dark' })
+      const accepted = store.flushPendingOrThrowAsync()
+      await started.promise
+      store.updateSettings({ theme: 'light' })
+      const failureStarted = maintenanceBarrier()
+      const fail = maintenanceBarrier()
+      vi.spyOn(authority, 'writeSerializedDomains').mockImplementationOnce(async () => {
+        failureStarted.resolve()
+        await fail.promise
+        throw new Error('disk refused')
+      })
+      const failed = expect(
+        store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
+      ).rejects.toThrow('disk refused')
+      await failureStarted.promise
+      const close = vi.spyOn(authority, 'close')
+      const paused =
+        kind === 'maintenance'
+          ? store.beginProfileMaintenance()
+          : kind === 'freeze'
+            ? store.freezeWritesAsync()
+            : store.flushFinalOrThrowAsync()
+      fail.resolve()
+      await failed
+      await new Promise<void>((resolve) => setImmediate(resolve))
+      expect(close).not.toHaveBeenCalled()
+      release.resolve()
+      await accepted
+      await paused
+      expect(close).toHaveBeenCalledOnce()
+      expect(readState().settings.theme).toBe('light')
+    }
+  )
+
+  it('cancels a backup and waits for its worker to exit before releasing maintenance', async () => {
+    const { store, authority, databaseFile } = await createWorkerMaintenanceFixture()
+    const started = maintenanceBarrier()
+    const canceled = maintenanceBarrier()
+    const release = maintenanceBarrier()
+    vi.spyOn(backupWorker, 'runProfileStateBackupWorker').mockImplementationOnce(
+      async (_job, options) => {
+        started.resolve()
+        await new Promise<void>((resolve) =>
+          options?.signal?.addEventListener('abort', () => resolve(), { once: true })
+        )
+        canceled.resolve()
+        await release.promise
+        throw new Error('backup aborted')
+      }
+    )
+    await store.runDurableMutation(() => {
+      store.updateSettings({ theme: 'dark' })
+      return { value: undefined }
+    })
+    await started.promise
+    const close = vi.spyOn(authority, 'close')
+    const paused = store.beginProfileMaintenance()
+    let done = false
+    void paused.then(() => {
+      done = true
+    })
+    await canceled.promise
+    expect(done).toBe(false)
+    expect(close).not.toHaveBeenCalled()
+    release.resolve()
+    await paused
+    expect(close).toHaveBeenCalledOnce()
+    expect(profileStateDatabaseBackups(databaseFile)).toHaveLength(0)
+  })
+
+  it('drains an accepted flush before rejecting canceled maintenance', async () => {
+    const { store, authority, readState } = await createWorkerMaintenanceFixture()
+    const started = maintenanceBarrier()
+    const release = maintenanceBarrier()
+    vi.spyOn(ActiveViewPreference.prototype, 'flushPendingAsync').mockImplementationOnce(
+      async () => {
+        started.resolve()
+        await release.promise
+      }
+    )
+    store.updateSettings({ theme: 'dark' })
+    const accepted = store.flushPendingOrThrowAsync()
+    await started.promise
+    store.updateSettings({ theme: 'light' })
+    const close = vi.spyOn(authority, 'close')
+    const controller = new AbortController()
+    controller.abort()
+    const rejected = expect(
+      store.beginProfileMaintenance({ signal: controller.signal })
+    ).rejects.toThrow('aborted')
+    await new Promise<void>((resolve) => setImmediate(resolve))
+    expect(close).not.toHaveBeenCalled()
+    release.resolve()
+    await accepted
+    await rejected
+    expect(close).toHaveBeenCalledOnce()
+    expect(readState().settings.theme).toBe('light')
+  })
+
+  it('joins an ongoing maintenance close at final shutdown without reopening or rewriting', async () => {
+    const { store, authority } = await createWorkerMaintenanceFixture()
+    const started = maintenanceBarrier()
+    const release = maintenanceBarrier()
+    const close = authority.close.bind(authority)
+    vi.spyOn(authority, 'close').mockImplementationOnce(async () => {
+      started.resolve()
+      await release.promise
+      await close()
+    })
+    const paused = store.beginProfileMaintenance()
+    await started.promise
+    const write = vi.spyOn(authority, 'writeCompleteSerializedDomains')
+    const final = store.flushFinalOrThrowAsync()
+    release.resolve()
+    const maintenance = await paused
+    await final
+    expect(write).not.toHaveBeenCalled()
+    await expect(maintenance.resume()).rejects.toThrow('finalization')
+  })
+
+  it('quarantines a faulted worker only after closing it, without writing current memory', async () => {
+    const { store, authority, directory, readState } = await createWorkerMaintenanceFixture()
+    const durable = readState()
+    store.updateSettings({ theme: durable.settings.theme === 'dark' ? 'light' : 'dark' })
+    await authority.abort()
+    const result = await store.quarantineProfileStateDatabaseAsync(directory, 'worker-failure')
+    expect(result.copiedFiles.some((path) => path.endsWith('profile-state.db'))).toBe(true)
+    expect(readState()).toEqual(durable)
+    await expect(store.flushPendingOrThrowAsync()).rejects.toThrow('finalized')
+  })
+
+  it('never provides a resume token after a faulted normal-maintenance attempt', async () => {
+    const { store, authority } = await createWorkerMaintenanceFixture()
+    vi.spyOn(console, 'error').mockImplementation(() => {})
+    await authority.abort()
+    await expect(store.beginProfileMaintenance()).rejects.toThrow('aborted')
+    await expect(store.beginProfileMaintenance()).rejects.toThrow('already stopped')
+  })
+
+  it('pauses SQLite and preference timers, then persists edits after unchanged-source resume', async () => {
+    const { store, dataFile, authority } = createSqliteMaintenanceFixture()
+    const maintenance = await store.beginProfileMaintenance()
+    const before = authority.readSerializedState()
+    const preference = getActiveViewPreferenceFile(dataFile)
+    const preferenceBefore = readFileSync(preference)
+    vi.useFakeTimers()
+    store.updateSettings({ theme: 'dark' })
+    store.updateUI({ activeView: 'settings' })
+    await vi.advanceTimersByTimeAsync(6_000)
+    expect(authority.readSerializedState()).toEqual(before)
+    expect(readFileSync(preference)).toEqual(preferenceBefore)
+    vi.useRealTimers()
+    await maintenance.resume()
+    await store.flushPendingOrThrowAsync()
+    expect(JSON.parse(authority.readSerializedState() ?? '{}').settings.theme).toBe('dark')
+    expect(JSON.parse(readFileSync(preference, 'utf8')).activeView).toBe('settings')
+  })
+
+  it('refuses synchronous SQL resume if the source changed during maintenance', async () => {
+    const { store, databaseFile, profileId } = createSqliteMaintenanceFixture()
+    const maintenance = await store.beginProfileMaintenance()
+    const peer = new ProfileStateSqliteAuthority(databaseFile, profileId)
+    peer.readSerializedState()
+    peer.writeSerializedDomains([{ domain: 'peer', payload: 'true' }])
+    peer.close()
+    await expect(maintenance.resume()).rejects.toThrow('Profile state revision changed')
+    await expect(store.flushPendingOrThrowAsync()).rejects.toThrow('finalized')
+    expect(JSON.parse(peer.readSerializedState() ?? '{}').peer).toBe(true)
+  })
+})
diff --git a/src/main/persistence/loading-store/profile-state-maintenance.ts b/src/main/persistence/loading-store/profile-state-maintenance.ts
new file mode 100644
index 000000000000..fe1c0f79d800
--- /dev/null
+++ b/src/main/persistence/loading-store/profile-state-maintenance.ts
@@ -0,0 +1,172 @@
+import { profileStateWriterFailureOutcome } from '../profile-state/profile-state-writer-errors'
+import type { ProfileStateMaintenance } from './profile-state-authority'
+import type { StoreDomains } from './store-domain-composition'
+import type { StoreRuntimeState } from './store-runtime-state'
+import { drainProfileStateOperations } from './profile-state-flush-lifetime'
+import { flushCurrentStateAsync } from './write-flush-barriers'
+import { scheduleSave } from './write-scheduling'
+
+export type ProfileStateMaintenanceOptions = {
+  signal?: AbortSignal
+  /** Recovery must preserve the existing database even when its state cannot be flushed. */
+  flush?: boolean
+}
+
+export function freezeProfileStateWrites(runtime: StoreRuntimeState): void {
+  if (runtime.profileStateAuthority?.asynchronous) {
+    throw new Error('Live profile persistence requires an awaited close')
+  }
+  runtime.writesFrozen = true
+  if (runtime.writeTimer) {
+    clearTimeout(runtime.writeTimer)
+    runtime.writeTimer = null
+  }
+  runtime.profileStateAuthority?.close?.()
+}
+
+export async function freezeProfileStateWritesAsync(runtime: StoreRuntimeState): Promise<void> {
+  runtime.quitFlushStarted = true
+  if (runtime.writeTimer) {
+    clearTimeout(runtime.writeTimer)
+    runtime.writeTimer = null
+  }
+  try {
+    await drainProfileStateOperations([
+      runtime.pendingProfileMaintenance,
+      runtime.activeViewPreference.flushAsync(),
+      drainProfileFileWork(runtime)
+    ])
+  } finally {
+    runtime.writesFrozen = true
+    await runtime.profileStateAuthority?.close?.()
+  }
+}
+
+/** Stop admission before the first await; only unchanged-source maintenance may resume. */
+export function beginProfileStateMaintenance(
+  runtime: StoreRuntimeState,
+  domains: StoreDomains,
+  options: ProfileStateMaintenanceOptions = {}
+): Promise<ProfileStateMaintenance> {
+  if (runtime.profileMaintenancePending || runtime.quitFlushStarted || runtime.writesFrozen) {
+    return Promise.reject(new Error('Profile persistence is already stopped for maintenance'))
+  }
+  runtime.profileMaintenancePending = true
+  if (runtime.writeTimer) {
+    clearTimeout(runtime.writeTimer)
+    runtime.writeTimer = null
+  }
+  const resumePreference = runtime.activeViewPreference.pauseForMaintenance()
+  const resumeScheduling = () => {
+    runtime.writesFrozen = false
+    runtime.profileMaintenancePending = false
+    runtime.pendingProfileMaintenance = null
+    resumePreference()
+    scheduleSave(domains.scheduling)
+  }
+  const paused = pauseProfileState(runtime, domains, options).then((authority) => {
+    let consumed = false
+    return {
+      resume: async () => {
+        if (consumed || runtime.quitFlushStarted || !runtime.profileMaintenancePending) {
+          throw new Error('Profile persistence cannot resume after finalization')
+        }
+        consumed = true
+        await authority.resume()
+        if (runtime.quitFlushStarted) {
+          await runtime.profileStateAuthority?.close?.()
+          throw new Error('Profile persistence finalized during maintenance admission')
+        }
+        resumeScheduling()
+      }
+    }
+  })
+  const recoverable = paused.catch(async (error: unknown) => {
+    if (await canResumeFailedMaintenance(runtime, options, error)) {
+      resumeScheduling()
+    } else {
+      runtime.writesFrozen = true
+      await runtime.profileStateAuthority?.close?.()
+    }
+    throw error
+  })
+  runtime.pendingProfileMaintenance = recoverable.then(() => {})
+  void runtime.pendingProfileMaintenance.catch(() => {})
+  return recoverable
+}
+
+async function canResumeFailedMaintenance(
+  runtime: StoreRuntimeState,
+  options: ProfileStateMaintenanceOptions,
+  error: unknown
+): Promise<boolean> {
+  try {
+    await drainProfileFileWork(runtime)
+    if (
+      options.flush === false ||
+      runtime.writesFrozen ||
+      profileStateWriterFailureOutcome(error) === 'indeterminate'
+    ) {
+      return false
+    }
+    const authority = runtime.profileStateAuthority
+    if (authority?.asynchronous) {
+      authority.assertWritable()
+    }
+    await (authority?.pauseForMaintenance
+      ? (await authority.pauseForMaintenance()).resume()
+      : authority?.assertCurrentRevision?.())
+    return true
+  } catch {
+    return false
+  }
+}
+
+async function pauseProfileState(
+  runtime: StoreRuntimeState,
+  domains: StoreDomains,
+  { signal, flush = true }: ProfileStateMaintenanceOptions
+): Promise<ProfileStateMaintenance> {
+  const authority = runtime.profileStateAuthority
+  signal?.throwIfAborted()
+  await drainProfileFileWork(runtime)
+  signal?.throwIfAborted()
+  if (flush) {
+    // Cancel between commands so a dispatched commit retains a known outcome.
+    await flushCurrentStateAsync(domains.flushBarriers, {
+      requireInitialGenerationDurable: true,
+      fullCheckpoint: true
+    })
+    signal?.throwIfAborted()
+    await authority?.writeJsonCompatibilityExportAsync?.(runtime.dataFile)
+  }
+  signal?.throwIfAborted()
+  runtime.writesFrozen = true
+  if (!flush) {
+    await authority?.close?.()
+    return {
+      resume: async () => {
+        throw new Error('Recovery maintenance requires reloading the profile')
+      }
+    }
+  }
+  if (authority?.pauseForMaintenance) {
+    return authority.pauseForMaintenance()
+  }
+  await authority?.close?.()
+  throw new Error('Profile authority cannot safely resume from maintenance')
+}
+
+async function drainProfileFileWork(runtime: StoreRuntimeState): Promise<void> {
+  await drainProfileStateOperations([
+    ...runtime.pendingProfileFlushes,
+    runtime.staleProfileStateTempCleanup,
+    runtime.pendingWrite,
+    runtime.pendingSnapshotFileWork,
+    runtime.pendingGithubCacheWrite,
+    runtime.activeViewPreference.waitForPendingWrite(),
+    runtime.profileStateAuthority?.drainBackups?.(
+      runtime.profileMaintenancePending || runtime.quitFlushStarted
+    )
+  ])
+}
diff --git a/src/main/persistence/loading-store/profile-state-pty-retirement-finalization.test.ts b/src/main/persistence/loading-store/profile-state-pty-retirement-finalization.test.ts
new file mode 100644
index 000000000000..3fe645629977
--- /dev/null
+++ b/src/main/persistence/loading-store/profile-state-pty-retirement-finalization.test.ts
@@ -0,0 +1,199 @@
+import { describe, expect, it, vi } from 'vitest'
+import { toSshExecutionHostId } from '../../../shared/execution-host'
+import { retirePersistedStablePaneOwner } from '../../ipc/pty/pane/stable-owner'
+import { TEST_LEAF_1 } from '../../persistence-session-fixtures'
+import { ProfileStateWriterError } from '../profile-state/profile-state-writer-errors'
+import {
+  createWorkerMaintenanceFixture,
+  maintenanceBarrier
+} from './profile-state-maintenance-fixture'
+import type { Store } from './store'
+
+vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
+vi.mock('../../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: () => ({ nth_repo_added: 2 })
+}))
+vi.mock('../../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: () => ({ hosts: [] }),
+  sshConfigHostsToTargets: () => []
+}))
+
+const binding = {
+  worktreeId: 'repo-local::/fixture/local',
+  tabId: 'finalizing-retirement-tab',
+  leafId: TEST_LEAF_1,
+  ptyId: 'finalizing-retirement-pty',
+  incarnationId: 'finalizing-retirement-incarnation'
+}
+
+function retire(store: Store, connectionId?: string) {
+  return retirePersistedStablePaneOwner(
+    store,
+    { ...binding, persistedIncarnationId: binding.incarnationId },
+    binding.worktreeId,
+    connectionId
+  )
+}
+
+function assertNewSnapshotsRefused(store: Store) {
+  const session = store.getWorkspaceSession()
+  expect(() => store.setWorkspaceSession(session)).toThrow('blocking new terminal snapshot work')
+  expect(() => store.stageWorkspaceSessionBeforeUnload(session)).toThrow(
+    'blocking new terminal snapshot work'
+  )
+}
+
+describe.each([
+  ['running', undefined],
+  ['maintenance', undefined],
+  ['freeze', undefined],
+  ['final', undefined],
+  ['running', 'retirement-ssh'],
+  ['maintenance', 'retirement-ssh'],
+  ['freeze', 'retirement-ssh'],
+  ['final', 'retirement-ssh']
+] as const)('admitted terminal retirement during %s on host %s', (kind, connectionId) => {
+  const hostId = connectionId ? toSshExecutionHostId(connectionId) : undefined
+  const persistedSession = (
+    readState: Awaited<ReturnType<typeof createWorkerMaintenanceFixture>>['readState']
+  ) => {
+    const state = readState()
+    return hostId ? state.workspaceSessionsByHostId[hostId] : state.workspaceSession
+  }
+  const stop = (store: Store) =>
+    kind === 'maintenance'
+      ? store.beginProfileMaintenance()
+      : kind === 'freeze'
+        ? store.freezeWritesAsync()
+        : kind === 'final'
+          ? store.flushFinalOrThrowAsync()
+          : Promise.resolve()
+  const assertSnapshotAdmission = (store: Store) => {
+    if (kind !== 'running') {
+      assertNewSnapshotsRefused(store)
+    }
+  }
+
+  it('persists an accepted queued retirement while refusing new snapshots', async () => {
+    const { store, authority, readState } = await createWorkerMaintenanceFixture()
+    vi.spyOn(console, 'error').mockImplementation(() => {})
+    await store.persistPtyBinding(binding, hostId)
+    const started = maintenanceBarrier()
+    const release = maintenanceBarrier()
+    const write = authority.writeSerializedDomains.bind(authority)
+    vi.spyOn(authority, 'writeSerializedDomains').mockImplementationOnce(async (domains) => {
+      started.resolve()
+      await release.promise
+      await write(domains)
+    })
+    store.updateSettings({ theme: 'dark' })
+    const previous = store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
+    await started.promise
+    const accepted = retire(store, connectionId).then(
+      (value) => ({ value }),
+      (error: unknown) => ({ error })
+    )
+    const stopping = stop(store)
+    assertSnapshotAdmission(store)
+    release.resolve()
+    await previous
+    await stopping
+    expect(await accepted).toEqual({ value: true })
+    expect(persistedSession(readState).terminalLayoutsByTabId[binding.tabId]).toBeUndefined()
+    assertSnapshotAdmission(store)
+  })
+
+  it('finishes a failed retirement rollback before closing its writer', async () => {
+    const { store, authority, readState } = await createWorkerMaintenanceFixture()
+    vi.spyOn(console, 'error').mockImplementation(() => {})
+    await store.persistPtyBinding(binding, hostId)
+    const original = structuredClone(store.getWorkspaceSession(hostId))
+    const started = maintenanceBarrier()
+    const release = maintenanceBarrier()
+    const failure = new ProfileStateWriterError(
+      'test-disk-failure',
+      'retirement disk refused',
+      'known-failure'
+    )
+    vi.spyOn(authority, 'writeSerializedDomains').mockImplementationOnce(async () => {
+      started.resolve()
+      await release.promise
+      throw failure
+    })
+    const rejected = retire(store, connectionId).catch((error: unknown) => error)
+    await started.promise
+    expect(store.getWorkspaceSession(hostId).terminalLayoutsByTabId[binding.tabId]).toBeUndefined()
+    store.getWorkspaceSession(hostId).activeTabId = 'newer-active-tab'
+    const stopping = stop(store)
+    assertSnapshotAdmission(store)
+    release.resolve()
+    await stopping
+    expect(await rejected).toBe(failure)
+    expect(store.getWorkspaceSession(hostId)).toEqual({
+      ...original,
+      activeTabId: 'newer-active-tab'
+    })
+    expect(persistedSession(readState).terminalLayoutsByTabId[binding.tabId]).toEqual(
+      original.terminalLayoutsByTabId[binding.tabId]
+    )
+    assertSnapshotAdmission(store)
+  })
+})
+
+describe.each(['mutate', 'rollback'] as const)('admitted %s scope', (phase) => {
+  it('preserves durable state and refuses later saves after a callback partially mutates then throws', async () => {
+    const { store, authority, readState } = await createWorkerMaintenanceFixture()
+    const original = readState()
+    vi.spyOn(console, 'error').mockImplementation(() => {})
+    const failure = new Error('callback failed')
+    if (phase === 'rollback') {
+      vi.spyOn(authority, 'writeSerializedDomains').mockRejectedValueOnce(new Error('disk refused'))
+    }
+    await expect(
+      store.runDurableMutation(() => {
+        store.updateSettings({ theme: 'dark' })
+        if (phase === 'mutate') {
+          throw failure
+        }
+        return {
+          value: undefined,
+          rollback: () => {
+            throw failure
+          }
+        }
+      })
+    ).rejects.toBe(failure)
+    assertNewSnapshotsRefused(store)
+    await expect(store.runDurableMutation(() => ({ value: undefined }))).rejects.toThrow(
+      'finalized'
+    )
+    await expect(store.flushFinalOrThrowAsync()).rejects.toBe(failure)
+    expect(readState()).toEqual(original)
+  })
+})
+
+it('rejects an already admitted final flush after a queued callback partially mutates then throws', async () => {
+  const { store, authority, readState } = await createWorkerMaintenanceFixture()
+  vi.spyOn(console, 'error').mockImplementation(() => {})
+  const started = maintenanceBarrier()
+  const release = maintenanceBarrier()
+  const write = authority.writeSerializedDomains.bind(authority)
+  vi.spyOn(authority, 'writeSerializedDomains').mockImplementationOnce(async (domains) => {
+    started.resolve()
+    await release.promise
+    await write(domains)
+  })
+  store.updateSettings({ theme: 'dark' })
+  const previous = store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
+  await started.promise
+  const failure = new Error('partial edit failed')
+  const mutation = store.runDurableMutation(() => {
+    store.updateSettings({ theme: 'light' })
+    throw failure
+  })
+  const rejectedMutation = expect(mutation).rejects.toBe(failure)
+  const rejectedFinal = expect(store.flushFinalOrThrowAsync()).rejects.toBe(failure)
+  release.resolve()
+  await Promise.all([previous, rejectedMutation, rejectedFinal])
+  expect(readState().settings.theme).toBe('dark')
+})
diff --git a/src/main/persistence/loading-store/profile-state-selective-serialization.test.ts b/src/main/persistence/loading-store/profile-state-selective-serialization.test.ts
new file mode 100644
index 000000000000..acb8c0f31054
--- /dev/null
+++ b/src/main/persistence/loading-store/profile-state-selective-serialization.test.ts
@@ -0,0 +1,272 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { getDefaultPersistedState } from '../../../shared/constants'
+import { ProtectedSecretPersistence } from '../../protected-secret-persistence'
+import { serializeSelectiveProfileStateDomains } from './profile-state-authority-writes'
+import { StateSerializationSecretHandlingOperations } from './state-serialization-secret-handling'
+
+function previousReplacements(state: Record<string, unknown>, domains: ReadonlySet<string>) {
+  const parsed: unknown = JSON.parse(Buffer.from(JSON.stringify(state), 'utf8').toString('utf8'))
+  if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) {
+    throw new Error('Profile state payload must be a JSON object')
+  }
+  const entries = new Map(Object.entries(parsed))
+  return [...domains].map((domain) => ({
+    domain,
+    payload: entries.has(domain) ? JSON.stringify(entries.get(domain)) : null
+  }))
+}
+
+afterEach(() => vi.restoreAllMocks())
+
+describe('selective profile domain serialization', () => {
+  it('preserves deletion, JSON null, primitive roots, and escaped property values', () => {
+    const escapedDomain = '雪"\\\ud800'
+    const state = Object.fromEntries([
+      ['undefined', undefined],
+      ['function', () => 'omitted'],
+      ['symbol', Symbol('omitted')],
+      ['null', null],
+      ['string', '雪😀\ud800\n"\\'],
+      ['number', -0],
+      ['nan', Number.NaN],
+      ['infinity', Infinity],
+      ['false', false],
+      ['array', [undefined, null, Number.NaN, Symbol('omitted'), () => 'omitted']],
+      ['date', new Date('2026-09-26T00:00:00Z')],
+      ['__proto__', { own: true }],
+      [escapedDomain, { '2': 'two', '1': 'one', omitted: undefined }]
+    ])
+    const domains = new Set([...Object.keys(state).toReversed(), 'missing', 'constructor'])
+
+    expect(serializeSelectiveProfileStateDomains(state, domains)).toEqual(
+      previousReplacements(state, domains)
+    )
+    expect(serializeSelectiveProfileStateDomains(state, new Set(['undefined', 'null']))).toEqual([
+      { domain: 'undefined', payload: null },
+      { domain: 'null', payload: 'null' }
+    ])
+  })
+
+  it('passes the same keys and receiver to toJSON exactly once in state property order', () => {
+    const calls: string[] = []
+    const first = {
+      text: 'before',
+      toJSON(key: string) {
+        expect(this).toBe(first)
+        calls.push(key)
+        second.text = 'after'
+        return {
+          text: this.text,
+          child: { toJSON: (childKey: string) => childKey }
+        }
+      }
+    }
+    const second = {
+      text: 'before',
+      toJSON(key: string) {
+        expect(this).toBe(second)
+        calls.push(key)
+        return this.text
+      }
+    }
+    const omitted = { toJSON: (key: string) => void calls.push(key) }
+    const state = { first, second, omitted }
+    const domains = new Set(['second', 'omitted', 'first'])
+    const expected = previousReplacements(state, domains)
+    calls.length = 0
+    second.text = 'before'
+
+    expect(serializeSelectiveProfileStateDomains(state, domains)).toEqual(expected)
+    expect(calls).toEqual(['first', 'second', 'omitted'])
+  })
+
+  it('still rejects cyclic and BigInt state before handing anything to the authority', () => {
+    const cyclic: Record<string, unknown> = {}
+    cyclic.self = cyclic
+    for (const value of [cyclic, 1n]) {
+      expect(() =>
+        serializeSelectiveProfileStateDomains({ session: value }, new Set(['session']))
+      ).toThrow(TypeError)
+    }
+  })
+
+  it('reads later domains after earlier toJSON hooks replace or delete them', () => {
+    const buildState = () => {
+      const state: Record<string, unknown> = {
+        first: {
+          toJSON() {
+            state.replaced = { text: 'after' }
+            delete state.deleted
+            state.added = 'outside the captured keys'
+            return 'first'
+          }
+        },
+        replaced: { text: 'before' },
+        deleted: 'before'
+      }
+      return state
+    }
+    const domains = new Set(['deleted', 'replaced', 'first', 'added'])
+    const expected = previousReplacements(buildState(), domains)
+
+    expect(expected).toEqual([
+      { domain: 'deleted', payload: null },
+      { domain: 'replaced', payload: '{"text":"after"}' },
+      { domain: 'first', payload: '"first"' },
+      { domain: 'added', payload: null }
+    ])
+    expect(serializeSelectiveProfileStateDomains(buildState(), domains)).toEqual(expected)
+  })
+
+  it('interleaves domain getters and toJSON hooks in JSON property order', () => {
+    const buildState = (calls: string[]) => {
+      let text = 'before'
+      return {
+        get first() {
+          calls.push('get first')
+          return {
+            toJSON() {
+              calls.push('serialize first')
+              text = 'after'
+              return 'first'
+            }
+          }
+        },
+        get second() {
+          calls.push('get second')
+          return text
+        }
+      }
+    }
+    const domains = new Set(['first', 'second'])
+    const expectedCalls: string[] = []
+    const expected = previousReplacements(buildState(expectedCalls), domains)
+    const actualCalls: string[] = []
+
+    expect(serializeSelectiveProfileStateDomains(buildState(actualCalls), domains)).toEqual(
+      expected
+    )
+    expect(actualCalls).toEqual(expectedCalls)
+    expect(actualCalls).toEqual(['get first', 'serialize first', 'get second'])
+  })
+
+  it.each(['1.0', '1e999', '9007199254740993', '"\\u0061"', '"\ud800"', '"\\uD800"'])(
+    'normalizes raw JSON from a production domain hook like the previous path: %s',
+    (raw) => {
+      if (!('rawJSON' in JSON) || typeof JSON.rawJSON !== 'function') {
+        throw new Error('This test requires native JSON.rawJSON support')
+      }
+      const rawValue: unknown = JSON.rawJSON(raw)
+      const state = getDefaultPersistedState('/synthetic-profile')
+      const serialize = vi.fn(() => ({ ...state.workspaceSession, extension: rawValue }))
+      Object.defineProperty(state.workspaceSession, 'toJSON', { value: serialize })
+      const domains = new Set(['workspaceSession'])
+      const expected = previousReplacements({ workspaceSession: state.workspaceSession }, domains)
+      serialize.mockClear()
+      const serialization = new StateSerializationSecretHandlingOperations({
+        state,
+        protectedSecrets: new ProtectedSecretPersistence()
+      })
+
+      expect(serialization.buildStateDomainsToSave(domains)?.replacements).toEqual(expected)
+      expect(serialize).toHaveBeenCalledExactlyOnceWith('workspaceSession')
+    }
+  )
+
+  it('normalizes proxy key order without re-running its getters or toJSON', () => {
+    const read = vi.fn(() => 'one')
+    const value = new Proxy(
+      {
+        get 1() {
+          return read()
+        },
+        2: 'two'
+      },
+      { ownKeys: () => ['2', '1'] }
+    )
+    const serialize = vi.fn(() => value)
+    const state = { workspaceSession: { child: { toJSON: serialize } } }
+    const domains = new Set(['workspaceSession'])
+    const expected = previousReplacements(state, domains)
+    read.mockClear()
+    serialize.mockClear()
+
+    expect(serializeSelectiveProfileStateDomains(state, domains)).toEqual(expected)
+    expect(read).toHaveBeenCalledOnce()
+    expect(serialize).toHaveBeenCalledExactlyOnceWith('child')
+  })
+
+  it('captures production domain references before hooks replace runtime fields', () => {
+    const state = getDefaultPersistedState('/synthetic-profile')
+    state.worktreeIdentityAliases = { captured: ['identity'] }
+    const capturedAliases = state.worktreeIdentityAliases
+    const capturedAutomations = state.automations
+    Object.defineProperty(state.workspaceSession, 'toJSON', {
+      value: () => {
+        state.automations = []
+        delete state.worktreeIdentityAliases
+        return 'session'
+      }
+    })
+    const domains = new Set(['workspaceSession', 'automations', 'worktreeIdentityAliases'])
+    const serialization = new StateSerializationSecretHandlingOperations({
+      state,
+      protectedSecrets: new ProtectedSecretPersistence()
+    })
+
+    expect(serialization.buildStateDomainsToSave(domains)?.replacements).toEqual([
+      { domain: 'workspaceSession', payload: '"session"' },
+      { domain: 'automations', payload: JSON.stringify(capturedAutomations) },
+      { domain: 'worktreeIdentityAliases', payload: JSON.stringify(capturedAliases) }
+    ])
+    expect(state.automations).not.toBe(capturedAutomations)
+    expect(state.worktreeIdentityAliases).toBeUndefined()
+  })
+
+  it('serializes each selected domain once without an aggregate parse or UTF-8 buffer', () => {
+    const state = getDefaultPersistedState('/synthetic-profile')
+    state.workspaceSession.activeTabId = 'x'.repeat(200_000)
+    const serialization = new StateSerializationSecretHandlingOperations({
+      state,
+      protectedSecrets: new ProtectedSecretPersistence()
+    })
+    const domains = new Set(['workspaceSession', 'automations', 'worktreeIdentityAliases'])
+    const expected = previousReplacements(
+      {
+        workspaceSession: state.workspaceSession,
+        automations: state.automations
+      },
+      domains
+    )
+    const stringify = vi.spyOn(JSON, 'stringify')
+    const parse = vi.spyOn(JSON, 'parse')
+    const encode = vi.spyOn(Buffer, 'from')
+
+    const built = serialization.buildStateDomainsToSave(domains)
+    const stringifiedObjects = stringify.mock.calls
+      .map(([value]) => value)
+      .filter((value) => value !== null && typeof value === 'object')
+    const parseCount = parse.mock.calls.length
+    const encodeCount = encode.mock.calls.length
+    vi.restoreAllMocks()
+
+    expect(built?.replacements).toEqual(expected)
+    expect(stringifiedObjects.map((value) => Object.keys(value))).toEqual([
+      ['workspaceSession'],
+      ['automations']
+    ])
+    expect(parseCount).toBe(0)
+    expect(encodeCount).toBe(0)
+  })
+
+  it('retains the full-write fallback for unknown domains or pending secret encryption', () => {
+    const protectedSecrets = new ProtectedSecretPersistence()
+    const serialization = new StateSerializationSecretHandlingOperations({
+      state: getDefaultPersistedState('/synthetic-profile'),
+      protectedSecrets
+    })
+    expect(serialization.buildStateDomainsToSave(new Set(['future-domain']))).toBeUndefined()
+    vi.spyOn(protectedSecrets, 'hasPendingEncryption').mockReturnValue(true)
+    expect(serialization.buildStateDomainsToSave(new Set(['workspaceSession']))).toBeUndefined()
+  })
+})
diff --git a/src/main/persistence/loading-store/profile-state-selective-write.ts b/src/main/persistence/loading-store/profile-state-selective-write.ts
new file mode 100644
index 000000000000..286626c33c23
--- /dev/null
+++ b/src/main/persistence/loading-store/profile-state-selective-write.ts
@@ -0,0 +1,98 @@
+import type { ProtectedSecretRetentionUpdate } from '../../protected-secret-persistence'
+import type {
+  ProfileStateAuthority,
+  ProfileStateDomainReplacement,
+  ProfileStatePersistenceAuthority
+} from './profile-state-authority'
+import type { StateSerializationSecretHandlingOperations } from './state-serialization-secret-handling'
+import type { AutomationRun } from '../../../shared/automations-types'
+
+export type SelectiveProfileStateWriteResult = {
+  handled: boolean
+  aborted: boolean
+  consumedAutomationRuns: boolean
+  protectedSecretUpdates: ProtectedSecretRetentionUpdate[]
+}
+
+export type PreparedSelectiveProfileStateWrite = {
+  replacements: ProfileStateDomainReplacement[]
+  automationRuns: readonly AutomationRun[] | undefined
+  consumedAutomationRuns: boolean
+  protectedSecretUpdates: ProtectedSecretRetentionUpdate[]
+}
+
+export function writeSelectiveProfileState(
+  authority: ProfileStateAuthority | undefined,
+  serialization: StateSerializationSecretHandlingOperations,
+  dirtyDomains: Set<string> | null,
+  pendingAutomationRunsAfter: readonly AutomationRun[] | undefined,
+  isCurrent?: () => boolean
+): SelectiveProfileStateWriteResult {
+  const prepared = prepareSelectiveProfileStateWrite(
+    authority,
+    serialization,
+    dirtyDomains,
+    pendingAutomationRunsAfter
+  )
+  if (!prepared) {
+    return {
+      handled: false,
+      aborted: false,
+      consumedAutomationRuns: false,
+      protectedSecretUpdates: []
+    }
+  }
+  if (isCurrent && !isCurrent()) {
+    return {
+      handled: true,
+      aborted: true,
+      consumedAutomationRuns: false,
+      protectedSecretUpdates: []
+    }
+  }
+  if (prepared.automationRuns !== undefined) {
+    authority?.writeSerializedAutomationRuns?.(prepared.replacements, prepared.automationRuns)
+  } else {
+    authority?.writeSerializedDomains?.(prepared.replacements)
+  }
+  dirtyDomains?.clear()
+  return {
+    handled: true,
+    aborted: false,
+    consumedAutomationRuns: prepared.consumedAutomationRuns,
+    protectedSecretUpdates: prepared.protectedSecretUpdates
+  }
+}
+
+export function prepareSelectiveProfileStateWrite(
+  authority: ProfileStatePersistenceAuthority | undefined,
+  serialization: StateSerializationSecretHandlingOperations,
+  dirtyDomains: ReadonlySet<string> | null,
+  pendingAutomationRunsAfter: readonly AutomationRun[] | undefined
+): PreparedSelectiveProfileStateWrite | undefined {
+  if (
+    !authority ||
+    dirtyDomains === null ||
+    dirtyDomains.size === 0 ||
+    !authority.writeSerializedDomains
+  ) {
+    return undefined
+  }
+  const useAutomationDelta =
+    pendingAutomationRunsAfter !== undefined &&
+    authority.writeSerializedAutomationRuns !== undefined
+  const serializableDomains = useAutomationDelta
+    ? new Set([...dirtyDomains].filter((domain) => domain !== 'automationRuns'))
+    : dirtyDomains
+  const built = serialization.buildStateDomainsToSave(serializableDomains)
+  if (built === undefined) {
+    return undefined
+  }
+  const { replacements, protectedSecretUpdates } = built
+  return {
+    replacements,
+    automationRuns: useAutomationDelta ? pendingAutomationRunsAfter : undefined,
+    consumedAutomationRuns: pendingAutomationRunsAfter !== undefined,
+    protectedSecretUpdates
+  }
+}
diff --git a/src/main/persistence/loading-store/profile-state-settings-writes.test.ts b/src/main/persistence/loading-store/profile-state-settings-writes.test.ts
new file mode 100644
index 000000000000..e7f64b6278a4
--- /dev/null
+++ b/src/main/persistence/loading-store/profile-state-settings-writes.test.ts
@@ -0,0 +1,320 @@
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { getDefaultPersistedState } from '../../../shared/constants'
+import { setSecretStore } from '../../../shared/secret-store'
+import { buildProfileStateCutoverFixture } from '../profile-state-cutover-fixture'
+import { openProfileStateDatabaseReadOnly } from '../profile-state/profile-state-database'
+import { readProfileStateSnapshot } from '../profile-state/profile-state-documents'
+import { parseProfileStateRoot } from '../profile-state/profile-state-document-validation'
+import { ProfileStateSqliteAuthority } from '../profile-state/profile-state-sqlite-authority'
+import { Store } from './store'
+
+vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
+vi.mock('../../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: () => ({ nth_repo_added: 2 })
+}))
+vi.mock('../../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: () => ({ hosts: [] }),
+  sshConfigHostsToTargets: () => []
+}))
+
+const ORIGINAL = {
+  opencodeSessionCookie: 'original-cookie',
+  httpProxyUrl: 'http://original:password@proxy.test:8080'
+}
+type Failure = 'none' | 'unavailable' | 'availability' | 'encryption' | 'decryption'
+let failure: Failure = 'none'
+let nonce = 0
+const directories: string[] = []
+const stores: Store[] = []
+
+beforeEach(() => {
+  failure = 'none'
+  nonce = 0
+  setSecretStore({
+    isEncryptionAvailable: () => {
+      if (failure === 'availability') {
+        throw new Error('keychain unavailable')
+      }
+      return failure !== 'unavailable'
+    },
+    encryptString: (plaintext) => {
+      if (failure === 'encryption') {
+        throw new Error('encryption failed')
+      }
+      return Buffer.from(`cipher:${++nonce}:${plaintext}`)
+    },
+    decryptString: (ciphertext) => {
+      if (failure === 'decryption') {
+        throw new Error('decryption failed')
+      }
+      const value = ciphertext.toString()
+      if (!value.startsWith('cipher:')) {
+        throw new Error('invalid ciphertext')
+      }
+      return value.slice(value.indexOf(':', 'cipher:'.length) + 1)
+    },
+    describeProtectionGap: () => null
+  })
+  vi.spyOn(ProfileStateSqliteAuthority.prototype, 'scheduleBackup').mockImplementation(() => {})
+})
+
+afterEach(async () => {
+  for (const store of stores.splice(0)) {
+    store.freezeWrites()
+    await store.flushAsync()
+  }
+  for (const directory of directories.splice(0)) {
+    rmSync(directory, { recursive: true, force: true })
+  }
+  vi.restoreAllMocks()
+})
+
+function fixture() {
+  const directory = mkdtempSync(join(tmpdir(), 'orca-settings-domain-'))
+  directories.push(directory)
+  const databasePath = join(directory, 'profile-state.db')
+  const dataFile = join(directory, 'orca-data.json')
+  const profileId = 'settings-domain'
+  const authority = new ProfileStateSqliteAuthority(databasePath, profileId)
+  const fixtureState = buildProfileStateCutoverFixture(directory)
+  authority.writeSerializedState(
+    Buffer.from(
+      JSON.stringify({
+        ...getDefaultPersistedState(directory),
+        automationRuns: fixtureState.automationRuns,
+        futureTopLevelExtension: fixtureState.futureTopLevelExtension
+      })
+    )
+  )
+  const createStore = (storage = new ProfileStateSqliteAuthority(databasePath, profileId)) => {
+    const store = new Store({ dataFile, profileStateAuthority: storage })
+    stores.push(store)
+    return store
+  }
+  const store = createStore(authority)
+  store.updateSettings(ORIGINAL)
+  store.flushOrThrow()
+  const read = () => {
+    const opened = openProfileStateDatabaseReadOnly(databasePath, profileId)
+    try {
+      return {
+        state: parseProfileStateRoot(readProfileStateSnapshot(opened.db).json),
+        otherDocuments: opened.db
+          .prepare(
+            "SELECT * FROM profile_state_documents WHERE domain <> 'settings' ORDER BY rowid"
+          )
+          .all(),
+        runs: opened.db.prepare('SELECT * FROM profile_state_automation_runs ORDER BY run_id').all()
+      }
+    } finally {
+      opened.db.close()
+    }
+  }
+  return { store, authority, read, reopen: () => createStore() }
+}
+
+describe('selective SQLite settings persistence', () => {
+  it.each(['sync', 'async'] as const)(
+    'saves settings through the %s barrier without rewriting history or unknown domains',
+    async (mode) => {
+      const state = fixture()
+      const before = state.read()
+      const wholeWrite = vi.spyOn(state.authority, 'writeCompleteSerializedDomains')
+      state.store.updateSettings({ terminalFontSize: 19, httpProxyBypassRules: '*.internal' })
+      if (mode === 'sync') {
+        state.store.flushOrThrow()
+      } else {
+        await state.store.flushPendingOrThrowAsync()
+      }
+      expect(wholeWrite).not.toHaveBeenCalled()
+      const after = state.read()
+      expect(after.otherDocuments).toEqual(before.otherDocuments)
+      expect(after.runs).toEqual(before.runs)
+      expect(after.state).toMatchObject({
+        settings: { terminalFontSize: 19, httpProxyBypassRules: '*.internal' },
+        futureTopLevelExtension: before.state.futureTopLevelExtension
+      })
+      expect(JSON.stringify(after.state)).not.toContain(ORIGINAL.opencodeSessionCookie)
+      expect(JSON.stringify(after.state)).not.toContain(ORIGINAL.httpProxyUrl)
+      expect(state.reopen().getSettings()).toMatchObject({ ...ORIGINAL, terminalFontSize: 19 })
+    }
+  )
+
+  it.each(['unavailable', 'availability', 'encryption'] as const)(
+    'retains committed secrets while %s and retries them after recovery',
+    async (mode) => {
+      const state = fixture()
+      const before = state.read()
+      failure = mode
+      state.store.updateSettings({ opencodeSessionCookie: 'pending-cookie', terminalFontSize: 18 })
+      await state.store.flushPendingOrThrowAsync()
+      expect(state.read().state.settings).toEqual({
+        ...getSettingsRecord(before.state),
+        terminalFontSize: 18
+      })
+      failure = 'none'
+      state.store.updateSettings({ terminalFontSize: 20 })
+      await state.store.flushPendingOrThrowAsync()
+      expect(state.reopen().getSettings()).toMatchObject({
+        ...ORIGINAL,
+        opencodeSessionCookie: 'pending-cookie',
+        terminalFontSize: 20
+      })
+    }
+  )
+
+  it('preserves sealed settings on unrelated saves and permits an explicit clear', () => {
+    const state = fixture()
+    const before = state.read()
+    state.store.freezeWrites()
+    failure = 'decryption'
+    const sealed = state.reopen()
+    sealed.flushOrThrow()
+    expect(sealed.getSettings().opencodeSessionCookie).toBe('')
+    sealed.updateSettings({ terminalFontSize: 21 })
+    sealed.flushOrThrow()
+    expect(state.read().state.settings).toEqual({
+      ...getSettingsRecord(before.state),
+      terminalFontSize: 21
+    })
+    sealed.updateSettings({ opencodeSessionCookie: '', httpProxyUrl: '' })
+    sealed.flushOrThrow()
+    failure = 'none'
+    expect(state.reopen().getSettings()).toMatchObject({
+      opencodeSessionCookie: '',
+      httpProxyUrl: '',
+      terminalFontSize: 21
+    })
+  })
+
+  it('does not retain ciphertext from a failed selective commit', () => {
+    const state = fixture()
+    const before = state.read()
+    vi.spyOn(state.authority, 'writeSerializedDomains').mockImplementationOnce(() => {
+      throw new Error('commit failed')
+    })
+    state.store.updateSettings({ opencodeSessionCookie: 'uncommitted-cookie' })
+    expect(() => state.store.flushOrThrow()).toThrow('commit failed')
+    expect(state.read()).toEqual(before)
+    failure = 'unavailable'
+    state.store.updateSettings({ terminalFontSize: 22 })
+    state.store.flushOrThrow()
+    failure = 'none'
+    expect(state.reopen().getSettings()).toMatchObject({ ...ORIGINAL, terminalFontSize: 22 })
+  })
+
+  it('commits pending session/settings domains together and falls back for unclassified updates', () => {
+    const state = fixture()
+    state.store.patchWorkspaceSession({ activeTabId: 'pending-tab' })
+    state.store.updateSettings({ terminalFontSize: 23 })
+    state.store.flushOrThrow()
+    expect(state.read().state).toMatchObject({
+      settings: { terminalFontSize: 23 },
+      workspaceSession: { activeTabId: 'pending-tab' }
+    })
+    const wholeWrite = vi.spyOn(state.authority, 'writeCompleteSerializedDomains')
+    state.store.updateSettings({ terminalFontSize: 24 })
+    state.store.updateOnboarding({ outcome: 'completed' })
+    state.store.flushOrThrow()
+    expect(wholeWrite).toHaveBeenCalledOnce()
+    expect(state.read().state).toMatchObject({
+      settings: { terminalFontSize: 24 },
+      onboarding: { outcome: 'completed' }
+    })
+  })
+
+  it.each(['unavailable', 'encryption'] as const)(
+    'retries deferred UI and SSH secrets on a settings save after %s recovers',
+    async (mode) => {
+      const state = fixture()
+      const recovery = {
+        targetId: 'ssh-test',
+        clientInstanceId: 'client-test',
+        serverBuildId: 'build-test',
+        clientGeneration: 1,
+        ownerGeneration: 1,
+        ownerLease: 'original-lease'
+      }
+      state.store.updateUI({ browserKagiSessionLink: 'original-link' })
+      await state.store.upsertSshPtyConsumerRecovery(recovery)
+      const before = state.read().state
+
+      failure = mode
+      state.store.updateUI({ browserKagiSessionLink: 'pending-link' })
+      await state.store.flushPendingOrThrowAsync()
+      await state.store.upsertSshPtyConsumerRecovery({ ...recovery, ownerLease: 'pending-lease' })
+      expect(state.read().state).toMatchObject({
+        ui: before.ui,
+        sshPtyConsumerRecoveries: before.sshPtyConsumerRecoveries
+      })
+
+      failure = 'none'
+      const wholeWrite = vi.spyOn(state.authority, 'writeCompleteSerializedDomains')
+      wholeWrite.mockImplementationOnce(() => {
+        throw new Error('recovery commit failed')
+      })
+      state.store.updateSettings({ terminalFontSize: 25 })
+      await expect(state.store.flushPendingOrThrowAsync()).rejects.toThrow('recovery commit failed')
+      expect(state.read().state).toMatchObject({
+        ui: before.ui,
+        sshPtyConsumerRecoveries: before.sshPtyConsumerRecoveries
+      })
+      state.store.updateSettings({ terminalFontSize: 26 })
+      await state.store.flushPendingOrThrowAsync()
+      expect(wholeWrite).toHaveBeenCalledTimes(2)
+      const reopened = state.reopen()
+      expect(reopened.getUI().browserKagiSessionLink).toBe('pending-link')
+      expect(reopened.getSshPtyConsumerRecovery('ssh-test')?.ownerLease).toBe('pending-lease')
+      expect(JSON.stringify(state.read().state)).not.toMatch(/pending-link|pending-lease/)
+
+      state.store.updateSettings({ terminalFontSize: 27 })
+      await state.store.flushPendingOrThrowAsync()
+      expect(wholeWrite).toHaveBeenCalledTimes(2)
+    }
+  )
+
+  it('keeps an explicit UI secret clear after an unavailable write and later settings save', async () => {
+    const state = fixture()
+    state.store.updateUI({ browserKagiSessionLink: 'original-link' })
+    await state.store.flushPendingOrThrowAsync()
+    failure = 'unavailable'
+    state.store.updateUI({ browserKagiSessionLink: 'pending-link' })
+    await state.store.flushPendingOrThrowAsync()
+    state.store.updateUI({ browserKagiSessionLink: null })
+    await state.store.flushPendingOrThrowAsync()
+    failure = 'none'
+    state.store.updateSettings({ terminalFontSize: 28 })
+    await state.store.flushPendingOrThrowAsync()
+    expect(state.reopen().getUI().browserKagiSessionLink).toBeNull()
+  })
+
+  it.each(['unavailable', 'decryption'] as const)(
+    'persists an explicit empty UI secret clear after reopening with %s secrets',
+    async (mode) => {
+      const state = fixture()
+      state.store.updateUI({ browserKagiSessionLink: 'original-link' })
+      await state.store.flushPendingOrThrowAsync()
+      state.store.freezeWrites()
+      failure = mode
+      const sealed = state.reopen()
+      await sealed.flushPendingOrThrowAsync()
+      expect(sealed.getUI().browserKagiSessionLink).toBe('')
+      sealed.updateUI({ browserKagiSessionLink: '' })
+      sealed.updateSettings({ terminalFontSize: 29 })
+      await sealed.flushPendingOrThrowAsync()
+      failure = 'none'
+      expect(state.reopen().getUI().browserKagiSessionLink).toBeNull()
+    }
+  )
+})
+
+function getSettingsRecord(state: Record<string, unknown>): Record<string, unknown> {
+  const settings = state.settings
+  if (typeof settings !== 'object' || settings === null || Array.isArray(settings)) {
+    throw new Error('Expected persisted settings')
+  }
+  return Object.fromEntries(Object.entries(settings))
+}
diff --git a/src/main/persistence/loading-store/profile-state-sqlite-authority.test.ts b/src/main/persistence/loading-store/profile-state-sqlite-authority.test.ts
new file mode 100644
index 000000000000..5f679d3128d4
--- /dev/null
+++ b/src/main/persistence/loading-store/profile-state-sqlite-authority.test.ts
@@ -0,0 +1,877 @@
+import {
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  readdirSync,
+  rmSync,
+  writeFileSync
+} from 'node:fs'
+import { tmpdir } from 'node:os'
+import { dirname, join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { MAX_AUTOMATION_RUNS_PER_AUTOMATION } from '../../../shared/automation-run-retention'
+import { ProfileStateSqliteAuthority } from '../profile-state/profile-state-sqlite-authority'
+import {
+  profileStateJsonMatchesAcceptance,
+  exportProfileStateJson,
+  hashProfileStateJson,
+  importProfileStateJson,
+  readProfileStateJsonAcceptance,
+  readProfileStateSnapshot
+} from '../profile-state/profile-state-documents'
+import { parseProfileStateRoot } from '../profile-state/profile-state-document-validation'
+import {
+  openProfileStateDatabase,
+  openProfileStateDatabaseReadOnly
+} from '../profile-state/profile-state-database'
+import { profileStateJsonExportPath } from '../profile-state/legacy-json/profile-state-export-path'
+import { buildProfileStateCutoverFixture } from '../profile-state-cutover-fixture'
+
+vi.mock('electron', () => ({
+  app: {
+    getPath: () => tmpdir(),
+    getName: () => 'orca-test',
+    getVersion: () => '0.0.0-test',
+    isPackaged: false,
+    on: () => {},
+    whenReady: () => Promise.resolve()
+  },
+  safeStorage: {
+    isEncryptionAvailable: () => true,
+    encryptString: (value: string) => Buffer.from(`encrypted:${value}`, 'utf8'),
+    decryptString: (value: Buffer) => value.toString('utf8').slice('encrypted:'.length)
+  },
+  ipcMain: { on: () => {}, handle: () => {} },
+  BrowserWindow: { getAllWindows: () => [] }
+}))
+
+vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
+vi.mock('../../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: vi.fn(() => ({ nth_repo_added: 2 }))
+}))
+vi.mock('../../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: vi.fn(() => ({ hosts: [] })),
+  sshConfigHostsToTargets: vi.fn(() => [])
+}))
+
+const { Store } = await import('./store')
+const { createProfileStateStore } = await import('../profile-state/profile-state-store-factory')
+
+const temporaryDirectories: string[] = []
+const backupAuthorities = new Set<ProfileStateSqliteAuthority>()
+const authorities = new Set<ProfileStateSqliteAuthority>()
+const scheduleBackup = ProfileStateSqliteAuthority.prototype.scheduleBackup
+
+function createAuthority(databasePath: string, profileId: string): ProfileStateSqliteAuthority {
+  const authority = new ProfileStateSqliteAuthority(databasePath, profileId)
+  authorities.add(authority)
+  return authority
+}
+
+beforeEach(() => {
+  vi.spyOn(ProfileStateSqliteAuthority.prototype, 'scheduleBackup').mockImplementation(function (
+    this: ProfileStateSqliteAuthority
+  ) {
+    backupAuthorities.add(this)
+    scheduleBackup.call(this)
+  })
+})
+
+afterEach(async () => {
+  for (const authority of authorities) {
+    authority.close()
+    await authority.drainBackups()
+  }
+  authorities.clear()
+  backupAuthorities.clear()
+  for (const directory of temporaryDirectories.splice(0)) {
+    rmSync(directory, { recursive: true, force: true })
+  }
+  vi.restoreAllMocks()
+})
+
+describe('Store with an injected SQLite profile-state authority', () => {
+  it('rejects profile-state buffers that are not valid UTF-8', () => {
+    const directory = mkdtempSync(join(tmpdir(), 'orca-store-profile-state-invalid-utf8-'))
+    temporaryDirectories.push(directory)
+    const authority = createAuthority(join(directory, 'profile-state.db'), 'profile-authority-test')
+
+    authority.writeSerializedState(Buffer.from('{"settings":{"theme":"dark"}}'))
+    const before = authority.readSerializedState()
+    const malformed = Buffer.concat([
+      Buffer.from('{"settings":{"theme":"'),
+      Buffer.from([0xff]),
+      Buffer.from('"}}')
+    ])
+    expect(() => authority.writeSerializedState(malformed)).toThrow(
+      'Profile state payload is not valid UTF-8'
+    )
+    expect(authority.readSerializedState()).toBe(before)
+    authority.close()
+  })
+
+  it('mutates, flushes, and reloads without writing the legacy JSON file', async () => {
+    const directory = mkdtempSync(join(tmpdir(), 'orca-store-profile-state-authority-'))
+    temporaryDirectories.push(directory)
+    const dataFile = join(directory, 'orca-data.json')
+    const databaseFile = join(directory, 'profile-state.db')
+    writeFileSync(dataFile, '{"settings":{"theme":"light"}}', 'utf8')
+    const legacyBytes = readFileSync(dataFile)
+    const authority = createAuthority(databaseFile, 'profile-authority-test')
+
+    const store = new Store({ dataFile, profileStateAuthority: authority })
+    store.updateSettings({ theme: 'dark', opencodeSessionCookie: 'authority-secret' })
+    store.flushOrThrow()
+
+    store.updateSettings({ terminalFontSize: store.getSettings().terminalFontSize + 1 })
+    await store.flushPendingOrThrowAsync()
+
+    expect(readFileSync(dataFile)).toEqual(legacyBytes)
+    expect(existsSync(databaseFile)).toBe(true)
+
+    const reloaded = new Store({ dataFile, profileStateAuthority: authority })
+    expect(reloaded.getSettings().theme).toBe('dark')
+    expect(reloaded.getSettings().terminalFontSize).toBe(store.getSettings().terminalFontSize)
+    expect(reloaded.getSettings().opencodeSessionCookie).toBe('authority-secret')
+    expect(readFileSync(dataFile)).toEqual(legacyBytes)
+    reloaded.freezeWrites()
+  })
+
+  it('rejects a corrupt ordering placeholder when normalized rows exist', () => {
+    const directory = mkdtempSync(join(tmpdir(), 'orca-store-profile-state-normalized-read-'))
+    temporaryDirectories.push(directory)
+    const databasePath = join(directory, 'profile-state.db')
+    const fixture = buildProfileStateCutoverFixture()
+    const authority = createAuthority(databasePath, 'profile-authority-test')
+    authority.writeSerializedState(Buffer.from(JSON.stringify(fixture)))
+    authority.close()
+
+    const opened = openProfileStateDatabase(databasePath, 'profile-authority-test')
+    opened.db
+      .prepare('UPDATE profile_state_documents SET payload = ? WHERE domain = ?')
+      .run('{invalid', 'automationRuns')
+    opened.db.close()
+
+    const runtime = createAuthority(databasePath, 'profile-authority-test')
+    expect(() => runtime.readSerializedState()).toThrow(/hash mismatch: automationRuns/)
+    runtime.close()
+
+    const strict = openProfileStateDatabaseReadOnly(databasePath, 'profile-authority-test')
+    try {
+      expect(() => readProfileStateSnapshot(strict.db)).toThrow(/hash mismatch: automationRuns/)
+    } finally {
+      strict.db.close()
+    }
+  })
+
+  it('rejects invalid domain JSON before handing it to the Store', () => {
+    const directory = mkdtempSync(join(tmpdir(), 'orca-store-profile-state-runtime-parse-'))
+    temporaryDirectories.push(directory)
+    const databasePath = join(directory, 'profile-state.db')
+    const authority = createAuthority(databasePath, 'profile-authority-test')
+    authority.writeSerializedState(Buffer.from(JSON.stringify({ settings: { theme: 'dark' } })))
+    authority.close()
+
+    const opened = openProfileStateDatabase(databasePath, 'profile-authority-test')
+    opened.db
+      .prepare('UPDATE profile_state_documents SET payload = ?, content_hash = ? WHERE domain = ?')
+      .run('{invalid', hashProfileStateJson('{invalid'), 'settings')
+    opened.db.close()
+
+    expect(
+      () =>
+        new Store({
+          dataFile: join(directory, 'orca-data.json'),
+          profileStateAuthority: createAuthority(databasePath, 'profile-authority-test')
+        })
+    ).toThrow('Profile state document payload is invalid JSON: settings')
+  })
+
+  it('rejects documents whose revision metadata was removed or reset', () => {
+    const directory = mkdtempSync(join(tmpdir(), 'orca-store-profile-state-authority-'))
+    temporaryDirectories.push(directory)
+    const databasePath = join(directory, 'profile-state.db')
+    const opened = openProfileStateDatabase(databasePath, 'profile-authority-test')
+    importProfileStateJson(opened.db, JSON.stringify({ settings: { theme: 'dark' } }))
+    opened.db.prepare("DELETE FROM profile_state_meta WHERE key = 'revision'").run()
+    opened.db.close()
+
+    const authority = createAuthority(databasePath, 'profile-authority-test')
+    expect(() => authority.readSerializedState()).toThrow()
+  })
+
+  it('fences a complete-document writer that read before another authority committed', () => {
+    const directory = mkdtempSync(join(tmpdir(), 'orca-store-profile-state-authority-cas-'))
+    temporaryDirectories.push(directory)
+    const databasePath = join(directory, 'profile-state.db')
+    const first = createAuthority(databasePath, 'profile-authority-test')
+    const second = createAuthority(databasePath, 'profile-authority-test')
+
+    first.writeSerializedState(Buffer.from(JSON.stringify({ settings: { theme: 'light' } })))
+    expect(second.readSerializedState()).toBe(JSON.stringify({ settings: { theme: 'light' } }))
+
+    first.readSerializedState()
+    first.writeSerializedState(Buffer.from(JSON.stringify({ settings: { theme: 'dark' } })))
+    expect(() =>
+      second.writeSerializedState(
+        Buffer.from(JSON.stringify({ settings: { theme: 'stale-writer' } }))
+      )
+    ).toThrowError(
+      expect.objectContaining({
+        code: 'profile-state-revision-conflict',
+        expectedRevision: 1,
+        actualRevision: 2
+      })
+    )
+
+    const verifier = createAuthority(databasePath, 'profile-authority-test')
+    expect(verifier.readSerializedState()).toBe(JSON.stringify({ settings: { theme: 'dark' } }))
+  })
+
+  it('fences a first commit after another authority creates the database', () => {
+    const directory = mkdtempSync(join(tmpdir(), 'orca-store-profile-state-authority-create-cas-'))
+    temporaryDirectories.push(directory)
+    const databasePath = join(directory, 'profile-state.db')
+    const first = createAuthority(databasePath, 'profile-authority-test')
+    const second = createAuthority(databasePath, 'profile-authority-test')
+
+    expect(first.readSerializedState()).toBeUndefined()
+    second.writeSerializedState(Buffer.from(JSON.stringify({ settings: { theme: 'other' } })))
+
+    expect(() =>
+      first.writeSerializedState(Buffer.from(JSON.stringify({ settings: { theme: 'stale' } })))
+    ).toThrowError(
+      expect.objectContaining({
+        code: 'profile-state-revision-conflict',
+        expectedRevision: 0,
+        actualRevision: 1
+      })
+    )
+  })
+
+  it('keeps normalized rows stable during a complete document replacement', () => {
+    const directory = mkdtempSync(join(tmpdir(), 'orca-store-profile-state-complete-write-'))
+    temporaryDirectories.push(directory)
+    const databasePath = join(directory, 'profile-state.db')
+    const fixture = buildProfileStateCutoverFixture(directory)
+    const authority = createAuthority(databasePath, 'profile-authority-test')
+    authority.writeSerializedState(Buffer.from(JSON.stringify(fixture)))
+
+    const before = openProfileStateDatabaseReadOnly(databasePath, 'profile-authority-test')
+    const beforeAutomationMeta = before.db
+      .prepare(
+        'SELECT revision, content_hash FROM profile_state_automation_runs_meta WHERE domain = ?'
+      )
+      .get('automationRuns')
+    const beforeAutomationRows = before.db
+      .prepare('SELECT COUNT(*) AS count FROM profile_state_automation_runs')
+      .get()
+    before.db.close()
+
+    const replacement = parseProfileStateRoot(authority.readSerializedState() ?? '{}')
+    replacement.settings = { theme: 'complete-replacement' }
+    replacement.unknownDomain = { preserved: true }
+    delete replacement.ui
+    authority.writeSerializedState(Buffer.from(JSON.stringify(replacement)))
+
+    expect(JSON.parse(authority.readSerializedState() ?? '{}')).toMatchObject({
+      settings: { theme: 'complete-replacement' },
+      unknownDomain: { preserved: true }
+    })
+    const after = openProfileStateDatabaseReadOnly(databasePath, 'profile-authority-test')
+    try {
+      expect(
+        after.db.prepare('SELECT value FROM profile_state_meta WHERE key = ?').get('revision')
+      ).toEqual({ value: '2' })
+      expect(
+        after.db
+          .prepare(
+            'SELECT revision, content_hash FROM profile_state_automation_runs_meta WHERE domain = ?'
+          )
+          .get('automationRuns')
+      ).toEqual(beforeAutomationMeta)
+      expect(
+        after.db.prepare('SELECT COUNT(*) AS count FROM profile_state_automation_runs').get()
+      ).toEqual(beforeAutomationRows)
+      expect(
+        after.db.prepare('SELECT 1 FROM profile_state_documents WHERE domain = ?').get('ui')
+      ).toBe(undefined)
+    } finally {
+      after.db.close()
+    }
+  })
+
+  it('reopens its writer after an explicit close without losing the revision fence', () => {
+    const directory = mkdtempSync(join(tmpdir(), 'orca-store-profile-state-authority-close-'))
+    temporaryDirectories.push(directory)
+    const databasePath = join(directory, 'profile-state.db')
+    const authority = createAuthority(databasePath, 'profile-authority-test')
+
+    authority.writeSerializedState(Buffer.from(JSON.stringify({ settings: { theme: 'light' } })))
+    authority.close()
+    authority.writeSerializedState(Buffer.from(JSON.stringify({ settings: { theme: 'dark' } })))
+
+    const verifier = createAuthority(databasePath, 'profile-authority-test')
+    expect(verifier.readSerializedState()).toBe(JSON.stringify({ settings: { theme: 'dark' } }))
+    verifier.close()
+  })
+
+  it('keeps a newer Store commit when a stale Store flushes afterward', () => {
+    const directory = mkdtempSync(join(tmpdir(), 'orca-store-profile-state-store-cas-'))
+    temporaryDirectories.push(directory)
+    const dataFile = join(directory, 'orca-data.json')
+    const databasePath = join(directory, 'profile-state.db')
+    const seed = createAuthority(databasePath, 'profile-authority-test')
+    seed.writeSerializedState(Buffer.from(JSON.stringify({ settings: { theme: 'light' } })))
+
+    const first = new Store({
+      dataFile,
+      profileStateAuthority: createAuthority(databasePath, 'profile-authority-test')
+    })
+    const stale = new Store({
+      dataFile,
+      profileStateAuthority: createAuthority(databasePath, 'profile-authority-test')
+    })
+    const initialTerminalFontSize = first.getSettings().terminalFontSize
+    first.updateSettings({ theme: 'dark' })
+    first.flushOrThrow()
+
+    stale.updateSettings({ terminalFontSize: stale.getSettings().terminalFontSize + 1 })
+    expect(() => stale.flushOrThrow()).toThrowError(
+      expect.objectContaining({
+        code: 'profile-state-revision-conflict',
+        expectedRevision: 1,
+        actualRevision: 2
+      })
+    )
+
+    const verifier = createAuthority(databasePath, 'profile-authority-test')
+    expect(JSON.parse(verifier.readSerializedState() ?? '{}')).toMatchObject({
+      settings: { theme: 'dark', terminalFontSize: initialTerminalFontSize }
+    })
+  })
+
+  it('writes a local session mutation as dirty domains and preserves unrelated rows', () => {
+    const directory = mkdtempSync(join(tmpdir(), 'orca-store-profile-state-domain-write-'))
+    temporaryDirectories.push(directory)
+    const dataFile = join(directory, 'orca-data.json')
+    const databasePath = join(directory, 'profile-state.db')
+    const seedDataFile = join(directory, 'seed-orca-data.json')
+    const seedStore = new Store({
+      dataFile: seedDataFile,
+      serializedState: existsSync(seedDataFile) ? readFileSync(seedDataFile, 'utf8') : '{}'
+    })
+    seedStore.updateSettings({ theme: 'light' })
+    seedStore.flushOrThrow()
+    const seed = createAuthority(databasePath, 'profile-authority-test')
+    seed.writeSerializedState(Buffer.from(seedStore.prepareProfileStateExport().json))
+    seedStore.freezeWrites()
+
+    const authority = createAuthority(databasePath, 'profile-authority-test')
+    const writeDomains = vi.spyOn(authority, 'writeSerializedDomains')
+    const store = new Store({ dataFile, profileStateAuthority: authority })
+    store.flushOrThrow()
+    store.setWorkspaceSession({
+      ...store.getWorkspaceSession(),
+      activeTabId: 'after'
+    })
+    store.flushOrThrow()
+
+    expect(writeDomains).toHaveBeenCalledTimes(1)
+    expect(writeDomains.mock.calls[0]?.[0].map(({ domain }) => domain)).toEqual([
+      'workspaceSession'
+    ])
+    const reloaded = new Store({
+      dataFile,
+      profileStateAuthority: createAuthority(databasePath, 'profile-authority-test')
+    })
+    expect(reloaded.getWorkspaceSession().activeTabId).toBe('after')
+    expect(reloaded.getSettings().theme).toBe('light')
+    reloaded.freezeWrites()
+  })
+
+  it('writes a PTY rebind through the workspace-session domain', async () => {
+    const directory = mkdtempSync(join(tmpdir(), 'orca-store-profile-state-pty-domain-write-'))
+    temporaryDirectories.push(directory)
+    const dataFile = join(directory, 'orca-data.json')
+    const databasePath = join(directory, 'profile-state.db')
+    const fixtureFile = join(directory, 'fixture-orca-data.json')
+    writeFileSync(fixtureFile, JSON.stringify(buildProfileStateCutoverFixture(directory)))
+    const seedStore = new Store({
+      dataFile: fixtureFile,
+      serializedState: existsSync(fixtureFile) ? readFileSync(fixtureFile, 'utf8') : '{}'
+    })
+    seedStore.flushOrThrow()
+    const seed = createAuthority(databasePath, 'profile-authority-test')
+    seed.writeSerializedState(Buffer.from(seedStore.prepareProfileStateExport().json))
+    seedStore.freezeWrites()
+
+    const authority = createAuthority(databasePath, 'profile-authority-test')
+    const writeDomains = vi.spyOn(authority, 'writeSerializedDomains')
+    const store = new Store({ dataFile, profileStateAuthority: authority })
+    store.flushOrThrow()
+    const session = store.getWorkspaceSession()
+    const worktreeId = session.activeWorktreeId
+    const tabId = session.activeTabId
+    const layout = tabId ? session.terminalLayoutsByTabId[tabId] : undefined
+    const leafId = layout ? Object.keys(layout.ptyIdsByLeafId ?? {})[0] : undefined
+    const previousPtyId = leafId ? layout?.ptyIdsByLeafId?.[leafId] : undefined
+    if (!worktreeId || !tabId || !layout || !leafId || !previousPtyId) {
+      throw new Error('fixture did not produce a normalized PTY binding')
+    }
+
+    expect(
+      await store.persistPtyBinding({
+        worktreeId,
+        tabId,
+        leafId,
+        ptyId: 'pty-rebound',
+        expectedBinding: { ptyId: previousPtyId }
+      })
+    ).toBe(true)
+    expect(writeDomains).toHaveBeenCalledTimes(1)
+    expect(writeDomains.mock.calls[0]?.[0].map(({ domain }) => domain)).toEqual([
+      'workspaceSession'
+    ])
+
+    const remoteSession = store.getWorkspaceSession('ssh:build-host')
+    const remoteWorktreeId = remoteSession.activeWorktreeId
+    const remoteTabId = remoteSession.activeTabId
+    const remoteLayout = remoteTabId ? remoteSession.terminalLayoutsByTabId[remoteTabId] : undefined
+    const remoteLeafId = remoteLayout
+      ? Object.keys(remoteLayout.ptyIdsByLeafId ?? {})[0]
+      : undefined
+    const remotePtyId = remoteLeafId ? remoteLayout?.ptyIdsByLeafId?.[remoteLeafId] : undefined
+    if (!remoteWorktreeId || !remoteTabId || !remoteLayout || !remoteLeafId || !remotePtyId) {
+      throw new Error('fixture did not produce a normalized remote PTY binding')
+    }
+    expect(
+      await store.persistPtyBinding(
+        {
+          worktreeId: remoteWorktreeId,
+          tabId: remoteTabId,
+          leafId: remoteLeafId,
+          ptyId: 'pty-remote-rebound',
+          expectedBinding: { ptyId: remotePtyId }
+        },
+        'ssh:build-host'
+      )
+    ).toBe(true)
+    expect(writeDomains).toHaveBeenCalledTimes(2)
+    expect(writeDomains.mock.calls[1]?.[0].map(({ domain }) => domain)).toEqual([
+      'workspaceSessionsByHostId'
+    ])
+
+    const reloaded = new Store({
+      dataFile,
+      profileStateAuthority: createAuthority(databasePath, 'profile-authority-test')
+    })
+    expect(
+      reloaded.getWorkspaceSession().terminalLayoutsByTabId[tabId]?.ptyIdsByLeafId
+    ).toMatchObject({
+      [leafId]: 'pty-rebound'
+    })
+    reloaded.freezeWrites()
+  })
+
+  it('writes scheduled automation changes as automations and automationRuns domains', () => {
+    const directory = mkdtempSync(join(tmpdir(), 'orca-store-profile-state-automation-write-'))
+    temporaryDirectories.push(directory)
+    const dataFile = join(directory, 'orca-data.json')
+    const seedDataFile = join(directory, 'seed-orca-data.json')
+    const databasePath = join(directory, 'profile-state.db')
+    writeFileSync(seedDataFile, JSON.stringify(buildProfileStateCutoverFixture(directory)))
+    const seedStore = new Store({
+      dataFile: seedDataFile,
+      serializedState: existsSync(seedDataFile) ? readFileSync(seedDataFile, 'utf8') : '{}'
+    })
+    seedStore.flushOrThrow()
+    const seed = createAuthority(databasePath, 'profile-authority-test')
+    seed.writeSerializedState(Buffer.from(seedStore.prepareProfileStateExport().json))
+    seedStore.freezeWrites()
+
+    const authority = createAuthority(databasePath, 'profile-authority-test')
+    const writeAutomationRuns = vi.spyOn(authority, 'writeSerializedAutomationRuns')
+    const store = new Store({ dataFile, profileStateAuthority: authority })
+    store.flushOrThrow()
+    const automation = store.listAutomations()[0]
+    if (!automation) {
+      throw new Error('fixture automation missing')
+    }
+    store.createAutomationRun(automation, Date.now(), 'scheduled')
+
+    expect(writeAutomationRuns).toHaveBeenCalledTimes(1)
+    expect(writeAutomationRuns.mock.calls[0]?.[0].map(({ domain }) => domain)).toEqual([
+      'automations'
+    ])
+    expect(writeAutomationRuns.mock.calls[0]?.[1]).toHaveLength(2)
+    const reloaded = new Store({
+      dataFile,
+      profileStateAuthority: createAuthority(databasePath, 'profile-authority-test')
+    })
+    expect(reloaded.listAutomationRuns()).toHaveLength(2)
+    reloaded.freezeWrites()
+  })
+
+  it('persists an automation run lifecycle through normalized rows', () => {
+    const directory = mkdtempSync(join(tmpdir(), 'orca-store-profile-state-automation-lifecycle-'))
+    temporaryDirectories.push(directory)
+    const dataFile = join(directory, 'orca-data.json')
+    const seedDataFile = join(directory, 'seed-orca-data.json')
+    const databasePath = join(directory, 'profile-state.db')
+    writeFileSync(seedDataFile, JSON.stringify(buildProfileStateCutoverFixture(directory)))
+    const seedStore = new Store({
+      dataFile: seedDataFile,
+      serializedState: existsSync(seedDataFile) ? readFileSync(seedDataFile, 'utf8') : '{}'
+    })
+    seedStore.flushOrThrow()
+    const seed = createAuthority(databasePath, 'profile-authority-test')
+    seed.writeSerializedState(Buffer.from(seedStore.prepareProfileStateExport().json))
+    seedStore.freezeWrites()
+
+    const authority = createAuthority(databasePath, 'profile-authority-test')
+    const writeAutomationRuns = vi.spyOn(authority, 'writeSerializedAutomationRuns')
+    const store = new Store({ dataFile, profileStateAuthority: authority })
+    store.flushOrThrow()
+    const automation = store.listAutomations()[0]
+    if (!automation) {
+      throw new Error('fixture automation missing')
+    }
+
+    store.updateUI({ browserKagiSessionLink: 'https://kagi.com/session?t=authority' })
+    store.flushOrThrow()
+    const pending = store.createAutomationRun(automation, 30, 'manual')
+    store.flushOrThrow()
+    expect(pending.status).toBe('pending')
+    const completed = store.updateAutomationRun({
+      runId: pending.id,
+      status: 'completed',
+      outputSnapshot: {
+        format: 'plain_text',
+        content: 'completed through sqlite',
+        capturedAt: 31,
+        truncated: false
+      }
+    })
+    store.flushOrThrow()
+    expect(completed.status).toBe('completed')
+    expect(writeAutomationRuns).toHaveBeenCalledTimes(2)
+    expect(writeAutomationRuns.mock.calls[1]?.[0].map(({ domain }) => domain)).toEqual([
+      'automations'
+    ])
+
+    const reloaded = new Store({
+      dataFile,
+      profileStateAuthority: createAuthority(databasePath, 'profile-authority-test')
+    })
+    expect(reloaded.listAutomationRuns('automation-fixture')).toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({
+          id: pending.id,
+          status: 'completed',
+          outputSnapshot: expect.objectContaining({ content: 'completed through sqlite' })
+        })
+      ])
+    )
+    expect(reloaded.getUI().featureInteractions?.['automation-run']?.interactionCount).toBe(1)
+    expect(reloaded.getUI().browserKagiSessionLink).toBe('https://kagi.com/session?t=authority')
+    const stored = openProfileStateDatabaseReadOnly(databasePath, 'profile-authority-test')
+    try {
+      const uiRow = stored.db
+        .prepare('SELECT payload FROM profile_state_documents WHERE domain = ?')
+        .get('ui')
+      expect(uiRow).toEqual(
+        expect.objectContaining({ payload: expect.not.stringContaining('authority') })
+      )
+    } finally {
+      stored.db.close()
+    }
+    reloaded.freezeWrites()
+  })
+
+  it('prunes normalized automation rows and reloads the retained window', () => {
+    const directory = mkdtempSync(join(tmpdir(), 'orca-store-profile-state-automation-retention-'))
+    temporaryDirectories.push(directory)
+    const dataFile = join(directory, 'orca-data.json')
+    const seedDataFile = join(directory, 'seed-orca-data.json')
+    const databasePath = join(directory, 'profile-state.db')
+    writeFileSync(seedDataFile, JSON.stringify(buildProfileStateCutoverFixture(directory)))
+    const seedStore = new Store({
+      dataFile: seedDataFile,
+      serializedState: existsSync(seedDataFile) ? readFileSync(seedDataFile, 'utf8') : '{}'
+    })
+    seedStore.flushOrThrow()
+    const seed = createAuthority(databasePath, 'profile-authority-test')
+    seed.writeSerializedState(Buffer.from(seedStore.prepareProfileStateExport().json))
+    seedStore.freezeWrites()
+
+    const store = new Store({
+      dataFile,
+      profileStateAuthority: createAuthority(databasePath, 'profile-authority-test')
+    })
+    store.flushOrThrow()
+    const automation = store.listAutomations()[0]
+    if (!automation) {
+      throw new Error('fixture automation missing')
+    }
+    for (let index = 0; index < MAX_AUTOMATION_RUNS_PER_AUTOMATION + 2; index += 1) {
+      const run = store.createAutomationRun(automation, 100 + index, 'scheduled')
+      store.updateAutomationRun({ runId: run.id, status: 'completed' })
+    }
+
+    const reloaded = new Store({
+      dataFile,
+      profileStateAuthority: createAuthority(databasePath, 'profile-authority-test')
+    })
+    const retained = reloaded.listAutomationRuns('automation-fixture')
+    expect(retained).toHaveLength(MAX_AUTOMATION_RUNS_PER_AUTOMATION)
+    expect(retained.some((run) => run.id === 'automation-run-fixture')).toBe(false)
+    reloaded.flushOrThrow()
+    const stored = openProfileStateDatabaseReadOnly(databasePath, 'profile-authority-test')
+    try {
+      expect(
+        stored.db.prepare('SELECT COUNT(*) AS count FROM profile_state_automation_runs').get()
+      ).toEqual({ count: MAX_AUTOMATION_RUNS_PER_AUTOMATION })
+    } finally {
+      stored.db.close()
+    }
+    reloaded.freezeWrites()
+  })
+
+  it('writes host-qualified worktree metadata as projected domain rows', () => {
+    const directory = mkdtempSync(join(tmpdir(), 'orca-store-profile-state-worktree-write-'))
+    temporaryDirectories.push(directory)
+    const dataFile = join(directory, 'orca-data.json')
+    const seedDataFile = join(directory, 'seed-orca-data.json')
+    const databasePath = join(directory, 'profile-state.db')
+    writeFileSync(seedDataFile, JSON.stringify(buildProfileStateCutoverFixture(directory)))
+    const seedStore = new Store({
+      dataFile: seedDataFile,
+      serializedState: existsSync(seedDataFile) ? readFileSync(seedDataFile, 'utf8') : '{}'
+    })
+    seedStore.flushOrThrow()
+    const seed = createAuthority(databasePath, 'profile-authority-test')
+    seed.writeSerializedState(Buffer.from(seedStore.prepareProfileStateExport().json))
+    seedStore.freezeWrites()
+
+    const authority = createAuthority(databasePath, 'profile-authority-test')
+    const writeDomains = vi.spyOn(authority, 'writeSerializedDomains')
+    const store = new Store({ dataFile, profileStateAuthority: authority })
+    store.flushOrThrow()
+    store.setWorktreeMetaForHost('repo-local::/fixture/local', 'local', {
+      displayName: 'Updated fixture local'
+    })
+    store.flushOrThrow()
+
+    expect(writeDomains).toHaveBeenCalledTimes(1)
+    expect(writeDomains.mock.calls[0]?.[0].map(({ domain }) => domain)).toEqual(
+      expect.arrayContaining(['worktreeMeta', 'worktreeMetaByIdentity', 'worktreeIdentityAliases'])
+    )
+    const reloaded = new Store({
+      dataFile,
+      profileStateAuthority: createAuthority(databasePath, 'profile-authority-test')
+    })
+    expect(
+      reloaded.getWorktreeMetaForHost('repo-local::/fixture/local', 'local')?.displayName
+    ).toBe('Updated fixture local')
+    reloaded.freezeWrites()
+  })
+
+  it('publishes a durable JSON rollback export without changing the SQLite authority', () => {
+    const directory = mkdtempSync(join(tmpdir(), 'orca-store-profile-state-json-export-'))
+    temporaryDirectories.push(directory)
+    const databasePath = join(directory, 'profile-state.db')
+    const authority = createAuthority(databasePath, 'profile-authority-test')
+    authority.writeSerializedState(
+      Buffer.from(JSON.stringify({ settings: { theme: 'dark' }, unknownDomain: { keep: true } }))
+    )
+
+    const exportPath = join(directory, 'rollback', 'orca-data.json.r3')
+    const revision = authority.writeJsonExport(exportPath)
+
+    expect(revision).toBe(1)
+    expect(JSON.parse(readFileSync(exportPath, 'utf8'))).toEqual({
+      settings: { theme: 'dark' },
+      unknownDomain: { keep: true }
+    })
+    const reopened = openProfileStateDatabaseReadOnly(databasePath, 'profile-authority-test')
+    try {
+      expect(exportProfileStateJson(reopened.db)).toBe(readFileSync(exportPath, 'utf8'))
+    } finally {
+      reopened.db.close()
+    }
+  })
+
+  it('publishes the Store export after flushing pending SQLite state', () => {
+    const directory = mkdtempSync(join(tmpdir(), 'orca-store-profile-state-store-export-'))
+    temporaryDirectories.push(directory)
+    const dataFile = join(directory, 'orca-data.json')
+    const databasePath = join(directory, 'profile-state.db')
+    const seed = new Store({ dataFile, serializedState: '{}' })
+    seed.flushOrThrow()
+    const authority = createAuthority(databasePath, 'profile-authority-test')
+    authority.writeSerializedState(Buffer.from(seed.prepareProfileStateExport().json, 'utf8'))
+    seed.freezeWrites()
+
+    const store = new Store({ dataFile, profileStateAuthority: authority })
+    store.updateSettings({ theme: 'dark' })
+    const exportPath = join(directory, 'rollback', 'orca-data.json.current')
+    const revision = store.writeProfileStateJsonExport(exportPath)
+
+    expect(revision).toBe(2)
+    expect(JSON.parse(readFileSync(exportPath, 'utf8')).settings.theme).toBe('dark')
+    store.freezeWrites()
+  })
+
+  it('publishes the latest SQLite revision as an idempotent versioned export', () => {
+    const directory = mkdtempSync(join(tmpdir(), 'orca-store-profile-state-latest-export-'))
+    temporaryDirectories.push(directory)
+    const dataFile = join(directory, 'orca-data.json')
+    const databasePath = join(directory, 'profile-state.db')
+    const seed = new Store({ dataFile, serializedState: '{}' })
+    seed.updateSettings({ theme: 'light' })
+    seed.flushOrThrow()
+    const authority = createAuthority(databasePath, 'profile-authority-test')
+    authority.writeSerializedState(Buffer.from(seed.prepareProfileStateExport().json, 'utf8'))
+    seed.freezeWrites()
+
+    const store = new Store({ dataFile, profileStateAuthority: authority })
+    store.updateSettings({ theme: 'dark' })
+
+    const firstRevision = store.writeLatestProfileStateJsonExport()
+    expect(firstRevision).toBe(2)
+    if (firstRevision === undefined) {
+      throw new Error('Expected the SQLite authority to publish a revisioned export')
+    }
+    const firstPath = profileStateJsonExportPath(dataFile, firstRevision)
+    expect(JSON.parse(readFileSync(firstPath, 'utf8')).settings.theme).toBe('dark')
+
+    expect(store.writeLatestProfileStateJsonExport()).toBe(firstRevision)
+    expect(readFileSync(profileStateJsonExportPath(dataFile, 2), 'utf8')).toBe(
+      readFileSync(firstPath, 'utf8')
+    )
+    expect(
+      readdirSync(directory).some((name) =>
+        name.startsWith('orca-data.json.sqlite-export.pending.')
+      )
+    ).toBe(false)
+    store.freezeWrites()
+  })
+
+  it('publishes canonical JSON for an older build and advances its acceptance marker', () => {
+    const directory = mkdtempSync(join(tmpdir(), 'orca-store-profile-state-compat-export-'))
+    temporaryDirectories.push(directory)
+    const dataFile = join(directory, 'orca-data.json')
+    const databasePath = join(directory, 'profile-state.db')
+    const seed = new Store({ dataFile, serializedState: '{}' })
+    seed.updateSettings({ theme: 'light' })
+    seed.flushOrThrow()
+    const authority = createAuthority(databasePath, 'profile-authority-test')
+    authority.writeSerializedState(Buffer.from(seed.prepareProfileStateExport().json, 'utf8'))
+    seed.freezeWrites()
+
+    const store = new Store({ dataFile, profileStateAuthority: authority })
+    store.updateSettings({ theme: 'dark' })
+    const revision = store.writeLatestProfileStateJsonCompatibilityExport()
+
+    expect(revision).toBe(2)
+    const canonical = readFileSync(dataFile, 'utf8')
+    expect(JSON.parse(canonical).settings.theme).toBe('dark')
+    const opened = openProfileStateDatabaseReadOnly(databasePath, 'profile-authority-test')
+    try {
+      expect(readProfileStateJsonAcceptance(opened.db)).toEqual({
+        jsonHash: hashProfileStateJson(canonical),
+        acceptedRevision: revision
+      })
+      expect(profileStateJsonMatchesAcceptance(opened.db, canonical)).toBe(true)
+    } finally {
+      opened.db.close()
+    }
+    authority.close()
+    const reopened = createProfileStateStore({
+      dataFile,
+      databaseFile: databasePath,
+      profileId: 'profile-authority-test'
+    })
+    expect(reopened.backend).toBe('sqlite')
+    expect(reopened.store.getSettings().theme).toBe('dark')
+    reopened.store.freezeWrites()
+    store.freezeWrites()
+  })
+
+  it('refuses to overwrite a conflicting export for the same SQLite revision', () => {
+    const directory = mkdtempSync(join(tmpdir(), 'orca-store-profile-state-export-conflict-'))
+    temporaryDirectories.push(directory)
+    const dataFile = join(directory, 'orca-data.json')
+    const databasePath = join(directory, 'profile-state.db')
+    const authority = createAuthority(databasePath, 'profile-authority-test')
+    authority.writeSerializedState(Buffer.from(JSON.stringify({ settings: { theme: 'dark' } })))
+    const store = new Store({ dataFile, profileStateAuthority: authority })
+    const revision = store.writeLatestProfileStateJsonExport()
+    if (revision === undefined) {
+      throw new Error('Expected the SQLite authority to publish a revisioned export')
+    }
+    const exportPath = profileStateJsonExportPath(dataFile, revision)
+    mkdirSync(dirname(exportPath), { recursive: true })
+    writeFileSync(exportPath, '{"settings":{"theme":"tampered"}}', 'utf8')
+
+    expect(() => store.writeLatestProfileStateJsonExport()).toThrow(
+      'already exists with different content'
+    )
+    expect(readFileSync(exportPath, 'utf8')).toContain('tampered')
+    expect(
+      readdirSync(directory).some((name) =>
+        name.startsWith('orca-data.json.sqlite-export.pending.')
+      )
+    ).toBe(false)
+    store.freezeWrites()
+  })
+
+  it('freezes Store writes before quarantining the SQLite database family', async () => {
+    const directory = mkdtempSync(join(tmpdir(), 'orca-store-profile-state-quarantine-'))
+    temporaryDirectories.push(directory)
+    const dataFile = join(directory, 'orca-data.json')
+    const databasePath = join(directory, 'profile-state.db')
+    const authority = createAuthority(databasePath, 'profile-authority-test')
+    authority.writeSerializedState(Buffer.from(JSON.stringify({ settings: { theme: 'light' } })))
+
+    const store = new Store({ dataFile, profileStateAuthority: authority })
+    store.updateSettings({ theme: 'dark' })
+    store.flushOrThrow()
+    await authority.drainBackups()
+    const sourceBytes = readFileSync(databasePath)
+    writeFileSync(`${databasePath}-wal`, 'wal-preservation-sentinel')
+
+    const result = store.quarantineProfileStateDatabase(
+      join(directory, 'quarantine'),
+      'store-recovery-test'
+    )
+
+    expect(readFileSync(join(result.directory, 'profile-state.db'))).toEqual(sourceBytes)
+    expect(readFileSync(join(result.directory, 'profile-state.db-wal'), 'utf8')).toBe(
+      'wal-preservation-sentinel'
+    )
+    expect(JSON.parse(readFileSync(result.manifestPath, 'utf8'))).toMatchObject({
+      profileId: 'profile-authority-test',
+      reason: 'store-recovery-test'
+    })
+    expect(readFileSync(databasePath)).toEqual(sourceBytes)
+  })
+
+  it('prepares frozen JSON imports without permitting file publication', () => {
+    const directory = mkdtempSync(join(tmpdir(), 'orca-store-profile-state-legacy-export-'))
+    temporaryDirectories.push(directory)
+    const dataFile = join(directory, 'orca-data.json')
+    const store = new Store({ dataFile, serializedState: '{"settings":{"theme":"light"}}' })
+    store.updateSettings({ theme: 'dark' })
+
+    const exportPath = join(directory, 'rollback', 'orca-data.json.legacy.json')
+    expect(() => store.writeProfileStateJsonExport(exportPath)).toThrow('require a SQLite')
+    expect(JSON.parse(store.prepareProfileStateExport().json).settings.theme).toBe('dark')
+    expect(existsSync(exportPath)).toBe(false)
+    expect(existsSync(dataFile)).toBe(false)
+    expect(existsSync(join(directory, 'profile-state.db'))).toBe(false)
+    store.freezeWrites()
+  })
+})
diff --git a/src/main/persistence/loading-store/profile-state-store-backups.test.ts b/src/main/persistence/loading-store/profile-state-store-backups.test.ts
new file mode 100644
index 000000000000..aa60618cc422
--- /dev/null
+++ b/src/main/persistence/loading-store/profile-state-store-backups.test.ts
@@ -0,0 +1,250 @@
+import { existsSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { basename, join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { flushActiveProfileBeforeFileMutation } from '../../orca-profiles/profile-persistence-deadline'
+import { openProfileStateDatabaseReadOnly } from '../profile-state/profile-state-database'
+import { readProfileStateSnapshot } from '../profile-state/profile-state-documents'
+import { profileStateDatabaseBackups } from '../profile-state/profile-state-backup-path'
+import * as backupExecution from '../profile-state/profile-state-backup-worker'
+import { ProfileStateSqliteAuthority } from '../profile-state/profile-state-sqlite-authority'
+import { Store } from './store'
+import { scheduleSave } from './write-scheduling'
+
+vi.mock('electron', () => ({
+  app: {
+    getPath: () => tmpdir(),
+    getName: () => 'orca-test',
+    getVersion: () => '0.0.0-test',
+    isPackaged: false,
+    on: () => {},
+    whenReady: () => Promise.resolve()
+  },
+  safeStorage: {
+    isEncryptionAvailable: () => true,
+    encryptString: (value: string) => Buffer.from(`encrypted:${value}`),
+    decryptString: (value: Buffer) => value.toString().slice('encrypted:'.length)
+  },
+  ipcMain: { on: () => {}, handle: () => {} },
+  BrowserWindow: { getAllWindows: () => [] }
+}))
+vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
+vi.mock('../../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: () => ({ nth_repo_added: 2 })
+}))
+vi.mock('../../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: () => ({ hosts: [] }),
+  sshConfigHostsToTargets: () => []
+}))
+
+const PROFILE_ID = 'store-backup-test'
+const HOUR = 60 * 60 * 1000
+const fixtures: { directory: string; store: Store; authority: ProfileStateSqliteAuthority }[] = []
+const releases: (() => void)[] = []
+
+beforeEach(() => {
+  vi.spyOn(backupExecution, 'runProfileStateBackup')
+})
+
+afterEach(async () => {
+  for (const release of releases.splice(0)) {
+    release()
+  }
+  for (const fixture of fixtures.splice(0)) {
+    await fixture.authority.drainBackups()
+    fixture.store.freezeWrites()
+    await fixture.store.flushAsync()
+    rmSync(fixture.directory, { recursive: true, force: true })
+  }
+  vi.restoreAllMocks()
+})
+
+async function fixture() {
+  const directory = mkdtempSync(join(tmpdir(), 'orca-store-backup-'))
+  const databasePath = join(directory, 'profile-state.db')
+  const dataFile = join(directory, 'orca-data.json')
+  const legacyBytes = '{"settings":{"theme":"system"},"legacy":"retained"}'
+  writeFileSync(dataFile, legacyBytes)
+  const beginning = Date.now()
+  const clock = vi.spyOn(Date, 'now').mockReturnValue(beginning)
+  const authority = new ProfileStateSqliteAuthority(databasePath, PROFILE_ID)
+  const store = new Store({ dataFile, profileStateAuthority: authority })
+  fixtures.push({ directory, store, authority })
+  store.updateSettings({ theme: 'light' })
+  store.flushOrThrow()
+  await authority.drainBackups()
+  const retained = profileStateDatabaseBackups(databasePath)
+  expect(retained).toHaveLength(1)
+  const retainedBytes = readFileSync(retained[0].path)
+  clock.mockReturnValue(beginning + HOUR + 1)
+  return {
+    directory,
+    databasePath,
+    dataFile,
+    legacyBytes,
+    store,
+    authority,
+    retained,
+    retainedBytes
+  }
+}
+
+function readSnapshot(path: string) {
+  const opened = openProfileStateDatabaseReadOnly(path, PROFILE_ID)
+  try {
+    const snapshot = readProfileStateSnapshot(opened.db)
+    return { revision: snapshot.revision, state: JSON.parse(snapshot.json) }
+  } finally {
+    opened.db.close()
+  }
+}
+
+describe('Store automatic SQLite recovery snapshots', () => {
+  it.each([
+    ['selective', 'sync'],
+    ['selective', 'async'],
+    ['complete', 'sync'],
+    ['complete', 'async']
+  ] as const)('backs up a %s %s commit without rewriting retained JSON', async (scope, flush) => {
+    const state = await fixture()
+    const fullWrite = vi.spyOn(state.authority, 'writeCompleteSerializedDomains')
+    const selectiveWrite = vi.spyOn(state.authority, 'writeSerializedDomains')
+    state.store.patchWorkspaceSession({ activeWorktreeId: 'backup-worktree' })
+    if (scope === 'complete') {
+      scheduleSave(state.store)
+    }
+    if (flush === 'sync') {
+      state.store.flushOrThrow()
+      await state.authority.drainBackups()
+    } else {
+      await state.store.flushPendingOrThrowAsync()
+    }
+
+    await state.authority.drainBackups()
+    expect(scope === 'complete' ? fullWrite : selectiveWrite).toHaveBeenCalledOnce()
+    expect(scope === 'complete' ? selectiveWrite : fullWrite).not.toHaveBeenCalled()
+    const backups = profileStateDatabaseBackups(state.databasePath)
+    expect(backups).toHaveLength(2)
+    expect(readSnapshot(backups[0].path)).toEqual(readSnapshot(state.databasePath))
+    expect(readSnapshot(backups[0].path).state.workspaceSession.activeWorktreeId).toBe(
+      'backup-worktree'
+    )
+    expect(readFileSync(state.retained[0].path)).toEqual(state.retainedBytes)
+    expect(readFileSync(state.dataFile, 'utf8')).toBe(state.legacyBytes)
+    expect(
+      readdirSync(state.directory)
+        .filter((name) => name.includes('.backup.'))
+        .sort()
+    ).toEqual(backups.map((backup) => basename(backup.path)).sort())
+  })
+
+  it('acknowledges a routine flush while the previous recovery backup is still running', async () => {
+    const state = await fixture()
+    const realSnapshot = backupExecution.runProfileStateBackup
+    const started = Promise.withResolvers<void>()
+    const gate = Promise.withResolvers<void>()
+    releases.push(gate.resolve)
+    vi.spyOn(backupExecution, 'runProfileStateBackup').mockImplementationOnce(async (job) => {
+      started.resolve()
+      await gate.promise
+      await realSnapshot(job)
+    })
+    state.store.updateSettings({ theme: 'dark' })
+    state.store.flushOrThrow()
+    await started.promise
+    state.store.patchWorkspaceSession({ activeWorktreeId: 'newer-than-backup' })
+    let settled = false
+    const flush = state.store.flushPendingOrThrowAsync().then(() => {
+      settled = true
+    })
+    await vi.waitFor(() => expect(settled).toBe(true))
+    expect(readSnapshot(state.databasePath).state.workspaceSession.activeWorktreeId).toBe(
+      'newer-than-backup'
+    )
+    expect(profileStateDatabaseBackups(state.databasePath)).toHaveLength(1)
+    gate.resolve()
+    await Promise.all([flush, state.authority.drainBackups()])
+  })
+
+  it.each(['quit', 'profile mutation'] as const)(
+    '%s waits for its owned backup across Store close',
+    async (kind) => {
+      const state = await fixture()
+      const realSnapshot = backupExecution.runProfileStateBackup
+      let begin: () => void = () => {}
+      let release: () => void = () => {}
+      const started = new Promise<void>((resolve) => {
+        begin = resolve
+      })
+      const gate = new Promise<void>((resolve) => {
+        release = resolve
+      })
+      releases.push(release)
+      vi.spyOn(backupExecution, 'runProfileStateBackup').mockImplementationOnce(async (job) => {
+        begin()
+        await gate
+        await realSnapshot(job)
+      })
+      state.store.updateSettings({ theme: 'dark' })
+      state.store.flushOrThrow()
+      await started
+      const drain = vi.spyOn(state.authority, 'drainBackups')
+      let settled = false
+      const barrier = (
+        kind === 'quit'
+          ? state.store.flushAsync({ exportJsonCompatibility: true })
+          : flushActiveProfileBeforeFileMutation(state.store)
+      ).then(() => {
+        settled = true
+      })
+      await vi.waitFor(() => expect(drain).toHaveBeenCalled())
+      expect(settled).toBe(false)
+      state.store.freezeWrites()
+      expect(profileStateDatabaseBackups(state.databasePath)).toHaveLength(1)
+      release()
+      await barrier
+
+      expect(settled).toBe(true)
+      const backups = profileStateDatabaseBackups(state.databasePath)
+      expect(backups).toHaveLength(2)
+      expect(readSnapshot(backups[0].path).state.settings.theme).toBe('dark')
+      expect(readFileSync(state.retained[0].path)).toEqual(state.retainedBytes)
+      expect(JSON.parse(readFileSync(state.dataFile, 'utf8'))).toEqual(
+        readSnapshot(state.databasePath).state
+      )
+    }
+  )
+
+  it.each(['sync', 'async'] as const)(
+    'does not reject a committed %s flush when its backup fails',
+    async (flush) => {
+      const state = await fixture()
+      const log = vi.spyOn(console, 'error').mockImplementation(() => {})
+      const failure = new Error('injected backup disk failure')
+      const snapshot = vi
+        .spyOn(backupExecution, 'runProfileStateBackup')
+        .mockClear()
+        .mockRejectedValueOnce(failure)
+      state.store.updateSettings({ theme: 'dark' })
+      if (flush === 'sync') {
+        expect(() => state.store.flushOrThrow()).not.toThrow()
+        await expect(state.authority.drainBackups()).resolves.toBeUndefined()
+      } else {
+        await expect(state.store.flushPendingOrThrowAsync()).resolves.toBeUndefined()
+      }
+
+      await state.authority.drainBackups()
+      expect(snapshot).toHaveBeenCalledOnce()
+      expect(log).toHaveBeenCalledWith(
+        '[persistence] Failed to back up profile state database:',
+        failure
+      )
+      expect(readSnapshot(state.databasePath).state.settings.theme).toBe('dark')
+      expect(profileStateDatabaseBackups(state.databasePath)).toEqual(state.retained)
+      expect(readFileSync(state.retained[0].path)).toEqual(state.retainedBytes)
+      expect(readSnapshot(state.retained[0].path).state.settings.theme).toBe('light')
+      expect(readFileSync(state.dataFile, 'utf8')).toBe(state.legacyBytes)
+      expect(existsSync(`${state.dataFile}.bak.0`)).toBe(false)
+    }
+  )
+})
diff --git a/src/main/persistence/loading-store/profile-state-temp-cleanup-lifetime.test.ts b/src/main/persistence/loading-store/profile-state-temp-cleanup-lifetime.test.ts
new file mode 100644
index 000000000000..2cbdd1c59ff4
--- /dev/null
+++ b/src/main/persistence/loading-store/profile-state-temp-cleanup-lifetime.test.ts
@@ -0,0 +1,87 @@
+import { mkdtempSync, readFileSync, utimesSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { basename, join } from 'node:path'
+import { afterEach, expect, it, vi } from 'vitest'
+import { removeTreeSync } from '../../../shared/windows-transient-lock-removal'
+import * as durableFileWrite from '../../durable-file-write'
+import { STALE_DURABLE_WRITE_TEMP_AGE_MS } from '../tracking-repos/worktree-metadata-normalization'
+import {
+  createWorkerMaintenanceFixture,
+  maintenanceBarrier
+} from './profile-state-maintenance-fixture'
+import { Store } from './store'
+
+vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
+vi.mock('../../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: () => ({ nth_repo_added: 2 })
+}))
+vi.mock('../../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: () => ({ hosts: [] }),
+  sshConfigHostsToTargets: () => []
+}))
+
+const directories: string[] = []
+afterEach(() => {
+  for (const directory of directories.splice(0)) {
+    removeTreeSync(directory)
+  }
+})
+
+it.each(['maintenance', 'freeze', 'final'] as const)(
+  '%s drains startup temp cleanup without delaying ordinary SQL writes',
+  async (kind) => {
+    const gate = maintenanceBarrier()
+    const cleanup = durableFileWrite.removeStaleDurableWriteTempFiles
+    vi.spyOn(durableFileWrite, 'removeStaleDurableWriteTempFiles').mockImplementation(
+      (file, options) =>
+        basename(file) === 'orca-data.json' ? gate.promise : cleanup(file, options)
+    )
+    const { store, authority, readState } = await createWorkerMaintenanceFixture()
+    store.updateSettings({ theme: 'dark' })
+    await store.flushPendingOrThrowAsync()
+    expect(readState().settings.theme).toBe('dark')
+
+    const close = vi.spyOn(authority, 'close')
+    const checkpoint = vi.spyOn(authority, 'writeCompleteSerializedDomains')
+    const finished = vi.fn()
+    const pending =
+      kind === 'maintenance'
+        ? store.beginProfileMaintenance()
+        : kind === 'freeze'
+          ? store.freezeWritesAsync()
+          : store.flushFinalOrThrowAsync()
+    void pending.then(finished, finished)
+    await new Promise<void>((resolve) => setImmediate(resolve))
+    expect(finished).not.toHaveBeenCalled()
+    expect(close).not.toHaveBeenCalled()
+    expect(checkpoint).not.toHaveBeenCalled()
+
+    gate.resolve()
+    await pending
+    expect(close).toHaveBeenCalledOnce()
+  }
+)
+
+it('leaves legacy source temp files untouched when constructing a frozen importer', async () => {
+  const directory = mkdtempSync(join(tmpdir(), 'orca-import-temp-cleanup-'))
+  directories.push(directory)
+  const dataFile = join(directory, 'orca-data.json')
+  const source = '{"settings":{"theme":"dark"}}'
+  const staleTempFile = `${dataFile}.99999999.0.import.tmp`
+  writeFileSync(dataFile, source)
+  writeFileSync(staleTempFile, 'retained temp bytes')
+  const staleSeconds = (Date.now() - STALE_DURABLE_WRITE_TEMP_AGE_MS - 60_000) / 1000
+  utimesSync(staleTempFile, staleSeconds, staleSeconds)
+  const cleanup = vi.spyOn(durableFileWrite, 'removeStaleDurableWriteTempFiles')
+
+  const imported = new Store({ dataFile, serializedState: source })
+  expect(JSON.parse(imported.prepareProfileStateExport().json).settings.theme).toBe('dark')
+  imported.freezeWrites()
+  await Promise.all(
+    cleanup.mock.results.map((result) => (result.type === 'return' ? result.value : undefined))
+  )
+
+  expect(cleanup.mock.calls.some(([file]) => file === dataFile)).toBe(false)
+  expect(readFileSync(dataFile, 'utf8')).toBe(source)
+  expect(readFileSync(staleTempFile, 'utf8')).toBe('retained temp bytes')
+})
diff --git a/src/main/persistence/loading-store/profile-state-update-quit.test.ts b/src/main/persistence/loading-store/profile-state-update-quit.test.ts
new file mode 100644
index 000000000000..cadbdbe754ac
--- /dev/null
+++ b/src/main/persistence/loading-store/profile-state-update-quit.test.ts
@@ -0,0 +1,241 @@
+import { mkdtempSync, readFileSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import * as durableFiles from '../../durable-file-write'
+import { settleTeardownWithinDeadline } from '../../quit-teardown-deadline'
+import { openProfileStateDatabaseReadOnly } from '../profile-state/profile-state-database'
+import {
+  hashProfileStateJson,
+  readProfileStateJsonAcceptance,
+  readProfileStateSnapshot
+} from '../profile-state/profile-state-documents'
+import { ProfileStateSqliteAuthority } from '../profile-state/profile-state-sqlite-authority'
+import { createProfileStateStore } from '../profile-state/profile-state-store-factory'
+import { Store } from './store'
+
+vi.mock('electron', () => ({
+  app: {
+    getPath: () => tmpdir(),
+    getName: () => 'orca-test',
+    getVersion: () => '0.0.0-test',
+    isPackaged: false,
+    on: () => {},
+    whenReady: () => Promise.resolve()
+  },
+  safeStorage: { isEncryptionAvailable: () => false },
+  ipcMain: { on: () => {}, handle: () => {} },
+  BrowserWindow: { getAllWindows: () => [] }
+}))
+vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
+vi.mock('../../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: () => ({ nth_repo_added: 2 })
+}))
+vi.mock('../../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: () => ({ hosts: [] }),
+  sshConfigHostsToTargets: () => []
+}))
+
+const PROFILE_ID = 'update-quit-test'
+const TARGET_ID = 'remote-host'
+const fixtures: { directory: string; store: Store; authority: ProfileStateSqliteAuthority }[] = []
+const releases: (() => void)[] = []
+
+afterEach(async () => {
+  for (const release of releases.splice(0)) {
+    release()
+  }
+  for (const { store, authority, directory } of fixtures.splice(0)) {
+    await store.flushAsync()
+    await authority.drainBackups()
+    store.freezeWrites()
+    rmSync(directory, { recursive: true, force: true })
+  }
+  vi.restoreAllMocks()
+})
+
+async function fixture() {
+  const directory = mkdtempSync(join(tmpdir(), 'orca-profile-state-update-quit-'))
+  const databasePath = join(directory, 'profile-state.db')
+  const dataFile = join(directory, 'orca-data.json')
+  const authority = new ProfileStateSqliteAuthority(databasePath, PROFILE_ID)
+  const store = new Store({ dataFile, profileStateAuthority: authority })
+  fixtures.push({ directory, store, authority })
+  store.upsertSshRemotePtyLease({ targetId: TARGET_ID, ptyId: 'remote-pty', state: 'attached' })
+  await store.flushPendingOrThrowAsync()
+  store.writeLatestProfileStateJsonExport()
+  store.writeLatestProfileStateJsonCompatibilityExport()
+  return { store, authority, databasePath, dataFile }
+}
+
+function persistedState(databasePath: string) {
+  const opened = openProfileStateDatabaseReadOnly(databasePath, PROFILE_ID)
+  try {
+    return {
+      ...readProfileStateSnapshot(opened.db),
+      acceptance: readProfileStateJsonAcceptance(opened.db)
+    }
+  } finally {
+    opened.db.close()
+  }
+}
+
+function gate() {
+  let release: () => void = () => {}
+  const promise = new Promise<void>((resolve) => {
+    release = resolve
+  })
+  releases.push(release)
+  return { promise, release }
+}
+
+describe('SQLite profile state during an update quit', () => {
+  it('exports final SSH shutdown writes and reloads them through the frozen JSON importer', async () => {
+    const { store, dataFile, databasePath } = await fixture()
+    store.markSshRemotePtyLeasesForShutdown(TARGET_ID, 'detached')
+
+    await store.flushAsync({ exportJsonCompatibility: true })
+
+    const json = readFileSync(dataFile, 'utf8')
+    const snapshot = persistedState(databasePath)
+    expect(json).toBe(snapshot.json)
+    expect(snapshot.acceptance).toEqual({
+      jsonHash: hashProfileStateJson(json),
+      acceptedRevision: snapshot.revision
+    })
+    const legacy = new Store({ dataFile, serializedState: json })
+    try {
+      expect(legacy.getSshRemotePtyLeases(TARGET_ID)).toEqual([
+        expect.objectContaining({ state: 'detached', lastDetachedAt: expect.any(Number) })
+      ])
+    } finally {
+      legacy.freezeWrites()
+    }
+  })
+
+  it('exports a normal quit for an older build after sessions and settings changed', async () => {
+    const { store, dataFile, databasePath } = await fixture()
+    store.updateSettings({ theme: 'dark' })
+    store.markSshRemotePtyLeasesForShutdown(TARGET_ID, 'detached')
+
+    await store.flushFinalOrThrowAsync({ exportJsonCompatibility: true })
+
+    const json = readFileSync(dataFile, 'utf8')
+    expect(json).toBe(persistedState(databasePath).json)
+    const legacy = new Store({ dataFile, serializedState: json })
+    try {
+      expect(legacy.getSettings().theme).toBe('dark')
+      expect(legacy.getSshRemotePtyLeases(TARGET_ID)[0]?.state).toBe('detached')
+    } finally {
+      legacy.freezeWrites()
+    }
+  })
+
+  it('does not publish or accept a snapshot when final persistence fails', async () => {
+    const { store, authority, dataFile, databasePath } = await fixture()
+    const retainedJson = readFileSync(dataFile, 'utf8')
+    const before = persistedState(databasePath)
+    const failure = new Error('injected final commit failure')
+    vi.spyOn(console, 'error').mockImplementation(() => {})
+    vi.spyOn(authority, 'writeCompleteSerializedDomains').mockImplementation(() => {
+      throw failure
+    })
+    const exportJson = vi.spyOn(authority, 'writeJsonCompatibilityExportAsync')
+    store.markSshRemotePtyLeasesForShutdown(TARGET_ID, 'detached')
+
+    await store.flushAsync({ exportJsonCompatibility: true })
+
+    expect(exportJson).not.toHaveBeenCalled()
+    expect(readFileSync(dataFile, 'utf8')).toBe(retainedJson)
+    expect(persistedState(databasePath)).toEqual(before)
+  })
+
+  it('retains the preflight export and acceptance if the final file write fails', async () => {
+    const { store, dataFile, databasePath } = await fixture()
+    const retainedJson = readFileSync(dataFile, 'utf8')
+    const before = persistedState(databasePath)
+    const failure = new Error('injected final export failure')
+    const log = vi.spyOn(console, 'error').mockImplementation(() => {})
+    vi.spyOn(durableFiles, 'writeFileDurable').mockRejectedValueOnce(failure)
+    store.markSshRemotePtyLeasesForShutdown(TARGET_ID, 'detached')
+
+    await store.flushAsync({ exportJsonCompatibility: true })
+
+    expect(readFileSync(dataFile, 'utf8')).toBe(retainedJson)
+    expect(persistedState(databasePath).acceptance).toMatchObject(before.acceptance ?? {})
+    expect(persistedState(databasePath).revision).toBeGreaterThan(before.revision)
+    expect(log).toHaveBeenCalledWith('[persistence] Failed to flush final state:', failure)
+  })
+
+  it('joins the final barrier and permits its deadline while the JSON file write stalls', async () => {
+    const { store, dataFile, databasePath } = await fixture()
+    const retainedJson = readFileSync(dataFile, 'utf8')
+    const writing = gate()
+    const held = gate()
+    const writeFileDurable = durableFiles.writeFileDurable
+    const exportWrite = vi
+      .spyOn(durableFiles, 'writeFileDurable')
+      .mockImplementationOnce(async (...args) => {
+        writing.release()
+        await held.promise
+        await writeFileDurable(...args)
+      })
+    store.markSshRemotePtyLeasesForShutdown(TARGET_ID, 'detached')
+    const pending = store.flushAsync({ exportJsonCompatibility: true })
+    expect(store.flushAsync()).toBe(pending)
+    await writing.promise
+
+    await expect(
+      settleTeardownWithinDeadline([{ name: 'state', promise: pending }], 25)
+    ).resolves.toEqual(['state'])
+    expect(readFileSync(dataFile, 'utf8')).toBe(retainedJson)
+    held.release()
+    await pending
+
+    expect(exportWrite).toHaveBeenCalledOnce()
+    expect(readFileSync(dataFile, 'utf8')).toBe(persistedState(databasePath).json)
+  })
+
+  it('reopens the latest SQLite state when a concurrent commit prevents export promotion', async () => {
+    const { store, dataFile, databasePath } = await fixture()
+    const before = persistedState(databasePath)
+    const log = vi.spyOn(console, 'error').mockImplementation(() => {})
+    const writeFileDurable = durableFiles.writeFileDurable
+    vi.spyOn(durableFiles, 'writeFileDurable').mockImplementationOnce(async (...args) => {
+      await writeFileDurable(...args)
+      const competitor = new ProfileStateSqliteAuthority(databasePath, PROFILE_ID)
+      try {
+        competitor.readSerializedState()
+        competitor.writeSerializedDomains([{ domain: 'settings', payload: '{"theme":"dark"}' }])
+      } finally {
+        competitor.close()
+      }
+    })
+    store.markSshRemotePtyLeasesForShutdown(TARGET_ID, 'detached')
+
+    await store.flushAsync({ exportJsonCompatibility: true })
+
+    const snapshot = persistedState(databasePath)
+    expect(snapshot.acceptance).toMatchObject(before.acceptance ?? {})
+    expect(snapshot.acceptance?.pending?.jsonHash).toBe(
+      hashProfileStateJson(readFileSync(dataFile, 'utf8'))
+    )
+    expect(log).toHaveBeenCalledWith(
+      '[persistence] Failed to flush final state:',
+      expect.objectContaining({ code: 'profile-state-revision-conflict' })
+    )
+    store.freezeWrites()
+    const reopened = createProfileStateStore({
+      dataFile,
+      databaseFile: databasePath,
+      profileId: PROFILE_ID
+    })
+    try {
+      expect(reopened.backend).toBe('sqlite')
+      expect(reopened.store.getSettings().theme).toBe('dark')
+      expect(reopened.store.getSshRemotePtyLeases(TARGET_ID)[0]?.state).toBe('detached')
+    } finally {
+      reopened.store.freezeWrites()
+    }
+  })
+})
diff --git a/src/main/persistence/loading-store/profile-state-worker-coordination.test.ts b/src/main/persistence/loading-store/profile-state-worker-coordination.test.ts
new file mode 100644
index 000000000000..7144abe07896
--- /dev/null
+++ b/src/main/persistence/loading-store/profile-state-worker-coordination.test.ts
@@ -0,0 +1,335 @@
+import { describe, expect, it, vi } from 'vitest'
+import { ProfileStateWriterError } from '../profile-state/profile-state-writer-errors'
+import { fixture } from './profile-state-delayed-authority-fixture'
+import { StateSerializationSecretHandlingOperations } from './state-serialization-secret-handling'
+vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
+vi.mock('../../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: () => ({ nth_repo_added: 2 })
+}))
+vi.mock('../../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: () => ({ hosts: [] }),
+  sshConfigHostsToTargets: () => []
+}))
+
+describe('worker-owned Store writes', () => {
+  it('consumes the debounce timer and avoids full checkpoints after a selective durable write', async () => {
+    const { store, authority, readState } = await fixture()
+    const full = vi.spyOn(authority, 'writeCompleteSerializedDomains')
+    const selective = vi.spyOn(authority, 'writeSerializedDomains')
+    vi.useFakeTimers()
+    try {
+      await store.runDurableMutation(() => {
+        store.updateSettings({ theme: 'dark' })
+        return { value: undefined }
+      })
+      await vi.advanceTimersByTimeAsync(6_000)
+      await store.waitForPendingWrite()
+      expect(selective).toHaveBeenCalledOnce()
+      expect(full).not.toHaveBeenCalled()
+      expect(readState().settings.theme).toBe('dark')
+    } finally {
+      vi.useRealTimers()
+    }
+  })
+
+  it('still captures direct durable mutations that do not identify dirty domains', async () => {
+    const { store, readState } = await fixture()
+    await store.runDurableMutation(() => {
+      store.getWorkspaceSession().activeTabId = 'direct-mutation'
+      return { value: undefined }
+    })
+    expect(readState().workspaceSession.activeTabId).toBe('direct-mutation')
+  })
+
+  it('skips a debounce callback already queued behind the write that consumed its changes', async () => {
+    const { store, authority } = await fixture()
+    const full = vi.spyOn(authority, 'writeCompleteSerializedDomains')
+    const gate = authority.pause()
+    vi.useFakeTimers()
+    try {
+      const durable = store.runDurableMutation(() => {
+        store.updateSettings({ theme: 'dark' })
+        return { value: undefined }
+      })
+      await gate.started.promise
+      await vi.advanceTimersByTimeAsync(1_000)
+      gate.finish.resolve()
+      await durable
+      await store.waitForPendingWrite()
+      expect(full).not.toHaveBeenCalled()
+    } finally {
+      gate.finish.resolve()
+      vi.useRealTimers()
+    }
+  })
+
+  it('handles a rejected debounced save and retains it for an explicit retry', async () => {
+    const { store, authority, readState } = await fixture()
+    const log = vi.spyOn(console, 'error').mockImplementation(() => {})
+    const gate = authority.pause()
+    vi.useFakeTimers()
+    try {
+      store.updateSettings({ theme: 'dark' })
+      await vi.advanceTimersByTimeAsync(1000)
+      await gate.started.promise
+      gate.finish.reject(new Error('disk refused'))
+      await store.waitForPendingWrite()
+      expect(log).toHaveBeenCalled()
+    } finally {
+      vi.useRealTimers()
+    }
+    await store.flushPendingOrThrowAsync()
+    expect(readState().settings.theme).toBe('dark')
+  })
+
+  it('refuses an export when serialization invalidates its full checkpoint', async () => {
+    const { store, authority, readState } = await fixture()
+    vi.spyOn(console, 'error').mockImplementation(() => {})
+    const publish = vi.spyOn(authority, 'writeLatestJsonExport')
+    const session = store.getWorkspaceSession()
+    Object.defineProperty(session, 'toJSON', {
+      configurable: true,
+      value: () => {
+        store.updateSettings({ theme: 'light' })
+        return { ...session }
+      }
+    })
+    try {
+      await expect(store.writeLatestProfileStateJsonExportAsync()).rejects.toThrow(
+        'changed while preparing its export'
+      )
+      expect(publish).not.toHaveBeenCalled()
+    } finally {
+      Reflect.deleteProperty(session, 'toJSON')
+    }
+    await store.writeLatestProfileStateJsonExportAsync()
+    expect(readState().settings.theme).toBe('light')
+    expect(publish).toHaveBeenCalledOnce()
+  })
+
+  it('retains selective write intent when a toJSON hook changes the captured generation', async () => {
+    const { store, authority, readState } = await fixture()
+    vi.spyOn(console, 'error').mockImplementation(() => {})
+    const selective = vi.spyOn(authority, 'writeSerializedDomains')
+    const serialize = vi.fn((key: string) => {
+      expect(key).toBe('workspaceSession')
+      store.updateSettings({ theme: 'light' })
+      return { ...store.getWorkspaceSession() }
+    })
+    try {
+      await expect(
+        store.runDurableMutation(() => {
+          store.patchWorkspaceSession({ activeTabId: 'captured-tab' })
+          Object.defineProperty(store.getWorkspaceSession(), 'toJSON', {
+            configurable: true,
+            value: serialize
+          })
+          return { value: undefined }
+        })
+      ).rejects.toThrow('changed while preparing its durable snapshot')
+      expect(serialize).toHaveBeenCalledOnce()
+      expect(selective).not.toHaveBeenCalled()
+    } finally {
+      Reflect.deleteProperty(store.getWorkspaceSession(), 'toJSON')
+    }
+    await store.flushPendingOrThrowAsync()
+    expect(readState()).toMatchObject({
+      settings: { theme: 'light' },
+      workspaceSession: { activeTabId: 'captured-tab' }
+    })
+    expect(selective).toHaveBeenCalledOnce()
+  })
+
+  it('preserves canonical domain bytes and revisions for raw JSON and proxy-valued hooks', async () => {
+    if (!('rawJSON' in JSON) || typeof JSON.rawJSON !== 'function') {
+      throw new Error('This test requires native JSON.rawJSON support')
+    }
+    const overflow: unknown = JSON.rawJSON('1e999')
+    const escaped: unknown = JSON.rawJSON('"\\u0061"')
+    const { store, authority, readState } = await fixture()
+    store.patchWorkspaceSession({ activeTabId: 'pending-tab' })
+    const session = store.getWorkspaceSession()
+    const keyOrder = new Proxy({ 1: 'one', 2: 'two' }, { ownKeys: () => ['2', '1'] })
+    const serialize = vi.fn(() => ({ ...session, activeTabId: escaped, overflow, keyOrder }))
+    Object.defineProperty(session, 'toJSON', { configurable: true, value: serialize })
+    const expected = JSON.stringify({
+      ...session,
+      activeTabId: 'a',
+      overflow: null,
+      keyOrder: {
+        1: 'one',
+        2: 'two'
+      }
+    })
+    try {
+      await store.flushPendingOrThrowAsync()
+      expect(authority.captures.at(-1)).toContainEqual({
+        domain: 'workspaceSession',
+        payload: expected
+      })
+      expect(readState().workspaceSession).toMatchObject({ activeTabId: 'a', overflow: null })
+      expect(serialize).toHaveBeenCalledOnce()
+      const revision = authority.inner.revision
+      store.setWorkspaceSession(session)
+      await store.flushPendingOrThrowAsync()
+      expect(authority.inner.revision).toBe(revision)
+      expect(serialize).toHaveBeenCalledTimes(2)
+    } finally {
+      Reflect.deleteProperty(session, 'toJSON')
+    }
+  })
+
+  it('retains a newer edit after an older write is acknowledged', async () => {
+    const { store, authority, readState } = await fixture()
+    const gate = authority.pause()
+    store.updateSettings({ theme: 'dark' })
+    const first = store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
+    await gate.started.promise
+    store.updateSettings({ theme: 'light' })
+    gate.finish.resolve()
+    await first
+    expect(readState().settings.theme).toBe('dark')
+    await store.flushPendingOrThrowAsync()
+    expect(readState().settings.theme).toBe('light')
+  })
+
+  it('merges a failed older write with dirty state added while it was in flight', async () => {
+    const { store, authority, readState } = await fixture()
+    vi.spyOn(console, 'error').mockImplementation(() => {})
+    const gate = authority.pause()
+    store.updateSettings({ theme: 'dark' })
+    const first = store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
+    const rejected = expect(first).rejects.toThrow('disk refused')
+    await gate.started.promise
+    store.getWorkspaceSession().activeTabId = 'newer-tab'
+    store.setWorkspaceSession(store.getWorkspaceSession())
+    gate.finish.reject(new Error('disk refused'))
+    await rejected
+    await store.flushPendingOrThrowAsync()
+    expect(readState()).toMatchObject({
+      settings: { theme: 'dark' },
+      workspaceSession: { activeTabId: 'newer-tab' }
+    })
+  })
+
+  it('captures a full checkpoint after an older save even without a new generation', async () => {
+    const { store, authority, readState } = await fixture()
+    const gate = authority.pause()
+    store.updateSettings({ theme: 'dark' })
+    const first = store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
+    await gate.started.promise
+    store.getWorkspaceSession().activeTabId = 'getter-only-tab'
+    const final = store.flushAsync()
+    gate.finish.resolve()
+    await first
+    await final
+    expect(readState().workspaceSession.activeTabId).toBe('getter-only-tab')
+    expect(authority.captures.at(-1)?.some(({ domain }) => domain === 'workspaceSession')).toBe(
+      true
+    )
+  })
+
+  it('reserves ordering before an exact mutation changes live state', async () => {
+    const { store, authority, readState } = await fixture()
+    const gate = authority.pause()
+    store.updateSettings({ theme: 'dark' })
+    const first = store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
+    await gate.started.promise
+    const mutate = vi.fn(() => {
+      store.updateSettings({ theme: 'light' })
+      return { value: 'durable' }
+    })
+    const exact = store.runDurableMutation(mutate)
+    await Promise.resolve()
+    expect(mutate).not.toHaveBeenCalled()
+    expect(store.getSettings().theme).toBe('dark')
+    gate.finish.resolve()
+    await first
+    await expect(exact).resolves.toBe('durable')
+    expect(readState().settings.theme).toBe('light')
+  })
+
+  it('retains dirty intent while many durability waiters share an active snapshot', async () => {
+    const { store, authority, readState } = await fixture()
+    const fullCapture = vi.spyOn(
+      StateSerializationSecretHandlingOperations.prototype,
+      'buildStateToSave'
+    )
+    const gate = authority.pause()
+    store.updateSettings({ terminalFontSize: 12 })
+    const first = store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
+    await gate.started.promise
+    const waiters: Promise<void>[] = [first]
+    for (let size = 13; size <= 32; size++) {
+      store.updateSettings({ terminalFontSize: size })
+      waiters.push(store.flushPendingOrThrowAsync({ drainToStableGeneration: false }))
+    }
+    await Promise.resolve()
+    expect(authority.captures).toHaveLength(1)
+    gate.finish.resolve()
+    await Promise.all(waiters)
+    expect(readState().settings.terminalFontSize).toBe(32)
+    expect(fullCapture).toHaveBeenCalledOnce()
+    expect(authority.captures).toHaveLength(2)
+  })
+
+  it('cancels a queued checkpoint without aborting the preceding writer or losing edits', async () => {
+    const { store, authority, readState } = await fixture()
+    vi.spyOn(console, 'error').mockImplementation(() => {})
+    const abortWriter = vi.spyOn(authority, 'abort')
+    const gate = authority.pause()
+    store.updateSettings({ theme: 'dark' })
+    const first = store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
+    await gate.started.promise
+    const controller = new AbortController()
+    store.updateSettings({ theme: 'light' })
+    const canceled = store.flushPendingOrThrowAsync({ signal: controller.signal })
+    const refused = expect(canceled).rejects.toThrow('aborted')
+    controller.abort()
+    gate.finish.resolve()
+    await first
+    await refused
+    expect(abortWriter).not.toHaveBeenCalled()
+    await store.flushPendingOrThrowAsync()
+    expect(readState().settings.theme).toBe('light')
+  })
+
+  it.each(['known-failure', 'indeterminate'] as const)(
+    'only rolls back a mutation with a known failure (%s)',
+    async (outcome) => {
+      const { store, authority } = await fixture()
+      vi.spyOn(console, 'error').mockImplementation(() => {})
+      const gate = authority.pause()
+      const rollback = vi.fn()
+      const exact = store.runDurableMutation(() => {
+        store.updateSettings({ theme: 'dark' })
+        return { value: undefined, rollback }
+      })
+      const rejected = expect(exact).rejects.toThrow('write failed')
+      await gate.started.promise
+      gate.finish.reject(new ProfileStateWriterError('test', 'write failed', outcome))
+      await rejected
+      expect(rollback).toHaveBeenCalledTimes(outcome === 'known-failure' ? 1 : 0)
+    }
+  )
+
+  it('awaits accepted operations before closing and refuses new exact mutations', async () => {
+    const { store, authority, readState } = await fixture()
+    const gate = authority.pause()
+    const first = store.runDurableMutation(() => {
+      store.updateSettings({ theme: 'dark' })
+      return { value: undefined }
+    })
+    await gate.started.promise
+    const closing = store.freezeWritesAsync()
+    await expect(store.runDurableMutation(() => ({ value: undefined }))).rejects.toThrow(
+      'finalized'
+    )
+    expect(authority.close).not.toHaveBeenCalled()
+    gate.finish.resolve()
+    await first
+    await closing
+    expect(authority.close).toHaveBeenCalledTimes(1)
+    expect(readState().settings.theme).toBe('dark')
+  })
+})
diff --git a/src/main/persistence/loading-store/profile-state-worker-secret-retention.test.ts b/src/main/persistence/loading-store/profile-state-worker-secret-retention.test.ts
new file mode 100644
index 000000000000..4d72ce144c62
--- /dev/null
+++ b/src/main/persistence/loading-store/profile-state-worker-secret-retention.test.ts
@@ -0,0 +1,124 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { getSecretStore, setSecretStore } from '../../../shared/secret-store'
+import { fixture } from './profile-state-delayed-authority-fixture'
+
+vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
+vi.mock('../../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: () => ({ nth_repo_added: 2 })
+}))
+vi.mock('../../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: () => ({ hosts: [] }),
+  sshConfigHostsToTargets: () => []
+}))
+
+let encryptionAvailable = true
+let previousSecretStore: ReturnType<typeof getSecretStore>
+const ciphertext = (plaintext: string) => Buffer.from(`sealed:${plaintext}`).toString('base64')
+
+beforeEach(() => {
+  encryptionAvailable = true
+  previousSecretStore = getSecretStore()
+  setSecretStore({
+    isEncryptionAvailable: () => encryptionAvailable,
+    encryptString: (value) => Buffer.from(`sealed:${value}`),
+    decryptString: (value) => value.toString().slice('sealed:'.length),
+    describeProtectionGap: () => null
+  })
+})
+afterEach(() => setSecretStore(previousSecretStore))
+
+describe.each(['opencodeSessionCookie', 'opencodeGoApiKey'] as const)(
+  'Store %s retention across worker acknowledgements',
+  (setting) => {
+    it('does not restore ciphertext cleared while its commit acknowledgement was pending', async () => {
+      const { store, authority, readState } = await fixture()
+      store.updateSettings({ [setting]: 'durable' })
+      await store.flushPendingOrThrowAsync()
+      const gate = authority.pause()
+      store.updateSettings({ [setting]: 'in-flight' })
+      const write = store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
+      await gate.started.promise
+      store.updateSettings({ [setting]: '' })
+      encryptionAvailable = false
+      gate.finish.resolve()
+      await write
+      await store.flushPendingOrThrowAsync()
+      expect(readState().settings[setting]).toBe('')
+      expect(store.getSettings()[setting]).toBe('')
+    })
+
+    it('retains confirmed ciphertext until a newer secret can be encrypted', async () => {
+      const { store, authority, readState } = await fixture()
+      store.updateSettings({ [setting]: 'durable' })
+      await store.flushPendingOrThrowAsync()
+      const gate = authority.pause()
+      store.updateSettings({ [setting]: 'in-flight' })
+      const write = store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
+      await gate.started.promise
+      store.updateSettings({ [setting]: 'newer' })
+      encryptionAvailable = false
+      gate.finish.resolve()
+      await write
+      await store.flushPendingOrThrowAsync()
+      expect(readState().settings[setting]).toBe(ciphertext('in-flight'))
+      expect(store.getSettings()[setting]).toBe('newer')
+      encryptionAvailable = true
+      store.updateSettings({ theme: 'dark' })
+      await store.flushPendingOrThrowAsync()
+      expect(readState().settings[setting]).toBe(ciphertext('newer'))
+    })
+
+    it('retains the earlier ciphertext after a failed write and retries newer plaintext', async () => {
+      const { store, authority, readState } = await fixture()
+      vi.spyOn(console, 'error').mockImplementation(() => {})
+      store.updateSettings({ [setting]: 'durable' })
+      await store.flushPendingOrThrowAsync()
+      const gate = authority.pause()
+      store.updateSettings({ [setting]: 'failed' })
+      const write = store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
+      const failure = expect(write).rejects.toThrow('disk refused')
+      await gate.started.promise
+      store.updateSettings({ [setting]: 'newer' })
+      encryptionAvailable = false
+      gate.finish.reject(new Error('disk refused'))
+      await failure
+      await store.flushPendingOrThrowAsync()
+      expect(readState().settings[setting]).toBe(ciphertext('durable'))
+      encryptionAvailable = true
+      store.updateSettings({ theme: 'dark' })
+      await store.flushPendingOrThrowAsync()
+      expect(readState().settings[setting]).toBe(ciphertext('newer'))
+    })
+  }
+)
+
+describe('worker protected settings serialization', () => {
+  it.each(['selective', 'complete'] as const)(
+    'encrypts both protected credentials in a %s write to SQLite',
+    async (mode) => {
+      const { store, authority, readState } = await fixture()
+      const selectiveWrite = vi.spyOn(authority, 'writeSerializedDomains')
+      const completeWrite = vi.spyOn(authority, 'writeCompleteSerializedDomains')
+      const secrets = {
+        opencodeSessionCookie: 'cookie-only-plaintext',
+        opencodeGoApiKey: 'api-key-only-plaintext'
+      }
+      store.updateSettings(secrets)
+      if (mode === 'complete') {
+        store.updateOnboarding({ outcome: 'completed' })
+      }
+      await store.flushPendingOrThrowAsync()
+      expect(selectiveWrite).toHaveBeenCalledTimes(mode === 'selective' ? 1 : 0)
+      expect(completeWrite).toHaveBeenCalledTimes(mode === 'complete' ? 1 : 0)
+      const persisted = readState()
+      expect(persisted.settings).toMatchObject({
+        opencodeSessionCookie: ciphertext(secrets.opencodeSessionCookie),
+        opencodeGoApiKey: ciphertext(secrets.opencodeGoApiKey)
+      })
+      for (const plaintext of Object.values(secrets)) {
+        expect(JSON.stringify(persisted)).not.toContain(plaintext)
+      }
+      expect(store.getSettings()).toMatchObject(secrets)
+    }
+  )
+})
diff --git a/src/main/persistence/loading-store/profile-state-write-batching.test.ts b/src/main/persistence/loading-store/profile-state-write-batching.test.ts
new file mode 100644
index 000000000000..fb6f44a5d8af
--- /dev/null
+++ b/src/main/persistence/loading-store/profile-state-write-batching.test.ts
@@ -0,0 +1,251 @@
+import { describe, expect, it, vi } from 'vitest'
+import { deferred, fixture } from './profile-state-delayed-authority-fixture'
+import { StateSerializationSecretHandlingOperations } from './state-serialization-secret-handling'
+import * as composition from './store-domain-composition'
+import type { StoreRuntimeState } from './store-runtime-state'
+import { ProfileStateRevisionConflictError } from '../profile-state/profile-state-document-validation'
+
+vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
+vi.mock('../../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: () => ({ nth_repo_added: 2 })
+}))
+vi.mock('../../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: () => ({ hosts: [] }),
+  sshConfigHostsToTargets: () => []
+}))
+
+async function snapshotFixture() {
+  let captured: StoreRuntimeState | undefined
+  const createDomains = composition.createStoreDomains
+  vi.spyOn(composition, 'createStoreDomains').mockImplementationOnce((runtime) => {
+    captured = runtime
+    return createDomains(runtime)
+  })
+  const state = await fixture()
+  if (!captured) {
+    throw new Error('Store runtime was not initialized')
+  }
+  return { ...state, runtime: captured }
+}
+
+describe('queued worker snapshot batching', () => {
+  it.each(['explicit', 'debounce'] as const)(
+    'preserves getter-only edits when an explicit flush joins a dirty %s batch',
+    async (firstFlush) => {
+      const { store, authority, readState } = await fixture()
+      const gate = authority.pause()
+      vi.useFakeTimers()
+      try {
+        const mutation = store.runDurableMutation(() => {
+          store.updateSettings({ theme: 'dark' })
+          return { value: undefined }
+        })
+        await gate.started.promise
+        const first =
+          firstFlush === 'explicit'
+            ? store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
+            : await vi.advanceTimersByTimeAsync(1_000)
+        store.getWorkspaceSession().activeTabId = 'getter-only-edit'
+        store.updateSettings({ theme: 'light' })
+        const second = store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
+        gate.finish.resolve()
+        await Promise.all([mutation, first, second])
+        expect(readState()).toMatchObject({
+          settings: { theme: 'light' },
+          workspaceSession: { activeTabId: 'getter-only-edit' }
+        })
+        expect(authority.captures).toHaveLength(2)
+      } finally {
+        gate.finish.resolve()
+        vi.useRealTimers()
+      }
+    }
+  )
+
+  it('preserves a queued explicit capture when a later debounce joins it', async () => {
+    const { store, authority, readState } = await fixture()
+    const gate = authority.pause()
+    vi.useFakeTimers()
+    try {
+      const mutation = store.runDurableMutation(() => {
+        store.updateSettings({ theme: 'dark' })
+        return { value: undefined }
+      })
+      await gate.started.promise
+      store.getWorkspaceSession().activeTabId = 'getter-only-edit'
+      const explicit = store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
+      store.updateSettings({ theme: 'light' })
+      await vi.advanceTimersByTimeAsync(1_000)
+      gate.finish.resolve()
+      await Promise.all([mutation, explicit])
+      expect(readState()).toMatchObject({
+        settings: { theme: 'light' },
+        workspaceSession: { activeTabId: 'getter-only-edit' }
+      })
+      expect(authority.captures).toHaveLength(2)
+    } finally {
+      gate.finish.resolve()
+      vi.useRealTimers()
+    }
+  })
+
+  it('keeps batches of only debounced saves selective', async () => {
+    const { store, authority, readState } = await fixture()
+    const full = vi.spyOn(authority, 'writeCompleteSerializedDomains')
+    const gate = authority.pause()
+    vi.useFakeTimers()
+    try {
+      const mutation = store.runDurableMutation(() => {
+        store.updateSettings({ theme: 'dark' })
+        return { value: undefined }
+      })
+      await gate.started.promise
+      await vi.advanceTimersByTimeAsync(1_000)
+      store.updateSettings({ theme: 'light' })
+      await vi.advanceTimersByTimeAsync(1_000)
+      gate.finish.resolve()
+      await mutation
+      await store.waitForPendingWrite()
+      expect(readState().settings.theme).toBe('light')
+      expect(authority.captures).toHaveLength(2)
+      expect(full).not.toHaveBeenCalled()
+    } finally {
+      gate.finish.resolve()
+      vi.useRealTimers()
+    }
+  })
+
+  it('captures getter-only edits in a flush requested after the preceding capture started', async () => {
+    const { store, authority, readState } = await fixture()
+    const fullCapture = vi.spyOn(
+      StateSerializationSecretHandlingOperations.prototype,
+      'buildStateToSave'
+    )
+    const firstGate = authority.pause()
+    store.updateSettings({ theme: 'dark' })
+    const first = store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
+    await firstGate.started.promise
+    store.getWorkspaceSession().activeTabId = 'getter-only-edit'
+    const second = store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
+    firstGate.finish.resolve()
+    await Promise.all([first, second])
+    expect(readState().workspaceSession.activeTabId).toBe('getter-only-edit')
+    expect(fullCapture).toHaveBeenCalledOnce()
+  })
+
+  it('upgrades a queued debounce to capture an explicit getter-only flush', async () => {
+    const { store, authority, readState } = await fixture()
+    const gate = authority.pause()
+    vi.useFakeTimers()
+    try {
+      const first = store.runDurableMutation(() => {
+        store.updateSettings({ theme: 'dark' })
+        return { value: undefined }
+      })
+      await gate.started.promise
+      await vi.advanceTimersByTimeAsync(1_000)
+      store.getWorkspaceSession().activeTabId = 'explicit-edit'
+      const explicit = store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
+      gate.finish.resolve()
+      await Promise.all([first, explicit])
+      expect(readState().workspaceSession.activeTabId).toBe('explicit-edit')
+    } finally {
+      gate.finish.resolve()
+      vi.useRealTimers()
+    }
+  })
+
+  it('keeps a later flush ordered after an intervening durable mutation', async () => {
+    const { store, authority, readState } = await fixture()
+    const gate = authority.pause()
+    store.updateSettings({ theme: 'dark' })
+    const first = store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
+    await gate.started.promise
+    const before = store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
+    const mutation = store.runDurableMutation(() => {
+      store.updateSettings({ theme: 'light' })
+      return { value: undefined }
+    })
+    const after = store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
+    const verifyAfter = after.then(() => expect(readState().settings.theme).toBe('light'))
+    gate.finish.resolve()
+    await Promise.all([first, before, mutation, verifyAfter])
+  })
+
+  it('shares a queued write failure with its waiters and allows a fresh retry', async () => {
+    const { store, authority, readState } = await fixture()
+    vi.spyOn(console, 'error').mockImplementation(() => {})
+    const gate = authority.pause()
+    store.updateSettings({ theme: 'dark' })
+    const first = store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
+    await gate.started.promise
+    store.updateSettings({ theme: 'light' })
+    const failed = [
+      store.flushPendingOrThrowAsync({ drainToStableGeneration: false }),
+      store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
+    ].map((waiter) => expect(waiter).rejects.toThrow('disk refused'))
+    vi.spyOn(authority, 'writeCompleteSerializedDomains').mockRejectedValueOnce(
+      new Error('disk refused')
+    )
+    gate.finish.resolve()
+    await Promise.all([first, ...failed])
+    await store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
+    expect(readState().settings.theme).toBe('light')
+  })
+
+  it('checks the disk revision for a clean batch and rejects every waiter on conflict', async () => {
+    const { store, authority } = await fixture()
+    vi.spyOn(console, 'error').mockImplementation(() => {})
+    const conflict = new ProfileStateRevisionConflictError(1, 2)
+    const revisionCheck = vi
+      .spyOn(authority, 'assertCurrentRevision')
+      .mockRejectedValueOnce(conflict)
+    const waiters = [
+      store.flushPendingOrThrowAsync({ drainToStableGeneration: false }),
+      store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
+    ]
+    await Promise.all(waiters.map((waiter) => expect(waiter).rejects.toBe(conflict)))
+    expect(revisionCheck).toHaveBeenCalledOnce()
+  })
+
+  it('waits for snapshot files admitted by a later member of the queued batch', async () => {
+    const { store, authority, readState, runtime } = await snapshotFixture()
+    const gate = authority.pause()
+    store.updateSettings({ theme: 'dark' })
+    const first = store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
+    await gate.started.promise
+    const second = store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
+    const snapshot = deferred<void>()
+    runtime.pendingSnapshotFileWork = snapshot.promise
+    store.updateSettings({ theme: 'light' })
+    const third = store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
+    try {
+      gate.finish.resolve()
+      await first
+      await new Promise<void>((resolve) => setImmediate(resolve))
+      expect(authority.captures).toHaveLength(1)
+    } finally {
+      snapshot.resolve()
+      runtime.pendingSnapshotFileWork = null
+      await Promise.all([second, third])
+    }
+    expect(readState().settings.theme).toBe('light')
+  })
+
+  it('discards a queued batch when its predecessor dependency rejects', async () => {
+    const { store, readState, runtime } = await snapshotFixture()
+    vi.spyOn(console, 'error').mockImplementation(() => {})
+    runtime.pendingSnapshotFileWork = Promise.reject(new Error('snapshot preparation failed'))
+    const waiters = [
+      store.flushPendingOrThrowAsync({ drainToStableGeneration: false }),
+      store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
+    ]
+    await Promise.all(
+      waiters.map((waiter) => expect(waiter).rejects.toThrow('snapshot preparation failed'))
+    )
+    runtime.pendingSnapshotFileWork = null
+    store.updateSettings({ theme: 'light' })
+    await store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
+    expect(readState().settings.theme).toBe('light')
+  })
+})
diff --git a/src/main/persistence/loading-store/pty-binding-async-durability.test.ts b/src/main/persistence/loading-store/pty-binding-async-durability.test.ts
new file mode 100644
index 000000000000..066cea3cce50
--- /dev/null
+++ b/src/main/persistence/loading-store/pty-binding-async-durability.test.ts
@@ -0,0 +1,267 @@
+import { describe, expect, it, vi } from 'vitest'
+import { TEST_LEAF_1, TEST_LEAF_2 } from '../../persistence-session-fixtures'
+import { ProfileStateWriterError } from '../profile-state/profile-state-writer-errors'
+import { fixture } from './profile-state-delayed-authority-fixture'
+
+vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
+vi.mock('../../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: () => ({ nth_repo_added: 2 })
+}))
+vi.mock('../../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: () => ({ hosts: [] }),
+  sshConfigHostsToTargets: () => []
+}))
+
+const binding = {
+  worktreeId: 'repo-local::/fixture/local',
+  tabId: 'async-binding-tab',
+  leafId: TEST_LEAF_1,
+  ptyId: 'async-binding-pty',
+  incarnationId: 'async-binding-incarnation'
+}
+
+describe('durable asynchronous PTY binding', () => {
+  it('acknowledges only after the binding reaches SQLite', async () => {
+    const { store, authority, readState } = await fixture()
+    store.getWorkspaceSession().activeWorktreeIdsOnShutdown = []
+    await store.flushPendingOrThrowAsync()
+    const gate = authority.pause()
+    let acknowledged = false
+    const pending = store.persistPtyBinding(binding).then((result) => {
+      acknowledged = true
+      return result
+    })
+    await gate.started.promise
+    expect(acknowledged).toBe(false)
+    expect(readState().workspaceSession.terminalLayoutsByTabId[binding.tabId]).toBeUndefined()
+    expect(readState().workspaceSession.activeWorktreeIdsOnShutdown).toEqual([])
+    gate.finish.resolve()
+    expect(await pending).toBe(true)
+    expect(
+      readState().workspaceSession.terminalLayoutsByTabId[binding.tabId].ptyIdsByLeafId
+    ).toEqual({
+      [binding.leafId]: binding.ptyId
+    })
+    expect(readState().workspaceSession.activeWorktreeIdsOnShutdown).toEqual([binding.worktreeId])
+  })
+
+  it('repairs activity on an otherwise matching durable reattach', async () => {
+    const { store, authority, readState } = await fixture()
+    await store.persistPtyBinding(binding)
+    store.getWorkspaceSession().activeWorktreeIdsOnShutdown = []
+    await store.flushPendingOrThrowAsync()
+    authority.captures.length = 0
+    await store.persistPtyBinding(binding)
+    expect(readState().workspaceSession.activeWorktreeIdsOnShutdown).toEqual([binding.worktreeId])
+    expect(authority.captures).toHaveLength(1)
+    await store.persistPtyBinding(binding)
+    expect(authority.captures).toHaveLength(1)
+  })
+
+  it('evaluates membership refusal after an older write finishes', async () => {
+    const { store, authority } = await fixture()
+    await store.persistPtyBinding(binding)
+    const gate = authority.pause()
+    store.updateSettings({ theme: 'dark' })
+    const older = store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
+    await gate.started.promise
+    const resolveBinding = vi.fn(() => ({ ...binding, mayCreate: false }))
+    const queued = store.persistPtyBinding(resolveBinding)
+    expect(resolveBinding).not.toHaveBeenCalled()
+    const session = store.getWorkspaceSession()
+    session.tabsByWorktree[binding.worktreeId] = []
+    delete session.terminalLayoutsByTabId[binding.tabId]
+    store.setWorkspaceSession(session)
+    gate.finish.resolve()
+    await older
+    expect(await queued).toBe(false)
+    expect(resolveBinding).toHaveBeenCalledTimes(1)
+  })
+
+  it('restores the binding after a known write failure', async () => {
+    const { store, authority } = await fixture()
+    vi.spyOn(console, 'error').mockImplementation(() => {})
+    store.getWorkspaceSession().activeWorktreeIdsOnShutdown = []
+    const before = structuredClone(store.getWorkspaceSession())
+    const gate = authority.pause()
+    const rejected = expect(store.persistPtyBinding(binding)).rejects.toThrow('disk refused')
+    await gate.started.promise
+    gate.finish.reject(
+      new ProfileStateWriterError('test-disk-failure', 'disk refused', 'known-failure')
+    )
+    await rejected
+    expect(store.getWorkspaceSession()).toEqual(before)
+  })
+
+  it('preserves newer getter edits when an older binding write fails', async () => {
+    const { store, authority } = await fixture()
+    vi.spyOn(console, 'error').mockImplementation(() => {})
+    const gate = authority.pause()
+    const rejected = expect(store.persistPtyBinding(binding)).rejects.toThrow('disk refused')
+    await gate.started.promise
+    store.getWorkspaceSession().terminalLayoutsByTabId[binding.tabId].ptyIdsByLeafId = {
+      [binding.leafId]: 'newer-pty'
+    }
+    gate.finish.reject(
+      new ProfileStateWriterError('test-disk-failure', 'disk refused', 'known-failure')
+    )
+    await rejected
+    expect(
+      store.getWorkspaceSession().terminalLayoutsByTabId[binding.tabId].ptyIdsByLeafId
+    ).toEqual({
+      [binding.leafId]: 'newer-pty'
+    })
+  })
+
+  it.each(['tab title', 'pane title'] as const)(
+    'rolls back a failed replacement while preserving a newer %s',
+    async (edit) => {
+      const { store, authority, readState } = await fixture()
+      vi.spyOn(console, 'error').mockImplementation(() => {})
+      await store.persistPtyBinding(binding)
+      const gate = authority.pause()
+      const rejected = expect(
+        store.persistPtyBinding({
+          ...binding,
+          ptyId: 'failed-replacement',
+          incarnationId: 'failed-incarnation',
+          expectedBinding: binding
+        })
+      ).rejects.toThrow('disk refused')
+      await gate.started.promise
+      const session = store.getWorkspaceSession()
+      const tab = session.tabsByWorktree[binding.worktreeId].find(
+        (candidate) => candidate.id === binding.tabId
+      )
+      if (!tab) {
+        throw new Error('binding did not create its terminal row')
+      }
+      if (edit === 'tab title') {
+        tab.customTitle = 'new title'
+      } else {
+        session.terminalLayoutsByTabId[binding.tabId].titlesByLeafId = {
+          [binding.leafId]: 'new title'
+        }
+      }
+      gate.finish.reject(
+        new ProfileStateWriterError('test-disk-failure', 'disk refused', 'known-failure')
+      )
+      await rejected
+      await store.flushPendingOrThrowAsync()
+      const persisted = readState().workspaceSession
+      expect(persisted.terminalLayoutsByTabId[binding.tabId].ptyIdsByLeafId).toEqual({
+        [binding.leafId]: binding.ptyId
+      })
+      expect(persisted.terminalPtyIncarnationsByPaneKey[`${binding.tabId}:${binding.leafId}`]).toBe(
+        binding.incarnationId
+      )
+      if (edit === 'tab title') {
+        expect(persisted.tabsByWorktree[binding.worktreeId]).toContainEqual(
+          expect.objectContaining({ id: binding.tabId, customTitle: 'new title' })
+        )
+      } else {
+        expect(persisted.terminalLayoutsByTabId[binding.tabId].titlesByLeafId).toEqual({
+          [binding.leafId]: 'new title'
+        })
+      }
+    }
+  )
+
+  it('rolls back a failed binding while retaining an unrelated newer navigation edit', async () => {
+    const { store, authority } = await fixture()
+    vi.spyOn(console, 'error').mockImplementation(() => {})
+    const gate = authority.pause()
+    const rejected = expect(store.persistPtyBinding(binding)).rejects.toThrow('disk refused')
+    await gate.started.promise
+    store.getWorkspaceSession().activeRepoId = 'newer-repo'
+    gate.finish.reject(
+      new ProfileStateWriterError('test-disk-failure', 'disk refused', 'known-failure')
+    )
+    await rejected
+    expect(store.getWorkspaceSession().activeRepoId).toBe('newer-repo')
+    expect(store.getWorkspaceSession().terminalLayoutsByTabId[binding.tabId]).toBeUndefined()
+  })
+
+  it('retains a newer root sibling when rolling back a failed leaf replacement', async () => {
+    const { store, authority, readState } = await fixture()
+    vi.spyOn(console, 'error').mockImplementation(() => {})
+    await store.persistPtyBinding(binding)
+    const gate = authority.pause()
+    const rejected = expect(
+      store.persistPtyBinding({ ...binding, ptyId: 'failed-replacement' })
+    ).rejects.toThrow('disk refused')
+    await gate.started.promise
+    const session = store.getWorkspaceSession()
+    const tab = session.tabsByWorktree[binding.worktreeId].find(
+      (candidate) => candidate.id === binding.tabId
+    )
+    if (!tab) {
+      throw new Error('binding did not create its terminal row')
+    }
+    const layout = session.terminalLayoutsByTabId[binding.tabId]
+    layout.root = {
+      type: 'split',
+      direction: 'horizontal',
+      first: { type: 'leaf', leafId: TEST_LEAF_2 },
+      second: { type: 'leaf', leafId: binding.leafId }
+    }
+    layout.ptyIdsByLeafId = { ...layout.ptyIdsByLeafId, [TEST_LEAF_2]: 'new-root-pty' }
+    tab.ptyId = 'new-root-pty'
+    gate.finish.reject(
+      new ProfileStateWriterError('test-disk-failure', 'disk refused', 'known-failure')
+    )
+    await rejected
+    await store.flushPendingOrThrowAsync()
+    const persisted = readState().workspaceSession
+    expect(persisted.terminalLayoutsByTabId[binding.tabId].root).toEqual(layout.root)
+    expect(persisted.terminalLayoutsByTabId[binding.tabId].ptyIdsByLeafId).toEqual({
+      [binding.leafId]: binding.ptyId,
+      [TEST_LEAF_2]: 'new-root-pty'
+    })
+    expect(persisted.tabsByWorktree[binding.worktreeId]).toContainEqual(
+      expect.objectContaining({ id: binding.tabId, ptyId: 'new-root-pty' })
+    )
+  })
+
+  it('removes a failed new binding while retaining a newer sibling tab', async () => {
+    const { store, authority } = await fixture()
+    vi.spyOn(console, 'error').mockImplementation(() => {})
+    const gate = authority.pause()
+    const rejected = expect(store.persistPtyBinding(binding)).rejects.toThrow('disk refused')
+    await gate.started.promise
+    const tabs = store.getWorkspaceSession().tabsByWorktree[binding.worktreeId]
+    const boundTab = tabs.find((tab) => tab.id === binding.tabId)
+    if (!boundTab) {
+      throw new Error('binding did not create its terminal row')
+    }
+    tabs.push({ ...boundTab, id: 'newer-sibling', ptyId: 'newer-sibling-pty' })
+    gate.finish.reject(
+      new ProfileStateWriterError('test-disk-failure', 'disk refused', 'known-failure')
+    )
+    await rejected
+    expect(
+      store.getWorkspaceSession().tabsByWorktree[binding.worktreeId].map((tab) => tab.id)
+    ).toContain('newer-sibling')
+    expect(
+      store.getWorkspaceSession().tabsByWorktree[binding.worktreeId].map((tab) => tab.id)
+    ).not.toContain(binding.tabId)
+    expect(store.getWorkspaceSession().terminalLayoutsByTabId[binding.tabId]).toBeUndefined()
+  })
+
+  it('retains a binding whose commit outcome is indeterminate', async () => {
+    const { store, authority } = await fixture()
+    vi.spyOn(console, 'error').mockImplementation(() => {})
+    const gate = authority.pause()
+    const rejected = expect(store.persistPtyBinding(binding)).rejects.toThrow('worker exited')
+    await gate.started.promise
+    gate.finish.reject(
+      new ProfileStateWriterError('test-worker-exit', 'worker exited', 'indeterminate')
+    )
+    await rejected
+    expect(
+      store.getWorkspaceSession().terminalLayoutsByTabId[binding.tabId].ptyIdsByLeafId
+    ).toEqual({
+      [binding.leafId]: binding.ptyId
+    })
+  })
+})
diff --git a/src/main/persistence/loading-store/pty-binding-created-surface-rollback.test.ts b/src/main/persistence/loading-store/pty-binding-created-surface-rollback.test.ts
new file mode 100644
index 000000000000..0feed681bf03
--- /dev/null
+++ b/src/main/persistence/loading-store/pty-binding-created-surface-rollback.test.ts
@@ -0,0 +1,135 @@
+import { expect, it, vi } from 'vitest'
+import { TEST_LEAF_1, TEST_LEAF_2 } from '../../persistence-session-fixtures'
+import { collectLayoutLeafIdsInOrder } from '../restoring-sessions/terminal-layout-normalization'
+import { ProfileStateWriterError } from '../profile-state/profile-state-writer-errors'
+import { fixture } from './profile-state-delayed-authority-fixture'
+
+vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
+vi.mock('../../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: () => ({ nth_repo_added: 2 })
+}))
+vi.mock('../../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: () => ({ hosts: [] }),
+  sshConfigHostsToTargets: () => []
+}))
+
+it.each(['tab title', 'pane title', 'new sibling'] as const)(
+  'retains a valid unbound new surface after a failed binding and newer %s',
+  async (edit) => {
+    const { store, authority, readState } = await fixture()
+    vi.spyOn(console, 'error').mockImplementation(() => {})
+    const binding = {
+      worktreeId: 'repo-local::/fixture/local',
+      tabId: 'new-binding-tab',
+      leafId: TEST_LEAF_1,
+      ptyId: 'failed-pty',
+      incarnationId: 'failed-incarnation'
+    }
+    const gate = authority.pause()
+    const rejected = expect(store.persistPtyBinding(binding)).rejects.toThrow('disk refused')
+    await gate.started.promise
+    const session = store.getWorkspaceSession()
+    const tab = session.tabsByWorktree[binding.worktreeId].find(
+      (candidate) => candidate.id === binding.tabId
+    )
+    if (!tab) {
+      throw new Error('binding did not create its terminal row')
+    }
+    const layout = session.terminalLayoutsByTabId[binding.tabId]
+    if (edit === 'tab title') {
+      tab.customTitle = 'new title'
+    } else if (edit === 'pane title') {
+      layout.titlesByLeafId = { [binding.leafId]: 'new title' }
+    } else {
+      layout.root = {
+        type: 'split',
+        direction: 'horizontal',
+        first: { type: 'leaf', leafId: binding.leafId },
+        second: { type: 'leaf', leafId: TEST_LEAF_2 }
+      }
+      layout.ptyIdsByLeafId = { ...layout.ptyIdsByLeafId, [TEST_LEAF_2]: 'sibling-pty' }
+      session.terminalPtyIncarnationsByPaneKey = {
+        ...session.terminalPtyIncarnationsByPaneKey,
+        [`${binding.tabId}:${TEST_LEAF_2}`]: 'sibling-incarnation'
+      }
+      tab.ptyId = 'sibling-pty'
+    }
+    gate.finish.reject(
+      new ProfileStateWriterError('test-disk-failure', 'disk refused', 'known-failure')
+    )
+    await rejected
+    await store.flushPendingOrThrowAsync()
+    const persisted = readState().workspaceSession
+    expect(JSON.stringify(persisted)).not.toContain('failed-pty')
+    expect(JSON.stringify(persisted)).not.toContain('failed-incarnation')
+    expect(persisted.tabsByWorktree[binding.worktreeId]).toContainEqual(
+      expect.objectContaining({
+        id: binding.tabId,
+        worktreeId: binding.worktreeId,
+        createdAt: expect.any(Number),
+        ptyId: edit === 'new sibling' ? 'sibling-pty' : null,
+        ...(edit === 'tab title' ? { customTitle: 'new title' } : {})
+      })
+    )
+    expect(persisted.terminalLayoutsByTabId[binding.tabId]).toMatchObject({
+      root: layout.root,
+      ...(edit === 'pane title' ? { titlesByLeafId: { [binding.leafId]: 'new title' } } : {})
+    })
+    if (edit === 'new sibling') {
+      expect(persisted.terminalLayoutsByTabId[binding.tabId].ptyIdsByLeafId).toEqual({
+        [TEST_LEAF_2]: 'sibling-pty'
+      })
+      expect(persisted.terminalPtyIncarnationsByPaneKey).toEqual({
+        [`${binding.tabId}:${TEST_LEAF_2}`]: 'sibling-incarnation'
+      })
+    }
+  }
+)
+
+it('preserves the valid newer tree after a failed split insertion', async () => {
+  const { store, authority, readState } = await fixture()
+  vi.spyOn(console, 'error').mockImplementation(() => {})
+  const binding = {
+    worktreeId: 'repo-local::/fixture/local',
+    tabId: 'split-binding-tab',
+    leafId: TEST_LEAF_1,
+    ptyId: 'original-pty',
+    incarnationId: 'original-incarnation'
+  }
+  await store.persistPtyBinding(binding)
+  const gate = authority.pause()
+  const rejected = expect(
+    store.persistPtyBinding({
+      ...binding,
+      leafId: TEST_LEAF_2,
+      ptyId: 'failed-pty',
+      incarnationId: 'failed-incarnation'
+    })
+  ).rejects.toThrow('disk refused')
+  await gate.started.promise
+  const layout = store.getWorkspaceSession().terminalLayoutsByTabId[binding.tabId]
+  if (!layout.root) {
+    throw new Error('binding did not create its layout')
+  }
+  const laterLeaf = '33333333-3333-4333-8333-333333333333'
+  layout.root = {
+    type: 'split',
+    direction: 'horizontal',
+    first: layout.root,
+    second: { type: 'leaf', leafId: laterLeaf }
+  }
+  layout.ptyIdsByLeafId = { ...layout.ptyIdsByLeafId, [laterLeaf]: 'later-sibling-pty' }
+  const expectedRoot = structuredClone(layout.root)
+  gate.finish.reject(
+    new ProfileStateWriterError('test-disk-failure', 'disk refused', 'known-failure')
+  )
+  await rejected
+  await store.flushPendingOrThrowAsync()
+  const persisted = readState().workspaceSession.terminalLayoutsByTabId[binding.tabId]
+  expect(persisted.root).toEqual(expectedRoot)
+  expect(collectLayoutLeafIdsInOrder(persisted.root)).toContain(laterLeaf)
+  expect(persisted.ptyIdsByLeafId).toEqual({
+    [TEST_LEAF_1]: 'original-pty',
+    [laterLeaf]: 'later-sibling-pty'
+  })
+})
diff --git a/src/main/persistence/loading-store/pty-binding-fast-lane.test.ts b/src/main/persistence/loading-store/pty-binding-fast-lane.test.ts
index 8ac6de70a0d7..3f8cc1c7e7da 100644
--- a/src/main/persistence/loading-store/pty-binding-fast-lane.test.ts
+++ b/src/main/persistence/loading-store/pty-binding-fast-lane.test.ts
@@ -71,6 +71,7 @@ describe('evaluatePtyBindingFastLane', () => {
       )
     ).toEqual(['layout_missing'])
     expect(miss({ incarnationId: 'a' })).toEqual(['incarnation'])
+    expect(miss({}, session({ activeWorktreeIdsOnShutdown: [] }))).toEqual(['inactive_worktree'])
     expect(miss({}, session({ terminalPtyIncarnationsByPaneKey: { [paneKey]: 'a' } }))).toEqual([
       'incarnation'
     ])
diff --git a/src/main/persistence/loading-store/pty-binding-fast-lane.ts b/src/main/persistence/loading-store/pty-binding-fast-lane.ts
index 9ae6304ed0f0..3f0763c883fb 100644
--- a/src/main/persistence/loading-store/pty-binding-fast-lane.ts
+++ b/src/main/persistence/loading-store/pty-binding-fast-lane.ts
@@ -18,6 +18,7 @@ export type PtyBindingFastLaneMiss =
   | 'leaf_pty'
   | 'incarnation'
   | 'tombstone'
+  | 'inactive_worktree'
   | 'not_durable'
 
 export type PtyBindingFastLaneRequest = {
@@ -80,6 +81,12 @@ export function evaluatePtyBindingFastLane(
   if (session.terminalSurfaceTombstonesByPaneKey?.[paneKey]) {
     misses.push('tombstone')
   }
+  if (
+    session.activeWorktreeIdsOnShutdown &&
+    !session.activeWorktreeIdsOnShutdown.includes(bindingWorktreeId)
+  ) {
+    misses.push('inactive_worktree')
+  }
   if (!durable) {
     misses.push('not_durable')
   }
diff --git a/src/main/persistence/loading-store/pty-binding-persistence.ts b/src/main/persistence/loading-store/pty-binding-persistence.ts
index c3cbff0796a8..f902ff7d2526 100644
--- a/src/main/persistence/loading-store/pty-binding-persistence.ts
+++ b/src/main/persistence/loading-store/pty-binding-persistence.ts
@@ -1,15 +1,9 @@
+import { isDeepStrictEqual } from 'node:util'
 import { LOCAL_EXECUTION_HOST_ID, parseExecutionHostId } from '../../../shared/execution-host'
 import { isTerminalLeafId } from '../../../shared/stable-pane-id'
 import type { WorkspaceSessionState } from '../../../shared/workspace-session-state-types'
-import { getRepoIdFromWorktreeId } from '../../../shared/worktree/id'
-import {
-  cloneLayoutNode,
-  layoutContainsLeafId
-} from '../restoring-sessions/terminal-layout-normalization'
-import {
-  cloneWorkspaceSessionState,
-  createMinimalPersistedTerminalTab
-} from '../restoring-sessions/session-owner-fields'
+import { rollbackFailedPtyBinding } from './pty-binding-write-rollback'
+import { cloneWorkspaceSessionState } from '../restoring-sessions/session-owner-fields'
 
 import type { PtyBindingSourceExpectation } from './store'
 
@@ -18,21 +12,22 @@ import type { SessionHostPartitionOperations } from './session-host-partitions'
 import { resolveHostId } from './session-host-partitions'
 import { evaluatePtyBindingFastLane } from './pty-binding-fast-lane'
 import { ptyBindingIsRefused } from './pty-binding-refusals'
-import { startPtyBindingSpan, type PtyBindingOrigin } from './pty-binding-span'
-import { tabRowPtyIdAfterLeafBinding } from './terminal-tab-pty-ownership'
+import { startPtyBindingSpan, type PtyBindingOrigin, type PtyBindingSpan } from './pty-binding-span'
+import { applyPtyBinding } from './pty-binding-session-update'
 
 type PtyBindingPersistenceOperationsRuntime = Pick<
   StoreRuntimeState,
-  | 'flushOrThrow'
+  | 'runDurableMutation'
   | 'lastDurableWriteGeneration'
   | 'pendingWrite'
   | 'quitFlushStarted'
+  | 'dirtyProfileStateDomains'
   | 'state'
   | 'writeGeneration'
   | 'writeTimer'
 >
 
-type PersistPtyBindingArgs = {
+export type PersistPtyBindingArgs = {
   worktreeId: string
   tabId: string
   leafId: string
@@ -72,43 +67,57 @@ export class PtyBindingPersistenceOperations {
     this[ptyBindingPersistenceOperationsContext] = { runtime, sessions }
   }
 
-  persistPtyBinding(args: PersistPtyBindingArgs, hostId?: string | null): boolean {
-    const runtime = this[ptyBindingPersistenceOperationsContext].runtime
+  async persistPtyBinding(
+    input: PersistPtyBindingArgs | (() => PersistPtyBindingArgs | null),
+    hostId?: string | null
+  ): Promise<boolean> {
+    const { runtime, sessions } = this[ptyBindingPersistenceOperationsContext]
     const resolvedHostId = resolveHostId(hostId)
-    const session =
-      this[ptyBindingPersistenceOperationsContext].sessions.getWorkspaceSession(resolvedHostId)
-    const paneKey = `${args.tabId}:${args.leafId}`
-    const bindingWorktreeId = args.expectedSourceBinding?.worktreeId ?? args.worktreeId
-    const span = startPtyBindingSpan({
-      hostKind: parseExecutionHostId(resolvedHostId)?.kind ?? 'local',
-      origin: args.origin ?? 'unknown',
-      savePending: runtime.writeTimer !== null || runtime.pendingWrite !== null,
-      generationGap: runtime.writeGeneration - runtime.lastDurableWriteGeneration
-    })
-    if (ptyBindingIsRefused(args, session, bindingWorktreeId, paneKey)) {
-      span.finish('refused')
-      return false
-    }
-    // A durable reattach needs neither a session clone nor whole-state serialization.
-    const verdict = evaluatePtyBindingFastLane(
-      args,
-      session,
-      bindingWorktreeId,
-      !runtime.quitFlushStarted && runtime.lastDurableWriteGeneration >= runtime.writeGeneration
-    )
-    span.setEligibility(verdict)
-    if (verdict.eligible) {
-      span.finish('fast_lane')
-      return true
-    }
+    const savePending = runtime.writeTimer !== null || runtime.pendingWrite !== null
+    let span: PtyBindingSpan | undefined
+    let outcome: 'refused' | 'fast_lane' | 'flushed' = 'flushed'
     try {
-      writePtyBinding(this, args, session, resolvedHostId, bindingWorktreeId, paneKey)
-    } catch (err) {
-      span.finish('threw', err)
-      throw err
+      const persisted = await runtime.runDurableMutation(() => {
+        const args = typeof input === 'function' ? input() : input
+        if (!args) {
+          return { value: false, persist: false }
+        }
+        // Measure the admitted binding operation; queue time precedes its current-state checks.
+        span = startPtyBindingSpan({
+          hostKind: parseExecutionHostId(resolvedHostId)?.kind ?? 'local',
+          origin: args.origin ?? 'unknown',
+          savePending,
+          generationGap: runtime.writeGeneration - runtime.lastDurableWriteGeneration
+        })
+        const paneKey = `${args.tabId}:${args.leafId}`
+        const bindingWorktreeId = args.expectedSourceBinding?.worktreeId ?? args.worktreeId
+        const session = sessions.getWorkspaceSession(resolvedHostId)
+        if (ptyBindingIsRefused(args, session, bindingWorktreeId, paneKey)) {
+          outcome = 'refused'
+          return { value: false, persist: false }
+        }
+        const verdict = evaluatePtyBindingFastLane(
+          args,
+          session,
+          bindingWorktreeId,
+          !runtime.quitFlushStarted && runtime.lastDurableWriteGeneration >= runtime.writeGeneration
+        )
+        span.setEligibility(verdict)
+        if (verdict.eligible) {
+          outcome = 'fast_lane'
+          return { value: true, persist: false }
+        }
+        return {
+          value: true,
+          rollback: writePtyBinding(this, args, session, resolvedHostId, bindingWorktreeId, paneKey)
+        }
+      })
+      span?.finish(outcome)
+      return persisted
+    } catch (error) {
+      span?.finish('threw', error)
+      throw error
     }
-    span.finish('flushed')
-    return true
   }
 }
 
@@ -119,155 +128,65 @@ function writePtyBinding(
   resolvedHostId: ReturnType<typeof resolveHostId>,
   bindingWorktreeId: string,
   paneKey: string
-): void {
-  const runtime = owner[ptyBindingPersistenceOperationsContext].runtime
+): () => void {
+  const { runtime, sessions } = owner[ptyBindingPersistenceOperationsContext]
   const sessionBeforeBinding = cloneWorkspaceSessionState(session)
-  try {
-    if (resolvedHostId !== LOCAL_EXECUTION_HOST_ID) {
-      runtime.state.workspaceSessionsByHostId = {
-        ...runtime.state.workspaceSessionsByHostId,
-        [resolvedHostId]: session
-      }
-    }
-    applyPtyBinding(args, session, bindingWorktreeId, paneKey)
-    runtime.flushOrThrow()
-  } catch (err) {
+  const restore = (restoredSession = sessionBeforeBinding): void => {
     if (resolvedHostId === LOCAL_EXECUTION_HOST_ID) {
-      runtime.state.workspaceSession = sessionBeforeBinding
+      runtime.state.workspaceSession = restoredSession
     } else {
       runtime.state.workspaceSessionsByHostId = {
         ...runtime.state.workspaceSessionsByHostId,
-        [resolvedHostId]: sessionBeforeBinding
+        [resolvedHostId]: restoredSession
       }
     }
-    throw err
   }
-}
-
-function applyPtyBinding(
-  args: PersistPtyBindingArgs,
-  session: WorkspaceSessionState,
-  bindingWorktreeId: string,
-  paneKey: string
-): void {
-  const reconciledIncarnation =
-    args.expectedBinding !== undefined && args.incarnationId !== args.expectedBinding.incarnationId
-  let terminalMembershipChanged = false
-  let hostAdmittedTabCreated = false
-  const advanceTopologyFence = (): void => {
-    const repoId = getRepoIdFromWorktreeId(bindingWorktreeId)
-    const currentRevision = session.terminalTopologyRevisionByRepoId?.[repoId] ?? 0
-    // Why: a split, or a host-admitted tab the renderer has never seen, is itself
-    // the authority — with no fence the renderer's pre-create tab list replays
-    // over it and the tab is lost even on the repo's first such change.
-    const establishesMembershipAuthority =
-      args.expectedSourceBinding !== undefined || hostAdmittedTabCreated
-    if (
-      !reconciledIncarnation &&
-      (!terminalMembershipChanged || (currentRevision <= 0 && !establishesMembershipAuthority))
-    ) {
-      return
-    }
-    // Why: host-admitted membership or incarnation changes must outrank a stale renderer replay.
-    session.terminalTopologyRevisionByRepoId = {
-      ...session.terminalTopologyRevisionByRepoId,
-      [repoId]: currentRevision + 1
-    }
-  }
-  if (args.incarnationId) {
-    session.terminalPtyIncarnationsByPaneKey = {
-      ...session.terminalPtyIncarnationsByPaneKey,
-      [paneKey]: args.incarnationId
-    }
-    if (session.terminalSurfaceTombstonesByPaneKey?.[paneKey]) {
-      session.terminalSurfaceTombstonesByPaneKey = {
-        ...session.terminalSurfaceTombstonesByPaneKey
+  try {
+    if (resolvedHostId !== LOCAL_EXECUTION_HOST_ID) {
+      runtime.state.workspaceSessionsByHostId = {
+        ...runtime.state.workspaceSessionsByHostId,
+        [resolvedHostId]: session
       }
-      delete session.terminalSurfaceTombstonesByPaneKey[paneKey]
     }
-  }
-  const tabs = session.tabsByWorktree?.[bindingWorktreeId]
-  const tab = tabs?.find((t) => t.id === args.tabId)
-  if (tab) {
-    tab.ptyId = tabRowPtyIdAfterLeafBinding(
-      tab,
-      session.terminalLayoutsByTabId?.[args.tabId]?.ptyIdsByLeafId,
-      args.leafId,
-      args.ptyId
+    applyPtyBinding(args, session, bindingWorktreeId, paneKey)
+    runtime.dirtyProfileStateDomains?.add(
+      resolvedHostId === LOCAL_EXECUTION_HOST_ID ? 'workspaceSession' : 'workspaceSessionsByHostId'
     )
-  } else {
-    terminalMembershipChanged = true
-    hostAdmittedTabCreated = args.hostAdmittedMembership === true
-    // Why: pty:spawn can beat the debounced writer; persist a minimal tab so hydration won't prune the binding as orphaned.
-    const nextTabs = [
-      ...(tabs ?? []),
-      createMinimalPersistedTerminalTab({
-        ...args,
-        worktreeId: bindingWorktreeId,
-        existingTabCount: tabs?.length ?? 0
-      })
-    ]
-    session.tabsByWorktree = {
-      ...session.tabsByWorktree,
-      [bindingWorktreeId]: nextTabs
-    }
-    session.activeWorktreeId ??= bindingWorktreeId
-    session.activeTabId ??= args.tabId
-    session.activeTabIdByWorktree = {
-      ...session.activeTabIdByWorktree,
-      [bindingWorktreeId]: session.activeTabIdByWorktree?.[bindingWorktreeId] ?? args.tabId
-    }
-  }
-  // Why: host-initiated persist snapshots used to omit this write-once guard, so every launch or reattach treated the worktree as never having default terminals applied.
-  session.defaultTerminalTabsAppliedByWorktreeId = {
-    ...session.defaultTerminalTabsAppliedByWorktreeId,
-    [bindingWorktreeId]: true
-  }
-  if (!isTerminalLeafId(args.leafId)) {
-    // Why: keep legacy renderer-local pane ids out of durable leaf-keyed layout state after the UUID migration.
-    advanceTopologyFence()
-    return
-  }
-  const layout = session.terminalLayoutsByTabId?.[args.tabId]
-  if (layout) {
-    if (!layout.root) {
-      terminalMembershipChanged = true
-      // Why: createTab can persist an empty layout before TerminalPane mounts; the sync binding still needs a durable root.
-      layout.root = { type: 'leaf', leafId: args.leafId }
-      layout.activeLeafId = args.leafId
-      layout.expandedLeafId = null
-    } else if (!layoutContainsLeafId(layout.root, args.leafId)) {
-      terminalMembershipChanged = true
-      // Why: splitPane spawns before its snapshot reaches main; add a minimal leaf so a crash can't strand the pane's binding.
-      layout.root = {
-        type: 'split',
-        direction: 'vertical',
-        first: cloneLayoutNode(layout.root),
-        second: { type: 'leaf', leafId: args.leafId }
+    const boundSession = cloneWorkspaceSessionState(session)
+    return () => {
+      const current = sessions.getWorkspaceSession(resolvedHostId)
+      const ownerState = (value: WorkspaceSessionState) => {
+        const tab = value.tabsByWorktree[bindingWorktreeId]?.find((tab) => tab.id === args.tabId)
+        return {
+          createdAt: tab?.createdAt,
+          generation: tab?.generation,
+          worktreeId: tab?.worktreeId,
+          ptyId: isTerminalLeafId(args.leafId)
+            ? value.terminalLayoutsByTabId[args.tabId]?.ptyIdsByLeafId?.[args.leafId]
+            : tab?.ptyId,
+          incarnation: value.terminalPtyIncarnationsByPaneKey?.[paneKey]
+        }
       }
-      layout.activeLeafId = args.leafId
-      if (layout.expandedLeafId && !layoutContainsLeafId(layout.root, layout.expandedLeafId)) {
-        layout.expandedLeafId = null
+      // Presentation edits do not replace the binding that must be rolled back.
+      if (!isDeepStrictEqual(ownerState(current), ownerState(boundSession))) {
+        return
       }
-    }
-    layout.ptyIdsByLeafId = {
-      ...layout.ptyIdsByLeafId,
-      [args.leafId]: args.ptyId
-    }
-  } else {
-    terminalMembershipChanged = true
-    // Why: first tab spawn — persist a minimal layout so a SIGKILL before the renderer snapshot can't lose ptyIdsByLeafId.
-    session.terminalLayoutsByTabId = {
-      ...session.terminalLayoutsByTabId,
-      [args.tabId]: {
-        root: { type: 'leaf', leafId: args.leafId },
-        activeLeafId: args.leafId,
-        expandedLeafId: null,
-        ptyIdsByLeafId: { [args.leafId]: args.ptyId }
+      const rolledBack = rollbackFailedPtyBinding(
+        sessionBeforeBinding,
+        boundSession,
+        current,
+        bindingWorktreeId,
+        args.tabId,
+        args.leafId
+      )
+      if (rolledBack !== current) {
+        restore(rolledBack)
       }
     }
+  } catch (error) {
+    restore()
+    throw error
   }
-  advanceTopologyFence()
 }
 
 export function installPtyBindingPersistenceOperationsContext(
diff --git a/src/main/persistence/loading-store/pty-binding-session-update.ts b/src/main/persistence/loading-store/pty-binding-session-update.ts
new file mode 100644
index 000000000000..3024543505a6
--- /dev/null
+++ b/src/main/persistence/loading-store/pty-binding-session-update.ts
@@ -0,0 +1,146 @@
+import { isTerminalLeafId } from '../../../shared/stable-pane-id'
+import type { WorkspaceSessionState } from '../../../shared/workspace-session-state-types'
+import { getRepoIdFromWorktreeId } from '../../../shared/worktree/id'
+import {
+  cloneLayoutNode,
+  layoutContainsLeafId
+} from '../restoring-sessions/terminal-layout-normalization'
+import { createMinimalPersistedTerminalTab } from '../restoring-sessions/session-owner-fields'
+import { tabRowPtyIdAfterLeafBinding } from './terminal-tab-pty-ownership'
+import type { PersistPtyBindingArgs } from './pty-binding-persistence'
+
+export function applyPtyBinding(
+  args: PersistPtyBindingArgs,
+  session: WorkspaceSessionState,
+  bindingWorktreeId: string,
+  paneKey: string
+): void {
+  const reconciledIncarnation =
+    args.expectedBinding !== undefined && args.incarnationId !== args.expectedBinding.incarnationId
+  let terminalMembershipChanged = false
+  let hostAdmittedTabCreated = false
+  const advanceTopologyFence = (): void => {
+    const repoId = getRepoIdFromWorktreeId(bindingWorktreeId)
+    const currentRevision = session.terminalTopologyRevisionByRepoId?.[repoId] ?? 0
+    // Why: a split, or a host-admitted tab the renderer has never seen, is itself
+    // the authority — with no fence the renderer's pre-create tab list replays
+    // over it and the tab is lost even on the repo's first such change.
+    const establishesMembershipAuthority =
+      args.expectedSourceBinding !== undefined || hostAdmittedTabCreated
+    if (
+      !reconciledIncarnation &&
+      (!terminalMembershipChanged || (currentRevision <= 0 && !establishesMembershipAuthority))
+    ) {
+      return
+    }
+    // Why: host-admitted membership or incarnation changes must outrank a stale renderer replay.
+    session.terminalTopologyRevisionByRepoId = {
+      ...session.terminalTopologyRevisionByRepoId,
+      [repoId]: currentRevision + 1
+    }
+  }
+  if (args.incarnationId) {
+    session.terminalPtyIncarnationsByPaneKey = {
+      ...session.terminalPtyIncarnationsByPaneKey,
+      [paneKey]: args.incarnationId
+    }
+    if (session.terminalSurfaceTombstonesByPaneKey?.[paneKey]) {
+      session.terminalSurfaceTombstonesByPaneKey = {
+        ...session.terminalSurfaceTombstonesByPaneKey
+      }
+      delete session.terminalSurfaceTombstonesByPaneKey[paneKey]
+    }
+  }
+  const tabs = session.tabsByWorktree?.[bindingWorktreeId]
+  const tab = tabs?.find((t) => t.id === args.tabId)
+  if (tab) {
+    tab.ptyId = tabRowPtyIdAfterLeafBinding(
+      tab,
+      session.terminalLayoutsByTabId?.[args.tabId]?.ptyIdsByLeafId,
+      args.leafId,
+      args.ptyId
+    )
+  } else {
+    terminalMembershipChanged = true
+    hostAdmittedTabCreated = args.hostAdmittedMembership === true
+    // Why: pty:spawn can beat the debounced writer; persist a minimal tab so hydration won't prune the binding as orphaned.
+    const nextTabs = [
+      ...(tabs ?? []),
+      createMinimalPersistedTerminalTab({
+        ...args,
+        worktreeId: bindingWorktreeId,
+        existingTabCount: tabs?.length ?? 0
+      })
+    ]
+    session.tabsByWorktree = {
+      ...session.tabsByWorktree,
+      [bindingWorktreeId]: nextTabs
+    }
+    session.activeWorktreeId ??= bindingWorktreeId
+    session.activeTabId ??= args.tabId
+    session.activeTabIdByWorktree = {
+      ...session.activeTabIdByWorktree,
+      [bindingWorktreeId]: session.activeTabIdByWorktree?.[bindingWorktreeId] ?? args.tabId
+    }
+  }
+  // Why: host-initiated persist snapshots used to omit this write-once guard, so every launch or reattach treated the worktree as never having default terminals applied.
+  session.defaultTerminalTabsAppliedByWorktreeId = {
+    ...session.defaultTerminalTabsAppliedByWorktreeId,
+    [bindingWorktreeId]: true
+  }
+  // Acknowledged spawns must survive a crash before the renderer records their activity.
+  if (
+    session.activeWorktreeIdsOnShutdown &&
+    !session.activeWorktreeIdsOnShutdown.includes(bindingWorktreeId)
+  ) {
+    session.activeWorktreeIdsOnShutdown = [
+      ...session.activeWorktreeIdsOnShutdown,
+      bindingWorktreeId
+    ]
+  }
+  if (!isTerminalLeafId(args.leafId)) {
+    // Why: keep legacy renderer-local pane ids out of durable leaf-keyed layout state after the UUID migration.
+    advanceTopologyFence()
+    return
+  }
+  const layout = session.terminalLayoutsByTabId?.[args.tabId]
+  if (layout) {
+    if (!layout.root) {
+      terminalMembershipChanged = true
+      // Why: createTab can persist an empty layout before TerminalPane mounts; the sync binding still needs a durable root.
+      layout.root = { type: 'leaf', leafId: args.leafId }
+      layout.activeLeafId = args.leafId
+      layout.expandedLeafId = null
+    } else if (!layoutContainsLeafId(layout.root, args.leafId)) {
+      terminalMembershipChanged = true
+      // Why: splitPane spawns before its snapshot reaches main; add a minimal leaf so a crash can't strand the pane's binding.
+      layout.root = {
+        type: 'split',
+        direction: 'vertical',
+        first: cloneLayoutNode(layout.root),
+        second: { type: 'leaf', leafId: args.leafId }
+      }
+      layout.activeLeafId = args.leafId
+      if (layout.expandedLeafId && !layoutContainsLeafId(layout.root, layout.expandedLeafId)) {
+        layout.expandedLeafId = null
+      }
+    }
+    layout.ptyIdsByLeafId = {
+      ...layout.ptyIdsByLeafId,
+      [args.leafId]: args.ptyId
+    }
+  } else {
+    terminalMembershipChanged = true
+    // Why: first tab spawn — persist a minimal layout so a SIGKILL before the renderer snapshot can't lose ptyIdsByLeafId.
+    session.terminalLayoutsByTabId = {
+      ...session.terminalLayoutsByTabId,
+      [args.tabId]: {
+        root: { type: 'leaf', leafId: args.leafId },
+        activeLeafId: args.leafId,
+        expandedLeafId: null,
+        ptyIdsByLeafId: { [args.leafId]: args.ptyId }
+      }
+    }
+  }
+  advanceTopologyFence()
+}
diff --git a/src/main/persistence/loading-store/pty-binding-span.ts b/src/main/persistence/loading-store/pty-binding-span.ts
index 58bed424a516..903d93c4967f 100644
--- a/src/main/persistence/loading-store/pty-binding-span.ts
+++ b/src/main/persistence/loading-store/pty-binding-span.ts
@@ -10,11 +10,13 @@ export type PtyBindingSpanOutcome = 'fast_lane' | 'flushed' | 'refused' | 'threw
  */
 export type PtyBindingOrigin = 'reattach' | 'spawn' | 'relay_reattach' | 'split' | 'unknown'
 
+export type PtySpawnCommitOrigin = Extract<PtyBindingOrigin, 'reattach' | 'spawn' | 'split'>
+
 /** The spawn-commit paths share one rule: a split outranks a reattach, a reattach outranks a spawn. */
 export function spawnCommitBindingOrigin(
   commit: { isReattach?: boolean; agentSessionEnsure?: { disposition: string } },
   expectedSourceBinding?: unknown
-): PtyBindingOrigin {
+): PtySpawnCommitOrigin {
   if (expectedSourceBinding !== undefined) {
     return 'split'
   }
diff --git a/src/main/persistence/loading-store/pty-binding-write-rollback.ts b/src/main/persistence/loading-store/pty-binding-write-rollback.ts
new file mode 100644
index 000000000000..af7cb63d7b0d
--- /dev/null
+++ b/src/main/persistence/loading-store/pty-binding-write-rollback.ts
@@ -0,0 +1,94 @@
+import { isDeepStrictEqual } from 'node:util'
+import type { WorkspaceSessionState } from '../../../shared/workspace-session-state-types'
+import { rollbackWorkspaceSessionAfterFailedAsyncWrite } from '../restoring-sessions/workspace-session-write-rollback'
+
+function restoreBindingSlot(
+  original: Record<string, string> | undefined,
+  staged: Record<string, string> | undefined,
+  current: Record<string, string> | undefined,
+  key: string
+): Record<string, string> | undefined {
+  if (current?.[key] !== staged?.[key] || original?.[key] === staged?.[key]) {
+    return current
+  }
+  const restored = { ...current }
+  const previous = original?.[key]
+  if (previous === undefined) {
+    delete restored[key]
+  } else {
+    restored[key] = previous
+  }
+  return original === undefined && Object.keys(restored).length === 0 ? undefined : restored
+}
+
+export function rollbackFailedPtyBinding(
+  original: WorkspaceSessionState,
+  staged: WorkspaceSessionState,
+  current: WorkspaceSessionState,
+  worktreeId: string,
+  tabId: string,
+  leafId: string
+): WorkspaceSessionState {
+  const tab = (session: WorkspaceSessionState) =>
+    session.tabsByWorktree[worktreeId]?.find((candidate) => candidate.id === tabId)
+  const stagedTab = tab(staged)
+  const originalLayout = original.terminalLayoutsByTabId[tabId]
+  const stagedLayout = staged.terminalLayoutsByTabId[tabId]
+  let baseline = original
+  if (
+    stagedTab &&
+    (!isDeepStrictEqual(tab(current), stagedTab) ||
+      !isDeepStrictEqual(current.terminalLayoutsByTabId[tabId], stagedLayout))
+  ) {
+    // Keep edited new surfaces structurally valid, without the failed process binding.
+    baseline = {
+      ...original,
+      tabsByWorktree: tab(original)
+        ? original.tabsByWorktree
+        : {
+            ...original.tabsByWorktree,
+            [worktreeId]: [
+              ...(original.tabsByWorktree[worktreeId] ?? []),
+              { ...stagedTab, ptyId: null }
+            ]
+          },
+      terminalLayoutsByTabId:
+        originalLayout || !stagedLayout
+          ? original.terminalLayoutsByTabId
+          : {
+              ...original.terminalLayoutsByTabId,
+              [tabId]: { ...stagedLayout, ptyIdsByLeafId: {} }
+            }
+    }
+  }
+  const restored = rollbackWorkspaceSessionAfterFailedAsyncWrite(baseline, staged, current)
+  const layout = restored.terminalLayoutsByTabId[tabId]
+  const currentRoot = current.terminalLayoutsByTabId[tabId]?.root
+  return {
+    ...restored,
+    ...(layout
+      ? {
+          terminalLayoutsByTabId: {
+            ...restored.terminalLayoutsByTabId,
+            [tabId]: {
+              ...layout,
+              // A tree is one value; fieldwise rollback can mix leaf and split node shapes.
+              root: isDeepStrictEqual(currentRoot, stagedLayout?.root) ? layout.root : currentRoot,
+              ptyIdsByLeafId: restoreBindingSlot(
+                originalLayout?.ptyIdsByLeafId,
+                stagedLayout?.ptyIdsByLeafId,
+                layout.ptyIdsByLeafId,
+                leafId
+              )
+            }
+          }
+        }
+      : {}),
+    terminalPtyIncarnationsByPaneKey: restoreBindingSlot(
+      original.terminalPtyIncarnationsByPaneKey,
+      staged.terminalPtyIncarnationsByPaneKey,
+      restored.terminalPtyIncarnationsByPaneKey,
+      `${tabId}:${leafId}`
+    )
+  }
+}
diff --git a/src/main/persistence/loading-store/pty-reattach-failure-routing.test.ts b/src/main/persistence/loading-store/pty-reattach-failure-routing.test.ts
new file mode 100644
index 000000000000..16f2978e04b5
--- /dev/null
+++ b/src/main/persistence/loading-store/pty-reattach-failure-routing.test.ts
@@ -0,0 +1,122 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { fixture } from './profile-state-delayed-authority-fixture'
+import { OrcaRuntimeService } from '../../runtime/orca-runtime'
+import { commitPtyIpcSpawn } from '../../ipc/pty/ipc/spawn-commit'
+import { createPtyIpcSpawnState } from '../../ipc/pty/ipc/spawn-state'
+import { commitRuntimePtySpawn } from '../../ipc/pty/runtime/spawn-commit'
+import { createRuntimePtySpawnState } from '../../ipc/pty/runtime/spawn-state'
+import { createPtySpawnCommitDependencies } from './pty-spawn-commit-dependencies-fixture'
+import { clearProviderPtyState } from '../../ipc/pty/provider/state-cleanup'
+import { ptyIncarnationById, ptyOwnership } from '../../ipc/pty/provider/ownership-state'
+import { toSshExecutionHostId } from '../../../shared/execution-host'
+
+vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
+vi.mock('../../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: () => ({ nth_repo_added: 2 })
+}))
+vi.mock('../../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: () => ({ hosts: [] }),
+  sshConfigHostsToTargets: () => []
+}))
+
+const connectionId = 'reattach-host'
+const binding = {
+  worktreeId: 'repo-local::/fixture/local',
+  tabId: 'aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa',
+  leafId: 'bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb',
+  ptyId: 'ssh:reattach-host@@surviving-pty'
+}
+const incarnation = 'cccccccc-cccc-4ccc-8ccc-cccccccccccc'
+const successorIncarnation = 'dddddddd-dddd-4ddd-8ddd-dddddddddddd'
+
+afterEach(() => {
+  clearProviderPtyState(binding.ptyId)
+  ptyOwnership.delete(binding.ptyId)
+})
+
+describe.each(['ipc', 'runtime'])('%s failed reattach routing', (controller) => {
+  it.each(
+    [undefined, incarnation].flatMap((incarnationId) =>
+      ['live', 'exited', 'replaced'].map((outcome) => ({ incarnationId, outcome }))
+    )
+  )(
+    'preserves host evidence after a failed save: $outcome, $incarnationId',
+    async ({ incarnationId, outcome }) => {
+      const { store, authority, readState } = await fixture()
+      const runtime = new OrcaRuntimeService(store)
+      runtime.onPtySpawned(binding.ptyId, incarnationId)
+      const deps = createPtySpawnCommitDependencies(runtime, store)
+      const publish = vi.spyOn(deps, 'sendPtySpawnedToRenderer')
+      const result = { id: binding.ptyId, incarnationId, isReattach: true }
+      let commit: () => Promise<unknown>
+      let shutdown: ReturnType<typeof vi.spyOn>
+      if (controller === 'ipc') {
+        const ctx = createPtyIpcSpawnState(deps, {
+          ...binding,
+          connectionId,
+          cols: 80,
+          rows: 24
+        })
+        ctx.result = result
+        ctx.metadataLeafId = binding.leafId
+        ctx.validatedLeafId = binding.leafId
+        shutdown = vi.spyOn(ctx.provider, 'shutdown')
+        commit = () => commitPtyIpcSpawn(ctx)
+      } else {
+        const ctx = createRuntimePtySpawnState(deps, {
+          ...binding,
+          connectionId,
+          cols: 80,
+          rows: 24
+        })
+        ctx.result = result
+        ctx.metadataLeafId = binding.leafId
+        ctx.hostSessionBinding = { store, ...binding }
+        shutdown = vi.spyOn(ctx.provider, 'shutdown')
+        commit = () => commitRuntimePtySpawn(ctx)
+      }
+      const gate = authority.pause()
+      const pending = expect(commit()).rejects.toThrow('ORCA_TERMINAL_SESSION_STATE_SAVE_FAILED')
+      await gate.started.promise
+      const ownerWhileSaving = ptyOwnership.get(binding.ptyId)
+      if (outcome !== 'live') {
+        clearProviderPtyState(binding.ptyId)
+        ptyOwnership.delete(binding.ptyId)
+        await runtime.onPtyExit(binding.ptyId, 0, incarnationId, { providerExitObserved: true })
+        if (outcome === 'replaced') {
+          runtime.onPtySpawned(binding.ptyId, successorIncarnation)
+          ptyOwnership.set(binding.ptyId, 'successor-host')
+          ptyIncarnationById.set(binding.ptyId, successorIncarnation)
+        }
+      }
+      gate.finish.reject(new Error('disk full'))
+      await pending
+      expect(ownerWhileSaving).toBe(connectionId)
+      expect(ptyOwnership.get(binding.ptyId)).toBe(
+        outcome === 'live' ? connectionId : outcome === 'replaced' ? 'successor-host' : undefined
+      )
+      expect(ptyIncarnationById.get(binding.ptyId)).toBe(
+        outcome === 'live'
+          ? incarnationId
+          : outcome === 'replaced'
+            ? successorIncarnation
+            : undefined
+      )
+      expect(shutdown).not.toHaveBeenCalled()
+      expect(publish).not.toHaveBeenCalled()
+      expect(store.getSshRemotePtyLeases(connectionId)).toEqual([])
+      const session = readState().workspaceSessionsByHostId[toSshExecutionHostId(connectionId)]
+      expect(
+        session?.terminalLayoutsByTabId[binding.tabId]?.ptyIdsByLeafId?.[binding.leafId]
+      ).toBeUndefined()
+      if (outcome !== 'exited') {
+        await runtime.onPtyExit(
+          binding.ptyId,
+          0,
+          outcome === 'replaced' ? successorIncarnation : incarnationId,
+          { providerExitObserved: true }
+        )
+      }
+    }
+  )
+})
diff --git a/src/main/persistence/loading-store/pty-retirement-async-durability.test.ts b/src/main/persistence/loading-store/pty-retirement-async-durability.test.ts
new file mode 100644
index 000000000000..6751cc3a0109
--- /dev/null
+++ b/src/main/persistence/loading-store/pty-retirement-async-durability.test.ts
@@ -0,0 +1,119 @@
+import { describe, expect, it, vi } from 'vitest'
+import { toSshExecutionHostId } from '../../../shared/execution-host'
+import { retirePersistedStablePaneOwner } from '../../ipc/pty/pane/stable-owner'
+import { TEST_LEAF_1 } from '../../persistence-session-fixtures'
+import { retireTerminalSurfaceFromPersistence } from '../../runtime/mobile-session-terminal-persistence-retirement'
+import { ProfileStateWriterError } from '../profile-state/profile-state-writer-errors'
+import { fixture } from './profile-state-delayed-authority-fixture'
+
+vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
+vi.mock('../../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: () => ({ nth_repo_added: 2 })
+}))
+vi.mock('../../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: () => ({ hosts: [] }),
+  sshConfigHostsToTargets: () => []
+}))
+
+const binding = {
+  worktreeId: 'repo-local::/fixture/local',
+  tabId: 'retirement-tab',
+  leafId: TEST_LEAF_1,
+  ptyId: 'retirement-pty',
+  incarnationId: 'retirement-incarnation'
+}
+
+async function retirementFixture(connectionId: string | undefined) {
+  const result = await fixture()
+  const hostId = connectionId ? toSshExecutionHostId(connectionId) : undefined
+  await result.store.persistPtyBinding(binding, hostId)
+  return {
+    ...result,
+    retire: () =>
+      retirePersistedStablePaneOwner(
+        result.store,
+        { ...binding, persistedIncarnationId: binding.incarnationId },
+        binding.worktreeId,
+        connectionId
+      ),
+    removeInMemory: () => {
+      result.store.setWorkspaceSession(
+        retireTerminalSurfaceFromPersistence(result.store.getWorkspaceSession(hostId), {
+          ...binding,
+          parentTabId: binding.tabId
+        }),
+        hostId
+      )
+    },
+    persistedLayout: () => {
+      const state = result.readState()
+      const session = hostId ? state.workspaceSessionsByHostId[hostId] : state.workspaceSession
+      return session.terminalLayoutsByTabId[binding.tabId]
+    }
+  }
+}
+
+describe.each([undefined, 'retirement-ssh'])(
+  'durable PTY retirement on host %s',
+  (connectionId) => {
+    it('waits for an already removed in-memory pane to reach SQLite', async () => {
+      const { authority, retire, removeInMemory, persistedLayout } =
+        await retirementFixture(connectionId)
+      removeInMemory()
+      expect(persistedLayout()?.ptyIdsByLeafId).toEqual({ [binding.leafId]: binding.ptyId })
+      const gate = authority.pause()
+      let acknowledged = false
+      const pending = retire().then((accepted) => {
+        acknowledged = true
+        return accepted
+      })
+      try {
+        await Promise.race([gate.started.promise, pending])
+        expect(acknowledged).toBe(false)
+        expect(persistedLayout()?.ptyIdsByLeafId).toEqual({ [binding.leafId]: binding.ptyId })
+      } finally {
+        gate.finish.resolve()
+      }
+      await expect(pending).resolves.toBe(true)
+      expect(persistedLayout()).toBeUndefined()
+    })
+
+    it('rejects when a pending removal cannot reach SQLite and retains it for retry', async () => {
+      const { authority, retire, removeInMemory, persistedLayout } =
+        await retirementFixture(connectionId)
+      vi.spyOn(console, 'error').mockImplementation(() => {})
+      removeInMemory()
+      const gate = authority.pause()
+      const rejected = expect(retire()).rejects.toThrow('retirement disk refused')
+      try {
+        await Promise.race([gate.started.promise, rejected])
+        gate.finish.reject(
+          new ProfileStateWriterError(
+            'test-disk-failure',
+            'retirement disk refused',
+            'known-failure'
+          )
+        )
+        await rejected
+      } finally {
+        gate.finish.resolve()
+      }
+      expect(persistedLayout()?.ptyIdsByLeafId).toEqual({ [binding.leafId]: binding.ptyId })
+      await expect(retire()).resolves.toBe(true)
+      expect(persistedLayout()).toBeUndefined()
+    })
+
+    it('skips disk work when the pane removal is already durable', async () => {
+      const { authority, retire, persistedLayout } = await retirementFixture(connectionId)
+      await expect(retire()).resolves.toBe(true)
+      expect(persistedLayout()).toBeUndefined()
+      authority.captures.length = 0
+      const revisionCheck = vi.spyOn(authority, 'assertCurrentRevision')
+      const fullStateWrite = vi.spyOn(authority, 'writeSerializedState')
+      await expect(retire()).resolves.toBe(true)
+      expect(authority.captures).toEqual([])
+      expect(revisionCheck).not.toHaveBeenCalled()
+      expect(fullStateWrite).not.toHaveBeenCalled()
+    })
+  }
+)
diff --git a/src/main/persistence/loading-store/pty-retirement-publication-during-read.test.ts b/src/main/persistence/loading-store/pty-retirement-publication-during-read.test.ts
new file mode 100644
index 000000000000..dd6754c1d73d
--- /dev/null
+++ b/src/main/persistence/loading-store/pty-retirement-publication-during-read.test.ts
@@ -0,0 +1,146 @@
+import { expect, it, vi } from 'vitest'
+import { fixture } from './profile-state-delayed-authority-fixture'
+import { OrcaRuntimeService } from '../../runtime/orca-runtime'
+import type { RuntimeMobileSessionTabsSnapshot } from '../../../shared/runtime-types'
+
+vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
+vi.mock('../../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: () => ({ nth_repo_added: 2 })
+}))
+vi.mock('../../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: () => ({ hosts: [] }),
+  sshConfigHostsToTargets: () => []
+}))
+
+const binding = {
+  worktreeId: 'repo-local::/fixture/local',
+  tabId: 'aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa',
+  leafId: 'bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb',
+  ptyId: 'retiring-pty',
+  incarnationId: 'cccccccc-cccc-4ccc-8ccc-cccccccccccc'
+}
+class RetirementRuntime extends OrcaRuntimeService {
+  readVisibleState() {
+    return this.readVisibleTerminalState(binding.ptyId)
+  }
+  snapshot(): RuntimeMobileSessionTabsSnapshot | undefined {
+    return this.mobileSessionTabsByWorktree.get(binding.worktreeId)
+  }
+  generations(): number {
+    return this.ptyLifecycleGenerationById.size
+  }
+  retirements(): number {
+    return this.pendingPtySurfaceRetirementsByPtyId.size
+  }
+  async closeTab(): Promise<void> {
+    const snapshot = this.snapshot()
+    const tab = snapshot?.tabs[0]
+    if (!snapshot || tab?.type !== 'terminal') {
+      throw new Error('missing test tab')
+    }
+    await this.closeHeadlessMobileTerminalTab(binding.worktreeId, snapshot, tab)
+  }
+  publish(layoutOnly = false): void {
+    this.storeMobileSessionSnapshot(binding.worktreeId, {
+      worktree: binding.worktreeId,
+      publicationEpoch: 'retirement-test',
+      snapshotVersion: 1,
+      activeGroupId: null,
+      activeTabId: `${binding.tabId}::${binding.leafId}`,
+      activeTabType: 'terminal',
+      tabs: [
+        {
+          type: 'terminal',
+          id: `${binding.tabId}::${binding.leafId}`,
+          parentTabId: binding.tabId,
+          leafId: binding.leafId,
+          ptyId: layoutOnly ? null : binding.ptyId,
+          ...(layoutOnly
+            ? {
+                parentLayout: {
+                  root: { type: 'leaf' as const, leafId: binding.leafId },
+                  activeLeafId: binding.leafId,
+                  expandedLeafId: null,
+                  ptyIdsByLeafId: { [binding.leafId]: binding.ptyId }
+                }
+              }
+            : {}),
+          title: 'Terminal',
+          isActive: true
+        }
+      ]
+    })
+  }
+}
+
+it.each(['read', 'replacement', 'legacy-replacement'] as const)(
+  'publishes an exited terminal retirement with concurrent %s',
+  async (action) => {
+    const { store, authority, readState } = await fixture()
+    await store.persistPtyBinding(binding)
+    const runtime = new RetirementRuntime(store)
+    runtime.registerPty(binding.ptyId, binding.worktreeId, null, binding)
+    runtime.publish()
+    const gate = authority.pause()
+    const exiting = runtime.onPtyExit(binding.ptyId, 0, binding.incarnationId, {
+      providerExitObserved: true
+    })
+    await gate.started.promise
+    if (action === 'read') {
+      await runtime.readVisibleState()
+    } else if (action === 'legacy-replacement') {
+      runtime.onPtySpawned(binding.ptyId)
+    } else {
+      runtime.onPtySpawned(binding.ptyId, 'dddddddd-dddd-4ddd-8ddd-dddddddddddd')
+    }
+    gate.finish.resolve()
+    await exiting
+    expect(readState().workspaceSession.terminalLayoutsByTabId[binding.tabId]).toBeUndefined()
+    expect(runtime.snapshot()?.tabs).toHaveLength(action === 'read' ? 0 : 1)
+    if (action === 'read') {
+      expect(runtime.retirements()).toBe(0)
+    }
+  }
+)
+
+it('publishes an exit whose only live ownership is the mobile parent layout', async () => {
+  const { store, authority, readState } = await fixture()
+  await store.persistPtyBinding(binding)
+  const runtime = new RetirementRuntime(store)
+  runtime.publish(true)
+  const gate = authority.pause()
+  const exiting = runtime.onPtyExit(binding.ptyId, 0, binding.incarnationId, {
+    providerExitObserved: true
+  })
+  await gate.started.promise
+  gate.finish.resolve()
+  await exiting
+  expect(readState().workspaceSession.terminalLayoutsByTabId[binding.tabId]).toBeUndefined()
+  expect(runtime.snapshot()?.tabs).toEqual([])
+  expect(runtime.generations()).toBe(0)
+})
+
+it('completes a durable close and refuses a split queued behind it', async () => {
+  const { store, authority, readState } = await fixture()
+  await store.persistPtyBinding(binding)
+  const runtime = new RetirementRuntime(store)
+  const kill = vi.fn(() => true)
+  runtime.setPtyController({ write: () => true, kill, getForegroundProcess: async () => null })
+  runtime.registerPty(binding.ptyId, binding.worktreeId, null, binding)
+  runtime.publish()
+  const gate = authority.pause()
+  const close = runtime.closeTab()
+  await gate.started.promise
+  const split = store.persistPtyBinding({
+    ...binding,
+    leafId: 'dddddddd-dddd-4ddd-8ddd-dddddddddddd',
+    ptyId: 'concurrent-split',
+    expectedSourceBinding: binding
+  })
+  gate.finish.resolve()
+  await close
+  await expect(split).resolves.toBe(false)
+  expect(kill).toHaveBeenCalledExactlyOnceWith(binding.ptyId)
+  expect(runtime.snapshot()?.tabs).toEqual([])
+  expect(readState().workspaceSession.terminalLayoutsByTabId[binding.tabId]).toBeUndefined()
+})
diff --git a/src/main/persistence/loading-store/pty-spawn-commit-dependencies-fixture.ts b/src/main/persistence/loading-store/pty-spawn-commit-dependencies-fixture.ts
new file mode 100644
index 000000000000..2777fdfde4b5
--- /dev/null
+++ b/src/main/persistence/loading-store/pty-spawn-commit-dependencies-fixture.ts
@@ -0,0 +1,44 @@
+import type { PtySpawnIpcDeps } from '../../ipc/pty/ipc/spawn-types'
+import type { PtyRuntimeControllerDeps } from '../../ipc/pty/runtime/controller-deps'
+import type { OrcaRuntimeService } from '../../runtime/orca-runtime'
+import type { Store } from './store'
+
+function unexpectedPreflight(): never {
+  throw new Error('Spawn commit must not rerun preflight')
+}
+
+export function createPtySpawnCommitDependencies(
+  runtime: OrcaRuntimeService,
+  store: Store
+): PtySpawnIpcDeps & PtyRuntimeControllerDeps {
+  return {
+    runtime,
+    store,
+    sendPtySpawnedToRenderer: () => {},
+    getLocalPtyStartupPromise: unexpectedPreflight,
+    getLocalPtyProviderStartupPromise: unexpectedPreflight,
+    adoptStablePane: unexpectedPreflight,
+    assertFolderWorkspacePtyPathUsable: unexpectedPreflight,
+    resolvePtySpawnStartupCwd: unexpectedPreflight,
+    localStartupCwdDirectoryExists: unexpectedPreflight,
+    prepareCodexResumeHome: unexpectedPreflight,
+    noCodexResumeLaunch: unexpectedPreflight,
+    resolveCodexResumeLaunch: unexpectedPreflight,
+    reconcileSharedRuntimeResumeHome: unexpectedPreflight,
+    stripSequencedStartupResumeArgv: unexpectedPreflight,
+    transitionSpawnHiddenRendererPtyDeliveryState: unexpectedPreflight,
+    trustedTerminalHandleEnv: new Set(),
+    syncPtyBackgroundedDelivery: unexpectedPreflight,
+    stopReplacedPty: unexpectedPreflight,
+    requestSerializedBuffer: unexpectedPreflight,
+    shutdownProviderAndDetectExit: unexpectedPreflight,
+    rememberSyntheticKillExit: unexpectedPreflight,
+    rememberRetiredRejectedPty: unexpectedPreflight,
+    sendPtyExitToRenderer: unexpectedPreflight,
+    finishPtyShutdown: unexpectedPreflight,
+    retiredRejectedPtyIds: new Map(),
+    get mainWindow() {
+      return unexpectedPreflight()
+    }
+  }
+}
diff --git a/src/main/persistence/loading-store/pty-spawn-exit-durability.test.ts b/src/main/persistence/loading-store/pty-spawn-exit-durability.test.ts
new file mode 100644
index 000000000000..ef146779b4bf
--- /dev/null
+++ b/src/main/persistence/loading-store/pty-spawn-exit-durability.test.ts
@@ -0,0 +1,238 @@
+import { expect, it, vi } from 'vitest'
+import { fixture } from './profile-state-delayed-authority-fixture'
+import { OrcaRuntimeService } from '../../runtime/orca-runtime'
+import { commitRuntimePtySpawn } from '../../ipc/pty/runtime/spawn-commit'
+import { createRuntimePtySpawnState } from '../../ipc/pty/runtime/spawn-state'
+import type { PtyRuntimeControllerDeps } from '../../ipc/pty/runtime/controller-deps'
+import { commitPtyIpcSpawn } from '../../ipc/pty/ipc/spawn-commit'
+import { createPtyIpcSpawnState } from '../../ipc/pty/ipc/spawn-state'
+import type { PtySpawnIpcDeps } from '../../ipc/pty/ipc/spawn-types'
+import { registerPersistedPtySpawn } from '../../ipc/pty/pane/spawn-registration'
+import { toSshExecutionHostId } from '../../../shared/execution-host'
+import { clearProviderPtyState } from '../../ipc/pty/provider/state-cleanup'
+import { ptyOwnership, ptyIncarnationById } from '../../ipc/pty/provider/ownership-state'
+import { ptySizes } from '../../ipc/pty/delivery/visibility-state'
+import {
+  paneSpawnReservationsByOwnerKey,
+  reservePaneSpawn,
+  reserveIdlePaneSpawn,
+  resolvePaneSpawnReservation,
+  type PaneSpawnReservation
+} from '../../ipc/pty/pane/spawn-reservation'
+
+vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
+vi.mock('../../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: () => ({ nth_repo_added: 2 })
+}))
+vi.mock('../../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: () => ({ hosts: [] }),
+  sshConfigHostsToTargets: () => []
+}))
+
+it.each(
+  [
+    { controller: 'runtime', connectionId: null, exitCode: 0 },
+    { controller: 'runtime', connectionId: 'test-host', exitCode: 0 },
+    { controller: 'ipc', connectionId: null, exitCode: -1 },
+    { controller: 'ipc', connectionId: 'test-host', exitCode: 0 }
+  ].flatMap((test) => [
+    { ...test, stableOwner: false },
+    { ...test, stableOwner: true }
+  ])
+)(
+  'retires an exited $controller binding on $connectionId after disk finishes (stable: $stableOwner)',
+  async ({ controller, connectionId, exitCode, stableOwner }) => {
+    const { store, authority, readState } = await fixture()
+    const runtime = new OrcaRuntimeService(store)
+    const binding = {
+      worktreeId: 'repo-local::/fixture/local',
+      tabId: 'aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa',
+      leafId: 'bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb',
+      ptyId: connectionId
+        ? `ssh:${connectionId}@@pty-exited-during-durable-bind`
+        : 'pty-exited-during-durable-bind',
+      incarnationId: 'cccccccc-cccc-4ccc-8ccc-cccccccccccc'
+    }
+    const owner = stableOwner
+      ? {
+          ...binding,
+          hasPersistedBinding: true as const,
+          persistedIncarnationId: 'previous-incarnation'
+        }
+      : null
+    if (owner) {
+      await store.persistPtyBinding(
+        { ...binding, incarnationId: owner.persistedIncarnationId },
+        connectionId ? toSshExecutionHostId(connectionId) : undefined
+      )
+    }
+    runtime.onPtySpawned(binding.ptyId, binding.incarnationId)
+    runtime.beginPtyRegistration(binding.ptyId, binding.incarnationId)
+    runtime.assertPtyRegistrationAllowed(binding.ptyId, binding.incarnationId)
+    let commit: () => Promise<unknown>
+    const reservationKey = JSON.stringify([connectionId, binding.worktreeId, binding.leafId])
+    let reservation: PaneSpawnReservation | undefined
+    if (controller === 'runtime') {
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: only commit runs; its runtime/store are real and preflight-only dependencies are unreachable.
+      const deps = { runtime, store, options: {} } as PtyRuntimeControllerDeps
+      const ctx = createRuntimePtySpawnState(deps, { ...binding, connectionId, cols: 80, rows: 24 })
+      ctx.result = { id: binding.ptyId, incarnationId: binding.incarnationId }
+      ctx.stablePaneOwner = owner
+      ctx.hostSessionBinding = { store, ...binding }
+      ctx.metadataLeafId = binding.leafId
+      commit = () => commitRuntimePtySpawn(ctx)
+    } else {
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: only commit runs; its runtime/store are real and preflight-only dependencies are unreachable.
+      const deps = { runtime, store } as PtySpawnIpcDeps
+      const ctx = createPtyIpcSpawnState(deps, { ...binding, connectionId, cols: 80, rows: 24 })
+      ctx.result = { id: binding.ptyId, incarnationId: binding.incarnationId }
+      ctx.stablePaneOwner = owner
+      ctx.metadataLeafId = binding.leafId
+      ctx.validatedLeafId = binding.leafId
+      reservation = reservePaneSpawn(reservationKey)
+      ctx.paneSpawnReservationKey = reservationKey
+      ctx.paneSpawnReservation = reservation
+      commit = () => commitPtyIpcSpawn(ctx)
+    }
+    const gate = authority.pause()
+    const pending =
+      controller === 'ipc'
+        ? expect(commit()).resolves.toMatchObject({
+            id: binding.ptyId,
+            incarnationId: binding.incarnationId
+          })
+        : expect(commit()).rejects.toThrow('agent_session_exited_during_start')
+    await gate.started.promise
+    const nextReservation = reservation ? reserveIdlePaneSpawn(reservationKey) : undefined
+    clearProviderPtyState(binding.ptyId)
+    ptyOwnership.delete(binding.ptyId)
+    await runtime.onPtyExit(binding.ptyId, exitCode, binding.incarnationId, {
+      providerExitObserved: true
+    })
+    gate.finish.resolve()
+    await pending
+    expect(ptyOwnership.has(binding.ptyId)).toBe(false)
+    expect(ptyIncarnationById.has(binding.ptyId)).toBe(false)
+    expect(ptySizes.has(binding.ptyId)).toBe(false)
+    expect(
+      store
+        .getSshRemotePtyLeases(connectionId ?? undefined)
+        .some((lease) => lease.ptyId.includes('pty-exited-during-durable-bind'))
+    ).toBe(false)
+    if (reservation) {
+      await expect(reservation.promise).resolves.toMatchObject({ id: binding.ptyId })
+      const next = await nextReservation
+      expect(next).not.toBe(reservation)
+      resolvePaneSpawnReservation(reservationKey, next, { id: 'next-spawn' })
+      expect(paneSpawnReservationsByOwnerKey.has(reservationKey)).toBe(false)
+    }
+    const state = readState()
+    const session = connectionId
+      ? state.workspaceSessionsByHostId[toSshExecutionHostId(connectionId)]
+      : state.workspaceSession
+    expect(
+      session.terminalLayoutsByTabId[binding.tabId]?.ptyIdsByLeafId?.[binding.leafId]
+    ).toBeUndefined()
+  }
+)
+
+const binding = {
+  worktreeId: 'repo-local::/fixture/local',
+  tabId: 'aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa',
+  leafId: 'bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb',
+  ptyId: 'exited-pty',
+  incarnationId: 'old-incarnation'
+}
+
+it.each(['replacement-pty', binding.ptyId])(
+  'preserves a replacement binding to %s while retirement waits',
+  async (ptyId) => {
+    const { store, authority, readState } = await fixture()
+    const runtime = new OrcaRuntimeService(store)
+    runtime.beginPtyRegistration(binding.ptyId, binding.incarnationId)
+    await store.persistPtyBinding(binding)
+    await runtime.onPtyExit(binding.ptyId, 0, binding.incarnationId, { providerExitObserved: true })
+    const gate = authority.pause()
+    const replacement = store.persistPtyBinding({
+      ...binding,
+      ptyId,
+      incarnationId: 'new-incarnation'
+    })
+    await gate.started.promise
+    const registration = expect(
+      registerPersistedPtySpawn(runtime, store, binding.ptyId, binding.worktreeId, null, binding)
+    ).rejects.toThrow('agent_session_exited_during_start')
+    gate.finish.resolve()
+    await Promise.all([replacement, registration])
+    const session = readState().workspaceSession
+    expect(session.terminalLayoutsByTabId[binding.tabId].ptyIdsByLeafId[binding.leafId]).toBe(ptyId)
+    expect(session.terminalPtyIncarnationsByPaneKey[`${binding.tabId}:${binding.leafId}`]).toBe(
+      'new-incarnation'
+    )
+  }
+)
+
+it('retains the binding when loss of contact supplies no process-exit proof', async () => {
+  const { store, readState } = await fixture()
+  const runtime = new OrcaRuntimeService(store)
+  runtime.beginPtyRegistration(binding.ptyId, binding.incarnationId)
+  await store.persistPtyBinding(binding)
+  await runtime.onPtyExit(binding.ptyId, -1, binding.incarnationId)
+  expect(() =>
+    registerPersistedPtySpawn(runtime, store, binding.ptyId, binding.worktreeId, null, binding)
+  ).toThrow('agent_session_exited_during_start')
+  expect(
+    readState().workspaceSession.terminalLayoutsByTabId[binding.tabId].ptyIdsByLeafId[
+      binding.leafId
+    ]
+  ).toBe(binding.ptyId)
+})
+
+it('does not settle rejected registration until its exit cleanup reaches SQLite', async () => {
+  const { store, authority, readState } = await fixture()
+  const runtime = new OrcaRuntimeService(store)
+  runtime.beginPtyRegistration(binding.ptyId, binding.incarnationId)
+  await store.persistPtyBinding(binding)
+  await runtime.onPtyExit(binding.ptyId, 0, binding.incarnationId, { providerExitObserved: true })
+  const gate = authority.pause()
+  let rejected = false
+  const cleanup = registerPersistedPtySpawn(
+    runtime,
+    store,
+    binding.ptyId,
+    binding.worktreeId,
+    null,
+    binding
+  )
+  if (!cleanup) {
+    throw new Error('exited registration did not start durable cleanup')
+  }
+  const pending = cleanup.catch((error: unknown) => {
+    rejected = true
+    throw error
+  })
+  const failure = expect(pending).rejects.toThrow('agent_session_exited_during_start')
+  await gate.started.promise
+  expect(rejected).toBe(false)
+  expect(
+    readState().workspaceSession.terminalLayoutsByTabId[binding.tabId].ptyIdsByLeafId[
+      binding.leafId
+    ]
+  ).toBe(binding.ptyId)
+  gate.finish.resolve()
+  await failure
+  expect(
+    readState().workspaceSession.terminalLayoutsByTabId[binding.tabId]?.ptyIdsByLeafId?.[
+      binding.leafId
+    ]
+  ).toBeUndefined()
+})
+
+it('keeps successful registration synchronous through the remaining spawn publication', async () => {
+  const { store } = await fixture()
+  const runtime = new OrcaRuntimeService(store)
+  await store.persistPtyBinding(binding)
+  expect(
+    registerPersistedPtySpawn(runtime, store, binding.ptyId, binding.worktreeId, null, binding)
+  ).toBeUndefined()
+})
diff --git a/src/main/persistence/loading-store/pty-spawn-handle-publication.test.ts b/src/main/persistence/loading-store/pty-spawn-handle-publication.test.ts
new file mode 100644
index 000000000000..9fb0d65a2cb8
--- /dev/null
+++ b/src/main/persistence/loading-store/pty-spawn-handle-publication.test.ts
@@ -0,0 +1,77 @@
+import { expect, it, vi } from 'vitest'
+import { fixture } from './profile-state-delayed-authority-fixture'
+import { OrcaRuntimeService } from '../../runtime/orca-runtime'
+import { commitPtyIpcSpawn } from '../../ipc/pty/ipc/spawn-commit'
+import { createPtyIpcSpawnState } from '../../ipc/pty/ipc/spawn-state'
+import { commitRuntimePtySpawn } from '../../ipc/pty/runtime/spawn-commit'
+import { createRuntimePtySpawnState } from '../../ipc/pty/runtime/spawn-state'
+import { createPtySpawnCommitDependencies } from './pty-spawn-commit-dependencies-fixture'
+
+vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
+vi.mock('../../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: () => ({ nth_repo_added: 2 })
+}))
+vi.mock('../../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: () => ({ hosts: [] }),
+  sshConfigHostsToTargets: () => []
+}))
+
+const binding = {
+  worktreeId: 'repo-local::/fixture/local',
+  tabId: 'aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa',
+  leafId: 'bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb',
+  ptyId: 'mobile-pending-spawn',
+  incarnationId: 'cccccccc-cccc-4ccc-8ccc-cccccccccccc'
+}
+class MobileCreateRuntime extends OrcaRuntimeService {
+  waitForCreatedSurface() {
+    this.pendingMobileTerminalCreatesByKey.set(`${binding.worktreeId}::${binding.tabId}`, {
+      activate: true,
+      paired: true,
+      selectIfNoActiveTab: true
+    })
+    return this.waitForMobileTerminalSurface(binding.worktreeId, binding.tabId, {
+      requireReady: true
+    })
+  }
+}
+
+it.each(['ipc', 'runtime'])(
+  'publishes the preallocated handle to a pending mobile %s create',
+  async (controller) => {
+    const { store, authority } = await fixture()
+    const runtime = new MobileCreateRuntime(store)
+    const preAllocatedHandle = runtime.createPreAllocatedTerminalHandle()
+    const surface = runtime.waitForCreatedSurface()
+    runtime.onPtySpawned(binding.ptyId, binding.incarnationId)
+    const deps = createPtySpawnCommitDependencies(runtime, store)
+    let commit: () => Promise<unknown>
+    if (controller === 'ipc') {
+      const ctx = createPtyIpcSpawnState(deps, { ...binding, cols: 80, rows: 24 })
+      ctx.result = { id: binding.ptyId, incarnationId: binding.incarnationId }
+      ctx.metadataLeafId = binding.leafId
+      ctx.validatedLeafId = binding.leafId
+      ctx.preAllocatedHandle = preAllocatedHandle
+      commit = () => commitPtyIpcSpawn(ctx)
+    } else {
+      const ctx = createRuntimePtySpawnState(deps, {
+        ...binding,
+        cols: 80,
+        rows: 24,
+        preAllocatedHandle
+      })
+      ctx.result = { id: binding.ptyId, incarnationId: binding.incarnationId }
+      ctx.metadataLeafId = binding.leafId
+      ctx.hostSessionBinding = { store, ...binding }
+      commit = () => commitRuntimePtySpawn(ctx)
+    }
+    const gate = authority.pause()
+    const pending = commit()
+    await gate.started.promise
+    gate.finish.resolve()
+    await pending
+    const result = await surface
+    expect(result.tab.terminal).toBe(preAllocatedHandle)
+    await runtime.onPtyExit(binding.ptyId, 0, binding.incarnationId, { providerExitObserved: true })
+  }
+)
diff --git a/src/main/persistence/loading-store/pty-spawn-replacement-durability.test.ts b/src/main/persistence/loading-store/pty-spawn-replacement-durability.test.ts
new file mode 100644
index 000000000000..719a3bbe9242
--- /dev/null
+++ b/src/main/persistence/loading-store/pty-spawn-replacement-durability.test.ts
@@ -0,0 +1,146 @@
+import { afterEach, expect, it, vi } from 'vitest'
+import { deferred, fixture } from './profile-state-delayed-authority-fixture'
+import { OrcaRuntimeService } from '../../runtime/orca-runtime'
+import { commitPtyIpcSpawn } from '../../ipc/pty/ipc/spawn-commit'
+import { createPtyIpcSpawnState } from '../../ipc/pty/ipc/spawn-state'
+import type { PtySpawnIpcDeps } from '../../ipc/pty/ipc/spawn-types'
+import { commitRuntimePtySpawn } from '../../ipc/pty/runtime/spawn-commit'
+import { createRuntimePtySpawnState } from '../../ipc/pty/runtime/spawn-state'
+import type { PtyRuntimeControllerDeps } from '../../ipc/pty/runtime/controller-deps'
+import { ptyIncarnationById, ptyOwnership } from '../../ipc/pty/provider/ownership-state'
+import { clearProviderPtyState } from '../../ipc/pty/provider/state-cleanup'
+import { createPtySpawnCommitDependencies } from './pty-spawn-commit-dependencies-fixture'
+
+vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
+vi.mock('../../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: () => ({ nth_repo_added: 2 })
+}))
+vi.mock('../../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: () => ({ hosts: [] }),
+  sshConfigHostsToTargets: () => []
+}))
+
+const binding = {
+  worktreeId: 'repo-local::/fixture/local',
+  tabId: 'aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa',
+  leafId: 'bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb',
+  ptyId: 'replaced-during-save',
+  incarnationId: 'cccccccc-cccc-4ccc-8ccc-cccccccccccc'
+}
+const replacementIncarnation = 'dddddddd-dddd-4ddd-8ddd-dddddddddddd'
+
+afterEach(() => {
+  clearProviderPtyState(binding.ptyId)
+  ptyOwnership.delete(binding.ptyId)
+})
+
+it.each(
+  ['ipc', 'runtime'].flatMap((controller) =>
+    ['save', 'shutdown'].map((replacementDuring) => ({ controller, replacementDuring }))
+  )
+)(
+  'preserves a successor during $replacementDuring when the predecessor $controller save fails',
+  async ({ controller, replacementDuring }) => {
+    const { store, authority } = await fixture()
+    const runtime = new OrcaRuntimeService(store)
+    runtime.onPtySpawned(binding.ptyId, binding.incarnationId)
+    ptyIncarnationById.set(binding.ptyId, binding.incarnationId)
+    const deps = createPtySpawnCommitDependencies(runtime, store)
+    const shutdownStarted = deferred<void>()
+    const shutdownFinished = deferred<void>()
+    const holdShutdown = async () => {
+      shutdownStarted.resolve()
+      await shutdownFinished.promise
+    }
+    let commit: () => Promise<unknown>
+    let shutdown: ReturnType<typeof vi.spyOn>
+    if (controller === 'ipc') {
+      const ctx = createPtyIpcSpawnState(deps, { ...binding, cols: 80, rows: 24 })
+      ctx.result = { id: binding.ptyId, incarnationId: binding.incarnationId }
+      ctx.metadataLeafId = binding.leafId
+      ctx.validatedLeafId = binding.leafId
+      shutdown = vi.spyOn(ctx.provider, 'shutdown').mockImplementation(holdShutdown)
+      commit = () => commitPtyIpcSpawn(ctx)
+    } else {
+      const ctx = createRuntimePtySpawnState(deps, { ...binding, cols: 80, rows: 24 })
+      ctx.result = { id: binding.ptyId, incarnationId: binding.incarnationId }
+      ctx.metadataLeafId = binding.leafId
+      ctx.hostSessionBinding = { store, ...binding }
+      shutdown = vi.spyOn(ctx.provider, 'shutdown').mockImplementation(holdShutdown)
+      commit = () => commitRuntimePtySpawn(ctx)
+    }
+    const gate = authority.pause()
+    const pending = expect(commit()).rejects.toThrow('ORCA_TERMINAL_SESSION_STATE_SAVE_FAILED')
+    await gate.started.promise
+    if (replacementDuring === 'shutdown') {
+      gate.finish.reject(new Error('disk full'))
+      await shutdownStarted.promise
+    }
+    await runtime.onPtyExit(binding.ptyId, 0, binding.incarnationId, { providerExitObserved: true })
+    runtime.onPtySpawned(binding.ptyId, replacementIncarnation)
+    ptyIncarnationById.set(binding.ptyId, replacementIncarnation)
+    ptyOwnership.set(binding.ptyId, 'successor-host')
+    if (replacementDuring === 'save') {
+      gate.finish.reject(new Error('disk full'))
+    }
+    shutdownFinished.resolve()
+    await pending
+    if (replacementDuring === 'save') {
+      expect(shutdown).not.toHaveBeenCalled()
+    } else {
+      expect(shutdown).toHaveBeenCalledExactlyOnceWith(binding.ptyId, {
+        immediate: true,
+        expectedIncarnationId: binding.incarnationId
+      })
+    }
+    expect(ptyIncarnationById.get(binding.ptyId)).toBe(replacementIncarnation)
+    expect(ptyOwnership.get(binding.ptyId)).toBe('successor-host')
+    await runtime.onPtyExit(binding.ptyId, 0, replacementIncarnation, {
+      providerExitObserved: true
+    })
+  }
+)
+
+it.each(['ipc', 'runtime'])(
+  'keeps replacement provider identity when an exited %s spawn finishes saving',
+  async (controller) => {
+    const { store, authority } = await fixture()
+    const runtime = new OrcaRuntimeService(store)
+    runtime.onPtySpawned(binding.ptyId, binding.incarnationId)
+    let commit: () => Promise<unknown>
+    if (controller === 'ipc') {
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: only commit runs; the runtime/store are real and preflight-only dependencies are unreachable.
+      const deps = { runtime, store } as PtySpawnIpcDeps
+      const ctx = createPtyIpcSpawnState(deps, { ...binding, cols: 80, rows: 24 })
+      ctx.result = { id: binding.ptyId, incarnationId: binding.incarnationId }
+      ctx.metadataLeafId = binding.leafId
+      ctx.validatedLeafId = binding.leafId
+      commit = () => commitPtyIpcSpawn(ctx)
+    } else {
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: only commit runs; the runtime/store are real and preflight-only dependencies are unreachable.
+      const deps = { runtime, store } as PtyRuntimeControllerDeps
+      const ctx = createRuntimePtySpawnState(deps, { ...binding, cols: 80, rows: 24 })
+      ctx.result = { id: binding.ptyId, incarnationId: binding.incarnationId }
+      ctx.metadataLeafId = binding.leafId
+      ctx.hostSessionBinding = { store, ...binding }
+      commit = () => commitRuntimePtySpawn(ctx)
+    }
+    const gate = authority.pause()
+    const pending = expect(commit()).rejects.toThrow('agent_session_exited_during_start')
+    await gate.started.promise
+    await runtime.onPtyExit(binding.ptyId, 0, binding.incarnationId, { providerExitObserved: true })
+    runtime.onPtySpawned(binding.ptyId, replacementIncarnation)
+    runtime.seedHeadlessTerminal(binding.ptyId, 'replacement history', { cols: 112, rows: 37 })
+    ptyIncarnationById.set(binding.ptyId, replacementIncarnation)
+    gate.finish.resolve()
+    await pending
+    expect(ptyIncarnationById.get(binding.ptyId)).toBe(replacementIncarnation)
+    expect(await runtime.serializeMainTerminalBuffer(binding.ptyId)).toMatchObject({
+      cols: 112,
+      rows: 37
+    })
+    await runtime.onPtyExit(binding.ptyId, 0, replacementIncarnation, {
+      providerExitObserved: true
+    })
+  }
+)
diff --git a/src/main/persistence/loading-store/pty-spawn-restore-durability.test.ts b/src/main/persistence/loading-store/pty-spawn-restore-durability.test.ts
new file mode 100644
index 000000000000..26737df9dd0d
--- /dev/null
+++ b/src/main/persistence/loading-store/pty-spawn-restore-durability.test.ts
@@ -0,0 +1,79 @@
+import { describe, expect, it, vi } from 'vitest'
+import { fixture } from './profile-state-delayed-authority-fixture'
+import { OrcaRuntimeService } from '../../runtime/orca-runtime'
+import { commitPtyIpcSpawn } from '../../ipc/pty/ipc/spawn-commit'
+import { createPtyIpcSpawnState } from '../../ipc/pty/ipc/spawn-state'
+import type { PtySpawnResult } from '../../providers/types'
+import { commitRuntimePtySpawn } from '../../ipc/pty/runtime/spawn-commit'
+import { createRuntimePtySpawnState } from '../../ipc/pty/runtime/spawn-state'
+import { createPtySpawnCommitDependencies } from './pty-spawn-commit-dependencies-fixture'
+
+vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
+vi.mock('../../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: () => ({ nth_repo_added: 2 })
+}))
+vi.mock('../../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: () => ({ hosts: [] }),
+  sshConfigHostsToTargets: () => []
+}))
+
+const binding = {
+  worktreeId: 'repo-local::/fixture/local',
+  tabId: 'aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa',
+  leafId: 'bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb',
+  ptyId: 'restoring-pty',
+  incarnationId: 'cccccccc-cccc-4ccc-8ccc-cccccccccccc'
+}
+const restores: Pick<PtySpawnResult, 'snapshot' | 'coldRestore' | 'replay'>[] = [
+  { snapshot: 'restored history\r\n' },
+  {
+    coldRestore: {
+      scrollback: 'restored history\r\n',
+      lastTitle: 'Restored',
+      cwd: '/fixture/local'
+    }
+  },
+  { replay: 'restored history\r\n' }
+]
+
+describe.each(['ipc', 'runtime'])('%s restored scrollback', (controller) => {
+  it.each(restores)(
+    'keeps restored history before output during the binding save: %j',
+    async (restore) => {
+      const { store, authority } = await fixture()
+      const runtime = new OrcaRuntimeService(store)
+      runtime.onPtySpawned(binding.ptyId, binding.incarnationId)
+      const deps = createPtySpawnCommitDependencies(runtime, store)
+      let commit: () => Promise<unknown>
+      const result = { id: binding.ptyId, incarnationId: binding.incarnationId, ...restore }
+      if (controller === 'ipc') {
+        const ctx = createPtyIpcSpawnState(deps, { ...binding, cols: 80, rows: 24 })
+        ctx.result = result
+        ctx.metadataLeafId = binding.leafId
+        ctx.validatedLeafId = binding.leafId
+        commit = () => commitPtyIpcSpawn(ctx)
+      } else {
+        const ctx = createRuntimePtySpawnState(deps, { ...binding, cols: 80, rows: 24 })
+        ctx.result = result
+        ctx.metadataLeafId = binding.leafId
+        ctx.hostSessionBinding = { store, ...binding }
+        commit = () => commitRuntimePtySpawn(ctx)
+      }
+      const gate = authority.pause()
+      const pending = commit()
+      await gate.started.promise
+      runtime.onPtyData(binding.ptyId, 'live output\r\n', Date.now())
+      gate.finish.resolve()
+      await pending
+      const snapshot = await runtime.serializeMainTerminalBuffer(binding.ptyId)
+      expect(snapshot?.data).toContain('restored history')
+      expect(snapshot?.data).toContain('live output')
+      expect(snapshot?.data.indexOf('restored history')).toBeLessThan(
+        snapshot?.data.indexOf('live output') ?? -1
+      )
+      await runtime.onPtyExit(binding.ptyId, 0, binding.incarnationId, {
+        providerExitObserved: true
+      })
+    }
+  )
+})
diff --git a/src/main/persistence/loading-store/secret-sentinel-substitution.test.ts b/src/main/persistence/loading-store/secret-sentinel-substitution.test.ts
index e58d0280baea..eaae559e77fa 100644
--- a/src/main/persistence/loading-store/secret-sentinel-substitution.test.ts
+++ b/src/main/persistence/loading-store/secret-sentinel-substitution.test.ts
@@ -1,11 +1,7 @@
-/**
- * The bar for this change is "the bytes on disk did not move". Every case below runs the exact
- * loop `applySecretSentinelSubstitutions` replaced — reproduced in `previousImplementation` — and
- * compares payload bytes and guard hash, because a drifting hash silently disables the no-op write
- * guard and a drifting payload is corrupted persisted state.
- */
+/** Full serialization retains its bytes/hash; domain serialization preserves bytes and equality. */
 import { createHash, randomUUID } from 'node:crypto'
-import { describe, expect, it } from 'vitest'
+import { describe, expect, it, vi } from 'vitest'
+import { serializeCompleteProfileStateDomains } from './profile-state-authority-writes'
 import {
   applySecretSentinelSubstitutions,
   type SecretSentinelSubstitution
@@ -36,14 +32,101 @@ function expectIdenticalToPrevious(
 ): void {
   const before = previousImplementation(serialized, subs, degradedPrefix)
   const after = applySecretSentinelSubstitutions(serialized, subs, degradedPrefix)
+  const text = applySecretSentinelSubstitutions(serialized, subs, degradedPrefix, 'text')
   expect(after.payload.equals(before.payload)).toBe(true)
   expect(after.stateHash).toBe(before.stateHash)
+  expect(text.payload).toBe(before.payload.toString('utf8'))
+  expect(text.stateHash).toBe(before.stateHash)
 }
 
 function sentinel(): string {
   return `orca-secret-slot-${randomUUID()}`
 }
 
+describe('complete profile domain serialization', () => {
+  it('preserves escaped domain names, omission and the keys passed to toJSON', () => {
+    const domain = '雪"\\\ud800'
+    const state = {
+      [domain]: {
+        toJSON(key: string) {
+          return { key, nested: { toJSON: (nestedKey: string) => nestedKey } }
+        }
+      },
+      omitted: undefined,
+      nullable: null,
+      history: [{ id: 'z' }, { id: 'a' }]
+    }
+
+    const serialized = serializeCompleteProfileStateDomains(state, [], '')
+
+    expect(serialized.payload.toString('utf8')).toBe(JSON.stringify(state))
+    expect(serialized.domains.map(({ domain }) => domain)).toEqual([domain, 'nullable', 'history'])
+    expect(JSON.parse(serialized.payload.toString('utf8'))).toMatchObject({
+      [domain]: { key: domain, nested: 'nested' },
+      nullable: null
+    })
+  })
+
+  it('keeps the complete hash stable across ciphertext changes and sensitive to plaintext and absence', () => {
+    const slot = sentinel()
+    const state = {
+      settings: { cookie: slot },
+      future: { shadow: 'ciphertext-one' },
+      nullable: null
+    }
+    const firstSub = [{ sentinel: slot, blob: 'ciphertext-one', hashValue: 'secret' }]
+    const first = serializeCompleteProfileStateDomains(state, firstSub, '')
+    const second = serializeCompleteProfileStateDomains(
+      state,
+      [{ sentinel: slot, blob: 'ciphertext-two', hashValue: 'secret' }],
+      ''
+    )
+
+    expect(first.payload).toEqual(
+      applySecretSentinelSubstitutions(JSON.stringify(state), firstSub, '').payload
+    )
+    expect(second.payload).not.toEqual(first.payload)
+    expect(second.stateHash).toBe(first.stateHash)
+    expect(JSON.parse(second.payload.toString('utf8')).future).toEqual({ shadow: 'ciphertext-one' })
+    expect(
+      serializeCompleteProfileStateDomains(
+        state,
+        [{ sentinel: slot, blob: 'ciphertext-one', hashValue: 'changed-secret' }],
+        ''
+      ).stateHash
+    ).not.toBe(first.stateHash)
+    expect(
+      serializeCompleteProfileStateDomains({ ...state, nullable: undefined }, firstSub, '')
+        .stateHash
+    ).not.toBe(first.stateHash)
+  })
+
+  it('retains unknown own keys and encodes bytes only when a complete payload is requested', () => {
+    const state = Object.fromEntries([
+      ['9', 9],
+      ['3', 3],
+      ['z', null],
+      ['__proto__', { own: true }],
+      ['constructor', false],
+      ['future', { text: '雪😀\ud800', absent: undefined }]
+    ])
+    const expected = JSON.stringify(state)
+    const encode = vi.spyOn(Buffer, 'from')
+    try {
+      const serialized = serializeCompleteProfileStateDomains(state, [], 'safeStorage-degraded\0')
+      expect(serialized.domains.map(({ domain }) => domain)).toEqual(Object.keys(state))
+      expect(serialized.domains.find(({ domain }) => domain === '__proto__')?.payload).toBe(
+        '{"own":true}'
+      )
+      expect(encode).not.toHaveBeenCalled()
+      expect(serialized.payload.toString('utf8')).toBe(expected)
+      expect(encode).toHaveBeenCalledExactlyOnceWith(expected, 'utf8')
+    } finally {
+      encode.mockRestore()
+    }
+  })
+})
+
 describe('applySecretSentinelSubstitutions', () => {
   it('produces bytes and a hash identical to the previous implementation', () => {
     const subs: SecretSentinelSubstitution[] = [
@@ -117,6 +200,39 @@ describe('applySecretSentinelSubstitutions', () => {
     expect(payload.toString('utf8')).not.toContain(subs[0].sentinel)
   })
 
+  it.each(['', 'safeStorage-degraded\0'])(
+    'keeps the first duplicate and handles adjacent escaped sentinels with prefix %j',
+    (prefix) => {
+      const slot = 'orca-$a/.*+?^${}()|[]\\"雪'
+      const subs = [
+        { sentinel: slot, blob: 'cipher-other-token-"\\\n雪\ud800', hashValue: 'plain-😀' },
+        { sentinel: slot, blob: 'duplicate-must-not-win', hashValue: 'wrong-plain' },
+        { sentinel: 'other-token', blob: 'last', hashValue: 'last-plain' }
+      ]
+      const serialized = JSON.stringify({ nested: { [slot]: `${slot}${slot}other-token` } })
+      const expectedPayload = JSON.stringify({
+        nested: { [subs[0].blob]: subs[0].blob + subs[0].blob + subs[2].blob }
+      })
+      const expectedHashInput = JSON.stringify({
+        nested: { [subs[0].hashValue]: subs[0].hashValue + subs[0].hashValue + subs[2].hashValue }
+      })
+      const expectedHash = createHash('sha1').update(prefix).update(expectedHashInput).digest('hex')
+      for (const actual of [
+        applySecretSentinelSubstitutions(serialized, subs, prefix),
+        applySecretSentinelSubstitutions(serialized, subs, prefix, 'text')
+      ]) {
+        expect(actual.payload.toString()).toBe(expectedPayload)
+        expect(actual.stateHash).toBe(expectedHash)
+      }
+    }
+  )
+
+  it('leaves domains without matching sentinels byte-identical', () => {
+    const serialized = JSON.stringify({ future: { output: '雪😀\ud800', present: null } })
+    const subs = [{ sentinel: 'missing-slot', blob: 'cipher', hashValue: 'plain' }]
+    expectIdenticalToPrevious(serialized, subs, 'safeStorage-degraded\0')
+  })
+
   it('copies and UTF-8 encodes the full state once, not once per sentinel per side', () => {
     const subs: SecretSentinelSubstitution[] = Array.from({ length: 3 }, () => ({
       sentinel: sentinel(),
@@ -172,13 +288,17 @@ describe('applySecretSentinelSubstitutions', () => {
 
     const before = counted(() => previousImplementation(serialized, subs, ''))
     const after = counted(() => applySecretSentinelSubstitutions(serialized, subs, ''))
+    const text = counted(() => applySecretSentinelSubstitutions(serialized, subs, '', 'text'))
 
     // Two `String.replace` calls over the whole state per sentinel — payload and hash input.
     expect(before.fullStateReplaces).toBe(subs.length * 2)
     expect(after.fullStateReplaces).toBe(0)
+    expect(text.fullStateReplaces).toBe(0)
     // The old path encoded the state twice: once for sha1, once for the file write.
     expect(before.encodedChars).toBeGreaterThan(serialized.length * 1.9)
     expect(after.encodedChars).toBeLessThan(serialized.length * 1.1)
     expect(after.encodedChars).toBeGreaterThan(serialized.length * 0.9)
+    expect(text.encodedChars).toBeLessThan(serialized.length * 1.1)
+    expect(text.encodedChars).toBeGreaterThan(serialized.length * 0.9)
   })
 })
diff --git a/src/main/persistence/loading-store/secret-sentinel-substitution.ts b/src/main/persistence/loading-store/secret-sentinel-substitution.ts
index afcdddafa771..30ec43eaa1d6 100644
--- a/src/main/persistence/loading-store/secret-sentinel-substitution.ts
+++ b/src/main/persistence/loading-store/secret-sentinel-substitution.ts
@@ -10,69 +10,92 @@ export type SecretSentinelSubstitution = {
   hashValue: string
 }
 
-/**
- * Replace every secret sentinel in `serialized` in ONE pass, producing the on-disk bytes and the
- * guard hash from the same encoded segments.
- *
- * Why not the obvious `payload.replace(...)` / `hashInput.replace(...)` loop it replaces: each
- * `String.replace` returns a rope that the *next* `replace` has to flatten before it can search, so
- * N sentinels cost 2N-1 flattened copies of the whole multi-MB state, plus one more per side when
- * `hash.update` and the file write finally consume them. Measured on a 4.65 MB store with three
- * sentinels: 7 full-state string allocations, 62 MB of V8 heap, 27 MB of it in large_object_space.
- *
- * Here the state is walked once, each literal run is UTF-8 encoded exactly once, and those same
- * buffers feed both the payload and the hash — 1 full-state string, 1 encode.
- *
- * Byte-for-byte identical output to the loop: both sides read the sentinel in its JSON-escaped
- * form, the replacements are the JSON-escaped `blob`/`hashValue`, and the hash sees the same byte
- * sequence it saw when it was handed one concatenated string.
- */
+type SecretSubstitutionOutput<T extends string | Buffer> = {
+  encode: (value: string) => T
+  concat: (chunks: T[]) => T
+}
+
+const bufferOutput: SecretSubstitutionOutput<Buffer> = {
+  encode: (value) => Buffer.from(value, 'utf8'),
+  concat: (chunks) => Buffer.concat(chunks)
+}
+
+const textOutput: SecretSubstitutionOutput<string> = {
+  encode: (value) => value,
+  concat: (chunks) => chunks.join('')
+}
+
+/** One traversal keeps ciphertext and guard hashes aligned without copying once per secret. */
+export function applySecretSentinelSubstitutions(
+  serialized: string,
+  substitutions: readonly SecretSentinelSubstitution[],
+  degradedPrefix: string,
+  output?: 'buffer'
+): { payload: Buffer; stateHash: string }
 export function applySecretSentinelSubstitutions(
   serialized: string,
   substitutions: readonly SecretSentinelSubstitution[],
-  degradedPrefix: string
-): { payload: Buffer; stateHash: string } {
+  degradedPrefix: string,
+  output: 'text'
+): { payload: string; stateHash: string }
+export function applySecretSentinelSubstitutions(
+  serialized: string,
+  substitutions: readonly SecretSentinelSubstitution[],
+  degradedPrefix: string,
+  output: 'buffer' | 'text' = 'buffer'
+): { payload: Buffer | string; stateHash: string } {
+  return output === 'text'
+    ? substituteSentinels(serialized, substitutions, degradedPrefix, textOutput)
+    : substituteSentinels(serialized, substitutions, degradedPrefix, bufferOutput)
+}
+
+function substituteSentinels<T extends string | Buffer>(
+  serialized: string,
+  substitutions: readonly SecretSentinelSubstitution[],
+  degradedPrefix: string,
+  output: SecretSubstitutionOutput<T>
+): { payload: T; stateHash: string } {
   const hash = createHash('sha1').update(degradedPrefix)
   if (substitutions.length === 0) {
-    const payload = Buffer.from(serialized, 'utf8')
+    const payload = output.encode(serialized)
     return { payload, stateHash: hash.update(payload).digest('hex') }
   }
 
-  const replacementBySentinel = new Map<string, { blob: Buffer; hashValue: Buffer }>()
+  const replacementBySentinel = new Map<string, { blob: T; hashValue: T }>()
   const alternatives: string[] = []
   for (const { sentinel, blob, hashValue } of substitutions) {
-    // Preserved from the loop this replaces: both the search key and the replacements are the
-    // JSON-escaped forms, because that is what `serialized` actually contains.
+    // Match escaped JSON contents, including quotes and backslashes inside a secret.
     const escapedSentinel = JSON.stringify(sentinel).slice(1, -1)
     if (replacementBySentinel.has(escapedSentinel)) {
       continue
     }
     alternatives.push(escapeRegex(escapedSentinel))
     replacementBySentinel.set(escapedSentinel, {
-      blob: Buffer.from(JSON.stringify(blob).slice(1, -1), 'utf8'),
-      hashValue: Buffer.from(JSON.stringify(hashValue).slice(1, -1), 'utf8')
+      blob: output.encode(JSON.stringify(blob).slice(1, -1)),
+      hashValue: output.encode(JSON.stringify(hashValue).slice(1, -1))
     })
   }
 
-  // Global, though a sentinel is a UUID minted after the state was assembled and so occurs exactly
-  // once: a single pass that substitutes every occurrence cannot leave one behind on disk.
+  // Substitute every occurrence so a repeated sentinel cannot survive on disk.
   const pattern = new RegExp(alternatives.join('|'), 'g')
-  const chunks: Buffer[] = []
+  const chunks: T[] = []
   let cursor = 0
   let match: RegExpExecArray | null
   while ((match = pattern.exec(serialized)) !== null) {
-    // Non-null: the alternation is built from exactly the map's keys.
-    const replacement = replacementBySentinel.get(match[0])!
-    // A sliced substring, so this does not copy the state; the encode below is its only pass.
-    const literal = Buffer.from(serialized.slice(cursor, match.index), 'utf8')
+    const replacement = replacementBySentinel.get(match[0])
+    if (replacement === undefined) {
+      throw new Error('Secret substitution matched an unregistered sentinel')
+    }
+    // The Buffer output reuses each literal's UTF-8 bytes for both the payload and hash.
+    const literal = output.encode(serialized.slice(cursor, match.index))
     chunks.push(literal, replacement.blob)
     hash.update(literal)
     hash.update(replacement.hashValue)
     cursor = match.index + match[0].length
   }
-  const tail = Buffer.from(serialized.slice(cursor), 'utf8')
+  const tail = output.encode(serialized.slice(cursor))
   chunks.push(tail)
   hash.update(tail)
 
-  return { payload: Buffer.concat(chunks), stateHash: hash.digest('hex') }
+  return { payload: output.concat(chunks), stateHash: hash.digest('hex') }
 }
diff --git a/src/main/persistence/loading-store/session-host-partitions.ts b/src/main/persistence/loading-store/session-host-partitions.ts
index d358f4c8f624..12efd45a19ec 100644
--- a/src/main/persistence/loading-store/session-host-partitions.ts
+++ b/src/main/persistence/loading-store/session-host-partitions.ts
@@ -146,7 +146,10 @@ export function removeWorkspaceSessionOwnerInPartition(
       [resolved]: session
     }
   }
-  scheduleSave(owner[sessionHostPartitionOperationsContext].scheduling)
+  scheduleSave(
+    owner[sessionHostPartitionOperationsContext].scheduling,
+    resolved === LOCAL_EXECUTION_HOST_ID ? ['workspaceSession'] : ['workspaceSessionsByHostId']
+  )
 }
 
 export function partitionOwnsWorktreeTabs(
@@ -206,7 +209,9 @@ export function setHostWorkspaceSession(
     ...owner[sessionHostPartitionOperationsContext].runtime.state.workspaceSessionsByHostId,
     [hostId]: pruned
   }
-  scheduleSave(owner[sessionHostPartitionOperationsContext].scheduling)
+  scheduleSave(owner[sessionHostPartitionOperationsContext].scheduling, [
+    'workspaceSessionsByHostId'
+  ])
 }
 
 export function installSessionHostPartitionOperationsContext(
diff --git a/src/main/persistence/loading-store/session-snapshot-operations.ts b/src/main/persistence/loading-store/session-snapshot-operations.ts
index 37ffd9d366b2..9c3cf23be7b7 100644
--- a/src/main/persistence/loading-store/session-snapshot-operations.ts
+++ b/src/main/persistence/loading-store/session-snapshot-operations.ts
@@ -3,7 +3,7 @@ import type {
   WorkspaceSessionPatch,
   WorkspaceSessionState
 } from '../../../shared/workspace-session-state-types'
-import { LOCAL_EXECUTION_HOST_ID } from '../../../shared/execution-host'
+import { LOCAL_EXECUTION_HOST_ID, type ExecutionHostId } from '../../../shared/execution-host'
 import { pruneWorkspaceSessionBrowserHistory } from '../../../shared/workspace-session-browser-history'
 
 import { workspaceSessionPatchNeedsFullNormalization } from './terminal-session-cleanup'
@@ -18,7 +18,13 @@ import { scheduleSave } from './write-scheduling'
 
 type SessionSnapshotOperationsRuntime = Pick<
   StoreRuntimeState,
-  'pendingSnapshotFileWork' | 'state' | 'terminalScrollbackSnapshotStorage'
+  | 'durableMutationPhase'
+  | 'pendingSnapshotFileWork'
+  | 'profileMaintenancePending'
+  | 'quitFlushStarted'
+  | 'state'
+  | 'terminalScrollbackSnapshotStorage'
+  | 'writesFrozen'
 >
 
 const sessionSnapshotOperationsContext = Symbol('SessionSnapshotOperations')
@@ -43,7 +49,15 @@ export class SessionSnapshotOperations {
 
   setWorkspaceSession(session: PersistedState['workspaceSession'], hostId?: string | null): void {
     const resolved = resolveHostId(hostId)
+    const { runtime } = this[sessionSnapshotOperationsContext]
+    if (runtime.durableMutationPhase === 'rollback') {
+      this.assertSnapshotAdmission(true)
+      // The fieldwise rollback already preserves newer edits; renderer rebasing would undo it.
+      this.publishSession(session, resolved)
+      return
+    }
     if (resolved === LOCAL_EXECUTION_HOST_ID) {
+      this.assertSnapshotAdmission(true)
       setLocalWorkspaceSession(this, session)
       return
     }
@@ -56,6 +70,7 @@ export class SessionSnapshotOperations {
   ): void {
     const resolved = resolveHostId(hostId)
     if (resolved === LOCAL_EXECUTION_HOST_ID) {
+      this.assertSnapshotAdmission()
       setLocalWorkspaceSession(this, session, true)
       return
     }
@@ -76,15 +91,34 @@ export class SessionSnapshotOperations {
     if (Object.hasOwn(patch, 'browserUrlHistory')) {
       next = pruneWorkspaceSessionBrowserHistory(next)
     }
-    if (resolved === LOCAL_EXECUTION_HOST_ID) {
-      this[sessionSnapshotOperationsContext].runtime.state.workspaceSession = next
+    this.publishSession(next, resolved)
+  }
+
+  private publishSession(session: WorkspaceSessionState, hostId: ExecutionHostId): void {
+    const { runtime, scheduling } = this[sessionSnapshotOperationsContext]
+    if (hostId === LOCAL_EXECUTION_HOST_ID) {
+      runtime.state.workspaceSession = session
     } else {
-      this[sessionSnapshotOperationsContext].runtime.state.workspaceSessionsByHostId = {
-        ...this[sessionSnapshotOperationsContext].runtime.state.workspaceSessionsByHostId,
-        [resolved]: next
+      runtime.state.workspaceSessionsByHostId = {
+        ...runtime.state.workspaceSessionsByHostId,
+        [hostId]: session
       }
     }
-    scheduleSave(this[sessionSnapshotOperationsContext].scheduling)
+    scheduleSave(
+      scheduling,
+      hostId === LOCAL_EXECUTION_HOST_ID ? ['workspaceSession'] : ['workspaceSessionsByHostId']
+    )
+  }
+
+  private assertSnapshotAdmission(allowAdmittedMutation = false): void {
+    const { runtime } = this[sessionSnapshotOperationsContext]
+    if (
+      runtime.writesFrozen ||
+      ((runtime.profileMaintenancePending || runtime.quitFlushStarted) &&
+        !(allowAdmittedMutation && runtime.durableMutationPhase !== null))
+    ) {
+      throw new Error('Profile maintenance or finalization is blocking new terminal snapshot work')
+    }
   }
 }
 
diff --git a/src/main/persistence/loading-store/ssh-lease-async-durability.test.ts b/src/main/persistence/loading-store/ssh-lease-async-durability.test.ts
new file mode 100644
index 000000000000..6c646285d4bb
--- /dev/null
+++ b/src/main/persistence/loading-store/ssh-lease-async-durability.test.ts
@@ -0,0 +1,128 @@
+import { describe, expect, it, vi } from 'vitest'
+import { fixture } from './profile-state-delayed-authority-fixture'
+import { removeSshPtyConsumerOwnerRecovery } from '../../ssh/ssh-pty-consumer-recovery'
+
+vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
+vi.mock('../../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: () => ({ nth_repo_added: 2 })
+}))
+vi.mock('../../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: () => ({ hosts: [] }),
+  sshConfigHostsToTargets: () => []
+}))
+
+const recovery = {
+  targetId: 'async-target',
+  clientInstanceId: 'first-owner',
+  serverBuildId: 'build',
+  clientGeneration: 1,
+  ownerGeneration: 1,
+  ownerLease: 'owner-lease'
+}
+
+describe('reserved SSH persistence', () => {
+  it('reserves consumer replacement before mutation and durably writes both exact owners', async () => {
+    const { store, authority } = await fixture()
+    const gate = authority.pause()
+    store.updateSettings({ theme: 'dark' })
+    const older = store.flushPendingOrThrowAsync()
+    await gate.started.promise
+    const first = store.upsertSshPtyConsumerRecovery(recovery)
+    const second = store.upsertSshPtyConsumerRecovery({
+      ...recovery,
+      clientInstanceId: 'next-owner'
+    })
+    expect(store.getSshPtyConsumerRecovery(recovery.targetId)).toBeNull()
+    gate.finish.resolve()
+    await Promise.all([older, first, second])
+    const ownerWrites = authority.captures
+      .flat()
+      .filter(({ domain }) => domain === 'sshPtyConsumerRecoveries')
+    expect(ownerWrites).toHaveLength(2)
+    expect(ownerWrites[0]?.payload).toContain('first-owner')
+    expect(ownerWrites[1]?.payload).toContain('next-owner')
+  })
+
+  it('retries a failed consumer removal through durability even after memory is already empty', async () => {
+    const { store, authority, readState } = await fixture()
+    vi.spyOn(console, 'error').mockImplementation(() => {})
+    await store.upsertSshPtyConsumerRecovery(recovery)
+    const gate = authority.pause()
+    const removal = expect(
+      removeSshPtyConsumerOwnerRecovery(recovery.targetId, recovery.clientInstanceId, store)
+    ).rejects.toThrow('disk refused')
+    await gate.started.promise
+    gate.finish.reject(new Error('disk refused'))
+    await removal
+    expect(readState().sshPtyConsumerRecoveries).toHaveLength(1)
+    await removeSshPtyConsumerOwnerRecovery(recovery.targetId, recovery.clientInstanceId, store)
+    expect(readState().sshPtyConsumerRecoveries).toEqual([])
+  })
+
+  it('does not let an old consumer remove the newer owner ahead of it in the write queue', async () => {
+    const { store, authority, readState } = await fixture()
+    await store.upsertSshPtyConsumerRecovery(recovery)
+    const gate = authority.pause()
+    store.updateSettings({ theme: 'dark' })
+    const older = store.flushPendingOrThrowAsync()
+    await gate.started.promise
+    const replacement = store.upsertSshPtyConsumerRecovery({
+      ...recovery,
+      clientInstanceId: 'next-owner'
+    })
+    const removal = removeSshPtyConsumerOwnerRecovery(
+      recovery.targetId,
+      recovery.clientInstanceId,
+      store
+    )
+    gate.finish.resolve()
+    await Promise.all([older, replacement, removal])
+    expect(readState().sshPtyConsumerRecoveries[0]?.clientInstanceId).toBe('next-owner')
+  })
+
+  it('does not detach a newer replacement lease while waiting for the writer', async () => {
+    const { store, authority, readState } = await fixture()
+    const lease = { targetId: recovery.targetId, ptyId: 'relay-pty', state: 'attached' as const }
+    store.upsertSshRemotePtyLease(lease)
+    await store.flushPendingOrThrowAsync()
+    const gate = authority.pause()
+    store.updateSettings({ theme: 'dark' })
+    const older = store.flushPendingOrThrowAsync()
+    await gate.started.promise
+    const detach = store.markSshRemotePtyLeasesAsync(recovery.targetId, 'detached')
+    expect(store.getSshRemotePtyLeases(recovery.targetId)[0]?.state).toBe('attached')
+    store.upsertSshRemotePtyLease({ ...lease, worktreeId: 'new-worktree' })
+    gate.finish.resolve()
+    await Promise.all([older, detach])
+    expect(readState().sshRemotePtyLeases).toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({
+          ptyId: 'relay-pty',
+          worktreeId: 'new-worktree',
+          state: 'attached'
+        })
+      ])
+    )
+  })
+
+  it('does not acknowledge a failed attachment retry before its lease reaches disk', async () => {
+    const { store, authority, readState } = await fixture()
+    vi.spyOn(console, 'error').mockImplementation(() => {})
+    store.upsertSshRemotePtyLease({
+      targetId: recovery.targetId,
+      ptyId: 'relay-pty',
+      state: 'expired'
+    })
+    await store.flushPendingOrThrowAsync()
+    const gate = authority.pause()
+    const attachment = expect(
+      store.markSshRemotePtyLeasesAttachedAsync(recovery.targetId, ['relay-pty'])
+    ).rejects.toThrow('disk refused')
+    await gate.started.promise
+    gate.finish.reject(new Error('disk refused'))
+    await attachment
+    expect(readState().sshRemotePtyLeases[0].state).toBe('expired')
+    await store.markSshRemotePtyLeasesAttachedAsync(recovery.targetId, ['relay-pty'])
+    expect(readState().sshRemotePtyLeases[0].state).toBe('attached')
+  })
+})
diff --git a/src/main/persistence/loading-store/ssh-lease-durable-mutation.ts b/src/main/persistence/loading-store/ssh-lease-durable-mutation.ts
new file mode 100644
index 000000000000..28f361a12cd3
--- /dev/null
+++ b/src/main/persistence/loading-store/ssh-lease-durable-mutation.ts
@@ -0,0 +1,42 @@
+import type { DurableProfileStateMutation, StoreRuntimeState } from './store-runtime-state'
+import {
+  flushDurableStateOrThrowAsync,
+  type WriteFlushBarrierOperations
+} from './write-flush-barriers'
+
+export type SshLeaseDurableMutationRuntime = Pick<
+  StoreRuntimeState,
+  | 'dirtyProfileStateDomains'
+  | 'profileMaintenancePending'
+  | 'profileStateAuthority'
+  | 'quitFlushStarted'
+  | 'runDurableMutation'
+  | 'writesFrozen'
+>
+
+export async function runSshLeaseDurableMutation<T>(
+  runtime: SshLeaseDurableMutationRuntime,
+  barriers: WriteFlushBarrierOperations,
+  domain: 'sshPtyConsumerRecoveries' | 'sshRemotePtyLeases',
+  mutate: () => DurableProfileStateMutation<T>
+): Promise<T> {
+  const writeMutation = (): DurableProfileStateMutation<T> => {
+    const mutation = mutate()
+    if (mutation.persist !== false) {
+      runtime.dirtyProfileStateDomains?.add(domain)
+    }
+    return mutation
+  }
+  if (runtime.profileStateAuthority?.asynchronous) {
+    return runtime.runDurableMutation(writeMutation)
+  }
+  if (runtime.writesFrozen || runtime.quitFlushStarted || runtime.profileMaintenancePending) {
+    throw new Error('Cannot mutate finalized profile persistence')
+  }
+  // Legacy SSH recovery keeps its existing asynchronous disk barrier on older runtimes.
+  const mutation = writeMutation()
+  if (mutation.persist !== false) {
+    await flushDurableStateOrThrowAsync(barriers)
+  }
+  return mutation.value
+}
diff --git a/src/main/persistence/loading-store/ssh-lease-recovery-operations.ts b/src/main/persistence/loading-store/ssh-lease-recovery-operations.ts
index 7da5144898ea..7188b4efb664 100644
--- a/src/main/persistence/loading-store/ssh-lease-recovery-operations.ts
+++ b/src/main/persistence/loading-store/ssh-lease-recovery-operations.ts
@@ -43,10 +43,14 @@ import type { StoreRuntimeState } from './store-runtime-state'
 import type { WriteFlushBarrierOperations } from './write-flush-barriers'
 import type { TerminalBindingRecoveryOperations } from './terminal-binding-recovery'
 import type { WriteSchedulingOperations } from './write-scheduling'
-import { flushDurableStateOrThrowAsync } from './write-flush-barriers'
 import { scheduleSave } from './write-scheduling'
+import {
+  runSshLeaseDurableMutation,
+  type SshLeaseDurableMutationRuntime
+} from './ssh-lease-durable-mutation'
 
-type SshLeaseRecoveryOperationsRuntime = Pick<StoreRuntimeState, 'protectedSecrets' | 'state'>
+type SshLeaseRecoveryOperationsRuntime = SshLeaseDurableMutationRuntime &
+  Pick<StoreRuntimeState, 'protectedSecrets' | 'state'>
 
 const sshLeaseRecoveryOperationsContext = Symbol('SshLeaseRecoveryOperations')
 type SshLeaseRecoveryOperationsContext = {
@@ -81,8 +85,15 @@ export class SshLeaseRecoveryOperations {
     await upsertSshPtyConsumerRecoveryOperation(getSshPtyConsumerRecoveryOperations(this), record)
   }
 
-  async removeSshPtyConsumerRecovery(targetId: string): Promise<void> {
-    await removeSshPtyConsumerRecoveryOperation(getSshPtyConsumerRecoveryOperations(this), targetId)
+  async removeSshPtyConsumerRecovery(
+    targetId: string,
+    expectedClientInstanceId?: string
+  ): Promise<void> {
+    await removeSshPtyConsumerRecoveryOperation(
+      getSshPtyConsumerRecoveryOperations(this),
+      targetId,
+      expectedClientInstanceId
+    )
   }
 
   getSshRemotePtyLeases(targetId?: string): SshRemotePtyLease[] {
@@ -127,6 +138,9 @@ export class SshLeaseRecoveryOperations {
 
   markSshRemotePtyLeasesForShutdown(targetId: string, state: SshRemotePtyLease['state']): void {
     markSshRemotePtyLeasesForShutdownOperation(getSshPtyLeaseOperations(this), targetId, state)
+    this[sshLeaseRecoveryOperationsContext].runtime.dirtyProfileStateDomains?.add(
+      'sshRemotePtyLeases'
+    )
   }
 
   async markSshRemotePtyLeasesAsync(
@@ -195,8 +209,13 @@ export function getSshPtyConsumerRecoveryOperations(
   return {
     state: owner[sshLeaseRecoveryOperationsContext].runtime.state,
     protectedSecrets: owner[sshLeaseRecoveryOperationsContext].runtime.protectedSecrets,
-    flushDurableStateOrThrowAsync: () =>
-      flushDurableStateOrThrowAsync(owner[sshLeaseRecoveryOperationsContext].flushBarriers)
+    runDurableMutation: (mutate) =>
+      runSshLeaseDurableMutation(
+        owner[sshLeaseRecoveryOperationsContext].runtime,
+        owner[sshLeaseRecoveryOperationsContext].flushBarriers,
+        'sshPtyConsumerRecoveries',
+        mutate
+      )
   }
 }
 
@@ -238,9 +257,19 @@ export function getSshPtyLeaseOperations(owner: SshLeaseRecoveryOperations): Ssh
         targetId,
         leases
       ),
-    flush: () => owner[sshLeaseRecoveryOperationsContext].flushBarriers.flush(),
-    flushDurableStateOrThrowAsync: () =>
-      flushDurableStateOrThrowAsync(owner[sshLeaseRecoveryOperationsContext].flushBarriers)
+    flush: () => {
+      owner[sshLeaseRecoveryOperationsContext].runtime.dirtyProfileStateDomains?.add(
+        'sshRemotePtyLeases'
+      )
+      owner[sshLeaseRecoveryOperationsContext].flushBarriers.flush()
+    },
+    runDurableMutation: (mutate) =>
+      runSshLeaseDurableMutation(
+        owner[sshLeaseRecoveryOperationsContext].runtime,
+        owner[sshLeaseRecoveryOperationsContext].flushBarriers,
+        'sshRemotePtyLeases',
+        mutate
+      )
   }
 }
 
diff --git a/src/main/persistence/loading-store/ssh-profile-operations.ts b/src/main/persistence/loading-store/ssh-profile-operations.ts
index d21ab5f04dae..ce81cea373b8 100644
--- a/src/main/persistence/loading-store/ssh-profile-operations.ts
+++ b/src/main/persistence/loading-store/ssh-profile-operations.ts
@@ -32,7 +32,10 @@ import { syncProjectHostSetupCompatibilityState } from './repo-lifecycle-operati
 import { scheduleSave } from './write-scheduling'
 import { forgetSshConnectionGeneration } from '../../ssh/ssh-connection-generation'
 
-type SshProfileOperationsRuntime = Pick<StoreRuntimeState, 'protectedSecrets' | 'state'>
+type SshProfileOperationsRuntime = Pick<
+  StoreRuntimeState,
+  'dirtyProfileStateDomains' | 'protectedSecrets' | 'state'
+>
 
 const sshProfileOperationsContext = Symbol('SshProfileOperations')
 type SshProfileOperationsContext = {
@@ -146,7 +149,12 @@ export function getSshTargetStateOperations(owner: SshProfileOperations): SshTar
     state: owner[sshProfileOperationsContext].runtime.state,
     protectedSecrets: owner[sshProfileOperationsContext].runtime.protectedSecrets,
     scheduleSave: () => scheduleSave(owner[sshProfileOperationsContext].scheduling),
-    flush: () => owner[sshProfileOperationsContext].flushBarriers.flush()
+    flush: () => {
+      owner[sshProfileOperationsContext].runtime.dirtyProfileStateDomains?.add(
+        'claudeLivePtySessionIds'
+      )
+      owner[sshProfileOperationsContext].flushBarriers.flush()
+    }
   }
 }
 
diff --git a/src/main/persistence/loading-store/state-serialization-secret-handling.ts b/src/main/persistence/loading-store/state-serialization-secret-handling.ts
index 026afd12c01c..40d40818343c 100644
--- a/src/main/persistence/loading-store/state-serialization-secret-handling.ts
+++ b/src/main/persistence/loading-store/state-serialization-secret-handling.ts
@@ -1,3 +1,8 @@
+import {
+  serializeCompleteProfileStateDomains,
+  serializeSelectiveProfileStateDomains
+} from './profile-state-authority-writes'
+import type { ProfileStateDomainReplacement } from './profile-state-authority'
 import { randomUUID } from 'node:crypto'
 import type { PersistedState } from '../../../shared/persisted-state-types'
 import { collectFolderWorkspaceDiffComments } from '../../folder-workspace-diff-comments'
@@ -30,7 +35,92 @@ export class StateSerializationSecretHandlingOperations {
     return durable
   }
 
-  buildStateToSave(): {
+  /** Serialize domains with complete secret handling; unknown domains fall back to a full write. */
+  buildStateDomainsToSave(domains: ReadonlySet<string>):
+    | {
+        replacements: ProfileStateDomainReplacement[]
+        protectedSecretUpdates: ProtectedSecretRetentionUpdate[]
+      }
+    | undefined {
+    // A later save must retry secrets deferred by any domain, until a durable commit succeeds.
+    if (this.runtime.protectedSecrets.hasPendingEncryption()) {
+      return undefined
+    }
+    const stateToSave: Record<string, unknown> = {}
+    const protectedSecretUpdates: ProtectedSecretRetentionUpdate[] = []
+    const encrypt = (slot: string, plaintext: string): string => {
+      const encrypted = this.runtime.protectedSecrets.encrypt(slot, plaintext)
+      if (encrypted.retentionUpdate) {
+        protectedSecretUpdates.push(encrypted.retentionUpdate)
+      }
+      return encrypted.blob
+    }
+    for (const domain of domains) {
+      switch (domain) {
+        case 'settings':
+          stateToSave[domain] = this.buildSettingsToSave(encrypt)
+          break
+        case 'workspaceSession':
+          stateToSave[domain] = this.runtime.state.workspaceSession
+          break
+        case 'automations':
+        case 'automationRuns':
+          stateToSave[domain] = this.runtime.state[domain]
+          break
+        case 'featureInteractionTelemetryBuckets':
+          stateToSave[domain] = this.runtime.state.featureInteractionTelemetryBuckets
+          break
+        case 'ui':
+          stateToSave[domain] = {
+            ...this.runtime.state.ui,
+            browserKagiSessionLink:
+              encrypt(
+                PROTECTED_SECRET_SLOT.browserKagiSessionLink,
+                this.runtime.state.ui.browserKagiSessionLink ?? ''
+              ) || null
+          }
+          break
+        case 'worktreeMeta':
+          stateToSave[domain] = omitDefaultWorktreeMetaFieldsInMap(this.runtime.state.worktreeMeta)
+          break
+        case 'worktreeMetaByIdentity':
+          if (this.runtime.state.worktreeMetaByIdentity !== undefined) {
+            stateToSave[domain] = omitDefaultWorktreeMetaFieldsInMap(
+              projectWorktreeMetaByIdentityOntoLocators(
+                this.runtime.state.worktreeMetaByIdentity,
+                this.runtime.state
+              )
+            )
+          }
+          break
+        case 'worktreeIdentityAliases':
+          if (this.runtime.state.worktreeIdentityAliases !== undefined) {
+            stateToSave[domain] = this.runtime.state.worktreeIdentityAliases
+          }
+          break
+        case 'workspaceSessionsByHostId':
+          if (this.runtime.state.workspaceSessionsByHostId !== undefined) {
+            stateToSave[domain] = withoutRedundantPartitionGlobals(
+              this.runtime.state.workspaceSessionsByHostId,
+              this.runtime.state.workspaceSession
+            )
+          }
+          break
+        case 'sshRemotePtyLeases':
+          stateToSave[domain] = this.runtime.state.sshRemotePtyLeases
+          break
+        default:
+          return undefined
+      }
+    }
+    return {
+      replacements: serializeSelectiveProfileStateDomains(stateToSave, domains),
+      protectedSecretUpdates
+    }
+  }
+
+  buildStateToSave(serializeDomains = false): {
+    domains?: readonly ProfileStateDomainReplacement[]
     payload: Buffer
     stateHash: string
     protectedSecretUpdates: ProtectedSecretRetentionUpdate[]
@@ -122,21 +212,7 @@ export class StateSerializationSecretHandlingOperations {
           )
         })
       ),
-      settings: {
-        ...stripRetiredGlobalSettings(this.runtime.state.settings),
-        opencodeSessionCookie: encryptToSentinel(
-          PROTECTED_SECRET_SLOT.opencodeSessionCookie,
-          this.runtime.state.settings.opencodeSessionCookie
-        ),
-        opencodeGoApiKey: encryptToSentinel(
-          PROTECTED_SECRET_SLOT.opencodeGoApiKey,
-          this.runtime.state.settings.opencodeGoApiKey ?? ''
-        ),
-        httpProxyUrl: encryptToSentinel(
-          PROTECTED_SECRET_SLOT.httpProxyUrl,
-          this.runtime.state.settings.httpProxyUrl ?? ''
-        )
-      },
+      settings: this.buildSettingsToSave(encryptToSentinel),
       ui: {
         ...this.runtime.state.ui,
         browserKagiSessionLink: encryptOptionalToSentinel(
@@ -145,6 +221,24 @@ export class StateSerializationSecretHandlingOperations {
         )
       }
     }
+    if (
+      serializeDomains &&
+      !('toJSON' in stateToSave && typeof stateToSave.toJSON === 'function')
+    ) {
+      const serialized = serializeCompleteProfileStateDomains(
+        stateToSave,
+        secretSubs,
+        protectedStorageDegraded ? 'safeStorage-degraded\0' : ''
+      )
+      return {
+        domains: serialized.domains,
+        stateHash: serialized.stateHash,
+        get payload() {
+          return serialized.payload
+        },
+        protectedSecretUpdates
+      }
+    }
     // Why compact: ~20% fewer bytes and less serialize time; all readers JSON.parse so formatting is irrelevant.
     // One full-state stringify; secret slots currently hold sentinels.
     const serialized = JSON.stringify(stateToSave)
@@ -158,4 +252,22 @@ export class StateSerializationSecretHandlingOperations {
     )
     return { payload, stateHash, protectedSecretUpdates }
   }
+
+  private buildSettingsToSave(encrypt: (slot: string, plaintext: string) => string) {
+    return {
+      ...stripRetiredGlobalSettings(this.runtime.state.settings),
+      opencodeSessionCookie: encrypt(
+        PROTECTED_SECRET_SLOT.opencodeSessionCookie,
+        this.runtime.state.settings.opencodeSessionCookie
+      ),
+      opencodeGoApiKey: encrypt(
+        PROTECTED_SECRET_SLOT.opencodeGoApiKey,
+        this.runtime.state.settings.opencodeGoApiKey ?? ''
+      ),
+      httpProxyUrl: encrypt(
+        PROTECTED_SECRET_SLOT.httpProxyUrl,
+        this.runtime.state.settings.httpProxyUrl ?? ''
+      )
+    }
+  }
 }
diff --git a/src/main/persistence/loading-store/state-write-round-trip.test.ts b/src/main/persistence/loading-store/state-write-round-trip.test.ts
index ee7f26feb3e7..1d543fb5b5fb 100644
--- a/src/main/persistence/loading-store/state-write-round-trip.test.ts
+++ b/src/main/persistence/loading-store/state-write-round-trip.test.ts
@@ -1,3 +1,8 @@
+import {
+  closeTestStores,
+  createSqliteTestStore,
+  readPersistedStateJson
+} from '../../persistence-test-harness'
 /**
  * The write path now hands the file a Buffer it built in one pass instead of a string it rebuilt
  * per secret. Drives the real `Store` end to end — encrypted settings, a local session and a remote
@@ -5,7 +10,7 @@
  * against (a mis-sliced segment, a re-encoded payload, a dropped sentinel) is invisible until
  * something reads the bytes back.
  */
-import { mkdtempSync, readFileSync, realpathSync } from 'node:fs'
+import { mkdtempSync, realpathSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, describe, expect, it, vi } from 'vitest'
@@ -35,15 +40,16 @@ const { Store } = await import('./store')
 const HOST_ID = 'ssh:user@host'
 
 const stores: InstanceType<typeof Store>[] = []
-afterEach(() => {
+afterEach(async () => {
   for (const store of stores.splice(0)) {
-    store.flush()
+    store.freezeWrites()
   }
+  await closeTestStores()
   vi.restoreAllMocks()
 })
 
 function openStore(dataFile: string): InstanceType<typeof Store> {
-  const store = new Store({ dataFile })
+  const store = createSqliteTestStore(Store, { dataFile })
   stores.push(store)
   return store
 }
@@ -95,7 +101,7 @@ describe('persisted state survives a save/load round trip', () => {
     }
 
     // The file is valid UTF-8 JSON and holds ciphertext, not the plaintext secrets.
-    const bytes = readFileSync(dataFile)
+    const bytes = Buffer.from(readPersistedStateJson(dataFile))
     const onDisk = JSON.parse(bytes.toString('utf8'))
     expect(onDisk.settings.opencodeSessionCookie).not.toBe('cookie-é-value')
     expect(Buffer.from(onDisk.settings.opencodeSessionCookie, 'base64').toString('utf8')).toContain(
@@ -118,7 +124,7 @@ describe('persisted state survives a save/load round trip', () => {
     // Deep equality of the whole reloaded state, taken across a second round trip so the assertion
     // is not comparing against the first load's one-time settings migrations.
     reloaded.flush()
-    const bytesAfterReload = readFileSync(dataFile)
+    const bytesAfterReload = Buffer.from(readPersistedStateJson(dataFile))
     const again = openStore(dataFile)
     expect(again.getSettings()).toEqual(reloaded.getSettings())
     expect(again.getUI()).toEqual(reloaded.getUI())
@@ -126,6 +132,6 @@ describe('persisted state survives a save/load round trip', () => {
     expect(again.getWorkspaceSession(HOST_ID)).toEqual(reloaded.getWorkspaceSession(HOST_ID))
     // ...and the bytes are stable, so a quiet app is not rewriting a 4 MB file with new content.
     again.flush()
-    expect(readFileSync(dataFile).equals(bytesAfterReload)).toBe(true)
+    expect(Buffer.from(readPersistedStateJson(dataFile)).equals(bytesAfterReload)).toBe(true)
   })
 })
diff --git a/src/main/persistence/loading-store/store-domain-composition.ts b/src/main/persistence/loading-store/store-domain-composition.ts
index c3f2059efe1c..70f22e90c5c7 100644
--- a/src/main/persistence/loading-store/store-domain-composition.ts
+++ b/src/main/persistence/loading-store/store-domain-composition.ts
@@ -1,7 +1,6 @@
 import type { StoreRuntimeState } from './store-runtime-state'
 import type { Store } from './store'
 import { LoadedStateAdaptationOperations } from './loaded-state-adaptation'
-import { BackupRecoveryRotationOperations } from './backup-recovery-rotation'
 import { LoadedCohortMigrationOperations } from './loaded-cohort-migrations'
 import { LoadedStateParsingOperations } from './loaded-state-parsing'
 import { StateSerializationSecretHandlingOperations } from './state-serialization-secret-handling'
@@ -65,9 +64,25 @@ import {
   installSshLeaseRecoveryOperationsContext
 } from './ssh-lease-recovery-operations'
 
+export type StoreDomainOperations = WriteSchedulingOperations &
+  PrimaryStateWriteOperations &
+  ProjectCollectionOperations &
+  RepoLifecycleOperations &
+  MobileTabSelectionPersistence &
+  SparsePresetPersistence &
+  AutomationPersistence &
+  MetadataLineageOperations &
+  ProfilePreferences &
+  SessionHostPartitionOperations &
+  SessionSnapshotOperations &
+  PtyBindingPersistenceOperations &
+  SshProfileOperations &
+  RetiredWorktreeNamePersistence &
+  SshLeaseRecoveryOperations &
+  WriteFlushBarrierOperations
+
 export type StoreDomains = {
   adaptation: LoadedStateAdaptationOperations
-  backups: BackupRecoveryRotationOperations
   cohorts: LoadedCohortMigrationOperations
   loader: LoadedStateParsingOperations
   serialization: StateSerializationSecretHandlingOperations
@@ -130,11 +145,10 @@ export function installStoreDomainContexts(target: Store, domains: StoreDomains)
 
 export function createStoreDomains(runtime: StoreRuntimeState): StoreDomains {
   const adaptation = new LoadedStateAdaptationOperations(runtime)
-  const backups = new BackupRecoveryRotationOperations(runtime)
   const cohorts = new LoadedCohortMigrationOperations(runtime)
-  const loader = new LoadedStateParsingOperations(runtime, backups, cohorts)
+  const loader = new LoadedStateParsingOperations(runtime, cohorts)
   const serialization = new StateSerializationSecretHandlingOperations(runtime)
-  const writes = new PrimaryStateWriteOperations(runtime, serialization, backups)
+  const writes = new PrimaryStateWriteOperations(runtime, serialization)
   const scheduling = new WriteSchedulingOperations(runtime, writes)
   const flushBarriers = new WriteFlushBarrierOperations(runtime, writes)
   const preferences = new ProfilePreferences(runtime, scheduling)
@@ -163,7 +177,6 @@ export function createStoreDomains(runtime: StoreRuntimeState): StoreDomains {
   )
   return {
     adaptation,
-    backups,
     cohorts,
     loader,
     serialization,
diff --git a/src/main/persistence/loading-store/store-prune-gate-signals.test.ts b/src/main/persistence/loading-store/store-prune-gate-signals.test.ts
index 9c9aa2eb176a..ca459ec39822 100644
--- a/src/main/persistence/loading-store/store-prune-gate-signals.test.ts
+++ b/src/main/persistence/loading-store/store-prune-gate-signals.test.ts
@@ -1,3 +1,4 @@
+import { closeTestStores, createSqliteTestStore } from '../../persistence-test-harness'
 /**
  * Drives the real `Store`, because the value of the prune gate is entirely in whether the shipping
  * write paths signal it. A mutation that unwires the call site survives any test that pokes the gate
@@ -43,17 +44,18 @@ beforeEach(() => {
   __resetLocalWorktreeMetadataPruneGateForTests()
 })
 
-afterEach(() => {
+afterEach(async () => {
   // Leaving a debounced save armed would write into a temp dir after the test file finishes.
   for (const store of stores.splice(0)) {
-    store.flush()
+    store.freezeWrites()
   }
+  await closeTestStores()
   vi.restoreAllMocks()
 })
 
 function createStore(): InstanceType<typeof Store> {
   const dir = realpathSync(mkdtempSync(join(tmpdir(), 'orca-store-prune-gate-')))
-  const store = new Store({ dataFile: join(dir, 'orca-data.json') })
+  const store = createSqliteTestStore(Store, { dataFile: join(dir, 'orca-data.json') })
   stores.push(store)
   return store
 }
diff --git a/src/main/persistence/loading-store/store-runtime-authored-session-writes.test.ts b/src/main/persistence/loading-store/store-runtime-authored-session-writes.test.ts
index 9bb2af980bfa..8007bfb7ece3 100644
--- a/src/main/persistence/loading-store/store-runtime-authored-session-writes.test.ts
+++ b/src/main/persistence/loading-store/store-runtime-authored-session-writes.test.ts
@@ -1,3 +1,4 @@
+import { closeTestStores, createSqliteTestStore } from '../../persistence-test-harness'
 /**
  * Drives the real `Store`, not the helper and not a fake.
  *
@@ -38,17 +39,18 @@ const WT = 'repo-1::/tmp/worktree-a'
 
 const stores: InstanceType<typeof Store>[] = []
 
-afterEach(() => {
+afterEach(async () => {
   // Leaving a debounced save armed would write into a temp dir after the test file finishes.
   for (const store of stores.splice(0)) {
-    store.flush()
+    store.freezeWrites()
   }
+  await closeTestStores()
   vi.restoreAllMocks()
 })
 
 function createStore(): InstanceType<typeof Store> {
   const dir = realpathSync(mkdtempSync(join(tmpdir(), 'orca-store-runtime-authored-')))
-  const store = new Store({ dataFile: join(dir, 'orca-data.json') })
+  const store = createSqliteTestStore(Store, { dataFile: join(dir, 'orca-data.json') })
   stores.push(store)
   return store
 }
diff --git a/src/main/persistence/loading-store/store-runtime-state.ts b/src/main/persistence/loading-store/store-runtime-state.ts
index b14ea8ce3a41..b29f49f95f90 100644
--- a/src/main/persistence/loading-store/store-runtime-state.ts
+++ b/src/main/persistence/loading-store/store-runtime-state.ts
@@ -19,10 +19,20 @@ import type {
   AutomationListProjectionCache,
   AutomationStorageAuthority
 } from '../scheduling-automations/automation-owner-projection'
+import type { ProfileStatePersistenceAuthority } from './profile-state-authority'
+import type { AutomationRun } from '../../../shared/automations-types'
+
+export type DurableProfileStateMutation<T> = {
+  value: T
+  /** 'if-dirty' fences an existing change without rewriting an already durable generation. */
+  persist?: boolean | 'if-dirty'
+  rollback?: () => void
+}
 
 export type StoreRuntimeOptions = {
   dataFile?: string
   storageAuthority?: AutomationStorageAuthority
+  profileStateAuthority?: ProfileStatePersistenceAuthority
 }
 
 /** Mutable coordination state shared only with this Store's private collaborators. */
@@ -30,30 +40,39 @@ export class StoreRuntimeState {
   state!: PersistedState
   readonly dataFile: string
   readonly storageAuthority: AutomationStorageAuthority
+  readonly profileStateAuthority: ProfileStatePersistenceAuthority | undefined
   automationListProjectionCache: AutomationListProjectionCache | null = null
   activeViewPreference!: ActiveViewPreference
   readonly terminalScrollbackSnapshotStorage: TerminalScrollbackSnapshotStorage
   writeTimer: ReturnType<typeof setTimeout> | null = null
   pendingWrite: Promise<void> | null = null
   pendingSnapshotFileWork: Promise<void> | null = null
-  readonly staleTempCleanup: Promise<void>
   writeGeneration = 0
-  inFlightAsyncTmpFile: string | null = null
-  backupRotationInFlight = false
   writesFrozen = false
+  fatalMutationError: Error | null = null
+  durableMutationPhase: 'mutate' | 'rollback' | null = null
+  profileMaintenancePending = false
+  pendingProfileMaintenance: Promise<void> | null = null
+  readonly pendingProfileFlushes = new Set<Promise<void>>()
   quitFlushStarted = false
   quitFlushPromise: Promise<void> | null = null
   lastWrittenStateHash: string | null = null
   lastDurableWriteGeneration = -1
   firstPendingSaveAt: number | null = null
+  /** Known dirty domains, or null when a caller requires a complete-document fallback. */
+  dirtyProfileStateDomains: Set<string> | null = new Set()
+  pendingAutomationRunsAfter: readonly AutomationRun[] | undefined
   githubCacheDirty = false
   githubCacheGeneration = 0
   pendingGithubCacheWrite: Promise<void> | null = null
   readonly staleGithubCacheTempCleanup: Promise<void>
+  /** Reclaim compatibility-export temps left by a process killed during rename. */
+  readonly staleProfileStateTempCleanup: Promise<void>
   readonly gitUsernameCache = new Map<string, string>()
   readonly protectedSecrets = new ProtectedSecretPersistence()
   loadNeedsSave = false
   flushOrThrow!: () => void
+  runDurableMutation!: <T>(mutate: () => DurableProfileStateMutation<T>) => Promise<T>
   settingsChangeListeners = new Set<
     (
       updates: Partial<GlobalSettings>,
@@ -72,9 +91,12 @@ export class StoreRuntimeState {
   constructor(options: StoreRuntimeOptions = {}) {
     this.dataFile = options.dataFile ?? getDataFile()
     this.storageAuthority = options.storageAuthority ?? 'desktop'
-    this.staleTempCleanup = removeStaleDurableWriteTempFiles(this.dataFile, {
-      minimumAgeMs: STALE_DURABLE_WRITE_TEMP_AGE_MS
-    })
+    this.profileStateAuthority = options.profileStateAuthority
+    this.staleProfileStateTempCleanup = this.profileStateAuthority
+      ? removeStaleDurableWriteTempFiles(this.dataFile, {
+          minimumAgeMs: STALE_DURABLE_WRITE_TEMP_AGE_MS
+        })
+      : Promise.resolve()
     this.staleGithubCacheTempCleanup = removeStaleDurableWriteTempFiles(
       getGithubCacheFile(this.dataFile),
       { minimumAgeMs: STALE_DURABLE_WRITE_TEMP_AGE_MS }
diff --git a/src/main/persistence/loading-store/store.ts b/src/main/persistence/loading-store/store.ts
index 017583e8f863..d60f1a7e3e1e 100644
--- a/src/main/persistence/loading-store/store.ts
+++ b/src/main/persistence/loading-store/store.ts
@@ -12,28 +12,40 @@ import {
   createStoreDomains,
   installStoreDomainContexts,
   STORE_DOMAIN_OPERATION_CLASSES,
-  type StoreDomains
+  type StoreDomains,
+  type StoreDomainOperations
 } from './store-domain-composition'
 import type { PersistedState } from '../../../shared/persisted-state-types'
 import { scheduleSave } from './write-scheduling'
-import type { WriteSchedulingOperations } from './write-scheduling'
-import type { PrimaryStateWriteOperations } from './primary-state-writes'
-import type { ProjectCollectionOperations } from './project-collection-operations'
-import type { RepoLifecycleOperations } from './repo-lifecycle-operations'
-import type { MobileTabSelectionPersistence } from './mobile-tab-selection-persistence'
-import type { SparsePresetPersistence } from './sparse-preset-persistence'
-import type { AutomationPersistence } from './automation-persistence'
-import type { MetadataLineageOperations } from './metadata-lineage-operations'
-import type { ProfilePreferences } from './profile-preferences'
-import type { SessionHostPartitionOperations } from './session-host-partitions'
-import type { SessionSnapshotOperations } from './session-snapshot-operations'
-import type { PtyBindingPersistenceOperations } from './pty-binding-persistence'
-import type { SshProfileOperations } from './ssh-profile-operations'
-import type { RetiredWorktreeNamePersistence } from './retired-worktree-name-persistence'
-import type { SshLeaseRecoveryOperations } from './ssh-lease-recovery-operations'
-import type { WriteFlushBarrierOperations } from './write-flush-barriers'
-
-export type StoreOptions = StoreRuntimeOptions
+import { enqueuePrimaryStateOperation, writeToDiskAsync } from './primary-state-writes'
+import type { ProfileStateDatabaseQuarantine } from '../profile-state/profile-state-database-quarantine'
+import { writeVersionedProfileStateExport } from '../profile-state/legacy-json/profile-state-versioned-export'
+import {
+  beginProfileStateMaintenance,
+  freezeProfileStateWrites,
+  freezeProfileStateWritesAsync,
+  type ProfileStateMaintenanceOptions
+} from './profile-state-maintenance'
+import type {
+  AsyncProfileStateAuthority,
+  ProfileStateAuthorityInitialState,
+  ProfileStateStartupPaneAlias,
+  ProfileStatePersistenceAuthority,
+  ProfileStateMaintenance
+} from './profile-state-authority'
+
+export type StoreOptions = StoreRuntimeOptions & {
+  /** Storage-form JSON supplied by a read-only profile migration/import boundary. */
+  serializedState?: string
+  collectUnboundPaneAlias?: (entry: ProfileStateStartupPaneAlias) => void
+  /** Reuse the authority's validated startup read without retaining a cached copy. */
+  initialAuthorityState?: ProfileStateAuthorityInitialState<ProfileStatePersistenceAuthority>
+}
+
+export type PreparedProfileStateExport = {
+  readonly json: string
+  commit(): void
+}
 export type PtyBindingSourceExpectation = {
   worktreeId?: string
   tabId: string
@@ -50,12 +62,49 @@ export class Store {
   private readonly state: PersistedState
 
   constructor(options: StoreOptions = {}) {
+    if (options.profileStateAuthority !== undefined && options.serializedState !== undefined) {
+      throw new Error('Store cannot use both a profile-state authority and serialized state')
+    }
+    if (
+      options.initialAuthorityState !== undefined &&
+      (options.profileStateAuthority === undefined ||
+        options.initialAuthorityState.authority !== options.profileStateAuthority)
+    ) {
+      throw new Error('Store initial authority state must belong to its profile-state authority')
+    }
+    if (options.profileStateAuthority === undefined && options.serializedState === undefined) {
+      throw new Error('Writable Store construction requires a SQLite profile-state authority')
+    }
+    const initial = options.initialAuthorityState
+    const parsedState = initial?.takeParsedState?.()
+    const imported = options.serializedState !== undefined
     this.runtime = new StoreRuntimeState(options)
+    this.runtime.writesFrozen = imported
     this.domains = createStoreDomains(this.runtime)
     installStoreDomainContexts(this, this.domains)
     this.runtime.flushOrThrow = () => this.flushOrThrow()
-    const loaded = this.domains.loader.load()
-    const normalized = normalizePersistedPaneIdentityState(loaded)
+    this.runtime.runDurableMutation = (mutate) => this.runDurableMutation(mutate)
+    let loaded: PersistedState
+    if (options.profileStateAuthority !== undefined) {
+      if (initial !== undefined) {
+        loaded =
+          initial.takeParsedState !== undefined
+            ? this.domains.loader.loadParsedFromAuthority(parsedState)
+            : this.domains.loader.loadFromAuthority(initial.serializedState)
+      } else {
+        loaded = this.domains.loader.loadFromAuthority(
+          options.profileStateAuthority.readSerializedState()
+        )
+      }
+    } else if (options.serializedState !== undefined) {
+      loaded = this.domains.loader.loadSerialized(options.serializedState)
+    } else {
+      throw new Error('Store requires an authority or a frozen serialized import')
+    }
+    const normalized = normalizePersistedPaneIdentityState(loaded, {
+      registerAliases: !imported,
+      collectUnboundPaneAlias: options.collectUnboundPaneAlias
+    })
     this.state = normalized.state
     this.runtime.state = this.state
     this.runtime.activeViewPreference = new ActiveViewPreference(
@@ -67,62 +116,198 @@ export class Store {
     // Load is the only place an orphaned repo id can be swept: every removal path needs the repo to
     // still be registered, so rows outlive their owner without one (#17776).
     const sweptRepoIds = this.domains.repos.sweepDeregisteredRepoResidue()
-    for (const entry of normalized.migrationUnsupportedEntries) {
-      setMigrationUnsupportedPty(entry)
+    // Imported snapshots cannot own the live hook server or write their source file.
+    if (!imported) {
+      for (const entry of initial?.unboundPaneAliases ?? []) {
+        agentHookServer.registerPaneKeyAlias(
+          entry.legacyPaneKey,
+          entry.stablePaneKey,
+          undefined,
+          entry.updatedAt
+        )
+      }
+      for (const entry of normalized.migrationUnsupportedEntries) {
+        setMigrationUnsupportedPty(entry)
+      }
+      for (const entry of normalized.legacyPaneKeyAliasEntries) {
+        registerPersistedPaneKeyAlias(entry)
+      }
+      setMigrationUnsupportedPtyPersistenceListener((entries) => {
+        this.state.migrationUnsupportedPtyEntries = entries
+        scheduleSave(this.domains.scheduling)
+      })
+      agentHookServer.setPaneKeyAliasPersistenceListener((entries) => {
+        this.state.legacyPaneKeyAliasEntries = entries
+        scheduleSave(this.domains.scheduling)
+      })
+      if (
+        normalized.changed ||
+        this.runtime.loadNeedsSave ||
+        adaptedProjectGroups ||
+        sweptRepoIds.length > 0
+      ) {
+        scheduleSave(this.domains.scheduling)
+      }
+    }
+  }
+
+  getProfileStorageDirectory(): string {
+    return dirname(this.runtime.dataFile)
+  }
+
+  /**
+   * Prepare a storage-form export for a database importer.
+   *
+   * Secret retention is committed only after the caller durably accepts the
+   * export. This keeps a failed migration from discarding the prior sealed
+   * value from the in-memory fallback store.
+   */
+  prepareProfileStateExport(): PreparedProfileStateExport {
+    const built = this.domains.serialization.buildStateToSave()
+    let committed = false
+    return {
+      json: built.payload.toString('utf8'),
+      commit: () => {
+        if (committed) {
+          return
+        }
+        this.runtime.protectedSecrets.commitRetentionUpdates(built.protectedSecretUpdates)
+        committed = true
+      }
+    }
+  }
+
+  /** Publish an explicit rollback/compatibility export after flushing current state. */
+  writeProfileStateJsonExport(targetPath: string): number {
+    this.runtime.dirtyProfileStateDomains = null
+    this.flushOrThrow()
+    const authority = this.runtime.profileStateAuthority
+    if (authority?.asynchronous) {
+      throw new Error('Live profile exports require an awaited export')
     }
-    for (const entry of normalized.legacyPaneKeyAliasEntries) {
-      registerPersistedPaneKeyAlias(entry)
+    if (authority?.writeJsonExport) {
+      return authority.writeJsonExport(targetPath)
     }
-    setMigrationUnsupportedPtyPersistenceListener((entries) => {
-      this.state.migrationUnsupportedPtyEntries = entries
-      scheduleSave(this.domains.scheduling)
-    })
-    agentHookServer.setPaneKeyAliasPersistenceListener((entries) => {
-      this.state.legacyPaneKeyAliasEntries = entries
-      scheduleSave(this.domains.scheduling)
-    })
+
+    throw new Error('Profile state exports require a SQLite profile-state authority')
+  }
+
+  /** Publish the latest SQLite revision as a durable, versioned rollback export. */
+  writeLatestProfileStateJsonExport(): number | undefined {
+    const authority = this.runtime.profileStateAuthority
+    if (authority?.asynchronous) {
+      throw new Error('Live profile exports require an awaited export')
+    }
+    if (!authority?.writeJsonExport) {
+      return undefined
+    }
+    this.runtime.dirtyProfileStateDomains = null
+    this.flushOrThrow()
+
+    const writeExport = authority.writeJsonExport.bind(authority)
+    return writeVersionedProfileStateExport(this.runtime.dataFile, writeExport)
+  }
+
+  /** Publish recovery and canonical JSON checkpoints for older builds. */
+  writeLatestProfileStateJsonCompatibilityExport(): number | undefined {
+    const authority = this.runtime.profileStateAuthority
+    if (authority?.asynchronous) {
+      throw new Error('Live profile exports require an awaited export')
+    }
+    if (!authority?.writeJsonCompatibilityExport) {
+      return undefined
+    }
+    this.runtime.dirtyProfileStateDomains = null
+    this.flushOrThrow()
+    return authority.writeJsonCompatibilityExport(this.runtime.dataFile)
+  }
+
+  writeLatestProfileStateJsonExportAsync(): Promise<number | undefined> {
+    if (!this.runtime.profileStateAuthority?.asynchronous) {
+      return Promise.resolve(this.writeLatestProfileStateJsonExport())
+    }
+    return this.enqueueProfileExport((authority) =>
+      authority.writeLatestJsonExport(this.runtime.dataFile)
+    )
+  }
+
+  writeLatestProfileStateJsonCompatibilityExportAsync(): Promise<number | undefined> {
+    if (!this.runtime.profileStateAuthority?.asynchronous) {
+      return Promise.resolve(this.writeLatestProfileStateJsonCompatibilityExport())
+    }
+    return this.enqueueProfileExport((authority) =>
+      authority.writeJsonCompatibilityExport(this.runtime.dataFile)
+    )
+  }
+
+  private enqueueProfileExport(
+    exportState: (authority: AsyncProfileStateAuthority) => Promise<number | undefined>
+  ): Promise<number | undefined> {
     if (
-      normalized.changed ||
-      this.runtime.loadNeedsSave ||
-      adaptedProjectGroups ||
-      sweptRepoIds.length > 0
+      this.runtime.writesFrozen ||
+      this.runtime.quitFlushStarted ||
+      this.runtime.profileMaintenancePending
     ) {
-      scheduleSave(this.domains.scheduling)
+      return Promise.reject(new Error('Cannot export finalized profile persistence'))
     }
+    const authority = this.runtime.profileStateAuthority
+    if (!authority?.asynchronous) {
+      return Promise.resolve(undefined)
+    }
+    return enqueuePrimaryStateOperation(this.domains.writes, async () => {
+      this.runtime.dirtyProfileStateDomains = null
+      if (!(await writeToDiskAsync(this.domains.writes))) {
+        throw new Error('Profile state changed while preparing its export')
+      }
+      return exportState(authority)
+    })
   }
 
-  getProfileStorageDirectory(): string {
-    return dirname(this.runtime.dataFile)
+  /** Freeze writes, then preserve the SQLite family for an explicit recovery decision. */
+  quarantineProfileStateDatabase(
+    quarantineRoot?: string,
+    reason?: string
+  ): ProfileStateDatabaseQuarantine {
+    this.freezeWrites()
+    const authority = this.runtime.profileStateAuthority
+    if (authority?.asynchronous) {
+      throw new Error('Live profile quarantine requires an awaited close')
+    }
+    if (!authority?.quarantineDatabase) {
+      throw new Error('SQLite profile-state quarantine is unavailable')
+    }
+    return authority.quarantineDatabase(quarantineRoot, reason)
   }
 
   freezeWrites(): void {
-    this.runtime.writesFrozen = true
-    if (this.runtime.writeTimer) {
-      clearTimeout(this.runtime.writeTimer)
-      this.runtime.writeTimer = null
+    freezeProfileStateWrites(this.runtime)
+  }
+
+  beginProfileMaintenance(
+    options?: ProfileStateMaintenanceOptions
+  ): Promise<ProfileStateMaintenance> {
+    return beginProfileStateMaintenance(this.runtime, this.domains, options)
+  }
+
+  freezeWritesAsync(): Promise<void> {
+    return freezeProfileStateWritesAsync(this.runtime)
+  }
+
+  async quarantineProfileStateDatabaseAsync(
+    quarantineRoot?: string,
+    reason?: string
+  ): Promise<ProfileStateDatabaseQuarantine> {
+    await this.beginProfileMaintenance({ flush: false })
+    const authority = this.runtime.profileStateAuthority
+    if (!authority?.quarantineDatabase) {
+      throw new Error('SQLite profile-state quarantine is unavailable')
     }
+    return authority.quarantineDatabase(quarantineRoot, reason)
   }
 }
 
 // oxlint-disable-next-line typescript-eslint/consistent-type-definitions -- declaration merging derives Store's prototype API directly from the exact concrete domain classes installed below
-export interface Store
-  extends
-    WriteSchedulingOperations,
-    PrimaryStateWriteOperations,
-    ProjectCollectionOperations,
-    RepoLifecycleOperations,
-    MobileTabSelectionPersistence,
-    SparsePresetPersistence,
-    AutomationPersistence,
-    MetadataLineageOperations,
-    ProfilePreferences,
-    SessionHostPartitionOperations,
-    SessionSnapshotOperations,
-    PtyBindingPersistenceOperations,
-    SshProfileOperations,
-    RetiredWorktreeNamePersistence,
-    SshLeaseRecoveryOperations,
-    WriteFlushBarrierOperations {}
+export interface Store extends StoreDomainOperations {}
 
 for (const OperationClass of STORE_DOMAIN_OPERATION_CLASSES) {
   const descriptors = Object.getOwnPropertyDescriptors(OperationClass.prototype)
diff --git a/src/main/persistence/loading-store/terminal-close-async-durability.test.ts b/src/main/persistence/loading-store/terminal-close-async-durability.test.ts
new file mode 100644
index 000000000000..4e74eea38ae5
--- /dev/null
+++ b/src/main/persistence/loading-store/terminal-close-async-durability.test.ts
@@ -0,0 +1,212 @@
+import { expect, it, vi } from 'vitest'
+import { fixture } from './profile-state-delayed-authority-fixture'
+import { OrcaRuntimeService } from '../../runtime/orca-runtime'
+import type { RuntimeMobileSessionTabsSnapshot } from '../../../shared/runtime-types'
+
+vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
+vi.mock('../../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: () => ({ nth_repo_added: 2 })
+}))
+vi.mock('../../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: () => ({ hosts: [] }),
+  sshConfigHostsToTargets: () => []
+}))
+
+const binding = {
+  worktreeId: 'repo-local::/fixture/local',
+  tabId: 'aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa',
+  leafId: 'bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb',
+  ptyId: 'closing-pty',
+  incarnationId: 'cccccccc-cccc-4ccc-8ccc-cccccccccccc'
+}
+const siblingLeafId = 'dddddddd-dddd-4ddd-8ddd-dddddddddddd'
+
+class CloseRuntime extends OrcaRuntimeService {
+  async closeHeadlessTab(): Promise<void> {
+    const snapshot = this.mobileSessionTabsByWorktree.get(binding.worktreeId)
+    const tab = snapshot?.tabs[0]
+    if (!snapshot || tab?.type !== 'terminal') {
+      throw new Error('missing test tab')
+    }
+    await this.closeHeadlessMobileTerminalTab(binding.worktreeId, snapshot, tab)
+  }
+  publish(): void {
+    const snapshot: RuntimeMobileSessionTabsSnapshot = {
+      worktree: binding.worktreeId,
+      publicationEpoch: 'close-test',
+      snapshotVersion: 1,
+      activeGroupId: null,
+      activeTabId: `${binding.tabId}::${binding.leafId}`,
+      activeTabType: 'terminal',
+      tabs: [
+        {
+          type: 'terminal',
+          id: `${binding.tabId}::${binding.leafId}`,
+          parentTabId: binding.tabId,
+          leafId: binding.leafId,
+          ptyId: binding.ptyId,
+          title: 'Terminal',
+          isActive: true
+        }
+      ]
+    }
+    this.storeMobileSessionSnapshot(binding.worktreeId, snapshot)
+  }
+}
+
+async function closeFixture(options: { split?: boolean } = {}) {
+  const result = await fixture()
+  await result.store.persistPtyBinding(binding)
+  if (options.split) {
+    await result.store.persistPtyBinding({
+      ...binding,
+      leafId: siblingLeafId,
+      ptyId: 'sibling-pty',
+      incarnationId: 'eeeeeeee-eeee-4eee-8eee-eeeeeeeeeeee',
+      expectedSourceBinding: binding
+    })
+  }
+  const runtime = new CloseRuntime(result.store)
+  const kill = vi.fn(() => true)
+  runtime.setPtyController({ write: () => true, kill, getForegroundProcess: async () => null })
+  return {
+    ...result,
+    runtime,
+    kill,
+    persistedLeafIds: () =>
+      Object.keys(
+        result.readState().workspaceSession.terminalLayoutsByTabId[binding.tabId]?.ptyIdsByLeafId ??
+          {}
+      ),
+    liveLeafIds: () =>
+      Object.keys(
+        result.store.getWorkspaceSession().terminalLayoutsByTabId[binding.tabId]?.ptyIdsByLeafId ??
+          {}
+      )
+  }
+}
+
+it.each([
+  ['tab', { kind: 'tab' as const, tabId: binding.tabId }, []],
+  [
+    'split pane',
+    { kind: 'pane' as const, tabId: binding.tabId, leafId: binding.leafId },
+    [siblingLeafId]
+  ]
+])('acknowledges a renderer %s close only once it is durable', async (kind, target, remaining) => {
+  const { authority, runtime, persistedLeafIds } = await closeFixture({ split: kind !== 'tab' })
+  const before = persistedLeafIds()
+  const gate = authority.pause()
+  let acknowledged = false
+  const closing = runtime.closeTerminalSurfaceFromRenderer(binding.worktreeId, target).then(() => {
+    acknowledged = true
+  })
+  try {
+    await Promise.race([gate.started.promise, closing])
+    expect(acknowledged).toBe(false)
+    expect(persistedLeafIds()).toEqual(before)
+  } finally {
+    gate.finish.resolve()
+  }
+  await closing
+  expect(persistedLeafIds()).toEqual(remaining)
+})
+
+it('keeps a phone close and still kills when its durable write fails', async () => {
+  const { authority, store, runtime, kill, persistedLeafIds, liveLeafIds } = await closeFixture()
+  runtime.registerPty(binding.ptyId, binding.worktreeId, null, binding)
+  runtime.publish()
+  const failure = vi.spyOn(console, 'error').mockImplementation(() => {})
+  const gate = authority.pause()
+  const closing = runtime.closeHeadlessTab()
+  await Promise.race([gate.started.promise, closing])
+  gate.finish.reject(new Error('close disk refused'))
+
+  await expect(closing).resolves.toBeUndefined()
+  expect(kill).toHaveBeenCalledExactlyOnceWith(binding.ptyId)
+  expect(liveLeafIds()).toEqual([])
+  expect(persistedLeafIds()).toEqual([binding.leafId])
+  expect(failure).toHaveBeenCalledWith(
+    '[runtime] failed to persist terminal close:',
+    expect.objectContaining({ message: 'close disk refused' })
+  )
+
+  // Nothing rolled the removal back, so the next write makes it durable.
+  await store.flushPendingOrThrowAsync()
+  expect(persistedLeafIds()).toEqual([])
+})
+
+it('keeps a renderer close when its durable write fails', async () => {
+  const { authority, runtime, persistedLeafIds, liveLeafIds } = await closeFixture()
+  vi.spyOn(console, 'error').mockImplementation(() => {})
+  const gate = authority.pause()
+  const closing = runtime.closeTerminalSurfaceFromRenderer(binding.worktreeId, {
+    kind: 'tab',
+    tabId: binding.tabId
+  })
+  await Promise.race([gate.started.promise, closing])
+  gate.finish.reject(new Error('close disk refused'))
+
+  await expect(closing).resolves.toBeUndefined()
+  expect(liveLeafIds()).toEqual([])
+  expect(persistedLeafIds()).toEqual([binding.leafId])
+})
+
+it('commits nothing for a pane that restarted while its close waited for the writer', async () => {
+  const { authority, store, runtime, liveLeafIds } = await closeFixture({ split: true })
+  const gate = authority.pause()
+  const session = store.getWorkspaceSession()
+  store.setWorkspaceSession({ ...session, activeTabIdByWorktree: { [binding.worktreeId]: null } })
+  const earlierWrite = store.flushPendingOrThrowAsync()
+  await gate.started.promise
+  // The restart is queued first, so it lands after the close captured the pane it meant.
+  const restart = store.persistPtyBinding({
+    ...binding,
+    ptyId: 'restarted-pty',
+    incarnationId: 'ffffffff-ffff-4fff-8fff-ffffffffffff'
+  })
+  const closing = runtime.closeTerminalSurfaceFromRenderer(binding.worktreeId, {
+    kind: 'pane',
+    tabId: binding.tabId,
+    leafId: binding.leafId
+  })
+  gate.finish.resolve()
+  await earlierWrite
+  await expect(restart).resolves.toBe(true)
+  await closing
+
+  expect(liveLeafIds()).toEqual([binding.leafId, siblingLeafId])
+})
+
+it('commits a renderer tab close whose split pane bound while the close waited for the writer', async () => {
+  const { authority, store, runtime, persistedLeafIds, liveLeafIds } = await closeFixture()
+  const gate = authority.pause()
+  const session = store.getWorkspaceSession()
+  store.setWorkspaceSession({ ...session, activeTabIdByWorktree: { [binding.worktreeId]: null } })
+  const earlierWrite = store.flushPendingOrThrowAsync()
+  await gate.started.promise
+  // The split's binding is queued first, so it grows the tab after the close was asked.
+  const split = store.persistPtyBinding({
+    ...binding,
+    leafId: siblingLeafId,
+    ptyId: 'sibling-pty',
+    incarnationId: 'eeeeeeee-eeee-4eee-8eee-eeeeeeeeeeee',
+    expectedSourceBinding: binding
+  })
+  const closing = runtime.closeTerminalSurfaceFromRenderer(binding.worktreeId, {
+    kind: 'tab',
+    tabId: binding.tabId
+  })
+  gate.finish.resolve()
+  await earlierWrite
+  await expect(split).resolves.toBe(true)
+  await expect(closing).resolves.toBeUndefined()
+
+  expect(persistedLeafIds()).toEqual([])
+  expect(liveLeafIds()).toEqual([])
+  expect(
+    store
+      .getWorkspaceSession()
+      .tabsByWorktree[binding.worktreeId]?.some((tab) => tab.id === binding.tabId)
+  ).toBe(false)
+})
diff --git a/src/main/persistence/loading-store/workspace-session-snapshot-publication.ts b/src/main/persistence/loading-store/workspace-session-snapshot-publication.ts
index 5b7f90cbb8fa..96834ffbcf92 100644
--- a/src/main/persistence/loading-store/workspace-session-snapshot-publication.ts
+++ b/src/main/persistence/loading-store/workspace-session-snapshot-publication.ts
@@ -111,7 +111,19 @@ export function setLocalWorkspaceSession(
   if (deferSnapshotFiles) {
     enqueueTerminalScrollbackSnapshotWork(owner, prior, session)
   }
-  scheduleSave(context.scheduling)
+  if (
+    remappedAcknowledgements.changed ||
+    remappedActivityCutoffs.changed ||
+    remappedManualUnread.changed
+  ) {
+    // UI remaps include protected fields, so keep the complete serializer boundary.
+    scheduleSave(context.scheduling)
+  } else {
+    scheduleSave(
+      context.scheduling,
+      remappedLeases.changed ? ['workspaceSession', 'sshRemotePtyLeases'] : ['workspaceSession']
+    )
+  }
 }
 
 export function enqueueTerminalScrollbackSnapshotWork(
diff --git a/src/main/persistence/loading-store/worktree-identity-metadata.ts b/src/main/persistence/loading-store/worktree-identity-metadata.ts
index 21fea4ac15c1..9515986f86a9 100644
--- a/src/main/persistence/loading-store/worktree-identity-metadata.ts
+++ b/src/main/persistence/loading-store/worktree-identity-metadata.ts
@@ -15,6 +15,13 @@ import { mergeWorktreeMetaForWrite } from './worktree-meta-write-normalization'
 
 type MetadataRuntime = Pick<StoreRuntimeState, 'state'>
 
+/** Storage rows changed together by host-qualified metadata writes. */
+export const WORKTREE_METADATA_DOMAINS = [
+  'worktreeMeta',
+  'worktreeMetaByIdentity',
+  'worktreeIdentityAliases'
+] as const
+
 /** Select one readable row without discarding competing alias candidates. */
 function resolveAliasIdentityKey(state: PersistedState, alias: string): string | undefined {
   const identityKeys = state.worktreeIdentityAliases?.[alias] ?? []
@@ -161,7 +168,7 @@ export function getWorktreeMetaForHost(
   const alias = composeWorktreeHostIdentity(executionHostId, worktreeId)
   const identityKey = resolveAliasIdentityKey(state, alias)
   if (changed) {
-    scheduleSave(scheduling)
+    scheduleSave(scheduling, WORKTREE_METADATA_DOMAINS)
   }
   if (identityKey) {
     return state.worktreeMetaByIdentity?.[identityKey]
@@ -238,6 +245,6 @@ export function setWorktreeMetaForHost(
   if (!legacy || legacy.hostId === executionHostId) {
     state.worktreeMeta[worktreeId] = updated
   }
-  scheduleSave(scheduling)
+  scheduleSave(scheduling, WORKTREE_METADATA_DOMAINS)
   return updated
 }
diff --git a/src/main/persistence/loading-store/worktree-meta-alias-projection.test.ts b/src/main/persistence/loading-store/worktree-meta-alias-projection.test.ts
index f324787cdf31..1ec0bb077a36 100644
--- a/src/main/persistence/loading-store/worktree-meta-alias-projection.test.ts
+++ b/src/main/persistence/loading-store/worktree-meta-alias-projection.test.ts
@@ -1,3 +1,8 @@
+import {
+  closeTestStores,
+  createSqliteTestStore,
+  readPersistedStateJson
+} from '../../persistence-test-harness'
 /**
  * `setWorktreeMetaForHost` puts one object in both `worktreeMeta` and `worktreeMetaByIdentity`, so
  * a heavy profile serializes every metadata row twice. On a measured 3.64 MB install 1,347 of
@@ -11,7 +16,7 @@
  * to the same state, the locator map is never reduced (which is what makes a downgrade lossless),
  * and a build with no rebuild at all recovers every row from the file the new build wrote.
  */
-import { mkdtempSync, readFileSync, realpathSync, writeFileSync } from 'node:fs'
+import { mkdtempSync, realpathSync, writeFileSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, describe, expect, it, vi } from 'vitest'
@@ -54,15 +59,16 @@ function seededRandom(seed: number): () => number {
 }
 
 const stores: InstanceType<typeof Store>[] = []
-afterEach(() => {
+afterEach(async () => {
   for (const store of stores.splice(0)) {
     store.freezeWrites()
   }
+  await closeTestStores()
   vi.restoreAllMocks()
 })
 
 function openStore(dataFile: string): InstanceType<typeof Store> {
-  const store = new Store({ dataFile })
+  const store = createSqliteTestStore(Store, { dataFile })
   stores.push(store)
   return store
 }
@@ -229,7 +235,7 @@ describe('worktree meta alias projection', () => {
     const loaded = openStore(dataFile)
     const before = snapshot(loaded)
     loaded.flush()
-    const rewritten = readFileSync(dataFile, 'utf-8')
+    const rewritten = readPersistedStateJson(dataFile)
     const onDisk = JSON.parse(rewritten) as PersistedState
 
     // The counter this change exists for: 401 regenerable identity rows leave the file.
@@ -257,7 +263,7 @@ describe('worktree meta alias projection', () => {
 
     // A quiet app does not rewrite the file with new content on the next flush.
     reloaded.flush()
-    expect(readFileSync(dataFile, 'utf-8')).toBe(rewritten)
+    expect(readPersistedStateJson(dataFile)).toBe(rewritten)
   })
 
   /**
@@ -277,17 +283,19 @@ describe('worktree meta alias projection', () => {
 
     // What a build without this change does with that file: parse it, run the metadata normalizer
     // it already ships (untouched here), write the result back.
-    const downgraded = JSON.parse(readFileSync(dataFile, 'utf-8')) as PersistedState
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The preceding Store save produced the PersistedState snapshot read by this test.
+    const downgraded = JSON.parse(readPersistedStateJson(dataFile)) as PersistedState
     normalizeWorktreeLinkedItemMetadata(downgraded)
     expect(Object.keys(downgraded.worktreeMeta).sort()).toEqual(Object.keys(before.meta).sort())
     // It drops the aliases whose identity row is not there; it never touches a locator row.
     expect(downgraded.worktreeIdentityAliases).not.toHaveProperty(
       composeWorktreeHostIdentity(LOCAL, worktreeId(0))
     )
-    writeFileSync(dataFile, JSON.stringify(downgraded), 'utf-8')
+    const rollbackDataFile = tempDataFile()
+    writeFileSync(rollbackDataFile, JSON.stringify(downgraded), 'utf-8')
 
     // Every reader is where it started, with no rebuild and without touching a row first.
-    const rolledBack = openStore(dataFile)
+    const rolledBack = openStore(rollbackDataFile)
     expect(rolledBack.getAllWorktreeMeta()).toEqual(before.meta)
     expect(rolledBack.getAllWorktreeMetaForHost(LOCAL)).toEqual(before.local)
     expect(rolledBack.getAllWorktreeMetaForHost(REMOTE as never)).toEqual(before.remote)
@@ -298,7 +306,8 @@ describe('worktree meta alias projection', () => {
       before.meta[worktreeId(0)]
     )
     rolledBack.flush()
-    const reminted = JSON.parse(readFileSync(dataFile, 'utf-8')) as PersistedState
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The preceding Store save produced the PersistedState snapshot read by this test.
+    const reminted = JSON.parse(readPersistedStateJson(rollbackDataFile)) as PersistedState
     expect(
       reminted.worktreeIdentityAliases?.[composeWorktreeHostIdentity(LOCAL, worktreeId(0))]
     ).toEqual([
@@ -338,7 +347,7 @@ describe('worktree meta alias projection', () => {
     fromLegacy.flush()
 
     const compactFile = tempDataFile()
-    writeFileSync(compactFile, readFileSync(legacyFile))
+    writeFileSync(compactFile, readPersistedStateJson(legacyFile))
     const fromCompact = openStore(compactFile)
 
     expect(fromCompact.getAllWorktreeMeta()).toEqual(fromLegacy.getAllWorktreeMeta())
@@ -366,7 +375,8 @@ describe('worktree meta alias projection', () => {
       )
       expect(store.getAllWorktreeMeta()[worktreeId(0)]?.displayName).toBe('workspace-0')
       store.flush()
-      const onDisk = JSON.parse(readFileSync(dataFile, 'utf-8')) as PersistedState
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The preceding Store save produced the PersistedState snapshot read by this test.
+      const onDisk = JSON.parse(readPersistedStateJson(dataFile)) as PersistedState
       expect(Object.keys(onDisk.worktreeMeta).length).toBe(
         Object.keys(fixture.state.worktreeMeta).length
       )
@@ -409,7 +419,8 @@ describe('worktree meta alias projection', () => {
     expect(Object.keys(store.getAllWorktreeMeta())).toEqual([worktreeId(0)])
     store.flush()
 
-    const onDisk = JSON.parse(readFileSync(dataFile, 'utf-8')) as PersistedState
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The preceding Store save produced the PersistedState snapshot read by this test.
+    const onDisk = JSON.parse(readPersistedStateJson(dataFile)) as PersistedState
     expect(Object.hasOwn(onDisk, 'worktreeMetaByIdentity')).toBe(false)
     // The locator map and its lineage companions are all still there, untouched by the projection.
     expect(Object.keys(onDisk.worktreeMeta)).toEqual([worktreeId(0)])
diff --git a/src/main/persistence/loading-store/write-flush-barriers.ts b/src/main/persistence/loading-store/write-flush-barriers.ts
index c08d4367989d..b4c583666dc0 100644
--- a/src/main/persistence/loading-store/write-flush-barriers.ts
+++ b/src/main/persistence/loading-store/write-flush-barriers.ts
@@ -6,6 +6,7 @@ import { getGithubCacheFile } from './user-data-path'
 import type { StoreRuntimeState } from './store-runtime-state'
 import type { PrimaryStateWriteOperations } from './primary-state-writes'
 import { enqueueWrite } from './primary-state-writes'
+import { drainProfileStateOperations, runProfileStateFlush } from './profile-state-flush-lifetime'
 
 type WriteFlushBarrierOperationsRuntime = Pick<
   StoreRuntimeState,
@@ -17,9 +18,14 @@ type WriteFlushBarrierOperationsRuntime = Pick<
   | 'githubCacheGeneration'
   | 'lastDurableWriteGeneration'
   | 'pendingGithubCacheWrite'
+  | 'pendingProfileFlushes'
+  | 'pendingProfileMaintenance'
+  | 'profileMaintenancePending'
+  | 'profileStateAuthority'
   | 'quitFlushPromise'
   | 'quitFlushStarted'
   | 'staleGithubCacheTempCleanup'
+  | 'staleProfileStateTempCleanup'
   | 'state'
   | 'writeGeneration'
   | 'writeTimer'
@@ -30,6 +36,7 @@ const writeFlushBarrierOperationsContext = Symbol('WriteFlushBarrierOperations')
 type WriteFlushBarrierOperationsContext = {
   runtime: WriteFlushBarrierOperationsRuntime
   writes: PrimaryStateWriteOperations
+  bestEffortFinalFlush?: Promise<void>
 }
 
 export class WriteFlushBarrierOperations {
@@ -40,136 +47,184 @@ export class WriteFlushBarrierOperations {
   }
 
   flush(): void {
-    this[writeFlushBarrierOperationsContext].runtime.automationListProjectionCache = null
-    if (this[writeFlushBarrierOperationsContext].runtime.quitFlushStarted) {
+    const { runtime, writes } = this[writeFlushBarrierOperationsContext]
+    runtime.automationListProjectionCache = null
+    if (runtime.quitFlushStarted || runtime.profileMaintenancePending) {
+      return
+    }
+    if (runtime.profileStateAuthority?.asynchronous) {
+      runtime.writeGeneration++
+      void flushCurrentStateAsync(this, { drainToStableGeneration: false }).catch((error) =>
+        console.error('[persistence] Failed to flush state:', error)
+      )
       return
     }
     try {
-      this[writeFlushBarrierOperationsContext].writes.flushOrThrow()
+      writes.flushOrThrow()
     } catch (err) {
       console.error('[persistence] Failed to flush state:', err)
     }
     try {
-      this[writeFlushBarrierOperationsContext].writes.flushActiveViewPreferenceOrThrow()
+      writes.flushActiveViewPreferenceOrThrow()
     } catch (err) {
       console.error('[active-view] Failed to flush preference:', err)
     }
     writeGithubCacheSnapshotSync(this)
   }
 
-  flushAsync(): Promise<void> {
-    if (this[writeFlushBarrierOperationsContext].runtime.quitFlushPromise) {
-      return this[writeFlushBarrierOperationsContext].runtime.quitFlushPromise
+  flushAsync(options: { exportJsonCompatibility?: boolean } = {}): Promise<void> {
+    const context = this[writeFlushBarrierOperationsContext]
+    context.bestEffortFinalFlush ??= this.flushFinalOrThrowAsync(options).catch((error) =>
+      console.error('[persistence] Failed to flush final state:', error)
+    )
+    return context.bestEffortFinalFlush
+  }
+
+  flushFinalOrThrowAsync(options: { exportJsonCompatibility?: boolean } = {}): Promise<void> {
+    const { runtime } = this[writeFlushBarrierOperationsContext]
+    if (runtime.quitFlushPromise) {
+      return runtime.quitFlushPromise
     }
-    this[writeFlushBarrierOperationsContext].runtime.quitFlushStarted = true
-    this[writeFlushBarrierOperationsContext].runtime.quitFlushPromise = flushCurrentStateAsync(
-      this,
-      true
-    ).catch(() => {})
-    return this[writeFlushBarrierOperationsContext].runtime.quitFlushPromise
+    runtime.quitFlushStarted = true
+    runtime.quitFlushPromise = Promise.resolve(runtime.pendingProfileMaintenance)
+      .catch((error: unknown) => {
+        // Failed maintenance may re-admit unchanged storage before this final checkpoint.
+        if (runtime.profileMaintenancePending || runtime.writesFrozen) {
+          throw error
+        }
+      })
+      .then(async () => {
+        if (runtime.profileMaintenancePending) {
+          return
+        }
+        await drainProfileStateOperations([
+          ...runtime.pendingProfileFlushes,
+          runtime.staleProfileStateTempCleanup,
+          runtime.profileStateAuthority?.drainBackups?.(true)
+        ])
+        await flushCurrentStateAsync(this, { final: true })
+        if (options.exportJsonCompatibility) {
+          await runtime.profileStateAuthority?.writeJsonCompatibilityExportAsync?.(runtime.dataFile)
+        }
+      })
+      .finally(async () => {
+        if (runtime.profileStateAuthority?.asynchronous) {
+          runtime.writesFrozen = true
+          await runtime.profileStateAuthority.close()
+        }
+      })
+    return runtime.quitFlushPromise
   }
 
   flushPendingAsync(): Promise<void> {
+    const { runtime } = this[writeFlushBarrierOperationsContext]
+    if (runtime.writesFrozen || runtime.quitFlushStarted || runtime.profileMaintenancePending) {
+      return Promise.resolve()
+    }
     // Best-effort callers must not livelock while the live app keeps mutating state.
-    return flushCurrentStateAsync(this, false, undefined, false).catch(() => {})
+    return flushCurrentStateAsync(this, { drainToStableGeneration: false }).catch(() => {})
   }
 
   flushPendingOrThrowAsync(
     options: { signal?: AbortSignal; drainToStableGeneration?: boolean } = {}
   ): Promise<void> {
-    if (
-      this[writeFlushBarrierOperationsContext].runtime.writesFrozen ||
-      this[writeFlushBarrierOperationsContext].runtime.quitFlushStarted
-    ) {
+    const { runtime } = this[writeFlushBarrierOperationsContext]
+    if (runtime.writesFrozen || runtime.profileMaintenancePending || runtime.quitFlushStarted) {
       return Promise.reject(new Error('Cannot flush while persistence is finalized'))
     }
-    return flushCurrentStateAsync(
-      this,
-      false,
-      options.signal,
-      options.drainToStableGeneration,
-      true
-    )
+    return flushCurrentStateAsync(this, {
+      signal: options.signal,
+      drainToStableGeneration: options.drainToStableGeneration,
+      requireInitialGenerationDurable: true
+    })
   }
 }
 
 export async function flushDurableStateOrThrowAsync(
   owner: WriteFlushBarrierOperations
 ): Promise<void> {
-  if (
-    owner[writeFlushBarrierOperationsContext].runtime.writesFrozen ||
-    owner[writeFlushBarrierOperationsContext].runtime.quitFlushStarted
-  ) {
+  const { runtime, writes } = owner[writeFlushBarrierOperationsContext]
+  if (runtime.writesFrozen || runtime.profileMaintenancePending || runtime.quitFlushStarted) {
     throw new Error('Cannot flush while persistence is finalized')
   }
-  for (;;) {
-    if (owner[writeFlushBarrierOperationsContext].runtime.writeTimer) {
-      clearTimeout(owner[writeFlushBarrierOperationsContext].runtime.writeTimer)
-      owner[writeFlushBarrierOperationsContext].runtime.writeTimer = null
-    }
-    owner[writeFlushBarrierOperationsContext].runtime.firstPendingSaveAt = null
-    const generation = owner[writeFlushBarrierOperationsContext].runtime.writeGeneration
-    await enqueueWrite(owner[writeFlushBarrierOperationsContext].writes)
-    if (generation === owner[writeFlushBarrierOperationsContext].runtime.writeGeneration) {
-      break
+  return runProfileStateFlush(runtime, async () => {
+    for (;;) {
+      if (runtime.writeTimer) {
+        clearTimeout(runtime.writeTimer)
+        runtime.writeTimer = null
+      }
+      runtime.firstPendingSaveAt = null
+      const generation = runtime.writeGeneration
+      await enqueueWrite(writes)
+      if (generation === runtime.writeGeneration) {
+        break
+      }
     }
-  }
+  })
 }
 
 export async function flushCurrentStateAsync(
   owner: WriteFlushBarrierOperations,
-  final: boolean,
-  signal?: AbortSignal,
-  drainToStableGeneration = true,
-  requireInitialGenerationDurable = false
+  {
+    final = false,
+    signal,
+    drainToStableGeneration = true,
+    requireInitialGenerationDurable = false,
+    fullCheckpoint = final
+  }: {
+    final?: boolean
+    signal?: AbortSignal
+    drainToStableGeneration?: boolean
+    requireInitialGenerationDurable?: boolean
+    fullCheckpoint?: boolean
+  }
 ): Promise<void> {
-  const requiredDurableGeneration = requireInitialGenerationDurable
-    ? owner[writeFlushBarrierOperationsContext].runtime.writeGeneration
-    : null
-  for (;;) {
-    if (signal?.aborted) {
-      throw new Error('Persistence flush aborted')
-    }
-    if (owner[writeFlushBarrierOperationsContext].runtime.writeTimer) {
-      clearTimeout(owner[writeFlushBarrierOperationsContext].runtime.writeTimer)
-      owner[writeFlushBarrierOperationsContext].runtime.writeTimer = null
-    }
-    owner[writeFlushBarrierOperationsContext].runtime.firstPendingSaveAt = null
-    const generation = owner[writeFlushBarrierOperationsContext].runtime.writeGeneration
-    try {
-      await enqueueWrite(owner[writeFlushBarrierOperationsContext].writes)
-    } catch (error) {
-      await (final
-        ? owner[writeFlushBarrierOperationsContext].runtime.activeViewPreference.flushAsync()
-        : owner[writeFlushBarrierOperationsContext].runtime.activeViewPreference.flushPendingAsync(
-            signal
-          ))
-      await writeGithubCacheSnapshotAsync(owner, final, signal)
-      throw error
-    }
-    await (final
-      ? owner[writeFlushBarrierOperationsContext].runtime.activeViewPreference.flushAsync()
-      : owner[writeFlushBarrierOperationsContext].runtime.activeViewPreference.flushPendingAsync(
+  const { runtime, writes } = owner[writeFlushBarrierOperationsContext]
+  return runProfileStateFlush(runtime, async () => {
+    const requiredDurableGeneration = requireInitialGenerationDurable
+      ? runtime.writeGeneration
+      : null
+    for (;;) {
+      if (signal?.aborted) {
+        throw new Error('Persistence flush aborted')
+      }
+      if (runtime.writeTimer) {
+        clearTimeout(runtime.writeTimer)
+        runtime.writeTimer = null
+      }
+      runtime.firstPendingSaveAt = null
+      const generation = runtime.writeGeneration
+      try {
+        await enqueueWrite(writes, {
+          fullCheckpoint,
           signal
-        ))
-    await writeGithubCacheSnapshotAsync(owner, final, signal)
-    if (signal?.aborted) {
-      throw new Error('Persistence flush aborted')
-    }
-    if (!drainToStableGeneration) {
-      if (
-        requiredDurableGeneration === null ||
-        owner[writeFlushBarrierOperationsContext].runtime.lastDurableWriteGeneration >=
-          requiredDurableGeneration
-      ) {
+        })
+      } finally {
+        await (final
+          ? runtime.activeViewPreference.flushAsync()
+          : runtime.activeViewPreference.flushPendingAsync(signal))
+        await writeGithubCacheSnapshotAsync(owner, final, signal)
+        if (final || runtime.profileMaintenancePending) {
+          await runtime.profileStateAuthority?.drainBackups?.(true)
+        }
+      }
+      if (signal?.aborted) {
+        throw new Error('Persistence flush aborted')
+      }
+      if (!drainToStableGeneration) {
+        if (
+          requiredDurableGeneration === null ||
+          runtime.lastDurableWriteGeneration >= requiredDurableGeneration
+        ) {
+          break
+        }
+        continue
+      }
+      if (generation === runtime.writeGeneration) {
         break
       }
-      continue
-    }
-    if (generation === owner[writeFlushBarrierOperationsContext].runtime.writeGeneration) {
-      break
     }
-  }
+  })
 }
 
 export async function writeGithubCacheSnapshotAsync(
@@ -177,39 +232,28 @@ export async function writeGithubCacheSnapshotAsync(
   drainToStableGeneration = true,
   signal?: AbortSignal
 ): Promise<void> {
-  if (!owner[writeFlushBarrierOperationsContext].runtime.githubCacheDirty) {
+  const { runtime } = owner[writeFlushBarrierOperationsContext]
+  if (!runtime.githubCacheDirty) {
     return
   }
-  const previousWrite =
-    owner[writeFlushBarrierOperationsContext].runtime.pendingGithubCacheWrite ??
-    owner[writeFlushBarrierOperationsContext].runtime.staleGithubCacheTempCleanup
+  const previousWrite = runtime.pendingGithubCacheWrite ?? runtime.staleGithubCacheTempCleanup
   const nextWrite = previousWrite
     .then(async () => {
-      while (owner[writeFlushBarrierOperationsContext].runtime.githubCacheDirty) {
+      while (runtime.githubCacheDirty) {
         if (signal?.aborted) {
           throw new Error('GitHub cache flush aborted')
         }
-        const generation = owner[writeFlushBarrierOperationsContext].runtime.githubCacheGeneration
-        const cacheFile = getGithubCacheFile(
-          owner[writeFlushBarrierOperationsContext].runtime.dataFile
-        )
+        const generation = runtime.githubCacheGeneration
+        const cacheFile = getGithubCacheFile(runtime.dataFile)
         const tmpFile = durableWriteTempPath(cacheFile)
         let renamed = false
         try {
-          await writeFile(
-            tmpFile,
-            JSON.stringify(owner[writeFlushBarrierOperationsContext].runtime.state.githubCache),
-            'utf-8'
-          )
-          if (
-            generation === owner[writeFlushBarrierOperationsContext].runtime.githubCacheGeneration
-          ) {
+          await writeFile(tmpFile, JSON.stringify(runtime.state.githubCache), 'utf-8')
+          if (generation === runtime.githubCacheGeneration) {
             await rename(tmpFile, cacheFile)
             renamed = true
-            if (
-              generation === owner[writeFlushBarrierOperationsContext].runtime.githubCacheGeneration
-            ) {
-              owner[writeFlushBarrierOperationsContext].runtime.githubCacheDirty = false
+            if (generation === runtime.githubCacheGeneration) {
+              runtime.githubCacheDirty = false
             }
           }
         } finally {
@@ -229,41 +273,36 @@ export async function writeGithubCacheSnapshotAsync(
       console.warn('[persistence] Failed to write github cache snapshot:', err)
     })
     .finally(() => {
-      if (owner[writeFlushBarrierOperationsContext].runtime.pendingGithubCacheWrite === nextWrite) {
-        owner[writeFlushBarrierOperationsContext].runtime.pendingGithubCacheWrite = null
+      if (runtime.pendingGithubCacheWrite === nextWrite) {
+        runtime.pendingGithubCacheWrite = null
       }
     })
-  owner[writeFlushBarrierOperationsContext].runtime.pendingGithubCacheWrite = nextWrite
+  runtime.pendingGithubCacheWrite = nextWrite
   await nextWrite
 }
 
 export function writeGithubCacheSnapshotSync(owner: WriteFlushBarrierOperations): void {
-  if (!owner[writeFlushBarrierOperationsContext].runtime.githubCacheDirty) {
+  const { runtime } = owner[writeFlushBarrierOperationsContext]
+  if (!runtime.githubCacheDirty) {
     return
   }
-  if (owner[writeFlushBarrierOperationsContext].runtime.pendingGithubCacheWrite) {
+  if (runtime.pendingGithubCacheWrite) {
     void writeGithubCacheSnapshotAsync(owner)
     return
   }
-  const cacheFile = getGithubCacheFile(owner[writeFlushBarrierOperationsContext].runtime.dataFile)
-  const generation = owner[writeFlushBarrierOperationsContext].runtime.githubCacheGeneration
+  const cacheFile = getGithubCacheFile(runtime.dataFile)
+  const generation = runtime.githubCacheGeneration
   const tmpFile = durableWriteTempPath(cacheFile)
   try {
-    writeFileSync(
-      tmpFile,
-      JSON.stringify(owner[writeFlushBarrierOperationsContext].runtime.state.githubCache),
-      'utf-8'
-    )
+    writeFileSync(tmpFile, JSON.stringify(runtime.state.githubCache), 'utf-8')
     renameSync(tmpFile, cacheFile)
-    if (generation === owner[writeFlushBarrierOperationsContext].runtime.githubCacheGeneration) {
-      owner[writeFlushBarrierOperationsContext].runtime.githubCacheDirty = false
+    if (generation === runtime.githubCacheGeneration) {
+      runtime.githubCacheDirty = false
     }
   } catch (err) {
     try {
       unlinkSync(tmpFile)
-    } catch {
-      // Best-effort cleanup.
-    }
+    } catch {}
     console.warn('[persistence] Failed to write github cache snapshot:', err)
   }
 }
diff --git a/src/main/persistence/loading-store/write-scheduling.ts b/src/main/persistence/loading-store/write-scheduling.ts
index 0301da34a7e9..30019c5c4562 100644
--- a/src/main/persistence/loading-store/write-scheduling.ts
+++ b/src/main/persistence/loading-store/write-scheduling.ts
@@ -9,11 +9,14 @@ type WriteSchedulingOperationsRuntime = Pick<
   StoreRuntimeState,
   | 'activeViewPreference'
   | 'automationListProjectionCache'
+  | 'dirtyProfileStateDomains'
   | 'firstPendingSaveAt'
   | 'pendingWrite'
+  | 'profileMaintenancePending'
   | 'quitFlushStarted'
   | 'writeGeneration'
   | 'writeTimer'
+  | 'writesFrozen'
 >
 
 const writeSchedulingOperationsContext = Symbol('WriteSchedulingOperations')
@@ -30,36 +33,44 @@ export class WriteSchedulingOperations {
   }
 
   async waitForPendingWrite(): Promise<void> {
-    await Promise.all([
-      this[writeSchedulingOperationsContext].runtime.pendingWrite,
-      this[writeSchedulingOperationsContext].runtime.activeViewPreference.waitForPendingWrite()
-    ])
+    const { runtime } = this[writeSchedulingOperationsContext]
+    await Promise.all([runtime.pendingWrite, runtime.activeViewPreference.waitForPendingWrite()])
   }
 }
 
-export function scheduleSave(owner: WriteSchedulingOperations): void {
-  owner[writeSchedulingOperationsContext].runtime.automationListProjectionCache = null
-  // Why: once the quit flush has snapshotted, a newly debounced write would fire during
-  // teardown with nothing awaiting it, and the process can exit mid-rename. The quit
-  // flush is the last write by construction.
-  if (owner[writeSchedulingOperationsContext].runtime.quitFlushStarted) {
+export function scheduleSave(
+  owner: WriteSchedulingOperations,
+  dirtyDomains?: readonly string[]
+): void {
+  const { runtime, writes } = owner[writeSchedulingOperationsContext]
+  runtime.automationListProjectionCache = null
+  const trackedDomains = runtime.dirtyProfileStateDomains
+  if (dirtyDomains === undefined) {
+    runtime.dirtyProfileStateDomains = null
+  } else if (trackedDomains !== null) {
+    for (const domain of dirtyDomains) {
+      trackedDomains.add(domain)
+    }
+  }
+  // A timer admitted after the final snapshot could outlive the awaited shutdown work.
+  if (runtime.quitFlushStarted || runtime.profileMaintenancePending) {
+    return
+  }
+  runtime.writeGeneration += 1
+  if (runtime.writesFrozen) {
     return
   }
-  owner[writeSchedulingOperationsContext].runtime.writeGeneration += 1
   const now = Date.now()
-  owner[writeSchedulingOperationsContext].runtime.firstPendingSaveAt ??= now
-  if (owner[writeSchedulingOperationsContext].runtime.writeTimer) {
-    clearTimeout(owner[writeSchedulingOperationsContext].runtime.writeTimer)
+  runtime.firstPendingSaveAt ??= now
+  if (runtime.writeTimer) {
+    clearTimeout(runtime.writeTimer)
   }
-  const untilMaxWait = Math.max(
-    0,
-    owner[writeSchedulingOperationsContext].runtime.firstPendingSaveAt + SAVE_MAX_WAIT_MS - now
-  )
+  const untilMaxWait = Math.max(0, runtime.firstPendingSaveAt + SAVE_MAX_WAIT_MS - now)
   const delay = Math.min(SAVE_DEBOUNCE_MS, untilMaxWait)
-  owner[writeSchedulingOperationsContext].runtime.writeTimer = setTimeout(() => {
-    owner[writeSchedulingOperationsContext].runtime.writeTimer = null
-    owner[writeSchedulingOperationsContext].runtime.firstPendingSaveAt = null
-    void enqueueWrite(owner[writeSchedulingOperationsContext].writes)
+  runtime.writeTimer = setTimeout(() => {
+    runtime.writeTimer = null
+    runtime.firstPendingSaveAt = null
+    void enqueueWrite(writes, { skipIfClean: true }).catch(() => {})
   }, delay)
 }
 
diff --git a/src/main/persistence/profile-state-cutover-fixture.test.ts b/src/main/persistence/profile-state-cutover-fixture.test.ts
new file mode 100644
index 000000000000..311c15ae450f
--- /dev/null
+++ b/src/main/persistence/profile-state-cutover-fixture.test.ts
@@ -0,0 +1,172 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { existsSync, mkdtempSync, readFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { tmpdir } from 'node:os'
+import { removeTreeSync } from '../../shared/windows-transient-lock-removal'
+import {
+  buildProfileStateCutoverFixture,
+  canonicalProfileStateJson
+} from './profile-state-cutover-fixture'
+import {
+  exportProfileStateJson,
+  importProfileStateJson
+} from './profile-state/profile-state-documents'
+import {
+  openProfileStateDatabase,
+  profileStateDatabaseFile
+} from './profile-state/profile-state-database'
+import { Store } from './loading-store/store'
+import {
+  closeTestStores,
+  createStore,
+  dataFile,
+  testState,
+  writeDataFile
+} from '../persistence-test-harness'
+
+const { trackMock, getCohortAtEmitMock } = vi.hoisted(() => ({
+  trackMock: vi.fn(),
+  getCohortAtEmitMock: vi.fn(() => ({ nth_repo_added: 2 }))
+}))
+
+vi.mock('electron', () => ({
+  app: { getPath: () => testState.dir },
+  safeStorage: {
+    isEncryptionAvailable: () => true,
+    encryptString: (plaintext: string) => Buffer.from(`encrypted:${plaintext}`, 'utf-8'),
+    decryptString: (ciphertext: Buffer) => ciphertext.toString('utf-8').slice('encrypted:'.length)
+  }
+}))
+
+vi.mock('../telemetry/client', () => ({ track: trackMock }))
+vi.mock('../telemetry/cohort-classifier', () => ({ getCohortAtEmit: getCohortAtEmitMock }))
+vi.mock('../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: vi.fn(() => ({ hosts: [] })),
+  sshConfigHostsToTargets: vi.fn(() => [])
+}))
+
+describe('profile-state cutover fixture', () => {
+  beforeEach(() => {
+    testState.dir = mkdtempSync(join(tmpdir(), 'orca-profile-cutover-fixture-'))
+  })
+
+  afterEach(async () => {
+    await closeTestStores()
+    removeTreeSync(testState.dir)
+  })
+
+  it('keeps object insertion order out of semantic comparisons while preserving array order', () => {
+    expect(canonicalProfileStateJson({ b: 2, a: { d: 4, c: 3 }, rows: ['first', 'second'] })).toBe(
+      canonicalProfileStateJson({ rows: ['first', 'second'], a: { c: 3, d: 4 }, b: 2 })
+    )
+    expect(canonicalProfileStateJson({ rows: ['first', 'second'] })).not.toBe(
+      canonicalProfileStateJson({ rows: ['second', 'first'] })
+    )
+    expect(canonicalProfileStateJson({ missing: undefined, nullable: null })).toBe(
+      canonicalProfileStateJson({ nullable: null })
+    )
+  })
+
+  it('loads the cross-domain fixture through the legacy Store contract', () => {
+    const fixture = buildProfileStateCutoverFixture(testState.dir)
+    writeDataFile(fixture)
+
+    const store = createStore()
+    store.flushOrThrow()
+    store.freezeWrites()
+
+    expect(store.getRepos().map((repo) => repo.id)).toEqual(['repo-local', 'repo-remote'])
+    expect(store.getProjects().map((project) => project.id)).toEqual([
+      'repo:repo-local',
+      'repo:repo-remote'
+    ])
+    expect(store.getProjectHostSetups().map((setup) => setup.id)).toEqual([
+      'repo-local',
+      'repo-remote'
+    ])
+    expect(store.getWorktreeMeta('repo-local::/fixture/local')).toMatchObject({
+      instanceId: 'instance-local',
+      linkedPR: 42,
+      comment: 'Preserve this comment'
+    })
+    expect(store.getWorkspaceSession().activeTabId).toBe('tab-local')
+    expect(store.getWorkspaceSession('ssh:build-host').activeTabId).toBe('tab-remote')
+    expect(store.listAutomations().map((automation) => automation.id)).toEqual([
+      'automation-fixture'
+    ])
+    expect(store.listAutomationRuns('automation-fixture').map((run) => run.id)).toEqual([
+      'automation-run-fixture'
+    ])
+    expect(store.getSettings().opencodeSessionCookie).toBe('fixture-secret')
+
+    const persisted: unknown = JSON.parse(readFileSync(dataFile(), 'utf-8'))
+    expect(persisted).toHaveProperty('futureTopLevelExtension', {
+      keep: 'forward-compatible',
+      nullable: null
+    })
+    expect(persisted).toHaveProperty(
+      'settings.opencodeSessionCookie',
+      fixture.settings.opencodeSessionCookie
+    )
+
+    const reloaded = createStore()
+    reloaded.freezeWrites()
+    expect(reloaded.getWorkspaceSession().activeTabId).toBe('tab-local')
+    expect(reloaded.getWorkspaceSession('ssh:build-host').activeTabId).toBe('tab-remote')
+    expect(reloaded.listAutomationRuns('automation-fixture')[0]?.outputSnapshot?.content).toBe(
+      'fixture output'
+    )
+    expect(reloaded.getSettings().opencodeSessionCookie).toBe('fixture-secret')
+  })
+
+  it('imports and exports through the real Store normalization and secret boundaries', () => {
+    const fixture = buildProfileStateCutoverFixture(testState.dir)
+    writeDataFile(fixture)
+
+    const source = createStore()
+    source.flushOrThrow()
+    const prepared = source.prepareProfileStateExport()
+    const databaseDirectory = mkdtempSync(join(testState.dir, 'profile-state-db-'))
+    const opened = openProfileStateDatabase(
+      profileStateDatabaseFile(databaseDirectory),
+      'profile-cutover'
+    )
+    try {
+      importProfileStateJson(opened.db, prepared.json, { now: () => 456 })
+      const exported = exportProfileStateJson(opened.db)
+      prepared.commit()
+
+      const candidateDirectory = mkdtempSync(join(testState.dir, 'candidate-'))
+      const candidate = new Store({
+        dataFile: join(candidateDirectory, 'orca-data.json'),
+        serializedState: exported
+      })
+
+      expect(candidate.getSettings().opencodeSessionCookie).toBe('fixture-secret')
+      expect(candidate.getWorkspaceSession().activeTabId).toBe('tab-local')
+      expect(candidate.getWorkspaceSession('ssh:build-host').activeTabId).toBe('tab-remote')
+      expect(candidate.listAutomationRuns('automation-fixture')[0]?.outputSnapshot?.content).toBe(
+        'fixture output'
+      )
+      expect(candidate.getWorktreeMeta('repo-local::/fixture/local')).toMatchObject({
+        linkedPR: 42,
+        comment: 'Preserve this comment'
+      })
+
+      const persisted: unknown = JSON.parse(candidate.prepareProfileStateExport().json)
+      expect(persisted).toHaveProperty('futureTopLevelExtension', fixture.futureTopLevelExtension)
+      expect(persisted).toHaveProperty('settings.opencodeSessionCookie')
+      expect(existsSync(join(candidateDirectory, 'orca-data.json'))).toBe(false)
+    } finally {
+      opened.db.close()
+    }
+  })
+
+  it('fails closed for an invalid serialized import instead of reading a fallback file', () => {
+    writeDataFile(buildProfileStateCutoverFixture(testState.dir))
+
+    expect(() => new Store({ dataFile: dataFile(), serializedState: '{not valid json' })).toThrow(
+      'Failed to load imported profile state'
+    )
+  })
+})
diff --git a/src/main/persistence/profile-state-cutover-fixture.ts b/src/main/persistence/profile-state-cutover-fixture.ts
new file mode 100644
index 000000000000..9d3bdf7ea39d
--- /dev/null
+++ b/src/main/persistence/profile-state-cutover-fixture.ts
@@ -0,0 +1,291 @@
+import { getDefaultPersistedState, getDefaultWorkspaceSession } from '../../shared/constants'
+import type { Automation, AutomationRun } from '../../shared/automations-types'
+import type { PersistedState } from '../../shared/persisted-state-types'
+import type { Project, ProjectHostSetup } from '../../shared/project-types'
+import type { Repo } from '../../shared/repo-types'
+import type { TerminalTab, TerminalLayoutSnapshot } from '../../shared/terminal-tab-types'
+import type { WorkspaceSessionState } from '../../shared/workspace-session-state-types'
+import type { WorktreeMeta } from '../../shared/worktree/meta-types'
+
+const LOCAL_WORKTREE_ID = 'repo-local::/fixture/local'
+const REMOTE_WORKTREE_ID = 'repo-remote::/fixture/remote'
+const LOCAL_TAB_ID = 'tab-local'
+const REMOTE_TAB_ID = 'tab-remote'
+const LOCAL_LEAF_ID = 'leaf-local'
+const REMOTE_LEAF_ID = 'leaf-remote'
+const REMOTE_HOST_ID = 'ssh:build-host'
+
+export type ProfileStateCutoverFixture = PersistedState & {
+  futureTopLevelExtension: {
+    keep: string
+    nullable: null
+  }
+}
+
+function fixtureRepo(overrides: Partial<Repo>): Repo {
+  return {
+    id: 'repo-local',
+    path: '/fixture/local',
+    displayName: 'Fixture local',
+    badgeColor: '#737373',
+    addedAt: 1,
+    ...overrides
+  }
+}
+
+function fixtureProject(overrides: Partial<Project>): Project {
+  return {
+    id: 'project-fixture',
+    displayName: 'Fixture project',
+    badgeColor: '#737373',
+    sourceRepoIds: ['repo-local', 'repo-remote'],
+    createdAt: 1,
+    updatedAt: 2,
+    ...overrides
+  }
+}
+
+function fixtureSetup(overrides: Partial<ProjectHostSetup>): ProjectHostSetup {
+  return {
+    id: 'setup-local',
+    projectId: 'project-fixture',
+    hostId: 'local',
+    repoId: 'repo-local',
+    path: '/fixture/local',
+    displayName: 'Fixture local',
+    setupState: 'ready',
+    setupMethod: 'imported-existing-folder',
+    createdAt: 1,
+    updatedAt: 2,
+    ...overrides
+  }
+}
+
+function fixtureTab(overrides: Partial<TerminalTab>): TerminalTab {
+  return {
+    id: LOCAL_TAB_ID,
+    ptyId: 'pty-local',
+    worktreeId: LOCAL_WORKTREE_ID,
+    title: 'Fixture terminal',
+    customTitle: null,
+    color: null,
+    sortOrder: 0,
+    createdAt: 1,
+    ...overrides
+  }
+}
+
+function fixtureLayout(leafId: string, ptyId: string): TerminalLayoutSnapshot {
+  return {
+    root: { type: 'leaf', leafId },
+    activeLeafId: leafId,
+    expandedLeafId: null,
+    ptyIdsByLeafId: { [leafId]: ptyId },
+    titlesByLeafId: { [leafId]: 'Fixture pane' }
+  }
+}
+
+function fixtureSession(args: {
+  repoId: string
+  worktreeId: string
+  tab: TerminalTab
+  layout: TerminalLayoutSnapshot
+}): WorkspaceSessionState {
+  return {
+    ...getDefaultWorkspaceSession(),
+    activeRepoId: args.repoId,
+    activeWorktreeId: args.worktreeId,
+    activeTabId: args.tab.id,
+    tabsByWorktree: { [args.worktreeId]: [args.tab] },
+    terminalLayoutsByTabId: { [args.tab.id]: args.layout },
+    activeTabIdByWorktree: { [args.worktreeId]: args.tab.id },
+    activeWorktreeIdsOnShutdown: [args.worktreeId],
+    browserUrlHistory: [
+      {
+        url: 'https://fixture.test/é😀',
+        normalizedUrl: 'https://fixture.test/é😀',
+        title: 'Fixture',
+        lastVisitedAt: 3,
+        visitCount: 2
+      }
+    ]
+  }
+}
+
+function fixtureAutomation(): Automation {
+  return {
+    id: 'automation-fixture',
+    name: 'Fixture automation',
+    prompt: 'Keep the fixture valid',
+    precheck: null,
+    agentId: 'claude',
+    projectId: 'project-fixture',
+    executionTargetType: 'local',
+    executionTargetId: 'local',
+    schedulerOwner: 'local_host_service',
+    workspaceMode: 'existing',
+    workspaceId: LOCAL_WORKTREE_ID,
+    baseBranch: null,
+    reuseSession: false,
+    timezone: 'UTC',
+    rrule: 'FREQ=DAILY',
+    dtstart: 10,
+    enabled: true,
+    nextRunAt: 20,
+    missedRunPolicy: 'run_once_within_grace',
+    missedRunGraceMinutes: 5,
+    createdAt: 1,
+    updatedAt: 2
+  }
+}
+
+function fixtureAutomationRun(): AutomationRun {
+  return {
+    id: 'automation-run-fixture',
+    automationId: 'automation-fixture',
+    title: 'Fixture run',
+    scheduledFor: 20,
+    status: 'completed',
+    trigger: 'manual',
+    workspaceId: LOCAL_WORKTREE_ID,
+    workspaceDisplayName: 'Fixture local',
+    sessionKind: 'terminal',
+    chatSessionId: null,
+    terminalSessionId: 'terminal-fixture',
+    terminalPaneKey: 'pane-fixture',
+    terminalPtyId: 'pty-local',
+    outputSnapshot: {
+      format: 'plain_text',
+      content: 'fixture output',
+      capturedAt: 21,
+      truncated: false
+    },
+    precheckResult: null,
+    usage: null,
+    error: null,
+    startedAt: 20,
+    dispatchedAt: 20,
+    createdAt: 20,
+    runNumber: 1
+  }
+}
+
+function fixtureWorktreeMeta(): WorktreeMeta {
+  const now = Date.now()
+  return {
+    instanceId: 'instance-local',
+    projectId: 'project-fixture',
+    hostId: 'local',
+    projectHostSetupId: 'setup-local',
+    displayName: 'Fixture local',
+    comment: 'Preserve this comment',
+    linkedIssue: null,
+    linkedPR: 42,
+    linkedLinearIssue: null,
+    isArchived: false,
+    isUnread: true,
+    isPinned: true,
+    sortOrder: 1,
+    lastActivityAt: now,
+    createdAt: now
+  }
+}
+
+export function buildProfileStateCutoverFixture(
+  homedir = '/fixture/home'
+): ProfileStateCutoverFixture {
+  const localTab = fixtureTab({})
+  const remoteTab = fixtureTab({
+    id: REMOTE_TAB_ID,
+    ptyId: 'pty-remote',
+    worktreeId: REMOTE_WORKTREE_ID
+  })
+  const localSession = fixtureSession({
+    repoId: 'repo-local',
+    worktreeId: LOCAL_WORKTREE_ID,
+    tab: localTab,
+    layout: fixtureLayout(LOCAL_LEAF_ID, 'pty-local')
+  })
+  const remoteSession = fixtureSession({
+    repoId: 'repo-remote',
+    worktreeId: REMOTE_WORKTREE_ID,
+    tab: remoteTab,
+    layout: fixtureLayout(REMOTE_LEAF_ID, 'pty-remote')
+  })
+  const state = getDefaultPersistedState(homedir)
+  state.repos = [
+    fixtureRepo({}),
+    fixtureRepo({
+      id: 'repo-remote',
+      path: '/fixture/remote',
+      displayName: 'Fixture remote',
+      connectionId: 'build-host',
+      executionHostId: REMOTE_HOST_ID
+    })
+  ]
+  state.projects = [fixtureProject({})]
+  state.projectHostSetups = [
+    fixtureSetup({}),
+    fixtureSetup({
+      id: 'setup-remote',
+      hostId: REMOTE_HOST_ID,
+      repoId: 'repo-remote',
+      path: '/fixture/remote',
+      displayName: 'Fixture remote',
+      connectionId: 'build-host',
+      executionHostId: REMOTE_HOST_ID
+    })
+  ]
+  state.worktreeMeta = {
+    [LOCAL_WORKTREE_ID]: fixtureWorktreeMeta(),
+    [REMOTE_WORKTREE_ID]: {
+      ...fixtureWorktreeMeta(),
+      instanceId: 'instance-remote',
+      hostId: REMOTE_HOST_ID,
+      projectHostSetupId: 'setup-remote',
+      displayName: 'Fixture remote'
+    }
+  }
+  state.workspaceSession = localSession
+  state.workspaceSessionsByHostId = { [REMOTE_HOST_ID]: remoteSession }
+  state.sshTargets = [
+    {
+      id: 'build-host',
+      label: 'Build host',
+      host: 'build.example.test',
+      port: 22,
+      username: 'builder',
+      source: 'manual',
+      generation: 3
+    }
+  ]
+  state.automations = [fixtureAutomation()]
+  state.automationRuns = [fixtureAutomationRun()]
+  state.settings = {
+    ...state.settings,
+    opencodeSessionCookie: Buffer.from('vitest-sealed:fixture-secret', 'utf-8').toString('base64')
+  }
+  state.ui = { ...state.ui, activeView: 'tasks', browserKagiSessionLink: null }
+  return Object.assign(state, {
+    futureTopLevelExtension: { keep: 'forward-compatible', nullable: null }
+  })
+}
+
+function sortForStableJson(value: unknown): unknown {
+  if (Array.isArray(value)) {
+    return value.map(sortForStableJson)
+  }
+  if (!value || typeof value !== 'object') {
+    return value
+  }
+  return Object.fromEntries(
+    Object.entries(value)
+      .sort(([left], [right]) => left.localeCompare(right))
+      .map(([key, child]) => [key, sortForStableJson(child)])
+  )
+}
+
+/** Compares state semantics while ignoring object insertion order and preserving array order. */
+export function canonicalProfileStateJson(state: unknown): string {
+  return JSON.stringify(sortForStableJson(state))
+}
diff --git a/src/main/persistence/profile-state-cutover-soak.test.ts b/src/main/persistence/profile-state-cutover-soak.test.ts
new file mode 100644
index 000000000000..2a46f6aedbfa
--- /dev/null
+++ b/src/main/persistence/profile-state-cutover-soak.test.ts
@@ -0,0 +1,352 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import {
+  buildProfileStateCutoverFixture,
+  canonicalProfileStateJson
+} from './profile-state-cutover-fixture'
+import {
+  readAgentHookSettingsFromProfileState,
+  updateAgentHookSettingsInProfileState,
+  type ProfileStateOfflineLocation
+} from './profile-state/profile-state-offline-settings'
+import {
+  createProfileStateStore,
+  type ProfileStateStoreFactoryOptions,
+  type ProfileStateStoreFactoryResult
+} from './profile-state/profile-state-store-factory'
+import { profileStateDatabaseFile } from './profile-state/profile-state-database'
+
+vi.mock('electron', () => ({
+  app: {
+    getPath: () => tmpdir(),
+    getName: () => 'orca-test',
+    getVersion: () => '0.0.0-test',
+    isPackaged: false,
+    on: () => {},
+    whenReady: () => Promise.resolve()
+  },
+  safeStorage: {
+    isEncryptionAvailable: () => true,
+    encryptString: (value: string) => Buffer.from(`encrypted:${value}`, 'utf8'),
+    decryptString: (value: Buffer) => value.toString('utf8').slice('encrypted:'.length)
+  },
+  ipcMain: { on: () => {}, handle: () => {} },
+  BrowserWindow: { getAllWindows: () => [] }
+}))
+
+vi.mock('../../telemetry/client', () => ({ track: () => {} }))
+vi.mock('../../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: () => ({ nth_repo_added: 2 })
+}))
+vi.mock('../../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: () => ({ hosts: [] }),
+  sshConfigHostsToTargets: () => []
+}))
+
+const { Store } = await import('./loading-store/store')
+
+const temporaryDirectories: string[] = []
+
+afterEach(() => {
+  for (const directory of temporaryDirectories.splice(0)) {
+    rmSync(directory, { recursive: true, force: true })
+  }
+  vi.restoreAllMocks()
+})
+
+type MigratedProfile = {
+  options: ProfileStateStoreFactoryOptions
+  location: ProfileStateOfflineLocation
+  first: ProfileStateStoreFactoryResult
+}
+
+function createProfile(profileId: string, theme: string): MigratedProfile {
+  const directory = mkdtempSync(join(tmpdir(), `orca-profile-state-cutover-${profileId}-`))
+  temporaryDirectories.push(directory)
+  const dataFile = join(directory, 'orca-data.json')
+  const databaseFile = profileStateDatabaseFile(directory)
+  const fixture = buildProfileStateCutoverFixture(directory)
+  writeFileSync(
+    dataFile,
+    JSON.stringify({
+      ...fixture,
+      settings: { ...fixture.settings, theme },
+      // Keep enough unrelated data to make repeated complete-document commits meaningful.
+      soakExtension: { bytes: 'x'.repeat(96 * 1024), nullable: null }
+    })
+  )
+  const options: ProfileStateStoreFactoryOptions = {
+    dataFile,
+    databaseFile,
+    profileId
+  }
+  const first = createProfileStateStore(options)
+  expect(first.backend).toBe('sqlite')
+  expect(first.migrated).toBe(true)
+  return {
+    options,
+    location: { dataFile, databaseFile, profileId },
+    first
+  }
+}
+
+function removeLegacyJson(profile: MigratedProfile): void {
+  profile.first.store.freezeWrites()
+  rmSync(profile.options.dataFile, { force: true })
+  expect(existsSync(profile.options.dataFile)).toBe(false)
+  expect(existsSync(profile.options.databaseFile)).toBe(true)
+}
+
+function reopen(profile: MigratedProfile): ProfileStateStoreFactoryResult {
+  return createProfileStateStore(profile.options)
+}
+
+function exportJson(store: ProfileStateStoreFactoryResult['store']): unknown {
+  return JSON.parse(store.prepareProfileStateExport().json)
+}
+
+describe('profile-state candidate cutover soak', () => {
+  it('keeps the retained JSON export usable for legacy rollback', () => {
+    const profile = createProfile('rollback-window', 'light')
+    const retainedJson = readFileSync(profile.options.dataFile)
+
+    profile.first.store.updateSettings({ theme: 'dark', terminalFontSize: 123 })
+    profile.first.store.flushOrThrow()
+    expect(readFileSync(profile.options.dataFile)).toEqual(retainedJson)
+
+    const legacyStore = new Store({
+      dataFile: profile.options.dataFile,
+      serializedState: retainedJson.toString('utf8')
+    })
+    expect(legacyStore.getSettings().theme).toBe('light')
+    expect(legacyStore.getSettings().terminalFontSize).not.toBe(123)
+    legacyStore.freezeWrites()
+    profile.first.store.freezeWrites()
+  })
+
+  it('migrates a complete profile, removes JSON, and survives restart/domain/offline churn', () => {
+    const profile = createProfile('soak-primary', 'light')
+    const initial = exportJson(profile.first.store)
+    const folderGroup = profile.first.store.createProjectGroup({
+      name: 'Fixture folders',
+      createdFrom: 'manual',
+      parentPath: '/fixture/folder',
+      connectionId: 'build-host'
+    })
+    const folderWorkspace = profile.first.store.createFolderWorkspace({
+      projectGroupId: folderGroup.id,
+      name: 'Remote folder fixture',
+      folderPath: '/fixture/folder',
+      connectionId: 'build-host'
+    })
+    const remoteAutomation = profile.first.store.createAutomation({
+      name: 'Remote fixture automation',
+      prompt: 'Keep the remote fixture valid',
+      agentId: 'claude',
+      projectId: 'repo-remote',
+      workspaceMode: 'existing',
+      workspaceId: 'repo-remote::/fixture/remote',
+      baseBranch: null,
+      reuseSession: false,
+      timezone: 'UTC',
+      rrule: 'FREQ=DAILY',
+      dtstart: 10,
+      enabled: true,
+      missedRunGraceMinutes: 5
+    })
+    profile.first.store.createAutomationRun(remoteAutomation, 30, 'manual')
+    profile.first.store.flushOrThrow()
+    removeLegacyJson(profile)
+
+    for (let round = 0; round < 8; round += 1) {
+      const reopened = reopen(profile)
+      const currentSession = reopened.store.getWorkspaceSession()
+      const currentAutomation = reopened.store.listAutomations()[0]
+      if (!currentAutomation) {
+        throw new Error('cutover fixture lost its automation')
+      }
+
+      reopened.store.updateSettings({
+        theme: round % 2 === 0 ? 'dark' : 'light',
+        terminalFontSize: reopened.store.getSettings().terminalFontSize + 1
+      })
+      reopened.store.updateUI({ activeView: round % 2 === 0 ? 'tasks' : 'terminal' })
+      reopened.store.patchWorkspaceSession({
+        browserUrlHistory: [
+          ...(currentSession.browserUrlHistory ?? []),
+          {
+            url: `https://fixture.test/soak/${round}`,
+            normalizedUrl: `https://fixture.test/soak/${round}`,
+            title: `Soak ${round}`,
+            lastVisitedAt: round + 10,
+            visitCount: 1
+          }
+        ]
+      })
+      reopened.store.setWorktreeMeta('repo-local::/fixture/local', {
+        comment: `soak-${round}`,
+        linkedPR: 100 + round
+      })
+      reopened.store.createAutomationRun(currentAutomation, 100 + round, 'manual')
+      reopened.store.flushOrThrow()
+      reopened.store.freezeWrites()
+
+      const restarted = reopen(profile)
+      expect(restarted.store.getWorkspaceSession().activeTabId).toBe('tab-local')
+      expect(restarted.store.getWorkspaceSession('ssh:build-host').activeTabId).toBe('tab-remote')
+      expect(restarted.store.getFolderWorkspace(folderWorkspace.id)).toMatchObject({
+        name: 'Remote folder fixture',
+        folderPath: '/fixture/folder',
+        connectionId: 'build-host'
+      })
+      expect(restarted.store.getWorktreeMeta('repo-local::/fixture/local')).toMatchObject({
+        comment: `soak-${round}`,
+        linkedPR: 100 + round
+      })
+      expect(restarted.store.listAutomationRuns('automation-fixture').length).toBeGreaterThan(
+        round + 1
+      )
+      const persistedRemoteAutomation = restarted.store
+        .listAutomations()
+        .find((automation) => automation.id === remoteAutomation.id)
+      expect(persistedRemoteAutomation).toMatchObject({
+        executionTargetType: 'ssh',
+        executionTargetId: 'build-host',
+        schedulerOwner: 'ssh_bridge',
+        workspaceId: 'repo-remote::/fixture/remote'
+      })
+      expect(
+        restarted.store
+          .listAutomationRuns(remoteAutomation.id)
+          .some((run) => run.trigger === 'manual')
+      ).toBe(true)
+      restarted.store.freezeWrites()
+    }
+
+    const beforeOffline = readAgentHookSettingsFromProfileState(profile.location)
+    const offlineUpdate = updateAgentHookSettingsInProfileState(profile.location, false)
+    expect(offlineUpdate.settingsPath).toBe(profile.options.databaseFile)
+    expect(readAgentHookSettingsFromProfileState(profile.location).agentStatusHooksEnabled).toBe(
+      false
+    )
+
+    const afterOffline = reopen(profile)
+    const persisted = exportJson(afterOffline.store)
+    expect(afterOffline.store.getSettings().agentStatusHooksEnabled).toBe(false)
+    expect(afterOffline.store.getSettings().opencodeSessionCookie).toBe('fixture-secret')
+    expect(afterOffline.store.getWorkspaceSession('ssh:build-host').activeTabId).toBe('tab-remote')
+    expect(afterOffline.store.getFolderWorkspace(folderWorkspace.id)).toMatchObject({
+      folderPath: '/fixture/folder',
+      connectionId: 'build-host'
+    })
+    expect(afterOffline.store.listAutomationRuns('automation-fixture').length).toBeGreaterThan(8)
+    expect(
+      afterOffline.store
+        .listAutomations()
+        .find((automation) => automation.id === remoteAutomation.id)
+    ).toMatchObject({
+      executionTargetType: 'ssh',
+      executionTargetId: 'build-host',
+      schedulerOwner: 'ssh_bridge'
+    })
+    expect(afterOffline.store.listAutomationRuns(remoteAutomation.id)).toHaveLength(1)
+    expect(persisted).toHaveProperty('soakExtension', {
+      bytes: 'x'.repeat(96 * 1024),
+      nullable: null
+    })
+    expect(beforeOffline.agentStatusHooksEnabled).toBe(true)
+    expect(existsSync(profile.options.dataFile)).toBe(false)
+    expect(canonicalProfileStateJson(persisted)).not.toBe(canonicalProfileStateJson(initial))
+    afterOffline.store.freezeWrites()
+  })
+
+  it('switches between independent SQLite profiles without crossing state', () => {
+    const first = createProfile('switch-first', 'dark')
+    const second = createProfile('switch-second', 'light')
+    removeLegacyJson(first)
+    removeLegacyJson(second)
+    const firstInitial = reopen(first)
+    const firstInitialFontSize = firstInitial.store.getSettings().terminalFontSize
+    firstInitial.store.freezeWrites()
+    const secondInitial = reopen(second)
+    const secondInitialFontSize = secondInitial.store.getSettings().terminalFontSize
+    secondInitial.store.freezeWrites()
+
+    for (let round = 0; round < 6; round += 1) {
+      const active = round % 2 === 0 ? first : second
+      const inactive = active === first ? second : first
+      const activeStore = reopen(active)
+      activeStore.store.updateSettings({
+        theme: active === first ? 'dark' : 'light',
+        terminalFontSize: (active === first ? 100 : 200) + round
+      })
+      activeStore.store.flushOrThrow()
+      activeStore.store.freezeWrites()
+
+      const inactiveStore = reopen(inactive)
+      expect(inactiveStore.store.getSettings().terminalFontSize).toBe(
+        round === 0
+          ? inactive === first
+            ? firstInitialFontSize
+            : secondInitialFontSize
+          : (inactive === first ? 100 : 200) + round - 1
+      )
+      expect(inactiveStore.store.getWorkspaceSession().activeTabId).toBe('tab-local')
+      inactiveStore.store.freezeWrites()
+    }
+
+    const firstFinal = reopen(first)
+    const secondFinal = reopen(second)
+    expect(firstFinal.store.getSettings().terminalFontSize).toBe(104)
+    expect(secondFinal.store.getSettings().terminalFontSize).toBe(205)
+    expect(firstFinal.store.getSettings().opencodeSessionCookie).toBe('fixture-secret')
+    expect(secondFinal.store.getSettings().opencodeSessionCookie).toBe('fixture-secret')
+    firstFinal.store.freezeWrites()
+    secondFinal.store.freezeWrites()
+  })
+
+  it('allows one stale complete-document writer and rejects the rest', () => {
+    const profile = createProfile('soak-cas', 'light')
+    removeLegacyJson(profile)
+    const staleWriters = Array.from({ length: 7 }, () => reopen(profile))
+
+    for (const [index, writer] of staleWriters.entries()) {
+      writer.store.updateSettings({
+        theme: index % 2 === 0 ? 'dark' : 'light',
+        terminalFontSize: 100 + index
+      })
+    }
+
+    let commits = 0
+    let conflicts = 0
+    for (const writer of staleWriters) {
+      try {
+        writer.store.flushOrThrow()
+        commits += 1
+      } catch (error) {
+        if (
+          error instanceof Error &&
+          'code' in error &&
+          error.code === 'profile-state-revision-conflict'
+        ) {
+          conflicts += 1
+        } else {
+          throw error
+        }
+      } finally {
+        writer.store.freezeWrites()
+      }
+    }
+
+    expect(commits).toBe(1)
+    expect(conflicts).toBe(staleWriters.length - 1)
+    const verifier = reopen(profile)
+    expect(verifier.store.getSettings().terminalFontSize).toBe(100)
+    expect(verifier.store.getSettings().opencodeSessionCookie).toBe('fixture-secret')
+    expect(verifier.store.getWorkspaceSession('ssh:build-host').activeTabId).toBe('tab-remote')
+    expect(readFileSync(profile.options.databaseFile)).toBeTruthy()
+    verifier.store.freezeWrites()
+  })
+})
diff --git a/src/main/persistence/profile-state/legacy-json/README.md b/src/main/persistence/profile-state/legacy-json/README.md
new file mode 100644
index 000000000000..3dfa59378152
--- /dev/null
+++ b/src/main/persistence/profile-state/legacy-json/README.md
@@ -0,0 +1,34 @@
+# Legacy profile JSON
+
+SQLite is the only ordinary writable profile backend. This folder retains the
+`orca-data.json` compatibility boundary; it does not provide a second live store.
+
+| Code                                                                   | Purpose                                                                                                                                                                                |
+| ---------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `profile-state-legacy-import.ts`                                       | Normalize an old profile through a frozen Store, trying the old backup ring if the primary JSON is unreadable. Publication and secret-retention commit stay with the SQLite bootstrap. |
+| `profile-state-legacy-backup-path.ts`                                  | Recognize the five old `.bak` files for import and missing-authority checks. No live JSON backup rotation remains.                                                                     |
+| `profile-state-authority-exports.ts`                                   | Export a consistent SQLite snapshot for explicit export, clean shutdown, or profile maintenance.                                                                                       |
+| `profile-state-json-acceptance.ts`                                     | Record which exact JSON bytes SQLite accepts, including both sides of an interrupted compatibility export.                                                                             |
+| `profile-state-versioned-export.ts` and `profile-state-export-path.ts` | Publish immutable recovery exports and retain the latest five.                                                                                                                         |
+| `profile-state-recovery.ts`                                            | Restore explicitly selected JSON after archiving the database and recovery evidence. The next capable startup imports it back into SQLite.                                             |
+
+Old profiles may upgrade directly; no intermediate release is required. A copy
+source can still be read as JSON, but every profile changed by a transfer or an
+offline settings command must first establish SQLite authority.
+
+Clean shutdown and maintenance refresh compatibility JSON for older builds. A
+crash or failed export can leave an older snapshot. If an older build edits that
+file, startup refuses to choose silently between it and SQLite. The explicit
+`orca profile state rollback --current-json` command selects those edits and
+archives both copies; it does not merge divergent histories.
+
+Keep import and recovery while old profiles or backups remain supported. Removing
+automatic compatibility exports is a separate compatibility decision requiring a
+policy for older builds and recovery when a database is missing. Deleting the
+ordinary JSON writer does not justify deleting these safeguards.
+
+SQLite admission, transactions, row serialization, backups, and recovery command
+dispatch stay in the parent folder. In particular, JSON payloads in SQLite are
+its document representation, not a legacy file backend. Profile-index metadata,
+move journals, caches, wire messages, and external-tool settings are also outside
+this boundary.
diff --git a/src/main/persistence/profile-state/legacy-json/profile-state-authority-exports.ts b/src/main/persistence/profile-state/legacy-json/profile-state-authority-exports.ts
new file mode 100644
index 000000000000..0dc6f0d6e90b
--- /dev/null
+++ b/src/main/persistence/profile-state/legacy-json/profile-state-authority-exports.ts
@@ -0,0 +1,89 @@
+import { existsSync, mkdirSync, readFileSync } from 'node:fs'
+import { mkdir, readFile } from 'node:fs/promises'
+import { dirname } from 'node:path'
+import {
+  durableWriteTempPath,
+  writeFileDurable,
+  writeFileDurableSync
+} from '../../../durable-file-write'
+import {
+  readProfileStateSnapshot,
+  stageProfileStateJsonCompatibility,
+  acceptProfileStateJsonCompatibility
+} from '../profile-state-documents'
+import type Database from '../../../sqlite/sync-database'
+import { writeVersionedProfileStateExport } from './profile-state-versioned-export'
+import { ProfileStateRevisionConflictError } from '../profile-state-document-validation'
+
+function readExportSnapshot(db: Database.Database, expectedRevision?: number) {
+  const snapshot = readProfileStateSnapshot(db)
+  if (expectedRevision !== undefined && snapshot.revision !== expectedRevision) {
+    throw new ProfileStateRevisionConflictError(expectedRevision, snapshot.revision)
+  }
+  return snapshot
+}
+
+/** Publish a durable JSON rollback/compatibility export without changing authority. */
+export function writeProfileStateAuthorityJsonExport(
+  db: Database.Database,
+  targetPath: string,
+  expectedRevision?: number
+): number {
+  const snapshot = readExportSnapshot(db, expectedRevision)
+  mkdirSync(dirname(targetPath), { recursive: true })
+  writeFileDurableSync(durableWriteTempPath(targetPath), targetPath, snapshot.json)
+  return snapshot.revision
+}
+
+/** Stage both accepted versions before replacing canonical JSON for an older build. */
+export function writeProfileStateAuthorityCompatibilityExport(
+  db: Database.Database,
+  targetPath: string,
+  expectedRevision?: number
+): number | undefined {
+  const snapshot = readExportSnapshot(db, expectedRevision)
+  if (snapshot.revision === 0) {
+    return undefined
+  }
+  writeCompatibilityRecoveryExport(targetPath, snapshot)
+  const retained = existsSync(targetPath) ? readFileSync(targetPath, 'utf8') : undefined
+  mkdirSync(dirname(targetPath), { recursive: true })
+  stageProfileStateJsonCompatibility(db, snapshot.json, snapshot.revision, retained)
+  writeFileDurableSync(durableWriteTempPath(targetPath), targetPath, snapshot.json)
+  acceptProfileStateJsonCompatibility(db, snapshot.json, snapshot.revision)
+  return snapshot.revision
+}
+
+export async function writeProfileStateAuthorityCompatibilityExportAsync(
+  db: Database.Database,
+  targetPath: string,
+  expectedRevision?: number
+): Promise<number | undefined> {
+  const snapshot = readExportSnapshot(db, expectedRevision)
+  if (snapshot.revision === 0) {
+    return undefined
+  }
+  writeCompatibilityRecoveryExport(targetPath, snapshot)
+  const retained = await readFile(targetPath, 'utf8').catch((error: unknown) => {
+    if (error instanceof Error && 'code' in error && error.code === 'ENOENT') {
+      return undefined
+    }
+    throw error
+  })
+  await mkdir(dirname(targetPath), { recursive: true })
+  stageProfileStateJsonCompatibility(db, snapshot.json, snapshot.revision, retained)
+  await writeFileDurable(durableWriteTempPath(targetPath), targetPath, snapshot.json)
+  acceptProfileStateJsonCompatibility(db, snapshot.json, snapshot.revision)
+  return snapshot.revision
+}
+
+function writeCompatibilityRecoveryExport(
+  dataFile: string,
+  snapshot: { json: string; revision: number }
+): void {
+  writeVersionedProfileStateExport(dataFile, (path) => {
+    mkdirSync(dirname(path), { recursive: true })
+    writeFileDurableSync(durableWriteTempPath(path), path, snapshot.json)
+    return snapshot.revision
+  })
+}
diff --git a/src/main/persistence/profile-state/legacy-json/profile-state-export-path.ts b/src/main/persistence/profile-state/legacy-json/profile-state-export-path.ts
new file mode 100644
index 000000000000..34332e86fa0a
--- /dev/null
+++ b/src/main/persistence/profile-state/legacy-json/profile-state-export-path.ts
@@ -0,0 +1,36 @@
+import { existsSync, readdirSync } from 'node:fs'
+import { basename, dirname, join } from 'node:path'
+
+/** Return the immutable JSON artifact created when a profile first enters SQLite authority. */
+export function profileStateJsonExportPath(dataFile: string, revision: number): string {
+  if (!Number.isSafeInteger(revision) || revision < 1) {
+    throw new Error('Profile state export revision must be a positive safe integer')
+  }
+  return `${dataFile}.sqlite-export.${revision}.json`
+}
+
+/** List retained rollback exports newest-first without opening SQLite. */
+export function profileStateJsonExportPaths(dataFile: string): readonly string[] {
+  const directory = dirname(dataFile)
+  const prefix = `${basename(dataFile)}.sqlite-export.`
+  if (!existsSync(directory)) {
+    return []
+  }
+  return readdirSync(directory)
+    .flatMap((name) => {
+      const match = new RegExp(`^${escapeRegExp(prefix)}(\\d+)\\.json$`).exec(name)
+      if (match === null) {
+        return []
+      }
+      const revision = Number(match[1])
+      return Number.isSafeInteger(revision) && revision > 0
+        ? [{ path: join(directory, name), revision }]
+        : []
+    })
+    .sort((left, right) => right.revision - left.revision)
+    .map(({ path }) => path)
+}
+
+function escapeRegExp(value: string): string {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
+}
diff --git a/src/main/persistence/profile-state/legacy-json/profile-state-json-acceptance.ts b/src/main/persistence/profile-state/legacy-json/profile-state-json-acceptance.ts
new file mode 100644
index 000000000000..9c297485e0f2
--- /dev/null
+++ b/src/main/persistence/profile-state/legacy-json/profile-state-json-acceptance.ts
@@ -0,0 +1,153 @@
+import { withProfileStateWriteTransaction } from '../profile-state-write-transaction'
+import type Database from '../../../sqlite/sync-database'
+import { PROFILE_STATE_META_LEGACY_JSON_ACCEPTANCE } from '../profile-state-database-schema'
+import {
+  hashProfileStatePayload,
+  isRecord,
+  parseProfileStateRoot,
+  ProfileStateDocumentCorruptionError,
+  ProfileStateRevisionConflictError
+} from '../profile-state-document-validation'
+import { readProfileStateRevision } from '../profile-state-revision'
+
+type ProfileStateJsonAcceptanceVersion = {
+  jsonHash: string
+  acceptedRevision: number
+}
+
+export type ProfileStateJsonAcceptance = ProfileStateJsonAcceptanceVersion & {
+  pending?: ProfileStateJsonAcceptanceVersion
+}
+
+/** Read the source acceptance marker, if this database has one. */
+export function readProfileStateJsonAcceptance(
+  db: Database.Database
+): ProfileStateJsonAcceptance | undefined {
+  const row = db
+    .prepare('SELECT value FROM profile_state_meta WHERE key = ?')
+    .get(PROFILE_STATE_META_LEGACY_JSON_ACCEPTANCE)
+  if (row === undefined) {
+    return undefined
+  }
+  if (!isRecord(row) || typeof row.value !== 'string') {
+    throw new ProfileStateDocumentCorruptionError('Legacy JSON acceptance marker is invalid')
+  }
+  let parsed: unknown
+  try {
+    parsed = JSON.parse(row.value)
+  } catch {
+    throw new ProfileStateDocumentCorruptionError('Legacy JSON acceptance marker is invalid')
+  }
+  if (!isJsonAcceptanceVersion(parsed)) {
+    throw new ProfileStateDocumentCorruptionError('Legacy JSON acceptance marker is invalid')
+  }
+  let pending: ProfileStateJsonAcceptanceVersion | undefined
+  if ('pending' in parsed) {
+    if (
+      !isJsonAcceptanceVersion(parsed.pending) ||
+      parsed.pending.acceptedRevision < parsed.acceptedRevision
+    ) {
+      throw new ProfileStateDocumentCorruptionError('Legacy JSON acceptance marker is invalid')
+    }
+    pending = parsed.pending
+  }
+  return {
+    jsonHash: parsed.jsonHash,
+    acceptedRevision: parsed.acceptedRevision,
+    ...(pending === undefined ? {} : { pending })
+  }
+}
+
+function isJsonAcceptanceVersion(value: unknown): value is ProfileStateJsonAcceptanceVersion {
+  return (
+    isRecord(value) &&
+    typeof value.jsonHash === 'string' &&
+    /^[a-f0-9]{64}$/.test(value.jsonHash) &&
+    typeof value.acceptedRevision === 'number' &&
+    Number.isSafeInteger(value.acceptedRevision) &&
+    value.acceptedRevision >= 1
+  )
+}
+
+/** Accept either side of the upcoming JSON replacement before publishing it. */
+export function stageProfileStateJsonCompatibility(
+  db: Database.Database,
+  rawJson: string,
+  expectedRevision: number,
+  retainedJson?: string
+): void {
+  const retainedHash =
+    retainedJson === undefined ? undefined : hashProfileStatePayload(retainedJson)
+  updateProfileStateJsonAcceptance(db, rawJson, expectedRevision, (previous, next) => {
+    if (previous === undefined) {
+      return next
+    }
+    const retained =
+      retainedHash === undefined || retainedHash === previous.jsonHash
+        ? previous
+        : previous.pending?.jsonHash === retainedHash
+          ? previous.pending
+          : undefined
+    if (retained === undefined) {
+      throw new ProfileStateDocumentCorruptionError('Compatibility JSON changed before export')
+    }
+    return {
+      jsonHash: retained.jsonHash,
+      acceptedRevision: retained.acceptedRevision,
+      pending: next
+    }
+  })
+}
+
+/** Promote the staged JSON after publication; failures leave both versions accepted. */
+export function acceptProfileStateJsonCompatibility(
+  db: Database.Database,
+  rawJson: string,
+  expectedRevision: number
+): void {
+  updateProfileStateJsonAcceptance(db, rawJson, expectedRevision, (previous, next) => {
+    const staged = previous?.pending ?? previous
+    if (staged?.jsonHash !== next.jsonHash || staged.acceptedRevision !== next.acceptedRevision) {
+      throw new ProfileStateDocumentCorruptionError('Compatibility JSON export was not staged')
+    }
+    return next
+  })
+}
+
+function updateProfileStateJsonAcceptance(
+  db: Database.Database,
+  rawJson: string,
+  expectedRevision: number,
+  update: (
+    previous: ProfileStateJsonAcceptance | undefined,
+    next: ProfileStateJsonAcceptanceVersion
+  ) => ProfileStateJsonAcceptance
+): void {
+  parseProfileStateRoot(rawJson)
+  if (!Number.isSafeInteger(expectedRevision) || expectedRevision < 1) {
+    throw new ProfileStateDocumentCorruptionError(
+      'Compatibility JSON acceptance revision is invalid'
+    )
+  }
+  return withProfileStateWriteTransaction(db, () => {
+    const actualRevision = readProfileStateRevision(db)
+    if (actualRevision !== expectedRevision) {
+      throw new ProfileStateRevisionConflictError(expectedRevision, actualRevision)
+    }
+    const previous = readProfileStateJsonAcceptance(db)
+    if (
+      previous &&
+      (previous.pending?.acceptedRevision ?? previous.acceptedRevision) > actualRevision
+    ) {
+      throw new ProfileStateDocumentCorruptionError('Legacy JSON acceptance marker is invalid')
+    }
+    const marker = update(previous, {
+      jsonHash: hashProfileStatePayload(rawJson),
+      acceptedRevision: expectedRevision
+    })
+    db.prepare(
+      `INSERT INTO profile_state_meta (key, value) VALUES (?, ?)
+       ON CONFLICT(key) DO UPDATE SET value = excluded.value`
+    ).run(PROFILE_STATE_META_LEGACY_JSON_ACCEPTANCE, JSON.stringify(marker))
+  })
+}
diff --git a/src/main/persistence/profile-state/legacy-json/profile-state-legacy-backup-path.ts b/src/main/persistence/profile-state/legacy-json/profile-state-legacy-backup-path.ts
new file mode 100644
index 000000000000..ba222b61fd77
--- /dev/null
+++ b/src/main/persistence/profile-state/legacy-json/profile-state-legacy-backup-path.ts
@@ -0,0 +1,16 @@
+import { existsSync } from 'node:fs'
+
+export const PROFILE_STATE_LEGACY_BACKUP_COUNT = 5
+
+export function profileStateLegacyBackupPath(dataFile: string, index: number): string {
+  return `${dataFile}.bak.${index}`
+}
+
+export function hasStateBackup(dataFile: string): boolean {
+  for (let index = 0; index < PROFILE_STATE_LEGACY_BACKUP_COUNT; index += 1) {
+    if (existsSync(profileStateLegacyBackupPath(dataFile, index))) {
+      return true
+    }
+  }
+  return false
+}
diff --git a/src/main/persistence/profile-state/legacy-json/profile-state-legacy-import.ts b/src/main/persistence/profile-state/legacy-json/profile-state-legacy-import.ts
new file mode 100644
index 000000000000..9eb5219ee6b4
--- /dev/null
+++ b/src/main/persistence/profile-state/legacy-json/profile-state-legacy-import.ts
@@ -0,0 +1,42 @@
+import { existsSync, readFileSync } from 'node:fs'
+import { Store } from '../../loading-store/store'
+import type { ProfileStateStartupPaneAlias } from '../../loading-store/profile-state-authority'
+import { ProfileStateAuthorityBootstrapError } from '../profile-state-recovery-required'
+import {
+  PROFILE_STATE_LEGACY_BACKUP_COUNT,
+  profileStateLegacyBackupPath
+} from './profile-state-legacy-backup-path'
+
+export function prepareLegacyProfileState(dataFile: string, rawJson: string) {
+  try {
+    return prepareLegacySnapshot(dataFile, rawJson)
+  } catch (error) {
+    // Import the first usable legacy backup without overwriting the damaged source.
+    for (let index = 0; index < PROFILE_STATE_LEGACY_BACKUP_COUNT; index += 1) {
+      const path = profileStateLegacyBackupPath(dataFile, index)
+      if (!existsSync(path)) {
+        continue
+      }
+      try {
+        const prepared = prepareLegacySnapshot(dataFile, readFileSync(path, 'utf8'))
+        console.warn(`[profile-state] Recovered legacy state from ${path}`)
+        return prepared
+      } catch {
+        // A corrupt backup must not prevent trying the remaining legacy ring.
+      }
+    }
+    throw new ProfileStateAuthorityBootstrapError(
+      `Failed to load imported profile state or its legacy backups: ${dataFile}. ${error instanceof Error ? error.message : String(error)}`
+    )
+  }
+}
+
+function prepareLegacySnapshot(dataFile: string, serializedState: string) {
+  const unboundPaneAliases: ProfileStateStartupPaneAlias[] = []
+  const store = new Store({
+    dataFile,
+    serializedState,
+    collectUnboundPaneAlias: (entry) => unboundPaneAliases.push(entry)
+  })
+  return { prepared: store.prepareProfileStateExport(), unboundPaneAliases }
+}
diff --git a/src/main/persistence/profile-state/legacy-json/profile-state-recovery.ts b/src/main/persistence/profile-state/legacy-json/profile-state-recovery.ts
new file mode 100644
index 000000000000..c5ee44542983
--- /dev/null
+++ b/src/main/persistence/profile-state/legacy-json/profile-state-recovery.ts
@@ -0,0 +1,88 @@
+import { profileStateDatabaseFiles } from '../profile-state-storage-classification'
+import { existsSync, mkdirSync, readFileSync, rmSync } from 'node:fs'
+import { dirname } from 'node:path'
+import { parseProfileStateRoot } from '../profile-state-document-validation'
+import { durableWriteTempPath, writeFileDurableSync } from '../../../durable-file-write'
+import { bestEffortFsyncDirectorySync } from '../../../../shared/secure-file'
+import {
+  quarantineProfileStateDatabase,
+  type ProfileStateDatabaseQuarantine
+} from '../profile-state-database-quarantine'
+import { profileStateJsonExportPaths } from './profile-state-export-path'
+import { profileStateDatabaseBackupFiles } from '../profile-state-backup-path'
+import {
+  assertProfileStateMaintenance,
+  type ProfileStateMaintenance
+} from '../profile-state-access'
+
+export type ProfileStateJsonRecoveryOptions = {
+  maintenance: ProfileStateMaintenance
+  databasePath: string
+  dataFile: string
+  exportPath: string
+  profileId: string
+  quarantineRoot?: string
+  reason?: string
+  beforeRestore?: () => void
+}
+
+export type ProfileStateJsonRecovery = {
+  quarantine: ProfileStateDatabaseQuarantine
+  removedDatabaseFiles: readonly string[]
+}
+
+/** Restore an explicitly selected JSON export after preserving a failed SQLite authority. */
+export function restoreProfileStateJsonExport(
+  options: ProfileStateJsonRecoveryOptions
+): ProfileStateJsonRecovery {
+  assertProfileStateMaintenance(options.maintenance, options)
+  const rawJson = readRecoveryExport(options.exportPath)
+  const retainedExports = profileStateJsonExportPaths(options.dataFile)
+  const retainedBackups = profileStateDatabaseBackupFiles(options.databasePath)
+  const recoveryFiles = [options.exportPath, ...retainedExports, ...retainedBackups]
+  if (existsSync(options.dataFile)) {
+    recoveryFiles.push(options.dataFile)
+  }
+  const quarantine = quarantineProfileStateDatabase(
+    options.databasePath,
+    options.profileId,
+    options.quarantineRoot,
+    options.reason ?? 'profile-state-json-rollback',
+    recoveryFiles
+  )
+
+  // Invalidate authority-dependent caches while the database and recovery exports still exist.
+  options.beforeRestore?.()
+  mkdirSync(dirname(options.dataFile), { recursive: true })
+  writeFileDurableSync(durableWriteTempPath(options.dataFile), options.dataFile, rawJson)
+
+  const removedDatabaseFiles = profileStateDatabaseFiles(options.databasePath).filter((path) =>
+    existsSync(path)
+  )
+  for (const path of removedDatabaseFiles) {
+    rmSync(path)
+  }
+  // Removing the reserved exports completes the authority transition back to JSON. Keeping one
+  // would make established startup correctly reject the restored legacy state as a stale mirror.
+  const retainedArtifacts = [...retainedBackups, ...retainedExports]
+  for (const path of retainedArtifacts) {
+    if (path !== options.exportPath) {
+      rmSync(path)
+    }
+  }
+  // Keep the selected revision retryable until no reserved artifact can block JSON startup.
+  if (retainedArtifacts.includes(options.exportPath)) {
+    rmSync(options.exportPath)
+  }
+  bestEffortFsyncDirectorySync(dirname(options.databasePath))
+  return { quarantine, removedDatabaseFiles }
+}
+
+function readRecoveryExport(exportPath: string): string {
+  if (exportPath.length === 0 || exportPath.includes('\0')) {
+    throw new Error('Profile state recovery export path is invalid')
+  }
+  const rawJson = readFileSync(exportPath, 'utf8')
+  parseProfileStateRoot(rawJson)
+  return rawJson
+}
diff --git a/src/main/persistence/profile-state/legacy-json/profile-state-versioned-export.test.ts b/src/main/persistence/profile-state/legacy-json/profile-state-versioned-export.test.ts
new file mode 100644
index 000000000000..edf3050c976b
--- /dev/null
+++ b/src/main/persistence/profile-state/legacy-json/profile-state-versioned-export.test.ts
@@ -0,0 +1,113 @@
+import * as fs from 'node:fs'
+import { tmpdir } from 'node:os'
+import { basename, join } from 'node:path'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { durableWriteTempPath, writeFileDurableSync } from '../../../durable-file-write'
+import { profileStateJsonExportPath } from './profile-state-export-path'
+import { writeVersionedProfileStateExport } from './profile-state-versioned-export'
+
+vi.mock('node:fs', async (original) => ({ ...(await original<typeof fs>()) }))
+
+const roots: string[] = []
+afterEach(() => {
+  vi.restoreAllMocks()
+  for (const root of roots.splice(0)) {
+    fs.rmSync(root, { recursive: true, force: true })
+  }
+})
+
+function fixture() {
+  const root = fs.mkdtempSync(join(tmpdir(), 'orca-versioned-export-'))
+  roots.push(root)
+  const dataFile = join(root, 'orca-data.json')
+  const target = profileStateJsonExportPath(dataFile, 4)
+  const source = '{"settings":{"theme":"dark"}}'
+  const write = (revision = 4) =>
+    writeVersionedProfileStateExport(dataFile, (staging) => {
+      writeFileDurableSync(durableWriteTempPath(staging), staging, source)
+      return revision
+    })
+  return { root, target, source, write }
+}
+
+describe('immutable versioned profile exports', () => {
+  it('publishes once and accepts repeated identical exports', () => {
+    const { root, target, source, write } = fixture()
+    expect(write()).toBe(4)
+    expect(write()).toBe(4)
+    expect(fs.readFileSync(target, 'utf8')).toBe(source)
+    expect(fs.readdirSync(root)).toEqual([basename(target)])
+  })
+
+  it('retains only five successfully published exports and leaves unrelated entries alone', () => {
+    const { root, write } = fixture()
+    for (let revision = 1; revision <= 7; revision++) {
+      expect(write(revision)).toBe(revision)
+    }
+    const reservedDirectory = join(root, 'orca-data.json.sqlite-export.1.json')
+    fs.mkdirSync(reservedDirectory)
+    const unrelated = join(root, 'orca-data.json.sqlite-export.notes.json')
+    fs.writeFileSync(unrelated, 'keep')
+    write(8)
+    expect(fs.readdirSync(root).sort()).toEqual([
+      'orca-data.json.sqlite-export.1.json',
+      ...[4, 5, 6, 7, 8].map((revision) => `orca-data.json.sqlite-export.${revision}.json`),
+      'orca-data.json.sqlite-export.notes.json'
+    ])
+    expect(fs.lstatSync(reservedDirectory).isDirectory()).toBe(true)
+  })
+
+  it('preserves every recovery point when the next export fails', () => {
+    const { root, write } = fixture()
+    for (let revision = 1; revision <= 5; revision++) {
+      write(revision)
+    }
+    const retained = fs.readdirSync(root)
+    expect(() =>
+      writeVersionedProfileStateExport(join(root, 'orca-data.json'), () => {
+        throw new Error('disk full')
+      })
+    ).toThrow('disk full')
+    expect(fs.readdirSync(root)).toEqual(retained)
+  })
+
+  it('does not retain an empty profile export', () => {
+    const { root, write } = fixture()
+    expect(write(0)).toBeUndefined()
+    expect(fs.readdirSync(root)).toEqual([])
+  })
+
+  it.each(['identical', 'divergent'] as const)(
+    'preserves a concurrently published %s revision',
+    (kind) => {
+      const { root, target, source, write } = fixture()
+      const competing = kind === 'identical' ? source : '{"settings":{"theme":"light"}}'
+      let raced = false
+      const publishCompetitor = (path: fs.PathLike) => {
+        if (!raced && path === target) {
+          raced = true
+          fs.writeFileSync(target, competing)
+        }
+      }
+      const rename = fs.renameSync
+      vi.spyOn(fs, 'renameSync').mockImplementation((from, to) => {
+        publishCompetitor(to)
+        rename(from, to)
+      })
+      const link = fs.linkSync
+      vi.spyOn(fs, 'linkSync').mockImplementation((from, to) => {
+        publishCompetitor(to)
+        link(from, to)
+      })
+
+      if (kind === 'identical') {
+        expect(write()).toBe(4)
+      } else {
+        expect(write).toThrow('already exists with different content')
+      }
+      expect(raced).toBe(true)
+      expect(fs.readFileSync(target, 'utf8')).toBe(competing)
+      expect(fs.readdirSync(root)).toEqual([basename(target)])
+    }
+  )
+})
diff --git a/src/main/persistence/profile-state/legacy-json/profile-state-versioned-export.ts b/src/main/persistence/profile-state/legacy-json/profile-state-versioned-export.ts
new file mode 100644
index 000000000000..8947fb5c5b80
--- /dev/null
+++ b/src/main/persistence/profile-state/legacy-json/profile-state-versioned-export.ts
@@ -0,0 +1,52 @@
+import { lstatSync, mkdirSync, readFileSync, rmSync } from 'node:fs'
+import { dirname } from 'node:path'
+import { bestEffortFsyncDirectorySync, fsyncFileSync } from '../../../../shared/secure-file'
+import { durableWriteTempPath, publishFileDurableSync } from '../../../durable-file-write'
+import {
+  profileStateJsonExportPath,
+  profileStateJsonExportPaths
+} from './profile-state-export-path'
+
+/** An existing revision must never be replaced with different content. */
+export function writeVersionedProfileStateExport(
+  dataFile: string,
+  writeExport: (targetPath: string) => number
+): number | undefined {
+  const stagingPath = durableWriteTempPath(`${dataFile}.sqlite-export.pending`)
+  try {
+    const revision = writeExport(stagingPath)
+    if (revision === 0) {
+      return undefined
+    }
+    const targetPath = profileStateJsonExportPath(dataFile, revision)
+    mkdirSync(dirname(targetPath), { recursive: true })
+    if (!publishFileDurableSync(stagingPath, targetPath)) {
+      const staged = readFileSync(stagingPath)
+      const existing = readFileSync(targetPath)
+      if (!staged.equals(existing)) {
+        throw new Error(
+          `Profile state export revision ${revision} already exists with different content`
+        )
+      }
+      fsyncFileSync(targetPath)
+      bestEffortFsyncDirectorySync(dirname(targetPath))
+    }
+    pruneProfileStateJsonExports(dataFile)
+    return revision
+  } finally {
+    rmSync(stagingPath, { force: true })
+  }
+}
+
+function pruneProfileStateJsonExports(dataFile: string): void {
+  try {
+    const regularExports = profileStateJsonExportPaths(dataFile).filter((path) =>
+      lstatSync(path).isFile()
+    )
+    for (const path of regularExports.slice(5)) {
+      rmSync(path, { force: true })
+    }
+  } catch (error) {
+    console.warn('[persistence] Failed to prune retained JSON exports:', error)
+  }
+}
diff --git a/src/main/persistence/profile-state/profile-state-access-identity.test.ts b/src/main/persistence/profile-state/profile-state-access-identity.test.ts
new file mode 100644
index 000000000000..a55e8610444c
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-access-identity.test.ts
@@ -0,0 +1,101 @@
+import * as fs from 'node:fs'
+import { afterEach, beforeEach, expect, it, vi } from 'vitest'
+
+const native = vi.hoisted(() => ({
+  registry: vi.fn(),
+  creationTime: vi.fn()
+}))
+vi.mock('../../windows-native-registry', () => ({
+  WINDOWS_REG_SZ: 1,
+  loadWindowsNativeRegistry: () => ({ HK: { LM: 123 }, getRegistryKey: native.registry })
+}))
+vi.mock('../../windows/windows-process-table', () => ({
+  readWindowsProcessCreationTime: native.creationTime
+}))
+
+vi.mock('node:fs', async (importOriginal) => ({ ...(await importOriginal<typeof fs>()) }))
+
+const platform = Object.getOwnPropertyDescriptor(process, 'platform')
+
+beforeEach(() => {
+  vi.resetModules()
+  native.registry.mockReset()
+  native.creationTime.mockReset().mockReturnValue(null)
+})
+
+afterEach(() => {
+  vi.restoreAllMocks()
+  if (platform) {
+    Object.defineProperty(process, 'platform', platform)
+  }
+})
+
+it.each([
+  [
+    'AAAAAAAA-BBBB-4CCC-8DDD-EEEEEEEEEEEE',
+    'win32-machine-guid:aaaaaaaa-bbbb-4ccc-8ddd-eeeeeeeeeeee'
+  ],
+  ['00000000-0000-0000-0000-000000000000', null],
+  ['invalid-machine-id', null],
+  ['', null]
+] as const)('validates the Windows machine GUID %j', async (value, expected) => {
+  Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' })
+  native.registry.mockReturnValue({ MACHINEGUID: { type: 1, value } })
+  const { profileStateAccessMachineIdentity } = await import('./profile-state-access-identity')
+  expect(profileStateAccessMachineIdentity()).toBe(expected)
+  expect(profileStateAccessMachineIdentity()).toBe(expected)
+  expect(native.registry).toHaveBeenCalledExactlyOnceWith(123, 'SOFTWARE\\Microsoft\\Cryptography')
+})
+
+it.each([
+  null,
+  {},
+  { MachineGuid: { type: 4, value: 123 } },
+  { MachineGuid: { type: 1, value: [] } }
+])('keeps unavailable Windows machine identity unverifiable', async (values) => {
+  Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' })
+  native.registry.mockReturnValue(values)
+  const { profileStateAccessMachineIdentity } = await import('./profile-state-access-identity')
+  expect(profileStateAccessMachineIdentity()).toBeNull()
+})
+
+it('tolerates a denied registry query', async () => {
+  Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' })
+  native.registry.mockImplementation(() => {
+    throw new Error('access denied')
+  })
+  const { profileStateAccessMachineIdentity } = await import('./profile-state-access-identity')
+  expect(profileStateAccessMachineIdentity()).toBeNull()
+})
+
+it('caches only its own Windows creation time and leaves boot identity unavailable', async () => {
+  Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' })
+  native.creationTime.mockReturnValue(1_700_000_000_000)
+  const { profileStateAccessProcessIdentity, profileStateAccessBootIdentity } =
+    await import('./profile-state-access-identity')
+  expect(profileStateAccessBootIdentity()).toBeNull()
+  expect(profileStateAccessProcessIdentity(process.pid)).toBe('win32-creation-ms:1700000000000')
+  native.creationTime.mockReturnValue(1_800_000_000_000)
+  expect(profileStateAccessProcessIdentity(process.pid)).toBe('win32-creation-ms:1700000000000')
+  expect(profileStateAccessProcessIdentity(process.pid + 1)).toBe('win32-creation-ms:1800000000000')
+  native.creationTime.mockReturnValue(null)
+  expect(profileStateAccessProcessIdentity(process.pid + 1)).toBeNull()
+  expect(native.creationTime).toHaveBeenCalledTimes(3)
+})
+
+it.each([
+  ['8de277067b3544d4b65c267d0edab928\n', '8de277067b3544d4b65c267d0edab928'],
+  ['00000000000000000000000000000000', null],
+  ['uninitialized\n', null],
+  ['invalid-machine-id', null],
+  ['', null]
+] as const)('validates the Linux machine identity %j', async (contents, expected) => {
+  vi.resetModules()
+  Object.defineProperty(process, 'platform', { configurable: true, value: 'linux' })
+  const read = fs.readFileSync
+  vi.spyOn(fs, 'readFileSync').mockImplementation((path, options) =>
+    path === '/etc/machine-id' ? contents : read(path, options)
+  )
+  const { profileStateAccessMachineIdentity } = await import('./profile-state-access-identity')
+  expect(profileStateAccessMachineIdentity()).toBe(expected)
+})
diff --git a/src/main/persistence/profile-state/profile-state-access-identity.ts b/src/main/persistence/profile-state/profile-state-access-identity.ts
new file mode 100644
index 000000000000..a36f220923b8
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-access-identity.ts
@@ -0,0 +1,105 @@
+import { readFileSync } from 'node:fs'
+import { runProcessSync } from '../../../shared/child-process/run-process'
+import { parseLinuxProcStartTicks } from '../../daemon/daemon-process-start-time'
+import { getPsProcessIdentity } from '../../daemon/daemon-process-identity-query'
+import { loadWindowsNativeRegistry, WINDOWS_REG_SZ } from '../../windows-native-registry'
+import { readWindowsProcessCreationTime } from '../../windows/windows-process-table'
+
+let bootIdentity: string | null | undefined
+let machineIdentity: string | null | undefined
+let ownProcessIdentity: string | null | undefined
+
+/** A boot change proves exit only when the record belongs to this machine. */
+export function profileStateAccessMachineIdentity(): string | null {
+  if (machineIdentity !== undefined) {
+    return machineIdentity
+  }
+  machineIdentity = null
+  try {
+    if (process.platform === 'linux') {
+      const value = readFileSync('/etc/machine-id', 'utf8').trim()
+      machineIdentity = /^[a-f0-9]{32}$/.test(value) && !/^0+$/.test(value) ? value : null
+    } else if (process.platform === 'win32') {
+      const registry = loadWindowsNativeRegistry()
+      const values = registry.getRegistryKey(registry.HK.LM, 'SOFTWARE\\Microsoft\\Cryptography')
+      const entry = Object.entries(values ?? {}).find(
+        ([name]) => name.toLowerCase() === 'machineguid'
+      )?.[1]
+      const value =
+        entry?.type === WINDOWS_REG_SZ && typeof entry.value === 'string'
+          ? entry.value.trim().toLowerCase()
+          : ''
+      machineIdentity =
+        /^[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12}$/.test(value) &&
+        value !== '00000000-0000-0000-0000-000000000000'
+          ? `win32-machine-guid:${value}`
+          : null
+    } else if (process.platform === 'darwin') {
+      const result = runProcessSync({
+        program: '/usr/sbin/sysctl',
+        args: ['-n', 'kern.hostuuid'],
+        timeoutMs: 1_000,
+        maxOutputBytes: 1024
+      })
+      machineIdentity = result.code === 0 ? result.stdout.trim() || null : null
+    }
+  } catch {
+    // Missing machine identity cannot establish ownership across a reboot.
+  }
+  return machineIdentity
+}
+
+/** A kernel boot UUID survives hostname changes without conflating machines sharing a profile. */
+export function profileStateAccessBootIdentity(): string | null {
+  if (bootIdentity !== undefined) {
+    return bootIdentity
+  }
+  bootIdentity = null
+  try {
+    if (process.platform === 'linux') {
+      bootIdentity = readFileSync('/proc/sys/kernel/random/boot_id', 'utf8').trim() || null
+    } else if (process.platform === 'darwin') {
+      const result = runProcessSync({
+        program: '/usr/sbin/sysctl',
+        args: ['-n', 'kern.bootsessionuuid'],
+        timeoutMs: 1_000,
+        maxOutputBytes: 1024
+      })
+      bootIdentity = result.code === 0 ? result.stdout.trim() || null : null
+    }
+  } catch {
+    // Unavailable identity leaves the conservative hostname and PID checks in force.
+  }
+  return bootIdentity
+}
+
+export function profileStateAccessProcessIdentity(pid: number): string | null {
+  if (pid !== process.pid) {
+    return readProcessIdentity(pid)
+  }
+  if (ownProcessIdentity === undefined) {
+    ownProcessIdentity = readProcessIdentity(pid)
+  }
+  return ownProcessIdentity
+}
+
+function readProcessIdentity(pid: number): string | null {
+  if (process.platform === 'win32') {
+    const startedAtMs = readWindowsProcessCreationTime(pid)
+    return startedAtMs === null ? null : `win32-creation-ms:${startedAtMs}`
+  }
+  if (process.platform === 'linux') {
+    try {
+      const ticks = parseLinuxProcStartTicks(readFileSync(`/proc/${pid}/stat`, 'utf8'))
+      return Number.isSafeInteger(ticks) && ticks >= 0 ? `linux-start-ticks:${ticks}` : null
+    } catch {
+      return null
+    }
+  }
+  if (process.platform !== 'darwin') {
+    return null
+  }
+  const startedAtMs = getPsProcessIdentity(pid, { utc: true })?.startedAtMs
+  // Local wall times are ambiguous during daylight-saving transitions.
+  return startedAtMs == null ? null : `darwin-utc-start-ms:${startedAtMs}`
+}
diff --git a/src/main/persistence/profile-state/profile-state-access-owner.ts b/src/main/persistence/profile-state/profile-state-access-owner.ts
new file mode 100644
index 000000000000..49d2960c6a35
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-access-owner.ts
@@ -0,0 +1,318 @@
+import { randomUUID } from 'node:crypto'
+import {
+  lstatSync,
+  mkdirSync,
+  readFileSync,
+  readlinkSync,
+  readdirSync,
+  realpathSync,
+  rmdirSync,
+  unlinkSync,
+  writeFileSync
+} from 'node:fs'
+import { hostname } from 'node:os'
+import { dirname, join } from 'node:path'
+import { bestEffortFsyncDirectorySync, fsyncFileSync } from '../../../shared/secure-file'
+import { renameFileWithWindowsRetry } from '../../codex-accounts/fs-utils'
+import {
+  START_TIME_TOLERANCE_MS,
+  startTimesWithinTolerance
+} from '../../daemon/daemon-process-start-time'
+import {
+  profileStateAccessBootIdentity,
+  profileStateAccessMachineIdentity,
+  profileStateAccessProcessIdentity
+} from './profile-state-access-identity'
+
+export class ProfileStateAccessError extends Error {
+  readonly code = 'profile-state-access-refused' as const
+
+  constructor(message: string) {
+    super(message)
+    this.name = 'ProfileStateAccessError'
+  }
+}
+
+export type ProfileStateAccessPaths = ReturnType<typeof profileStateAccessPaths>
+
+export function profileStateAccessPaths(userDataPath: string) {
+  mkdirSync(userDataPath, { recursive: true, mode: 0o700 })
+  const root = join(realpathSync(userDataPath), '.profile-state-access')
+  const paths = {
+    root,
+    participants: join(root, 'participants'),
+    candidates: join(root, 'candidates'),
+    maintenance: join(root, 'maintenance')
+  }
+  for (const path of [root, paths.participants, paths.candidates]) {
+    mkdirSync(path, { recursive: true, mode: 0o700 })
+  }
+  return paths
+}
+
+export const PROFILE_STATE_ACCESS_TOKEN = /^[a-f0-9-]{36}$/
+
+type AccessOwner = {
+  token: string
+  pid: number
+  host: string
+  platform: string
+  pidNamespace: string | null
+  bootIdentity?: string | null
+  machineIdentity?: string | null
+  processStartIdentity?: string | null
+}
+
+export function profileStateAccessPidNamespace(): string | null {
+  if (process.platform !== 'linux') {
+    return null
+  }
+  try {
+    return readlinkSync('/proc/self/ns/pid')
+  } catch {
+    return null
+  }
+}
+
+function readOwner(path: string): AccessOwner | undefined {
+  try {
+    if (!lstatSync(path).isFile()) {
+      throw new ProfileStateAccessError(`Profile state owner is not a regular file: ${path}`)
+    }
+    const owner: unknown = JSON.parse(readFileSync(path, 'utf8'))
+    if (
+      typeof owner === 'object' &&
+      owner !== null &&
+      'token' in owner &&
+      typeof owner.token === 'string' &&
+      PROFILE_STATE_ACCESS_TOKEN.test(owner.token) &&
+      'pid' in owner &&
+      typeof owner.pid === 'number' &&
+      Number.isSafeInteger(owner.pid) &&
+      owner.pid > 0 &&
+      'host' in owner &&
+      typeof owner.host === 'string' &&
+      owner.host.length > 0 &&
+      'platform' in owner &&
+      typeof owner.platform === 'string' &&
+      'pidNamespace' in owner &&
+      (owner.pidNamespace === null || typeof owner.pidNamespace === 'string')
+    ) {
+      return {
+        token: owner.token,
+        pid: owner.pid,
+        host: owner.host,
+        platform: owner.platform,
+        pidNamespace: owner.pidNamespace,
+        bootIdentity:
+          'bootIdentity' in owner && typeof owner.bootIdentity === 'string'
+            ? owner.bootIdentity
+            : null,
+        machineIdentity:
+          'machineIdentity' in owner && typeof owner.machineIdentity === 'string'
+            ? owner.machineIdentity
+            : null,
+        processStartIdentity:
+          'processStartIdentity' in owner &&
+          typeof owner.processStartIdentity === 'string' &&
+          /^(?:(?:linux-start-ticks|darwin-utc-start-ms|wall-time-ms):\d+|win32-creation-ms:[1-9]\d*)$/.test(
+            owner.processStartIdentity
+          ) &&
+          Number.isSafeInteger(Number(owner.processStartIdentity.split(':')[1]))
+            ? owner.processStartIdentity
+            : null
+      }
+    }
+  } catch (error) {
+    if (hasCode(error, 'ENOENT')) {
+      return undefined
+    }
+    throw new ProfileStateAccessError(`Profile state ownership is unverifiable: ${path}`)
+  }
+  throw new ProfileStateAccessError(`Profile state ownership is malformed: ${path}`)
+}
+
+function ownerExited(owner: AccessOwner): boolean {
+  const currentBoot = profileStateAccessBootIdentity()
+  const currentMachine = profileStateAccessMachineIdentity()
+  const sameBoot = Boolean(owner.bootIdentity && owner.bootIdentity === currentBoot)
+  const sameMachine = Boolean(owner.machineIdentity && owner.machineIdentity === currentMachine)
+  const sameHost = owner.host === hostname()
+  // Windows has no boot UUID to verify a renamed host.
+  if (
+    (process.platform === 'win32' && !sameHost) ||
+    (!sameBoot && !sameHost) ||
+    owner.platform !== process.platform ||
+    (!sameBoot && owner.machineIdentity && currentMachine && !sameMachine)
+  ) {
+    return false
+  }
+  if (
+    sameHost &&
+    sameMachine &&
+    owner.bootIdentity &&
+    currentBoot &&
+    owner.bootIdentity !== currentBoot
+  ) {
+    return true
+  }
+  // Windows/WSL and Linux PID namespaces cannot establish each other's process absence.
+  if (
+    process.platform === 'linux' &&
+    (owner.pidNamespace === null || owner.pidNamespace !== profileStateAccessPidNamespace())
+  ) {
+    return false
+  }
+  try {
+    process.kill(owner.pid, 0)
+  } catch (error) {
+    return hasCode(error, 'ESRCH')
+  }
+  const recordedStart = owner.processStartIdentity
+  // GetProcessTimes records an absolute creation time, so it also detects reuse after reboot.
+  const canCompareStart = sameBoot || (process.platform === 'win32' && sameMachine && sameHost)
+  const actualStart =
+    !canCompareStart || recordedStart == null ? null : profileStateAccessProcessIdentity(owner.pid)
+  return (
+    actualStart !== null &&
+    recordedStart != null &&
+    actualStart.split(':')[0] === recordedStart.split(':')[0] &&
+    (actualStart.startsWith('darwin-utc-start-ms:')
+      ? !startTimesWithinTolerance(
+          Number(actualStart.split(':')[1]),
+          Number(recordedStart.split(':')[1]),
+          START_TIME_TOLERANCE_MS
+        )
+      : actualStart !== recordedStart)
+  )
+}
+
+export function hasCode(error: unknown, code: string): boolean {
+  return typeof error === 'object' && error !== null && 'code' in error && error.code === code
+}
+
+export function removeOwnerEntry(path: string): void {
+  try {
+    unlinkSync(path)
+  } catch (error) {
+    if (!hasCode(error, 'ENOENT')) {
+      throw error
+    }
+  }
+}
+
+function removeEmptyOwnerDirectory(path: string): void {
+  try {
+    rmdirSync(path)
+  } catch (error) {
+    if (!['ENOENT', 'ENOTEMPTY', 'EEXIST', 'EBUSY'].some((code) => hasCode(error, code))) {
+      throw error
+    }
+  }
+}
+
+/** Only remove immutable entries whose owner is positively known to have exited. */
+export function reclaimExitedOwner(path: string): void {
+  let entries: string[]
+  try {
+    if (!lstatSync(path).isDirectory()) {
+      throw new ProfileStateAccessError(`Profile state owner is not a directory: ${path}`)
+    }
+    entries = readdirSync(path)
+  } catch (error) {
+    if (hasCode(error, 'ENOENT')) {
+      return
+    }
+    throw error
+  }
+  for (const entry of entries) {
+    const token = entry.endsWith('.owner') ? entry.slice(0, -6) : ''
+    if (!PROFILE_STATE_ACCESS_TOKEN.test(token)) {
+      throw new ProfileStateAccessError(`Profile state ownership is unverifiable: ${path}`)
+    }
+    const owner = readOwner(join(path, entry))
+    if (owner === undefined) {
+      continue
+    }
+    if (owner.token !== token || !ownerExited(owner)) {
+      throw new ProfileStateAccessError(
+        `Profile state is in use or its owner is unverifiable: ${path}. Stop Orca and orcad on every host using this profile, then retry. If this remains, verify PID ${owner.pid} on ${owner.host} has exited before removing its owner entry ${join(path, entry)}.`
+      )
+    }
+    removeOwnerEntry(join(path, entry))
+  }
+  // A replacement owner keeps the directory nonempty, even if our observation is stale.
+  removeEmptyOwnerDirectory(path)
+}
+
+export function publishAccessOwner(paths: ProfileStateAccessPaths, exclusive: boolean) {
+  const token = randomUUID()
+  const candidate = join(paths.candidates, token)
+  const target = exclusive ? paths.maintenance : join(paths.participants, token)
+  const entry = `${token}.owner`
+  mkdirSync(candidate, { mode: 0o700 })
+  let published = false
+  try {
+    writeFileSync(
+      join(candidate, entry),
+      JSON.stringify({
+        token,
+        pid: process.pid,
+        host: hostname(),
+        platform: process.platform,
+        pidNamespace: profileStateAccessPidNamespace(),
+        bootIdentity: profileStateAccessBootIdentity(),
+        machineIdentity: profileStateAccessMachineIdentity(),
+        processStartIdentity: profileStateAccessProcessIdentity(process.pid)
+      }),
+      {
+        flag: 'wx',
+        mode: 0o600
+      }
+    )
+    fsyncFileSync(join(candidate, entry))
+    bestEffortFsyncDirectorySync(candidate)
+    for (let attempt = 0; ; attempt += 1) {
+      try {
+        renameFileWithWindowsRetry(candidate, target)
+        published = true
+        break
+      } catch (error) {
+        if (!exclusive || attempt >= 2) {
+          throw error
+        }
+        reclaimExitedOwner(target)
+      }
+    }
+    bestEffortFsyncDirectorySync(dirname(target))
+    bestEffortFsyncDirectorySync(paths.candidates)
+  } catch (error) {
+    if (published) {
+      removeOwnerEntry(join(target, entry))
+      removeEmptyOwnerDirectory(target)
+    }
+    throw error
+  } finally {
+    if (!published) {
+      removeOwnerEntry(join(candidate, entry))
+      removeEmptyOwnerDirectory(candidate)
+    }
+  }
+  let released = false
+  return {
+    token,
+    assertActive(): void {
+      if (released || readOwner(join(target, entry))?.token !== token) {
+        throw new ProfileStateAccessError('Profile state access has already been released')
+      }
+    },
+    release(): void {
+      if (released) {
+        return
+      }
+      removeOwnerEntry(join(target, entry))
+      removeEmptyOwnerDirectory(target)
+      released = true
+    }
+  }
+}
diff --git a/src/main/persistence/profile-state/profile-state-access-process.test.ts b/src/main/persistence/profile-state/profile-state-access-process.test.ts
new file mode 100644
index 000000000000..eef48007bf1d
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-access-process.test.ts
@@ -0,0 +1,150 @@
+import { once } from 'node:events'
+import { mkdtempSync, readdirSync, rmSync, utimesSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join, resolve } from 'node:path'
+import { buildSync } from 'esbuild'
+import { afterAll, afterEach, beforeAll, describe, expect, it } from 'vitest'
+import { spawnProcess } from '../../../shared/child-process/run-process'
+import {
+  acquireProfileStateMaintenance,
+  acquireProfileStateRuntimeAdmission
+} from './profile-state-access'
+import { profileStateAccessPaths } from './profile-state-access-owner'
+
+const fixture = mkdtempSync(join(tmpdir(), 'orca-state-access-process-'))
+const bundle = join(fixture, 'access.cjs')
+const children = new Set<ReturnType<typeof spawnProcess>>()
+
+beforeAll(() => {
+  buildSync({
+    entryPoints: [resolve(__dirname, 'profile-state-access.ts')],
+    outfile: bundle,
+    bundle: true,
+    platform: 'node',
+    format: 'cjs',
+    packages: 'external'
+  })
+})
+
+afterEach(async () => {
+  await Promise.all([...children].map(stopChild))
+})
+
+afterAll(() => rmSync(fixture, { recursive: true, force: true }))
+
+async function stopChild(child: ReturnType<typeof spawnProcess>): Promise<void> {
+  children.delete(child)
+  if (child.exitCode !== null || child.signalCode !== null) {
+    return
+  }
+  const closed = once(child, 'close')
+  child.kill('SIGKILL')
+  await closed
+}
+
+const CHILD_SOURCE = `
+const fs = require('node:fs')
+const [root, bundle, mode] = process.argv.slice(1)
+const rename = fs.renameSync
+if (mode === 'candidate' || mode === 'published') {
+  fs.renameSync = (from, to) => {
+    if (mode === 'candidate' && String(to).endsWith('maintenance')) {
+      fs.writeSync(1, 'barrier\\n')
+      fs.readSync(0, Buffer.alloc(1), 0, 1)
+    }
+    rename(from, to)
+    if (mode === 'published' && String(to).includes('participants')) {
+      fs.writeSync(1, 'barrier\\n')
+      fs.readSync(0, Buffer.alloc(1), 0, 1)
+    }
+  }
+}
+const access = require(bundle)
+const owner = mode === 'runtime' || mode === 'published'
+  ? access.acquireProfileStateRuntimeAdmission(root)
+  : access.acquireProfileStateMaintenance(root)
+fs.writeSync(1, 'ready\\n')
+process.stdin.resume()
+`
+
+async function startChild(root: string, mode: string): Promise<ReturnType<typeof spawnProcess>> {
+  const child = spawnProcess({
+    program: process.execPath,
+    args: ['-e', CHILD_SOURCE, root, bundle, mode],
+    env: { ...process.env, ORCA_BACKGROUND_LAUNCH: '1' }
+  })
+  children.add(child)
+  let stderr = ''
+  child.stderr.on('data', (chunk: Buffer) => {
+    stderr += chunk.toString()
+  })
+  await new Promise<void>((resolveReady, reject) => {
+    let stdout = ''
+    const onData = (chunk: Buffer) => {
+      stdout += chunk.toString()
+      if (stdout.includes('ready\n') || stdout.includes('barrier\n')) {
+        cleanup()
+        resolveReady()
+      }
+    }
+    const onExit = () => {
+      cleanup()
+      reject(new Error(`Owner child exited before its barrier: ${stderr}`))
+    }
+    const onError = (error: Error) => {
+      cleanup()
+      reject(error)
+    }
+    const cleanup = () => {
+      child.stdout.off('data', onData)
+      child.off('exit', onExit)
+      child.off('error', onError)
+    }
+    child.stdout.on('data', onData)
+    child.once('exit', onExit)
+    child.once('error', onError)
+  })
+  return child
+}
+
+describe('profile state owners across actual process death', () => {
+  it('excludes recovery while a runtime lives and reclaims its registration after SIGKILL', async () => {
+    const root = join(fixture, 'runtime')
+    const child = await startChild(root, 'runtime')
+    expect(() => acquireProfileStateMaintenance(root)).toThrow('in use')
+    await stopChild(child)
+    const maintenance = acquireProfileStateMaintenance(root)
+    expect(readdirSync(profileStateAccessPaths(root).participants)).toEqual([])
+    maintenance.release()
+  })
+
+  it('never steals a live maintenance owner with arbitrarily old timestamps', async () => {
+    const root = join(fixture, 'maintenance')
+    const child = await startChild(root, 'maintenance')
+    const gate = profileStateAccessPaths(root).maintenance
+    for (const file of readdirSync(gate)) {
+      utimesSync(join(gate, file), 0, 0)
+    }
+    utimesSync(gate, 0, 0)
+    expect(() => acquireProfileStateRuntimeAdmission(root)).toThrow('in use')
+    expect(() => acquireProfileStateMaintenance(root)).toThrow('in use')
+    await stopChild(child)
+    acquireProfileStateRuntimeAdmission(root).release()
+  })
+
+  it('treats a crash before complete owner publication as an inert candidate', async () => {
+    const root = join(fixture, 'candidate')
+    const child = await startChild(root, 'candidate')
+    acquireProfileStateRuntimeAdmission(root).release()
+    await stopChild(child)
+    acquireProfileStateMaintenance(root).release()
+  })
+
+  it('excludes recovery after participant publication even before runtime admission finishes', async () => {
+    const root = join(fixture, 'published')
+    const child = await startChild(root, 'published')
+    expect(() => acquireProfileStateMaintenance(root)).toThrow('in use')
+    await stopChild(child)
+    acquireProfileStateMaintenance(root).release()
+  })
+})
diff --git a/src/main/persistence/profile-state/profile-state-access-windows-native.win32.test.ts b/src/main/persistence/profile-state/profile-state-access-windows-native.win32.test.ts
new file mode 100644
index 000000000000..963bd5d48b7d
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-access-windows-native.win32.test.ts
@@ -0,0 +1,56 @@
+import { randomUUID } from 'node:crypto'
+import { existsSync, mkdirSync, mkdtempSync, writeFileSync } from 'node:fs'
+import { hostname, tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { expect, it } from 'vitest'
+import { readWindowsProcessCreationTime } from '../../windows/windows-process-table'
+import {
+  acquireProfileStateMaintenance,
+  acquireProfileStateRuntimeAdmission
+} from './profile-state-access'
+import { profileStateAccessMachineIdentity } from './profile-state-access-identity'
+import { profileStateAccessPaths } from './profile-state-access-owner'
+import { removeTreeSync } from '../../../shared/windows-transient-lock-removal'
+
+it.runIf(process.platform === 'win32')(
+  'reclaims a previous Windows PID incarnation and retains the live owner using native identities',
+  () => {
+    const startedAt = readWindowsProcessCreationTime(process.pid)
+    const machine = profileStateAccessMachineIdentity()
+    expect(startedAt).toBeGreaterThan(0)
+    expect(machine).toMatch(/^win32-machine-guid:/)
+    if (startedAt === null) {
+      throw new Error('Native process creation-time capability is required')
+    }
+    const root = mkdtempSync(join(tmpdir(), 'orca-profile-owner-native-'))
+    try {
+      const maintenance = profileStateAccessPaths(root).maintenance
+      mkdirSync(maintenance)
+      const token = randomUUID()
+      const entry = join(maintenance, `${token}.owner`)
+      writeFileSync(
+        entry,
+        JSON.stringify({
+          token,
+          pid: process.pid,
+          host: hostname(),
+          platform: 'win32',
+          pidNamespace: null,
+          bootIdentity: null,
+          machineIdentity: machine,
+          processStartIdentity: `win32-creation-ms:${startedAt - 1}`
+        })
+      )
+      const admission = acquireProfileStateRuntimeAdmission(root)
+      try {
+        expect(existsSync(entry)).toBe(false)
+        expect(() => acquireProfileStateMaintenance(root)).toThrow('unverifiable')
+      } finally {
+        admission.release()
+      }
+      acquireProfileStateMaintenance(root).release()
+    } finally {
+      removeTreeSync(root)
+    }
+  }
+)
diff --git a/src/main/persistence/profile-state/profile-state-access-windows.test.ts b/src/main/persistence/profile-state/profile-state-access-windows.test.ts
new file mode 100644
index 000000000000..02d210523e04
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-access-windows.test.ts
@@ -0,0 +1,228 @@
+import { randomUUID } from 'node:crypto'
+import {
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  readdirSync,
+  rmSync,
+  writeFileSync
+} from 'node:fs'
+import { hostname, tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, expect, it, vi } from 'vitest'
+import {
+  acquireProfileStateMaintenance,
+  acquireProfileStateRuntimeAdmission
+} from './profile-state-access'
+import { profileStateAccessPaths } from './profile-state-access-owner'
+
+const identity = vi.hoisted(() => ({
+  boot: vi.fn(),
+  machine: vi.fn(),
+  process: vi.fn()
+}))
+vi.mock('./profile-state-access-identity', () => ({
+  profileStateAccessBootIdentity: identity.boot,
+  profileStateAccessMachineIdentity: identity.machine,
+  profileStateAccessProcessIdentity: identity.process
+}))
+
+const platform = Object.getOwnPropertyDescriptor(process, 'platform')
+let root: string
+
+beforeEach(() => {
+  root = mkdtempSync(join(tmpdir(), 'orca-state-access-windows-'))
+  Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' })
+  identity.boot.mockReset().mockReturnValue(null)
+  identity.machine.mockReset().mockReturnValue('win32-machine-guid:this-machine')
+  identity.process.mockReset().mockReturnValue('win32-creation-ms:2000')
+  vi.spyOn(process, 'kill').mockReturnValue(true)
+})
+
+afterEach(() => {
+  vi.restoreAllMocks()
+  if (platform) {
+    Object.defineProperty(process, 'platform', platform)
+  }
+  rmSync(root, { recursive: true, force: true })
+})
+
+function writeOwner(overrides: Record<string, unknown> = {}, exclusive = true): string {
+  const paths = profileStateAccessPaths(root)
+  const token = randomUUID()
+  const directory = exclusive ? paths.maintenance : join(paths.participants, token)
+  mkdirSync(directory)
+  const path = join(directory, `${token}.owner`)
+  writeFileSync(
+    path,
+    JSON.stringify({
+      token,
+      pid: 12345,
+      host: hostname(),
+      platform: 'win32',
+      pidNamespace: null,
+      bootIdentity: null,
+      machineIdentity: 'win32-machine-guid:this-machine',
+      processStartIdentity: 'win32-creation-ms:1000',
+      ...overrides
+    })
+  )
+  return path
+}
+
+it('records the machine and native creation time before publishing a runtime admission', () => {
+  const admission = acquireProfileStateRuntimeAdmission(root)
+  const participants = profileStateAccessPaths(root).participants
+  const token = readdirSync(participants)[0]
+  expect(
+    JSON.parse(readFileSync(join(participants, token, `${token}.owner`), 'utf8'))
+  ).toMatchObject({
+    pid: process.pid,
+    platform: 'win32',
+    machineIdentity: 'win32-machine-guid:this-machine',
+    processStartIdentity: 'win32-creation-ms:2000',
+    bootIdentity: null
+  })
+  admission.release()
+})
+
+it.each([true, false])(
+  'reclaims a reused PID on the same machine without a boot UUID: maintenance=%s',
+  (exclusive) => {
+    const path = writeOwner({}, exclusive)
+    acquireProfileStateMaintenance(root).release()
+    expect(existsSync(path)).toBe(false)
+    expect(identity.process).toHaveBeenCalledWith(12345)
+  }
+)
+
+it('lets runtime startup recover a stale maintenance owner', () => {
+  const path = writeOwner()
+  acquireProfileStateRuntimeAdmission(root).release()
+  expect(existsSync(path)).toBe(false)
+})
+
+it('uses exact creation times even for reuse within the POSIX timestamp tolerance', () => {
+  const path = writeOwner({ processStartIdentity: 'win32-creation-ms:1999' })
+  acquireProfileStateMaintenance(root).release()
+  expect(existsSync(path)).toBe(false)
+})
+
+it('keeps an unchanged process alive across wall-clock changes', () => {
+  const path = writeOwner({ processStartIdentity: 'win32-creation-ms:2000' })
+  vi.spyOn(Date, 'now').mockReturnValue(9_000_000)
+  expect(() => acquireProfileStateMaintenance(root)).toThrow('unverifiable')
+  expect(existsSync(path)).toBe(true)
+})
+
+it('can reclaim after reboot using the stored absolute creation time', () => {
+  const path = writeOwner({ processStartIdentity: 'win32-creation-ms:1700000000000' })
+  identity.process.mockReturnValue('win32-creation-ms:1800000000000')
+  acquireProfileStateMaintenance(root).release()
+  expect(existsSync(path)).toBe(false)
+})
+
+it.each([
+  { host: 'previous-hostname' },
+  { machineIdentity: 'win32-machine-guid:another-machine' },
+  { platform: 'linux' }
+])(
+  'keeps another or unverifiable execution host even when the PID is absent locally: %j',
+  (record) => {
+    const path = writeOwner(record)
+    vi.mocked(process.kill).mockImplementation(() => {
+      throw Object.assign(new Error('absent'), { code: 'ESRCH' })
+    })
+    expect(() => acquireProfileStateMaintenance(root)).toThrow('unverifiable')
+    expect(process.kill).not.toHaveBeenCalled()
+    expect(existsSync(path)).toBe(true)
+  }
+)
+
+it('cannot identify another host from a cloned machine GUID and a renamed hostname', () => {
+  const path = writeOwner({ host: 'other-host-with-cloned-guid' })
+  expect(() => acquireProfileStateMaintenance(root)).toThrow('unverifiable')
+  expect(process.kill).not.toHaveBeenCalled()
+  expect(existsSync(path)).toBe(true)
+})
+
+it('does not infer PID reuse from an unavailable local machine identity', () => {
+  const path = writeOwner()
+  identity.machine.mockReturnValue(null)
+  expect(() => acquireProfileStateMaintenance(root)).toThrow('unverifiable')
+  expect(process.kill).toHaveBeenCalledWith(12345, 0)
+  expect(identity.process).not.toHaveBeenCalledWith(12345)
+  expect(existsSync(path)).toBe(true)
+})
+
+it.each([null, undefined])(
+  'reclaims a legacy same-host owner with an absent PID and machine identity %s',
+  (machineIdentity) => {
+    const path = writeOwner({ machineIdentity })
+    vi.mocked(process.kill).mockImplementation(() => {
+      throw Object.assign(new Error('absent'), { code: 'ESRCH' })
+    })
+    acquireProfileStateMaintenance(root).release()
+    expect(existsSync(path)).toBe(false)
+  }
+)
+
+it('reclaims an absent same-host PID when the reader cannot load machine identity', () => {
+  const path = writeOwner()
+  identity.machine.mockReturnValue(null)
+  vi.mocked(process.kill).mockImplementation(() => {
+    throw Object.assign(new Error('absent'), { code: 'ESRCH' })
+  })
+  acquireProfileStateMaintenance(root).release()
+  expect(existsSync(path)).toBe(false)
+})
+
+it.each([null, undefined])(
+  'does not compare creation times for a legacy live PID without machine identity %s',
+  (machineIdentity) => {
+    const path = writeOwner({ machineIdentity })
+    expect(() => acquireProfileStateMaintenance(root)).toThrow('unverifiable')
+    expect(identity.process).not.toHaveBeenCalledWith(12345)
+    expect(existsSync(path)).toBe(true)
+  }
+)
+
+it.each([
+  undefined,
+  null,
+  'wall-time-ms:1000',
+  'win32-creation-ms:0',
+  'win32-creation-ms:02000',
+  'win32-creation-ms:invalid',
+  'win32-creation-ms:99999999999999999'
+])('keeps legacy, incompatible or malformed creation identities: %s', (processStartIdentity) => {
+  const path = writeOwner({ processStartIdentity })
+  expect(() => acquireProfileStateMaintenance(root)).toThrow('unverifiable')
+  expect(existsSync(path)).toBe(true)
+})
+
+it('does not infer PID reuse when the native identity getter is unavailable', () => {
+  const path = writeOwner()
+  identity.process.mockReturnValue(null)
+  expect(() => acquireProfileStateMaintenance(root)).toThrow('unverifiable')
+  expect(existsSync(path)).toBe(true)
+})
+
+it.each(['EPERM', 'EACCES', 'EINVAL'])('retains owners on signal query failure %s', (code) => {
+  const path = writeOwner()
+  vi.mocked(process.kill).mockImplementation(() => {
+    throw Object.assign(new Error(code), { code })
+  })
+  expect(() => acquireProfileStateMaintenance(root)).toThrow('unverifiable')
+  expect(existsSync(path)).toBe(true)
+})
+
+it('reclaims a positively absent PID from the same machine even without a start timestamp', () => {
+  const path = writeOwner({ processStartIdentity: null })
+  vi.mocked(process.kill).mockImplementation(() => {
+    throw Object.assign(new Error('absent'), { code: 'ESRCH' })
+  })
+  acquireProfileStateMaintenance(root).release()
+  expect(existsSync(path)).toBe(false)
+})
diff --git a/src/main/persistence/profile-state/profile-state-access.test.ts b/src/main/persistence/profile-state/profile-state-access.test.ts
new file mode 100644
index 000000000000..b551a44f053f
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-access.test.ts
@@ -0,0 +1,531 @@
+import * as fs from 'node:fs'
+import { randomUUID } from 'node:crypto'
+import { tmpdir, hostname } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import {
+  acquireProfileStateMaintenance,
+  acquireProfileStateRuntimeAdmission,
+  assertProfileStateMaintenance,
+  type ProfileStateMaintenance
+} from './profile-state-access'
+import { profileStateAccessPaths, reclaimExitedOwner } from './profile-state-access-owner'
+import * as identity from './profile-state-access-identity'
+import * as processStart from '../../daemon/daemon-process-start-time'
+
+vi.mock('node:fs', async (importOriginal) => ({ ...(await importOriginal<typeof fs>()) }))
+vi.mock('../../daemon/daemon-process-start-time', async (importOriginal) => ({
+  ...(await importOriginal<typeof processStart>())
+}))
+vi.mock('./profile-state-access-identity', async (importOriginal) => ({
+  ...(await importOriginal<typeof identity>())
+}))
+
+const roots: string[] = []
+function root(): string {
+  const path = fs.mkdtempSync(join(tmpdir(), 'orca-state-access-'))
+  roots.push(path)
+  return path
+}
+
+afterEach(() => {
+  vi.restoreAllMocks()
+  for (const path of roots.splice(0)) {
+    fs.rmSync(path, { recursive: true, force: true })
+  }
+})
+
+describe('profile state admission and maintenance', () => {
+  it.skipIf(process.platform === 'win32')(
+    'releases its published owner when directory sync fails',
+    () => {
+      const path = root()
+      const syncFile = fs.fsyncSync
+      let syncCount = 0
+      const sync = vi.spyOn(fs, 'fsyncSync').mockImplementation((fd) => {
+        if (++syncCount === 3) {
+          throw new Error('directory sync failed')
+        }
+        syncFile(fd)
+      })
+      expect(() => acquireProfileStateRuntimeAdmission(path)).toThrow('directory sync failed')
+      const paths = profileStateAccessPaths(path)
+      expect(fs.readdirSync(paths.participants)).toEqual([])
+      expect(fs.readdirSync(paths.candidates)).toEqual([])
+      sync.mockRestore()
+      acquireProfileStateMaintenance(path).release()
+    }
+  )
+
+  it('does not publish an owner whose contents could not be synced', () => {
+    const path = root()
+    const sync = vi.spyOn(fs, 'fsyncSync').mockImplementationOnce(() => {
+      throw new Error('owner sync failed')
+    })
+    expect(() => acquireProfileStateRuntimeAdmission(path)).toThrow('owner sync failed')
+    const paths = profileStateAccessPaths(path)
+    expect(fs.readdirSync(paths.participants)).toEqual([])
+    expect(fs.readdirSync(paths.candidates)).toEqual([])
+    sync.mockRestore()
+    acquireProfileStateMaintenance(path).release()
+  })
+
+  it('allows concurrent normal writers and refuses maintenance until every admission releases', () => {
+    const path = root()
+    const first = acquireProfileStateRuntimeAdmission(path)
+    const second = acquireProfileStateRuntimeAdmission(path)
+    expect(() => acquireProfileStateMaintenance(path)).toThrow('in use')
+    first.release()
+    expect(() => acquireProfileStateMaintenance(path)).toThrow('in use')
+    second.release()
+    const maintenance = acquireProfileStateMaintenance(path)
+    expect(() => acquireProfileStateRuntimeAdmission(path)).toThrow('in use')
+    expect(() => acquireProfileStateMaintenance(path)).toThrow('in use')
+    maintenance.release()
+    acquireProfileStateRuntimeAdmission(path).release()
+  })
+
+  it('refuses a runtime publishing after maintenance has acquired and scanned', () => {
+    const path = root()
+    const rename = fs.renameSync
+    let maintenance: ProfileStateMaintenance | undefined
+    vi.spyOn(fs, 'renameSync').mockImplementation((from, to) => {
+      if (String(to).includes('participants')) {
+        maintenance = acquireProfileStateMaintenance(path)
+      }
+      rename(from, to)
+    })
+    expect(() => acquireProfileStateRuntimeAdmission(path)).toThrow('in use')
+    expect(maintenance).toBeDefined()
+    maintenance?.release()
+    expect(fs.readdirSync(profileStateAccessPaths(path).participants)).toEqual([])
+  })
+
+  it('refuses maintenance when runtime publication precedes its final admission check', () => {
+    const path = root()
+    const rename = fs.renameSync
+    let refused = false
+    vi.spyOn(fs, 'renameSync').mockImplementation((from, to) => {
+      rename(from, to)
+      if (String(to).includes('participants')) {
+        expect(() => acquireProfileStateMaintenance(path)).toThrow('in use')
+        refused = true
+      }
+    })
+    const admission = acquireProfileStateRuntimeAdmission(path)
+    expect(refused).toBe(true)
+    admission.release()
+  })
+
+  it('rejects released and fabricated maintenance owners and binds valid owners to exact profile paths', () => {
+    const path = root()
+    const other = root()
+    const profileId = 'profile-test'
+    const profileDir = join(path, 'profiles', profileId)
+    fs.mkdirSync(profileDir, { recursive: true })
+    const files = {
+      profileId,
+      dataFile: join(profileDir, 'orca-data.json'),
+      databasePath: join(profileDir, 'profile-state.db')
+    }
+    const owner = acquireProfileStateMaintenance(path)
+    assertProfileStateMaintenance(owner, files)
+    expect(() => assertProfileStateMaintenance({ ...owner }, files)).toThrow('acquired')
+    const wrong = acquireProfileStateMaintenance(other)
+    expect(() => assertProfileStateMaintenance(wrong, files)).toThrow('paths')
+    expect(() =>
+      assertProfileStateMaintenance(owner, { ...files, profileId: '../escape' })
+    ).toThrow('acquired')
+    owner.release()
+    expect(() => assertProfileStateMaintenance(owner, files)).toThrow('released')
+    wrong.release()
+  })
+
+  it.skipIf(process.platform === 'win32')(
+    'refuses symlinked profile directories outside the protected root',
+    () => {
+      const path = root()
+      const outside = root()
+      fs.mkdirSync(join(path, 'profiles'))
+      fs.symlinkSync(outside, join(path, 'profiles', 'escaped'))
+      const owner = acquireProfileStateMaintenance(path)
+      expect(() =>
+        assertProfileStateMaintenance(owner, {
+          profileId: 'escaped',
+          dataFile: join(outside, 'orca-data.json'),
+          databasePath: join(outside, 'profile-state.db')
+        })
+      ).toThrow('paths')
+      owner.release()
+    }
+  )
+
+  it.each(['', '../outside', 'x'.repeat(129)])(
+    'rejects invalid recovery profile IDs: %s',
+    (profileId) => {
+      const path = root()
+      const owner = acquireProfileStateMaintenance(path)
+      expect(() => owner.assertProfile(profileId, path, path)).toThrow('acquired')
+      owner.release()
+      acquireProfileStateRuntimeAdmission(path).release()
+    }
+  )
+})
+
+function staleGate(
+  path: string,
+  pid = 12345,
+  host = hostname(),
+  extra: {
+    bootIdentity?: string
+    machineIdentity?: string
+    startedAtMs?: number
+    processStartIdentity?: string
+  } = {}
+): string {
+  const gate = profileStateAccessPaths(path).maintenance
+  fs.mkdirSync(gate)
+  const token = randomUUID()
+  const record = join(gate, `${token}.owner`)
+  fs.writeFileSync(
+    record,
+    JSON.stringify({
+      token,
+      pid,
+      host,
+      platform: process.platform,
+      pidNamespace: process.platform === 'linux' ? fs.readlinkSync('/proc/self/ns/pid') : null,
+      machineIdentity: identity.profileStateAccessMachineIdentity(),
+      ...extra
+    })
+  )
+  return record
+}
+
+describe('profile state owner reclamation', () => {
+  it('reclaims a local owner from a previous boot even when its PID is now live', () => {
+    const path = root()
+    vi.spyOn(identity, 'profileStateAccessBootIdentity').mockReturnValue('current-boot')
+    vi.spyOn(identity, 'profileStateAccessMachineIdentity').mockReturnValue('same-machine')
+    const owner = staleGate(path, process.pid, hostname(), {
+      bootIdentity: 'previous-boot',
+      machineIdentity: 'same-machine'
+    })
+    const kill = vi.spyOn(process, 'kill')
+    acquireProfileStateMaintenance(path).release()
+    expect(kill).not.toHaveBeenCalled()
+    expect(fs.existsSync(owner)).toBe(false)
+  })
+
+  it('keeps a differently booted machine with the same hostname unverifiable', () => {
+    const path = root()
+    vi.spyOn(identity, 'profileStateAccessBootIdentity').mockReturnValue('current-boot')
+    vi.spyOn(identity, 'profileStateAccessMachineIdentity').mockReturnValue('this-machine')
+    const owner = staleGate(path, process.pid, hostname(), {
+      bootIdentity: 'another-boot',
+      machineIdentity: 'another-machine'
+    })
+    const kill = vi.spyOn(process, 'kill')
+    expect(() => acquireProfileStateMaintenance(path)).toThrow('unverifiable')
+    expect(kill).not.toHaveBeenCalled()
+    expect(fs.existsSync(owner)).toBe(true)
+  })
+
+  it.each(['current-boot', null])(
+    'does not reclaim another host with a cloned machine identity (current boot: %s)',
+    (currentBoot) => {
+      const path = root()
+      vi.spyOn(identity, 'profileStateAccessBootIdentity').mockReturnValue(currentBoot)
+      vi.spyOn(identity, 'profileStateAccessMachineIdentity').mockReturnValue('cloned-machine')
+      const owner = staleGate(path, 12345, 'another-host', {
+        bootIdentity: 'another-boot',
+        machineIdentity: 'cloned-machine'
+      })
+      const kill = vi.spyOn(process, 'kill').mockImplementation(() => {
+        throw Object.assign(new Error('absent on this host'), { code: 'ESRCH' })
+      })
+      expect(() => acquireProfileStateMaintenance(path)).toThrow('unverifiable')
+      expect(kill).not.toHaveBeenCalled()
+      expect(fs.existsSync(owner)).toBe(true)
+    }
+  )
+
+  it('reclaims a reused PID only when its recorded process start differs on the same boot', () => {
+    const path = root()
+    vi.spyOn(identity, 'profileStateAccessBootIdentity').mockReturnValue('same-boot')
+    vi.spyOn(identity, 'profileStateAccessProcessIdentity').mockReturnValue(
+      'linux-start-ticks:2000'
+    )
+    const owner = staleGate(path, process.pid, hostname(), {
+      bootIdentity: 'same-boot',
+      processStartIdentity: 'linux-start-ticks:1000'
+    })
+    acquireProfileStateMaintenance(path).release()
+    expect(fs.existsSync(owner)).toBe(false)
+  })
+
+  it('cannot reclaim a live Linux owner when wall-clock time changes', () => {
+    const platform = Object.getOwnPropertyDescriptor(process, 'platform')
+    if (!platform) {
+      throw new Error('Missing platform descriptor')
+    }
+    const path = root()
+    const read = fs.readFileSync
+    const fields = Array.from({ length: 20 }, () => '0')
+    fields[0] = 'S'
+    fields[19] = '987654'
+    let clock = 1_700_000_000_000
+    const wallStart = vi
+      .spyOn(processStart, 'getProcessStartedAtMs')
+      .mockImplementation(() => clock)
+    vi.spyOn(fs, 'readFileSync').mockImplementation((file, options) => {
+      if (file === '/proc/12345/stat') {
+        return `12345 (orca daemon) ${fields.join(' ')}`
+      }
+      return read(file, options)
+    })
+    vi.spyOn(fs, 'readlinkSync').mockReturnValue('pid:[same-namespace]')
+    vi.spyOn(identity, 'profileStateAccessBootIdentity').mockReturnValue('same-boot')
+    vi.spyOn(process, 'kill').mockReturnValue(true)
+    try {
+      Object.defineProperty(process, 'platform', { configurable: true, value: 'linux' })
+      const processStartIdentity = identity.profileStateAccessProcessIdentity(12345)
+      expect(processStartIdentity).toBe('linux-start-ticks:987654')
+      if (processStartIdentity === null) {
+        throw new Error('Expected process identity')
+      }
+      const owner = staleGate(path, 12345, hostname(), {
+        bootIdentity: 'same-boot',
+        processStartIdentity
+      })
+      clock += 60_000
+      // Linux identity emulation must not change the host filesystem's publication/fsync flags.
+      expect(() => reclaimExitedOwner(profileStateAccessPaths(path).maintenance)).toThrow(
+        'unverifiable'
+      )
+      expect(fs.existsSync(owner)).toBe(true)
+      expect(wallStart).not.toHaveBeenCalled()
+    } finally {
+      Object.defineProperty(process, 'platform', platform)
+    }
+  })
+
+  it('does not compare legacy epoch timestamps with raw process identity', () => {
+    const path = root()
+    vi.spyOn(identity, 'profileStateAccessBootIdentity').mockReturnValue('same-boot')
+    vi.spyOn(identity, 'profileStateAccessProcessIdentity').mockReturnValue(
+      'linux-start-ticks:2000'
+    )
+    const owner = staleGate(path, process.pid, hostname(), {
+      bootIdentity: 'same-boot',
+      startedAtMs: 1000
+    })
+    expect(() => acquireProfileStateMaintenance(path)).toThrow('unverifiable')
+    expect(fs.existsSync(owner)).toBe(true)
+  })
+
+  it.each([
+    'wall-time-ms:1000',
+    'linux-start-ticks:invalid',
+    'linux-start-ticks:99999999999999999'
+  ])('does not compare incompatible or malformed identity %s', (recorded) => {
+    const path = root()
+    vi.spyOn(identity, 'profileStateAccessBootIdentity').mockReturnValue('same-boot')
+    vi.spyOn(identity, 'profileStateAccessProcessIdentity').mockReturnValue(
+      'linux-start-ticks:2000'
+    )
+    const owner = staleGate(path, process.pid, hostname(), {
+      bootIdentity: 'same-boot',
+      processStartIdentity: recorded
+    })
+    expect(() => acquireProfileStateMaintenance(path)).toThrow('unverifiable')
+    expect(fs.existsSync(owner)).toBe(true)
+  })
+
+  it('does not interpret an unavailable process start as proof of PID reuse', () => {
+    const path = root()
+    vi.spyOn(identity, 'profileStateAccessBootIdentity').mockReturnValue('same-boot')
+    vi.spyOn(identity, 'profileStateAccessProcessIdentity').mockReturnValue(null)
+    const owner = staleGate(path, process.pid, hostname(), {
+      bootIdentity: 'same-boot',
+      processStartIdentity: 'linux-start-ticks:1000'
+    })
+    expect(() => acquireProfileStateMaintenance(path)).toThrow('unverifiable')
+    expect(fs.existsSync(owner)).toBe(true)
+  })
+
+  it.each([
+    ['darwin-utc-start-ms:100000', 'darwin-utc-start-ms:101000', false],
+    ['darwin-utc-start-ms:100000', 'darwin-utc-start-ms:101501', true],
+    ['wall-time-ms:100000', 'darwin-utc-start-ms:3700000', false]
+  ] as const)('compares macOS start identities safely: %s / %s', (recorded, actual, exited) => {
+    const path = root()
+    vi.spyOn(identity, 'profileStateAccessBootIdentity').mockReturnValue('same-boot')
+    vi.spyOn(identity, 'profileStateAccessProcessIdentity').mockReturnValue(actual)
+    const owner = staleGate(path, process.pid, hostname(), {
+      bootIdentity: 'same-boot',
+      processStartIdentity: recorded
+    })
+    if (exited) {
+      acquireProfileStateMaintenance(path).release()
+      expect(fs.existsSync(owner)).toBe(false)
+    } else {
+      expect(() => acquireProfileStateMaintenance(path)).toThrow('unverifiable')
+      expect(fs.existsSync(owner)).toBe(true)
+    }
+  })
+
+  it('retries a transient Windows owner publication lock', () => {
+    const platform = Object.getOwnPropertyDescriptor(process, 'platform')
+    if (!platform) {
+      throw new Error('Missing platform descriptor')
+    }
+    const path = root()
+    const rename = fs.renameSync
+    const publish = vi
+      .spyOn(fs, 'renameSync')
+      .mockImplementationOnce(() => {
+        throw Object.assign(new Error('scanner holds directory'), { code: 'EPERM' })
+      })
+      .mockImplementation(rename)
+    vi.spyOn(Atomics, 'wait').mockReturnValue('timed-out')
+    try {
+      Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' })
+      const admission = acquireProfileStateRuntimeAdmission(path)
+      expect(publish).toHaveBeenCalledTimes(2)
+      admission.release()
+      expect(fs.readdirSync(profileStateAccessPaths(path).participants)).toEqual([])
+    } finally {
+      Object.defineProperty(process, 'platform', platform)
+    }
+  })
+
+  it.skipIf(process.platform === 'win32')(
+    'recognizes an exited owner after a hostname change on the same kernel boot',
+    () => {
+      const path = root()
+      vi.spyOn(identity, 'profileStateAccessBootIdentity').mockReturnValue('same-boot')
+      const owner = staleGate(path, 12345, 'previous-hostname', { bootIdentity: 'same-boot' })
+      vi.spyOn(process, 'kill').mockImplementation(() => {
+        throw Object.assign(new Error('exited'), { code: 'ESRCH' })
+      })
+      acquireProfileStateMaintenance(path).release()
+      expect(fs.existsSync(owner)).toBe(false)
+    }
+  )
+
+  it('keeps a differently booted host unverifiable after a hostname change', () => {
+    const path = root()
+    vi.spyOn(identity, 'profileStateAccessBootIdentity').mockReturnValue('different-boot')
+    const owner = staleGate(path, 12345, 'previous-hostname', { bootIdentity: 'owner-boot' })
+    const kill = vi.spyOn(process, 'kill')
+    expect(() => acquireProfileStateMaintenance(path)).toThrow('verify PID 12345')
+    expect(kill).not.toHaveBeenCalled()
+    expect(fs.existsSync(owner)).toBe(true)
+  })
+
+  it('does not infer exit from a PID in another platform on a shared root', () => {
+    const path = root()
+    const owner = staleGate(path)
+    const record: unknown = JSON.parse(fs.readFileSync(owner, 'utf8'))
+    if (typeof record !== 'object' || record === null) {
+      throw new Error('Owner fixture missing')
+    }
+    fs.writeFileSync(
+      owner,
+      JSON.stringify({ ...record, platform: process.platform === 'win32' ? 'linux' : 'win32' })
+    )
+    const kill = vi.spyOn(process, 'kill').mockImplementation(() => {
+      throw Object.assign(new Error('absent here'), { code: 'ESRCH' })
+    })
+    expect(() => acquireProfileStateMaintenance(path)).toThrow('unverifiable')
+    expect(kill).not.toHaveBeenCalled()
+    expect(fs.existsSync(owner)).toBe(true)
+  })
+
+  it.skipIf(process.platform !== 'linux')(
+    'refuses a different Linux PID namespace even with the same hostname',
+    () => {
+      const path = root()
+      const owner = staleGate(path)
+      const record: unknown = JSON.parse(fs.readFileSync(owner, 'utf8'))
+      if (typeof record !== 'object' || record === null) {
+        throw new Error('Owner fixture missing')
+      }
+      fs.writeFileSync(owner, JSON.stringify({ ...record, pidNamespace: 'pid:[foreign]' }))
+      expect(() => acquireProfileStateMaintenance(path)).toThrow('unverifiable')
+      expect(fs.existsSync(owner)).toBe(true)
+    }
+  )
+
+  it.each(['EPERM', 'EINVAL', 'EACCES'])('refuses unverifiable process query %s', (code) => {
+    const path = root()
+    const owner = staleGate(path)
+    vi.spyOn(process, 'kill').mockImplementation(() => {
+      throw Object.assign(new Error(code), { code })
+    })
+    expect(() => acquireProfileStateMaintenance(path)).toThrow('unverifiable')
+    expect(fs.existsSync(owner)).toBe(true)
+  })
+
+  it('refuses live reused PIDs regardless of old timestamps', () => {
+    const path = root()
+    const owner = staleGate(path, process.pid)
+    fs.utimesSync(owner, 0, 0)
+    expect(() => acquireProfileStateMaintenance(path)).toThrow('in use')
+    expect(fs.existsSync(owner)).toBe(true)
+  })
+
+  it('refuses foreign host and malformed owners without reclaiming them', () => {
+    const path = root()
+    const owner = staleGate(path, process.pid, `${hostname()}-other`)
+    expect(() => acquireProfileStateMaintenance(path)).toThrow('unverifiable')
+    fs.writeFileSync(owner, '{}')
+    expect(() => acquireProfileStateMaintenance(path)).toThrow('malformed')
+    expect(fs.existsSync(owner)).toBe(true)
+  })
+
+  it('cannot remove a replacement published while it releases its own token', () => {
+    const path = root()
+    const original = acquireProfileStateMaintenance(path)
+    const unlink = fs.unlinkSync
+    let replacement: ProfileStateMaintenance | undefined
+    let intercepted = false
+    vi.spyOn(fs, 'unlinkSync').mockImplementation((entry) => {
+      unlink(entry)
+      if (!intercepted && String(entry).includes('maintenance')) {
+        intercepted = true
+        replacement = acquireProfileStateMaintenance(path)
+      }
+    })
+    original.release()
+    expect(replacement).toBeDefined()
+    replacement?.assertActive()
+    expect(() => acquireProfileStateRuntimeAdmission(path)).toThrow('in use')
+    replacement?.release()
+  })
+
+  it('cannot remove a replacement published after stale-owner observation', () => {
+    const path = root()
+    const old = staleGate(path)
+    const kill = process.kill
+    vi.spyOn(process, 'kill').mockImplementation((pid, signal) => {
+      if (pid === 12345) {
+        throw Object.assign(new Error('exited'), { code: 'ESRCH' })
+      }
+      return kill(pid, signal)
+    })
+    const unlink = fs.unlinkSync
+    let replacement: ProfileStateMaintenance | undefined
+    vi.spyOn(fs, 'unlinkSync').mockImplementation((entry) => {
+      unlink(entry)
+      if (entry === old) {
+        replacement = acquireProfileStateMaintenance(path)
+      }
+    })
+    expect(() => acquireProfileStateMaintenance(path)).toThrow('in use')
+    replacement?.assertActive()
+    expect(replacement).toBeDefined()
+    replacement?.release()
+  })
+})
diff --git a/src/main/persistence/profile-state/profile-state-access.ts b/src/main/persistence/profile-state/profile-state-access.ts
new file mode 100644
index 000000000000..724549dc7de1
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-access.ts
@@ -0,0 +1,99 @@
+import { lstatSync, readdirSync, realpathSync } from 'node:fs'
+import { basename, dirname, join } from 'node:path'
+import {
+  ProfileStateAccessError,
+  hasCode,
+  profileStateAccessPaths,
+  publishAccessOwner,
+  reclaimExitedOwner
+} from './profile-state-access-owner'
+export { ProfileStateAccessError } from './profile-state-access-owner'
+
+export type ProfileStateRuntimeAdmission = {
+  assertActive(): void
+  release(): void
+}
+
+export type ProfileStateMaintenance = ProfileStateRuntimeAdmission & {
+  assertProfile(profileId: string, dataFile: string, databasePath: string): void
+}
+
+const maintenanceRoots = new WeakMap<ProfileStateMaintenance, string>()
+
+/** Bind destructive operations to a genuine, live maintenance owner for these exact profile paths. */
+export function assertProfileStateMaintenance(
+  maintenance: ProfileStateMaintenance,
+  profile: { profileId: string; dataFile: string; databasePath: string }
+): void {
+  const root = maintenanceRoots.get(maintenance)
+  if (root === undefined || !/^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/.test(profile.profileId)) {
+    throw new ProfileStateAccessError(
+      'Profile state recovery requires an acquired maintenance owner'
+    )
+  }
+  maintenance.assertActive()
+  const expectedDirectory = join(root, 'profiles', profile.profileId)
+  for (const [path, expectedName] of [
+    [profile.dataFile, 'orca-data.json'],
+    [profile.databasePath, 'profile-state.db']
+  ] as const) {
+    if (
+      !samePath(realpathSync(dirname(path)), expectedDirectory) ||
+      !samePath(basename(path), expectedName)
+    ) {
+      throw new ProfileStateAccessError(
+        'Profile state recovery paths do not belong to the maintenance root'
+      )
+    }
+    try {
+      if (lstatSync(path).isSymbolicLink()) {
+        throw new ProfileStateAccessError('Profile state recovery cannot replace a symbolic link')
+      }
+    } catch (error) {
+      if (!hasCode(error, 'ENOENT')) {
+        throw error
+      }
+    }
+  }
+}
+
+function samePath(left: string, right: string): boolean {
+  return process.platform === 'win32' ? left.toLowerCase() === right.toLowerCase() : left === right
+}
+
+/** Admit before any profile read, and retain until every Store and worker has stopped. */
+export function acquireProfileStateRuntimeAdmission(
+  userDataPath: string
+): ProfileStateRuntimeAdmission {
+  const paths = profileStateAccessPaths(userDataPath)
+  const owner = publishAccessOwner(paths, false)
+  try {
+    reclaimExitedOwner(paths.maintenance)
+    return owner
+  } catch (error) {
+    owner.release()
+    throw error
+  }
+}
+
+/** Exclude startup and all participating readers/writers through durable recovery publication. */
+export function acquireProfileStateMaintenance(userDataPath: string): ProfileStateMaintenance {
+  const paths = profileStateAccessPaths(userDataPath)
+  const owner = publishAccessOwner(paths, true)
+  try {
+    for (const entry of readdirSync(paths.participants)) {
+      reclaimExitedOwner(join(paths.participants, entry))
+    }
+    const maintenance: ProfileStateMaintenance = {
+      ...owner,
+      assertProfile(profileId, dataFile, databasePath): void {
+        assertProfileStateMaintenance(maintenance, { profileId, dataFile, databasePath })
+      }
+    }
+    maintenanceRoots.set(maintenance, dirname(paths.root))
+    return maintenance
+  } catch (error) {
+    owner.release()
+    throw error
+  }
+}
diff --git a/src/main/persistence/profile-state/profile-state-active-location.ts b/src/main/persistence/profile-state/profile-state-active-location.ts
new file mode 100644
index 000000000000..15c38fe3ac1a
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-active-location.ts
@@ -0,0 +1,49 @@
+import { existsSync, readFileSync } from 'node:fs'
+import { join } from 'node:path'
+import {
+  getOrcaProfileDataFile,
+  getOrcaProfileStateDatabaseFile
+} from '../../../shared/profile-state-storage-paths'
+import type { ProfileStateOfflineLocation } from './profile-state-offline-settings'
+import { ProfileStateRecoveryCommandError } from '../../../shared/profile-state-recovery-command'
+
+/** Resolve the active profile files for offline profile-state commands. */
+export function getActiveProfileStateLocation(
+  userDataPath: string
+): ProfileStateOfflineLocation | undefined {
+  const indexPath = join(userDataPath, 'orca-profile-index.json')
+  const candidates = [indexPath, `${indexPath}.bak`].filter(existsSync)
+  if (candidates.length === 0) {
+    return undefined
+  }
+  for (const candidate of candidates) {
+    try {
+      const parsed: unknown = JSON.parse(readFileSync(candidate, 'utf-8'))
+      if (!isRecord(parsed) || !Array.isArray(parsed.profiles)) {
+        continue
+      }
+      const profileId = parsed.activeProfileId
+      if (
+        typeof profileId === 'string' &&
+        /^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/.test(profileId) &&
+        parsed.profiles.some((profile) => isRecord(profile) && profile.id === profileId)
+      ) {
+        return {
+          dataFile: getOrcaProfileDataFile(profileId, userDataPath),
+          databaseFile: getOrcaProfileStateDatabaseFile(profileId, userDataPath),
+          profileId
+        }
+      }
+    } catch {
+      // Try the profile-index backup before failing closed.
+    }
+  }
+  throw new ProfileStateRecoveryCommandError(
+    'runtime_error',
+    `Could not read active profile index ${indexPath}`
+  )
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value)
+}
diff --git a/src/main/persistence/profile-state/profile-state-authority-bootstrap.test.ts b/src/main/persistence/profile-state/profile-state-authority-bootstrap.test.ts
new file mode 100644
index 000000000000..8d7b7f726740
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-authority-bootstrap.test.ts
@@ -0,0 +1,544 @@
+import {
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  readdirSync,
+  rmSync,
+  writeFileSync
+} from 'node:fs'
+import { tmpdir } from 'node:os'
+import { basename, dirname, join } from 'node:path'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import Database from '../../sqlite/sync-database'
+import { openProfileStateDatabase, profileStateDatabaseFile } from './profile-state-database'
+import * as profileStateDocuments from './profile-state-documents'
+import { profileStateJsonExportPath } from './legacy-json/profile-state-export-path'
+import { acquireProfileStateMaintenance } from './profile-state-access'
+import { restoreProfileStateJsonExport } from './legacy-json/profile-state-recovery'
+import {
+  bootstrapProfileStateAuthority as bootstrapProfileStateAuthorityImpl,
+  classifyProfileStateStorage,
+  ProfileStateAuthorityBootstrapError,
+  ProfileStateRecoveryRequiredError
+} from './profile-state-authority-bootstrap'
+
+vi.mock('electron', () => ({
+  app: {
+    getPath: () => tmpdir(),
+    getName: () => 'orca-test',
+    getVersion: () => '0.0.0-test',
+    isPackaged: false,
+    on: () => {},
+    whenReady: () => Promise.resolve()
+  },
+  safeStorage: {
+    isEncryptionAvailable: () => true,
+    encryptString: (value: string) => Buffer.from(`encrypted:${value}`, 'utf8'),
+    decryptString: (value: Buffer) => value.toString('utf8').slice('encrypted:'.length)
+  },
+  ipcMain: { on: () => {}, handle: () => {} },
+  BrowserWindow: { getAllWindows: () => [] }
+}))
+
+vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
+vi.mock('../../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: vi.fn(() => ({ nth_repo_added: 2 }))
+}))
+vi.mock('../../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: vi.fn(() => ({ hosts: [] })),
+  sshConfigHostsToTargets: vi.fn(() => [])
+}))
+
+const { Store } = await import('../loading-store/store')
+
+const temporaryDirectories: string[] = []
+const authoritiesToClose: NonNullable<
+  ReturnType<typeof bootstrapProfileStateAuthorityImpl>['authority']
+>[] = []
+
+function bootstrapProfileStateAuthority(
+  options: Parameters<typeof bootstrapProfileStateAuthorityImpl>[0]
+): ReturnType<typeof bootstrapProfileStateAuthorityImpl> {
+  const result = bootstrapProfileStateAuthorityImpl(options)
+  if (result.authority !== undefined) {
+    authoritiesToClose.push(result.authority)
+  }
+  return result
+}
+
+afterEach(() => {
+  for (const authority of authoritiesToClose.splice(0)) {
+    authority.close?.()
+  }
+  for (const directory of temporaryDirectories.splice(0)) {
+    rmSync(directory, { recursive: true, force: true })
+  }
+  vi.restoreAllMocks()
+})
+
+function createDirectory(): string {
+  const root = mkdtempSync(join(tmpdir(), 'orca-profile-state-bootstrap-'))
+  temporaryDirectories.push(root)
+  const directory = join(root, 'profiles', 'profile-bootstrap-test')
+  mkdirSync(directory, { recursive: true })
+  return directory
+}
+
+function paths(directory: string): {
+  dataFile: string
+  databaseFile: string
+  profileId: string
+} {
+  return {
+    dataFile: join(directory, 'orca-data.json'),
+    databaseFile: profileStateDatabaseFile(directory),
+    profileId: 'profile-bootstrap-test'
+  }
+}
+
+describe('profile state authority bootstrap', () => {
+  it('classifies all four storage-presence states without opening SQLite', () => {
+    const directory = createDirectory()
+    const { dataFile, databaseFile } = paths(directory)
+
+    expect(classifyProfileStateStorage(dataFile, databaseFile)).toBe('neither')
+    writeFileSync(dataFile, '{}')
+    expect(classifyProfileStateStorage(dataFile, databaseFile)).toBe('json-only')
+
+    const opened = openProfileStateDatabase(databaseFile, 'profile-bootstrap-test')
+    opened.db.close()
+    expect(classifyProfileStateStorage(dataFile, databaseFile)).toBe('both')
+
+    rmSync(dataFile)
+    expect(classifyProfileStateStorage(dataFile, databaseFile)).toBe('sqlite-only')
+  })
+
+  it('imports JSON-only state through Store export and returns the SQLite authority', () => {
+    const directory = createDirectory()
+    const options = paths(directory)
+    writeFileSync(
+      options.dataFile,
+      JSON.stringify({ settings: { theme: 'dark' }, futureExtension: { keep: true } })
+    )
+
+    const result = bootstrapProfileStateAuthority(options)
+
+    expect(result.classification).toBe('json-only')
+    expect(result.migrated).toBe(true)
+    expect(result.authority?.readSerializedState()).toContain('futureExtension')
+    expect(existsSync(options.dataFile)).toBe(true)
+    expect(existsSync(profileStateJsonExportPath(options.dataFile, 1))).toBe(true)
+    expect(readFileSync(profileStateJsonExportPath(options.dataFile, 1), 'utf8')).toContain(
+      'futureExtension'
+    )
+    expect(classifyProfileStateStorage(options.dataFile, options.databaseFile)).toBe('both')
+
+    if (result.authority === undefined) {
+      throw new Error('JSON migration did not return a SQLite authority')
+    }
+    const store = new Store({
+      dataFile: options.dataFile,
+      profileStateAuthority: result.authority
+    })
+    expect(store.getSettings().theme).toBe('dark')
+
+    const repeated = bootstrapProfileStateAuthority(options)
+    expect(repeated.authority?.readSerializedState()).toContain('futureExtension')
+  })
+
+  it('fails closed when both files are present without a matching acceptance marker', () => {
+    const directory = createDirectory()
+    const options = paths(directory)
+    writeFileSync(options.dataFile, JSON.stringify({ settings: { theme: 'dark' } }))
+    const opened = openProfileStateDatabase(options.databaseFile, options.profileId)
+    opened.db.close()
+
+    expect(() => bootstrapProfileStateAuthority(options)).toThrowError(
+      ProfileStateAuthorityBootstrapError
+    )
+  })
+
+  it('rejects a legacy JSON edit after migration instead of selecting stale SQLite state', () => {
+    const directory = createDirectory()
+    const options = paths(directory)
+    writeFileSync(options.dataFile, JSON.stringify({ settings: { theme: 'dark' } }))
+    bootstrapProfileStateAuthority(options)
+    writeFileSync(options.dataFile, JSON.stringify({ settings: { theme: 'light' } }))
+
+    expect(() => bootstrapProfileStateAuthority(options)).toThrowError(
+      ProfileStateAuthorityBootstrapError
+    )
+  })
+
+  it.each([1, 2])(
+    'requires explicit recovery for unreleased schema %s without changing its bytes',
+    (version) => {
+      const options = paths(createDirectory())
+      const raw = JSON.stringify({ settings: { theme: 'dark' }, futureDomain: { retained: true } })
+      const opened = openProfileStateDatabase(options.databaseFile, options.profileId)
+      profileStateDocuments.importProfileStateJson(opened.db, raw, {
+        acceptedLegacyJsonHash: profileStateDocuments.hashProfileStateJson(raw)
+      })
+      if (version === 1) {
+        opened.db.exec(
+          'DROP TABLE profile_state_automation_runs; DROP TABLE profile_state_automation_runs_meta'
+        )
+      } else {
+        opened.db.exec('DELETE FROM profile_state_automation_runs_meta')
+      }
+      opened.db.pragma(`user_version = ${version}`)
+      opened.db.close()
+      const before = readFileSync(options.databaseFile)
+      for (const withJson of [false, true]) {
+        if (withJson) {
+          writeFileSync(options.dataFile, raw)
+        }
+        expect(() => bootstrapProfileStateAuthority(options)).toThrow(
+          ProfileStateRecoveryRequiredError
+        )
+        expect(readFileSync(options.databaseFile)).toEqual(before)
+      }
+      const exportPath = profileStateJsonExportPath(options.dataFile, 1)
+      writeFileSync(exportPath, raw)
+      restoreProfileStateJsonExport({
+        maintenance: acquireProfileStateMaintenance(dirname(dirname(dirname(options.dataFile)))),
+        databasePath: options.databaseFile,
+        dataFile: options.dataFile,
+        profileId: options.profileId,
+        exportPath
+      })
+      const recovered = bootstrapProfileStateAuthority(options)
+      expect(recovered.migrated).toBe(true)
+      expect(JSON.parse(recovered.authority?.readSerializedState() ?? '{}')).toMatchObject({
+        futureDomain: { retained: true }
+      })
+    }
+  )
+
+  it('returns no authority for a brand-new profile', () => {
+    const directory = createDirectory()
+    const result = bootstrapProfileStateAuthority(paths(directory))
+
+    expect(result).toEqual({ classification: 'neither', authority: undefined, migrated: false })
+  })
+
+  it('cleans failed empty-profile initialization before a successful retry', () => {
+    const directory = createDirectory()
+    const options = { ...paths(directory), allowEmptyProfileState: true }
+    const initializationFailure = new Error('injected initial schema failure')
+    const originalExec = Database.prototype.exec
+    const execSpy = vi.spyOn(Database.prototype, 'exec').mockImplementation(function (
+      this: Database,
+      sql
+    ) {
+      originalExec.call(this, sql)
+      if (sql.includes('CREATE TABLE')) {
+        const row = this.prepare('PRAGMA database_list').get()
+        if (typeof row?.file !== 'string') {
+          throw new Error('Expected a file-backed database during initialization')
+        }
+        expect(existsSync(`${row.file}-journal`)).toBe(true)
+        for (const suffix of ['-wal', '-shm']) {
+          writeFileSync(`${row.file}${suffix}`, 'interrupted schema initialization')
+        }
+        throw initializationFailure
+      }
+    })
+
+    expect(() => bootstrapProfileStateAuthority(options)).toThrowError(
+      expect.objectContaining({ cause: initializationFailure })
+    )
+    expect(existsSync(options.databaseFile)).toBe(false)
+    expect(classifyProfileStateStorage(options.dataFile, options.databaseFile)).toBe('neither')
+    expect(readdirSync(directory)).toEqual([])
+
+    execSpy.mockRestore()
+    const retry = bootstrapProfileStateAuthority(options)
+    expect(retry.migrated).toBe(false)
+    expect(retry.authority).toBeDefined()
+    expect(retry.authority?.readSerializedState()).toBeUndefined()
+    expect(bootstrapProfileStateAuthority(options).classification).toBe('sqlite-only')
+  })
+
+  it('preserves JSON created while an empty database is being initialized', () => {
+    const options = { ...paths(createDirectory()), allowEmptyProfileState: true }
+    const source = '{"settings":{"theme":"dark"}}'
+    const originalClose = Database.prototype.close
+    vi.spyOn(Database.prototype, 'close').mockImplementationOnce(function (this: Database) {
+      originalClose.call(this)
+      writeFileSync(options.dataFile, source)
+    })
+
+    expect(() => bootstrapProfileStateAuthority(options)).toThrow(
+      'Profile state storage changed while creating an empty database'
+    )
+    expect(readFileSync(options.dataFile, 'utf8')).toBe(source)
+    expect(readdirSync(dirname(options.dataFile))).toEqual(['orca-data.json'])
+  })
+
+  it.each(['legacy-backup', 'sqlite-export'])(
+    'preserves a %s created while an empty database is being initialized',
+    (artifact) => {
+      const options = { ...paths(createDirectory()), allowEmptyProfileState: true }
+      const path =
+        artifact === 'legacy-backup'
+          ? `${options.dataFile}.bak.0`
+          : profileStateJsonExportPath(options.dataFile, 1)
+      const source = '{"settings":{"theme":"dark"}}'
+      const originalClose = Database.prototype.close
+      vi.spyOn(Database.prototype, 'close').mockImplementationOnce(function (this: Database) {
+        originalClose.call(this)
+        writeFileSync(path, source)
+      })
+
+      expect(() => bootstrapProfileStateAuthority(options)).toThrow()
+      expect(existsSync(options.databaseFile)).toBe(false)
+      expect(existsSync(options.dataFile)).toBe(false)
+      expect(readFileSync(path, 'utf8')).toBe(source)
+      expect(readdirSync(dirname(path))).toEqual([basename(path)])
+    }
+  )
+
+  it.each(['-wal', '-shm', '-journal'])(
+    'treats an orphaned SQLite %s sidecar as authority evidence with or without JSON',
+    (suffix) => {
+      const options = paths(createDirectory())
+      const sidecar = `${options.databaseFile}${suffix}`
+      writeFileSync(sidecar, 'orphaned recovery evidence')
+
+      expect(classifyProfileStateStorage(options.dataFile, options.databaseFile)).toBe(
+        'sqlite-only'
+      )
+      expect(() => bootstrapProfileStateAuthority(options)).toThrow()
+      writeFileSync(options.dataFile, '{"settings":{"theme":"dark"}}')
+      expect(classifyProfileStateStorage(options.dataFile, options.databaseFile)).toBe('both')
+      expect(() => bootstrapProfileStateAuthority(options)).toThrow()
+      expect(existsSync(options.databaseFile)).toBe(false)
+      expect(readFileSync(sidecar, 'utf8')).toBe('orphaned recovery evidence')
+      expect(readFileSync(options.dataFile, 'utf8')).toBe('{"settings":{"theme":"dark"}}')
+    }
+  )
+
+  it('validates and returns an existing SQLite-only authority', () => {
+    const directory = createDirectory()
+    const options = paths(directory)
+    const opened = openProfileStateDatabase(options.databaseFile, options.profileId)
+    opened.db.close()
+
+    const result = bootstrapProfileStateAuthority(options)
+
+    expect(result.classification).toBe('sqlite-only')
+    expect(result.migrated).toBe(false)
+    expect(result.authority?.readSerializedState()).toBeUndefined()
+  })
+
+  it('rejects malformed SQLite-only state before Store can select it', () => {
+    const directory = createDirectory()
+    const options = paths(directory)
+    writeFileSync(options.databaseFile, 'not sqlite')
+
+    expect(() => bootstrapProfileStateAuthority(options)).toThrow()
+  })
+
+  it('reports retained exports when an established SQLite profile needs recovery', () => {
+    const directory = createDirectory()
+    const options = paths(directory)
+    writeFileSync(options.dataFile, JSON.stringify({ settings: { theme: 'dark' } }))
+    const bootstrap = bootstrapProfileStateAuthority(options)
+    bootstrap.authority?.close?.()
+    const exportPath = profileStateJsonExportPath(options.dataFile, 1)
+    const exportPathRevision2 = profileStateJsonExportPath(options.dataFile, 2)
+    const exportPathRevision10 = profileStateJsonExportPath(options.dataFile, 10)
+    writeFileSync(exportPathRevision2, readFileSync(exportPath))
+    writeFileSync(exportPathRevision10, readFileSync(exportPath))
+    writeFileSync(
+      `${options.dataFile}.sqlite-export.9007199254740992.json`,
+      readFileSync(exportPath)
+    )
+    writeFileSync(options.databaseFile, 'not sqlite')
+
+    try {
+      bootstrapProfileStateAuthority(options)
+      throw new Error('expected recovery-required startup failure')
+    } catch (error) {
+      expect(error).toBeInstanceOf(ProfileStateRecoveryRequiredError)
+      if (!(error instanceof ProfileStateRecoveryRequiredError)) {
+        throw error
+      }
+      expect(error.dataFile).toBe(options.dataFile)
+      expect(error.databaseFile).toBe(options.databaseFile)
+      expect(error.exportPaths).toEqual([exportPathRevision10, exportPathRevision2, exportPath])
+    }
+  })
+
+  it('does not create a database when the legacy JSON cannot be imported', () => {
+    const directory = createDirectory()
+    const options = paths(directory)
+    writeFileSync(options.dataFile, '{ malformed')
+
+    expect(() => bootstrapProfileStateAuthority(options)).toThrow(
+      'Failed to load imported profile state'
+    )
+    expect(existsSync(options.databaseFile)).toBe(false)
+  })
+
+  it.each([0, 1, 2, 3, 4])(
+    'migrates usable legacy backup slot %s after a corrupt primary',
+    (slot) => {
+      const options = paths(createDirectory())
+      const damaged = '{ malformed primary'
+      const recovered = JSON.stringify({ settings: { theme: 'dark' }, retainedBackup: slot })
+      writeFileSync(options.dataFile, damaged)
+      for (let index = 0; index < slot; index += 1) {
+        writeFileSync(`${options.dataFile}.bak.${index}`, '{ damaged backup')
+      }
+      writeFileSync(`${options.dataFile}.bak.${slot}`, recovered)
+
+      const result = bootstrapProfileStateAuthority(options)
+      expect(result.migrated).toBe(true)
+      expect(JSON.parse(result.authority?.readSerializedState() ?? '{}')).toMatchObject({
+        settings: { theme: 'dark' },
+        retainedBackup: slot
+      })
+      expect(readFileSync(options.dataFile, 'utf8')).toBe(damaged)
+      expect(readFileSync(`${options.dataFile}.bak.${slot}`, 'utf8')).toBe(recovered)
+      expect(bootstrapProfileStateAuthority(options).migrated).toBe(false)
+    }
+  )
+
+  it('preserves every source when legacy primary and backups are unusable', () => {
+    const options = paths(createDirectory())
+    writeFileSync(options.dataFile, '{ malformed primary')
+    writeFileSync(`${options.dataFile}.bak.0`, '{ malformed backup')
+    expect(() => bootstrapProfileStateAuthority(options)).toThrow(
+      ProfileStateAuthorityBootstrapError
+    )
+    expect(readFileSync(options.dataFile, 'utf8')).toBe('{ malformed primary')
+    expect(readFileSync(`${options.dataFile}.bak.0`, 'utf8')).toBe('{ malformed backup')
+    expect(existsSync(options.databaseFile)).toBe(false)
+  })
+
+  it('cleans a temporary database when import fails after opening SQLite', () => {
+    const directory = createDirectory()
+    const options = paths(directory)
+    writeFileSync(options.dataFile, JSON.stringify({ settings: { theme: 'dark' } }))
+    const importFailure = new Error('injected import failure')
+    const importSpy = vi
+      .spyOn(profileStateDocuments, 'importProfileStateJson')
+      .mockImplementation(() => {
+        throw importFailure
+      })
+
+    expect(() => bootstrapProfileStateAuthority(options)).toThrow(importFailure)
+    expect(classifyProfileStateStorage(options.dataFile, options.databaseFile)).toBe('json-only')
+    expect(existsSync(options.databaseFile)).toBe(false)
+    expect(
+      readdirSync(directory).some((name) => name.includes('.migration.') && name.endsWith('.tmp'))
+    ).toBe(false)
+
+    importSpy.mockRestore()
+    const retry = bootstrapProfileStateAuthority(options)
+    expect(retry.migrated).toBe(true)
+    expect(retry.authority?.readSerializedState()).toContain('"dark"')
+  })
+
+  it('refuses a pre-existing retained export before migrating JSON again', () => {
+    const directory = createDirectory()
+    const options = paths(directory)
+    writeFileSync(options.dataFile, JSON.stringify({ settings: { theme: 'dark' } }))
+    const exportPath = profileStateJsonExportPath(options.dataFile, 1)
+    mkdirSync(exportPath)
+
+    expect(() => bootstrapProfileStateAuthority(options)).toThrow()
+    expect(existsSync(options.dataFile)).toBe(true)
+    expect(existsSync(options.databaseFile)).toBe(false)
+
+    rmSync(exportPath, { recursive: true })
+    const retry = bootstrapProfileStateAuthority(options)
+    expect(retry.classification).toBe('json-only')
+    expect(retry.migrated).toBe(true)
+    expect(retry.authority?.readSerializedState()).toContain('"dark"')
+  })
+
+  it('boots the revisioned export through the legacy Store after SQLite corruption', () => {
+    const directory = createDirectory()
+    const options = paths(directory)
+    writeFileSync(options.dataFile, JSON.stringify({ settings: { theme: 'dark' } }))
+    bootstrapProfileStateAuthority(options)
+    const exportPath = profileStateJsonExportPath(options.dataFile, 1)
+
+    writeFileSync(options.databaseFile, 'corrupt sqlite primary')
+    writeFileSync(options.dataFile, readFileSync(exportPath))
+    const rollbackStore = new Store({
+      dataFile: options.dataFile,
+      serializedState: readFileSync(options.dataFile, 'utf8')
+    })
+    expect(rollbackStore.getSettings().theme).toBe('dark')
+    rollbackStore.freezeWrites()
+  })
+
+  it('quarantines SQLite and restores a selected export for legacy rollback', () => {
+    const directory = createDirectory()
+    const options = paths(directory)
+    writeFileSync(options.dataFile, JSON.stringify({ settings: { theme: 'dark' } }))
+    const bootstrap = bootstrapProfileStateAuthority(options)
+    bootstrap.authority?.close?.()
+    const exportPath = profileStateJsonExportPath(options.dataFile, 1)
+    writeFileSync(options.databaseFile, 'corrupt sqlite primary')
+    writeFileSync(`${options.databaseFile}-wal`, 'corrupt wal sidecar')
+    const restoredJson = readFileSync(exportPath)
+
+    const result = restoreProfileStateJsonExport({
+      maintenance: acquireProfileStateMaintenance(dirname(dirname(dirname(options.dataFile)))),
+      databasePath: options.databaseFile,
+      dataFile: options.dataFile,
+      profileId: options.profileId,
+      exportPath,
+      quarantineRoot: join(directory, 'quarantine')
+    })
+
+    expect(result.removedDatabaseFiles).toEqual(
+      expect.arrayContaining([options.databaseFile, `${options.databaseFile}-wal`])
+    )
+    expect(existsSync(options.databaseFile)).toBe(false)
+    expect(readFileSync(options.dataFile)).toEqual(restoredJson)
+    expect(existsSync(exportPath)).toBe(false)
+    expect(readFileSync(join(result.quarantine.directory, 'profile-state.db'), 'utf8')).toBe(
+      'corrupt sqlite primary'
+    )
+    expect(readFileSync(join(result.quarantine.directory, 'profile-state.db-wal'), 'utf8')).toBe(
+      'corrupt wal sidecar'
+    )
+
+    const rollbackStore = new Store({
+      dataFile: options.dataFile,
+      serializedState: readFileSync(options.dataFile, 'utf8')
+    })
+    expect(rollbackStore.getSettings().theme).toBe('dark')
+    rollbackStore.freezeWrites()
+  })
+
+  it('validates the selected export before quarantining or replacing anything', () => {
+    const directory = createDirectory()
+    const options = paths(directory)
+    writeFileSync(options.dataFile, JSON.stringify({ settings: { theme: 'dark' } }))
+    bootstrapProfileStateAuthority(options)
+    const exportPath = profileStateJsonExportPath(options.dataFile, 1)
+    writeFileSync(exportPath, '{ malformed')
+    const databaseBytes = readFileSync(options.databaseFile)
+    const dataBytes = readFileSync(options.dataFile)
+
+    expect(() =>
+      restoreProfileStateJsonExport({
+        maintenance: acquireProfileStateMaintenance(dirname(dirname(dirname(options.dataFile)))),
+        databasePath: options.databaseFile,
+        dataFile: options.dataFile,
+        profileId: options.profileId,
+        exportPath
+      })
+    ).toThrow('Profile state JSON is invalid')
+    expect(readFileSync(options.databaseFile)).toEqual(databaseBytes)
+    expect(readFileSync(options.dataFile)).toEqual(dataBytes)
+  })
+})
diff --git a/src/main/persistence/profile-state/profile-state-authority-bootstrap.ts b/src/main/persistence/profile-state/profile-state-authority-bootstrap.ts
new file mode 100644
index 000000000000..7056b8aec9f7
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-authority-bootstrap.ts
@@ -0,0 +1,152 @@
+import { existsSync, mkdirSync, readFileSync, rmSync } from 'node:fs'
+import { randomUUID } from 'node:crypto'
+import { dirname } from 'node:path'
+import { publishProfileStateDatabase } from './profile-state-database-publication'
+import type { ProfileStateAuthorityInitialState } from '../loading-store/profile-state-authority'
+import { isProfileStateSqliteAvailable, openProfileStateDatabase } from './profile-state-database'
+import { ProfileStateDatabaseOpenError } from './profile-state-database-errors'
+import { ProfileStateSqliteAuthority } from './profile-state-sqlite-authority'
+import { migrateProfileStateToSqlite } from './profile-state-migration'
+import { prepareLegacyProfileState } from './legacy-json/profile-state-legacy-import'
+import {
+  assertProfileStateCanInitialize,
+  ProfileStateAuthorityBootstrapError,
+  ProfileStateRecoveryRequiredError
+} from './profile-state-recovery-required'
+export {
+  ProfileStateAuthorityBootstrapError,
+  ProfileStateRecoveryRequiredError
+} from './profile-state-recovery-required'
+import {
+  classifyProfileStateStorage,
+  profileStateDatabaseFiles,
+  type ProfileStateStorageClassification
+} from './profile-state-storage-classification'
+
+export { classifyProfileStateStorage } from './profile-state-storage-classification'
+export type { ProfileStateStorageClassification } from './profile-state-storage-classification'
+
+export type ProfileStateAuthorityBootstrapResult = {
+  classification: ProfileStateStorageClassification
+  migrated: boolean
+} & (
+  | {
+      authority: ProfileStateSqliteAuthority
+      initialState: ProfileStateAuthorityInitialState<ProfileStateSqliteAuthority>
+    }
+  | { authority: undefined; initialState?: never }
+)
+
+export type ProfileStateAuthorityBootstrapOptions = {
+  dataFile: string
+  databaseFile: string
+  profileId: string
+  /** Establish empty profiles before their first Store write. */
+  allowEmptyProfileState?: boolean
+}
+
+/** Normalize legacy state once, then hand one validated authority to Store. */
+export function bootstrapProfileStateAuthority(
+  options: ProfileStateAuthorityBootstrapOptions
+): ProfileStateAuthorityBootstrapResult {
+  const classification = classifyProfileStateStorage(options.dataFile, options.databaseFile)
+  if (classification === 'neither' && options.allowEmptyProfileState !== true) {
+    return { classification, authority: undefined, migrated: false }
+  }
+  if (!isProfileStateSqliteAvailable()) {
+    if (classification === 'neither' || classification === 'json-only') {
+      return { classification, authority: undefined, migrated: false }
+    }
+    throw new ProfileStateAuthorityBootstrapError(
+      'SQLite profile state is present but this runtime cannot validate it'
+    )
+  }
+  if (classification === 'json-only' || classification === 'neither') {
+    assertProfileStateCanInitialize(options)
+  }
+  if (classification === 'json-only') {
+    return migrateJsonOnlyProfile(options)
+  }
+  if (classification === 'neither') {
+    mkdirSync(dirname(options.databaseFile), { recursive: true })
+    createEmptyProfileStateDatabase(options)
+  } else if (classification === 'sqlite-only' && !existsSync(options.databaseFile)) {
+    throw new ProfileStateAuthorityBootstrapError(
+      'SQLite profile state has an orphaned database sidecar'
+    )
+  }
+
+  const authority = new ProfileStateSqliteAuthority(options.databaseFile, options.profileId)
+  try {
+    const initialState =
+      classification === 'both'
+        ? authority.readAcceptedState(readFileSync(options.dataFile, 'utf8'))
+        : authority.readInitialState()
+    if (initialState === undefined) {
+      throw new ProfileStateAuthorityBootstrapError(
+        'Profile state has both JSON and SQLite storage without a matching acceptance marker',
+        'diverged-json'
+      )
+    }
+    return { classification, authority, initialState, migrated: false }
+  } catch (error) {
+    authority.close()
+    if (
+      error instanceof ProfileStateAuthorityBootstrapError ||
+      (error instanceof ProfileStateDatabaseOpenError && error.code === 'newer-schema')
+    ) {
+      throw error
+    }
+    throw new ProfileStateRecoveryRequiredError(options, error)
+  }
+}
+
+function createEmptyProfileStateDatabase({
+  dataFile,
+  databaseFile,
+  profileId
+}: ProfileStateAuthorityBootstrapOptions): void {
+  const temporaryDatabaseFile = `${databaseFile}.empty.${process.pid}.${randomUUID()}.tmp`
+  let published = false
+  try {
+    const opened = openProfileStateDatabase(temporaryDatabaseFile, profileId)
+    opened.db.close()
+    if (classifyProfileStateStorage(dataFile, databaseFile) !== 'neither') {
+      throw new ProfileStateAuthorityBootstrapError(
+        'Profile state storage changed while creating an empty database'
+      )
+    }
+    assertProfileStateCanInitialize({ dataFile, databaseFile, profileId })
+    if (!publishProfileStateDatabase(temporaryDatabaseFile, databaseFile)) {
+      throw new ProfileStateAuthorityBootstrapError(
+        'Profile state storage changed while creating an empty database'
+      )
+    }
+    published = true
+  } finally {
+    if (!published) {
+      for (const path of profileStateDatabaseFiles(temporaryDatabaseFile)) {
+        rmSync(path, { force: true })
+      }
+    }
+  }
+}
+
+function migrateJsonOnlyProfile(
+  options: ProfileStateAuthorityBootstrapOptions
+): ProfileStateAuthorityBootstrapResult {
+  const rawJson = readFileSync(options.dataFile, 'utf8')
+  const { prepared, unboundPaneAliases } = prepareLegacyProfileState(options.dataFile, rawJson)
+  const migrated = migrateProfileStateToSqlite({
+    ...options,
+    expectedLegacyJson: rawJson,
+    serializedState: prepared.json
+  })
+  prepared.commit()
+  return {
+    classification: 'json-only',
+    ...migrated,
+    initialState: { ...migrated.initialState, unboundPaneAliases },
+    migrated: true
+  }
+}
diff --git a/src/main/persistence/profile-state/profile-state-authority-export-fencing.test.ts b/src/main/persistence/profile-state/profile-state-authority-export-fencing.test.ts
new file mode 100644
index 000000000000..b53dc25fd69e
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-authority-export-fencing.test.ts
@@ -0,0 +1,43 @@
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { describe, expect, it } from 'vitest'
+import { ProfileStateSqliteAuthority } from './profile-state-sqlite-authority'
+import { ProfileStateRevisionConflictError } from './profile-state-document-validation'
+
+describe('profile export snapshot revision', () => {
+  it.each(['json', 'compatibility-sync', 'compatibility-async'] as const)(
+    'refuses a competing revision before publishing %s',
+    async (kind) => {
+      const root = mkdtempSync(join(tmpdir(), 'orca-export-fence-'))
+      const database = join(root, 'profile-state.db')
+      const target = join(root, 'retained.json')
+      const owner = new ProfileStateSqliteAuthority(database, 'export-fence')
+      const peer = new ProfileStateSqliteAuthority(database, 'export-fence')
+      try {
+        owner.writeSerializedState(Buffer.from('{"settings":{"theme":"dark"}}'))
+        writeFileSync(target, 'retained export')
+        owner.assertCurrentRevision()
+        peer.readSerializedState()
+        peer.writeSerializedDomains([{ domain: 'settings', payload: '{"theme":"light"}' }])
+        await expect(
+          Promise.resolve().then(() => {
+            if (kind === 'json') {
+              return owner.writeJsonExport(target)
+            }
+            if (kind === 'compatibility-sync') {
+              return owner.writeJsonCompatibilityExport(target)
+            }
+            return owner.writeJsonCompatibilityExportAsync(target)
+          })
+        ).rejects.toBeInstanceOf(ProfileStateRevisionConflictError)
+        expect(readFileSync(target, 'utf8')).toBe('retained export')
+        expect(JSON.parse(peer.readSerializedState() ?? '{}').settings.theme).toBe('light')
+      } finally {
+        owner.close()
+        peer.close()
+        rmSync(root, { recursive: true, force: true })
+      }
+    }
+  )
+})
diff --git a/src/main/persistence/profile-state/profile-state-automation-runs-equality.test.ts b/src/main/persistence/profile-state/profile-state-automation-runs-equality.test.ts
new file mode 100644
index 000000000000..8ac387db9aaf
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-automation-runs-equality.test.ts
@@ -0,0 +1,177 @@
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it } from 'vitest'
+import { clearProfileStateAutomationRuns } from './profile-state-automation-runs'
+import { openProfileStateDatabase } from './profile-state-database'
+import {
+  hashProfileStateJson,
+  importProfileStateJson,
+  readProfileStateRevision,
+  readProfileStateSnapshot
+} from './profile-state-documents'
+import { writeProfileStateDomains } from './profile-state-domain-writes'
+
+const databases: { db: ReturnType<typeof openProfileStateDatabase>['db']; directory: string }[] = []
+
+function fixture() {
+  const directory = mkdtempSync(join(tmpdir(), 'orca-history-equality-'))
+  const { db } = openProfileStateDatabase(join(directory, 'state.db'), 'profile')
+  const runs = [{ id: 'run', extension: { content: '雪 🐋' } }]
+  const payload = JSON.stringify(runs)
+  importProfileStateJson(db, JSON.stringify({ settings: {}, automationRuns: runs }))
+  const result = { db, directory, runs, payload }
+  databases.push(result)
+  return result
+}
+
+afterEach(() => {
+  for (const { db, directory } of databases.splice(0)) {
+    db.close()
+    rmSync(directory, { recursive: true, force: true })
+  }
+})
+
+describe('automation history replacement equality', () => {
+  it.each([false, true])(
+    'keeps revision and timestamp for equal history (whitespace: %s)',
+    (spaces) => {
+      const { db, payload, runs } = fixture()
+      const before = readProfileStateSnapshot(db)
+
+      expect(
+        writeProfileStateDomains(db, {
+          expectedRevision: 1,
+          replacements: [
+            {
+              domain: 'automationRuns',
+              payload: spaces ? JSON.stringify(runs, null, 2) : payload,
+              now: () => {
+                throw new Error('An unchanged replacement must not request a timestamp')
+              }
+            }
+          ]
+        })
+      ).toEqual({ changed: false, revision: 1, changedDomains: [] })
+      expect(readProfileStateSnapshot(db)).toEqual(before)
+    }
+  )
+
+  it.each([
+    {
+      payload: '[{"id":"ignored","id":"run","extension":{"value":1,"value":2}}, {"id":"next"}]',
+      presence: 'array'
+    },
+    { payload: '[{"id":"same"},{"id":"same","extension":true}]', presence: 'document' },
+    { payload: '[{"extension":true}]', presence: 'document' },
+    { payload: '[]', presence: 'array' },
+    { payload: 'null', presence: 'null' },
+    { payload: null, presence: 'absent' }
+  ])('preserves canonical JSON and storage transitions for $payload', ({ payload, presence }) => {
+    const { db } = fixture()
+
+    expect(
+      writeProfileStateDomains(db, {
+        expectedRevision: 1,
+        replacements: [{ domain: 'automationRuns', payload }]
+      })
+    ).toEqual({ changed: true, revision: 2, changedDomains: ['automationRuns'] })
+    expect(JSON.parse(readProfileStateSnapshot(db).json)).toEqual({
+      settings: {},
+      ...(payload === null ? {} : { automationRuns: JSON.parse(payload) })
+    })
+    expect(db.prepare('SELECT presence FROM profile_state_automation_runs_meta').get()).toEqual({
+      presence
+    })
+    if (presence === 'array' || presence === 'null') {
+      expect(
+        db.prepare('SELECT content_hash FROM profile_state_automation_runs_meta').get()
+      ).toEqual({
+        content_hash: hashProfileStateJson(JSON.stringify(JSON.parse(payload ?? 'null')))
+      })
+    }
+  })
+
+  it('derives prepared history from the checked payload instead of caller metadata', () => {
+    const { db } = fixture()
+    const replacement = {
+      domain: 'automationRuns',
+      payload: '[{"id":"actual"}]',
+      automationRunsValue: [{ id: 'forged' }]
+    }
+
+    writeProfileStateDomains(db, { expectedRevision: 1, replacements: [replacement] })
+
+    expect(JSON.parse(readProfileStateSnapshot(db).json)).toEqual({
+      settings: {},
+      automationRuns: [{ id: 'actual' }]
+    })
+  })
+
+  it('fences a stale caller even when its history still matches', () => {
+    const { db, payload } = fixture()
+    writeProfileStateDomains(db, {
+      expectedRevision: 1,
+      replacements: [{ domain: 'settings', payload: '{"theme":"dark"}' }]
+    })
+
+    expect(() =>
+      writeProfileStateDomains(db, {
+        expectedRevision: 1,
+        replacements: [{ domain: 'automationRuns', payload }]
+      })
+    ).toThrow(expect.objectContaining({ code: 'profile-state-revision-conflict' }))
+    expect(readProfileStateRevision(db)).toBe(2)
+  })
+
+  it('rejects malformed JSON before trusting an equal stored hash', () => {
+    const { db } = fixture()
+    db.prepare('UPDATE profile_state_automation_runs_meta SET content_hash = ?').run(
+      hashProfileStateJson('[')
+    )
+
+    expect(() =>
+      writeProfileStateDomains(db, {
+        expectedRevision: 1,
+        replacements: [{ domain: 'automationRuns', payload: '[' }]
+      })
+    ).toThrow('Profile state domain payload is invalid JSON: automationRuns')
+    expect(db.isTransaction).toBe(false)
+    expect(readProfileStateRevision(db)).toBe(1)
+  })
+
+  it('normalizes an equal document payload when normalized storage is not established', () => {
+    const { db, payload } = fixture()
+    clearProfileStateAutomationRuns(db)
+    db.prepare(
+      "UPDATE profile_state_documents SET payload = ?, content_hash = ? WHERE domain = 'automationRuns'"
+    ).run(payload, hashProfileStateJson(payload))
+    const before = readProfileStateSnapshot(db)
+
+    expect(
+      writeProfileStateDomains(db, {
+        expectedRevision: 1,
+        replacements: [{ domain: 'automationRuns', payload }]
+      })
+    ).toEqual({ changed: true, revision: 2, changedDomains: ['automationRuns'] })
+    expect(readProfileStateSnapshot(db).json).toBe(before.json)
+    expect(db.prepare('SELECT presence FROM profile_state_automation_runs_meta').get()).toEqual({
+      presence: 'array'
+    })
+  })
+
+  it('rejects a corrupt document placeholder before accepting equal normalized history', () => {
+    const { db, payload } = fixture()
+    db.prepare(
+      "UPDATE profile_state_documents SET payload = 'true' WHERE domain = 'automationRuns'"
+    ).run()
+
+    expect(() =>
+      writeProfileStateDomains(db, {
+        expectedRevision: 1,
+        replacements: [{ domain: 'automationRuns', payload }]
+      })
+    ).toThrow('Profile state document hash mismatch: automationRuns')
+    expect(readProfileStateRevision(db)).toBe(1)
+  })
+})
diff --git a/src/main/persistence/profile-state/profile-state-automation-runs-migration.ts b/src/main/persistence/profile-state/profile-state-automation-runs-migration.ts
new file mode 100644
index 000000000000..adf996192423
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-automation-runs-migration.ts
@@ -0,0 +1,46 @@
+import type Database from '../../sqlite/sync-database'
+import {
+  readProfileStateRevision,
+  assertProfileStateDocumentRevision
+} from './profile-state-revision'
+import { readProfileStateAutomationRunsDocument } from './profile-state-automation-runs-reader'
+import {
+  ProfileStateDocumentCorruptionError,
+  validateProfileStateDocumentRow
+} from './profile-state-document-validation'
+import {
+  markAutomationRunsDocumentStorage,
+  compactAutomationRunsDocument
+} from './profile-state-automation-runs-storage'
+
+export function migrateAutomationRunsStorage(db: Database.Database, storedVersion: number): void {
+  if (storedVersion < 2) {
+    markAutomationRunsDocumentStorage(db)
+  } else {
+    const meta = db
+      .prepare('SELECT domain FROM profile_state_automation_runs_meta WHERE domain = ?')
+      .get('automationRuns')
+    if (meta === undefined) {
+      // Schema 2 cannot distinguish cleared history from a lost projection marker.
+      if (
+        readProfileStateRevision(db) !== 0 ||
+        db.prepare('SELECT 1 FROM profile_state_documents LIMIT 1').get() !== undefined ||
+        db.prepare('SELECT 1 FROM profile_state_automation_runs LIMIT 1').get() !== undefined
+      ) {
+        throw new ProfileStateDocumentCorruptionError(
+          'Schema 2 automationRuns storage is ambiguous; restore a validated backup or JSON export',
+          'automationRuns'
+        )
+      }
+      markAutomationRunsDocumentStorage(db)
+    }
+  }
+  const revision = readProfileStateRevision(db)
+  for (const row of db.prepare('SELECT * FROM profile_state_documents').all()) {
+    const document = validateProfileStateDocumentRow(row)
+    assertProfileStateDocumentRevision(document.revision, revision, document.domain)
+  }
+  if (readProfileStateAutomationRunsDocument(db, revision) !== undefined) {
+    compactAutomationRunsDocument(db)
+  }
+}
diff --git a/src/main/persistence/profile-state/profile-state-automation-runs-model.ts b/src/main/persistence/profile-state/profile-state-automation-runs-model.ts
new file mode 100644
index 000000000000..b02418cf8ea6
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-automation-runs-model.ts
@@ -0,0 +1,49 @@
+export const PROFILE_STATE_AUTOMATION_RUNS_TABLE = 'profile_state_automation_runs'
+export const PROFILE_STATE_AUTOMATION_RUNS_META_TABLE = 'profile_state_automation_runs_meta'
+
+export const AUTOMATION_RUNS_DOMAIN = 'automationRuns'
+export const AUTOMATION_RUNS_ABSENT = 'absent'
+export const AUTOMATION_RUNS_NULL = 'null'
+export const AUTOMATION_RUNS_ARRAY = 'array'
+export const AUTOMATION_RUNS_DOCUMENT = 'document'
+
+export type AutomationRunsPresence =
+  | typeof AUTOMATION_RUNS_DOCUMENT
+  | typeof AUTOMATION_RUNS_ABSENT
+  | typeof AUTOMATION_RUNS_NULL
+  | typeof AUTOMATION_RUNS_ARRAY
+
+export type AutomationRunsMeta = {
+  presence: AutomationRunsPresence
+  domainVersion: number
+  revision: number
+  updatedAt: number
+  contentHash: string
+}
+
+export type AutomationRunPayload = {
+  id: string
+  ordinal: number
+  payload: string
+  contentHash: string
+}
+
+export type NormalizedAutomationRunRow = AutomationRunPayload & {
+  revision: number
+  updatedAt: number
+}
+
+export type AutomationRunIdentity = {
+  id: string
+  ordinal: number
+  contentHash: string
+}
+
+export type ParsedAutomationRunsReplacement =
+  | { presence: typeof AUTOMATION_RUNS_ABSENT; contentHash: ''; runs?: undefined }
+  | { presence: typeof AUTOMATION_RUNS_NULL; contentHash: string; runs?: undefined }
+  | {
+      presence: typeof AUTOMATION_RUNS_ARRAY
+      contentHash: string
+      runs: readonly AutomationRunPayload[]
+    }
diff --git a/src/main/persistence/profile-state/profile-state-automation-runs-payload.ts b/src/main/persistence/profile-state/profile-state-automation-runs-payload.ts
new file mode 100644
index 000000000000..32da30b87848
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-automation-runs-payload.ts
@@ -0,0 +1,72 @@
+import { createHash } from 'node:crypto'
+import { hashProfileStatePayload, isRecord } from './profile-state-document-validation'
+import {
+  AUTOMATION_RUNS_ABSENT,
+  AUTOMATION_RUNS_ARRAY,
+  AUTOMATION_RUNS_NULL,
+  type AutomationRunPayload,
+  type ParsedAutomationRunsReplacement
+} from './profile-state-automation-runs-model'
+
+export function parseAutomationRunsReplacement(
+  payload: string | null
+): ParsedAutomationRunsReplacement | undefined {
+  if (payload === null) {
+    return parseAutomationRunsValue(undefined)
+  }
+  let parsed: unknown
+  try {
+    parsed = JSON.parse(payload)
+  } catch {
+    return undefined
+  }
+  return parseAutomationRunsValue(parsed)
+}
+
+export function parseAutomationRunsValue(
+  value: unknown
+): ParsedAutomationRunsReplacement | undefined {
+  if (value === undefined) {
+    return { presence: AUTOMATION_RUNS_ABSENT, contentHash: '' }
+  }
+  if (value === null) {
+    return { presence: AUTOMATION_RUNS_NULL, contentHash: hashProfileStatePayload('null') }
+  }
+  if (!Array.isArray(value)) {
+    return undefined
+  }
+  return parseAutomationRunValues(value)
+}
+
+export function parseAutomationRunValues(
+  values: readonly unknown[]
+): ParsedAutomationRunsReplacement | undefined {
+  const ids = new Set<string>()
+  const runs: AutomationRunPayload[] = []
+  const aggregate = createHash('sha256').update('[')
+  for (const [ordinal, value] of values.entries()) {
+    if (!isRecord(value) || typeof value.id !== 'string' || ids.has(value.id)) {
+      return undefined
+    }
+    const runPayload = JSON.stringify(value)
+    if (runPayload === undefined) {
+      return undefined
+    }
+    if (ordinal > 0) {
+      aggregate.update(',')
+    }
+    aggregate.update(runPayload, 'utf8')
+    ids.add(value.id)
+    runs.push({
+      id: value.id,
+      ordinal,
+      payload: runPayload,
+      contentHash: hashProfileStatePayload(runPayload)
+    })
+  }
+  return {
+    presence: AUTOMATION_RUNS_ARRAY,
+    contentHash: aggregate.update(']').digest('hex'),
+    runs
+  }
+}
diff --git a/src/main/persistence/profile-state/profile-state-automation-runs-reader.ts b/src/main/persistence/profile-state/profile-state-automation-runs-reader.ts
new file mode 100644
index 000000000000..c8e4087a1a8c
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-automation-runs-reader.ts
@@ -0,0 +1,151 @@
+import { createHash } from 'node:crypto'
+import type Database from '../../sqlite/sync-database'
+import { readProfileStateRevision } from './profile-state-revision'
+import {
+  hashProfileStatePayload,
+  ProfileStateDocumentCorruptionError,
+  type ProfileStateDocument,
+  type ProfileStateParsedDocument,
+  type ProfileStateValidatedDocument
+} from './profile-state-document-validation'
+import {
+  AUTOMATION_RUNS_ABSENT,
+  AUTOMATION_RUNS_DOCUMENT,
+  AUTOMATION_RUNS_DOMAIN,
+  AUTOMATION_RUNS_NULL,
+  PROFILE_STATE_AUTOMATION_RUNS_TABLE,
+  type AutomationRunsMeta
+} from './profile-state-automation-runs-model'
+import {
+  assertNoNormalizedAutomationRuns,
+  parseNormalizedAutomationRunRow
+} from './profile-state-automation-runs-validation'
+
+import { readCurrentAutomationRunsState } from './profile-state-automation-runs-storage'
+
+type Representation = 'serialized' | 'parsed' | 'validated'
+type ReadDocument =
+  | ProfileStateDocument
+  | ProfileStateParsedDocument
+  | ProfileStateValidatedDocument
+
+/** Undefined means explicit document storage; null means the domain is absent. */
+export function readProfileStateAutomationRunsDocument(
+  db: Database.Database,
+  profileRevision?: number
+): ProfileStateDocument | null | undefined
+export function readProfileStateAutomationRunsDocument(
+  db: Database.Database,
+  profileRevision: number,
+  representation: 'parsed'
+): ProfileStateParsedDocument | null | undefined
+export function readProfileStateAutomationRunsDocument(
+  db: Database.Database,
+  profileRevision: number,
+  representation: 'validated'
+): ProfileStateValidatedDocument | null | undefined
+export function readProfileStateAutomationRunsDocument(
+  db: Database.Database,
+  profileRevision = readProfileStateRevision(db),
+  representation: Representation = 'serialized'
+): ReadDocument | null | undefined {
+  const meta = readCurrentAutomationRunsState(db, profileRevision)
+  if (meta.presence === AUTOMATION_RUNS_DOCUMENT) {
+    return undefined
+  }
+  if (meta.presence === AUTOMATION_RUNS_ABSENT) {
+    assertNoNormalizedAutomationRuns(db)
+    return null
+  }
+  if (meta.presence === AUTOMATION_RUNS_NULL) {
+    if (meta.contentHash !== hashProfileStatePayload('null')) {
+      throw new ProfileStateDocumentCorruptionError(
+        'Normalized automationRuns null hash mismatch',
+        AUTOMATION_RUNS_DOMAIN
+      )
+    }
+    assertNoNormalizedAutomationRuns(db)
+    return makeAutomationRunsDocument(
+      meta,
+      representation === 'validated'
+        ? {}
+        : representation === 'parsed'
+          ? { value: null }
+          : { payload: 'null' }
+    )
+  }
+
+  // Sort only stable keys; payloads stay outside the sorter and extra columns cannot shadow the key.
+  const references = db.prepare(
+    `SELECT run_id FROM ${PROFILE_STATE_AUTOMATION_RUNS_TABLE} ORDER BY ordinal`
+  )
+  const row = db.prepare(
+    `SELECT run_id, ordinal, payload, content_hash, revision, updated_at FROM ${PROFILE_STATE_AUTOMATION_RUNS_TABLE} WHERE run_id = ?`
+  )
+  const payloads: string[] = []
+  const values: unknown[] = []
+  const aggregate = createHash('sha256').update('[')
+  const ids = new Set<string>()
+  let index = 0
+  for (const reference of references.iterate()) {
+    const parsed = parseNormalizedAutomationRunRow(
+      row.get(reference.run_id),
+      representation === 'parsed'
+    )
+    if (parsed.id !== reference.run_id || parsed.ordinal !== index || ids.has(parsed.id)) {
+      throw new ProfileStateDocumentCorruptionError(
+        'Normalized automationRuns ordering is corrupt',
+        AUTOMATION_RUNS_DOMAIN
+      )
+    }
+    if (
+      parsed.revision > meta.revision ||
+      (parsed.revision === meta.revision && parsed.updatedAt !== meta.updatedAt)
+    ) {
+      throw new ProfileStateDocumentCorruptionError(
+        'Normalized automationRuns row metadata is inconsistent',
+        AUTOMATION_RUNS_DOMAIN
+      )
+    }
+    ids.add(parsed.id)
+    if (index > 0) {
+      aggregate.update(',')
+    }
+    aggregate.update(parsed.payload, 'utf8')
+    if (representation === 'parsed') {
+      values.push(parsed.value)
+    } else if (representation === 'serialized') {
+      payloads.push(parsed.payload)
+    }
+    index++
+  }
+  const contentHash = aggregate.update(']').digest('hex')
+  if (contentHash !== meta.contentHash) {
+    throw new ProfileStateDocumentCorruptionError(
+      'Normalized automationRuns aggregate hash mismatch',
+      AUTOMATION_RUNS_DOMAIN
+    )
+  }
+  return makeAutomationRunsDocument(
+    meta,
+    representation === 'validated'
+      ? {}
+      : representation === 'parsed'
+        ? { value: values }
+        : { payload: `[${payloads.join(',')}]` }
+  )
+}
+
+function makeAutomationRunsDocument(
+  meta: AutomationRunsMeta,
+  content: { payload: string } | { value: unknown } | Record<string, never>
+): ReadDocument {
+  return {
+    domain: AUTOMATION_RUNS_DOMAIN,
+    ...content,
+    domainVersion: meta.domainVersion,
+    revision: meta.revision,
+    updatedAt: meta.updatedAt,
+    contentHash: meta.contentHash
+  }
+}
diff --git a/src/main/persistence/profile-state/profile-state-automation-runs-serialization.test.ts b/src/main/persistence/profile-state/profile-state-automation-runs-serialization.test.ts
new file mode 100644
index 000000000000..389498aa3649
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-automation-runs-serialization.test.ts
@@ -0,0 +1,65 @@
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { describe, expect, it } from 'vitest'
+import { buildProfileStateCutoverFixture } from '../profile-state-cutover-fixture'
+import { openProfileStateDatabase } from './profile-state-database'
+import { importProfileStateJson, readProfileStateSnapshot } from './profile-state-documents'
+import { writeProfileStateDomains } from './profile-state-domain-writes'
+
+describe('automation history serialization', () => {
+  it.each(['import', 'replacement', 'delta'] as const)(
+    'preserves JSON ordering, escaping and unknown fields through %s',
+    (operation) => {
+      const directory = mkdtempSync(join(tmpdir(), 'orca-automation-run-serialization-'))
+      const { db } = openProfileStateDatabase(join(directory, 'state.db'), 'profile')
+      try {
+        const fixtureRun = buildProfileStateCutoverFixture().automationRuns[0]
+        if (!fixtureRun) {
+          throw new Error('Expected an automation run fixture')
+        }
+        const runs = [
+          {
+            ...fixtureRun,
+            id: 'second',
+            extension: {
+              '3': 3,
+              '1': 1,
+              z: '雪 🐋\ud800',
+              a: ['\\', '\n', '"', null],
+              omitted: undefined
+            }
+          },
+          { ...fixtureRun, id: 'first', extension: { fractional: -0 } }
+        ]
+        const settings = { note: 'unchanged' }
+        const expected = JSON.stringify({ settings, automationRuns: runs })
+        importProfileStateJson(db, JSON.stringify({ settings, automationRuns: runs.toReversed() }))
+        if (operation === 'import') {
+          importProfileStateJson(db, expected, { expectedRevision: 1 })
+        } else {
+          writeProfileStateDomains(db, {
+            expectedRevision: 1,
+            replacements:
+              operation === 'replacement'
+                ? [{ domain: 'automationRuns', payload: JSON.stringify(runs) }]
+                : [],
+            ...(operation === 'delta' ? { automationRunsAfter: runs } : {})
+          })
+        }
+
+        expect(readProfileStateSnapshot(db)).toMatchObject({ revision: 2, json: expected })
+        expect(
+          writeProfileStateDomains(db, {
+            expectedRevision: 2,
+            replacements: [],
+            automationRunsAfter: runs
+          })
+        ).toEqual({ changed: false, revision: 2, changedDomains: [] })
+      } finally {
+        db.close()
+        rmSync(directory, { recursive: true, force: true })
+      }
+    }
+  )
+})
diff --git a/src/main/persistence/profile-state/profile-state-automation-runs-storage.ts b/src/main/persistence/profile-state/profile-state-automation-runs-storage.ts
new file mode 100644
index 000000000000..c9ee590d3695
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-automation-runs-storage.ts
@@ -0,0 +1,49 @@
+import type Database from '../../sqlite/sync-database'
+import { hashProfileStatePayload } from './profile-state-document-validation'
+import { assertProfileStateDocumentRevision } from './profile-state-revision'
+import {
+  AUTOMATION_RUNS_DOCUMENT,
+  AUTOMATION_RUNS_DOMAIN,
+  PROFILE_STATE_AUTOMATION_RUNS_META_TABLE,
+  type AutomationRunsMeta
+} from './profile-state-automation-runs-model'
+import {
+  assertNoNormalizedAutomationRuns,
+  parseAutomationRunsMeta
+} from './profile-state-automation-runs-validation'
+
+export function readCurrentAutomationRunsState(
+  db: Database.Database,
+  actualRevision: number
+): AutomationRunsMeta {
+  const row = db
+    .prepare(
+      `SELECT domain, presence, domain_version, revision, updated_at, content_hash
+     FROM ${PROFILE_STATE_AUTOMATION_RUNS_META_TABLE} WHERE domain = ?`
+    )
+    .get(AUTOMATION_RUNS_DOMAIN)
+  const meta = parseAutomationRunsMeta(row)
+  assertProfileStateDocumentRevision(meta.revision, actualRevision, AUTOMATION_RUNS_DOMAIN)
+  if (meta.presence === AUTOMATION_RUNS_DOCUMENT) {
+    assertNoNormalizedAutomationRuns(db)
+  }
+  return meta
+}
+
+export function markAutomationRunsDocumentStorage(db: Database.Database): void {
+  db.prepare(
+    `INSERT INTO ${PROFILE_STATE_AUTOMATION_RUNS_META_TABLE}
+     (domain, presence, domain_version, revision, updated_at, content_hash)
+     VALUES (?, ?, 1, 0, 0, '')
+     ON CONFLICT(domain) DO UPDATE SET presence = excluded.presence,
+     domain_version = 1, revision = 0, updated_at = 0, content_hash = ''`
+  ).run(AUTOMATION_RUNS_DOMAIN, AUTOMATION_RUNS_DOCUMENT)
+}
+
+/** Retain the key's JSON position without retaining a second history payload. */
+export function compactAutomationRunsDocument(db: Database.Database): void {
+  db.prepare(
+    `UPDATE profile_state_documents SET payload = 'null', content_hash = ?
+     WHERE domain = ? AND payload <> 'null'`
+  ).run(hashProfileStatePayload('null'), AUTOMATION_RUNS_DOMAIN)
+}
diff --git a/src/main/persistence/profile-state/profile-state-automation-runs-validation.ts b/src/main/persistence/profile-state/profile-state-automation-runs-validation.ts
new file mode 100644
index 000000000000..98d0f79cc4b4
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-automation-runs-validation.ts
@@ -0,0 +1,154 @@
+import type Database from '../../sqlite/sync-database'
+import {
+  hashProfileStatePayload,
+  isRecord,
+  ProfileStateDocumentCorruptionError
+} from './profile-state-document-validation'
+import {
+  AUTOMATION_RUNS_ABSENT,
+  AUTOMATION_RUNS_ARRAY,
+  AUTOMATION_RUNS_DOMAIN,
+  AUTOMATION_RUNS_DOCUMENT,
+  AUTOMATION_RUNS_NULL,
+  PROFILE_STATE_AUTOMATION_RUNS_TABLE,
+  type AutomationRunIdentity,
+  type AutomationRunsMeta,
+  type NormalizedAutomationRunRow
+} from './profile-state-automation-runs-model'
+
+export function assertNoNormalizedAutomationRuns(db: Database.Database): void {
+  const row = db
+    .prepare(`SELECT COUNT(*) AS count FROM ${PROFILE_STATE_AUTOMATION_RUNS_TABLE}`)
+    .get()
+  if (isRecord(row) && row.count !== 0) {
+    throw new ProfileStateDocumentCorruptionError(
+      'Normalized automationRuns rows exist for an empty domain',
+      AUTOMATION_RUNS_DOMAIN
+    )
+  }
+}
+
+export function parseAutomationRunsMeta(row: unknown): AutomationRunsMeta {
+  if (
+    !isRecord(row) ||
+    row.domain !== AUTOMATION_RUNS_DOMAIN ||
+    (row.presence !== AUTOMATION_RUNS_ABSENT &&
+      row.presence !== AUTOMATION_RUNS_DOCUMENT &&
+      row.presence !== AUTOMATION_RUNS_NULL &&
+      row.presence !== AUTOMATION_RUNS_ARRAY) ||
+    typeof row.domain_version !== 'number' ||
+    typeof row.revision !== 'number' ||
+    typeof row.updated_at !== 'number' ||
+    typeof row.content_hash !== 'string'
+  ) {
+    throw new ProfileStateDocumentCorruptionError(
+      'Normalized automationRuns metadata is malformed',
+      AUTOMATION_RUNS_DOMAIN
+    )
+  }
+  if (
+    !Number.isSafeInteger(row.domain_version) ||
+    row.domain_version < 1 ||
+    !Number.isSafeInteger(row.revision) ||
+    row.revision < (row.presence === AUTOMATION_RUNS_DOCUMENT ? 0 : 1) ||
+    !Number.isSafeInteger(row.updated_at) ||
+    row.updated_at < 0 ||
+    (row.presence === AUTOMATION_RUNS_ABSENT || row.presence === AUTOMATION_RUNS_DOCUMENT
+      ? row.content_hash !== ''
+      : !/^[a-f0-9]{64}$/.test(row.content_hash))
+  ) {
+    throw new ProfileStateDocumentCorruptionError(
+      'Normalized automationRuns metadata is invalid',
+      AUTOMATION_RUNS_DOMAIN
+    )
+  }
+  if (
+    row.presence === AUTOMATION_RUNS_DOCUMENT &&
+    (row.revision !== 0 || row.updated_at !== 0 || row.domain_version !== 1)
+  ) {
+    throw new ProfileStateDocumentCorruptionError(
+      'AutomationRuns document storage marker is invalid',
+      AUTOMATION_RUNS_DOMAIN
+    )
+  }
+  return {
+    presence: row.presence,
+    domainVersion: row.domain_version,
+    revision: row.revision,
+    updatedAt: row.updated_at,
+    contentHash: row.content_hash
+  }
+}
+
+export function parseNormalizedAutomationRunRow(
+  row: unknown,
+  retainParsedValue = false
+): NormalizedAutomationRunRow & { value?: unknown } {
+  if (
+    !isRecord(row) ||
+    typeof row.run_id !== 'string' ||
+    typeof row.ordinal !== 'number' ||
+    typeof row.payload !== 'string' ||
+    typeof row.content_hash !== 'string' ||
+    typeof row.revision !== 'number' ||
+    typeof row.updated_at !== 'number' ||
+    !Number.isSafeInteger(row.ordinal) ||
+    row.ordinal < 0 ||
+    !Number.isSafeInteger(row.revision) ||
+    row.revision < 1 ||
+    !Number.isSafeInteger(row.updated_at) ||
+    row.updated_at < 0 ||
+    hashProfileStatePayload(row.payload) !== row.content_hash
+  ) {
+    throw new ProfileStateDocumentCorruptionError(
+      'Normalized automationRuns row is corrupt',
+      AUTOMATION_RUNS_DOMAIN
+    )
+  }
+  // Individually invalid fragments can splice into a valid aggregate with matching IDs.
+  let parsed: unknown
+  try {
+    parsed = JSON.parse(row.payload)
+  } catch {
+    throw new ProfileStateDocumentCorruptionError(
+      'Normalized automationRuns row is invalid JSON',
+      AUTOMATION_RUNS_DOMAIN
+    )
+  }
+  if (!isRecord(parsed) || parsed.id !== row.run_id) {
+    throw new ProfileStateDocumentCorruptionError(
+      'Normalized automationRuns row identity is corrupt',
+      AUTOMATION_RUNS_DOMAIN
+    )
+  }
+  return {
+    id: row.run_id,
+    ordinal: row.ordinal,
+    payload: row.payload,
+    contentHash: row.content_hash,
+    revision: row.revision,
+    updatedAt: row.updated_at,
+    ...(retainParsedValue ? { value: parsed } : {})
+  }
+}
+
+export function parseAutomationRunIdentity(row: unknown): AutomationRunIdentity {
+  if (
+    !isRecord(row) ||
+    typeof row.run_id !== 'string' ||
+    typeof row.ordinal !== 'number' ||
+    typeof row.content_hash !== 'string' ||
+    !Number.isSafeInteger(row.ordinal) ||
+    row.ordinal < 0
+  ) {
+    throw new ProfileStateDocumentCorruptionError(
+      'Normalized automationRuns row is malformed',
+      AUTOMATION_RUNS_DOMAIN
+    )
+  }
+  return {
+    id: row.run_id,
+    ordinal: row.ordinal,
+    contentHash: row.content_hash
+  }
+}
diff --git a/src/main/persistence/profile-state/profile-state-automation-runs-writer.ts b/src/main/persistence/profile-state/profile-state-automation-runs-writer.ts
new file mode 100644
index 000000000000..31f4eb4f1d1c
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-automation-runs-writer.ts
@@ -0,0 +1,158 @@
+import type Database from '../../sqlite/sync-database'
+import type { PreparedProfileStateMutation } from './profile-state-domain-write-validation'
+import {
+  AUTOMATION_RUNS_ARRAY,
+  AUTOMATION_RUNS_DOMAIN,
+  PROFILE_STATE_AUTOMATION_RUNS_META_TABLE,
+  PROFILE_STATE_AUTOMATION_RUNS_TABLE,
+  type AutomationRunIdentity,
+  type ParsedAutomationRunsReplacement
+} from './profile-state-automation-runs-model'
+import {
+  parseAutomationRunValues,
+  parseAutomationRunsReplacement,
+  parseAutomationRunsValue
+} from './profile-state-automation-runs-payload'
+import { parseAutomationRunIdentity } from './profile-state-automation-runs-validation'
+import {
+  readCurrentAutomationRunsState,
+  compactAutomationRunsDocument
+} from './profile-state-automation-runs-storage'
+
+export type AutomationRunsWritePreparation = {
+  changed: boolean
+  incoming: ParsedAutomationRunsReplacement
+  domainVersion: number
+  now?: () => number
+}
+
+export function rebuildProfileStateAutomationRunsProjection(
+  db: Database.Database,
+  payload: string,
+  domainVersion: number,
+  updatedAt: number,
+  revision: number
+): boolean {
+  const incoming = parseAutomationRunsReplacement(payload)
+  if (incoming === undefined) {
+    return false
+  }
+  const now = resolveAutomationRunsTimestamp(() => updatedAt)
+  applyIncomingAutomationRuns(db, incoming, domainVersion, now, revision)
+  return true
+}
+
+export function prepareProfileStateAutomationRunsReplacement(
+  db: Database.Database,
+  replacement: PreparedProfileStateMutation,
+  actualRevision: number
+): AutomationRunsWritePreparation | undefined {
+  const current = readCurrentAutomationRunsState(db, actualRevision)
+  const incoming = parseAutomationRunsValue(replacement.automationRunsValue)
+  if (incoming === undefined) {
+    return undefined
+  }
+  return {
+    changed: current.presence !== incoming.presence || current.contentHash !== incoming.contentHash,
+    incoming,
+    domainVersion: replacement.domainVersion,
+    now: replacement.now
+  }
+}
+
+export function prepareProfileStateAutomationRunsDelta(
+  db: Database.Database,
+  after: readonly unknown[],
+  domainVersion: number,
+  now: () => number,
+  actualRevision: number
+): AutomationRunsWritePreparation | undefined {
+  const incoming = parseAutomationRunValues(after)
+  if (incoming === undefined) {
+    return undefined
+  }
+  const current = readCurrentAutomationRunsState(db, actualRevision)
+  return {
+    changed: current.presence !== incoming.presence || current.contentHash !== incoming.contentHash,
+    incoming,
+    domainVersion,
+    now
+  }
+}
+
+export function applyProfileStateAutomationRuns(
+  db: Database.Database,
+  preparation: AutomationRunsWritePreparation,
+  nextRevision: number
+): void {
+  const now = resolveAutomationRunsTimestamp(preparation.now ?? Date.now)
+  applyIncomingAutomationRuns(
+    db,
+    preparation.incoming,
+    preparation.domainVersion,
+    now,
+    nextRevision
+  )
+}
+
+function applyIncomingAutomationRuns(
+  db: Database.Database,
+  incoming: ParsedAutomationRunsReplacement,
+  domainVersion: number,
+  now: number,
+  nextRevision: number
+): void {
+  const existingRows = new Map<string, AutomationRunIdentity>()
+  for (const row of db
+    .prepare(`SELECT run_id, ordinal, content_hash FROM ${PROFILE_STATE_AUTOMATION_RUNS_TABLE}`)
+    .all()) {
+    const parsed = parseAutomationRunIdentity(row)
+    existingRows.set(parsed.id, parsed)
+  }
+
+  const upsert = db.prepare(
+    `INSERT INTO ${PROFILE_STATE_AUTOMATION_RUNS_TABLE}
+     (run_id, ordinal, payload, content_hash, revision, updated_at) VALUES (?, ?, ?, ?, ?, ?)
+     ON CONFLICT(run_id) DO UPDATE SET ordinal = excluded.ordinal,
+     payload = excluded.payload, content_hash = excluded.content_hash,
+     revision = excluded.revision, updated_at = excluded.updated_at`
+  )
+  if (incoming.presence === AUTOMATION_RUNS_ARRAY) {
+    for (const run of incoming.runs) {
+      const existing = existingRows.get(run.id)
+      existingRows.delete(run.id)
+      if (existing?.ordinal === run.ordinal && existing.contentHash === run.contentHash) {
+        continue
+      }
+      upsert.run(run.id, run.ordinal, run.payload, run.contentHash, nextRevision, now)
+    }
+  }
+  const remove = db.prepare(`DELETE FROM ${PROFILE_STATE_AUTOMATION_RUNS_TABLE} WHERE run_id = ?`)
+  for (const id of existingRows.keys()) {
+    remove.run(id)
+  }
+
+  db.prepare(
+    `INSERT INTO ${PROFILE_STATE_AUTOMATION_RUNS_META_TABLE}
+     (domain, presence, domain_version, revision, updated_at, content_hash) VALUES (?, ?, ?, ?, ?, ?)
+     ON CONFLICT(domain) DO UPDATE SET presence = excluded.presence,
+     domain_version = excluded.domain_version, revision = excluded.revision,
+     updated_at = excluded.updated_at, content_hash = excluded.content_hash`
+  ).run(
+    AUTOMATION_RUNS_DOMAIN,
+    incoming.presence,
+    domainVersion,
+    nextRevision,
+    now,
+    incoming.contentHash
+  )
+  compactAutomationRunsDocument(db)
+}
+
+function resolveAutomationRunsTimestamp(nowFactory: () => number): number {
+  const now = nowFactory()
+  if (!Number.isSafeInteger(now) || now < 0) {
+    throw new Error('Profile state domain update timestamp is invalid: automationRuns')
+  }
+  return now
+}
diff --git a/src/main/persistence/profile-state/profile-state-automation-runs.ts b/src/main/persistence/profile-state/profile-state-automation-runs.ts
new file mode 100644
index 000000000000..8b81cf070197
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-automation-runs.ts
@@ -0,0 +1,22 @@
+import type Database from '../../sqlite/sync-database'
+import { markAutomationRunsDocumentStorage } from './profile-state-automation-runs-storage'
+import { PROFILE_STATE_AUTOMATION_RUNS_TABLE } from './profile-state-automation-runs-model'
+
+export {
+  PROFILE_STATE_AUTOMATION_RUNS_META_TABLE,
+  PROFILE_STATE_AUTOMATION_RUNS_TABLE
+} from './profile-state-automation-runs-model'
+export type { AutomationRunPayload } from './profile-state-automation-runs-model'
+export type { AutomationRunsWritePreparation } from './profile-state-automation-runs-writer'
+export {
+  applyProfileStateAutomationRuns,
+  prepareProfileStateAutomationRunsDelta,
+  prepareProfileStateAutomationRunsReplacement,
+  rebuildProfileStateAutomationRunsProjection
+} from './profile-state-automation-runs-writer'
+export { readProfileStateAutomationRunsDocument } from './profile-state-automation-runs-reader'
+
+export function clearProfileStateAutomationRuns(db: Database.Database): void {
+  db.prepare(`DELETE FROM ${PROFILE_STATE_AUTOMATION_RUNS_TABLE}`).run()
+  markAutomationRunsDocumentStorage(db)
+}
diff --git a/src/main/persistence/profile-state/profile-state-automation-storage-upgrade.test.ts b/src/main/persistence/profile-state/profile-state-automation-storage-upgrade.test.ts
new file mode 100644
index 000000000000..bb28c491f0e8
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-automation-storage-upgrade.test.ts
@@ -0,0 +1,380 @@
+import { mkdtempSync, readFileSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it } from 'vitest'
+import Database from '../../sqlite/sync-database'
+import { openProfileStateDatabase, profileStatePragmaNumber } from './profile-state-database'
+import { PROFILE_STATE_DATABASE_SCHEMA_VERSION } from './profile-state-database-schema'
+import { hashProfileStatePayload } from './profile-state-document-validation'
+import { exportProfileStateJson, importProfileStateJson } from './profile-state-documents'
+import { readProfileStateDomain } from './profile-state-domain-reader'
+import { writeProfileStateDomain } from './profile-state-domain-writes'
+
+const directories: string[] = []
+const connections: Database.Database[] = []
+const staleRuns = [{ id: 'deleted-run', status: 'running', output: 'stale history'.repeat(1_000) }]
+const liveRuns = [{ id: 'live-run', status: 'completed', future: { retained: true } }]
+
+afterEach(() => {
+  for (const db of connections.splice(0)) {
+    db.close()
+  }
+  for (const directory of directories.splice(0)) {
+    rmSync(directory, { recursive: true, force: true })
+  }
+})
+
+function databasePath(): string {
+  const directory = mkdtempSync(join(tmpdir(), 'orca-automation-upgrade-'))
+  directories.push(directory)
+  return join(directory, 'profile-state.db')
+}
+
+function openDatabase(path: string): Database.Database {
+  const { db } = openProfileStateDatabase(path, 'profile-a')
+  connections.push(db)
+  return db
+}
+
+function expectRejectedDatabaseUntouched(path: string, profileId = 'profile-a'): void {
+  const before = readFileSync(path)
+  expect(() => {
+    const { db } = openProfileStateDatabase(path, profileId)
+    connections.push(db)
+  }).toThrowError(
+    expect.objectContaining({
+      code: profileId === 'profile-a' ? 'unreadable' : 'identity-mismatch'
+    })
+  )
+  expect(readFileSync(path)).toEqual(before)
+}
+
+type LegacyProjection = {
+  presence: 'array' | 'null' | 'absent'
+  runs?: readonly { id: string; [key: string]: unknown }[]
+}
+
+function seedLegacyDatabase(
+  version: 1 | 2,
+  root: Record<string, unknown>,
+  projection?: LegacyProjection,
+  revision = projection ? 2 : 1
+): string {
+  const path = databasePath()
+  const db = new Database(path)
+  try {
+    db.exec(`
+      CREATE TABLE profile_state_meta (key TEXT PRIMARY KEY NOT NULL, value TEXT NOT NULL);
+      CREATE TABLE profile_state_documents (
+        domain TEXT PRIMARY KEY NOT NULL, payload TEXT NOT NULL,
+        domain_version INTEGER NOT NULL, revision INTEGER NOT NULL,
+        updated_at INTEGER NOT NULL, content_hash TEXT NOT NULL
+      );
+    `)
+    db.prepare('INSERT INTO profile_state_meta VALUES (?, ?)').run('profile_id', 'profile-a')
+    db.prepare('INSERT INTO profile_state_meta VALUES (?, ?)').run('revision', String(revision))
+    for (const [domain, value] of Object.entries(root)) {
+      const payload = JSON.stringify(value)
+      db.prepare('INSERT INTO profile_state_documents VALUES (?, ?, 1, 1, 100, ?)').run(
+        domain,
+        payload,
+        hashProfileStatePayload(payload)
+      )
+    }
+    if (version === 2) {
+      db.exec(`
+        CREATE TABLE profile_state_automation_runs_meta (
+          domain TEXT PRIMARY KEY NOT NULL, presence TEXT NOT NULL,
+          domain_version INTEGER NOT NULL, revision INTEGER NOT NULL,
+          updated_at INTEGER NOT NULL, content_hash TEXT NOT NULL
+        );
+        CREATE TABLE profile_state_automation_runs (
+          run_id TEXT PRIMARY KEY NOT NULL, ordinal INTEGER NOT NULL,
+          payload TEXT NOT NULL, content_hash TEXT NOT NULL,
+          revision INTEGER NOT NULL, updated_at INTEGER NOT NULL
+        );
+      `)
+      if (projection) {
+        const runs = projection.runs ?? []
+        const payload = projection.presence === 'array' ? JSON.stringify(runs) : 'null'
+        db.prepare(
+          'INSERT INTO profile_state_automation_runs_meta VALUES (?, ?, 1, 2, 200, ?)'
+        ).run(
+          'automationRuns',
+          projection.presence,
+          projection.presence === 'absent' ? '' : hashProfileStatePayload(payload)
+        )
+        for (const [ordinal, run] of runs.entries()) {
+          const runPayload = JSON.stringify(run)
+          db.prepare('INSERT INTO profile_state_automation_runs VALUES (?, ?, ?, ?, 2, 200)').run(
+            run.id,
+            ordinal,
+            runPayload,
+            hashProfileStatePayload(runPayload)
+          )
+        }
+      }
+    }
+    db.pragma(`user_version = ${version}`)
+  } finally {
+    db.close()
+  }
+  return path
+}
+
+describe('automation storage schema upgrades', () => {
+  it.each([
+    { label: 'supported runs', value: liveRuns },
+    { label: 'explicit null', value: null },
+    { label: 'unknown object', value: { futureFormat: [1, 2] } },
+    { label: 'duplicate identifiers', value: [{ id: 'same' }, { id: 'same', future: true }] }
+  ])('preserves version 1 $label and domain ordering', ({ value }) => {
+    const root = { settings: { theme: 'dark' }, automationRuns: value, futureDomain: [2, 1] }
+    const db = openDatabase(seedLegacyDatabase(1, root))
+
+    expect(profileStatePragmaNumber(db, 'user_version')).toBe(PROFILE_STATE_DATABASE_SCHEMA_VERSION)
+    expect(exportProfileStateJson(db)).toBe(JSON.stringify(root))
+    expect(db.prepare('SELECT presence FROM profile_state_automation_runs_meta').get()).toEqual({
+      presence: 'document'
+    })
+    expect(db.prepare('SELECT COUNT(*) AS count FROM profile_state_automation_runs').get()).toEqual(
+      {
+        count: 0
+      }
+    )
+  })
+
+  it('normalizes a version 1 document on replacement without duplicating its payload', () => {
+    const root = { settings: {}, automationRuns: liveRuns, futureDomain: [2, 1] }
+    const db = openDatabase(seedLegacyDatabase(1, root))
+
+    expect(
+      writeProfileStateDomain(db, {
+        domain: 'automationRuns',
+        payload: JSON.stringify(liveRuns),
+        expectedRevision: 1
+      })
+    ).toEqual({ changed: true, revision: 2 })
+
+    expect(exportProfileStateJson(db)).toBe(JSON.stringify(root))
+    expect(
+      db
+        .prepare('SELECT payload FROM profile_state_documents WHERE domain = ?')
+        .get('automationRuns')
+    ).toEqual({ payload: 'null' })
+  })
+
+  it.each([
+    { presence: 'array', runs: liveRuns, expected: liveRuns },
+    { presence: 'array', runs: [], expected: [] },
+    { presence: 'null', expected: null },
+    { presence: 'absent', expected: undefined }
+  ] as const)(
+    'keeps version 2 $presence authority while removing stale retained history',
+    (value) => {
+      const root = { settings: {}, automationRuns: staleRuns, futureDomain: { kept: true } }
+      const path = seedLegacyDatabase(2, root, value)
+      const db = openDatabase(path)
+      const expected = { ...root, automationRuns: value.expected }
+
+      expect(exportProfileStateJson(db)).toBe(JSON.stringify(expected))
+      expect(readProfileStateDomain(path, 'profile-a', 'automationRuns')).toEqual(
+        value.expected === undefined
+          ? { kind: 'missing' }
+          : { kind: 'value', value: value.expected }
+      )
+      expect(
+        db
+          .prepare('SELECT payload FROM profile_state_documents WHERE domain = ?')
+          .get('automationRuns')
+      ).toEqual({ payload: 'null' })
+      expect(profileStatePragmaNumber(db, 'user_version')).toBe(
+        PROFILE_STATE_DATABASE_SCHEMA_VERSION
+      )
+    }
+  )
+
+  it.each([
+    { label: 'stale run array', root: { automationRuns: staleRuns } },
+    { label: 'empty array', root: { automationRuns: [] } },
+    { label: 'explicit null', root: { automationRuns: null } },
+    { label: 'unknown value', root: { automationRuns: { futureFormat: true } } },
+    { label: 'absent domain', root: {} }
+  ])('refuses ambiguous version 2 $label without rewriting it', ({ root }) => {
+    const path = seedLegacyDatabase(2, root)
+    expectRejectedDatabaseUntouched(path)
+    const db = new Database(path)
+    connections.push(db)
+    expect(profileStatePragmaNumber(db, 'user_version')).toBe(2)
+    expect(db.prepare('SELECT domain FROM profile_state_automation_runs_meta').all()).toEqual([])
+    expect(
+      db.prepare('SELECT domain, payload FROM profile_state_documents ORDER BY rowid').all()
+    ).toEqual(
+      Object.entries(root).map(([domain, value]) => ({ domain, payload: JSON.stringify(value) }))
+    )
+  })
+
+  it('upgrades a genuinely empty version 2 database', () => {
+    const db = openDatabase(seedLegacyDatabase(2, {}, undefined, 0))
+    expect(exportProfileStateJson(db)).toBe('{}')
+    expect(importProfileStateJson(db, JSON.stringify({ automationRuns: liveRuns }))).toBe(1)
+    expect(JSON.parse(exportProfileStateJson(db))).toEqual({ automationRuns: liveRuns })
+  })
+
+  it.each(['legacy document', 'normalized row', 'projection metadata'])(
+    'rolls back version 2 migration with corrupt %s',
+    (target) => {
+      const path = seedLegacyDatabase(
+        2,
+        { automationRuns: staleRuns },
+        { presence: 'array', runs: liveRuns }
+      )
+      const tampered = new Database(path)
+      try {
+        if (target === 'legacy document') {
+          tampered.exec("UPDATE profile_state_documents SET content_hash = 'broken'")
+        } else if (target === 'normalized row') {
+          tampered.exec("UPDATE profile_state_automation_runs SET content_hash = 'broken'")
+        } else {
+          tampered.exec("UPDATE profile_state_automation_runs_meta SET content_hash = 'broken'")
+        }
+      } finally {
+        tampered.close()
+      }
+
+      expectRejectedDatabaseUntouched(path)
+      const db = new Database(path)
+      connections.push(db)
+      expect(profileStatePragmaNumber(db, 'user_version')).toBe(2)
+      expect(
+        db
+          .prepare('SELECT payload FROM profile_state_documents WHERE domain = ?')
+          .get('automationRuns')
+      ).toEqual({ payload: JSON.stringify(staleRuns) })
+    }
+  )
+})
+
+describe('rejected schema upgrades preserve source bytes', () => {
+  it.each([1, 2] as const)('rejects another profile in schema %s before migration', (version) => {
+    const path = seedLegacyDatabase(
+      version,
+      { automationRuns: staleRuns },
+      { presence: 'array', runs: liveRuns }
+    )
+    expectRejectedDatabaseUntouched(path, 'profile-b')
+  })
+
+  it.each([1, 2] as const)(
+    'rejects an incompatible schema %s document column before migration',
+    (version) => {
+      const path = seedLegacyDatabase(
+        version,
+        { automationRuns: staleRuns },
+        { presence: 'array', runs: liveRuns }
+      )
+      const db = new Database(path)
+      try {
+        db.exec(`
+        ALTER TABLE profile_state_documents RENAME TO old_documents;
+        CREATE TABLE profile_state_documents (
+          domain TEXT PRIMARY KEY NOT NULL, payload BLOB NOT NULL,
+          domain_version INTEGER NOT NULL, revision INTEGER NOT NULL,
+          updated_at INTEGER NOT NULL, content_hash TEXT NOT NULL
+        );
+        INSERT INTO profile_state_documents SELECT * FROM old_documents;
+        DROP TABLE old_documents;
+      `)
+      } finally {
+        db.close()
+      }
+      expectRejectedDatabaseUntouched(path)
+    }
+  )
+
+  it.each([
+    { label: 'negative schema version', sql: 'PRAGMA user_version = -1' },
+    { label: 'missing run table', sql: 'DROP TABLE profile_state_automation_runs' },
+    { label: 'missing metadata table', sql: 'DROP TABLE profile_state_automation_runs_meta' }
+  ])('rejects a version 2 database with $label before migration', ({ sql }) => {
+    const path = seedLegacyDatabase(
+      2,
+      { automationRuns: staleRuns },
+      { presence: 'array', runs: liveRuns }
+    )
+    const db = new Database(path)
+    try {
+      db.exec(sql)
+    } finally {
+      db.close()
+    }
+    expectRejectedDatabaseUntouched(path)
+  })
+})
+
+describe('required automation storage metadata', () => {
+  it.each([
+    { label: 'cleared array', payload: '[]' },
+    { label: 'explicit null', payload: 'null' },
+    { label: 'removed domain', payload: null }
+  ])('refuses lost metadata after $label instead of resurrecting retained state', ({ payload }) => {
+    const path = databasePath()
+    const db = openDatabase(path)
+    importProfileStateJson(db, JSON.stringify({ automationRuns: staleRuns }))
+    writeProfileStateDomain(db, { domain: 'automationRuns', payload, expectedRevision: 1 })
+    db.exec('DELETE FROM profile_state_automation_runs_meta')
+
+    expect(() => exportProfileStateJson(db)).toThrow()
+    expect(readProfileStateDomain(path, 'profile-a', 'automationRuns')).toMatchObject({
+      kind: 'unreadable'
+    })
+    expect(() =>
+      writeProfileStateDomain(db, {
+        domain: 'automationRuns',
+        payload: JSON.stringify(liveRuns),
+        expectedRevision: 2
+      })
+    ).toThrow()
+    expect(db.prepare('SELECT COUNT(*) AS count FROM profile_state_automation_runs').get()).toEqual(
+      { count: 0 }
+    )
+  })
+
+  it.each(['revision = 1', 'updated_at = 1', 'domain_version = 2', "content_hash = 'unexpected'"])(
+    'rejects a malformed document marker (%s)',
+    (assignment) => {
+      const db = openDatabase(databasePath())
+      importProfileStateJson(db, JSON.stringify({ automationRuns: { futureFormat: true } }))
+      db.exec(`UPDATE profile_state_automation_runs_meta SET ${assignment}`)
+      expect(() => exportProfileStateJson(db)).toThrow()
+    }
+  )
+
+  it('keeps one authority through complete imports of supported, unknown, and absent history', () => {
+    const db = openDatabase(databasePath())
+    for (const root of [
+      { settings: {}, automationRuns: liveRuns },
+      { settings: {}, automationRuns: { futureFormat: [2, 1] } },
+      { settings: {} },
+      { settings: {}, automationRuns: null },
+      { settings: {}, automationRuns: [] }
+    ]) {
+      importProfileStateJson(db, JSON.stringify(root))
+      expect(exportProfileStateJson(db)).toBe(JSON.stringify(root))
+      expect(
+        db.prepare('SELECT COUNT(*) AS count FROM profile_state_automation_runs_meta').get()
+      ).toEqual({ count: 1 })
+    }
+  })
+
+  it('rejects reopening a current database with lost metadata before changing its bytes', () => {
+    const path = databasePath()
+    const { db } = openProfileStateDatabase(path, 'profile-a')
+    db.exec('DELETE FROM profile_state_automation_runs_meta')
+    db.close()
+    const before = readFileSync(path)
+
+    expect(() => openDatabase(path)).toThrow()
+    expect(readFileSync(path)).toEqual(before)
+  })
+})
diff --git a/src/main/persistence/profile-state/profile-state-backup-job.ts b/src/main/persistence/profile-state/profile-state-backup-job.ts
new file mode 100644
index 000000000000..f10ef15368c8
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-backup-job.ts
@@ -0,0 +1,33 @@
+import { openProfileStateDatabaseReadOnly } from './profile-state-database'
+import { writeProfileStateDatabaseSnapshotAsync } from './profile-state-database-snapshot'
+import { validateProfileStateSnapshot } from './profile-state-documents'
+
+export type ProfileStateBackupJob = {
+  databasePath: string
+  profileId: string
+  targetPath: string
+  temporaryPath?: string
+}
+
+/** Own every connection until the copy and its strict validation finish. */
+export async function writeProfileStateBackup(job: ProfileStateBackupJob): Promise<void> {
+  const opened = openProfileStateDatabaseReadOnly(job.databasePath, job.profileId)
+  try {
+    await writeProfileStateDatabaseSnapshotAsync(opened.db, job.targetPath, {
+      temporaryPath: job.temporaryPath,
+      validateStagedSnapshot: (stagingPath) =>
+        validateProfileStateBackup(stagingPath, job.profileId)
+    })
+  } finally {
+    opened.db.close()
+  }
+}
+
+function validateProfileStateBackup(path: string, profileId: string): void {
+  const snapshot = openProfileStateDatabaseReadOnly(path, profileId)
+  try {
+    validateProfileStateSnapshot(snapshot.db)
+  } finally {
+    snapshot.db.close()
+  }
+}
diff --git a/src/main/persistence/profile-state/profile-state-backup-path.test.ts b/src/main/persistence/profile-state/profile-state-backup-path.test.ts
new file mode 100644
index 000000000000..593d490ce115
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-backup-path.test.ts
@@ -0,0 +1,76 @@
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it } from 'vitest'
+import {
+  createProfileStateDatabaseBackupId,
+  profileStateDatabaseBackupFiles,
+  profileStateDatabaseBackupPath,
+  profileStateDatabaseBackups
+} from './profile-state-backup-path'
+
+const directories: string[] = []
+afterEach(() => {
+  for (const path of directories.splice(0)) {
+    rmSync(path, { recursive: true, force: true })
+  }
+})
+
+function location(): string {
+  const directory = mkdtempSync(join(tmpdir(), 'orca-backup-path-'))
+  directories.push(directory)
+  return join(directory, 'profile-state.db')
+}
+
+describe('profile state database backup discovery', () => {
+  it('lists immutable backup IDs newest-first without opening SQLite', () => {
+    const path = location()
+    const first = createProfileStateDatabaseBackupId(1_000)
+    const last = createProfileStateDatabaseBackupId(2_000)
+    writeFileSync(profileStateDatabaseBackupPath(path, first), 'first')
+    writeFileSync(profileStateDatabaseBackupPath(path, last), 'second')
+    writeFileSync(`${path}.backup.${last}.db.tmp`, 'incomplete staging')
+    writeFileSync(`${path}.backup.invalid.db`, 'unrelated')
+    expect(profileStateDatabaseBackups(path)).toEqual([
+      { id: last, path: profileStateDatabaseBackupPath(path, last), createdAtMs: 2_000 },
+      { id: first, path: profileStateDatabaseBackupPath(path, first), createdAtMs: 1_000 }
+    ])
+  })
+
+  it('keeps reserved artifact names visible when their type needs recovery', () => {
+    const path = location()
+    const id = createProfileStateDatabaseBackupId()
+    mkdirSync(profileStateDatabaseBackupPath(path, id))
+    expect(profileStateDatabaseBackups(path).map((backup) => backup.id)).toEqual([id])
+  })
+
+  it('includes every existing backup sidecar in the recovery archive inventory', () => {
+    const path = location()
+    const backup = profileStateDatabaseBackupPath(path, createProfileStateDatabaseBackupId())
+    const files = [backup, `${backup}-wal`, `${backup}-shm`, `${backup}-journal`]
+    for (const file of files) {
+      writeFileSync(file, 'recovery evidence')
+    }
+    expect(profileStateDatabaseBackupFiles(path)).toEqual(files)
+  })
+
+  it.each([
+    '../profile-state.db',
+    '1-../../outside',
+    '0-00000000-0000-4000-8000-000000000000',
+    '9007199254740992-00000000-0000-4000-8000-000000000000'
+  ])('rejects invalid or escaping IDs: %s', (id) =>
+    expect(() => profileStateDatabaseBackupPath(location(), id)).toThrow('ID is invalid')
+  )
+
+  it.each([0, -1, 1.5, Number.MAX_SAFE_INTEGER + 1])('rejects unsafe backup times: %s', (time) => {
+    expect(() => createProfileStateDatabaseBackupId(time)).toThrow('positive safe integer')
+  })
+
+  it('treats only a missing directory as an empty recovery inventory', () => {
+    const path = location()
+    expect(profileStateDatabaseBackups(join(path, 'profile-state.db'))).toEqual([])
+    writeFileSync(path, 'not a directory')
+    expect(() => profileStateDatabaseBackups(join(path, 'profile-state.db'))).toThrow()
+  })
+})
diff --git a/src/main/persistence/profile-state/profile-state-backup-path.ts b/src/main/persistence/profile-state/profile-state-backup-path.ts
new file mode 100644
index 000000000000..c85029947c65
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-backup-path.ts
@@ -0,0 +1,88 @@
+import { profileStateDatabaseFiles } from './profile-state-storage-classification'
+import { randomUUID } from 'node:crypto'
+import { existsSync, readdirSync } from 'node:fs'
+import { readdir } from 'node:fs/promises'
+import { basename, dirname, join } from 'node:path'
+
+const BACKUP_ID_PATTERN =
+  /^([1-9]\d*)-([0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12})$/
+
+export type ProfileStateDatabaseBackup = {
+  id: string
+  path: string
+  createdAtMs: number
+}
+
+export function createProfileStateDatabaseBackupId(now = Date.now()): string {
+  if (!Number.isSafeInteger(now) || now <= 0) {
+    throw new Error('Profile state backup timestamp must be a positive safe integer')
+  }
+  return `${now}-${randomUUID()}`
+}
+
+export function profileStateDatabaseBackupPath(databaseFile: string, id: string): string {
+  if (parseBackupCreatedAt(id) === undefined) {
+    throw new Error('Profile state backup ID is invalid')
+  }
+  return `${databaseFile}.backup.${id}.db`
+}
+
+/** Enumerate immutable recovery artifacts without opening the possibly damaged primary. */
+export function profileStateDatabaseBackups(
+  databaseFile: string
+): readonly ProfileStateDatabaseBackup[] {
+  let entries: string[]
+  try {
+    entries = readdirSync(dirname(databaseFile))
+  } catch (error) {
+    if (error instanceof Error && 'code' in error && error.code === 'ENOENT') {
+      return []
+    }
+    throw error
+  }
+  return parseBackupEntries(databaseFile, entries)
+}
+
+export async function profileStateDatabaseBackupsAsync(
+  databaseFile: string
+): Promise<readonly ProfileStateDatabaseBackup[]> {
+  try {
+    return parseBackupEntries(databaseFile, await readdir(dirname(databaseFile)))
+  } catch (error) {
+    if (error instanceof Error && 'code' in error && error.code === 'ENOENT') {
+      return []
+    }
+    throw error
+  }
+}
+
+function parseBackupEntries(
+  databaseFile: string,
+  entries: readonly string[]
+): readonly ProfileStateDatabaseBackup[] {
+  const directory = dirname(databaseFile)
+  const prefix = `${basename(databaseFile)}.backup.`
+  return entries
+    .flatMap((name) => {
+      if (typeof name !== 'string' || !name.startsWith(prefix) || !name.endsWith('.db')) {
+        return []
+      }
+      const id = name.slice(prefix.length, -3)
+      const createdAtMs = parseBackupCreatedAt(id)
+      return createdAtMs === undefined ? [] : [{ id, path: join(directory, name), createdAtMs }]
+    })
+    .sort((left, right) => right.createdAtMs - left.createdAtMs || right.id.localeCompare(left.id))
+}
+
+function parseBackupCreatedAt(id: string): number | undefined {
+  const match = BACKUP_ID_PATTERN.exec(id)
+  const timestamp = match ? Number(match[1]) : 0
+  return Number.isSafeInteger(timestamp) && timestamp > 0 ? timestamp : undefined
+}
+
+/** Preserve sidecars too if an external writer has opened an otherwise immutable backup. */
+export function profileStateDatabaseBackupFiles(databaseFile: string): readonly string[] {
+  return profileStateDatabaseBackups(databaseFile).flatMap(({ path }) =>
+    profileStateDatabaseFiles(path).filter(existsSync)
+  )
+}
diff --git a/src/main/persistence/profile-state/profile-state-backup-rotation.test.ts b/src/main/persistence/profile-state/profile-state-backup-rotation.test.ts
new file mode 100644
index 000000000000..eb99b1fd128c
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-backup-rotation.test.ts
@@ -0,0 +1,278 @@
+import { existsSync, mkdirSync, mkdtempSync, readdirSync, rmSync, writeFileSync } from 'node:fs'
+import * as fsPromises from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { ProfileStateBackupRotation } from './profile-state-backup-rotation'
+import {
+  createProfileStateDatabaseBackupId,
+  profileStateDatabaseBackupPath,
+  profileStateDatabaseBackups
+} from './profile-state-backup-path'
+import {
+  openProfileStateDatabase,
+  openProfileStateDatabaseReadOnly
+} from './profile-state-database'
+import { importProfileStateJson, readProfileStateSnapshot } from './profile-state-documents'
+import * as backupExecution from './profile-state-backup-worker'
+
+vi.mock('node:fs/promises', async (importOriginal) => {
+  const actual = await importOriginal<typeof fsPromises>()
+  return { ...actual }
+})
+
+const directories: string[] = []
+const rotations: ProfileStateBackupRotation[] = []
+const databases: ReturnType<typeof openProfileStateDatabase>[] = []
+const HOUR = 60 * 60 * 1000
+
+beforeEach(() => {
+  vi.spyOn(backupExecution, 'runProfileStateBackup')
+})
+
+afterEach(async () => {
+  for (const rotation of rotations.splice(0)) {
+    rotation.stop()
+    await rotation.drain()
+  }
+  for (const opened of databases.splice(0)) {
+    opened.db.close()
+  }
+  vi.restoreAllMocks()
+  for (const directory of directories.splice(0)) {
+    rmSync(directory, { recursive: true, force: true })
+  }
+})
+
+function fixture() {
+  const directory = mkdtempSync(join(tmpdir(), 'orca-sqlite-backup-'))
+  directories.push(directory)
+  const databasePath = join(directory, 'profile-state.db')
+  const opened = openProfileStateDatabase(databasePath, 'backup-profile')
+  databases.push(opened)
+  const clock = { now: Date.now() }
+  const rotation = createRotation(databasePath, () => clock.now)
+  const write = (generation: number) => {
+    importProfileStateJson(opened.db, JSON.stringify({ settings: { generation } }))
+  }
+  write(1)
+  return { directory, databasePath, opened, rotation, write, clock }
+}
+
+function createRotation(databasePath: string, now: () => number = Date.now) {
+  const rotation = new ProfileStateBackupRotation(databasePath, 'backup-profile', now)
+  rotations.push(rotation)
+  return rotation
+}
+
+function readBackup(path: string) {
+  const opened = openProfileStateDatabaseReadOnly(path, 'backup-profile')
+  try {
+    return JSON.parse(readProfileStateSnapshot(opened.db).json)
+  } finally {
+    opened.db.close()
+  }
+}
+
+describe('automatic SQLite recovery generations', () => {
+  it('copies committed WAL state once, without a live JSON writer or snapshot sidecars', async () => {
+    const { directory, databasePath, rotation, write } = fixture()
+    write(2)
+    rotation.schedule()
+    rotation.schedule()
+    await rotation.drain()
+    const backups = profileStateDatabaseBackups(databasePath)
+    expect(backups).toHaveLength(1)
+    expect(readBackup(backups[0].path)).toEqual({ settings: { generation: 2 } })
+    expect(existsSync(join(directory, 'orca-data.json'))).toBe(false)
+    expect(readdirSync(directory).filter((name) => name.includes('.backup.'))).toEqual([
+      backups[0].path.slice(directory.length + 1)
+    ])
+  })
+
+  it('keeps five hourly generations and remembers cadence across reopen', async () => {
+    const { databasePath, rotation, write, clock } = fixture()
+    const beginning = Date.now()
+    clock.now = beginning
+    for (let generation = 1; generation <= 7; generation++) {
+      clock.now = beginning + (generation - 1) * HOUR
+      write(generation)
+      rotation.schedule()
+      await rotation.drain()
+    }
+    const backups = profileStateDatabaseBackups(databasePath)
+    expect(backups).toHaveLength(5)
+    expect(backups.map(({ path }) => readBackup(path).settings.generation)).toEqual([7, 6, 5, 4, 3])
+    const reopened = createRotation(databasePath, () => clock.now)
+    reopened.schedule()
+    await reopened.drain()
+    expect(profileStateDatabaseBackups(databasePath)).toEqual(backups)
+    clock.now = beginning + 7 * HOUR - 1
+    reopened.schedule()
+    await reopened.drain()
+    expect(profileStateDatabaseBackups(databasePath)).toEqual(backups)
+    clock.now = beginning + 7 * HOUR
+    write(8)
+    reopened.schedule()
+    await reopened.drain()
+    expect(
+      profileStateDatabaseBackups(databasePath).map(
+        ({ path }) => readBackup(path).settings.generation
+      )
+    ).toEqual([8, 7, 6, 5, 4])
+  })
+
+  it('preserves all earlier backups on failure and retries without rejecting a committed write', async () => {
+    const { databasePath, rotation, opened, write, clock } = fixture()
+    const beginning = Date.now()
+    clock.now = beginning
+    rotation.schedule()
+    await rotation.drain()
+    const retained = profileStateDatabaseBackups(databasePath)
+    const snapshot = vi
+      .spyOn(backupExecution, 'runProfileStateBackup')
+      .mockClear()
+      .mockRejectedValueOnce(new Error('disk full'))
+    const log = vi.spyOn(console, 'error').mockImplementation(() => {})
+    clock.now = beginning + HOUR
+    write(2)
+    rotation.schedule()
+    await expect(rotation.drain()).resolves.toBeUndefined()
+    expect(JSON.parse(readProfileStateSnapshot(opened.db).json).settings.generation).toBe(2)
+    expect(profileStateDatabaseBackups(databasePath)).toEqual(retained)
+    expect(log).toHaveBeenCalledOnce()
+    rotation.schedule()
+    await rotation.drain()
+    expect(snapshot).toHaveBeenCalledOnce()
+    clock.now = beginning + HOUR + 60_000
+    rotation.schedule()
+    await rotation.drain()
+    expect(profileStateDatabaseBackups(databasePath)).toHaveLength(2)
+  })
+
+  it('does not prune previous generations when the new copy fails strict validation', async () => {
+    const { databasePath, rotation, clock } = fixture()
+    const beginning = Date.now()
+    clock.now = beginning
+    rotation.schedule()
+    await rotation.drain()
+    const retained = profileStateDatabaseBackups(databasePath)
+    vi.spyOn(console, 'error').mockImplementation(() => {})
+    vi.spyOn(backupExecution, 'runProfileStateBackup')
+      .mockClear()
+      .mockRejectedValueOnce(new Error('staged validation failed'))
+    clock.now = beginning + HOUR
+    rotation.schedule()
+    await rotation.drain()
+    expect(profileStateDatabaseBackups(databasePath)).toEqual(retained)
+  })
+
+  it('cancels a queued backup before opening a source after Store close', async () => {
+    const { databasePath, rotation } = fixture()
+    rotation.schedule()
+    expect(() => rotation.assertIdle()).toThrow('Flush pending')
+    rotation.stop()
+    expect(() => rotation.assertIdle()).toThrow('Flush pending')
+    await rotation.drain()
+    expect(() => rotation.assertIdle()).not.toThrow()
+    expect(profileStateDatabaseBackups(databasePath)).toEqual([])
+  })
+
+  it('blocks synchronous quarantine until retention pruning finishes', async () => {
+    const { databasePath, rotation, clock } = fixture()
+    for (let generation = 0; generation < 5; generation++) {
+      rotation.schedule()
+      await rotation.drain()
+      clock.now += HOUR
+    }
+    const oldest = profileStateDatabaseBackups(databasePath)[4].path
+    const remove = fsPromises.rm
+    let begin: () => void = () => {}
+    let release: () => void = () => {}
+    const started = new Promise<void>((resolve) => {
+      begin = resolve
+    })
+    const gate = new Promise<void>((resolve) => {
+      release = resolve
+    })
+    vi.spyOn(fsPromises, 'rm').mockImplementation(async (path, options) => {
+      if (path === oldest) {
+        begin()
+        await gate
+      }
+      await remove(path, options)
+    })
+    rotation.schedule()
+    try {
+      await started
+      rotation.stop()
+      expect(profileStateDatabaseBackups(databasePath)).toHaveLength(6)
+      expect(() => rotation.assertIdle()).toThrow('Flush pending')
+    } finally {
+      release()
+      await rotation.drain()
+    }
+    expect(() => rotation.assertIdle()).not.toThrow()
+    expect(profileStateDatabaseBackups(databasePath)).toHaveLength(5)
+  })
+
+  it('owns an in-flight source until completion and blocks synchronous quarantine', async () => {
+    const { databasePath, rotation, opened } = fixture()
+    const realSnapshot = backupExecution.runProfileStateBackup
+    let begin: () => void = () => {}
+    let release: () => void = () => {}
+    const started = new Promise<void>((resolve) => {
+      begin = resolve
+    })
+    const gate = new Promise<void>((resolve) => {
+      release = resolve
+    })
+    vi.spyOn(backupExecution, 'runProfileStateBackup').mockImplementationOnce(async (job) => {
+      begin()
+      await gate
+      await realSnapshot(job)
+    })
+    rotation.schedule()
+    await started
+    rotation.stop()
+    opened.db.close()
+    databases.splice(databases.indexOf(opened), 1)
+    expect(() => rotation.assertIdle()).toThrow('Flush pending')
+    release()
+    await rotation.drain()
+    expect(() => rotation.assertIdle()).not.toThrow()
+    expect(readBackup(profileStateDatabaseBackups(databasePath)[0].path)).toEqual({
+      settings: { generation: 1 }
+    })
+  })
+
+  it('does not treat a reserved-name directory as a recent successful backup', async () => {
+    const { databasePath, rotation } = fixture()
+    const invalid = profileStateDatabaseBackupPath(
+      databasePath,
+      createProfileStateDatabaseBackupId()
+    )
+    mkdirSync(invalid)
+    rotation.schedule()
+    await rotation.drain()
+    expect(profileStateDatabaseBackups(databasePath)).toHaveLength(2)
+    expect(existsSync(invalid)).toBe(true)
+  })
+
+  it('preserves a backup with sidecars without counting it toward cadence or retention', async () => {
+    const { databasePath, rotation, clock } = fixture()
+    rotation.schedule()
+    await rotation.drain()
+    const original = profileStateDatabaseBackups(databasePath)[0].path
+    writeFileSync(`${original}-journal`, 'external unfinished write')
+    const reopened = createRotation(databasePath, () => clock.now)
+    for (let generation = 0; generation < 6; generation++) {
+      reopened.schedule()
+      await reopened.drain()
+      clock.now += HOUR
+    }
+    expect(existsSync(original)).toBe(true)
+    expect(existsSync(`${original}-journal`)).toBe(true)
+    expect(profileStateDatabaseBackups(databasePath)).toHaveLength(6)
+  })
+})
diff --git a/src/main/persistence/profile-state/profile-state-backup-rotation.ts b/src/main/persistence/profile-state/profile-state-backup-rotation.ts
new file mode 100644
index 000000000000..d13ce4265dac
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-backup-rotation.ts
@@ -0,0 +1,131 @@
+import { lstat, rm } from 'node:fs/promises'
+import {
+  createProfileStateDatabaseBackupId,
+  profileStateDatabaseBackupPath,
+  profileStateDatabaseBackupsAsync,
+  type ProfileStateDatabaseBackup
+} from './profile-state-backup-path'
+import { runProfileStateBackup } from './profile-state-backup-worker'
+import { removeAbandonedProfileStateBackupFiles } from './profile-state-backup-temporary-files'
+
+const BACKUP_COUNT = 5
+const BACKUP_INTERVAL_MS = 60 * 60 * 1000
+const BACKUP_RETRY_MS = 60 * 1000
+
+/** Immutable generations keep every previous recovery point until publication succeeds. */
+export class ProfileStateBackupRotation {
+  private pending: Promise<void> | undefined
+  private stopped = false
+  private readonly cancellation = new AbortController()
+  private nextAttemptAt = 0
+
+  constructor(
+    private readonly databasePath: string,
+    private readonly profileId: string,
+    private readonly now: () => number = Date.now,
+    private readonly runBackup = runProfileStateBackup
+  ) {}
+
+  schedule(): void {
+    if (this.stopped || this.pending || this.now() < this.nextAttemptAt) {
+      return
+    }
+    const pending = Promise.resolve()
+      .then(() => this.rotate())
+      .catch((error: unknown) => {
+        this.nextAttemptAt = this.now() + BACKUP_RETRY_MS
+        if (this.stopped && (this.cancellation.signal.aborted || isMissingPath(error))) {
+          return
+        }
+        console.error('[persistence] Failed to back up profile state database:', error)
+      })
+      .finally(() => {
+        if (this.pending === pending) {
+          this.pending = undefined
+        }
+      })
+    this.pending = pending
+  }
+
+  async drain(): Promise<void> {
+    await this.pending
+  }
+
+  stop(): void {
+    this.stopped = true
+    this.cancellation.abort()
+  }
+
+  assertIdle(): void {
+    if (this.pending) {
+      throw new Error('Flush pending profile state backups before quarantining the database')
+    }
+  }
+
+  private async rotate(): Promise<void> {
+    if (this.stopped) {
+      return
+    }
+    const now = this.now()
+    await removeAbandonedProfileStateBackupFiles(this.databasePath, now)
+    const latest = (await this.regularBackups())[0]
+    if (this.stopped) {
+      return
+    }
+    if (latest && now - latest.createdAtMs < BACKUP_INTERVAL_MS) {
+      this.nextAttemptAt = Math.min(latest.createdAtMs, now) + BACKUP_INTERVAL_MS
+      return
+    }
+    const target = profileStateDatabaseBackupPath(
+      this.databasePath,
+      createProfileStateDatabaseBackupId(now)
+    )
+    await this.runBackup(
+      {
+        databasePath: this.databasePath,
+        profileId: this.profileId,
+        targetPath: target
+      },
+      this.cancellation.signal
+    )
+    this.nextAttemptAt = this.now() + BACKUP_INTERVAL_MS
+    for (const backup of (await this.regularBackups()).slice(BACKUP_COUNT)) {
+      await rm(backup.path, { force: true })
+    }
+  }
+
+  private async regularBackups(): Promise<readonly ProfileStateDatabaseBackup[]> {
+    const backups = await profileStateDatabaseBackupsAsync(this.databasePath)
+    const candidates = await Promise.all(
+      backups.map(async (backup) => {
+        try {
+          if (!(await lstat(backup.path)).isFile()) {
+            return undefined
+          }
+          for (const suffix of ['-wal', '-shm', '-journal']) {
+            const sidecar = await lstat(`${backup.path}${suffix}`).catch((error: unknown) => {
+              if (error instanceof Error && 'code' in error && error.code === 'ENOENT') {
+                return undefined
+              }
+              throw error
+            })
+            if (sidecar !== undefined) {
+              return undefined
+            }
+          }
+          return backup
+        } catch (error) {
+          if (error instanceof Error && 'code' in error && error.code === 'ENOENT') {
+            return undefined
+          }
+          throw error
+        }
+      })
+    )
+    return candidates.filter((backup) => backup !== undefined)
+  }
+}
+
+function isMissingPath(error: unknown): boolean {
+  return error instanceof Error && 'code' in error && error.code === 'ENOENT'
+}
diff --git a/src/main/persistence/profile-state/profile-state-backup-temporary-files.test.ts b/src/main/persistence/profile-state/profile-state-backup-temporary-files.test.ts
new file mode 100644
index 000000000000..a37de695fa5b
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-backup-temporary-files.test.ts
@@ -0,0 +1,91 @@
+import { mkdtempSync, readdirSync, rmSync, utimesSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { basename, join } from 'node:path'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import * as identity from './profile-state-access-identity'
+import {
+  createProfileStateDatabaseBackupId,
+  profileStateDatabaseBackupPath
+} from './profile-state-backup-path'
+import {
+  profileStateBackupTemporaryPath,
+  removeAbandonedProfileStateBackupFiles
+} from './profile-state-backup-temporary-files'
+
+vi.mock('./profile-state-access-identity', () => ({
+  profileStateAccessBootIdentity: () => 'test-boot'
+}))
+vi.mock('./profile-state-access-owner', () => ({
+  profileStateAccessPidNamespace: () => 'test-namespace'
+}))
+
+const roots: string[] = []
+afterEach(() => {
+  vi.restoreAllMocks()
+  for (const root of roots.splice(0)) {
+    rmSync(root, { recursive: true, force: true })
+  }
+})
+
+describe('abandoned profile database backups', () => {
+  it('does not infer ownership when kernel identity is unavailable', async () => {
+    vi.spyOn(identity, 'profileStateAccessBootIdentity').mockReturnValue(null)
+    const probe = vi.spyOn(process, 'kill')
+    await removeAbandonedProfileStateBackupFiles('/missing/profile-state.db', Date.now())
+    expect(probe).not.toHaveBeenCalled()
+    expect(profileStateBackupTemporaryPath('/profile/backup.db')).not.toContain('.owner-')
+  })
+
+  it('removes only old temporary files whose owner is proven exited', async () => {
+    const root = mkdtempSync(join(tmpdir(), 'orca-backup-orphans-'))
+    roots.push(root)
+    const databasePath = join(root, 'profile-state.db')
+    const backup = profileStateDatabaseBackupPath(
+      databasePath,
+      createProfileStateDatabaseBackupId()
+    )
+    const now = Date.now()
+    const old = new Date(now - 2 * 60 * 60_000)
+    const temporary = profileStateBackupTemporaryPath(backup)
+    const orphan = temporary.replace(`.${process.pid}.`, '.12345.')
+    const live = temporary.replace(`.${process.pid}.`, '.12346.')
+    const unknown = temporary.replace(`.${process.pid}.`, '.12347.')
+    const recent = profileStateBackupTemporaryPath(backup).replace(`.${process.pid}.`, '.12345.')
+    const remote = orphan.replace(/owner-[a-f0-9]{64}/, `owner-${'0'.repeat(64)}`)
+    const legacy = `${backup}.12345.${now}.ab12.tmp`
+    const unrelated = `${databasePath}.unrelated.tmp`
+    for (const path of [
+      backup,
+      orphan,
+      `${orphan}-wal`,
+      `${orphan}-shm`,
+      `${orphan}-journal`,
+      live,
+      unknown,
+      recent,
+      remote,
+      legacy,
+      unrelated
+    ]) {
+      writeFileSync(path, 'retained')
+      if (path !== recent) {
+        utimesSync(path, old, old)
+      }
+    }
+    vi.spyOn(process, 'kill').mockImplementation((pid) => {
+      if (pid === 12345) {
+        throw Object.assign(new Error('exited'), { code: 'ESRCH' })
+      }
+      if (pid === 12347) {
+        throw Object.assign(new Error('denied'), { code: 'EPERM' })
+      }
+      return true
+    })
+    await removeAbandonedProfileStateBackupFiles(databasePath, now)
+    expect(readdirSync(root).sort()).toEqual(
+      [backup, live, unknown, recent, remote, legacy, unrelated]
+        .map((path) => basename(path))
+        .sort()
+    )
+  })
+})
diff --git a/src/main/persistence/profile-state/profile-state-backup-temporary-files.ts b/src/main/persistence/profile-state/profile-state-backup-temporary-files.ts
new file mode 100644
index 000000000000..eb0424abbc29
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-backup-temporary-files.ts
@@ -0,0 +1,71 @@
+import { createHash } from 'node:crypto'
+import { lstat, readdir, rm } from 'node:fs/promises'
+import { durableWriteTempPath } from '../../durable-file-write'
+import { profileStateAccessBootIdentity } from './profile-state-access-identity'
+import { profileStateAccessPidNamespace } from './profile-state-access-owner'
+import { basename, dirname, join } from 'node:path'
+
+const ORPHAN_AGE_MS = 60 * 60_000
+const BACKUP_TEMP_PATTERN =
+  /^([1-9]\d*)-[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}\.db\.owner-([a-f0-9]{64})\.([1-9]\d*)\.\d+\.[0-9a-f]+\.tmp(?:-(?:wal|shm|journal))?$/
+
+export function profileStateBackupTemporaryPath(targetPath: string): string {
+  const scope = currentProcessScope()
+  return durableWriteTempPath(scope ? `${targetPath}.owner-${scope}` : targetPath)
+}
+
+function currentProcessScope(): string | undefined {
+  const boot = profileStateAccessBootIdentity()
+  const namespace = profileStateAccessPidNamespace()
+  if (!boot || (process.platform === 'linux' && namespace === null)) {
+    return undefined
+  }
+  return createHash('sha256')
+    .update(JSON.stringify([process.platform, boot, namespace]))
+    .digest('hex')
+}
+
+/** A dead process proves the temporary database and its journals cannot still be in use. */
+export async function removeAbandonedProfileStateBackupFiles(
+  databasePath: string,
+  now: number
+): Promise<void> {
+  const scope = currentProcessScope()
+  if (!scope) {
+    return
+  }
+  const directory = dirname(databasePath)
+  const prefix = `${basename(databasePath)}.backup.`
+  for (const name of await readdir(directory)) {
+    if (!name.startsWith(prefix)) {
+      continue
+    }
+    const match = BACKUP_TEMP_PATTERN.exec(name.slice(prefix.length))
+    if (!match || match[2] !== scope || !ownerExited(Number(match[3]))) {
+      continue
+    }
+    const path = join(directory, name)
+    try {
+      const info = await lstat(path)
+      if (info.isFile() && now - info.mtimeMs >= ORPHAN_AGE_MS) {
+        await rm(path, { force: true })
+      }
+    } catch (error) {
+      if (!(error instanceof Error && 'code' in error && error.code === 'ENOENT')) {
+        throw error
+      }
+    }
+  }
+}
+
+function ownerExited(pid: number): boolean {
+  if (!Number.isSafeInteger(pid) || pid <= 0) {
+    return false
+  }
+  try {
+    process.kill(pid, 0)
+    return false
+  } catch (error) {
+    return error instanceof Error && 'code' in error && error.code === 'ESRCH'
+  }
+}
diff --git a/src/main/persistence/profile-state/profile-state-backup-worker-entry.ts b/src/main/persistence/profile-state/profile-state-backup-worker-entry.ts
new file mode 100644
index 000000000000..9213e4e00420
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-backup-worker-entry.ts
@@ -0,0 +1,30 @@
+import { parentPort, workerData } from 'node:worker_threads'
+import { writeProfileStateBackup } from './profile-state-backup-job'
+import { isRecord } from './profile-state-document-validation'
+
+if (!parentPort) {
+  throw new Error('Profile state backup must run on a worker thread')
+}
+const port = parentPort
+const request: unknown = workerData
+if (
+  !isRecord(request) ||
+  typeof request.databasePath !== 'string' ||
+  typeof request.profileId !== 'string' ||
+  typeof request.targetPath !== 'string' ||
+  (request.temporaryPath !== undefined && typeof request.temporaryPath !== 'string')
+) {
+  throw new Error('Invalid profile state backup request')
+}
+
+void writeProfileStateBackup({
+  databasePath: request.databasePath,
+  profileId: request.profileId,
+  targetPath: request.targetPath,
+  temporaryPath: request.temporaryPath
+})
+  .then(
+    () => port.postMessage({ ok: true }),
+    (error: unknown) => port.postMessage({ ok: false, error: String(error) })
+  )
+  .finally(() => port.close())
diff --git a/src/main/persistence/profile-state/profile-state-backup-worker.test.ts b/src/main/persistence/profile-state/profile-state-backup-worker.test.ts
new file mode 100644
index 000000000000..310c14714201
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-backup-worker.test.ts
@@ -0,0 +1,236 @@
+import { build } from 'esbuild'
+import { existsSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join, resolve } from 'node:path'
+import { afterAll, afterEach, beforeAll, describe, expect, it, vi } from 'vitest'
+import { ProfileStateBackupRotation } from './profile-state-backup-rotation'
+import { profileStateDatabaseBackups } from './profile-state-backup-path'
+import {
+  openProfileStateDatabase,
+  openProfileStateDatabaseReadOnly
+} from './profile-state-database'
+import {
+  hashProfileStateJson,
+  importProfileStateJson,
+  readProfileStateSnapshot
+} from './profile-state-documents'
+import {
+  runProfileStateBackupWorker,
+  resolveProfileStateBackupWorkerPath
+} from './profile-state-backup-worker'
+import * as backupWorker from './profile-state-backup-worker'
+
+const directories: string[] = []
+let workerDirectory: string
+let workerPath: string
+
+beforeAll(async () => {
+  workerDirectory = mkdtempSync(join(tmpdir(), 'orca-backup-worker-entry-'))
+  workerPath = join(workerDirectory, 'profile-state-backup-worker-entry.js')
+  await build({
+    entryPoints: [
+      resolve('src/main/persistence/profile-state/profile-state-backup-worker-entry.ts')
+    ],
+    outfile: workerPath,
+    bundle: true,
+    platform: 'node',
+    format: 'cjs',
+    logLevel: 'silent'
+  })
+})
+
+afterEach(() => {
+  vi.restoreAllMocks()
+  for (const directory of directories.splice(0)) {
+    rmSync(directory, { recursive: true, force: true })
+  }
+})
+
+afterAll(() => rmSync(workerDirectory, { recursive: true, force: true }))
+
+function fixture() {
+  const directory = mkdtempSync(join(tmpdir(), 'orca-backup-worker-'))
+  directories.push(directory)
+  const job = {
+    databasePath: join(directory, 'profile-state.db'),
+    targetPath: join(directory, 'backup.db'),
+    profileId: 'worker-test'
+  }
+  const opened = openProfileStateDatabase(job.databasePath, job.profileId)
+  importProfileStateJson(opened.db, '{"settings":{"theme":"dark"}}')
+  opened.db.close()
+  return { directory, job }
+}
+
+function script(directory: string, source: string): string {
+  const path = join(directory, 'worker.cjs')
+  writeFileSync(path, source)
+  return path
+}
+
+describe('profile state backup worker', () => {
+  it('runs the built entry and releases every handle before recovery can move its files', async () => {
+    const { directory, job } = fixture()
+    await runProfileStateBackupWorker(job, { workerPath })
+    const snapshot = openProfileStateDatabaseReadOnly(job.targetPath, job.profileId)
+    try {
+      expect(JSON.parse(readProfileStateSnapshot(snapshot.db).json)).toEqual({
+        settings: { theme: 'dark' }
+      })
+    } finally {
+      snapshot.db.close()
+    }
+    expect(readdirSync(directory).filter((name) => name.startsWith('backup.db'))).toEqual([
+      'backup.db'
+    ])
+    rmSync(directory, { recursive: true })
+    expect(existsSync(directory)).toBe(false)
+  })
+
+  it.each([
+    [
+      'a mismatched stored hash',
+      (db: ReturnType<typeof openProfileStateDatabase>['db']) => {
+        db.prepare('UPDATE profile_state_documents SET content_hash = ?').run('0'.repeat(64))
+      },
+      'hash mismatch'
+    ],
+    [
+      'an independently hashed invalid domain fragment',
+      (db: ReturnType<typeof openProfileStateDatabase>['db']) => {
+        db.prepare(
+          "UPDATE profile_state_documents SET payload = ?, content_hash = ? WHERE domain = 'settings'"
+        ).run('{', hashProfileStateJson('{'))
+      },
+      'invalid JSON'
+    ],
+    [
+      'an independently hashed invalid normalized history fragment',
+      (db: ReturnType<typeof openProfileStateDatabase>['db']) => {
+        importProfileStateJson(db, '{"automationRuns":[{"id":"run-1","output":"ok"}]}')
+        db.prepare(
+          'UPDATE profile_state_automation_runs SET payload = ?, content_hash = ? WHERE run_id = ?'
+        ).run('{', hashProfileStateJson('{'), 'run-1')
+      },
+      'invalid JSON'
+    ]
+  ] as const)('%s', async (_description, corrupt, expectedError) => {
+    const { job } = fixture()
+    const primary = openProfileStateDatabase(job.databasePath, job.profileId)
+    corrupt(primary.db)
+    primary.db.close()
+    const before = readFileSync(job.databasePath)
+    const retained = `${job.targetPath}.prior`
+    writeFileSync(retained, 'previous recovery point')
+
+    await expect(runProfileStateBackupWorker(job, { workerPath })).rejects.toThrow(expectedError)
+    expect(existsSync(job.targetPath)).toBe(false)
+    expect(readFileSync(retained, 'utf8')).toBe('previous recovery point')
+    expect(readFileSync(job.databasePath)).toEqual(before)
+  })
+
+  it.each(['true', 'false'])('waits for actual exit after an ok=%s response', async (ok) => {
+    const { directory, job } = fixture()
+    const delayedWorker = script(
+      directory,
+      `
+      const { parentPort, workerData } = require('node:worker_threads')
+      parentPort.postMessage({ ok: ${ok}, error: 'backup failed' })
+      setTimeout(() => {
+        require('node:fs').writeFileSync(workerData.targetPath, 'handles released')
+        parentPort.close()
+      }, 50)
+    `
+    )
+    const result = runProfileStateBackupWorker(job, { workerPath: delayedWorker })
+    await (ok === 'true' ? result : expect(result).rejects.toThrow('backup failed'))
+    expect(readFileSync(job.targetPath, 'utf8')).toBe('handles released')
+  })
+
+  it.each([
+    ['throw new Error("worker boot failed")', 'worker boot failed'],
+    ['process.exit(0)', 'without completion'],
+    ['require("node:worker_threads").parentPort.postMessage({ wrong: true })', 'Invalid profile'],
+    ['setInterval(() => {}, 1000)', 'timed out']
+  ])('fails closed for worker failure: %s', async (source, error) => {
+    const { directory, job } = fixture()
+    const failedWorker = script(directory, source)
+    await expect(
+      runProfileStateBackupWorker(job, { workerPath: failedWorker, timeoutMs: 500 })
+    ).rejects.toThrow(error)
+    expect(existsSync(job.targetPath)).toBe(false)
+    rmSync(directory, { recursive: true })
+  })
+
+  it.each(['timeout', 'cancel'] as const)(
+    'cleans a terminated %s worker only after exit',
+    async (mode) => {
+      const { directory, job } = fixture()
+      const ready = join(directory, 'ready')
+      const worker = script(
+        directory,
+        `
+      const { workerData } = require('node:worker_threads')
+      const fs = require('node:fs')
+      for (const suffix of ['', '-wal', '-shm', '-journal']) fs.writeFileSync(workerData.temporaryPath + suffix, 'incomplete')
+      fs.writeFileSync(${JSON.stringify(ready)}, 'ready')
+      setInterval(() => {}, 1000)
+    `
+      )
+      const cancellation = new AbortController()
+      const pending = runProfileStateBackupWorker(job, {
+        workerPath: worker,
+        timeoutMs: 500,
+        signal: cancellation.signal
+      })
+      const failed = expect(pending).rejects.toThrow(mode === 'cancel' ? 'cancelled' : 'timed out')
+      await vi.waitFor(() => expect(existsSync(ready)).toBe(true))
+      expect(readdirSync(directory).filter((name) => name.startsWith('backup.db.'))).toHaveLength(4)
+      if (mode === 'cancel') {
+        cancellation.abort()
+      }
+      await failed
+      expect(readdirSync(directory).filter((name) => name.startsWith('backup.db.'))).toEqual([])
+      expect(existsSync(job.databasePath)).toBe(true)
+    }
+  )
+
+  it('reports a missing bundle and leaves the primary untouched', async () => {
+    const { directory, job } = fixture()
+    const before = readFileSync(job.databasePath)
+    await expect(
+      runProfileStateBackupWorker(job, { workerPath: join(directory, 'missing.js') })
+    ).rejects.toThrow()
+    expect(readFileSync(job.databasePath)).toEqual(before)
+  })
+
+  it('coalesces desktop work and drains a started backup before allowing quarantine', async () => {
+    const { directory, job } = fixture()
+    let started: () => void = () => {}
+    const beginning = new Promise<void>((resolve) => {
+      started = resolve
+    })
+    const dispatch = vi
+      .spyOn(backupWorker, 'runProfileStateBackup')
+      .mockImplementation((request) => {
+        started()
+        return runProfileStateBackupWorker(request, { workerPath })
+      })
+    const rotation = new ProfileStateBackupRotation(job.databasePath, job.profileId)
+    rotation.schedule()
+    rotation.schedule()
+    await beginning
+    rotation.stop()
+    expect(() => rotation.assertIdle()).toThrow('Flush pending')
+    await rotation.drain()
+    expect(() => rotation.assertIdle()).not.toThrow()
+    expect(dispatch).toHaveBeenCalledOnce()
+    expect(profileStateDatabaseBackups(job.databasePath)).toHaveLength(1)
+    rmSync(directory, { recursive: true })
+  })
+
+  it('finds entries beside the launcher and above Rollup shared chunks', () => {
+    expect(resolveProfileStateBackupWorkerPath(workerDirectory)).toBe(workerPath)
+    expect(resolveProfileStateBackupWorkerPath(join(workerDirectory, 'chunks'))).toBe(workerPath)
+  })
+})
diff --git a/src/main/persistence/profile-state/profile-state-backup-worker.ts b/src/main/persistence/profile-state/profile-state-backup-worker.ts
new file mode 100644
index 000000000000..b671df941122
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-backup-worker.ts
@@ -0,0 +1,87 @@
+import { existsSync } from 'node:fs'
+import { rm } from 'node:fs/promises'
+import { profileStateBackupTemporaryPath } from './profile-state-backup-temporary-files'
+import { profileStateDatabaseFiles } from './profile-state-storage-classification'
+import { dirname, join } from 'node:path'
+import { Worker } from 'node:worker_threads'
+import {
+  currentWorkerEntryLayout,
+  resolveWorkerThreadEntryPath
+} from '../../worker-thread-entry-path'
+import { type ProfileStateBackupJob, writeProfileStateBackup } from './profile-state-backup-job'
+import { isRecord } from './profile-state-document-validation'
+
+const WORKER_FILENAME = 'profile-state-backup-worker-entry.js'
+const BACKUP_TIMEOUT_MS = 10 * 60_000
+
+export function resolveProfileStateBackupWorkerPath(moduleDir = __dirname): string {
+  const entry = resolveWorkerThreadEntryPath(currentWorkerEntryLayout(moduleDir), WORKER_FILENAME)
+  // Rollup can place this launcher in a shared chunk beside the worker entries.
+  return [entry, join(dirname(entry), '..', WORKER_FILENAME)].find(existsSync) ?? entry
+}
+
+/** Bun snapshot copying and desktop validation run off the owning runtime thread. */
+export function runProfileStateBackup(
+  job: ProfileStateBackupJob,
+  signal?: AbortSignal
+): Promise<void> {
+  return process.versions.electron || process.versions.bun
+    ? runProfileStateBackupWorker(job, { signal })
+    : writeProfileStateBackup(job)
+}
+
+export async function runProfileStateBackupWorker(
+  job: ProfileStateBackupJob,
+  options: { workerPath?: string; timeoutMs?: number; signal?: AbortSignal } = {}
+): Promise<void> {
+  options.signal?.throwIfAborted()
+  const temporaryPath = profileStateBackupTemporaryPath(job.targetPath)
+  try {
+    await new Promise<void>((resolve, reject) => {
+      const workerPath = options.workerPath ?? resolveProfileStateBackupWorkerPath()
+      const worker = new Worker(workerPath, { workerData: { ...job, temporaryPath }, execArgv: [] })
+      let completed = false
+      let failure: Error | undefined
+      const terminate = (reason: Error): void => {
+        failure ??= reason
+        void worker.terminate().catch((error: unknown) => {
+          failure = error instanceof Error ? error : new Error(String(error))
+        })
+      }
+      const abort = (): void => terminate(new Error('Profile state backup cancelled'))
+      options.signal?.addEventListener('abort', abort, { once: true })
+      const timer = setTimeout(
+        () => terminate(new Error('Profile state backup worker timed out')),
+        options.timeoutMs ?? BACKUP_TIMEOUT_MS
+      )
+      worker.on('message', (response: unknown) => {
+        if (!isRecord(response) || typeof response.ok !== 'boolean') {
+          failure = new Error('Invalid profile state backup worker response')
+        } else if (!response.ok) {
+          failure = new Error(String(response.error))
+        } else {
+          completed = true
+        }
+      })
+      worker.on('error', (error) => {
+        failure = error instanceof Error ? error : new Error(String(error))
+      })
+      // Even an error response leaves handles open until the worker actually exits.
+      worker.once('exit', (code) => {
+        clearTimeout(timer)
+        options.signal?.removeEventListener('abort', abort)
+        if (failure || code !== 0 || !completed) {
+          reject(
+            failure ?? new Error(`Profile state backup worker exited without completion (${code})`)
+          )
+        } else {
+          resolve()
+        }
+      })
+    })
+  } finally {
+    await Promise.all(
+      profileStateDatabaseFiles(temporaryPath).map((path) => rm(path, { force: true }))
+    )
+  }
+}
diff --git a/src/main/persistence/profile-state/profile-state-bootstrap-publication-race.test.ts b/src/main/persistence/profile-state/profile-state-bootstrap-publication-race.test.ts
new file mode 100644
index 000000000000..b93b05b1b317
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-bootstrap-publication-race.test.ts
@@ -0,0 +1,178 @@
+import * as fs from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { bootstrapProfileStateAuthority } from './profile-state-authority-bootstrap'
+import { migrateProfileStateToSqlite } from './profile-state-migration'
+import { ProfileStateSqliteAuthority } from './profile-state-sqlite-authority'
+import { profileStateJsonExportPath } from './legacy-json/profile-state-export-path'
+import type { ProfileStateAuthority } from '../loading-store/profile-state-authority'
+import { formatProfileStateStartupFailure } from './profile-state-startup-failure'
+
+vi.mock('node:fs', async (original) => ({ ...(await original<typeof fs>()) }))
+vi.mock('../../telemetry/client', () => ({ track: () => {} }))
+vi.mock('../../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: () => ({ nth_repo_added: 2 })
+}))
+vi.mock('../../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: () => ({ hosts: [] }),
+  sshConfigHostsToTargets: () => []
+}))
+
+const roots: string[] = []
+const authorities: ProfileStateAuthority[] = []
+afterEach(() => {
+  vi.restoreAllMocks()
+  for (const authority of authorities.splice(0)) {
+    authority.close?.()
+  }
+  for (const root of roots.splice(0)) {
+    fs.rmSync(root, { recursive: true, force: true })
+  }
+})
+
+describe('first database publication with competing startup', () => {
+  it.each(['empty', 'legacy'])(
+    'explains unavailable hard links without publishing a partial %s database',
+    (kind) => {
+      const root = fs.mkdtempSync(join(tmpdir(), 'orca-bootstrap-no-hardlinks-'))
+      roots.push(root)
+      const options = {
+        dataFile: join(root, 'orca-data.json'),
+        databaseFile: join(root, 'profile-state.db'),
+        profileId: 'unsupported-publication',
+        allowEmptyProfileState: true
+      }
+      const json = '{"settings":{"theme":"dark"}}'
+      if (kind === 'legacy') {
+        fs.writeFileSync(options.dataFile, json)
+      }
+      const link = vi.spyOn(fs, 'linkSync').mockImplementation(() => {
+        throw Object.assign(new Error('hard links unsupported'), {
+          code: 'ENOTSUP',
+          syscall: 'link'
+        })
+      })
+      let failure: unknown
+      try {
+        bootstrapProfileStateAuthority(options)
+      } catch (error) {
+        failure = error
+      }
+      expect(failure).toMatchObject({ code: 'profile-state-publication-unavailable' })
+      const message = formatProfileStateStartupFailure(failure)
+      expect(message).toContain('hard links')
+      expect(message).toContain(root)
+      expect(message).toContain('complete Orca data directory')
+      expect(message).not.toContain('rollback')
+      expect(fs.existsSync(options.databaseFile)).toBe(false)
+      expect(fs.readdirSync(root)).toEqual(kind === 'legacy' ? ['orca-data.json'] : [])
+      if (kind === 'legacy') {
+        expect(fs.readFileSync(options.dataFile, 'utf8')).toBe(json)
+      }
+      link.mockRestore()
+      const retry = bootstrapProfileStateAuthority(options)
+      expect(retry.authority).toBeDefined()
+      if (retry.authority) {
+        authorities.push(retry.authority)
+      }
+    }
+  )
+
+  it('names its migration export after the snapshot actually captured', () => {
+    const root = fs.mkdtempSync(join(tmpdir(), 'orca-migration-export-race-'))
+    roots.push(root)
+    const options = {
+      dataFile: join(root, 'orca-data.json'),
+      databaseFile: join(root, 'profile-state.db'),
+      profileId: 'migration-export-race',
+      expectedLegacyJson: '{"settings":{"theme":"dark"}}',
+      serializedState: '{"settings":{"theme":"dark"}}'
+    }
+    fs.writeFileSync(options.dataFile, options.expectedLegacyJson)
+    const link = fs.linkSync
+    vi.spyOn(fs, 'linkSync').mockImplementation((from, to) => {
+      link(from, to)
+      if (to === options.databaseFile) {
+        const peer = new ProfileStateSqliteAuthority(options.databaseFile, options.profileId)
+        try {
+          peer.writeSerializedDomains([{ domain: 'settings', payload: '{"theme":"light"}' }])
+        } finally {
+          peer.close()
+        }
+      }
+    })
+
+    const migrated = migrateProfileStateToSqlite(options)
+    authorities.push(migrated.authority)
+    expect(migrated.authority.revision).toBe(2)
+    expect(fs.existsSync(profileStateJsonExportPath(options.dataFile, 1))).toBe(false)
+    expect(
+      JSON.parse(fs.readFileSync(profileStateJsonExportPath(options.dataFile, 2), 'utf8'))
+    ).toEqual({
+      settings: { theme: 'light' }
+    })
+    expect(fs.readFileSync(options.dataFile, 'utf8')).toBe(options.expectedLegacyJson)
+  })
+
+  it.each(['empty', 'legacy'])('cannot replace an acknowledged competing %s profile', (kind) => {
+    const root = fs.mkdtempSync(join(tmpdir(), 'orca-bootstrap-publication-race-'))
+    roots.push(root)
+    const options = {
+      dataFile: join(root, 'orca-data.json'),
+      databaseFile: join(root, 'profile-state.db'),
+      profileId: 'publication-race',
+      allowEmptyProfileState: true
+    }
+    if (kind === 'legacy') {
+      fs.writeFileSync(options.dataFile, '{"settings":{"theme":"dark"}}')
+    }
+    const committed = {
+      settings: { theme: 'light' },
+      extension: { acknowledged: true, value: null }
+    }
+    let competing = false
+    const open = () => {
+      const result = bootstrapProfileStateAuthority(options)
+      if (result.authority) {
+        authorities.push(result.authority)
+      }
+      return result
+    }
+    const race = (target: fs.PathLike) => {
+      if (competing || target !== options.databaseFile) {
+        return
+      }
+      competing = true
+      const winner = open().authority
+      if (!winner) {
+        throw new Error('Competing startup did not establish SQLite')
+      }
+      winner.writeSerializedState(Buffer.from(JSON.stringify(committed)))
+      expect(JSON.parse(winner.readSerializedState() ?? 'null')).toEqual(committed)
+      winner.close?.()
+      authorities.splice(authorities.indexOf(winner), 1)
+    }
+    const rename = fs.renameSync
+    vi.spyOn(fs, 'renameSync').mockImplementation((from, to) => {
+      race(to)
+      rename(from, to)
+    })
+    const link = fs.linkSync
+    vi.spyOn(fs, 'linkSync').mockImplementation((from, to) => {
+      race(to)
+      link(from, to)
+    })
+
+    let publicationError: unknown
+    try {
+      open()
+    } catch (error) {
+      publicationError = error
+    }
+    expect(competing).toBe(true)
+    expect(JSON.parse(open().authority?.readSerializedState() ?? 'null')).toEqual(committed)
+    expect(publicationError).toMatchObject({ message: expect.stringContaining('storage changed') })
+    expect(fs.readdirSync(root).some((name) => name.endsWith('.tmp'))).toBe(false)
+  })
+})
diff --git a/src/main/persistence/profile-state/profile-state-complete-domain-writes.test.ts b/src/main/persistence/profile-state/profile-state-complete-domain-writes.test.ts
new file mode 100644
index 000000000000..177c79dd8741
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-complete-domain-writes.test.ts
@@ -0,0 +1,122 @@
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it } from 'vitest'
+import {
+  openProfileStateDatabaseReadOnly,
+  openProfileStateDatabase
+} from './profile-state-database'
+import { readProfileStateRevision } from './profile-state-documents'
+import { ProfileStateSqliteAuthority } from './profile-state-sqlite-authority'
+
+const fixtures: { authority: ProfileStateSqliteAuthority; directory: string }[] = []
+
+function fixture(established: boolean) {
+  const directory = mkdtempSync(join(tmpdir(), 'orca-complete-domain-write-'))
+  const databasePath = join(directory, 'state.db')
+  openProfileStateDatabase(databasePath, 'profile').db.close()
+  const authority = new ProfileStateSqliteAuthority(databasePath, 'profile')
+  fixtures.push({ authority, directory })
+  if (established) {
+    authority.writeSerializedState(
+      Buffer.from('{"settings":{"theme":"light"},"automationRuns":[{"id":"old"}],"removeMe":true}')
+    )
+  }
+  const readRevision = () => {
+    const { db } = openProfileStateDatabaseReadOnly(databasePath, 'profile')
+    try {
+      return readProfileStateRevision(db)
+    } finally {
+      db.close()
+    }
+  }
+  return { authority, databasePath, readRevision }
+}
+
+afterEach(() => {
+  for (const { authority, directory } of fixtures.splice(0)) {
+    authority.close()
+    rmSync(directory, { recursive: true, force: true })
+  }
+})
+
+const invalidReplacements = [
+  {
+    name: 'sibling-key injection',
+    value: [{ domain: 'extension', payload: 'null,"settings":{"theme":"dark"}' }]
+  },
+  {
+    name: 'duplicate domains',
+    value: [
+      { domain: 'settings', payload: '{}' },
+      { domain: 'settings', payload: 'null' }
+    ]
+  },
+  { name: 'non-string payload', value: [{ domain: 'settings', payload: true }] },
+  { name: 'missing payload', value: [{ domain: 'settings' }] },
+  { name: 'empty domain', value: [{ domain: '', payload: '{}' }] },
+  { name: 'non-array replacements', value: { settings: '{}' } }
+]
+
+describe.each([false, true])('complete domain writes (established: %s)', (established) => {
+  it.each(invalidReplacements)('rejects $name without changing state or revision', ({ value }) => {
+    const { authority, readRevision } = fixture(established)
+    const before = authority.readSerializedState()
+    const revision = readRevision()
+
+    expect(() => {
+      // @ts-expect-error Intentionally malformed input must fail runtime validation.
+      authority.writeCompleteSerializedDomains(value)
+    }).toThrow()
+
+    expect(authority.readSerializedState()).toBe(before)
+    expect(readRevision()).toBe(revision)
+  })
+
+  it('preserves null, history order and unknown fields while deleting omitted domains', () => {
+    const { authority } = fixture(established)
+    const future = { '3': 3, '1': 1, unicode: '雪 🐋\ud800', nested: { z: null, a: [] } }
+    const runs = [{ id: 'z', extension: future }, { id: 'a' }]
+
+    authority.writeCompleteSerializedDomains([
+      { domain: 'settings', payload: 'null' },
+      { domain: 'automationRuns', payload: JSON.stringify(runs) },
+      { domain: 'future', payload: JSON.stringify(future) },
+      { domain: 'deleted', payload: null }
+    ])
+
+    expect(authority.readSerializedState()).toBe(
+      JSON.stringify({ settings: null, automationRuns: runs, future })
+    )
+    authority.writeCompleteSerializedDomains([])
+    expect(authority.readSerializedState()).toBe('{}')
+  })
+
+  it('accepts an empty complete profile', () => {
+    const { authority } = fixture(established)
+
+    authority.writeCompleteSerializedDomains([])
+
+    expect(authority.readSerializedState()).toBe('{}')
+  })
+})
+
+describe('complete domain revision fencing', () => {
+  it('rejects an older complete replacement after a concurrent writer commits', () => {
+    const { authority, databasePath } = fixture(true)
+    authority.readSerializedState()
+    const other = new ProfileStateSqliteAuthority(databasePath, 'profile')
+    try {
+      other.writeCompleteSerializedDomains([{ domain: 'settings', payload: '{"theme":"dark"}' }])
+    } finally {
+      other.close()
+    }
+
+    expect(() =>
+      authority.writeCompleteSerializedDomains([
+        { domain: 'settings', payload: '{"theme":"light"}' }
+      ])
+    ).toThrow(expect.objectContaining({ code: 'profile-state-revision-conflict' }))
+    expect(authority.readSerializedState()).toBe('{"settings":{"theme":"dark"}}')
+  })
+})
diff --git a/src/main/persistence/profile-state/profile-state-complete-replacements.ts b/src/main/persistence/profile-state/profile-state-complete-replacements.ts
new file mode 100644
index 000000000000..2f7ea20f5376
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-complete-replacements.ts
@@ -0,0 +1,36 @@
+import type { ProfileStateDomainReplacement } from '../loading-store/profile-state-authority'
+import type { openProfileStateDatabase } from './profile-state-database'
+
+export function buildCompleteDocumentReplacements(
+  db: ReturnType<typeof openProfileStateDatabase>['db'],
+  replacements: readonly ProfileStateDomainReplacement[]
+): ProfileStateDomainReplacement[] {
+  const domains = new Set(replacements.map(({ domain }) => domain))
+  const incoming = new Set(domains)
+  for (const row of db
+    .prepare(`SELECT domain FROM profile_state_documents
+      UNION SELECT domain FROM profile_state_automation_runs_meta WHERE presence <> 'document'`)
+    .all()) {
+    if (isDomainRow(row)) {
+      domains.add(row.domain)
+    }
+  }
+
+  return [
+    ...replacements,
+    ...[...domains]
+      .filter((domain) => !incoming.has(domain))
+      .map((domain) => ({ domain, payload: null }))
+  ]
+}
+
+function isDomainRow(value: unknown): value is { domain: string } {
+  return (
+    typeof value === 'object' &&
+    value !== null &&
+    !Array.isArray(value) &&
+    'domain' in value &&
+    typeof value.domain === 'string' &&
+    value.domain.length > 0
+  )
+}
diff --git a/src/main/persistence/profile-state/profile-state-crash-recovery.test.ts b/src/main/persistence/profile-state/profile-state-crash-recovery.test.ts
new file mode 100644
index 000000000000..e9d6a54e0e58
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-crash-recovery.test.ts
@@ -0,0 +1,210 @@
+import { spawnProcess } from '../../../shared/child-process/run-process'
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it } from 'vitest'
+import {
+  buildProfileStateCutoverFixture,
+  canonicalProfileStateJson
+} from '../profile-state-cutover-fixture'
+import {
+  exportProfileStateJson,
+  importProfileStateJson,
+  readProfileStateRevision
+} from './profile-state-documents'
+import { openProfileStateDatabase, profileStateDatabaseFile } from './profile-state-database'
+
+const temporaryDirectories: string[] = []
+
+afterEach(() => {
+  for (const directory of temporaryDirectories.splice(0)) {
+    rmSync(directory, { recursive: true, force: true })
+  }
+})
+
+const crashDuringWriteScript = `
+  const { DatabaseSync } = process.getBuiltinModule('node:sqlite')
+  const db = new DatabaseSync(process.argv[1])
+  db.exec('PRAGMA journal_mode = WAL; PRAGMA synchronous = FULL; BEGIN IMMEDIATE')
+  db.prepare('DELETE FROM profile_state_documents').run()
+  db.prepare('DELETE FROM profile_state_automation_runs').run()
+  db.prepare('DELETE FROM profile_state_automation_runs_meta').run()
+  db.prepare(\`
+    UPDATE profile_state_meta
+    SET value = ?
+    WHERE key = 'revision'
+  \`).run('999')
+  process.stdout.write('transaction-ready\\n')
+  setInterval(() => {}, 1_000)
+`
+
+const crashAfterCommittedWriteScript = `
+  const { DatabaseSync } = process.getBuiltinModule('node:sqlite')
+  const { createHash } = require('node:crypto')
+  const db = new DatabaseSync(process.argv[1])
+  const payload = '{"theme":"committed"}'
+  const hash = createHash('sha256').update(payload).digest('hex')
+  db.exec('PRAGMA journal_mode = WAL; PRAGMA synchronous = FULL; BEGIN IMMEDIATE')
+  db.prepare('DELETE FROM profile_state_documents').run()
+  db.prepare('DELETE FROM profile_state_automation_runs').run()
+  db.prepare("UPDATE profile_state_automation_runs_meta SET presence = 'document', domain_version = 1, revision = 0, updated_at = 0, content_hash = ''").run()
+  db.prepare(\`
+    INSERT INTO profile_state_documents
+       (domain, payload, domain_version, revision, updated_at, content_hash)
+       VALUES (?, ?, ?, ?, ?, ?)\`
+  ).run('settings', payload, 1, 999, 999, hash)
+  db.prepare(\`
+    UPDATE profile_state_meta
+    SET value = ?
+    WHERE key = 'revision'
+  \`).run('999')
+  db.exec('COMMIT')
+  process.stdout.write('transaction-committed\\n')
+  setInterval(() => {}, 1_000)
+`
+
+const crashDuringCheckpointScript = `
+  const { DatabaseSync } = process.getBuiltinModule('node:sqlite')
+  const dbPath = process.argv[1]
+  const writer = new DatabaseSync(dbPath, { timeout: 5_000 })
+  const reader = new DatabaseSync(dbPath, { timeout: 5_000 })
+  writer.exec('PRAGMA wal_autocheckpoint = 0')
+  writer.exec('BEGIN IMMEDIATE')
+  writer.prepare(
+    \`UPDATE profile_state_meta SET value = value WHERE key = 'revision'\`
+  ).run()
+  writer.exec('COMMIT')
+  reader.exec('BEGIN')
+  reader.prepare("SELECT value FROM profile_state_meta WHERE key = 'revision'").get()
+  // SQLITE_PRAGMA is action code 19; the reader keeps TRUNCATE checkpointing active after this callback returns.
+  writer.setAuthorizer((action) => {
+    if (action === 19) {
+      process.stdout.write('checkpoint-started\\n')
+    }
+    return 0
+  })
+  writer.prepare('PRAGMA wal_checkpoint(TRUNCATE)').all()
+  process.stdout.write('checkpoint-complete\\n')
+`
+
+async function killAfterChildReady(dbPath: string, script: string, marker: string): Promise<void> {
+  const child = spawnProcess({
+    program: process.execPath,
+    args: ['-e', script, dbPath],
+    timeoutMs: null
+  })
+  for (const stream of [child.stdin, child.stdout, child.stderr]) {
+    stream?.on('error', () => {})
+  }
+
+  try {
+    await new Promise<void>((resolve, reject) => {
+      let output = ''
+      const onData = (chunk: Buffer | string): void => {
+        output += String(chunk)
+        if (output.includes(marker)) {
+          resolve()
+        }
+      }
+      child.stdout.on('data', onData)
+      child.once('error', reject)
+    })
+    child.kill('SIGKILL')
+    await new Promise<void>((resolve, reject) => {
+      child.once('close', () => resolve())
+      child.once('error', reject)
+    })
+  } finally {
+    if (child.exitCode === null && child.signalCode === null) {
+      child.kill('SIGKILL')
+    }
+  }
+}
+
+async function killAfterUncommittedWrite(dbPath: string): Promise<void> {
+  await killAfterChildReady(dbPath, crashDuringWriteScript, 'transaction-ready')
+}
+
+describe('profile state crash recovery', () => {
+  it('rolls back an uncommitted SQLite write and accepts the next import', async () => {
+    const directory = mkdtempSync(join(tmpdir(), 'orca-profile-state-crash-'))
+    temporaryDirectories.push(directory)
+    const dbPath = profileStateDatabaseFile(directory)
+    const fixture = buildProfileStateCutoverFixture()
+
+    const initial = openProfileStateDatabase(dbPath, 'profile-a')
+    importProfileStateJson(initial.db, JSON.stringify(fixture), { now: () => 100 })
+    initial.db.close()
+
+    await killAfterUncommittedWrite(dbPath)
+
+    const recovered = openProfileStateDatabase(dbPath, 'profile-a')
+    try {
+      expect(recovered.readOnly).toBe(false)
+      expect(readProfileStateRevision(recovered.db)).toBe(1)
+      expect(canonicalProfileStateJson(JSON.parse(exportProfileStateJson(recovered.db)))).toBe(
+        canonicalProfileStateJson(fixture)
+      )
+
+      const replacement = {
+        ...fixture,
+        futureTopLevelExtension: { keep: 'replacement', nullable: null }
+      }
+      expect(
+        importProfileStateJson(recovered.db, JSON.stringify(replacement), { now: () => 200 })
+      ).toBe(2)
+      expect(canonicalProfileStateJson(JSON.parse(exportProfileStateJson(recovered.db)))).toBe(
+        canonicalProfileStateJson(replacement)
+      )
+    } finally {
+      recovered.db.close()
+    }
+  })
+
+  it('preserves a committed SQLite write after process termination', async () => {
+    const directory = mkdtempSync(join(tmpdir(), 'orca-profile-state-crash-'))
+    temporaryDirectories.push(directory)
+    const dbPath = profileStateDatabaseFile(directory)
+    const initial = openProfileStateDatabase(dbPath, 'profile-a')
+    importProfileStateJson(initial.db, JSON.stringify(buildProfileStateCutoverFixture()), {
+      now: () => 100
+    })
+    initial.db.close()
+
+    await killAfterChildReady(dbPath, crashAfterCommittedWriteScript, 'transaction-committed')
+
+    const recovered = openProfileStateDatabase(dbPath, 'profile-a')
+    try {
+      expect(recovered.readOnly).toBe(false)
+      expect(readProfileStateRevision(recovered.db)).toBe(999)
+      expect(JSON.parse(exportProfileStateJson(recovered.db))).toEqual({
+        settings: { theme: 'committed' }
+      })
+    } finally {
+      recovered.db.close()
+    }
+  })
+
+  it('recovers a committed database when checkpointing is interrupted', async () => {
+    const directory = mkdtempSync(join(tmpdir(), 'orca-profile-state-checkpoint-crash-'))
+    temporaryDirectories.push(directory)
+    const dbPath = profileStateDatabaseFile(directory)
+    const fixture = buildProfileStateCutoverFixture()
+    const initial = openProfileStateDatabase(dbPath, 'profile-a')
+    importProfileStateJson(initial.db, JSON.stringify(fixture), { now: () => 100 })
+    initial.db.close()
+
+    await killAfterChildReady(dbPath, crashDuringCheckpointScript, 'checkpoint-started')
+
+    const recovered = openProfileStateDatabase(dbPath, 'profile-a')
+    try {
+      expect(recovered.readOnly).toBe(false)
+      expect(readProfileStateRevision(recovered.db)).toBe(1)
+      expect(canonicalProfileStateJson(JSON.parse(exportProfileStateJson(recovered.db)))).toBe(
+        canonicalProfileStateJson(fixture)
+      )
+    } finally {
+      recovered.db.close()
+    }
+  })
+})
diff --git a/src/main/persistence/profile-state/profile-state-current-json-command.test.ts b/src/main/persistence/profile-state/profile-state-current-json-command.test.ts
new file mode 100644
index 000000000000..0b1592bc9fc9
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-current-json-command.test.ts
@@ -0,0 +1,171 @@
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { basename, join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import {
+  acquireProfileStateMaintenance,
+  acquireProfileStateRuntimeAdmission
+} from './profile-state-access'
+import { rollbackProfileState } from './profile-state-recovery-command'
+import { bootstrapProfileStateAuthority } from './profile-state-authority-bootstrap'
+import { migrateProfileStateToSqlite } from './profile-state-migration'
+import {
+  createProfileStateDatabaseBackupId,
+  profileStateDatabaseBackupPath
+} from './profile-state-backup-path'
+import { profileStateJsonExportPath } from './legacy-json/profile-state-export-path'
+const roots: string[] = []
+const profileId = 'current-json-recovery'
+const originalState = { settings: { theme: 'dark', httpProxyUrl: 'sealed:original' } }
+const editedState = {
+  settings: {
+    theme: 'light',
+    httpProxyUrl: 'sealed:older-build',
+    electronHttp1CompatibilityMode: true
+  },
+  futureDomain: { opaque: [null, '\ud800', { futureKey: 'keep me' }] },
+  accounts: { token: 'sealed:account-token' }
+}
+const editedJson = `${JSON.stringify(editedState, null, 2)}\n`
+
+beforeEach(() => {
+  vi.spyOn(console, 'log').mockImplementation(() => {})
+})
+afterEach(() => {
+  vi.restoreAllMocks()
+  for (const root of roots.splice(0)) {
+    rmSync(root, { recursive: true, force: true })
+  }
+})
+
+function fixture() {
+  const root = mkdtempSync(join(tmpdir(), 'orca-current-json-'))
+  roots.push(root)
+  const directory = join(root, 'profiles', profileId)
+  mkdirSync(directory, { recursive: true })
+  writeFileSync(
+    join(root, 'orca-profile-index.json'),
+    JSON.stringify({ activeProfileId: profileId, profiles: [{ id: profileId }] })
+  )
+  const dataFile = join(directory, 'orca-data.json')
+  const databaseFile = join(directory, 'profile-state.db')
+  const exportPath = profileStateJsonExportPath(dataFile, 1)
+  const originalJson = JSON.stringify(originalState)
+  writeFileSync(dataFile, originalJson)
+  const migration = migrateProfileStateToSqlite({
+    dataFile,
+    databaseFile,
+    profileId,
+    expectedLegacyJson: originalJson,
+    serializedState: originalJson
+  })
+  migration.authority.close()
+  const backupPath = profileStateDatabaseBackupPath(
+    databaseFile,
+    createProfileStateDatabaseBackupId()
+  )
+  writeFileSync(backupPath, readFileSync(databaseFile))
+  writeFileSync(dataFile, editedJson)
+  return { root, directory, dataFile, databaseFile, exportPath, backupPath, profileId }
+}
+
+function rollback(profile: ReturnType<typeof fixture>) {
+  const maintenance = acquireProfileStateMaintenance(profile.root)
+  try {
+    expect(() => acquireProfileStateRuntimeAdmission(profile.root)).toThrow('in use')
+    return rollbackProfileState(profile.root, { kind: 'current-json' }, maintenance)
+  } finally {
+    maintenance.release()
+  }
+}
+
+function snapshot(profile: ReturnType<typeof fixture>) {
+  return [profile.dataFile, profile.databaseFile, profile.exportPath, profile.backupPath].map(
+    (path) => readFileSync(path)
+  )
+}
+
+describe('adopting JSON edited by an older build', () => {
+  it('preserves both authorities and retained exports before adopting exact JSON bytes', async () => {
+    const profile = fixture()
+    const before = snapshot(profile)
+    const previousQuarantine = join(profile.directory, 'profile-state-corrupt-earlier')
+    mkdirSync(previousQuarantine)
+    writeFileSync(join(previousQuarantine, 'evidence'), 'preserve earlier recovery')
+    expect(() => bootstrapProfileStateAuthority(profile)).toThrow('acceptance marker')
+    const result = rollback(profile)
+    expect(result).toMatchObject({
+      revision: null,
+      storage: 'json',
+      restoredPath: profile.dataFile
+    })
+    expect(readFileSync(profile.dataFile, 'utf8')).toBe(editedJson)
+    expect(existsSync(profile.databaseFile)).toBe(false)
+    expect(existsSync(profile.exportPath)).toBe(false)
+    expect(existsSync(profile.backupPath)).toBe(false)
+    expect(readFileSync(join(previousQuarantine, 'evidence'), 'utf8')).toBe(
+      'preserve earlier recovery'
+    )
+    for (const [index, path] of [
+      profile.dataFile,
+      profile.databaseFile,
+      profile.exportPath,
+      profile.backupPath
+    ].entries()) {
+      expect(readFileSync(join(result.quarantineDirectory, basename(path)))).toEqual(before[index])
+    }
+    const reopened = bootstrapProfileStateAuthority(profile)
+    expect(reopened.migrated).toBe(true)
+    try {
+      const restored: unknown = JSON.parse(reopened.authority?.readSerializedState() ?? 'null')
+      expect(restored).toMatchObject(editedState)
+    } finally {
+      reopened.authority?.close()
+    }
+    acquireProfileStateRuntimeAdmission(profile.root).release()
+  })
+
+  it.each(['invalid JSON', '[]', 'null'])(
+    'refuses invalid current JSON without changing either authority: %s',
+    async (raw) => {
+      const profile = fixture()
+      writeFileSync(profile.dataFile, raw)
+      const before = snapshot(profile)
+      expect(() => rollback(profile)).toThrow('Profile state JSON')
+      expect(snapshot(profile)).toEqual(before)
+    }
+  )
+
+  it('refuses a missing canonical JSON without choosing a retained export', async () => {
+    const profile = fixture()
+    rmSync(profile.dataFile)
+    const before = readFileSync(profile.databaseFile)
+    expect(() => rollback(profile)).toThrow('ENOENT')
+    expect(readFileSync(profile.databaseFile)).toEqual(before)
+    expect(existsSync(profile.exportPath)).toBe(true)
+  })
+
+  it('refuses while a profile owner holds admission', async () => {
+    const profile = fixture()
+    const before = snapshot(profile)
+    const admission = acquireProfileStateRuntimeAdmission(profile.root)
+    try {
+      expect(() => rollback(profile)).toThrow('in use')
+      expect(snapshot(profile)).toEqual(before)
+    } finally {
+      admission.release()
+    }
+  })
+
+  it('refuses an unresolved move without removing its journal', async () => {
+    const profile = fixture()
+    const before = snapshot(profile)
+    const moves = join(profile.root, 'profile-move-intents')
+    mkdirSync(moves)
+    const journal = join(moves, '00000000-0000-0000-0000-000000000001.json')
+    writeFileSync(journal, '{"partial":true}')
+    expect(() => rollback(profile)).toThrow('pending project move')
+    expect(snapshot(profile)).toEqual(before)
+    expect(readFileSync(journal, 'utf8')).toBe('{"partial":true}')
+  })
+})
diff --git a/src/main/persistence/profile-state/profile-state-current-sqlite-command.test.ts b/src/main/persistence/profile-state/profile-state-current-sqlite-command.test.ts
new file mode 100644
index 000000000000..53aa67120e90
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-current-sqlite-command.test.ts
@@ -0,0 +1,147 @@
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import {
+  acquireProfileStateMaintenance,
+  acquireProfileStateRuntimeAdmission
+} from './profile-state-access'
+import { rollbackProfileState } from './profile-state-recovery-command'
+import {
+  bootstrapProfileStateAuthority,
+  ProfileStateAuthorityBootstrapError
+} from './profile-state-authority-bootstrap'
+import { migrateProfileStateToSqlite } from './profile-state-migration'
+import { profileStateJsonExportPath } from './legacy-json/profile-state-export-path'
+import { isDivergedProfileStateFailure } from './profile-state-startup-failure'
+
+const roots: string[] = []
+const profileId = 'current-sqlite-recovery'
+const sqliteState = { settings: { theme: 'dark', electronHttp1CompatibilityMode: true } }
+const editedJson = JSON.stringify({ settings: { theme: 'light' } })
+
+beforeEach(() => {
+  vi.spyOn(console, 'log').mockImplementation(() => {})
+})
+afterEach(() => {
+  vi.restoreAllMocks()
+  for (const root of roots.splice(0)) {
+    rmSync(root, { recursive: true, force: true })
+  }
+})
+
+function fixture() {
+  const root = mkdtempSync(join(tmpdir(), 'orca-current-sqlite-'))
+  roots.push(root)
+  const directory = join(root, 'profiles', profileId)
+  mkdirSync(directory, { recursive: true })
+  writeFileSync(
+    join(root, 'orca-profile-index.json'),
+    JSON.stringify({ activeProfileId: profileId, profiles: [{ id: profileId }] })
+  )
+  const dataFile = join(directory, 'orca-data.json')
+  const databaseFile = join(directory, 'profile-state.db')
+  const originalJson = JSON.stringify(sqliteState)
+  writeFileSync(dataFile, originalJson)
+  migrateProfileStateToSqlite({
+    dataFile,
+    databaseFile,
+    profileId,
+    expectedLegacyJson: originalJson,
+    serializedState: originalJson
+  }).authority.close()
+  writeFileSync(dataFile, editedJson)
+  return { root, dataFile, databaseFile, profileId }
+}
+
+function rollback(profile: ReturnType<typeof fixture>) {
+  const maintenance = acquireProfileStateMaintenance(profile.root)
+  try {
+    return rollbackProfileState(profile.root, { kind: 'current-sqlite' }, maintenance)
+  } finally {
+    maintenance.release()
+  }
+}
+
+describe('keeping SQLite over JSON edited by an older build', () => {
+  it('tags the startup failure as a user-resolvable divergence', () => {
+    const profile = fixture()
+    let failure: unknown
+    try {
+      bootstrapProfileStateAuthority(profile)
+    } catch (error) {
+      failure = error
+    }
+    expect(failure).toBeInstanceOf(ProfileStateAuthorityBootstrapError)
+    expect(isDivergedProfileStateFailure(failure)).toBe(true)
+    expect(isDivergedProfileStateFailure(new ProfileStateAuthorityBootstrapError('other'))).toBe(
+      false
+    )
+  })
+
+  it('archives the diverged JSON and republishes JSON that SQLite accepts', () => {
+    const profile = fixture()
+    const databaseBefore = readFileSync(profile.databaseFile)
+    const result = rollback(profile)
+    expect(result).toMatchObject({
+      storage: 'sqlite',
+      restoredPath: profile.databaseFile,
+      revision: 1,
+      removedDatabaseFiles: []
+    })
+    expect(result.backupId).toBeUndefined()
+    expect(readFileSync(join(result.quarantineDirectory, 'orca-data.json'), 'utf8')).toBe(
+      editedJson
+    )
+    expect(readFileSync(join(result.quarantineDirectory, 'profile-state.db'))).toEqual(
+      databaseBefore
+    )
+    expect(JSON.parse(readFileSync(profile.dataFile, 'utf8'))).toEqual(sqliteState)
+
+    const reopened = bootstrapProfileStateAuthority(profile)
+    try {
+      expect(reopened.migrated).toBe(false)
+      expect(JSON.parse(reopened.authority?.readSerializedState() ?? 'null')).toEqual(sqliteState)
+    } finally {
+      reopened.authority?.close()
+    }
+    acquireProfileStateRuntimeAdmission(profile.root).release()
+  })
+
+  it('replaces JSON that an older build left unparseable', () => {
+    const profile = fixture()
+    writeFileSync(profile.dataFile, 'not json')
+    const result = rollback(profile)
+    expect(readFileSync(join(result.quarantineDirectory, 'orca-data.json'), 'utf8')).toBe(
+      'not json'
+    )
+    expect(JSON.parse(readFileSync(profile.dataFile, 'utf8'))).toEqual(sqliteState)
+  })
+
+  it('leaves both copies untouched when SQLite is unreadable', () => {
+    const profile = fixture()
+    writeFileSync(profile.databaseFile, 'broken database')
+    expect(() => rollback(profile)).toThrow()
+    expect(readFileSync(profile.databaseFile, 'utf8')).toBe('broken database')
+    expect(readFileSync(profile.dataFile, 'utf8')).toBe(editedJson)
+  })
+
+  it('restores the diverged JSON when republishing fails', () => {
+    const profile = fixture()
+    writeFileSync(profileStateJsonExportPath(profile.dataFile, 1), '{"conflicting":true}')
+    expect(() => rollback(profile)).toThrow('already exists with different content')
+    expect(readFileSync(profile.dataFile, 'utf8')).toBe(editedJson)
+  })
+
+  it('refuses while a profile owner holds admission', () => {
+    const profile = fixture()
+    const admission = acquireProfileStateRuntimeAdmission(profile.root)
+    try {
+      expect(() => rollback(profile)).toThrow('in use')
+      expect(readFileSync(profile.dataFile, 'utf8')).toBe(editedJson)
+      expect(existsSync(profile.databaseFile)).toBe(true)
+    } finally {
+      admission.release()
+    }
+  })
+})
diff --git a/src/main/persistence/profile-state/profile-state-database-errors.ts b/src/main/persistence/profile-state/profile-state-database-errors.ts
new file mode 100644
index 000000000000..65b58470a5e7
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-database-errors.ts
@@ -0,0 +1,17 @@
+export type ProfileStateDatabaseOpenErrorCode =
+  | 'unreadable'
+  | 'identity-mismatch'
+  | 'invalid-profile-id'
+  | 'newer-schema'
+
+export class ProfileStateDatabaseOpenError extends Error {
+  readonly code: ProfileStateDatabaseOpenErrorCode
+  readonly cause: unknown
+
+  constructor(code: ProfileStateDatabaseOpenErrorCode, message: string, cause?: unknown) {
+    super(message)
+    this.name = 'ProfileStateDatabaseOpenError'
+    this.code = code
+    this.cause = cause
+  }
+}
diff --git a/src/main/persistence/profile-state/profile-state-database-export-crash.test.ts b/src/main/persistence/profile-state/profile-state-database-export-crash.test.ts
new file mode 100644
index 000000000000..4f82cd61a465
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-database-export-crash.test.ts
@@ -0,0 +1,112 @@
+import { spawnProcess } from '../../../shared/child-process/run-process'
+import { mkdirSync, existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { build } from 'esbuild'
+import { tmpdir } from 'node:os'
+import { dirname, join, resolve } from 'node:path'
+import { afterEach, describe, expect, it } from 'vitest'
+import { importProfileStateJson } from './profile-state-documents'
+import {
+  openProfileStateDatabase,
+  openProfileStateDatabaseReadOnly,
+  profileStateDatabaseFile
+} from './profile-state-database'
+import { writeProfileStateDatabaseSnapshotAsync } from './profile-state-database-snapshot'
+
+const temporaryDirectories: string[] = []
+
+afterEach(() => {
+  for (const directory of temporaryDirectories.splice(0)) {
+    rmSync(directory, { recursive: true, force: true })
+  }
+})
+
+const interruptedExportScript = `
+  import { openProfileStateDatabaseReadOnly } from './profile-state-database'
+  import { writeProfileStateDatabaseSnapshotAsync } from './profile-state-database-snapshot'
+  const { db } = openProfileStateDatabaseReadOnly(process.argv[2], 'profile-a')
+  writeProfileStateDatabaseSnapshotAsync(db, process.argv[3], {
+    validateStagedSnapshot: async (path) => {
+      process.stdout.write(path + '\\n')
+      await new Promise(() => setInterval(() => {}, 1_000))
+    }
+  }).catch((error) => { console.error(error); process.exit(1) })
+`
+
+async function killBeforePublication(sourcePath: string, targetPath: string): Promise<string> {
+  const childEntry = join(dirname(sourcePath), 'interrupted-export.cjs')
+  await build({
+    stdin: {
+      contents: interruptedExportScript,
+      resolveDir: resolve('src/main/persistence/profile-state'),
+      loader: 'ts'
+    },
+    outfile: childEntry,
+    bundle: true,
+    platform: 'node',
+    format: 'cjs',
+    logLevel: 'silent'
+  })
+  const child = spawnProcess({
+    program: process.execPath,
+    args: [childEntry, sourcePath, targetPath],
+    timeoutMs: 10_000
+  })
+  for (const stream of [child.stdin, child.stdout, child.stderr]) {
+    stream?.on('error', () => {})
+  }
+  const exited = new Promise<void>((resolve, reject) => {
+    child.once('close', () => resolve())
+    child.once('error', reject)
+  })
+  const temporaryPath = await new Promise<string>((resolve, reject) => {
+    let output = ''
+    child.stdout.on('data', (chunk: Buffer | string) => {
+      output += String(chunk)
+      if (output.includes('\n')) {
+        resolve(output.trim())
+      }
+    })
+    child.once('close', () => reject(new Error('Export exited before staging completed')))
+    child.once('error', reject)
+  })
+  child.kill('SIGKILL')
+  await exited
+  return temporaryPath
+}
+
+describe('profile state database export crash recovery', () => {
+  it('leaves the destination intact when the production backup dies before publication', async () => {
+    const directory = mkdtempSync(join(tmpdir(), 'orca-profile-state-export-crash-'))
+    temporaryDirectories.push(directory)
+    const sourcePath = profileStateDatabaseFile(directory)
+    const source = openProfileStateDatabase(sourcePath, 'profile-a')
+    importProfileStateJson(source.db, JSON.stringify({ settings: { theme: 'dark' } }), {
+      now: () => 100
+    })
+    source.db.close()
+
+    const targetPath = join(directory, 'recovery', 'profile-state.db')
+    mkdirSync(join(directory, 'recovery'), { recursive: true })
+    writeFileSync(targetPath, 'known-good-destination')
+    const interruptedPath = await killBeforePublication(sourcePath, targetPath)
+
+    expect(readFileSync(targetPath, 'utf8')).toBe('known-good-destination')
+    expect(existsSync(interruptedPath)).toBe(true)
+    rmSync(interruptedPath, { force: true })
+
+    const recoveredSource = openProfileStateDatabase(sourcePath, 'profile-a')
+    try {
+      await writeProfileStateDatabaseSnapshotAsync(recoveredSource.db, targetPath)
+    } finally {
+      recoveredSource.db.close()
+    }
+    const snapshot = openProfileStateDatabaseReadOnly(targetPath, 'profile-a')
+    try {
+      expect(
+        snapshot.db.prepare('SELECT value FROM profile_state_meta WHERE key = ?').get('revision')
+      ).toEqual({ value: '1' })
+    } finally {
+      snapshot.db.close()
+    }
+  })
+})
diff --git a/src/main/persistence/profile-state/profile-state-database-publication.ts b/src/main/persistence/profile-state/profile-state-database-publication.ts
new file mode 100644
index 000000000000..eb265b433983
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-database-publication.ts
@@ -0,0 +1,38 @@
+import { dirname } from 'node:path'
+import { publishFileDurableSync } from '../../durable-file-write'
+
+class ProfileStateDatabasePublicationError extends Error {
+  readonly code = 'profile-state-publication-unavailable' as const
+
+  constructor(databaseFile: string, cause: unknown) {
+    super(
+      [
+        `Orca could not safely publish profile state in ${dirname(databaseFile)}.`,
+        'This location must support hard links, and Orca needs permission to create them.',
+        'Close Orca and orcad before checking folder permissions or moving the complete Orca data directory to a writable local filesystem that supports hard links, such as APFS, NTFS, or ext4.',
+        'Keep the original directory and all recovery files.'
+      ].join('\n'),
+      { cause }
+    )
+    this.name = 'ProfileStateDatabasePublicationError'
+  }
+}
+
+/** Preserve atomic no-overwrite publication while explaining filesystem refusals. */
+export function publishProfileStateDatabase(stagingFile: string, databaseFile: string): boolean {
+  try {
+    return publishFileDurableSync(stagingFile, databaseFile)
+  } catch (error) {
+    if (
+      error instanceof Error &&
+      'syscall' in error &&
+      error.syscall === 'link' &&
+      'code' in error &&
+      typeof error.code === 'string' &&
+      ['ENOTSUP', 'EOPNOTSUPP', 'ENOSYS', 'EPERM', 'EACCES', 'EXDEV'].includes(error.code)
+    ) {
+      throw new ProfileStateDatabasePublicationError(databaseFile, error)
+    }
+    throw error
+  }
+}
diff --git a/src/main/persistence/profile-state/profile-state-database-quarantine.ts b/src/main/persistence/profile-state/profile-state-database-quarantine.ts
new file mode 100644
index 000000000000..8e15f9fcf0d3
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-database-quarantine.ts
@@ -0,0 +1,89 @@
+import { profileStateDatabaseFiles } from './profile-state-storage-classification'
+import { randomUUID } from 'node:crypto'
+import { existsSync, mkdirSync, rmSync } from 'node:fs'
+import { basename, dirname, join } from 'node:path'
+import { bestEffortFsyncDirectorySync, fsyncFileSync } from '../../../shared/secure-file'
+import { durableWriteTempPath, writeFileDurableSync } from '../../durable-file-write'
+import { hardenSqliteDatabaseFiles } from '../../sqlite/harden-database-files'
+import { copyProfileStateRecoveryFiles } from './profile-state-recovery-copy'
+
+export type ProfileStateDatabaseQuarantine = {
+  directory: string
+  manifestPath: string
+  copiedFiles: readonly string[]
+}
+
+/**
+ * Preserve a damaged profile database family before a caller attempts repair or fallback.
+ * Originals remain in place so this operation cannot turn a recovery failure into data loss.
+ */
+export function quarantineProfileStateDatabase(
+  databasePath: string,
+  profileId: string,
+  quarantineRoot = dirname(databasePath),
+  reason = 'profile-state-database-recovery',
+  recoveryFiles: readonly string[] = []
+): ProfileStateDatabaseQuarantine {
+  if (databasePath.length === 0 || databasePath.includes('\0') || profileId.length === 0) {
+    throw new Error('Profile state quarantine arguments are invalid')
+  }
+  const sourceFiles = profileStateDatabaseFiles(databasePath).filter(existsSync)
+  if (sourceFiles.length === 0 && recoveryFiles.length === 0) {
+    throw new Error('Profile state database family does not exist')
+  }
+
+  const directory = join(quarantineRoot, `profile-state-corrupt-${Date.now()}-${randomUUID()}`)
+  const targets = new Set<string>()
+  mkdirSync(directory, { recursive: true, mode: 0o700 })
+  try {
+    const copies: { source: string; target: string }[] = []
+    for (const sourcePath of sourceFiles) {
+      const targetName =
+        sourcePath === databasePath
+          ? 'profile-state.db'
+          : `profile-state.db${sourcePath.slice(databasePath.length)}`
+      const targetPath = join(directory, targetName)
+      copies.push({ source: sourcePath, target: targetPath })
+      targets.add(targetPath)
+    }
+    for (const sourcePath of new Set(recoveryFiles)) {
+      const targetPath = join(directory, basename(sourcePath))
+      if (
+        targets.has(targetPath) ||
+        existsSync(targetPath) ||
+        basename(sourcePath) === 'manifest.json'
+      ) {
+        throw new Error('Profile recovery artifact name conflicts with the quarantine manifest')
+      }
+      copies.push({ source: sourcePath, target: targetPath })
+      targets.add(targetPath)
+    }
+    copyProfileStateRecoveryFiles(copies)
+    const manifestPath = join(directory, 'manifest.json')
+    // Let the destination filesystem detect case or Unicode aliases of the manifest name.
+    if (existsSync(manifestPath)) {
+      throw new Error('Profile recovery artifact name conflicts with the quarantine manifest')
+    }
+    for (const { target } of copies) {
+      hardenSqliteDatabaseFiles(target)
+      fsyncFileSync(target)
+    }
+    writeFileDurableSync(
+      durableWriteTempPath(manifestPath),
+      manifestPath,
+      JSON.stringify({
+        schemaVersion: 1,
+        profileId,
+        reason,
+        capturedAt: new Date().toISOString(),
+        sourceFiles: sourceFiles.map((sourcePath) => sourcePath.slice(databasePath.length)),
+        recoveryFiles: [...new Set(recoveryFiles)].map((sourcePath) => basename(sourcePath))
+      })
+    )
+    bestEffortFsyncDirectorySync(directory)
+    return { directory, manifestPath, copiedFiles: [...targets] }
+  } catch (error) {
+    rmSync(directory, { recursive: true, force: true })
+    throw error
+  }
+}
diff --git a/src/main/persistence/profile-state/profile-state-database-recovery.test.ts b/src/main/persistence/profile-state/profile-state-database-recovery.test.ts
new file mode 100644
index 000000000000..34f61113c0ab
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-database-recovery.test.ts
@@ -0,0 +1,296 @@
+import {
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  readdirSync,
+  rmSync,
+  symlinkSync,
+  writeFileSync
+} from 'node:fs'
+import { tmpdir } from 'node:os'
+import { basename, dirname, join } from 'node:path'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import Database from '../../sqlite/sync-database'
+import * as durableFileWrite from '../../durable-file-write'
+import {
+  openProfileStateDatabase,
+  openProfileStateDatabaseReadOnly
+} from './profile-state-database'
+import { exportProfileStateJson, importProfileStateJson } from './profile-state-documents'
+import {
+  createProfileStateDatabaseBackupId,
+  profileStateDatabaseBackupPath
+} from './profile-state-backup-path'
+import { writeProfileStateDatabaseSnapshotAsync } from './profile-state-database-snapshot'
+import { restoreProfileStateDatabaseBackup } from './profile-state-database-recovery'
+import { restoreProfileStateJsonExport } from './legacy-json/profile-state-recovery'
+import { acquireProfileStateMaintenance } from './profile-state-access'
+import { profileStateJsonExportPath } from './legacy-json/profile-state-export-path'
+
+const directories: string[] = []
+const profileId = 'profile-recovery-test'
+const savedJson = JSON.stringify({
+  settings: { theme: 'dark', httpProxyUrl: 'safe-storage-sealed-ciphertext' },
+  ui: { unknownField: { keep: true } },
+  opaqueExtension: { sequence: 71 }
+})
+
+afterEach(() => {
+  vi.restoreAllMocks()
+  for (const path of directories.splice(0)) {
+    rmSync(path, { recursive: true, force: true })
+  }
+})
+
+async function fixture(options: { profileId?: string; empty?: boolean; json?: string } = {}) {
+  const root = mkdtempSync(join(tmpdir(), 'orca-database-recovery-'))
+  directories.push(root)
+  const directory = join(root, 'profiles', profileId)
+  mkdirSync(directory, { recursive: true })
+  const maintenance = acquireProfileStateMaintenance(root)
+  const databasePath = join(directory, 'profile-state.db')
+  const dataFile = join(directory, 'orca-data.json')
+  const exportPath = profileStateJsonExportPath(dataFile, 1)
+  const backupPath = profileStateDatabaseBackupPath(
+    databasePath,
+    createProfileStateDatabaseBackupId()
+  )
+  const source = openProfileStateDatabase(
+    join(directory, 'source.db'),
+    options.profileId ?? profileId
+  )
+  try {
+    if (!options.empty) {
+      importProfileStateJson(source.db, options.json ?? savedJson)
+    }
+    await writeProfileStateDatabaseSnapshotAsync(source.db, backupPath)
+  } finally {
+    source.db.close()
+  }
+  writeFileSync(dataFile, '{"settings":{"theme":"stale"}}')
+  writeFileSync(exportPath, '{"settings":{"theme":"migration"}}')
+  for (const suffix of ['', '-wal', '-shm', '-journal']) {
+    writeFileSync(`${databasePath}${suffix}`, `damaged ${suffix || 'primary'}`)
+  }
+  return { databasePath, dataFile, backupPath, exportPath, profileId, maintenance }
+}
+
+function readRestored(databasePath: string): string {
+  const opened = openProfileStateDatabaseReadOnly(databasePath, profileId)
+  try {
+    return exportProfileStateJson(opened.db)
+  } finally {
+    opened.db.close()
+  }
+}
+
+function expectOriginals(options: Awaited<ReturnType<typeof fixture>>): void {
+  expect(readFileSync(options.databasePath, 'utf8')).toBe('damaged primary')
+  expect(readFileSync(options.dataFile, 'utf8')).toContain('stale')
+  expect(existsSync(options.backupPath)).toBe(true)
+  expect(readdirSync(dirname(options.databasePath)).some((name) => name.endsWith('.tmp'))).toBe(
+    false
+  )
+}
+
+describe('profile state database backup recovery', () => {
+  it('rejects corruption in a large cloned staging file before changing recovery state', async () => {
+    const options = await fixture({
+      json: JSON.stringify({ opaqueExtension: 'x'.repeat(8 * 1024 * 1024) })
+    })
+    const backup = new Database(options.backupPath)
+    try {
+      backup.exec("UPDATE profile_state_documents SET content_hash = printf('%064d', 0)")
+    } finally {
+      backup.close()
+    }
+    const originalBackup = readFileSync(options.backupPath)
+    expect(() => restoreProfileStateDatabaseBackup(options)).toThrow()
+    expectOriginals(options)
+    expect(readFileSync(options.backupPath).equals(originalBackup)).toBe(true)
+    expect(
+      readdirSync(dirname(options.databasePath)).some((name) =>
+        name.startsWith('.orca-recovery-clone-')
+      )
+    ).toBe(false)
+  })
+
+  it.each([true, false])(
+    'restores SQLite authority with the old database present=%s',
+    async (hasDatabase) => {
+      const options = await fixture()
+      const backupBytes = readFileSync(options.backupPath)
+      if (!hasDatabase) {
+        for (const suffix of ['', '-wal', '-shm', '-journal']) {
+          rmSync(`${options.databasePath}${suffix}`)
+        }
+      }
+      const beforeRestore = vi.fn()
+
+      const result = restoreProfileStateDatabaseBackup({ ...options, beforeRestore })
+
+      expect(result.revision).toBe(1)
+      expect(beforeRestore).toHaveBeenCalledOnce()
+      expect(readRestored(options.databasePath)).toBe(savedJson)
+      expect(existsSync(options.dataFile)).toBe(false)
+      expect(readFileSync(options.backupPath)).toEqual(backupBytes)
+      expect(existsSync(options.exportPath)).toBe(false)
+      expect(readFileSync(join(result.quarantine.directory, basename(options.backupPath)))).toEqual(
+        backupBytes
+      )
+      expect(
+        readFileSync(join(result.quarantine.directory, basename(options.dataFile)), 'utf8')
+      ).toContain('stale')
+      expect(existsSync(join(result.quarantine.directory, basename(options.exportPath)))).toBe(true)
+      if (hasDatabase) {
+        for (const suffix of ['', '-wal', '-shm', '-journal']) {
+          expect(
+            readFileSync(join(result.quarantine.directory, `profile-state.db${suffix}`), 'utf8')
+          ).toBe(`damaged ${suffix || 'primary'}`)
+        }
+      }
+      for (const suffix of ['-wal', '-shm', '-journal']) {
+        expect(existsSync(`${options.databasePath}${suffix}`)).toBe(false)
+      }
+    }
+  )
+
+  it.each(['foreign identity', 'empty profile'])(
+    'rejects a %s backup before touching recovery state',
+    async (kind) => {
+      const options = await fixture(
+        kind === 'foreign identity' ? { profileId: 'other-profile' } : { empty: true }
+      )
+      const beforeRestore = vi.fn()
+      expect(() => restoreProfileStateDatabaseBackup({ ...options, beforeRestore })).toThrow()
+      expect(beforeRestore).not.toHaveBeenCalled()
+      expectOriginals(options)
+    }
+  )
+
+  it.each(['corrupt hash', 'future schema', 'WAL mode'])(
+    'rejects a backup with %s',
+    async (kind) => {
+      const options = await fixture()
+      const backup = new Database(options.backupPath)
+      try {
+        if (kind === 'corrupt hash') {
+          backup.exec("UPDATE profile_state_documents SET payload = '{}' WHERE domain = 'settings'")
+        }
+        if (kind === 'future schema') {
+          backup.pragma('user_version = 999')
+        }
+        if (kind === 'WAL mode') {
+          backup.pragma('journal_mode = WAL')
+        }
+      } finally {
+        backup.close()
+      }
+      const beforeRestore = vi.fn()
+      expect(() => restoreProfileStateDatabaseBackup({ ...options, beforeRestore })).toThrow()
+      expect(beforeRestore).not.toHaveBeenCalled()
+      expectOriginals(options)
+    }
+  )
+
+  it.each(['-wal', '-shm', '-journal'])(
+    'rejects a selected backup with a %s sidecar',
+    async (suffix) => {
+      const options = await fixture()
+      writeFileSync(`${options.backupPath}${suffix}`, 'external writer evidence')
+      expect(() => restoreProfileStateDatabaseBackup(options)).toThrow('not self-contained')
+      expectOriginals(options)
+    }
+  )
+
+  it.skipIf(process.platform === 'win32')(
+    'rejects a reserved-name symlink to a valid snapshot',
+    async () => {
+      const options = await fixture()
+      const alias = profileStateDatabaseBackupPath(
+        options.databasePath,
+        createProfileStateDatabaseBackupId()
+      )
+      symlinkSync(options.backupPath, alias)
+      expect(() => restoreProfileStateDatabaseBackup({ ...options, backupPath: alias })).toThrow(
+        'regular file'
+      )
+      expectOriginals(options)
+    }
+  )
+
+  it('refuses a backup path outside the retained profile inventory', async () => {
+    const options = await fixture()
+    expect(() =>
+      restoreProfileStateDatabaseBackup({ ...options, backupPath: options.databasePath })
+    ).toThrow('not retained')
+    expectOriginals(options)
+  })
+
+  it('keeps live state untouched when an older artifact cannot be archived', async () => {
+    const options = await fixture()
+    mkdirSync(profileStateJsonExportPath(options.dataFile, 2))
+    expect(() => restoreProfileStateDatabaseBackup(options)).toThrow()
+    expectOriginals(options)
+  })
+
+  it('keeps live state untouched when the pre-restore cache invalidation fails', async () => {
+    const options = await fixture()
+    expect(() =>
+      restoreProfileStateDatabaseBackup({
+        ...options,
+        beforeRestore: () => {
+          throw new Error('injected pre-restore failure')
+        }
+      })
+    ).toThrow('injected pre-restore failure')
+    expectOriginals(options)
+  })
+
+  it('preserves recoverable evidence when publication fails after removing a damaged family', async () => {
+    const options = await fixture()
+    const renameDurableSync = durableFileWrite.renameDurableSync
+    vi.spyOn(durableFileWrite, 'renameDurableSync').mockImplementation((source, target) => {
+      if (target === options.databasePath) {
+        throw new Error('injected snapshot publication failure')
+      }
+      return renameDurableSync(source, target)
+    })
+    expect(() => restoreProfileStateDatabaseBackup(options)).toThrow(
+      'injected snapshot publication failure'
+    )
+    expect(existsSync(options.databasePath)).toBe(false)
+    expect(existsSync(options.backupPath)).toBe(true)
+    const archives = readdirSync(dirname(options.databasePath)).filter((name) =>
+      name.startsWith('profile-state-corrupt-')
+    )
+    expect(archives).toHaveLength(1)
+    expect(
+      readFileSync(join(dirname(options.databasePath), archives[0], 'profile-state.db-wal'), 'utf8')
+    ).toBe('damaged -wal')
+    vi.restoreAllMocks()
+    options.maintenance.release()
+    options.maintenance = acquireProfileStateMaintenance(
+      dirname(dirname(dirname(options.dataFile)))
+    )
+    restoreProfileStateDatabaseBackup(options)
+    expect(readRestored(options.databasePath)).toBe(savedJson)
+  })
+
+  it('archives and removes SQLite backups and sidecars when explicitly rolling back to JSON', async () => {
+    const options = await fixture()
+    writeFileSync(`${options.backupPath}-journal`, 'backup recovery evidence')
+    const recovered = restoreProfileStateJsonExport(options)
+    expect(existsSync(options.databasePath)).toBe(false)
+    expect(existsSync(options.backupPath)).toBe(false)
+    expect(existsSync(`${options.backupPath}-journal`)).toBe(false)
+    expect(
+      readFileSync(
+        join(recovered.quarantine.directory, `${basename(options.backupPath)}-journal`),
+        'utf8'
+      )
+    ).toBe('backup recovery evidence')
+    expect(readFileSync(options.dataFile, 'utf8')).toContain('migration')
+  })
+})
diff --git a/src/main/persistence/profile-state/profile-state-database-recovery.ts b/src/main/persistence/profile-state/profile-state-database-recovery.ts
new file mode 100644
index 000000000000..f561c9766802
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-database-recovery.ts
@@ -0,0 +1,113 @@
+import { profileStateDatabaseFiles } from './profile-state-storage-classification'
+import { existsSync, lstatSync, mkdirSync, rmSync } from 'node:fs'
+import { dirname } from 'node:path'
+import { durableWriteTempPath, renameDurableSync } from '../../durable-file-write'
+import { hardenSqliteDatabaseFiles } from '../../sqlite/harden-database-files'
+import { bestEffortFsyncDirectorySync, fsyncFileSync } from '../../../shared/secure-file'
+import { openProfileStateDatabaseReadOnly } from './profile-state-database'
+import { validateProfileStateSnapshot } from './profile-state-documents'
+import { copyProfileStateRecoveryFile } from './profile-state-recovery-copy'
+import {
+  profileStateDatabaseBackups,
+  profileStateDatabaseBackupFiles
+} from './profile-state-backup-path'
+import { profileStateJsonExportPaths } from './legacy-json/profile-state-export-path'
+import { assertProfileStateMaintenance, type ProfileStateMaintenance } from './profile-state-access'
+import {
+  quarantineProfileStateDatabase,
+  type ProfileStateDatabaseQuarantine
+} from './profile-state-database-quarantine'
+
+export type ProfileStateDatabaseRecoveryOptions = {
+  maintenance: ProfileStateMaintenance
+  databasePath: string
+  dataFile: string
+  backupPath: string
+  profileId: string
+  quarantineRoot?: string
+  reason?: string
+  beforeRestore?: () => void
+}
+
+export type ProfileStateDatabaseRecovery = {
+  revision: number
+  quarantine: ProfileStateDatabaseQuarantine
+  removedDatabaseFiles: readonly string[]
+}
+
+/** Replace the database family only while startup and offline access are excluded. */
+export function restoreProfileStateDatabaseBackup(
+  options: ProfileStateDatabaseRecoveryOptions
+): ProfileStateDatabaseRecovery {
+  assertProfileStateMaintenance(options.maintenance, options)
+  const backups = profileStateDatabaseBackups(options.databasePath)
+  if (!backups.some((backup) => backup.path === options.backupPath)) {
+    throw new Error('Selected profile state database backup is not retained by this profile')
+  }
+  if (!lstatSync(options.backupPath).isFile()) {
+    throw new Error('Profile state database backup must be a regular file')
+  }
+  if (['-wal', '-shm', '-journal'].some((suffix) => existsSync(`${options.backupPath}${suffix}`))) {
+    throw new Error('Profile state database backup has sidecars and is not self-contained')
+  }
+
+  mkdirSync(dirname(options.databasePath), { recursive: true })
+  const stagingPath = durableWriteTempPath(options.databasePath)
+  try {
+    copyProfileStateRecoveryFile(options.backupPath, stagingPath)
+    hardenSqliteDatabaseFiles(stagingPath)
+    const revision = validateRecoverySnapshot(stagingPath, options.profileId)
+    fsyncFileSync(stagingPath)
+    const recoveryFiles = [
+      ...profileStateDatabaseBackupFiles(options.databasePath),
+      ...profileStateJsonExportPaths(options.dataFile),
+      ...(existsSync(options.dataFile) ? [options.dataFile] : [])
+    ]
+    const quarantine = quarantineProfileStateDatabase(
+      options.databasePath,
+      options.profileId,
+      options.quarantineRoot,
+      options.reason ?? 'profile-state-database-rollback',
+      recoveryFiles
+    )
+    options.beforeRestore?.()
+
+    // JSON exports are revisioned for the legacy authority. Remove them after
+    // archiving so a later SQLite revision can publish a fresh export at the
+    // same number without colliding with an older divergent payload.
+    const retainedJsonExports = profileStateJsonExportPaths(options.dataFile)
+    for (const exportPath of retainedJsonExports) {
+      rmSync(exportPath)
+    }
+
+    const removedDatabaseFiles = profileStateDatabaseFiles(options.databasePath).filter(existsSync)
+    // Remove the primary first: interruption must fail closed on retained backups, never replay old WAL.
+    for (const path of removedDatabaseFiles) {
+      rmSync(path)
+    }
+    rmSync(options.dataFile, { force: true })
+    bestEffortFsyncDirectorySync(dirname(options.databasePath))
+    renameDurableSync(stagingPath, options.databasePath)
+    return { revision, quarantine, removedDatabaseFiles }
+  } finally {
+    for (const path of profileStateDatabaseFiles(stagingPath)) {
+      rmSync(path, { force: true })
+    }
+  }
+}
+
+function validateRecoverySnapshot(path: string, profileId: string): number {
+  const opened = openProfileStateDatabaseReadOnly(path, profileId)
+  try {
+    if (opened.db.pragma('journal_mode', { simple: true }) !== 'delete') {
+      throw new Error('Profile state database backup must use a self-contained journal mode')
+    }
+    const revision = validateProfileStateSnapshot(opened.db)
+    if (revision === 0) {
+      throw new Error('Profile state database backup contains no committed profile state')
+    }
+    return revision
+  } finally {
+    opened.db.close()
+  }
+}
diff --git a/src/main/persistence/profile-state/profile-state-database-rollback-export.test.ts b/src/main/persistence/profile-state/profile-state-database-rollback-export.test.ts
new file mode 100644
index 000000000000..29f1af653897
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-database-rollback-export.test.ts
@@ -0,0 +1,159 @@
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { basename, join } from 'node:path'
+import { expect, it, vi } from 'vitest'
+import { Store } from '../loading-store/store'
+import { ProfileStateSqliteAuthority } from './profile-state-sqlite-authority'
+import { profileStateDatabaseBackups } from './profile-state-backup-path'
+import { profileStateJsonExportPath } from './legacy-json/profile-state-export-path'
+import { acquireProfileStateMaintenance } from './profile-state-access'
+import { restoreProfileStateJsonExport } from './legacy-json/profile-state-recovery'
+import { openProfileStateDatabase } from './profile-state-database'
+import {
+  bootstrapProfileStateAuthority,
+  ProfileStateAuthorityBootstrapError
+} from './profile-state-authority-bootstrap'
+import { restoreProfileStateDatabaseBackup } from './profile-state-database-recovery'
+
+vi.mock('electron', () => ({
+  app: {
+    getPath: () => tmpdir(),
+    getName: () => 'orca-test',
+    getVersion: () => '0.0.0-test',
+    isPackaged: false,
+    on: () => {},
+    whenReady: () => Promise.resolve()
+  },
+  safeStorage: {
+    isEncryptionAvailable: () => true,
+    encryptString: (value: string) => Buffer.from(`encrypted:${value}`),
+    decryptString: (value: Buffer) => value.toString().slice('encrypted:'.length)
+  },
+  ipcMain: { on: () => {}, handle: () => {} },
+  BrowserWindow: { getAllWindows: () => [] }
+}))
+vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
+vi.mock('../../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: () => ({ nth_repo_added: 2 })
+}))
+vi.mock('../../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: () => ({ hosts: [] }),
+  sshConfigHostsToTargets: () => []
+}))
+
+it('can publish an updater JSON export at a reused revision after SQLite rollback', async () => {
+  const root = mkdtempSync(join(tmpdir(), 'orca-database-rollback-export-'))
+  const directory = join(root, 'profiles', 'rollback-export')
+  mkdirSync(directory, { recursive: true })
+  const databasePath = join(directory, 'profile-state.db')
+  const dataFile = join(directory, 'orca-data.json')
+  const profileId = 'rollback-export'
+  const stores: Store[] = []
+  try {
+    const originalAuthority = new ProfileStateSqliteAuthority(databasePath, profileId)
+    const original = new Store({
+      dataFile,
+      profileStateAuthority: originalAuthority
+    })
+    stores.push(original)
+    original.updateSettings({ theme: 'light' })
+    await original.flushPendingOrThrowAsync()
+    await originalAuthority.drainBackups()
+    const backup = profileStateDatabaseBackups(databasePath)[0]
+    expect(backup).toBeDefined()
+    original.updateSettings({ theme: 'dark' })
+    const formerRevision = original.writeLatestProfileStateJsonExport()
+    expect(formerRevision).toBeTypeOf('number')
+    if (!backup || formerRevision === undefined) {
+      throw new Error('Missing recovery fixture')
+    }
+    const exportPath = profileStateJsonExportPath(dataFile, formerRevision)
+    const previousExport = readFileSync(exportPath)
+    original.freezeWrites()
+    await original.flushAsync()
+
+    const restored = restoreProfileStateDatabaseBackup({
+      maintenance: acquireProfileStateMaintenance(root),
+      databasePath,
+      dataFile,
+      profileId,
+      backupPath: backup.path
+    })
+    expect(existsSync(exportPath)).toBe(false)
+    expect(readFileSync(join(restored.quarantine.directory, basename(exportPath)))).toEqual(
+      previousExport
+    )
+    const recovered = new Store({
+      dataFile,
+      profileStateAuthority: new ProfileStateSqliteAuthority(databasePath, profileId)
+    })
+    stores.push(recovered)
+    recovered.updateSettings({ theme: 'system' })
+    const newRevision = recovered.writeLatestProfileStateJsonExport()
+
+    expect(newRevision).toBe(formerRevision)
+    expect(JSON.parse(readFileSync(exportPath, 'utf8')).settings.theme).toBe('system')
+    expect(readFileSync(exportPath)).not.toEqual(previousExport)
+  } finally {
+    for (const store of stores) {
+      store.freezeWrites()
+      await store.flushAsync()
+    }
+    rmSync(root, { recursive: true, force: true })
+  }
+})
+
+it('leaves an explicit rollback path if compatibility publication fails before acceptance', async () => {
+  const root = mkdtempSync(join(tmpdir(), 'orca-store-profile-state-compat-failure-'))
+  const directory = join(root, 'profiles', 'profile-authority-test')
+  mkdirSync(directory, { recursive: true })
+  const dataFile = join(directory, 'orca-data.json')
+  const databasePath = join(directory, 'profile-state.db')
+  writeFileSync(dataFile, JSON.stringify({ settings: { theme: 'light' } }), 'utf8')
+
+  const authority = new ProfileStateSqliteAuthority(databasePath, 'profile-authority-test')
+  const store = new Store({ dataFile, profileStateAuthority: authority })
+  try {
+    store.updateSettings({ theme: 'dark' })
+    store.flushOrThrow()
+    const revisionOne = store.writeLatestProfileStateJsonExport()
+    expect(revisionOne).toBe(1)
+
+    const opened = openProfileStateDatabase(databasePath, 'profile-authority-test')
+    opened.db.exec(
+      `CREATE TRIGGER fail_compatibility_acceptance
+       BEFORE INSERT ON profile_state_meta
+       WHEN NEW.key = 'legacy_json_acceptance'
+       BEGIN SELECT RAISE(ABORT, 'injected compatibility failure'); END`
+    )
+    opened.db.close()
+
+    store.updateSettings({ theme: 'light' })
+    expect(() => store.writeLatestProfileStateJsonCompatibilityExport()).toThrow(
+      'injected compatibility failure'
+    )
+    expect(JSON.parse(readFileSync(dataFile, 'utf8')).settings.theme).toBe('light')
+    expect(() =>
+      bootstrapProfileStateAuthority({
+        dataFile,
+        databaseFile: databasePath,
+        profileId: 'profile-authority-test'
+      })
+    ).toThrow(ProfileStateAuthorityBootstrapError)
+
+    store.freezeWrites()
+    await store.flushAsync()
+    restoreProfileStateJsonExport({
+      maintenance: acquireProfileStateMaintenance(root),
+      databasePath,
+      dataFile,
+      exportPath: profileStateJsonExportPath(dataFile, revisionOne ?? 1),
+      profileId: 'profile-authority-test'
+    })
+    expect(JSON.parse(readFileSync(dataFile, 'utf8')).settings.theme).toBe('dark')
+  } finally {
+    store.freezeWrites()
+    await store.flushAsync()
+    rmSync(root, { recursive: true, force: true })
+  }
+})
diff --git a/src/main/persistence/profile-state/profile-state-database-schema.ts b/src/main/persistence/profile-state/profile-state-database-schema.ts
new file mode 100644
index 000000000000..4f6cd4538259
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-database-schema.ts
@@ -0,0 +1,41 @@
+// Schema 3 requires explicit automation storage metadata even when history is empty.
+
+import {
+  PROFILE_STATE_AUTOMATION_RUNS_META_TABLE,
+  PROFILE_STATE_AUTOMATION_RUNS_TABLE
+} from './profile-state-automation-runs-model'
+
+export const PROFILE_STATE_DATABASE_SCHEMA_VERSION = 3
+export const PROFILE_STATE_DOCUMENT_VERSION = 1
+
+export const PROFILE_STATE_META_PROFILE_ID = 'profile_id'
+export const PROFILE_STATE_META_REVISION = 'revision'
+/** Records the legacy JSON bytes accepted by the SQLite authority bootstrap. */
+export const PROFILE_STATE_META_LEGACY_JSON_ACCEPTANCE = 'legacy_json_acceptance'
+
+export function createProfileStateTablesSql(): string {
+  return `CREATE TABLE IF NOT EXISTS profile_state_meta (
+    key TEXT PRIMARY KEY NOT NULL, value TEXT NOT NULL
+  );
+  CREATE TABLE IF NOT EXISTS profile_state_documents (
+    domain TEXT PRIMARY KEY NOT NULL, payload TEXT NOT NULL,
+    domain_version INTEGER NOT NULL, revision INTEGER NOT NULL,
+    updated_at INTEGER NOT NULL, content_hash TEXT NOT NULL
+  );
+  CREATE TABLE IF NOT EXISTS ${PROFILE_STATE_AUTOMATION_RUNS_META_TABLE} (
+    domain TEXT PRIMARY KEY NOT NULL,
+    presence TEXT NOT NULL,
+    domain_version INTEGER NOT NULL,
+    revision INTEGER NOT NULL,
+    updated_at INTEGER NOT NULL,
+    content_hash TEXT NOT NULL
+  );
+  CREATE TABLE IF NOT EXISTS ${PROFILE_STATE_AUTOMATION_RUNS_TABLE} (
+    run_id TEXT PRIMARY KEY NOT NULL,
+    ordinal INTEGER NOT NULL,
+    payload TEXT NOT NULL,
+    content_hash TEXT NOT NULL,
+    revision INTEGER NOT NULL,
+    updated_at INTEGER NOT NULL
+  );`
+}
diff --git a/src/main/persistence/profile-state/profile-state-database-snapshot.test.ts b/src/main/persistence/profile-state/profile-state-database-snapshot.test.ts
new file mode 100644
index 000000000000..e0147cb937f4
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-database-snapshot.test.ts
@@ -0,0 +1,328 @@
+import {
+  existsSync,
+  mkdtempSync,
+  readFileSync,
+  readdirSync,
+  rmSync,
+  statSync,
+  symlinkSync,
+  writeFileSync
+} from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import {
+  openProfileStateDatabase,
+  openProfileStateDatabaseReadOnly,
+  profileStateDatabaseFile
+} from './profile-state-database'
+import { exportProfileStateJson, importProfileStateJson } from './profile-state-documents'
+import { writeProfileStateDatabaseSnapshotAsync } from './profile-state-database-snapshot'
+import type Database from '../../sqlite/sync-database'
+import * as durableFileWrite from '../../durable-file-write'
+import * as fsPromises from 'node:fs/promises'
+
+vi.mock('node:fs/promises', async (importOriginal) => {
+  const actual = await importOriginal<typeof fsPromises>()
+  return { ...actual }
+})
+
+const directories: string[] = []
+const databases: Database.Database[] = []
+
+afterEach(() => {
+  vi.restoreAllMocks()
+  for (const db of databases.splice(0)) {
+    db.close()
+  }
+  for (const directory of directories.splice(0)) {
+    rmSync(directory, { recursive: true, force: true })
+  }
+})
+
+function fixture() {
+  const directory = mkdtempSync(join(tmpdir(), 'orca-profile-state-async-snapshot-'))
+  directories.push(directory)
+  const databasePath = profileStateDatabaseFile(directory)
+  const { db } = openProfileStateDatabase(databasePath, 'profile-a')
+  databases.push(db)
+  const originalJson = JSON.stringify({ settings: { theme: 'light' } })
+  importProfileStateJson(db, originalJson)
+  return { directory, databasePath, db, targetPath: join(directory, 'snapshot.db'), originalJson }
+}
+
+function readSnapshot(path: string): string {
+  const { db } = openProfileStateDatabaseReadOnly(path, 'profile-a')
+  try {
+    return exportProfileStateJson(db)
+  } finally {
+    db.close()
+  }
+}
+
+function expectNoTemporaryFiles(directory: string): void {
+  expect(readdirSync(directory).filter((name) => name.includes('.tmp'))).toEqual([])
+}
+
+describe('asynchronous profile-state database snapshots', () => {
+  it('publishes a hardened self-contained snapshot including committed WAL pages', async () => {
+    const { directory, databasePath, db, targetPath, originalJson } = fixture()
+    expect(existsSync(`${databasePath}-wal`)).toBe(true)
+    const sourceFile = readFileSync(databasePath)
+
+    await writeProfileStateDatabaseSnapshotAsync(db, targetPath)
+
+    expect(readSnapshot(targetPath)).toBe(originalJson)
+    expect(existsSync(`${targetPath}-wal`)).toBe(false)
+    expect(existsSync(`${targetPath}-shm`)).toBe(false)
+    if (process.platform !== 'win32') {
+      expect(statSync(targetPath).mode & 0o777).toBe(0o600)
+    }
+    expect(exportProfileStateJson(db)).toBe(originalJson)
+    expect(db.pragma('journal_mode', { simple: true })).toBe('wal')
+    expect(readFileSync(databasePath)).toEqual(sourceFile)
+    importProfileStateJson(db, JSON.stringify({ settings: { theme: 'dark' } }))
+    expect(readSnapshot(targetPath)).toBe(originalJson)
+    expectNoTemporaryFiles(directory)
+  })
+
+  it('never removes an existing staging file when exclusive creation fails', async () => {
+    const { db, databasePath, targetPath, originalJson } = fixture()
+    await expect(
+      writeProfileStateDatabaseSnapshotAsync(db, targetPath, { temporaryPath: databasePath })
+    ).rejects.toThrow()
+    expect(existsSync(databasePath)).toBe(true)
+    expect(exportProfileStateJson(db)).toBe(originalJson)
+    expect(existsSync(targetPath)).toBe(false)
+  })
+
+  // Node's incremental backup callback is not part of Bun's worker snapshot contract.
+  it.skipIf(!!process.versions.bun).each(['same connection', 'another connection'] as const)(
+    'keeps a consistent complete revision while writes occur from %s',
+    async (connection) => {
+      const { directory, databasePath, db, targetPath } = fixture()
+      const writer =
+        connection === 'same connection'
+          ? db
+          : openProfileStateDatabase(databasePath, 'profile-a').db
+      if (writer !== db) {
+        databases.push(writer)
+      }
+      const padding = 'x'.repeat(256_000)
+      importProfileStateJson(
+        db,
+        JSON.stringify({ settings: { value: 1 }, ui: { value: 1 }, padding })
+      )
+      const nextJson = JSON.stringify({ settings: { value: 2 }, ui: { value: 2 }, padding })
+      const nativeBackup = db.backup.bind(db)
+      let wroteDuringBackup = false
+      vi.spyOn(db, 'backup').mockImplementation((path) =>
+        nativeBackup(path, {
+          rate: 1,
+          progress: ({ remainingPages }) => {
+            if (remainingPages > 0 && !wroteDuringBackup) {
+              wroteDuringBackup = true
+              importProfileStateJson(writer, nextJson)
+            }
+          }
+        })
+      )
+
+      await writeProfileStateDatabaseSnapshotAsync(db, targetPath)
+
+      expect(wroteDuringBackup).toBe(true)
+      expect(readSnapshot(targetPath)).toBe(nextJson)
+      expect(exportProfileStateJson(db)).toBe(nextJson)
+      expectNoTemporaryFiles(directory)
+    }
+  )
+
+  it('preserves the previous destination and removes staging after native backup fails', async () => {
+    const { directory, db, targetPath, originalJson } = fixture()
+    await writeProfileStateDatabaseSnapshotAsync(db, targetPath)
+    const previous = readFileSync(targetPath)
+    vi.spyOn(db, 'backup').mockImplementation(async (path) => {
+      writeFileSync(path, 'incomplete backup')
+      writeFileSync(`${path}-journal`, 'incomplete journal')
+      throw new Error('injected native backup failure')
+    })
+
+    await expect(writeProfileStateDatabaseSnapshotAsync(db, targetPath)).rejects.toThrow(
+      'injected native backup failure'
+    )
+
+    expect(readFileSync(targetPath)).toEqual(previous)
+    expect(exportProfileStateJson(db)).toBe(originalJson)
+    expectNoTemporaryFiles(directory)
+  })
+
+  it('validates staged content before replacing the previous destination', async () => {
+    const { directory, db, targetPath } = fixture()
+    writeFileSync(targetPath, 'previous recovery artifact')
+
+    await expect(
+      writeProfileStateDatabaseSnapshotAsync(db, targetPath, {
+        validateStagedSnapshot: () => {
+          throw new Error('staged validation failed')
+        }
+      })
+    ).rejects.toThrow('staged validation failed')
+
+    expect(readFileSync(targetPath, 'utf8')).toBe('previous recovery artifact')
+    expectNoTemporaryFiles(directory)
+  })
+
+  it('preserves the previous destination when publication fails', async () => {
+    const { directory, db, targetPath } = fixture()
+    await writeProfileStateDatabaseSnapshotAsync(db, targetPath)
+    const previous = readFileSync(targetPath)
+    importProfileStateJson(db, JSON.stringify({ settings: { theme: 'dark' } }))
+    vi.spyOn(durableFileWrite, 'renameDurable').mockRejectedValue(
+      new Error('injected rename failure')
+    )
+
+    await expect(writeProfileStateDatabaseSnapshotAsync(db, targetPath)).rejects.toThrow(
+      'injected rename failure'
+    )
+
+    expect(readFileSync(targetPath)).toEqual(previous)
+    expectNoTemporaryFiles(directory)
+  })
+
+  it('rejects active transactions without publishing uncommitted state', async () => {
+    const { directory, db, targetPath, originalJson } = fixture()
+    await writeProfileStateDatabaseSnapshotAsync(db, targetPath)
+    const previous = readFileSync(targetPath)
+    db.exec('BEGIN IMMEDIATE')
+    try {
+      db.exec("UPDATE profile_state_documents SET payload = '{}' WHERE domain = 'settings'")
+      await expect(writeProfileStateDatabaseSnapshotAsync(db, targetPath)).rejects.toThrow(
+        'idle database connection'
+      )
+    } finally {
+      db.exec('ROLLBACK')
+    }
+
+    expect(readFileSync(targetPath)).toEqual(previous)
+    expect(exportProfileStateJson(db)).toBe(originalJson)
+    expectNoTemporaryFiles(directory)
+  })
+
+  it('checks again if a transaction starts while the backup is staging', async () => {
+    const { directory, db, targetPath } = fixture()
+    const nativeBackup = db.backup.bind(db)
+    vi.spyOn(db, 'backup').mockImplementation((path) => {
+      db.exec('BEGIN IMMEDIATE')
+      return nativeBackup(path)
+    })
+    try {
+      await expect(writeProfileStateDatabaseSnapshotAsync(db, targetPath)).rejects.toThrow(
+        'idle database connection'
+      )
+    } finally {
+      db.exec('ROLLBACK')
+    }
+    expect(existsSync(targetPath)).toBe(false)
+    expectNoTemporaryFiles(directory)
+  })
+
+  it('leaves the previous destination intact when the staged file cannot be fsynced', async () => {
+    const { directory, db, targetPath } = fixture()
+    writeFileSync(targetPath, 'previous recovery artifact')
+    const nativeOpen = fsPromises.open
+    vi.spyOn(fsPromises, 'open').mockImplementation(async (...args) => {
+      const file = await nativeOpen(...args)
+      if (args[1] === 'r+') {
+        vi.spyOn(file, 'sync').mockRejectedValue(new Error('injected fsync failure'))
+      }
+      return file
+    })
+
+    await expect(writeProfileStateDatabaseSnapshotAsync(db, targetPath)).rejects.toThrow(
+      'injected fsync failure'
+    )
+
+    expect(readFileSync(targetPath, 'utf8')).toBe('previous recovery artifact')
+    expectNoTemporaryFiles(directory)
+  })
+
+  it.skipIf(!!process.versions.bun)(
+    'fails clearly when native backup is unsupported without replacing the destination',
+    async () => {
+      const { directory, db, targetPath } = fixture()
+      writeFileSync(targetPath, 'previous recovery artifact')
+      const getBuiltinModule = process.getBuiltinModule.bind(process)
+      vi.spyOn(process, 'getBuiltinModule').mockImplementation((id) =>
+        id === 'node:sqlite' ? {} : getBuiltinModule(id)
+      )
+
+      await expect(writeProfileStateDatabaseSnapshotAsync(db, targetPath)).rejects.toThrow(
+        'Asynchronous SQLite backup is unavailable'
+      )
+
+      expect(readFileSync(targetPath, 'utf8')).toBe('previous recovery artifact')
+      expectNoTemporaryFiles(directory)
+    }
+  )
+
+  it.each(['', 'invalid\0path'])('rejects the invalid target %j', async (path) => {
+    const { db } = fixture()
+    await expect(writeProfileStateDatabaseSnapshotAsync(db, path)).rejects.toThrow(
+      'snapshot path is invalid'
+    )
+  })
+
+  it.each(['', '-wal', '-shm', '-journal'])(
+    'refuses to replace the source database%s',
+    async (suffix) => {
+      const { databasePath, db, originalJson } = fixture()
+      await expect(
+        writeProfileStateDatabaseSnapshotAsync(db, `${databasePath}${suffix}`)
+      ).rejects.toThrow('cannot replace a source database')
+      expect(exportProfileStateJson(db)).toBe(originalJson)
+    }
+  )
+
+  it('rejects a source database reached through a directory alias', async () => {
+    const { directory, db, originalJson } = fixture()
+    const alias = join(directory, 'alias')
+    symlinkSync(directory, alias, 'junction')
+    await expect(
+      writeProfileStateDatabaseSnapshotAsync(db, join(alias, 'profile-state.db'))
+    ).rejects.toThrow('cannot replace a source database')
+    expect(exportProfileStateJson(db)).toBe(originalJson)
+  })
+
+  it.for(['', '-WAL', '-SHM', '-JOURNAL'])(
+    'refuses source database%s case aliases on case-insensitive filesystems',
+    async (suffix, { skip }) => {
+      const { directory, db, originalJson } = fixture()
+      const alias = join(directory, 'PROFILE-STATE.DB')
+      if (!existsSync(alias)) {
+        skip()
+        return
+      }
+      await expect(writeProfileStateDatabaseSnapshotAsync(db, `${alias}${suffix}`)).rejects.toThrow(
+        'cannot replace a source database'
+      )
+      expect(exportProfileStateJson(db)).toBe(originalJson)
+    }
+  )
+
+  it.each(['-wal', '-shm', '-journal'])(
+    'preserves a destination with an existing %s sidecar',
+    async (suffix) => {
+      const { directory, db, targetPath } = fixture()
+      writeFileSync(targetPath, 'previous recovery artifact')
+      writeFileSync(`${targetPath}${suffix}`, 'retained SQLite sidecar')
+
+      await expect(writeProfileStateDatabaseSnapshotAsync(db, targetPath)).rejects.toThrow(
+        'destination has SQLite sidecars'
+      )
+
+      expect(readFileSync(targetPath, 'utf8')).toBe('previous recovery artifact')
+      expect(readFileSync(`${targetPath}${suffix}`, 'utf8')).toBe('retained SQLite sidecar')
+      expectNoTemporaryFiles(directory)
+    }
+  )
+})
diff --git a/src/main/persistence/profile-state/profile-state-database-snapshot.ts b/src/main/persistence/profile-state/profile-state-database-snapshot.ts
new file mode 100644
index 000000000000..9cc89d58b59c
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-database-snapshot.ts
@@ -0,0 +1,123 @@
+import { profileStateDatabaseFiles } from './profile-state-storage-classification'
+import { access, mkdir, open, realpath, rm, stat } from 'node:fs/promises'
+import { basename, dirname, resolve } from 'node:path'
+import Database from '../../sqlite/sync-database'
+import { hardenSqliteDatabaseFiles } from '../../sqlite/harden-database-files'
+import { durableWriteTempPath, renameDurable } from '../../durable-file-write'
+
+/** The caller owns the destination and keeps the source open until this backup settles. */
+export async function writeProfileStateDatabaseSnapshotAsync(
+  db: Database.Database,
+  targetPath: string,
+  options: {
+    temporaryPath?: string
+    validateStagedSnapshot?: (stagingPath: string) => Promise<void> | void
+  } = {}
+): Promise<void> {
+  if (targetPath.length === 0 || targetPath.includes('\0')) {
+    throw new Error('Profile state snapshot path is invalid')
+  }
+  if (db.isTransaction) {
+    throw new Error('Profile state database snapshot requires an idle database connection')
+  }
+  await mkdir(dirname(targetPath), { recursive: true })
+  await assertSnapshotTargetIsSeparate(db, targetPath)
+  await assertNoSnapshotSidecars(targetPath)
+  const temporaryPath = options.temporaryPath ?? durableWriteTempPath(targetPath)
+  let published = false
+  let created = false
+  try {
+    // Pre-create privately: the native backup otherwise creates a world-readable temporary file.
+    const temporary = await open(temporaryPath, 'wx', 0o600)
+    created = true
+    await temporary.close()
+    await db.backup(temporaryPath)
+    // The native copy preserves WAL mode; snapshots must not create sidecars when opened read-only.
+    const snapshot = new Database(temporaryPath, { fileMustExist: true })
+    try {
+      if (snapshot.pragma('journal_mode = DELETE', { simple: true }) !== 'delete') {
+        throw new Error('Profile state snapshot could not become a self-contained database')
+      }
+    } finally {
+      snapshot.close()
+    }
+    hardenSqliteDatabaseFiles(temporaryPath)
+    const completed = await open(temporaryPath, 'r+')
+    try {
+      await completed.sync()
+    } finally {
+      await completed.close()
+    }
+    await options.validateStagedSnapshot?.(temporaryPath)
+    await assertNoSnapshotSidecars(targetPath)
+    await renameDurable(temporaryPath, targetPath)
+    published = true
+  } finally {
+    if (created && !published) {
+      await rm(temporaryPath, { force: true })
+    }
+    if (created) {
+      await Promise.all(
+        ['-wal', '-shm', '-journal'].map((suffix) =>
+          rm(`${temporaryPath}${suffix}`, { force: true })
+        )
+      )
+    }
+  }
+}
+
+async function assertSnapshotTargetIsSeparate(
+  db: Database.Database,
+  targetPath: string
+): Promise<void> {
+  const target = await realpath(targetPath).catch(async (error: unknown) => {
+    if (!isMissingPath(error)) {
+      throw error
+    }
+    return resolve(await realpath(dirname(targetPath)), basename(targetPath))
+  })
+  const databases = db.prepare('PRAGMA database_list').all()
+  for (const database of databases) {
+    if (typeof database.file !== 'string' || database.file.length === 0) {
+      continue
+    }
+    const source = await realpath(database.file)
+    if (profileStateDatabaseFiles(source).includes(target)) {
+      throw new Error('Profile state snapshot cannot replace a source database or its sidecars')
+    }
+    // realpath preserves case aliases on macOS; file identity also protects absent sidecar names.
+    const sourceInfo = await stat(source, { bigint: true })
+    for (const candidate of new Set([target, target.replace(/-(?:wal|shm|journal)$/i, '')])) {
+      const targetInfo = await stat(candidate, { bigint: true }).catch((error: unknown) => {
+        if (!isMissingPath(error)) {
+          throw error
+        }
+        return undefined
+      })
+      if (targetInfo?.dev === sourceInfo.dev && targetInfo.ino === sourceInfo.ino) {
+        throw new Error('Profile state snapshot cannot replace a source database or its sidecars')
+      }
+    }
+  }
+}
+
+async function assertNoSnapshotSidecars(targetPath: string): Promise<void> {
+  for (const suffix of ['-wal', '-shm', '-journal']) {
+    const exists = await access(`${targetPath}${suffix}`).then(
+      () => true,
+      (error: unknown) => {
+        if (!isMissingPath(error)) {
+          throw error
+        }
+        return false
+      }
+    )
+    if (exists) {
+      throw new Error('Profile state snapshot destination has SQLite sidecars')
+    }
+  }
+}
+
+function isMissingPath(error: unknown): boolean {
+  return error instanceof Error && 'code' in error && error.code === 'ENOENT'
+}
diff --git a/src/main/persistence/profile-state/profile-state-database-validation.ts b/src/main/persistence/profile-state/profile-state-database-validation.ts
new file mode 100644
index 000000000000..3bd744219659
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-database-validation.ts
@@ -0,0 +1,146 @@
+import { withProfileStateReadSnapshot } from './profile-state-read-snapshot'
+import type Database from '../../sqlite/sync-database'
+import { readCurrentAutomationRunsState } from './profile-state-automation-runs-storage'
+import { readProfileStateRevision } from './profile-state-revision'
+import {
+  PROFILE_STATE_META_PROFILE_ID,
+  PROFILE_STATE_DATABASE_SCHEMA_VERSION
+} from './profile-state-database-schema'
+import {
+  PROFILE_STATE_AUTOMATION_RUNS_META_TABLE,
+  PROFILE_STATE_AUTOMATION_RUNS_TABLE
+} from './profile-state-automation-runs'
+import { ProfileStateDatabaseOpenError } from './profile-state-database-errors'
+
+export function verifyProfileStateSchema(
+  db: Database.Database,
+  profileId: string,
+  schemaVersion = PROFILE_STATE_DATABASE_SCHEMA_VERSION
+): void {
+  withProfileStateReadSnapshot(db, () => {
+    const tables = profileStateTableNames(db)
+    if (
+      !tables.has('profile_state_meta') ||
+      !tables.has('profile_state_documents') ||
+      (schemaVersion >= 2 &&
+        (!tables.has(PROFILE_STATE_AUTOMATION_RUNS_META_TABLE) ||
+          !tables.has(PROFILE_STATE_AUTOMATION_RUNS_TABLE)))
+    ) {
+      throw new Error('Profile state database schema is incomplete')
+    }
+
+    verifyProfileStateColumns(db, 'profile_state_meta', {
+      key: { type: 'TEXT', notNull: true, primaryKey: true },
+      value: { type: 'TEXT', notNull: true, primaryKey: false }
+    })
+    verifyProfileStateColumns(db, 'profile_state_documents', {
+      domain: { type: 'TEXT', notNull: true, primaryKey: true },
+      payload: { type: 'TEXT', notNull: true, primaryKey: false },
+      domain_version: { type: 'INTEGER', notNull: true, primaryKey: false },
+      revision: { type: 'INTEGER', notNull: true, primaryKey: false },
+      updated_at: { type: 'INTEGER', notNull: true, primaryKey: false },
+      content_hash: { type: 'TEXT', notNull: true, primaryKey: false }
+    })
+    if (schemaVersion >= 2) {
+      verifyProfileStateColumns(db, PROFILE_STATE_AUTOMATION_RUNS_META_TABLE, {
+        domain: { type: 'TEXT', notNull: true, primaryKey: true },
+        presence: { type: 'TEXT', notNull: true, primaryKey: false },
+        domain_version: { type: 'INTEGER', notNull: true, primaryKey: false },
+        revision: { type: 'INTEGER', notNull: true, primaryKey: false },
+        updated_at: { type: 'INTEGER', notNull: true, primaryKey: false },
+        content_hash: { type: 'TEXT', notNull: true, primaryKey: false }
+      })
+      verifyProfileStateColumns(db, PROFILE_STATE_AUTOMATION_RUNS_TABLE, {
+        run_id: { type: 'TEXT', notNull: true, primaryKey: true },
+        ordinal: { type: 'INTEGER', notNull: true, primaryKey: false },
+        payload: { type: 'TEXT', notNull: true, primaryKey: false },
+        content_hash: { type: 'TEXT', notNull: true, primaryKey: false },
+        revision: { type: 'INTEGER', notNull: true, primaryKey: false },
+        updated_at: { type: 'INTEGER', notNull: true, primaryKey: false }
+      })
+    }
+
+    verifyProfileStateIdentity(db, profileId)
+    if (schemaVersion >= 3) {
+      readCurrentAutomationRunsState(db, readProfileStateRevision(db))
+    }
+  })
+}
+
+export function verifyEmptyProfileStateSchema(db: Database.Database): void {
+  if (profileStateTableNames(db).size > 0) {
+    throw new Error('Profile state database has an unexpected version-0 schema')
+  }
+}
+
+function verifyProfileStateColumns(
+  db: Database.Database,
+  table: string,
+  expected: Readonly<Record<string, { type: string; notNull: boolean; primaryKey: boolean }>>
+): void {
+  const rows = db.pragma(`table_info(${table})`)
+  if (!Array.isArray(rows)) {
+    throw new Error(`Profile state table has no readable columns: ${table}`)
+  }
+  const columns = new Map<string, { type: string; notNull: boolean; primaryKey: boolean }>()
+  for (const row of rows) {
+    if (
+      !isRecord(row) ||
+      typeof row.name !== 'string' ||
+      typeof row.type !== 'string' ||
+      typeof row.notnull !== 'number' ||
+      typeof row.pk !== 'number'
+    ) {
+      throw new Error(`Profile state table has malformed column metadata: ${table}`)
+    }
+    columns.set(row.name, {
+      type: row.type.toUpperCase(),
+      notNull: row.notnull === 1,
+      primaryKey: row.pk === 1
+    })
+  }
+  for (const [name, definition] of Object.entries(expected)) {
+    const actual = columns.get(name)
+    if (
+      actual === undefined ||
+      actual.type !== definition.type ||
+      actual.notNull !== definition.notNull ||
+      actual.primaryKey !== definition.primaryKey
+    ) {
+      throw new Error(`Profile state table has an incompatible column: ${table}.${name}`)
+    }
+  }
+}
+
+function profileStateTableNames(db: Database.Database): Set<string> {
+  return new Set(
+    db
+      .prepare("SELECT name FROM sqlite_master WHERE type = 'table'")
+      .all()
+      .map((row) => (isRecord(row) && typeof row.name === 'string' ? row.name : undefined))
+      .filter((name): name is string => name !== undefined)
+  )
+}
+
+function verifyProfileStateIdentity(db: Database.Database, profileId: string): void {
+  const storedProfileIdRow = db
+    .prepare('SELECT value FROM profile_state_meta WHERE key = ?')
+    .get(PROFILE_STATE_META_PROFILE_ID)
+  const storedProfileId =
+    isRecord(storedProfileIdRow) && typeof storedProfileIdRow.value === 'string'
+      ? storedProfileIdRow.value
+      : undefined
+  if (storedProfileId === undefined) {
+    throw new Error('Profile state database is missing its profile identity')
+  }
+  if (storedProfileId !== profileId) {
+    throw new ProfileStateDatabaseOpenError(
+      'identity-mismatch',
+      'Profile state database belongs to a different profile'
+    )
+  }
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value)
+}
diff --git a/src/main/persistence/profile-state/profile-state-database.test.ts b/src/main/persistence/profile-state/profile-state-database.test.ts
new file mode 100644
index 000000000000..c3cb63fb114e
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-database.test.ts
@@ -0,0 +1,339 @@
+import { mkdtempSync, readFileSync, rmSync, statSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it } from 'vitest'
+import Database from '../../sqlite/sync-database'
+import {
+  openProfileStateDatabase,
+  openProfileStateDatabaseReadOnly,
+  profileStateDatabaseFile,
+  profileStatePragmaNumber,
+  PROFILE_STATE_BUSY_TIMEOUT_MS,
+  PROFILE_STATE_DATABASE_FILE_NAME
+} from './profile-state-database'
+import { PROFILE_STATE_DATABASE_SCHEMA_VERSION } from './profile-state-database-schema'
+import { importProfileStateJson } from './profile-state-documents'
+import { quarantineProfileStateDatabase } from './profile-state-database-quarantine'
+
+const temporaryDirectories: string[] = []
+
+afterEach(() => {
+  for (const directory of temporaryDirectories.splice(0)) {
+    rmSync(directory, { recursive: true, force: true })
+  }
+})
+
+function createDirectory(): string {
+  const directory = mkdtempSync(join(tmpdir(), 'orca-profile-state-db-'))
+  temporaryDirectories.push(directory)
+  return directory
+}
+
+describe('profile state database', () => {
+  it('creates an isolated per-profile schema with durable pragmas', () => {
+    const directory = createDirectory()
+    const dbPath = profileStateDatabaseFile(directory)
+    const opened = openProfileStateDatabase(dbPath, 'profile-a')
+    try {
+      expect(dbPath).toBe(join(directory, PROFILE_STATE_DATABASE_FILE_NAME))
+      expect(opened.readOnly).toBe(false)
+      expect(opened.profileId).toBe('profile-a')
+      expect(profileStatePragmaNumber(opened.db, 'user_version')).toBe(
+        PROFILE_STATE_DATABASE_SCHEMA_VERSION
+      )
+      expect(opened.db.pragma('journal_mode', { simple: true })).toBe('wal')
+      expect(profileStatePragmaNumber(opened.db, 'synchronous')).toBe(2)
+      expect(profileStatePragmaNumber(opened.db, 'busy_timeout')).toBe(
+        PROFILE_STATE_BUSY_TIMEOUT_MS
+      )
+      expect(profileStatePragmaNumber(opened.db, 'foreign_keys')).toBe(1)
+      expect(
+        opened.db.prepare("SELECT name FROM sqlite_master WHERE type = 'table' ORDER BY name").all()
+      ).toEqual([
+        { name: 'profile_state_automation_runs' },
+        { name: 'profile_state_automation_runs_meta' },
+        { name: 'profile_state_documents' },
+        { name: 'profile_state_meta' }
+      ])
+      expect(
+        opened.db.prepare('SELECT value FROM profile_state_meta WHERE key = ?').get('profile_id')
+      ).toEqual({ value: 'profile-a' })
+    } finally {
+      opened.db.close()
+    }
+  })
+
+  it('migrates the version-1 document schema by adding normalized run tables', () => {
+    const directory = createDirectory()
+    const dbPath = profileStateDatabaseFile(directory)
+    const seeded = new Database(dbPath)
+    seeded.exec(`
+      PRAGMA user_version = 1;
+      CREATE TABLE profile_state_meta (key TEXT PRIMARY KEY NOT NULL, value TEXT NOT NULL);
+      CREATE TABLE profile_state_documents (
+        domain TEXT PRIMARY KEY NOT NULL,
+        payload TEXT NOT NULL,
+        domain_version INTEGER NOT NULL,
+        revision INTEGER NOT NULL,
+        updated_at INTEGER NOT NULL,
+        content_hash TEXT NOT NULL
+      );
+      INSERT INTO profile_state_meta (key, value) VALUES ('profile_id', 'profile-a');
+      INSERT INTO profile_state_meta (key, value) VALUES ('revision', '1');
+      INSERT INTO profile_state_documents
+        (domain, payload, domain_version, revision, updated_at, content_hash)
+      VALUES ('settings', '{"theme":"dark"}', 1, 1, 100, '0f4f87db4567232a7f1756aa1534ec1314777b39c3bf5209f87cf9739321cddc');
+    `)
+    seeded.close()
+
+    const opened = openProfileStateDatabase(dbPath, 'profile-a')
+    try {
+      expect(profileStatePragmaNumber(opened.db, 'user_version')).toBe(
+        PROFILE_STATE_DATABASE_SCHEMA_VERSION
+      )
+      expect(
+        opened.db.prepare("SELECT name FROM sqlite_master WHERE type = 'table' ORDER BY name").all()
+      ).toEqual([
+        { name: 'profile_state_automation_runs' },
+        { name: 'profile_state_automation_runs_meta' },
+        { name: 'profile_state_documents' },
+        { name: 'profile_state_meta' }
+      ])
+      expect(
+        opened.db
+          .prepare('SELECT payload FROM profile_state_documents WHERE domain = ?')
+          .get('settings')
+      ).toEqual({ payload: '{"theme":"dark"}' })
+    } finally {
+      opened.db.close()
+    }
+  })
+
+  it('validates normalized tables created during migration', () => {
+    const directory = createDirectory()
+    const dbPath = profileStateDatabaseFile(directory)
+    const seeded = new Database(dbPath)
+    seeded.exec(`
+      PRAGMA user_version = 1;
+      CREATE TABLE profile_state_meta (key TEXT PRIMARY KEY NOT NULL, value TEXT NOT NULL);
+      CREATE TABLE profile_state_documents (
+        domain TEXT PRIMARY KEY NOT NULL,
+        payload TEXT NOT NULL,
+        domain_version INTEGER NOT NULL,
+        revision INTEGER NOT NULL,
+        updated_at INTEGER NOT NULL,
+        content_hash TEXT NOT NULL
+      );
+      CREATE TABLE profile_state_automation_runs (
+        run_id TEXT PRIMARY KEY NOT NULL,
+        ordinal INTEGER NOT NULL,
+        payload BLOB NOT NULL,
+        content_hash TEXT NOT NULL,
+        revision INTEGER NOT NULL,
+        updated_at INTEGER NOT NULL
+      );
+      INSERT INTO profile_state_meta (key, value) VALUES ('profile_id', 'profile-a');
+    `)
+    seeded.close()
+
+    expect(() => openProfileStateDatabase(dbPath, 'profile-a')).toThrowError(
+      expect.objectContaining({ code: 'unreadable' })
+    )
+  })
+
+  it('latches a future schema read-only without changing the database file', () => {
+    const directory = createDirectory()
+    const dbPath = profileStateDatabaseFile(directory)
+    const seeded = openProfileStateDatabase(dbPath, 'profile-a')
+    seeded.db.pragma(`user_version = ${PROFILE_STATE_DATABASE_SCHEMA_VERSION + 9}`)
+    seeded.db.close()
+    const before = statSync(dbPath)
+    const beforeBytes = readFileSync(dbPath)
+
+    const opened = openProfileStateDatabase(dbPath, 'profile-a')
+    try {
+      expect(opened.readOnly).toBe(true)
+      expect(profileStatePragmaNumber(opened.db, 'user_version')).toBe(
+        PROFILE_STATE_DATABASE_SCHEMA_VERSION + 9
+      )
+      expect(() => opened.db.exec("INSERT INTO profile_state_meta VALUES ('x', 'y')")).toThrow()
+    } finally {
+      opened.db.close()
+    }
+    const after = statSync(dbPath)
+    expect(after.size).toBe(before.size)
+    expect(readFileSync(dbPath)).toEqual(beforeBytes)
+  })
+
+  it('opens the current schema read-only without changing its bytes', () => {
+    const directory = createDirectory()
+    const dbPath = profileStateDatabaseFile(directory)
+    const seeded = openProfileStateDatabase(dbPath, 'profile-a')
+    seeded.db.close()
+    const before = readFileSync(dbPath)
+
+    const opened = openProfileStateDatabaseReadOnly(dbPath, 'profile-a')
+    try {
+      expect(opened.readOnly).toBe(true)
+      expect(() => opened.db.exec("INSERT INTO profile_state_meta VALUES ('x', 'y')")).toThrow()
+    } finally {
+      opened.db.close()
+    }
+    expect(readFileSync(dbPath)).toEqual(before)
+  })
+
+  it('rejects a database whose profile identity does not match', () => {
+    const directory = createDirectory()
+    const dbPath = profileStateDatabaseFile(directory)
+    const opened = openProfileStateDatabase(dbPath, 'profile-a')
+    opened.db.close()
+    const before = readFileSync(dbPath)
+
+    expect(() => openProfileStateDatabase(dbPath, 'profile-b')).toThrowError(
+      expect.objectContaining({ code: 'identity-mismatch' })
+    )
+    expect(readFileSync(dbPath)).toEqual(before)
+  })
+
+  it('rejects malformed database bytes without replacing them', () => {
+    const directory = createDirectory()
+    const dbPath = profileStateDatabaseFile(directory)
+    const bytes = Buffer.from('not a sqlite database')
+    writeFileSync(dbPath, bytes)
+
+    expect(() => openProfileStateDatabase(dbPath, 'profile-a')).toThrowError(
+      expect.objectContaining({ code: 'unreadable' })
+    )
+    expect(readFileSync(dbPath)).toEqual(bytes)
+  })
+
+  it('quarantines the database family without touching live recovery sources', () => {
+    const directory = createDirectory()
+    const dbPath = profileStateDatabaseFile(directory)
+    const opened = openProfileStateDatabase(dbPath, 'profile-a')
+    importProfileStateJson(opened.db, JSON.stringify({ settings: { theme: 'dark' } }))
+    opened.db.close()
+    writeFileSync(`${dbPath}-wal`, 'wal-preservation-sentinel')
+
+    const sourceBytes = new Map(
+      [dbPath, `${dbPath}-wal`].map((path) => [path, readFileSync(path).toString('hex')])
+    )
+    const result = quarantineProfileStateDatabase(
+      dbPath,
+      'profile-a',
+      join(directory, 'quarantine'),
+      'test-corruption'
+    )
+
+    expect(result.copiedFiles).toHaveLength(2)
+    expect(JSON.parse(readFileSync(result.manifestPath, 'utf8'))).toMatchObject({
+      schemaVersion: 1,
+      profileId: 'profile-a',
+      reason: 'test-corruption',
+      sourceFiles: expect.arrayContaining(['', '-wal'])
+    })
+    expect(readFileSync(join(result.directory, 'profile-state.db')).toString('hex')).toBe(
+      sourceBytes.get(dbPath)
+    )
+    expect(readFileSync(join(result.directory, 'profile-state.db-wal')).toString('hex')).toBe(
+      sourceBytes.get(`${dbPath}-wal`)
+    )
+    for (const [path, bytes] of sourceBytes) {
+      expect(readFileSync(path).toString('hex')).toBe(bytes)
+    }
+  })
+
+  it('rejects an unexpected version-0 schema without mutating it', () => {
+    const directory = createDirectory()
+    const dbPath = profileStateDatabaseFile(directory)
+    const seeded = new Database(dbPath)
+    seeded.exec('CREATE TABLE unrelated (value TEXT)')
+    seeded.close()
+    const before = readFileSync(dbPath)
+
+    expect(() => openProfileStateDatabase(dbPath, 'profile-a')).toThrowError(
+      expect.objectContaining({ code: 'unreadable' })
+    )
+    expect(readFileSync(dbPath)).toEqual(before)
+  })
+
+  it('rejects an incomplete current schema without mutating it', () => {
+    const directory = createDirectory()
+    const dbPath = profileStateDatabaseFile(directory)
+    const seeded = openProfileStateDatabase(dbPath, 'profile-a')
+    seeded.db.exec('DROP TABLE profile_state_documents')
+    seeded.db.close()
+    const before = readFileSync(dbPath)
+
+    expect(() => openProfileStateDatabase(dbPath, 'profile-a')).toThrowError(
+      expect.objectContaining({ code: 'unreadable' })
+    )
+    expect(readFileSync(dbPath)).toEqual(before)
+  })
+
+  it('rejects current-version tables with incompatible columns without mutating them', () => {
+    const directory = createDirectory()
+    const dbPath = profileStateDatabaseFile(directory)
+    const seeded = new Database(dbPath)
+    seeded.exec(`
+      PRAGMA user_version = ${PROFILE_STATE_DATABASE_SCHEMA_VERSION};
+      CREATE TABLE profile_state_meta (key TEXT PRIMARY KEY, value TEXT NOT NULL);
+      CREATE TABLE profile_state_documents (
+        domain TEXT PRIMARY KEY,
+        payload BLOB NOT NULL,
+        revision INTEGER NOT NULL
+      );
+    `)
+    seeded.close()
+    const before = readFileSync(dbPath)
+
+    expect(() => openProfileStateDatabase(dbPath, 'profile-a')).toThrowError(
+      expect.objectContaining({ code: 'unreadable' })
+    )
+    expect(readFileSync(dbPath)).toEqual(before)
+  })
+
+  it('does not create an empty database when the parent directory is absent', () => {
+    const directory = createDirectory()
+    const dbPath = join(directory, 'missing', PROFILE_STATE_DATABASE_FILE_NAME)
+
+    expect(() => openProfileStateDatabase(dbPath, 'profile-a')).toThrowError(
+      expect.objectContaining({ code: 'unreadable' })
+    )
+  })
+
+  it('rejects an empty profile identity before opening SQLite', () => {
+    const directory = createDirectory()
+    const dbPath = profileStateDatabaseFile(directory)
+
+    expect(() => openProfileStateDatabase(dbPath, '')).toThrowError(
+      expect.objectContaining({ code: 'invalid-profile-id' })
+    )
+  })
+
+  it('restricts the database and WAL sidecars on POSIX', () => {
+    if (process.platform === 'win32') {
+      return
+    }
+    const directory = createDirectory()
+    const dbPath = profileStateDatabaseFile(directory)
+    const opened = openProfileStateDatabase(dbPath, 'profile-a')
+    opened.db
+      .prepare('INSERT INTO profile_state_documents VALUES (?, ?, ?, ?, ?, ?)')
+      .run('settings', '{}', 1, 1, Date.now(), 'hash')
+    try {
+      for (const path of [dbPath, `${dbPath}-wal`, `${dbPath}-shm`]) {
+        expect(statSync(path).mode & 0o777).toBe(0o600)
+      }
+    } finally {
+      opened.db.close()
+    }
+  })
+})
+
+describe('profile state database does not reuse orchestration state', () => {
+  it('uses a profile-local filename', () => {
+    const directory = createDirectory()
+    expect(profileStateDatabaseFile(directory)).not.toBe(join(directory, 'orchestration.db'))
+  })
+})
diff --git a/src/main/persistence/profile-state/profile-state-database.ts b/src/main/persistence/profile-state/profile-state-database.ts
new file mode 100644
index 000000000000..e09c8c87869c
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-database.ts
@@ -0,0 +1,246 @@
+import { withProfileStateWriteTransaction } from './profile-state-write-transaction'
+import Database, { isSqliteAvailable } from '../../sqlite/sync-database'
+import { migrateAutomationRunsStorage } from './profile-state-automation-runs-migration'
+import { hardenSqliteDatabaseFiles } from '../../sqlite/harden-database-files'
+import {
+  createProfileStateTablesSql,
+  PROFILE_STATE_DATABASE_SCHEMA_VERSION,
+  PROFILE_STATE_META_PROFILE_ID
+} from './profile-state-database-schema'
+import { existsSync, mkdirSync } from 'node:fs'
+import { dirname } from 'node:path'
+import {
+  PROFILE_STATE_DATABASE_FILE_NAME,
+  profileStateDatabaseFile
+} from '../../../shared/profile-state-storage-paths'
+import {
+  ProfileStateDatabaseOpenError,
+  type ProfileStateDatabaseOpenErrorCode
+} from './profile-state-database-errors'
+import {
+  verifyEmptyProfileStateSchema,
+  verifyProfileStateSchema
+} from './profile-state-database-validation'
+
+export const PROFILE_STATE_BUSY_TIMEOUT_MS = 5_000
+
+// Keep relay-only Node 18 imports safe while selecting the actual database driver.
+export const isProfileStateSqliteAvailable = isSqliteAvailable
+
+export { ProfileStateDatabaseOpenError }
+export type { ProfileStateDatabaseOpenErrorCode }
+
+export type OpenProfileStateDatabase = {
+  db: Database.Database
+  readOnly: boolean
+  profileId: string
+}
+
+export { PROFILE_STATE_DATABASE_FILE_NAME, profileStateDatabaseFile }
+
+export function openWritableProfileStateDatabase(
+  databasePath: string,
+  profileId: string
+): OpenProfileStateDatabase {
+  mkdirSync(dirname(databasePath), { recursive: true })
+  const opened = openProfileStateDatabase(databasePath, profileId)
+  if (opened.readOnly) {
+    opened.db.close()
+    throw new ProfileStateDatabaseOpenError(
+      'newer-schema',
+      'This profile requires a newer version of Orca'
+    )
+  }
+  return opened
+}
+
+/**
+ * Open the database belonging to one profile.
+ *
+ * The schema version is read before WAL, busy-timeout, or DDL configuration so
+ * a newer build can leave the database byte-for-byte untouched and read it
+ * without accidentally writing through an unknown schema.
+ */
+export function openProfileStateDatabase(
+  dbPath: string,
+  profileId: string
+): OpenProfileStateDatabase {
+  if (profileId.length === 0) {
+    throw new ProfileStateDatabaseOpenError('invalid-profile-id', 'Profile ID cannot be empty')
+  }
+
+  let probe: Database.Database
+  try {
+    probe = new Database(dbPath)
+  } catch (error) {
+    throw new ProfileStateDatabaseOpenError(
+      'unreadable',
+      `Unable to open profile state database: ${dbPath}`,
+      error
+    )
+  }
+
+  let transferred = false
+  try {
+    const storedVersion = profileStatePragmaNumber(probe, 'user_version')
+    verifyProfileStateIntegrity(probe)
+    if (storedVersion > PROFILE_STATE_DATABASE_SCHEMA_VERSION) {
+      probe.close()
+      transferred = true
+      try {
+        return {
+          db: new Database(dbPath, {
+            readonly: true,
+            fileMustExist: true,
+            timeout: PROFILE_STATE_BUSY_TIMEOUT_MS
+          }),
+          readOnly: true,
+          profileId
+        }
+      } catch (error) {
+        throw new ProfileStateDatabaseOpenError(
+          'unreadable',
+          `Unable to open future profile state database read-only: ${dbPath}`,
+          error
+        )
+      }
+    }
+
+    if (storedVersion > 0) {
+      // Validate the complete current shape before WAL setup. A structurally
+      // valid but incomplete database should fail without changing its header.
+      verifyProfileStateSchema(probe, profileId, storedVersion)
+    } else if (storedVersion === 0) {
+      verifyEmptyProfileStateSchema(probe)
+    } else {
+      throw new Error(`Unsupported profile state database schema: ${storedVersion}`)
+    }
+
+    // The journal-mode pragma can update the SQLite header even when no state
+    // row is written, so all known-shape validation happens before this point.
+    migrateProfileStateSchema(probe, storedVersion, profileId)
+    configureProfileStatePragmas(probe)
+    hardenSqliteDatabaseFiles(dbPath)
+    transferred = true
+    return { db: probe, readOnly: false, profileId }
+  } catch (error) {
+    if (error instanceof ProfileStateDatabaseOpenError) {
+      throw error
+    }
+    throw new ProfileStateDatabaseOpenError(
+      'unreadable',
+      `Unable to initialize profile state database: ${dbPath}`,
+      error
+    )
+  } finally {
+    if (!transferred) {
+      probe.close()
+    }
+  }
+}
+
+/**
+ * Open an existing profile database without applying migrations or changing
+ * its journal mode. Callers use this for best-effort reads during GC, where a
+ * present database is authoritative and any failure must fail closed.
+ */
+export function openProfileStateDatabaseReadOnly(
+  dbPath: string,
+  profileId: string
+): OpenProfileStateDatabase {
+  if (profileId.length === 0) {
+    throw new ProfileStateDatabaseOpenError('invalid-profile-id', 'Profile ID cannot be empty')
+  }
+  if (!existsSync(dbPath)) {
+    throw new ProfileStateDatabaseOpenError(
+      'unreadable',
+      `Profile state database does not exist: ${dbPath}`
+    )
+  }
+
+  let db: Database.Database
+  try {
+    db = new Database(dbPath, {
+      readonly: true,
+      fileMustExist: true,
+      timeout: PROFILE_STATE_BUSY_TIMEOUT_MS
+    })
+  } catch (error) {
+    throw new ProfileStateDatabaseOpenError(
+      'unreadable',
+      `Unable to open profile state database read-only: ${dbPath}`,
+      error
+    )
+  }
+
+  try {
+    const storedVersion = profileStatePragmaNumber(db, 'user_version')
+    verifyProfileStateIntegrity(db)
+    if (storedVersion > PROFILE_STATE_DATABASE_SCHEMA_VERSION) {
+      throw new ProfileStateDatabaseOpenError(
+        'newer-schema',
+        `Profile state database schema is newer than this runtime: ${storedVersion}`
+      )
+    }
+    if (storedVersion !== PROFILE_STATE_DATABASE_SCHEMA_VERSION) {
+      throw new Error(`Unsupported profile state database schema: ${storedVersion}`)
+    }
+    verifyProfileStateSchema(db, profileId)
+    return { db, readOnly: true, profileId }
+  } catch (error) {
+    db.close()
+    if (error instanceof ProfileStateDatabaseOpenError) {
+      throw error
+    }
+    throw new ProfileStateDatabaseOpenError(
+      'unreadable',
+      `Unable to read profile state database: ${dbPath}`,
+      error
+    )
+  }
+}
+
+export function profileStatePragmaNumber(db: Database.Database, name: string): number {
+  return Number(db.pragma(name, { simple: true }) ?? 0)
+}
+
+function verifyProfileStateIntegrity(db: Database.Database): void {
+  const result = db.pragma('quick_check', { simple: true })
+  if (result !== 'ok') {
+    throw new Error(`Profile state database integrity check failed: ${String(result)}`)
+  }
+}
+
+function configureProfileStatePragmas(db: Database.Database): void {
+  const journalMode = db.pragma('journal_mode = WAL', { simple: true })
+  if (typeof journalMode !== 'string' || journalMode.toLowerCase() !== 'wal') {
+    throw new Error(`Profile state database does not support WAL (mode: ${String(journalMode)})`)
+  }
+  db.pragma(`busy_timeout = ${PROFILE_STATE_BUSY_TIMEOUT_MS}`)
+  db.pragma('foreign_keys = ON')
+  // Profile commits are user-visible state. Keep the same power-loss contract
+  // as the current temp-file + fsync writer rather than the orchestration DB's
+  // cache-oriented NORMAL setting.
+  db.pragma('synchronous = FULL')
+}
+
+function migrateProfileStateSchema(
+  db: Database.Database,
+  storedVersion: number,
+  profileId: string
+): void {
+  if (storedVersion >= PROFILE_STATE_DATABASE_SCHEMA_VERSION) {
+    return
+  }
+
+  return withProfileStateWriteTransaction(db, () => {
+    db.exec(createProfileStateTablesSql())
+    db.prepare('INSERT OR IGNORE INTO profile_state_meta (key, value) VALUES (?, ?)').run(
+      PROFILE_STATE_META_PROFILE_ID,
+      profileId
+    )
+    migrateAutomationRunsStorage(db, storedVersion)
+    verifyProfileStateSchema(db, profileId)
+    db.pragma(`user_version = ${PROFILE_STATE_DATABASE_SCHEMA_VERSION}`)
+  })
+}
diff --git a/src/main/persistence/profile-state/profile-state-document-reader.ts b/src/main/persistence/profile-state/profile-state-document-reader.ts
new file mode 100644
index 000000000000..075e4f6dc060
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-document-reader.ts
@@ -0,0 +1,99 @@
+import type Database from '../../sqlite/sync-database'
+import { readProfileStateAutomationRunsDocument } from './profile-state-automation-runs'
+import {
+  assertProfileStateDocumentRevision,
+  readProfileStateRevision
+} from './profile-state-revision'
+import {
+  ProfileStateDocumentCorruptionError,
+  validateProfileStateDocumentRow,
+  type ProfileStateDocument,
+  type ProfileStateParsedDocument,
+  type ProfileStateValidatedDocument
+} from './profile-state-document-validation'
+
+export type ReadProfileStateDocumentsOptions = {
+  /** The profile revision already read by a surrounding snapshot. */
+  profileRevision?: number
+}
+
+/** Read the authoritative rows after checking their hash, shape, and JSON payload. */
+export function readProfileStateDocuments(
+  db: Database.Database,
+  options: ReadProfileStateDocumentsOptions & { representation: 'parsed' }
+): readonly ProfileStateParsedDocument[]
+export function readProfileStateDocuments(
+  db: Database.Database,
+  options?: ReadProfileStateDocumentsOptions
+): readonly ProfileStateDocument[]
+export function readProfileStateDocuments(
+  db: Database.Database,
+  options: ReadProfileStateDocumentsOptions & { representation: 'validated' }
+): void
+export function readProfileStateDocuments(
+  db: Database.Database,
+  options: ReadProfileStateDocumentsOptions & { representation?: 'parsed' | 'validated' } = {}
+):
+  | readonly (ProfileStateDocument | ProfileStateParsedDocument | ProfileStateValidatedDocument)[]
+  | void {
+  const profileRevision = options.profileRevision ?? readProfileStateRevision(db)
+  const normalized =
+    options.representation === 'validated'
+      ? readProfileStateAutomationRunsDocument(db, profileRevision, 'validated')
+      : options.representation === 'parsed'
+        ? readProfileStateAutomationRunsDocument(db, profileRevision, 'parsed')
+        : readProfileStateAutomationRunsDocument(db, profileRevision)
+  const rows = db
+    .prepare(
+      `SELECT domain, payload, domain_version, revision, updated_at, content_hash
+       FROM profile_state_documents ORDER BY rowid`
+    )
+    .iterate()
+  const documents: (
+    | ProfileStateDocument
+    | ProfileStateParsedDocument
+    | ProfileStateValidatedDocument
+  )[] = []
+  for (const row of rows) {
+    const document = validateProfileStateDocumentRow(row, {
+      retainParsedValue: options.representation === 'parsed'
+    })
+    assertProfileStateDocumentRevision(document.revision, profileRevision, document.domain)
+    if (
+      normalized !== undefined &&
+      document.domain === 'automationRuns' &&
+      document.payload !== 'null'
+    ) {
+      throw new ProfileStateDocumentCorruptionError(
+        'Normalized automationRuns placeholder is invalid',
+        document.domain
+      )
+    }
+    if (options.representation === 'validated') {
+      continue
+    }
+    if (options.representation === 'parsed') {
+      const { payload: _payload, ...parsedDocument } = document
+      documents.push({ ...parsedDocument, value: document.value })
+    } else {
+      documents.push(document)
+    }
+  }
+  if (options.representation === 'validated') {
+    return
+  }
+  if (normalized === undefined) {
+    return documents
+  }
+  const withoutAutomationRuns = documents.filter((document) => document.domain !== 'automationRuns')
+  if (normalized === null) {
+    return withoutAutomationRuns
+  }
+  const originalIndex = documents.findIndex((document) => document.domain === 'automationRuns')
+  withoutAutomationRuns.splice(
+    originalIndex === -1 ? withoutAutomationRuns.length : originalIndex,
+    0,
+    normalized
+  )
+  return withoutAutomationRuns
+}
diff --git a/src/main/persistence/profile-state/profile-state-document-validation.ts b/src/main/persistence/profile-state/profile-state-document-validation.ts
new file mode 100644
index 000000000000..526383539219
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-document-validation.ts
@@ -0,0 +1,117 @@
+import { createHash } from 'node:crypto'
+
+export type ProfileStateDocument = {
+  domain: string
+  payload: string
+  domainVersion: number
+  revision: number
+  updatedAt: number
+  contentHash: string
+}
+
+export type ProfileStateValidatedDocument = Omit<ProfileStateDocument, 'payload'>
+export type ProfileStateParsedDocument = ProfileStateValidatedDocument & { value: unknown }
+
+export class ProfileStateDocumentCorruptionError extends Error {
+  readonly code = 'corrupt-document' as const
+  readonly domain: string | null
+
+  constructor(message: string, domain: string | null = null) {
+    super(message)
+    this.name = 'ProfileStateDocumentCorruptionError'
+    this.domain = domain
+  }
+}
+
+export class ProfileStateRevisionConflictError extends Error {
+  readonly code = 'profile-state-revision-conflict' as const
+  readonly expectedRevision: number
+  readonly actualRevision: number
+
+  constructor(expectedRevision: number, actualRevision: number) {
+    super(
+      `Profile state revision changed while importing a document (expected ${expectedRevision}, found ${actualRevision})`
+    )
+    this.name = 'ProfileStateRevisionConflictError'
+    this.expectedRevision = expectedRevision
+    this.actualRevision = actualRevision
+  }
+}
+
+export function hashProfileStatePayload(payload: string): string {
+  return createHash('sha256').update(payload, 'utf8').digest('hex')
+}
+
+export function parseProfileStateRoot(rawJson: string): Record<string, unknown> {
+  let parsed: unknown
+  try {
+    parsed = JSON.parse(rawJson)
+  } catch {
+    throw new ProfileStateDocumentCorruptionError('Profile state JSON is invalid', null)
+  }
+  if (!isRecord(parsed)) {
+    throw new ProfileStateDocumentCorruptionError('Profile state JSON root must be an object', null)
+  }
+  return parsed
+}
+
+export function validateProfileStateDocumentRow(
+  row: unknown,
+  options: { validateJson?: boolean; retainParsedValue?: boolean } = {}
+): ProfileStateDocument & { value?: unknown } {
+  if (
+    !isRecord(row) ||
+    typeof row.domain !== 'string' ||
+    typeof row.payload !== 'string' ||
+    typeof row.domain_version !== 'number' ||
+    typeof row.revision !== 'number' ||
+    typeof row.updated_at !== 'number' ||
+    typeof row.content_hash !== 'string'
+  ) {
+    throw new ProfileStateDocumentCorruptionError('Profile state document row has invalid fields')
+  }
+  if (
+    !Number.isSafeInteger(row.domain_version) ||
+    row.domain_version < 1 ||
+    !Number.isSafeInteger(row.revision) ||
+    row.revision < 1 ||
+    !Number.isSafeInteger(row.updated_at) ||
+    row.updated_at < 0 ||
+    !/^[a-f0-9]{64}$/.test(row.content_hash)
+  ) {
+    throw new ProfileStateDocumentCorruptionError(
+      `Profile state document row metadata is invalid: ${row.domain}`,
+      row.domain
+    )
+  }
+  if (hashProfileStatePayload(row.payload) !== row.content_hash) {
+    throw new ProfileStateDocumentCorruptionError(
+      `Profile state document hash mismatch: ${row.domain}`,
+      row.domain
+    )
+  }
+  let value: unknown
+  if (options.retainParsedValue || (options.validateJson ?? true)) {
+    try {
+      value = JSON.parse(row.payload)
+    } catch {
+      throw new ProfileStateDocumentCorruptionError(
+        `Profile state document payload is invalid JSON: ${row.domain}`,
+        row.domain
+      )
+    }
+  }
+  return {
+    domain: row.domain,
+    payload: row.payload,
+    domainVersion: row.domain_version,
+    revision: row.revision,
+    updatedAt: row.updated_at,
+    contentHash: row.content_hash,
+    ...(options.retainParsedValue ? { value } : {})
+  }
+}
+
+export function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value)
+}
diff --git a/src/main/persistence/profile-state/profile-state-documents.test.ts b/src/main/persistence/profile-state/profile-state-documents.test.ts
new file mode 100644
index 000000000000..1afdae3d60c0
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-documents.test.ts
@@ -0,0 +1,370 @@
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it } from 'vitest'
+import {
+  buildProfileStateCutoverFixture,
+  canonicalProfileStateJson
+} from '../profile-state-cutover-fixture'
+import {
+  exportProfileStateJson,
+  hashProfileStateJson,
+  importProfileStateJson,
+  readProfileStateJsonAcceptance,
+  readProfileStateDocuments,
+  readProfileStateRevision,
+  readProfileStateSnapshot,
+  readProfileStateParsedSnapshot
+} from './profile-state-documents'
+import { openProfileStateDatabase, profileStateDatabaseFile } from './profile-state-database'
+import { readProfileStateDomains } from './profile-state-domain-reader'
+import { writeProfileStateDomain } from './profile-state-domain-writes'
+import { ProfileStateSqliteAuthority } from './profile-state-sqlite-authority'
+
+const temporaryDirectories: string[] = []
+
+afterEach(() => {
+  for (const directory of temporaryDirectories.splice(0)) {
+    rmSync(directory, { recursive: true, force: true })
+  }
+})
+
+function openTestDatabase(): {
+  directory: string
+  db: ReturnType<typeof openProfileStateDatabase>['db']
+} {
+  const directory = mkdtempSync(join(tmpdir(), 'orca-profile-state-documents-'))
+  temporaryDirectories.push(directory)
+  return {
+    directory,
+    db: openProfileStateDatabase(profileStateDatabaseFile(directory), 'profile-a').db
+  }
+}
+
+describe('profile state document adapter', () => {
+  it('round-trips every top-level domain, including unknown keys, nulls, arrays, and sealed bytes', () => {
+    const { db } = openTestDatabase()
+    try {
+      const fixture = buildProfileStateCutoverFixture()
+      const raw = JSON.stringify(fixture)
+      expect(importProfileStateJson(db, raw, { now: () => 123 })).toBe(1)
+      const exported = exportProfileStateJson(db)
+
+      expect(canonicalProfileStateJson(JSON.parse(exported))).toBe(
+        canonicalProfileStateJson(fixture)
+      )
+      expect(JSON.parse(exported).settings.opencodeSessionCookie).toBe(
+        fixture.settings.opencodeSessionCookie
+      )
+      expect(readProfileStateRevision(db)).toBe(1)
+      expect(readProfileStateDocuments(db)).toHaveLength(Object.keys(fixture).length)
+      expect(readProfileStateDocuments(db).find((row) => row.domain === 'settings')).toMatchObject({
+        revision: 1,
+        updatedAt: 123
+      })
+    } finally {
+      db.close()
+    }
+  })
+
+  it('preserves missing domains versus explicit null values and array order', () => {
+    const { db } = openTestDatabase()
+    try {
+      importProfileStateJson(
+        db,
+        JSON.stringify({
+          explicitNull: null,
+          ordered: ['first', 'second'],
+          unknown: { keep: true }
+        })
+      )
+      const exported = JSON.parse(exportProfileStateJson(db))
+      expect(exported).toEqual({
+        explicitNull: null,
+        ordered: ['first', 'second'],
+        unknown: { keep: true }
+      })
+      expect(Object.hasOwn(exported, 'missing')).toBe(false)
+    } finally {
+      db.close()
+    }
+  })
+
+  it('advances revision and replaces the complete document set atomically', () => {
+    const { db } = openTestDatabase()
+    try {
+      expect(importProfileStateJson(db, JSON.stringify({ first: 1, old: 2 }))).toBe(1)
+      expect(importProfileStateJson(db, JSON.stringify({ second: 3 }), { now: () => 456 })).toBe(2)
+      expect(exportProfileStateJson(db)).toBe(JSON.stringify({ second: 3 }))
+      expect(readProfileStateRevision(db)).toBe(2)
+      expect(readProfileStateDocuments(db)[0]).toMatchObject({
+        domain: 'second',
+        revision: 2,
+        updatedAt: 456
+      })
+    } finally {
+      db.close()
+    }
+  })
+
+  it('rejects a stale complete-document replacement before deleting rows', () => {
+    const { db } = openTestDatabase()
+    try {
+      importProfileStateJson(db, JSON.stringify({ keep: true }))
+      expect(() =>
+        importProfileStateJson(db, JSON.stringify({ replacement: true }), {
+          expectedRevision: 0
+        })
+      ).toThrowError(
+        expect.objectContaining({
+          code: 'profile-state-revision-conflict',
+          expectedRevision: 0,
+          actualRevision: 1
+        })
+      )
+      expect(exportProfileStateJson(db)).toBe(JSON.stringify({ keep: true }))
+      expect(readProfileStateRevision(db)).toBe(1)
+    } finally {
+      db.close()
+    }
+  })
+
+  it('commits the legacy JSON acceptance marker with the imported revision', () => {
+    const { db } = openTestDatabase()
+    try {
+      const raw = JSON.stringify({ settings: { theme: 'dark' } })
+      expect(
+        importProfileStateJson(db, raw, {
+          acceptedLegacyJsonHash: hashProfileStateJson(raw),
+          now: () => 123
+        })
+      ).toBe(1)
+      expect(readProfileStateJsonAcceptance(db)).toEqual({
+        jsonHash: hashProfileStateJson(raw),
+        acceptedRevision: 1
+      })
+    } finally {
+      db.close()
+    }
+  })
+
+  it('rolls back every row and the revision when one insert fails', () => {
+    const { db } = openTestDatabase()
+    try {
+      importProfileStateJson(db, JSON.stringify({ keep: { value: 1 } }), { now: () => 10 })
+      db.exec(
+        `CREATE TRIGGER fail_profile_state_insert
+         BEFORE INSERT ON profile_state_documents
+         WHEN NEW.domain = 'second'
+         BEGIN SELECT RAISE(ABORT, 'injected document failure'); END`
+      )
+
+      expect(() => importProfileStateJson(db, JSON.stringify({ first: 1, second: 2 }))).toThrow(
+        'injected document failure'
+      )
+      db.exec('DROP TRIGGER fail_profile_state_insert')
+      expect(exportProfileStateJson(db)).toBe(JSON.stringify({ keep: { value: 1 } }))
+      expect(readProfileStateRevision(db)).toBe(1)
+    } finally {
+      db.close()
+    }
+  })
+
+  it('does not roll back a transaction owned by the caller', () => {
+    const { db } = openTestDatabase()
+    try {
+      importProfileStateJson(db, JSON.stringify({ keep: true }))
+      db.exec('BEGIN IMMEDIATE')
+
+      expect(() => importProfileStateJson(db, JSON.stringify({ replacement: true }))).toThrow(
+        'requires an idle database connection'
+      )
+      expect(db.isTransaction).toBe(true)
+      db.exec('ROLLBACK')
+      expect(exportProfileStateJson(db)).toBe(JSON.stringify({ keep: true }))
+    } finally {
+      if (db.isTransaction) {
+        db.exec('ROLLBACK')
+      }
+      db.close()
+    }
+  })
+
+  it('rejects a tampered payload when its hash no longer matches', () => {
+    const { db } = openTestDatabase()
+    try {
+      importProfileStateJson(db, JSON.stringify({ ui: { active: 'terminal' } }))
+      db.prepare('UPDATE profile_state_documents SET payload = ? WHERE domain = ?').run(
+        JSON.stringify({ active: 'tasks' }),
+        'ui'
+      )
+
+      expect(() => readProfileStateDocuments(db)).toThrowError(
+        expect.objectContaining({ domain: 'ui' })
+      )
+      expect(() => exportProfileStateJson(db)).toThrowError(/hash mismatch: ui/)
+    } finally {
+      db.close()
+    }
+  })
+
+  it('rejects invalid domain JSON even when its hash is correct', () => {
+    const { db } = openTestDatabase()
+    try {
+      importProfileStateJson(db, JSON.stringify({ settings: { theme: 'dark' } }))
+      db.prepare(
+        'UPDATE profile_state_documents SET payload = ?, content_hash = ? WHERE domain = ?'
+      ).run('{invalid', hashProfileStateJson('{invalid'), 'settings')
+
+      expect(() => readProfileStateDocuments(db)).toThrow(/invalid JSON: settings/)
+      expect(() => readProfileStateSnapshot(db)).toThrow(/invalid JSON: settings/)
+      expect(() => readProfileStateParsedSnapshot(db)).toThrow(/invalid JSON: settings/)
+    } finally {
+      db.close()
+    }
+  })
+
+  it.each(['[]', ' null '])(
+    'rejects the noncanonical normalized history placeholder %s',
+    (payload) => {
+      const { db } = openTestDatabase()
+      try {
+        const original = {
+          settings: { theme: 'dark' },
+          automationRuns: [{ id: 'run-1', status: 'pending' }],
+          ui: { sidebarWidth: 280 }
+        }
+        importProfileStateJson(db, JSON.stringify(original))
+        expect(
+          db
+            .prepare('SELECT payload FROM profile_state_documents WHERE domain = ?')
+            .get('automationRuns')
+        ).toEqual({ payload: 'null' })
+        expect(readProfileStateSnapshot(db).json).toBe(JSON.stringify(original))
+        db.prepare(
+          'UPDATE profile_state_documents SET payload = ?, content_hash = ? WHERE domain = ?'
+        ).run(payload, hashProfileStateJson(payload), 'automationRuns')
+        expect(() => readProfileStateSnapshot(db)).toThrow(/placeholder is invalid/)
+        expect(() => readProfileStateParsedSnapshot(db)).toThrow(/placeholder is invalid/)
+      } finally {
+        db.close()
+      }
+    }
+  )
+
+  it('rejects a retained legacy document whose revision is ahead of the profile', () => {
+    const { db } = openTestDatabase()
+    try {
+      importProfileStateJson(db, JSON.stringify({ automationRuns: [{ id: 'run-1' }] }))
+      db.prepare('UPDATE profile_state_documents SET revision = ? WHERE domain = ?').run(
+        999,
+        'automationRuns'
+      )
+
+      expect(() => readProfileStateDocuments(db)).toThrow(
+        /document revision 999 exceeds profile revision 1/
+      )
+      expect(() => readProfileStateParsedSnapshot(db)).toThrow(
+        /document revision 999 exceeds profile revision 1/
+      )
+    } finally {
+      db.close()
+    }
+  })
+
+  it.each(['null', 'absent'] as const)(
+    'rejects normalized %s metadata whose revision is ahead of the profile',
+    (presence) => {
+      const { directory, db } = openTestDatabase()
+      try {
+        importProfileStateJson(db, JSON.stringify({ automationRuns: [{ id: 'run-1' }] }))
+        writeProfileStateDomain(db, {
+          domain: 'automationRuns',
+          payload: presence === 'null' ? 'null' : null,
+          expectedRevision: 1
+        })
+        expect(db.prepare('SELECT presence FROM profile_state_automation_runs_meta').get()).toEqual(
+          {
+            presence
+          }
+        )
+        db.prepare('UPDATE profile_state_automation_runs_meta SET revision = ?').run(999)
+
+        expect(() => readProfileStateSnapshot(db)).toThrow(
+          /document revision 999 exceeds profile revision 2/
+        )
+        expect(() => readProfileStateParsedSnapshot(db)).toThrow(
+          /document revision 999 exceeds profile revision 2/
+        )
+        expect(
+          readProfileStateDomains(profileStateDatabaseFile(directory), 'profile-a', [
+            'automationRuns'
+          ])
+        ).toMatchObject({
+          kind: 'unreadable'
+        })
+      } finally {
+        db.close()
+      }
+    }
+  )
+
+  it.each(['missing', 'absent', 'null'] as const)(
+    'rejects %s automation metadata with remaining normalized runs on every read path',
+    (presence) => {
+      const { directory, db } = openTestDatabase()
+      try {
+        importProfileStateJson(
+          db,
+          JSON.stringify({ automationRuns: [{ id: 'run-1', status: 'pending' }] })
+        )
+        writeProfileStateDomain(db, {
+          domain: 'automationRuns',
+          payload: JSON.stringify([{ id: 'run-1', status: 'completed' }]),
+          expectedRevision: 1
+        })
+        expect(JSON.parse(readProfileStateSnapshot(db).json)).toEqual({
+          automationRuns: [{ id: 'run-1', status: 'completed' }]
+        })
+        if (presence === 'missing') {
+          db.exec('DELETE FROM profile_state_automation_runs_meta')
+        } else {
+          db.prepare(
+            'UPDATE profile_state_automation_runs_meta SET presence = ?, content_hash = ?'
+          ).run(presence, presence === 'absent' ? '' : hashProfileStateJson('null'))
+        }
+
+        const expectedError =
+          presence === 'missing'
+            ? 'Normalized automationRuns metadata is malformed'
+            : 'Normalized automationRuns rows exist for an empty domain'
+        expect(() => readProfileStateSnapshot(db)).toThrow(expectedError)
+        expect(() => readProfileStateParsedSnapshot(db)).toThrow(expectedError)
+        const databasePath = profileStateDatabaseFile(directory)
+        const authority = new ProfileStateSqliteAuthority(databasePath, 'profile-a')
+        expect(() => authority.readSerializedState()).toThrow(
+          presence === 'missing' ? /Unable to read profile state database/ : expectedError
+        )
+        expect(
+          readProfileStateDomains(databasePath, 'profile-a', ['automationRuns'])
+        ).toMatchObject({
+          kind: 'unreadable'
+        })
+      } finally {
+        db.close()
+      }
+    }
+  )
+
+  it('rejects malformed input without changing an existing revision', () => {
+    const { db } = openTestDatabase()
+    try {
+      importProfileStateJson(db, JSON.stringify({ keep: true }))
+      expect(() => importProfileStateJson(db, '{invalid')).toThrow('Profile state JSON is invalid')
+      expect(exportProfileStateJson(db)).toBe(JSON.stringify({ keep: true }))
+      expect(readProfileStateRevision(db)).toBe(1)
+    } finally {
+      db.close()
+    }
+  })
+})
diff --git a/src/main/persistence/profile-state/profile-state-documents.ts b/src/main/persistence/profile-state/profile-state-documents.ts
new file mode 100644
index 000000000000..59e700cfab94
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-documents.ts
@@ -0,0 +1,232 @@
+import { withProfileStateWriteTransaction } from './profile-state-write-transaction'
+import { withProfileStateReadSnapshot } from './profile-state-read-snapshot'
+import type Database from '../../sqlite/sync-database'
+import { readCurrentAutomationRunsState } from './profile-state-automation-runs-storage'
+import {
+  PROFILE_STATE_META_LEGACY_JSON_ACCEPTANCE,
+  PROFILE_STATE_DOCUMENT_VERSION,
+  PROFILE_STATE_META_REVISION
+} from './profile-state-database-schema'
+import {
+  hashProfileStatePayload,
+  parseProfileStateRoot,
+  ProfileStateDocumentCorruptionError,
+  ProfileStateRevisionConflictError,
+  type ProfileStateDocument
+} from './profile-state-document-validation'
+import {
+  clearProfileStateAutomationRuns,
+  rebuildProfileStateAutomationRunsProjection
+} from './profile-state-automation-runs'
+
+import { readProfileStateDocuments } from './profile-state-document-reader'
+
+import { readProfileStateRevision } from './profile-state-revision'
+import { readProfileStateJsonAcceptance } from './legacy-json/profile-state-json-acceptance'
+
+export {
+  acceptProfileStateJsonCompatibility,
+  readProfileStateJsonAcceptance,
+  stageProfileStateJsonCompatibility,
+  type ProfileStateJsonAcceptance
+} from './legacy-json/profile-state-json-acceptance'
+
+export { readProfileStateRevision } from './profile-state-revision'
+export { readProfileStateDocuments } from './profile-state-document-reader'
+export type { ReadProfileStateDocumentsOptions } from './profile-state-document-reader'
+export { ProfileStateDocumentCorruptionError, ProfileStateRevisionConflictError }
+export type { ProfileStateDocument } from './profile-state-document-validation'
+
+export type ImportProfileStateOptions = {
+  now?: () => number
+  /** Hash of the exact legacy JSON bytes accepted by this import. */
+  acceptedLegacyJsonHash?: string
+  /** Revision observed by the caller before constructing this replacement. */
+  expectedRevision?: number
+}
+
+export type ProfileStateSnapshot = {
+  revision: number
+  documents: readonly ProfileStateDocument[]
+  json: string
+}
+
+export type ProfileStateParsedSnapshot = {
+  revision: number
+  state: Record<string, unknown>
+}
+
+/** Import a complete JSON document set atomically into one profile database. */
+export function importProfileStateJson(
+  db: Database.Database,
+  rawJson: string,
+  options: ImportProfileStateOptions = {}
+): number {
+  const parsed = parseProfileStateRoot(rawJson)
+  const entries = Object.entries(parsed).map(([domain, value]) => {
+    const payload = JSON.stringify(value)
+    if (payload === undefined) {
+      throw new ProfileStateDocumentCorruptionError(
+        `Profile state domain cannot be serialized: ${domain}`,
+        domain
+      )
+    }
+    return { domain, payload }
+  })
+
+  const now = options.now ?? Date.now
+  if (
+    options.acceptedLegacyJsonHash !== undefined &&
+    !/^[a-f0-9]{64}$/.test(options.acceptedLegacyJsonHash)
+  ) {
+    throw new ProfileStateDocumentCorruptionError('Legacy JSON acceptance hash is invalid')
+  }
+  if (
+    options.expectedRevision !== undefined &&
+    (!Number.isSafeInteger(options.expectedRevision) || options.expectedRevision < 0)
+  ) {
+    throw new ProfileStateDocumentCorruptionError('Expected profile state revision is invalid')
+  }
+  const updatedAt = now()
+  if (!Number.isSafeInteger(updatedAt) || updatedAt < 0) {
+    throw new ProfileStateDocumentCorruptionError('Profile state update timestamp is invalid')
+  }
+  return withProfileStateWriteTransaction(db, () => {
+    const actualRevision = readProfileStateRevision(db)
+    if (options.expectedRevision !== undefined && actualRevision !== options.expectedRevision) {
+      throw new ProfileStateRevisionConflictError(options.expectedRevision, actualRevision)
+    }
+    readCurrentAutomationRunsState(db, actualRevision)
+    const revision = actualRevision + 1
+    clearProfileStateAutomationRuns(db)
+    db.exec('DELETE FROM profile_state_documents')
+    const automationRuns = entries.find((entry) => entry.domain === 'automationRuns')
+    const normalizedRuns =
+      automationRuns !== undefined &&
+      rebuildProfileStateAutomationRunsProjection(
+        db,
+        automationRuns.payload,
+        PROFILE_STATE_DOCUMENT_VERSION,
+        updatedAt,
+        revision
+      )
+    const insert = db.prepare(
+      `INSERT INTO profile_state_documents
+       (domain, payload, domain_version, revision, updated_at, content_hash)
+       VALUES (?, ?, ?, ?, ?, ?)`
+    )
+    for (const entry of entries) {
+      const payload = normalizedRuns && entry.domain === 'automationRuns' ? 'null' : entry.payload
+      insert.run(
+        entry.domain,
+        payload,
+        PROFILE_STATE_DOCUMENT_VERSION,
+        revision,
+        updatedAt,
+        hashProfileStatePayload(payload)
+      )
+    }
+    db.prepare(
+      `INSERT INTO profile_state_meta (key, value) VALUES (?, ?)
+       ON CONFLICT(key) DO UPDATE SET value = excluded.value`
+    ).run(PROFILE_STATE_META_REVISION, String(revision))
+    if (options.acceptedLegacyJsonHash !== undefined) {
+      db.prepare(
+        `INSERT INTO profile_state_meta (key, value) VALUES (?, ?)
+         ON CONFLICT(key) DO UPDATE SET value = excluded.value`
+      ).run(
+        PROFILE_STATE_META_LEGACY_JSON_ACCEPTANCE,
+        JSON.stringify({ jsonHash: options.acceptedLegacyJsonHash, acceptedRevision: revision })
+      )
+    }
+    return revision
+  })
+}
+
+export function hashProfileStateJson(rawJson: string): string {
+  return hashProfileStatePayload(rawJson)
+}
+
+/** Validate that retained legacy JSON is the exact export accepted by this database. */
+export function profileStateJsonMatchesAcceptance(db: Database.Database, rawJson: string): boolean {
+  return readAcceptedProfileStateSnapshot(db, rawJson) !== undefined
+}
+
+/** Validate the retained JSON and return the same database snapshot used for acceptance. */
+export function readAcceptedProfileStateSnapshot(
+  db: Database.Database,
+  rawJson: string
+): ProfileStateSnapshot | undefined {
+  return readAcceptedSnapshot(db, rawJson, () => readProfileStateSnapshot(db))
+}
+
+export function readAcceptedProfileStateParsedSnapshot(
+  db: Database.Database,
+  rawJson: string
+): ProfileStateParsedSnapshot | undefined {
+  return readAcceptedSnapshot(db, rawJson, () => readProfileStateParsedSnapshot(db))
+}
+
+function readAcceptedSnapshot<T extends { revision: number }>(
+  db: Database.Database,
+  rawJson: string,
+  read: () => T
+): T | undefined {
+  return withProfileStateReadSnapshot(db, () => {
+    const marker = readProfileStateJsonAcceptance(db)
+    const snapshot = read()
+    const jsonHash = hashProfileStateJson(rawJson)
+    return marker !== undefined &&
+      (marker.jsonHash === jsonHash || marker.pending?.jsonHash === jsonHash) &&
+      snapshot.revision >= (marker.pending?.acceptedRevision ?? marker.acceptedRevision)
+      ? snapshot
+      : undefined
+  })
+}
+
+/** Transfer independently validated values without constructing another whole-profile string. */
+export function readProfileStateParsedSnapshot(db: Database.Database): ProfileStateParsedSnapshot {
+  return withProfileStateReadSnapshot(db, () => {
+    const revision = readProfileStateRevision(db)
+    const documents = readProfileStateDocuments(db, {
+      profileRevision: revision,
+      representation: 'parsed'
+    })
+    return {
+      revision,
+      state: Object.fromEntries(documents.map((document) => [document.domain, document.value]))
+    }
+  })
+}
+
+/** Export the row set as JSON accepted by the current loader. */
+export function exportProfileStateJson(db: Database.Database): string {
+  return readProfileStateSnapshot(db).json
+}
+
+/** Read revision, rows, and their JSON projection under one SQLite snapshot. */
+export function readProfileStateSnapshot(db: Database.Database): ProfileStateSnapshot {
+  return withProfileStateReadSnapshot(db, () => {
+    const revision = readProfileStateRevision(db)
+    const documents = readProfileStateDocuments(db, { profileRevision: revision })
+    return {
+      revision,
+      documents,
+      // Every payload was already hash- and JSON-validated above. Reusing the
+      // validated fragments avoids parsing and stringifying the full profile a
+      // second time before Store parses it at its domain boundary.
+      json: `{${documents
+        .map((document) => `${JSON.stringify(document.domain)}:${document.payload}`)
+        .join(',')}}`
+    }
+  })
+}
+
+/** Validate the complete snapshot without retaining state that recovery callers discard. */
+export function validateProfileStateSnapshot(db: Database.Database): number {
+  return withProfileStateReadSnapshot(db, () => {
+    const revision = readProfileStateRevision(db)
+    readProfileStateDocuments(db, { profileRevision: revision, representation: 'validated' })
+    return revision
+  })
+}
diff --git a/src/main/persistence/profile-state/profile-state-domain-equality.test.ts b/src/main/persistence/profile-state/profile-state-domain-equality.test.ts
new file mode 100644
index 000000000000..df9dfe3efb93
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-domain-equality.test.ts
@@ -0,0 +1,144 @@
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it } from 'vitest'
+import { openProfileStateDatabase } from './profile-state-database'
+import {
+  hashProfileStateJson,
+  importProfileStateJson,
+  readProfileStateRevision,
+  readProfileStateSnapshot
+} from './profile-state-documents'
+import { writeProfileStateDomains } from './profile-state-domain-writes'
+
+const databases: { db: ReturnType<typeof openProfileStateDatabase>['db']; directory: string }[] = []
+
+function fixture(value: unknown = { future: { content: '雪 🐋', nullable: null } }) {
+  const directory = mkdtempSync(join(tmpdir(), 'orca-domain-equality-'))
+  const { db } = openProfileStateDatabase(join(directory, 'state.db'), 'profile')
+  importProfileStateJson(db, JSON.stringify({ settings: {}, extension: value }))
+  databases.push({ db, directory })
+  return { db, payload: JSON.stringify(value) }
+}
+
+afterEach(() => {
+  for (const { db, directory } of databases.splice(0)) {
+    db.close()
+    rmSync(directory, { recursive: true, force: true })
+  }
+})
+
+describe('validated domain replacement equality', () => {
+  it.each([{ nested: { content: '雪 🐋', nullable: null } }, null])(
+    'preserves equal payload, revision and timestamp for %j',
+    (value) => {
+      const { db, payload } = fixture(value)
+      const before = readProfileStateSnapshot(db)
+      const rows = db.prepare('SELECT * FROM profile_state_documents').all()
+
+      expect(
+        writeProfileStateDomains(db, {
+          expectedRevision: 1,
+          replacements: [
+            {
+              domain: 'extension',
+              payload,
+              now: () => {
+                throw new Error('An unchanged replacement must not request a timestamp')
+              }
+            }
+          ]
+        })
+      ).toEqual({ changed: false, revision: 1, changedDomains: [] })
+      expect(readProfileStateSnapshot(db)).toEqual(before)
+      expect(db.prepare('SELECT * FROM profile_state_documents').all()).toEqual(rows)
+
+      writeProfileStateDomains(db, {
+        expectedRevision: 1,
+        replacements: [{ domain: 'extension', payload: null }]
+      })
+      expect(JSON.parse(readProfileStateSnapshot(db).json)).toEqual({ settings: {} })
+    }
+  )
+
+  it.each([
+    ["content_hash = 'invalid'", /metadata is invalid/],
+    [`content_hash = '${'a'.repeat(64)}'`, /hash mismatch/],
+    ['domain_version = 0', /metadata is invalid/],
+    ['updated_at = -1', /metadata is invalid/],
+    ['revision = 0', /metadata is invalid/],
+    ['revision = 2', /exceeds profile revision/]
+  ] as const)('rejects equal payload with corrupt %s', (assignment, error) => {
+    const { db, payload } = fixture()
+    db.exec(`UPDATE profile_state_documents SET ${assignment} WHERE domain = 'extension'`)
+    const before = db.prepare('SELECT * FROM profile_state_documents').all()
+
+    expect(() =>
+      writeProfileStateDomains(db, {
+        expectedRevision: 1,
+        replacements: [
+          { domain: 'settings', payload: '{"changed":true}' },
+          { domain: 'extension', payload }
+        ]
+      })
+    ).toThrow(error)
+    expect(readProfileStateRevision(db)).toBe(1)
+    expect(db.isTransaction).toBe(false)
+    expect(db.prepare('SELECT * FROM profile_state_documents').all()).toEqual(before)
+  })
+
+  it.each(['{', '{"valid":true}', null])(
+    'rejects malformed stored JSON with a matching hash on replacement %j',
+    (payload) => {
+      const { db } = fixture()
+      db.prepare(
+        "UPDATE profile_state_documents SET payload = ?, content_hash = ? WHERE domain = 'extension'"
+      ).run('{', hashProfileStateJson('{'))
+
+      expect(() =>
+        writeProfileStateDomains(db, {
+          expectedRevision: 1,
+          replacements: [{ domain: 'extension', payload }]
+        })
+      ).toThrow(/invalid JSON: extension/)
+      expect(readProfileStateRevision(db)).toBe(1)
+      expect(db.isTransaction).toBe(false)
+      expect(
+        db.prepare("SELECT payload FROM profile_state_documents WHERE domain = 'extension'").get()
+      ).toEqual({ payload: '{' })
+    }
+  )
+
+  it('ignores caller-supplied prepared history when writing another domain', () => {
+    const { db } = fixture()
+    const replacement = {
+      domain: 'settings',
+      payload: '{"changed":true}',
+      automationRuns: { incoming: { presence: 'absent', contentHash: '' }, domainVersion: 1 }
+    }
+
+    writeProfileStateDomains(db, { expectedRevision: 1, replacements: [replacement] })
+
+    expect(JSON.parse(readProfileStateSnapshot(db).json)).toEqual({
+      settings: { changed: true },
+      extension: { future: { content: '雪 🐋', nullable: null } }
+    })
+  })
+
+  it('fences a stale writer even when its payload remains equal', () => {
+    const { db, payload } = fixture()
+    writeProfileStateDomains(db, {
+      expectedRevision: 1,
+      replacements: [{ domain: 'settings', payload: '{"changed":true}' }]
+    })
+    const before = readProfileStateSnapshot(db)
+
+    expect(() =>
+      writeProfileStateDomains(db, {
+        expectedRevision: 1,
+        replacements: [{ domain: 'extension', payload }]
+      })
+    ).toThrow(expect.objectContaining({ code: 'profile-state-revision-conflict' }))
+    expect(readProfileStateSnapshot(db)).toEqual(before)
+  })
+})
diff --git a/src/main/persistence/profile-state/profile-state-domain-reader.test.ts b/src/main/persistence/profile-state/profile-state-domain-reader.test.ts
new file mode 100644
index 000000000000..c6c9d89c6db4
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-domain-reader.test.ts
@@ -0,0 +1,152 @@
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { importProfileStateJson } from './profile-state-documents'
+import { openProfileStateDatabase, profileStateDatabaseFile } from './profile-state-database'
+import {
+  readProfileStateDomains,
+  readProfileStateDomainsWithRevisionFromDatabase
+} from './profile-state-domain-reader'
+import { writeProfileStateDomains } from './profile-state-domain-writes'
+
+const temporaryDirectories: string[] = []
+
+afterEach(() => {
+  for (const directory of temporaryDirectories.splice(0)) {
+    rmSync(directory, { recursive: true, force: true })
+  }
+})
+
+function createDatabase(): { directory: string; databasePath: string } {
+  const directory = mkdtempSync(join(tmpdir(), 'orca-profile-state-domain-reader-'))
+  temporaryDirectories.push(directory)
+  return { directory, databasePath: profileStateDatabaseFile(directory) }
+}
+
+describe('profile state domain reader', () => {
+  it('does not parse unrelated domains', () => {
+    const { databasePath } = createDatabase()
+    const opened = openProfileStateDatabase(databasePath, 'profile-a')
+    importProfileStateJson(
+      opened.db,
+      JSON.stringify({ settings: { theme: 'dark' }, unrelated: { keep: true } })
+    )
+    opened.db
+      .prepare('UPDATE profile_state_documents SET payload = ? WHERE domain = ?')
+      .run('{invalid', 'unrelated')
+    opened.db.close()
+
+    const result = readProfileStateDomains(databasePath, 'profile-a', ['settings'])
+    expect(result).toEqual({
+      kind: 'values',
+      revision: 1,
+      values: new Map([['settings', { theme: 'dark' }]])
+    })
+  })
+
+  it('fails closed when a selected domain is corrupt', () => {
+    const { databasePath } = createDatabase()
+    const opened = openProfileStateDatabase(databasePath, 'profile-a')
+    importProfileStateJson(opened.db, JSON.stringify({ settings: { theme: 'dark' } }))
+    opened.db
+      .prepare('UPDATE profile_state_documents SET payload = ? WHERE domain = ?')
+      .run('{invalid', 'settings')
+    opened.db.close()
+
+    const result = readProfileStateDomains(databasePath, 'profile-a', ['settings'])
+    expect(result.kind).toBe('unreadable')
+  })
+
+  it('reads the normalized automation projection when selected', () => {
+    const { databasePath } = createDatabase()
+    const opened = openProfileStateDatabase(databasePath, 'profile-a')
+    importProfileStateJson(
+      opened.db,
+      JSON.stringify({ automationRuns: [{ id: 'run-1', status: 'pending' }] })
+    )
+    opened.db.close()
+
+    const result = readProfileStateDomains(databasePath, 'profile-a', ['automationRuns'])
+    expect(result).toEqual({
+      kind: 'values',
+      revision: 1,
+      values: new Map([['automationRuns', [{ id: 'run-1', status: 'pending' }]]])
+    })
+  })
+
+  it('preserves missing versus explicit null automation runs', () => {
+    const missing = createDatabase()
+    const missingOpened = openProfileStateDatabase(missing.databasePath, 'profile-a')
+    importProfileStateJson(missingOpened.db, JSON.stringify({ settings: { theme: 'dark' } }))
+    missingOpened.db.close()
+    const missingResult = readProfileStateDomains(missing.databasePath, 'profile-a', [
+      'automationRuns'
+    ])
+    expect(missingResult.kind).toBe('values')
+    expect(
+      missingResult.kind === 'values' ? missingResult.values.has('automationRuns') : true
+    ).toBe(false)
+
+    const explicitNull = createDatabase()
+    const nullOpened = openProfileStateDatabase(explicitNull.databasePath, 'profile-a')
+    importProfileStateJson(
+      nullOpened.db,
+      JSON.stringify({ settings: { theme: 'dark' }, automationRuns: null })
+    )
+    nullOpened.db.close()
+    const nullResult = readProfileStateDomains(explicitNull.databasePath, 'profile-a', [
+      'automationRuns'
+    ])
+    expect(nullResult).toEqual({
+      kind: 'values',
+      revision: 1,
+      values: new Map([['automationRuns', null]])
+    })
+  })
+
+  it('does not resurrect a stale legacy automation row after normalized deletion', () => {
+    const { databasePath } = createDatabase()
+    const opened = openProfileStateDatabase(databasePath, 'profile-a')
+    importProfileStateJson(
+      opened.db,
+      JSON.stringify({ automationRuns: [{ id: 'run-1', status: 'pending' }] })
+    )
+    writeProfileStateDomains(opened.db, {
+      expectedRevision: 1,
+      replacements: [{ domain: 'automationRuns', payload: null }]
+    })
+    opened.db.close()
+
+    const result = readProfileStateDomains(databasePath, 'profile-a', ['automationRuns'])
+    expect(result.kind).toBe('values')
+    expect(result.kind === 'values' ? result.values.has('automationRuns') : true).toBe(false)
+  })
+})
+
+it('reuses independently parsed values for selected domains and history rows', () => {
+  const { databasePath } = createDatabase()
+  const { db } = openProfileStateDatabase(databasePath, 'profile-a')
+  const settings = '{"theme":"dark"}'
+  const row = '{"id":"run-a","output":"retained"}'
+  importProfileStateJson(db, `{"settings":${settings},"automationRuns":[${row}]}`)
+  const parse = vi.spyOn(JSON, 'parse')
+  try {
+    expect(
+      readProfileStateDomainsWithRevisionFromDatabase(db, ['settings', 'automationRuns'])
+    ).toEqual({
+      kind: 'values',
+      revision: 1,
+      values: new Map<string, unknown>([
+        ['settings', { theme: 'dark' }],
+        ['automationRuns', [{ id: 'run-a', output: 'retained' }]]
+      ])
+    })
+    expect(parse.mock.calls.filter(([input]) => input === settings)).toHaveLength(1)
+    expect(parse.mock.calls.filter(([input]) => input === row)).toHaveLength(1)
+    expect(parse.mock.calls.some(([input]) => input === `[${row}]`)).toBe(false)
+  } finally {
+    parse.mockRestore()
+    db.close()
+  }
+})
diff --git a/src/main/persistence/profile-state/profile-state-domain-reader.ts b/src/main/persistence/profile-state/profile-state-domain-reader.ts
new file mode 100644
index 000000000000..2bd3a642e8ee
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-domain-reader.ts
@@ -0,0 +1,115 @@
+import { withProfileStateReadSnapshot } from './profile-state-read-snapshot'
+import {
+  assertProfileStateDocumentRevision,
+  readProfileStateRevision
+} from './profile-state-revision'
+import { readProfileStateAutomationRunsDocument } from './profile-state-automation-runs'
+import { openProfileStateDatabaseReadOnly } from './profile-state-database'
+import {
+  validateProfileStateDocumentRow,
+  type ProfileStateParsedDocument
+} from './profile-state-document-validation'
+
+export type ProfileStateDomainReadResult =
+  | { kind: 'value'; value: unknown }
+  | { kind: 'missing' }
+  | { kind: 'unreadable'; error: unknown }
+
+export type ProfileStateDomainsReadResult =
+  | { kind: 'values'; revision: number; values: ReadonlyMap<string, unknown> }
+  | { kind: 'unreadable'; error: unknown }
+
+/**
+ * Read one domain from an existing profile database without opening a write
+ * handle, applying migrations, or creating the database. Any malformed selected
+ * row makes the whole read unusable so callers that prune state can fail closed.
+ */
+export function readProfileStateDomain(
+  databasePath: string,
+  profileId: string,
+  domain: string
+): ProfileStateDomainReadResult {
+  const result = readProfileStateDomains(databasePath, profileId, [domain])
+  if (result.kind === 'unreadable') {
+    return result
+  }
+  if (!result.values.has(domain)) {
+    return { kind: 'missing' }
+  }
+  return { kind: 'value', value: result.values.get(domain) }
+}
+
+/** Read several domains and the fencing revision under one SQLite snapshot. */
+export function readProfileStateDomains(
+  databasePath: string,
+  profileId: string,
+  domains: readonly string[]
+): ProfileStateDomainsReadResult {
+  let opened: ReturnType<typeof openProfileStateDatabaseReadOnly> | undefined
+  try {
+    opened = openProfileStateDatabaseReadOnly(databasePath, profileId)
+    return readProfileStateDomainsWithRevisionFromDatabase(opened.db, domains)
+  } catch (error) {
+    return { kind: 'unreadable', error }
+  } finally {
+    opened?.db.close()
+  }
+}
+
+/** Read several domains from an already-open database, keeping the caller's handle alive. */
+export function readProfileStateDomainsWithRevisionFromDatabase(
+  db: Parameters<typeof readProfileStateRevision>[0],
+  domains: readonly string[]
+): ProfileStateDomainsReadResult {
+  const wanted = new Set(domains)
+  const values = new Map<string, unknown>()
+  try {
+    return withProfileStateReadSnapshot(db, () => {
+      const revision = readProfileStateRevision(db)
+      if (wanted.size === 0) {
+        return { kind: 'values', revision, values }
+      }
+
+      const normalized = wanted.has('automationRuns')
+        ? readProfileStateAutomationRunsDocument(db, revision, 'parsed')
+        : undefined
+      const legacyDomains = [...wanted].filter(
+        (domain) => domain !== 'automationRuns' || normalized === undefined
+      )
+      for (const document of readSelectedDocuments(db, legacyDomains)) {
+        assertProfileStateDocumentRevision(document.revision, revision, document.domain)
+        values.set(document.domain, document.value)
+      }
+      if (normalized !== undefined && normalized !== null) {
+        values.set(normalized.domain, normalized.value)
+      }
+      return { kind: 'values', revision, values }
+    })
+  } catch (error) {
+    return { kind: 'unreadable', error }
+  }
+}
+
+function readSelectedDocuments(
+  db: Parameters<typeof readProfileStateRevision>[0],
+  domains: readonly string[]
+): readonly ProfileStateParsedDocument[] {
+  if (domains.length === 0) {
+    return []
+  }
+  const placeholders = domains.map(() => '?').join(',')
+  const rows = db
+    .prepare(
+      `SELECT domain, payload, domain_version, revision, updated_at, content_hash
+       FROM profile_state_documents
+       WHERE domain IN (${placeholders})
+       ORDER BY rowid`
+    )
+    .iterate(...domains)
+  return Array.from(rows, (row) => {
+    const { payload: _payload, ...document } = validateProfileStateDocumentRow(row, {
+      retainParsedValue: true
+    })
+    return { ...document, value: document.value }
+  })
+}
diff --git a/src/main/persistence/profile-state/profile-state-domain-write-validation.ts b/src/main/persistence/profile-state/profile-state-domain-write-validation.ts
new file mode 100644
index 000000000000..bac86a1610aa
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-domain-write-validation.ts
@@ -0,0 +1,78 @@
+import { PROFILE_STATE_DOCUMENT_VERSION } from './profile-state-database-schema'
+import { hashProfileStateJson } from './profile-state-documents'
+import type { AutomationRunsWritePreparation } from './profile-state-automation-runs'
+import type {
+  ProfileStateDomainMutation,
+  ProfileStateDomainTransaction
+} from './profile-state-domain-writes'
+
+export type PreparedProfileStateMutation = ProfileStateDomainMutation & {
+  domainVersion: number
+  payloadHash: string | null
+  // Keep the checked history value only for this write so normalization does not parse it again.
+  automationRunsValue?: unknown
+  automationRuns?: AutomationRunsWritePreparation
+}
+
+export function validateProfileStateDomainTransaction(
+  transaction: ProfileStateDomainTransaction
+): void {
+  if (!Number.isSafeInteger(transaction.expectedRevision) || transaction.expectedRevision < 0) {
+    throw new Error('Profile state expected revision is invalid')
+  }
+  if (
+    !Array.isArray(transaction.replacements) ||
+    (transaction.replacements.length === 0 && transaction.automationRunsAfter === undefined)
+  ) {
+    throw new Error('Profile state domain transaction requires at least one replacement')
+  }
+  const domains = new Set<string>()
+  for (const replacement of transaction.replacements) {
+    validateProfileStateDomainMutation(replacement)
+    if (domains.has(replacement.domain)) {
+      throw new Error(`Profile state domain transaction repeats domain: ${replacement.domain}`)
+    }
+    domains.add(replacement.domain)
+  }
+  if (transaction.automationRunsAfter !== undefined && domains.has('automationRuns')) {
+    throw new Error('Profile state automationRuns delta repeats domain: automationRuns')
+  }
+}
+
+export function prepareProfileStateDomainMutation(
+  replacement: ProfileStateDomainMutation
+): PreparedProfileStateMutation {
+  const payloadHash =
+    replacement.payload === null ? null : hashProfileStateJson(replacement.payload)
+  let parsed: unknown
+  if (replacement.payload !== null) {
+    try {
+      parsed = JSON.parse(replacement.payload)
+    } catch {
+      throw new Error(`Profile state domain payload is invalid JSON: ${replacement.domain}`)
+    }
+  }
+  return {
+    domain: replacement.domain,
+    payload: replacement.payload,
+    now: replacement.now,
+    domainVersion: replacement.domainVersion ?? PROFILE_STATE_DOCUMENT_VERSION,
+    payloadHash,
+    automationRunsValue: replacement.domain === 'automationRuns' ? parsed : undefined
+  }
+}
+
+function validateProfileStateDomainMutation(replacement: ProfileStateDomainMutation): void {
+  if (typeof replacement.domain !== 'string' || replacement.domain.length === 0) {
+    throw new Error('Profile state domain name cannot be empty')
+  }
+  if (replacement.payload !== null && typeof replacement.payload !== 'string') {
+    throw new Error(`Profile state domain payload is invalid: ${replacement.domain}`)
+  }
+  if (
+    replacement.domainVersion !== undefined &&
+    (!Number.isSafeInteger(replacement.domainVersion) || replacement.domainVersion < 1)
+  ) {
+    throw new Error('Profile state domain version is invalid')
+  }
+}
diff --git a/src/main/persistence/profile-state/profile-state-domain-writes.test.ts b/src/main/persistence/profile-state/profile-state-domain-writes.test.ts
new file mode 100644
index 000000000000..8c54ee2360f1
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-domain-writes.test.ts
@@ -0,0 +1,585 @@
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it } from 'vitest'
+import {
+  exportProfileStateJson,
+  importProfileStateJson,
+  readProfileStateDocuments,
+  readProfileStateRevision
+} from './profile-state-documents'
+import { openProfileStateDatabase, profileStateDatabaseFile } from './profile-state-database'
+import {
+  ProfileStateRevisionConflictError,
+  writeProfileStateDomain,
+  writeProfileStateDomains
+} from './profile-state-domain-writes'
+import { buildProfileStateCutoverFixture } from '../profile-state-cutover-fixture'
+
+const temporaryDirectories: string[] = []
+
+afterEach(() => {
+  for (const directory of temporaryDirectories.splice(0)) {
+    rmSync(directory, { recursive: true, force: true })
+  }
+})
+
+function openTestDatabase(): ReturnType<typeof openProfileStateDatabase>['db'] {
+  const directory = mkdtempSync(join(tmpdir(), 'orca-profile-state-domain-write-'))
+  temporaryDirectories.push(directory)
+  return openProfileStateDatabase(profileStateDatabaseFile(directory), 'profile-a').db
+}
+
+describe('profile state dirty-domain writes', () => {
+  it('retains logical history order when existing runs change position', () => {
+    const db = openTestDatabase()
+    const runs = [{ id: 'first' }, { id: 'second' }, { id: 'third' }] as const
+    const reordered = [runs[2], runs[0], runs[1]]
+    try {
+      importProfileStateJson(db, JSON.stringify({ automationRuns: runs }))
+      writeProfileStateDomain(db, {
+        domain: 'automationRuns',
+        payload: JSON.stringify(reordered),
+        expectedRevision: 1
+      })
+
+      expect(
+        db.prepare('SELECT run_id FROM profile_state_automation_runs ORDER BY rowid').all()
+      ).toEqual(runs.map((run) => ({ run_id: run.id })))
+      expect(JSON.parse(exportProfileStateJson(db)).automationRuns).toEqual(reordered)
+
+      db.prepare('UPDATE profile_state_automation_runs SET ordinal = 0 WHERE run_id = ?').run(
+        'first'
+      )
+      expect(() => exportProfileStateJson(db)).toThrow(
+        'Normalized automationRuns ordering is corrupt'
+      )
+    } finally {
+      db.close()
+    }
+  })
+
+  it('updates automationRuns without rewriting unrelated domains', () => {
+    const db = openTestDatabase()
+    try {
+      importProfileStateJson(
+        db,
+        JSON.stringify({
+          settings: { theme: 'dark' },
+          automationRuns: [{ id: 'run-1', status: 'pending' }]
+        }),
+        { now: () => 100 }
+      )
+      const settingsBefore = readProfileStateDocuments(db).find(
+        (document) => document.domain === 'settings'
+      )
+
+      const result = writeProfileStateDomain(db, {
+        domain: 'automationRuns',
+        payload: JSON.stringify([{ id: 'run-1', status: 'completed' }]),
+        expectedRevision: 1,
+        now: () => 200
+      })
+
+      expect(result).toEqual({ changed: true, revision: 2 })
+      expect(JSON.parse(exportProfileStateJson(db))).toEqual({
+        settings: { theme: 'dark' },
+        automationRuns: [{ id: 'run-1', status: 'completed' }]
+      })
+      expect(readProfileStateDocuments(db)).toEqual([
+        expect.objectContaining({ domain: 'settings', revision: 1, updatedAt: 100 }),
+        expect.objectContaining({ domain: 'automationRuns', revision: 2, updatedAt: 200 })
+      ])
+      const settingsAfter = readProfileStateDocuments(db).find(
+        (document) => document.domain === 'settings'
+      )
+      expect(settingsAfter).toMatchObject({
+        payload: settingsBefore?.payload,
+        contentHash: settingsBefore?.contentHash,
+        updatedAt: settingsBefore?.updatedAt
+      })
+    } finally {
+      db.close()
+    }
+  })
+
+  it('commits changed automation runs as rows without rewriting the legacy document blob', () => {
+    const db = openTestDatabase()
+    try {
+      const fixtureRun = buildProfileStateCutoverFixture().automationRuns[0]
+      if (!fixtureRun) {
+        throw new Error('Expected automation run fixture')
+      }
+      const initialRuns = [
+        { ...fixtureRun, id: 'run-1', status: 'pending' as const },
+        { ...fixtureRun, id: 'run-2', status: 'completed' as const }
+      ]
+      importProfileStateJson(
+        db,
+        JSON.stringify({
+          settings: { theme: 'dark' },
+          automationRuns: initialRuns
+        }),
+        { now: () => 100 }
+      )
+      const legacyDocument = db
+        .prepare('SELECT payload, content_hash FROM profile_state_documents WHERE domain = ?')
+        .get('automationRuns')
+
+      const result = writeProfileStateDomains(db, {
+        expectedRevision: 1,
+        replacements: [],
+        automationRunsAfter: [{ ...initialRuns[0], status: 'dispatched' as const }, initialRuns[1]]
+      })
+
+      expect(result).toEqual({
+        changed: true,
+        revision: 2,
+        changedDomains: ['automationRuns']
+      })
+      expect(
+        db.prepare('SELECT COUNT(*) AS count FROM profile_state_automation_runs').get()
+      ).toEqual({ count: 2 })
+      expect(
+        db
+          .prepare('SELECT payload, content_hash FROM profile_state_documents WHERE domain = ?')
+          .get('automationRuns')
+      ).toEqual(legacyDocument)
+      expect(JSON.parse(exportProfileStateJson(db))).toEqual({
+        settings: { theme: 'dark' },
+        automationRuns: [{ ...initialRuns[0], status: 'dispatched' }, initialRuns[1]]
+      })
+    } finally {
+      db.close()
+    }
+  })
+
+  it('rolls back a direct automation-run delta and revision when normalized metadata rejects it', () => {
+    const db = openTestDatabase()
+    try {
+      const fixtureRun = buildProfileStateCutoverFixture().automationRuns[0]
+      if (!fixtureRun) {
+        throw new Error('Expected automation run fixture')
+      }
+      const initialRuns = [{ ...fixtureRun, id: 'run-1', status: 'pending' as const }]
+      importProfileStateJson(db, JSON.stringify({ automationRuns: initialRuns }), {
+        now: () => 100
+      })
+      const normalizedRuns = [{ ...initialRuns[0], status: 'dispatched' as const }]
+      expect(
+        writeProfileStateDomains(db, {
+          expectedRevision: 1,
+          replacements: [],
+          automationRunsAfter: normalizedRuns
+        })
+      ).toEqual({ changed: true, revision: 2, changedDomains: ['automationRuns'] })
+      db.exec(
+        `CREATE TRIGGER fail_profile_state_automation_run_delta
+         BEFORE UPDATE ON profile_state_automation_runs_meta
+         WHEN NEW.domain = 'automationRuns'
+         BEGIN SELECT RAISE(ABORT, 'injected automation delta failure'); END`
+      )
+
+      expect(() =>
+        writeProfileStateDomains(db, {
+          expectedRevision: 2,
+          replacements: [],
+          automationRunsAfter: [{ ...normalizedRuns[0], status: 'completed' as const }]
+        })
+      ).toThrow('injected automation delta failure')
+      db.exec('DROP TRIGGER fail_profile_state_automation_run_delta')
+      expect(readProfileStateRevision(db)).toBe(2)
+      expect(JSON.parse(exportProfileStateJson(db)).automationRuns).toEqual(normalizedRuns)
+    } finally {
+      db.close()
+    }
+  })
+
+  it('fails closed when a normalized automation-run row is corrupt', () => {
+    const db = openTestDatabase()
+    try {
+      const fixtureRun = buildProfileStateCutoverFixture().automationRuns[0]
+      if (!fixtureRun) {
+        throw new Error('Expected automation run fixture')
+      }
+      const runs = [{ ...fixtureRun, id: 'run-1', status: 'pending' as const }]
+      importProfileStateJson(db, JSON.stringify({ automationRuns: runs }))
+      writeProfileStateDomains(db, {
+        expectedRevision: 1,
+        replacements: [],
+        automationRunsAfter: runs
+      })
+      db.prepare('UPDATE profile_state_automation_runs SET payload = ? WHERE run_id = ?').run(
+        JSON.stringify({ ...runs[0], status: 'tampered' }),
+        'run-1'
+      )
+
+      expect(() => exportProfileStateJson(db)).toThrow('Normalized automationRuns row is corrupt')
+    } finally {
+      db.close()
+    }
+  })
+
+  it('retains unchanged run row revisions while updating the aggregate projection', () => {
+    const db = openTestDatabase()
+    try {
+      const fixtureRuns = buildProfileStateCutoverFixture().automationRuns
+      const first = fixtureRuns[0]
+      if (!first) {
+        throw new Error('Expected automation run fixture')
+      }
+      const initialRuns = [
+        { ...first, id: 'run-1', status: 'pending' as const },
+        { ...first, id: 'run-2', status: 'dispatched' as const }
+      ]
+      importProfileStateJson(db, JSON.stringify({ automationRuns: initialRuns }))
+      writeProfileStateDomains(db, {
+        expectedRevision: 1,
+        replacements: [],
+        automationRunsAfter: [{ ...initialRuns[0], status: 'completed' as const }, initialRuns[1]]
+      })
+      writeProfileStateDomains(db, {
+        expectedRevision: 2,
+        replacements: [],
+        automationRunsAfter: [
+          { ...initialRuns[0], status: 'dispatch_failed' as const },
+          initialRuns[1]
+        ]
+      })
+
+      expect(
+        db
+          .prepare('SELECT revision FROM profile_state_automation_runs WHERE run_id = ?')
+          .get('run-2')
+      ).toEqual({ revision: 1 })
+      expect(readProfileStateRevision(db)).toBe(3)
+      expect(JSON.parse(exportProfileStateJson(db)).automationRuns).toEqual([
+        { ...initialRuns[0], status: 'dispatch_failed' },
+        initialRuns[1]
+      ])
+    } finally {
+      db.close()
+    }
+  })
+
+  it('commits several changed domains at one shared revision', () => {
+    const db = openTestDatabase()
+    try {
+      importProfileStateJson(
+        db,
+        JSON.stringify({
+          settings: { theme: 'dark' },
+          automationRuns: [{ id: 'run-1', status: 'pending' }],
+          ui: { activeView: 'terminal' }
+        }),
+        { now: () => 100 }
+      )
+
+      expect(
+        writeProfileStateDomains(db, {
+          expectedRevision: 1,
+          replacements: [
+            {
+              domain: 'settings',
+              payload: JSON.stringify({ theme: 'light' }),
+              now: () => 200
+            },
+            {
+              domain: 'automationRuns',
+              payload: JSON.stringify([{ id: 'run-1', status: 'completed' }]),
+              now: () => 201
+            }
+          ]
+        })
+      ).toEqual({
+        changed: true,
+        revision: 2,
+        changedDomains: ['settings', 'automationRuns']
+      })
+      expect(readProfileStateRevision(db)).toBe(2)
+      expect(JSON.parse(exportProfileStateJson(db))).toEqual({
+        settings: { theme: 'light' },
+        automationRuns: [{ id: 'run-1', status: 'completed' }],
+        ui: { activeView: 'terminal' }
+      })
+      expect(readProfileStateDocuments(db)).toEqual([
+        expect.objectContaining({ domain: 'settings', revision: 2, updatedAt: 200 }),
+        expect.objectContaining({ domain: 'automationRuns', revision: 2, updatedAt: 201 }),
+        expect.objectContaining({ domain: 'ui', revision: 1, updatedAt: 100 })
+      ])
+    } finally {
+      db.close()
+    }
+  })
+
+  it('rolls back every domain when a later mutation fails', () => {
+    const db = openTestDatabase()
+    try {
+      importProfileStateJson(
+        db,
+        JSON.stringify({
+          settings: { theme: 'dark' },
+          automationRuns: [{ id: 'run-1', status: 'pending' }]
+        }),
+        { now: () => 100 }
+      )
+      db.exec(
+        `CREATE TRIGGER fail_second_profile_state_domain_update
+         BEFORE UPDATE ON profile_state_automation_runs_meta
+         WHEN NEW.domain = 'automationRuns'
+         BEGIN SELECT RAISE(ABORT, 'injected domain failure'); END`
+      )
+
+      expect(() =>
+        writeProfileStateDomains(db, {
+          expectedRevision: 1,
+          replacements: [
+            { domain: 'settings', payload: JSON.stringify({ theme: 'light' }) },
+            {
+              domain: 'automationRuns',
+              payload: JSON.stringify([{ id: 'run-1', status: 'completed' }])
+            }
+          ]
+        })
+      ).toThrow('injected domain failure')
+      db.exec('DROP TRIGGER fail_second_profile_state_domain_update')
+      expect(readProfileStateRevision(db)).toBe(1)
+      expect(JSON.parse(exportProfileStateJson(db))).toEqual({
+        settings: { theme: 'dark' },
+        automationRuns: [{ id: 'run-1', status: 'pending' }]
+      })
+    } finally {
+      db.close()
+    }
+  })
+
+  it('fences a stale multi-domain transaction before changing either row', () => {
+    const db = openTestDatabase()
+    try {
+      importProfileStateJson(
+        db,
+        JSON.stringify({ settings: { theme: 'dark' }, ui: { activeView: 'terminal' } })
+      )
+      writeProfileStateDomain(db, {
+        domain: 'settings',
+        payload: JSON.stringify({ theme: 'light' }),
+        expectedRevision: 1
+      })
+
+      expect(() =>
+        writeProfileStateDomains(db, {
+          expectedRevision: 1,
+          replacements: [
+            { domain: 'settings', payload: JSON.stringify({ theme: 'blue' }) },
+            { domain: 'ui', payload: JSON.stringify({ activeView: 'browser' }) }
+          ]
+        })
+      ).toThrowError(ProfileStateRevisionConflictError)
+      expect(readProfileStateRevision(db)).toBe(2)
+      expect(JSON.parse(exportProfileStateJson(db))).toEqual({
+        settings: { theme: 'light' },
+        ui: { activeView: 'terminal' }
+      })
+    } finally {
+      db.close()
+    }
+  })
+
+  it('rejects duplicate domains before opening a transaction', () => {
+    const db = openTestDatabase()
+    try {
+      importProfileStateJson(db, JSON.stringify({ settings: { theme: 'dark' } }))
+      expect(() =>
+        writeProfileStateDomains(db, {
+          expectedRevision: 1,
+          replacements: [
+            { domain: 'settings', payload: JSON.stringify({ theme: 'light' }) },
+            { domain: 'settings', payload: JSON.stringify({ theme: 'blue' }) }
+          ]
+        })
+      ).toThrow('repeats domain: settings')
+      expect(readProfileStateRevision(db)).toBe(1)
+      expect(JSON.parse(exportProfileStateJson(db))).toEqual({ settings: { theme: 'dark' } })
+    } finally {
+      db.close()
+    }
+  })
+
+  it('fences a stale Store and leaves the database unchanged', () => {
+    const db = openTestDatabase()
+    try {
+      importProfileStateJson(db, JSON.stringify({ automationRuns: [{ id: 'run-1' }] }))
+      writeProfileStateDomain(db, {
+        domain: 'automationRuns',
+        payload: JSON.stringify([{ id: 'run-1', status: 'completed' }]),
+        expectedRevision: 1
+      })
+
+      expect(() =>
+        writeProfileStateDomain(db, {
+          domain: 'automationRuns',
+          payload: JSON.stringify([{ id: 'run-1', status: 'failed' }]),
+          expectedRevision: 1
+        })
+      ).toThrowError(
+        expect.objectContaining({
+          code: 'profile-state-revision-conflict',
+          expectedRevision: 1,
+          actualRevision: 2
+        })
+      )
+      expect(readProfileStateRevision(db)).toBe(2)
+      expect(JSON.parse(exportProfileStateJson(db)).automationRuns).toEqual([
+        { id: 'run-1', status: 'completed' }
+      ])
+    } finally {
+      db.close()
+    }
+  })
+
+  it('fences two independently opened database writers with the shared revision', () => {
+    const directory = mkdtempSync(join(tmpdir(), 'orca-profile-state-domain-writer-fence-'))
+    temporaryDirectories.push(directory)
+    const databasePath = profileStateDatabaseFile(directory)
+    const first = openProfileStateDatabase(databasePath, 'profile-a').db
+    const second = openProfileStateDatabase(databasePath, 'profile-a').db
+    try {
+      importProfileStateJson(first, JSON.stringify({ automationRuns: [{ id: 'run-1' }] }))
+      expect(readProfileStateRevision(second)).toBe(1)
+      writeProfileStateDomain(first, {
+        domain: 'automationRuns',
+        payload: JSON.stringify([{ id: 'run-1', status: 'completed' }]),
+        expectedRevision: 1
+      })
+
+      expect(() =>
+        writeProfileStateDomain(second, {
+          domain: 'automationRuns',
+          payload: JSON.stringify([{ id: 'run-1', status: 'failed' }]),
+          expectedRevision: 1
+        })
+      ).toThrowError(ProfileStateRevisionConflictError)
+      expect(readProfileStateRevision(second)).toBe(2)
+    } finally {
+      first.close()
+      second.close()
+    }
+  })
+
+  it('does not advance revision for an identical replacement or absent delete', () => {
+    const db = openTestDatabase()
+    try {
+      importProfileStateJson(db, JSON.stringify({ automationRuns: [{ id: 'run-1' }] }))
+      expect(
+        writeProfileStateDomain(db, {
+          domain: 'automationRuns',
+          payload: JSON.stringify([{ id: 'run-1' }]),
+          expectedRevision: 1
+        })
+      ).toEqual({ changed: false, revision: 1 })
+      expect(
+        writeProfileStateDomain(db, {
+          domain: 'missingDomain',
+          payload: null,
+          expectedRevision: 1
+        })
+      ).toEqual({ changed: false, revision: 1 })
+      expect(readProfileStateRevision(db)).toBe(1)
+    } finally {
+      db.close()
+    }
+  })
+
+  it('distinguishes explicit JSON null from deleting a domain', () => {
+    const db = openTestDatabase()
+    try {
+      importProfileStateJson(db, JSON.stringify({ automationRuns: [{ id: 'run-1' }] }))
+      expect(
+        writeProfileStateDomain(db, {
+          domain: 'automationRuns',
+          payload: 'null',
+          expectedRevision: 1
+        })
+      ).toEqual({ changed: true, revision: 2 })
+      expect(JSON.parse(exportProfileStateJson(db))).toEqual({ automationRuns: null })
+
+      expect(
+        writeProfileStateDomain(db, {
+          domain: 'automationRuns',
+          payload: null,
+          expectedRevision: 2
+        })
+      ).toEqual({ changed: true, revision: 3 })
+      expect(JSON.parse(exportProfileStateJson(db))).toEqual({})
+    } finally {
+      db.close()
+    }
+  })
+
+  it('rolls back the row and revision when SQLite rejects the replacement', () => {
+    const db = openTestDatabase()
+    try {
+      importProfileStateJson(db, JSON.stringify({ automationRuns: [{ id: 'run-1' }] }))
+      db.exec(
+        `CREATE TRIGGER fail_profile_state_domain_update
+         BEFORE UPDATE ON profile_state_automation_runs_meta
+         WHEN NEW.domain = 'automationRuns'
+         BEGIN SELECT RAISE(ABORT, 'injected domain failure'); END`
+      )
+
+      expect(() =>
+        writeProfileStateDomain(db, {
+          domain: 'automationRuns',
+          payload: JSON.stringify([{ id: 'run-1', status: 'failed' }]),
+          expectedRevision: 1
+        })
+      ).toThrow('injected domain failure')
+      db.exec('DROP TRIGGER fail_profile_state_domain_update')
+      expect(readProfileStateRevision(db)).toBe(1)
+      expect(JSON.parse(exportProfileStateJson(db))).toEqual({
+        automationRuns: [{ id: 'run-1' }]
+      })
+    } finally {
+      db.close()
+    }
+  })
+
+  it('rejects malformed payloads before opening a transaction', () => {
+    const db = openTestDatabase()
+    try {
+      importProfileStateJson(db, JSON.stringify({ automationRuns: [{ id: 'run-1' }] }))
+      expect(() =>
+        writeProfileStateDomain(db, {
+          domain: 'automationRuns',
+          payload: '{invalid',
+          expectedRevision: 1
+        })
+      ).toThrow('Profile state domain payload is invalid JSON: automationRuns')
+      expect(readProfileStateRevision(db)).toBe(1)
+    } finally {
+      db.close()
+    }
+  })
+
+  it('fails closed when the target row hash is already corrupt', () => {
+    const db = openTestDatabase()
+    try {
+      importProfileStateJson(db, JSON.stringify({ automationRuns: [{ id: 'run-1' }] }))
+      db.prepare('UPDATE profile_state_documents SET payload = ? WHERE domain = ?').run(
+        JSON.stringify([{ id: 'tampered' }]),
+        'automationRuns'
+      )
+
+      expect(() =>
+        writeProfileStateDomain(db, {
+          domain: 'automationRuns',
+          payload: JSON.stringify([{ id: 'run-1', status: 'completed' }]),
+          expectedRevision: 1
+        })
+      ).toThrow('Profile state document hash mismatch: automationRuns')
+      expect(readProfileStateRevision(db)).toBe(1)
+    } finally {
+      db.close()
+    }
+  })
+})
diff --git a/src/main/persistence/profile-state/profile-state-domain-writes.ts b/src/main/persistence/profile-state/profile-state-domain-writes.ts
new file mode 100644
index 000000000000..792487ef3b11
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-domain-writes.ts
@@ -0,0 +1,231 @@
+import { withProfileStateWriteTransaction } from './profile-state-write-transaction'
+import type Database from '../../sqlite/sync-database'
+import { readCurrentAutomationRunsState } from './profile-state-automation-runs-storage'
+import {
+  PROFILE_STATE_DOCUMENT_VERSION,
+  PROFILE_STATE_META_REVISION
+} from './profile-state-database-schema'
+import {
+  ProfileStateRevisionConflictError,
+  readProfileStateRevision
+} from './profile-state-documents'
+import {
+  applyProfileStateAutomationRuns,
+  clearProfileStateAutomationRuns,
+  prepareProfileStateAutomationRunsDelta,
+  prepareProfileStateAutomationRunsReplacement
+} from './profile-state-automation-runs'
+import { isRecord, validateProfileStateDocumentRow } from './profile-state-document-validation'
+import { assertProfileStateDocumentRevision } from './profile-state-revision'
+import {
+  prepareProfileStateDomainMutation,
+  validateProfileStateDomainTransaction,
+  type PreparedProfileStateMutation
+} from './profile-state-domain-write-validation'
+
+export { ProfileStateRevisionConflictError } from './profile-state-documents'
+
+/** A storage-form replacement for one top-level profile-state domain. */
+export type ProfileStateDomainReplacement = {
+  /** Non-empty top-level domain name, for example `automationRuns`. */
+  domain: string
+  /** Canonical JSON payload, or null to remove the domain row. */
+  payload: string | null
+  /** Revision observed by the caller before it built this replacement. */
+  expectedRevision: number
+  domainVersion?: number
+  now?: () => number
+}
+
+/** One row mutation inside a transaction that may update several domains. */
+export type ProfileStateDomainMutation = Omit<ProfileStateDomainReplacement, 'expectedRevision'>
+
+/**
+ * A set of domain mutations guarded by one profile revision.
+ *
+ * A profile revision is shared by every row, so checking it once at the start
+ * of the transaction gives callers an atomic cross-domain compare-and-swap.
+ */
+export type ProfileStateDomainTransaction = {
+  expectedRevision: number
+  replacements: readonly ProfileStateDomainMutation[]
+  /** Changed run projection supplied by Store for selective row updates. */
+  automationRunsAfter?: readonly unknown[]
+}
+
+export type ProfileStateDomainWriteResult = {
+  changed: boolean
+  revision: number
+}
+
+export type ProfileStateDomainTransactionResult = ProfileStateDomainWriteResult & {
+  changedDomains: readonly string[]
+}
+
+/**
+ * Replace one domain without serializing or rewriting the other domains.
+ *
+ * The caller supplies the revision it read with the domain. SQLite's
+ * `BEGIN IMMEDIATE` plus the exact revision check fences stale Store instances
+ * before the row and profile revision are changed. A null payload deletes the
+ * row; the JSON literal `null` remains an explicit domain value.
+ */
+export function writeProfileStateDomain(
+  db: Database.Database,
+  replacement: ProfileStateDomainReplacement
+): ProfileStateDomainWriteResult {
+  const result = writeProfileStateDomains(db, {
+    expectedRevision: replacement.expectedRevision,
+    replacements: [
+      {
+        domain: replacement.domain,
+        payload: replacement.payload,
+        domainVersion: replacement.domainVersion,
+        now: replacement.now
+      }
+    ]
+  })
+  return { changed: result.changed, revision: result.revision }
+}
+
+/**
+ * Replace one or more domains in one SQLite transaction.
+ *
+ * Every changed row receives the same next profile revision. If any row
+ * validation, payload write, or commit step fails, SQLite rolls back all row
+ * changes and the profile revision remains unchanged.
+ */
+export function writeProfileStateDomains(
+  db: Database.Database,
+  transaction: ProfileStateDomainTransaction
+): ProfileStateDomainTransactionResult {
+  validateProfileStateDomainTransaction(transaction)
+
+  const prepared = transaction.replacements.map(prepareProfileStateDomainMutation)
+
+  return withProfileStateWriteTransaction(db, () => {
+    const actualRevision = readProfileStateRevision(db)
+    if (actualRevision !== transaction.expectedRevision) {
+      throw new ProfileStateRevisionConflictError(transaction.expectedRevision, actualRevision)
+    }
+    const currentAutomationRuns = readCurrentAutomationRunsState(db, actualRevision)
+
+    const updates: PreparedProfileStateMutation[] = []
+    for (const mutation of prepared) {
+      const existing = db
+        .prepare(
+          `SELECT domain, payload, domain_version, revision, updated_at, content_hash
+           FROM profile_state_documents WHERE domain = ?`
+        )
+        .get(mutation.domain)
+      const existingRow =
+        existing === undefined
+          ? undefined
+          : validateProfileStateDocumentRow(existing, {
+              // An identical incoming payload has already passed JSON validation.
+              validateJson: !(isRecord(existing) && existing.payload === mutation.payload)
+            })
+      if (existingRow) {
+        assertProfileStateDocumentRevision(existingRow.revision, actualRevision, mutation.domain)
+      }
+      if (mutation.domain === 'automationRuns') {
+        // Canonical history already has this hash; unchanged rows need no new projection.
+        if (
+          currentAutomationRuns.presence === 'array' &&
+          mutation.payload?.startsWith('[') &&
+          currentAutomationRuns.contentHash === mutation.payloadHash
+        ) {
+          continue
+        }
+        const normalized = prepareProfileStateAutomationRunsReplacement(
+          db,
+          mutation,
+          actualRevision
+        )
+        if (normalized !== undefined) {
+          if (normalized.changed) {
+            updates.push({ ...mutation, automationRuns: normalized })
+          }
+          continue
+        }
+      }
+      const unchanged =
+        (mutation.payload === null && existingRow === undefined) ||
+        (mutation.payload !== null && existingRow?.payload === mutation.payload)
+      if (!unchanged) {
+        updates.push(mutation)
+      }
+    }
+    if (transaction.automationRunsAfter !== undefined) {
+      const delta = prepareProfileStateAutomationRunsDelta(
+        db,
+        transaction.automationRunsAfter,
+        PROFILE_STATE_DOCUMENT_VERSION,
+        Date.now,
+        actualRevision
+      )
+      if (delta === undefined) {
+        throw new Error('Normalized automationRuns delta is unsupported')
+      }
+      if (delta.changed) {
+        updates.push({
+          domain: 'automationRuns',
+          payload: null,
+          domainVersion: PROFILE_STATE_DOCUMENT_VERSION,
+          payloadHash: null,
+          automationRuns: delta
+        })
+      }
+    }
+
+    if (updates.length === 0) {
+      return { changed: false, revision: actualRevision, changedDomains: [] }
+    }
+
+    const nextRevision = actualRevision + 1
+    for (const mutation of updates) {
+      if (mutation.automationRuns) {
+        applyProfileStateAutomationRuns(db, mutation.automationRuns, nextRevision)
+        continue
+      }
+      if (mutation.domain === 'automationRuns') {
+        clearProfileStateAutomationRuns(db)
+      }
+      if (mutation.payload === null) {
+        db.prepare('DELETE FROM profile_state_documents WHERE domain = ?').run(mutation.domain)
+      } else {
+        const updatedAt = (mutation.now ?? Date.now)()
+        if (!Number.isSafeInteger(updatedAt) || updatedAt < 0) {
+          throw new Error(`Profile state domain update timestamp is invalid: ${mutation.domain}`)
+        }
+        db.prepare(
+          `INSERT INTO profile_state_documents
+           (domain, payload, domain_version, revision, updated_at, content_hash)
+           VALUES (?, ?, ?, ?, ?, ?)
+           ON CONFLICT(domain) DO UPDATE SET
+             payload = excluded.payload,
+             domain_version = excluded.domain_version,
+             revision = excluded.revision,
+             updated_at = excluded.updated_at,
+             content_hash = excluded.content_hash`
+        ).run(
+          mutation.domain,
+          mutation.payload,
+          mutation.domainVersion,
+          nextRevision,
+          updatedAt,
+          mutation.payloadHash
+        )
+      }
+    }
+    db.prepare(
+      `INSERT INTO profile_state_meta (key, value) VALUES (?, ?)
+       ON CONFLICT(key) DO UPDATE SET value = excluded.value`
+    ).run(PROFILE_STATE_META_REVISION, String(nextRevision))
+    return {
+      changed: true,
+      revision: nextRevision,
+      changedDomains: updates.map(({ domain }) => domain)
+    }
+  })
+}
diff --git a/src/main/persistence/profile-state/profile-state-fragment-validation.test.ts b/src/main/persistence/profile-state/profile-state-fragment-validation.test.ts
new file mode 100644
index 000000000000..1fcb85eb108c
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-fragment-validation.test.ts
@@ -0,0 +1,132 @@
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { Store } from '../loading-store/store'
+import { openProfileStateDatabase } from './profile-state-database'
+import {
+  hashProfileStateJson,
+  importProfileStateJson,
+  readProfileStateSnapshot,
+  readProfileStateParsedSnapshot,
+  validateProfileStateSnapshot
+} from './profile-state-documents'
+import { ProfileStateSqliteAuthority } from './profile-state-sqlite-authority'
+import { createProfileStateStore } from './profile-state-store-factory'
+
+vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
+vi.mock('../../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: () => ({ nth_repo_added: 2 })
+}))
+vi.mock('../../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: () => ({ hosts: [] }),
+  sshConfigHostsToTargets: () => []
+}))
+
+const directories: string[] = []
+
+afterEach(() => {
+  for (const directory of directories.splice(0)) {
+    rmSync(directory, { recursive: true, force: true })
+  }
+})
+
+function fixture(keepJson = false) {
+  const directory = mkdtempSync(join(tmpdir(), 'orca-profile-fragments-'))
+  directories.push(directory)
+  const paths = {
+    dataFile: join(directory, 'orca-data.json'),
+    databaseFile: join(directory, 'profile-state.db'),
+    profileId: 'fragment-validation'
+  }
+  const source = JSON.stringify({
+    settings: { theme: 'dark' },
+    futureDomain: null,
+    automationRuns: [{ id: 'a' }, { id: 'b' }]
+  })
+  if (keepJson) {
+    writeFileSync(paths.dataFile, source)
+  }
+  const { db } = openProfileStateDatabase(paths.databaseFile, paths.profileId)
+  importProfileStateJson(db, source, { acceptedLegacyJsonHash: hashProfileStateJson(source) })
+  return { paths, db }
+}
+
+describe('independent profile state JSON fragments', () => {
+  it.each([false, true])(
+    'rejects a domain that injects a valid sibling into startup JSON (retained JSON: %s)',
+    (keepJson) => {
+      const { paths, db } = fixture(keepJson)
+      const payload = 'null,"settings":{"theme":"light"}'
+      db.prepare(
+        'UPDATE profile_state_documents SET payload = ?, content_hash = ? WHERE domain = ?'
+      ).run(payload, hashProfileStateJson(payload), 'futureDomain')
+      expect(() => readProfileStateParsedSnapshot(db)).toThrow(/invalid JSON: futureDomain/)
+      expect(() => validateProfileStateSnapshot(db)).toThrow(/invalid JSON: futureDomain/)
+      db.close()
+
+      expect(() => {
+        const result = createProfileStateStore({ ...paths })
+        result.store.freezeWrites()
+      }).toThrow()
+    }
+  )
+
+  it('rejects a spliced domain through direct authority and Store reads', () => {
+    const { paths, db } = fixture()
+    const payload = 'null,"settings":{"theme":"light"}'
+    db.prepare(
+      'UPDATE profile_state_documents SET payload = ?, content_hash = ? WHERE domain = ?'
+    ).run(payload, hashProfileStateJson(payload), 'futureDomain')
+    db.close()
+    const authority = new ProfileStateSqliteAuthority(paths.databaseFile, paths.profileId)
+    try {
+      expect(() => {
+        const store = new Store({ dataFile: paths.dataFile, profileStateAuthority: authority })
+        store.freezeWrites()
+      }).toThrow(/invalid JSON: futureDomain/)
+      expect(() => authority.readSerializedState()).toThrow(/invalid JSON: futureDomain/)
+    } finally {
+      authority.close()
+    }
+  })
+
+  it.each(['snapshot', 'parsed', 'validated', 'authority', 'store'] as const)(
+    'rejects history rows that form a valid array only when spliced together (%s)',
+    (boundary) => {
+      const { paths, db } = fixture()
+      const payloads = ['{"id":"a","text":"', 'b"},{"id":"b"}']
+      const aggregate = `[${payloads.join(',')}]`
+      expect(JSON.parse(aggregate)).toEqual([{ id: 'a', text: ',b' }, { id: 'b' }])
+      for (const [ordinal, payload] of payloads.entries()) {
+        expect(() => JSON.parse(payload)).toThrow()
+        db.prepare(
+          'UPDATE profile_state_automation_runs SET payload = ?, content_hash = ? WHERE ordinal = ?'
+        ).run(payload, hashProfileStateJson(payload), ordinal)
+      }
+      db.prepare('UPDATE profile_state_automation_runs_meta SET content_hash = ?').run(
+        hashProfileStateJson(aggregate)
+      )
+      const authority = new ProfileStateSqliteAuthority(paths.databaseFile, paths.profileId)
+      try {
+        expect(() => {
+          if (boundary === 'snapshot') {
+            readProfileStateSnapshot(db)
+          } else if (boundary === 'parsed') {
+            readProfileStateParsedSnapshot(db)
+          } else if (boundary === 'validated') {
+            validateProfileStateSnapshot(db)
+          } else if (boundary === 'authority') {
+            authority.readSerializedState()
+          } else {
+            const store = new Store({ dataFile: paths.dataFile, profileStateAuthority: authority })
+            store.freezeWrites()
+          }
+        }).toThrow('Normalized automationRuns row is invalid JSON')
+      } finally {
+        authority.close()
+        db.close()
+      }
+    }
+  )
+})
diff --git a/src/main/persistence/profile-state/profile-state-json-compatibility-recovery.test.ts b/src/main/persistence/profile-state/profile-state-json-compatibility-recovery.test.ts
new file mode 100644
index 000000000000..ed02b9ba43e1
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-json-compatibility-recovery.test.ts
@@ -0,0 +1,239 @@
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import * as durableFiles from '../../durable-file-write'
+import { openProfileStateDatabase } from './profile-state-database'
+import {
+  hashProfileStateJson,
+  importProfileStateJson,
+  readProfileStateJsonAcceptance
+} from './profile-state-documents'
+import { ProfileStateSqliteAuthority } from './profile-state-sqlite-authority'
+import { createProfileStateStore } from './profile-state-store-factory'
+
+vi.mock('electron', () => ({
+  app: {
+    getPath: () => tmpdir(),
+    getName: () => 'orca-test',
+    getVersion: () => '0.0.0-test',
+    isPackaged: false,
+    on: () => {},
+    whenReady: () => Promise.resolve()
+  },
+  safeStorage: { isEncryptionAvailable: () => false },
+  ipcMain: { on: () => {}, handle: () => {} },
+  BrowserWindow: { getAllWindows: () => [] }
+}))
+vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
+vi.mock('../../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: () => ({ nth_repo_added: 2 })
+}))
+vi.mock('../../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: () => ({ hosts: [] }),
+  sshConfigHostsToTargets: () => []
+}))
+
+const fixtures: { directory: string; authority: ProfileStateSqliteAuthority }[] = []
+
+afterEach(() => {
+  vi.restoreAllMocks()
+  for (const { authority, directory } of fixtures.splice(0)) {
+    authority.close()
+    rmSync(directory, { recursive: true, force: true })
+  }
+})
+
+function fixture() {
+  const directory = mkdtempSync(join(tmpdir(), 'orca-json-compatibility-recovery-'))
+  const paths = {
+    dataFile: join(directory, 'orca-data.json'),
+    databaseFile: join(directory, 'profile-state.db'),
+    profileId: 'compatibility-recovery'
+  }
+  const retainedJson = '{"settings":{"theme":"light"}}'
+  writeFileSync(paths.dataFile, retainedJson)
+  const withDatabase = <T>(
+    run: (db: ReturnType<typeof openProfileStateDatabase>['db']) => T
+  ): T => {
+    const opened = openProfileStateDatabase(paths.databaseFile, paths.profileId)
+    try {
+      return run(opened.db)
+    } finally {
+      opened.db.close()
+    }
+  }
+  withDatabase((db) =>
+    importProfileStateJson(db, retainedJson, {
+      acceptedLegacyJsonHash: hashProfileStateJson(retainedJson)
+    })
+  )
+  const authority = new ProfileStateSqliteAuthority(paths.databaseFile, paths.profileId)
+  authority.readSerializedState()
+  authority.writeSerializedState(Buffer.from('{"settings":{"theme":"dark"}}'))
+  fixtures.push({ directory, authority })
+  return {
+    paths,
+    authority,
+    retainedJson,
+    withDatabase,
+    acceptance: () => withDatabase(readProfileStateJsonAcceptance),
+    publish: async (mode: 'sync' | 'async') =>
+      mode === 'sync'
+        ? authority.writeJsonCompatibilityExport(paths.dataFile)
+        : authority.writeJsonCompatibilityExportAsync(paths.dataFile),
+    reopen: () => {
+      const result = createProfileStateStore({ ...paths })
+      try {
+        expect(result.backend).toBe('sqlite')
+        return result.store.getSettings().theme
+      } finally {
+        result.store.freezeWrites()
+      }
+    }
+  }
+}
+
+describe.each(['sync', 'async'] as const)('%s compatibility export recovery', (mode) => {
+  it.each(['staging', 'publication', 'promotion'] as const)(
+    'reopens SQLite and permits a later export after failed %s',
+    async (phase) => {
+      const state = fixture()
+      if (phase === 'publication') {
+        if (mode === 'sync') {
+          const write = durableFiles.writeFileDurableSync
+          vi.spyOn(durableFiles, 'writeFileDurableSync').mockImplementation((...args) => {
+            if (args[1] === state.paths.dataFile) {
+              throw new Error('injected publication failure')
+            }
+            write(...args)
+          })
+        } else {
+          vi.spyOn(durableFiles, 'writeFileDurable').mockRejectedValueOnce(
+            new Error('injected publication failure')
+          )
+        }
+      } else {
+        state.withDatabase((db) =>
+          db.exec(
+            `CREATE TRIGGER reject_acceptance BEFORE INSERT ON profile_state_meta
+           WHEN NEW.key = 'legacy_json_acceptance'
+           ${phase === 'promotion' ? "AND json_type(NEW.value, '$.pending') IS NULL" : ''}
+           BEGIN SELECT RAISE(ABORT, 'injected acceptance failure'); END`
+          )
+        )
+      }
+
+      await expect(state.publish(mode)).rejects.toThrow('injected')
+
+      const published = readFileSync(state.paths.dataFile, 'utf8')
+      expect(JSON.parse(published).settings.theme).toBe(phase === 'promotion' ? 'dark' : 'light')
+      expect(state.reopen()).toBe('dark')
+      if (phase !== 'staging') {
+        expect(state.acceptance()?.pending).toEqual({
+          jsonHash: hashProfileStateJson('{"settings":{"theme":"dark"}}'),
+          acceptedRevision: 2
+        })
+      }
+      vi.restoreAllMocks()
+      state.withDatabase((db) => db.exec('DROP TRIGGER IF EXISTS reject_acceptance'))
+      state.authority.writeSerializedState(Buffer.from('{"settings":{"theme":"system"}}'))
+
+      await state.publish(mode)
+
+      expect(state.reopen()).toBe('system')
+      expect(state.acceptance()).toEqual({
+        jsonHash: hashProfileStateJson(readFileSync(state.paths.dataFile, 'utf8')),
+        acceptedRevision: 3
+      })
+    }
+  )
+
+  it('keeps the published JSON accepted when a concurrent commit prevents promotion', async () => {
+    const state = fixture()
+    const compete = () => {
+      const other = new ProfileStateSqliteAuthority(state.paths.databaseFile, state.paths.profileId)
+      try {
+        other.readSerializedState()
+        other.writeSerializedState(Buffer.from('{"settings":{"theme":"system"}}'))
+      } finally {
+        other.close()
+      }
+    }
+    if (mode === 'sync') {
+      const write = durableFiles.writeFileDurableSync
+      vi.spyOn(durableFiles, 'writeFileDurableSync').mockImplementation((...args) => {
+        write(...args)
+        if (args[1] === state.paths.dataFile) {
+          compete()
+        }
+      })
+    } else {
+      const write = durableFiles.writeFileDurable
+      vi.spyOn(durableFiles, 'writeFileDurable').mockImplementationOnce(async (...args) => {
+        await write(...args)
+        compete()
+      })
+    }
+
+    await expect(state.publish(mode)).rejects.toMatchObject({
+      code: 'profile-state-revision-conflict'
+    })
+
+    expect(JSON.parse(readFileSync(state.paths.dataFile, 'utf8')).settings.theme).toBe('dark')
+    expect(state.reopen()).toBe('system')
+    expect(state.acceptance()?.pending?.acceptedRevision).toBe(2)
+  })
+
+  it('refuses an unrelated edit even while a previous export remains staged', async () => {
+    const state = fixture()
+    if (mode === 'sync') {
+      const write = durableFiles.writeFileDurableSync
+      vi.spyOn(durableFiles, 'writeFileDurableSync').mockImplementation((...args) => {
+        if (args[1] === state.paths.dataFile) {
+          throw new Error('injected publication failure')
+        }
+        write(...args)
+      })
+    } else {
+      vi.spyOn(durableFiles, 'writeFileDurable').mockRejectedValueOnce(
+        new Error('injected publication failure')
+      )
+    }
+    await expect(state.publish(mode)).rejects.toThrow('injected')
+    expect(state.acceptance()?.pending).toEqual({
+      jsonHash: hashProfileStateJson('{"settings":{"theme":"dark"}}'),
+      acceptedRevision: 2
+    })
+    const unrelatedJson = '{"settings":{"theme":"system"},"unrelatedEdit":true}'
+    writeFileSync(state.paths.dataFile, unrelatedJson)
+
+    expect(state.reopen).toThrow('without a matching acceptance marker')
+    await expect(state.publish(mode)).rejects.toThrow('Compatibility JSON changed before export')
+    expect(readFileSync(state.paths.dataFile, 'utf8')).toBe(unrelatedJson)
+  })
+})
+
+it.each([
+  null,
+  [],
+  { jsonHash: 'invalid', acceptedRevision: 2 },
+  { jsonHash: 'a'.repeat(64), acceptedRevision: 0 },
+  { jsonHash: 'a'.repeat(64), acceptedRevision: 1.5 },
+  { jsonHash: 'a'.repeat(64), acceptedRevision: 3 }
+])('refuses malformed or impossible pending acceptance %#', (pending) => {
+  const state = fixture()
+  state.withDatabase((db) =>
+    db.prepare('UPDATE profile_state_meta SET value = ? WHERE key = ?').run(
+      JSON.stringify({
+        jsonHash: hashProfileStateJson(state.retainedJson),
+        acceptedRevision: 1,
+        pending
+      }),
+      'legacy_json_acceptance'
+    )
+  )
+  expect(state.reopen).toThrow()
+  expect(() => state.authority.writeJsonCompatibilityExport(state.paths.dataFile)).toThrow()
+  expect(readFileSync(state.paths.dataFile, 'utf8')).toBe(state.retainedJson)
+})
diff --git a/src/main/persistence/profile-state/profile-state-large-recovery-crash.test.ts b/src/main/persistence/profile-state/profile-state-large-recovery-crash.test.ts
new file mode 100644
index 000000000000..3c0096b1849c
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-large-recovery-crash.test.ts
@@ -0,0 +1,149 @@
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { basename, join } from 'node:path'
+import { afterAll, afterEach, beforeAll, describe, expect, it } from 'vitest'
+import { acquireProfileStateMaintenance } from './profile-state-access'
+import {
+  createProfileStateDatabaseBackupId,
+  profileStateDatabaseBackupPath
+} from './profile-state-backup-path'
+import {
+  openProfileStateDatabase,
+  openProfileStateDatabaseReadOnly
+} from './profile-state-database'
+import { restoreProfileStateDatabaseBackup } from './profile-state-database-recovery'
+import { writeProfileStateDatabaseSnapshotAsync } from './profile-state-database-snapshot'
+import { importProfileStateJson, readProfileStateSnapshot } from './profile-state-documents'
+import { profileStateJsonExportPath } from './legacy-json/profile-state-export-path'
+import { buildRecoveryCrashProcess, killRecoveryAt } from './profile-state-recovery-crash-process'
+
+const suite = mkdtempSync(join(tmpdir(), 'orca-large-recovery-crash-'))
+const roots: string[] = []
+const profileId = 'large-recovery'
+const oldJson = JSON.stringify({ opaque: 'x'.repeat(8 * 1024 * 1024), revision: 'old' })
+const selectedJson = JSON.stringify({ opaque: 'y'.repeat(8 * 1024 * 1024), revision: 'selected' })
+let bundle: string
+beforeAll(() => {
+  bundle = buildRecoveryCrashProcess(suite)
+})
+afterEach(() => {
+  for (const root of roots.splice(0)) {
+    rmSync(root, { recursive: true, force: true })
+  }
+})
+afterAll(() => rmSync(suite, { recursive: true, force: true }))
+
+async function fixture() {
+  const root = mkdtempSync(join(suite, 'profile-'))
+  roots.push(root)
+  const directory = join(root, 'profiles', profileId)
+  mkdirSync(directory, { recursive: true })
+  const databasePath = join(directory, 'profile-state.db')
+  const dataFile = join(directory, 'orca-data.json')
+  const backupPath = profileStateDatabaseBackupPath(
+    databasePath,
+    createProfileStateDatabaseBackupId()
+  )
+  const db = openProfileStateDatabase(databasePath, profileId).db
+  try {
+    importProfileStateJson(db, oldJson)
+    importProfileStateJson(db, oldJson)
+    importProfileStateJson(db, selectedJson)
+    await writeProfileStateDatabaseSnapshotAsync(db, backupPath)
+  } finally {
+    db.close()
+  }
+  const options = {
+    root,
+    directory,
+    profileId,
+    databasePath,
+    dataFile,
+    backupPath,
+    exportPath: profileStateJsonExportPath(dataFile, 3),
+    markerPath: join(root, 'http1-compatibility.json'),
+    kind: 'sqlite' as const
+  }
+  await killRecoveryAt(bundle, options, 'seed', oldJson)
+  expect(existsSync(`${databasePath}-wal`)).toBe(true)
+  const originalFamily = new Map(
+    ['', '-wal', '-shm'].map((suffix) => [suffix, readFileSync(databasePath + suffix)])
+  )
+  return { ...options, originalFamily, backupBytes: readFileSync(backupPath) }
+}
+
+function snapshot(path: string) {
+  const db = openProfileStateDatabaseReadOnly(path, profileId).db
+  try {
+    const { json, revision } = readProfileStateSnapshot(db)
+    return { json, revision }
+  } finally {
+    db.close()
+  }
+}
+
+const boundaries = [
+  ...(process.platform === 'darwin'
+    ? [
+        'clone:1:before',
+        'clone:1:after',
+        'clone:2:before',
+        'clone:2:after',
+        'clone:3:after',
+        'clone:4:after'
+      ]
+    : []),
+  'primary',
+  'sqlite-publish:before',
+  'sqlite-publish:after'
+]
+
+describe('large independent recovery copies under process death', () => {
+  it.each(boundaries)(
+    'preserves exact backup and retry state after %s',
+    async (boundary) => {
+      const profile = await fixture()
+      const stage = boundary === 'primary' ? `removed:${profile.databasePath}` : boundary
+      await killRecoveryAt(bundle, profile, stage)
+      expect(readFileSync(profile.backupPath).equals(profile.backupBytes)).toBe(true)
+      if (boundary.startsWith('clone:')) {
+        for (const [suffix, bytes] of profile.originalFamily) {
+          expect(readFileSync(profile.databasePath + suffix).equals(bytes)).toBe(true)
+        }
+      } else {
+        const directory = readdirSync(profile.directory).find((name) =>
+          name.startsWith('profile-state-corrupt-')
+        )
+        if (directory === undefined) {
+          throw new Error('Recovery did not preserve a quarantine')
+        }
+        for (const [suffix, bytes] of profile.originalFamily) {
+          expect(
+            readFileSync(join(profile.directory, directory, `profile-state.db${suffix}`)).equals(
+              bytes
+            )
+          ).toBe(true)
+        }
+        expect(
+          readFileSync(join(profile.directory, directory, basename(profile.backupPath))).equals(
+            profile.backupBytes
+          )
+        ).toBe(true)
+        if (boundary === 'sqlite-publish:after') {
+          expect(snapshot(profile.databasePath)).toEqual({ json: selectedJson, revision: 3 })
+        } else {
+          expect(existsSync(profile.databasePath)).toBe(false)
+        }
+      }
+      const maintenance = acquireProfileStateMaintenance(profile.root)
+      try {
+        restoreProfileStateDatabaseBackup({ ...profile, maintenance })
+      } finally {
+        maintenance.release()
+      }
+      expect(snapshot(profile.databasePath)).toEqual({ json: selectedJson, revision: 3 })
+      expect(readFileSync(profile.backupPath).equals(profile.backupBytes)).toBe(true)
+    },
+    30_000
+  )
+})
diff --git a/src/main/persistence/profile-state/profile-state-live-store-factory.test.ts b/src/main/persistence/profile-state/profile-state-live-store-factory.test.ts
new file mode 100644
index 000000000000..b96d09d44f36
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-live-store-factory.test.ts
@@ -0,0 +1,215 @@
+import { build } from 'esbuild'
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join, resolve } from 'node:path'
+import { afterAll, afterEach, beforeAll, describe, expect, it, vi } from 'vitest'
+import { agentHookServer } from '../../agent-hooks/server'
+import { buildProfileStateCutoverFixture } from '../profile-state-cutover-fixture'
+import type { Store } from '../loading-store/store'
+import { ProfileStateSqliteAuthority } from './profile-state-sqlite-authority'
+import { createLiveProfileStateStore } from './profile-state-live-store-factory'
+import {
+  profileStateJsonExportPath,
+  profileStateJsonExportPaths
+} from './legacy-json/profile-state-export-path'
+
+vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
+vi.mock('../../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: () => ({ nth_repo_added: 2 })
+}))
+vi.mock('../../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: () => ({ hosts: [] }),
+  sshConfigHostsToTargets: () => []
+}))
+
+let bundleRoot: string
+let workerOptions: { workerPath: string; backupWorkerPath: string }
+const roots: string[] = []
+const stores: Store[] = []
+
+beforeAll(async () => {
+  bundleRoot = mkdtempSync(join(tmpdir(), 'orca-live-writer-bundle-'))
+  workerOptions = {
+    workerPath: join(bundleRoot, 'profile-state-writer-worker-entry.js'),
+    backupWorkerPath: join(bundleRoot, 'profile-state-backup-worker-entry.js')
+  }
+  await build({
+    entryPoints: [
+      resolve('src/main/persistence/profile-state/profile-state-writer-worker-entry.ts'),
+      resolve('src/main/persistence/profile-state/profile-state-backup-worker-entry.ts')
+    ],
+    outdir: bundleRoot,
+    bundle: true,
+    platform: 'node',
+    format: 'cjs',
+    logLevel: 'silent'
+  })
+})
+
+afterEach(async () => {
+  await Promise.all(stores.splice(0).map((store) => store.freezeWritesAsync()))
+  for (const root of roots.splice(0)) {
+    rmSync(root, { recursive: true, force: true })
+  }
+  vi.restoreAllMocks()
+})
+afterAll(() => rmSync(bundleRoot, { recursive: true, force: true }))
+
+function options() {
+  const root = mkdtempSync(join(tmpdir(), 'orca-live-profile-'))
+  roots.push(root)
+  return {
+    dataFile: join(root, 'orca-data.json'),
+    databaseFile: join(root, 'profile-state.db'),
+    profileId: 'live-profile-test'
+  }
+}
+
+async function open(input: ReturnType<typeof options>) {
+  const result = await createLiveProfileStateStore(input, workerOptions)
+  stores.push(result.store)
+  return result
+}
+
+function readState(input: ReturnType<typeof options>) {
+  const reader = new ProfileStateSqliteAuthority(input.databaseFile, input.profileId)
+  try {
+    return JSON.parse(reader.readSerializedState() ?? '{}')
+  } finally {
+    reader.close()
+  }
+}
+
+describe('live profile authority admission', () => {
+  it.each([false, true])(
+    'hands unbound aliases to admitted startup only (worker refused=%s)',
+    async (refused) => {
+      const input = options()
+      const source = buildProfileStateCutoverFixture(join(input.dataFile, '..'))
+      const session = source.workspaceSession
+      for (const tab of Object.values(session.tabsByWorktree).flat()) {
+        tab.ptyId = null
+      }
+      session.terminalLayoutsByTabId['tab-local'] = {
+        root: { type: 'leaf', leafId: 'pane:1' },
+        activeLeafId: 'pane:1',
+        expandedLeafId: null,
+        ptyIdsByLeafId: {}
+      }
+      writeFileSync(input.dataFile, JSON.stringify(source))
+      const register = vi.spyOn(agentHookServer, 'registerPaneKeyAlias')
+      if (refused) {
+        await expect(
+          createLiveProfileStateStore(input, {
+            workerPath: join(input.dataFile, '..', 'missing-worker.js')
+          })
+        ).rejects.toThrow()
+        expect(register).not.toHaveBeenCalled()
+        return
+      }
+      const { store } = await open(input)
+      const leafId = store.getWorkspaceSession().terminalLayoutsByTabId['tab-local'].activeLeafId
+      const userDataPath = join(input.dataFile, '..')
+      mkdirSync(join(userDataPath, 'agent-hooks'), { recursive: true })
+      writeFileSync(
+        join(userDataPath, 'agent-hooks', 'last-status.json'),
+        JSON.stringify({
+          version: 2,
+          entries: {
+            'tab-local:1': {
+              paneKey: 'tab-local:1',
+              tabId: 'tab-local',
+              worktreeId: 'repo-local::/fixture/local',
+              connectionId: null,
+              receivedAt: Date.now(),
+              stateStartedAt: Date.now(),
+              payload: { state: 'working', prompt: 'legacy cached', agentType: 'claude' }
+            }
+          }
+        })
+      )
+      try {
+        await agentHookServer.start({ env: 'production', userDataPath })
+        expect(agentHookServer.getStatusSnapshot()).toContainEqual(
+          expect.objectContaining({
+            paneKey: `tab-local:${leafId}`,
+            prompt: 'legacy cached'
+          })
+        )
+      } finally {
+        agentHookServer.stop()
+      }
+    }
+  )
+
+  it('migrates once, loads admitted state and reopens worker-acknowledged writes', async () => {
+    const input = options()
+    writeFileSync(
+      input.dataFile,
+      JSON.stringify(buildProfileStateCutoverFixture(join(input.dataFile, '..')))
+    )
+    const { store, migrated, backend } = await open(input)
+    expect({ migrated, backend }).toEqual({ migrated: true, backend: 'sqlite' })
+    store.updateSettings({ theme: 'dark' })
+    await store.flushPendingOrThrowAsync()
+    await store.freezeWritesAsync()
+    const reopened = await open(input)
+    expect(reopened.migrated).toBe(false)
+    expect(reopened.store.getSettings().theme).toBe('dark')
+    expect(readState(input).automationRuns).toHaveLength(1)
+  })
+
+  it('never adopts a competing revision between bootstrap and worker readiness', async () => {
+    const input = options()
+    const original = ProfileStateSqliteAuthority.prototype.retireForWorker
+    vi.spyOn(ProfileStateSqliteAuthority.prototype, 'retireForWorker').mockImplementation(function (
+      this: ProfileStateSqliteAuthority
+    ) {
+      const handoff = original.call(this)
+      const peer = new ProfileStateSqliteAuthority(input.databaseFile, input.profileId)
+      try {
+        peer.readSerializedState()
+        peer.writeSerializedDomains([{ domain: 'peer', payload: '{"retained":true}' }])
+      } finally {
+        peer.close()
+      }
+      return handoff
+    })
+    await expect(open(input)).rejects.toThrow('Profile state revision changed')
+    expect(readState(input).peer).toEqual({ retained: true })
+  })
+
+  it('refuses startup when the worker is unavailable without selecting JSON', async () => {
+    const input = options()
+    await expect(
+      createLiveProfileStateStore(input, { workerPath: join(bundleRoot, 'missing.js') })
+    ).rejects.toThrow('Profile state writer')
+    expect(() => readFileSync(input.dataFile)).toThrow()
+    const reopened = await open(input)
+    expect(reopened.backend).toBe('sqlite')
+  })
+
+  it('orders exports with full checkpoints and closes backup and writer handles on final flush', async () => {
+    const input = options()
+    const { store } = await open(input)
+    store.getWorkspaceSession().activeTabId = 'getter-export'
+    store.updateSettings({ theme: 'dark' })
+    const revision = await store.writeLatestProfileStateJsonExportAsync()
+    expect(revision).toBeTypeOf('number')
+    if (revision === undefined) {
+      throw new Error('Expected a persisted profile revision')
+    }
+    expect(
+      JSON.parse(readFileSync(profileStateJsonExportPath(input.dataFile, revision), 'utf8'))
+        .workspaceSession.activeTabId
+    ).toBe('getter-export')
+    store.updateSettings({ theme: 'light' })
+    await store.flushFinalOrThrowAsync({ exportJsonCompatibility: true })
+    expect(JSON.parse(readFileSync(input.dataFile, 'utf8')).settings.theme).toBe('light')
+    expect(profileStateJsonExportPaths(input.dataFile).length).toBeGreaterThan(0)
+    expect(readState(input).settings.theme).toBe('light')
+    await expect(store.flushPendingOrThrowAsync()).rejects.toThrow('finalized')
+    const reopened = await open(input)
+    expect(reopened.store.getSettings().theme).toBe('light')
+  })
+})
diff --git a/src/main/persistence/profile-state/profile-state-live-store-factory.ts b/src/main/persistence/profile-state/profile-state-live-store-factory.ts
new file mode 100644
index 000000000000..8a5e29c46e85
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-live-store-factory.ts
@@ -0,0 +1,52 @@
+import { Store } from '../loading-store/store'
+import {
+  prepareProfileStateStore,
+  type ProfileStateStoreFactoryOptions,
+  type ProfileStateStoreFactoryResult
+} from './profile-state-store-factory'
+import { ProfileStateWorkerAuthority } from './profile-state-worker-authority'
+
+/** Publish live state only after its exact bootstrap revision has a worker owner. */
+export async function createLiveProfileStateStore(
+  options: ProfileStateStoreFactoryOptions,
+  workerOptions: {
+    workerPath?: string
+    backupWorkerPath?: string
+    onFailure?: (error: Error) => void
+  } = {}
+): Promise<ProfileStateStoreFactoryResult> {
+  const { initialState: initial, ...prepared } = prepareProfileStateStore(options)
+
+  // Consume before retirement: the bootstrap snapshot carries the original revision fence.
+  const parsed = initial.takeParsedState?.()
+  const serializedState = initial.serializedState
+  const authority = new ProfileStateWorkerAuthority(
+    initial.authority.retireForWorker(),
+    workerOptions
+  )
+  try {
+    await authority.ready
+    const initialAuthorityState = initial.takeParsedState
+      ? { authority, takeParsedState: () => parsed }
+      : { authority, serializedState }
+    return {
+      ...prepared,
+      store: new Store({
+        dataFile: options.dataFile,
+        storageAuthority: options.storageAuthority,
+        profileStateAuthority: authority,
+        initialAuthorityState: {
+          ...initialAuthorityState,
+          unboundPaneAliases: initial.unboundPaneAliases
+        }
+      })
+    }
+  } catch (error) {
+    try {
+      await authority.close()
+    } catch (closeError) {
+      console.error('[persistence] Failed to close a refused profile writer:', closeError)
+    }
+    throw error
+  }
+}
diff --git a/src/main/persistence/profile-state/profile-state-migration.ts b/src/main/persistence/profile-state/profile-state-migration.ts
new file mode 100644
index 000000000000..43705c44dee3
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-migration.ts
@@ -0,0 +1,86 @@
+import { randomUUID } from 'node:crypto'
+import { existsSync, mkdirSync, readFileSync, rmSync } from 'node:fs'
+import { dirname } from 'node:path'
+import { publishProfileStateDatabase } from './profile-state-database-publication'
+import { openProfileStateDatabase } from './profile-state-database'
+import { hashProfileStateJson, importProfileStateJson } from './profile-state-documents'
+import { writeVersionedProfileStateExport } from './legacy-json/profile-state-versioned-export'
+import { assertProfileStateCanInitialize } from './profile-state-recovery-required'
+import { ProfileStateSqliteAuthority } from './profile-state-sqlite-authority'
+import {
+  classifyProfileStateStorage,
+  profileStateDatabaseFiles
+} from './profile-state-storage-classification'
+import type { ProfileStateAuthorityInitialState } from '../loading-store/profile-state-authority'
+
+type ProfileStateMigrationOptions = {
+  dataFile: string
+  databaseFile: string
+  profileId: string
+  expectedLegacyJson: string | undefined
+  /** Storage-form state; inactive profiles retain sealed secrets without decrypting them. */
+  serializedState: string
+}
+
+/** Publish an imported database only after its complete source has committed durably. */
+export function migrateProfileStateToSqlite(options: ProfileStateMigrationOptions): {
+  authority: ProfileStateSqliteAuthority
+  initialState: ProfileStateAuthorityInitialState<ProfileStateSqliteAuthority>
+} {
+  assertMigrationSourceUnchanged(options)
+  mkdirSync(dirname(options.databaseFile), { recursive: true })
+  const temporaryDatabaseFile = `${options.databaseFile}.migration.${process.pid}.${randomUUID()}.tmp`
+  let published = false
+  try {
+    const opened = openProfileStateDatabase(temporaryDatabaseFile, options.profileId)
+    try {
+      importProfileStateJson(
+        opened.db,
+        options.serializedState,
+        options.expectedLegacyJson === undefined
+          ? {}
+          : { acceptedLegacyJsonHash: hashProfileStateJson(options.expectedLegacyJson) }
+      )
+    } finally {
+      opened.db.close()
+    }
+
+    // Closing checkpoints the temporary database before its canonical path becomes visible.
+    assertMigrationSourceUnchanged(options)
+    if (!publishProfileStateDatabase(temporaryDatabaseFile, options.databaseFile)) {
+      throw new Error('Profile state storage changed while importing legacy JSON')
+    }
+    published = true
+    const authority = new ProfileStateSqliteAuthority(options.databaseFile, options.profileId)
+    try {
+      writeVersionedProfileStateExport(options.dataFile, (path) => authority.writeJsonExport(path))
+      const initialState = authority.readInitialState()
+      return { authority, initialState }
+    } catch (error) {
+      authority.close()
+      throw error
+    }
+  } finally {
+    if (!published) {
+      for (const path of profileStateDatabaseFiles(temporaryDatabaseFile)) {
+        rmSync(path, { force: true })
+      }
+    }
+  }
+}
+
+function assertMigrationSourceUnchanged(options: ProfileStateMigrationOptions): void {
+  assertProfileStateCanInitialize(options)
+  const expectedClassification = options.expectedLegacyJson === undefined ? 'neither' : 'json-only'
+  if (
+    classifyProfileStateStorage(options.dataFile, options.databaseFile) !== expectedClassification
+  ) {
+    throw new Error('Profile state storage changed while importing legacy JSON')
+  }
+  const currentJson = existsSync(options.dataFile)
+    ? readFileSync(options.dataFile, 'utf8')
+    : undefined
+  if (currentJson !== options.expectedLegacyJson) {
+    throw new Error('Profile state JSON changed while importing legacy JSON')
+  }
+}
diff --git a/src/main/persistence/profile-state/profile-state-offline-settings.test.ts b/src/main/persistence/profile-state/profile-state-offline-settings.test.ts
new file mode 100644
index 000000000000..56f5cf0177cb
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-offline-settings.test.ts
@@ -0,0 +1,135 @@
+import { existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import {
+  readAgentHookSettingsFromProfileState,
+  updateAgentHookSettingsFromProfileState
+} from './profile-state-offline-settings'
+import * as exportPaths from './legacy-json/profile-state-export-path'
+import { ProfileStateRecoveryRequiredError } from './profile-state-recovery-required'
+import { ProfileStateSqliteAuthority } from './profile-state-sqlite-authority'
+
+const directories: string[] = []
+afterEach(() => {
+  vi.restoreAllMocks()
+  for (const directory of directories.splice(0)) {
+    rmSync(directory, { recursive: true, force: true })
+  }
+})
+
+function createLocation() {
+  const directory = mkdtempSync(join(tmpdir(), 'orca-offline-settings-'))
+  directories.push(directory)
+  return {
+    dataFile: join(directory, 'orca-data.json'),
+    databaseFile: join(directory, 'orca-state.db'),
+    profileId: 'profile-offline'
+  }
+}
+
+describe.each(['json', 'sqlite'] as const)('offline settings %s updates', (backend) => {
+  it('filters malformed hook settings for callers while preserving their stored values', () => {
+    const location = createLocation()
+    const original = {
+      settings: {
+        agentStatusHooksEnabled: true,
+        agentCmdOverrides: { codex: 42, claude: 'claude --model opus', gemini: null },
+        disabledTuiAgents: ['codex', false, 'future-agent', 'codex'],
+        futureSetting: { preserved: true }
+      },
+      futureDomain: { preserved: ['雪', null] }
+    }
+    const authority = new ProfileStateSqliteAuthority(location.databaseFile, location.profileId)
+    try {
+      if (backend === 'sqlite') {
+        authority.writeSerializedState(Buffer.from(JSON.stringify(original)))
+        authority.close()
+      } else {
+        writeFileSync(location.dataFile, JSON.stringify(original))
+      }
+
+      expect(updateAgentHookSettingsFromProfileState(location, false)).toEqual({
+        settingsPath: location.databaseFile,
+        settings: {
+          agentCmdOverrides: { claude: 'claude --model opus' },
+          disabledTuiAgents: ['codex', 'future-agent', 'codex']
+        }
+      })
+      const persisted = authority.readSerializedState()
+      if (backend === 'json') {
+        expect(readFileSync(location.dataFile, 'utf8')).toBe(JSON.stringify(original))
+      }
+      expect(JSON.parse(persisted ?? 'null')).toMatchObject({
+        ...original,
+        settings: { ...original.settings, agentStatusHooksEnabled: false }
+      })
+    } finally {
+      authority.close()
+    }
+  })
+})
+
+describe.each(['read', 'update'] as const)('offline settings %s recovery', (operation) => {
+  function run(location: ReturnType<typeof createLocation>) {
+    return operation === 'read'
+      ? readAgentHookSettingsFromProfileState(location)
+      : updateAgentHookSettingsFromProfileState(location, false)
+  }
+
+  it.each([true, false])('rejects retained exports with JSON present=%s', (hasJson) => {
+    const location = createLocation()
+    const source = JSON.stringify({ settings: { agentStatusHooksEnabled: true } })
+    if (hasJson) {
+      writeFileSync(location.dataFile, source)
+    }
+    const exportFile = exportPaths.profileStateJsonExportPath(location.dataFile, 1)
+    writeFileSync(exportFile, source)
+    // Recovery detection must also work in the Node 18 fallback without SQLite.
+    vi.spyOn(process, 'getBuiltinModule').mockReturnValue(undefined)
+
+    expect(() => run(location)).toThrowError(ProfileStateRecoveryRequiredError)
+    expect(existsSync(location.databaseFile)).toBe(false)
+    expect(existsSync(location.dataFile)).toBe(hasJson)
+    expect(readFileSync(exportFile, 'utf8')).toBe(source)
+    if (hasJson) {
+      expect(readFileSync(location.dataFile, 'utf8')).toBe(source)
+    }
+  })
+
+  it.each([0, 1, 2, 3, 4])('refuses defaults when only legacy backup %s remains', (slot) => {
+    const location = createLocation()
+    const backup = `${location.dataFile}.bak.${slot}`
+    const source = '{"settings":{"agentStatusHooksEnabled":false}}'
+    writeFileSync(backup, source)
+
+    expect(() => run(location)).toThrow('restore a selected backup')
+    expect(existsSync(location.dataFile)).toBe(false)
+    expect(existsSync(location.databaseFile)).toBe(false)
+    expect(readFileSync(backup, 'utf8')).toBe(source)
+  })
+
+  it('fails closed when retained exports cannot be enumerated', () => {
+    const location = createLocation()
+    vi.spyOn(exportPaths, 'profileStateJsonExportPaths').mockImplementation(() => {
+      throw new Error('permission denied')
+    })
+
+    expect(() => run(location)).toThrowError(ProfileStateRecoveryRequiredError)
+    expect(existsSync(location.dataFile)).toBe(false)
+    expect(existsSync(location.databaseFile)).toBe(false)
+  })
+
+  it.each(['-wal', '-shm', '-journal'])('rejects stale JSON when only %s remains', (suffix) => {
+    const location = createLocation()
+    const source = JSON.stringify({ settings: { agentStatusHooksEnabled: true } })
+    writeFileSync(location.dataFile, source)
+    const sidecar = `${location.databaseFile}${suffix}`
+    writeFileSync(sidecar, 'orphaned recovery evidence')
+
+    expect(() => run(location)).toThrow()
+    expect(readFileSync(location.dataFile, 'utf8')).toBe(source)
+    expect(existsSync(location.databaseFile)).toBe(false)
+    expect(readFileSync(sidecar, 'utf8')).toBe('orphaned recovery evidence')
+  })
+})
diff --git a/src/main/persistence/profile-state/profile-state-offline-settings.ts b/src/main/persistence/profile-state/profile-state-offline-settings.ts
new file mode 100644
index 000000000000..1c7c85c3980f
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-offline-settings.ts
@@ -0,0 +1,190 @@
+import { existsSync, readFileSync } from 'node:fs'
+import { homedir } from 'node:os'
+import type { GlobalSettings } from '../../../shared/global-settings-types'
+import { getDefaultPersistedState } from '../../../shared/constants'
+import { normalizeDisabledTuiAgents } from '../../../shared/tui-agent-selection'
+import { profileStateJsonMatchesAcceptance } from './profile-state-documents'
+import { isRecord, parseProfileStateRoot } from './profile-state-document-validation'
+import {
+  isProfileStateSqliteAvailable,
+  openProfileStateDatabase,
+  openProfileStateDatabaseReadOnly
+} from './profile-state-database'
+import {
+  readProfileStateDomains,
+  readProfileStateDomainsWithRevisionFromDatabase
+} from './profile-state-domain-reader'
+import { writeProfileStateDomain } from './profile-state-domain-writes'
+import { assertProfileStateCanInitialize } from './profile-state-recovery-required'
+import { classifyProfileStateStorage } from './profile-state-storage-classification'
+import { migrateProfileStateToSqlite } from './profile-state-migration'
+
+export type ProfileStateOfflineLocation = {
+  dataFile: string
+  databaseFile: string
+  profileId: string
+}
+
+export type AgentHookSettings = Pick<
+  GlobalSettings,
+  'agentStatusHooksEnabled' | 'disabledTuiAgents'
+>
+
+export type AgentHookSettingsUpdate = {
+  settings: Pick<GlobalSettings, 'agentCmdOverrides' | 'disabledTuiAgents'>
+  settingsPath: string
+}
+
+/** Read the settings domain without creating SQLite for a JSON-only profile. */
+export function readAgentHookSettingsFromProfileState(
+  location: ProfileStateOfflineLocation
+): AgentHookSettings {
+  const classification = classifyProfileStateStorage(location.dataFile, location.databaseFile)
+  if (classification === 'json-only' || classification === 'neither') {
+    assertProfileStateCanInitialize(location)
+    return readAgentHookSettingsFromJson(location.dataFile)
+  }
+
+  assertSqliteCapability()
+  assertAcceptedLegacyJson(location, classification)
+  const result = readProfileStateDomains(location.databaseFile, location.profileId, ['settings'])
+  if (result.kind === 'unreadable') {
+    throw result.error
+  }
+  return readAgentHookSettingsFromSettingsValue(result.values.get('settings'))
+}
+
+/**
+ * Update only the settings row in an existing SQLite authority.
+ *
+ * The snapshot revision is checked again by BEGIN IMMEDIATE, so a runtime
+ * writer between read and update produces a conflict instead of clobbering it.
+ */
+export function updateAgentHookSettingsInProfileState(
+  location: ProfileStateOfflineLocation,
+  enabled: boolean
+): AgentHookSettingsUpdate {
+  const classification = classifyProfileStateStorage(location.dataFile, location.databaseFile)
+  if (classification === 'json-only' || classification === 'neither') {
+    throw new Error('SQLite profile state is not established for this profile')
+  }
+
+  assertSqliteCapability()
+  assertAcceptedLegacyJson(location, classification)
+  const opened = openProfileStateDatabase(location.databaseFile, location.profileId)
+  try {
+    const domains = readProfileStateDomainsWithRevisionFromDatabase(opened.db, ['settings'])
+    if (domains.kind === 'unreadable') {
+      throw domains.error
+    }
+    const persistedSettings = domains.values.get('settings')
+    const settings = {
+      ...getDefaultPersistedState(homedir()).settings,
+      ...(isRecord(persistedSettings) ? persistedSettings : {}),
+      agentStatusHooksEnabled: enabled
+    }
+    writeProfileStateDomain(opened.db, {
+      domain: 'settings',
+      payload: JSON.stringify(settings),
+      expectedRevision: domains.revision
+    })
+    return {
+      settingsPath: location.databaseFile,
+      settings: projectAgentHookSettings(settings)
+    }
+  } finally {
+    opened.db.close()
+  }
+}
+
+/** The caller holds maintenance ownership through import and the fenced settings write. */
+export function updateAgentHookSettingsFromProfileState(
+  location: ProfileStateOfflineLocation,
+  enabled: boolean
+): AgentHookSettingsUpdate {
+  const classification = classifyProfileStateStorage(location.dataFile, location.databaseFile)
+  if (classification === 'json-only' || classification === 'neither') {
+    assertProfileStateCanInitialize(location)
+    assertOfflineProfileStateMutationRuntime()
+    const rawJson = existsSync(location.dataFile)
+      ? readFileSync(location.dataFile, 'utf8')
+      : undefined
+    const migrated = migrateProfileStateToSqlite({
+      ...location,
+      expectedLegacyJson: rawJson,
+      serializedState: rawJson ?? JSON.stringify(getDefaultPersistedState(homedir()))
+    })
+    migrated.authority.close()
+  }
+  return updateAgentHookSettingsInProfileState(location, enabled)
+}
+
+export function assertOfflineProfileStateMutationRuntime(): void {
+  if (!isProfileStateSqliteAvailable()) {
+    throw new Error(
+      'Changing agent hooks offline requires the bundled Orca CLI. Run that launcher, or start Orca and retry this command.'
+    )
+  }
+}
+
+function projectAgentHookSettings(
+  settings: AgentHookSettingsUpdate['settings']
+): AgentHookSettingsUpdate['settings'] {
+  return {
+    agentCmdOverrides: isRecord(settings.agentCmdOverrides)
+      ? Object.fromEntries(
+          Object.entries(settings.agentCmdOverrides).filter(
+            ([, value]) => typeof value === 'string'
+          )
+        )
+      : {},
+    disabledTuiAgents: Array.isArray(settings.disabledTuiAgents)
+      ? settings.disabledTuiAgents.filter((value) => typeof value === 'string')
+      : []
+  }
+}
+
+function assertSqliteCapability(): void {
+  if (!isProfileStateSqliteAvailable()) {
+    throw new Error('SQLite profile state is present but this runtime cannot validate it')
+  }
+}
+
+function assertAcceptedLegacyJson(
+  location: ProfileStateOfflineLocation,
+  classification: 'sqlite-only' | 'both'
+): void {
+  if (classification === 'sqlite-only') {
+    if (!existsSync(location.databaseFile)) {
+      throw new Error('SQLite profile state has an orphaned database sidecar')
+    }
+    return
+  }
+
+  const rawJson = readFileSync(location.dataFile, 'utf8')
+  const opened = openProfileStateDatabaseReadOnly(location.databaseFile, location.profileId)
+  try {
+    if (!profileStateJsonMatchesAcceptance(opened.db, rawJson)) {
+      throw new Error(
+        'Profile state has both JSON and SQLite storage without a matching acceptance marker'
+      )
+    }
+  } finally {
+    opened.db.close()
+  }
+}
+
+function readAgentHookSettingsFromJson(dataFile: string): AgentHookSettings {
+  const settings = existsSync(dataFile)
+    ? parseProfileStateRoot(readFileSync(dataFile, 'utf8')).settings
+    : getDefaultPersistedState(homedir()).settings
+  return readAgentHookSettingsFromSettingsValue(settings)
+}
+
+function readAgentHookSettingsFromSettingsValue(value: unknown): AgentHookSettings {
+  const settings = isRecord(value) ? value : {}
+  return {
+    agentStatusHooksEnabled: settings.agentStatusHooksEnabled !== false,
+    disabledTuiAgents: normalizeDisabledTuiAgents(settings.disabledTuiAgents)
+  }
+}
diff --git a/src/main/persistence/profile-state/profile-state-parsed-snapshot.test.ts b/src/main/persistence/profile-state/profile-state-parsed-snapshot.test.ts
new file mode 100644
index 000000000000..428622f8c6d5
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-parsed-snapshot.test.ts
@@ -0,0 +1,158 @@
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it } from 'vitest'
+import { openProfileStateDatabase } from './profile-state-database'
+import {
+  hashProfileStateJson,
+  importProfileStateJson,
+  readAcceptedProfileStateParsedSnapshot,
+  readProfileStateDocuments,
+  readProfileStateParsedSnapshot,
+  readProfileStateSnapshot,
+  validateProfileStateSnapshot
+} from './profile-state-documents'
+
+const directories: string[] = []
+afterEach(() => {
+  for (const directory of directories.splice(0)) {
+    rmSync(directory, { recursive: true, force: true })
+  }
+})
+
+function fixture() {
+  const directory = mkdtempSync(join(tmpdir(), 'orca-parsed-profile-'))
+  directories.push(directory)
+  return openProfileStateDatabase(join(directory, 'profile-state.db'), 'parsed-profile').db
+}
+
+describe('checked profile state values', () => {
+  it.each([
+    [
+      'row hash',
+      "UPDATE profile_state_automation_runs SET payload = '{}' WHERE ordinal = 0",
+      'row is corrupt'
+    ],
+    [
+      'ordering',
+      'UPDATE profile_state_automation_runs SET ordinal = 3 WHERE ordinal = 0',
+      'ordering is corrupt'
+    ],
+    [
+      'revision',
+      'UPDATE profile_state_automation_runs SET revision = 99 WHERE ordinal = 0',
+      'metadata is inconsistent'
+    ],
+    [
+      'timestamp',
+      'UPDATE profile_state_automation_runs SET updated_at = updated_at + 1 WHERE ordinal = 0',
+      'metadata is inconsistent'
+    ]
+  ])('rejects corrupt normalized %s in both representations', (_, sql, message) => {
+    const db = fixture()
+    try {
+      importProfileStateJson(db, '{"automationRuns":[{"id":"a"},{"id":"b"}]}')
+      db.exec(sql)
+      expect(() => readProfileStateParsedSnapshot(db)).toThrow(message)
+      expect(() => readProfileStateSnapshot(db)).toThrow(message)
+      expect(() => validateProfileStateSnapshot(db)).toThrow(message)
+    } finally {
+      db.close()
+    }
+  })
+
+  it('rejects a normalized identity mismatch even when the payload hash is valid', () => {
+    const db = fixture()
+    try {
+      importProfileStateJson(db, '{"automationRuns":[{"id":"a"}]}')
+      const payload = '{"id":"other"}'
+      db.prepare('UPDATE profile_state_automation_runs SET payload = ?, content_hash = ?').run(
+        payload,
+        hashProfileStateJson(payload)
+      )
+      expect(() => readProfileStateParsedSnapshot(db)).toThrow('identity is corrupt')
+      expect(() => readProfileStateSnapshot(db)).toThrow('identity is corrupt')
+      expect(() => validateProfileStateSnapshot(db)).toThrow('identity is corrupt')
+    } finally {
+      db.close()
+    }
+  })
+
+  it.each([
+    undefined,
+    null,
+    [],
+    [
+      { id: 'second', unknown: '雪 🐋\ud800' },
+      { id: 'first', unknown: null }
+    ],
+    { futureHistoryFormat: true },
+    [{ id: 'duplicate' }, { id: 'duplicate' }]
+  ])('matches serialized semantics for history %j', (automationRuns) => {
+    const db = fixture()
+    try {
+      const source = JSON.stringify(
+        Object.fromEntries([
+          ['z', { sealed: 'safeStorage:unchanged' }],
+          ['__proto__', { own: true }],
+          ['10', 'ten'],
+          ['2', 'two'],
+          ['constructor', 'own constructor'],
+          ['automationRuns', automationRuns],
+          ['a', null]
+        ])
+      )
+      importProfileStateJson(db, source, { acceptedLegacyJsonHash: hashProfileStateJson(source) })
+      const serialized = readProfileStateSnapshot(db)
+      const expected: unknown = JSON.parse(serialized.json)
+      const parsed = readProfileStateParsedSnapshot(db)
+      expect(parsed).toStrictEqual({ revision: serialized.revision, state: expected })
+      expect(Object.keys(parsed.state)).toEqual(Object.keys(JSON.parse(source)))
+      expect(Object.hasOwn(parsed.state, '__proto__')).toBe(true)
+      expect(Object.getPrototypeOf(parsed.state)).toBe(Object.prototype)
+      expect(readAcceptedProfileStateParsedSnapshot(db, source)).toStrictEqual(parsed)
+      expect(readAcceptedProfileStateParsedSnapshot(db, '{}')).toBeUndefined()
+      expect(
+        readProfileStateDocuments(db).every((document) => !Object.hasOwn(document, 'value'))
+      ).toBe(true)
+      expect(readProfileStateSnapshot(db).json).toBe(serialized.json)
+    } finally {
+      db.close()
+    }
+  })
+
+  it('validates original bytes while reusing noncanonical JSON values', () => {
+    const db = fixture()
+    try {
+      importProfileStateJson(db, '{"future":null,"automationRuns":[{"id":"a"},{"id":"b"}]}')
+      const future =
+        ' {"negativeZero":-0,"large":1e400,"duplicate":1,"duplicate":2,"text":"雪\\ud800"} '
+      db.prepare(
+        'UPDATE profile_state_documents SET payload = ?, content_hash = ? WHERE domain = ?'
+      ).run(future, hashProfileStateJson(future), 'future')
+      const payloads = [' {"id":"a","number":-0,"large":1e400} ', '{"id":"b","text":"雪\\ud800"}']
+      for (const [ordinal, payload] of payloads.entries()) {
+        db.prepare(
+          'UPDATE profile_state_automation_runs SET payload = ?, content_hash = ? WHERE ordinal = ?'
+        ).run(payload, hashProfileStateJson(payload), ordinal)
+      }
+      const aggregate = `[${payloads.join(',')}]`
+      db.prepare('UPDATE profile_state_automation_runs_meta SET content_hash = ?').run(
+        hashProfileStateJson(aggregate)
+      )
+      const serialized = readProfileStateSnapshot(db)
+      expect(serialized.json).toBe(`{"future":${future},"automationRuns":${aggregate}}`)
+      expect(readProfileStateParsedSnapshot(db)).toStrictEqual({
+        revision: serialized.revision,
+        state: JSON.parse(serialized.json)
+      })
+      db.prepare('UPDATE profile_state_automation_runs_meta SET content_hash = ?').run(
+        hashProfileStateJson(JSON.stringify(JSON.parse(aggregate)))
+      )
+      expect(() => readProfileStateParsedSnapshot(db)).toThrow('aggregate hash mismatch')
+      expect(() => readProfileStateSnapshot(db)).toThrow('aggregate hash mismatch')
+    } finally {
+      db.close()
+    }
+  })
+})
diff --git a/src/main/persistence/profile-state/profile-state-read-concurrency.test.ts b/src/main/persistence/profile-state/profile-state-read-concurrency.test.ts
new file mode 100644
index 000000000000..0f6307e47d37
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-read-concurrency.test.ts
@@ -0,0 +1,174 @@
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import {
+  openProfileStateDatabase,
+  openProfileStateDatabaseReadOnly
+} from './profile-state-database'
+import { verifyProfileStateSchema } from './profile-state-database-validation'
+import {
+  importProfileStateJson,
+  readProfileStateSnapshot,
+  readProfileStateParsedSnapshot,
+  validateProfileStateSnapshot
+} from './profile-state-documents'
+import { readProfileStateDomainsWithRevisionFromDatabase } from './profile-state-domain-reader'
+import { writeProfileStateDomains } from './profile-state-domain-writes'
+import * as revisions from './profile-state-revision'
+
+const directories: string[] = []
+
+afterEach(() => {
+  vi.restoreAllMocks()
+  for (const directory of directories.splice(0)) {
+    rmSync(directory, { recursive: true, force: true })
+  }
+})
+
+function fixture() {
+  const directory = mkdtempSync(join(tmpdir(), 'orca-profile-read-concurrency-'))
+  directories.push(directory)
+  const path = join(directory, 'profile-state.db')
+  const { db } = openProfileStateDatabase(path, 'profile-a')
+  importProfileStateJson(db, '{"automationRuns":[{"id":"run-1","status":"pending"}]}')
+  return { path, db }
+}
+
+describe('profile state reads during concurrent commits', () => {
+  it.each([readProfileStateSnapshot, readProfileStateParsedSnapshot, validateProfileStateSnapshot])(
+    'keeps revision and documents together when a writer commits during %s',
+    (read) => {
+      const { path, db: writer } = fixture()
+      const { db: reader } = openProfileStateDatabaseReadOnly(path, 'profile-a')
+      const readRevision = revisions.readProfileStateRevision
+      let committed = false
+      vi.spyOn(revisions, 'readProfileStateRevision').mockImplementation((db) => {
+        const revision = readRevision(db)
+        if (db === reader && !committed) {
+          committed = true
+          writeProfileStateDomains(writer, {
+            expectedRevision: 1,
+            replacements: [{ domain: 'automationRuns', payload: '[]' }]
+          })
+        }
+        return revision
+      })
+      try {
+        const snapshot = read(reader)
+        expect(committed).toBe(true)
+        if (typeof snapshot === 'number') {
+          expect(snapshot).toBe(1)
+        } else {
+          expect(snapshot).toMatchObject({ revision: 1 })
+          expect(snapshot).toMatchObject(
+            read === readProfileStateSnapshot
+              ? { json: '{"automationRuns":[{"id":"run-1","status":"pending"}]}' }
+              : { state: { automationRuns: [{ id: 'run-1', status: 'pending' }] } }
+          )
+        }
+        expect(reader.isTransaction).toBe(false)
+        const next = read(reader)
+        expect(typeof next === 'number' ? next : next.revision).toBe(2)
+      } finally {
+        reader.close()
+        writer.close()
+      }
+    }
+  )
+
+  it.each([
+    ['read-only', openProfileStateDatabaseReadOnly],
+    ['writable', openProfileStateDatabase]
+  ] as const)(
+    'opens a healthy %s database when automation state changes between validation reads',
+    (_, open) => {
+      const { path, db: writer } = fixture()
+      const readRevision = revisions.readProfileStateRevision
+      let committed = false
+      vi.spyOn(revisions, 'readProfileStateRevision').mockImplementation((reader) => {
+        const revision = readRevision(reader)
+        if (reader !== writer && !committed) {
+          committed = true
+          writeProfileStateDomains(writer, {
+            expectedRevision: 1,
+            replacements: [{ domain: 'automationRuns', payload: '[]' }]
+          })
+        }
+        return revision
+      })
+      try {
+        const opened = open(path, 'profile-a')
+        try {
+          expect(committed).toBe(true)
+          expect(opened.db.isTransaction).toBe(false)
+          expect(readProfileStateParsedSnapshot(opened.db)).toEqual({
+            revision: 2,
+            state: { automationRuns: [] }
+          })
+          expect(readProfileStateSnapshot(opened.db)).toMatchObject({
+            revision: 2,
+            json: '{"automationRuns":[]}'
+          })
+        } finally {
+          opened.db.close()
+        }
+      } finally {
+        writer.close()
+      }
+    }
+  )
+
+  it('keeps caller-owned writes uncommitted through schema, full and selected reads', () => {
+    const { db } = fixture()
+    try {
+      db.exec('BEGIN IMMEDIATE')
+      db.prepare('INSERT INTO profile_state_meta (key, value) VALUES (?, ?)').run('probe', 'value')
+      verifyProfileStateSchema(db, 'profile-a')
+      expect(readProfileStateSnapshot(db).revision).toBe(1)
+      expect(readProfileStateParsedSnapshot(db).revision).toBe(1)
+      expect(readProfileStateDomainsWithRevisionFromDatabase(db, ['automationRuns'])).toEqual({
+        kind: 'values',
+        revision: 1,
+        values: new Map([['automationRuns', [{ id: 'run-1', status: 'pending' }]]])
+      })
+      expect(db.isTransaction).toBe(true)
+      db.exec('ROLLBACK')
+      expect(
+        db.prepare('SELECT value FROM profile_state_meta WHERE key = ?').get('probe')
+      ).toBeUndefined()
+    } finally {
+      db.close()
+    }
+  })
+
+  it.each(['owned', 'caller'] as const)(
+    'preserves corrupt state and releases only %s read transactions',
+    (ownership) => {
+      const { db } = fixture()
+      try {
+        if (ownership === 'caller') {
+          db.exec('BEGIN IMMEDIATE')
+        }
+        db.exec('DELETE FROM profile_state_automation_runs_meta')
+        expect(() => verifyProfileStateSchema(db, 'profile-a')).toThrow('metadata is malformed')
+        expect(() => readProfileStateSnapshot(db)).toThrow('metadata is malformed')
+        expect(() => readProfileStateParsedSnapshot(db)).toThrow('metadata is malformed')
+        expect(readProfileStateDomainsWithRevisionFromDatabase(db, ['automationRuns']).kind).toBe(
+          'unreadable'
+        )
+        expect(db.isTransaction).toBe(ownership === 'caller')
+        expect(db.prepare('SELECT domain FROM profile_state_automation_runs_meta').all()).toEqual(
+          []
+        )
+        if (ownership === 'caller') {
+          db.exec('ROLLBACK')
+          expect(readProfileStateSnapshot(db).revision).toBe(1)
+          expect(readProfileStateParsedSnapshot(db).revision).toBe(1)
+        }
+      } finally {
+        db.close()
+      }
+    }
+  )
+})
diff --git a/src/main/persistence/profile-state/profile-state-read-snapshot.ts b/src/main/persistence/profile-state/profile-state-read-snapshot.ts
new file mode 100644
index 000000000000..415c17210717
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-read-snapshot.ts
@@ -0,0 +1,37 @@
+import type Database from '../../sqlite/sync-database'
+
+export class ProfileStateReadRollbackError extends Error {
+  readonly code = 'profile-state-read-rollback-failed' as const
+
+  constructor(
+    cause: unknown,
+    readonly rollbackError: unknown
+  ) {
+    super('Profile state read failed without releasing its transaction', { cause })
+    this.name = 'ProfileStateReadRollbackError'
+  }
+}
+
+/** Reuse a caller's transaction without committing or rolling it back. */
+export function withProfileStateReadSnapshot<T>(db: Database.Database, read: () => T): T {
+  const ownsTransaction = !db.isTransaction
+  if (ownsTransaction) {
+    db.exec('BEGIN')
+  }
+  try {
+    const result = read()
+    if (ownsTransaction) {
+      db.exec('COMMIT')
+    }
+    return result
+  } catch (error) {
+    if (ownsTransaction && db.isTransaction) {
+      try {
+        db.exec('ROLLBACK')
+      } catch (rollbackError) {
+        throw new ProfileStateReadRollbackError(error, rollbackError)
+      }
+    }
+    throw error
+  }
+}
diff --git a/src/main/persistence/profile-state/profile-state-recovery-batch.test.ts b/src/main/persistence/profile-state/profile-state-recovery-batch.test.ts
new file mode 100644
index 000000000000..82e4ccf708ee
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-recovery-batch.test.ts
@@ -0,0 +1,227 @@
+import {
+  closeSync,
+  copyFileSync,
+  existsSync,
+  ftruncateSync,
+  mkdirSync,
+  mkdtempSync,
+  openSync,
+  readFileSync,
+  readdirSync,
+  rmSync,
+  statSync,
+  writeFileSync,
+  writeSync
+} from 'node:fs'
+import type * as FileSystem from 'node:fs'
+import { tmpdir } from 'node:os'
+import { basename, dirname, isAbsolute, join } from 'node:path'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import * as processes from '../../../shared/child-process/run-process'
+import { copyProfileStateRecoveryFiles } from './profile-state-recovery-copy'
+import { quarantineProfileStateDatabase } from './profile-state-database-quarantine'
+
+const publication = vi.hoisted(() => ({ unsupportedTarget: '' }))
+vi.mock('node:fs', async (original) => {
+  const actual = await original<typeof FileSystem>()
+  return {
+    ...actual,
+    linkSync: (...args: Parameters<typeof actual.linkSync>) => {
+      if (args[1] === publication.unsupportedTarget) {
+        throw Object.assign(new Error('hardlinks unavailable'), { code: 'ENOTSUP' })
+      }
+      return actual.linkSync(...args)
+    }
+  }
+})
+
+const directories: string[] = []
+afterEach(() => {
+  publication.unsupportedTarget = ''
+  vi.restoreAllMocks()
+  for (const directory of directories.splice(0)) {
+    rmSync(directory, { recursive: true, force: true })
+  }
+})
+
+function fixture(names = ['primary.db', 'backup.db'], large = true) {
+  const directory = mkdtempSync(join(tmpdir(), 'orca-recovery-batch-'))
+  directories.push(directory)
+  const files = names.map((name, index) => {
+    const sourceDirectory = join(directory, `source-${index}`)
+    mkdirSync(sourceDirectory)
+    const source = join(sourceDirectory, name)
+    const descriptor = openSync(source, 'wx', 0o600)
+    try {
+      ftruncateSync(descriptor, large ? 8 * 1024 * 1024 + 1 : 128)
+      writeSync(descriptor, Buffer.from(`retained-${index}`))
+    } finally {
+      closeSync(descriptor)
+    }
+    return { source, target: join(directory, `restored-${index}.db`) }
+  })
+  return { directory, files }
+}
+
+function expectIndependent(files: ReturnType<typeof fixture>['files']): void {
+  for (const { source, target } of files) {
+    const original = readFileSync(source)
+    expect(readFileSync(target).equals(original)).toBe(true)
+    expect(statSync(source, { bigint: true }).ino).not.toBe(statSync(target, { bigint: true }).ino)
+    writeFileSync(source, 'changed source')
+    expect(readFileSync(target).equals(original)).toBe(true)
+  }
+}
+
+function expectNoTemporary(directory: string): void {
+  expect(readdirSync(directory).some((name) => name.startsWith('.orca-recovery-clone-'))).toBe(
+    false
+  )
+}
+
+describe('batched profile recovery copies', () => {
+  it.each(['manifest.json', 'MANIFEST.JSON'])(
+    'preserves a recovery artifact named %s without overwriting it with a manifest',
+    (name) => {
+      const { directory, files } = fixture(['primary.db', name], false)
+      const artifact = files[1].source
+      const original = readFileSync(artifact)
+      const quarantine = () =>
+        quarantineProfileStateDatabase(files[0].source, 'profile', directory, 'test', [artifact])
+      if (existsSync(join(dirname(artifact), 'manifest.json'))) {
+        expect(quarantine).toThrow('conflicts with the quarantine manifest')
+        expect(
+          readdirSync(directory).some((entry) => entry.startsWith('profile-state-corrupt-'))
+        ).toBe(false)
+      } else {
+        const result = quarantine()
+        expect(readFileSync(join(result.directory, name)).equals(original)).toBe(true)
+      }
+      expect(readFileSync(artifact).equals(original)).toBe(true)
+      expect(existsSync(files[0].source)).toBe(true)
+    }
+  )
+
+  it.each([false, true])('preserves every independent file with large copies=%s', (large) => {
+    const { directory, files } = fixture(undefined, large)
+    copyProfileStateRecoveryFiles(files)
+    expectIndependent(files)
+    expectNoTemporary(directory)
+  })
+
+  it('does nothing for an empty batch', () => {
+    const run = vi.spyOn(processes, 'runProcessSync')
+    copyProfileStateRecoveryFiles([])
+    expect(run).not.toHaveBeenCalled()
+  })
+
+  describe.skipIf(process.platform !== 'darwin')('Darwin batch boundaries', () => {
+    it('shares one process with absolute arguments and the per-file timeout budget', () => {
+      const { directory, files } = fixture()
+      const run = vi.spyOn(processes, 'runProcessSync')
+      copyProfileStateRecoveryFiles(files)
+      expect(run).toHaveBeenCalledOnce()
+      const spec = run.mock.calls[0]?.[0]
+      expect(spec?.args?.slice(1).every(isAbsolute)).toBe(true)
+      expect(spec?.args).toHaveLength(4)
+      expect(spec?.timeoutMs).toBe(60_000)
+      expectIndependent(files)
+      expectNoTemporary(directory)
+    })
+
+    it('bounds a shared process when many large artifacts are retained', () => {
+      const { directory, files } = fixture(
+        Array.from({ length: 17 }, (_, index) => `backup-${index}.db`)
+      )
+      const run = vi.spyOn(processes, 'runProcessSync')
+      copyProfileStateRecoveryFiles(files)
+      expect(run).toHaveBeenCalledTimes(2)
+      expect(run.mock.calls.every(([spec]) => (spec.args?.length ?? 0) <= 18)).toBe(true)
+      expectIndependent(files)
+      expectNoTemporary(directory)
+    })
+
+    it.each([
+      ['same.db', 'same.db'],
+      ['CASE.db', 'case.db'],
+      ['é.db', 'e\u0301.db'],
+      ['suffix.db.', 'suffix.db'],
+      ['- leading space.db', 'plain.db']
+    ])('isolates ambiguous source names %s and %s', (...names) => {
+      const { directory, files } = fixture(names)
+      const run = vi.spyOn(processes, 'runProcessSync')
+      copyProfileStateRecoveryFiles(files)
+      expect(run).toHaveBeenCalledTimes(2)
+      expectIndependent(files)
+      expectNoTemporary(directory)
+    })
+
+    it.each(['timeout', 'signal', 'spawn'] as const)(
+      'publishes no cloned files after a batch %s failure',
+      (failure) => {
+        const { directory, files } = fixture()
+        vi.spyOn(processes, 'runProcessSync').mockImplementation(() => {
+          if (failure === 'spawn') {
+            throw new Error('copy process could not start')
+          }
+          return {
+            code: null,
+            signal: 'SIGTERM',
+            timedOut: failure === 'timeout',
+            stdout: '',
+            stderr: ''
+          }
+        })
+        expect(() => copyProfileStateRecoveryFiles(files)).toThrow()
+        for (const { source, target } of files) {
+          expect(existsSync(source)).toBe(true)
+          expect(existsSync(target)).toBe(false)
+        }
+        expectNoTemporary(directory)
+      }
+    )
+
+    it('discards partial process output before falling back for every source', () => {
+      const { directory, files } = fixture()
+      vi.spyOn(processes, 'runProcessSync').mockImplementation((spec) => {
+        const temporaryDirectory = spec.args?.at(-1)
+        if (!temporaryDirectory) {
+          throw new Error('Missing clone directory')
+        }
+        expect(statSync(temporaryDirectory).mode & 0o777).toBe(0o700)
+        writeFileSync(join(temporaryDirectory, basename(files[0].source)), 'incomplete')
+        return { code: 1, signal: null, timedOut: false, stdout: '', stderr: 'clone unavailable' }
+      })
+      copyProfileStateRecoveryFiles(files)
+      expectIndependent(files)
+      expectNoTemporary(directory)
+    })
+
+    it('preserves a destination created during the batch process', () => {
+      const { directory, files } = fixture()
+      vi.spyOn(processes, 'runProcessSync').mockImplementation((spec) => {
+        const temporaryDirectory = spec.args?.at(-1)
+        if (!temporaryDirectory) {
+          throw new Error('Missing clone directory')
+        }
+        for (const { source } of files) {
+          copyFileSync(source, join(temporaryDirectory, basename(source)))
+        }
+        writeFileSync(files[1].target, 'concurrent destination')
+        return { code: 0, signal: null, timedOut: false, stdout: '', stderr: '' }
+      })
+      expect(() => copyProfileStateRecoveryFiles(files)).toThrow()
+      expect(readFileSync(files[1].target, 'utf8')).toBe('concurrent destination')
+      expect(readFileSync(files[0].target).equals(readFileSync(files[0].source))).toBe(true)
+      expectNoTemporary(directory)
+    })
+
+    it('falls back independently when one destination cannot publish hardlinks', () => {
+      const { directory, files } = fixture()
+      publication.unsupportedTarget = files[1].target
+      copyProfileStateRecoveryFiles(files)
+      expectIndependent(files)
+      expectNoTemporary(directory)
+    })
+  })
+})
diff --git a/src/main/persistence/profile-state/profile-state-recovery-command.ts b/src/main/persistence/profile-state/profile-state-recovery-command.ts
new file mode 100644
index 000000000000..750df221f1c9
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-recovery-command.ts
@@ -0,0 +1,206 @@
+import { existsSync, readFileSync, rmSync } from 'node:fs'
+import {
+  ProfileStateRecoveryCommandError,
+  type ProfileStateRecoverySelector,
+  type ProfileStateExportsResult,
+  type ProfileStateRollbackResult
+} from '../../../shared/profile-state-recovery-command'
+import { getActiveProfileStateLocation } from './profile-state-active-location'
+import {
+  profileStateJsonExportPath,
+  profileStateJsonExportPaths
+} from './legacy-json/profile-state-export-path'
+import { profileStateDatabaseBackups } from './profile-state-backup-path'
+import { restoreProfileStateJsonExport } from './legacy-json/profile-state-recovery'
+import { restoreProfileStateDatabaseBackup } from './profile-state-database-recovery'
+import { quarantineProfileStateDatabase } from './profile-state-database-quarantine'
+import { ProfileStateSqliteAuthority } from './profile-state-sqlite-authority'
+import { durableWriteTempPath, writeFileDurableSync } from '../../durable-file-write'
+import type { ProfileStateMaintenance } from './profile-state-access'
+import { readProfileStateDomain } from './profile-state-domain-reader'
+import { isRecord } from './profile-state-document-validation'
+import { profileHasPendingProjectMove } from '../../orca-profiles/profile-project-move-record'
+import {
+  invalidateHttp1CompatibilityMarker,
+  writeHttp1CompatibilityMarker
+} from '../../startup/http1-compatibility-marker'
+
+export function getProfileStateExports(userDataPath: string): ProfileStateExportsResult {
+  const location = getActiveProfileStateLocation(userDataPath)
+  if (location === undefined) {
+    throw new ProfileStateRecoveryCommandError(
+      'runtime_error',
+      'No active profile is available for recovery.'
+    )
+  }
+  return {
+    profileId: location.profileId,
+    dataFile: location.dataFile,
+    databaseFile: location.databaseFile,
+    exportPaths: profileStateJsonExportPaths(location.dataFile),
+    backups: profileStateDatabaseBackups(location.databaseFile)
+  }
+}
+
+export function rollbackProfileState(
+  userDataPath: string,
+  selector: ProfileStateRecoverySelector,
+  maintenance: ProfileStateMaintenance
+): ProfileStateRollbackResult {
+  const result = getProfileStateExports(userDataPath)
+  if (profileHasPendingProjectMove(result.profileId, userDataPath)) {
+    throw new ProfileStateRecoveryCommandError(
+      'runtime_error',
+      'This profile has a pending project move. Resolve the move with both profiles preserved before restoring a single profile.'
+    )
+  }
+  if (selector.kind === 'sqlite') {
+    return restoreDatabaseBackup(userDataPath, result, selector.backupId, maintenance)
+  }
+  if (selector.kind === 'current-sqlite') {
+    return adoptCurrentDatabase(userDataPath, result, maintenance)
+  }
+  const revision = selector.kind === 'json' ? selector.revision : null
+  const exportPath =
+    revision === null ? result.dataFile : profileStateJsonExportPath(result.dataFile, revision)
+  if (revision !== null && !result.exportPaths.includes(exportPath)) {
+    throw new ProfileStateRecoveryCommandError(
+      'invalid_argument',
+      `Profile-state export revision ${revision} is unavailable. Use profile state exports to inspect retained revisions.`
+    )
+  }
+  const recovered = restoreProfileStateJsonExport({
+    maintenance,
+    databasePath: result.databaseFile,
+    dataFile: result.dataFile,
+    exportPath,
+    profileId: result.profileId,
+    ...(revision === null ? { reason: 'profile-state-adopt-current-json' } : {}),
+    beforeRestore: () => invalidateHttp1CompatibilityMarker(userDataPath)
+  })
+  syncHttp1CompatibilityMarkerAfterRollback(userDataPath, result.dataFile, result.profileId)
+  return {
+    ...result,
+    storage: 'json',
+    restoredPath: result.dataFile,
+    revision,
+    quarantineDirectory: recovered.quarantine.directory,
+    removedDatabaseFiles: recovered.removedDatabaseFiles
+  }
+}
+
+function restoreDatabaseBackup(
+  userDataPath: string,
+  result: ProfileStateExportsResult,
+  backupId: string,
+  maintenance: ProfileStateMaintenance
+): ProfileStateRollbackResult {
+  const backup = result.backups.find((entry) => entry.id === backupId)
+  if (!backup) {
+    throw new ProfileStateRecoveryCommandError(
+      'invalid_argument',
+      'Profile-state backup is unavailable. Use profile state exports to inspect retained backups.'
+    )
+  }
+  const recovered = restoreProfileStateDatabaseBackup({
+    maintenance,
+    databasePath: result.databaseFile,
+    dataFile: result.dataFile,
+    backupPath: backup.path,
+    profileId: result.profileId,
+    beforeRestore: () => invalidateHttp1CompatibilityMarker(userDataPath)
+  })
+  syncHttp1CompatibilityMarkerFromDatabase(userDataPath, result)
+  return {
+    ...result,
+    storage: 'sqlite',
+    restoredPath: result.databaseFile,
+    backupId: backup.id,
+    revision: recovered.revision,
+    quarantineDirectory: recovered.quarantine.directory,
+    removedDatabaseFiles: recovered.removedDatabaseFiles
+  }
+}
+
+/** Keep SQLite and replace diverged JSON (e.g. edited by an older build) with its export. */
+function adoptCurrentDatabase(
+  userDataPath: string,
+  result: ProfileStateExportsResult,
+  maintenance: ProfileStateMaintenance
+): ProfileStateRollbackResult {
+  maintenance.assertProfile(result.profileId, result.dataFile, result.databaseFile)
+  const authority = new ProfileStateSqliteAuthority(result.databaseFile, result.profileId)
+  try {
+    // Validate before archiving so an unreadable database leaves both copies untouched.
+    authority.readInitialState()
+    if (authority.revision === 0) {
+      throw new ProfileStateRecoveryCommandError(
+        'runtime_error',
+        'SQLite profile state is empty. Keep the current JSON instead.'
+      )
+    }
+    const quarantine = quarantineProfileStateDatabase(
+      result.databaseFile,
+      result.profileId,
+      undefined,
+      'profile-state-adopt-current-sqlite',
+      existsSync(result.dataFile) ? [result.dataFile] : []
+    )
+    invalidateHttp1CompatibilityMarker(userDataPath)
+    // A retained JSON the marker never accepted would fail the compatibility export's fence.
+    const divergedJson = existsSync(result.dataFile) ? readFileSync(result.dataFile) : undefined
+    rmSync(result.dataFile, { force: true })
+    let revision: number
+    try {
+      revision = authority.writeJsonCompatibilityExport(result.dataFile) ?? authority.revision
+    } catch (error) {
+      if (divergedJson !== undefined && !existsSync(result.dataFile)) {
+        writeFileDurableSync(durableWriteTempPath(result.dataFile), result.dataFile, divergedJson)
+      }
+      throw error
+    }
+    syncHttp1CompatibilityMarkerFromDatabase(userDataPath, result)
+    return {
+      ...result,
+      storage: 'sqlite',
+      restoredPath: result.databaseFile,
+      revision,
+      quarantineDirectory: quarantine.directory,
+      removedDatabaseFiles: []
+    }
+  } finally {
+    authority.close()
+  }
+}
+
+function syncHttp1CompatibilityMarkerFromDatabase(
+  userDataPath: string,
+  result: ProfileStateExportsResult
+): void {
+  const settings = readProfileStateDomain(result.databaseFile, result.profileId, 'settings')
+  if (settings.kind !== 'unreadable') {
+    const enabled =
+      settings.kind === 'value' &&
+      isRecord(settings.value) &&
+      settings.value.electronHttp1CompatibilityMode === true
+    writeHttp1CompatibilityMarker(userDataPath, enabled, result.profileId)
+  }
+}
+
+function syncHttp1CompatibilityMarkerAfterRollback(
+  userDataPath: string,
+  dataFile: string,
+  profileId: string
+): void {
+  let enabled = false
+  try {
+    const parsed: unknown = JSON.parse(readFileSync(dataFile, 'utf8'))
+    if (isRecord(parsed) && isRecord(parsed.settings)) {
+      enabled = parsed.settings.electronHttp1CompatibilityMode === true
+    }
+  } catch {
+    // Leave the invalidated marker absent so startup reads the restored JSON itself.
+    return
+  }
+  writeHttp1CompatibilityMarker(userDataPath, enabled, profileId)
+}
diff --git a/src/main/persistence/profile-state/profile-state-recovery-copy.test.ts b/src/main/persistence/profile-state/profile-state-recovery-copy.test.ts
new file mode 100644
index 000000000000..d7bc8796be2b
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-recovery-copy.test.ts
@@ -0,0 +1,193 @@
+import {
+  closeSync,
+  copyFileSync,
+  existsSync,
+  ftruncateSync,
+  mkdtempSync,
+  openSync,
+  readFileSync,
+  readdirSync,
+  rmSync,
+  statSync,
+  symlinkSync,
+  writeFileSync,
+  writeSync
+} from 'node:fs'
+import type * as FileSystem from 'node:fs'
+import { tmpdir } from 'node:os'
+import { dirname, isAbsolute, join, relative } from 'node:path'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import * as processes from '../../../shared/child-process/run-process'
+import { copyProfileStateRecoveryFile } from './profile-state-recovery-copy'
+
+const cloneLink = vi.hoisted(() => ({ unsupported: false }))
+vi.mock('node:fs', async (original) => {
+  const actual = await original<typeof FileSystem>()
+  return {
+    ...actual,
+    linkSync: (...args: Parameters<typeof actual.linkSync>) => {
+      if (cloneLink.unsupported) {
+        throw Object.assign(new Error('hardlinks unavailable'), { code: 'ENOTSUP' })
+      }
+      return actual.linkSync(...args)
+    }
+  }
+})
+
+const directories: string[] = []
+afterEach(() => {
+  cloneLink.unsupported = false
+  vi.restoreAllMocks()
+  for (const directory of directories.splice(0)) {
+    rmSync(directory, { recursive: true, force: true })
+  }
+})
+
+function fixture(large = true) {
+  const directory = mkdtempSync(join(tmpdir(), 'orca-recovery-copy-'))
+  directories.push(directory)
+  const source = join(directory, '- source with spaces')
+  const target = join(directory, 'target')
+  const descriptor = openSync(source, 'wx', 0o600)
+  try {
+    ftruncateSync(descriptor, large ? 8 * 1024 * 1024 + 1 : 100)
+    writeSync(descriptor, Buffer.from('retained source'))
+  } finally {
+    closeSync(descriptor)
+  }
+  return { directory, source, target }
+}
+
+function expectNoTemporary(directory: string): void {
+  expect(readdirSync(directory).some((name) => name.startsWith('.orca-recovery-clone-'))).toBe(
+    false
+  )
+}
+
+describe('independent profile recovery copies', () => {
+  it.each([false, true])('preserves independent bytes with a large file=%s', (large) => {
+    const { directory, source, target } = fixture(large)
+    const before = readFileSync(source)
+    copyProfileStateRecoveryFile(source, target)
+    expect(readFileSync(target).equals(before)).toBe(true)
+    expect(statSync(target, { bigint: true }).ino).not.toBe(statSync(source, { bigint: true }).ino)
+    writeFileSync(source, 'changed source')
+    expect(readFileSync(target).equals(before)).toBe(true)
+    writeFileSync(target, 'changed target')
+    expect(readFileSync(source, 'utf8')).toBe('changed source')
+    expectNoTemporary(directory)
+  })
+
+  it.each([false, true])('never replaces an existing destination with a large file=%s', (large) => {
+    const { directory, source, target } = fixture(large)
+    writeFileSync(target, 'do not replace')
+    expect(() => copyProfileStateRecoveryFile(source, target)).toThrow()
+    expect(readFileSync(target, 'utf8')).toBe('do not replace')
+    expectNoTemporary(directory)
+  })
+
+  it('does not start a copy process for small files', () => {
+    const { source, target } = fixture(false)
+    const run = vi.spyOn(processes, 'runProcessSync')
+    copyProfileStateRecoveryFile(source, target)
+    expect(run).not.toHaveBeenCalled()
+  })
+
+  describe.skipIf(process.platform !== 'darwin')('Darwin clone failure boundaries', () => {
+    it('resolves both process arguments while preserving relative path behavior', () => {
+      const { directory, source, target } = fixture()
+      const run = vi.spyOn(processes, 'runProcessSync')
+      copyProfileStateRecoveryFile(relative(process.cwd(), source), relative(process.cwd(), target))
+      const args = run.mock.calls[0]?.[0].args
+      expect(args?.[0]).toBe('-c')
+      expect(isAbsolute(args?.[1] ?? '')).toBe(true)
+      expect(isAbsolute(args?.[2] ?? '')).toBe(true)
+      expect(readFileSync(target).equals(readFileSync(source))).toBe(true)
+      expectNoTemporary(directory)
+    })
+
+    it('keeps ordinary-copy semantics for symlinks to large recovery artifacts', () => {
+      const { directory, source, target } = fixture()
+      const alias = join(directory, 'alias')
+      symlinkSync(source, alias)
+      const run = vi.spyOn(processes, 'runProcessSync')
+      copyProfileStateRecoveryFile(alias, target)
+      expect(run).not.toHaveBeenCalled()
+      expect(readFileSync(target).equals(readFileSync(source))).toBe(true)
+      expect(statSync(target, { bigint: true }).ino).not.toBe(
+        statSync(source, { bigint: true }).ino
+      )
+      expectNoTemporary(directory)
+    })
+
+    it('cleans a failed partial clone and falls back to an independent ordinary copy', () => {
+      const { directory, source, target } = fixture()
+      vi.spyOn(processes, 'runProcessSync').mockImplementation((spec) => {
+        const temporary = spec.args?.[2]
+        if (typeof temporary !== 'string') {
+          throw new Error('Missing clone destination')
+        }
+        expect(statSync(dirname(temporary)).mode & 0o777).toBe(0o700)
+        writeFileSync(temporary, 'incomplete')
+        return { code: 1, signal: null, timedOut: false, stdout: '', stderr: 'clone unavailable' }
+      })
+      copyProfileStateRecoveryFile(source, target)
+      expect(readFileSync(target).equals(readFileSync(source))).toBe(true)
+      expect(statSync(target, { bigint: true }).ino).not.toBe(
+        statSync(source, { bigint: true }).ino
+      )
+      expectNoTemporary(directory)
+    })
+
+    it.each(['timeout', 'signal', 'spawn'] as const)(
+      'preserves originals and removes temporary copies after %s failure',
+      (failure) => {
+        const { directory, source, target } = fixture()
+        const before = readFileSync(source)
+        vi.spyOn(processes, 'runProcessSync').mockImplementation(() => {
+          if (failure === 'spawn') {
+            throw new Error('copy process could not start')
+          }
+          return {
+            code: null,
+            signal: 'SIGTERM',
+            timedOut: failure === 'timeout',
+            stdout: '',
+            stderr: ''
+          }
+        })
+        expect(() => copyProfileStateRecoveryFile(source, target)).toThrow()
+        expect(readFileSync(source).equals(before)).toBe(true)
+        expect(existsSync(target)).toBe(false)
+        expectNoTemporary(directory)
+      }
+    )
+
+    it('preserves a destination created while the clone process runs', () => {
+      const { directory, source, target } = fixture()
+      vi.spyOn(processes, 'runProcessSync').mockImplementation((spec) => {
+        const temporary = spec.args?.[2]
+        if (typeof temporary !== 'string') {
+          throw new Error('Missing clone destination')
+        }
+        copyFileSync(source, temporary)
+        writeFileSync(target, 'concurrent destination')
+        return { code: 0, signal: null, timedOut: false, stdout: '', stderr: '' }
+      })
+      expect(() => copyProfileStateRecoveryFile(source, target)).toThrow()
+      expect(readFileSync(target, 'utf8')).toBe('concurrent destination')
+      expectNoTemporary(directory)
+    })
+
+    it('falls back when the destination filesystem does not support hardlinks', () => {
+      const { directory, source, target } = fixture()
+      cloneLink.unsupported = true
+      copyProfileStateRecoveryFile(source, target)
+      expect(readFileSync(target).equals(readFileSync(source))).toBe(true)
+      expect(statSync(target, { bigint: true }).ino).not.toBe(
+        statSync(source, { bigint: true }).ino
+      )
+      expectNoTemporary(directory)
+    })
+  })
+})
diff --git a/src/main/persistence/profile-state/profile-state-recovery-copy.ts b/src/main/persistence/profile-state/profile-state-recovery-copy.ts
new file mode 100644
index 000000000000..cb7a1f9315bd
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-recovery-copy.ts
@@ -0,0 +1,81 @@
+import { constants, copyFileSync, linkSync, lstatSync, mkdtempSync, rmSync } from 'node:fs'
+import { basename, dirname, join, resolve } from 'node:path'
+import { runProcessSync } from '../../../shared/child-process/run-process'
+
+// Keep process startup overhead off small recovery copies.
+const MINIMUM_CLONE_BYTES = 8 * 1024 * 1024
+const MAXIMUM_CLONE_FILES = 16
+
+type RecoveryCopy = { source: string; target: string }
+
+/** Copy quiescent recovery artifacts independently; never copy an active WAL database this way. */
+export function copyProfileStateRecoveryFile(source: string, target: string): void {
+  copyProfileStateRecoveryFiles([{ source, target }])
+}
+
+/** Targets are staging files; callers validate, fsync and publish. */
+export function copyProfileStateRecoveryFiles(files: readonly RecoveryCopy[]): void {
+  const clones: RecoveryCopy[] = []
+  const names = new Set<string>()
+  for (const file of files) {
+    const info = process.platform === 'darwin' ? lstatSync(file.source) : undefined
+    const name = basename(file.source)
+    if (!info?.isFile() || info.size < MINIMUM_CLONE_BYTES) {
+      copyFileSync(file.source, file.target, constants.COPYFILE_EXCL)
+    } else if (
+      files.length > 1 &&
+      (clones.length === MAXIMUM_CLONE_FILES ||
+        !/^[a-z0-9][a-z0-9._-]*[a-z0-9]$/i.test(name) ||
+        names.has(name.toLowerCase()))
+    ) {
+      // cp derives temporary basenames; ambiguous names need their own private directory.
+      copyProfileStateRecoveryFile(file.source, file.target)
+    } else {
+      clones.push(file)
+      names.add(name.toLowerCase())
+    }
+  }
+  if (clones.length === 0) {
+    return
+  }
+  const directory = mkdtempSync(join(dirname(clones[0].target), '.orca-recovery-clone-'))
+  const temporary = (source: string) =>
+    join(directory, clones.length === 1 ? 'copy' : basename(source))
+  let cloned = false
+  try {
+    // Node's clone flag is unsupported on Darwin; cp -c falls back to ordinary copying.
+    const result = runProcessSync({
+      program: '/bin/cp',
+      args: [
+        '-c',
+        ...clones.map(({ source }) => resolve(source)),
+        resolve(clones.length === 1 ? temporary(clones[0].source) : directory)
+      ],
+      timeoutMs: 30_000 * clones.length,
+      maxOutputBytes: 16_384
+    })
+    if (result.timedOut || result.signal !== null) {
+      throw new Error('Profile recovery file copy was interrupted')
+    }
+    if (result.code === 0) {
+      for (const { source, target } of clones) {
+        try {
+          linkSync(temporary(source), target)
+        } catch (error) {
+          if (error instanceof Error && 'code' in error && error.code === 'EEXIST') {
+            throw error
+          }
+          copyFileSync(source, target, constants.COPYFILE_EXCL)
+        }
+      }
+      cloned = true
+    }
+  } finally {
+    rmSync(directory, { recursive: true, force: true })
+  }
+  if (!cloned) {
+    for (const { source, target } of clones) {
+      copyFileSync(source, target, constants.COPYFILE_EXCL)
+    }
+  }
+}
diff --git a/src/main/persistence/profile-state/profile-state-recovery-crash-boundaries.test.ts b/src/main/persistence/profile-state/profile-state-recovery-crash-boundaries.test.ts
new file mode 100644
index 000000000000..75e498b8d70c
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-recovery-crash-boundaries.test.ts
@@ -0,0 +1,380 @@
+import {
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  readdirSync,
+  rmSync,
+  writeFileSync
+} from 'node:fs'
+import { tmpdir } from 'node:os'
+import { basename, dirname, join } from 'node:path'
+import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, it, vi } from 'vitest'
+import { setSecretStore } from '../../../shared/secret-store'
+import { profileStateStorage } from '../../orca-profiles/profile-project-state-file'
+import {
+  acquireProfileStateMaintenance,
+  acquireProfileStateRuntimeAdmission
+} from './profile-state-access'
+import {
+  openProfileStateDatabase,
+  openProfileStateDatabaseReadOnly
+} from './profile-state-database'
+import {
+  hashProfileStateJson,
+  importProfileStateJson,
+  readProfileStateSnapshot
+} from './profile-state-documents'
+import {
+  profileStateJsonExportPath,
+  profileStateJsonExportPaths
+} from './legacy-json/profile-state-export-path'
+import {
+  createProfileStateDatabaseBackupId,
+  profileStateDatabaseBackupPath,
+  profileStateDatabaseBackups
+} from './profile-state-backup-path'
+import { writeProfileStateDatabaseSnapshotAsync } from './profile-state-database-snapshot'
+import { createProfileStateStore } from './profile-state-store-factory'
+import { restoreProfileStateJsonExport } from './legacy-json/profile-state-recovery'
+import { restoreProfileStateDatabaseBackup } from './profile-state-database-recovery'
+import {
+  buildRecoveryCrashProcess,
+  killRecoveryAt,
+  type RecoveryCrashOptions
+} from './profile-state-recovery-crash-process'
+
+vi.mock('../../telemetry/client', () => ({ track: () => {} }))
+vi.mock('../../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: () => ({ nth_repo_added: 2 })
+}))
+vi.mock('../../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: () => ({ hosts: [] }),
+  sshConfigHostsToTargets: () => []
+}))
+
+const suiteRoot = mkdtempSync(join(tmpdir(), 'orca-recovery-crash-boundaries-'))
+const fixtureRoots: string[] = []
+let bundle: string
+const profileId = 'crash-recovery'
+const selectedState = {
+  settings: {
+    theme: 'dark',
+    httpProxyUrl: Buffer.from('sealed-selected').toString('base64'),
+    electronHttp1CompatibilityMode: true
+  },
+  ui: { extension: { origin: 'selected', value: null } },
+  extension: { nested: [null, '\ud800', 'selected'], ['__proto__']: { inert: true } },
+  opaque: null,
+  repos: [],
+  automationRuns: [],
+  automations: []
+}
+const oldState = {
+  ...selectedState,
+  settings: {
+    ...selectedState.settings,
+    theme: 'light',
+    httpProxyUrl: Buffer.from('sealed-old').toString('base64')
+  },
+  ui: { extension: { origin: 'old', value: null } },
+  extension: { nested: [null, '\ud800', 'old'], ['__proto__']: { inert: true } }
+}
+const selectedJson = JSON.stringify(selectedState)
+const oldJson = JSON.stringify(oldState)
+
+beforeAll(() => {
+  bundle = buildRecoveryCrashProcess(suiteRoot)
+})
+beforeEach(() => {
+  setSecretStore({
+    isEncryptionAvailable: () => false,
+    encryptString: () => {
+      throw new Error('Keychain unavailable')
+    },
+    decryptString: () => {
+      throw new Error('Keychain unavailable')
+    },
+    describeProtectionGap: () => null
+  })
+})
+afterEach(() => {
+  for (const root of fixtureRoots.splice(0)) {
+    rmSync(root, { recursive: true, force: true })
+  }
+})
+afterAll(() => rmSync(suiteRoot, { recursive: true, force: true }))
+
+type Fixture = RecoveryCrashOptions & { backupBytes: Buffer; originalFamily: Map<string, Buffer> }
+
+async function fixture(kind: 'json' | 'sqlite', accepted: boolean): Promise<Fixture> {
+  const root = mkdtempSync(join(suiteRoot, 'profile-'))
+  fixtureRoots.push(root)
+  const directory = join(root, 'profiles', profileId)
+  mkdirSync(directory, { recursive: true })
+  writeFileSync(
+    join(root, 'orca-profile-index.json'),
+    JSON.stringify({ activeProfileId: profileId, profiles: [{ id: profileId }] })
+  )
+  const dataFile = join(directory, 'orca-data.json')
+  const databasePath = join(directory, 'profile-state.db')
+  const exportPath = profileStateJsonExportPath(dataFile, 3)
+  const backupPath = profileStateDatabaseBackupPath(
+    databasePath,
+    createProfileStateDatabaseBackupId()
+  )
+  const options = {
+    root,
+    profileId,
+    dataFile,
+    databasePath,
+    exportPath,
+    backupPath,
+    markerPath: join(root, 'http1-compatibility.json'),
+    kind
+  }
+  const source = openProfileStateDatabase(databasePath, profileId)
+  try {
+    importProfileStateJson(source.db, oldJson)
+    importProfileStateJson(source.db, oldJson)
+    importProfileStateJson(
+      source.db,
+      selectedJson,
+      accepted ? { acceptedLegacyJsonHash: hashProfileStateJson(selectedJson) } : {}
+    )
+    await writeProfileStateDatabaseSnapshotAsync(source.db, backupPath)
+  } finally {
+    source.db.close()
+  }
+  await killRecoveryAt(bundle, options, 'seed', oldJson)
+  expect(existsSync(`${databasePath}-wal`)).toBe(true)
+  expect(existsSync(`${databasePath}-shm`)).toBe(true)
+  // An empty abandoned rollback journal is harmless, but must be removed before publication.
+  writeFileSync(`${databasePath}-journal`, '')
+  if (accepted) {
+    writeFileSync(dataFile, selectedJson)
+  }
+  writeFileSync(exportPath, selectedJson)
+  writeFileSync(
+    profileStateJsonExportPath(dataFile, 1),
+    JSON.stringify({ ...oldState, exportRevision: 1 })
+  )
+  writeFileSync(
+    profileStateJsonExportPath(dataFile, 2),
+    JSON.stringify({ ...oldState, exportRevision: 2 })
+  )
+  writeFileSync(options.markerPath, JSON.stringify({ schemeVersion: 2, enabled: false, profileId }))
+  const originalFamily = new Map(
+    ['', '-wal', '-shm', '-journal'].map((suffix) => [
+      suffix,
+      readFileSync(`${databasePath}${suffix}`)
+    ])
+  )
+  return { ...options, backupBytes: readFileSync(backupPath), originalFamily }
+}
+
+function readSqlite(path: string): unknown {
+  const opened = openProfileStateDatabaseReadOnly(path, profileId)
+  try {
+    return JSON.parse(readProfileStateSnapshot(opened.db).json)
+  } finally {
+    opened.db.close()
+  }
+}
+
+function assertQuarantine(profile: Fixture): void {
+  const quarantine = readdirSync(dirname(profile.databasePath)).find((name) =>
+    name.startsWith('profile-state-corrupt-')
+  )
+  if (quarantine === undefined) {
+    throw new Error('Recovery did not preserve a quarantine')
+  }
+  const directory = join(dirname(profile.databasePath), quarantine)
+  // Check exact family bytes before opening the copied WAL snapshot.
+  for (const [suffix, bytes] of profile.originalFamily) {
+    expect(readFileSync(join(directory, `profile-state.db${suffix}`))).toEqual(bytes)
+  }
+  expect(readFileSync(join(directory, basename(profile.exportPath)), 'utf8')).toBe(selectedJson)
+  expect(readFileSync(join(directory, basename(profile.backupPath)))).toEqual(profile.backupBytes)
+  expect(readSqlite(join(directory, 'profile-state.db'))).toEqual(oldState)
+}
+
+function assertRestart(profile: Fixture, expected: 'old' | 'selected' | 'refused'): void {
+  const admission = acquireProfileStateRuntimeAdmission(profile.root)
+  try {
+    const open = () =>
+      createProfileStateStore({
+        dataFile: profile.dataFile,
+        databaseFile: profile.databasePath,
+        profileId
+      })
+    if (expected === 'refused') {
+      expect(open).toThrow()
+      expect(() => profileStateStorage(profileId, profile.root)).toThrow()
+      return
+    }
+    const expectedState = expected === 'old' ? oldState : selectedState
+    const storage = profileStateStorage(profileId, profile.root)
+    const raw =
+      storage === 'sqlite'
+        ? readSqlite(profile.databasePath)
+        : JSON.parse(readFileSync(profile.dataFile, 'utf8'))
+    // Full raw-state equality is checked before Store normalization can hide a lost domain.
+    expect(raw).toEqual(expectedState)
+    const reopened = open()
+    try {
+      expect(reopened.backend).toBe('sqlite')
+      expect(reopened.migrated).toBe(storage === 'json')
+      expect(profileStateStorage(profileId, profile.root)).toBe('sqlite')
+      const projected: unknown = JSON.parse(reopened.store.prepareProfileStateExport().json)
+      expect(projected).toMatchObject(expectedState)
+    } finally {
+      reopened.store.freezeWrites()
+    }
+  } finally {
+    admission.release()
+  }
+}
+
+function retry(profile: Fixture): void {
+  const maintenance = acquireProfileStateMaintenance(profile.root)
+  try {
+    if (profile.kind === 'json') {
+      expect(profileStateJsonExportPaths(profile.dataFile)).toContain(profile.exportPath)
+      restoreProfileStateJsonExport({ ...profile, maintenance })
+    } else {
+      expect(
+        profileStateDatabaseBackups(profile.databasePath).some(
+          (backup) => backup.path === profile.backupPath
+        )
+      ).toBe(true)
+      restoreProfileStateDatabaseBackup({ ...profile, maintenance })
+    }
+  } finally {
+    maintenance.release()
+  }
+  assertRestart(profile, 'selected')
+}
+
+const JSON_BOUNDARIES = [
+  'marker-invalidated',
+  'json-publish:before',
+  'json-publish:after',
+  'primary',
+  'wal',
+  'shm',
+  'journal',
+  'other-export',
+  'first-export',
+  'backup',
+  'selected-export',
+  'restore-returned',
+  'marker-publish:before',
+  'marker-publish:after',
+  'marker-refreshed'
+] as const
+
+function stage(profile: Fixture, name: string): string {
+  const paths: Record<string, string> = {
+    primary: profile.databasePath,
+    wal: `${profile.databasePath}-wal`,
+    shm: `${profile.databasePath}-shm`,
+    journal: `${profile.databasePath}-journal`,
+    'other-export': profileStateJsonExportPath(profile.dataFile, 2),
+    'first-export': profileStateJsonExportPath(profile.dataFile, 1),
+    'marker-invalidated': profile.markerPath,
+    backup: profile.backupPath,
+    'selected-export': profile.exportPath,
+    json: profile.dataFile
+  }
+  const target = paths[name]
+  return target === undefined ? name : `removed:${target}`
+}
+
+describe.each([false, true])('JSON recovery process death, accepted prior JSON=%s', (accepted) => {
+  it.each(JSON_BOUNDARIES)(
+    'preserves a complete authority or exact retry at %s',
+    async (boundary) => {
+      const profile = await fixture('json', accepted)
+      await killRecoveryAt(bundle, profile, stage(profile, boundary))
+      assertQuarantine(profile)
+      const finished = [
+        'selected-export',
+        'restore-returned',
+        'marker-publish:before',
+        'marker-publish:after',
+        'marker-refreshed'
+      ].includes(boundary)
+      const expected = finished
+        ? 'selected'
+        : ['marker-invalidated', 'json-publish:before'].includes(boundary) ||
+            (boundary === 'json-publish:after' && accepted)
+          ? 'old'
+          : 'refused'
+      if (finished) {
+        expect(readFileSync(profile.dataFile, 'utf8')).toBe(selectedJson)
+        expect(profileStateJsonExportPaths(profile.dataFile)).toEqual([])
+        expect(profileStateDatabaseBackups(profile.databasePath)).toEqual([])
+      }
+      assertRestart(profile, expected)
+      if (!finished) {
+        expect(readFileSync(profile.exportPath, 'utf8')).toBe(selectedJson)
+        retry(profile)
+      }
+    }
+  )
+})
+
+describe('SQLite recovery process death', () => {
+  it.each([
+    'marker-invalidated',
+    'selected-export',
+    'other-export',
+    'first-export',
+    'primary',
+    'wal',
+    'shm',
+    'journal',
+    'json',
+    'sqlite-publish:before',
+    'sqlite-publish:after',
+    'restore-returned',
+    'marker-publish:before',
+    'marker-publish:after',
+    'marker-refreshed'
+  ])('preserves full state and its immutable retry backup at %s', async (boundary) => {
+    const profile = await fixture('sqlite', true)
+    await killRecoveryAt(bundle, profile, stage(profile, boundary))
+    assertQuarantine(profile)
+    expect(readFileSync(profile.backupPath)).toEqual(profile.backupBytes)
+    const expected = [
+      'marker-invalidated',
+      'selected-export',
+      'other-export',
+      'first-export'
+    ].includes(boundary)
+      ? 'old'
+      : [
+            'sqlite-publish:after',
+            'restore-returned',
+            'marker-publish:before',
+            'marker-publish:after',
+            'marker-refreshed'
+          ].includes(boundary)
+        ? 'selected'
+        : 'refused'
+    assertRestart(profile, expected)
+    retry(profile)
+    expect(readFileSync(profile.backupPath)).toEqual(profile.backupBytes)
+  })
+
+  it.skipIf(process.platform === 'win32')(
+    'allows clean JSON startup after final artifact cleanup is directory-synced',
+    async () => {
+      const profile = await fixture('json', true)
+      await killRecoveryAt(bundle, profile, 'cleanup-directory-synced')
+      assertQuarantine(profile)
+      assertRestart(profile, 'selected')
+    }
+  )
+})
diff --git a/src/main/persistence/profile-state/profile-state-recovery-crash-process.ts b/src/main/persistence/profile-state/profile-state-recovery-crash-process.ts
new file mode 100644
index 000000000000..5b542fff161c
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-recovery-crash-process.ts
@@ -0,0 +1,178 @@
+import { once } from 'node:events'
+import { writeFileSync } from 'node:fs'
+import { dirname, join } from 'node:path'
+import { buildSync } from 'esbuild'
+import { spawnProcess } from '../../../shared/child-process/run-process'
+
+export type RecoveryCrashOptions = {
+  root: string
+  profileId: string
+  dataFile: string
+  databasePath: string
+  exportPath: string
+  backupPath: string
+  markerPath: string
+  kind: 'json' | 'sqlite'
+}
+
+/** Build only the recovery graph into an isolated test directory, never shared out/. */
+export function buildRecoveryCrashProcess(directory: string): string {
+  const bundle = join(directory, 'recovery-crash-api.cjs')
+  buildSync({
+    stdin: {
+      contents: `
+        export { acquireProfileStateMaintenance } from './src/main/persistence/profile-state/profile-state-access'
+        export { restoreProfileStateJsonExport } from './src/main/persistence/profile-state/legacy-json/profile-state-recovery'
+        export { restoreProfileStateDatabaseBackup } from './src/main/persistence/profile-state/profile-state-database-recovery'
+        export { openProfileStateDatabase } from './src/main/persistence/profile-state/profile-state-database'
+        export { importProfileStateJson } from './src/main/persistence/profile-state/profile-state-documents'
+        export { invalidateHttp1CompatibilityMarker, writeHttp1CompatibilityMarker } from './src/main/startup/http1-compatibility-marker'
+      `,
+      loader: 'ts',
+      resolveDir: process.cwd()
+    },
+    outfile: bundle,
+    bundle: true,
+    platform: 'node',
+    format: 'cjs',
+    packages: 'external'
+  })
+  return bundle
+}
+
+const CHILD_SOURCE = `
+const fs = require('node:fs')
+const [bundle, raw, stage, payloadPath] = process.argv.slice(2)
+const options = JSON.parse(raw)
+const payload = fs.readFileSync(payloadPath, 'utf8')
+const api = require(bundle)
+const barrier = label => {
+  if (label !== stage) return
+  fs.writeSync(1, label + '\\n')
+  fs.readSync(0, Buffer.alloc(1), 0, 1)
+  throw new Error('Crash barrier unexpectedly resumed')
+}
+if (stage === 'seed') {
+  const source = api.openProfileStateDatabase(options.databasePath, options.profileId)
+  api.importProfileStateJson(source.db, payload, { expectedRevision: 3 })
+  barrier('seed')
+}
+const rename = fs.renameSync
+fs.renameSync = (from, to) => {
+  if (to === options.dataFile) barrier('json-publish:before')
+  if (to === options.databasePath) barrier('sqlite-publish:before')
+  if (to === options.markerPath) barrier('marker-publish:before')
+  rename(from, to)
+  if (to === options.dataFile) barrier('json-publish:after')
+  if (to === options.databasePath) barrier('sqlite-publish:after')
+  if (to === options.markerPath) barrier('marker-publish:after')
+}
+const rm = fs.rmSync
+fs.rmSync = (target, ...rest) => {
+  rm(target, ...rest)
+  barrier('removed:' + target)
+}
+let clone = 0
+const link = fs.linkSync
+fs.linkSync = (from, to) => {
+  const isClone = from.includes('.orca-recovery-clone-')
+  if (isClone) barrier('clone:' + (++clone) + ':before')
+  link(from, to)
+  if (isClone) barrier('clone:' + clone + ':after')
+}
+const fsync = fs.fsyncSync
+fs.fsyncSync = descriptor => {
+  fsync(descriptor)
+  if (fs.fstatSync(descriptor).isDirectory() && !fs.existsSync(options.exportPath)) {
+    barrier('cleanup-directory-synced')
+  }
+}
+const maintenance = api.acquireProfileStateMaintenance(options.root)
+const recovered = (options.kind === 'json'
+  ? api.restoreProfileStateJsonExport
+  : api.restoreProfileStateDatabaseBackup)({
+    ...options, maintenance,
+    beforeRestore: () => api.invalidateHttp1CompatibilityMarker(options.root)
+  })
+barrier('restore-returned')
+api.writeHttp1CompatibilityMarker(options.root, true, options.profileId)
+barrier('marker-refreshed')
+maintenance.release()
+throw new Error('Requested crash boundary was not reached: ' + stage)
+`
+
+/** A pipe barrier proves the syscall completed before the parent sends SIGKILL. */
+export async function killRecoveryAt(
+  bundle: string,
+  options: RecoveryCrashOptions,
+  stage: string,
+  payload = ''
+): Promise<void> {
+  const childScript = join(dirname(bundle), 'recovery-crash-child.cjs')
+  const payloadPath = join(dirname(bundle), 'recovery-crash-payload.json')
+  writeFileSync(childScript, CHILD_SOURCE, 'utf8')
+  writeFileSync(payloadPath, payload, 'utf8')
+  const childEnv = {
+    ORCA_BACKGROUND_LAUNCH: '1',
+    ...(process.env.PATH ? { PATH: process.env.PATH } : {}),
+    ...(process.env.SystemRoot ? { SystemRoot: process.env.SystemRoot } : {}),
+    ...(process.env.TEMP ? { TEMP: process.env.TEMP } : {}),
+    ...(process.env.TMP ? { TMP: process.env.TMP } : {})
+  }
+  const recoveryOptions: RecoveryCrashOptions = {
+    root: options.root,
+    profileId: options.profileId,
+    dataFile: options.dataFile,
+    databasePath: options.databasePath,
+    exportPath: options.exportPath,
+    backupPath: options.backupPath,
+    markerPath: options.markerPath,
+    kind: options.kind
+  }
+  const child = spawnProcess({
+    program: process.execPath,
+    args: [childScript, bundle, JSON.stringify(recoveryOptions), stage, payloadPath],
+    env: childEnv
+  })
+  let stderr = ''
+  child.stderr.on('data', (chunk: Buffer) => {
+    stderr += chunk.toString()
+  })
+  try {
+    await new Promise<void>((resolve, reject) => {
+      let stdout = ''
+      const timer = setTimeout(
+        () => finish(new Error(`Crash boundary timed out: ${stage}; ${stderr}`)),
+        10_000
+      )
+      const onData = (chunk: Buffer) => {
+        stdout += chunk.toString()
+        if (stdout.includes(`${stage}\n`)) {
+          finish()
+        }
+      }
+      const onExit = () => finish(new Error(`Recovery exited before ${stage}: ${stderr}`))
+      const onError = (error: Error) => finish(error)
+      const finish = (error?: Error) => {
+        clearTimeout(timer)
+        child.stdout.off('data', onData)
+        child.off('exit', onExit)
+        child.off('error', onError)
+        if (error) {
+          reject(error)
+        } else {
+          resolve()
+        }
+      }
+      child.stdout.on('data', onData)
+      child.once('exit', onExit)
+      child.once('error', onError)
+    })
+  } finally {
+    if (child.exitCode === null && child.signalCode === null) {
+      const closed = once(child, 'close')
+      child.kill('SIGKILL')
+      await closed
+    }
+  }
+}
diff --git a/src/main/persistence/profile-state/profile-state-recovery-required.ts b/src/main/persistence/profile-state/profile-state-recovery-required.ts
new file mode 100644
index 000000000000..12a254f7f1e9
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-recovery-required.ts
@@ -0,0 +1,85 @@
+import { existsSync } from 'node:fs'
+import { hasStateBackup } from './legacy-json/profile-state-legacy-backup-path'
+import { profileStateJsonExportPaths } from './legacy-json/profile-state-export-path'
+import { profileStateDatabaseBackups } from './profile-state-backup-path'
+
+type ProfileStateRecoveryLocation = {
+  dataFile: string
+  databaseFile: string
+  profileId: string
+}
+
+export class ProfileStateAuthorityBootstrapError extends Error {
+  readonly code = 'ambiguous-profile-state' as const
+
+  /** `diverged-json`: both copies are readable, so the user can pick one at startup. */
+  constructor(
+    message: string,
+    readonly divergence?: 'diverged-json'
+  ) {
+    super(message)
+    this.name = 'ProfileStateAuthorityBootstrapError'
+  }
+}
+
+/** Never establish a new authority over evidence that the primary was lost. */
+export function assertProfileStateCanInitialize(options: ProfileStateRecoveryLocation): void {
+  assertNoRetainedProfileStateExports(options)
+  if (!existsSync(options.dataFile) && hasStateBackup(options.dataFile)) {
+    throw new ProfileStateAuthorityBootstrapError(
+      `Legacy profile JSON is missing while its .bak.0–.bak.4 backups remain. Stop Orca and restore a selected backup to ${options.dataFile} before reopening.`
+    )
+  }
+}
+
+/** Startup can surface this error with the exact artifacts an explicit rollback may use. */
+export class ProfileStateRecoveryRequiredError extends Error {
+  readonly code = 'profile-state-recovery-required' as const
+  readonly dataFile: string
+  readonly databaseFile: string
+  readonly exportPaths: readonly string[]
+  readonly backupPaths: readonly string[]
+
+  constructor(options: ProfileStateRecoveryLocation, cause: unknown) {
+    super(
+      `SQLite profile state could not be read; choose a retained backup or JSON export to recover the profile`,
+      { cause }
+    )
+    this.name = 'ProfileStateRecoveryRequiredError'
+    this.dataFile = options.dataFile
+    this.databaseFile = options.databaseFile
+    // Recovery guidance must survive a permissions failure while enumerating the directory.
+    // The startup error still names the canonical paths and remains typed for fail-closed handling.
+    try {
+      this.exportPaths = profileStateJsonExportPaths(options.dataFile)
+    } catch {
+      this.exportPaths = []
+    }
+    try {
+      this.backupPaths = profileStateDatabaseBackups(options.databaseFile).map(({ path }) => path)
+    } catch {
+      this.backupPaths = []
+    }
+  }
+}
+
+/** A retained migration export proves that absent SQLite is not a fresh profile. */
+export function assertNoRetainedProfileStateExports(options: ProfileStateRecoveryLocation): void {
+  let hasRetainedExport: boolean
+  try {
+    hasRetainedExport =
+      profileStateJsonExportPaths(options.dataFile).length > 0 ||
+      profileStateDatabaseBackups(options.databaseFile).length > 0
+  } catch {
+    throw new ProfileStateRecoveryRequiredError(
+      options,
+      new Error('Could not enumerate retained profile state exports')
+    )
+  }
+  if (hasRetainedExport) {
+    throw new ProfileStateRecoveryRequiredError(
+      options,
+      new Error('SQLite profile state is missing while retained migration exports exist')
+    )
+  }
+}
diff --git a/src/main/persistence/profile-state/profile-state-revision-readmission.ts b/src/main/persistence/profile-state/profile-state-revision-readmission.ts
new file mode 100644
index 000000000000..8a3c3df338de
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-revision-readmission.ts
@@ -0,0 +1,20 @@
+import { openProfileStateDatabaseReadOnly } from './profile-state-database'
+import { readProfileStateRevision } from './profile-state-documents'
+import { ProfileStateRevisionConflictError } from './profile-state-document-validation'
+
+/** Reopening a live snapshot cannot adopt another writer's intervening revision. */
+export function assertProfileStateRevisionOnDisk(
+  databasePath: string,
+  profileId: string,
+  revision: number
+): void {
+  const admitted = openProfileStateDatabaseReadOnly(databasePath, profileId)
+  try {
+    const actual = readProfileStateRevision(admitted.db)
+    if (actual !== revision) {
+      throw new ProfileStateRevisionConflictError(revision, actual)
+    }
+  } finally {
+    admitted.db.close()
+  }
+}
diff --git a/src/main/persistence/profile-state/profile-state-revision.ts b/src/main/persistence/profile-state/profile-state-revision.ts
new file mode 100644
index 000000000000..6c64714606f7
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-revision.ts
@@ -0,0 +1,31 @@
+import type Database from '../../sqlite/sync-database'
+import { PROFILE_STATE_META_REVISION } from './profile-state-database-schema'
+import { isRecord, ProfileStateDocumentCorruptionError } from './profile-state-document-validation'
+
+export function readProfileStateRevision(db: Database.Database): number {
+  const row = db
+    .prepare('SELECT value FROM profile_state_meta WHERE key = ?')
+    .get(PROFILE_STATE_META_REVISION)
+  if (!isRecord(row) || typeof row.value !== 'string') {
+    return 0
+  }
+  const revision = Number(row.value)
+  if (!Number.isSafeInteger(revision) || revision < 0) {
+    throw new ProfileStateDocumentCorruptionError('Profile state revision is invalid')
+  }
+  return revision
+}
+
+/** Unchanged domains may lag the profile revision, but cannot lead it. */
+export function assertProfileStateDocumentRevision(
+  revision: number,
+  profileRevision: number,
+  domain: string
+): void {
+  if (revision > profileRevision) {
+    throw new ProfileStateDocumentCorruptionError(
+      `Profile state document revision ${revision} exceeds profile revision ${profileRevision}`,
+      domain
+    )
+  }
+}
diff --git a/src/main/persistence/profile-state/profile-state-runtime-preflight.test.ts b/src/main/persistence/profile-state/profile-state-runtime-preflight.test.ts
new file mode 100644
index 000000000000..34a4b02c0a42
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-runtime-preflight.test.ts
@@ -0,0 +1,60 @@
+import { build } from 'esbuild'
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join, resolve } from 'node:path'
+import { afterAll, beforeAll, describe, expect, it } from 'vitest'
+import { preflightProfileStateRuntime } from './profile-state-runtime-preflight'
+
+let directory: string
+let workerPath: string
+let backupWorkerPath: string
+
+beforeAll(async () => {
+  directory = mkdtempSync(join(tmpdir(), 'orca-preflight-test-'))
+  workerPath = join(directory, 'profile-state-writer-worker-entry.js')
+  backupWorkerPath = join(directory, 'profile-state-backup-worker-entry.js')
+  await build({
+    entryPoints: [
+      resolve('src/main/persistence/profile-state/profile-state-writer-worker-entry.ts'),
+      resolve('src/main/persistence/profile-state/profile-state-backup-worker-entry.ts')
+    ],
+    outdir: directory,
+    bundle: true,
+    platform: 'node',
+    format: 'cjs',
+    logLevel: 'silent'
+  })
+})
+
+afterAll(() => rmSync(directory, { recursive: true, force: true }))
+
+describe('profile runtime preflight', () => {
+  it('requires a worker commit and an independently readable backup', async () => {
+    const result = await preflightProfileStateRuntime({ workerPath, backupWorkerPath })
+    expect(result.revision).toBe(1)
+    expect(result.sqliteVersion).toMatch(/^\d+\.\d+\.\d+$/)
+  })
+
+  it('refuses readiness when a required worker artifact is absent', async () => {
+    await expect(
+      preflightProfileStateRuntime({
+        workerPath: join(directory, 'missing.js'),
+        backupWorkerPath
+      })
+    ).rejects.toThrow('Profile state writer')
+  })
+
+  it('does not trust a backup success reply without a valid database', async () => {
+    const corruptBackup = join(directory, 'corrupt-backup.cjs')
+    writeFileSync(
+      corruptBackup,
+      `const { parentPort, workerData } = require('node:worker_threads')
+       require('node:fs').writeFileSync(workerData.targetPath, 'not a database')
+       parentPort.postMessage({ ok: true })
+       parentPort.close()`
+    )
+    await expect(
+      preflightProfileStateRuntime({ workerPath, backupWorkerPath: corruptBackup })
+    ).rejects.toThrow()
+  })
+})
diff --git a/src/main/persistence/profile-state/profile-state-runtime-preflight.ts b/src/main/persistence/profile-state/profile-state-runtime-preflight.ts
new file mode 100644
index 000000000000..90a8ab1fab13
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-runtime-preflight.ts
@@ -0,0 +1,67 @@
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { randomUUID } from 'node:crypto'
+import {
+  openProfileStateDatabase,
+  openProfileStateDatabaseReadOnly
+} from './profile-state-database'
+import { readProfileStateSnapshot } from './profile-state-documents'
+import { runProfileStateBackupWorker } from './profile-state-backup-worker'
+import { ProfileStateWriteWorkerClient } from './profile-state-writer-worker-client'
+
+export type ProfileStateRuntimePreflightResult = {
+  sqliteVersion: string
+  revision: number
+}
+
+/** Qualify the installed writer and backup without opening an existing user profile. */
+export async function preflightProfileStateRuntime(
+  options: { workerPath?: string; backupWorkerPath?: string; timeoutMs?: number } = {}
+): Promise<ProfileStateRuntimePreflightResult> {
+  const directory = await mkdtemp(join(tmpdir(), 'orca-profile-preflight-'))
+  const databasePath = join(directory, 'profile.db')
+  const targetPath = join(directory, 'backup.db')
+  const profileId = randomUUID()
+  const payload = JSON.stringify({ witness: profileId, unicode: '雪 🐋', surrogate: '\ud800' })
+  let writer: ProfileStateWriteWorkerClient | undefined
+  try {
+    const initial = openProfileStateDatabase(databasePath, profileId)
+    let revision: number
+    try {
+      revision = readProfileStateSnapshot(initial.db).revision
+    } finally {
+      initial.db.close()
+    }
+    writer = new ProfileStateWriteWorkerClient({ databasePath, profileId, revision }, options)
+    await writer.ready
+    const committedRevision = await writer.writeCompleteSerializedDomains([
+      { domain: 'preflight', payload }
+    ])
+    await writer.close()
+    await runProfileStateBackupWorker(
+      { databasePath, profileId, targetPath },
+      { workerPath: options.backupWorkerPath, timeoutMs: options.timeoutMs }
+    )
+    const backup = openProfileStateDatabaseReadOnly(targetPath, profileId)
+    try {
+      const snapshot = readProfileStateSnapshot(backup.db)
+      if (snapshot.revision !== committedRevision || snapshot.json !== `{"preflight":${payload}}`) {
+        throw new Error('Profile runtime backup did not preserve the acknowledged state')
+      }
+      const row = backup.db.prepare('SELECT sqlite_version() AS version').get()
+      if (typeof row?.version !== 'string') {
+        throw new Error('Profile runtime did not report its SQLite version')
+      }
+      return { sqliteVersion: row.version, revision: committedRevision }
+    } finally {
+      backup.db.close()
+    }
+  } finally {
+    try {
+      await writer?.close()
+    } finally {
+      await rm(directory, { recursive: true, force: true })
+    }
+  }
+}
diff --git a/src/main/persistence/profile-state/profile-state-sqlite-authority.ts b/src/main/persistence/profile-state/profile-state-sqlite-authority.ts
new file mode 100644
index 000000000000..8c1408ec5115
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-sqlite-authority.ts
@@ -0,0 +1,339 @@
+import { existsSync } from 'node:fs'
+import type {
+  ProfileStateAuthority,
+  ProfileStateAuthorityInitialState,
+  ProfileStateDomainReplacement,
+  ProfileStateMaintenance
+} from '../loading-store/profile-state-authority'
+import {
+  importProfileStateJson,
+  readAcceptedProfileStateParsedSnapshot,
+  readProfileStateParsedSnapshot,
+  readProfileStateRevision,
+  readProfileStateSnapshot
+} from './profile-state-documents'
+import {
+  openWritableProfileStateDatabase,
+  openProfileStateDatabaseReadOnly
+} from './profile-state-database'
+import { writeProfileStateDomains } from './profile-state-domain-writes'
+import {
+  prepareProfileStateDomainMutation,
+  validateProfileStateDomainTransaction
+} from './profile-state-domain-write-validation'
+import {
+  parseProfileStateRoot,
+  ProfileStateRevisionConflictError
+} from './profile-state-document-validation'
+import { assertProfileStateRevisionOnDisk } from './profile-state-revision-readmission'
+import {
+  quarantineProfileStateDatabase,
+  type ProfileStateDatabaseQuarantine
+} from './profile-state-database-quarantine'
+import {
+  writeProfileStateAuthorityJsonExport,
+  writeProfileStateAuthorityCompatibilityExport,
+  writeProfileStateAuthorityCompatibilityExportAsync
+} from './legacy-json/profile-state-authority-exports'
+import { buildCompleteDocumentReplacements } from './profile-state-complete-replacements'
+import { ProfileStateBackupRotation } from './profile-state-backup-rotation'
+import type { ProfileStateWriterInitialization } from './profile-state-writer-protocol'
+
+/**
+ * Complete-document authority for the Store cutover.
+ *
+ * A Store authority keeps one writable handle for its lifetime so repeated
+ * domain commits do not pay connection and pragma setup costs. Store teardown
+ * calls {@link close} before profile switches or process removal. Complete
+ * payloads use one fenced domain transaction, so unchanged normalized rows are
+ * not rebuilt; Store callers can still opt into narrower dirty-domain writes.
+ */
+export class ProfileStateSqliteAuthority implements ProfileStateAuthority {
+  private retired = false
+  private observedRevision: number | undefined
+  private writableDatabase: ReturnType<typeof openWritableProfileStateDatabase> | undefined
+  private backupRotation: ProfileStateBackupRotation | undefined
+
+  constructor(
+    private readonly databasePath: string,
+    private readonly profileId: string
+  ) {}
+
+  retireForWorker(): ProfileStateWriterInitialization {
+    this.assertActive()
+    if (this.observedRevision === undefined || this.backupRotation !== undefined) {
+      throw new Error('Profile state worker handoff requires an admitted bootstrap authority')
+    }
+    const initialization = {
+      databasePath: this.databasePath,
+      profileId: this.profileId,
+      revision: this.observedRevision
+    }
+    this.close()
+    this.retired = true
+    return initialization
+  }
+
+  initializeFromRevision(revision: number): void {
+    this.assertActive()
+    if (this.observedRevision !== undefined || !Number.isSafeInteger(revision) || revision < 0) {
+      throw new Error('Invalid profile state worker revision handoff')
+    }
+    assertProfileStateRevisionOnDisk(this.databasePath, this.profileId, revision)
+    this.observedRevision = revision
+    this.assertCurrentRevision()
+  }
+
+  get revision(): number {
+    this.assertActive()
+    if (this.observedRevision === undefined) {
+      throw new Error('Profile state authority has no admitted revision')
+    }
+    return this.observedRevision
+  }
+
+  /** Keep the startup payload and write fence on the same accepted revision. */
+  readAcceptedState(
+    rawJson: string
+  ): ProfileStateAuthorityInitialState<ProfileStateSqliteAuthority> | undefined {
+    this.assertActive()
+    const opened = openProfileStateDatabaseReadOnly(this.databasePath, this.profileId)
+    try {
+      const snapshot = readAcceptedProfileStateParsedSnapshot(opened.db, rawJson)
+      if (snapshot === undefined) {
+        return undefined
+      }
+      return this.createInitialState(snapshot.revision, snapshot.state)
+    } finally {
+      opened.db.close()
+    }
+  }
+
+  readInitialState(): ProfileStateAuthorityInitialState<ProfileStateSqliteAuthority> {
+    this.assertActive()
+    if (!this.writableDatabase && !existsSync(this.databasePath)) {
+      return this.createInitialState(0, undefined)
+    }
+    const opened =
+      this.writableDatabase ?? openProfileStateDatabaseReadOnly(this.databasePath, this.profileId)
+    try {
+      const snapshot = readProfileStateParsedSnapshot(opened.db)
+      return this.createInitialState(
+        snapshot.revision,
+        snapshot.revision === 0 ? undefined : snapshot.state
+      )
+    } finally {
+      if (opened !== this.writableDatabase) {
+        opened.db.close()
+      }
+    }
+  }
+
+  readSerializedState(): string | undefined {
+    this.assertActive()
+    if (!this.writableDatabase && !existsSync(this.databasePath)) {
+      // Treat an absent database as the empty revision so a concurrent creator
+      // cannot race this authority's first commit.
+      this.observedRevision = 0
+      return undefined
+    }
+    const opened =
+      this.writableDatabase ?? openProfileStateDatabaseReadOnly(this.databasePath, this.profileId)
+    try {
+      const snapshot = readProfileStateSnapshot(opened.db)
+      this.observedRevision = snapshot.revision
+      return snapshot.revision === 0 ? undefined : snapshot.json
+    } finally {
+      if (opened !== this.writableDatabase) {
+        opened.db.close()
+      }
+    }
+  }
+
+  writeSerializedDomains(
+    replacements: readonly ProfileStateDomainReplacement[],
+    automationRunsAfter?: readonly unknown[]
+  ): void {
+    this.assertActive()
+    if (this.observedRevision === undefined) {
+      // Store normally reads before its first write. Establishing the revision
+      // here keeps direct authority callers fenced too.
+      this.readSerializedState()
+    }
+    const opened = this.openWritableDatabase()
+    this.observedRevision = writeProfileStateDomains(opened.db, {
+      expectedRevision: this.observedRevision ?? 0,
+      replacements,
+      automationRunsAfter
+    }).revision
+  }
+
+  assertCurrentRevision(): void {
+    const actualRevision = readProfileStateRevision(this.openWritableDatabase().db)
+    if (this.observedRevision === undefined || actualRevision !== this.observedRevision) {
+      throw new ProfileStateRevisionConflictError(this.observedRevision ?? 0, actualRevision)
+    }
+  }
+
+  writeSerializedAutomationRuns(
+    replacements: readonly ProfileStateDomainReplacement[],
+    runs: readonly unknown[]
+  ): void {
+    this.writeSerializedDomains(replacements, runs)
+  }
+
+  writeSerializedState(payload: Buffer): void {
+    this.assertActive()
+    const serialized = payload.toString('utf8')
+    if (!Buffer.from(serialized, 'utf8').equals(payload)) {
+      throw new Error('Profile state payload is not valid UTF-8')
+    }
+    const parsed = parseProfileStateRoot(serialized)
+    this.writeCompleteSerializedDomains(
+      Object.entries(parsed).map(([domain, value]) => {
+        const payload = JSON.stringify(value)
+        if (payload === undefined) {
+          throw new Error(`Profile state domain payload is not serializable: ${domain}`)
+        }
+        return { domain, payload }
+      })
+    )
+  }
+
+  writeCompleteSerializedDomains(replacements: readonly ProfileStateDomainReplacement[]): void {
+    this.assertActive()
+    if (this.observedRevision === undefined) {
+      this.readSerializedState()
+    }
+    if (!Array.isArray(replacements) || replacements.length > 0) {
+      validateProfileStateDomainTransaction({
+        expectedRevision: this.observedRevision ?? 0,
+        replacements
+      })
+    }
+    const opened = this.openWritableDatabase()
+    const currentRevision = readProfileStateRevision(opened.db)
+    const complete = buildCompleteDocumentReplacements(opened.db, replacements)
+    if (currentRevision === 0 || complete.length === 0) {
+      // Each fragment must be valid independently before it can become part of a root object.
+      for (const replacement of replacements) {
+        prepareProfileStateDomainMutation(replacement)
+      }
+      const rawJson = `{${replacements
+        .filter(({ payload }) => payload !== null)
+        .map(({ domain, payload }) => `${JSON.stringify(domain)}:${payload}`)
+        .join(',')}}`
+      this.observedRevision = importProfileStateJson(opened.db, rawJson, {
+        expectedRevision: this.observedRevision
+      })
+      return
+    }
+    this.observedRevision = writeProfileStateDomains(opened.db, {
+      expectedRevision: this.observedRevision ?? currentRevision,
+      replacements: complete
+    }).revision
+  }
+
+  scheduleBackup(): void {
+    this.assertActive()
+    this.backupRotation ??= new ProfileStateBackupRotation(this.databasePath, this.profileId)
+    this.backupRotation.schedule()
+  }
+
+  async drainBackups(): Promise<void> {
+    this.assertActive()
+    await this.backupRotation?.drain()
+  }
+
+  writeJsonExport(targetPath: string): number {
+    return writeProfileStateAuthorityJsonExport(
+      this.openWritableDatabase().db,
+      targetPath,
+      this.observedRevision
+    )
+  }
+
+  writeJsonCompatibilityExport(targetPath: string): number | undefined {
+    return writeProfileStateAuthorityCompatibilityExport(
+      this.openWritableDatabase().db,
+      targetPath,
+      this.observedRevision
+    )
+  }
+
+  writeJsonCompatibilityExportAsync(targetPath: string): Promise<number | undefined> {
+    return writeProfileStateAuthorityCompatibilityExportAsync(
+      this.openWritableDatabase().db,
+      targetPath,
+      this.observedRevision
+    )
+  }
+
+  quarantineDatabase(quarantineRoot?: string, reason?: string): ProfileStateDatabaseQuarantine {
+    this.assertActive()
+    this.backupRotation?.assertIdle()
+    this.close()
+    return quarantineProfileStateDatabase(this.databasePath, this.profileId, quarantineRoot, reason)
+  }
+
+  close(): void {
+    this.assertActive()
+    this.backupRotation?.stop()
+    this.writableDatabase?.db.close()
+    this.writableDatabase = undefined
+  }
+
+  async pauseForMaintenance(): Promise<ProfileStateMaintenance> {
+    const revision = this.revision
+    await this.drainBackups()
+    this.close()
+    let consumed = false
+    return {
+      resume: async () => {
+        if (consumed) {
+          throw new Error('Profile maintenance resume has already been consumed')
+        }
+        consumed = true
+        assertProfileStateRevisionOnDisk(this.databasePath, this.profileId, revision)
+        this.assertCurrentRevision()
+        this.backupRotation = undefined
+      }
+    }
+  }
+
+  private createInitialState(
+    revision: number,
+    value: Record<string, unknown> | undefined
+  ): ProfileStateAuthorityInitialState<ProfileStateSqliteAuthority> {
+    let pending: { revision: number; value: Record<string, unknown> | undefined } | undefined = {
+      revision,
+      value
+    }
+    this.observedRevision = revision
+    return {
+      authority: this,
+      takeParsedState: () => {
+        this.assertActive()
+        const snapshot = pending
+        if (snapshot === undefined) {
+          throw new Error('Profile state startup snapshot has already been consumed')
+        }
+        pending = undefined
+        this.observedRevision = snapshot.revision
+        return snapshot.value
+      }
+    }
+  }
+
+  private assertActive(): void {
+    if (this.retired) {
+      throw new Error('Profile state authority was retired for worker ownership')
+    }
+  }
+
+  private openWritableDatabase(): NonNullable<ProfileStateSqliteAuthority['writableDatabase']> {
+    this.assertActive()
+    this.writableDatabase ??= openWritableProfileStateDatabase(this.databasePath, this.profileId)
+    return this.writableDatabase
+  }
+}
diff --git a/src/main/persistence/profile-state/profile-state-startup-authority.test.ts b/src/main/persistence/profile-state/profile-state-startup-authority.test.ts
new file mode 100644
index 000000000000..539556d788f5
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-startup-authority.test.ts
@@ -0,0 +1,292 @@
+import { build } from 'esbuild'
+import type * as WorkerEntryPath from '../../worker-thread-entry-path'
+import { afterAll, afterEach, beforeAll, describe, expect, it, vi } from 'vitest'
+import { existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join, resolve } from 'node:path'
+import { buildProfileStateCutoverFixture } from '../profile-state-cutover-fixture'
+import {
+  createProfileStateStoreForStartup,
+  ProfileStateStartupAuthorityError,
+  type ProfileStateStartupAuthorityOptions
+} from './profile-state-startup-authority'
+import { openProfileStateDatabase, profileStateDatabaseFile } from './profile-state-database'
+
+const bundle = vi.hoisted(() => ({ directory: '' }))
+vi.mock('../../worker-thread-entry-path', async (importOriginal) => {
+  const original = await importOriginal<typeof WorkerEntryPath>()
+  return {
+    ...original,
+    resolveWorkerThreadEntryPath: (
+      layout: Parameters<typeof original.resolveWorkerThreadEntryPath>[0],
+      name: string
+    ) =>
+      name.startsWith('profile-state-')
+        ? join(bundle.directory, name)
+        : original.resolveWorkerThreadEntryPath(layout, name)
+  }
+})
+
+beforeAll(async () => {
+  bundle.directory = mkdtempSync(join(tmpdir(), 'orca-startup-writers-'))
+  await build({
+    entryPoints: [
+      resolve('src/main/persistence/profile-state/profile-state-writer-worker-entry.ts'),
+      resolve('src/main/persistence/profile-state/profile-state-backup-worker-entry.ts')
+    ],
+    outdir: bundle.directory,
+    bundle: true,
+    platform: 'node',
+    format: 'cjs',
+    logLevel: 'silent'
+  })
+})
+afterAll(() => rmSync(bundle.directory, { recursive: true, force: true }))
+
+vi.mock('electron', () => ({
+  app: {
+    getPath: () => tmpdir(),
+    getName: () => 'orca-test',
+    getVersion: () => '0.0.0-test',
+    isPackaged: false,
+    on: () => {},
+    whenReady: () => Promise.resolve()
+  },
+  safeStorage: {
+    isEncryptionAvailable: () => true,
+    encryptString: (value: string) => Buffer.from(`encrypted:${value}`, 'utf8'),
+    decryptString: (value: Buffer) => value.toString('utf8').slice('encrypted:'.length)
+  },
+  ipcMain: { on: () => {}, handle: () => {} },
+  BrowserWindow: { getAllWindows: () => [] }
+}))
+
+vi.mock('../../telemetry/client', () => ({ track: () => {} }))
+vi.mock('../../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: () => ({ nth_repo_added: 2 })
+}))
+vi.mock('../../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: () => ({ hosts: [] }),
+  sshConfigHostsToTargets: () => []
+}))
+
+const temporaryDirectories: string[] = []
+
+afterEach(() => {
+  for (const directory of temporaryDirectories.splice(0)) {
+    rmSync(directory, { recursive: true, force: true })
+  }
+  vi.restoreAllMocks()
+})
+
+describe('profile-state startup authority boundary', () => {
+  it('imports legacy desktop state by default and reopens acknowledged SQLite state', async () => {
+    const directory = mkdtempSync(join(tmpdir(), 'orca-profile-state-startup-authority-'))
+    temporaryDirectories.push(directory)
+    const dataFile = join(directory, 'orca-data.json')
+    const databaseFile = profileStateDatabaseFile(directory)
+    writeFileSync(dataFile, JSON.stringify(buildProfileStateCutoverFixture(directory)))
+
+    const base: Omit<ProfileStateStartupAuthorityOptions, 'runtime'> = {
+      dataFile,
+      databaseFile,
+      profileId: 'startup-authority-test',
+      storageAuthority: 'desktop'
+    }
+    const candidate = await createProfileStateStoreForStartup({
+      ...base,
+      runtime: 'desktop'
+    })
+    expect(candidate.backend).toBe('sqlite')
+    expect(candidate.migrated).toBe(true)
+    candidate.store.updateSettings({ theme: 'dark' })
+    await candidate.store.flushPendingOrThrowAsync()
+    await candidate.store.freezeWritesAsync()
+    rmSync(dataFile)
+
+    const restarted = await createProfileStateStoreForStartup({
+      ...base,
+      runtime: 'desktop'
+    })
+    expect(restarted.backend).toBe('sqlite')
+    expect(restarted.classification).toBe('sqlite-only')
+    expect(restarted.store.getSettings().theme).toBe('dark')
+    await restarted.store.freezeWritesAsync()
+
+    const packaged = await createProfileStateStoreForStartup({
+      ...base,
+      runtime: 'desktop'
+    })
+    expect(packaged.backend).toBe('sqlite')
+    expect(packaged.classification).toBe('sqlite-only')
+    expect(packaged.store.getSettings().theme).toBe('dark')
+    await packaged.store.freezeWritesAsync()
+
+    const orcad = await createProfileStateStoreForStartup({
+      ...base,
+      runtime: 'orcad',
+      storageAuthority: 'runtime'
+    })
+    expect(orcad.backend).toBe('sqlite')
+    await orcad.store.freezeWritesAsync()
+  })
+
+  it('rejects direct orcad startup on an incapable runtime', async () => {
+    const original = process.getBuiltinModule
+    vi.spyOn(process, 'getBuiltinModule').mockImplementation((id) => {
+      if (id === 'node:sqlite' || id === 'bun:sqlite') {
+        return undefined
+      }
+      return original(id)
+    })
+
+    await expect(
+      createProfileStateStoreForStartup({
+        dataFile: join(tmpdir(), 'missing-orca-data.json'),
+        databaseFile: join(tmpdir(), 'missing-profile-state.db'),
+        profileId: 'startup-authority-node18-test',
+        runtime: 'orcad',
+        storageAuthority: 'runtime'
+      })
+    ).rejects.toThrowError(ProfileStateStartupAuthorityError)
+  })
+
+  it('creates an empty desktop profile directly in SQLite and preserves its first acknowledged write', async () => {
+    const directory = mkdtempSync(join(tmpdir(), 'orca-default-empty-profile-'))
+    temporaryDirectories.push(directory)
+    const options: ProfileStateStartupAuthorityOptions = {
+      dataFile: join(directory, 'orca-data.json'),
+      databaseFile: profileStateDatabaseFile(directory),
+      profileId: 'default-empty',
+      runtime: 'desktop',
+      storageAuthority: 'desktop'
+    }
+    const first = await createProfileStateStoreForStartup(options)
+    try {
+      expect(first.backend).toBe('sqlite')
+      expect(first.classification).toBe('neither')
+      first.store.updateSettings({ terminalFontSize: 19 })
+      await first.store.flushPendingOrThrowAsync()
+      expect(existsSync(options.databaseFile)).toBe(true)
+      expect(existsSync(options.dataFile)).toBe(false)
+    } finally {
+      await first.store.freezeWritesAsync()
+    }
+    const reopened = await createProfileStateStoreForStartup(options)
+    try {
+      expect(reopened.backend).toBe('sqlite')
+      expect(reopened.migrated).toBe(false)
+      expect(reopened.store.getSettings().terminalFontSize).toBe(19)
+    } finally {
+      await reopened.store.freezeWritesAsync()
+    }
+  })
+
+  it.each(['corrupt', 'future-schema', 'ambiguous'] as const)(
+    'refuses %s storage under the desktop default without replacing the authority',
+    async (kind) => {
+      const directory = mkdtempSync(join(tmpdir(), 'orca-default-invalid-profile-'))
+      temporaryDirectories.push(directory)
+      const options: ProfileStateStartupAuthorityOptions = {
+        dataFile: join(directory, 'orca-data.json'),
+        databaseFile: profileStateDatabaseFile(directory),
+        profileId: 'default-invalid',
+        runtime: 'desktop',
+        storageAuthority: 'desktop'
+      }
+      if (kind === 'corrupt') {
+        writeFileSync(options.databaseFile, 'not a SQLite database')
+      } else {
+        const opened = openProfileStateDatabase(options.databaseFile, options.profileId)
+        try {
+          if (kind === 'future-schema') {
+            opened.db.exec('PRAGMA user_version = 999')
+          } else {
+            writeFileSync(options.dataFile, '{"settings":{"theme":"dark"}}')
+          }
+        } finally {
+          opened.db.close()
+        }
+      }
+      const before = readFileSync(options.databaseFile)
+      await expect(createProfileStateStoreForStartup(options)).rejects.toMatchObject({
+        code:
+          kind === 'future-schema'
+            ? 'newer-schema'
+            : kind === 'ambiguous'
+              ? 'ambiguous-profile-state'
+              : 'profile-state-recovery-required'
+      })
+      expect(readFileSync(options.databaseFile)).toEqual(before)
+      if (kind === 'ambiguous') {
+        expect(readFileSync(options.dataFile, 'utf8')).toBe('{"settings":{"theme":"dark"}}')
+      }
+    }
+  )
+
+  it('migrates a JSON-only orcad profile when the runtime exposes SQLite', async () => {
+    const directory = mkdtempSync(join(tmpdir(), 'orca-profile-state-orcad-capable-'))
+    temporaryDirectories.push(directory)
+    const dataFile = join(directory, 'orca-data.json')
+    const databaseFile = profileStateDatabaseFile(directory)
+    writeFileSync(dataFile, JSON.stringify({ settings: { theme: 'dark' } }))
+
+    const result = await createProfileStateStoreForStartup({
+      dataFile,
+      databaseFile,
+      profileId: 'orcad-capable-test',
+      runtime: 'orcad',
+      storageAuthority: 'runtime'
+    })
+
+    expect(result.backend).toBe('sqlite')
+    expect(result.migrated).toBe(true)
+    expect(result.store.getSettings().theme).toBe('dark')
+    await result.store.freezeWritesAsync()
+  })
+
+  it('refuses a runtime with SQLite but no native backup', async () => {
+    const original = process.getBuiltinModule
+    vi.spyOn(process, 'getBuiltinModule').mockImplementation((id) => {
+      if (id === 'bun:sqlite') {
+        return undefined
+      }
+      return id === 'node:sqlite' ? { DatabaseSync: class {} } : original(id)
+    })
+    await expect(
+      createProfileStateStoreForStartup({
+        dataFile: join(tmpdir(), 'missing-backup-orca-data.json'),
+        databaseFile: join(tmpdir(), 'missing-backup-profile-state.db'),
+        profileId: 'missing-native-backup',
+        runtime: 'orcad',
+        storageAuthority: 'runtime'
+      })
+    ).rejects.toThrowError(ProfileStateStartupAuthorityError)
+  })
+
+  it('leaves legacy JSON untouched when the runtime cannot own SQLite', async () => {
+    const directory = mkdtempSync(join(tmpdir(), 'orca-profile-state-orcad-node18-'))
+    temporaryDirectories.push(directory)
+    const dataFile = join(directory, 'orca-data.json')
+    const databaseFile = profileStateDatabaseFile(directory)
+    const source = JSON.stringify({ settings: { theme: 'dark' } })
+    writeFileSync(dataFile, source)
+    const original = process.getBuiltinModule
+    vi.spyOn(process, 'getBuiltinModule').mockImplementation((id) =>
+      id === 'node:sqlite' || id === 'bun:sqlite' ? undefined : original(id)
+    )
+
+    await expect(
+      createProfileStateStoreForStartup({
+        dataFile,
+        databaseFile,
+        profileId: 'orcad-node18-test',
+        runtime: 'orcad',
+        storageAuthority: 'runtime'
+      })
+    ).rejects.toThrowError(ProfileStateStartupAuthorityError)
+
+    expect(readFileSync(dataFile, 'utf8')).toBe(source)
+    expect(existsSync(databaseFile)).toBe(false)
+  })
+})
diff --git a/src/main/persistence/profile-state/profile-state-startup-authority.ts b/src/main/persistence/profile-state/profile-state-startup-authority.ts
new file mode 100644
index 000000000000..55c9a0314555
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-startup-authority.ts
@@ -0,0 +1,45 @@
+import type { AutomationStorageAuthority } from '../scheduling-automations/automation-owner-projection'
+import { isProfileStateSqliteAvailable } from './profile-state-database'
+import type {
+  ProfileStateStoreFactoryOptions,
+  ProfileStateStoreFactoryResult
+} from './profile-state-store-factory'
+import { createLiveProfileStateStore } from './profile-state-live-store-factory'
+
+/** Runtime roots sharing the profile-state selection boundary. */
+export type ProfileStateStartupRuntime = 'desktop' | 'orcad'
+
+export type ProfileStateStartupAuthorityOptions = Omit<
+  ProfileStateStoreFactoryOptions,
+  'storageAuthority'
+> & {
+  runtime: ProfileStateStartupRuntime
+  storageAuthority: AutomationStorageAuthority
+  onPersistenceFailure?: (error: Error) => void
+}
+
+export class ProfileStateStartupAuthorityError extends Error {
+  readonly code = 'orcad-sqlite-authority-unsupported' as const
+
+  constructor() {
+    super(
+      'orcad requires SQLite database and backup support. Launch through its bundled Bun runtime.'
+    )
+    this.name = 'ProfileStateStartupAuthorityError'
+  }
+}
+
+/** Construct both runtimes through the same validated authority boundary. */
+export async function createProfileStateStoreForStartup(
+  options: ProfileStateStartupAuthorityOptions
+): Promise<ProfileStateStoreFactoryResult> {
+  if (options.runtime === 'orcad' && !isProfileStateSqliteAvailable()) {
+    throw new ProfileStateStartupAuthorityError()
+  }
+  return createLiveProfileStateStore(options, {
+    onFailure:
+      options.onPersistenceFailure ??
+      ((error) =>
+        console.error('[persistence] Saving has stopped. Restart Orca before continuing.', error))
+  })
+}
diff --git a/src/main/persistence/profile-state/profile-state-startup-failure.test.ts b/src/main/persistence/profile-state/profile-state-startup-failure.test.ts
new file mode 100644
index 000000000000..e82ee6ba56fa
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-startup-failure.test.ts
@@ -0,0 +1,96 @@
+import { describe, expect, it } from 'vitest'
+import {
+  ProfileStateAuthorityBootstrapError,
+  ProfileStateRecoveryRequiredError
+} from './profile-state-authority-bootstrap'
+import {
+  formatProfileStateStartupFailure,
+  profileStateStartupFailureClass
+} from './profile-state-startup-failure'
+import { ProfileStateWriterError } from './profile-state-writer-errors'
+import { ProfileStateRevisionConflictError } from './profile-state-document-validation'
+import { ProfileStateDatabaseOpenError } from './profile-state-database-errors'
+
+describe('profile-state startup failure formatting', () => {
+  it('asks for a newer build instead of rollback when the schema is newer', () => {
+    const error = new ProfileStateDatabaseOpenError('newer-schema', 'Newer schema: 999')
+    expect(profileStateStartupFailureClass(error)).toBe('newer-schema')
+    const message = formatProfileStateStartupFailure(error)
+    expect(message).toContain('newer version of Orca')
+    expect(message).not.toContain('rollback')
+    expect(message).not.toContain('unreadable')
+  })
+
+  it('prints recovery paths and the offline rollback command', () => {
+    const error = new ProfileStateRecoveryRequiredError(
+      {
+        dataFile: '/profile/orca-data.json',
+        databaseFile: '/profile/profile-state.db',
+        profileId: 'profile-a'
+      },
+      new Error('database is corrupt')
+    )
+
+    expect(formatProfileStateStartupFailure(error)).toContain(
+      'orca profile state rollback --revision <revision>'
+    )
+    expect(formatProfileStateStartupFailure(error)).toContain('/profile/profile-state.db')
+    expect(profileStateStartupFailureClass(error)).toBe('recovery-required')
+  })
+
+  it('explains ambiguity and offers explicit inspection before choosing a recovery point', () => {
+    const message = formatProfileStateStartupFailure(
+      new ProfileStateAuthorityBootstrapError('both profile stores are present')
+    )
+
+    expect(message).toContain(
+      'Orca cannot safely choose a profile-state authority: both profile stores are present'
+    )
+    expect(message).toContain('neither is selected automatically')
+    expect(message).toContain('orca profile state rollback --current-json')
+    expect(message).toContain('does not merge')
+    expect(message).toContain('orca profile state exports')
+    expect(message).toContain('orca profile state rollback --backup <id>')
+    expect(
+      profileStateStartupFailureClass(new ProfileStateAuthorityBootstrapError('ambiguous'))
+    ).toBe('ambiguous-authority')
+  })
+
+  it('shows retained SQLite backups and their explicit recovery command without JSON exports', () => {
+    const message = formatProfileStateStartupFailure({
+      code: 'profile-state-recovery-required',
+      dataFile: '/profile/orca-data.json',
+      databaseFile: '/profile/profile-state.db',
+      exportPaths: [],
+      backupPaths: ['/profile/profile-state.db.backup.latest.db']
+    })
+    expect(message).toContain(
+      'Retained SQLite backups:\n  /profile/profile-state.db.backup.latest.db'
+    )
+    expect(message).toContain('orca profile state rollback --backup <id>')
+  })
+
+  it('leaves unrelated startup errors on the existing fatal path', () => {
+    expect(formatProfileStateStartupFailure(new Error('unrelated startup failure'))).toBeUndefined()
+    expect(profileStateStartupFailureClass(new Error('unrelated startup failure'))).toBeUndefined()
+  })
+
+  it('reports a missing writer without exposing its cause or suggesting database rollback', () => {
+    const error = new ProfileStateWriterError(
+      'profile-state-writer-unavailable',
+      'Profile state writer could not start',
+      'known-failure',
+      { cause: new Error('private runtime path') }
+    )
+    expect(profileStateStartupFailureClass(error)).toBe('writer-unavailable')
+    expect(formatProfileStateStartupFailure(error)).toBe(
+      'Orca could not start profile persistence. Restart Orca; if the problem continues, repair or reinstall this build.'
+    )
+  })
+
+  it('reports an admission race as a conflicting writer', () => {
+    const error = new ProfileStateRevisionConflictError(2, 3)
+    expect(profileStateStartupFailureClass(error)).toBe('revision-conflict')
+    expect(formatProfileStateStartupFailure(error)).toContain('Close other Orca processes')
+  })
+})
diff --git a/src/main/persistence/profile-state/profile-state-startup-failure.ts b/src/main/persistence/profile-state/profile-state-startup-failure.ts
new file mode 100644
index 000000000000..4c8710cbca21
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-startup-failure.ts
@@ -0,0 +1,133 @@
+type ProfileStateRecoveryFailure = {
+  code: 'profile-state-recovery-required'
+  dataFile: string
+  databaseFile: string
+  exportPaths: readonly string[]
+  backupPaths?: readonly string[]
+}
+
+type ProfileStateAuthorityFailure = {
+  code: 'ambiguous-profile-state'
+  message: string
+  divergence?: unknown
+}
+
+export type ProfileStateStartupFailureClass =
+  | 'recovery-required'
+  | 'ambiguous-authority'
+  | 'revision-conflict'
+  | 'writer-unavailable'
+  | 'newer-schema'
+  | 'publication-unavailable'
+
+/** Return the bounded failure class used by startup breadcrumbs and support diagnostics. */
+export function profileStateStartupFailureClass(
+  error: unknown
+): ProfileStateStartupFailureClass | undefined {
+  if (isProfileStateRecoveryFailure(error)) {
+    return 'recovery-required'
+  }
+  if (isProfileStateAuthorityFailure(error)) {
+    return 'ambiguous-authority'
+  }
+  if (isRecord(error) && typeof error.code === 'string') {
+    if (error.code === 'profile-state-publication-unavailable') {
+      return 'publication-unavailable'
+    }
+    if (error.code === 'newer-schema') {
+      return 'newer-schema'
+    }
+    if (error.code === 'profile-state-revision-conflict') {
+      return 'revision-conflict'
+    }
+    if (error.code.startsWith('profile-state-writer-')) {
+      return 'writer-unavailable'
+    }
+  }
+  return undefined
+}
+
+/** Both copies are readable and differ only because JSON changed outside SQLite. */
+export function isDivergedProfileStateFailure(error: unknown): boolean {
+  return isProfileStateAuthorityFailure(error) && error.divergence === 'diverged-json'
+}
+
+/** Format profile-state startup failures without exposing a generic fatal-error path. */
+export function formatProfileStateStartupFailure(error: unknown): string | undefined {
+  if (isProfileStateRecoveryFailure(error)) {
+    const retainedBackups = !error.backupPaths?.length
+      ? '  (none found)'
+      : error.backupPaths.map((path) => `  ${path}`).join('\n')
+    const retainedExports =
+      error.exportPaths.length === 0
+        ? '  (none found)'
+        : error.exportPaths.map((path) => `  ${path}`).join('\n')
+    return [
+      'Orca cannot safely open the active profile because its SQLite state is unreadable.',
+      `Legacy JSON path: ${error.dataFile}`,
+      `SQLite path: ${error.databaseFile}`,
+      'Retained SQLite backups:',
+      retainedBackups,
+      'Retained JSON exports:',
+      retainedExports,
+      'Stop Orca, then run `orca profile state exports` and choose a known-good recovery artifact.',
+      'Restore SQLite with `orca profile state rollback --backup <id>`, or restore a JSON export with',
+      '`orca profile state rollback --revision <revision>`.'
+    ].join('\n')
+  }
+
+  if (isProfileStateAuthorityFailure(error)) {
+    return [
+      `Orca cannot safely choose a profile-state authority: ${error.message}`,
+      'An older build may have changed the JSON file. Both copies are preserved; neither is selected automatically.',
+      'Stop Orca and copy the profile directory before choosing which state to keep.',
+      'To keep the current JSON, including edits from an older build, run `orca profile state rollback --current-json`. This archives both copies and does not merge their contents.',
+      'Run `orca profile state exports` to inspect retained recovery points.',
+      'Use `orca profile state rollback --backup <id>` or `orca profile state rollback --revision <revision>` only after selecting the state you want to restore.'
+    ].join('\n')
+  }
+
+  const failureClass = profileStateStartupFailureClass(error)
+  if (
+    failureClass === 'publication-unavailable' &&
+    isRecord(error) &&
+    typeof error.message === 'string'
+  ) {
+    return error.message
+  }
+  if (failureClass === 'newer-schema') {
+    return 'This profile was saved by a newer version of Orca. Open it with that version or a newer release. Your profile has not been changed.'
+  }
+  if (failureClass === 'revision-conflict') {
+    return 'The active profile changed while Orca was starting. Close other Orca processes using this profile, then restart Orca.'
+  }
+  if (failureClass === 'writer-unavailable') {
+    return 'Orca could not start profile persistence. Restart Orca; if the problem continues, repair or reinstall this build.'
+  }
+
+  return undefined
+}
+
+function isProfileStateRecoveryFailure(error: unknown): error is ProfileStateRecoveryFailure {
+  return (
+    isRecord(error) &&
+    error.code === 'profile-state-recovery-required' &&
+    typeof error.dataFile === 'string' &&
+    typeof error.databaseFile === 'string' &&
+    Array.isArray(error.exportPaths) &&
+    error.exportPaths.every((path) => typeof path === 'string') &&
+    (error.backupPaths === undefined ||
+      (Array.isArray(error.backupPaths) &&
+        error.backupPaths.every((path) => typeof path === 'string')))
+  )
+}
+
+function isProfileStateAuthorityFailure(error: unknown): error is ProfileStateAuthorityFailure {
+  return (
+    isRecord(error) && error.code === 'ambiguous-profile-state' && typeof error.message === 'string'
+  )
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null
+}
diff --git a/src/main/persistence/profile-state/profile-state-startup-recovery-dialog.test.ts b/src/main/persistence/profile-state/profile-state-startup-recovery-dialog.test.ts
new file mode 100644
index 000000000000..80c8687bbcc7
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-startup-recovery-dialog.test.ts
@@ -0,0 +1,99 @@
+import { describe, expect, it, vi } from 'vitest'
+import {
+  chooseProfileStateCopy,
+  presentProfileStateStartupRecoveryDialog
+} from './profile-state-startup-recovery-dialog'
+
+describe('profile state startup recovery dialog', () => {
+  it('offers a copyable offline export command and does not mutate state', async () => {
+    const showMessageBox = vi.fn().mockResolvedValue({ response: 0 })
+    const copyToClipboard = vi.fn()
+
+    await presentProfileStateStartupRecoveryDialog({
+      message: 'SQLite state is unreadable.\nSQLite path: /tmp/profile-state.db',
+      recoveryCommand: 'orca profile state exports',
+      showMessageBox,
+      copyToClipboard
+    })
+
+    expect(showMessageBox).toHaveBeenCalledWith({
+      type: 'error',
+      buttons: ['Copy recovery command', 'Quit'],
+      defaultId: 1,
+      cancelId: 1,
+      title: 'Orca profile state cannot be opened',
+      message: 'Orca cannot safely open this profile.',
+      detail:
+        'SQLite state is unreadable.\nSQLite path: /tmp/profile-state.db\n\nCopy the recovery command, then run it after Orca closes.'
+    })
+    expect(copyToClipboard).toHaveBeenCalledWith('orca profile state exports')
+  })
+
+  it('leaves the clipboard untouched when the user quits', async () => {
+    const showMessageBox = vi.fn().mockResolvedValue({ response: 1 })
+    const copyToClipboard = vi.fn()
+
+    await presentProfileStateStartupRecoveryDialog({
+      message: 'ambiguous profile state',
+      recoveryCommand: 'orca profile state exports',
+      showMessageBox,
+      copyToClipboard
+    })
+
+    expect(copyToClipboard).not.toHaveBeenCalled()
+  })
+
+  it('does not offer rollback for an authority ambiguity', async () => {
+    const showMessageBox = vi.fn().mockResolvedValue({ response: 0 })
+    const copyToClipboard = vi.fn()
+
+    await presentProfileStateStartupRecoveryDialog({
+      message: 'both profile authorities are present',
+      showMessageBox,
+      copyToClipboard
+    })
+
+    expect(showMessageBox).toHaveBeenCalledWith(
+      expect.objectContaining({
+        buttons: ['Quit'],
+        defaultId: 0,
+        cancelId: 0,
+        detail:
+          'both profile authorities are present\n\nQuit Orca and resolve the profile-state authority before retrying.'
+      })
+    )
+    expect(copyToClipboard).not.toHaveBeenCalled()
+  })
+
+  it.each([
+    [0, 'current-sqlite'],
+    [1, 'current-json'],
+    [2, undefined]
+  ] as const)('maps choice button %i to %s', async (response, expected) => {
+    const showMessageBox = vi.fn().mockResolvedValue({ response })
+    await expect(
+      chooseProfileStateCopy({
+        sqliteSavedAt: new Date(1),
+        jsonSavedAt: new Date(2),
+        formatTime: (time) => `t${time.getTime()}`,
+        showMessageBox
+      })
+    ).resolves.toBe(expected)
+    expect(showMessageBox).toHaveBeenCalledWith(
+      expect.objectContaining({
+        buttons: ['Use SQLite (Recommended)', 'Use JSON', 'Quit'],
+        defaultId: 0,
+        cancelId: 2
+      })
+    )
+    const { detail } = showMessageBox.mock.calls[0][0]
+    expect(detail).toContain('Last saved t1.')
+    expect(detail).toContain('Last saved t2.')
+  })
+
+  it('omits save times it could not read', async () => {
+    const showMessageBox = vi.fn().mockResolvedValue({ response: 2 })
+    await chooseProfileStateCopy({ showMessageBox })
+    expect(showMessageBox.mock.calls[0][0].detail).not.toContain('Last saved')
+  })
+})
diff --git a/src/main/persistence/profile-state/profile-state-startup-recovery-dialog.ts b/src/main/persistence/profile-state/profile-state-startup-recovery-dialog.ts
new file mode 100644
index 000000000000..9201ab54e171
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-startup-recovery-dialog.ts
@@ -0,0 +1,100 @@
+import { statSync } from 'node:fs'
+import type { MessageBoxOptions, MessageBoxReturnValue } from 'electron'
+import { getActiveProfileStateLocation } from './profile-state-active-location'
+import { profileStateDatabaseFiles } from './profile-state-storage-classification'
+
+export type ProfileStateStartupRecoveryDialogDeps = {
+  message: string
+  recoveryCommand?: string
+  showMessageBox: (options: MessageBoxOptions) => Promise<MessageBoxReturnValue>
+  copyToClipboard: (text: string) => void
+}
+
+/** Present the only safe desktop recovery action without changing the failed authority. */
+export async function presentProfileStateStartupRecoveryDialog(
+  deps: ProfileStateStartupRecoveryDialogDeps
+): Promise<void> {
+  const buttons = deps.recoveryCommand ? ['Copy recovery command', 'Quit'] : ['Quit']
+  const detail = deps.recoveryCommand
+    ? `${deps.message}\n\nCopy the recovery command, then run it after Orca closes.`
+    : `${deps.message}\n\nQuit Orca and resolve the profile-state authority before retrying.`
+  const { response } = await deps.showMessageBox({
+    type: 'error',
+    buttons,
+    defaultId: buttons.length - 1,
+    cancelId: buttons.length - 1,
+    title: 'Orca profile state cannot be opened',
+    message: 'Orca cannot safely open this profile.',
+    detail
+  })
+  if (response === 0 && deps.recoveryCommand) {
+    deps.copyToClipboard(deps.recoveryCommand)
+  }
+}
+
+export type ProfileStateCopyChoice = 'current-sqlite' | 'current-json'
+
+export type ProfileStateCopyChoiceDialogDeps = {
+  sqliteSavedAt?: Date
+  jsonSavedAt?: Date
+  formatTime?: (time: Date) => string
+  showMessageBox: (options: MessageBoxOptions) => Promise<MessageBoxReturnValue>
+}
+
+/** Best-effort save times; SQLite's latest commit may live only in its WAL, and -shm changes on every open. */
+export function readProfileStateCopySavedTimes(userDataPath: string): {
+  sqliteSavedAt?: Date
+  jsonSavedAt?: Date
+} {
+  try {
+    const location = getActiveProfileStateLocation(userDataPath)
+    if (location === undefined) {
+      return {}
+    }
+    const sqliteTimes = profileStateDatabaseFiles(location.databaseFile)
+      .filter((path) => !path.endsWith('-shm'))
+      .map(modifiedAt)
+      .filter((time) => time !== undefined)
+    const sqliteSavedAt =
+      sqliteTimes.length === 0 ? undefined : new Date(Math.max(...sqliteTimes.map(Number)))
+    const jsonSavedAt = modifiedAt(location.dataFile)
+    return {
+      ...(sqliteSavedAt === undefined ? {} : { sqliteSavedAt }),
+      ...(jsonSavedAt === undefined ? {} : { jsonSavedAt })
+    }
+  } catch {
+    return {}
+  }
+}
+
+function modifiedAt(path: string): Date | undefined {
+  return statSync(path, { throwIfNoEntry: false })?.mtime
+}
+
+/** Ask which diverged copy to keep; undefined means quit without changing either. */
+export async function chooseProfileStateCopy(
+  deps: ProfileStateCopyChoiceDialogDeps
+): Promise<ProfileStateCopyChoice | undefined> {
+  const format = deps.formatTime ?? ((time: Date) => time.toLocaleString())
+  const savedAt = (time: Date | undefined): string =>
+    time === undefined ? '' : ` Last saved ${format(time)}.`
+  const { response } = await deps.showMessageBox({
+    type: 'warning',
+    buttons: ['Use SQLite (Recommended)', 'Use JSON', 'Quit'],
+    defaultId: 0,
+    cancelId: 2,
+    noLink: true,
+    title: 'Choose profile state',
+    message: 'This profile has two saved copies that don’t match.',
+    detail: [
+      'This usually happens after opening the profile in an older version of Orca.',
+      '',
+      `SQLite: what this version of Orca saved. Changes made in the older version are discarded.${savedAt(deps.sqliteSavedAt)}`,
+      '',
+      `JSON: includes changes made in the older version. Changes this version saved since then are discarded.${savedAt(deps.jsonSavedAt)}`,
+      '',
+      'Orca archives both copies before switching, then restarts.'
+    ].join('\n')
+  })
+  return response === 0 ? 'current-sqlite' : response === 1 ? 'current-json' : undefined
+}
diff --git a/src/main/persistence/profile-state/profile-state-startup-secrets.test.ts b/src/main/persistence/profile-state/profile-state-startup-secrets.test.ts
new file mode 100644
index 000000000000..e9fbd395bd0e
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-startup-secrets.test.ts
@@ -0,0 +1,184 @@
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import {
+  getSecretStore,
+  hasSecretStore,
+  setSecretStore,
+  _resetSecretStoreForTests
+} from '../../../shared/secret-store'
+import { Store } from '../loading-store/store'
+import * as storeDomains from '../loading-store/store-domain-composition'
+import { ProfileStateSqliteAuthority } from './profile-state-sqlite-authority'
+
+let keyState: 'available' | 'unavailable' | 'decrypt-fails' = 'available'
+
+vi.mock('electron', () => ({
+  app: {
+    getPath: () => tmpdir(),
+    getName: () => 'orca-test',
+    getVersion: () => '0.0.0-test',
+    isPackaged: false,
+    on: () => {},
+    whenReady: () => Promise.resolve()
+  },
+  ipcMain: { on: () => {}, handle: () => {} },
+  BrowserWindow: { getAllWindows: () => [] }
+}))
+vi.mock('../../telemetry/client', () => ({ track: () => {} }))
+vi.mock('../../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: () => ({ nth_repo_added: 2 })
+}))
+vi.mock('../../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: () => ({ hosts: [] }),
+  sshConfigHostsToTargets: () => []
+}))
+
+let originalSecretStore: ReturnType<typeof getSecretStore> | undefined
+beforeEach(() => {
+  originalSecretStore = hasSecretStore() ? getSecretStore() : undefined
+  setSecretStore({
+    isEncryptionAvailable: () => keyState !== 'unavailable',
+    encryptString: (value) => Buffer.from(`encrypted:${value}`, 'utf8'),
+    decryptString: (value) => {
+      if (keyState === 'decrypt-fails') {
+        throw new Error('keychain denied decryption')
+      }
+      return value.toString('utf8').slice('encrypted:'.length)
+    },
+    describeProtectionGap: () => null
+  })
+})
+
+const directories: string[] = []
+const stores: Store[] = []
+afterEach(async () => {
+  vi.restoreAllMocks()
+  for (const store of stores) {
+    store.freezeWrites()
+  }
+  for (const store of stores.splice(0)) {
+    await store.flushAsync()
+  }
+  for (const directory of directories.splice(0)) {
+    rmSync(directory, { recursive: true, force: true })
+  }
+  keyState = 'available'
+  if (originalSecretStore) {
+    setSecretStore(originalSecretStore)
+  } else {
+    _resetSecretStoreForTests()
+  }
+})
+
+const secrets = {
+  proxy: 'http://user:password@proxy.test:8080',
+  cookie: 'startup-secret-cookie',
+  kagi: 'https://kagi.com/session?t=startup-secret',
+  lease: `startup-owner-lease-${'x'.repeat(480)}`
+}
+const sealed = (value: string) => Buffer.from(`encrypted:${value}`, 'utf8').toString('base64')
+
+it.each([false, true])(
+  'rejects reused input before Store context installation (secret=%s)',
+  (hasSecret) => {
+    const directory = mkdtempSync(join(tmpdir(), 'orca-consumed-startup-'))
+    directories.push(directory)
+    const authority = new ProfileStateSqliteAuthority(join(directory, 'profile-state.db'), 'once')
+    if (hasSecret) {
+      authority.writeSerializedState(
+        Buffer.from(
+          JSON.stringify({
+            settings: { opencodeSessionCookie: sealed(secrets.cookie) }
+          })
+        )
+      )
+    }
+    const options = {
+      dataFile: join(directory, 'orca-data.json'),
+      profileStateAuthority: authority,
+      initialAuthorityState: authority.readInitialState()
+    }
+    const store = new Store(options)
+    stores.push(store)
+    if (hasSecret) {
+      expect(store.getSettings().opencodeSessionCookie).toBe(secrets.cookie)
+    }
+    const install = vi.spyOn(storeDomains, 'installStoreDomainContexts')
+
+    expect(() => new Store(options)).toThrow('already been consumed')
+    expect(install).not.toHaveBeenCalled()
+  }
+)
+
+describe.each(['serialized', 'parsed'] as const)(
+  '%s startup secret retention',
+  (representation) => {
+    it.each(['available', 'unavailable', 'decrypt-fails'] as const)(
+      'preserves every protected slot through an unrelated save when keys are %s',
+      async (failure) => {
+        const directory = mkdtempSync(join(tmpdir(), 'orca-startup-secrets-'))
+        directories.push(directory)
+        const dataFile = join(directory, 'orca-data.json')
+        const databaseFile = join(directory, 'profile-state.db')
+        function open() {
+          const authority = new ProfileStateSqliteAuthority(databaseFile, 'startup-secrets')
+          const store = new Store({
+            dataFile,
+            profileStateAuthority: authority,
+            ...(representation === 'parsed'
+              ? { initialAuthorityState: authority.readInitialState() }
+              : {})
+          })
+          stores.push(store)
+          return { store, authority }
+        }
+
+        const seeded = open()
+        seeded.store.updateSettings({
+          httpProxyUrl: secrets.proxy,
+          opencodeSessionCookie: secrets.cookie
+        })
+        seeded.store.updateUI({ browserKagiSessionLink: secrets.kagi })
+        await seeded.store.upsertSshPtyConsumerRecovery({
+          targetId: 'ssh-1',
+          clientInstanceId: 'client-1',
+          serverBuildId: 'server-1',
+          clientGeneration: 1,
+          ownerGeneration: 1,
+          ownerLease: secrets.lease
+        })
+        await seeded.store.flushAsync()
+        seeded.store.freezeWrites()
+
+        keyState = failure
+        const reopened = open()
+        reopened.store.updateSettings({ terminalFontSize: 19 })
+        await reopened.store.flushAsync()
+        const persisted = reopened.authority.readSerializedState()
+        expect(persisted).toBeDefined()
+        for (const value of Object.values(secrets)) {
+          expect(persisted).not.toContain(value)
+        }
+        expect(JSON.parse(persisted ?? 'null')).toMatchObject({
+          settings: {
+            terminalFontSize: 19,
+            httpProxyUrl: sealed(secrets.proxy),
+            opencodeSessionCookie: sealed(secrets.cookie)
+          },
+          ui: { browserKagiSessionLink: sealed(secrets.kagi) },
+          sshPtyConsumerRecoveries: [{ ownerLease: sealed(secrets.lease) }]
+        })
+        reopened.store.freezeWrites()
+
+        keyState = 'available'
+        const restored = open().store
+        expect(restored.getSettings().httpProxyUrl).toBe(secrets.proxy)
+        expect(restored.getSettings().opencodeSessionCookie).toBe(secrets.cookie)
+        expect(restored.getUI().browserKagiSessionLink).toBe(secrets.kagi)
+        expect(restored.getSshPtyConsumerRecovery('ssh-1')?.ownerLease).toBe(secrets.lease)
+      }
+    )
+  }
+)
diff --git a/src/main/persistence/profile-state/profile-state-startup-snapshot.test.ts b/src/main/persistence/profile-state/profile-state-startup-snapshot.test.ts
new file mode 100644
index 000000000000..e53c425465dd
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-startup-snapshot.test.ts
@@ -0,0 +1,309 @@
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import type { ProfileStateAuthority } from '../loading-store/profile-state-authority'
+import { Store } from '../loading-store/store'
+import { bootstrapProfileStateAuthority } from './profile-state-authority-bootstrap'
+import * as profileStateDatabase from './profile-state-database'
+import * as profileStateDocumentReader from './profile-state-document-reader'
+import { hashProfileStateJson, importProfileStateJson } from './profile-state-documents'
+import { ProfileStateSqliteAuthority } from './profile-state-sqlite-authority'
+import { createProfileStateStore } from './profile-state-store-factory'
+
+vi.mock('electron', () => ({
+  app: {
+    getPath: () => tmpdir(),
+    getName: () => 'orca-test',
+    getVersion: () => '0.0.0-test',
+    isPackaged: false,
+    on: () => {},
+    whenReady: () => Promise.resolve()
+  },
+  safeStorage: {
+    isEncryptionAvailable: () => true,
+    encryptString: (value: string) => Buffer.from(`encrypted:${value}`, 'utf8'),
+    decryptString: (value: Buffer) => value.toString('utf8').slice('encrypted:'.length)
+  },
+  ipcMain: { on: () => {}, handle: () => {} },
+  BrowserWindow: { getAllWindows: () => [] }
+}))
+
+vi.mock('../../telemetry/client', () => ({ track: () => {} }))
+vi.mock('../../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: () => ({ nth_repo_added: 2 })
+}))
+vi.mock('../../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: () => ({ hosts: [] }),
+  sshConfigHostsToTargets: () => []
+}))
+
+const directories: string[] = []
+const stores: Store[] = []
+const authorities: ProfileStateAuthority[] = []
+
+afterEach(async () => {
+  vi.restoreAllMocks()
+  const openedStores = stores.splice(0)
+  const openedAuthorities = authorities.splice(0)
+  for (const store of openedStores) {
+    store.freezeWrites()
+  }
+  for (const authority of openedAuthorities) {
+    authority.close?.()
+  }
+  for (const store of openedStores) {
+    await store.flushAsync()
+  }
+  await Promise.all(openedAuthorities.map((authority) => authority.drainBackups?.()))
+  for (const directory of directories.splice(0)) {
+    rmSync(directory, { recursive: true, force: true })
+  }
+})
+
+function createPaths(): { dataFile: string; databaseFile: string; profileId: string } {
+  const directory = mkdtempSync(join(tmpdir(), 'orca-profile-state-startup-snapshot-'))
+  directories.push(directory)
+  return {
+    dataFile: join(directory, 'orca-data.json'),
+    databaseFile: join(directory, 'profile-state.db'),
+    profileId: 'startup-snapshot-test'
+  }
+}
+
+function createEstablishedProfile(keepJson: boolean): ReturnType<typeof createPaths> {
+  const paths = createPaths()
+  const source = JSON.stringify({ settings: { theme: 'dark' }, futureDomain: { keep: true } })
+  if (keepJson) {
+    writeFileSync(paths.dataFile, source)
+  }
+  const opened = profileStateDatabase.openProfileStateDatabase(paths.databaseFile, paths.profileId)
+  try {
+    importProfileStateJson(opened.db, source, {
+      acceptedLegacyJsonHash: hashProfileStateJson(source)
+    })
+  } finally {
+    opened.db.close()
+  }
+  return paths
+}
+
+describe('profile state startup snapshot handoff', () => {
+  it('keeps serialized-only authorities usable without SQLite capability', () => {
+    const paths = createPaths()
+    const original = process.getBuiltinModule
+    vi.spyOn(process, 'getBuiltinModule').mockImplementation((id) =>
+      id === 'node:sqlite' ? undefined : original(id)
+    )
+    let serialized = '{"settings":{"theme":"dark"},"futureDomain":{"keep":true}}'
+    const authority: ProfileStateAuthority = {
+      readSerializedState: () => serialized,
+      writeSerializedState: (payload) => {
+        serialized = payload.toString('utf8')
+      }
+    }
+    const store = new Store({ dataFile: paths.dataFile, profileStateAuthority: authority })
+    stores.push(store)
+    expect(store.getSettings().theme).toBe('dark')
+    expect(store.getSettings().terminalFontSize).toBeGreaterThan(0)
+    store.updateSettings({ theme: 'light' })
+    store.flushOrThrow()
+    expect(JSON.parse(serialized)).toMatchObject({
+      settings: { theme: 'light' },
+      futureDomain: { keep: true }
+    })
+  })
+
+  it.each([false, true])('reads established storage once with retained JSON=%s', (keepJson) => {
+    const paths = createEstablishedProfile(keepJson)
+    const open = vi.spyOn(profileStateDatabase, 'openProfileStateDatabaseReadOnly')
+    const documentRead = vi.spyOn(profileStateDocumentReader, 'readProfileStateDocuments')
+    const initialRead = vi.spyOn(ProfileStateSqliteAuthority.prototype, 'readInitialState')
+    const serializedRead = vi.spyOn(ProfileStateSqliteAuthority.prototype, 'readSerializedState')
+    const acceptedRead = vi.spyOn(ProfileStateSqliteAuthority.prototype, 'readAcceptedState')
+
+    const result = createProfileStateStore({ ...paths })
+    stores.push(result.store)
+
+    expect(open).toHaveBeenCalledTimes(1)
+    expect(documentRead).toHaveBeenCalledTimes(1)
+    expect(initialRead).toHaveBeenCalledTimes(keepJson ? 0 : 1)
+    expect(serializedRead).not.toHaveBeenCalled()
+    expect(acceptedRead).toHaveBeenCalledTimes(keepJson ? 1 : 0)
+    expect(result.store.getSettings().theme).toBe('dark')
+    expect(JSON.parse(result.store.prepareProfileStateExport().json)).toMatchObject({
+      futureDomain: { keep: true }
+    })
+  })
+
+  it('uses the validated empty snapshot without rereading SQLite or consulting JSON', () => {
+    const paths = createPaths()
+    const opened = profileStateDatabase.openProfileStateDatabase(
+      paths.databaseFile,
+      paths.profileId
+    )
+    opened.db.close()
+    const bootstrapped = bootstrapProfileStateAuthority(paths)
+    if (bootstrapped.authority === undefined) {
+      throw new Error('Expected SQLite authority')
+    }
+    authorities.push(bootstrapped.authority)
+    expect(bootstrapped.initialState.serializedState).toBeUndefined()
+    const read = vi.spyOn(bootstrapped.authority, 'readSerializedState')
+    writeFileSync(paths.dataFile, '{"settings":{"opencodeSessionCookie":"stale-json"}}')
+
+    const store = new Store({
+      dataFile: paths.dataFile,
+      profileStateAuthority: bootstrapped.authority,
+      initialAuthorityState: bootstrapped.initialState
+    })
+    stores.push(store)
+
+    expect(read).not.toHaveBeenCalled()
+    expect(store.getSettings().opencodeSessionCookie).not.toBe('stale-json')
+    store.updateSettings({ theme: 'dark' })
+    store.flushOrThrow()
+    expect(readFileSync(paths.dataFile, 'utf8')).toContain('stale-json')
+    expect(bootstrapped.authority.readSerializedState()).toContain('"dark"')
+  })
+
+  it('consumes a parsed startup snapshot once, including an empty revision', () => {
+    const paths = createPaths()
+    const opened = profileStateDatabase.openProfileStateDatabase(
+      paths.databaseFile,
+      paths.profileId
+    )
+    opened.db.close()
+    const authority = new ProfileStateSqliteAuthority(paths.databaseFile, paths.profileId)
+    authorities.push(authority)
+    const initial = authority.readInitialState()
+    expect(initial.takeParsedState?.()).toBeUndefined()
+    expect(() => initial.takeParsedState?.()).toThrow('already been consumed')
+  })
+
+  it.each([false, true])(
+    'fences a writer between bootstrap and Store construction with retained JSON=%s',
+    (keepJson) => {
+      const paths = createEstablishedProfile(keepJson)
+      const bootstrapped = bootstrapProfileStateAuthority(paths)
+      if (bootstrapped.authority === undefined) {
+        throw new Error('Expected SQLite authority')
+      }
+      authorities.push(bootstrapped.authority)
+      const opened = profileStateDatabase.openProfileStateDatabase(
+        paths.databaseFile,
+        paths.profileId
+      )
+      try {
+        importProfileStateJson(opened.db, '{"settings":{"theme":"light"}}', {
+          expectedRevision: 1
+        })
+      } finally {
+        opened.db.close()
+      }
+
+      const store = new Store({
+        dataFile: paths.dataFile,
+        profileStateAuthority: bootstrapped.authority,
+        initialAuthorityState: bootstrapped.initialState
+      })
+      stores.push(store)
+
+      expect(store.getSettings().theme).toBe('dark')
+      store.updateSettings({ theme: 'system' })
+      expect(() => store.flushOrThrow()).toThrowError(
+        expect.objectContaining({
+          code: 'profile-state-revision-conflict',
+          expectedRevision: 1,
+          actualRevision: 2
+        })
+      )
+      expect(bootstrapped.authority.readSerializedState()).toBe('{"settings":{"theme":"light"}}')
+    }
+  )
+
+  it('restores the captured fence after a same-authority refresh', () => {
+    const paths = createEstablishedProfile(true)
+    const authority = new ProfileStateSqliteAuthority(paths.databaseFile, paths.profileId)
+    authorities.push(authority)
+    const initial = authority.readInitialState()
+    const writer = new ProfileStateSqliteAuthority(paths.databaseFile, paths.profileId)
+    authorities.push(writer)
+    writer.writeSerializedState(Buffer.from('{"settings":{"theme":"light"}}'))
+    expect(authority.readSerializedState()).toContain('"light"')
+
+    const store = new Store({
+      dataFile: paths.dataFile,
+      profileStateAuthority: authority,
+      initialAuthorityState: initial
+    })
+    stores.push(store)
+    store.updateSettings({ theme: 'system' })
+    expect(() => store.flushOrThrow()).toThrowError(
+      expect.objectContaining({ code: 'profile-state-revision-conflict', actualRevision: 2 })
+    )
+    expect(writer.readSerializedState()).toContain('"light"')
+  })
+
+  it('keeps direct authority reads fresh after bootstrap', () => {
+    const paths = createEstablishedProfile(true)
+    const bootstrapped = bootstrapProfileStateAuthority(paths)
+    if (bootstrapped.authority === undefined) {
+      throw new Error('Expected SQLite authority')
+    }
+    authorities.push(bootstrapped.authority)
+    const writer = new ProfileStateSqliteAuthority(paths.databaseFile, paths.profileId)
+    authorities.push(writer)
+    writer.writeSerializedState(Buffer.from('{"settings":{"theme":"light"}}'))
+
+    expect(bootstrapped.authority.readSerializedState()).toBe('{"settings":{"theme":"light"}}')
+    writer.writeSerializedState(Buffer.from('{"settings":{"theme":"system"}}'))
+    expect(bootstrapped.authority.readSerializedState()).toBe('{"settings":{"theme":"system"}}')
+  })
+
+  it('decrypts and normalizes the startup snapshot through the existing Store loader', () => {
+    const paths = createPaths()
+    writeFileSync(paths.dataFile, '{"settings":{"theme":"dark"}}')
+    const first = createProfileStateStore({ ...paths }).store
+    stores.push(first)
+    first.updateSettings({ opencodeSessionCookie: 'startup-secret' })
+    first.flushOrThrow()
+    first.freezeWrites()
+
+    const reopened = createProfileStateStore({
+      ...paths
+    }).store
+    stores.push(reopened)
+    expect(reopened.getSettings().opencodeSessionCookie).toBe('startup-secret')
+    expect(reopened.getSettings().terminalFontSize).toBeGreaterThan(0)
+    reopened.updateSettings({ theme: 'light' })
+    reopened.flushOrThrow()
+    expect(reopened.prepareProfileStateExport().json).not.toContain('startup-secret')
+    const again = createProfileStateStore({ ...paths }).store
+    stores.push(again)
+    expect(again.getSettings().opencodeSessionCookie).toBe('startup-secret')
+    expect(again.getSettings().theme).toBe('light')
+  })
+
+  it('rejects initial state without its authority or alongside migration input', () => {
+    const paths = createPaths()
+    const authority = new ProfileStateSqliteAuthority(paths.databaseFile, paths.profileId)
+    const otherAuthority = new ProfileStateSqliteAuthority(paths.databaseFile, paths.profileId)
+    const initialAuthorityState = { authority, serializedState: '{}' }
+
+    expect(() => new Store({ dataFile: paths.dataFile, initialAuthorityState })).toThrow(
+      'must belong to its profile-state authority'
+    )
+    expect(
+      () => new Store({ profileStateAuthority: otherAuthority, initialAuthorityState })
+    ).toThrow('must belong to its profile-state authority')
+    expect(
+      () =>
+        new Store({
+          profileStateAuthority: authority,
+          initialAuthorityState,
+          serializedState: '{}'
+        })
+    ).toThrow('cannot use both a profile-state authority and serialized state')
+  })
+})
diff --git a/src/main/persistence/profile-state/profile-state-storage-classification.ts b/src/main/persistence/profile-state/profile-state-storage-classification.ts
new file mode 100644
index 000000000000..987f2a7bbe7f
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-storage-classification.ts
@@ -0,0 +1,32 @@
+import { existsSync } from 'node:fs'
+
+export type ProfileStateStorageClassification = 'json-only' | 'sqlite-only' | 'both' | 'neither'
+
+/** Primary first: recovery must remove it before any journal can be replayed. */
+export function profileStateDatabaseFiles(databaseFile: string): string[] {
+  return ['', '-wal', '-shm', '-journal'].map((suffix) => `${databaseFile}${suffix}`)
+}
+
+/** Any surviving database-family file rules out a fresh profile or JSON fallback. */
+export function hasProfileStateDatabaseFiles(databaseFile: string): boolean {
+  return profileStateDatabaseFiles(databaseFile).some(existsSync)
+}
+
+/** Classify storage without opening SQLite or changing either representation. */
+export function classifyProfileStateStorage(
+  dataFile: string,
+  databaseFile: string
+): ProfileStateStorageClassification {
+  const hasJson = existsSync(dataFile)
+  const hasDatabase = hasProfileStateDatabaseFiles(databaseFile)
+  if (hasJson && hasDatabase) {
+    return 'both'
+  }
+  if (hasJson) {
+    return 'json-only'
+  }
+  if (hasDatabase) {
+    return 'sqlite-only'
+  }
+  return 'neither'
+}
diff --git a/src/main/persistence/profile-state/profile-state-store-factory.test.ts b/src/main/persistence/profile-state/profile-state-store-factory.test.ts
new file mode 100644
index 000000000000..45ceade86981
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-store-factory.test.ts
@@ -0,0 +1,413 @@
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { dirname, join } from 'node:path'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import {
+  isProfileStateSqliteAvailable,
+  openProfileStateDatabase,
+  profileStateDatabaseFile
+} from './profile-state-database'
+import {
+  createProfileStateStore as createProfileStateStoreImpl,
+  type ProfileStateStoreFactoryOptions
+} from './profile-state-store-factory'
+import {
+  profileStateJsonExportPath,
+  profileStateJsonExportPaths
+} from './legacy-json/profile-state-export-path'
+import { ProfileStateRecoveryRequiredError } from './profile-state-authority-bootstrap'
+import { acquireProfileStateMaintenance } from './profile-state-access'
+import { restoreProfileStateJsonExport } from './legacy-json/profile-state-recovery'
+import { ProfileStateSqliteAuthority } from './profile-state-sqlite-authority'
+import { LoadedStateParsingOperations } from '../loading-store/loaded-state-parsing'
+import { hashProfileStateJson, importProfileStateJson } from './profile-state-documents'
+import { PROFILE_STATE_DATABASE_SCHEMA_VERSION } from './profile-state-database-schema'
+
+vi.mock('electron', () => ({
+  app: {
+    getPath: () => tmpdir(),
+    getName: () => 'orca-test',
+    getVersion: () => '0.0.0-test',
+    isPackaged: false,
+    on: () => {},
+    whenReady: () => Promise.resolve()
+  },
+  safeStorage: {
+    isEncryptionAvailable: () => true,
+    encryptString: (value: string) => Buffer.from(`encrypted:${value}`, 'utf8'),
+    decryptString: (value: Buffer) => value.toString('utf8').slice('encrypted:'.length)
+  },
+  ipcMain: { on: () => {}, handle: () => {} },
+  BrowserWindow: { getAllWindows: () => [] }
+}))
+
+vi.mock('../../telemetry/client', () => ({ track: () => {} }))
+vi.mock('../../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: () => ({ nth_repo_added: 2 })
+}))
+vi.mock('../../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: () => ({ hosts: [] }),
+  sshConfigHostsToTargets: () => []
+}))
+
+const temporaryDirectories: string[] = []
+const storesToClose: ReturnType<typeof createProfileStateStoreImpl>['store'][] = []
+
+function createProfileStateStore(
+  options: ProfileStateStoreFactoryOptions
+): ReturnType<typeof createProfileStateStoreImpl> {
+  const result = createProfileStateStoreImpl(options)
+  storesToClose.push(result.store)
+  return result
+}
+
+afterEach(async () => {
+  vi.restoreAllMocks()
+  const openedStores = storesToClose.splice(0)
+  for (const store of openedStores) {
+    store.freezeWrites()
+  }
+  for (const store of openedStores) {
+    await store.flushAsync()
+  }
+  for (const directory of temporaryDirectories.splice(0)) {
+    rmSync(directory, { recursive: true, force: true })
+  }
+})
+
+function createOptions(): ProfileStateStoreFactoryOptions & { directory: string } {
+  const root = mkdtempSync(join(tmpdir(), 'orca-profile-state-store-factory-'))
+  temporaryDirectories.push(root)
+  const directory = join(root, 'profiles', 'profile-factory-test')
+  mkdirSync(directory, { recursive: true })
+  return {
+    directory,
+    dataFile: join(directory, 'orca-data.json'),
+    databaseFile: profileStateDatabaseFile(directory),
+    profileId: 'profile-factory-test'
+  }
+}
+
+describe('profile state Store authority factory', () => {
+  it.each([false, true])(
+    'refuses future schemas without changing storage (retained JSON=%s)',
+    (keepJson) => {
+      const options = createOptions()
+      const source = '{"settings":{"theme":"dark"},"futureDomain":{"keep":true}}'
+      const { db } = openProfileStateDatabase(options.databaseFile, options.profileId)
+      try {
+        importProfileStateJson(db, source, { acceptedLegacyJsonHash: hashProfileStateJson(source) })
+        db.pragma(`user_version = ${PROFILE_STATE_DATABASE_SCHEMA_VERSION + 1}`)
+      } finally {
+        db.close()
+      }
+      if (keepJson) {
+        writeFileSync(options.dataFile, source)
+      }
+      const databaseBefore = readFileSync(options.databaseFile)
+
+      expect(() => createProfileStateStore({ ...options })).toThrow(
+        expect.objectContaining({ code: 'newer-schema' })
+      )
+      expect(readFileSync(options.databaseFile)).toEqual(databaseBefore)
+      expect(existsSync(options.dataFile)).toBe(keepJson)
+      if (keepJson) {
+        expect(readFileSync(options.dataFile, 'utf8')).toBe(source)
+      }
+    }
+  )
+
+  it('closes a migrated authority when Store normalization fails', () => {
+    const options = createOptions()
+    writeFileSync(options.dataFile, '{"settings":{"theme":"dark"}}')
+    const close = vi.spyOn(ProfileStateSqliteAuthority.prototype, 'close')
+    const readInitialState = vi.spyOn(ProfileStateSqliteAuthority.prototype, 'readInitialState')
+    vi.spyOn(LoadedStateParsingOperations.prototype, 'loadParsedFromAuthority').mockImplementation(
+      () => {
+        throw new Error('injected normalization failure')
+      }
+    )
+
+    expect(() => createProfileStateStore({ ...options })).toThrow('injected normalization failure')
+    expect(close).toHaveBeenCalledOnce()
+    expect(readInitialState).toHaveBeenCalledOnce()
+    const initial = readInitialState.mock.results[0]
+    if (initial?.type !== 'return') {
+      throw new Error('Expected a startup token before normalization')
+    }
+    expect(() => initial.value.takeParsedState?.()).toThrow('already been consumed')
+  })
+
+  it('uses a capability probe that remains false on a Node 18-style host', () => {
+    const original = process.getBuiltinModule
+    vi.spyOn(process, 'getBuiltinModule').mockImplementation((id) => {
+      if (id === 'node:sqlite' || id === 'bun:sqlite') {
+        return undefined
+      }
+      return original(id)
+    })
+
+    expect(isProfileStateSqliteAvailable()).toBe(false)
+  })
+
+  it('imports legacy state by default and preserves its original bytes', () => {
+    const options = createOptions()
+    const source = JSON.stringify({ settings: { theme: 'dark' }, unknownDomain: { keep: true } })
+    writeFileSync(options.dataFile, source)
+
+    const result = createProfileStateStore(options)
+
+    expect(result.backend).toBe('sqlite')
+    expect(result.classification).toBe('json-only')
+    expect(result.migrated).toBe(true)
+    expect(result.store.getSettings().theme).toBe('dark')
+    expect(existsSync(options.databaseFile)).toBe(true)
+    expect(readFileSync(options.dataFile, 'utf8')).toBe(source)
+  })
+
+  it.each([0, 1, 2, 3, 4])(
+    'requires selected recovery when only legacy backup slot %s remains',
+    (slot) => {
+      const options = createOptions()
+      const backup = `${options.dataFile}.bak.${slot}`
+      const source = '{"settings":{"theme":"dark"},"futureDomain":{"preserved":true}}'
+      writeFileSync(backup, source)
+
+      expect(() => createProfileStateStore({ ...options })).toThrow('restore a selected backup')
+      expect(existsSync(options.databaseFile)).toBe(false)
+      expect(existsSync(options.dataFile)).toBe(false)
+      expect(readFileSync(backup, 'utf8')).toBe(source)
+
+      restoreProfileStateJsonExport({
+        maintenance: acquireProfileStateMaintenance(dirname(dirname(options.directory))),
+        databasePath: options.databaseFile,
+        dataFile: options.dataFile,
+        profileId: options.profileId,
+        exportPath: backup
+      })
+      const recovered = createProfileStateStore({ ...options })
+      expect(recovered.backend).toBe('sqlite')
+      expect(JSON.parse(recovered.store.prepareProfileStateExport().json)).toMatchObject({
+        settings: { theme: 'dark' },
+        futureDomain: { preserved: true }
+      })
+      expect(readFileSync(backup, 'utf8')).toBe(source)
+    }
+  )
+
+  it('migrates JSON and constructs a SQLite Store', () => {
+    const options = createOptions()
+    const source = JSON.stringify({ settings: { theme: 'dark' }, unknownDomain: { keep: true } })
+    writeFileSync(options.dataFile, source)
+
+    const result = createProfileStateStore({ ...options })
+
+    expect(result.backend).toBe('sqlite')
+    expect(result.classification).toBe('json-only')
+    expect(result.migrated).toBe(true)
+    expect(result.store.getSettings().theme).toBe('dark')
+    expect(existsSync(options.databaseFile)).toBe(true)
+    expect(readFileSync(options.dataFile, 'utf8')).toBe(source)
+  })
+
+  it('reuses the candidate authority after the legacy export is removed', () => {
+    const options = createOptions()
+    writeFileSync(options.dataFile, JSON.stringify({ settings: { theme: 'dark' } }))
+    createProfileStateStore({ ...options })
+    rmSync(options.dataFile)
+
+    const result = createProfileStateStore({ ...options })
+
+    expect(result.backend).toBe('sqlite')
+    expect(result.classification).toBe('sqlite-only')
+    expect(result.migrated).toBe(false)
+    expect(result.store.getSettings().theme).toBe('dark')
+  })
+
+  it('reopens an established SQLite profile without the migration switch', () => {
+    const options = createOptions()
+    writeFileSync(options.dataFile, JSON.stringify({ settings: { theme: 'dark' } }))
+    createProfileStateStore({ ...options })
+    rmSync(options.dataFile)
+
+    const result = createProfileStateStore({ ...options })
+
+    expect(result.backend).toBe('sqlite')
+    expect(result.classification).toBe('sqlite-only')
+    expect(result.migrated).toBe(false)
+    expect(result.store.getSettings().theme).toBe('dark')
+  })
+
+  it('fails closed instead of falling back to a stale JSON mirror when SQLite is missing', () => {
+    const options = createOptions()
+    writeFileSync(options.dataFile, JSON.stringify({ settings: { theme: 'dark' } }))
+    const migrated = createProfileStateStore({ ...options })
+    const exportPath = profileStateJsonExportPath(options.dataFile, 1)
+    expect(existsSync(exportPath)).toBe(true)
+    migrated.store.freezeWrites()
+    rmSync(options.databaseFile)
+
+    expect(() => createProfileStateStore({ ...options })).toThrow(ProfileStateRecoveryRequiredError)
+  })
+
+  it('does not let candidate mode re-import JSON after SQLite was established', () => {
+    const options = createOptions()
+    writeFileSync(options.dataFile, JSON.stringify({ settings: { theme: 'dark' } }))
+    const migrated = createProfileStateStore({ ...options })
+    migrated.store.freezeWrites()
+    rmSync(options.databaseFile)
+
+    expect(() => createProfileStateStore({ ...options })).toThrow(ProfileStateRecoveryRequiredError)
+  })
+
+  it('reopens JSON after an explicit rollback removes the SQLite export marker', () => {
+    const options = createOptions()
+    writeFileSync(options.dataFile, JSON.stringify({ settings: { theme: 'dark' } }))
+    const migrated = createProfileStateStore({ ...options })
+    const exportPath = profileStateJsonExportPath(options.dataFile, 1)
+    migrated.store.freezeWrites()
+
+    restoreProfileStateJsonExport({
+      maintenance: acquireProfileStateMaintenance(dirname(dirname(options.directory))),
+      databasePath: options.databaseFile,
+      dataFile: options.dataFile,
+      exportPath,
+      profileId: options.profileId
+    })
+
+    const result = createProfileStateStore({ ...options })
+    expect(result.backend).toBe('sqlite')
+    expect(result.store.getSettings().theme).toBe('dark')
+  })
+
+  it('keeps a migrated profile on SQLite across mutation and restart', () => {
+    const options = createOptions()
+    const source = JSON.stringify({
+      settings: { theme: 'light' },
+      unknownDomain: { preserved: true }
+    })
+    writeFileSync(options.dataFile, source)
+    const first = createProfileStateStore({ ...options })
+
+    first.store.updateSettings({ theme: 'dark' })
+    first.store.flushOrThrow()
+
+    expect(readFileSync(options.dataFile, 'utf8')).toBe(source)
+    rmSync(options.dataFile)
+    const restarted = createProfileStateStore({ ...options })
+
+    expect(restarted.store.getSettings().theme).toBe('dark')
+    expect(JSON.parse(restarted.store.prepareProfileStateExport().json)).toMatchObject({
+      settings: { theme: 'dark' },
+      unknownDomain: { preserved: true }
+    })
+  })
+
+  it('initializes a valid empty SQLite profile instead of falling back to legacy JSON', () => {
+    const options = createOptions()
+    const opened = openProfileStateDatabase(options.databaseFile, options.profileId)
+    opened.db.close()
+
+    const result = createProfileStateStore({ ...options })
+
+    expect(result.backend).toBe('sqlite')
+    expect(result.classification).toBe('sqlite-only')
+    expect(result.store.getSettings()).toBeDefined()
+    result.store.updateSettings({ theme: 'dark' })
+    result.store.flushOrThrow()
+
+    const verifier = createProfileStateStore({ ...options })
+    expect(verifier.store.getSettings().theme).toBe('dark')
+  })
+
+  it('establishes SQLite for a fresh candidate profile before its first write', () => {
+    const options = createOptions()
+
+    const result = createProfileStateStore({ ...options })
+
+    expect(result.backend).toBe('sqlite')
+    expect(result.classification).toBe('neither')
+    expect(result.migrated).toBe(false)
+    expect(existsSync(options.databaseFile)).toBe(true)
+    result.store.updateSettings({ theme: 'dark' })
+    result.store.flushOrThrow()
+    result.store.freezeWrites()
+
+    const restarted = createProfileStateStore({ ...options })
+    expect(restarted.backend).toBe('sqlite')
+    expect(restarted.store.getSettings().theme).toBe('dark')
+    restarted.store.freezeWrites()
+  })
+
+  it('refuses a stale JSON mirror when candidate mode sees both files', () => {
+    const options = createOptions()
+    writeFileSync(options.dataFile, JSON.stringify({ settings: { theme: 'dark' } }))
+    createProfileStateStore({ ...options })
+    writeFileSync(options.dataFile, JSON.stringify({ settings: { theme: 'light' } }))
+
+    expect(() => createProfileStateStore({ ...options })).toThrow('matching acceptance marker')
+  })
+
+  it.each([false, true])(
+    'refuses an incapable first writer before mutation (JSON=%s)',
+    (hasJson) => {
+      const options = createOptions()
+      const source = '{"settings":{"theme":"dark"}}'
+      if (hasJson) {
+        writeFileSync(options.dataFile, source)
+      }
+      const original = process.getBuiltinModule
+      vi.spyOn(process, 'getBuiltinModule').mockImplementation((id) =>
+        id === 'node:sqlite' || id === 'bun:sqlite' ? undefined : original(id)
+      )
+      expect(() => createProfileStateStore(options)).toThrow('Writable profiles require SQLite')
+      expect(existsSync(options.databaseFile)).toBe(false)
+      expect(existsSync(options.dataFile)).toBe(hasJson)
+      if (hasJson) {
+        expect(readFileSync(options.dataFile, 'utf8')).toBe(source)
+      }
+    }
+  )
+
+  describe('missing database recovery', () => {
+    it.each([
+      { hasJson: true, artifact: 'export' },
+      { hasJson: false, artifact: 'export' },
+      { hasJson: true, artifact: 'backup' },
+      { hasJson: false, artifact: 'backup' }
+    ])(
+      'fails closed with a retained $artifact and JSON present=$hasJson',
+      ({ hasJson, artifact }) => {
+        const options = createOptions()
+        const source = JSON.stringify({ settings: { theme: 'dark' } })
+        writeFileSync(options.dataFile, source)
+        const migrated = createProfileStateStore({
+          ...options
+        })
+        migrated.store.freezeWrites()
+        rmSync(options.databaseFile)
+        if (artifact === 'backup') {
+          for (const path of profileStateJsonExportPaths(options.dataFile)) {
+            rmSync(path)
+          }
+          writeFileSync(
+            `${options.databaseFile}.backup.1789999999999-00000000-0000-4000-8000-000000000000.db`,
+            'reserved recovery artifact'
+          )
+        }
+        if (!hasJson) {
+          rmSync(options.dataFile)
+        }
+
+        expect(() => createProfileStateStore(options)).toThrowError(
+          ProfileStateRecoveryRequiredError
+        )
+        expect(existsSync(options.databaseFile)).toBe(false)
+        expect(existsSync(options.dataFile)).toBe(hasJson)
+        if (hasJson) {
+          expect(readFileSync(options.dataFile, 'utf8')).toBe(source)
+        }
+      }
+    )
+  })
+})
diff --git a/src/main/persistence/profile-state/profile-state-store-factory.ts b/src/main/persistence/profile-state/profile-state-store-factory.ts
new file mode 100644
index 000000000000..a40b19a17267
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-store-factory.ts
@@ -0,0 +1,78 @@
+import type { AutomationStorageAuthority } from '../scheduling-automations/automation-owner-projection'
+import type { ProfileStateAuthorityInitialState } from '../loading-store/profile-state-authority'
+import type { ProfileStateSqliteAuthority } from './profile-state-sqlite-authority'
+import { Store } from '../loading-store/store'
+import { bootstrapProfileStateAuthority } from './profile-state-authority-bootstrap'
+import type { ProfileStateStorageClassification } from './profile-state-storage-classification'
+
+export type ProfileStateStoreFactoryOptions = {
+  dataFile: string
+  databaseFile: string
+  profileId: string
+  storageAuthority?: AutomationStorageAuthority
+}
+
+export class ProfileStateStoreFactoryError extends Error {
+  readonly code = 'profile-state-authority-required' as const
+
+  constructor(message: string) {
+    super(message)
+    this.name = 'ProfileStateStoreFactoryError'
+  }
+}
+
+export type ProfileStateStoreFactoryResult = {
+  store: Store
+  backend: 'sqlite'
+  classification: ProfileStateStorageClassification
+  migrated: boolean
+}
+
+/** Centralize authority selection for desktop, orcad and offline callers. */
+export function createProfileStateStore(
+  options: ProfileStateStoreFactoryOptions
+): ProfileStateStoreFactoryResult {
+  const { initialState, ...prepared } = prepareProfileStateStore(options)
+  try {
+    return {
+      ...prepared,
+      store: new Store({
+        dataFile: options.dataFile,
+        storageAuthority: options.storageAuthority,
+        profileStateAuthority: initialState.authority,
+        initialAuthorityState: initialState
+      })
+    }
+  } catch (error) {
+    // Store construction owns the authority only after its load boundary succeeds.
+    initialState.authority.close?.()
+    throw error
+  }
+}
+
+type PreparedProfileStateStore = Omit<ProfileStateStoreFactoryResult, 'store'> & {
+  initialState: ProfileStateAuthorityInitialState<ProfileStateSqliteAuthority>
+}
+
+/** Admission is shared by live worker startup and synchronous offline operations. */
+export function prepareProfileStateStore(
+  options: ProfileStateStoreFactoryOptions
+): PreparedProfileStateStore {
+  const bootstrap = bootstrapProfileStateAuthority({
+    ...options,
+    allowEmptyProfileState: true
+  })
+  const authority = bootstrap.authority
+  if (authority === undefined) {
+    throw new ProfileStateStoreFactoryError(
+      'Writable profiles require SQLite database and backup support. Use Orca or its bundled Bun runtime.'
+    )
+  }
+
+  return {
+    initialState: bootstrap.initialState,
+    backend: 'sqlite',
+    classification: bootstrap.classification,
+    migrated: bootstrap.migrated
+  }
+}
diff --git a/src/main/persistence/profile-state/profile-state-streaming-validation.test.ts b/src/main/persistence/profile-state/profile-state-streaming-validation.test.ts
new file mode 100644
index 000000000000..537023ac45a5
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-streaming-validation.test.ts
@@ -0,0 +1,145 @@
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it } from 'vitest'
+import { openProfileStateDatabase } from './profile-state-database'
+import { verifyProfileStateSchema } from './profile-state-database-validation'
+import {
+  hashProfileStateJson,
+  importProfileStateJson,
+  readProfileStateParsedSnapshot,
+  readProfileStateSnapshot,
+  validateProfileStateSnapshot
+} from './profile-state-documents'
+
+const fixtures: { directory: string; db: ReturnType<typeof openProfileStateDatabase>['db'] }[] = []
+afterEach(() => {
+  for (const { directory, db } of fixtures.splice(0)) {
+    db.close()
+    rmSync(directory, { recursive: true, force: true })
+  }
+})
+
+function fixture(source = '{"automationRuns":[{"id":"a"},{"id":"b"}],"last":null}') {
+  const directory = mkdtempSync(join(tmpdir(), 'orca-streamed-profile-'))
+  const { db } = openProfileStateDatabase(join(directory, 'profile-state.db'), 'stream-test')
+  fixtures.push({ directory, db })
+  importProfileStateJson(db, source)
+  return db
+}
+
+const readers = [
+  readProfileStateSnapshot,
+  readProfileStateParsedSnapshot,
+  validateProfileStateSnapshot
+]
+
+describe('complete streaming profile validation', () => {
+  it('preserves history order and bytes with rowids at both SQLite integer limits', () => {
+    const source =
+      '{"before":null,"automationRuns":[{"id":"a","text":"雪\\ud800"},{"id":"b"}],"after":true}'
+    const db = fixture(source)
+    const before = readProfileStateSnapshot(db)
+    const update = db.prepare('UPDATE profile_state_automation_runs SET rowid = ? WHERE run_id = ?')
+    update.run(9223372036854775807n, 'a')
+    update.run(-9223372036854775808n, 'b')
+    expect(readProfileStateSnapshot(db)).toEqual(before)
+    expect(readProfileStateParsedSnapshot(db)).toEqual({
+      revision: before.revision,
+      state: JSON.parse(source)
+    })
+    expect(validateProfileStateSnapshot(db)).toBe(before.revision)
+    expect(db.isTransaction).toBe(false)
+  })
+
+  it('accepts extra columns that shadow every SQLite rowid alias', () => {
+    const db = fixture()
+    const before = readProfileStateSnapshot(db)
+    db.exec("ALTER TABLE profile_state_automation_runs ADD COLUMN rowid TEXT DEFAULT 'shadow'")
+    db.exec("ALTER TABLE profile_state_automation_runs ADD COLUMN _rowid_ TEXT DEFAULT 'shadow'")
+    db.exec("ALTER TABLE profile_state_automation_runs ADD COLUMN oid TEXT DEFAULT 'shadow'")
+    verifyProfileStateSchema(db, 'stream-test')
+    expect(readProfileStateSnapshot(db)).toEqual(before)
+    expect(readProfileStateParsedSnapshot(db).state).toEqual(JSON.parse(before.json))
+    expect(validateProfileStateSnapshot(db)).toBe(before.revision)
+  })
+
+  it.each([
+    '{}',
+    '{"automationRuns":null}',
+    '{"automationRuns":[]}',
+    '{"automationRuns":{"future":true}}'
+  ])('validates history presence without constructing a returned state: %s', (source) => {
+    const db = fixture(source)
+    expect(validateProfileStateSnapshot(db)).toBe(readProfileStateSnapshot(db).revision)
+    expect(readProfileStateParsedSnapshot(db).state).toEqual(JSON.parse(source))
+  })
+
+  it.each([
+    [
+      'row hash',
+      "UPDATE profile_state_automation_runs SET content_hash = printf('%064d', 0) WHERE ordinal = 1"
+    ],
+    ['ordering', 'UPDATE profile_state_automation_runs SET ordinal = 0 WHERE ordinal = 1'],
+    ['row revision', 'UPDATE profile_state_automation_runs SET revision = 99 WHERE ordinal = 1'],
+    [
+      'row timestamp',
+      'UPDATE profile_state_automation_runs SET updated_at = updated_at + 1 WHERE ordinal = 1'
+    ],
+    [
+      'aggregate hash',
+      "UPDATE profile_state_automation_runs_meta SET content_hash = printf('%064d', 0)"
+    ],
+    ['domain hash', "UPDATE profile_state_documents SET payload = 'true' WHERE domain = 'last'"],
+    ['domain revision', "UPDATE profile_state_documents SET revision = 99 WHERE domain = 'last'"]
+  ])('rejects late %s corruption in every representation', (_, sql) => {
+    const db = fixture()
+    db.exec(sql)
+    for (const read of readers) {
+      expect(() => read(db)).toThrow()
+      expect(db.isTransaction).toBe(false)
+    }
+  })
+
+  it.each([false, true])(
+    'closes failed iterators while preserving caller transaction ownership (%s)',
+    (ownsTransaction) => {
+      const db = fixture()
+      if (ownsTransaction) {
+        db.exec('BEGIN')
+      }
+      const payload = 'null,"injected":true'
+      const update = db.prepare(
+        'UPDATE profile_state_documents SET payload = ?, content_hash = ? WHERE domain = ?'
+      )
+      update.run(payload, hashProfileStateJson(payload), 'last')
+      expect(() => validateProfileStateSnapshot(db)).toThrow('invalid JSON')
+      expect(db.isTransaction).toBe(ownsTransaction)
+      update.run('null', hashProfileStateJson('null'), 'last')
+      expect(validateProfileStateSnapshot(db)).toBe(1)
+      expect(db.isTransaction).toBe(ownsTransaction)
+      if (ownsTransaction) {
+        db.exec('ROLLBACK')
+      }
+      expect(readProfileStateSnapshot(db).json).toBe(
+        '{"automationRuns":[{"id":"a"},{"id":"b"}],"last":null}'
+      )
+    }
+  )
+
+  it('closes the ordered-history iterator when the inner lookup fails validation', () => {
+    const db = fixture()
+    const update = db.prepare(
+      'UPDATE profile_state_automation_runs SET payload = ?, content_hash = ? WHERE ordinal = 1'
+    )
+    const invalid = '{"id":"wrong"}'
+    update.run(invalid, hashProfileStateJson(invalid))
+    for (const read of readers) {
+      expect(() => read(db)).toThrow('identity is corrupt')
+      expect(db.isTransaction).toBe(false)
+    }
+    const valid = '{"id":"b"}'
+    update.run(valid, hashProfileStateJson(valid))
+    expect(validateProfileStateSnapshot(db)).toBe(1)
+  })
+})
diff --git a/src/main/persistence/profile-state/profile-state-worker-authority.test.ts b/src/main/persistence/profile-state/profile-state-worker-authority.test.ts
new file mode 100644
index 000000000000..cc42f3505815
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-worker-authority.test.ts
@@ -0,0 +1,76 @@
+import { join } from 'node:path'
+import { describe, expect, it, vi } from 'vitest'
+import { ProfileStateBackupRotation } from './profile-state-backup-rotation'
+import { ProfileStateWriteWorkerClient } from './profile-state-writer-worker-client'
+import {
+  createWorkerMaintenanceFixture,
+  maintenanceBarrier
+} from '../loading-store/profile-state-maintenance-fixture'
+
+vi.mock('../../telemetry/client', () => ({ track: vi.fn() }))
+vi.mock('../../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: () => ({ nth_repo_added: 2 })
+}))
+vi.mock('../../ssh/ssh-config-parser', () => ({
+  loadUserSshConfig: () => ({ hosts: [] }),
+  sshConfigHostsToTargets: () => []
+}))
+
+describe('worker authority close admission', () => {
+  it('reports a failed maintenance resume without accepting a changed database', async () => {
+    const notify = vi.fn()
+    const { authority, peer } = await createWorkerMaintenanceFixture(undefined, notify)
+    const maintenance = await authority.pauseForMaintenance()
+    const other = peer()
+    other.writeSerializedDomains([{ domain: 'ui', payload: '{"external":true}' }])
+    other.close()
+
+    await expect(maintenance.resume()).rejects.toMatchObject({
+      code: 'profile-state-revision-conflict'
+    })
+    expect(notify).toHaveBeenCalledExactlyOnceWith(
+      expect.objectContaining({ code: 'profile-state-revision-conflict' })
+    )
+    expect(() => authority.assertWritable()).toThrow()
+  })
+
+  it('refuses new commands while its existing backup drains', async () => {
+    const { authority, directory, readState } = await createWorkerMaintenanceFixture()
+    const before = readState()
+    const release = maintenanceBarrier()
+    vi.spyOn(ProfileStateBackupRotation.prototype, 'drain').mockReturnValueOnce(release.promise)
+    const closeWriter = vi.spyOn(ProfileStateWriteWorkerClient.prototype, 'close')
+
+    const closing = authority.close()
+    expect(authority.close()).toBe(closing)
+    expect(closeWriter).toHaveBeenCalledOnce()
+    expect(() => authority.assertWritable()).toThrow('closing')
+    await expect(
+      authority.writeSerializedDomains([{ domain: 'settings', payload: '{}' }])
+    ).rejects.toMatchObject({ code: 'profile-state-writer-closed', outcome: 'known-failure' })
+    await expect(
+      authority.writeJsonExport(join(directory, 'late-export.json'))
+    ).rejects.toMatchObject({
+      code: 'profile-state-writer-closed'
+    })
+
+    release.resolve()
+    await closing
+    expect(closeWriter).toHaveBeenCalledOnce()
+    expect(readState()).toEqual(before)
+  })
+
+  it('finishes an accepted write before releasing its database', async () => {
+    const { authority, readState } = await createWorkerMaintenanceFixture()
+    const accepted = authority.writeSerializedDomains([
+      { domain: 'ui', payload: '{"accepted":true}' }
+    ])
+    const closing = authority.close()
+    await expect(accepted).resolves.toBeUndefined()
+    await closing
+    expect(readState().ui).toEqual({ accepted: true })
+    await expect(authority.assertCurrentRevision()).rejects.toMatchObject({
+      code: 'profile-state-writer-closed'
+    })
+  })
+})
diff --git a/src/main/persistence/profile-state/profile-state-worker-authority.ts b/src/main/persistence/profile-state/profile-state-worker-authority.ts
new file mode 100644
index 000000000000..efd93652c171
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-worker-authority.ts
@@ -0,0 +1,168 @@
+import type { AutomationRun } from '../../../shared/automations-types'
+import type {
+  AsyncProfileStateAuthority,
+  ProfileStateDomainReplacement,
+  ProfileStateMaintenance
+} from '../loading-store/profile-state-authority'
+import { ProfileStateBackupRotation } from './profile-state-backup-rotation'
+import { runProfileStateBackupWorker } from './profile-state-backup-worker'
+import { quarantineProfileStateDatabase } from './profile-state-database-quarantine'
+import {
+  ProfileStateWriteWorkerClient,
+  type ProfileStateWriterInitialization
+} from './profile-state-writer-worker-client'
+
+/** Main owns backup scheduling; the persistent worker owns every live SQL command. */
+export class ProfileStateWorkerAuthority implements AsyncProfileStateAuthority {
+  readonly asynchronous = true
+  private writer: ProfileStateWriteWorkerClient
+  private backups: ProfileStateBackupRotation
+  private closing: Promise<void> | undefined
+
+  constructor(
+    private readonly initialization: ProfileStateWriterInitialization,
+    private readonly options: {
+      workerPath?: string
+      backupWorkerPath?: string
+      onFailure?: (error: Error) => void
+    } = {}
+  ) {
+    this.writer = new ProfileStateWriteWorkerClient(initialization, options)
+    this.backups = this.createBackups()
+  }
+
+  get ready(): Promise<void> {
+    return this.writer.ready
+  }
+
+  readSerializedState(): never {
+    throw new Error('Live profile state requires its admitted startup snapshot')
+  }
+
+  assertWritable(): void {
+    this.writer.assertWritable()
+  }
+
+  abort(): Promise<void> {
+    return this.writer.abort()
+  }
+
+  assertCurrentRevision(): Promise<void> {
+    return this.writer.assertCurrentRevision().then(() => {})
+  }
+
+  writeSerializedDomains(replacements: readonly ProfileStateDomainReplacement[]): Promise<void> {
+    return this.writer.writeSerializedDomains(replacements).then(() => {})
+  }
+
+  writeSerializedAutomationRuns(
+    replacements: readonly ProfileStateDomainReplacement[],
+    runs: readonly AutomationRun[]
+  ): Promise<void> {
+    return this.writer.writeSerializedAutomationRuns(replacements, runs).then(() => {})
+  }
+
+  writeCompleteSerializedDomains(
+    replacements: readonly ProfileStateDomainReplacement[]
+  ): Promise<void> {
+    return this.writer.writeCompleteSerializedDomains(replacements).then(() => {})
+  }
+
+  writeSerializedState(payload: Buffer): Promise<void> {
+    return this.writer.writeSerializedState(payload).then(() => {})
+  }
+
+  writeJsonExport(targetPath: string): Promise<number> {
+    return this.writer.writeJsonExport(targetPath)
+  }
+
+  writeLatestJsonExport(dataFile: string): Promise<number | undefined> {
+    return this.writer.writeLatestJsonExport(dataFile)
+  }
+
+  writeJsonCompatibilityExport(targetPath: string): Promise<number | undefined> {
+    return this.writer.writeJsonCompatibilityExportAsync(targetPath)
+  }
+
+  writeJsonCompatibilityExportAsync(targetPath: string): Promise<number | undefined> {
+    return this.writeJsonCompatibilityExport(targetPath)
+  }
+
+  scheduleBackup(): void {
+    if (!this.closing) {
+      this.backups.schedule()
+    }
+  }
+
+  drainBackups(cancel = false): Promise<void> {
+    if (cancel) {
+      this.backups.stop()
+    }
+    return this.backups.drain()
+  }
+
+  close(): Promise<void> {
+    this.writer.stopAdmission()
+    this.closing ??= this.finishClose()
+    return this.closing
+  }
+
+  async pauseForMaintenance(): Promise<ProfileStateMaintenance> {
+    this.assertWritable()
+    const writer = this.writer
+    await this.close()
+    const revision = writer.acknowledgedRevision
+    let consumed = false
+    return {
+      resume: async () => {
+        if (consumed || this.writer !== writer) {
+          throw new Error('Profile maintenance resume has already been consumed')
+        }
+        consumed = true
+        this.writer = new ProfileStateWriteWorkerClient(
+          { ...this.initialization, revision },
+          { ...this.options, reportInitializationFailure: true }
+        )
+        this.backups = this.createBackups()
+        this.closing = undefined
+        try {
+          await this.writer.ready
+          this.assertWritable()
+        } catch (error) {
+          await this.close()
+          throw error
+        }
+      }
+    }
+  }
+
+  async quarantineDatabase(quarantineRoot?: string, reason?: string) {
+    await this.close()
+    return quarantineProfileStateDatabase(
+      this.initialization.databasePath,
+      this.initialization.profileId,
+      quarantineRoot,
+      reason
+    )
+  }
+
+  private async finishClose(): Promise<void> {
+    this.backups.stop()
+    const settled = await Promise.allSettled([this.backups.drain(), this.writer.close()])
+    for (const result of settled) {
+      if (result.status === 'rejected') {
+        throw result.reason
+      }
+    }
+  }
+
+  private createBackups(): ProfileStateBackupRotation {
+    return new ProfileStateBackupRotation(
+      this.initialization.databasePath,
+      this.initialization.profileId,
+      Date.now,
+      (job, signal) =>
+        runProfileStateBackupWorker(job, { workerPath: this.options.backupWorkerPath, signal })
+    )
+  }
+}
diff --git a/src/main/persistence/profile-state/profile-state-worker-export-failures.test.ts b/src/main/persistence/profile-state/profile-state-worker-export-failures.test.ts
new file mode 100644
index 000000000000..56e21da43e56
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-worker-export-failures.test.ts
@@ -0,0 +1,177 @@
+import { build } from 'esbuild'
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join, resolve } from 'node:path'
+import { afterAll, afterEach, beforeAll, expect, it, vi } from 'vitest'
+import { openProfileStateDatabase } from './profile-state-database'
+import {
+  hashProfileStateJson,
+  importProfileStateJson,
+  readProfileStateJsonAcceptance
+} from './profile-state-documents'
+import { ProfileStateSqliteAuthority } from './profile-state-sqlite-authority'
+import { ProfileStateWriteWorkerClient } from './profile-state-writer-worker-client'
+
+let bundleRoot: string
+let workerPath: string
+const fixtures: { root: string; client: ProfileStateWriteWorkerClient }[] = []
+beforeAll(async () => {
+  bundleRoot = mkdtempSync(join(tmpdir(), 'orca-export-worker-bundle-'))
+  workerPath = join(bundleRoot, 'writer.cjs')
+  await build({
+    entryPoints: [
+      resolve('src/main/persistence/profile-state/profile-state-writer-worker-entry.ts')
+    ],
+    outfile: workerPath,
+    bundle: true,
+    platform: 'node',
+    format: 'cjs',
+    logLevel: 'silent'
+  })
+})
+afterEach(async () => {
+  for (const { root, client } of fixtures.splice(0)) {
+    await client.close().catch(() => {})
+    rmSync(root, { recursive: true, force: true })
+  }
+})
+afterAll(() => rmSync(bundleRoot, { recursive: true, force: true }))
+
+async function fixture(fault: 'rename' | 'commit' | 'exit' | 'read-rollback' | 'none') {
+  const root = mkdtempSync(join(tmpdir(), 'orca-export-worker-'))
+  const databasePath = join(root, 'profile-state.db')
+  const dataFile = join(root, 'orca-data.json')
+  const profileId = 'export-failure'
+  const original = '{"settings":{"theme":"light"}}'
+  writeFileSync(dataFile, original)
+  const withDatabase = <T>(
+    run: (db: ReturnType<typeof openProfileStateDatabase>['db']) => T
+  ): T => {
+    const { db } = openProfileStateDatabase(databasePath, profileId)
+    try {
+      return run(db)
+    } finally {
+      db.close()
+    }
+  }
+  withDatabase((db) =>
+    importProfileStateJson(db, original, {
+      acceptedLegacyJsonHash: hashProfileStateJson(original)
+    })
+  )
+  const bootstrap = new ProfileStateSqliteAuthority(databasePath, profileId)
+  bootstrap.readSerializedState()
+  bootstrap.writeSerializedDomains([{ domain: 'settings', payload: '{"theme":"dark"}' }])
+  const wrapper = join(root, 'fault-worker.cjs')
+  const faultSource =
+    fault === 'commit' || fault === 'read-rollback'
+      ? `
+      const DatabaseSync = process.versions.bun
+        ? require('bun:sqlite').Database
+        : require('node:sqlite').DatabaseSync
+      const { existsSync } = require('node:fs')
+      let writing = false
+      const exec = DatabaseSync.prototype.exec
+      DatabaseSync.prototype.exec = function(sql) {
+        if (${JSON.stringify(fault)} === 'read-rollback' &&
+            existsSync(${JSON.stringify(join(root, 'armed'))}) &&
+            (sql === 'COMMIT' || sql === 'ROLLBACK')) {
+          throw new Error('injected read transaction release failure')
+        }
+        const result = exec.call(this, sql)
+        if (sql === 'BEGIN IMMEDIATE' && existsSync(${JSON.stringify(join(root, 'armed'))})) writing = true
+        if (writing && sql === 'COMMIT') throw new Error('injected post-COMMIT failure')
+        return result
+      }
+    `
+      : fault === 'none'
+        ? ''
+        : `
+      const fs = require('node:fs/promises')
+      const rename = fs.rename
+      let injected = false
+      fs.rename = async function(source, target) {
+        if (!injected && target === ${JSON.stringify(dataFile)}) {
+          injected = true
+          if (${JSON.stringify(fault)} === 'exit') {
+            await rename(source, target)
+            process.exit(19)
+          }
+          throw Object.assign(new Error('injected publication failure'), { code: 'ENOSPC' })
+        }
+        return rename(source, target)
+      }
+    `
+  writeFileSync(wrapper, `${faultSource}\nrequire(${JSON.stringify(workerPath)})`)
+  const onFailure = vi.fn()
+  const client = new ProfileStateWriteWorkerClient(bootstrap.retireForWorker(), {
+    workerPath: wrapper,
+    onFailure
+  })
+  fixtures.push({ root, client })
+  await client.ready
+  writeFileSync(join(root, 'armed'), '')
+  const readAccepted = () => {
+    const reader = new ProfileStateSqliteAuthority(databasePath, profileId)
+    try {
+      return reader.readAcceptedState(readFileSync(dataFile, 'utf8'))?.takeParsedState?.()
+    } finally {
+      reader.close()
+    }
+  }
+  return { client, dataFile, original, withDatabase, readAccepted, onFailure }
+}
+
+it.each(['rename', 'staging', 'promotion'] as const)(
+  'keeps the real worker usable after known compatibility %s failure',
+  async (phase) => {
+    const f = await fixture(phase === 'rename' ? phase : 'none')
+    if (phase !== 'rename') {
+      f.withDatabase((db) =>
+        db.exec(`
+        CREATE TRIGGER reject_acceptance BEFORE INSERT ON profile_state_meta
+        WHEN NEW.key = 'legacy_json_acceptance'
+        ${phase === 'promotion' ? "AND json_type(NEW.value, '$.pending') IS NULL" : ''}
+        BEGIN SELECT RAISE(ABORT, 'injected marker failure'); END
+      `)
+      )
+    }
+    await expect(f.client.writeJsonCompatibilityExportAsync(f.dataFile)).rejects.toMatchObject({
+      outcome: 'known-failure'
+    })
+    expect(JSON.parse(readFileSync(f.dataFile, 'utf8')).settings.theme).toBe(
+      phase === 'promotion' ? 'dark' : 'light'
+    )
+    expect(f.readAccepted()).toEqual({ settings: { theme: 'dark' } })
+    expect(f.onFailure).not.toHaveBeenCalled()
+    expect(await f.client.assertCurrentRevision()).toBe(2)
+    f.withDatabase((db) => db.exec('DROP TRIGGER IF EXISTS reject_acceptance'))
+    await f.client.writeSerializedDomains([{ domain: 'settings', payload: '{"theme":"system"}' }])
+    await f.client.writeJsonCompatibilityExportAsync(f.dataFile)
+    expect(f.readAccepted()).toEqual({ settings: { theme: 'system' } })
+    expect(f.withDatabase(readProfileStateJsonAcceptance)).toEqual({
+      jsonHash: hashProfileStateJson(readFileSync(f.dataFile, 'utf8')),
+      acceptedRevision: 3
+    })
+  }
+)
+
+it.each(['commit', 'exit', 'read-rollback'] as const)(
+  'keeps an unacknowledged export %s fenced even when its files remain recoverable',
+  async (fault) => {
+    const f = await fixture(fault)
+    const failure = await f.client
+      .writeJsonCompatibilityExportAsync(f.dataFile)
+      .catch((error: unknown) => error)
+    expect(failure).toMatchObject({ outcome: 'indeterminate' })
+    await expect(
+      f.client.writeSerializedDomains([{ domain: 'settings', payload: '{}' }])
+    ).rejects.toBe(failure)
+    await f.client.close()
+    expect(f.onFailure).toHaveBeenCalledExactlyOnceWith(failure)
+    expect(f.readAccepted()).toEqual({ settings: { theme: 'dark' } })
+    expect(JSON.parse(readFileSync(f.dataFile, 'utf8')).settings.theme).toBe(
+      fault === 'exit' ? 'dark' : 'light'
+    )
+  }
+)
diff --git a/src/main/persistence/profile-state/profile-state-write-transaction.test.ts b/src/main/persistence/profile-state/profile-state-write-transaction.test.ts
new file mode 100644
index 000000000000..2f4dade139cf
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-write-transaction.test.ts
@@ -0,0 +1,102 @@
+import { describe, expect, it, vi } from 'vitest'
+import Database from '../../sqlite/sync-database'
+import {
+  ProfileStateIndeterminateWriteError,
+  withProfileStateWriteTransaction
+} from './profile-state-write-transaction'
+
+describe('profile state write transaction ownership', () => {
+  it('preserves SQLITE_FULL after SQLite rolls back the transaction itself', () => {
+    const db = new Database(':memory:')
+    try {
+      db.exec('PRAGMA page_size=512; CREATE TABLE writes (data BLOB); PRAGMA max_page_count=2')
+      const rollback = vi.spyOn(db, 'exec')
+      expect(() =>
+        withProfileStateWriteTransaction(db, () => {
+          db.exec('INSERT INTO writes VALUES (zeroblob(4096))')
+        })
+      ).toThrow(/database or disk is full/)
+      expect(db.isTransaction).toBe(false)
+      expect(rollback).not.toHaveBeenCalledWith('ROLLBACK')
+      expect(db.prepare('SELECT COUNT(*) AS count FROM writes').get()).toMatchObject({ count: 0 })
+      withProfileStateWriteTransaction(db, () => db.exec("INSERT INTO writes VALUES ('small')"))
+      expect(db.prepare('SELECT COUNT(*) AS count FROM writes').get()).toMatchObject({ count: 1 })
+    } finally {
+      db.close()
+    }
+  })
+
+  it('rolls back a failed deferred commit and leaves the connection usable', () => {
+    const db = new Database(':memory:')
+    try {
+      db.exec(`
+        PRAGMA foreign_keys = ON;
+        CREATE TABLE parent (id INTEGER PRIMARY KEY);
+        CREATE TABLE child (parent_id INTEGER REFERENCES parent(id) DEFERRABLE INITIALLY DEFERRED);
+      `)
+      expect(() =>
+        withProfileStateWriteTransaction(db, () => {
+          db.exec('INSERT INTO child VALUES (1)')
+        })
+      ).toThrow(/FOREIGN KEY/)
+      expect(db.isTransaction).toBe(false)
+      expect(db.prepare('SELECT COUNT(*) AS count FROM child').get()).toMatchObject({ count: 0 })
+      withProfileStateWriteTransaction(db, () => {
+        db.exec('INSERT INTO parent VALUES (1); INSERT INTO child VALUES (1)')
+      })
+      expect(db.prepare('SELECT COUNT(*) AS count FROM child').get()).toMatchObject({ count: 1 })
+    } finally {
+      db.close()
+    }
+  })
+
+  it('leaves a caller-owned transaction intact when a nested write is refused', () => {
+    const db = new Database(':memory:')
+    try {
+      db.exec('CREATE TABLE pending (id INTEGER); BEGIN; INSERT INTO pending VALUES (1)')
+      expect(() =>
+        withProfileStateWriteTransaction(db, () => db.exec('DELETE FROM pending'))
+      ).toThrow(/idle database/)
+      expect(db.isTransaction).toBe(true)
+      db.exec('COMMIT')
+      expect(db.prepare('SELECT id FROM pending').get()).toMatchObject({ id: 1 })
+    } finally {
+      db.close()
+    }
+  })
+  it.each([false, true])(
+    'reports failed rollback as indeterminate after commit=%s',
+    (commitFirst) => {
+      const db = new Database(':memory:')
+      db.exec('CREATE TABLE writes (id INTEGER)')
+      const exec = db.exec.bind(db)
+      const injected = vi.spyOn(db, 'exec').mockImplementation((sql) => {
+        if (sql === 'ROLLBACK') {
+          throw new Error('injected rollback failure')
+        }
+        if (sql === 'COMMIT') {
+          if (commitFirst) {
+            exec(sql)
+          }
+          throw new Error('injected commit failure')
+        }
+        exec(sql)
+      })
+      try {
+        expect(() =>
+          withProfileStateWriteTransaction(db, () => db.exec('INSERT INTO writes VALUES (1)'))
+        ).toThrow(ProfileStateIndeterminateWriteError)
+        expect(db.isTransaction).toBe(!commitFirst)
+        if (db.isTransaction) {
+          exec('ROLLBACK')
+        }
+        expect(db.prepare('SELECT COUNT(*) AS count FROM writes').get()).toMatchObject({
+          count: commitFirst ? 1 : 0
+        })
+      } finally {
+        injected.mockRestore()
+        db.close()
+      }
+    }
+  )
+})
diff --git a/src/main/persistence/profile-state/profile-state-write-transaction.ts b/src/main/persistence/profile-state/profile-state-write-transaction.ts
new file mode 100644
index 000000000000..1dbf10d5bed1
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-write-transaction.ts
@@ -0,0 +1,42 @@
+import type Database from '../../sqlite/sync-database'
+
+export class ProfileStateIndeterminateWriteError extends Error {
+  readonly code = 'profile-state-write-indeterminate' as const
+
+  constructor(
+    cause: unknown,
+    readonly rollbackError: unknown
+  ) {
+    super('Profile state write failed without a confirmed rollback', { cause })
+    this.name = 'ProfileStateIndeterminateWriteError'
+  }
+}
+
+/** Own the write transaction; joining a caller's transaction would weaken its revision fence. */
+export function withProfileStateWriteTransaction<T>(db: Database.Database, write: () => T): T {
+  if (db.isTransaction) {
+    throw new Error('Profile state write requires an idle database connection')
+  }
+  db.exec('BEGIN IMMEDIATE')
+  let committing = false
+  try {
+    const result = write()
+    committing = true
+    db.exec('COMMIT')
+    return result
+  } catch (error) {
+    if (!db.isTransaction) {
+      // SQLite can roll back a failed statement itself; a failed COMMIT is ambiguous.
+      if (committing) {
+        throw new ProfileStateIndeterminateWriteError(error, undefined)
+      }
+      throw error
+    }
+    try {
+      db.exec('ROLLBACK')
+    } catch (rollbackError) {
+      throw new ProfileStateIndeterminateWriteError(error, rollbackError)
+    }
+    throw error
+  }
+}
diff --git a/src/main/persistence/profile-state/profile-state-writer-connection.ts b/src/main/persistence/profile-state/profile-state-writer-connection.ts
new file mode 100644
index 000000000000..bd956f48592d
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-writer-connection.ts
@@ -0,0 +1,302 @@
+import { Worker } from 'node:worker_threads'
+import { resolveProfileStateWriterWorkerPath } from './profile-state-writer-worker-path'
+import {
+  createProfileStateWriterRequest,
+  isExpectedProfileStateWriterSuccess,
+  type PendingProfileStateWriterRequest,
+  type SuccessfulProfileStateWriterResponse
+} from './profile-state-writer-request'
+import {
+  decodeProfileStateWriterError,
+  ProfileStateWriterError
+} from './profile-state-writer-errors'
+import {
+  isProfileStateWriterResponse,
+  type ProfileStateWriterCommand,
+  type ProfileStateWriterInitialization
+} from './profile-state-writer-protocol'
+
+const REQUEST_TIMEOUT_MS = 30_000
+
+/** One materialized command; Store owns coalescing and never queues snapshots here. */
+export class ProfileStateWriterConnection {
+  readonly ready: Promise<void>
+  private worker: Worker | undefined
+  private active: PendingProfileStateWriterRequest | undefined
+  private nextId = 1
+  private failure: Error | undefined
+  private draining = false
+  private closePromise: Promise<void> | undefined
+  private readonly exit = Promise.withResolvers<void>()
+  private didExit = false
+  private closeAcknowledged = false
+  private readonly timeoutMs: number
+  private readonly initialRevision: number
+  private latestRevision: number | undefined
+
+  constructor(
+    initialization: ProfileStateWriterInitialization,
+    private readonly options: {
+      workerPath?: string
+      timeoutMs?: number
+      onFailure?: (error: Error) => void
+      reportInitializationFailure?: boolean
+    } = {}
+  ) {
+    this.initialRevision = initialization.revision
+    this.timeoutMs = options.timeoutMs ?? REQUEST_TIMEOUT_MS
+    const pending = this.createPending(0, 'initialize')
+    this.active = pending
+    this.ready = pending.promise.then(() => {})
+    // Initialization failures remain observable through ready without an unhandled rejection.
+    void this.ready.catch(() => {})
+    try {
+      const worker = new Worker(options.workerPath ?? resolveProfileStateWriterWorkerPath(), {
+        workerData: initialization,
+        execArgv: []
+      })
+      this.worker = worker
+      worker.on('message', (response: unknown) => this.receive(response))
+      worker.on('error', (cause: Error) =>
+        this.fault(
+          new ProfileStateWriterError(
+            'profile-state-writer-exit',
+            'Profile state writer failed',
+            this.dispatchedOutcome(),
+            { cause }
+          )
+        )
+      )
+      worker.once('exit', (code) => {
+        this.didExit = true
+        this.exit.resolve()
+        if (!this.closeAcknowledged || code !== 0) {
+          this.fault(
+            new ProfileStateWriterError(
+              'profile-state-writer-exit',
+              `Profile state writer exited without a completed close (${code})`,
+              this.dispatchedOutcome()
+            )
+          )
+        }
+      })
+    } catch (cause) {
+      this.didExit = true
+      this.exit.resolve()
+      this.fault(
+        new ProfileStateWriterError(
+          'profile-state-writer-unavailable',
+          'Profile state writer could not start',
+          'known-failure',
+          { cause }
+        )
+      )
+    }
+  }
+
+  /** Abandoning an active wait cannot establish whether SQLite committed. */
+  async abort(): Promise<void> {
+    this.fault(
+      new ProfileStateWriterError(
+        'profile-state-writer-aborted',
+        'Profile state writer was aborted',
+        this.dispatchedOutcome()
+      )
+    )
+    await this.exit.promise
+  }
+
+  stopAdmission(): void {
+    this.draining = true
+  }
+
+  close(): Promise<void> {
+    this.stopAdmission()
+    this.closePromise ??= this.finishClose()
+    return this.closePromise
+  }
+
+  get acknowledgedRevision(): number {
+    if (this.failure) {
+      throw this.failure
+    }
+    if (this.latestRevision === undefined) {
+      throw new Error('Profile state writer has no acknowledged revision')
+    }
+    return this.latestRevision
+  }
+
+  private async finishClose(): Promise<void> {
+    await this.active?.promise.catch(() => {})
+    if (!this.failure && !this.didExit) {
+      try {
+        await this.dispatch({ command: 'close' })
+      } finally {
+        const timer = setTimeout(
+          () =>
+            this.fault(
+              new ProfileStateWriterError(
+                'profile-state-writer-close-timeout',
+                'Profile state writer did not exit after close',
+                'indeterminate'
+              )
+            ),
+          this.timeoutMs
+        )
+        try {
+          await this.exit.promise
+        } finally {
+          clearTimeout(timer)
+        }
+      }
+      if (this.failure) {
+        throw this.failure
+      }
+    } else {
+      await this.exit.promise
+    }
+  }
+
+  protected assertDispatchable(closing = false): void {
+    if (this.failure) {
+      throw this.failure
+    }
+    if (this.didExit || (this.draining && !closing)) {
+      throw new ProfileStateWriterError(
+        'profile-state-writer-closed',
+        'Profile state writer is closing',
+        'known-failure'
+      )
+    }
+    if (this.active) {
+      throw new ProfileStateWriterError(
+        'profile-state-writer-busy',
+        'Await the active profile state command before dispatching another snapshot',
+        'known-failure'
+      )
+    }
+  }
+
+  protected dispatch(
+    command: ProfileStateWriterCommand
+  ): Promise<SuccessfulProfileStateWriterResponse> {
+    try {
+      this.assertDispatchable(command.command === 'close')
+    } catch (error) {
+      return Promise.reject(error)
+    }
+    const pending = this.createPending(this.nextId++, command.command)
+    this.active = pending
+    try {
+      this.worker?.postMessage({ ...command, id: pending.id })
+    } catch (cause) {
+      // postMessage did not dispatch a message when serialization fails.
+      this.settle(
+        undefined,
+        new ProfileStateWriterError(
+          'profile-state-writer-message',
+          'Profile state command could not be transferred',
+          'known-failure',
+          { cause }
+        )
+      )
+    }
+    return pending.promise
+  }
+
+  private createPending(
+    id: number,
+    command: PendingProfileStateWriterRequest['command']
+  ): PendingProfileStateWriterRequest {
+    return createProfileStateWriterRequest(id, command, this.timeoutMs, () =>
+      this.fault(
+        new ProfileStateWriterError(
+          'profile-state-writer-timeout',
+          'Profile state writer command timed out',
+          this.dispatchedOutcome()
+        )
+      )
+    )
+  }
+
+  private receive(value: unknown): void {
+    if (this.failure) {
+      return
+    }
+    const pending = this.active
+    if (!isProfileStateWriterResponse(value) || !pending || value.id !== pending.id) {
+      this.invalidResponse()
+      return
+    }
+    if (!value.ok) {
+      const error = decodeProfileStateWriterError(value.error)
+      if (pending.command === 'initialize' || value.error.outcome === 'indeterminate') {
+        this.fault(error)
+      } else {
+        this.settle(undefined, error)
+      }
+      return
+    }
+    if (
+      !isExpectedProfileStateWriterSuccess(
+        pending.command,
+        value,
+        this.latestRevision ?? this.initialRevision
+      )
+    ) {
+      this.invalidResponse()
+      return
+    }
+    if (pending.command === 'close') {
+      this.closeAcknowledged = true
+    }
+    this.latestRevision = value.revision
+    this.settle(value)
+  }
+
+  private settle(response?: SuccessfulProfileStateWriterResponse, error?: Error): void {
+    const pending = this.active
+    this.active = undefined
+    if (!pending) {
+      return
+    }
+    clearTimeout(pending.timer)
+    if (response) {
+      pending.resolve(response)
+    } else {
+      pending.reject(error ?? new Error('Profile state request failed'))
+    }
+  }
+
+  private dispatchedOutcome(): 'known-failure' | 'indeterminate' {
+    return this.active?.command === 'initialize' ? 'known-failure' : 'indeterminate'
+  }
+
+  private invalidResponse(): void {
+    const error = new ProfileStateWriterError(
+      'profile-state-writer-protocol',
+      'Invalid profile state writer response',
+      this.dispatchedOutcome()
+    )
+    this.fault(error)
+  }
+
+  private fault(error: Error): void {
+    if (this.failure) {
+      return
+    }
+    this.failure = error
+    this.settle(undefined, this.failure)
+    if (!this.didExit) {
+      void this.worker?.terminate().catch(() => {})
+    }
+    // Startup failures already reject ready; admitted writers must also alert idle callers.
+    if (this.latestRevision !== undefined || this.options.reportInitializationFailure) {
+      try {
+        this.options.onFailure?.(error)
+      } catch (notificationError) {
+        console.error('[persistence] Could not report stopped saving:', notificationError)
+      }
+    }
+  }
+}
diff --git a/src/main/persistence/profile-state/profile-state-writer-errors.ts b/src/main/persistence/profile-state/profile-state-writer-errors.ts
new file mode 100644
index 000000000000..28237862ce2a
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-writer-errors.ts
@@ -0,0 +1,94 @@
+import {
+  ProfileStateDocumentCorruptionError,
+  ProfileStateRevisionConflictError
+} from './profile-state-document-validation'
+import { ProfileStateDatabaseOpenError } from './profile-state-database-errors'
+import { ProfileStateIndeterminateWriteError } from './profile-state-write-transaction'
+import { ProfileStateReadRollbackError } from './profile-state-read-snapshot'
+import type {
+  ProfileStateWriterErrorData,
+  ProfileStateWriterFailureOutcome
+} from './profile-state-writer-protocol'
+
+export class ProfileStateWriterError extends Error {
+  constructor(
+    readonly code: string,
+    message: string,
+    readonly outcome: ProfileStateWriterFailureOutcome,
+    options?: ErrorOptions
+  ) {
+    super(message, options)
+    this.name = 'ProfileStateWriterError'
+  }
+}
+
+export function profileStateWriterFailureOutcome(error: unknown): ProfileStateWriterFailureOutcome {
+  if (
+    error instanceof ProfileStateIndeterminateWriteError ||
+    error instanceof ProfileStateReadRollbackError
+  ) {
+    return 'indeterminate'
+  }
+  if (error instanceof ProfileStateWriterError) {
+    return error.outcome
+  }
+  if (error instanceof Error && error.cause !== undefined) {
+    return profileStateWriterFailureOutcome(error.cause)
+  }
+  return 'known-failure'
+}
+
+export function encodeProfileStateWriterError(
+  error: unknown,
+  forceIndeterminate = false
+): ProfileStateWriterErrorData {
+  const outcome = forceIndeterminate ? 'indeterminate' : profileStateWriterFailureOutcome(error)
+  if (error instanceof ProfileStateRevisionConflictError) {
+    return {
+      code: error.code,
+      message: error.message,
+      outcome,
+      expectedRevision: error.expectedRevision,
+      actualRevision: error.actualRevision
+    }
+  }
+  if (error instanceof ProfileStateDocumentCorruptionError) {
+    return { code: error.code, message: error.message, outcome, domain: error.domain }
+  }
+  if (
+    error instanceof ProfileStateDatabaseOpenError ||
+    error instanceof ProfileStateWriterError ||
+    error instanceof ProfileStateIndeterminateWriteError ||
+    error instanceof ProfileStateReadRollbackError
+  ) {
+    return { code: error.code, message: error.message, outcome }
+  }
+  return {
+    code: 'profile-state-write-failed',
+    message: 'Profile state persistence failed',
+    outcome
+  }
+}
+
+export function decodeProfileStateWriterError(data: ProfileStateWriterErrorData): Error {
+  if (data.outcome === 'known-failure') {
+    if (
+      data.code === 'profile-state-revision-conflict' &&
+      data.expectedRevision !== undefined &&
+      data.actualRevision !== undefined
+    ) {
+      return new ProfileStateRevisionConflictError(data.expectedRevision, data.actualRevision)
+    }
+    if (data.code === 'corrupt-document') {
+      return new ProfileStateDocumentCorruptionError(data.message, data.domain ?? null)
+    }
+    if (
+      data.code === 'unreadable' ||
+      data.code === 'identity-mismatch' ||
+      data.code === 'invalid-profile-id'
+    ) {
+      return new ProfileStateDatabaseOpenError(data.code, data.message)
+    }
+  }
+  return new ProfileStateWriterError(data.code, data.message, data.outcome)
+}
diff --git a/src/main/persistence/profile-state/profile-state-writer-protocol-faults.test.ts b/src/main/persistence/profile-state/profile-state-writer-protocol-faults.test.ts
new file mode 100644
index 000000000000..80a92f001181
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-writer-protocol-faults.test.ts
@@ -0,0 +1,148 @@
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { ProfileStateWriteWorkerClient } from './profile-state-writer-worker-client'
+
+const clients: ProfileStateWriteWorkerClient[] = []
+const roots: string[] = []
+afterEach(async () => {
+  await Promise.all(clients.splice(0).map((client) => client.close()))
+  for (const root of roots.splice(0)) {
+    rmSync(root, { recursive: true, force: true })
+  }
+})
+
+function clientFor(
+  response: string,
+  initialization = '{ id: 0, ok: true, revision: 1 }',
+  onFailure?: (error: Error) => void,
+  startup = ''
+) {
+  const root = mkdtempSync(join(tmpdir(), 'orca-writer-protocol-'))
+  roots.push(root)
+  const workerPath = join(root, 'writer.cjs')
+  writeFileSync(
+    workerPath,
+    `
+    const { parentPort } = require('node:worker_threads')
+    parentPort.postMessage(${initialization})
+    parentPort.on('message', (request) => { ${response} })
+    ${startup}
+  `
+  )
+  const client = new ProfileStateWriteWorkerClient(
+    { databasePath: join(root, 'unused.db'), profileId: 'protocol-test', revision: 1 },
+    { workerPath, timeoutMs: 1000, onFailure }
+  )
+  clients.push(client)
+  return client
+}
+
+describe('writer protocol refuses uncertain acknowledgements', () => {
+  it.each([
+    '{ id: request.id + 1, ok: true, revision: 2 }',
+    '{ id: request.id, ok: true, revision: 0 }',
+    '{ id: request.id, ok: true, revision: 3 }',
+    '{ id: request.id, ok: true, revision: 2, exportedRevision: 2 }',
+    '{ id: request.id, ok: true, revision: "2" }'
+  ])('faults instead of acknowledging malformed write response %s', async (response) => {
+    const client = clientFor(`parentPort.postMessage(${response})`)
+    await client.ready
+    await expect(
+      client.writeSerializedDomains([{ domain: 'settings', payload: '{}' }])
+    ).rejects.toMatchObject({ code: 'profile-state-writer-protocol', outcome: 'indeterminate' })
+    await expect(client.assertCurrentRevision()).rejects.toMatchObject({
+      code: 'profile-state-writer-protocol'
+    })
+  })
+
+  it.each(['undefined', 'null', '0', '2'])(
+    'refuses a compatibility export with revision %s for an admitted revision of one',
+    async (exportedRevision) => {
+      const client = clientFor(`parentPort.postMessage({
+        id: request.id, ok: true, revision: 1, exportedRevision: ${exportedRevision}
+      })`)
+      await client.ready
+      await expect(client.writeJsonCompatibilityExportAsync('unused.json')).rejects.toMatchObject({
+        code: 'profile-state-writer-protocol',
+        outcome: 'indeterminate'
+      })
+    }
+  )
+
+  it('refuses a revision jump at an unchanged-state fence', async () => {
+    const client = clientFor('parentPort.postMessage({ id: request.id, ok: true, revision: 2 })')
+    await client.ready
+    await expect(client.assertCurrentRevision()).rejects.toMatchObject({
+      code: 'profile-state-writer-protocol',
+      outcome: 'indeterminate'
+    })
+  })
+
+  it('refuses an initialization acknowledgement for a different revision', async () => {
+    const client = clientFor('', '{ id: 0, ok: true, revision: 2 }')
+    await expect(client.ready).rejects.toMatchObject({
+      code: 'profile-state-writer-protocol',
+      outcome: 'known-failure'
+    })
+  })
+
+  it('faults an unanswered request and rejects later work without retry', async () => {
+    const notify = vi.fn()
+    const client = clientFor('', undefined, notify)
+    await client.ready
+    await expect(
+      client.writeSerializedDomains([{ domain: 'settings', payload: '{}' }])
+    ).rejects.toMatchObject({ code: 'profile-state-writer-timeout', outcome: 'indeterminate' })
+    await expect(client.assertCurrentRevision()).rejects.toMatchObject({
+      code: 'profile-state-writer-timeout'
+    })
+    await client.close()
+    expect(notify).toHaveBeenCalledExactlyOnceWith(
+      expect.objectContaining({ code: 'profile-state-writer-timeout' })
+    )
+  })
+
+  it('reports an idle writer exit even without a subsequent save', async () => {
+    const notify = vi.fn()
+    const client = clientFor('', undefined, notify, 'setTimeout(() => process.exit(1), 50)')
+    await client.ready
+    await vi.waitFor(() => expect(notify).toHaveBeenCalledOnce())
+    expect(notify).toHaveBeenCalledWith(
+      expect.objectContaining({ code: 'profile-state-writer-exit' })
+    )
+    await client.close()
+    expect(notify).toHaveBeenCalledOnce()
+  })
+
+  it('leaves startup failure reporting to the startup caller', async () => {
+    const notify = vi.fn()
+    const client = clientFor('', '{ id: 0, ok: true, revision: 2 }', notify)
+    await expect(client.ready).rejects.toThrow()
+    await client.close()
+    expect(notify).not.toHaveBeenCalled()
+  })
+
+  it('does not report saving stopped after a recoverable request failure or clean close', async () => {
+    const notify = vi.fn()
+    const client = clientFor(
+      `
+      if (request.command === 'close') {
+        parentPort.postMessage({ id: request.id, ok: true, revision: 1 })
+        parentPort.close()
+      } else {
+        parentPort.postMessage({ id: request.id, ok: false,
+          error: { code: 'SQLITE_BUSY', message: 'busy', outcome: 'known-failure' } })
+      }
+    `,
+      undefined,
+      notify
+    )
+    await client.ready
+    await expect(client.assertCurrentRevision()).rejects.toThrow('busy')
+    expect(() => client.assertWritable()).not.toThrow()
+    await client.close()
+    expect(notify).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/main/persistence/profile-state/profile-state-writer-protocol.ts b/src/main/persistence/profile-state/profile-state-writer-protocol.ts
new file mode 100644
index 000000000000..1a7dc665abfc
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-writer-protocol.ts
@@ -0,0 +1,115 @@
+import type { ProfileStateDomainReplacement } from '../loading-store/profile-state-authority'
+import { isRecord } from './profile-state-document-validation'
+
+export type ProfileStateWriterInitialization = {
+  databasePath: string
+  profileId: string
+  revision: number
+}
+
+export type ProfileStateWriterCommand =
+  | { command: 'write-state'; payload: Uint8Array }
+  | {
+      command: 'write-complete' | 'write-domains'
+      replacements: readonly ProfileStateDomainReplacement[]
+    }
+  | {
+      command: 'write-automation'
+      replacements: readonly ProfileStateDomainReplacement[]
+      runPayloads: readonly string[]
+    }
+  | { command: 'assert-revision' | 'close' }
+  | { command: 'export-json' | 'export-latest' | 'export-compatibility'; targetPath: string }
+
+export type ProfileStateWriterRequest = ProfileStateWriterCommand & { id: number }
+export type ProfileStateWriterFailureOutcome = 'known-failure' | 'indeterminate'
+export type ProfileStateWriterErrorData = {
+  code: string
+  message: string
+  outcome: ProfileStateWriterFailureOutcome
+  expectedRevision?: number
+  actualRevision?: number
+  domain?: string | null
+}
+export type ProfileStateWriterResponse =
+  | { id: number; ok: true; revision: number; exportedRevision?: number | null }
+  | { id: number; ok: false; error: ProfileStateWriterErrorData }
+
+export function isProfileStateRevision(value: unknown): value is number {
+  return typeof value === 'number' && Number.isSafeInteger(value) && value >= 0
+}
+
+export function isProfileStateWriterInitialization(
+  value: unknown
+): value is ProfileStateWriterInitialization {
+  return (
+    isRecord(value) &&
+    typeof value.databasePath === 'string' &&
+    value.databasePath.length > 0 &&
+    typeof value.profileId === 'string' &&
+    value.profileId.length > 0 &&
+    isProfileStateRevision(value.revision)
+  )
+}
+
+function isReplacement(value: unknown): value is ProfileStateDomainReplacement {
+  return (
+    isRecord(value) &&
+    typeof value.domain === 'string' &&
+    value.domain.length > 0 &&
+    (typeof value.payload === 'string' || value.payload === null)
+  )
+}
+
+export function isProfileStateWriterRequest(value: unknown): value is ProfileStateWriterRequest {
+  if (!isRecord(value) || !isProfileStateRevision(value.id) || value.id === 0) {
+    return false
+  }
+  switch (value.command) {
+    case 'write-state':
+      return value.payload instanceof Uint8Array
+    case 'assert-revision':
+    case 'close':
+      return true
+    case 'export-json':
+    case 'export-latest':
+    case 'export-compatibility':
+      return typeof value.targetPath === 'string' && value.targetPath.length > 0
+    case 'write-complete':
+    case 'write-domains':
+      return Array.isArray(value.replacements) && value.replacements.every(isReplacement)
+    case 'write-automation':
+      return (
+        Array.isArray(value.replacements) &&
+        value.replacements.every(isReplacement) &&
+        Array.isArray(value.runPayloads) &&
+        value.runPayloads.every((payload: unknown) => typeof payload === 'string')
+      )
+    default:
+      return false
+  }
+}
+
+function isErrorData(value: unknown): value is ProfileStateWriterErrorData {
+  return (
+    isRecord(value) &&
+    typeof value.code === 'string' &&
+    typeof value.message === 'string' &&
+    (value.outcome === 'known-failure' || value.outcome === 'indeterminate') &&
+    (value.expectedRevision === undefined || isProfileStateRevision(value.expectedRevision)) &&
+    (value.actualRevision === undefined || isProfileStateRevision(value.actualRevision)) &&
+    (value.domain === undefined || value.domain === null || typeof value.domain === 'string')
+  )
+}
+
+export function isProfileStateWriterResponse(value: unknown): value is ProfileStateWriterResponse {
+  if (!isRecord(value) || !isProfileStateRevision(value.id)) {
+    return false
+  }
+  return value.ok === true
+    ? isProfileStateRevision(value.revision) &&
+        (value.exportedRevision === undefined ||
+          value.exportedRevision === null ||
+          isProfileStateRevision(value.exportedRevision))
+    : value.ok === false && isErrorData(value.error)
+}
diff --git a/src/main/persistence/profile-state/profile-state-writer-request.ts b/src/main/persistence/profile-state/profile-state-writer-request.ts
new file mode 100644
index 000000000000..8db4c4f65802
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-writer-request.ts
@@ -0,0 +1,59 @@
+import type {
+  ProfileStateWriterCommand,
+  ProfileStateWriterResponse
+} from './profile-state-writer-protocol'
+
+export type SuccessfulProfileStateWriterResponse = Extract<ProfileStateWriterResponse, { ok: true }>
+export type PendingProfileStateWriterRequest = {
+  id: number
+  command: ProfileStateWriterCommand['command'] | 'initialize'
+  promise: Promise<SuccessfulProfileStateWriterResponse>
+  resolve: (response: SuccessfulProfileStateWriterResponse) => void
+  reject: (error: Error) => void
+  timer: ReturnType<typeof setTimeout>
+}
+
+export function isExpectedProfileStateWriterSuccess(
+  command: PendingProfileStateWriterRequest['command'],
+  response: SuccessfulProfileStateWriterResponse,
+  previousRevision: number
+): boolean {
+  const mayWrite = command.startsWith('write-')
+  if (
+    response.revision < previousRevision ||
+    response.revision > previousRevision + (mayWrite ? 1 : 0)
+  ) {
+    return false
+  }
+  if (
+    response.exportedRevision !== undefined &&
+    response.exportedRevision !== null &&
+    response.exportedRevision !== response.revision
+  ) {
+    return false
+  }
+  if (command === 'export-json') {
+    return response.exportedRevision !== undefined && response.exportedRevision !== null
+  }
+  if (command === 'export-compatibility' || command === 'export-latest') {
+    return (
+      response.exportedRevision !== undefined &&
+      (response.exportedRevision !== null || response.revision === 0)
+    )
+  }
+  return response.exportedRevision === undefined
+}
+
+export function createProfileStateWriterRequest(
+  id: number,
+  command: PendingProfileStateWriterRequest['command'],
+  timeoutMs: number,
+  onTimeout: () => void
+): PendingProfileStateWriterRequest {
+  return {
+    id,
+    command,
+    ...Promise.withResolvers<SuccessfulProfileStateWriterResponse>(),
+    timer: setTimeout(onTimeout, timeoutMs)
+  }
+}
diff --git a/src/main/persistence/profile-state/profile-state-writer-worker-client.ts b/src/main/persistence/profile-state/profile-state-writer-worker-client.ts
new file mode 100644
index 000000000000..215af1f34990
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-writer-worker-client.ts
@@ -0,0 +1,75 @@
+import type { ProfileStateDomainReplacement } from '../loading-store/profile-state-authority'
+import { ProfileStateWriterConnection } from './profile-state-writer-connection'
+export { resolveProfileStateWriterWorkerPath } from './profile-state-writer-worker-path'
+export {
+  ProfileStateWriterError,
+  profileStateWriterFailureOutcome
+} from './profile-state-writer-errors'
+export type { ProfileStateWriterInitialization } from './profile-state-writer-protocol'
+
+export class ProfileStateWriteWorkerClient extends ProfileStateWriterConnection {
+  assertWritable(): void {
+    this.assertDispatchable()
+  }
+
+  writeSerializedState(payload: Buffer): Promise<number> {
+    return this.dispatch({ command: 'write-state', payload }).then((response) => response.revision)
+  }
+
+  writeCompleteSerializedDomains(
+    replacements: readonly ProfileStateDomainReplacement[]
+  ): Promise<number> {
+    return this.dispatch({ command: 'write-complete', replacements }).then(
+      (response) => response.revision
+    )
+  }
+
+  writeSerializedDomains(replacements: readonly ProfileStateDomainReplacement[]): Promise<number> {
+    return this.dispatch({ command: 'write-domains', replacements }).then(
+      (response) => response.revision
+    )
+  }
+
+  writeSerializedAutomationRuns(
+    replacements: readonly ProfileStateDomainReplacement[],
+    runs: readonly unknown[]
+  ): Promise<number> {
+    try {
+      this.assertDispatchable()
+      const runPayloads = runs.map((run) => {
+        const payload = JSON.stringify(run)
+        if (payload === undefined) {
+          throw new Error('Automation run is not serializable')
+        }
+        return payload
+      })
+      return this.dispatch({ command: 'write-automation', replacements, runPayloads }).then(
+        (response) => response.revision
+      )
+    } catch (error) {
+      return Promise.reject(error)
+    }
+  }
+
+  assertCurrentRevision(): Promise<number> {
+    return this.dispatch({ command: 'assert-revision' }).then((response) => response.revision)
+  }
+
+  writeJsonExport(targetPath: string): Promise<number> {
+    return this.dispatch({ command: 'export-json', targetPath }).then(
+      (response) => response.exportedRevision ?? response.revision
+    )
+  }
+
+  writeLatestJsonExport(dataFile: string): Promise<number | undefined> {
+    return this.dispatch({ command: 'export-latest', targetPath: dataFile }).then(
+      (response) => response.exportedRevision ?? undefined
+    )
+  }
+
+  writeJsonCompatibilityExportAsync(targetPath: string): Promise<number | undefined> {
+    return this.dispatch({ command: 'export-compatibility', targetPath }).then(
+      (response) => response.exportedRevision ?? undefined
+    )
+  }
+}
diff --git a/src/main/persistence/profile-state/profile-state-writer-worker-entry.ts b/src/main/persistence/profile-state/profile-state-writer-worker-entry.ts
new file mode 100644
index 000000000000..f79170312860
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-writer-worker-entry.ts
@@ -0,0 +1,148 @@
+import { parentPort, workerData } from 'node:worker_threads'
+import { ProfileStateSqliteAuthority } from './profile-state-sqlite-authority'
+import { writeVersionedProfileStateExport } from './legacy-json/profile-state-versioned-export'
+import {
+  encodeProfileStateWriterError,
+  ProfileStateWriterError
+} from './profile-state-writer-errors'
+import {
+  isProfileStateWriterInitialization,
+  isProfileStateWriterRequest,
+  type ProfileStateWriterRequest,
+  type ProfileStateWriterResponse
+} from './profile-state-writer-protocol'
+
+if (!parentPort) {
+  throw new Error('Profile state writer requires a worker thread')
+}
+const port = parentPort
+let authority: ProfileStateSqliteAuthority | undefined
+let busy = false
+let stopping = false
+let previousId = 0
+
+function reply(response: ProfileStateWriterResponse): void {
+  port.postMessage(response)
+}
+
+function close(): void {
+  stopping = true
+  try {
+    authority?.close()
+  } finally {
+    port.close()
+  }
+}
+
+async function execute(request: ProfileStateWriterRequest): Promise<ProfileStateWriterResponse> {
+  if (!authority) {
+    throw new Error('Profile state writer is not initialized')
+  }
+  let exportedRevision: number | null | undefined
+  switch (request.command) {
+    case 'write-state':
+      authority.writeSerializedState(Buffer.from(request.payload))
+      break
+    case 'write-complete':
+      authority.writeCompleteSerializedDomains(request.replacements)
+      break
+    case 'write-domains':
+      authority.writeSerializedDomains(request.replacements)
+      break
+    case 'write-automation':
+      authority.writeSerializedAutomationRuns(
+        request.replacements,
+        request.runPayloads.map((payload): unknown => JSON.parse(payload))
+      )
+      break
+    case 'assert-revision':
+      authority.assertCurrentRevision()
+      break
+    case 'export-json':
+      authority.assertCurrentRevision()
+      exportedRevision = authority.writeJsonExport(request.targetPath)
+      break
+    case 'export-latest':
+      authority.assertCurrentRevision()
+      exportedRevision =
+        writeVersionedProfileStateExport(
+          request.targetPath,
+          authority.writeJsonExport.bind(authority)
+        ) ?? null
+      break
+    case 'export-compatibility':
+      authority.assertCurrentRevision()
+      exportedRevision =
+        (await authority.writeJsonCompatibilityExportAsync(request.targetPath)) ?? null
+      break
+    case 'close':
+      authority.close()
+      stopping = true
+      break
+  }
+  return {
+    id: request.id,
+    ok: true,
+    revision: authority.revision,
+    ...(exportedRevision === undefined ? {} : { exportedRevision })
+  }
+}
+
+async function accept(value: unknown): Promise<void> {
+  if (stopping) {
+    return
+  }
+  if (!isProfileStateWriterRequest(value) || busy || value.id <= previousId) {
+    stopping = true
+    reply({
+      id: 0,
+      ok: false,
+      error: encodeProfileStateWriterError(
+        new ProfileStateWriterError(
+          'profile-state-writer-protocol',
+          'Invalid profile state writer request',
+          'indeterminate'
+        )
+      )
+    })
+    if (!busy) {
+      close()
+    }
+    return
+  }
+  busy = true
+  previousId = value.id
+  try {
+    reply(await execute(value))
+  } catch (error) {
+    // Export staging accepts both JSON versions; only uncertain SQL outcomes retire the writer.
+    const failure = encodeProfileStateWriterError(error, value.command === 'close')
+    reply({ id: value.id, ok: false, error: failure })
+    stopping ||= failure.outcome === 'indeterminate'
+  } finally {
+    busy = false
+    if (stopping) {
+      close()
+    }
+  }
+}
+
+try {
+  const initialization: unknown = workerData
+  if (!isProfileStateWriterInitialization(initialization)) {
+    throw new ProfileStateWriterError(
+      'profile-state-writer-initialization',
+      'Invalid profile state writer initialization',
+      'known-failure'
+    )
+  }
+  authority = new ProfileStateSqliteAuthority(initialization.databasePath, initialization.profileId)
+  authority.initializeFromRevision(initialization.revision)
+  reply({ id: 0, ok: true, revision: authority.revision })
+  port.on('message', (value: unknown) => {
+    void accept(value)
+  })
+} catch (error) {
+  reply({ id: 0, ok: false, error: encodeProfileStateWriterError(error) })
+  close()
+}
diff --git a/src/main/persistence/profile-state/profile-state-writer-worker-path.ts b/src/main/persistence/profile-state/profile-state-writer-worker-path.ts
new file mode 100644
index 000000000000..d1068eb26b0d
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-writer-worker-path.ts
@@ -0,0 +1,17 @@
+import { existsSync } from 'node:fs'
+import { dirname, join } from 'node:path'
+import {
+  currentWorkerEntryLayout,
+  resolveWorkerThreadEntryPath
+} from '../../worker-thread-entry-path'
+
+export function resolveProfileStateWriterWorkerPath(moduleDir = __dirname): string {
+  const entry = resolveWorkerThreadEntryPath(
+    currentWorkerEntryLayout(moduleDir),
+    'profile-state-writer-worker-entry.js'
+  )
+  return (
+    [entry, join(dirname(entry), '..', 'profile-state-writer-worker-entry.js')].find(existsSync) ??
+    entry
+  )
+}
diff --git a/src/main/persistence/profile-state/profile-state-writer-worker.test.ts b/src/main/persistence/profile-state/profile-state-writer-worker.test.ts
new file mode 100644
index 000000000000..bcf2f54ee518
--- /dev/null
+++ b/src/main/persistence/profile-state/profile-state-writer-worker.test.ts
@@ -0,0 +1,355 @@
+import { build } from 'esbuild'
+import { mkdtempSync, readFileSync, rmSync, writeFileSync, existsSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join, resolve } from 'node:path'
+import { afterAll, afterEach, beforeAll, describe, expect, it, vi } from 'vitest'
+import { ProfileStateSqliteAuthority } from './profile-state-sqlite-authority'
+import { ProfileStateRevisionConflictError } from './profile-state-document-validation'
+import { openProfileStateDatabase } from './profile-state-database'
+import { readProfileStateSnapshot } from './profile-state-documents'
+import {
+  ProfileStateWriteWorkerClient,
+  profileStateWriterFailureOutcome,
+  resolveProfileStateWriterWorkerPath
+} from './profile-state-writer-worker-client'
+
+let bundleRoot: string
+let workerPath: string
+const roots: string[] = []
+const clients: ProfileStateWriteWorkerClient[] = []
+
+beforeAll(async () => {
+  bundleRoot = mkdtempSync(join(tmpdir(), 'orca-writer-bundle-'))
+  workerPath = join(bundleRoot, 'profile-state-writer-worker-entry.js')
+  await build({
+    entryPoints: [
+      resolve('src/main/persistence/profile-state/profile-state-writer-worker-entry.ts')
+    ],
+    outfile: workerPath,
+    bundle: true,
+    platform: 'node',
+    format: 'cjs',
+    logLevel: 'silent'
+  })
+})
+
+afterEach(async () => {
+  await Promise.all(clients.splice(0).map((client) => client.close().catch(() => {})))
+  for (const root of roots.splice(0)) {
+    rmSync(root, { recursive: true, force: true })
+  }
+})
+afterAll(() => rmSync(bundleRoot, { recursive: true, force: true }))
+
+function fixture() {
+  const root = mkdtempSync(join(tmpdir(), 'orca-writer-'))
+  roots.push(root)
+  const path = join(root, 'profile-state.db')
+  const profileId = 'writer-test'
+  const db = openProfileStateDatabase(path, profileId)
+  db.db.close()
+  const authority = new ProfileStateSqliteAuthority(path, profileId)
+  authority.readInitialState().takeParsedState?.()
+  authority.writeCompleteSerializedDomains([{ domain: 'settings', payload: '{"theme":"dark"}' }])
+  const initialization = authority.retireForWorker()
+  return { root, path, profileId, authority, initialization }
+}
+
+function clientFor(
+  initialization: ReturnType<typeof fixture>['initialization'],
+  path = workerPath,
+  timeoutMs = 5000
+) {
+  const client = new ProfileStateWriteWorkerClient(initialization, { workerPath: path, timeoutMs })
+  clients.push(client)
+  return client
+}
+
+function readState(path: string, profileId: string): unknown {
+  const db = openProfileStateDatabase(path, profileId)
+  try {
+    return JSON.parse(readProfileStateSnapshot(db.db).json)
+  } finally {
+    db.db.close()
+  }
+}
+
+function script(root: string, source: string): string {
+  const path = join(root, 'fault-worker.cjs')
+  writeFileSync(path, source)
+  return path
+}
+
+describe('persistent profile state write worker', () => {
+  it('commits full, selective, automation and byte payloads, exports and releases the database', async () => {
+    const f = fixture()
+    const client = clientFor(f.initialization)
+    await client.ready
+    expect(
+      await client.writeSerializedDomains([{ domain: 'ui', payload: '{"note":"hi \\ud800"}' }])
+    ).toBe(2)
+    const run = {
+      id: 'run-1',
+      output: 'first',
+      toJSON() {
+        return { id: this.id, output: this.output }
+      }
+    }
+    const write = client.writeSerializedAutomationRuns([], [run])
+    run.output = 'changed after capture'
+    expect(await write).toBe(3)
+    const exported = join(f.root, 'state.json')
+    expect(await client.writeJsonExport(exported)).toBe(3)
+    expect(JSON.parse(readFileSync(exported, 'utf8'))).toEqual({
+      settings: { theme: 'dark' },
+      ui: { note: 'hi \ud800' },
+      automationRuns: [{ id: 'run-1', output: 'first' }]
+    })
+    const compatibility = join(f.root, 'compatibility.json')
+    expect(await client.writeJsonCompatibilityExportAsync(compatibility)).toBe(3)
+    expect(readFileSync(compatibility, 'utf8')).toBe(readFileSync(exported, 'utf8'))
+    expect(await client.writeSerializedState(Buffer.from('{"settings":{"theme":"light"}}'))).toBe(4)
+    expect(await client.assertCurrentRevision()).toBe(4)
+    await client.close()
+    await client.close()
+    expect(readState(f.path, f.profileId)).toEqual({ settings: { theme: 'light' } })
+    rmSync(f.root, { recursive: true })
+    expect(existsSync(f.root)).toBe(false)
+  })
+
+  it('requires a present admitted database and refuses startup revision races', async () => {
+    const f = fixture()
+    const peer = new ProfileStateSqliteAuthority(f.path, f.profileId)
+    peer.readInitialState()
+    peer.writeSerializedDomains([{ domain: 'settings', payload: '{"peer":true}' }])
+    peer.close()
+    const client = clientFor(f.initialization)
+    await expect(client.ready).rejects.toBeInstanceOf(ProfileStateRevisionConflictError)
+    await client.close()
+    expect(readState(f.path, f.profileId)).toEqual({ settings: { peer: true } })
+    const missing = clientFor({ ...f.initialization, databasePath: join(f.root, 'missing.db') })
+    await expect(missing.ready).rejects.toMatchObject({ code: 'unreadable' })
+    await missing.close()
+    expect(existsSync(join(f.root, 'missing.db'))).toBe(false)
+  })
+
+  it('permanently retires bootstrap authority and refuses subsequent calls', () => {
+    const f = fixture()
+    for (const call of [
+      () => f.authority.readInitialState(),
+      () => f.authority.readAcceptedState('{}'),
+      () => f.authority.readSerializedState(),
+      () => f.authority.writeSerializedDomains([]),
+      () => f.authority.writeCompleteSerializedDomains([]),
+      () => f.authority.writeSerializedAutomationRuns([], []),
+      () => f.authority.writeSerializedState(Buffer.from('{}')),
+      () => f.authority.writeJsonExport(join(f.root, 'export.json')),
+      () => f.authority.scheduleBackup(),
+      () => f.authority.assertCurrentRevision(),
+      () => f.authority.initializeFromRevision(1),
+      () => f.authority.retireForWorker(),
+      () => f.authority.close()
+    ]) {
+      expect(call).toThrow(/retired/)
+    }
+  })
+
+  it('preserves known validation failures and rejects a peer at the no-op fence', async () => {
+    const f = fixture()
+    const client = clientFor(f.initialization)
+    await client.ready
+    await expect(
+      client.writeSerializedDomains([{ domain: 'settings', payload: '{' }])
+    ).rejects.toMatchObject({ code: 'profile-state-write-failed', outcome: 'known-failure' })
+    expect(await client.assertCurrentRevision()).toBe(1)
+    const peer = new ProfileStateSqliteAuthority(f.path, f.profileId)
+    peer.readInitialState()
+    peer.writeSerializedDomains([{ domain: 'ui', payload: '{"peer":true}' }])
+    peer.close()
+    const failure = await client.assertCurrentRevision().catch((error: unknown) => error)
+    expect(failure).toBeInstanceOf(ProfileStateRevisionConflictError)
+    expect(profileStateWriterFailureOutcome(failure)).toBe('known-failure')
+    await expect(
+      client.writeSerializedDomains([{ domain: 'settings', payload: '{}' }])
+    ).rejects.toBeInstanceOf(ProfileStateRevisionConflictError)
+  })
+
+  it('rejects a second materialized write and waits for the first before close', async () => {
+    const f = fixture()
+    const delayed = script(
+      f.root,
+      `
+      const { MessagePort } = require('node:worker_threads')
+      const send = MessagePort.prototype.postMessage
+      MessagePort.prototype.postMessage = function(value, ...rest) {
+        if (value?.id === 1 && value.ok) { setTimeout(() => send.call(this, value, ...rest), 60); return }
+        return send.call(this, value, ...rest)
+      }
+      require(${JSON.stringify(workerPath)})
+    `
+    )
+    const client = clientFor(f.initialization, delayed)
+    await client.ready
+    const first = client.writeSerializedDomains([{ domain: 'settings', payload: '{"first":true}' }])
+    await expect(
+      client.writeSerializedDomains([{ domain: 'settings', payload: '{"second":true}' }])
+    ).rejects.toMatchObject({ code: 'profile-state-writer-busy' })
+    const closing = client.close()
+    expect(await first).toBe(2)
+    await closing
+    expect(readState(f.path, f.profileId)).toEqual({ settings: { first: true } })
+    await expect(client.assertCurrentRevision()).rejects.toMatchObject({
+      code: 'profile-state-writer-closed'
+    })
+  })
+
+  it('waits for actual worker exit after receiving its close acknowledgement', async () => {
+    const f = fixture()
+    const marker = join(f.root, 'worker-exited.txt')
+    const delayedExit = script(
+      f.root,
+      `
+      const { MessagePort } = require('node:worker_threads')
+      const send = MessagePort.prototype.postMessage
+      MessagePort.prototype.postMessage = function(value, ...rest) {
+        if (value?.id === 1 && value.ok) {
+          setTimeout(() => require('node:fs').writeFileSync(${JSON.stringify(marker)}, 'released'), 60)
+        }
+        return send.call(this, value, ...rest)
+      }
+      require(${JSON.stringify(workerPath)})
+    `
+    )
+    const client = clientFor(f.initialization, delayedExit)
+    await client.ready
+    await client.close()
+    expect(readFileSync(marker, 'utf8')).toBe('released')
+  })
+
+  it('reports post-commit worker death as indeterminate without replaying the committed write', async () => {
+    const f = fixture()
+    const crashAfterCommit = script(
+      f.root,
+      `
+      const { MessagePort } = require('node:worker_threads')
+      const send = MessagePort.prototype.postMessage
+      MessagePort.prototype.postMessage = function(value, ...rest) {
+        if (value?.id === 1 && value.ok) process.exit(13)
+        return send.call(this, value, ...rest)
+      }
+      require(${JSON.stringify(workerPath)})
+    `
+    )
+    const client = clientFor(f.initialization, crashAfterCommit)
+    await client.ready
+    const failure = await client
+      .writeSerializedDomains([{ domain: 'settings', payload: '{"committed":true}' }])
+      .catch((error: unknown) => error)
+    expect(profileStateWriterFailureOutcome(failure)).toBe('indeterminate')
+    await expect(client.assertCurrentRevision()).rejects.toBe(failure)
+    await client.close()
+    expect(readState(f.path, f.profileId)).toEqual({ settings: { committed: true } })
+  })
+
+  it.each(['mismatch', 'timeout', 'exit'])(
+    'fails closed after a dispatched %s and awaits actual exit',
+    async (mode) => {
+      const f = fixture()
+      const broken = script(
+        f.root,
+        `
+      const { parentPort } = require('node:worker_threads')
+      parentPort.postMessage({ id: 0, ok: true, revision: 1 })
+      parentPort.on('message', request => {
+        if (${JSON.stringify(mode)} === 'exit') process.exit(0)
+        if (${JSON.stringify(mode)} === 'mismatch') parentPort.postMessage({ id: request.id + 1, ok: true, revision: 2 })
+      })
+    `
+      )
+      const client = clientFor(f.initialization, broken)
+      await client.ready
+      if (mode === 'timeout') {
+        vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout'] })
+      }
+      try {
+        const failure = client
+          .writeSerializedDomains([{ domain: 'settings', payload: '{}' }])
+          .catch((error: unknown) => error)
+        if (mode === 'timeout') {
+          await vi.advanceTimersByTimeAsync(5000)
+        }
+        const observedFailure = await failure
+        expect(profileStateWriterFailureOutcome(observedFailure)).toBe('indeterminate')
+        if (mode === 'timeout') {
+          expect(observedFailure).toMatchObject({ code: 'profile-state-writer-timeout' })
+        }
+      } finally {
+        vi.useRealTimers()
+      }
+      await client.close()
+      expect(readState(f.path, f.profileId)).toEqual({ settings: { theme: 'dark' } })
+      rmSync(f.root, { recursive: true })
+    }
+  )
+
+  it('recovers the prior committed revision after the worker exits inside a transaction', async () => {
+    const f = fixture()
+    const interruptedPath = join(f.root, 'interrupted-worker.cjs')
+    await build({
+      entryPoints: [
+        resolve('src/main/persistence/profile-state/profile-state-writer-worker-entry.ts')
+      ],
+      outfile: interruptedPath,
+      bundle: true,
+      platform: 'node',
+      format: 'cjs',
+      logLevel: 'silent',
+      plugins: [
+        {
+          name: 'interrupt-transaction',
+          setup(builder) {
+            builder.onLoad({ filter: /profile-state-write-transaction\.ts$/ }, (args) => ({
+              contents: readFileSync(args.path, 'utf8').replace(
+                "db.exec('COMMIT')",
+                'process.exit(17)'
+              ),
+              loader: 'ts'
+            }))
+          }
+        }
+      ]
+    })
+    const client = clientFor(f.initialization, interruptedPath)
+    await client.ready
+    const failure = await client
+      .writeSerializedDomains([{ domain: 'settings', payload: '{"uncommitted":true}' }])
+      .catch((error: unknown) => error)
+    expect(profileStateWriterFailureOutcome(failure)).toBe('indeterminate')
+    await client.close()
+    expect(readState(f.path, f.profileId)).toEqual({ settings: { theme: 'dark' } })
+  })
+
+  it('aborts an active request without treating the pending write as rolled back', async () => {
+    const f = fixture()
+    const hung = script(
+      f.root,
+      `
+      const { parentPort } = require('node:worker_threads')
+      parentPort.postMessage({ id: 0, ok: true, revision: 1 })
+      parentPort.on('message', () => {})
+    `
+    )
+    const client = clientFor(f.initialization, hung)
+    await client.ready
+    const write = client.writeSerializedDomains([{ domain: 'settings', payload: '{}' }])
+    const failed = expect(write).rejects.toMatchObject({ outcome: 'indeterminate' })
+    await client.abort()
+    await failed
+    await client.close()
+  })
+
+  it('resolves flat and shared-chunk entry layouts', () => {
+    expect(resolveProfileStateWriterWorkerPath(bundleRoot)).toBe(workerPath)
+    expect(resolveProfileStateWriterWorkerPath(join(bundleRoot, 'chunks'))).toBe(workerPath)
+  })
+})
diff --git a/src/main/persistence/restoring-sessions/pane-identity-migration.ts b/src/main/persistence/restoring-sessions/pane-identity-migration.ts
index 98d97a649a31..6cd2bbf129fd 100644
--- a/src/main/persistence/restoring-sessions/pane-identity-migration.ts
+++ b/src/main/persistence/restoring-sessions/pane-identity-migration.ts
@@ -1,8 +1,8 @@
+import type { ProfileStateStartupPaneAlias } from '../loading-store/profile-state-authority'
 import type { LegacyPaneKeyAliasEntry } from '../../../shared/persisted-state-types'
 import type { TerminalLayoutSnapshot, TerminalTab } from '../../../shared/terminal-tab-types'
 import type { WorkspaceSessionState } from '../../../shared/workspace-session-state-types'
 import { isTerminalLeafId, makePaneKey } from '../../../shared/stable-pane-id'
-import { agentHookServer } from '../../agent-hooks/server'
 import { collectLayoutLeafIdsInOrder, firstLayoutLeafId } from './terminal-layout-normalization'
 
 export function findWorktreeIdForTab(
@@ -67,47 +67,49 @@ export function createLazyTerminalTabLookup(session: WorkspaceSessionState): Ter
   }
 }
 
-/** Bridges a tab's legacy numeric pane keys to stable ones; returns the alias rows worth persisting. */
-export function registerLegacyPaneKeyAliasesForTab(args: {
+export type PaneAliasNormalizationOptions = {
+  registerAliases?: boolean
+  collectUnboundPaneAlias?: (entry: ProfileStateStartupPaneAlias) => void
+}
+
+type LegacyPaneKeyAlias = Omit<LegacyPaneKeyAliasEntry, 'ptyId'> & { ptyId?: string }
+
+/** Includes unbound aliases needed by the live hook server, even though they are not persisted. */
+export function collectLegacyPaneKeyAliasesForTab(args: {
   tabId: string
   tab: TerminalTab | undefined
   inputLayout: TerminalLayoutSnapshot
   normalizedLayout: TerminalLayoutSnapshot
   leafIdByInputLeafId: Map<string, string>
-}): LegacyPaneKeyAliasEntry[] {
-  const legacyPaneKeyAliasEntries: LegacyPaneKeyAliasEntry[] = []
+}): LegacyPaneKeyAlias[] {
+  const legacyPaneKeyAliasEntries: LegacyPaneKeyAlias[] = []
   const registeredLegacyPaneKeys = new Set<string>()
   const hasLeafPtyBindings = Object.keys(args.inputLayout.ptyIdsByLeafId ?? {}).length > 0
   const fallbackPtyId =
     !hasLeafPtyBindings && typeof args.tab?.ptyId === 'string' ? args.tab.ptyId : undefined
-  const registerLegacyAlias = (inputLeafId: string, leafId: string, ptyId?: string): boolean => {
+  const collectLegacyAlias = (inputLeafId: string, leafId: string, ptyId?: string): void => {
     if (!isTerminalLeafId(leafId)) {
-      return false
+      return
     }
     let paneKey: string
     try {
       paneKey = makePaneKey(args.tabId, leafId)
     } catch {
-      return false
+      return
     }
     const numeric = /^(?:pane:)?(\d+)$/.exec(inputLeafId)?.[1]
     if (!numeric) {
-      return false
+      return
     }
     // Why: PaneManager ids are 1-based; a zero-based alias in split layouts makes tab:1 ambiguous and misroutes panes.
     const legacyPaneKey = `${args.tabId}:${numeric}`
-    agentHookServer.registerPaneKeyAlias(legacyPaneKey, paneKey, ptyId)
     registeredLegacyPaneKeys.add(legacyPaneKey)
-    if (ptyId) {
-      legacyPaneKeyAliasEntries.push({
-        ptyId,
-        legacyPaneKey,
-        stablePaneKey: paneKey,
-        updatedAt: Date.now()
-      })
-      return true
-    }
-    return false
+    legacyPaneKeyAliasEntries.push({
+      ptyId,
+      legacyPaneKey,
+      stablePaneKey: paneKey,
+      updatedAt: Date.now()
+    })
   }
   const inputLeafIds = new Set([
     ...collectLayoutLeafIdsInOrder(args.inputLayout.root),
@@ -119,7 +121,7 @@ export function registerLegacyPaneKeyAliasesForTab(args: {
     }
     const leafId = args.leafIdByInputLeafId.get(inputLeafId)
     if (leafId) {
-      registerLegacyAlias(
+      collectLegacyAlias(
         inputLeafId,
         leafId,
         args.inputLayout.ptyIdsByLeafId?.[inputLeafId] ?? fallbackPtyId
@@ -142,7 +144,6 @@ export function registerLegacyPaneKeyAliasesForTab(args: {
         if (registeredLegacyPaneKeys.has(legacyPaneKey)) {
           continue
         }
-        agentHookServer.registerPaneKeyAlias(legacyPaneKey, paneKey, args.tab.ptyId)
         legacyPaneKeyAliasEntries.push({
           ptyId: args.tab.ptyId,
           legacyPaneKey,
diff --git a/src/main/persistence/restoring-sessions/terminal-layout-normalization.ts b/src/main/persistence/restoring-sessions/terminal-layout-normalization.ts
index c2cd72247f61..551d57e6e35c 100644
--- a/src/main/persistence/restoring-sessions/terminal-layout-normalization.ts
+++ b/src/main/persistence/restoring-sessions/terminal-layout-normalization.ts
@@ -218,6 +218,10 @@ export function normalizeTerminalLayoutSnapshotForPersistence(
     inputSnapshot.expandedLeafId && !duplicatedInputLeafIds.has(inputSnapshot.expandedLeafId)
       ? (leafIdByInputLeafId.get(inputSnapshot.expandedLeafId) ?? null)
       : null
+  const chatLeafId =
+    inputSnapshot.chatLeafId && !duplicatedInputLeafIds.has(inputSnapshot.chatLeafId)
+      ? (leafIdByInputLeafId.get(inputSnapshot.chatLeafId) ?? null)
+      : null
   const ptyIdsByLeafId = remapLeafRecordForPersistence(
     inputSnapshot.ptyIdsByLeafId,
     leafIdByInputLeafId,
@@ -244,7 +248,9 @@ export function normalizeTerminalLayoutSnapshotForPersistence(
     !leafRecordEquivalent(inputSnapshot.scrollbackRefsByLeafId, scrollbackRefsByLeafId) ||
     !leafRecordEquivalent(inputSnapshot.titlesByLeafId, titlesByLeafId)
   const metadataChanged =
-    activeLeafId !== inputSnapshot.activeLeafId || expandedLeafId !== inputSnapshot.expandedLeafId
+    activeLeafId !== inputSnapshot.activeLeafId ||
+    expandedLeafId !== inputSnapshot.expandedLeafId ||
+    chatLeafId !== (inputSnapshot.chatLeafId ?? null)
   if (!changed && !recordsChanged && !metadataChanged) {
     return { snapshot, changed: false, leafIdByInputLeafId }
   }
@@ -253,6 +259,7 @@ export function normalizeTerminalLayoutSnapshotForPersistence(
     buffersByLeafId: _oldBuffersByLeafId,
     scrollbackRefsByLeafId: _oldScrollbackRefsByLeafId,
     titlesByLeafId: _oldTitlesByLeafId,
+    chatLeafId: _oldChatLeafId,
     ...snapshotWithoutLeafRecords
   } = inputSnapshot
   return {
@@ -261,6 +268,7 @@ export function normalizeTerminalLayoutSnapshotForPersistence(
       root,
       activeLeafId,
       expandedLeafId,
+      ...(chatLeafId ? { chatLeafId } : {}),
       ...(ptyIdsByLeafId ? { ptyIdsByLeafId } : {}),
       ...(buffersByLeafId ? { buffersByLeafId } : {}),
       ...(scrollbackRefsByLeafId ? { scrollbackRefsByLeafId } : {}),
diff --git a/src/main/persistence/restoring-sessions/workspace-pane-normalization.ts b/src/main/persistence/restoring-sessions/workspace-pane-normalization.ts
index cfc26c7bb8a6..38ec014c7c96 100644
--- a/src/main/persistence/restoring-sessions/workspace-pane-normalization.ts
+++ b/src/main/persistence/restoring-sessions/workspace-pane-normalization.ts
@@ -2,6 +2,7 @@ import type { LegacyPaneKeyAliasEntry, PersistedState } from '../../../shared/pe
 import type { TerminalLayoutSnapshot } from '../../../shared/terminal-tab-types'
 import type { WorkspaceSessionState } from '../../../shared/workspace-session-state-types'
 import type { MigrationUnsupportedPtyEntry } from '../../../shared/agent-status-types'
+import { agentHookServer } from '../../agent-hooks/server'
 import {
   LOCAL_EXECUTION_HOST_ID,
   toSshExecutionHostId,
@@ -12,7 +13,8 @@ import { isTerminalLeafId, parsePaneKey } from '../../../shared/stable-pane-id'
 import { findCrossHostPaneTabIds, withoutPaneTabIds } from './cross-host-pane-tab-ids'
 import {
   createLazyTerminalTabLookup,
-  registerLegacyPaneKeyAliasesForTab
+  collectLegacyPaneKeyAliasesForTab,
+  type PaneAliasNormalizationOptions
 } from './pane-identity-migration'
 import { normalizeTerminalLayoutSnapshotForPersistence } from './terminal-layout-normalization'
 import {
@@ -37,7 +39,7 @@ export {
 export function normalizeWorkspaceSessionPaneIdentities(
   session: WorkspaceSessionState,
   priorLayoutsByTabId: Record<string, TerminalLayoutSnapshot> = {},
-  options: { skipAliasTabIds?: ReadonlySet<string> } = {}
+  options: PaneAliasNormalizationOptions & { skipAliasTabIds?: ReadonlySet<string> } = {}
 ): {
   session: WorkspaceSessionState
   changed: boolean
@@ -49,9 +51,6 @@ export function normalizeWorkspaceSessionPaneIdentities(
   let changed = false
   const leafIdByInputLeafIdByTabId = new Map<string, Map<string, string>>()
   const leafIdByPtyIdByTabId = new Map<string, Map<string, string>>()
-  // Why always empty: legacy numeric pane keys are bridged by aliases now, not persisted as
-  // restart-required rows; the field stays so callers keep clearing stale rows written by old builds.
-  const migrationUnsupportedEntries: MigrationUnsupportedPtyEntry[] = []
   const legacyPaneKeyAliasEntries: LegacyPaneKeyAliasEntry[] = []
   const terminalLayoutsByTabId: Record<string, TerminalLayoutSnapshot> = {}
   let tabsById: ReturnType<typeof createLazyTerminalTabLookup> | null = null
@@ -64,7 +63,7 @@ export function normalizeWorkspaceSessionPaneIdentities(
     leafIdByInputLeafIdByTabId.set(tabId, normalized.leafIdByInputLeafId)
     if (!options.skipAliasTabIds?.has(tabId)) {
       tabsById ??= createLazyTerminalTabLookup(session)
-      const tabAliasEntries = registerLegacyPaneKeyAliasesForTab({
+      const tabAliasEntries = collectLegacyPaneKeyAliasesForTab({
         tabId,
         tab: tabsById.get(tabId),
         inputLayout: layout,
@@ -73,7 +72,18 @@ export function normalizeWorkspaceSessionPaneIdentities(
       })
       // Why: old split layouts can generate enough alias rows to exceed V8's argument limit if spread into push().
       for (const entry of tabAliasEntries) {
-        legacyPaneKeyAliasEntries.push(entry)
+        if (options.registerAliases !== false) {
+          agentHookServer.registerPaneKeyAlias(
+            entry.legacyPaneKey,
+            entry.stablePaneKey,
+            entry.ptyId
+          )
+        }
+        if (entry.ptyId) {
+          legacyPaneKeyAliasEntries.push({ ...entry, ptyId: entry.ptyId })
+        } else {
+          options.collectUnboundPaneAlias?.(entry)
+        }
       }
     }
     const leafIdByPtyId = new Map<string, string>()
@@ -97,7 +107,8 @@ export function normalizeWorkspaceSessionPaneIdentities(
     changed,
     leafIdByInputLeafIdByTabId,
     leafIdByPtyIdByTabId,
-    migrationUnsupportedEntries,
+    // Aliases replace old restart-required rows; callers still clear that legacy field.
+    migrationUnsupportedEntries: [],
     legacyPaneKeyAliasEntries
   }
 }
@@ -163,7 +174,10 @@ function mergeAcknowledgementLeafIdMapsByTabId(
   return merged
 }
 
-export function normalizePersistedPaneIdentityState(state: PersistedState): {
+export function normalizePersistedPaneIdentityState(
+  state: PersistedState,
+  options: PaneAliasNormalizationOptions = {}
+): {
   state: PersistedState
   changed: boolean
   migrationUnsupportedEntries: MigrationUnsupportedPtyEntry[]
@@ -174,6 +188,7 @@ export function normalizePersistedPaneIdentityState(state: PersistedState): {
     state.workspaceSession,
     {},
     {
+      ...options,
       skipAliasTabIds: crossHostTabIds
     }
   )
@@ -200,6 +215,7 @@ export function normalizePersistedPaneIdentityState(state: PersistedState): {
         hostSession,
         {},
         {
+          ...options,
           skipAliasTabIds: crossHostTabIds
         }
       )
diff --git a/src/main/persistence/restoring-sessions/workspace-session-write-rollback.ts b/src/main/persistence/restoring-sessions/workspace-session-write-rollback.ts
new file mode 100644
index 000000000000..bdca21f7bbe1
--- /dev/null
+++ b/src/main/persistence/restoring-sessions/workspace-session-write-rollback.ts
@@ -0,0 +1,132 @@
+import { isDeepStrictEqual } from 'node:util'
+import type { WorkspaceSessionState } from '../../../shared/workspace-session-state-types'
+
+const MISSING = Symbol('missing')
+
+/** A JSON-shaped slot of persisted session state, or the absent-key sentinel. */
+type RollbackSlot =
+  | string
+  | number
+  | boolean
+  | null
+  | undefined
+  | typeof MISSING
+  | readonly RollbackSlot[]
+  | RollbackRecord
+
+type RollbackRecord = { readonly [key: string]: RollbackSlot }
+
+function isRecord(value: RollbackSlot): value is RollbackRecord {
+  return (
+    value !== MISSING &&
+    typeof value === 'object' &&
+    value !== null &&
+    !Array.isArray(value) &&
+    Object.getPrototypeOf(value) === Object.prototype
+  )
+}
+
+type IdentifiedRecord = RollbackRecord & { readonly id: string }
+
+function identifiedRows(value: RollbackSlot): readonly IdentifiedRecord[] | null {
+  if (value === MISSING) {
+    return []
+  }
+  if (
+    !Array.isArray(value) ||
+    !value.every((row): row is IdentifiedRecord => isRecord(row) && typeof row.id === 'string')
+  ) {
+    return null
+  }
+  return new Set(value.map((row) => row.id)).size === value.length ? value : null
+}
+
+function rollbackIdentifiedRows(
+  original: RollbackSlot,
+  staged: RollbackSlot,
+  current: RollbackSlot
+): readonly RollbackSlot[] | null {
+  if (!Array.isArray(original) && !Array.isArray(staged) && !Array.isArray(current)) {
+    return null
+  }
+  const before = identifiedRows(original)
+  const written = identifiedRows(staged)
+  const latest = identifiedRows(current)
+  if (!before || !written || !latest) {
+    return null
+  }
+  const beforeById = new Map(before.map((row) => [row.id, row]))
+  const writtenById = new Map(written.map((row) => [row.id, row]))
+  const latestById = new Map(latest.map((row) => [row.id, row]))
+  const restored = new Map<string, RollbackSlot>()
+  for (const id of new Set([...beforeById.keys(), ...writtenById.keys(), ...latestById.keys()])) {
+    const value = rollbackValue(
+      beforeById.get(id) ?? MISSING,
+      writtenById.get(id) ?? MISSING,
+      latestById.get(id) ?? MISSING
+    )
+    if (value !== MISSING) {
+      restored.set(id, value)
+    }
+  }
+  const order = latest.map((row) => row.id).filter((id) => restored.has(id))
+  for (const [index, row] of before.entries()) {
+    if (restored.has(row.id) && !order.includes(row.id)) {
+      order.splice(Math.min(index, order.length), 0, row.id)
+    }
+  }
+  return order.map((id) => restored.get(id))
+}
+
+function rollbackValue(
+  original: RollbackSlot,
+  staged: RollbackSlot,
+  current: RollbackSlot
+): RollbackSlot {
+  if (isDeepStrictEqual(original, staged)) {
+    return current
+  }
+  if (isDeepStrictEqual(current, staged)) {
+    return original
+  }
+  // Terminal and unified tab rows have stable ids; unrelated row edits must survive rollback.
+  const rows = rollbackIdentifiedRows(original, staged, current)
+  if (rows) {
+    return rows
+  }
+  if (!isRecord(original) || !isRecord(staged) || !isRecord(current)) {
+    return current
+  }
+  let changed = false
+  const next: Record<string, RollbackSlot> = { ...current }
+  for (const key of new Set([
+    ...Object.keys(original),
+    ...Object.keys(staged),
+    ...Object.keys(current)
+  ])) {
+    const value = rollbackValue(
+      Object.hasOwn(original, key) ? original[key] : MISSING,
+      Object.hasOwn(staged, key) ? staged[key] : MISSING,
+      Object.hasOwn(current, key) ? current[key] : MISSING
+    )
+    if (value === MISSING) {
+      if (Object.hasOwn(next, key)) {
+        delete next[key]
+        changed = true
+      }
+    } else if (!Object.hasOwn(current, key) || !isDeepStrictEqual(current[key], value)) {
+      next[key] = value
+      changed = true
+    }
+  }
+  return changed ? next : current
+}
+
+export function rollbackWorkspaceSessionAfterFailedAsyncWrite(
+  original: WorkspaceSessionState,
+  staged: WorkspaceSessionState,
+  current: WorkspaceSessionState
+): WorkspaceSessionState {
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Each restored field retains a value from the same field of a typed session.
+  return rollbackValue(original, staged, current) as WorkspaceSessionState
+}
diff --git a/src/main/persistence/scheduling-automations/automation-definition-operations.ts b/src/main/persistence/scheduling-automations/automation-definition-operations.ts
index c25315e4986b..1192b7aaf391 100644
--- a/src/main/persistence/scheduling-automations/automation-definition-operations.ts
+++ b/src/main/persistence/scheduling-automations/automation-definition-operations.ts
@@ -3,6 +3,7 @@ import { invalidateLocalWorktreeMetadataPruneInputs } from '../../local-worktree
 import type {
   Automation,
   AutomationCreateInput,
+  AutomationRun,
   AutomationUpdateInput
 } from '../../../shared/automations-types'
 import type { PersistedState } from '../../../shared/persisted-state-types'
@@ -38,6 +39,7 @@ export type AutomationDefinitionOperations = {
   storageAuthority: AutomationStorageAuthority
   flush: () => void
   recordCreated: () => void
+  recordAutomationRunsMutation?: (runs: readonly AutomationRun[]) => void
 }
 
 export function listAutomations(state: PersistedState): Automation[] {
@@ -263,6 +265,7 @@ export function deleteAutomation(
   operations.state.automationRuns = (operations.state.automationRuns ?? []).filter(
     (entry) => entry.automationId !== id
   )
+  operations.recordAutomationRunsMutation?.(operations.state.automationRuns)
   // Why: the automation and its unfinished runs were pinning their workspace; both are gone (#17775).
   invalidateLocalWorktreeMetadataPruneInputs()
   operations.flush()
diff --git a/src/main/persistence/scheduling-automations/automation-run-operations.ts b/src/main/persistence/scheduling-automations/automation-run-operations.ts
index 0dc9e61731ad..7415fd12cf1f 100644
--- a/src/main/persistence/scheduling-automations/automation-run-operations.ts
+++ b/src/main/persistence/scheduling-automations/automation-run-operations.ts
@@ -28,6 +28,7 @@ import {
 export type AutomationRunOperations = {
   state: PersistedState
   flush: () => void
+  recordAutomationRunsMutation?: (runs: readonly AutomationRun[]) => void
   recordManualRun: () => void
   getWorkspaceDisplayName: (workspaceId: string | null | undefined) => string | null
 }
@@ -110,6 +111,7 @@ export function createAutomationRun(
     ...(operations.state.automationRuns ?? []),
     run
   ])
+  operations.recordAutomationRunsMutation?.(operations.state.automationRuns ?? [])
   if (trigger === 'manual') {
     operations.recordManualRun()
   }
@@ -149,6 +151,7 @@ export function recordRepeatedAutomationSkip(
   }
   // Replaced, not patched in place: the list projection caches on array identity.
   operations.state.automationRuns = runs.map((run) => (run.id === latest.id ? updated : run))
+  operations.recordAutomationRunsMutation?.(operations.state.automationRuns)
   touchAutomation(operations.state, automationId, now)
   operations.flush()
   return updated
@@ -202,6 +205,7 @@ export function updateAutomationRun(
   operations.state.automationRuns = operations.state.automationRuns.map((run) =>
     run.id === result.runId ? updated : run
   )
+  operations.recordAutomationRunsMutation?.(operations.state.automationRuns)
   if (!isFinalAutomationRunStatus(current.status) && isFinalAutomationRunStatus(updated.status)) {
     // Why: only a non-final run pins its workspace, so finishing releases the claim (#17775).
     invalidateLocalWorktreeMetadataPruneInputs()
@@ -229,6 +233,7 @@ export function snapshotAutomationRunWorkspaceDisplayName(
     return { ...run, workspaceDisplayName: normalizedDisplayName }
   })
   if (updatedCount > 0) {
+    operations.recordAutomationRunsMutation?.(operations.state.automationRuns ?? [])
     operations.flush()
   }
   return updatedCount
diff --git a/src/main/persistence/tracking-repos/repo-update-host-guard.test.ts b/src/main/persistence/tracking-repos/repo-update-host-guard.test.ts
new file mode 100644
index 000000000000..101cbc2e2b2d
--- /dev/null
+++ b/src/main/persistence/tracking-repos/repo-update-host-guard.test.ts
@@ -0,0 +1,98 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type { Repo } from '../../../shared/repo-types'
+import { RepoUpdatePersistenceOperations } from './repo-update-operations'
+
+function makeRepo(overrides: Partial<Repo> & Pick<Repo, 'id'>): Repo {
+  return {
+    path: '/repos/example',
+    displayName: 'Example',
+    badgeColor: '#000000',
+    addedAt: 0,
+    kind: 'git',
+    ...overrides
+  }
+}
+
+function makeOperations(repos: Repo[]) {
+  const state = { repos, projectGroups: [] }
+  const scheduleSave = vi.fn()
+  const operations = new RepoUpdatePersistenceOperations({
+    state,
+    bumpLocalWorktreeScanGeneration: vi.fn(),
+    syncProjectHostSetupCompatibilityState: vi.fn(),
+    scheduleSave,
+    hydrateRepo: (repo) => repo
+  })
+  return { operations, scheduleSave, state }
+}
+
+describe('updateRepo host guard', () => {
+  let errors: string[]
+
+  beforeEach(() => {
+    errors = []
+    vi.spyOn(console, 'error').mockImplementation((...args: unknown[]) => {
+      errors.push(args.map(String).join(' '))
+    })
+  })
+
+  it('reports a host mismatch instead of returning the same silent null as a missing row', () => {
+    // #22421's exact shape: the row exists under `runtime:env-1`, the caller addressed the probe host.
+    const { operations, scheduleSave } = makeOperations([
+      makeRepo({ id: 'repo-1', executionHostId: 'runtime:env-1' })
+    ])
+
+    const result = operations.updateRepo('repo-1', { displayName: 'Renamed' }, 'local')
+
+    expect(result).toBeNull()
+    expect(scheduleSave).not.toHaveBeenCalled()
+    expect(errors).toHaveLength(1)
+    expect(errors[0]).toContain('repo-1')
+    expect(errors[0]).toContain('requested host local')
+    expect(errors[0]).toContain('runtime:env-1')
+  })
+
+  it('stays silent when the row genuinely does not exist', () => {
+    const { operations } = makeOperations([
+      makeRepo({ id: 'repo-1', executionHostId: 'runtime:env-1' })
+    ])
+
+    expect(operations.updateRepo('repo-missing', { displayName: 'Renamed' }, 'local')).toBeNull()
+    expect(errors).toEqual([])
+  })
+
+  it('writes when the host argument matches the row stamp', () => {
+    const { operations, scheduleSave, state } = makeOperations([
+      makeRepo({ id: 'repo-1', executionHostId: 'runtime:env-1' })
+    ])
+
+    const result = operations.updateRepo('repo-1', { displayName: 'Renamed' }, 'runtime:env-1')
+
+    expect(result?.displayName).toBe('Renamed')
+    expect(state.repos[0].displayName).toBe('Renamed')
+    expect(scheduleSave).toHaveBeenCalledTimes(1)
+    expect(errors).toEqual([])
+  })
+
+  it('still refuses a cross-host write when both hosts hold a row with the same id', () => {
+    const local = makeRepo({ id: 'repo-1', displayName: 'Local', executionHostId: 'local' })
+    const peer = makeRepo({ id: 'repo-1', displayName: 'Peer', executionHostId: 'ssh:peer' })
+    const { operations, state } = makeOperations([local, peer])
+
+    const result = operations.updateRepo('repo-1', { displayName: 'Local edit' }, 'local')
+
+    expect(result?.displayName).toBe('Local edit')
+    // The peer's row is untouched: a client-local write must never repair another host's metadata.
+    expect(state.repos[1].displayName).toBe('Peer')
+  })
+
+  it('writes without a host argument exactly as before', () => {
+    const { operations, state } = makeOperations([
+      makeRepo({ id: 'repo-1', executionHostId: 'runtime:env-1' })
+    ])
+
+    expect(operations.updateRepo('repo-1', { displayName: 'Renamed' })?.displayName).toBe('Renamed')
+    expect(state.repos[0].displayName).toBe('Renamed')
+    expect(errors).toEqual([])
+  })
+})
diff --git a/src/main/persistence/tracking-repos/repo-update-operations.ts b/src/main/persistence/tracking-repos/repo-update-operations.ts
index 399d05ac653a..79444a32a19d 100644
--- a/src/main/persistence/tracking-repos/repo-update-operations.ts
+++ b/src/main/persistence/tracking-repos/repo-update-operations.ts
@@ -10,17 +10,50 @@ import { invalidateGhAccountTokenCache } from '../../github/gh-account-token'
 import { sanitizeRepoUpdatesForPersistence } from './repo-sanitization'
 
 export type RepoUpdateMutationOperations = {
-  state: PersistedState
+  state: Pick<PersistedState, 'repos' | 'projectGroups'>
   bumpLocalWorktreeScanGeneration: (repoId: string) => void
   syncProjectHostSetupCompatibilityState: () => void
   scheduleSave: () => void
   hydrateRepo: (repo: Repo) => Repo
 }
 
+/**
+ * Resolve the row a host-scoped write may touch, and report the one failure the `Repo | null` return
+ * cannot express: the row exists, but under a different host stamp.
+ *
+ * `hostId` is the row's own `executionHostId`, never the host a caller probed or a user selected. A
+ * caller that passes anything else gets the same `null` as a deleted row, so its write is discarded
+ * with no error and no failing test — how #22421 shipped an enrichment pass that never persisted.
+ */
+export function findRepoRowForHostScopedWrite(
+  repos: readonly Repo[],
+  id: string,
+  hostId: ExecutionHostId | undefined
+): Repo | undefined {
+  if (!hostId) {
+    return repos.find((candidate) => candidate.id === id)
+  }
+  const matched = repos.find(
+    (candidate) => candidate.id === id && getRepoExecutionHostId(candidate) === hostId
+  )
+  if (matched) {
+    return matched
+  }
+  const storedHostIds = repos
+    .filter((candidate) => candidate.id === id)
+    .map((candidate) => getRepoExecutionHostId(candidate))
+  if (storedHostIds.length > 0) {
+    console.error(
+      `[persistence] Discarded a repo update for ${id}: requested host ${hostId}, but the row is stored on ${storedHostIds.join(', ')}. Address updateRepo by the row's own executionHostId stamp.`
+    )
+  }
+  return undefined
+}
+
 export class RepoUpdatePersistenceOperations {
   constructor(private readonly operations: RepoUpdateMutationOperations) {}
 
-  private get state(): PersistedState {
+  private get state(): Pick<PersistedState, 'repos' | 'projectGroups'> {
     return this.operations.state
   }
 
@@ -77,10 +110,7 @@ export class RepoUpdatePersistenceOperations {
     },
     hostId?: ExecutionHostId
   ): Repo | null {
-    const repo = this.state.repos.find(
-      (candidate) =>
-        candidate.id === id && (!hostId || getRepoExecutionHostId(candidate) === hostId)
-    )
+    const repo = findRepoRowForHostScopedWrite(this.state.repos, id, hostId)
     if (!repo) {
       return null
     }
diff --git a/src/main/pi/agent-status-extension-source.ts b/src/main/pi/agent-status-extension-source.ts
index bdf9061779c7..58a18b78fa56 100644
--- a/src/main/pi/agent-status-extension-source.ts
+++ b/src/main/pi/agent-status-extension-source.ts
@@ -46,7 +46,7 @@ export function getPiAgentStatusExtensionSource(kind: PiAgentKind = 'pi'): strin
           '  const sessionFile = sessionManager?.getSessionFile?.()',
           "  runtimeOmpSessionMetadata = typeof sessionId === 'string' && sessionId && typeof sessionFile === 'string' && sessionFile ? { session_id: sessionId, session_file: sessionFile } : {}",
           '  trackModelSession(runtimeOmpSessionMetadata.session_id)',
-          '  updateModelMetadata(ctx)', 
+          '  updateModelMetadata(ctx)',
           '}',
           '',
           'function getPostSessionMetadata(ompRuntime: boolean): Record<string, unknown> {',
@@ -75,7 +75,7 @@ export function getPiAgentStatusExtensionSource(kind: PiAgentKind = 'pi'): strin
           '  const sessionId = sessionManager?.getSessionId?.()',
           '  const sessionFile = sessionManager?.getSessionFile?.()',
           "  sessionMetadata = typeof sessionId === 'string' && sessionId && typeof sessionFile === 'string' && sessionFile ? { session_id: sessionId, session_file: sessionFile } : {}",
-          '  trackModelSession(sessionMetadata.session_id)', 
+          '  trackModelSession(sessionMetadata.session_id)',
           '}',
           '',
           'function updateRuntimeOmpSessionMetadata(ctx: unknown): void {',
diff --git a/src/main/pi/titlebar-extension-service.test.ts b/src/main/pi/titlebar-extension-service.test.ts
index 1240d1859a8b..6b66d7f337f1 100644
--- a/src/main/pi/titlebar-extension-service.test.ts
+++ b/src/main/pi/titlebar-extension-service.test.ts
@@ -156,9 +156,14 @@ describe('PiTitlebarExtensionService', () => {
     homedirOverride.current = fakeHome
     vi.stubEnv('PI_CONFIG_DIR', 'host-profile')
     try {
-      const env = new PiTitlebarExtensionService().buildPtyEnv('pty-ambient-root', undefined, 'omp', {
-        materializeDefaultHome: true
-      })
+      const env = new PiTitlebarExtensionService().buildPtyEnv(
+        'pty-ambient-root',
+        undefined,
+        'omp',
+        {
+          materializeDefaultHome: true
+        }
+      )
       expect(env.ORCA_OMP_SOURCE_AGENT_DIR).toBe(join(fakeHome, '.omp', 'agent'))
       expect(existsSync(join(fakeHome, 'host-profile'))).toBe(false)
     } finally {
diff --git a/src/main/pi/titlebar-extension-service.ts b/src/main/pi/titlebar-extension-service.ts
index 64a021603f7b..4b698c02f09a 100644
--- a/src/main/pi/titlebar-extension-service.ts
+++ b/src/main/pi/titlebar-extension-service.ts
@@ -191,8 +191,7 @@ export class PiTitlebarExtensionService {
   ): Record<string, string> {
     const freshConfigEnv = kind === 'omp' ? this.buildFreshOmpEnv() : {}
     // The caller resolves the effective launch environment before this point.
-    const sourceAgentDir =
-      existingAgentDir || getDefaultPiAgentDir(kind, options?.configDirName)
+    const sourceAgentDir = existingAgentDir || getDefaultPiAgentDir(kind, options?.configDirName)
     if (kind !== 'prime-agent') {
       try {
         this.safeRemoveOverlay(this.getPtyOverlayDir(ptyId, kind), kind)
diff --git a/src/main/plugins/plugin-host-methods.test.ts b/src/main/plugins/plugin-host-methods.test.ts
index ee6e7a5b9d02..7f196c9eb818 100644
--- a/src/main/plugins/plugin-host-methods.test.ts
+++ b/src/main/plugins/plugin-host-methods.test.ts
@@ -194,10 +194,14 @@ describe('terminal.sendText explicit worktree routing', () => {
         { includeVisualLayouts: false }
       )
       expect(delegate.sendTerminal).toHaveBeenCalledTimes(1)
-      expect(delegate.sendTerminal).toHaveBeenCalledWith(terminalId, {
-        text: 'echo hi',
-        enter: true
-      })
+      expect(delegate.sendTerminal).toHaveBeenCalledWith(
+        terminalId,
+        {
+          text: 'echo hi',
+          enter: true
+        },
+        { inputKind: 'driving' }
+      )
       expect(vi.mocked(delegate.listTerminals).mock.invocationCallOrder[0]!).toBeLessThan(
         vi.mocked(delegate.sendTerminal).mock.invocationCallOrder[0]!
       )
diff --git a/src/main/plugins/plugin-host-service-bindings.ts b/src/main/plugins/plugin-host-service-bindings.ts
index 266b819dbaea..731934d55954 100644
--- a/src/main/plugins/plugin-host-service-bindings.ts
+++ b/src/main/plugins/plugin-host-service-bindings.ts
@@ -3,6 +3,7 @@ import { PLUGIN_WORKSPACE_TERMINAL_LIMIT } from '../../shared/plugins/plugin-hos
 import type { PluginHostServices } from './plugin-host-methods'
 import { PluginSecretsStore } from './plugin-secrets-store'
 import { PluginKvStore } from './plugin-storage-store'
+import type { TerminalInputKind } from '../../shared/terminal-input-kind'
 
 /** Structural subset of OrcaRuntimeService exposed to plugin facade bindings. */
 export type PluginRuntimeDelegate = {
@@ -19,7 +20,8 @@ export type PluginRuntimeDelegate = {
   ): Promise<{ terminals: { handle: string; title: string | null }[] }>
   sendTerminal(
     handle: string,
-    action: { text?: string; enter?: boolean }
+    action: { text?: string; enter?: boolean },
+    options: { inputKind: TerminalInputKind }
   ): Promise<{ accepted: boolean }>
   dispatchPluginNotification(input: {
     pluginId: string
@@ -59,7 +61,7 @@ export function bindPluginHostServices(input: {
         .map((terminal) => ({ id: terminal.handle }))
     },
     sendTerminalText: async (terminalId, action) => {
-      const result = await delegate.sendTerminal(terminalId, action)
+      const result = await delegate.sendTerminal(terminalId, action, { inputKind: 'driving' })
       return { accepted: result.accepted }
     },
     dispatchPluginNotification: (notification) => delegate.dispatchPluginNotification(notification),
diff --git a/src/main/preflight/freebuff-remote-detection.test.ts b/src/main/preflight/freebuff-remote-detection.test.ts
new file mode 100644
index 000000000000..de8408da088f
--- /dev/null
+++ b/src/main/preflight/freebuff-remote-detection.test.ts
@@ -0,0 +1,31 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+
+const { getActiveMultiplexerMock } = vi.hoisted(() => ({
+  getActiveMultiplexerMock: vi.fn()
+}))
+
+vi.mock('../ssh/ssh-target-registry', () => ({
+  getActiveMultiplexer: getActiveMultiplexerMock
+}))
+
+import { detectRemoteAgents } from './agent-detection'
+
+afterEach(() => vi.resetAllMocks())
+
+describe('Freebuff SSH detection', () => {
+  it('asks the execution host to detect Freebuff separately from Codebuff', async () => {
+    const request = vi.fn().mockResolvedValue({ agents: ['freebuff'] })
+    getActiveMultiplexerMock.mockReturnValue({ isDisposed: () => false, request })
+
+    await expect(detectRemoteAgents({ connectionId: 'ssh-freebuff' })).resolves.toEqual([
+      'freebuff'
+    ])
+    expect(getActiveMultiplexerMock).toHaveBeenCalledWith('ssh-freebuff')
+    expect(request).toHaveBeenCalledWith('preflight.detectAgents', {
+      commands: expect.arrayContaining([
+        { id: 'freebuff', cmd: 'freebuff' },
+        { id: 'codebuff', cmd: 'codebuff' }
+      ])
+    })
+  })
+})
diff --git a/src/main/project-groups/nested-repo-glob-budget.test.ts b/src/main/project-groups/nested-repo-glob-budget.test.ts
new file mode 100644
index 000000000000..41b051a0134f
--- /dev/null
+++ b/src/main/project-groups/nested-repo-glob-budget.test.ts
@@ -0,0 +1,193 @@
+import { describe, expect, it } from 'vitest'
+import {
+  isIgnoredNestedRepoDirectory,
+  readNestedRepoGitignoreRules,
+  readNestedRepoGlobMatchSteps
+} from './nested-repo-scan-rules'
+
+async function readRules(content: string) {
+  return readNestedRepoGitignoreRules({
+    folderPath: '/synthetic',
+    entries: [{ name: '.gitignore', isDirectory: false }],
+    baseSegments: [],
+    filesystem: {
+      readDirectory: async () => [],
+      readTextFile: async () => content,
+      joinPath: (parent, child) => `${parent}/${child}`,
+      basename: (path) => path,
+      hasGitMarker: () => false,
+      isSelectedPathGitRepo: () => false
+    }
+  })
+}
+
+function strings(alphabet: string[], maxLength: number): string[] {
+  const result = ['']
+  let layer = ['']
+  for (let length = 1; length <= maxLength; length++) {
+    layer = layer.flatMap((prefix) => alphabet.map((character) => prefix + character))
+    result.push(...layer)
+  }
+  return result
+}
+
+function segmentLists(alphabet: string[], maxLength: number): string[][] {
+  const result: string[][] = []
+  let layer: string[][] = [[]]
+  for (let length = 1; length <= maxLength; length++) {
+    layer = layer.flatMap((prefix) => alphabet.map((token) => [...prefix, token]))
+    result.push(...layer)
+  }
+  return result
+}
+
+// Pre-change oracle: a regular expression per wildcard segment, plus an unmemoized `**` walk over
+// uncollapsed segments. Differential cases hold the shipped matcher to exactly this behaviour.
+function referenceSegment(pattern: string): string | RegExp {
+  if (!pattern.includes('*') && !pattern.includes('?')) {
+    return pattern
+  }
+  const escaped = pattern.replace(/[.+^${}()|[\]\\]/g, '\\$&')
+  return new RegExp(`^${escaped.replace(/\*/g, '[^/]*').replace(/\?/g, '[^/]')}$`)
+}
+
+function referenceSegmentMatches(pattern: string | RegExp, value: string): boolean {
+  return typeof pattern === 'string' ? pattern === value : pattern.test(value)
+}
+
+function referenceIgnored(line: string, candidateSegments: string[]): boolean {
+  const anchored = line.startsWith('/')
+  const pattern = line.replace(/^\/+/, '').replace(/\/+$/, '')
+  if (!anchored && !pattern.includes('/')) {
+    const segment = referenceSegment(pattern)
+    return candidateSegments.some((candidate) => referenceSegmentMatches(segment, candidate))
+  }
+  const patternSegments = pattern
+    .split('/')
+    .map((segment) => (segment === '**' ? segment : referenceSegment(segment)))
+  const matchFrom = (patternIndex: number, candidateIndex: number): boolean => {
+    if (patternIndex >= patternSegments.length) {
+      return candidateIndex >= candidateSegments.length
+    }
+    const segment = patternSegments[patternIndex]
+    if (segment === '**') {
+      return (
+        matchFrom(patternIndex + 1, candidateIndex) ||
+        (candidateIndex < candidateSegments.length && matchFrom(patternIndex, candidateIndex + 1))
+      )
+    }
+    return (
+      candidateIndex < candidateSegments.length &&
+      referenceSegmentMatches(segment, candidateSegments[candidateIndex] ?? '') &&
+      matchFrom(patternIndex + 1, candidateIndex + 1)
+    )
+  }
+  return matchFrom(0, 0)
+}
+
+function stepsSpentOn(run: () => void): number {
+  const before = readNestedRepoGlobMatchSteps()
+  run()
+  return readNestedRepoGlobMatchSteps() - before
+}
+
+describe('nested repository wildcard work budget', () => {
+  it('bounds wildcard segment work for fifty adverse names', async () => {
+    const rules = await readRules(`${'*a'.repeat(12)}b`)
+    const name = `${'a'.repeat(24)}c`
+    let ignored = 0
+    const steps = stepsSpentOn(() => {
+      for (let index = 0; index < 50; index++) {
+        ignored += Number(isIgnoredNestedRepoDirectory(name, [name], rules))
+      }
+    })
+    expect(ignored).toBe(0)
+    // O(pattern length x name length) per name, ~51 steps in practice; the pre-change expression
+    // revisited earlier stars and needed ~25 ms for each of these names.
+    expect(steps).toBeLessThan(50 * 100)
+  })
+
+  it('bounds ** path work for a long run of double stars', async () => {
+    const rules = await readRules(`${'**/'.repeat(24)}z`)
+    const candidate = ['a', 'b', 'c', 'd', 'e', 'f', 'g', 'h']
+    let ignored = true
+    // Parse-time collapse of the `**` run; uncollapsed this shape cost ~49M recursive calls.
+    const steps = stepsSpentOn(() => {
+      ignored = isIgnoredNestedRepoDirectory('h', candidate, rules)
+    })
+    expect(ignored).toBe(false)
+    expect(steps).toBeLessThan(100)
+  })
+
+  it('bounds ** path work when non-collapsible segments separate the double stars', async () => {
+    const rules = await readRules(Array.from({ length: 12 }, () => '**/*').join('/'))
+    const candidate = ['a', 'b', 'c', 'd', 'e', 'f', 'g', 'h']
+    let ignored = true
+    // Memoization; without it this shape revisits pairs and costs over a thousand calls.
+    const steps = stepsSpentOn(() => {
+      ignored = isIgnoredNestedRepoDirectory('h', candidate, rules)
+    })
+    expect(ignored).toBe(false)
+    expect(steps).toBeLessThan(400)
+  })
+
+  it('accepts exactly the same paths for a collapsed and an expanded ** run', async () => {
+    const collapsed = await readRules('**/x')
+    const expanded = await readRules('**/**/**/x')
+    for (const candidate of segmentLists(['a', 'x'], 4)) {
+      const name = candidate.at(-1) ?? ''
+      const label = candidate.join('/')
+      const expectedMatch = referenceIgnored('**/x', candidate)
+      expect(isIgnoredNestedRepoDirectory(name, candidate, collapsed), label).toBe(expectedMatch)
+      expect(isIgnoredNestedRepoDirectory(name, candidate, expanded), label).toBe(expectedMatch)
+      expect(referenceIgnored('**/**/**/x', candidate), label).toBe(expectedMatch)
+    }
+  })
+
+  it('preserves wildcard results for every short pattern and name', async () => {
+    const names = strings(['a', 'b', '?'], 4)
+    for (const pattern of strings(['a', 'b', '*', '?'], 4).slice(1)) {
+      const rules = await readRules(pattern)
+      for (const name of names) {
+        expect(isIgnoredNestedRepoDirectory(name, [name], rules), `${pattern} / ${name}`).toBe(
+          referenceIgnored(pattern, [name])
+        )
+      }
+    }
+  })
+
+  it('preserves path results for every short multi-segment pattern and candidate path', async () => {
+    const candidates = segmentLists(['a', 'b', 'ab'], 3)
+    for (const patternSegments of segmentLists(['a', 'b', '*', '?', '**'], 3)) {
+      const joined = patternSegments.join('/')
+      // The leading slash anchors the rule, which is the non-basenameOnly path even at one segment.
+      for (const line of [joined, `/${joined}`]) {
+        const rules = await readRules(line)
+        for (const candidate of candidates) {
+          expect(
+            isIgnoredNestedRepoDirectory(candidate.at(-1) ?? '', candidate, rules),
+            `${line} / ${candidate.join('/')}`
+          ).toBe(referenceIgnored(line, candidate))
+        }
+      }
+    }
+  })
+
+  it.each([
+    ['[literal]+.*', '[literal]+.suffix', true],
+    ['[literal]+.*', 'literal-suffix', false],
+    ['a\\*', 'a\\suffix', true],
+    ['*', 'a/b', false],
+    ['a?', 'a\n', true],
+    ['a?b', 'a\nb', true],
+    ['a*b', 'ab\n', false],
+    ['?', '😀', false],
+    ['??', '😀', true],
+    ['*😀?', 'x😀a', true],
+    ['*?*a*', 'ba', true],
+    ['**b**', 'abca', true]
+  ])('preserves literal and code-unit matching for %s / %s', async (pattern, name, expected) => {
+    const rules = await readRules(pattern)
+    expect(isIgnoredNestedRepoDirectory(name, [name], rules)).toBe(expected)
+  })
+})
diff --git a/src/main/project-groups/nested-repo-scan-rules.ts b/src/main/project-groups/nested-repo-scan-rules.ts
index 3a8399172528..d38bd1f09833 100644
--- a/src/main/project-groups/nested-repo-scan-rules.ts
+++ b/src/main/project-groups/nested-repo-scan-rules.ts
@@ -17,12 +17,15 @@ export type NestedRepoScanFilesystem = {
 
 type IgnoreRule = {
   pattern: string
-  segmentPatterns: (string | RegExp)[]
+  segmentPatterns: GlobSegment[]
+  memoizePathWalk: boolean
   negate: boolean
   basenameOnly: boolean
   baseSegments: string[]
 }
 
+type GlobSegment = string | { pattern: string }
+
 export type TraversalFolder = {
   path: string
   depth: number
@@ -83,42 +86,107 @@ function shouldSkipDirectory(name: string, depth: number): boolean {
   return depth > 0 && name.startsWith('.')
 }
 
-function compileGlobSegment(pattern: string): string | RegExp {
+function compileGlobSegment(pattern: string): GlobSegment {
   if (!pattern.includes('*') && !pattern.includes('?')) {
     return pattern
   }
-  const escaped = pattern.replace(/[.+^${}()|[\]\\]/g, '\\$&')
-  return new RegExp(`^${escaped.replace(/\*/g, '[^/]*').replace(/\?/g, '[^/]')}$`)
+  return { pattern }
 }
 
-function globSegmentMatches(pattern: string | RegExp, value: string): boolean {
-  return typeof pattern === 'string' ? pattern === value : pattern.test(value)
+let globMatchSteps = 0
+
+/**
+ * Monotonic count of matcher steps taken since process start.
+ *
+ * Budget tests assert on a delta so an algorithmic regression fails deterministically instead of
+ * riding on how fast the machine running the suite happens to be.
+ */
+export function readNestedRepoGlobMatchSteps(): number {
+  return globMatchSteps
+}
+
+function globSegmentMatches(segment: GlobSegment, value: string): boolean {
+  globMatchSteps++
+  if (typeof segment === 'string') {
+    return segment === value
+  }
+  const { pattern } = segment
+  let patternIndex = 0
+  let valueIndex = 0
+  let starIndex = -1
+  let starMatchIndex = 0
+  // Retry only the latest star, avoiding combinatorial regular-expression backtracking.
+  while (valueIndex < value.length) {
+    globMatchSteps++
+    const token = pattern[patternIndex]
+    if (token === '*') {
+      starIndex = patternIndex++
+      starMatchIndex = valueIndex
+    } else if (token === value[valueIndex] || (token === '?' && value[valueIndex] !== '/')) {
+      patternIndex++
+      valueIndex++
+    } else if (starIndex !== -1 && value[starMatchIndex] !== '/') {
+      patternIndex = starIndex + 1
+      valueIndex = ++starMatchIndex
+    } else {
+      return false
+    }
+  }
+  while (pattern[patternIndex] === '*') {
+    patternIndex++
+  }
+  return patternIndex === pattern.length
 }
 
 function pathSegmentsMatch(
-  patternSegments: (string | RegExp)[],
-  candidateSegments: string[]
+  patternSegments: GlobSegment[],
+  candidateSegments: string[],
+  memoize: boolean
 ): boolean {
+  const memoStride = candidateSegments.length + 1
+  // Allocating the table costs more than the walk it would save on the overwhelmingly common
+  // shapes, so only rules that can actually revisit a pair pay for it.
+  const visited = memoize ? new Map<number, boolean>() : undefined
   const matchFrom = (patternIndex: number, candidateIndex: number): boolean => {
+    globMatchSteps++
     if (patternIndex >= patternSegments.length) {
       return candidateIndex >= candidateSegments.length
     }
-    const pattern = patternSegments[patternIndex]
-    if (pattern === '**') {
-      return (
-        matchFrom(patternIndex + 1, candidateIndex) ||
-        (candidateIndex < candidateSegments.length && matchFrom(patternIndex, candidateIndex + 1))
-      )
+    const memoKey = patternIndex * memoStride + candidateIndex
+    const memoized = visited?.get(memoKey)
+    if (memoized !== undefined) {
+      return memoized
     }
-    return (
-      candidateIndex < candidateSegments.length &&
-      globSegmentMatches(pattern, candidateSegments[candidateIndex] ?? '') &&
-      matchFrom(patternIndex + 1, candidateIndex + 1)
-    )
+    const pattern = patternSegments[patternIndex]
+    const matched =
+      pattern === '**'
+        ? matchFrom(patternIndex + 1, candidateIndex) ||
+          (candidateIndex < candidateSegments.length && matchFrom(patternIndex, candidateIndex + 1))
+        : candidateIndex < candidateSegments.length &&
+          globSegmentMatches(pattern, candidateSegments[candidateIndex] ?? '') &&
+          matchFrom(patternIndex + 1, candidateIndex + 1)
+    visited?.set(memoKey, matched)
+    return matched
   }
   return matchFrom(0, 0)
 }
 
+function compilePathSegments(pattern: string): GlobSegment[] {
+  const segments: GlobSegment[] = []
+  for (const segment of pattern.split('/')) {
+    // `**` spans zero or more segments, so `**/**` accepts exactly what `**` accepts: collapsing a
+    // run keeps one adversarial line from handing the path matcher dozens of forking segments.
+    if (segment === '**') {
+      if (segments.at(-1) !== '**') {
+        segments.push(segment)
+      }
+      continue
+    }
+    segments.push(compileGlobSegment(segment))
+  }
+  return segments
+}
+
 function parseGitignoreRules(content: string, baseSegments: string[]): IgnoreRule[] {
   return content
     .split(/\r?\n/)
@@ -130,13 +198,15 @@ function parseGitignoreRules(content: string, baseSegments: string[]): IgnoreRul
       const anchored = unprefixed.startsWith('/')
       const pattern = unprefixed.replace(/^\/+/, '').replace(/\/+$/, '')
       const basenameOnly = !anchored && !pattern.includes('/')
+      const segmentPatterns = basenameOnly
+        ? [compileGlobSegment(pattern)]
+        : compilePathSegments(pattern)
       return {
         pattern,
-        segmentPatterns: basenameOnly
-          ? [compileGlobSegment(pattern)]
-          : pattern
-              .split('/')
-              .map((segment) => (segment === '**' ? segment : compileGlobSegment(segment))),
+        segmentPatterns,
+        // One `**` walks the candidate segments once; two or more reach the same (pattern,
+        // candidate) pair by many routes, which is what turns the walk exponential.
+        memoizePathWalk: segmentPatterns.filter((segment) => segment === '**').length > 1,
         negate,
         basenameOnly,
         baseSegments
@@ -158,7 +228,7 @@ export function isIgnoredNestedRepoDirectory(
     const relativeSegments = segments.slice(rule.baseSegments.length)
     const matches = rule.basenameOnly
       ? relativeSegments.some((segment) => globSegmentMatches(rule.segmentPatterns[0], segment))
-      : pathSegmentsMatch(rule.segmentPatterns, relativeSegments)
+      : pathSegmentsMatch(rule.segmentPatterns, relativeSegments, rule.memoizePathWalk)
     if (matches) {
       ignored = !rule.negate
     }
diff --git a/src/main/protected-secret-persistence-concurrency.test.ts b/src/main/protected-secret-persistence-concurrency.test.ts
new file mode 100644
index 000000000000..1b429cdaa8b3
--- /dev/null
+++ b/src/main/protected-secret-persistence-concurrency.test.ts
@@ -0,0 +1,192 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { setSecretStore } from '../shared/secret-store'
+import {
+  ProtectedSecretPersistence,
+  type ProtectedSecretRetentionUpdate
+} from './protected-secret-persistence'
+
+const cipherState = { available: true, fails: false }
+const ciphertext = (plaintext: string): string =>
+  Buffer.from(`encrypted:${plaintext}`).toString('base64')
+
+function prepare(
+  secrets: ProtectedSecretPersistence,
+  slot: string,
+  plaintext: string
+): ProtectedSecretRetentionUpdate {
+  const { retentionUpdate } = secrets.encrypt(slot, plaintext)
+  if (!retentionUpdate) {
+    throw new Error('Expected a prepared retention update')
+  }
+  return retentionUpdate
+}
+
+describe('protected secret acknowledgements', () => {
+  beforeEach(() => {
+    cipherState.available = true
+    cipherState.fails = false
+    setSecretStore({
+      isEncryptionAvailable: () => cipherState.available,
+      encryptString: (plaintext) => {
+        if (cipherState.fails) {
+          throw new Error('Keyring encryption failed')
+        }
+        return Buffer.from(`encrypted:${plaintext}`)
+      },
+      decryptString: (encrypted) => encrypted.toString().slice('encrypted:'.length),
+      describeProtectionGap: () => null
+    })
+  })
+
+  afterEach(() => vi.restoreAllMocks())
+
+  it.each(['remove', 'empty encryption', 'empty decryption'])(
+    'does not revive a secret cleared by %s while its save was in flight',
+    (clear) => {
+      const secrets = new ProtectedSecretPersistence()
+      const update = prepare(secrets, 'slot', 'first')
+      if (clear === 'remove') {
+        secrets.removeRetainedBlob('slot')
+      } else if (clear === 'empty encryption') {
+        secrets.encrypt('slot', '')
+      } else {
+        secrets.decrypt('slot', '')
+      }
+
+      secrets.commitRetentionUpdates([update])
+
+      cipherState.available = false
+      expect(secrets.encrypt('slot', 'replacement').blob).toBe('')
+    }
+  )
+
+  it.each(['replacement', ''])('preserves a reloaded sealed slot after an old %j save', (value) => {
+    const secrets = new ProtectedSecretPersistence()
+    secrets.decrypt('slot', ciphertext('original'))
+    const update = prepare(secrets, 'slot', value)
+    const reloaded = ciphertext('reloaded')
+    cipherState.available = false
+    secrets.decrypt('slot', reloaded)
+
+    secrets.commitRetentionUpdates([update])
+
+    expect(secrets.isSealed('slot', reloaded)).toBe(true)
+    expect(secrets.encrypt('slot', '').blob).toBe(reloaded)
+    expect(secrets.hasPendingEncryption()).toBe(false)
+  })
+
+  it('preserves a successfully decrypted replacement after an older save acknowledges', () => {
+    const secrets = new ProtectedSecretPersistence()
+    const update = prepare(secrets, 'slot', 'first')
+    const reloaded = ciphertext('reloaded')
+    expect(secrets.decrypt('slot', reloaded)).toBe('reloaded')
+
+    secrets.commitRetentionUpdates([update])
+
+    cipherState.available = false
+    expect(secrets.encrypt('slot', 'reloaded').blob).toBe(reloaded)
+  })
+
+  it.each(['unavailable', 'throws'])(
+    'keeps a newer %s encryption pending after an old ack',
+    (failure) => {
+      vi.spyOn(console, 'error').mockImplementation(() => {})
+      const secrets = new ProtectedSecretPersistence()
+      const original = ciphertext('original')
+      secrets.decrypt('slot', original)
+      const update = prepare(secrets, 'slot', 'first')
+      cipherState.available = failure !== 'unavailable'
+      cipherState.fails = failure === 'throws'
+      expect(secrets.encrypt('slot', 'newer')).toEqual({ blob: original, degraded: true })
+
+      secrets.commitRetentionUpdates([update])
+
+      expect(secrets.hasPendingEncryption()).toBe(true)
+      cipherState.available = false
+      expect(secrets.encrypt('slot', 'newer').blob).toBe(original)
+      cipherState.available = true
+      cipherState.fails = false
+      const retry = prepare(secrets, 'slot', 'newer')
+      secrets.commitRetentionUpdates([retry])
+      expect(secrets.hasPendingEncryption()).toBe(false)
+      cipherState.available = false
+      expect(secrets.encrypt('slot', 'newer').blob).toBe(ciphertext('newer'))
+    }
+  )
+
+  it.each([false, true])(
+    'retains only the latest prepared ciphertext, reverse ack order: %s',
+    (reverse) => {
+      const secrets = new ProtectedSecretPersistence()
+      const older = prepare(secrets, 'slot', 'older')
+      const newer = prepare(secrets, 'slot', 'newer')
+      for (const update of reverse ? [newer, older] : [older, newer]) {
+        secrets.commitRetentionUpdates([update])
+      }
+
+      cipherState.available = false
+      expect(secrets.encrypt('slot', 'replacement').blob).toBe(ciphertext('newer'))
+    }
+  )
+
+  it('retains the last same-slot value in a single acknowledged preparation batch', () => {
+    const secrets = new ProtectedSecretPersistence()
+    const updates = [prepare(secrets, 'slot', 'older'), prepare(secrets, 'slot', 'newer')]
+
+    secrets.commitRetentionUpdates(updates)
+
+    cipherState.available = false
+    expect(secrets.encrypt('slot', 'replacement').blob).toBe(ciphertext('newer'))
+  })
+
+  it('does not reuse an old acknowledgement when a removed dynamic slot is recreated', () => {
+    const secrets = new ProtectedSecretPersistence()
+    const removed = prepare(secrets, 'dynamic-slot', 'removed')
+    secrets.removeRetainedBlob('dynamic-slot')
+    const recreated = prepare(secrets, 'dynamic-slot', 'recreated')
+
+    secrets.commitRetentionUpdates([removed, recreated, removed])
+
+    cipherState.available = false
+    expect(secrets.encrypt('dynamic-slot', 'replacement').blob).toBe(ciphertext('recreated'))
+  })
+
+  it('invalidates only the changed slot in an acknowledged batch', () => {
+    const secrets = new ProtectedSecretPersistence()
+    const updates = [prepare(secrets, 'keep', 'keep'), prepare(secrets, 'remove', 'remove')]
+    secrets.removeRetainedBlob('remove')
+
+    secrets.commitRetentionUpdates(updates)
+
+    cipherState.available = false
+    expect(secrets.encrypt('keep', 'replacement').blob).toBe(ciphertext('keep'))
+    expect(secrets.encrypt('remove', 'replacement').blob).toBe('')
+  })
+
+  it('does not accept a prepared update from a replaced persistence instance', () => {
+    const previous = new ProtectedSecretPersistence()
+    const current = new ProtectedSecretPersistence()
+    const older = prepare(previous, 'slot', 'older')
+    const newer = prepare(current, 'slot', 'newer')
+
+    current.commitRetentionUpdates([older, newer])
+
+    cipherState.available = false
+    expect(current.encrypt('slot', 'replacement').blob).toBe(ciphertext('newer'))
+  })
+
+  it('keeps the previous ciphertext and pending retry when a prepared save has no confirmed ack', () => {
+    const secrets = new ProtectedSecretPersistence()
+    const original = ciphertext('original')
+    secrets.decrypt('slot', original)
+    cipherState.available = false
+    secrets.encrypt('slot', 'replacement')
+    cipherState.available = true
+
+    prepare(secrets, 'slot', 'replacement')
+
+    expect(secrets.hasPendingEncryption()).toBe(true)
+    cipherState.available = false
+    expect(secrets.encrypt('slot', 'replacement').blob).toBe(original)
+  })
+})
diff --git a/src/main/protected-secret-persistence.test.ts b/src/main/protected-secret-persistence.test.ts
index 28a9ca6cf430..cbd1561f3449 100644
--- a/src/main/protected-secret-persistence.test.ts
+++ b/src/main/protected-secret-persistence.test.ts
@@ -62,6 +62,7 @@ describe('ProtectedSecretPersistence', () => {
       degraded: true,
       hashValue: ciphertext
     })
+    expect(secrets.hasPendingEncryption()).toBe(false)
 
     cipherState.available = true
     expect(secrets.encrypt(slot, '')).toEqual({
@@ -74,4 +75,34 @@ describe('ProtectedSecretPersistence', () => {
     secrets.removeRetainedBlob(slot)
     expect(secrets.encrypt(slot, '')).toEqual({ blob: '', degraded: false })
   })
+
+  it('keeps deferred encryption pending until its retention update commits', async () => {
+    const { ProtectedSecretPersistence } = await import('./protected-secret-persistence')
+    const secrets = new ProtectedSecretPersistence()
+    cipherState.available = false
+    secrets.encrypt('slot', 'pending')
+    expect(secrets.hasPendingEncryption()).toBe(true)
+    cipherState.available = true
+    const encrypted = secrets.encrypt('slot', 'pending')
+    expect(secrets.hasPendingEncryption()).toBe(true)
+    if (!encrypted.retentionUpdate) {
+      throw new Error('Expected a retention update')
+    }
+    secrets.commitRetentionUpdates([encrypted.retentionUpdate])
+    expect(secrets.hasPendingEncryption()).toBe(false)
+  })
+
+  it('retires a deferred empty secret without retaining a phantom retry', async () => {
+    const { ProtectedSecretPersistence } = await import('./protected-secret-persistence')
+    const secrets = new ProtectedSecretPersistence()
+    cipherState.available = false
+    secrets.encrypt('slot', 'pending')
+    const cleared = secrets.encrypt('slot', '')
+    expect(secrets.hasPendingEncryption()).toBe(true)
+    if (!cleared.retentionUpdate) {
+      throw new Error('Expected a retention update')
+    }
+    secrets.commitRetentionUpdates([cleared.retentionUpdate])
+    expect(secrets.hasPendingEncryption()).toBe(false)
+  })
 })
diff --git a/src/main/protected-secret-persistence.ts b/src/main/protected-secret-persistence.ts
index 90bb2ee334d9..c72af0966197 100644
--- a/src/main/protected-secret-persistence.ts
+++ b/src/main/protected-secret-persistence.ts
@@ -19,6 +19,7 @@ export type ProtectedSecretDecryption = {
 export type ProtectedSecretRetentionUpdate = {
   slot: string
   blob: string | null
+  epoch: symbol
 }
 
 export type LegacyPlaintextValidator = (value: string) => boolean
@@ -34,10 +35,18 @@ type ProtectedSecretEncryption = {
 export class ProtectedSecretPersistence {
   private readonly retainedBlobs = new Map<string, string>()
   private readonly sealedSlots = new Set<string>()
+  private readonly pendingEncryption = new Set<string>()
+  private readonly retentionEpochs = new Map<string, symbol>()
+
+  hasPendingEncryption(): boolean {
+    return this.pendingEncryption.size > 0
+  }
 
   removeRetainedBlob(slot: string): void {
+    this.retentionEpochs.delete(slot)
     this.retainedBlobs.delete(slot)
     this.sealedSlots.delete(slot)
+    this.pendingEncryption.delete(slot)
   }
 
   isSealed(slot: string, value: string): boolean {
@@ -46,6 +55,12 @@ export class ProtectedSecretPersistence {
 
   commitRetentionUpdates(updates: readonly ProtectedSecretRetentionUpdate[]): void {
     for (const update of updates) {
+      // A delayed save must not overwrite a newer secret decision.
+      if (this.retentionEpochs.get(update.slot) !== update.epoch) {
+        continue
+      }
+      this.retentionEpochs.delete(update.slot)
+      this.pendingEncryption.delete(update.slot)
       if (update.blob === null) {
         this.removeRetainedBlob(update.slot)
       } else {
@@ -56,11 +71,21 @@ export class ProtectedSecretPersistence {
   }
 
   encrypt(slot: string, plaintext: string): ProtectedSecretEncryption {
+    this.retentionEpochs.delete(slot)
     const retained = this.retainedBlobs.get(slot) ?? ''
     if (!plaintext && !retained) {
-      return { blob: '', degraded: false }
+      return {
+        blob: '',
+        degraded: false,
+        ...(this.pendingEncryption.has(slot)
+          ? { retentionUpdate: this.prepareRetentionUpdate(slot, null) }
+          : {})
+      }
     }
     if (!this.encryptionAvailable()) {
+      if (!this.isSealed(slot, plaintext) && (plaintext || !this.sealedSlots.has(slot))) {
+        this.pendingEncryption.add(slot)
+      }
       return {
         blob: retained,
         degraded: true,
@@ -74,7 +99,7 @@ export class ProtectedSecretPersistence {
       return {
         blob: '',
         degraded: false,
-        retentionUpdate: { slot, blob: null }
+        retentionUpdate: this.prepareRetentionUpdate(slot, null)
       }
     }
     try {
@@ -82,9 +107,10 @@ export class ProtectedSecretPersistence {
       return {
         blob,
         degraded: false,
-        retentionUpdate: { slot, blob }
+        retentionUpdate: this.prepareRetentionUpdate(slot, blob)
       }
     } catch (err) {
+      this.pendingEncryption.add(slot)
       console.error('[persistence] Encryption failed; retaining the prior protected value:', err)
       return { blob: retained, degraded: true }
     }
@@ -99,6 +125,7 @@ export class ProtectedSecretPersistence {
     ciphertext: string,
     isLegacyPlaintext?: LegacyPlaintextValidator
   ): ProtectedSecretDecryption {
+    this.retentionEpochs.delete(slot)
     if (!ciphertext) {
       this.removeRetainedBlob(slot)
       return { plaintext: '', status: 'decrypted' }
@@ -129,6 +156,15 @@ export class ProtectedSecretPersistence {
     }
   }
 
+  private prepareRetentionUpdate(
+    slot: string,
+    blob: string | null
+  ): ProtectedSecretRetentionUpdate {
+    const epoch = Symbol()
+    this.retentionEpochs.set(slot, epoch)
+    return { slot, blob, epoch }
+  }
+
   private encryptionAvailable(): boolean {
     // Why getSecretStore() sits outside the try: an uninstalled store is a startup bug,
     // not a keyring failure. Swallowing it would degrade to an empty blob and report
diff --git a/src/main/providers/agent-foreground-process-git-bash.win32.test.ts b/src/main/providers/agent-foreground-process-git-bash.win32.test.ts
index 3cd4f07c003c..4133375180fa 100644
--- a/src/main/providers/agent-foreground-process-git-bash.win32.test.ts
+++ b/src/main/providers/agent-foreground-process-git-bash.win32.test.ts
@@ -1,19 +1,97 @@
-import { mkdtempSync } from 'node:fs'
+import { mkdtempSync, rmdirSync, symlinkSync } from 'node:fs'
 import { tmpdir } from 'node:os'
-import { join } from 'node:path'
+import { dirname, join } from 'node:path'
 import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest'
 import { removeTreeSync } from '../../shared/windows-transient-lock-removal'
 import { WINDOWS_GIT_BASH_SHELL } from '../../shared/windows-terminal-shell'
 import { confirmPtyShellForeground } from '../daemon/pty-subprocess/pty-shell-foreground-confirmation'
 import { createPtyShellLaunchPlan } from '../daemon/pty-subprocess/shell-launch-plan'
 import { spawnNativeDaemonPty } from '../daemon/pty-subprocess/native-pty-spawn'
+import { canUseBunPty, spawnBunPty } from '../daemon/pty-subprocess/bun-pty-process'
+import { createWindowsBunPtyLaunch } from '../daemon/pty-subprocess/windows-bun-pty-launch'
 import { createDaemonPtyEnvironment } from '../daemon/pty-subprocess/spawn-environment'
+import type { PtyShellLaunchPlan } from '../daemon/pty-subprocess/shell-launch-plan'
 import type { PtySubprocessOptions } from '../daemon/pty-subprocess'
-import { isGitForWindowsBashLauncherPath } from '../git-bash'
+import { isGitForWindowsBashLauncherPath, resolveGitBashPath } from '../git-bash'
 import { readWindowsPtyJobProcessIds } from './windows-pty-job-membership'
 
 const describeOnWindows = process.platform === 'win32' ? describe : describe.skip
 
+async function spawnPlannedPane(
+  plan: PtyShellLaunchPlan,
+  env: Record<string, string>,
+  opts: PtySubprocessOptions
+): ReturnType<typeof spawnNativeDaemonPty> {
+  return spawnNativeDaemonPty(
+    { ...plan, env, cols: opts.cols, rows: opts.rows },
+    {
+      canUseBunPty,
+      spawnBunPty: (args) =>
+        spawnBunPty(args, {
+          // Source tests use the TS worker; packaged hosts resolve their adjacent JS worker.
+          createWindowsLaunch: (launch) =>
+            createWindowsBunPtyLaunch(launch, {
+              workerPath: join(__dirname, '../daemon/pty-subprocess/windows-bun-pty-gate-entry.ts')
+            })
+        })
+    }
+  )
+}
+
+/** Drives a live pane through prompt -> foreground command -> interrupt -> background job. */
+async function proveIdlePromptCycle(
+  spawned: Awaited<ReturnType<typeof spawnNativeDaemonPty>>,
+  expectedJobSize: number
+): Promise<void> {
+  const proc = spawned.process
+  let output = ''
+  let dead = false
+  proc.onData((chunk) => {
+    output += chunk
+  })
+  proc.onExit(() => {
+    dead = true
+  })
+  const confirm = (): Promise<boolean> =>
+    confirmPtyShellForeground({
+      process: proc,
+      shellPath: spawned.shellPath,
+      isDead: () => dead
+    })
+  try {
+    await vi.waitFor(() => expect(output).toContain('$'), { timeout: 20_000 })
+    await vi.waitFor(() => expect(readWindowsPtyJobProcessIds(proc)?.size).toBe(expectedJobSize), {
+      timeout: 5_000
+    })
+    await vi.waitFor(async () => expect(await confirm(), 'initial prompt').toBe(true), {
+      timeout: 5_000
+    })
+
+    // Interrupt only after the child is ready, not during a transient shell fork.
+    proc.write(
+      "node -e \"console.log(['ORCA','FOREGROUND_READY'].join('_')); setInterval(() => {}, 1000)\"\r"
+    )
+    await vi.waitFor(() => expect(output).toContain('ORCA_FOREGROUND_READY'), {
+      timeout: 10_000
+    })
+    await vi.waitFor(async () => expect(await confirm()).toBe(false), { timeout: 10_000 })
+
+    proc.write('\x03')
+    await vi.waitFor(
+      async () => {
+        expect(dead, 'terminal survived foreground interrupt').toBe(false)
+        expect(await confirm(), 'prompt after interrupt').toBe(true)
+      },
+      { timeout: 10_000 }
+    )
+
+    proc.write('sleep 60 &\r')
+    await vi.waitFor(async () => expect(await confirm()).toBe(false), { timeout: 10_000 })
+  } finally {
+    proc.kill()
+  }
+}
+
 describeOnWindows("Git Bash launcher shell proof with Orca's real launch", () => {
   let userData: string
   const previousUserData = process.env.ORCA_USER_DATA_PATH
@@ -52,42 +130,40 @@ describeOnWindows("Git Bash launcher shell proof with Orca's real launch", () =>
       const plan = createPtyShellLaunchPlan(opts, env)
       expect(isGitForWindowsBashLauncherPath(plan.shellPath)).toBe(true)
       expect(plan.shellArgs.join(' ')).toContain('exec "$BASH"')
-      const spawned = spawnNativeDaemonPty({ ...plan, env, cols: opts.cols, rows: opts.rows })
-      const proc = spawned.process
-      let output = ''
-      let dead = false
-      proc.onData((chunk) => {
-        output += chunk
-      })
-      proc.onExit(() => {
-        dead = true
-      })
-      const confirm = (): Promise<boolean> =>
-        confirmPtyShellForeground({
-          process: proc,
-          shellPath: spawned.shellPath,
-          isDead: () => dead
-        })
-      try {
-        await vi.waitFor(() => expect(output).toContain('$'), { timeout: 20_000 })
-        // Launcher, exec stub, interactive bash: the shape that a size-1 or size-2 rule never matches.
-        await vi.waitFor(() => expect(readWindowsPtyJobProcessIds(proc)?.size).toBe(3), {
-          timeout: 5_000
-        })
-        await vi.waitFor(async () => expect(await confirm()).toBe(true), { timeout: 5_000 })
-
-        proc.write('sleep 60\r')
-        await vi.waitFor(async () => expect(await confirm()).toBe(false), { timeout: 10_000 })
-
-        proc.write('\x03')
-        await vi.waitFor(async () => expect(await confirm()).toBe(true), { timeout: 10_000 })
-
-        proc.write('sleep 60 &\r')
-        await vi.waitFor(async () => expect(await confirm()).toBe(false), { timeout: 10_000 })
-      } finally {
-        proc.kill()
-      }
+      // Launcher, exec stub, interactive bash: the shape that a size-1 or size-2 rule never matches.
+      await proveIdlePromptCycle(await spawnPlannedPane(plan, env, opts), 3)
     },
     60_000
   )
+
+  it('confirms an idle prompt for an install folder named neither Git nor PortableGit', async () => {
+    const discovered = resolveGitBashPath()
+    if (!discovered) {
+      throw new Error('this host has no Git for Windows install to stage')
+    }
+    expect(isGitForWindowsBashLauncherPath(discovered)).toBe(true)
+    // A junction, not a copy: the operator's install is neither modified nor duplicated.
+    const stagingRoot = mkdtempSync(join(tmpdir(), 'orca-git-renamed-'))
+    const stagedInstall = join(stagingRoot, 'Git-2.55')
+    symlinkSync(dirname(dirname(discovered)), stagedInstall, 'junction')
+    const opts: PtySubprocessOptions = {
+      sessionId: 'git-bash-renamed-shell-proof',
+      cols: 120,
+      rows: 30,
+      cwd: tmpdir(),
+      shellOverride: join(stagedInstall, 'bin', 'bash.exe')
+    }
+    try {
+      const env = createDaemonPtyEnvironment(opts)
+      const plan = createPtyShellLaunchPlan(opts, env)
+      expect(plan.shellPath).toBe(opts.shellOverride)
+      expect(isGitForWindowsBashLauncherPath(plan.shellPath)).toBe(true)
+      // No Git Bash startup args for an unrecognized folder, so no exec stub: launcher -> bash.
+      await proveIdlePromptCycle(await spawnPlannedPane(plan, env, opts), 2)
+    } finally {
+      // rmdir, never a recursive remove: it detaches the junction and cannot reach the target.
+      rmdirSync(stagedInstall)
+      removeTreeSync(stagingRoot)
+    }
+  }, 60_000)
 })
diff --git a/src/main/providers/local-pty-bun-artifact.integration.test.ts b/src/main/providers/local-pty-bun-artifact.integration.test.ts
new file mode 100644
index 000000000000..487127887a34
--- /dev/null
+++ b/src/main/providers/local-pty-bun-artifact.integration.test.ts
@@ -0,0 +1,107 @@
+import { build } from 'esbuild'
+import { existsSync } from 'node:fs'
+import { copyFile, mkdtemp } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join, resolve } from 'node:path'
+import { describe, expect, it } from 'vitest'
+import { runProcess } from '../../shared/child-process/run-process'
+import { orcadBunRuntimeFilename } from '../../shared/orcad-artifacts'
+import { ORCAD_BUN_VERSION } from '../../shared/orcad-bun-runtime'
+import { removeTreeSync } from '../../shared/windows-transient-lock-removal'
+
+const runtime =
+  process.env.BUN_EXECUTABLE ?? resolve('out/orcad', orcadBunRuntimeFilename(process.platform))
+
+describe.skipIf(!existsSync(runtime))('isolated Bun in-process PTY artifact', () => {
+  it('spawns, reattaches, delivers data and retires a shell without node-pty installed', async () => {
+    const directory = await mkdtemp(join(tmpdir(), 'orca-bun-local-pty-'))
+    try {
+      const entry = join(directory, 'local-pty.cjs')
+      const external = ['node-pty', 'electron', 'bun:ffi', '@parcel/watcher', '*.node']
+      await build({
+        stdin: {
+          contents: `
+            import { LocalPtyProvider } from './src/main/providers/local-pty-provider'
+            import { setAppEnvironment } from './src/shared/app-environment'
+            import { getCmdExePath } from './src/shared/windows-batch-spawn'
+            try { require.resolve('node-pty'); throw new Error('node-pty unexpectedly available') }
+            catch (error) { if (error.code !== 'MODULE_NOT_FOUND') throw error }
+            setAppEnvironment({
+              getPath: () => process.cwd(), getAppPath: () => process.cwd(),
+              getVersion: () => 'test', isPackaged: () => true,
+              onWillQuit() {}, exit: code => process.exit(code), getAppMetrics: () => []
+            })
+            const provider = new LocalPtyProvider()
+            let output = '', resolveExit
+            const exit = new Promise(resolve => { resolveExit = resolve })
+            provider.onData(event => { output += event.data })
+            provider.onExit(event => resolveExit(event.code))
+            const deadline = setTimeout(() => { provider.killAll(); process.exit(98) }, 10_000)
+            ;(async () => {
+              const first = await provider.spawn({
+                sessionId: 'isolated-bun-fallback', cols: 80, rows: 24, cwd: process.cwd(),
+                shellOverride: process.platform === 'win32' ? getCmdExePath() : '/bin/sh'
+              })
+              const again = await provider.spawn({sessionId:first.id, cols:100, rows:30})
+              provider.write(first.id, process.platform === 'win32'
+                ? 'echo ORCA_BUN_FALLBACK_READY & exit 17\\r'
+                : 'printf ORCA_BUN_FALLBACK_READY; exit 17\\r')
+              const code = await exit
+              clearTimeout(deadline)
+              console.log(JSON.stringify({
+                version:process.versions.bun, code, output:output.includes('ORCA_BUN_FALLBACK_READY'),
+                reattached:again.isReattach === true && again.pid === first.pid,
+                retired:provider.getPtyProcess(first.id) === undefined
+              }))
+            })().catch(error => { clearTimeout(deadline); provider.killAll(); console.error(error);process.exitCode=1 })
+          `,
+          resolveDir: process.cwd(),
+          loader: 'ts'
+        },
+        bundle: true,
+        platform: 'node',
+        format: 'cjs',
+        target: 'node18',
+        external,
+        outfile: entry,
+        logLevel: 'silent'
+      })
+      if (process.platform === 'win32') {
+        await build({
+          entryPoints: ['src/main/daemon/pty-subprocess/windows-bun-pty-gate-entry.ts'],
+          bundle: true,
+          platform: 'node',
+          format: 'cjs',
+          external,
+          outfile: join(directory, 'windows-bun-pty-gate-entry.js'),
+          logLevel: 'silent'
+        })
+      }
+      const isolatedRuntime = join(directory, orcadBunRuntimeFilename(process.platform))
+      await copyFile(runtime, isolatedRuntime)
+      const result = await runProcess({
+        program: isolatedRuntime,
+        args: ['--no-install', entry],
+        cwd: directory,
+        env: {
+          ...process.env,
+          ORCA_BACKGROUND_LAUNCH: '1',
+          ORCA_DISABLE_MACOS_LOGIN_SHELL: '1',
+          ORCA_USER_DATA_PATH: directory
+        },
+        timeoutMs: 15_000,
+        terminationBarrier: true
+      })
+      expect(result.code, result.stderr).toBe(0)
+      expect(JSON.parse(result.stdout)).toEqual({
+        version: ORCAD_BUN_VERSION,
+        code: 17,
+        output: true,
+        reattached: true,
+        retired: true
+      })
+    } finally {
+      removeTreeSync(directory)
+    }
+  }, 20_000)
+})
diff --git a/src/main/providers/local-pty-bun-posix-inspection.test.ts b/src/main/providers/local-pty-bun-posix-inspection.test.ts
new file mode 100644
index 000000000000..c71e4a3fa6c4
--- /dev/null
+++ b/src/main/providers/local-pty-bun-posix-inspection.test.ts
@@ -0,0 +1,153 @@
+import type { IPty } from 'node-pty'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type * as ProcessTableReader from '../../shared/process-table-snapshot-reader'
+import type { ProcessTableRow } from '../../shared/process-table-snapshot'
+import {
+  confirmLocalPtyForegroundProcess,
+  getLocalPtyForegroundProcess,
+  hasLocalPtyChildProcesses,
+  inspectLocalPtyChildProcesses
+} from './local-pty-foreground-inspection'
+import { LocalPtyProvider } from './local-pty-provider'
+import { ptyLastRecognizedForeground, ptyProcesses, ptyShellPath } from './local-pty-provider-state'
+
+const scans = vi.hoisted(() => ({ full: vi.fn(), fresh: vi.fn(), strict: vi.fn() }))
+vi.mock('../../shared/process-table-snapshot-reader', async (importOriginal) => ({
+  ...(await importOriginal<typeof ProcessTableReader>()),
+  getProcessTableSnapshot: scans.full,
+  getFreshProcessTableSnapshot: scans.fresh,
+  getStrictProcessTableSnapshotWithAge: scans.strict
+}))
+const platform = Object.getOwnPropertyDescriptor(process, 'platform')!
+const id = 'bun-pane'
+const provider = new LocalPtyProvider()
+let rows: ProcessTableRow[]
+
+function row(pid: number, ppid: number, command: string, foregroundPid: number): ProcessTableRow {
+  return {
+    pid,
+    ppid,
+    command,
+    pgid: pid,
+    tpgid: foregroundPid,
+    stat: pid === foregroundPid ? 'Ss+' : 'Ss',
+    tty: 'ttys002'
+  }
+}
+
+function pane(): IPty & { processNameIsSpawnFile: true } {
+  return {
+    pid: 100,
+    process: '/bin/zsh',
+    processNameIsSpawnFile: true,
+    cols: 80,
+    rows: 24,
+    handleFlowControl: false,
+    onData: () => ({ dispose() {} }),
+    onExit: () => ({ dispose() {} }),
+    resize() {},
+    clear() {},
+    write() {},
+    kill() {},
+    pause() {},
+    resume() {}
+  }
+}
+
+beforeEach(() => {
+  vi.resetAllMocks()
+  scans.full.mockImplementation(async () => rows)
+  scans.fresh.mockImplementation(async () => rows)
+  scans.strict.mockImplementation(async () => ({ rows, capturedAgeMs: 0 }))
+  ptyProcesses.set(id, pane())
+  ptyShellPath.set(id, '/bin/zsh')
+})
+afterEach(() => {
+  ptyProcesses.clear()
+  ptyShellPath.clear()
+  ptyLastRecognizedForeground.clear()
+  Object.defineProperty(process, 'platform', platform)
+  vi.restoreAllMocks()
+})
+
+describe.each(['darwin', 'linux'])('Bun in-process %s inspection', (host) => {
+  beforeEach(() => Object.defineProperty(process, 'platform', { value: host, configurable: true }))
+
+  it('reports the actual foreground command and warns before closing a busy pane', async () => {
+    rows = [row(100, 1, '-zsh', 101), row(101, 100, 'vim notes.md', 101)]
+    expect(await provider.inspectProcess(id)).toEqual({
+      foregroundProcess: 'vim',
+      hasChildProcesses: true,
+      childProcessEvidence: 'children'
+    })
+    expect(await hasLocalPtyChildProcesses(id)).toBe(true)
+    expect(await confirmLocalPtyForegroundProcess(id)).toBe('vim')
+    expect(scans.fresh).toHaveBeenCalledOnce()
+  })
+
+  it('proves an idle shell has no children', async () => {
+    rows = [row(100, 1, '-zsh', 100)]
+    expect(await provider.inspectProcess(id)).toEqual({
+      foregroundProcess: 'zsh',
+      hasChildProcesses: false,
+      childProcessEvidence: 'no-children'
+    })
+    expect(await hasLocalPtyChildProcesses(id)).toBe(false)
+  })
+
+  it('does not mistake the login wrapper for a running user job', async () => {
+    ptyProcesses.set(id, { ...pane(), process: '/usr/bin/login' })
+    rows = [row(100, 1, '/usr/bin/login -fp test', 101), row(101, 100, '-zsh', 101)]
+    expect(await provider.inspectProcess(id)).toEqual({
+      foregroundProcess: 'zsh',
+      hasChildProcesses: false,
+      childProcessEvidence: 'no-children'
+    })
+  })
+
+  it('preserves a cached agent when the foreground scan cannot verify it', async () => {
+    rows = []
+    scans.full.mockRejectedValue(new Error('process table unavailable'))
+    scans.strict.mockRejectedValue(new Error('process table unavailable'))
+    ptyLastRecognizedForeground.set(id, { name: 'claude', pid: 101, at: Date.now() })
+    expect(await provider.inspectProcess(id)).toEqual({
+      foregroundProcess: 'claude',
+      hasChildProcesses: true,
+      childProcessEvidence: 'unverifiable'
+    })
+    expect(await hasLocalPtyChildProcesses(id)).toBe(true)
+    expect(await confirmLocalPtyForegroundProcess(id)).toBeNull()
+  })
+
+  it('returns uncertainty when the process table has no pane root', async () => {
+    rows = [row(900, 1, '-zsh', 900)]
+    expect(await getLocalPtyForegroundProcess(id)).toBeNull()
+    expect(await inspectLocalPtyChildProcesses(id)).toBe('unverifiable')
+    expect(await hasLocalPtyChildProcesses(id)).toBe(true)
+  })
+
+  it('does not resurrect an agent cache after replacement during fingerprint capture', async () => {
+    rows = [row(100, 1, '-zsh', 101), row(101, 100, 'node /usr/local/bin/claude', 101)]
+    scans.full
+      .mockImplementationOnce(async () => rows)
+      .mockImplementationOnce(async () => {
+        ptyProcesses.set(id, { ...pane(), pid: 999 })
+        return rows
+      })
+    expect(await getLocalPtyForegroundProcess(id)).toBeNull()
+    expect(ptyLastRecognizedForeground.has(id)).toBe(false)
+  })
+
+  it('does not combine an old foreground with a replacement pane during a child scan', async () => {
+    rows = [row(100, 1, '-zsh', 101), row(101, 100, 'vim notes.md', 101)]
+    scans.strict.mockImplementationOnce(async () => {
+      ptyProcesses.set(id, { ...pane(), pid: 999 })
+      return { rows, capturedAgeMs: 0 }
+    })
+    expect(await provider.inspectProcess(id)).toEqual({
+      foregroundProcess: null,
+      hasChildProcesses: true,
+      childProcessEvidence: 'unverifiable'
+    })
+  })
+})
diff --git a/src/main/providers/local-pty-bun-windows-identity.test.ts b/src/main/providers/local-pty-bun-windows-identity.test.ts
new file mode 100644
index 000000000000..434445790462
--- /dev/null
+++ b/src/main/providers/local-pty-bun-windows-identity.test.ts
@@ -0,0 +1,80 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { ptyProcesses, ptyShellPath } from './local-pty-provider-state'
+import {
+  confirmLocalPtyShellForeground,
+  inspectLocalPtyChildProcesses
+} from './local-pty-foreground-inspection'
+import { getLocalPtyCwd, sendLocalPtySignal } from './local-pty-session-operations'
+
+const { confirm, cwd, membership } = vi.hoisted(() => ({
+  confirm: vi.fn(),
+  cwd: vi.fn(),
+  membership: vi.fn()
+}))
+vi.mock('./agent-foreground-process', () => ({
+  confirmShellForegroundProcess: confirm,
+  resolveAgentForegroundProcessWithAvailability: vi.fn()
+}))
+vi.mock('./process-cwd', () => ({ resolveProcessCwd: cwd }))
+vi.mock('./windows-pty-job-membership', () => ({
+  readWindowsPtyJobProcessIds: membership,
+  isWindowsPtyJobReadable: () => true
+}))
+
+const originalPlatform = Object.getOwnPropertyDescriptor(process, 'platform')!
+beforeEach(() => {
+  Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' })
+  confirm.mockResolvedValue(true)
+  cwd.mockResolvedValue('C:\\work')
+})
+afterEach(() => {
+  ptyProcesses.clear()
+  ptyShellPath.clear()
+  Object.defineProperty(process, 'platform', originalPlatform)
+  vi.restoreAllMocks()
+})
+
+describe('Bun in-process Windows shell identity', () => {
+  it('uses the child shell for cwd and foreground checks while signaling the owned job', async () => {
+    const proc = {
+      pid: 1200,
+      shellProcessId: 1201,
+      jobRootProcessIsWrapper: true as const,
+      processNameIsSpawnFile: true as const,
+      process: 'cmd.exe',
+      cols: 80,
+      rows: 24,
+      handleFlowControl: false,
+      onData: () => ({ dispose() {} }),
+      onExit: () => ({ dispose() {} }),
+      write() {},
+      clear() {},
+      pause() {},
+      resume() {},
+      resize() {},
+      kill() {},
+      signalProcess: vi.fn()
+    }
+    ptyProcesses.set('gated-shell', proc)
+    const shellPath = 'C:\\Windows\\System32\\cmd.exe'
+    ptyShellPath.set('gated-shell', shellPath)
+    const kill = vi.spyOn(process, 'kill').mockReturnValue(true)
+    expect(await getLocalPtyCwd('gated-shell')).toBe('C:\\work')
+    expect(cwd).toHaveBeenCalledWith(1201)
+    expect(await confirmLocalPtyShellForeground('gated-shell')).toBe(true)
+    expect(confirm).toHaveBeenCalledWith(1201, shellPath, expect.any(Object))
+    await sendLocalPtySignal('gated-shell', 'SIGTERM')
+    expect(proc.signalProcess).toHaveBeenCalledWith('SIGTERM')
+    expect(kill).not.toHaveBeenCalled()
+    membership.mockReturnValue(new Set([1201]))
+    expect(await inspectLocalPtyChildProcesses('gated-shell')).toBe('no-children')
+    membership.mockReturnValue(new Set([1201, 1202]))
+    expect(await inspectLocalPtyChildProcesses('gated-shell')).toBe('children')
+    membership.mockReturnValue(null)
+    expect(await inspectLocalPtyChildProcesses('gated-shell')).toBe('unverifiable')
+    Reflect.deleteProperty(proc, 'shellProcessId')
+    cwd.mockClear()
+    expect(await getLocalPtyCwd('gated-shell')).toBe('')
+    expect(cwd).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/main/providers/local-pty-child-process-verdict.test.ts b/src/main/providers/local-pty-child-process-verdict.test.ts
index 0338b38aaa4f..857017b66710 100644
--- a/src/main/providers/local-pty-child-process-verdict.test.ts
+++ b/src/main/providers/local-pty-child-process-verdict.test.ts
@@ -99,7 +99,7 @@ describe('confirmLocalPtyShellForeground', () => {
 const describeOnPosix = process.platform === 'win32' ? describe.skip : describe
 
 describe('inspectLocalPtyChildProcesses', () => {
-  it('reports unverifiable when the pty fd cannot be read', () => {
+  it('reports unverifiable when the pty fd cannot be read', async () => {
     registerPane(
       'pty-closed',
       () => {
@@ -107,24 +107,24 @@ describe('inspectLocalPtyChildProcesses', () => {
       },
       '/bin/zsh'
     )
-    expect(inspectLocalPtyChildProcesses('pty-closed')).toBe('unverifiable')
+    expect(await inspectLocalPtyChildProcesses('pty-closed')).toBe('unverifiable')
   })
 
-  it('still answers no-children when the shell itself is in the foreground', () => {
+  it('still answers no-children when the shell itself is in the foreground', async () => {
     registerPane('pty-idle', 'zsh', '/bin/zsh')
-    expect(inspectLocalPtyChildProcesses('pty-idle')).toBe('no-children')
+    expect(await inspectLocalPtyChildProcesses('pty-idle')).toBe('no-children')
   })
 
-  it('answers children when something else is in the foreground', () => {
+  it('answers children when something else is in the foreground', async () => {
     registerPane('pty-busy', 'vim', '/bin/zsh')
-    expect(inspectLocalPtyChildProcesses('pty-busy')).toBe('children')
+    expect(await inspectLocalPtyChildProcesses('pty-busy')).toBe('children')
   })
 
-  it('treats a pane this provider does not hold as a real negative', () => {
-    expect(inspectLocalPtyChildProcesses('pty-absent')).toBe('no-children')
+  it('treats a pane this provider does not hold as a real negative', async () => {
+    expect(await inspectLocalPtyChildProcesses('pty-absent')).toBe('no-children')
   })
 
-  it('collapses uncertainty to false only in the boolean adapter', async () => {
+  it('preserves uncertainty conservatively in the boolean adapter', async () => {
     let reads = 0
     registerPane(
       'pty-closed',
@@ -134,8 +134,8 @@ describe('inspectLocalPtyChildProcesses', () => {
       },
       '/bin/zsh'
     )
-    await expect(hasLocalPtyChildProcesses('pty-closed')).resolves.toBe(false)
-    // The `false` has to come from the failed read, not from an earlier short-circuit.
+    await expect(hasLocalPtyChildProcesses('pty-closed')).resolves.toBe(true)
+    // The result must come from the failed read, not from an earlier short-circuit.
     expect(reads).toBe(1)
   })
 })
@@ -147,14 +147,14 @@ describeOnPosix('inspectLocalPtyChildProcesses on a retired master', () => {
     // The mechanism is silent: this is the same string an idle pane reports.
     expect(term.process).toBe(POSIX_SHELL)
     // Not `no-children`: the close guard reads that as "nothing is running here" and kills the pane.
-    expect(inspectLocalPtyChildProcesses('pty-retired')).toBe('unverifiable')
+    expect(await inspectLocalPtyChildProcesses('pty-retired')).toBe('unverifiable')
   }, 15000)
 
-  it('collapses uncertainty to false only in the boolean adapter', async () => {
+  it('preserves uncertainty conservatively in the boolean adapter', async () => {
     await registerRetiredPane('pty-retired')
 
     // The adapter exists for `IPtyProvider.hasChildProcesses`, which has no third slot.
-    await expect(hasLocalPtyChildProcesses('pty-retired')).resolves.toBe(false)
+    await expect(hasLocalPtyChildProcesses('pty-retired')).resolves.toBe(true)
   }, 15000)
 })
 
@@ -176,7 +176,7 @@ describe('inspectPtyProviderProcess child-process evidence', () => {
     )
     await expect(inspectPtyProviderProcess(provider, 'pty-closing')).resolves.toEqual({
       foregroundProcess: '/bin/zsh',
-      hasChildProcesses: false,
+      hasChildProcesses: true,
       childProcessEvidence: 'unverifiable'
     })
   })
@@ -216,7 +216,7 @@ describe('inspectPtyProviderProcess child-process evidence', () => {
 
     await expect(inspectPtyProviderProcess(provider, 'pty-swapped')).resolves.toEqual({
       foregroundProcess: null,
-      hasChildProcesses: false,
+      hasChildProcesses: true,
       childProcessEvidence: 'unverifiable'
     })
   })
@@ -229,7 +229,7 @@ describeOnPosix('inspectPtyProviderProcess on a retired master', () => {
     await registerRetiredPane('pty-retired')
 
     const inspection = await inspectPtyProviderProcess(provider, 'pty-retired')
-    expect(inspection.hasChildProcesses).toBe(false)
+    expect(inspection.hasChildProcesses).toBe(true)
     expect(inspection.childProcessEvidence).toBe('unverifiable')
   }, 15000)
 })
diff --git a/src/main/providers/local-pty-foreground-inspection.ts b/src/main/providers/local-pty-foreground-inspection.ts
index 1eb4876cfd0c..8c3b0a6dccef 100644
--- a/src/main/providers/local-pty-foreground-inspection.ts
+++ b/src/main/providers/local-pty-foreground-inspection.ts
@@ -1,13 +1,22 @@
 import type { PtyChildProcessVerdict } from '../../shared/terminal-process-inspection'
 import { recognizeAgentProcessFromCommandLine } from '../../shared/agent-process-recognition'
 import { getCheapProcessTableSnapshot } from '../../shared/cheap-process-table-snapshot-reader'
-import { getProcessTableSnapshot } from '../../shared/process-table-snapshot-reader'
 import {
-  confirmShellForegroundProcess,
-  resolveAgentForegroundProcessWithAvailability
-} from './agent-foreground-process'
+  getProcessTableSnapshot,
+  getStrictProcessTableSnapshotWithAge
+} from '../../shared/process-table-snapshot-reader'
+import { confirmShellForegroundProcess } from './agent-foreground-process'
+import {
+  createPtyForegroundResolver,
+  ptyProcessNameIsSpawnFile
+} from '../daemon/pty-subprocess/spawn-file-foreground-process'
+import {
+  inspectSpawnFileChildProcessesFromRows,
+  inspectSpawnFileWindowsChildProcesses
+} from '../daemon/pty-subprocess/spawn-file-child-processes'
 import { buildPaneProcessFingerprint } from './posix-pane-foreground-fingerprint'
 import { isRetiredPtyMaster } from '../pty/node-pty-master-fd-retirement'
+import { ptyShellProcessId } from '../windows/windows-pty-job'
 import { resolveForegroundFallbackProcess } from './local-pty-launch-helpers'
 import {
   ptyAgentForegroundContextPaths,
@@ -29,7 +38,7 @@ import { isWindowsPtyJobReadable, readWindowsPtyJobProcessIds } from './windows-
  * equals the recorded shell and would otherwise read as a real "nothing is running here". Ask the
  * descriptor before the name, because an unreadable PTY is not evidence that its children exited.
  */
-export function inspectLocalPtyChildProcesses(id: string): PtyChildProcessVerdict {
+export async function inspectLocalPtyChildProcesses(id: string): Promise<PtyChildProcessVerdict> {
   const proc = ptyProcesses.get(id)
   if (!proc) {
     return 'no-children'
@@ -38,6 +47,19 @@ export function inspectLocalPtyChildProcesses(id: string): PtyChildProcessVerdic
     return 'unverifiable'
   }
   try {
+    if (ptyProcessNameIsSpawnFile(proc)) {
+      if (process.platform === 'win32') {
+        return inspectSpawnFileWindowsChildProcesses(proc)
+      }
+      const snapshot = await getStrictProcessTableSnapshotWithAge()
+      return ptyProcesses.get(id) === proc
+        ? inspectSpawnFileChildProcessesFromRows(
+            snapshot.rows,
+            proc.pid,
+            getPtyShellName(id) ?? null
+          )
+        : 'unverifiable'
+    }
     const foreground = proc.process
     const shell = getPtyShellName(id)
     if (!shell) {
@@ -51,7 +73,7 @@ export function inspectLocalPtyChildProcesses(id: string): PtyChildProcessVerdic
 }
 
 export async function hasLocalPtyChildProcesses(id: string): Promise<boolean> {
-  return inspectLocalPtyChildProcesses(id) === 'children'
+  return (await inspectLocalPtyChildProcesses(id)) !== 'no-children'
 }
 
 /**
@@ -89,7 +111,7 @@ export async function getLocalPtyForegroundProcess(id: string): Promise<string |
     return null
   }
   const fallbackProcess = resolveForegroundFallbackProcess(
-    proc.process || null,
+    ptyProcessNameIsSpawnFile(proc) ? (getPtyShellName(id) ?? null) : proc.process || null,
     getPtyShellName(id)
   )
   const cachedEntry = ptyLastRecognizedForeground.get(id)
@@ -112,7 +134,7 @@ export async function getLocalPtyForegroundProcess(id: string): Promise<string |
       const verdict = judgeCachedAgentJobEvidence({
         jobProcessIds: paneProcessIds,
         jobSupported: isWindowsPtyJobReadable(),
-        shellPid: proc.pid,
+        shellPid: ptyShellProcessId(proc) ?? proc.pid,
         anchorProcessId: cachedEntry?.pid ?? null,
         identityAgeMs: Date.now() - (cachedEntry?.at ?? 0)
       })
@@ -149,16 +171,12 @@ export async function getLocalPtyForegroundProcess(id: string): Promise<string |
     return cachedAgent
   }
   try {
-    const resolution = await resolveAgentForegroundProcessWithAvailability(
-      proc.pid,
-      fallbackProcess,
-      {
-        contextPaths: ptyAgentForegroundContextPaths.get(id),
-        ...(cachedEntry?.pid != null
-          ? { anchorProcessId: cachedEntry.pid, anchorProcessName: cachedEntry.name }
-          : {})
-      }
-    )
+    const resolution = await createPtyForegroundResolver(proc)(proc.pid, fallbackProcess, {
+      contextPaths: ptyAgentForegroundContextPaths.get(id),
+      ...(cachedEntry?.pid != null
+        ? { anchorProcessId: cachedEntry.pid, anchorProcessName: cachedEntry.name }
+        : {})
+    })
     // Why: the scan can outlive PTY teardown/id reuse; stale results must not resurrect cache for a foreign id.
     if (ptyProcesses.get(id) !== proc) {
       return null
@@ -181,6 +199,10 @@ export async function getLocalPtyForegroundProcess(id: string): Promise<string |
         : resolution
     const stable = resolveStableForegroundProcess(stableResolution, lastRecognizedAgent)
     if (stable.lastRecognizedAgent && stableResolution.available) {
+      const steady = await readPosixSteadyState(proc.pid, fallbackProcess)
+      if (ptyProcesses.get(id) !== proc) {
+        return null
+      }
       // Only a positive recognition restarts the age bound.
       ptyLastRecognizedForeground.set(id, {
         name: stable.lastRecognizedAgent,
@@ -189,7 +211,7 @@ export async function getLocalPtyForegroundProcess(id: string): Promise<string |
             ? (resolution.processId ?? null)
             : null,
         at: Date.now(),
-        steady: await readPosixSteadyState(proc.pid, fallbackProcess)
+        steady
       })
     } else if (stable.lastRecognizedAgent && cachedAgentAliveInJob && !anchorContradicted) {
       // The anchor pid in the job is proof of life; restamp so the
@@ -234,9 +256,12 @@ export async function confirmLocalPtyForegroundProcess(id: string): Promise<stri
     return null
   }
   try {
-    const resolution = await resolveAgentForegroundProcessWithAvailability(
+    const resolution = await createPtyForegroundResolver(proc)(
       proc.pid,
-      resolveForegroundFallbackProcess(proc.process || null, getPtyShellName(id)),
+      resolveForegroundFallbackProcess(
+        ptyProcessNameIsSpawnFile(proc) ? (getPtyShellName(id) ?? null) : proc.process || null,
+        getPtyShellName(id)
+      ),
       {
         contextPaths: ptyAgentForegroundContextPaths.get(id),
         fresh: true,
@@ -265,7 +290,7 @@ export async function confirmLocalPtyShellForeground(id: string): Promise<boolea
     return false
   }
   const confirmed = await confirmShellForegroundProcess(
-    proc.pid,
+    ptyShellProcessId(proc),
     ptyShellPath.get(id),
     process.platform === 'win32'
       ? { readWindowsPtyJobProcessIds: () => readWindowsPtyJobProcessIds(proc) }
diff --git a/src/main/providers/local-pty-launch-plan.ts b/src/main/providers/local-pty-launch-plan.ts
index c8b784e7cb35..17351325300d 100644
--- a/src/main/providers/local-pty-launch-plan.ts
+++ b/src/main/providers/local-pty-launch-plan.ts
@@ -1,4 +1,5 @@
 import { win32 as pathWin32 } from 'node:path'
+import { canUseBunPty } from '../daemon/pty-subprocess/bun-pty-process-capabilities'
 import { recognizeAgentProcessFromCommandLine } from '../../shared/agent-process-recognition'
 import { WINDOWS_GIT_BASH_SHELL } from '../../shared/windows-terminal-shell'
 import { resolveWindowsGitBashShellPath } from '../git-bash'
@@ -76,7 +77,9 @@ function finalizeLocalPtyLaunchPlan(
     windowsFallbackAttempts?: ReturnType<typeof buildWindowsPowerShellSpawnAttempts>
   }
 ): LocalPtyLaunchPlan {
-  ensureNodePtySpawnHelperExecutable()
+  if (!canUseBunPty()) {
+    ensureNodePtySpawnHelperExecutable()
+  }
   if (seed.args.prevalidatedCwd !== shell.validationCwd) {
     validateWorkingDirectory(shell.validationCwd)
   }
diff --git a/src/main/providers/local-pty-pending-native-spawn.test.ts b/src/main/providers/local-pty-pending-native-spawn.test.ts
new file mode 100644
index 000000000000..7f292e41273a
--- /dev/null
+++ b/src/main/providers/local-pty-pending-native-spawn.test.ts
@@ -0,0 +1,147 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { spawnLocalPty } from './local-pty-spawn'
+import { cancelPendingLocalPtySpawns } from './local-pty-spawn-state'
+import { pendingLocalPtySpawns, ptyProcesses } from './local-pty-provider-state'
+
+const { spawn, activate, destroy } = vi.hoisted(() => ({
+  spawn: vi.fn(),
+  activate: vi.fn(),
+  destroy: vi.fn()
+}))
+vi.mock('./local-pty-runtime-spawn', () => ({ loadLocalPtyRuntimeSpawn: async () => spawn }))
+vi.mock('./macos-tcc-login-shell', () => ({ prepareMacosTccLoginShell: async () => {} }))
+vi.mock('./local-pty-finalize-environment', () => ({
+  finalizeLocalPtySpawnEnvironment: () => null
+}))
+vi.mock('./local-pty-spawn-environment', () => ({
+  buildLocalPtySpawnEnvironment: () => ({}),
+  enforceLocalPtySpawnEnvironmentOverrides() {}
+}))
+vi.mock('./local-pty-launch-plan', () => ({
+  DeferredLocalPtyLaunchPlan: class {},
+  createLocalPtyLaunchPlan: () => ({
+    shellPath: '/bin/sh',
+    shellArgs: [],
+    effectiveCwd: '/tmp',
+    cwd: '/tmp',
+    windowsFallbackAttempts: []
+  })
+}))
+vi.mock('./local-pty-session-activation', () => ({ activateLocalPtySession: activate }))
+vi.mock('./local-pty-termination', () => ({ destroyPtyProcess: destroy }))
+
+function createProcess() {
+  return {
+    pid: 12345,
+    process: '/bin/sh',
+    cols: 80,
+    rows: 24,
+    handleFlowControl: false,
+    onData: () => ({ dispose() {} }),
+    onExit: () => ({ dispose() {} }),
+    write() {},
+    clear() {},
+    pause() {},
+    resume() {},
+    resize: vi.fn(),
+    kill: vi.fn()
+  }
+}
+
+function start(id = 'pending-bun-shell') {
+  return spawnLocalPty({ sessionId: id, cols: 80, rows: 24 }, () => ({}))
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  activate.mockImplementation(({ id, proc }) => {
+    ptyProcesses.set(id, proc)
+    return { id, pid: proc.pid }
+  })
+})
+afterEach(() => {
+  ptyProcesses.clear()
+  expect(pendingLocalPtySpawns.size).toBe(0)
+})
+
+describe('local PTY native spawn admission', () => {
+  it('aborts a pending receipt when the requesting client disconnects', async () => {
+    const controller = new AbortController()
+    spawn.mockImplementationOnce(
+      ({ signal }: { signal: AbortSignal }) =>
+        new Promise((_resolve, reject) => {
+          signal.addEventListener('abort', () => reject(signal.reason), { once: true })
+        })
+    )
+    const result = spawnLocalPty(
+      { sessionId: 'disconnected-shell', cols: 80, rows: 24, signal: controller.signal },
+      () => ({})
+    )
+    const rejected = expect(result).rejects.toThrow('client disconnected')
+    await vi.waitFor(() => expect(spawn).toHaveBeenCalledOnce())
+    controller.abort(new Error('client disconnected'))
+    await rejected
+    expect(activate).not.toHaveBeenCalled()
+  })
+
+  it('reserves the same session until a delayed shell receipt is activated', async () => {
+    const proc = createProcess()
+    let release!: () => void
+    spawn.mockImplementationOnce(
+      () =>
+        new Promise((resolve) => {
+          release = () => resolve({ process: proc, shellPath: '/bin/sh' })
+        })
+    )
+    const first = start()
+    await vi.waitFor(() => expect(spawn).toHaveBeenCalledOnce())
+    const second = start()
+    await new Promise((resolve) => setImmediate(resolve))
+    expect(spawn).toHaveBeenCalledOnce()
+    release()
+    expect(await first).toEqual({ id: 'pending-bun-shell', pid: proc.pid })
+    expect(await second).toMatchObject({ id: 'pending-bun-shell', pid: proc.pid, isReattach: true })
+    expect(activate).toHaveBeenCalledOnce()
+    expect(spawn).toHaveBeenCalledOnce()
+  })
+
+  it('aborts a pending receipt on shutdown and cancels queued same-session launches', async () => {
+    spawn.mockImplementationOnce(
+      ({ signal }: { signal: AbortSignal }) =>
+        new Promise((_resolve, reject) => {
+          signal.addEventListener('abort', () => reject(signal.reason), { once: true })
+        })
+    )
+    const first = start()
+    await vi.waitFor(() => expect(spawn).toHaveBeenCalledOnce())
+    const second = start()
+    const results = Promise.allSettled([first, second])
+    cancelPendingLocalPtySpawns('pending-bun-shell')
+    expect(await results).toEqual([
+      { status: 'rejected', reason: new Error('PTY spawn canceled: pending-bun-shell') },
+      { status: 'rejected', reason: new Error('PTY spawn canceled: pending-bun-shell') }
+    ])
+    expect(spawn).toHaveBeenCalledOnce()
+    expect(activate).not.toHaveBeenCalled()
+  })
+
+  it('cleans a confirmed process when shutdown races the receipt continuation', async () => {
+    const proc = createProcess()
+    let release!: () => void
+    spawn.mockImplementationOnce(
+      () =>
+        new Promise((resolve) => {
+          release = () => resolve({ process: proc, shellPath: '/bin/sh' })
+        })
+    )
+    const first = start()
+    const rejected = expect(first).rejects.toThrow('PTY spawn canceled: pending-bun-shell')
+    await vi.waitFor(() => expect(spawn).toHaveBeenCalledOnce())
+    release()
+    cancelPendingLocalPtySpawns('pending-bun-shell')
+    await rejected
+    expect(proc.kill).toHaveBeenCalledWith('SIGKILL')
+    expect(destroy).toHaveBeenCalledWith(proc)
+    expect(activate).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/main/providers/local-pty-provider-spawn-session.test.ts b/src/main/providers/local-pty-provider-spawn-session.test.ts
index 9dfa08d81bf5..cf523a469fca 100644
--- a/src/main/providers/local-pty-provider-spawn-session.test.ts
+++ b/src/main/providers/local-pty-provider-spawn-session.test.ts
@@ -53,6 +53,10 @@ vi.mock('node-pty', () => ({
   spawn: spawnMock
 }))
 
+vi.mock('../daemon/pty-subprocess/bun-pty-process-capabilities', () => ({
+  canUseBunPty: () => false
+}))
+
 vi.mock('./macos-tcc-login-shell', async (importOriginal) => ({
   ...(await importOriginal<typeof MacosTccLoginShell>()),
   prepareMacosTccLoginShell: prepareMacosTccLoginShellMock
@@ -115,6 +119,13 @@ vi.mock('../shell-prompt-readiness-probe', () => ({
 }))
 
 import { LocalPtyProvider } from './local-pty-provider'
+import {
+  pendingLocalPtySpawns,
+  ptyDisposables,
+  ptyExitDisposables,
+  ptyPhysicalExits,
+  startupIngressByPty
+} from './local-pty-provider-state'
 import {
   applyLocalPtyProviderMockDefaults,
   createLocalPtyMockProcess,
@@ -164,6 +175,42 @@ describe('LocalPtyProvider', () => {
       expect(typeof result.id).toBe('string')
     })
 
+    it('retires buffered output and synchronous Bun exit before replying to spawn', async () => {
+      const disposeData = vi.fn()
+      const disposeExit = vi.fn()
+      const onExit = vi.fn()
+      provider.configure({ onExit })
+      mockProc.onData.mockImplementation((listener: (data: string) => void) => {
+        listener('last output')
+        return { dispose: disposeData }
+      })
+      mockProc.onExit.mockImplementation((listener: (event: { exitCode: number }) => void) => {
+        listener({ exitCode: 17 })
+        return { dispose: disposeExit }
+      })
+      const result = await provider.spawn({
+        cols: 80,
+        rows: 24,
+        sessionId: 'already-exited-bun-shell',
+        command: 'must-not-run'
+      })
+      expect(result.exitedBeforeSpawnReply).toBe(true)
+      expect(provider.getPtyProcess(result.id)).toBeUndefined()
+      for (const map of [
+        ptyDisposables,
+        ptyExitDisposables,
+        ptyPhysicalExits,
+        startupIngressByPty
+      ]) {
+        expect(map.has(result.id)).toBe(false)
+      }
+      expect(disposeData).toHaveBeenCalledOnce()
+      expect(disposeExit).toHaveBeenCalledOnce()
+      expect(onExit).toHaveBeenCalledOnce()
+      await Promise.resolve()
+      expect(mockProc.write).not.toHaveBeenCalled()
+    })
+
     it('reattaches to an existing caller-supplied session id without spawning', async () => {
       const first = await provider.spawn({ cols: 80, rows: 24, sessionId: 'serve-session-1' })
       spawnMock.mockClear()
@@ -363,41 +410,154 @@ describe('LocalPtyProvider', () => {
       expect(spawnMock).not.toHaveBeenCalled()
     })
 
-    it('registers post-build preflight before a nested-microtask shutdown', async () => {
-      spawnMock.mockClear()
-      let finishEnvBuild!: () => void
-      const envProvider = new LocalPtyProvider({
-        buildSpawnEnv: (_id, baseEnv) =>
-          new Promise<Record<string, string>>((resolve) => {
-            finishEnvBuild = () => resolve(baseEnv)
-          })
-      })
-      const spawn = envProvider.spawn({
-        cols: 80,
-        rows: 24,
-        sessionId: 'resolved-env-build-session'
-      })
-      const canceledSpawn = expect(spawn).rejects.toThrow(
-        'PTY spawn canceled: resolved-env-build-session'
-      )
-      await vi.waitFor(() => expect(finishEnvBuild).toBeTypeOf('function'))
-
-      finishEnvBuild()
-      const shutdown = new Promise<void>((resolve, reject) => {
-        queueMicrotask(() => {
-          queueMicrotask(() => {
+    it.each([1, 2])(
+      'keeps cancellation registered across %i environment-resume microtasks',
+      async (microtasks) => {
+        spawnMock.mockClear()
+        let finishEnvBuild!: () => void
+        const envProvider = new LocalPtyProvider({
+          buildSpawnEnv: (_id, baseEnv) =>
+            new Promise<Record<string, string>>((resolve) => {
+              finishEnvBuild = () => resolve(baseEnv)
+            })
+        })
+        const spawn = envProvider.spawn({
+          cols: 80,
+          rows: 24,
+          sessionId: 'resolved-env-build-session'
+        })
+        const canceledSpawn = expect(spawn).rejects.toThrow(
+          'PTY spawn canceled: resolved-env-build-session'
+        )
+        await vi.waitFor(() => expect(finishEnvBuild).toBeTypeOf('function'))
+
+        finishEnvBuild()
+        const shutdown = new Promise<void>((resolve, reject) => {
+          const shutdown = () => {
             envProvider
               .shutdown('resolved-env-build-session', { immediate: true })
               .then(resolve, reject)
+          }
+          queueMicrotask(() => (microtasks === 1 ? shutdown() : queueMicrotask(shutdown)))
+        })
+
+        await shutdown
+        await canceledSpawn
+        expect(spawnMock).not.toHaveBeenCalled()
+      }
+    )
+
+    it.each([1, 2])(
+      'settles final-preflight shutdown without a late PTY (%i microtasks)',
+      async (microtasks) => {
+        spawnMock.mockClear()
+        let finishPreparation!: () => void
+        prepareMacosTccLoginShellMock.mockImplementationOnce(
+          () =>
+            new Promise<void>((resolve) => {
+              finishPreparation = resolve
+            })
+        )
+        const id = 'preflight-resume-session'
+        const kill = mockProc.kill
+        let committed = false
+        const outcome = provider
+          .spawn({
+            cols: 80,
+            rows: 24,
+            sessionId: id,
+            onPtySpawnCommitted: () => {
+              committed = true
+            }
           })
+          .then(
+            (result) => ({ ok: true as const, result }),
+            (error: unknown) => ({ ok: false as const, error })
+          )
+        await import('node-pty')
+        await vi.waitFor(() => expect(finishPreparation).toBeTypeOf('function'))
+        finishPreparation()
+        let committedAtShutdown = false
+        await new Promise<void>((resolve, reject) => {
+          const shutdown = () => {
+            committedAtShutdown = committed
+            provider.shutdown(id, { immediate: true }).then(resolve, reject)
+          }
+          queueMicrotask(() => (microtasks === 1 ? shutdown() : queueMicrotask(shutdown)))
         })
-      })
+        const settled = await outcome
+        if (committedAtShutdown) {
+          expect(settled.ok).toBe(true)
+          expect(kill).toHaveBeenCalled()
+        } else {
+          expect(settled).toEqual({ ok: false, error: new Error(`PTY spawn canceled: ${id}`) })
+          expect(spawnMock.mock.calls.length).toBe(0)
+        }
+        expect(provider.getPtyProcess(id)).toBeUndefined()
+        expect(pendingLocalPtySpawns.has(id)).toBe(false)
+      }
+    )
 
-      await shutdown
-      await canceledSpawn
-      expect(spawnMock).not.toHaveBeenCalled()
+    it('cancels deferred shell availability before finalizing a launch plan', async () => {
+      spawnMock.mockClear()
+      Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' })
+      let finishAvailability!: (available: boolean) => void
+      const buildSpawnEnv = vi.fn((_id: string, env: Record<string, string>) => env)
+      provider.configure({
+        getWindowsShell: () => 'powershell.exe',
+        getWindowsPowerShellImplementation: () => 'auto',
+        pwshAvailable: () =>
+          new Promise<boolean>((resolve) => {
+            finishAvailability = resolve
+          }),
+        buildSpawnEnv
+      })
+      const id = 'deferred-availability-session'
+      const spawn = provider.spawn({ cols: 80, rows: 24, sessionId: id })
+      const rejected = expect(spawn).rejects.toThrow(`PTY spawn canceled: ${id}`)
+      await provider.shutdown(id, { immediate: true })
+      finishAvailability(true)
+      await rejected
+      expect(buildSpawnEnv).not.toHaveBeenCalled()
+      expect(spawnMock.mock.calls.length).toBe(0)
+      expect(pendingLocalPtySpawns.has(id)).toBe(false)
     })
 
+    it.each(['synchronous environment', 'async environment', 'preflight'])(
+      'releases cancellation state after failed %s and allows a fresh retry',
+      async (phase) => {
+        spawnMock.mockClear()
+        const id = 'failed-preparation-session'
+        let fail = true
+        provider.configure({
+          buildSpawnEnv: (_id, env) => {
+            if (fail && phase === 'synchronous environment') {
+              throw new Error('preparation failed')
+            }
+            if (fail && phase === 'async environment') {
+              return Promise.reject(new Error('preparation failed'))
+            }
+            return env
+          }
+        })
+        if (phase === 'preflight') {
+          prepareMacosTccLoginShellMock.mockRejectedValueOnce(new Error('preparation failed'))
+        }
+        await expect(provider.spawn({ cols: 80, rows: 24, sessionId: id })).rejects.toThrow(
+          'preparation failed'
+        )
+        expect(pendingLocalPtySpawns.has(id)).toBe(false)
+        expect(spawnMock.mock.calls.length).toBe(0)
+        await provider.shutdown(id, { immediate: true })
+        fail = false
+        await expect(provider.spawn({ cols: 80, rows: 24, sessionId: id })).resolves.toMatchObject({
+          id
+        })
+        expect(spawnMock.mock.calls.length).toBe(1)
+        expect(pendingLocalPtySpawns.has(id)).toBe(false)
+      }
+    )
+
     it('coalesces a concurrent same-session-id spawn before launching a redundant shell (F3)', async () => {
       spawnMock.mockClear()
       const procA = { ...mockProc, pid: 1001 }
diff --git a/src/main/providers/local-pty-provider-state.ts b/src/main/providers/local-pty-provider-state.ts
index d38175c0d2bd..10cef331a620 100644
--- a/src/main/providers/local-pty-provider-state.ts
+++ b/src/main/providers/local-pty-provider-state.ts
@@ -12,7 +12,7 @@ export type PtyShutdownOperation = {
 }
 
 export type PendingLocalPtySpawn = {
-  canceled: boolean
+  cancellation: AbortController
 }
 
 export type DataCallback = (payload: {
diff --git a/src/main/providers/local-pty-provider.ts b/src/main/providers/local-pty-provider.ts
index 8dad9843ab6d..a8e2f9ce6094 100644
--- a/src/main/providers/local-pty-provider.ts
+++ b/src/main/providers/local-pty-provider.ts
@@ -132,20 +132,18 @@ export class LocalPtyProvider implements IPtyProvider {
   async inspectProcess(id: string): Promise<PtyProcessInspection> {
     const proc = ptyProcesses.get(id)
     const foregroundProcess = await getLocalPtyForegroundProcess(id)
-    // Both fields have to describe one PTY: cleanup plus reactivation across the await above would
-    // otherwise pair the old pane's identity with the replacement's children. The child read below
-    // is synchronous, so this recheck is the last point either answer can drift.
+    const childProcessEvidence = await inspectLocalPtyChildProcesses(id)
+    // Neither asynchronous inspection may publish a replacement pane's identity.
     if (ptyProcesses.get(id) !== proc) {
       return {
         foregroundProcess: null,
-        hasChildProcesses: false,
+        hasChildProcesses: true,
         childProcessEvidence: 'unverifiable'
       }
     }
-    const childProcessEvidence = inspectLocalPtyChildProcesses(id)
     return {
       foregroundProcess,
-      hasChildProcesses: childProcessEvidence === 'children',
+      hasChildProcesses: childProcessEvidence !== 'no-children',
       childProcessEvidence
     }
   }
diff --git a/src/main/providers/local-pty-runtime-spawn.ts b/src/main/providers/local-pty-runtime-spawn.ts
new file mode 100644
index 000000000000..7d3c26d90ade
--- /dev/null
+++ b/src/main/providers/local-pty-runtime-spawn.ts
@@ -0,0 +1,44 @@
+import { canUseBunPty, spawnBunPty } from '../daemon/pty-subprocess/bun-pty-process'
+import { spawnNativeDaemonPty } from '../daemon/pty-subprocess/native-pty-spawn'
+import {
+  spawnShellWithFallback,
+  type ShellSpawnParams,
+  type ShellSpawnResult
+} from './local-pty-utils'
+
+type LocalPtySpawn = (
+  params: Omit<ShellSpawnParams, 'ptySpawn'> & { signal?: AbortSignal }
+) => ShellSpawnResult | Promise<ShellSpawnResult>
+
+/** Degraded daemon routing uses the same runtime as the packaged host. */
+export async function loadLocalPtyRuntimeSpawn(): Promise<LocalPtySpawn> {
+  if (!canUseBunPty()) {
+    const pty = await import('node-pty')
+    return (params) => spawnShellWithFallback({ ...params, ptySpawn: pty.spawn })
+  }
+  if (process.platform === 'win32') {
+    return (params) =>
+      spawnNativeDaemonPty({
+        ...params,
+        spawnCwd: params.cwd,
+        windowsFallbackAttempts: params.windowsFallbackAttempts ?? []
+      })
+  }
+  return (params) =>
+    spawnShellWithFallback({
+      ...params,
+      ptySpawn(file, args = [], options = {}) {
+        if (!Array.isArray(args)) {
+          throw new Error('POSIX PTY arguments must be an array')
+        }
+        return spawnBunPty({
+          file,
+          args,
+          cwd: options.cwd ?? params.cwd,
+          env: params.env,
+          cols: options.cols ?? params.cols,
+          rows: options.rows ?? params.rows
+        })
+      }
+    })
+}
diff --git a/src/main/providers/local-pty-session-activation.ts b/src/main/providers/local-pty-session-activation.ts
index 71c633483dbf..e89f0c433162 100644
--- a/src/main/providers/local-pty-session-activation.ts
+++ b/src/main/providers/local-pty-session-activation.ts
@@ -122,8 +122,11 @@ export function activateLocalPtySession(args: {
   if (onDataDisposable) {
     disposables.push(onDataDisposable)
   }
+  ptyDisposables.set(id, disposables)
 
+  let exitedBeforeSpawnReply = false
   const onExitDisposable = proc.onExit(({ exitCode, signal }) => {
+    exitedBeforeSpawnReply = true
     // Why: node-pty reports a signalled death as {exitCode: 0, signal: N}; the
     // cause is built here, where the signal and the spawn's trustworthiness
     // are both still in hand.
@@ -151,14 +154,18 @@ export function activateLocalPtySession(args: {
     }
   })
   if (onExitDisposable) {
-    ptyExitDisposables.set(id, onExitDisposable)
+    if (exitedBeforeSpawnReply) {
+      onExitDisposable.dispose()
+    } else {
+      ptyExitDisposables.set(id, onExitDisposable)
+    }
   }
-  ptyDisposables.set(id, disposables)
 
   const startupCommandDeliveredByWrapper =
     spawn.command !== undefined &&
     plan.shellReadyLaunch?.env[POSIX_SHELL_STARTUP_COMMAND_ENV] === spawn.command
   if (
+    !exitedBeforeSpawnReply &&
     spawn.command &&
     !plan.startupCommandDeliveredInShellArgs &&
     !startupCommandDeliveredByWrapper
@@ -191,6 +198,7 @@ export function activateLocalPtySession(args: {
     id,
     incarnationId,
     pid,
+    ...(exitedBeforeSpawnReply ? { exitedBeforeSpawnReply: true } : {}),
     ...(spawnedWslDistro !== undefined ? { wslDistro: spawnedWslDistro } : {})
   }
 }
diff --git a/src/main/providers/local-pty-session-operations.ts b/src/main/providers/local-pty-session-operations.ts
index 37e770812068..27a151580ce8 100644
--- a/src/main/providers/local-pty-session-operations.ts
+++ b/src/main/providers/local-pty-session-operations.ts
@@ -3,6 +3,7 @@ import { basename } from 'node:path'
 import type * as pty from 'node-pty'
 import { readPtsName } from '../pty/node-pty-pts-name'
 import { signalPosixPtyForegroundGroup } from '../pty/posix-pty-foreground-group'
+import { ptyShellProcessId } from '../windows/windows-pty-job'
 import { isWslAvailableAsync } from '../wsl'
 import { resolveGitBashPath } from '../git-bash'
 import { resolveProcessCwd } from './process-cwd'
@@ -74,6 +75,10 @@ export async function sendLocalPtySignal(id: string, signal: string): Promise<vo
   if (!proc) {
     return
   }
+  if ('signalProcess' in proc && typeof proc.signalProcess === 'function') {
+    proc.signalProcess(signal)
+    return
+  }
   const signalRootPid = (): void => {
     try {
       process.kill(proc.pid, signal)
@@ -97,7 +102,8 @@ export async function getLocalPtyCwd(id: string): Promise<string> {
     return ''
   }
   // Why: let resolveProcessCwd's '' surface for the renderer fallback chain; a fabricated cwd would short-circuit it.
-  return resolveProcessCwd(proc.pid)
+  const shellPid = ptyShellProcessId(proc)
+  return shellPid === undefined ? '' : resolveProcessCwd(shellPid)
 }
 
 export async function clearLocalPtyBuffer(id: string): Promise<void> {
diff --git a/src/main/providers/local-pty-shell-ready-bash-rcfile.ts b/src/main/providers/local-pty-shell-ready-bash-rcfile.ts
index f752b75f67a7..877fdda3bcc8 100644
--- a/src/main/providers/local-pty-shell-ready-bash-rcfile.ts
+++ b/src/main/providers/local-pty-shell-ready-bash-rcfile.ts
@@ -5,6 +5,7 @@
  * startup-file chain, OSC 133 hooks, and the shell-ready marker all live here.
  */
 import { BASH_PROMPT_COMMAND_COMPOSITION_BLOCK } from '../bash-prompt-command-composition'
+import { WSL_MANAGED_CLI_PATH_RESTORE } from '../wsl-managed-cli-path-restore'
 import { getPosixOmpShellWrapper } from '../pty/omp-shell-wrapper'
 import { getPosixCodexShellLaunchPreflight } from '../pty/codex-shell-launch-preflight'
 import { getBashStartupCommandPromptBlock } from '../pty/posix-shell-startup-command'
@@ -45,6 +46,7 @@ __orca_restore_agent_teams_path() {
   export PATH="\${ORCA_AGENT_TEAMS_SHIM_DIR}:$PATH"
 }
 __orca_restore_agent_teams_path
+${WSL_MANAGED_CLI_PATH_RESTORE}
 # Why: user startup files may set the default OpenCode config after Orca's
 # spawn env; restore the Orca-managed config dir before the first prompt.
 [[ -n "\${ORCA_OPENCODE_CONFIG_DIR:-}" ]] && export OPENCODE_CONFIG_DIR="\${ORCA_OPENCODE_CONFIG_DIR}"
diff --git a/src/main/providers/local-pty-shell-ready-wrapper-fileset.ts b/src/main/providers/local-pty-shell-ready-wrapper-fileset.ts
index f0e3f792fc02..47fb521afcbc 100644
--- a/src/main/providers/local-pty-shell-ready-wrapper-fileset.ts
+++ b/src/main/providers/local-pty-shell-ready-wrapper-fileset.ts
@@ -24,6 +24,7 @@ export function getLocalZshWrapperSpec(): ZshStartupHookSpec {
     overlayRestoreComment:
       "# Why: ~/.zshrc can export the user's default OpenCode config after spawn.",
     restores: {
+      managedWslCli: true,
       agentTeamsPath: true,
       remoteCliBinDir: false,
       codexHome: true,
diff --git a/src/main/providers/local-pty-spawn-environment.ts b/src/main/providers/local-pty-spawn-environment.ts
index 8290baa3dc39..645fcacb2d0d 100644
--- a/src/main/providers/local-pty-spawn-environment.ts
+++ b/src/main/providers/local-pty-spawn-environment.ts
@@ -8,10 +8,10 @@ import { stripInheritedBuildModeEnv } from '../pty/build-mode-env'
 import { stripPiProcessOwnerEnv } from '../pty/pi-process-owner-env'
 import { removeInheritedNoColor } from '../pty/terminal-color-env'
 import { isWindowsGitBashShellPath } from '../git-bash'
+import { applyScrubSafeAgentEnvAliases } from '../../shared/agent-hook-scrub-safe-env'
 import { removeUnspecifiedPaneIdentityEnv } from './local-pty-launch-helpers'
 import type { LocalPtyLaunchPlan } from './local-pty-launch-plan'
 import type { LocalPtyProviderOptions } from './local-pty-provider-types'
-import { awaitCancelableLocalPtySpawn } from './local-pty-spawn-state'
 import type { PtySpawnOptions } from './types'
 
 /** Pane ownership must be fresh even when Orca itself was launched inside an agent. */
@@ -43,6 +43,8 @@ export function buildLocalPtySpawnEnvironment(args: {
   if (spawn.env?.TERM) {
     spawnEnv.TERM = spawn.env.TERM
   }
+  // Why after the strips and deletes: an alias must never outlive the value it mirrors.
+  applyScrubSafeAgentEnvAliases(spawnEnv)
 
   spawnEnv.LANG ??= 'en_US.UTF-8'
 
@@ -58,21 +60,16 @@ export function buildLocalPtySpawnEnvironment(args: {
   if (!getOptions().buildSpawnEnv) {
     return spawnEnv
   }
-  // Why (#16441): building the env now awaits Codex hook installs and trust
-  // grants, so shutdown must be able to cancel this session id here too.
-  return awaitCancelableLocalPtySpawn(
-    id,
-    getOptions().buildSpawnEnv!(id, spawnEnv, {
-      explicitEnv: spawn.env ?? {},
-      command: spawn.command,
-      launchAgent: spawn.launchAgent,
-      codexHomePathOverride: spawn.codexHomePathOverride,
-      cwd: plan.cwd,
-      shellPath: plan.shellPath,
-      isWsl: plan.isWslShell,
-      wslDistro: plan.launchWslDistro
-    })
-  )
+  return getOptions().buildSpawnEnv!(id, spawnEnv, {
+    explicitEnv: spawn.env ?? {},
+    command: spawn.command,
+    launchAgent: spawn.launchAgent,
+    codexHomePathOverride: spawn.codexHomePathOverride,
+    cwd: plan.cwd,
+    shellPath: plan.shellPath,
+    isWsl: plan.isWslShell,
+    wslDistro: plan.launchWslDistro
+  })
 }
 
 /** App-level env builders can reintroduce deleted keys; enforce isolation after they finish. */
diff --git a/src/main/providers/local-pty-spawn-state.ts b/src/main/providers/local-pty-spawn-state.ts
index 2ab145f6c398..d73d230f68b5 100644
--- a/src/main/providers/local-pty-spawn-state.ts
+++ b/src/main/providers/local-pty-spawn-state.ts
@@ -7,22 +7,34 @@ import {
   type PendingLocalPtySpawn
 } from './local-pty-provider-state'
 
-/** Awaits pre-launch work that shutdown must be able to cancel: no node-pty
- *  process exists yet, so cancellation can only be observed after the await. */
-export async function awaitCancelableLocalPtySpawn<T>(
+const spawnReservations = new Map<string, Promise<unknown>>()
+
+/** A Windows shell receipt can arrive after another request reaches the same native spawn. */
+export async function reserveLocalPtySpawn<T>(id: string, operation: () => Promise<T>): Promise<T> {
+  const previous = spawnReservations.get(id)
+  const pending = previous ? previous.catch(() => {}).then(operation) : operation()
+  spawnReservations.set(id, pending)
+  try {
+    return await pending
+  } finally {
+    if (spawnReservations.get(id) === pending) {
+      spawnReservations.delete(id)
+    }
+  }
+}
+
+/** Keep shutdown visible between awaits until the native process is registered. */
+export async function runCancelableLocalPtySpawn<T>(
   id: string,
-  operation: T | Promise<T>
+  operation: (throwIfCanceled: () => void, signal: AbortSignal) => Promise<T>
 ): Promise<T> {
-  const pendingSpawn: PendingLocalPtySpawn = { canceled: false }
+  const cancellation = new AbortController()
+  const pendingSpawn: PendingLocalPtySpawn = { cancellation }
   const pending = pendingLocalPtySpawns.get(id) ?? new Set()
   pending.add(pendingSpawn)
   pendingLocalPtySpawns.set(id, pending)
   try {
-    const result = await operation
-    if (pendingSpawn.canceled) {
-      throw new Error(`PTY spawn canceled: ${id}`)
-    }
-    return result
+    return await operation(() => cancellation.signal.throwIfAborted(), cancellation.signal)
   } finally {
     pending.delete(pendingSpawn)
     if (pending.size === 0) {
@@ -37,7 +49,7 @@ export function cancelPendingLocalPtySpawns(id: string): void {
     return
   }
   for (const pendingSpawn of pending) {
-    pendingSpawn.canceled = true
+    pendingSpawn.cancellation.abort(new Error(`PTY spawn canceled: ${id}`))
   }
 }
 
diff --git a/src/main/providers/local-pty-spawn.ts b/src/main/providers/local-pty-spawn.ts
index 19436a8c4059..cc3c39979a87 100644
--- a/src/main/providers/local-pty-spawn.ts
+++ b/src/main/providers/local-pty-spawn.ts
@@ -1,6 +1,5 @@
 import { randomUUID } from 'node:crypto'
 import { win32 as pathWin32 } from 'node:path'
-import * as pty from 'node-pty'
 import { SessionNotFoundError } from '../daemon/daemon-errors'
 import { prepareMacosTccLoginShell } from './macos-tcc-login-shell'
 import { finalizeLocalPtySpawnEnvironment } from './local-pty-finalize-environment'
@@ -13,9 +12,14 @@ import {
   buildLocalPtySpawnEnvironment,
   enforceLocalPtySpawnEnvironmentOverrides
 } from './local-pty-spawn-environment'
-import { awaitCancelableLocalPtySpawn, reattachLocalPty } from './local-pty-spawn-state'
-import { spawnShellWithFallback } from './local-pty-utils'
-import { updateHistoryEnvForFallback, type HistoryInjectionResult } from '../terminal-history'
+import {
+  runCancelableLocalPtySpawn,
+  reattachLocalPty,
+  reserveLocalPtySpawn
+} from './local-pty-spawn-state'
+import { loadLocalPtyRuntimeSpawn } from './local-pty-runtime-spawn'
+import { destroyPtyProcess } from './local-pty-termination'
+import { updateHistoryEnvForFallback } from '../terminal-history'
 import type { PtySpawnOptions, PtySpawnResult } from './types'
 
 export async function spawnLocalPty(
@@ -37,86 +41,108 @@ export async function spawnLocalPty(
     throw new SessionNotFoundError(args.sessionId ?? '')
   }
   const id = allocatePtyId(reattachId ?? undefined)
-  const incarnationId = randomUUID()
-  const planResult = createLocalPtyLaunchPlan(args, getOptions)
-  const plan =
-    planResult instanceof DeferredLocalPtyLaunchPlan
-      ? planResult.finish(await planResult.availability)
-      : planResult
-  const envResult = buildLocalPtySpawnEnvironment({
-    id,
-    spawn: args,
-    getOptions,
-    plan
-  })
-  const finalEnv = envResult instanceof Promise ? await envResult : envResult
-  enforceLocalPtySpawnEnvironmentOverrides(args, finalEnv)
-  const historyResult = finalizeLocalPtySpawnEnvironment({
-    spawn: args,
-    getOptions,
-    plan,
-    env: finalEnv
-  })
+  return runCancelableLocalPtySpawn(id, async (throwIfCanceled, cancellation) => {
+    const incarnationId = randomUUID()
+    let plan = createLocalPtyLaunchPlan(args, getOptions)
+    if (plan instanceof DeferredLocalPtyLaunchPlan) {
+      const available = await plan.availability
+      throwIfCanceled()
+      plan = plan.finish(available)
+    }
+    throwIfCanceled()
+    const envResult = buildLocalPtySpawnEnvironment({
+      id,
+      spawn: args,
+      getOptions,
+      plan
+    })
+    const finalEnv = envResult instanceof Promise ? await envResult : envResult
+    throwIfCanceled()
+    enforceLocalPtySpawnEnvironmentOverrides(args, finalEnv)
+    const historyResult = finalizeLocalPtySpawnEnvironment({
+      spawn: args,
+      getOptions,
+      plan,
+      env: finalEnv
+    })
 
-  // Why: the async macOS capability probe runs before node-pty exists.
-  await awaitCancelableLocalPtySpawn(id, prepareMacosTccLoginShell())
-  if (args.signal?.aborted) {
-    throw new Error('client_disconnected')
-  }
-  // Why: another same-id request can win while this one awaits preflight; attach before launching a redundant shell.
-  const concurrentWinner = reattachId ? reattachLocalPty(id, args.cols, args.rows) : null
-  if (concurrentWinner) {
-    return concurrentWinner
-  }
-  const spawnResult = spawnShellWithFallback({
-    shellPath: plan.shellPath,
-    shellArgs: plan.shellArgs,
-    cols: args.cols,
-    rows: args.rows,
-    cwd: plan.effectiveCwd,
-    env: finalEnv,
-    termName: finalEnv.TERM,
-    ptySpawn: pty.spawn,
-    getShellReadyConfig: plan.getFallbackShellReadyConfig,
-    launchEnvKeys: plan.primaryLaunchEnvKeys,
-    // Why: on zsh→bash fallback HISTFILE still points to zsh_history; update before spawn so the child inherits it (design doc §8).
-    onBeforeFallbackSpawn: historyResult?.historyDir
-      ? (env, fallbackShell) =>
-          updateHistoryEnvForFallback(env, fallbackShell, historyResult as HistoryInjectionResult)
-      : undefined,
-    windowsFallbackAttempts: plan.windowsFallbackAttempts
-  })
-  args.onPtySpawnCommitted?.()
-  plan.shellPath = spawnResult.shellPath
-  // Why: a Windows fallback embeds its startup command in argv; honor the winning shell's delivery flag to avoid a double write.
-  if (spawnResult.startupCommandDeliveredInShellArgs !== undefined) {
-    plan.startupCommandDeliveredInShellArgs = spawnResult.startupCommandDeliveredInShellArgs
-  }
-  if (args.command && plan.getFallbackShellReadyConfig) {
-    plan.shellReadyLaunch = plan.getFallbackShellReadyConfig(plan.shellPath)
-  }
+    const fallbackHistory = historyResult?.historyDir ? historyResult : undefined
+    const [spawn] = await Promise.all([loadLocalPtyRuntimeSpawn(), prepareMacosTccLoginShell()])
+    return reserveLocalPtySpawn(id, async () => {
+      const checkCanceled = (): void => {
+        throwIfCanceled()
+        if (args.signal?.aborted) {
+          throw new Error('client_disconnected')
+        }
+      }
+      checkCanceled()
+      // Why: another same-id request can win while this one awaits preflight; attach before launching a redundant shell.
+      const concurrentWinner = reattachId ? reattachLocalPty(id, args.cols, args.rows) : null
+      if (concurrentWinner) {
+        return concurrentWinner
+      }
+      const pendingSpawn = spawn({
+        shellPath: plan.shellPath,
+        shellArgs: plan.shellArgs,
+        cols: args.cols,
+        rows: args.rows,
+        cwd: plan.effectiveCwd,
+        env: finalEnv,
+        termName: finalEnv.TERM,
+        signal: args.signal ? AbortSignal.any([args.signal, cancellation]) : cancellation,
+        getShellReadyConfig: plan.getFallbackShellReadyConfig,
+        launchEnvKeys: plan.primaryLaunchEnvKeys,
+        // Why: on zsh→bash fallback HISTFILE still points to zsh_history; update before spawn so the child inherits it (design doc §8).
+        onBeforeFallbackSpawn: fallbackHistory
+          ? (env, fallbackShell) => updateHistoryEnvForFallback(env, fallbackShell, fallbackHistory)
+          : undefined,
+        windowsFallbackAttempts: plan.windowsFallbackAttempts
+      })
+      const spawnResult = pendingSpawn instanceof Promise ? await pendingSpawn : pendingSpawn
+      try {
+        checkCanceled()
+      } catch (error) {
+        try {
+          spawnResult.process.kill('SIGKILL')
+        } finally {
+          destroyPtyProcess(spawnResult.process)
+        }
+        throw error
+      }
+      args.onPtySpawnCommitted?.()
+      plan.shellPath = spawnResult.shellPath
+      // Why: a Windows fallback embeds its startup command in argv; honor the winning shell's delivery flag to avoid a double write.
+      if (spawnResult.startupCommandDeliveredInShellArgs !== undefined) {
+        plan.startupCommandDeliveredInShellArgs = spawnResult.startupCommandDeliveredInShellArgs
+      }
+      if (args.command && plan.getFallbackShellReadyConfig) {
+        plan.shellReadyLaunch = plan.getFallbackShellReadyConfig(plan.shellPath)
+      }
 
-  if (process.platform !== 'win32') {
-    finalEnv.SHELL = plan.shellPath
-  }
+      if (process.platform !== 'win32') {
+        finalEnv.SHELL = plan.shellPath
+      }
 
-  const proc = spawnResult.process
-  const spawnedShellIsWsl =
-    process.platform === 'win32' && pathWin32.basename(plan.shellPath).toLowerCase() === 'wsl.exe'
-  const spawnedWslDistro = spawnedShellIsWsl
-    ? (plan.launchWslDistro ?? undefined)
-    : process.platform === 'win32'
-      ? null
-      : undefined
-  return activateLocalPtySession({
-    id,
-    incarnationId,
-    spawn: args,
-    getOptions,
-    plan,
-    env: finalEnv,
-    proc,
-    reportsChildExitStatus: spawnResult.reportsChildExitStatus !== false,
-    spawnedWslDistro
+      const proc = spawnResult.process
+      const spawnedShellIsWsl =
+        process.platform === 'win32' &&
+        pathWin32.basename(plan.shellPath).toLowerCase() === 'wsl.exe'
+      const spawnedWslDistro = spawnedShellIsWsl
+        ? (plan.launchWslDistro ?? undefined)
+        : process.platform === 'win32'
+          ? null
+          : undefined
+      return activateLocalPtySession({
+        id,
+        incarnationId,
+        spawn: args,
+        getOptions,
+        plan,
+        env: finalEnv,
+        proc,
+        reportsChildExitStatus: spawnResult.reportsChildExitStatus !== false,
+        spawnedWslDistro
+      })
+    })
   })
 }
diff --git a/src/main/providers/local-pty-utils.ts b/src/main/providers/local-pty-utils.ts
index 735393449f25..8009260923dc 100644
--- a/src/main/providers/local-pty-utils.ts
+++ b/src/main/providers/local-pty-utils.ts
@@ -2,6 +2,7 @@ import { basename, isAbsolute, join } from 'node:path'
 import { existsSync, accessSync, statSync, chmodSync, constants as fsConstants } from 'node:fs'
 import type * as pty from 'node-pty'
 import { usesNodePtySpawnHelper } from '../../shared/node-pty-spawn-helper'
+import { TERMINAL_SPAWN_ISSUE_REQUEST } from '../../shared/terminal-spawn-error-copy'
 import {
   hostReportsChildExitStatus,
   wrapShellSpawnForMacosTccAttribution
@@ -307,7 +308,6 @@ export function spawnShellWithFallback(params: ShellSpawnParams): ShellSpawnResu
 
   const diag = formatLocalPtyEnvironmentDiag({ shell: shellPath, cwd })
   throw new Error(
-    `Failed to spawn shell "${shellPath}": ${primaryError ?? 'unknown error'} (${diag}). ` +
-      `If this persists, please file an issue.`
+    `Failed to spawn shell "${shellPath}": ${primaryError ?? 'unknown error'} (${diag}). ${TERMINAL_SPAWN_ISSUE_REQUEST}`
   )
 }
diff --git a/src/main/providers/ssh-git-noninteractive-provider.ts b/src/main/providers/ssh-git-noninteractive-provider.ts
index ee60b2541342..0550b1bba390 100644
--- a/src/main/providers/ssh-git-noninteractive-provider.ts
+++ b/src/main/providers/ssh-git-noninteractive-provider.ts
@@ -27,6 +27,7 @@ export class SshGitNoninteractiveProvider extends SshGitReadProvider {
         args: plan.args,
         cwd,
         stdin: plan.stdinPayload,
+        ...(plan.env ? { env: plan.env } : {}),
         timeoutMs,
         operation
       },
diff --git a/src/main/providers/ssh-git-provider-commit-message.test.ts b/src/main/providers/ssh-git-provider-commit-message.test.ts
index 41a5003946d5..be024b643c81 100644
--- a/src/main/providers/ssh-git-provider-commit-message.test.ts
+++ b/src/main/providers/ssh-git-provider-commit-message.test.ts
@@ -163,7 +163,8 @@ describe('SshGitProvider', () => {
         binary: 'codex',
         args: ['exec', 'PROMPT'],
         stdinPayload: null,
-        label: 'Codex'
+        label: 'Codex',
+        env: { FLAG: 'literal $HOME' }
       },
       '/home/user/repo',
       60_000
@@ -176,6 +177,7 @@ describe('SshGitProvider', () => {
         args: ['exec', 'PROMPT'],
         cwd: '/home/user/repo',
         stdin: null,
+        env: { FLAG: 'literal $HOME' },
         timeoutMs: 60_000,
         operation: 'commit-message'
       },
diff --git a/src/main/providers/ssh-pty-provider-agent-session-create-operation.test.ts b/src/main/providers/ssh-pty-provider-agent-session-create-operation.test.ts
index e088b21f0258..61b0293f25b4 100644
--- a/src/main/providers/ssh-pty-provider-agent-session-create-operation.test.ts
+++ b/src/main/providers/ssh-pty-provider-agent-session-create-operation.test.ts
@@ -57,18 +57,30 @@ function requestPayloads(transport: ReturnType<typeof createTransport>): Record<
   })
 }
 
+// Why a macrotask yield: FrameDecoder stops after FRAME_DECODER_MAX_TURN_MS of decoding and
+// resumes the rest of the fed bytes from setImmediate, and feed() refuses to drain while that
+// continuation is pending. Under load a delivered response can therefore only be decoded a
+// macrotask later, which a microtask-only poll can never reach. Matches waitForRequestCount in
+// ssh-git-provider-test-harness.
+async function waitForValue<T>(produce: () => T | undefined, what: string): Promise<T> {
+  for (let turn = 0; turn < 20; turn += 1) {
+    const value = produce()
+    if (value !== undefined) {
+      return value
+    }
+    await new Promise<void>((resolve) => setTimeout(resolve, 0))
+  }
+  throw new Error(`never observed: ${what}`)
+}
+
 async function waitForRequest(
   transport: ReturnType<typeof createTransport>,
   method: string
 ): Promise<Record<string, unknown>> {
-  for (let turn = 0; turn < 10; turn += 1) {
-    const request = requestPayloads(transport).find((payload) => payload.method === method)
-    if (request) {
-      return request
-    }
-    await Promise.resolve()
-  }
-  throw new Error(`request not dispatched: ${method}`)
+  return waitForValue(
+    () => requestPayloads(transport).find((payload) => payload.method === method),
+    `request ${method}`
+  )
 }
 
 describe('SSH fresh agent-session create operations', () => {
@@ -377,6 +389,8 @@ describe('SSH fresh agent-session create operations', () => {
       ])
     )
     await expect(replacement).resolves.toMatchObject({ incarnationId: 'incarnation-new' })
+    // The same-buffer data frame can decode a decoder turn after the spawn response resolves.
+    await waitForValue(() => onData.mock.calls.at(0), 'replacement source data')
     expect(onData.mock.calls.map(([payload]) => payload.data)).toEqual(['new'])
 
     transport.deliver(
diff --git a/src/main/providers/windows-pty-job-membership.ts b/src/main/providers/windows-pty-job-membership.ts
index 99bcf7ef2c2d..7bb37323b39d 100644
--- a/src/main/providers/windows-pty-job-membership.ts
+++ b/src/main/providers/windows-pty-job-membership.ts
@@ -1,5 +1,9 @@
 import type { IPty } from 'node-pty'
-import { isPtyJobOwnershipAvailable, listPtyJobProcessIds } from '../windows/windows-pty-job'
+import {
+  isPtyJobOwnershipAvailable,
+  listPtyJobProcessIds,
+  ptyShellProcessId
+} from '../windows/windows-pty-job'
 
 /**
  * Processes still running under a pane, or null when there is no answer.
@@ -30,7 +34,14 @@ export function readWindowsPtyJobProcessIds(
   const membership = new Set(pids.filter((pid) => Number.isSafeInteger(pid) && pid > 0))
   // Without the shell, a size-1 set would read as "shell alone, retire" when it
   // means the opposite. The forked probe this replaced refused the same way.
-  return membership.has(proc.pid) ? membership : null
+  const shellPid = ptyShellProcessId(proc)
+  if (shellPid === undefined || !membership.has(proc.pid) || !membership.has(shellPid)) {
+    return null
+  }
+  if (shellPid !== proc.pid) {
+    membership.delete(proc.pid)
+  }
+  return membership
 }
 
 /**
diff --git a/src/main/pty-descendant-exit-verification.test.ts b/src/main/pty-descendant-exit-verification.test.ts
index 4b92a6444c07..72b331492ad5 100644
--- a/src/main/pty-descendant-exit-verification.test.ts
+++ b/src/main/pty-descendant-exit-verification.test.ts
@@ -32,9 +32,9 @@ describe('descendant exit verification across partial process-table reads', () =
     const snapshot = collectDescendantRows(10, [row(10, 1), first, later], CAPTURED_AT)
     const readTable = vi
       .fn()
-      .mockResolvedValueOnce(capture([first]))
-      .mockResolvedValueOnce(capture([first, later]))
-      .mockResolvedValue(capture([]))
+      .mockImplementationOnce(async () => capture([first]))
+      .mockImplementationOnce(async () => capture([first, later]))
+      .mockImplementation(async () => capture([]))
     const sendSignal = vi.fn()
     const pending = terminateDescendantSnapshotWithVerdict(snapshot, {
       readTable,
@@ -52,16 +52,37 @@ describe('descendant exit verification across partial process-table reads', () =
     ])
   })
 
-  it('keeps an omitted target unverifiable when partial reads never show its identity', async () => {
-    const first = row(20)
-    const omitted = row(30)
-    const snapshot = collectDescendantRows(10, [row(10, 1), first, omitted], CAPTURED_AT)
+  it('proves a target gone that only the snapshot saw, once two later reads miss it', async () => {
+    // A root that exits on its own takes a short-lived child with it before the first poll.
+    const snapshot = collectDescendantRows(10, [row(10, 1), row(20)], CAPTURED_AT)
     const sendSignal = vi.fn()
     const pending = terminateDescendantSnapshotWithVerdict(snapshot, {
-      readTable: vi
-        .fn()
-        .mockResolvedValueOnce(capture([first]))
-        .mockResolvedValue(capture([])),
+      readTable: vi.fn().mockImplementation(async () => capture([])),
+      sendSignal,
+      requireIdentityBeforeSignal: true,
+      graceMs: 0,
+      verifyMs: 3_500
+    })
+    let verdict: string | undefined
+    void pending.then((value) => {
+      verdict = value
+    })
+    // Proven within a few polls, not by waiting out the verification window.
+    await vi.advanceTimersByTimeAsync(200)
+
+    expect(verdict).toBe('exited')
+    expect(sendSignal).not.toHaveBeenCalled()
+    await vi.advanceTimersByTimeAsync(4_000)
+  })
+
+  it('does not count an absence from a read that started before the target was seen', async () => {
+    const unseen = row(30)
+    const snapshot = collectDescendantRows(10, [row(10, 1), unseen], CAPTURED_AT)
+    const sendSignal = vi.fn()
+    // A shared read already in flight when the snapshot ran cannot list a descendant forked since.
+    const staleRead = { rows: [], capturedAtMs: CAPTURED_AT - 1 }
+    const pending = terminateDescendantSnapshotWithVerdict(snapshot, {
+      readTable: vi.fn().mockResolvedValue(staleRead),
       sendSignal,
       requireIdentityBeforeSignal: true,
       graceMs: 0,
@@ -70,8 +91,45 @@ describe('descendant exit verification across partial process-table reads', () =
     await vi.advanceTimersByTimeAsync(200)
 
     await expect(pending).resolves.toBe('unverifiable')
-    expect(sendSignal).toHaveBeenCalledWith(first.pid, 'SIGTERM')
-    expect(sendSignal).not.toHaveBeenCalledWith(omitted.pid, 'SIGTERM')
+    expect(sendSignal).not.toHaveBeenCalled()
+  })
+
+  it('keeps the latest sighting when an earlier-started read that matches resolves later', async () => {
+    const target = row(20)
+    const snapshot = collectDescendantRows(10, [row(10, 1), target], CAPTURED_AT)
+    const readTable = vi
+      .fn()
+      .mockResolvedValueOnce({ rows: [target], capturedAtMs: CAPTURED_AT + 300 })
+      .mockResolvedValueOnce({ rows: [target], capturedAtMs: CAPTURED_AT + 100 })
+      // Began between the two sightings, so it cannot prove the later one gone.
+      .mockResolvedValue({ rows: [], capturedAtMs: CAPTURED_AT + 200 })
+    const pending = terminateDescendantSnapshotWithVerdict(snapshot, {
+      readTable,
+      sendSignal: vi.fn(),
+      requireIdentityBeforeSignal: true,
+      graceMs: 10_000,
+      verifyMs: 300
+    })
+    await vi.advanceTimersByTimeAsync(400)
+
+    await expect(pending).resolves.toBe('unverifiable')
+  })
+
+  it('counts the read after the deadline as an absence', async () => {
+    const snapshot = collectDescendantRows(10, [row(10, 1), row(20)], CAPTURED_AT)
+    const readTable = vi.fn().mockImplementation(async () => capture([]))
+    // One poll fits in the window; the final read supplies the second absence.
+    const pending = terminateDescendantSnapshotWithVerdict(snapshot, {
+      readTable,
+      sendSignal: vi.fn(),
+      requireIdentityBeforeSignal: true,
+      graceMs: 0,
+      verifyMs: 50
+    })
+    await vi.advanceTimersByTimeAsync(100)
+
+    await expect(pending).resolves.toBe('exited')
+    expect(readTable).toHaveBeenCalledTimes(2)
   })
 
   it('escalates a survivor omitted at the first force-kill read when it reappears', async () => {
@@ -80,10 +138,10 @@ describe('descendant exit verification across partial process-table reads', () =
     const snapshot = collectDescendantRows(10, [row(10, 1), first, later], CAPTURED_AT)
     const readTable = vi
       .fn()
-      .mockResolvedValueOnce(capture([first, later]))
-      .mockResolvedValueOnce(capture([first]))
-      .mockResolvedValueOnce(capture([first, later]))
-      .mockResolvedValue(capture([]))
+      .mockImplementationOnce(async () => capture([first, later]))
+      .mockImplementationOnce(async () => capture([first]))
+      .mockImplementationOnce(async () => capture([first, later]))
+      .mockImplementation(async () => capture([]))
     const sendSignal = vi.fn()
     const pending = terminateDescendantSnapshotWithVerdict(snapshot, {
       readTable,
diff --git a/src/main/pty-descendant-exit-verification.ts b/src/main/pty-descendant-exit-verification.ts
index 27ed62ca0a0b..bc23faf29581 100644
--- a/src/main/pty-descendant-exit-verification.ts
+++ b/src/main/pty-descendant-exit-verification.ts
@@ -124,7 +124,32 @@ export async function terminateDescendantSnapshotWithVerdict(
   const forced = new Set<number>()
   const signalled = new Set<number>()
   const missingObservations = new Map(snapshot.descendants.map((row) => [row.pid, 0]))
-  const observedPids = new Set<number>()
+  // The snapshot is itself a table read that saw each target alive. An absence is evidence only
+  // from a read that started after the target was last seen: a shared or in-flight read begun
+  // earlier can miss a descendant forked since, but a later full scan cannot miss a live one.
+  const lastSeenAtMs = new Map(
+    snapshot.descendants.map((row) => [
+      row.pid,
+      snapshot.capturedAtMsByPid?.[String(row.pid)] ?? snapshot.capturedAtMs
+    ])
+  )
+  const recordIdentityObservation = (
+    capture: ProcessTableCapture,
+    live: readonly ProcessTableRow[]
+  ): void => {
+    for (const row of snapshot.descendants) {
+      const lastSeen = lastSeenAtMs.get(row.pid) ?? Infinity
+      if (live.some((current) => current.pid === row.pid)) {
+        missingObservations.set(row.pid, 0)
+        // A read that started earlier but resolved later must not move the sighting back.
+        lastSeenAtMs.set(row.pid, Math.max(lastSeen, capture.capturedAtMs))
+      } else if (capture.capturedAtMs > lastSeen) {
+        missingObservations.set(row.pid, (missingObservations.get(row.pid) ?? 0) + 1)
+      }
+    }
+  }
+  const provenAbsent = (): boolean =>
+    snapshot.descendants.every((row) => (missingObservations.get(row.pid) ?? 0) >= 2)
   if (!deps.requireIdentityBeforeSignal) {
     for (const row of snapshot.descendants) {
       sendSignal(row.pid, 'SIGTERM')
@@ -148,30 +173,14 @@ export async function terminateDescendantSnapshotWithVerdict(
       }
       const live = matchingSnapshotRows(snapshot, capture.rows, deps.requireIdentityBeforeSignal)
       if (deps.requireIdentityBeforeSignal) {
-        const rowsByPid = new Set(capture.rows.map((row) => row.pid))
-        for (const row of snapshot.descendants) {
-          if (rowsByPid.has(row.pid)) {
-            observedPids.add(row.pid)
-          }
-          if (live.some((current) => current.pid === row.pid)) {
-            missingObservations.set(row.pid, 0)
-          } else {
-            missingObservations.set(row.pid, (missingObservations.get(row.pid) ?? 0) + 1)
-          }
-        }
+        recordIdentityObservation(capture, live)
       }
       if (live.length === 0) {
         // Before a signal has been sent, an empty identity match means the
         // snapshotted descendants already exited or were replaced. Signalling
-        // those old numeric pids would be unsafe. Partial reads are not proof
-        // that a never-observed target exited, so every identity needs two
-        // bounded absences after it has appeared in a table.
-        if (
-          deps.requireIdentityBeforeSignal &&
-          !snapshot.descendants.every(
-            (row) => observedPids.has(row.pid) && (missingObservations.get(row.pid) ?? 0) >= 2
-          )
-        ) {
+        // those old numeric pids would be unsafe. Every identity needs two
+        // absences from reads that started after it was last seen.
+        if (deps.requireIdentityBeforeSignal && !provenAbsent()) {
           await waitForDelay(50, deps.keepAlive)
           continue
         }
@@ -235,10 +244,8 @@ export async function terminateDescendantSnapshotWithVerdict(
     return 'live'
   }
   if (deps.requireIdentityBeforeSignal) {
-    const everyTargetAbsent = snapshot.descendants.every(
-      (row) => observedPids.has(row.pid) && (missingObservations.get(row.pid) ?? 0) >= 2
-    )
-    return everyTargetAbsent ? 'exited' : 'unverifiable'
+    recordIdentityObservation(finalCapture, finalLive)
+    return provenAbsent() ? 'exited' : 'unverifiable'
   }
   return 'exited'
 }
diff --git a/src/main/pty-descendant-termination.test.ts b/src/main/pty-descendant-termination.test.ts
index f6b8e0669832..6261ec92fc22 100644
--- a/src/main/pty-descendant-termination.test.ts
+++ b/src/main/pty-descendant-termination.test.ts
@@ -453,7 +453,8 @@ describe('terminateDescendantSnapshotAndWait', () => {
       snapshot([row(20, 10, 20, 'Tue Jul 14 12:00:00 2026')]),
       {
         sendSignal,
-        readTable: vi.fn().mockResolvedValue(tableCapture([recycled])),
+        // Reads begin after the walk that produced the snapshot, as every fresh scan does.
+        readTable: vi.fn().mockResolvedValue(tableCapture([recycled], CAPTURED_AT_MS + 1_000)),
         requireIdentityBeforeSignal: true,
         verifyMs: 100
       }
diff --git a/src/main/pty/node-pty-self-exit-pseudoconsole-close.test.ts b/src/main/pty/node-pty-self-exit-pseudoconsole-close.test.ts
index 1f9cae275c30..6d8b6411ba56 100644
--- a/src/main/pty/node-pty-self-exit-pseudoconsole-close.test.ts
+++ b/src/main/pty/node-pty-self-exit-pseudoconsole-close.test.ts
@@ -84,7 +84,7 @@ describe('node-pty patch: pseudoconsole close on the self-exit path', () => {
       [
         '+      baton->shellExited = true;',
         '+      if (baton->consoleClosed) {',
-        '+        const bool removed = remove_pty_baton(baton->id);',
+        '+        const bool removed = remove_pty_baton_locked(baton->id);',
         '+        assert(removed);',
         '+        (void)removed;',
         '+      }'
@@ -138,7 +138,7 @@ describe('node-pty patch: pseudoconsole close on the self-exit path', () => {
     expect(ptyKillHunk).toContain(
       [
         '+      if (handle->shellExited) {',
-        '+        const bool removed = remove_pty_baton(id);',
+        '+        const bool removed = remove_pty_baton_locked(id);',
         '+        assert(removed);',
         '+        (void)removed;'
       ].join('\n')
diff --git a/src/main/pty/posix-pty-process-groups.test.ts b/src/main/pty/posix-pty-process-groups.test.ts
index ef9acf050307..f0b3727c6ee4 100644
--- a/src/main/pty/posix-pty-process-groups.test.ts
+++ b/src/main/pty/posix-pty-process-groups.test.ts
@@ -1,19 +1,33 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type { ProcessResult } from '../../shared/child-process/run-process'
 
-const { recordSelfInitiatedTreeKillMock } = vi.hoisted(() => ({
-  recordSelfInitiatedTreeKillMock: vi.fn()
+const { recordSelfInitiatedTreeKillMock, runProcessMock, runProcessSyncMock } = vi.hoisted(() => ({
+  recordSelfInitiatedTreeKillMock: vi.fn(),
+  runProcessMock: vi.fn(),
+  runProcessSyncMock: vi.fn()
 }))
 vi.mock('../crash-reporting/self-initiated-tree-kill-log', () => ({
   recordSelfInitiatedTreeKill: recordSelfInitiatedTreeKillMock
 }))
+vi.mock('../../shared/child-process/run-process', () => ({
+  runProcess: runProcessMock,
+  runProcessSync: runProcessSyncMock
+}))
 
 import {
   forceKillPosixPtyProcessGroups,
-  getPosixPtyProcessGroups
+  getPosixPtyProcessGroups,
+  isPosixPtyRootStopped,
+  readPosixPtyProcessTable,
+  resetPosixPtyProcessTableDialectForTests,
+  signalPosixPtyProcessGroups
 } from './posix-pty-process-groups'
 
 beforeEach(() => {
   recordSelfInitiatedTreeKillMock.mockReset()
+  runProcessMock.mockReset()
+  runProcessSyncMock.mockReset()
+  resetPosixPtyProcessTableDialectForTests()
 })
 
 const TABLE = `
@@ -25,6 +39,265 @@ const TABLE = `
   300  300 ??
 `
 
+const ALL_PROCESS_ARGS = [
+  '-e',
+  '-o',
+  'pid=PROCESS_ID,pgid=PROCESS_GID,tty=TERMINAL_DEVICE_NUMBER,stat=PROCESS_STATE'
+]
+const BUSYBOX_TABLE = `
+PROCESS_ID PROCESS_GID TERMINAL_DEVICE_NUMBER
+100 100 136,100
+101 101 136,100
+200 200 136,10
+201 201 136,10
+999 999 ?
+`
+const unsupportedSelection = (stderr = 'ps: unrecognized option: p\n'): ProcessResult => ({
+  code: 1,
+  signal: null,
+  stdout: '',
+  stderr,
+  timedOut: false
+})
+
+describe('ps selection compatibility', () => {
+  it.each([
+    ['p', 'ps: unrecognized option: p\nBusyBox v1.37\nUsage: ps'],
+    ['p', "ps: invalid option -- 'p'\n"],
+    ['p', 'ps: illegal option -- p\n'],
+    ['t', 'ps: unrecognized option: t\n']
+  ])(
+    'falls back after a rejected %s selector and caches only the dialect (%s)',
+    async (option, stderr) => {
+      if (option === 't') {
+        runProcessMock.mockResolvedValueOnce({ code: 0, stdout: '100 100 pts/100' })
+      }
+      runProcessMock
+        .mockResolvedValueOnce(unsupportedSelection(stderr))
+        .mockResolvedValueOnce({ code: 0, stdout: BUSYBOX_TABLE })
+        .mockResolvedValueOnce({
+          code: 0,
+          stdout: BUSYBOX_TABLE.replace('201 201 136,10', '202 202 136,10')
+        })
+
+      const first = await readPosixPtyProcessTable(100)
+      const second = await readPosixPtyProcessTable(200)
+      expect(first).toBe(BUSYBOX_TABLE)
+      expect(getPosixPtyProcessGroups(first, 100, 999)).toEqual([101, 100])
+      expect(getPosixPtyProcessGroups(second, 200, 999)).toEqual([202, 200])
+      expect(runProcessMock.mock.calls.map(([spec]) => spec.args)).toEqual([
+        ['-p', '100', '-o', 'pid=,pgid=,tty=,stat='],
+        ...(option === 't' ? [['-t', 'pts/100', '-o', 'pid=,pgid=,tty=,stat=']] : []),
+        ALL_PROCESS_ARGS,
+        ALL_PROCESS_ARGS
+      ])
+      expect(
+        runProcessMock.mock.calls.every(
+          ([spec]) => spec.maxOutputBytes === 1048576 && spec.timeoutMs === 1000
+        )
+      ).toBe(true)
+    }
+  )
+
+  it('shares the initial unsupported probe across concurrent callers and cancels waiting independently', async () => {
+    let resolveProbe: (result: ProcessResult) => void = () => {}
+    runProcessMock
+      .mockImplementationOnce(
+        () =>
+          new Promise<ProcessResult>((resolve) => {
+            resolveProbe = resolve
+          })
+      )
+      .mockResolvedValue({ code: 0, stdout: BUSYBOX_TABLE })
+    const first = readPosixPtyProcessTable(100)
+    const second = readPosixPtyProcessTable(200)
+    const controller = new AbortController()
+    const cancelled = readPosixPtyProcessTable(300, controller.signal)
+    expect(runProcessMock).toHaveBeenCalledOnce()
+    controller.abort()
+    await expect(cancelled).rejects.toThrow()
+    resolveProbe(unsupportedSelection())
+
+    expect(getPosixPtyProcessGroups(await first, 100, 999)).toEqual([101, 100])
+    expect(getPosixPtyProcessGroups(await second, 200, 999)).toEqual([201, 200])
+    expect(runProcessMock.mock.calls.map(([spec]) => spec.args)).toEqual([
+      ['-p', '100', '-o', 'pid=,pgid=,tty=,stat='],
+      ALL_PROCESS_ARGS,
+      ALL_PROCESS_ARGS
+    ])
+  })
+
+  it('uses the cached async dialect for synchronous teardown with fresh membership', async () => {
+    runProcessMock
+      .mockResolvedValueOnce(unsupportedSelection())
+      .mockResolvedValueOnce({ code: 0, stdout: BUSYBOX_TABLE })
+    await readPosixPtyProcessTable(100)
+    runProcessSyncMock.mockReturnValue({
+      code: 0,
+      stdout: BUSYBOX_TABLE.replace('101 101 136,100', '102 102 136,100')
+    })
+    const signalProcessGroup = vi.fn()
+    const fallback = vi.fn()
+    forceKillPosixPtyProcessGroups(100, fallback, {
+      platform: 'linux',
+      currentPid: 999,
+      signalProcessGroup
+    })
+    expect(runProcessSyncMock.mock.calls.map(([spec]) => spec.args)).toEqual([ALL_PROCESS_ARGS])
+    expect(signalProcessGroup.mock.calls).toEqual([[102], [100]])
+    expect(fallback).not.toHaveBeenCalled()
+  })
+
+  it('discovers unsupported selection during teardown and shares it with async readers', async () => {
+    runProcessSyncMock
+      .mockReturnValueOnce(unsupportedSelection())
+      .mockReturnValueOnce({ code: 0, stdout: BUSYBOX_TABLE })
+    const signalProcessGroup = vi.fn()
+    const fallback = vi.fn()
+    forceKillPosixPtyProcessGroups(100, fallback, {
+      platform: 'linux',
+      currentPid: 999,
+      signalProcessGroup
+    })
+    expect(signalProcessGroup.mock.calls).toEqual([[101], [100]])
+    expect(fallback).not.toHaveBeenCalled()
+    runProcessMock.mockResolvedValueOnce({ code: 0, stdout: BUSYBOX_TABLE })
+    await readPosixPtyProcessTable(200)
+    expect(runProcessMock.mock.calls.map(([spec]) => spec.args)).toEqual([ALL_PROCESS_ARGS])
+  })
+
+  it.each([
+    { stderr: 'ps: permission denied' },
+    { stderr: 'ps: unrecognized option: o' },
+    { stderr: 'ps: unrecognized option: t' },
+    { timedOut: true },
+    { outputTruncated: true },
+    { code: null, signal: 'SIGTERM' }
+  ])('does not turn an unrelated failure into a full-host scan: %j', async (failure) => {
+    runProcessMock.mockResolvedValueOnce({ ...unsupportedSelection(), ...failure })
+    await expect(readPosixPtyProcessTable(100)).rejects.toThrow('unavailable')
+    expect(runProcessMock).toHaveBeenCalledOnce()
+    runProcessMock
+      .mockResolvedValueOnce({ code: 0, stdout: '100 100 ttys001' })
+      .mockResolvedValueOnce({ code: 0, stdout: TABLE })
+    await readPosixPtyProcessTable(100)
+    expect(runProcessMock.mock.calls[1][0].args).toEqual([
+      '-p',
+      '100',
+      '-o',
+      'pid=,pgid=,tty=,stat='
+    ])
+  })
+
+  it.each([{ code: 1 }, { code: 0, timedOut: true }, { code: 0, outputTruncated: true }])(
+    'rejects incomplete fallback snapshots for async discovery and sync teardown: %j',
+    async (failure) => {
+      runProcessMock
+        .mockResolvedValueOnce(unsupportedSelection())
+        .mockResolvedValueOnce({ stdout: BUSYBOX_TABLE, ...failure })
+      await expect(readPosixPtyProcessTable(100)).rejects.toThrow('unavailable')
+      runProcessSyncMock.mockReturnValue({ stdout: BUSYBOX_TABLE, ...failure })
+      const signalProcessGroup = vi.fn()
+      const fallback = vi.fn()
+      forceKillPosixPtyProcessGroups(100, fallback, {
+        platform: 'linux',
+        currentPid: 999,
+        signalProcessGroup
+      })
+      expect(fallback).toHaveBeenCalledOnce()
+      expect(signalProcessGroup).not.toHaveBeenCalled()
+    }
+  )
+
+  it('does not cache a rejected selector if the caller has already cancelled', async () => {
+    const controller = new AbortController()
+    runProcessMock.mockImplementationOnce(async () => {
+      controller.abort()
+      return unsupportedSelection()
+    })
+    await expect(readPosixPtyProcessTable(100, controller.signal)).rejects.toThrow()
+    expect(runProcessMock).toHaveBeenCalledOnce()
+    runProcessMock.mockResolvedValueOnce({ code: 0, stdout: '100 100 ?' })
+    await readPosixPtyProcessTable(100)
+    expect(runProcessMock.mock.calls[1][0].args[0]).toBe('-p')
+  })
+
+  it.each(['?', '??', '-', '0', '0,0'])(
+    'refuses to group processes without a controlling terminal (%s)',
+    (tty) => {
+      expect(getPosixPtyProcessGroups(`100 100 ${tty}\n101 101 ${tty}`, 100, 999)).toBeNull()
+    }
+  )
+
+  it('preserves full numeric terminal identity and the daemon terminal guard', () => {
+    expect(getPosixPtyProcessGroups(BUSYBOX_TABLE, 100, 999)).toEqual([101, 100])
+    expect(getPosixPtyProcessGroups(BUSYBOX_TABLE, 200, 999)).toEqual([201, 200])
+    expect(getPosixPtyProcessGroups(BUSYBOX_TABLE, 100, 101)).toBeNull()
+  })
+})
+
+describe('asynchronous PTY process discovery', () => {
+  it('requires a stopped state for the exact shell process', () => {
+    expect(isPosixPtyRootStopped('100 100 pts/test Ts\n101 101 pts/test R+', 100)).toBe(true)
+    expect(isPosixPtyRootStopped('100 100 pts/test S\n101 101 pts/test T', 100)).toBe(false)
+    expect(isPosixPtyRootStopped('101 101 pts/test T', 100)).toBe(false)
+    expect(isPosixPtyRootStopped('100 100 pts/test\n101 101 pts/test T', 100)).toBe(false)
+  })
+
+  it('bounds each lookup and selects the root terminal without synchronous subprocesses', async () => {
+    const controller = new AbortController()
+    runProcessMock
+      .mockResolvedValueOnce({ code: 0, stdout: '100 100 ttys001' })
+      .mockResolvedValueOnce({ code: 0, stdout: TABLE })
+
+    expect(await readPosixPtyProcessTable(100, controller.signal)).toBe(`100 100 ttys001\n${TABLE}`)
+    expect(
+      runProcessMock.mock.calls.map(([spec]) => [{ ...spec, env: { LC_ALL: spec.env.LC_ALL } }])
+    ).toEqual([
+      [
+        {
+          program: 'ps',
+          env: { LC_ALL: 'C' },
+          args: ['-p', '100', '-o', 'pid=,pgid=,tty=,stat='],
+          timeoutMs: 1000,
+          maxOutputBytes: 1048576,
+          signal: controller.signal
+        }
+      ],
+      [
+        {
+          program: 'ps',
+          env: { LC_ALL: 'C' },
+          args: ['-t', 'ttys001', '-o', 'pid=,pgid=,tty=,stat='],
+          timeoutMs: 1000,
+          maxOutputBytes: 1048576,
+          signal: controller.signal
+        }
+      ]
+    ])
+    expect(runProcessSyncMock).not.toHaveBeenCalled()
+  })
+
+  it.each([{ code: 1 }, { code: 0, timedOut: true }, { code: 0, outputTruncated: true }])(
+    'rejects incomplete process evidence: %j',
+    async (result) => {
+      runProcessMock.mockResolvedValue({ stdout: TABLE, ...result })
+      await expect(readPosixPtyProcessTable(100)).rejects.toThrow('unavailable')
+      expect(runProcessMock).toHaveBeenCalledOnce()
+    }
+  )
+
+  it('does not start the second lookup after cancellation', async () => {
+    const controller = new AbortController()
+    runProcessMock.mockImplementation(async () => {
+      controller.abort()
+      return { code: 0, stdout: '100 100 ttys001' }
+    })
+    await expect(readPosixPtyProcessTable(100, controller.signal)).rejects.toThrow()
+    expect(runProcessMock).toHaveBeenCalledOnce()
+  })
+})
+
 describe('POSIX PTY process-group termination', () => {
   it('returns every group attached to the root PTY with the root group last', () => {
     expect(getPosixPtyProcessGroups(TABLE, 100, 999)).toEqual([101, 103, 100])
@@ -51,6 +324,43 @@ describe('POSIX PTY process-group termination', () => {
     expect(fallback).not.toHaveBeenCalled()
   })
 
+  it.each([
+    ['SIGSTOP', [99, 101, 103]],
+    ['SIGCONT', [101, 103, 99]]
+  ] as const)('orders shell and job groups safely for %s', (signal, expected) => {
+    const signalProcessGroup = vi.fn()
+    signalPosixPtyProcessGroups(100, signal, vi.fn(), {
+      platform: 'linux',
+      currentPid: 999,
+      readProcessTable: () => TABLE.replace('100  100', '100  99'),
+      signalProcessGroup
+    })
+    expect(signalProcessGroup.mock.calls.map(([pgid]) => pgid)).toEqual(expected)
+  })
+
+  it.each(['EPERM', 'ESRCH'])(
+    'does not stop jobs when stopping the shell fails with %s',
+    (code) => {
+      const error = Object.assign(new Error('stop failed'), { code })
+      const signalProcessGroup = vi.fn(() => {
+        throw error
+      })
+      const stop = () =>
+        signalPosixPtyProcessGroups(100, 'SIGSTOP', vi.fn(), {
+          platform: 'linux',
+          currentPid: 999,
+          readProcessTable: () => TABLE,
+          signalProcessGroup
+        })
+      if (code === 'ESRCH') {
+        expect(stop).not.toThrow()
+      } else {
+        expect(stop).toThrow(error)
+      }
+      expect(signalProcessGroup.mock.calls).toEqual([[100]])
+    }
+  )
+
   it('falls back when the process table cannot prove PTY ownership', () => {
     const fallback = vi.fn()
 
diff --git a/src/main/pty/posix-pty-process-groups.ts b/src/main/pty/posix-pty-process-groups.ts
index c34e7ff8123e..1f7f05f73a1e 100644
--- a/src/main/pty/posix-pty-process-groups.ts
+++ b/src/main/pty/posix-pty-process-groups.ts
@@ -1,13 +1,35 @@
-import { execFileSync } from 'node:child_process'
 import { recordSelfInitiatedTreeKill } from '../crash-reporting/self-initiated-tree-kill-log'
+import { waitForPromiseWithSignal } from '../../shared/abort-signal-reason'
+import {
+  runProcess,
+  runProcessSync,
+  type ProcessResult
+} from '../../shared/child-process/run-process'
 
 const PROCESS_TABLE_TIMEOUT_MS = 1_000
 const PROCESS_TABLE_MAX_BYTES = 1024 * 1024
+const SELECTED_COLUMNS = 'pid=,pgid=,tty=,stat='
+// Explicit widths prevent BusyBox from truncating device numbers into another terminal's identity.
+const ALL_PROCESS_ARGS = [
+  '-e',
+  '-o',
+  'pid=PROCESS_ID,pgid=PROCESS_GID,tty=TERMINAL_DEVICE_NUMBER,stat=PROCESS_STATE'
+]
+let psDialect: 'selected' | 'all' | undefined
+let dialectProbe: Promise<void> | undefined
+
+class UnsupportedPsSelectionError extends Error {}
+
+export function resetPosixPtyProcessTableDialectForTests(): void {
+  psDialect = undefined
+  dialectProbe = undefined
+}
 
 type ProcessRow = {
   pid: number
   pgid: number
   tty: string
+  state?: string
 }
 
 export type PosixPtyProcessGroupTerminationDeps = {
@@ -17,41 +39,149 @@ export type PosixPtyProcessGroupTerminationDeps = {
   signalProcessGroup?: (pgid: number) => void
 }
 
-function runPs(args: string[]): string {
-  return execFileSync('ps', args, {
-    encoding: 'utf8',
-    timeout: PROCESS_TABLE_TIMEOUT_MS,
-    maxBuffer: PROCESS_TABLE_MAX_BYTES
-  })
+function readProcessTableResult(result: ProcessResult): string {
+  if (result.code !== 0 || result.timedOut || result.outputTruncated) {
+    throw new Error('PTY process table is unavailable')
+  }
+  return result.stdout
+}
+
+function readSelectionResult(result: ProcessResult, option: 'p' | 't'): string {
+  const rejectedOption =
+    /^ps: (?:invalid|illegal|unrecognized) option(?: -- |: | )['"]?-?([pt])['"]?\s*$/m.exec(
+      result.stderr ?? ''
+    )?.[1]
+  if (
+    result.code !== null &&
+    result.code !== 0 &&
+    !result.signal &&
+    !result.timedOut &&
+    !result.outputTruncated &&
+    rejectedOption === option
+  ) {
+    throw new UnsupportedPsSelectionError()
+  }
+  const output = readProcessTableResult(result)
+  if (psDialect === 'all') {
+    throw new UnsupportedPsSelectionError()
+  }
+  return output
+}
+
+function hasControllingTty(tty: string): boolean {
+  return tty !== '?' && tty !== '??' && tty !== '-' && tty !== '0' && !/^0,\d+$/.test(tty)
+}
+
+function* processTableQueries(rootPid: number): Generator<string[], string, ProcessResult> {
+  if (psDialect !== 'all') {
+    try {
+      const root = readSelectionResult(yield ['-p', String(rootPid), '-o', SELECTED_COLUMNS], 'p')
+      const rootRow = parseProcessRows(root).find((row) => row.pid === rootPid)
+      if (!rootRow || !hasControllingTty(rootRow.tty)) {
+        return root
+      }
+      const terminal = readSelectionResult(yield ['-t', rootRow.tty, '-o', SELECTED_COLUMNS], 't')
+      psDialect ??= 'selected'
+      return `${root}\n${terminal}`
+    } catch (error) {
+      if (!(error instanceof UnsupportedPsSelectionError)) {
+        throw error
+      }
+      psDialect = 'all'
+    }
+  }
+  return readProcessTableResult(yield ALL_PROCESS_ARGS)
+}
+
+function processTableSpec(args: string[]) {
+  return {
+    program: 'ps',
+    args,
+    env: { ...process.env, LC_ALL: 'C' },
+    timeoutMs: PROCESS_TABLE_TIMEOUT_MS,
+    maxOutputBytes: PROCESS_TABLE_MAX_BYTES
+  }
 }
 
 function readPtyProcessTable(rootPid: number): string {
-  const root = runPs(['-p', String(rootPid), '-o', 'pid=,pgid=,tty='])
-  const rootRow = parseProcessRows(root).find((row) => row.pid === rootPid)
-  if (!rootRow || rootRow.tty === '?' || rootRow.tty === '??') {
-    return root
+  const queries = processTableQueries(rootPid)
+  let next = queries.next()
+  while (!next.done) {
+    next = queries.next(runProcessSync(processTableSpec(next.value)))
+  }
+  return next.value
+}
+
+export async function readPosixPtyProcessTable(
+  rootPid: number,
+  signal?: AbortSignal
+): Promise<string> {
+  while (dialectProbe) {
+    await waitForPromiseWithSignal(dialectProbe, signal)
+  }
+  signal?.throwIfAborted()
+  let releaseProbe: (() => void) | undefined
+  if (psDialect === undefined) {
+    dialectProbe = new Promise<void>((resolve) => {
+      releaseProbe = resolve
+    })
+  }
+  try {
+    const queries = processTableQueries(rootPid)
+    let next = queries.next()
+    while (!next.done) {
+      signal?.throwIfAborted()
+      const result = await runProcess({ ...processTableSpec(next.value), signal })
+      signal?.throwIfAborted()
+      next = queries.next(result)
+    }
+    return next.value
+  } finally {
+    if (releaseProbe) {
+      dialectProbe = undefined
+      releaseProbe()
+    }
   }
-  // Why: a whole-host `ps -ax` takes nearly a second on large machines. TTY
-  // selection keeps forced terminal teardown proportional to one terminal.
-  return `${root}\n${runPs(['-t', rootRow.tty, '-o', 'pid=,pgid=,tty='])}`
 }
 
 function parseProcessRows(output: string): ProcessRow[] {
   const rows: ProcessRow[] = []
   for (const line of output.split(/\r?\n/)) {
-    const match = /^\s*(\d+)\s+(\d+)\s+(\S+)/.exec(line)
+    const match = /^\s*(\d+)\s+(\d+)\s+(\S+)(?:\s+(\S+))?/.exec(line)
     if (!match) {
       continue
     }
     const pid = Number(match[1])
     const pgid = Number(match[2])
     if (pid > 0 && pgid > 1) {
-      rows.push({ pid, pgid, tty: match[3] })
+      rows.push({ pid, pgid, tty: match[3], state: match[4] })
     }
   }
   return rows
 }
 
+export function isPosixPtyRootStopped(output: string, rootPid: number): boolean {
+  return (
+    parseProcessRows(output)
+      .find((row) => row.pid === rootPid)
+      ?.state?.startsWith('T') === true
+  )
+}
+
+/** The root was stopped by flow control; preserve independently stopped jobs. */
+export function getPosixPtyStoppedJobGroups(output: string, rootPid: number): Set<number> {
+  const rows = parseProcessRows(output)
+  const root = rows.find((row) => row.pid === rootPid)
+  return new Set(
+    rows
+      .filter(
+        (row) =>
+          root && row.tty === root.tty && row.pgid !== root.pgid && /^[Tt]/.test(row.state ?? '')
+      )
+      .map((row) => row.pgid)
+  )
+}
+
 export function getPosixPtyProcessGroups(
   output: string,
   rootPid: number,
@@ -59,7 +189,7 @@ export function getPosixPtyProcessGroups(
 ): number[] | null {
   const rows = parseProcessRows(output)
   const root = rows.find((row) => row.pid === rootPid)
-  if (!root || root.tty === '?' || root.tty === '??') {
+  if (!root || !hasControllingTty(root.tty)) {
     return null
   }
   // Why: a development daemon can inherit its launch TTY. Never group-signal
@@ -91,6 +221,16 @@ export function forceKillPosixPtyProcessGroups(
   rootPid: number,
   fallback: () => void,
   deps: PosixPtyProcessGroupTerminationDeps = {}
+): void {
+  signalPosixPtyProcessGroups(rootPid, 'SIGKILL', fallback, deps)
+}
+
+/** Signal every process group proven to belong to one POSIX PTY. */
+export function signalPosixPtyProcessGroups(
+  rootPid: number,
+  signal: NodeJS.Signals,
+  fallback: () => void,
+  deps: PosixPtyProcessGroupTerminationDeps = {}
 ): void {
   if ((deps.platform ?? process.platform) === 'win32') {
     fallback()
@@ -110,14 +250,24 @@ export function forceKillPosixPtyProcessGroups(
     fallback()
     return
   }
+  if (signal === 'SIGSTOP') {
+    // Stop the shell before its jobs so it cannot treat their suspension as completion.
+    groups.unshift(...groups.splice(-1))
+  }
 
   const signalProcessGroup =
-    deps.signalProcessGroup ?? ((pgid: number) => process.kill(-pgid, 'SIGKILL'))
+    deps.signalProcessGroup ?? ((pgid: number) => process.kill(-pgid, signal))
   let firstError: unknown
   for (const pgid of groups) {
     try {
       signalProcessGroup(pgid)
     } catch (error) {
+      if (signal === 'SIGSTOP' && pgid === groups[0]) {
+        if (isProcessAlreadyGone(error)) {
+          return
+        }
+        throw error
+      }
       // Why: the PTY exit callback may reap a group between `ps` and killpg.
       // ESRCH is proof that this captured owner is already gone, not failure.
       if (!isProcessAlreadyGone(error) && firstError === undefined) {
@@ -127,11 +277,13 @@ export function forceKillPosixPtyProcessGroups(
     }
     // Outside the try: this catch is the ESRCH contract, and a throw from the
     // breadcrumb path would be rethrown as a failed kill.
-    recordSelfInitiatedTreeKill({
-      pid: pgid,
-      site: 'posix-pty-process-group-sweep',
-      scope: 'posix-process-group'
-    })
+    if (signal === 'SIGKILL') {
+      recordSelfInitiatedTreeKill({
+        pid: pgid,
+        site: 'posix-pty-process-group-sweep',
+        scope: 'posix-process-group'
+      })
+    }
   }
   if (firstError !== undefined) {
     throw firstError
diff --git a/src/main/pty/wsl-orca-env.test.ts b/src/main/pty/wsl-orca-env.test.ts
index e56146ea9915..1df30613076a 100644
--- a/src/main/pty/wsl-orca-env.test.ts
+++ b/src/main/pty/wsl-orca-env.test.ts
@@ -62,6 +62,7 @@ describe('addOrcaWslInteropEnv', () => {
       ORCA_TERMINAL_HANDLE: 'term_wsl',
       ORCA_USER_DATA_PATH: 'C:\\Users\\jin\\AppData\\Roaming\\Orca',
       ORCA_CLI_COMMAND: 'orca-ide',
+      ORCA_WSL_CLI_DIR: 'C:\\Users\\jin\\AppData\\Roaming\\Orca\\wsl-managed-cli\\hash',
       ORCA_CODEX_LAUNCH_PREFLIGHT: 'C:\\Program Files\\Orca\\resources\\bin\\orca.exe',
       ORCA_OMP_FRESH_CONFIG: 'C:\\Orca\\fresh-session.yml',
       ORCA_OMP_STATUS_EXTENSION: 'C:\\Users\\jin\\.omp\\agent\\extensions\\orca-agent-status.ts',
@@ -87,6 +88,7 @@ describe('addOrcaWslInteropEnv', () => {
     expect(env.WSLENV).toContain('ORCA_TERMINAL_HANDLE/u')
     expect(env.WSLENV).toContain('ORCA_USER_DATA_PATH/p')
     expect(env.WSLENV).toContain('ORCA_CLI_COMMAND/u')
+    expect(env.WSLENV).toContain('ORCA_WSL_CLI_DIR/p')
     expect(env.WSLENV).toContain('ORCA_CODEX_LAUNCH_PREFLIGHT/p')
     expect(env.WSLENV).toContain('ORCA_OMP_STATUS_EXTENSION/p')
     expect(env.WSLENV).toContain('ORCA_OMP_FRESH_CONFIG/p')
diff --git a/src/main/pty/wsl-orca-env.ts b/src/main/pty/wsl-orca-env.ts
index 04035a957ca3..b3047fd8a27f 100644
--- a/src/main/pty/wsl-orca-env.ts
+++ b/src/main/pty/wsl-orca-env.ts
@@ -79,6 +79,8 @@ export function addOrcaWslInteropEnv(env: Record<string, string>): void {
     // and it cannot derive the hash segment from ORCA_USER_DATA_PATH alone.
     'ORCA_SHELL_READY_ROOT/p',
     'ORCA_CLI_COMMAND/u',
+    // Why /p: the managed CLI launcher lives in the host's userData tree.
+    'ORCA_WSL_CLI_DIR/p',
     'ORCA_CODEX_LAUNCH_PREFLIGHT/p',
     'ORCA_PANE_KEY/u',
     'ORCA_TAB_ID/u',
diff --git a/src/main/qoder/hook-service.test.ts b/src/main/qoder/hook-service.test.ts
new file mode 100644
index 000000000000..7f1d2674f9cb
--- /dev/null
+++ b/src/main/qoder/hook-service.test.ts
@@ -0,0 +1,92 @@
+import { mkdtempSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import type * as OsModule from 'node:os'
+import { join } from 'node:path'
+import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest'
+const sandbox = vi.hoisted(() => ({ home: '' }))
+vi.mock('node:os', async (importOriginal) => ({
+  ...(await importOriginal<typeof OsModule>()),
+  homedir: () => sandbox.home
+}))
+vi.mock('electron', () => ({ app: { getPath: () => sandbox.home } }))
+import { getManagedLifecycleHook, hasSameManagedHookInvocation } from '../claude/hook-settings'
+import { createManagedCommandMatcher } from '../agent-hooks/installer-utils'
+import { qoderHookService, QODER_HOOK_EVENTS } from './hook-service'
+import { markQoderWorkspaceTrusted, withQoderTrustedWorkspace } from './workspace-trust'
+
+beforeAll(() => {
+  sandbox.home = mkdtempSync(join(tmpdir(), 'orca-qoder-test-'))
+  mkdirSync(join(sandbox.home, '.qoder'))
+})
+afterAll(() => {
+  rmSync(sandbox.home, { recursive: true, force: true })
+})
+
+describe('Qoder managed configuration', () => {
+  it('preserves user hooks and trust, installs idempotently, then removes only Orca hooks', () => {
+    const path = join(sandbox.home, '.qoder', 'settings.json')
+    const userHook = { hooks: [{ type: 'command', command: 'echo user-hook' }] }
+    writeFileSync(
+      path,
+      JSON.stringify({
+        model: 'custom',
+        hooks: { Stop: [userHook] },
+        permissions: { trustDirectories: ['/existing'] }
+      })
+    )
+    expect(qoderHookService.install().state).toBe('installed')
+    expect(qoderHookService.install().state).toBe('installed')
+    const installed = JSON.parse(readFileSync(path, 'utf8'))
+    for (const event of QODER_HOOK_EVENTS) {
+      expect(installed.hooks[event]).toHaveLength(event === 'Stop' ? 2 : 1)
+    }
+    expect(installed.hooks.TeammateIdle).toBeUndefined()
+    expect(installed.statusLine).toBeUndefined()
+    markQoderWorkspaceTrusted('/new-workspace')
+    const trusted = JSON.parse(readFileSync(path, 'utf8'))
+    expect(trusted.permissions.trustDirectories).toEqual(['/existing', '/new-workspace'])
+    expect(trusted.hooks).toEqual(installed.hooks)
+    expect(qoderHookService.remove().state).toBe('not_installed')
+    expect(JSON.parse(readFileSync(path, 'utf8'))).toMatchObject({
+      model: 'custom',
+      hooks: { Stop: [userHook] }
+    })
+  })
+
+  it('refuses malformed settings instead of overwriting them', () => {
+    const path = join(sandbox.home, '.qoder', 'settings.json')
+    writeFileSync(path, '{broken')
+    expect(qoderHookService.install().state).toBe('error')
+    markQoderWorkspaceTrusted('/new-workspace')
+    expect(readFileSync(path, 'utf8')).toBe('{broken')
+    expect(withQoderTrustedWorkspace({ permissions: 'invalid' }, '/workspace')).toBeNull()
+    expect(
+      withQoderTrustedWorkspace({ permissions: { trustDirectories: true } }, '/workspace')
+    ).toBeNull()
+  })
+})
+
+describe('Qoder Windows hook shell', () => {
+  it('uses the documented explicit shell without relying on Git Bash or another PowerShell hop', () => {
+    vi.spyOn(process, 'platform', 'get').mockReturnValue('win32')
+    try {
+      const hook = getManagedLifecycleHook(
+        'C:\\Users\\a b\\.orca\\agent-hooks\\qoder-hook.cmd',
+        {
+          configDirName: '.qoder',
+          scriptBaseName: 'qoder-hook',
+          usesWindowsCompatLauncher: true,
+          windowsHookShell: 'powershell'
+        },
+        { gitBashAvailable: true }
+      )
+      expect(hook.shell).toBe('powershell')
+      expect(hook.command).toContain('$env:USERPROFILE')
+      expect(hook.command).not.toMatch(/EncodedCommand|ExecutionPolicy|\|\|/)
+      expect(createManagedCommandMatcher('qoder-hook.cmd')(hook.command)).toBe(true)
+      expect(hasSameManagedHookInvocation({ ...hook, shell: undefined }, hook)).toBe(false)
+    } finally {
+      vi.restoreAllMocks()
+    }
+  })
+})
diff --git a/src/main/qoder/hook-service.ts b/src/main/qoder/hook-service.ts
new file mode 100644
index 000000000000..d6950ef32359
--- /dev/null
+++ b/src/main/qoder/hook-service.ts
@@ -0,0 +1,29 @@
+import { ClaudeHookService } from '../claude/hook-service'
+
+// Qoder documents Claude-shaped hooks at https://docs.qoder.com/cli/hooks.
+export const QODER_HOOK_EVENTS = [
+  'SessionStart',
+  'SessionEnd',
+  'UserPromptSubmit',
+  'PreToolUse',
+  'PostToolUse',
+  'PostToolUseFailure',
+  'PermissionRequest',
+  'Stop',
+  'StopFailure',
+  'Notification',
+  'PostCompact'
+] as const
+
+export const qoderHookService = new ClaudeHookService({
+  agent: 'qoder',
+  source: 'qoder',
+  displayName: 'Qoder CLI',
+  settings: {
+    configDirName: '.qoder',
+    scriptBaseName: 'qoder-hook',
+    usesWindowsCompatLauncher: true,
+    windowsHookShell: 'powershell'
+  },
+  events: QODER_HOOK_EVENTS.map((eventName) => ({ eventName, definition: {} }))
+})
diff --git a/src/main/qoder/workspace-trust.ts b/src/main/qoder/workspace-trust.ts
new file mode 100644
index 000000000000..2a834f7cbcb0
--- /dev/null
+++ b/src/main/qoder/workspace-trust.ts
@@ -0,0 +1,78 @@
+import { realpathSync } from 'node:fs'
+import { homedir } from 'node:os'
+import { join, posix } from 'node:path'
+import { isPlainObject, readHooksJson, writeHooksJson } from '../agent-hooks/installer-utils'
+import { parseHooksJsonText } from '../agent-hooks/hooks-json-read'
+import { isENOENT } from '../ipc/filesystem-path-containment'
+import type { IFilesystemProvider } from '../providers/types'
+
+// Qoder 1.1.64 writes this exact shape after accepting its folder-trust prompt.
+export function withQoderTrustedWorkspace(
+  config: Record<string, unknown>,
+  workspacePath: string
+): Record<string, unknown> | null {
+  if (config.permissions !== undefined && !isPlainObject(config.permissions)) {
+    return null
+  }
+  const permissions = isPlainObject(config.permissions) ? config.permissions : {}
+  if (permissions.trustDirectories !== undefined && !Array.isArray(permissions.trustDirectories)) {
+    return null
+  }
+  const existing = Array.isArray(permissions.trustDirectories) ? permissions.trustDirectories : []
+  if (existing.includes(workspacePath)) {
+    return config
+  }
+  return {
+    ...config,
+    permissions: { ...permissions, trustDirectories: [...existing, workspacePath] }
+  }
+}
+
+export function markQoderWorkspaceTrusted(workspacePath: string): void {
+  let canonicalPath = workspacePath
+  try {
+    canonicalPath = realpathSync.native(workspacePath)
+  } catch {
+    /* Keep the supplied path when absent. */
+  }
+  const configPath = join(homedir(), '.qoder', 'settings.json')
+  const config = readHooksJson(configPath)
+  if (!config) {
+    return
+  }
+  const updated = withQoderTrustedWorkspace(config, canonicalPath)
+  if (updated && updated !== config) {
+    writeHooksJson(configPath, updated)
+  }
+}
+
+export async function markRemoteQoderWorkspaceTrusted(
+  fsProvider: IFilesystemProvider,
+  remoteHome: string,
+  workspacePath: string
+): Promise<void> {
+  const configDir = posix.join(remoteHome, '.qoder')
+  const configPath = posix.join(configDir, 'settings.json')
+  let config: Record<string, unknown> | null
+  try {
+    const result = await fsProvider.readFile(configPath)
+    if (result.isBinary) {
+      return
+    }
+    config = parseHooksJsonText(result.content)
+  } catch (error) {
+    if (!isENOENT(error)) {
+      return
+    }
+    config = {}
+  }
+  if (!config) {
+    return
+  }
+  const updated = withQoderTrustedWorkspace(config, workspacePath)
+  if (!updated || updated === config) {
+    return
+  }
+  await fsProvider.createDir(configDir)
+  await fsProvider.writeFile(configPath, `${JSON.stringify(updated, null, 2)}\n`)
+}
diff --git a/src/main/quit-path-durable-write-blocking.test.ts b/src/main/quit-path-durable-write-blocking.test.ts
index 5d09e2057a70..11bea685c7e0 100644
--- a/src/main/quit-path-durable-write-blocking.test.ts
+++ b/src/main/quit-path-durable-write-blocking.test.ts
@@ -1,10 +1,11 @@
+import { createWorkerMaintenanceFixture } from './persistence/loading-store/profile-state-maintenance-fixture'
+import type { Store } from './persistence/loading-store/store'
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
 import { mkdtempSync, readFileSync, existsSync, rmSync, utimesSync, writeFileSync } from 'node:fs'
 import type * as NodeFs from 'node:fs'
 import type * as NodeFsPromises from 'node:fs/promises'
 import { join } from 'node:path'
 import { tmpdir } from 'node:os'
-import { installFakeAppEnvironment } from '../../config/scripts/vitest-host-ports-setup'
 
 // Why these tests exist: will-quit used to run stats.flush() and store.flush() synchronously,
 // before preventDefault(). On a stalled network profile mount those fsync/rename syscalls park
@@ -108,37 +109,68 @@ vi.mock('electron', () => ({
   }
 }))
 
-type TestStore = {
-  updateUI(updates: { sidebarWidth?: number; activeView?: string }): void
-  setGitHubCache(cache: unknown): void
-  waitForPendingWrite(): Promise<void>
-  flushAsync(): Promise<void>
-  flushOrThrow(): void
-  stageWorkspaceSessionBeforeUnload(session: Record<string, unknown>): void
-}
-
 type TestStatsCollector = {
   onAgentStart(ptyId: string, at: number, repo?: string, worktree?: string): void
   getSummary(): { totalAgentsSpawned: number; totalAgentTimeMs: number }
   flushAsync(): Promise<void>
 }
 
-async function createStore(dir: string): Promise<TestStore> {
+const profiles = new Map<string, Awaited<ReturnType<typeof createWorkerMaintenanceFixture>>>()
+const stores: Store[] = []
+const statsCollectors: TestStatsCollector[] = []
+const releases: (() => void)[] = []
+
+async function createStore(dir: string): Promise<Store> {
   testState.dir = dir
-  vi.resetModules()
-  const { Store, initDataPath } = await import('./persistence')
-  // Why: userData resolves through AppEnvironment; point it at this file's temp dir.
-  installFakeAppEnvironment({ getPath: () => testState.dir })
-  initDataPath()
-  return new Store() as unknown as TestStore
+  const fixture = await createWorkerMaintenanceFixture({ directory: dir, profileId: 'quit-test' })
+  profiles.set(dir, fixture)
+  stores.push(fixture.store)
+  fixture.store.updateUI({ activeView: 'terminal' })
+  await fixture.store.flushPendingOrThrowAsync()
+  await fixture.authority.drainBackups()
+  return fixture.store
+}
+
+function readState(dir: string) {
+  const profile = profiles.get(dir)
+  if (!profile) {
+    throw new Error('Missing test profile')
+  }
+  return profile.readState()
+}
+
+function stallFilesystem(): void {
+  const gate = Promise.withResolvers<void>()
+  releases.push(gate.resolve)
+  fsCalls.holdAsync = gate.promise
+}
+
+function stallCommit(dir: string) {
+  const profile = profiles.get(dir)
+  if (!profile) {
+    throw new Error('Missing test profile')
+  }
+  const started = Promise.withResolvers<void>()
+  const finish = Promise.withResolvers<void>()
+  releases.push(finish.resolve)
+  const original = profile.authority.writeCompleteSerializedDomains.bind(profile.authority)
+  vi.spyOn(profile.authority, 'writeCompleteSerializedDomains').mockImplementationOnce(
+    async (rows) => {
+      started.resolve()
+      await finish.promise
+      await original(rows)
+    }
+  )
+  return { started: started.promise, release: finish.resolve }
 }
 
 async function createStatsCollector(dir: string): Promise<TestStatsCollector> {
   testState.dir = dir
-  vi.resetModules()
   const { StatsCollector, initStatsPath } = await import('./stats/collector')
   initStatsPath()
-  return new StatsCollector() as unknown as TestStatsCollector
+  const stats = new StatsCollector()
+  statsCollectors.push(stats)
+  return stats
 }
 
 const dataFile = (dir: string): string => join(dir, 'orca-data.json')
@@ -165,8 +197,17 @@ describe('quit-path durable writes never park the main thread', () => {
     fsCalls.reset()
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    fsCalls.recording = false
+    for (const release of releases.splice(0)) {
+      release()
+    }
+    fsCalls.holdAsync = null
+    fsCalls.waitAsync = null
     vi.useRealTimers()
+    await Promise.all(stores.splice(0).map((store) => store.freezeWritesAsync()))
+    await Promise.all(statsCollectors.splice(0).map((stats) => stats.flushAsync()))
+    profiles.clear()
     for (const dir of dirs.splice(0)) {
       rmSync(dir, { recursive: true, force: true })
     }
@@ -183,7 +224,7 @@ describe('quit-path durable writes never park the main thread', () => {
     fsCalls.recording = false
 
     expect(fsCalls.syncCalls).toEqual([])
-    expect(JSON.parse(readFileSync(dataFile(dir), 'utf-8')).ui.sidebarWidth).toBe(321)
+    expect(readState(dir).ui.sidebarWidth).toBe(321)
   })
 
   it('renderer unload staging issues no synchronous fs syscalls', async () => {
@@ -194,6 +235,9 @@ describe('quit-path durable writes never park the main thread', () => {
     fsCalls.recording = true
     const leafId = '11111111-1111-4111-8111-111111111111'
     store.stageWorkspaceSessionBeforeUnload({
+      activeRepoId: null,
+      activeWorktreeId: null,
+      activeTabId: null,
       tabsByWorktree: {
         'remote-repo::/remote': [
           {
@@ -222,8 +266,7 @@ describe('quit-path durable writes never park the main thread', () => {
 
     expect(fsCalls.syncCalls).toEqual([])
     await store.flushAsync()
-    const layout = JSON.parse(readFileSync(dataFile(dir), 'utf-8')).workspaceSession
-      .terminalLayoutsByTabId['remote-tab']
+    const layout = readState(dir).workspaceSession.terminalLayoutsByTabId['remote-tab']
     const ref = layout.scrollbackRefsByLeafId[leafId]
     expect(layout.buffersByLeafId).toBeUndefined()
     expect(readFileSync(join(dir, 'terminal-scrollback', `${ref}.bin`), 'utf-8')).toBe(
@@ -239,7 +282,7 @@ describe('quit-path durable writes never park the main thread', () => {
     utimesSync(staleCacheTemp, staleSeconds, staleSeconds)
     const store = await createStore(dir)
     store.updateUI({ activeView: 'activity' })
-    store.setGitHubCache({ pullRequestsByWorktree: {} })
+    store.setGitHubCache({ pr: {}, issue: {} })
 
     fsCalls.dirPrefix = dir
     fsCalls.recording = true
@@ -270,7 +313,6 @@ describe('quit-path durable writes never park the main thread', () => {
     const dir = makeDir()
     const previousGrokHome = process.env.GROK_HOME
     process.env.GROK_HOME = dir
-    vi.resetModules()
     const { GrokHookService } = await import('./grok/hook-service')
     const service = new GrokHookService()
     try {
@@ -314,7 +356,7 @@ describe('quit-path durable writes never park the main thread', () => {
     stats.onAgentStart('pty-1', Date.now() - 4_000)
 
     fsCalls.dirPrefix = dir
-    fsCalls.holdAsync = new Promise(() => {})
+    stallFilesystem()
     const pending = stats.flushAsync()
 
     expect(stats.getSummary().totalAgentTimeMs).toBeGreaterThan(0)
@@ -327,9 +369,9 @@ describe('quit-path durable writes never park the main thread', () => {
     store.updateUI({ sidebarWidth: 654 })
 
     fsCalls.dirPrefix = dir
-    // Every fs call from here on never resolves — the mount is gone.
-    fsCalls.holdAsync = new Promise(() => {})
+    const gate = stallCommit(dir)
     const pending = store.flushAsync()
+    await gate.started
 
     // The whole point: timers still fire, so the app still repaints and the quit
     // deadline below can still be reached. A sync flush would have blocked here.
@@ -344,8 +386,10 @@ describe('quit-path durable writes never park the main thread', () => {
     store.updateUI({ sidebarWidth: 999 })
 
     fsCalls.dirPrefix = dir
-    fsCalls.holdAsync = new Promise(() => {})
+    const before = readState(dir).ui.sidebarWidth
+    const gate = stallCommit(dir)
     const pending = store.flushAsync()
+    await gate.started
 
     const outstanding = await settleTeardownWithinDeadline(
       [{ name: 'state', promise: pending }],
@@ -353,23 +397,28 @@ describe('quit-path durable writes never park the main thread', () => {
     )
 
     expect(outstanding).toEqual(['state'])
-    // Cut short before the rename, so the previous file is still whole — bounded loss, no corruption.
-    expect(existsSync(dataFile(dir))).toBe(false)
+    expect(readState(dir).ui.sidebarWidth).toBe(before)
+    gate.release()
+    await pending
+    expect(readState(dir).ui.sidebarWidth).toBe(999)
   })
 
   it('store.flushAsync() drains an in-flight debounced write before writing', async () => {
-    vi.useFakeTimers()
     const dir = makeDir()
     const store = await createStore(dir)
+    const gate = stallCommit(dir)
+    vi.useFakeTimers()
     store.updateUI({ sidebarWidth: 100 })
     await vi.advanceTimersByTimeAsync(1_000)
+    await gate.started
 
     store.updateUI({ sidebarWidth: 200 })
     const flushed = store.flushAsync()
-    await vi.runAllTimersAsync()
+    vi.useRealTimers()
+    gate.release()
     await flushed
 
-    expect(JSON.parse(readFileSync(dataFile(dir), 'utf-8')).ui.sidebarWidth).toBe(200)
+    expect(readState(dir).ui.sidebarWidth).toBe(200)
   })
 
   it('store.flushAsync() is one idempotent final barrier', async () => {
@@ -383,7 +432,7 @@ describe('quit-path durable writes never park the main thread', () => {
     expect(second).toBe(first)
     expect(() => store.flushOrThrow()).toThrow('final persistence')
     await first
-    expect(JSON.parse(readFileSync(dataFile(dir), 'utf-8')).ui.sidebarWidth).toBe(777)
+    expect(readState(dir).ui.sidebarWidth).toBe(777)
   })
 
   it('serializes github-cache snapshots and keeps the newest generation', async () => {
@@ -394,6 +443,7 @@ describe('quit-path durable writes never park the main thread', () => {
       releaseWrite = resolve
     })
     let signalWrite!: () => void
+    releases.push(releaseWrite)
     const writeStarted = new Promise<void>((resolve) => {
       signalWrite = resolve
     })
@@ -409,17 +459,18 @@ describe('quit-path durable writes never park the main thread', () => {
       return writeRelease
     }
 
-    store.setGitHubCache({ version: 1 })
+    store.setGitHubCache({ pr: { test: { data: null, fetchedAt: 1 } }, issue: {} })
     const finalFlush = store.flushAsync()
     await writeStarted
-    store.setGitHubCache({ version: 2 })
+    store.setGitHubCache({ pr: { test: { data: null, fetchedAt: 2 } }, issue: {} })
 
     releaseWrite()
     await finalFlush
     fsCalls.recording = false
 
     expect(JSON.parse(readFileSync(join(dir, 'orca-github-cache.json'), 'utf-8'))).toEqual({
-      version: 2
+      pr: { test: { data: null, fetchedAt: 2 } },
+      issue: {}
     })
   })
 
@@ -444,9 +495,9 @@ describe('quit-path durable writes never park the main thread', () => {
   it('the quit flush is the last write — later mutations do not schedule another', async () => {
     // A teardown step that touches the store would otherwise arm a debounced write with
     // nothing awaiting it, leaving a rename to race the process exit.
-    vi.useFakeTimers()
     const dir = makeDir()
     const store = await createStore(dir)
+    vi.useFakeTimers()
     store.updateUI({ sidebarWidth: 10 })
     await store.flushAsync()
 
@@ -457,11 +508,11 @@ describe('quit-path durable writes never park the main thread', () => {
     fsCalls.recording = false
 
     expect(fsCalls.syncCalls).toEqual([])
-    expect(JSON.parse(readFileSync(dataFile(dir), 'utf-8')).ui.sidebarWidth).toBe(10)
+    expect(readState(dir).ui.sidebarWidth).toBe(10)
     expect(JSON.parse(readFileSync(activeViewFile(dir), 'utf-8')).activeView).toBe('terminal')
   })
 
-  it('sweeps orphaned state and stats temp files before the final write', async () => {
+  it('sweeps orphaned state and stats temps while retaining fresh process temps', async () => {
     const dir = makeDir()
     const stateTemp = `${dataFile(dir)}.999999.1.orphan.tmp`
     const statsTemp = `${statsFile(dir)}.999999.1.orphan.tmp`
@@ -480,6 +531,7 @@ describe('quit-path durable writes never park the main thread', () => {
     await Promise.all([store.flushAsync(), stats.flushAsync()])
 
     expect(existsSync(stateTemp)).toBe(false)
+    expect(existsSync(dataFile(dir))).toBe(false)
     expect(existsSync(statsTemp)).toBe(false)
     expect(existsSync(freshOtherProcessTemp)).toBe(true)
   })
@@ -488,7 +540,13 @@ describe('quit-path durable writes never park the main thread', () => {
     const dir = makeDir()
     const store = await createStore(dir)
     store.updateUI({ sidebarWidth: 42 })
-    rmSync(dir, { recursive: true, force: true })
+    const profile = profiles.get(dir)
+    if (!profile) {
+      throw new Error('Missing test profile')
+    }
+    vi.spyOn(profile.authority, 'writeCompleteSerializedDomains').mockRejectedValueOnce(
+      new Error('profile mount rejected write')
+    )
 
     // It joins the teardown barrier; a rejection there is noise that must not cancel the quit.
     await expect(store.flushAsync()).resolves.toBeUndefined()
diff --git a/src/main/rate-limits/cursor-auth-paths.ts b/src/main/rate-limits/cursor-auth-paths.ts
new file mode 100644
index 000000000000..72a3006a8ae8
--- /dev/null
+++ b/src/main/rate-limits/cursor-auth-paths.ts
@@ -0,0 +1,34 @@
+import os from 'node:os'
+import { join } from 'node:path'
+
+/** Where a Cursor credential was found. */
+export type CursorAuthSource = 'keychain' | 'cli' | 'desktop'
+
+function cursorConfigRoot(source: Exclude<CursorAuthSource, 'keychain'>): string {
+  if (process.platform === 'darwin') {
+    return source === 'desktop'
+      ? join(os.homedir(), 'Library', 'Application Support', 'Cursor')
+      : join(os.homedir(), '.cursor')
+  }
+  if (process.platform === 'win32') {
+    const root = process.env.APPDATA?.trim() || join(os.homedir(), 'AppData', 'Roaming')
+    return join(root, 'Cursor')
+  }
+  const root = process.env.XDG_CONFIG_HOME?.trim() || join(os.homedir(), '.config')
+  return join(root, source === 'desktop' ? 'Cursor' : 'cursor')
+}
+
+/** Cursor IDE global storage; holds `cursorAuth/*` keys in an `ItemTable` row. */
+export function getCursorDesktopStateDbPath(): string {
+  return join(cursorConfigRoot('desktop'), 'User', 'globalStorage', 'state.vscdb')
+}
+
+/** Pre-2026.06 `cursor-agent` token file; newer CLIs keep the token in the OS keychain. */
+export function getCursorCliAuthPath(): string {
+  return join(cursorConfigRoot('cli'), 'auth.json')
+}
+
+/** `cursor-agent` settings file; its `authInfo` block carries the signed-in identity, never a token. */
+export function getCursorCliConfigPath(): string {
+  return join(cursorConfigRoot('cli'), 'cli-config.json')
+}
diff --git a/src/main/rate-limits/cursor-auth.test.ts b/src/main/rate-limits/cursor-auth.test.ts
new file mode 100644
index 000000000000..8280bf984cda
--- /dev/null
+++ b/src/main/rate-limits/cursor-auth.test.ts
@@ -0,0 +1,230 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+const keychainState = vi.hoisted<{ token: string | null; error: Error | null }>(() => ({
+  token: null,
+  error: null
+}))
+const files = vi.hoisted<() => Map<string, string | Error>>(() => {
+  const map = new Map<string, string | Error>()
+  return () => map
+})
+const desktopState = vi.hoisted<{
+  result: { status: string; profile?: unknown; error?: string }
+}>(() => ({ result: { status: 'missing' } }))
+
+vi.mock('../macos-keychain/generic-password', () => ({
+  readKeychainPassword: async () => {
+    if (keychainState.error) {
+      throw keychainState.error
+    }
+    return keychainState.token
+  }
+}))
+
+vi.mock('node:fs', () => ({
+  existsSync: (path: string) => files().has(path),
+  readFileSync: (path: string) => {
+    const entry = files().get(path)
+    if (entry instanceof Error) {
+      throw entry
+    }
+    if (entry === undefined) {
+      throw new Error('ENOENT')
+    }
+    return entry
+  }
+}))
+
+vi.mock('./cursor-desktop-state-db', () => ({
+  readCursorDesktopProfile: () => desktopState.result
+}))
+
+import { readCursorAuthSession, readCursorCliIdentity } from './cursor-auth'
+
+type JwtSegment = Record<string, unknown>
+
+function expiredJwt(sub: string): string {
+  const encode = (value: JwtSegment): string =>
+    Buffer.from(JSON.stringify(value)).toString('base64url')
+  return `${encode({ alg: 'RS256' })}.${encode({ sub, exp: 1_000 })}.signature`
+}
+
+function jwt(sub: string): string {
+  const encode = (value: JwtSegment): string =>
+    Buffer.from(JSON.stringify(value)).toString('base64url')
+  return `${encode({ alg: 'RS256' })}.${encode({ sub, exp: 2_000_000_000 })}.signature`
+}
+
+const CLI_AUTH = '/cli/auth.json'
+const CLI_CONFIG = '/cli/cli-config.json'
+const DESKTOP_DB = '/desktop/state.vscdb'
+const options = {
+  cliAuthPath: CLI_AUTH,
+  cliConfigPath: CLI_CONFIG,
+  desktopStateDbPath: DESKTOP_DB
+}
+
+const originalPlatform = process.platform
+
+function setPlatform(platform: NodeJS.Platform): void {
+  Object.defineProperty(process, 'platform', { value: platform, configurable: true })
+}
+
+beforeEach(() => {
+  // Why: the keychain source is macOS-only by an explicit platform check, so
+  // these cases must pin the platform rather than inherit the CI runner's.
+  setPlatform('darwin')
+  keychainState.token = null
+  keychainState.error = null
+  files().clear()
+  desktopState.result = { status: 'missing' }
+})
+
+afterEach(() => {
+  setPlatform(originalPlatform)
+  vi.restoreAllMocks()
+})
+
+describe('readCursorAuthSession', () => {
+  it('prefers the keychain session cursor-agent 2026.06+ writes', async () => {
+    keychainState.token = jwt('auth0|user_keychain')
+    files().set(CLI_AUTH, JSON.stringify({ accessToken: jwt('auth0|user_file') }))
+    const result = await readCursorAuthSession(options)
+    expect(result.status).toBe('ok')
+    expect(result.status === 'ok' && result.session.source).toBe('keychain')
+    expect(result.status === 'ok' && result.session.token.subject).toBe('auth0|user_keychain')
+  })
+
+  it('names the signed-in account from cli-config.json, which holds no token', async () => {
+    keychainState.token = jwt('auth0|user_1')
+    files().set(
+      CLI_CONFIG,
+      JSON.stringify({ authInfo: { email: 'dev@example.com', displayName: 'Dev' } })
+    )
+    const result = await readCursorAuthSession(options)
+    expect(result.status === 'ok' && result.session.email).toBe('dev@example.com')
+    expect(result.status === 'ok' && result.session.displayName).toBe('Dev')
+  })
+
+  it('falls back to the legacy CLI auth file when the keychain holds nothing', async () => {
+    files().set(CLI_AUTH, JSON.stringify({ accessToken: jwt('auth0|user_file') }))
+    const result = await readCursorAuthSession(options)
+    expect(result.status === 'ok' && result.session.source).toBe('cli')
+  })
+
+  it('falls back to Cursor IDE when no CLI session exists', async () => {
+    desktopState.result = {
+      status: 'ok',
+      profile: {
+        accessToken: jwt('auth0|user_ide'),
+        email: 'ide@example.com',
+        membershipType: 'pro',
+        subscriptionStatus: 'active'
+      }
+    }
+    const result = await readCursorAuthSession(options)
+    expect(result.status === 'ok' && result.session.source).toBe('desktop')
+    expect(result.status === 'ok' && result.session.membershipType).toBe('pro')
+  })
+
+  it('does not let a locked keychain hide a readable CLI session', async () => {
+    keychainState.error = new Error('User interaction is not allowed')
+    files().set(CLI_AUTH, JSON.stringify({ accessToken: jwt('auth0|user_file') }))
+    const result = await readCursorAuthSession(options)
+    expect(result.status === 'ok' && result.session.source).toBe('cli')
+  })
+
+  it('reports the first read failure when no source yields a session', async () => {
+    keychainState.error = new Error('User interaction is not allowed')
+    const result = await readCursorAuthSession(options)
+    expect(result).toEqual({
+      status: 'error',
+      error: 'Unable to read the Cursor login from the macOS Keychain'
+    })
+  })
+
+  it('reports signed out when nothing is stored anywhere', async () => {
+    expect(await readCursorAuthSession(options)).toEqual({ status: 'missing' })
+  })
+
+  it('treats a signed-out CLI auth file as missing, not as an error', async () => {
+    files().set(CLI_AUTH, JSON.stringify({}))
+    expect(await readCursorAuthSession(options)).toEqual({ status: 'missing' })
+  })
+
+  it('keeps the local auth path out of the surfaced error', async () => {
+    files().set(
+      CLI_AUTH,
+      new Error('EACCES: permission denied, open /Users/someone/.cursor/auth.json')
+    )
+    const result = await readCursorAuthSession(options)
+    expect(result).toEqual({ status: 'error', error: 'Unable to read the Cursor CLI auth file' })
+  })
+
+  it('reports invalid JSON distinctly from an unreadable file', async () => {
+    files().set(CLI_AUTH, '{ not json')
+    const result = await readCursorAuthSession(options)
+    expect(result).toEqual({ status: 'error', error: 'Cursor CLI auth file is invalid' })
+  })
+
+  it('prefers a live desktop session over an expired keychain one', async () => {
+    // Why: a user who signed the CLI in once and now works only in the IDE would
+    // otherwise be told "sign-in expired" forever while a usable session sat below.
+    keychainState.token = expiredJwt('auth0|user_stale')
+    desktopState.result = {
+      status: 'ok',
+      profile: {
+        accessToken: jwt('auth0|user_ide'),
+        email: 'ide@example.com',
+        membershipType: 'pro',
+        subscriptionStatus: 'active'
+      }
+    }
+    const result = await readCursorAuthSession(options)
+    expect(result.status === 'ok' && result.session.source).toBe('desktop')
+    expect(result.status === 'ok' && result.session.token.subject).toBe('auth0|user_ide')
+  })
+
+  it('still returns the expired session when no live one exists anywhere', async () => {
+    // Why: the expiry message is the actionable answer in that case.
+    keychainState.token = expiredJwt('auth0|user_stale')
+    const result = await readCursorAuthSession(options)
+    expect(result.status === 'ok' && result.session.source).toBe('keychain')
+  })
+
+  it('never reads the keychain off macOS and falls through to the CLI file', async () => {
+    setPlatform('linux')
+    keychainState.token = jwt('auth0|user_keychain')
+    files().set(CLI_AUTH, JSON.stringify({ accessToken: jwt('auth0|user_file') }))
+    const result = await readCursorAuthSession(options)
+    expect(result.status === 'ok' && result.session.source).toBe('cli')
+  })
+
+  it('reports signed out off macOS when only a keychain session exists', async () => {
+    setPlatform('win32')
+    keychainState.token = jwt('auth0|user_keychain')
+    expect(await readCursorAuthSession(options)).toEqual({ status: 'missing' })
+  })
+
+  it('skips a stored token that carries no subject', async () => {
+    keychainState.token = 'not-a-jwt'
+    expect(await readCursorAuthSession(options)).toEqual({ status: 'missing' })
+  })
+})
+
+describe('readCursorCliIdentity', () => {
+  it('returns empty identity for a config with no authInfo', () => {
+    files().set(CLI_CONFIG, JSON.stringify({ version: 1 }))
+    expect(readCursorCliIdentity(CLI_CONFIG)).toEqual({
+      email: null,
+      displayName: null,
+      membershipType: null,
+      subscriptionStatus: null
+    })
+  })
+
+  it('survives a corrupt config file', () => {
+    files().set(CLI_CONFIG, '{{{')
+    expect(readCursorCliIdentity(CLI_CONFIG).email).toBeNull()
+  })
+})
diff --git a/src/main/rate-limits/cursor-auth.ts b/src/main/rate-limits/cursor-auth.ts
new file mode 100644
index 000000000000..8ef86f0ba73c
--- /dev/null
+++ b/src/main/rate-limits/cursor-auth.ts
@@ -0,0 +1,211 @@
+import { existsSync, readFileSync } from 'node:fs'
+import { z } from 'zod'
+import { readKeychainPassword } from '../macos-keychain/generic-password'
+import {
+  getCursorCliAuthPath,
+  getCursorCliConfigPath,
+  getCursorDesktopStateDbPath,
+  type CursorAuthSource
+} from './cursor-auth-paths'
+import { readCursorDesktopProfile, type CursorDesktopProfile } from './cursor-desktop-state-db'
+import {
+  isCursorSessionTokenExpired,
+  parseCursorSessionToken,
+  type CursorSessionToken
+} from './cursor-session-token'
+
+// Why: cursor-agent 2026.06+ stores the session in the login keychain, not auth.json.
+const KEYCHAIN_SERVICE = 'cursor-access-token'
+const KEYCHAIN_ACCOUNT = 'cursor-user'
+
+export type CursorIdentity = {
+  email: string | null
+  displayName: string | null
+  membershipType: string | null
+  subscriptionStatus: string | null
+}
+
+export type CursorAuthSession = CursorIdentity & {
+  token: CursorSessionToken
+  source: CursorAuthSource
+}
+
+export type CursorAuthReadResult =
+  | { status: 'missing' }
+  | { status: 'error'; error: string }
+  | { status: 'ok'; session: CursorAuthSession }
+
+function emptyIdentity(): CursorIdentity {
+  return { email: null, displayName: null, membershipType: null, subscriptionStatus: null }
+}
+
+function nonEmpty(value: unknown): string | null {
+  return typeof value === 'string' && value.trim().length > 0 ? value.trim() : null
+}
+
+const cliConfigSchema = z.object({
+  authInfo: z.object({ email: z.unknown(), displayName: z.unknown() }).partial().optional()
+})
+
+const cliAuthFileSchema = z.object({ accessToken: z.unknown() }).partial()
+
+/** `cli-config.json` carries the signed-in identity for keychain-backed CLI sessions. */
+export function readCursorCliIdentity(configPath = getCursorCliConfigPath()): CursorIdentity {
+  if (!existsSync(configPath)) {
+    return emptyIdentity()
+  }
+  try {
+    const parsed = cliConfigSchema.safeParse(JSON.parse(readFileSync(configPath, 'utf8')))
+    if (!parsed.success) {
+      return emptyIdentity()
+    }
+    return {
+      ...emptyIdentity(),
+      email: nonEmpty(parsed.data.authInfo?.email),
+      displayName: nonEmpty(parsed.data.authInfo?.displayName)
+    }
+  } catch {
+    return emptyIdentity()
+  }
+}
+
+type TokenReadResult =
+  | { status: 'missing' }
+  | { status: 'error'; error: string }
+  | { status: 'ok'; token: string }
+
+async function readKeychainToken(): Promise<TokenReadResult> {
+  if (process.platform !== 'darwin') {
+    return { status: 'missing' }
+  }
+  try {
+    const token = await readKeychainPassword(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT)
+    return token ? { status: 'ok', token } : { status: 'missing' }
+  } catch {
+    // Why: a denied or locked keychain must not mask a readable auth.json below it.
+    return { status: 'error', error: 'Unable to read the Cursor login from the macOS Keychain' }
+  }
+}
+
+function readCliFileToken(authPath: string): TokenReadResult {
+  if (!existsSync(authPath)) {
+    return { status: 'missing' }
+  }
+  try {
+    const parsed = cliAuthFileSchema.safeParse(JSON.parse(readFileSync(authPath, 'utf8')))
+    const token = parsed.success ? parsed.data.accessToken : null
+    return typeof token === 'string' && token.length > 0
+      ? { status: 'ok', token }
+      : { status: 'missing' }
+  } catch (error) {
+    // Why: filesystem errors quote the full path; account state must not leak local usernames.
+    return {
+      status: 'error',
+      error:
+        error instanceof SyntaxError
+          ? 'Cursor CLI auth file is invalid'
+          : 'Unable to read the Cursor CLI auth file'
+    }
+  }
+}
+
+function sessionFrom(
+  raw: string,
+  source: CursorAuthSource,
+  identity: CursorIdentity
+): CursorAuthSession | null {
+  const token = parseCursorSessionToken(raw)
+  return token ? { ...identity, token, source } : null
+}
+
+function desktopIdentity(profile: CursorDesktopProfile): CursorIdentity {
+  return {
+    email: profile.email,
+    displayName: null,
+    membershipType: profile.membershipType,
+    subscriptionStatus: profile.subscriptionStatus
+  }
+}
+
+export type CursorAuthReadOptions = {
+  cliAuthPath?: string
+  cliConfigPath?: string
+  desktopStateDbPath?: string
+}
+
+/**
+ * Resolve the Cursor session Orca should poll with, preferring the CLI login
+ * (keychain, then legacy auth.json) over the Cursor IDE's own session. Read-only:
+ * Orca never writes, refreshes, or rotates the user's Cursor credentials.
+ */
+export async function readCursorAuthSession(
+  options: CursorAuthReadOptions = {}
+): Promise<CursorAuthReadResult> {
+  const cliAuthPath = options.cliAuthPath ?? getCursorCliAuthPath()
+  const cliConfigPath = options.cliConfigPath ?? getCursorCliConfigPath()
+  const desktopDbPath = options.desktopStateDbPath ?? getCursorDesktopStateDbPath()
+  const errors: string[] = []
+  // Why a live session wins over precedence: a user who signed the CLI in once and
+  // now works only in the IDE has an expired keychain token in front of a fresh
+  // desktop one. Returning the first token that parses would report "sign-in
+  // expired" forever while a usable session sat one source below.
+  let expired: CursorAuthSession | null = null
+  const takeLive = (session: CursorAuthSession | null): CursorAuthSession | null => {
+    if (!session) {
+      return null
+    }
+    if (isCursorSessionTokenExpired(session.token)) {
+      expired ??= session
+      return null
+    }
+    return session
+  }
+
+  const keychainRead = await readKeychainToken()
+  if (keychainRead.status === 'error') {
+    errors.push(keychainRead.error)
+  }
+  if (keychainRead.status === 'ok') {
+    const session = takeLive(
+      sessionFrom(keychainRead.token, 'keychain', readCursorCliIdentity(cliConfigPath))
+    )
+    if (session) {
+      return { status: 'ok', session }
+    }
+  }
+
+  const cliRead = readCliFileToken(cliAuthPath)
+  if (cliRead.status === 'error') {
+    errors.push(cliRead.error)
+  }
+  if (cliRead.status === 'ok') {
+    const session = takeLive(
+      sessionFrom(cliRead.token, 'cli', readCursorCliIdentity(cliConfigPath))
+    )
+    if (session) {
+      return { status: 'ok', session }
+    }
+  }
+
+  // Why not pushed to `errors`: the IDE holds a lock on state.vscdb while it runs,
+  // so a busy open is transient. Reporting it would pin an alert-triangle bar on
+  // every Cursor IDE user who never set Cursor up in Orca.
+  const desktopRead = readCursorDesktopProfile(desktopDbPath)
+  if (desktopRead.status === 'ok' && desktopRead.profile.accessToken) {
+    const session = takeLive(
+      sessionFrom(desktopRead.profile.accessToken, 'desktop', desktopIdentity(desktopRead.profile))
+    )
+    if (session) {
+      return { status: 'ok', session }
+    }
+  }
+
+  // Why still returned: with no live session anywhere, the expired one is what the
+  // user must act on, and the fetcher turns it into "run cursor-agent login".
+  if (expired) {
+    return { status: 'ok', session: expired }
+  }
+
+  const firstError = errors[0]
+  return firstError === undefined ? { status: 'missing' } : { status: 'error', error: firstError }
+}
diff --git a/src/main/rate-limits/cursor-desktop-state-db.ts b/src/main/rate-limits/cursor-desktop-state-db.ts
new file mode 100644
index 000000000000..bdc50c7390d6
--- /dev/null
+++ b/src/main/rate-limits/cursor-desktop-state-db.ts
@@ -0,0 +1,73 @@
+import { existsSync } from 'node:fs'
+import { z } from 'zod'
+import SyncDatabase from '../sqlite/sync-database'
+
+const TOKEN_KEY = 'cursorAuth/accessToken'
+const EMAIL_KEY = 'cursorAuth/cachedEmail'
+const MEMBERSHIP_KEY = 'cursorAuth/stripeMembershipType'
+const SUBSCRIPTION_KEY = 'cursorAuth/stripeSubscriptionStatus'
+const OPEN_TIMEOUT_MS = 250
+
+export type CursorDesktopProfile = {
+  accessToken: string | null
+  email: string | null
+  membershipType: string | null
+  subscriptionStatus: string | null
+}
+
+export type CursorDesktopProfileReadResult =
+  | { status: 'missing' }
+  | { status: 'error'; error: string }
+  | { status: 'ok'; profile: CursorDesktopProfile }
+
+const rowsSchema = z.array(z.object({ key: z.unknown(), value: z.unknown() }).partial())
+
+function valueAsString(value: unknown): string | null {
+  if (typeof value === 'string' && value.length > 0) {
+    return value
+  }
+  if (value instanceof Uint8Array) {
+    return Buffer.from(value).toString('utf8').trim() || null
+  }
+  return null
+}
+
+/** Reads the Cursor IDE's stored session. Opens read-only in place; state.vscdb can be multi-GB. */
+export function readCursorDesktopProfile(dbPath: string): CursorDesktopProfileReadResult {
+  if (!existsSync(dbPath)) {
+    return { status: 'missing' }
+  }
+  let db: SyncDatabase | null = null
+  try {
+    db = new SyncDatabase(dbPath, {
+      readonly: true,
+      fileMustExist: true,
+      timeout: OPEN_TIMEOUT_MS
+    })
+    const rows = rowsSchema.parse(
+      db
+        .prepare('SELECT key, value FROM ItemTable WHERE key IN (?, ?, ?, ?)')
+        .all(TOKEN_KEY, EMAIL_KEY, MEMBERSHIP_KEY, SUBSCRIPTION_KEY)
+    )
+    const byKey = new Map<string, string>()
+    for (const row of rows) {
+      const value = valueAsString(row.value)
+      if (typeof row.key === 'string' && value) {
+        byKey.set(row.key, value)
+      }
+    }
+    return {
+      status: 'ok',
+      profile: {
+        accessToken: byKey.get(TOKEN_KEY) ?? null,
+        email: byKey.get(EMAIL_KEY) ?? null,
+        membershipType: byKey.get(MEMBERSHIP_KEY) ?? null,
+        subscriptionStatus: byKey.get(SUBSCRIPTION_KEY) ?? null
+      }
+    }
+  } catch {
+    return { status: 'error', error: 'Unable to read the Cursor desktop login' }
+  } finally {
+    db?.close()
+  }
+}
diff --git a/src/main/rate-limits/cursor-fetcher.test.ts b/src/main/rate-limits/cursor-fetcher.test.ts
new file mode 100644
index 000000000000..b334713a9af8
--- /dev/null
+++ b/src/main/rate-limits/cursor-fetcher.test.ts
@@ -0,0 +1,217 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const netFetchMock = vi.hoisted(() => vi.fn())
+
+vi.mock('electron', () => ({ net: { fetch: netFetchMock } }))
+
+import { fetchCursorRateLimits } from './cursor-fetcher'
+import type { CursorAuthReadResult } from './cursor-auth'
+import { parseCursorSessionToken } from './cursor-session-token'
+
+type JwtSegment = Record<string, unknown>
+
+function jwt(exp: number): string {
+  const encode = (value: JwtSegment): string =>
+    Buffer.from(JSON.stringify(value)).toString('base64url')
+  return `${encode({ alg: 'RS256' })}.${encode({ sub: 'auth0|user_1', exp })}.signature`
+}
+
+function session(expSeconds = 4_000_000_000): CursorAuthReadResult {
+  return {
+    status: 'ok',
+    session: {
+      token: parseCursorSessionToken(jwt(expSeconds))!,
+      source: 'keychain',
+      email: 'dev@example.com',
+      displayName: 'Dev',
+      membershipType: null,
+      subscriptionStatus: null
+    }
+  }
+}
+
+type FakeResponse = Pick<Response, 'ok' | 'status'> & {
+  headers: Pick<Headers, 'get'>
+  json: () => Promise<unknown>
+}
+
+function fakeResponse(response: FakeResponse): Response {
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the fetcher only reads ok/status/headers.get/json, all of which FakeResponse provides.
+  return response as unknown as Response
+}
+
+function jsonResponse(body: unknown, status = 200, headers: Record<string, string> = {}): Response {
+  return fakeResponse({
+    ok: status >= 200 && status < 300,
+    status,
+    headers: { get: (name: string) => headers[name.toLowerCase()] ?? null },
+    json: async () => body
+  })
+}
+
+const SUMMARY = {
+  billingCycleStart: '2026-09-01T00:00:00.000Z',
+  billingCycleEnd: '2026-10-01T00:00:00.000Z',
+  membershipType: 'pro',
+  individualUsage: {
+    plan: { enabled: true, used: 2_500, limit: 5_000, autoPercentUsed: 40, apiPercentUsed: 12 }
+  }
+}
+
+beforeEach(() => {
+  netFetchMock.mockReset()
+})
+
+describe('fetchCursorRateLimits', () => {
+  it('publishes both plan pools and the cycle reset', async () => {
+    netFetchMock.mockResolvedValueOnce(jsonResponse(SUMMARY))
+    const limits = await fetchCursorRateLimits({ authReadResult: session() })
+    expect(limits.status).toBe('ok')
+    expect(limits.monthly?.usedPercent).toBe(50)
+    expect(limits.buckets?.map((bucket) => bucket.name)).toEqual(['Cursor Models', 'Other Models'])
+    expect(limits.planType).toBe('pro')
+    expect(limits.usageMetadata).toMatchObject({ source: 'cli', credentialSource: 'keychain' })
+  })
+
+  it('sends the origin headers the dashboard checks as CSRF defence', async () => {
+    netFetchMock.mockResolvedValueOnce(jsonResponse(SUMMARY))
+    await fetchCursorRateLimits({ authReadResult: session() })
+    const [url, init] = netFetchMock.mock.calls[0] ?? []
+    expect(url).toBe('https://cursor.com/api/usage-summary')
+    expect(init?.headers).toMatchObject({
+      Origin: 'https://cursor.com',
+      Referer: 'https://cursor.com/dashboard',
+      Cookie: expect.stringContaining('WorkosCursorSessionToken=auth0%7Cuser_1%3A%3A')
+    })
+  })
+
+  it('reports an expired session without spending a request that must 401', async () => {
+    const limits = await fetchCursorRateLimits({ authReadResult: session(1_000) })
+    expect(netFetchMock).not.toHaveBeenCalled()
+    expect(limits.status).toBe('error')
+    expect(limits.usageMetadata?.failureKind).toBe('stale-token')
+    expect(limits.error).toContain('cursor-agent login')
+  })
+
+  it('tells a signed-out user how to sign in, without painting an error bar', async () => {
+    const limits = await fetchCursorRateLimits({ authReadResult: { status: 'missing' } })
+    expect(limits.status).toBe('unavailable')
+    expect(limits.usageMetadata?.failureKind).toBe('missing-credentials')
+  })
+
+  it('surfaces a credential read failure', async () => {
+    const limits = await fetchCursorRateLimits({
+      authReadResult: { status: 'error', error: 'Unable to read the Cursor CLI auth file' }
+    })
+    expect(limits.status).toBe('error')
+    expect(limits.error).toBe('Unable to read the Cursor CLI auth file')
+  })
+
+  it('treats a rejected session as expired sign-in and records Retry-After on 429', async () => {
+    netFetchMock.mockResolvedValueOnce(jsonResponse({}, 401))
+    expect(
+      (await fetchCursorRateLimits({ authReadResult: session() })).usageMetadata?.failureKind
+    ).toBe('stale-token')
+
+    netFetchMock.mockResolvedValueOnce(jsonResponse({}, 429, { 'retry-after': '60' }))
+    const limited = await fetchCursorRateLimits({ authReadResult: session() })
+    expect(limited.usageMetadata?.failureKind).toBe('rate-limited')
+    expect(limited.usageMetadata?.retryAtMs).toBeGreaterThan(Date.now())
+  })
+
+  it('treats a redirect to the login page as an expired sign-in', async () => {
+    // Why: the dashboard bounces an unusable session to /login. With
+    // redirect:'error' that surfaced as a generic network failure, hiding the
+    // one message that tells the user what to do.
+    netFetchMock.mockResolvedValueOnce(jsonResponse({}, 302, { location: '/login' }))
+    const limits = await fetchCursorRateLimits({ authReadResult: session() })
+    expect(limits.usageMetadata?.failureKind).toBe('stale-token')
+    expect(limits.error).toContain('cursor-agent login')
+  })
+
+  it('names the account on failures too, so an account switch can clear stale figures', async () => {
+    // Why: the service drops a previous account's numbers only when the fresh
+    // result names an account. A switch whose first refresh fails is exactly when
+    // that matters, so every failure holding a readable session carries it.
+    const ok = jsonResponse(SUMMARY)
+    netFetchMock.mockResolvedValueOnce(ok)
+    const success = await fetchCursorRateLimits({ authReadResult: session() })
+    const fingerprint = success.usageMetadata?.authProvenance
+    expect(fingerprint).toBeTruthy()
+
+    for (const [status, headers] of [
+      [401, {}],
+      [429, { 'retry-after': '60' }],
+      [503, {}]
+    ] as const) {
+      netFetchMock.mockResolvedValueOnce(jsonResponse({}, status, headers))
+      const failure = await fetchCursorRateLimits({ authReadResult: session() })
+      expect(failure.status).toBe('error')
+      expect(failure.usageMetadata?.authProvenance).toBe(fingerprint)
+    }
+
+    const expired = await fetchCursorRateLimits({ authReadResult: session(1_000) })
+    expect(expired.usageMetadata?.authProvenance).toBe(fingerprint)
+  })
+
+  it('leaves the account unnamed when no session could be read', async () => {
+    const missing = await fetchCursorRateLimits({ authReadResult: { status: 'missing' } })
+    expect(missing.usageMetadata?.authProvenance).toBeUndefined()
+  })
+
+  it('reports a server failure with its status code', async () => {
+    netFetchMock.mockResolvedValueOnce(jsonResponse({}, 503))
+    const limits = await fetchCursorRateLimits({ authReadResult: session() })
+    expect(limits.error).toBe('Cursor usage request failed (HTTP 503)')
+    expect(limits.usageMetadata?.failureKind).toBe('server')
+  })
+
+  it('classifies an unparseable body as a parse failure, not as usage', async () => {
+    netFetchMock.mockResolvedValueOnce(
+      fakeResponse({
+        ok: true,
+        status: 200,
+        headers: { get: () => null },
+        json: async () => {
+          throw new Error('invalid json')
+        }
+      })
+    )
+    const limits = await fetchCursorRateLimits({ authReadResult: session() })
+    expect(limits.usageMetadata?.failureKind).toBe('parse')
+  })
+
+  it('publishes an unlimited plan with no misleading bar', async () => {
+    netFetchMock.mockResolvedValueOnce(jsonResponse({ isUnlimited: true, membershipType: 'ultra' }))
+    const limits = await fetchCursorRateLimits({ authReadResult: session() })
+    expect(limits.status).toBe('ok')
+    expect(limits.monthly).toBeUndefined()
+    expect(limits.planType).toBe('ultra')
+  })
+
+  it('falls back to the request-quota endpoint before declaring no allowance', async () => {
+    netFetchMock
+      .mockResolvedValueOnce(jsonResponse({ membershipType: 'free' }))
+      .mockResolvedValueOnce(jsonResponse({ 'gpt-4': { numRequests: 25, maxRequestUsage: 50 } }))
+    const limits = await fetchCursorRateLimits({ authReadResult: session() })
+    expect(limits.status).toBe('ok')
+    expect(limits.monthly?.usedPercent).toBe(50)
+    expect(netFetchMock.mock.calls[1]?.[0]).toBe('https://cursor.com/api/usage?user=auth0%7Cuser_1')
+  })
+
+  it('hides the bar for an account with no quota rather than alerting forever', async () => {
+    netFetchMock
+      .mockResolvedValueOnce(jsonResponse({ membershipType: 'free' }))
+      .mockResolvedValueOnce(jsonResponse({}))
+    const limits = await fetchCursorRateLimits({ authReadResult: session() })
+    expect(limits.status).toBe('unavailable')
+    expect(limits.usageMetadata?.failureKind).toBe('usage-unavailable')
+  })
+
+  it('reports a network failure without leaking the request internals', async () => {
+    netFetchMock.mockRejectedValueOnce(new Error('getaddrinfo ENOTFOUND cursor.com'))
+    const limits = await fetchCursorRateLimits({ authReadResult: session() })
+    expect(limits.error).toBe('Cursor usage request failed')
+    expect(limits.usageMetadata?.failureKind).toBe('network')
+  })
+})
diff --git a/src/main/rate-limits/cursor-fetcher.ts b/src/main/rate-limits/cursor-fetcher.ts
new file mode 100644
index 000000000000..d188127a19a6
--- /dev/null
+++ b/src/main/rate-limits/cursor-fetcher.ts
@@ -0,0 +1,251 @@
+import { createHash } from 'node:crypto'
+import { net } from 'electron'
+import type { ProviderRateLimits, UsageRateLimitSource } from '../../shared/rate-limit-types'
+import {
+  readCursorAuthSession,
+  type CursorAuthReadResult,
+  type CursorAuthSession
+} from './cursor-auth'
+import { cursorSessionCookie, isCursorSessionTokenExpired } from './cursor-session-token'
+import {
+  mapCursorLegacyRequestQuota,
+  mapCursorUsageSummary,
+  parseCursorUsageSummary
+} from './cursor-usage-mapping'
+
+const DASHBOARD_ORIGIN = 'https://cursor.com'
+const USAGE_SUMMARY_URL = `${DASHBOARD_ORIGIN}/api/usage-summary`
+const LEGACY_USAGE_URL = `${DASHBOARD_ORIGIN}/api/usage`
+const API_TIMEOUT_MS = 10_000
+
+const SIGNED_OUT_MESSAGE =
+  'No Cursor sign-in on this computer — sign in with Cursor IDE or `cursor-agent login`'
+const EXPIRED_MESSAGE = 'Cursor sign-in expired — run `cursor-agent login` again'
+
+function usageSource(session: CursorAuthSession): UsageRateLimitSource {
+  return session.source === 'desktop' ? 'web' : 'cli'
+}
+
+/**
+ * Stable, non-secret fingerprint of the signed-in account. Hashed because this
+ * rides `usageMetadata` into the renderer and mobile snapshots, where the raw
+ * WorkOS subject would be an account identifier nobody needs to see. Readers
+ * only compare it, so a digest is enough.
+ */
+function accountFingerprint(session: CursorAuthSession): string {
+  return createHash('sha256').update(session.token.subject).digest('hex').slice(0, 12)
+}
+
+function result(
+  status: ProviderRateLimits['status'],
+  error: string | null,
+  extra: Partial<ProviderRateLimits> = {}
+): ProviderRateLimits {
+  return {
+    provider: 'cursor',
+    session: null,
+    weekly: null,
+    updatedAt: Date.now(),
+    error,
+    status,
+    ...extra
+  }
+}
+
+/**
+ * Dashboard routes answer 403 to a bare session cookie — they check the request
+ * origin as CSRF defence. Sending what the dashboard itself sends is what they
+ * expect; without these headers every /api route fails on a valid session.
+ */
+function requestHeaders(session: CursorAuthSession): Record<string, string> {
+  return {
+    Cookie: cursorSessionCookie(session.token),
+    Accept: 'application/json',
+    Origin: DASHBOARD_ORIGIN,
+    Referer: `${DASHBOARD_ORIGIN}/dashboard`
+  }
+}
+
+type FetchOutcome = { kind: 'data'; data: unknown } | { kind: 'result'; result: ProviderRateLimits }
+
+async function fetchDashboardJson(
+  url: string,
+  session: CursorAuthSession,
+  signal?: AbortSignal
+): Promise<FetchOutcome> {
+  const source = usageSource(session)
+  // Why on failures too: the account-switch guard downstream can only drop a
+  // previous account's figures when the fresh result names an account, and a
+  // switch whose first refresh 401s or 5xxs is exactly when it must.
+  const provenance = accountFingerprint(session)
+  const requestSignal = signal
+    ? AbortSignal.any([signal, AbortSignal.timeout(API_TIMEOUT_MS)])
+    : AbortSignal.timeout(API_TIMEOUT_MS)
+  const res = await net.fetch(url, {
+    // Why manual: the dashboard bounces an unusable session to /login, and
+    // 'error' would surface that as a generic network failure instead of the
+    // actionable sign-in message below.
+    redirect: 'manual',
+    headers: requestHeaders(session),
+    signal: requestSignal
+  })
+  if (res.status === 401 || res.status === 403 || (res.status >= 300 && res.status < 400)) {
+    return {
+      kind: 'result',
+      result: result('error', EXPIRED_MESSAGE, {
+        usageMetadata: {
+          source,
+          credentialSource: session.source,
+          authProvenance: provenance,
+          failureKind: 'stale-token'
+        }
+      })
+    }
+  }
+  if (res.status === 429) {
+    const retryAfterSeconds = Number(res.headers.get('retry-after'))
+    return {
+      kind: 'result',
+      result: result('error', 'Cursor usage is rate limited right now', {
+        usageMetadata: {
+          source,
+          credentialSource: session.source,
+          authProvenance: provenance,
+          failureKind: 'rate-limited',
+          ...(Number.isFinite(retryAfterSeconds) && retryAfterSeconds > 0
+            ? { retryAtMs: Date.now() + retryAfterSeconds * 1000 }
+            : {})
+        }
+      })
+    }
+  }
+  if (!res.ok) {
+    return {
+      kind: 'result',
+      result: result('error', `Cursor usage request failed (HTTP ${res.status})`, {
+        usageMetadata: {
+          source,
+          credentialSource: session.source,
+          authProvenance: provenance,
+          failureKind: 'server'
+        }
+      })
+    }
+  }
+  try {
+    return { kind: 'data', data: await res.json() }
+  } catch {
+    return {
+      kind: 'result',
+      result: result('error', 'Cursor usage response could not be parsed', {
+        usageMetadata: {
+          source,
+          credentialSource: session.source,
+          authProvenance: provenance,
+          failureKind: 'parse'
+        }
+      })
+    }
+  }
+}
+
+function credentialFailure(readResult: CursorAuthReadResult): ProviderRateLimits | null {
+  if (readResult.status === 'missing') {
+    return result('unavailable', SIGNED_OUT_MESSAGE, {
+      usageMetadata: { failureKind: 'missing-credentials' }
+    })
+  }
+  if (readResult.status === 'error') {
+    return result('error', readResult.error, {
+      usageMetadata: { failureKind: 'missing-credentials' }
+    })
+  }
+  // Why: cursor-agent refreshes its own token on use; Orca only reads, so a
+  // lapsed session is reported instead of spending a request that must 401.
+  if (isCursorSessionTokenExpired(readResult.session.token)) {
+    return result('error', EXPIRED_MESSAGE, {
+      usageMetadata: {
+        source: usageSource(readResult.session),
+        credentialSource: readResult.session.source,
+        authProvenance: accountFingerprint(readResult.session),
+        failureKind: 'stale-token'
+      }
+    })
+  }
+  return null
+}
+
+/**
+ * Reads the Cursor plan allowance for the account this machine is signed into.
+ * Orca never runs `cursor-agent login` and never writes Cursor's credentials.
+ */
+export async function fetchCursorRateLimits(
+  options: { signal?: AbortSignal; authReadResult?: CursorAuthReadResult } = {}
+): Promise<ProviderRateLimits> {
+  const readResult = options.authReadResult ?? (await readCursorAuthSession())
+  const failure = credentialFailure(readResult)
+  if (failure || readResult.status !== 'ok') {
+    return failure ?? result('unavailable', SIGNED_OUT_MESSAGE)
+  }
+  const session = readResult.session
+  const source = usageSource(session)
+  const metadata = {
+    source,
+    credentialSource: session.source,
+    authProvenance: accountFingerprint(session)
+  }
+
+  try {
+    const outcome = await fetchDashboardJson(USAGE_SUMMARY_URL, session, options.signal)
+    if (outcome.kind === 'result') {
+      return outcome.result
+    }
+    const mapped = mapCursorUsageSummary(parseCursorUsageSummary(outcome.data))
+
+    // Why: an unlimited plan has no ceiling to divide by. Publish the plan so the
+    // roster still lists the account, with no misleading bar.
+    if (mapped.isUnlimited) {
+      return result('ok', null, { planType: mapped.planType, usageMetadata: metadata })
+    }
+    if (mapped.monthly || mapped.buckets.length > 0) {
+      return result('ok', null, {
+        ...(mapped.monthly ? { monthly: mapped.monthly } : {}),
+        ...(mapped.buckets.length > 0 ? { buckets: mapped.buckets } : {}),
+        planType: mapped.planType,
+        usageMetadata: metadata
+      })
+    }
+
+    // Why: accounts still on request-quota billing report nothing under
+    // individualUsage, so try the older per-model endpoint before concluding
+    // the account has no visible quota.
+    const legacy = await fetchDashboardJson(
+      `${LEGACY_USAGE_URL}?user=${encodeURIComponent(session.token.subject)}`,
+      session,
+      options.signal
+    )
+    if (legacy.kind === 'result') {
+      return legacy.result
+    }
+    const legacyWindow = mapCursorLegacyRequestQuota(legacy.data)
+    if (legacyWindow) {
+      return result('ok', null, {
+        monthly: legacyWindow,
+        planType: mapped.planType,
+        usageMetadata: metadata
+      })
+    }
+
+    // Why: a 200 with no allowance means the plan exposes no quota (API-key or
+    // team-billed accounts). 'unavailable' hides the bar the way Claude does on
+    // API-key billing; 'error' would paint a permanent alert for a healthy account.
+    return result('unavailable', 'Cursor reported no usage allowance for this account', {
+      planType: mapped.planType,
+      usageMetadata: { ...metadata, failureKind: 'usage-unavailable' }
+    })
+  } catch {
+    return result('error', 'Cursor usage request failed', {
+      usageMetadata: { ...metadata, failureKind: 'network' }
+    })
+  }
+}
diff --git a/src/main/rate-limits/cursor-session-token.test.ts b/src/main/rate-limits/cursor-session-token.test.ts
new file mode 100644
index 000000000000..61bb7d8221a4
--- /dev/null
+++ b/src/main/rate-limits/cursor-session-token.test.ts
@@ -0,0 +1,64 @@
+import { describe, expect, it } from 'vitest'
+import {
+  cursorSessionCookie,
+  isCursorSessionTokenExpired,
+  parseCursorSessionToken
+} from './cursor-session-token'
+
+type JwtSegment = Record<string, unknown>
+
+function jwt(payload: Record<string, unknown>): string {
+  const encode = (value: JwtSegment): string =>
+    Buffer.from(JSON.stringify(value)).toString('base64url')
+  return `${encode({ alg: 'RS256' })}.${encode(payload)}.signature`
+}
+
+describe('parseCursorSessionToken', () => {
+  it('reads the WorkOS subject and expiry from a cursor-agent session token', () => {
+    const token = parseCursorSessionToken(
+      jwt({ sub: 'auth0|user_01ABC', exp: 1_800_000_000, aud: 'https://cursor.com' })
+    )
+    expect(token?.subject).toBe('auth0|user_01ABC')
+    expect(token?.expiresAtMs).toBe(1_800_000_000_000)
+  })
+
+  it('rejects a token without a subject, which cannot address the dashboard', () => {
+    expect(parseCursorSessionToken(jwt({ exp: 1_800_000_000 }))).toBeNull()
+  })
+
+  it('rejects blank and malformed tokens instead of throwing', () => {
+    expect(parseCursorSessionToken('   ')).toBeNull()
+    expect(parseCursorSessionToken('not-a-jwt')).toBeNull()
+    expect(parseCursorSessionToken('a.!!!.c')).toBeNull()
+  })
+
+  it('leaves expiry null when the token omits exp', () => {
+    expect(parseCursorSessionToken(jwt({ sub: 'auth0|user_1' }))?.expiresAtMs).toBeNull()
+  })
+})
+
+describe('isCursorSessionTokenExpired', () => {
+  const token = parseCursorSessionToken(jwt({ sub: 'auth0|user_1', exp: 2_000 }))
+
+  it('reports a lapsed session', () => {
+    expect(isCursorSessionTokenExpired(token!, 2_000_001)).toBe(true)
+  })
+
+  it('reports a live session', () => {
+    expect(isCursorSessionTokenExpired(token!, 1_999_999)).toBe(false)
+  })
+
+  it('never expires a token with no exp claim', () => {
+    const noExpiry = parseCursorSessionToken(jwt({ sub: 'auth0|user_1' }))
+    expect(isCursorSessionTokenExpired(noExpiry!, Number.MAX_SAFE_INTEGER)).toBe(false)
+  })
+})
+
+describe('cursorSessionCookie', () => {
+  it('escapes the subject and joins it to the token the way the dashboard does', () => {
+    const token = parseCursorSessionToken(jwt({ sub: 'auth0|user_01ABC' }))
+    expect(cursorSessionCookie(token!)).toBe(
+      `WorkosCursorSessionToken=auth0%7Cuser_01ABC%3A%3A${token!.raw}`
+    )
+  })
+})
diff --git a/src/main/rate-limits/cursor-session-token.ts b/src/main/rate-limits/cursor-session-token.ts
new file mode 100644
index 000000000000..8db148c61fff
--- /dev/null
+++ b/src/main/rate-limits/cursor-session-token.ts
@@ -0,0 +1,57 @@
+import { z } from 'zod'
+
+const jwtPayloadSchema = z.object({ sub: z.unknown(), exp: z.unknown() }).partial()
+
+export type CursorSessionToken = {
+  raw: string
+  /** WorkOS subject (`auth0|user_…`), the first half of the dashboard session cookie. */
+  subject: string
+  expiresAtMs: number | null
+}
+
+function decodeJwtPayload(token: string): z.infer<typeof jwtPayloadSchema> | null {
+  const parts = token.split('.')
+  if (parts.length < 2 || !parts[1]) {
+    return null
+  }
+  try {
+    const base64 = parts[1].replace(/-/g, '+').replace(/_/g, '/')
+    const padded = base64 + '='.repeat((4 - (base64.length % 4)) % 4)
+    const parsed = jwtPayloadSchema.safeParse(
+      JSON.parse(Buffer.from(padded, 'base64').toString('utf8'))
+    )
+    return parsed.success ? parsed.data : null
+  } catch {
+    return null
+  }
+}
+
+export function parseCursorSessionToken(raw: string): CursorSessionToken | null {
+  const trimmed = raw.trim()
+  if (!trimmed) {
+    return null
+  }
+  const payload = decodeJwtPayload(trimmed)
+  const subject = payload?.sub
+  if (typeof subject !== 'string' || subject.trim().length === 0) {
+    return null
+  }
+  const exp = payload?.exp
+  return {
+    raw: trimmed,
+    subject: subject.trim(),
+    expiresAtMs: typeof exp === 'number' && Number.isFinite(exp) ? exp * 1000 : null
+  }
+}
+
+export function isCursorSessionTokenExpired(
+  token: CursorSessionToken,
+  nowMs: number = Date.now()
+): boolean {
+  return token.expiresAtMs !== null && token.expiresAtMs <= nowMs
+}
+
+/** Cookie the cursor.com dashboard sends: `<subject>::<jwt>`, URL-escaped. */
+export function cursorSessionCookie(token: CursorSessionToken): string {
+  return `WorkosCursorSessionToken=${encodeURIComponent(token.subject)}%3A%3A${token.raw}`
+}
diff --git a/src/main/rate-limits/cursor-usage-mapping.test.ts b/src/main/rate-limits/cursor-usage-mapping.test.ts
new file mode 100644
index 000000000000..8e1b5192fdee
--- /dev/null
+++ b/src/main/rate-limits/cursor-usage-mapping.test.ts
@@ -0,0 +1,182 @@
+import { describe, expect, it } from 'vitest'
+import {
+  mapCursorLegacyRequestQuota,
+  mapCursorUsageSummary,
+  parseCursorUsageSummary
+} from './cursor-usage-mapping'
+
+const CYCLE = {
+  billingCycleStart: '2026-09-01T00:00:00.000Z',
+  billingCycleEnd: '2026-10-01T00:00:00.000Z'
+}
+
+describe('mapCursorUsageSummary', () => {
+  it('maps both plan pools Cursor bills individual accounts from', () => {
+    const mapped = mapCursorUsageSummary({
+      ...CYCLE,
+      membershipType: 'pro',
+      individualUsage: {
+        plan: { enabled: true, used: 1_250, limit: 5_000, autoPercentUsed: 40, apiPercentUsed: 10 }
+      }
+    })
+    expect(mapped.planType).toBe('pro')
+    expect(mapped.buckets.map((bucket) => [bucket.name, bucket.usedPercent])).toEqual([
+      ['Cursor Models', 40],
+      ['Other Models', 10]
+    ])
+    expect(mapped.monthly?.usedPercent).toBe(25)
+    expect(mapped.monthly?.resetsAt).toBe(Date.parse(CYCLE.billingCycleEnd))
+  })
+
+  it('prefers the used/limit pair over the rounded percentage Cursor renders', () => {
+    const mapped = mapCursorUsageSummary({
+      ...CYCLE,
+      individualUsage: { plan: { enabled: true, used: 1_000, limit: 3_000, totalPercentUsed: 33 } }
+    })
+    expect(mapped.monthly?.usedPercent).toBeCloseTo(33.333, 3)
+  })
+
+  it('falls back to the percentage when no cents allowance is reported', () => {
+    const mapped = mapCursorUsageSummary({
+      ...CYCLE,
+      individualUsage: { plan: { enabled: true, totalPercentUsed: 62 } }
+    })
+    expect(mapped.monthly?.usedPercent).toBe(62)
+  })
+
+  it('adds an on-demand bucket only once the user has enabled on-demand spend', () => {
+    const disabled = mapCursorUsageSummary({
+      ...CYCLE,
+      individualUsage: {
+        plan: { enabled: true, totalPercentUsed: 5 },
+        onDemand: { used: 900, limit: 1_000 }
+      }
+    })
+    expect(disabled.buckets).toHaveLength(0)
+
+    const enabled = mapCursorUsageSummary({
+      ...CYCLE,
+      individualUsage: {
+        plan: { enabled: true, totalPercentUsed: 5 },
+        onDemand: { enabled: true, used: 900, limit: 1_000 }
+      }
+    })
+    expect(enabled.buckets).toEqual([
+      expect.objectContaining({ name: 'On-demand', usedPercent: 90 })
+    ])
+  })
+
+  it('clamps an over-consumed pool to 100% instead of overflowing the bar', () => {
+    const mapped = mapCursorUsageSummary({
+      ...CYCLE,
+      individualUsage: { plan: { enabled: true, used: 7_000, limit: 5_000 } }
+    })
+    expect(mapped.monthly?.usedPercent).toBe(100)
+  })
+
+  it('publishes no pools for a plan the account does not own', () => {
+    // Why: a team-billed account still reports 0% pools. Publishing them would
+    // paint a healthy 0% meter and skip the request-quota fallback.
+    const mapped = mapCursorUsageSummary({
+      ...CYCLE,
+      individualUsage: {
+        plan: { enabled: false, autoPercentUsed: 0, apiPercentUsed: 0, totalPercentUsed: 0 }
+      }
+    })
+    expect(mapped.buckets).toHaveLength(0)
+    expect(mapped.monthly).toBeNull()
+  })
+
+  it('reports an unlimited plan without inventing a percentage', () => {
+    const mapped = mapCursorUsageSummary({ ...CYCLE, isUnlimited: true, membershipType: 'ultra' })
+    expect(mapped.isUnlimited).toBe(true)
+    expect(mapped.monthly).toBeNull()
+    expect(mapped.buckets).toHaveLength(0)
+  })
+
+  it('accepts epoch seconds and milliseconds for the billing cycle', () => {
+    const seconds = mapCursorUsageSummary({
+      billingCycleEnd: 1_790_000_000,
+      individualUsage: { plan: { enabled: true, totalPercentUsed: 1 } }
+    })
+    const millis = mapCursorUsageSummary({
+      billingCycleEnd: 1_790_000_000_000,
+      individualUsage: { plan: { enabled: true, totalPercentUsed: 1 } }
+    })
+    expect(seconds.monthly?.resetsAt).toBe(1_790_000_000_000)
+    expect(millis.monthly?.resetsAt).toBe(1_790_000_000_000)
+  })
+
+  it('keeps the plan when a sibling pool arrives as null', () => {
+    // Why: the route sends `null` for an absent sub-object, and a stricter schema
+    // would drop the whole body — plan pools and billing cycle included.
+    const mapped = mapCursorUsageSummary(
+      parseCursorUsageSummary({
+        ...CYCLE,
+        membershipType: 'pro',
+        individualUsage: { plan: { enabled: true, totalPercentUsed: 40 }, onDemand: null }
+      })
+    )
+    expect(mapped.monthly?.usedPercent).toBe(40)
+    expect(mapped.planType).toBe('pro')
+  })
+
+  it('survives a null individualUsage block', () => {
+    const mapped = mapCursorUsageSummary(
+      parseCursorUsageSummary({ ...CYCLE, membershipType: 'free', individualUsage: null })
+    )
+    expect(mapped.planType).toBe('free')
+    expect(mapped.monthly).toBeNull()
+  })
+
+  it('returns nothing to publish for an empty payload', () => {
+    const mapped = mapCursorUsageSummary({})
+    expect(mapped.monthly).toBeNull()
+    expect(mapped.buckets).toHaveLength(0)
+    expect(mapped.planType).toBeNull()
+  })
+
+  it('derives the window from the reported cycle rather than assuming 30 days', () => {
+    const mapped = mapCursorUsageSummary({
+      billingCycleStart: '2026-09-01T00:00:00.000Z',
+      billingCycleEnd: '2026-09-08T00:00:00.000Z',
+      individualUsage: { plan: { enabled: true, totalPercentUsed: 10 } }
+    })
+    expect(mapped.monthly?.windowMinutes).toBe(7 * 24 * 60)
+  })
+})
+
+describe('mapCursorLegacyRequestQuota', () => {
+  it('uses the premium gpt-4 bucket on request-quota plans', () => {
+    const window = mapCursorLegacyRequestQuota({
+      'gpt-4': { numRequests: 250, maxRequestUsage: 500 },
+      'gpt-3.5-turbo': { numRequests: 10, maxRequestUsage: 9_999 },
+      startOfMonth: '2026-09-01T00:00:00.000Z'
+    })
+    expect(window?.usedPercent).toBe(50)
+    expect(window?.resetsAt).toBe(new Date('2026-10-01T00:00:00.000Z').getTime())
+  })
+
+  it('falls back to the largest ceiling when no gpt-4 bucket is present', () => {
+    const window = mapCursorLegacyRequestQuota({
+      small: { numRequests: 1, maxRequestUsage: 10 },
+      large: { numRequests: 20, maxRequestUsage: 100 }
+    })
+    expect(window?.usedPercent).toBe(20)
+  })
+
+  it('clamps a month-end cycle start instead of overflowing into the next month', () => {
+    const window = mapCursorLegacyRequestQuota({
+      'gpt-4': { numRequests: 1, maxRequestUsage: 10 },
+      startOfMonth: '2026-01-31T00:00:00.000Z'
+    })
+    expect(window?.resetsAt).toBe(Date.parse('2026-02-28T00:00:00.000Z'))
+  })
+
+  it('ignores unmetered buckets and returns null when nothing is metered', () => {
+    expect(
+      mapCursorLegacyRequestQuota({ free: { numRequests: 3, maxRequestUsage: null } })
+    ).toBeNull()
+    expect(mapCursorLegacyRequestQuota(null)).toBeNull()
+  })
+})
diff --git a/src/main/rate-limits/cursor-usage-mapping.ts b/src/main/rate-limits/cursor-usage-mapping.ts
new file mode 100644
index 000000000000..66a29d464693
--- /dev/null
+++ b/src/main/rate-limits/cursor-usage-mapping.ts
@@ -0,0 +1,234 @@
+import { z } from 'zod'
+import {
+  CURSOR_MODELS_BUCKET_NAME,
+  CURSOR_ON_DEMAND_BUCKET_NAME,
+  CURSOR_OTHER_MODELS_BUCKET_NAME
+} from '../../shared/cursor-usage-buckets'
+import type { RateLimitBucket, RateLimitWindow } from '../../shared/rate-limit-types'
+
+const MONTHLY_WINDOW_MINUTES = 43_200
+
+const cursorPoolSchema = z
+  .object({
+    enabled: z.unknown(),
+    used: z.unknown(),
+    limit: z.unknown(),
+    totalPercentUsed: z.unknown(),
+    autoPercentUsed: z.unknown(),
+    apiPercentUsed: z.unknown()
+  })
+  .partial()
+
+const cursorUsageSummarySchema = z
+  .object({
+    billingCycleStart: z.unknown(),
+    billingCycleEnd: z.unknown(),
+    membershipType: z.unknown(),
+    isUnlimited: z.unknown(),
+    // Why nullish and not optional: this route is undocumented and sends `null`
+    // for an absent sub-object. With `.optional()` one null pool fails the parse
+    // for the whole body, discarding valid pools and the billing cycle with it.
+    individualUsage: z
+      .object({ plan: cursorPoolSchema.nullish(), onDemand: cursorPoolSchema.nullish() })
+      .partial()
+      .nullish()
+  })
+  .partial()
+
+type CursorPool = z.infer<typeof cursorPoolSchema>
+export type CursorUsageSummary = z.infer<typeof cursorUsageSummarySchema>
+
+/** Accepts the raw dashboard body; an unrecognised shape maps to "nothing reported". */
+export function parseCursorUsageSummary(data: unknown): CursorUsageSummary {
+  const parsed = cursorUsageSummarySchema.safeParse(data)
+  return parsed.success ? parsed.data : {}
+}
+
+export type CursorUsageMapping = {
+  monthly: RateLimitWindow | null
+  buckets: RateLimitBucket[]
+  planType: string | null
+  isUnlimited: boolean
+}
+
+function finiteNumber(value: unknown): number | null {
+  if (typeof value === 'number' && Number.isFinite(value)) {
+    return value
+  }
+  if (typeof value !== 'string' || !value.trim()) {
+    return null
+  }
+  const parsed = Number(value)
+  return Number.isFinite(parsed) ? parsed : null
+}
+
+export function parseCursorTimestampMs(value: unknown): number | null {
+  if (typeof value === 'number' && Number.isFinite(value)) {
+    // Why: Cursor mixes epoch seconds and milliseconds across billing fields.
+    return value > 1e12 ? value : value * 1000
+  }
+  if (typeof value !== 'string' || !value.trim()) {
+    return null
+  }
+  const trimmed = value.trim()
+  if (/^\d+$/.test(trimmed)) {
+    return parseCursorTimestampMs(Number(trimmed))
+  }
+  const parsed = Date.parse(trimmed)
+  return Number.isFinite(parsed) ? parsed : null
+}
+
+function clampPercent(value: number): number {
+  return Math.min(100, Math.max(0, value))
+}
+
+function resetDescription(resetsAtMs: number | null): string | null {
+  if (resetsAtMs === null) {
+    return null
+  }
+  const date = new Date(resetsAtMs)
+  if (Number.isNaN(date.getTime())) {
+    return null
+  }
+  return date.toLocaleDateString(undefined, { month: 'short', day: 'numeric' })
+}
+
+function windowMinutesFor(startMs: number | null, endMs: number | null): number {
+  if (startMs === null || endMs === null || endMs <= startMs) {
+    return MONTHLY_WINDOW_MINUTES
+  }
+  return Math.max(1, Math.round((endMs - startMs) / 60_000))
+}
+
+/**
+ * Percent consumed for one pool. `used / limit` wins over the sibling percentage
+ * fields: the raw pair is internally consistent, while the percentages are
+ * pre-rounded for the dashboard's own copy and disagree with it on real accounts.
+ */
+function poolPercent(
+  pool: CursorPool | null | undefined,
+  percentField: keyof CursorPool
+): number | null {
+  if (!pool) {
+    return null
+  }
+  const used = finiteNumber(pool.used)
+  const limit = finiteNumber(pool.limit)
+  if (used !== null && limit !== null && limit > 0) {
+    return (used / limit) * 100
+  }
+  return finiteNumber(pool[percentField])
+}
+
+export function mapCursorUsageSummary(summary: CursorUsageSummary): CursorUsageMapping {
+  const startMs = parseCursorTimestampMs(summary.billingCycleStart)
+  const endMs = parseCursorTimestampMs(summary.billingCycleEnd)
+  const windowMinutes = windowMinutesFor(startMs, endMs)
+  const description = resetDescription(endMs)
+  const toWindow = (percent: number): RateLimitWindow => ({
+    usedPercent: clampPercent(percent),
+    windowMinutes,
+    resetsAt: endMs,
+    resetDescription: description
+  })
+
+  const plan = summary.individualUsage?.plan
+  // Why: a team-billed account still reports 0% pools it does not own. Publishing
+  // them as buckets would paint a healthy 0% meter and skip the legacy fallback.
+  const planEnabled = plan?.enabled !== false
+  const buckets: RateLimitBucket[] = []
+  const cursorModels = planEnabled ? finiteNumber(plan?.autoPercentUsed) : null
+  if (cursorModels !== null) {
+    buckets.push({ name: CURSOR_MODELS_BUCKET_NAME, ...toWindow(cursorModels) })
+  }
+  const otherModels = planEnabled ? finiteNumber(plan?.apiPercentUsed) : null
+  if (otherModels !== null) {
+    buckets.push({ name: CURSOR_OTHER_MODELS_BUCKET_NAME, ...toWindow(otherModels) })
+  }
+
+  const onDemand = summary.individualUsage?.onDemand
+  const onDemandPercent =
+    onDemand?.enabled === true ? poolPercent(onDemand, 'totalPercentUsed') : null
+  if (onDemandPercent !== null) {
+    buckets.push({ name: CURSOR_ON_DEMAND_BUCKET_NAME, ...toWindow(onDemandPercent) })
+  }
+
+  const planPercent = planEnabled ? poolPercent(plan, 'totalPercentUsed') : null
+  const membership = summary.membershipType
+  return {
+    monthly: planPercent === null ? null : toWindow(planPercent),
+    buckets,
+    planType: typeof membership === 'string' && membership.trim() ? membership.trim() : null,
+    isUnlimited: summary.isUnlimited === true
+  }
+}
+
+/**
+ * Advances a cycle start by one month in UTC, clamping the day so a Jan 31 start
+ * lands on Feb 28/29 instead of overflowing into March.
+ */
+function addOneMonthUtc(startMs: number): number {
+  const start = new Date(startMs)
+  const year = start.getUTCFullYear()
+  const month = start.getUTCMonth()
+  const lastDayOfNextMonth = new Date(Date.UTC(year, month + 2, 0)).getUTCDate()
+  return Date.UTC(
+    year,
+    month + 1,
+    Math.min(start.getUTCDate(), lastDayOfNextMonth),
+    start.getUTCHours(),
+    start.getUTCMinutes(),
+    start.getUTCSeconds(),
+    start.getUTCMilliseconds()
+  )
+}
+
+const legacyBucketSchema = z
+  .object({ numRequests: z.unknown(), maxRequestUsage: z.unknown() })
+  .partial()
+
+const legacyQuotaSchema = z.record(z.string(), z.union([legacyBucketSchema, z.unknown()]))
+
+/**
+ * Request-quota plans predate spend-based billing and report a per-model ceiling
+ * instead of a cents allowance, so those accounts still get a bar.
+ */
+export function mapCursorLegacyRequestQuota(payload: unknown): RateLimitWindow | null {
+  const parsed = legacyQuotaSchema.safeParse(payload)
+  if (!parsed.success) {
+    return null
+  }
+  const quotas: { name: string; used: number; limit: number }[] = []
+  for (const [name, value] of Object.entries(parsed.data)) {
+    const entry = legacyBucketSchema.safeParse(value)
+    if (!entry.success) {
+      continue
+    }
+    const limit = finiteNumber(entry.data.maxRequestUsage)
+    const used = finiteNumber(entry.data.numRequests)
+    if (limit === null || limit <= 0 || used === null) {
+      continue
+    }
+    quotas.push({ name, used, limit })
+  }
+  if (quotas.length === 0) {
+    return null
+  }
+  // Why: 'gpt-4' is the premium bucket on legacy plans; otherwise the largest
+  // ceiling is the headline quota on every shape seen so far.
+  const quota =
+    quotas.find((entry) => entry.name === 'gpt-4') ??
+    quotas.sort((left, right) => right.limit - left.limit)[0]
+  if (!quota) {
+    return null
+  }
+
+  const startOfMonth = parseCursorTimestampMs(parsed.data.startOfMonth)
+  const resetsAt = startOfMonth === null ? null : addOneMonthUtc(startOfMonth)
+  return {
+    usedPercent: clampPercent((quota.used / quota.limit) * 100),
+    windowMinutes: MONTHLY_WINDOW_MINUTES,
+    resetsAt,
+    resetDescription: resetDescription(resetsAt)
+  }
+}
diff --git a/src/main/rate-limits/grok-fetcher.ts b/src/main/rate-limits/grok-fetcher.ts
index 33c4fac9aec3..b776613a3359 100644
--- a/src/main/rate-limits/grok-fetcher.ts
+++ b/src/main/rate-limits/grok-fetcher.ts
@@ -109,12 +109,11 @@ function usageScalars(config: GrokBillingConfig): (GrokMoneyVal | undefined)[] {
   ]
 }
 
-// Why: proto3 JSON drops default zeros, so an omitted percent can mean zero —
-// but only an explicitly-emitted zero proves this encoder keeps them. #15740
-// ships `onDemandUsed: {val: 0}`, so there the omission means "not reported"
-// and must never render as 0%. Non-zero money fields prove nothing either way,
-// so #9214/#9219 accounts that carry only those keep their genuine 0%.
-function emitsExplicitZeroScalar(config: GrokBillingConfig): boolean {
+function omittedPercentIsUnreported(config: GrokBillingConfig): boolean {
+  // A strict zero cap rejects numeric prefixes like "0invalid" accepted by parseMoneyVal.
+  if (parseMoneyVal(config.onDemandCap) === 0 && Number(config.onDemandCap?.val) === 0) {
+    return [config.onDemandUsed, config.used].some((value) => (parseMoneyVal(value) ?? 0) > 0)
+  }
   return usageScalars(config).some((value) => parseMoneyVal(value) === 0)
 }
 
@@ -130,10 +129,8 @@ function resolveWeeklyPercent(config: GrokBillingConfig): number | null {
   if (reported !== undefined) {
     return null
   }
-  // Why: infer the dropped zero only when nothing else in the payload speaks
-  // for consumption — an explicit zero proves the encoder keeps defaults, and a
-  // computable budget pair is a real monthly number this must not shadow.
-  if (emitsExplicitZeroScalar(config) || mapMonthlyUsage(config) !== null) {
+  // A computable monthly budget must not be relabelled as weekly zero usage.
+  if (omittedPercentIsUnreported(config) || mapMonthlyUsage(config) !== null) {
     return null
   }
   return hasConfirmedWeeklyPeriod(config) ? 0 : null
diff --git a/src/main/rate-limits/grok-weekly-zero.test.ts b/src/main/rate-limits/grok-weekly-zero.test.ts
new file mode 100644
index 000000000000..f8c8b098ebfc
--- /dev/null
+++ b/src/main/rate-limits/grok-weekly-zero.test.ts
@@ -0,0 +1,225 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const netFetchMock = vi.hoisted(() => vi.fn())
+vi.mock('electron', () => ({ net: { fetch: netFetchMock } }))
+vi.mock('./grok-auth', () => ({
+  readGrokAuthSession: () => {
+    throw new Error('Tests must supply synthetic auth')
+  },
+  isGrokAccessTokenFresh: () => true
+}))
+
+import { fetchGrokRateLimits } from './grok-fetcher'
+
+const START = '2026-09-13T16:33:14.392197+00:00'
+const END = '2026-09-20T16:33:14.392197+00:00'
+const PERIOD = { type: 'USAGE_PERIOD_TYPE_WEEKLY', start: START, end: END }
+const CONFIRMED_PERIOD = {
+  currentPeriod: PERIOD,
+  billingPeriodStart: START,
+  billingPeriodEnd: END
+}
+// Reporter deminit02-hue's #20657 payload; authentication is synthetic.
+const REPORTER_CONFIG = {
+  ...CONFIRMED_PERIOD,
+  onDemandCap: { val: 0 },
+  onDemandUsed: { val: 0 },
+  prepaidBalance: { val: 0 },
+  isUnifiedBillingUser: true
+}
+const AUTH = {
+  status: 'ok',
+  session: {
+    accessToken: 'fixture-only',
+    userId: 'fixture-user',
+    email: 'grok@example.invalid',
+    teamId: null,
+    oidcClientId: null,
+    expiresAtMs: Date.parse('2099-01-01T00:00:00Z')
+  }
+} as const
+
+function jsonResponse(body: unknown, status = 200) {
+  return { ok: status >= 200 && status < 300, status, json: async () => body }
+}
+
+async function fetchConfig(config: Record<string, unknown>, flat = false) {
+  netFetchMock
+    .mockResolvedValueOnce(jsonResponse(flat ? config : { config }))
+    .mockResolvedValueOnce(jsonResponse({ config: {} }))
+  return fetchGrokRateLimits({ authReadResult: AUTH })
+}
+
+describe('Grok weekly zero evidence', () => {
+  beforeEach(() => netFetchMock.mockReset())
+
+  it.each([false, true])('maps the reporter payload with flat=%s', async (flat) => {
+    const result = await fetchConfig(REPORTER_CONFIG, flat)
+    expect(result.status).toBe('ok')
+    expect(result.weekly).toMatchObject({
+      usedPercent: 0,
+      windowMinutes: 10_080,
+      resetsAt: Date.parse(END)
+    })
+    expect(result.monthly).toBeUndefined()
+    expect(netFetchMock).toHaveBeenCalledTimes(1)
+  })
+
+  it.each([0, '0', '0.00'])('accepts money zero encoded as %s', async (val) => {
+    const result = await fetchConfig({
+      ...REPORTER_CONFIG,
+      onDemandCap: { val },
+      onDemandUsed: { val },
+      prepaidBalance: { val }
+    })
+    expect(result.weekly?.usedPercent).toBe(0)
+    expect(netFetchMock).toHaveBeenCalledTimes(1)
+  })
+
+  it.each([
+    { name: 'absent', cap: undefined },
+    { name: 'empty', cap: {} },
+    { name: 'malformed', cap: { val: 'unknown' } },
+    { name: 'zero prefix', cap: { val: '0invalid' } },
+    { name: 'negative', cap: { val: -1 } },
+    { name: 'nonfinite', cap: { val: Infinity } },
+    { name: 'positive', cap: { val: 250 } }
+  ])('keeps $name cap with explicit money zeros unknown', async ({ cap }) => {
+    const result = await fetchConfig({ ...REPORTER_CONFIG, onDemandCap: cap })
+    expect(result.status).toBe('unavailable')
+    expect(result.weekly).toBeNull()
+    expect(netFetchMock).toHaveBeenCalledTimes(2)
+  })
+
+  it.each(['onDemandUsed', 'used'])('does not infer zero beside positive %s', async (field) => {
+    const result = await fetchConfig({ ...REPORTER_CONFIG, [field]: { val: '37.5' } })
+    expect(result.status).toBe('unavailable')
+    expect(result.weekly).toBeNull()
+    expect(netFetchMock).toHaveBeenCalledTimes(2)
+  })
+
+  it.each([
+    { name: 'absent cap and no money', config: CONFIRMED_PERIOD },
+    { name: 'prepaid only', config: { ...CONFIRMED_PERIOD, prepaidBalance: { val: 25 } } },
+    { name: 'zero cap and prepaid', config: { ...REPORTER_CONFIG, prepaidBalance: { val: 25 } } }
+  ])('preserves $name zero inference', async ({ config }) => {
+    const result = await fetchConfig(config)
+    expect(result.weekly?.usedPercent).toBe(0)
+    expect(netFetchMock).toHaveBeenCalledTimes(1)
+  })
+
+  it.each([0, 23, -10, 150])(
+    'honors finite explicit percent %s before money evidence',
+    async (percent) => {
+      const result = await fetchConfig({
+        ...REPORTER_CONFIG,
+        creditUsagePercent: percent,
+        onDemandUsed: { val: 37.5 },
+        monthlyLimit: { val: 100 },
+        used: { val: 25 },
+        billingPeriodStart: undefined
+      })
+      expect(result.weekly?.usedPercent).toBe(Math.min(100, Math.max(0, percent)))
+      expect(result.monthly).toBeUndefined()
+      expect(netFetchMock).toHaveBeenCalledTimes(1)
+    }
+  )
+
+  it.each([null, '0', 'invalid', Number.NaN, Infinity, -Infinity])(
+    'does not infer an invalid explicit percent %s',
+    async (percent) => {
+      const result = await fetchConfig({ ...REPORTER_CONFIG, creditUsagePercent: percent })
+      expect(result.status).toBe('unavailable')
+      expect(result.weekly).toBeNull()
+      expect(netFetchMock).toHaveBeenCalledTimes(2)
+    }
+  )
+
+  it.each([
+    { billingPeriodStart: undefined },
+    { billingPeriodEnd: undefined },
+    { billingPeriodStart: 'invalid' },
+    { billingPeriodEnd: 'invalid' },
+    { billingPeriodStart: END },
+    { billingPeriodEnd: START },
+    { currentPeriod: undefined },
+    { currentPeriod: { ...PERIOD, type: 'USAGE_PERIOD_TYPE_MONTHLY' } },
+    { currentPeriod: { ...PERIOD, start: 'invalid' } },
+    { currentPeriod: { ...PERIOD, end: 'invalid' } }
+  ])('requires confirmed weekly bounds: %o', async (period) => {
+    const result = await fetchConfig({ ...REPORTER_CONFIG, ...period })
+    expect(result.status).toBe('unavailable')
+    expect(result.weekly).toBeNull()
+    expect(netFetchMock).toHaveBeenCalledTimes(2)
+  })
+
+  it.each([0, 25])('keeps a computable monthly pair with used=%s monthly', async (used) => {
+    const result = await fetchConfig({
+      ...REPORTER_CONFIG,
+      monthlyLimit: { val: '100' },
+      used: { val: used }
+    })
+    expect(result.status).toBe('ok')
+    expect(result.weekly).toBeNull()
+    expect(result.monthly).toMatchObject({ usedPercent: used, windowMinutes: 43_200 })
+    expect(netFetchMock).toHaveBeenCalledTimes(1)
+  })
+
+  it.each([0, '0', -1, 'invalid', null, Infinity, Number.NaN])(
+    'rejects invalid monthly denominator %s',
+    async (val) => {
+      netFetchMock
+        .mockResolvedValueOnce(jsonResponse({ config: { subscriptionTier: 'Fixture' } }))
+        .mockResolvedValueOnce(
+          jsonResponse({ config: { monthlyLimit: { val }, used: { val: 12 } } })
+        )
+      const result = await fetchGrokRateLimits({ authReadResult: AUTH })
+      expect(result.status).toBe('unavailable')
+      expect(result.weekly).toBeNull()
+      expect(result.monthly).toBeUndefined()
+      expect(netFetchMock).toHaveBeenCalledTimes(2)
+    }
+  )
+
+  it.each([false, true])('preserves monthly fallback with flat=%s', async (flat) => {
+    const config = { monthlyLimit: { val: 200 }, used: { val: 50 }, billingPeriodEnd: END }
+    netFetchMock
+      .mockResolvedValueOnce(
+        jsonResponse({ config: { ...REPORTER_CONFIG, onDemandCap: { val: 250 } } })
+      )
+      .mockResolvedValueOnce(jsonResponse(flat ? config : { config }))
+    const result = await fetchGrokRateLimits({ authReadResult: AUTH })
+    expect(result.status).toBe('ok')
+    expect(result.weekly).toBeNull()
+    expect(result.monthly).toMatchObject({ usedPercent: 25, resetsAt: Date.parse(END) })
+    expect(netFetchMock).toHaveBeenCalledTimes(2)
+  })
+
+  it.each([401, 403, 500])('preserves fallback HTTP %s errors', async (status) => {
+    netFetchMock
+      .mockResolvedValueOnce(jsonResponse({ config: { subscriptionTier: 'Fixture' } }))
+      .mockResolvedValueOnce(jsonResponse({}, status))
+    const result = await fetchGrokRateLimits({ authReadResult: AUTH })
+    expect(result.status).toBe('error')
+    expect(result.error).toContain(`HTTP ${status}`)
+    expect(netFetchMock).toHaveBeenCalledTimes(2)
+  })
+
+  it('aborts the default billing fallback with the caller signal', async () => {
+    const controller = new AbortController()
+    let signal: AbortSignal | null | undefined
+    netFetchMock
+      .mockResolvedValueOnce(jsonResponse({ config: { subscriptionTier: 'Fixture' } }))
+      .mockImplementationOnce((_url, init: RequestInit) => {
+        signal = init.signal
+        return new Promise((_resolve, reject) => {
+          signal?.addEventListener('abort', () => reject(new Error('aborted')), { once: true })
+        })
+      })
+    const pending = fetchGrokRateLimits({ authReadResult: AUTH, signal: controller.signal })
+    await vi.waitFor(() => expect(netFetchMock).toHaveBeenCalledTimes(2))
+    controller.abort()
+    expect(signal?.aborted).toBe(true)
+    expect(await pending).toMatchObject({ status: 'error', error: 'aborted' })
+  })
+})
diff --git a/src/main/rate-limits/rate-limit-service-test-harness.ts b/src/main/rate-limits/rate-limit-service-test-harness.ts
index 25f7baeb78d6..f51839d108b9 100644
--- a/src/main/rate-limits/rate-limit-service-test-harness.ts
+++ b/src/main/rate-limits/rate-limit-service-test-harness.ts
@@ -8,7 +8,10 @@ import { fetchKimiRateLimits } from './kimi-fetcher'
 import { fetchMiniMaxRateLimits } from './minimax/minimax-fetcher'
 import { fetchGrokRateLimits } from './grok-fetcher'
 import { readGrokAuthSession } from './grok-auth'
+import { fetchCursorRateLimits } from './cursor-fetcher'
+import { readCursorAuthSession } from './cursor-auth'
 import { fetchOpenCodeGoUsage } from './opencode-go-usage-source-selection'
+import { fetchZcodeRateLimits } from './zcode-usage-fetcher'
 import { hasMiniMaxSessionCookie } from '../minimax/minimax-cookie-store'
 
 export type Deferred<T> = {
@@ -89,6 +92,8 @@ export function mockFreshBackgroundProviderFetches(): void {
   vi.mocked(fetchKimiRateLimits).mockImplementation(async () => okProvider('kimi', 0))
   vi.mocked(fetchMiniMaxRateLimits).mockImplementation(async () => okProvider('minimax', 0))
   vi.mocked(fetchGrokRateLimits).mockImplementation(async () => unavailableProvider('grok'))
+  vi.mocked(fetchCursorRateLimits).mockImplementation(async () => unavailableProvider('cursor'))
+  vi.mocked(fetchZcodeRateLimits).mockImplementation(async () => unavailableProvider('zcode'))
 }
 
 /** Shared `beforeEach` body: healthy stubs for every provider the service polls. */
@@ -106,8 +111,11 @@ export function resetRateLimitProviderMocks(): void {
     error: null,
     status: 'unavailable'
   })
+  vi.mocked(fetchCursorRateLimits).mockResolvedValue(unavailableProvider('cursor'))
+  vi.mocked(fetchZcodeRateLimits).mockResolvedValue(unavailableProvider('zcode'))
   vi.mocked(hasMiniMaxSessionCookie).mockReturnValue(false)
   vi.mocked(readGrokAuthSession).mockReturnValue({ status: 'missing' })
+  vi.mocked(readCursorAuthSession).mockResolvedValue({ status: 'missing' })
 }
 
 type RateLimitWindow = Parameters<RateLimitService['attach']>[0]
diff --git a/src/main/rate-limits/service-account-target-selection.test.ts b/src/main/rate-limits/service-account-target-selection.test.ts
index 163730246145..bb5de4b64856 100644
--- a/src/main/rate-limits/service-account-target-selection.test.ts
+++ b/src/main/rate-limits/service-account-target-selection.test.ts
@@ -32,6 +32,10 @@ vi.mock('./opencode-go-usage-source-selection', () => ({
   fetchOpenCodeGoUsage: vi.fn()
 }))
 
+vi.mock('./zcode-usage-fetcher', () => ({
+  fetchZcodeRateLimits: vi.fn()
+}))
+
 vi.mock('./minimax/minimax-fetcher', () => ({
   fetchMiniMaxRateLimits: vi.fn()
 }))
@@ -40,6 +44,14 @@ vi.mock('./grok-fetcher', () => ({
   fetchGrokRateLimits: vi.fn()
 }))
 
+vi.mock('./cursor-fetcher', () => ({
+  fetchCursorRateLimits: vi.fn()
+}))
+
+vi.mock('./cursor-auth', () => ({
+  readCursorAuthSession: vi.fn()
+}))
+
 vi.mock('./grok-auth', () => ({
   readGrokAuthSession: vi.fn(() => ({ status: 'missing' }))
 }))
diff --git a/src/main/rate-limits/service-antigravity-usage.test.ts b/src/main/rate-limits/service-antigravity-usage.test.ts
index 9f5afe9423d1..3696f434dec5 100644
--- a/src/main/rate-limits/service-antigravity-usage.test.ts
+++ b/src/main/rate-limits/service-antigravity-usage.test.ts
@@ -39,6 +39,16 @@ vi.mock('./grok-fetcher', () => ({
   fetchGrokRateLimits: vi.fn()
 }))
 
+vi.mock('./zcode-usage-fetcher', () => ({ fetchZcodeRateLimits: vi.fn() }))
+
+vi.mock('./cursor-fetcher', () => ({
+  fetchCursorRateLimits: vi.fn()
+}))
+
+vi.mock('./cursor-auth', () => ({
+  readCursorAuthSession: vi.fn()
+}))
+
 vi.mock('./grok-auth', () => ({
   readGrokAuthSession: vi.fn(() => ({ status: 'missing' }))
 }))
diff --git a/src/main/rate-limits/service-cursor-usage.test.ts b/src/main/rate-limits/service-cursor-usage.test.ts
new file mode 100644
index 000000000000..3646f9f85863
--- /dev/null
+++ b/src/main/rate-limits/service-cursor-usage.test.ts
@@ -0,0 +1,165 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { RateLimitService } from './service'
+import { fetchCursorRateLimits } from './cursor-fetcher'
+import { readCursorAuthSession } from './cursor-auth'
+import { parseCursorSessionToken } from './cursor-session-token'
+import { fetchClaudeRateLimits } from './claude-fetcher'
+import { fetchCodexRateLimits } from './codex-fetcher'
+import { okProvider, resetRateLimitProviderMocks } from './rate-limit-service-test-harness'
+
+vi.mock('./claude-fetcher', () => ({
+  fetchClaudeRateLimits: vi.fn(),
+  fetchManagedAccountUsage: vi.fn()
+}))
+
+vi.mock('./codex-fetcher', () => ({
+  consumeCodexRateLimitResetCredit: vi.fn(),
+  fetchCodexRateLimits: vi.fn()
+}))
+
+vi.mock('./gemini-usage-fetcher', () => ({ fetchGeminiRateLimits: vi.fn() }))
+vi.mock('./kimi-fetcher', () => ({ fetchKimiRateLimits: vi.fn() }))
+vi.mock('./opencode-go-usage-source-selection', () => ({ fetchOpenCodeGoUsage: vi.fn() }))
+vi.mock('./minimax/minimax-fetcher', () => ({ fetchMiniMaxRateLimits: vi.fn() }))
+vi.mock('./grok-fetcher', () => ({ fetchGrokRateLimits: vi.fn() }))
+vi.mock('./grok-auth', () => ({ readGrokAuthSession: vi.fn(() => ({ status: 'missing' })) }))
+vi.mock('./zcode-usage-fetcher', () => ({ fetchZcodeRateLimits: vi.fn() }))
+
+vi.mock('./cursor-fetcher', () => ({ fetchCursorRateLimits: vi.fn() }))
+vi.mock('./cursor-auth', () => ({ readCursorAuthSession: vi.fn() }))
+vi.mock('../minimax/minimax-cookie-store', () => ({ hasMiniMaxSessionCookie: vi.fn(() => false) }))
+
+type JwtSegment = Record<string, unknown>
+
+function jwt(): string {
+  const encode = (value: JwtSegment): string =>
+    Buffer.from(JSON.stringify(value)).toString('base64url')
+  return `${encode({ alg: 'RS256' })}.${encode({ sub: 'auth0|user_1', exp: 4_000_000_000 })}.sig`
+}
+
+function signedInResult(): Awaited<ReturnType<typeof readCursorAuthSession>> {
+  return {
+    status: 'ok',
+    session: {
+      token: parseCursorSessionToken(jwt())!,
+      source: 'keychain',
+      email: 'dev@example.com',
+      displayName: 'Dev',
+      membershipType: 'pro',
+      subscriptionStatus: 'active'
+    }
+  }
+}
+
+describe('RateLimitService Cursor usage', () => {
+  beforeEach(() => {
+    resetRateLimitProviderMocks()
+    vi.mocked(fetchClaudeRateLimits).mockResolvedValue(okProvider('claude', 0))
+    vi.mocked(fetchCodexRateLimits).mockResolvedValue(okProvider('codex', 0))
+  })
+
+  it('does not probe the Cursor keychain while callers read state snapshots', () => {
+    const service = new RateLimitService()
+    service.getState()
+    service.getState()
+    expect(readCursorAuthSession).not.toHaveBeenCalled()
+  })
+
+  it('reports Cursor as unconfigured until a fetch cycle finds a session', async () => {
+    const service = new RateLimitService()
+    expect(service.getState().cursorAuthConfigured).toBe(false)
+
+    vi.mocked(readCursorAuthSession).mockResolvedValue(signedInResult())
+    vi.mocked(fetchCursorRateLimits).mockResolvedValue(okProvider('cursor', 42))
+    await service.refresh()
+
+    expect(service.getState().cursorAuthConfigured).toBe(true)
+    expect(service.getState().cursor?.status).toBe('ok')
+  })
+
+  it('passes the resolved session to the fetcher instead of reading it twice', async () => {
+    const authReadResult = signedInResult()
+    vi.mocked(readCursorAuthSession).mockResolvedValue(authReadResult)
+    vi.mocked(fetchCursorRateLimits).mockResolvedValue(okProvider('cursor', 7))
+
+    await new RateLimitService().refresh()
+
+    expect(readCursorAuthSession).toHaveBeenCalledTimes(1)
+    expect(fetchCursorRateLimits).toHaveBeenCalledWith(expect.objectContaining({ authReadResult }))
+  })
+
+  it('publishes an error snapshot instead of dropping the cycle when the fetch throws', async () => {
+    vi.mocked(readCursorAuthSession).mockResolvedValue({ status: 'missing' })
+    vi.mocked(fetchCursorRateLimits).mockRejectedValue(new Error('boom'))
+
+    const service = new RateLimitService()
+    await service.refresh()
+
+    const state = service.getState()
+    expect(state.cursor).toMatchObject({ provider: 'cursor', status: 'error', error: 'boom' })
+    // Why: a Cursor failure must not take the rest of the cycle down with it.
+    expect(state.gemini?.status).toBe('ok')
+  })
+
+  it("drops a previous account's usage when the signed-in account changes", async () => {
+    // Why: the stale policy keeps a recent snapshot through a failed refresh. Across
+    // an account switch that would name the new account beside the old one's figures.
+    vi.mocked(readCursorAuthSession).mockResolvedValue(signedInResult())
+    vi.mocked(fetchCursorRateLimits).mockResolvedValue({
+      ...okProvider('cursor', 80),
+      usageMetadata: { source: 'cli', authProvenance: 'account-a' }
+    })
+    const service = new RateLimitService()
+    await service.refresh()
+    expect(service.getState().cursor?.session?.usedPercent).toBe(80)
+
+    vi.mocked(fetchCursorRateLimits).mockResolvedValue({
+      provider: 'cursor',
+      session: null,
+      weekly: null,
+      updatedAt: Date.now(),
+      error: 'Cursor sign-in expired — run `cursor-agent login` again',
+      status: 'error',
+      // Why this exact shape: it is what cursor-fetcher returns for a readable but
+      // rejected session, which is the failure an account switch actually hits.
+      usageMetadata: { source: 'cli', failureKind: 'stale-token', authProvenance: 'account-b' }
+    })
+    await service.refresh()
+    expect(service.getState().cursor?.session).toBeNull()
+    expect(service.getState().cursor?.status).toBe('error')
+  })
+
+  it('keeps the last reading when a refresh fails without naming an account', async () => {
+    vi.mocked(readCursorAuthSession).mockResolvedValue(signedInResult())
+    vi.mocked(fetchCursorRateLimits).mockResolvedValue({
+      ...okProvider('cursor', 60),
+      usageMetadata: { source: 'cli', authProvenance: 'account-a' }
+    })
+    const service = new RateLimitService()
+    await service.refresh()
+
+    vi.mocked(fetchCursorRateLimits).mockResolvedValue({
+      provider: 'cursor',
+      session: null,
+      weekly: null,
+      updatedAt: Date.now(),
+      error: 'Cursor usage request failed',
+      status: 'error',
+      usageMetadata: { source: 'cli' }
+    })
+    await service.refresh()
+    expect(service.getState().cursor?.session?.usedPercent).toBe(60)
+  })
+
+  it('clears cursorAuthConfigured once the local session goes away', async () => {
+    vi.mocked(readCursorAuthSession).mockResolvedValue(signedInResult())
+    vi.mocked(fetchCursorRateLimits).mockResolvedValue(okProvider('cursor', 5))
+    const service = new RateLimitService()
+    await service.refresh()
+    expect(service.getState().cursorAuthConfigured).toBe(true)
+
+    vi.mocked(readCursorAuthSession).mockResolvedValue({ status: 'missing' })
+    await service.refresh()
+    expect(service.getState().cursorAuthConfigured).toBe(false)
+  })
+})
diff --git a/src/main/rate-limits/service-inactive-account-previews.test.ts b/src/main/rate-limits/service-inactive-account-previews.test.ts
index 1dee94e8c991..23f0a0e6bbac 100644
--- a/src/main/rate-limits/service-inactive-account-previews.test.ts
+++ b/src/main/rate-limits/service-inactive-account-previews.test.ts
@@ -39,6 +39,10 @@ vi.mock('./opencode-go-usage-source-selection', () => ({
   fetchOpenCodeGoUsage: vi.fn()
 }))
 
+vi.mock('./zcode-usage-fetcher', () => ({
+  fetchZcodeRateLimits: vi.fn()
+}))
+
 vi.mock('./minimax/minimax-fetcher', () => ({
   fetchMiniMaxRateLimits: vi.fn()
 }))
@@ -47,6 +51,14 @@ vi.mock('./grok-fetcher', () => ({
   fetchGrokRateLimits: vi.fn()
 }))
 
+vi.mock('./cursor-fetcher', () => ({
+  fetchCursorRateLimits: vi.fn()
+}))
+
+vi.mock('./cursor-auth', () => ({
+  readCursorAuthSession: vi.fn()
+}))
+
 vi.mock('./grok-auth', () => ({
   readGrokAuthSession: vi.fn(() => ({ status: 'missing' }))
 }))
diff --git a/src/main/rate-limits/service-live-claude-usage.test.ts b/src/main/rate-limits/service-live-claude-usage.test.ts
index 9b9137568fb9..07f6ccf0d272 100644
--- a/src/main/rate-limits/service-live-claude-usage.test.ts
+++ b/src/main/rate-limits/service-live-claude-usage.test.ts
@@ -36,6 +36,10 @@ vi.mock('./opencode-go-usage-source-selection', () => ({
   fetchOpenCodeGoUsage: vi.fn()
 }))
 
+vi.mock('./zcode-usage-fetcher', () => ({
+  fetchZcodeRateLimits: vi.fn()
+}))
+
 vi.mock('./minimax/minimax-fetcher', () => ({
   fetchMiniMaxRateLimits: vi.fn()
 }))
@@ -44,6 +48,14 @@ vi.mock('./grok-fetcher', () => ({
   fetchGrokRateLimits: vi.fn()
 }))
 
+vi.mock('./cursor-fetcher', () => ({
+  fetchCursorRateLimits: vi.fn()
+}))
+
+vi.mock('./cursor-auth', () => ({
+  readCursorAuthSession: vi.fn()
+}))
+
 vi.mock('./grok-auth', () => ({
   readGrokAuthSession: vi.fn(() => ({ status: 'missing' }))
 }))
diff --git a/src/main/rate-limits/service-minimax-usage.test.ts b/src/main/rate-limits/service-minimax-usage.test.ts
index 89b311827b66..93f95de78474 100644
--- a/src/main/rate-limits/service-minimax-usage.test.ts
+++ b/src/main/rate-limits/service-minimax-usage.test.ts
@@ -33,6 +33,10 @@ vi.mock('./opencode-go-usage-source-selection', () => ({
   fetchOpenCodeGoUsage: vi.fn()
 }))
 
+vi.mock('./zcode-usage-fetcher', () => ({
+  fetchZcodeRateLimits: vi.fn()
+}))
+
 vi.mock('./minimax/minimax-fetcher', () => ({
   fetchMiniMaxRateLimits: vi.fn()
 }))
@@ -41,6 +45,14 @@ vi.mock('./grok-fetcher', () => ({
   fetchGrokRateLimits: vi.fn()
 }))
 
+vi.mock('./cursor-fetcher', () => ({
+  fetchCursorRateLimits: vi.fn()
+}))
+
+vi.mock('./cursor-auth', () => ({
+  readCursorAuthSession: vi.fn()
+}))
+
 vi.mock('./grok-auth', () => ({
   readGrokAuthSession: vi.fn(() => ({ status: 'missing' }))
 }))
diff --git a/src/main/rate-limits/service-refresh-orchestration.test.ts b/src/main/rate-limits/service-refresh-orchestration.test.ts
index 9b70fa0ea51f..9577a87d6a3f 100644
--- a/src/main/rate-limits/service-refresh-orchestration.test.ts
+++ b/src/main/rate-limits/service-refresh-orchestration.test.ts
@@ -7,6 +7,7 @@ import { fetchGeminiRateLimits } from './gemini-usage-fetcher'
 import { fetchKimiRateLimits } from './kimi-fetcher'
 import { fetchMiniMaxRateLimits } from './minimax/minimax-fetcher'
 import { fetchGrokRateLimits } from './grok-fetcher'
+import { fetchZcodeRateLimits } from './zcode-usage-fetcher'
 import { readGrokAuthSession } from './grok-auth'
 import { fetchOpenCodeGoUsage } from './opencode-go-usage-source-selection'
 import {
@@ -40,6 +41,10 @@ vi.mock('./opencode-go-usage-source-selection', () => ({
   fetchOpenCodeGoUsage: vi.fn()
 }))
 
+vi.mock('./zcode-usage-fetcher', () => ({
+  fetchZcodeRateLimits: vi.fn()
+}))
+
 vi.mock('./minimax/minimax-fetcher', () => ({
   fetchMiniMaxRateLimits: vi.fn()
 }))
@@ -48,6 +53,14 @@ vi.mock('./grok-fetcher', () => ({
   fetchGrokRateLimits: vi.fn()
 }))
 
+vi.mock('./cursor-fetcher', () => ({
+  fetchCursorRateLimits: vi.fn()
+}))
+
+vi.mock('./cursor-auth', () => ({
+  readCursorAuthSession: vi.fn()
+}))
+
 vi.mock('./grok-auth', () => ({
   readGrokAuthSession: vi.fn(() => ({ status: 'missing' }))
 }))
@@ -65,6 +78,57 @@ describe('RateLimitService', () => {
     resetRateLimitProviderMocks()
   })
 
+  it('publishes a ZCode quota snapshot alongside the other providers', async () => {
+    vi.mocked(fetchClaudeRateLimits).mockResolvedValue(okProvider('claude', 7))
+    vi.mocked(fetchCodexRateLimits).mockResolvedValue(okProvider('codex', 8))
+    vi.mocked(fetchZcodeRateLimits).mockResolvedValue(okProvider('zcode', 42))
+    const service = new RateLimitService()
+
+    await service.refresh()
+
+    expect(fetchZcodeRateLimits).toHaveBeenCalledTimes(1)
+    expect(service.getState().zcode?.session?.usedPercent).toBe(42)
+    expect(service.getState().codex?.session?.usedPercent).toBe(8)
+  })
+
+  it('does not keep a previous ZCode account quota after a failed account switch', async () => {
+    vi.mocked(fetchZcodeRateLimits)
+      .mockResolvedValueOnce({
+        ...okProvider('zcode', 42),
+        usageMetadata: { source: 'web', authProvenance: 'account-a' }
+      })
+      .mockResolvedValueOnce({
+        ...errorProvider('zcode', 'request failed'),
+        usageMetadata: { source: 'web', authProvenance: 'account-b', failureKind: 'network' }
+      })
+    const service = new RateLimitService()
+
+    await service.refresh()
+    await service.refresh()
+
+    expect(service.getState().zcode?.status).toBe('error')
+    expect(service.getState().zcode?.session).toBeNull()
+  })
+
+  it('keeps a recent ZCode quota after a failed retry for the same account', async () => {
+    vi.mocked(fetchZcodeRateLimits)
+      .mockResolvedValueOnce({
+        ...okProvider('zcode', 42),
+        usageMetadata: { source: 'web', authProvenance: 'account-a' }
+      })
+      .mockResolvedValueOnce({
+        ...errorProvider('zcode', 'request failed'),
+        usageMetadata: { source: 'web', authProvenance: 'account-a', failureKind: 'network' }
+      })
+    const service = new RateLimitService()
+
+    await service.refresh()
+    await service.refresh()
+
+    expect(service.getState().zcode?.status).toBe('error')
+    expect(service.getState().zcode?.session?.usedPercent).toBe(42)
+  })
+
   it('does not reread Grok auth when callers read state snapshots', () => {
     vi.mocked(readGrokAuthSession).mockReturnValue({
       status: 'ok',
diff --git a/src/main/rate-limits/service-window-activation.test.ts b/src/main/rate-limits/service-window-activation.test.ts
index 2b53c0919a1b..54296c396b9b 100644
--- a/src/main/rate-limits/service-window-activation.test.ts
+++ b/src/main/rate-limits/service-window-activation.test.ts
@@ -41,6 +41,10 @@ vi.mock('./opencode-go-usage-source-selection', () => ({
   fetchOpenCodeGoUsage: vi.fn()
 }))
 
+vi.mock('./zcode-usage-fetcher', () => ({
+  fetchZcodeRateLimits: vi.fn()
+}))
+
 vi.mock('./minimax/minimax-fetcher', () => ({
   fetchMiniMaxRateLimits: vi.fn()
 }))
@@ -49,6 +53,14 @@ vi.mock('./grok-fetcher', () => ({
   fetchGrokRateLimits: vi.fn()
 }))
 
+vi.mock('./cursor-fetcher', () => ({
+  fetchCursorRateLimits: vi.fn()
+}))
+
+vi.mock('./cursor-auth', () => ({
+  readCursorAuthSession: vi.fn()
+}))
+
 vi.mock('./grok-auth', () => ({
   readGrokAuthSession: vi.fn(() => ({ status: 'missing' }))
 }))
diff --git a/src/main/rate-limits/service/service-configuration.ts b/src/main/rate-limits/service/service-configuration.ts
index f2629aa4feae..2a788b1cf935 100644
--- a/src/main/rate-limits/service/service-configuration.ts
+++ b/src/main/rate-limits/service/service-configuration.ts
@@ -127,6 +127,7 @@ export abstract class RateLimitServiceConfiguration extends RateLimitServiceAcco
       minimaxApiKeyConfigured: hasMiniMaxApiKey(),
       opencodeGoApiKeyConfigured: this.openCodeGoApiKeyConfigured,
       grokAuthConfigured: this.grokAuthConfigured,
+      cursorAuthConfigured: this.cursorAuthConfigured,
       claudeTarget: this.claudeFetchTarget,
       codexTarget: this.codexFetchTarget,
       inactiveClaudeAccounts: this.buildInactiveArray(
diff --git a/src/main/rate-limits/service/service-full-cycle-application.ts b/src/main/rate-limits/service/service-full-cycle-application.ts
index 7104face38fa..70b58933c163 100644
--- a/src/main/rate-limits/service/service-full-cycle-application.ts
+++ b/src/main/rate-limits/service/service-full-cycle-application.ts
@@ -1,5 +1,6 @@
 import { RateLimitServiceFullCyclePreparation } from './service-full-cycle-preparation'
 import { deriveAntigravityRateLimits } from '../antigravity-usage-mirror'
+import { settleSiblingProviderResult } from './service-sibling-provider-result'
 import type { ProviderRateLimits } from './service-types'
 
 export abstract class RateLimitServiceFullCycleApplication extends RateLimitServiceFullCyclePreparation {
@@ -34,7 +35,9 @@ export abstract class RateLimitServiceFullCycleApplication extends RateLimitServ
         kimiResult,
         miniMaxResult
       ],
-      grokResultPromise
+      grokResultPromise,
+      cursorResultPromise,
+      zcodeResultPromise
     } = prepared
     if (signal.aborted) {
       return
@@ -191,25 +194,45 @@ export abstract class RateLimitServiceFullCycleApplication extends RateLimitServ
         : this.state.minimax
     })
 
-    const grokResult = await grokResultPromise
+    const [grokSettled, cursorSettled, zcodeSettled] = await Promise.all([
+      grokResultPromise,
+      cursorResultPromise,
+      zcodeResultPromise
+    ])
     if (signal.aborted) {
       return
     }
-    const grok =
-      grokResult.status === 'fulfilled'
-        ? grokResult.value
-        : ({
-            provider: 'grok',
-            session: null,
-            weekly: null,
-            updatedAt: Date.now(),
-            error: grokResult.reason instanceof Error ? grokResult.reason.message : 'Unknown error',
-            status: 'error'
-          } satisfies ProviderRateLimits)
+    const grok = settleSiblingProviderResult('grok', grokSettled)
+    const cursor = settleSiblingProviderResult('cursor', cursorSettled)
+    const zcode = settleSiblingProviderResult('zcode', zcodeSettled)
+    // Why: the stale policy keeps a recent snapshot through a failed refresh, but
+    // a snapshot belonging to a different Cursor account must not survive the
+    // switch — the Accounts pane would name the new account beside the old
+    // account's figures. Only a known-and-changed identity clears it, so an
+    // errored refresh that reports no account still keeps its own last reading.
+    const previousCursorAccount = previousState.cursor?.usageMetadata?.authProvenance
+    const cursorAccount = cursor.usageMetadata?.authProvenance
+    const cursorAccountChanged =
+      previousCursorAccount !== undefined &&
+      cursorAccount !== undefined &&
+      previousCursorAccount !== cursorAccount
+    const previousZcodeAccount = previousState.zcode?.usageMetadata?.authProvenance
+    const zcodeAccount = zcode.usageMetadata?.authProvenance
+    const sameZcodeAccount =
+      previousZcodeAccount !== undefined &&
+      zcodeAccount !== undefined &&
+      previousZcodeAccount === zcodeAccount
     this.trackActiveFailureStreak('grok', grok)
+    this.trackActiveFailureStreak('cursor', cursor)
+    this.trackActiveFailureStreak('zcode', zcode)
     this.updateState({
       ...this.state,
-      grok: this.applyStalePolicy(grok, previousState.grok)
+      grok: this.applyStalePolicy(grok, previousState.grok),
+      cursor: cursorAccountChanged ? cursor : this.applyStalePolicy(cursor, previousState.cursor),
+      zcode:
+        zcode.status === 'error' && !sameZcodeAccount
+          ? zcode
+          : this.applyStalePolicy(zcode, previousState.zcode)
     })
   }
 }
diff --git a/src/main/rate-limits/service/service-full-cycle-preparation.ts b/src/main/rate-limits/service/service-full-cycle-preparation.ts
index 3e4f77b906de..55a2cc2a0622 100644
--- a/src/main/rate-limits/service/service-full-cycle-preparation.ts
+++ b/src/main/rate-limits/service/service-full-cycle-preparation.ts
@@ -3,10 +3,14 @@ import { fetchCodexRateLimits } from '../codex-fetcher'
 import { fetchGeminiRateLimits } from '../gemini-usage-fetcher'
 import { fetchGrokRateLimits } from '../grok-fetcher'
 import { readGrokAuthSession } from '../grok-auth'
+import { fetchCursorRateLimits } from '../cursor-fetcher'
+import { readCursorAuthSession } from '../cursor-auth'
+import { fetchZcodeRateLimits } from '../zcode-usage-fetcher'
 import { fetchMiniMaxRateLimits } from '../minimax/minimax-fetcher'
 import { createHash } from 'node:crypto'
 import { fetchOpenCodeGoUsage } from '../opencode-go-usage-source-selection'
 import { RateLimitServiceFetchPolicy } from './service-fetch-policy'
+import type { SettledProviderResult } from './service-sibling-provider-result'
 import type {
   ClaudeRuntimeAuthPreparation,
   InternalRateLimitState,
@@ -39,9 +43,9 @@ export type FetchAllCyclePrepared = {
     PromiseSettledResult<ProviderRateLimits>,
     PromiseSettledResult<ProviderRateLimits>
   ]
-  grokResultPromise: Promise<
-    { status: 'fulfilled'; value: ProviderRateLimits } | { status: 'rejected'; reason: unknown }
-  >
+  grokResultPromise: Promise<SettledProviderResult>
+  cursorResultPromise: Promise<SettledProviderResult>
+  zcodeResultPromise: Promise<SettledProviderResult>
 }
 
 export abstract class RateLimitServiceFullCyclePreparation extends RateLimitServiceFetchPolicy {
@@ -127,9 +131,28 @@ export abstract class RateLimitServiceFullCyclePreparation extends RateLimitServ
       minimax: miniMaxConfigChanged
         ? this.withFetchingStatus(null, 'minimax')
         : this.withFetchingStatus(previousState.minimax, 'minimax'),
-      grok: this.withFetchingStatus(previousState.grok, 'grok')
+      grok: this.withFetchingStatus(previousState.grok, 'grok'),
+      cursor: this.withFetchingStatus(previousState.cursor, 'cursor'),
+      zcode: this.withFetchingStatus(previousState.zcode, 'zcode')
     })
 
+    // Why: the Cursor probe reads the macOS Keychain, so it is awaited inside the
+    // provider's own promise instead of blocking the rest of the cycle on it.
+    const cursorResultPromise = readCursorAuthSession()
+      .then((authReadResult) => {
+        this.cursorAuthConfigured = authReadResult.status === 'ok'
+        return fetchCursorRateLimits({ signal, authReadResult })
+      })
+      .then(
+        (value) => ({ status: 'fulfilled', value }) as const,
+        (reason) => ({ status: 'rejected', reason }) as const
+      )
+
+    const zcodeResultPromise = fetchZcodeRateLimits({ signal }).then(
+      (value) => ({ status: 'fulfilled', value }) as const,
+      (reason) => ({ status: 'rejected', reason }) as const
+    )
+
     const missingWslCodexHome =
       codexFetchGated || codexHomePath ? null : this.getMissingWslCodexHomeResult(codexTarget)
     const grokResultPromise = fetchGrokRateLimits({
@@ -215,7 +238,9 @@ export abstract class RateLimitServiceFullCyclePreparation extends RateLimitServ
         kimiResult,
         miniMaxResult
       ],
-      grokResultPromise
+      grokResultPromise,
+      cursorResultPromise,
+      zcodeResultPromise
     }
   }
 }
diff --git a/src/main/rate-limits/service/service-polling.ts b/src/main/rate-limits/service/service-polling.ts
index c861726cc524..402495080c27 100644
--- a/src/main/rate-limits/service/service-polling.ts
+++ b/src/main/rate-limits/service/service-polling.ts
@@ -78,7 +78,9 @@ export abstract class RateLimitServicePolling extends RateLimitServiceFetchQueue
       kimi: this.state.kimi,
       minimax: this.state.minimax,
       grok: this.state.grok,
-      antigravity: this.state.antigravity
+      antigravity: this.state.antigravity,
+      cursor: this.state.cursor,
+      zcode: this.state.zcode
     }
     return Object.entries(byProvider).map(([provider, limits]) => ({
       provider: provider as ActiveRateLimitProvider,
diff --git a/src/main/rate-limits/service/service-result-policy.ts b/src/main/rate-limits/service/service-result-policy.ts
index db00053fdcf1..75f032159fab 100644
--- a/src/main/rate-limits/service/service-result-policy.ts
+++ b/src/main/rate-limits/service/service-result-policy.ts
@@ -83,15 +83,7 @@ export abstract class RateLimitServiceResultPolicy extends RateLimitServiceFetch
 
   protected withFetchingStatus(
     current: ProviderRateLimits | null,
-    provider:
-      | 'claude'
-      | 'codex'
-      | 'gemini'
-      | 'opencode-go'
-      | 'kimi'
-      | 'minimax'
-      | 'grok'
-      | 'antigravity'
+    provider: ActiveRateLimitProvider
   ): ProviderRateLimits {
     if (!current) {
       return {
diff --git a/src/main/rate-limits/service/service-sibling-provider-result.ts b/src/main/rate-limits/service/service-sibling-provider-result.ts
new file mode 100644
index 000000000000..ff5337c7f707
--- /dev/null
+++ b/src/main/rate-limits/service/service-sibling-provider-result.ts
@@ -0,0 +1,26 @@
+import type { ProviderRateLimits } from './service-types'
+
+export type SettledProviderResult =
+  | { status: 'fulfilled'; value: ProviderRateLimits }
+  | { status: 'rejected'; reason: unknown }
+
+/**
+ * Collapses a provider that resolves on its own promise (outside the main
+ * `Promise.allSettled` tuple) into a publishable snapshot.
+ */
+export function settleSiblingProviderResult(
+  provider: ProviderRateLimits['provider'],
+  settled: SettledProviderResult
+): ProviderRateLimits {
+  if (settled.status === 'fulfilled') {
+    return settled.value
+  }
+  return {
+    provider,
+    session: null,
+    weekly: null,
+    updatedAt: Date.now(),
+    error: settled.reason instanceof Error ? settled.reason.message : 'Unknown error',
+    status: 'error'
+  }
+}
diff --git a/src/main/rate-limits/service/service-state.ts b/src/main/rate-limits/service/service-state.ts
index 5cea2a263388..7af82c6c3135 100644
--- a/src/main/rate-limits/service/service-state.ts
+++ b/src/main/rate-limits/service/service-state.ts
@@ -31,9 +31,14 @@ export abstract class RateLimitServiceState {
     kimi: null,
     antigravity: null,
     minimax: null,
-    grok: null
+    grok: null,
+    cursor: null,
+    zcode: null
   }
   protected grokAuthConfigured = readGrokAuthSession().status === 'ok'
+  // Why: the Cursor probe reads the macOS Keychain, so it cannot run synchronously
+  // at construction the way Grok's auth-file probe does; each fetch cycle sets it.
+  protected cursorAuthConfigured = false
   protected openCodeGoApiKeyConfigured = false
   protected pollInterval: number = DEFAULT_POLL_MS
   protected timer: ReturnType<typeof setInterval> | null = null
@@ -47,7 +52,9 @@ export abstract class RateLimitServiceState {
     kimi: 0,
     minimax: 0,
     grok: 0,
-    antigravity: 0
+    antigravity: 0,
+    cursor: 0,
+    zcode: 0
   }
   // Why: consecutive failures drive exponential backoff of the fast activation-retry lane; reset on any success/unavailable result.
   protected activeFailureStreakByProvider: Record<ActiveRateLimitProvider, number> = {
@@ -58,7 +65,9 @@ export abstract class RateLimitServiceState {
     kimi: 0,
     minimax: 0,
     grok: 0,
-    antigravity: 0
+    antigravity: 0,
+    cursor: 0,
+    zcode: 0
   }
   protected mainWindow: BrowserWindow | null = null
   protected detachWindowListeners: (() => void) | null = null
diff --git a/src/main/rate-limits/service/service-types.ts b/src/main/rate-limits/service/service-types.ts
index 92204150d9a6..a3998c13abe4 100644
--- a/src/main/rate-limits/service/service-types.ts
+++ b/src/main/rate-limits/service/service-types.ts
@@ -109,6 +109,8 @@ export type InternalRateLimitState = {
   antigravity: ProviderRateLimits | null
   minimax: ProviderRateLimits | null
   grok: ProviderRateLimits | null
+  cursor: ProviderRateLimits | null
+  zcode: ProviderRateLimits | null
 }
 
 export function normalizePollingInterval(ms: number): number {
diff --git a/src/main/rate-limits/zcode-usage-fetcher.test.ts b/src/main/rate-limits/zcode-usage-fetcher.test.ts
new file mode 100644
index 000000000000..b587d196be0f
--- /dev/null
+++ b/src/main/rate-limits/zcode-usage-fetcher.test.ts
@@ -0,0 +1,292 @@
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { fetchZcodeRateLimits } from './zcode-usage-fetcher'
+
+let dir: string
+let configPath: string
+
+beforeEach(() => {
+  dir = mkdtempSync(join(tmpdir(), 'orca-zcode-usage-'))
+  configPath = join(dir, 'config.json')
+  vi.stubGlobal('fetch', vi.fn())
+  vi.useFakeTimers()
+  vi.setSystemTime(new Date('2026-08-12T06:00:00.000Z'))
+})
+
+afterEach(() => {
+  vi.unstubAllGlobals()
+  vi.useRealTimers()
+  rmSync(dir, { recursive: true, force: true })
+})
+
+function writeConfig(overrides: Record<string, unknown> = {}): void {
+  mkdirSync(dir, { recursive: true })
+  writeFileSync(
+    configPath,
+    JSON.stringify({
+      model: { main: 'bigmodel-coding-plan/GLM-5.2' },
+      provider: {
+        other: { options: { apiKey: 'ignored', baseURL: 'https://example.com/v1' } },
+        'bigmodel-coding-plan': {
+          options: {
+            apiKey: 'test-secret',
+            baseURL: 'https://open.bigmodel.cn/api/anthropic'
+          }
+        }
+      },
+      ...overrides
+    })
+  )
+}
+
+describe('fetchZcodeRateLimits', () => {
+  it('returns unavailable without a supported Coding Plan credential', async () => {
+    writeFileSync(configPath, JSON.stringify({ provider: {} }))
+
+    const result = await fetchZcodeRateLimits({ configPath })
+
+    expect(result).toMatchObject({ provider: 'zcode', status: 'unavailable' })
+    expect(fetch).not.toHaveBeenCalled()
+  })
+
+  it('does not infer an account from the only configured provider without a selected model', async () => {
+    writeConfig({
+      model: {},
+      provider: {
+        zai: { options: { apiKey: 'sole-account', baseURL: 'https://api.z.ai/v1' } }
+      }
+    })
+
+    const result = await fetchZcodeRateLimits({ configPath })
+
+    expect(result.status).toBe('unavailable')
+    expect(fetch).not.toHaveBeenCalled()
+  })
+
+  it('queries the matching quota endpoint and maps rolling, weekly, and MCP limits', async () => {
+    writeConfig()
+    vi.mocked(fetch).mockResolvedValue(
+      new Response(
+        JSON.stringify({
+          success: true,
+          data: {
+            level: 'max',
+            limits: [
+              {
+                type: 'TIME_LIMIT',
+                unit: 5,
+                number: 1,
+                percentage: 3,
+                nextResetTime: 1_787_000_000_000
+              },
+              {
+                type: 'TOKENS_LIMIT',
+                unit: 6,
+                number: 1,
+                percentage: 44,
+                nextResetTime: 1_786_600_000_000
+              },
+              {
+                type: 'TOKENS_LIMIT',
+                unit: 3,
+                number: 5,
+                percentage: 12,
+                nextResetTime: 1_786_500_000_000
+              }
+            ]
+          }
+        })
+      )
+    )
+
+    const result = await fetchZcodeRateLimits({ configPath })
+
+    expect(fetch).toHaveBeenCalledWith(
+      'https://open.bigmodel.cn/api/monitor/usage/quota/limit',
+      expect.objectContaining({
+        method: 'GET',
+        redirect: 'error',
+        headers: expect.objectContaining({ Authorization: 'test-secret' })
+      })
+    )
+    expect(result).toMatchObject({ provider: 'zcode', status: 'ok', planType: 'max' })
+    expect(result.session).toEqual({
+      usedPercent: 12,
+      windowMinutes: 300,
+      resetsAt: 1_786_500_000_000,
+      resetDescription: null
+    })
+    expect(result.weekly?.usedPercent).toBe(44)
+    expect(result.monthly?.usedPercent).toBe(3)
+  })
+
+  it('uses CREDIT_LIMIT counts when the reported percentage is stale', async () => {
+    writeConfig()
+    vi.mocked(fetch).mockResolvedValue(
+      new Response(
+        JSON.stringify({
+          success: true,
+          code: 200,
+          data: {
+            limits: [
+              {
+                type: 'CREDIT_LIMIT',
+                unit: 3,
+                number: 5,
+                usage: 2_000,
+                currentValue: 500,
+                remaining: 1_500,
+                percentage: 1
+              },
+              {
+                type: 'CREDIT_LIMIT',
+                unit: 6,
+                number: 1,
+                usage: 10_000,
+                remaining: 8_000,
+                percentage: 0
+              }
+            ]
+          }
+        })
+      )
+    )
+
+    const result = await fetchZcodeRateLimits({ configPath })
+
+    expect(result.status).toBe('ok')
+    expect(result.session?.usedPercent).toBe(25)
+    expect(result.weekly?.usedPercent).toBe(20)
+    expect(result.monthly).toBeNull()
+  })
+
+  it('drops an implausible five-hour reset without discarding the quota value', async () => {
+    writeConfig()
+    vi.mocked(fetch).mockResolvedValue(
+      new Response(
+        JSON.stringify({
+          success: true,
+          data: {
+            limits: [
+              {
+                type: 'CREDIT_LIMIT',
+                unit: 3,
+                number: 5,
+                percentage: 25,
+                nextResetTime: Date.now() + 10 * 60 * 60_000
+              }
+            ]
+          }
+        })
+      )
+    )
+
+    const result = await fetchZcodeRateLimits({ configPath })
+
+    expect(result.session?.usedPercent).toBe(25)
+    expect(result.session?.resetsAt).toBeNull()
+  })
+
+  it('selects the legacy string model provider when several accounts are configured', async () => {
+    writeConfig({
+      model: 'zai/GLM-5.3',
+      provider: {
+        zai: { options: { apiKey: 'selected-key', baseURL: 'https://api.z.ai/v1' } },
+        bigmodel: { options: { apiKey: 'other-key', baseURL: 'https://open.bigmodel.cn/v1' } }
+      }
+    })
+    vi.mocked(fetch).mockResolvedValue(
+      new Response(
+        JSON.stringify({
+          success: true,
+          data: { limits: [{ type: 'CREDIT_LIMIT', unit: 3, number: 5, percentage: 20 }] }
+        })
+      )
+    )
+
+    const result = await fetchZcodeRateLimits({ configPath })
+
+    expect(result.status).toBe('ok')
+    expect(fetch).toHaveBeenCalledWith(
+      'https://api.z.ai/api/monitor/usage/quota/limit',
+      expect.objectContaining({
+        headers: expect.objectContaining({ Authorization: 'selected-key' })
+      })
+    )
+  })
+
+  it('does not substitute a different account when the selected provider lacks a key', async () => {
+    writeConfig({
+      model: { main: 'unconfigured/GLM-5.3' },
+      provider: { zai: { options: { apiKey: 'other-account', baseURL: 'https://api.z.ai/v1' } } }
+    })
+
+    const result = await fetchZcodeRateLimits({ configPath })
+
+    expect(result.status).toBe('unavailable')
+    expect(fetch).not.toHaveBeenCalled()
+  })
+
+  it('rejects a nonstandard HTTPS port before sending the key', async () => {
+    writeConfig({
+      provider: { zai: { options: { apiKey: 'secret', baseURL: 'https://api.z.ai:4444/v1' } } }
+    })
+
+    const result = await fetchZcodeRateLimits({ configPath })
+
+    expect(result.status).toBe('unavailable')
+    expect(fetch).not.toHaveBeenCalled()
+  })
+
+  it('supports the Z.AI endpoint without exposing credentials in errors', async () => {
+    writeConfig({
+      model: { main: 'zai/GLM-5.2' },
+      provider: {
+        zai: { options: { apiKey: 'never-log-me', baseURL: 'https://api.z.ai/api/anthropic' } }
+      }
+    })
+    vi.mocked(fetch).mockResolvedValue(new Response('denied', { status: 401 }))
+
+    const result = await fetchZcodeRateLimits({ configPath })
+
+    expect(fetch).toHaveBeenCalledWith(
+      'https://api.z.ai/api/monitor/usage/quota/limit',
+      expect.any(Object)
+    )
+    expect(result.status).toBe('error')
+    expect(result.error).toBe('ZCode quota request failed (401)')
+    expect(JSON.stringify(result)).not.toContain('never-log-me')
+  })
+
+  it('changes the non-secret account identity when the selected key changes', async () => {
+    writeConfig()
+    vi.mocked(fetch).mockResolvedValue(new Response('denied', { status: 401 }))
+
+    const first = await fetchZcodeRateLimits({ configPath })
+    writeConfig({
+      provider: {
+        'bigmodel-coding-plan': {
+          options: { apiKey: 'new-key', baseURL: 'https://open.bigmodel.cn/api/anthropic' }
+        }
+      }
+    })
+    const second = await fetchZcodeRateLimits({ configPath })
+
+    expect(first.usageMetadata?.authProvenance).toMatch(/^[a-f0-9]{64}$/)
+    expect(second.usageMetadata?.authProvenance).not.toBe(first.usageMetadata?.authProvenance)
+    expect(JSON.stringify(first)).not.toContain('test-secret')
+    expect(JSON.stringify(second)).not.toContain('new-key')
+  })
+
+  it('rejects malformed successful responses', async () => {
+    writeConfig()
+    vi.mocked(fetch).mockResolvedValue(new Response(JSON.stringify({ success: true, data: {} })))
+
+    const result = await fetchZcodeRateLimits({ configPath })
+
+    expect(result.status).toBe('error')
+    expect(result.usageMetadata?.failureKind).toBe('parse')
+  })
+})
diff --git a/src/main/rate-limits/zcode-usage-fetcher.ts b/src/main/rate-limits/zcode-usage-fetcher.ts
new file mode 100644
index 000000000000..852def603e32
--- /dev/null
+++ b/src/main/rate-limits/zcode-usage-fetcher.ts
@@ -0,0 +1,277 @@
+import { createHmac, randomBytes } from 'node:crypto'
+import { readFileSync } from 'node:fs'
+import { homedir } from 'node:os'
+import { join } from 'node:path'
+import { cancelUnreadResponseBody } from '../lib/unread-response-body'
+import type { ProviderRateLimits, RateLimitWindow } from '../../shared/rate-limit-types'
+
+const API_TIMEOUT_MS = 15_000
+const SUPPORTED_HOSTS = new Set(['api.z.ai', 'open.bigmodel.cn', 'dev.bigmodel.cn'])
+const CREDENTIAL_IDENTITY_KEY = randomBytes(32)
+
+type QuotaLimit = {
+  type?: unknown
+  unit?: unknown
+  number?: unknown
+  usage?: unknown
+  currentValue?: unknown
+  remaining?: unknown
+  percentage?: unknown
+  nextResetTime?: unknown
+}
+
+type ZcodeUsageCredentials = {
+  apiKey: string
+  quotaUrl: string
+  authProvenance: string
+}
+
+// Why readers and not casts: both JSON sources are outside our control — a user-edited
+// config file and a remote response — so their shape is a guess until something checks it.
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value)
+}
+
+function readRecord(value: unknown): Record<string, unknown> | null {
+  return isRecord(value) ? value : null
+}
+
+function readMainProvider(model: unknown): string | null {
+  const name = typeof model === 'string' ? model : readRecord(model)?.main
+  if (typeof name !== 'string') {
+    return null
+  }
+  const delimiter = name.indexOf('/')
+  return delimiter > 0 && delimiter < name.length - 1 ? name.slice(0, delimiter) : null
+}
+
+function unavailable(error: string): ProviderRateLimits {
+  return {
+    provider: 'zcode',
+    session: null,
+    weekly: null,
+    monthly: null,
+    updatedAt: Date.now(),
+    error,
+    status: 'unavailable',
+    usageMetadata: { source: 'web', failureKind: 'missing-credentials' }
+  }
+}
+
+function failed(
+  error: string,
+  failureKind: 'network' | 'server' | 'parse',
+  authProvenance: string
+): ProviderRateLimits {
+  return {
+    provider: 'zcode',
+    session: null,
+    weekly: null,
+    monthly: null,
+    updatedAt: Date.now(),
+    error,
+    status: 'error',
+    usageMetadata: { source: 'web', failureKind, authProvenance }
+  }
+}
+
+function readCredentials(configPath: string): ZcodeUsageCredentials | null {
+  let config: Record<string, unknown> | null
+  try {
+    config = readRecord(JSON.parse(readFileSync(configPath, 'utf8')))
+  } catch {
+    return null
+  }
+
+  if (!config) {
+    return null
+  }
+  // A quota from another configured account must never appear as the selected model's quota.
+  const mainProvider = readMainProvider(config.model)
+  if (!mainProvider) {
+    return null
+  }
+  const options = readRecord(readRecord(readRecord(config.provider)?.[mainProvider])?.options)
+  const apiKey = options?.apiKey
+  const baseURL = options?.baseURL
+  if (
+    typeof apiKey !== 'string' ||
+    !apiKey.trim() ||
+    /[\r\n]/.test(apiKey) ||
+    typeof baseURL !== 'string'
+  ) {
+    return null
+  }
+  try {
+    const parsed = new URL(baseURL)
+    if (
+      parsed.protocol !== 'https:' ||
+      !SUPPORTED_HOSTS.has(parsed.hostname) ||
+      (parsed.port !== '' && parsed.port !== '443')
+    ) {
+      return null
+    }
+    return {
+      apiKey: apiKey.trim(),
+      quotaUrl: `${parsed.origin}/api/monitor/usage/quota/limit`,
+      authProvenance: createHmac('sha256', CREDENTIAL_IDENTITY_KEY)
+        .update(JSON.stringify([mainProvider, parsed.origin, apiKey.trim()]))
+        .digest('hex')
+    }
+  } catch {
+    return null
+  }
+}
+
+function asNumber(value: unknown): number | null {
+  return typeof value === 'number' && Number.isFinite(value) ? value : null
+}
+
+function asUsedPercent(limit: QuotaLimit): number | null {
+  const total = asNumber(limit.usage)
+  if (total !== null && total > 0) {
+    const current = asNumber(limit.currentValue)
+    const remaining = asNumber(limit.remaining)
+    if (current !== null || remaining !== null) {
+      const used = current ?? total - (remaining ?? 0)
+      return Math.min(100, Math.max(0, (used / total) * 100))
+    }
+  }
+  const reported = asNumber(limit.percentage)
+  return reported === null ? null : Math.min(100, Math.max(0, reported))
+}
+
+function asResetTime(value: unknown): number | null {
+  return typeof value === 'number' && Number.isFinite(value) && value > 0 ? value : null
+}
+
+function asWindowMinutes(limit: QuotaLimit): number | null {
+  if (limit.type === 'TIME_LIMIT' && limit.unit === 5 && limit.number === 1) {
+    // Z.ai's monthly MCP marker is encoded as one minute.
+    return 30 * 24 * 60
+  }
+  const multipliers: Record<number, number> = { 1: 1440, 3: 60, 5: 1, 6: 10080 }
+  const unit = asNumber(limit.unit)
+  const count = asNumber(limit.number)
+  if (unit === null || count === null || !Number.isInteger(count) || count <= 0) {
+    return null
+  }
+  const multiplier = multipliers[unit]
+  return multiplier ? count * multiplier : null
+}
+
+function asWindow(limit: QuotaLimit | undefined): RateLimitWindow | null {
+  if (!limit) {
+    return null
+  }
+  const usedPercent = asUsedPercent(limit)
+  const windowMinutes = asWindowMinutes(limit)
+  if (usedPercent === null || windowMinutes === null) {
+    return null
+  }
+  const reset = asResetTime(limit.nextResetTime)
+  return {
+    usedPercent,
+    windowMinutes,
+    resetsAt:
+      windowMinutes === 300 && reset !== null && reset > Date.now() + 301 * 60_000 ? null : reset,
+    resetDescription: null
+  }
+}
+
+export async function fetchZcodeRateLimits(
+  options: {
+    configPath?: string
+    signal?: AbortSignal
+  } = {}
+): Promise<ProviderRateLimits> {
+  const configPath = options.configPath ?? join(homedir(), '.zcode', 'cli', 'config.json')
+  const credentials = readCredentials(configPath)
+  if (!credentials) {
+    return unavailable('ZCode Coding Plan credentials are not configured')
+  }
+
+  let response: Response
+  try {
+    const signal = options.signal
+      ? AbortSignal.any([options.signal, AbortSignal.timeout(API_TIMEOUT_MS)])
+      : AbortSignal.timeout(API_TIMEOUT_MS)
+    response = await fetch(credentials.quotaUrl, {
+      method: 'GET',
+      redirect: 'error',
+      headers: {
+        Authorization: credentials.apiKey,
+        'Accept-Language': 'en-US,en',
+        'Content-Type': 'application/json'
+      },
+      signal
+    })
+  } catch (error) {
+    return failed(
+      error instanceof Error ? error.message : 'ZCode quota request failed',
+      'network',
+      credentials.authProvenance
+    )
+  }
+
+  if (!response.ok) {
+    await cancelUnreadResponseBody(response)
+    return failed(
+      `ZCode quota request failed (${response.status})`,
+      'server',
+      credentials.authProvenance
+    )
+  }
+
+  let payload: Record<string, unknown> | null
+  try {
+    payload = readRecord(await response.json())
+  } catch {
+    return failed('Could not parse ZCode quota response', 'parse', credentials.authProvenance)
+  }
+  const data = readRecord(payload?.data)
+  const code = payload?.code
+  const reported = data?.limits
+  if (
+    payload?.success !== true ||
+    (code !== undefined && code !== 0 && code !== 200) ||
+    !Array.isArray(reported)
+  ) {
+    const msg = payload?.msg
+    const message = typeof msg === 'string' ? msg : 'Invalid ZCode quota response'
+    return failed(message, 'parse', credentials.authProvenance)
+  }
+
+  const limits = reported.filter((value): value is QuotaLimit => isRecord(value))
+  const planLimits = limits
+    .filter((limit) => limit.type === 'TOKENS_LIMIT' || limit.type === 'CREDIT_LIMIT')
+    .map(asWindow)
+    .filter((limit): limit is RateLimitWindow => limit !== null)
+    .sort((left, right) => left.windowMinutes - right.windowMinutes)
+  const session = planLimits.find((limit) => limit.windowMinutes === 300) ?? null
+  const weekly = planLimits.find((limit) => limit.windowMinutes === 10080) ?? null
+  const monthly = asWindow(limits.find((limit) => limit.type === 'TIME_LIMIT'))
+  if (!session && !weekly && !monthly) {
+    return failed(
+      'ZCode quota response contained no usable limits',
+      'parse',
+      credentials.authProvenance
+    )
+  }
+
+  return {
+    provider: 'zcode',
+    session,
+    weekly,
+    monthly,
+    planType: typeof data?.level === 'string' ? data.level : null,
+    updatedAt: Date.now(),
+    error: null,
+    status: 'ok',
+    usageMetadata: {
+      source: 'web',
+      credentialSource: configPath,
+      authProvenance: credentials.authProvenance
+    }
+  }
+}
diff --git a/src/main/remote-agent-trust-presets.test.ts b/src/main/remote-agent-trust-presets.test.ts
index d1ff9ee24ca0..8b552e55277f 100644
--- a/src/main/remote-agent-trust-presets.test.ts
+++ b/src/main/remote-agent-trust-presets.test.ts
@@ -160,3 +160,66 @@ describe('markRemoteAgentWorkspaceTrusted', () => {
     expect(fsProvider.writeFile).not.toHaveBeenCalled()
   })
 })
+
+describe('remote Qoder trust', () => {
+  it('preserves settings and hooks while trusting the execution host canonical folder', async () => {
+    const original = {
+      model: 'custom',
+      hooks: { Stop: [] },
+      permissions: { trustDirectories: ['/old'], other: true }
+    }
+    const fsProvider = makeFsProvider({
+      readFile: vi.fn(async () => ({ content: JSON.stringify(original), isBinary: false }))
+    })
+    mocks.getActiveMultiplexer.mockReturnValue({
+      request: vi.fn(async () => ({ resolvedPath: '/home/remote' }))
+    })
+    mocks.getSshFilesystemProvider.mockReturnValue(fsProvider)
+    await markRemoteAgentWorkspaceTrusted({
+      preset: 'qoder',
+      connectionId: 'ssh-qoder',
+      workspacePath: '/folder'
+    })
+    expect(fsProvider.writeFile).toHaveBeenCalledWith(
+      '/home/remote/.qoder/settings.json',
+      `${JSON.stringify(
+        {
+          ...original,
+          permissions: { ...original.permissions, trustDirectories: ['/old', '/real/folder'] }
+        },
+        null,
+        2
+      )}\n`
+    )
+  })
+
+  it.each(['malformed', 'denied', 'binary', 'trusted'])(
+    'does not overwrite %s remote settings',
+    async (kind) => {
+      const fsProvider = makeFsProvider({
+        readFile: vi.fn(async () => {
+          if (kind === 'denied') {
+            throw Object.assign(new Error('denied'), { code: 'EACCES' })
+          }
+          return {
+            content:
+              kind === 'trusted'
+                ? JSON.stringify({ permissions: { trustDirectories: ['/real/folder'] } })
+                : '{broken',
+            isBinary: kind === 'binary'
+          }
+        })
+      })
+      mocks.getActiveMultiplexer.mockReturnValue({
+        request: vi.fn(async () => ({ resolvedPath: '/home/remote' }))
+      })
+      mocks.getSshFilesystemProvider.mockReturnValue(fsProvider)
+      await markRemoteAgentWorkspaceTrusted({
+        preset: 'qoder',
+        connectionId: 'ssh-qoder',
+        workspacePath: '/folder'
+      })
+      expect(fsProvider.writeFile).not.toHaveBeenCalled()
+    }
+  )
+})
diff --git a/src/main/remote-agent-trust-presets.ts b/src/main/remote-agent-trust-presets.ts
index a9ccb382c09e..9ca8d665e066 100644
--- a/src/main/remote-agent-trust-presets.ts
+++ b/src/main/remote-agent-trust-presets.ts
@@ -1,3 +1,4 @@
+import { markRemoteQoderWorkspaceTrusted } from './qoder/workspace-trust'
 import type { AgentTrustPreset } from './agent-trust-presets'
 import { upsertProjectTrustLevelInContent } from './codex/config-toml-trust'
 import { getActiveMultiplexer } from './ssh/ssh-target-registry'
@@ -20,7 +21,9 @@ export async function markRemoteAgentWorkspaceTrusted(args: {
   }
 
   const workspacePath = await canonicalizeRemoteWorkspacePath(fsProvider, args.workspacePath)
-  if (args.preset === 'codex') {
+  if (args.preset === 'qoder') {
+    await markRemoteQoderWorkspaceTrusted(fsProvider, home, workspacePath)
+  } else if (args.preset === 'codex') {
     await markRemoteCodexProjectTrusted(fsProvider, home, workspacePath)
   } else if (args.preset === 'cursor') {
     await markRemoteCursorWorkspaceTrusted(fsProvider, home, workspacePath)
diff --git a/src/main/repo-execution-host.ts b/src/main/repo-execution-host.ts
new file mode 100644
index 000000000000..dae5b0e48d40
--- /dev/null
+++ b/src/main/repo-execution-host.ts
@@ -0,0 +1,21 @@
+import {
+  getRepoExecutionHostId,
+  getSshTargetIdForExecutionHost,
+  LOCAL_EXECUTION_HOST_ID,
+  type ExecutionHostId
+} from '../shared/execution-host'
+import type { Repo } from '../shared/repo-types'
+
+/** Only for rows from this process's Store: runtime stamps address files registered here. */
+export function getStoredRepoExecutionHostId(
+  repo: Pick<Repo, 'connectionId' | 'executionHostId'>
+): ExecutionHostId {
+  const hostId = getRepoExecutionHostId(repo)
+  return getSshTargetIdForExecutionHost(hostId) ? hostId : LOCAL_EXECUTION_HOST_ID
+}
+
+export function getStoredRepoSshConnectionId(
+  repo: Pick<Repo, 'connectionId' | 'executionHostId'>
+): string | null {
+  return getSshTargetIdForExecutionHost(getStoredRepoExecutionHostId(repo))
+}
diff --git a/src/main/repo-git-remote-avatar-refresh.test.ts b/src/main/repo-git-remote-avatar-refresh.test.ts
new file mode 100644
index 000000000000..a787f5501bf3
--- /dev/null
+++ b/src/main/repo-git-remote-avatar-refresh.test.ts
@@ -0,0 +1,339 @@
+import { afterEach, expect, it, vi } from 'vitest'
+import { getRepoExecutionHostId, type ExecutionHostId } from '../shared/execution-host'
+import { deriveGitRemoteIdentity } from '../shared/git-remote-identity'
+import { projectHostSetupProjectionFromRepos } from '../shared/project-host-setup-projection'
+import { githubAvatarIcon, type RepoIcon } from '../shared/repo-icon'
+import type { Repo } from '../shared/repo-types'
+import { probeGitRemoteIdentity, type GitRemoteIdentityProbe } from './repo-git-remote-identity'
+import {
+  enrichMissingRepoGitRemoteIdentities,
+  flushRepoGitRemoteIdentityEnrichmentForTests,
+  resetRepoGitRemoteIdentityEnrichmentForTests
+} from './repo-git-remote-identity-enrichment'
+
+vi.mock('./repo-git-remote-identity', () => ({ probeGitRemoteIdentity: vi.fn() }))
+
+function identity(remote = 'https://github.com/org-b/app.git') {
+  const parsed = deriveGitRemoteIdentity(`origin\t${remote} (fetch)`)
+  if (!parsed) {
+    throw new Error('Fixture remote must parse')
+  }
+  return parsed
+}
+
+function repo(overrides: Partial<Repo> = {}): Repo {
+  return {
+    id: 'app',
+    path: '/workspace/app',
+    displayName: 'app',
+    kind: 'git',
+    badgeColor: '',
+    addedAt: 1,
+    upstream: null,
+    gitRemoteIdentity: identity(),
+    repoIcon: githubAvatarIcon({ owner: 'owner-a', repo: 'app' }),
+    ...overrides
+  }
+}
+
+function storeFor(repos: Repo[]) {
+  const getRepo = (id: string, hostId?: ExecutionHostId) =>
+    repos.find((row) => row.id === id && (!hostId || getRepoExecutionHostId(row) === hostId))
+  const updateRepo = vi.fn((id: string, updates: Partial<Repo>, hostId?: ExecutionHostId) => {
+    const current = getRepo(id, hostId)
+    if (!current) {
+      return null
+    }
+    Object.assign(current, updates)
+    return current
+  })
+  return { getRepos: () => repos, getRepo, updateRepo }
+}
+
+async function sweep(store: ReturnType<typeof storeFor>, onChanged = vi.fn()) {
+  enrichMissingRepoGitRemoteIdentities(store, { onChanged })
+  for (let i = 0; i < 8; i++) {
+    await flushRepoGitRemoteIdentityEnrichmentForTests()
+  }
+}
+
+async function refresh(store: ReturnType<typeof storeFor>, onChanged = vi.fn()) {
+  vi.useFakeTimers()
+  vi.setSystemTime(1_000)
+  await sweep(store, onChanged)
+  expect(probeGitRemoteIdentity).not.toHaveBeenCalled()
+  vi.setSystemTime(301_001)
+  await sweep(store, onChanged)
+}
+
+afterEach(() => {
+  resetRepoGitRemoteIdentityEnrichmentForTests()
+  vi.useRealTimers()
+  vi.clearAllMocks()
+})
+
+it.each(['already-current', 'changed'])(
+  'repairs a stale avatar when the canonical key is %s',
+  async (mode) => {
+    const local = repo({
+      gitRemoteIdentity:
+        mode === 'changed' ? identity('https://github.com/owner-a/app.git') : identity()
+    })
+    const peer = repo({
+      id: 'peer',
+      path: '/workspace/app',
+      connectionId: 'build',
+      repoIcon: githubAvatarIcon({ owner: 'org-b', repo: 'app' })
+    })
+    const store = storeFor([local, peer])
+    const onChanged = vi.fn()
+    vi.mocked(probeGitRemoteIdentity).mockResolvedValue({
+      status: 'resolved',
+      identity: identity()
+    })
+
+    expect(projectHostSetupProjectionFromRepos(store.getRepos()).projects).toHaveLength(2)
+    await refresh(store, onChanged)
+
+    expect(local.repoIcon).toEqual(githubAvatarIcon({ owner: 'org-b', repo: 'app' }))
+    expect(store.updateRepo).toHaveBeenCalledTimes(1)
+    expect(onChanged).toHaveBeenCalledTimes(1)
+    const projected = projectHostSetupProjectionFromRepos(store.getRepos())
+    expect(projected.projects.map(({ id }) => id)).toEqual(['github:org-b/app'])
+    expect(projected.setups.map(({ hostId, path }) => ({ hostId, path }))).toEqual([
+      { hostId: 'local', path: '/workspace/app' },
+      { hostId: 'ssh:build', path: '/workspace/app' }
+    ])
+    vi.setSystemTime(301_001 + 6 * 60 * 60 * 1000)
+    await sweep(store, onChanged)
+    expect(store.updateRepo).toHaveBeenCalledTimes(1)
+  }
+)
+
+it.each([
+  'https://github.company.test:8443/org-b/app.git',
+  'ssh://git@ssh.github.com:443/org-b/app.git'
+])('preserves GitHub endpoint identity for %s', async (remote) => {
+  const row = repo({ gitRemoteIdentity: identity(remote) })
+  const store = storeFor([row])
+  vi.mocked(probeGitRemoteIdentity).mockResolvedValue({
+    status: 'resolved',
+    identity: identity(remote)
+  })
+  await refresh(store)
+  expect(projectHostSetupProjectionFromRepos([row]).projects[0]?.id).toBe(
+    remote.includes('company') ? 'github:github.company.test:8443/org-b/app' : 'github:org-b/app'
+  )
+})
+
+it.each([
+  'git@github-work:org/app.git',
+  'ssh://git@ghe-work/org/app.git',
+  'https://gitlab.com/team/sub/app.git',
+  'https://forgejo.test/team/app.git',
+  'https://gitea.test/team/app.git',
+  'https://code.company.test/team/app.git'
+])('leaves provider metadata intact for unresolved or other-provider remote %s', async (remote) => {
+  const row = repo({ gitRemoteIdentity: identity(remote) })
+  const original = row.repoIcon
+  const store = storeFor([row])
+  vi.mocked(probeGitRemoteIdentity).mockResolvedValue({
+    status: 'resolved',
+    identity: identity(remote)
+  })
+  await refresh(store)
+  expect(row.repoIcon).toBe(original)
+  expect(store.updateRepo).not.toHaveBeenCalled()
+})
+
+const customIcons: (RepoIcon | null | undefined)[] = [
+  { type: 'emoji', emoji: '🐙' },
+  { type: 'lucide', name: 'Folder' },
+  { type: 'image', source: 'upload', src: 'data:image/png;base64,fixture', label: 'custom' },
+  { type: 'image', source: 'file', src: 'data:image/png;base64,fixture', label: 'custom' },
+  { type: 'image', source: 'favicon', src: 'https://website.test/favicon.png', label: 'custom' },
+  null,
+  undefined
+]
+
+it.each(customIcons)('preserves custom or cleared icon %j', async (repoIcon) => {
+  const row = repo({ repoIcon })
+  const store = storeFor([row])
+  vi.mocked(probeGitRemoteIdentity).mockResolvedValue({ status: 'resolved', identity: identity() })
+  await refresh(store)
+  expect(row.repoIcon).toBe(repoIcon)
+  expect(store.updateRepo).not.toHaveBeenCalled()
+})
+
+it('preserves explicit upstream even when the remote disagrees', async () => {
+  const row = repo({ upstream: { owner: 'parent', repo: 'app', host: 'github.parent.test' } })
+  const original = row.repoIcon
+  const store = storeFor([row])
+  vi.mocked(probeGitRemoteIdentity).mockResolvedValue({ status: 'resolved', identity: identity() })
+  await refresh(store)
+  expect(row.repoIcon).toBe(original)
+  expect(projectHostSetupProjectionFromRepos([row]).projects[0]?.id).toBe(
+    'github:github.parent.test/parent/app'
+  )
+  expect(store.updateRepo).not.toHaveBeenCalled()
+})
+
+it.each(['unavailable', 'no-remote'] as const)(
+  'preserves the last avatar when a refresh is %s',
+  async (status) => {
+    const row = repo()
+    const original = row.repoIcon
+    const store = storeFor([row])
+    vi.mocked(probeGitRemoteIdentity).mockResolvedValue({ status })
+    await refresh(store)
+    expect(row.repoIcon).toBe(original)
+    expect(store.updateRepo).not.toHaveBeenCalled()
+  }
+)
+
+it.each(['same', 'different', 'missing'] as const)(
+  'never probes or writes peer-owned metadata when identity is %s',
+  async (kind) => {
+    const row = repo({
+      executionHostId: 'runtime:peer',
+      connectionId: 'nested',
+      gitRemoteIdentity:
+        kind === 'missing'
+          ? undefined
+          : identity(kind === 'different' ? 'https://github.com/peer-only/app.git' : undefined)
+    })
+    const originalIcon = row.repoIcon
+    const originalIdentity = row.gitRemoteIdentity
+    const store = storeFor([row])
+    vi.mocked(probeGitRemoteIdentity).mockResolvedValue({
+      status: 'resolved',
+      identity: identity()
+    })
+    await (kind === 'missing' ? sweep(store) : refresh(store))
+    expect(probeGitRemoteIdentity).not.toHaveBeenCalled()
+    expect(row.repoIcon).toBe(originalIcon)
+    expect(row.gitRemoteIdentity).toBe(originalIdentity)
+    expect(store.updateRepo).not.toHaveBeenCalled()
+  }
+)
+
+it('repairs only the matching owner when repo IDs and paths collide across hosts', async () => {
+  const local = repo({ repoIcon: githubAvatarIcon({ owner: 'org-b', repo: 'app' }) })
+  const ssh = repo({ executionHostId: 'ssh:build' })
+  const store = storeFor([local, ssh])
+  vi.mocked(probeGitRemoteIdentity).mockResolvedValue({ status: 'resolved', identity: identity() })
+  await refresh(store)
+  expect(store.updateRepo).toHaveBeenCalledWith(
+    'app',
+    { repoIcon: githubAvatarIcon({ owner: 'org-b', repo: 'app' }) },
+    'ssh:build'
+  )
+  expect(projectHostSetupProjectionFromRepos([local, ssh]).projects).toHaveLength(1)
+})
+
+it('keeps local metadata writes scoped when a same-id ssh:build row comes first', async () => {
+  const foreignIdentity = identity('https://github.com/foreign/app.git')
+  const foreignIcon = githubAvatarIcon({ owner: 'foreign', repo: 'app' })
+  const foreign = repo({
+    executionHostId: 'ssh:build',
+    gitRemoteIdentity: foreignIdentity,
+    repoIcon: foreignIcon
+  })
+  const local = repo({ gitRemoteIdentity: identity('https://github.com/old-local/app.git') })
+  const store = storeFor([foreign, local])
+  vi.mocked(probeGitRemoteIdentity).mockImplementation(async (_path, probeHostId) => ({
+    status: 'resolved',
+    identity: probeHostId === 'local' ? identity() : foreignIdentity
+  }))
+  await refresh(store)
+  expect(foreign.gitRemoteIdentity).toBe(foreignIdentity)
+  expect(foreign.repoIcon).toBe(foreignIcon)
+  expect(local.gitRemoteIdentity).toEqual(identity())
+  expect(local.repoIcon).toEqual(githubAvatarIcon({ owner: 'org-b', repo: 'app' }))
+  expect(store.updateRepo).toHaveBeenCalledExactlyOnceWith(
+    'app',
+    { gitRemoteIdentity: identity(), repoIcon: local.repoIcon },
+    'local'
+  )
+})
+
+// Why this row is repaired where the `ssh:build` one above is not: a `runtime:` stamp reaches this
+// store only from a client addressing *this* host, so the files are here and `local` is the only
+// host that can answer for them (`getStoredRepoExecutionHostId`). Both rows are written, each
+// addressed by its own stamp, because that is what the store matches a write against.
+it('repairs a same-id runtime-addressed row under its own stamp', async () => {
+  const runtimeRow = repo({
+    executionHostId: 'runtime:env-a',
+    gitRemoteIdentity: identity('https://github.com/old-runtime/app.git'),
+    repoIcon: githubAvatarIcon({ owner: 'old-runtime', repo: 'app' })
+  })
+  const local = repo({ gitRemoteIdentity: identity('https://github.com/old-local/app.git') })
+  const store = storeFor([runtimeRow, local])
+  vi.mocked(probeGitRemoteIdentity).mockResolvedValue({ status: 'resolved', identity: identity() })
+  await refresh(store)
+  expect(probeGitRemoteIdentity).toHaveBeenCalledWith(
+    '/workspace/app',
+    'local',
+    expect.objectContaining({ signal: expect.any(AbortSignal) })
+  )
+  const repaired = {
+    gitRemoteIdentity: identity(),
+    repoIcon: githubAvatarIcon({ owner: 'org-b', repo: 'app' })
+  }
+  expect(runtimeRow).toMatchObject(repaired)
+  expect(local).toMatchObject(repaired)
+  expect(store.updateRepo).toHaveBeenCalledWith('app', repaired, 'runtime:env-a')
+  expect(store.updateRepo).toHaveBeenCalledWith('app', repaired, 'local')
+})
+
+it('does not write after a pending local probe becomes peer-owned', async () => {
+  let answer: ((value: GitRemoteIdentityProbe) => void) | undefined
+  const row = repo({ gitRemoteIdentity: undefined })
+  const originalIcon = row.repoIcon
+  const store = storeFor([row])
+  vi.mocked(probeGitRemoteIdentity).mockImplementation(
+    () =>
+      new Promise((resolve) => {
+        answer = resolve
+      })
+  )
+  enrichMissingRepoGitRemoteIdentities(store)
+  row.executionHostId = 'runtime:peer'
+  if (!answer) {
+    throw new Error('Expected pending probe')
+  }
+  answer({ status: 'resolved', identity: identity() })
+  await flushRepoGitRemoteIdentityEnrichmentForTests()
+  expect(row.gitRemoteIdentity).toBeUndefined()
+  expect(row.repoIcon).toBe(originalIcon)
+  expect(store.updateRepo).not.toHaveBeenCalled()
+})
+
+it('does not overwrite a custom icon selected while the probe is pending', async () => {
+  let answer: ((value: GitRemoteIdentityProbe) => void) | undefined
+  const row = repo({ gitRemoteIdentity: undefined })
+  const store = storeFor([row])
+  vi.mocked(probeGitRemoteIdentity).mockImplementation(
+    () =>
+      new Promise((resolve) => {
+        answer = resolve
+      })
+  )
+  enrichMissingRepoGitRemoteIdentities(store)
+  const selected: RepoIcon = { type: 'emoji', emoji: '🐙' }
+  row.repoIcon = selected
+  if (!answer) {
+    throw new Error('Expected pending probe')
+  }
+  answer({ status: 'resolved', identity: identity() })
+  await flushRepoGitRemoteIdentityEnrichmentForTests()
+  expect(row.repoIcon).toBe(selected)
+  expect(store.updateRepo).toHaveBeenCalledWith('app', { gitRemoteIdentity: identity() }, 'local')
+})
+
+it('never probes folder workspaces for an avatar repair', async () => {
+  const store = storeFor([repo({ kind: 'folder' })])
+  await refresh(store)
+  expect(probeGitRemoteIdentity).not.toHaveBeenCalled()
+  expect(store.updateRepo).not.toHaveBeenCalled()
+})
diff --git a/src/main/repo-git-remote-identity-enrichment.test.ts b/src/main/repo-git-remote-identity-enrichment.test.ts
index a52d110aa02a..d1e54e11de8a 100644
--- a/src/main/repo-git-remote-identity-enrichment.test.ts
+++ b/src/main/repo-git-remote-identity-enrichment.test.ts
@@ -1,4 +1,5 @@
 import { afterEach, describe, expect, it, vi } from 'vitest'
+import { getRepoExecutionHostId, type ExecutionHostId } from '../shared/execution-host'
 import type { GitRemoteIdentity } from '../shared/git-remote-identity'
 import type { Repo } from '../shared/repo-types'
 import { type GitRemoteIdentityProbe, probeGitRemoteIdentity } from './repo-git-remote-identity'
@@ -15,7 +16,11 @@ vi.mock('./repo-git-remote-identity', () => ({
 type RepoIdentityStore = {
   getRepos: () => Repo[]
   getRepo: (id: string) => Repo | undefined
-  updateRepo: (id: string, updates: Pick<Partial<Repo>, 'gitRemoteIdentity'>) => Repo | null
+  updateRepo: (
+    id: string,
+    updates: Pick<Partial<Repo>, 'gitRemoteIdentity'>,
+    hostId?: ExecutionHostId
+  ) => Repo | null
 }
 
 const remoteIdentity: GitRemoteIdentity = {
@@ -42,8 +47,13 @@ function makeStore(...repos: Repo[]): RepoIdentityStore & { updateRepo: ReturnTy
   return {
     getRepos: () => repos,
     getRepo: (id) => repos.find((candidate) => candidate.id === id),
-    updateRepo: vi.fn((id, updates) => {
-      const target = repos.find((candidate) => candidate.id === id)
+    // Mirrors the real store: `hostId` is matched against the row's own stamp, so a write
+    // addressed to the wrong host finds no row (src/main/persistence/tracking-repos).
+    updateRepo: vi.fn((id, updates, hostId) => {
+      const target = repos.find(
+        (candidate) =>
+          candidate.id === id && (!hostId || getRepoExecutionHostId(candidate) === hostId)
+      )
       if (!target) {
         return null
       }
@@ -129,23 +139,43 @@ describe('enrichMissingRepoGitRemoteIdentities', () => {
     await flushRepoGitRemoteIdentityEnrichmentForTests()
   })
 
-  it('never hands a runtime row nested SSH target to this client dispatch table', async () => {
+  it('never probes a runtime row that names a nested SSH target', async () => {
     // Why: `connectionId` on a `runtime:` row names a target inside that server's namespace, so
-    // dialing it here reaches a same-named box of ours. The row keeps the probe this process has
-    // always run for it; what it must never do is dial our same-named target.
+    // dialing it here reaches a same-named box of ours, and the same path on this machine is a
+    // different checkout. Neither host is probeable from here, so the row is skipped outright.
     vi.mocked(probeGitRemoteIdentity).mockResolvedValue({ status: 'unavailable' })
     const store = makeStore(
       makeRepo({ connectionId: 'nested-1', executionHostId: 'runtime:env-a' })
     )
 
-    enrichMissingRepoGitRemoteIdentities(store)
+    await sweep(store)
+
+    expect(probeGitRemoteIdentity).not.toHaveBeenCalled()
+    expect(store.updateRepo).not.toHaveBeenCalled()
+  })
+
+  it('probes a self-addressed runtime row here and writes it back under its own stamp', async () => {
+    // Why: a bare `runtime:` stamp is how a paired client addresses a repo registered in *this*
+    // process, so its files are local. Skipping it left `gitRemoteIdentity` unset forever, which
+    // consumers read as pending. The write must carry the row's stamp, not the probe host — the
+    // store matches that argument against the stamp, so `local` would match no row.
+    vi.mocked(probeGitRemoteIdentity).mockResolvedValue(resolvedProbe)
+    const repo = makeRepo({ executionHostId: 'runtime:env-a' })
+    const store = makeStore(repo)
+
+    await sweep(store)
 
     expect(probeGitRemoteIdentity).toHaveBeenCalledWith(
       '/workspace/sample-app',
       'local',
       expect.objectContaining({ signal: expect.any(AbortSignal) })
     )
-    await flushRepoGitRemoteIdentityEnrichmentForTests()
+    expect(store.updateRepo).toHaveBeenCalledWith(
+      'repo-1',
+      { gitRemoteIdentity: remoteIdentity },
+      'runtime:env-a'
+    )
+    expect(repo.gitRemoteIdentity).toEqual(remoteIdentity)
   })
 
   it('keeps same-path rows on two different SSH hosts from sharing one backoff', async () => {
@@ -208,7 +238,7 @@ describe('enrichMissingRepoGitRemoteIdentities', () => {
     enrichMissingRepoGitRemoteIdentities(store)
     await flushRepoGitRemoteIdentityEnrichmentForTests()
 
-    expect(store.updateRepo).toHaveBeenCalledWith('repo-1', { gitRemoteIdentity: null })
+    expect(store.updateRepo).toHaveBeenCalledWith('repo-1', { gitRemoteIdentity: null }, 'local')
     expect(repo.gitRemoteIdentity).toBeNull()
   })
 
@@ -243,7 +273,11 @@ describe('enrichMissingRepoGitRemoteIdentities', () => {
     enrichMissingRepoGitRemoteIdentities(store)
     await flushRepoGitRemoteIdentityEnrichmentForTests()
 
-    expect(store.updateRepo).toHaveBeenCalledWith('repo-1', { gitRemoteIdentity: remoteIdentity })
+    expect(store.updateRepo).toHaveBeenCalledWith(
+      'repo-1',
+      { gitRemoteIdentity: remoteIdentity },
+      'local'
+    )
   })
 
   it('does not re-probe a resolved identity before the refresh window elapses', async () => {
@@ -296,7 +330,11 @@ describe('enrichMissingRepoGitRemoteIdentities', () => {
     enrichMissingRepoGitRemoteIdentities(store, { onChanged })
     await drainEnrichmentSweep()
 
-    expect(store.updateRepo).toHaveBeenCalledWith('repo-1', { gitRemoteIdentity: movedIdentity })
+    expect(store.updateRepo).toHaveBeenCalledWith(
+      'repo-1',
+      { gitRemoteIdentity: movedIdentity },
+      'local'
+    )
     expect(repo.gitRemoteIdentity).toEqual(movedIdentity)
     expect(onChanged).toHaveBeenCalledTimes(1)
   })
diff --git a/src/main/repo-git-remote-identity-enrichment.ts b/src/main/repo-git-remote-identity-enrichment.ts
index a97961fe59f1..f1cea725efc0 100644
--- a/src/main/repo-git-remote-identity-enrichment.ts
+++ b/src/main/repo-git-remote-identity-enrichment.ts
@@ -1,10 +1,14 @@
 import {
   getRepoExecutionHostId,
-  getSshTargetIdForExecutionHost,
+  getRepoSshConnectionId,
   LOCAL_EXECUTION_HOST_ID,
   type ExecutionHostId
 } from '../shared/execution-host'
 import type { Repo } from '../shared/repo-types'
+import { githubAvatarIcon, type RepoIcon } from '../shared/repo-icon'
+import { isUnresolvedSshHostAlias } from '../shared/git-remote-host-alias'
+import { getProjectProviderIdentity } from '../shared/project-host-setup-projection'
+import { getStoredRepoExecutionHostId } from './repo-execution-host'
 import { probeGitRemoteIdentity } from './repo-git-remote-identity'
 
 const NO_IDENTITY_RETRY_TTL_MS = 5 * 60 * 1000
@@ -21,8 +25,12 @@ const MAX_IDENTITY_REFRESHES_PER_SWEEP = 4
 
 type RepoIdentityStore = {
   getRepos(): Repo[]
-  getRepo?(id: string): Repo | undefined
-  updateRepo(id: string, updates: Pick<Partial<Repo>, 'gitRemoteIdentity'>): Repo | null
+  getRepo?(id: string, hostId?: ExecutionHostId): Repo | undefined
+  updateRepo(
+    id: string,
+    updates: Pick<Partial<Repo>, 'gitRemoteIdentity' | 'repoIcon'>,
+    hostId?: ExecutionHostId
+  ): Repo | null
 }
 
 type EnrichmentOptions = {
@@ -51,18 +59,23 @@ function getRepoLocationKey(repo: Pick<Repo, 'path' | 'connectionId' | 'executio
   return `${getRepoExecutionHostId(repo)}\0${repo.path}`
 }
 
-/**
- * The host *this* process may run the probe on. `getSshTargetIdForExecutionHost`, not the row's
- * file-holding target: a `runtime:` row's nested SSH target lives in that server's namespace, so
- * dialing it here would reach a same-named box of ours — a wrong-host answer, not a local one.
- */
-function getRepoProbeHostId(repo: Repo): ExecutionHostId {
-  const hostId = getRepoExecutionHostId(repo)
-  return getSshTargetIdForExecutionHost(hostId) ? hostId : LOCAL_EXECUTION_HOST_ID
+// A peer's nested SSH targets belong to its dispatch table, never this client's, so a `runtime:`
+// row that names one has no host here to probe. A `runtime:` stamp on its own is how a paired
+// client addresses files registered in *this* process (`getStoredRepoExecutionHostId`), so that row
+// keeps the local probe it has always had — dropping it leaves its identity permanently pending.
+function getRepoProbeHostId(repo: Repo): ExecutionHostId | null {
+  const hostId = getStoredRepoExecutionHostId(repo)
+  return hostId === LOCAL_EXECUTION_HOST_ID && getRepoSshConnectionId(repo) ? null : hostId
 }
 
-function getCurrentRepo(store: RepoIdentityStore, id: string): Repo | undefined {
-  return store.getRepo?.(id) ?? store.getRepos().find((repo) => repo.id === id)
+function getCurrentRepo(store: RepoIdentityStore, snapshot: Repo): Repo | undefined {
+  const hostId = getRepoExecutionHostId(snapshot)
+  const found = store.getRepo?.(snapshot.id, hostId)
+  return found && getRepoExecutionHostId(found) === hostId
+    ? found
+    : store
+        .getRepos()
+        .find((repo) => repo.id === snapshot.id && getRepoExecutionHostId(repo) === hostId)
 }
 
 function isSameProbedRepo(snapshot: Repo, current: Repo | undefined): current is Repo {
@@ -87,22 +100,67 @@ function shouldWriteProbedIdentity(current: Repo, probed: Repo['gitRemoteIdentit
   return !!probed && probed.canonicalKey !== existing.canonicalKey
 }
 
+function getAutomaticGitHubIconRefresh(
+  current: Repo,
+  probed: NonNullable<Repo['gitRemoteIdentity']>
+): RepoIcon | undefined {
+  if (
+    (current.upstream?.owner && current.upstream.repo) ||
+    current.repoIcon?.type !== 'image' ||
+    current.repoIcon.source !== 'github'
+  ) {
+    return undefined
+  }
+  const identity = getProjectProviderIdentity({
+    upstream: null,
+    repoIcon: undefined,
+    gitRemoteIdentity: probed
+  })
+  if (!identity || (identity.host && isUnresolvedSshHostAlias(identity.host))) {
+    return undefined
+  }
+  const icon = githubAvatarIcon(identity)
+  return icon.type === 'image' &&
+    current.repoIcon.src === icon.src &&
+    current.repoIcon.label === icon.label
+    ? undefined
+    : icon
+}
+
 function writeIdentity(
   store: RepoIdentityStore,
   snapshot: Repo,
   gitRemoteIdentity: Repo['gitRemoteIdentity']
 ): boolean {
-  const current = getCurrentRepo(store, snapshot.id)
-  if (
-    !isSameProbedRepo(snapshot, current) ||
-    !shouldWriteProbedIdentity(current, gitRemoteIdentity)
-  ) {
+  // A peer's repo metadata must never be repaired from a client-local probe.
+  if (!getRepoProbeHostId(snapshot)) {
+    return false
+  }
+  const current = getCurrentRepo(store, snapshot)
+  if (!isSameProbedRepo(snapshot, current)) {
     return false
   }
-  return !!store.updateRepo(snapshot.id, { gitRemoteIdentity })
+  const writeRemote = shouldWriteProbedIdentity(current, gitRemoteIdentity)
+  const icon = gitRemoteIdentity
+    ? getAutomaticGitHubIconRefresh(current, gitRemoteIdentity)
+    : undefined
+  // The row's own host, not the probe's: the store matches this argument against the row's stamp,
+  // so a `runtime:` row probed locally is only addressable here under that stamp.
+  const storeHostId = getRepoExecutionHostId(snapshot)
+  const update = (updates: Pick<Partial<Repo>, 'gitRemoteIdentity' | 'repoIcon'>): Repo | null => {
+    return store.updateRepo(snapshot.id, updates, storeHostId)
+  }
+  if (icon) {
+    return !!update({ ...(writeRemote ? { gitRemoteIdentity } : {}), repoIcon: icon })
+  }
+  return writeRemote && !!update({ gitRemoteIdentity })
 }
 
 async function enrichRepoGitRemoteIdentity(store: RepoIdentityStore, repo: Repo): Promise<boolean> {
+  const hostId = getRepoProbeHostId(repo)
+  if (!hostId) {
+    return false
+  }
   const locationKey = getRepoLocationKey(repo)
   const retryAfter = probeRetryAfterByLocation.get(locationKey) ?? 0
   if (retryAfter > Date.now()) {
@@ -119,7 +177,7 @@ async function enrichRepoGitRemoteIdentity(store: RepoIdentityStore, repo: Repo)
     : NO_IDENTITY_RETRY_TTL_MS
   const controller = new AbortController()
   const promise = (async () => {
-    const result = await probeGitRemoteIdentity(repo.path, getRepoProbeHostId(repo), {
+    const result = await probeGitRemoteIdentity(repo.path, hostId, {
       signal: controller.signal
     })
     // Why the signal and not a catch: probeGitRemoteIdentity swallows the AbortError and RESOLVES
@@ -187,7 +245,9 @@ function retireRemovedLocations(allRepos: Repo[]): void {
 
 function selectEnrichmentCandidates(store: RepoIdentityStore): Repo[] {
   const now = Date.now()
-  const repos = store.getRepos().filter((repo) => repo.kind !== 'folder')
+  const repos = store
+    .getRepos()
+    .filter((repo) => repo.kind !== 'folder' && getRepoProbeHostId(repo) !== null)
   // Why: the settled `null` marker stays a candidate on purpose — a repo that
   // gains a remote later must still resolve. Do not tighten this to
   // `=== undefined`; the retry TTL already bounds the cost and `writeIdentity`
diff --git a/src/main/runtime/__fixtures__/claude-dialog-trust-workspace-answered.meta.json b/src/main/runtime/__fixtures__/claude-dialog-trust-workspace-answered.meta.json
new file mode 100644
index 000000000000..ce80eebc6a7f
--- /dev/null
+++ b/src/main/runtime/__fixtures__/claude-dialog-trust-workspace-answered.meta.json
@@ -0,0 +1,9 @@
+{
+  "capturedAt": "2026-09-25T21:10:00.000Z",
+  "platform": "darwin",
+  "command": ["claude"],
+  "cols": 120,
+  "rows": 40,
+  "note": "Claude Code v2.1.280, macOS arm64, first launch in an untrusted folder with an isolated CLAUDE_CONFIG_DIR (the trust answer went to a throwaway config); Down then Enter picked 'Yes, I trust this folder' and the capture ends on the idle composer; API-key auth",
+  "exitCode": null
+}
diff --git a/src/main/runtime/__fixtures__/claude-dialog-trust-workspace-answered.txt b/src/main/runtime/__fixtures__/claude-dialog-trust-workspace-answered.txt
new file mode 100644
index 000000000000..80b75267b38d
--- /dev/null
+++ b/src/main/runtime/__fixtures__/claude-dialog-trust-workspace-answered.txt
@@ -0,0 +1,21 @@
+78[?25h[?25l[?2004h[?2031h[?1004h

+────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

+Accessingworkspace:

+

+/private/tmp/claude-trust-review/proj

+

+Quicksafetycheck:Isthisaprojectyoucreatedoroneyoutrust?(Likeyourowncode,awell-knownopensource

+project,orworkfromyourteam).Ifnot,takeamomenttoreviewwhat'sinthisfolderfirst.

+

+ClaudeCode'llbeabletoread,edit,andexecutefileshere.

+

+]8;id=zaxmda;https://code.claude.com/docs/en/securitySecurity guide]8;;

+

+❯No,exit

+Yes,Itrustthisfolder

+

+Entertoconfirm·Esctocancel

+[>0q[?u(B
 No, exit
❯Yes, I trust this folder

+
+
+[>4m[<u[?1004l[?2031l[?2004l
















[?2004h[?2031h[?1004h[?1049h[?1000h[?1002h[?1003h[?1006h[?25l]0;✳ Claude Code
 ▐▛███▛█Claude Codev2.1.280
▝▜██████▀Opus 5.5 (1M context) · API Usage Billing
  ▝▝ ▝▝  /private/tmp/claude-trust-review/proj
◐ medium · /effort
────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
❯  
────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
⏸ manual mode on · ? for shortcuts · ← for agents[>0q
        
 ▐▛▛█ 
·▜██████·
~~
▗▟▛███▛█▄
▜███▘
  ▝▝ ▝▝  
 ▐ 
▝▀
        
 ▐▛▛█ 
·▜██████·
~~
▗▟▛███▛█▄
▜███▘
  ▝▝ ▝▝  
 ▐ 
▝▀

\ No newline at end of file
diff --git a/src/main/runtime/__fixtures__/claude-dialog-trust-workspace-narrow.meta.json b/src/main/runtime/__fixtures__/claude-dialog-trust-workspace-narrow.meta.json
new file mode 100644
index 000000000000..5841c7e66944
--- /dev/null
+++ b/src/main/runtime/__fixtures__/claude-dialog-trust-workspace-narrow.meta.json
@@ -0,0 +1,9 @@
+{
+  "capturedAt": "2026-09-25T21:03:00.000Z",
+  "platform": "darwin",
+  "command": ["claude"],
+  "cols": 60,
+  "rows": 30,
+  "note": "Claude Code v2.1.280, macOS arm64, first launch in an untrusted folder with an isolated CLAUDE_CONFIG_DIR (no operator config touched); a narrow pane, where Claude wraps the dialog's opening question across lines; capture ends with the trust dialog owning the screen",
+  "exitCode": null
+}
diff --git a/src/main/runtime/__fixtures__/claude-dialog-trust-workspace-narrow.txt b/src/main/runtime/__fixtures__/claude-dialog-trust-workspace-narrow.txt
new file mode 100644
index 000000000000..9e15b7b1e853
--- /dev/null
+++ b/src/main/runtime/__fixtures__/claude-dialog-trust-workspace-narrow.txt
@@ -0,0 +1,21 @@
+78[?25h[?25l[?2004h[?2031h[?1004h

+────────────────────────────────────────────────────────────

+Accessingworkspace:

+

+/private/tmp/claude-trust-review/proj

+

+Quicksafetycheck:Isthisaprojectyoucreatedorone

+youtrust?(Likeyourowncode,awell-knownopensource

+project,orworkfromyourteam).Ifnot,takeamomentto

+reviewwhat'sinthisfolderfirst.

+

+ClaudeCode'llbeabletoread,edit,andexecutefiles

+here.

+

+]8;id=zaxmda;https://code.claude.com/docs/en/securitySecurity guide]8;;

+

+❯No,exit

+Yes,Itrustthisfolder

+

+Entertoconfirm·Esctocancel

+[>0q[?u
\ No newline at end of file
diff --git a/src/main/runtime/__fixtures__/claude-dialog-trust-workspace.meta.json b/src/main/runtime/__fixtures__/claude-dialog-trust-workspace.meta.json
new file mode 100644
index 000000000000..ecfd36098d27
--- /dev/null
+++ b/src/main/runtime/__fixtures__/claude-dialog-trust-workspace.meta.json
@@ -0,0 +1,9 @@
+{
+  "capturedAt": "2026-09-25T20:03:23.885Z",
+  "platform": "darwin",
+  "command": ["claude", "--dangerously-skip-permissions"],
+  "cols": 120,
+  "rows": 40,
+  "note": "Claude Code v2.1.280, macOS arm64, first launch in an untrusted git worktree; API-key auth; capture ends with the trust dialog owning the screen",
+  "exitCode": 129
+}
diff --git a/src/main/runtime/__fixtures__/claude-dialog-trust-workspace.txt b/src/main/runtime/__fixtures__/claude-dialog-trust-workspace.txt
new file mode 100644
index 000000000000..c8eb94c6b5c1
--- /dev/null
+++ b/src/main/runtime/__fixtures__/claude-dialog-trust-workspace.txt
@@ -0,0 +1,18 @@
+78[?25h[?25l[?2004h[?2031h[?1004h

+────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

+Accessingworkspace:

+

+/Users/xxxxxxxxxxxxx/orca/workspaces/repo/qa-untrusted-raw

+

+Quicksafetycheck:Isthisaprojectyoucreatedoroneyoutrust?(Likeyourowncode,awell-knownopensource

+project,orworkfromyourteam).Ifnot,takeamomenttoreviewwhat'sinthisfolderfirst.

+

+ClaudeCode'llbeabletoread,edit,andexecutefileshere.

+

+]8;id=zaxmda;https://code.claude.com/docs/en/securitySecurity guide]8;;

+

+❯No,exit

+Yes,Itrustthisfolder

+

+Entertoconfirm·Esctocancel

+[>0q[?u
\ No newline at end of file
diff --git a/src/main/runtime/__fixtures__/codex-0157-config-override-embedded-warning.meta.json b/src/main/runtime/__fixtures__/codex-0157-config-override-embedded-warning.meta.json
new file mode 100644
index 000000000000..9adb710acedb
--- /dev/null
+++ b/src/main/runtime/__fixtures__/codex-0157-config-override-embedded-warning.meta.json
@@ -0,0 +1,14 @@
+{
+  "capturedAt": "2026-09-27T20:00:34.230Z",
+  "platform": "darwin",
+  "command": [
+    "codex",
+    "--dangerously-bypass-approvals-and-sandbox",
+    "-c",
+    "model_reasoning_effort=high"
+  ],
+  "cols": 120,
+  "rows": 40,
+  "note": "codex-cli 0.157.1 with only -c model_reasoning_effort. Same embedded-warning cell-diff header repaint as the -m/-c launch (STA-8628). Worktree-path leaf redacted by the recorder scan.",
+  "exitCode": 0
+}
diff --git a/src/main/runtime/__fixtures__/codex-0157-config-override-embedded-warning.txt b/src/main/runtime/__fixtures__/codex-0157-config-override-embedded-warning.txt
new file mode 100644
index 000000000000..8a5d933c1cc2
--- /dev/null
+++ b/src/main/runtime/__fixtures__/codex-0157-config-override-embedded-warning.txt
@@ -0,0 +1 @@
+[?2004h[>4;0m[>7u[?1004h]10;?\]11;?\[?u[?2026h[?25l[?1049h[>4;0m[>7u[?1007l[?1000h[?1002h[?1006h[?1003h[?25l[?2026h[?25l╭───────────────────────────────────────╮│ >_ OpenAI Codex (v0.157.1)            ││                                       ││ model:     loading   /model to change ││ directory: loading                    │╰───────────────────────────────────────╯›Ask Codex to do anything?forshortcuts[0 q╭[?25h[?2026l[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l───────────────────╮                   │                   │  loading  /model to change                  │  ~/orca/…/orca/…start-for-codex-times-out-at ││ permissions: YOLO mode                                   │╰──────────────────────────────────────────────────────────╯[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;sta-8628-bug-worker-s...[?2026h[?25l ╭──────────────────────────────────────────────────────────╮>_OpenAI Codex(v0.157.1)                           modl:    loading   /model to change                 diectory:  ~/orca/…/orca/…start-for-codex-times-out-at│ permissions: YOLO mode                                   │╰──────────────────────────────────────────────────────────╯Tip:Use/inittocreateanAGENTS.mdwithproject-specificguidance.GPT-6-Sol default·~/orca/workspaces/orca/XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX⚠1 warning·f2toview[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠙ sta-8628-bug-worker-s...[?2026h[?25l╭──────────────────────────────────────────────────────────╮│ >_ OpenAI Codex (v0.157.1)                               │                        model:GPT-6-Sol high/modeltochangedirctory:~/orca/…/orca/…start-for-codex-times-out-atpemissions:YOLO mode                                  ╰──────────────────────────────────────────────────────────╯ high · ~/orca/workspaces/orca/sta-862-bug-worke-star-for-codex-times-out-a[?25h[?2026l[?2026h[?25h[?2026l]0;sta-8628-bug-worker-s...[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l
\ No newline at end of file
diff --git a/src/main/runtime/__fixtures__/codex-0157-effort-override-embedded-warning.meta.json b/src/main/runtime/__fixtures__/codex-0157-effort-override-embedded-warning.meta.json
new file mode 100644
index 000000000000..602cf71904bc
--- /dev/null
+++ b/src/main/runtime/__fixtures__/codex-0157-effort-override-embedded-warning.meta.json
@@ -0,0 +1,16 @@
+{
+  "capturedAt": "2026-09-27T19:35:31.761Z",
+  "platform": "darwin",
+  "command": [
+    "codex",
+    "--dangerously-bypass-approvals-and-sandbox",
+    "-m",
+    "gpt-6-sol",
+    "-c",
+    "model_reasoning_effort=high"
+  ],
+  "cols": 120,
+  "rows": 40,
+  "note": "codex-cli 0.157.1 with -m and -c model_reasoning_effort (the worker-start argv). Embedded mode shows a startup warning and redraws the header by cell diff, so a line-folded tail reads `dirctory:` (STA-8628). Worktree-path leaf redacted by the recorder scan.",
+  "exitCode": 0
+}
diff --git a/src/main/runtime/__fixtures__/codex-0157-effort-override-embedded-warning.txt b/src/main/runtime/__fixtures__/codex-0157-effort-override-embedded-warning.txt
new file mode 100644
index 000000000000..04777d9a88c3
--- /dev/null
+++ b/src/main/runtime/__fixtures__/codex-0157-effort-override-embedded-warning.txt
@@ -0,0 +1 @@
+[?2004h[>4;0m[>7u[?1004h]10;?\]11;?\[?u[?2026h[?25l[?1049h[>4;0m[>7u[?1007l[?1000h[?1002h[?1006h[?1003h[?25l[?2026h[?25l╭───────────────────────────────────────╮│ >_ OpenAI Codex (v0.157.1)            ││                                       ││ model:     loading   /model to change ││ directory: loading                    │╰───────────────────────────────────────╯›Ask Codex to do anything?forshortcuts[0 q╭[?25h[?2026l[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l───────────────────╮                   │                   │  loading  /model to change                  │  ~/orca/…/orca/…start-for-codex-times-out-at ││ permissions: YOLO mode                                   │╰──────────────────────────────────────────────────────────╯[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;sta-8628-bug-worker-s...[?2026h[?25h[?2026l[?2026h[?25l ╭──────────────────────────────────────────────────────────╮>_OpenAI Codex(v0.157.1)                           modl:    loading   /model to change                 diectory:  ~/orca/…/orca/…start-for-codex-times-out-at│ permissions: YOLO mode                                   │╰──────────────────────────────────────────────────────────╯Tip:Use/agentstoopentheagentcommandcenter.GPT-6-Sol default·~/orca/workspaces/orca/XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX⚠1 warning·f2toview[?25h[?2026l[?2026h[?25h[?2026l]0;⠙ sta-8628-bug-worker-s...[?2026h[?25l╭──────────────────────────────────────────────────────────╮│ >_ OpenAI Codex (v0.157.1)                               │                        model:GPT-6-Sol high/modeltochangedirctory:~/orca/…/orca/…start-for-codex-times-out-atpemissions:YOLO mode                                  ╰──────────────────────────────────────────────────────────╯ high · ~/orca/workspaces/orca/sta-862-bug-worke-star-for-codex-times-out-a[?25h[?2026l[?2026h[?25h[?2026l]0;sta-8628-bug-worker-s...[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l
\ No newline at end of file
diff --git a/src/main/runtime/__fixtures__/codex-0157-no-daemon-effort-override.meta.json b/src/main/runtime/__fixtures__/codex-0157-no-daemon-effort-override.meta.json
new file mode 100644
index 000000000000..91a98c0b0c78
--- /dev/null
+++ b/src/main/runtime/__fixtures__/codex-0157-no-daemon-effort-override.meta.json
@@ -0,0 +1,17 @@
+{
+  "capturedAt": "2026-09-27T20:48:19.864Z",
+  "platform": "darwin",
+  "command": [
+    "codex",
+    "--no-daemon",
+    "--dangerously-bypass-approvals-and-sandbox",
+    "-m",
+    "gpt-6-sol",
+    "-c",
+    "model_reasoning_effort=high"
+  ],
+  "cols": 120,
+  "rows": 40,
+  "note": "codex-cli 0.157.1 with --no-daemon, -m and -c model_reasoning_effort. No startup warning; header fills in from `loading`. Worktree-path leaf redacted by the recorder scan.",
+  "exitCode": 0
+}
diff --git a/src/main/runtime/__fixtures__/codex-0157-no-daemon-effort-override.txt b/src/main/runtime/__fixtures__/codex-0157-no-daemon-effort-override.txt
new file mode 100644
index 000000000000..e6e8d151af5a
--- /dev/null
+++ b/src/main/runtime/__fixtures__/codex-0157-no-daemon-effort-override.txt
@@ -0,0 +1 @@
+[?2004h[>4;0m[>7u[?1004h]10;?\]11;?\[?u[?2026h[?25l[?1049h[>4;0m[>7u[?1007l[?1000h[?1002h[?1006h[?1003h[?25l[?2026h[?25l╭───────────────────────────────────────╮│ >_ OpenAI Codex (v0.157.1)            ││                                       ││ model:     loading   /model to change ││ directory: loading                    │╰───────────────────────────────────────╯›Ask Codex to do anything?forshortcuts[0 q╭[?25h[?2026l[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l───────────────────╮                   │                   │  loading  /model to change                  │  ~/orca/…/orca/…start-for-codex-times-out-at ││ permissions: YOLO mode                                   │╰──────────────────────────────────────────────────────────╯[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;sta-8628-bug-worker-s...[?2026h[?25lTip:NEW:Preventsleepwhilerunningisnowavailablein/experimental.GPT-6-Sol default·~/orca/workspaces/orca/XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠙ sta-8628-bug-worker-s...[?2026h[?25lGPT-6-Sol high  /model tochangehigh · ~/orca/workspaces/orca/sta-862-bug-worke-star-for-codex-times-out-a[?25h[?2026l[?2026h[?25h[?2026l]0;⠹ sta-8628-bug-worker-s...]0;sta-8628-bug-worker-s...[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l
\ No newline at end of file
diff --git a/src/main/runtime/__fixtures__/codex-0157-plain-ready.meta.json b/src/main/runtime/__fixtures__/codex-0157-plain-ready.meta.json
new file mode 100644
index 000000000000..07d30431d7b2
--- /dev/null
+++ b/src/main/runtime/__fixtures__/codex-0157-plain-ready.meta.json
@@ -0,0 +1,9 @@
+{
+  "capturedAt": "2026-09-27T19:35:31.758Z",
+  "platform": "darwin",
+  "command": ["codex", "--dangerously-bypass-approvals-and-sandbox"],
+  "cols": 120,
+  "rows": 40,
+  "note": "codex-cli 0.157.1, plain launch (no -m/-c). Header paints with `loading` rows, then fills in; the ready baseline for STA-8628. Worktree-path leaf redacted by the recorder scan.",
+  "exitCode": 0
+}
diff --git a/src/main/runtime/__fixtures__/codex-0157-plain-ready.txt b/src/main/runtime/__fixtures__/codex-0157-plain-ready.txt
new file mode 100644
index 000000000000..c346994bd910
--- /dev/null
+++ b/src/main/runtime/__fixtures__/codex-0157-plain-ready.txt
@@ -0,0 +1 @@
+[?2004h[>4;0m[>7u[?1004h]10;?\]11;?\[?u[?2026h[?25l[?1049h[>4;0m[>7u[?1007l[?1000h[?1002h[?1006h[?1003h[?25l[?2026h[?25l╭───────────────────────────────────────╮│ >_ OpenAI Codex (v0.157.1)            ││                                       ││ model:     loading   /model to change ││ directory: loading                    │╰───────────────────────────────────────╯›Ask Codex to do anything?forshortcuts[0 q╭[?25h[?2026l[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25l───────────────────╮                   │                   │  loading  /model to change                  │  ~/orca/…/orca/…start-for-codex-times-out-at ││ permissions: YOLO mode                                   │╰──────────────────────────────────────────────────────────╯[?25h[?2026l[?1006l[?1015l[?1003l[?1002l[?1000l[<1u[?1007l[?1049l[<1u[>4;0m[?2004l[?1004l[0 q[?25h[?2004h[>4;0m[>7u[?1004h[?25l[?1049h[>4;0m[>7u[?1007l[?1000h[?1002h[?1006h[?1003h[?25l[?2026h[?25l╭──────────────────────────────────────────────────────────╮│ >_ OpenAI Codex (v0.157.1)                               ││                                                          ││ model:       loading   /model to change                  ││ directory:   ~/orca/…/orca/…start-for-codex-times-out-at ││ permissions: YOLO mode                                   │╰──────────────────────────────────────────────────────────╯›Ask Codex to do anything?forshortcuts[0 q╭[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;sta-8628-bug-worker-s...[?2026h[?25h[?2026l[?2026h[?25lTip:Use/agentstoopentheagentcommandcenter.GPT-6-Sol default·~/orca/workspaces/orca/XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX←agens · ?forshortcuts[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;⠙ sta-8628-bug-worker-s...[?2026h[?25lGPT-6-Sol medium  /model tochangemdim · ~/orca/workspaces/orca/XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l]0;sta-8628-bug-worker-s...[?2026h[?25h[?2026l[?2026h[?25h[?2026l[?2026h[?25h[?2026l
\ No newline at end of file
diff --git a/src/main/runtime/__fixtures__/dsh-tui-ready-no-key.meta.json b/src/main/runtime/__fixtures__/dsh-tui-ready-no-key.meta.json
new file mode 100644
index 000000000000..5c5284b50567
--- /dev/null
+++ b/src/main/runtime/__fixtures__/dsh-tui-ready-no-key.meta.json
@@ -0,0 +1,9 @@
+{
+  "capturedAt": "2026-09-23T07:34:39.531Z",
+  "platform": "darwin",
+  "command": ["dsh-tui"],
+  "cols": 120,
+  "rows": 40,
+  "note": "dsh-tui 0.10.2 on @deepseek-ai/dsh 0.1.5-rc.1, macOS arm64, no DEEPSEEK_API_KEY, empty workspace, DSH_TUI_LANG=en",
+  "exitCode": 0
+}
diff --git a/src/main/runtime/__fixtures__/dsh-tui-ready-no-key.txt b/src/main/runtime/__fixtures__/dsh-tui-ready-no-key.txt
new file mode 100644
index 000000000000..34f9432049a9
--- /dev/null
+++ b/src/main/runtime/__fixtures__/dsh-tui-ready-no-key.txt
@@ -0,0 +1 @@
+[?25l[?2004h[?1004h]11;?[>0q[?1049h[?1000h[?1002h[?1003h[?1006h]0;✦ 🐋 ]8;;
✦ dsh-TUI  v0.10.2
█▀▀▀▄█▀▀▀▀█▀▀▀▀█▀▀▀▄█▀▀▀▀█▀▀▀▀█▀▀▀▀██
███████████
▄▀▄▄███▀▀▀█▀▀▀█▄▄▄▀▀▀▀▄█▀▀▀█▀▀▀██
▀▀▀▀▄▄▄▀▀▀██████████
▄▄▄▄▄▄▄▄▄▀▀▀▀▀▀▀▀▀▀▀▀█▄▄▄▀█▄▄▄▄█▄▄▄▄██▄▄▄▀█▄▄▄▄█▄▄▄▄██
▄▀▀▀▀▀▀▀▀▀▀▀▀▄▄▀▀▀▀▀▀▀▀▀██▄▀▄█▀▀▀▄███▀▀▀▀█▀▀▀▀█▀▀▀▀
▄▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▄▄▀▀▀▀▀████████████
▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀█▀▀▀██▀▀▀██▄▄▄▀████▀▀▀▀▀▀▄▀▀▀▄
▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀████████████
▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀█████████▄▄▄▄█▄▄▄▀█▄▄▄▀
▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀deepseek-flash · Max effort
▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▄/private/tmp/dsh-ws
▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀Tip: Clicktool/thinking/summaryrowstofold;subagentcardsopendetail;…
⚠ The dsh engine (0.1.5-rc.3) is newer than the 0.1.5-rc.1 this UI is 
validated against, so issues are possible; downgrade via npm i -g 
@deepseek-ai/dsh@0.1.5-rc.1 for stability, or wait for a dsh-tui update.
Explore the uncharted!
▶（Ctrl+P to expand）Contextloaded·Systemprompt18sections·Runtimecontext2items·Skills14·Tools27
╭──────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮
❯  ⛶
╰──────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯
deepseek-flash · max · dsh-ws]8;;
✦
█
█
█
█
█
█
█
█
█
█
E]8;;
✦ 
█▀
█
█
█
█▄
█
█
█▀
█
█
Ex]8;;
✦ ds
█▀▀▀
█
█
█
█▄▄▄
█
█
█▀▀▀
█
█
Expl]8;;
✦ dsh
█▀▀▀▄
██
██
██
█▄▄▄▀
██
██
█▀▀▀█
██
██
Explo]8;;
✦ dsh-
█▀▀▀▄
██
██
██
█▄▄▄▀
██
██
█▀▀▀█
██
██
Explor]8;;
▀▀]8;;
✦ dsh-T
█▀▀▀▄█
███
███
███
█▄▄▄▀█
██
███
█▀▀▀██
███
███
Explore]8;;
✦ dsh-TU
█▀▀▀▄█▀
███
███▀
███
█▄▄▄▀█▄
██▄
███
█▀▀▀██▀
███
███
Explore ]8;;
✦ dsh-TU
█▀▀▀▄█▀
███
███▀
███
█▄▄▄▀█▄
██▄
███
█▀▀▀██▀
███
███
Explore ]8;;
✦ dsh-TUI
▀▀▄█▀▀▀
██
██▀▀▀
██
▄▄▀█▄▄▄
█▄▀▄
██
▀▀██▀▀▀
██
██
Explore th]8;;
▀▀]8;;
✦ dsh-TUI
▀▀▄█▀▀▀▀
██
██▀▀▀
██
▄▄▀█▄▄▄▄
█▄▀▄
███
▀▀██▀▀▀█
███
███
Explore the]8;;
 dsh-TUI
▀▄█▀▀▀▀
██
██▀▀▀
██
▄▀█▄▄▄▄
█▄▀▄
███
▀██▀▀▀█
███
███
xplore the ]8;;
dsh-TUI
▄█▀▀▀▀█▀
███
██▀▀▀█▀
███
▀█▄▄▄▄█▄
█▄▀▄█▀
████
██▀▀▀██▄
████
████
plore the un]8;;
h-TUI
█▀▀▀▀█▀▀
██
█▀▀▀█▀▀
██
█▄▄▄▄█▄▄
▄▀▄█▀▀
███
█▀▀▀██▄▄
████
███
ore the unc]8;;
-
▀▀▀▀█▀▀▀
█
▀▀▀█▀▀▀
█
▄▄▄▄█▄▄▄
▄▀
▀▄
re the unch]8;;
▄▄▄
▀]8;;
TUI
▀▀▀█▀▀▀▀
█
▀▀█▀▀▀
█
▄▄▄█▄▄▄▄
▀▄█▀▀▀▄
███
▀▀██▄▄▄▀
███
███
e the uncha]8;;
UI
▀▀█▀▀▀▀
█
▀█▀▀▀
█
▄▄█▄▄▄▄
▄█▀▀▀▄
███
▀██▄▄▄▀
███
███
 the unchar]8;;
▄
▀▀▀▀▀]8;;
I
▀█▀▀▀▀█
██
█▀▀▀█
██
▄█▄▄▄▄█
█▀▀▀▄█
████
██▄▄▄▀█
████
████
the unchart]8;;
█▀▀▀▀█▀
██
█▀▀▀█▄
██
█▄▄▄▄█
█▀▀▀▄█
████
█▄▄▄▀█
███
███
he uncharte]8;;
▄▄▀▄▄
▀▀▀▀]8;;
█▀▀▀▀█▀
██
█▀▀▀█▄
██
█▄▄▄▄█
█▀▀▀▄█
████
█▄▄▄▀█
███
███
e uncharte]8;;
▀▀█▀▀▀▄
██
▀█▄▄▄▀
█
▄▄█
▀▄██
████
▄▀███
███
███
ncharted!]8;;
▄
▄▄▀▀▀▀▀▀▄▄
▀   ▀▀   ▀
▄]8;;
▀▀█▀▀▀▄
██
▀█▄▄▄▀
█
▄▄█
▀▄██
████
▄▀███
███
███
ncharted!]8;;
▀█▀▀▀▄█
███
█▄▄▄▀
█
▄██
▄███
█████
▀████
████
████
charted!]8;;
█▀▀▀▄█▀
███
█▄▄▄▀▀
█
██▄
███▀
████
████▀
████
███▄
harted!]8;;
▄▄▄▄
▄▀▀▀▀▄▄▀▀▀▀▄
▀  ▀  ▀]8;;
█▀▀▀▄█▀▀
███
█▄▄▄▀▀▀
█
██▄▄
███▀▀
████
████▀▀
████
███▄▄
arted!]8;;
▀▀▀▄█▀▀▀
██
▄▄▄▀▀▀▀
█▄▄▄
██▀▀
███
███▀▀
███
██▄▄
rted!]8;;
▄  ▄
▄▀    ▀▄
▀  ▀]8;;
▀▀▄█▀▀▀▀
██
▄▄▀▀▀▀▄
█
█▄▄▄▀
██▀▀▀▀
██
███▀▀▀
███
██▄▄▄▄
ted!]8;;
✦
▀▄█▀▀▀▀
██
▄▀▀▀▀▄
█
█▄▄▄▀
██▀▀▀▀
██
██▀▀▀
███
██▄▄▄▄
ed!]8;;
     
           
   ]8;;
✦ d
▄█▀▀▀▀█▀
███
▀▀▀▀▄█▀
██
█▄▄▄▀█▄
██▀▀▀▀█▀
███
██▀▀▀▀
██
██▄▄▄▄█▄
d!]8;;
✦ ds
█▀▀▀▀█▀▀
██
▀▀▀▄█▀▀
██
█▄▄▄▀█▄▄
█▀▀▀▀█▀
██
█▀▀▀▀
█
█▄▄▄▄█▄]8;;
✦ ds
▀▀▀▀█▀▀
█
▀▀▀▄█▀▀
██
▄▄▄▀█▄▄
▀▀▀▀█▀
█
▀▀▀▀
▄▄▄▄█▄]8;;
✦ dsh-
▀▀█▀▀▀▀
█
▀▄█▀▀▀
██
▄▀█▄▄▄▄
▀▀
▀
▄▄]8;;
 ▄▀▄ ▄
 ▀▀▀▄ ▄▀▀▀
  ▀▀▀▀▀▀
 ▀▀▀▀
 ▄▀▀▀
▀▀▀
▀▀
▀▀]8;;
✦ dsh-T
▀▀█▀▀▀▀
█
▀▄█▀▀▀
██
▄▀█▄▄▄▄
▀▀█▀▀
█
▀▀▀
▄▄█▄▄]8;;
✦ dsh-TU
▀█▀▀▀▀█
██
▄█▀▀▀█
███
▀█▄▄▄▄█
▀█▀▀█
██
▀▄
█
▄█▄▀█]8;;
  ▀▄ ▄
  ▀▀▀▀   ▄▀▀▀
 ▀▀▄▀▀▀▀▀▀
 ▀▀▀▀▀▀
▄▄▀▀▀▀▀
▀▀▀▀
▀▀]8;;
✦ dsh-TUI
█▀▀▀▀█▀
██
█▀▀▀█▀
██
█▄▄▄▄█▄
█▀▀▀▀█▀
██
▀▀▀▄▀
█
█▄▄▄▀█▄]8;;
✦ dsh-TUI
█▀▀▀▀█▀▀
██
█▀▀▀█▀▀
██
█▄▄▄▄█▄▄
█▀▀█▀▀
██
▀▀▀▀
█▄▄█▄▄]8;;
   ▄ 
  ▀▀▀    
 ▀   ▄▀▀▄
▀▄▀▀▀▀▀
 ▀▀▀▀▀
▀▀▀▀▀
▀▀
▀▀
▀]8;;
✦ dsh-TUI
▀▀▀▀█▀▀▀▀
█
▀▀▀█▀▀▀
█
▄▄▄▄█▄▄▄▄
▀▀▀▀▀
▀▀▀▀▄
█
▄▄▄▄▀]8;;
dsh-TUI
▀▀█▀▀▀▀
█
▀█▀▀▀
█
▄▄█▄▄▄▄
▀█▀▀▀▀
█
▀▀▀▀▄
█
▄█▄▄▄▀]8;;
sh-TUI
▀█▀▀▀▀█
██
█▀▀▀█
██
▄█▄▄▄▄█
▀█▀▀▀▀
█
▄▀▀▀▄
██
▀█▄▄▄▀
E]8;;
 
   ▄▀▄
   ▀▀▀▀    
  ▀▀▀▀    ▄
  ▄▀▀▀▀▀▀▀
▀▀▀▀▀▀▀▀▀
▀▀▀▀▀▀
▀▀▀▀
▀]8;;
h-TUI
█▀▀▀▀█
██
█▀▀▀██
██
█▄▄▄▄█
█▀▀▀▀
█
▀▀▀▄
█
█▄▄▄▀
Ex]8;;
-TUI
█▀▀▀▀█
███
█▀▀▀██
███
█▄▄▄▄█
█▀▀▀▀
█
▀▀▀▄
█
█▄▄▄▀
Exp]8;;
▄
▀▀▀   
▀▀▀▀▄  ▄▀▀▄
▀▀▀▀▄▀▀▀▀▀ 
▄▄▀▀▀▀▀   
▀▀▀▀▀    
▀     
▀▀▀ 
 ]8;;
TUI
▀▀▀▀█
██
▀▀▀██
██
▄▄▄▄█
▀▀▀▀
▀▀▀▄
█
▄▄▄▀
Expl]8;;
UI
▀▀▀██
██
▀▀██
██
▄▄▄██
Explo]8;;
I
▀▀██
██
▀██
██
▄▄██
▀
▄
█
▀
Explor]8;;
▄▀▄ ▄
▀▀▀▀ ▄▀▀▀
▀▀▀▀▀▀▀▀ 
▀▀▀▀▀▀ 
▄▀▀▀  
▀▀▀  
▀ 
▀ 
 ]8;;
▀██
██
██
██
▄██
▀
▄
█
▀
Explore]8;;
██
██
██
██
██
Explore t]8;;
▄▀  ▄ 
▀▀▀▀▄ ▄▄▀▀▀  
▀▀▀▀▀▀▀▀  
▀▀▀▀▀  
 ▀▀▀   
▀▀▀ 
▀▀]8;;
█
█
█
█
█
Explore th]8;;
█
█
█
█
Explore the]8;;
▄▀▄ ▄ 
▀▀▀▄ ▄▀▀▀ 
▀▀▀▀▀▀▀ 
▀▀▀▀ 
▄▀▀▀ 
▀▀ 
▀ 
▀ ]8;;
█
█
xplore the ]8;;
█
█
plore the u]8;;
lore the un]8;;
ore the unc]8;;
re the unch]8;;
e the unch]8;;
▀▀
▀▀▀▀▄
▀ ]8;;
▀
▀▀▀▄▄
▀▀▀▀▀
 ]8;;
▀
▀▀▀  
▀▀▀▄ 
▀]8;;
▀▀
▀▀▀▄ 
 ▀]8;;
 ▄▀▄ ▄
 ▀▀▀▄ ▄▀▀▀
  ▀▀▀▀▀▀
 ▀▀▀▀
 ▄▀▀▀
▀▀▀
▀▀
▀▀]8;;
  ▀▄ ▄
  ▀▀▀▀   ▄▀▀▀
 ▀▀▄▀▀▀▀▀▀
 ▀▀▀▀▀▀
▄▄▀▀▀▀▀
▀▀▀▀
▀▀]8;;
   ▄ 
  ▀▀▀    
 ▀   ▄▀▀▄
▀▄▀▀▀▀▀
 ▀▀▀▀▀
▀▀▀▀▀
▀▀
▀▀
▀]8;;
 
   ▄▀▄
   ▀▀▀▀    
  ▀▀▀▀    ▄
  ▄▀▀▀▀▀▀▀
▀▀▀▀▀▀▀▀▀
▀▀▀▀▀▀
▀▀▀▀
▀]8;;
▄
▀▀▀   
▀▀▀▀▄  ▄▀▀▄
▀▀▀▀▄▀▀▀▀▀ 
▄▄▀▀▀▀▀   
▀▀▀▀▀    
▀     
▀▀▀ 
 ]8;;
▀▀
▀▀▀▀▄
▀ ]8;;
▄▀▄ ▄
▀▀▀▀ ▄▀▀▀
▀▀▀▀▀▀▀▀ 
▀▀▀▀▀▀ 
▄▀▀▀  
▀▀▀  
▀ 
▀▀ 
▀▀▀▄▄
▀▀▀▀▀
 ]8;;
▀▀]8;;
▀
▀▀▀  
▀▀▀▄ 
▀]8;;
▀▀]8;;
▄▀  ▄ 
▀▀▀▀▄ ▄▄▀▀▀  
▀▀▀▀▀▀▀▀  
▀▀▀▀▀  
 ▀▀▀   
▀▀▀ 
▀▀]8;;
▀▀
▀▀▀▄ 
 ▀]8;;
▄▀▄ ▄ 
▀▀▀▄ ▄▀▀▀ 
▀▀▀▀▀▀▀ 
▀▀▀▀ 
▄▀▀▀ 
▀▀ 
▀ 
▀ ]8;;
▀▀
▀▀▀▀▄
▀ ]8;;
▀
▀▀▀▄▄
▀▀▀▀▀
 ]8;;
▀
▀▀▀  
▀▀▀▄ 
▀]8;;
▀▀
▀▀▀▄ 
 ▀]8;;
 ▄▀▄ ▄
 ▀▀▀▄ ▄▀▀▀
  ▀▀▀▀▀▀
 ▀▀▀▀
 ▄▀▀▀
▀▀▀
▀▀
▀▀]8;;
  ▀▄ ▄
  ▀▀▀▀   ▄▀▀▀
 ▀▀▄▀▀▀▀▀▀
 ▀▀▀▀▀▀
▄▄▀▀▀▀▀
▀▀▀▀
▀▀]8;;
   ▄ 
  ▀▀▀    
 ▀   ▄▀▀▄
▀▄▀▀▀▀▀
 ▀▀▀▀▀
▀▀▀▀▀
▀▀
▀▀
▀]8;;
 
   ▄▀▄
   ▀▀▀▀    
  ▀▀▀▀    ▄
  ▄▀▀▀▀▀▀▀
▀▀▀▀▀▀▀▀▀
▀▀▀▀▀▀
▀▀▀▀
▀]8;;
▀▀
▀▀▀▀▄
▀ ]8;;
▄
▀▀▀   
▀▀▀▀▄  ▄▀▀▄
▀▀▀▀▄▀▀▀▀▀ 
▄▄▀▀▀▀▀   
▀▀▀▀▀    
▀     
▀▀▀ 
 ]8;;
▀▀]8;;
▀
▀▀▀▀▄
▀▀▀▀▀
 ]8;;
▀▀]8;;
▀
▀▀▀▀ 
▀▀▀▄ 
▀]8;;
▄▀▄ ▄
▀▀▀▀ ▄▀▀▀
▀▀▀▀▀▀▀▀ 
▀▀▀▀▀▀ 
▄▀▀▀  
▀▀▀  
▀ 
▀ 
 ]8;;
▀▀▀▀
▀▀▀▀
▄▀▄▄]8;;
▀▀
▀▀▀▄ 
 ▀]8;;
▄▀  ▄ 
▀▀▀▀▄ ▄▄▀▀▀  
▀▀▀▀▀▀▀▀  
▀▀▀▀▀  
 ▀▀▀   
▀▀▀ 
▀▀]8;;
▄▄▄▄    
  ▄
 ▀▀▀▀
▀▀▀▀]8;;
▄▀▄ ▄ 
▀▀▀▄ ▄▀▀▀ 
▀▀▀▀▀▀▀ 
▀▀▀▀ 
▄▀▀▀ 
▀▀ 
▀ 
▀ ]8;;
 ▀▀▀▀
▀▄▄
▄▄▄▄    
▄▄▄]8;;
  ▄
 ▀▀▀▀
 ▀▀▀▀]8;;
▀▄▄
▄▄▄▄    
  ▄
▀▀▀]8;;
 ▀▀▀▀
 ▀▀▀▀
▀▄▄
▄▄▄ ]8;;
▀▀
▀▀▀▀▄
▀ ]8;;
▄▄▄▄    
  ▄
 ▀▀▀▀
▀▀▀▀]8;;
▀
▀▀▀▄▄
▀▀▀▀▀
 ]8;;
 ▀▀▀▀
▀▄▄
▄▄▄▄    
▄▄▄]8;;
▀
▀▀▀  
▀▀▀▄ 
▀]8;;
▀▀
▀▀▀▄ 
 ▀]8;;
  ▄
 ▀▀▀▀
 ▀▀▀▀]8;;
▀▄▄
▄▄▄▄    
  ▄
▀▀▀]8;;
 ▀▀▀▀
 ▀▀▀▀
▀▄▄
▄▄▄ ]8;;
 ▄▀▄ ▄
 ▀▀▀▄ ▄▀▀▀
  ▀▀▀▀▀▀
 ▀▀▀▀
 ▄▀▀▀
▀▀▀
▀▀
▀▀]8;;
▄▄▄▄    
  ▄
 ▀▀▀▀
▀▀▀▀]8;;
  ▀▄ ▄
  ▀▀▀▀   ▄▀▀▀
 ▀▀▄▀▀▀▀▀▀
 ▀▀▀▀▀▀
▄▄▀▀▀▀▀
▀▀▀▀
▀▀]8;;
 ▀▀▀▀
▀▄▄
▄▄▄▄    
▄▄▄]8;;
   ▄ 
  ▀▀▀    
 ▀   ▄▀▀▄
▀▄▀▀▀▀▀
 ▀▀▀▀▀
▀▀▀▀▀
▀▀
▀▀
▀]8;;
  ▄
 ▀▀▀▀
 ▀▀▀▀]8;;
▀▀]8;;
▀▀
▀▀▀▀▄
▀ ]8;;
 
   ▄▀▄
   ▀▀▀▀    
  ▀▀▀▀    ▄
  ▄▀▀▀▀▀▀▀
▀▀▀▀▀▀▀▀▀
▀▀▀▀▀▀
▀▀▀▀
▀]8;;
▀▀]8;;
▀
▀▀▀▀▀
▀▀▀▀▀
 ]8;;
▀▄▄
▄▄▄▄    
  ▄
▀▀▀]8;;
▄
▀▀▀   
▀▀▀▀▄  ▄▀▀▄
▀▀▀▀▄▀▀▀▀▀ 
▄▄▀▀▀▀▀   
▀▀▀▀▀    
▀     
▀▀▀ 
▄
\ No newline at end of file
diff --git a/src/main/runtime/__fixtures__/freebuff-lifecycle.meta.json b/src/main/runtime/__fixtures__/freebuff-lifecycle.meta.json
new file mode 100644
index 000000000000..57f6174485f2
--- /dev/null
+++ b/src/main/runtime/__fixtures__/freebuff-lifecycle.meta.json
@@ -0,0 +1,9 @@
+{
+  "capturedAt": "2026-09-28T07:56:49.813Z",
+  "platform": "darwin",
+  "command": ["freebuff", "--cwd", "/tmp/orca-freebuff-folder-workspace"],
+  "cols": 120,
+  "rows": 40,
+  "note": "Freebuff 0.1.2 authenticated free plan; choice, answer, tool, interruption, tool error",
+  "exitCode": 0
+}
diff --git a/src/main/runtime/__fixtures__/freebuff-lifecycle.txt b/src/main/runtime/__fixtures__/freebuff-lifecycle.txt
new file mode 100644
index 000000000000..0f965581bceb
--- /dev/null
+++ b/src/main/runtime/__fixtures__/freebuff-lifecycle.txt
@@ -0,0 +1 @@
+]11;?]10;?[?2031h]10;?]11;?[>0q[?25l[?1016$p[?2027$p[?2031$p[?1004$p[?2004$p[?2026$p[?u]99;i=opentui-notifications:p=?;\]1337;Capabilities\]66;w=1; \]66;s=2; \[?1049h[>4;1m[?2027h[?2004h[?1000h[?1002h[?1003h[?1006h]4;0;?[?2026h[?25l ███████████                        ██                 ▄████  ▄██                                                        ███▀▀▀▀▀▀▀▀                        ██                 ██    ██▀                                                         ███ █████  ██████ ▄█████   ▄████▄  ██████▄  ██   ██ ████████████                                                        ███ ███▀▀  ██▀   ███▄▄▄██ ██▄▄▄███ ██   ▀██ ██   ██   ██    ██                                                          ███ ███    ███   ███▀▀▀▀▀ ██▀▀▀▀▀  ██▄  ▄██ ██▄  ██   ██    ██                                                          ███ ██▀    ██▀    ▀█████   ▀████▀  ██████▀   ▀████▀   ██    ██                                                                                                                                                                                  ┌──────────────────────────────────────────────────────────────────┐                                                    │ Your first message starts the session.                           │                                                    │ Some models aren't available on this connection                  │                                                    └──────────────────────────────────────────────────────────────────┘                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   ╭──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮│                                                                                                                      ││  ▍Enter a coding task or / for commands                                                                              ││                                                                                                                      │╰──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯ GLM 5.3 Flash • max · /private/tmp/orca-freebuff-folder-workspace · /model to change · Chat: New chat                   ← for history · ? for help                                                                                             [?2026l[?1004h[?2026h[?25l│ 1 day streak                                                     │└──────────────────────────────────────────────────────────────────┘[?2026l[?2026h[?25l100/100 Freebucks remaining                    │                                                                  ││✦ Refer friends → earn Freebucks:││││⎘ Copy invite link  Learn More ↵│└──────────────────────────────────────────────────────────────────┘[?2026l[?2026h[?25l ███████████                        ██                 ▄████  ▄██                                                        ███▀▀▀▀▀▀▀▀                        ██                 ██    ██▀                                                         ███ █████  ██████ ▄█████   ▄████▄  ██████▄  ██   ██ ████████████                                                        ███ ███▀▀  ██▀   ███▄▄▄██ ██▄▄▄███ ██   ▀██ ██   ██   ██    ██                                                          ███ ███    ███   ███▀▀▀▀▀ ██▀▀▀▀▀  ██▄  ▄██ ██▄  ██   ██    ██                                                          ███ ██▀    ██▀    ▀█████   ▀████▀  ██████▀   ▀████▀   ██    ██                                                                                                                                                                                  ┌──────────────────────────────────────────────────────────────────┐                                                    │ Your first message starts the session.                           │                                                    │ 100/100 Freebucks remaining                                      │                                                    │ 1 day streak                                                     │                                                    │                                                                  │                                                    │ ✦ Refer friends → earn Freebucks:                                │                                                    │                                                                  │                                                    │ ⎘ Copy invite link  Learn More ↵                                 │                                                    └──────────────────────────────────────────────────────────────────┘                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           ╭──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮│                                                                                                                      ││  ▍Enter a coding task or / for commands                                                                              ││                                                                                                                      │╰──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯ GLM 5.3 Flash • max · /private/tmp/orca-freebuff-folder-workspace · /model to change · Chat: New chat                   ← for history · ? for help                                                                                             [?2026l[?2026h[?25l╭────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮│Geo Daniela — La primera IA de remuneraciones de Chile  Ad││Liquidaciones PDF, Previred CSV, LRE CSV y portal del trabajador. Demo 30 min para PYME.││ Learn more geodaniela.cl│╰────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯[?2026l[?2026h[?25lUse ask_user to ask me to choose blue orgreen.Waitformyreply.Donotmodifyfiles.▍[?2026l]0;Freebuff: Use ask_user to ask me to choose blue or green. W…[?2026h[?25l                                                                                                                        ┌──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐│Starting your model session… Your message is saved.                               ││Esc: back to draft│└──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┘[?2026l[?2026h[?25lSession active                        └──────────────────────────────────────────────────────────────────┘                                    [12:55 AM]  Use ask_user to ask me to choose blue or green. Wait for my reply. Do not modify files. ⎘                                                                    ╭────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮│Geo Daniela — La primera IA de remuneraciones de Chile  Ad││ Liquidaciones PDF, Previred CSV, LRE CSV y portal del trabajador. Demo 30 min para PYME.                           │ Learn more  geodaniela.cl                                ╰────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯ 44m left                                                                                                ✕ End session  ╭──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮│││  ▍Enter a coding task or / for commands                                                                              ││                                                   │╰──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯ GLM 5.3 Flash • max · /private/tmp/orca-freebuff-folder-workspace · /model to change · Chat: Use ask_user to ask me to choose blue or green.Wait for my reply. Do not modify files.                                        [?2026l[?2026h[?25lthinking...        ■ Esc[?2026l[?2026h[?25lhinking...[?2026l[?2026h[?25ltinking...[?2026l[?2026h[?25lthnking...[?2026l[?2026h[?25lthiking...[?2026l[?2026h[?25lthining...[?2026l[?2026h[?25lthinkng...[?2026l[?2026h[?25l1s[?2026l[?2026h[?25lthinkig...[?2026l[?2026h[?25lthinkin...[?2026l[?2026h[?25lthinking..[?2026l[?2026h[?25lthinking..[?2026l[?2026h[?25lthinking..[?2026l[?2026h[?25lhinking...[?2026l[?2026h[?25l2[?2026l[?2026h[?25ltinking...[?2026l[?2026h[?25lthnking...[?2026l[?2026h[?25lthiking...[?2026l[?2026h[?25lthining...[?2026l[?2026h[?25lthinkng...[?2026l[?2026h[?25lthinkig...[?2026l[?2026h[?25l3[?2026l[?2026h[?25lthinkin...[?2026l[?2026h[?25lthinking..[?2026l[?2026h[?25lthinking..[?2026l[?2026h[?25lthinking..[?2026l[?2026h[?25lhinking...[?2026l[?2026h[?25ltinking...[?2026l[?2026h[?25l4[?2026l[?2026h[?25lthnking...[?2026l[?2026h[?25lthiking...[?2026l[?2026h[?25lthining...[?2026l[?2026h[?25lthinkng...[?2026l[?2026h[?25lthinkig...[?2026l[?2026h[?25lthinkin...[?2026l[?2026h[?25lthinking..[?2026l[?2026h[?25l5[?2026l[?2026h[?25lthinking..[?2026l[?2026h[?25lthinking..[?2026l[?2026h[?25lhinking...[?2026l[?2026h[?25ltinking...[?2026l[?2026h[?25lthnking...[?2026l[?2026h[?25lthiking...[?2026l[?2026h[?25l6[?2026l[?2026h[?25lthining...[?2026l[?2026h[?25lthinkng...[?2026l[?2026h[?25lworking... [?2026l[?2026h[?25l• ThinkingThe user wants me to ask them to choose between blue and green using the ask_user tool. This is straightforward — I should call ask_user with a single question offering those two options, then wait for their reply. No file modifications needed.[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25l ▀▀  ██▀███▄▄▄████▄▄▄███▀███████   ██   ███    ██████▀▀▀▀▀██▀▀▀▀▀▄▄████▄██ ▀  ▀   ▀▀▀▀ ▀███▀                                                                      ┌──────────────────────────────────────────────────────────────────┐│ Session active                                              ││100/100 Freebucks remaining││ 1 day streak                                                     │└──────────────────────────────────────────────────────────────────┘                              [12:55 AM]     Use ask_user to ask me to choose blue or green. Wait for my reply. Do not modify files. ⎘ • Thinking   The user wants me to ask them to choose between blue and green using the ask_user tool. This is straightforward — I should call ask_user with a single question offering those two options, then wait for   their reply. No file modifications needed.                                                                                                ╭────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮│Geo Daniela — La primera IA de remuneraciones de Chile  Ad││Liquidaciones PDF, Previred CSV, LRE CSV y portal del trabajador. Demo 30 min para PYME.││ Learn more geodaniela.cl│╰────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯                                                                                                                     6s ╭─────────────────────────────────────────────── Some questions for you ───────────────────────────────────────────────╮│Close ✕││                                                                                                                      ││▼ Which color would you like to choose?                      ││  ○ Blue                                                                                                              ││    Pick blue as the color                                                                                            ││  ○ Green                                                                                                             ││  ○ Custom                                                                                                            ││                                                                                                                      ││╭──────────╮│││ Submit  │    ↑↓ navigate • Enter select││╰──────────╯│╰──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯[?2026l[?2026h[?25l7[?2026l[?2026h[?25l [?2026l[?2026h[?25l█████                          ▄███ ▄██▀▀▀▀▀▀▀▀                           ▀███████▄▄▄▄██   ████████████ ███▀▀  ██▀   ███▄▄▄██ ██▄▄▄███ ██   ▀██ ██   ██   ██    █████ ███    ███   ███▀▀▀▀▀ ██▀▀▀▀▀  ██▄  ▄██ ██▄  ██   ██    ██      ███ ██▀    ██▀    ▀█████   ▀████▀  ██████▀   ▀████▀   ██    ██                              ┌──────────────────────────────────────────────────────────────────┐│ Session active                                                   ││100/100 Freebucks remaining││1 day streak│└──────────────────────────────────────────────────────────────────┘                         [12:55 AM] Use ask_user to ask me to choose blue or green. Wait for my reply. Do not modify files. ⎘                                                                                                                  • Thinking                                  The user wants me to ask them to choose between blue and green using the ask_user tool. This is    straightforward — I should call ask_user with a single question offering those two options, then wait for            their reply. No file modifications needed.                                                                                                          ╭────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮│ Geo Daniela — La primera IA de remuneraciones de Chile                                                          Ad │ │ Liquidaciones PDF, Previred CSV, LRE CSV y portal del trabajador. Demo 30 min para PYME.                           │  │  Learn more  geodaniela.cl                                                                                         │  ╰────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯                                                                                                                      7s ╭─────────────────────────────────────────────── Some questions for you ───────────────────────────────────────────────╮                                                                                                               Close ✕                                                                                                                      ▶ Which color would you like to choose? ↳ "Blue"╭──────────╮│Submit│╰──────────╯[?2026l[?2026h[?25l                                                                                                                                                                                                                                                                                                                                                                                                                              ╭────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮  │ Geo Daniela — La primera IA de remuneraciones de Chile                                                          Ad │  │Liquidaciones PDF, Previred CSV, LRE CSV y portal del trabajador. Demo 30 min para PYME.      │  │ Learn more geodaniela.cl│  ╰────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯  working...                                                                                                  7s  ■ Esc  ╭──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮│            ││ ▍Enter a coding task or / for commands  ││            │╰──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯[?2026l[?2026h[?25l ▀    ██▀▀█████▀████▀████▀▀████▀█   ██                                                                 ┌──────────────────────────────────────────────────────────────────┐│ Session active                                              ││ 100/100 Freebucks remaining                                 ││ 1 day streak                                                │└──────────────────────────────────────────────────────────────────┘                                                                     [12:55 AM]      Use ask_user to ask me to choose blue or green. Wait for my reply. Do not modify files. ⎘               • Thinking                                                         The user wants me to ask them to choose between blue and green using the ask_user tool. This is   straightforward — I should call ask_user with a single question offering those two options, then wait for   their reply. No file modifications needed.                                                        ╭──────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮│                                                                                                          ││Your answer:                              ││││1. Which color would you like to choose?││↳ Blue│││╰──────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25l8[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25l9[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25l10[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25l└──────────────────────────────────────────────────────────────────┘  [12:55 AM]                                                         Use ask_user to ask me to choose blue or green. Wait for my reply. Do not modify files. ⎘                              • Thinking       The user wants me to ask them to choose between blue and green using the ask_user tool. This is straightforward — I should call ask_user with a single question offering those two options, then wait for   their reply. No file modifications needed.                                                                                          ╭──────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮│                                                                                                ││Your answer:                                                                                              ││                                          ││1. Which color would you like to choose?││↳ Blue││                                                                                                                  │╰──────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯                • Thinking                                  The user chose Blue. They asked me to wait for their reply and not modify files. I've received their answer.   I should acknowledge it simply and not do anything else.                                                                                                                     You chose Blue. Noted — and I haven't modified any files, as requested.[?2026l[?2026h[?25l                                                                      [12:55 AM] Use ask_user to ask me to choose blue or green. Wait for my reply. Do not modify files. ⎘                                                                                            • Thinking   The user wants me to ask them to choose between blue and green using the ask_user tool. This is  straightforward —I should call ask_ur with asingle question offeringthose two ptions, then wait for  their reply. Nofile mdifition needed.                                                                                                             ╭──────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮ │                                                                                                                  │ Your answer:              1. Which color would you like to choose?   ↳ Blue                                        ╰──────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯                                                                                                                       • Thinking   The user chose Blue. They asked me to wait for their reply and not modify files. I've received their answer.  I shouldacknowledgeit simply andnt do anything els.                                                                                                               You chose Blue. Noted — and I haven't modified any files, as requested.█                                                                       ⎘•20s•△▽█44m left · 13.2K (1%)✕ End session[?2026l[?2026h[?25lThe user wants me to ask them to choose between blue and green using the ask_user tool. This is   straightforward — I should call ask_user with a single question offering those two options, then wait for   their reply. No file modifications needed.                                                        ╭──────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮│                                                                                                          ││Your answer:                              ││││1. Which color would you like to choose?││   ↳ Blue                                                                                                         │╰──────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯                                            ╭─────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮ │Looooooong running AI agentsAd│ │ Build and run AI agents that don't time out on Trigger.dev                                        trigger.dev ↗ │ ╰─────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯ [?2026l[?2026h[?25lRun sleep 20 then say done. Do not modify files.▍[?2026l]0;Freebuff: Run sleep 20 then say done. Do not modify files.[?2026h[?25l                                                                                                                                                                                                          ╭──────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮│││Your answer:││                                                                                                                  │1. Which color would you like to choose?  ↳ Blue    ╰──────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯          ╭─────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮ │Looooooong running AI agentsAd││Build and run AI agents that don't time out on Trigger.devtrigger.dev ↗│╰╯                                • Thinking                                                                  The user chose Blue. They asked me to wait for their reply and not modify files. I've received their answer.     I should acknowledge it simply and not do anything else.          You chose Blue. Noted — and I haven't modified any files, as requested.                                                                                                ⎘•20s•△▽  [12:56 AM]                                                             Run sleep 20 then say done. Do not modify files. ⎘        ▍Enter a coding task or / for commands           [?2026l[?2026h[?25l▸ Thinking                                                                                                                       ╭──────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮              Your answer:                                          1. Which color would you like to choose? ↳ Blue │                                                                                                                  │ ╰──────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯                                                                                                                      ╭─────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮ Looooooong running AI agents                                         Ad │ Build and run AI agents that don't time out on Trigger.dev                                        trigger.dev ↗ │ ╰─────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯            ▸ Thinking                                                                                                                                                               You chose Blue. Noted — and I haven't modified any files, as requested.                                                                        ⎘•20s•△▽           [12:56 AM] Run sleep 20 then say done. Do not modify files. ⎘                                                     thinking...                  ■ Esc[?2026l[?2026h[?25lhinking...[?2026l[?2026h[?25ltinking...[?2026l[?2026h[?25lthnking...[?2026l[?2026h[?25lthiking...[?2026l[?2026h[?25lthining...[?2026l[?2026h[?25lthinkng...[?2026l[?2026h[?25l1s[?2026l[?2026h[?25lthinkig...[?2026l[?2026h[?25lthinkin...[?2026l[?2026h[?25lthinking..[?2026l[?2026h[?25lthinking..[?2026l[?2026h[?25lthinking..[?2026l[?2026h[?25lhinking...[?2026l[?2026h[?25l2[?2026l[?2026h[?25ltinking...[?2026l[?2026h[?25lthnking...[?2026l[?2026h[?25lthiking...[?2026l[?2026h[?25lthining...[?2026l[?2026h[?25lthinkng...[?2026l[?2026h[?25lthinkig...[?2026l[?2026h[?25l3[?2026l[?2026h[?25lthinkin...[?2026l[?2026h[?25lthinking..[?2026l[?2026h[?25lthinking..[?2026l[?2026h[?25lthinking..[?2026l[?2026h[?25lhinking...[?2026l[?2026h[?25ltinking...[?2026l[?2026h[?25l4[?2026l[?2026h[?25lthnking...[?2026l[?2026h[?25lthiking...[?2026l[?2026h[?25lthining...[?2026l[?2026h[?25lthinkng...[?2026l[?2026h[?25lthinkig...[?2026l[?2026h[?25lthinkin...[?2026l[?2026h[?25lthinking..[?2026l[?2026h[?25l5[?2026l[?2026h[?25lthinking..[?2026l[?2026h[?25lthinking..[?2026l[?2026h[?25lhinking...[?2026l[?2026h[?25ltinking...[?2026l[?2026h[?25l [?2026l[?2026h[?25lthnking...[?2026l[?2026h[?25lthiking...[?2026l[?2026h[?25l6[?2026l[?2026h[?25lthining...[?2026l[?2026h[?25lthinkng...[?2026l[?2026h[?25lthinkig...[?2026l[?2026h[?25lthinkin...[?2026l[?2026h[?25lthinking..[?2026l[?2026h[?25lthinking..[?2026l[?2026h[?25l7[?2026l[?2026h[?25lthinking..[?2026l[?2026h[?25lhinking...[?2026l[?2026h[?25lworking... [?2026l[?2026h[?25l│ Your answer:││││1. Which color would you like to choose?││   ↳ Blue                                                                                                         │╰──────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯                                            ╭─────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮ │Looooooong running AI agentsAd│ │ Build and run AI agents that don't time out on Trigger.dev                                        trigger.dev ↗ │ ╰─────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯▸ Thinking                                                                                                                                         You chose Blue. Noted — and I haven't modified any files, as requested.                                                                                                                     ⎘ • 20s • △▽  [12:56 AM] Run sleep 20 then say done. Do not modify files. ⎘                                                                       • Thinking        The user wants me to run `sleep 20` in the terminal and then say "done". This is a simple, harmless command —   it just waits 20 seconds. No files modified. The tool guidance says to ask permission for commands other   than the listed use cases, but this is trivially safe and the user explicitly requested it, which is explicit permission itself. Let[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25l me run it with an appropriate timeout (default is[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25l  ↳ Blue    ╰──────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯          ╭─────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮ │Looooooong running AI agentsAd││Build and run AI agents that don't time out on Trigger.devtrigger.dev ↗│╰╯                                ▸ Thinking                                                                                                                                                                                   You chose Blue. Noted — and I haven't modified any files, as requested.          ⎘•20s•△▽  [12:56 AM]                                                             Run sleep 20 then say done. Do not modify files. ⎘         • Thinking   The user wants me to run `sleep 20` in the terminal and then say "done". This is a simple, harmless command — it just waits 20 seconds. No files modified. The tool guidance says to ask permission for commands other   than the listed use cases, but this is trivially safe and the user explicitly requested it, which is explicit prmission itself. Let me run it withan appopriate timeout (default is 30, which is fine for a 20-second sleep).                                                                                                                                                                                                                $ sleep 20                                                                 8[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25l            ╭─────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮  │Looooooong running AI agentsAd│ │Build and run AI agents that don't time out on Trigger.devtrigger.dev ↗│ ╰╯                                  ▸ Thinking                                                                                                                                                                                     You chose Blue. Noted — and I haven't modified any files, as requested.           ⎘•20s•△▽    [12:56 AM]                                                              Run sleep 20 then say done. Do not modify files. ⎘           • Thinking    The user wants me to run `sleep 20` in the terminal and then say "done". This is a simple, harmless command —  it just waits 20 seconds. No files modified. The tool guidance says to ask permission for commands other    than the listed use cases, but this is trivially safe and the user explicitly requested it, which is explicit  prmission itself. Let me run it withan appopriate timeout (default is 30, which is fine for a 20-second  sleep).                                                                                                                                                                                                                  $ sleep 20                                                                                                              [response interrupted]           ⎘•△▽▄44m left · 13.2K (1%)✕ End session[?2026l[?2026h[?25l╰─────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯▸ Thinking                                                                                                                                         You chose Blue. Noted — and I haven't modified any files, as requested.                                                                                                                    ⎘ • 20s • △▽   [12:56 AM] Run sleep 20 then say done. Do not modify files. ⎘                                                                       • Thinking        The user wants me to run `sleep 20` in the terminal and then say "done". This is a simple, harmless command —   it just waits 20 seconds. No files modified. The tool guidance says to ask permission for commands other   than the listed use cases, but this is trivially safe and the user explicitly requested it, which is explicit permission itself. Let me run it with an appropriate timeout (default is 30s, which is fine for a 20-second   sleep).                                                                                                              $ sleep 20                                                                                                                                                                                                               ╭─────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮│Looooooong running AI agentsAd││Build and run AI agents that don't time out on Trigger.devtrigger.dev ↗│╰─────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯[?2026l[?2026h[?25lRun sh -c "exit 7" and report the result. Do not modify files.▍[?2026l]0;Freebuff: Run sh -c "exit 7" and report the result. Do not …[?2026h[?25l                                                                                                                   You chose Blue. Noted — and I haven't modified any files, as requested.          ⎘•20s•△▽  [12:56 AM]                                                             Run sleep 20 then say done. Do not modify files. ⎘         • Thinking   The user wants me to run `sleep 20` in the terminal and then say "done". This is a simple, harmless command — it just waits 20 seconds. No files modified. The tool guidance says to ask permission for commands other   than the listed use cases, but this is trivially safe and the user explicitly requested it, which is explicit prmission itself. Let me run it withan appopriate timeout (default is 30, which is fine for a 20-second sleep).                                                                                                                                                                                                                $ sleep 20                                                                                                            ╭─────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮│ Looooooong running AI agentsAd││Build and run AI agents that don't time out on Trigger.devtrigger.dev ↗│╰╯                                [response interrupted]                                                                                                                                                                ⎘ • △▽   [12:56 AM]            Run sh -c "exit 7" and report the result. Do not modify files. ⎘    ▍Enter a coding task or / for commands                         [?2026l[?2026h[?25l│Build and run AI agents that don't time out on Trigger.devtrigger.dev ↗│ ╰─────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯          ▸ Thinking              You chose Blue. Noted — and I haven't modified any files, as requested. ⎘•20s•△▽             [12:56 AM]                                                                                                      Run sleep 20 then say done. Do not modify files. ⎘                                                                                                                                                                        ▸ Thinking                                                                                                              $ sleep 20            ╭─────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮ │ Looooooong running AI agents                                                                                 Ad │ Build and run AI agents that don't time out on Trigger.devtrigger.dev ↗ ╰─────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯                                                                                                                     [response interrupted]                       ⎘•△▽       [12:56 AM] Run sh -c "exit 7" and report the result. Do not modify files. ⎘                                                                   thinking...                  ■ Esc[?2026l[?2026h[?25lhinking...[?2026l[?2026h[?25ltinking...[?2026l[?2026h[?25lthnking...[?2026l[?2026h[?25lthiking...[?2026l[?2026h[?25lthining...[?2026l[?2026h[?25lthinkng...[?2026l[?2026h[?25l1s[?2026l[?2026h[?25lthinkig...[?2026l[?2026h[?25lthinkin...[?2026l[?2026h[?25lthinking..[?2026l[?2026h[?25lthinking..[?2026l[?2026h[?25lthinking..[?2026l[?2026h[?25lhinking...[?2026l[?2026h[?25l2[?2026l[?2026h[?25ltinking...[?2026l[?2026h[?25lthnking...[?2026l[?2026h[?25lthiking...[?2026l[?2026h[?25lthining...[?2026l[?2026h[?25lthinkng...[?2026l[?2026h[?25lManaged Postgresthat keepsupwith your machins     Scale your production wokloads withTigerData'smanaged, unfked PstgreSQL ndhigh-availability multi-AZ…SttFreTrial  tigerdata.com[?2026l[?2026h[?25lthinkig...[?2026l[?2026h[?25l3[?2026l[?2026h[?25lthinkin...[?2026l[?2026h[?25lthinking..[?2026l[?2026h[?25lworking.. [?2026l[?2026h[?25lYou chose Blue. Noted — and I haven't modified any files, as requested.                                                                                                                     ⎘ • 20s • △▽  [12:56 AM] Run sleep 20 then say done. Do not modify files. ⎘                                                                       ▸ Thinking         $ sleep 20                                                    ╭─────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮│ Looooooong running AI agentsAd││Build and run AI agents that don't time out on Trigger.devtrigger.dev ↗│╰─────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯[response interrupted]                                                                                                                          ⎘• △▽                                                                           [12:56 AM]                                                                                                         Run sh -c "exit 7" and report the result. Do not modify files. ⎘                      • Thinking    The user wants me to run `sh -c "exit 7"` and report the result. This is a harmless command — it just exits   with code 7. It doesn't modify files. Let me run it with the run_terminal_command tool.                                                                 $ sh -c "exit 7"[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25l  [12:56 AM]                                                             Run sleep 20 then say done. Do not modify files. ⎘         ▸ Thinking                                                    $ sleep 20          ╭─────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮│ Looooooong running AI agentsAd││Build and run AI agents that don't time out on Trigger.devtrigger.dev ↗│╰╯                                [response interrupted]                                                                                                                                                                 ⎘ • △▽  [12:56 AM]            Run sh -c "exit 7" and report the result. Do not modify files. ⎘     • Thinking   The user wants me to run `sh -c "exit 7"` and report the result. This is a harmless command — it just exits with code 7. It doesn't modify files. Let me run it with the run_terminal_command tool.          $ sh -c "exit 7"                                                                                              command: sh -c "exit 7"                                                                  stdout: exitCode: 7     [?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25l4[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25l5[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25l6[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25l7[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25l8[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25lworking...[?2026l[?2026h[?25l9[?2026l[?2026h[?25l            [response interrupted]                             ⎘•△▽           [12:56 AM]  Run sh -c "exit 7" and report the result. Do not modify files. ⎘• Thinking                                                                                                          The user wants me to run `sh -c "exit 7"` and report the result. This is a harmless command — it just exits     with code 7. It doesn't modify files. Let me run it with the run_terminal_command tool.                                                                                                                                 $ sh -c "exit 7"command: sh -c "exit 7"stdout:     exitCode: 7            • Thinking                                                       The command `sh -c "exit 7"` was run. It exited with code 7, no stdout output. I should report the result. No   files modified.                                                                                                            The command ran and completed with:                                                      - Exit code: 7 (as expected, since  exit 7  was explicitly called)- stdout: empty - stderr: none                 No files were modified.[?2026l[?2026h[?25l[response interrupted]                       ⎘•△▽       [12:56 AM] Run sh -c "exit 7" and report the result. Do not modify files. ⎘                                                                   • Thinking   The user wants me to run `sh -c "exit 7"` and report the result. This is a harmless command — it just exits  with code 7. It doesn't modify files.Letme run it withthe run_terminal_command tool.                                                                                                              $ sh -c "exit 7" command: sh -c "exit 7" stdout:                 exitCode: 7             • Thinking   The command `sh -c "exit 7"` was run. It exited with code 7, no stdout output. I should report the result. No  files odified.                                                                                                               The command ran and completed with: - Exit code: 7 (s expectd, since  exit 7  was explicitly called) stdout: empty                                                    errnone                 No files were modified.                        ⎘•9s•△▽▄43m left · 13.3K (1%)✕ End session[?2026l[?2026h[?25l                      • Thinking    The user wants me to run `sh -c "exit 7"` and report the result. This is a harmless command — it just exits   with code 7. It doesn't modify files. Let me run it with the run_terminal_command tool.                                                                 $ sh -c "exit 7"command: sh -c "exit 7"stdout:                                                                                                       exitCode: 7                                                                              ╭─────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮│ Your AI Agent’s Data Layer, Built on MongoDB AtlasAd││ Power your agentic workflows with MongoDB Atlas for reliable, scalable session memory and real-…mongodb.com ↗│╰─────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯[?2026l[?2026h[?25l [?2026l
\ No newline at end of file
diff --git a/src/main/runtime/__fixtures__/freebuff-login.meta.json b/src/main/runtime/__fixtures__/freebuff-login.meta.json
new file mode 100644
index 000000000000..390bcedba909
--- /dev/null
+++ b/src/main/runtime/__fixtures__/freebuff-login.meta.json
@@ -0,0 +1,9 @@
+{
+  "capturedAt": "2026-09-28T07:20:19.119Z",
+  "platform": "darwin",
+  "command": ["freebuff", "--cwd", "/tmp/orca-freebuff-verify"],
+  "cols": 100,
+  "rows": 32,
+  "note": "Freebuff npm 0.1.2, unauthenticated, macOS arm64; no model inference",
+  "exitCode": 0
+}
diff --git a/src/main/runtime/__fixtures__/freebuff-login.txt b/src/main/runtime/__fixtures__/freebuff-login.txt
new file mode 100644
index 000000000000..d90d8905cebd
--- /dev/null
+++ b/src/main/runtime/__fixtures__/freebuff-login.txt
@@ -0,0 +1 @@
+]11;?]10;?[?2031h]10;?]11;?[>0q[?25l[?1016$p[?2027$p[?2031$p[?1004$p[?2004$p[?2026$p[?u]99;i=opentui-notifications:p=?;\]1337;Capabilities\]66;w=1; \]66;s=2; \[?1049h[>4;1m[?2027h[?2004h[?1000h[?1002h[?1003h[?1006h]4;0;?[?2026h[?25l ███████████                        ██                 ▄████  ▄██                                    ███▀▀▀▀▀▀▀▀                        ██                 ██    ██▀                                     ███ █████  ██████ ▄█████   ▄████▄  ██████▄  ██   ██ ████████████                                    ███ ███▀▀  ██▀   ███▄▄▄██ ██▄▄▄███ ██   ▀██ ██   ██   ██    ██                                      ███ ███    ███   ███▀▀▀▀▀ ██▀▀▀▀▀  ██▄  ▄██ ██▄  ██   ██    ██                                      ███ ██▀    ██▀    ▀█████   ▀████▀  ██████▀   ▀████▀   ██    ██                                                                                                                                          ┌──────────────────────────────────────────────────────────────────┐                                │ Your first message starts the session.                           │                                │ Some models aren't available on this connection                  │                                └──────────────────────────────────────────────────────────────────┘                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Try one of these:                                                                                   → Explain this codebase                                                                             → Find opportunities to refactor                                                                    → Improve my test coverage                                                                                                                                                                             ╭──────────────────────────────────────────────────────────────────────────────────────────────────╮│                                                                                                  ││  ▍Enter a coding task or / for commands                                                          ││                                                                                                  │╰──────────────────────────────────────────────────────────────────────────────────────────────────╯ GLM 5.3 Flash • max · /private/tmp/orca-freebuff-verify · /model to change · Chat: New chat         ← for history · ? for help                                                                         [?2026l[?1004h[?2026h[?25l                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ███████████                        ██                 ▄████  ▄██                                    ███▀▀▀▀▀▀▀▀                        ██                 ██    ██▀                                     ███ █████  ██████ ▄█████   ▄████▄  ██████▄  ██   ██ ████████████                                    ███ ███▀▀  ██▀   ███▄▄▄██ ██▄▄▄███ ██   ▀██ ██   ██   ██    ██                                      ███ ███    ███   ███▀▀▀▀▀ ██▀▀▀▀▀  ██▄  ▄██ ██▄  ██   ██    ██                                      ███ ██▀    ██▀    ▀█████   ▀████▀  ██████▀   ▀████▀   ██    ██                                                                                                                                                               Press ENTER to login...                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      [?2026l[?2026h[?25l                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ███████████                        ██                 ▄████  ▄██                                    ███▀▀▀▀▀▀▀▀                        ██                 ██    ██▀                                     ███ █████  ██████ ▄█████   ▄████▄  ██████▄  ██   ██ ████████████                                    ███ ███▀▀  ██▀   ███▄▄▄██ ██▄▄▄███ ██   ▀██ ██   ██   ██    ██                                      ███ ███    ███   ███▀▀▀▀▀ ██▀▀▀▀▀  ██▄  ▄██ ██▄  ██   ██    ██                                      ███ ██▀    ██▀    ▀█████   ▀████▀  ██████▀   ▀████▀   ██    ██                                                                                                                                                               Press ENTER to login...                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      [?2026l
\ No newline at end of file
diff --git a/src/main/runtime/__fixtures__/freebuff-ready.meta.json b/src/main/runtime/__fixtures__/freebuff-ready.meta.json
new file mode 100644
index 000000000000..4555254cd8f8
--- /dev/null
+++ b/src/main/runtime/__fixtures__/freebuff-ready.meta.json
@@ -0,0 +1,9 @@
+{
+  "capturedAt": "2026-09-28T08:15:15.356Z",
+  "platform": "darwin",
+  "command": ["freebuff", "--cwd", "/tmp/orca-freebuff-trust"],
+  "cols": 120,
+  "rows": 40,
+  "note": "Freebuff 0.1.2 authenticated, declined repository agent files; waiting for first message",
+  "exitCode": 0
+}
diff --git a/src/main/runtime/__fixtures__/freebuff-ready.txt b/src/main/runtime/__fixtures__/freebuff-ready.txt
new file mode 100644
index 000000000000..150521f88b99
--- /dev/null
+++ b/src/main/runtime/__fixtures__/freebuff-ready.txt
@@ -0,0 +1,11 @@
+]11;?]10;?
+freebuff found agent files in this repository it has not run before:
+
+  /private/tmp/orca-freebuff-trust/.agents
+    agents: demo.ts
+
+These run with your permissions and can read your environment. Only load them if you trust this repository.
+
+Load and run these? [y/N] n
+Skipped agents and mcp.json in /private/tmp/orca-freebuff-trust/.agents for this run. Re-run and answer y to trust it, or set CODEBUFF_TRUST_AGENT_DIRS=1 (or pass --trust-agents).
+[?2031h]10;?]11;?[>0q[?25l[?1016$p[?2027$p[?2031$p[?1004$p[?2004$p[?2026$p[?u]99;i=opentui-notifications:p=?;\]1337;Capabilities\]66;w=1; \]66;s=2; \[?1049h[>4;1m[?2027h[?2004h[?1000h[?1002h[?1003h[?1006h]4;0;?[?2026h[?25l ███████████                        ██                 ▄████  ▄██                                                        ███▀▀▀▀▀▀▀▀                        ██                 ██    ██▀                                                         ███ █████  ██████ ▄█████   ▄████▄  ██████▄  ██   ██ ████████████                                                        ███ ███▀▀  ██▀   ███▄▄▄██ ██▄▄▄███ ██   ▀██ ██   ██   ██    ██                                                          ███ ███    ███   ███▀▀▀▀▀ ██▀▀▀▀▀  ██▄  ▄██ ██▄  ██   ██    ██                                                          ███ ██▀    ██▀    ▀█████   ▀████▀  ██████▀   ▀████▀   ██    ██                                                                                                                                                                                  ┌──────────────────────────────────────────────────────────────────┐                                                    │ Your first message starts the session.                           │                                                    │ Some models aren't available on this connection                  │                                                    └──────────────────────────────────────────────────────────────────┘                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   ╭──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮│                                                                                                                      ││  ▍Enter a coding task or / for commands                                                                              ││                                                                                                                      │╰──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯ GLM 5.3 Flash • max · /private/tmp/orca-freebuff-trust · /model to change · Chat: New chat                              ← for history · ? for help                                                                                             [?2026l[?1004h[?2026h[?25l95/100 Freebucks remaining                     │                                                                  ││✦ Refer friends → earn Freebucks:││││⎘ Copy invite link  Learn More ↵│└──────────────────────────────────────────────────────────────────┘[?2026l[?2026h[?25l1 day streak                                 ✦ Refer friends → earn Freebucks:                                │ ⎘ Copy invite link  Learn More ↵                                 │└──────────────────────────────────────────────────────────────────┘[?2026l[?2026h[?25l ███████████                        ██                 ▄████  ▄██                                                        ███▀▀▀▀▀▀▀▀                        ██                 ██    ██▀                                                         ███ █████  ██████ ▄█████   ▄████▄  ██████▄  ██   ██ ████████████                                                        ███ ███▀▀  ██▀   ███▄▄▄██ ██▄▄▄███ ██   ▀██ ██   ██   ██    ██                                                          ███ ███    ███   ███▀▀▀▀▀ ██▀▀▀▀▀  ██▄  ▄██ ██▄  ██   ██    ██                                                          ███ ██▀    ██▀    ▀█████   ▀████▀  ██████▀   ▀████▀   ██    ██                                                                                                                                                                                  ┌──────────────────────────────────────────────────────────────────┐                                                    │ Your first message starts the session.                           │                                                    │ 95/100 Freebucks remaining                                       │                                                    │ 1 day streak                                                     │                                                    │                                                                  │                                                    │ ✦ Refer friends → earn Freebucks:                                │                                                    │                                                                  │                                                    │ ⎘ Copy invite link  Learn More ↵                                 │                                                    └──────────────────────────────────────────────────────────────────┘                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           ╭──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮│                                                                                                                      ││  ▍Enter a coding task or / for commands                                                                              ││                                                                                                                      │╰──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯ GLM 5.3 Flash • max · /private/tmp/orca-freebuff-trust · /model to change · Chat: New chat                              ← for history · ? for help                                                                                             [?2026l[?2026h[?25l╭────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮│MARS | A robot to build physical AI agents  Ad││A mobile robot with an arm to run agents for $995. Start in simulation. Bring it to life.││ Learn more innate.bot│╰────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯[?2026l
\ No newline at end of file
diff --git a/src/main/runtime/__fixtures__/freebuff-trust.meta.json b/src/main/runtime/__fixtures__/freebuff-trust.meta.json
new file mode 100644
index 000000000000..d4513cba70e3
--- /dev/null
+++ b/src/main/runtime/__fixtures__/freebuff-trust.meta.json
@@ -0,0 +1,9 @@
+{
+  "capturedAt": "2026-09-28T08:09:19.020Z",
+  "platform": "darwin",
+  "command": ["freebuff", "--cwd", "/tmp/orca-freebuff-trust"],
+  "cols": 120,
+  "rows": 40,
+  "note": "Freebuff 0.1.2; harmless repository agent file trust prompt, not accepted",
+  "exitCode": 0
+}
diff --git a/src/main/runtime/__fixtures__/freebuff-trust.txt b/src/main/runtime/__fixtures__/freebuff-trust.txt
new file mode 100644
index 000000000000..48ca2e771609
--- /dev/null
+++ b/src/main/runtime/__fixtures__/freebuff-trust.txt
@@ -0,0 +1,9 @@
+]11;?]10;?
+freebuff found agent files in this repository it has not run before:
+
+  /private/tmp/orca-freebuff-trust/.agents
+    agents: demo.ts
+
+These run with your permissions and can read your environment. Only load them if you trust this repository.
+
+Load and run these? [y/N] 
\ No newline at end of file
diff --git a/src/main/runtime/__fixtures__/orca-runtime-terminal-close-continuity-fixtures.ts b/src/main/runtime/__fixtures__/orca-runtime-terminal-close-continuity-fixtures.ts
index 945284816224..c0053bc75ae2 100644
--- a/src/main/runtime/__fixtures__/orca-runtime-terminal-close-continuity-fixtures.ts
+++ b/src/main/runtime/__fixtures__/orca-runtime-terminal-close-continuity-fixtures.ts
@@ -1,3 +1,4 @@
+import { withDurableRuntimeStore } from '../runtime-durable-store-fixture'
 import { vi, type Mock } from 'vitest'
 import { makePaneKey } from '../../../shared/stable-pane-id'
 import type { WorkspaceSessionState } from '../../../shared/workspace-session-state-types'
@@ -20,6 +21,7 @@ import {
   WORKTREE_ID,
   WORKTREE_PATH,
   canaryProcess,
+  makeDeferred,
   makeSession
 } from './orca-runtime-terminal-close-continuity-state-fixture'
 import { createCloseContinuityGraphFixture } from './orca-runtime-terminal-close-continuity-graph-fixture'
@@ -45,18 +47,11 @@ export {
   makeSession
 } from './orca-runtime-terminal-close-continuity-state-fixture'
 
-function makeDeferred() {
-  let resolve!: () => void
-  const promise = new Promise<void>((settle) => {
-    resolve = settle
-  })
-  return { promise, resolve }
-}
-
 export type CloseContinuityHarness = {
   runtime: OrcaRuntimeService
   acknowledged: ReturnType<typeof makeDeferred>
   closeTerminal: Mock<(...args: unknown[]) => unknown>
+  closeTerminalPane: Mock<(...args: unknown[]) => unknown>
   closeTerminalTab: Mock<(...args: unknown[]) => unknown>
   flushOrThrow: Mock<() => void>
   kill: Mock<(ptyId: string) => boolean>
@@ -67,6 +62,7 @@ export type CloseContinuityHarness = {
   syncFixtureTabWithoutLeaf: () => void
   syncSplitFixtureGraph: () => void
   getSession: () => WorkspaceSessionState
+  editSession: (edit: (session: WorkspaceSessionState) => WorkspaceSessionState) => void
   makeSessionUnavailable: () => void
   removeVictimFromInventory: () => void
   retirePersistedTab: () => void
@@ -101,7 +97,7 @@ function createHarness(
     badgeColor: '#000000',
     addedAt: 1
   }
-  const store = {
+  const store = withDurableRuntimeStore({
     getRepos: () => [repo],
     getRepo: (id: string) => (id === REPO_ID ? repo : undefined),
     getAllWorktreeMeta: () => ({}),
@@ -117,11 +113,12 @@ function createHarness(
         throw flushError
       }
     })
-  }
+  })
   const acknowledged = makeDeferred()
   let closeTerminalTabError: Error | null = null
   let closeTerminalTabAction: (() => void | Promise<void>) | null = null
   const closeTerminal = vi.fn()
+  const closeTerminalPane = vi.fn()
   const closeTerminalTab = vi.fn(() => {
     if (closeTerminalTabError) {
       return Promise.reject(closeTerminalTabError)
@@ -162,7 +159,8 @@ function createHarness(
     ...(options.includeCanary ? [canaryProcess] : [])
   ])
   const runtime = new OrcaRuntimeService(store as never)
-  runtime.setNotifier({ closeTerminal, closeTerminalTab } as never)
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: these close paths call only the listed notifier methods.
+  runtime.setNotifier({ closeTerminal, closeTerminalPane, closeTerminalTab } as never)
   runtime.setPtyController({
     write: () => true,
     kill,
@@ -201,16 +199,20 @@ function createHarness(
     }
   }
   graph.syncFixtureGraph()
-  return {
+  return withDurableRuntimeStore({
     runtime,
     acknowledged,
     closeTerminal,
+    closeTerminalPane,
     closeTerminalTab,
     flushOrThrow: store.flushOrThrow,
     kill,
     stopAndWait,
     ...graph,
     getSession: () => session,
+    editSession: (edit) => {
+      session = edit(session)
+    },
     makeSessionUnavailable: () => {
       sessionAvailable = false
     },
@@ -264,7 +266,7 @@ function createHarness(
         }
       }
     }
-  }
+  })
 }
 
 function createPtyBackedPublishedSurfaceHarness(): CloseContinuityHarness {
diff --git a/src/main/runtime/__fixtures__/orca-runtime-terminal-close-continuity-state-fixture.ts b/src/main/runtime/__fixtures__/orca-runtime-terminal-close-continuity-state-fixture.ts
index d304ff57d232..21013296dafe 100644
--- a/src/main/runtime/__fixtures__/orca-runtime-terminal-close-continuity-state-fixture.ts
+++ b/src/main/runtime/__fixtures__/orca-runtime-terminal-close-continuity-state-fixture.ts
@@ -106,3 +106,11 @@ export function makeSession(ptyId = PTY_ID, includeCanary = false): WorkspaceSes
     }
   }
 }
+
+export function makeDeferred() {
+  let resolve!: () => void
+  const promise = new Promise<void>((settle) => {
+    resolve = settle
+  })
+  return { promise, resolve }
+}
diff --git a/src/main/runtime/__fixtures__/qoder-no-account.meta.json b/src/main/runtime/__fixtures__/qoder-no-account.meta.json
new file mode 100644
index 000000000000..e434627627c0
--- /dev/null
+++ b/src/main/runtime/__fixtures__/qoder-no-account.meta.json
@@ -0,0 +1,17 @@
+{
+  "capturedAt": "2026-09-28T08:03:27.131Z",
+  "platform": "darwin",
+  "command": [
+    "qodercli",
+    "--config-dir",
+    "/tmp/orca-qoder-probe/config",
+    "--cwd",
+    "/tmp/orca-qoder-probe/workspace",
+    "--prompt-interactive",
+    "Reply with hello."
+  ],
+  "cols": 100,
+  "rows": 32,
+  "note": "Qoder CLI 1.1.64; isolated trusted folder; no account; lifecycle hook capture",
+  "exitCode": 129
+}
diff --git a/src/main/runtime/__fixtures__/qoder-no-account.txt b/src/main/runtime/__fixtures__/qoder-no-account.txt
new file mode 100644
index 000000000000..9c6753425599
--- /dev/null
+++ b/src/main/runtime/__fixtures__/qoder-no-account.txt
@@ -0,0 +1,66 @@
+[?u]11;?\[>q[>4;?m
]0;◇ Qoder CLI | Ready                                                             ]8;;78

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+[?25h[?25l[?1006l[?1002l[?1004h]0;◇ Qoder CLI | Ready                                                             [?2004h[?2004h[?1004h

+ ██████╭─Tipsforgettingstarted────────────────────────────────╮

+████│1.UseAGENTS.mdfilestocustomizeinteractions│

+██████QoderCLIv1.1.64│2./helpformoreinformation│

+████│3.Askcodingquestions,editcodeorruncommands│

+ ██████NotLoginPleaseAuth│4.Bespecificforthebestresults│

+╰───────────────────────────────────────────────────────────╯

+

+

+ Authenticating

+────────────────────────────────────────────────────────────────────────────────────────────────────

+

+⠋Waitingforauthentication...

+

+Escback

+[>0q
Welcome to Qoder CLI
Signintogetstarted,orexittheapplication.

❯1.Signintocontinue
   2. Exittheapplication

+

+↑/↓navigate·Enterselect·Escback

+]0;✦ Qoder CLI | Working                                                           
 > Reply with hello.

 Welcome to Qoder CLI
────────────────────────────────────────────────────────────────────────────────────────────────────
Sign in toget started, orexittheapplication.

❯1.Signintocontinue
   2. Exit the application

+

+↑/↓navigate·Enterselect·Escback

+]0;✦ Reply with hello. | Working                                                   ]0;◇ Reply with hello. | Ready                                                     
 x Qoder authenticationisnotready.Pleasesigninagain(e.g.via/login)beforesendinga
   message.
 Welcome to Qoder CLI
────────────────────────────────────────────────────────────────────────────────────────────────────
Sign in toget started, orexittheapplication.

❯1.Signintocontinue
   2. Exit the application

+

+↑/↓navigate·Enterselect·Escback

+


+
+
+
+
+
+
+
+
+
\ No newline at end of file
diff --git a/src/main/runtime/__fixtures__/qoder-ready.meta.json b/src/main/runtime/__fixtures__/qoder-ready.meta.json
new file mode 100644
index 000000000000..d197b691db48
--- /dev/null
+++ b/src/main/runtime/__fixtures__/qoder-ready.meta.json
@@ -0,0 +1,9 @@
+{
+  "capturedAt": "2026-09-28T08:15:00.339Z",
+  "platform": "darwin",
+  "command": ["qodercli", "--cwd", "/tmp/orca-qoder-probe/workspace"],
+  "cols": 100,
+  "rows": 32,
+  "note": "Qoder CLI 1.1.64; existing browser-login config; credit limit reached; no prompt submitted",
+  "exitCode": 129
+}
diff --git a/src/main/runtime/__fixtures__/qoder-ready.txt b/src/main/runtime/__fixtures__/qoder-ready.txt
new file mode 100644
index 000000000000..e198f8ff3bbb
--- /dev/null
+++ b/src/main/runtime/__fixtures__/qoder-ready.txt
@@ -0,0 +1,66 @@
+[?u]11;?\[>q[>4;?m
]0;◇ Qoder CLI | Ready                                                             ]8;;78

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+[?25h[?25l[?1006l[?1002l[?1004h]0;◇ Qoder CLI | Ready                                                             [?2004h[?2004h[?1004h

+ ██████╭─Tipsforgettingstarted──────────────────────────────╮

+████│1.UseAGENTS.mdfilestocustomizeinteractions│

+██████QoderCLIv1.1.64│2./helpformoreinformation│

+████│3.Askcodingquestions,editcodeorruncommands│

+ ██████SignedinBrowserLogin│4.Bespecificforthebestresults│

+╰─────────────────────────────────────────────────────────╯

+

+

+?forshortcuts

+────────────────────────────────────────────────────────────────────────────────────────────────────

+Shift+TabtoAcceptEdits

+────────────────────────────────────────────────────────────────────────────────────────────────────

+> Typeyourmessageor@path/to/file

+────────────────────────────────────────────────────────────────────────────────────────────────────

+Model·ctx░░░░░░░░░░0%·/private/tmp/orca-qoder-probe/workspace

+[>0q
Qwen3.8-Max Model · ctx░░░░░░░░░░ 0% · /privte/tmp/oca-qoder-robe/workspace

+
●Warning:Truecolor(24-bit)supportnotdetected.Usingaterminalwithtruecolor enabled will
   result in a better visual experience.

                                                                                    ? for shortcuts
────────────────────────────────────────────────────────────────────────────────────────────────────
 Shift+Tab to Accept Edits                                                             1 MCP server
────────────────────────────────────────────────────────────────────────────────────────────────────

+> Typeyourmessageor@path/to/file

+────────────────────────────────────────────────────────────────────────────────────────────────────

+Qwen3.8-MaxModel·ctx░░░░░░░░░░0%·/private/tmp/orca-qoder-probe/workspace

+
1MCPserver · 34kills

+
+
+
+
+
Creditsexhausted.Use/usagefordetailsor/upgradefor more.

+
+
+
+
+
+
+
\ No newline at end of file
diff --git a/src/main/runtime/__fixtures__/qoder-trust-dialog.meta.json b/src/main/runtime/__fixtures__/qoder-trust-dialog.meta.json
new file mode 100644
index 000000000000..f028a668af32
--- /dev/null
+++ b/src/main/runtime/__fixtures__/qoder-trust-dialog.meta.json
@@ -0,0 +1,15 @@
+{
+  "capturedAt": "2026-09-28T07:56:42.619Z",
+  "platform": "darwin",
+  "command": [
+    "qodercli",
+    "--config-dir",
+    "/tmp/orca-qoder-probe/config",
+    "--cwd",
+    "/tmp/orca-qoder-probe/workspace"
+  ],
+  "cols": 100,
+  "rows": 32,
+  "note": "Qoder CLI 1.1.64; isolated configuration; no account",
+  "exitCode": 129
+}
diff --git a/src/main/runtime/__fixtures__/qoder-trust-dialog.txt b/src/main/runtime/__fixtures__/qoder-trust-dialog.txt
new file mode 100644
index 000000000000..039f945f776d
--- /dev/null
+++ b/src/main/runtime/__fixtures__/qoder-trust-dialog.txt
@@ -0,0 +1,58 @@
+[?u]11;?\[>q[>4;?m
]0;◇ Qoder CLI | Ready                                                             ]8;;78

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+

+[?25h[?25l[?1006l[?1002l[?1004h]0;◇ Qoder CLI | Ready                                                             [?2004h[?2004h[?1004h

+ ██████╭─Tipsforgettingstarted────────────────────────────────╮

+████│1.UseAGENTS.mdfilestocustomizeinteractions│

+██████QoderCLIv1.1.64│2./helpformoreinformation│

+████│3.Askcodingquestions,editcodeorruncommands│

+ ██████NotLoginPleaseAuth│4.Bespecificforthebestresults│

+╰───────────────────────────────────────────────────────────╯

+

+

+ Doyoutrustthefilesinthisfolder?

+────────────────────────────────────────────────────────────────────────────────────────────────────

+Pleaseconfirmthisisyourownprojectorfromatrustedsource.Oncetrusted,QoderCLIcan

+read,modify,andexecutefileshere,andwillloadlocalconfigurations(commands,hooks,MCP

+servers,agents,skills,settings).

+

+/private/tmp/orca-qoder-probe/workspace

+

+❯1.Trustfolder

+2.Don'ttrustandexit

+

+↑/↓navigate·Enterselect·Escback

+[>0q
 ● Warning: True color (24-bit) supportnotdetected.Usingaterminalwithtruecolorenabledwill
   result in a better visual experience.

 Do you trust the files in this folder?
────────────────────────────────────────────────────────────────────────────────────────────────────
Pleaseconfirmthisisyourownprojectorfromatrustedsource.Oncetrusted,QoderCLIcan
read, modify, and execute files here, andwillloadlocalconfigurations(commands,hooks,MCP
servers,agents,skills,settings).

/private/tmp/orca-qoder-probe/workspace
 ❯ 1. Trust folder

+2.Don'ttrustandexit

+

+↑/↓navigate·Enterselect·Escback

+
\ No newline at end of file
diff --git a/src/main/runtime/acknowledged-terminal-tab-retirement-fixture.ts b/src/main/runtime/acknowledged-terminal-tab-retirement-fixture.ts
index 2173d080dcb8..51cd8b4cd8bf 100644
--- a/src/main/runtime/acknowledged-terminal-tab-retirement-fixture.ts
+++ b/src/main/runtime/acknowledged-terminal-tab-retirement-fixture.ts
@@ -5,6 +5,8 @@ import { vi } from 'vitest'
 import { getDefaultWorkspaceSession } from '../../shared/constants'
 import type { RuntimeSyncWindowGraph } from '../../shared/runtime-types'
 import { closeTerminalTabInWorkspaceSession } from '../../shared/workspace-session-terminal-tab-close'
+import { ProfileStateSqliteAuthority } from '../persistence/profile-state/profile-state-sqlite-authority'
+import { DelayedAuthority } from '../persistence/loading-store/profile-state-delayed-authority-fixture'
 import { Store } from '../persistence/loading-store/store'
 import { OrcaRuntimeService } from './orca-runtime'
 import { buildHeadlessMobileSessionTerminalTabs } from './mobile-session-terminal-projection'
@@ -28,7 +30,13 @@ function deferred(): { promise: Promise<void>; resolve: () => void } {
 
 export function createAcknowledgedTabRetirementFixture(bound = false) {
   const directory = mkdtempSync(join(tmpdir(), 'orca-close-ack-'))
-  const store = new Store({ dataFile: join(directory, 'orca-data.json') })
+  const authority = new DelayedAuthority(
+    new ProfileStateSqliteAuthority(join(directory, 'profile-state.db'), 'ack-retirement')
+  )
+  const store = new Store({
+    dataFile: join(directory, 'orca-data.json'),
+    profileStateAuthority: authority
+  })
   store.addRepo({
     id: 'repo1',
     path: '/tmp/worktree',
@@ -150,7 +158,7 @@ export function createAcknowledgedTabRetirementFixture(bound = false) {
       ACK_TAB
     )
     store.setWorkspaceSession({ ...closed.session, terminalTopologyRevisionByRepoId: undefined })
-    store.flushOrThrow()
+    await store.flushPendingOrThrowAsync()
     entered.resolve()
     await acknowledgement.promise
   })
@@ -171,6 +179,7 @@ export function createAcknowledgedTabRetirementFixture(bound = false) {
   return {
     runtime,
     store,
+    authority,
     entered,
     acknowledgement,
     closeTerminalTab,
@@ -182,9 +191,8 @@ export function createAcknowledgedTabRetirementFixture(bound = false) {
     dispose: async () => {
       runtime.setNotifier(null)
       runtime.syncWindowGraph(1, { tabs: [], leaves: [], mobileSessionTabs: [] })
-      store.flush()
-      store.freezeWrites()
-      await store.waitForPendingWrite()
+      await store.flushPendingOrThrowAsync()
+      await store.freezeWritesAsync()
       setRuntimeDesktopSurface(null)
       rmSync(directory, { recursive: true, force: true })
     }
diff --git a/src/main/runtime/acknowledged-terminal-tab-retirement.test.ts b/src/main/runtime/acknowledged-terminal-tab-retirement.test.ts
index 91c3cb1b1d63..179dba29bd18 100644
--- a/src/main/runtime/acknowledged-terminal-tab-retirement.test.ts
+++ b/src/main/runtime/acknowledged-terminal-tab-retirement.test.ts
@@ -8,6 +8,7 @@ import {
   createAcknowledgedTabRetirementFixture
 } from './acknowledged-terminal-tab-retirement-fixture'
 import { advanceTerminalTopologyRevision } from './workspace-session-terminal-membership-authority'
+import { delegatedMobileSessionTabClose } from './mobile-session-tab-close-outcome'
 
 const fixtures: ReturnType<typeof createAcknowledgedTabRetirementFixture>[] = []
 afterEach(async () => {
@@ -78,7 +79,7 @@ it.each([false, true])(
     }
     const pending = f.close()
     await f.entered.promise
-    f.runtime.onPtyExit('pty-a', 0, ACK_INCARNATION, { providerExitObserved: true })
+    await f.runtime.onPtyExit('pty-a', 0, ACK_INCARNATION, { providerExitObserved: true })
     expect(f.store.getWorkspaceSession().terminalLayoutsByTabId[ACK_TAB].ptyIdsByLeafId).toEqual({
       [ACK_SECOND_LEAF]: 'pty-b'
     })
@@ -103,7 +104,7 @@ it('protects a persisted incarnation replacement on the same leaf and raw PTY ID
   const f = fixture(true)
   const pending = f.close()
   await f.entered.promise
-  f.store.persistPtyBinding({
+  await f.store.persistPtyBinding({
     worktreeId: ACK_WORKTREE,
     tabId: ACK_TAB,
     leafId: ACK_LEAF,
@@ -133,13 +134,27 @@ it('rechecks current pins after renderer acknowledgement', async () => {
   f.acknowledgement.resolve()
   await expect(pending).rejects.toThrow('terminal_tab_pinned')
   expect(f.hasTab()).toBe(true)
+  await expect(f.store.flushPendingOrThrowAsync()).resolves.toBeUndefined()
+})
+
+it('keeps persistence writable when worktree teardown finds remaining terminal rows', async () => {
+  const f = fixture()
+  f.store.updateRepo('repo1', { executionHostId: 'ssh:target' })
+  f.store.setWorktreeMeta(ACK_WORKTREE, { hostId: 'ssh:target' })
+  f.store.setWorkspaceSession(f.store.getWorkspaceSession(), 'ssh:target')
+  vi.spyOn(f.runtime, 'closeMobileSessionTab').mockResolvedValue(delegatedMobileSessionTabClose())
+  await expect(f.runtime.closeTerminalsForWorktree(`id:${ACK_WORKTREE}`)).rejects.toThrow(
+    'terminal_close_incomplete'
+  )
+  expect(f.hasTab()).toBe(true)
+  await expect(f.store.flushPendingOrThrowAsync()).resolves.toBeUndefined()
 })
 
 it('preserves dormant SSH kill IDs when the acknowledged tab becomes headless', async () => {
   const f = fixture()
   const visible = 'ssh:target@@visible'
   const dormant = 'ssh:target@@persisted-only'
-  f.store.persistPtyBinding({
+  await f.store.persistPtyBinding({
     worktreeId: ACK_WORKTREE,
     tabId: ACK_TAB,
     leafId: ACK_LEAF,
diff --git a/src/main/runtime/agent-prompt-line-settle.test.ts b/src/main/runtime/agent-prompt-line-settle.test.ts
index 45d8bca53a65..4ac0d9648ee2 100644
--- a/src/main/runtime/agent-prompt-line-settle.test.ts
+++ b/src/main/runtime/agent-prompt-line-settle.test.ts
@@ -37,7 +37,7 @@ describe('agent prompt line-settle scheduling', () => {
       () => undefined,
       'antigravity'
     )
-    const submission = runtime.sendTerminalAgentPrompt(handle, prompt)
+    const submission = runtime.sendTerminalAgentPrompt(handle, prompt, { inputKind: 'driving' })
     const stalled = expect(submission).rejects.toThrow('agent_prompt_stalled')
 
     await vi.advanceTimersByTimeAsync(submitDelayMs - 1)
diff --git a/src/main/runtime/agent-prompt-receipt-correlation.test.ts b/src/main/runtime/agent-prompt-receipt-correlation.test.ts
index e6b6d7f27936..77e8967b6d34 100644
--- a/src/main/runtime/agent-prompt-receipt-correlation.test.ts
+++ b/src/main/runtime/agent-prompt-receipt-correlation.test.ts
@@ -34,6 +34,7 @@ describe('agent prompt receipt correlation', () => {
     runtime.onPtyData('pty-prompt', '\x1b]0;Codex working\x07', Date.now())
 
     const firstPromise = runtime.sendTerminalAgentPrompt(handle, 'first prompt', {
+      inputKind: 'driving',
       acceptQueued: true,
       requestId: 'historical-first',
       observationTimeoutMs: 0
@@ -41,6 +42,7 @@ describe('agent prompt receipt correlation', () => {
     await vi.runAllTimersAsync()
     const first = await firstPromise
     const secondPromise = runtime.sendTerminalAgentPrompt(handle, 'second prompt', {
+      inputKind: 'driving',
       acceptQueued: true,
       requestId: 'historical-second',
       observationTimeoutMs: 0
diff --git a/src/main/runtime/agent-prompt-submission-runtime-hook-and-generation.test.ts b/src/main/runtime/agent-prompt-submission-runtime-hook-and-generation.test.ts
index c893623a18af..3d0c317a31b4 100644
--- a/src/main/runtime/agent-prompt-submission-runtime-hook-and-generation.test.ts
+++ b/src/main/runtime/agent-prompt-submission-runtime-hook-and-generation.test.ts
@@ -102,7 +102,9 @@ describe('agent prompt submission runtime hook and generation cases', () => {
       getForegroundProcess: async () => null
     })
 
-    const submission = runtime.sendTerminalAgentPrompt(handle, 'review this')
+    const submission = runtime.sendTerminalAgentPrompt(handle, 'review this', {
+      inputKind: 'driving'
+    })
     await vi.runAllTimersAsync()
 
     await expect(submission).resolves.toMatchObject({ accepted: true })
@@ -130,6 +132,7 @@ describe('agent prompt submission runtime hook and generation cases', () => {
     })
 
     const submission = runtime.sendTerminalAgentPrompt(handle, 'review this', {
+      inputKind: 'driving',
       acceptQueued: true,
       requestId: 'antigravity-pre-invocation',
       observationTimeoutMs: 20_000
@@ -156,7 +159,9 @@ describe('agent prompt submission runtime hook and generation cases', () => {
       stateStartedAt: 1_000
     })
 
-    const submission = runtime.sendTerminalAgentPrompt(handle, 'review this')
+    const submission = runtime.sendTerminalAgentPrompt(handle, 'review this', {
+      inputKind: 'driving'
+    })
     const rejected = expect(submission).rejects.toThrow('agent_prompt_stalled')
     await vi.runAllTimersAsync()
 
@@ -171,6 +176,7 @@ describe('agent prompt submission runtime hook and generation cases', () => {
     const { runtime, handle, writes } = await createHookOnlyPromptRuntime(hook, 'codex')
 
     const firstPromise = runtime.sendTerminalAgentPrompt(handle, 'first prompt', {
+      inputKind: 'driving',
       acceptQueued: true,
       requestId: 'hook-queued-first',
       observationTimeoutMs: 0
@@ -193,6 +199,7 @@ describe('agent prompt submission runtime hook and generation cases', () => {
       getForegroundProcess: async () => null
     })
     const secondPromise = runtime.sendTerminalAgentPrompt(handle, 'second prompt', {
+      inputKind: 'driving',
       acceptQueued: true,
       requestId: 'hook-queued-second',
       observationTimeoutMs: 500
@@ -219,7 +226,9 @@ describe('agent prompt submission runtime hook and generation cases', () => {
   it('does not write Enter after the PTY generation changes during settlement', async () => {
     vi.useFakeTimers()
     const { runtime, handle, writes } = await createPromptRuntime(() => undefined)
-    const submission = runtime.sendTerminalAgentPrompt(handle, 'review this')
+    const submission = runtime.sendTerminalAgentPrompt(handle, 'review this', {
+      inputKind: 'driving'
+    })
     const rejected = expect(submission).rejects.toThrow('terminal_handle_stale')
 
     await vi.advanceTimersByTimeAsync(0)
@@ -256,6 +265,7 @@ describe('agent prompt submission runtime hook and generation cases', () => {
     )
 
     const submission = runtime.sendTerminalAgentPrompt(handle, 'review this', {
+      inputKind: 'driving',
       signal: controller.signal
     })
     const rejected = expect(submission).rejects.toThrow('request_aborted')
@@ -291,7 +301,9 @@ describe('agent prompt submission runtime hook and generation cases', () => {
       sequenceAtSpawnStart
     )
 
-    const submission = runtime.sendTerminalAgentPrompt(handle, 'review this')
+    const submission = runtime.sendTerminalAgentPrompt(handle, 'review this', {
+      inputKind: 'driving'
+    })
     await vi.runAllTimersAsync()
 
     await expect(submission).resolves.toMatchObject({ accepted: true })
@@ -318,9 +330,9 @@ describe('agent prompt submission runtime hook and generation cases', () => {
       sequenceAtSpawnStart
     )
 
-    await expect(runtime.sendTerminalAgentPrompt(handle, 'review this')).rejects.toThrow(
-      'agent_prompt_blocked'
-    )
+    await expect(
+      runtime.sendTerminalAgentPrompt(handle, 'review this', { inputKind: 'driving' })
+    ).rejects.toThrow('agent_prompt_blocked')
     expect(writes).toEqual([])
   })
 
@@ -331,7 +343,9 @@ describe('agent prompt submission runtime hook and generation cases', () => {
         runtime.onPtyData('pty-prompt', '\x1b]0;Codex waiting for permission\x07', Date.now())
       }
     })
-    const submission = runtime.sendTerminalAgentPrompt(handle, 'review this')
+    const submission = runtime.sendTerminalAgentPrompt(handle, 'review this', {
+      inputKind: 'driving'
+    })
     const rejected = expect(submission).rejects.toThrow('agent_prompt_blocked')
 
     await vi.runAllTimersAsync()
@@ -351,8 +365,10 @@ describe('agent prompt submission runtime hook and generation cases', () => {
       }
     })
 
-    const first = runtime.sendTerminalAgentPrompt(handle, 'first prompt')
-    const second = runtime.sendTerminalAgentPrompt(handle, 'second prompt')
+    const first = runtime.sendTerminalAgentPrompt(handle, 'first prompt', { inputKind: 'driving' })
+    const second = runtime.sendTerminalAgentPrompt(handle, 'second prompt', {
+      inputKind: 'driving'
+    })
     await vi.runAllTimersAsync()
     await Promise.all([first, second])
 
@@ -373,6 +389,7 @@ describe('agent prompt submission runtime hook and generation cases', () => {
     runtime.onPtyData('pty-prompt', '\x1b]0;Codex working\x07', Date.now())
 
     const firstPromise = runtime.sendTerminalAgentPrompt(handle, 'first prompt', {
+      inputKind: 'driving',
       acceptQueued: true,
       requestId: 'queued-first',
       observationTimeoutMs: 0
@@ -380,6 +397,7 @@ describe('agent prompt submission runtime hook and generation cases', () => {
     await vi.runAllTimersAsync()
     const first = await firstPromise
     const secondPromise = runtime.sendTerminalAgentPrompt(handle, 'second prompt', {
+      inputKind: 'driving',
       acceptQueued: true,
       requestId: 'queued-second',
       observationTimeoutMs: 0
@@ -418,6 +436,7 @@ describe('agent prompt submission runtime hook and generation cases', () => {
     })
 
     const first = runtime.sendTerminalAgentPrompt(handle, 'obsolete prompt', {
+      inputKind: 'driving',
       beforeWrite: async () => {
         firstWriteReached()
         await firstGate
@@ -430,7 +449,9 @@ describe('agent prompt submission runtime hook and generation cases', () => {
       0
     )
 
-    const replacement = runtime.sendTerminalAgentPrompt(handle, 'replacement prompt')
+    const replacement = runtime.sendTerminalAgentPrompt(handle, 'replacement prompt', {
+      inputKind: 'driving'
+    })
     await vi.runAllTimersAsync()
     await expect(replacement).resolves.toMatchObject({ accepted: true })
     expect(writes.some((data) => data.includes('replacement prompt'))).toBe(true)
@@ -444,6 +465,7 @@ describe('agent prompt submission runtime hook and generation cases', () => {
     let writeChecks = 0
 
     const submission = runtime.sendTerminalAgentPrompt(handle, 'x'.repeat(20_000), {
+      inputKind: 'driving',
       beforeWrite: () => {
         writeChecks += 1
         if (writeChecks === 2) {
@@ -466,6 +488,7 @@ describe('agent prompt submission runtime hook and generation cases', () => {
     const controller = new AbortController()
     const { runtime, handle, writes } = await createPromptRuntime(() => undefined)
     const submission = runtime.sendTerminalAgentPrompt(handle, 'review this', {
+      inputKind: 'driving',
       signal: controller.signal
     })
     const rejected = expect(submission).rejects.toThrow('request_aborted')
@@ -483,6 +506,7 @@ describe('agent prompt submission runtime hook and generation cases', () => {
     const controller = new AbortController()
     const { runtime, handle, writes } = await createPromptRuntime(() => undefined)
     const submission = runtime.sendTerminalAgentPrompt(handle, 'review this', {
+      inputKind: 'driving',
       signal: controller.signal
     })
     const rejected = expect(submission).rejects.toThrow('request_aborted')
diff --git a/src/main/runtime/agent-prompt-submission-runtime.test.ts b/src/main/runtime/agent-prompt-submission-runtime.test.ts
index 873863ada75c..700445483a9b 100644
--- a/src/main/runtime/agent-prompt-submission-runtime.test.ts
+++ b/src/main/runtime/agent-prompt-submission-runtime.test.ts
@@ -43,7 +43,9 @@ describe('agent prompt submission runtime', () => {
       }
     )
 
-    const submission = runtime.sendTerminalAgentPrompt(handle, 'review this')
+    const submission = runtime.sendTerminalAgentPrompt(handle, 'review this', {
+      inputKind: 'driving'
+    })
     await vi.runAllTimersAsync()
 
     await expect(submission).resolves.toMatchObject({ accepted: true })
@@ -59,7 +61,9 @@ describe('agent prompt submission runtime', () => {
       }
     })
 
-    const submission = runtime.sendTerminalAgentPrompt(handle, 'review this')
+    const submission = runtime.sendTerminalAgentPrompt(handle, 'review this', {
+      inputKind: 'driving'
+    })
     await vi.runAllTimersAsync()
 
     await expect(submission).resolves.toMatchObject({ accepted: true })
@@ -75,7 +79,9 @@ describe('agent prompt submission runtime', () => {
         runtime.onPtyData('pty-prompt', '\x1b[2J\x1b[H› review this', Date.now())
       }
     })
-    const submission = runtime.sendTerminalAgentPrompt(handle, 'review this')
+    const submission = runtime.sendTerminalAgentPrompt(handle, 'review this', {
+      inputKind: 'driving'
+    })
     const rejected = expect(submission).rejects.toThrow('agent_prompt_stalled')
 
     await vi.runAllTimersAsync()
@@ -93,7 +99,9 @@ describe('agent prompt submission runtime', () => {
       }
     })
     runtime.onPtyData('pty-prompt', '\x1b]0;Codex idle\x07', Date.now())
-    const submission = runtime.sendTerminalAgentPrompt(handle, 'review this')
+    const submission = runtime.sendTerminalAgentPrompt(handle, 'review this', {
+      inputKind: 'driving'
+    })
     const rejected = expect(submission).rejects.toThrow('agent_prompt_stalled')
 
     await vi.runAllTimersAsync()
@@ -109,7 +117,9 @@ describe('agent prompt submission runtime', () => {
         runtime.onPtyData('pty-prompt', '\x1b]0;Codex waiting for permission\x07', Date.now())
       }
     })
-    const submission = runtime.sendTerminalAgentPrompt(handle, 'review this')
+    const submission = runtime.sendTerminalAgentPrompt(handle, 'review this', {
+      inputKind: 'driving'
+    })
     const rejected = expect(submission).rejects.toThrow('agent_prompt_blocked')
 
     await vi.runAllTimersAsync()
@@ -122,9 +132,9 @@ describe('agent prompt submission runtime', () => {
     const { runtime, handle, writes } = await createPromptRuntime(() => undefined)
     runtime.onPtyData('pty-prompt', '\x1b]0;Codex waiting for permission\x07', Date.now())
 
-    await expect(runtime.sendTerminalAgentPrompt(handle, 'review this')).rejects.toThrow(
-      'agent_prompt_blocked'
-    )
+    await expect(
+      runtime.sendTerminalAgentPrompt(handle, 'review this', { inputKind: 'driving' })
+    ).rejects.toThrow('agent_prompt_blocked')
     expect(writes).toEqual([])
   })
 
@@ -140,9 +150,9 @@ describe('agent prompt submission runtime', () => {
       Date.now()
     )
 
-    await expect(runtime.sendTerminalAgentPrompt(handle, 'review this')).rejects.toThrow(
-      'agent_prompt_blocked'
-    )
+    await expect(
+      runtime.sendTerminalAgentPrompt(handle, 'review this', { inputKind: 'driving' })
+    ).rejects.toThrow('agent_prompt_blocked')
     expect(writes).toEqual([])
   })
 
@@ -155,9 +165,9 @@ describe('agent prompt submission runtime', () => {
       Date.now()
     )
 
-    await expect(runtime.sendTerminalAgentPrompt(handle, 'review this')).rejects.toThrow(
-      'agent_prompt_blocked'
-    )
+    await expect(
+      runtime.sendTerminalAgentPrompt(handle, 'review this', { inputKind: 'driving' })
+    ).rejects.toThrow('agent_prompt_blocked')
     expect(writes).toEqual([])
   })
 
@@ -175,7 +185,9 @@ describe('agent prompt submission runtime', () => {
     )
     runtime.onPtyData('pty-prompt', '}\x07\x07', Date.now())
 
-    const submission = runtime.sendTerminalAgentPrompt(handle, 'review this')
+    const submission = runtime.sendTerminalAgentPrompt(handle, 'review this', {
+      inputKind: 'driving'
+    })
     const rejected = expect(submission).rejects.toThrow('agent_prompt_blocked')
     await vi.runAllTimersAsync()
 
@@ -197,9 +209,9 @@ describe('agent prompt submission runtime', () => {
       Date.now()
     )
 
-    await expect(runtime.sendTerminalAgentPrompt(handle, 'review this')).rejects.toThrow(
-      'agent_prompt_blocked'
-    )
+    await expect(
+      runtime.sendTerminalAgentPrompt(handle, 'review this', { inputKind: 'driving' })
+    ).rejects.toThrow('agent_prompt_blocked')
     expect(writes).toEqual([])
   })
 
@@ -214,7 +226,9 @@ describe('agent prompt submission runtime', () => {
       text: 'Permission required\r\nAllow once\r\nAllow always\r\nReject\r\n'
     })
 
-    const submission = runtime.sendTerminalAgentPrompt(handle, 'review this')
+    const submission = runtime.sendTerminalAgentPrompt(handle, 'review this', {
+      inputKind: 'driving'
+    })
     await vi.runAllTimersAsync()
 
     await expect(submission).resolves.toMatchObject({ accepted: true })
@@ -235,7 +249,9 @@ describe('agent prompt submission runtime', () => {
       }
     })
     runtime.onPtyData('pty-prompt', '\x1b]0;Codex idle\x07', Date.now())
-    const submission = runtime.sendTerminalAgentPrompt(handle, 'review this')
+    const submission = runtime.sendTerminalAgentPrompt(handle, 'review this', {
+      inputKind: 'driving'
+    })
     const rejected = expect(submission).rejects.toThrow('agent_prompt_blocked')
 
     await vi.runAllTimersAsync()
@@ -257,7 +273,9 @@ describe('agent prompt submission runtime', () => {
         runtime.onPtyData('pty-prompt', output, Date.now())
       }
     })
-    const submission = runtime.sendTerminalAgentPrompt(handle, 'review this')
+    const submission = runtime.sendTerminalAgentPrompt(handle, 'review this', {
+      inputKind: 'driving'
+    })
     const rejected = expect(submission).rejects.toThrow('agent_prompt_blocked')
 
     await vi.runAllTimersAsync()
@@ -271,6 +289,7 @@ describe('agent prompt submission runtime', () => {
     let writeChecks = 0
 
     const submission = runtime.sendTerminalAgentPrompt(handle, 'x'.repeat(20_000), {
+      inputKind: 'driving',
       beforeWrite: () => {
         writeChecks += 1
         if (writeChecks === 2) {
@@ -291,6 +310,7 @@ describe('agent prompt submission runtime', () => {
     let writeChecks = 0
 
     const submission = runtime.sendTerminalAgentPrompt(handle, 'x'.repeat(20_000), {
+      inputKind: 'driving',
       beforeWrite: () => {
         writeChecks += 1
         if (writeChecks === 2) {
@@ -319,9 +339,9 @@ describe('agent prompt submission runtime', () => {
     )
     runtime.onPtyData('pty-prompt', '\x1b]0;Codex waiting for permission\x07', Date.now())
 
-    await expect(runtime.sendTerminalAgentPrompt(handle, 'review this')).rejects.toThrow(
-      'agent_prompt_blocked'
-    )
+    await expect(
+      runtime.sendTerminalAgentPrompt(handle, 'review this', { inputKind: 'driving' })
+    ).rejects.toThrow('agent_prompt_blocked')
     expect(writes).toEqual([])
   })
 
@@ -369,7 +389,9 @@ describe('agent prompt submission runtime', () => {
     )
     vi.setSystemTime(2_000)
 
-    const submission = runtime.sendTerminalAgentPrompt(handle, 'review this')
+    const submission = runtime.sendTerminalAgentPrompt(handle, 'review this', {
+      inputKind: 'driving'
+    })
     await vi.runAllTimersAsync()
 
     await expect(submission).resolves.toMatchObject({ accepted: true })
@@ -389,7 +411,9 @@ describe('agent prompt submission runtime', () => {
       Date.now()
     )
 
-    const submission = runtime.sendTerminalAgentPrompt(handle, 'review this')
+    const submission = runtime.sendTerminalAgentPrompt(handle, 'review this', {
+      inputKind: 'driving'
+    })
     await vi.runAllTimersAsync()
 
     await expect(submission).resolves.toMatchObject({ accepted: true })
@@ -408,7 +432,9 @@ describe('agent prompt submission runtime', () => {
       Date.now()
     )
 
-    const submission = runtime.sendTerminalAgentPrompt(handle, 'review this')
+    const submission = runtime.sendTerminalAgentPrompt(handle, 'review this', {
+      inputKind: 'driving'
+    })
     const rejected = expect(submission).rejects.toThrow('agent_prompt_stalled')
     await vi.runAllTimersAsync()
 
@@ -432,7 +458,9 @@ describe('agent prompt submission runtime', () => {
       Date.now()
     )
 
-    const submission = runtime.sendTerminalAgentPrompt(handle, 'review this')
+    const submission = runtime.sendTerminalAgentPrompt(handle, 'review this', {
+      inputKind: 'driving'
+    })
     await vi.runAllTimersAsync()
 
     await expect(submission).resolves.toMatchObject({ accepted: true })
@@ -453,6 +481,7 @@ describe('agent prompt submission runtime', () => {
     )
 
     const submission = runtime.sendTerminalAgentPrompt(handle, 'review this', {
+      inputKind: 'driving',
       acceptQueued: true,
       requestId: 'queued-output-only',
       observationTimeoutMs: 0
diff --git a/src/main/runtime/agent-prompt-submission-windows-submit-delay.test.ts b/src/main/runtime/agent-prompt-submission-windows-submit-delay.test.ts
index f6298df8b175..3bc936c78a5b 100644
--- a/src/main/runtime/agent-prompt-submission-windows-submit-delay.test.ts
+++ b/src/main/runtime/agent-prompt-submission-windows-submit-delay.test.ts
@@ -111,7 +111,9 @@ describe('agent prompt submit delay on a ConPTY host', () => {
     vi.useFakeTimers()
     const { runtime, handle, writes } = await createPromptRuntime()
     const delayMs = submitDelayFor('review this', 'win32')
-    const submission = runtime.sendTerminalAgentPrompt(handle, 'review this')
+    const submission = runtime.sendTerminalAgentPrompt(handle, 'review this', {
+      inputKind: 'driving'
+    })
     const stalled = expect(submission).rejects.toThrow('agent_prompt_stalled')
 
     await vi.advanceTimersByTimeAsync(delayMs - 1)
@@ -131,7 +133,7 @@ describe('agent prompt submit delay on a ConPTY host', () => {
     // Measured ConPTY ingest for 8 KB is 60-89 ms; the old constant charged 1_500 ms.
     const delayMs = submitDelayFor(prompt, 'win32')
     expect(delayMs).toBeLessThan(700)
-    const submission = runtime.sendTerminalAgentPrompt(handle, prompt)
+    const submission = runtime.sendTerminalAgentPrompt(handle, prompt, { inputKind: 'driving' })
     const stalled = expect(submission).rejects.toThrow('agent_prompt_stalled')
 
     await vi.advanceTimersByTimeAsync(delayMs)
@@ -146,7 +148,7 @@ describe('agent prompt submit delay on a ConPTY host', () => {
     vi.useFakeTimers()
     const { runtime, handle, writes, submitTimes } = await createPromptRuntime()
     const prompt = 'y'.repeat(320_000)
-    const submission = runtime.sendTerminalAgentPrompt(handle, prompt)
+    const submission = runtime.sendTerminalAgentPrompt(handle, prompt, { inputKind: 'driving' })
     const stalled = expect(submission).rejects.toThrow('agent_prompt_stalled')
 
     // Every byte is already handed to node-pty here -- the hazard is that the *host* is
@@ -167,6 +169,7 @@ describe('agent prompt submit delay on a ConPTY host', () => {
     const controller = new AbortController()
     const { runtime, handle, writes } = await createPromptRuntime()
     const submission = runtime.sendTerminalAgentPrompt(handle, 'review this', {
+      inputKind: 'driving',
       signal: controller.signal
     })
     const rejected = expect(submission).rejects.toThrow('request_aborted')
@@ -186,7 +189,9 @@ describe('agent prompt submit delay on a ConPTY host', () => {
     const { runtime, handle, writes } = await createPromptRuntime()
     const delayMs = submitDelayFor(HOST_PROBE_PROMPT, 'darwin')
     expect(delayMs).toBeLessThan(submitDelayFor(HOST_PROBE_PROMPT, 'win32'))
-    const submission = runtime.sendTerminalAgentPrompt(handle, HOST_PROBE_PROMPT)
+    const submission = runtime.sendTerminalAgentPrompt(handle, HOST_PROBE_PROMPT, {
+      inputKind: 'driving'
+    })
     const stalled = expect(submission).rejects.toThrow('agent_prompt_stalled')
 
     await vi.advanceTimersByTimeAsync(delayMs - 1)
@@ -215,7 +220,9 @@ describe('agent prompt submit delay follows the execution host', () => {
     patchPtyRecord(runtime, { isWsl: true, wslDistro: 'Ubuntu' })
     const delayMs = submitDelayFor(HOST_PROBE_PROMPT, 'win32')
     expect(delayMs).toBeGreaterThan(submitDelayFor(HOST_PROBE_PROMPT, 'linux'))
-    const submission = runtime.sendTerminalAgentPrompt(handle, HOST_PROBE_PROMPT)
+    const submission = runtime.sendTerminalAgentPrompt(handle, HOST_PROBE_PROMPT, {
+      inputKind: 'driving'
+    })
     const stalled = expect(submission).rejects.toThrow('agent_prompt_stalled')
 
     await vi.advanceTimersByTimeAsync(delayMs - 1)
@@ -235,7 +242,9 @@ describe('agent prompt submit delay follows the execution host', () => {
     registerSshRemotePlatform('win32')
     const clientDelayMs = submitDelayFor(HOST_PROBE_PROMPT, 'darwin')
     const hostDelayMs = submitDelayFor(HOST_PROBE_PROMPT, 'win32')
-    const submission = runtime.sendTerminalAgentPrompt(handle, HOST_PROBE_PROMPT)
+    const submission = runtime.sendTerminalAgentPrompt(handle, HOST_PROBE_PROMPT, {
+      inputKind: 'driving'
+    })
     const stalled = expect(submission).rejects.toThrow('agent_prompt_stalled')
 
     await vi.advanceTimersByTimeAsync(clientDelayMs)
@@ -255,7 +264,9 @@ describe('agent prompt submit delay follows the execution host', () => {
     registerSshRemotePlatform('linux')
     const delayMs = submitDelayFor(HOST_PROBE_PROMPT, 'linux')
     expect(delayMs).toBeLessThan(submitDelayFor(HOST_PROBE_PROMPT, 'win32'))
-    const submission = runtime.sendTerminalAgentPrompt(handle, HOST_PROBE_PROMPT)
+    const submission = runtime.sendTerminalAgentPrompt(handle, HOST_PROBE_PROMPT, {
+      inputKind: 'driving'
+    })
     const stalled = expect(submission).rejects.toThrow('agent_prompt_stalled')
 
     await vi.advanceTimersByTimeAsync(delayMs - 1)
@@ -277,7 +288,9 @@ describe('agent prompt submit delay follows the execution host', () => {
     })
     registerSshRemotePlatform(undefined)
     const delayMs = submitDelayFor(HOST_PROBE_PROMPT, 'win32')
-    const submission = runtime.sendTerminalAgentPrompt(handle, HOST_PROBE_PROMPT)
+    const submission = runtime.sendTerminalAgentPrompt(handle, HOST_PROBE_PROMPT, {
+      inputKind: 'driving'
+    })
     const stalled = expect(submission).rejects.toThrow('agent_prompt_stalled')
 
     await vi.advanceTimersByTimeAsync(delayMs - 1)
@@ -341,7 +354,9 @@ describe('agent prompt render gate on a ConPTY host', () => {
     useHostPlatform('win32')
     vi.useFakeTimers()
     const { runtime, handle, writes, submitTimes } = await createSettlementRuntime()
-    const submission = runtime.sendTerminalAgentPrompt(handle, 'y'.repeat(320_000))
+    const submission = runtime.sendTerminalAgentPrompt(handle, 'y'.repeat(320_000), {
+      inputKind: 'driving'
+    })
     const stalled = expect(submission).rejects.toThrow('agent_prompt_stalled')
 
     // Marker at 100 ms + a 1_500 ms quiet window would have submitted at ~1_600 ms, while
@@ -370,7 +385,7 @@ describe('agent prompt render gate on a ConPTY host', () => {
       markerDelayMs: ingestMs - 1_000,
       noiseUntilMs: ingestMs + 20_000
     })
-    const submission = runtime.sendTerminalAgentPrompt(handle, prompt)
+    const submission = runtime.sendTerminalAgentPrompt(handle, prompt, { inputKind: 'driving' })
     const stalled = expect(submission).rejects.toThrow('agent_prompt_stalled')
 
     await vi.advanceTimersByTimeAsync(ingestMs + 8_000 - 1)
@@ -387,7 +402,9 @@ describe('agent prompt render gate on a ConPTY host', () => {
     useHostPlatform('win32')
     vi.useFakeTimers()
     const { runtime, handle, submitTimes } = await createSettlementRuntime()
-    const submission = runtime.sendTerminalAgentPrompt(handle, 'review this')
+    const submission = runtime.sendTerminalAgentPrompt(handle, 'review this', {
+      inputKind: 'driving'
+    })
     const stalled = expect(submission).rejects.toThrow('agent_prompt_stalled')
 
     await vi.runAllTimersAsync()
@@ -409,7 +426,11 @@ describe('plain terminal send suffix delay', () => {
     useHostPlatform('win32')
     vi.useFakeTimers()
     const { runtime, handle, writes, submitTimes } = await createPromptRuntime()
-    const send = runtime.sendTerminal(handle, { text: 'z'.repeat(320_000), enter: true })
+    const send = runtime.sendTerminal(
+      handle,
+      { text: 'z'.repeat(320_000), enter: true },
+      { inputKind: 'driving' }
+    )
 
     // Same hazard as the agent-prompt path: a flat 500 ms wrote Enter mid-paste here.
     await vi.advanceTimersByTimeAsync(3_342)
@@ -429,7 +450,7 @@ describe('plain terminal send suffix delay', () => {
     const send = runtime.sendTerminal(
       handle,
       { text: 'z'.repeat(320_000), enter: true },
-      { signal: controller.signal }
+      { inputKind: 'driving', signal: controller.signal }
     )
     const rejected = expect(send).rejects.toThrow('request_aborted')
 
diff --git a/src/main/runtime/agent-session-acquisition-failure-settlement.ts b/src/main/runtime/agent-session-acquisition-failure-settlement.ts
index 9335dd230bb6..a3e114081186 100644
--- a/src/main/runtime/agent-session-acquisition-failure-settlement.ts
+++ b/src/main/runtime/agent-session-acquisition-failure-settlement.ts
@@ -15,10 +15,12 @@ import type { AgentSessionStoreState } from './agent-session-record-store-file'
  * How the failed attempt's provider process was accounted for.
  * - `exit-proven`: cleanup observed the whole tree gone.
  * - `root-exit-observed`: the owner root's exit was observed first-hand, so the
- *   identity this lease is keyed on is dead, but its descendants could not be
- *   verified. Releases the lease and says exactly that, claiming nothing more.
+ *   identity this lease is keyed on is dead, but its descendants were not proven
+ *   gone. Releases the lease and says exactly that, claiming nothing more.
  * - `processless`: the attempt failed before a process existed.
- * - `unproven`: nothing about the process was observed; the reservation latches.
+ * - `unproven`: nothing about the process was observed. A recorded owner goes to recovery, which
+ *   concludes about it; a reservation that recorded none is released, since the adapter already
+ *   closed the stdio of anything it spawned.
  */
 export type AgentSessionAcquisitionExitProof =
   | 'exit-proven'
@@ -96,7 +98,6 @@ export function settleFailedAgentSessionPostAcquisitionAttachment(
           handoffStage: null,
           ownerProcess: null,
           reservedSpawnToken: null,
-          processlessAt: null,
           claimStatus: 'released',
           lastRenewedAt: args.now,
           handoffOperationId: null,
@@ -104,7 +105,7 @@ export function settleFailedAgentSessionPostAcquisitionAttachment(
             args.exitProof === 'root-exit-observed'
               ? {
                   kind: 'exit-observed',
-                  detail: 'the provider process exited; its descendants were not verifiable',
+                  detail: 'the provider process exited; its descendants were not proven gone',
                   observedAt: args.now
                 }
               : {
@@ -131,10 +132,10 @@ function settleFailedLease(
   ) {
     throw new Error('agent_session_ownership_unknown')
   }
-  if (args.exitProof === 'unproven') {
+  if (args.exitProof === 'unproven' && record.lease.ownerProcess) {
     return withLease(record, {
       ...record.lease,
-      handoffStage: record.lease.ownerProcess ? 'recovering' : 'manual-recovery',
+      handoffStage: 'recovering',
       // The operation is durably settled failed below; a lease still naming it would
       // read as an in-flight transfer to every consumer that keys on the stage + id pair.
       handoffOperationId: null,
@@ -147,7 +148,6 @@ function settleFailedLease(
     handoffStage: null,
     ownerProcess: null,
     reservedSpawnToken: null,
-    processlessAt: null,
     claimStatus: 'released',
     lastRenewedAt: args.now,
     handoffOperationId: null,
@@ -155,18 +155,22 @@ function settleFailedLease(
   })
 }
 
-/** Records only what was observed: never a tree claim the cleanup did not make. */
+/** Records only what was observed: never a tree claim the cleanup did not make, and nothing at all
+ *  when nothing was. */
 function acquisitionDeathEvidence(
   exitProof: AgentSessionAcquisitionExitProof,
   observedAt: number
-): AgentSessionDeathEvidence {
+): AgentSessionDeathEvidence | null {
+  if (exitProof === 'unproven') {
+    return null
+  }
   if (exitProof === 'processless') {
     return { kind: 'pid-absent', detail: 'reservation failed before spawn', observedAt }
   }
   if (exitProof === 'root-exit-observed') {
     return {
       kind: 'exit-observed',
-      detail: 'the provider process exited; its descendants were not verifiable',
+      detail: 'the provider process exited; its descendants were not proven gone',
       observedAt
     }
   }
diff --git a/src/main/runtime/agent-session-conversation-command-record.ts b/src/main/runtime/agent-session-conversation-command-record.ts
index 2e7053e8a1b5..297b9dd34e73 100644
--- a/src/main/runtime/agent-session-conversation-command-record.ts
+++ b/src/main/runtime/agent-session-conversation-command-record.ts
@@ -1,4 +1,6 @@
+import { agentSessionRefusalError } from '../../shared/agent-session-wire-refusals'
 import type { AgentSessionStoreState } from './agent-session-record-store-file'
+import { AgentSessionTabTable } from './agent-session-tab-table'
 import type { AgentSessionConversationCommandRecord } from '../../shared/agent-session-conversation-command'
 
 export function commitConversationCommandRecord(
@@ -9,7 +11,7 @@ export function commitConversationCommandRecord(
 ): void {
   const record = state.records.get(sessionId)
   if (!record || record.lease.runtimeFence !== fence) {
-    throw new Error('agent_session_checkpoint_stale')
+    throw agentSessionRefusalError('agent_session_checkpoint_stale', { reason: 'leaseMoved' })
   }
   state.records.set(sessionId, { ...record, conversationCommand: command })
   if (
@@ -18,10 +20,9 @@ export function commitConversationCommandRecord(
     command.replacementSessionId
   ) {
     if (!state.records.has(command.replacementSessionId)) {
-      throw new Error('agent_session_identity_required')
+      throw agentSessionRefusalError('agent_session_identity_required', { reason: 'recordMissing' })
     }
-    state.visibleSessionIds.delete(sessionId)
-    state.visibleSessionIds.add(command.replacementSessionId)
-    state.visibleSessionIdsIndexPresent = true
+    state.sessionTabs ??= new AgentSessionTabTable()
+    state.sessionTabs.move(sessionId, command.replacementSessionId)
   }
 }
diff --git a/src/main/runtime/agent-session-eviction-settlement-latch.test.ts b/src/main/runtime/agent-session-eviction-settlement-latch.test.ts
deleted file mode 100644
index ebb893ef7e54..000000000000
--- a/src/main/runtime/agent-session-eviction-settlement-latch.test.ts
+++ /dev/null
@@ -1,141 +0,0 @@
-import { describe, expect, it } from 'vitest'
-import {
-  agentSessionLeaseFixture,
-  agentSessionRecordFixture
-} from '../../shared/agent-session-record.test-fixture'
-import { evictAgentSessionOwner } from './agent-session-lease-transitions'
-import { applyAgentSessionRestartAdjudication } from './agent-session-restart-lease-transitions'
-
-const NOW = 1_800_000_000_000
-
-describe('proven-dead agent session eviction settlement', () => {
-  it('latches restart eviction with a stable id while keeping the lease resumable', () => {
-    const record = agentSessionRecordFixture(
-      agentSessionLeaseFixture({ runtimeKind: 'native', unreconciled: true })
-    )
-
-    const evicted = applyAgentSessionRestartAdjudication({
-      record,
-      probe: { outcome: 'pid-absent' },
-      now: NOW
-    })
-
-    expect(evicted.lease).toMatchObject({
-      claimStatus: 'released',
-      runtimeFence: 8,
-      handoffStage: null,
-      settlementRetryRequired: true,
-      settlementRetryId: 'restart-eviction:session-alpha-1:8',
-      deathEvidence: { kind: 'pid-absent', detail: 'recorded pid absent on host' }
-    })
-  })
-
-  it('owes no settlement for a start that died before proving its handle', () => {
-    const record = agentSessionRecordFixture(
-      agentSessionLeaseFixture({
-        runtimeKind: 'native',
-        claimStatus: 'reserved',
-        handoffStage: 'new-owner-proving',
-        handoffOperationId: 'attach-op-1',
-        unreconciled: true
-      })
-    )
-
-    const evicted = applyAgentSessionRestartAdjudication({
-      record,
-      probe: { outcome: 'pid-absent' },
-      now: NOW
-    })
-
-    expect(evicted.lease).toMatchObject({
-      claimStatus: 'released',
-      runtimeFence: 8,
-      handoffStage: null,
-      handoffOperationId: null
-    })
-    expect(evicted.lease).not.toHaveProperty('settlementRetryRequired')
-  })
-
-  it('latches recovery eviction from the same evicted disposition', () => {
-    const record = agentSessionRecordFixture(
-      agentSessionLeaseFixture({ runtimeKind: 'native', handoffStage: 'recovering' })
-    )
-
-    const evicted = evictAgentSessionOwner({
-      record,
-      expectedFence: 7,
-      probe: { outcome: 'identity-mismatch', field: 'process-start-time' },
-      now: NOW,
-      journalSettlement: 'required'
-    })
-
-    expect(evicted.lease).toMatchObject({
-      claimStatus: 'released',
-      runtimeFence: 8,
-      handoffStage: null,
-      settlementRetryRequired: true,
-      settlementRetryId: 'restart-eviction:session-alpha-1:8',
-      deathEvidence: { kind: 'identity-mismatch', detail: 'mismatched process-start-time' }
-    })
-  })
-
-  it('never latches an indeterminate owner', () => {
-    const restartRecord = agentSessionRecordFixture(
-      agentSessionLeaseFixture({ runtimeKind: 'native', unreconciled: true })
-    )
-    const recovered = applyAgentSessionRestartAdjudication({
-      record: restartRecord,
-      probe: { outcome: 'indeterminate', reason: 'remote host unavailable' },
-      now: NOW
-    })
-    const recoveryRecord = agentSessionRecordFixture(
-      agentSessionLeaseFixture({ runtimeKind: 'native', handoffStage: 'recovering' })
-    )
-
-    expect(recovered.lease).toMatchObject({
-      handoffStage: 'recovering',
-      ownerProcess: { pid: 4242 }
-    })
-    expect(recovered.lease).not.toHaveProperty('settlementRetryRequired')
-    expect(recovered.lease).not.toHaveProperty('settlementRetryId')
-    expect(() =>
-      evictAgentSessionOwner({
-        record: recoveryRecord,
-        expectedFence: 7,
-        probe: { outcome: 'indeterminate', reason: 'remote host unavailable' },
-        now: NOW,
-        journalSettlement: 'required'
-      })
-    ).toThrow('agent_session_ownership_unknown')
-    expect(recoveryRecord.lease).not.toHaveProperty('settlementRetryRequired')
-    expect(recoveryRecord.lease).not.toHaveProperty('settlementRetryId')
-  })
-
-  it('preserves a null handoff stage when the latch survives another restart', () => {
-    const record = agentSessionRecordFixture(
-      agentSessionLeaseFixture({
-        runtimeKind: 'native',
-        ownerProcess: null,
-        reservedSpawnToken: null,
-        claimStatus: 'released',
-        handoffStage: null,
-        settlementRetryRequired: true,
-        settlementRetryId: 'restart-eviction:session-alpha-1:8',
-        unreconciled: true
-      })
-    )
-
-    const restored = applyAgentSessionRestartAdjudication({
-      record,
-      probe: { outcome: 'indeterminate', reason: 'remote host unavailable' },
-      now: NOW
-    })
-
-    expect(restored.lease).toMatchObject({
-      handoffStage: null,
-      settlementRetryRequired: true,
-      settlementRetryId: 'restart-eviction:session-alpha-1:8',
-      unreconciled: false
-    })
-  })
-})
diff --git a/src/main/runtime/agent-session-lease-transitions.ts b/src/main/runtime/agent-session-lease-transitions.ts
index 580fbeda255e..41e8d300e1e9 100644
--- a/src/main/runtime/agent-session-lease-transitions.ts
+++ b/src/main/runtime/agent-session-lease-transitions.ts
@@ -6,9 +6,9 @@
  * observed process identity, and a proved provider handle — in that order, at one fence.
  */
 
+import { agentSessionRefusalError } from '../../shared/agent-session-wire-refusals'
 import {
   adjudicateAgentSessionRestart,
-  agentSessionRestartEvictionSettlementId,
   evaluateAgentSessionAcquisition,
   type AgentSessionOwnerProbe
 } from '../../shared/agent-session-lease-adjudication'
@@ -16,7 +16,9 @@ import {
   appendAgentSessionProviderHandleLink,
   type AgentSessionProviderHandleLink
 } from '../../shared/agent-session-provider-handle'
+import { nextAgentSessionFence } from '../../shared/agent-session-next-fence'
 import type {
+  AgentSessionDeathEvidence,
   AgentSessionJournalCheckpoint,
   AgentSessionLease,
   AgentSessionProcessIdentity,
@@ -40,10 +42,10 @@ export function withLease(
 
 export function assertFence(lease: AgentSessionLease, fence: number): void {
   if (lease.runtimeFence !== fence) {
-    throw new Error('agent_session_checkpoint_stale')
+    throw agentSessionRefusalError('agent_session_checkpoint_stale', { reason: 'leaseMoved' })
   }
   if (lease.unreconciled) {
-    throw new Error('execution_owner_reconciling')
+    throw agentSessionRefusalError('execution_owner_reconciling', { reason: 'hostReconciling' })
   }
 }
 
@@ -65,7 +67,7 @@ export function reserveAgentSessionOwner(args: {
     probe: args.probe
   })
   if (decision.decision === 'refused') {
-    throw new Error(decision.code)
+    throw agentSessionRefusalError(decision.code, decision.details)
   }
   if (decision.decision === 'retry-reservation') {
     return { record, disposition: 'retry-reservation' }
@@ -81,14 +83,11 @@ export function reserveAgentSessionOwner(args: {
       provenHandleLinkId: null,
       ownerProcess: null,
       reservedSpawnToken: reservation.spawnToken,
-      processlessAt: null,
       leaseDeadlineAt: reservation.now + reservation.leaseTtlMs,
       lastRenewedAt: reservation.now,
       handoffOperationId: reservation.handoffOperationId,
       claimKeyId: reservation.claimKeyId,
       claimStatus: 'reserved',
-      settlementRetryRequired: undefined,
-      settlementRetryId: undefined,
       deathEvidence: null
     })
   }
@@ -108,16 +107,19 @@ export function commitAgentSessionProcessIdentity(
   const { record } = args
   assertFence(record.lease, args.fence)
   if (record.lease.claimStatus !== 'reserved' || record.lease.ownerProcess !== null) {
-    throw new Error('agent_session_ownership_unknown')
+    throw agentSessionRefusalError('agent_session_ownership_unknown', {
+      reason: 'spawnIdentityMismatch'
+    })
   }
   if (record.lease.reservedSpawnToken !== args.process.spawnToken) {
     // Why: a child that cannot echo the reserved token is not the process Orca started.
-    throw new Error('agent_session_ownership_unknown')
+    throw agentSessionRefusalError('agent_session_ownership_unknown', {
+      reason: 'spawnIdentityMismatch'
+    })
   }
   return withLease(record, {
     ...record.lease,
     ownerProcess: args.process,
-    processlessAt: null,
     lastRenewedAt: args.now
   })
 }
@@ -140,7 +142,9 @@ export function proveAgentSessionOwner(args: {
     record.lease.handoffStage !== 'new-owner-proving' ||
     record.lease.ownerProcess === null
   ) {
-    throw new Error('agent_session_ownership_unknown')
+    throw agentSessionRefusalError('agent_session_ownership_unknown', {
+      reason: 'spawnIdentityMismatch'
+    })
   }
   if (args.link.handle.provider !== record.provider) {
     throw new Error('agent_session_provider_handle_provider_mismatch')
@@ -205,13 +209,9 @@ export function evictAgentSessionOwner(args: {
   expectedFence: number
   probe: AgentSessionOwnerProbe
   now: number
-  journalSettlement: 'required' | 'not-required'
 }): AgentSessionRecord {
   const { record } = args
   assertFence(record.lease, args.expectedFence)
-  if (record.lease.settlementRetryRequired) {
-    throw new Error('agent_session_ownership_unknown')
-  }
   const adjudication = adjudicateAgentSessionRestart({
     lease: record.lease,
     probe: args.probe,
@@ -224,29 +224,50 @@ export function evictAgentSessionOwner(args: {
       ...record.lease,
       handoffStage: null,
       handoffOperationId: null,
-      processlessAt: null,
       lastRenewedAt: args.now
     })
   }
   if (adjudication.disposition !== 'evicted') {
     throw new Error('agent_session_ownership_unknown')
   }
-  const settlementRequired = args.journalSettlement === 'required'
+  return releasedAgentSessionLease(record, adjudication.nextFence, adjudication.evidence, args.now)
+}
+
+/**
+ * Recovery's conclusion when proof never came: a recorded owner whose identity cannot be verified,
+ * or that survived the stop ladder. Its transport died with the runtime that held it, so nothing
+ * can drive it, and a verdict that never arrives must not hold the conversation. Nothing proved it
+ * gone, so no death evidence is written.
+ */
+export function releaseUnprovenAgentSessionOwner(args: {
+  record: AgentSessionRecord
+  expectedFence: number
+  now: number
+}): AgentSessionRecord {
+  const { record } = args
+  assertFence(record.lease, args.expectedFence)
+  if (record.lease.handoffStage !== 'recovering') {
+    throw new Error('agent_session_ownership_unknown')
+  }
+  return releasedAgentSessionLease(record, nextAgentSessionFence(record.lease), null, args.now)
+}
+
+function releasedAgentSessionLease(
+  record: AgentSessionRecord,
+  runtimeFence: number,
+  deathEvidence: AgentSessionDeathEvidence | null,
+  now: number
+): AgentSessionRecord {
   return withLease(record, {
     ...record.lease,
-    runtimeFence: adjudication.nextFence,
+    runtimeFence,
     handoffStage: null,
     ownerProcess: null,
     reservedSpawnToken: null,
-    processlessAt: null,
     claimStatus: 'released',
-    lastRenewedAt: args.now,
+    lastRenewedAt: now,
     handoffOperationId: null,
-    deathEvidence: adjudication.evidence,
-    settlementRetryRequired: settlementRequired ? true : undefined,
-    settlementRetryId: settlementRequired
-      ? agentSessionRestartEvictionSettlementId(record.lease, adjudication)
-      : undefined
+    deathEvidence
   })
 }
 
diff --git a/src/main/runtime/agent-session-operation-admission.test.ts b/src/main/runtime/agent-session-operation-admission.test.ts
index 0b8b9ff91f20..41df221ad122 100644
--- a/src/main/runtime/agent-session-operation-admission.test.ts
+++ b/src/main/runtime/agent-session-operation-admission.test.ts
@@ -48,6 +48,10 @@ describe('global agent-session operation admission', () => {
         fingerprint: 'different-send',
         now: NOW + 1
       }).decision
-    ).toEqual({ decision: 'refused', code: 'agent_session_operation_conflict' })
+    ).toEqual({
+      decision: 'refused',
+      code: 'agent_session_operation_conflict',
+      details: { reason: 'operationIdReused' }
+    })
   })
 })
diff --git a/src/main/runtime/agent-session-operation-admission.ts b/src/main/runtime/agent-session-operation-admission.ts
index 49dbab1c90dc..f16d48efb9d8 100644
--- a/src/main/runtime/agent-session-operation-admission.ts
+++ b/src/main/runtime/agent-session-operation-admission.ts
@@ -36,6 +36,7 @@ export type AgentSessionMutationOperationAdmission = {
   hostFingerprint: string
   now: number
   operationIdScope?: 'global'
+  conversationWrite?: true
 }
 
 export type AgentSessionMutationOperationDecision = {
@@ -132,7 +133,7 @@ function mutationOperation(
   }
 }
 
-/** Admit the ledger row and its lease/fence preconditions in one durable transaction. */
+/** Admit the ledger row and its writer-lease precondition in one durable transaction. */
 export function admitAgentSessionMutationOperation(
   state: AgentSessionStoreState,
   args: AgentSessionMutationOperationAdmission
@@ -149,7 +150,8 @@ export function admitAgentSessionMutationOperation(
     envelope: args.envelope,
     hostFingerprint: args.hostFingerprint,
     ledger: ledger.decision,
-    lease: record.lease
+    lease: record.lease,
+    ...(args.conversationWrite ? { conversationWrite: true } : {})
   })
   if (ledger.decision.decision === 'admit' && admission.decision === 'refused') {
     ledger.rows.delete(agentSessionOperationKey(operation.callerKey, operation.operationId))
diff --git a/src/main/runtime/agent-session-process-identity-probe.ts b/src/main/runtime/agent-session-process-identity-probe.ts
index 3fa1971b8303..0fe0a16f4ee0 100644
--- a/src/main/runtime/agent-session-process-identity-probe.ts
+++ b/src/main/runtime/agent-session-process-identity-probe.ts
@@ -4,8 +4,8 @@
  * Pids are reused within minutes on a busy host, and reuse happens precisely in the recovery
  * case, so a bare pid match is never proof. Every element of the identity tuple is unavailable
  * somewhere — start time costs a CIM query on Windows and is missing in some containers, /proc
- * does not exist on macOS — so an exact but unanswerable identity stays fenced in `recovering`;
- * an ownerless, unattributable reservation enters `manual-recovery`.
+ * does not exist on macOS — so an unanswerable identity reports `indeterminate` and is never read
+ * as alive or dead.
  */
 
 import { readFile } from 'node:fs/promises'
diff --git a/src/main/runtime/agent-session-processless-reservation.ts b/src/main/runtime/agent-session-processless-reservation.ts
deleted file mode 100644
index 9415ba8fcb73..000000000000
--- a/src/main/runtime/agent-session-processless-reservation.ts
+++ /dev/null
@@ -1,44 +0,0 @@
-import type { AgentSessionRecord } from '../../shared/agent-session-record'
-
-export type AgentSessionReservationProcesslessProof = {
-  sessionId: string
-  fence: number
-  spawnToken: string
-  now: number
-}
-
-function assertReservation(
-  record: AgentSessionRecord,
-  args: AgentSessionReservationProcesslessProof
-): void {
-  if (record.lease.runtimeFence !== args.fence || record.lease.unreconciled) {
-    throw new Error('agent_session_checkpoint_stale')
-  }
-  if (
-    record.lease.claimStatus !== 'reserved' ||
-    record.lease.reservedSpawnToken !== args.spawnToken
-  ) {
-    throw new Error('agent_session_ownership_unknown')
-  }
-}
-
-export function setAgentSessionReservationProcesslessProof(
-  args: AgentSessionReservationProcesslessProof & {
-    record: AgentSessionRecord
-    processlessAt: number | null
-  }
-): AgentSessionRecord {
-  const { record } = args
-  assertReservation(record, args)
-  if (args.processlessAt === null && record.lease.processlessAt == null) {
-    return record
-  }
-  if (record.lease.ownerProcess !== null) {
-    throw new Error('agent_session_ownership_unknown')
-  }
-  return {
-    ...record,
-    lease: { ...record.lease, processlessAt: args.processlessAt },
-    updatedAt: args.now
-  }
-}
diff --git a/src/main/runtime/agent-session-provider-handle-transition.ts b/src/main/runtime/agent-session-provider-handle-transition.ts
index f04089018684..57d2ecb172c0 100644
--- a/src/main/runtime/agent-session-provider-handle-transition.ts
+++ b/src/main/runtime/agent-session-provider-handle-transition.ts
@@ -1,3 +1,4 @@
+import { agentSessionRefusalError } from '../../shared/agent-session-wire-refusals'
 import {
   agentSessionProviderHandleChainHead,
   appendAgentSessionProviderHandleLink,
@@ -20,7 +21,7 @@ export function recordAgentSessionProviderHandle(args: {
     throw new Error('agent_session_provider_handle_invalid')
   }
   if (record.lease.claimStatus !== 'live' && record.lease.handoffStage !== 'new-owner-proving') {
-    throw new Error('agent_session_ownership_unknown')
+    throw agentSessionRefusalError('agent_session_ownership_unknown', { reason: 'leaseMoved' })
   }
   const providerHandleChain = appendAgentSessionProviderHandleLink(
     record.providerHandleChain,
diff --git a/src/main/runtime/agent-session-record-options.ts b/src/main/runtime/agent-session-record-options.ts
index 8cf88d685f37..697b63a0422c 100644
--- a/src/main/runtime/agent-session-record-options.ts
+++ b/src/main/runtime/agent-session-record-options.ts
@@ -1,3 +1,4 @@
+import { agentSessionRefusalError } from '../../shared/agent-session-wire-refusals'
 import type {
   AgentSessionOptionsReplacement,
   AgentSessionRecord
@@ -7,8 +8,11 @@ export function replaceAgentSessionRecordOptions(
   record: AgentSessionRecord,
   replacement: AgentSessionOptionsReplacement
 ): AgentSessionRecord {
-  if (record.lease.runtimeFence !== replacement.fence || record.lease.claimStatus !== 'live') {
-    throw new Error('agent_session_ownership_unknown')
+  const { lease } = record
+  // At rest the host is the only writer: a pick is intent the next start replays.
+  const atRest = lease.claimStatus === 'released' && lease.ownerProcess === null
+  if (lease.runtimeFence !== replacement.fence || (lease.claimStatus !== 'live' && !atRest)) {
+    throw agentSessionRefusalError('agent_session_ownership_unknown', { reason: 'leaseMoved' })
   }
   return { ...record, options: { ...replacement.options }, updatedAt: replacement.now }
 }
diff --git a/src/main/runtime/agent-session-record-store-file.ts b/src/main/runtime/agent-session-record-store-file.ts
index b721055e2a93..ef0f4b1ab7f5 100644
--- a/src/main/runtime/agent-session-record-store-file.ts
+++ b/src/main/runtime/agent-session-record-store-file.ts
@@ -21,10 +21,9 @@ import {
   type AgentSessionRecord
 } from '../../shared/agent-session-record'
 import { normalizeLegacyHandoffRecord } from '../../shared/agent-session-legacy-handoff-lease'
-import { structuredAgentSessionTabId } from '../../shared/structured-agent-session-projection'
 import { agentSessionStoreBackupPath as backupPath } from './agent-session-record-store-write'
 export { saveAgentSessionStore } from './agent-session-record-store-write'
-import { parseVisibleSessionIds } from './agent-session-visible-tab-index'
+import { parseAgentSessionTabTable, type AgentSessionTabTable } from './agent-session-tab-table'
 import { serializeAgentSessionStoreState } from './agent-session-store-serialization'
 
 export const AGENT_SESSION_STORE_SCHEMA_VERSION = 2 as const
@@ -41,10 +40,8 @@ export type AgentSessionStoreState = {
   retiredClaimKeys: RetiredAgentSessionClaimKey[]
   /** Rows this build cannot validate, kept with a durable refusal reason. */
   unreadableRecords: Map<string, { reason: string; raw: unknown }>
-  /** Structured sessions that currently have a visible chat tab. */
-  visibleSessionIds: Set<string>
-  /** True once this store has committed the visibility index field. */
-  visibleSessionIdsIndexPresent: boolean
+  /** Chat tab id → the conversation it shows; null until this store first records a tab. */
+  sessionTabs: AgentSessionTabTable | null
 }
 
 export type LoadedAgentSessionStore = {
@@ -72,33 +69,10 @@ function emptyState(hostId: string): AgentSessionStoreState {
     operations: new Map(),
     retiredClaimKeys: [],
     unreadableRecords: new Map(),
-    visibleSessionIds: new Set(),
-    visibleSessionIdsIndexPresent: false
+    sessionTabs: null
   }
 }
 
-/**
- * Gives every record written before the host owned a chat's tab id the string clients derived for
- * it, so read state, notification ids and worker rows keyed by that id stay valid on upgrade.
- *
- * Runs once per open, after the disk revision is taken and before the load rewrite: it is not part
- * of parsing, because a parsed state must hash to what is on disk or every transaction would read
- * the file as externally changed. Returns how many records it filled.
- */
-export function backfillAgentSessionSurfaceTabIds(state: AgentSessionStoreState): number {
-  let filled = 0
-  for (const [sessionId, record] of state.records) {
-    if (record.surfaceTabId === undefined) {
-      state.records.set(sessionId, {
-        ...record,
-        surfaceTabId: structuredAgentSessionTabId(sessionId)
-      })
-      filled += 1
-    }
-  }
-  return filled
-}
-
 export function agentSessionStoreRevision(state: AgentSessionStoreState): string {
   return createHash('sha256')
     .update(String(state.schemaVersion))
@@ -131,6 +105,7 @@ function parseState(
     operations?: unknown
     retiredClaimKeys?: unknown
     unusableRecords?: unknown
+    sessionTabs?: unknown
     visibleSessionIds?: unknown
   }
   if (
@@ -245,16 +220,15 @@ function parseState(
       state.retiredClaimKeys.push({ keyId: key.keyId, retiredAt: key.retiredAt as number })
     }
   }
-  const visibleSessionIds = parseVisibleSessionIds(
-    file.visibleSessionIds,
-    schemaVersion,
-    AGENT_SESSION_STORE_SCHEMA_VERSION
+  const sessionTabs = parseAgentSessionTabTable(
+    file,
+    state.records,
+    schemaVersion === AGENT_SESSION_STORE_SCHEMA_VERSION
   )
-  if (!visibleSessionIds.valid) {
+  if (!sessionTabs.valid) {
     return null
   }
-  state.visibleSessionIdsIndexPresent = visibleSessionIds.present
-  visibleSessionIds.ids.forEach((sessionId) => state.visibleSessionIds.add(sessionId))
+  state.sessionTabs = sessionTabs.table
   return { state, needsRewrite, legacyHandoffLeasesNormalized }
 }
 
diff --git a/src/main/runtime/agent-session-record-store-legacy-handoff-lease.test.ts b/src/main/runtime/agent-session-record-store-legacy-handoff-lease.test.ts
index 3b92eeb5fe74..c614cfa5515f 100644
--- a/src/main/runtime/agent-session-record-store-legacy-handoff-lease.test.ts
+++ b/src/main/runtime/agent-session-record-store-legacy-handoff-lease.test.ts
@@ -125,7 +125,7 @@ describe('a lease the removed terminal handoff wrote', () => {
     expect(store.getRecord(SESSION)?.lease).toMatchObject({
       unreconciled: false,
       claimStatus: 'conflicted',
-      handoffStage: 'manual-recovery'
+      handoffStage: 'recovering'
     })
     const settled = await readFile(agentSessionStorePath(directory), 'utf-8')
     await open()
diff --git a/src/main/runtime/agent-session-record-store-surface-tab-id.test.ts b/src/main/runtime/agent-session-record-store-surface-tab-id.test.ts
deleted file mode 100644
index f9603e7a86bc..000000000000
--- a/src/main/runtime/agent-session-record-store-surface-tab-id.test.ts
+++ /dev/null
@@ -1,149 +0,0 @@
-/**
- * The host-owned id of the tab that shows a structured chat, as the record store persists it.
- * Separate from the store's main suite only because that file is at its line cap.
- */
-
-import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'
-import { tmpdir } from 'node:os'
-import { join } from 'node:path'
-import { afterEach, beforeEach, describe, expect, it } from 'vitest'
-import type { AgentSessionOwnerProbe } from '../../shared/agent-session-lease-adjudication'
-import type { AgentSessionExecutionLocation } from '../../shared/agent-session-record'
-import { AgentSessionRecordStore } from './agent-session-record-store'
-import { agentSessionStorePath } from './agent-session-record-store-file'
-import type { AgentSessionReserveRequest } from './agent-session-reservation-admission'
-
-const NOW = 1_800_000_000_000
-const NATIVE: AgentSessionExecutionLocation = {
-  executionHostId: 'local',
-  wslDistro: null,
-  workspaceId: 'workspace-1',
-  workspaceKind: 'git-worktree'
-}
-const INDETERMINATE: AgentSessionOwnerProbe = { outcome: 'indeterminate', reason: 'no answer' }
-
-let directory: string
-let counter = 0
-
-beforeEach(async () => {
-  directory = await mkdtemp(join(tmpdir(), 'orca-agent-session-surface-tab-id-'))
-})
-
-afterEach(async () => {
-  await rm(directory, { recursive: true, force: true })
-})
-
-function operationId(now = NOW): string {
-  counter += 1
-  return `${now}-${String(counter)
-    .padStart(32, '0')
-    .replaceAll(/[^0-9a-f]/g, '0')}`
-}
-
-function reserveRequest(
-  overrides: Partial<AgentSessionReserveRequest> = {}
-): AgentSessionReserveRequest {
-  return {
-    sessionId: 'session-alpha',
-    location: NATIVE,
-    provider: 'claude',
-    accountHome: { variable: 'CLAUDE_CONFIG_DIR', path: '/home/dev/.claude-work' },
-    expectedFence: null,
-    spawnToken: 'spawn-a',
-    claimKeyId: 'key-1',
-    handoffOperationId: null,
-    probe: INDETERMINATE,
-    operation: { callerKey: 'client-1', operationId: operationId(), fingerprint: 'fp-1' },
-    now: NOW,
-    ...overrides
-  }
-}
-
-async function open(): Promise<AgentSessionRecordStore> {
-  return AgentSessionRecordStore.open({ directory, hostId: 'local' })
-}
-
-describe('surface tab id', () => {
-  const LEGACY_TAB_ID = 'structured-agent-session-session-alpha'
-
-  it('records the reserved tab id and refuses a second record under it', async () => {
-    const store = await open()
-    await store.reserveOwner(reserveRequest({ surfaceTabId: 'tab-alpha' }))
-    expect(store.getRecord('session-alpha')?.surfaceTabId).toBe('tab-alpha')
-    const persisted = JSON.parse(await readFile(agentSessionStorePath(directory), 'utf-8'))
-    expect(persisted.records['session-alpha'].surfaceTabId).toBe('tab-alpha')
-
-    await expect(
-      store.reserveOwner(
-        reserveRequest({
-          sessionId: 'session-beta',
-          surfaceTabId: 'tab-alpha',
-          operation: { callerKey: 'client-1', operationId: operationId(), fingerprint: 'fp-2' }
-        })
-      )
-    ).rejects.toThrow('agent_session_conflict')
-    expect(store.getRecord('session-beta')).toBeNull()
-  })
-
-  it('refuses a tab id that could not prefix a pane key', async () => {
-    const store = await open()
-    await expect(
-      store.reserveOwner(reserveRequest({ surfaceTabId: 'agent-session:session-alpha' }))
-    ).rejects.toThrow('agent_session_operation_invalid')
-  })
-
-  it('backfills a record written before the field existed with the id clients derived', async () => {
-    const first = await open()
-    await first.reserveOwner(reserveRequest())
-    const filePath = agentSessionStorePath(directory)
-    const raw = JSON.parse(await readFile(filePath, 'utf-8'))
-    delete raw.records['session-alpha'].surfaceTabId
-    await writeFile(filePath, JSON.stringify(raw))
-
-    const reopened = await open()
-    // In memory at once, so every reader of the record sees one.
-    expect(reopened.getRecord('session-alpha')?.surfaceTabId).toBe(LEGACY_TAB_ID)
-    // Not on disk yet: an open must not write, or another holder of the file mid-restart would
-    // read it as an external change.
-    expect(
-      JSON.parse(await readFile(filePath, 'utf-8')).records['session-alpha']
-    ).not.toHaveProperty('surfaceTabId')
-
-    // The first transaction carries it to disk, and a later open finds nothing left to fill.
-    await reopened.setSessionTabVisibility('session-alpha', true)
-    expect(
-      JSON.parse(await readFile(filePath, 'utf-8')).records['session-alpha'].surfaceTabId
-    ).toBe(LEGACY_TAB_ID)
-    const settled = await readFile(filePath, 'utf-8')
-    await open()
-    expect(await readFile(filePath, 'utf-8')).toBe(settled)
-  })
-
-  it('refills the id when another holder rewrites the file, without forcing a save', async () => {
-    const store = await open()
-    await store.reserveOwner(reserveRequest({ surfaceTabId: 'tab-alpha' }))
-    const filePath = agentSessionStorePath(directory)
-    const raw = JSON.parse(await readFile(filePath, 'utf-8'))
-    // An older build's write, which never carries the field.
-    delete raw.records['session-alpha'].surfaceTabId
-    raw.visibleSessionIds = []
-    const external = JSON.stringify(raw)
-    await writeFile(filePath, external)
-
-    // A transaction that changes nothing still reloads the externally changed file first.
-    await store.setSessionTabVisibility('session-alpha', false)
-    expect(store.getRecord('session-alpha')?.surfaceTabId).toBe(LEGACY_TAB_ID)
-    // The reload marked every lease unadjudicated; a refill must not persist that verdict.
-    expect(await readFile(filePath, 'utf-8')).toBe(external)
-  })
-
-  it('quarantines a persisted record whose tab id contains a colon', async () => {
-    const first = await open()
-    await first.reserveOwner(reserveRequest())
-    const filePath = agentSessionStorePath(directory)
-    const raw = JSON.parse(await readFile(filePath, 'utf-8'))
-    raw.records['session-alpha'].surfaceTabId = 'agent-session:session-alpha'
-    await writeFile(filePath, JSON.stringify(raw))
-    expect((await open()).isSessionUnreadable('session-alpha')).toBe(true)
-  })
-})
diff --git a/src/main/runtime/agent-session-record-store-tab-table.test.ts b/src/main/runtime/agent-session-record-store-tab-table.test.ts
new file mode 100644
index 000000000000..56bcb6debb6a
--- /dev/null
+++ b/src/main/runtime/agent-session-record-store-tab-table.test.ts
@@ -0,0 +1,277 @@
+/**
+ * The persisted table from chat tab id to the conversation it shows, as the record store keeps it.
+ * Separate from the store's main suite only because that file is at its line cap.
+ */
+
+import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+import type { AgentSessionOwnerProbe } from '../../shared/agent-session-lease-adjudication'
+import type { AgentSessionExecutionLocation } from '../../shared/agent-session-record'
+import { isAgentSessionRefusalError } from '../../shared/agent-session-wire-refusals'
+import { AgentSessionRecordStore } from './agent-session-record-store'
+import { agentSessionStorePath } from './agent-session-record-store-file'
+import type { AgentSessionReserveRequest } from './agent-session-reservation-admission'
+
+const NOW = 1_800_000_000_000
+const NATIVE: AgentSessionExecutionLocation = {
+  executionHostId: 'local',
+  wslDistro: null,
+  workspaceId: 'workspace-1',
+  workspaceKind: 'git-worktree'
+}
+const INDETERMINATE: AgentSessionOwnerProbe = { outcome: 'indeterminate', reason: 'no answer' }
+
+let directory: string
+let counter = 0
+
+beforeEach(async () => {
+  directory = await mkdtemp(join(tmpdir(), 'orca-agent-session-tab-table-'))
+})
+
+afterEach(async () => {
+  await rm(directory, { recursive: true, force: true })
+})
+
+function operationId(now = NOW): string {
+  counter += 1
+  return `${now}-${String(counter)
+    .padStart(32, '0')
+    .replaceAll(/[^0-9a-f]/g, '0')}`
+}
+
+function reserveRequest(
+  overrides: Partial<AgentSessionReserveRequest> = {}
+): AgentSessionReserveRequest {
+  return {
+    sessionId: 'session-alpha',
+    location: NATIVE,
+    provider: 'claude',
+    accountHome: { variable: 'CLAUDE_CONFIG_DIR', path: '/home/dev/.claude-work' },
+    expectedFence: null,
+    spawnToken: 'spawn-a',
+    claimKeyId: 'key-1',
+    handoffOperationId: null,
+    probe: INDETERMINATE,
+    operation: { callerKey: 'client-1', operationId: operationId(), fingerprint: 'fp-1' },
+    now: NOW,
+    ...overrides
+  }
+}
+
+async function open(): Promise<AgentSessionRecordStore> {
+  return AgentSessionRecordStore.open({ directory, hostId: 'local' })
+}
+
+describe('chat tab table', () => {
+  const LEGACY_TAB_ID = 'structured-agent-session-session-alpha'
+  const filePath = () => agentSessionStorePath(directory)
+  const readFileJson = async () => JSON.parse(await readFile(filePath(), 'utf-8'))
+
+  it('takes a reserved id only when the tab is shown, and refuses it to a second chat', async () => {
+    const store = await open()
+    await store.reserveOwner(reserveRequest({ surfaceTabId: 'tab-alpha' }))
+    // A create that dies before its tab is shown leaves nothing to restore or release.
+    expect(store.getSessionTabId('session-alpha')).toBeNull()
+    expect((await readFileJson()).sessionTabs).toBeUndefined()
+
+    await store.setSessionTabVisibility('session-alpha', true, 'tab-alpha')
+    expect(store.getSessionTabId('session-alpha')).toBe('tab-alpha')
+    const persisted = await readFileJson()
+    expect(persisted.sessionTabs).toEqual([{ tabId: 'tab-alpha', sessionId: 'session-alpha' }])
+    // Not copied onto the record: the table is the one place the id lives.
+    expect(persisted.records['session-alpha']).not.toHaveProperty('surfaceTabId')
+
+    await expect(
+      store.reserveOwner(
+        reserveRequest({
+          sessionId: 'session-beta',
+          surfaceTabId: 'tab-alpha',
+          operation: { callerKey: 'client-1', operationId: operationId(), fingerprint: 'fp-2' }
+        })
+      )
+    ).rejects.toThrow('agent_session_conflict')
+    expect(store.getRecord('session-beta')).toBeNull()
+  })
+
+  it('refuses showing a tab with the situation typed, as every chat refusal is', async () => {
+    const store = await open()
+    await store.reserveOwner(reserveRequest({ surfaceTabId: 'tab-alpha' }))
+    await store.setSessionTabVisibility('session-alpha', true, 'tab-alpha')
+    await store.reserveOwner(
+      reserveRequest({
+        sessionId: 'session-beta',
+        operation: { callerKey: 'client-1', operationId: operationId(), fingerprint: 'fp-2' }
+      })
+    )
+
+    // The message stays the code: readers of a thrown refusal treat it as one.
+    await expect(
+      store.setSessionTabVisibility('session-beta', true, 'tab-alpha')
+    ).rejects.toSatisfy(
+      (error) =>
+        isAgentSessionRefusalError(error) &&
+        error.message === 'agent_session_conflict' &&
+        error.refusal.details?.reason === 'tabIdTaken'
+    )
+    await expect(store.setSessionTabVisibility('session-gone', true)).rejects.toSatisfy(
+      (error) =>
+        isAgentSessionRefusalError(error) &&
+        error.message === 'agent_session_identity_required' &&
+        error.refusal.details?.reason === 'recordMissing'
+    )
+  })
+
+  it('frees a reserved id once its chat is hidden', async () => {
+    const store = await open()
+    await store.reserveOwner(reserveRequest({ surfaceTabId: 'tab-alpha' }))
+    await store.setSessionTabVisibility('session-alpha', true, 'tab-alpha')
+    await store.setSessionTabVisibility('session-alpha', false)
+    await store.reserveOwner(
+      reserveRequest({
+        sessionId: 'session-beta',
+        surfaceTabId: 'tab-alpha',
+        operation: { callerKey: 'client-1', operationId: operationId(), fingerprint: 'fp-2' }
+      })
+    )
+    await store.setSessionTabVisibility('session-beta', true, 'tab-alpha')
+    expect(store.getSessionTabId('session-beta')).toBe('tab-alpha')
+  })
+
+  it('refuses a tab id that could not prefix a pane key', async () => {
+    const store = await open()
+    await expect(
+      store.reserveOwner(reserveRequest({ surfaceTabId: 'agent-session:session-alpha' }))
+    ).rejects.toThrow('agent_session_operation_invalid')
+  })
+
+  it('gives a shown chat the id clients derive, and puts a hidden one back under its old id', async () => {
+    const store = await open()
+    await store.reserveOwner(reserveRequest())
+    await store.setSessionTabVisibility('session-alpha', true)
+    expect(store.getSessionTabId('session-alpha')).toBe(LEGACY_TAB_ID)
+    await store.setSessionTabVisibility('session-alpha', false)
+    await store.setSessionTabVisibility('session-alpha', true, 'tab-restored')
+    expect(store.getSessionTabId('session-alpha')).toBe('tab-restored')
+  })
+
+  it('seeds the table from an older store, keeping each visible chat on the id it has today', async () => {
+    const first = await open()
+    await first.reserveOwner(reserveRequest())
+    await first.reserveOwner(
+      reserveRequest({
+        sessionId: 'session-beta',
+        operation: { callerKey: 'client-1', operationId: operationId(), fingerprint: 'fp-2' }
+      })
+    )
+    await first.reserveOwner(
+      reserveRequest({
+        sessionId: 'session-gamma',
+        operation: { callerKey: 'client-1', operationId: operationId(), fingerprint: 'fp-3' }
+      })
+    )
+    // What a build before the table wrote: the visible list, and a tab id on some records.
+    const raw = await readFileJson()
+    delete raw.sessionTabs
+    raw.visibleSessionIds = ['session-alpha', 'session-beta']
+    raw.records['session-alpha'].surfaceTabId = 'tab-alpha'
+    raw.records['session-beta'].surfaceTabId = 'structured-agent-session-session-beta'
+    const legacy = JSON.stringify(raw)
+    await writeFile(filePath(), legacy)
+
+    const reopened = await open()
+    expect(reopened.getSessionTabId('session-alpha')).toBe('tab-alpha')
+    expect(reopened.getSessionTabId('session-beta')).toBe('structured-agent-session-session-beta')
+    expect(reopened.getSessionTabId('session-gamma')).toBeNull()
+    // Seeding is part of reading, so an open alone writes nothing.
+    expect(await readFile(filePath(), 'utf-8')).toBe(legacy)
+
+    await reopened.setSessionTabVisibility('session-gamma', true)
+    const persisted = await readFileJson()
+    expect(persisted.sessionTabs).toEqual([
+      { tabId: 'tab-alpha', sessionId: 'session-alpha' },
+      { tabId: 'structured-agent-session-session-beta', sessionId: 'session-beta' },
+      { tabId: 'structured-agent-session-session-gamma', sessionId: 'session-gamma' }
+    ])
+    // Older builds restore from this list; the record field rides along untouched and unread.
+    expect(persisted.visibleSessionIds).toEqual(['session-alpha', 'session-beta', 'session-gamma'])
+    expect(persisted.records['session-alpha'].surfaceTabId).toBe('tab-alpha')
+  })
+
+  it('seeds a chat cleared before the upgrade under the id its tab opened with', async () => {
+    const first = await open()
+    for (const [index, sessionId] of ['session-alpha', 'clear-one', 'clear-two'].entries()) {
+      await first.reserveOwner(
+        reserveRequest({
+          sessionId,
+          operation: {
+            callerKey: 'client-1',
+            operationId: operationId(),
+            fingerprint: `fp-chain-${index}`
+          }
+        })
+      )
+    }
+    // An older build after two clears, with the first conversation reopened from history.
+    const raw = await readFileJson()
+    const cleared = (replacementSessionId: string) => ({
+      command: 'clear',
+      state: 'completed',
+      phase: 'committed',
+      operationId: operationId(),
+      callerKey: 'client-1',
+      replacementSessionId
+    })
+    raw.records['session-alpha'].conversationCommand = cleared('clear-one')
+    raw.records['clear-one'].conversationCommand = cleared('clear-two')
+    raw.records['clear-two'].surfaceTabId = 'structured-agent-session-clear-two'
+    delete raw.sessionTabs
+    raw.visibleSessionIds = ['session-alpha', 'clear-two']
+    await writeFile(filePath(), JSON.stringify(raw))
+
+    const reopened = await open()
+    expect(reopened.getSessionTabId('clear-two')).toBe(LEGACY_TAB_ID)
+    const reopenedTab = reopened.getSessionTabId('session-alpha')
+    expect(reopenedTab).not.toBe(LEGACY_TAB_ID)
+    expect(reopenedTab).not.toContain(':')
+    expect(reopened.listVisibleSessionIds()).toEqual(['session-alpha', 'clear-two'])
+    // Seeding is part of reading, so it must give the same ids on every read of the same bytes.
+    expect((await open()).getSessionTabId('session-alpha')).toBe(reopenedTab)
+  })
+
+  it('reads the table, never the record field, once the table is on disk', async () => {
+    const first = await open()
+    await first.reserveOwner(reserveRequest())
+    await first.setSessionTabVisibility('session-alpha', true, 'tab-alpha')
+    const raw = await readFileJson()
+    raw.records['session-alpha'].surfaceTabId = 'tab-stale'
+    await writeFile(filePath(), JSON.stringify(raw))
+    expect((await open()).getSessionTabId('session-alpha')).toBe('tab-alpha')
+  })
+
+  it('keeps a record whose legacy tab id is malformed, seeding it under the derived id', async () => {
+    const first = await open()
+    await first.reserveOwner(reserveRequest())
+    const raw = await readFileJson()
+    delete raw.sessionTabs
+    raw.visibleSessionIds = ['session-alpha']
+    raw.records['session-alpha'].surfaceTabId = 'agent-session:session-alpha'
+    await writeFile(filePath(), JSON.stringify(raw))
+    const reopened = await open()
+    expect(reopened.isSessionUnreadable('session-alpha')).toBe(false)
+    expect(reopened.getSessionTabId('session-alpha')).toBe(LEGACY_TAB_ID)
+  })
+
+  it('treats a malformed table as a corrupt store rather than guessing', async () => {
+    const first = await open()
+    await first.reserveOwner(reserveRequest())
+    const raw = await readFileJson()
+    raw.sessionTabs = [
+      { tabId: 'tab-alpha', sessionId: 'session-alpha' },
+      { tabId: 'tab-alpha', sessionId: 'session-beta' }
+    ]
+    await writeFile(filePath(), JSON.stringify(raw))
+    await expect(open()).rejects.toThrow('agent_session_store_corrupt')
+  })
+})
diff --git a/src/main/runtime/agent-session-record-store.test.ts b/src/main/runtime/agent-session-record-store.test.ts
index 65d689503c2a..ce38e43d0ea3 100644
--- a/src/main/runtime/agent-session-record-store.test.ts
+++ b/src/main/runtime/agent-session-record-store.test.ts
@@ -5,6 +5,7 @@ import { afterEach, beforeEach, describe, expect, it } from 'vitest'
 import type { AgentSessionOwnerProbe } from '../../shared/agent-session-lease-adjudication'
 import type {
   AgentSessionExecutionLocation,
+  AgentSessionLease,
   AgentSessionProcessIdentity,
   AgentSessionRecord
 } from '../../shared/agent-session-record'
@@ -121,6 +122,26 @@ async function establishOwner(
   })
 }
 
+/** The shape the removed conflict marker wrote, as it decodes. No shipped build called it; a record
+ *  may carry it. */
+async function markLegacyConflicted(
+  store: AgentSessionRecordStore,
+  lease: Partial<AgentSessionLease> = {}
+): Promise<void> {
+  if (!store.getRecord('session-alpha')) {
+    await store.reserveOwner(reserveRequest())
+  }
+  await store.transitionHandoff('session-alpha', (record) => ({
+    ...record,
+    lease: {
+      ...record.lease,
+      claimStatus: 'conflicted',
+      handoffStage: 'recovering',
+      ...lease
+    }
+  }))
+}
+
 beforeEach(async () => {
   directory = await mkdtemp(join(tmpdir(), 'orca-agent-session-store-'))
 })
@@ -596,29 +617,37 @@ describe('restart reconciliation', () => {
     ).rejects.toThrow('agent_session_ownership_unknown')
   })
 
-  it('keeps a conflict conflicted across a restart that proves nothing', async () => {
+  it('re-adjudicates a claim an older record marked conflicted by the owner it names', async () => {
     const first = await open()
     await establishOwner(first)
-    await first.markClaimConflicted('session-alpha', NOW)
+    await markLegacyConflicted(first)
 
     const reopened = await open()
     await reopened.reconcileOnRestart({
       probe: async () => ({ outcome: 'indeterminate', reason: 'no answer' }),
       now: NOW
     })
+    // An unverifiable owner goes to recovery like any other; resolution concludes about it.
     expect(reopened.getRecord('session-alpha')?.lease).toMatchObject({
-      claimStatus: 'conflicted',
-      handoffStage: 'manual-recovery'
+      handoffStage: 'recovering',
+      ownerProcess: { pid: expect.any(Number) }
+    })
+  })
+
+  it('releases a claim an older record marked conflicted that names no process', async () => {
+    const first = await open()
+    await markLegacyConflicted(first, { ownerProcess: null })
+
+    const reopened = await open()
+    await reopened.reconcileOnRestart({
+      probe: async () => ({ outcome: 'indeterminate', reason: 'no answer' }),
+      now: NOW
+    })
+    expect(reopened.getRecord('session-alpha')?.lease).toMatchObject({
+      claimStatus: 'released',
+      handoffStage: null,
+      deathEvidence: null
     })
-    await expect(
-      reopened.reserveOwner(
-        reserveRequest({
-          expectedFence: 1,
-          probe: { outcome: 'pid-absent' },
-          operation: { callerKey: 'client-1', operationId: operationId(), fingerprint: 'fp-2' }
-        })
-      )
-    ).rejects.toThrow('agent_session_conflict')
   })
 
   it('releases a conflict whose named owner is proven gone at restart', async () => {
@@ -626,7 +655,7 @@ describe('restart reconciliation', () => {
     // the process the conflict names has exited leaves no claimant left to protect.
     const first = await open()
     await establishOwner(first)
-    await first.markClaimConflicted('session-alpha', NOW)
+    await markLegacyConflicted(first)
 
     const reopened = await open()
     await reopened.reconcileOnRestart({ probe: async () => ({ outcome: 'pid-absent' }), now: NOW })
diff --git a/src/main/runtime/agent-session-record-store.ts b/src/main/runtime/agent-session-record-store.ts
index 58817a7e59cb..7df509dd8102 100644
--- a/src/main/runtime/agent-session-record-store.ts
+++ b/src/main/runtime/agent-session-record-store.ts
@@ -1,4 +1,4 @@
-import { setVisibleSessionId } from './agent-session-visible-tab-index'
+import { agentSessionRefusalError } from '../../shared/agent-session-wire-refusals'
 import { commitConversationCommandRecord } from './agent-session-conversation-command-record'
 import { setAgentSessionRecordConversationName } from './agent-session-record-conversation-name'
 /** Durable single-writer session records and their operation ledger. */
@@ -57,10 +57,6 @@ import {
   type AgentSessionRestartProbeArgs
 } from './agent-session-restart-reconciliation'
 import { replaceAgentSessionRecordOptions } from './agent-session-record-options'
-import {
-  setAgentSessionReservationProcesslessProof,
-  type AgentSessionReservationProcesslessProof
-} from './agent-session-processless-reservation'
 import {
   commitAgentSessionReservation,
   type AgentSessionReserveRequest,
@@ -69,9 +65,9 @@ import {
 import {
   agentSessionStoreRevision,
   agentSessionStorePath,
-  type AgentSessionStoreState,
-  backfillAgentSessionSurfaceTabIds
+  type AgentSessionStoreState
 } from './agent-session-record-store-file'
+import { setAgentSessionTabVisibility } from './agent-session-tab-table'
 import { loadProtectedAgentSessionStore } from './agent-session-record-store-security'
 import {
   AgentSessionStoreTransactionQueue,
@@ -90,19 +86,14 @@ export class AgentSessionRecordStore {
     // Why: every persisted lease is unreconciled until this host adjudicates it, so a restart
     // grants no writer on the strength of what the previous process wrote.
     const diskRevision = agentSessionStoreRevision(loaded.state)
-    // After the revision, so the file still hashes to what was read. The filled ids, like the
-    // normalized legacy leases, reach disk with this store's first transaction rather than a write
-    // here: a rewrite at open would read as an external change to any other holder of the file
-    // mid-restart.
-    const backfilled = backfillAgentSessionSurfaceTabIds(loaded.state)
+    // The normalized legacy leases reach disk with this store's first transaction rather than a
+    // write here: a rewrite at open would read as an external change to any other holder of the
+    // file mid-restart.
     markAgentSessionStoreLeasesUnreconciled(loaded.state)
     const transactions = AgentSessionStoreTransactionQueue.fromLoadedStore(
       filePath,
       args.hostId,
-      {
-        ...loaded,
-        needsRewrite: loaded.needsRewrite || backfilled > 0 || loaded.legacyHandoffLeasesNormalized
-      },
+      { ...loaded, needsRewrite: loaded.needsRewrite || loaded.legacyHandoffLeasesNormalized },
       diskRevision
     )
     if (loaded.needsRewrite && !loaded.readOnly && !loaded.recoveredFromBackup) {
@@ -133,16 +124,25 @@ export class AgentSessionRecordStore {
   listRecords = (): AgentSessionRecord[] => [...this.state.records.values()]
 
   listVisibleSessionIds = (): string[] =>
-    [...this.state.visibleSessionIds].filter((sessionId) => this.state.records.has(sessionId))
+    (this.state.sessionTabs?.sessionIds() ?? []).filter((sessionId) =>
+      this.state.records.has(sessionId)
+    )
 
   getVisibleSessionTabIndex = (): { present: boolean; sessionIds: string[] } => ({
-    present: this.state.visibleSessionIdsIndexPresent,
+    present: this.state.sessionTabs !== null,
     sessionIds: this.listVisibleSessionIds()
   })
 
-  /** Persist the user-visible tab reference separately from the rollback-sensitive profile tabs. */
-  setSessionTabVisibility(sessionId: string, visible: boolean): Promise<void> {
-    return this.transact(() => setVisibleSessionId(this.state, sessionId, visible))
+  /** The id of the chat tab showing this conversation, if one does. */
+  getSessionTabId = (sessionId: string): string | null =>
+    this.state.sessionTabs?.tabIdFor(sessionId) ?? null
+
+  /**
+   * Persist the user-visible tab reference separately from the rollback-sensitive profile tabs.
+   * Showing keeps a tab the session already has; `tabId` puts a hidden one back under its old id.
+   */
+  setSessionTabVisibility(sessionId: string, visible: boolean, tabId?: string): Promise<void> {
+    return this.transact(() => setAgentSessionTabVisibility(this.state, sessionId, visible, tabId))
   }
 
   listByScope(location: AgentSessionExecutionLocation): AgentSessionRecord[] {
@@ -202,13 +202,6 @@ export class AgentSessionRecordStore {
     )
   }
 
-  setReservationProcesslessProof = (
-    args: AgentSessionReservationProcesslessProof & { processlessAt: number | null }
-  ): Promise<AgentSessionRecord> =>
-    this.mutate(args.sessionId, (record) =>
-      setAgentSessionReservationProcesslessProof({ ...args, record })
-    )
-
   async proveOwner(args: {
     sessionId: string
     fence: number
@@ -256,9 +249,7 @@ export class AgentSessionRecordStore {
     probe: AgentSessionOwnerProbe
     now: number
   }): Promise<AgentSessionRecord> {
-    return this.mutate(args.sessionId, (record) =>
-      evictAgentSessionOwner({ ...args, record, journalSettlement: 'required' })
-    )
+    return this.mutate(args.sessionId, (record) => evictAgentSessionOwner({ ...args, record }))
   }
 
   async transitionHandoff(
@@ -322,16 +313,6 @@ export class AgentSessionRecordStore {
     await this.transact(() => settleAgentSessionOperationInto(this.state, args))
   }
 
-  async markClaimConflicted(sessionId: string, now: number): Promise<AgentSessionRecord> {
-    return this.mutate(sessionId, (record) => ({
-      ...record,
-      updatedAt: now,
-      // Why: a conflicted key must stay conflicted across a restart; it cannot resolve to free
-      // merely because the process that observed the conflict is gone.
-      lease: { ...record.lease, claimStatus: 'conflicted', handoffStage: 'manual-recovery' }
-    }))
-  }
-
   replaceSessionOptions = (args: AgentSessionOptionsReplacement): Promise<AgentSessionRecord> =>
     this.mutate(args.sessionId, (record) => replaceAgentSessionRecordOptions(record, args))
 
@@ -346,11 +327,9 @@ export class AgentSessionRecordStore {
     return this.transact(() => {
       const record = this.state.records.get(sessionId)
       if (!record) {
-        throw new Error(
-          this.isSessionUnreadable(sessionId)
-            ? 'execution_owner_reconciling'
-            : 'agent_session_identity_required'
-        )
+        throw this.isSessionUnreadable(sessionId)
+          ? agentSessionRefusalError('execution_owner_reconciling', { reason: 'recordUnreadable' })
+          : agentSessionRefusalError('agent_session_identity_required', { reason: 'recordMissing' })
       }
       const next = apply(record)
       this.state.records.set(sessionId, next)
diff --git a/src/main/runtime/agent-session-recovery-capsule-entries.ts b/src/main/runtime/agent-session-recovery-capsule-entries.ts
index de8a452c87a2..a5d1d899723a 100644
--- a/src/main/runtime/agent-session-recovery-capsule-entries.ts
+++ b/src/main/runtime/agent-session-recovery-capsule-entries.ts
@@ -4,6 +4,10 @@
 // — can be read on its own. Every value parsed here re-enters from a file this process did not
 // necessarily write, including one written by an older or newer build.
 
+import {
+  readAgentSessionRefusalReference,
+  type AgentSessionAnyRefusalDetails
+} from '../../shared/agent-session-wire-refusals'
 import { z } from 'zod'
 import {
   AGENT_SESSION_RESUME_FAILURE_OUTCOMES,
@@ -28,6 +32,7 @@ const failureSchema = z.object({
   failedAt: z.number().int().nonnegative(),
   outcome: z.enum(AGENT_SESSION_RESUME_FAILURE_OUTCOMES),
   reason: z.string().max(MAX_FAILURE_FIELD_LENGTH),
+  details: z.unknown().optional(),
   latestPrompt: z.string().max(MAX_FAILURE_FIELD_LENGTH),
   latestUserItemId: z.string().max(MAX_FAILURE_FIELD_LENGTH).nullable()
 })
@@ -47,7 +52,11 @@ export type AgentSessionResumeFailureRecord = {
   marker: AgentSessionResumeMarker
   failedAt: number
   outcome: AgentSessionResumeFailureOutcome
+  /** The refusal code, as it always was; the renderer's guidance keys on it. */
   reason: string
+  /** The refusal's details beside the code; absent on older records and non-refusals. A record
+   *  an unreleased build wrote with a `cause` instead reads as having none. */
+  details?: AgentSessionAnyRefusalDetails
   /** The prompt the offer quoted, snapshotted because the session may no longer be readable. */
   latestPrompt: string
   /** The chat's newest user message when this was filed, as the marker records it at teardown. A
@@ -109,7 +118,16 @@ function parseFailures(value: unknown): AgentSessionResumeFailureRecord[] {
   return (Array.isArray(value) ? value : []).flatMap((failure: unknown) => {
     const parsed = failureSchema.safeParse(failure)
     const marker = parsed.success ? parseAgentSessionResumeMarker(parsed.data.marker) : null
-    return parsed.success && marker ? [{ ...parsed.data, marker }] : []
+    if (!parsed.success || !marker) {
+      return []
+    }
+    const { details: stored, ...rest } = parsed.data
+    // `reason` is the refusal code, so the details are read against it.
+    const details = readAgentSessionRefusalReference({
+      code: rest.reason,
+      details: stored
+    })?.details
+    return [{ ...rest, marker, ...(details ? { details } : {}) }]
   })
 }
 
diff --git a/src/main/runtime/agent-session-recovery-capsule.test.ts b/src/main/runtime/agent-session-recovery-capsule.test.ts
index 2150e5c7d516..d70fde57af30 100644
--- a/src/main/runtime/agent-session-recovery-capsule.test.ts
+++ b/src/main/runtime/agent-session-recovery-capsule.test.ts
@@ -342,6 +342,41 @@ describe('durable restart offers', () => {
     expect(JSON.parse(await readFile(filePath, 'utf8')).failed).toEqual([readable])
   })
 
+  it('keeps refusal details beside the code, read back against that code', async () => {
+    const readable = {
+      marker: marker(),
+      failedAt: NOW,
+      outcome: 'refused',
+      reason: 'agent_session_conflict',
+      latestPrompt: '',
+      latestUserItemId: null
+    }
+    await writeFile(
+      filePath,
+      JSON.stringify({
+        version: 2,
+        entries: [],
+        failed: [
+          { ...readable, details: { reason: 'claimConflicted', note: 'dropped' } },
+          // An unreleased build wrote a cause here; it still parses, naming nothing.
+          { ...readable, marker: marker({ sessionId: 'older' }), cause: 'claimConflicted' },
+          // A reason the code does not list is not this code's.
+          {
+            ...readable,
+            marker: marker({ sessionId: 'foreign' }),
+            details: { reason: 'promptGone' }
+          }
+        ]
+      })
+    )
+
+    expect(await capsule.listFailed(NOW)).toEqual([
+      { ...readable, details: { reason: 'claimConflicted' } },
+      { ...readable, marker: marker({ sessionId: 'older' }) },
+      { ...readable, marker: marker({ sessionId: 'foreign' }) }
+    ])
+  })
+
   it('reads a malformed failure list as no failures', async () => {
     await writeFile(
       filePath,
diff --git a/src/main/runtime/agent-session-recovery-capsule.ts b/src/main/runtime/agent-session-recovery-capsule.ts
index 8b54871b9f4a..80ed0bb726e2 100644
--- a/src/main/runtime/agent-session-recovery-capsule.ts
+++ b/src/main/runtime/agent-session-recovery-capsule.ts
@@ -201,15 +201,20 @@ export class AgentSessionRecoveryCapsule {
 
   /** Forgets the named sessions whatever their state. Unlike `clearAll`, this is not a fence: a
    *  later teardown of the same chat may record a fresh offer. */
-  dismiss(sessionIds: readonly string[], now: number): Promise<number> {
+  dismiss(
+    sessionIds: readonly string[],
+    now: number,
+    /** A record this answers true for stays: read against the stored marker, under the lock. */
+    keep: (marker: AgentSessionResumeMarker) => boolean = () => false
+  ): Promise<number> {
     return withFileTransactionLock(this.filePath, async () => {
       const named = new Set(sessionIds)
       const state = await this.readState()
       const { entries, failed } = normalizeState(state, now)
       const dismissed = new Set(
         [...entries, ...failed]
+          .filter((record) => named.has(record.marker.sessionId) && !keep(record.marker))
           .map((record) => record.marker.sessionId)
-          .filter((sessionId) => named.has(sessionId))
       )
       if (dismissed.size > 0) {
         await this.publish(
diff --git a/src/main/runtime/agent-session-recovery-publish-fault.test.ts b/src/main/runtime/agent-session-recovery-publish-fault.test.ts
index f3f2ba91d2aa..9fdbe393334f 100644
--- a/src/main/runtime/agent-session-recovery-publish-fault.test.ts
+++ b/src/main/runtime/agent-session-recovery-publish-fault.test.ts
@@ -48,8 +48,7 @@ function state(generation: number): AgentSessionStoreState {
     operations: new Map(),
     retiredClaimKeys: [{ keyId: `generation-${generation}`, retiredAt: generation }],
     unreadableRecords: new Map(),
-    visibleSessionIds: new Set(),
-    visibleSessionIdsIndexPresent: false
+    sessionTabs: null
   }
 }
 
diff --git a/src/main/runtime/agent-session-released-reservation-replay.test.ts b/src/main/runtime/agent-session-released-reservation-replay.test.ts
new file mode 100644
index 000000000000..e3f9bcff74bc
--- /dev/null
+++ b/src/main/runtime/agent-session-released-reservation-replay.test.ts
@@ -0,0 +1,171 @@
+// A create the host was running when it died is retried under the same operation id. Recovery has
+// released its reservation by then, so the retry continues it at the next fence; a reservation that
+// is still held keeps answering exactly as it did.
+
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import {
+  AGENT_SESSION_MAX_NEW_OPERATION_AGE_MS,
+  AGENT_SESSION_OPERATION_FUTURE_SKEW_MS
+} from '../../shared/agent-session-host-authority'
+import type { AgentSessionOwnerProbe } from '../../shared/agent-session-lease-adjudication'
+import type { AgentSessionLease } from '../../shared/agent-session-record'
+import { AgentSessionRecordStore } from './agent-session-record-store'
+import type { AgentSessionReserveRequest } from './agent-session-reservation-admission'
+
+const NOW = 1_800_000_000_000
+const SESSION = 'session-alpha'
+const OPERATION = `${NOW}-${'1'.padStart(32, '0')}`
+const PAST_EXPIRY =
+  AGENT_SESSION_MAX_NEW_OPERATION_AGE_MS + AGENT_SESSION_OPERATION_FUTURE_SKEW_MS + 60_000
+const INDETERMINATE: AgentSessionOwnerProbe = { outcome: 'indeterminate', reason: 'no answer' }
+
+let directory: string
+
+beforeEach(async () => {
+  directory = await mkdtemp(join(tmpdir(), 'orca-released-reservation-replay-'))
+})
+
+afterEach(async () => {
+  await rm(directory, { recursive: true, force: true })
+})
+
+function open(): Promise<AgentSessionRecordStore> {
+  return AgentSessionRecordStore.open({ directory, hostId: 'local' })
+}
+
+function createRequest(
+  overrides: Partial<AgentSessionReserveRequest> = {}
+): AgentSessionReserveRequest {
+  return {
+    sessionId: SESSION,
+    location: {
+      executionHostId: 'local',
+      wslDistro: null,
+      workspaceId: 'workspace-1',
+      workspaceKind: 'git-worktree'
+    },
+    provider: 'codex',
+    accountHome: { variable: 'CODEX_HOME', path: '/home/dev/.codex' },
+    expectedFence: null,
+    spawnToken: 'spawn-a',
+    claimKeyId: 'key-1',
+    handoffOperationId: OPERATION,
+    probe: INDETERMINATE,
+    operation: { callerKey: 'client-1', operationId: OPERATION, fingerprint: 'fp-1' },
+    now: NOW,
+    ...overrides
+  }
+}
+
+/** The create reserved, then a restart that could prove nothing released it at fence 2. */
+async function releasedByRestart(now: number): Promise<AgentSessionRecordStore> {
+  const first = await open()
+  await first.reserveOwner(createRequest())
+  const store = await open()
+  await store.reconcileOnRestart({ probe: async () => INDETERMINATE, now })
+  expect(store.getRecord(SESSION)?.lease).toMatchObject({
+    claimStatus: 'released',
+    handoffStage: null,
+    runtimeFence: 2
+  })
+  return store
+}
+
+describe('a create retried after recovery released its reservation', () => {
+  it.each([
+    ['its operation row is still pending', 1_000],
+    ['its operation row has expired', PAST_EXPIRY]
+  ])('continues when %s, and the old reservation can never commit', async (_case, elapsed) => {
+    const now = NOW + elapsed
+    const store = await releasedByRestart(now)
+
+    const continued = await store.reserveOwner(createRequest({ spawnToken: () => 'spawn-b', now }))
+    expect(continued.disposition).toBe('reserved')
+    expect(continued.record.lease).toMatchObject({
+      claimStatus: 'reserved',
+      handoffStage: 'new-owner-proving',
+      runtimeFence: 3,
+      reservedSpawnToken: 'spawn-b',
+      handoffOperationId: OPERATION
+    })
+    expect(store.listOperationRows()).toEqual([
+      expect.objectContaining({ operationId: OPERATION, outcome: { status: 'pending' } })
+    ])
+
+    // A spawn from the first reservation reports in late: refused at its fence, and by token.
+    const lateSpawn = { hostId: 'local', pid: 4242, processStartTimeMs: NOW, spawnToken: 'spawn-a' }
+    await expect(
+      store.commitProcessIdentity({ sessionId: SESSION, fence: 1, process: lateSpawn, now })
+    ).rejects.toThrow('agent_session_checkpoint_stale')
+    await expect(
+      store.commitProcessIdentity({ sessionId: SESSION, fence: 3, process: lateSpawn, now })
+    ).rejects.toThrow('agent_session_ownership_unknown')
+
+    // Retried again while that reservation stands: the same reservation, never a second spawn.
+    const mint = vi.fn(() => 'spawn-c')
+    const retried = await store.reserveOwner(createRequest({ spawnToken: mint, now }))
+    expect(retried.disposition).toBe('replayed')
+    expect(retried.record.lease).toMatchObject({ runtimeFence: 3, reservedSpawnToken: 'spawn-b' })
+    expect(mint).not.toHaveBeenCalled()
+  })
+
+  it('refuses an expired retry of a session that has no record', async () => {
+    const store = await open()
+    await expect(store.reserveOwner(createRequest({ now: NOW + PAST_EXPIRY }))).rejects.toThrow(
+      'agent_session_operation_expired'
+    )
+  })
+
+  it.each([
+    ['proven alive', { outcome: 'identity-matched', matchedOn: ['spawn-token'] }, 'conflict'],
+    ['one nothing could verify', INDETERMINATE, 'ownership_unknown']
+  ] as const)('still refuses a retry once its child is live and %s', async (_case, probe, code) => {
+    const store = await open()
+    await store.reserveOwner(createRequest())
+    await store.commitProcessIdentity({
+      sessionId: SESSION,
+      fence: 1,
+      process: { hostId: 'local', pid: 4242, processStartTimeMs: NOW, spawnToken: 'spawn-a' },
+      now: NOW
+    })
+    await store.proveOwner({
+      sessionId: SESSION,
+      fence: 1,
+      link: {
+        linkId: 'link-1',
+        handle: { provider: 'codex', threadId: 'thread-1' },
+        origin: 'created',
+        mintedAtFence: 1,
+        observedAt: NOW
+      },
+      now: NOW
+    })
+
+    await expect(store.reserveOwner(createRequest({ probe }))).rejects.toThrow(
+      `agent_session_${code}`
+    )
+    expect(store.getRecord(SESSION)?.lease).toMatchObject({ claimStatus: 'live', runtimeFence: 1 })
+  })
+
+  it.each<[string, Partial<AgentSessionLease>, string]>([
+    ['in recovery', { handoffStage: 'recovering' }, 'agent_session_ownership_unknown'],
+    [
+      'held by a terminal agent',
+      { claimStatus: 'conflicted', handoffStage: 'recovering' },
+      'agent_session_conflict'
+    ]
+  ])('still refuses a retry whose reservation is %s', async (_case, lease, code) => {
+    const store = await open()
+    await store.reserveOwner(createRequest())
+    await store.transitionHandoff(SESSION, (record) => ({
+      ...record,
+      lease: { ...record.lease, ...lease }
+    }))
+
+    await expect(store.reserveOwner(createRequest())).rejects.toThrow(code)
+    expect(store.getRecord(SESSION)?.lease.runtimeFence).toBe(1)
+  })
+})
diff --git a/src/main/runtime/agent-session-reservation-admission.test.ts b/src/main/runtime/agent-session-reservation-admission.test.ts
index 83e9c6100567..cad534931e60 100644
--- a/src/main/runtime/agent-session-reservation-admission.test.ts
+++ b/src/main/runtime/agent-session-reservation-admission.test.ts
@@ -69,8 +69,7 @@ function storeState(records: readonly AgentSessionRecord[] = []): AgentSessionSt
     operations: new Map(),
     retiredClaimKeys: [],
     unreadableRecords: new Map(),
-    visibleSessionIds: new Set(),
-    visibleSessionIdsIndexPresent: true
+    sessionTabs: null
   }
 }
 
@@ -205,7 +204,8 @@ describe('re-create over a failed create', () => {
     provenHandleLinkId: null,
     ownerProcess: null,
     reservedSpawnToken: null,
-    claimStatus: 'released'
+    claimStatus: 'released',
+    deathEvidence: { kind: 'exit-observed', detail: 'the create failed', observedAt: 1 }
   })
   function failedCreate(overrides: Partial<AgentSessionRecord> = {}): AgentSessionRecord {
     return {
@@ -231,10 +231,12 @@ describe('re-create over a failed create', () => {
   it('refuses when the record bound a conversation, or its attempt may still run', () => {
     const bound = failedCreate({ providerHandleChain: [adoptedLink()] })
     const unproven = failedCreate({
-      lease: { ...EXITED, claimStatus: 'reserved', handoffStage: 'manual-recovery' }
+      lease: { ...EXITED, claimStatus: 'reserved', handoffStage: 'recovering' }
     })
+    // Released so a send can start over, but nothing proved the attempt gone.
+    const releasedUnproven = failedCreate({ lease: { ...EXITED, deathEvidence: null } })
 
-    for (const record of [bound, unproven]) {
+    for (const record of [bound, unproven, releasedUnproven]) {
       expect(() =>
         applyAgentSessionReservation(storeState([record]), reserveRequest(), LEASE_TTL_MS)
       ).toThrow('agent_session_conflict')
diff --git a/src/main/runtime/agent-session-reservation-admission.ts b/src/main/runtime/agent-session-reservation-admission.ts
index 4bd3bf9b4dbc..d86383ddae72 100644
--- a/src/main/runtime/agent-session-reservation-admission.ts
+++ b/src/main/runtime/agent-session-reservation-admission.ts
@@ -9,14 +9,17 @@
  * inside a transaction, which is what makes the record and its operation row land together.
  */
 
+import { agentSessionRefusalError } from '../../shared/agent-session-wire-refusals'
 import {
   agentSessionOperationKey,
   evaluateAgentSessionOperation,
+  pendingAgentSessionOperationRow,
   pruneAgentSessionOperationRows,
   type AgentSessionOperationDecision,
   type AgentSessionOperationRow
 } from '../../shared/agent-session-operation-ledger'
 import {
+  agentSessionLeaseIsReleased,
   agentSessionLeaseOwnerVerdict,
   evaluateAgentSessionAcquisition,
   type AgentSessionOwnerProbe
@@ -56,8 +59,8 @@ export type AgentSessionReserveRequest = {
   launchEnv?: AgentSessionLaunchEnv
   /** Initial provider options persisted before the first process is acquired. */
   options?: Readonly<Record<string, string>>
-  /** The tab id this conversation shows under. Pinned on first reservation; a later reservation of
-   *  an existing record keeps the record's own. Refused when another record already holds it. */
+  /** The tab id a create reserved for this conversation, taken when its tab is published. An id
+   *  another session's tab holds is refused here, before anything is spawned. */
   surfaceTabId?: string
   /** Set only when this create adopts an existing provider conversation. Seeds the handle chain so
    *  the adapter resumes; without it a new record has never proved a thread and starts a fresh one. */
@@ -110,7 +113,7 @@ export function requireAgentSessionRecordForReplay(
   if (!record) {
     // Why: the recorded effect is no longer reconstructable, and re-running it would be a second
     // spawn rather than a replay.
-    throw new Error('agent_session_ownership_unknown')
+    throw agentSessionRefusalError('agent_session_ownership_unknown', { reason: 'recordMissing' })
   }
   return record
 }
@@ -126,11 +129,13 @@ export function admitPendingAgentSessionReservationReplay(
     probe: request.probe
   })
   if (decision.decision === 'refused') {
-    throw new Error(decision.code)
+    throw agentSessionRefusalError(decision.code, decision.details)
   }
   if (decision.decision !== 'retry-reservation') {
-    // A replay may continue only its still-present reservation; recovery requires a fresh intent.
-    throw new Error('agent_session_ownership_unknown')
+    // A replay may continue only its still-present reservation.
+    throw agentSessionRefusalError('agent_session_ownership_unknown', {
+      reason: 'replaySuperseded'
+    })
   }
   return record
 }
@@ -168,12 +173,12 @@ export function applyAgentSessionReservation(
   const existing = state.records.get(request.sessionId)
   if (!existing) {
     if (state.unreadableRecords.has(request.sessionId)) {
-      throw new Error('execution_owner_reconciling')
+      throw agentSessionRefusalError('execution_owner_reconciling', { reason: 'recordUnreadable' })
     }
     if (request.expectedFence !== null) {
-      throw new Error('agent_session_checkpoint_stale')
+      throw agentSessionRefusalError('agent_session_checkpoint_stale', { reason: 'recordMissing' })
     }
-    assertSurfaceTabIdUnheld(state, request)
+    assertReservedTabUnheld(state, request)
     return { record: createAgentSessionRecord(request, reservation), disposition: 'created' }
   }
   if (
@@ -183,7 +188,7 @@ export function applyAgentSessionReservation(
     existing.accountHome.path !== request.accountHome.path
   ) {
     // Why: location, provider, and account are the session identity; changing one is a fork.
-    throw new Error('agent_session_conflict')
+    throw agentSessionRefusalError('agent_session_conflict', { reason: 'identityMismatch' })
   }
   // A create may take over only a record that never bound a conversation and whose last
   // attempt is proven gone: that is the same as creating it fresh, under a fresh provider id.
@@ -192,8 +197,9 @@ export function applyAgentSessionReservation(
     !request.adoptedHandleLink &&
     agentSessionLeaseOwnerVerdict(existing.lease) === 'exited'
   if (request.expectedFence === null && !recreatable) {
-    throw new Error('agent_session_conflict')
+    throw agentSessionRefusalError('agent_session_conflict', { reason: 'sessionExists' })
   }
+  assertReservedTabUnheld(state, request)
   const pinned = {
     ...existing,
     ...(!existing.launchArgs && request.launchArgs ? { launchArgs: [...request.launchArgs] } : {}),
@@ -237,14 +243,19 @@ function assertAdoptedConversationUnowned(
       (link) => agentSessionProviderHandleRoot(link.handle) === root
     )
     if (holdsSameConversation) {
-      throw new Error('agent_session_conflict')
+      throw agentSessionRefusalError('agent_session_conflict', {
+        reason: 'conversationHeldElsewhere'
+      })
     }
   }
 }
 
-/** A tab id names one conversation. Two records under one id would give two chats one tab, one
- *  read-state key and one notification id, so the second reservation is refused as a conflict. */
-function assertSurfaceTabIdUnheld(
+/**
+ * A tab id names one conversation, so a reserved id another session's tab holds is a conflict.
+ * Checked, not claimed: the id is taken when the chat's tab is published, so a create that never
+ * gets that far leaves nothing in the table to restore or release.
+ */
+function assertReservedTabUnheld(
   state: AgentSessionStoreState,
   request: AgentSessionReserveRequest
 ): void {
@@ -252,12 +263,13 @@ function assertSurfaceTabIdUnheld(
     return
   }
   if (!isAgentSessionSurfaceTabId(request.surfaceTabId)) {
-    throw new Error('agent_session_operation_invalid')
+    throw agentSessionRefusalError('agent_session_operation_invalid', {
+      reason: 'requestMalformed'
+    })
   }
-  for (const record of state.records.values()) {
-    if (record.sessionId !== request.sessionId && record.surfaceTabId === request.surfaceTabId) {
-      throw new Error('agent_session_conflict')
-    }
+  const holder = state.sessionTabs?.sessionIdFor(request.surfaceTabId)
+  if (holder !== undefined && holder !== request.sessionId) {
+    throw agentSessionRefusalError('agent_session_conflict', { reason: 'tabIdTaken' })
   }
 }
 
@@ -276,7 +288,6 @@ function createAgentSessionRecord(
     accountHome: request.accountHome,
     ...(request.options ? { options: { ...request.options } } : {}),
     ...(request.launchArgs ? { launchArgs: [...request.launchArgs] } : {}),
-    ...(request.surfaceTabId ? { surfaceTabId: request.surfaceTabId } : {}),
     createdAt: request.now,
     updatedAt: request.now,
     lease: {
@@ -310,21 +321,43 @@ export function commitAgentSessionReservation(
   leaseTtlMs: number
 ): AgentSessionReserveResult {
   const decision = evaluateAgentSessionReserveOperation(state, request)
+  const existing = state.records.get(request.sessionId)
+  // An unfinished operation whose reservation recovery released continues under its own id at the
+  // next fence, as a resume does under a new id; the fence move stops the old spawn committing.
+  const continued =
+    existing && agentSessionLeaseIsReleased(existing.lease)
+      ? { ...request, expectedFence: existing.lease.runtimeFence }
+      : null
   if (decision.decision === 'refused') {
-    throw new Error(decision.code)
+    // An aged-out row proves nothing more: a released reservation runs no effect.
+    if (decision.code !== 'agent_session_operation_expired' || !continued) {
+      throw agentSessionRefusalError(decision.code, decision.details)
+    }
+    const row = pendingAgentSessionOperationRow({ ...request.operation, now: request.now })
+    return reserveWithOperationRow(state, continued, row, leaseTtlMs)
   }
   if (decision.decision === 'replay') {
-    let record = requireAgentSessionRecordForReplay(state, decision.row, request.sessionId)
-    if (decision.row.outcome.status === 'pending' && request.handoffOperationId !== null) {
-      record = admitPendingAgentSessionReservationReplay(record, request)
+    const record = requireAgentSessionRecordForReplay(state, decision.row, request.sessionId)
+    if (decision.row.outcome.status !== 'pending' || request.handoffOperationId === null) {
+      return { record, disposition: 'replayed', operationRow: decision.row }
+    }
+    if (continued) {
+      return reserveWithOperationRow(state, continued, decision.row, leaseTtlMs)
     }
-    return { record, disposition: 'replayed' as const, operationRow: decision.row }
+    const retried = admitPendingAgentSessionReservationReplay(record, request)
+    return { record: retried, disposition: 'replayed', operationRow: decision.row }
   }
+  return reserveWithOperationRow(state, request, decision.row, leaseTtlMs)
+}
+
+function reserveWithOperationRow(
+  state: AgentSessionStoreState,
+  request: AgentSessionReserveRequest,
+  row: AgentSessionOperationRow,
+  leaseTtlMs: number
+): AgentSessionReserveResult {
   const result = applyAgentSessionReservation(state, request, leaseTtlMs)
-  state.operations.set(
-    agentSessionOperationKey(request.operation.callerKey, request.operation.operationId),
-    decision.row
-  )
+  state.operations.set(agentSessionOperationKey(row.callerKey, row.operationId), row)
   state.records.set(result.record.sessionId, result.record)
-  return { ...result, operationRow: decision.row }
+  return { ...result, operationRow: row }
 }
diff --git a/src/main/runtime/agent-session-restart-lease-transitions.ts b/src/main/runtime/agent-session-restart-lease-transitions.ts
index 45c59e027449..70104588a584 100644
--- a/src/main/runtime/agent-session-restart-lease-transitions.ts
+++ b/src/main/runtime/agent-session-restart-lease-transitions.ts
@@ -8,13 +8,9 @@
 
 import {
   adjudicateAgentSessionRestart,
-  agentSessionRestartEvictionSettlementId,
   type AgentSessionOwnerProbe
 } from '../../shared/agent-session-lease-adjudication'
-import type {
-  AgentSessionHandoffStage,
-  AgentSessionRecord
-} from '../../shared/agent-session-record'
+import type { AgentSessionRecord } from '../../shared/agent-session-record'
 import { withLease } from './agent-session-lease-transitions'
 
 /** Apply one restart adjudication. Never consults deadlines — only proof moves a lease. */
@@ -29,9 +25,6 @@ export function applyAgentSessionRestartAdjudication(args: {
     probe: args.probe,
     observedAt: args.now
   })
-  if (adjudication.disposition === 'settlement-pending') {
-    return withLease(record, { ...record.lease, unreconciled: false, lastRenewedAt: args.now })
-  }
   if (adjudication.disposition === 'free') {
     // Why: an already-free lease that reloads into `recovering` is unopenable forever; clearing
     // the stage restores it without moving the fence or touching the recorded death evidence.
@@ -39,41 +32,29 @@ export function applyAgentSessionRestartAdjudication(args: {
       ...record.lease,
       handoffStage: null,
       handoffOperationId: null,
-      processlessAt: null,
       unreconciled: false,
       lastRenewedAt: args.now
     })
   }
   if (adjudication.disposition === 'evicted') {
-    // A reservation that never proved its handle ran no turn, so no journal settlement is owed.
-    const settlementOwed = record.lease.handoffStage !== 'new-owner-proving'
+    // What the dead generation left running is settled from `deathEvidence` when the journal is
+    // next opened, so nothing about it is owed here.
     return withLease(record, {
       ...record.lease,
       runtimeFence: adjudication.nextFence,
       handoffStage: null,
       ownerProcess: null,
       reservedSpawnToken: null,
-      processlessAt: null,
       claimStatus: 'released',
       unreconciled: false,
       lastRenewedAt: args.now,
       handoffOperationId: null,
-      deathEvidence: adjudication.evidence,
-      ...(settlementOwed
-        ? {
-            settlementRetryRequired: true,
-            settlementRetryId: agentSessionRestartEvictionSettlementId(record.lease, adjudication)
-          }
-        : {})
+      deathEvidence: adjudication.evidence
     })
   }
-  const stage: AgentSessionHandoffStage =
-    adjudication.disposition === 'conflicted' ? 'manual-recovery' : adjudication.stage
   return withLease(record, {
     ...record.lease,
-    handoffStage: stage,
-    claimStatus:
-      adjudication.disposition === 'conflicted' ? 'conflicted' : record.lease.claimStatus,
+    handoffStage: adjudication.stage,
     unreconciled: false,
     lastRenewedAt: args.now
   })
diff --git a/src/main/runtime/agent-session-store-serialization.ts b/src/main/runtime/agent-session-store-serialization.ts
index cda3e44d7ff2..adc93f85c011 100644
--- a/src/main/runtime/agent-session-store-serialization.ts
+++ b/src/main/runtime/agent-session-store-serialization.ts
@@ -1,4 +1,5 @@
 import type { AgentSessionStoreState } from './agent-session-record-store-file'
+import { serializeAgentSessionTabTable } from './agent-session-tab-table'
 
 export function serializeAgentSessionStoreState(state: AgentSessionStoreState): string {
   const records: Record<string, unknown> = Object.create(null)
@@ -13,8 +14,8 @@ export function serializeAgentSessionStoreState(state: AgentSessionStoreState):
     retiredClaimKeys: state.retiredClaimKeys,
     unusableRecords: Object.fromEntries(state.unreadableRecords)
   }
-  if (state.visibleSessionIdsIndexPresent) {
-    serialized.visibleSessionIds = [...state.visibleSessionIds]
+  if (state.sessionTabs) {
+    Object.assign(serialized, serializeAgentSessionTabTable(state.sessionTabs))
   }
   return JSON.stringify(serialized)
 }
diff --git a/src/main/runtime/agent-session-store-transaction-queue.ts b/src/main/runtime/agent-session-store-transaction-queue.ts
index 08d04996d81b..1a4c78e46720 100644
--- a/src/main/runtime/agent-session-store-transaction-queue.ts
+++ b/src/main/runtime/agent-session-store-transaction-queue.ts
@@ -1,5 +1,5 @@
 import type { AgentSessionOperationRow } from '../../shared/agent-session-operation-ledger'
-import type { AgentSessionRecord } from '../../shared/agent-session-record'
+import type { AgentSessionLease, AgentSessionRecord } from '../../shared/agent-session-record'
 import { raiseAgentSessionFencesAfterBackupRecovery } from './agent-session-backup-recovery-fence'
 import {
   AGENT_SESSION_STORE_SCHEMA_VERSION,
@@ -7,16 +7,30 @@ import {
   loadAgentSessionStore,
   saveAgentSessionStore,
   type AgentSessionStoreState,
-  type LoadedAgentSessionStore,
-  backfillAgentSessionSurfaceTabIds
+  type LoadedAgentSessionStore
 } from './agent-session-record-store-file'
 import { withFileTransactionLock } from '../file-transaction-lock'
 
+/** Latch fields older builds wrote. Nothing reads them, and dropping them keeps a lease this build
+ *  writes back from carrying a stale latch to an older build after a downgrade. */
+type RetiredAgentSessionLeaseFields = {
+  processlessAt?: unknown
+  settlementRetryRequired?: unknown
+  settlementRetryId?: unknown
+}
+
 function markLoadedLeasesUnreconciled(state: AgentSessionStoreState): void {
   for (const [sessionId, record] of state.records) {
+    const lease: AgentSessionLease & RetiredAgentSessionLeaseFields = record.lease
+    const {
+      processlessAt: _processlessAt,
+      settlementRetryRequired: _settlementRetryRequired,
+      settlementRetryId: _settlementRetryId,
+      ...current
+    } = lease
     state.records.set(sessionId, {
       ...record,
-      lease: { ...record.lease, unreconciled: true }
+      lease: { ...current, unreconciled: true }
     })
   }
 }
@@ -39,16 +53,15 @@ function agentSessionStoreStateChanged(
   operations: ReadonlyMap<string, AgentSessionOperationRow>,
   retiredClaimKeys: AgentSessionStoreState['retiredClaimKeys'],
   unreadableRecords: AgentSessionStoreState['unreadableRecords'],
-  visibleSessionIds: AgentSessionStoreState['visibleSessionIds'],
-  visibleSessionIdsIndexPresent: AgentSessionStoreState['visibleSessionIdsIndexPresent']
+  sessionTabs: AgentSessionStoreState['sessionTabs']
 ): boolean {
   return (
     !mapEntriesMatch(state.records, records) ||
     !mapEntriesMatch(state.operations, operations) ||
     !mapEntriesMatch(state.unreadableRecords, unreadableRecords) ||
-    state.visibleSessionIdsIndexPresent !== visibleSessionIdsIndexPresent ||
-    state.visibleSessionIds.size !== visibleSessionIds.size ||
-    [...state.visibleSessionIds].some((id) => !visibleSessionIds.has(id)) ||
+    (state.sessionTabs && sessionTabs
+      ? !state.sessionTabs.equals(sessionTabs)
+      : state.sessionTabs !== sessionTabs) ||
     state.retiredClaimKeys.length !== retiredClaimKeys.length ||
     state.retiredClaimKeys.some((entry, index) => entry !== retiredClaimKeys[index])
   )
@@ -100,8 +113,7 @@ export class AgentSessionStoreTransactionQueue {
         const operations = new Map(this.state.operations)
         const retiredClaimKeys = [...this.state.retiredClaimKeys]
         const unreadableRecords = new Map(this.state.unreadableRecords)
-        const visibleSessionIds = new Set(this.state.visibleSessionIds)
-        const visibleSessionIdsIndexPresent = this.state.visibleSessionIdsIndexPresent
+        const sessionTabs = this.state.sessionTabs?.clone() ?? null
         try {
           // The lost commit may have granted a higher fence than the backup records show. Rather
           // than refuse forever, raise every recovered fence clear of anything that commit could
@@ -120,8 +132,7 @@ export class AgentSessionStoreTransactionQueue {
               operations,
               retiredClaimKeys,
               unreadableRecords,
-              visibleSessionIds,
-              visibleSessionIdsIndexPresent
+              sessionTabs
             )
           ) {
             return result
@@ -140,8 +151,7 @@ export class AgentSessionStoreTransactionQueue {
           this.state.operations = operations
           this.state.retiredClaimKeys = retiredClaimKeys
           this.state.unreadableRecords = unreadableRecords
-          this.state.visibleSessionIds = visibleSessionIds
-          this.state.visibleSessionIdsIndexPresent = visibleSessionIdsIndexPresent
+          this.state.sessionTabs = sessionTabs
           throw error
         }
       })
@@ -170,11 +180,6 @@ export class AgentSessionStoreTransactionQueue {
       throw new Error('agent_session_legacy_required')
     }
     markLoadedLeasesUnreconciled(loaded.state)
-    // Why: a reload replaces the state wholesale, so the ids filled at open would vanish from
-    // memory until the next open; refilling keeps every in-memory record carrying one. It does
-    // not force a save: a reload marks every lease unadjudicated, and this instance must not
-    // persist that verdict on the strength of a refill.
-    backfillAgentSessionSurfaceTabIds(loaded.state)
     this.state = loaded.state
     this.diskRevision = diskRevision
     this.needsRewrite = loaded.needsRewrite
diff --git a/src/main/runtime/agent-session-surface-release-transition.ts b/src/main/runtime/agent-session-surface-release-transition.ts
index a6c90d1e01fa..7da1e7633eff 100644
--- a/src/main/runtime/agent-session-surface-release-transition.ts
+++ b/src/main/runtime/agent-session-surface-release-transition.ts
@@ -5,9 +5,10 @@
 // lease-owning provider root through the adapter. Its observed exit is sufficient because the
 // lease follows that root, even when descendants remain `unverifiable`.
 //
-// The fence still moves. A released lease at the old fence would let a mutation a client queued
-// against the dead generation land on the next one.
+// The fence still moves, so the next owner is a new generation: an attach or settlement still
+// holding the stopped owner's fence is refused as stale rather than acting on its successor.
 
+import { agentSessionRefusalError } from '../../shared/agent-session-wire-refusals'
 import type { AgentSessionRecord } from '../../shared/agent-session-record'
 import { nextAgentSessionFence } from '../../shared/agent-session-next-fence'
 import { assertFence, withLease } from './agent-session-lease-transitions'
@@ -31,27 +32,25 @@ export function releaseAgentSessionOwnerAfterSurfaceClose(args: {
   now: number
   /** Exit receipt can precede a delayed journal settlement and lease release. */
   exitObservedAt?: number
-  settlementRetry?: { settlementId: string; detail: string }
+  /** Why the provider exited, when the host saw it die on its own. */
+  exitReason?: string
 }): AgentSessionRecord {
   const { record } = args
   assertFence(record.lease, args.expectedFence)
   if (!isSurfaceReleasableAgentSessionRecord(record)) {
-    throw new Error('agent_session_ownership_unknown')
+    throw agentSessionRefusalError('agent_session_ownership_unknown', { reason: 'leaseMoved' })
   }
   return withLease(record, {
     ...record.lease,
     runtimeFence: nextAgentSessionFence(record.lease),
     ownerProcess: null,
     reservedSpawnToken: null,
-    processlessAt: null,
     claimStatus: 'released',
-    handoffStage: args.settlementRetry ? 'recovering' : null,
-    settlementRetryRequired: args.settlementRetry ? true : undefined,
-    settlementRetryId: args.settlementRetry?.settlementId,
+    handoffStage: null,
     lastRenewedAt: args.now,
     deathEvidence: {
       kind: 'exit-observed',
-      detail: args.settlementRetry?.detail ?? 'the last surface holding this session released it',
+      detail: args.exitReason ?? 'the last surface holding this session released it',
       observedAt: args.exitObservedAt ?? args.now
     }
   })
@@ -65,7 +64,7 @@ export function releaseStoredAgentSessionOwnerAfterSurfaceClose(
     expectedFence: number
     now: number
     exitObservedAt?: number
-    settlementRetry?: { settlementId: string; detail: string }
+    exitReason?: string
   }
 ): Promise<AgentSessionRecord> {
   return store.transitionHandoff(args.sessionId, (record) =>
diff --git a/src/main/runtime/agent-session-tab-table.ts b/src/main/runtime/agent-session-tab-table.ts
new file mode 100644
index 000000000000..6022aac8bf2b
--- /dev/null
+++ b/src/main/runtime/agent-session-tab-table.ts
@@ -0,0 +1,259 @@
+import { isAgentSessionId, type AgentSessionRecord } from '../../shared/agent-session-record'
+import { agentSessionRefusalError } from '../../shared/agent-session-wire-refusals'
+import { isAgentSessionSurfaceTabId } from '../../shared/agent-session-surface-tab-id'
+import { structuredAgentSessionTabId } from '../../shared/structured-agent-session-projection'
+import type { AgentSessionStoreState } from './agent-session-record-store-file'
+
+/**
+ * Which conversation each structured chat tab shows, keyed by the host tab id.
+ *
+ * Membership is visibility: a session with an entry has a chat tab, and the key is that tab's id.
+ * A /clear moves the tab to the replacement conversation rather than copying its id, so an id names
+ * one conversation by construction and a session maps back to at most one tab.
+ */
+export class AgentSessionTabTable {
+  private readonly sessionByTab = new Map<string, string>()
+  private readonly tabBySession = new Map<string, string>()
+
+  constructor(entries: Iterable<readonly [tabId: string, sessionId: string]> = []) {
+    for (const [tabId, sessionId] of entries) {
+      this.put(tabId, sessionId)
+    }
+  }
+
+  tabIdFor(sessionId: string): string | undefined {
+    return this.tabBySession.get(sessionId)
+  }
+
+  sessionIdFor(tabId: string): string | undefined {
+    return this.sessionByTab.get(tabId)
+  }
+
+  /** Sessions that have a tab, in the order their tabs were given out. */
+  sessionIds(): string[] {
+    return [...this.sessionByTab.values()]
+  }
+
+  entries(): [tabId: string, sessionId: string][] {
+    return [...this.sessionByTab.entries()]
+  }
+
+  /**
+   * Gives a session a tab unless it already has one. Without a reserved id it gets the id clients
+   * derive for it, unless a cleared conversation's tab kept that id.
+   */
+  show(sessionId: string, tabId?: string): void {
+    if (this.tabBySession.has(sessionId)) {
+      return
+    }
+    const derived = structuredAgentSessionTabId(sessionId)
+    const held = (candidate: string): boolean => this.sessionByTab.has(candidate)
+    this.put(tabId ?? (held(derived) ? reopenedTabId(sessionId, held) : derived), sessionId)
+  }
+
+  /** Returns the id the session's tab had, if it had one. */
+  hide(sessionId: string): string | undefined {
+    const tabId = this.tabBySession.get(sessionId)
+    if (tabId !== undefined) {
+      this.tabBySession.delete(sessionId)
+      this.sessionByTab.delete(tabId)
+    }
+    return tabId
+  }
+
+  /** A /clear: the tab that showed `fromSessionId` shows `toSessionId`, keeping its id and place. */
+  move(fromSessionId: string, toSessionId: string): void {
+    const tabId = this.tabBySession.get(fromSessionId)
+    this.hide(toSessionId)
+    if (tabId === undefined) {
+      this.show(toSessionId)
+      return
+    }
+    this.tabBySession.delete(fromSessionId)
+    this.sessionByTab.set(tabId, toSessionId)
+    this.tabBySession.set(toSessionId, tabId)
+  }
+
+  clone(): AgentSessionTabTable {
+    return new AgentSessionTabTable(this.sessionByTab)
+  }
+
+  equals(other: AgentSessionTabTable): boolean {
+    const left = this.entries()
+    const right = other.entries()
+    return (
+      left.length === right.length &&
+      left.every(([tabId, sessionId], index) => {
+        const [otherTabId, otherSessionId] = right[index]
+        return tabId === otherTabId && sessionId === otherSessionId
+      })
+    )
+  }
+
+  private put(tabId: string, sessionId: string): void {
+    const owner = this.sessionByTab.get(tabId)
+    if (owner !== undefined && owner !== sessionId) {
+      throw agentSessionRefusalError('agent_session_conflict', { reason: 'tabIdTaken' })
+    }
+    this.hide(sessionId)
+    this.sessionByTab.set(tabId, sessionId)
+    this.tabBySession.set(sessionId, tabId)
+  }
+}
+
+/**
+ * The id a cleared conversation reopened from history takes while the tab now showing its
+ * replacement holds its own. Deterministic, so a table seeded again gives it the same id.
+ */
+function reopenedTabId(sessionId: string, held: (tabId: string) => boolean): string {
+  const base = `${structuredAgentSessionTabId(sessionId)}-reopened`
+  let tabId = base
+  for (let suffix = 2; held(tabId); suffix++) {
+    tabId = `${base}-${suffix}`
+  }
+  return tabId
+}
+
+export function setAgentSessionTabVisibility(
+  state: AgentSessionStoreState,
+  sessionId: string,
+  visible: boolean,
+  tabId?: string
+): void {
+  if (visible && !state.records.has(sessionId)) {
+    throw agentSessionRefusalError('agent_session_identity_required', { reason: 'recordMissing' })
+  }
+  state.sessionTabs ??= new AgentSessionTabTable()
+  if (visible) {
+    state.sessionTabs.show(sessionId, tabId)
+  } else {
+    state.sessionTabs.hide(sessionId)
+  }
+}
+
+export type PersistedAgentSessionTab = { tabId: string; sessionId: string }
+
+export function serializeAgentSessionTabTable(table: AgentSessionTabTable): {
+  sessionTabs: PersistedAgentSessionTab[]
+  visibleSessionIds: string[]
+} {
+  return {
+    sessionTabs: table.entries().map(([tabId, sessionId]) => ({ tabId, sessionId })),
+    // Written for older builds, which restore tabs from this list; never read beside the table.
+    visibleSessionIds: table.sessionIds()
+  }
+}
+
+/**
+ * Reads the persisted table, or seeds it from what older builds wrote: the visible session list and,
+ * for a chat created by a build that recorded one, the tab id on its record. That record field is
+ * read here and nowhere else, and only when the file carries no table.
+ *
+ * Deterministic on purpose: a parsed store must hash the same on every read of the same bytes.
+ */
+export function parseAgentSessionTabTable(
+  file: { sessionTabs?: unknown; visibleSessionIds?: unknown },
+  records: ReadonlyMap<string, AgentSessionRecord>,
+  strict: boolean
+): { valid: boolean; table: AgentSessionTabTable | null } {
+  if (file.sessionTabs !== undefined) {
+    return parsePersistedTabs(file.sessionTabs, strict)
+  }
+  if (file.visibleSessionIds === undefined) {
+    return { valid: true, table: null }
+  }
+  if (!Array.isArray(file.visibleSessionIds)) {
+    return { valid: !strict, table: null }
+  }
+  return { valid: true, table: seedFromVisibleSessions(file.visibleSessionIds, records) }
+}
+
+/**
+ * A cleared chat's tab was opened for the first conversation of its /clear chain and kept that id
+ * through every clear, so the chat now showing the chain's latest conversation seeds under the
+ * first one's id, as a /clear on this build would have left it. Those chats seed first: a cleared
+ * conversation reopened from history is the later tab, and takes a fresh id if its own is held.
+ */
+function seedFromVisibleSessions(
+  visible: readonly unknown[],
+  records: ReadonlyMap<string, AgentSessionRecord>
+): AgentSessionTabTable {
+  const sessionIds = [...new Set(visible.filter(isAgentSessionId))]
+  const clearedFrom = new Map<string, string>()
+  for (const record of records.values()) {
+    const command = record.conversationCommand
+    if (
+      command?.command === 'clear' &&
+      command.phase === 'committed' &&
+      command.replacementSessionId &&
+      !clearedFrom.has(command.replacementSessionId)
+    ) {
+      clearedFrom.set(command.replacementSessionId, record.sessionId)
+    }
+  }
+  const clearedTo = new Set(clearedFrom.values())
+  const chainRoot = (sessionId: string): string => {
+    const seen = new Set([sessionId])
+    let current = sessionId
+    let prior = clearedFrom.get(current)
+    while (prior !== undefined && !seen.has(prior)) {
+      seen.add(prior)
+      current = prior
+      prior = clearedFrom.get(current)
+    }
+    return current
+  }
+  const recordedOrDerived = (sessionId: string): string[] => {
+    const record = records.get(sessionId)
+    const recorded = record && 'surfaceTabId' in record ? record.surfaceTabId : undefined
+    return [recorded, structuredAgentSessionTabId(sessionId)].filter(isAgentSessionSurfaceTabId)
+  }
+  const tabIds = new Map<string, string>()
+  const taken = new Set<string>()
+  const held = (tabId: string): boolean => taken.has(tabId)
+  const assign = (sessionId: string, candidates: readonly string[]): void => {
+    const tabId = candidates.find((candidate) => !held(candidate)) ?? reopenedTabId(sessionId, held)
+    taken.add(tabId)
+    tabIds.set(sessionId, tabId)
+  }
+  const holdsChainTab = (sessionId: string): boolean =>
+    !clearedTo.has(sessionId) && chainRoot(sessionId) !== sessionId
+  for (const sessionId of sessionIds.filter(holdsChainTab)) {
+    assign(sessionId, [...recordedOrDerived(chainRoot(sessionId)), ...recordedOrDerived(sessionId)])
+  }
+  for (const sessionId of sessionIds.filter((sessionId) => !holdsChainTab(sessionId))) {
+    assign(sessionId, recordedOrDerived(sessionId))
+  }
+  // In the visible list's order, which is the order older builds restored tabs in.
+  return new AgentSessionTabTable(
+    sessionIds.flatMap((sessionId) => {
+      const tabId = tabIds.get(sessionId)
+      return tabId === undefined ? [] : [[tabId, sessionId] as const]
+    })
+  )
+}
+
+function parsePersistedTabs(
+  raw: unknown,
+  strict: boolean
+): { valid: boolean; table: AgentSessionTabTable | null } {
+  if (!Array.isArray(raw)) {
+    return { valid: !strict, table: null }
+  }
+  const table = new AgentSessionTabTable()
+  for (const entry of raw) {
+    const tabId: unknown = entry?.tabId
+    const sessionId: unknown = entry?.sessionId
+    const wellFormed =
+      isAgentSessionSurfaceTabId(tabId) &&
+      isAgentSessionId(sessionId) &&
+      table.sessionIdFor(tabId) === undefined &&
+      table.tabIdFor(sessionId) === undefined
+    if (wellFormed) {
+      table.show(sessionId, tabId)
+    } else if (strict) {
+      return { valid: false, table: null }
+    }
+  }
+  return { valid: true, table }
+}
diff --git a/src/main/runtime/agent-session-visible-tab-index.ts b/src/main/runtime/agent-session-visible-tab-index.ts
deleted file mode 100644
index e0f7b9b4c5c8..000000000000
--- a/src/main/runtime/agent-session-visible-tab-index.ts
+++ /dev/null
@@ -1,38 +0,0 @@
-import type { AgentSessionStoreState } from './agent-session-record-store-file'
-export function parseVisibleSessionIds(
-  raw: unknown,
-  schemaVersion: number,
-  currentSchemaVersion: number
-): { ids: string[]; present: boolean; valid: boolean } {
-  if (raw === undefined) {
-    return { ids: [], present: false, valid: true }
-  }
-  if (!Array.isArray(raw)) {
-    return { ids: [], present: false, valid: schemaVersion !== currentSchemaVersion }
-  }
-  const ids: string[] = []
-  for (const value of raw) {
-    if (typeof value === 'string' && value.length > 0) {
-      ids.push(value)
-    } else if (schemaVersion === currentSchemaVersion) {
-      return { ids: [], present: true, valid: false }
-    }
-  }
-  return { ids, present: true, valid: true }
-}
-
-export function setVisibleSessionId(
-  state: AgentSessionStoreState,
-  sessionId: string,
-  visible: boolean
-): void {
-  if (visible) {
-    if (!state.records.has(sessionId)) {
-      throw new Error('agent_session_identity_required')
-    }
-    state.visibleSessionIds.add(sessionId)
-  } else {
-    state.visibleSessionIds.delete(sessionId)
-  }
-  state.visibleSessionIdsIndexPresent = true
-}
diff --git a/src/main/runtime/agent-transcript-pane-test-harness.ts b/src/main/runtime/agent-transcript-pane-test-harness.ts
index 5f0c20267d99..14ad56a8d9dd 100644
--- a/src/main/runtime/agent-transcript-pane-test-harness.ts
+++ b/src/main/runtime/agent-transcript-pane-test-harness.ts
@@ -18,6 +18,8 @@ export type TranscriptPaneOptions = {
   /** Simulates a PTY controller whose foreground probe never settles. */
   foregroundProbeHangs?: boolean
   onForegroundProbe?: () => void
+  /** PTY grid the controller reports; the runtime's emulator otherwise defaults to 80x24. */
+  size?: { cols: number; rows: number }
 }
 
 export async function createTranscriptPane(
@@ -39,6 +41,7 @@ export async function createTranscriptPane(
     spawn: vi.fn().mockResolvedValue({ id: TRANSCRIPT_PANE_PTY_ID, incarnationId: 'inc-1' }),
     write: () => true,
     kill: () => true,
+    getSize: () => options.size ?? null,
     getForegroundProcess: (): Promise<string | null> => {
       options.onForegroundProbe?.()
       return options.foregroundProbeHangs === true
diff --git a/src/main/runtime/automation-change-publication.test.ts b/src/main/runtime/automation-change-publication.test.ts
index 5cde275d5eaf..a63d56efb9b0 100644
--- a/src/main/runtime/automation-change-publication.test.ts
+++ b/src/main/runtime/automation-change-publication.test.ts
@@ -1,3 +1,4 @@
+import { closeTestStores, createSqliteTestStore } from '../persistence-test-harness'
 /**
  * A definition change must name the host it affected, and a change that moves a
  * record between hosts must name both — a subscriber that never hears about the
@@ -106,7 +107,7 @@ async function makeRuntime() {
   vi.resetModules()
   const { Store, initDataPath } = await import('../persistence')
   initDataPath()
-  const store = new Store()
+  const store = createSqliteTestStore(Store, { dataFile: join(testState.dir, 'orca-data.json') })
   const { OrcaRuntimeService } = await import('./orca-runtime')
   const runtime = new OrcaRuntimeService(store as never)
   const published: AutomationsChangedPayload[] = []
@@ -127,14 +128,42 @@ beforeEach(() => {
   })
 })
 
-afterEach(() => {
+afterEach(async () => {
+  await closeTestStores()
   rmSync(testState.dir, { recursive: true, force: true })
 })
 
 describe('scoped automationsChanged publication', () => {
+  it.each(['update', 'delete'] as const)(
+    'waits for durable %s before publishing success',
+    async (operation) => {
+      const { store, runtime, published } = await makeRuntime()
+      const gate = Promise.withResolvers<void>()
+      vi.spyOn(store, 'flushPendingOrThrowAsync').mockReturnValue(gate.promise)
+      const pending =
+        operation === 'update'
+          ? runtime.updateAutomation('local-1', { name: 'Changed' })
+          : runtime.deleteAutomation('local-1')
+      await vi.waitFor(() => expect(store.flushPendingOrThrowAsync).toHaveBeenCalledOnce())
+      expect(published).toEqual([])
+      gate.resolve()
+      await pending
+      expect(published).toHaveLength(1)
+    }
+  )
+
+  it('rejects a failed durable definition write without publishing success', async () => {
+    const { store, runtime, published } = await makeRuntime()
+    vi.spyOn(store, 'flushPendingOrThrowAsync').mockRejectedValue(new Error('disk full'))
+    await expect(runtime.updateAutomation('local-1', { name: 'Changed' })).rejects.toThrow(
+      'disk full'
+    )
+    expect(published).toEqual([])
+  })
+
   it('names the host a delete removed a row from', async () => {
     const { runtime, published } = await makeRuntime()
-    runtime.deleteAutomation('ssh-1-a', {
+    await runtime.deleteAutomation('ssh-1-a', {
       selector: { kind: 'ssh', targetId: 'ssh-1', targetGeneration: 7 }
     })
     expect(published).toEqual([
@@ -144,7 +173,7 @@ describe('scoped automationsChanged publication', () => {
 
   it('names the orphan bucket when an unowned row is deleted', async () => {
     const { runtime, published } = await makeRuntime()
-    runtime.deleteAutomation('orphan-1', { selector: { kind: 'orphan' } })
+    await runtime.deleteAutomation('orphan-1', { selector: { kind: 'orphan' } })
     expect(published).toEqual([{ reason: 'definition', selector: { kind: 'orphan' } }])
   })
 
diff --git a/src/main/runtime/claude-agent-teams-tmux-dispatcher.ts b/src/main/runtime/claude-agent-teams-tmux-dispatcher.ts
index a9a3b4484a81..eb4acb14d5e2 100644
--- a/src/main/runtime/claude-agent-teams-tmux-dispatcher.ts
+++ b/src/main/runtime/claude-agent-teams-tmux-dispatcher.ts
@@ -226,7 +226,7 @@ export class ClaudeAgentTeamsTmuxDispatcher {
     const pane = this.resolvePane(team, tmuxValue(parsed, '-t') ?? envPane)
     const text = tmuxSendKeysText(parsed.positional, parsed.flags.has('-l'))
     if (text) {
-      await api.sendTerminal(pane.handle, { text })
+      await api.sendTerminal(pane.handle, { text }, { inputKind: 'driving' })
     }
     return ''
   }
diff --git a/src/main/runtime/claude-agent-teams-types.ts b/src/main/runtime/claude-agent-teams-types.ts
index 10234f5226da..bddfad17d171 100644
--- a/src/main/runtime/claude-agent-teams-types.ts
+++ b/src/main/runtime/claude-agent-teams-types.ts
@@ -6,6 +6,7 @@ import type {
   RuntimeTerminalShow,
   RuntimeTerminalSplit
 } from '../../shared/runtime-types'
+import type { TerminalInputKind } from '../../shared/terminal-input-kind'
 
 export type AgentTeamsTmuxCompatRequest = {
   teamId: string
@@ -43,7 +44,8 @@ export type AgentTeamsTerminalApi = {
   readTerminal(handle: string, opts?: { limit?: number }): Promise<RuntimeTerminalRead>
   sendTerminal(
     handle: string,
-    action: { text?: string; enter?: boolean; interrupt?: boolean }
+    action: { text?: string; enter?: boolean; interrupt?: boolean },
+    options: { inputKind: TerminalInputKind }
   ): Promise<RuntimeTerminalSend>
   focusTerminal(handle: string): Promise<RuntimeTerminalFocus>
   closeTerminal(handle: string): Promise<RuntimeTerminalClose>
diff --git a/src/main/runtime/claude-structured-exit-mid-response.test.ts b/src/main/runtime/claude-structured-exit-mid-response.test.ts
new file mode 100644
index 000000000000..fd30df7dad0e
--- /dev/null
+++ b/src/main/runtime/claude-structured-exit-mid-response.test.ts
@@ -0,0 +1,72 @@
+// A Claude CLI that exits on its own after its start landed, with a message handed to it: the chat
+// says Claude stopped, by name. Against the production runtime, adapter, record store and host,
+// with only the CLI process scripted.
+
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { computeAgentSessionPayloadFingerprint } from '../../shared/agent-session-mutation-envelope'
+import { hostTestMessage } from '../native-chat/agent-session-wire/structured-agent-session-host-test-data'
+import type { StructuredAgentSessionHost } from '../native-chat/agent-session-wire/structured-agent-session-host'
+import { waitForStructuredAgentSessionRecovery } from './structured-agent-session-runtime'
+import {
+  createScriptedClaudeRuntime,
+  scriptedClaudeExitError
+} from './structured-claude-scripted-runtime-test-support'
+
+const SESSION = 'claude-exit-mid-response'
+const CALLER = { callerKey: 'client-1' }
+
+let claude = createScriptedClaudeRuntime([SESSION])
+let operations = 0
+
+afterEach(async () => {
+  vi.restoreAllMocks()
+  await claude.dispose()
+  claude = createScriptedClaudeRuntime([SESSION])
+})
+
+async function send(host: StructuredAgentSessionHost, text: string): Promise<void> {
+  const body = hostTestMessage(text)
+  const sent = await host.send(CALLER, {
+    envelope: {
+      sessionId: SESSION,
+      clientOperationId: `${Date.now()}-${(++operations).toString(16).padStart(32, '0')}`,
+      expectedRuntimeFence: host.deps.store.getRecord(SESSION)?.lease.runtimeFence ?? 0,
+      payloadFingerprint: computeAgentSessionPayloadFingerprint({
+        method: 'agentSession.send',
+        sessionId: SESSION,
+        fields: { body }
+      })
+    },
+    body
+  })
+  expect(sent, JSON.stringify(sent)).toMatchObject({ ok: true })
+}
+
+describe('a started Claude CLI that exits while a response is in progress', () => {
+  it('says Claude stopped, and that the conversation can continue', async () => {
+    const host = await claude.install()
+    await expect(host.attach(CALLER, claude.attachParams(SESSION, null))).resolves.toMatchObject({
+      ok: true
+    })
+    await send(host, 'hello')
+    await vi.waitFor(() => expect(claude.child(SESSION).calls).toContain('send'))
+
+    claude.child(SESSION).exit(scriptedClaudeExitError('claude stream-json exited (code 137)'))
+    await waitForStructuredAgentSessionRecovery()
+
+    await vi.waitFor(async () =>
+      expect(
+        (await host.journalSnapshot(SESSION)).items.flatMap((item) =>
+          item.body.kind === 'status' && item.body.failure
+            ? [{ text: item.body.text, kind: item.body.failure.kind }]
+            : []
+        )
+      ).toEqual([
+        {
+          text: 'Claude stopped while this response was in progress. You can continue in this conversation.',
+          kind: 'providerExited'
+        }
+      ])
+    )
+  })
+})
diff --git a/src/main/runtime/claude-structured-failed-start-resume.test.ts b/src/main/runtime/claude-structured-failed-start-resume.test.ts
index 32362cbafdce..cd4f44d59f8a 100644
--- a/src/main/runtime/claude-structured-failed-start-resume.test.ts
+++ b/src/main/runtime/claude-structured-failed-start-resume.test.ts
@@ -55,7 +55,7 @@ describe('a Claude chat whose CLI exits the moment it is spawned', () => {
   // Before the spawn returns, the start time of a dead pid is unreadable; during that read, the
   // child is found closed afterwards. Both must answer with what the CLI said.
   it.each(['spawn', 'start-time-read'] as const)(
-    "refuses the create with the CLI's own diagnostic when it exits at %s",
+    "refuses the create in a sentence, not the CLI's diagnostic, when it exits at %s",
     async (at) => {
       const diagnostic = 'claude stream-json exited (code 1): claude: not signed in'
       claude.behave(SESSION, { exitsDuringSpawn: { diagnostic, at } })
@@ -65,7 +65,10 @@ describe('a Claude chat whose CLI exits the moment it is spawned', () => {
 
       expect(created).toMatchObject({
         ok: false,
-        refusal: { message: expect.stringContaining('not signed in'), ownerVerdict: 'exited' }
+        refusal: {
+          message: 'Claude stopped before it finished starting. Send your message to try again.',
+          ownerVerdict: 'exited'
+        }
       })
     }
   )
diff --git a/src/main/runtime/claude-structured-resumed-start-failure.test.ts b/src/main/runtime/claude-structured-resumed-start-failure.test.ts
index 8fcef7e4a48b..7a0c66e1b85c 100644
--- a/src/main/runtime/claude-structured-resumed-start-failure.test.ts
+++ b/src/main/runtime/claude-structured-resumed-start-failure.test.ts
@@ -7,11 +7,15 @@ import { computeAgentSessionPayloadFingerprint } from '../../shared/agent-sessio
 import type { AgentSessionSubscribeEvent } from '../../shared/agent-session-wire'
 import { hostTestMessage } from '../native-chat/agent-session-wire/structured-agent-session-host-test-data'
 import { waitForStructuredAgentSessionRecovery } from './structured-agent-session-runtime'
-import { createScriptedClaudeRuntime } from './structured-claude-scripted-runtime-test-support'
+import {
+  createScriptedClaudeRuntime,
+  scriptedClaudeExitError
+} from './structured-claude-scripted-runtime-test-support'
 
 const SESSION = 'claude-resumed-start'
 const CALLER = { callerKey: 'client-1' }
 const DIAGNOSTIC = 'claude stream-json exited (code 1): claude: not signed in'
+const STARTUP_TEXT = 'Claude stopped before it finished starting. Send your message to try again.'
 
 let claude = createScriptedClaudeRuntime([SESSION])
 
@@ -38,11 +42,11 @@ describe('a reopened Claude chat whose CLI dies before initialize', () => {
     await waitForStructuredAgentSessionRecovery()
     await host.close(SESSION)
 
-    // The user reopens it; this time the CLI never answers, then dies, and its tree is unprovable.
+    // The user reopens it and sends; this time the CLI never answers, then dies, and its tree is
+    // unprovable. Opening starts nothing: the send does.
     claude.behave(SESSION, { initHangs: true, closeUnproven: true })
-    await host.hold(SESSION, 'surface-1')
     const events: AgentSessionSubscribeEvent[] = []
-    host.subscribe({ id: 'sub-1', sessionId: SESSION, emit: (event) => events.push(event) })
+    await host.subscribe({ id: 'sub-1', sessionId: SESSION, emit: (event) => events.push(event) })
     const body = hostTestMessage('hello')
     const fence = host.deps.store.getRecord(SESSION)?.lease.runtimeFence ?? 0
     const sent = await host.send(CALLER, {
@@ -59,21 +63,22 @@ describe('a reopened Claude chat whose CLI dies before initialize', () => {
       body
     })
     expect(sent).toMatchObject({ ok: true, value: { submission: { dispatchState: 'pending' } } })
+    // Accepted first; the delivery loop starts the second child after.
+    await vi.waitFor(() => expect(claude.children(SESSION)).toHaveLength(2))
 
-    claude.child(SESSION).exit(new Error(DIAGNOSTIC))
+    claude.child(SESSION).exit(scriptedClaudeExitError(DIAGNOSTIC))
     await waitForStructuredAgentSessionRecovery()
 
-    await vi.waitFor(() =>
-      expect(statusTexts(events)).toContainEqual(
-        expect.stringMatching(/stopped before it finished starting: .*not signed in/)
-      )
-    )
+    await vi.waitFor(() => expect(statusTexts(events)).toContainEqual(STARTUP_TEXT))
     // Never written, so it did not happen: refused, not left in doubt.
-    const submission = host
-      .journalSnapshot(SESSION)
-      .submissions.find(
-        (entry) => entry.clientMessageId === (sent.ok && sent.value.clientMessageId)
-      )
-    expect(submission).toMatchObject({ dispatchState: 'rejected' })
+    const submission = (await host.journalSnapshot(SESSION)).submissions.find(
+      (entry) => entry.clientMessageId === (sent.ok && sent.value.clientMessageId)
+    )
+    // The stderr the exit carried is beside the sentence, as a log detail, and never in it.
+    expect(submission).toMatchObject({
+      dispatchState: 'rejected',
+      reason: STARTUP_TEXT,
+      rejection: { kind: 'providerStartFailed', detail: { text: DIAGNOSTIC, audience: 'log' } }
+    })
   })
 })
diff --git a/src/main/runtime/claude-structured-send-held-for-startup.test.ts b/src/main/runtime/claude-structured-send-held-for-startup.test.ts
index 19e058110553..efb8d3cde16a 100644
--- a/src/main/runtime/claude-structured-send-held-for-startup.test.ts
+++ b/src/main/runtime/claude-structured-send-held-for-startup.test.ts
@@ -1,8 +1,8 @@
 // A Claude chat is published the moment its child spawns, before the CLI has answered initialize.
-// A send in that window — into a fresh start, or into the restart a send itself asked for after
-// a start that failed — is admitted and held until the child proves its start. When the CLI dies
-// first, the held message is rejected with the CLI's own diagnostic, the chat shows the cause
-// once, and nothing is left as a delivery nobody can confirm. Against the production runtime,
+// A send in that window — into a fresh start, or into the restart the delivery loop makes for a
+// send after a start that failed — is accepted and stays queued until the child proves its start.
+// When the CLI dies first, the queued message is rejected with the CLI's own diagnostic, the chat
+// shows the cause once, and nothing is left as a delivery nobody can confirm. Against the production runtime,
 // adapter, record store and host, with only the CLI process scripted.
 
 import { afterEach, describe, expect, it, vi } from 'vitest'
@@ -10,11 +10,15 @@ import { computeAgentSessionPayloadFingerprint } from '../../shared/agent-sessio
 import { hostTestMessage } from '../native-chat/agent-session-wire/structured-agent-session-host-test-data'
 import type { StructuredAgentSessionHost } from '../native-chat/agent-session-wire/structured-agent-session-host'
 import { waitForStructuredAgentSessionRecovery } from './structured-agent-session-runtime'
-import { createScriptedClaudeRuntime } from './structured-claude-scripted-runtime-test-support'
+import {
+  createScriptedClaudeRuntime,
+  scriptedClaudeExitError
+} from './structured-claude-scripted-runtime-test-support'
 
 const SESSION = 'claude-send-held'
 const CALLER = { callerKey: 'client-1' }
 const DIAGNOSTIC = 'claude stream-json exited (code 1): claude: not signed in (rig)'
+const STARTUP_TEXT = 'Claude stopped before it finished starting. Send your message to try again.'
 
 let claude = createScriptedClaudeRuntime([SESSION])
 let operations = 0
@@ -39,7 +43,7 @@ async function send(host: StructuredAgentSessionHost, text: string): Promise<str
     },
     body
   })
-  // Admitted and held for the start, never refused: the message shows as sent.
+  // Accepted and queued for the start, never refused: the message shows as sent.
   expect(sent, JSON.stringify(sent)).toMatchObject({
     ok: true,
     replayed: false,
@@ -52,22 +56,22 @@ function fence(host: StructuredAgentSessionHost): number {
   return host.deps.store.getRecord(SESSION)?.lease.runtimeFence ?? 0
 }
 
-function statusRows(host: StructuredAgentSessionHost): string[] {
-  return host
-    .journalSnapshot(SESSION)
-    .items.flatMap((item) => (item.body.kind === 'status' ? [item.body.text] : []))
+async function statusRows(host: StructuredAgentSessionHost): Promise<string[]> {
+  return (await host.journalSnapshot(SESSION)).items.flatMap((item) =>
+    item.body.kind === 'status' ? [item.body.text] : []
+  )
 }
 
-function submission(host: StructuredAgentSessionHost, clientMessageId: string) {
-  return host
-    .journalSnapshot(SESSION)
-    .submissions.find((entry) => entry.clientMessageId === clientMessageId)
+async function submission(host: StructuredAgentSessionHost, clientMessageId: string) {
+  return (await host.journalSnapshot(SESSION)).submissions.find(
+    (entry) => entry.clientMessageId === clientMessageId
+  )
 }
 
 /** The CLI keeps dying at startup: the latest child exits with the diagnostic once it exists. */
 async function failLatestStart(host: StructuredAgentSessionHost, count: number): Promise<void> {
   await vi.waitFor(() => expect(claude.children(SESSION)).toHaveLength(count))
-  claude.child(SESSION).exit(new Error(DIAGNOSTIC))
+  claude.child(SESSION).exit(scriptedClaudeExitError(DIAGNOSTIC))
   await waitForStructuredAgentSessionRecovery()
   await vi.waitFor(() =>
     expect(host.deps.store.getRecord(SESSION)?.lease.claimStatus).toBe('released')
@@ -82,27 +86,28 @@ describe('a send into a Claude chat whose CLI keeps failing at startup', () => {
       ok: true
     })
     await failLatestStart(host, 1)
-    expect(statusRows(host)).toEqual([expect.stringContaining('not signed in')])
+    expect(await statusRows(host)).toEqual([STARTUP_TEXT])
     const releasedFence = fence(host)
 
-    // The send asks for the child back and is held for its start; the CLI dies again first.
+    // The delivery loop asks for the child back and the message waits for its start; the CLI
+    // dies again first.
     const held = await send(host, 'hello?')
-    expect(claude.children(SESSION)).toHaveLength(2)
-    expect(host.deps.store.getRecord(SESSION)?.lease.claimStatus).toBe('live')
+    await vi.waitFor(() => expect(claude.children(SESSION)).toHaveLength(2))
+    await vi.waitFor(() =>
+      expect(host.deps.store.getRecord(SESSION)?.lease.claimStatus).toBe('live')
+    )
     await failLatestStart(host, 2)
 
     // Rejected with the cause, not left in doubt; one row for this attempt names it.
-    await vi.waitFor(() =>
-      expect(submission(host, held)).toMatchObject({
+    await vi.waitFor(async () =>
+      expect(await submission(host, held)).toMatchObject({
         dispatchState: 'rejected',
         // Worded for the user: the red line under the composer shows it as it stands.
-        reason: `The provider stopped before it finished starting: ${DIAGNOSTIC}.`
+        reason: STARTUP_TEXT,
+        rejection: { kind: 'providerStartFailed' }
       })
     )
-    expect(statusRows(host)).toEqual([
-      expect.stringContaining('not signed in'),
-      expect.stringMatching(/stopped before it finished starting: .*not signed in \(rig\)/)
-    ])
+    expect(await statusRows(host)).toEqual([STARTUP_TEXT, STARTUP_TEXT])
     // The restart moved the fence twice: its acquisition, and the exit that released it.
     expect(fence(host)).toBe(releasedFence + 2)
     expect(claude.children(SESSION)).toHaveLength(2)
@@ -111,18 +116,18 @@ describe('a send into a Claude chat whose CLI keeps failing at startup', () => {
     // The user signs in and retries: one restart, proven, written to the CLI.
     claude.behave(SESSION, {})
     await send(host, 'hello again')
-    expect(claude.children(SESSION)).toHaveLength(3)
-    expect(fence(host)).toBe(releasedFence + 3)
+    await vi.waitFor(() => expect(claude.children(SESSION)).toHaveLength(3))
+    await vi.waitFor(() => expect(fence(host)).toBe(releasedFence + 3))
     await vi.waitFor(() => expect(claude.child(SESSION).calls).toContain('send'))
     await vi.waitFor(() =>
       expect(host.deps.store.getRecord(SESSION)?.lease.claimStatus).toBe('live')
     )
-    expect(statusRows(host)).toHaveLength(2)
+    expect(await statusRows(host)).toHaveLength(2)
   })
 })
 
 describe('a send while the first Claude start is still answering initialize', () => {
-  it('is held, and written once the CLI proves its start', async () => {
+  it('is queued, and written once the CLI proves its start', async () => {
     claude.behave(SESSION, { initHangs: true })
     const host = await claude.install()
     await host.attach(CALLER, claude.attachParams(SESSION, null))
@@ -130,12 +135,12 @@ describe('a send while the first Claude start is still answering initialize', ()
     await send(host, 'hello')
     expect(claude.child(SESSION).calls).not.toContain('send')
 
-    // The CLI answers: startup lands and the held message is written to the proven child.
+    // The CLI answers: startup lands and the queued message is written to the proven child.
     claude.child(SESSION).answerInit()
 
     await vi.waitFor(() => expect(claude.child(SESSION).calls).toContain('send'))
     expect(claude.children(SESSION)).toHaveLength(1)
-    expect(statusRows(host)).toEqual([])
+    expect(await statusRows(host)).toEqual([])
   })
 
   it('is rejected with the diagnostic when the CLI dies first, and restarts nothing', async () => {
@@ -147,16 +152,15 @@ describe('a send while the first Claude start is still answering initialize', ()
     const held = await send(host, 'hello')
     await failLatestStart(host, 1)
 
-    await vi.waitFor(() =>
-      expect(submission(host, held)).toMatchObject({
+    await vi.waitFor(async () =>
+      expect(await submission(host, held)).toMatchObject({
         dispatchState: 'rejected',
         // Worded for the user: the red line under the composer shows it as it stands.
-        reason: `The provider stopped before it finished starting: ${DIAGNOSTIC}.`
+        reason: STARTUP_TEXT,
+        rejection: { kind: 'providerStartFailed' }
       })
     )
-    expect(statusRows(host)).toEqual([
-      expect.stringMatching(/stopped before it finished starting: .*not signed in \(rig\)/)
-    ])
+    expect(await statusRows(host)).toEqual([STARTUP_TEXT])
     expect(fence(host)).toBe(startedFence + 1)
     expect(claude.children(SESSION)).toHaveLength(1)
     expect(claude.child(SESSION).calls).not.toContain('send')
diff --git a/src/main/runtime/claude-structured-send-restart-dies-before-dispatch.test.ts b/src/main/runtime/claude-structured-send-restart-dies-before-dispatch.test.ts
index 0d4b49096379..183879abe1a6 100644
--- a/src/main/runtime/claude-structured-send-restart-dies-before-dispatch.test.ts
+++ b/src/main/runtime/claude-structured-send-restart-dies-before-dispatch.test.ts
@@ -1,10 +1,9 @@
-// A send restarts a chat's Claude child and is admitted against it while it is still starting.
-// When that child dies before the send's dispatch reaches the adapter, the adapter has no session
-// to hold the message for, so the dispatch throws. A child that never proved its start accepted
-// nothing — input is only written after initialize — so the send settles `rejected` with the
-// child's own diagnostic, never as a delivery nobody can confirm, and a client that was
-// subscribed the whole time receives the failure row and the rejected submission over the wire.
-// Against the production runtime, adapter, record store and host, with only the CLI scripted.
+// A send is accepted into a chat whose Claude child is gone, and its delivery restarts the child.
+// When that child dies before it proves its start, the message was never handed to it — delivery
+// waits for the start — so the send settles `rejected` with the child's own diagnostic, never as a
+// delivery nobody can confirm, and a client that was subscribed the whole time receives the
+// failure row and the rejected submission over the wire. Against the production runtime, adapter,
+// record store and host, with only the CLI scripted.
 
 import { afterEach, describe, expect, it, vi } from 'vitest'
 import { computeAgentSessionPayloadFingerprint } from '../../shared/agent-session-mutation-envelope'
@@ -12,11 +11,20 @@ import type { AgentSessionSubscribeEvent } from '../../shared/agent-session-wire
 import { hostTestMessage } from '../native-chat/agent-session-wire/structured-agent-session-host-test-data'
 import type { StructuredAgentSessionHost } from '../native-chat/agent-session-wire/structured-agent-session-host'
 import { waitForStructuredAgentSessionRecovery } from './structured-agent-session-runtime'
-import { createScriptedClaudeRuntime } from './structured-claude-scripted-runtime-test-support'
+import {
+  createScriptedClaudeRuntime,
+  scriptedClaudeExitError
+} from './structured-claude-scripted-runtime-test-support'
 
 const SESSION = 'claude-send-restart-dies-first'
 const CALLER = { callerKey: 'client-1' }
 const DIAGNOSTIC = 'claude stream-json exited (code 1): claude: not signed in (rig)'
+const STARTUP_TEXT = 'Claude stopped before it finished starting. Send your message to try again.'
+
+/** Delivery runs on its own serialized steps; under a loaded runner they take more than a second. */
+function eventually(assertion: () => unknown): Promise<unknown> {
+  return vi.waitFor(assertion, { timeout: 10_000 })
+}
 
 let claude = createScriptedClaudeRuntime([SESSION])
 let operations = 0
@@ -73,37 +81,27 @@ async function send(host: StructuredAgentSessionHost, text: string): Promise<str
   return clientOperationId
 }
 
-function statusRows(host: StructuredAgentSessionHost): string[] {
-  return host
-    .journalSnapshot(SESSION)
-    .items.flatMap((item) => (item.body.kind === 'status' ? [item.body.text] : []))
+async function statusRows(host: StructuredAgentSessionHost): Promise<string[]> {
+  return (await host.journalSnapshot(SESSION)).items.flatMap((item) =>
+    item.body.kind === 'status' ? [item.body.text] : []
+  )
 }
 
-function submission(host: StructuredAgentSessionHost, clientMessageId: string) {
-  return host
-    .journalSnapshot(SESSION)
-    .submissions.find((entry) => entry.clientMessageId === clientMessageId)
+async function submission(host: StructuredAgentSessionHost, clientMessageId: string) {
+  return (await host.journalSnapshot(SESSION)).submissions.find(
+    (entry) => entry.clientMessageId === clientMessageId
+  )
 }
 
 async function failLatestStart(host: StructuredAgentSessionHost, count: number): Promise<void> {
-  await vi.waitFor(() => expect(claude.children(SESSION)).toHaveLength(count))
-  claude.child(SESSION).exit(new Error(DIAGNOSTIC))
+  await eventually(() => expect(claude.children(SESSION)).toHaveLength(count))
+  claude.child(SESSION).exit(scriptedClaudeExitError(DIAGNOSTIC))
   await waitForStructuredAgentSessionRecovery()
-  await vi.waitFor(() =>
+  await eventually(() =>
     expect(host.deps.store.getRecord(SESSION)?.lease.claimStatus).toBe('released')
   )
 }
 
-/** The restarted child dies the instant the send's dispatch reaches the adapter. */
-function killChildAtDispatch(host: StructuredAgentSessionHost): void {
-  const adapter = host.deps.adapter
-  const dispatch = adapter.dispatch.bind(adapter)
-  vi.spyOn(adapter, 'dispatch').mockImplementationOnce((input) => {
-    claude.child(SESSION).exit(new Error(DIAGNOSTIC))
-    return dispatch(input)
-  })
-}
-
 /** Everything a subscriber received, flattened to the rows and submissions it was shown. */
 function received(events: AgentSessionSubscribeEvent[]) {
   const statusTexts: string[] = []
@@ -129,7 +127,7 @@ function received(events: AgentSessionSubscribeEvent[]) {
   return { statusTexts, submissions, fences }
 }
 
-describe('a send whose restarted Claude child dies before the dispatch reaches the adapter', () => {
+describe('a send whose restarted Claude child dies before it proves its start', () => {
   it('settles rejected with the diagnostic, keeps one failure row, and a Retry is one new attempt', async () => {
     claude.behave(SESSION, { initHangs: true })
     const host = await claude.install()
@@ -139,28 +137,21 @@ describe('a send whose restarted Claude child dies before the dispatch reaches t
     await failLatestStart(host, 1)
     const releasedFence = fence(host)
 
-    killChildAtDispatch(host)
     const sent = await send(host, 'hello?')
-    // The send's own answer already says it was not delivered; it does not wait for the exit.
-    expect(answered.get(sent)).toBe('rejected')
-    expect(claude.children(SESSION)).toHaveLength(2)
-    await waitForStructuredAgentSessionRecovery()
-    await vi.waitFor(() =>
-      expect(host.deps.store.getRecord(SESSION)?.lease.claimStatus).toBe('released')
-    )
+    // Accepted: the answer comes before the restart it needs.
+    expect(answered.get(sent)).toBe('pending')
+    await failLatestStart(host, 2)
 
     // Provably not delivered, with the cause; not "unconfirmed".
-    await vi.waitFor(() =>
-      expect(submission(host, sent)).toMatchObject({
+    await eventually(async () =>
+      expect(await submission(host, sent)).toMatchObject({
         dispatchState: 'rejected',
         // Worded for the user: the red line under the composer shows it as it stands.
-        reason: `The provider stopped before it finished starting: ${DIAGNOSTIC}.`
+        reason: STARTUP_TEXT,
+        rejection: { kind: 'providerStartFailed' }
       })
     )
-    expect(statusRows(host)).toEqual([
-      expect.stringContaining('not signed in'),
-      expect.stringMatching(/stopped before it finished starting: .*not signed in \(rig\)/)
-    ])
+    expect(await statusRows(host)).toEqual([STARTUP_TEXT, STARTUP_TEXT])
     expect(fence(host)).toBe(releasedFence + 2)
     expect(claude.children(SESSION)).toHaveLength(2)
     expect(claude.child(SESSION).calls).not.toContain('send')
@@ -168,40 +159,14 @@ describe('a send whose restarted Claude child dies before the dispatch reaches t
     // Retry under a new id: one restart, and once the CLI is healthy the message is written.
     claude.behave(SESSION, {})
     await send(host, 'hello again')
-    expect(claude.children(SESSION)).toHaveLength(3)
-    await vi.waitFor(() => expect(claude.child(SESSION).calls).toContain('send'))
+    await eventually(() => expect(claude.children(SESSION)).toHaveLength(3))
+    await eventually(() => expect(claude.child(SESSION).calls).toContain('send'))
     expect(claude.child(SESSION).calls.filter((call) => call === 'send')).toHaveLength(1)
-    expect(statusRows(host)).toHaveLength(2)
-  })
-
-  it('names the diagnostic even when the exit was fully processed before the dispatch arrived', async () => {
-    claude.behave(SESSION, { initHangs: true })
-    const host = await claude.install()
-    await expect(host.attach(CALLER, claude.attachParams(SESSION, null))).resolves.toMatchObject({
-      ok: true
-    })
-    await failLatestStart(host, 1)
-    const adapter = host.deps.adapter
-    const dispatch = adapter.dispatch.bind(adapter)
-    vi.spyOn(adapter, 'dispatch').mockImplementationOnce(async (input) => {
-      claude.child(SESSION).exit(new Error(DIAGNOSTIC))
-      // The adapter settles and publishes the exit; the host's own settlement waits behind this send.
-      await new Promise((resolve) => setTimeout(resolve, 300))
-      return dispatch(input)
-    })
-
-    const sent = await send(host, 'hello?')
-    expect(answered.get(sent)).toBe('rejected')
-    await waitForStructuredAgentSessionRecovery()
-    expect(submission(host, sent)).toMatchObject({
-      dispatchState: 'rejected',
-      reason: `The provider stopped before it finished starting: ${DIAGNOSTIC}.`
-    })
-    expect(statusRows(host)).toHaveLength(2)
+    expect(await statusRows(host)).toHaveLength(2)
   })
 
   // A restart refused because its child died before it was handed over leaves one row, from the
-  // send, in the words any failed start uses.
+  // delivery, in the words any failed start uses, and rejects the message with them.
   it.each(['spawn', 'start-time-read'] as const)(
     'leaves one row for a restart whose child exits at %s',
     async (at) => {
@@ -213,16 +178,17 @@ describe('a send whose restarted Claude child dies before the dispatch reaches t
       await failLatestStart(host, 1)
 
       claude.behave(SESSION, { exitsDuringSpawn: { diagnostic: DIAGNOSTIC, at } })
-      await expect(attempt(host, 'hello?')).resolves.toMatchObject({
-        ok: false,
-        refusal: { code: 'agent_session_owner_restart_failed' }
-      })
+      const sent = await send(host, 'hello?')
+      await eventually(async () =>
+        expect(await submission(host, sent)).toMatchObject({
+          dispatchState: 'rejected',
+          reason: STARTUP_TEXT,
+          rejection: { kind: 'providerStartFailed' }
+        })
+      )
       await waitForStructuredAgentSessionRecovery()
 
-      expect(statusRows(host)).toEqual([
-        `The provider stopped before it finished starting: ${DIAGNOSTIC}.`,
-        `The provider stopped before it finished starting: ${DIAGNOSTIC}.`
-      ])
+      expect(await statusRows(host)).toEqual([STARTUP_TEXT, STARTUP_TEXT])
     }
   )
 
@@ -233,7 +199,7 @@ describe('a send whose restarted Claude child dies before the dispatch reaches t
       ok: true
     })
     const events: AgentSessionSubscribeEvent[] = []
-    const unsubscribe = host.subscribe({
+    const unsubscribe = await host.subscribe({
       id: 'pane',
       sessionId: SESSION,
       emit: (event) => {
@@ -242,19 +208,13 @@ describe('a send whose restarted Claude child dies before the dispatch reaches t
     })
     try {
       await failLatestStart(host, 1)
-      killChildAtDispatch(host)
       const sent = await send(host, 'hello?')
-      await waitForStructuredAgentSessionRecovery()
-      await vi.waitFor(() =>
-        expect(host.deps.store.getRecord(SESSION)?.lease.claimStatus).toBe('released')
-      )
+      await failLatestStart(host, 2)
 
-      await vi.waitFor(() => {
+      await eventually(() => {
         const seen = received(events)
         expect(seen.submissions.get(sent)).toBe('rejected')
-        expect(seen.statusTexts).toContainEqual(
-          expect.stringMatching(/stopped before it finished starting: .*not signed in \(rig\)/)
-        )
+        expect(seen.statusTexts).toContainEqual(STARTUP_TEXT)
         // The subscriber ended up on the fence the exit published, not the one the restart did.
         expect(seen.fences.at(-1)).toBe(fence(host))
       })
@@ -265,8 +225,8 @@ describe('a send whose restarted Claude child dies before the dispatch reaches t
 })
 
 describe('a chat whose Claude CLI keeps failing to start, seen by a subscriber open throughout', () => {
-  const STARTUP_FAILURE =
-    'The provider stopped before it finished starting: claude stream-json exited (code 1): claude: not signed in (rig).'
+  // The stderr rides beside the sentence as a log detail; the sentence is the same every time.
+  const STARTUP_FAILURE = STARTUP_TEXT
 
   /** Status rows a subscriber has been shown, one per row whatever frame carried it. */
   function shownRows(events: AgentSessionSubscribeEvent[]): Map<string, string> {
@@ -285,14 +245,14 @@ describe('a chat whose Claude CLI keeps failing to start, seen by a subscriber o
     return rows
   }
 
-  it('shows one row naming the cause per failed attempt, admitted or refused, and none once the CLI is fixed', async () => {
+  it('shows one row naming the cause per failed attempt, however the start died, and none once the CLI is fixed', async () => {
     claude.behave(SESSION, { initHangs: true })
     const host = await claude.install()
     const events: AgentSessionSubscribeEvent[] = []
     await expect(host.attach(CALLER, claude.attachParams(SESSION, null))).resolves.toMatchObject({
       ok: true
     })
-    const unsubscribe = host.subscribe({
+    const unsubscribe = await host.subscribe({
       id: 'pane',
       sessionId: SESSION,
       emit: (event) => {
@@ -301,37 +261,38 @@ describe('a chat whose Claude CLI keeps failing to start, seen by a subscriber o
     })
     try {
       await failLatestStart(host, 1)
-      await vi.waitFor(() => expect([...shownRows(events).values()]).toEqual([STARTUP_FAILURE]))
+      await eventually(() => expect([...shownRows(events).values()]).toEqual([STARTUP_FAILURE]))
 
-      // Send: admitted against the restarted child, which dies before starting.
-      killChildAtDispatch(host)
-      const sent = await attempt(host, 'hello?')
-      await waitForStructuredAgentSessionRecovery()
-      expect(sent).toMatchObject({
-        ok: true,
-        value: { submission: { dispatchState: 'rejected', reason: STARTUP_FAILURE } }
-      })
-      await vi.waitFor(() =>
+      // Send: accepted, and its delivery restarts the child, which dies before starting.
+      const sent = await send(host, 'hello?')
+      await failLatestStart(host, 2)
+      await eventually(async () =>
+        expect(await submission(host, sent)).toMatchObject({
+          dispatchState: 'rejected',
+          reason: STARTUP_FAILURE
+        })
+      )
+      await eventually(() =>
         expect([...shownRows(events).values()]).toEqual([STARTUP_FAILURE, STARTUP_FAILURE])
       )
 
-      // Retry while still broken: this restart dies before its child is handed over, so the send
-      // is refused before admission. Still one row, saying the same thing.
+      // Retry while still broken: this restart dies before its child is handed over, so the
+      // delivery's start is refused. Still one row, saying the same thing, on the rejected message.
       claude.behave(SESSION, {
         exitsDuringSpawn: {
           diagnostic: 'claude stream-json exited (code 1): claude: not signed in (rig)',
           at: 'start-time-read'
         }
       })
-      await expect(attempt(host, 'hello?')).resolves.toMatchObject({
-        ok: false,
-        refusal: {
-          code: 'agent_session_owner_restart_failed',
-          message: expect.stringMatching(/couldn't restart: .*not signed in \(rig\)/)
-        }
-      })
+      const retried = await send(host, 'hello?')
+      await eventually(async () =>
+        expect(await submission(host, retried)).toMatchObject({
+          dispatchState: 'rejected',
+          reason: STARTUP_FAILURE
+        })
+      )
       await waitForStructuredAgentSessionRecovery()
-      await vi.waitFor(() =>
+      await eventually(() =>
         expect([...shownRows(events).values()]).toEqual([
           STARTUP_FAILURE,
           STARTUP_FAILURE,
@@ -342,7 +303,7 @@ describe('a chat whose Claude CLI keeps failing to start, seen by a subscriber o
       // The CLI is fixed: Retry delivers and adds no row.
       claude.behave(SESSION, {})
       await expect(attempt(host, 'hello?')).resolves.toMatchObject({ ok: true })
-      await vi.waitFor(() => expect(claude.child(SESSION).calls).toContain('send'))
+      await eventually(() => expect(claude.child(SESSION).calls).toContain('send'))
       expect(shownRows(events).size).toBe(3)
     } finally {
       unsubscribe()
diff --git a/src/main/runtime/claude-structured-session-integration.test.ts b/src/main/runtime/claude-structured-session-integration.test.ts
index 480720da93b8..82db5d6c5425 100644
--- a/src/main/runtime/claude-structured-session-integration.test.ts
+++ b/src/main/runtime/claude-structured-session-integration.test.ts
@@ -349,6 +349,7 @@ describe('a structured Claude session over agentSession.*', () => {
   })
 
   it('leaves unlisted shell exports out when inheritance is off', async () => {
+    vi.stubEnv('CODEX_LB_API_KEY', undefined)
     shellEnv = { ...shellEnv, CODEX_LB_API_KEY: 'shell-exported', LISTED_ONLY: 'yes' }
     shellEnvironmentPolicy = { inheritAll: false, names: ['LISTED_ONLY'] }
 
@@ -363,9 +364,28 @@ describe('a structured Claude session over agentSession.*', () => {
     claudeAuthPolicy = { stripAuthEnv: true }
     // The default overlay carries ANTHROPIC_AUTH_TOKEN, which the terminal path
     // refuses at spawn-env.ts:25 rather than letting it beat the pinned account.
-    const refused = await call('agentSession.create', createIntentParams())
-
-    expect(JSON.stringify(refused)).toContain('explicit Anthropic auth environment')
+    const params = createIntentParams()
+    const sentence =
+      'This Claude launch sets its own Anthropic sign-in variables. Remove them to use a managed Claude account.'
+    const refused = await call('agentSession.create', params)
+
+    // The thrown answer keeps its wire code; only its words are the ones its replay reads.
+    expect(refused).toMatchObject({
+      ok: false,
+      error: { code: 'runtime_error', message: sentence }
+    })
+    // Its replay reads the same sentence, beside the situation it names.
+    expect(await call('agentSession.create', params)).toMatchObject({
+      ok: true,
+      result: {
+        ok: false,
+        refusal: {
+          code: 'agent_session_operation_invalid',
+          details: { reason: 'managedAccountEnvOverride' },
+          message: sentence
+        }
+      }
+    })
     // Refused before spawn: no provider child was ever opened.
     expect(claude.connections).toHaveLength(0)
   })
@@ -378,51 +398,56 @@ describe('a structured Claude session over agentSession.*', () => {
     await waitForStructuredAgentSessionRecovery()
 
     const guidance = itemsOf(await subscribe()).find((item) => item.body?.kind === 'status')
+    // The adapter typed the refusal, so the row names the situation rather than quoting Orca.
     expect(guidance?.body).toMatchObject({
       kind: 'status',
-      text: expect.stringMatching(
-        /stopped before it finished starting: .*not signed in.*Claude CLI.*CLAUDE_CONFIG_DIR/s
-      )
+      text: 'Claude is not signed in for the selected account. Sign in, then send your message again.',
+      failure: { kind: 'notSignedIn' }
     })
     expect(leaseOf(SESSION)).toMatchObject({ claimStatus: 'released', handoffStage: null })
     // A failed start is not auto-resumed into the same failure.
     expect(claude.connections).toHaveLength(1)
   })
 
-  it('releases a session whose CLI self-exited during create, with its diagnostic intact', async () => {
-    claude.setSelfExit({
-      message: 'claude stream-json exited (code 1): claude: not signed in',
-      // The root's death is first-hand; its descendants were never snapshottable.
-      exitVerdict: { root: 'exited', tree: 'unverifiable' }
-    })
-
-    const failed = await call('agentSession.create', createIntentParams())
+  // The root's death is first-hand. Its descendants were never snapshottable, or one was seen
+  // alive; either way the lease follows the root, so the reservation goes with it.
+  it.each(['unverifiable', 'live'] as const)(
+    'releases a session whose CLI self-exited during create with its tree %s, refused in a sentence',
+    async (tree) => {
+      claude.setSelfExit({
+        message: 'claude stream-json exited (code 1): claude: not signed in',
+        exitVerdict: { root: 'exited', tree }
+      })
 
-    // Answered once, as the refusal a replay of this operation gives, never thrown first.
-    expect(failed).toMatchObject({
-      ok: true,
-      result: {
-        ok: false,
-        refusal: {
-          code: 'agent_session_operation_invalid',
-          message: expect.stringContaining('claude: not signed in'),
-          ownerVerdict: 'exited'
+      const failed = await call('agentSession.create', createIntentParams())
+
+      // Answered once, as the refusal a replay of this operation gives, never thrown first.
+      expect(failed).toMatchObject({
+        ok: true,
+        result: {
+          ok: false,
+          refusal: {
+            code: 'agent_session_operation_invalid',
+            // The CLI's stderr is log text; the person reads what the chat's start failure says.
+            message: 'Claude stopped before it finished starting. Send your message to try again.',
+            ownerVerdict: 'exited'
+          }
         }
-      }
-    })
-    const lease = leaseOf(SESSION)
-    // Latching here would refuse every later attach with agent_session_ownership_unknown,
-    // wedging a user who only needs to sign in.
-    expect(lease).toMatchObject({ claimStatus: 'released', handoffStage: null })
-    expect(lease.deathEvidence).toMatchObject({
-      kind: 'exit-observed',
-      detail: 'the provider process exited; its descendants were not verifiable'
-    })
+      })
+      const lease = leaseOf(SESSION)
+      // Latching here would refuse every later attach with agent_session_ownership_unknown,
+      // wedging a user who only needs to sign in.
+      expect(lease).toMatchObject({ claimStatus: 'released', handoffStage: null })
+      expect(lease.deathEvidence).toMatchObject({
+        kind: 'exit-observed',
+        detail: 'the provider process exited; its descendants were not proven gone'
+      })
 
-    claude.setSelfExit(null)
-    // Signing in and reopening the chat works: the reservation was not latched.
-    await ok<{ fence: number }>('agentSession.ensure', ensureParams(lease.runtimeFence))
-  })
+      claude.setSelfExit(null)
+      // Signing in and reopening the chat works: the reservation was not latched.
+      await ok<{ fence: number }>('agentSession.ensure', ensureParams(lease.runtimeFence))
+    }
+  )
 
   it('answers a create whose whole CLI tree exited as exited on the first call', async () => {
     claude.setSelfExit({
@@ -439,7 +464,7 @@ describe('a structured Claude session over agentSession.*', () => {
         ok: false,
         refusal: {
           code: 'agent_session_operation_invalid',
-          message: expect.stringContaining('claude: not signed in'),
+          message: 'Claude stopped before it finished starting. Send your message to try again.',
           ownerVerdict: 'exited'
         }
       }
@@ -448,42 +473,52 @@ describe('a structured Claude session over agentSession.*', () => {
     claude.setSelfExit(null)
   })
 
-  it('keeps a session reserved when a descendant of the failed start was seen alive', async () => {
+  it('releases a failed start that recorded no owner without claiming it exited', async () => {
     claude.setSelfExit({
       message: 'claude stream-json exited (code 1): claude: not signed in',
-      exitVerdict: { root: 'exited', tree: 'live' }
+      // The root was never seen to exit, so nothing proves this start's process gone.
+      exitVerdict: { root: 'live', tree: 'unverifiable' }
     })
 
     await call('agentSession.create', createIntentParams())
+    claude.setSelfExit(null)
 
-    // A live descendant still holds the provider session: releasing would hand a
-    // second writer to it.
+    // The adapter closed the stdio of what it spawned, and no owner was recorded to stop. The next
+    // start goes ahead; with no death evidence nothing reads the failed start as exited.
     expect(leaseOf(SESSION)).toMatchObject({
-      claimStatus: 'reserved',
-      handoffStage: 'manual-recovery'
+      claimStatus: 'released',
+      handoffStage: null,
+      deathEvidence: null
     })
-    claude.setSelfExit(null)
   })
 
-  it('reopens a chat whose stop saw the Claude root exit but not its descendants', async () => {
-    await ok('agentSession.create', createIntentParams())
-    const first = claude.live()
-    first.exitVerdict = { root: 'exited', tree: 'unverifiable' }
-    first.close = async () => {
-      first.closed = true
-      return false
-    }
-    const host = getStructuredAgentSessionHost()
-    // The idle release clock's eviction: the lease follows the root, so the host lets go.
-    await host?.close(SESSION)
-    expect(host?.hasSession(SESSION)).toBe(false)
-
-    // What the chat surface's `agentSession.hold` does when the user comes back to it.
-    await host?.hold(SESSION, 'desktop-chat:reopen')
+  it.each(['unverifiable', 'live'] as const)(
+    'restarts a chat whose stop saw the Claude root exit with its tree %s',
+    async (tree) => {
+      await ok('agentSession.create', createIntentParams())
+      const first = claude.live()
+      first.exitVerdict = { root: 'exited', tree }
+      first.close = async () => {
+        first.closed = true
+        return false
+      }
+      const host = getStructuredAgentSessionHost()
+      // The lease follows the root, so the host lets go.
+      await host?.close(SESSION)
+      expect(host?.hasSession(SESSION)).toBe(false)
+
+      // The user comes back and sends: that send is what starts Claude again.
+      const body = { kind: 'message', role: 'user', blocks: [{ type: 'text', text: 'back' }] }
+      await ok('agentSession.send', {
+        envelope: envelope('agentSession.send', { body }, leaseOf(SESSION).runtimeFence),
+        body
+      })
 
-    expect(claude.connections).toHaveLength(2)
-    expect(host?.hasSession(SESSION)).toBe(true)
-  })
+      await vi.waitFor(() => expect(claude.connections).toHaveLength(2))
+      await vi.waitFor(() => expect(claude.live().sent).toHaveLength(1))
+      expect(host?.hasSession(SESSION)).toBe(true)
+    }
+  )
 
   it('routes a published Claude first-hand exit through fenced host reconciliation', async () => {
     await ok<{ fence: number }>('agentSession.create', createIntentParams())
@@ -497,46 +532,49 @@ describe('a structured Claude session over agentSession.*', () => {
     expect(leaseOf(SESSION)).toMatchObject({ claimStatus: 'released', handoffStage: null })
   })
 
-  it('restarts an open chat after a Claude crash whose descendants could not be verified', async () => {
-    const created = await ok<{ fence: number }>('agentSession.create', createIntentParams())
-    // The open chat surface is what asks the host to bring Claude back.
-    await getStructuredAgentSessionHost()?.hold(SESSION, 'desktop-chat:open')
-    const connection = claude.live()
-    connection.exitVerdict = { root: 'exited', tree: 'unverifiable' }
-    connection.close = async () => {
-      connection.closed = true
-      return false
-    }
-    // Claude takes the message but crashes before echoing it.
-    connection.send = async (message) => {
-      connection.sent.push(message)
-    }
-    const body = { kind: 'message', role: 'user', blocks: [{ type: 'text', text: 'in flight' }] }
-    const inFlight = ok<{ submission: { dispatchState: string; reason: string | null } }>(
-      'agentSession.send',
-      { envelope: envelope('agentSession.send', { body }, created.fence), body }
-    )
-    await vi.waitFor(() => expect(connection.sent).toHaveLength(1))
-    connection.handlers.onExit?.(new Error('claude stream-json exited (code 1): crashed'))
+  // A descendant seen alive is one that survived the close ladder, such as an MCP server that
+  // ignores SIGTERM; it no longer holds the chat.
+  it.each(['unverifiable', 'live'] as const)(
+    'restarts a chat on its next send after a Claude crash whose tree was %s',
+    async (tree) => {
+      const created = await ok<{ fence: number }>('agentSession.create', createIntentParams())
+      const connection = claude.live()
+      connection.exitVerdict = { root: 'exited', tree }
+      connection.close = async () => {
+        connection.closed = true
+        return false
+      }
+      // Claude takes the message but crashes before echoing it.
+      connection.send = async (message) => {
+        connection.sent.push(message)
+      }
+      const body = { kind: 'message', role: 'user', blocks: [{ type: 'text', text: 'in flight' }] }
+      const inFlight = ok<{ submission: { dispatchState: string; reason: string | null } }>(
+        'agentSession.send',
+        { envelope: envelope('agentSession.send', { body }, created.fence), body }
+      )
+      await vi.waitFor(() => expect(connection.sent).toHaveLength(1))
+      connection.handlers.onExit?.(new Error('claude stream-json exited (code 1): crashed'))
 
-    expect((await inFlight).submission).toMatchObject({
-      dispatchState: 'unknown',
-      reason: 'provider_exited_before_acknowledgement'
-    })
-    // Held back, sends failed with the crash until the idle clock stopped the chat.
-    await waitForStructuredAgentSessionRecovery()
-    expect(claude.connections).toHaveLength(2)
-    expect(claude.live().launch.options).toMatchObject({ resume: PROVIDER_SESSION })
-    const lease = leaseOf(SESSION)
-    expect(lease).toMatchObject({ claimStatus: 'live', handoffStage: null })
-    const next = { kind: 'message', role: 'user', blocks: [{ type: 'text', text: 'after' }] }
-    const sent = await ok<{ submission: { dispatchState: string } }>('agentSession.send', {
-      envelope: envelope('agentSession.send', { body: next }, lease.runtimeFence),
-      body: next
-    })
-    expect(sent.submission.dispatchState).toBe('accepted')
-    expect(claude.live().sent).toHaveLength(1)
-  })
+      expect((await inFlight).submission).toMatchObject({
+        dispatchState: 'unknown',
+        reason: 'provider_exited_before_acknowledgement'
+      })
+      // The crash releases the lease; nothing restarts Claude until the chat has work for it.
+      await waitForStructuredAgentSessionRecovery()
+      expect(claude.connections).toHaveLength(1)
+      expect(leaseOf(SESSION)).toMatchObject({ claimStatus: 'released', handoffStage: null })
+      const next = { kind: 'message', role: 'user', blocks: [{ type: 'text', text: 'after' }] }
+      await ok('agentSession.send', {
+        envelope: envelope('agentSession.send', { body: next }, leaseOf(SESSION).runtimeFence),
+        body: next
+      })
+      await vi.waitFor(() => expect(claude.connections).toHaveLength(2))
+      expect(claude.live().launch.options).toMatchObject({ resume: PROVIDER_SESSION })
+      await vi.waitFor(() => expect(claude.live().sent).toHaveLength(1))
+      expect(leaseOf(SESSION)).toMatchObject({ claimStatus: 'live', handoffStage: null })
+    }
+  )
 
   it('creates, sends, streams, approves, interrupts, and resumes from the chain head', async () => {
     shellEnv = { ...shellEnv, ANTHROPIC_API_KEY: 'sk-ant-SHELL-LEAK' }
diff --git a/src/main/runtime/claude-structured-startup-fault-is-not-an-exit.test.ts b/src/main/runtime/claude-structured-startup-fault-is-not-an-exit.test.ts
new file mode 100644
index 000000000000..863cbaeaebf9
--- /dev/null
+++ b/src/main/runtime/claude-structured-startup-fault-is-not-an-exit.test.ts
@@ -0,0 +1,139 @@
+// A Claude start can fail on Orca's side while the CLI is still running: a saved option it can't
+// restore, or an init frame naming another session. Orca ends that child itself, so the chat must
+// not say Claude stopped on its own; only an exit Orca saw says that. Against the production
+// runtime, adapter, record store and host, with only the CLI process scripted.
+
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { computeAgentSessionPayloadFingerprint } from '../../shared/agent-session-mutation-envelope'
+import { hostTestMessage } from '../native-chat/agent-session-wire/structured-agent-session-host-test-data'
+import type { StructuredAgentSessionHost } from '../native-chat/agent-session-wire/structured-agent-session-host'
+import { waitForStructuredAgentSessionRecovery } from './structured-agent-session-runtime'
+import {
+  createScriptedClaudeRuntime,
+  scriptedClaudeExitError
+} from './structured-claude-scripted-runtime-test-support'
+
+const SESSION = 'claude-startup-fault'
+const CALLER = { callerKey: 'client-1' }
+const DIAGNOSTIC = 'claude stream-json exited (code 1): claude: not signed in (rig)'
+const STOPPED_TEXT = 'Claude stopped before it finished starting. Send your message to try again.'
+
+let claude = createScriptedClaudeRuntime([SESSION])
+let operations = 0
+
+afterEach(async () => {
+  vi.restoreAllMocks()
+  await claude.dispose()
+  claude = createScriptedClaudeRuntime([SESSION])
+})
+
+function fence(host: StructuredAgentSessionHost): number {
+  return host.deps.store.getRecord(SESSION)?.lease.runtimeFence ?? 0
+}
+
+async function send(host: StructuredAgentSessionHost, text: string): Promise<string> {
+  const body = hostTestMessage(text)
+  const sent = await host.send(CALLER, {
+    envelope: {
+      sessionId: SESSION,
+      clientOperationId: `${Date.now()}-${(++operations).toString(16).padStart(32, '0')}`,
+      expectedRuntimeFence: fence(host),
+      payloadFingerprint: computeAgentSessionPayloadFingerprint({
+        method: 'agentSession.send',
+        sessionId: SESSION,
+        fields: { body }
+      })
+    },
+    body
+  })
+  expect(sent, JSON.stringify(sent)).toMatchObject({
+    ok: true,
+    value: { submission: { dispatchState: 'pending' } }
+  })
+  return sent.ok ? sent.value.clientMessageId : ''
+}
+
+async function failureRows(host: StructuredAgentSessionHost) {
+  return (await host.journalSnapshot(SESSION)).items.flatMap((item) =>
+    item.body.kind === 'status' && item.body.failure
+      ? [{ text: item.body.text, kind: item.body.failure.kind }]
+      : []
+  )
+}
+
+async function submission(host: StructuredAgentSessionHost, clientMessageId: string) {
+  return (await host.journalSnapshot(SESSION)).submissions.find(
+    (entry) => entry.clientMessageId === clientMessageId
+  )
+}
+
+async function released(host: StructuredAgentSessionHost): Promise<void> {
+  await waitForStructuredAgentSessionRecovery()
+  await vi.waitFor(() =>
+    expect(host.deps.store.getRecord(SESSION)?.lease.claimStatus).toBe('released')
+  )
+}
+
+describe('a Claude start that Orca fails while the CLI is still running', () => {
+  it('reads as a start that could not happen when a saved option cannot be restored', async () => {
+    claude.behave(SESSION, { optionWritesFail: true })
+    const host = await claude.install()
+    await expect(
+      host.attach(
+        CALLER,
+        claude.attachParams(SESSION, null, { options: { permissionMode: 'plan' } })
+      )
+    ).resolves.toMatchObject({ ok: true })
+    await released(host)
+
+    expect(claude.child(SESSION).calls).toContain('set_permission_mode')
+    expect(await failureRows(host)).toEqual([
+      { text: expect.stringMatching(/^Claude couldn't start\./), kind: 'startFailed' }
+    ])
+  })
+
+  it('rejects a held message as a start that could not happen when init names another session', async () => {
+    claude.behave(SESSION, { initHangs: true, initNamesForeignSession: true })
+    const host = await claude.install()
+    await expect(host.attach(CALLER, claude.attachParams(SESSION, null))).resolves.toMatchObject({
+      ok: true
+    })
+    const held = await send(host, 'hello')
+
+    claude.child(SESSION).answerInit()
+    await released(host)
+
+    await vi.waitFor(async () =>
+      expect(await submission(host, held)).toMatchObject({
+        dispatchState: 'rejected',
+        reason: expect.stringMatching(/^Claude couldn't start\./),
+        rejection: { kind: 'startFailed' }
+      })
+    )
+    expect(await failureRows(host)).toEqual([
+      { text: expect.stringMatching(/^Claude couldn't start\./), kind: 'startFailed' }
+    ])
+    expect(claude.child(SESSION).calls).not.toContain('send')
+  })
+
+  it('still says Claude stopped when the CLI exits on its own before its start lands', async () => {
+    claude.behave(SESSION, { initHangs: true })
+    const host = await claude.install()
+    await expect(host.attach(CALLER, claude.attachParams(SESSION, null))).resolves.toMatchObject({
+      ok: true
+    })
+    const held = await send(host, 'hello')
+
+    claude.child(SESSION).exit(scriptedClaudeExitError(DIAGNOSTIC))
+    await released(host)
+
+    await vi.waitFor(async () =>
+      expect(await submission(host, held)).toMatchObject({
+        dispatchState: 'rejected',
+        reason: STOPPED_TEXT,
+        rejection: { kind: 'providerStartFailed' }
+      })
+    )
+    expect(await failureRows(host)).toEqual([{ text: STOPPED_TEXT, kind: 'providerStartFailed' }])
+  })
+})
diff --git a/src/main/runtime/claude-structured-startup-unanswered-control-request.test.ts b/src/main/runtime/claude-structured-startup-unanswered-control-request.test.ts
index 38d0de314d26..ce26647ae85f 100644
--- a/src/main/runtime/claude-structured-startup-unanswered-control-request.test.ts
+++ b/src/main/runtime/claude-structured-startup-unanswered-control-request.test.ts
@@ -72,10 +72,10 @@ function turnReportsModel(model: string): void {
   })
 }
 
-function statusRows(host: StructuredAgentSessionHost): string[] {
-  return host
-    .journalSnapshot(SESSION)
-    .items.flatMap((item) => (item.body.kind === 'status' ? [item.body.text] : []))
+async function statusRows(host: StructuredAgentSessionHost): Promise<string[]> {
+  return (await host.journalSnapshot(SESSION)).items.flatMap((item) =>
+    item.body.kind === 'status' ? [item.body.text] : []
+  )
 }
 
 async function send(host: StructuredAgentSessionHost, text: string): Promise<void> {
@@ -119,7 +119,7 @@ describe('a Claude start whose CLI answers initialize but not a control request'
       timeout: DEADLINE_MS * 40
     })
     expect(host.deps.adapter.readOptionRestoreFailures?.(SESSION)).toEqual([])
-    expect(statusRows(host)).toEqual([])
+    expect(await statusRows(host)).toEqual([])
     expect(claude.children(SESSION)).toHaveLength(1)
 
     // The proven child takes the next message.
@@ -245,7 +245,7 @@ describe('a Claude start whose CLI answers initialize but not a control request'
       timeout: DEADLINE_MS * 40
     })
     expect(record(host)?.lease.claimStatus).toBe('live')
-    expect(statusRows(host)).toEqual([])
+    expect(await statusRows(host)).toEqual([])
     expect(claude.children(SESSION)).toHaveLength(1)
   })
 })
diff --git a/src/main/runtime/claude-trust-dialog-transcript.test.ts b/src/main/runtime/claude-trust-dialog-transcript.test.ts
new file mode 100644
index 000000000000..d459fc515024
--- /dev/null
+++ b/src/main/runtime/claude-trust-dialog-transcript.test.ts
@@ -0,0 +1,242 @@
+/**
+ * Claude Code's first-launch trust dialog, replayed byte for byte from captured transcripts
+ * (`__fixtures__/claude-dialog-trust-workspace*.txt`).
+ *
+ * The dialog parks the cursor on its highlighted option with a cursor-up, and the host's line tail
+ * drops every row below the cursor — "Yes, I trust this folder" and "Enter to confirm". The
+ * tui-idle poll therefore reads the runtime's rendered screen, which still shows them.
+ */
+
+import { readFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { createTranscriptPane, TRANSCRIPT_PANE_PTY_ID } from './agent-transcript-pane-test-harness'
+
+function readCapture(name: string): { data: string; size: { cols: number; rows: number } } {
+  const base = join(__dirname, '__fixtures__', name)
+  const meta: { cols: number; rows: number } = JSON.parse(readFileSync(`${base}.meta.json`, 'utf8'))
+  return { data: readFileSync(`${base}.txt`, 'utf8'), size: { cols: meta.cols, rows: meta.rows } }
+}
+
+async function waitOnReplay(
+  name: string,
+  readSize: number | null,
+  options: { after?: string; timeoutMs?: number } = {}
+) {
+  const { data, size } = readCapture(name)
+  const { runtime, handle } = await createTranscriptPane({
+    paneTitle: 'Claude Code',
+    foregroundProcess: 'claude',
+    launchAgent: 'claude',
+    size,
+    data: ''
+  })
+  const bytes = Buffer.from(data, 'utf8')
+  const step = readSize ?? bytes.length
+  // Why a streaming decoder: a PTY read can end inside a multi-byte character, as a real one does.
+  const decoder = new TextDecoder()
+  for (let offset = 0; offset < bytes.length; offset += step) {
+    const read = decoder.decode(bytes.subarray(offset, offset + step), { stream: true })
+    runtime.onPtyData(TRANSCRIPT_PANE_PTY_ID, read, Date.now())
+  }
+  if (options.after) {
+    runtime.onPtyData(TRANSCRIPT_PANE_PTY_ID, options.after, Date.now())
+  }
+  // Why a wide budget: a blocked verdict lands on the first ~2 s poll tick; the slack absorbs load.
+  return runtime.waitForTerminal(handle, {
+    condition: 'tui-idle',
+    timeoutMs: options.timeoutMs ?? 15_000
+  })
+}
+
+describe("Claude's workspace trust dialog, from captured transcripts", () => {
+  it('reports the dialog as a blocking prompt instead of waiting out the whole budget', async () => {
+    await expect(waitOnReplay('claude-dialog-trust-workspace', null)).resolves.toMatchObject({
+      satisfied: false,
+      blockedReason: 'agent-trust-workspace'
+    })
+  })
+
+  it('still reports it when the dialog arrives in the 1024-byte reads a live Claude produced', async () => {
+    // Why: the tail's plain path blanks each `text\r\r\n` line of a read that carries no
+    // cursor-up, so the opening question never survives there; the screen is unaffected.
+    await expect(waitOnReplay('claude-dialog-trust-workspace', 1024)).resolves.toMatchObject({
+      satisfied: false,
+      blockedReason: 'agent-trust-workspace'
+    })
+  })
+
+  it('reports it on a narrow pane, where Claude wraps the question across lines', async () => {
+    await expect(waitOnReplay('claude-dialog-trust-workspace-narrow', null)).resolves.toMatchObject(
+      { satisfied: false, blockedReason: 'agent-trust-workspace' }
+    )
+  })
+
+  it('reports the agent ready, not blocked, once the user has answered "Yes"', async () => {
+    const wait = await waitOnReplay('claude-dialog-trust-workspace-answered', 1024)
+    expect(wait).toMatchObject({ satisfied: true })
+    expect(wait).not.toHaveProperty('blockedReason')
+  })
+
+  it('does not report a working Claude blocked for quoting the dialog in its own output', async () => {
+    // Synthetic turn painted over the answered capture: a working title, then a diff of this
+    // dialog's wording just above the status line, where the rendered screen shows it.
+    const quotedDiff = [
+      '⏺ Update(src/main/runtime/claude-trust-dialog-transcript.test.ts)',
+      '  ⎿  Added 3 lines',
+      "      12 +    '❯ No, exit',",
+      "      13 +    '  Yes, I trust this folder',",
+      "      14 +    'Enter to confirm · Esc to cancel'",
+      '✻ Working… (esc to interrupt)'
+    ]
+      .map((line, index) => `\x1b[${27 + index};1H\x1b[2K${line}`)
+      .join('')
+    // Why a timeout proves it: three poll ticks pass, and a working agent has nothing else to settle on.
+    await expect(
+      waitOnReplay('claude-dialog-trust-workspace-answered', 1024, {
+        after: `\x1b]0;⠂ Claude Code\x07${quotedDiff}`,
+        timeoutMs: 6_500
+      })
+    ).rejects.toThrow('timeout')
+  })
+})
+
+// A shell auto-title names Claude before Claude paints anything: oh-my-zsh sends the command
+// line as OSC 2 and then `claude` as OSC 1; fish's default is `claude <cwd>`. That bare name is
+// not a rest signal, so it must never let a launch type into the dialog below it.
+const OH_MY_ZSH_TITLES = ['\x1b]2;claude --dangerously-skip-permissions\x07', '\x1b]1;claude\x07']
+const FISH_TITLE = '\x1b]0;claude ~/p/repo\x07'
+// eslint-disable-next-line no-control-regex -- OSC title sequences are control characters
+const OSC_0_TITLE = /\x1b\]0;[^\x07]*\x07/g
+const POLL_INTERVAL_MS = 2_000
+const QUIESCENCE_MS = 3_000
+
+describe("Claude's trust dialog under a shell auto-title", () => {
+  afterEach(() => {
+    vi.useRealTimers()
+  })
+
+  async function createPane(name = 'claude-dialog-trust-workspace') {
+    const { data, size } = readCapture(name)
+    const pane = await createTranscriptPane({
+      paneTitle: 'claude',
+      foregroundProcess: 'claude',
+      launchAgent: 'claude',
+      size,
+      data: ''
+    })
+    // Why after creation: the pane's own set-up awaits real timers.
+    vi.useFakeTimers()
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: both resolvers are protected methods on the runtime; the spies only count calls.
+    const internals = pane.runtime as unknown as {
+      resolveTuiIdleWaiters: (...args: unknown[]) => void
+      resolvePtyTuiIdleWaiters: (...args: unknown[]) => void
+    }
+    const titleResolves = [
+      vi.spyOn(internals, 'resolveTuiIdleWaiters'),
+      vi.spyOn(internals, 'resolvePtyTuiIdleWaiters')
+    ]
+    const write = (chunk: string) =>
+      pane.runtime.onPtyData(TRANSCRIPT_PANE_PTY_ID, chunk, Date.now())
+    const paint = (bytes = data) => {
+      const encoded = Buffer.from(bytes, 'utf8')
+      const decoder = new TextDecoder()
+      for (let offset = 0; offset < encoded.length; offset += 1024) {
+        write(decoder.decode(encoded.subarray(offset, offset + 1024), { stream: true }))
+      }
+    }
+    const wait = () => {
+      const settled = vi.fn()
+      const promise = pane.runtime.waitForTerminal(pane.handle, {
+        condition: 'tui-idle',
+        timeoutMs: 60_000
+      })
+      promise.then(settled, () => {})
+      return { promise, settled }
+    }
+    const titleResolveCount = () =>
+      titleResolves.reduce((sum, spy) => sum + spy.mock.calls.length, 0)
+    return { data, write, paint, wait, titleResolveCount }
+  }
+
+  it('reports the dialog to a wait registered after the pane has gone quiet', async () => {
+    const pane = await createPane()
+    OH_MY_ZSH_TITLES.forEach(pane.write)
+    pane.paint()
+    await vi.advanceTimersByTimeAsync(QUIESCENCE_MS + 500)
+
+    const { promise } = pane.wait()
+    await vi.advanceTimersByTimeAsync(0)
+    await expect(promise).resolves.toMatchObject({
+      satisfied: false,
+      blockedReason: 'agent-trust-workspace'
+    })
+  })
+
+  // Why the resolver differs: the command-line title reads as `permission`, and a
+  // permission-to-idle step is not offered to waiters, so oh-my-zsh reaches the poll instead.
+  it.each([
+    ['oh-my-zsh', OH_MY_ZSH_TITLES, false],
+    ['fish', [FISH_TITLE], true]
+  ])(
+    'does not settle ready when the %s title arrives before the dialog paints',
+    async (_, titles, offered) => {
+      const pane = await createPane()
+      const { promise, settled } = pane.wait()
+      titles.forEach(pane.write)
+      expect(pane.titleResolveCount() > 0).toBe(offered)
+      await vi.advanceTimersByTimeAsync(POLL_INTERVAL_MS)
+      expect(settled).not.toHaveBeenCalled()
+
+      pane.paint()
+      await vi.advanceTimersByTimeAsync(POLL_INTERVAL_MS)
+      await expect(promise).resolves.toMatchObject({
+        satisfied: false,
+        blockedReason: 'agent-trust-workspace'
+      })
+    }
+  )
+
+  it('does not settle ready when the exit probe restores the name-only title', async () => {
+    const pane = await createPane()
+    const { promise, settled } = pane.wait()
+    pane.write('\x1b]1;claude\x07')
+    const resolvesBeforeRestore = pane.titleResolveCount()
+    // A neutral title reads as the agent exiting; the probe finds `claude` still in front and
+    // restores the idle status, offering it to the waiters again.
+    pane.write('\x1b]0;~/p/repo\x07')
+    await vi.advanceTimersByTimeAsync(0)
+    expect(pane.titleResolveCount()).toBeGreaterThan(resolvesBeforeRestore)
+    expect(settled).not.toHaveBeenCalled()
+
+    pane.paint()
+    await vi.advanceTimersByTimeAsync(POLL_INTERVAL_MS)
+    await expect(promise).resolves.toMatchObject({
+      satisfied: false,
+      blockedReason: 'agent-trust-workspace'
+    })
+  })
+
+  it("reports ready at once when Claude's own idle title follows the answer", async () => {
+    const pane = await createPane('claude-dialog-trust-workspace-answered')
+    OH_MY_ZSH_TITLES.forEach(pane.write)
+    pane.paint()
+    const { promise } = pane.wait()
+    await vi.advanceTimersByTimeAsync(0)
+    await expect(promise).resolves.toMatchObject({ satisfied: true })
+  })
+
+  it('reports ready after the quiet window when Claude paints no title of its own', async () => {
+    const pane = await createPane('claude-dialog-trust-workspace-answered')
+    OH_MY_ZSH_TITLES.forEach(pane.write)
+    pane.paint(pane.data.replace(OSC_0_TITLE, ''))
+    const { promise, settled } = pane.wait()
+    await vi.advanceTimersByTimeAsync(QUIESCENCE_MS - 500)
+    expect(settled).not.toHaveBeenCalled()
+
+    await vi.advanceTimersByTimeAsync(POLL_INTERVAL_MS * 2)
+    const wait = await promise
+    expect(wait).toMatchObject({ satisfied: true })
+    expect(wait).not.toHaveProperty('blockedReason')
+  })
+})
diff --git a/src/main/runtime/codex-header-readiness-transcripts.test.ts b/src/main/runtime/codex-header-readiness-transcripts.test.ts
new file mode 100644
index 000000000000..6cb3c08179ff
--- /dev/null
+++ b/src/main/runtime/codex-header-readiness-transcripts.test.ts
@@ -0,0 +1,218 @@
+import { readFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { describe, expect, it, vi } from 'vitest'
+import { HeadlessEmulator } from '../daemon/headless-emulator'
+import { createTranscriptPane } from './agent-transcript-pane-test-harness'
+import { projectTerminalVisibleLines } from './orca-runtime-terminal-projection'
+import { normalizeTerminalChunk } from './terminal-ansi-normalization'
+import { appendNormalizedToTailBuffer } from './terminal-tail-buffer'
+import { buildPreview } from './terminal-tail-state'
+import { isKnownReadyPromptBody, isKnownReadyPromptPreview } from './terminal-wait-detection'
+import { buildTerminalWaitText } from './terminal-wait-tail-state'
+
+vi.mock('electron', () => ({
+  BrowserWindow: { fromId: vi.fn(() => null) },
+  webContents: { fromId: vi.fn(() => null) },
+  ipcMain: { on: vi.fn(), removeListener: vi.fn() },
+  app: { getPath: vi.fn(() => '/tmp') }
+}))
+
+// codex-cli 0.157.1 recordings at 120x40 (see each .meta.json); STA-8628.
+const PLAIN = 'codex-0157-plain-ready'
+const EFFORT_OVERRIDE = 'codex-0157-effort-override-embedded-warning'
+const CONFIG_OVERRIDE = 'codex-0157-config-override-embedded-warning'
+const NO_DAEMON = 'codex-0157-no-daemon-effort-override'
+const ALL_FIXTURES = [PLAIN, EFFORT_OVERRIDE, CONFIG_OVERRIDE, NO_DAEMON]
+const CHUNK_CHARS = 64
+
+function readFixture(name: string): string {
+  return readFileSync(join(__dirname, '__fixtures__', `${name}.txt`), 'utf8')
+}
+
+type ReplayFrame = { screenLines: string[]; waitText: string }
+
+/** Feeds the bytes the way onPtyData does: one emulator grid, one line-folded wait text. */
+async function* replay(data: string, cols: number, rows: number): AsyncGenerator<ReplayFrame> {
+  const emulator = new HeadlessEmulator({ cols, rows })
+  let lines: string[] = []
+  let partialLine = ''
+  let pendingAnsi = ''
+  let redrawCursor: ReturnType<typeof appendNormalizedToTailBuffer>['redrawCursor'] = null
+  try {
+    for (let offset = 0; offset < data.length; offset += CHUNK_CHARS) {
+      const chunk = data.slice(offset, offset + CHUNK_CHARS)
+      await emulator.write(chunk)
+      const normalized = normalizeTerminalChunk(chunk, pendingAnsi)
+      pendingAnsi = normalized.pendingAnsi
+      const tail = appendNormalizedToTailBuffer(lines, partialLine, normalized.text, redrawCursor)
+      lines = tail.lines
+      partialLine = tail.partialLine
+      redrawCursor = tail.redrawCursor
+      yield {
+        screenLines: projectTerminalVisibleLines(emulator).lines,
+        waitText: buildTerminalWaitText(lines, partialLine, buildPreview(lines, partialLine))
+      }
+    }
+  } finally {
+    emulator.dispose()
+  }
+}
+
+async function finalFrame(name: string, cols: number, rows: number): Promise<ReplayFrame> {
+  let last: ReplayFrame | null = null
+  for await (const frame of replay(readFixture(name), cols, rows)) {
+    last = frame
+  }
+  if (!last) {
+    throw new Error(`empty fixture ${name}`)
+  }
+  return last
+}
+
+function screenShowsLoadingHeader(screenLines: string[]): boolean {
+  const screen = screenLines.join('\n').toLowerCase()
+  return screen.includes('openai codex') && /(?:model|directory):\s+loading/.test(screen)
+}
+
+describe('Codex 0.157 header readiness from captured bytes', () => {
+  it.each([EFFORT_OVERRIDE, CONFIG_OVERRIDE])(
+    '%s: the line-folded wait text never shows a ready header',
+    async (name) => {
+      const { waitText } = await finalFrame(name, 120, 40)
+      // Why: the cell-diff repaint folds to `dirctory:` — the STA-8628 timeout.
+      expect(waitText.toLowerCase()).toContain('dirctory:')
+      expect(isKnownReadyPromptPreview(waitText)).toBe(false)
+    }
+  )
+
+  it.each(ALL_FIXTURES)(
+    '%s: the screen never adds readiness while loading, and is ready at the final screen',
+    async (name) => {
+      let sawLoadingHeader = false
+      let last: ReplayFrame | null = null
+      for await (const frame of replay(readFixture(name), 120, 40)) {
+        if (screenShowsLoadingHeader(frame.screenLines)) {
+          sawLoadingHeader = true
+          expect(isKnownReadyPromptBody('', 'codex', () => frame.screenLines)).toBe(false)
+        }
+        last = frame
+      }
+      // Presence precondition: a loading frame was actually exercised.
+      expect(sawLoadingHeader).toBe(true)
+      expect(last).not.toBeNull()
+      expect(isKnownReadyPromptBody(last!.waitText, 'codex', () => last!.screenLines)).toBe(true)
+    }
+  )
+
+  // Why these sizes: grids out of step with the 120x40 recording garble the header (review of #23475).
+  describe.each([
+    [120, 40],
+    [80, 24],
+    [30, 50],
+    [108, 30],
+    [60, 5]
+  ])('at %ix%i the screen never takes readiness away from the text rules', (cols, rows) => {
+    it.each(ALL_FIXTURES)('%s', async (name) => {
+      for await (const frame of replay(readFixture(name), cols, rows)) {
+        if (isKnownReadyPromptPreview(frame.waitText)) {
+          expect(isKnownReadyPromptBody(frame.waitText, 'codex', () => frame.screenLines)).toBe(
+            true
+          )
+        }
+      }
+    })
+  })
+
+  it('keeps the text rules when there is no live screen', async () => {
+    const { waitText } = await finalFrame(PLAIN, 120, 40)
+    expect(isKnownReadyPromptBody(waitText, 'codex', () => null)).toBe(
+      isKnownReadyPromptPreview(waitText)
+    )
+    expect(isKnownReadyPromptBody(waitText, 'codex', () => null)).toBe(true)
+  })
+
+  it('does not read a mid-turn composer as ready', () => {
+    const screenLines = [
+      '› Summarize the repository layout',
+      '• Working (12s • esc to interrupt)',
+      '› Ask Codex to do anything',
+      '  GPT-6-Sol high · ~/repo/app'
+    ]
+    expect(isKnownReadyPromptBody(screenLines.join('\n'), 'codex', () => screenLines)).toBe(false)
+  })
+
+  it('does not settle when a blocking dialog is painted below the header', () => {
+    const screenLines = [
+      '│ >_ OpenAI Codex (v0.157.1)                               │',
+      '│ model:       GPT-6-Sol high   /model to change           │',
+      '│ directory:   ~/repo/app                                  │',
+      'Do you trust the contents of this directory?',
+      'Press enter to continue'
+    ]
+    expect(isKnownReadyPromptBody('', 'codex', () => screenLines)).toBe(false)
+  })
+
+  it('reads only the header box, not chat below it that mentions Codex', () => {
+    const screenLines = [
+      '╭──────────────────────────────────────────────────────────╮',
+      '│ >_ OpenAI Codex (v0.157.1)                               │',
+      '│ model:       GPT-6-Sol high   /model to change           │',
+      '│ directory:   ~/repo/app                                  │',
+      '╰──────────────────────────────────────────────────────────╯',
+      '› Why does OpenAI Codex print model: loading at startup?'
+    ]
+    expect(isKnownReadyPromptBody('', 'codex', () => screenLines)).toBe(true)
+  })
+
+  it('leaves a non-codex pane on the text rules even when its screen shows the Codex header', () => {
+    const screenLines = [
+      '│ >_ OpenAI Codex (v0.157.1)                               │',
+      '│ model:       GPT-6-Sol high   /model to change           │',
+      '│ directory:   ~/repo/app                                  │'
+    ]
+    const readScreenLines = vi.fn(() => screenLines)
+    expect(isKnownReadyPromptBody('', 'claude', readScreenLines)).toBe(false)
+    expect(readScreenLines).not.toHaveBeenCalled()
+    expect(isKnownReadyPromptBody('', 'codex', readScreenLines)).toBe(true)
+  })
+
+  describe('at the 80x24 default grid the header garbles and today’s answer stands', () => {
+    it.each(ALL_FIXTURES)('%s', async (name) => {
+      const { screenLines, waitText } = await finalFrame(name, 80, 24)
+      expect(isKnownReadyPromptBody(waitText, 'codex', () => screenLines)).toBe(
+        isKnownReadyPromptPreview(waitText)
+      )
+    })
+  })
+
+  describe('through the runtime', () => {
+    async function codexPane(name: string, size?: { cols: number; rows: number }) {
+      return createTranscriptPane({
+        paneTitle: 'Terminal',
+        foregroundProcess: 'codex',
+        launchAgent: 'codex',
+        data: readFixture(name),
+        size
+      })
+    }
+
+    it.each(ALL_FIXTURES)(
+      '%s: a tui-idle wait settles from the live screen',
+      async (name) => {
+        const { runtime, handle } = await codexPane(name, { cols: 120, rows: 40 })
+        // Why 5s: the poll re-reads the grid every 2s once the queued emulator write lands.
+        await expect(
+          runtime.waitForTerminal(handle, { condition: 'tui-idle', timeoutMs: 5_000 })
+        ).resolves.toMatchObject({ condition: 'tui-idle', satisfied: true })
+      },
+      15_000
+    )
+
+    it('keeps timing out on the garbled 80x24 default grid, as before', async () => {
+      const { runtime, handle } = await codexPane(EFFORT_OVERRIDE)
+      await expect(
+        runtime.waitForTerminal(handle, { condition: 'tui-idle', timeoutMs: 2_500 })
+      ).rejects.toThrow(/timeout/)
+    }, 15_000)
+  })
+})
diff --git a/src/main/runtime/created-mobile-session-tab-caller-selection.test.ts b/src/main/runtime/created-mobile-session-tab-caller-selection.test.ts
new file mode 100644
index 000000000000..65fc065a5a36
--- /dev/null
+++ b/src/main/runtime/created-mobile-session-tab-caller-selection.test.ts
@@ -0,0 +1,114 @@
+/**
+ * A tab a create just published becomes one paired client's selection: the shared snapshot the host
+ * and unselected clients follow stays put, and no PTY work runs — unlike a tap, which may respawn.
+ */
+import { expect, it, vi } from 'vitest'
+import { parsePaneKey } from '../../shared/stable-pane-id'
+import type { RuntimeMobileSessionTabsResult } from '../../shared/runtime-types'
+
+// Fragments stay side-effect ordered: mocks, then lifecycle, then fixtures.
+const { OrcaRuntimeService } = await import('./orca-runtime-test-mocks.spec')
+await import('./orca-runtime-test-lifecycle.spec')
+const { store, TEST_WORKTREE_ID, HEADLESS_LEAF_ID } =
+  await import('./orca-runtime-test-fixtures.spec')
+const { makePendingAgentTabActivationRuntime } =
+  await import('./orca-runtime-test-scenario-builders.spec')
+
+const WT = TEST_WORKTREE_ID
+
+function pairedRuntime() {
+  let next = 0
+  const spawn = vi.fn(async () => ({ id: `pty-${++next}` }))
+  const runtime = new OrcaRuntimeService(store)
+  runtime.setPtyController({
+    spawn,
+    write: () => true,
+    kill: () => true,
+    getForegroundProcess: async () => null
+  })
+  const caller: RuntimeMobileSessionTabsResult[] = []
+  runtime.onMobileSessionTabsChanged((snapshot) => caller.push(snapshot), 'device-caller')
+  // A subscribed second device: selection that fans out to live clients would move it too.
+  runtime.onMobileSessionTabsChanged(() => {}, 'device-bystander')
+  return { runtime, spawn, caller }
+}
+
+async function createPane(runtime: InstanceType<typeof OrcaRuntimeService>) {
+  const created = await runtime.createTerminal(`id:${WT}`)
+  const pane = parsePaneKey(created.paneKey ?? '')
+  if (!pane) {
+    throw new Error(`createTerminal returned no pane key: ${created.paneKey}`)
+  }
+  return { tabId: pane.tabId, leafId: pane.leafId, id: `${pane.tabId}::${pane.leafId}` }
+}
+
+it('selects a launched terminal for the caller only, without spawning again', async () => {
+  const { runtime, spawn, caller } = pairedRuntime()
+  const first = await createPane(runtime)
+  const launched = await createPane(runtime)
+  expect((await runtime.listMobileSessionTabs(`id:${WT}`)).activeTabId).toBe(first.id)
+
+  expect(runtime.selectCreatedMobileSessionTabForClient(WT, launched, 'device-caller')).toBe(true)
+
+  expect(caller.at(-1)?.activeTabId).toBe(launched.id)
+  expect((await runtime.listMobileSessionTabs(`id:${WT}`, 'device-caller')).activeTabId).toBe(
+    launched.id
+  )
+  expect((await runtime.listMobileSessionTabs(`id:${WT}`)).activeTabId).toBe(first.id)
+  expect((await runtime.listMobileSessionTabs(`id:${WT}`, 'device-bystander')).activeTabId).toBe(
+    first.id
+  )
+  expect(spawn).toHaveBeenCalledTimes(2)
+})
+
+it('selects a launched chat by its session for the caller only', async () => {
+  const { runtime, caller } = pairedRuntime()
+  const first = await createPane(runtime)
+  await runtime.publishStructuredAgentSessionTab({
+    workspaceId: WT,
+    sessionId: 'sess-1',
+    agent: 'claude',
+    activate: false
+  })
+
+  expect(
+    runtime.selectCreatedMobileSessionTabForClient(WT, { sessionId: 'sess-1' }, 'device-caller')
+  ).toBe(true)
+
+  expect(caller.at(-1)?.activeTabId).toBe('agent-session:sess-1')
+  expect((await runtime.listMobileSessionTabs(`id:${WT}`)).activeTabId).toBe(first.id)
+  expect((await runtime.listMobileSessionTabs(`id:${WT}`, 'device-bystander')).activeTabId).toBe(
+    first.id
+  )
+})
+
+it('reports a tab that is not published instead of selecting something else', async () => {
+  const { runtime, caller } = pairedRuntime()
+  await createPane(runtime)
+  const before = caller.length
+
+  expect(
+    runtime.selectCreatedMobileSessionTabForClient(WT, { sessionId: 'missing' }, 'device-caller')
+  ).toBe(false)
+  expect(caller).toHaveLength(before)
+})
+
+it('never materializes a pane that is not ready, as a tap would', async () => {
+  const { runtime, spawn } = makePendingAgentTabActivationRuntime()
+  const listed = await runtime.listMobileSessionTabs(`id:${WT}`)
+  expect(listed.tabs[0]).toMatchObject({ launchAgent: 'claude', status: 'pending-handle' })
+
+  expect(
+    runtime.selectCreatedMobileSessionTabForClient(
+      WT,
+      { tabId: 'host-tab', leafId: HEADLESS_LEAF_ID },
+      'device-caller'
+    )
+  ).toBe(true)
+
+  const selected = await runtime.listMobileSessionTabs(`id:${WT}`, 'device-caller')
+  expect(selected.activeTabId).toBe(`host-tab::${HEADLESS_LEAF_ID}`)
+  // Why wait: a tap's respawn lands several awaits later, so an immediate check cannot see one.
+  await new Promise((resolve) => setTimeout(resolve, 200))
+  expect(spawn).not.toHaveBeenCalled()
+})
diff --git a/src/main/runtime/dsh-readiness-transcript.test.ts b/src/main/runtime/dsh-readiness-transcript.test.ts
new file mode 100644
index 000000000000..36608b987b0c
--- /dev/null
+++ b/src/main/runtime/dsh-readiness-transcript.test.ts
@@ -0,0 +1,71 @@
+import { readFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { describe, expect, it } from 'vitest'
+import { createDraftPasteReadyScanner } from '../../shared/draft-paste-ready-scanner'
+import {
+  getAgentLabel,
+  isGeminiTerminalTitle,
+  resolveExplicitTerminalTitleAgentType
+} from '../../shared/terminal-title-agent-type'
+
+// The committed capture of a real `dsh-tui` 0.10.2 launch on @deepseek-ai/dsh 0.1.5-rc.1.
+// Every rule below is written against these bytes rather than a remembered screen; see
+// docs/reference/agent-pty-transcript-capture.md.
+const TRANSCRIPT = readFileSync(join(__dirname, '__fixtures__', 'dsh-tui-ready-no-key.txt'), 'utf8')
+
+const ESC = String.fromCharCode(27)
+const BEL = String.fromCharCode(7)
+
+/** The OSC 0 title DSH-TUI sets, read back out of the capture. */
+function readFirstOscTitle(data: string): string {
+  // Indexed scan rather than a regex: the delimiters are control characters.
+  const open = data.indexOf(`${ESC}]0;`)
+  const bodyStart = open === -1 ? -1 : open + 4
+  const terminator = bodyStart === -1 ? -1 : data.indexOf(BEL, bodyStart)
+  if (terminator === -1) {
+    throw new Error('the captured transcript carries no BEL-terminated OSC 0 title')
+  }
+  return data.slice(bodyStart, terminator)
+}
+
+describe('DSH-TUI readiness from captured terminal bytes', () => {
+  it('fires the composer-ready signal well before the transcript ends', () => {
+    const scanner = createDraftPasteReadyScanner('dsh-composer-prompt')
+    let readyAt = -1
+    // Feed it in PTY-sized chunks so a marker split across chunk boundaries is exercised.
+    for (let offset = 0; offset < TRANSCRIPT.length; offset += 1024) {
+      const chunk = TRANSCRIPT.slice(offset, offset + 1024)
+      if (scanner.observe(chunk).ready && readyAt === -1) {
+        readyAt = offset + chunk.length
+      }
+    }
+    // The composer glyph lands at byte 5910 of ~70KB: readiness must not wait out the
+    // whale intro that keeps painting behind it (the grok failure mode this signal fixes).
+    expect(readyAt).toBeGreaterThan(0)
+    expect(readyAt).toBeLessThan(8192)
+  })
+
+  it('arms the quiet-window fallback from DECSET 2004 as well', () => {
+    const scanner = createDraftPasteReadyScanner('dsh-composer-prompt')
+    expect(scanner.observe(TRANSCRIPT.slice(0, 40)).armQuietTimer).toBe(true)
+  })
+
+  it('identifies the pane from DSH’s own title, not Gemini’s', () => {
+    const title = readFirstOscTitle(TRANSCRIPT)
+    // DSH-TUI's idle prefix is `✦`, which is Gemini CLI's WORKING glyph.
+    expect(title).toContain('✦')
+    expect(title).toContain('\u{1F40B}')
+    expect(isGeminiTerminalTitle(title)).toBe(false)
+    expect(getAgentLabel(title)).toBe('DeepSeek Harness')
+    expect(resolveExplicitTerminalTitleAgentType(title)).toBe('dsh')
+  })
+
+  it('keeps a working DSH title out of Claude’s braille-spinner lane', () => {
+    // `titlePrefix` cycles through `⠂`/`⠐` while a turn runs (Chat.js
+    // TITLE_SPINNER_FRAMES), both of which are in the braille block Claude claims.
+    for (const frame of ['⠂', '⠐']) {
+      const working = `${frame} \u{1F40B} fix the flaky test`
+      expect(getAgentLabel(working)).toBe('DeepSeek Harness')
+    }
+  })
+})
diff --git a/src/main/runtime/folder-workspace-pty-identity.test.ts b/src/main/runtime/folder-workspace-pty-identity.test.ts
index db14f74bad80..43eb15f66b32 100644
--- a/src/main/runtime/folder-workspace-pty-identity.test.ts
+++ b/src/main/runtime/folder-workspace-pty-identity.test.ts
@@ -1,3 +1,4 @@
+import { withDurableRuntimeStore } from './runtime-durable-store-fixture'
 import { describe, expect, it } from 'vitest'
 import { getDefaultWorkspaceSession } from '../../shared/constants'
 import type { RuntimeClientEvent } from '../../shared/runtime-client-events'
@@ -66,7 +67,8 @@ function createRuntimeInternals(
     [WORKSPACE_A]: { hostId: 'local' },
     [WORKSPACE_B]: { hostId: 'local' }
   }
-  const store = {
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: This runtime fixture supplies the persistence and graph methods exercised by the test.
+  const store = withDurableRuntimeStore({
     getRepos: () => [REPO],
     getRepo: (id: string) => (id === REPO_ID ? REPO : undefined),
     getAllWorktreeMeta: () => meta,
@@ -78,7 +80,7 @@ function createRuntimeInternals(
     getWorkspaceSession: () => options.session ?? getDefaultWorkspaceSession(),
     setWorkspaceSession: () => {},
     flushOrThrow: () => {}
-  } as never
+  }) as never
   const runtime = new OrcaRuntimeService(store)
   runtime.setPtyController({
     write: () => true,
diff --git a/src/main/runtime/freebuff-status-transcript.test.ts b/src/main/runtime/freebuff-status-transcript.test.ts
new file mode 100644
index 000000000000..04aa1e0a2abd
--- /dev/null
+++ b/src/main/runtime/freebuff-status-transcript.test.ts
@@ -0,0 +1,146 @@
+import { readFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { describe, expect, it, vi } from 'vitest'
+import { createTranscriptPane, TRANSCRIPT_PANE_PTY_ID } from './agent-transcript-pane-test-harness'
+import { makeAgentStatusStoreWiring } from './agent-status-store-wiring.test-fixture'
+
+vi.mock('electron', () => ({
+  BrowserWindow: { fromId: vi.fn(() => null) },
+  webContents: { fromId: vi.fn(() => null) },
+  ipcMain: { on: vi.fn(), removeListener: vi.fn() },
+  app: { getPath: vi.fn(() => '/tmp') }
+}))
+
+const transcript = readFileSync(
+  join(import.meta.dirname, '__fixtures__/freebuff-lifecycle.txt'),
+  'utf8'
+)
+
+describe('Freebuff execution-host status', () => {
+  it('publishes real running, question, and settled screens into the canonical store', async () => {
+    const wiring = makeAgentStatusStoreWiring()
+    const { runtime } = await createTranscriptPane(
+      {
+        data: '',
+        paneTitle: 'Freebuff',
+        foregroundProcess: 'freebuff',
+        launchAgent: 'freebuff',
+        size: { cols: 120, rows: 40 }
+      },
+      wiring.deps
+    )
+    const states: string[] = []
+    const questions: string[] = []
+    try {
+      // oxlint-disable-next-line no-control-regex -- Terminal protocol delimiters contain ESC and BEL.
+      for (const frame of transcript.split(/(?<=\x1b\[\?2026l)/)) {
+        runtime.onPtyData(TRANSCRIPT_PANE_PTY_ID, frame, Date.now())
+        await runtime.serializeMainTerminalBuffer(TRANSCRIPT_PANE_PTY_ID)
+        const row = wiring.statusStore.getStatusSnapshot()[0]
+        if (row && states.at(-1) !== row.state) {
+          states.push(row.state)
+        }
+        if (row?.interactivePrompt) {
+          questions.push(row.interactivePrompt)
+        }
+      }
+      expect(states).toContain('working')
+      expect(states).toContain('waiting')
+      expect(states.at(-1)).toBe('done')
+      expect(questions.join('\n')).toMatch(/blue|green/i)
+    } finally {
+      runtime.onPtyExit(TRANSCRIPT_PANE_PTY_ID, 0)
+    }
+  })
+  it.each([
+    { name: 'login', cols: 100, rows: 32, input: 'Sign in to Freebuff' },
+    { name: 'trust', cols: 120, rows: 40, input: 'Trust repository agent files? [y/N]' }
+  ])('publishes captured $name startup as blocked', async ({ name, cols, rows, input }) => {
+    const wiring = makeAgentStatusStoreWiring()
+    const { runtime } = await createTranscriptPane(
+      {
+        data: '',
+        paneTitle: 'Freebuff',
+        foregroundProcess: 'freebuff',
+        launchAgent: 'freebuff',
+        size: { cols, rows }
+      },
+      wiring.deps
+    )
+    try {
+      runtime.onPtyData(
+        TRANSCRIPT_PANE_PTY_ID,
+        readFileSync(join(import.meta.dirname, `__fixtures__/freebuff-${name}.txt`), 'utf8'),
+        Date.now()
+      )
+      await runtime.serializeMainTerminalBuffer(TRANSCRIPT_PANE_PTY_ID)
+      expect(wiring.statusStore.getStatusSnapshot()[0]).toMatchObject({
+        state: 'blocked',
+        toolInput: input,
+        agentType: 'freebuff'
+      })
+    } finally {
+      runtime.onPtyExit(TRANSCRIPT_PANE_PTY_ID, 0)
+    }
+  })
+
+  it('clears startup blocks and starts a fresh session after an earlier completed turn', async () => {
+    const wiring = makeAgentStatusStoreWiring()
+    const { runtime } = await createTranscriptPane(
+      {
+        data: '',
+        paneTitle: 'Freebuff',
+        foregroundProcess: 'freebuff',
+        launchAgent: 'freebuff',
+        size: { cols: 120, rows: 40 }
+      },
+      wiring.deps
+    )
+    try {
+      for (const name of ['trust', 'ready', 'lifecycle', 'ready']) {
+        runtime.onPtyData(
+          TRANSCRIPT_PANE_PTY_ID,
+          readFileSync(join(import.meta.dirname, `__fixtures__/freebuff-${name}.txt`), 'utf8'),
+          Date.now()
+        )
+        await runtime.serializeMainTerminalBuffer(TRANSCRIPT_PANE_PTY_ID)
+        expect(wiring.statusStore.getStatusSnapshot()[0]?.state).toBe(
+          name === 'trust' ? 'blocked' : 'done'
+        )
+        if (name === 'ready') {
+          expect(wiring.statusStore.getStatusSnapshot()[0]).toMatchObject({
+            sessionBoundary: true,
+            prompt: ''
+          })
+        }
+        if (name === 'lifecycle') {
+          expect(wiring.statusStore.getStatusSnapshot()[0]?.sessionBoundary).not.toBe(true)
+        }
+      }
+      expect(wiring.statusStore.getStatusSnapshot()[0]?.toolInput).toBeUndefined()
+    } finally {
+      runtime.onPtyExit(TRANSCRIPT_PANE_PTY_ID, 0)
+    }
+  })
+
+  it('does not infer remote status from the client screen', async () => {
+    const wiring = makeAgentStatusStoreWiring()
+    const { runtime } = await createTranscriptPane(
+      {
+        data: '',
+        paneTitle: 'Freebuff',
+        foregroundProcess: 'freebuff',
+        connectionId: 'ssh-test',
+        size: { cols: 120, rows: 40 }
+      },
+      wiring.deps
+    )
+    try {
+      runtime.onPtyData(TRANSCRIPT_PANE_PTY_ID, transcript, Date.now())
+      await runtime.serializeMainTerminalBuffer(TRANSCRIPT_PANE_PTY_ID)
+      expect(wiring.statusStore.getStatusSnapshot()).toEqual([])
+    } finally {
+      runtime.onPtyExit(TRANSCRIPT_PANE_PTY_ID, 0)
+    }
+  })
+})
diff --git a/src/main/runtime/freebuff-terminal-status.ts b/src/main/runtime/freebuff-terminal-status.ts
new file mode 100644
index 000000000000..09ffee3d50d0
--- /dev/null
+++ b/src/main/runtime/freebuff-terminal-status.ts
@@ -0,0 +1,25 @@
+import { FreebuffScreenStatusTracker } from '../../shared/freebuff-screen-status'
+import { recognizeAgentProcessFromCommandLine } from '../../shared/agent-process-recognition'
+import type { HeadlessEmulator } from '../daemon/headless-emulator'
+
+const trackers = new WeakMap<HeadlessEmulator, FreebuffScreenStatusTracker>()
+
+export function observeFreebuffTerminalStatus(
+  emulator: HeadlessEmulator,
+  data: string,
+  startupCommand: string | undefined,
+  launchAgent?: string | null
+) {
+  let tracker = trackers.get(emulator)
+  if (!tracker) {
+    const identified =
+      launchAgent === 'freebuff' ||
+      recognizeAgentProcessFromCommandLine(startupCommand)?.agent === 'freebuff'
+    tracker = new FreebuffScreenStatusTracker(identified)
+    trackers.set(emulator, tracker)
+  }
+  return tracker.observe(data, () => ({
+    lines: emulator.getVisibleLines(),
+    alternate: emulator.isAlternateScreen
+  }))
+}
diff --git a/src/main/runtime/graph-sync-live-daemon-pty-tab-preservation.test.ts b/src/main/runtime/graph-sync-live-daemon-pty-tab-preservation.test.ts
index e91f18e8c6d8..a824191bb90a 100644
--- a/src/main/runtime/graph-sync-live-daemon-pty-tab-preservation.test.ts
+++ b/src/main/runtime/graph-sync-live-daemon-pty-tab-preservation.test.ts
@@ -1,3 +1,4 @@
+import { withDurableRuntimeStore } from './runtime-durable-store-fixture'
 /**
  * shouldPreserveHeadlessMobileSessionTab excludes the daemon ptyId form
  * <worktreeId>@@<uuid> from its runtime-owned checks, so a host-created terminal
@@ -51,7 +52,7 @@ function createHarness() {
   // Starts empty: only the create path may put this terminal in the session.
   let session: WorkspaceSessionState = { ...getDefaultWorkspaceSession() }
   const repo = makeRepo()
-  const store = {
+  const store = withDurableRuntimeStore({
     getRepos: () => [repo],
     getRepo: (id: string) => (id === REPO_ID ? repo : undefined),
     getAllWorktreeMeta: () => ({}),
@@ -63,7 +64,7 @@ function createHarness() {
       session = next
     },
     flushOrThrow: () => {}
-  }
+  })
   const runtime = new OrcaRuntimeService(store as never)
   runtime.setNotifier({
     closeTerminal: vi.fn(),
diff --git a/src/main/runtime/headless-close-keeps-publication-epoch.test.ts b/src/main/runtime/headless-close-keeps-publication-epoch.test.ts
index b33579b783c1..1a0344f393b7 100644
--- a/src/main/runtime/headless-close-keeps-publication-epoch.test.ts
+++ b/src/main/runtime/headless-close-keeps-publication-epoch.test.ts
@@ -1,4 +1,5 @@
 import { describe, expect, it, vi } from 'vitest'
+import type { DurableProfileStateMutation } from '../persistence/loading-store/store-runtime-state'
 import { OrcaRuntimeService } from './orca-runtime'
 import { getDefaultWorkspaceSession } from '../../shared/constants'
 import type {
@@ -25,7 +26,7 @@ function makeStore() {
   return {
     getWorkspaceSession: vi.fn(() => session),
     setWorkspaceSession: vi.fn(),
-    flushOrThrow: vi.fn(),
+    runDurableMutation: async <T>(mutate: () => DurableProfileStateMutation<T>) => mutate().value,
     getRepos: vi.fn(() => [
       {
         id: 'repo-1',
@@ -68,7 +69,7 @@ function storedSnapshot(tabs: RuntimeMobileSessionTerminalTab[]): RuntimeMobileS
   }
 }
 
-function closeOneTab(): RuntimeMobileSessionTabsSnapshot {
+async function closeOneTab(): Promise<RuntimeMobileSessionTabsSnapshot> {
   // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: makeStore covers the reads this suite drives.
   const runtime = new OrcaRuntimeService(makeStore() as never)
   const closedTab = terminalTab('tab-a', LEAF_ID)
@@ -80,11 +81,11 @@ function closeOneTab(): RuntimeMobileSessionTabsSnapshot {
       snapshot: RuntimeMobileSessionTabsSnapshot,
       tab: RuntimeMobileSessionTerminalTab,
       options?: Record<string, unknown>
-    ) => void
+    ) => Promise<void>
     mobileSessionTabsByWorktree: Map<string, RuntimeMobileSessionTabsSnapshot>
   }
   internals.mobileSessionTabsByWorktree.set(WORKTREE_ID, snapshot)
-  internals.closeHeadlessMobileTerminalTab(WORKTREE_ID, snapshot, closedTab, {
+  await internals.closeHeadlessMobileTerminalTab(WORKTREE_ID, snapshot, closedTab, {
     allowMissingPersistedTab: true,
     killPtys: false
   })
@@ -96,12 +97,12 @@ function closeOneTab(): RuntimeMobileSessionTabsSnapshot {
 }
 
 describe('closing a headless mobile terminal tab', () => {
-  it('keeps the worktree under the epoch that was already publishing it', () => {
-    expect(closeOneTab().publicationEpoch).toBe(LIVE_EPOCH)
+  it('keeps the worktree under the epoch that was already publishing it', async () => {
+    expect((await closeOneTab()).publicationEpoch).toBe(LIVE_EPOCH)
   })
 
-  it('still advances the version so clients accept the frame', () => {
-    const published = closeOneTab()
+  it('still advances the version so clients accept the frame', async () => {
+    const published = await closeOneTab()
     expect(published.snapshotVersion).toBe(5)
     expect(published.tabs.map((tab) => tab.id)).toEqual([`tab-b::${LEAF_ID}`])
   })
diff --git a/src/main/runtime/headless-seed-ownership.test.ts b/src/main/runtime/headless-seed-ownership.test.ts
index 39963e531d27..42fe9c91660d 100644
--- a/src/main/runtime/headless-seed-ownership.test.ts
+++ b/src/main/runtime/headless-seed-ownership.test.ts
@@ -184,13 +184,15 @@ it.each([false, true])(
     const started = makeDeferred()
     const release = makeDeferred()
     const original = HeadlessEmulator.prototype.write
-    vi.spyOn(HeadlessEmulator.prototype, 'write').mockImplementationOnce(
-      async function (this: HeadlessEmulator, data, options) {
-        started.resolve()
-        await release.promise
-        return original.call(this, data, options)
-      }
-    )
+    vi.spyOn(HeadlessEmulator.prototype, 'write').mockImplementationOnce(async function (
+      this: HeadlessEmulator,
+      data,
+      options
+    ) {
+      started.resolve()
+      await release.promise
+      return original.call(this, data, options)
+    })
     const read = runtime.providerTail(visibleOnly)
     snapshot.resolve(PROVIDER_SNAPSHOT)
     await started.promise
diff --git a/src/main/runtime/headless-terminal-dispose-write-ordering.test.ts b/src/main/runtime/headless-terminal-dispose-write-ordering.test.ts
index b26c7bfb62c2..13efbb1e80ae 100644
--- a/src/main/runtime/headless-terminal-dispose-write-ordering.test.ts
+++ b/src/main/runtime/headless-terminal-dispose-write-ordering.test.ts
@@ -71,12 +71,12 @@ describe('disposeHeadlessTerminal write ordering', () => {
       events.push(`write:${emulators.indexOf(this)}:${data.trim()}`)
       return write.call(this, data, opts)
     })
-    vi.spyOn(HeadlessEmulator.prototype, 'dispose').mockImplementation(
-      function (this: HeadlessEmulator) {
-        events.push(`dispose:${emulators.indexOf(this)}`)
-        return dispose.call(this)
-      }
-    )
+    vi.spyOn(HeadlessEmulator.prototype, 'dispose').mockImplementation(function (
+      this: HeadlessEmulator
+    ) {
+      events.push(`dispose:${emulators.indexOf(this)}`)
+      return dispose.call(this)
+    })
 
     const runtime = createRuntime()
     // Queued but not yet parsed: the chain link is still pending here.
diff --git a/src/main/runtime/host-terminal-close-persistence-durability.test.ts b/src/main/runtime/host-terminal-close-persistence-durability.test.ts
index 66a34f16ea6d..642edd6cf17b 100644
--- a/src/main/runtime/host-terminal-close-persistence-durability.test.ts
+++ b/src/main/runtime/host-terminal-close-persistence-durability.test.ts
@@ -62,7 +62,7 @@ describe('host-created terminal close durability', () => {
 
   it('a host-created terminal does NOT push a fresh repo into host-authoritative membership', async () => {
     const store = await makeStore()
-    store.persistPtyBinding({ worktreeId: WT, tabId: TAB, leafId: LEAF, ptyId: PTY })
+    await store.persistPtyBinding({ worktreeId: WT, tabId: TAB, leafId: LEAF, ptyId: PTY })
     const session = store.getWorkspaceSession()
     expect(session.tabsByWorktree?.[WT]?.map((t) => t.id)).toContain(TAB)
     // advanceTopologyFence (store.ts:3284) deliberately declines to arm the
@@ -73,14 +73,14 @@ describe('host-created terminal close durability', () => {
 
   it('a renderer close write durably removes the row it persisted', async () => {
     const store = await makeStore()
-    store.persistPtyBinding({ worktreeId: WT, tabId: TAB, leafId: LEAF, ptyId: PTY })
+    await store.persistPtyBinding({ worktreeId: WT, tabId: TAB, leafId: LEAF, ptyId: PTY })
     store.setWorkspaceSession(rendererWriteWithout(store.getWorkspaceSession(), TAB))
     expect(store.getWorkspaceSession().tabsByWorktree?.[WT] ?? []).toEqual([])
   })
 
   it('stays removed with the PTY still connected and no exit ever delivered', async () => {
     const store = await makeStore()
-    store.persistPtyBinding({ worktreeId: WT, tabId: TAB, leafId: LEAF, ptyId: PTY })
+    await store.persistPtyBinding({ worktreeId: WT, tabId: TAB, leafId: LEAF, ptyId: PTY })
     store.setWorkspaceSession(rendererWriteWithout(store.getWorkspaceSession(), TAB))
     // Kill-failure shape: no retirement, no exit, just more renderer writes.
     for (let i = 0; i < 3; i += 1) {
@@ -96,7 +96,7 @@ describe('host-created terminal close durability', () => {
       ...store.getWorkspaceSession(),
       terminalTopologyRevisionByRepoId: { [REPO_ID]: 1 }
     })
-    store.persistPtyBinding({ worktreeId: WT, tabId: TAB, leafId: LEAF, ptyId: PTY })
+    await store.persistPtyBinding({ worktreeId: WT, tabId: TAB, leafId: LEAF, ptyId: PTY })
     store.setWorkspaceSession(rendererWriteWithout(store.getWorkspaceSession(), TAB))
     // Documents PRE-EXISTING behavior: with the fence already armed, a renderer
     // write that omits a row is treated as a stale replay and the row survives
@@ -125,7 +125,7 @@ describe('topology fence census', () => {
       { startupCwd: '/tmp/wt-cli' }
     ].entries()) {
       const store = await makeStore()
-      store.persistPtyBinding({
+      await store.persistPtyBinding({
         worktreeId: WT,
         tabId: `${TAB}-${index}`,
         leafId: LEAF,
@@ -138,8 +138,8 @@ describe('topology fence census', () => {
 
   it('a second pane in the same tab still does not arm the fence', async () => {
     const store = await makeStore()
-    store.persistPtyBinding({ worktreeId: WT, tabId: TAB, leafId: LEAF, ptyId: PTY })
-    store.persistPtyBinding({
+    await store.persistPtyBinding({ worktreeId: WT, tabId: TAB, leafId: LEAF, ptyId: PTY })
+    await store.persistPtyBinding({
       worktreeId: WT,
       tabId: TAB,
       leafId: '22222222-2222-4222-8222-222222222222',
@@ -154,7 +154,7 @@ describe('topology fence census', () => {
       ...store.getWorkspaceSession(),
       terminalTopologyRevisionByRepoId: { [REPO_ID]: 1 }
     })
-    store.persistPtyBinding({ worktreeId: WT, tabId: TAB, leafId: LEAF, ptyId: PTY })
+    await store.persistPtyBinding({ worktreeId: WT, tabId: TAB, leafId: LEAF, ptyId: PTY })
     expect(
       store.getWorkspaceSession().terminalTopologyRevisionByRepoId?.[REPO_ID] ?? 0
     ).toBeGreaterThan(1)
diff --git a/src/main/runtime/mobile-session-layout-projection.ts b/src/main/runtime/mobile-session-layout-projection.ts
index e495116e81e4..3dd92091c77b 100644
--- a/src/main/runtime/mobile-session-layout-projection.ts
+++ b/src/main/runtime/mobile-session-layout-projection.ts
@@ -63,7 +63,8 @@ export function cloneTerminalLayoutSnapshot(
   const cloned: TerminalLayoutSnapshot = {
     root: layout.root,
     activeLeafId: layout.activeLeafId,
-    expandedLeafId: layout.expandedLeafId
+    expandedLeafId: layout.expandedLeafId,
+    ...(layout.chatLeafId ? { chatLeafId: layout.chatLeafId } : {})
   }
   if (layout.ptyIdsByLeafId) {
     cloned.ptyIdsByLeafId = { ...layout.ptyIdsByLeafId }
diff --git a/src/main/runtime/mobile-session-terminal-retirement.ts b/src/main/runtime/mobile-session-terminal-retirement.ts
index e8caba4ddf3e..0f027e8c68d5 100644
--- a/src/main/runtime/mobile-session-terminal-retirement.ts
+++ b/src/main/runtime/mobile-session-terminal-retirement.ts
@@ -115,7 +115,15 @@ function chooseGroupActiveTab(
   if (group.activeTabId && retainedTabIds.has(group.activeTabId)) {
     return group.activeTabId
   }
-  const recent = (group.recentTabIds ?? []).toReversed().find((tabId) => retainedTabIds.has(tabId))
+  // Node 18 is the orcad floor and does not provide Array.prototype.toReversed.
+  let recent: string | undefined
+  for (let index = (group.recentTabIds?.length ?? 0) - 1; index >= 0; index -= 1) {
+    const tabId = group.recentTabIds?.[index]
+    if (tabId && retainedTabIds.has(tabId)) {
+      recent = tabId
+      break
+    }
+  }
   return recent ?? group.tabOrder.find((tabId) => retainedTabIds.has(tabId)) ?? null
 }
 
diff --git a/src/main/runtime/orca-runtime-activate-managed-worktree.ts b/src/main/runtime/orca-runtime-activate-managed-worktree.ts
index 6b94e5d0ea28..48d81fc79cc9 100644
--- a/src/main/runtime/orca-runtime-activate-managed-worktree.ts
+++ b/src/main/runtime/orca-runtime-activate-managed-worktree.ts
@@ -27,7 +27,8 @@ import type {
 import { recordCreatedWorktreeLineage as recordCreatedWorktreeLineageState } from './runtime-worktree-lineage-recording'
 import {
   pasteWorktreeStartupDraftWhenReady,
-  sendWorktreeStartupFollowupWhenReady
+  sendWorktreeStartupFollowupWhenReady,
+  waitForWorktreeStartupDraft
 } from './runtime-worktree-startup-readiness'
 import type { CreateWorktreeResult } from '../../shared/worktree/create-types'
 import { provisionWorktreeTerminals } from './runtime-worktree-terminal-provisioning'
@@ -203,6 +204,29 @@ export class OrcaRuntimeWithActivateManagedWorktree extends OrcaRuntimeWithListM
     pasteWorktreeStartupDraftWhenReady(this.getWorktreeStartupReadinessHost(), handle, draft)
   }
 
+  /** Only for a newly launched worker, before its first dispatch input. */
+  async waitForFreshWorkerComposer(
+    handle: string,
+    agent: TuiAgent,
+    timeoutMs: number
+  ): Promise<void> {
+    const initialPtyId =
+      this.getLivePtyForHandle(handle)?.pty.ptyId ?? this.getLiveLeafForHandle(handle).leaf.ptyId
+    const ptyId = await waitForWorktreeStartupDraft(
+      { ...this.getWorktreeStartupReadinessHost(), getPtyId: () => initialPtyId },
+      handle,
+      agent,
+      { timeoutMs, requireComposerMarker: true }
+    )
+    if (!ptyId) {
+      throw new Error('timeout')
+    }
+    this.assertLiveTerminalHandleTargetsPty(handle, ptyId)
+    if (!this.ptysById.get(ptyId)?.connected) {
+      throw new Error('terminal_handle_stale')
+    }
+  }
+
   protected sendStartupFollowupWhenReady(handle: string, followup: WorktreeStartupFollowup): void {
     sendWorktreeStartupFollowupWhenReady(this.getWorktreeStartupReadinessHost(), handle, followup)
   }
diff --git a/src/main/runtime/orca-runtime-adopt-terminal-orphans-from-inventory.ts b/src/main/runtime/orca-runtime-adopt-terminal-orphans-from-inventory.ts
index 5dd2908413b3..3bc5b570704a 100644
--- a/src/main/runtime/orca-runtime-adopt-terminal-orphans-from-inventory.ts
+++ b/src/main/runtime/orca-runtime-adopt-terminal-orphans-from-inventory.ts
@@ -4,10 +4,7 @@ import {
   spawnSurfaceClaimSequence,
   SURFACE_CLAIM_WITHOUT_STANDING
 } from './pty-recorded-surface-topology'
-import {
-  observeStructuredWorker,
-  resolveStructuredWorkerAuthority
-} from './structured-worker-authority'
+import { resolveStructuredWorkerAuthority } from './structured-worker-authority'
 import type { RuntimeLeafRecord } from './runtime-terminal-state-records'
 import { OrcaRuntimeWithSubscribeToTerminalResize } from './orca-runtime-subscribe-to-terminal-resize'
 import type {
@@ -210,12 +207,10 @@ export class OrcaRuntimeWithAdoptTerminalOrphansFromInventory extends OrcaRuntim
       this.getOrchestrationDbIfAvailable?.() ?? null
     )
     if (structured) {
-      // `resolveBareOrchestrationRecipient` routes direct mail through this, not through
-      // getTerminalPaneKey. The connected-gate below exists so mail is never routed to a corpse,
-      // so the structured answer needs a real liveness proof too, not just a registry hit.
-      return observeStructuredWorker(structured.identity).status === 'live'
-        ? structured.identity.paneKey
-        : null
+      // `resolveBareOrchestrationRecipient` routes direct mail through this. A structured worker is
+      // a recipient while this runtime owns it, running or at rest: mail to one at rest is a send,
+      // and the send starts its agent.
+      return structured.identity.paneKey
     }
     const runtimePty = this.getLivePtyForHandle(handle)
     if (runtimePty) {
diff --git a/src/main/runtime/orca-runtime-apply-mobile-session-tab-navigation.ts b/src/main/runtime/orca-runtime-apply-mobile-session-tab-navigation.ts
index a2552ef12c3c..68101c809609 100644
--- a/src/main/runtime/orca-runtime-apply-mobile-session-tab-navigation.ts
+++ b/src/main/runtime/orca-runtime-apply-mobile-session-tab-navigation.ts
@@ -72,6 +72,31 @@ export class OrcaRuntimeWithApplyMobileSessionTabNavigation extends OrcaRuntimeW
     return snapshot
   }
 
+  /**
+   * Records a tab a create just published as one paired client's selection, as a create does for
+   * its own tab. Not the tap path: a tap is a wake gesture that may respawn a non-ready pane.
+   * Returns false when the tab is not in the snapshot.
+   */
+  selectCreatedMobileSessionTabForClient(
+    worktreeId: string,
+    surface: { tabId: string; leafId: string } | { sessionId: string },
+    clientNavigationId: string
+  ): boolean {
+    const snapshot = this.getMobileSessionTabsForWorktree(worktreeId)
+    const tab = snapshot.tabs.find((candidate) =>
+      'sessionId' in surface
+        ? candidate.type === 'agent-session' && candidate.sessionId === surface.sessionId
+        : candidate.type === 'terminal' &&
+          candidate.parentTabId === surface.tabId &&
+          candidate.leafId === surface.leafId
+    )
+    if (!tab) {
+      return false
+    }
+    this.applyMobileSessionTabNavigation(snapshot, tab.id, 'caller', clientNavigationId)
+    return true
+  }
+
   /**
    * Whether persistence proves this pane's PTY was deliberately taken down and parked
    * (workspace sleep or completed-agent hibernation) rather than lost and awaiting reconnect.
diff --git a/src/main/runtime/orca-runtime-apply-tracked-pty-title.ts b/src/main/runtime/orca-runtime-apply-tracked-pty-title.ts
index 3459c7c8b6e4..f1ea159f4a8b 100644
--- a/src/main/runtime/orca-runtime-apply-tracked-pty-title.ts
+++ b/src/main/runtime/orca-runtime-apply-tracked-pty-title.ts
@@ -62,10 +62,9 @@ export class OrcaRuntimeWithApplyTrackedPtyTitle extends OrcaRuntimeWithGetUnper
       // parked on its poll, so the later explicit idle is an idle→idle step that still has
       // to be offered. The resolve helper re-ranks and returns early when it is not yet
       // satisfying evidence, which is what the old edge guard was really protecting.
-      // Why also gated on a change: re-ranking an unchanged idle title cannot reach a
-      // different verdict. Tier 1 and 2 depend only on the title and the status; tier 3
-      // needs the stream to go quiet, which cannot happen on the frame that just wrote to
-      // it. Repainted frames would otherwise re-scan the pane tail for nothing.
+      // Why also gated on a change: the resolver settles only a blocked tail or strong
+      // ready, and the poll catches either between title changes; repainted frames would
+      // otherwise re-scan the pane tail for nothing.
       if (agentStatus === 'idle' && prevStatus !== 'permission' && ptyRecordChanged) {
         this.resolvePtyTuiIdleWaiters(pty, ptyId)
       }
@@ -123,8 +122,7 @@ export class OrcaRuntimeWithApplyTrackedPtyTitle extends OrcaRuntimeWithGetUnper
       // which isn't a task-completion signal.
       // Why not `prevStatus !== 'idle'`: see the pty branch — the resolve helper re-ranks,
       // so an idle→idle step that upgrades weak evidence to explicit must still be offered.
-      // Why the change gate: see the pty branch — an unchanged idle title re-ranks to the
-      // same verdict, so repainted frames must not re-scan the tail.
+      // Why the change gate: see the pty branch — repainted frames must not re-scan the tail.
       if (
         agentStatus === 'idle' &&
         prevStatus !== 'permission' &&
diff --git a/src/main/runtime/orca-runtime-attach-remote-terminal-source-range-consumer.ts b/src/main/runtime/orca-runtime-attach-remote-terminal-source-range-consumer.ts
index f433c75793db..7cb440b4bacf 100644
--- a/src/main/runtime/orca-runtime-attach-remote-terminal-source-range-consumer.ts
+++ b/src/main/runtime/orca-runtime-attach-remote-terminal-source-range-consumer.ts
@@ -182,6 +182,7 @@ export class OrcaRuntimeWithAttachRemoteTerminalSourceRangeConsumer extends Orca
     try {
       await assertTerminalInputWithinLimitWithYield(data)
       await this.writeTerminalInputChunks(ptyId, data, {
+        inputKind: 'driving',
         // Why: a phone can claim the floor while a paste yields between chunks.
         beforeWrite: () => {
           if (this.getDriver(ptyId).kind === 'mobile') {
diff --git a/src/main/runtime/orca-runtime-automation-operations.ts b/src/main/runtime/orca-runtime-automation-operations.ts
index fe65979ed1e4..662ea04c3da0 100644
--- a/src/main/runtime/orca-runtime-automation-operations.ts
+++ b/src/main/runtime/orca-runtime-automation-operations.ts
@@ -120,12 +120,13 @@ export class OrcaRuntimeWithAutomationOperations extends OrcaRuntimeWithPtyForeg
   deleteAutomation(
     id: string,
     expectedOwner?: AutomationOwnerPrecondition
-  ): { removed: boolean; id: string } {
+  ): Promise<{ removed: boolean; id: string }> {
     return this.automation.withExternalProbePriority(() => {
       const selector = this.automationChangeSelector(id)
-      const result = this.automation.delete(id, expectedOwner as never)
-      this.publishAutomationDefinitionChange(selector, selector)
-      return result
+      return this.automation.delete(id, expectedOwner).then((result) => {
+        this.publishAutomationDefinitionChange(selector, selector)
+        return result
+      })
     })
   }
 
diff --git a/src/main/runtime/orca-runtime-automations.test.ts b/src/main/runtime/orca-runtime-automations.test.ts
index 9c2ea907c912..26cbdec3d136 100644
--- a/src/main/runtime/orca-runtime-automations.test.ts
+++ b/src/main/runtime/orca-runtime-automations.test.ts
@@ -187,7 +187,7 @@ describe('OrcaRuntimeService automation methods', () => {
     const runtime = new OrcaRuntimeService(store as never)
 
     const updated = await runtime.updateAutomation('auto-1', { enabled: false })
-    const removed = runtime.deleteAutomation('auto-1')
+    const removed = await runtime.deleteAutomation('auto-1')
 
     expect(store.updateAutomation).toHaveBeenCalledWith('auto-1', { enabled: false }, undefined)
     expect(updated).toMatchObject({
diff --git a/src/main/runtime/orca-runtime-build-headless-mobile-session-browser-tabs.ts b/src/main/runtime/orca-runtime-build-headless-mobile-session-browser-tabs.ts
index 5aa6e46cc589..e2e1e2337fcc 100644
--- a/src/main/runtime/orca-runtime-build-headless-mobile-session-browser-tabs.ts
+++ b/src/main/runtime/orca-runtime-build-headless-mobile-session-browser-tabs.ts
@@ -3,15 +3,25 @@ import { OrcaRuntimeWithPersistTerminalSurfaceRetirements } from './orca-runtime
 import type {
   RuntimeMobileSessionBrowserTab,
   RuntimeMobileSessionTabsResult,
-  RuntimeMobileSessionTabsSnapshot
+  RuntimeMobileSessionTabsSnapshot,
+  RuntimeMobileSessionTerminalTab
 } from '../../shared/runtime-types'
+import { parseAppSshPtyId } from '../../shared/ssh-pty-id'
 import { getRuntimeBrowserPageRegistry } from './runtime-browser-page-registry'
 import type { Tab } from '../../shared/tab-types'
-import { closeTerminalTabInWorkspaceSession } from '../../shared/workspace-session-terminal-tab-close'
-import { advanceTerminalTopologyRevision } from './workspace-session-terminal-membership-authority'
+import {
+  resolveTerminalCloseTarget,
+  terminalSurfaceCloseMutation,
+  type PaneCloseResolution
+} from './terminal-surface-close'
+import type {
+  TerminalPaneCloseTarget,
+  TerminalSurfaceCloseTarget
+} from '../../shared/terminal-surface-close-target'
+import { retireTerminalSurfacesFromSnapshot } from './mobile-session-terminal-retirement'
 import type { PtyControllerInventory } from './runtime-pty-controller-contract'
 import { FLOATING_TERMINAL_WORKTREE_ID } from '../../shared/constants'
-import { rollbackWorkspaceSessionAfterFailedAsyncWrite } from './workspace-session-failed-write-rollback'
+import { captureAcknowledgedTerminalTabRetirement } from './workspace-session-terminal-tab-retirement-identity'
 
 export class OrcaRuntimeWithBuildHeadlessMobileSessionBrowserTabs extends OrcaRuntimeWithPersistTerminalSurfaceRetirements {
   // Why: headless serve backs browser panes with offscreen WebContents that live
@@ -78,44 +88,167 @@ export class OrcaRuntimeWithBuildHeadlessMobileSessionBrowserTabs extends OrcaRu
     return tab ? { color: tab.color, isPinned: tab.isPinned } : null
   }
 
-  protected commitHeadlessTerminalTabRetirement(
+  protected captureTerminalTabRetirement(worktreeId: string, tabId: string) {
+    const originalHostId = this.getWorkspaceSessionHostIdForWorktree(worktreeId)
+    return captureAcknowledgedTerminalTabRetirement(worktreeId, tabId, () => {
+      const resolvedHostId = this.getWorkspaceSessionHostIdForWorktree(worktreeId)
+      const resolvedSession = this.store?.getWorkspaceSession?.(resolvedHostId)
+      // Emptying the last tab may reroute the worktree to its catalog host.
+      const hostId = resolvedSession?.tabsByWorktree[worktreeId]?.some((tab) => tab.id === tabId)
+        ? resolvedHostId
+        : originalHostId
+      return {
+        hostId,
+        session: this.store?.getWorkspaceSession?.(hostId) ?? null,
+        snapshot: this.mobileSessionTabsByWorktree.get(worktreeId),
+        incarnationOf: (ptyId) => this.ptysById.get(ptyId)?.incarnationId
+      }
+    })
+  }
+
+  /**
+   * The one close transaction every explicit terminal close reaches: durably commits the membership
+   * removal in the owning host's partition. Callers publish and kill afterwards.
+   */
+  protected async closeTerminalSurface(
     worktreeId: string,
-    parentTabId: string,
-    options: { allowMissing?: boolean; force?: boolean } = {}
-  ): string[] {
-    const session = this.getWorkspaceSessionForWorktree(worktreeId)
-    if (!session || !this.store?.setWorkspaceSession || !this.store.flushOrThrow) {
+    target: TerminalSurfaceCloseTarget,
+    // closedByLayoutOwner goes away with D1, once main owns the terminal layout.
+    options: { allowMissing?: boolean; force?: boolean; closedByLayoutOwner?: boolean } = {}
+  ): Promise<string[]> {
+    const store = this.store
+    if (!store?.getWorkspaceSession || !store.setWorkspaceSession || !store.runDurableMutation) {
       throw new Error('workspace_session_unavailable')
     }
-    const result = closeTerminalTabInWorkspaceSession(session, worktreeId, parentTabId, {
-      force: options.force
-    })
-    if (result.pinned) {
-      throw new Error('terminal_tab_pinned')
+    // Why: a tab its layout owner already removed has no newer owner; refusing would only strand it.
+    const acknowledgeTabRetirement =
+      target.kind === 'tab' && !options.closedByLayoutOwner
+        ? this.captureTerminalTabRetirement(worktreeId, target.tabId)
+        : null
+    let ptyIdsToKill: string[] = []
+    let refusal: Error | undefined
+    try {
+      refusal = await store.runDurableMutation(
+        terminalSurfaceCloseMutation({
+          worktreeId,
+          target,
+          options,
+          requestedSession: this.getWorkspaceSessionForWorktree(worktreeId),
+          ownerMatches: () => !acknowledgeTabRetirement || acknowledgeTabRetirement().matches,
+          hostId: () => this.getWorkspaceSessionHostIdForWorktree(worktreeId),
+          getSession: (hostId) => store.getWorkspaceSession(hostId),
+          setSession: (session, hostId) => store.setWorkspaceSession(session, hostId),
+          onClosed: (closedPtyIds) => {
+            ptyIdsToKill = closedPtyIds
+          }
+        })
+      )
+    } catch (error) {
+      console.error('[runtime] failed to persist terminal close:', error)
     }
-    if (!result.closed) {
-      if (!options.allowMissing) {
-        throw new Error('tab_not_found')
+    if (refusal) {
+      throw refusal
+    }
+    return ptyIdsToKill
+  }
+
+  /** The desktop renderer's close intent: it already guarded, removed and killed; this only reports. */
+  async closeTerminalSurfaceFromRenderer(worktreeId: string, target: TerminalSurfaceCloseTarget) {
+    const options = { allowMissing: true, force: true, closedByLayoutOwner: true }
+    await this.closeTerminalSurface(worktreeId, target, options)
+  }
+
+  /** Resolves a close main started against the copy of the tab's panes its layout owner holds. */
+  protected resolveTerminalCloseTarget(
+    worktreeId: string,
+    target: TerminalSurfaceCloseTarget
+  ): PaneCloseResolution | 'tab' {
+    const graphLeafIds: string[] = []
+    for (const leaf of this.leaves.values()) {
+      if (leaf.tabId === target.tabId) {
+        graphLeafIds.push(leaf.leafId)
       }
     }
-    const persisted = result.closed
-      ? advanceTerminalTopologyRevision(result.session, worktreeId)
-      : session
-    this.setWorkspaceSessionForWorktree(worktreeId, persisted)
-    const staged = this.getWorkspaceSessionForWorktree(worktreeId)
+    return resolveTerminalCloseTarget(target, {
+      rendererListsTab: this.tabs.has(target.tabId),
+      snapshotRows: (this.mobileSessionTabsByWorktree.get(worktreeId)?.tabs ?? []).filter(
+        (row) => row.type === 'terminal' && row.parentTabId === target.tabId
+      ),
+      graphLeafIds,
+      sessionLayout:
+        this.getWorkspaceSessionForWorktree(worktreeId)?.terminalLayoutsByTabId?.[target.tabId]
+    })
+  }
+
+  /**
+   * Commits a split pane's close that main started, then tells the desktop renderer to drop that
+   * pane. Never touches the tab: a pane the session no longer lists commits nothing.
+   */
+  protected async closeTerminalPane(
+    worktreeId: string,
+    target: TerminalPaneCloseTarget
+  ): Promise<void> {
     try {
-      this.store.flushOrThrow()
+      await this.closeTerminalSurface(worktreeId, target, { allowMissing: true })
     } catch (error) {
-      const current = this.getWorkspaceSessionForWorktree(worktreeId)
-      if (staged && current) {
-        const rolledBack = rollbackWorkspaceSessionAfterFailedAsyncWrite(session, staged, current)
-        if (rolledBack !== current) {
-          this.setWorkspaceSessionForWorktree(worktreeId, rolledBack)
-        }
+      if (!(error instanceof Error) || error.message !== 'workspace_session_unavailable') {
+        throw error
       }
-      throw error
     }
-    return result.ptyIdsToKill
+    // Why: no exit may ever arrive to remove the pane. The notice is leaf-addressed, so it and the
+    // renderer's exit handling are each a no-op after the other.
+    this.retireClosedTerminalLeafFromMobileSnapshot(worktreeId, target.tabId, target.leafId)
+    this.notifier?.closeTerminalPane?.(target.tabId, target.leafId)
+  }
+
+  /** A paired client's close of one pane: stops only that pane's process, commits only that pane. */
+  protected async closeMobileSessionTerminalPane(
+    worktreeId: string,
+    tab: RuntimeMobileSessionTerminalTab
+  ): Promise<void> {
+    // Why best-effort, as for a tab: a failed kill must not keep a pane the user closed.
+    const pty = this.findPtyForMobileTerminalTab(worktreeId, tab)
+    if (pty) {
+      this.ptyController?.kill(pty.ptyId)
+    } else if (!this.tabs.has(tab.parentTabId) && tab.ptyId && parseAppSshPtyId(tab.ptyId)) {
+      // Why: with no renderer to own the kill, a dormant SSH pane's durable id is its stop order.
+      this.ptyController?.kill(tab.ptyId)
+    }
+    await this.closeTerminalPane(worktreeId, {
+      kind: 'pane',
+      tabId: tab.parentTabId,
+      leafId: tab.leafId
+    })
+  }
+
+  private retireClosedTerminalLeafFromMobileSnapshot(
+    worktreeId: string,
+    tabId: string,
+    leafId: string
+  ): void {
+    const snapshot = this.mobileSessionTabsByWorktree.get(worktreeId)
+    const tab = snapshot?.tabs.find(
+      (candidate) =>
+        candidate.type === 'terminal' &&
+        candidate.parentTabId === tabId &&
+        candidate.leafId === leafId
+    )
+    // Why: a renderer that lists the tab republishes its own snapshot once it drops the pane.
+    if (!snapshot || !tab || this.tabs.has(tabId)) {
+      return
+    }
+    const proof = this.getMobileSessionTerminalRetirementProof(worktreeId, tab)
+    const retired = retireTerminalSurfacesFromSnapshot({
+      snapshot,
+      ptyId: tab.ptyId ?? tab.parentLayout?.ptyIdsByLeafId?.[leafId] ?? '',
+      exactSurfaces: [{ parentTabId: tabId, leafId }],
+      exactOnly: true,
+      ...(proof ? { retirementProofs: [proof] } : {})
+    })
+    if (retired) {
+      this.storeMobileSessionSnapshot(worktreeId, retired.snapshot)
+      this.notifyMobileSessionTabsChanged(worktreeId)
+    }
   }
 
   protected persistHeadlessTerminalTabOrder(worktreeId: string, tabOrder: readonly string[]): void {
diff --git a/src/main/runtime/orca-runtime-build-pty-terminal-summary.ts b/src/main/runtime/orca-runtime-build-pty-terminal-summary.ts
index 159a709fd3c7..d7a169d00e17 100644
--- a/src/main/runtime/orca-runtime-build-pty-terminal-summary.ts
+++ b/src/main/runtime/orca-runtime-build-pty-terminal-summary.ts
@@ -1,7 +1,7 @@
 // @ts-nocheck -- mechanically split from OrcaRuntimeService; behavior is covered by AST equivalence and characterization tests.
 import { OrcaRuntimeWithGetPtyRecordForPaneKey } from './orca-runtime-get-pty-record-for-pane-key'
 import type { RuntimeLeafRecord, RuntimePtyWorktreeRecord } from './runtime-terminal-state-records'
-import type { ResolvedWorktree } from './runtime-worktree-path-identity'
+import { runtimeWorktreeIdentityKey, type ResolvedWorktree } from './runtime-worktree-path-identity'
 import type { RuntimeTerminalRead, RuntimeTerminalSummary } from '../../shared/runtime-types'
 import { getLatestPtyTitle } from './runtime-worktree-status-projection'
 import { parsePaneKey } from '../../shared/stable-pane-id'
@@ -28,6 +28,14 @@ export class OrcaRuntimeWithBuildPtyTerminalSummary extends OrcaRuntimeWithGetPt
     const title = getLatestPtyTitle(pty)
     const pane = parsePaneKey(pty.paneKey ?? '')
     const orphaned = !ptyHoldsRecordedSurface(pty, this.ptySurfaceTopology())
+    // A live process awaiting its pane binding is not evidence of an orphan.
+    if (
+      orphaned &&
+      (this.pendingPtyRegistrationIncarnations.has(pty.ptyId) ||
+        this.terminalMutationLock.hasActiveSpawns(runtimeWorktreeIdentityKey(pty.worktreeId)))
+    ) {
+      throw new Error('terminal_surface_ownership_unavailable')
+    }
     return {
       handle: this.issuePtyHandle(pty),
       ptyId: pty.ptyId,
diff --git a/src/main/runtime/orca-runtime-close-headless-mobile-terminal-tab.ts b/src/main/runtime/orca-runtime-close-headless-mobile-terminal-tab.ts
index b326d00ec6c3..7239f66d3165 100644
--- a/src/main/runtime/orca-runtime-close-headless-mobile-terminal-tab.ts
+++ b/src/main/runtime/orca-runtime-close-headless-mobile-terminal-tab.ts
@@ -13,7 +13,7 @@ import type { RuntimePtyWorktreeRecord } from './runtime-terminal-state-records'
 import type { TerminalPaneLayoutNode } from '../../shared/terminal-tab-types'
 
 export class OrcaRuntimeWithCloseHeadlessMobileTerminalTab extends OrcaRuntimeWithCloseStructuredAgentSessionTab {
-  protected closeHeadlessMobileTerminalTab(
+  protected async closeHeadlessMobileTerminalTab(
     worktreeId: string,
     snapshot: RuntimeMobileSessionTabsSnapshot,
     tab: RuntimeMobileSessionTerminalTab,
@@ -23,7 +23,7 @@ export class OrcaRuntimeWithCloseHeadlessMobileTerminalTab extends OrcaRuntimeWi
       authorizedPty?: RuntimePtyWorktreeRecord
       force?: boolean
     } = {}
-  ): void {
+  ): Promise<void> {
     const closedParentTabId = tab.parentTabId
     const retirementProofs = snapshot.tabs.flatMap((candidate) => {
       if (candidate.type !== 'terminal' || candidate.parentTabId !== closedParentTabId) {
@@ -36,11 +36,20 @@ export class OrcaRuntimeWithCloseHeadlessMobileTerminalTab extends OrcaRuntimeWi
       )
       return proof ? [proof] : []
     })
-    const projectedPtyIds = this.commitHeadlessTerminalTabRetirement(
+    const acknowledgeRetirement = this.captureTerminalTabRetirement(worktreeId, closedParentTabId)
+    const projectedPtyIds = await this.closeTerminalSurface(
       worktreeId,
-      closedParentTabId,
-      { allowMissing: options.allowMissingPersistedTab, force: options.force }
+      { kind: 'tab', tabId: closedParentTabId },
+      {
+        allowMissing: options.allowMissingPersistedTab,
+        force: options.force
+      }
     )
+    if (!acknowledgeRetirement().matches) {
+      throw new Error('terminal_pane_owner_changed')
+    }
+    // Renderer frames may add other tabs while the durable close is in flight.
+    snapshot = this.mobileSessionTabsByWorktree.get(worktreeId) ?? snapshot
     this.clearRuntimeSessionOwnershipForMobileTab(worktreeId, snapshot, closedParentTabId)
     if (options.authorizedPty) {
       options.authorizedPty.runtimeSessionOwned = false
@@ -172,6 +181,7 @@ export class OrcaRuntimeWithCloseHeadlessMobileTerminalTab extends OrcaRuntimeWi
       tabId: string
       root: TerminalPaneLayoutNode | null
       expandedLeafId: string | null
+      chatLeafId?: string | null
       titlesByLeafId?: Record<string, string>
     }
   ): Promise<{ updated: true }> {
@@ -197,6 +207,7 @@ export class OrcaRuntimeWithCloseHeadlessMobileTerminalTab extends OrcaRuntimeWi
         tabId: hostTabId,
         root: acceptedLayout.root,
         expandedLeafId: acceptedLayout.expandedLeafId,
+        chatLeafId: acceptedLayout.chatLeafId ?? null,
         ...(acceptedLayout.titlesByLeafId ? { titlesByLeafId: acceptedLayout.titlesByLeafId } : {})
       })
     }
diff --git a/src/main/runtime/orca-runtime-close-mobile-session-tab.ts b/src/main/runtime/orca-runtime-close-mobile-session-tab.ts
index 2ef5b77069d6..7f161f81dc5d 100644
--- a/src/main/runtime/orca-runtime-close-mobile-session-tab.ts
+++ b/src/main/runtime/orca-runtime-close-mobile-session-tab.ts
@@ -18,9 +18,7 @@ import {
 } from './mobile-session-tab-close-outcome'
 import { getRuntimeBrowserPageRegistry } from './runtime-browser-page-registry'
 import type { RuntimeCommandSurfaceHost } from './orca-runtime-core'
-import { structuredAgentSessionTabId } from '../../shared/structured-agent-session-projection'
 import { SESSION_TAB_NOT_FOUND_ERROR } from '../../shared/session-tab-close'
-import { captureAcknowledgedTerminalTabRetirement } from './workspace-session-terminal-tab-retirement-identity'
 import { rendererPublicationThrottle } from '../window/renderer-publication-throttle'
 
 export class OrcaRuntimeWithCloseMobileSessionTab extends OrcaRuntimeWithRefuseUnattributedMobileSessionTabClose {
@@ -120,10 +118,14 @@ export class OrcaRuntimeWithCloseMobileSessionTab extends OrcaRuntimeWithRefuseU
         closedSelectionTabIds
       )
     if (tab.type === 'terminal') {
-      const parentLeafCount = snapshot.tabs.filter(
-        (candidate) => candidate.type === 'terminal' && candidate.parentTabId === tab.parentTabId
-      ).length
-      const closingWholeParent = tab.id !== tabId || parentLeafCount <= 1
+      // Why: the wire id carries the intent — `parent::leaf` names a pane, `parent` its tab.
+      const resolution = this.resolveTerminalCloseTarget(
+        worktreeId,
+        tab.id === tabId
+          ? { kind: 'pane', tabId: tab.parentTabId, leafId: tab.leafId }
+          : { kind: 'tab', tabId: tab.parentTabId }
+      )
+      const closingWholeParent = resolution === 'tab' || resolution === 'last-pane'
       if (closingWholeParent) {
         closedSelectionTabIds = snapshot.tabs.flatMap((candidate) =>
           candidate.type === 'terminal' && candidate.parentTabId === tab.parentTabId
@@ -167,7 +169,7 @@ export class OrcaRuntimeWithCloseMobileSessionTab extends OrcaRuntimeWithRefuseU
       // the relay when no renderer owns the parent: an adopted tab needs the
       // renderer's live pin guard and durable close transaction.
       if (closingWholeParent && !this.tabs.has(tab.parentTabId)) {
-        this.closeHeadlessMobileTerminalTab(worktreeId, snapshot, tab, {
+        await this.closeHeadlessMobileTerminalTab(worktreeId, snapshot, tab, {
           allowMissingPersistedTab: Boolean(ptyCloseAuthority),
           force: options.force,
           killPtys:
@@ -180,16 +182,7 @@ export class OrcaRuntimeWithCloseMobileSessionTab extends OrcaRuntimeWithRefuseU
       }
       if (closingWholeParent && this.notifier?.closeTerminalTab) {
         // The renderer flush can rebase its omission; the host commits the acknowledged identity.
-        const acknowledgeRetirement = captureAcknowledgedTerminalTabRetirement(
-          worktreeId,
-          tab.parentTabId,
-          () => ({
-            hostId: this.getWorkspaceSessionHostIdForWorktree(worktreeId),
-            session: this.getWorkspaceSessionForWorktree(worktreeId),
-            snapshot: this.mobileSessionTabsByWorktree.get(worktreeId),
-            incarnationOf: (ptyId) => this.ptysById.get(ptyId)?.incarnationId
-          })
-        )
+        const acknowledgeRetirement = this.captureTerminalTabRetirement(worktreeId, tab.parentTabId)
         // Wait for the renderer's pin guard, retirement and forced session flush.
         const win = this.getAvailableAuthoritativeWindow()
         if (win?.webContents.isDestroyed?.()) {
@@ -230,7 +223,7 @@ export class OrcaRuntimeWithCloseMobileSessionTab extends OrcaRuntimeWithRefuseU
             ? this.resolvePtyTabCloseSurfaceAuthority(options.expectedPtyCloseAuthority)
             : null
           // Why: after relay recovery the renderer can acknowledge a tab it no longer mirrors; the HUB must still retire its SSH-owned surface.
-          this.closeHeadlessMobileTerminalTab(worktreeId, remainingSnapshot, remainingTab, {
+          await this.closeHeadlessMobileTerminalTab(worktreeId, remainingSnapshot, remainingTab, {
             // Why: the renderer may already have durably removed the tab before acknowledging.
             allowMissingPersistedTab: true,
             force: options.force,
@@ -238,47 +231,42 @@ export class OrcaRuntimeWithCloseMobileSessionTab extends OrcaRuntimeWithRefuseU
           })
           this.notifyRendererOfHeadlessTerminalClose(tab.parentTabId)
         } else if (retirement.hasPersistedTab) {
-          this.commitHeadlessTerminalTabRetirement(worktreeId, tab.parentTabId, {
-            force: options.force
-          })
+          // Why: the renderer's close normally commits this through its own intent; this covers
+          // a renderer that acknowledged a tab it no longer listed. Missing is fine: that intent's
+          // durable write can land between this check and this commit.
+          await this.closeTerminalSurface(
+            worktreeId,
+            { kind: 'tab', tabId: tab.parentTabId },
+            { allowMissing: true, force: options.force }
+          )
+        }
+        if (!acknowledgeRetirement().matches) {
+          this.republishMobileSessionTabsSnapshot(worktreeId)
+          return refusedMobileSessionTabClose('stale-terminal', { snapshotRepublished: true })
         }
         this.clearRuntimeSessionOwnershipForMobileTab(worktreeId, snapshot, tab.parentTabId)
         return finishCommittedClose()
       }
-      // Why: notifier implementations without the acknowledged relay may expose
-      // only raw pane close. Runtime-owned parents still need de-persist + kill.
-      if (closingWholeParent && this.isRuntimeOwnedHeadlessMobileTab(worktreeId, tab)) {
-        this.closeHeadlessMobileTerminalTab(worktreeId, snapshot, tab, {
-          force: options.force,
-          ...(ptyCloseAuthority ? { authorizedPty: ptyCloseAuthority.pty } : {})
-        })
-        this.notifyRendererOfHeadlessTerminalClose(tab.parentTabId)
-        return finishCommittedClose()
-      }
-      if (!this.notifier?.closeTerminal) {
-        this.closeHeadlessMobileTerminalTab(worktreeId, snapshot, tab, {
-          force: options.force,
-          ...(ptyCloseAuthority ? { authorizedPty: ptyCloseAuthority.pty } : {})
-        })
-        return finishCommittedClose()
-      }
-      if (tab.id === tabId) {
-        const pty = this.findPtyForMobileTerminalTab(worktreeId, tab)
-        if (pty) {
-          if (this.ptyController?.kill(pty.ptyId) !== true) {
-            throw new Error('terminal_close_failed')
-          }
+      if (closingWholeParent) {
+        // Why: notifier implementations without the acknowledged relay may expose
+        // only raw pane close. Runtime-owned parents still need de-persist + kill.
+        if (
+          !this.notifier?.closeTerminal ||
+          this.isRuntimeOwnedHeadlessMobileTab(worktreeId, tab)
+        ) {
+          await this.closeHeadlessMobileTerminalTab(worktreeId, snapshot, tab, {
+            force: options.force,
+            ...(ptyCloseAuthority ? { authorizedPty: ptyCloseAuthority.pty } : {})
+          })
+          this.notifyRendererOfHeadlessTerminalClose(tab.parentTabId)
           return finishCommittedClose()
         }
         this.notifier.closeTerminal(tab.parentTabId)
+        this.clearRuntimeSessionOwnershipForMobileTab(worktreeId, snapshot, tab.parentTabId)
         return delegatedMobileSessionTabClose()
       }
-      // Why: paired web tab bars represent a split terminal with one local
-      // parent tab id. Closing that parent should close the desktop tab, not
-      // just whichever leaf happened to be first in the session snapshot.
-      this.notifier.closeTerminal(tab.parentTabId)
-      this.clearRuntimeSessionOwnershipForMobileTab(worktreeId, snapshot, tab.parentTabId)
-      return delegatedMobileSessionTabClose()
+      await this.closeMobileSessionTerminalPane(worktreeId, tab)
+      return finishCommittedClose()
     } else if (tab.type === 'browser') {
       // Why: a browser tab can be hosted by a client, by the offscreen backend,
       // or by the renderer; each surface owns a different retirement path.
@@ -302,10 +290,8 @@ export class OrcaRuntimeWithCloseMobileSessionTab extends OrcaRuntimeWithRefuseU
     } else if (tab.type === 'agent-session') {
       if (this.notifier?.closeSessionTab) {
         try {
-          await this.notifier.closeSessionTab(
-            structuredAgentSessionTabId(tab.sessionId),
-            worktreeId
-          )
+          // Why: a reopened chat's window tab id is not derivable from its session; the window maps ours.
+          await this.notifier.closeSessionTab(tab.id, worktreeId)
         } catch (error) {
           // The renderer already having removed the tab is an idempotent close, not a veto.
           if (!(error instanceof Error && error.message === SESSION_TAB_NOT_FOUND_ERROR)) {
diff --git a/src/main/runtime/orca-runtime-cold-restore-terminal-membership.test.ts b/src/main/runtime/orca-runtime-cold-restore-terminal-membership.test.ts
new file mode 100644
index 000000000000..321f4d40ae62
--- /dev/null
+++ b/src/main/runtime/orca-runtime-cold-restore-terminal-membership.test.ts
@@ -0,0 +1,577 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { getDefaultWorkspaceSession } from '../../shared/constants'
+import { LOCAL_EXECUTION_HOST_ID, type ExecutionHostId } from '../../shared/execution-host'
+import type {
+  RuntimeMobileSessionSnapshotTab,
+  RuntimeMobileSessionTabsResult,
+  RuntimeMobileSessionTabsSnapshot
+} from '../../shared/runtime-types'
+import type { WorkspaceSessionState } from '../../shared/workspace-session-state-types'
+import { OrcaRuntimeService } from './orca-runtime'
+import { setRuntimeDesktopSurface } from './runtime-desktop-surface'
+import { withDurableRuntimeStore } from './runtime-durable-store-fixture'
+
+const WORKTREE_ID = 'repo::/worktree'
+const REPO_ID = 'repo'
+const LEFT = '11111111-1111-4111-8111-111111111111'
+const RIGHT = '22222222-2222-4222-8222-222222222222'
+const SPLIT_ROOT = {
+  type: 'split' as const,
+  direction: 'vertical' as const,
+  first: { type: 'leaf' as const, leafId: LEFT },
+  second: { type: 'leaf' as const, leafId: RIGHT }
+}
+
+type RestoreHost = {
+  repo: {
+    id: string
+    path: string
+    displayName: string
+    badgeColor: string
+    addedAt: number
+    connectionId?: string
+    executionHostId?: ExecutionHostId
+  }
+  hostId: ExecutionHostId
+  connectionId: string | null
+  ptyIds: { left: string; right: string }
+  /** An SSH relaunch has not bound its PTY into the saved session yet. */
+  persistsPtyBindings: boolean
+}
+
+const LOCAL_HOST: RestoreHost = {
+  repo: { id: REPO_ID, path: '/worktree', displayName: 'repo', badgeColor: 'blue', addedAt: 1 },
+  hostId: LOCAL_EXECUTION_HOST_ID,
+  connectionId: null,
+  ptyIds: { left: 'pty-left', right: 'pty-right' },
+  persistsPtyBindings: true
+}
+const SSH_HOST: RestoreHost = {
+  repo: { ...LOCAL_HOST.repo, connectionId: 'ssh-1' },
+  hostId: 'ssh:ssh-1',
+  connectionId: 'ssh-1',
+  ptyIds: { left: 'ssh:ssh-1@@pty-left', right: 'ssh:ssh-1@@pty-right' },
+  persistsPtyBindings: false
+}
+const RUNTIME_HOST: RestoreHost = {
+  ...LOCAL_HOST,
+  repo: { ...LOCAL_HOST.repo, executionHostId: 'runtime:env-1' },
+  hostId: 'runtime:env-1'
+}
+
+// A cold restore: the saved split survives, and an earlier incarnation change left the repo's
+// terminal membership host-authoritative, but no PTY has registered yet.
+function makeColdRestoredSession(host: RestoreHost): WorkspaceSessionState {
+  return {
+    ...getDefaultWorkspaceSession(),
+    tabsByWorktree: {
+      [WORKTREE_ID]: [
+        {
+          id: 'tab',
+          ptyId: host.persistsPtyBindings ? host.ptyIds.left : null,
+          worktreeId: WORKTREE_ID,
+          title: 'Terminal',
+          customTitle: null,
+          color: null,
+          sortOrder: 0,
+          createdAt: 1
+        }
+      ]
+    },
+    terminalLayoutsByTabId: {
+      tab: {
+        root: SPLIT_ROOT,
+        activeLeafId: LEFT,
+        expandedLeafId: null,
+        ptyIdsByLeafId: host.persistsPtyBindings
+          ? { [LEFT]: host.ptyIds.left, [RIGHT]: host.ptyIds.right }
+          : {}
+      }
+    },
+    terminalTopologyRevisionByRepoId: { [REPO_ID]: 2 }
+  }
+}
+
+function makeRendererFrame(
+  host: RestoreHost,
+  options: {
+    version?: number
+    leaves?: readonly string[]
+    extraTabs?: readonly RuntimeMobileSessionSnapshotTab[]
+  } = {}
+): RuntimeMobileSessionTabsSnapshot {
+  const leaves = options.leaves ?? [LEFT, RIGHT]
+  const ptyIdByLeaf: Record<string, string> = {
+    [LEFT]: host.ptyIds.left,
+    [RIGHT]: host.ptyIds.right
+  }
+  const parentLayout = {
+    root: leaves.length === 2 ? SPLIT_ROOT : { type: 'leaf' as const, leafId: leaves[0] },
+    activeLeafId: leaves[0],
+    expandedLeafId: leaves[0],
+    ptyIdsByLeafId: Object.fromEntries(leaves.map((leafId) => [leafId, ptyIdByLeaf[leafId]]))
+  }
+  const extraTabs = options.extraTabs ?? []
+  return {
+    worktree: WORKTREE_ID,
+    publicationEpoch: 'renderer',
+    snapshotVersion: options.version ?? 1,
+    activeGroupId: 'group',
+    activeTabId: `tab::${leaves[0]}`,
+    activeTabType: 'terminal',
+    tabGroups: [
+      { id: 'group', activeTabId: 'tab', tabOrder: ['tab', ...extraTabs.map((tab) => tab.id)] }
+    ],
+    tabs: [
+      ...leaves.map((leafId, index) => ({
+        type: 'terminal' as const,
+        id: `tab::${leafId}`,
+        parentTabId: 'tab',
+        leafId,
+        ptyId: ptyIdByLeaf[leafId],
+        title: leafId === LEFT ? 'Left' : 'Right',
+        parentLayout,
+        isActive: index === 0
+      })),
+      ...extraTabs
+    ]
+  }
+}
+
+const RENDERER_TABS = [
+  {
+    tabId: 'tab',
+    worktreeId: WORKTREE_ID,
+    title: 'Terminal',
+    activeLeafId: LEFT,
+    layout: SPLIT_ROOT
+  }
+]
+
+function publishRendererFrame(
+  runtime: OrcaRuntimeService,
+  frame: RuntimeMobileSessionTabsSnapshot
+): ReturnType<OrcaRuntimeService['syncWindowGraph']> {
+  return runtime.syncWindowGraph(1, { tabs: RENDERER_TABS, leaves: [], mobileSessionTabs: [frame] })
+}
+
+function coldRestoredRuntime(host: RestoreHost = LOCAL_HOST): {
+  runtime: OrcaRuntimeService
+  sessions: Map<ExecutionHostId, WorkspaceSessionState>
+} {
+  const sessions = new Map<ExecutionHostId, WorkspaceSessionState>([
+    [host.hostId, makeColdRestoredSession(host)]
+  ])
+  // The desktop window is live, so main must not rebuild the list from the saved session.
+  const liveWindow = {
+    isDestroyed: () => false,
+    webContents: { isDestroyed: () => false, send: () => {} }
+  }
+  setRuntimeDesktopSurface({
+    showNotification: () => false,
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the runtime reads only liveness and send off its authoritative window on these paths.
+    findWindowById: () => liveWindow as never,
+    onIpc: () => {},
+    removeIpcListener: () => {}
+  })
+  const runtime = new OrcaRuntimeService(
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the list, fence, exit and close paths read only repos and the workspace session; the rest of Store is unreached.
+    withDurableRuntimeStore({
+      getRepos: () => [host.repo],
+      getRepo: (id: string) => (id === REPO_ID ? host.repo : undefined),
+      getAllWorktreeMeta: () => ({}),
+      getWorktreeMeta: () => undefined,
+      getSettings: () => ({ workspaceDir: '/tmp/workspaces' }),
+      getProjects: () => [],
+      getWorkspaceSessionHostIds: () => [...sessions.keys()],
+      getWorkspaceSession: (hostId?: ExecutionHostId) =>
+        sessions.get(hostId ?? LOCAL_EXECUTION_HOST_ID) ?? getDefaultWorkspaceSession(),
+      setWorkspaceSession: (next: WorkspaceSessionState, hostId?: ExecutionHostId) => {
+        sessions.set(hostId ?? LOCAL_EXECUTION_HOST_ID, next)
+      },
+      flushPendingOrThrowAsync: async () => {},
+      // The production store commits asynchronously; a synchronous flush on these paths is a bug.
+      flushOrThrow: () => {
+        throw new Error('synchronous flush')
+      }
+    }) as never
+  )
+  runtime.attachWindow(1)
+  return { runtime, sessions }
+}
+
+function registerLeaf(runtime: OrcaRuntimeService, host: RestoreHost, leaf: 'left' | 'right') {
+  runtime.registerPty(host.ptyIds[leaf], WORKTREE_ID, host.connectionId, {
+    tabId: 'tab',
+    leafId: leaf === 'left' ? LEFT : RIGHT,
+    incarnationId: `incarnation-${leaf}`
+  })
+}
+
+function surfaces(result: RuntimeMobileSessionTabsResult | undefined): string[] {
+  return (result?.tabs ?? []).map((tab) => `${tab.id}:${'status' in tab ? tab.status : ''}`)
+}
+
+async function listedSurfaces(runtime: OrcaRuntimeService): Promise<string[]> {
+  return surfaces(await runtime.listMobileSessionTabs(`id:${WORKTREE_ID}`))
+}
+
+// The session-tabs notify coalescer's max wait (mobile-session-tabs-notify-coalescer.ts).
+const COALESCED_PUSH_MS = 250
+
+describe('a restored terminal published before its PTY registers', () => {
+  afterEach(() => {
+    setRuntimeDesktopSurface(null)
+    vi.useRealTimers()
+  })
+
+  it.each([
+    ['local', LOCAL_HOST],
+    ['SSH without a saved PTY binding', SSH_HOST],
+    ['runtime host', RUNTIME_HOST]
+  ])('%s: is listed pending, then pushed ready when its PTY registers', async (_label, host) => {
+    vi.useFakeTimers()
+    const { runtime } = coldRestoredRuntime(host)
+    publishRendererFrame(runtime, makeRendererFrame(host))
+    expect(await listedSurfaces(runtime)).toEqual([
+      `tab::${LEFT}:pending-handle`,
+      `tab::${RIGHT}:pending-handle`
+    ])
+    vi.advanceTimersByTime(COALESCED_PUSH_MS)
+    const published: RuntimeMobileSessionTabsResult[] = []
+    const unsubscribe = runtime.onMobileSessionTabsChanged((event) => published.push(event))
+
+    registerLeaf(runtime, host, 'left')
+    vi.advanceTimersByTime(COALESCED_PUSH_MS)
+
+    // Registration alone reaches clients: no renderer frame or graph change follows it here.
+    expect(surfaces(published.at(-1))).toEqual([
+      `tab::${LEFT}:ready`,
+      `tab::${RIGHT}:pending-handle`
+    ])
+    const pushes = published.length
+    expect(
+      runtime.syncWindowGraph(1, {
+        tabs: RENDERER_TABS,
+        leaves: [],
+        mobileSessionTabs: [],
+        unchangedMobileSessionWorktrees: [WORKTREE_ID]
+      }).mobileSessionResyncWorktrees
+    ).toBeUndefined()
+    publishRendererFrame(runtime, makeRendererFrame(host))
+    vi.advanceTimersByTime(COALESCED_PUSH_MS)
+    expect(published).toHaveLength(pushes)
+    expect(await listedSurfaces(runtime)).toEqual([
+      `tab::${LEFT}:ready`,
+      `tab::${RIGHT}:pending-handle`
+    ])
+
+    registerLeaf(runtime, host, 'right')
+    vi.advanceTimersByTime(COALESCED_PUSH_MS)
+
+    expect(surfaces(published.at(-1))).toEqual([`tab::${LEFT}:ready`, `tab::${RIGHT}:ready`])
+    unsubscribe()
+  })
+
+  it('pushes a restore of several panes once, not once per registering pane', () => {
+    vi.useFakeTimers()
+    const { runtime } = coldRestoredRuntime()
+    publishRendererFrame(runtime, makeRendererFrame(LOCAL_HOST))
+    vi.advanceTimersByTime(COALESCED_PUSH_MS)
+    const published: RuntimeMobileSessionTabsResult[] = []
+    const unsubscribe = runtime.onMobileSessionTabsChanged((event) => published.push(event))
+
+    registerLeaf(runtime, LOCAL_HOST, 'left')
+    registerLeaf(runtime, LOCAL_HOST, 'right')
+    vi.advanceTimersByTime(COALESCED_PUSH_MS)
+
+    expect(published.map(surfaces)).toEqual([[`tab::${LEFT}:ready`, `tab::${RIGHT}:ready`]])
+    unsubscribe()
+  })
+
+  it('keeps listing a restored pane whose PTY never returns as pending', async () => {
+    const { runtime } = coldRestoredRuntime()
+    publishRendererFrame(runtime, makeRendererFrame(LOCAL_HOST))
+
+    registerLeaf(runtime, LOCAL_HOST, 'left')
+    runtime.registerPty('pty-other', WORKTREE_ID, null, {
+      tabId: 'tab-other',
+      leafId: RIGHT,
+      incarnationId: 'incarnation-other'
+    })
+
+    expect(await listedSurfaces(runtime)).toEqual([
+      `tab::${LEFT}:ready`,
+      `tab::${RIGHT}:pending-handle`
+    ])
+  })
+})
+
+describe('a retired restored terminal stays out of a later renderer frame', () => {
+  afterEach(() => setRuntimeDesktopSurface(null))
+
+  it('after its process exits and the retirement is saved', async () => {
+    const { runtime, sessions } = coldRestoredRuntime()
+    registerLeaf(runtime, LOCAL_HOST, 'left')
+    publishRendererFrame(runtime, makeRendererFrame(LOCAL_HOST))
+    expect(await listedSurfaces(runtime)).toContain(`tab::${LEFT}:ready`)
+
+    await runtime.onPtyExit('pty-left', 0, 'incarnation-left')
+
+    expect(sessions.get(LOCAL_EXECUTION_HOST_ID)?.terminalLayoutsByTabId.tab?.root).toEqual({
+      type: 'leaf',
+      leafId: RIGHT
+    })
+    // A lagging renderer still lists the exited pane, at a newer version.
+    publishRendererFrame(runtime, makeRendererFrame(LOCAL_HOST, { version: 2 }))
+    expect(await listedSurfaces(runtime)).not.toContain(`tab::${LEFT}:ready`)
+    expect(await listedSurfaces(runtime)).not.toContain(`tab::${LEFT}:pending-handle`)
+  })
+
+  it('after its last pane exits from a runtime-host partition an older copy still lists', async () => {
+    const { runtime, sessions } = coldRestoredRuntime(RUNTIME_HOST)
+    // Left behind in another partition before the catalog owner rotated.
+    sessions.set(LOCAL_EXECUTION_HOST_ID, makeColdRestoredSession(RUNTIME_HOST))
+    registerLeaf(runtime, RUNTIME_HOST, 'left')
+    registerLeaf(runtime, RUNTIME_HOST, 'right')
+    publishRendererFrame(runtime, makeRendererFrame(RUNTIME_HOST))
+
+    await runtime.onPtyExit('pty-left', 0, 'incarnation-left')
+    await runtime.onPtyExit('pty-right', 0, 'incarnation-right')
+    // Emptying the owner's partition re-routes reads to the older copy.
+    expect(sessions.get(RUNTIME_HOST.hostId)?.tabsByWorktree[WORKTREE_ID]).toEqual([])
+
+    publishRendererFrame(runtime, makeRendererFrame(RUNTIME_HOST, { version: 2 }))
+    expect(await listedSurfaces(runtime)).toEqual([])
+  })
+
+  it('after the user closes it on the desktop', async () => {
+    const { runtime, sessions } = coldRestoredRuntime()
+    registerLeaf(runtime, LOCAL_HOST, 'left')
+    registerLeaf(runtime, LOCAL_HOST, 'right')
+    publishRendererFrame(runtime, makeRendererFrame(LOCAL_HOST))
+    expect(await listedSurfaces(runtime)).toEqual([`tab::${LEFT}:ready`, `tab::${RIGHT}:ready`])
+
+    publishRendererFrame(runtime, makeRendererFrame(LOCAL_HOST, { version: 2, leaves: [LEFT] }))
+    await runtime.onPtyExit('pty-right', 0, 'incarnation-right')
+    expect(sessions.get(LOCAL_EXECUTION_HOST_ID)?.terminalLayoutsByTabId.tab?.root).toEqual({
+      type: 'leaf',
+      leafId: LEFT
+    })
+
+    publishRendererFrame(runtime, makeRendererFrame(LOCAL_HOST, { version: 3 }))
+    expect(await listedSurfaces(runtime)).toEqual([`tab::${LEFT}:ready`])
+  })
+})
+
+// An SSH worktree: the phone closes a tab while a relaunched sibling tab has not registered yet.
+const SSH_PTY_X = 'ssh:ssh-1@@pty-x'
+const SSH_PTY_Y = 'ssh:ssh-1@@pty-y'
+
+function makeSshSession(tabIds: readonly ('tab-x' | 'tab-y')[]): WorkspaceSessionState {
+  // tab-x's relaunched PTY has not bound yet, so only tab-y saves a relay binding.
+  const specs = {
+    'tab-x': { leafId: LEFT, ptyId: null },
+    'tab-y': { leafId: RIGHT, ptyId: SSH_PTY_Y }
+  }
+  return {
+    ...getDefaultWorkspaceSession(),
+    tabsByWorktree: {
+      [WORKTREE_ID]: tabIds.map((id, index) => ({
+        id,
+        ptyId: specs[id].ptyId,
+        worktreeId: WORKTREE_ID,
+        title: id,
+        customTitle: null,
+        color: null,
+        sortOrder: index,
+        createdAt: index + 1
+      }))
+    },
+    terminalLayoutsByTabId: Object.fromEntries(
+      tabIds.map((id) => [
+        id,
+        {
+          root: { type: 'leaf' as const, leafId: specs[id].leafId },
+          activeLeafId: specs[id].leafId,
+          expandedLeafId: null,
+          ptyIdsByLeafId: specs[id].ptyId ? { [specs[id].leafId]: specs[id].ptyId } : {}
+        }
+      ])
+    ),
+    terminalTopologyRevisionByRepoId: { [REPO_ID]: 2 }
+  }
+}
+
+function publishSshRendererFrame(runtime: OrcaRuntimeService): void {
+  const tabs = [
+    { tabId: 'tab-x', leafId: LEFT, ptyId: SSH_PTY_X },
+    { tabId: 'tab-y', leafId: RIGHT, ptyId: SSH_PTY_Y }
+  ]
+  runtime.syncWindowGraph(1, {
+    tabs: tabs.map(({ tabId, leafId }) => ({
+      tabId,
+      worktreeId: WORKTREE_ID,
+      title: tabId,
+      activeLeafId: leafId,
+      layout: { type: 'leaf' as const, leafId }
+    })),
+    leaves: [],
+    mobileSessionTabs: [
+      {
+        worktree: WORKTREE_ID,
+        publicationEpoch: 'renderer',
+        snapshotVersion: 1,
+        activeGroupId: 'group',
+        activeTabId: `tab-y::${RIGHT}`,
+        activeTabType: 'terminal',
+        tabGroups: [{ id: 'group', activeTabId: 'tab-y', tabOrder: ['tab-x', 'tab-y'] }],
+        tabs: tabs.map(({ tabId, leafId, ptyId }) => ({
+          type: 'terminal' as const,
+          id: `${tabId}::${leafId}`,
+          parentTabId: tabId,
+          leafId,
+          ptyId,
+          title: tabId,
+          isActive: tabId === 'tab-y'
+        }))
+      }
+    ]
+  })
+}
+
+describe('a surface the host retired stays retired when a restored sibling registers', () => {
+  afterEach(() => setRuntimeDesktopSurface(null))
+
+  it('keeps a phone-closed SSH terminal closed while its remote PTY is still exiting', async () => {
+    const { runtime, sessions } = coldRestoredRuntime(SSH_HOST)
+    sessions.set(SSH_HOST.hostId, makeSshSession(['tab-x', 'tab-y']))
+    const kill = vi.fn(() => true)
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the close path uses only these two relays.
+    runtime.setNotifier({
+      closeTerminal: vi.fn(),
+      // The renderer durably retires the tab and acks; its pruned frame is still in flight.
+      closeTerminalTab: vi.fn(async () => {
+        sessions.set(SSH_HOST.hostId, makeSshSession(['tab-x']))
+      })
+    } as never)
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the close path kills and inventories only; the remote kill lands asynchronously.
+    runtime.setPtyController({
+      write: () => true,
+      kill,
+      listProcesses: vi.fn(async () =>
+        [SSH_PTY_X, SSH_PTY_Y].map((id) => ({ id, cwd: '/worktree', title: 'shell' }))
+      ),
+      getForegroundProcess: async () => null
+    } as never)
+    publishSshRendererFrame(runtime)
+    runtime.registerPty(SSH_PTY_Y, WORKTREE_ID, 'ssh-1', {
+      tabId: 'tab-y',
+      leafId: RIGHT,
+      incarnationId: 'incarnation-y'
+    })
+    expect(await listedSurfaces(runtime)).toContain(`tab-y::${RIGHT}:ready`)
+
+    await runtime.closeMobileSessionTab(`id:${WORKTREE_ID}`, 'tab-y', { reason: 'user' })
+    expect(kill).toHaveBeenCalledWith(SSH_PTY_Y)
+    runtime.registerPty(SSH_PTY_X, WORKTREE_ID, 'ssh-1', {
+      tabId: 'tab-x',
+      leafId: LEFT,
+      incarnationId: 'incarnation-x'
+    })
+
+    expect(await listedSurfaces(runtime)).not.toContain(`tab-y::${RIGHT}:ready`)
+  })
+
+  it('keeps a phone-closed chat tab closed', async () => {
+    const { runtime } = coldRestoredRuntime()
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the chat close path uses only this relay.
+    runtime.setNotifier({ closeSessionTab: vi.fn(async () => {}) } as never)
+    publishRendererFrame(
+      runtime,
+      makeRendererFrame(LOCAL_HOST, {
+        extraTabs: [
+          {
+            type: 'agent-session',
+            id: 'chat',
+            title: 'Chat',
+            sessionId: 'session-chat',
+            agent: 'claude',
+            isActive: false
+          }
+        ]
+      })
+    )
+    expect(await listedSurfaces(runtime)).toContain('chat:')
+
+    await runtime.closeMobileSessionTab(`id:${WORKTREE_ID}`, 'chat', { reason: 'user' })
+    registerLeaf(runtime, LOCAL_HOST, 'left')
+
+    expect(await listedSurfaces(runtime)).not.toContain('chat:')
+  })
+})
+
+// A phone creates a terminal while the desktop's frame still lacks it: the spawn registered and the
+// host published the tab itself, as it does for a create the desktop has not published yet.
+const PHONE_LEAF = '33333333-3333-4333-8333-333333333333'
+
+async function runtimeWithUnpublishedPhoneCreate(): Promise<OrcaRuntimeService> {
+  const { runtime } = coldRestoredRuntime()
+  const handlers = new Map<string, (event: unknown, reply: unknown) => void>()
+  const webContents = {
+    isDestroyed: () => false,
+    setBackgroundThrottling: () => {},
+    send: (channel: string, payload: { requestId: string }) => {
+      if (channel !== 'terminal:requestTabCreate') {
+        return
+      }
+      runtime.registerPty('pty-phone', WORKTREE_ID, null, {
+        tabId: 'tab-phone',
+        leafId: PHONE_LEAF,
+        incarnationId: 'incarnation-phone'
+      })
+      handlers.get('terminal:tabCreateReply')?.(
+        { sender: webContents },
+        { requestId: payload.requestId, tabId: 'tab-phone', title: 'Terminal' }
+      )
+    }
+  }
+  setRuntimeDesktopSurface({
+    showNotification: () => false,
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the create path reads only liveness and these webContents members off its authoritative window.
+    findWindowById: () => ({ isDestroyed: () => false, webContents }) as never,
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: only the tab-create reply channel is registered on this path.
+    onIpc: (channel, listener) => handlers.set(channel, listener as never),
+    removeIpcListener: (channel) => handlers.delete(channel)
+  })
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the create path focuses only when activating, which this create does not.
+  runtime.setNotifier({ focusTerminal: vi.fn() } as never)
+  Object.assign(runtime, {
+    resolveTerminalWorkspaceLaunchScope: vi.fn(async () => ({
+      id: WORKTREE_ID,
+      path: '/worktree',
+      connectionId: null,
+      repo: LOCAL_HOST.repo,
+      folderWorkspace: null
+    }))
+  })
+  publishRendererFrame(runtime, makeRendererFrame(LOCAL_HOST))
+  await runtime.createMobileSessionTerminal(`id:${WORKTREE_ID}`, {
+    activate: false,
+    clientNavigationId: 'phone'
+  })
+  return runtime
+}
+
+describe('a surface the host added stays listed when a restored sibling registers', () => {
+  afterEach(() => setRuntimeDesktopSurface(null))
+
+  it('keeps a phone-created terminal listed', async () => {
+    const runtime = await runtimeWithUnpublishedPhoneCreate()
+    expect(await listedSurfaces(runtime)).toContain(`tab-phone::${PHONE_LEAF}:ready`)
+
+    registerLeaf(runtime, LOCAL_HOST, 'left')
+
+    expect(await listedSurfaces(runtime)).toContain(`tab-phone::${PHONE_LEAF}:ready`)
+  })
+})
diff --git a/src/main/runtime/orca-runtime-controller-knows-pty-is-live.ts b/src/main/runtime/orca-runtime-controller-knows-pty-is-live.ts
index 391b55ac5b02..3c9c8b7eab94 100644
--- a/src/main/runtime/orca-runtime-controller-knows-pty-is-live.ts
+++ b/src/main/runtime/orca-runtime-controller-knows-pty-is-live.ts
@@ -3,6 +3,7 @@ import { OrcaRuntimeWithResolveTerminalPane } from './orca-runtime-resolve-termi
 import { PROVEN_ABSENT_LEAF_PTY_TTL_MS } from './orca-runtime-core'
 import { pruneExpiredProvenAbsentLeafPtyVerdicts } from './proven-absent-leaf-pty-verdicts'
 import type { RuntimeTerminalSend } from '../../shared/runtime-types'
+import type { TerminalInputKind } from '../../shared/terminal-input-kind'
 import type { RuntimeAgentPromptWriteOptions } from './runtime-terminal-contracts'
 import {
   assertTerminalInputWithinLimitWithYield,
@@ -103,7 +104,8 @@ export class OrcaRuntimeWithControllerKnowsPtyIsLive extends OrcaRuntimeWithReso
       reserveWrite?: (ptyId: string) => void
       afterWrite?: (ptyId: string) => void | Promise<void>
       suffixFailureError?: string
-    } = {}
+      inputKind: TerminalInputKind
+    }
   ): Promise<RuntimeTerminalSend> {
     const pty = this.getLivePtyForHandle(handle)
     if (pty) {
@@ -152,7 +154,7 @@ export class OrcaRuntimeWithControllerKnowsPtyIsLive extends OrcaRuntimeWithReso
   async sendTerminalAgentPrompt(
     handle: string,
     prompt: string,
-    options: RuntimeAgentPromptWriteOptions = {}
+    options: RuntimeAgentPromptWriteOptions
   ): Promise<RuntimeTerminalSend> {
     // Why the consuming agent: the foreground process reads the bytes; launchAgent covers startup.
     const payloadFor = (ptyId: string): string => {
diff --git a/src/main/runtime/orca-runtime-create-pty-headless-terminal-state.ts b/src/main/runtime/orca-runtime-create-pty-headless-terminal-state.ts
index b9f35478505b..dbdf4f1c37ae 100644
--- a/src/main/runtime/orca-runtime-create-pty-headless-terminal-state.ts
+++ b/src/main/runtime/orca-runtime-create-pty-headless-terminal-state.ts
@@ -45,7 +45,7 @@ export class OrcaRuntimeWithCreatePtyHeadlessTerminalState extends OrcaRuntimeWi
           // pending and flushes at the ready marker or the 15s
           // SHELL_READY_TIMEOUT_MS bound (session.ts) — a spawn-time query
           // reply is delayed at most that bound, not lost.
-          this.ptyController?.write(ptyId, reply)
+          this.ptyController?.write(ptyId, reply, 'query-reply')
         }
       }
     })
diff --git a/src/main/runtime/orca-runtime-create-terminal.ts b/src/main/runtime/orca-runtime-create-terminal.ts
index c366b6e57ef9..e95431dd51cc 100644
--- a/src/main/runtime/orca-runtime-create-terminal.ts
+++ b/src/main/runtime/orca-runtime-create-terminal.ts
@@ -124,6 +124,7 @@ export class OrcaRuntimeWithCreateTerminal extends OrcaRuntimeWithTerminalCreate
         }
         let result: Awaited<ReturnType<NonNullable<dependencies.RuntimePtyController['spawn']>>>
         try {
+          launchOpts.onPtySpawnDispatched?.()
           result = await this.ptyController.spawn({
             cols: 120,
             rows: 40,
@@ -292,6 +293,8 @@ export class OrcaRuntimeWithCreateTerminal extends OrcaRuntimeWithTerminalCreate
         releaseStablePaneCreate()
       }
     }
+    // The renderer owns this spawn, so this process cannot see when it is requested.
+    opts.onPtySpawnDispatched?.()
     return createDesktopTerminal(this, worktreeSelector, opts, presentation, rendererWindow)
   }
 }
diff --git a/src/main/runtime/orca-runtime-deliver-pending-messages.ts b/src/main/runtime/orca-runtime-deliver-pending-messages.ts
index 55c6a8dad5e1..2cd1cc69c003 100644
--- a/src/main/runtime/orca-runtime-deliver-pending-messages.ts
+++ b/src/main/runtime/orca-runtime-deliver-pending-messages.ts
@@ -137,7 +137,7 @@ export class OrcaRuntimeWithDeliverPendingMessages extends OrcaRuntimeWithResolv
     let settlesInEnterCallback = false
     try {
       const payload = formatMessagePointer(unread.length, mailboxHandle)
-      const wrote = this.ptyController?.write(deliveryPtyId, payload) ?? false
+      const wrote = this.ptyController?.write(deliveryPtyId, payload, 'driving') ?? false
       if (!wrote) {
         return
       }
@@ -171,7 +171,7 @@ export class OrcaRuntimeWithDeliverPendingMessages extends OrcaRuntimeWithResolv
           if (!currentLeaf || currentLeaf.ptyId !== deliveryPtyId || !currentLeaf.writable) {
             return
           }
-          this.ptyController?.write(deliveryPtyId, '\r')
+          this.ptyController?.write(deliveryPtyId, '\r', 'driving')
         } catch {
           // Terminal may have closed during the delay; mail remains queued for check.
         } finally {
diff --git a/src/main/runtime/orca-runtime-fit-override-listeners.ts b/src/main/runtime/orca-runtime-fit-override-listeners.ts
index 5ef17ce4c2ea..6d4242d77587 100644
--- a/src/main/runtime/orca-runtime-fit-override-listeners.ts
+++ b/src/main/runtime/orca-runtime-fit-override-listeners.ts
@@ -74,6 +74,7 @@ export class OrcaRuntimeWithFitOverrideListeners extends OrcaRuntimeWithStopRequ
   protected providerSnapshotsWithLiveModeTransition = new WeakSet<PtyProviderBufferSnapshot>()
 
   protected ptyLifecycleGenerationById = new Map<string, number>()
+  protected pendingPtySurfaceRetirementsByPtyId = new Map<string, object>()
 
   protected nextPtyLifecycleGeneration = 1
 
diff --git a/src/main/runtime/orca-runtime-get-orchestration-dispatch-authority.ts b/src/main/runtime/orca-runtime-get-orchestration-dispatch-authority.ts
index d61374c34665..5eb0bffb8e85 100644
--- a/src/main/runtime/orca-runtime-get-orchestration-dispatch-authority.ts
+++ b/src/main/runtime/orca-runtime-get-orchestration-dispatch-authority.ts
@@ -22,6 +22,7 @@ import { getAppEnvironment } from '../../shared/app-environment'
 import type { FleetAgentStatusEvidence } from '../../shared/orchestration-fleet-agent-status-evidence'
 import { readOrchestrationFleetAgentStatusSnapshot } from './orchestration-fleet-agent-status-snapshot'
 import { resolveStructuredWorkerAuthority } from './structured-worker-authority'
+import { matchesProcessIncarnation } from './orchestration/worker-terminal-process-liveness'
 
 export class OrcaRuntimeWithGetOrchestrationDispatchAuthority extends OrcaRuntimeWithVerifyOrchestrationCompatibilityCaller {
   /** Every pane key this PTY could be addressed by, including restored receipts. */
@@ -270,4 +271,38 @@ export class OrcaRuntimeWithGetOrchestrationDispatchAuthority extends OrcaRuntim
         : undefined
     })
   }
+  /**
+   * Recover a live terminal handle for a worker whose durable handle stopped resolving
+   * (renderer graph epoch bump / handle invalidation) while its PTY is still tracked. Fences on
+   * the recorded process incarnation EXACTLY — never a bare ptyId, worktree, or pane — so a
+   * reused ptyId belonging to a different process can never be closed, and fails closed on an
+   * unknown host scope (this is also consumed by workerShow, which does no lease re-check).
+   * Returns a freshly minted live handle, or null when no live PTY carries that exact incarnation.
+   */
+  resolveTerminalHandleByProcessIncarnation(
+    processIncarnation: string,
+    serializedHostScope: string | null
+  ): string | null {
+    if (!processIncarnation || !serializedHostScope) {
+      return null
+    }
+    // Scan by the incarnation itself (startsWith + exact equality, mirroring
+    // classifyWorkerTerminalProcessIncarnation) rather than splitting on a colon, so relay/SSH
+    // ptyIds and colon-bearing incarnationIds still match. A pty with no incarnationId can never
+    // match, so the legacy `${runtimeId}:${ptyId}:${ptyGeneration}` fence stays fail-closed.
+    for (const [ptyId, pty] of this.ptysById) {
+      if (!matchesProcessIncarnation(ptyId, pty.incarnationId, processIncarnation)) {
+        continue
+      }
+      const hostScope = this.getOrchestrationCompatibilityHostScope(pty)
+      if (!hostScope || JSON.stringify(hostScope) !== serializedHostScope) {
+        // Keep scanning: a colon-ambiguous decoy pty in a different host scope that this
+        // incarnation string happens to prefix-match must not suppress the genuine same-scope
+        // pty later in ptysById. The scope check still fences the real match below.
+        continue
+      }
+      return this.issuePtyHandle(pty)
+    }
+    return null
+  }
 }
diff --git a/src/main/runtime/orca-runtime-get-pty-record-for-pane-key.ts b/src/main/runtime/orca-runtime-get-pty-record-for-pane-key.ts
index 564555513496..e26301e379a2 100644
--- a/src/main/runtime/orca-runtime-get-pty-record-for-pane-key.ts
+++ b/src/main/runtime/orca-runtime-get-pty-record-for-pane-key.ts
@@ -246,7 +246,7 @@ export class OrcaRuntimeWithGetPtyRecordForPaneKey extends OrcaRuntimeWithPruneM
    * The worker's ACTIVE dispatch is preferred when it has one, so peer and coordinator nudges share
    * one operation-ledger budget and one set of retain rules. A worker BETWEEN dispatches is still
    * nudged, under a session-scoped budget: the mail is durable, the session is live, and a dispatch
-   * says nothing about whether delivery is safe — the idle gate and the lease fence do that.
+   * says nothing about whether delivery is safe — the idle gate and the writer lease do that.
    */
   protected resolveStructuredWorkerDirectMailboxTarget(
     handle: string
diff --git a/src/main/runtime/orca-runtime-get-runtime-id.ts b/src/main/runtime/orca-runtime-get-runtime-id.ts
index a56825a4a851..ee7fe60e85e4 100644
--- a/src/main/runtime/orca-runtime-get-runtime-id.ts
+++ b/src/main/runtime/orca-runtime-get-runtime-id.ts
@@ -180,6 +180,10 @@ export class OrcaRuntimeWithGetRuntimeId extends OrcaRuntimeWithHasExactPersiste
     return this.workspaceSessions.get(worktreeId)
   }
 
+  protected getOwnWorkspaceSessionForWorktree(worktreeId: string): WorkspaceSessionState | null {
+    return this.workspaceSessions.getOwnPartition(worktreeId)
+  }
+
   protected setWorkspaceSessionForWorktree(
     worktreeId: string,
     session: WorkspaceSessionState
diff --git a/src/main/runtime/orca-runtime-get-status.ts b/src/main/runtime/orca-runtime-get-status.ts
index 4d2219e3e565..39b8dbf0dcfb 100644
--- a/src/main/runtime/orca-runtime-get-status.ts
+++ b/src/main/runtime/orca-runtime-get-status.ts
@@ -15,6 +15,7 @@ import {
   RUNTIME_CAPABILITIES,
   RUNTIME_PROTOCOL_VERSION,
   SESSION_TABS_AUTHORITATIVE_INVENTORY_RUNTIME_CAPABILITY,
+  TERMINAL_PROMPT_DELIVERY_RUNTIME_CAPABILITY,
   TERMINAL_PAIRED_PARKING_RUNTIME_CAPABILITY
 } from '../../shared/protocol-version'
 import {
@@ -46,6 +47,17 @@ type RuntimeStatusHost = {
   ): string[]
 }
 
+function supportsDurableTerminalPromptDelivery(): boolean {
+  if (typeof process.getBuiltinModule !== 'function') {
+    return false
+  }
+  try {
+    return process.getBuiltinModule('node:sqlite') !== undefined
+  } catch {
+    return false
+  }
+}
+
 export class OrcaRuntimeWithGetStatus extends OrcaRuntimeWithGetRuntimeId {
   private asRuntimeStatusHost(): RuntimeStatusHost {
     return this as unknown as RuntimeStatusHost
@@ -76,7 +88,9 @@ export class OrcaRuntimeWithGetStatus extends OrcaRuntimeWithGetRuntimeId {
         (process.env.ORCA_E2E_DISABLE_PAIRED_TERMINAL_PARKING !== '1' ||
           capability !== TERMINAL_PAIRED_PARKING_RUNTIME_CAPABILITY) &&
         (process.env.ORCA_E2E_DISABLE_AUTHORITATIVE_SESSION_TABS_INVENTORY !== '1' ||
-          capability !== SESSION_TABS_AUTHORITATIVE_INVENTORY_RUNTIME_CAPABILITY)
+          capability !== SESSION_TABS_AUTHORITATIVE_INVENTORY_RUNTIME_CAPABILITY) &&
+        (capability !== TERMINAL_PROMPT_DELIVERY_RUNTIME_CAPABILITY ||
+          supportsDurableTerminalPromptDelivery())
     )
     if (hasOffscreen || hasHeadlessCommands) {
       capabilities.push(BROWSER_HEADLESS_RUNTIME_CAPABILITY)
diff --git a/src/main/runtime/orca-runtime-get-structured-agent-session-create-support.ts b/src/main/runtime/orca-runtime-get-structured-agent-session-create-support.ts
index f2143b9772c0..ce2cf31b9ced 100644
--- a/src/main/runtime/orca-runtime-get-structured-agent-session-create-support.ts
+++ b/src/main/runtime/orca-runtime-get-structured-agent-session-create-support.ts
@@ -1,4 +1,5 @@
 // @ts-nocheck -- mechanically split from OrcaRuntimeService; behavior is covered by AST equivalence and characterization tests.
+import { agentSessionRefusalError } from '../../shared/agent-session-wire-refusals'
 import { OrcaRuntimeWithGetWorktreePs } from './orca-runtime-get-worktree-ps'
 import { supportsCodexStructuredLocation } from '../codex/codex-structured-location-support'
 import { supportsClaudeStructuredLocation } from '../claude/claude-structured-location-support'
@@ -156,7 +157,9 @@ export class OrcaRuntimeWithGetStructuredAgentSessionCreateSupport extends OrcaR
   ): Promise<AgentSessionAttachParams> {
     const support = await this.getStructuredAgentSessionCreateSupport(input.worktree, input.agent)
     if (!support.supported) {
-      throw new Error('structured_agent_session_unsupported')
+      throw agentSessionRefusalError('structured_agent_session_unsupported', {
+        reason: 'hostUnsupported'
+      })
     }
     const settings = this.requireStore().getSettings()
     const launchEnv = resolveTuiAgentLaunchEnv(input.agent, settings.agentDefaultEnv)
diff --git a/src/main/runtime/orca-runtime-get-worktree-ps.ts b/src/main/runtime/orca-runtime-get-worktree-ps.ts
index cf7e8e56db1b..107cbd63407f 100644
--- a/src/main/runtime/orca-runtime-get-worktree-ps.ts
+++ b/src/main/runtime/orca-runtime-get-worktree-ps.ts
@@ -19,6 +19,7 @@ import { firstWorkRenameDeps } from '../agent-hooks/first-work-rename-runtime'
 import { getProfileUserDataPath } from '../orca-profiles/profile-storage-paths'
 import { LOCAL_EXECUTION_HOST_ID } from '../../shared/execution-host'
 import { buildWorktreeListingPage } from './worktree-listing-host-scope'
+import { structuredWorkerOwesWork } from './structured-worker-custody'
 import { resolveTuiAgentLaunchEnv } from '../../shared/tui-agent-launch-defaults'
 import { nativeChatShellEnvironmentPolicy } from '../../shared/native-chat-shell-environment'
 import { claudeStructuredPermissionModeForSettings } from '../claude/claude-structured-permission-mode'
@@ -171,7 +172,11 @@ export class OrcaRuntimeWithGetWorktreePs extends OrcaRuntimeWithStartTuiIdleVis
           firstWorkRenameDeps(this.requireStore(), this)
         )
       },
-      ...(this.structuredAgentStatusSinkFn ? { statusSink: this.structuredAgentStatusSinkFn } : {})
+      ...(this.structuredAgentStatusSinkFn ? { statusSink: this.structuredAgentStatusSinkFn } : {}),
+      // Read per sweep tick from the orchestration database: a worker whose dispatch is open keeps
+      // its agent running. No database answers no.
+      hasOpenDispatch: (record) =>
+        structuredWorkerOwesWork(this.getOrchestrationDbIfAvailable?.() ?? null, record)
     })
   }
 }
diff --git a/src/main/runtime/orca-runtime-get-worktree-terminal-provisioning-host.ts b/src/main/runtime/orca-runtime-get-worktree-terminal-provisioning-host.ts
index d9d6b2acfb93..7f42304eb8b9 100644
--- a/src/main/runtime/orca-runtime-get-worktree-terminal-provisioning-host.ts
+++ b/src/main/runtime/orca-runtime-get-worktree-terminal-provisioning-host.ts
@@ -36,7 +36,7 @@ export class OrcaRuntimeWithGetWorktreeTerminalProvisioningHost extends OrcaRunt
         this.ptyController!.hasChildProcesses?.(ptyId) ?? Promise.resolve(false),
       subscribeToData: (ptyId, listener) => this.subscribeToTerminalData(ptyId, listener),
       readRecentOutput: (ptyId) => this.recentPtyOutputById.get(ptyId)?.read(),
-      write: (ptyId, data) => this.ptyController?.write(ptyId, data)
+      write: (ptyId, data, inputKind) => this.ptyController?.write(ptyId, data, inputKind)
     }
   }
 
diff --git a/src/main/runtime/orca-runtime-has-exact-persisted-terminal-surface-identity.ts b/src/main/runtime/orca-runtime-has-exact-persisted-terminal-surface-identity.ts
index d0425cdc1f93..7aea8a0d0d74 100644
--- a/src/main/runtime/orca-runtime-has-exact-persisted-terminal-surface-identity.ts
+++ b/src/main/runtime/orca-runtime-has-exact-persisted-terminal-surface-identity.ts
@@ -5,6 +5,8 @@ import {
   runtimeWorktreeIdsEqual
 } from './runtime-worktree-path-identity'
 import { makePaneKey } from '../../shared/stable-pane-id'
+import type { WorkspaceSessionState } from '../../shared/workspace-session-state-types'
+import { layoutContainsLeafId } from '../persistence/restoring-sessions/terminal-layout-normalization'
 import type { LegacyWorkerTerminalRecoveryPlan } from './orchestration/orchestration-legacy-worker-terminal-recovery'
 import { retireTerminalSurfacesFromSnapshot } from './mobile-session-terminal-retirement'
 import type {
@@ -27,6 +29,35 @@ import type {
 } from '../../shared/artifacts'
 
 export class OrcaRuntimeWithHasExactPersistedTerminalSurfaceIdentity extends OrcaRuntimeWithAutomationOperations {
+  /** The host's saved session, when it still lists `tabId` under this worktree. */
+  protected getPersistedSessionListingTerminalTab(
+    worktreeId: string,
+    tabId: string,
+    session = this.getWorkspaceSessionForWorktree(worktreeId)
+  ): WorkspaceSessionState | null {
+    const sessionWorktreeId = session ? resolveTerminalSessionWorktreeId(session, worktreeId) : null
+    return session &&
+      sessionWorktreeId &&
+      session.tabsByWorktree[sessionWorktreeId]?.some((candidate) => candidate.id === tabId)
+      ? session
+      : null
+  }
+
+  protected hasPersistedTerminalSurfaceMembership(
+    worktreeId: string,
+    tabId: string,
+    leafId: string
+  ): boolean {
+    // Why own partition: emptying a rotated runtime partition re-routes reads to an older copy
+    // that can still list a surface retirement just removed.
+    const layout = this.getPersistedSessionListingTerminalTab(
+      worktreeId,
+      tabId,
+      this.getOwnWorkspaceSessionForWorktree(worktreeId)
+    )?.terminalLayoutsByTabId[tabId]
+    return Boolean(layout && layoutContainsLeafId(layout.root, leafId))
+  }
+
   protected hasExactPersistedTerminalSurfaceIdentity(expected: {
     worktreeId: string
     tabId: string
@@ -34,19 +65,10 @@ export class OrcaRuntimeWithHasExactPersistedTerminalSurfaceIdentity extends Orc
     ptyId: string
     incarnationId: string
   }): boolean {
-    const session = this.getWorkspaceSessionForWorktree(expected.worktreeId)
-    const sessionWorktreeId = session
-      ? resolveTerminalSessionWorktreeId(session, expected.worktreeId)
-      : null
-    if (!session || !sessionWorktreeId) {
-      return false
-    }
-    const tab = session.tabsByWorktree[sessionWorktreeId]?.find(
-      (candidate) => candidate.id === expected.tabId
-    )
+    const session = this.getPersistedSessionListingTerminalTab(expected.worktreeId, expected.tabId)
     const paneKey = makePaneKey(expected.tabId, expected.leafId)
     return Boolean(
-      tab &&
+      session &&
       session.terminalLayoutsByTabId[expected.tabId]?.ptyIdsByLeafId?.[expected.leafId] ===
         expected.ptyId &&
       session.terminalPtyIncarnationsByPaneKey?.[paneKey] === expected.incarnationId
diff --git a/src/main/runtime/orca-runtime-invalidate-all-handles-for-pty.ts b/src/main/runtime/orca-runtime-invalidate-all-handles-for-pty.ts
index 9d6e5d56ca4b..a348309a5689 100644
--- a/src/main/runtime/orca-runtime-invalidate-all-handles-for-pty.ts
+++ b/src/main/runtime/orca-runtime-invalidate-all-handles-for-pty.ts
@@ -140,6 +140,7 @@ export class OrcaRuntimeWithInvalidateAllHandlesForPty extends OrcaRuntimeWithRe
     options: { awaitsRegistration?: boolean } = {}
   ): void {
     this.invalidatePtyControllerInventoryForLifecycle(ptyId)
+    this.pendingPtySurfaceRetirementsByPtyId.delete(ptyId)
     const existingPty = this.ptysById.get(ptyId)
     if (
       existingPty &&
diff --git a/src/main/runtime/orca-runtime-maybe-hydrate-headless-from-renderer.ts b/src/main/runtime/orca-runtime-maybe-hydrate-headless-from-renderer.ts
index 63135f261b78..3e8d618e8a40 100644
--- a/src/main/runtime/orca-runtime-maybe-hydrate-headless-from-renderer.ts
+++ b/src/main/runtime/orca-runtime-maybe-hydrate-headless-from-renderer.ts
@@ -1,5 +1,7 @@
 // @ts-nocheck -- mechanically split from OrcaRuntimeService; behavior is covered by AST equivalence and characterization tests.
+import { splitFreebuffScreenUpdates } from '../../shared/freebuff-screen-status'
 import { OrcaRuntimeWithSerializeMainTerminalBuffer } from './orca-runtime-serialize-main-terminal-buffer'
+import { observeFreebuffTerminalStatus } from './freebuff-terminal-status'
 import { MOBILE_SUBSCRIBE_SCROLLBACK_ROWS } from './scrollback-limits'
 import { detectAgentStatusFromTitle, normalizeTerminalTitle } from '../../shared/agent-detection'
 import { shouldModelAnswerHiddenPtyQueries } from './terminal-model-query-authority'
@@ -171,7 +173,26 @@ export class OrcaRuntimeWithMaybeHydrateHeadlessFromRenderer extends OrcaRuntime
       // Why inside the chain: the ownership mirror must observe live bytes in
       // the same total order as seeds (seedOwner also runs on this chain).
       state.ownership.scan(data)
-      await state.emulator.write(data, { forwardQueryReplies })
+      for (const chunk of splitFreebuffScreenUpdates(data, state.emulator.partialEscapeTailAnsi)) {
+        await state.emulator.write(chunk, { forwardQueryReplies })
+        const pty = this.ptysById.get(ptyId)
+        if (pty && !pty.connectionId && this.headlessTerminals.get(ptyId) === state) {
+          const payload = observeFreebuffTerminalStatus(
+            state.emulator,
+            chunk,
+            this.terminalSpawnCommandsByPtyId.get(ptyId),
+            pty.launchAgent
+          )
+          if (payload) {
+            pty.lastExplicitAgentStatus = { state: payload.state, updatedAt: Date.now() }
+            this.emitTerminalAgentStatusEvents(ptyId, {
+              cleanData: '',
+              payloads: [payload],
+              lastPayloadCleanOffset: null
+            })
+          }
+        }
+      }
       state.outputSequence = outputSequence
     })
     // Legacy callers remain best-effort; bounded SSH admission observes the raw receipt.
diff --git a/src/main/runtime/orca-runtime-mobile-close-preserved-resurrection.test.ts b/src/main/runtime/orca-runtime-mobile-close-preserved-resurrection.test.ts
index 5780b3539444..4260c8213efd 100644
--- a/src/main/runtime/orca-runtime-mobile-close-preserved-resurrection.test.ts
+++ b/src/main/runtime/orca-runtime-mobile-close-preserved-resurrection.test.ts
@@ -1,3 +1,4 @@
+import { withDurableRuntimeStore } from './runtime-durable-store-fixture'
 /**
  * STA-4593 incident: closing paired-remote tabs "worked briefly" but the tabs
  * returned seconds later and after workspace switches, on a host whose PTYs
@@ -103,7 +104,7 @@ function createHarness() {
     badgeColor: '#000000',
     addedAt: 1
   }
-  const store = {
+  const store = withDurableRuntimeStore({
     getRepos: () => [repo],
     getRepo: (id: string) => (id === REPO_ID ? repo : undefined),
     getAllWorktreeMeta: () => ({}),
@@ -115,7 +116,7 @@ function createHarness() {
       session = next
     },
     flushOrThrow: () => {}
-  }
+  })
   const relayAck = makeDeferred()
   const closeTerminal = vi.fn()
   const closeTerminalTab = vi.fn(() => relayAck.promise)
@@ -277,7 +278,7 @@ function createSplitHarness() {
     badgeColor: '#000000',
     addedAt: 1
   }
-  const store = {
+  const store = withDurableRuntimeStore({
     getRepos: () => [repo],
     getRepo: (id: string) => (id === REPO_ID ? repo : undefined),
     getAllWorktreeMeta: () => ({}),
@@ -289,7 +290,7 @@ function createSplitHarness() {
       session = next
     },
     flushOrThrow: () => {}
-  }
+  })
   const runtime = new OrcaRuntimeService(store as never)
   runtime.setNotifier({ closeTerminal: vi.fn(), closeTerminalTab: vi.fn(async () => {}) } as never)
   runtime.setPtyController({
diff --git a/src/main/runtime/orca-runtime-on-pty-exit.ts b/src/main/runtime/orca-runtime-on-pty-exit.ts
index 588a834d6e64..52b7024b8181 100644
--- a/src/main/runtime/orca-runtime-on-pty-exit.ts
+++ b/src/main/runtime/orca-runtime-on-pty-exit.ts
@@ -24,7 +24,7 @@ export class OrcaRuntimeWithOnPtyExit extends OrcaRuntimeWithOnClientDisconnecte
        * as -1, so the numeric code alone cannot tell a dead process from a failed stop. */
       providerExitObserved?: boolean
     } = {}
-  ): void {
+  ): void | Promise<void> {
     const pty = this.ptysById.get(ptyId)
     if (exitIncarnationId && pty?.incarnationId && exitIncarnationId !== pty.incarnationId) {
       return
@@ -75,7 +75,10 @@ export class OrcaRuntimeWithOnPtyExit extends OrcaRuntimeWithOnClientDisconnecte
     >()
     for (const [worktreeId, snapshot] of this.mobileSessionTabsByWorktree) {
       for (const tab of snapshot.tabs) {
-        if (tab.type === 'terminal' && tab.ptyId === ptyId) {
+        if (
+          tab.type === 'terminal' &&
+          (tab.ptyId === ptyId || tab.parentLayout?.ptyIdsByLeafId?.[tab.leafId] === ptyId)
+        ) {
           exactSurfaceByKey.set(`${worktreeId}\0${tab.parentTabId}\0${tab.leafId}`, {
             worktreeId,
             parentTabId: tab.parentTabId,
@@ -114,10 +117,9 @@ export class OrcaRuntimeWithOnPtyExit extends OrcaRuntimeWithOnClientDisconnecte
         exitIncarnationId ?? pendingIncarnation ?? pty?.incarnationId ?? null
       )
     }
-    const intentionalStopIncarnation = this.intentionalHandlelessPtyStops.get(ptyId)
-    const preservesIntentionalHandlelessSurface =
-      this.intentionalHandlelessPtyStops.has(ptyId) &&
-      (intentionalStopIncarnation === null || intentionalStopIncarnation === incarnationId)
+    // Why both kinds: a sleep keeps its wake hint, and a restart's replacement takes the pane.
+    const preservesIntentionallyStoppedSurface =
+      this.intentionalPtyStops.claimExit(ptyId, exitIncarnationId ?? pty?.incarnationId).length > 0
     advertisedUrlWatcher.unbindPty(ptyId)
     // Clean up new mobile state for this PTY
     this.mobileSubscribers.delete(ptyId)
@@ -139,11 +141,8 @@ export class OrcaRuntimeWithOnPtyExit extends OrcaRuntimeWithOnClientDisconnecte
     this.providerVisibleStateByPtyId.delete(ptyId)
     this.providerVisibleRetryAtByPtyId.delete(ptyId)
     this.agentPromptExplicitStatusFloorByPtyId.delete(ptyId)
-    // Safe against respawn: `getPtyLifecycleGeneration` lazily mints from the
-    // monotonic `nextPtyLifecycleGeneration`, so a re-read after this delete
-    // returns a strictly newer number — never a reused one. Every comparison a
-    // stale frame makes therefore still fails, exactly as the advance above intends.
     this.ptyLifecycleGenerationById.delete(ptyId)
+    this.pendingPtySurfaceRetirementsByPtyId.delete(ptyId)
     this.agentStatusOscProcessorsByPtyId.delete(ptyId)
     this.terminalSpawnCommandsByPtyId.delete(ptyId)
     this.disposePtyTitleTracker(ptyId)
@@ -216,13 +215,24 @@ export class OrcaRuntimeWithOnPtyExit extends OrcaRuntimeWithOnClientDisconnecte
       this.resolvePtyExitWaiters(pty, ptyId)
       this.pruneDisconnectedPtyTranscript(pty)
     }
-    if (preservesIntentionalHandlelessSurface || preservesAbnormalSshSurface) {
+    let retirement: Promise<void> | undefined
+    if (preservesIntentionallyStoppedSurface || preservesAbnormalSshSurface) {
       // Why: relay loss is recoverable; keep the HUB-owned pane addressable through the bounded reconnect grace.
       this.touchMobileSessionSnapshotsForPty(ptyId, { immediate: true })
     } else {
       // Why: permanent process exit is absence, not a starting/sleeping tab.
       // Retire before publishing so paired clients never persist a ghost.
-      this.retireMobileSessionSurfacesForPty(ptyId, incarnationId, exactSurfaces)
+      const pendingRetirement = {}
+      this.pendingPtySurfaceRetirementsByPtyId.set(ptyId, pendingRetirement)
+      retirement = this.retireMobileSessionSurfacesForPty(ptyId, incarnationId, exactSurfaces)
+        .catch((error) => {
+          console.error('[runtime] failed to publish terminal retirement:', error)
+        })
+        .finally(() => {
+          if (this.pendingPtySurfaceRetirementsByPtyId.get(ptyId) === pendingRetirement) {
+            this.pendingPtySurfaceRetirementsByPtyId.delete(ptyId)
+          }
+        })
     }
 
     const exitedSurfaces: { handle: string; paneKey: string | null }[] = []
@@ -253,6 +263,7 @@ export class OrcaRuntimeWithOnPtyExit extends OrcaRuntimeWithOnClientDisconnecte
       }
     }
     this.pruneDisconnectedPtyRecords()
+    return retirement
   }
 
   private notifyPtyExitListeners(ptyId: string): void {
diff --git a/src/main/runtime/orca-runtime-persist-headless-session-tab-props.ts b/src/main/runtime/orca-runtime-persist-headless-session-tab-props.ts
index 10489c6c701a..7c21c0256545 100644
--- a/src/main/runtime/orca-runtime-persist-headless-session-tab-props.ts
+++ b/src/main/runtime/orca-runtime-persist-headless-session-tab-props.ts
@@ -112,6 +112,7 @@ export class OrcaRuntimeWithPersistHeadlessSessionTabProps extends OrcaRuntimeWi
       tabId: string
       root: TerminalPaneLayoutNode | null
       expandedLeafId: string | null
+      chatLeafId?: string | null
       titlesByLeafId?: Record<string, string>
     }
   ): TerminalLayoutSnapshot | undefined {
@@ -131,6 +132,7 @@ export class OrcaRuntimeWithPersistHeadlessSessionTabProps extends OrcaRuntimeWi
           ...cloneTerminalLayoutSnapshot(existing),
           root: args.root ?? existing.root,
           expandedLeafId: args.expandedLeafId,
+          ...(args.chatLeafId !== undefined ? { chatLeafId: args.chatLeafId ?? undefined } : {}),
           ...(args.titlesByLeafId ? { titlesByLeafId: args.titlesByLeafId } : {})
         }
       }
@@ -149,6 +151,7 @@ export class OrcaRuntimeWithPersistHeadlessSessionTabProps extends OrcaRuntimeWi
       tabId: string
       root: TerminalPaneLayoutNode | null
       expandedLeafId: string | null
+      chatLeafId?: string | null
       titlesByLeafId?: Record<string, string>
     }
   ): void {
@@ -168,6 +171,7 @@ export class OrcaRuntimeWithPersistHeadlessSessionTabProps extends OrcaRuntimeWi
           ...tab.parentLayout,
           root: args.root ?? tab.parentLayout.root,
           expandedLeafId: args.expandedLeafId,
+          ...(args.chatLeafId !== undefined ? { chatLeafId: args.chatLeafId ?? undefined } : {}),
           ...(args.titlesByLeafId ? { titlesByLeafId: args.titlesByLeafId } : {})
         }
       }
diff --git a/src/main/runtime/orca-runtime-persist-terminal-surface-retirements.ts b/src/main/runtime/orca-runtime-persist-terminal-surface-retirements.ts
index 6b9887d2cf85..bafc280d9574 100644
--- a/src/main/runtime/orca-runtime-persist-terminal-surface-retirements.ts
+++ b/src/main/runtime/orca-runtime-persist-terminal-surface-retirements.ts
@@ -8,7 +8,8 @@ import type { WorkspaceSessionState } from '../../shared/workspace-session-state
 import { retireTerminalSurfaceFromPersistence } from './mobile-session-terminal-persistence-retirement'
 import { retireTerminalSurfacesFromSnapshot } from './mobile-session-terminal-retirement'
 import { attachRetirementProofsToSnapshot } from './mobile-session-terminal-retirement-proof'
-import { rollbackWorkspaceSessionAfterFailedAsyncWrite } from './workspace-session-failed-write-rollback'
+import { cloneWorkspaceSessionState } from '../persistence/restoring-sessions/session-owner-fields'
+import { rollbackWorkspaceSessionAfterFailedAsyncWrite } from '../persistence/restoring-sessions/workspace-session-write-rollback'
 import { getRepoIdFromWorktreeId } from '../../shared/worktree/id'
 
 export class OrcaRuntimeWithPersistTerminalSurfaceRetirements extends OrcaRuntimeWithTouchMobileSessionTabsForWorktree {
@@ -18,92 +19,77 @@ export class OrcaRuntimeWithPersistTerminalSurfaceRetirements extends OrcaRuntim
    * against the local partition strands the real ghost and bumps a foreign host's epoch.
    * Returns null when nothing may be published because persistence is unavailable or failed.
    */
-  protected persistTerminalSurfaceRetirements(
+  protected async persistTerminalSurfaceRetirements(
     retiredSurfaces: readonly RetiredTerminalSurface[]
-  ): { accepted: RetiredTerminalSurface[]; unpersisted: RetiredTerminalSurface[] } | null {
-    const surfacesByHostId = new Map<ExecutionHostId, RetiredTerminalSurface[]>()
-    for (const surface of retiredSurfaces) {
-      const hostId =
-        this.tryGetWorkspaceSessionHostIdForWorktree(surface.worktreeId) ?? LOCAL_EXECUTION_HOST_ID
-      const bucket = surfacesByHostId.get(hostId)
-      if (bucket) {
-        bucket.push(surface)
-      } else {
-        surfacesByHostId.set(hostId, [surface])
-      }
-    }
-    const accepted: RetiredTerminalSurface[] = []
-    const unpersisted: RetiredTerminalSurface[] = []
-    const pendingWrites: { hostId: ExecutionHostId; session: WorkspaceSessionState }[] = []
-    const originalSessions = new Map<ExecutionHostId, WorkspaceSessionState>()
-    const stagedSessions = new Map<ExecutionHostId, WorkspaceSessionState>()
-    for (const [hostId, surfaces] of surfacesByHostId) {
-      const session = this.store?.getWorkspaceSession?.(hostId)
-      if (!session) {
-        unpersisted.push(...surfaces)
-        continue
-      }
-      // Why: publishing absence before its host membership fence is durable lets a crash or
-      // stale renderer write resurrect the retired surface.
-      if (!this.store?.setWorkspaceSession || !this.store.flushOrThrow) {
-        return null
-      }
-      originalSessions.set(hostId, session)
-      let nextSession = session
-      const acceptedForHost: RetiredTerminalSurface[] = []
-      for (const surface of surfaces) {
-        const candidate = retireTerminalSurfaceFromPersistence(nextSession, surface)
-        if (candidate !== nextSession) {
-          acceptedForHost.push(surface)
-          nextSession = candidate
-        }
-      }
-      if (acceptedForHost.length === 0) {
-        continue
-      }
-      accepted.push(...acceptedForHost)
-      pendingWrites.push({ hostId, session: nextSession })
+  ): Promise<{ accepted: RetiredTerminalSurface[]; unpersisted: RetiredTerminalSurface[] } | null> {
+    if (!this.store?.runDurableMutation) {
+      const hasPersistedSession = retiredSurfaces.some((surface) =>
+        this.store?.getWorkspaceSession?.(
+          this.tryGetWorkspaceSessionHostIdForWorktree(surface.worktreeId) ??
+            LOCAL_EXECUTION_HOST_ID
+        )
+      )
+      return hasPersistedSession ? null : { accepted: [], unpersisted: [...retiredSurfaces] }
     }
-    if (pendingWrites.length > 0) {
-      try {
-        for (const write of pendingWrites) {
-          this.store?.setWorkspaceSession?.(write.session, write.hostId)
-          const staged = this.store?.getWorkspaceSession?.(write.hostId)
-          if (staged) {
-            stagedSessions.set(write.hostId, staged)
-          }
-        }
-        this.store?.flushOrThrow?.()
-      } catch (error) {
-        // setWorkspaceSession mutates the in-memory partition before the flush. Restore only
-        // fields still equal to our staged write so concurrent renderer updates survive.
-        for (const [hostId, original] of originalSessions) {
-          const staged = stagedSessions.get(hostId)
-          const current = this.store?.getWorkspaceSession?.(hostId)
-          if (!staged || !current) {
+    try {
+      return await this.store.runDurableMutation(() => {
+        const accepted: RetiredTerminalSurface[] = []
+        const unpersisted: RetiredTerminalSurface[] = []
+        const originals = new Map<ExecutionHostId, WorkspaceSessionState>()
+        const staged = new Map<ExecutionHostId, WorkspaceSessionState>()
+        for (const surface of retiredSurfaces) {
+          const hostId =
+            this.tryGetWorkspaceSessionHostIdForWorktree(surface.worktreeId) ??
+            LOCAL_EXECUTION_HOST_ID
+          const current = this.store.getWorkspaceSession?.(hostId)
+          if (!current) {
+            unpersisted.push(surface)
             continue
           }
-          const rolledBack = rollbackWorkspaceSessionAfterFailedAsyncWrite(
-            original,
-            staged,
-            current
-          )
-          if (rolledBack !== current) {
-            this.store?.setWorkspaceSession?.(rolledBack, hostId)
+          if (!this.store.setWorkspaceSession) {
+            throw new Error('workspace_session_unavailable')
+          }
+          if (!originals.has(hostId)) {
+            originals.set(hostId, cloneWorkspaceSessionState(current))
+          }
+          const next = retireTerminalSurfaceFromPersistence(current, surface)
+          if (next !== current) {
+            this.store.setWorkspaceSession(next, hostId)
+            staged.set(hostId, cloneWorkspaceSessionState(this.store.getWorkspaceSession(hostId)))
+            accepted.push(surface)
           }
         }
-        console.error('[runtime] failed to persist terminal retirement:', error)
-        return null
-      }
+        return {
+          value: { accepted, unpersisted },
+          persist: staged.size > 0,
+          rollback: () => {
+            for (const [hostId, stagedSession] of staged) {
+              const current = this.store.getWorkspaceSession(hostId)
+              const rolledBack = rollbackWorkspaceSessionAfterFailedAsyncWrite(
+                originals.get(hostId),
+                stagedSession,
+                current
+              )
+              if (rolledBack !== current) {
+                this.store.setWorkspaceSession(rolledBack, hostId)
+              }
+            }
+          }
+        }
+      })
+    } catch (error) {
+      console.error('[runtime] failed to persist terminal retirement:', error)
+      return null
     }
-    return { accepted, unpersisted }
   }
 
-  protected retireMobileSessionSurfacesForPty(
+  protected async retireMobileSessionSurfacesForPty(
     ptyId: string,
     incarnationId: string,
     exactSurfaces: readonly Pick<RetiredTerminalSurface, 'worktreeId' | 'parentTabId' | 'leafId'>[]
-  ): void {
+  ): Promise<void> {
+    // Reads can mint a new frame generation while this independent retirement waits for disk.
+    const pendingRetirement = this.pendingPtySurfaceRetirementsByPtyId.get(ptyId)
     const terminalHandle =
       this.handleByPtyId.get(ptyId) ?? this.findHandleForPtyRecord(ptyId) ?? undefined
     const retiredSurfaceByKey = new Map<string, RetiredTerminalSurface>()
@@ -135,8 +121,13 @@ export class OrcaRuntimeWithPersistTerminalSurfaceRetirements extends OrcaRuntim
     if (retiredSurfaces.length === 0) {
       return
     }
-    const persisted = this.persistTerminalSurfaceRetirements(retiredSurfaces)
-    if (!persisted) {
+    const persisted = await this.persistTerminalSurfaceRetirements(retiredSurfaces)
+    const currentIncarnation = this.ptysById.get(ptyId)?.incarnationId
+    if (
+      !persisted ||
+      this.pendingPtySurfaceRetirementsByPtyId.get(ptyId) !== pendingRetirement ||
+      (currentIncarnation && currentIncarnation !== incarnationId)
+    ) {
       return
     }
     for (const surface of persisted.unpersisted) {
diff --git a/src/main/runtime/orca-runtime-prune-mobile-session-tab-group-layout.ts b/src/main/runtime/orca-runtime-prune-mobile-session-tab-group-layout.ts
index 50b1f52d238a..75005726c2db 100644
--- a/src/main/runtime/orca-runtime-prune-mobile-session-tab-group-layout.ts
+++ b/src/main/runtime/orca-runtime-prune-mobile-session-tab-group-layout.ts
@@ -216,9 +216,10 @@ export class OrcaRuntimeWithPruneMobileSessionTabGroupLayout extends OrcaRuntime
   }
 
   // Why: group address resolution (Section 4.5) queries per-handle status and must not throw on stale handles; return null on any error.
-  getAgentStatusForHandle(handle: string): string | null {
+  async getAgentStatusForHandle(handle: string): Promise<string | null> {
     // A structured worker has no pane and no title, so every PTY probe below answers null and
-    // `@idle` would enumerate it and then silently drop it. Its status is the journal's.
+    // `@idle` would enumerate it and then silently drop it. Its status is the journal's, read
+    // through a conversation the idle sweep may have closed.
     const structured = resolveStructuredWorkerAuthority(handle, this._orchestrationDb)
     if (structured) {
       return structuredWorkerAgentStatus(structured.identity.sessionId)
diff --git a/src/main/runtime/orca-runtime-refresh-floating-workspace-pty-liveness.ts b/src/main/runtime/orca-runtime-refresh-floating-workspace-pty-liveness.ts
index de98831cdd51..b09ca3b7b8dc 100644
--- a/src/main/runtime/orca-runtime-refresh-floating-workspace-pty-liveness.ts
+++ b/src/main/runtime/orca-runtime-refresh-floating-workspace-pty-liveness.ts
@@ -146,6 +146,7 @@ export class OrcaRuntimeWithRefreshFloatingWorkspacePtyLiveness extends OrcaRunt
     this.providerVisibleRetryAtByPtyId.delete(ptyId)
     this.agentStatusOscProcessorsByPtyId.delete(ptyId)
     this.terminalSpawnCommandsByPtyId.delete(ptyId)
+    this.terminalRunFacts.delete(ptyId)
     this.disposePtyTitleTracker(ptyId)
     this.invalidatePtyIncarnationHandle(ptyId)
     this.oscTitleScanTailByPtyId.delete(ptyId)
diff --git a/src/main/runtime/orca-runtime-register-pty.ts b/src/main/runtime/orca-runtime-register-pty.ts
index 37a5434e5c5b..ba7b47be72d2 100644
--- a/src/main/runtime/orca-runtime-register-pty.ts
+++ b/src/main/runtime/orca-runtime-register-pty.ts
@@ -27,6 +27,7 @@ export class OrcaRuntimeWithRegisterPty extends OrcaRuntimeWithInvalidateAllHand
     isWsl?: boolean
   ): void {
     this.assertPtyDidNotExitBeforeRegistration(ptyId, binding?.incarnationId)
+    this.pendingPtySurfaceRetirementsByPtyId.delete(ptyId)
     this.invalidatePtyControllerInventoryForLifecycle(ptyId, connectionId)
     const existingPty = this.ptysById.get(ptyId)
     const replacementHandle = binding?.terminalHandle?.trim()
@@ -140,9 +141,17 @@ export class OrcaRuntimeWithRegisterPty extends OrcaRuntimeWithInvalidateAllHand
         currentFence.pendingRegistration = false
       }
     }
+    // Why: a listed surface's pending-handle → ready flip must not wait on a later renderer graph change.
+    this.touchMobileSessionSnapshotsForPty(ptyId)
     // Why: the renderer's own PTY spawn is the reliable signal that the pending
     // mobile create's tab is live; publish its surface main-side (#7587).
     if (binding && paneKey) {
+      if (
+        replacementHandle?.startsWith('term_') &&
+        this.handleByPtyId.get(ptyId) !== replacementHandle
+      ) {
+        this.registerPreAllocatedHandleForPty(ptyId, replacementHandle)
+      }
       this.ensurePtyBackedMobileSurfaceForRendererTab(worktreeId, binding.tabId)
     }
   }
diff --git a/src/main/runtime/orca-runtime-resolve-authoritative-terminal-wait-permission.ts b/src/main/runtime/orca-runtime-resolve-authoritative-terminal-wait-permission.ts
index ad7c81f2e872..04cb91e02811 100644
--- a/src/main/runtime/orca-runtime-resolve-authoritative-terminal-wait-permission.ts
+++ b/src/main/runtime/orca-runtime-resolve-authoritative-terminal-wait-permission.ts
@@ -61,7 +61,7 @@ export class OrcaRuntimeWithResolveAuthoritativeTerminalWaitPermission extends O
     ptyId: string,
     action: { text?: string; enter?: boolean; interrupt?: boolean },
     payload: string,
-    options: RuntimeTerminalWriteOptions = {}
+    options: RuntimeTerminalWriteOptions
   ): Promise<void> {
     return this.terminalWriter.writeAction(ptyId, action, payload, options)
   }
@@ -69,7 +69,7 @@ export class OrcaRuntimeWithResolveAuthoritativeTerminalWaitPermission extends O
   protected writeTerminalInputChunks(
     ptyId: string,
     text: string,
-    options: RuntimeTerminalWriteOptions = {}
+    options: RuntimeTerminalWriteOptions
   ): Promise<void> {
     return this.terminalWriter.writeChunks(ptyId, text, options)
   }
diff --git a/src/main/runtime/orca-runtime-resolve-exit-waiters.ts b/src/main/runtime/orca-runtime-resolve-exit-waiters.ts
index 9d2ea33a6b81..f7ead603e022 100644
--- a/src/main/runtime/orca-runtime-resolve-exit-waiters.ts
+++ b/src/main/runtime/orca-runtime-resolve-exit-waiters.ts
@@ -2,15 +2,22 @@
 // @ts-nocheck -- mechanically split from OrcaRuntimeService; behavior is covered by AST equivalence and characterization tests.
 import { OrcaRuntimeWithBindPtyIncarnationHandle } from './orca-runtime-bind-pty-incarnation-handle'
 import type { RuntimeLeafRecord, RuntimePtyWorktreeRecord } from './runtime-terminal-state-records'
-import { buildPtyTerminalWaitResult, buildTerminalWaitResult } from './terminal-wait-results'
-import type { AgentStatus } from '../../shared/agent-detection'
 import {
-  detectExplicitIdleStatusFromTitle,
-  isKnownReadyPromptPreview,
-  isMuseReadyPromptPreview
-} from './terminal-wait-detection'
+  buildPtyTerminalWaitBlockedResult,
+  buildPtyTerminalWaitResult,
+  buildTerminalWaitBlockedResult,
+  buildTerminalWaitResult
+} from './terminal-wait-results'
+import type { AgentStatus } from '../../shared/agent-detection'
+import { detectExplicitIdleStatusFromTitle } from './terminal-wait-detection'
 import { buildTerminalWaitText } from './terminal-wait-tail-state'
-import { isTuiIdleSatisfied } from './tui-idle-evidence'
+import {
+  evaluateTuiIdle,
+  isTuiIdleReadyVerdict,
+  leafTuiIdleEvidence,
+  ptyTuiIdleEvidence,
+  type TuiIdleVerdict
+} from './tui-idle-evidence'
 import { TUI_IDLE_QUIESCENCE_MS } from './orca-runtime-postlude'
 
 export class OrcaRuntimeWithResolveExitWaiters extends OrcaRuntimeWithBindPtyIncarnationHandle {
@@ -50,14 +57,20 @@ export class OrcaRuntimeWithResolveExitWaiters extends OrcaRuntimeWithBindPtyInc
     if (!waiters || waiters.size === 0) {
       return
     }
-    // Why re-rank rather than resolve outright: the transition that brought us here is
-    // only a title sample, and a name-only title arriving mid-turn is the weakest tier
-    // there is (#6011). Leave such a waiter on its poll to be corroborated instead.
-    if (!this.isTuiIdleSatisfiedForLeaf(leaf)) {
-      return
-    }
+    // Why re-rank rather than resolve outright: the transition that brought us here is only a
+    // title sample. Weak ready (a name-only title, #6011) cannot see a dialog the tail lost,
+    // so it is left to the poll, which settles it only after a rendered-screen read.
+    const verdict = this.evaluateTuiIdleForLeaf(leaf)
     for (const waiter of [...waiters]) {
-      if (waiter.condition === 'tui-idle') {
+      if (waiter.condition !== 'tui-idle') {
+        continue
+      }
+      if (verdict.kind === 'blocked') {
+        this.resolveWaiter(
+          waiter,
+          buildTerminalWaitBlockedResult(handle, 'tui-idle', leaf, verdict.reason)
+        )
+      } else if (verdict.kind === 'ready-strong') {
         this.resolveWaiter(waiter, buildTerminalWaitResult(handle, 'tui-idle', leaf))
       }
     }
@@ -92,34 +105,28 @@ export class OrcaRuntimeWithResolveExitWaiters extends OrcaRuntimeWithBindPtyInc
       return
     }
     // Why: same re-ranking as resolveTuiIdleWaiters above.
-    if (!this.isTuiIdleSatisfiedForPty(pty)) {
-      return
-    }
+    const verdict = this.evaluateTuiIdleForPty(pty)
     for (const waiter of [...waiters]) {
-      if (waiter.condition === 'tui-idle') {
+      if (waiter.condition !== 'tui-idle') {
+        continue
+      }
+      if (verdict.kind === 'blocked') {
+        this.resolveWaiter(
+          waiter,
+          buildPtyTerminalWaitBlockedResult(handle, 'tui-idle', pty, verdict.reason)
+        )
+      } else if (verdict.kind === 'ready-strong') {
         this.resolveWaiter(waiter, buildPtyTerminalWaitResult(handle, 'tui-idle', pty))
       }
     }
   }
 
-  // Why: the primary OSC-title signal can't fire for daemon-hosted terminals (no PTY data through the runtime), so this fallback polls the renderer-synced tab title + foreground-process quiescence; self-cancels when the OSC path fires.
-  protected isTuiIdleSatisfiedForLeaf(leaf: RuntimeLeafRecord): boolean {
-    return isTuiIdleSatisfied({
-      record: leaf,
-      rendererTitle: leaf.paneTitle ?? this.tabs.get(leaf.tabId)?.title ?? null,
-      readPositiveBodyEvidence: () =>
-        isKnownReadyPromptPreview(
-          buildTerminalWaitText(leaf.tailBuffer, leaf.tailPartialLine, leaf.preview)
-        ),
-      readMuseReadyBodyEvidence: () =>
-        isMuseReadyPromptPreview(
-          buildTerminalWaitText(leaf.tailBuffer, leaf.tailPartialLine, leaf.preview)
-        ),
-      agent: this.getPaneAgentForTuiIdle(leaf.ptyId),
-      firstPartyStatus:
-        (leaf.ptyId ? this.ptysById.get(leaf.ptyId)?.lastExplicitAgentStatus : null) ?? null,
-      quiescenceMs: TUI_IDLE_QUIESCENCE_MS
-    })
+  protected evaluateTuiIdleForLeaf(leaf: RuntimeLeafRecord): TuiIdleVerdict {
+    return evaluateTuiIdle(
+      leafTuiIdleEvidence(this.tuiIdleEvidenceSource, leaf, () =>
+        buildTerminalWaitText(leaf.tailBuffer, leaf.tailPartialLine, leaf.preview)
+      )
+    )
   }
 
   /**
@@ -189,25 +196,25 @@ export class OrcaRuntimeWithResolveExitWaiters extends OrcaRuntimeWithBindPtyInc
    */
   protected isAgentSettledForDelivery(leaf: { tabId: string; leafId: string }): boolean {
     const live = this.leaves.get(this.getLeafKey(leaf.tabId, leaf.leafId))
-    return live ? this.isTuiIdleSatisfiedForLeaf(live) : false
+    if (!live) {
+      return false
+    }
+    const evidence = leafTuiIdleEvidence(this.tuiIdleEvidenceSource, live, () =>
+      buildTerminalWaitText(live.tailBuffer, live.tailPartialLine, live.preview)
+    )
+    // Why no blocked reader: a refusal here re-arms a recheck that a lingering tail prompt
+    // would spin, so delivery keeps its own, blocked-blind, reading of the same ranking.
+    return isTuiIdleReadyVerdict(
+      evaluateTuiIdle({ ...evidence, readTailBlockedReason: () => null })
+    )
   }
 
-  protected isTuiIdleSatisfiedForPty(pty: RuntimePtyWorktreeRecord): boolean {
-    return isTuiIdleSatisfied({
-      record: pty,
-      readPositiveBodyEvidence: () =>
-        this.getAdoptedPtyExplicitIdleStatus(pty) === 'idle' ||
-        isKnownReadyPromptPreview(
-          buildTerminalWaitText(pty.tailBuffer, pty.tailPartialLine, pty.preview)
-        ),
-      readMuseReadyBodyEvidence: () =>
-        isMuseReadyPromptPreview(
-          buildTerminalWaitText(pty.tailBuffer, pty.tailPartialLine, pty.preview)
-        ),
-      agent: this.getPaneAgentForTuiIdle(pty.ptyId),
-      firstPartyStatus: pty.lastExplicitAgentStatus ?? null,
-      quiescenceMs: TUI_IDLE_QUIESCENCE_MS
-    })
+  protected evaluateTuiIdleForPty(pty: RuntimePtyWorktreeRecord): TuiIdleVerdict {
+    return evaluateTuiIdle(
+      ptyTuiIdleEvidence(this.tuiIdleEvidenceSource, pty, () =>
+        buildTerminalWaitText(pty.tailBuffer, pty.tailPartialLine, pty.preview)
+      )
+    )
   }
 
   protected getAdoptedPtyExplicitIdleStatus(pty: RuntimePtyWorktreeRecord): AgentStatus | null {
diff --git a/src/main/runtime/orca-runtime-resolve-terminal-pane.ts b/src/main/runtime/orca-runtime-resolve-terminal-pane.ts
index 1093319783a6..60047604e438 100644
--- a/src/main/runtime/orca-runtime-resolve-terminal-pane.ts
+++ b/src/main/runtime/orca-runtime-resolve-terminal-pane.ts
@@ -184,7 +184,7 @@ export class OrcaRuntimeWithResolveTerminalPane extends OrcaRuntimeWithGetTermin
   ): Promise<RuntimeTerminalRead> {
     // Before the PTY lookup, because a structured worker has no PTY and no leaf: without this the
     // only peer read verb answers `terminal_handle_stale` for a perfectly live worker.
-    const structured = readStructuredWorkerTerminal({
+    const structured = await readStructuredWorkerTerminal({
       handle,
       db: this.getOrchestrationDbIfAvailable?.() ?? null,
       ...(opts.cursor === undefined ? {} : { cursor: opts.cursor }),
diff --git a/src/main/runtime/orca-runtime-resolve-terminal-split-source-authority.ts b/src/main/runtime/orca-runtime-resolve-terminal-split-source-authority.ts
index 49d55d96c17e..6acf8ba325f0 100644
--- a/src/main/runtime/orca-runtime-resolve-terminal-split-source-authority.ts
+++ b/src/main/runtime/orca-runtime-resolve-terminal-split-source-authority.ts
@@ -100,7 +100,7 @@ export class OrcaRuntimeWithResolveTerminalSplitSourceAuthority extends OrcaRunt
     return await this.claudeAgentTeams.handleTmuxCompat(request, {
       splitTerminal: (handle, opts) => this.splitTerminal(handle, opts),
       readTerminal: (handle, opts) => this.readTerminal(handle, opts),
-      sendTerminal: (handle, action) => this.sendTerminal(handle, action),
+      sendTerminal: (handle, action, options) => this.sendTerminal(handle, action, options),
       focusTerminal: (handle) => this.focusTerminal(handle),
       closeTerminal: (handle) => this.closeTerminal(handle),
       showTerminal: (handle) => this.showTerminal(handle)
diff --git a/src/main/runtime/orca-runtime-restore-live-paired-renderer-session-owned-mobile-terminals.ts b/src/main/runtime/orca-runtime-restore-live-paired-renderer-session-owned-mobile-terminals.ts
index bfab8f0ba9a8..8e9ad65dc328 100644
--- a/src/main/runtime/orca-runtime-restore-live-paired-renderer-session-owned-mobile-terminals.ts
+++ b/src/main/runtime/orca-runtime-restore-live-paired-renderer-session-owned-mobile-terminals.ts
@@ -123,9 +123,9 @@ export class OrcaRuntimeWithRestoreLivePairedRendererSessionOwnedMobileTerminals
     if (!pty || this.terminalSpawnCommandsByPtyId.has(pty.ptyId)) {
       return
     }
-    if (this.ptyController?.write(pty.ptyId, command)) {
+    if (this.ptyController?.write(pty.ptyId, command, 'launch')) {
       // Why: Enter rides its own write so a long command cannot swallow it.
-      this.ptyController.write(pty.ptyId, '\r')
+      this.ptyController.write(pty.ptyId, '\r', 'launch')
       this.noteTerminalSpawnCommand(pty.ptyId, command)
     }
   }
diff --git a/src/main/runtime/orca-runtime-restore-structured-agent-session-tabs-once.ts b/src/main/runtime/orca-runtime-restore-structured-agent-session-tabs-once.ts
index d53b465d97d5..f22a09bac5e4 100644
--- a/src/main/runtime/orca-runtime-restore-structured-agent-session-tabs-once.ts
+++ b/src/main/runtime/orca-runtime-restore-structured-agent-session-tabs-once.ts
@@ -95,10 +95,16 @@ export class OrcaRuntimeWithRestoreStructuredAgentSessionTabsOnce extends OrcaRu
     activate: boolean
     notify?: boolean
     replacesSessionId?: string
+    /** The host tab id a create reserved; a session that already has a tab keeps its own. */
+    tabId?: string
   }): Promise<void> {
     const host = getStructuredAgentSessionHost()
     if (typeof host?.setSessionTabVisibility === 'function') {
-      await host.setSessionTabVisibility(input.sessionId, true)
+      await host.setSessionTabVisibility(
+        input.sessionId,
+        true,
+        ...(input.tabId ? [input.tabId] : [])
+      )
     }
     const existing = this.mobileSessionTabsByWorktree.get(input.workspaceId)
     const id = `agent-session:${input.sessionId}`
diff --git a/src/main/runtime/orca-runtime-runtime-id.ts b/src/main/runtime/orca-runtime-runtime-id.ts
index 7b1811d92558..4b252d57fefd 100644
--- a/src/main/runtime/orca-runtime-runtime-id.ts
+++ b/src/main/runtime/orca-runtime-runtime-id.ts
@@ -45,6 +45,9 @@ import { MailPointerRepointScheduler } from './orchestration/mail-pointer-repoin
 import { RuntimeTerminalWaiterRegistry } from './runtime-terminal-waiter-registry'
 import { RuntimeTerminalWriter } from './runtime-terminal-writer'
 import { RuntimeTerminalIdlePolls } from './runtime-terminal-idle-polls'
+import { TerminalIntentionalStops } from './terminal-intentional-stops'
+import { TerminalRunFactsRegister, type TerminalSpawnCommit } from './terminal-run-facts'
+import type { TuiIdleEvidenceSource } from './tui-idle-evidence'
 import {
   TUI_IDLE_DEFAULT_TIMEOUT_MS,
   TUI_IDLE_POLL_INTERVAL_MS,
@@ -232,9 +235,16 @@ export class OrcaRuntimeWithRuntimeId {
 
   protected pendingPtyRegistrationIncarnations = new Map<string, PtyIncarnationId | null>()
 
-  // Why: exact-stop is the current sleep transaction boundary; its exit must
-  // leave the renderer's intentional sleeping surface available for wake.
-  protected intentionalHandlelessPtyStops = new Map<string, string | null>()
+  // Why public: the PTY IPC layer's stop paths write it and its exit delivery reads it.
+  readonly intentionalPtyStops = new TerminalIntentionalStops()
+
+  readonly terminalRunFacts = new TerminalRunFactsRegister()
+
+  /** Both spawn-commit funnels report each committed process here, once. */
+  noteTerminalSpawnCommit(commit: TerminalSpawnCommit, expectedSourceBinding?: unknown): void {
+    this.terminalRunFacts.recordSpawnCommit(commit, expectedSourceBinding)
+    this.intentionalPtyStops.noteSpawnCommit(commit.id)
+  }
 
   // Why: coalesces title/status-driven session.tabs emits so spinner churn
   // doesn't fan out (and per-client JSON.stringify) a snapshot several times a
@@ -321,35 +331,43 @@ export class OrcaRuntimeWithRuntimeId {
   protected readonly terminalWaiters = new RuntimeTerminalWaiterRegistry()
 
   protected readonly terminalWriter = new RuntimeTerminalWriter(
-    (ptyId, data) => this.ptyController?.write(ptyId, data) ?? false,
+    (ptyId, data, inputKind) => this.ptyController?.write(ptyId, data, inputKind) ?? false,
     (ptyId) => this.getPtyWriteHostPlatform(ptyId),
     (ptyId) => this.getPtyAgent(ptyId)
   )
 
-  protected readonly terminalIdlePolls = new RuntimeTerminalIdlePolls({
-    intervalMs: TUI_IDLE_POLL_INTERVAL_MS,
+  // Why one source: every tui-idle site must read the same evidence, or they rank one pane differently.
+  protected readonly tuiIdleEvidenceSource: TuiIdleEvidenceSource = {
     quiescenceMs: TUI_IDLE_QUIESCENCE_MS,
     getTabTitle: (tabId) => this.tabs.get(tabId)?.title ?? null,
-    getForegroundProcess: (ptyId) => this.ptyController?.getForegroundProcess(ptyId) ?? null,
     getAdoptedPtyIdleStatus: (pty) => this.getAdoptedPtyExplicitIdleStatus(pty),
     getPaneAgent: (ptyId) => this.getPaneAgentForTuiIdle(ptyId),
     getFirstPartyAgentStatus: (ptyId) =>
       (ptyId ? this.ptysById.get(ptyId)?.lastExplicitAgentStatus : null) ?? null,
+    readScreenLines: (ptyId) => this.readLiveTerminalScreenLines(ptyId)
+  }
+
+  protected readonly terminalIdlePolls = new RuntimeTerminalIdlePolls({
+    ...this.tuiIdleEvidenceSource,
+    intervalMs: TUI_IDLE_POLL_INTERVAL_MS,
+    getForegroundProcess: (ptyId) => this.ptyController?.getForegroundProcess(ptyId) ?? null,
+    // Why the runtime's own emulator: a provider snapshot would be a host round trip per tick.
+    readVisibleScreen: (ptyId) =>
+      this.headlessTerminals.has(ptyId)
+        ? this.readHeadlessVisibleTerminalState(ptyId).then(
+            (screen) => screen?.lines.join('\n') ?? null
+          )
+        : null,
     getLiveLeaf: (leaf) => this.leaves.get(this.getLeafKey(leaf.tabId, leaf.leafId)) ?? leaf,
     resolve: (waiter, result) => this.terminalWaiters.resolve(waiter, result)
   })
 
   protected readonly terminalWait = new RuntimeTerminalWaitController(
     {
+      ...this.tuiIdleEvidenceSource,
       defaultTimeoutMs: TUI_IDLE_DEFAULT_TIMEOUT_MS,
       getLivePty: (handle) => this.getLivePtyForHandle(handle),
       getLiveLeaf: (handle) => this.getLiveLeafForHandle(handle),
-      getAdoptedPtyIdleStatus: (pty) => this.getAdoptedPtyExplicitIdleStatus(pty),
-      getTabTitle: (tabId) => this.tabs.get(tabId)?.title ?? null,
-      quiescenceMs: TUI_IDLE_QUIESCENCE_MS,
-      getPaneAgent: (ptyId) => this.getPaneAgentForTuiIdle(ptyId),
-      getFirstPartyAgentStatus: (ptyId) =>
-        (ptyId ? this.ptysById.get(ptyId)?.lastExplicitAgentStatus : null) ?? null,
       startVisibleReadProbe: (waiter, waiterTimeoutMs, agent) =>
         this.startTuiIdleVisibleReadProbe(waiter, waiterTimeoutMs, agent)
     },
diff --git a/src/main/runtime/orca-runtime-sleep-resolved-worktree-terminals.ts b/src/main/runtime/orca-runtime-sleep-resolved-worktree-terminals.ts
index 7d3645473bc7..0f0a856bda24 100644
--- a/src/main/runtime/orca-runtime-sleep-resolved-worktree-terminals.ts
+++ b/src/main/runtime/orca-runtime-sleep-resolved-worktree-terminals.ts
@@ -64,7 +64,7 @@ export class OrcaRuntimeWithSleepResolvedWorktreeTerminals extends OrcaRuntimeWi
     const pendingPtyIds = new Set<string>()
     let generation = 0
     let fullyCommitted = false
-    let releaseReversibleRendererStops = (): void => {}
+    const settleReversibleStops = new Map<string, (stopped: boolean) => void>()
     try {
       const resolvedWorktrees = includeTargetResolvedWorktree(
         [...(await this.getResolvedWorktreeMap()).values()],
@@ -148,16 +148,25 @@ export class OrcaRuntimeWithSleepResolvedWorktreeTerminals extends OrcaRuntimeWi
       const stopAndWait = ptyController.stopAndWait.bind(ptyController)
 
       const orderedLivePtyIds = [...livePtyIds].sort()
-      releaseReversibleRendererStops =
-        ptyController.markReversibleStops?.(orderedLivePtyIds) ?? (() => {})
-      const stopResults = await Promise.allSettled(
-        orderedLivePtyIds.map(async (ptyId) => ({
+      for (const ptyId of orderedLivePtyIds) {
+        settleReversibleStops.set(
           ptyId,
-          stopped: await stopAndWait(ptyId, {
+          this.intentionalPtyStops.mark(
+            ptyId,
+            'reversible',
+            this.ptysById.get(ptyId)?.incarnationId ?? null
+          )
+        )
+      }
+      const stopResults = await Promise.allSettled(
+        orderedLivePtyIds.map(async (ptyId) => {
+          const stopped = await stopAndWait(ptyId, {
             keepHistory: true,
             deadlineMs: teardownRpcDeadline(sleepDeadline)
           })
-        }))
+          settleReversibleStops.get(ptyId)?.(stopped)
+          return { ptyId, stopped }
+        })
       )
       const successfulStopPtyIds = orderedLivePtyIds.filter((_, index) => {
         const result = stopResults[index]
@@ -251,7 +260,9 @@ export class OrcaRuntimeWithSleepResolvedWorktreeTerminals extends OrcaRuntimeWi
         postStopVerified: true
       }
     } finally {
-      releaseReversibleRendererStops()
+      for (const settleStop of settleReversibleStops.values()) {
+        settleStop(false)
+      }
       if (!fullyCommitted && generation > 0) {
         const cancelledPtyIds = [...pendingPtyIds].sort()
         if (cancelledPtyIds.length > 0) {
diff --git a/src/main/runtime/orca-runtime-stop-exact-terminals-for-worktree.ts b/src/main/runtime/orca-runtime-stop-exact-terminals-for-worktree.ts
index a96ae64e5966..d854be6ec682 100644
--- a/src/main/runtime/orca-runtime-stop-exact-terminals-for-worktree.ts
+++ b/src/main/runtime/orca-runtime-stop-exact-terminals-for-worktree.ts
@@ -47,18 +47,22 @@ export class OrcaRuntimeWithStopExactTerminalsForWorktree extends OrcaRuntimeWit
 
     const stoppedPtyIds: string[] = []
     for (const ptyId of [...expected].sort()) {
-      if (opts.keepHistory) {
-        this.intentionalHandlelessPtyStops.set(
-          ptyId,
-          this.ptysById.get(ptyId)?.incarnationId ?? null
-        )
-      }
+      // Why: exact-stop is the sleep transaction boundary; its exit must leave the sleeping surface for wake.
+      const settleStop = opts.keepHistory
+        ? this.intentionalPtyStops.mark(
+            ptyId,
+            'reversible',
+            this.ptysById.get(ptyId)?.incarnationId ?? null
+          )
+        : null
+      let stopped = false
       try {
-        if (!(await this.ptyController.stopAndWait(ptyId, { keepHistory: opts.keepHistory }))) {
-          throw Object.assign(new Error('terminal_exact_stop_failed'), { ptyId })
-        }
+        stopped = await this.ptyController.stopAndWait(ptyId, { keepHistory: opts.keepHistory })
       } finally {
-        this.intentionalHandlelessPtyStops.delete(ptyId)
+        settleStop?.(stopped)
+      }
+      if (!stopped) {
+        throw Object.assign(new Error('terminal_exact_stop_failed'), { ptyId })
       }
       stoppedPtyIds.push(ptyId)
     }
diff --git a/src/main/runtime/orca-runtime-stop-explicitly-closed-tab-ptys.ts b/src/main/runtime/orca-runtime-stop-explicitly-closed-tab-ptys.ts
index 196845d09ef9..a243d5ea0a6d 100644
--- a/src/main/runtime/orca-runtime-stop-explicitly-closed-tab-ptys.ts
+++ b/src/main/runtime/orca-runtime-stop-explicitly-closed-tab-ptys.ts
@@ -3,20 +3,26 @@ import { OrcaRuntimeWithFocusTerminal } from './orca-runtime-focus-terminal'
 import { EXPLICIT_TERMINAL_CLOSE_STOP_TIMEOUT_MS } from './orca-runtime-core'
 import { SSH_PROVIDER_UNREGISTERED_REASON } from '../../shared/pty-liveness-verdict'
 import type { RuntimeTerminalClose } from '../../shared/runtime-types'
-import { countTerminalLayoutLeaves } from './headless-terminal-split-layout'
 import type { RuntimePtyTabCloseAuthority } from './runtime-terminal-state-records'
+import { parsePaneKey } from '../../shared/stable-pane-id'
+
+/** How an explicit close's stop of its addressed PTY ended. */
+type ExplicitCloseStop = { stopped: boolean; pendingKillRecorded: boolean }
+
+const NO_STOP: ExplicitCloseStop = { stopped: false, pendingKillRecorded: false }
 
 export class OrcaRuntimeWithStopExplicitlyClosedTabPtys extends OrcaRuntimeWithFocusTerminal {
   protected async stopExplicitlyClosedTabPtys(
     ptyIds: readonly string[],
     addressedPtyId: string
-  ): Promise<boolean> {
-    let addressedPtyStopped = false
+  ): Promise<ExplicitCloseStop> {
+    let addressedPtyStop = NO_STOP
     const deadlineMs = Date.now() + EXPLICIT_TERMINAL_CLOSE_STOP_TIMEOUT_MS
     for (const ptyId of ptyIds) {
       this.markPtyStopRequested(ptyId)
       const expectedIncarnationId = this.ptysById.get(ptyId)?.incarnationId
       let stopped = false
+      let pendingKillRecorded = false
       if (this.ptyController?.stopAndWait) {
         try {
           stopped = await this.ptyController.stopAndWait(ptyId, { deadlineMs })
@@ -41,6 +47,8 @@ export class OrcaRuntimeWithStopExplicitlyClosedTabPtys extends OrcaRuntimeWithF
             verdict?.status === 'unverifiable' &&
             verdict.reason === SSH_PROVIDER_UNREGISTERED_REASON
           if (!providerAlreadyRetiredPty) {
+            // Why before the kill: its own failure is recorded only once its RPC settles.
+            pendingKillRecorded = this.ptyController.recordUnconfirmedStop?.(ptyId) === true
             this.ptyController.kill(ptyId)
             if (!verdict || verdict.status === 'live') {
               this.markPtyLivenessUnverifiable(
@@ -54,35 +62,35 @@ export class OrcaRuntimeWithStopExplicitlyClosedTabPtys extends OrcaRuntimeWithF
         stopped = this.ptyController?.kill(ptyId) ?? false
       }
       if (ptyId === addressedPtyId) {
-        addressedPtyStopped = stopped
+        addressedPtyStop = { stopped, pendingKillRecorded }
       }
     }
-    return addressedPtyStopped
+    return addressedPtyStop
   }
 
   protected describeTerminalClose(
     handle: string,
     tabId: string,
     ptyId: string | null,
-    ptyKilled: boolean
+    stop: ExplicitCloseStop
   ): RuntimeTerminalClose {
-    if (ptyKilled || !ptyId) {
-      return { handle, tabId, ptyKilled }
+    const close: RuntimeTerminalClose = {
+      handle,
+      tabId,
+      ptyKilled: stop.stopped,
+      ...(stop.pendingKillRecorded ? { pendingKillRecorded: true as const } : {})
+    }
+    if (stop.stopped || !ptyId) {
+      return close
     }
     const verdict = this.getPtyLivenessVerdict(ptyId)
     if (verdict?.status === 'unverifiable') {
-      return {
-        handle,
-        tabId,
-        ptyKilled,
-        ptyStopVerdict: 'unverifiable',
-        ptyStopReason: verdict.reason
-      }
+      return { ...close, ptyStopVerdict: 'unverifiable', ptyStopReason: verdict.reason }
     }
     if (verdict?.status === 'live') {
-      return { handle, tabId, ptyKilled, ptyStopVerdict: 'live' }
+      return { ...close, ptyStopVerdict: 'live' }
     }
-    return { handle, tabId, ptyKilled }
+    return close
   }
 
   async closeTerminal(handle: string): Promise<RuntimeTerminalClose> {
@@ -106,11 +114,13 @@ export class OrcaRuntimeWithStopExplicitlyClosedTabPtys extends OrcaRuntimeWithF
           ? spawnSurface
           : null)
       const tabId = surface?.tab.parentTabId ?? pty.pty.tabId ?? pty.record.tabId
-      // Why: relay recovery can leave stale renderer leaves; the persisted HUB layout defines whether closing this PTY closes the whole surface.
-      const siblingCount = surface?.tab.parentLayout
-        ? countTerminalLayoutLeaves(surface.tab.parentLayout.root)
-        : this.countLeavesInTab(tabId)
-      if (siblingCount <= 1 && surface && this.tabs.has(tabId) && this.notifier?.closeTerminalTab) {
+      const leafId = surface?.tab.leafId ?? parsePaneKey(pty.pty.paneKey ?? '')?.leafId
+      const paneTarget = leafId ? { kind: 'pane' as const, tabId, leafId } : null
+      // Why: a PTY with no pane identity cannot be placed in any tab's layout, so it closes nothing.
+      const closesTab =
+        paneTarget !== null &&
+        this.resolveTerminalCloseTarget(pty.pty.worktreeId, paneTarget) === 'last-pane'
+      if (closesTab && surface && this.tabs.has(tabId) && this.notifier?.closeTerminalTab) {
         const ptyIdsToKill = this.getPtyIdsForExplicitTabClose(pty.pty.worktreeId, tabId)
         try {
           await this.closeMobileSessionTab(`id:${pty.pty.worktreeId}`, tabId, {
@@ -122,15 +132,10 @@ export class OrcaRuntimeWithStopExplicitlyClosedTabPtys extends OrcaRuntimeWithF
           }
           this.notifier.closeTerminal?.(tabId)
         }
-        const ptyKilled = await this.stopExplicitlyClosedTabPtys(ptyIdsToKill, pty.pty.ptyId)
-        return this.describeTerminalClose(handle, tabId, pty.pty.ptyId, ptyKilled)
+        const stop = await this.stopExplicitlyClosedTabPtys(ptyIdsToKill, pty.pty.ptyId)
+        return this.describeTerminalClose(handle, tabId, pty.pty.ptyId, stop)
       }
-      if (
-        siblingCount <= 1 &&
-        surface &&
-        ptyCloseAuthority &&
-        !this.tabs.has(surface.tab.parentTabId)
-      ) {
+      if (closesTab && surface && ptyCloseAuthority && !this.tabs.has(surface.tab.parentTabId)) {
         try {
           await this.closeMobileSessionTab(`id:${pty.pty.worktreeId}`, tabId, {
             reason: 'user',
@@ -141,59 +146,64 @@ export class OrcaRuntimeWithStopExplicitlyClosedTabPtys extends OrcaRuntimeWithF
           if (!(error instanceof Error) || error.message !== 'workspace_session_unavailable') {
             throw error
           }
-          const ptyKilled = await this.stopExplicitlyClosedTabPtys([pty.pty.ptyId], pty.pty.ptyId)
+          const stop = await this.stopExplicitlyClosedTabPtys([pty.pty.ptyId], pty.pty.ptyId)
           this.notifier?.closeTerminal(tabId)
-          return this.describeTerminalClose(handle, tabId, pty.pty.ptyId, ptyKilled)
+          return this.describeTerminalClose(handle, tabId, pty.pty.ptyId, stop)
         }
-        const ptyKilled = await this.stopExplicitlyClosedTabPtys([pty.pty.ptyId], pty.pty.ptyId)
-        return this.describeTerminalClose(handle, tabId, pty.pty.ptyId, ptyKilled)
+        const stop = await this.stopExplicitlyClosedTabPtys([pty.pty.ptyId], pty.pty.ptyId)
+        return this.describeTerminalClose(handle, tabId, pty.pty.ptyId, stop)
       }
-      if (siblingCount <= 1 && !surface && pty.pty.tabId && this.notifier?.closeTerminalTab) {
+      if (closesTab && !surface && pty.pty.tabId && this.notifier?.closeTerminalTab) {
         const ptyIdsToKill = this.getPtyIdsForExplicitTabClose(pty.pty.worktreeId, tabId)
         await this.notifier.closeTerminalTab(tabId, { localPtyTeardownOwnedExternally: true })
-        const ptyKilled = await this.stopExplicitlyClosedTabPtys(ptyIdsToKill, pty.pty.ptyId)
-        return this.describeTerminalClose(handle, tabId, pty.pty.ptyId, ptyKilled)
+        const stop = await this.stopExplicitlyClosedTabPtys(ptyIdsToKill, pty.pty.ptyId)
+        return this.describeTerminalClose(handle, tabId, pty.pty.ptyId, stop)
       }
-      const ptyKilled = await this.stopExplicitlyClosedTabPtys([pty.pty.ptyId], pty.pty.ptyId)
-      if (!ptyKilled || siblingCount <= 1) {
-        if (surface) {
-          // Why: paired viewers keep ended streams mounted until the HUB publishes removal, so explicit close uses the durable host-tab transaction instead of viewer-local exit handling.
-          try {
-            await this.closeMobileSessionTab(`id:${pty.pty.worktreeId}`, tabId, {
-              localPtyTeardownOwnedExternally: true
-            })
-          } catch (error) {
-            if (!(error instanceof Error) || error.message !== 'workspace_session_unavailable') {
-              throw error
-            }
-            this.notifier?.closeTerminal(tabId)
+      const stop = await this.stopExplicitlyClosedTabPtys([pty.pty.ptyId], pty.pty.ptyId)
+      if (!closesTab) {
+        // Why: the pane's removal is this close's own commit, not a side effect of its exit. An
+        // unconfirmed stop is unverifiable, never a reason to close the live siblings with it.
+        if (paneTarget) {
+          await this.closeTerminalPane(pty.pty.worktreeId, paneTarget)
+        }
+      } else if (surface) {
+        // Why: paired viewers keep ended streams mounted until the HUB publishes removal, so explicit close uses the durable host-tab transaction instead of viewer-local exit handling.
+        try {
+          await this.closeMobileSessionTab(`id:${pty.pty.worktreeId}`, tabId, {
+            localPtyTeardownOwnedExternally: true
+          })
+        } catch (error) {
+          if (!(error instanceof Error) || error.message !== 'workspace_session_unavailable') {
+            throw error
           }
-        } else {
           this.notifier?.closeTerminal(tabId)
         }
+      } else {
+        this.notifier?.closeTerminal(tabId)
       }
-      return this.describeTerminalClose(handle, tabId, pty.pty.ptyId, ptyKilled)
+      return this.describeTerminalClose(handle, tabId, pty.pty.ptyId, stop)
     }
     this.assertGraphReady()
     const { leaf } = this.getLiveLeafForHandle(handle)
-    // Why: in a multi-pane tab, killing the PTY is enough (renderer's exit handler closes the pane); an extra IPC close would race it and close the whole tab.
-    const siblingCount = this.countLeavesInTab(leaf.tabId)
-    const ptyIdsToKill =
-      siblingCount <= 1
-        ? this.getPtyIdsForExplicitTabClose(leaf.worktreeId, leaf.tabId)
-        : leaf.ptyId
-          ? [leaf.ptyId]
-          : []
-    if (siblingCount <= 1 && this.notifier?.closeTerminalTab) {
+    const paneTarget = { kind: 'pane' as const, tabId: leaf.tabId, leafId: leaf.leafId }
+    const closesTab = this.resolveTerminalCloseTarget(leaf.worktreeId, paneTarget) === 'last-pane'
+    const ptyIdsToKill = closesTab
+      ? this.getPtyIdsForExplicitTabClose(leaf.worktreeId, leaf.tabId)
+      : leaf.ptyId
+        ? [leaf.ptyId]
+        : []
+    if (closesTab && this.notifier?.closeTerminalTab) {
       await this.notifier.closeTerminalTab(leaf.tabId, { localPtyTeardownOwnedExternally: true })
     }
-    const ptyKilled = leaf.ptyId
+    const stop = leaf.ptyId
       ? await this.stopExplicitlyClosedTabPtys(ptyIdsToKill, leaf.ptyId)
-      : false
-    if (siblingCount > 1 ? !ptyKilled : !this.notifier?.closeTerminalTab) {
-      this.notifier?.closeTerminal(leaf.tabId, leaf.paneRuntimeId)
+      : NO_STOP
+    if (!closesTab) {
+      await this.closeTerminalPane(leaf.worktreeId, paneTarget)
+    } else if (!this.notifier?.closeTerminalTab) {
+      this.notifier?.closeTerminal(leaf.tabId)
     }
-    return this.describeTerminalClose(handle, leaf.tabId, leaf.ptyId ?? null, ptyKilled)
+    return this.describeTerminalClose(handle, leaf.tabId, leaf.ptyId ?? null, stop)
   }
 
   async closeTerminalTab(handle: string): Promise<RuntimeTerminalClose> {
diff --git a/src/main/runtime/orca-runtime-stop-terminals-for-worktree.ts b/src/main/runtime/orca-runtime-stop-terminals-for-worktree.ts
index 768448e2ac99..747384d21032 100644
--- a/src/main/runtime/orca-runtime-stop-terminals-for-worktree.ts
+++ b/src/main/runtime/orca-runtime-stop-terminals-for-worktree.ts
@@ -11,7 +11,8 @@ import type {
 } from '../../shared/runtime-types'
 import type { WorktreeTerminalMutationKind } from './worktree-terminal-mutation-lock'
 import type { WorkspaceSessionState } from '../../shared/workspace-session-state-types'
-import { rollbackWorkspaceSessionAfterFailedAsyncWrite } from './workspace-session-failed-write-rollback'
+import { cloneWorkspaceSessionState } from '../persistence/restoring-sessions/session-owner-fields'
+import { rollbackWorkspaceSessionAfterFailedAsyncWrite } from '../persistence/restoring-sessions/workspace-session-write-rollback'
 import {
   getWorktreeExecutionHostId,
   parseExecutionHostId,
@@ -88,7 +89,7 @@ export class OrcaRuntimeWithStopTerminalsForWorktree extends OrcaRuntimeWithReso
         }
         closed += 1
       }
-      this.clearWorktreeTerminalResumeRecords(worktree.id, sessionHostId, parentTabIds)
+      await this.clearWorktreeTerminalResumeRecords(worktree.id, sessionHostId, parentTabIds)
       const { stopped } = await this.stopTerminalsForWorktree(`id:${worktree.id}`, {
         resolvedWorktreeId: worktree.id,
         ...hostFence
@@ -109,60 +110,65 @@ export class OrcaRuntimeWithStopTerminalsForWorktree extends OrcaRuntimeWithReso
     })
   }
 
-  private clearWorktreeTerminalResumeRecords(
+  private async clearWorktreeTerminalResumeRecords(
     worktreeId: string,
     hostId: ExecutionHostId,
     closedTabIds: readonly string[]
-  ): void {
+  ): Promise<void> {
     if (
       !this.store?.getWorkspaceSession ||
       !this.store.setWorkspaceSession ||
-      !this.store.flushOrThrow
+      !this.store.runDurableMutation
     ) {
       throw new Error('workspace_session_unavailable')
     }
-    const session = this.store.getWorkspaceSession(hostId)
-    const sleepingAgentSessionsByPaneKey = Object.fromEntries(
-      Object.entries(session.sleepingAgentSessionsByPaneKey ?? {}).filter(
-        ([, record]) => record.worktreeId !== worktreeId
+    const refusal = await this.store.runDurableMutation<Error | undefined>(() => {
+      const session = cloneWorkspaceSessionState(this.store.getWorkspaceSession(hostId))
+      const sleepingAgentSessionsByPaneKey = Object.fromEntries(
+        Object.entries(session.sleepingAgentSessionsByPaneKey ?? {}).filter(
+          ([, record]) => record.worktreeId !== worktreeId
+        )
       )
-    )
-    const terminalPtyIncarnationsByPaneKey = Object.fromEntries(
-      Object.entries(session.terminalPtyIncarnationsByPaneKey ?? {}).filter(
-        ([paneKey]) => !closedTabIds.some((tabId) => paneKey.startsWith(`${tabId}:`))
+      const terminalPtyIncarnationsByPaneKey = Object.fromEntries(
+        Object.entries(session.terminalPtyIncarnationsByPaneKey ?? {}).filter(
+          ([paneKey]) => !closedTabIds.some((tabId) => paneKey.startsWith(`${tabId}:`))
+        )
       )
-    )
-    const remainingTerminalRows = session.tabsByWorktree[worktreeId] ?? []
-    const remainingUnifiedTerminalTabs = (session.unifiedTabs?.[worktreeId] ?? []).filter(
-      (tab) => tab.contentType === 'terminal'
-    )
-    if (remainingTerminalRows.length > 0 || remainingUnifiedTerminalTabs.length > 0) {
-      throw new Error('terminal_close_incomplete')
-    }
-    const hasChanges =
-      Object.keys(sleepingAgentSessionsByPaneKey).length !==
-        Object.keys(session.sleepingAgentSessionsByPaneKey ?? {}).length ||
-      Object.keys(terminalPtyIncarnationsByPaneKey).length !==
-        Object.keys(session.terminalPtyIncarnationsByPaneKey ?? {}).length
-    if (!hasChanges) {
-      return
-    }
-    const next: WorkspaceSessionState = {
-      ...session,
-      sleepingAgentSessionsByPaneKey,
-      terminalPtyIncarnationsByPaneKey
-    }
-    this.store.setWorkspaceSession(next, hostId)
-    const staged = this.store.getWorkspaceSession(hostId)
-    try {
-      this.store.flushOrThrow()
-    } catch (error) {
-      const current = this.store.getWorkspaceSession(hostId)
-      const rolledBack = rollbackWorkspaceSessionAfterFailedAsyncWrite(session, staged, current)
-      if (rolledBack !== current) {
-        this.store.setWorkspaceSession(rolledBack, hostId)
+      const remainingTerminalRows = session.tabsByWorktree[worktreeId] ?? []
+      const remainingUnifiedTerminalTabs = (session.unifiedTabs?.[worktreeId] ?? []).filter(
+        (tab) => tab.contentType === 'terminal'
+      )
+      if (remainingTerminalRows.length > 0 || remainingUnifiedTerminalTabs.length > 0) {
+        return { value: new Error('terminal_close_incomplete'), persist: false }
+      }
+      const hasChanges =
+        Object.keys(sleepingAgentSessionsByPaneKey).length !==
+          Object.keys(session.sleepingAgentSessionsByPaneKey ?? {}).length ||
+        Object.keys(terminalPtyIncarnationsByPaneKey).length !==
+          Object.keys(session.terminalPtyIncarnationsByPaneKey ?? {}).length
+      if (!hasChanges) {
+        return { value: undefined, persist: false }
+      }
+      const next: WorkspaceSessionState = {
+        ...session,
+        sleepingAgentSessionsByPaneKey,
+        terminalPtyIncarnationsByPaneKey
+      }
+      this.store.setWorkspaceSession(next, hostId)
+      const staged = cloneWorkspaceSessionState(this.store.getWorkspaceSession(hostId))
+      return {
+        value: undefined,
+        rollback: () => {
+          const current = this.store.getWorkspaceSession(hostId)
+          const rolledBack = rollbackWorkspaceSessionAfterFailedAsyncWrite(session, staged, current)
+          if (rolledBack !== current) {
+            this.store.setWorkspaceSession(rolledBack, hostId)
+          }
+        }
       }
-      throw error
+    })
+    if (refusal) {
+      throw refusal
     }
   }
 
diff --git a/src/main/runtime/orca-runtime-structured-session-restore.test.ts b/src/main/runtime/orca-runtime-structured-session-restore.test.ts
index d6ec1e22782c..1d8105d07f81 100644
--- a/src/main/runtime/orca-runtime-structured-session-restore.test.ts
+++ b/src/main/runtime/orca-runtime-structured-session-restore.test.ts
@@ -307,10 +307,7 @@ describe('structured session cold restoration', () => {
       reason: 'user'
     })
 
-    expect(closeSessionTab).toHaveBeenCalledWith(
-      'structured-agent-session-restored-session',
-      'workspace-1'
-    )
+    expect(closeSessionTab).toHaveBeenCalledWith('agent-session:restored-session', 'workspace-1')
     expect(closeStructuredSession).toHaveBeenCalledWith('restored-session')
     expect(setSessionTabVisibility).toHaveBeenCalledWith('restored-session', false)
     expect(setSessionTabVisibility.mock.invocationCallOrder[0]).toBeLessThan(
diff --git a/src/main/runtime/orca-runtime-terminal-close-continuity.test.ts b/src/main/runtime/orca-runtime-terminal-close-continuity.test.ts
index ef24301c7cf5..5e100dd4dbd0 100644
--- a/src/main/runtime/orca-runtime-terminal-close-continuity.test.ts
+++ b/src/main/runtime/orca-runtime-terminal-close-continuity.test.ts
@@ -72,25 +72,27 @@ describe('terminal close and handle incarnation continuity', () => {
     unsubscribe()
   })
 
-  it('publishes no retirement or absence when the durable headless close fails', async () => {
+  it('still kills and keeps the removal when the durable headless close fails to flush', async () => {
     const harness = await createStaleTabCloseHarness({ headless: true })
-    const published = vi.fn()
-    const unsubscribe = harness.runtime.onMobileSessionTabsChanged(published)
+    const errorSpy = vi.spyOn(console, 'error').mockImplementation(() => undefined)
     harness.rejectPersistenceFlush(new Error('disk-full'))
 
-    await expect(harness.runtime.closeTerminalTab(harness.terminal.handle)).rejects.toThrow(
-      'disk-full'
-    )
+    await expect(harness.runtime.closeTerminalTab(harness.terminal.handle)).resolves.toMatchObject({
+      tabId: TAB_ID,
+      closeMode: 'tab'
+    })
 
-    expect(harness.kill).not.toHaveBeenCalled()
-    expect(published).not.toHaveBeenCalled()
-    expect(harness.getSession().tabsByWorktree[WORKTREE_ID]).toHaveLength(1)
+    // Why: a failed flush is bookkeeping; the user's close still stops its process and the
+    // in-memory removal stays for the next flush to write.
+    expect(harness.kill).toHaveBeenCalledWith(RUNTIME_OWNED_PTY_ID)
+    expect(harness.getSession().tabsByWorktree[WORKTREE_ID]).toEqual([])
     const snapshot = await harness.runtime.listMobileSessionTabs(`id:${WORKTREE_ID}`)
-    expect(snapshot).toMatchObject({
-      tabs: [expect.objectContaining({ parentTabId: TAB_ID, leafId: LEAF_ID })]
-    })
-    expect(snapshot.retiredTerminalSurfaces).toBeUndefined()
-    unsubscribe()
+    expect(snapshot.tabs).toEqual([])
+    expect(errorSpy).toHaveBeenCalledWith(
+      '[runtime] failed to persist terminal close:',
+      expect.any(Error)
+    )
+    errorSpy.mockRestore()
   })
 
   it('publishes each split leaf retirement with its own terminal handle', async () => {
@@ -366,6 +368,36 @@ describe('terminal close and handle incarnation continuity', () => {
     expect(harness.kill).toHaveBeenCalledWith(PTY_ID)
   })
 
+  it.each([true, false])(
+    'promises a retry only when the stop recorded a replayable kill (recorded: %s)',
+    async (recorded) => {
+      const harness = createHarness()
+      const [{ handle }] = (await harness.runtime.listTerminals(`id:${WORKTREE_ID}`)).terminals
+      harness.setVerifiedStopResult(false)
+      const recordUnconfirmedStop = vi.fn(() => {
+        // The order must exist before the follow-up kill, whose own failure lands only later.
+        expect(harness.kill).not.toHaveBeenCalled()
+        return recorded
+      })
+      const controller = harness.runtime['ptyController']
+      if (!controller) {
+        throw new Error('fixture has no PTY controller')
+      }
+      Object.assign(controller, { recordUnconfirmedStop })
+
+      const closing = harness.runtime.closeTerminal(handle)
+      await vi.waitFor(() => expect(harness.closeTerminalTab).toHaveBeenCalled())
+      harness.retirePersistedTab()
+      harness.acknowledged.resolve()
+
+      const close = await closing
+      expect(recordUnconfirmedStop).toHaveBeenCalledWith(PTY_ID)
+      expect(harness.kill).toHaveBeenCalledWith(PTY_ID)
+      expect(close.ptyStopVerdict).toBe('unverifiable')
+      expect(close.pendingKillRecorded).toBe(recorded ? true : undefined)
+    }
+  )
+
   it('leaves a confirmed kill receipt free of any stop verdict', async () => {
     const harness = createHarness()
     const [{ handle }] = (await harness.runtime.listTerminals(`id:${WORKTREE_ID}`)).terminals
diff --git a/src/main/runtime/orca-runtime-terminal-close-no-widening.test.ts b/src/main/runtime/orca-runtime-terminal-close-no-widening.test.ts
new file mode 100644
index 000000000000..2def6219d294
--- /dev/null
+++ b/src/main/runtime/orca-runtime-terminal-close-no-widening.test.ts
@@ -0,0 +1,332 @@
+import { describe, expect, it } from 'vitest'
+import {
+  LEAF_ID,
+  PTY_ID,
+  SIBLING_LEAF_ID,
+  SIBLING_PTY_ID,
+  TAB_ID,
+  WORKTREE_ID,
+  createHarness,
+  type CloseContinuityHarness
+} from './__fixtures__/orca-runtime-terminal-close-continuity-fixtures'
+import { retireTerminalSurfaceFromPersistence } from './mobile-session-terminal-persistence-retirement'
+
+const emptyLayout = { root: null, activeLeafId: null, expandedLeafId: null }
+
+/**
+ * Every explicit close of one pane, from every entry point, under every condition that has ever
+ * widened one into a whole-tab close: the live sibling survives and no tab-level close goes out.
+ */
+
+type Entry = 'renderer' | 'cli-graph' | 'cli-pty' | 'phone-desktop' | 'phone-headless'
+type Condition =
+  | 'normal'
+  | 'stop-unconfirmed'
+  | 'stop-throws'
+  | 'leaf-already-retired'
+  | 'unbound-sibling'
+  | 'pinned'
+  | 'no-saved-layout'
+  | 'no-live-pty'
+  | 'kill-fails'
+  | 'nothing-published'
+
+/** The desktop renderer's split tab as it publishes it, with the given PTY bindings. */
+function syncRendererSplit(
+  harness: CloseContinuityHarness,
+  ptyIdsByLeafId: Record<string, string>,
+  livePtyIdsByLeafId = ptyIdsByLeafId
+): void {
+  const parentLayout = {
+    root: {
+      type: 'split' as const,
+      direction: 'horizontal' as const,
+      first: { type: 'leaf' as const, leafId: LEAF_ID },
+      second: { type: 'leaf' as const, leafId: SIBLING_LEAF_ID }
+    },
+    activeLeafId: LEAF_ID,
+    expandedLeafId: null,
+    ptyIdsByLeafId
+  }
+  const leaves = [LEAF_ID, SIBLING_LEAF_ID].map((leafId, index) => ({
+    tabId: TAB_ID,
+    worktreeId: WORKTREE_ID,
+    leafId,
+    paneRuntimeId: 7 + index,
+    ptyId: livePtyIdsByLeafId[leafId] ?? null
+  }))
+  harness.runtime.syncWindowGraph(1, {
+    tabs: [
+      {
+        tabId: TAB_ID,
+        worktreeId: WORKTREE_ID,
+        title: 'Fixture shell',
+        activeLeafId: LEAF_ID,
+        layout: parentLayout.root
+      }
+    ],
+    leaves,
+    mobileSessionTabs: [
+      {
+        worktree: WORKTREE_ID,
+        publicationEpoch: 'renderer:unbound-pane',
+        snapshotVersion: 3,
+        activeGroupId: null,
+        activeTabId: `${TAB_ID}::${LEAF_ID}`,
+        activeTabType: 'terminal' as const,
+        tabs: leaves.map((leaf) => ({
+          type: 'terminal' as const,
+          id: `${TAB_ID}::${leaf.leafId}`,
+          parentTabId: TAB_ID,
+          leafId: leaf.leafId,
+          ...(ptyIdsByLeafId[leaf.leafId] ? { ptyId: ptyIdsByLeafId[leaf.leafId] } : {}),
+          title: 'Fixture shell',
+          parentLayout,
+          isActive: leaf.leafId === LEAF_ID
+        }))
+      }
+    ]
+  })
+}
+
+function arrange(entry: Entry, condition: Condition): CloseContinuityHarness {
+  const usesPtyRecord = entry !== 'cli-graph' && entry !== 'renderer' && condition !== 'no-live-pty'
+  const harness = createHarness({ publishMobileSurface: true, registerPtyBacked: usesPtyRecord })
+  if (condition === 'unbound-sibling') {
+    // A pane the renderer just split: no PTY bound yet, so main's saved layout lacks it.
+    syncRendererSplit(harness, { [LEAF_ID]: PTY_ID })
+  } else {
+    harness.syncSplitFixtureGraph()
+  }
+  if (condition === 'no-live-pty') {
+    // The closed pane's process already exited, so main holds no record of its PTY.
+    syncRendererSplit(
+      harness,
+      { [LEAF_ID]: 'pty-exited', [SIBLING_LEAF_ID]: SIBLING_PTY_ID },
+      { [SIBLING_LEAF_ID]: SIBLING_PTY_ID }
+    )
+  }
+  if (entry === 'cli-pty') {
+    // Graph without the leaf: the handle resolves through the PTY, as for a runtime-owned pane.
+    harness.syncFixtureTabWithoutLeaf()
+  }
+  if (condition === 'nothing-published') {
+    // The renderer lists the tab before its panes register and before it publishes any row.
+    harness.runtime.syncWindowGraph(1, {
+      tabs: [
+        {
+          tabId: TAB_ID,
+          worktreeId: WORKTREE_ID,
+          title: 'Fixture shell',
+          activeLeafId: null,
+          layout: null
+        }
+      ],
+      leaves: [],
+      mobileSessionTabs: [
+        {
+          worktree: WORKTREE_ID,
+          publicationEpoch: 'renderer:nothing-published',
+          snapshotVersion: 4,
+          activeGroupId: null,
+          activeTabId: null,
+          activeTabType: null,
+          tabs: []
+        }
+      ]
+    })
+  }
+  if (condition === 'kill-fails') {
+    harness.kill.mockReturnValue(false)
+  }
+  if (condition === 'stop-unconfirmed') {
+    harness.setVerifiedStopResult(false)
+  } else if (condition === 'stop-throws') {
+    harness.setVerifiedStopResult(new Error('ssh_host_unreachable'))
+  } else {
+    harness.setVerifiedStopResult(true)
+  }
+  if (condition === 'leaf-already-retired') {
+    harness.editSession((session) =>
+      retireTerminalSurfaceFromPersistence(session, {
+        worktreeId: WORKTREE_ID,
+        parentTabId: TAB_ID,
+        leafId: LEAF_ID,
+        ptyId: PTY_ID
+      })
+    )
+  } else if (condition === 'pinned') {
+    harness.editSession((session) => ({
+      ...session,
+      tabsByWorktree: {
+        [WORKTREE_ID]: (session.tabsByWorktree[WORKTREE_ID] ?? []).map((tab) => ({
+          ...tab,
+          isPinned: true
+        }))
+      }
+    }))
+  } else if (condition === 'no-saved-layout') {
+    harness.editSession((session) => ({ ...session, terminalLayoutsByTabId: {} }))
+  }
+  // A renderer that honours a whole-tab close, so a widened close shows as the lost sibling.
+  harness.setCloseTerminalTabAction(() => harness.retirePersistedTab())
+  return harness
+}
+
+async function closePane(entry: Entry, harness: CloseContinuityHarness): Promise<void> {
+  if (entry === 'renderer') {
+    await harness.runtime.closeTerminalSurfaceFromRenderer(WORKTREE_ID, {
+      kind: 'pane',
+      tabId: TAB_ID,
+      leafId: LEAF_ID
+    })
+    return
+  }
+  if (entry === 'cli-graph' || entry === 'cli-pty') {
+    const terminal = (await harness.runtime.listTerminals(`id:${WORKTREE_ID}`)).terminals.find(
+      (candidate) => candidate.ptyId === PTY_ID
+    )
+    if (!terminal) {
+      throw new Error('fixture pane has no terminal handle')
+    }
+    await harness.runtime.closeTerminal(terminal.handle)
+    return
+  }
+  if (entry === 'phone-headless') {
+    harness.runtime.setNotifier(null)
+    harness.syncEmptyGraph()
+  }
+  await harness.runtime.closeMobileSessionTab(`id:${WORKTREE_ID}`, `${TAB_ID}::${LEAF_ID}`, {
+    reason: 'user'
+  })
+}
+
+const rows: [Entry, Condition][] = [
+  // e.g. the exited-pane overlay's Close after main's exit handling retired that pane (fc5cac5c32).
+  ['renderer', 'leaf-already-retired'],
+  ['renderer', 'unbound-sibling'],
+  ['renderer', 'pinned'],
+  ['renderer', 'no-saved-layout'],
+  ['cli-graph', 'normal'],
+  ['cli-graph', 'stop-unconfirmed'],
+  ['cli-graph', 'leaf-already-retired'],
+  ['cli-graph', 'unbound-sibling'],
+  ['cli-pty', 'normal'],
+  // An unconfirmed stop once chose the tab close (bc8bbd7abf).
+  ['cli-pty', 'stop-unconfirmed'],
+  ['cli-pty', 'stop-throws'],
+  ['cli-pty', 'unbound-sibling'],
+  // An owner copy with no panes once read as "one pane", so the close took the whole tab.
+  ['cli-pty', 'nothing-published'],
+  ['phone-desktop', 'normal'],
+  ['phone-desktop', 'pinned'],
+  ['phone-desktop', 'unbound-sibling'],
+  ['phone-desktop', 'no-saved-layout'],
+  // A pane with no live process record once sent a tab-level close notice.
+  ['phone-desktop', 'no-live-pty'],
+  ['phone-desktop', 'kill-fails'],
+  // A host with no desktop window once closed the whole tab for one pane.
+  ['phone-headless', 'normal'],
+  ['phone-headless', 'kill-fails'],
+  ['phone-headless', 'leaf-already-retired'],
+  ['phone-headless', 'pinned'],
+  ['phone-headless', 'no-saved-layout']
+]
+
+describe('an explicit close of one pane never widens into its tab', () => {
+  it.each(rows)('%s close, %s', async (entry, condition) => {
+    const harness = arrange(entry, condition)
+    const siblingWasPersisted = Boolean(
+      harness.getSession().terminalLayoutsByTabId[TAB_ID]?.ptyIdsByLeafId?.[SIBLING_LEAF_ID]
+    )
+
+    await closePane(entry, harness)
+
+    const session = harness.getSession()
+    expect(session.tabsByWorktree[WORKTREE_ID]).toEqual([expect.objectContaining({ id: TAB_ID })])
+    if (siblingWasPersisted) {
+      expect(session.terminalLayoutsByTabId[TAB_ID]?.root).toEqual({
+        type: 'leaf',
+        leafId: SIBLING_LEAF_ID
+      })
+    }
+    expect(harness.closeTerminalTab).not.toHaveBeenCalled()
+    expect(harness.closeTerminal).not.toHaveBeenCalled()
+    expect(harness.kill).not.toHaveBeenCalledWith(SIBLING_PTY_ID)
+    if (entry === 'renderer') {
+      return
+    }
+    if (entry === 'phone-headless') {
+      const snapshot = await harness.runtime.listMobileSessionTabs(`id:${WORKTREE_ID}`)
+      expect(snapshot.tabs.map((tab) => tab.id)).toEqual([`${TAB_ID}::${SIBLING_LEAF_ID}`])
+      expect(harness.kill).toHaveBeenCalledWith(PTY_ID)
+      return
+    }
+    expect(harness.closeTerminalPane).toHaveBeenCalledExactlyOnceWith(TAB_ID, LEAF_ID)
+  })
+})
+
+describe("a close of a tab's last pane still closes the tab", () => {
+  it('on a host with no desktop window, closes the whole tab in main and for paired clients', async () => {
+    const harness = createHarness({ publishMobileSurface: true, registerPtyBacked: true })
+    harness.runtime.setNotifier(null)
+    harness.syncEmptyGraph()
+
+    await harness.runtime.closeMobileSessionTab(`id:${WORKTREE_ID}`, `${TAB_ID}::${LEAF_ID}`, {
+      reason: 'user'
+    })
+
+    expect(harness.getSession().tabsByWorktree[WORKTREE_ID]).toEqual([])
+    expect((await harness.runtime.listMobileSessionTabs(`id:${WORKTREE_ID}`)).tabs).toEqual([])
+    expect(harness.kill).toHaveBeenCalledWith(PTY_ID)
+  })
+
+  it.each([
+    ['no saved layout', () => ({})],
+    ['a layout saved before its pane mounted', () => ({ [TAB_ID]: emptyLayout })]
+  ] as const)(
+    'on a host with no desktop window, closes an unsplit tab with %s',
+    async (_name, layouts) => {
+      const harness = createHarness({ publishMobileSurface: true, registerPtyBacked: true })
+      harness.runtime.setNotifier(null)
+      harness.syncEmptyGraph()
+      harness.editSession((session) => ({ ...session, terminalLayoutsByTabId: layouts() }))
+
+      await harness.runtime.closeMobileSessionTab(`id:${WORKTREE_ID}`, `${TAB_ID}::${LEAF_ID}`, {
+        reason: 'user'
+      })
+
+      expect(harness.getSession().tabsByWorktree[WORKTREE_ID]).toEqual([])
+      expect(harness.kill).toHaveBeenCalledWith(PTY_ID)
+    }
+  )
+
+  it('from the CLI by PTY, closes an unsplit tab whose renderer graph lists no panes yet', async () => {
+    const harness = createHarness({ publishMobileSurface: true, registerPtyBacked: true })
+    harness.syncFixtureTabWithoutLeaf()
+    harness.setVerifiedStopResult(true)
+    harness.setCloseTerminalTabAction(() => harness.retirePersistedTab())
+
+    await closePane('cli-pty', harness)
+
+    expect(harness.closeTerminalTab.mock.calls.map((call) => call[0])).toEqual([TAB_ID])
+    expect(harness.closeTerminalPane).not.toHaveBeenCalled()
+  })
+
+  it.each(['phone-desktop', 'cli-graph'] as const)(
+    'from %s, goes through the renderer tab close so its pin guard still runs',
+    async (entry) => {
+      const harness = createHarness({
+        publishMobileSurface: true,
+        registerPtyBacked: entry === 'phone-desktop'
+      })
+      harness.setVerifiedStopResult(true)
+      harness.setCloseTerminalTabAction(() => harness.retirePersistedTab())
+
+      await closePane(entry, harness)
+
+      expect(harness.closeTerminalTab.mock.calls.map((call) => call[0])).toEqual([TAB_ID])
+      expect(harness.closeTerminalPane).not.toHaveBeenCalled()
+    }
+  )
+})
diff --git a/src/main/runtime/orca-runtime-terminal-handle-incarnation.test.ts b/src/main/runtime/orca-runtime-terminal-handle-incarnation.test.ts
index bac59e614b29..101ad7d4e4e4 100644
--- a/src/main/runtime/orca-runtime-terminal-handle-incarnation.test.ts
+++ b/src/main/runtime/orca-runtime-terminal-handle-incarnation.test.ts
@@ -1,11 +1,13 @@
 import { describe, expect, it, vi } from 'vitest'
 import { OrcaRuntimeService } from './orca-runtime'
+import { makePaneKey } from '../../shared/stable-pane-id'
 
 const PTY_ID = 'ssh:target@@relay-pty'
 const WORKTREE_ID = 'repo::/worktree'
 const TAB_ID = 'tab-terminal'
 const LEAF_ID = '11111111-1111-4111-8111-111111111111'
 
+/** A runtime whose pty controller captures every write for assertion. */
 function makeRuntime(): { runtime: OrcaRuntimeService; writes: string[] } {
   const writes: string[] = []
   const runtime = new OrcaRuntimeService(null)
@@ -20,6 +22,7 @@ function makeRuntime(): { runtime: OrcaRuntimeService; writes: string[] } {
   return { runtime, writes }
 }
 
+/** Attach a window and publish a one-tab, one-leaf terminal graph. */
 function syncGraph(runtime: OrcaRuntimeService): void {
   runtime.attachWindow(1)
   runtime.syncWindowGraph(1, {
@@ -44,6 +47,7 @@ function syncGraph(runtime: OrcaRuntimeService): void {
   })
 }
 
+/** (Re)register the fixture pty leaf under the given incarnation id. */
 function register(runtime: OrcaRuntimeService, incarnationId: string): void {
   runtime.registerPty(PTY_ID, WORKTREE_ID, 'target', {
     tabId: TAB_ID,
@@ -66,6 +70,8 @@ describe('runtime terminal handle incarnation fencing', () => {
       inspectProcess
     })
     expect(runtime.markRendererReloading(1)).not.toBeNull()
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
     expect((runtime as unknown as { handles: Map<string, unknown> }).handles.has(handle)).toBe(
       false
     )
@@ -89,6 +95,8 @@ describe('runtime terminal handle incarnation fencing', () => {
     })
   })
 
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
   it('treats a null-to-known incarnation as the same un-fenced PTY', async () => {
     const { runtime } = makeRuntime()
     const handle = runtime.preAllocateHandleForPty(PTY_ID)
@@ -132,6 +140,8 @@ describe('runtime terminal handle incarnation fencing', () => {
 
     // Rotate the record directly so reconcile is the only fence exercised.
     // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: test reaches the runtime's protected pty record map to bypass the registerPty fence.
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
     const internals = runtime as unknown as {
       ptysById: Map<string, { incarnationId: string | null }>
     }
@@ -159,12 +169,16 @@ describe('runtime terminal handle incarnation fencing', () => {
     })
     expect(replacement?.handle).not.toBe(staleHandle)
     await expect(runtime.readTerminal(staleHandle)).rejects.toThrow('terminal_handle_stale')
-    await expect(runtime.sendTerminal(staleHandle, { text: 'stale input' })).rejects.toThrow(
-      'terminal_handle_stale'
-    )
+    await expect(
+      runtime.sendTerminal(staleHandle, { text: 'stale input' }, { inputKind: 'driving' })
+    ).rejects.toThrow('terminal_handle_stale')
 
     await expect(
-      runtime.sendTerminal(replacement!.handle, { text: 'replacement input' })
+      runtime.sendTerminal(
+        replacement!.handle,
+        { text: 'replacement input' },
+        { inputKind: 'driving' }
+      )
     ).resolves.toMatchObject({
       accepted: true,
       handle: replacement!.handle
@@ -215,6 +229,8 @@ describe('runtime terminal handle incarnation fencing', () => {
     runtime.registerPreAllocatedHandleForPty(PTY_ID, replacementHandle)
     syncGraph(runtime)
 
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
     const internals = runtime as unknown as {
       handles: Map<string, unknown>
       handleByLeafKey: Map<string, string>
@@ -237,3 +253,130 @@ describe('runtime terminal handle incarnation fencing', () => {
     })
   })
 })
+
+describe('resolveTerminalHandleByProcessIncarnation direct fencing', () => {
+  const LOCAL_SCOPE = JSON.stringify({ kind: 'local', hostId: 'local' })
+  // PTY_ID ('ssh:target@@relay-pty') derives connectionId 'target' via parseAppSshPtyId, so its
+  // host scope is ssh:target rather than local.
+  const SSH_TARGET_SCOPE = JSON.stringify({ kind: 'ssh', targetId: 'target' })
+
+  /** Register a pty leaf directly, optionally under a connection and incarnation. */
+  function seedPty(
+    runtime: OrcaRuntimeService,
+    ptyId: string,
+    incarnationId: string | null,
+    connectionId: string | null = null
+  ): void {
+    runtime.registerPty(ptyId, WORKTREE_ID, connectionId, {
+      tabId: TAB_ID,
+      leafId: LEAF_ID,
+      ...(incarnationId ? { incarnationId } : {})
+    })
+  }
+
+  function resolve(
+    runtime: OrcaRuntimeService,
+    processIncarnation: string,
+    serializedHostScope: string | null
+  ): string | null {
+    return runtime.resolveTerminalHandleByProcessIncarnation(
+      processIncarnation,
+      serializedHostScope
+    )
+  }
+
+  it('mints a live handle for a pty whose exact incarnation and host scope match', () => {
+    const { runtime } = makeRuntime()
+    seedPty(runtime, PTY_ID, 'incarnation-1')
+    const handle = resolve(runtime, `${PTY_ID}:incarnation-1`, SSH_TARGET_SCOPE)
+    expect(handle).toMatch(/^term_/)
+    // Re-minting the same live pty is idempotent.
+    expect(resolve(runtime, `${PTY_ID}:incarnation-1`, SSH_TARGET_SCOPE)).toBe(handle)
+  })
+
+  it('returns null when the recorded incarnationId no longer matches the live pty', () => {
+    const { runtime } = makeRuntime()
+    seedPty(runtime, PTY_ID, 'incarnation-1')
+    expect(resolve(runtime, `${PTY_ID}:incarnation-2`, LOCAL_SCOPE)).toBeNull()
+  })
+
+  it('returns null when the live pty has no incarnationId (legacy runtimeId:ptyId:gen never reaps)', () => {
+    const { runtime } = makeRuntime()
+    seedPty(runtime, PTY_ID, null)
+    // A modern-shaped probe cannot match a pty that carries no incarnationId...
+    expect(resolve(runtime, `${PTY_ID}:incarnation-1`, LOCAL_SCOPE)).toBeNull()
+    // ...and the legacy `${runtimeId}:${ptyId}:${ptyGeneration}` shape stays fail-closed rather
+    // than reap on a ptyGeneration guess.
+    expect(resolve(runtime, `runtime_test:${PTY_ID}:0`, LOCAL_SCOPE)).toBeNull()
+  })
+
+  it('returns null when the host scope does not match', () => {
+    const { runtime } = makeRuntime()
+    seedPty(runtime, PTY_ID, 'incarnation-1')
+    expect(
+      resolve(runtime, `${PTY_ID}:incarnation-1`, JSON.stringify({ kind: 'ssh', targetId: 'nope' }))
+    ).toBeNull()
+  })
+
+  it('returns null when no host scope is supplied (fails closed)', () => {
+    const { runtime } = makeRuntime()
+    seedPty(runtime, PTY_ID, 'incarnation-1')
+    expect(resolve(runtime, `${PTY_ID}:incarnation-1`, null)).toBeNull()
+  })
+
+  it('resolves a colon-bearing SSH/relay incarnationId that lastIndexOf would mis-split', () => {
+    const { runtime } = makeRuntime()
+    // PTY_ID already carries ':' and '@@'; the incarnationId itself also carries colons.
+    seedPty(runtime, PTY_ID, 'relay:conn-3:incarnation-9', 'target')
+    const handle = resolve(
+      runtime,
+      `${PTY_ID}:relay:conn-3:incarnation-9`,
+      JSON.stringify({ kind: 'ssh', targetId: 'target' })
+    )
+    expect(handle).toMatch(/^term_/)
+  })
+
+  it('resolves a Windows repo::C:\\path@@1 ptyId', () => {
+    const { runtime } = makeRuntime()
+    const windowsPtyId = 'repo::C:\\path@@1'
+    seedPty(runtime, windowsPtyId, 'incarnation-win')
+    const handle = resolve(runtime, `${windowsPtyId}:incarnation-win`, LOCAL_SCOPE)
+    expect(handle).toMatch(/^term_/)
+  })
+
+  it('keeps scanning past a colon-ambiguous decoy in another host scope to the genuine match', () => {
+    const { runtime } = makeRuntime()
+    // One process-incarnation string, two colon-ambiguous pty ids that both satisfy the exact
+    // matcher: 'relay' + 'conn:incarnation-1' AND 'relay:conn' + 'incarnation-1' both stringify to
+    // 'relay:conn:incarnation-1'. The decoy is registered FIRST and lives in a different host scope
+    // (ssh:decoy); the genuine pty is local and registered later.
+    const processIncarnation = 'relay:conn:incarnation-1'
+    const DECOY_TAB_ID = 'tab-decoy'
+    const DECOY_LEAF_ID = '22222222-2222-4222-8222-222222222222'
+    const GENUINE_TAB_ID = 'tab-genuine'
+    const GENUINE_LEAF_ID = '33333333-3333-4333-8333-333333333333'
+    runtime.registerPty('relay', WORKTREE_ID, 'decoy', {
+      tabId: DECOY_TAB_ID,
+      leafId: DECOY_LEAF_ID,
+      incarnationId: 'conn:incarnation-1'
+    })
+    runtime.registerPty('relay:conn', WORKTREE_ID, null, {
+      tabId: GENUINE_TAB_ID,
+      leafId: GENUINE_LEAF_ID,
+      incarnationId: 'incarnation-1'
+    })
+
+    // Before the fix, the earlier decoy's host-scope mismatch returned null and suppressed the
+    // genuine same-scope pty entirely. `continue` lets the scan reach it.
+    const handle = resolve(runtime, processIncarnation, LOCAL_SCOPE)
+    expect(handle).toMatch(/^term_/)
+    // getTerminalProcessIncarnation cannot separate the two (both stringify to
+    // 'relay:conn:incarnation-1'), so pin the remint to the GENUINE pane. The paneKey is the only
+    // terminal-specific observable that distinguishes the genuine leaf from the same-incarnation
+    // decoy; this fails if the resolver ever mints the decoy's handle instead of the genuine pty's.
+    const genuinePaneKey = makePaneKey(GENUINE_TAB_ID, GENUINE_LEAF_ID)
+    const decoyPaneKey = makePaneKey(DECOY_TAB_ID, DECOY_LEAF_ID)
+    expect(runtime.getTerminalPaneKey(handle!)).toBe(genuinePaneKey)
+    expect(runtime.getTerminalPaneKey(handle!)).not.toBe(decoyPaneKey)
+  })
+})
diff --git a/src/main/runtime/orca-runtime-terminal-retirement-host-partition.test.ts b/src/main/runtime/orca-runtime-terminal-retirement-host-partition.test.ts
index 3079ce1f4dae..3a91794f441f 100644
--- a/src/main/runtime/orca-runtime-terminal-retirement-host-partition.test.ts
+++ b/src/main/runtime/orca-runtime-terminal-retirement-host-partition.test.ts
@@ -1,3 +1,4 @@
+import { withDurableRuntimeStore } from './runtime-durable-store-fixture'
 import { describe, expect, it, vi } from 'vitest'
 import { getDefaultWorkspaceSession } from '../../shared/constants'
 import { LOCAL_EXECUTION_HOST_ID, type ExecutionHostId } from '../../shared/execution-host'
@@ -123,7 +124,8 @@ function partitionedStore(): PartitionedStoreHarness {
   ])
   const writes: { hostId: ExecutionHostId | undefined; session: WorkspaceSessionState }[] = []
   const reads: (ExecutionHostId | undefined)[] = []
-  const store = {
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: This runtime fixture supplies the persistence and graph methods exercised by the test.
+  const store = withDurableRuntimeStore({
     getRepos: () => [SSH_REPO],
     getRepo: (id: string) => (id === SSH_REPO_ID ? SSH_REPO : undefined),
     getWorkspaceSessionHostIds: () => [...sessions.keys()],
@@ -136,7 +138,7 @@ function partitionedStore(): PartitionedStoreHarness {
       sessions.set(hostId ?? LOCAL_EXECUTION_HOST_ID, session)
     },
     flushOrThrow: vi.fn()
-  } as never
+  }) as never
   return { store, sessions, writes, reads }
 }
 
@@ -210,7 +212,8 @@ describe('OrcaRuntimeService terminal retirement host partitioning (STA-3463)',
         }
       ]
     ])
-    const store = {
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: This runtime fixture supplies the persistence and graph methods exercised by the test.
+    const store = withDurableRuntimeStore({
       getRepos: () => [{ ...SSH_REPO, executionHostId: staleHostId }],
       getRepo: () => ({ ...SSH_REPO, executionHostId: staleHostId }),
       getWorktreeMeta: () => undefined,
@@ -221,7 +224,7 @@ describe('OrcaRuntimeService terminal retirement host partitioning (STA-3463)',
       setWorkspaceSession: (session: WorkspaceSessionState, hostId?: ExecutionHostId) =>
         sessions.set(hostId ?? LOCAL_EXECUTION_HOST_ID, session),
       flushOrThrow: vi.fn()
-    } as never
+    }) as never
     const runtime = new OrcaRuntimeService(store)
     runtime.setPtyController({
       write: () => true,
@@ -285,7 +288,8 @@ describe('OrcaRuntimeService terminal retirement host partitioning (STA-3463)',
       // The SSH copy of the same `repoId::path` currently has no terminals.
       [SSH_HOST_ID, { ...getDefaultWorkspaceSession(), tabsByWorktree: { [SSH_WORKTREE_ID]: [] } }]
     ])
-    const store = {
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: This runtime fixture supplies the persistence and graph methods exercised by the test.
+    const store = withDurableRuntimeStore({
       getRepos: () => [SSH_REPO],
       getRepo: (id: string) => (id === SSH_REPO_ID ? SSH_REPO : undefined),
       getWorktreeMeta: () => ({ hostId: SSH_HOST_ID }),
@@ -298,7 +302,7 @@ describe('OrcaRuntimeService terminal retirement host partitioning (STA-3463)',
         sessions.set(hostId ?? LOCAL_EXECUTION_HOST_ID, session),
       flushOrThrow: vi.fn(),
       persistPtyBinding: vi.fn()
-    } as never
+    }) as never
     const runtime = new OrcaRuntimeService(store)
     const stopAndWait = vi.fn(async () => true)
     runtime.setPtyController({
@@ -334,7 +338,8 @@ describe('OrcaRuntimeService terminal retirement host partitioning (STA-3463)',
       ],
       [staleHostId, { ...getDefaultWorkspaceSession(), tabsByWorktree: { [SSH_WORKTREE_ID]: [] } }]
     ])
-    const store = {
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: This runtime fixture supplies the persistence and graph methods exercised by the test.
+    const store = withDurableRuntimeStore({
       getRepos: () => [{ ...SSH_REPO, executionHostId: staleHostId }],
       getRepo: () => ({ ...SSH_REPO, executionHostId: staleHostId }),
       getWorktreeMeta: () => ({}),
@@ -347,7 +352,7 @@ describe('OrcaRuntimeService terminal retirement host partitioning (STA-3463)',
         sessions.set(hostId ?? LOCAL_EXECUTION_HOST_ID, session),
       flushOrThrow: vi.fn(),
       persistPtyBinding: vi.fn()
-    } as never
+    }) as never
     const runtime = new OrcaRuntimeService(store)
     runtime.setPtyController({
       write: () => true,
@@ -408,6 +413,62 @@ describe('OrcaRuntimeService terminal retirement host partitioning (STA-3463)',
     expect(targets.get(folderWorktreeId)).toBe(localSession)
   })
 
+  it.each<[string, string, Record<string, unknown>, ExecutionHostId]>([
+    ['local repo', 'repo::/wt', { id: 'repo' }, LOCAL_EXECUTION_HOST_ID],
+    ['SSH repo', 'repo::/wt', { id: 'repo', connectionId: 'c1' }, 'ssh:c1'],
+    ['runtime repo', 'repo::/wt', { id: 'repo', executionHostId: 'runtime:e1' }, 'runtime:e1'],
+    ['local folder', 'folder:f1', { folderId: 'f1' }, LOCAL_EXECUTION_HOST_ID],
+    ['SSH folder', 'folder:f1', { folderId: 'f1', connectionId: 'c1' }, 'ssh:c1'],
+    ['explicit SSH folder', 'folder:f1', { folderId: 'f1', executionHostId: 'ssh:c2' }, 'ssh:c2'],
+    ['runtime folder', 'folder:f1', { folderId: 'f1', executionHostId: 'runtime:e1' }, 'runtime:e1']
+  ])('reads a %s own saved partition', (_label, worktreeId, owner, ownerHostId) => {
+    const listing = (id: string) => ({
+      ...getDefaultWorkspaceSession(),
+      tabsByWorktree: {
+        [worktreeId]: [
+          {
+            id,
+            ptyId: null,
+            worktreeId,
+            title: id,
+            customTitle: null,
+            color: null,
+            sortOrder: 0,
+            createdAt: 1
+          }
+        ]
+      }
+    })
+    const sessions = new Map<ExecutionHostId, WorkspaceSessionState>([
+      [ownerHostId, listing('own')],
+      ['runtime:e0', listing('rotated')]
+    ])
+    const { folderId, ...repoOrFolder } = owner
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the controller reads only repos, folder workspaces and workspace sessions.
+    const store = {
+      getRepos: () => (folderId ? [] : [repoOrFolder]),
+      getRepo: () => (folderId ? undefined : repoOrFolder),
+      getFolderWorkspaces: () => (folderId ? [{ ...repoOrFolder, id: folderId }] : []),
+      getWorkspaceSessionHostIds: () => [...sessions.keys()],
+      getWorkspaceSession: (hostId: ExecutionHostId) =>
+        sessions.get(hostId) ?? getDefaultWorkspaceSession()
+    } as never
+    const controller = new RuntimeWorkspaceSessionController({
+      getStore: () => store,
+      resolveFolderConnectionId: (workspace) => workspace.connectionId ?? null,
+      hasRuntimeOwnedPtyCandidate: () => false
+    })
+
+    expect(controller.getOwnPartition(worktreeId)).toBe(sessions.get(ownerHostId))
+    expect(controller.get(worktreeId)).toBe(sessions.get(ownerHostId))
+
+    sessions.set(ownerHostId, getDefaultWorkspaceSession())
+    const fellBack = controller.get(worktreeId) === sessions.get('runtime:e0')
+    // Only a runtime owner rotates onto another copy; that copy is never read as its own.
+    expect(fellBack).toBe(ownerHostId.startsWith('runtime:'))
+    expect(controller.getOwnPartition(worktreeId)?.tabsByWorktree[worktreeId]).toBeUndefined()
+  })
+
   it('waits for provider retirement on a direct worktree stop', async () => {
     const harness = partitionedStore()
     const runtime = new OrcaRuntimeService(harness.store)
@@ -491,7 +552,7 @@ describe('OrcaRuntimeService terminal retirement host partitioning (STA-3463)',
       incarnationId: 'incarnation-a'
     })
 
-    runtime.onPtyExit(SSH_PTY_LEFT, 0, 'incarnation-a')
+    await runtime.onPtyExit(SSH_PTY_LEFT, 0, 'incarnation-a')
 
     // The durable retirement must land in the pane's own host partition.
     expect(harness.writes.map((write) => write.hostId)).toEqual([SSH_HOST_ID])
@@ -624,7 +685,7 @@ describe('OrcaRuntimeService terminal retirement host partitioning (STA-3463)',
       incarnationId: 'incarnation-a'
     })
 
-    runtime.onPtyExit('pty-left', 0, 'incarnation-a')
+    await runtime.onPtyExit('pty-left', 0, 'incarnation-a')
 
     expect(harness.writes.map((write) => write.hostId ?? LOCAL_EXECUTION_HOST_ID)).toEqual([
       LOCAL_EXECUTION_HOST_ID
diff --git a/src/main/runtime/orca-runtime-terminal-retirement.test.ts b/src/main/runtime/orca-runtime-terminal-retirement.test.ts
index e1a2c68242cd..4422dc2a1e64 100644
--- a/src/main/runtime/orca-runtime-terminal-retirement.test.ts
+++ b/src/main/runtime/orca-runtime-terminal-retirement.test.ts
@@ -1,3 +1,4 @@
+import { withDurableRuntimeStore } from './runtime-durable-store-fixture'
 import { describe, expect, it, vi } from 'vitest'
 import { getDefaultWorkspaceSession } from '../../shared/constants'
 import { LOCAL_EXECUTION_HOST_ID } from '../../shared/execution-host'
@@ -148,7 +149,7 @@ function makePersistedSplitSession(): WorkspaceSessionState {
 }
 
 describe('OrcaRuntimeService terminal surface retirement', () => {
-  it('releases each early-exit fence after its matching registration is rejected', () => {
+  it('releases each early-exit fence after its matching registration is rejected', async () => {
     const runtime = new OrcaRuntimeService()
     const internals = runtime as unknown as {
       earlyExitedPtyIncarnations: Map<string, string | null>
@@ -158,7 +159,7 @@ describe('OrcaRuntimeService terminal surface retirement', () => {
       const ptyId = `pty-early-${index}`
       const incarnationId = `incarnation-${index}`
       runtime.beginPtyRegistration(ptyId, incarnationId)
-      runtime.onPtyExit(ptyId, 0, incarnationId)
+      await runtime.onPtyExit(ptyId, 0, incarnationId)
       expect(() => runtime.assertPtyRegistrationAllowed(ptyId, incarnationId)).toThrow(
         'agent_session_exited_during_start'
       )
@@ -168,7 +169,7 @@ describe('OrcaRuntimeService terminal surface retirement', () => {
     expect(internals.earlyExitedPtyIncarnations.size).toBe(0)
   })
 
-  it('does not retain fences for completed surface-less lifecycles', () => {
+  it('does not retain fences for completed surface-less lifecycles', async () => {
     const runtime = new OrcaRuntimeService()
     const internals = runtime as unknown as {
       earlyExitedPtyIncarnations: Map<string, string | null>
@@ -179,14 +180,14 @@ describe('OrcaRuntimeService terminal surface retirement', () => {
       runtime.onPtySpawned(`pty-headless-${index}`, `incarnation-${index}`, {
         awaitsRegistration: false
       })
-      runtime.onPtyExit(`pty-headless-${index}`, 0, `incarnation-${index}`)
+      await runtime.onPtyExit(`pty-headless-${index}`, 0, `incarnation-${index}`)
     }
 
     expect(internals.earlyExitedPtyIncarnations.size).toBe(0)
     expect(internals.pendingPtyRegistrationIncarnations.size).toBe(0)
   })
 
-  it('fences an early-exited replacement even when its pane already exists', () => {
+  it('fences an early-exited replacement even when its pane already exists', async () => {
     const runtime = new OrcaRuntimeService()
     runtime.attachWindow(1)
     syncSplit(runtime)
@@ -197,7 +198,7 @@ describe('OrcaRuntimeService terminal surface retirement', () => {
     })
 
     runtime.onPtySpawned('pty-left', 'incarnation-replacement')
-    runtime.onPtyExit('pty-left', 0, 'incarnation-replacement')
+    await runtime.onPtyExit('pty-left', 0, 'incarnation-replacement')
 
     expect(() =>
       runtime.assertPtyRegistrationAllowed('pty-left', 'incarnation-replacement')
@@ -224,7 +225,7 @@ describe('OrcaRuntimeService terminal surface retirement', () => {
         ? leftBeforeExit.terminal
         : null
 
-    runtime.onPtyExit('pty-left', 0)
+    await runtime.onPtyExit('pty-left', 0)
 
     expect(await runtime.listMobileSessionTabs(`id:${WORKTREE_ID}`)).toMatchObject({
       activeTabId: 'tab::right',
@@ -467,16 +468,18 @@ describe('OrcaRuntimeService terminal surface retirement', () => {
       sleepingAgentSessionsByPaneKey: { 'tab:left': {} as never }
     }
     const runtime = new OrcaRuntimeService(
-      runtimeStore({
-        getWorkspaceSession: () => session,
-        setWorkspaceSession: vi.fn(),
-        flushOrThrow: vi.fn()
-      })
+      runtimeStore(
+        withDurableRuntimeStore({
+          getWorkspaceSession: () => session,
+          setWorkspaceSession: vi.fn(),
+          flushOrThrow: vi.fn()
+        })
+      )
     )
     runtime.attachWindow(1)
     syncSplit(runtime)
 
-    runtime.onPtyExit('pty-left', 0)
+    await runtime.onPtyExit('pty-left', 0)
 
     const result = await runtime.listMobileSessionTabs(`id:${WORKTREE_ID}`)
     expect(result.tabs.find((tab) => tab.id === 'tab::left')).toBeUndefined()
@@ -506,7 +509,7 @@ describe('OrcaRuntimeService terminal surface retirement', () => {
       incarnationId: 'incarnation-b'
     })
 
-    runtime.onPtyExit('pty-left', 0, 'incarnation-a')
+    await runtime.onPtyExit('pty-left', 0, 'incarnation-a')
 
     expect((await runtime.listMobileSessionTabs(`id:${WORKTREE_ID}`)).tabs).toEqual([
       expect.objectContaining({ id: 'tab::left', status: 'ready' }),
@@ -519,11 +522,13 @@ describe('OrcaRuntimeService terminal surface retirement', () => {
     const session = makePersistedSplitSession()
     const setWorkspaceSession = vi.fn()
     const runtime = new OrcaRuntimeService(
-      runtimeStore({
-        getWorkspaceSession: () => session,
-        setWorkspaceSession,
-        flushOrThrow: vi.fn()
-      })
+      runtimeStore(
+        withDurableRuntimeStore({
+          getWorkspaceSession: () => session,
+          setWorkspaceSession,
+          flushOrThrow: vi.fn()
+        })
+      )
     )
     runtime.attachWindow(1)
     syncSplit(runtime)
@@ -534,7 +539,7 @@ describe('OrcaRuntimeService terminal surface retirement', () => {
     })
 
     runtime.acceptPtyIncarnationForExit('pty-left', 'incarnation-after-reconnect')
-    runtime.onPtyExit('pty-left', 0, 'incarnation-after-reconnect')
+    await runtime.onPtyExit('pty-left', 0, 'incarnation-after-reconnect')
 
     expect((await runtime.listMobileSessionTabs(`id:${WORKTREE_ID}`)).tabs).toEqual([
       expect.objectContaining({ id: 'tab::right', status: 'ready' })
@@ -567,11 +572,13 @@ describe('OrcaRuntimeService terminal surface retirement', () => {
       session = next
     })
     const runtime = new OrcaRuntimeService(
-      runtimeStore({
-        getWorkspaceSession: () => session,
-        setWorkspaceSession,
-        flushOrThrow: vi.fn()
-      })
+      runtimeStore(
+        withDurableRuntimeStore({
+          getWorkspaceSession: () => session,
+          setWorkspaceSession,
+          flushOrThrow: vi.fn()
+        })
+      )
     )
     runtime.attachWindow(1)
     const snapshot = makeSplitSnapshot()
@@ -601,7 +608,7 @@ describe('OrcaRuntimeService terminal surface retirement', () => {
     const published: RuntimeMobileSessionTabsResult[] = []
     const unsubscribe = runtime.onMobileSessionTabsChanged((event) => published.push(event))
 
-    runtime.onPtyExit('pty-shared', 0, 'incarnation-exiting')
+    await runtime.onPtyExit('pty-shared', 0, 'incarnation-exiting')
 
     expect(session.terminalLayoutsByTabId.tab).toMatchObject({
       root: { type: 'leaf', leafId: 'right' },
@@ -626,16 +633,18 @@ describe('OrcaRuntimeService terminal surface retirement', () => {
     unsubscribe()
   })
 
-  it('de-persists an exact surface even when there is no mobile snapshot', () => {
+  it('de-persists an exact surface even when there is no mobile snapshot', async () => {
     const session = makePersistedSplitSession()
     const setWorkspaceSession = vi.fn()
     const flushOrThrow = vi.fn()
     const runtime = new OrcaRuntimeService(
-      runtimeStore({
-        getWorkspaceSession: () => session,
-        setWorkspaceSession,
-        flushOrThrow
-      })
+      runtimeStore(
+        withDurableRuntimeStore({
+          getWorkspaceSession: () => session,
+          setWorkspaceSession,
+          flushOrThrow
+        })
+      )
     )
     runtime.attachWindow(1)
     runtime.syncWindowGraph(1, {
@@ -664,7 +673,7 @@ describe('OrcaRuntimeService terminal surface retirement', () => {
       incarnationId: 'incarnation-a'
     })
 
-    runtime.onPtyExit('pty-left', 0, 'incarnation-a')
+    await runtime.onPtyExit('pty-left', 0, 'incarnation-a')
 
     expect(setWorkspaceSession).toHaveBeenCalledWith(
       expect.objectContaining({
@@ -686,13 +695,15 @@ describe('OrcaRuntimeService terminal surface retirement', () => {
     const session = makePersistedSplitSession()
     const errorSpy = vi.spyOn(console, 'error').mockImplementation(() => undefined)
     const runtime = new OrcaRuntimeService(
-      runtimeStore({
-        getWorkspaceSession: () => session,
-        setWorkspaceSession: vi.fn(),
-        flushOrThrow: vi.fn(() => {
-          throw new Error('disk unavailable')
+      runtimeStore(
+        withDurableRuntimeStore({
+          getWorkspaceSession: () => session,
+          setWorkspaceSession: vi.fn(),
+          flushOrThrow: vi.fn(() => {
+            throw new Error('disk unavailable')
+          })
         })
-      })
+      )
     )
     runtime.attachWindow(1)
     syncSplit(runtime)
@@ -704,7 +715,7 @@ describe('OrcaRuntimeService terminal surface retirement', () => {
     const events: unknown[] = []
     const unsubscribe = runtime.onMobileSessionTabsChanged((event) => events.push(event))
 
-    runtime.onPtyExit('pty-left', 0, 'incarnation-a')
+    await runtime.onPtyExit('pty-left', 0, 'incarnation-a')
 
     expect((await runtime.listMobileSessionTabs(`id:${WORKTREE_ID}`)).tabs).toEqual([
       expect.objectContaining({ id: 'tab::left' }),
@@ -726,13 +737,15 @@ describe('OrcaRuntimeService terminal surface retirement', () => {
       session = next
     })
     const runtime = new OrcaRuntimeService(
-      runtimeStore({
-        getWorkspaceSession: () => session,
-        setWorkspaceSession,
-        flushOrThrow: vi.fn(() => {
-          throw new Error('disk unavailable')
+      runtimeStore(
+        withDurableRuntimeStore({
+          getWorkspaceSession: () => session,
+          setWorkspaceSession,
+          flushOrThrow: vi.fn(() => {
+            throw new Error('disk unavailable')
+          })
         })
-      })
+      )
     )
     runtime.attachWindow(1)
     syncSplit(runtime)
@@ -742,7 +755,7 @@ describe('OrcaRuntimeService terminal surface retirement', () => {
       incarnationId: 'incarnation-a'
     })
 
-    runtime.onPtyExit('pty-left', 0, 'incarnation-a')
+    await runtime.onPtyExit('pty-left', 0, 'incarnation-a')
 
     expect(session).toEqual(original)
     expect(setWorkspaceSession).toHaveBeenLastCalledWith(original, LOCAL_EXECUTION_HOST_ID)
diff --git a/src/main/runtime/orca-runtime-terminal-surface-close.test.ts b/src/main/runtime/orca-runtime-terminal-surface-close.test.ts
new file mode 100644
index 000000000000..df39087c6888
--- /dev/null
+++ b/src/main/runtime/orca-runtime-terminal-surface-close.test.ts
@@ -0,0 +1,344 @@
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it } from 'vitest'
+import { makePaneKey } from '../../shared/stable-pane-id'
+import type { WorkspaceSessionState } from '../../shared/workspace-session-state-types'
+import { Store } from '../persistence/loading-store/store'
+import { closeTestStores, createSqliteTestStore } from '../persistence-test-harness'
+import { OrcaRuntimeService } from './orca-runtime'
+import {
+  LEAF_ID,
+  PTY_ID,
+  REPO_ID,
+  SIBLING_LEAF_ID,
+  SIBLING_PTY_ID,
+  TAB_ID,
+  WORKTREE_ID,
+  WORKTREE_PATH,
+  createHarness,
+  makeSession
+} from './__fixtures__/orca-runtime-terminal-close-continuity-fixtures'
+import {
+  retireTerminalSurfaceFromPersistence,
+  sanitizeWorkspaceSessionTerminalRetirements
+} from './mobile-session-terminal-persistence-retirement'
+import { advanceTerminalTopologyRevision } from './workspace-session-terminal-membership-authority'
+
+const splitLayout = {
+  root: {
+    type: 'split' as const,
+    direction: 'horizontal' as const,
+    first: { type: 'leaf' as const, leafId: LEAF_ID },
+    second: { type: 'leaf' as const, leafId: SIBLING_LEAF_ID }
+  },
+  activeLeafId: LEAF_ID,
+  expandedLeafId: null,
+  ptyIdsByLeafId: { [LEAF_ID]: PTY_ID, [SIBLING_LEAF_ID]: SIBLING_PTY_ID }
+}
+
+function splitSession(): WorkspaceSessionState {
+  return { ...makeSession(), terminalLayoutsByTabId: { [TAB_ID]: splitLayout } }
+}
+
+function splitSessionAfterExitRetired(): WorkspaceSessionState {
+  return retireTerminalSurfaceFromPersistence(splitSession(), {
+    worktreeId: WORKTREE_ID,
+    parentTabId: TAB_ID,
+    leafId: LEAF_ID,
+    ptyId: PTY_ID
+  })
+}
+
+function withPinnedTab(session: WorkspaceSessionState): WorkspaceSessionState {
+  return {
+    ...session,
+    tabsByWorktree: {
+      [WORKTREE_ID]: (session.tabsByWorktree[WORKTREE_ID] ?? []).map((tab) => ({
+        ...tab,
+        isPinned: true
+      }))
+    }
+  }
+}
+
+const directories: string[] = []
+afterEach(async () => {
+  await closeTestStores()
+  for (const directory of directories.splice(0)) {
+    rmSync(directory, { recursive: true, force: true })
+  }
+})
+
+/** A real store whose repo already has host-authoritative membership, as any repo with an exit does. */
+function createPersistedRuntime(session: WorkspaceSessionState) {
+  const directory = mkdtempSync(join(tmpdir(), 'orca-surface-close-'))
+  directories.push(directory)
+  const dataFile = join(directory, 'orca-data.json')
+  const store = createSqliteTestStore(Store, { dataFile })
+  store.addRepo({
+    id: REPO_ID,
+    path: WORKTREE_PATH,
+    displayName: 'Fixture',
+    badgeColor: 'gray',
+    addedAt: 1
+  })
+  store.setWorkspaceSession(advanceTerminalTopologyRevision(session, WORKTREE_ID))
+  store.flushOrThrow()
+  return {
+    store,
+    runtime: new OrcaRuntimeService(store),
+    reload: async () => {
+      store.flush()
+      store.freezeWrites()
+      await store.waitForPendingWrite()
+      return createSqliteTestStore(Store, { dataFile }).getWorkspaceSession()
+    }
+  }
+}
+
+/** What a renderer save carries after its own close: membership without the closed surface. */
+function rendererSaveWithout(
+  session: WorkspaceSessionState,
+  leafId?: string
+): WorkspaceSessionState {
+  const { terminalTopologyRevisionByRepoId: _hostPrivate, ...rendererView } = session
+  if (!leafId) {
+    return { ...rendererView, tabsByWorktree: { [WORKTREE_ID]: [] }, terminalLayoutsByTabId: {} }
+  }
+  return {
+    ...rendererView,
+    terminalLayoutsByTabId: {
+      [TAB_ID]: {
+        root: { type: 'leaf', leafId: SIBLING_LEAF_ID },
+        activeLeafId: SIBLING_LEAF_ID,
+        expandedLeafId: null,
+        ptyIdsByLeafId: { [SIBLING_LEAF_ID]: SIBLING_PTY_ID }
+      }
+    }
+  }
+}
+
+describe('renderer close intents', () => {
+  it('keeps a closed tab closed across a renderer save and a reload', async () => {
+    const { store, runtime, reload } = createPersistedRuntime(makeSession())
+
+    await runtime.closeTerminalSurfaceFromRenderer(WORKTREE_ID, { kind: 'tab', tabId: TAB_ID })
+    store.setWorkspaceSession(rendererSaveWithout(store.getWorkspaceSession()))
+
+    expect((await reload()).tabsByWorktree[WORKTREE_ID]).toEqual([])
+  })
+
+  it('keeps a closed split pane closed across a renderer save and a reload', async () => {
+    const { store, runtime, reload } = createPersistedRuntime(splitSession())
+
+    await runtime.closeTerminalSurfaceFromRenderer(WORKTREE_ID, {
+      kind: 'pane',
+      tabId: TAB_ID,
+      leafId: LEAF_ID
+    })
+    store.setWorkspaceSession(rendererSaveWithout(store.getWorkspaceSession(), LEAF_ID))
+
+    const reloaded = await reload()
+    expect(reloaded.tabsByWorktree[WORKTREE_ID]).toEqual([expect.objectContaining({ id: TAB_ID })])
+    expect(reloaded.terminalLayoutsByTabId[TAB_ID]?.root).toEqual({
+      type: 'leaf',
+      leafId: SIBLING_LEAF_ID
+    })
+    expect(reloaded.terminalPtyIncarnationsByPaneKey?.[makePaneKey(TAB_ID, LEAF_ID)]).toBe(
+      undefined
+    )
+  })
+
+  // e.g. the exited-pane overlay's Close, after main's exit handling already retired that leaf.
+  it.each([
+    ['its exit already retired the pane', () => splitSessionAfterExitRetired()],
+    ['the tab is pinned', () => withPinnedTab(splitSessionAfterExitRetired())],
+    ['the tab has no saved layout', () => ({ ...makeSession(), terminalLayoutsByTabId: {} })]
+  ])('never widens a pane close into a tab close when %s', async (_case, session) => {
+    const { runtime, reload } = createPersistedRuntime(session())
+
+    await runtime.closeTerminalSurfaceFromRenderer(WORKTREE_ID, {
+      kind: 'pane',
+      tabId: TAB_ID,
+      leafId: LEAF_ID
+    })
+
+    expect((await reload()).tabsByWorktree[WORKTREE_ID]).toEqual([
+      expect.objectContaining({ id: TAB_ID })
+    ])
+  })
+})
+
+describe('CLI close of one pane in a split tab', () => {
+  it('commits the pane removal without waiting for its process exit', async () => {
+    const harness = createHarness()
+    harness.syncSplitFixtureGraph()
+    // A verified stop that never reports an exit: membership must not ride on one.
+    harness.setVerifiedStopResult(true)
+    const terminal = (await harness.runtime.listTerminals(`id:${WORKTREE_ID}`)).terminals.find(
+      (candidate) => candidate.ptyId === PTY_ID
+    )!
+
+    await expect(harness.runtime.closeTerminal(terminal.handle)).resolves.toMatchObject({
+      tabId: TAB_ID,
+      ptyKilled: true
+    })
+
+    const session = harness.getSession()
+    expect(session.tabsByWorktree[WORKTREE_ID]).toEqual([expect.objectContaining({ id: TAB_ID })])
+    expect(session.terminalLayoutsByTabId[TAB_ID]).toMatchObject({
+      root: { type: 'leaf', leafId: SIBLING_LEAF_ID },
+      ptyIdsByLeafId: { [SIBLING_LEAF_ID]: SIBLING_PTY_ID }
+    })
+    // No exit arrives to remove the pane, so the desktop renderer is told to drop that leaf.
+    expect(harness.closeTerminalPane).toHaveBeenCalledExactlyOnceWith(TAB_ID, LEAF_ID)
+    expect(harness.closeTerminalTab).not.toHaveBeenCalled()
+  })
+
+  it('commits the pane removal when the handle names a live PTY', async () => {
+    const harness = createHarness({ publishMobileSurface: true, registerPtyBacked: true })
+    harness.syncSplitFixtureGraph()
+    // Graph without the leaf: the handle resolves through the PTY, as for a runtime-owned pane.
+    harness.syncFixtureTabWithoutLeaf()
+    harness.setVerifiedStopResult(true)
+    const terminal = (await harness.runtime.listTerminals(`id:${WORKTREE_ID}`)).terminals.find(
+      (candidate) => candidate.ptyId === PTY_ID
+    )!
+
+    await expect(harness.runtime.closeTerminal(terminal.handle)).resolves.toMatchObject({
+      tabId: TAB_ID,
+      ptyKilled: true
+    })
+
+    expect(harness.getSession().terminalLayoutsByTabId[TAB_ID]?.root).toEqual({
+      type: 'leaf',
+      leafId: SIBLING_LEAF_ID
+    })
+    expect(harness.closeTerminalPane).toHaveBeenCalledExactlyOnceWith(TAB_ID, LEAF_ID)
+    expect(harness.closeTerminalTab).not.toHaveBeenCalled()
+  })
+
+  it.each([
+    ['reports no exit', false],
+    ['throws, as an unreachable SSH host does', new Error('ssh_host_unreachable')]
+  ] as const)(
+    'closes only that pane, never the live sibling, when its stop %s',
+    async (_case, stopResult) => {
+      const harness = createHarness({ publishMobileSurface: true, registerPtyBacked: true })
+      harness.syncSplitFixtureGraph()
+      harness.syncFixtureTabWithoutLeaf()
+      harness.setVerifiedStopResult(stopResult)
+      // A renderer that honours a whole-tab close, so a widened close shows as the lost sibling.
+      harness.setCloseTerminalTabAction(() => harness.retirePersistedTab())
+      const terminal = (await harness.runtime.listTerminals(`id:${WORKTREE_ID}`)).terminals.find(
+        (candidate) => candidate.ptyId === PTY_ID
+      )!
+
+      const receipt = await harness.runtime.closeTerminal(terminal.handle)
+
+      // A stale renderer save that still lists the pane can neither restore it nor drop the sibling.
+      const saved = sanitizeWorkspaceSessionTerminalRetirements(
+        { ...harness.getSession(), terminalLayoutsByTabId: { [TAB_ID]: splitLayout } },
+        harness.getSession()
+      )
+      expect(saved.tabsByWorktree[WORKTREE_ID]).toEqual([expect.objectContaining({ id: TAB_ID })])
+      expect(saved.terminalLayoutsByTabId[TAB_ID]?.root).toEqual({
+        type: 'leaf',
+        leafId: SIBLING_LEAF_ID
+      })
+      expect(harness.closeTerminalPane).toHaveBeenCalledExactlyOnceWith(TAB_ID, LEAF_ID)
+      expect(harness.closeTerminalTab).not.toHaveBeenCalled()
+      // The owed stop still goes out through the controller's kill, which records SSH pending kills.
+      expect(harness.kill).toHaveBeenCalledWith(PTY_ID)
+      expect(harness.kill).not.toHaveBeenCalledWith(SIBLING_PTY_ID)
+      expect(receipt).toMatchObject({
+        tabId: TAB_ID,
+        ptyKilled: false,
+        ptyStopVerdict: 'unverifiable'
+      })
+    }
+  )
+
+  it('drops only that pane from paired clients on a host with no renderer listing the tab', async () => {
+    const harness = createHarness({ publishMobileSurface: true, registerPtyBacked: true })
+    harness.syncSplitFixtureGraph()
+    harness.syncFixtureTabWithoutLeaf()
+    const terminal = (await harness.runtime.listTerminals(`id:${WORKTREE_ID}`)).terminals.find(
+      (candidate) => candidate.ptyId === PTY_ID
+    )!
+    harness.syncEmptyGraph()
+    // No exit arrives to retire the pane from the published snapshot.
+    harness.setVerifiedStopResult(new Error('ssh_host_unreachable'))
+
+    await harness.runtime.closeTerminal(terminal.handle)
+
+    const snapshot = await harness.runtime.listMobileSessionTabs(`id:${WORKTREE_ID}`)
+    expect(snapshot.tabs).toEqual([
+      expect.objectContaining({ parentTabId: TAB_ID, leafId: SIBLING_LEAF_ID })
+    ])
+    expect(snapshot.retiredTerminalSurfaces).toEqual([
+      expect.objectContaining({ parentTabId: TAB_ID, leafId: LEAF_ID, ptyId: PTY_ID })
+    ])
+    expect(harness.getSession().terminalLayoutsByTabId[TAB_ID]?.root).toEqual({
+      type: 'leaf',
+      leafId: SIBLING_LEAF_ID
+    })
+  })
+
+  it('keeps the sibling when the stop delivers the exit before the pane commit', async () => {
+    const harness = createHarness()
+    harness.syncSplitFixtureGraph()
+    harness.setStopAndWaitAction((stoppingPtyId) => harness.runtime.onPtyExit(stoppingPtyId, 0))
+    harness.setVerifiedStopResult(true)
+    const terminal = (await harness.runtime.listTerminals(`id:${WORKTREE_ID}`)).terminals.find(
+      (candidate) => candidate.ptyId === PTY_ID
+    )!
+
+    await harness.runtime.closeTerminal(terminal.handle)
+
+    const session = harness.getSession()
+    expect(session.tabsByWorktree[WORKTREE_ID]).toEqual([expect.objectContaining({ id: TAB_ID })])
+    expect(session.terminalLayoutsByTabId[TAB_ID]?.root).toEqual({
+      type: 'leaf',
+      leafId: SIBLING_LEAF_ID
+    })
+  })
+})
+
+describe('mobile close of one pane in a split tab', () => {
+  it('commits the pane removal alongside its kill', async () => {
+    const harness = createHarness({ publishMobileSurface: true, registerPtyBacked: true })
+    harness.syncSplitFixtureGraph()
+
+    await expect(
+      harness.runtime.closeMobileSessionTab(`id:${WORKTREE_ID}`, `${TAB_ID}::${LEAF_ID}`, {
+        reason: 'user'
+      })
+    ).resolves.toMatchObject({ closed: true })
+
+    expect(harness.kill).toHaveBeenCalledWith(PTY_ID)
+    expect(harness.getSession().terminalLayoutsByTabId[TAB_ID]).toMatchObject({
+      root: { type: 'leaf', leafId: SIBLING_LEAF_ID }
+    })
+    expect(harness.closeTerminalPane).toHaveBeenCalledExactlyOnceWith(TAB_ID, LEAF_ID)
+  })
+})
+
+describe('mobile close of a tab the desktop renderer lists', () => {
+  // Pins are renderer presentation that main's session can lag, so only the renderer can refuse.
+  it('still asks the renderer, whose pin guard can refuse it', async () => {
+    const harness = createHarness({ publishMobileSurface: true, registerPtyBacked: true })
+    harness.rejectTerminalTabClose(new Error('terminal_tab_pinned'))
+
+    await expect(
+      harness.runtime.closeMobileSessionTab(`id:${WORKTREE_ID}`, TAB_ID, { reason: 'user' })
+    ).rejects.toThrow('terminal_tab_pinned')
+
+    expect(harness.closeTerminalTab).toHaveBeenCalledWith(TAB_ID)
+    expect(harness.kill).not.toHaveBeenCalled()
+    expect(harness.getSession().tabsByWorktree[WORKTREE_ID]).toEqual([
+      expect.objectContaining({ id: TAB_ID })
+    ])
+  })
+})
diff --git a/src/main/runtime/orca-runtime-test-fixtures.spec.ts b/src/main/runtime/orca-runtime-test-fixtures.spec.ts
index c72bde039b9f..78a6089e3ed3 100644
--- a/src/main/runtime/orca-runtime-test-fixtures.spec.ts
+++ b/src/main/runtime/orca-runtime-test-fixtures.spec.ts
@@ -1,3 +1,4 @@
+import { withDurableRuntimeStore } from './runtime-durable-store-fixture'
 import { expect, vi } from 'vitest'
 import { createHash } from 'node:crypto'
 import { HeadlessEmulator } from '../daemon/headless-emulator'
@@ -25,6 +26,7 @@ import type {
 import { InMemoryOrchestrationMessages } from './orca-runtime-test-orchestration-messages.spec'
 import type { OrchestrationDb } from './orchestration/db'
 import type { PtyProcessInspection } from '../providers/pty-process-inspection'
+import type { Store } from '../persistence'
 
 type RuntimeService = InstanceType<typeof OrcaRuntimeService>
 type HeadlessTerminal = InstanceType<typeof HeadlessEmulator>
@@ -558,9 +560,9 @@ function makeRuntimeStoreWithWorkspaceSession(
 ): {
   runtimeStore: typeof store & {
     getWorkspaceSession: (hostId?: string) => WorkspaceSessionState
-    setWorkspaceSession: ReturnType<typeof vi.fn>
-    flushOrThrow: ReturnType<typeof vi.fn>
-    persistPtyBinding: ReturnType<typeof vi.fn>
+    setWorkspaceSession: ReturnType<typeof vi.fn<Store['setWorkspaceSession']>>
+    flushOrThrow: ReturnType<typeof vi.fn<() => void>>
+    persistPtyBinding: ReturnType<typeof vi.fn<Store['persistPtyBinding']>>
   }
   getSession: () => WorkspaceSessionState
   setSession: (next: WorkspaceSessionState) => void
@@ -569,7 +571,7 @@ function makeRuntimeStoreWithWorkspaceSession(
   const setSession = (next: WorkspaceSessionState): void => {
     session = next
   }
-  const runtimeStore = {
+  const runtimeStore = withDurableRuntimeStore({
     ...store,
     getWorkspaceSession: (hostId?: string) =>
       hostId === undefined || hostId === ownerHostId ? session : getDefaultWorkspaceSession(),
@@ -577,36 +579,38 @@ function makeRuntimeStoreWithWorkspaceSession(
     // Headless close is a durable transaction; keep the in-memory fixture's
     // persistence contract equivalent to the production store.
     flushOrThrow: vi.fn(),
-    persistPtyBinding: vi.fn(
-      (args: { worktreeId: string; tabId: string; leafId: string; ptyId: string }) => {
-        const tabs = session.tabsByWorktree[args.worktreeId] ?? []
-        session = {
-          ...session,
-          tabsByWorktree: {
-            ...session.tabsByWorktree,
-            [args.worktreeId]: tabs.map((tab) =>
-              tab.id === args.tabId ? { ...tab, ptyId: args.ptyId } : tab
-            )
-          },
-          terminalLayoutsByTabId: {
-            ...session.terminalLayoutsByTabId,
-            [args.tabId]: {
-              ...(session.terminalLayoutsByTabId[args.tabId] ?? {
-                root: { type: 'leaf', leafId: args.leafId },
-                activeLeafId: args.leafId,
-                expandedLeafId: null
-              }),
-              ptyIdsByLeafId: {
-                ...session.terminalLayoutsByTabId[args.tabId]?.ptyIdsByLeafId,
-                [args.leafId]: args.ptyId
-              }
+    persistPtyBinding: vi.fn<Store['persistPtyBinding']>(async (input) => {
+      const args = typeof input === 'function' ? input() : input
+      if (!args) {
+        return false
+      }
+      const tabs = session.tabsByWorktree[args.worktreeId] ?? []
+      session = {
+        ...session,
+        tabsByWorktree: {
+          ...session.tabsByWorktree,
+          [args.worktreeId]: tabs.map((tab) =>
+            tab.id === args.tabId ? { ...tab, ptyId: args.ptyId } : tab
+          )
+        },
+        terminalLayoutsByTabId: {
+          ...session.terminalLayoutsByTabId,
+          [args.tabId]: {
+            ...(session.terminalLayoutsByTabId[args.tabId] ?? {
+              root: { type: 'leaf', leafId: args.leafId },
+              activeLeafId: args.leafId,
+              expandedLeafId: null
+            }),
+            ptyIdsByLeafId: {
+              ...session.terminalLayoutsByTabId[args.tabId]?.ptyIdsByLeafId,
+              [args.leafId]: args.ptyId
             }
           }
         }
-        return true
       }
-    )
-  }
+      return true
+    })
+  })
   return { runtimeStore, getSession: () => session, setSession }
 }
 
diff --git a/src/main/runtime/orca-runtime-test-scenario-builders.spec.ts b/src/main/runtime/orca-runtime-test-scenario-builders.spec.ts
index 1f87d901c817..1d63e09c4c7f 100644
--- a/src/main/runtime/orca-runtime-test-scenario-builders.spec.ts
+++ b/src/main/runtime/orca-runtime-test-scenario-builders.spec.ts
@@ -1,3 +1,4 @@
+import { withDurableRuntimeStore } from './runtime-durable-store-fixture'
 import * as mocks from './orca-runtime-test-mocks.spec'
 import type { Mock } from 'vitest'
 
@@ -34,7 +35,7 @@ type MobileCreateTestNotifier = {
   revealTerminalSession: TestMock
   splitTerminal: TestMock
   renameTerminal: TestMock
-  closeTerminal: (tabId: string, paneRuntimeId?: number) => void
+  closeTerminal: (tabId: string, leafId?: string) => void
   closeSessionTab: TestMock
   sleepWorktree: TestMock
   terminalFitOverrideChanged: TestMock
@@ -211,7 +212,7 @@ function makePostRevealWorkerRecoveryHarness(
   }
   const { runtimeStore, getSession } = makeRuntimeStoreWithWorkspaceSession(session)
   const runtime = new OrcaRuntimeService(
-    { ...runtimeStore, flushOrThrow: vi.fn() } as never,
+    withDurableRuntimeStore({ ...runtimeStore, flushOrThrow: vi.fn() }),
     undefined,
     { canRecoverPersistentLocalPtys: () => true }
   )
@@ -326,7 +327,7 @@ function makePendingAgentTabActivationRuntime(opts: { disabledTuiAgents?: string
 
 // Why: the five #7587 mobile-create tests share one notifier factory so interface changes live in one place.
 function createMobileCreateTestNotifier(
-  closeTerminal: (tabId: string, paneRuntimeId?: number) => void
+  closeTerminal: (tabId: string, leafId?: string) => void
 ): MobileCreateTestNotifier {
   return {
     focusTerminal: vi.fn(),
diff --git a/src/main/runtime/orca-runtime-tests/agent-status-and-waits-part-02.spec.ts b/src/main/runtime/orca-runtime-tests/agent-status-and-waits-part-02.spec.ts
index 1fafc4f7a9d1..b7a784e62828 100644
--- a/src/main/runtime/orca-runtime-tests/agent-status-and-waits-part-02.spec.ts
+++ b/src/main/runtime/orca-runtime-tests/agent-status-and-waits-part-02.spec.ts
@@ -357,11 +357,11 @@ describe('OrcaRuntimeService', () => {
 
   it('calls foreground confirmation with its controller receiver', async () => {
     const getForegroundProcess = vi.fn(async () => 'powershell.exe')
-    const confirmForegroundProcess = vi.fn(
-      async function (this: { getForegroundProcess: typeof getForegroundProcess }) {
-        return this.getForegroundProcess === getForegroundProcess ? 'codex' : null
-      }
-    )
+    const confirmForegroundProcess = vi.fn(async function (this: {
+      getForegroundProcess: typeof getForegroundProcess
+    }) {
+      return this.getForegroundProcess === getForegroundProcess ? 'codex' : null
+    })
     const { runtime, handle } = await createExplicitAgentStatusHarness({
       getForegroundProcess,
       confirmForegroundProcess
diff --git a/src/main/runtime/orca-runtime-tests/agent-status-and-waits-part-03.spec.ts b/src/main/runtime/orca-runtime-tests/agent-status-and-waits-part-03.spec.ts
index 2501d0141dda..a1bcdf4b2873 100644
--- a/src/main/runtime/orca-runtime-tests/agent-status-and-waits-part-03.spec.ts
+++ b/src/main/runtime/orca-runtime-tests/agent-status-and-waits-part-03.spec.ts
@@ -85,7 +85,7 @@ describe('OrcaRuntimeService', () => {
       runtime.sendTerminal(
         terminal.handle,
         { text: 'notes', enter: true },
-        { beforeWrite, afterWrite }
+        { inputKind: 'driving', beforeWrite, afterWrite }
       )
     ).rejects.toThrow('terminal_not_writable')
     expect(writes).toEqual(['notes', '\r'])
diff --git a/src/main/runtime/orca-runtime-tests/agent-status-and-waits.spec.ts b/src/main/runtime/orca-runtime-tests/agent-status-and-waits.spec.ts
index 23312f494201..310a1e12c819 100644
--- a/src/main/runtime/orca-runtime-tests/agent-status-and-waits.spec.ts
+++ b/src/main/runtime/orca-runtime-tests/agent-status-and-waits.spec.ts
@@ -150,10 +150,14 @@ describe('OrcaRuntimeService', () => {
       nextCursor: expect.any(String)
     })
 
-    const send = await runtime.sendTerminal(terminal.handle, {
-      text: 'continue',
-      enter: true
-    })
+    const send = await runtime.sendTerminal(
+      terminal.handle,
+      {
+        text: 'continue',
+        enter: true
+      },
+      { inputKind: 'driving' }
+    )
     expect(send).toMatchObject({
       handle: terminal.handle,
       accepted: true
diff --git a/src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-04.spec.ts b/src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-04.spec.ts
index 6f5410e82a88..8b6806aec2b7 100644
--- a/src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-04.spec.ts
+++ b/src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-04.spec.ts
@@ -1,3 +1,4 @@
+import { withDurableRuntimeStore } from '../runtime-durable-store-fixture'
 import { describe, expect, it, vi } from 'vitest'
 import {
   OrcaRuntimeService,
@@ -177,13 +178,15 @@ describe('OrcaRuntimeService', () => {
     const getWorkspaceSession = vi.fn((hostId?: string | null) =>
       hostId === 'ssh:ssh-1' ? sshSession : localSession
     )
-    const runtime = new OrcaRuntimeService({
-      ...store,
-      flushOrThrow: vi.fn(),
-      getRepos: () => [remoteRepo],
-      getRepo: (id: string) => (id === TEST_REPO_ID ? remoteRepo : undefined),
-      getWorkspaceSession
-    } as never)
+    const runtime = new OrcaRuntimeService(
+      withDurableRuntimeStore({
+        ...store,
+        flushOrThrow: vi.fn(),
+        getRepos: () => [remoteRepo],
+        getRepo: (id: string) => (id === TEST_REPO_ID ? remoteRepo : undefined),
+        getWorkspaceSession
+      })
+    )
     runtime.setPtyController({
       write: () => true,
       kill: () => true,
@@ -229,15 +232,17 @@ describe('OrcaRuntimeService', () => {
       sshSession = session
     })
     const kill = vi.fn(() => true)
-    const runtime = new OrcaRuntimeService({
-      ...store,
-      getRepos: () => [remoteRepo],
-      getRepo: (id: string) => (id === TEST_REPO_ID ? remoteRepo : undefined),
-      getWorkspaceSession: (hostId?: string | null) =>
-        hostId === 'ssh:ssh-1' ? sshSession : localSession,
-      setWorkspaceSession,
-      flushOrThrow: vi.fn()
-    } as never)
+    const runtime = new OrcaRuntimeService(
+      withDurableRuntimeStore({
+        ...store,
+        getRepos: () => [remoteRepo],
+        getRepo: (id: string) => (id === TEST_REPO_ID ? remoteRepo : undefined),
+        getWorkspaceSession: (hostId?: string | null) =>
+          hostId === 'ssh:ssh-1' ? sshSession : localSession,
+        setWorkspaceSession,
+        flushOrThrow: vi.fn()
+      })
+    )
     runtime.setPtyController({
       write: () => true,
       kill,
diff --git a/src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-05.spec.ts b/src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-05.spec.ts
index eb2af5c0a1b9..d2861c214003 100644
--- a/src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-05.spec.ts
+++ b/src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-05.spec.ts
@@ -1,3 +1,4 @@
+import { withDurableRuntimeStore } from '../runtime-durable-store-fixture'
 import { describe, expect, it, vi } from 'vitest'
 import { OrcaRuntimeService, electronMocks } from '../orca-runtime-test-mocks.spec'
 import type { RuntimeMobileSessionTabsResult } from '../orca-runtime-test-mocks.spec'
@@ -181,7 +182,7 @@ describe('OrcaRuntimeService', () => {
     })
     events.length = 0
 
-    runtime.onPtyExit('laptop-created-pty', 0)
+    await runtime.onPtyExit('laptop-created-pty', 0)
 
     expect(events).toEqual([
       expect.objectContaining({
@@ -374,7 +375,9 @@ describe('OrcaRuntimeService', () => {
     const acknowledged = makeDeferred()
     const closeTerminalTab = vi.fn(() => acknowledged.promise)
     const kill = vi.fn(() => true)
-    const runtime = new OrcaRuntimeService({ ...runtimeStore, flushOrThrow: vi.fn() } as never)
+    const runtime = new OrcaRuntimeService(
+      withDurableRuntimeStore({ ...runtimeStore, flushOrThrow: vi.fn() })
+    )
     runtime.setNotifier({ closeTerminal: vi.fn(), closeTerminalTab } as never)
     runtime.setPtyController({
       write: () => true,
@@ -510,7 +513,9 @@ describe('OrcaRuntimeService', () => {
       .mockResolvedValueOnce({ id: 'headless-left' })
       .mockResolvedValueOnce({ id: 'headless-right' })
     const kill = vi.fn(() => true)
-    const runtime = new OrcaRuntimeService({ ...runtimeStore, flushOrThrow } as never)
+    const runtime = new OrcaRuntimeService(
+      withDurableRuntimeStore({ ...runtimeStore, flushOrThrow })
+    )
     runtime.setPtyController({
       spawn,
       write: () => true,
diff --git a/src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-08.spec.ts b/src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-08.spec.ts
index 518d6805c5b5..4ac0faf4d586 100644
--- a/src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-08.spec.ts
+++ b/src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-08.spec.ts
@@ -1,3 +1,4 @@
+import { withDurableRuntimeStore } from '../runtime-durable-store-fixture'
 import { describe, expect, it, vi } from 'vitest'
 import type { AgentStatusIpcPayload } from '../../../shared/agent-status-types'
 import { OrcaRuntimeService, electronMocks } from '../orca-runtime-test-mocks.spec'
@@ -442,7 +443,9 @@ describe('OrcaRuntimeService', () => {
     })
     const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
     const closeTerminalTab = vi.fn(async () => {})
-    const runtime = new OrcaRuntimeService({ ...runtimeStore, flushOrThrow } as never)
+    const runtime = new OrcaRuntimeService(
+      withDurableRuntimeStore({ ...runtimeStore, flushOrThrow })
+    )
     runtime.setPtyController({
       write: () => true,
       kill,
diff --git a/src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-10.spec.ts b/src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-10.spec.ts
index b37fa4963d4d..6974a6f7f8f2 100644
--- a/src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-10.spec.ts
+++ b/src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-10.spec.ts
@@ -478,6 +478,7 @@ describe('OrcaRuntimeService', () => {
     )
     const kill = vi.fn(() => true)
     const closeTerminal = vi.fn()
+    const closeTerminalPane = vi.fn()
     const runtime = new OrcaRuntimeService(runtimeStore as never)
     runtime.setPtyController({
       write: () => true,
@@ -485,7 +486,8 @@ describe('OrcaRuntimeService', () => {
       getForegroundProcess: async () => null,
       listProcesses: async () => []
     })
-    runtime.setNotifier({ closeTerminal } as never)
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: these close paths call only the listed notifier methods.
+    runtime.setNotifier({ closeTerminal, closeTerminalPane } as never)
     runtime.syncWindowGraph(1, {
       tabs: [
         {
@@ -524,8 +526,13 @@ describe('OrcaRuntimeService', () => {
     // Exact split leaf: kill only that leaf's PTY, keep the sibling, don't tear down the parent.
     expect(kill).toHaveBeenCalledWith('serve-right')
     expect(kill).not.toHaveBeenCalledWith('serve-left')
+    // Only the leaf-addressed notice for the closed pane; never a whole-tab close.
+    expect(closeTerminalPane).toHaveBeenCalledExactlyOnceWith('host-tab', HEADLESS_SECOND_LEAF_ID)
     expect(closeTerminal).not.toHaveBeenCalled()
     expect(getSession().tabsByWorktree[TEST_WORKTREE_ID]).toHaveLength(1)
-    expect(getSession().terminalLayoutsByTabId['host-tab']).toBeDefined()
+    expect(getSession().terminalLayoutsByTabId['host-tab']?.root).toEqual({
+      type: 'leaf',
+      leafId: HEADLESS_LEAF_ID
+    })
   })
 })
diff --git a/src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-11.spec.ts b/src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-11.spec.ts
index 81d78d4e3088..88c988929f77 100644
--- a/src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-11.spec.ts
+++ b/src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-11.spec.ts
@@ -409,7 +409,7 @@ describe('OrcaRuntimeService', () => {
       // republish would re-add the dead leaf on the echoing client and feed a
       // refuse→republish→re-echo loop.
       const { runtime, getSession, kill, closeTerminal } = makeSplitLeafRuntime()
-      runtime.onPtyExit('serve-right', 0)
+      await runtime.onPtyExit('serve-right', 0)
       const events: { worktree: string }[] = []
       const unsubscribe = runtime.onMobileSessionTabsChanged((snapshot) => events.push(snapshot))
 
diff --git a/src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-13.spec.ts b/src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-13.spec.ts
index 27421489abac..a47f037d40e8 100644
--- a/src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-13.spec.ts
+++ b/src/main/runtime/orca-runtime-tests/mobile-session-tabs-part-13.spec.ts
@@ -602,7 +602,7 @@ describe('OrcaRuntimeService', () => {
       expect(write).toHaveBeenCalledTimes(2)
       expect(write.mock.calls[0][0]).toBe('pty-bare')
       expect(String(write.mock.calls[0][1])).toMatch(/codex/)
-      expect(write.mock.calls[1]).toEqual(['pty-bare', '\r'])
+      expect(write.mock.calls[1]).toEqual(['pty-bare', '\r', 'launch'])
     } finally {
       vi.useRealTimers()
     }
diff --git a/src/main/runtime/orca-runtime-tests/mobile-session-tabs.spec.ts b/src/main/runtime/orca-runtime-tests/mobile-session-tabs.spec.ts
index c3000e90bd29..fe8f7e08fab4 100644
--- a/src/main/runtime/orca-runtime-tests/mobile-session-tabs.spec.ts
+++ b/src/main/runtime/orca-runtime-tests/mobile-session-tabs.spec.ts
@@ -235,6 +235,7 @@ describe('OrcaRuntimeService', () => {
 
   it('closes the matching mobile terminal UUID leaf without closing the whole tab', async () => {
     const closeTerminal = vi.fn()
+    const closeTerminalPane = vi.fn()
     const kill = vi.fn(() => true)
     const runtime = new OrcaRuntimeService(store)
     runtime.setPtyController({
@@ -253,6 +254,7 @@ describe('OrcaRuntimeService', () => {
       renameTerminal: vi.fn(),
       focusTerminal: vi.fn(),
       closeTerminal,
+      closeTerminalPane,
       sleepWorktree: vi.fn(),
       terminalFitOverrideChanged: vi.fn(),
       terminalDriverChanged: vi.fn()
@@ -313,6 +315,8 @@ describe('OrcaRuntimeService', () => {
     await runtime.closeMobileSessionTab(`id:${TEST_WORKTREE_ID}`, `tab-1::${rightLeafId}`)
 
     expect(kill).toHaveBeenCalledWith('pty-right')
+    // Only the leaf-addressed notice for the closed pane; never a whole-tab close.
+    expect(closeTerminalPane).toHaveBeenCalledExactlyOnceWith('tab-1', rightLeafId)
     expect(closeTerminal).not.toHaveBeenCalled()
   })
 
diff --git a/src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-05.spec.ts b/src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-05.spec.ts
index 591f4e7ca977..2aba44299f2f 100644
--- a/src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-05.spec.ts
+++ b/src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-05.spec.ts
@@ -333,7 +333,7 @@ describe('OrcaRuntimeService', () => {
     await vi.waitFor(() => expect(spawn).toHaveBeenCalledOnce())
 
     setSession(getDefaultWorkspaceSession())
-    runtimeStore.persistPtyBinding.mockReturnValue(false)
+    runtimeStore.persistPtyBinding.mockResolvedValue(false)
     resolveSpawn({ id: 'rejected-split-pty' })
 
     await expect(split).rejects.toThrow('terminal_split_source_not_found')
diff --git a/src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts b/src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts
index 9145bea46f60..d90dc63031b2 100644
--- a/src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts
+++ b/src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-07.spec.ts
@@ -467,7 +467,7 @@ describe('OrcaRuntimeService', () => {
     })
     const { handle } = await runtime.createTerminal(`path:${TEST_WORKTREE_PATH}`)
 
-    await runtime.sendTerminal(handle, { text: 'continue', enter: true })
+    await runtime.sendTerminal(handle, { text: 'continue', enter: true }, { inputKind: 'driving' })
 
     expect(writes).toEqual(['continue', '\r'])
   })
@@ -490,7 +490,7 @@ describe('OrcaRuntimeService', () => {
       const { handle } = await runtime.createTerminal(`path:${TEST_WORKTREE_PATH}`)
       const prompt = 'line one\nline two\x1b[201~'
 
-      const sendPromise = runtime.sendTerminalAgentPrompt(handle, prompt)
+      const sendPromise = runtime.sendTerminalAgentPrompt(handle, prompt, { inputKind: 'driving' })
       await vi.runAllTimersAsync()
       const result = await sendPromise
 
@@ -535,6 +535,7 @@ describe('OrcaRuntimeService', () => {
       )
 
       const sendPromise = runtime.sendTerminalAgentPrompt(handle, 'the brief', {
+        inputKind: 'driving',
         leadLine: ORCA_DISPATCH_PROMPT_LEAD_LINE
       })
       await vi.runAllTimersAsync()
@@ -601,6 +602,7 @@ describe('OrcaRuntimeService', () => {
         const assertAuthority = vi.fn()
 
         const sendPromise = runtime.sendTerminalAgentPrompt(handle, 'review this change', {
+          inputKind: 'driving',
           beforeWrite: assertAuthority
         })
         await vi.advanceTimersByTimeAsync(500)
@@ -659,7 +661,9 @@ describe('OrcaRuntimeService', () => {
         'review this change',
         agent
       )
-      const sendPromise = runtime.sendTerminalAgentPrompt(handle, 'review this change')
+      const sendPromise = runtime.sendTerminalAgentPrompt(handle, 'review this change', {
+        inputKind: 'driving'
+      })
       if (agent === 'omp') {
         await sendPromise
         expect(writes).toEqual([`${buildAgentPromptPasteBytes('review this change')}\r`])
diff --git a/src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts b/src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts
index 8b27ce9bb5da..fe3687aab0a7 100644
--- a/src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts
+++ b/src/main/runtime/orca-runtime-tests/terminal-creation-and-readiness-part-08.spec.ts
@@ -44,7 +44,9 @@ describe('OrcaRuntimeService', () => {
       const { handle } = await runtime.createTerminal(`path:${TEST_WORKTREE_PATH}`)
 
       await expect(runtime.isTerminalRunningSettledPromptAgent(handle)).resolves.toBe(true)
-      const sendPromise = runtime.sendTerminalAgentPrompt(handle, 'review this change')
+      const sendPromise = runtime.sendTerminalAgentPrompt(handle, 'review this change', {
+        inputKind: 'driving'
+      })
       await vi.advanceTimersByTimeAsync(1_199)
       expect(writes).not.toContain('\r')
       await vi.advanceTimersByTimeAsync(1_500)
@@ -78,7 +80,9 @@ describe('OrcaRuntimeService', () => {
         launchAgent: 'claude'
       })
 
-      const sendPromise = runtime.sendTerminalAgentPrompt(handle, 'review this change')
+      const sendPromise = runtime.sendTerminalAgentPrompt(handle, 'review this change', {
+        inputKind: 'driving'
+      })
       await vi.advanceTimersByTimeAsync(renderGateCapMs('review this change') - 1)
       expect(writes).not.toContain('\r')
 
@@ -117,7 +121,9 @@ describe('OrcaRuntimeService', () => {
         launchAgent: 'codex'
       })
 
-      const sendPromise = runtime.sendTerminalAgentPrompt(handle, 'review this change')
+      const sendPromise = runtime.sendTerminalAgentPrompt(handle, 'review this change', {
+        inputKind: 'driving'
+      })
       await vi.advanceTimersByTimeAsync(8_000)
       expect(writes).not.toContain('\r')
       await vi.advanceTimersByTimeAsync(1_599)
@@ -159,7 +165,9 @@ describe('OrcaRuntimeService', () => {
         launchAgent: 'claude'
       })
 
-      const sendPromise = runtime.sendTerminalAgentPrompt(handle, 'review this change')
+      const sendPromise = runtime.sendTerminalAgentPrompt(handle, 'review this change', {
+        inputKind: 'driving'
+      })
       // The marker at 100 ms re-arms the cap, but the ingest term is absolute: a prompt this
       // small is already ingested by then, so the fallback is one flat render timeout later.
       await vi.advanceTimersByTimeAsync(100 + 8_000 - 1)
@@ -193,7 +201,7 @@ describe('OrcaRuntimeService', () => {
       })
       const prompt = `${'x'.repeat(TERMINAL_INPUT_CHUNK_MAX_BYTES)}\ntail`
 
-      const sendPromise = runtime.sendTerminalAgentPrompt(handle, prompt)
+      const sendPromise = runtime.sendTerminalAgentPrompt(handle, prompt, { inputKind: 'driving' })
       await vi.runAllTimersAsync()
       const result = await sendPromise
 
@@ -230,7 +238,7 @@ describe('OrcaRuntimeService', () => {
       })
       const prompt = 'x'.repeat(TERMINAL_INPUT_CHUNK_MAX_BYTES + 1)
 
-      const sendPromise = runtime.sendTerminalAgentPrompt(handle, prompt)
+      const sendPromise = runtime.sendTerminalAgentPrompt(handle, prompt, { inputKind: 'driving' })
       const sendRejection = expect(sendPromise).rejects.toThrow('terminal_not_writable')
       await vi.runAllTimersAsync()
 
@@ -258,7 +266,7 @@ describe('OrcaRuntimeService', () => {
     const { handle } = await runtime.createTerminal(`path:${TEST_WORKTREE_PATH}`)
     const text = ['x'.repeat(TERMINAL_INPUT_CHUNK_MAX_BYTES), 'tail'].join('')
 
-    const result = await runtime.sendTerminal(handle, { text })
+    const result = await runtime.sendTerminal(handle, { text }, { inputKind: 'driving' })
 
     expect(result).toMatchObject({
       handle,
@@ -285,7 +293,7 @@ describe('OrcaRuntimeService', () => {
       const { handle } = await runtime.createTerminal(`path:${TEST_WORKTREE_PATH}`)
 
       const text = `${'x'.repeat(TERMINAL_INPUT_CHUNK_MAX_BYTES)}\nline two\nline three`
-      await runtime.sendTerminal(handle, { text, enter: true })
+      await runtime.sendTerminal(handle, { text, enter: true }, { inputKind: 'driving' })
 
       expect(writes.at(-1)).toBe('\r')
       expect(writes.slice(0, -1).join('')).toBe(text)
@@ -312,7 +320,7 @@ describe('OrcaRuntimeService', () => {
 
     vi.useFakeTimers()
     try {
-      const sendPromise = runtime.sendTerminal(handle, { text })
+      const sendPromise = runtime.sendTerminal(handle, { text }, { inputKind: 'driving' })
 
       expect(writes).toEqual([])
 
@@ -346,7 +354,11 @@ describe('OrcaRuntimeService', () => {
     const { handle } = await runtime.createTerminal(`path:${TEST_WORKTREE_PATH}`)
 
     await expect(
-      runtime.sendTerminal(handle, { text: 'x'.repeat(TERMINAL_INPUT_MAX_BYTES + 1) })
+      runtime.sendTerminal(
+        handle,
+        { text: 'x'.repeat(TERMINAL_INPUT_MAX_BYTES + 1) },
+        { inputKind: 'driving' }
+      )
     ).rejects.toThrow(TERMINAL_INPUT_TOO_LARGE_ERROR)
     expect(writes).toEqual([])
   })
diff --git a/src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts b/src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts
index 237afc57bc96..be454a5bde84 100644
--- a/src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts
+++ b/src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status-part-02.spec.ts
@@ -142,7 +142,7 @@ describe('OrcaRuntimeService', () => {
     syncSinglePty(runtime, 'pty-1', { paneTitle: 'claude agents' })
     const [terminal] = (await runtime.listTerminals()).terminals
 
-    expect(runtime.getAgentStatusForHandle(terminal.handle)).toBeNull()
+    await expect(runtime.getAgentStatusForHandle(terminal.handle)).resolves.toBeNull()
   })
 
   it('lists live terminals with fresh pane titles over stale tab titles', async () => {
diff --git a/src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status.spec.ts b/src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status.spec.ts
index e85aeb461c68..e122effd17dd 100644
--- a/src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status.spec.ts
+++ b/src/main/runtime/orca-runtime-tests/terminal-handles-and-agent-status.spec.ts
@@ -1,3 +1,4 @@
+import { withDurableRuntimeStore } from '../runtime-durable-store-fixture'
 import { describe, expect, it, vi } from 'vitest'
 import {
   OrcaRuntimeService,
@@ -20,7 +21,9 @@ describe('OrcaRuntimeService', () => {
       ...getDefaultWorkspaceSession(),
       tabsByWorktree: { [TEST_WORKTREE_ID]: [] }
     })
-    const runtime = new OrcaRuntimeService({ ...runtimeStore, flushOrThrow: vi.fn() } as never)
+    const runtime = new OrcaRuntimeService(
+      withDurableRuntimeStore({ ...runtimeStore, flushOrThrow: vi.fn() })
+    )
     let process = {
       id: 'reused-pty-id',
       incarnationId: 'inc-old',
@@ -66,7 +69,9 @@ describe('OrcaRuntimeService', () => {
       ...getDefaultWorkspaceSession(),
       tabsByWorktree: { [TEST_WORKTREE_ID]: [] }
     })
-    const runtime = new OrcaRuntimeService({ ...runtimeStore, flushOrThrow: vi.fn() } as never)
+    const runtime = new OrcaRuntimeService(
+      withDurableRuntimeStore({ ...runtimeStore, flushOrThrow: vi.fn() })
+    )
     runtime.syncWindowGraph(1, {
       tabs: [
         {
@@ -156,7 +161,9 @@ describe('OrcaRuntimeService', () => {
         [`duplicate-b:${HEADLESS_SECOND_LEAF_ID}`]: 'inc-duplicate'
       }
     })
-    const runtime = new OrcaRuntimeService({ ...runtimeStore, flushOrThrow: vi.fn() } as never)
+    const runtime = new OrcaRuntimeService(
+      withDurableRuntimeStore({ ...runtimeStore, flushOrThrow: vi.fn() })
+    )
     runtime.setPtyController({
       write: () => true,
       kill: () => true,
@@ -223,7 +230,7 @@ describe('OrcaRuntimeService', () => {
     expect(new Set(handles).size).toBe(handles.length)
 
     await expect(
-      runtime.sendTerminal('term_victim', { text: 'for victim' })
+      runtime.sendTerminal('term_victim', { text: 'for victim' }, { inputKind: 'driving' })
     ).resolves.toMatchObject({ accepted: true })
     expect(writesByPty.get('pty-victim')).toEqual(['for victim'])
     expect(writesByPty.has('pty-imposter')).toBe(false)
@@ -253,7 +260,7 @@ describe('OrcaRuntimeService', () => {
     const listed = await runtime.listTerminals()
     expect(listed.terminals[0]?.handle).toBe('term_already_bound')
     await expect(
-      runtime.sendTerminal('term_already_bound', { text: 'still routed' })
+      runtime.sendTerminal('term_already_bound', { text: 'still routed' }, { inputKind: 'driving' })
     ).resolves.toMatchObject({ accepted: true })
     expect(writes).toEqual(['still routed'])
     // the reported-but-not-adopted handle must not resolve to the live pty
@@ -340,7 +347,9 @@ describe('OrcaRuntimeService', () => {
       handle,
       tail: ['after unavailable']
     })
-    await expect(runtime.sendTerminal(handle, { text: 'still writable' })).resolves.toMatchObject({
+    await expect(
+      runtime.sendTerminal(handle, { text: 'still writable' }, { inputKind: 'driving' })
+    ).resolves.toMatchObject({
       handle,
       accepted: true
     })
diff --git a/src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-02.spec.ts b/src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-02.spec.ts
index ecf2ab53678e..dffd6e971eb7 100644
--- a/src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-02.spec.ts
+++ b/src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-02.spec.ts
@@ -1,3 +1,4 @@
+import { withDurableRuntimeStore } from '../runtime-durable-store-fixture'
 import { describe, expect, it, vi } from 'vitest'
 import {
   OrcaRuntimeService,
@@ -53,7 +54,7 @@ describe('OrcaRuntimeService', () => {
       tail: ['after restart']
     })
     await expect(
-      runtime.sendTerminal('term_exported', { text: 'still writable' })
+      runtime.sendTerminal('term_exported', { text: 'still writable' }, { inputKind: 'driving' })
     ).resolves.toMatchObject({
       handle: 'term_exported',
       accepted: true
@@ -76,7 +77,9 @@ describe('OrcaRuntimeService', () => {
       ['pty-setup', 'inc-setup', 'term_setup', 'Setup'],
       ['pty-shell', 'inc-shell', 'term_shell', 'Shell']
     ] as const
-    const runtime = new OrcaRuntimeService({ ...runtimeStore, flushOrThrow: vi.fn() } as never)
+    const runtime = new OrcaRuntimeService(
+      withDurableRuntimeStore({ ...runtimeStore, flushOrThrow: vi.fn() })
+    )
     const listProcesses = vi.fn(async () =>
       processes.map(([id, incarnationId, terminalHandle, title]) => ({
         id,
@@ -176,7 +179,7 @@ describe('OrcaRuntimeService', () => {
     ])
     expect(getSession().terminalTopologyRevisionByRepoId?.[TEST_REPO_ID]).toBe(1)
 
-    await runtime.sendTerminal('term_agent', { text: 'input' })
+    await runtime.sendTerminal('term_agent', { text: 'input' }, { inputKind: 'driving' })
     await runtime.updateRemoteDesktopViewer('pty-agent', 'viewer', 'client', 132, 41)
     expect(writes).toEqual([['pty-agent', 'input']])
     expect(resize).toHaveBeenCalledWith('pty-agent', 132, 41)
@@ -247,13 +250,15 @@ describe('OrcaRuntimeService', () => {
     const { runtimeStore, getSession, setSession } = makeRuntimeStoreWithWorkspaceSession(session)
     const durableWrite = deferred<void>()
     const durableWriteStarted = deferred<void>()
-    const runtime = new OrcaRuntimeService({
-      ...runtimeStore,
-      flushPendingOrThrowAsync: vi.fn(() => {
-        durableWriteStarted.resolve()
-        return durableWrite.promise
+    const runtime = new OrcaRuntimeService(
+      withDurableRuntimeStore({
+        ...runtimeStore,
+        flushPendingOrThrowAsync: vi.fn(() => {
+          durableWriteStarted.resolve()
+          return durableWrite.promise
+        })
       })
-    } as never)
+    )
     runtime.setPtyController({
       write: vi.fn(() => true),
       kill: vi.fn(() => true),
@@ -332,10 +337,12 @@ describe('OrcaRuntimeService', () => {
         wslDistro: null
       }
     ])
-    const runtime = new OrcaRuntimeService({
-      ...runtimeStore,
-      flushPendingOrThrowAsync
-    } as never)
+    const runtime = new OrcaRuntimeService(
+      withDurableRuntimeStore({
+        ...runtimeStore,
+        flushPendingOrThrowAsync
+      })
+    )
     runtime.setPtyController({
       write: vi.fn(() => true),
       kill: vi.fn(() => true),
@@ -447,13 +454,17 @@ describe('OrcaRuntimeService', () => {
     }
     const { runtimeStore, getSession } = makeRuntimeStoreWithWorkspaceSession(session)
     const flushOrThrow = vi.fn()
-    const runtime = new OrcaRuntimeService({ ...runtimeStore, flushOrThrow } as never, undefined, {
-      canRecoverPersistentLocalPtys: () => true,
-      attestAgentHookCompatibilityAuthority: ({ paneKey, launchTokenHash }) =>
-        paneKey === workerPaneKey && launchTokenHash === RESTORED_AUTHORITY_TOKEN_HASH
-          ? { paneKey, source: 'hydrated_commitment' }
-          : null
-    })
+    const runtime = new OrcaRuntimeService(
+      withDurableRuntimeStore({ ...runtimeStore, flushOrThrow }),
+      undefined,
+      {
+        canRecoverPersistentLocalPtys: () => true,
+        attestAgentHookCompatibilityAuthority: ({ paneKey, launchTokenHash }) =>
+          paneKey === workerPaneKey && launchTokenHash === RESTORED_AUTHORITY_TOKEN_HASH
+            ? { paneKey, source: 'hydrated_commitment' }
+            : null
+      }
+    )
     runtime.setOrchestrationDb({
       getActiveDispatchForTerminal: () => undefined,
       listLegacyWorkerTerminalRecoveryRows: () => [
@@ -598,7 +609,10 @@ describe('OrcaRuntimeService', () => {
       condition: 'tui-idle',
       timeoutMs: 50
     })
-    await vi.waitFor(() => expect(serializeProviderBuffer).toHaveBeenCalledTimes(4))
+    // The probe's read starts a microtask late; a 50 ms poll would race the wait's 50 ms timeout.
+    await vi.waitFor(() => expect(serializeProviderBuffer).toHaveBeenCalledTimes(4), {
+      interval: 1
+    })
     runtime.onPtyData('pty-legacy', '\x1b[H', Date.now())
     lateReadySnapshot.resolve({
       data: READY_SCREEN,
diff --git a/src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts b/src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts
index 00a083108775..51edcad7373c 100644
--- a/src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts
+++ b/src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec.ts
@@ -1,3 +1,4 @@
+import { withDurableRuntimeStore } from '../runtime-durable-store-fixture'
 import { describe, expect, it, vi } from 'vitest'
 import { OrcaRuntimeService, getDefaultWorkspaceSession } from '../orca-runtime-test-mocks.spec'
 import type { OrchestrationDb } from '../orchestration/db'
@@ -40,7 +41,7 @@ describe('OrcaRuntimeService', () => {
     }
     const { runtimeStore, getSession } = makeRuntimeStoreWithWorkspaceSession(session)
     const runtime = new OrcaRuntimeService(
-      { ...runtimeStore, flushOrThrow: vi.fn() } as never,
+      withDurableRuntimeStore({ ...runtimeStore, flushOrThrow: vi.fn() }),
       undefined,
       { canRecoverPersistentLocalPtys: () => true }
     )
@@ -451,7 +452,7 @@ describe('OrcaRuntimeService', () => {
       return durableWrite.promise
     })
     const runtime = new OrcaRuntimeService(
-      { ...runtimeStore, flushPendingOrThrowAsync } as never,
+      withDurableRuntimeStore({ ...runtimeStore, flushPendingOrThrowAsync }),
       undefined,
       { canRecoverPersistentLocalPtys: () => true }
     )
diff --git a/src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts b/src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts
index ea70b730388f..6c4390893963 100644
--- a/src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts
+++ b/src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-04.spec.ts
@@ -1,3 +1,4 @@
+import { withDurableRuntimeStore } from '../runtime-durable-store-fixture'
 import { describe, expect, it, vi } from 'vitest'
 import {
   OrcaRuntimeService,
@@ -50,7 +51,7 @@ describe('OrcaRuntimeService', () => {
       throw new Error('synchronous persistence must not run')
     })
     const runtime = new OrcaRuntimeService(
-      { ...runtimeStore, flushOrThrow, flushPendingOrThrowAsync } as never,
+      withDurableRuntimeStore({ ...runtimeStore, flushOrThrow, flushPendingOrThrowAsync }),
       undefined,
       { canRecoverPersistentLocalPtys: () => true }
     )
@@ -160,7 +161,7 @@ describe('OrcaRuntimeService', () => {
       return retryDurableWrite.promise
     })
     const runtime = new OrcaRuntimeService(
-      { ...runtimeStore, flushPendingOrThrowAsync } as never,
+      withDurableRuntimeStore({ ...runtimeStore, flushPendingOrThrowAsync }),
       undefined,
       { canRecoverPersistentLocalPtys: () => true }
     )
@@ -272,7 +273,7 @@ describe('OrcaRuntimeService', () => {
     }
     const { runtimeStore, getSession } = makeRuntimeStoreWithWorkspaceSession(session)
     const runtime = new OrcaRuntimeService(
-      { ...runtimeStore, flushOrThrow: vi.fn() } as never,
+      withDurableRuntimeStore({ ...runtimeStore, flushOrThrow: vi.fn() }),
       undefined,
       { canRecoverPersistentLocalPtys: () => true }
     )
@@ -383,7 +384,7 @@ describe('OrcaRuntimeService', () => {
     }
     const { runtimeStore, getSession } = makeRuntimeStoreWithWorkspaceSession(session)
     const runtime = new OrcaRuntimeService(
-      { ...runtimeStore, flushOrThrow: vi.fn() } as never,
+      withDurableRuntimeStore({ ...runtimeStore, flushOrThrow: vi.fn() }),
       undefined,
       { canRecoverPersistentLocalPtys: () => true }
     )
diff --git a/src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-05.spec.ts b/src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-05.spec.ts
index 389c70d4f42f..756f87611f62 100644
--- a/src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-05.spec.ts
+++ b/src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-05.spec.ts
@@ -1,3 +1,4 @@
+import { withDurableRuntimeStore } from '../runtime-durable-store-fixture'
 import { describe, expect, it, vi } from 'vitest'
 import {
   OrcaRuntimeService,
@@ -74,7 +75,7 @@ describe('OrcaRuntimeService', () => {
     }
     const { runtimeStore, getSession } = makeRuntimeStoreWithWorkspaceSession(session)
     const runtime = new OrcaRuntimeService(
-      { ...runtimeStore, flushOrThrow: vi.fn() } as never,
+      withDurableRuntimeStore({ ...runtimeStore, flushOrThrow: vi.fn() }),
       undefined,
       { canRecoverPersistentLocalPtys: () => true }
     )
@@ -187,12 +188,12 @@ describe('OrcaRuntimeService', () => {
     const folderWorkspace = makeFolderWorkspace({ folderPath })
     const projectGroup = makeFolderProjectGroup({ parentPath: folderPath })
     const runtime = new OrcaRuntimeService(
-      {
+      withDurableRuntimeStore({
         ...runtimeStore,
         getFolderWorkspaces: () => [folderWorkspace],
         getProjectGroups: () => [projectGroup],
         flushOrThrow: vi.fn()
-      } as never,
+      }),
       undefined,
       { canRecoverPersistentLocalPtys: () => true }
     )
@@ -313,14 +314,14 @@ describe('OrcaRuntimeService', () => {
     const folderWorkspace = makeFolderWorkspace({ folderPath, connectionId })
     const projectGroup = makeFolderProjectGroup({ parentPath: folderPath })
     const runtime = new OrcaRuntimeService(
-      {
+      withDurableRuntimeStore({
         ...runtimeStore,
         getFolderWorkspaces: () => [folderWorkspace],
         getProjectGroups: () => [projectGroup],
         getWorkspaceSession,
         setWorkspaceSession,
         flushOrThrow: vi.fn()
-      } as never,
+      }),
       undefined,
       { canRecoverPersistentLocalPtys: () => true }
     )
diff --git a/src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-06.spec.ts b/src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-06.spec.ts
index 1907b2bb4500..2100c708043a 100644
--- a/src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-06.spec.ts
+++ b/src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-06.spec.ts
@@ -1,3 +1,4 @@
+import { withDurableRuntimeStore } from '../runtime-durable-store-fixture'
 import { describe, expect, it, vi } from 'vitest'
 import {
   OrcaRuntimeService,
@@ -83,14 +84,14 @@ describe('OrcaRuntimeService', () => {
       rows: 24
     })
     const runtime = new OrcaRuntimeService(
-      {
+      withDurableRuntimeStore({
         ...runtimeStore,
         getRepos: () => [remoteRepo],
         getRepo: (id: string) => (id === TEST_REPO_ID ? remoteRepo : undefined),
         getWorkspaceSession,
         setWorkspaceSession,
         flushOrThrow: vi.fn()
-      } as never,
+      }),
       undefined,
       { canRecoverPersistentLocalPtys: () => true }
     )
@@ -220,7 +221,7 @@ describe('OrcaRuntimeService', () => {
     }
     const { runtimeStore, getSession } = makeRuntimeStoreWithWorkspaceSession(session)
     const runtime = new OrcaRuntimeService(
-      {
+      withDurableRuntimeStore({
         ...runtimeStore,
         getProjects: () => [
           {
@@ -228,17 +229,17 @@ describe('OrcaRuntimeService', () => {
             displayName: 'repo',
             badgeColor: 'blue',
             sourceRepoIds: [TEST_REPO_ID],
-            localWindowsRuntimePreference: { kind: 'wsl', distro: 'Ubuntu' },
+            localWindowsRuntimePreference: { kind: 'wsl' as const, distro: 'Ubuntu' },
             createdAt: 0,
             updatedAt: 0
           }
         ],
         getSettings: () => ({
           ...store.getSettings(),
-          localWindowsRuntimeDefault: { kind: 'windows-host' }
+          localWindowsRuntimeDefault: { kind: 'windows-host' as const }
         }),
         flushOrThrow: vi.fn()
-      } as never,
+      }),
       undefined,
       { canRecoverPersistentLocalPtys: () => true }
     )
@@ -353,7 +354,9 @@ describe('OrcaRuntimeService', () => {
       }
     }
     const { runtimeStore, getSession } = makeRuntimeStoreWithWorkspaceSession(session)
-    const runtime = new OrcaRuntimeService({ ...runtimeStore, flushOrThrow: vi.fn() } as never)
+    const runtime = new OrcaRuntimeService(
+      withDurableRuntimeStore({ ...runtimeStore, flushOrThrow: vi.fn() })
+    )
     runtime.setPtyController({
       write: () => true,
       kill: () => true,
@@ -524,7 +527,9 @@ describe('OrcaRuntimeService', () => {
       }
     }
     const { runtimeStore, getSession } = makeRuntimeStoreWithWorkspaceSession(session)
-    const runtime = new OrcaRuntimeService({ ...runtimeStore, flushOrThrow: vi.fn() } as never)
+    const runtime = new OrcaRuntimeService(
+      withDurableRuntimeStore({ ...runtimeStore, flushOrThrow: vi.fn() })
+    )
     runtime.setPtyController({
       write: () => true,
       kill: () => true,
diff --git a/src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-07.spec.ts b/src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-07.spec.ts
index 79bdf13909e1..4f89b097cbbe 100644
--- a/src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-07.spec.ts
+++ b/src/main/runtime/orca-runtime-tests/terminal-output-and-worker-recovery-part-07.spec.ts
@@ -1,3 +1,4 @@
+import { withDurableRuntimeStore } from '../runtime-durable-store-fixture'
 import { describe, expect, it, vi } from 'vitest'
 import { OrcaRuntimeService, getDefaultWorkspaceSession } from '../orca-runtime-test-mocks.spec'
 import {
@@ -64,7 +65,7 @@ describe('OrcaRuntimeService', () => {
     const afterRestart = await restarted.listMobileSessionTabs(`id:${TEST_WORKTREE_ID}`)
     const listed = await restarted.listTerminals(`id:${TEST_WORKTREE_ID}`)
     restarted.onPtyData('persisted-pty', 'after restart\n', 1)
-    await restarted.sendTerminal('term_current', { text: 'input' })
+    await restarted.sendTerminal('term_current', { text: 'input' }, { inputKind: 'driving' })
     await restarted.updateRemoteDesktopViewer('persisted-pty', 'viewer', 'client', 132, 41)
 
     expect(beforeRestart.tabs[0]).toMatchObject({
@@ -108,7 +109,9 @@ describe('OrcaRuntimeService', () => {
       terminalTopologyRevisionByRepoId: { [TEST_REPO_ID]: 7 }
     }
     const { runtimeStore } = makeRuntimeStoreWithWorkspaceSession(session)
-    const runtime = new OrcaRuntimeService({ ...runtimeStore, flushOrThrow: vi.fn() } as never)
+    const runtime = new OrcaRuntimeService(
+      withDurableRuntimeStore({ ...runtimeStore, flushOrThrow: vi.fn() })
+    )
     runtime.setPtyController({
       write: () => true,
       kill: () => true,
@@ -148,7 +151,9 @@ describe('OrcaRuntimeService', () => {
       ...getDefaultWorkspaceSession(),
       tabsByWorktree: { [TEST_WORKTREE_ID]: [] }
     })
-    const runtime = new OrcaRuntimeService({ ...runtimeStore, flushOrThrow: vi.fn() } as never)
+    const runtime = new OrcaRuntimeService(
+      withDurableRuntimeStore({ ...runtimeStore, flushOrThrow: vi.fn() })
+    )
     const writes: [string, string][] = []
     runtime.setPtyController({
       write: (ptyId: string, data: string) => {
@@ -178,7 +183,9 @@ describe('OrcaRuntimeService', () => {
 
     const shown = await runtime.showTerminal(entry!.handle)
     expect(shown.writable).toBe(true)
-    await expect(runtime.sendTerminal(entry!.handle, { text: 'hi' })).resolves.toMatchObject({
+    await expect(
+      runtime.sendTerminal(entry!.handle, { text: 'hi' }, { inputKind: 'driving' })
+    ).resolves.toMatchObject({
       accepted: true
     })
     expect(writes).toEqual([['pty-orphan', 'hi']])
@@ -190,7 +197,9 @@ describe('OrcaRuntimeService', () => {
         ...getDefaultWorkspaceSession(),
         tabsByWorktree: { [TEST_WORKTREE_ID]: [] }
       })
-      return new OrcaRuntimeService({ ...runtimeStore, flushOrThrow: vi.fn() } as never)
+      return new OrcaRuntimeService(
+        withDurableRuntimeStore({ ...runtimeStore, flushOrThrow: vi.fn() })
+      )
     }
     const ownerMismatch = makeRuntime()
     ownerMismatch.registerPty('pty-wrong-owner', TEST_WORKTREE_ID, 'ssh-other-host')
@@ -282,25 +291,27 @@ describe('OrcaRuntimeService', () => {
           ...getDefaultWorkspaceSession(),
           tabsByWorktree: { [TEST_WORKTREE_ID]: [] }
         })
-        const wsl = new OrcaRuntimeService({
-          ...runtimeStore,
-          flushOrThrow: vi.fn(),
-          getProjects: () => [
-            {
-              id: 'project-wsl',
-              displayName: 'WSL',
-              badgeColor: 'blue',
-              sourceRepoIds: [TEST_REPO_ID],
-              localWindowsRuntimePreference: { kind: 'wsl', distro: 'Ubuntu' },
-              createdAt: 1,
-              updatedAt: 1
-            }
-          ],
-          getSettings: () => ({
-            ...store.getSettings(),
-            localWindowsRuntimeDefault: { kind: 'windows-host' }
+        const wsl = new OrcaRuntimeService(
+          withDurableRuntimeStore({
+            ...runtimeStore,
+            flushOrThrow: vi.fn(),
+            getProjects: () => [
+              {
+                id: 'project-wsl',
+                displayName: 'WSL',
+                badgeColor: 'blue',
+                sourceRepoIds: [TEST_REPO_ID],
+                localWindowsRuntimePreference: { kind: 'wsl' as const, distro: 'Ubuntu' },
+                createdAt: 1,
+                updatedAt: 1
+              }
+            ],
+            getSettings: () => ({
+              ...store.getSettings(),
+              localWindowsRuntimeDefault: { kind: 'windows-host' as const }
+            })
           })
-        } as never)
+        )
         wsl.registerPty('pty-wsl', TEST_WORKTREE_ID, null, undefined, true)
         wsl.onPtySpawned('pty-wsl', 'inc-wsl', { awaitsRegistration: false })
         wsl.setPtyController({
@@ -356,7 +367,9 @@ describe('OrcaRuntimeService', () => {
       tabsByWorktree: { [TEST_WORKTREE_ID]: [] }
     }
     const { runtimeStore, getSession } = makeRuntimeStoreWithWorkspaceSession(session)
-    const runtime = new OrcaRuntimeService({ ...runtimeStore, flushOrThrow: vi.fn() } as never)
+    const runtime = new OrcaRuntimeService(
+      withDurableRuntimeStore({ ...runtimeStore, flushOrThrow: vi.fn() })
+    )
     const processes = [
       ['pty-left', 'inc-left', 'term_left'],
       ['pty-right', 'inc-right', 'term_right'],
diff --git a/src/main/runtime/orca-runtime-tests/terminal-spawn-dispatch.spec.ts b/src/main/runtime/orca-runtime-tests/terminal-spawn-dispatch.spec.ts
new file mode 100644
index 000000000000..ff3401997705
--- /dev/null
+++ b/src/main/runtime/orca-runtime-tests/terminal-spawn-dispatch.spec.ts
@@ -0,0 +1,70 @@
+import { describe, expect, it, vi } from 'vitest'
+import { OrcaRuntimeService } from '../orca-runtime-test-mocks.spec'
+import { TEST_WORKTREE_PATH, store } from '../orca-runtime-test-fixtures.spec'
+
+// `agent.launch` settles a launch as failed only when its create threw before this hook ran.
+describe('OrcaRuntimeService createTerminal spawn dispatch', () => {
+  it('reports the spawn request before it leaves for the pty controller', async () => {
+    const dispatched = vi.fn()
+    const spawn = vi.fn(async () => {
+      expect(dispatched).toHaveBeenCalledOnce()
+      return { id: 'pty-dispatch' }
+    })
+    const runtime = new OrcaRuntimeService(store)
+    runtime.setPtyController({
+      spawn,
+      write: () => true,
+      kill: () => true,
+      getForegroundProcess: async () => null
+    })
+
+    await runtime.createTerminal(`path:${TEST_WORKTREE_PATH}`, {
+      command: 'codex',
+      onPtySpawnDispatched: dispatched
+    })
+
+    expect(spawn).toHaveBeenCalledOnce()
+  })
+
+  it('reports it even when the spawn itself then fails', async () => {
+    const dispatched = vi.fn()
+    const runtime = new OrcaRuntimeService(store)
+    runtime.setPtyController({
+      spawn: vi.fn(async () => {
+        throw new Error('ssh_channel_closed')
+      }),
+      write: () => true,
+      kill: () => true,
+      getForegroundProcess: async () => null
+    })
+
+    await expect(
+      runtime.createTerminal(`path:${TEST_WORKTREE_PATH}`, {
+        command: 'codex',
+        onPtySpawnDispatched: dispatched
+      })
+    ).rejects.toThrow('ssh_channel_closed')
+    expect(dispatched).toHaveBeenCalledOnce()
+  })
+
+  it('does not report it when the create fails before any spawn request', async () => {
+    const dispatched = vi.fn()
+    const spawn = vi.fn()
+    const runtime = new OrcaRuntimeService(store)
+    runtime.setPtyController({
+      spawn,
+      write: () => true,
+      kill: () => true,
+      getForegroundProcess: async () => null
+    })
+
+    await expect(
+      runtime.createTerminal('path:/no/such/workspace', {
+        command: 'codex',
+        onPtySpawnDispatched: dispatched
+      })
+    ).rejects.toThrow()
+    expect(spawn).not.toHaveBeenCalled()
+    expect(dispatched).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-04.spec.ts b/src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-04.spec.ts
index 78c4f072bb31..10cf9b4fbb91 100644
--- a/src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-04.spec.ts
+++ b/src/main/runtime/orca-runtime-tests/worktree-removal-and-reconciliation-part-04.spec.ts
@@ -14,14 +14,18 @@ import {
   listWorktrees,
   listWorktreesStrict,
   lstat,
+  localWorktreeFilesystem,
+  mkdir,
   mkdtemp,
+  restoreLocalWatcherAfterFailedRemovalMock,
   registerSshGitProvider,
   removeWorktree,
   removeWorktreeLinkedPathsMock,
   rm,
   runHook,
   tmpdir,
-  unregisterSshGitProvider
+  unregisterSshGitProvider,
+  writeFile
 } from '../orca-runtime-test-mocks.spec'
 import type { WorktreeMeta } from '../orca-runtime-test-mocks.spec'
 import {
@@ -344,6 +348,158 @@ describe('OrcaRuntimeService', () => {
     expect(deleteWorktreeHistoryDirMock).toHaveBeenCalledWith(TEST_WORKTREE_ID)
   })
 
+  it('retains metadata when an unproven orphan directory survives cleanup', async () => {
+    const parentDir = await mkdtemp(join(tmpdir(), 'orca-runtime-orphan-retention-'))
+    const repoPath = join(parentDir, 'repo')
+    const orphanPath = join(parentDir, 'orphan')
+    const worktreeId = `${TEST_REPO_ID}::${orphanPath}`
+    await mkdir(orphanPath, { recursive: true })
+    const { runtimeStore, removeWorktreeMeta } = createStaleRuntimeWorktreeStore(worktreeId)
+    const runtimeStoreWithRepoPath = {
+      ...runtimeStore,
+      getRepos: () => [
+        {
+          id: TEST_REPO_ID,
+          path: repoPath,
+          displayName: 'repo',
+          badgeColor: 'blue',
+          addedAt: 1
+        }
+      ],
+      getRepo: (id: string) =>
+        id === TEST_REPO_ID
+          ? {
+              id: TEST_REPO_ID,
+              path: repoPath,
+              displayName: 'repo',
+              badgeColor: 'blue',
+              addedAt: 1
+            }
+          : undefined
+    }
+    const runtime = createWorktreeRemovalRuntime(runtimeStoreWithRepoPath)
+    const registeredWorktree = {
+      path: orphanPath,
+      head: 'abc',
+      branch: 'feature/orphan',
+      isBare: false,
+      isMainWorktree: false
+    }
+    vi.mocked(listWorktrees).mockResolvedValue([registeredWorktree])
+    vi.mocked(listWorktreesStrict).mockResolvedValue([registeredWorktree])
+    vi.mocked(removeWorktree).mockRejectedValue(
+      Object.assign(new Error('git worktree remove failed'), {
+        stderr: `fatal: '${orphanPath}' is not a working tree`
+      })
+    )
+    vi.mocked(assertWorktreeCleanForRemoval).mockRejectedValue(
+      Object.assign(new Error('status failed'), {
+        stderr: 'fatal: not a git repository (or any of the parent directories): .git\n'
+      })
+    )
+    const gitSpy = vi.spyOn(gitRunner, 'gitExecFileAsync').mockResolvedValue({
+      stdout: '',
+      stderr: ''
+    })
+    const pruneCallsBefore = gitSpy.mock.calls.filter(([args]) => args[0] === 'worktree').length
+
+    try {
+      await expect(runtime.removeManagedWorktree(worktreeId)).rejects.toThrow(
+        'Worktree is no longer registered with Git but its directory remains.'
+      )
+      await expect(lstat(orphanPath)).resolves.toBeTruthy()
+      expect(removeWorktreeMeta).not.toHaveBeenCalled()
+      expect(restoreLocalWatcherAfterFailedRemovalMock).toHaveBeenCalledWith(orphanPath)
+      expect(gitSpy.mock.calls.filter(([args]) => args[0] === 'worktree')).toHaveLength(
+        pruneCallsBefore
+      )
+
+      await rm(orphanPath, { recursive: true, force: true })
+      vi.mocked(listWorktrees).mockResolvedValue([])
+      await expect(runtime.removeManagedWorktree(worktreeId)).resolves.toEqual({})
+      expect(removeWorktreeMeta).toHaveBeenCalledWith(worktreeId, 'local')
+    } finally {
+      gitSpy.mockRestore()
+      await rm(parentDir, { recursive: true, force: true })
+    }
+  })
+
+  it('retains metadata when proven orphan cleanup cannot remove the directory', async () => {
+    const parentDir = await mkdtemp(join(tmpdir(), 'orca-runtime-orphan-removal-failure-'))
+    const repoPath = join(parentDir, 'repo')
+    const orphanPath = join(parentDir, 'orphan')
+    const adminWorktreePath = join(repoPath, '.git', 'worktrees', 'orphan')
+    const worktreeId = `${TEST_REPO_ID}::${orphanPath}`
+    await mkdir(orphanPath, { recursive: true })
+    await mkdir(adminWorktreePath, { recursive: true })
+    await writeFile(join(orphanPath, '.git'), `gitdir: ${adminWorktreePath}\n`)
+    await writeFile(join(adminWorktreePath, 'gitdir'), `${join(orphanPath, '.git')}\n`)
+    const { runtimeStore, removeWorktreeMeta } = createStaleRuntimeWorktreeStore(worktreeId)
+    const runtimeStoreWithRepoPath = {
+      ...runtimeStore,
+      getRepos: () => [
+        {
+          id: TEST_REPO_ID,
+          path: repoPath,
+          displayName: 'repo',
+          badgeColor: 'blue',
+          addedAt: 1
+        }
+      ],
+      getRepo: (id: string) =>
+        id === TEST_REPO_ID
+          ? {
+              id: TEST_REPO_ID,
+              path: repoPath,
+              displayName: 'repo',
+              badgeColor: 'blue',
+              addedAt: 1
+            }
+          : undefined
+    }
+    const runtime = createWorktreeRemovalRuntime(runtimeStoreWithRepoPath)
+    const registeredWorktree = {
+      path: orphanPath,
+      head: 'abc',
+      branch: 'feature/orphan',
+      isBare: false,
+      isMainWorktree: false
+    }
+    vi.mocked(listWorktrees).mockResolvedValue([registeredWorktree])
+    vi.mocked(listWorktreesStrict).mockResolvedValue([registeredWorktree])
+    vi.mocked(removeWorktree).mockRejectedValue(
+      Object.assign(new Error('git worktree remove failed'), {
+        stderr: `fatal: '${orphanPath}' is not a working tree`
+      })
+    )
+    vi.mocked(assertWorktreeCleanForRemoval).mockRejectedValue(
+      Object.assign(new Error('status failed'), {
+        stderr: 'fatal: not a git repository (or any of the parent directories): .git\n'
+      })
+    )
+    const removePathSpy = vi
+      .spyOn(localWorktreeFilesystem, 'removeLocalWorktreePath')
+      .mockRejectedValue(new Error('injected removal failure'))
+    const gitSpy = vi.spyOn(gitRunner, 'gitExecFileAsync').mockResolvedValue({
+      stdout: '',
+      stderr: ''
+    })
+
+    try {
+      await expect(runtime.removeManagedWorktree(worktreeId)).rejects.toThrow(
+        'Worktree is no longer registered with Git but its directory remains.'
+      )
+      await expect(lstat(orphanPath)).resolves.toBeTruthy()
+      expect(removePathSpy).toHaveBeenCalledWith(orphanPath, {})
+      expect(removeWorktreeMeta).not.toHaveBeenCalled()
+      expect(gitSpy).not.toHaveBeenCalledWith(['worktree', 'prune'], expect.anything())
+    } finally {
+      removePathSpy.mockRestore()
+      gitSpy.mockRestore()
+      await rm(parentDir, { recursive: true, force: true })
+    }
+  })
+
   it('drops the bounded scan cache when orphan-cleanup removal completes', async () => {
     const runtime = createWorktreeRemovalRuntime()
     vi.mocked(getEffectiveHooks).mockReturnValue(null)
diff --git a/src/main/runtime/orca-runtime-tests/worktree-setup-and-startup-part-03.spec.ts b/src/main/runtime/orca-runtime-tests/worktree-setup-and-startup-part-03.spec.ts
index cc73ffa27180..5a5c95214031 100644
--- a/src/main/runtime/orca-runtime-tests/worktree-setup-and-startup-part-03.spec.ts
+++ b/src/main/runtime/orca-runtime-tests/worktree-setup-and-startup-part-03.spec.ts
@@ -418,7 +418,11 @@ describe('OrcaRuntimeService', () => {
     await Promise.resolve()
     await Promise.resolve()
 
-    expect(write).toHaveBeenCalledWith('pty-startup-draft', `\x1b[200~${draftUrl}\x1b[201~`)
+    expect(write).toHaveBeenCalledWith(
+      'pty-startup-draft',
+      `\x1b[200~${draftUrl}\x1b[201~`,
+      'launch'
+    )
   })
 
   it('keeps the 8s main-runtime startup readiness budget for agents without an override', async () => {
@@ -554,7 +558,11 @@ describe('OrcaRuntimeService', () => {
     await Promise.resolve()
     await Promise.resolve()
 
-    expect(write).toHaveBeenCalledWith('pty-opencode-draft-budget', `\x1b[200~${draftUrl}\x1b[201~`)
+    expect(write).toHaveBeenCalledWith(
+      'pty-opencode-draft-budget',
+      `\x1b[200~${draftUrl}\x1b[201~`,
+      'launch'
+    )
   })
 
   it('rejects explicit startup commands for disabled selected agents', async () => {
diff --git a/src/main/runtime/orca-runtime-tests/worktree-setup-and-startup-part-04.spec.ts b/src/main/runtime/orca-runtime-tests/worktree-setup-and-startup-part-04.spec.ts
index 2ec8e73f8000..cc2c2cae2ba5 100644
--- a/src/main/runtime/orca-runtime-tests/worktree-setup-and-startup-part-04.spec.ts
+++ b/src/main/runtime/orca-runtime-tests/worktree-setup-and-startup-part-04.spec.ts
@@ -83,7 +83,7 @@ describe('OrcaRuntimeService', () => {
       })
     )
     await vi.waitFor(() => {
-      expect(write).toHaveBeenCalledWith('pty-cli-aider-startup', 'fix it\r')
+      expect(write).toHaveBeenCalledWith('pty-cli-aider-startup', 'fix it\r', 'launch')
     })
   })
 
@@ -526,7 +526,11 @@ describe('OrcaRuntimeService', () => {
 
     runtime.onPtyData('pty-explicit-draft', '\x1b[?2004h›', Date.now())
     await vi.waitFor(() => {
-      expect(write).toHaveBeenCalledWith('pty-explicit-draft', `\x1b[200~${draftUrl}\x1b[201~`)
+      expect(write).toHaveBeenCalledWith(
+        'pty-explicit-draft',
+        `\x1b[200~${draftUrl}\x1b[201~`,
+        'launch'
+      )
     })
   })
 
diff --git a/src/main/runtime/orca-runtime-touch-mobile-session-tabs-for-worktree.ts b/src/main/runtime/orca-runtime-touch-mobile-session-tabs-for-worktree.ts
index 7a08f8f3bacf..3c18eb68def3 100644
--- a/src/main/runtime/orca-runtime-touch-mobile-session-tabs-for-worktree.ts
+++ b/src/main/runtime/orca-runtime-touch-mobile-session-tabs-for-worktree.ts
@@ -27,8 +27,8 @@ export class OrcaRuntimeWithTouchMobileSessionTabsForWorktree extends OrcaRuntim
       snapshotVersion: snapshot.snapshotVersion + 1
     })
     if (options.immediate) {
-      // Why: readiness/lifecycle changes are structural and must not wait
-      // behind the title/status coalescing window.
+      // Why: an exit is structural and must not wait behind the title/status window. A
+      // registration's ready flip coalesces so it merges with the spawn's graph update.
       this.notifyMobileSessionTabsChanged(worktreeId)
       return
     }
@@ -126,7 +126,11 @@ export class OrcaRuntimeWithTouchMobileSessionTabsForWorktree extends OrcaRuntim
           tab.parentTabId,
           tab.leafId,
           tab.ptyId
-        )
+        ) ||
+        // Why: after a cold restore the saved session is the only membership record until the PTY
+        // registers. Frame-only; once listed, the surface's graph leaves pass the shared predicate
+        // like any listed surface's. Host-side single-writer membership absorbs this.
+        this.hasPersistedTerminalSurfaceMembership(snapshot.worktree, tab.parentTabId, tab.leafId)
       ) {
         continue
       }
diff --git a/src/main/runtime/orca-runtime-visible-snapshot-preview.ts b/src/main/runtime/orca-runtime-visible-snapshot-preview.ts
index ac9eb99a67bd..be14a92c3193 100644
--- a/src/main/runtime/orca-runtime-visible-snapshot-preview.ts
+++ b/src/main/runtime/orca-runtime-visible-snapshot-preview.ts
@@ -140,6 +140,24 @@ export class OrcaRuntimeWithVisibleSnapshotPreview extends OrcaRuntimeWithCaptur
     }
   }
 
+  /** Synchronous visible grid of the live emulator, for tui-idle body evidence. Null when the
+   *  model is not the whole screen: a provider-restored partial suffix or a pending hydration. */
+  protected readLiveTerminalScreenLines(ptyId: string | null | undefined): string[] | null {
+    if (!ptyId) {
+      return null
+    }
+    const state = this.headlessTerminals.get(ptyId)
+    if (
+      !state ||
+      this.providerSnapshotPreferredPtys.has(ptyId) ||
+      this.headlessHydrationState.get(ptyId) === 'pending'
+    ) {
+      return null
+    }
+    // Why unawaited writeChain: callers are synchronous; a grid one chunk behind is re-read next poll.
+    return projectTerminalVisibleLines(state.emulator).lines
+  }
+
   protected async parseVisibleSnapshot(snapshot: {
     data: string
     cols: number
diff --git a/src/main/runtime/orca-runtime-wait-for-leaf-pty-id.ts b/src/main/runtime/orca-runtime-wait-for-leaf-pty-id.ts
index 37ac8c5a8394..b3749ec6dba7 100644
--- a/src/main/runtime/orca-runtime-wait-for-leaf-pty-id.ts
+++ b/src/main/runtime/orca-runtime-wait-for-leaf-pty-id.ts
@@ -142,16 +142,6 @@ export class OrcaRuntimeWithWaitForLeafPtyId extends OrcaRuntimeWithRestoreLiveP
   }
 
   // Why: a leaf exists before its PTY spawns; a handle issued while ptyId is null gets invalidated on the next sync, so wait for a connected PTY.
-  protected countLeavesInTab(tabId: string): number {
-    let count = 0
-    for (const leaf of this.leaves.values()) {
-      if (leaf.tabId === tabId) {
-        count++
-      }
-    }
-    return count
-  }
-
   protected resolveHandleForTab(tabId: string): string | null {
     for (const leaf of this.leaves.values()) {
       if (leaf.tabId === tabId && leaf.ptyId !== null) {
diff --git a/src/main/runtime/orca-runtime-write-terminal-agent-prompt.ts b/src/main/runtime/orca-runtime-write-terminal-agent-prompt.ts
index 5e90602755cb..1597084eee15 100644
--- a/src/main/runtime/orca-runtime-write-terminal-agent-prompt.ts
+++ b/src/main/runtime/orca-runtime-write-terminal-agent-prompt.ts
@@ -27,7 +27,7 @@ export class OrcaRuntimeWithWriteTerminalAgentPrompt extends OrcaRuntimeWithReso
     ptyId: string,
     generation: number,
     pastePayload: string,
-    options: RuntimeAgentPromptWriteOptions = {}
+    options: RuntimeAgentPromptWriteOptions
   ): Promise<{ submits: number; prompt?: RuntimeTerminalPromptDelivery }> {
     assertAgentPromptRequestActive(options.signal)
     this.assertAgentPromptGeneration(ptyId, generation)
@@ -62,7 +62,7 @@ export class OrcaRuntimeWithWriteTerminalAgentPrompt extends OrcaRuntimeWithReso
       // beginning when a large frame is split into independently processed chunks.
       renderGate?.arm()
       const initialWrite = submitWithPaste ? pastePayload + AGENT_PROMPT_SUBMIT : pastePayload
-      if (!this.ptyController?.write(ptyId, initialWrite)) {
+      if (!this.ptyController?.write(ptyId, initialWrite, options.inputKind)) {
         throw new Error('terminal_not_writable')
       }
     } catch (error) {
@@ -103,7 +103,7 @@ export class OrcaRuntimeWithWriteTerminalAgentPrompt extends OrcaRuntimeWithReso
     const baseline = preSubmitBaseline ?? this.getAgentPromptActivity(handle, ptyId, waitTextCache)
     this.assertAgentPromptPermissionSafe(permissionBaseline, baseline)
     if (!submitWithPaste) {
-      if (!this.ptyController?.write(ptyId, AGENT_PROMPT_SUBMIT)) {
+      if (!this.ptyController?.write(ptyId, AGENT_PROMPT_SUBMIT, options.inputKind)) {
         throw new Error(options.suffixFailureError ?? 'terminal_not_writable')
       }
     }
diff --git a/src/main/runtime/orca-runtime.test.ts b/src/main/runtime/orca-runtime.test.ts
index 13796169be0a..6d4cba4741d5 100644
--- a/src/main/runtime/orca-runtime.test.ts
+++ b/src/main/runtime/orca-runtime.test.ts
@@ -51,6 +51,7 @@ await import('./orca-runtime-tests/terminal-creation-and-readiness-part-09.spec'
 await import('./orca-runtime-tests/terminal-creation-and-readiness-part-10.spec')
 await import('./orca-runtime-tests/terminal-creation-and-readiness-part-11.spec')
 await import('./orca-runtime-tests/terminal-creation-and-readiness-part-12.spec')
+await import('./orca-runtime-tests/terminal-spawn-dispatch.spec')
 await import('./orca-runtime-tests/terminal-output-and-worker-recovery.spec')
 await import('./orca-runtime-tests/terminal-output-and-worker-recovery-part-02.spec')
 await import('./orca-runtime-tests/terminal-output-and-worker-recovery-part-03.spec')
diff --git a/src/main/runtime/orchestration/canonical-orca-session-id.ts b/src/main/runtime/orchestration/canonical-orca-session-id.ts
new file mode 100644
index 000000000000..7889e257f482
--- /dev/null
+++ b/src/main/runtime/orchestration/canonical-orca-session-id.ts
@@ -0,0 +1,7 @@
+import type { OrcaSessionId } from '../../../shared/orca-session-address'
+
+/** The Orca session id orchestration addresses a session by; every session-to-party step calls this. */
+export function canonicalOrcaSessionId(orcaSessionId: OrcaSessionId): OrcaSessionId {
+  // Later lineage canonicalization (a `/clear`ed session to its lineage root) plugs in here.
+  return orcaSessionId
+}
diff --git a/src/main/runtime/orchestration/coordinator-runtime-contract.ts b/src/main/runtime/orchestration/coordinator-runtime-contract.ts
index 2f4f5bf9b5ae..3c98fa302008 100644
--- a/src/main/runtime/orchestration/coordinator-runtime-contract.ts
+++ b/src/main/runtime/orchestration/coordinator-runtime-contract.ts
@@ -11,7 +11,7 @@ export type CoordinatorRuntime = {
   sendTerminalAgentPrompt(
     handle: string,
     prompt: string,
-    options?: DispatchPreambleSendOptions
+    options: DispatchPreambleSendOptions
   ): Promise<unknown>
   listTerminals(
     worktreeSelector?: string,
diff --git a/src/main/runtime/orchestration/coordinator-task-dispatch.ts b/src/main/runtime/orchestration/coordinator-task-dispatch.ts
index bb64f6dd98b9..a305afedf40d 100644
--- a/src/main/runtime/orchestration/coordinator-task-dispatch.ts
+++ b/src/main/runtime/orchestration/coordinator-task-dispatch.ts
@@ -32,7 +32,7 @@ export async function listAvailableWorkerTerminals(
   runtime: CoordinatorRuntime,
   coordinatorHandle: string,
   worktree: string | undefined
-): Promise<string[]> {
+): Promise<string[] | null> {
   try {
     const result = await runtime.listTerminals(worktree, undefined, {
       includeVisualLayouts: false
@@ -55,7 +55,8 @@ export async function listAvailableWorkerTerminals(
       )
       .map((t) => t.handle)
   } catch {
-    return []
+    // A failed census cannot authorize creating another worker.
+    return null
   }
 }
 
diff --git a/src/main/runtime/orchestration/coordinator-terminal-census-unavailable.test.ts b/src/main/runtime/orchestration/coordinator-terminal-census-unavailable.test.ts
new file mode 100644
index 000000000000..49b348141449
--- /dev/null
+++ b/src/main/runtime/orchestration/coordinator-terminal-census-unavailable.test.ts
@@ -0,0 +1,84 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { Coordinator } from './coordinator'
+import type { CoordinatorRuntime } from './coordinator-runtime-contract'
+import { OrchestrationDb } from './db'
+
+afterEach(() => vi.useRealTimers())
+
+describe('coordinator terminal census availability', () => {
+  it.each(['terminal_surface_ownership_unavailable', 'terminal_liveness_unavailable'])(
+    'defers dispatch on %s and reuses the existing worker after recovery',
+    async (error) => {
+      vi.useFakeTimers()
+      const db = new OrchestrationDb(':memory:')
+      const task = db.createTask({ runId: 'run_legacy_local', spec: 'implement the feature' })
+      const listTerminals = vi
+        .fn<CoordinatorRuntime['listTerminals']>()
+        .mockRejectedValueOnce(new Error(error))
+        .mockResolvedValue({
+          terminals: [
+            { handle: 'term_existing', worktreeId: 'wt1', connected: true, writable: true }
+          ]
+        })
+      const createTerminal = vi.fn<CoordinatorRuntime['createTerminal']>(async () => ({
+        handle: 'term_unnecessary',
+        worktreeId: 'wt1'
+      }))
+      const sendTerminalAgentPrompt = vi.fn<CoordinatorRuntime['sendTerminalAgentPrompt']>(
+        async () => ({ accepted: true })
+      )
+      const runtime: CoordinatorRuntime = {
+        listTerminals,
+        createTerminal,
+        sendTerminalAgentPrompt,
+        waitForTerminal: async (handle) => ({ handle, condition: 'exit' }),
+        probeWorktreeDrift: async () => null
+      }
+      const coordinator = new Coordinator(db, runtime, {
+        spec: 'go',
+        coordinatorHandle: 'coord',
+        pollIntervalMs: 1000,
+        worktree: 'wt1'
+      })
+      const run = coordinator.run()
+      try {
+        await vi.advanceTimersByTimeAsync(0)
+        expect(listTerminals).toHaveBeenCalledTimes(1)
+        expect(createTerminal).not.toHaveBeenCalled()
+        expect(sendTerminalAgentPrompt).not.toHaveBeenCalled()
+        expect(db.getTask(task.id)?.status).toBe('ready')
+        expect(db.listTasks({ status: 'dispatched' })).toEqual([])
+
+        await vi.advanceTimersByTimeAsync(1000)
+        expect(listTerminals).toHaveBeenCalledTimes(2)
+        expect(createTerminal).not.toHaveBeenCalled()
+        expect(sendTerminalAgentPrompt).toHaveBeenCalledTimes(1)
+        const dispatch = db.getDispatchContext(task.id)
+        expect(dispatch?.assignee_handle).toBe('term_existing')
+        expect(db.getTask(task.id)?.status).toBe('dispatched')
+        db.insertMessage({
+          runId: 'run_legacy_local',
+          from: 'term_existing',
+          to: 'coord',
+          subject: 'Done',
+          type: 'worker_done',
+          payload: JSON.stringify({
+            taskId: task.id,
+            dispatchId: dispatch?.id,
+            outcome: 'succeeded'
+          })
+        })
+        await vi.advanceTimersByTimeAsync(1000)
+        await expect(run).resolves.toMatchObject({ status: 'completed', completedTasks: [task.id] })
+      } finally {
+        coordinator.stop()
+        try {
+          await vi.runOnlyPendingTimersAsync()
+          await run
+        } finally {
+          db.close()
+        }
+      }
+    }
+  )
+})
diff --git a/src/main/runtime/orchestration/coordinator.ts b/src/main/runtime/orchestration/coordinator.ts
index 252c9f89ea90..915dc9e16a4f 100644
--- a/src/main/runtime/orchestration/coordinator.ts
+++ b/src/main/runtime/orchestration/coordinator.ts
@@ -245,6 +245,9 @@ export class Coordinator {
       this.opts.coordinatorHandle,
       this.opts.worktree
     )
+    if (terminals === null) {
+      return
+    }
     if (terminals.length === 0 && slotsAvailable > 0) {
       // Why: create at most one terminal per tick to avoid spawning many at once.
       try {
diff --git a/src/main/runtime/orchestration/db/dispatch-context/dispatch-context-store.ts b/src/main/runtime/orchestration/db/dispatch-context/dispatch-context-store.ts
index 38905f30434d..67be16e6cf26 100644
--- a/src/main/runtime/orchestration/db/dispatch-context/dispatch-context-store.ts
+++ b/src/main/runtime/orchestration/db/dispatch-context/dispatch-context-store.ts
@@ -9,6 +9,7 @@ import { recordedCreatorIdentity, type DispatchCreator } from '../dispatch-depth
 import type { OrchestrationDb } from '../orchestration-db'
 import { transitionLifecycleWithDb } from '../lifecycle-transition'
 import { taskNotFoundError, taskNotStartableError } from '../../task-dispatch-refusal'
+import { structuredWorkerOrcaSessionIdForIncarnation } from '../../../structured-worker-identity'
 
 export function createDispatchContext(
   this: OrchestrationDb,
@@ -65,6 +66,7 @@ export function createDispatchContext(
       launchTokenHash: launchTokenHash ?? null,
       assigneeHandle,
       assigneePaneKey: assigneePaneKey ?? null,
+      assigneeOrcaSessionId: structuredWorkerOrcaSessionIdForIncarnation(processIncarnation),
       processIncarnation: processIncarnation ?? null,
       creatorDispatchId,
       ...recordedCreatorIdentity(params.creator),
diff --git a/src/main/runtime/orchestration/db/dispatch-depth.ts b/src/main/runtime/orchestration/db/dispatch-depth.ts
index cc4ba026db93..93c5bd65fb66 100644
--- a/src/main/runtime/orchestration/db/dispatch-depth.ts
+++ b/src/main/runtime/orchestration/db/dispatch-depth.ts
@@ -7,6 +7,7 @@ import {
 import { OrchestrationError } from '../orchestration-error'
 import { isEquivalentPaneKey } from './pane-key-match'
 import type { OrchestrationDb } from './orchestration-db'
+import type { OrcaSessionId } from '../../../../shared/orca-session-address'
 import type { DispatchContextRow, RemoteDispatchAttachmentRow } from '../types'
 import { potentiallyLiveRemoteAttachmentSql } from './federation/remote-attachment-liveness'
 
@@ -26,17 +27,33 @@ export type DispatchCreator =
       paneKey?: string
       /** Remote attachment matching requires the exact incarnation; local rows do not. */
       processIncarnation?: string
+      /** A structured worker's bare Orca session id, recorded beside its handle. */
+      orcaSessionId?: OrcaSessionId | null
     }
+  /** A structured session with no terminal handle, identified by its Orca session id alone. */
+  | { kind: 'session'; orcaSessionId: OrcaSessionId }
 
 /** Creator identity to persist on a new row, so depth can later tell delegation from bookkeeping. */
 export function recordedCreatorIdentity(creator: DispatchCreator): {
   creatorHandle: string | null
   creatorPaneKey: string | null
+  creatorOrcaSessionId: OrcaSessionId | null
 } {
   if (creator.kind === 'system') {
-    return { creatorHandle: null, creatorPaneKey: null }
+    return { creatorHandle: null, creatorPaneKey: null, creatorOrcaSessionId: null }
+  }
+  if (creator.kind === 'session') {
+    return {
+      creatorHandle: null,
+      creatorPaneKey: null,
+      creatorOrcaSessionId: creator.orcaSessionId
+    }
+  }
+  return {
+    creatorHandle: creator.handle,
+    creatorPaneKey: creator.paneKey ?? null,
+    creatorOrcaSessionId: creator.orcaSessionId ?? null
   }
-  return { creatorHandle: creator.handle, creatorPaneKey: creator.paneKey ?? null }
 }
 
 /**
@@ -84,14 +101,14 @@ export function resolveCreatorDepth(this: OrchestrationDb, creator: DispatchCrea
   // Local rows match on handle/pane as they always have. process_incarnation is
   // nullable here and context-only dispatch stores null deliberately, so
   // requiring it would drop real parents.
-  const local = this.findActiveDispatchForAssignee(creator.handle, creator.paneKey) as
-    | DispatchContextRow
-    | undefined
+  const local = findActiveDispatchForCreator.call(this, creator)
   if (local && !isSelfCreatedDispatch(local)) {
     depths.push(local.depth)
   }
 
-  for (const attachment of findPotentiallyLiveAttachmentsForCreator.call(this, creator)) {
+  const attachments =
+    creator.kind === 'terminal' ? findPotentiallyLiveAttachmentsForCreator.call(this, creator) : []
+  for (const attachment of attachments) {
     depths.push(attachment.depth)
   }
 
@@ -109,16 +126,36 @@ export function resolveCreatorDispatchId(
   if (creator.kind === 'system') {
     return null
   }
-  const own = this.findActiveDispatchForAssignee(creator.handle, creator.paneKey)
+  const own = findActiveDispatchForCreator.call(this, creator)
   // Why: a self-dispatch is not a parent Attempt, so it must not be stamped as the child's creator.
   const local = own && !isSelfCreatedDispatch(own) ? own : undefined
-  const remote = findPotentiallyLiveAttachmentsForCreator.call(this, creator)
+  const remote =
+    creator.kind === 'terminal' ? findPotentiallyLiveAttachmentsForCreator.call(this, creator) : []
   if ((local ? 1 : 0) + remote.length !== 1) {
     return null
   }
   return local?.id ?? remote[0]?.dispatch_id ?? null
 }
 
+/** The live Dispatch this creator is itself working on, found the way its identity is recorded. */
+function findActiveDispatchForCreator(
+  this: OrchestrationDb,
+  creator: Exclude<DispatchCreator, { kind: 'system' }>
+): DispatchContextRow | undefined {
+  if (creator.kind === 'terminal') {
+    return this.findActiveDispatchForAssignee(creator.handle, creator.paneKey)
+  }
+  const row = this.db
+    .prepare(
+      `SELECT * FROM dispatch_contexts
+       WHERE assignee_orca_session_id = ? AND status IN ('pending', 'dispatched')
+       ORDER BY rowid DESC LIMIT 1`
+    )
+    .get(creator.orcaSessionId)
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: SELECT * over this table returns the row shape its schema and row type define, like every row cast in db/.
+  return row as DispatchContextRow | undefined
+}
+
 /**
  * Remote attachments matching this caller's pane AND exact process incarnation.
  *
diff --git a/src/main/runtime/orchestration/db/dispatch-row-writer.ts b/src/main/runtime/orchestration/db/dispatch-row-writer.ts
index 84862ee343d2..e8e4192e137b 100644
--- a/src/main/runtime/orchestration/db/dispatch-row-writer.ts
+++ b/src/main/runtime/orchestration/db/dispatch-row-writer.ts
@@ -1,5 +1,6 @@
 import type Database from '../../../sqlite/sync-database'
 import { DISPATCH_PANE_KEY_MATCH_SUFFIX_SQL } from './pane-key-match'
+import type { OrcaSessionId } from '../../../../shared/orca-session-address'
 
 /**
  * The only place that inserts rows representing a live supervised worker.
@@ -14,11 +15,11 @@ import { DISPATCH_PANE_KEY_MATCH_SUFFIX_SQL } from './pane-key-match'
 
 export const DISPATCH_CONTEXT_CLAIM_SQL = `INSERT INTO dispatch_contexts (
   id, run_id, task_id, contract_version, launch_token_hash,
-  assignee_handle, assignee_pane_key, process_incarnation,
-  creator_dispatch_id, creator_handle, creator_pane_key,
+  assignee_handle, assignee_pane_key, assignee_orca_session_id, process_incarnation,
+  creator_dispatch_id, creator_handle, creator_pane_key, creator_orca_session_id,
   status, failure_count, depth, dispatched_at
 )
-SELECT ?, run_id, id, ?, ?, ?, ?, ?, ?, ?, ?, 'dispatched', ?, ?, datetime('now')
+SELECT ?, run_id, id, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'dispatched', ?, ?, datetime('now')
 FROM tasks
 WHERE id = ? AND status = 'ready'
   AND NOT EXISTS (
@@ -45,8 +46,9 @@ WHERE id = ? AND status = 'ready'
 
 const STARTING_DISPATCH_CONTEXT_SQL = `INSERT INTO dispatch_contexts (
    id, run_id, task_id, contract_version, launch_token_hash, retry_of_dispatch_id,
-   creator_dispatch_id, creator_handle, creator_pane_key, depth, status, dispatched_at
- ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'pending', datetime('now'))`
+   creator_dispatch_id, creator_handle, creator_pane_key, creator_orca_session_id, depth, status,
+   dispatched_at
+ ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'pending', datetime('now'))`
 
 const REMOTE_DISPATCH_ATTACHMENT_SQL = `INSERT INTO remote_dispatch_attachments (
    dispatch_id, home_run_id, task_id, home_peer_fingerprint, protocol_version, runtime_epoch, depth
@@ -70,10 +72,12 @@ export function claimDispatchContextRow(
     launchTokenHash: string | null
     assigneeHandle: string
     assigneePaneKey: string | null
+    assigneeOrcaSessionId?: OrcaSessionId | null
     processIncarnation: string | null
     creatorDispatchId?: string | null
     creatorHandle?: string | null
     creatorPaneKey?: string | null
+    creatorOrcaSessionId?: OrcaSessionId | null
     priorFailures: number
     depth: number
     taskId: string
@@ -89,10 +93,12 @@ export function claimDispatchContextRow(
       params.launchTokenHash,
       params.assigneeHandle,
       params.assigneePaneKey,
+      params.assigneeOrcaSessionId ?? null,
       params.processIncarnation,
       params.creatorDispatchId ?? null,
       params.creatorHandle ?? null,
       params.creatorPaneKey ?? null,
+      params.creatorOrcaSessionId ?? null,
       params.priorFailures,
       params.depth,
       params.taskId,
@@ -118,6 +124,7 @@ export function insertStartingDispatchContextRow(
     creatorDispatchId?: string | null
     creatorHandle?: string | null
     creatorPaneKey?: string | null
+    creatorOrcaSessionId?: OrcaSessionId | null
   }
 ): void {
   assertStampedDepth(params.depth)
@@ -131,6 +138,7 @@ export function insertStartingDispatchContextRow(
     params.creatorDispatchId ?? null,
     params.creatorHandle ?? null,
     params.creatorPaneKey ?? null,
+    params.creatorOrcaSessionId ?? null,
     params.depth
   )
 }
diff --git a/src/main/runtime/orchestration/db/messages/direct-mailbox-routing.ts b/src/main/runtime/orchestration/db/messages/direct-mailbox-routing.ts
index aa7d93fbea29..c1e5ee995623 100644
--- a/src/main/runtime/orchestration/db/messages/direct-mailbox-routing.ts
+++ b/src/main/runtime/orchestration/db/messages/direct-mailbox-routing.ts
@@ -1,6 +1,7 @@
 import type { MessageType } from '../../types'
 import type { OrchestrationDb } from '../orchestration-db'
 import { ORCHESTRATION_DELIVERY_BATCH_LIMIT, type MailboxRoutingPage } from './mailbox-routing-page'
+import { activeDispatchOwnsAddressSql } from '../runs/run-coordinator-mail-routing'
 
 export function hasUndeliveredDirectMessageForRun(
   this: OrchestrationDb,
@@ -48,12 +49,7 @@ export function routeDirectMessagePage(
   try {
     const throughClause = throughSequence === undefined ? '' : ' AND sequence <= ?'
     const dispatchOwnershipClause = preserveActiveDispatchOwnership
-      ? ` AND NOT EXISTS (
-           SELECT 1 FROM dispatch_contexts
-           WHERE dispatch_contexts.run_id = messages.run_id
-             AND dispatch_contexts.assignee_handle = messages.to_handle
-             AND dispatch_contexts.status IN ('pending', 'dispatched')
-         )`
+      ? ` AND NOT ${activeDispatchOwnsAddressSql('messages.run_id', 'messages.to_handle')}`
       : ''
     const params: (string | number)[] = [runId, directHandle]
     if (throughSequence !== undefined) {
diff --git a/src/main/runtime/orchestration/db/orca-session-address-sql.ts b/src/main/runtime/orchestration/db/orca-session-address-sql.ts
new file mode 100644
index 000000000000..83bb7ad2c56e
--- /dev/null
+++ b/src/main/runtime/orchestration/db/orca-session-address-sql.ts
@@ -0,0 +1,10 @@
+import { ORCA_SESSION_ADDRESS_PREFIX } from '../../../../shared/orca-session-address'
+
+/**
+ * The `session:<id>` address of a bare Orca session id column or expression, NULL when it is NULL.
+ * The only way SQL compares a stored id with a mail address: the id side is formatted, never the
+ * address side stripped, so a handle or `run:` address can never equal a bare id.
+ */
+export function orcaSessionAddressSql(orcaSessionIdSql: string): string {
+  return `('${ORCA_SESSION_ADDRESS_PREFIX}' || ${orcaSessionIdSql})`
+}
diff --git a/src/main/runtime/orchestration/db/runs/run-binding.ts b/src/main/runtime/orchestration/db/runs/run-binding.ts
index c5e6f34abfad..b396b79f1ece 100644
--- a/src/main/runtime/orchestration/db/runs/run-binding.ts
+++ b/src/main/runtime/orchestration/db/runs/run-binding.ts
@@ -3,13 +3,21 @@ import { OrchestrationError } from '../../orchestration-error'
 import { LEGACY_CONTRACT_VERSION } from '../contract-constants'
 import { isEquivalentPaneKey } from '../pane-key-match'
 import type { OrchestrationDb } from '../orchestration-db'
+import type { OrcaSessionId } from '../../../../../shared/orca-session-address'
+import {
+  mailboxAddressOf,
+  runBoundToCoordinator,
+  runCoordinatorKey
+} from '../../orchestration-caller-identity'
 
 export function bindRun(
   this: OrchestrationDb,
   params: {
     runId: string
-    coordinatorHandle: string
-    coordinatorPaneKey: string
+    coordinatorHandle: string | null
+    coordinatorPaneKey: string | null
+    /** The coordinator's bare Orca session id when it is a structured session; see orca-session-address. */
+    coordinatorOrcaSessionId?: OrcaSessionId | null
     takeoverLegacy?: boolean
     legacyCoordinatorAuthority?: {
       runId: string
@@ -20,6 +28,11 @@ export function bindRun(
     }
   }
 ): RunRow | undefined {
+  const coordinator = {
+    terminalHandle: params.coordinatorHandle,
+    paneKey: params.coordinatorPaneKey,
+    orcaSessionId: params.coordinatorOrcaSessionId ?? null
+  }
   this.db.exec('BEGIN IMMEDIATE')
   try {
     const run = this.getRunRaw(params.runId)
@@ -27,9 +40,7 @@ export function bindRun(
       this.db.exec('ROLLBACK')
       return undefined
     }
-    const sameBinding =
-      run.coordinator_pane_key !== null &&
-      isEquivalentPaneKey(run.coordinator_pane_key, params.coordinatorPaneKey)
+    const sameBinding = runBoundToCoordinator(run, coordinator)
     const adoption = this.getLegacyAdoption()
     const adoptedRun = adoption?.adopted_run_id === params.runId
     const legacyAuthority = params.legacyCoordinatorAuthority
@@ -49,6 +60,7 @@ export function bindRun(
       legacyPrincipal.terminal_handle === legacyAuthority.terminalHandle &&
       isEquivalentPaneKey(legacyPrincipal.pane_key, legacyAuthority.paneKey) &&
       params.coordinatorHandle === legacyAuthority.terminalHandle &&
+      params.coordinatorPaneKey !== null &&
       isEquivalentPaneKey(params.coordinatorPaneKey, legacyAuthority.paneKey)
     )
     if (legacyAuthority && !provenLegacyBinding) {
@@ -109,14 +121,17 @@ export function bindRun(
         }
       )
     }
-    this.unbindOtherRunsForPane(params.coordinatorPaneKey, params.runId)
-    for (const handle of new Set(
-      [run.coordinator_handle, params.coordinatorHandle].filter((value): value is string =>
-        Boolean(value)
-      )
-    )) {
-      this.rememberRunCoordinatorHandle(params.runId, handle)
-      this.routeAllUnreadDirectMessagesToRunMailbox(params.runId, handle)
+    this.unbindOtherRunsForCoordinator(coordinator, params.runId)
+    // The mailbox address of the coordinator being replaced and of the one binding now.
+    for (const address of new Set([
+      mailboxAddressOf(runCoordinatorKey(run)),
+      mailboxAddressOf(coordinator)
+    ])) {
+      if (address === null) {
+        continue
+      }
+      this.rememberRunCoordinatorHandle(params.runId, address)
+      this.routeAllUnreadDirectMessagesToRunMailbox(params.runId, address)
     }
     if (
       (params.takeoverLegacy && !takeoverAlreadyApplied) ||
@@ -128,26 +143,40 @@ export function bindRun(
           coordinatorPrincipal?.status === 'committed' &&
           (params.takeoverLegacy ||
             coordinatorPrincipal.terminal_handle !== params.coordinatorHandle ||
+            params.coordinatorPaneKey === null ||
             !isEquivalentPaneKey(coordinatorPrincipal.pane_key, params.coordinatorPaneKey))
         ) {
           this.setLegacyCompatibilityPrincipalStatus(coordinatorPrincipal.id, 'revoked')
         }
       }
-      // The Orca session id belongs to the coordinator being replaced; nothing here resolves the new one's.
       this.db
         .prepare(
           `UPDATE runs
-           SET coordinator_handle = ?, coordinator_pane_key = ?, coordinator_orca_session_id = NULL,
-               coordinator_orca_session_id_generation = NULL,
+           SET coordinator_handle = ?, coordinator_pane_key = ?, coordinator_orca_session_id = ?,
+               coordinator_orca_session_id_generation = consumer_generation + 1,
                consumer_generation = consumer_generation + 1,
                updated_at = datetime('now')
            WHERE id = ?`
         )
-        .run(params.coordinatorHandle, params.coordinatorPaneKey, params.runId)
+        .run(
+          coordinator.terminalHandle,
+          coordinator.paneKey,
+          coordinator.orcaSessionId,
+          params.runId
+        )
       this.fenceUnacknowledgedMailboxDeliveries(`run:${params.runId}`)
       if (params.takeoverLegacy || replacesLegacyCoordinator) {
         this.promoteLegacyCoordinatorMailForTakeover(params.runId, retainedCoordinatorHandle)
       }
+    } else if (runCoordinatorKey(run).orcaSessionId !== coordinator.orcaSessionId) {
+      // Same coordinator, so no new consumer: correct an Orca session id a writer without the column left.
+      this.db
+        .prepare(
+          `UPDATE runs SET coordinator_orca_session_id = ?,
+             coordinator_orca_session_id_generation = consumer_generation
+           WHERE id = ?`
+        )
+        .run(coordinator.orcaSessionId, params.runId)
     }
     this.db.exec('COMMIT')
   } catch (error) {
diff --git a/src/main/runtime/orchestration/db/runs/run-coordinator-mail-routing.ts b/src/main/runtime/orchestration/db/runs/run-coordinator-mail-routing.ts
index 07a6044d5aaa..d42b93dfdd9f 100644
--- a/src/main/runtime/orchestration/db/runs/run-coordinator-mail-routing.ts
+++ b/src/main/runtime/orchestration/db/runs/run-coordinator-mail-routing.ts
@@ -1,6 +1,16 @@
 import type { OrchestrationDb } from '../orchestration-db'
 import { currentRunCoordinatorSessionAddressSql } from './run-coordinator-orca-session'
 
+/** Mail to an active Dispatch assignee's address in the same Run is that worker's, not coordinator mail. */
+export function activeDispatchOwnsAddressSql(runIdSql: string, addressSql: string): string {
+  return `EXISTS (
+    SELECT 1 FROM dispatch_contexts
+    WHERE dispatch_contexts.run_id = ${runIdSql}
+      AND dispatch_contexts.assignee_handle = ${addressSql}
+      AND dispatch_contexts.status IN ('pending', 'dispatched')
+  )`
+}
+
 export function rememberRunCoordinatorHandle(
   this: OrchestrationDb,
   runId: string,
@@ -43,11 +53,7 @@ export function createCoordinatorMailRoutingTrigger(this: OrchestrationDb): void
           SELECT 1 FROM run_coordinator_handles
           WHERE run_id = NEW.run_id AND terminal_handle = NEW.to_handle
         )
-        AND NOT EXISTS (
-          SELECT 1 FROM dispatch_contexts
-          WHERE run_id = NEW.run_id AND assignee_handle = NEW.to_handle
-            AND status IN ('pending', 'dispatched')
-        )
+        AND NOT ${activeDispatchOwnsAddressSql('NEW.run_id', 'NEW.to_handle')}
       BEGIN
         UPDATE messages SET to_handle = 'run:' || NEW.run_id WHERE sequence = NEW.sequence;
       END;
@@ -69,12 +75,7 @@ export function routeAllUnreadDirectMessagesToRunMailbox(
       `UPDATE messages SET to_handle = ?
        WHERE run_id = ? AND to_handle = ? AND read = 0
          AND delivery_contract = 'current_delivery'
-         AND NOT EXISTS (
-           SELECT 1 FROM dispatch_contexts
-           WHERE dispatch_contexts.run_id = messages.run_id
-             AND dispatch_contexts.assignee_handle = messages.to_handle
-             AND dispatch_contexts.status IN ('pending', 'dispatched')
-         )`
+         AND NOT ${activeDispatchOwnsAddressSql('messages.run_id', 'messages.to_handle')}`
     )
     .run(`run:${runId}`, runId, directHandle)
 }
diff --git a/src/main/runtime/orchestration/db/runs/run-coordinator-orca-session-binding.test.ts b/src/main/runtime/orchestration/db/runs/run-coordinator-orca-session-binding.test.ts
new file mode 100644
index 000000000000..3340f625b66c
--- /dev/null
+++ b/src/main/runtime/orchestration/db/runs/run-coordinator-orca-session-binding.test.ts
@@ -0,0 +1,405 @@
+import { afterEach, describe, expect, it } from 'vitest'
+import {
+  mintStructuredWorkerHandle,
+  mintStructuredWorkerPaneKey,
+  structuredWorkerProcessIncarnation
+} from '../../../structured-worker-identity'
+import { OrchestrationDb } from '../../db'
+import {
+  formatOrcaSessionAddress,
+  type OrcaSessionId
+} from '../../../../../shared/orca-session-address'
+import { testOrcaSessionId } from '../../../../../shared/orca-session-address-test-fixture'
+
+const CHAT_X_ID = testOrcaSessionId('1b6f0c3a-7d2e-4a91-8c55-2e9d4b7a0f13')
+const CHAT_X = formatOrcaSessionAddress(CHAT_X_ID)
+const CHAT_Y_ID = testOrcaSessionId('6d2a9e41-0c7b-4f38-9a15-b3e8c1d57f20')
+const CHAT_Y = formatOrcaSessionAddress(CHAT_Y_ID)
+const WORKER_SESSION = testOrcaSessionId('9c3e5a17-4b2d-4f60-8e91-0d7a6c2b5e48')
+const WORKER_ADDRESS = formatOrcaSessionAddress(WORKER_SESSION)
+const OTHER_WORKER_SESSION = testOrcaSessionId('2e8b4d61-5a3c-4e97-b0f2-7c1d9a6e3b54')
+const PTY_PANE = 'tab_pty:11111111-1111-4111-8111-111111111111'
+const OTHER_PANE = 'tab_other:22222222-2222-4222-8222-222222222222'
+const UNCAPPED = Number.MAX_SAFE_INTEGER
+
+function chat(orcaSessionId: OrcaSessionId) {
+  return { terminalHandle: null, paneKey: null, orcaSessionId }
+}
+
+describe('Run binding by Orca session id', () => {
+  let db: OrchestrationDb
+
+  afterEach(() => {
+    db?.close()
+  })
+
+  function createChatRun(orcaSessionId: OrcaSessionId, objective = 'chat run') {
+    return db.createRun({
+      objective,
+      coordinatorHandle: null,
+      coordinatorPaneKey: null,
+      coordinatorOrcaSessionId: orcaSessionId
+    })
+  }
+
+  function directMail(runId: string, to: string, subject = 'direct') {
+    return db.insertMessage({ from: 'term_sender', to, subject, body: '', runId })
+  }
+
+  function structuredWorker(sessionId = WORKER_SESSION) {
+    return {
+      terminalHandle: mintStructuredWorkerHandle(),
+      paneKey: mintStructuredWorkerPaneKey(sessionId),
+      orcaSessionId: sessionId
+    }
+  }
+
+  // A binary without the Orca session id column: its bindRun and unbindOtherRunsForPane statements.
+  function olderBinaryRebind(runId: string, handle: string, paneKey: string) {
+    db.db
+      .prepare(
+        `UPDATE runs SET coordinator_handle = ?, coordinator_pane_key = ?,
+           consumer_generation = consumer_generation + 1, updated_at = datetime('now')
+         WHERE id = ?`
+      )
+      .run(handle, paneKey, runId)
+  }
+
+  function olderBinaryUnbind(runId: string) {
+    db.db
+      .prepare(
+        `UPDATE runs SET coordinator_handle = NULL, coordinator_pane_key = NULL,
+           consumer_generation = consumer_generation + 1, updated_at = datetime('now')
+         WHERE id = ?`
+      )
+      .run(runId)
+  }
+
+  /** Unread mail addressed straight to `to`, as a row written before the address was cached. */
+  function strayMail(runId: string, to: string) {
+    const message = directMail(runId, 'term_late', `to ${to}`)
+    db.db.prepare('UPDATE messages SET to_handle = ? WHERE id = ?').run(to, message.id)
+    return message.id
+  }
+
+  it('binds a handle-less session by its Orca session id and remembers its session address', () => {
+    db = new OrchestrationDb(':memory:')
+    const run = createChatRun(CHAT_X_ID)
+
+    expect(db.getRunRaw(run.id)).toMatchObject({
+      coordinator_handle: null,
+      coordinator_pane_key: null,
+      coordinator_orca_session_id: CHAT_X_ID
+    })
+    expect(db.getCurrentRunForCoordinator(chat(CHAT_X_ID))?.id).toBe(run.id)
+    expect(db.getRunMailboxOwnerIdsForHandle(CHAT_X)).toEqual([run.id])
+    // Mail to the session's address reaches the Run mailbox, as mail to a coordinator handle does.
+    expect(directMail(run.id, CHAT_X).to_handle).toBe(`run:${run.id}`)
+  })
+
+  it("never unbinds another session's Run, and unbinds only the same session's other Runs", () => {
+    db = new OrchestrationDb(':memory:')
+    const ptyRun = db.createRun({
+      objective: 'pty',
+      coordinatorHandle: 'term_pty',
+      coordinatorPaneKey: PTY_PANE
+    })
+    const yRun = createChatRun(CHAT_Y_ID, 'y')
+    const xFirst = createChatRun(CHAT_X_ID, 'x first')
+    const pending = db.insertMessage({
+      from: 'term_sender',
+      to: 'term_late',
+      subject: 'queued before the rebind',
+      body: '',
+      runId: xFirst.id
+    })
+    // Mail addressed to the session that the cache did not reroute on insert, as a pre-cache row.
+    db.db.prepare('UPDATE messages SET to_handle = ? WHERE id = ?').run(CHAT_X, pending.id)
+    const generation = db.getRunRaw(xFirst.id)?.consumer_generation ?? 0
+
+    const xSecond = createChatRun(CHAT_X_ID, 'x second')
+
+    expect(db.getCurrentRunForCoordinator(chat(CHAT_X_ID))?.id).toBe(xSecond.id)
+    expect(db.getCurrentRunForCoordinator(chat(CHAT_Y_ID))?.id).toBe(yRun.id)
+    expect(db.getRunRaw(yRun.id)?.coordinator_orca_session_id).toBe(CHAT_Y_ID)
+    expect(db.getRunRaw(ptyRun.id)?.coordinator_pane_key).toBe(PTY_PANE)
+    expect(db.getRunRaw(xFirst.id)).toMatchObject({
+      coordinator_handle: null,
+      coordinator_orca_session_id: null,
+      consumer_generation: generation + 1
+    })
+    // Pending coordinator mail follows the Run, as it does when a pane is unbound.
+    expect(db.getMessageById(pending.id)?.to_handle).toBe(`run:${xFirst.id}`)
+  })
+
+  it('stops counting an Orca session id once a binary without the column rebinds the Run to a terminal', () => {
+    db = new OrchestrationDb(':memory:')
+    const run = createChatRun(CHAT_X_ID)
+    olderBinaryRebind(run.id, 'term_taker', PTY_PANE)
+
+    expect(db.getCurrentRunForCoordinator(chat(CHAT_X_ID))).toBeUndefined()
+    expect(
+      db.getCurrentRunForCoordinator({
+        terminalHandle: 'term_taker',
+        paneKey: PTY_PANE,
+        orcaSessionId: null
+      })?.id
+    ).toBe(run.id)
+    createChatRun(CHAT_X_ID, 'next')
+    expect(db.getRunRaw(run.id)?.coordinator_handle).toBe('term_taker')
+  })
+
+  it('does not hand a chat back a Run an older binary rebound and then unbound', () => {
+    db = new OrchestrationDb(':memory:')
+    const run = createChatRun(CHAT_X_ID)
+    olderBinaryRebind(run.id, 'term_taker', PTY_PANE)
+    olderBinaryUnbind(run.id)
+
+    // Handle and pane are gone and the id is still there: the shape of a live chat binding.
+    expect(db.getRunRaw(run.id)).toMatchObject({
+      coordinator_handle: null,
+      coordinator_pane_key: null,
+      coordinator_orca_session_id: CHAT_X_ID
+    })
+    expect(db.getCurrentRunForCoordinator(chat(CHAT_X_ID))).toBeUndefined()
+    const next = createChatRun(CHAT_X_ID, 'next')
+    expect(db.getCurrentRunForCoordinator(chat(CHAT_X_ID))?.id).toBe(next.id)
+  })
+
+  it("stops counting a structured worker's Orca session id once an older binary unbinds its Run", () => {
+    db = new OrchestrationDb(':memory:')
+    const worker = structuredWorker()
+    const run = db.createRun({
+      objective: 'worker coordinates',
+      coordinatorHandle: worker.terminalHandle,
+      coordinatorPaneKey: worker.paneKey,
+      coordinatorOrcaSessionId: worker.orcaSessionId
+    })
+    expect(db.getCurrentRunForCoordinator(worker)?.id).toBe(run.id)
+    olderBinaryUnbind(run.id)
+    expect(db.getCurrentRunForCoordinator(worker)).toBeUndefined()
+    expect(db.getCurrentRunForCoordinator(chat(worker.orcaSessionId))).toBeUndefined()
+  })
+
+  it('remembers a coordinating structured worker at its handle, and the v42 trigger its inert session address', () => {
+    db = new OrchestrationDb(':memory:')
+    const worker = structuredWorker()
+    const run = db.createRun({
+      objective: 'worker coordinates',
+      coordinatorHandle: worker.terminalHandle,
+      coordinatorPaneKey: worker.paneKey,
+      coordinatorOrcaSessionId: worker.orcaSessionId
+    })
+
+    expect(db.getRunMailboxOwnerIdsForHandle(worker.terminalHandle)).toEqual([run.id])
+    expect(db.getRunMailboxOwnerIdsForHandle(WORKER_ADDRESS)).toEqual([run.id])
+    expect(directMail(run.id, WORKER_ADDRESS).to_handle).toBe(`run:${run.id}`)
+  })
+
+  it('hands a Run to a different session like a terminal takeover: fenced, rerouted, remembered', () => {
+    db = new OrchestrationDb(':memory:')
+    const run = createChatRun(CHAT_X_ID)
+    const pending = directMail(run.id, 'term_late')
+    db.db.prepare('UPDATE messages SET to_handle = ? WHERE id = ?').run(CHAT_X, pending.id)
+    const before = db.getRunRaw(run.id)?.consumer_generation ?? 0
+
+    db.bindRun({
+      runId: run.id,
+      coordinatorHandle: null,
+      coordinatorPaneKey: null,
+      coordinatorOrcaSessionId: CHAT_Y_ID
+    })
+
+    expect(db.getRunRaw(run.id)).toMatchObject({
+      coordinator_orca_session_id: CHAT_Y_ID,
+      consumer_generation: before + 1
+    })
+    expect(db.getCurrentRunForCoordinator(chat(CHAT_X_ID))).toBeUndefined()
+    expect(db.getCurrentRunForCoordinator(chat(CHAT_Y_ID))?.id).toBe(run.id)
+    expect(db.getMessageById(pending.id)?.to_handle).toBe(`run:${run.id}`)
+    expect(db.getRunMailboxOwnerIdsForHandle(CHAT_Y)).toEqual([run.id])
+  })
+
+  it('rebinding the same session is not a new consumer, and fills a missing Orca session id in place', () => {
+    db = new OrchestrationDb(':memory:')
+    const worker = structuredWorker()
+    const run = db.createRun({
+      objective: 'worker coordinates',
+      coordinatorHandle: worker.terminalHandle,
+      coordinatorPaneKey: worker.paneKey
+    })
+    // As an older binary writes the row: no Orca session id, and no generation for one.
+    db.db
+      .prepare('UPDATE runs SET coordinator_orca_session_id_generation = NULL WHERE id = ?')
+      .run(run.id)
+    const before = db.getRunRaw(run.id)?.consumer_generation
+
+    db.bindRun({
+      runId: run.id,
+      coordinatorHandle: worker.terminalHandle,
+      coordinatorPaneKey: worker.paneKey,
+      coordinatorOrcaSessionId: worker.orcaSessionId
+    })
+
+    expect(db.getRunRaw(run.id)).toMatchObject({
+      coordinator_orca_session_id: WORKER_SESSION,
+      consumer_generation: before
+    })
+    // Written at the current generation, so the filled id counts on its own.
+    expect(db.getCurrentRunForCoordinator(chat(WORKER_SESSION))?.id).toBe(run.id)
+  })
+
+  it("reroutes and remembers each worker's one mailbox address when one takes a Run from another", () => {
+    db = new OrchestrationDb(':memory:')
+    const first = structuredWorker()
+    const second = structuredWorker(OTHER_WORKER_SESSION)
+    const run = db.createRun({
+      objective: 'first worker coordinates',
+      coordinatorHandle: first.terminalHandle,
+      coordinatorPaneKey: first.paneKey,
+      coordinatorOrcaSessionId: first.orcaSessionId
+    })
+    // A worker's mailbox address is its handle; nothing writes mail to its session address.
+    const addresses = [first.terminalHandle, second.terminalHandle]
+    const stray = addresses.map((address) => strayMail(run.id, address))
+
+    db.bindRun({
+      runId: run.id,
+      coordinatorHandle: second.terminalHandle,
+      coordinatorPaneKey: second.paneKey,
+      coordinatorOrcaSessionId: second.orcaSessionId
+    })
+
+    for (const id of stray) {
+      expect(db.getMessageById(id)?.to_handle).toBe(`run:${run.id}`)
+    }
+    for (const address of addresses) {
+      expect(db.getRunMailboxOwnerIdsForHandle(address)).toEqual([run.id])
+    }
+  })
+
+  it("reroutes a worker's mailbox address when its next Run unbinds the last", () => {
+    db = new OrchestrationDb(':memory:')
+    const worker = structuredWorker()
+    const bind = {
+      coordinatorHandle: worker.terminalHandle,
+      coordinatorPaneKey: worker.paneKey,
+      coordinatorOrcaSessionId: worker.orcaSessionId
+    }
+    const last = db.createRun({ objective: 'last', ...bind })
+    const stray = [strayMail(last.id, worker.terminalHandle)]
+
+    db.createRun({ objective: 'next', ...bind })
+
+    for (const id of stray) {
+      expect(db.getMessageById(id)?.to_handle).toBe(`run:${last.id}`)
+    }
+  })
+})
+
+describe('Dispatch Orca session ids recorded by every writer', () => {
+  let db: OrchestrationDb
+
+  afterEach(() => {
+    db?.close()
+  })
+
+  it('records the assignee Orca session id from a structured incarnation and a creator one', () => {
+    db = new OrchestrationDb(':memory:')
+    const run = db.createRun({
+      objective: 'r',
+      coordinatorHandle: null,
+      coordinatorPaneKey: null,
+      coordinatorOrcaSessionId: CHAT_X_ID
+    })
+    const handle = mintStructuredWorkerHandle()
+    const assigned = db.createDispatchContext({
+      taskId: db.createTask({ runId: run.id, spec: 'structured' }).id,
+      assigneeHandle: handle,
+      assigneePaneKey: mintStructuredWorkerPaneKey(WORKER_SESSION),
+      processIncarnation: structuredWorkerProcessIncarnation(WORKER_SESSION),
+      creator: { kind: 'session', orcaSessionId: CHAT_X_ID },
+      maxDepth: UNCAPPED
+    })
+    const pty = db.createDispatchContext({
+      taskId: db.createTask({ runId: run.id, spec: 'pty' }).id,
+      assigneeHandle: 'term_pty',
+      assigneePaneKey: PTY_PANE,
+      processIncarnation: 'pty_proc:1',
+      creator: { kind: 'terminal', handle: 'term_c', paneKey: OTHER_PANE },
+      maxDepth: UNCAPPED
+    })
+
+    expect(assigned).toMatchObject({
+      assignee_orca_session_id: WORKER_SESSION,
+      creator_handle: null,
+      creator_pane_key: null,
+      creator_orca_session_id: CHAT_X_ID
+    })
+    expect(pty).toMatchObject({ assignee_orca_session_id: null, creator_orca_session_id: null })
+  })
+
+  it('nests under the Dispatch a handle-less creator is assigned by its Orca session id', () => {
+    db = new OrchestrationDb(':memory:')
+    const run = db.createRun({
+      objective: 'r',
+      coordinatorHandle: 'term_c',
+      coordinatorPaneKey: OTHER_PANE
+    })
+    const parent = db.createDispatchContext({
+      taskId: db.createTask({ runId: run.id, spec: 'parent' }).id,
+      assigneeHandle: mintStructuredWorkerHandle(),
+      assigneePaneKey: mintStructuredWorkerPaneKey(WORKER_SESSION),
+      processIncarnation: structuredWorkerProcessIncarnation(WORKER_SESSION),
+      creator: { kind: 'system' },
+      maxDepth: UNCAPPED
+    })
+
+    const child = db.createDispatchContext({
+      taskId: db.createTask({ runId: run.id, spec: 'child' }).id,
+      assigneeHandle: 'term_child',
+      assigneePaneKey: PTY_PANE,
+      processIncarnation: 'pty_proc:2',
+      creator: { kind: 'session', orcaSessionId: WORKER_SESSION },
+      maxDepth: UNCAPPED
+    })
+
+    expect(child).toMatchObject({ creator_dispatch_id: parent.id, depth: parent.depth + 1 })
+  })
+
+  it('records the starting creator and the attached assignee of a worker-start', () => {
+    db = new OrchestrationDb(':memory:')
+    const run = db.createRun({
+      objective: 'r',
+      coordinatorHandle: null,
+      coordinatorPaneKey: null,
+      coordinatorOrcaSessionId: CHAT_X_ID
+    })
+    const started = db.createStartingWorkerDispatch({
+      creator: { kind: 'session', orcaSessionId: CHAT_X_ID },
+      maxDepth: UNCAPPED,
+      taskSpec: 'work',
+      taskRunId: run.id,
+      startOptions: {}
+    })
+    expect(started.dispatch).toMatchObject({
+      creator_orca_session_id: CHAT_X_ID,
+      assignee_orca_session_id: null
+    })
+
+    const handle = mintStructuredWorkerHandle()
+    db.prepareStartingWorkerAuthority({
+      dispatchId: started.dispatch.id,
+      handle,
+      paneKey: mintStructuredWorkerPaneKey(WORKER_SESSION),
+      processIncarnation: structuredWorkerProcessIncarnation(WORKER_SESSION),
+      worktreeId: 'wt_1',
+      effects: [],
+      setupState: 'not_applicable'
+    })
+
+    expect(db.getDispatchContextById(started.dispatch.id)?.assignee_orca_session_id).toBe(
+      WORKER_SESSION
+    )
+  })
+})
diff --git a/src/main/runtime/orchestration/db/runs/run-coordinator-orca-session.ts b/src/main/runtime/orchestration/db/runs/run-coordinator-orca-session.ts
index 2ed9d9809a29..007e979df4d8 100644
--- a/src/main/runtime/orchestration/db/runs/run-coordinator-orca-session.ts
+++ b/src/main/runtime/orchestration/db/runs/run-coordinator-orca-session.ts
@@ -1,4 +1,5 @@
-import { ORCA_SESSION_ADDRESS_PREFIX } from '../../../../../shared/orca-session-address'
+import { orcaSessionAddressSql } from '../orca-session-address-sql'
+import type { OrcaSessionId } from '../../../../../shared/orca-session-address'
 import type { RunRow } from '../../types'
 
 type RunCoordinatorOrcaSessionFields = Pick<
@@ -13,7 +14,7 @@ type RunCoordinatorOrcaSessionFields = Pick<
  */
 export function currentRunCoordinatorOrcaSessionId(
   run: RunCoordinatorOrcaSessionFields
-): string | null {
+): OrcaSessionId | null {
   return run.coordinator_orca_session_id_generation === run.consumer_generation
     ? run.coordinator_orca_session_id
     : null
@@ -27,5 +28,5 @@ export function currentRunCoordinatorOrcaSessionIdSql(row: string): string {
 
 /** The coordinator's `session:<id>` address in SQL; NULL when it has no current Orca session id. */
 export function currentRunCoordinatorSessionAddressSql(row: string): string {
-  return `('${ORCA_SESSION_ADDRESS_PREFIX}' || ${currentRunCoordinatorOrcaSessionIdSql(row)})`
+  return orcaSessionAddressSql(currentRunCoordinatorOrcaSessionIdSql(row))
 }
diff --git a/src/main/runtime/orchestration/db/runs/run-create.ts b/src/main/runtime/orchestration/db/runs/run-create.ts
index 3f99e0189362..9b7eab6ab0d2 100644
--- a/src/main/runtime/orchestration/db/runs/run-create.ts
+++ b/src/main/runtime/orchestration/db/runs/run-create.ts
@@ -1,6 +1,8 @@
 import type { RunRow } from '../../types'
 import { generateId } from '../generated-id'
 import type { OrchestrationDb } from '../orchestration-db'
+import type { OrcaSessionId } from '../../../../../shared/orca-session-address'
+import { mailboxAddressOf } from '../../orchestration-caller-identity'
 
 // ── Runs ──
 
@@ -8,23 +10,39 @@ export function createRun(
   this: OrchestrationDb,
   params: {
     objective: string
-    coordinatorHandle: string
-    coordinatorPaneKey: string
+    coordinatorHandle: string | null
+    coordinatorPaneKey: string | null
+    /** The coordinator's bare Orca session id when it is a structured session; see orca-session-address. */
+    coordinatorOrcaSessionId?: OrcaSessionId | null
   }
 ): RunRow {
+  const coordinator = {
+    terminalHandle: params.coordinatorHandle,
+    paneKey: params.coordinatorPaneKey,
+    orcaSessionId: params.coordinatorOrcaSessionId ?? null
+  }
   const id = generateId('run')
   this.db.exec('BEGIN IMMEDIATE')
   try {
-    this.unbindOtherRunsForPane(params.coordinatorPaneKey)
+    this.unbindOtherRunsForCoordinator(coordinator)
     this.db
       .prepare(
         `INSERT INTO runs (
-           id, objective, coordinator_handle, coordinator_pane_key,
-           consumer_generation, legacy
-         ) VALUES (?, ?, ?, ?, 1, 0)`
+           id, objective, coordinator_handle, coordinator_pane_key, coordinator_orca_session_id,
+           coordinator_orca_session_id_generation, consumer_generation, legacy
+         ) VALUES (?, ?, ?, ?, ?, 1, 1, 0)`
+      )
+      .run(
+        id,
+        params.objective,
+        coordinator.terminalHandle,
+        coordinator.paneKey,
+        coordinator.orcaSessionId
       )
-      .run(id, params.objective, params.coordinatorHandle, params.coordinatorPaneKey)
-    this.rememberRunCoordinatorHandle(id, params.coordinatorHandle)
+    const address = mailboxAddressOf(coordinator)
+    if (address !== null) {
+      this.rememberRunCoordinatorHandle(id, address)
+    }
     this.db.exec('COMMIT')
   } catch (error) {
     this.db.exec('ROLLBACK')
diff --git a/src/main/runtime/orchestration/db/runs/run-lookup.ts b/src/main/runtime/orchestration/db/runs/run-lookup.ts
index 0a60b4e7f9d3..94a57c345a38 100644
--- a/src/main/runtime/orchestration/db/runs/run-lookup.ts
+++ b/src/main/runtime/orchestration/db/runs/run-lookup.ts
@@ -1,4 +1,10 @@
 import type { RunRow } from '../../types'
+import {
+  mailboxAddressOf,
+  runBoundToCoordinator,
+  runCoordinatorKey,
+  type OrchestrationCoordinatorKey
+} from '../../orchestration-caller-identity'
 import { ORCHESTRATION_RUN_PAGE_LIMIT } from '../../../../../shared/orchestration-run-pagination'
 import {
   isEquivalentPaneKey,
@@ -22,6 +28,13 @@ const RUNS_BOUND_TO_PANE_SQL = `SELECT ${RUN_COLUMN_LIST} FROM runs
          WHERE coordinator_pane_key IS NOT NULL AND legacy = 0
            AND ${RUN_PANE_KEY_MATCH_SUFFIX_SQL} = ?
          ORDER BY rowid`
+// Why: one statement so pane and Orca session id matches keep a single rowid order; the JS predicate decides.
+const RUNS_BOUND_TO_COORDINATOR_SQL = `SELECT ${RUN_COLUMN_LIST} FROM runs
+         WHERE legacy = 0 AND (
+           (coordinator_pane_key IS NOT NULL AND ${RUN_PANE_KEY_MATCH_SUFFIX_SQL} = ?)
+           OR coordinator_orca_session_id = ?
+         )
+         ORDER BY rowid`
 
 export function getRun(this: OrchestrationDb, id: string): RunRow | undefined {
   const run = this.getRunRaw(id)
@@ -122,15 +135,38 @@ export function getRunRaw(this: OrchestrationDb, id: string): RunRow | undefined
   return this.db.prepare(RUN_BY_ID_SQL).get(id) as RunRow | undefined
 }
 
-export function unbindOtherRunsForPane(
+export function getCurrentRunForCoordinator(
+  this: OrchestrationDb,
+  caller: OrchestrationCoordinatorKey
+): RunRow | undefined {
+  const run = this.runsBoundToCoordinator(caller)[0]
+  return run ? exposeRunTimestamps(run) : undefined
+}
+
+/** Runs bound to this caller by pane or by Orca session id; a caller without one matches as before. */
+export function runsBoundToCoordinator(
+  this: OrchestrationDb,
+  caller: OrchestrationCoordinatorKey
+): RunRow[] {
+  if (caller.orcaSessionId === null) {
+    return caller.paneKey === null ? [] : this.runsBoundToPane(caller.paneKey)
+  }
+  const suffix = caller.paneKey === null ? null : paneKeyMatchSuffix(caller.paneKey)
+  const rows = this.db.prepare(RUNS_BOUND_TO_COORDINATOR_SQL).all(suffix, caller.orcaSessionId)
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: SELECT * over this table returns the row shape its schema and row type define, like every row cast in db/.
+  return (rows as RunRow[]).filter((run) => runBoundToCoordinator(run, caller))
+}
+
+export function unbindOtherRunsForCoordinator(
   this: OrchestrationDb,
-  paneKey: string,
+  caller: OrchestrationCoordinatorKey,
   exceptRunId?: string
 ): void {
-  for (const run of this.runsBoundToPane(paneKey)) {
+  for (const run of this.runsBoundToCoordinator(caller)) {
     if (run.id !== exceptRunId) {
-      if (run.coordinator_handle) {
-        this.routeAllUnreadDirectMessagesToRunMailbox(run.id, run.coordinator_handle)
+      const address = mailboxAddressOf(runCoordinatorKey(run))
+      if (address !== null) {
+        this.routeAllUnreadDirectMessagesToRunMailbox(run.id, address)
       }
       this.db
         .prepare(
@@ -160,8 +196,10 @@ export type RunLookupMethods = {
   listRuns: typeof listRuns
   getCurrentRunForPane: typeof getCurrentRunForPane
   runsBoundToPane: typeof runsBoundToPane
+  getCurrentRunForCoordinator: typeof getCurrentRunForCoordinator
+  runsBoundToCoordinator: typeof runsBoundToCoordinator
   getRunRaw: typeof getRunRaw
-  unbindOtherRunsForPane: typeof unbindOtherRunsForPane
+  unbindOtherRunsForCoordinator: typeof unbindOtherRunsForCoordinator
   requireRun: typeof requireRun
 }
 
@@ -173,8 +211,10 @@ export function attachRunLookup(ctor: { prototype: object }): void {
     listRuns,
     getCurrentRunForPane,
     runsBoundToPane,
+    getCurrentRunForCoordinator,
+    runsBoundToCoordinator,
     getRunRaw,
-    unbindOtherRunsForPane,
+    unbindOtherRunsForCoordinator,
     requireRun
   })
 }
diff --git a/src/main/runtime/orchestration/db/schema/structured-worker-orca-session-backfill.test.ts b/src/main/runtime/orchestration/db/schema/structured-worker-orca-session-backfill.test.ts
index 57bf53e7026a..273d7a09aca9 100644
--- a/src/main/runtime/orchestration/db/schema/structured-worker-orca-session-backfill.test.ts
+++ b/src/main/runtime/orchestration/db/schema/structured-worker-orca-session-backfill.test.ts
@@ -96,6 +96,10 @@ describe('structured worker Orca session id backfill', () => {
       processIncarnation: structuredWorkerProcessIncarnation(SESSION_B),
       ownership: 'owned'
     })
+    // Rows a writer without the column left; a current writer records the incarnation's Orca session id.
+    db.db.exec(
+      'UPDATE dispatch_contexts SET assignee_orca_session_id = NULL, creator_orca_session_id = NULL'
+    )
 
     backfillStructuredWorkerOrcaSessionIds(db.db)
 
diff --git a/src/main/runtime/orchestration/db/worker-dispatch/worker-dispatch-authority.ts b/src/main/runtime/orchestration/db/worker-dispatch/worker-dispatch-authority.ts
index 166ccd7193e6..bc7b2c0cc0c0 100644
--- a/src/main/runtime/orchestration/db/worker-dispatch/worker-dispatch-authority.ts
+++ b/src/main/runtime/orchestration/db/worker-dispatch/worker-dispatch-authority.ts
@@ -2,6 +2,7 @@ import { randomBytes } from 'node:crypto'
 import { OrchestrationError } from '../../orchestration-error'
 import { hashDispatchCapability } from '../dispatch-capability-hash'
 import type { OrchestrationDb } from '../orchestration-db'
+import { structuredWorkerOrcaSessionIdForIncarnation } from '../../../structured-worker-identity'
 
 export function prepareStartingWorkerAuthority(
   this: OrchestrationDb,
@@ -53,8 +54,8 @@ export function prepareStartingWorkerAuthority(
     const contextUpdate = this.db
       .prepare(
         `UPDATE dispatch_contexts
-         SET assignee_handle = ?, assignee_pane_key = ?, process_incarnation = ?,
-             assignee_orca_session_id = NULL, host_scope = ?,
+         SET assignee_handle = ?, assignee_pane_key = ?, assignee_orca_session_id = ?,
+             process_incarnation = ?, host_scope = ?,
              capability_hash = ?, launch_token_hash = COALESCE(launch_token_hash, ?),
              capability_revoked_at = NULL,
              consumer_generation = consumer_generation + 1
@@ -63,6 +64,7 @@ export function prepareStartingWorkerAuthority(
       .run(
         params.handle,
         params.paneKey,
+        structuredWorkerOrcaSessionIdForIncarnation(params.processIncarnation),
         params.processIncarnation,
         params.hostScope ?? null,
         hashDispatchCapability(capability),
diff --git a/src/main/runtime/orchestration/db/worker-terminal/failed-start-dispatch-identity.ts b/src/main/runtime/orchestration/db/worker-terminal/failed-start-dispatch-identity.ts
index c9b9b5d0afdf..490cfbb11384 100644
--- a/src/main/runtime/orchestration/db/worker-terminal/failed-start-dispatch-identity.ts
+++ b/src/main/runtime/orchestration/db/worker-terminal/failed-start-dispatch-identity.ts
@@ -1,5 +1,6 @@
 import type { WorkerDispatchRow } from '../../types'
 import type { OrchestrationDb } from '../orchestration-db'
+import { structuredWorkerOrcaSessionIdForIncarnation } from '../../../structured-worker-identity'
 
 /**
  * A start that dies before `prepareStartingWorkerAuthority` never filled the Dispatch context in,
@@ -21,13 +22,14 @@ export function recordFailedStartDispatchIdentity(
   db.db
     .prepare(
       `UPDATE dispatch_contexts
-         SET assignee_handle = ?, assignee_pane_key = ?, process_incarnation = ?, host_scope = ?,
-             assignee_orca_session_id = NULL
+         SET assignee_handle = ?, assignee_pane_key = ?, assignee_orca_session_id = ?,
+             process_incarnation = ?, host_scope = ?
        WHERE id = ? AND status = 'failed' AND capability_hash IS NULL`
     )
     .run(
       resource.terminal_handle,
       resource.pane_key,
+      structuredWorkerOrcaSessionIdForIncarnation(resource.process_incarnation),
       resource.process_incarnation,
       resource.host_scope,
       worker.dispatch_id
diff --git a/src/main/runtime/orchestration/db/worker-terminal/worker-terminal-resource-store.ts b/src/main/runtime/orchestration/db/worker-terminal/worker-terminal-resource-store.ts
index e6942503dbf3..fe26380d5397 100644
--- a/src/main/runtime/orchestration/db/worker-terminal/worker-terminal-resource-store.ts
+++ b/src/main/runtime/orchestration/db/worker-terminal/worker-terminal-resource-store.ts
@@ -123,6 +123,20 @@ export function getWorkerTerminalResourceByHandle(
     .get(terminalHandle) as WorkerTerminalResourceRow | undefined
 }
 
+export function getWorkerTerminalResourceByProcessIncarnation(
+  this: OrchestrationDb,
+  processIncarnation: string
+): WorkerTerminalResourceRow | undefined {
+  const row = this.db
+    .prepare(
+      `SELECT * FROM worker_terminal_resources
+        WHERE process_incarnation = ? ORDER BY updated_at DESC LIMIT 1`
+    )
+    .get(processIncarnation)
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: SELECT * over this table returns the row shape its schema and row type define, like every row cast in db/.
+  return row as WorkerTerminalResourceRow | undefined
+}
+
 export function getWorkerTerminalResourceFormerlyOwnedBy(
   this: OrchestrationDb,
   dispatchId: string
@@ -238,6 +252,7 @@ export type WorkerTerminalResourceStoreMethods = {
   createWorkerTerminalResourceStatement: typeof createWorkerTerminalResourceStatement
   getWorkerTerminalResource: typeof getWorkerTerminalResource
   getWorkerTerminalResourceByHandle: typeof getWorkerTerminalResourceByHandle
+  getWorkerTerminalResourceByProcessIncarnation: typeof getWorkerTerminalResourceByProcessIncarnation
   getWorkerTerminalResourceByOwner: typeof getWorkerTerminalResourceByOwner
   getWorkerTerminalResourceFormerlyOwnedBy: typeof getWorkerTerminalResourceFormerlyOwnedBy
   recordWorkerTerminalRecoveryAttempt: typeof recordWorkerTerminalRecoveryAttempt
@@ -251,6 +266,7 @@ export function attachWorkerTerminalResourceStore(ctor: { prototype: object }):
     createWorkerTerminalResourceStatement,
     getWorkerTerminalResource,
     getWorkerTerminalResourceByHandle,
+    getWorkerTerminalResourceByProcessIncarnation,
     getWorkerTerminalResourceByOwner,
     getWorkerTerminalResourceFormerlyOwnedBy,
     recordWorkerTerminalRecoveryAttempt,
diff --git a/src/main/runtime/orchestration/db/worker-terminal/worker-terminal-transfer.ts b/src/main/runtime/orchestration/db/worker-terminal/worker-terminal-transfer.ts
index 439aca59b017..064ae577e0f1 100644
--- a/src/main/runtime/orchestration/db/worker-terminal/worker-terminal-transfer.ts
+++ b/src/main/runtime/orchestration/db/worker-terminal/worker-terminal-transfer.ts
@@ -81,14 +81,30 @@ export function workerTerminalResourceHasIdentityConflict(
   )
 }
 
+/** Every resource whose process incarnation starts with `prefix`, newest first. */
+export function listWorkerTerminalResourcesByIncarnationPrefix(
+  this: OrchestrationDb,
+  prefix: string
+): WorkerTerminalResourceRow[] {
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: SELECT * over this table is exactly its row shape.
+  return this.db
+    .prepare(
+      `SELECT * FROM worker_terminal_resources
+        WHERE substr(process_incarnation, 1, ?) = ? ORDER BY updated_at DESC`
+    )
+    .all(prefix.length, prefix) as WorkerTerminalResourceRow[]
+}
+
 export type WorkerTerminalTransferMethods = {
   findTransferableWorkerTerminalResource: typeof findTransferableWorkerTerminalResource
   workerTerminalResourceHasIdentityConflict: typeof workerTerminalResourceHasIdentityConflict
+  listWorkerTerminalResourcesByIncarnationPrefix: typeof listWorkerTerminalResourcesByIncarnationPrefix
 }
 
 export function attachWorkerTerminalTransfer(ctor: { prototype: object }): void {
   Object.assign(ctor.prototype, {
     findTransferableWorkerTerminalResource,
-    workerTerminalResourceHasIdentityConflict
+    workerTerminalResourceHasIdentityConflict,
+    listWorkerTerminalResourcesByIncarnationPrefix
   })
 }
diff --git a/src/main/runtime/orchestration/mailbox-pointer-pty-write.ts b/src/main/runtime/orchestration/mailbox-pointer-pty-write.ts
index 8dbedc9b33cf..52016aa1465b 100644
--- a/src/main/runtime/orchestration/mailbox-pointer-pty-write.ts
+++ b/src/main/runtime/orchestration/mailbox-pointer-pty-write.ts
@@ -24,7 +24,8 @@ export function writeOrchestrationPointerWithSettlement(
     return writeRefused('provider_cannot_settle')
   }
   try {
-    return settledWrite.call(args.controller, args.ptyId, args.data)
+    // Why driving: a pointer is input that tells a running agent to read its mail.
+    return settledWrite.call(args.controller, args.ptyId, args.data, 'driving')
   } catch {
     // A partial write that then threw cannot prove the transport took nothing.
     return writeUnverifiable('provider_threw_after_handoff', true)
diff --git a/src/main/runtime/orchestration/orchestration-caller-identity.ts b/src/main/runtime/orchestration/orchestration-caller-identity.ts
new file mode 100644
index 000000000000..cce3cecd5484
--- /dev/null
+++ b/src/main/runtime/orchestration/orchestration-caller-identity.ts
@@ -0,0 +1,76 @@
+import type { RunRow } from './types'
+import { isEquivalentPaneKey } from './db/pane-key-match'
+import { currentRunCoordinatorOrcaSessionId } from './db/runs/run-coordinator-orca-session'
+import { formatOrcaSessionAddress, type OrcaSessionId } from '../../../shared/orca-session-address'
+
+/**
+ * Who an orchestration caller is, as Run binding and mail routing match it.
+ *
+ * A PTY agent is its terminal: a handle and a pane key, no Orca session id. An agent that is a
+ * structured session is its Orca session id, addressed as `session:<id>`; a structured worker also
+ * has the handle and pane key it was minted, and an ordinary chat has neither. Methods pass this
+ * through whole and never branch on which fields are set; the lookups below own that.
+ */
+export type OrchestrationCallerIdentity = Readonly<{
+  /** Mailbox address the caller sends from and reads: its terminal handle, else its session address. */
+  address: string
+  terminalHandle: string | null
+  paneKey: string | null
+  /** The bare Orca session id the caller is addressed by; mail spells it `session:<id>`. */
+  orcaSessionId: OrcaSessionId | null
+}>
+
+/** The part of a caller a Run binding stores and matches. */
+export type OrchestrationCoordinatorKey = Pick<
+  OrchestrationCallerIdentity,
+  'terminalHandle' | 'paneKey' | 'orcaSessionId'
+>
+
+/** A caller the dispatch entry resolved from the Orca session id in its injected environment. */
+export type OrchestrationSessionCaller = OrchestrationCallerIdentity &
+  Readonly<{
+    orcaSessionId: OrcaSessionId
+    /** The session record the request came from. */
+    sessionId: OrcaSessionId
+    /** Where the session runs, from its record; `worker-start --worktree current` places here. */
+    workspaceId: string
+  }>
+
+/** A caller with neither a pane nor an Orca session id can never be bound to a Run. */
+export function hasRunBindingKey(caller: OrchestrationCoordinatorKey): boolean {
+  return caller.paneKey !== null || caller.orcaSessionId !== null
+}
+
+/** The one address a party reads mail at and is sent mail at; null for a key naming nobody. */
+export function mailboxAddressOf(
+  party: Pick<OrchestrationCoordinatorKey, 'terminalHandle' | 'orcaSessionId'>
+): string | null {
+  // Handle first because a worker's mail and Dispatch rows are keyed by it today; flips when sessions become canonical.
+  if (party.terminalHandle !== null) {
+    return party.terminalHandle
+  }
+  return party.orcaSessionId === null ? null : formatOrcaSessionAddress(party.orcaSessionId)
+}
+
+/** Who a Run's binding names now; an Orca session id an older binding left behind is not part of it. */
+export function runCoordinatorKey(run: RunRow): OrchestrationCoordinatorKey {
+  return {
+    terminalHandle: run.coordinator_handle,
+    paneKey: run.coordinator_pane_key,
+    orcaSessionId: currentRunCoordinatorOrcaSessionId(run)
+  }
+}
+
+export function runBoundToCoordinator(run: RunRow, caller: OrchestrationCoordinatorKey): boolean {
+  if (
+    caller.paneKey !== null &&
+    run.coordinator_pane_key !== null &&
+    isEquivalentPaneKey(run.coordinator_pane_key, caller.paneKey)
+  ) {
+    return true
+  }
+  return (
+    caller.orcaSessionId !== null &&
+    currentRunCoordinatorOrcaSessionId(run) === caller.orcaSessionId
+  )
+}
diff --git a/src/main/runtime/orchestration/orchestration-orca-session-column-migration.test.ts b/src/main/runtime/orchestration/orchestration-orca-session-column-migration.test.ts
index 69186334828b..b721dcc166e8 100644
--- a/src/main/runtime/orchestration/orchestration-orca-session-column-migration.test.ts
+++ b/src/main/runtime/orchestration/orchestration-orca-session-column-migration.test.ts
@@ -11,6 +11,7 @@ import {
 import { OrchestrationDb } from './db'
 import { SCHEMA_VERSION } from './db/contract-constants'
 import { formatOrcaSessionAddress } from '../../../shared/orca-session-address'
+import { testOrcaSessionId } from '../../../shared/orca-session-address-test-fixture'
 import { RUN_PANE_KEY_MATCH_SUFFIX_SQL } from './db/pane-key-match'
 import {
   currentRunCoordinatorOrcaSessionId,
@@ -18,8 +19,8 @@ import {
 } from './db/runs/run-coordinator-orca-session'
 import { resolveOrchestrationMigrationStartVersion } from './orchestration-schema-version-skew'
 
-const SESSION_ID = '5f0c1d9e-2b7a-4c3e-8f61-0a9d2e7b4c11'
-const CHAT_SESSION_ID = '9a4e7c1b-3d2f-4b6a-8e5c-7f1d0b2a6c93'
+const SESSION_ID = testOrcaSessionId('5f0c1d9e-2b7a-4c3e-8f61-0a9d2e7b4c11')
+const CHAT_SESSION_ID = testOrcaSessionId('9a4e7c1b-3d2f-4b6a-8e5c-7f1d0b2a6c93')
 const CHAT_SESSION_ADDRESS = formatOrcaSessionAddress(CHAT_SESSION_ID)
 const ORCA_SESSION_ID_COLUMNS = [
   'assignee_orca_session_id',
@@ -49,6 +50,25 @@ const HANDLE_ONLY_COORDINATOR_TRIGGERS_SQL = `
     VALUES (NEW.id, NEW.coordinator_handle);
   END;`
 
+// The mail routing trigger as main recreated it on every open at v41 and before: handle-only.
+const HANDLE_ONLY_MAIL_ROUTING_TRIGGER_SQL = `
+  CREATE TRIGGER trg_messages_route_coordinator_mail
+  AFTER INSERT ON messages
+  WHEN NEW.read = 0 AND NEW.delivery_contract = 'current_delivery'
+    AND EXISTS (SELECT 1 FROM runs WHERE runs.id = NEW.run_id AND runs.legacy = 0)
+    AND EXISTS (
+      SELECT 1 FROM run_coordinator_handles
+      WHERE run_id = NEW.run_id AND terminal_handle = NEW.to_handle
+    )
+    AND NOT EXISTS (
+      SELECT 1 FROM dispatch_contexts
+      WHERE run_id = NEW.run_id AND assignee_handle = NEW.to_handle
+        AND status IN ('pending', 'dispatched')
+    )
+  BEGIN
+    UPDATE messages SET to_handle = 'run:' || NEW.run_id WHERE sequence = NEW.sequence;
+  END;`
+
 const V41_RUN_COLUMNS =
   'id, objective, home_database, coordinator_handle, coordinator_pane_key, consumer_generation, legacy, created_at, updated_at'
 
@@ -117,11 +137,13 @@ function stripOrcaSessionSchema(path: string, version: number): void {
     DROP INDEX idx_dispatch_assignee_orca_session_id;
     DROP TRIGGER trg_runs_remember_coordinator_insert;
     DROP TRIGGER trg_runs_remember_coordinator_update;
+    DROP TRIGGER trg_messages_route_coordinator_mail;
     ALTER TABLE runs DROP COLUMN coordinator_orca_session_id;
     ALTER TABLE runs DROP COLUMN coordinator_orca_session_id_generation;
     ALTER TABLE dispatch_contexts DROP COLUMN assignee_orca_session_id;
     ALTER TABLE dispatch_contexts DROP COLUMN creator_orca_session_id;
     ${HANDLE_ONLY_COORDINATOR_TRIGGERS_SQL}
+    ${HANDLE_ONLY_MAIL_ROUTING_TRIGGER_SQL}
   `)
   raw.pragma(`user_version = ${version}`)
   raw.close()
@@ -419,8 +441,11 @@ describe('orchestration Orca session id column migration', () => {
   it('fills structured-worker rows written after the stamp reached v42 on the next open', () => {
     const path = tempDbPath()
     const first = new OrchestrationDb(path)
-    // No writer records an Orca session id yet, which is also the shape a binary rolled back past v42 writes.
     const rows = seedStructuredAndPtyRows(first)
+    // The shape a binary rolled back past v42 writes: its INSERTs name no Orca session id column.
+    first.db.exec(
+      'UPDATE dispatch_contexts SET assignee_orca_session_id = NULL, creator_orca_session_id = NULL; UPDATE runs SET coordinator_orca_session_id = NULL'
+    )
     expect(
       first.getDispatchContextById(rows.structuredDispatchId)?.assignee_orca_session_id
     ).toBeNull()
diff --git a/src/main/runtime/orchestration/orchestration-party.ts b/src/main/runtime/orchestration/orchestration-party.ts
new file mode 100644
index 000000000000..65b6d7a5c5ae
--- /dev/null
+++ b/src/main/runtime/orchestration/orchestration-party.ts
@@ -0,0 +1,108 @@
+// The one place an orchestration address becomes a party, so no two sites can disagree on who it names.
+import {
+  formatOrcaSessionAddress,
+  isOrcaSessionId,
+  parseOrcaSessionAddress,
+  type OrcaSessionId
+} from '../../../shared/orca-session-address'
+import { ORCHESTRATION_SESSION_CALLER_ERROR_CODES as CODES } from '../../../shared/orchestration-session-caller-codes'
+import {
+  isRecordedStructuredWorkerSession,
+  resolveStructuredWorkerIdentity,
+  resolveStructuredWorkerIdentityForSession
+} from '../structured-worker-authority'
+import { canonicalOrcaSessionId } from './canonical-orca-session-id'
+import type { OrchestrationDb } from './db'
+import { mailboxAddressOf, type OrchestrationCallerIdentity } from './orchestration-caller-identity'
+import { OrchestrationError } from './orchestration-error'
+
+/** A party as Run binding and mail routing match it; `address` is its one mailbox address. */
+export type OrchestrationParty = OrchestrationCallerIdentity
+
+/** A party named by an Orca session id: a structured worker, or a chat. */
+export type OrchestrationSessionParty = OrchestrationParty &
+  Readonly<{ orcaSessionId: OrcaSessionId }>
+
+const NO_EFFECTS = { effectsApplied: false } as const
+
+/** Every param naming a party other than the caller; a new one is added here with its own test. */
+export const ORCHESTRATION_TARGET_PARAM: Readonly<Record<string, 'to' | 'terminal'>> = {
+  'orchestration.send': 'to',
+  'orchestration.ask': 'to',
+  'orchestration.dispatch': 'to',
+  'orchestration.inbox': 'terminal'
+}
+
+/** The party an Orca session id names. Throws when it is a worker this host lost the identity of. */
+export function resolveOrcaSessionParty(
+  orcaSessionId: OrcaSessionId,
+  db: OrchestrationDb | null | undefined
+): OrchestrationSessionParty {
+  const id = canonicalOrcaSessionId(orcaSessionId)
+  const worker = resolveStructuredWorkerIdentityForSession(id, db)
+  if (!worker && db && isRecordedStructuredWorkerSession(id, db)) {
+    // Why: handle-less, it would split one worker into two parties and bind like a chat.
+    throw new OrchestrationError(
+      CODES.notLive,
+      `Agent session ${id} is a structured worker whose worker identity this host no longer has, so orchestration cannot address it. No effects were applied.`,
+      NO_EFFECTS
+    )
+  }
+  const key = { terminalHandle: worker?.handle ?? null, orcaSessionId: id }
+  return {
+    ...key,
+    address: mailboxAddressOf(key) ?? formatOrcaSessionAddress(id),
+    paneKey: worker?.paneKey ?? null
+  }
+}
+
+/** The party an address names; a PTY handle is itself and costs no lookup. */
+export function resolveOrchestrationParty(
+  address: string,
+  db: OrchestrationDb | null | undefined
+): OrchestrationParty {
+  const orcaSessionId = parseOrcaSessionAddress(address)
+  if (orcaSessionId) {
+    return resolveOrcaSessionParty(orcaSessionId, db)
+  }
+  const worker = resolveStructuredWorkerIdentity(address, db)
+  return {
+    address,
+    terminalHandle: address,
+    paneKey: worker?.paneKey ?? null,
+    orcaSessionId:
+      worker && isOrcaSessionId(worker.sessionId) ? canonicalOrcaSessionId(worker.sessionId) : null
+  }
+}
+
+/** A caller named by a param: naming a chat's address proves nothing, unlike its own session id. */
+export function resolveDeclaredCallerParty(
+  address: string,
+  db: OrchestrationDb | null | undefined
+): OrchestrationParty {
+  const party = resolveOrchestrationParty(address, db)
+  if (party.terminalHandle === null) {
+    throw new OrchestrationError(
+      CODES.chatNotDeclarable,
+      `Agent session ${party.orcaSessionId} is a chat, and a chat is identified only by the session id its own environment sends, never by naming its address. No effects were applied.`,
+      NO_EFFECTS
+    )
+  }
+  return party
+}
+
+/** A Dispatch assignee: a terminal or a structured worker, never a chat yet. */
+export function resolveDispatchAssigneeParty(
+  address: string,
+  db: OrchestrationDb | null | undefined
+): OrchestrationParty {
+  const party = resolveOrchestrationParty(address, db)
+  if (party.terminalHandle === null) {
+    throw new OrchestrationError(
+      CODES.chatNotDispatchable,
+      `Agent session ${party.orcaSessionId} is a chat, and a chat can't receive a dispatch yet. Start a worker with worker-start instead. No effects were applied.`,
+      NO_EFFECTS
+    )
+  }
+  return party
+}
diff --git a/src/main/runtime/orchestration/preamble.ts b/src/main/runtime/orchestration/preamble.ts
index 208868ce45ba..a9fbb528939f 100644
--- a/src/main/runtime/orchestration/preamble.ts
+++ b/src/main/runtime/orchestration/preamble.ts
@@ -147,12 +147,13 @@ ${params.taskSpec}`
 
 export type DispatchPreambleSendOptions = Pick<
   RuntimeAgentPromptWriteOptions,
-  'leadLine' | 'acceptQueued' | 'observationTimeoutMs' | 'requestId'
+  'leadLine' | 'acceptQueued' | 'observationTimeoutMs' | 'requestId' | 'inputKind'
 >
 
 export function dispatchPreambleSendOptions(requestId: string): DispatchPreambleSendOptions {
   // Why: a delayed provider hook must not revoke an accepted Dispatch.
   return {
+    inputKind: 'driving',
     leadLine: ORCA_DISPATCH_PROMPT_LEAD_LINE,
     acceptQueued: true,
     observationTimeoutMs: 0,
diff --git a/src/main/runtime/orchestration/run-coordinator-orca-session-address.test.ts b/src/main/runtime/orchestration/run-coordinator-orca-session-address.test.ts
index f93e1e4a4b5f..4dd07052d6fa 100644
--- a/src/main/runtime/orchestration/run-coordinator-orca-session-address.test.ts
+++ b/src/main/runtime/orchestration/run-coordinator-orca-session-address.test.ts
@@ -6,6 +6,7 @@ import {
   formatOrcaSessionAddress,
   parseOrcaSessionAddress
 } from '../../../shared/orca-session-address'
+import { testOrcaSessionId } from '../../../shared/orca-session-address-test-fixture'
 import {
   mintStructuredWorkerHandle,
   mintStructuredWorkerPaneKey,
@@ -14,9 +15,9 @@ import {
 import { OrchestrationDb } from './db'
 import { backfillStructuredWorkerOrcaSessionIds } from './db/schema/structured-worker-orca-session-backfill'
 
-const CHAT_SESSION_ID = '3a5c7e9b-1d4f-4a6c-8b0e-2f4a6c8e0b14'
+const CHAT_SESSION_ID = testOrcaSessionId('3a5c7e9b-1d4f-4a6c-8b0e-2f4a6c8e0b14')
 const CHAT_ADDRESS = formatOrcaSessionAddress(CHAT_SESSION_ID)
-const WORKER_SESSION_ID = '4b6d8f0c-2e5a-4b7d-9c1f-3a5b7d9f1c25'
+const WORKER_SESSION_ID = testOrcaSessionId('4b6d8f0c-2e5a-4b7d-9c1f-3a5b7d9f1c25')
 const WORKER_ADDRESS = formatOrcaSessionAddress(WORKER_SESSION_ID)
 const PTY_PANE = 'tab_pty:66666666-6666-4666-8666-666666666666'
 
diff --git a/src/main/runtime/orchestration/structured-mailbox-pointer-delivery.test.ts b/src/main/runtime/orchestration/structured-mailbox-pointer-delivery.test.ts
index 048fc7732e40..52103cd5322b 100644
--- a/src/main/runtime/orchestration/structured-mailbox-pointer-delivery.test.ts
+++ b/src/main/runtime/orchestration/structured-mailbox-pointer-delivery.test.ts
@@ -109,7 +109,7 @@ function harness(options: {
     resolveStructuredTarget: (mailboxHandle) =>
       mailboxHandle === mailbox ? { sessionId: IDENTITY.sessionId, dispatchId } : null,
     host: {
-      readGateFacts: () => (journal === null ? null : structuredSessionGateFacts(journal)),
+      readGateFacts: async () => (journal === null ? null : structuredSessionGateFacts(journal)),
       currentFence: () => 4,
       send
     }
@@ -329,7 +329,7 @@ describe('forgetting one settled worker', () => {
           : null
       },
       host: {
-        readGateFacts: () => structuredSessionGateFacts(journal),
+        readGateFacts: async () => structuredSessionGateFacts(journal),
         currentFence: () => 4,
         send
       }
diff --git a/src/main/runtime/orchestration/structured-mailbox-pointer-delivery.ts b/src/main/runtime/orchestration/structured-mailbox-pointer-delivery.ts
index 62a555d41191..d3afed4923f0 100644
--- a/src/main/runtime/orchestration/structured-mailbox-pointer-delivery.ts
+++ b/src/main/runtime/orchestration/structured-mailbox-pointer-delivery.ts
@@ -49,8 +49,8 @@ export type StructuredPointerSendOutcome =
   | { kind: 'unattached' }
 
 export type StructuredMailboxPointerHost = {
-  /** The idle gate, read off the session's full reduced timeline; `null` when it is not attached. */
-  readGateFacts: (sessionId: string) => StructuredSessionGateFacts | null
+  /** The idle gate, read off the session's full reduced timeline; `null` when it cannot be read. */
+  readGateFacts: (sessionId: string) => Promise<StructuredSessionGateFacts | null>
   send: (input: {
     sessionId: string
     dispatchId: string | null
@@ -184,7 +184,7 @@ export class OrchestrationStructuredMailboxPointerDelivery<
     reservedTypes: ReadonlySet<string> | undefined
   ): Promise<void> {
     const sessionId = target.sessionId
-    const session = this.deps.host.readGateFacts(sessionId)
+    const session = await this.deps.host.readGateFacts(sessionId)
     const decision = decideStructuredSessionPointerDelivery({ session })
     if (!decision.deliver) {
       this.retain(mailboxHandle, sessionId, decision.retain, reservedTypes)
diff --git a/src/main/runtime/orchestration/structured-mailbox-pointer-host.test.ts b/src/main/runtime/orchestration/structured-mailbox-pointer-host.test.ts
index 91bf1158e077..ba28ee431743 100644
--- a/src/main/runtime/orchestration/structured-mailbox-pointer-host.test.ts
+++ b/src/main/runtime/orchestration/structured-mailbox-pointer-host.test.ts
@@ -38,7 +38,7 @@ describe('structured mailbox pointer host', () => {
     hostRef.current = null
   })
 
-  it('reads the gate facts from the FULL timeline, never a bounded tail', () => {
+  it('reads the gate facts from the FULL timeline, never a bounded tail', async () => {
     // The defect this pins: a running turn is announced by ONE lifecycle item, and settlement
     // tombstones it rather than rewriting it. A long tool-calling turn pushes that item arbitrarily
     // far from the tail, so any page-sized read reports a busy worker as idle — and the pointer is
@@ -46,22 +46,22 @@ describe('structured mailbox pointer host', () => {
     // it -- either way folded into work already in flight rather than read as a new instruction.
     const items = [runningTurn(), ...transcript(500)]
     hostRef.current = { journalSnapshot: () => ({ items }) }
-    expect(createStructuredMailboxPointerHost().readGateFacts('s1')).toEqual({
+    expect(await createStructuredMailboxPointerHost().readGateFacts('s1')).toEqual({
       turnRunning: true,
       awaitingHuman: false
     })
   })
 
-  it('answers null rather than idle when the session cannot be read', () => {
+  it('answers null rather than idle when the session cannot be read', async () => {
     // Null retains the pointer; `{turnRunning:false}` would deliver a nudge into a session this
     // runtime cannot see at all.
-    expect(createStructuredMailboxPointerHost().readGateFacts('s1')).toBeNull()
+    expect(await createStructuredMailboxPointerHost().readGateFacts('s1')).toBeNull()
     hostRef.current = {
       journalSnapshot: () => {
         throw new Error('agent_session_ownership_unknown')
       }
     }
-    expect(createStructuredMailboxPointerHost().readGateFacts('s1')).toBeNull()
+    expect(await createStructuredMailboxPointerHost().readGateFacts('s1')).toBeNull()
   })
 
   it('reports an unattached host rather than a rejection when nothing can be sent', async () => {
@@ -91,7 +91,7 @@ describe('structured mailbox pointer host', () => {
         value: { submission: { dispatchState } }
       })
     )
-    hostRef.current = { send }
+    hostRef.current = { send, waitForSendSettlement: async () => undefined }
     await expect(
       createStructuredMailboxPointerHost().send({
         sessionId: 's1',
@@ -107,6 +107,28 @@ describe('structured mailbox pointer host', () => {
     expect(send.mock.calls[0]![1]!.retryUnknown).toBeUndefined()
   })
 
+  it('consumes mail once an accepted nudge is delivered while the worker starts (W10)', async () => {
+    hostRef.current = {
+      send: async () => ({
+        ok: true,
+        value: { clientMessageId: 'op1', submission: { dispatchState: 'pending' } }
+      }),
+      waitForSendSettlement: async () => ({
+        value: { clientMessageId: 'op1', submission: { dispatchState: 'accepted' } }
+      })
+    }
+    await expect(
+      createStructuredMailboxPointerHost().send({
+        sessionId: 's1',
+        dispatchId: 'd1',
+        operationId: 'op1',
+        expectedRuntimeFence: 1,
+        payloadFingerprint: 'fp',
+        body: { kind: 'message', role: 'user', blocks: [] }
+      } as never)
+    ).resolves.toEqual({ kind: 'sent', state: 'accepted' })
+  })
+
   it('scopes direct peer mail to the session when there is no dispatch to scope to', async () => {
     // Direct mail is addressed to the worker's own handle, so there may be no dispatch at all.
     // The ledger is keyed on (callerKey, operationId): a key derived from the session keeps that
diff --git a/src/main/runtime/orchestration/structured-mailbox-pointer-host.ts b/src/main/runtime/orchestration/structured-mailbox-pointer-host.ts
index b722952df92f..d53dc04600e7 100644
--- a/src/main/runtime/orchestration/structured-mailbox-pointer-host.ts
+++ b/src/main/runtime/orchestration/structured-mailbox-pointer-host.ts
@@ -6,6 +6,7 @@
  * the send and reports what the host said.
  */
 
+import { ORCHESTRATION_READINESS_TIMEOUT_MS } from '../../../shared/orchestration-timing-budgets'
 import { AGENT_SESSION_NOT_ATTACHED } from '../../native-chat/agent-session-wire/structured-agent-session-mutation-admission'
 import { getStructuredAgentSessionHost } from '../../native-chat/agent-session-wire/structured-agent-session-registry'
 import type { StructuredMailboxPointerHost } from './structured-mailbox-pointer-delivery'
@@ -38,15 +39,16 @@ export function structuredSessionPointerCallerKey(sessionId: string): string {
  * idle-with-history is the normal steady state of a working agent. Shared so the pointer lane and
  * group addressing cannot disagree about it.
  */
-export function readStructuredSessionGateFacts(
+export async function readStructuredSessionGateFacts(
   sessionId: string
-): StructuredSessionGateFacts | null {
+): Promise<StructuredSessionGateFacts | null> {
   const host = getStructuredAgentSessionHost()
   if (!host) {
     return null
   }
   try {
-    return structuredSessionGateFacts(host.journalSnapshot(sessionId).items)
+    // Opens a conversation the idle sweep closed; that starts no agent.
+    return structuredSessionGateFacts((await host.journalSnapshot(sessionId)).items)
   } catch (error) {
     // Not attached is a retain reason, not a failure; anything else is still unreadable.
     if ((error as Error)?.message !== AGENT_SESSION_NOT_ATTACHED.code) {
@@ -94,8 +96,19 @@ export function createStructuredMailboxPointerHost(): StructuredMailboxPointerHo
           ? { kind: 'unattached' }
           : { kind: 'sent', state: 'rejected' }
       }
-      // `pending` is not yet an acknowledgement; only `accepted` may consume mail.
-      const state = result.value.submission.dispatchState
+      // `pending` is not yet an acknowledgement; only `accepted` may consume mail. Accepted is not
+      // delivered, so wait out a start; a wait that runs out parks for the next journal edge.
+      const submission =
+        result.value.submission.dispatchState === 'pending'
+          ? ((
+              await host
+                .waitForSendSettlement(input.sessionId, result.value.clientMessageId, {
+                  budgetMs: ORCHESTRATION_READINESS_TIMEOUT_MS
+                })
+                .catch(() => undefined)
+            )?.value.submission ?? result.value.submission)
+          : result.value.submission
+      const state = submission.dispatchState
       return {
         kind: 'sent',
         state: state === 'accepted' ? 'accepted' : state === 'rejected' ? 'rejected' : 'unknown'
diff --git a/src/main/runtime/orchestration/structured-worker-direct-mailbox-target.test.ts b/src/main/runtime/orchestration/structured-worker-direct-mailbox-target.test.ts
index 4fff2d387d0c..cc32156cc873 100644
--- a/src/main/runtime/orchestration/structured-worker-direct-mailbox-target.test.ts
+++ b/src/main/runtime/orchestration/structured-worker-direct-mailbox-target.test.ts
@@ -93,7 +93,7 @@ describe('the mailbox target for direct peer mail to a structured worker', () =>
     // claimed the mailbox — the PTY lane refuses a structured handle outright and this resolver
     // answered only `dispatch:` addresses. The worker never reacted and the peer waiting on a
     // reply hung, with nothing logged. A dispatch says nothing about whether delivery is safe;
-    // the idle gate and the lease fence do, and both still run downstream.
+    // the idle gate and the writer lease do, and both still run downstream.
     const handle = registerWorker()
     installRecord({ runtimeKind: 'native', claimStatus: 'live' })
     expect(probe(undefined).instance.probeResolveTarget(handle)).toEqual({
diff --git a/src/main/runtime/orchestration/structured-worker-group-addressing.test.ts b/src/main/runtime/orchestration/structured-worker-group-addressing.test.ts
index 93fa58fd6b56..2f7b0a49eaf9 100644
--- a/src/main/runtime/orchestration/structured-worker-group-addressing.test.ts
+++ b/src/main/runtime/orchestration/structured-worker-group-addressing.test.ts
@@ -50,6 +50,7 @@ function installHost(options: {
   items?: AgentJournalRenderItem[]
   lease?: { runtimeKind: string; claimStatus: string }
   hasSession?: boolean
+  tabListed?: boolean
 }): void {
   const lease = options.lease ?? { runtimeKind: 'native', claimStatus: 'live' }
   hostRef.current = {
@@ -65,21 +66,45 @@ function installHost(options: {
       }
     },
     hasSession: () => options.hasSession ?? true,
-    journalSnapshot: () => ({ items: options.items ?? [idleTurn()] })
+    getPersistedVisibleSessionTabIndex: () => ({
+      present: true,
+      sessionIds: options.tabListed ? [SESSION_ID] : []
+    }),
+    journalSnapshot: async () => ({ items: options.items ?? [idleTurn()] })
   }
 }
 
+/** The durable worker-terminal rows group addressing enumerates. */
+const rows: {
+  terminal_handle: string
+  pane_key: string
+  process_incarnation: string
+  worktree_id: string
+  host_scope: string
+}[] = []
+
+// oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: group addressing reads only this one query off the database.
+const workerDb = { listWorkerTerminalResourcesByIncarnationPrefix: () => rows } as never
+
 function registerWorker(worktreeId = 'wt_1'): string {
   const handle = mintStructuredWorkerHandle()
+  const paneKey = mintStructuredWorkerPaneKey(SESSION_ID)
   structuredWorkerIdentities.register({
     handle,
     sessionId: SESSION_ID,
     agent: 'codex',
-    paneKey: mintStructuredWorkerPaneKey(SESSION_ID),
+    paneKey,
     processIncarnation: structuredWorkerProcessIncarnation(SESSION_ID),
     worktreeId,
     hostScope: { kind: 'local', hostId: 'local' }
   })
+  rows.push({
+    terminal_handle: handle,
+    pane_key: paneKey,
+    process_incarnation: structuredWorkerProcessIncarnation(SESSION_ID),
+    worktree_id: worktreeId,
+    host_scope: JSON.stringify({ kind: 'local', hostId: 'local' })
+  })
   return handle
 }
 
@@ -88,22 +113,28 @@ const PTY_TERMINAL = { handle: 'term_a', worktreeId: 'wt_1', agentIdentity: 'cla
 describe('group addressing and structured workers', () => {
   beforeEach(() => {
     structuredWorkerIdentities.clear()
+    rows.length = 0
     hostRef.current = null
   })
 
   it('enumerates a live structured worker as a candidate', () => {
     const handle = registerWorker()
     installHost({})
-    expect(listAddressableStructuredWorkers()).toEqual([
+    expect(listAddressableStructuredWorkers(workerDb)).toEqual([
       { handle, worktreeId: 'wt_1', agentIdentity: 'codex' }
     ])
   })
 
-  it('leaves out a worker whose session is not proven live', () => {
-    // Addressing a settled worker would store mail no lane will ever deliver.
-    registerWorker()
-    installHost({ lease: { runtimeKind: 'native', claimStatus: 'live' }, hasSession: false })
-    expect(listAddressableStructuredWorkers()).toEqual([])
+  it('keeps a worker at rest and leaves out a retired one', () => {
+    // At rest: its agent was stopped while idle, its chat tab still lists it, and mail starts it.
+    const handle = registerWorker()
+    installHost({ lease: { runtimeKind: 'native', claimStatus: 'released' }, tabListed: true })
+    expect(listAddressableStructuredWorkers(workerDb)).toEqual([
+      { handle, worktreeId: 'wt_1', agentIdentity: 'codex' }
+    ])
+    // Retired: released with its tab gone. Addressing it would store mail no lane delivers.
+    installHost({ lease: { runtimeKind: 'native', claimStatus: 'released' }, tabListed: false })
+    expect(listAddressableStructuredWorkers(workerDb)).toEqual([])
   })
 
   it('reaches a structured worker through @all', () => {
@@ -112,14 +143,14 @@ describe('group addressing and structured workers', () => {
     // machinery never ran and the sender got exit 0 with a receipt naming only who did resolve.
     const handle = registerWorker()
     installHost({})
-    const recipients = [PTY_TERMINAL, ...listAddressableStructuredWorkers()]
+    const recipients = [PTY_TERMINAL, ...listAddressableStructuredWorkers(workerDb)]
     expect(resolveGroupAddress('@all', 'term_sender', recipients, () => 'idle')).toContain(handle)
   })
 
   it('reaches a structured worker through @worktree: and @codex, but not @claude', () => {
     const handle = registerWorker('wt_2')
     installHost({})
-    const recipients = [PTY_TERMINAL, ...listAddressableStructuredWorkers()]
+    const recipients = [PTY_TERMINAL, ...listAddressableStructuredWorkers(workerDb)]
     expect(resolveGroupAddress('@worktree:wt_2', 'term_sender', recipients, () => 'idle')).toEqual([
       handle
     ])
@@ -129,20 +160,20 @@ describe('group addressing and structured workers', () => {
     ])
   })
 
-  it('reads @idle status off the FULL timeline, never a bounded tail', () => {
+  it('reads @idle status off the FULL timeline, never a bounded tail', async () => {
     // The same trap that already cost this branch once: settlement tombstones the lifecycle item
     // rather than rewriting it, so a long tool-calling turn pushes it arbitrarily far from the
     // tail and any page-sized read reports a BUSY worker as idle — then `@idle` broadcasts into a
     // running turn, which Codex refuses outright and Claude queues behind.
     registerWorker()
     installHost({ items: [runningTurn(), ...transcript(500)] })
-    expect(structuredWorkerAgentStatus(SESSION_ID)).toBe('working')
+    expect(await structuredWorkerAgentStatus(SESSION_ID)).toBe('working')
   })
 
-  it('answers idle only when no turn is running and no human is awaited', () => {
+  it('answers idle only when no turn is running and no human is awaited', async () => {
     registerWorker()
     installHost({ items: [idleTurn()] })
-    expect(structuredWorkerAgentStatus(SESSION_ID)).toBe('idle')
+    expect(await structuredWorkerAgentStatus(SESSION_ID)).toBe('idle')
     installHost({
       items: [
         {
@@ -156,26 +187,27 @@ describe('group addressing and structured workers', () => {
         } as unknown as AgentJournalRenderItem
       ]
     })
-    expect(structuredWorkerAgentStatus(SESSION_ID)).toBe('attention')
+    expect(await structuredWorkerAgentStatus(SESSION_ID)).toBe('attention')
   })
 
-  it('answers null rather than idle when the session cannot be read', () => {
+  it('answers null rather than idle when the session cannot be read', async () => {
     // Unknown must never read as idle, or `@idle` wakes a worker mid-turn.
     hostRef.current = null
-    expect(structuredWorkerAgentStatus(SESSION_ID)).toBeNull()
+    expect(await structuredWorkerAgentStatus(SESSION_ID)).toBeNull()
   })
 })
 
 describe('sendGroupMessage actually composes structured workers in', () => {
   beforeEach(() => {
     structuredWorkerIdentities.clear()
+    rows.length = 0
     hostRef.current = null
   })
 
   /**
    * Drives the real `sendGroupMessage`, not `resolveGroupAddress`.
    *
-   * The suite above hand-composed `[PTY_TERMINAL, ...listAddressableStructuredWorkers()]` itself,
+   * The suite above hand-composed `[PTY_TERMINAL, ...listAddressableStructuredWorkers(workerDb)]` itself,
    * so deleting the composition at the call site left it green — the exact regression the fix
    * describes could come straight back. This test owns that seam.
    */
@@ -186,8 +218,10 @@ describe('sendGroupMessage actually composes structured workers in', () => {
     const db = {
       getLegacyAdoptedRunMailboxOwner: () => null,
       getCurrentRunForPane: () => undefined,
+      getCurrentRunForCoordinator: () => undefined,
       getActiveDispatchMailboxOwners: () => [],
       getRunMailboxOwnerIdsForHandle: () => [],
+      listWorkerTerminalResourcesByIncarnationPrefix: () => rows,
       insertMessages: (rows: { to: string }[]) => {
         inserted.push(...rows)
         return rows.map((row, index) => ({ id: `m${index}`, to_handle: row.to, type: 'status' }))
@@ -197,7 +231,7 @@ describe('sendGroupMessage actually composes structured workers in', () => {
       // No PTY terminals at all: if the call site does not compose structured workers in, the
       // group resolves empty and this throws instead of delivering.
       listTerminals: async () => ({ terminals: [] }),
-      getAgentStatusForHandle: () => 'idle',
+      getAgentStatusForHandle: async () => 'idle',
       getLiveTerminalPaneKey: () => structuredWorkerIdentities.get(handle)!.paneKey,
       notifyMessageArrived: () => {}
     }
@@ -227,9 +261,11 @@ describe('sendGroupMessage actually composes structured workers in', () => {
     const db = {
       getLegacyAdoptedRunMailboxOwner: () => null,
       getCurrentRunForPane: () => undefined,
+      getCurrentRunForCoordinator: () => undefined,
       getActiveDispatchForIdentity: () => ({ run_id: 'run_1' }),
       getActiveDispatchMailboxOwners: () => [],
       getRunMailboxOwnerIdsForHandle: () => [],
+      listWorkerTerminalResourcesByIncarnationPrefix: () => rows,
       listWorkerTerminalResources: () => [
         {
           dispatchId: 'ctx_structured',
@@ -257,17 +293,24 @@ describe('sendGroupMessage actually composes structured workers in', () => {
       listTerminals: async () => ({
         terminals: [{ handle: 'term_claude', worktreeId: 'wt_1', agentIdentity: 'claude' }]
       }),
-      getAgentStatusForHandle: () => 'idle',
+      getAgentStatusForHandle: async () => 'idle',
       getLiveTerminalPaneKey: () => null,
       getOrchestrationDb: () => db,
       notifyMessageArrived: () => {}
     }
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the stub cast is unchanged; the gate flags it only because this diff adds the sender field inside its span.
     await sendGroupMessage({
       params: { subject: 's', body: 'b', type: 'status', priority: 'normal' },
       runtime: runtime as never,
       db: db as never,
       from: 'term_sender',
       groupAddress: '@codex',
+      sender: {
+        address: 'term_sender',
+        terminalHandle: 'term_sender',
+        paneKey: null,
+        orcaSessionId: null
+      },
       senderPaneKey: undefined,
       senderRunId: 'run_1',
       explicitRunId: undefined,
diff --git a/src/main/runtime/orchestration/structured-worker-group-addressing.ts b/src/main/runtime/orchestration/structured-worker-group-addressing.ts
index 168bd8701188..4115f168552b 100644
--- a/src/main/runtime/orchestration/structured-worker-group-addressing.ts
+++ b/src/main/runtime/orchestration/structured-worker-group-addressing.ts
@@ -16,8 +16,13 @@
  */
 
 import type { TuiAgent } from '../../../shared/tui-agent'
-import { observeStructuredWorker, structuredWorkerAgent } from '../structured-worker-authority'
-import { structuredWorkerIdentities } from '../structured-worker-identity'
+import { structuredWorkerAgent } from '../structured-worker-authority'
+import { structuredWorkerAddressable } from '../structured-worker-custody'
+import {
+  STRUCTURED_WORKER_INCARNATION_PREFIX,
+  structuredWorkerIdentityFromRow
+} from '../structured-worker-identity'
+import type { OrchestrationDb } from './db'
 import { readStructuredSessionGateFacts } from './structured-mailbox-pointer-host'
 
 /** The only facts group addressing reads off a recipient. */
@@ -29,15 +34,29 @@ export type OrchestrationAddressableAgent = {
 }
 
 /**
- * Live structured workers of this runtime, as group-address candidates.
+ * Structured workers this runtime owns, as group-address candidates.
  *
- * Liveness-gated on the same observation the rest of the structured surface uses: a settled or
- * handed-off worker is not a recipient, and addressing one would store mail no lane will deliver.
+ * Read from the durable worker-terminal rows, which outlive a settled dispatch and a restart, and
+ * gated on ownership and on the orchestration not having released it — the same answer direct mail
+ * routes on — never on liveness: a worker at rest is a recipient, and the mail starts it. A retired
+ * or released one is not.
  */
-export function listAddressableStructuredWorkers(): OrchestrationAddressableAgent[] {
-  return structuredWorkerIdentities
-    .list()
-    .filter((identity) => observeStructuredWorker(identity).status === 'live')
+export function listAddressableStructuredWorkers(
+  db: OrchestrationDb | null
+): OrchestrationAddressableAgent[] {
+  const seen = new Set<string>()
+  return (
+    db?.listWorkerTerminalResourcesByIncarnationPrefix(STRUCTURED_WORKER_INCARNATION_PREFIX) ?? []
+  )
+    .flatMap((row) => {
+      const identity = structuredWorkerIdentityFromRow(row)
+      // Newest row first: a session is one recipient, under its latest handle.
+      if (!identity || seen.has(identity.sessionId)) {
+        return []
+      }
+      seen.add(identity.sessionId)
+      return structuredWorkerAddressable(db, identity.sessionId, row) === true ? [identity] : []
+    })
     .map((identity) => ({
       handle: identity.handle,
       worktreeId: identity.worktreeId,
@@ -52,8 +71,8 @@ export function listAddressableStructuredWorkers(): OrchestrationAddressableAgen
  * would wake a worker mid-turn — which Codex coalesces into the running turn and Claude queues
  * behind it.
  */
-export function structuredWorkerAgentStatus(sessionId: string): string | null {
-  const facts = readStructuredSessionGateFacts(sessionId)
+export async function structuredWorkerAgentStatus(sessionId: string): Promise<string | null> {
+  const facts = await readStructuredSessionGateFacts(sessionId)
   if (!facts) {
     return null
   }
diff --git a/src/main/runtime/orchestration/structured-worker-journal-page.ts b/src/main/runtime/orchestration/structured-worker-journal-page.ts
index 35676aaf52cc..8d260339fa6f 100644
--- a/src/main/runtime/orchestration/structured-worker-journal-page.ts
+++ b/src/main/runtime/orchestration/structured-worker-journal-page.ts
@@ -16,14 +16,17 @@ export type StructuredJournalPage = {
   hasOlder: boolean
 }
 
-/** The newest page of a session's journal, or null when this runtime cannot read it. */
-export function readStructuredJournalPage(sessionId: string): StructuredJournalPage | null {
+/** The newest page of a session's journal, or null when this runtime cannot read it. A closed
+ *  conversation is opened for the read; that starts no agent. */
+export async function readStructuredJournalPage(
+  sessionId: string
+): Promise<StructuredJournalPage | null> {
   const host = getStructuredAgentSessionHost()
   if (!host) {
     return null
   }
   try {
-    const result = host.history({
+    const result = await host.history({
       sessionId,
       direction: 'tail',
       limit: STRUCTURED_JOURNAL_PAGE_LIMIT
diff --git a/src/main/runtime/orchestration/types.ts b/src/main/runtime/orchestration/types.ts
index d00ea480c7dd..cd2b12a7da28 100644
--- a/src/main/runtime/orchestration/types.ts
+++ b/src/main/runtime/orchestration/types.ts
@@ -1,4 +1,5 @@
 import type { TerminalExitCause } from '../../../shared/terminal-exit-cause'
+import type { OrcaSessionId } from '../../../shared/orca-session-address'
 export const MESSAGE_TYPES = [
   'status',
   'dispatch',
@@ -47,7 +48,7 @@ export type RunRow = {
   coordinator_handle: string | null
   coordinator_pane_key: string | null
   /** Bare Orca session id the coordinator is addressed by, when it has one (today only structured sessions); a `/clear`ed chat's lineage root. */
-  coordinator_orca_session_id: string | null
+  coordinator_orca_session_id: OrcaSessionId | null
   /** The consumer_generation the id was written at; see currentRunCoordinatorOrcaSessionId. */
   coordinator_orca_session_id_generation: number | null
   consumer_generation: number
@@ -283,7 +284,7 @@ export type DispatchContextRow = {
   assignee_handle: string | null
   assignee_pane_key: string | null
   /** Bare Orca session id the assignee is addressed by, when it has one (today only structured sessions); a `/clear`ed chat's lineage root. */
-  assignee_orca_session_id: string | null
+  assignee_orca_session_id: OrcaSessionId | null
   capability_hash: string | null
   process_incarnation: string | null
   capability_revoked_at: string | null
@@ -294,7 +295,7 @@ export type DispatchContextRow = {
   creator_handle: string | null
   creator_pane_key: string | null
   /** Bare Orca session id the creator is addressed by, when it has one (today only structured sessions); a `/clear`ed chat's lineage root. */
-  creator_orca_session_id: string | null
+  creator_orca_session_id: OrcaSessionId | null
   host_scope: string | null
   status: DispatchStatus
   failure_count: number
diff --git a/src/main/runtime/orchestration/worker-output-archive.ts b/src/main/runtime/orchestration/worker-output-archive.ts
index d7e894cf54c1..ddae515a7f2c 100644
--- a/src/main/runtime/orchestration/worker-output-archive.ts
+++ b/src/main/runtime/orchestration/worker-output-archive.ts
@@ -91,7 +91,7 @@ export async function captureWorkerOutputArchive(args: {
   structuredWorker?: StructuredWorkerIdentity | null
 }): Promise<WorkerOutputArchiveCapture> {
   if (args.structuredWorker) {
-    const content = captureStructuredWorkerArchive(
+    const content = await captureStructuredWorkerArchive(
       args.structuredWorker,
       structuredWorkerAgent(args.structuredWorker)
     )
diff --git a/src/main/runtime/orchestration/worker-terminal-process-liveness.test.ts b/src/main/runtime/orchestration/worker-terminal-process-liveness.test.ts
new file mode 100644
index 000000000000..e2bc2cc7d639
--- /dev/null
+++ b/src/main/runtime/orchestration/worker-terminal-process-liveness.test.ts
@@ -0,0 +1,70 @@
+import { describe, expect, it } from 'vitest'
+import { matchesProcessIncarnation } from './worker-terminal-process-liveness'
+
+describe('matchesProcessIncarnation', () => {
+  it.each([
+    {
+      name: 'an exact ptyId:incarnation match',
+      ptyId: 'pty-1',
+      incarnationId: 'incarnation-1',
+      processIncarnation: 'pty-1:incarnation-1',
+      expected: true
+    },
+    {
+      name: 'a Windows repo::C:\\path@@1 ptyId whose incarnation matches',
+      ptyId: 'repo::C:\\path@@1',
+      incarnationId: 'incarnation-win',
+      processIncarnation: 'repo::C:\\path@@1:incarnation-win',
+      expected: true
+    },
+    {
+      name: 'a colon-bearing relay incarnationId that a lastIndexOf split would mangle',
+      ptyId: 'relay-pty',
+      incarnationId: 'relay:conn-3:incarnation-9',
+      processIncarnation: 'relay-pty:relay:conn-3:incarnation-9',
+      expected: true
+    },
+    {
+      name: 'a whitespace-dirty incarnationId (lost contact is never a match)',
+      ptyId: 'pty-1',
+      incarnationId: ' incarnation-1',
+      processIncarnation: 'pty-1: incarnation-1',
+      expected: false
+    },
+    {
+      name: 'an empty-string incarnationId',
+      ptyId: 'pty-1',
+      incarnationId: '',
+      processIncarnation: 'pty-1:',
+      expected: false
+    },
+    {
+      name: 'an absent (null) incarnationId',
+      ptyId: 'pty-1',
+      incarnationId: null,
+      processIncarnation: 'pty-1:incarnation-1',
+      expected: false
+    },
+    {
+      name: 'an absent (undefined) incarnationId',
+      ptyId: 'pty-1',
+      incarnationId: undefined,
+      processIncarnation: 'pty-1:incarnation-1',
+      expected: false
+    },
+    {
+      name: 'a prefix-decoy ptyId (@@1) against a longer live pty (@@10)',
+      ptyId: 'repo::C:\\path@@1',
+      incarnationId: 'inc-1',
+      processIncarnation: 'repo::C:\\path@@10:inc-1',
+      expected: false
+    }
+  ])('returns $expected for $name', ({ ptyId, incarnationId, processIncarnation, expected }) => {
+    expect(matchesProcessIncarnation(ptyId, incarnationId, processIncarnation)).toBe(expected)
+  })
+
+  it('rejects a partial prefix that is not colon-delimited', () => {
+    // 'pty-10' is not the pty 'pty-1'; the `${ptyId}:` fence keeps them distinct.
+    expect(matchesProcessIncarnation('pty-1', 'inc', 'pty-10:inc')).toBe(false)
+  })
+})
diff --git a/src/main/runtime/orchestration/worker-terminal-process-liveness.ts b/src/main/runtime/orchestration/worker-terminal-process-liveness.ts
index 72c5ce076669..4e652d6286af 100644
--- a/src/main/runtime/orchestration/worker-terminal-process-liveness.ts
+++ b/src/main/runtime/orchestration/worker-terminal-process-liveness.ts
@@ -5,6 +5,24 @@ import type { PtyProcessInfo } from '../../providers/pty-process-info'
 export type { WorkerTerminalHostScope } from '../../../shared/worker-terminal-host-scope'
 export { parseWorkerTerminalHostScope } from '../../../shared/worker-terminal-host-scope'
 
+/**
+ * Does `processIncarnation` name exactly this pty's live incarnation? Requires exact
+ * `${ptyId}:${incarnationId}` equality, so it is immune to colons on either side (relay/SSH
+ * ptyIds, colon-bearing relay incarnationIds). A pty with no (or a whitespace-dirty)
+ * incarnationId can never match — the exact-incarnation fence stays intact.
+ */
+export function matchesProcessIncarnation(
+  ptyId: string,
+  incarnationId: string | null | undefined,
+  processIncarnation: string
+): boolean {
+  if (!incarnationId || incarnationId !== incarnationId.trim()) {
+    return false
+  }
+  return `${ptyId}:${incarnationId}` === processIncarnation
+}
+
+/** Classify a recorded incarnation against live sessions: live on exact match, unverifiable when a candidate pty has a dirty or absent incarnationId (lost contact is never a death certificate), else exited. */
 export function classifyWorkerTerminalProcessIncarnation(
   processIncarnation: string,
   sessions: readonly PtyProcessInfo[]
@@ -13,13 +31,9 @@ export function classifyWorkerTerminalProcessIncarnation(
     processIncarnation.startsWith(`${session.id}:`)
   )
   if (
-    possibleMatches.some((session) => {
-      const incarnationId = session.incarnationId
-      if (!incarnationId || incarnationId !== incarnationId.trim()) {
-        return false
-      }
-      return `${session.id}:${incarnationId}` === processIncarnation
-    })
+    possibleMatches.some((session) =>
+      matchesProcessIncarnation(session.id, session.incarnationId, processIncarnation)
+    )
   ) {
     return 'live'
   }
diff --git a/src/main/runtime/orchestration/worker-transcript-payload.test.ts b/src/main/runtime/orchestration/worker-transcript-payload.test.ts
index c843fe1cfa72..802b724a2aa6 100644
--- a/src/main/runtime/orchestration/worker-transcript-payload.test.ts
+++ b/src/main/runtime/orchestration/worker-transcript-payload.test.ts
@@ -1,7 +1,9 @@
 import { describe, expect, it } from 'vitest'
 import { MAX_CODEX_SUBAGENTS_PER_GROUP } from '../../codex/codex-structured-journal-limits'
+import { projectStructuredItemsToNativeChat } from '../../../shared/structured-agent-session-projection'
 import {
   boundWorkerTranscriptMessages,
+  boundWorkerTranscriptTail,
   redactWorkerTerminalLines
 } from './worker-transcript-payload'
 
@@ -177,6 +179,28 @@ describe('worker transcript wire bounds', () => {
     expect(result).toMatchObject({ limited: false, warnings: [] })
   })
 
+  it("serves a structured worker's journal rows without their list position", () => {
+    const [message] = projectStructuredItemsToNativeChat([
+      {
+        itemId: 'reply',
+        revision: 1,
+        sequence: 7,
+        sequenceIndex: 1,
+        observedAt: 1,
+        body: { kind: 'message', role: 'assistant', blocks: [{ type: 'text', text: 'done' }] }
+      }
+    ])
+    // Anti-vacuous: the projection itself does position the row.
+    expect(message?.journalPosition).toEqual({ sequence: 7, index: 1 })
+    for (const served of [
+      boundWorkerTranscriptMessages([message!]).messages,
+      boundWorkerTranscriptTail([message!], 262_144).messages
+    ]) {
+      expect(served).toHaveLength(1)
+      expect(served[0]).not.toHaveProperty('journalPosition')
+    }
+  })
+
   it('keeps two roster ids sharing a 512-char prefix distinct', () => {
     // The id is the roster key: a plain prefix clip would merge the two children.
     const head = 'a'.repeat(512)
diff --git a/src/main/runtime/orchestration/worker-transcript-payload.ts b/src/main/runtime/orchestration/worker-transcript-payload.ts
index b4365e259c21..684dfc771e2b 100644
--- a/src/main/runtime/orchestration/worker-transcript-payload.ts
+++ b/src/main/runtime/orchestration/worker-transcript-payload.ts
@@ -108,8 +108,10 @@ function boundMessage(
   if (blocks.length < message.blocks.length) {
     markClipped(state, 'Some transcript blocks were omitted from oversized messages.')
   }
+  // The journal position only orders a live list; a worker read is already in order.
+  const { journalPosition: _journalPosition, ...served } = message
   return {
-    ...message,
+    ...served,
     id: boundIdentifier(message.id, transcriptPath, state),
     ...(message.turnId ? { turnId: boundIdentifier(message.turnId, transcriptPath, state) } : {}),
     blocks: blocks.map((block) => boundBlock(block, state))
diff --git a/src/main/runtime/paired-close-retirement-proof-publication-order.test.ts b/src/main/runtime/paired-close-retirement-proof-publication-order.test.ts
index 640c54a753c6..35fb16d55ead 100644
--- a/src/main/runtime/paired-close-retirement-proof-publication-order.test.ts
+++ b/src/main/runtime/paired-close-retirement-proof-publication-order.test.ts
@@ -1,3 +1,4 @@
+import { withDurableRuntimeStore } from './runtime-durable-store-fixture'
 import { describe, expect, it, vi } from 'vitest'
 import { getDefaultWorkspaceSession } from '../../shared/constants'
 import type {
@@ -88,14 +89,17 @@ function createHost(): {
 } {
   let session = makePersistedSession()
   // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the store stub carries the four members this publication-order suite drives; the rest of Store is unreached.
-  const runtime = new OrcaRuntimeService({
-    getRepos: () => [LIVE_REPO],
-    getWorkspaceSession: () => session,
-    setWorkspaceSession: (next: WorkspaceSessionState) => {
-      session = next
-    },
-    flushOrThrow: vi.fn()
-  } as never)
+  const runtime = new OrcaRuntimeService(
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: This runtime fixture supplies the persistence and graph methods exercised by the test.
+    withDurableRuntimeStore({
+      getRepos: () => [LIVE_REPO],
+      getWorkspaceSession: () => session,
+      setWorkspaceSession: (next: WorkspaceSessionState) => {
+        session = next
+      },
+      flushOrThrow: vi.fn()
+    }) as never
+  )
   runtime.attachWindow(1)
   runtime.syncWindowGraph(1, {
     tabs: [
@@ -159,7 +163,7 @@ describe('retirement proof publication vs. renderer republication order', () =>
   it('publishes the proof when the exit lands before the renderer drops the surface', async () => {
     const { runtime, handle } = createHost()
 
-    runtime.onPtyExit('pty-left', 0, 'incarnation-a')
+    await runtime.onPtyExit('pty-left', 0, 'incarnation-a')
     republishWithoutTheSurface(runtime)
 
     const published = await runtime.listMobileSessionTabs(`id:${WORKTREE_ID}`)
@@ -174,7 +178,7 @@ describe('retirement proof publication vs. renderer republication order', () =>
 
     retirePersistedSurface()
     republishWithoutTheSurface(runtime)
-    runtime.onPtyExit('pty-left', 0, 'incarnation-a')
+    await runtime.onPtyExit('pty-left', 0, 'incarnation-a')
 
     const published = await runtime.listMobileSessionTabs(`id:${WORKTREE_ID}`)
     expect(published.tabs).toEqual([])
@@ -185,7 +189,7 @@ describe('retirement proof publication vs. renderer republication order', () =>
 
   // Why a subscriber and not just the stored snapshot: a mirror only ever sees frames. A proof
   // that lands in state without a frame to carry it is the same silence from the client's side.
-  it('fans the proof out to a paired subscriber, not just into stored state', () => {
+  it('fans the proof out to a paired subscriber, not just into stored state', async () => {
     const { runtime, handle, retirePersistedSurface } = createHost()
     const frames: RuntimeMobileSessionTabsResult[] = []
     const unsubscribe = runtime.onMobileSessionTabsChanged(
@@ -196,7 +200,7 @@ describe('retirement proof publication vs. renderer republication order', () =>
     try {
       retirePersistedSurface()
       republishWithoutTheSurface(runtime)
-      runtime.onPtyExit('pty-left', 0, 'incarnation-a')
+      await runtime.onPtyExit('pty-left', 0, 'incarnation-a')
     } finally {
       unsubscribe()
     }
diff --git a/src/main/runtime/pty-inventory-partial-relay-liveness.test.ts b/src/main/runtime/pty-inventory-partial-relay-liveness.test.ts
index 22dc70e42c01..cf5618ab2ff5 100644
--- a/src/main/runtime/pty-inventory-partial-relay-liveness.test.ts
+++ b/src/main/runtime/pty-inventory-partial-relay-liveness.test.ts
@@ -1,3 +1,4 @@
+import { withDurableRuntimeStore } from './runtime-durable-store-fixture'
 import { describe, expect, it } from 'vitest'
 import { getDefaultWorkspaceSession } from '../../shared/constants'
 import { makePaneKey } from '../../shared/stable-pane-id'
@@ -50,7 +51,8 @@ function createRuntime(options: { sessions?: unknown[]; vouchesForRetainedPty?:
   calls: ListCall[]
 } {
   const meta: Record<string, Record<string, unknown>> = { [WORKSPACE]: { hostId: 'local' } }
-  const store = {
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: This runtime fixture supplies the persistence and graph methods exercised by the test.
+  const store = withDurableRuntimeStore({
     getRepos: () => [REPO],
     getRepo: (id: string) => (id === REPO_ID ? REPO : undefined),
     getAllWorktreeMeta: () => meta,
@@ -62,7 +64,7 @@ function createRuntime(options: { sessions?: unknown[]; vouchesForRetainedPty?:
     getWorkspaceSession: () => getDefaultWorkspaceSession(),
     setWorkspaceSession: () => {},
     flushOrThrow: () => {}
-  } as never
+  }) as never
   const calls: ListCall[] = []
   const runtime = new OrcaRuntimeService(store)
   runtime.setPtyController({
diff --git a/src/main/runtime/pty-shell-ownership-mirror.test.ts b/src/main/runtime/pty-shell-ownership-mirror.test.ts
index 20468a194cd6..b0525940a864 100644
--- a/src/main/runtime/pty-shell-ownership-mirror.test.ts
+++ b/src/main/runtime/pty-shell-ownership-mirror.test.ts
@@ -16,6 +16,24 @@ describe('PtyShellOwnershipMirror', () => {
     expect(mirror.owner).toBe('shell')
   })
 
+  it('asks at the real D after refuted stray Ds, in lockstep with the host barrier', async () => {
+    let hostGrounded = false
+    const confirm = vi.fn(async () => hostGrounded)
+    const mirror = new PtyShellOwnershipMirror(confirm)
+    mirror.scan('\x1b]133;C\x07\x1b[>1u\x1b[?1049hAGENT')
+
+    for (let index = 1; index <= 5; index += 1) {
+      mirror.scan('\x1b]133;C\x07nested\x1b]133;D;0\x07')
+      await vi.waitFor(() => expect(confirm).toHaveBeenCalledTimes(index))
+      await mirror.settle()
+    }
+    hostGrounded = true
+    mirror.scan('\x1b]133;D;137\x07')
+
+    await vi.waitFor(() => expect(mirror.owner).toBe('shell'))
+    expect(confirm).toHaveBeenCalledTimes(6)
+  })
+
   it('does not arm from a seed on the normal buffer', async () => {
     const confirm = vi.fn(async () => true)
     const mirror = new PtyShellOwnershipMirror(confirm)
diff --git a/src/main/runtime/qoder-terminal-readiness.ts b/src/main/runtime/qoder-terminal-readiness.ts
new file mode 100644
index 000000000000..781da3341c08
--- /dev/null
+++ b/src/main/runtime/qoder-terminal-readiness.ts
@@ -0,0 +1,11 @@
+// Captured Qoder 1.1.64 paints its idle OSC title even while the trust menu owns input.
+export function isQoderComposerReady(screenLines: readonly string[] | null): boolean {
+  if (!screenLines) {
+    return false
+  }
+  const screen = screenLines.join('\n').toLowerCase()
+  return (
+    screen.includes('type your message or @path/to/file') &&
+    !screen.includes("don't trust and exit")
+  )
+}
diff --git a/src/main/runtime/qoder-transcripts.test.ts b/src/main/runtime/qoder-transcripts.test.ts
new file mode 100644
index 000000000000..89c5881382ad
--- /dev/null
+++ b/src/main/runtime/qoder-transcripts.test.ts
@@ -0,0 +1,50 @@
+import { readFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { describe, expect, it, vi } from 'vitest'
+import { createTranscriptPane } from './agent-transcript-pane-test-harness'
+import { extractLastOscTitle } from '../../shared/osc-title-extraction'
+import { getAgentLabel, normalizeTerminalTitle } from '../../shared/agent-detection'
+
+vi.mock('electron', () => ({
+  BrowserWindow: { fromId: vi.fn(() => null) },
+  webContents: { fromId: vi.fn(() => null) },
+  ipcMain: { on: vi.fn(), removeListener: vi.fn() },
+  app: { getPath: vi.fn(() => '/tmp') }
+}))
+
+describe('captured Qoder 1.1.64 startup', () => {
+  it.each(['qoder-trust-dialog', 'qoder-no-account', 'qoder-ready'])(
+    'preserves Qoder identity in %s',
+    async (fixture) => {
+      const data = readFileSync(join(__dirname, '__fixtures__', `${fixture}.txt`), 'utf8')
+      // The recorder's shutdown clears the OSC title; inspect the live capture before that reset.
+      const title = extractLastOscTitle(
+        data.replaceAll(`${String.fromCharCode(27)}]0;${String.fromCharCode(7)}`, '')
+      )
+      expect(title).toContain(' | Ready')
+      expect(getAgentLabel(normalizeTerminalTitle(title ?? ''))).toBe('Qoder CLI')
+      const { runtime, handle } = await createTranscriptPane({
+        paneTitle: title ?? '',
+        foregroundProcess: 'qodercli-1.1.64',
+        launchAgent: 'qoder',
+        data,
+        size: { cols: 100, rows: 32 }
+      })
+      const shown = await runtime.showTerminal(handle)
+      expect(shown.agentIdentity).toBe('qoder')
+      if (fixture === 'qoder-trust-dialog') {
+        const readiness = await runtime
+          .waitForTerminal(handle, { condition: 'tui-idle', timeoutMs: 600 })
+          .catch(() => null)
+        expect(readiness?.satisfied ?? false).toBe(false)
+      }
+      if (fixture === 'qoder-ready') {
+        const readiness = await runtime.waitForTerminal(handle, {
+          condition: 'tui-idle',
+          timeoutMs: 1500
+        })
+        expect(readiness.satisfied).toBe(true)
+      }
+    }
+  )
+})
diff --git a/src/main/runtime/rpc/core.ts b/src/main/runtime/rpc/core.ts
index 0eae5f48bb35..1ec159337827 100644
--- a/src/main/runtime/rpc/core.ts
+++ b/src/main/runtime/rpc/core.ts
@@ -10,6 +10,7 @@ import type {
 } from '../../../shared/mobile-relay-credential-contract'
 import type { RuntimeCapability } from '../../../shared/protocol-version'
 import type { OrchestrationCompatibilityEvidence } from '../../../shared/orchestration-compatibility-evidence'
+import type { OrchestrationSessionCaller } from '../orchestration/orchestration-caller-identity'
 
 export type PairingRpcContext = {
   getEndpoints(params: PairingGetEndpointsParams): Promise<PairingGetEndpointsResult>
@@ -100,6 +101,8 @@ export type RpcContext = {
   replayedMutationReceipt?: unknown
   // Why: Run-scoped handlers must compare declared handles with request attestation.
   orchestrationCompatibilityEvidence?: OrchestrationCompatibilityEvidence
+  // Why: resolved once at the dispatch entry from the caller's Orca session id; the session wins.
+  orchestrationCaller?: OrchestrationSessionCaller
   // Why: only the compatibility authority router can set this trusted scope; user params cannot bypass Run consumer binding.
   legacyCoordinatorRunId?: string
   legacyCoordinatorAuthority?: LegacyCoordinatorAuthorityProof
@@ -228,6 +231,11 @@ export function eraseRpcMethods(
   return methods as readonly RpcAnyMethod[]
 }
 
+// Unsubscribes that must not retire a registration created after their dispatch began.
+export function isRegistrationFencedUnsubscribe(method: string): boolean {
+  return method === 'terminal.unsubscribe' || method === 'session.tabs.unsubscribe'
+}
+
 export function isStreamingMethod(method: RpcAnyMethod): method is RpcStreamingMethod {
   return 'stream' in method && method.stream === true
 }
diff --git a/src/main/runtime/rpc/dispatcher-unary-method-invocation.ts b/src/main/runtime/rpc/dispatcher-unary-method-invocation.ts
index 60d9728f152b..d8bf3e25b539 100644
--- a/src/main/runtime/rpc/dispatcher-unary-method-invocation.ts
+++ b/src/main/runtime/rpc/dispatcher-unary-method-invocation.ts
@@ -82,7 +82,8 @@ export async function invokeDispatcherUnaryMethod({
     request,
     effectiveParams,
     invoke,
-    legacyCoordinator?.mutationCallerFingerprint ?? authenticatedCallerFingerprint
+    legacyCoordinator?.mutationCallerFingerprint ?? authenticatedCallerFingerprint,
+    context.orchestrationCaller?.orcaSessionId
   )
   recordRuntimeFeatureInteraction(runtime, request.method, result, undefined, request.params)
   return result
diff --git a/src/main/runtime/rpc/dispatcher.ts b/src/main/runtime/rpc/dispatcher.ts
index 6ed2f1fd9eb8..83cd0e30f9c9 100644
--- a/src/main/runtime/rpc/dispatcher.ts
+++ b/src/main/runtime/rpc/dispatcher.ts
@@ -1,5 +1,6 @@
 import {
   buildRegistry,
+  isRegistrationFencedUnsubscribe,
   isStreamingMethod,
   type RpcAnyMethodDeclaration,
   type RpcEnvelopeMeta,
@@ -23,6 +24,11 @@ import { mapDispatcherError } from './dispatcher-error-response'
 import { parseRpcRequestParams } from './dispatcher-request-parsing'
 import { RpcStreamingDispatcher } from './rpc-streaming-dispatcher'
 import { invokeDispatcherUnaryMethod } from './dispatcher-unary-method-invocation'
+import {
+  needsOrchestrationCallerResolution,
+  resolveOrchestrationSessionCaller,
+  type ResolvedOrchestrationRequest
+} from './orchestration-session-caller'
 
 export type DispatcherOptions = {
   runtime: OrcaRuntimeService
@@ -69,7 +75,15 @@ export class RpcDispatcher {
       return migrationFence
     }
 
-    const parsedParams = parseRpcRequestParams(request, method, meta)
+    let resolved: ResolvedOrchestrationRequest = { request }
+    if (needsOrchestrationCallerResolution(request)) {
+      try {
+        resolved = await resolveOrchestrationSessionCaller(this.runtime, request, options)
+      } catch (error) {
+        return mapDispatcherError(request, meta, error)
+      }
+    }
+    const parsedParams = parseRpcRequestParams(resolved.request, method, meta)
     if (parsedParams.error) {
       return parsedParams.error
     }
@@ -89,24 +103,25 @@ export class RpcDispatcher {
     try {
       const result = await invokeDispatcherUnaryMethod({
         runtime: this.runtime,
-        request,
+        request: resolved.request,
         method,
         params: parsedParams.value,
         context: {
           runtime: this.runtime,
           signal: options?.signal,
           connectionId: options?.connectionId,
-          subscriptionRegistrationVersion:
-            request.method === 'terminal.unsubscribe'
-              ? this.runtime.getSubscriptionRegistrationVersion()
-              : undefined,
+          // Session tabs always need this fence. COMPAT(terminal request-addressed unsubscribe): terminal only for phones without `requestId`.
+          subscriptionRegistrationVersion: isRegistrationFencedUnsubscribe(request.method)
+            ? this.runtime.getSubscriptionRegistrationVersion()
+            : undefined,
           requestId: request.id,
           clientId: options?.clientId,
           clientKind: options?.clientKind,
           clientCapabilities: options?.clientCapabilities,
           updateClientCapabilities: options?.updateClientCapabilities,
           orchestrationCapability: request.orchestrationCapability,
-          authenticatedCallerFingerprint: options?.authenticatedCallerFingerprint
+          authenticatedCallerFingerprint: options?.authenticatedCallerFingerprint,
+          orchestrationCaller: resolved.caller
         },
         orchestrationMutations: this.orchestrationMutations,
         legacyOrchestration: this.legacyOrchestration
diff --git a/src/main/runtime/rpc/errors.test.ts b/src/main/runtime/rpc/errors.test.ts
index 02ae6a335f22..624557c1f7f4 100644
--- a/src/main/runtime/rpc/errors.test.ts
+++ b/src/main/runtime/rpc/errors.test.ts
@@ -15,6 +15,11 @@ import {
   nestedWorkerDepthExceededMessage
 } from '../../../shared/nested-worker-depth'
 import { OrchestrationError } from '../orchestration/orchestration-error'
+import {
+  AgentSessionRefusalError,
+  agentSessionRefusalError,
+  refuseUnclassified
+} from '../../../shared/agent-session-wire-refusals'
 
 class LineageError extends Error {
   code = 'LINEAGE_PARENT_NOT_FOUND'
@@ -297,3 +302,63 @@ describe('structured worker dispatch preamble errors', () => {
     })
   })
 })
+
+describe('thrown agent-session refusals', () => {
+  const meta = { runtimeId: 'runtime-1' }
+
+  // Released clients classify a thrown refusal by its wire code and message; both must read
+  // exactly as the bare `Error(code)` this replaced.
+  it.each([
+    [
+      'agent_session_ownership_unknown',
+      'agent_session_ownership_unknown',
+      agentSessionRefusalError('agent_session_ownership_unknown', { reason: 'noLiveOwner' })
+    ],
+    [
+      'structured_agent_session_unsupported',
+      'runtime_error',
+      agentSessionRefusalError('structured_agent_session_unsupported', { reason: 'hostDisabled' })
+    ],
+    [
+      'agent_session_checkpoint_stale',
+      'agent_session_checkpoint_stale',
+      agentSessionRefusalError('agent_session_checkpoint_stale', {
+        reason: 'fenceStale',
+        currentFence: 4
+      })
+    ]
+  ] as const)(
+    'keeps %s on the wire as it was, and adds its details in data',
+    (code, wire, error) => {
+      const before = mapRuntimeError('req_1', meta, new Error(code))
+      const after = mapRuntimeError('req_1', meta, error)
+      expect(after.error.code).toBe(before.error.code)
+      expect(after.error.code).toBe(wire)
+      expect(after.error.message).toBe(before.error.message)
+      expect(after.error.message).toBe(code)
+      expect(after.error.data).toEqual({ refusal: { code, details: error.refusal.details } })
+      expect(error.refusal.details?.reason).toBeDefined()
+    }
+  )
+
+  it('carries no details in data when the refusal named none', () => {
+    const response = mapRuntimeError(
+      'req_1',
+      meta,
+      new AgentSessionRefusalError(
+        refuseUnclassified('agent_session_conflict', 'Another process claims this session.')
+      )
+    )
+    expect(response.error).toEqual({
+      code: 'agent_session_conflict',
+      message: 'agent_session_conflict',
+      data: { refusal: { code: 'agent_session_conflict' } }
+    })
+  })
+
+  it('exposes no code property another passthrough could claim', () => {
+    expect(
+      'code' in agentSessionRefusalError('agent_session_conflict', { reason: 'claimConflicted' })
+    ).toBe(false)
+  })
+})
diff --git a/src/main/runtime/rpc/errors.ts b/src/main/runtime/rpc/errors.ts
index c2402d878495..6d122c02d453 100644
--- a/src/main/runtime/rpc/errors.ts
+++ b/src/main/runtime/rpc/errors.ts
@@ -2,7 +2,13 @@
 // runtime/browser error allowlists define the contract the CLI relies on to
 // format human-facing messages. Centralizing this mapping keeps the allowlist
 // auditable in one place instead of spread across per-method branches.
+import {
+  agentSessionRefusalReference,
+  isAgentSessionRefusalError,
+  type AgentSessionRefusalError
+} from '../../../shared/agent-session-wire-refusals'
 import type { RpcEnvelopeMeta, RpcFailure, RpcSuccess } from './core'
+import { ORCHESTRATION_SESSION_CALLER_ERROR_CODES } from '../../../shared/orchestration-session-caller-codes'
 import { computerUseErrorRecoveryData } from '../../../shared/computer-use-error-recovery'
 import { COMPUTER_ERROR_CODES } from '../../../shared/runtime-types'
 import { LINEAR_ERROR_CODES } from '../../../shared/linear/agent-access'
@@ -153,11 +159,15 @@ const STRUCTURED_RUNTIME_PASSTHROUGH_CODES: ReadonlySet<string> = new Set([
   SKILL_INSTALL_RPC_ERROR_CODE,
   // Why: an owner conflict is a distinct client decision (reload the host, re-adopt,
   // stop offering the action) — flattened to runtime_error it can only be guessed at.
-  ...Object.values(AUTOMATION_OWNER_CONFLICT_CODES)
+  ...Object.values(AUTOMATION_OWNER_CONFLICT_CODES),
+  ...Object.values(ORCHESTRATION_SESSION_CALLER_ERROR_CODES)
 ])
 
 export function mapRuntimeError(id: string, meta: RpcEnvelopeMeta, error: unknown): RpcFailure {
   const message = error instanceof Error ? error.message : String(error)
+  if (isAgentSessionRefusalError(error)) {
+    return agentSessionRefusalErrorResponse(id, meta, error)
+  }
   if (
     error instanceof Error &&
     'code' in error &&
@@ -228,6 +238,27 @@ export function mapRuntimeError(id: string, meta: RpcEnvelopeMeta, error: unknow
   return errorResponse(id, meta, 'runtime_error', message)
 }
 
+/**
+ * A thrown agent-session refusal, mapped before any `'code' in error` passthrough so no other
+ * subsystem's code set can claim it. Wire code and message are exactly what the bare `Error(code)`
+ * it replaced produced — released clients classify both — and the refusal's details ride only in
+ * `data`, which they ignore.
+ */
+function agentSessionRefusalErrorResponse(
+  id: string,
+  meta: RpcEnvelopeMeta,
+  error: AgentSessionRefusalError
+): RpcFailure {
+  const { code } = error.refusal
+  return errorResponse(
+    id,
+    meta,
+    RUNTIME_PASSTHROUGH_CODES.has(code) ? code : 'runtime_error',
+    code,
+    { refusal: agentSessionRefusalReference(error.refusal) }
+  )
+}
+
 export const computerErrorData = computerUseErrorRecoveryData
 
 // Why: browser errors carry a structured .code property (BrowserError from
diff --git a/src/main/runtime/rpc/methods/agent-launch-caller-selection.test.ts b/src/main/runtime/rpc/methods/agent-launch-caller-selection.test.ts
new file mode 100644
index 000000000000..8ef0f2c904dd
--- /dev/null
+++ b/src/main/runtime/rpc/methods/agent-launch-caller-selection.test.ts
@@ -0,0 +1,181 @@
+/**
+ * A launch from a paired client moves that client's view to the new tab and nobody else's: the view
+ * intent belongs to the connection that asked. In-process callers and workspace-creating launches
+ * keep today's behaviour.
+ */
+
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { AgentSessionRecordStore } from '../../agent-session-record-store'
+import { setStructuredAgentSessionHost } from '../../../native-chat/agent-session-wire/structured-agent-session-registry'
+import type { StructuredAgentSessionHost } from '../../../native-chat/agent-session-wire/structured-agent-session-host'
+import type { RpcContext } from '../core'
+import {
+  CAPABLE_CLIENT,
+  STRUCTURED_PREFERENCE,
+  methodNamed,
+  rpcContext,
+  runtimeStub,
+  type AgentLaunchRuntimeStub
+} from './agent-launch.test-fixture'
+
+const createStructuredSession = vi.hoisted(() => vi.fn())
+vi.mock('./structured-agent-session-create', () => ({
+  createStructuredAgentSessionForWorktree: createStructuredSession
+}))
+
+const { AGENT_LAUNCH_METHODS } = await import('./agent-launch')
+const AGENT_LAUNCH = methodNamed(AGENT_LAUNCH_METHODS, 'agent.launch')
+const AGENT_LAUNCH_REPLAY = methodNamed(AGENT_LAUNCH_METHODS, 'agent.launchReplay')
+
+const TAB_ID = '9b1deb4d-3b7d-4bad-9bdd-2b0d7b3dcb6d'
+const LEAF_ID = '3f2504e0-4f89-41d3-9a0c-0305e82c3301'
+const PANE_KEY = `${TAB_ID}:${LEAF_ID}`
+const EXISTING_LAUNCH = { agent: 'claude', target: { kind: 'existing', worktree: 'id:wt-7' } }
+const CREATE_LAUNCH = {
+  agent: 'claude',
+  target: { kind: 'create-worktree', create: { repo: 'id:repo-1', name: 'task' } }
+}
+const CALLER = 'device-1'
+
+function selectionRuntime(options: Parameters<typeof runtimeStub>[0]) {
+  return Object.assign(runtimeStub(options), {
+    selectCreatedMobileSessionTabForClient: vi.fn(() => true)
+  })
+}
+
+async function launch(
+  params: unknown,
+  runtime: AgentLaunchRuntimeStub,
+  context: Partial<RpcContext> = CAPABLE_CLIENT
+) {
+  return AGENT_LAUNCH.handler(AGENT_LAUNCH.params.parse(params), rpcContext(runtime, context))
+}
+
+function chatActivation(): unknown {
+  return createStructuredSession.mock.calls[0]?.[0]?.activate
+}
+
+beforeEach(() => {
+  createStructuredSession
+    .mockReset()
+    .mockResolvedValue({ ok: true, value: { sessionId: 'sess-1' } })
+})
+
+describe('a paired client launching into an existing workspace', () => {
+  it("selects the new terminal as that client's tab only", async () => {
+    const runtime = selectionRuntime({ settings: {}, terminalPaneKey: PANE_KEY })
+
+    await launch(EXISTING_LAUNCH, runtime)
+
+    expect(runtime.selectCreatedMobileSessionTabForClient).toHaveBeenCalledExactlyOnceWith(
+      'wt-7',
+      expect.objectContaining({ tabId: TAB_ID, leafId: LEAF_ID }),
+      CALLER
+    )
+  })
+
+  it('publishes the chat without activating it for everyone, then selects it by session for the caller', async () => {
+    const runtime = selectionRuntime({ settings: STRUCTURED_PREFERENCE })
+
+    const result = await launch(EXISTING_LAUNCH, runtime)
+
+    expect(result.outcome.kind).toBe('structured')
+    expect(chatActivation()).toBe(false)
+    expect(runtime.selectCreatedMobileSessionTabForClient).toHaveBeenCalledExactlyOnceWith(
+      'wt-7',
+      { sessionId: 'sess-1' },
+      CALLER
+    )
+  })
+
+  it('still reports the launch when selecting its tab fails', async () => {
+    const runtime = selectionRuntime({ settings: {}, terminalPaneKey: PANE_KEY })
+    runtime.selectCreatedMobileSessionTabForClient.mockImplementationOnce(() => {
+      throw new Error('selection store unavailable')
+    })
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+
+    const result = await launch(EXISTING_LAUNCH, runtime)
+
+    expect(result.outcome).toMatchObject({ kind: 'terminal', handle: 'term_1' })
+    warn.mockRestore()
+  })
+
+  it('selects nothing when the runtime reported no pane for the terminal', async () => {
+    const runtime = selectionRuntime({ settings: {} })
+
+    await launch(EXISTING_LAUNCH, runtime)
+
+    expect(runtime.selectCreatedMobileSessionTabForClient).not.toHaveBeenCalled()
+  })
+})
+
+describe('launches that keep the host-wide behaviour', () => {
+  it('an in-process caller activates the chat and selects nothing per client', async () => {
+    const runtime = selectionRuntime({ settings: STRUCTURED_PREFERENCE })
+
+    await launch(EXISTING_LAUNCH, runtime, {})
+
+    expect(chatActivation()).toBe(true)
+    expect(runtime.selectCreatedMobileSessionTabForClient).not.toHaveBeenCalled()
+  })
+
+  it("the host's own desktop window, a runtime client with no paired device, still activates the chat", async () => {
+    const runtime = selectionRuntime({ settings: STRUCTURED_PREFERENCE })
+
+    await launch(EXISTING_LAUNCH, runtime, {
+      ...CAPABLE_CLIENT,
+      clientKind: 'runtime',
+      pairedDeviceId: undefined
+    })
+
+    expect(chatActivation()).toBe(true)
+    expect(runtime.selectCreatedMobileSessionTabForClient).not.toHaveBeenCalled()
+  })
+
+  it('a workspace-creating launch from a paired client keeps the create navigation', async () => {
+    const runtime = selectionRuntime({ settings: STRUCTURED_PREFERENCE })
+
+    await launch(CREATE_LAUNCH, runtime)
+
+    expect(chatActivation()).toBe(true)
+    expect(runtime.selectCreatedMobileSessionTabForClient).not.toHaveBeenCalled()
+  })
+})
+
+describe('a replayed launch', () => {
+  // The ledger admits against `Date.now()`, so the id must be dated now.
+  const OPERATION_ID = `${Date.now()}-000000000000000000000000000000dd`
+  let directory: string
+
+  beforeEach(async () => {
+    directory = await mkdtemp(join(tmpdir(), 'orca-agent-launch-caller-'))
+    const store = await AgentSessionRecordStore.open({ directory, hostId: 'local' })
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: `deps.store` is the only member `agent.launch` reads, and a member it omits throws on call.
+    setStructuredAgentSessionHost({ deps: { store } } as unknown as StructuredAgentSessionHost)
+  })
+
+  afterEach(async () => {
+    setStructuredAgentSessionHost(null)
+    await rm(directory, { recursive: true, force: true })
+  })
+
+  it('answers from the record without moving the caller again', async () => {
+    const params = AGENT_LAUNCH_REPLAY.params.parse({
+      ...EXISTING_LAUNCH,
+      operationId: OPERATION_ID
+    })
+    const first = selectionRuntime({ settings: {}, terminalPaneKey: PANE_KEY })
+    await AGENT_LAUNCH_REPLAY.handler(params, rpcContext(first, CAPABLE_CLIENT))
+    expect(first.selectCreatedMobileSessionTabForClient).toHaveBeenCalledOnce()
+
+    const replay = selectionRuntime({ settings: {}, terminalPaneKey: PANE_KEY })
+    await AGENT_LAUNCH_REPLAY.handler(params, rpcContext(replay, CAPABLE_CLIENT))
+
+    expect(replay.createTerminal).not.toHaveBeenCalled()
+    expect(replay.selectCreatedMobileSessionTabForClient).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/main/runtime/rpc/methods/agent-launch-caller-selection.ts b/src/main/runtime/rpc/methods/agent-launch-caller-selection.ts
new file mode 100644
index 000000000000..b5fe4fe31f4c
--- /dev/null
+++ b/src/main/runtime/rpc/methods/agent-launch-caller-selection.ts
@@ -0,0 +1,57 @@
+/**
+ * Which view a launch moves: the requesting connection's, never the host's or another client's.
+ *
+ * A paired client (a phone, or a desktop client of a remote server) that launches into an existing
+ * workspace gets the new tab as its own selection, recorded the way `session.tabs.createTerminal`
+ * selects the tab it creates for its caller. In-process callers keep today's behaviour, and a
+ * launch that creates its workspace keeps `worktree.create`'s navigation, whose host activation is
+ * what runs the new workspace's setup.
+ */
+
+import type { AgentLaunchResult, AgentLaunchTarget } from '../../../../shared/agent-launch-intent'
+import { parsePaneKey } from '../../../../shared/stable-pane-id'
+import type { OrcaRuntimeService } from '../../orca-runtime'
+import type { RpcContext } from '../core'
+
+/** The paired client whose view this launch should move, or null when it moves the host's. */
+export function agentLaunchCallerNavigationId(
+  target: AgentLaunchTarget,
+  context: Pick<RpcContext, 'clientKind' | 'pairedDeviceId'>
+): string | null {
+  if (target.kind !== 'existing' || context.clientKind === undefined) {
+    return null
+  }
+  return context.pairedDeviceId?.trim() || null
+}
+
+/** Bookkeeping, never a gate: the agent already runs, so a failure here only leaves the view as it was. */
+export function selectAgentLaunchTabForCaller(
+  runtime: Pick<OrcaRuntimeService, 'selectCreatedMobileSessionTabForClient'>,
+  result: AgentLaunchResult,
+  clientNavigationId: string
+): void {
+  const { outcome } = result
+  // Found by pane or session, never by a predicted tab id.
+  const surface =
+    outcome.kind === 'terminal'
+      ? outcome.paneKey
+        ? parsePaneKey(outcome.paneKey)
+        : null
+      : { sessionId: outcome.sessionId }
+  if (!surface) {
+    return
+  }
+  try {
+    if (
+      !runtime.selectCreatedMobileSessionTabForClient(
+        result.worktreeId,
+        surface,
+        clientNavigationId
+      )
+    ) {
+      console.warn('[agent-launch] the launch ran; its tab was not published to select')
+    }
+  } catch (error) {
+    console.warn('[agent-launch] the launch ran; selecting its tab for the caller did not', error)
+  }
+}
diff --git a/src/main/runtime/rpc/methods/agent-launch-failure-code.ts b/src/main/runtime/rpc/methods/agent-launch-failure-code.ts
new file mode 100644
index 000000000000..eac21c7c00e9
--- /dev/null
+++ b/src/main/runtime/rpc/methods/agent-launch-failure-code.ts
@@ -0,0 +1,57 @@
+import type { AgentLaunchTarget } from '../../../../shared/agent-launch-intent'
+import {
+  WorktreeCreateCollisionError,
+  WORKTREE_CREATE_COLLISION_CODE
+} from '../../../../shared/new-workspace/worktree-create-collision'
+import {
+  AgentLaunchPaneAlreadyLiveError,
+  AGENT_LAUNCH_PANE_ALREADY_LIVE_CODE
+} from '../../../../shared/agent-launch-pane-already-live'
+import {
+  AgentLaunchSessionAlreadyExistsError,
+  AGENT_LAUNCH_SESSION_ALREADY_EXISTS_CODE
+} from '../../../../shared/agent-launch-session-already-exists'
+import type { TerminalSpawnDispatch } from '../../../agent-launch/agent-launch-not-started'
+
+/** Long enough for every code this path raises, with room for one a later guard adds. */
+const LAUNCH_FAILURE_CODE_MAX_LENGTH = 128
+
+/**
+ * This path raises its refusals as the thrown code, the way the method's own guards do — and the
+ * recorded code is what a replay answers with, so it is worth keeping.
+ *
+ * Bounded because a code is an identifier but `error.message` is free text: an errno sentence
+ * carrying an absolute path arrives here as one, and it would be written into a ledger file that is
+ * re-serialized whole on every subsequent operation. Bounded on the way IN only. A length check in
+ * `isAgentSessionOperationRow` would reject rows this same build wrote, and one rejected row costs
+ * the entire store.
+ */
+export function agentLaunchFailureCode(error: unknown): string {
+  const code = error instanceof Error ? error.message : ''
+  return code.length > 0 ? code.slice(0, LAUNCH_FAILURE_CODE_MAX_LENGTH) : 'agent_launch_failed'
+}
+
+/**
+ * Only a typed refusal raised before anything was created proves the claimed launch had no effects.
+ * A live reserved pane or an existing reserved session proves it only for an existing workspace; on
+ * create-worktree the workspace already exists by the time the surface is refused.
+ */
+export function launchFailureWithoutEffectsCode(
+  error: unknown,
+  targetKind: AgentLaunchTarget['kind'],
+  terminalSpawn: TerminalSpawnDispatch
+): string | null {
+  if (error instanceof WorktreeCreateCollisionError) {
+    return WORKTREE_CREATE_COLLISION_CODE
+  }
+  if (error instanceof AgentLaunchPaneAlreadyLiveError && targetKind === 'existing') {
+    return AGENT_LAUNCH_PANE_ALREADY_LIVE_CODE
+  }
+  if (error instanceof AgentLaunchSessionAlreadyExistsError && targetKind === 'existing') {
+    return AGENT_LAUNCH_SESSION_ALREADY_EXISTS_CODE
+  }
+  if (terminalSpawn.failedBeforeDispatch(error) && targetKind === 'existing') {
+    return agentLaunchFailureCode(error)
+  }
+  return null
+}
diff --git a/src/main/runtime/rpc/methods/agent-launch-floating-workspace.test.ts b/src/main/runtime/rpc/methods/agent-launch-floating-workspace.test.ts
index 5551c4de354e..1df2c1f7433a 100644
--- a/src/main/runtime/rpc/methods/agent-launch-floating-workspace.test.ts
+++ b/src/main/runtime/rpc/methods/agent-launch-floating-workspace.test.ts
@@ -64,7 +64,7 @@ describe('agent.launch with the real floating workspace resolver', () => {
       expect(structuredHost).not.toHaveBeenCalled()
       expect(createTerminal).toHaveBeenCalledExactlyOnceWith(
         `id:${FLOATING_TERMINAL_WORKTREE_ID}`,
-        { startupAgent: 'claude' }
+        { startupAgent: 'claude', onPtySpawnDispatched: expect.any(Function) }
       )
       expect(result).toMatchObject({
         worktreeId: FLOATING_TERMINAL_WORKTREE_ID,
diff --git a/src/main/runtime/rpc/methods/agent-launch-prestart-failure.test.ts b/src/main/runtime/rpc/methods/agent-launch-prestart-failure.test.ts
new file mode 100644
index 000000000000..6b7adb8dbfc7
--- /dev/null
+++ b/src/main/runtime/rpc/methods/agent-launch-prestart-failure.test.ts
@@ -0,0 +1,171 @@
+/**
+ * A terminal launch that fails before its spawn is requested — no launch command, runtime
+ * unavailable — created nothing, so a named operation settles as failed with its real cause.
+ * Once the request has left, a failure proves nothing and the outcome stays unknown.
+ */
+
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { AgentSessionRecordStore } from '../../agent-session-record-store'
+import { setStructuredAgentSessionHost } from '../../../native-chat/agent-session-wire/structured-agent-session-registry'
+import type { StructuredAgentSessionHost } from '../../../native-chat/agent-session-wire/structured-agent-session-host'
+import type { OrcaRuntimeService } from '../../orca-runtime'
+import { RpcDispatcher } from '../dispatcher'
+import { methodNamed, runtimeStub, type AgentLaunchRuntimeStub } from './agent-launch.test-fixture'
+
+vi.mock('./structured-agent-session-create', () => ({
+  createStructuredAgentSessionForWorktree: async () => ({
+    ok: true,
+    value: { sessionId: 'sess-1' }
+  })
+}))
+
+const { AGENT_LAUNCH_METHODS } = await import('./agent-launch')
+const AGENT_LAUNCH_REPLAY = methodNamed(AGENT_LAUNCH_METHODS, 'agent.launchReplay')
+
+const EXISTING_LAUNCH = { agent: 'claude', target: { kind: 'existing', worktree: 'id:wt-7' } }
+const CREATE_LAUNCH = {
+  agent: 'claude',
+  target: { kind: 'create-worktree', create: { repo: 'id:repo-1', name: 'task' } }
+}
+const NO_LAUNCH_COMMAND = 'Could not build launch command for claude.'
+type Launch = typeof EXISTING_LAUNCH | typeof CREATE_LAUNCH
+
+/** The create throws; `afterDispatch` says whether the spawn request had already left. */
+function failingCreate(runtime: AgentLaunchRuntimeStub, error: Error, afterDispatch: boolean) {
+  runtime.createTerminal.mockImplementation(
+    async (_selector: string, options?: Record<string, unknown>) => {
+      const dispatched = options?.onPtySpawnDispatched
+      if (afterDispatch && typeof dispatched === 'function') {
+        dispatched()
+      }
+      throw error
+    }
+  )
+}
+
+describe('a launch whose terminal fails', () => {
+  // The ledger admits against `Date.now()`, so the ids must be dated now.
+  const OPERATION_ID = `${Date.now()}-000000000000000000000000000000cc`
+  const OTHER_OPERATION_ID = `${Date.now()}-000000000000000000000000000000dd`
+  let directory: string
+  let store: AgentSessionRecordStore
+
+  beforeEach(async () => {
+    directory = await mkdtemp(join(tmpdir(), 'orca-agent-launch-prestart-'))
+    store = await AgentSessionRecordStore.open({ directory, hostId: 'local' })
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: `deps.store` is the only member `agent.launch` reads, and a member it omits throws on call.
+    setStructuredAgentSessionHost({ deps: { store } } as unknown as StructuredAgentSessionHost)
+  })
+
+  afterEach(async () => {
+    setStructuredAgentSessionHost(null)
+    await rm(directory, { recursive: true, force: true })
+  })
+
+  function outcomeOf(operationId: string) {
+    return store.listOperationRows().find((row) => row.operationId === operationId)?.outcome
+  }
+
+  async function replay(
+    runtime: AgentLaunchRuntimeStub,
+    launch: Launch,
+    operationId: string = OPERATION_ID
+  ) {
+    const dispatcher = new RpcDispatcher({
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the fixture implements every runtime method reached by agent.launch and dispatcher metadata.
+      runtime: { ...runtime, getRuntimeId: () => 'runtime-1' } as unknown as OrcaRuntimeService,
+      methods: AGENT_LAUNCH_METHODS
+    })
+    return dispatcher.dispatch({
+      id: 'request-1',
+      authToken: 'token',
+      method: 'agent.launchReplay',
+      params: AGENT_LAUNCH_REPLAY.params.parse({ ...launch, operationId })
+    })
+  }
+
+  it('reports a failure before the spawn request with its real cause and records it', async () => {
+    const runtime = runtimeStub({ settings: {} })
+    failingCreate(runtime, new Error(NO_LAUNCH_COMMAND), false)
+
+    const response = await replay(runtime, EXISTING_LAUNCH)
+
+    expect(response).toMatchObject({ ok: false, error: { message: NO_LAUNCH_COMMAND } })
+    expect(outcomeOf(OPERATION_ID)).toMatchObject({ status: 'failed', code: NO_LAUNCH_COMMAND })
+  })
+
+  it('keeps a stable runtime code such as runtime_unavailable', async () => {
+    const runtime = runtimeStub({ settings: {} })
+    failingCreate(runtime, new Error('runtime_unavailable'), false)
+
+    const response = await replay(runtime, EXISTING_LAUNCH)
+
+    expect(response).toMatchObject({ ok: false, error: { code: 'runtime_unavailable' } })
+  })
+
+  it('answers a retry of the same operation from the record instead of launching again', async () => {
+    const first = runtimeStub({ settings: {} })
+    failingCreate(first, new Error(NO_LAUNCH_COMMAND), false)
+    await replay(first, EXISTING_LAUNCH)
+
+    const retry = runtimeStub({ settings: {} })
+    const response = await replay(retry, EXISTING_LAUNCH)
+
+    expect(retry.createTerminal).not.toHaveBeenCalled()
+    expect(response).toMatchObject({ ok: false, error: { message: NO_LAUNCH_COMMAND } })
+  })
+
+  it('stays unknown when the failure came after the spawn request left', async () => {
+    // An SSH or daemon spawn whose reply was lost may still have started an agent.
+    const runtime = runtimeStub({ settings: {} })
+    failingCreate(runtime, new Error('ssh_channel_closed'), true)
+
+    const response = await replay(runtime, EXISTING_LAUNCH)
+
+    expect(response).toMatchObject({
+      ok: false,
+      error: { code: 'agent_session_operation_unknown' }
+    })
+    expect(outcomeOf(OPERATION_ID)?.status).toBe('unknown')
+  })
+
+  it('stays unknown when another launch saw the same error before its own spawn request', async () => {
+    // A failed pane spawn rejects one error into the spawner and into a create waiting on that pane.
+    const shared = new Error('ssh_channel_closed')
+    const waiting = runtimeStub({ settings: {} })
+    failingCreate(waiting, shared, false)
+    await replay(waiting, EXISTING_LAUNCH, OTHER_OPERATION_ID)
+    expect(outcomeOf(OTHER_OPERATION_ID)?.status).toBe('failed')
+
+    const spawner = runtimeStub({ settings: {} })
+    failingCreate(spawner, shared, true)
+    const response = await replay(spawner, EXISTING_LAUNCH)
+
+    expect(response).toMatchObject({
+      ok: false,
+      error: { code: 'agent_session_operation_unknown' }
+    })
+    expect(outcomeOf(OPERATION_ID)?.status).toBe('unknown')
+  })
+
+  it('stays unknown for a launch that created its workspace first', async () => {
+    const runtime = runtimeStub({ settings: {} })
+    // No startup terminal came back, so the launch builds its own in the new workspace.
+    runtime.createManagedWorktree.mockResolvedValueOnce({
+      worktree: { id: 'wt-new' },
+      startupTerminal: undefined
+    })
+    failingCreate(runtime, new Error(NO_LAUNCH_COMMAND), false)
+
+    const response = await replay(runtime, CREATE_LAUNCH)
+
+    expect(runtime.createTerminal).toHaveBeenCalledTimes(1)
+    expect(response).toMatchObject({
+      ok: false,
+      error: { code: 'agent_session_operation_unknown' }
+    })
+  })
+})
diff --git a/src/main/runtime/rpc/methods/agent-launch-replay.test.ts b/src/main/runtime/rpc/methods/agent-launch-replay.test.ts
index 3d6981ed4a16..336cd4c212b5 100644
--- a/src/main/runtime/rpc/methods/agent-launch-replay.test.ts
+++ b/src/main/runtime/rpc/methods/agent-launch-replay.test.ts
@@ -585,7 +585,8 @@ describe('the inner attach reserves under its own id', () => {
     })
     expect(forwarded).toEqual({
       decision: 'refused',
-      code: 'agent_session_operation_conflict'
+      code: 'agent_session_operation_conflict',
+      details: { reason: 'operationIdReused' }
     })
 
     const derived = deriveAgentLaunchChildOperationId(OPERATION_ID)
diff --git a/src/main/runtime/rpc/methods/agent-launch-replay.ts b/src/main/runtime/rpc/methods/agent-launch-replay.ts
index 223d4a56c9ed..ec9269f4efea 100644
--- a/src/main/runtime/rpc/methods/agent-launch-replay.ts
+++ b/src/main/runtime/rpc/methods/agent-launch-replay.ts
@@ -11,8 +11,8 @@
  * resolving the caller's worktree selector, because a selector resolution is a live precondition
  * and a replay must not be able to fail on one: an operation that already ran has an answer, and
  * re-deciding it against today's world is how a recorded success becomes a fresh refusal the client
- * then retries as a second effect. `admitAgentSessionMutation` puts the ledger ahead of the lease
- * and the fence for that same reason.
+ * then retries as a second effect. `admitAgentSessionMutation` puts the ledger ahead of the writer
+ * lease for that same reason.
  */
 
 import { deriveAgentLaunchChildOperationId } from '../../../../shared/agent-launch-operation'
diff --git a/src/main/runtime/rpc/methods/agent-launch-structured-prompt.ts b/src/main/runtime/rpc/methods/agent-launch-structured-prompt.ts
index 0037d6fc35e9..11762137ba2f 100644
--- a/src/main/runtime/rpc/methods/agent-launch-structured-prompt.ts
+++ b/src/main/runtime/rpc/methods/agent-launch-structured-prompt.ts
@@ -63,9 +63,9 @@ export async function commitStructuredAgentSessionLaunchPrompt(args: {
     // Settlement can fail after the journal append. Re-read the authoritative row before asking
     // the caller to resend, otherwise a retry creates a duplicate turn.
     try {
-      const committed = args.host
-        .journalSnapshot(args.sessionId)
-        .submissions.find((submission) => submission.clientMessageId === clientMessageId)
+      const committed = (await args.host.journalSnapshot(args.sessionId)).submissions.find(
+        (submission) => submission.clientMessageId === clientMessageId
+      )
       if (committed) {
         return clientMessageId
       }
diff --git a/src/main/runtime/rpc/methods/agent-launch-surfaces.ts b/src/main/runtime/rpc/methods/agent-launch-surfaces.ts
index 412d947d441a..07dcdb531865 100644
--- a/src/main/runtime/rpc/methods/agent-launch-surfaces.ts
+++ b/src/main/runtime/rpc/methods/agent-launch-surfaces.ts
@@ -4,8 +4,8 @@
  * Both halves are deliberately the plain, user-facing forms: a structured session created for the
  * worktree exactly as `agentSession.create` creates one, and a terminal agent created exactly as a
  * new agent tab is. Orchestration's own factories are NOT reusable here — a worker's session
- * carries a dispatch hold, a mailbox and a background tab that a launch the user asked for must
- * not take — which is why the executor injects this rather than branching.
+ * carries a redrive subscription, a mailbox and a background tab that a launch the user asked for
+ * must not take — which is why the executor injects this rather than branching.
  *
  * Delivering the launch text is here for the same reason: it is the wire-shaped half. Each surface
  * takes it differently — a structured session commits it to a transcript, a terminal agent takes it
@@ -36,12 +36,19 @@ import { AgentLaunchSessionAlreadyExistsError } from '../../../../shared/agent-l
 import { createStructuredAgentSessionId } from '../../../../shared/structured-agent-session-create'
 import { toAgentLaunchPreferences } from '../../../../shared/agent-launch-preferences'
 import { paneIdentity } from '../../runtime-terminal-pane-identity'
+import {
+  trackTerminalSpawnDispatch,
+  type TerminalSpawnDispatch
+} from '../../../agent-launch/agent-launch-not-started'
 
 /** Replay-safe launches keep the nested attach in the same stable caller namespace as the launch. */
 export function agentLaunchSurfaceFactory(
   context: RpcContext,
   attachOperationId?: string,
-  operationCallerKey?: string
+  operationCallerKey?: string,
+  // False when the launch selects the chat for its paired caller instead of for everyone.
+  activateChat = true,
+  terminalSpawn: TerminalSpawnDispatch = trackTerminalSpawnDispatch()
 ): AgentLaunchSurfaceFactory {
   return {
     createStructuredSession: async ({
@@ -77,7 +84,7 @@ export function agentLaunchSurfaceFactory(
         ...(seeded ? { options: seeded } : {}),
         ...(tabId ? { tabId } : {}),
         // The user asked for this chat, so it takes the surface — unlike a dispatched worker.
-        activate: true
+        activate: activateChat
       })
       if (!created.ok) {
         // The caller named this session, so a taken id is its answer, not an opaque refusal; and not
@@ -118,7 +125,7 @@ export function agentLaunchSurfaceFactory(
       options
     }) => {
       const launchPreferences = toAgentLaunchPreferences(options)
-      const terminal = await context.runtime.createTerminal(`id:${worktreeId}`, {
+      const created = context.runtime.createTerminal(`id:${worktreeId}`, {
         // The agent id is not a shell command — `cursor` is the desktop app, its CLI is
         // `cursor-agent` — so the runtime builds the configured launcher.
         startupAgent: agent,
@@ -131,8 +138,10 @@ export function agentLaunchSurfaceFactory(
         ...(launchPreferences ? { launchPreferences } : {}),
         // A live reserved pane would be attached, not launched into, so the runtime refuses it.
         ...(paneKey ? { ...paneIdentity(paneKey), requireFreshPane: true } : {}),
-        ...agentLaunchTelemetry(agent, launchSource)
+        ...agentLaunchTelemetry(agent, launchSource),
+        onPtySpawnDispatched: terminalSpawn.onPtySpawnDispatched
       })
+      const terminal = await created.catch(terminalSpawn.rethrow)
       return {
         handle: terminal.handle,
         // The runtime already minted this pane and baked it into the PTY's env and its own reveal;
diff --git a/src/main/runtime/rpc/methods/agent-launch-terminal-prompt.ts b/src/main/runtime/rpc/methods/agent-launch-terminal-prompt.ts
index 41081daeb99d..ac66912e7475 100644
--- a/src/main/runtime/rpc/methods/agent-launch-terminal-prompt.ts
+++ b/src/main/runtime/rpc/methods/agent-launch-terminal-prompt.ts
@@ -66,6 +66,7 @@ export async function deliverTerminalAgentLaunchPrompt(args: {
       return false
     }
     const sent = await args.runtime.sendTerminalAgentPrompt(args.handle, args.text, {
+      inputKind: 'launch',
       // Paired: together these take the queued path, which settles an unobserved turn start into
       // an `input_accepted` receipt rather than raising it. Without the id the write is verified
       // strictly and a slow first turn throws.
diff --git a/src/main/runtime/rpc/methods/agent-launch.test.ts b/src/main/runtime/rpc/methods/agent-launch.test.ts
index f44ddb4978b7..b39dbc350f0f 100644
--- a/src/main/runtime/rpc/methods/agent-launch.test.ts
+++ b/src/main/runtime/rpc/methods/agent-launch.test.ts
@@ -461,7 +461,10 @@ describe('the terminal factory', () => {
     const runtime = runtimeStub({ createSupport: { supported: false, reason: 'wsl' } })
     const result = await launch(CREATE_LAUNCH, runtime)
 
-    expect(runtime.createTerminal).toHaveBeenCalledWith('id:wt-new', { startupAgent: 'claude' })
+    expect(runtime.createTerminal).toHaveBeenCalledWith('id:wt-new', {
+      startupAgent: 'claude',
+      onPtySpawnDispatched: expect.any(Function)
+    })
     expect(createStructuredSession).not.toHaveBeenCalled()
     expect(result.outcome).toEqual({ kind: 'terminal', handle: 'term_1' })
     // Never a failed launch, and never a silent downgrade.
@@ -481,7 +484,10 @@ describe('the terminal factory', () => {
     expect(runtime.showManagedTerminalWorkspace).not.toHaveBeenCalled()
     // Resolved to an id first: everything below re-prefixes it, so a raw selector reaches the
     // runtime as `id:id:wt-7`.
-    expect(runtime.createTerminal).toHaveBeenCalledWith('id:wt-7', { startupAgent: 'grok' })
+    expect(runtime.createTerminal).toHaveBeenCalledWith('id:wt-7', {
+      startupAgent: 'grok',
+      onPtySpawnDispatched: expect.any(Function)
+    })
     expect(result.worktreeId).toBe('wt-7')
   })
 })
diff --git a/src/main/runtime/rpc/methods/agent-launch.ts b/src/main/runtime/rpc/methods/agent-launch.ts
index eee9f2a48c1d..1c7448e5ca2e 100644
--- a/src/main/runtime/rpc/methods/agent-launch.ts
+++ b/src/main/runtime/rpc/methods/agent-launch.ts
@@ -31,20 +31,24 @@ import {
   WorktreeCreateCollisionError,
   WORKTREE_CREATE_COLLISION_CODE
 } from '../../../../shared/new-workspace/worktree-create-collision'
-import {
-  AgentLaunchPaneAlreadyLiveError,
-  AGENT_LAUNCH_PANE_ALREADY_LIVE_CODE
-} from '../../../../shared/agent-launch-pane-already-live'
-import {
-  AgentLaunchSessionAlreadyExistsError,
-  AGENT_LAUNCH_SESSION_ALREADY_EXISTS_CODE
-} from '../../../../shared/agent-launch-session-already-exists'
 import { executeAgentLaunch } from '../../../agent-launch/agent-launch-executor'
+import {
+  trackTerminalSpawnDispatch,
+  type TerminalSpawnDispatch
+} from '../../../agent-launch/agent-launch-not-started'
 import type { OrcaRuntimeService } from '../../orca-runtime'
 import { defineMethod, type RpcContext } from '../core'
 import { admitAgentLaunchOperation, agentLaunchOperationCallerKey } from './agent-launch-replay'
 import { AgentLaunch, AgentLaunchReplay, type AgentLaunchParams } from './agent-launch-schemas'
 import { agentLaunchSurfaceFactory } from './agent-launch-surfaces'
+import {
+  agentLaunchFailureCode,
+  launchFailureWithoutEffectsCode
+} from './agent-launch-failure-code'
+import {
+  agentLaunchCallerNavigationId,
+  selectAgentLaunchTabForCaller
+} from './agent-launch-caller-selection'
 import { agentLaunchWorkspaceFactory } from './agent-launch-worktree-creation'
 
 /**
@@ -138,18 +142,30 @@ async function resolveUnlaunchedIntent(
   return intent
 }
 
-function runAgentLaunch(
+async function runAgentLaunch(
   intent: AgentLaunchIntent,
   context: RpcContext,
   attachOperationId?: string,
-  operationCallerKey?: string
+  operationCallerKey?: string,
+  terminalSpawn?: TerminalSpawnDispatch
 ): Promise<AgentLaunchResult> {
-  return executeAgentLaunch({
+  const callerNavigationId = agentLaunchCallerNavigationId(intent.target, context)
+  const result = await executeAgentLaunch({
     runtime: context.runtime,
     intent,
-    surfaces: agentLaunchSurfaceFactory(context, attachOperationId, operationCallerKey),
+    surfaces: agentLaunchSurfaceFactory(
+      context,
+      attachOperationId,
+      operationCallerKey,
+      callerNavigationId === null,
+      terminalSpawn
+    ),
     workspaces: agentLaunchWorkspaceFactory(context, intent.agent)
   })
+  if (callerNavigationId !== null) {
+    selectAgentLaunchTabForCaller(context.runtime, result, callerNavigationId)
+  }
+  return result
 }
 
 /**
@@ -184,52 +200,17 @@ function settleQuietly(settlement: Promise<void>): Promise<void> {
   })
 }
 
-/** Long enough for every code this path raises, with room for one a later guard adds. */
-const LAUNCH_FAILURE_CODE_MAX_LENGTH = 128
-
-/**
- * This path raises its refusals as the thrown code, the way the method's own guards do — and the
- * recorded code is what a replay answers with, so it is worth keeping.
- *
- * Bounded because a code is an identifier but `error.message` is free text: an errno sentence
- * carrying an absolute path arrives here as one, and it would be written into a ledger file that is
- * re-serialized whole on every subsequent operation. Bounded on the way IN only. A length check in
- * `isAgentSessionOperationRow` would reject rows this same build wrote, and one rejected row costs
- * the entire store.
- */
-function agentLaunchFailureCode(error: unknown): string {
-  const code = error instanceof Error ? error.message : ''
-  return code.length > 0 ? code.slice(0, LAUNCH_FAILURE_CODE_MAX_LENGTH) : 'agent_launch_failed'
-}
-
-/**
- * Only a typed refusal raised before anything was created proves the claimed launch had no effects.
- * A live reserved pane or an existing reserved session proves it only for an existing workspace; on
- * create-worktree the workspace already exists by the time the surface is refused.
- */
-function launchFailureWithoutEffectsCode(
-  error: unknown,
-  targetKind: AgentLaunchTarget['kind']
-): string | null {
-  if (error instanceof WorktreeCreateCollisionError) {
-    return WORKTREE_CREATE_COLLISION_CODE
-  }
-  if (error instanceof AgentLaunchPaneAlreadyLiveError && targetKind === 'existing') {
-    return AGENT_LAUNCH_PANE_ALREADY_LIVE_CODE
-  }
-  if (error instanceof AgentLaunchSessionAlreadyExistsError && targetKind === 'existing') {
-    return AGENT_LAUNCH_SESSION_ALREADY_EXISTS_CODE
-  }
-  return null
-}
-
 type ActiveAgentLaunch = {
   fingerprint: string
   promise: Promise<AgentLaunchResult>
 }
 
 class AgentLaunchExecutionError extends Error {
-  constructor(cause: unknown) {
+  constructor(
+    cause: unknown,
+    /** Decided once, by the launch that ran; a later reader cannot re-derive it from the error. */
+    readonly failedWithoutEffects: boolean
+  ) {
     super('agent_session_operation_unknown', { cause })
   }
 }
@@ -268,15 +249,26 @@ async function executeReplaySafeAgentLaunch(
     await settleQuietly(admission.fail(agentLaunchFailureCode(error)))
     throw error
   }
+  const terminalSpawn = trackTerminalSpawnDispatch()
   let result: AgentLaunchResult
   try {
-    result = await runAgentLaunch(intent, context, admission.attachOperationId, admission.callerKey)
+    result = await runAgentLaunch(
+      intent,
+      context,
+      admission.attachOperationId,
+      admission.callerKey,
+      terminalSpawn
+    )
   } catch (error) {
-    const failedWithoutEffects = launchFailureWithoutEffectsCode(error, intent.target.kind)
+    const failedWithoutEffects = launchFailureWithoutEffectsCode(
+      error,
+      intent.target.kind,
+      terminalSpawn
+    )
     if (failedWithoutEffects) {
       await settleQuietly(admission.fail(failedWithoutEffects))
     }
-    throw new AgentLaunchExecutionError(error)
+    throw new AgentLaunchExecutionError(error, failedWithoutEffects !== null)
   }
   // Settlement is bookkeeping; failure leaves the truthful `unknown` refusal for later retries.
   await settleQuietly(admission.settle(result))
@@ -327,7 +319,7 @@ export const AGENT_LAUNCH_METHODS = [
               code: WORKTREE_CREATE_COLLISION_CODE
             })
           }
-          if (launchFailureWithoutEffectsCode(error.cause, params.target.kind)) {
+          if (error.failedWithoutEffects) {
             throw error.cause
           }
           throw new Error('agent_session_operation_unknown', { cause: error.cause })
diff --git a/src/main/runtime/rpc/methods/orchestration-caller-workspace.ts b/src/main/runtime/rpc/methods/orchestration-caller-workspace.ts
index 556938eef239..a3bbe7f01a38 100644
--- a/src/main/runtime/rpc/methods/orchestration-caller-workspace.ts
+++ b/src/main/runtime/rpc/methods/orchestration-caller-workspace.ts
@@ -14,12 +14,18 @@
  */
 
 import type { OrcaRuntimeService } from '../../orca-runtime'
+import type { OrchestrationSessionCaller } from '../../orchestration/orchestration-caller-identity'
 import { isStructuredWorkerHandle } from '../../structured-worker-identity'
 
 export async function resolveDispatchCallerWorktreeId(
   runtime: Pick<OrcaRuntimeService, 'showTerminal' | 'getOrchestrationDispatchAuthority'>,
-  callerHandle: string
+  callerHandle: string,
+  callerSession: OrchestrationSessionCaller | undefined
 ): Promise<string> {
+  // A session caller's workspace is on its record, whichever owner (chat or terminal) holds it.
+  if (callerSession) {
+    return callerSession.workspaceId
+  }
   if (isStructuredWorkerHandle(callerHandle)) {
     const worktreeId = runtime.getOrchestrationDispatchAuthority?.(callerHandle)?.worktreeId ?? null
     if (worktreeId) {
diff --git a/src/main/runtime/rpc/methods/orchestration-structured-worker-abandon.test.ts b/src/main/runtime/rpc/methods/orchestration-structured-worker-abandon.test.ts
index 983bd20ad955..cf6075246748 100644
--- a/src/main/runtime/rpc/methods/orchestration-structured-worker-abandon.test.ts
+++ b/src/main/runtime/rpc/methods/orchestration-structured-worker-abandon.test.ts
@@ -7,13 +7,12 @@ const released: string[] = []
 vi.mock('./orchestration-structured-worker-session', () => ({
   releaseStructuredWorkerSession: (dispatchId: string) => released.push(dispatchId),
   createStructuredWorkerSession: vi.fn(),
-  sendStructuredWorkerPreamble: vi.fn(),
-  structuredWorkerHoldId: (dispatchId: string) => `orchestration:dispatch:${dispatchId}`
+  sendStructuredWorkerPreamble: vi.fn()
 }))
 
 const harness = createOrchestrationRpcHarness()
 
-describe('workerAbandon settles the structured hold', () => {
+describe('workerAbandon settles the structured worker session', () => {
   let state: OrchestrationRpcState
 
   beforeEach(() => {
@@ -37,10 +36,10 @@ describe('workerAbandon settles the structured hold', () => {
     return started.dispatch.id
   }
 
-  it('releases the hold when the dispatch actually settles', async () => {
+  it('releases the worker session when the dispatch actually settles', async () => {
     const dispatchId = await startedDispatch()
-    // Without this, the resume-capable hold outlives settlement: the provider child can never be
-    // evicted and host crash recovery keeps respawning an abandoned worker.
+    // Without this, the redrive subscription outlives settlement and keeps nudging a session no
+    // dispatch owns.
     await harness.call('orchestration.workerAbandon', { dispatch: dispatchId }, state.ctx)
     expect(released).toEqual([dispatchId])
   })
diff --git a/src/main/runtime/rpc/methods/orchestration-structured-worker-lifecycle.test.ts b/src/main/runtime/rpc/methods/orchestration-structured-worker-lifecycle.test.ts
index a0d0426509b7..b669233c31fb 100644
--- a/src/main/runtime/rpc/methods/orchestration-structured-worker-lifecycle.test.ts
+++ b/src/main/runtime/rpc/methods/orchestration-structured-worker-lifecycle.test.ts
@@ -47,6 +47,7 @@ function installHost(options: {
   close?: () => Promise<void>
   setSessionTabVisibility?: () => Promise<void>
   historyThrows?: boolean
+  tabListed?: boolean
 }) {
   const record =
     options.record === undefined
@@ -63,6 +64,10 @@ function installHost(options: {
   let closed = false
   hostRef.current = {
     deps: { store: { getRecord: () => record } },
+    getPersistedVisibleSessionTabIndex: () => ({
+      present: true,
+      sessionIds: options.tabListed ? [IDENTITY.sessionId] : []
+    }),
     hasSession: () => (closed ? false : (options.hasSession ?? true)),
     setSessionTabVisibility: options.setSessionTabVisibility ?? (async () => {}),
     close:
@@ -84,7 +89,7 @@ describe('structured worker observation', () => {
     hostRef.current = null
   })
 
-  it('is unverifiable, never exited, when the host is not installed', () => {
+  it('is unverifiable, never exited, when the host is not installed', async () => {
     // Not being able to look is not a death certificate.
     expect(observeStructuredWorker(IDENTITY)).toEqual({
       status: 'unverifiable',
@@ -92,12 +97,12 @@ describe('structured worker observation', () => {
     })
   })
 
-  it('is live when the host holds the session under a live native lease', () => {
+  it('is live when the host holds the session under a live native lease', async () => {
     installHost({})
     expect(observeStructuredWorker(IDENTITY).status).toBe('live')
   })
 
-  it('is exited only on a released lease with death evidence', () => {
+  it('is exited only on a released lease with death evidence', async () => {
     installHost({
       claimStatus: 'released',
       deathEvidence: { kind: 'exit-observed', detail: 'x', observedAt: 1 }
@@ -105,7 +110,7 @@ describe('structured worker observation', () => {
     expect(observeStructuredWorker(IDENTITY).status).toBe('exited')
   })
 
-  it('is unverifiable when a terminal an older build recorded holds the lease', () => {
+  it('is unverifiable when a terminal an older build recorded holds the lease', async () => {
     installHost({ claimStatus: 'conflicted' })
     expect(observeStructuredWorker(IDENTITY).status).toBe('unverifiable')
   })
@@ -127,22 +132,30 @@ describe('structured worker stop', () => {
     })
   })
 
-  it.each([
-    { hasSession: false },
-    { claimStatus: 'conflicted' },
-    { claimStatus: 'released' },
-    { record: null }
-  ])('retains without positive exit evidence: %j', async (options) => {
-    installHost({ ...options, close: async () => {} })
-    const retireStructuredAgentSessionTabFromSnapshot = vi.fn()
-    const result = await stopStructuredWorker(IDENTITY, 'd1', {
-      forgetStructuredSessionMail: vi.fn(),
-      retireStructuredAgentSessionTabFromSnapshot
+  it('settles a released lease whose stop was unproven: nothing is left running to close', async () => {
+    // A release that could not prove its stop sent no signal and left the verdict `unverifiable`;
+    // closing the chat is the user's action, so that bookkeeping does not refuse it.
+    installHost({ claimStatus: 'released', close: async () => {} })
+    await expect(stopStructuredWorker(IDENTITY, 'd1')).resolves.toEqual({
+      stopped: true,
+      closeAttempted: true
     })
-    expect(result).toMatchObject({ stopped: false, closeAttempted: true })
-    expect(retireStructuredAgentSessionTabFromSnapshot).not.toHaveBeenCalled()
   })
 
+  it.each([{ hasSession: false }, { claimStatus: 'conflicted' }, { record: null }])(
+    'retains without positive exit evidence: %j',
+    async (options) => {
+      installHost({ ...options, close: async () => {} })
+      const retireStructuredAgentSessionTabFromSnapshot = vi.fn()
+      const result = await stopStructuredWorker(IDENTITY, 'd1', {
+        forgetStructuredSessionMail: vi.fn(),
+        retireStructuredAgentSessionTabFromSnapshot
+      })
+      expect(result).toMatchObject({ stopped: false, closeAttempted: true })
+      expect(retireStructuredAgentSessionTabFromSnapshot).not.toHaveBeenCalled()
+    }
+  )
+
   it('retains when the close throws, and admits the close was issued', async () => {
     installHost({
       close: async () => {
@@ -191,9 +204,9 @@ describe('structured worker output', () => {
     hostRef.current = null
   })
 
-  it('round-trips the journal through the archive and back out of a released read', () => {
+  it('round-trips the journal through the archive and back out of a released read', async () => {
     installHost({})
-    const live = readStructuredWorkerJournal({
+    const live = await readStructuredWorkerJournal({
       identity: IDENTITY,
       dispatchId: 'd1',
       workerState: 'ready',
@@ -201,7 +214,7 @@ describe('structured worker output', () => {
       agent: 'claude'
     })
     expect(live.source).toBe('transcript')
-    const archive = captureStructuredWorkerArchive(IDENTITY, 'claude')
+    const archive = await captureStructuredWorkerArchive(IDENTITY, 'claude')
     hostRef.current = null
     const archived = readArchivedStructuredJournal({
       dispatchId: 'd1',
@@ -219,7 +232,7 @@ describe('structured worker output', () => {
     expect(archived.sourceIdentity).not.toBe(live.sourceIdentity)
   })
 
-  it('redacts dispatch capabilities from the archived journal', () => {
+  it('redacts dispatch capabilities from the archived journal', async () => {
     installHost({
       items: [
         {
@@ -233,13 +246,13 @@ describe('structured worker output', () => {
         } as unknown as AgentJournalRenderItem
       ]
     })
-    const archive = captureStructuredWorkerArchive(IDENTITY, 'claude')
+    const archive = await captureStructuredWorkerArchive(IDENTITY, 'claude')
     expect(JSON.stringify(archive)).not.toContain('dcap_aaa')
     expect(JSON.stringify(archive)).toContain('[dispatch capability redacted]')
   })
 
-  it('refuses to read a session the host no longer holds', () => {
-    expect(() =>
+  it('refuses to read a session the host no longer holds', async () => {
+    await expect(
       readStructuredWorkerJournal({
         identity: IDENTITY,
         dispatchId: 'd1',
@@ -247,15 +260,15 @@ describe('structured worker output', () => {
         liveness: 'live',
         agent: 'claude'
       })
-    ).toThrow(/not attached/)
+    ).rejects.toThrow(/not attached/)
   })
 
-  it('reports an unverifiable worker as unknown, never as running', () => {
+  it('reports an unverifiable worker as unknown, never as running', async () => {
     // The `could not look, therefore it is alive` inversion. After a restart the runtime observes
     // `unverifiable` — no attached provider child in this generation — while the journal is still
     // readable, and a coordinator reading `running` waits on a worker that may already be gone.
     installHost({})
-    const read = readStructuredWorkerJournal({
+    const read = await readStructuredWorkerJournal({
       identity: IDENTITY,
       dispatchId: 'd1',
       workerState: 'ready',
@@ -266,9 +279,9 @@ describe('structured worker output', () => {
     expect(read.status.liveness).toBe('unverifiable')
   })
 
-  it('carries each proven verdict through unchanged', () => {
+  it('carries each proven verdict through unchanged', async () => {
     installHost({})
-    const live = readStructuredWorkerJournal({
+    const live = await readStructuredWorkerJournal({
       identity: IDENTITY,
       dispatchId: 'd1',
       workerState: 'ready',
@@ -276,7 +289,7 @@ describe('structured worker output', () => {
       agent: 'claude'
     })
     expect(live.status).toMatchObject({ terminal: 'running', liveness: 'live' })
-    const exited = readStructuredWorkerJournal({
+    const exited = await readStructuredWorkerJournal({
       identity: IDENTITY,
       dispatchId: 'd1',
       workerState: 'succeeded',
@@ -286,9 +299,9 @@ describe('structured worker output', () => {
     expect(exited.status).toMatchObject({ terminal: 'exited', liveness: 'exited' })
   })
 
-  it('states that a settled release is exited', () => {
+  it('states that a settled release is exited', async () => {
     installHost({})
-    const archive = captureStructuredWorkerArchive(IDENTITY, 'claude')
+    const archive = await captureStructuredWorkerArchive(IDENTITY, 'claude')
     const archived = readArchivedStructuredJournal({
       dispatchId: 'd1',
       workerState: 'succeeded',
@@ -300,12 +313,12 @@ describe('structured worker output', () => {
     expect(archived.status).toMatchObject({ terminal: 'exited', liveness: 'exited' })
   })
 
-  it('never calls an unproven release exited', () => {
+  it('never calls an unproven release exited', async () => {
     // The archive is frozen BEFORE the close. `release_unknown` is the state that records a close
     // that did NOT land, and a coordinator reading `exited` there starts a replacement worker over
     // the same worktree while the original provider child may still be attached.
     installHost({})
-    const archive = captureStructuredWorkerArchive(IDENTITY, 'claude')
+    const archive = await captureStructuredWorkerArchive(IDENTITY, 'claude')
     for (const releaseState of ['unknown', 'releasing'] as const) {
       const archived = readArchivedStructuredJournal({
         dispatchId: 'd1',
@@ -324,7 +337,7 @@ describe('structured worker output', () => {
     // `readArchivedWorkerOutput`, and the resource row it already holds is the only thing that
     // knows whether the close landed.
     installHost({})
-    const archive = captureStructuredWorkerArchive(IDENTITY, 'claude')
+    const archive = await captureStructuredWorkerArchive(IDENTITY, 'claude')
     const db = {
       getWorkerTerminalArchive: () => ({
         dispatch_id: 'd1',
@@ -355,12 +368,12 @@ describe('structured worker output', () => {
     })
   })
 
-  it('refuses a cursor once the tail window has slid past it', () => {
+  it('refuses a cursor once the tail window has slid past it', async () => {
     // The cursor is an index into the bounded tail, and `sourceIdentity` was constant for the
     // worker's life, so a coordinator paging a growing journal resumed at the newest items and
     // skipped the middle without a word.
     installHost({ items: ITEMS })
-    const first = readStructuredWorkerJournal({
+    const first = await readStructuredWorkerJournal({
       identity: IDENTITY,
       dispatchId: 'd1',
       workerState: 'ready',
@@ -376,7 +389,7 @@ describe('structured worker output', () => {
         } as unknown as AgentJournalRenderItem
       ]
     })
-    expect(() =>
+    await expect(
       readStructuredWorkerJournal({
         identity: IDENTITY,
         dispatchId: 'd1',
@@ -385,7 +398,7 @@ describe('structured worker output', () => {
         agent: 'claude',
         cursor: first.cursor
       })
-    ).toThrow(/source changed/i)
+    ).rejects.toThrow(/source changed/i)
   })
 })
 
@@ -394,7 +407,7 @@ describe('archiving a structured worker whose journal cannot be read', () => {
     hostRef.current = null
   })
 
-  it('settles with an empty, warned archive once the session is PROVEN gone', () => {
+  it('settles with an empty, warned archive once the session is PROVEN gone', async () => {
     // Closing the worker's chat tab is a routine user action: it evicts the child and detaches the
     // journal permanently. Throwing archive_failed there wedged release on evidence that could
     // never arrive, leaving worker-abandon as the only way out.
@@ -403,7 +416,7 @@ describe('archiving a structured worker whose journal cannot be read', () => {
       claimStatus: 'released',
       deathEvidence: { kind: 'exit-observed', detail: 'surface released', observedAt: 1 }
     })
-    const archive = captureStructuredWorkerArchive(IDENTITY, 'claude')
+    const archive = await captureStructuredWorkerArchive(IDENTITY, 'claude')
     expect(archive.messages).toEqual([])
     expect(archive.processIncarnation).toBe(IDENTITY.processIncarnation)
     expect(archive.warnings).toContain(
@@ -411,12 +424,24 @@ describe('archiving a structured worker whose journal cannot be read', () => {
     )
   })
 
-  it('still retains when the journal is unreadable but nothing proves the child is gone', () => {
+  it('retains a worker at rest: released, but its chat tab still lists it', async () => {
+    // Released is not retired now — the idle sweep releases a quiet worker's lease — so an owned
+    // worker whose journal cannot be read keeps its evidence for a later archive.
+    installHost({
+      historyThrows: true,
+      claimStatus: 'released',
+      deathEvidence: { kind: 'exit-observed', detail: 'idle stop', observedAt: 1 },
+      tabListed: true
+    })
+    await expect(captureStructuredWorkerArchive(IDENTITY, 'claude')).rejects.toThrow(/retained/)
+  })
+
+  it('still retains when the journal is unreadable but nothing proves the child is gone', async () => {
     installHost({ historyThrows: true })
-    expect(() => captureStructuredWorkerArchive(IDENTITY, 'claude')).toThrow(/retained/)
+    await expect(captureStructuredWorkerArchive(IDENTITY, 'claude')).rejects.toThrow(/retained/)
   })
 
-  it('still retains when there is no host to look with', () => {
-    expect(() => captureStructuredWorkerArchive(IDENTITY, 'claude')).toThrow(/retained/)
+  it('still retains when there is no host to look with', async () => {
+    await expect(captureStructuredWorkerArchive(IDENTITY, 'claude')).rejects.toThrow(/retained/)
   })
 })
diff --git a/src/main/runtime/rpc/methods/orchestration-structured-worker-lifecycle.ts b/src/main/runtime/rpc/methods/orchestration-structured-worker-lifecycle.ts
index 13d3ce1dbce1..bec15537c49d 100644
--- a/src/main/runtime/rpc/methods/orchestration-structured-worker-lifecycle.ts
+++ b/src/main/runtime/rpc/methods/orchestration-structured-worker-lifecycle.ts
@@ -40,12 +40,13 @@ import {
   structuredWorkerTerminalState,
   type StructuredWorkerObservation
 } from '../../structured-worker-authority'
+import { structuredWorkerOwned } from '../../structured-worker-custody'
 import type { StructuredWorkerIdentity } from '../../structured-worker-identity'
 import type { WorkerTerminalReleaseState } from '../../orchestration/worker-terminal-ownership'
 import { releaseStructuredWorkerSession } from './orchestration-structured-worker-session'
 import { closeStructuredAgentSessionChild } from '../../structured-agent-session-close'
 
-export { observeStructuredWorker, type StructuredWorkerObservation }
+export { observeStructuredWorker, structuredWorkerOwned, type StructuredWorkerObservation }
 
 /** The structured worker behind a dispatch, or null when a PTY worker owns it. */
 export function resolveStructuredWorkerForDispatch(
@@ -83,13 +84,13 @@ export async function stopStructuredWorker(
   return closeStructuredAgentSessionChild(identity.sessionId, {
     ...(runtime ? { runtime } : {}),
     // Between the close and the proof, never after: an unsettled close returns early, and a
-    // surviving hold keeps the provider child un-evictable for the life of the app.
+    // surviving redrive subscription keeps nudging a session no dispatch owns.
     afterClose: () => releaseStructuredWorkerSession(dispatchId, runtime)
   })
 }
 
 /** The structured half of `worker-read`, or null when a PTY worker owns the dispatch. */
-export function readStructuredWorkerOutput(args: {
+export async function readStructuredWorkerOutput(args: {
   db: OrchestrationDb
   dispatchId: string
   workerState: string
@@ -98,7 +99,7 @@ export function readStructuredWorkerOutput(args: {
   source?: 'auto' | 'transcript' | 'terminal'
   cursor?: string | number
   limit?: number
-}): OrchestrationWorkerReadTranscriptResult | null {
+}): Promise<OrchestrationWorkerReadTranscriptResult | null> {
   const identity = resolveStructuredWorkerForDispatch(args.db, args.dispatchId)
   if (!identity) {
     return null
@@ -123,7 +124,7 @@ export function readStructuredWorkerOutput(args: {
 }
 
 /** Journal page in the shape `worker-read --source transcript` already serves. */
-export function readStructuredWorkerJournal(args: {
+export async function readStructuredWorkerJournal(args: {
   identity: StructuredWorkerIdentity
   dispatchId: string
   workerState: string
@@ -131,8 +132,8 @@ export function readStructuredWorkerJournal(args: {
   agent: AgentType
   cursor?: string | number
   limit?: number
-}): OrchestrationWorkerReadTranscriptResult {
-  const page = readStructuredJournalPage(args.identity.sessionId)
+}): Promise<OrchestrationWorkerReadTranscriptResult> {
+  const page = await readStructuredJournalPage(args.identity.sessionId)
   if (!page) {
     throw new OrchestrationError(
       'transcript_required',
@@ -213,11 +214,13 @@ function structuredJournalPrefixIdentity(args: {
 }
 
 /** Freezes the journal before the session is closed, so a released worker is still readable. */
-export function captureStructuredWorkerArchive(
+export async function captureStructuredWorkerArchive(
   identity: StructuredWorkerIdentity,
   agent: AgentType
-): WorkerStructuredJournalArchive {
-  const page = readStructuredJournalPage(identity.sessionId)
+): Promise<WorkerStructuredJournalArchive> {
+  // Opens a conversation at rest or one the idle sweep closed, so a resting worker's journal is
+  // still preserved.
+  const page = await readStructuredJournalPage(identity.sessionId)
   if (page) {
     return buildStructuredJournalArchive({
       agent,
@@ -232,10 +235,9 @@ export function captureStructuredWorkerArchive(
   // the worker's chat tab is a routine user action that does exactly that, so throwing there wedges
   // release on evidence that can never come and leaves `worker-abandon` as the only exit.
   //
-  // `exited` is the only verdict that qualifies: it needs a released lease WITH death evidence.
-  // `unverifiable` — no host installed, a lease handed to a TUI owner — means we could not look,
-  // and retaining is still right.
-  if (observeStructuredWorker(identity).status !== 'exited') {
+  // Only a worker this runtime no longer owns qualifies — released with its chat tab gone. An owned
+  // one, running or at rest, keeps its journal, and so does one we could not look at.
+  if (structuredWorkerOwned(identity.sessionId) !== false) {
     throw new OrchestrationError(
       'archive_failed',
       'Output could not be preserved for this structured worker; the session was retained.'
diff --git a/src/main/runtime/rpc/methods/orchestration-structured-worker-session.test.ts b/src/main/runtime/rpc/methods/orchestration-structured-worker-session.test.ts
index 493f9d092c36..0d1f04cb83bd 100644
--- a/src/main/runtime/rpc/methods/orchestration-structured-worker-session.test.ts
+++ b/src/main/runtime/rpc/methods/orchestration-structured-worker-session.test.ts
@@ -1,5 +1,6 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest'
-import { dispatchWriteFailureReason } from '../../../../shared/structured-agent-session-dispatch-rejection'
+import type { AgentJournalSubmission } from '../../../../shared/agent-session-journal-types'
+import { DISPATCH_REJECTED_WRITE_FAILED } from '../../../../shared/structured-agent-session-dispatch-rejection'
 
 const hostRef: { current: unknown } = { current: null }
 const createSpy = vi.fn()
@@ -14,37 +15,34 @@ vi.mock('./structured-agent-session-create', () => ({
 const {
   createStructuredWorkerSession,
   releaseStructuredWorkerSession,
-  sendStructuredWorkerPreamble,
-  structuredWorkerHoldId
+  sendStructuredWorkerPreamble
 } = await import('./orchestration-structured-worker-session')
 const { isUnknownWorkerStartOutcome } = await import('./orchestration/worker/worker-topology')
 const { structuredWorkerIdentities } = await import('../../structured-worker-identity')
 const { structuredWorkerChildIdentityEnv } =
   await import('../../structured-worker-child-identity-env')
 
-function installHost() {
-  const hold = vi.fn(async () => {})
-  const release = vi.fn()
+// oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: a host stub carrying only the members the worker start reaches.
+function installHost(location = { executionHostId: 'local', wslDistro: null as string | null }) {
   const dispose = vi.fn()
+  const subscribe = vi.fn(async () => dispose)
   hostRef.current = {
     setSessionTabVisibility: async () => {},
     close: async () => {},
     deps: {
       store: {
         getRecord: () => ({
-          location: { executionHostId: 'local', wslDistro: null },
+          location,
           lease: { runtimeFence: 2, runtimeKind: 'native', claimStatus: 'live' }
         })
       }
     },
-    hold,
-    release,
-    subscribe: () => dispose
+    subscribe
   }
-  return { hold, release, dispose }
+  return { subscribe, dispose }
 }
 
-describe('structured worker session hold', () => {
+describe('structured worker session', () => {
   beforeEach(() => {
     structuredWorkerIdentities.clear()
     createSpy.mockReset()
@@ -54,8 +52,8 @@ describe('structured worker session hold', () => {
     }))
   })
 
-  it('takes a resume-capable hold at start and releases it only on settlement', async () => {
-    const { hold, release, dispose } = installHost()
+  it('binds only a redrive subscription at start, and settlement drops it', async () => {
+    const { subscribe, dispose } = installHost()
     const created = await createStructuredWorkerSession({
       runtime: { ensureStructuredAgentSessionHost: async () => {} } as never,
       worktreeId: 'wt_1',
@@ -63,18 +61,19 @@ describe('structured worker session hold', () => {
       dispatchId: 'd1',
       onJournalActivity: () => {}
     })
-    // Without the hold, the release clock evicts the provider child 15s after a user closes the
-    // worker's chat tab, killing an idle worker mid-dispatch.
-    expect(hold).toHaveBeenCalledWith(created.identity.sessionId, structuredWorkerHoldId('d1'))
-    expect(release).not.toHaveBeenCalled()
+    // No hold: while the dispatch is open the idle sweep reads it from the orchestration database.
+    expect(hostRef.current).not.toHaveProperty('hold')
+    expect(subscribe).toHaveBeenCalledWith(
+      expect.objectContaining({ sessionId: created.identity.sessionId })
+    )
+    expect(dispose).not.toHaveBeenCalled()
 
     releaseStructuredWorkerSession('d1')
-    expect(release).toHaveBeenCalledWith(created.identity.sessionId, structuredWorkerHoldId('d1'))
     expect(dispose).toHaveBeenCalledTimes(1)
     expect(structuredWorkerIdentities.get(created.identity.handle)).toBeNull()
-    // A second settlement is a no-op rather than a second release of the same holder.
+    // A second settlement is a no-op.
     releaseStructuredWorkerSession('d1')
-    expect(release).toHaveBeenCalledTimes(1)
+    expect(dispose).toHaveBeenCalledTimes(1)
   })
 
   it('registers the identity BEFORE the session is created, so the child gets the handle', async () => {
@@ -100,8 +99,8 @@ describe('structured worker session hold', () => {
   })
 
   it('forgets the identity and discards the session when the start fails', async () => {
-    const { hold } = installHost()
-    hold.mockRejectedValueOnce(new Error('hold refused'))
+    // A session that resolves outside the local host is not a worker this runtime can own.
+    installHost({ executionHostId: 'local', wslDistro: 'Ubuntu' })
     const closed: string[] = []
     ;(hostRef.current as { close: (id: string) => Promise<void> }).close = async (id) => {
       closed.push(id)
@@ -114,7 +113,7 @@ describe('structured worker session hold', () => {
         dispatchId: 'd_fail',
         onJournalActivity: () => {}
       })
-    ).rejects.toThrow('hold refused')
+    ).rejects.toThrow(/local execution host outside WSL/)
     // Neither a live provider child nor a registry entry may outlive the failed start.
     expect(closed).toHaveLength(1)
     expect(structuredWorkerIdentities.getBySessionId(closed[0]!)).toBeNull()
@@ -128,7 +127,7 @@ describe('structured worker session hold', () => {
     }
     // `commit` answers this after `attach` SUCCEEDED and only the tab publish failed, so the
     // provider child is live. Reading it as "refused, nothing created" strands that child with no
-    // hold and no binding, and nothing else in the runtime ever retires it.
+    // binding, and nothing else in the runtime ever retires it.
     createSpy.mockImplementation(async () => ({
       ok: false,
       refusal: {
@@ -224,20 +223,69 @@ describe('structured worker session hold', () => {
 })
 
 describe('structured worker dispatch preamble', () => {
-  function hostWithSubmission(submission: Record<string, unknown>) {
+  type PreambleHost = Parameters<typeof sendStructuredWorkerPreamble>[0]['host']
+  type Settled = Pick<AgentJournalSubmission, 'dispatchState' | 'reason'>
+
+  function submissionOf(settled: Settled): AgentJournalSubmission {
+    return {
+      clientMessageId: 'c1',
+      fence: 7,
+      payloadFingerprint: 'fingerprint',
+      providerItemId: null,
+      submittedAt: 1,
+      resolvedAt: null,
+      ...settled
+    }
+  }
+
+  function hostWithSubmission(submission: Settled, delivered?: Settled): PreambleHost {
     return {
       deps: { store: { getRecord: () => ({ lease: { runtimeFence: 7 } }) } },
-      send: async () => ({ ok: true, value: { clientMessageId: 'c1', submission } })
-    } as never
+      send: async () => ({
+        ok: true,
+        replayed: false,
+        fence: 7,
+        cursor: { epoch: 'epoch-1', sequence: 1 },
+        value: { clientMessageId: 'c1', submission: submissionOf(submission) }
+      }),
+      // What the submission settled as while the worker's agent started; undefined when the
+      // start outlasted the wait.
+      waitForSendSettlement: async () =>
+        delivered
+          ? {
+              cursor: { epoch: 'epoch-1', sequence: 2 },
+              value: { clientMessageId: 'c1', submission: submissionOf(delivered) }
+            }
+          : undefined
+    }
   }
 
-  const send = (host: never) =>
+  const send = (host: PreambleHost) =>
     sendStructuredWorkerPreamble({ host, sessionId: 's1', dispatchId: 'd1', preamble: 'spec' })
 
   it('reports the preamble delivered only on an accepted submission', async () => {
     await expect(
       send(hostWithSubmission({ dispatchState: 'accepted', reason: null }))
-    ).resolves.toBeUndefined()
+    ).resolves.toBe('accepted')
+  })
+
+  it('waits for an accepted preamble to be delivered, and reports that delivery (W10)', async () => {
+    await expect(
+      send(
+        hostWithSubmission(
+          { dispatchState: 'pending', reason: null },
+          { dispatchState: 'accepted', reason: null }
+        )
+      )
+    ).resolves.toBe('accepted')
+  })
+
+  it('reports a preamble still held for an agent that outlasted the wait, without failing the start (W10)', async () => {
+    // Held, not lost: the host delivers it when the agent starts. Throwing here tore the worker
+    // down, which rejected the preamble the start was about to deliver.
+    await expect(
+      send(hostWithSubmission({ dispatchState: 'pending', reason: null }))
+    ).resolves.toBe('pending')
   })
 
   it('never claims delivery for a submission the provider never acknowledged', async () => {
@@ -245,15 +293,13 @@ describe('structured worker dispatch preamble', () => {
     // into `unknown`, and `performSend` still returns ok. Reporting that as `dispatch_input:
     // accepted` marks the worker ready with no task, and the coordinator blocks in
     // `check --wait --types worker_done` until it times out.
-    for (const dispatchState of ['unknown', 'pending'] as const) {
-      const error = await send(
-        hostWithSubmission({ dispatchState, reason: 'provider child exited' })
-      ).catch((thrown: unknown) => thrown)
-      expect((error as { code?: string }).code).toBe('operation_unknown')
-      // The wiring, not just the throw: this is the code that makes the start receipt
-      // `outcome_unknown` with the worker-show / worker-abandon recovery commands.
-      expect(isUnknownWorkerStartOutcome(error, 'dispatch_input')).toBe(true)
-    }
+    const error = await send(
+      hostWithSubmission({ dispatchState: 'unknown', reason: 'provider child exited' })
+    ).catch((thrown: unknown) => thrown)
+    expect((error as { code?: string }).code).toBe('operation_unknown')
+    // The wiring, not just the throw: this is the code that makes the start receipt
+    // `outcome_unknown` with the worker-show / worker-abandon recovery commands.
+    expect(isUnknownWorkerStartOutcome(error, 'dispatch_input')).toBe(true)
   })
 
   it('keeps a rejected preamble a proven failure under a code of its own', async () => {
@@ -268,13 +314,33 @@ describe('structured worker dispatch preamble', () => {
     expect(isUnknownWorkerStartOutcome(error, 'dispatch_input')).toBe(false)
   })
 
+  it('ends the message with one period whether the reason is a sentence or a marker', async () => {
+    const sentence = await send(
+      hostWithSubmission({
+        dispatchState: 'rejected',
+        reason: 'The provider stopped before this message was sent.'
+      })
+    ).catch((thrown: unknown) => thrown)
+    expect(sentence).toMatchObject({
+      message:
+        'The dispatch preamble was not delivered: The provider stopped before this message was sent.'
+    })
+    const marker = await send(
+      hostWithSubmission({ dispatchState: 'unknown', reason: 'provider child exited' })
+    ).catch((thrown: unknown) => thrown)
+    expect(marker).toMatchObject({
+      message:
+        'The dispatch preamble was submitted but not acknowledged (unknown): provider child exited.'
+    })
+  })
+
   it('reports a refused transport write as undelivered, never as unknown', async () => {
     // The state a provably-unwritten frame now settles. Nothing reached the provider,
     // so there is no running turn for a coordinator to go and look at.
     const error = await send(
       hostWithSubmission({
         dispatchState: 'rejected',
-        reason: dispatchWriteFailureReason(new Error('broken pipe'))
+        reason: DISPATCH_REJECTED_WRITE_FAILED
       })
     ).catch((thrown: unknown) => thrown)
     expect((error as { code?: string }).code).toBe('dispatch_preamble_undelivered')
diff --git a/src/main/runtime/rpc/methods/orchestration-structured-worker-session.ts b/src/main/runtime/rpc/methods/orchestration-structured-worker-session.ts
index 5bde461a0595..dad93face828 100644
--- a/src/main/runtime/rpc/methods/orchestration-structured-worker-session.ts
+++ b/src/main/runtime/rpc/methods/orchestration-structured-worker-session.ts
@@ -1,19 +1,20 @@
 /**
- * Starting, holding and retiring a worker that IS a structured agent session.
+ * Starting and retiring a worker that IS a structured agent session.
  *
  * Three things make this different from the PTY worker path, and all three live here:
  *
  * - The session is created directly as structured, so readiness is the attach returning ok. There
  *   is no boot-to-idle gap to wait on and no `tui-idle` edge to read.
- * - A structured session's provider child is evicted 15s after its last HOLDER leaves, and holds
- *   come only from bound surfaces. A dispatched worker parked on mail is exactly that state, so
- *   the dispatch takes its own resume-capable hold and keeps it until the worker settles.
+ * - Nothing here keeps its agent running. The idle sweep leaves it running while its dispatch is
+ *   open, reading that from the orchestration database; once the dispatch settles the agent rests
+ *   like any chat's, and the next mail starts it.
  * - The dispatch preamble is a turn, not keystrokes.
  */
 
 import { randomUUID } from 'node:crypto'
 import { isDefinitiveAgentSessionCreateRefusal } from '../../../../shared/agent-session-definitive-refusal'
 import type { AgentJournalMessageItem } from '../../../../shared/agent-session-journal-types'
+import { ORCHESTRATION_READINESS_TIMEOUT_MS } from '../../../../shared/orchestration-timing-budgets'
 import type { StructuredAgentSessionHost } from '../../../native-chat/agent-session-wire/structured-agent-session-host'
 import { getStructuredAgentSessionHost } from '../../../native-chat/agent-session-wire/structured-agent-session-registry'
 import type { OrcaRuntimeService } from '../../orca-runtime'
@@ -38,23 +39,16 @@ import { createStructuredAgentSessionForWorktree } from './structured-agent-sess
 type StructuredWorkerBinding = {
   sessionId: string
   handle: string
-  holderId: string
   disposeSubscription: () => void
 }
 
 const bindingsByDispatchId = new Map<string, StructuredWorkerBinding>()
 
-export function structuredWorkerHoldId(dispatchId: string): string {
-  return `orchestration:dispatch:${dispatchId}`
-}
-
 /**
- * Drops the dispatch's hold, its redrive subscription and its parked mail; the release clock takes
- * it from here.
+ * Drops the dispatch's redrive subscription, its registry entry and its parked mail.
  *
- * EVERY settlement has to reach this — stop, release AND abandon. A surviving hold does not just
- * leak: it keeps the provider child un-evictable for the life of the app, and makes host crash
- * recovery respawn a child for a worker that was settled long ago.
+ * EVERY settlement has to reach this — stop, release AND abandon. A surviving subscription keeps
+ * nudging a session no dispatch owns.
  */
 export function releaseStructuredWorkerSession(
   dispatchId: string,
@@ -68,11 +62,6 @@ export function releaseStructuredWorkerSession(
   binding.disposeSubscription()
   structuredWorkerIdentities.forget(binding.handle)
   runtime?.forgetStructuredSessionMail?.(binding.sessionId)
-  try {
-    getStructuredAgentSessionHost()?.release(binding.sessionId, binding.holderId)
-  } catch (error) {
-    console.warn('[orchestration] structured worker hold release failed', dispatchId, error)
-  }
 }
 
 export async function createStructuredWorkerSession(args: {
@@ -92,7 +81,7 @@ export async function createStructuredWorkerSession(args: {
   // resolves to whatever single leaf sits in the worktree — by default the COORDINATOR's pane.
   //
   // The scope is provisionally local; the record's own location is asserted local below, and a
-  // session that resolves anywhere else never reaches a hold.
+  // session that resolves anywhere else is discarded.
   const identity = structuredWorkerIdentities.register({
     handle: mintStructuredWorkerHandle(),
     sessionId,
@@ -141,13 +130,10 @@ export async function createStructuredWorkerSession(args: {
         'A structured worker must run on the local execution host outside WSL.'
       )
     }
-    const holderId = structuredWorkerHoldId(args.dispatchId)
-    await host.hold(sessionId, holderId)
-    const disposeSubscription = subscribeForRedrive(host, sessionId, args.onJournalActivity)
+    const disposeSubscription = await subscribeForRedrive(host, sessionId, args.onJournalActivity)
     bindingsByDispatchId.set(args.dispatchId, {
       sessionId,
       handle: identity.handle,
-      holderId,
       disposeSubscription
     })
     return { identity, host }
@@ -167,8 +153,8 @@ export async function createStructuredWorkerSession(args: {
  *
  * `ok` is not the test. `commit` answers `agent_session_operation_unknown` when `attach` SUCCEEDED
  * and only the tab publish failed, and a throw out of the commit half is past `attach` too — the
- * pre-commit half never throws, it refuses. Both leave a live provider child that took no hold and
- * has no binding, so nothing else in the runtime will ever retire it. Only a DEFINITIVE refusal
+ * pre-commit half never throws, it refuses. Both leave a session with a published tab and no
+ * binding, so nothing else in the runtime will ever retire it. Only a DEFINITIVE refusal
  * proves there is nothing to discard; everything else gets the best-effort close.
  */
 function structuredCreateMayHaveCommitted(
@@ -213,13 +199,27 @@ export async function discardStructuredWorkerSession(
   retireSettledStructuredWorkerTab(sessionId, runtime)
 }
 
-/** Delivers the dispatch preamble as the worker's first turn. */
+/** A submission reason as a clause: host sentences end in a period, legacy markers do not. */
+function reasonClause(reason: string | null | undefined): string {
+  return (reason ?? 'no reason given').replace(/[.\s]+$/, '')
+}
+
+/** What a preamble send reads of the host. */
+type StructuredWorkerPreambleHost = Pick<
+  StructuredAgentSessionHost,
+  'send' | 'waitForSendSettlement'
+> & {
+  deps: { store: { getRecord: (sessionId: string) => { lease: { runtimeFence: number } } | null } }
+}
+
+/** Delivers the dispatch preamble as the worker's first turn. `pending`: the worker's agent had
+ *  not taken it within the wait; the host still holds it for that agent, and never re-sends it. */
 export async function sendStructuredWorkerPreamble(args: {
-  host: StructuredAgentSessionHost
+  host: StructuredWorkerPreambleHost
   sessionId: string
   dispatchId: string
   preamble: string
-}): Promise<void> {
+}): Promise<'accepted' | 'pending'> {
   const body: AgentJournalMessageItem = {
     kind: 'message',
     role: 'user',
@@ -244,9 +244,19 @@ export async function sendStructuredWorkerPreamble(args: {
   if (!result.ok) {
     throw new Error(`The dispatch preamble was refused: ${result.refusal.message}`)
   }
-  const submission = result.value.submission
-  if (submission.dispatchState === 'accepted') {
-    return
+  // Accepted is not delivered: the worker's agent may still be starting.
+  const submission =
+    result.value.submission.dispatchState === 'pending'
+      ? ((
+          await args.host
+            .waitForSendSettlement(args.sessionId, result.value.clientMessageId, {
+              budgetMs: ORCHESTRATION_READINESS_TIMEOUT_MS
+            })
+            .catch(() => undefined)
+        )?.value.submission ?? result.value.submission)
+      : result.value.submission
+  if (submission.dispatchState === 'accepted' || submission.dispatchState === 'pending') {
+    return submission.dispatchState
   }
   if (submission.dispatchState === 'rejected') {
     // A rejection is a verdict, not a mystery: the preamble provably did not happen.
@@ -256,7 +266,9 @@ export async function sendStructuredWorkerPreamble(args: {
     // pending receipt; only this one lets the caller retry knowing nothing landed.
     throw new OrchestrationError(
       'dispatch_preamble_undelivered',
-      `The dispatch preamble was not delivered: ${submission.reason ?? 'no reason given'}.`
+      `The dispatch preamble was not delivered${
+        submission.rejection ? ` (${submission.rejection.kind})` : ''
+      }: ${reasonClause(submission.reason)}.`
     )
   }
   // Only `accepted` is an acknowledgement — the same rule the mail lane already applies. A thrown
@@ -265,7 +277,7 @@ export async function sendStructuredWorkerPreamble(args: {
   // `outcome_unknown` receipt whose nextCommands send the coordinator to look.
   throw new OrchestrationError(
     'operation_unknown',
-    `The dispatch preamble was submitted but not acknowledged (${submission.dispatchState}): ${submission.reason ?? 'no reason given'}.`
+    `The dispatch preamble was submitted but not acknowledged (${submission.dispatchState}): ${reasonClause(submission.reason)}.`
   )
 }
 
@@ -304,17 +316,17 @@ const REDRIVE_MAX_WAIT_MS = 2_000
  * idle worker — that is `deliverForHandle`, called when the message is enqueued and untouched
  * here. This is only the retry for mail already parked because the worker was busy.
  */
-function subscribeForRedrive(
+async function subscribeForRedrive(
   host: StructuredAgentSessionHost,
   sessionId: string,
   onJournalActivity: (sessionId: string) => void
-): () => void {
+): Promise<() => void> {
   const coalescer = createKeyedTrailingEdgeCoalescer(onJournalActivity, {
     flushMs: REDRIVE_FLUSH_MS,
     maxWaitMs: REDRIVE_MAX_WAIT_MS
   })
   try {
-    const unsubscribe = host.subscribe({
+    const unsubscribe = await host.subscribe({
       id: `orchestration:redrive:${sessionId}`,
       sessionId,
       emit: (event) => {
@@ -324,7 +336,7 @@ function subscribeForRedrive(
       }
     })
     // Disposal drops the pending timer rather than flushing it: every settlement reaches here, and
-    // a redrive that fires after the hold is gone would nudge a session no dispatch owns.
+    // a redrive that fires after it would nudge a session no dispatch owns.
     return () => {
       coalescer.dispose()
       unsubscribe()
diff --git a/src/main/runtime/rpc/methods/orchestration-structured-worker-start-failure.test.ts b/src/main/runtime/rpc/methods/orchestration-structured-worker-start-failure.test.ts
index 1f29dfb49044..98a843fb695b 100644
--- a/src/main/runtime/rpc/methods/orchestration-structured-worker-start-failure.test.ts
+++ b/src/main/runtime/rpc/methods/orchestration-structured-worker-start-failure.test.ts
@@ -136,7 +136,7 @@ describe('a structured worker-start that fails after the session exists', () =>
       db,
       run: { id: 'run_1' } as never,
       existingTask: { id: 't1', spec: 'do the thing' } as never,
-      coordinatorPane: null,
+      coordinator: null,
       orchestrationMutation: undefined
     })
 
diff --git a/src/main/runtime/rpc/methods/orchestration-worker-mode-opacity.test.ts b/src/main/runtime/rpc/methods/orchestration-worker-mode-opacity.test.ts
index aa8c7c58574f..199e43fae7b3 100644
--- a/src/main/runtime/rpc/methods/orchestration-worker-mode-opacity.test.ts
+++ b/src/main/runtime/rpc/methods/orchestration-worker-mode-opacity.test.ts
@@ -42,6 +42,7 @@ vi.mock('./orchestration-structured-worker-session', async (importOriginal) => (
   ...(await importOriginal<Record<string, unknown>>()),
   sendStructuredWorkerPreamble: async (args: { preamble: string }) => {
     structuredPreambles.push(args.preamble)
+    return 'accepted'
   },
   releaseStructuredWorkerSession: () => {},
   discardStructuredWorkerSession: async () => {}
@@ -253,10 +254,14 @@ describe('a worker cannot tell which mode it is running in', () => {
         source: 'terminal'
       })
 
-    expect(read).toThrow(/has no terminal output/)
+    const refusal = await read().then(
+      () => '',
+      (error: unknown) => (error instanceof Error ? error.message : String(error))
+    )
+    expect(refusal).toMatch(/has no terminal output/)
     // The refusal names a source that works instead of naming the worker's kind.
-    expect(read).toThrow(/--source auto or --source transcript/)
-    expect(read).not.toThrow(/structured/i)
+    expect(refusal).toMatch(/--source auto or --source transcript/)
+    expect(refusal).not.toMatch(/structured/i)
   })
 
   it('never claims a structured worker was checked for a human-answerable prompt', async () => {
diff --git a/src/main/runtime/rpc/methods/orchestration-worker-release-incarnation-fallback.test.ts b/src/main/runtime/rpc/methods/orchestration-worker-release-incarnation-fallback.test.ts
new file mode 100644
index 000000000000..e839c2e017d0
--- /dev/null
+++ b/src/main/runtime/rpc/methods/orchestration-worker-release-incarnation-fallback.test.ts
@@ -0,0 +1,534 @@
+import { afterEach, describe, expect, it, vi, type MockInstance } from 'vitest'
+import { ORCHESTRATION_METHODS } from './orchestration'
+import { eraseRpcMethods, type RpcContext } from '../core'
+import { OrchestrationDb } from '../../orchestration/db'
+import { OrcaRuntimeService } from '../../orca-runtime'
+import { completeWorkerTerminalRelease } from './orchestration/worker/worker-release-completion'
+
+describe('orchestration worker release incarnation fallback', () => {
+  let db: OrchestrationDb
+  let dbOpen = false
+  let runtime: OrcaRuntimeService
+  let ctx: RpcContext
+  let activeRunId: string
+  let inspectProcessLiveness: MockInstance<
+    OrcaRuntimeService['inspectTerminalProcessIncarnationLiveness']
+  >
+
+  const coordinatorPaneKey = 'tab_coord:aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa'
+  const workerPaneKey = 'tab_worker:bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb'
+
+  /** Fresh in-memory db and a fully-stubbed runtime for one worker-release scenario. */
+  function setup(): void {
+    db = new OrchestrationDb(':memory:')
+    dbOpen = true
+    runtime = new OrcaRuntimeService()
+    runtime.setOrchestrationDb(db)
+    inspectProcessLiveness = vi
+      .spyOn(runtime, 'inspectTerminalProcessIncarnationLiveness')
+      .mockResolvedValue('live')
+    vi.spyOn(runtime, 'getTerminalPaneKey').mockImplementation((handle) =>
+      handle === 'term_coord'
+        ? coordinatorPaneKey
+        : handle === 'term_worker' || handle === 'term_reminted'
+          ? workerPaneKey
+          : null
+    )
+    vi.spyOn(runtime, 'getTerminalProcessIncarnation').mockImplementation((handle) =>
+      handle === 'term_worker' || handle === 'term_reminted' ? 'runtime_test:term_worker:1' : null
+    )
+    vi.spyOn(runtime, 'getOrchestrationDispatchAuthority').mockImplementation((handle) =>
+      handle === 'term_worker' || handle === 'term_reminted'
+        ? // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: This test fixture is deliberately shaped to exercise the private/runtime boundary.
+          ({
+            terminalHandle: handle,
+            paneKey: workerPaneKey,
+            processIncarnation: 'runtime_test:term_worker:1',
+            hostScope: { kind: 'local', hostId: 'local' }
+            // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+            // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+          } as never)
+        : null
+    )
+    vi.spyOn(runtime, 'validateOrchestrationAgentLauncher').mockImplementation(() => {})
+    vi.spyOn(runtime, 'showTerminal').mockImplementation(
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+      async (handle) => ({ handle, worktreeId: 'repo::worktree', status: 'running' }) as never
+    )
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    vi.spyOn(runtime, 'showManagedTerminalWorkspace').mockResolvedValue({
+      id: 'repo::worktree'
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    } as never)
+    vi.spyOn(runtime, 'createTerminal').mockResolvedValue({
+      handle: 'term_worker',
+      worktreeId: 'repo::worktree',
+      title: 'worker'
+    })
+    vi.spyOn(runtime, 'waitForTerminal').mockResolvedValue({
+      handle: 'term_worker',
+      condition: 'tui-idle',
+      satisfied: true,
+      status: 'running',
+      exitCode: null
+    })
+    vi.spyOn(runtime, 'getTerminalOrchestrationCliCommand').mockReturnValue('orca')
+    vi.spyOn(runtime, 'sendTerminalAgentPrompt').mockResolvedValue({
+      handle: 'term_worker',
+      accepted: true,
+      bytesWritten: 1
+    })
+    vi.spyOn(runtime, 'isTerminalRunningAgent').mockResolvedValue(true)
+    vi.spyOn(runtime, 'getExactWorkerProviderSession').mockReturnValue(null)
+    vi.spyOn(runtime, 'readTerminal').mockResolvedValue({
+      handle: 'term_worker',
+      status: 'running',
+      tail: ['worker output line 1', 'worker output line 2'],
+      truncated: false,
+      nextCursor: '2'
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    })
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    vi.spyOn(runtime, 'closeTerminal').mockResolvedValue({
+      handle: 'term_worker',
+      tabId: 'tab-worker',
+      ptyKilled: true
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    } as never)
+    vi.spyOn(runtime, 'notifyMessageArrived').mockImplementation(() => {})
+    activeRunId = db.createRun({
+      objective: 'Release test Run',
+      coordinatorHandle: 'term_coord',
+      coordinatorPaneKey
+    }).id
+    ctx = { runtime }
+  }
+
+  afterEach(() => {
+    if (dbOpen) {
+      dbOpen = false
+      db.close()
+    }
+    vi.restoreAllMocks()
+  })
+
+  /** Look up a registered orchestration RPC method by name. */
+  function findMethod(name: string) {
+    const method = eraseRpcMethods(ORCHESTRATION_METHODS).find((m) => m.name === name)
+    if (!method) {
+      throw new Error(`Method not found: ${name}`)
+    }
+    return method
+  }
+
+  /** Parse a method's params and invoke its handler against the shared ctx. */
+  async function call(name: string, params: Record<string, unknown>) {
+    const method = findMethod(name)
+    const parsed = method.params ? method.params.parse(params) : undefined
+    return method.handler(parsed, ctx)
+  }
+
+  /** Start a ready worker on a fresh task off the coordinator terminal. */
+  async function startWorker(options: { terminal?: string } = {}): Promise<{
+    taskId: string
+    dispatchId: string
+  }> {
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    const task = db.createTask({ spec: 'release fixture task', runId: activeRunId })
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    const result = (await call('orchestration.workerStart', {
+      task: task.id,
+      from: 'term_coord',
+      ...(options.terminal ? { terminal: options.terminal } : { agent: 'codex' })
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    })) as { dispatchId: string; state: string }
+    expect(result.state).toBe('ready')
+    return { taskId: task.id, dispatchId: result.dispatchId }
+  }
+
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+  /** Record the worker's report as settled — the precondition for release. */
+  function settle(taskId: string, dispatchId: string, outcome: 'succeeded' | 'failed'): void {
+    const settlement = db.settleWorkerReport({
+      taskId,
+      dispatchId,
+      outcome,
+      result: `worker ${outcome}`
+    })
+    expect(settlement.action).toBe('settled')
+  }
+
+  /** Start a worker and settle its report, the state a release acts on. */
+  async function startSettledWorker(
+    outcome: 'succeeded' | 'failed' = 'succeeded',
+    options: { terminal?: string } = {}
+  ): Promise<{ taskId: string; dispatchId: string }> {
+    const worker = await startWorker(options)
+    settle(worker.taskId, worker.dispatchId, outcome)
+    return worker
+  }
+
+  it('closes a live worker terminal whose durable handle no longer resolves but whose process incarnation still matches', async () => {
+    setup()
+    const { dispatchId } = await startSettledWorker()
+    // The durable handle stops resolving (renderer graph epoch bump / handle invalidation)...
+    vi.mocked(runtime.showTerminal).mockImplementation(async (handle) =>
+      handle === 'term_worker'
+        ? Promise.reject(new Error('terminal_handle_stale'))
+        : // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: This test fixture is deliberately shaped to exercise the private/runtime boundary.
+          // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+          // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+          ({ handle, worktreeId: 'repo::worktree', status: 'running' } as never)
+    )
+    // ...but the recorded process incarnation still names a live PTY, re-minted to a fresh handle.
+    const resolveByIncarnation = vi.fn().mockReturnValue('term_reminted')
+    vi.spyOn(runtime, 'resolveTerminalHandleByProcessIncarnation').mockImplementation(
+      resolveByIncarnation
+    )
+
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    const receipt = (await call('orchestration.workerRelease', { dispatch: dispatchId })) as {
+      state: string
+      processAction: string
+    }
+
+    expect(receipt).toMatchObject({ state: 'released', processAction: 'closed_agent_terminal' })
+    expect(resolveByIncarnation).toHaveBeenCalledWith(
+      'runtime_test:term_worker:1',
+      JSON.stringify({ kind: 'local', hostId: 'local' })
+    )
+    // The close targeted exactly the re-minted live handle for that PTY, never the stale one.
+    expect(runtime.closeTerminal).toHaveBeenCalledTimes(1)
+    expect(runtime.closeTerminal).toHaveBeenCalledWith('term_reminted')
+    expect(db.getWorkerTerminalResourceByOwner(dispatchId)).toMatchObject({
+      ownership_state: 'released',
+      release_state: 'released'
+    })
+  })
+
+  it('stays release_unknown and closes nothing when the recorded incarnation no longer matches a live pty', async () => {
+    setup()
+    const { dispatchId } = await startSettledWorker()
+    vi.mocked(runtime.showTerminal).mockRejectedValue(new Error('terminal_handle_stale'))
+    // A reused ptyId now belongs to a different process: the incarnation mismatch refuses a close.
+    const resolveByIncarnation = vi.fn().mockReturnValue(null)
+    vi.spyOn(runtime, 'resolveTerminalHandleByProcessIncarnation').mockImplementation(
+      resolveByIncarnation
+    )
+
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    const receipt = (await call('orchestration.workerRelease', { dispatch: dispatchId })) as {
+      state: string
+    }
+
+    expect(receipt.state).toBe('release_unknown')
+    expect(resolveByIncarnation).toHaveBeenCalledWith(
+      'runtime_test:term_worker:1',
+      JSON.stringify({ kind: 'local', hostId: 'local' })
+    )
+    expect(runtime.closeTerminal).not.toHaveBeenCalled()
+    expect(db.getWorkerTerminalResourceByOwner(dispatchId)?.release_state).toBe('unknown')
+  })
+
+  it('does not plain-settle an exited missing worker when the archive was never committed', async () => {
+    setup()
+    const { dispatchId } = await startSettledWorker()
+    vi.mocked(runtime.showTerminal).mockRejectedValue(new Error('terminal_handle_stale'))
+    const resolveByIncarnation = vi.fn().mockReturnValue(null)
+    vi.spyOn(runtime, 'resolveTerminalHandleByProcessIncarnation').mockImplementation(
+      resolveByIncarnation
+    )
+    inspectProcessLiveness.mockResolvedValue('exited')
+
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    const receipt = (await call('orchestration.workerRelease', { dispatch: dispatchId })) as {
+      state: string
+      processAction: string
+    }
+
+    expect(receipt).toMatchObject({ state: 'release_unknown', processAction: 'none' })
+    expect(inspectProcessLiveness).toHaveBeenCalled()
+    expect(runtime.closeTerminal).not.toHaveBeenCalled()
+    expect(db.getWorkerTerminalResourceByOwner(dispatchId)).toMatchObject({
+      ownership_state: 'owned',
+      release_state: 'unknown'
+    })
+  })
+
+  it('settles released without a close when exited missing and an archive is already committed', async () => {
+    setup()
+    const { dispatchId } = await startSettledWorker()
+    const requested = db.requestWorkerTerminalRelease(dispatchId)
+    if (requested.disposition !== 'requested') {
+      throw new Error(`expected requested, got ${requested.disposition}`)
+    }
+    db.commitWorkerTerminalArchiveForRelease({
+      dispatchId,
+      resourceId: requested.resource.id,
+      kind: 'terminal_tail',
+      content: JSON.stringify({ lines: [] }),
+      archiveSource: 'terminal',
+      archiveStatus: 'empty'
+    })
+    vi.mocked(runtime.showTerminal).mockRejectedValue(new Error('terminal_handle_stale'))
+    const resolveByIncarnation = vi.fn().mockReturnValue(null)
+    vi.spyOn(runtime, 'resolveTerminalHandleByProcessIncarnation').mockImplementation(
+      resolveByIncarnation
+    )
+    inspectProcessLiveness.mockResolvedValue('exited')
+
+    const receipt = await completeWorkerTerminalRelease({
+      runtime,
+      db,
+      dispatchId,
+      resource: db.getWorkerTerminalResource(requested.resource.id)!,
+      mode: 'interactive'
+    })
+
+    expect(receipt).toMatchObject({ state: 'released', processAction: 'none' })
+    expect(runtime.closeTerminal).not.toHaveBeenCalled()
+    expect(db.getWorkerTerminalResourceByOwner(dispatchId)).toMatchObject({
+      ownership_state: 'released',
+      release_state: 'released'
+    })
+  })
+
+  it('reaches settleDead before the lease check when a gone worker is exited with no live authority', async () => {
+    // Without a committed archive settleDead retains; lease must not run first and force
+    // retained/identity_unproven. Disposition is release_unknown (interactive) after the retain.
+    setup()
+    const { dispatchId } = await startSettledWorker()
+    vi.mocked(runtime.showTerminal).mockRejectedValue(new Error('terminal_handle_stale'))
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    const resolveByIncarnation = vi.fn().mockReturnValue(null)
+    vi.spyOn(runtime, 'resolveTerminalHandleByProcessIncarnation').mockImplementation(
+      resolveByIncarnation
+    )
+    vi.mocked(runtime.getOrchestrationDispatchAuthority).mockReturnValue(null)
+    inspectProcessLiveness.mockResolvedValue('exited')
+
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    const receipt = (await call('orchestration.workerRelease', { dispatch: dispatchId })) as {
+      state: string
+      processAction: string
+    }
+
+    expect(receipt).toMatchObject({ state: 'release_unknown', processAction: 'none' })
+    expect(receipt.state).not.toBe('retained')
+    expect(inspectProcessLiveness).toHaveBeenCalled()
+    expect(runtime.closeTerminal).not.toHaveBeenCalled()
+  })
+
+  it('concedes release_unknown before the lease check when a gone worker has no live authority and liveness is unproven', async () => {
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    setup()
+    const { dispatchId } = await startSettledWorker()
+    vi.mocked(runtime.showTerminal).mockRejectedValue(new Error('terminal_handle_stale'))
+    const resolveByIncarnation = vi.fn().mockReturnValue(null)
+    vi.spyOn(runtime, 'resolveTerminalHandleByProcessIncarnation').mockImplementation(
+      resolveByIncarnation
+    )
+    vi.mocked(runtime.getOrchestrationDispatchAuthority).mockReturnValue(null)
+    // Liveness is unresolvable/not-exited: the process may have been re-homed, so concede rather
+    // than retain or guess at a live process.
+    inspectProcessLiveness.mockResolvedValue('live')
+
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    const receipt = (await call('orchestration.workerRelease', { dispatch: dispatchId })) as {
+      state: string
+    }
+
+    expect(receipt.state).toBe('release_unknown')
+    expect(receipt.state).not.toBe('retained')
+    expect(runtime.closeTerminal).not.toHaveBeenCalled()
+    expect(db.getWorkerTerminalResourceByOwner(dispatchId)?.release_state).toBe('unknown')
+  })
+
+  it('workerStop closes a live worker via the reminted handle when the durable handle is stale', async () => {
+    setup()
+    const { dispatchId } = await startWorker()
+    // The durable handle stops resolving, but the recorded incarnation still names a live PTY.
+    vi.mocked(runtime.showTerminal).mockImplementation(async (handle) =>
+      handle === 'term_worker'
+        ? Promise.reject(new Error('terminal_handle_stale'))
+        : // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: This test fixture is deliberately shaped to exercise the private/runtime boundary.
+          // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+          // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+          ({ handle, worktreeId: 'repo::worktree', status: 'running' } as never)
+    )
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    const resolveByIncarnation = vi.fn().mockReturnValue('term_reminted')
+    vi.spyOn(runtime, 'resolveTerminalHandleByProcessIncarnation').mockImplementation(
+      resolveByIncarnation
+    )
+
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    const receipt = (await call('orchestration.workerStop', { dispatch: dispatchId })) as {
+      processAction: string
+    }
+
+    expect(receipt.processAction).toBe('closed_agent_terminal')
+    // The kill targeted exactly the reminted live handle, never the stale durable one — closing
+    // the stale handle would throw terminal_handle_stale and leak the PTY.
+    expect(runtime.closeTerminal).toHaveBeenCalledTimes(1)
+    expect(runtime.closeTerminal).toHaveBeenCalledWith('term_reminted')
+  })
+
+  it('workerRead reads a live worker via the reminted handle when the durable handle is stale', async () => {
+    setup()
+    const { dispatchId } = await startWorker()
+    vi.mocked(runtime.showTerminal).mockImplementation(
+      async (handle) =>
+        handle === 'term_worker'
+          ? Promise.reject(new Error('terminal_handle_stale'))
+          : // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: This test fixture is deliberately shaped to exercise the private/runtime boundary.
+            // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+            // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+            // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+            // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+            ({ handle, worktreeId: 'repo::worktree', status: 'running' } as never)
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    )
+    const resolveByIncarnation = vi.fn().mockReturnValue('term_reminted')
+    vi.spyOn(runtime, 'resolveTerminalHandleByProcessIncarnation').mockImplementation(
+      resolveByIncarnation
+    )
+
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    const output = (await call('orchestration.workerRead', { dispatch: dispatchId })) as {
+      terminal?: { tail: string[] }
+    }
+
+    // Both the exact-session probe and the terminal read addressed the reminted handle.
+    expect(runtime.getExactWorkerProviderSession).toHaveBeenCalledWith(
+      'term_reminted',
+      expect.any(Number)
+    )
+    expect(runtime.readTerminal).toHaveBeenCalledWith('term_reminted', expect.anything())
+    expect(output.terminal?.tail).toEqual(['worker output line 1', 'worker output line 2'])
+  })
+
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+  it('recovery-mode: defers when exited missing has no archive rather than plain-settling', async () => {
+    // Proof of death still runs settleDead first; when it retains (no archive), recovery must
+    // stay release_pending — not plain-settle, not unknown.
+    setup()
+    const { dispatchId } = await startSettledWorker()
+    vi.mocked(runtime.showTerminal).mockRejectedValue(new Error('terminal_handle_stale'))
+    const resolveByIncarnation = vi.fn().mockReturnValue(null)
+    vi.spyOn(runtime, 'resolveTerminalHandleByProcessIncarnation').mockImplementation(
+      resolveByIncarnation
+    )
+    inspectProcessLiveness.mockResolvedValue('exited')
+    const requested = db.requestWorkerTerminalRelease(dispatchId)
+    if (requested.disposition !== 'requested') {
+      throw new Error(`expected a requested release, got ${requested.disposition}`)
+    }
+
+    const receipt = await completeWorkerTerminalRelease({
+      runtime,
+      db,
+      dispatchId,
+      resource: requested.resource,
+      mode: 'recovery'
+    })
+
+    expect(receipt).toMatchObject({ state: 'release_pending', processAction: 'none' })
+    expect(runtime.closeTerminal).not.toHaveBeenCalled()
+    expect(db.getWorkerTerminalResourceByOwner(dispatchId)).toMatchObject({
+      ownership_state: 'owned',
+      release_state: 'requested'
+    })
+  })
+
+  it('recovery-mode: settles released before the defer when exited missing already has an archive', async () => {
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    setup()
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    const { dispatchId } = await startSettledWorker()
+    vi.mocked(runtime.showTerminal).mockRejectedValue(new Error('terminal_handle_stale'))
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    const resolveByIncarnation = vi.fn().mockReturnValue(null)
+    vi.spyOn(runtime, 'resolveTerminalHandleByProcessIncarnation').mockImplementation(
+      resolveByIncarnation
+    )
+    inspectProcessLiveness.mockResolvedValue('exited')
+    const requested = db.requestWorkerTerminalRelease(dispatchId)
+    if (requested.disposition !== 'requested') {
+      throw new Error(`expected a requested release, got ${requested.disposition}`)
+    }
+    db.commitWorkerTerminalArchiveForRelease({
+      dispatchId,
+      resourceId: requested.resource.id,
+      kind: 'terminal_tail',
+      content: JSON.stringify({ lines: [] }),
+      archiveSource: 'terminal',
+      archiveStatus: 'empty'
+    })
+
+    const receipt = await completeWorkerTerminalRelease({
+      runtime,
+      db,
+      dispatchId,
+      resource: db.getWorkerTerminalResource(requested.resource.id)!,
+      mode: 'recovery'
+    })
+
+    expect(receipt).toMatchObject({ state: 'released', processAction: 'none' })
+    expect(runtime.closeTerminal).not.toHaveBeenCalled()
+    expect(db.getWorkerTerminalResourceByOwner(dispatchId)).toMatchObject({
+      ownership_state: 'released',
+      release_state: 'released'
+    })
+  })
+
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+  it('recovery-mode: defers release_pending when liveness is unverifiable rather than provably exited', async () => {
+    setup()
+    const { dispatchId } = await startSettledWorker()
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    vi.mocked(runtime.showTerminal).mockRejectedValue(new Error('terminal_handle_stale'))
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    const resolveByIncarnation = vi.fn().mockReturnValue(null)
+    vi.spyOn(runtime, 'resolveTerminalHandleByProcessIncarnation').mockImplementation(
+      resolveByIncarnation
+    )
+    // Not a death certificate: inventory may still be incomplete, so recovery must defer.
+    inspectProcessLiveness.mockResolvedValue('unverifiable')
+    const requested = db.requestWorkerTerminalRelease(dispatchId)
+    if (requested.disposition !== 'requested') {
+      throw new Error(`expected a requested release, got ${requested.disposition}`)
+    }
+
+    const receipt = await completeWorkerTerminalRelease({
+      runtime,
+      db,
+      dispatchId,
+      resource: requested.resource,
+      mode: 'recovery'
+    })
+
+    expect(receipt.state).toBe('release_pending')
+    expect(runtime.closeTerminal).not.toHaveBeenCalled()
+    expect(db.getWorkerTerminalResourceByOwner(dispatchId)?.release_state).not.toBe('released')
+  })
+})
diff --git a/src/main/runtime/rpc/methods/orchestration-worker-release-reap-fixed.func.test.ts b/src/main/runtime/rpc/methods/orchestration-worker-release-reap-fixed.func.test.ts
new file mode 100644
index 000000000000..579f37eaf9e3
--- /dev/null
+++ b/src/main/runtime/rpc/methods/orchestration-worker-release-reap-fixed.func.test.ts
@@ -0,0 +1,358 @@
+// PRB-0219 / upstream #18737 — FUNCTIONAL (integration) reproduction of the steady-state
+// worker-release reap LEAK.
+//
+// This is the "functional/integration" tier of the PRB-0219 test strategy. It wires the REAL
+// orchestration RPC surface (orchestration.workerStart / workerRelease / workerList), the REAL
+// OrchestrationDb, and the REAL release completion + observation modules against a fake runtime
+// that faithfully models the two identity planes involved in the bug:
+//
+//   * VOLATILE, epoch-fenced handle table  — `handleTable` keyed by terminal handle, each entry
+//     stamped with the `rendererGraphEpoch` at which it was issued. `showTerminal` resolves a
+//     handle ONLY while its stamped epoch matches the current epoch (mirrors getLiveLeafForHandle
+//     throwing 'terminal_handle_stale' on a rendererGraphEpoch bump). A relay reconnect / renderer
+//     remount on headless serve bumps the epoch.
+//   * DURABLE, incarnation-addressed process table — `ptysById` keyed by the ptyId embedded in the
+//     worker's persisted process_incarnation (`${ptyId}:${incarnationId}`). The pty stays LIVE
+//     across an epoch bump; nothing about the graph epoch kills the process.
+//
+// The bug (mechanism): when the epoch bumps, the durable db handle stops resolving through
+// showTerminal WHILE THE PTY IS STILL ALIVE. inspectWorkerTerminal swallows the throw and reports
+// `missing`; completeWorkerTerminalRelease then commits `release_unknown` and returns WITHOUT ever
+// calling runtime.closeTerminal — so the process/PTY leaks. On mtl-02 those orphans accumulate in
+// the orca-serve@factory cgroup until TasksMax=4096 is hit and Bun/omp abort() on EAGAIN.
+//
+// The observable leak signal asserted here: state 'release_unknown' + processAction 'none' +
+// closeTerminal NEVER called + the pty STILL alive in ptysById + worker-list terminalState stuck
+// on 'release_unknown' (never 'released').
+
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { ORCHESTRATION_METHODS } from './orchestration'
+import { eraseRpcMethods, type RpcContext } from '../core'
+import { OrchestrationDb } from '../../orchestration/db'
+import { OrcaRuntimeService } from '../../orca-runtime'
+
+describe('PRB-0219 worker-release reap FIX (functional verification)', () => {
+  let db: OrchestrationDb
+  let dbOpen = false
+  let runtime: OrcaRuntimeService
+  let ctx: RpcContext
+  let activeRunId: string
+
+  const coordinatorPaneKey = 'tab_coord:aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa'
+  const workerPaneKey = 'tab_worker:bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb'
+
+  // Dispatch/automation ptyId shape: `${repoId}::${worktreePath}@@${suffix}` (executionHostId:null).
+  const PTY_ID = 'repo-7f3a::/data/wt/factory-task-1@@a1b2c3d4'
+  const INCARNATION_ID = 1
+  const PROCESS_INCARNATION = `${PTY_ID}:${INCARNATION_ID}`
+
+  // ---- fake runtime process/handle planes (module-level so spies can mutate them) ----
+  let ptysById: Map<string, { incarnationId: number; alive: boolean }>
+  let handleTable: Map<string, { ptyId: string; epoch: number }>
+  let rendererGraphEpoch: number
+  let closedPtyIds: string[]
+
+  /** Resolve a handle to its live pty only while its stamped graph epoch is current. */
+  function resolveHandleToLivePty(
+    handle: string
+  ): { ptyId: string; pty: { incarnationId: number; alive: boolean } } | null {
+    const entry = handleTable.get(handle)
+    if (!entry) {
+      return null
+    }
+    if (entry.epoch !== rendererGraphEpoch) {
+      // rendererGraphEpoch fence: the durable handle no longer resolves to a live leaf.
+      return null
+    }
+    const pty = ptysById.get(entry.ptyId)
+    if (!pty || !pty.alive) {
+      return null
+    }
+    return { ptyId: entry.ptyId, pty }
+  }
+
+  /** Wire the real RPC surface and db against the two-plane fake runtime. */
+  function setup(): void {
+    ptysById = new Map([
+      ['coord-pty', { incarnationId: 1, alive: true }],
+      [PTY_ID, { incarnationId: INCARNATION_ID, alive: true }]
+    ])
+    handleTable = new Map([
+      ['term_coord', { ptyId: 'coord-pty', epoch: 0 }],
+      ['term_worker', { ptyId: PTY_ID, epoch: 0 }]
+    ])
+    rendererGraphEpoch = 0
+    closedPtyIds = []
+
+    db = new OrchestrationDb(':memory:')
+    dbOpen = true
+    runtime = new OrcaRuntimeService()
+    runtime.setOrchestrationDb(db)
+
+    // Incarnation-addressed liveness probe: reads the DURABLE plane, so it stays 'live' across the
+    // epoch bump (the process really is still running). Matches the real asymmetry.
+    vi.spyOn(runtime, 'inspectTerminalProcessIncarnationLiveness').mockImplementation(
+      async (incarnation: string) => {
+        const idx = incarnation.lastIndexOf(':')
+        const ptyId = incarnation.slice(0, idx)
+        const pty = ptysById.get(ptyId)
+        return pty?.alive ? 'live' : 'exited'
+      }
+    )
+
+    // The incarnation-addressed re-resolution primitive the fix adds. Present here as a spy so the
+    // same harness proves BOTH tiers: pre-fix completion never calls it (leak); post-fix completion
+    // calls it to remint a live handle (reap). Fence: EXACT incarnationId match only.
+    vi.spyOn(runtime, 'resolveTerminalHandleByProcessIncarnation').mockImplementation(
+      (incarnation: string): string | null => {
+        const idx = incarnation.lastIndexOf(':')
+        const ptyId = incarnation.slice(0, idx)
+        const inc = Number(incarnation.slice(idx + 1))
+        const pty = ptysById.get(ptyId)
+        if (!pty || !pty.alive) {
+          return null
+        }
+        if (pty.incarnationId !== inc) {
+          // Fence: a reused ptyId with a different incarnation must NOT resolve.
+          return null
+        }
+        // Remint a live handle at the current graph epoch.
+        handleTable.set('term_reminted', { ptyId, epoch: rendererGraphEpoch })
+        return 'term_reminted'
+      }
+    )
+
+    // Identity plane (durable) — answers for the original AND any reminted handle. Independent of
+    // the graph epoch, exactly like the real getTerminal* accessors that read dispatch authority.
+    const knownWorkerHandle = (handle: string): boolean =>
+      handle === 'term_worker' || handle === 'term_reminted'
+    vi.spyOn(runtime, 'getTerminalPaneKey').mockImplementation((handle) =>
+      handle === 'term_coord'
+        ? coordinatorPaneKey
+        : knownWorkerHandle(handle)
+          ? workerPaneKey
+          : null
+    )
+    vi.spyOn(runtime, 'getTerminalProcessIncarnation').mockImplementation((handle) =>
+      knownWorkerHandle(handle) ? PROCESS_INCARNATION : null
+    )
+    vi.spyOn(runtime, 'getOrchestrationDispatchAuthority').mockImplementation((handle) =>
+      knownWorkerHandle(handle)
+        ? // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: This test fixture is deliberately shaped to exercise the private/runtime boundary.
+          ({
+            terminalHandle: handle,
+            paneKey: workerPaneKey,
+            processIncarnation: PROCESS_INCARNATION,
+            hostScope: { kind: 'local', hostId: 'local' }
+            // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+            // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+          } as never)
+        : null
+    )
+    vi.spyOn(runtime, 'validateOrchestrationAgentLauncher').mockImplementation(() => {})
+
+    // Volatile handle resolution — epoch-fenced. Throws 'terminal_handle_stale' once the epoch
+    // moves past the epoch at which the handle was issued.
+    vi.spyOn(runtime, 'showTerminal').mockImplementation(async (handle) => {
+      if (!resolveHandleToLivePty(handle)) {
+        throw new Error('terminal_handle_stale')
+      }
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+      return { handle, worktreeId: 'repo::worktree', status: 'running' } as never
+    })
+
+    // The reap: closing a handle kills exactly the pty it resolves to.
+    vi.spyOn(runtime, 'closeTerminal').mockImplementation(async (handle) => {
+      const live = resolveHandleToLivePty(handle)
+      if (!live) {
+        // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+        // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+        return { handle, tabId: null, ptyKilled: false } as never
+      }
+      live.pty.alive = false
+      ptysById.delete(live.ptyId)
+      closedPtyIds.push(live.ptyId)
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+      return { handle, tabId: `tab:${live.ptyId}`, ptyKilled: true } as never
+    })
+
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    // Remaining runtime surface required to start + settle a worker (mirrors the unit harness).
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    vi.spyOn(runtime, 'showManagedTerminalWorkspace').mockResolvedValue({
+      id: 'repo::worktree'
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    } as never)
+    vi.spyOn(runtime, 'createTerminal').mockResolvedValue({
+      handle: 'term_worker',
+      worktreeId: 'repo::worktree',
+      title: 'worker'
+    })
+    vi.spyOn(runtime, 'waitForTerminal').mockResolvedValue({
+      handle: 'term_worker',
+      condition: 'tui-idle',
+      satisfied: true,
+      status: 'running',
+      exitCode: null
+    })
+    vi.spyOn(runtime, 'getTerminalOrchestrationCliCommand').mockReturnValue('orca')
+    vi.spyOn(runtime, 'sendTerminalAgentPrompt').mockResolvedValue({
+      handle: 'term_worker',
+      accepted: true,
+      bytesWritten: 1
+    })
+    vi.spyOn(runtime, 'isTerminalRunningAgent').mockResolvedValue(true)
+    vi.spyOn(runtime, 'getExactWorkerProviderSession').mockReturnValue(null)
+    vi.spyOn(runtime, 'readTerminal').mockResolvedValue({
+      handle: 'term_worker',
+      status: 'running',
+      tail: ['worker output line 1', 'worker output line 2'],
+      truncated: false,
+      nextCursor: '2'
+    })
+    vi.spyOn(runtime, 'notifyMessageArrived').mockImplementation(() => {})
+
+    activeRunId = db.createRun({
+      objective: 'PRB-0219 reap leak fixture',
+      coordinatorHandle: 'term_coord',
+      coordinatorPaneKey
+    }).id
+    ctx = { runtime }
+  }
+
+  afterEach(() => {
+    if (dbOpen) {
+      dbOpen = false
+      db.close()
+    }
+    vi.restoreAllMocks()
+  })
+
+  /** Look up a registered orchestration RPC method by name. */
+  function findMethod(name: string) {
+    const method = eraseRpcMethods(ORCHESTRATION_METHODS).find((m) => m.name === name)
+    if (!method) {
+      throw new Error(`Method not found: ${name}`)
+    }
+    return method
+  }
+
+  /** Parse a method's params and invoke its handler against the shared ctx. */
+  async function call(name: string, params: Record<string, unknown>) {
+    const method = findMethod(name)
+    const parsed = method.params ? method.params.parse(params) : undefined
+    return method.handler(parsed, ctx)
+  }
+
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+  /** Start a worker and settle its report, the state a release acts on. */
+  async function startSettledWorker(): Promise<{ taskId: string; dispatchId: string }> {
+    const task = db.createTask({ spec: 'reap-leak fixture task', runId: activeRunId })
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    const result = (await call('orchestration.workerStart', {
+      task: task.id,
+      from: 'term_coord',
+      agent: 'codex'
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    })) as { dispatchId: string; state: string }
+    expect(result.state).toBe('ready')
+    const settlement = db.settleWorkerReport({
+      taskId: task.id,
+      dispatchId: result.dispatchId,
+      outcome: 'succeeded',
+      result: 'worker succeeded'
+    })
+    expect(settlement.action).toBe('settled')
+    return { taskId: task.id, dispatchId: result.dispatchId }
+  }
+
+  /** The terminalState workerList projects for a dispatch, or null. */
+  async function workerTerminalState(dispatchId: string): Promise<string | null> {
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    const listed = (await call('orchestration.workerList', { run: activeRunId })) as {
+      workers: { dispatchId: string; terminalState: string | null }[]
+    }
+    return listed.workers.find((w) => w.dispatchId === dispatchId)?.terminalState ?? null
+  }
+
+  it('REAP (fixed): a rendererGraphEpoch bump strands the durable handle, but the incarnation fallback remints a live handle and reaps the process', async () => {
+    setup()
+    const { dispatchId } = await startSettledWorker()
+    const resource = db.getWorkerTerminalResourceByOwner(dispatchId)
+    expect(resource?.process_incarnation).toBe(PROCESS_INCARNATION)
+
+    // Relay reconnect / renderer remount bumps the graph epoch: the durable handle goes stale
+    // while the PTY stays alive.
+    rendererGraphEpoch = 1
+    await expect(runtime.showTerminal('term_worker')).rejects.toThrow('terminal_handle_stale')
+    expect(ptysById.get(PTY_ID)?.alive).toBe(true)
+
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    const receipt = (await call('orchestration.workerRelease', { dispatch: dispatchId })) as {
+      state: string
+      processAction: string
+    }
+
+    // The fix: inspectWorkerTerminal re-resolved the live PTY by process incarnation, reminted a
+    // handle, and completion closed THAT handle — the process is actually reaped.
+    expect(receipt.state).toBe('released')
+    expect(receipt.processAction).toBe('closed_agent_terminal')
+    expect(runtime.closeTerminal).toHaveBeenCalledWith('term_reminted')
+    expect(closedPtyIds).toEqual([PTY_ID])
+    expect(ptysById.has(PTY_ID)).toBe(false)
+    expect(await workerTerminalState(dispatchId)).toBe('released')
+  })
+
+  it('CONTROL: with the graph epoch intact the same release reaps exactly that PTY', async () => {
+    setup()
+    const { dispatchId } = await startSettledWorker()
+
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    const receipt = (await call('orchestration.workerRelease', { dispatch: dispatchId })) as {
+      state: string
+      processAction: string
+    }
+
+    expect(receipt.state).toBe('released')
+    expect(receipt.processAction).toBe('closed_agent_terminal')
+    expect(closedPtyIds).toEqual([PTY_ID])
+    expect(ptysById.has(PTY_ID)).toBe(false)
+    expect(await workerTerminalState(dispatchId)).toBe('released')
+  })
+
+  it('FENCE (fixed): a reused ptyId carrying a different incarnation must NOT remint or close — stays release_unknown', async () => {
+    setup()
+    const { dispatchId } = await startSettledWorker()
+
+    // The graph epoch bumps AND the ptyId has been reused by a different process (incarnation 2),
+    // while the worker's recorded incarnation is still 1. The exact-incarnation fence must refuse.
+    rendererGraphEpoch = 1
+    const reused = ptysById.get(PTY_ID)
+    if (reused) {
+      reused.incarnationId = 2
+    }
+
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Test fixture crosses a private/runtime boundary with a verified shape.
+    const receipt = (await call('orchestration.workerRelease', { dispatch: dispatchId })) as {
+      state: string
+      processAction: string
+    }
+
+    expect(receipt.state).toBe('release_unknown')
+    expect(receipt.processAction).toBe('none')
+    expect(runtime.closeTerminal).not.toHaveBeenCalled()
+    // The other lane's live process is left untouched (never reaped by an over-broad match).
+    expect(ptysById.get(PTY_ID)?.alive).toBe(true)
+    expect(await workerTerminalState(dispatchId)).toBe('release_unknown')
+  })
+})
diff --git a/src/main/runtime/rpc/methods/orchestration-worker-start-mode-selection.test.ts b/src/main/runtime/rpc/methods/orchestration-worker-start-mode-selection.test.ts
index 52cf3579016c..a2beea9ea05c 100644
--- a/src/main/runtime/rpc/methods/orchestration-worker-start-mode-selection.test.ts
+++ b/src/main/runtime/rpc/methods/orchestration-worker-start-mode-selection.test.ts
@@ -30,7 +30,7 @@ vi.mock('./orchestration/federation/federated-worker-start', () => ({
 }))
 vi.mock('./orchestration-structured-worker-session', async (importOriginal) => ({
   ...(await importOriginal<Record<string, unknown>>()),
-  sendStructuredWorkerPreamble: async () => {},
+  sendStructuredWorkerPreamble: async () => 'accepted',
   releaseStructuredWorkerSession: () => {},
   discardStructuredWorkerSession: async () => {}
 }))
diff --git a/src/main/runtime/rpc/methods/orchestration/federation/federated-worker-start.ts b/src/main/runtime/rpc/methods/orchestration/federation/federated-worker-start.ts
index a7c59b7064b9..957b4a6dde7a 100644
--- a/src/main/runtime/rpc/methods/orchestration/federation/federated-worker-start.ts
+++ b/src/main/runtime/rpc/methods/orchestration/federation/federated-worker-start.ts
@@ -1,3 +1,4 @@
+import type { OrchestrationSessionCaller } from '../../../../orchestration/orchestration-caller-identity'
 import { isTuiAgent } from '../../../../../../shared/tui-agent-config'
 import type { RuntimeStatus } from '../../../../../../shared/runtime-types'
 import {
@@ -45,6 +46,8 @@ export async function startFederatedWorker(args: {
     method: string
     payloadHash: string
   }
+  /** The coordinator's resolved session, when it is one; recorded as the Dispatch creator. */
+  callerSession?: OrchestrationSessionCaller
 }): Promise<unknown> {
   const { params, runtime, db, task, runId, orchestrationMutation } = args
   if (!isWorkerStartTimeoutWithinTimerLimit(params.timeoutMs)) {
@@ -117,7 +120,7 @@ export async function startFederatedWorker(args: {
 
   const setupDecision = createsWorktree ? (params.setup ?? 'run') : 'not_applicable'
   const started = db.createStartingWorkerDispatch({
-    creator: resolveDispatchCreator(runtime, params.from),
+    creator: resolveDispatchCreator(runtime, params.from, args.callerSession),
     maxDepth: runtime.getNestedWorkerMaxDepth(),
     taskId: task?.id,
     taskSpec: params.spec,
diff --git a/src/main/runtime/rpc/methods/orchestration/gates/gates.ts b/src/main/runtime/rpc/methods/orchestration/gates/gates.ts
index 29be91b43245..f0736db916c2 100644
--- a/src/main/runtime/rpc/methods/orchestration/gates/gates.ts
+++ b/src/main/runtime/rpc/methods/orchestration/gates/gates.ts
@@ -84,7 +84,10 @@ export const ORCHESTRATION_GATE_METHODS = [
   defineMethod({
     name: 'orchestration.gateCreate',
     params: GateCreateParams,
-    handler: (params, { orchestrationCompatibilityEvidence, runtime, legacyCoordinatorRunId }) => {
+    handler: (
+      params,
+      { orchestrationCompatibilityEvidence, orchestrationCaller, runtime, legacyCoordinatorRunId }
+    ) => {
       const db = runtime.getOrchestrationDb()
       let options: string[] | undefined
       if (params.options) {
@@ -107,7 +110,8 @@ export const ORCHESTRATION_GATE_METHODS = [
         callerTerminalHandle: params.from,
         requireCurrentConsumer: true,
         legacyCoordinatorRunId,
-        callerEvidence: orchestrationCompatibilityEvidence
+        callerEvidence: orchestrationCompatibilityEvidence,
+        callerSession: orchestrationCaller
       })
       if (task.run_id !== run.id) {
         throw taskNotFoundError(`Task ${params.task} was not found in Run ${run.id}.`, {
@@ -127,7 +131,10 @@ export const ORCHESTRATION_GATE_METHODS = [
   defineMethod({
     name: 'orchestration.gateResolve',
     params: GateResolveParams,
-    handler: (params, { orchestrationCompatibilityEvidence, runtime, legacyCoordinatorRunId }) => {
+    handler: (
+      params,
+      { orchestrationCompatibilityEvidence, orchestrationCaller, runtime, legacyCoordinatorRunId }
+    ) => {
       const db = runtime.getOrchestrationDb()
       const existing = db.getGate(params.id)
       if (!existing) {
@@ -138,7 +145,8 @@ export const ORCHESTRATION_GATE_METHODS = [
         callerTerminalHandle: params.from,
         requireCurrentConsumer: true,
         legacyCoordinatorRunId,
-        callerEvidence: orchestrationCompatibilityEvidence
+        callerEvidence: orchestrationCompatibilityEvidence,
+        callerSession: orchestrationCaller
       })
       // Why: a gate outside the caller's Run is indistinguishable from a missing one, so probing cannot map foreign Runs.
       if (existing.run_id !== run.id) {
@@ -155,7 +163,10 @@ export const ORCHESTRATION_GATE_METHODS = [
   defineMethod({
     name: 'orchestration.gateList',
     params: GateListParams,
-    handler: (params, { orchestrationCompatibilityEvidence, runtime, legacyCoordinatorRunId }) => {
+    handler: (
+      params,
+      { orchestrationCompatibilityEvidence, orchestrationCaller, runtime, legacyCoordinatorRunId }
+    ) => {
       const db = runtime.getOrchestrationDb()
       const explicitRun = params.run ? db.getRun(params.run) : undefined
       // Why: same read posture as taskList — an explicitly named Run is inspectable, an unnamed one means the caller's own.
@@ -167,7 +178,8 @@ export const ORCHESTRATION_GATE_METHODS = [
               callerTerminalHandle: params.from,
               requireCurrentConsumer: params.run === undefined,
               legacyCoordinatorRunId,
-              callerEvidence: orchestrationCompatibilityEvidence
+              callerEvidence: orchestrationCompatibilityEvidence,
+              callerSession: orchestrationCaller
             })
       const gates = db
         .listGates({
diff --git a/src/main/runtime/rpc/methods/orchestration/messaging/ask-methods.ts b/src/main/runtime/rpc/methods/orchestration/messaging/ask-methods.ts
index ef191250a8be..9b49e7a07a11 100644
--- a/src/main/runtime/rpc/methods/orchestration/messaging/ask-methods.ts
+++ b/src/main/runtime/rpc/methods/orchestration/messaging/ask-methods.ts
@@ -5,6 +5,11 @@ import { isGroupAddress } from '../../../../orchestration/groups'
 import { AskParams } from '../schemas'
 import { rejectFederatedExplicitTarget } from '../routing'
 import { askRemoteRunHome } from './ask-remote'
+import {
+  mailboxAddressOf,
+  runCoordinatorKey
+} from '../../../../orchestration/orchestration-caller-identity'
+import { resolveOrchestrationParty } from '../../../../orchestration/orchestration-party'
 
 export const ORCHESTRATION_ASK_METHODS = [
   defineMethod({
@@ -87,7 +92,12 @@ export const ORCHESTRATION_ASK_METHODS = [
             `Dispatch ${activeDispatch.id} belongs to Run ${run.id}, not ${params.run}.`
           )
         }
-        if (params.to && params.to !== `run:${run.id}` && params.to !== run.coordinator_handle) {
+        if (
+          params.to &&
+          params.to !== `run:${run.id}` &&
+          resolveOrchestrationParty(params.to, db).address !==
+            mailboxAddressOf(runCoordinatorKey(run))
+        ) {
           throw new OrchestrationError(
             'dispatch_run_mismatch',
             `ask from Dispatch ${activeDispatch.id} must target its owning Run ${run.id}.`
diff --git a/src/main/runtime/rpc/methods/orchestration/messaging/check-methods.ts b/src/main/runtime/rpc/methods/orchestration/messaging/check-methods.ts
index 20ac25e65120..b9aa437e1794 100644
--- a/src/main/runtime/rpc/methods/orchestration/messaging/check-methods.ts
+++ b/src/main/runtime/rpc/methods/orchestration/messaging/check-methods.ts
@@ -6,6 +6,8 @@ import { checkRunMailbox } from './check-run'
 import { checkWorkerMailbox } from './check-worker'
 import { checkDirectMailbox } from './check-direct'
 import { orchestrationSkillRecoveryData } from '../../../../../../shared/orchestration-rpc-contract'
+import { hasRunBindingKey } from '../../../../orchestration/orchestration-caller-identity'
+import { orchestrationCallerIdentity } from '../runs/run-scope'
 import {
   callerHoldsDispatchPane,
   dispatchFenced,
@@ -20,6 +22,7 @@ export const ORCHESTRATION_CHECK_METHODS = [
       params,
       {
         orchestrationCompatibilityEvidence,
+        orchestrationCaller,
         runtime,
         signal,
         legacyCoordinatorRunId,
@@ -31,9 +34,14 @@ export const ORCHESTRATION_CHECK_METHODS = [
       const handle = params.terminal ?? 'unknown'
       const typeFilter = parseMessageTypes(params.types)
 
-      // Why: a live runtime handle is authoritative; pane metadata is only the restart fallback.
-      const paneKey = runtime.getTerminalPaneKey(handle) ?? params.terminalPaneKey
-      const boundRun = paneKey ? db.getCurrentRunForPane(paneKey) : undefined
+      const caller = orchestrationCallerIdentity(runtime, {
+        handle,
+        session: orchestrationCaller,
+        // Why: a live runtime handle is authoritative; pane metadata is only the restart fallback.
+        paneKey: runtime.getTerminalPaneKey(handle) ?? params.terminalPaneKey
+      })
+      const paneKey = caller.paneKey ?? undefined
+      const boundRun = hasRunBindingKey(caller) ? db.getCurrentRunForCoordinator(caller) : undefined
       if (params.run || boundRun) {
         return checkRunMailbox({
           params,
@@ -41,6 +49,7 @@ export const ORCHESTRATION_CHECK_METHODS = [
           db,
           handle,
           paneKey,
+          callerSession: orchestrationCaller,
           typeFilter,
           signal,
           legacyCoordinatorRunId,
@@ -80,7 +89,8 @@ export const ORCHESTRATION_CHECK_METHODS = [
           typeFilter,
           signal,
           activeDispatch,
-          remoteAttachment
+          remoteAttachment,
+          recordMutationReceipt
         })
       }
       const consumingCheck = params.peek !== true && params.all !== true && params.unread !== false
@@ -93,7 +103,7 @@ export const ORCHESTRATION_CHECK_METHODS = [
       }
       // Why: a consuming check on a handle with no live pane and no Dispatch can never see
       // Run mail, so an empty inbox would read as "nothing yet" instead of a stale caller.
-      if (!paneKey && consumingCheck) {
+      if (!hasRunBindingKey(caller) && consumingCheck) {
         throw new OrchestrationError(
           'stable_pane_required',
           `Terminal ${handle} has no live pane bound to a Run, so this inbox can never receive Run mail. Rebind this terminal with orchestration run-use, or read the Run mailbox with --run <run_id>.`,
diff --git a/src/main/runtime/rpc/methods/orchestration/messaging/check-run-pending-mail.ts b/src/main/runtime/rpc/methods/orchestration/messaging/check-run-pending-mail.ts
new file mode 100644
index 000000000000..5d453616f355
--- /dev/null
+++ b/src/main/runtime/rpc/methods/orchestration/messaging/check-run-pending-mail.ts
@@ -0,0 +1,140 @@
+import type { MessageType, OrchestrationDb, RunRow } from '../../../../orchestration/db'
+import type { OrcaRuntimeService } from '../../../../orca-runtime'
+import { interruptedAcknowledgedCheck } from '../routing'
+import { checkWorkerMailbox } from './check-worker'
+import { currentDispatchAssigneeRun } from './recipient-routing'
+import { callerHoldsDispatchPane, dispatchFenced } from './dispatch-mailbox-fence'
+import { orchestrationCallerIdentity } from '../runs/run-scope'
+import type { OrchestrationSessionCaller } from '../../../../orchestration/orchestration-caller-identity'
+import type { CheckParams } from '../schemas'
+import type { z } from 'zod'
+
+export async function checkRunPendingMail(args: {
+  params: z.infer<typeof CheckParams>
+  runtime: OrcaRuntimeService
+  db: OrchestrationDb
+  run: RunRow
+  handle: string
+  paneKey: string | undefined
+  callerSession: OrchestrationSessionCaller | undefined
+  typeFilter: MessageType[] | undefined
+  signal: AbortSignal | undefined
+  revalidateConsumer: () => void
+  recordMutationReceipt: ((receipt: unknown) => void) | undefined
+}): Promise<{ acknowledged?: string; result?: unknown }> {
+  const {
+    params,
+    runtime,
+    db,
+    run,
+    handle,
+    paneKey,
+    typeFilter,
+    signal,
+    revalidateConsumer,
+    recordMutationReceipt
+  } = args
+  const generation = run.consumer_generation
+  const address = `run:${run.id}`
+  // Drain pre-bind mail through its original Dispatch owner, never by changing its Run.
+  const residual = !params.run ? db.getActiveDispatchForIdentity(handle, paneKey) : undefined
+  const caller = orchestrationCallerIdentity(runtime, {
+    handle,
+    paneKey,
+    session: args.callerSession
+  })
+  const residualAck =
+    params.ack &&
+    residual &&
+    db.getDeliveryRaw(params.ack)?.mailbox_handle === `dispatch:${residual.id}`
+      ? params.ack
+      : undefined
+  const acknowledgeRun = () =>
+    params.ack
+      ? db.acknowledgeRunDelivery({
+          runId: run.id,
+          consumerGeneration: generation,
+          deliveryId: params.ack
+        })
+      : undefined
+  let acknowledged: { delivery: { id: string } } | undefined = residualAck
+    ? undefined
+    : acknowledgeRun()
+  const recordAcknowledged = () => {
+    if (acknowledged) {
+      recordMutationReceipt?.(
+        interruptedAcknowledgedCheck(run.id, acknowledged.delivery.id, 'outcome_unknown')
+      )
+    }
+  }
+  recordAcknowledged()
+  if (
+    residual &&
+    residual.run_id !== run.id &&
+    (residual.assignee_orca_session_id === null ||
+      residual.assignee_orca_session_id === caller.orcaSessionId) &&
+    callerHoldsDispatchPane(residual, paneKey) &&
+    currentDispatchAssigneeRun(runtime, db, residual)?.id === run.id &&
+    (residualAck || !db.hasOutstandingMailboxDelivery(address))
+  ) {
+    const result = await checkWorkerMailbox({
+      params: { ...params, ack: residualAck, wait: false },
+      runtime,
+      db,
+      handle,
+      paneKey,
+      typeFilter,
+      signal,
+      activeDispatch: residual,
+      remoteAttachment: undefined,
+      wakeTypes: params.wait ? typeFilter : undefined,
+      // Accept the original owner's ack without creating a batch ahead of Run replay.
+      deferDelivery: () => db.hasOutstandingMailboxDelivery(address),
+      revalidateConsumer: () => {
+        revalidateConsumer()
+        const current = db.getActiveDispatchForIdentity(handle, paneKey)
+        if (
+          !current ||
+          current.id !== residual.id ||
+          currentDispatchAssigneeRun(runtime, db, current)?.id !== run.id
+        ) {
+          throw dispatchFenced()
+        }
+      },
+      recordMutationReceipt
+    })
+    if (result?.acknowledged) {
+      acknowledged = { delivery: { id: result.acknowledged } }
+    }
+    recordAcknowledged()
+    try {
+      revalidateConsumer()
+    } catch (error) {
+      if (acknowledged) {
+        return {
+          acknowledged: acknowledged.delivery.id,
+          result: interruptedAcknowledgedCheck(run.id, acknowledged.delivery.id, 'consumer_fenced')
+        }
+      }
+      throw error
+    }
+    const inspectingHistory =
+      params.all === true || (params.unread === false && params.peek !== true)
+    if (
+      result &&
+      result.count > 0 &&
+      (!inspectingHistory || db.getUnreadMessages(`dispatch:${residual.id}`).length > 0)
+    ) {
+      return {
+        acknowledged: acknowledged?.delivery.id,
+        result: { ...result, acknowledged: acknowledged?.delivery.id ?? null }
+      }
+    }
+  }
+
+  // A supplied Delivery outside this caller's current Dispatch must still fail acknowledgment.
+  if (params.ack && !acknowledged) {
+    acknowledgeRun()
+  }
+  return { acknowledged: acknowledged?.delivery.id }
+}
diff --git a/src/main/runtime/rpc/methods/orchestration/messaging/check-run.ts b/src/main/runtime/rpc/methods/orchestration/messaging/check-run.ts
index 6db89cf4a201..c48141cf7ddb 100644
--- a/src/main/runtime/rpc/methods/orchestration/messaging/check-run.ts
+++ b/src/main/runtime/rpc/methods/orchestration/messaging/check-run.ts
@@ -9,6 +9,8 @@ import { routeAllMailboxPages } from '../schemas'
 import { resolveRunScope } from '../runs/run-scope'
 import type { CheckParams } from '../schemas'
 import type { z } from 'zod'
+import type { OrchestrationSessionCaller } from '../../../../orchestration/orchestration-caller-identity'
+import { checkRunPendingMail } from './check-run-pending-mail'
 
 type CheckParamsInput = z.infer<typeof CheckParams>
 
@@ -18,6 +20,7 @@ export async function checkRunMailbox(args: {
   db: OrchestrationDb
   handle: string
   paneKey: string | undefined
+  callerSession: OrchestrationSessionCaller | undefined
   typeFilter: MessageType[] | undefined
   signal: AbortSignal | undefined
   legacyCoordinatorRunId: string | undefined
@@ -31,12 +34,12 @@ export async function checkRunMailbox(args: {
     db,
     handle,
     paneKey,
+    callerSession,
     typeFilter,
     signal,
     legacyCoordinatorRunId,
     revalidateLegacyCoordinator,
-    orchestrationCompatibilityEvidence,
-    recordMutationReceipt
+    orchestrationCompatibilityEvidence
   } = args
   const routeDirectSnapshot = async (
     runId: string,
@@ -52,6 +55,7 @@ export async function checkRunMailbox(args: {
     runId: params.run,
     callerTerminalHandle: handle,
     callerPaneKey: paneKey,
+    callerSession,
     requireCurrentConsumer: true,
     legacyCoordinatorRunId,
     callerEvidence: orchestrationCompatibilityEvidence
@@ -68,40 +72,45 @@ export async function checkRunMailbox(args: {
       db.routeUnreadDirectMessagesToRunMailbox(run.id, coordinatorHandle, throughSequence)
     )
   }
-  revalidateLegacyCoordinator?.()
-  const currentRun = resolveRunScope(runtime, {
-    runId: run.id,
-    callerTerminalHandle: handle,
-    callerPaneKey: paneKey,
-    requireCurrentConsumer: true,
-    legacyCoordinatorRunId,
-    callerEvidence: orchestrationCompatibilityEvidence
-  })
-  if (currentRun.consumer_generation !== generation) {
-    throw new OrchestrationError(
-      'consumer_fenced',
-      'This mailbox consumer was replaced while routing pending mail.'
-    )
+  const revalidateConsumer = (): void => {
+    revalidateLegacyCoordinator?.()
+    const currentRun = resolveRunScope(runtime, {
+      runId: run.id,
+      callerTerminalHandle: handle,
+      callerPaneKey: paneKey,
+      callerSession,
+      requireCurrentConsumer: true,
+      legacyCoordinatorRunId,
+      callerEvidence: orchestrationCompatibilityEvidence
+    })
+    if (currentRun.consumer_generation !== generation) {
+      throw new OrchestrationError(
+        'consumer_fenced',
+        'This mailbox consumer was replaced while routing pending mail.'
+      )
+    }
   }
+  revalidateConsumer()
 
-  const acknowledged = params.ack
-    ? db.acknowledgeRunDelivery({
-        runId: run.id,
-        consumerGeneration: generation,
-        deliveryId: params.ack
-      })
-    : undefined
-  if (acknowledged) {
-    recordMutationReceipt?.(
-      interruptedAcknowledgedCheck(run.id, acknowledged.delivery.id, 'outcome_unknown')
-    )
+  const pending = await checkRunPendingMail({ ...args, run, revalidateConsumer })
+  try {
+    revalidateConsumer()
+  } catch (error) {
+    if (pending.acknowledged) {
+      return interruptedAcknowledgedCheck(run.id, pending.acknowledged, 'consumer_fenced')
+    }
+    throw error
   }
+  if (pending.result) {
+    return pending.result
+  }
+  const acknowledged = pending.acknowledged
   if (params.all || (params.unread === false && !params.peek)) {
     const messages = db.getRunMailboxHistory(run.id, 100, typeFilter)
     const result = {
       messages: exposeMessages(messages),
       count: messages.length,
-      acknowledged: acknowledged?.delivery.id ?? null
+      acknowledged: acknowledged ?? null
     }
     if (params.format || params.inject) {
       return {
@@ -117,7 +126,7 @@ export async function checkRunMailbox(args: {
     runId: run.id,
     messages: exposeMessages(messages),
     count: messages.length,
-    acknowledged: acknowledged?.delivery.id ?? null,
+    acknowledged: acknowledged ?? null,
     ...(params.format || params.inject
       ? { formatted: messages.map(formatMessageBanner).join('\n\n') }
       : {})
@@ -137,7 +146,7 @@ export async function checkRunMailbox(args: {
       messages: exposeMessages(current.messages),
       count: current.messages.length,
       replayed: current.replayed,
-      acknowledged: acknowledged?.delivery.id ?? null,
+      acknowledged: acknowledged ?? null,
       timedOut: false,
       cancelled: false,
       connectionLost: false,
@@ -155,7 +164,7 @@ export async function checkRunMailbox(args: {
       deliveryId: null,
       messages: [],
       count: 0,
-      acknowledged: acknowledged?.delivery.id ?? null,
+      acknowledged: acknowledged ?? null,
       timedOut: false,
       cancelled: false,
       connectionLost: false
@@ -169,17 +178,17 @@ export async function checkRunMailbox(args: {
     exclusive: true
   })
   try {
-    revalidateLegacyCoordinator?.()
+    revalidateConsumer()
   } catch (error) {
     if (!acknowledged) {
       throw error
     }
-    return interruptedAcknowledgedCheck(run.id, acknowledged.delivery.id, 'consumer_fenced')
+    return interruptedAcknowledgedCheck(run.id, acknowledged, 'consumer_fenced')
   }
   const latestRun = db.getRun(run.id)
   if (!latestRun || latestRun.consumer_generation !== generation) {
     if (acknowledged) {
-      return interruptedAcknowledgedCheck(run.id, acknowledged.delivery.id, 'consumer_fenced')
+      return interruptedAcknowledgedCheck(run.id, acknowledged, 'consumer_fenced')
     }
     throw new OrchestrationError(
       'consumer_fenced',
@@ -188,7 +197,7 @@ export async function checkRunMailbox(args: {
   }
   if (waitResult === 'waiter_exists') {
     if (acknowledged) {
-      return interruptedAcknowledgedCheck(run.id, acknowledged.delivery.id, 'waiter_exists')
+      return interruptedAcknowledgedCheck(run.id, acknowledged, 'waiter_exists')
     }
     throw new OrchestrationError(
       'waiter_exists',
@@ -204,7 +213,7 @@ export async function checkRunMailbox(args: {
       deliveryId: null,
       messages: [],
       count: 0,
-      acknowledged: acknowledged?.delivery.id ?? null,
+      acknowledged: acknowledged ?? null,
       timedOut: true,
       cancelled: false,
       connectionLost: false
@@ -224,7 +233,7 @@ export async function checkRunMailbox(args: {
       deliveryId: null,
       messages: [],
       count: 0,
-      acknowledged: acknowledged?.delivery.id ?? null,
+      acknowledged: acknowledged ?? null,
       timedOut: false,
       cancelled: true,
       connectionLost: signal?.aborted === true
@@ -241,7 +250,7 @@ export async function checkRunMailbox(args: {
     messages: exposeMessages(current?.messages ?? []),
     count: current?.messages.length ?? 0,
     replayed: current?.replayed ?? false,
-    acknowledged: acknowledged?.delivery.id ?? null,
+    acknowledged: acknowledged ?? null,
     timedOut: false,
     cancelled: false,
     connectionLost: false,
diff --git a/src/main/runtime/rpc/methods/orchestration/messaging/check-worker.ts b/src/main/runtime/rpc/methods/orchestration/messaging/check-worker.ts
index fc9fa6b04e9d..7616f3e5cc10 100644
--- a/src/main/runtime/rpc/methods/orchestration/messaging/check-worker.ts
+++ b/src/main/runtime/rpc/methods/orchestration/messaging/check-worker.ts
@@ -5,6 +5,8 @@ import { formatMessageBanner } from '../../../../orchestration/formatter'
 import { exposeMessages } from './mailbox-message-receipt'
 import { routeAllMailboxPages } from '../schemas'
 import { asDispatchFence, callerHoldsDispatchPane, dispatchFenced } from './dispatch-mailbox-fence'
+import { interruptedAcknowledgedCheck } from '../routing'
+import { currentDispatchAssigneeRun } from './recipient-routing'
 import type { CheckParams } from '../schemas'
 import type { z } from 'zod'
 
@@ -24,7 +26,11 @@ export async function checkWorkerMailbox(args: {
   signal: AbortSignal | undefined
   activeDispatch: ActiveDispatch | undefined
   remoteAttachment: RemoteAttachment | undefined
-}): Promise<unknown> {
+  wakeTypes?: MessageType[]
+  revalidateConsumer?: () => void
+  deferDelivery?: () => boolean
+  recordMutationReceipt?: (receipt: unknown) => void
+}) {
   const {
     params,
     runtime,
@@ -54,6 +60,7 @@ export async function checkWorkerMailbox(args: {
   }
   const deliveryRunId = workerMailbox.runId
   db.requireRun(deliveryRunId)
+  const mailboxIdentity = { runId: deliveryRunId, dispatchId: workerMailbox.dispatchId }
   const address = `dispatch:${workerMailbox.dispatchId}`
   // Why: a federated worker host has no dispatch_contexts row, so its generation lives on the
   // remote_dispatch_attachments row instead.
@@ -165,6 +172,7 @@ export async function checkWorkerMailbox(args: {
     }
   }
   await revalidateWorkerMailbox()
+  args.revalidateConsumer?.()
   let acknowledged
   try {
     acknowledged = params.ack
@@ -179,9 +187,17 @@ export async function checkWorkerMailbox(args: {
   } catch (error) {
     throw asDispatchFence(error)
   }
+  if (acknowledged) {
+    args.recordMutationReceipt?.(
+      interruptedAcknowledgedCheck(deliveryRunId, acknowledged.delivery.id, 'outcome_unknown')
+    )
+  }
   const showAll = params.all === true || (params.unread === false && params.peek !== true)
   const readPeek = () => db.getUnreadMessages(address, typeFilter)
   const readDelivery = (wakeTypes?: MessageType[]) => {
+    if (args.deferDelivery?.()) {
+      return undefined
+    }
     try {
       return db.getOrCreateMailboxDelivery({
         runId: deliveryRunId,
@@ -197,8 +213,7 @@ export async function checkWorkerMailbox(args: {
   if (showAll) {
     const messages = db.getAllMessagesForHandle(address, 100, typeFilter)
     return {
-      ...(workerMailbox.runId ? { runId: workerMailbox.runId } : {}),
-      dispatchId: workerMailbox.dispatchId,
+      ...mailboxIdentity,
       messages: exposeMessages(messages),
       count: messages.length,
       acknowledged: acknowledged?.delivery.id ?? null,
@@ -211,8 +226,7 @@ export async function checkWorkerMailbox(args: {
     const messages = readPeek()
     if (messages.length > 0 || !params.wait) {
       return {
-        ...(workerMailbox.runId ? { runId: workerMailbox.runId } : {}),
-        dispatchId: workerMailbox.dispatchId,
+        ...mailboxIdentity,
         messages: exposeMessages(messages),
         count: messages.length,
         acknowledged: acknowledged?.delivery.id ?? null,
@@ -222,11 +236,10 @@ export async function checkWorkerMailbox(args: {
       }
     }
   } else {
-    const current = readDelivery(params.wait ? typeFilter : undefined)
+    const current = readDelivery(params.wait ? typeFilter : args.wakeTypes)
     if (current || !params.wait) {
       return {
-        ...(workerMailbox.runId ? { runId: workerMailbox.runId } : {}),
-        dispatchId: workerMailbox.dispatchId,
+        ...mailboxIdentity,
         deliveryId: current?.delivery.id ?? null,
         messages: exposeMessages(current?.messages ?? []),
         count: current?.messages.length ?? 0,
@@ -241,19 +254,22 @@ export async function checkWorkerMailbox(args: {
       }
     }
   }
-  const waitResult = await runtime.waitForMessage(address, {
-    typeFilter: typeFilter as string[] | undefined,
-    timeoutMs: params.timeoutMs ?? undefined,
-    signal
-  })
+  // Binding can happen during recovery, before run-create/run-use can cancel this wait.
+  const waitResult =
+    activeDispatch && currentDispatchAssigneeRun(runtime, db, activeDispatch)
+      ? 'cancelled'
+      : await runtime.waitForMessage(address, {
+          typeFilter: typeFilter as string[] | undefined,
+          timeoutMs: params.timeoutMs ?? undefined,
+          signal
+        })
   await revalidateWorkerMailbox()
   if (readCurrentGeneration() !== workerMailbox.generation) {
     throw dispatchFenced()
   }
   if (waitResult === 'timed_out' || waitResult === 'cancelled') {
     return {
-      ...(workerMailbox.runId ? { runId: workerMailbox.runId } : {}),
-      dispatchId: workerMailbox.dispatchId,
+      ...mailboxIdentity,
       messages: [],
       count: 0,
       acknowledged: acknowledged?.delivery.id ?? null,
@@ -265,8 +281,7 @@ export async function checkWorkerMailbox(args: {
   if (params.peek) {
     const arrived = readPeek()
     return {
-      ...(workerMailbox.runId ? { runId: workerMailbox.runId } : {}),
-      dispatchId: workerMailbox.dispatchId,
+      ...mailboxIdentity,
       messages: exposeMessages(arrived),
       count: arrived.length,
       acknowledged: acknowledged?.delivery.id ?? null,
@@ -277,8 +292,7 @@ export async function checkWorkerMailbox(args: {
   }
   const arrived = readDelivery(typeFilter)
   return {
-    ...(workerMailbox.runId ? { runId: workerMailbox.runId } : {}),
-    dispatchId: workerMailbox.dispatchId,
+    ...mailboxIdentity,
     deliveryId: arrived?.delivery.id ?? null,
     messages: exposeMessages(arrived?.messages ?? []),
     count: arrived?.messages.length ?? 0,
diff --git a/src/main/runtime/rpc/methods/orchestration/messaging/dispatch-recipient-identity.test.ts b/src/main/runtime/rpc/methods/orchestration/messaging/dispatch-recipient-identity.test.ts
new file mode 100644
index 000000000000..4ab4b6555a09
--- /dev/null
+++ b/src/main/runtime/rpc/methods/orchestration/messaging/dispatch-recipient-identity.test.ts
@@ -0,0 +1,137 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { testOrcaSessionId } from '../../../../../../shared/orca-session-address-test-fixture'
+import { createRootDispatch } from '../../../../orchestration/db/root-dispatch-test-fixture'
+import { createOrchestrationRpcHarness } from '../rpc-test-harness'
+
+const PANE = 'tab_lead:22222222-2222-4222-9222-222222222222'
+const OTHER = 'tab_other:33333333-3333-4333-8333-333333333333'
+const SESSION = testOrcaSessionId('4bd46b4a-035b-41dd-a122-a9c29122ff11')
+
+describe.each([false, true])('Dispatch recipient identity (settled=%s)', (settled) => {
+  const h = createOrchestrationRpcHarness()
+  let state: ReturnType<typeof h.setup>
+  let dispatch: ReturnType<typeof createRootDispatch>
+
+  beforeEach(() => {
+    state = h.setup()
+    const task = state.db.createTask({ spec: 'lead' })
+    dispatch = createRootDispatch(state.db, task.id, 'term_lead', PANE)
+    if (settled) {
+      state.db.completeDispatch(dispatch.id)
+    }
+    vi.spyOn(state.runtime, 'getLiveTerminalPaneKey').mockImplementation((handle) =>
+      handle === 'term_lead' ? PANE : h.coordinatorPaneKey
+    )
+  })
+  afterEach(() => h.cleanup())
+
+  function send() {
+    return h.call(
+      'orchestration.send',
+      { from: 'term_coord', to: `dispatch:${dispatch.id}`, subject: 'follow up' },
+      state.ctx
+    )
+  }
+  function sessionRun() {
+    state.db.db
+      .prepare('UPDATE dispatch_contexts SET assignee_orca_session_id = ? WHERE id = ?')
+      .run(SESSION, dispatch.id)
+    return state.db.createRun({
+      objective: 'session lead',
+      coordinatorHandle: 'term_lead',
+      coordinatorPaneKey: null,
+      coordinatorOrcaSessionId: SESSION
+    })
+  }
+  async function expectRun(runId: string) {
+    if (settled) {
+      await expect(send()).rejects.toMatchObject({
+        code: 'dispatch_inactive',
+        message: expect.stringContaining(`Send to run:${runId} instead`)
+      })
+      expect(state.db.getInbox()).toEqual([])
+    } else {
+      expect(await send()).toMatchObject({ message: { to_handle: `run:${runId}`, run_id: runId } })
+    }
+  }
+  async function expectNoRedirect(unrelatedRun: string) {
+    if (settled) {
+      await expect(send()).rejects.toMatchObject({
+        code: 'dispatch_inactive',
+        message: expect.not.stringContaining(unrelatedRun)
+      })
+      expect(state.db.getInbox()).toEqual([])
+    } else {
+      expect(await send()).toMatchObject({
+        message: { to_handle: `dispatch:${dispatch.id}`, run_id: dispatch.run_id }
+      })
+    }
+  }
+
+  it('uses a durable session binding without a live pane', async () => {
+    const run = sessionRun()
+    vi.mocked(state.runtime.getLiveTerminalPaneKey).mockReturnValue(null)
+    await expectRun(run.id)
+  })
+
+  it('uses the recorded session instead of an unrelated Run now occupying the saved pane', async () => {
+    const run = sessionRun()
+    state.db.createRun({
+      objective: 'new occupant',
+      coordinatorHandle: 'term_other',
+      coordinatorPaneKey: PANE
+    })
+    await expectRun(run.id)
+  })
+
+  it('ignores an old session column left behind by an older binary rebind', async () => {
+    const run = sessionRun()
+    state.db.db
+      .prepare(
+        'UPDATE runs SET coordinator_handle = ?, coordinator_pane_key = ?, consumer_generation = consumer_generation + 1 WHERE id = ?'
+      )
+      .run('term_other', OTHER, run.id)
+    await expectNoRedirect(run.id)
+  })
+
+  it('does not follow a closed handle to another occupant of its old pane', async () => {
+    const run = state.db.createRun({
+      objective: 'new occupant',
+      coordinatorHandle: 'term_other',
+      coordinatorPaneKey: PANE
+    })
+    vi.mocked(state.runtime.getLiveTerminalPaneKey).mockReturnValue(null)
+    await expectNoRedirect(run.id)
+  })
+
+  it.each(['replacement:pty:2', null])(
+    'does not redirect with a replaced or unverifiable process: %s',
+    async (process) => {
+      const run = state.db.createRun({
+        objective: 'pane run',
+        coordinatorHandle: 'term_lead',
+        coordinatorPaneKey: PANE
+      })
+      state.db.db
+        .prepare('UPDATE dispatch_contexts SET process_incarnation = ? WHERE id = ?')
+        .run('original:pty:1', dispatch.id)
+      vi.mocked(state.runtime.getTerminalProcessIncarnation).mockReturnValue(process)
+      await expectNoRedirect(run.id)
+      expect(state.db.getDispatchContextById(dispatch.id)?.status).toBe(
+        settled ? 'completed' : dispatch.status
+      )
+    }
+  )
+
+  it('accepts a reminted tab half with the same pane leaf and process', async () => {
+    const run = state.db.createRun({
+      objective: 'same pane',
+      coordinatorHandle: 'term_lead',
+      coordinatorPaneKey: PANE
+    })
+    vi.mocked(state.runtime.getLiveTerminalPaneKey).mockReturnValue(
+      PANE.replace('tab_lead', 'tab_restored')
+    )
+    await expectRun(run.id)
+  })
+})
diff --git a/src/main/runtime/rpc/methods/orchestration/messaging/message-methods.ts b/src/main/runtime/rpc/methods/orchestration/messaging/message-methods.ts
index 51a9d9bc0c51..e079596f80d0 100644
--- a/src/main/runtime/rpc/methods/orchestration/messaging/message-methods.ts
+++ b/src/main/runtime/rpc/methods/orchestration/messaging/message-methods.ts
@@ -4,13 +4,15 @@ import { OrchestrationError } from '../../../../orchestration/orchestration-erro
 import { ORCHESTRATION_LEGACY_RUN_ID } from '../../../../../../shared/orchestration-rpc-contract'
 import { abbreviateOrchestrationTasks } from '../../../../../../shared/orchestration-task-summary'
 import { parseOrchestrationTaskDepsFlag } from '../../../../orchestration/task-deps-flag'
-import { resolveRunScope } from '../runs/run-scope'
+import { orchestrationCallerIdentity, resolveRunScope } from '../runs/run-scope'
 import {
   readMutationReplayNudge,
   stripMutationReplayNudge
 } from '../../../orchestration-mutation-executor'
 import { exposeMessage } from './mailbox-message-receipt'
+import { resolveOrchestrationParty } from '../../../../orchestration/orchestration-party'
 import { recordReceiptBeforeNudge, replayMutationNudge } from './mutation-replay-nudge'
+import { resolveReplyRecipient } from './recipient-routing'
 import {
   ReplyParams,
   InboxParams,
@@ -27,6 +29,7 @@ export const ORCHESTRATION_MESSAGE_METHODS = [
       params,
       {
         orchestrationCompatibilityEvidence,
+        orchestrationCaller,
         runtime,
         legacyCoordinatorRunId,
         recordMutationReceipt,
@@ -73,7 +76,8 @@ export const ORCHESTRATION_MESSAGE_METHODS = [
           callerTerminalHandle: params.from,
           requireCurrentConsumer: true,
           legacyCoordinatorRunId,
-          callerEvidence: orchestrationCompatibilityEvidence
+          callerEvidence: orchestrationCompatibilityEvidence,
+          callerSession: orchestrationCaller
         })
         const answered = db.answerQuestion({
           messageId: question.message_id,
@@ -110,15 +114,20 @@ export const ORCHESTRATION_MESSAGE_METHODS = [
         )
       }
 
+      const recipient = resolveReplyRecipient({
+        runtime,
+        db,
+        originalFrom: original.from_handle,
+        originalRunId: original.run_id
+      })
       db.markAsRead([original.id])
-
       const reply = db.insertMessage({
         from: params.from ?? original.to_handle,
-        to: original.from_handle,
+        to: recipient.to,
         subject: `Re: ${original.subject}`,
         body: params.body,
         threadId: original.thread_id ?? original.id,
-        runId: original.run_id
+        runId: recipient.runId
       })
 
       const receipt = { message: exposeMessage(reply) }
@@ -135,7 +144,10 @@ export const ORCHESTRATION_MESSAGE_METHODS = [
       const db = runtime.getOrchestrationDb()
       // Why: stale/unknown handles return empty rather than error — historical rows survive handle deletion (design doc §3.3).
       const messages = params.terminal
-        ? db.getAllMessagesForHandle(params.terminal, params.limit)
+        ? db.getAllMessagesForHandle(
+            resolveOrchestrationParty(params.terminal, db).address,
+            params.limit
+          )
         : db.getInbox(params.limit)
       return { messages, count: messages.length }
     }
@@ -144,7 +156,10 @@ export const ORCHESTRATION_MESSAGE_METHODS = [
   defineMethod({
     name: 'orchestration.taskCreate',
     params: TaskCreateParams,
-    handler: (params, { orchestrationCompatibilityEvidence, runtime, legacyCoordinatorRunId }) => {
+    handler: (
+      params,
+      { orchestrationCompatibilityEvidence, orchestrationCaller, runtime, legacyCoordinatorRunId }
+    ) => {
       const db = runtime.getOrchestrationDb()
       const deps = params.deps ? parseOrchestrationTaskDepsFlag(params.deps) : undefined
       const run = resolveRunScope(runtime, {
@@ -152,10 +167,19 @@ export const ORCHESTRATION_MESSAGE_METHODS = [
         callerTerminalHandle: params.callerTerminalHandle,
         requireCurrentConsumer: true,
         legacyCoordinatorRunId,
-        callerEvidence: orchestrationCompatibilityEvidence
+        callerEvidence: orchestrationCompatibilityEvidence,
+        callerSession: orchestrationCaller
       })
-      const creatorAuthority = params.callerTerminalHandle
-        ? runtime.getOrchestrationDispatchAuthority(params.callerTerminalHandle)
+      // A handle-less session creates root Tasks: Task lineage is recorded by terminal only.
+      const creatorHandle = params.callerTerminalHandle
+        ? orchestrationCallerIdentity(runtime, {
+            handle: params.callerTerminalHandle,
+            session: orchestrationCaller,
+            paneKey: null
+          }).terminalHandle
+        : null
+      const creatorAuthority = creatorHandle
+        ? runtime.getOrchestrationDispatchAuthority(creatorHandle)
         : null
       const task = db.createTask({
         spec: params.spec,
@@ -163,7 +187,7 @@ export const ORCHESTRATION_MESSAGE_METHODS = [
         displayName: params.displayName,
         deps,
         parentId: params.parent,
-        createdByTerminalHandle: params.callerTerminalHandle,
+        createdByTerminalHandle: creatorHandle ?? undefined,
         ...(creatorAuthority?.paneKey && creatorAuthority.processIncarnation
           ? {
               createdByPaneKey: creatorAuthority.paneKey,
@@ -180,7 +204,10 @@ export const ORCHESTRATION_MESSAGE_METHODS = [
   defineMethod({
     name: 'orchestration.taskList',
     params: TaskListParams,
-    handler: (params, { orchestrationCompatibilityEvidence, runtime, legacyCoordinatorRunId }) => {
+    handler: (
+      params,
+      { orchestrationCompatibilityEvidence, orchestrationCaller, runtime, legacyCoordinatorRunId }
+    ) => {
       const db = runtime.getOrchestrationDb()
       const explicitRun = params.run ? db.getRun(params.run) : undefined
       const run =
@@ -191,7 +218,8 @@ export const ORCHESTRATION_MESSAGE_METHODS = [
               callerTerminalHandle: params.callerTerminalHandle,
               requireCurrentConsumer: params.run === undefined,
               legacyCoordinatorRunId,
-              callerEvidence: orchestrationCompatibilityEvidence
+              callerEvidence: orchestrationCompatibilityEvidence,
+              callerSession: orchestrationCaller
             })
       // Why: listTasksWithDispatch adds assignee_handle + dispatch_id (NULL for non-dispatched), so legacy-shape consumers are unaffected.
       const joined = db.listTasksWithDispatch({
@@ -218,14 +246,18 @@ export const ORCHESTRATION_MESSAGE_METHODS = [
   defineMethod({
     name: 'orchestration.taskUpdate',
     params: TaskUpdateParams,
-    handler: (params, { orchestrationCompatibilityEvidence, runtime, legacyCoordinatorRunId }) => {
+    handler: (
+      params,
+      { orchestrationCompatibilityEvidence, orchestrationCaller, runtime, legacyCoordinatorRunId }
+    ) => {
       const db = runtime.getOrchestrationDb()
       const run = resolveRunScope(runtime, {
         runId: params.run,
         callerTerminalHandle: params.callerTerminalHandle,
         requireCurrentConsumer: true,
         legacyCoordinatorRunId,
-        callerEvidence: orchestrationCompatibilityEvidence
+        callerEvidence: orchestrationCompatibilityEvidence,
+        callerSession: orchestrationCaller
       })
       const existing = db.getTask(params.id)
       if (!existing || existing.run_id !== run.id) {
diff --git a/src/main/runtime/rpc/methods/orchestration/messaging/recipient-routing.ts b/src/main/runtime/rpc/methods/orchestration/messaging/recipient-routing.ts
index f2b5e939a659..c499f743576c 100644
--- a/src/main/runtime/rpc/methods/orchestration/messaging/recipient-routing.ts
+++ b/src/main/runtime/rpc/methods/orchestration/messaging/recipient-routing.ts
@@ -2,6 +2,11 @@ import type { LegacyAdoptedMailboxOwner, OrchestrationDb } from '../../../../orc
 import { OrchestrationError } from '../../../../orchestration/orchestration-error'
 import type { DispatchContextRow, DispatchStatus } from '../../../../orchestration/types'
 import type { OrcaRuntimeService } from '../../../../orca-runtime'
+import { readStructuredAgentSessionRecord } from '../../../../structured-worker-authority'
+import { structuredWorkerHostScope } from '../../../../structured-worker-identity'
+import { resolveOrchestrationParty } from '../../../../orchestration/orchestration-party'
+import { isEquivalentPaneKey } from '../../../../orchestration/db/pane-key-match'
+import { CURRENT_CONTRACT_VERSION } from '../../../../orchestration/db/contract-constants'
 
 const ACTIVE_DISPATCH_STATUSES: readonly DispatchStatus[] = ['pending', 'dispatched']
 
@@ -12,20 +17,123 @@ const ACTIVE_DISPATCH_STATUSES: readonly DispatchStatus[] = ['pending', 'dispatc
  * mailbox, so accepting the message reports success for a delivery that cannot
  * happen. Federated targets keep their own liveness check.
  */
-export function assertDispatchMailboxDeliverable(db: OrchestrationDb, dispatchId: string): void {
+export function assertDispatchMailboxDeliverable(
+  runtime: OrcaRuntimeService,
+  db: OrchestrationDb,
+  dispatchId: string
+): void {
   const dispatch = db.getDispatchContextById(dispatchId)
   if (!dispatch || ACTIVE_DISPATCH_STATUSES.includes(dispatch.status)) {
     return
   }
+  const recipientRun = currentDispatchAssigneeRun(runtime, db, dispatch)?.id ?? dispatch.run_id
   throw new OrchestrationError(
     'dispatch_inactive',
-    `Dispatch ${dispatchId} is ${dispatch.status}; its worker will never read that mailbox. Send to run:${dispatch.run_id} instead, or start a new Dispatch for follow-up work.`
+    `Dispatch ${dispatchId} is ${dispatch.status}; its worker will never read that mailbox. Send to run:${recipientRun} instead, or start a new Dispatch for follow-up work.`
   )
 }
 
+// A saved pane alone cannot identify its occupant after reuse.
+export function currentDispatchAssigneeRun(
+  runtime: OrcaRuntimeService,
+  db: OrchestrationDb,
+  dispatch: DispatchContextRow
+) {
+  if (
+    dispatch.contract_version !== CURRENT_CONTRACT_VERSION ||
+    db.getFederatedDispatch(dispatch.id)
+  ) {
+    return undefined
+  }
+  if (dispatch.assignee_orca_session_id !== null) {
+    return db.getCurrentRunForCoordinator({
+      terminalHandle: dispatch.assignee_handle,
+      paneKey: null,
+      orcaSessionId: dispatch.assignee_orca_session_id
+    })
+  }
+  if (dispatch.assignee_handle === null) {
+    return undefined
+  }
+  const paneKey = runtime.getLiveTerminalPaneKey(dispatch.assignee_handle)
+  if (
+    !paneKey ||
+    (dispatch.assignee_pane_key && !isEquivalentPaneKey(dispatch.assignee_pane_key, paneKey)) ||
+    (dispatch.process_incarnation !== null &&
+      runtime.getTerminalProcessIncarnation(dispatch.assignee_handle) !==
+        dispatch.process_incarnation)
+  ) {
+    return undefined
+  }
+  return db.getCurrentRunForPane(paneKey)
+}
+
+// Nested coordinators receive new mail where their current Run check waits.
+export function resolveRunBoundDispatchRecipient(
+  runtime: OrcaRuntimeService,
+  db: OrchestrationDb,
+  dispatchId: string,
+  explicitRunId?: string
+): { to: string; runId: string; warning: SendRecipientWarning } | undefined {
+  const dispatch = db.getDispatchContextById(dispatchId)
+  if (!dispatch || !ACTIVE_DISPATCH_STATUSES.includes(dispatch.status)) {
+    return undefined
+  }
+  const boundRun = currentDispatchAssigneeRun(runtime, db, dispatch)
+  if (!boundRun || boundRun.id === dispatch.run_id) {
+    return undefined
+  }
+  const recipient = `dispatch:${dispatchId}`
+  const mismatch = runMismatch(recipient, boundRun.id, explicitRunId)
+  if (mismatch && !mismatch.ok) {
+    throw new OrchestrationError(mismatch.code, mismatch.message)
+  }
+  return {
+    to: `run:${boundRun.id}`,
+    runId: boundRun.id,
+    warning: {
+      code: 'recipient_run_bound_redirect',
+      recipient,
+      message: `${recipient} is assigned to a terminal that now coordinates Run ${boundRun.id}; queued for run:${boundRun.id}, the mailbox that terminal reads.`
+    }
+  }
+}
+
+// Replies share send routing; unresolved historical senders keep their original address.
+export function resolveReplyRecipient(params: {
+  runtime: OrcaRuntimeService
+  db: OrchestrationDb
+  originalFrom: string
+  originalRunId: string | undefined
+}): { to: string; runId: string | undefined } {
+  const { runtime, db, originalFrom, originalRunId } = params
+  const unchanged = { to: originalFrom, runId: originalRunId }
+  if (originalFrom.startsWith('run:')) {
+    return { to: originalFrom, runId: originalFrom.slice('run:'.length) }
+  }
+  if (originalFrom.startsWith('dispatch:')) {
+    const dispatchId = originalFrom.slice('dispatch:'.length)
+    // Federation owns its own recipient and liveness checks.
+    if (db.getFederatedDispatch(dispatchId)) {
+      return unchanged
+    }
+    assertDispatchMailboxDeliverable(runtime, db, dispatchId)
+    const runBound = resolveRunBoundDispatchRecipient(runtime, db, dispatchId)
+    return runBound ?? unchanged
+  }
+  const recipient = resolveBareOrchestrationRecipient({
+    runtime,
+    db,
+    handle: originalFrom,
+    senderRunId: originalRunId
+  })
+  return recipient.ok ? { to: recipient.to, runId: recipient.runId ?? originalRunId } : unchanged
+}
+
 export type SendRecipientWarning = {
   code:
     | 'legacy_terminal_recipient'
+    | 'recipient_run_bound_redirect'
     | 'recipient_unreachable'
     | 'recipient_ambiguous'
     | 'recipient_run_mismatch'
@@ -55,9 +163,20 @@ export function resolveBareOrchestrationRecipient(params: {
   explicitRunId?: string
   legacyAdoptedMailboxOwner?: LegacyAdoptedMailboxOwner | null
 }): BareRecipientResolution {
-  const { runtime, db, handle } = params
-  const paneKey = runtime.getLiveTerminalPaneKey(handle) ?? undefined
-  const boundRun = paneKey ? db.getCurrentRunForPane(paneKey) : undefined
+  const { runtime, db } = params
+  const party = resolveOrchestrationParty(params.handle, db)
+  const handle = party.address
+  const paneKey =
+    party.terminalHandle === null
+      ? undefined
+      : (runtime.getLiveTerminalPaneKey(party.terminalHandle) ?? undefined)
+  // Why: a session-backed party's Run binding is durable, so it outranks whether its pane is live.
+  const boundRun =
+    party.orcaSessionId !== null
+      ? db.getCurrentRunForCoordinator(party)
+      : paneKey
+        ? db.getCurrentRunForPane(paneKey)
+        : undefined
   if (boundRun) {
     const mismatch = runMismatch(handle, boundRun.id, params.explicitRunId)
     return mismatch ?? { ok: true, to: `run:${boundRun.id}`, runId: boundRun.id }
@@ -102,7 +221,19 @@ export function resolveBareOrchestrationRecipient(params: {
     }
   }
 
-  const message = `Terminal ${handle} has no live pane or durable Run/Dispatch mailbox.`
+  const chatSessionId = party.terminalHandle === null ? party.orcaSessionId : null
+  if (chatSessionId !== null) {
+    const record = readStructuredAgentSessionRecord(chatSessionId)
+    // Unlike a terminal handle, a session address outlives its process, so its direct mail is durable.
+    if (record && structuredWorkerHostScope(record.location)) {
+      return { ok: true, to: handle, runId: params.senderRunId }
+    }
+  }
+
+  const message =
+    chatSessionId !== null
+      ? `Agent session ${chatSessionId} does not run on this host and has no durable Run/Dispatch mailbox.`
+      : `Terminal ${handle} has no live pane or durable Run/Dispatch mailbox.`
   return {
     ok: false,
     code: 'terminal_not_found',
diff --git a/src/main/runtime/rpc/methods/orchestration/messaging/run-bound-mailbox-history.test.ts b/src/main/runtime/rpc/methods/orchestration/messaging/run-bound-mailbox-history.test.ts
new file mode 100644
index 000000000000..fba01d0d4556
--- /dev/null
+++ b/src/main/runtime/rpc/methods/orchestration/messaging/run-bound-mailbox-history.test.ts
@@ -0,0 +1,69 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { createRootDispatch } from '../../../../orchestration/db/root-dispatch-test-fixture'
+import { createOrchestrationRpcHarness } from '../rpc-test-harness'
+
+const LEAD = 'tab_lead:22222222-2222-4222-9222-222222222222'
+function deliveryId(result: unknown): string {
+  if (
+    typeof result === 'object' &&
+    result &&
+    'deliveryId' in result &&
+    typeof result.deliveryId === 'string'
+  ) {
+    return result.deliveryId
+  }
+  throw new Error('Expected a Delivery')
+}
+
+describe('Run history after residual Dispatch acknowledgment', () => {
+  const h = createOrchestrationRpcHarness()
+  let state: ReturnType<typeof h.setup>
+  beforeEach(() => {
+    state = h.setup()
+    vi.mocked(state.runtime.getTerminalPaneKey).mockImplementation((handle) =>
+      handle === 'term_lead' ? LEAD : h.coordinatorPaneKey
+    )
+  })
+  afterEach(() => h.cleanup())
+  it.each([
+    { mode: { all: true }, acknowledgeTogether: false },
+    { mode: { all: true }, acknowledgeTogether: true },
+    { mode: { unread: false }, acknowledgeTogether: false },
+    { mode: { unread: false }, acknowledgeTogether: true }
+  ])('shows Run history after old mail is read: %j', async ({ mode, acknowledgeTogether }) => {
+    const task = state.db.createTask({ spec: 'nested lead' })
+    const dispatch = createRootDispatch(state.db, task.id, 'term_lead', LEAD)
+    const run = state.db.createRun({
+      objective: 'child Run',
+      coordinatorHandle: 'term_lead',
+      coordinatorPaneKey: LEAD
+    })
+    const old = state.db.insertMessage({
+      from: 'term_coord',
+      to: `dispatch:${dispatch.id}`,
+      runId: dispatch.run_id,
+      subject: 'old mail'
+    })
+    const check = (params = {}) =>
+      h.call('orchestration.check', { terminal: 'term_lead', ...params }, state.ctx)
+    expect(await check(mode)).toMatchObject({ runId: dispatch.run_id, messages: [{ id: old.id }] })
+    expect(state.db.hasOutstandingMailboxDelivery(`dispatch:${dispatch.id}`)).toBe(false)
+    const delivery = deliveryId(await check())
+    if (!acknowledgeTogether) {
+      await check({ ack: delivery })
+    }
+    const fresh = state.db.insertMessage({
+      from: 'term_child',
+      to: `run:${run.id}`,
+      runId: run.id,
+      subject: 'new mail'
+    })
+    expect(
+      await check({ ...mode, ...(acknowledgeTogether ? { ack: delivery } : {}) })
+    ).toMatchObject({ runId: run.id, messages: [{ id: fresh.id }] })
+    expect(state.db.getMessageById(old.id)?.read).toBe(1)
+    expect(state.db.getMessageById(fresh.id)?.read).toBe(0)
+    expect(state.db.hasOutstandingMailboxDelivery(`dispatch:${dispatch.id}`)).toBe(false)
+    expect(state.db.hasOutstandingMailboxDelivery(`run:${run.id}`)).toBe(false)
+  })
+})
diff --git a/src/main/runtime/rpc/methods/orchestration/messaging/run-bound-mailbox-interleavings.test.ts b/src/main/runtime/rpc/methods/orchestration/messaging/run-bound-mailbox-interleavings.test.ts
new file mode 100644
index 000000000000..4e92d7c35c16
--- /dev/null
+++ b/src/main/runtime/rpc/methods/orchestration/messaging/run-bound-mailbox-interleavings.test.ts
@@ -0,0 +1,175 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { createRootDispatch } from '../../../../orchestration/db/root-dispatch-test-fixture'
+import { ORCHESTRATION_DELIVERY_BATCH_LIMIT } from '../../../../orchestration/db/messages/mailbox-routing-page'
+import { createOrchestrationRpcHarness } from '../rpc-test-harness'
+
+const LEAD = 'tab_lead:22222222-2222-4222-9222-222222222222'
+const OTHER = 'tab_other:33333333-3333-4333-8333-333333333333'
+
+function deliveryId(result: unknown): string {
+  if (
+    typeof result === 'object' &&
+    result !== null &&
+    'deliveryId' in result &&
+    typeof result.deliveryId === 'string'
+  ) {
+    return result.deliveryId
+  }
+  throw new Error('Expected a Delivery')
+}
+
+describe('Run binding during Dispatch checks', () => {
+  const h = createOrchestrationRpcHarness()
+  let state: ReturnType<typeof h.setup>
+  let dispatch: ReturnType<typeof createRootDispatch>
+
+  beforeEach(() => {
+    state = h.setup()
+    vi.mocked(state.runtime.getTerminalPaneKey).mockImplementation((handle) =>
+      handle === 'term_lead' ? LEAD : handle === 'term_coord' ? h.coordinatorPaneKey : OTHER
+    )
+    dispatch = createRootDispatch(
+      state.db,
+      state.db.createTask({ spec: 'lead' }).id,
+      'term_lead',
+      LEAD
+    )
+  })
+  afterEach(() => {
+    state.runtime.cancelMessageWaiters(`dispatch:${dispatch.id}`)
+    h.cleanup()
+    vi.restoreAllMocks()
+  })
+
+  function check(params: Record<string, unknown> = {}) {
+    return h.call('orchestration.check', { terminal: 'term_lead', ...params }, state.ctx)
+  }
+  function residual(subject: string) {
+    return state.db.insertMessage({
+      from: 'term_coord',
+      to: `dispatch:${dispatch.id}`,
+      runId: dispatch.run_id,
+      subject
+    })
+  }
+  async function bind(method: 'runCreate' | 'runUse') {
+    const params =
+      method === 'runCreate'
+        ? { objective: 'child' }
+        : {
+            id: state.db.createRun({
+              objective: 'adopt',
+              coordinatorHandle: 'term_other',
+              coordinatorPaneKey: OTHER
+            }).id
+          }
+    await h.call(`orchestration.${method}`, { from: 'term_lead', ...params }, state.ctx)
+    const run = state.db.getCurrentRunForPane(LEAD)
+    if (!run) {
+      throw new Error('Expected bound Run')
+    }
+    return run
+  }
+
+  describe.each(['runCreate', 'runUse'] as const)('%s', (method) => {
+    it.each(['parked', 'recovering'] as const)(
+      'cancels a %s Dispatch wait and preserves its ack',
+      async (phase) => {
+        const old = residual('before bind')
+        const ack = deliveryId(await check())
+        const record = vi.fn()
+        state.ctx.recordMutationReceipt = record
+        const wait = vi.spyOn(state.runtime, 'waitForMessage')
+        const waiting = check({ ack, wait: true, timeoutMs: 500 })
+        if (phase === 'parked') {
+          await vi.waitFor(() =>
+            expect(wait).toHaveBeenCalledWith(`dispatch:${dispatch.id}`, expect.anything())
+          )
+        }
+        const run = await bind(method)
+        await h.call(
+          'orchestration.send',
+          {
+            from: 'term_coord',
+            to: `dispatch:${dispatch.id}`,
+            subject: 'after bind'
+          },
+          state.ctx
+        )
+        expect(await waiting).toMatchObject({ acknowledged: ack, cancelled: true, timedOut: false })
+        expect(record).toHaveBeenCalledWith(expect.objectContaining({ acknowledged: ack }))
+        expect(state.db.getMessageById(old.id)).toMatchObject({ run_id: dispatch.run_id, read: 1 })
+        expect(await check()).toMatchObject({
+          runId: run.id,
+          messages: [{ subject: 'after bind' }]
+        })
+        if (phase === 'recovering') {
+          expect(wait).not.toHaveBeenCalled()
+        }
+      }
+    )
+  })
+
+  it.each(['before', 'during recovery'] as const)(
+    'replays Run delivery created %s residual acknowledgment',
+    async (phase) => {
+      const ids = Array.from(
+        { length: ORCHESTRATION_DELIVERY_BATCH_LIMIT + 1 },
+        (_, i) => residual(`old ${i}`).id
+      )
+      const last = ids.at(-1)
+      if (!last) {
+        throw new Error('Expected residual tail')
+      }
+      const ack = deliveryId(await check())
+      const run = await bind('runCreate')
+      state.db.insertMessage({
+        from: 'term_child',
+        to: `run:${run.id}`,
+        runId: run.id,
+        subject: 'Run batch'
+      })
+      let runDelivery: string | undefined
+      const readRun = () => {
+        const result = state.db.getOrCreateRunDelivery({
+          runId: run.id,
+          consumerGeneration: run.consumer_generation
+        })
+        if (!result) {
+          throw new Error('Expected Run delivery')
+        }
+        runDelivery = result.delivery.id
+      }
+      if (phase === 'before') {
+        runDelivery = deliveryId(await check({ run: run.id }))
+      } else {
+        state.db.db.prepare('UPDATE messages SET to_handle = ? WHERE id = ?').run('term_lead', last)
+        const route = state.db.routeUnreadDirectMessagesToDispatchMailbox.bind(state.db)
+        vi.spyOn(state.db, 'routeUnreadDirectMessagesToDispatchMailbox').mockImplementationOnce(
+          (...args) => {
+            const result = route(...args)
+            readRun()
+            return result
+          }
+        )
+      }
+      const result = await check({ ack })
+      expect(result).toMatchObject({
+        runId: run.id,
+        deliveryId: runDelivery,
+        acknowledged: ack,
+        replayed: true
+      })
+      expect(state.db.hasOutstandingMailboxDelivery(`dispatch:${dispatch.id}`)).toBe(false)
+      for (const id of ids.slice(0, -1)) {
+        expect(state.db.getMessageById(id)).toMatchObject({ read: 1, run_id: dispatch.run_id })
+      }
+      expect(state.db.getMessageById(last)).toMatchObject({ read: 0, run_id: dispatch.run_id })
+      expect(await check({ ack })).toMatchObject({ deliveryId: runDelivery, replayed: true })
+      const tail = await check({ ack: runDelivery })
+      expect(tail).toMatchObject({ runId: dispatch.run_id, messages: [{ id: last }], count: 1 })
+      expect(await check({ ack: deliveryId(tail) })).toMatchObject({ count: 0 })
+      expect(state.db.getMessageById(last)?.read).toBe(1)
+    }
+  )
+})
diff --git a/src/main/runtime/rpc/methods/orchestration/messaging/run-bound-mailbox-safety.test.ts b/src/main/runtime/rpc/methods/orchestration/messaging/run-bound-mailbox-safety.test.ts
new file mode 100644
index 000000000000..f5f2c57575f5
--- /dev/null
+++ b/src/main/runtime/rpc/methods/orchestration/messaging/run-bound-mailbox-safety.test.ts
@@ -0,0 +1,290 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { createRootDispatch } from '../../../../orchestration/db/root-dispatch-test-fixture'
+import { createOrchestrationRpcHarness } from '../rpc-test-harness'
+
+const LEAD = 'tab_lead:22222222-2222-4222-9222-222222222222'
+const OTHER = 'tab_other:33333333-3333-4333-8333-333333333333'
+
+function deliveryId(result: unknown): string {
+  if (
+    typeof result === 'object' &&
+    result &&
+    'deliveryId' in result &&
+    typeof result.deliveryId === 'string'
+  ) {
+    return result.deliveryId
+  }
+  throw new Error('Expected a Delivery')
+}
+
+describe('Run-bound lead mailbox boundaries', () => {
+  const h = createOrchestrationRpcHarness()
+  let state: ReturnType<typeof h.setup>
+  let dispatch: ReturnType<typeof createRootDispatch>
+  let leadRun: ReturnType<typeof state.db.createRun>
+
+  beforeEach(() => {
+    state = h.setup()
+    vi.mocked(state.runtime.getTerminalPaneKey).mockImplementation((handle) =>
+      handle === 'term_lead' ? LEAD : handle === 'term_coord' ? h.coordinatorPaneKey : OTHER
+    )
+    const task = state.db.createTask({ spec: 'nested lead' })
+    dispatch = createRootDispatch(state.db, task.id, 'term_lead', LEAD)
+    leadRun = state.db.createRun({
+      objective: 'child Run',
+      coordinatorHandle: 'term_lead',
+      coordinatorPaneKey: LEAD
+    })
+  })
+  afterEach(() => h.cleanup())
+
+  function check(params: Record<string, unknown> = {}) {
+    return h.call('orchestration.check', { terminal: 'term_lead', ...params }, state.ctx)
+  }
+  function residual(subject: string, type: 'status' | 'question' = 'status') {
+    return state.db.insertMessage({
+      from: 'term_coord',
+      to: `dispatch:${dispatch.id}`,
+      runId: dispatch.run_id,
+      subject,
+      type
+    })
+  }
+  function runMail(subject = 'Run report') {
+    return state.db.insertMessage({
+      from: 'term_child',
+      to: `run:${leadRun.id}`,
+      runId: leadRun.id,
+      subject,
+      type: 'question'
+    })
+  }
+  function handoff() {
+    state.db.bindRun({
+      runId: leadRun.id,
+      coordinatorHandle: 'term_other',
+      coordinatorPaneKey: OTHER
+    })
+  }
+
+  it('recovers old raw-handle replies only from the active Dispatch Run', async () => {
+    const old = residual('old reply')
+    state.db.db.prepare('UPDATE messages SET to_handle = ? WHERE id = ?').run('term_lead', old.id)
+    const foreign = state.db.createRun({
+      objective: 'unrelated',
+      coordinatorHandle: 'term_other',
+      coordinatorPaneKey: OTHER
+    })
+    const privateMail = state.db.insertMessage({
+      from: 'term_other',
+      to: 'term_lead',
+      runId: foreign.id,
+      subject: 'foreign'
+    })
+    runMail()
+    const first = await check()
+    expect(first).toMatchObject({ runId: dispatch.run_id, messages: [{ id: old.id }] })
+    expect(await check({ ack: deliveryId(first) })).toMatchObject({
+      runId: leadRun.id,
+      messages: [{ subject: 'Run report' }]
+    })
+    expect(state.db.getMessageById(privateMail.id)).toMatchObject({ read: 0, run_id: foreign.id })
+  })
+
+  it('treats types as a wake condition and replays the entire residual FIFO batch', async () => {
+    residual('older status')
+    residual('decision needed', 'question')
+    runMail()
+    const first = await check({ wait: true, types: 'question' })
+    expect(first).toMatchObject({
+      messages: [{ subject: 'older status' }, { subject: 'decision needed' }]
+    })
+    expect(await check({ wait: true, types: 'worker_done' })).toMatchObject({
+      deliveryId: deliveryId(first),
+      replayed: true
+    })
+    expect(await check({ ack: deliveryId(first) })).toMatchObject({
+      runId: leadRun.id,
+      acknowledged: deliveryId(first),
+      messages: [{ subject: 'Run report' }]
+    })
+  })
+
+  it('does not filter a non-waiting consuming residual check', async () => {
+    residual('status')
+    expect(await check({ types: 'question' })).toMatchObject({ messages: [{ subject: 'status' }] })
+  })
+
+  it.each([{ peek: true }, { all: true }])(
+    'filters residual inspection without consuming it: %j',
+    async (mode) => {
+      const status = residual('status')
+      residual('question', 'question')
+      expect(await check({ ...mode, types: 'question' })).toMatchObject({
+        messages: [{ subject: 'question' }]
+      })
+      expect(state.db.getMessageById(status.id)?.read).toBe(0)
+      expect(state.db.hasOutstandingMailboxDelivery(`dispatch:${dispatch.id}`)).toBe(false)
+    }
+  )
+
+  it('replays an outstanding Run batch before exposing older nonmatching residual mail', async () => {
+    residual('status')
+    runMail()
+    const first = await check({ wait: true, types: 'question' })
+    expect(first).toMatchObject({ runId: leadRun.id })
+    expect(await check()).toMatchObject({ deliveryId: deliveryId(first), replayed: true })
+    expect(await check({ ack: deliveryId(first) })).toMatchObject({
+      acknowledged: deliveryId(first),
+      messages: [{ subject: 'status' }]
+    })
+  })
+
+  it('keeps explicit Run checks scoped and refuses the parent Run', async () => {
+    const pending = residual('parent mail')
+    runMail()
+    expect(await check({ run: leadRun.id })).toMatchObject({
+      runId: leadRun.id,
+      messages: [{ subject: 'Run report' }]
+    })
+    await expect(check({ run: dispatch.run_id })).rejects.toMatchObject({ code: 'consumer_fenced' })
+    expect(state.db.getMessageById(pending.id)?.read).toBe(0)
+  })
+
+  it('fences a Run handoff during residual direct-mail recovery before delivery or ack', async () => {
+    const pending = residual('raw before bind')
+    state.db.db
+      .prepare('UPDATE messages SET to_handle = ? WHERE id = ?')
+      .run('term_lead', pending.id)
+    const route = state.db.routeUnreadDirectMessagesToDispatchMailbox.bind(state.db)
+    vi.spyOn(state.db, 'routeUnreadDirectMessagesToDispatchMailbox').mockImplementationOnce(
+      (...args) => {
+        const result = route(...args)
+        handoff()
+        return result
+      }
+    )
+    await expect(check()).rejects.toMatchObject({ code: 'consumer_fenced' })
+    expect(state.db.hasOutstandingMailboxDelivery(`dispatch:${dispatch.id}`)).toBe(false)
+    expect(state.db.getMessageById(pending.id)?.read).toBe(0)
+  })
+
+  it('records a residual acknowledgment before a Run handoff interrupts the following wait', async () => {
+    residual('ack me')
+    const first = await check()
+    const record = vi.fn()
+    state.ctx.recordMutationReceipt = record
+    vi.spyOn(state.runtime, 'waitForMessage').mockImplementationOnce(async () => {
+      expect(record).toHaveBeenCalledWith(
+        expect.objectContaining({ acknowledged: deliveryId(first) })
+      )
+      handoff()
+      return 'cancelled'
+    })
+    expect(await check({ ack: deliveryId(first), wait: true })).toMatchObject({
+      acknowledged: deliveryId(first),
+      waitInterrupted: 'consumer_fenced',
+      messages: []
+    })
+    expect(state.db.getUnreadMessages(`dispatch:${dispatch.id}`)).toEqual([])
+  })
+
+  it('retains the acknowledged receipt if the wait transport throws', async () => {
+    residual('ack me')
+    const first = await check()
+    const record = vi.fn()
+    state.ctx.recordMutationReceipt = record
+    vi.spyOn(state.runtime, 'waitForMessage').mockRejectedValueOnce(
+      new Error('connection interrupted')
+    )
+    await expect(check({ ack: deliveryId(first), wait: true })).rejects.toThrow(
+      'connection interrupted'
+    )
+    expect(record).toHaveBeenCalledWith(
+      expect.objectContaining({ acknowledged: deliveryId(first) })
+    )
+    expect(state.db.getUnreadMessages(`dispatch:${dispatch.id}`)).toEqual([])
+  })
+
+  it('does not give a reused process the previous assignee mail', async () => {
+    state.db.mintDispatchCapability({
+      dispatchId: dispatch.id,
+      paneKey: LEAD,
+      processIncarnation: 'old:pty:1'
+    })
+    const pending = residual('old process mail')
+    runMail()
+    expect(await check()).toMatchObject({
+      runId: leadRun.id,
+      messages: [{ subject: 'Run report' }]
+    })
+    expect(state.db.getMessageById(pending.id)?.read).toBe(0)
+    expect(state.db.hasOutstandingMailboxDelivery(`dispatch:${dispatch.id}`)).toBe(false)
+  })
+
+  it('refuses an explicit sender Run that would silently redirect into another Run', async () => {
+    await expect(
+      h.call(
+        'orchestration.send',
+        {
+          from: 'term_coord',
+          to: `dispatch:${dispatch.id}`,
+          run: dispatch.run_id,
+          subject: 'wrong scope'
+        },
+        state.ctx
+      )
+    ).rejects.toMatchObject({ code: 'recipient_run_mismatch' })
+    expect(state.db.getInbox()).toEqual([])
+  })
+
+  it('wakes a parked Run check for Dispatch mail sent after binding', async () => {
+    const waiter = vi.spyOn(state.runtime, 'waitForMessage')
+    const waiting = check({ wait: true, timeoutMs: 1_000 })
+    await vi.waitFor(() =>
+      expect(waiter).toHaveBeenCalledWith(`run:${leadRun.id}`, expect.anything())
+    )
+    await h.call(
+      'orchestration.send',
+      { from: 'term_coord', to: `dispatch:${dispatch.id}`, subject: 'wake up' },
+      state.ctx
+    )
+    expect(await waiting).toMatchObject({ timedOut: false, messages: [{ subject: 'wake up' }] })
+  })
+
+  it('keeps a canonical Run reply in the recipient Run even across an original thread Run', async () => {
+    const note = state.db.insertMessage({
+      from: `run:${leadRun.id}`,
+      to: `run:${dispatch.run_id}`,
+      runId: dispatch.run_id,
+      subject: 'report'
+    })
+    expect(
+      await h.call(
+        'orchestration.reply',
+        { from: 'term_coord', id: note.id, body: 'decision' },
+        state.ctx
+      )
+    ).toMatchObject({ message: { to_handle: `run:${leadRun.id}`, run_id: leadRun.id } })
+    expect(await check()).toMatchObject({ messages: [{ subject: 'Re: report' }] })
+  })
+
+  it('refuses replies to an inactive canonical Dispatch before reading or inserting mail', async () => {
+    const note = state.db.insertMessage({
+      from: `dispatch:${dispatch.id}`,
+      to: `run:${dispatch.run_id}`,
+      runId: dispatch.run_id,
+      subject: 'old report'
+    })
+    state.db.completeDispatch(dispatch.id)
+    await expect(
+      h.call(
+        'orchestration.reply',
+        { from: 'term_coord', id: note.id, body: 'too late' },
+        state.ctx
+      )
+    ).rejects.toMatchObject({ code: 'dispatch_inactive' })
+    expect(state.db.getMessageById(note.id)?.read).toBe(0)
+    expect(state.db.getInbox()).toHaveLength(1)
+  })
+})
diff --git a/src/main/runtime/rpc/methods/orchestration/messaging/run-bound-recipient-mail.test.ts b/src/main/runtime/rpc/methods/orchestration/messaging/run-bound-recipient-mail.test.ts
new file mode 100644
index 000000000000..bb6c7041cee6
--- /dev/null
+++ b/src/main/runtime/rpc/methods/orchestration/messaging/run-bound-recipient-mail.test.ts
@@ -0,0 +1,189 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import type { RpcContext } from '../../../core'
+import type { OrchestrationDb, RunRow } from '../../../../orchestration/db'
+import type { OrcaRuntimeService } from '../../../../orca-runtime'
+import type { DispatchContextRow } from '../../../../orchestration/types'
+import { createRootDispatch } from '../../../../orchestration/db/root-dispatch-test-fixture'
+import { createOrchestrationRpcHarness } from '../rpc-test-harness'
+
+// A lead is dispatched by a root coordinator and then coordinates its own Run from the same pane.
+// That pane's `check` reads its own Run mailbox, so mail meant for it must land there.
+describe('mail for a lead whose pane coordinates its own Run', () => {
+  const h = createOrchestrationRpcHarness()
+  const coordPane = 'tab_coord:11111111-1111-4111-8111-111111111111'
+  const leadPane = 'tab_lead:22222222-2222-4222-9222-222222222222'
+  let db: OrchestrationDb
+  let runtime: OrcaRuntimeService
+  let ctx: RpcContext
+  let rootRun: RunRow
+  let dispatch: DispatchContextRow
+
+  afterEach(() => {
+    h.cleanup()
+  })
+
+  function setup(): void {
+    ;({ db, runtime, ctx } = h.setup(false))
+    vi.spyOn(runtime, 'getTerminalPaneKey').mockImplementation((handle) =>
+      handle === 'term_coord' ? coordPane : handle === 'term_lead' ? leadPane : null
+    )
+    rootRun = db.createRun({
+      objective: 'root',
+      coordinatorHandle: 'term_coord',
+      coordinatorPaneKey: coordPane
+    })
+    const task = db.createTask({ spec: 'lead the sub-project', runId: rootRun.id })
+    dispatch = createRootDispatch(db, task.id, 'term_lead', leadPane)
+  }
+
+  function bindLeadRun(): RunRow {
+    return db.createRun({
+      objective: 'lead',
+      coordinatorHandle: 'term_lead',
+      coordinatorPaneKey: leadPane
+    })
+  }
+
+  async function call(name: string, params: Record<string, unknown>) {
+    return h.call(name, params, ctx)
+  }
+
+  async function leadInbox(params: Record<string, unknown> = {}): Promise<unknown> {
+    return call('orchestration.check', { terminal: 'term_lead', ...params })
+  }
+
+  function deliveryIdOf(result: unknown): string {
+    if (
+      typeof result === 'object' &&
+      result !== null &&
+      'deliveryId' in result &&
+      typeof result.deliveryId === 'string'
+    ) {
+      return result.deliveryId
+    }
+    throw new Error('check returned no delivery')
+  }
+
+  it('routes dispatch:<id> mail to the Run the assignee pane now coordinates', async () => {
+    setup()
+    const leadRun = bindLeadRun()
+
+    const result = await call('orchestration.send', {
+      from: 'term_coord',
+      to: `dispatch:${dispatch.id}`,
+      subject: 'Follow-up for the lead'
+    })
+
+    expect(result).toMatchObject({
+      message: { to_handle: `run:${leadRun.id}`, run_id: leadRun.id },
+      warnings: [{ code: 'recipient_run_bound_redirect' }]
+    })
+    expect(await leadInbox()).toMatchObject({ messages: [{ subject: 'Follow-up for the lead' }] })
+  })
+
+  it('still reads dispatch mail that arrived before the pane bound its own Run', async () => {
+    setup()
+    db.insertMessage({
+      from: 'term_coord',
+      to: `dispatch:${dispatch.id}`,
+      subject: 'Sent before the lead bound a Run',
+      runId: rootRun.id
+    })
+    const leadRun = bindLeadRun()
+    db.insertMessage({
+      from: 'term_worker',
+      to: `run:${leadRun.id}`,
+      subject: 'Sub-worker report',
+      runId: leadRun.id
+    })
+
+    const first = await leadInbox()
+    expect(first).toMatchObject({ messages: [{ subject: 'Sent before the lead bound a Run' }] })
+
+    const second = await leadInbox({ ack: deliveryIdOf(first) })
+    expect(second).toMatchObject({ messages: [{ subject: 'Sub-worker report' }] })
+  })
+
+  it('keeps the --types wake condition when older Dispatch mail does not match it', async () => {
+    setup()
+    db.insertMessage({
+      from: 'term_coord',
+      to: `dispatch:${dispatch.id}`,
+      subject: 'Older status note',
+      type: 'status',
+      runId: rootRun.id
+    })
+    const leadRun = bindLeadRun()
+    db.insertMessage({
+      from: 'term_worker',
+      to: `run:${leadRun.id}`,
+      subject: 'Sub-worker finished',
+      type: 'worker_done',
+      runId: leadRun.id
+    })
+
+    const woke = await leadInbox({ wait: true, types: 'worker_done', timeoutMs: 500 })
+
+    expect(woke).toMatchObject({
+      runId: leadRun.id,
+      messages: [{ subject: 'Sub-worker finished' }]
+    })
+  })
+
+  it('delivers a reply to a Run-bound sender and wakes its waiting check', async () => {
+    setup()
+    const leadRun = bindLeadRun()
+    const report = db.insertMessage({
+      from: 'term_lead',
+      to: `run:${rootRun.id}`,
+      subject: 'Lead report',
+      runId: rootRun.id
+    })
+
+    const waiting = leadInbox({ wait: true, timeoutMs: 2_000 })
+    const reply = await call('orchestration.reply', {
+      id: report.id,
+      from: 'term_coord',
+      body: 'Decision'
+    })
+
+    expect(reply).toMatchObject({
+      message: { to_handle: `run:${leadRun.id}`, run_id: leadRun.id }
+    })
+    expect(await waiting).toMatchObject({
+      timedOut: false,
+      messages: [{ subject: 'Re: Lead report' }]
+    })
+  })
+
+  it('keeps dispatch:<id> mail on the Dispatch mailbox while the assignee has no Run', async () => {
+    setup()
+
+    const result = await call('orchestration.send', {
+      from: 'term_coord',
+      to: `dispatch:${dispatch.id}`,
+      subject: 'Plain worker follow-up'
+    })
+
+    expect(result).toMatchObject({ message: { to_handle: `dispatch:${dispatch.id}` } })
+    expect(result).not.toHaveProperty('warnings')
+  })
+
+  it('keeps a reply on the raw handle when the sender has no Run or live pane', async () => {
+    setup()
+    const note = db.insertMessage({
+      from: 'term_offline',
+      to: `run:${rootRun.id}`,
+      subject: 'Offline note',
+      runId: rootRun.id
+    })
+
+    const reply = await call('orchestration.reply', {
+      id: note.id,
+      from: 'term_coord',
+      body: 'Ack'
+    })
+
+    expect(reply).toMatchObject({ message: { to_handle: 'term_offline', run_id: rootRun.id } })
+  })
+})
diff --git a/src/main/runtime/rpc/methods/orchestration/messaging/send-group.test.ts b/src/main/runtime/rpc/methods/orchestration/messaging/send-group.test.ts
index b076be065931..62d2b5da4950 100644
--- a/src/main/runtime/rpc/methods/orchestration/messaging/send-group.test.ts
+++ b/src/main/runtime/rpc/methods/orchestration/messaging/send-group.test.ts
@@ -69,7 +69,7 @@ describe('orchestration.send group addresses', () => {
       return terminal ? `${terminal.tabId}:${terminal.leafId}` : null
     })
     vi.spyOn(runtime, 'getAgentStatusForHandle').mockImplementation(
-      (handle: string) => agentStatuses?.[handle] ?? null
+      async (handle: string) => agentStatuses?.[handle] ?? null
     )
   }
 
diff --git a/src/main/runtime/rpc/methods/orchestration/messaging/send-group.ts b/src/main/runtime/rpc/methods/orchestration/messaging/send-group.ts
index d5ee366a40f4..ebcff6c284e5 100644
--- a/src/main/runtime/rpc/methods/orchestration/messaging/send-group.ts
+++ b/src/main/runtime/rpc/methods/orchestration/messaging/send-group.ts
@@ -13,6 +13,7 @@ import { exposeMessages } from './mailbox-message-receipt'
 import { recordReceiptBeforeNudge } from './mutation-replay-nudge'
 import type { BareRecipientResolution, SendRecipientWarning } from './recipient-routing'
 import type { SendParams } from '../schemas'
+import type { OrchestrationCallerIdentity } from '../../../../orchestration/orchestration-caller-identity'
 import type { z } from 'zod'
 
 type SendParamsInput = z.infer<typeof SendParams>
@@ -94,6 +95,7 @@ export async function sendGroupMessage(args: {
   db: OrchestrationDb
   from: string
   groupAddress: string
+  sender: OrchestrationCallerIdentity
   senderPaneKey: string | undefined
   senderRunId: string | undefined
   explicitRunId: string | undefined
@@ -108,6 +110,7 @@ export async function sendGroupMessage(args: {
     db,
     from,
     groupAddress,
+    sender,
     senderPaneKey,
     senderRunId,
     explicitRunId,
@@ -117,7 +120,7 @@ export async function sendGroupMessage(args: {
   } = args
   // Audience follows the sender's binding, never a caller-supplied message Run or payload.
   function resolveAudienceRunId(): string {
-    const coordinated = senderPaneKey ? db.getCurrentRunForPane(senderPaneKey) : undefined
+    const coordinated = db.getCurrentRunForCoordinator(sender)
     const runId =
       coordinated?.id ??
       db.getActiveDispatchForIdentity(from, senderPaneKey)?.run_id ??
@@ -145,7 +148,7 @@ export async function sendGroupMessage(args: {
     const { terminals } = await runtime.listTerminals(undefined, undefined, {
       includeVisualLayouts: false
     })
-    agents = [...terminals, ...listAddressableStructuredWorkers()]
+    agents = [...terminals, ...listAddressableStructuredWorkers(db)]
   }
   // Revalidate after discovery before selecting recipients or writing mail.
   revalidateLegacyCoordinator?.()
@@ -164,8 +167,23 @@ export async function sendGroupMessage(args: {
           agents,
           warnings: groupWarnings
         })
-  const handles = resolveGroupAddress(groupAddress, from, candidates, (handle: string) =>
-    runtime.getAgentStatusForHandle(handle)
+  // Read up front: a structured worker's status comes from its journal, which may need opening.
+  const statuses =
+    groupAddress.toLowerCase() === '@idle'
+      ? new Map(
+          await Promise.all(
+            candidates.map(
+              async (candidate) =>
+                [candidate.handle, await runtime.getAgentStatusForHandle(candidate.handle)] as const
+            )
+          )
+        )
+      : new Map<string, string | null>()
+  const handles = resolveGroupAddress(
+    groupAddress,
+    from,
+    candidates,
+    (handle: string) => statuses.get(handle) ?? null
   )
   if (handles.length === 0) {
     // Preserve the recovery addresses even when every worker was skipped.
diff --git a/src/main/runtime/rpc/methods/orchestration/messaging/send-methods.ts b/src/main/runtime/rpc/methods/orchestration/messaging/send-methods.ts
index 7d1edb776022..527c8c6a509f 100644
--- a/src/main/runtime/rpc/methods/orchestration/messaging/send-methods.ts
+++ b/src/main/runtime/rpc/methods/orchestration/messaging/send-methods.ts
@@ -7,6 +7,7 @@ import { resolveMessageRun } from '../routing'
 import {
   assertDispatchMailboxDeliverable,
   resolveBareOrchestrationRecipient,
+  resolveRunBoundDispatchRecipient,
   type SendRecipientWarning
 } from './recipient-routing'
 import {
@@ -19,6 +20,7 @@ import { sendRemoteMessage } from './send-remote'
 import { sendPointToPointMessage } from './send-point-to-point'
 import { sendGroupMessage } from './send-group'
 import { sendFederatedControlMail } from './send-control-mail'
+import { orchestrationCallerIdentity } from '../runs/run-scope'
 
 export const ORCHESTRATION_SEND_METHODS = [
   defineMethod({
@@ -35,6 +37,7 @@ export const ORCHESTRATION_SEND_METHODS = [
         recordMutationReceipt,
         markWorkerDoneMutationEffectFree,
         replayedMutationReceipt,
+        orchestrationCaller,
         signal
       }
     ) => {
@@ -59,7 +62,12 @@ export const ORCHESTRATION_SEND_METHODS = [
           ? orchestrationCompatibilityCallerAuthority
           : undefined
       // Why: attested hook identity survives graph remount; caller params never supply lifecycle authority.
-      const senderPaneKey = attestedCaller?.paneKey ?? runtime.getTerminalPaneKey(from) ?? undefined
+      const sender = orchestrationCallerIdentity(runtime, {
+        handle: from,
+        session: orchestrationCaller,
+        paneKey: attestedCaller?.paneKey ?? runtime.getTerminalPaneKey(from)
+      })
+      const senderPaneKey = sender.paneKey ?? undefined
       const remoteAttachment = senderPaneKey
         ? db.findActiveRemoteAttachmentForPane(senderPaneKey)
         : undefined
@@ -84,8 +92,7 @@ export const ORCHESTRATION_SEND_METHODS = [
         params.to && isGroupAddress(params.to) && !params.to.toLowerCase().startsWith('@worktree:')
       // Run groups validate their own audience; message scope cannot select a parent Dispatch.
       const routing = resolveMessageRun(runtime, {
-        from,
-        senderPaneKey,
+        sender,
         to: params.to,
         runId: runGroup ? undefined : params.run,
         payload: runGroup ? undefined : params.payload
@@ -156,7 +163,18 @@ export const ORCHESTRATION_SEND_METHODS = [
             : undefined
         // Federated targets perform their own liveness check before relaying.
         if (addressedDispatchId && !federatedTarget) {
-          assertDispatchMailboxDeliverable(db, addressedDispatchId)
+          assertDispatchMailboxDeliverable(runtime, db, addressedDispatchId)
+          const runBound = resolveRunBoundDispatchRecipient(
+            runtime,
+            db,
+            addressedDispatchId,
+            params.run
+          )
+          if (runBound) {
+            to = runBound.to
+            messageRunId = runBound.runId
+            sendWarnings.push(runBound.warning)
+          }
         }
         const federatedControl = sendFederatedControlMail({
           params,
@@ -199,6 +217,7 @@ export const ORCHESTRATION_SEND_METHODS = [
         db,
         from,
         groupAddress: to,
+        sender,
         senderPaneKey,
         senderRunId: routing.run?.id,
         explicitRunId: params.run,
diff --git a/src/main/runtime/rpc/methods/orchestration/messaging/settled-dispatch-mail.test.ts b/src/main/runtime/rpc/methods/orchestration/messaging/settled-dispatch-mail.test.ts
index e91614061ea5..ddffed468900 100644
--- a/src/main/runtime/rpc/methods/orchestration/messaging/settled-dispatch-mail.test.ts
+++ b/src/main/runtime/rpc/methods/orchestration/messaging/settled-dispatch-mail.test.ts
@@ -1,4 +1,4 @@
-import { afterEach, describe, expect, it } from 'vitest'
+import { afterEach, describe, expect, it, vi } from 'vitest'
 import type { RpcContext } from '../../../core'
 import type { OrchestrationDb } from '../../../../orchestration/db'
 import { createRootDispatch } from '../../../../orchestration/db/root-dispatch-test-fixture'
@@ -58,6 +58,38 @@ describe('orchestration.send to a settled Dispatch mailbox', () => {
     ).rejects.toThrow(new RegExp(`run:${dispatch.run_id}`))
   })
 
+  it('names the Run a settled assignee now coordinates, not the sender Run', async () => {
+    setup()
+    const leadPane = 'tab_lead:22222222-2222-4222-9222-222222222222'
+    vi.spyOn(ctx.runtime, 'getLiveTerminalPaneKey').mockReturnValue(leadPane)
+    const task = db.createTask({ spec: 'lead that settled and kept coordinating' })
+    const dispatch = createRootDispatch(db, task.id, 'term_lead', leadPane)
+    db.completeDispatch(dispatch.id)
+    const leadRun = db.createRun({
+      objective: 'lead',
+      coordinatorHandle: 'term_lead',
+      coordinatorPaneKey: leadPane
+    })
+
+    const rejection = call('orchestration.send', {
+      from: 'term_coord',
+      to: `dispatch:${dispatch.id}`,
+      subject: 'One more thing'
+    })
+
+    await expect(rejection).rejects.toMatchObject({ code: 'dispatch_inactive' })
+    await expect(rejection).rejects.toThrow(new RegExp(`run:${leadRun.id}`))
+    await expect(rejection).rejects.not.toThrow(new RegExp(`run:${dispatch.run_id}`))
+    expect(db.getInbox()).toEqual([])
+    await expect(
+      call('orchestration.check', { terminal: 'term_coord', run: leadRun.id })
+    ).rejects.toMatchObject({ code: 'consumer_fenced' })
+    // Run addresses are already visible to callers; a hint grants no consuming authority.
+    expect(await call('orchestration.runShow', { id: leadRun.id })).toMatchObject({
+      run: { id: leadRun.id }
+    })
+  })
+
   it('does not write an undeliverable message row', async () => {
     setup()
     const task = db.createTask({ spec: 'worker that already reported' })
diff --git a/src/main/runtime/rpc/methods/orchestration/routing.ts b/src/main/runtime/rpc/methods/orchestration/routing.ts
index 470012838951..5978eb60cd12 100644
--- a/src/main/runtime/rpc/methods/orchestration/routing.ts
+++ b/src/main/runtime/rpc/methods/orchestration/routing.ts
@@ -1,6 +1,7 @@
 import type { MessageType } from '../../../orchestration/db'
 import type { RunRow } from '../../../orchestration/types'
 import type { OrcaRuntimeService } from '../../../orca-runtime'
+import type { OrchestrationCallerIdentity } from '../../../orchestration/orchestration-caller-identity'
 import { MESSAGE_TYPES } from '../../../orchestration/types'
 import { OrchestrationError } from '../../../orchestration/orchestration-error'
 import { LEGACY_CONTRACT_VERSION } from '../../../orchestration/db'
@@ -20,8 +21,8 @@ export function parseMessageTypes(rawTypes: string | undefined): MessageType[] |
 export function resolveMessageRun(
   runtime: OrcaRuntimeService,
   params: {
-    from?: string
-    senderPaneKey?: string
+    /** The sender as Run binding and Dispatch identity see it. */
+    sender: OrchestrationCallerIdentity
     to?: string
     runId?: string
     payload?: string
@@ -50,9 +51,7 @@ export function resolveMessageRun(
 
   const dispatch = dispatchId
     ? db.getDispatchContextById(dispatchId)
-    : params.from
-      ? db.getActiveDispatchForIdentity(params.from, params.senderPaneKey)
-      : undefined
+    : db.getActiveDispatchForIdentity(params.sender.address, params.sender.paneKey ?? undefined)
   if (params.to?.startsWith('dispatch:') && !dispatch) {
     throw new OrchestrationError(
       'dispatch_not_found',
@@ -63,9 +62,8 @@ export function resolveMessageRun(
   const resolvedRunId = params.runId ?? targetRunId ?? dispatch?.run_id
   let run = resolvedRunId ? db.getRun(resolvedRunId) : undefined
 
-  if (!run && params.from) {
-    const paneKey = params.senderPaneKey ?? runtime.getTerminalPaneKey(params.from)
-    run = paneKey ? db.getCurrentRunForPane(paneKey) : undefined
+  if (!run) {
+    run = db.getCurrentRunForCoordinator(params.sender)
   }
   if (resolvedRunId && (!run || run.legacy === 1)) {
     throw new OrchestrationError('run_not_found', `Run ${resolvedRunId} was not found.`)
diff --git a/src/main/runtime/rpc/methods/orchestration/runs/dispatch-creator.ts b/src/main/runtime/rpc/methods/orchestration/runs/dispatch-creator.ts
index 8cdbcb8da115..0ee7f7523e75 100644
--- a/src/main/runtime/rpc/methods/orchestration/runs/dispatch-creator.ts
+++ b/src/main/runtime/rpc/methods/orchestration/runs/dispatch-creator.ts
@@ -1,5 +1,7 @@
 import type { DispatchCreator } from '../../../../orchestration/db/dispatch-depth'
+import type { OrchestrationSessionCaller } from '../../../../orchestration/orchestration-caller-identity'
 import type { OrcaRuntimeService } from '../../../../orca-runtime'
+import { orchestrationCallerIdentity } from './run-scope'
 
 /**
  * Identify a CLI caller for nesting-depth purposes.
@@ -10,18 +12,35 @@ import type { OrcaRuntimeService } from '../../../../orca-runtime'
  */
 export function resolveDispatchCreator(
   runtime: OrcaRuntimeService,
-  callerHandle: string | undefined
+  callerHandle: string | undefined,
+  callerSession: OrchestrationSessionCaller | undefined
 ): DispatchCreator {
   if (!callerHandle) {
     // No declared caller means no resolvable parent. Depth 0 is the same answer
     // the pre-existing Run-binding check already gives this case.
     return { kind: 'system' }
   }
-  const authority = runtime.getOrchestrationDispatchAuthority?.(callerHandle)
+  const caller = orchestrationCallerIdentity(runtime, {
+    handle: callerHandle,
+    session: callerSession,
+    paneKey: null
+  })
+  if (caller.terminalHandle === null) {
+    // A handle-less session: its Orca session id is its whole identity.
+    return caller.orcaSessionId
+      ? { kind: 'session', orcaSessionId: caller.orcaSessionId }
+      : { kind: 'system' }
+  }
+  const authority = runtime.getOrchestrationDispatchAuthority?.(caller.terminalHandle)
   return {
     kind: 'terminal',
-    handle: callerHandle,
-    paneKey: authority?.paneKey ?? runtime.getTerminalPaneKey(callerHandle) ?? undefined,
-    processIncarnation: authority?.processIncarnation ?? undefined
+    handle: caller.terminalHandle,
+    paneKey:
+      authority?.paneKey ??
+      caller.paneKey ??
+      runtime.getTerminalPaneKey(caller.terminalHandle) ??
+      undefined,
+    processIncarnation: authority?.processIncarnation ?? undefined,
+    ...(caller.orcaSessionId ? { orcaSessionId: caller.orcaSessionId } : {})
   }
 }
diff --git a/src/main/runtime/rpc/methods/orchestration/runs/dispatch-methods.ts b/src/main/runtime/rpc/methods/orchestration/runs/dispatch-methods.ts
index 75c838783351..843df33357a6 100644
--- a/src/main/runtime/rpc/methods/orchestration/runs/dispatch-methods.ts
+++ b/src/main/runtime/rpc/methods/orchestration/runs/dispatch-methods.ts
@@ -12,6 +12,7 @@ import {
 } from '../../../../orchestration/task-dispatch-refusal'
 import { resolveRunScope } from './run-scope'
 import { DispatchParams, DispatchShowParams } from '../schemas'
+import { resolveDispatchAssigneeParty } from '../../../../orchestration/orchestration-party'
 
 export const ORCHESTRATION_DISPATCH_METHODS = [
   defineMethod({
@@ -21,6 +22,7 @@ export const ORCHESTRATION_DISPATCH_METHODS = [
       params,
       {
         orchestrationCompatibilityEvidence,
+        orchestrationCaller,
         runtime,
         legacyCoordinatorRunId,
         revalidateLegacyCoordinator,
@@ -37,7 +39,8 @@ export const ORCHESTRATION_DISPATCH_METHODS = [
         callerTerminalHandle: params.from,
         requireCurrentConsumer: true,
         legacyCoordinatorRunId,
-        callerEvidence: orchestrationCompatibilityEvidence
+        callerEvidence: orchestrationCompatibilityEvidence,
+        callerSession: orchestrationCaller
       })
       if (task.run_id !== run.id) {
         throw taskNotFoundError(`Task ${task.id} was not found in Run ${run.id}.`, {
@@ -45,12 +48,13 @@ export const ORCHESTRATION_DISPATCH_METHODS = [
           runId: run.id
         })
       }
+      const assignee = params.to ? resolveDispatchAssigneeParty(params.to, db).address : undefined
 
       // Why: dry-run previews the preamble without mutating state, so it skips the ready-status check and uses a placeholder dispatchId.
       if (params.dryRun) {
         const maxDepth = runtime.getNestedWorkerMaxDepth()
         const previewDepth = db.resolveChildDispatchDepth(
-          resolveDispatchCreator(runtime, params.from),
+          resolveDispatchCreator(runtime, params.from, orchestrationCaller),
           maxDepth
         )
         const preamble = buildDispatchPreamble({
@@ -59,19 +63,17 @@ export const ORCHESTRATION_DISPATCH_METHODS = [
           canDispatchSubWorkers: previewDepth < maxDepth,
           taskSpec: task.spec,
           coordinatorHandle: params.from ?? 'coordinator',
-          workerHandle: params.to ?? 'worker',
+          workerHandle: assignee ?? 'worker',
           devMode: params.devMode,
-          ...(params.to
-            ? { cliCommand: runtime.getTerminalOrchestrationCliCommand(params.to) }
-            : {})
+          ...(assignee ? { cliCommand: runtime.getTerminalOrchestrationCliCommand(assignee) } : {})
         })
         return { dispatch: null, injected: false, dryRun: true, preamble }
       }
 
-      if (!params.to) {
+      if (!assignee) {
         throw new Error('Missing --to')
       }
-      const to = params.to
+      const to = assignee
 
       if (task.status !== 'ready') {
         throw taskNotStartableError(
@@ -131,7 +133,7 @@ export const ORCHESTRATION_DISPATCH_METHODS = [
         assigneePaneKey,
         launchTokenHash: dispatchAuthority?.launchTokenHash ?? undefined,
         processIncarnation,
-        creator: resolveDispatchCreator(runtime, params.from),
+        creator: resolveDispatchCreator(runtime, params.from, orchestrationCaller),
         maxDepth: runtime.getNestedWorkerMaxDepth()
       })
       const dispatchCapability = params.inject
diff --git a/src/main/runtime/rpc/methods/orchestration/runs/run-receipt.test.ts b/src/main/runtime/rpc/methods/orchestration/runs/run-receipt.test.ts
index 49afdfe119a7..93d6f7bdda9a 100644
--- a/src/main/runtime/rpc/methods/orchestration/runs/run-receipt.test.ts
+++ b/src/main/runtime/rpc/methods/orchestration/runs/run-receipt.test.ts
@@ -1,6 +1,7 @@
 import { describe, expect, it } from 'vitest'
 import { exposeRun } from './run-receipt'
 import type { RunRow } from '../../../../orchestration/types'
+import { testOrcaSessionId } from '../../../../../../shared/orca-session-address-test-fixture'
 
 // Why: typecheck cannot see the strip because the RPC return types are loose.
 const RUN_ROW: RunRow = {
@@ -9,7 +10,7 @@ const RUN_ROW: RunRow = {
   home_database: '/tmp/orca/orchestration.db',
   coordinator_handle: 'term_coord',
   coordinator_pane_key: 'tab_coord:11111111-1111-4111-8111-111111111111',
-  coordinator_orca_session_id: '22222222-2222-4222-8222-222222222222',
+  coordinator_orca_session_id: testOrcaSessionId('22222222-2222-4222-8222-222222222222'),
   coordinator_orca_session_id_generation: 3,
   consumer_generation: 3,
   legacy: 0,
diff --git a/src/main/runtime/rpc/methods/orchestration/runs/run-scope.ts b/src/main/runtime/rpc/methods/orchestration/runs/run-scope.ts
index 6b0667233151..0496c92806ee 100644
--- a/src/main/runtime/rpc/methods/orchestration/runs/run-scope.ts
+++ b/src/main/runtime/rpc/methods/orchestration/runs/run-scope.ts
@@ -6,11 +6,19 @@ import type {
   OrcaRuntimeService,
   OrchestrationCompatibilityCallerAuthority
 } from '../../../../orca-runtime'
+import {
+  hasRunBindingKey,
+  type OrchestrationCallerIdentity,
+  type OrchestrationSessionCaller
+} from '../../../../orchestration/orchestration-caller-identity'
+import { resolveDeclaredCallerParty } from '../../../../orchestration/orchestration-party'
 
 export type RunScopeParams = {
   runId?: string
   callerTerminalHandle?: string
   callerPaneKey?: string
+  /** Resolved at the dispatch entry; when set it is the caller, whatever the declared handle. */
+  callerSession: OrchestrationSessionCaller | undefined
   requireCurrentConsumer: boolean
   legacyCoordinatorRunId?: string
   // Why: the caller's declared handle is a user param; this is the attested one to check it against.
@@ -36,10 +44,30 @@ export function assertCallerHandleMatchesEvidence(
   }
 }
 
+/**
+ * The caller as Run binding and mail routing see it. A session the dispatch entry resolved is the
+ * caller outright; otherwise it is the party the declared handle names, at the pane it resolved to.
+ */
+export function orchestrationCallerIdentity(
+  runtime: OrcaRuntimeService,
+  caller: {
+    handle: string
+    paneKey: string | null | undefined
+    session: OrchestrationSessionCaller | undefined
+  }
+): OrchestrationCallerIdentity {
+  if (caller.session) {
+    return caller.session
+  }
+  const party = resolveDeclaredCallerParty(caller.handle, runtime.getOrchestrationDb())
+  return { ...party, paneKey: caller.paneKey ?? null }
+}
+
 export type OrchestrationCallerParams = {
   callerTerminalHandle: string
   callerEvidence?: OrchestrationCompatibilityEvidence
   callerAuthority?: OrchestrationCompatibilityCallerAuthority
+  callerSession: OrchestrationSessionCaller | undefined
   /** Preserve legacy callers that treated a missing pane as an ordinary fence. */
   requireStablePane?: boolean
   /**
@@ -50,33 +78,42 @@ export type OrchestrationCallerParams = {
   evidenceAssertedByCaller?: boolean
 }
 
-/** Resolve the caller's runtime pane and, by default, attest its declared handle. */
+/** Resolve the caller's identity and, by default, attest its declared handle. */
 export function resolveOrchestrationCaller(
   runtime: OrcaRuntimeService,
   params: OrchestrationCallerParams & { requireStablePane: true }
-): string
+): OrchestrationCallerIdentity
 export function resolveOrchestrationCaller(
   runtime: OrcaRuntimeService,
   params: OrchestrationCallerParams
-): string | null
+): OrchestrationCallerIdentity | null
 export function resolveOrchestrationCaller(
   runtime: OrcaRuntimeService,
   params: OrchestrationCallerParams
-): string | null {
+): OrchestrationCallerIdentity | null {
   if (!params.evidenceAssertedByCaller) {
     assertCallerHandleMatchesEvidence(runtime, params.callerTerminalHandle, params.callerEvidence)
   }
-  const paneKey =
-    params.callerAuthority?.terminalHandle === params.callerTerminalHandle
-      ? params.callerAuthority.paneKey
-      : runtime.getTerminalPaneKey(params.callerTerminalHandle)
-  if (!paneKey && params.requireStablePane) {
-    throw new OrchestrationError(
-      'stable_pane_required',
-      'The coordinator terminal has no stable pane identity. Run this command inside a live Orca terminal.'
-    )
+  const caller = orchestrationCallerIdentity(runtime, {
+    handle: params.callerTerminalHandle,
+    session: params.callerSession,
+    paneKey:
+      params.callerSession === undefined
+        ? params.callerAuthority?.terminalHandle === params.callerTerminalHandle
+          ? params.callerAuthority.paneKey
+          : runtime.getTerminalPaneKey(params.callerTerminalHandle)
+        : undefined
+  })
+  if (!hasRunBindingKey(caller)) {
+    if (params.requireStablePane) {
+      throw new OrchestrationError(
+        'stable_pane_required',
+        'The coordinator terminal has no stable pane identity. Run this command inside a live Orca terminal.'
+      )
+    }
+    return null
   }
-  return paneKey ?? null
+  return caller
 }
 
 // Why: task and gate mutations must share one Run-binding rule.
@@ -101,14 +138,21 @@ export function resolveRunScope(runtime: OrcaRuntimeService, params: RunScopePar
   if (explicit && params.legacyCoordinatorRunId === explicit.id) {
     return explicit
   }
-  const paneKey = params.callerPaneKey ?? runtime.getTerminalPaneKey(params.callerTerminalHandle)
-  if (!paneKey) {
+  const caller = orchestrationCallerIdentity(runtime, {
+    handle: params.callerTerminalHandle,
+    session: params.callerSession,
+    paneKey:
+      params.callerSession === undefined
+        ? (params.callerPaneKey ?? runtime.getTerminalPaneKey(params.callerTerminalHandle))
+        : undefined
+  })
+  if (!hasRunBindingKey(caller)) {
     throw new OrchestrationError(
       'stable_pane_required',
       'The coordinator terminal has no stable pane identity.'
     )
   }
-  const current = db.getCurrentRunForPane(paneKey)
+  const current = db.getCurrentRunForCoordinator(caller)
   if (!current) {
     if (explicit) {
       throw new OrchestrationError(
diff --git a/src/main/runtime/rpc/methods/orchestration/runs/runs.ts b/src/main/runtime/rpc/methods/orchestration/runs/runs.ts
index eab6eb2913e6..88653af8ecdb 100644
--- a/src/main/runtime/rpc/methods/orchestration/runs/runs.ts
+++ b/src/main/runtime/rpc/methods/orchestration/runs/runs.ts
@@ -2,6 +2,9 @@ import { defineMethod } from '../../../core'
 import { OrchestrationError } from '../../../../orchestration/orchestration-error'
 import { assertCallerHandleMatchesEvidence, resolveOrchestrationCaller } from './run-scope'
 import { exposeRun } from './run-receipt'
+import type { OrcaRuntimeService } from '../../../../orca-runtime'
+import type { OrchestrationCallerIdentity } from '../../../../orchestration/orchestration-caller-identity'
+import { currentDispatchAssigneeRun } from '../messaging/recipient-routing'
 import {
   RunCreateParams,
   RunCurrentParams,
@@ -10,24 +13,39 @@ import {
   RunUseParams
 } from '../../../../../../shared/rpc-contract/orchestration-runs-params'
 
+function cancelBoundDispatchWaiters(
+  runtime: OrcaRuntimeService,
+  caller: OrchestrationCallerIdentity,
+  runId: string
+): void {
+  const db = runtime.getOrchestrationDb()
+  const dispatch = db.getActiveDispatchForIdentity(caller.address, caller.paneKey ?? undefined)
+  if (dispatch && currentDispatchAssigneeRun(runtime, db, dispatch)?.id === runId) {
+    runtime.cancelMessageWaiters(`dispatch:${dispatch.id}`)
+  }
+}
+
 export const ORCHESTRATION_RUN_METHODS = [
   defineMethod({
     name: 'orchestration.runCreate',
     params: RunCreateParams,
-    handler: (params, { orchestrationCompatibilityEvidence, runtime }) => {
-      const paneKey = resolveOrchestrationCaller(runtime, {
+    handler: (params, { orchestrationCompatibilityEvidence, orchestrationCaller, runtime }) => {
+      const caller = resolveOrchestrationCaller(runtime, {
         callerTerminalHandle: params.from,
         callerEvidence: orchestrationCompatibilityEvidence,
+        callerSession: orchestrationCaller,
         requireStablePane: true
       })
       const db = runtime.getOrchestrationDb()
-      const priorRun = db.getCurrentRunForPane(paneKey)
+      const priorRun = db.getCurrentRunForCoordinator(caller)
       const run = db.createRun({
         objective: params.objective,
-        coordinatorHandle: params.from,
-        coordinatorPaneKey: paneKey
+        coordinatorHandle: caller.terminalHandle,
+        coordinatorPaneKey: caller.paneKey,
+        coordinatorOrcaSessionId: caller.orcaSessionId
       })
       runtime.cancelMessageWaiters(params.from)
+      cancelBoundDispatchWaiters(runtime, caller, run.id)
       if (priorRun) {
         runtime.cancelMessageWaiters(`run:${priorRun.id}`)
       }
@@ -43,19 +61,22 @@ export const ORCHESTRATION_RUN_METHODS = [
         runtime,
         legacyCoordinatorAuthority,
         orchestrationCompatibilityEvidence,
-        orchestrationCompatibilityCallerAuthority: callerAuthority
+        orchestrationCompatibilityCallerAuthority: callerAuthority,
+        orchestrationCaller
       }
     ) => {
-      const paneKey = resolveOrchestrationCaller(runtime, {
+      const caller = resolveOrchestrationCaller(runtime, {
         callerTerminalHandle: params.from,
         callerEvidence: orchestrationCompatibilityEvidence,
         callerAuthority,
+        callerSession: orchestrationCaller,
         requireStablePane: true,
         evidenceAssertedByCaller: true
       })
       if (
         params.takeoverLegacy &&
-        (callerAuthority?.terminalHandle !== params.from || callerAuthority.paneKey !== paneKey)
+        (callerAuthority?.terminalHandle !== params.from ||
+          callerAuthority.paneKey !== caller.paneKey)
       ) {
         throw new OrchestrationError(
           'legacy_read_only',
@@ -65,11 +86,12 @@ export const ORCHESTRATION_RUN_METHODS = [
       }
       assertCallerHandleMatchesEvidence(runtime, params.from, orchestrationCompatibilityEvidence)
       const db = runtime.getOrchestrationDb()
-      const priorRun = db.getCurrentRunForPane(paneKey)
+      const priorRun = db.getCurrentRunForCoordinator(caller)
       const run = db.bindRun({
         runId: params.id,
-        coordinatorHandle: params.from,
-        coordinatorPaneKey: paneKey,
+        coordinatorHandle: caller.terminalHandle,
+        coordinatorPaneKey: caller.paneKey,
+        coordinatorOrcaSessionId: caller.orcaSessionId,
         takeoverLegacy: params.takeoverLegacy,
         legacyCoordinatorAuthority
       })
@@ -80,6 +102,7 @@ export const ORCHESTRATION_RUN_METHODS = [
         )
       }
       runtime.cancelMessageWaiters(params.from)
+      cancelBoundDispatchWaiters(runtime, caller, run.id)
       runtime.cancelMessageWaiters(`run:${params.id}`)
       if (priorRun && priorRun.id !== params.id) {
         runtime.cancelMessageWaiters(`run:${priorRun.id}`)
@@ -90,13 +113,14 @@ export const ORCHESTRATION_RUN_METHODS = [
   defineMethod({
     name: 'orchestration.runCurrent',
     params: RunCurrentParams,
-    handler: (params, { orchestrationCompatibilityEvidence, runtime }) => {
-      const paneKey = resolveOrchestrationCaller(runtime, {
+    handler: (params, { orchestrationCompatibilityEvidence, orchestrationCaller, runtime }) => {
+      const caller = resolveOrchestrationCaller(runtime, {
         callerTerminalHandle: params.from,
         callerEvidence: orchestrationCompatibilityEvidence,
+        callerSession: orchestrationCaller,
         requireStablePane: true
       })
-      const run = runtime.getOrchestrationDb().getCurrentRunForPane(paneKey)
+      const run = runtime.getOrchestrationDb().getCurrentRunForCoordinator(caller)
       return { run: run ? exposeRun(run) : null }
     }
   }),
diff --git a/src/main/runtime/rpc/methods/orchestration/worker/deliver-worker-dispatch-preamble.ts b/src/main/runtime/rpc/methods/orchestration/worker/deliver-worker-dispatch-preamble.ts
index ecb3270874e4..bc2b9601cebc 100644
--- a/src/main/runtime/rpc/methods/orchestration/worker/deliver-worker-dispatch-preamble.ts
+++ b/src/main/runtime/rpc/methods/orchestration/worker/deliver-worker-dispatch-preamble.ts
@@ -5,6 +5,7 @@ import {
   dispatchPreambleSendOptions
 } from '../../../../orchestration/preamble'
 import { sendStructuredWorkerPreamble } from '../../orchestration-structured-worker-session'
+import type { WorkerTurnStartObservation } from './worker-start-turn-observation'
 import type { createStructuredWorkerSessionForWorktree } from './worker-topology'
 
 type StructuredSession = Awaited<ReturnType<typeof createStructuredWorkerSessionForWorktree>> | null
@@ -14,7 +15,8 @@ type StructuredSession = Awaited<ReturnType<typeof createStructuredWorkerSession
  *
  * The preamble itself is identical for both: a worker is taught the same verbs whichever mode it
  * runs in, and only the delivery differs — a PTY write returns a queued/accepted receipt, while a
- * structured turn either is acknowledged or throws.
+ * structured turn is acknowledged, still held for an agent that has not started, or throws. Held is
+ * a turn start nobody observed yet: the start is left unknown, not torn down.
  */
 export async function deliverWorkerDispatchPreamble(args: {
   runtime: OrcaRuntimeService
@@ -28,7 +30,10 @@ export async function deliverWorkerDispatchPreamble(args: {
   dispatchCapability: string
   devMode: boolean | undefined
   requestId: string
-}): Promise<RuntimeTerminalSend['prompt']> {
+}): Promise<{
+  prompt?: RuntimeTerminalSend['prompt']
+  structuredTurnStart?: WorkerTurnStartObservation
+}> {
   const { runtime, structuredSession, terminalHandle } = args
   const preamble = buildDispatchPreamble({
     // Depth only. A worker is taught the same verbs whichever mode it runs in, so this must not
@@ -45,19 +50,32 @@ export async function deliverWorkerDispatchPreamble(args: {
     cliCommand: runtime.getTerminalOrchestrationCliCommand(terminalHandle)
   })
   if (structuredSession) {
-    await sendStructuredWorkerPreamble({
+    const delivery = await sendStructuredWorkerPreamble({
       host: structuredSession.host,
       sessionId: structuredSession.identity.sessionId,
       dispatchId: args.dispatchId,
       preamble
     })
-    return undefined
+    return {
+      structuredTurnStart:
+        delivery === 'accepted'
+          ? { verdict: 'observed' }
+          : {
+              verdict: 'unobserved',
+              reason:
+                'The dispatch preamble was accepted, but the agent had not started to take it. It ' +
+                'is delivered when the agent starts; if the worker then reports, this Dispatch ' +
+                'settles normally.'
+            }
+    }
+  }
+  return {
+    prompt: (
+      await runtime.sendTerminalAgentPrompt(
+        terminalHandle,
+        preamble,
+        dispatchPreambleSendOptions(args.requestId)
+      )
+    ).prompt
   }
-  return (
-    await runtime.sendTerminalAgentPrompt(
-      terminalHandle,
-      preamble,
-      dispatchPreambleSendOptions(args.requestId)
-    )
-  ).prompt
 }
diff --git a/src/main/runtime/rpc/methods/orchestration/worker/explicit-worker-terminal-validation.ts b/src/main/runtime/rpc/methods/orchestration/worker/explicit-worker-terminal-validation.ts
index 6e20cc40a294..f9b9e195e21a 100644
--- a/src/main/runtime/rpc/methods/orchestration/worker/explicit-worker-terminal-validation.ts
+++ b/src/main/runtime/rpc/methods/orchestration/worker/explicit-worker-terminal-validation.ts
@@ -1,6 +1,7 @@
 import type { OrcaRuntimeService } from '../../../../orca-runtime'
 import { OrchestrationError } from '../../../../orchestration/orchestration-error'
 import { isStructuredWorkerHandle } from '../../../../structured-worker-identity'
+import type { OrchestrationCallerIdentity } from '../../../../orchestration/orchestration-caller-identity'
 
 /**
  * Admits a caller-supplied `--terminal` as this dispatch's worker pane.
@@ -13,18 +14,22 @@ export async function assertExplicitWorkerTerminalUsable(args: {
   runtime: OrcaRuntimeService
   terminal: string
   from: string
-  coordinatorPane: string | null
+  coordinator: OrchestrationCallerIdentity | null
   resolvedWorktreeId: string | undefined
 }): Promise<void> {
-  const { runtime, terminal, from, coordinatorPane, resolvedWorktreeId } = args
+  const { runtime, terminal, from, coordinator, resolvedWorktreeId } = args
   const explicitTerminal = await runtime.showTerminal(terminal)
   const targetPane = runtime.getTerminalPaneKey(terminal)
-  const callerPane = coordinatorPane ?? runtime.getTerminalPaneKey(from)
+  const callerPane = coordinator?.paneKey ?? runtime.getTerminalPaneKey(from)
   // A structured coordinator has no terminal to show, so its own identity is the raw handle plus
-  // the pane key; showing `from` unconditionally would throw for exactly those callers.
-  const coordinatorHandle = isStructuredWorkerHandle(from)
-    ? from
-    : (await runtime.showTerminal(from)).handle
+  // the pane key; showing `from` unconditionally would throw for exactly those callers. A
+  // handle-less session has no terminal at all, so its address is its identity.
+  const coordinatorHandle =
+    coordinator?.terminalHandle === null
+      ? coordinator.address
+      : isStructuredWorkerHandle(from)
+        ? from
+        : (await runtime.showTerminal(from)).handle
   if (
     explicitTerminal.handle === coordinatorHandle ||
     (targetPane !== null && targetPane === callerPane)
diff --git a/src/main/runtime/rpc/methods/orchestration/worker/failed-worker-start-teardown.ts b/src/main/runtime/rpc/methods/orchestration/worker/failed-worker-start-teardown.ts
index 250b639fc603..758bc3397cb7 100644
--- a/src/main/runtime/rpc/methods/orchestration/worker/failed-worker-start-teardown.ts
+++ b/src/main/runtime/rpc/methods/orchestration/worker/failed-worker-start-teardown.ts
@@ -8,10 +8,10 @@ import type { createStructuredWorkerSessionForWorktree } from './worker-topology
 /**
  * Undoes what a start created before it failed.
  *
- * A start that never reached ready leaves no settlement to release the hold later, and its session
- * was already published as a chat tab — without the discard, a failed start strands a dead chat tab
- * that the durable restore index republishes on every app launch. Both halves are best-effort by
- * construction, so neither can replace the real error.
+ * A start that never reached ready leaves no settlement to release its binding later, and its
+ * session was already published as a chat tab — without the discard, a failed start strands a dead
+ * chat tab that the durable restore index republishes on every app launch. Both halves are
+ * best-effort by construction, so neither can replace the real error.
  *
  * A created PTY terminal is deliberately NOT torn down: its custody row was written at creation, so
  * `worker-release` on the failed Dispatch owns that cleanup and the coordinator decides when.
diff --git a/src/main/runtime/rpc/methods/orchestration/worker/local-worker-start.ts b/src/main/runtime/rpc/methods/orchestration/worker/local-worker-start.ts
index f8cd1033c97c..d6b265c41a97 100644
--- a/src/main/runtime/rpc/methods/orchestration/worker/local-worker-start.ts
+++ b/src/main/runtime/rpc/methods/orchestration/worker/local-worker-start.ts
@@ -2,6 +2,10 @@ import type { OrcaRuntimeService } from '../../../../orca-runtime'
 import { describeTerminalWaitBlockedReason } from '../../../../../../shared/terminal-wait-blocked-reason-legacy-alias'
 import type { OrchestrationDb } from '../../../../orchestration/db'
 import type { RunRow, TaskRow } from '../../../../orchestration/types'
+import type {
+  OrchestrationCallerIdentity,
+  OrchestrationSessionCaller
+} from '../../../../orchestration/orchestration-caller-identity'
 import { resolveDispatchCreator } from '../runs/dispatch-creator'
 import { resolveDispatchCallerWorktreeId } from '../../orchestration-caller-workspace'
 import {
@@ -38,18 +42,25 @@ export async function startLocalWorker(args: {
   runtime: OrcaRuntimeService
   db: OrchestrationDb
   run: RunRow
-  coordinatorPane: string | null
+  coordinator: OrchestrationCallerIdentity | null
+  callerSession?: OrchestrationSessionCaller
   existingTask?: TaskRow
   orchestrationMutation?: WorkerStartMutation
   /** Settings-driven; the executing host still gets to refuse below. */
   mode: WorkerStartModeReceipt
 }): Promise<unknown> {
-  const { params, runtime, db, run, coordinatorPane, existingTask, orchestrationMutation } = args
+  const { params, runtime, db, run, coordinator, callerSession, existingTask } = args
+  const { orchestrationMutation } = args
+  const coordinatorPane = coordinator?.paneKey ?? null
   const requestedWorktree = params.worktree ?? 'current'
   const createsWorktree = requestedWorktree === 'new-child' || requestedWorktree === 'new-top-level'
   const { agent, launch } = prepareLocalWorkerStart({ params, createsWorktree, runtime })
 
-  const coordinatorWorktreeId = await resolveDispatchCallerWorktreeId(runtime, params.from)
+  const coordinatorWorktreeId = await resolveDispatchCallerWorktreeId(
+    runtime,
+    params.from,
+    callerSession
+  )
   const creationWorktree = createsWorktree
     ? await runtime.showManagedWorktree(`id:${coordinatorWorktreeId}`)
     : undefined
@@ -70,7 +81,7 @@ export async function startLocalWorker(args: {
       runtime,
       terminal: params.terminal,
       from: params.from,
-      coordinatorPane,
+      coordinator,
       resolvedWorktreeId: resolvedWorktree?.id
     })
   }
@@ -95,7 +106,7 @@ export async function startLocalWorker(args: {
       : 'existing_worktree'
   }
   const started = db.createStartingWorkerDispatch({
-    creator: resolveDispatchCreator(runtime, params.from),
+    creator: resolveDispatchCreator(runtime, params.from, callerSession),
     maxDepth: runtime.getNestedWorkerMaxDepth(),
     taskId: existingTask?.id,
     taskSpec: params.spec,
@@ -103,10 +114,12 @@ export async function startLocalWorker(args: {
     taskDeps: parseTaskDeps(params.deps),
     taskParentId: params.parent,
     taskRunId: run.id,
-    taskCreatedByTerminalHandle: params.from,
+    // A handle-less session creates root Tasks: Task lineage is recorded by terminal only.
+    taskCreatedByTerminalHandle: coordinator?.terminalHandle ?? undefined,
     taskCreatedByPaneKey: coordinatorPane ?? undefined,
-    taskCreatedByProcessIncarnation:
-      runtime.getTerminalProcessIncarnation(params.from) ?? undefined,
+    taskCreatedByProcessIncarnation: coordinator?.terminalHandle
+      ? (runtime.getTerminalProcessIncarnation(coordinator.terminalHandle) ?? undefined)
+      : undefined,
     taskCreatedByRunGeneration: run.consumer_generation,
     retryOf: params.retryOf,
     startOptions,
@@ -175,10 +188,17 @@ export async function startLocalWorker(args: {
           effects,
           timeoutMs: params.timeoutMs ?? 60_000
         })
-      : await runtime.waitForTerminal(terminalHandle, {
-          condition: 'tui-idle',
-          timeoutMs: params.timeoutMs ?? 60_000
-        })
+      : // ZCode emits SessionStart only after input; its first dispatch must wait for the composer.
+        agent === 'zcode' && !params.terminal
+        ? await runtime.waitForFreshWorkerComposer(
+            terminalHandle,
+            agent,
+            params.timeoutMs ?? 60_000
+          )
+        : await runtime.waitForTerminal(terminalHandle, {
+            condition: 'tui-idle',
+            timeoutMs: params.timeoutMs ?? 60_000
+          })
     if (wait) {
       persistWorkerSetupWaitOutcome({ ...setupStage, wait })
       if (!wait.satisfied) {
diff --git a/src/main/runtime/rpc/methods/orchestration/worker/structured-worker-release-stop.ts b/src/main/runtime/rpc/methods/orchestration/worker/structured-worker-release-stop.ts
index 4a32147d1a68..91e524e4bf17 100644
--- a/src/main/runtime/rpc/methods/orchestration/worker/structured-worker-release-stop.ts
+++ b/src/main/runtime/rpc/methods/orchestration/worker/structured-worker-release-stop.ts
@@ -4,15 +4,15 @@ import type { WorkerTerminalResourceRow } from '../../../../orchestration/worker
 import { stopStructuredWorker } from '../../orchestration-structured-worker-lifecycle'
 import type { StructuredWorkerIdentity } from '../../../../structured-worker-identity'
 import { archiveSummary } from './worker-terminal-resource-presentation'
-import type { WorkerReleaseReceipt } from './worker-release-completion'
+import { releaseUnknownRecovery, type WorkerReleaseReceipt } from './worker-release-completion'
 
 /**
  * The close half of a release for a worker that IS a structured session.
  *
  * Separate from the PTY close for the same reason the delivery lane is: there is no terminal to
  * close and no exit to observe, so the host's own settlement is the only proof available. Only a
- * proven close may settle; an unproven one reports `release_unknown` and stays retryable under the
- * same request id.
+ * proven close may settle; an unproven one reports `release_unknown` and stays retryable, but only
+ * under a fresh request id — replaying the prior one just returns this same receipt.
  */
 export async function stopStructuredWorkerForRelease(args: {
   structured: StructuredWorkerIdentity
@@ -36,7 +36,7 @@ export async function stopStructuredWorkerForRelease(args: {
       processAction: stop.closeAttempted ? 'closed_agent_terminal' : 'none',
       archive: { source: args.archiveSource, status: args.archiveStatus },
       lastError: unknown.release_error ?? stop.reason,
-      recovery: `Inspect with: orca orchestration worker-show --dispatch ${dispatchId} --json — then repeat worker-release with the same --retry-request.`
+      recovery: releaseUnknownRecovery(dispatchId)
     }
   }
   const settled = db.settleWorkerTerminalRelease(resource.id)
diff --git a/src/main/runtime/rpc/methods/orchestration/worker/worker-control.ts b/src/main/runtime/rpc/methods/orchestration/worker/worker-control.ts
index 5e8babf3c5e1..a9211532626a 100644
--- a/src/main/runtime/rpc/methods/orchestration/worker/worker-control.ts
+++ b/src/main/runtime/rpc/methods/orchestration/worker/worker-control.ts
@@ -143,7 +143,10 @@ export const ORCHESTRATION_WORKER_CONTROL_METHODS = [
           `Worker Dispatch ${params.dispatch} no longer resolves to its exact process.`
         )
       }
-      const structured = readStructuredWorkerOutput({
+      // Read via the handle inspectWorkerTerminal proved live: the durable one, or a handle
+      // re-minted from the recorded incarnation after the durable handle went stale.
+      const liveHandle = observation.terminalHandle ?? terminalHandle
+      const structured = await readStructuredWorkerOutput({
         db,
         dispatchId: params.dispatch,
         workerState: worker?.state ?? 'unsupervised',
@@ -163,7 +166,7 @@ export const ORCHESTRATION_WORKER_CONTROL_METHODS = [
       const output = await readExactWorkerOutput({
         runtime,
         dispatchId: params.dispatch,
-        terminalHandle,
+        terminalHandle: liveHandle,
         workerState: worker?.state ?? 'unsupervised',
         terminalStatus:
           observation.status === 'exited'
@@ -200,9 +203,8 @@ export const ORCHESTRATION_WORKER_CONTROL_METHODS = [
       const abandoned = runtime.getOrchestrationDb().abandonWorkerDispatch(params.dispatch)
       if (abandoned.disposition === 'context_only') {
         if (!abandoned.alreadySettled) {
-          // Abandon settles the Dispatch, so it owes the same hold release stop and release do.
-          // A surviving hold pins the provider child for the life of the app and makes host crash
-          // recovery respawn a worker nobody is waiting on.
+          // Abandon settles the Dispatch, so it owes the same binding release stop and release do:
+          // a surviving redrive subscription keeps nudging a worker nobody is waiting on.
           releaseStructuredWorkerSession(params.dispatch, runtime)
           runtime.notifyMessageArrived(`dispatch:${params.dispatch}`, 'status')
         }
diff --git a/src/main/runtime/rpc/methods/orchestration/worker/worker-observation.ts b/src/main/runtime/rpc/methods/orchestration/worker/worker-observation.ts
index 83b3d020f4ca..f1202c6e7cfe 100644
--- a/src/main/runtime/rpc/methods/orchestration/worker/worker-observation.ts
+++ b/src/main/runtime/rpc/methods/orchestration/worker/worker-observation.ts
@@ -9,12 +9,14 @@ import {
   observeStructuredWorker,
   resolveStructuredWorkerForDispatch
 } from '../../orchestration-structured-worker-lifecycle'
+import { structuredWorkerAddressable } from '../../../../structured-worker-custody'
 import type {
   DispatchContextRow,
   FederatedDispatchRow,
   WorkerDispatchRow
 } from '../../../../orchestration/types'
 
+/** Observe a worker terminal, re-minting a live handle from the recorded process incarnation when the durable handle went stale, so a still-running worker is never reported missing and leaked. */
 export async function inspectWorkerTerminal(
   runtime: OrcaRuntimeService,
   db: OrchestrationDb,
@@ -27,12 +29,18 @@ export async function inspectWorkerTerminal(
   reason?: string
   /** Set only on a proven-exact worker parked on a prompt that needs a human. */
   agentWait?: RuntimeTerminalInteractiveWait | null
+  /** Structured workers only: whether mail still reaches it — at rest included, since the mail
+   *  starts it. Absent when ownership cannot be read. `status` stays the process verdict. */
+  addressable?: boolean
+  /** The handle that actually resolved: the durable one, or a live handle re-minted from the
+   *  recorded process incarnation after the durable handle went stale. Null when none resolved. */
+  terminalHandle: string | null
 }> {
   const worker = db.getWorkerDispatch(dispatchId)
   const terminalHandle =
     worker?.agent_terminal_handle ?? db.getDispatchContextById(dispatchId)?.assignee_handle
   if (!terminalHandle) {
-    return { terminal: null, exact: false, status: 'unattached' }
+    return { terminal: null, exact: false, status: 'unattached', terminalHandle: null }
   }
   const structured = resolveStructuredWorkerForDispatch(db, dispatchId)
   if (structured) {
@@ -49,24 +57,54 @@ export async function inspectWorkerTerminal(
       processIncarnation: structured.processIncarnation
     })
     const observation = observeStructuredWorker(structured)
+    const addressable = structuredWorkerAddressable(
+      db,
+      structured.sessionId,
+      db.getWorkerTerminalResourceByHandle?.(structured.handle)
+    )
     return {
       terminal: null,
       exact,
       status: exact ? observation.status : 'identity_changed',
-      ...(exact && observation.reason ? { reason: observation.reason } : {})
+      ...(exact && observation.reason ? { reason: observation.reason } : {}),
+      ...(exact && addressable !== null ? { addressable } : {}),
+      terminalHandle: null
+    }
+  }
+  let effectiveHandle = terminalHandle
+  let terminal = await runtime.showTerminal(effectiveHandle).catch(() => null)
+  if (!terminal) {
+    // Why: the durable handle resolves nowhere after a renderer graph epoch bump or handle
+    // invalidation, yet the recorded process incarnation may still name a live PTY. Re-mint a
+    // live handle (incarnation-fenced) so worker-show and release act on the still-running
+    // process instead of reporting it missing — which would leak the agent process tree.
+    // (workerList is a pure DB projection and never calls inspectWorkerTerminal.)
+    const resource = db.getWorkerTerminalResourceByOwner(dispatchId)
+    const reminted = resource?.process_incarnation
+      ? runtime.resolveTerminalHandleByProcessIncarnation(
+          resource.process_incarnation,
+          resource.host_scope
+        )
+      : null
+    if (reminted) {
+      const remintedTerminal = await runtime.showTerminal(reminted).catch(() => null)
+      if (remintedTerminal) {
+        effectiveHandle = reminted
+        terminal = remintedTerminal
+      }
     }
   }
-  const terminal = await runtime.showTerminal(terminalHandle).catch(() => null)
   if (!terminal) {
-    return { terminal: null, exact: false, status: 'missing' }
+    // The re-mint above failed, so no live handle resolved; report the durable handle unresolved.
+    return { terminal: null, exact: false, status: 'missing', terminalHandle: null }
   }
   const exact = db.isDispatchProcessCurrent({
     dispatchId,
-    paneKey: runtime.getTerminalPaneKey(terminalHandle),
-    processIncarnation: runtime.getTerminalProcessIncarnation(terminalHandle)
+    paneKey: runtime.getTerminalPaneKey(effectiveHandle),
+    processIncarnation: runtime.getTerminalProcessIncarnation(effectiveHandle)
   })
   if (!exact) {
-    return { terminal, exact, status: 'identity_changed' }
+    return { terminal, exact, status: 'identity_changed', terminalHandle: effectiveHandle }
   }
   // Why: the aggregate inventory only iterates registered providers, so a dropped
   // relay clears `connected` for every remote PTY at once. Lost contact is not a
@@ -76,38 +114,48 @@ export async function inspectWorkerTerminal(
   // Exact-gated by the early return above: a replaced process's prompt would attribute another
   // lane's blocker to this worker.
   const agentWait = terminal.agentWait
-  const verdict = runtime.getTerminalLivenessVerdict?.(terminalHandle) ?? null
+  const verdict = runtime.getTerminalLivenessVerdict?.(effectiveHandle) ?? null
   if (verdict?.status === 'unverifiable') {
-    return { terminal, exact, status: 'unverifiable', reason: verdict.reason, agentWait }
+    return {
+      terminal,
+      exact,
+      status: 'unverifiable',
+      reason: verdict.reason,
+      agentWait,
+      terminalHandle: effectiveHandle
+    }
   }
   if (verdict?.status === 'live') {
-    return { terminal, exact, status: 'live', agentWait }
+    return { terminal, exact, status: 'live', agentWait, terminalHandle: effectiveHandle }
   }
   if (!verdict) {
     const dispatch = db.getDispatchContextById?.(dispatchId)
     const persistedHostScope = parseWorkerTerminalHostScope(dispatch?.host_scope ?? null)
-    const currentHostScope = runtime.getOrchestrationDispatchAuthority?.(terminalHandle)?.hostScope
+    const currentHostScope = runtime.getOrchestrationDispatchAuthority?.(effectiveHandle)?.hostScope
     if (persistedHostScope?.kind === 'ssh' || currentHostScope?.kind === 'ssh') {
       return {
         terminal,
         exact,
         status: 'unverifiable',
         reason: 'missing_liveness_verdict',
-        agentWait
+        agentWait,
+        terminalHandle: effectiveHandle
       }
     }
     return {
       terminal,
       exact,
       status: terminal.connected === false ? 'exited' : 'live',
-      agentWait
+      agentWait,
+      terminalHandle: effectiveHandle
     }
   }
   return {
     terminal,
     exact,
     status: 'exited',
-    agentWait
+    agentWait,
+    terminalHandle: effectiveHandle
   }
 }
 
@@ -119,7 +167,8 @@ export function exposeObservation(observation: Awaited<ReturnType<typeof inspect
     status: observation.status,
     exactWorker: observation.exact,
     ...(observation.reason ? { reason: observation.reason } : {}),
-    ...(observation.agentWait !== undefined ? { agentWait: observation.agentWait } : {})
+    ...(observation.agentWait !== undefined ? { agentWait: observation.agentWait } : {}),
+    ...(observation.addressable !== undefined ? { addressable: observation.addressable } : {})
   }
 }
 
diff --git a/src/main/runtime/rpc/methods/orchestration/worker/worker-release-completion.ts b/src/main/runtime/rpc/methods/orchestration/worker/worker-release-completion.ts
index b686cdfe6cd4..4aca4d0420a0 100644
--- a/src/main/runtime/rpc/methods/orchestration/worker/worker-release-completion.ts
+++ b/src/main/runtime/rpc/methods/orchestration/worker/worker-release-completion.ts
@@ -98,9 +98,8 @@ async function completeWorkerTerminalReleaseOnce(
     // here is what lets the release see the session instead of reporting it unreadable.
     //
     // NOT yet handled, and deliberately follow-up: rebinding a restarted runtime to a structured
-    // worker's hold and redrive subscription. Until that exists, a worker that survives a restart
-    // keeps no hold, so its child is evictable and its parked mail waits for the next arrival
-    // rather than a settle edge.
+    // worker's redrive subscription. Until that exists, a worker that survives a restart has its
+    // parked mail wait for the next arrival rather than a settle edge.
     await runtime.ensureStructuredAgentSessionHost().catch((error: unknown) => {
       console.warn(
         '[orchestration] structured host install failed before release',
@@ -121,6 +120,9 @@ async function completeWorkerTerminalReleaseOnce(
     }
   }
   const observation = await inspectWorkerTerminal(runtime, db, dispatchId)
+  // The live handle to act on: the durable one, or a handle re-minted from the recorded process
+  // incarnation when the durable handle went stale (inspectWorkerTerminal proved it live).
+  const terminalHandle = observation.terminalHandle ?? resource.terminal_handle
   if (observation.status === 'identity_changed') {
     const retained = db.revertWorkerTerminalReleaseToRetained(resource.id, 'identity_unproven')
     return {
@@ -132,33 +134,39 @@ async function completeWorkerTerminalReleaseOnce(
     }
   }
   if (observation.status === 'missing' || observation.status === 'unattached') {
-    if (args.mode === 'recovery') {
-      // A close can succeed before the process crashes, leaving `releasing` durable state while
-      // terminal inventory no longer resolves the handle. Only a positive host liveness verdict
-      // may settle that exact incarnation; contact loss remains pending/unverifiable.
-      if (resource.process_incarnation) {
-        const processLiveness = await runtime.inspectTerminalProcessIncarnationLiveness(
-          resource.process_incarnation,
-          resource.host_scope
-        )
-        if (processLiveness === 'exited') {
-          const reconciled = db.settleDeadWorkerTerminalRelease({
-            requestingDispatchId: dispatchId,
-            resourceId: resource.id,
-            processIncarnation: resource.process_incarnation
-          })
-          if (reconciled.disposition === 'released') {
-            runtime.notifyMessageArrived(`dispatch:${dispatchId}`, 'status')
-            return {
-              dispatchId,
-              state: 'released',
-              processAction: 'closed_exited_terminal',
-              archive: archiveSummary(reconciled.resource)
-            }
+    // Re-resolution by process incarnation (inspectWorkerTerminal) already failed, so no live PTY
+    // carries this worker's exact incarnation. If that incarnation is provably gone, settle
+    // released BEFORE the recovery defer: proof of death outranks deferral, so a provably-exited
+    // worker never languishes in release_pending across recovery passes.
+    if (resource.process_incarnation) {
+      const processLiveness = await runtime.inspectTerminalProcessIncarnationLiveness(
+        resource.process_incarnation,
+        resource.host_scope
+      )
+      if (processLiveness === 'exited') {
+        // Prefer incarnation-fenced settle (dispatch relation + process_incarnation CAS).
+        const reconciled = db.settleDeadWorkerTerminalRelease({
+          requestingDispatchId: dispatchId,
+          resourceId: resource.id,
+          processIncarnation: resource.process_incarnation
+        })
+        if (reconciled.disposition === 'released') {
+          runtime.notifyMessageArrived(`dispatch:${dispatchId}`, 'status')
+          return {
+            dispatchId,
+            state: 'released',
+            processAction: 'none',
+            archive: archiveSummary(reconciled.resource)
           }
         }
+        // settleDead retains when the archive is still mandatory and missing (e.g. requested but
+        // never committed). Do NOT plain-settle: that would discard output and break recovery's
+        // "archive is mandatory" invariant. Fall through to recovery pending / unknown instead.
       }
-      // Inventory may still be incomplete during startup/reconnect discovery; defer.
+    }
+    if (args.mode === 'recovery') {
+      // No death certificate yet: inventory may still be incomplete during startup/reconnect
+      // discovery, so defer instead of guessing.
       return {
         dispatchId,
         state: 'release_pending',
@@ -184,7 +192,7 @@ async function completeWorkerTerminalReleaseOnce(
     }
   }
 
-  if (!workerTerminalLeaseIsCurrent(runtime, db, dispatchId, resource)) {
+  if (!workerTerminalLeaseIsCurrent(runtime, db, dispatchId, resource, terminalHandle)) {
     const retained = db.revertWorkerTerminalReleaseToRetained(resource.id, 'identity_unproven')
     return {
       dispatchId,
@@ -203,7 +211,7 @@ async function completeWorkerTerminalReleaseOnce(
     const captured = await captureWorkerOutputArchive({
       runtime,
       dispatchId,
-      terminalHandle: resource.terminal_handle,
+      terminalHandle,
       attachedAtMs: orchestrationTimestampToMs(worker.created_at),
       structuredWorker: structured
     })
@@ -231,7 +239,7 @@ async function completeWorkerTerminalReleaseOnce(
       archive: archiveSummary(releasing)
     }
   }
-  if (!workerTerminalLeaseIsCurrent(runtime, db, dispatchId, releasing)) {
+  if (!workerTerminalLeaseIsCurrent(runtime, db, dispatchId, releasing, terminalHandle)) {
     const retained = db.revertWorkerTerminalReleaseToRetained(resource.id, 'identity_unproven')
     return {
       dispatchId,
@@ -254,7 +262,7 @@ async function completeWorkerTerminalReleaseOnce(
         archiveStatus
       })
     }
-    const close = await runtime.closeTerminal(resource.terminal_handle)
+    const close = await runtime.closeTerminal(terminalHandle)
     if (!close.ptyKilled) {
       const reason = describeUnconfirmedAgentStop(close)
       const unknown = db.markWorkerTerminalReleaseUnknown(resource.id, reason)
diff --git a/src/main/runtime/rpc/methods/orchestration/worker/worker-release-mobile-report.test.ts b/src/main/runtime/rpc/methods/orchestration/worker/worker-release-mobile-report.test.ts
index dd4ce2522ea2..d9798a47372a 100644
--- a/src/main/runtime/rpc/methods/orchestration/worker/worker-release-mobile-report.test.ts
+++ b/src/main/runtime/rpc/methods/orchestration/worker/worker-release-mobile-report.test.ts
@@ -100,7 +100,7 @@ it.each(['unary', 'stream'])('mobile %s bytes do no orchestration database work'
       method.handler(method.params!.parse(params) as never, { runtime } as never)
     ).resolves.toMatchObject({ send: { accepted: true } })
   }
-  expect(write).toHaveBeenCalledWith('pty-worker', 'x')
+  expect(write).toHaveBeenCalledWith('pty-worker', 'x', 'driving')
   expect(commit).toHaveBeenCalledTimes(1)
   expect(dbAccess).not.toHaveBeenCalled()
   expect(takeover).not.toHaveBeenCalled()
diff --git a/src/main/runtime/rpc/methods/orchestration/worker/worker-release-runtime-incarnation.test.ts b/src/main/runtime/rpc/methods/orchestration/worker/worker-release-runtime-incarnation.test.ts
new file mode 100644
index 000000000000..4caac62f5da0
--- /dev/null
+++ b/src/main/runtime/rpc/methods/orchestration/worker/worker-release-runtime-incarnation.test.ts
@@ -0,0 +1,79 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { inspectWorkerTerminal } from './worker-observation'
+import { createOrchestrationWorkerReleaseHarness } from './worker-release.test-support'
+import { makePaneKey } from '../../../../../../shared/stable-pane-id'
+
+const PTY_ID = 'runtime_test:term_worker'
+const LEAF_ID = 'bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb'
+
+describe('worker release through runtime incarnation recovery', () => {
+  const harness = createOrchestrationWorkerReleaseHarness()
+  afterEach(() => harness.cleanup())
+
+  it.each(['release', 'stop', 'read', 'replacement', 'disconnected'] as const)(
+    '%s uses runtime identity and close paths',
+    async (scenario) => {
+      harness.setup()
+      const { dispatchId } =
+        scenario === 'stop' ? await harness.startWorker() : await harness.startSettledWorker()
+      const runtime = harness.runtime
+      vi.mocked(runtime.showTerminal).mockRestore()
+      vi.mocked(runtime.getTerminalPaneKey).mockRestore()
+      vi.mocked(runtime.getTerminalProcessIncarnation).mockRestore()
+      vi.mocked(runtime.getOrchestrationDispatchAuthority).mockRestore()
+      vi.mocked(runtime.readTerminal).mockRestore()
+      vi.mocked(runtime.closeTerminal).mockRestore()
+      const kill = vi.fn(() => true)
+      runtime.setPtyController({ write: () => true, kill, getForegroundProcess: async () => null })
+      runtime.registerPty(PTY_ID, 'repo::worktree', null, {
+        tabId: 'tab_worker',
+        leafId: LEAF_ID,
+        incarnationId: scenario === 'replacement' ? '2' : '1'
+      })
+      await expect(runtime.showTerminal('term_worker')).rejects.toThrow()
+      if (scenario === 'disconnected') {
+        vi.spyOn(runtime, 'getTerminalLivenessVerdict').mockReturnValue({
+          status: 'unverifiable',
+          reason: 'transport unavailable'
+        })
+        const observed = await inspectWorkerTerminal(runtime, harness.db, dispatchId)
+        expect(observed).toMatchObject({ exact: true, status: 'unverifiable' })
+        expect(kill).not.toHaveBeenCalled()
+        return
+      }
+      if (scenario === 'stop') {
+        const receipt = await harness.call('orchestration.workerStop', { dispatch: dispatchId })
+        expect(receipt).toMatchObject({ state: 'stopped', processAction: 'closed_agent_terminal' })
+        expect(kill).toHaveBeenCalledExactlyOnceWith(PTY_ID)
+        return
+      }
+      if (scenario === 'read') {
+        const readTerminal = vi.spyOn(runtime, 'readTerminal')
+        const output = await harness.call('orchestration.workerRead', { dispatch: dispatchId })
+        // Pins the read to the reminted terminal: the handle it reached must resolve to the
+        // registered pane and incarnation, which the stale durable handle never does.
+        const [[readHandle]] = readTerminal.mock.calls
+        expect(runtime.getTerminalPaneKey(readHandle)).toBe(makePaneKey('tab_worker', LEAF_ID))
+        expect(runtime.getTerminalProcessIncarnation(readHandle)).toBe(`${PTY_ID}:1`)
+        expect(output).toMatchObject({
+          source: 'terminal',
+          fallbackReason: 'session_not_reported'
+        })
+        expect(kill).not.toHaveBeenCalled()
+        return
+      }
+      const receipt = await harness.call('orchestration.workerRelease', { dispatch: dispatchId })
+      if (scenario === 'replacement') {
+        expect(receipt).toMatchObject({ state: 'release_unknown', processAction: 'none' })
+        expect(kill).not.toHaveBeenCalled()
+        return
+      }
+      expect(receipt).toMatchObject({ state: 'released', processAction: 'closed_agent_terminal' })
+      expect(kill).toHaveBeenCalledExactlyOnceWith(PTY_ID)
+      expect(harness.db.getWorkerTerminalResourceByOwner(dispatchId)).toMatchObject({
+        ownership_state: 'released',
+        release_state: 'released'
+      })
+    }
+  )
+})
diff --git a/src/main/runtime/rpc/methods/orchestration/worker/worker-start-prompt-contract.test.ts b/src/main/runtime/rpc/methods/orchestration/worker/worker-start-prompt-contract.test.ts
index 593d097580fd..526b09a6320c 100644
--- a/src/main/runtime/rpc/methods/orchestration/worker/worker-start-prompt-contract.test.ts
+++ b/src/main/runtime/rpc/methods/orchestration/worker/worker-start-prompt-contract.test.ts
@@ -381,6 +381,7 @@ describe('orchestration worker-start prompt contract', () => {
     const { runtime, handle } = await createAgentPromptSubmissionRuntime(() => undefined, 'codex')
     runtime.onPtyData('pty-prompt', '\x1b]0;Codex working\x07', Date.now())
     const pending = runtime.sendTerminalAgentPrompt(handle, 'queued prompt', {
+      inputKind: 'driving',
       acceptQueued: true,
       requestId: 'busy-swallowed',
       observationTimeoutMs: 0
diff --git a/src/main/runtime/rpc/methods/orchestration/worker/worker-start-readiness-settlement.test.ts b/src/main/runtime/rpc/methods/orchestration/worker/worker-start-readiness-settlement.test.ts
new file mode 100644
index 000000000000..e39a06110dcd
--- /dev/null
+++ b/src/main/runtime/rpc/methods/orchestration/worker/worker-start-readiness-settlement.test.ts
@@ -0,0 +1,90 @@
+import { describe, expect, it, vi } from 'vitest'
+
+vi.mock('../../../../orchestration/preamble', () => ({ buildDispatchPreamble: () => 'preamble' }))
+vi.mock('./worker-topology', async (importOriginal) => ({
+  ...(await importOriginal<Record<string, unknown>>()),
+  monitorWorkerSetup: () => {}
+}))
+
+const { deliverAndSettleWorkerStartReadiness } = await import('./worker-start-readiness-settlement')
+
+function settle(delivered: 'accepted' | undefined) {
+  const db = {
+    getWorkerDispatch: () => ({ state: 'starting' }),
+    markWorkerStartUnknown: vi.fn(() => ({
+      stage: 'turn_start_unobserved',
+      residual_resources: '[]'
+    })),
+    markWorkerDispatchReady: vi.fn(() => ({ state: 'ready', stage: 'ready' }))
+  }
+  const host = {
+    deps: { store: { getRecord: () => ({ lease: { runtimeFence: 1 } }) } },
+    send: async () => ({
+      ok: true,
+      value: { clientMessageId: 'c1', submission: { dispatchState: 'pending', reason: null } }
+    }),
+    // undefined: the worker's agent was still starting when the wait ran out.
+    waitForSendSettlement: async () =>
+      delivered
+        ? { value: { clientMessageId: 'c1', submission: { dispatchState: delivered } } }
+        : undefined
+  }
+  const args = {
+    runtime: {
+      getNestedWorkerMaxDepth: () => 3,
+      getTerminalOrchestrationCliCommand: () => 'orca'
+    },
+    db,
+    run: { id: 'run_1' },
+    task: { id: 't1', spec: 'do the thing' },
+    dispatchId: 'd1',
+    dispatchDepth: 0,
+    structuredSession: { host, identity: { sessionId: 's1' } },
+    terminalHandle: 'structured_worker_1',
+    coordinatorHandle: 'term_c',
+    dispatchCapability: 'capability',
+    devMode: undefined,
+    requestId: 'r1',
+    agent: 'claude',
+    setupReceipt: {},
+    launchReceipt: {},
+    mode: {},
+    timeoutMs: 60_000,
+    effects: [],
+    terminalRevealWarning: undefined,
+    onStage: () => {}
+  }
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the fakes implement exactly the runtime, db and host members this settlement reaches.
+  const receipt = deliverAndSettleWorkerStartReadiness(args as never)
+  return { db, receipt }
+}
+
+describe('a structured worker whose agent outlasts the preamble wait', () => {
+  it('parks as start-unknown instead of failing the start, and never names a screen to read', async () => {
+    const { db, receipt } = settle(undefined)
+
+    // Resolving, not throwing, is what keeps the worker's session: a throw tears it down.
+    await expect(receipt).resolves.toMatchObject({
+      state: 'outcome_unknown',
+      turnStart: 'unobserved',
+      nextCommands: [
+        'orca orchestration worker-show --dispatch d1 --json',
+        'orca orchestration worker-abandon --dispatch d1 --json'
+      ]
+    })
+    expect(db.markWorkerStartUnknown).toHaveBeenCalledWith(
+      'd1',
+      'turn_start_unobserved',
+      expect.stringContaining('delivered when the agent starts'),
+      expect.anything()
+    )
+    expect(db.markWorkerDispatchReady).not.toHaveBeenCalled()
+  })
+
+  it('is ready once the agent took the preamble within the wait', async () => {
+    const { db, receipt } = settle('accepted')
+
+    await expect(receipt).resolves.toMatchObject({ state: 'ready', turnStart: 'observed' })
+    expect(db.markWorkerStartUnknown).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/main/runtime/rpc/methods/orchestration/worker/worker-start-readiness-settlement.ts b/src/main/runtime/rpc/methods/orchestration/worker/worker-start-readiness-settlement.ts
index a3c57a357d27..7e9118daffb5 100644
--- a/src/main/runtime/rpc/methods/orchestration/worker/worker-start-readiness-settlement.ts
+++ b/src/main/runtime/rpc/methods/orchestration/worker/worker-start-readiness-settlement.ts
@@ -47,7 +47,7 @@ export async function deliverAndSettleWorkerStartReadiness(args: {
   const { runtime, db, run, task, structuredSession, terminalHandle, effects } = args
 
   args.onStage('dispatch_input')
-  const promptDelivery = await deliverWorkerDispatchPreamble({
+  const delivery = await deliverWorkerDispatchPreamble({
     runtime,
     structuredSession,
     terminalHandle,
@@ -71,11 +71,11 @@ export async function deliverAndSettleWorkerStartReadiness(args: {
   // The write above was accepted without waiting on provider hooks; now demand the positive
   // evidence the receipt claims is observable. A worker whose turn never starts must not be
   // reported ready — a wedged agent and a working one looked identical before this gate.
-  // A structured preamble send is acknowledged by the provider or throws, so it is already
-  // positive evidence.
-  const turnStart: WorkerTurnStartObservation = structuredSession
-    ? { verdict: 'observed' }
-    : await observeWorkerTurnStart({ runtime, terminalHandle, prompt: promptDelivery })
+  // A structured preamble send is its own evidence: acknowledged, or still held for its agent.
+  const promptDelivery = delivery.prompt
+  const turnStart: WorkerTurnStartObservation =
+    delivery.structuredTurnStart ??
+    (await observeWorkerTurnStart({ runtime, terminalHandle, prompt: promptDelivery }))
   const deliveredPrompt = turnStart.prompt ?? promptDelivery
   monitorWorkerSetup({
     runtime,
@@ -98,7 +98,7 @@ export async function deliverAndSettleWorkerStartReadiness(args: {
       id: terminalHandle,
       state: 'turn_unobserved'
     })
-    const reason = describeUnobservedWorkerTurnStart(args.agent)
+    const reason = turnStart.reason ?? describeUnobservedWorkerTurnStart(args.agent)
     const worker = db.markWorkerStartUnknown(
       args.dispatchId,
       'turn_start_unobserved',
@@ -122,7 +122,8 @@ export async function deliverAndSettleWorkerStartReadiness(args: {
       residualResources: JSON.parse(worker.residual_resources) as unknown[],
       nextCommands: [
         `orca orchestration worker-show --dispatch ${args.dispatchId} --json`,
-        `orca terminal read --terminal ${terminalHandle} --screen`,
+        // A structured worker has no screen to read.
+        ...(structuredSession ? [] : [`orca terminal read --terminal ${terminalHandle} --screen`]),
         `orca orchestration worker-abandon --dispatch ${args.dispatchId} --json`
       ],
       ...(args.terminalRevealWarning ? { warning: args.terminalRevealWarning } : {})
diff --git a/src/main/runtime/rpc/methods/orchestration/worker/worker-start-turn-observation.ts b/src/main/runtime/rpc/methods/orchestration/worker/worker-start-turn-observation.ts
index d1c9e59adfa5..cc648ee7ddeb 100644
--- a/src/main/runtime/rpc/methods/orchestration/worker/worker-start-turn-observation.ts
+++ b/src/main/runtime/rpc/methods/orchestration/worker/worker-start-turn-observation.ts
@@ -19,6 +19,8 @@ export type WorkerTurnStartVerdict = 'observed' | 'permission' | 'unsupported' |
 export type WorkerTurnStartObservation = {
   verdict: WorkerTurnStartVerdict
   prompt?: RuntimeTerminalPromptDelivery
+  /** Why an `unobserved` start is unknown, when the default PTY wording does not fit. */
+  reason?: string
 }
 
 function classifyPromptDelivery(prompt: RuntimeTerminalPromptDelivery): WorkerTurnStartVerdict {
diff --git a/src/main/runtime/rpc/methods/orchestration/worker/worker-stop.ts b/src/main/runtime/rpc/methods/orchestration/worker/worker-stop.ts
index 98d3c376f61f..ee0e73c904f8 100644
--- a/src/main/runtime/rpc/methods/orchestration/worker/worker-stop.ts
+++ b/src/main/runtime/rpc/methods/orchestration/worker/worker-stop.ts
@@ -141,6 +141,7 @@ export const ORCHESTRATION_WORKER_STOP_METHODS = [
           })
         }
         const observation = await inspectWorkerTerminal(runtime, db, params.dispatch)
+        const liveHandle = observation.terminalHandle ?? handle
         // The host exit can settle this stop while terminal inspection is awaiting inventory.
         if (db.getWorkerDispatch(params.dispatch)?.state === 'stopped') {
           runtime.notifyMessageArrived(`dispatch:${params.dispatch}`, 'status')
@@ -201,7 +202,7 @@ export const ORCHESTRATION_WORKER_STOP_METHODS = [
           }
         }
         const closed = await runtime
-          .closeTerminal(handle)
+          .closeTerminal(liveHandle)
           .then((close) => ({ close }) as const)
           .catch(
             (error: unknown) =>
diff --git a/src/main/runtime/rpc/methods/orchestration/worker/worker-terminal-release-lease.ts b/src/main/runtime/rpc/methods/orchestration/worker/worker-terminal-release-lease.ts
index 50a97c9de4be..cad0ceb41280 100644
--- a/src/main/runtime/rpc/methods/orchestration/worker/worker-terminal-release-lease.ts
+++ b/src/main/runtime/rpc/methods/orchestration/worker/worker-terminal-release-lease.ts
@@ -9,23 +9,27 @@ export function workerTerminalLeaseIsCurrent(
   runtime: OrcaRuntimeService,
   db: OrchestrationDb,
   dispatchId: string,
-  resource: WorkerTerminalResourceRow
+  resource: WorkerTerminalResourceRow,
+  // Live (possibly reminted) handle for runtime probes. Durable identity still compares
+  // worker.agent_terminal_handle to resource.terminal_handle; after beginGraphReload the durable
+  // string is absent from the handle table, so authority/pane/incarnation must use the live one.
+  liveTerminalHandle: string
 ): boolean {
   const worker = db.getWorkerDispatch(dispatchId)
   if (isStructuredWorkerHandle(resource.terminal_handle)) {
     return structuredWorkerTerminalLeaseIsCurrent(db, dispatchId, worker, resource)
   }
-  const authority = runtime.getOrchestrationDispatchAuthority(resource.terminal_handle)
+  const authority = runtime.getOrchestrationDispatchAuthority(liveTerminalHandle)
   // Exited PTYs retain identity and host evidence but no longer mint launch authority.
   return Boolean(
     worker?.agent_terminal_handle === resource.terminal_handle &&
     (authority
       ? resource.host_scope === JSON.stringify(authority.hostScope)
-      : runtime.getTerminalLivenessVerdict(resource.terminal_handle)?.status === 'exited') &&
+      : runtime.getTerminalLivenessVerdict(liveTerminalHandle)?.status === 'exited') &&
     db.isDispatchProcessCurrent({
       dispatchId,
-      paneKey: runtime.getTerminalPaneKey(resource.terminal_handle),
-      processIncarnation: runtime.getTerminalProcessIncarnation(resource.terminal_handle)
+      paneKey: runtime.getTerminalPaneKey(liveTerminalHandle),
+      processIncarnation: runtime.getTerminalProcessIncarnation(liveTerminalHandle)
     }) &&
     !db.workerTerminalResourceHasIdentityConflict(resource.id)
   )
diff --git a/src/main/runtime/rpc/methods/orchestration/worker/workers.ts b/src/main/runtime/rpc/methods/orchestration/worker/workers.ts
index b1a1f40d45ae..be4e40ab2b64 100644
--- a/src/main/runtime/rpc/methods/orchestration/worker/workers.ts
+++ b/src/main/runtime/rpc/methods/orchestration/worker/workers.ts
@@ -20,7 +20,7 @@ export const ORCHESTRATION_WORKER_START_METHODS = [
     params: WorkerStartParams,
     handler: async (
       params,
-      { runtime, orchestrationMutation, orchestrationCompatibilityEvidence }
+      { runtime, orchestrationMutation, orchestrationCompatibilityEvidence, orchestrationCaller }
     ) => {
       if (!isWorkerStartTimeoutWithinTimerLimit(params.timeoutMs)) {
         throw new OrchestrationError(
@@ -30,11 +30,12 @@ export const ORCHESTRATION_WORKER_START_METHODS = [
       }
       const readinessTimeoutMs = resolveWorkerStartReadinessTimeoutMs(params.timeoutMs)
       const db = runtime.getOrchestrationDb()
-      const coordinatorPane = resolveOrchestrationCaller(runtime, {
+      const coordinator = resolveOrchestrationCaller(runtime, {
         callerTerminalHandle: params.from,
-        callerEvidence: orchestrationCompatibilityEvidence
+        callerEvidence: orchestrationCompatibilityEvidence,
+        callerSession: orchestrationCaller
       })
-      const run = coordinatorPane ? db.getCurrentRunForPane(coordinatorPane) : undefined
+      const run = coordinator ? db.getCurrentRunForCoordinator(coordinator) : undefined
       if (!run || (params.run && params.run !== run.id)) {
         throw new OrchestrationError(
           'consumer_fenced',
@@ -62,7 +63,8 @@ export const ORCHESTRATION_WORKER_START_METHODS = [
           db,
           runId: run.id,
           task: existingTask,
-          orchestrationMutation
+          orchestrationMutation,
+          callerSession: orchestrationCaller
         })
         return receipt && typeof receipt === 'object' ? { ...receipt, mode } : receipt
       }
@@ -71,7 +73,8 @@ export const ORCHESTRATION_WORKER_START_METHODS = [
         runtime,
         db,
         run,
-        coordinatorPane,
+        coordinator,
+        callerSession: orchestrationCaller,
         existingTask,
         orchestrationMutation,
         mode
diff --git a/src/main/runtime/rpc/methods/orchestration/worker/zcode-worker-readiness.test.ts b/src/main/runtime/rpc/methods/orchestration/worker/zcode-worker-readiness.test.ts
new file mode 100644
index 000000000000..30d32c2ede83
--- /dev/null
+++ b/src/main/runtime/rpc/methods/orchestration/worker/zcode-worker-readiness.test.ts
@@ -0,0 +1,44 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { createOrchestrationWorkerReleaseHarness } from './worker-release.test-support'
+
+describe('ZCode first dispatch readiness', () => {
+  const h = createOrchestrationWorkerReleaseHarness()
+  afterEach(() => h.cleanup())
+
+  it('waits for the new composer before delivering exactly one dispatch', async () => {
+    h.setup()
+    const gate = h.deferred<void>()
+    vi.spyOn(h.runtime, 'waitForFreshWorkerComposer').mockReturnValue(gate.promise)
+    const pending = h.startWorker({ agent: 'zcode' })
+    await vi.waitFor(() =>
+      expect(h.runtime.waitForFreshWorkerComposer).toHaveBeenCalledWith(
+        'term_worker',
+        'zcode',
+        60_000
+      )
+    )
+    expect(h.runtime.waitForTerminal).not.toHaveBeenCalled()
+    expect(h.runtime.sendTerminalAgentPrompt).not.toHaveBeenCalled()
+    gate.resolve()
+    await pending
+    expect(h.runtime.sendTerminalAgentPrompt).toHaveBeenCalledOnce()
+  })
+
+  it('keeps reused terminals on the normal idle wait', async () => {
+    h.setup()
+    vi.spyOn(h.runtime, 'waitForFreshWorkerComposer')
+    await h.startWorker({ terminal: 'term_worker' })
+    expect(h.runtime.waitForFreshWorkerComposer).not.toHaveBeenCalled()
+    expect(h.runtime.waitForTerminal).toHaveBeenCalledWith(
+      'term_worker',
+      expect.objectContaining({ condition: 'tui-idle' })
+    )
+  })
+
+  it('never delivers a task after a startup timeout', async () => {
+    h.setup()
+    vi.spyOn(h.runtime, 'waitForFreshWorkerComposer').mockRejectedValue(new Error('timeout'))
+    await expect(h.startWorker({ agent: 'zcode' })).rejects.toThrow('Expected worker-start')
+    expect(h.runtime.sendTerminalAgentPrompt).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/main/runtime/rpc/methods/session-tab-mutation-methods.ts b/src/main/runtime/rpc/methods/session-tab-mutation-methods.ts
index d62f50be5958..95369d5830f1 100644
--- a/src/main/runtime/rpc/methods/session-tab-mutation-methods.ts
+++ b/src/main/runtime/rpc/methods/session-tab-mutation-methods.ts
@@ -99,6 +99,7 @@ export const SESSION_TAB_MUTATION_METHODS = [
         tabId: params.tabId,
         root: params.root,
         expandedLeafId: params.expandedLeafId ?? null,
+        chatLeafId: params.chatLeafId,
         titlesByLeafId: params.titlesByLeafId
       })
     }
diff --git a/src/main/runtime/rpc/methods/session-tabs-inventory.ts b/src/main/runtime/rpc/methods/session-tabs-inventory.ts
index d63868844a6e..3ab06a298fc6 100644
--- a/src/main/runtime/rpc/methods/session-tabs-inventory.ts
+++ b/src/main/runtime/rpc/methods/session-tabs-inventory.ts
@@ -6,6 +6,7 @@ import { projectSessionTabAgentStatus } from './session-tab-agent-status-project
 import { projectSessionTabBrowserPlacements } from './session-tab-browser-placement-projection'
 import { createSessionTabsRetirementProofDelta } from './session-tabs-retirement-proof-delta'
 import { isStructuredNativeChatEnabled } from './structured-agent-session-policy'
+import { restoreStructuredTabsIfSupported } from './structured-session-tab-restore'
 
 type SessionTabsInventory = {
   snapshots: RuntimeMobileSessionTabsResult[]
@@ -241,6 +242,14 @@ export async function subscribeSessionTabsInventory(
   }
   let collected: Awaited<ReturnType<typeof collectSessionTabsInventory>> | undefined
   try {
+    // Why: restore after registering, so an unsubscribe or socket close while it runs still finds the stream.
+    const restoring = restoreStructuredTabsIfSupported(context)
+    if (restoring) {
+      await restoring
+      if (closed) {
+        return
+      }
+    }
     for (let attempt = 1; !collected; attempt += 1) {
       censusInvalidated = false
       const candidate = await collectSessionTabsInventory(
diff --git a/src/main/runtime/rpc/methods/session-tabs-subscribe-admission.test.ts b/src/main/runtime/rpc/methods/session-tabs-subscribe-admission.test.ts
new file mode 100644
index 000000000000..2652cdf12fd5
--- /dev/null
+++ b/src/main/runtime/rpc/methods/session-tabs-subscribe-admission.test.ts
@@ -0,0 +1,342 @@
+import { describe, expect, it, vi } from 'vitest'
+import type { OrcaRuntimeService } from '../../orca-runtime'
+import type { RuntimeMobileSessionTabsResult } from '../../../../shared/runtime-types'
+import { RuntimeSubscriptionRegistry } from '../../runtime-subscription-registry'
+import { RpcDispatcher } from '../dispatcher'
+import type { RpcRequest } from '../core'
+import { SESSION_TAB_METHODS } from './session-tabs'
+import { visibleSnapshot } from './session-tabs-snapshot.test-fixture'
+
+const CONNECTION = 'conn-1'
+const KEY = (requestId: string): string => `session.tabs:${CONNECTION}:wt-1:${requestId}`
+const ALL_KEY = (requestId: string): string => `session.tabs:${CONNECTION}:*:${requestId}`
+
+type Deferred<T> = { promise: Promise<T>; resolve: (value: T) => void; reject: (e: Error) => void }
+
+function deferred<T>(): Deferred<T> {
+  let resolve!: (value: T) => void
+  let reject!: (e: Error) => void
+  const promise = new Promise<T>((settle, fail) => {
+    resolve = settle
+    reject = fail
+  })
+  return { promise, resolve, reject }
+}
+
+function makeHost(options: { structuredChat?: boolean } = {}) {
+  const registry = new RuntimeSubscriptionRegistry()
+  const stopListening = vi.fn()
+  const tabListeners: ((snapshot: RuntimeMobileSessionTabsResult, sequence: number) => void)[] = []
+  const restore = vi.fn(() => Promise.resolve())
+  const listMobileSessionTabs = vi.fn(async (): Promise<RuntimeMobileSessionTabsResult> =>
+    visibleSnapshot()
+  )
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the session tab methods reach only these members; a missing one throws and fails the test.
+  const runtime = {
+    getRuntimeId: () => 'test-runtime',
+    getClientSettings: () => ({
+      experimentalStructuredNativeChat: options.structuredChat === true
+    }),
+    restoreStructuredAgentSessionTabs: restore,
+    listMobileSessionTabs,
+    supportsAuthoritativeSessionTabsInventory: () => false,
+    listAllMobileSessionTabsWithChangeSequence: async () => ({
+      snapshots: [visibleSnapshot()],
+      changeSequence: 0
+    }),
+    onMobileSessionTabsChanged: vi.fn(
+      (listener: (snapshot: RuntimeMobileSessionTabsResult, sequence: number) => void) => {
+        tabListeners.push(listener)
+        return stopListening
+      }
+    ),
+    registerSubscriptionCleanup: registry.register.bind(registry),
+    cleanupSubscription: registry.cleanup.bind(registry),
+    cleanupSubscriptionsByPrefix: registry.cleanupByPrefix.bind(registry),
+    cleanupSubscriptionsForConnection: registry.cleanupForConnection.bind(registry),
+    getSubscriptionRegistrationVersion: registry.getRegistrationVersion.bind(registry)
+  } as unknown as OrcaRuntimeService
+  const dispatcher = new RpcDispatcher({ runtime, methods: SESSION_TAB_METHODS })
+  return {
+    runtime,
+    registry,
+    restore,
+    listMobileSessionTabs,
+    stopListening,
+    tabListeners,
+    // A foreign connection never owns the entry, so this probe reads presence without releasing it.
+    isRegistered: (id: string): boolean => !registry.cleanupIfOwnedByConnection(id, 'probe'),
+    dispatch: (
+      request: RpcRequest,
+      messages: Frame[] = [],
+      extra: { signal?: AbortSignal } = {}
+    ): Promise<void> =>
+      dispatcher.dispatchStreaming(request, (message) => messages.push(JSON.parse(message)), {
+        connectionId: CONNECTION,
+        clientKind: 'mobile',
+        ...extra
+      })
+  }
+}
+
+function request(id: string, method: string, params?: unknown): RpcRequest {
+  return { id, authToken: 'tok', method, params }
+}
+
+type Frame = { ok: boolean; result?: { type?: string } }
+
+function frames(messages: Frame[]): (string | undefined)[] {
+  return messages.map((reply) => (reply.ok ? reply.result?.type : 'error'))
+}
+
+async function settle(): Promise<void> {
+  for (let index = 0; index < 10; index += 1) {
+    await Promise.resolve()
+  }
+}
+
+describe('session.tabs.subscribe registers when the request arrives', () => {
+  it.each([
+    { stage: 'restore', unsubscribe: { worktree: 'id:wt-1', subscriptionId: 'sub-1' } },
+    { stage: 'list', unsubscribe: { worktree: 'id:wt-1', subscriptionId: 'sub-1' } },
+    { stage: 'list', unsubscribe: { worktree: 'id:wt-1' } }
+  ])(
+    'an unsubscribe ($unsubscribe) during the $stage await ends the stream and leaves nothing',
+    async ({ stage, unsubscribe }) => {
+      const host = makeHost({ structuredChat: true })
+      const gate = deferred<void>()
+      const listing = deferred<RuntimeMobileSessionTabsResult>()
+      if (stage === 'restore') {
+        host.restore.mockReturnValueOnce(gate.promise)
+      } else {
+        host.listMobileSessionTabs.mockReturnValueOnce(listing.promise)
+      }
+      const messages: Frame[] = []
+      const pending = host.dispatch(
+        request('sub-1', 'session.tabs.subscribe', { worktree: 'id:wt-1' }),
+        messages
+      )
+
+      await host.dispatch(request('unsub-1', 'session.tabs.unsubscribe', unsubscribe))
+      gate.resolve()
+      listing.resolve(visibleSnapshot())
+      await pending
+      await settle()
+
+      expect(host.isRegistered(KEY('sub-1'))).toBe(false)
+      expect(host.runtime.onMobileSessionTabsChanged).not.toHaveBeenCalled()
+      expect(frames(messages)).toEqual(['end'])
+    }
+  )
+
+  it('a socket close during setup leaves no registration and no listener', async () => {
+    const host = makeHost()
+    const listing = deferred<RuntimeMobileSessionTabsResult>()
+    host.listMobileSessionTabs.mockReturnValueOnce(listing.promise)
+    const messages: Frame[] = []
+    const pending = host.dispatch(
+      request('sub-1', 'session.tabs.subscribe', { worktree: 'id:wt-1' }),
+      messages
+    )
+
+    host.runtime.cleanupSubscriptionsForConnection(CONNECTION)
+    listing.resolve(visibleSnapshot())
+    await pending
+    await settle()
+
+    expect(host.isRegistered(KEY('sub-1'))).toBe(false)
+    expect(host.runtime.onMobileSessionTabsChanged).not.toHaveBeenCalled()
+    expect(frames(messages)).toEqual(['end'])
+  })
+
+  it('a request abort during setup ends the stream and leaves nothing', async () => {
+    const host = makeHost()
+    const listing = deferred<RuntimeMobileSessionTabsResult>()
+    host.listMobileSessionTabs.mockReturnValueOnce(listing.promise)
+    const controller = new AbortController()
+    const messages: Frame[] = []
+    const pending = host.dispatch(
+      request('sub-1', 'session.tabs.subscribe', { worktree: 'id:wt-1' }),
+      messages,
+      { signal: controller.signal }
+    )
+
+    controller.abort()
+    listing.resolve(visibleSnapshot())
+    await pending
+    await settle()
+
+    expect(host.isRegistered(KEY('sub-1'))).toBe(false)
+    expect(host.runtime.onMobileSessionTabsChanged).not.toHaveBeenCalled()
+    expect(frames(messages)).toEqual(['end'])
+  })
+
+  it('a request whose socket already closed attaches nothing', async () => {
+    const host = makeHost()
+    const controller = new AbortController()
+    controller.abort()
+
+    await host.dispatch(request('sub-1', 'session.tabs.subscribe', { worktree: 'id:wt-1' }), [], {
+      signal: controller.signal
+    })
+    await settle()
+
+    expect(host.isRegistered(KEY('sub-1'))).toBe(false)
+    expect(host.runtime.onMobileSessionTabsChanged).not.toHaveBeenCalled()
+  })
+
+  it('a stream released during setup reports no error when the await then rejects', async () => {
+    const host = makeHost()
+    const listing = deferred<RuntimeMobileSessionTabsResult>()
+    host.listMobileSessionTabs.mockReturnValueOnce(listing.promise)
+    const messages: Frame[] = []
+    const pending = host.dispatch(
+      request('sub-1', 'session.tabs.subscribe', { worktree: 'id:wt-1' }),
+      messages
+    )
+
+    await host.dispatch(
+      request('unsub-1', 'session.tabs.unsubscribe', {
+        worktree: 'id:wt-1',
+        subscriptionId: 'sub-1'
+      })
+    )
+    listing.reject(new Error('list failed'))
+    await pending
+
+    expect(frames(messages)).toEqual(['end'])
+  })
+
+  it('a failed setup reports only the error and leaves no registration', async () => {
+    const host = makeHost()
+    host.listMobileSessionTabs.mockRejectedValueOnce(new Error('list failed'))
+    const messages: Frame[] = []
+
+    await host.dispatch(
+      request('sub-1', 'session.tabs.subscribe', { worktree: 'id:wt-1' }),
+      messages
+    )
+    await settle()
+
+    expect(host.isRegistered(KEY('sub-1'))).toBe(false)
+    expect(frames(messages)).toEqual(['error'])
+  })
+
+  it('streams snapshot and updates, then ends once on unsubscribe', async () => {
+    const host = makeHost()
+    const messages: Frame[] = []
+
+    await host.dispatch(
+      request('sub-1', 'session.tabs.subscribe', { worktree: 'id:wt-1' }),
+      messages
+    )
+    expect(host.isRegistered(KEY('sub-1'))).toBe(true)
+    host.tabListeners[0]?.({ ...visibleSnapshot(), snapshotVersion: 2 }, 1)
+    await host.dispatch(
+      request('unsub-1', 'session.tabs.unsubscribe', {
+        worktree: 'id:wt-1',
+        subscriptionId: 'sub-1'
+      })
+    )
+    host.runtime.cleanupSubscriptionsForConnection(CONNECTION)
+    await settle()
+
+    expect(frames(messages)).toEqual(['snapshot', 'updated', 'end'])
+    expect(host.stopListening).toHaveBeenCalledTimes(1)
+    expect(host.isRegistered(KEY('sub-1'))).toBe(false)
+  })
+
+  it('keys a non-id selector by the resolved worktree once it is known', async () => {
+    const host = makeHost()
+    const messages: Frame[] = []
+
+    await host.dispatch(
+      request('sub-1', 'session.tabs.subscribe', { worktree: 'path:/repo/wt-1' }),
+      messages
+    )
+
+    expect(host.isRegistered(KEY('sub-1'))).toBe(true)
+    expect(frames(messages)).toEqual(['snapshot'])
+  })
+
+  it('a worktree-wide unsubscribe spares a subscribe that arrives while it resolves', async () => {
+    const host = makeHost()
+    const first: Frame[] = []
+    const second: Frame[] = []
+    await host.dispatch(request('sub-1', 'session.tabs.subscribe', { worktree: 'id:wt-1' }), first)
+    const listing = deferred<RuntimeMobileSessionTabsResult>()
+    host.listMobileSessionTabs.mockReturnValueOnce(listing.promise)
+
+    // Old phones send no request id, so the host sweeps every stream for the worktree.
+    const unsubscribing = host.dispatch(
+      request('unsub-1', 'session.tabs.unsubscribe', { worktree: 'id:wt-1' })
+    )
+    await settle()
+    await host.dispatch(request('sub-2', 'session.tabs.subscribe', { worktree: 'id:wt-1' }), second)
+    listing.resolve(visibleSnapshot())
+    await unsubscribing
+    await settle()
+
+    expect(frames(first)).toEqual(['snapshot', 'end'])
+    expect(frames(second)).toEqual(['snapshot'])
+    expect(host.isRegistered(KEY('sub-1'))).toBe(false)
+    expect(host.isRegistered(KEY('sub-2'))).toBe(true)
+  })
+
+  it('a request-id unsubscribe ends only its own stream', async () => {
+    const host = makeHost()
+    const first: Frame[] = []
+    const second: Frame[] = []
+
+    await host.dispatch(request('sub-1', 'session.tabs.subscribe', { worktree: 'id:wt-1' }), first)
+    await host.dispatch(request('sub-2', 'session.tabs.subscribe', { worktree: 'id:wt-1' }), second)
+    await host.dispatch(
+      request('unsub-1', 'session.tabs.unsubscribe', {
+        worktree: 'id:wt-1',
+        subscriptionId: 'sub-1'
+      })
+    )
+    await settle()
+
+    expect(frames(first)).toEqual(['snapshot', 'end'])
+    expect(frames(second)).toEqual(['snapshot'])
+    expect(host.isRegistered(KEY('sub-1'))).toBe(false)
+    expect(host.isRegistered(KEY('sub-2'))).toBe(true)
+    expect(host.stopListening).toHaveBeenCalledTimes(1)
+  })
+})
+
+describe('session.tabs.subscribeAll registers before restoring structured tabs', () => {
+  it.each([
+    {
+      release: 'unsubscribeAll',
+      act: (host: ReturnType<typeof makeHost>) =>
+        host.dispatch(
+          request('unsub-1', 'session.tabs.unsubscribeAll', { subscriptionId: 'sub-1' })
+        )
+    },
+    {
+      release: 'socket close',
+      act: async (host: ReturnType<typeof makeHost>) =>
+        host.runtime.cleanupSubscriptionsForConnection(CONNECTION)
+    }
+  ])('a $release during the restore leaves no stream behind', async ({ act }) => {
+    const host = makeHost({ structuredChat: true })
+    const gate = deferred<void>()
+    host.restore.mockReturnValueOnce(gate.promise)
+    const messages: Frame[] = []
+    const pending = host.dispatch(request('sub-1', 'session.tabs.subscribeAll'), messages)
+
+    await act(host)
+    gate.resolve()
+    await pending
+    await settle()
+
+    expect(host.isRegistered(ALL_KEY('sub-1'))).toBe(false)
+    expect(frames(messages)).not.toContain('snapshots')
+    expect(
+      vi.mocked(host.runtime.onMobileSessionTabsChanged).mock.calls.length -
+        host.stopListening.mock.calls.length
+    ).toBe(0)
+  })
+})
diff --git a/src/main/runtime/rpc/methods/session-tabs-unsubscribe.test.ts b/src/main/runtime/rpc/methods/session-tabs-unsubscribe.test.ts
index efd353a7c913..8490181d0eab 100644
--- a/src/main/runtime/rpc/methods/session-tabs-unsubscribe.test.ts
+++ b/src/main/runtime/rpc/methods/session-tabs-unsubscribe.test.ts
@@ -67,6 +67,7 @@ function runtimeWithCleanup(
   cleanupSubscription: ReturnType<typeof vi.fn>,
   cleanupSubscriptionsByPrefix = vi.fn()
 ): OrcaRuntimeService {
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the unsubscribe methods reach only these members; a missing one throws and fails the test.
   return {
     getRuntimeId: () => 'test-runtime',
     listMobileSessionTabs: vi.fn().mockResolvedValue({
@@ -79,7 +80,8 @@ function runtimeWithCleanup(
       tabs: []
     }),
     cleanupSubscription,
-    cleanupSubscriptionsByPrefix
+    cleanupSubscriptionsByPrefix,
+    getSubscriptionRegistrationVersion: () => 0
   } as unknown as OrcaRuntimeService
 }
 
diff --git a/src/main/runtime/rpc/methods/session-tabs.ts b/src/main/runtime/rpc/methods/session-tabs.ts
index 40e1525f1486..8d3d1af33bf2 100644
--- a/src/main/runtime/rpc/methods/session-tabs.ts
+++ b/src/main/runtime/rpc/methods/session-tabs.ts
@@ -1,4 +1,5 @@
 import { resolveRuntimeNavigationTarget } from '../../../../shared/runtime-navigation'
+import { getExplicitWorktreeIdSelector } from '../../runtime-worktree-selection'
 import { defineMethod, defineStreamingMethod } from '../core'
 import {
   CreateTerminalTab,
@@ -97,78 +98,115 @@ export const SESSION_TAB_METHODS = [
     params: WorktreeTabSelector,
     handler: async (
       params,
-      { runtime, connectionId, requestId, pairedDeviceId, clientKind, clientCapabilities },
+      { runtime, connectionId, requestId, pairedDeviceId, clientKind, clientCapabilities, signal },
       emit
     ) => {
-      let subscribedWorktree: string | null = null
-      let unsubscribe = (): void => {}
-      let closed = false
-      let initialized = false
-      await restoreStructuredTabsIfSupported({ runtime, clientKind, clientCapabilities })
-      const initial = await runtime.listMobileSessionTabs(params.worktree, pairedDeviceId)
-      if (closed) {
-        return
-      }
-      subscribedWorktree = initial.worktree
-      const cleanupPrefix = `session.tabs:${connectionId ?? 'local'}:${subscribedWorktree}`
-      const subscriptionId = requestId ? `${cleanupPrefix}:${requestId}` : cleanupPrefix
-      // Why: shared-control can carry multiple subscribers for one worktree on
-      // one socket; include the RPC id so one subscriber cannot evict another.
-      runtime.registerSubscriptionCleanup(
-        subscriptionId,
-        () => {
-          closed = true
-          unsubscribe()
-          if (initialized) {
-            emit({ type: 'end' })
-          }
-        },
-        connectionId
-      )
-      if (closed) {
-        return
+      let subscriptionId: string | null = null
+      let released = false
+      let endOnRelease = true
+      let stopListening = (): void => {}
+      // Safe without a version check: any other release of this key runs our cleanup first, which latches `released`.
+      const release = (): void => {
+        if (!released && subscriptionId) {
+          runtime.cleanupSubscription(subscriptionId)
+        }
       }
-      const withProofDelta = createSessionTabsRetirementProofDelta(clientCapabilities)
-      emit({
-        type: 'snapshot',
-        ...withProofDelta(
-          projectSessionTabsForClient(
-            initial,
-            clientKind,
-            clientCapabilities,
-            isStructuredNativeChatEnabled(runtime)
-          )
+      const register = (worktreeId: string): void => {
+        const cleanupPrefix = `session.tabs:${connectionId ?? 'local'}:${worktreeId}`
+        // Why: shared-control can carry multiple subscribers for one worktree on
+        // one socket; include the RPC id so one subscriber cannot evict another.
+        subscriptionId = requestId ? `${cleanupPrefix}:${requestId}` : cleanupPrefix
+        runtime.registerSubscriptionCleanup(
+          subscriptionId,
+          () => {
+            if (released) {
+              return
+            }
+            released = true
+            signal?.removeEventListener('abort', release)
+            stopListening()
+            if (endOnRelease) {
+              emit({ type: 'end' })
+            }
+          },
+          connectionId
         )
-      })
-      initialized = true
-      if (closed) {
-        return
+        if (signal?.aborted) {
+          release()
+        } else {
+          signal?.addEventListener('abort', release, { once: true })
+        }
       }
-
-      unsubscribe = runtime.onMobileSessionTabsChanged((snapshot) => {
-        if (snapshot.worktree === subscribedWorktree) {
-          emit({
-            type: 'updated',
-            ...withProofDelta(
-              projectSessionTabsForClient(
-                snapshot,
-                clientKind,
-                clientCapabilities,
-                isStructuredNativeChatEnabled(runtime)
-              )
+      // Why: register before any await so an unsubscribe or socket close during setup
+      // finds the stream; only an `id:` selector (every phone and web client) names it up front.
+      const explicitWorktreeId = getExplicitWorktreeIdSelector(params.worktree)
+      if (explicitWorktreeId) {
+        register(explicitWorktreeId)
+      }
+      try {
+        await restoreStructuredTabsIfSupported({ runtime, clientKind, clientCapabilities })
+        if (released) {
+          return
+        }
+        const initial = await runtime.listMobileSessionTabs(params.worktree, pairedDeviceId)
+        if (released) {
+          return
+        }
+        if (!subscriptionId) {
+          register(initial.worktree)
+          if (released) {
+            return
+          }
+        }
+        const subscribedWorktree = initial.worktree
+        const withProofDelta = createSessionTabsRetirementProofDelta(clientCapabilities)
+        emit({
+          type: 'snapshot',
+          ...withProofDelta(
+            projectSessionTabsForClient(
+              initial,
+              clientKind,
+              clientCapabilities,
+              isStructuredNativeChatEnabled(runtime)
             )
-          })
+          )
+        })
+        if (released) {
+          return
+        }
+        stopListening = runtime.onMobileSessionTabsChanged((snapshot) => {
+          if (snapshot.worktree === subscribedWorktree) {
+            emit({
+              type: 'updated',
+              ...withProofDelta(
+                projectSessionTabsForClient(
+                  snapshot,
+                  clientKind,
+                  clientCapabilities,
+                  isStructuredNativeChatEnabled(runtime)
+                )
+              )
+            })
+          }
+        }, pairedDeviceId)
+      } catch (error) {
+        // A stream already ended by its release must not also report an error.
+        if (released) {
+          return
         }
-      }, pairedDeviceId)
-      if (closed) {
-        unsubscribe()
+        endOnRelease = false
+        release()
+        throw error
       }
     }
   }),
   defineMethod({
     name: 'session.tabs.unsubscribe',
     params: SessionTabsUnsubscribe,
-    handler: async (params, { runtime, connectionId, pairedDeviceId }) => {
+    handler: async (
+      params,
+      { runtime, connectionId, pairedDeviceId, subscriptionRegistrationVersion }
+    ) => {
       const snapshot = await runtime.listMobileSessionTabs(params.worktree, pairedDeviceId)
       const connection = connectionId ?? 'local'
       if (params.subscriptionId) {
@@ -179,17 +217,18 @@ export const SESSION_TAB_METHODS = [
       }
       runtime.cleanupSubscription(`session.tabs:${connection}:${params.worktree}`)
       runtime.cleanupSubscription(`session.tabs:${connection}:${snapshot.worktree}`)
-      runtime.cleanupSubscriptionsByPrefix(`session.tabs:${connection}:${snapshot.worktree}:`)
+      // Why: subscribes register on arrival, so spare any that arrived after this unsubscribe.
+      runtime.cleanupSubscriptionsByPrefix(
+        `session.tabs:${connection}:${snapshot.worktree}:`,
+        subscriptionRegistrationVersion
+      )
       return { unsubscribed: true }
     }
   }),
   defineStreamingMethod({
     name: 'session.tabs.subscribeAll',
     params: null,
-    handler: async (_params, context, emit) => {
-      await restoreStructuredTabsIfSupported(context)
-      return subscribeSessionTabsInventory(context, emit)
-    }
+    handler: (_params, context, emit) => subscribeSessionTabsInventory(context, emit)
   }),
   defineMethod({
     name: 'session.tabs.unsubscribeAll',
diff --git a/src/main/runtime/rpc/methods/structured-agent-session-admission.test.ts b/src/main/runtime/rpc/methods/structured-agent-session-admission.test.ts
index de62b6b5b528..554c0912ff03 100644
--- a/src/main/runtime/rpc/methods/structured-agent-session-admission.test.ts
+++ b/src/main/runtime/rpc/methods/structured-agent-session-admission.test.ts
@@ -32,16 +32,16 @@ describe('admission revoked while a session is still open', () => {
 
   it.each(CLEANUP_METHODS)(
     'still serves $method after the host setting is turned off',
-    async ({ method, params, hostCall }) => {
-      const response = await call(method, params, STRUCTURED_CLIENT, SETTING_OFF)
+    async (entry) => {
+      const response = await call(entry.method, entry.params, STRUCTURED_CLIENT, SETTING_OFF)
 
       expect(response).toMatchObject({ ok: true })
-      // `unsubscribe` retires runtime-owned subscriptions rather than calling the host, so its
-      // result payload is the observable effect.
-      if (hostCall === 'unsubscribe') {
-        expect(response).toMatchObject({ result: { unsubscribed: true } })
+      // `unsubscribe` retires runtime-owned subscriptions and `release` is a no-op, so neither
+      // calls the host: the result payload is the observable effect.
+      if (entry.hostCall === null) {
+        expect(response).toMatchObject({ result: entry.result })
       } else {
-        expect(hostCalls[hostCall]).toHaveBeenCalled()
+        expect(hostCalls[entry.hostCall]).toHaveBeenCalled()
       }
     }
   )
diff --git a/src/main/runtime/rpc/methods/structured-agent-session-at-rest.test.ts b/src/main/runtime/rpc/methods/structured-agent-session-at-rest.test.ts
new file mode 100644
index 000000000000..a3d598a69d88
--- /dev/null
+++ b/src/main/runtime/rpc/methods/structured-agent-session-at-rest.test.ts
@@ -0,0 +1,427 @@
+// A chat at rest, through the RPC surface a client actually calls: opening it starts nothing, what
+// it can answer without an agent it answers, and the first send is what starts one.
+
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { computeAgentSessionPayloadFingerprint } from '../../../../shared/agent-session-mutation-envelope'
+import { STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY } from '../../../../shared/protocol-version'
+import { activeStructuredAgentSessionTurnId } from '../../../../shared/structured-agent-session-projection'
+import { openJournalDatabase } from '../../../native-chat/agent-session-journal/journal-database'
+import {
+  journalDatabaseFile,
+  journalDirectoryFor
+} from '../../../native-chat/agent-session-journal/journal-paths'
+import {
+  HOST_TEST_LOCATION,
+  hostTestAttachParams,
+  hostTestMessage,
+  hostTestOperationId
+} from '../../../native-chat/agent-session-wire/structured-agent-session-host-test-data'
+import { setStructuredAgentSessionHost } from '../../../native-chat/agent-session-wire/structured-agent-session-registry'
+import {
+  createRestTestRig,
+  foundRestTestChat,
+  REST_TEST_CALLER as CALLER,
+  REST_TEST_SESSION as SESSION,
+  REST_TEST_THREAD,
+  restTestSend,
+  type RestTestRig
+} from '../../../native-chat/agent-session-wire/structured-agent-session-rest-test-rig'
+import * as providerSupport from '../../../native-chat/agent-session-wire/structured-agent-session-provider-support'
+import { OrcaRuntimeService } from '../../orca-runtime'
+import type { RpcResponse } from '../core'
+import { RpcDispatcher } from '../dispatcher'
+import { closeStructuredAgentSessionChild } from '../../structured-agent-session-close'
+import { discardStructuredWorkerSession } from './orchestration-structured-worker-session'
+import { STRUCTURED_AGENT_SESSION_METHODS } from './structured-agent-session'
+
+const CLIENT = {
+  clientId: 'device-1',
+  clientKind: 'runtime' as const,
+  clientCapabilities: [STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY],
+  connectionId: 'connection-1'
+}
+
+let rig: RestTestRig
+let dispatcher: RpcDispatcher
+let requests = 0
+
+async function call(method: string, params: unknown): Promise<RpcResponse[]> {
+  const replies: RpcResponse[] = []
+  requests += 1
+  await dispatcher.dispatchStreaming(
+    { id: `request-${requests}`, authToken: 'token', method, params },
+    (raw) => replies.push(JSON.parse(raw) as RpcResponse),
+    CLIENT
+  )
+  return replies
+}
+
+/** A chat that once ran, reopened by a fresh host: nothing of it is in memory. */
+async function restingChat(): Promise<void> {
+  await foundRestTestChat(rig)
+  await rig.store.replaceSessionOptions({
+    sessionId: SESSION,
+    fence: rig.store.getRecord(SESSION)!.lease.runtimeFence,
+    options: { model: 'gpt-saved', effort: 'high' },
+    now: rig.clock.now
+  })
+  await rig.restart()
+  setStructuredAgentSessionHost(rig.host)
+  rig.adapter.acquire.mockClear()
+  rig.adapter.dispatch.mockClear()
+  rig.adapter.readOptions.mockClear()
+}
+
+beforeEach(async () => {
+  requests = 0
+  rig = await createRestTestRig({ idleSweep: { intervalMs: 3_600_000 } })
+  setStructuredAgentSessionHost(rig.host)
+  const runtime = new OrcaRuntimeService()
+  vi.spyOn(runtime, 'getClientSettings').mockImplementation(
+    () =>
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the RPC gate reads only this one setting.
+      ({ experimentalStructuredNativeChat: true }) as ReturnType<
+        OrcaRuntimeService['getClientSettings']
+      >
+  )
+  dispatcher = new RpcDispatcher({ runtime, methods: STRUCTURED_AGENT_SESSION_METHODS })
+})
+
+afterEach(async () => {
+  vi.restoreAllMocks()
+  setStructuredAgentSessionHost(null)
+  await rig.dispose()
+})
+
+describe('opening a chat at rest (P2-01)', () => {
+  it('reads, subscribes and answers everything without starting an agent', async () => {
+    await restingChat()
+    expect(rig.host.hasSession(SESSION)).toBe(false)
+
+    const [history] = await call('agentSession.history', { sessionId: SESSION, direction: 'tail' })
+    const frames = await call('agentSession.subscribe', { sessionId: SESSION })
+    const [options] = await call('agentSession.options', { sessionId: SESSION })
+    const [commands] = await call('agentSession.commands', { sessionId: SESSION })
+    const [outline] = await call('agentSession.conversationOutline', { sessionId: SESSION })
+    const [status] = await call('agentSession.handoffStatus', { sessionId: SESSION })
+    const [held] = await call('agentSession.hold', { sessionId: SESSION, holderId: 'pane' })
+
+    expect(rig.adapter.acquire).not.toHaveBeenCalled()
+    expect(history).toMatchObject({ ok: true, result: { ok: true } })
+    const snapshot = frames.find((frame) => frame.ok && 'result' in frame)
+    expect(snapshot).toMatchObject({ result: { type: 'snapshot', commands: null } })
+    expect(options).toMatchObject({
+      ok: true,
+      result: { current: { model: 'gpt-saved', effort: 'high' } }
+    })
+    // Absent, never an empty list: the composer keeps its own menu.
+    expect(commands).toMatchObject({ ok: true, result: {} })
+    expect(commands?.ok && 'result' in commands && commands.result).not.toHaveProperty(
+      'commands',
+      []
+    )
+    expect(outline).toMatchObject({ ok: true })
+    expect(status).toMatchObject({ ok: true })
+    expect(held).toMatchObject({ ok: true, result: { held: true } })
+  })
+
+  // Worktree activation asks this for every chat tab in the worktree.
+  it('answers the owner check from the record without opening the chat', async () => {
+    await restingChat()
+
+    const [status] = await call('agentSession.handoffStatus', { sessionId: SESSION })
+
+    expect(status).toMatchObject({ ok: true, result: { owner: expect.any(String) } })
+    expect(rig.host.hasSession(SESSION)).toBe(false)
+  })
+
+  it('starts the agent on the first send (P2-01)', async () => {
+    await restingChat()
+    const fence = rig.store.getRecord(SESSION)!.lease.runtimeFence
+    const sent = await rig.host.send(CALLER, restTestSend('wake up', fence))
+    if (!sent.ok) {
+      throw new Error(`send refused: ${sent.refusal.code}`)
+    }
+    // Awaits the provider's answer itself rather than polling for it, however slow the start.
+    await rig.host.waitForSendSettlement(SESSION, sent.value.clientMessageId)
+    expect(rig.adapter.acquire).toHaveBeenCalledOnce()
+    expect(rig.adapter.dispatch).toHaveBeenCalledOnce()
+  })
+})
+
+describe('the accessor', () => {
+  it('opens a closed conversation once, however many readers arrive together (P2-02)', async () => {
+    // Written by the provider alone, so nothing but the readers below ever opens it here.
+    const attached = await rig.host.attach(CALLER, hostTestAttachParams(null))
+    expect(attached.ok).toBe(true)
+    rig.adapter.acquire.mock.calls
+      .at(-1)?.[0]
+      .events?.appendItem(
+        { provider: 'codex', threadId: REST_TEST_THREAD, turnId: 'turn-1', ordinal: 1 },
+        hostTestMessage('from the provider')
+      )
+    await rig.host.flushStreamedEvents(SESSION)
+    await rig.restart()
+    setStructuredAgentSessionHost(rig.host)
+    rig.adapter.acquire.mockClear()
+    const open = vi.spyOn(rig.host.collaboratorsForTests().conversationDelivery, 'open')
+    await Promise.all([
+      ...Array.from({ length: 5 }, () =>
+        call('agentSession.history', { sessionId: SESSION, direction: 'tail' })
+      ),
+      call('agentSession.subscribe', { sessionId: SESSION })
+    ])
+    const openedJournals = new Set(
+      await Promise.all(open.mock.results.map((result) => result.value))
+    )
+    expect(openedJournals.size).toBe(1)
+    expect(rig.adapter.acquire).not.toHaveBeenCalled()
+  })
+
+  it('opens nothing once quit began, for a read that was already waiting on the lock', async () => {
+    await restingChat()
+    // The host's per-session queue, held so the read waits behind it.
+    const { serialize, lifetime } = rig.host.collaboratorsForTests()
+    let release = (): void => undefined
+    const held = new Promise<void>((started) => {
+      void serialize(SESSION, () => {
+        started()
+        return new Promise<void>((resolve) => (release = resolve))
+      })
+    })
+    await held
+    const read = rig.host.history({ sessionId: SESSION, direction: 'tail' })
+
+    // Disposed as quit's first teardown step does.
+    lifetime.dispose()
+    release()
+
+    await expect(read).rejects.toThrow()
+    expect(rig.host.hasSession(SESSION)).toBe(false)
+  })
+
+  it('refuses a read it cannot open with the reason, under the same code and message', async () => {
+    const [missing] = await call('agentSession.history', {
+      sessionId: 'session-never-created',
+      direction: 'tail'
+    })
+    expect(missing).toMatchObject({
+      ok: false,
+      error: {
+        code: 'agent_session_identity_required',
+        message: 'agent_session_identity_required',
+        data: {
+          refusal: {
+            code: 'agent_session_identity_required',
+            details: { reason: 'recordMissing' }
+          }
+        }
+      }
+    })
+
+    await restingChat()
+    vi.spyOn(providerSupport, 'adapterSupportsRecord').mockReturnValue(false)
+    const [unsupported] = await call('agentSession.history', {
+      sessionId: SESSION,
+      direction: 'tail'
+    })
+    expect(unsupported).toMatchObject({
+      ok: false,
+      error: {
+        // Not a passthrough code: released clients match the message, as before.
+        code: 'runtime_error',
+        message: 'structured_agent_session_unsupported',
+        data: { refusal: { details: { reason: 'hostUnsupported' } } }
+      }
+    })
+  })
+
+  it('opens a corrupt journal through the recovering open and still accepts a send (P2-03)', async () => {
+    await foundRestTestChat(rig)
+    await rig.host.flushAllStreamedEvents()
+    const directory = journalDirectoryFor(rig.root, {
+      workspaceId: HOST_TEST_LOCATION.workspaceId,
+      sessionId: SESSION
+    })
+    // A row that no longer parses: the recovering open keeps the readable prefix and rebuilds.
+    const opened = openJournalDatabase(journalDatabaseFile(directory))
+    try {
+      opened.db.prepare('UPDATE journal_rows SET row_json = ? WHERE seq = ?').run('}{', 2)
+    } finally {
+      opened.db.close()
+    }
+    await rig.restart()
+    setStructuredAgentSessionHost(rig.host)
+
+    const frames = await call('agentSession.subscribe', { sessionId: SESSION })
+    expect(frames.some((frame) => !frame.ok)).toBe(false)
+    expect(frames.find((frame) => frame.ok)).toMatchObject({ result: { type: 'snapshot' } })
+    const fence = rig.store.getRecord(SESSION)!.lease.runtimeFence
+    expect((await rig.host.send(CALLER, restTestSend('after the repair', fence))).ok).toBe(true)
+  })
+
+  it('subscribes an old mobile client that holds first even when no agent can start (P2-06)', async () => {
+    await restingChat()
+    rig.adapter.acquire.mockRejectedValue(new Error('auth expired'))
+
+    const [held] = await call('agentSession.hold', { sessionId: SESSION, holderId: 'mobile' })
+    const frames = await call('agentSession.subscribe', { sessionId: SESSION })
+    expect(held).toMatchObject({ ok: true })
+    expect(frames.find((frame) => frame.ok)).toMatchObject({ result: { type: 'snapshot' } })
+    expect(rig.adapter.acquire).not.toHaveBeenCalled()
+  })
+})
+
+describe('options at rest', () => {
+  it('records a pick as intent and replays it at the next start (P2-16)', async () => {
+    await restingChat()
+    const fields = { key: 'model', value: 'gpt-picked' }
+    const [picked] = await call('agentSession.setOption', {
+      envelope: {
+        sessionId: SESSION,
+        clientOperationId: hostTestOperationId(),
+        expectedRuntimeFence: rig.store.getRecord(SESSION)!.lease.runtimeFence,
+        payloadFingerprint: computeAgentSessionPayloadFingerprint({
+          method: 'agentSession.setOption',
+          sessionId: SESSION,
+          fields
+        })
+      },
+      ...fields
+    })
+    expect(picked).toMatchObject({ ok: true, result: { ok: true } })
+    expect(rig.store.getRecord(SESSION)?.options).toMatchObject({ model: 'gpt-picked' })
+    expect(rig.adapter.acquire).not.toHaveBeenCalled()
+
+    const fence = rig.store.getRecord(SESSION)!.lease.runtimeFence
+    await rig.host.send(CALLER, restTestSend('use the new model', fence))
+    await vi.waitFor(() => expect(rig.adapter.acquire).toHaveBeenCalledOnce())
+    expect(rig.adapter.acquire.mock.calls[0]?.[0]).toMatchObject({
+      options: expect.objectContaining({ model: 'gpt-picked' })
+    })
+  })
+
+  it('answers the provider-level features of a chat at rest (P2-17)', async () => {
+    await restingChat()
+    Object.assign(rig.host.deps.adapter, {
+      supportsThreadGoal: (_id: string, agent?: string) => agent === 'codex',
+      recordsContextUsage: (_id: string, agent?: string) => agent === 'claude',
+      rewindSupport: (_id: string, agent?: string) =>
+        agent === 'codex' ? { supported: true } : { supported: false, reason: 'unsupported' }
+    })
+    const [options] = await call('agentSession.options', { sessionId: SESSION })
+    expect(options).toMatchObject({
+      ok: true,
+      result: { threadGoal: { current: null }, rewind: { supported: true } }
+    })
+    expect(rig.adapter.acquire).not.toHaveBeenCalled()
+    expect(rig.adapter.readOptions).not.toHaveBeenCalled()
+  })
+})
+
+describe('an agent exit', () => {
+  it('is shown, not respawned; the next send starts the agent (P2-18)', async () => {
+    await foundRestTestChat(rig)
+    const running = rig.host.collaboratorsForTests().sessions.get(SESSION)!.child!
+    await rig.host.handleAdapterEvent({
+      type: 'ended',
+      sessionId: SESSION,
+      reason: 'killed',
+      cause: 'unexpected-exit',
+      fence: running.fence,
+      acquisitionGeneration: running.generation!
+    })
+    await new Promise((resolve) => setTimeout(resolve, 50))
+    expect(rig.adapter.acquire).toHaveBeenCalledOnce()
+
+    const fence = rig.store.getRecord(SESSION)!.lease.runtimeFence
+    expect(rig.store.getRecord(SESSION)?.lease.claimStatus).toBe('released')
+    await rig.host.send(CALLER, restTestSend('again', fence))
+    await vi.waitFor(() => expect(rig.adapter.acquire).toHaveBeenCalledTimes(2))
+  })
+
+  it('whose settlement write failed is settled by the next send, which is delivered', async () => {
+    await foundRestTestChat(rig)
+    const open = rig.host.collaboratorsForTests().sessions.get(SESSION)!
+    const running = open.child!
+    // A turn in flight, so the exit has something to settle.
+    rig.adapter.acquire.mock.calls
+      .at(-1)?.[0]
+      .events?.appendItem(
+        { provider: 'codex', threadId: REST_TEST_THREAD, turnId: 'working', ordinal: 50 },
+        { kind: 'turn', turnId: 'working', state: 'running' }
+      )
+    await rig.host.flushStreamedEvents(SESSION)
+    vi.spyOn(open.journal, 'appendLifecycleBatch').mockRejectedValueOnce(new Error('disk full'))
+    await rig.host.handleAdapterEvent({
+      type: 'ended',
+      sessionId: SESSION,
+      reason: 'killed',
+      cause: 'unexpected-exit',
+      fence: running.fence,
+      acquisitionGeneration: running.generation!
+    })
+    // Released with its death evidence, not latched: the next acquire settles from that evidence.
+    await vi.waitFor(() =>
+      expect(rig.store.getRecord(SESSION)?.lease).toMatchObject({
+        claimStatus: 'released',
+        deathEvidence: { kind: 'exit-observed' }
+      })
+    )
+
+    const sent = await rig.host.send(
+      CALLER,
+      restTestSend('again', rig.store.getRecord(SESSION)!.lease.runtimeFence)
+    )
+
+    if (!sent.ok) {
+      throw new Error(`send refused: ${sent.refusal.code}`)
+    }
+    await rig.host.waitForSendSettlement(SESSION, sent.value.clientMessageId)
+    expect(rig.adapter.dispatch).toHaveBeenCalledTimes(2)
+    expect(
+      activeStructuredAgentSessionTurnId((await rig.host.journalSnapshot(SESSION)).items)
+    ).not.toBe('working')
+  })
+})
+
+describe('every close withdraws what is queued (P2-29)', () => {
+  it.each([
+    ['the close RPC', async () => void (await call('agentSession.close', { sessionId: SESSION }))],
+    ['the runtime chat close', async () => void (await closeStructuredAgentSessionChild(SESSION))],
+    [
+      'a discarded worker',
+      () =>
+        // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the discard reads only this runtime member.
+        discardStructuredWorkerSession(SESSION, {
+          retireStructuredAgentSessionTabFromSnapshot: () => undefined
+        } as never)
+    ]
+  ])('%s rejects a message accepted before any start, and starts nothing', async (_, close) => {
+    await restingChat()
+    // The delivery loop has not reached its first start yet.
+    const { loop } = rig.host.collaboratorsForTests().conversationDelivery
+    vi.spyOn(loop, 'wake').mockImplementation(() => undefined)
+    const reader: unknown[] = []
+    await rig.host.subscribe({
+      id: 'reader',
+      sessionId: SESSION,
+      emit: (event) => reader.push(event)
+    })
+    const fence = rig.store.getRecord(SESSION)!.lease.runtimeFence
+    expect((await rig.host.send(CALLER, restTestSend('closed before it went', fence))).ok).toBe(
+      true
+    )
+
+    await close()
+    // A close's rejection is a sentence with its fact beside it, never a marker.
+    await vi.waitFor(() =>
+      expect(JSON.stringify(reader)).toContain(
+        '"reason":"The chat closed before this message was sent.","submittedAt"'
+      )
+    )
+    expect(JSON.stringify(reader)).toContain('"rejection":{"kind":"chatClosed"}')
+    expect(rig.host.hasSession(SESSION)).toBe(false)
+    expect(rig.adapter.acquire).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/main/runtime/rpc/methods/structured-agent-session-background-task-capability.test.ts b/src/main/runtime/rpc/methods/structured-agent-session-background-task-capability.test.ts
index 2b62b00525e8..8a9e2267a5a8 100644
--- a/src/main/runtime/rpc/methods/structured-agent-session-background-task-capability.test.ts
+++ b/src/main/runtime/rpc/methods/structured-agent-session-background-task-capability.test.ts
@@ -1,4 +1,4 @@
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
 import type { AgentSessionBackgroundTaskState } from '../../../../shared/agent-session-wire'
 import {
   AGENT_SESSION_BACKGROUND_TASK_ROW_STOP_CAPABILITY,
@@ -63,7 +63,6 @@ describe('background-task stop capability at the RPC boundary', () => {
   it.each(['snapshot', 'batch', 'reset'] as const)(
     'gates the %s stream without changing the provider state',
     async (type) => {
-      hostCalls.hold = vi.fn(async () => undefined)
       hostCalls.subscribe.mockImplementation((input: AgentSessionSubscribeInput) => {
         const base = { sessionId: SESSION, fence: 1, backgroundTasks: TASKS }
         if (type === 'batch') {
diff --git a/src/main/runtime/rpc/methods/structured-agent-session-conversation-outline.ts b/src/main/runtime/rpc/methods/structured-agent-session-conversation-outline.ts
index 99bf60da727d..08ecc212ec1b 100644
--- a/src/main/runtime/rpc/methods/structured-agent-session-conversation-outline.ts
+++ b/src/main/runtime/rpc/methods/structured-agent-session-conversation-outline.ts
@@ -7,7 +7,7 @@
 
 import { readAgentSessionConversationOutline } from '../../../native-chat/agent-session-wire/agent-session-conversation-outline'
 import { defineMethod } from '../core'
-import { requireStructuredHost as requireHost } from './structured-agent-session-gate'
+import { requireInstalledStructuredHost } from './structured-agent-session-gate'
 import { OptionsParams } from './structured-agent-session-schemas'
 
 export const STRUCTURED_AGENT_SESSION_CONVERSATION_OUTLINE_METHODS = [
@@ -15,6 +15,8 @@ export const STRUCTURED_AGENT_SESSION_CONVERSATION_OUTLINE_METHODS = [
     name: 'agentSession.conversationOutline',
     params: OptionsParams,
     handler: async (params, ctx) =>
-      readAgentSessionConversationOutline(requireHost(ctx).journalSnapshot(params.sessionId))
+      readAgentSessionConversationOutline(
+        await (await requireInstalledStructuredHost(ctx)).journalSnapshot(params.sessionId)
+      )
   })
 ]
diff --git a/src/main/runtime/rpc/methods/structured-agent-session-create.ts b/src/main/runtime/rpc/methods/structured-agent-session-create.ts
index ab52c2aa855c..0c3b7b087133 100644
--- a/src/main/runtime/rpc/methods/structured-agent-session-create.ts
+++ b/src/main/runtime/rpc/methods/structured-agent-session-create.ts
@@ -12,6 +12,7 @@
  * in. Both callers run the same two halves, so orchestration gets that guarantee too.
  */
 
+import { refuse } from '../../../../shared/agent-session-wire-refusals'
 import { computeAgentSessionPayloadFingerprint } from '../../../../shared/agent-session-mutation-envelope'
 import type {
   AgentSessionAttachResult,
@@ -43,7 +44,7 @@ export type PreparedStructuredAgentSessionCreate = {
  * intent, not a detail of it: without it a retry of "adopt this conversation" would replay as, or
  * conflict with, a blank create. `tabId` is covered so the declared digest spans the payload, but
  * replay keys on the attach fingerprint, so a retry naming another tab is answered with the one the
- * record holds. The canonicalizer drops `undefined`, so plain creates keep the digest they had.
+ * chat's tab holds. The canonicalizer drops `undefined`, so plain creates keep the digest they had.
  */
 export function structuredAgentSessionCreateIntentFingerprint(params: {
   envelope: AgentSessionMutationEnvelope
@@ -79,8 +80,8 @@ export async function prepareStructuredAgentSessionCreateForWorktree(args: {
    *  `--model`/`--effort` the dispatch asked for; a chat the user opened passes nothing and keeps
    *  the saved selection. Narrowed by the caller, so `{}` never reaches the reservation. */
   options?: Readonly<Record<string, string>>
-  /** The tab id the caller reserved for this chat, so its placement is recorded before the reply;
-   *  absent records the id clients derive. Beside `options`, after the fingerprint, likewise. */
+  /** The tab id the caller reserved for this chat, taken when its tab is published; absent, the tab
+   *  gets the id clients derive. Beside `options`, after the fingerprint, likewise. */
   tabId?: string
 }): Promise<PreparedStructuredAgentSessionCreate> {
   // Adoption replay may need the record loaded from disk before source discovery can be skipped.
@@ -131,24 +132,29 @@ export async function commitStructuredAgentSessionCreate(args: {
   if (!result.ok || !prepared.tab) {
     return result
   }
+  const surfaceTabId = prepared.attachParams.surfaceTabId
   try {
     await args.runtime.publishStructuredAgentSessionTab({
       workspaceId: prepared.tab.workspaceId,
       sessionId: result.value.sessionId,
       agent: prepared.tab.agent,
-      activate: args.activate
+      activate: args.activate,
+      ...(surfaceTabId ? { tabId: surfaceTabId } : {})
     })
   } catch (error) {
     console.warn('[agent-session] create committed before tab publication failed', error)
     return {
       ok: false,
-      refusal: {
-        code: 'agent_session_operation_unknown',
-        message: 'The chat may have been created, but its tab could not be confirmed.'
-      }
+      refusal: refuse(
+        'agent_session_operation_unknown',
+        { reason: 'tabUnconfirmed' },
+        'The chat may have been created, but its tab could not be confirmed.'
+      )
     }
   }
-  return result
+  // Read after publishing, which is what gives the chat its tab.
+  const tabId = prepared.host.getSessionTabId?.(result.value.sessionId)
+  return tabId ? { ...result, value: { ...result.value, tabId } } : result
 }
 
 export async function createStructuredAgentSessionForWorktree(args: {
diff --git a/src/main/runtime/rpc/methods/structured-agent-session-gate-classification.test-fixture.ts b/src/main/runtime/rpc/methods/structured-agent-session-gate-classification.test-fixture.ts
index 72c52c888fd3..7b388f5eca22 100644
--- a/src/main/runtime/rpc/methods/structured-agent-session-gate-classification.test-fixture.ts
+++ b/src/main/runtime/rpc/methods/structured-agent-session-gate-classification.test-fixture.ts
@@ -21,15 +21,18 @@ export const CLEANUP_METHODS = [
     params: { envelope: envelope(), turnId: 'turn-1' },
     hostCall: 'cancel'
   },
+  // A no-op kept for older clients: it answers without reaching the host.
   {
     method: 'agentSession.release',
     params: { sessionId: SESSION, holderId: 'surface-1' },
-    hostCall: 'release'
+    hostCall: null,
+    result: { released: true }
   },
   {
     method: 'agentSession.unsubscribe',
     params: { sessionId: SESSION },
-    hostCall: 'unsubscribe'
+    hostCall: null,
+    result: { unsubscribed: true }
   }
 ] as const
 
diff --git a/src/main/runtime/rpc/methods/structured-agent-session-gate.ts b/src/main/runtime/rpc/methods/structured-agent-session-gate.ts
index 95e3e3d6eee7..e4ff861d1ac7 100644
--- a/src/main/runtime/rpc/methods/structured-agent-session-gate.ts
+++ b/src/main/runtime/rpc/methods/structured-agent-session-gate.ts
@@ -8,6 +8,7 @@
 // for old mobile clients while structured chat is enabled so they receive a fallback row, and that
 // path constructs the host. `agentSession.*` stays refused either way, which is what this gate is for.
 
+import { agentSessionRefusalError } from '../../../../shared/agent-session-wire-refusals'
 import { getStructuredAgentSessionHost } from '../../../native-chat/agent-session-wire/structured-agent-session-registry'
 import type { StructuredAgentSessionHost } from '../../../native-chat/agent-session-wire/structured-agent-session-host'
 import type { StructuredAgentSessionCaller } from '../../../native-chat/agent-session-wire/structured-agent-session-host-types'
@@ -27,7 +28,9 @@ export function supportsStructuredSessions(ctx: RpcContext): boolean {
 
 export function requireStructuredCapability(ctx: RpcContext): void {
   if (!supportsStructuredSessions(ctx)) {
-    throw new Error('structured_agent_session_unsupported')
+    throw agentSessionRefusalError('structured_agent_session_unsupported', {
+      reason: 'clientCapabilityMissing'
+    })
   }
 }
 
@@ -35,7 +38,9 @@ export function requireStructuredHost(ctx: RpcContext): StructuredAgentSessionHo
   requireStructuredCapability(ctx)
   const host = getStructuredAgentSessionHost()
   if (!host) {
-    throw new Error('structured_agent_session_unsupported')
+    throw agentSessionRefusalError('structured_agent_session_unsupported', {
+      reason: 'hostDisabled'
+    })
   }
   return host
 }
@@ -64,19 +69,22 @@ export function requireStructuredHost(ctx: RpcContext): StructuredAgentSessionHo
  */
 export function requireStructuredCleanupHost(ctx: RpcContext): StructuredAgentSessionHost {
   if (!supportsStructuredAgentSessionCapability(ctx)) {
-    throw new Error('structured_agent_session_unsupported')
+    throw agentSessionRefusalError('structured_agent_session_unsupported', {
+      reason: 'clientCapabilityMissing'
+    })
   }
   const host = getStructuredAgentSessionHost()
   if (!host) {
-    throw new Error('structured_agent_session_unsupported')
+    throw agentSessionRefusalError('structured_agent_session_unsupported', {
+      reason: 'hostDisabled'
+    })
   }
   return host
 }
 
-/** Builds the host for the calls that address a session by durable record rather than by live
- *  state: attach, which is the only way a session comes into being, plus hold and reveal, which
- *  each reach for a record on disk this process may not have opened yet. Every other method
- *  addresses a session that must already be attached, and correctly reports absent when none is. */
+/** Builds the host for a call that may be the first this process sees. Every session is addressed
+ *  by its durable record — a read opens a conversation at rest — so each call that reaches for one
+ *  may meet a host nothing has built yet. */
 export async function ensureStructuredHostInstalled(ctx: RpcContext): Promise<void> {
   // Gated first: a client that cannot read structured sessions must not be able
   // to make the host exist, which is an observable side effect of the surface.
@@ -89,6 +97,14 @@ export async function ensureStructuredHostInstalled(ctx: RpcContext): Promise<vo
   await ctx.runtime.ensureStructuredAgentSessionHost()
 }
 
+/** The host for a read, built first when this process has none: the read RPCs share this one. */
+export async function requireInstalledStructuredHost(
+  ctx: RpcContext
+): Promise<StructuredAgentSessionHost> {
+  await ensureStructuredHostInstalled(ctx)
+  return requireStructuredHost(ctx)
+}
+
 /** Mirrors the existing agent-session host-authority derivation so one client
  *  gets one operation namespace across both surfaces. */
 export function structuredCallerFor(ctx: RpcContext): StructuredAgentSessionCaller {
diff --git a/src/main/runtime/rpc/methods/structured-agent-session-hold.test.ts b/src/main/runtime/rpc/methods/structured-agent-session-hold.test.ts
index c3099d843ced..140be5e1c39b 100644
--- a/src/main/runtime/rpc/methods/structured-agent-session-hold.test.ts
+++ b/src/main/runtime/rpc/methods/structured-agent-session-hold.test.ts
@@ -1,8 +1,8 @@
-// The wire half of a session's lifetime: who takes a hold, and what happens when they vanish.
+// `agentSession.hold` / `release` are kept answering for clients that still send them, and do
+// nothing else: a view never starts or keeps an agent.
 //
-// Run against the REAL subscription registry rather than a stub, because the backstop being tested
-// IS that registry's connection sweep — a stubbed `registerSubscriptionCleanup` would prove that
-// the handler called a function, which is not the claim.
+// Run against the REAL subscription registry rather than a stub, because the claim includes that a
+// connection closing runs nothing hold-related — a stubbed registry could not show that.
 
 import { mkdtemp, rm } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
@@ -24,9 +24,10 @@ import { OrcaRuntimeService } from '../../orca-runtime'
 import type { RpcResponse } from '../core'
 import { RpcDispatcher } from '../dispatcher'
 import { STRUCTURED_AGENT_SESSION_METHODS } from './structured-agent-session'
+import { agentSessionFailureFact } from '../../../../shared/agent-session-failure'
+import { agentSessionFailureWords } from '../../../../shared/agent-session-failure-words'
 
 const CONNECTION = 'connection-1'
-const GRACE_MS = 5
 const CLIENT = {
   clientId: 'device-1',
   clientKind: 'runtime' as const,
@@ -82,7 +83,12 @@ beforeEach(async () => {
       // acquire that throws leaves an unverifiable owner nothing may replace.
       releaseAcquisition: vi.fn(async () => true),
       closeSession,
-      dispatch: async () => ({ state: 'rejected', reason: 'unused' }),
+      dispatch: async () => ({
+        state: 'rejected',
+        ...agentSessionFailureWords(agentSessionFailureFact('providerRejected'), {
+          surface: 'rejection'
+        })
+      }),
       cancelTurn: async () => ({ cancelled: false }),
       answerPrompt: async () => undefined,
       setOption: async () => undefined
@@ -90,7 +96,6 @@ beforeEach(async () => {
     journalRoot: root,
     claimKeyId: 'key-1',
     mintSpawnToken: () => 'spawn-a',
-    releaseGraceMs: GRACE_MS,
     now: () => NOW
   })
   setStructuredAgentSessionHost(host)
@@ -114,186 +119,85 @@ afterEach(async () => {
   await rm(root, { recursive: true, force: true })
 })
 
-describe('a client that holds a session', () => {
-  it('keeps the provider child while the hold stands', async () => {
+describe('the hold surface, for clients that still call it', () => {
+  it('answers a hold without starting an agent or registering a cleanup', async () => {
+    await host.close(SESSION)
+    expect(host.hasSession(SESSION)).toBe(false)
+    const registered = vi.spyOn(runtime, 'registerOwnedSubscriptionCleanup')
+    const acquiresBefore = acquire.mock.calls.length
+
     expect(
       await call('agentSession.hold', { sessionId: SESSION, holderId: 'chat-1' })
-    ).toMatchObject({ ok: true })
+    ).toMatchObject({ ok: true, result: { held: true } })
 
-    await new Promise((resolve) => setTimeout(resolve, GRACE_MS * 20))
-
-    expect(closeSession).not.toHaveBeenCalled()
-    expect(host.hasSession(SESSION)).toBe(true)
+    expect(acquire.mock.calls.length).toBe(acquiresBefore)
+    expect(registered).not.toHaveBeenCalled()
+    expect(store.getRecord(SESSION)?.lease.claimStatus).toBe('released')
   })
 
-  it('releases it when the client says so', async () => {
+  it('answers a release without stopping anything, and a connection close runs nothing', async () => {
     await call('agentSession.hold', { sessionId: SESSION, holderId: 'chat-1' })
 
     expect(
       await call('agentSession.release', { sessionId: SESSION, holderId: 'chat-1' })
-    ).toMatchObject({ ok: true })
+    ).toMatchObject({ ok: true, result: { released: true } })
+    runtime.cleanupSubscriptionsForConnection(CONNECTION)
+    await new Promise((resolve) => setTimeout(resolve, 20))
 
-    await vi.waitFor(() => expect(host.hasSession(SESSION)).toBe(false))
-    expect(closeSession).toHaveBeenCalledWith(SESSION)
+    expect(closeSession).not.toHaveBeenCalled()
+    expect(host.hasSession(SESSION)).toBe(true)
   })
 
-  it('releases its hold and cleanup after the setting is disabled', async () => {
-    const release = vi.spyOn(host, 'release')
-    await call('agentSession.hold', { sessionId: SESSION, holderId: 'chat-1' })
+  it('refuses a hold once the setting is off, and still answers a release', async () => {
     structuredNativeChatEnabled = false
 
+    expect(
+      await call('agentSession.hold', { sessionId: SESSION, holderId: 'chat-1' })
+    ).toMatchObject({ ok: false })
     expect(
       await call('agentSession.release', { sessionId: SESSION, holderId: 'chat-1' })
-    ).toMatchObject({ ok: true })
-    const releaseCallsAfterRpc = release.mock.calls.length
-    runtime.cleanupSubscriptionsForConnection(CONNECTION)
-
-    expect(releaseCallsAfterRpc).toBe(2)
-    expect(release).toHaveBeenCalledTimes(releaseCallsAfterRpc)
-    await vi.waitFor(() => expect(host.hasSession(SESSION)).toBe(false))
-    expect(closeSession).toHaveBeenCalledWith(SESSION)
-  })
-
-  it('does not report success when no provider child can be acquired', async () => {
-    const response = await call('agentSession.hold', {
-      sessionId: 'session-missing',
-      holderId: 'chat-missing'
-    })
-
-    expect(response).toMatchObject({
-      ok: false,
-      error: { code: 'agent_session_identity_required' }
-    })
-    expect(host.isHeld('session-missing')).toBe(false)
+    ).toMatchObject({ ok: true, result: { released: true } })
+    expect(closeSession).not.toHaveBeenCalled()
   })
-})
 
-describe('a client that disappears without cleanup', () => {
-  it('shares one child with a same-ID replacement that arrives while the first hold resumes', async () => {
+  it('answers a hold even when no agent could be started', async () => {
     await host.close(SESSION)
-    await host.restoreReadableSessions()
-    closeSession.mockClear()
-    acquire.mockClear()
-    const entered = Promise.withResolvers<void>()
-    const gate = Promise.withResolvers<void>()
-    const spawnChild = acquire.getMockImplementation()!
-    acquire.mockImplementationOnce(async (input) => {
-      entered.resolve()
-      await gate.promise
-      return spawnChild(input)
-    })
-    try {
-      const params = { sessionId: SESSION, holderId: 'same-chat' }
-      const first = call('agentSession.hold', params)
-      await entered.promise
-      // Re-registering the cleanup id released the first hold; the replacement waits its turn
-      // behind the first hold's attach and finds the child it made.
-      const replacement = call('agentSession.hold', params)
-      gate.resolve()
-
-      expect(await first).toMatchObject({ ok: true })
-      expect(await replacement).toMatchObject({ ok: true })
-      expect(acquire).toHaveBeenCalledOnce()
-      expect(host.isHeld(SESSION)).toBe(true)
-      await new Promise((resolve) => setTimeout(resolve, GRACE_MS * 4))
-      expect(closeSession).not.toHaveBeenCalled()
+    acquire.mockRejectedValue(new Error('provider unavailable'))
+    const acquiresBefore = acquire.mock.calls.length
 
-      runtime.cleanupSubscriptionsForConnection(CONNECTION)
-      await vi.waitFor(() => expect(host.hasSession(SESSION)).toBe(false))
-      expect(closeSession).toHaveBeenCalledExactlyOnceWith(SESSION)
-    } finally {
-      gate.resolve()
-    }
+    expect(
+      await call('agentSession.hold', { sessionId: SESSION, holderId: 'chat-1' })
+    ).toMatchObject({ ok: true, result: { held: true } })
+    expect(acquire.mock.calls.length).toBe(acquiresBefore)
   })
+})
 
-  it('lets a same-ID replacement make its own attempt when the first hold fails to acquire', async () => {
+describe('a stream', () => {
+  it('reads a closed conversation without starting its agent', async () => {
     await host.close(SESSION)
-    await host.restoreReadableSessions()
-    closeSession.mockClear()
-    acquire.mockClear()
-    const entered = Promise.withResolvers<void>()
-    const gate = Promise.withResolvers<void>()
-    acquire.mockImplementationOnce(async () => {
-      entered.resolve()
-      await gate.promise
-      throw new Error('acquisition failed')
-    })
-    try {
-      const params = { sessionId: SESSION, holderId: 'same-chat' }
-      const first = call('agentSession.hold', params)
-      await entered.promise
-      const replacement = call('agentSession.hold', params)
-      gate.resolve()
-
-      expect(await first).toMatchObject({ ok: false })
-      // One attempt per hold: the replacement's own succeeds, and the holder it re-took stands.
-      const replaced = await replacement
-      expect(replaced, JSON.stringify(replaced)).toMatchObject({ ok: true })
-      expect(acquire).toHaveBeenCalledTimes(2)
-      expect(host.isHeld(SESSION)).toBe(true)
-      expect(closeSession).not.toHaveBeenCalled()
-
-      runtime.cleanupSubscriptionsForConnection(CONNECTION)
-      await vi.waitFor(() => expect(host.hasSession(SESSION)).toBe(false))
-      expect(closeSession).toHaveBeenCalledExactlyOnceWith(SESSION)
-    } finally {
-      gate.resolve()
-    }
-  })
-
-  it('still releases the session when its transport closes', async () => {
-    await call('agentSession.hold', { sessionId: SESSION, holderId: 'chat-1' })
-
-    runtime.cleanupSubscriptionsForConnection(CONNECTION)
-
-    await vi.waitFor(() => expect(host.hasSession(SESSION)).toBe(false))
-    expect(closeSession).toHaveBeenCalledWith(SESSION)
-  })
+    expect(host.hasSession(SESSION)).toBe(false)
+    const acquiresBefore = acquire.mock.calls.length
+    const frames: unknown[] = []
 
-  it('does not release a hold another connection is still holding', async () => {
-    await call('agentSession.hold', { sessionId: SESSION, holderId: 'chat-1' })
     await dispatcher.dispatchStreaming(
       {
-        id: 'request-other',
+        id: 'request-subscribe',
         authToken: 'token',
-        method: 'agentSession.hold',
-        params: { sessionId: SESSION, holderId: 'chat-1' }
+        method: 'agentSession.subscribe',
+        params: { sessionId: SESSION }
       },
-      () => {},
-      { ...CLIENT, clientId: 'device-2', connectionId: 'connection-2' }
+      (raw) => frames.push(JSON.parse(raw)),
+      CLIENT
     )
 
-    runtime.cleanupSubscriptionsForConnection(CONNECTION)
-    await new Promise((resolve) => setTimeout(resolve, GRACE_MS * 20))
-
-    expect(closeSession).not.toHaveBeenCalled()
-    expect(host.hasSession(SESSION)).toBe(true)
-  })
-
-  it('does not let an old connection sweep release its same-document replacement', async () => {
-    await call('agentSession.hold', { sessionId: SESSION, holderId: 'chat-1' })
-    await dispatcher.dispatchStreaming(
-      {
-        id: 'request-replacement',
-        authToken: 'token',
-        method: 'agentSession.hold',
-        params: { sessionId: SESSION, holderId: 'chat-1' }
-      },
-      () => {},
-      { ...CLIENT, connectionId: 'connection-2' }
+    expect(frames).toContainEqual(
+      expect.objectContaining({ result: expect.objectContaining({ type: 'snapshot' }) })
     )
-
-    runtime.cleanupSubscriptionsForConnection(CONNECTION)
-    await new Promise((resolve) => setTimeout(resolve, GRACE_MS * 20))
-
-    expect(closeSession).not.toHaveBeenCalled()
-    expect(host.hasSession(SESSION)).toBe(true)
-
-    runtime.cleanupSubscriptionsForConnection('connection-2')
-    await vi.waitFor(() => expect(host.hasSession(SESSION)).toBe(false))
+    expect(acquire.mock.calls.length).toBe(acquiresBefore)
+    expect(store.getRecord(SESSION)?.lease.claimStatus).toBe('released')
   })
 
-  it('releases a desktop subscription when its renderer transport dies', async () => {
+  it('keeps nothing alive when its transport dies', async () => {
     const transport = new AbortController()
     await dispatcher.dispatchStreaming(
       {
@@ -310,56 +214,12 @@ describe('a client that disappears without cleanup', () => {
         clientCapabilities: CLIENT.clientCapabilities
       }
     )
-    expect(host.isHeld(SESSION)).toBe(true)
 
     transport.abort()
+    await new Promise((resolve) => setTimeout(resolve, 20))
 
-    await vi.waitFor(() => expect(host.hasSession(SESSION)).toBe(false))
-    expect(closeSession).toHaveBeenCalledWith(SESSION)
-  })
-
-  it('unsubscribes and releases stream retention after the setting is disabled', async () => {
-    await dispatcher.dispatchStreaming(
-      {
-        id: 'stream-disabled-cleanup',
-        authToken: 'token',
-        method: 'agentSession.subscribe',
-        params: { sessionId: SESSION }
-      },
-      () => {},
-      CLIENT
-    )
-    expect(host.isHeld(SESSION)).toBe(true)
-    structuredNativeChatEnabled = false
-
-    expect(
-      await call('agentSession.unsubscribe', {
-        sessionId: SESSION,
-        subscriptionId: 'stream-disabled-cleanup'
-      })
-    ).toMatchObject({ ok: true })
-
-    await vi.waitFor(() => expect(host.hasSession(SESSION)).toBe(false))
-    expect(closeSession).toHaveBeenCalledWith(SESSION)
-  })
-
-  it('does not let a stream alone resume a released session', async () => {
-    await host.close(SESSION)
-    expect(host.hasSession(SESSION)).toBe(false)
-    await host.restoreReadableSessions()
-    expect(store.getRecord(SESSION)?.lease.claimStatus).toBe('released')
-
-    await dispatcher.dispatchStreaming(
-      {
-        id: 'request-subscribe',
-        authToken: 'token',
-        method: 'agentSession.subscribe',
-        params: { sessionId: SESSION }
-      },
-      () => {},
-      CLIENT
-    )
-
-    expect(store.getRecord(SESSION)?.lease.claimStatus).toBe('released')
+    // The idle sweep, not a departing reader, is what stops an agent.
+    expect(closeSession).not.toHaveBeenCalled()
+    expect(host.hasSession(SESSION)).toBe(true)
   })
 })
diff --git a/src/main/runtime/rpc/methods/structured-agent-session-hold.ts b/src/main/runtime/rpc/methods/structured-agent-session-hold.ts
index 54753fcb8894..e1975f1c7255 100644
--- a/src/main/runtime/rpc/methods/structured-agent-session-hold.ts
+++ b/src/main/runtime/rpc/methods/structured-agent-session-hold.ts
@@ -1,64 +1,31 @@
-// `agentSession.hold` / `agentSession.release` — a surface saying it is bound to a session.
+// `agentSession.hold` / `agentSession.release` — kept answering for clients that still send them.
 //
-// The holder identity is scoped to the CONNECTION, not taken from the client verbatim: two clients
-// are free to name their surfaces the same thing, and a hold that collides is one that a stranger
-// can release.
-//
-// The registered cleanup is the backstop, and the ONLY thing that covers a client which vanishes —
-// a paired client that disconnects mid-turn never gets to send its release. Registering it before taking
-// the hold is deliberate: re-registering an id runs the previous cleanup synchronously, so the
-// stale release lands before this hold rather than after it.
+// A view no longer decides whether an agent runs: a send starts one, and the idle sweep stops it.
+// So both are no-ops. `hold` still builds the host, because shipped mobile builds build it through
+// `hold` before they subscribe. Delete both, and their allowlist entries, once
+// MIN_COMPATIBLE_RUNTIME_CLIENT_VERSION passes every client that still calls them.
 
-import { defineMethod, type RpcContext } from '../core'
+import { defineMethod } from '../core'
 import {
-  ensureStructuredHostInstalled,
-  requireStructuredCleanupHost,
-  requireStructuredHost
+  requireInstalledStructuredHost,
+  requireStructuredCleanupHost
 } from './structured-agent-session-gate'
 import { HoldParams } from './structured-agent-session-schemas'
 
-const HOLD_CLEANUP_PREFIX = 'agentSession.hold'
-
-function holderKeyFor(ctx: RpcContext, holderId: string): string {
-  const client = ctx.clientId?.trim() || (ctx.clientKind ?? 'runtime')
-  return `${ctx.connectionId ?? 'local'}:${client}:${holderId}`
-}
-
-function holdCleanupIdFor(sessionId: string, holderKey: string): string {
-  return `${HOLD_CLEANUP_PREFIX}:${holderKey}:${sessionId}`
-}
-
 export const STRUCTURED_AGENT_SESSION_HOLD_METHODS = [
   defineMethod({
     name: 'agentSession.hold',
     params: HoldParams,
-    handler: async (params, ctx) => {
-      await ensureStructuredHostInstalled(ctx)
-      const host = requireStructuredHost(ctx)
-      const holderKey = holderKeyFor(ctx, params.holderId)
-      const registration = ctx.runtime.registerOwnedSubscriptionCleanup(
-        holdCleanupIdFor(params.sessionId, holderKey),
-        () => host.release(params.sessionId, holderKey),
-        ctx.connectionId
-      )
-      try {
-        await host.hold(params.sessionId, holderKey)
-      } catch (error) {
-        registration.releaseIfCurrent()
-        throw error
-      }
+    handler: async (_params, ctx) => {
+      await requireInstalledStructuredHost(ctx)
       return { held: true as const }
     }
   }),
   defineMethod({
     name: 'agentSession.release',
     params: HoldParams,
-    handler: async (params, ctx) => {
-      const host = requireStructuredCleanupHost(ctx)
-      const holderKey = holderKeyFor(ctx, params.holderId)
-      host.release(params.sessionId, holderKey)
-      // Retires the backstop too; its release is a no-op against a holder already gone.
-      ctx.runtime.cleanupSubscription(holdCleanupIdFor(params.sessionId, holderKey))
+    handler: async (_params, ctx) => {
+      requireStructuredCleanupHost(ctx)
       return { released: true as const }
     }
   })
diff --git a/src/main/runtime/rpc/methods/structured-agent-session-options-read.ts b/src/main/runtime/rpc/methods/structured-agent-session-options-read.ts
index b74b9cacfa66..19e936895771 100644
--- a/src/main/runtime/rpc/methods/structured-agent-session-options-read.ts
+++ b/src/main/runtime/rpc/methods/structured-agent-session-options-read.ts
@@ -1,22 +1,26 @@
 // The options read surface: what a session reports about itself, and the
 // host's stored model catalog behind the picker.
 //
-// `agentSession.options` serializes on the session because it asks the live
-// provider what is selected. `agentSession.modelCatalog` deliberately does
+// `agentSession.options` answers at rest from the record and the catalog, and
+// asks the live provider only when one runs. `agentSession.modelCatalog` deliberately does
 // neither — answering from the host store is what lets a picker render while
 // an attach is still running. It is additive: an older host answers
 // `method_not_found` (or `forbidden` through the mobile allowlist gate), and
 // the client keeps its static seed.
 
 import { defineMethod } from '../core'
-import { requireStructuredHost as requireHost } from './structured-agent-session-gate'
+import {
+  requireInstalledStructuredHost,
+  requireStructuredHost as requireHost
+} from './structured-agent-session-gate'
 import { ModelCatalogParams, OptionsParams } from './structured-agent-session-schemas'
 
 export const STRUCTURED_AGENT_SESSION_OPTIONS_READ_METHODS = [
   defineMethod({
     name: 'agentSession.options',
     params: OptionsParams,
-    handler: async (params, ctx) => requireHost(ctx).readOptions(params.sessionId)
+    handler: async (params, ctx) =>
+      (await requireInstalledStructuredHost(ctx)).readOptions(params.sessionId)
   }),
   defineMethod({
     name: 'agentSession.modelCatalog',
diff --git a/src/main/runtime/rpc/methods/structured-agent-session-precommit-refusal.ts b/src/main/runtime/rpc/methods/structured-agent-session-precommit-refusal.ts
index 24d9fa2aec4b..4038fe9e40d2 100644
--- a/src/main/runtime/rpc/methods/structured-agent-session-precommit-refusal.ts
+++ b/src/main/runtime/rpc/methods/structured-agent-session-precommit-refusal.ts
@@ -12,6 +12,9 @@
 
 import {
   AGENT_SESSION_WIRE_REFUSAL_CODES,
+  agentSessionRefusalFromReference,
+  isAgentSessionRefusalError,
+  refuseUnclassified,
   type AgentSessionWireRefusal,
   type AgentSessionWireRefusalCode
 } from '../../../../shared/agent-session-wire'
@@ -40,19 +43,25 @@ function wireRefusalCode(error: unknown): AgentSessionWireRefusalCode | null {
   return null
 }
 
+const PRECOMMIT_REFUSAL_MESSAGE = 'Orca cannot open a structured agent chat for this workspace.'
+
 function precommitRefusal(error: unknown): AgentSessionWireRefusal {
+  // A refusal the host raised keeps its situation; a bare code names none.
+  if (isAgentSessionRefusalError(error)) {
+    return agentSessionRefusalFromReference(error.refusal, PRECOMMIT_REFUSAL_MESSAGE)
+  }
   const code = wireRefusalCode(error)
   if (code) {
-    return { code, message: 'Orca cannot open a structured agent chat for this workspace.' }
+    return refuseUnclassified(code, PRECOMMIT_REFUSAL_MESSAGE)
   }
   const message = error instanceof Error ? error.message : String(error)
   // A code-less failure here is often a defect, not a policy answer; the refusal keeps the user
-  // moving, the log keeps the cause findable.
+  // moving, the log keeps the cause findable. Nothing names its situation, so it carries no reason.
   console.warn('[agent-session] create refused before it committed anything', error)
-  return {
-    code: UNCODED_PRECOMMIT_REFUSAL_CODE,
-    message: `Orca could not prepare a structured agent chat for this workspace: ${message}`
-  }
+  return refuseUnclassified(
+    UNCODED_PRECOMMIT_REFUSAL_CODE,
+    `Orca could not prepare a structured agent chat for this workspace: ${message}`
+  )
 }
 
 /**
diff --git a/src/main/runtime/rpc/methods/structured-agent-session-respond-params.test.ts b/src/main/runtime/rpc/methods/structured-agent-session-respond-params.test.ts
new file mode 100644
index 000000000000..3eb7ad3db619
--- /dev/null
+++ b/src/main/runtime/rpc/methods/structured-agent-session-respond-params.test.ts
@@ -0,0 +1,106 @@
+// Wire bounds for prompt responses: a decision id for an approval, structured answers for a question.
+
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+import {
+  call,
+  clearStructuredHostStub,
+  envelope,
+  hostCalls,
+  installStructuredHostStub,
+  STRUCTURED_CLIENT
+} from './structured-agent-session-rpc.test-fixture'
+
+beforeEach(() => {
+  installStructuredHostStub()
+})
+
+afterEach(() => {
+  clearStructuredHostStub()
+})
+
+describe('prompt response parameters', () => {
+  const rejects = async (method: string, params: unknown): Promise<void> => {
+    const response = await call(method, params, STRUCTURED_CLIENT)
+    expect(response).toMatchObject({ ok: false, error: { code: 'invalid_argument' } })
+  }
+
+  it('accepts the maximum fully encoded Claude choice group and retains a finite bound', async () => {
+    const maximumSelections = Array.from({ length: 4 }, (_, questionIndex) => ({
+      questionId: `q${questionIndex + 1}`,
+      optionIds: Array.from(
+        { length: 4 },
+        (_, optionIndex) => `q${questionIndex + 1}:choice-${optionIndex + 1}`
+      )
+    }))
+    const optionId = `question-group:${encodeURIComponent(JSON.stringify(maximumSelections))}`
+    expect(optionId.length).toBe(610)
+
+    const response = await call(
+      'agentSession.respondToQuestion',
+      {
+        envelope: envelope(),
+        itemId: 'item-1',
+        expectedRevision: 1,
+        optionId
+      },
+      STRUCTURED_CLIENT
+    )
+    expect(response).toMatchObject({ ok: true })
+    expect(hostCalls.respondToPrompt).toHaveBeenCalledWith(
+      expect.anything(),
+      expect.objectContaining({ optionId })
+    )
+
+    await rejects('agentSession.respondToQuestion', {
+      envelope: envelope(),
+      itemId: 'item-1',
+      expectedRevision: 1,
+      optionId: 'x'.repeat(1025)
+    })
+  })
+
+  it('takes a long typed answer as structured answers and bounds each field', async () => {
+    const answers = [
+      { questionId: 'q1', optionIds: ['q1:choice-1'] },
+      { questionId: 'q2', optionIds: [], other: 'Proceed with the replacement. '.repeat(100) }
+    ]
+    const response = await call(
+      'agentSession.respondToQuestion',
+      { envelope: envelope(), itemId: 'item-1', expectedRevision: 1, answers },
+      STRUCTURED_CLIENT
+    )
+    expect(response).toMatchObject({ ok: true })
+    expect(hostCalls.respondToPrompt).toHaveBeenCalledWith(
+      expect.anything(),
+      expect.objectContaining({ kind: 'question', answers })
+    )
+
+    const base = { envelope: envelope(), itemId: 'item-1', expectedRevision: 1 }
+    await rejects('agentSession.respondToQuestion', base)
+    await rejects('agentSession.respondToQuestion', { ...base, optionId: 'q1:choice-1', answers })
+    await rejects('agentSession.respondToQuestion', {
+      ...base,
+      answers: [{ questionId: 'q1', optionIds: [], other: 'x'.repeat(64 * 1024 + 1) }]
+    })
+    await rejects('agentSession.respondToQuestion', {
+      ...base,
+      answers: [{ questionId: 'q1', optionIds: [], other: 'é'.repeat(40 * 1024) }]
+    })
+    await rejects('agentSession.respondToApproval', { ...base, answers })
+    await rejects('agentSession.respondToApproval', { ...base, optionId: 'x'.repeat(1025) })
+  })
+
+  it('takes a question id exactly as the agent wrote it, including edge spaces', async () => {
+    const answers = [{ questionId: 'scope ', optionIds: [], other: 'mine' }]
+    const response = await call(
+      'agentSession.respondToQuestion',
+      { envelope: envelope(), itemId: 'item-1', expectedRevision: 1, answers },
+      STRUCTURED_CLIENT
+    )
+    expect(response).toMatchObject({ ok: true })
+    expect(hostCalls.respondToPrompt).toHaveBeenCalledWith(
+      expect.anything(),
+      expect.objectContaining({ kind: 'question', answers })
+    )
+  })
+})
diff --git a/src/main/runtime/rpc/methods/structured-agent-session-restart-resume.ts b/src/main/runtime/rpc/methods/structured-agent-session-restart-resume.ts
index b3a70334f409..a48f897a005e 100644
--- a/src/main/runtime/rpc/methods/structured-agent-session-restart-resume.ts
+++ b/src/main/runtime/rpc/methods/structured-agent-session-restart-resume.ts
@@ -64,20 +64,15 @@ export const STRUCTURED_AGENT_SESSION_RESTART_RESUME_METHODS = [
     }
   }),
   defineMethod({
-    // Reattach only, no send. No Orca surface calls it now — the desktop prompt's single action is
-    // resume-and-continue — but it is a PUBLISHED wire method, so dropping it is a wire removal an
-    // older or non-desktop client would meet as an unknown method.
+    // Reattach only, no send. Reattaching is nothing now — an agent starts only for work — so this
+    // answers that nothing was resumed. No Orca surface calls it, but it is a PUBLISHED wire
+    // method, so dropping it is a wire removal an older client would meet as an unknown method.
     name: 'agentSession.restartResume',
     params: RestartResumeParams,
-    handler: async (params, ctx) => {
+    handler: async (_params, ctx) => {
       await ensureStructuredHostInstalled(ctx)
-      const host = requireStructuredHost(ctx)
-      return {
-        results: await host.restartResume.resume(
-          params.sessionIds,
-          structuredCallerFor(ctx).callerKey
-        )
-      }
+      requireStructuredHost(ctx)
+      return { results: [] }
     }
   })
 ]
diff --git a/src/main/runtime/rpc/methods/structured-agent-session-reveal.ts b/src/main/runtime/rpc/methods/structured-agent-session-reveal.ts
index 47f30a5030dc..903f8d440afb 100644
--- a/src/main/runtime/rpc/methods/structured-agent-session-reveal.ts
+++ b/src/main/runtime/rpc/methods/structured-agent-session-reveal.ts
@@ -9,7 +9,11 @@
 // reads its own record and answers with that record's workspace and provider, so a client knowing
 // only a session id cannot aim the publication somewhere else.
 
-import { isAgentSessionWireRefusalCode } from '../../../../shared/agent-session-wire'
+import {
+  agentSessionRefusalFromReference,
+  isAgentSessionRefusalError,
+  isAgentSessionWireRefusalCode
+} from '../../../../shared/agent-session-wire'
 import type { StructuredAgentSessionReveal } from '../../../native-chat/agent-session-wire/structured-agent-session-host-types'
 import { refuseAgentSessionMutation } from '../../../native-chat/agent-session-wire/structured-agent-session-mutation-admission'
 import { defineMethod } from '../core'
@@ -37,13 +41,14 @@ export const STRUCTURED_AGENT_SESSION_REVEAL_METHODS = [
         if (!isAgentSessionWireRefusalCode(code)) {
           throw error
         }
-        return refuseAgentSessionMutation({
-          code,
-          message:
+        return refuseAgentSessionMutation(
+          agentSessionRefusalFromReference(
+            isAgentSessionRefusalError(error) ? error.refusal : { code },
             code === 'structured_agent_session_unsupported'
               ? 'This host cannot open that chat.'
               : 'This chat is no longer on this host.'
-        })
+          )
+        )
       }
       await ctx.runtime.publishStructuredAgentSessionTab({
         workspaceId: revealed.workspaceId,
diff --git a/src/main/runtime/rpc/methods/structured-agent-session-rpc.test-fixture.ts b/src/main/runtime/rpc/methods/structured-agent-session-rpc.test-fixture.ts
index a9cf5cd79576..9a0f3902496b 100644
--- a/src/main/runtime/rpc/methods/structured-agent-session-rpc.test-fixture.ts
+++ b/src/main/runtime/rpc/methods/structured-agent-session-rpc.test-fixture.ts
@@ -203,8 +203,7 @@ export function hostStub(): StructuredAgentSessionHost {
     subscribeStatus: vi.fn((subscriber: StructuredAgentSessionStatusSubscriber) =>
       statusFeed().subscribe(subscriber)
     ),
-    unsubscribe: vi.fn(),
-    release: vi.fn()
+    unsubscribe: vi.fn()
   })
   return hostCalls as unknown as StructuredAgentSessionHost
 }
diff --git a/src/main/runtime/rpc/methods/structured-agent-session-schemas.ts b/src/main/runtime/rpc/methods/structured-agent-session-schemas.ts
index 9daf97d55af2..345fdf5bf47f 100644
--- a/src/main/runtime/rpc/methods/structured-agent-session-schemas.ts
+++ b/src/main/runtime/rpc/methods/structured-agent-session-schemas.ts
@@ -17,6 +17,7 @@ export {
   MutationEnvelope,
   OptionsParams,
   RespondParams,
+  RespondToQuestionParams,
   RestartResumableParams,
   RestartResumeParams,
   RewindParams,
diff --git a/src/main/runtime/rpc/methods/structured-agent-session-send-compatibility.test.ts b/src/main/runtime/rpc/methods/structured-agent-session-send-compatibility.test.ts
new file mode 100644
index 000000000000..9ae846df6fc0
--- /dev/null
+++ b/src/main/runtime/rpc/methods/structured-agent-session-send-compatibility.test.ts
@@ -0,0 +1,84 @@
+// Which clients get a send answered at acceptance, and which have their reply held until the
+// message is handed over: a client that cannot show a rejection after `pending` must not see one.
+
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+import {
+  ELECTRON_REMOTE_RUNTIME_CLIENT_CAPABILITIES,
+  STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY
+} from '../../../../shared/protocol-version'
+import { DESKTOP_RENDERER_RUNTIME_CLIENT_CAPABILITIES } from '../../../ipc/desktop-renderer-runtime-capabilities'
+import { STRUCTURED_AGENT_SESSION_START_WAIT_MS } from '../../../native-chat/agent-session-wire/structured-agent-session-send-settlement'
+import {
+  call,
+  clearStructuredHostStub,
+  hostCalls,
+  installStructuredHostStub,
+  SESSION,
+  sendParams,
+  STRUCTURED_CLIENT
+} from './structured-agent-session-rpc.test-fixture'
+
+beforeEach(() => {
+  installStructuredHostStub()
+})
+
+afterEach(() => {
+  clearStructuredHostStub()
+})
+
+describe('agentSession.send reply timing', () => {
+  it('holds a pending reply until handover for a client that cannot show a later rejection', async () => {
+    hostCalls.send.mockResolvedValueOnce(pendingSendResult())
+    hostCalls.waitForSendSettlement.mockResolvedValueOnce(undefined)
+
+    await call('agentSession.send', sendParams(), STRUCTURED_CLIENT)
+
+    expect(hostCalls.waitForSendSettlement).toHaveBeenCalledWith(SESSION, 'client-1', {
+      until: 'handed-over',
+      budgetMs: STRUCTURED_AGENT_SESSION_START_WAIT_MS
+    })
+  })
+
+  it('answers at acceptance for the local desktop and paired desktop clients (W2)', async () => {
+    for (const clientCapabilities of [
+      DESKTOP_RENDERER_RUNTIME_CLIENT_CAPABILITIES,
+      // A paired desktop gains the structured surface as its own capability; the reply rule rides
+      // on the list it already sends.
+      [...ELECTRON_REMOTE_RUNTIME_CLIENT_CAPABILITIES, STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY]
+    ]) {
+      hostCalls.send.mockResolvedValueOnce(pendingSendResult())
+      const response = await call('agentSession.send', sendParams(), {
+        clientKind: 'runtime',
+        clientCapabilities: [...clientCapabilities]
+      })
+      expect(response).toMatchObject({
+        ok: true,
+        result: { value: { submission: { dispatchState: 'pending' } } }
+      })
+    }
+    expect(hostCalls.waitForSendSettlement).not.toHaveBeenCalled()
+  })
+})
+
+function pendingSendResult() {
+  return {
+    ok: true,
+    replayed: false,
+    fence: 1,
+    cursor: { epoch: 'epoch-a', sequence: 1 },
+    value: {
+      clientMessageId: 'client-1',
+      submission: {
+        clientMessageId: 'client-1',
+        fence: 1,
+        payloadFingerprint: 'fingerprint',
+        dispatchState: 'pending' as const,
+        providerItemId: null,
+        reason: null,
+        submittedAt: 1,
+        resolvedAt: null,
+        handoverRecorded: true as const
+      }
+    }
+  }
+}
diff --git a/src/main/runtime/rpc/methods/structured-agent-session-send-compatibility.ts b/src/main/runtime/rpc/methods/structured-agent-session-send-compatibility.ts
index 8b9488699904..5fde5e0f6e49 100644
--- a/src/main/runtime/rpc/methods/structured-agent-session-send-compatibility.ts
+++ b/src/main/runtime/rpc/methods/structured-agent-session-send-compatibility.ts
@@ -1,26 +1,43 @@
-import { AGENT_SESSION_PENDING_SEND_RESULT_RUNTIME_CAPABILITY } from '../../../../shared/protocol-version'
+import {
+  AGENT_SESSION_ACCEPTED_SEND_RUNTIME_CAPABILITY,
+  AGENT_SESSION_PENDING_SEND_RESULT_RUNTIME_CAPABILITY
+} from '../../../../shared/protocol-version'
 import type { StructuredAgentSessionHost } from '../../../native-chat/agent-session-wire/structured-agent-session-host'
+import { STRUCTURED_AGENT_SESSION_START_WAIT_MS } from '../../../native-chat/agent-session-wire/structured-agent-session-send-settlement'
 import type { RpcContext } from '../core'
 import { requireStructuredHost, structuredCallerFor } from './structured-agent-session-gate'
 
+/**
+ * A send answers once the host accepts it. A client that predates that answer cannot show a
+ * message rejected after it, so its reply is held until the message is handed over or rejected;
+ * one that predates pending replies at all waits, as before, for the provider's answer.
+ */
 export async function sendStructuredAgentSessionForClient(
   params: Parameters<StructuredAgentSessionHost['send']>[1],
   context: RpcContext
 ) {
   const host = requireStructuredHost(context)
   const result = await host.send(structuredCallerFor(context), params)
+  const capabilities = context.clientCapabilities ?? []
   if (
     !result.ok ||
     result.value.submission.dispatchState !== 'pending' ||
     context.clientKind === undefined ||
-    context.clientCapabilities?.includes(AGENT_SESSION_PENDING_SEND_RESULT_RUNTIME_CAPABILITY)
+    capabilities.includes(AGENT_SESSION_ACCEPTED_SEND_RUNTIME_CAPABILITY)
   ) {
     return result
   }
+  // The start that used to run before the reply now runs after acceptance, so both waits cover it.
   const settled = await host.waitForSendSettlement(
     params.envelope.sessionId,
     result.value.clientMessageId,
-    context.signal
+    {
+      until: capabilities.includes(AGENT_SESSION_PENDING_SEND_RESULT_RUNTIME_CAPABILITY)
+        ? 'handed-over'
+        : 'answered',
+      budgetMs: STRUCTURED_AGENT_SESSION_START_WAIT_MS,
+      ...(context.signal ? { signal: context.signal } : {})
+    }
   )
   return settled ? { ...result, ...settled } : result
 }
diff --git a/src/main/runtime/rpc/methods/structured-agent-session-turn-item-capability.test.ts b/src/main/runtime/rpc/methods/structured-agent-session-turn-item-capability.test.ts
index 0393cf216c84..473f63313729 100644
--- a/src/main/runtime/rpc/methods/structured-agent-session-turn-item-capability.test.ts
+++ b/src/main/runtime/rpc/methods/structured-agent-session-turn-item-capability.test.ts
@@ -1,4 +1,4 @@
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
 import type { AgentJournalRenderItem } from '../../../../shared/agent-session-journal-types'
 import type {
   AgentSessionHistoryPage,
@@ -87,7 +87,6 @@ describe('turn item capability at the RPC boundary', () => {
   it.each(['snapshot', 'batch', 'reset'] as const)(
     'downgrades the %s stream only for a legacy reader',
     async (type) => {
-      hostCalls.hold = vi.fn(async () => undefined)
       hostCalls.subscribe.mockImplementation((input: AgentSessionSubscribeInput) => {
         const base = { sessionId: SESSION, fence: 1 }
         if (type === 'batch') {
diff --git a/src/main/runtime/rpc/methods/structured-agent-session-unsubscribe.test.ts b/src/main/runtime/rpc/methods/structured-agent-session-unsubscribe.test.ts
new file mode 100644
index 000000000000..a31a8bc8d186
--- /dev/null
+++ b/src/main/runtime/rpc/methods/structured-agent-session-unsubscribe.test.ts
@@ -0,0 +1,91 @@
+// A transcript stream ends when its client says so: the host drops that subscriber, so nothing is
+// derived or sent for it any more, and a sibling stream of the same session keeps going.
+
+import { afterEach, beforeEach, expect, it, vi } from 'vitest'
+import { STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY } from '../../../../shared/protocol-version'
+import { setStructuredAgentSessionHost } from '../../../native-chat/agent-session-wire/structured-agent-session-registry'
+import {
+  createRestTestRig,
+  foundRestTestChat,
+  REST_TEST_CALLER as CALLER,
+  REST_TEST_SESSION as SESSION,
+  restTestSend,
+  type RestTestRig
+} from '../../../native-chat/agent-session-wire/structured-agent-session-rest-test-rig'
+import { OrcaRuntimeService } from '../../orca-runtime'
+import type { RpcResponse } from '../core'
+import { RpcDispatcher } from '../dispatcher'
+import { STRUCTURED_AGENT_SESSION_METHODS } from './structured-agent-session'
+
+const CLIENT = {
+  clientId: 'device-1',
+  clientKind: 'runtime' as const,
+  clientCapabilities: [STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY],
+  connectionId: 'connection-1'
+}
+
+let rig: RestTestRig
+let dispatcher: RpcDispatcher
+
+function subscriberCount(): number {
+  return rig.host.collaboratorsForTests().subscribers.subscriberCountForTests(SESSION)
+}
+
+async function stream(id: string, frames: RpcResponse[]): Promise<void> {
+  await dispatcher.dispatchStreaming(
+    { id, authToken: 'token', method: 'agentSession.subscribe', params: { sessionId: SESSION } },
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the dispatcher writes RpcResponse JSON.
+    (raw) => frames.push(JSON.parse(raw) as RpcResponse),
+    CLIENT
+  )
+}
+
+beforeEach(async () => {
+  rig = await createRestTestRig({ idleSweep: { intervalMs: 3_600_000 } })
+  setStructuredAgentSessionHost(rig.host)
+  const runtime = new OrcaRuntimeService()
+  vi.spyOn(runtime, 'getClientSettings').mockImplementation(
+    () =>
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the RPC gate reads only this one setting.
+      ({ experimentalStructuredNativeChat: true }) as ReturnType<
+        OrcaRuntimeService['getClientSettings']
+      >
+  )
+  dispatcher = new RpcDispatcher({ runtime, methods: STRUCTURED_AGENT_SESSION_METHODS })
+})
+
+afterEach(async () => {
+  setStructuredAgentSessionHost(null)
+  await rig.dispose()
+})
+
+it('drops the subscriber a client unsubscribes, and keeps its sibling (U-02)', async () => {
+  await foundRestTestChat(rig)
+  const ended: RpcResponse[] = []
+  const kept: RpcResponse[] = []
+  await stream('frame-a', ended)
+  await stream('frame-b', kept)
+  expect(subscriberCount()).toBe(2)
+
+  const replies: RpcResponse[] = []
+  await dispatcher.dispatchStreaming(
+    {
+      id: 'frame-c',
+      authToken: 'token',
+      method: 'agentSession.unsubscribe',
+      params: { sessionId: SESSION, subscriptionId: 'frame-a' }
+    },
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the dispatcher writes RpcResponse JSON.
+    (raw) => replies.push(JSON.parse(raw) as RpcResponse),
+    CLIENT
+  )
+  expect(replies[0]).toMatchObject({ ok: true })
+  expect(subscriberCount()).toBe(1)
+
+  const before = ended.length
+  const fence = rig.store.getRecord(SESSION)!.lease.runtimeFence
+  await rig.host.send(CALLER, restTestSend('after the unsubscribe', fence))
+  await vi.waitFor(() => expect(kept.length).toBeGreaterThan(1))
+  // The ended stream's own `end` frame is all it gets.
+  expect(ended.slice(before).every((frame) => JSON.stringify(frame).includes('"end"'))).toBe(true)
+})
diff --git a/src/main/runtime/rpc/methods/structured-agent-session.test.ts b/src/main/runtime/rpc/methods/structured-agent-session.test.ts
index 2d2760832add..a8378489c029 100644
--- a/src/main/runtime/rpc/methods/structured-agent-session.test.ts
+++ b/src/main/runtime/rpc/methods/structured-agent-session.test.ts
@@ -4,6 +4,7 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { setStructuredAgentSessionHost } from '../../../native-chat/agent-session-wire/structured-agent-session-registry'
 import {
+  AGENT_SESSION_ACCEPTED_SEND_RUNTIME_CAPABILITY,
   AGENT_SESSION_PENDING_SEND_RESULT_RUNTIME_CAPABILITY,
   RUNTIME_CAPABILITIES,
   RUNTIME_PROTOCOL_VERSION,
@@ -12,6 +13,7 @@ import {
   STRUCTURED_AGENT_SESSION_REVEAL_RUNTIME_CAPABILITY,
   STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY
 } from '../../../../shared/protocol-version'
+import { STRUCTURED_AGENT_SESSION_START_WAIT_MS } from '../../../native-chat/agent-session-wire/structured-agent-session-send-settlement'
 import { computeAgentSessionPayloadFingerprint } from '../../../../shared/agent-session-mutation-envelope'
 import { ALL_RPC_METHODS } from './index'
 import { STRUCTURED_AGENT_SESSION_METHODS } from './structured-agent-session'
@@ -149,6 +151,8 @@ describe('capability gating', () => {
   it('advertises the capability without bumping the protocol version', () => {
     expect(RUNTIME_CAPABILITIES).toContain(STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY)
     expect(RUNTIME_CAPABILITIES).toContain(AGENT_SESSION_PENDING_SEND_RESULT_RUNTIME_CAPABILITY)
+    // A client tells a host that accepts first, and admits a writer-free Stop before a turn, by it.
+    expect(RUNTIME_CAPABILITIES).toContain(AGENT_SESSION_ACCEPTED_SEND_RUNTIME_CAPABILITY)
     expect(RUNTIME_CAPABILITIES).toContain(STRUCTURED_AGENT_SESSION_HOLD_RUNTIME_CAPABILITY)
     expect(RUNTIME_CAPABILITIES).toContain(STRUCTURED_AGENT_SESSION_REVEAL_RUNTIME_CAPABILITY)
     // Separate from the structured capability on purpose: a host can serve the rest of the
@@ -252,11 +256,11 @@ describe('capability gating', () => {
       signal: controller.signal
     })
 
-    expect(hostCalls.waitForSendSettlement).toHaveBeenCalledWith(
-      SESSION,
-      'client-1',
-      controller.signal
-    )
+    expect(hostCalls.waitForSendSettlement).toHaveBeenCalledWith(SESSION, 'client-1', {
+      until: 'answered',
+      budgetMs: STRUCTURED_AGENT_SESSION_START_WAIT_MS,
+      signal: controller.signal
+    })
     expect(response).toMatchObject({
       ok: true,
       result: {
@@ -302,36 +306,6 @@ describe('capability gating', () => {
     })
   })
 
-  it('returns durable pending immediately to clients that understand admission', async () => {
-    hostCalls.send.mockResolvedValueOnce({
-      ok: true,
-      replayed: false,
-      fence: 1,
-      cursor: { epoch: 'epoch-a', sequence: 1 },
-      value: {
-        clientMessageId: 'client-1',
-        submission: {
-          clientMessageId: 'client-1',
-          fence: 1,
-          payloadFingerprint: 'fingerprint',
-          dispatchState: 'pending',
-          providerItemId: null,
-          reason: null,
-          submittedAt: 1,
-          resolvedAt: null
-        }
-      }
-    })
-
-    const response = await call('agentSession.send', sendParams(), STRUCTURED_CLIENT)
-
-    expect(hostCalls.waitForSendSettlement).not.toHaveBeenCalled()
-    expect(response).toMatchObject({
-      ok: true,
-      result: { value: { submission: { dispatchState: 'pending' } } }
-    })
-  })
-
   it('requires the host structured-chat setting for mobile clients', async () => {
     const response = await call('agentSession.send', sendParams(), STRUCTURED_MOBILE_CLIENT, {
       getClientSettings: () => ({ experimentalStructuredNativeChat: false })
@@ -363,7 +337,9 @@ describe('capability gating', () => {
         ok: false,
         error: { message: expect.stringContaining('structured_agent_session_unsupported') }
       })
-      expect(hostCalls[hostCall]).not.toHaveBeenCalled()
+      if (hostCall !== null) {
+        expect(hostCalls[hostCall]).not.toHaveBeenCalled()
+      }
     }
   )
 
@@ -783,41 +759,6 @@ describe('parameter validation', () => {
     })
   })
 
-  it('accepts the maximum fully encoded Claude choice group and retains a finite bound', async () => {
-    const maximumSelections = Array.from({ length: 4 }, (_, questionIndex) => ({
-      questionId: `q${questionIndex + 1}`,
-      optionIds: Array.from(
-        { length: 4 },
-        (_, optionIndex) => `q${questionIndex + 1}:choice-${optionIndex + 1}`
-      )
-    }))
-    const optionId = `question-group:${encodeURIComponent(JSON.stringify(maximumSelections))}`
-    expect(optionId.length).toBe(610)
-
-    const response = await call(
-      'agentSession.respondToQuestion',
-      {
-        envelope: envelope(),
-        itemId: 'item-1',
-        expectedRevision: 1,
-        optionId
-      },
-      STRUCTURED_CLIENT
-    )
-    expect(response).toMatchObject({ ok: true })
-    expect(hostCalls.respondToPrompt).toHaveBeenCalledWith(
-      expect.anything(),
-      expect.objectContaining({ optionId })
-    )
-
-    await rejects('agentSession.respondToQuestion', {
-      envelope: envelope(),
-      itemId: 'item-1',
-      expectedRevision: 1,
-      optionId: 'x'.repeat(1025)
-    })
-  })
-
   it('bounds a history page and validates its cursor', async () => {
     await rejects('agentSession.history', {
       sessionId: SESSION,
diff --git a/src/main/runtime/rpc/methods/structured-agent-session.ts b/src/main/runtime/rpc/methods/structured-agent-session.ts
index 66d44d4b7820..dc01a2fee8f1 100644
--- a/src/main/runtime/rpc/methods/structured-agent-session.ts
+++ b/src/main/runtime/rpc/methods/structured-agent-session.ts
@@ -5,6 +5,7 @@
 // not exist rather than receiving the journal or mutation surface. Session-tab
 // inventory may expose only a metadata placeholder for an incapable mobile client.
 
+import { agentSessionRefusalError } from '../../../../shared/agent-session-wire-refusals'
 import { agentSessionFingerprintConflict } from '../../../../shared/agent-session-mutation-envelope'
 import type { z } from 'zod'
 import {
@@ -18,6 +19,7 @@ import {
 import { defineMethod, defineStreamingMethod, type RpcContext } from '../core'
 import {
   ensureStructuredHostInstalled as ensureHostInstalled,
+  requireInstalledStructuredHost as requireInstalledHost,
   requireStructuredCapability,
   requireStructuredCleanupHost,
   requireStructuredHost as requireHost,
@@ -56,6 +58,7 @@ import {
   HandoffStatusParams,
   OptionsParams,
   RespondParams,
+  RespondToQuestionParams,
   RewindParams,
   SendParams,
   SetOptionParams,
@@ -74,7 +77,9 @@ async function resolveClientSuppliedAttach(params: z.infer<typeof AttachParams>,
   await ensureHostInstalled(ctx)
   const host = requireHost(ctx)
   if (!host.supportsCreate(params.location, params.agent)) {
-    throw new Error('structured_agent_session_unsupported')
+    throw agentSessionRefusalError('structured_agent_session_unsupported', {
+      reason: 'hostUnsupported'
+    })
   }
   const { agent: _attachAgent, provider: _attachProvider, ...attachWithoutAgent } = params
   const attachParams = {
@@ -129,7 +134,9 @@ export const STRUCTURED_AGENT_SESSION_METHODS = [
     params: CreateSupportParams,
     handler: async (params, ctx) => {
       if (!supportsStructuredSessions(ctx)) {
-        throw new Error('structured_agent_session_unsupported')
+        throw agentSessionRefusalError('structured_agent_session_unsupported', {
+          reason: 'clientCapabilityMissing'
+        })
       }
       return ctx.runtime.getStructuredAgentSessionCreateSupport(params.worktree, params.agent)
     }
@@ -140,7 +147,9 @@ export const STRUCTURED_AGENT_SESSION_METHODS = [
     handler: async (params, ctx) => {
       requireStructuredCapability(ctx)
       if (params.envelope.expectedRuntimeFence !== null) {
-        throw new Error('agent_session_operation_invalid')
+        throw agentSessionRefusalError('agent_session_operation_invalid', {
+          reason: 'requestMalformed'
+        })
       }
       // Everything up to `attach` is pre-commit, and answers with a refusal rather than a throw so
       // a client can tell "nothing was created" from "the outcome is unknown".
@@ -222,7 +231,7 @@ export const STRUCTURED_AGENT_SESSION_METHODS = [
   }),
   defineMethod({
     name: 'agentSession.respondToQuestion',
-    params: RespondParams,
+    params: RespondToQuestionParams,
     handler: async (params, ctx) =>
       requireHost(ctx).respondToPrompt(callerFor(ctx), { ...params, kind: 'question' })
   }),
@@ -234,19 +243,20 @@ export const STRUCTURED_AGENT_SESSION_METHODS = [
   defineMethod({
     name: 'agentSession.handoffStatus',
     params: HandoffStatusParams,
-    handler: async (params, ctx) => requireHost(ctx).handoffStatus(params.sessionId)
+    handler: async (params, ctx) =>
+      (await requireInstalledHost(ctx)).handoffStatus(params.sessionId)
   }),
   defineMethod({
     name: 'agentSession.commands',
     params: OptionsParams,
-    handler: async (params, ctx) => requireHost(ctx).readCommands(params.sessionId)
+    handler: async (params, ctx) => (await requireInstalledHost(ctx)).readCommands(params.sessionId)
   }),
   defineMethod({
     name: 'agentSession.history',
     params: HistoryParams,
     handler: async (params, ctx) =>
       projectTurnItemHistory(
-        projectBackgroundTaskHistory(requireHost(ctx).history(params), ctx),
+        projectBackgroundTaskHistory(await (await requireInstalledHost(ctx)).history(params), ctx),
         ctx
       )
   }),
@@ -254,25 +264,17 @@ export const STRUCTURED_AGENT_SESSION_METHODS = [
     name: 'agentSession.subscribe',
     params: SubscribeParams,
     handler: async (params, ctx, emit) => {
-      const host = requireHost(ctx)
+      const host = await requireInstalledHost(ctx)
       const subscriptionId = subscriptionIdFor(ctx, params.sessionId)
-      // A live stream is a surface too: it keeps a session from being evicted while it is read and
-      // releases that retention when the transport dies without a word.
-      //
-      // Retain-only: reading history must never be what starts a provider process. Current clients
-      // explicitly hold every open surface before subscribing.
-      const streamHolder = `subscription:${subscriptionId}`
+      // A stream reads; it never keeps an agent alive or starts one.
       let dispose = (): void => {}
-      const stream = bindStructuredAgentSessionStream(ctx, subscriptionId, () => {
-        dispose()
-        host.release(params.sessionId, streamHolder)
-      })
+      const stream = bindStructuredAgentSessionStream(ctx, subscriptionId, () => dispose())
       if (stream.isClosed()) {
         return
       }
-      // The host emits the opening snapshot (or the missed batch) synchronously
-      // inside open(), so nothing between here and there can interleave.
-      dispose = host.subscribe({
+      // Resolves once the conversation is open and the opening snapshot (or the missed batch) is
+      // emitted; a close that raced the open disposes what it bound.
+      dispose = await host.subscribe({
         id: subscriptionId,
         sessionId: params.sessionId,
         emit: (event) => emit(projectTurnItemEvent(projectBackgroundTaskEvent(event, ctx), ctx)),
@@ -280,14 +282,6 @@ export const STRUCTURED_AGENT_SESSION_METHODS = [
       })
       if (stream.isClosed()) {
         dispose()
-      } else {
-        // Fire-and-forget, but never unhandled: a resume that refuses leaves the stream holding a
-        // readable session, which is exactly what the client sees anyway.
-        void host
-          .hold(params.sessionId, streamHolder, { resume: false })
-          .catch((error: unknown) =>
-            console.warn('[agent-session] stream hold failed', params.sessionId, error)
-          )
       }
     }
   }),
diff --git a/src/main/runtime/rpc/methods/structured-chat-tab-table.test.ts b/src/main/runtime/rpc/methods/structured-chat-tab-table.test.ts
new file mode 100644
index 000000000000..f76b3ae6cb74
--- /dev/null
+++ b/src/main/runtime/rpc/methods/structured-chat-tab-table.test.ts
@@ -0,0 +1,409 @@
+/**
+ * A chat tab's pointer to the conversation it shows, driven end to end: a real record store on disk,
+ * the real structured host, the real runtime, and the real RPC handlers. Only the provider is faked.
+ */
+
+import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { computeAgentSessionPayloadFingerprint } from '../../../../shared/agent-session-mutation-envelope'
+import {
+  CLAUDE_STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY,
+  STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY
+} from '../../../../shared/protocol-version'
+import type { StructuredAgentSessionAdapter } from '../../../native-chat/agent-session-wire/structured-agent-session-adapter'
+import { StructuredAgentSessionHost } from '../../../native-chat/agent-session-wire/structured-agent-session-host'
+import {
+  HOST_TEST_LOCATION,
+  HOST_TEST_NOW,
+  HOST_TEST_SESSION,
+  hostTestAttachParams,
+  hostTestMessage,
+  hostTestOperationId,
+  resetHostTestOperationIds
+} from '../../../native-chat/agent-session-wire/structured-agent-session-host-test-data'
+import { setStructuredAgentSessionHost } from '../../../native-chat/agent-session-wire/structured-agent-session-registry'
+import { AgentSessionRecordStore } from '../../agent-session-record-store'
+import { agentSessionStorePath } from '../../agent-session-record-store-file'
+import { OrcaRuntimeService } from '../../orca-runtime'
+import { RpcDispatcher } from '../dispatcher'
+import type { RpcDispatchStreamingOptions } from '../dispatcher-stream-options'
+import { SESSION_TAB_METHODS } from './session-tabs'
+import { STRUCTURED_AGENT_SESSION_METHODS } from './structured-agent-session'
+import { commitStructuredAgentSessionCreate } from './structured-agent-session-create'
+import { closeStructuredAgentSessionChild } from '../../structured-agent-session-close'
+
+const WORKTREE = `id:${HOST_TEST_LOCATION.workspaceId}`
+const SOURCE_TAB = `structured-agent-session-${HOST_TEST_SESSION}`
+const caller = { callerKey: 'trusted-local:runtime' }
+
+let directory: string
+let store: AgentSessionRecordStore
+let host: StructuredAgentSessionHost
+let runtime: OrcaRuntimeService
+let dispatcher: RpcDispatcher
+let acquisitions = 0
+let acquireFails = false
+let closeSession: ReturnType<typeof vi.fn<() => Promise<boolean>>>
+
+function providerAdapter(): StructuredAgentSessionAdapter {
+  return {
+    supportsLocation: (location) =>
+      location.executionHostId === 'local' && location.wslDistro === null,
+    acquire: vi.fn(async (input) => {
+      if (acquireFails) {
+        throw new Error('provider failed to start')
+      }
+      acquisitions++
+      return {
+        process: {
+          hostId: 'local',
+          pid: 4000 + acquisitions,
+          processStartTimeMs: HOST_TEST_NOW,
+          spawnToken: input.spawnToken
+        },
+        link: {
+          linkId: `link-${acquisitions}`,
+          mintedAtFence: input.fence,
+          observedAt: HOST_TEST_NOW,
+          origin: 'created' as const,
+          handle: {
+            provider: 'codex' as const,
+            threadId: `00000000-0000-4000-8000-${String(acquisitions).padStart(12, '0')}`
+          }
+        }
+      }
+    }),
+    dispatch: vi.fn(async () => ({ state: 'admitted' as const })),
+    cancelTurn: vi.fn(async () => ({ cancelled: true })),
+    answerPrompt: async () => {},
+    setOption: async () => {},
+    releaseAcquisition: async () => true,
+    closeSession,
+    readOptions: async () => ({ models: [], current: { model: 'test-model', effort: 'high' } })
+  }
+}
+
+async function openHost(): Promise<void> {
+  store = await AgentSessionRecordStore.open({
+    directory: join(directory, 'store'),
+    hostId: 'local'
+  })
+  host = new StructuredAgentSessionHost({
+    store,
+    adapter: providerAdapter(),
+    journalRoot: directory,
+    claimKeyId: 'key',
+    now: () => HOST_TEST_NOW,
+    mintSpawnToken: () => `spawn-${acquisitions}`
+  })
+  setStructuredAgentSessionHost(host)
+}
+
+type CallResponse = {
+  ok: boolean
+  result?: { ok?: boolean; value?: { replacementSessionId?: string } }
+}
+
+async function call(
+  method: string,
+  params: unknown,
+  context: RpcDispatchStreamingOptions = {}
+): Promise<CallResponse> {
+  const response = await dispatcher.dispatch(
+    { id: 'request', authToken: 'token', method, params },
+    context
+  )
+  return JSON.parse(JSON.stringify(response))
+}
+
+async function createChat(sessionId: string, tabId?: string) {
+  return commitStructuredAgentSessionCreate({
+    runtime,
+    caller,
+    activate: true,
+    prepared: {
+      host,
+      attachParams: hostTestAttachParams(null, {
+        envelope: {
+          sessionId,
+          clientOperationId: hostTestOperationId(),
+          expectedRuntimeFence: null,
+          payloadFingerprint: ''
+        },
+        ...(tabId ? { surfaceTabId: tabId } : {})
+      }),
+      tab: { workspaceId: HOST_TEST_LOCATION.workspaceId, agent: 'codex' }
+    }
+  })
+}
+
+function envelopeFor(method: string, sessionId: string, fields: Record<string, unknown>) {
+  return {
+    sessionId,
+    clientOperationId: hostTestOperationId(),
+    expectedRuntimeFence: store.getRecord(sessionId)!.lease.runtimeFence,
+    payloadFingerprint: computeAgentSessionPayloadFingerprint({ method, sessionId, fields })
+  }
+}
+
+async function clear(sessionId: string): Promise<string> {
+  const response = await call('agentSession.conversationCommand', {
+    command: 'clear',
+    envelope: envelopeFor('agentSession.conversationCommand', sessionId, { command: 'clear' })
+  })
+  expect(response).toMatchObject({ ok: true, result: { ok: true } })
+  const replacement = response.result?.value?.replacementSessionId
+  expect(replacement).toBeDefined()
+  return replacement!
+}
+
+async function send(sessionId: string, text: string) {
+  const body = hostTestMessage(text)
+  return call('agentSession.send', {
+    body,
+    envelope: envelopeFor('agentSession.send', sessionId, { body })
+  })
+}
+
+async function snapshot() {
+  return runtime.listMobileSessionTabs(WORKTREE)
+}
+
+beforeEach(async () => {
+  resetHostTestOperationIds()
+  acquisitions = 0
+  acquireFails = false
+  closeSession = vi.fn(async () => true)
+  directory = await mkdtemp(join(tmpdir(), 'orca-chat-tab-table-'))
+  runtime = new OrcaRuntimeService()
+  vi.spyOn(runtime, 'getClientSettings').mockReturnValue(
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the structured-chat policy reads only this one setting on these paths.
+    { experimentalStructuredNativeChat: true } as ReturnType<
+      OrcaRuntimeService['getClientSettings']
+    >
+  )
+  dispatcher = new RpcDispatcher({
+    runtime,
+    methods: [...STRUCTURED_AGENT_SESSION_METHODS, ...SESSION_TAB_METHODS]
+  })
+  await openHost()
+})
+
+afterEach(async () => {
+  await host?.flushAllStreamedEvents()
+  setStructuredAgentSessionHost(null)
+  await rm(directory, { recursive: true, force: true })
+})
+
+describe('a chat tab across /clear', () => {
+  it('keeps sending through a second and third /clear, the tab following each replacement', async () => {
+    expect(await createChat(HOST_TEST_SESSION)).toMatchObject({ ok: true })
+    expect(store.getSessionTabId(HOST_TEST_SESSION)).toBe(SOURCE_TAB)
+    let current = HOST_TEST_SESSION
+    // A pending send blocks /clear by design, so the clears run back to back and the chat sends after.
+    for (let round = 0; round < 3; round++) {
+      const replacement = await clear(current)
+      expect(store.getSessionTabId(replacement)).toBe(SOURCE_TAB)
+      expect(store.getSessionTabId(current)).toBeNull()
+      current = replacement
+    }
+    expect(await send(current, 'after three clears')).toMatchObject({
+      ok: true,
+      result: { ok: true }
+    })
+    const tabs = (await snapshot()).tabs
+    expect(tabs).toHaveLength(1)
+    expect(tabs[0]).toMatchObject({ type: 'agent-session', sessionId: current })
+    expect(store.listVisibleSessionIds()).toEqual([current])
+  })
+
+  it('reveals a cleared conversation in its own tab without activating the current chat', async () => {
+    await createChat(HOST_TEST_SESSION)
+    const replacement = await clear(HOST_TEST_SESSION)
+
+    expect(await call('agentSession.reveal', { sessionId: HOST_TEST_SESSION })).toMatchObject({
+      ok: true
+    })
+
+    const revealedTabId = store.getSessionTabId(HOST_TEST_SESSION)
+    expect(revealedTabId).not.toBeNull()
+    expect(revealedTabId).not.toBe(SOURCE_TAB)
+    expect(revealedTabId).not.toContain(':')
+    expect(store.getSessionTabId(replacement)).toBe(SOURCE_TAB)
+    const published = await snapshot()
+    expect(published.tabs.map((tab) => tab.id)).toEqual([
+      `agent-session:${replacement}`,
+      `agent-session:${HOST_TEST_SESSION}`
+    ])
+    expect(published.activeTabId).toBe(`agent-session:${HOST_TEST_SESSION}`)
+  })
+
+  it('closes the cleared conversation and leaves the current chat and its tab', async () => {
+    await createChat(HOST_TEST_SESSION)
+    const replacement = await clear(HOST_TEST_SESSION)
+    await call('agentSession.reveal', { sessionId: HOST_TEST_SESSION })
+
+    expect(
+      await call('session.tabs.close', {
+        worktree: WORKTREE,
+        tabId: `agent-session:${HOST_TEST_SESSION}`,
+        reason: 'user'
+      })
+    ).toMatchObject({ ok: true })
+
+    expect(store.getSessionTabId(HOST_TEST_SESSION)).toBeNull()
+    expect(store.getSessionTabId(replacement)).toBe(SOURCE_TAB)
+    expect((await snapshot()).tabs.map((tab) => tab.id)).toEqual([`agent-session:${replacement}`])
+    expect(await send(replacement, 'still here')).toMatchObject({ ok: true, result: { ok: true } })
+  })
+
+  it('puts a cleared chat back under the tab id it had when its close does not land', async () => {
+    await createChat(HOST_TEST_SESSION)
+    const replacement = await clear(HOST_TEST_SESSION)
+    closeSession.mockResolvedValue(false)
+
+    const outcome = await closeStructuredAgentSessionChild(replacement)
+    expect(outcome).toMatchObject({ stopped: false })
+    expect(store.getSessionTabId(replacement)).toBe(SOURCE_TAB)
+    closeSession.mockResolvedValue(true)
+  })
+
+  it('keeps the tab id and its pointer across a restart', async () => {
+    await createChat(HOST_TEST_SESSION)
+    const replacement = await clear(await clear(HOST_TEST_SESSION))
+    await host.flushAllStreamedEvents()
+
+    await openHost()
+    expect(store.getSessionTabId(replacement)).toBe(SOURCE_TAB)
+    expect(host.getPersistedVisibleSessionTabIndex()).toEqual({
+      present: true,
+      sessionIds: [replacement]
+    })
+  })
+
+  it('gives a reopened cleared conversation the same id when an older build drops the table', async () => {
+    await createChat(HOST_TEST_SESSION)
+    const first = await clear(HOST_TEST_SESSION)
+    await call('agentSession.reveal', { sessionId: HOST_TEST_SESSION })
+    const current = await clear(first)
+    const reopenedTab = store.getSessionTabId(HOST_TEST_SESSION)
+    expect(reopenedTab).not.toBeNull()
+    await host.flushAllStreamedEvents()
+
+    // An older build rewrites the file from what it read, which drops the table.
+    const file = agentSessionStorePath(join(directory, 'store'))
+    const raw = JSON.parse(await readFile(file, 'utf-8'))
+    expect(raw.sessionTabs).toHaveLength(2)
+    delete raw.sessionTabs
+    await writeFile(file, JSON.stringify(raw))
+
+    await openHost()
+    expect(store.getSessionTabId(current)).toBe(SOURCE_TAB)
+    expect(store.getSessionTabId(HOST_TEST_SESSION)).toBe(reopenedTab)
+  })
+})
+
+describe('session tab mutations from other clients, unchanged by the table', () => {
+  it('reorders a group holding a chat for a paired client', async () => {
+    await createChat(HOST_TEST_SESSION)
+    await createChat('session-bravo')
+    const ids = (await snapshot()).tabs.map((tab) => tab.id)
+    const group = (await snapshot()).tabGroups![0]!
+
+    expect(
+      await call(
+        'session.tabs.move',
+        {
+          worktree: WORKTREE,
+          tabId: ids[1],
+          targetGroupId: group.id,
+          kind: 'reorder',
+          tabOrder: ids.toReversed()
+        },
+        {
+          clientKind: 'runtime',
+          clientCapabilities: [
+            STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY,
+            CLAUDE_STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY
+          ]
+        }
+      )
+    ).toMatchObject({ ok: true })
+    expect((await snapshot()).tabGroups![0]!.tabOrder).toEqual(ids.toReversed())
+  })
+
+  it('refuses an old mobile client closing a chat it may only view', async () => {
+    await createChat(HOST_TEST_SESSION)
+
+    const response = await call(
+      'session.tabs.close',
+      { worktree: WORKTREE, tabId: `agent-session:${HOST_TEST_SESSION}`, reason: 'user' },
+      { clientKind: 'mobile', clientCapabilities: [] }
+    )
+
+    expect(response.ok).toBe(false)
+    expect(store.getSessionTabId(HOST_TEST_SESSION)).toBe(SOURCE_TAB)
+    expect((await snapshot()).tabs).toHaveLength(1)
+  })
+})
+
+describe('a create that reserves its tab', () => {
+  it('answers with the reserved id and refuses a second chat under it', async () => {
+    expect(await createChat(HOST_TEST_SESSION, 'reserved-tab')).toMatchObject({
+      ok: true,
+      value: { tabId: 'reserved-tab' }
+    })
+    expect(await createChat('session-bravo', 'reserved-tab')).toMatchObject({
+      ok: false,
+      refusal: { code: 'agent_session_conflict' }
+    })
+    expect(store.getSessionTabId(HOST_TEST_SESSION)).toBe('reserved-tab')
+    expect(store.getRecord('session-bravo')).toBeNull()
+  })
+
+  it('answers a create that reserved nothing with the id its tab was given', async () => {
+    expect(await createChat(HOST_TEST_SESSION)).toMatchObject({
+      ok: true,
+      value: { tabId: SOURCE_TAB }
+    })
+  })
+
+  it('restores no tab for a reserved create that stopped before its tab was published', async () => {
+    const attached = await host.attach(
+      caller,
+      hostTestAttachParams(null, {
+        envelope: {
+          sessionId: HOST_TEST_SESSION,
+          clientOperationId: hostTestOperationId(),
+          expectedRuntimeFence: null,
+          payloadFingerprint: ''
+        },
+        surfaceTabId: 'reserved-tab'
+      })
+    )
+    expect(attached).toMatchObject({ ok: true })
+    await host.flushAllStreamedEvents()
+
+    await openHost()
+    expect(host.getPersistedVisibleSessionTabIndex().sessionIds).toEqual([])
+    expect(await createChat('session-bravo', 'reserved-tab')).toMatchObject({
+      ok: true,
+      value: { tabId: 'reserved-tab' }
+    })
+  })
+
+  it('leaves no tab behind when the create fails, so nothing is restored and the id is free', async () => {
+    acquireFails = true
+    expect(await createChat(HOST_TEST_SESSION, 'reserved-tab')).toMatchObject({ ok: false })
+    expect(store.getSessionTabId(HOST_TEST_SESSION)).toBeNull()
+    expect(store.listVisibleSessionIds()).toEqual([])
+
+    acquireFails = false
+    expect(await createChat('session-bravo', 'reserved-tab')).toMatchObject({
+      ok: true,
+      value: { tabId: 'reserved-tab' }
+    })
+  })
+})
diff --git a/src/main/runtime/rpc/methods/structured-session-tab-restore.ts b/src/main/runtime/rpc/methods/structured-session-tab-restore.ts
index f9efa46d16d8..6ec962414229 100644
--- a/src/main/runtime/rpc/methods/structured-session-tab-restore.ts
+++ b/src/main/runtime/rpc/methods/structured-session-tab-restore.ts
@@ -11,14 +11,16 @@ import {
  *  project after a desktop restart — no chat and no prompt. The setting still gates it, because
  *  with structured chat off there is nothing for any mobile client to reach. Restoring spawns no
  *  provider child for a cleanly closed session. */
-export async function restoreStructuredTabsIfSupported(
+export function restoreStructuredTabsIfSupported(
   context: Pick<RpcContext, 'runtime' | 'clientKind' | 'clientCapabilities'>
-): Promise<void> {
+): Promise<void> | undefined {
   const shouldRestore =
     context.clientKind === 'mobile'
       ? isStructuredNativeChatEnabled(context.runtime)
       : supportsStructuredAgentSessions(context)
   if (shouldRestore && typeof context.runtime.restoreStructuredAgentSessionTabs === 'function') {
-    await context.runtime.restoreStructuredAgentSessionTabs()
+    return context.runtime.restoreStructuredAgentSessionTabs()
   }
+  // Nothing to restore: callers skip the await, so a stream's setup keeps its timing.
+  return undefined
 }
diff --git a/src/main/runtime/rpc/methods/structured-worker-read-cursor.test.ts b/src/main/runtime/rpc/methods/structured-worker-read-cursor.test.ts
index 1a97223bc395..b376f2c80d9e 100644
--- a/src/main/runtime/rpc/methods/structured-worker-read-cursor.test.ts
+++ b/src/main/runtime/rpc/methods/structured-worker-read-cursor.test.ts
@@ -79,7 +79,7 @@ function read(cursor?: string, limit?: number) {
   })
 }
 
-function textsOf(result: ReturnType<typeof read>): string[] {
+function textsOf(result: Awaited<ReturnType<typeof read>>): string[] {
   return result.transcript.messages.map((entry) =>
     entry.blocks.map((block) => ('text' in block ? block.text : '')).join('')
   )
@@ -90,57 +90,57 @@ describe('the structured worker-read cursor over a mutating journal', () => {
     hostRef.current = null
   })
 
-  it('refuses to resume when an already-delivered item was revised in place', () => {
+  it('refuses to resume when an already-delivered item was revised in place', async () => {
     // The `"hel"` / `"hello"` defect. The caller is handed a coalesced snapshot, resumes past it,
     // and the item is later revised at its original sequence — under the old anchor the resume was
     // accepted and that revision was never delivered to anyone.
     installJournal([message('i1', 'hel'), message('i2', 'second')])
-    const first = read(undefined, 1)
+    const first = await read(undefined, 1)
     expect(textsOf(first)).toEqual(['hel'])
 
     installJournal([message('i1', 'hello world', 2), message('i2', 'second')])
-    expect(() => read(first.cursor)).toThrow(/source changed/i)
+    await expect(read(first.cursor)).rejects.toThrow(/source changed/i)
   })
 
-  it('refuses to resume when a resolved prompt inserts ahead of the caller position', () => {
+  it('refuses to resume when a resolved prompt inserts ahead of the caller position', async () => {
     // Duplication. A pending approval projects to null, so resolving it inserts a message in the
     // MIDDLE; the oldest item never moved, so the old anchor accepted a now-stale index and the
     // caller re-read content it already had.
     installJournal([message('i1', 'first'), approval('i2', false), message('i3', 'second')])
-    const first = read(undefined, 2)
+    const first = await read(undefined, 2)
     expect(textsOf(first)).toEqual(['first', 'second'])
 
     installJournal([message('i1', 'first'), approval('i2', true, 2), message('i3', 'second')])
-    expect(() => read(first.cursor)).toThrow(/source changed/i)
+    await expect(read(first.cursor)).rejects.toThrow(/source changed/i)
   })
 
-  it('still resumes across a page boundary when only unread tail items change', () => {
+  it('still resumes across a page boundary when only unread tail items change', async () => {
     // The reason this is prefix-scoped and not whole-page: during an active turn the coalescer
     // revises the streaming item every 60ms. Fingerprinting the whole page would invalidate the
     // cursor continuously — a useless verb — while the worker is working.
     installJournal([message('i1', 'first'), message('i2', 'streaming')])
-    const first = read(undefined, 1)
+    const first = await read(undefined, 1)
     expect(textsOf(first)).toEqual(['first'])
 
     installJournal([message('i1', 'first'), message('i2', 'streaming more', 7)])
-    const second = read(first.cursor)
+    const second = await read(first.cursor)
     expect(textsOf(second)).toEqual(['streaming more'])
   })
 
-  it('delivers every message exactly once when nothing below the cursor changes', () => {
+  it('delivers every message exactly once when nothing below the cursor changes', async () => {
     // The property the two refusals above protect: no omission, no duplication.
     installJournal([message('i1', 'a'), message('i2', 'b'), message('i3', 'c')])
-    const first = read(undefined, 2)
-    const second = read(first.cursor, 2)
+    const first = await read(undefined, 2)
+    const second = await read(first.cursor, 2)
     expect([...textsOf(first), ...textsOf(second)]).toEqual(['a', 'b', 'c'])
   })
 
-  it('still refuses when the window slides off the front', () => {
+  it('still refuses when the window slides off the front', async () => {
     // The case the old anchor DID catch, and which the prefix scoping must not lose: a slide
     // shifts every index.
     installJournal([message('i1', 'a'), message('i2', 'b')])
-    const first = read(undefined, 1)
+    const first = await read(undefined, 1)
     installJournal([message('i2', 'b'), message('i3', 'c')])
-    expect(() => read(first.cursor)).toThrow(/source changed/i)
+    await expect(read(first.cursor)).rejects.toThrow(/source changed/i)
   })
 })
diff --git a/src/main/runtime/rpc/methods/terminal/terminal-input-delivery.ts b/src/main/runtime/rpc/methods/terminal/terminal-input-delivery.ts
index 7313eb82b944..59fd827f0ce1 100644
--- a/src/main/runtime/rpc/methods/terminal/terminal-input-delivery.ts
+++ b/src/main/runtime/rpc/methods/terminal/terminal-input-delivery.ts
@@ -1,9 +1,5 @@
 import { InvalidArgumentError } from '../../core'
-import type {
-  DriverState,
-  OrcaRuntimeService,
-  SubscriptionRegistration
-} from '../../../orca-runtime'
+import type { DriverState, OrcaRuntimeService } from '../../../orca-runtime'
 import {
   TERMINAL_INPUT_MAX_BYTES,
   TERMINAL_INPUT_TOO_LARGE_ERROR,
@@ -51,45 +47,6 @@ export function resolveMobileFloorClientId(
 
 export type TerminalStreamInputOutcome = 'delivered' | 'rejected' | 'failed'
 
-export function watchSubscriptionLifetime(
-  runtime: OrcaRuntimeService,
-  ptyId: string,
-  signal: AbortSignal | undefined,
-  registration: SubscriptionRegistration
-): () => void {
-  let unsubscribeExit: (() => void) | null = null
-  let removeAbort: (() => void) | null = null
-  let stopped = false
-  const stop = (): void => {
-    stopped = true
-    unsubscribeExit?.()
-    removeAbort?.()
-  }
-  const release = (): void => {
-    registration.releaseIfCurrent()
-    stop()
-  }
-  unsubscribeExit = runtime.subscribeToPtyExit(ptyId, release)
-  if (stopped) {
-    unsubscribeExit()
-    return stop
-  }
-  if (!signal) {
-    return stop
-  }
-  if (signal.aborted) {
-    release()
-    return stop
-  }
-  const onAbort = (): void => release()
-  removeAbort = () => signal.removeEventListener('abort', onAbort)
-  signal.addEventListener('abort', onAbort, { once: true })
-  if (stopped) {
-    removeAbort()
-  }
-  return stop
-}
-
 export function isTerminalStreamInputRejection(error: unknown): boolean {
   const message = error instanceof Error ? error.message : String(error)
   return message.includes('terminal_not_writable') || message.includes('terminal_handle_stale')
@@ -109,10 +66,11 @@ export async function sendTerminalStreamInput(
   const floorClaim: MobileInputFloorClaimHolder = { current: null }
   try {
     if (!clientId) {
-      const result = await runtime.sendTerminal(args.terminal, action)
+      const result = await runtime.sendTerminal(args.terminal, action, { inputKind: 'driving' })
       return result.accepted ? 'delivered' : 'rejected'
     }
     const result = await runtime.sendTerminal(args.terminal, action, {
+      inputKind: 'driving',
       reserveWrite: (writePtyId) => {
         const claim = runtime.beginMobileInputFloor(writePtyId, clientId)
         if (!claim) {
diff --git a/src/main/runtime/rpc/methods/terminal/terminal-legacy-simple-subscriptions.ts b/src/main/runtime/rpc/methods/terminal/terminal-legacy-simple-subscriptions.ts
index ad4c7dd05da9..a9bcf1af6957 100644
--- a/src/main/runtime/rpc/methods/terminal/terminal-legacy-simple-subscriptions.ts
+++ b/src/main/runtime/rpc/methods/terminal/terminal-legacy-simple-subscriptions.ts
@@ -3,182 +3,115 @@ import type { TerminalOutputBatcher } from './terminal-output-batcher'
 import { isTerminalReadPayloadIncomplete } from './terminal-stream-replay'
 import { serializeBudgetedMobileSnapshot } from './terminal-snapshot-publication'
 import { updateViewportForClient } from './terminal-viewport-update'
-import { watchSubscriptionLifetime } from './terminal-input-delivery'
 import type { TerminalSubscriptionArgs } from './terminal-legacy-subscription-types'
 import { allocateTerminalSubscriptionStreamId } from './terminal-subscription-stream-id'
 
 export async function runTerminalLeaseSubscription(args: TerminalSubscriptionArgs): Promise<void> {
-  const { params, runtime, connectionId, signal, emit, ptyId, clientId } = args
+  const { registration, emit, ptyId, clientId } = args
   if (!clientId) {
     return
   }
-  let closed = false
-  let stopWatchingLifetime = (): void => {}
   let resolveStream = (): void => {}
   const streamClosed = new Promise<void>((resolve) => {
     resolveStream = resolve
   })
-  const subscriptionId = `${params.terminal}:${clientId}`
+  registration.setTeardown(resolveStream)
   // Why: chat needs the input-floor ack without registering a view subscriber or transporting duplicate PTY output.
-  const registration = runtime.registerOwnedSubscriptionCleanup(
-    subscriptionId,
-    () => {
-      stopWatchingLifetime()
-      closed = true
-      runtime.handleMobileUnsubscribe(ptyId, clientId)
-      emit({ type: 'end' })
-      resolveStream()
-    },
-    connectionId
-  )
-  stopWatchingLifetime = watchSubscriptionLifetime(runtime, ptyId, signal, registration)
-  if (closed) {
-    // Why: an already-exited pty releases synchronously, so cleanup ran before this setup registers anything.
+  // A lease-only subscriber has no terminal view, so its cached viewport must never phone-fit the PTY.
+  await registration.addMobilePresence(ptyId, clientId, undefined)
+  if (registration.released) {
     return
   }
-  try {
-    // Why: a lease-only subscriber has no terminal view, so its cached viewport must never phone-fit the PTY.
-    await runtime.handleMobileSubscribe(ptyId, clientId, undefined)
-    if (closed || signal?.aborted) {
-      // Why: a disconnect can win the awaited subscribe and resurrect mobile presence after cleanup already released it.
-      // Unguarded on purpose: this must still fire when our own cleanup already ran.
-      // Safe only because lease-only passes no viewport and both !viewport paths in
-      // handleMobileSubscribeInternal return with no await, so no rebind can land
-      // first. Adding an await there — or passing a viewport here — makes a
-      // superseded handler delete the replacement's (ptyId, clientId) presence.
-      runtime.handleMobileUnsubscribe(ptyId, clientId)
-      if (!closed) {
-        registration.releaseIfCurrent()
-      }
-      return
-    }
-    emit({ type: 'subscribed', streamId: null, lines: [], truncated: false })
-    await streamClosed
-  } catch (error) {
-    registration.releaseIfCurrent()
-    throw error
-  }
+  emit({ type: 'subscribed', streamId: null, lines: [], truncated: false })
+  await streamClosed
 }
 
 export async function runTerminalJsonSubscription(args: TerminalSubscriptionArgs): Promise<void> {
-  const {
-    params,
-    runtime,
-    connectionId,
-    signal,
-    emit,
-    ptyId,
-    clientId,
-    supportsDesktopViewportClaims
-  } = args
+  const { params, runtime, registration, emit, ptyId, clientId, supportsDesktopViewportClaims } =
+    args
   // Why: only unregister the width floor this subscription took (see the multiplex stream's registeredRemoteDesktopDriver note).
   let registeredRemoteDesktopDriver = false
-
-  // Why: a hidden watcher and a visible pane can subscribe to one terminal, so key by client so neither stream evicts the other.
-  const subscriptionId = clientId ? `${params.terminal}:${clientId}` : params.terminal
   const remoteDesktopSubscriptionKey = `json:${allocateTerminalSubscriptionStreamId()}`
-  let closed = false
   let outputBatcher: TerminalOutputBatcher | null = null
   let unsubscribeData = (): void => {}
   let unsubscribeFit = (): void => {}
-  let stopWatchingLifetime = (): void => {}
   let resolveStream = (): void => {}
   const streamClosed = new Promise<void>((resolve) => {
     resolveStream = resolve
   })
-  // Why: register before viewport/snapshot awaits so a socket close can't orphan the stream listeners or its remote-desktop width floor.
-  const registration = runtime.registerOwnedSubscriptionCleanup(
-    subscriptionId,
-    () => {
-      stopWatchingLifetime()
-      closed = true
-      outputBatcher?.flush()
-      outputBatcher?.dispose()
-      unsubscribeData()
-      unsubscribeFit()
-      if (registeredRemoteDesktopDriver && clientId) {
-        runtime.unregisterRemoteDesktopViewer(ptyId, remoteDesktopSubscriptionKey)
-      }
-      emit({ type: 'end' })
-      resolveStream()
-    },
-    connectionId
-  )
-  stopWatchingLifetime = watchSubscriptionLifetime(runtime, ptyId, signal, registration)
-  if (closed) {
-    // Why: an already-exited pty releases synchronously, so cleanup ran before this setup registers anything.
+  registration.setTeardown(() => {
+    outputBatcher?.flush()
+    outputBatcher?.dispose()
+    unsubscribeData()
+    unsubscribeFit()
+    if (registeredRemoteDesktopDriver && clientId) {
+      runtime.unregisterRemoteDesktopViewer(ptyId, remoteDesktopSubscriptionKey)
+    }
+    resolveStream()
+  })
+  if (clientId && params.client && params.viewport) {
+    registeredRemoteDesktopDriver = true
+    await updateViewportForClient(
+      runtime,
+      ptyId,
+      remoteDesktopSubscriptionKey,
+      params.client,
+      params.viewport,
+      'desktop',
+      'register',
+      !supportsDesktopViewportClaims
+    )
+  }
+  if (registration.released) {
     return
   }
-  try {
-    if (clientId && params.client && params.viewport) {
-      registeredRemoteDesktopDriver = true
-      await updateViewportForClient(
-        runtime,
-        ptyId,
-        remoteDesktopSubscriptionKey,
-        params.client,
-        params.viewport,
-        'desktop',
-        'register',
-        !supportsDesktopViewportClaims
-      )
-    }
-    if (closed || signal?.aborted) {
-      registration.releaseIfCurrent()
-      return
-    }
-    const read = await runtime.readTerminal(params.terminal)
-    const serialized = await serializeBudgetedMobileSnapshot(runtime, ptyId, false)
-    if (closed || signal?.aborted) {
-      registration.releaseIfCurrent()
-      return
-    }
-    const size = runtime.getTerminalSize(ptyId)
-    const displayMode = runtime.getMobileDisplayMode(ptyId)
-    const seq = runtime.getLayout(ptyId)?.seq
+  const read = await runtime.readTerminal(params.terminal)
+  const serialized = await serializeBudgetedMobileSnapshot(runtime, ptyId, false)
+  if (registration.released) {
+    return
+  }
+  const size = runtime.getTerminalSize(ptyId)
+  const displayMode = runtime.getMobileDisplayMode(ptyId)
+  const seq = runtime.getLayout(ptyId)?.seq
+  emit({
+    type: 'scrollback',
+    lines: read.tail,
+    truncated: isTerminalReadPayloadIncomplete(read),
+    serialized: serialized?.data,
+    oscLinks: serialized?.oscLinks,
+    cwd: serialized?.cwd,
+    // Why: an empty snapshot with no PTY size must still report the dims the fit
+    // will produce — dimless frames re-armed the mobile fit loop (STA-3337).
+    cols: serialized?.cols ?? size?.cols ?? params.viewport?.cols,
+    rows: serialized?.rows ?? size?.rows ?? params.viewport?.rows,
+    displayMode,
+    seq
+  })
+  outputBatcher = createTerminalOutputBatcher((chunk) => {
+    emit({ type: 'data', chunk })
+  })
+  const unsubscribeStreamData = runtime.subscribeToTerminalData(ptyId, (data) => {
+    outputBatcher?.push(data)
+  })
+  // Why: the legacy JSON stream can feed a live xterm view, so register as a view subscriber; worst case is a withheld model reply, safer than a double reply.
+  const releaseViewSubscriber = runtime.registerRemoteTerminalViewSubscriber(ptyId)
+  unsubscribeData = () => {
+    releaseViewSubscriber()
+    unsubscribeStreamData()
+  }
+  unsubscribeFit = runtime.subscribeToFitOverrideChanges(ptyId, (event) => {
+    outputBatcher?.flush()
+    const mode =
+      event.mode === 'mobile-fit'
+        ? event.mode
+        : (runtime.getRemoteDesktopFitHold?.(ptyId, remoteDesktopSubscriptionKey).mode ??
+          'desktop-fit')
     emit({
-      type: 'scrollback',
-      lines: read.tail,
-      truncated: isTerminalReadPayloadIncomplete(read),
-      serialized: serialized?.data,
-      oscLinks: serialized?.oscLinks,
-      cwd: serialized?.cwd,
-      // Why: an empty snapshot with no PTY size must still report the dims the fit
-      // will produce — dimless frames re-armed the mobile fit loop (STA-3337).
-      cols: serialized?.cols ?? size?.cols ?? params.viewport?.cols,
-      rows: serialized?.rows ?? size?.rows ?? params.viewport?.rows,
-      displayMode,
-      seq
-    })
-    outputBatcher = createTerminalOutputBatcher((chunk) => {
-      emit({ type: 'data', chunk })
+      type: 'fit-override-changed',
+      mode,
+      cols: event.cols,
+      rows: event.rows
     })
-    const unsubscribeStreamData = runtime.subscribeToTerminalData(ptyId, (data) => {
-      outputBatcher?.push(data)
-    })
-    // Why: the legacy JSON stream can feed a live xterm view, so register as a view subscriber; worst case is a withheld model reply, safer than a double reply.
-    const releaseViewSubscriber = runtime.registerRemoteTerminalViewSubscriber(ptyId)
-    unsubscribeData = () => {
-      releaseViewSubscriber()
-      unsubscribeStreamData()
-    }
-    unsubscribeFit = runtime.subscribeToFitOverrideChanges(ptyId, (event) => {
-      outputBatcher?.flush()
-      const mode =
-        event.mode === 'mobile-fit'
-          ? event.mode
-          : (runtime.getRemoteDesktopFitHold?.(ptyId, remoteDesktopSubscriptionKey).mode ??
-            'desktop-fit')
-      emit({
-        type: 'fit-override-changed',
-        mode,
-        cols: event.cols,
-        rows: event.rows
-      })
-    })
-    await streamClosed
-  } catch (error) {
-    registration.releaseIfCurrent()
-    throw error
-  }
+  })
+  await streamClosed
 }
diff --git a/src/main/runtime/rpc/methods/terminal/terminal-legacy-subscribe-binary.ts b/src/main/runtime/rpc/methods/terminal/terminal-legacy-subscribe-binary.ts
index 08639f16f48f..35d40a2d9485 100644
--- a/src/main/runtime/rpc/methods/terminal/terminal-legacy-subscribe-binary.ts
+++ b/src/main/runtime/rpc/methods/terminal/terminal-legacy-subscribe-binary.ts
@@ -13,7 +13,6 @@ import {
 import { TERMINAL_MULTIPLEX_PENDING_MAX_BYTES } from '../../../../../shared/terminal-multiplex-flow-control'
 import { measureTerminalStreamByteLength } from '../../terminal-stream-byte-length'
 import { createTerminalOutputBatcher, type TerminalOutputBatcher } from './terminal-output-batcher'
-import { watchSubscriptionLifetime } from './terminal-input-delivery'
 import { trimPendingOutputToBudget } from './terminal-stream-replay'
 import { allocateTerminalSubscriptionStreamId } from './terminal-subscription-stream-id'
 import type {
@@ -26,8 +25,7 @@ import { activateLegacyBinarySubscription } from './terminal-legacy-subscribe-li
 import { registerLegacyBinaryControlFrames } from './terminal-legacy-binary-control-frames'
 const TERMINAL_QUERY_REPLAY_MAX_CHARS = 16 * 1024
 export async function runTerminalBinarySubscription(args: TerminalSubscriptionArgs): Promise<void> {
-  const { params, runtime, connectionId, sendBinary, signal, emit, ptyId, clientId, isMobile } =
-    args
+  const { runtime, registration, sendBinary, ptyId, clientId, isMobile } = args
   if (!sendBinary) {
     throw new Error('binary_terminal_stream_required')
   }
@@ -53,40 +51,28 @@ export async function runTerminalBinarySubscription(args: TerminalSubscriptionAr
   let unsubscribeFit = (): void => {}
   let unregisterBinaryHandler = (): void => {}
   let abortRendererMountWait = (): void => {}
-  let stopWatchingLifetime = (): void => {}
   let lateRendererReadyPromise: Promise<boolean> | null = null
   let outputBatcher: TerminalOutputBatcher | null = null
   let resolveStream = (): void => {}
   const streamClosed = new Promise<void>((resolve) => {
     resolveStream = resolve
   })
-  // Why: register cleanup before any await so a mid-subscribe disconnect still removes mobile presence; client-scoped ids also allow parallel desktop subscribers.
-  const subscriptionId = clientId ? `${params.terminal}:${clientId}` : params.terminal
-  const registration = runtime.registerOwnedSubscriptionCleanup(
-    subscriptionId,
-    () => {
-      stopWatchingLifetime()
-      outputBatcher?.flush()
-      outputBatcher?.dispose()
-      closed = true
-      unsubscribeData()
-      unsubscribeResize()
-      unsubscribeFit()
-      unregisterBinaryHandler()
-      abortRendererMountWait()
-      if (isMobile && clientId) {
-        runtime.handleMobileUnsubscribe(ptyId, clientId)
-      } else if (registeredRemoteDesktopDriver && clientId) {
-        runtime.unregisterRemoteDesktopViewer(ptyId, remoteDesktopSubscriptionKey)
-      }
-      emit({ type: 'end' })
-      resolveStream()
-    },
-    connectionId
-  )
-  stopWatchingLifetime = watchSubscriptionLifetime(runtime, ptyId, signal, registration)
-  if (closed) {
-    // Why: an already-exited pty releases synchronously, so cleanup ran before this setup registers anything.
+  registration.setTeardown(() => {
+    outputBatcher?.flush()
+    outputBatcher?.dispose()
+    closed = true
+    unsubscribeData()
+    unsubscribeResize()
+    unsubscribeFit()
+    unregisterBinaryHandler()
+    abortRendererMountWait()
+    // Why: phone presence belongs to the registration; only a desktop viewer owns a width floor here.
+    if (!isMobile && registeredRemoteDesktopDriver && clientId) {
+      runtime.unregisterRemoteDesktopViewer(ptyId, remoteDesktopSubscriptionKey)
+    }
+    resolveStream()
+  })
+  if (registration.released) {
     return
   }
   const sendFrame = (
@@ -268,19 +254,13 @@ export async function runTerminalBinarySubscription(args: TerminalSubscriptionAr
       registeredRemoteDesktopDriver = value
     },
     displayMode: 'auto',
-    registration,
     streamClosed,
     sendFrame
   }
-  try {
-    await publishLegacyBinaryInitialSnapshot(args, state)
-    if (state.closed || signal?.aborted) {
-      return
-    }
-    activateLegacyBinarySubscription(args, state)
-  } catch (error) {
-    registration.releaseIfCurrent()
-    throw error
+  await publishLegacyBinaryInitialSnapshot(args, state)
+  if (registration.released) {
+    return
   }
+  activateLegacyBinarySubscription(args, state)
   await streamClosed
 }
diff --git a/src/main/runtime/rpc/methods/terminal/terminal-legacy-subscribe-snapshot.ts b/src/main/runtime/rpc/methods/terminal/terminal-legacy-subscribe-snapshot.ts
index 7b9d45d144ca..5202804c0d5e 100644
--- a/src/main/runtime/rpc/methods/terminal/terminal-legacy-subscribe-snapshot.ts
+++ b/src/main/runtime/rpc/methods/terminal/terminal-legacy-subscribe-snapshot.ts
@@ -24,7 +24,7 @@ export async function publishLegacyBinaryInitialSnapshot(
   const {
     params,
     runtime,
-    signal,
+    registration,
     sendBinary,
     emit,
     ptyId,
@@ -34,8 +34,9 @@ export async function publishLegacyBinaryInitialSnapshot(
     rendererMountRequestedBeforePty,
     serializerGenerationBeforeMobileFit
   } = args
+  const { signal } = registration
   if (isMobile && clientId) {
-    await runtime.handleMobileSubscribe(ptyId, clientId, params.viewport)
+    await registration.addMobilePresence(ptyId, clientId, params.viewport)
   } else if (clientId && params.viewport) {
     // Why: legacy subscribe records geometry without taking ownership; only an explicit activity/claim frame may suppress the host.
     state.registeredRemoteDesktopDriver = true
@@ -60,20 +61,28 @@ export async function publishLegacyBinaryInitialSnapshot(
   if (state.closed) {
     return
   }
-  // Why: missing model state (not blank snapshot text) signals a never-attached PTY; a renderer-sourced snapshot already proves attachment, so skip the remount.
+  // Why: missing model state (not blank snapshot text) signals a never-attached PTY; any renderer answer proves a pane, and the answer is null when the host's flag is unset or stale after a pane closed over a live PTY, which falls back to the mount wait.
+  const needsRendererScreen =
+    missingHeadlessStateBeforeMobileFit && serialized?.source !== 'renderer'
+  let rendererReady =
+    needsRendererScreen &&
+    (await runtime.serializeRendererTerminalBuffer(ptyId, { scrollbackRows: 0 })) !== null
+  if (state.closed) {
+    return
+  }
   const mountRequested =
-    missingHeadlessStateBeforeMobileFit &&
-    serialized?.source !== 'renderer' &&
+    needsRendererScreen &&
+    !rendererReady &&
     (rendererMountRequestedBeforePty || runtime.requestRendererTerminalTabMount(params.terminal))
-  if (missingHeadlessStateBeforeMobileFit && mountRequested) {
+  if (mountRequested) {
     // Why: an idle legacy PTY emits no later byte, so wait for a settle proving this remount completed before replaying its screen.
     const mountWaitController = new AbortController()
     const abortMountWait = (): void => mountWaitController.abort()
     state.abortRendererMountWait = abortMountWait
-    if (signal?.aborted) {
+    if (signal.aborted) {
       abortMountWait()
     } else {
-      signal?.addEventListener('abort', abortMountWait, { once: true })
+      signal.addEventListener('abort', abortMountWait, { once: true })
     }
     const rendererReadyPromise = runtime
       .waitForRendererTerminalSerializer(
@@ -84,7 +93,7 @@ export async function publishLegacyBinaryInitialSnapshot(
       )
       .catch(() => false)
     const finishMountWait = (): void => {
-      signal?.removeEventListener('abort', abortMountWait)
+      signal.removeEventListener('abort', abortMountWait)
       if (state.abortRendererMountWait === abortMountWait) {
         state.abortRendererMountWait = () => {}
       }
@@ -97,43 +106,49 @@ export async function publishLegacyBinaryInitialSnapshot(
         deadlineTimer.unref()
       }
     })
-    const rendererReady = await Promise.race([rendererReadyPromise, initialDeadline])
+    rendererReady = await Promise.race([rendererReadyPromise, initialDeadline])
     if (deadlineTimer) {
       clearTimeout(deadlineTimer)
     }
-    if (state.closed || signal?.aborted) {
+    if (state.closed || signal.aborted) {
       return
     }
-    if (rendererReady) {
-      read = await runtime.readTerminal(params.terminal)
-      const stableRendererSnapshot = await serializeStableMobileRendererSnapshot(
-        runtime,
-        ptyId,
-        // The same frame, because this snapshot is published by the scrollback send below rather
-        // than by one of its own: the `resized` it used to name is a frame nothing here sends.
-        mobileSnapshotByteBudget(params.snapshotByteBudget, state.streamId, scrollbackFrame)
-      )
-      if (state.closed) {
-        return
-      }
-      if (stableRendererSnapshot?.data.length) {
-        serialized = stableRendererSnapshot
-        const trailingOutput = state.pendingOutput.flatMap((item) => {
-          const output = getOutputAfterSnapshotSeq(item, stableRendererSnapshot.seq)
-          const seq = item.meta?.seq
-          return output && typeof seq === 'number' ? [{ data: output.data, seq }] : []
-        })
-        runtime.replaceHeadlessTerminalFromRendererSnapshotForRecovery(
-          ptyId,
-          stableRendererSnapshot,
-          trailingOutput
-        )
-      }
-    } else {
+    if (!rendererReady) {
       // Why: a renderer can settle after the bounded initial response; keep observing so an idle PTY self-heals without bytes.
       state.lateRendererReadyPromise = rendererReadyPromise
     }
   }
+  if (rendererReady) {
+    read = await runtime.readTerminal(params.terminal)
+    const stableRendererSnapshot = await serializeStableMobileRendererSnapshot(
+      runtime,
+      ptyId,
+      // The same frame, because this snapshot is published by the scrollback send below rather
+      // than by one of its own: the `resized` it used to name is a frame nothing here sends.
+      mobileSnapshotByteBudget(params.snapshotByteBudget, state.streamId, scrollbackFrame)
+    )
+    if (state.closed) {
+      return
+    }
+    // Why: a blank screen may be a parked pane that has not hydrated, and a seq-less screen has no
+    // seam against buffered output, so it is safe only when nothing is pending to replay twice.
+    if (
+      stableRendererSnapshot?.data.length &&
+      (typeof stableRendererSnapshot.seq === 'number' || state.pendingOutput.length === 0)
+    ) {
+      serialized = stableRendererSnapshot
+      const trailingOutput = state.pendingOutput.flatMap((item) => {
+        const output = getOutputAfterSnapshotSeq(item, stableRendererSnapshot.seq)
+        const seq = item.meta?.seq
+        return output && typeof seq === 'number' ? [{ data: output.data, seq }] : []
+      })
+      runtime.replaceHeadlessTerminalFromRendererSnapshotForRecovery(
+        ptyId,
+        stableRendererSnapshot,
+        trailingOutput
+      )
+    }
+  }
   let initialOutputOverflowed = false
   if (state.pendingOutputOverflowed) {
     state.pendingOutput.splice(0)
diff --git a/src/main/runtime/rpc/methods/terminal/terminal-legacy-subscription-types.ts b/src/main/runtime/rpc/methods/terminal/terminal-legacy-subscription-types.ts
index d9eb624f0e16..595a65a5eeb4 100644
--- a/src/main/runtime/rpc/methods/terminal/terminal-legacy-subscription-types.ts
+++ b/src/main/runtime/rpc/methods/terminal/terminal-legacy-subscription-types.ts
@@ -1,11 +1,11 @@
 import type { z } from 'zod'
 import type { RpcContext } from '../../core'
-import type { SubscriptionRegistration } from '../../../orca-runtime'
 import type { TerminalReplyQuerySequence } from '../../../../../shared/terminal-reply-query-scan'
 import type { TerminalOutputChunk } from './terminal-stream-types'
 import type { TerminalSubscribe } from './stream-schemas'
 import type { TerminalOutputBatcher } from './terminal-output-batcher'
 import type { TerminalStreamOpcode } from '../../../../../shared/terminal-stream-protocol'
+import type { TerminalSubscriptionRegistration } from './terminal-subscription-registration'
 
 export type TerminalSubscribeParams = z.infer<typeof TerminalSubscribe>
 export type TerminalSubscriptionEmit = (result: unknown) => void
@@ -13,10 +13,9 @@ export type TerminalSubscriptionEmit = (result: unknown) => void
 export type TerminalSubscriptionArgs = {
   params: TerminalSubscribeParams
   runtime: RpcContext['runtime']
-  connectionId: RpcContext['connectionId']
+  registration: TerminalSubscriptionRegistration
   sendBinary: RpcContext['sendBinary']
   registerBinaryStreamHandler: RpcContext['registerBinaryStreamHandler']
-  signal: RpcContext['signal']
   emit: TerminalSubscriptionEmit
   ptyId: string
   clientId: string | undefined
@@ -48,7 +47,6 @@ export type LegacyBinarySubscriptionState = {
   unsubscribeFit: () => void
   registeredRemoteDesktopDriver: boolean
   displayMode: string
-  readonly registration: SubscriptionRegistration
   readonly streamClosed: Promise<void>
   readonly sendFrame: (
     opcode: TerminalStreamOpcode,
diff --git a/src/main/runtime/rpc/methods/terminal/terminal-send-method.ts b/src/main/runtime/rpc/methods/terminal/terminal-send-method.ts
index 99c01d902a42..ca7ac0aeb759 100644
--- a/src/main/runtime/rpc/methods/terminal/terminal-send-method.ts
+++ b/src/main/runtime/rpc/methods/terminal/terminal-send-method.ts
@@ -210,6 +210,7 @@ export const TERMINAL_SEND_METHODS = [
       try {
         result = useSettledAgentPrompt
           ? await runtime.sendTerminalAgentPrompt(params.terminal, params.text!, {
+              inputKind: 'driving',
               beforeWrite,
               signal,
               ...(orchestrationMutation
@@ -234,6 +235,8 @@ export const TERMINAL_SEND_METHODS = [
               {
                 beforeWrite,
                 signal,
+                // Why: a wire write carries no provenance beyond a client's own query reply.
+                inputKind: params.inputKind === 'query-reply' ? 'query-reply' : 'driving',
                 ...(reserveWrite ? { reserveWrite } : {}),
                 ...(params.inputKind !== 'query-reply' && mobileFloorClientId
                   ? { afterWrite: () => commitMobileInputFloorClaim(mobileFloorClaim) }
diff --git a/src/main/runtime/rpc/methods/terminal/terminal-subscribe-method.ts b/src/main/runtime/rpc/methods/terminal/terminal-subscribe-method.ts
index 7572d41496f5..6fa2c936c0cf 100644
--- a/src/main/runtime/rpc/methods/terminal/terminal-subscribe-method.ts
+++ b/src/main/runtime/rpc/methods/terminal/terminal-subscribe-method.ts
@@ -7,6 +7,7 @@ import {
   runTerminalLeaseSubscription
 } from './terminal-legacy-simple-subscriptions'
 import type { TerminalSubscriptionArgs } from './terminal-legacy-subscription-types'
+import { registerTerminalSubscription } from './terminal-subscription-registration'
 
 export const TERMINAL_SUBSCRIBE_METHODS = [
   // Streams live terminal output over WebSocket; mobile clients pass client+viewport for server-side auto-fit.
@@ -15,81 +16,106 @@ export const TERMINAL_SUBSCRIBE_METHODS = [
     params: TerminalSubscribe,
     handler: async (
       params,
-      { runtime, connectionId, sendBinary, registerBinaryStreamHandler, signal },
+      { runtime, connectionId, requestId, sendBinary, registerBinaryStreamHandler, signal },
       emit
     ) => {
-      let leaf = runtime.resolveLeafForHandle(params.terminal)
       const isMobile = params.client?.type === 'mobile'
-      const serializerGenerationBeforeAnyMount = isMobile
-        ? (runtime.getRendererTerminalSerializerGenerationForHandle?.(params.terminal) ?? 0)
-        : 0
-      let rendererMountRequestedBeforePty = false
       const useBinaryStream = params.capabilities?.terminalBinaryStream === 1 && Boolean(sendBinary)
+      // Why: validated before registering, so a request that can never stream can't evict the slot's live stream.
+      if (isMobile && !useBinaryStream) {
+        throw new Error('binary_terminal_stream_required')
+      }
       if (signal?.aborted) {
         return
       }
-
-      if (!leaf?.ptyId && params.client) {
-        rendererMountRequestedBeforePty = runtime.requestRendererTerminalTabMount(params.terminal)
-        try {
-          const ptyId = await runtime.waitForLeafPtyId(params.terminal, 10_000, signal)
+      let leaf = runtime.resolveLeafForHandle(params.terminal)
+      const serializerGenerationBeforeAnyMount = isMobile
+        ? (runtime.getRendererTerminalSerializerGenerationForHandle?.(params.terminal) ?? 0)
+        : 0
+      let rendererMountRequestedBeforePty = false
+      const clientId = params.client?.id
+      // Why: register before the pty wait so an unsubscribe, a same-slot replacement or a closed socket can end a pending stream.
+      // Client-scoped keys also let a hidden watcher and a visible pane subscribe to one terminal.
+      const registration = registerTerminalSubscription({
+        runtime,
+        subscriptionId: clientId ? `${params.terminal}:${clientId}` : params.terminal,
+        connectionId,
+        requestId,
+        requestSignal: signal,
+        emit
+      })
+      try {
+        if (!leaf?.ptyId && params.client) {
+          rendererMountRequestedBeforePty = runtime.requestRendererTerminalTabMount(params.terminal)
+          const ptyId = await runtime
+            .waitForLeafPtyId(params.terminal, 10_000, registration.signal)
+            .catch(() => null)
+          if (registration.released) {
+            return
+          }
           leaf = { ptyId }
-        } catch {
-          if (signal?.aborted) {
+        }
+        if (!leaf?.ptyId) {
+          const read = await runtime.readTerminal(params.terminal)
+          if (registration.released) {
             return
           }
+          emit({
+            type: 'subscribed',
+            streamId: null,
+            lines: read.tail,
+            truncated: isTerminalReadPayloadIncomplete(read)
+          })
+          return
         }
-      }
-      if (!leaf?.ptyId) {
-        const read = await runtime.readTerminal(params.terminal)
-        emit({
-          type: 'subscribed',
-          streamId: null,
-          lines: read.tail,
-          truncated: isTerminalReadPayloadIncomplete(read)
-        })
-        emit({ type: 'end' })
-        return
-      }
-      if (isMobile && (!useBinaryStream || !sendBinary)) {
-        throw new Error('binary_terminal_stream_required')
-      }
 
-      const ptyId = leaf.ptyId
-      const clientId = params.client?.id
-      const missingHeadlessStateBeforeMobileFit =
-        isMobile &&
-        (rendererMountRequestedBeforePty || runtime.hasHeadlessTerminalState?.(ptyId) === false)
-      const args: TerminalSubscriptionArgs = {
-        params,
-        runtime,
-        connectionId,
-        sendBinary,
-        registerBinaryStreamHandler,
-        signal,
-        emit,
-        ptyId,
-        clientId,
-        isMobile,
-        supportsDesktopViewportClaims: params.capabilities?.desktopViewportClaims === 1,
-        supportsWriteUnavailable: params.capabilities?.writeUnavailable === 1,
-        rendererMountRequestedBeforePty,
-        missingHeadlessStateBeforeMobileFit,
-        serializerGenerationBeforeMobileFit: missingHeadlessStateBeforeMobileFit
-          ? rendererMountRequestedBeforePty
-            ? serializerGenerationBeforeAnyMount
-            : runtime.getRendererTerminalSerializerGeneration(ptyId)
-          : 0
-      }
-      if (isMobile && params.capabilities?.mobileInputLeaseOnly === 1 && Boolean(clientId)) {
-        await runTerminalLeaseSubscription(args)
-        return
-      }
-      if (!useBinaryStream) {
-        await runTerminalJsonSubscription(args)
-        return
+        const ptyId = leaf.ptyId
+        registration.releaseOnPtyExit(ptyId)
+        if (registration.released) {
+          return
+        }
+        const missingHeadlessStateBeforeMobileFit =
+          isMobile &&
+          (rendererMountRequestedBeforePty || runtime.hasHeadlessTerminalState?.(ptyId) === false)
+        const args: TerminalSubscriptionArgs = {
+          params,
+          runtime,
+          registration,
+          sendBinary,
+          registerBinaryStreamHandler,
+          emit,
+          ptyId,
+          clientId,
+          isMobile,
+          supportsDesktopViewportClaims: params.capabilities?.desktopViewportClaims === 1,
+          supportsWriteUnavailable: params.capabilities?.writeUnavailable === 1,
+          rendererMountRequestedBeforePty,
+          missingHeadlessStateBeforeMobileFit,
+          serializerGenerationBeforeMobileFit: missingHeadlessStateBeforeMobileFit
+            ? rendererMountRequestedBeforePty
+              ? serializerGenerationBeforeAnyMount
+              : runtime.getRendererTerminalSerializerGeneration(ptyId)
+            : 0
+        }
+        if (isMobile && params.capabilities?.mobileInputLeaseOnly === 1 && Boolean(clientId)) {
+          await runTerminalLeaseSubscription(args)
+          return
+        }
+        if (!useBinaryStream) {
+          await runTerminalJsonSubscription(args)
+          return
+        }
+        await runTerminalBinarySubscription(args)
+      } catch (error) {
+        // Why: a released stream already sent `end`; an error frame after it would contradict it.
+        if (registration.released) {
+          return
+        }
+        registration.releaseSilently()
+        throw error
+      } finally {
+        registration.release()
       }
-      await runTerminalBinarySubscription(args)
     }
   })
 ]
diff --git a/src/main/runtime/rpc/methods/terminal/terminal-subscription-registration.test.ts b/src/main/runtime/rpc/methods/terminal/terminal-subscription-registration.test.ts
new file mode 100644
index 000000000000..1af456dfdd4a
--- /dev/null
+++ b/src/main/runtime/rpc/methods/terminal/terminal-subscription-registration.test.ts
@@ -0,0 +1,123 @@
+import { describe, expect, it, vi } from 'vitest'
+import { RuntimeSubscriptionRegistry } from '../../../runtime-subscription-registry'
+import { registerTerminalSubscription } from './terminal-subscription-registration'
+
+const SUBSCRIPTION_ID = 'terminal-1:phone-1'
+
+function createRegistration(
+  requestSignal?: AbortSignal,
+  registry = new RuntimeSubscriptionRegistry()
+) {
+  const runtime = {
+    registerOwnedSubscriptionCleanup: registry.registerOwned.bind(registry),
+    subscribeToPtyExit: vi.fn((_ptyId: string, _listener: () => void) => vi.fn()),
+    handleMobileSubscribe: vi.fn().mockResolvedValue(true),
+    handleMobileUnsubscribe: vi.fn()
+  }
+  const emit = vi.fn()
+  const registration = registerTerminalSubscription({
+    runtime,
+    subscriptionId: SUBSCRIPTION_ID,
+    connectionId: 'conn-a',
+    requestId: 'req-1',
+    requestSignal,
+    emit
+  })
+  return { registry, runtime, emit, registration }
+}
+
+describe('terminal subscription registration', () => {
+  it('runs its teardown once when the teardown re-enters release', () => {
+    const { registry, emit, registration } = createRegistration()
+    const teardown = vi.fn(() => {
+      registration.release()
+      registry.cleanup(SUBSCRIPTION_ID)
+    })
+    registration.setTeardown(teardown)
+
+    registration.release()
+
+    expect(teardown).toHaveBeenCalledOnce()
+    expect(emit.mock.calls).toEqual([[{ type: 'end' }]])
+    expect(registration.signal.aborted).toBe(true)
+  })
+
+  it('runs a teardown set after release immediately', () => {
+    const { registration } = createRegistration()
+    registration.release()
+    const teardown = vi.fn()
+
+    registration.setTeardown(teardown)
+
+    expect(teardown).toHaveBeenCalledOnce()
+  })
+
+  it('is released on arrival, without taking the slot, when the request signal is already aborted', () => {
+    const registry = new RuntimeSubscriptionRegistry()
+    const liveCleanup = vi.fn()
+    registry.registerOwned(SUBSCRIPTION_ID, liveCleanup, 'conn-a')
+    const request = new AbortController()
+    request.abort()
+    const { emit, registration } = createRegistration(request.signal, registry)
+
+    expect(registration.released).toBe(true)
+    expect(registration.signal.aborted).toBe(true)
+    expect(emit).not.toHaveBeenCalled()
+    expect(liveCleanup).not.toHaveBeenCalled()
+    expect(registry.cleanupIfOwnedByConnection(SUBSCRIPTION_ID, 'conn-a')).toBe(true)
+    expect(liveCleanup).toHaveBeenCalledOnce()
+  })
+
+  it('removes phone presence and aborts even when the teardown throws', async () => {
+    const { runtime, registration } = createRegistration()
+    void registration.addMobilePresence('pty-1', 'phone-1', undefined)
+    registration.setTeardown(() => {
+      throw new Error('flush_failed')
+    })
+    const error = vi.spyOn(console, 'error').mockImplementation(() => {})
+
+    registration.release()
+
+    expect(runtime.handleMobileUnsubscribe).toHaveBeenCalledWith('pty-1', 'phone-1')
+    expect(registration.signal.aborted).toBe(true)
+    await vi.waitFor(() => expect(error).toHaveBeenCalled())
+    error.mockRestore()
+  })
+
+  it('adds no presence after release', async () => {
+    const { runtime, registration } = createRegistration()
+    registration.release()
+
+    await registration.addMobilePresence('pty-1', 'phone-1', undefined)
+
+    expect(runtime.handleMobileSubscribe).not.toHaveBeenCalled()
+    expect(runtime.handleMobileUnsubscribe).not.toHaveBeenCalled()
+  })
+
+  it('releases silently without end', () => {
+    const { emit, registration } = createRegistration()
+
+    registration.releaseSilently()
+    registration.release()
+
+    expect(registration.released).toBe(true)
+    expect(emit).not.toHaveBeenCalled()
+  })
+
+  it('stops watching for pty exit when released, and releases on exit', () => {
+    const { runtime, emit, registration } = createRegistration()
+    let onExit = (): void => {}
+    const stopWatching = vi.fn()
+    runtime.subscribeToPtyExit.mockImplementation((_ptyId: string, listener: () => void) => {
+      onExit = listener
+      return stopWatching
+    })
+    registration.releaseOnPtyExit('pty-1')
+
+    onExit()
+
+    expect(registration.released).toBe(true)
+    expect(stopWatching).toHaveBeenCalledOnce()
+    expect(emit.mock.calls).toEqual([[{ type: 'end' }]])
+  })
+})
diff --git a/src/main/runtime/rpc/methods/terminal/terminal-subscription-registration.ts b/src/main/runtime/rpc/methods/terminal/terminal-subscription-registration.ts
new file mode 100644
index 000000000000..235088b20482
--- /dev/null
+++ b/src/main/runtime/rpc/methods/terminal/terminal-subscription-registration.ts
@@ -0,0 +1,141 @@
+import type { OrcaRuntimeService } from '../../../orca-runtime'
+
+type RegistrationRuntime = Pick<
+  OrcaRuntimeService,
+  | 'registerOwnedSubscriptionCleanup'
+  | 'subscribeToPtyExit'
+  | 'handleMobileSubscribe'
+  | 'handleMobileUnsubscribe'
+>
+
+/** One `terminal.subscribe` request, addressable from admission until it is released. */
+export type TerminalSubscriptionRegistration = {
+  readonly released: boolean
+  /** Aborted once release has torn everything down. */
+  readonly signal: AbortSignal
+  /** Runs the stream's teardown on release, or now if the registration was already released. */
+  setTeardown(teardown: () => void): void
+  releaseOnPtyExit(ptyId: string): void
+  addMobilePresence(
+    ptyId: string,
+    clientId: string,
+    viewport: { cols: number; rows: number } | undefined
+  ): Promise<void>
+  /** Releases and ends the stream. */
+  release(): void
+  /** Releases without `end`, for a handler about to fail the request instead. */
+  releaseSilently(): void
+}
+
+export function registerTerminalSubscription({
+  runtime,
+  subscriptionId,
+  connectionId,
+  requestId,
+  requestSignal,
+  emit
+}: {
+  runtime: RegistrationRuntime
+  subscriptionId: string
+  connectionId: string | undefined
+  /** With `connectionId`, lets `terminal.unsubscribe{requestId}` address this exact request. */
+  requestId: string | undefined
+  requestSignal: AbortSignal | undefined
+  emit: (result: unknown) => void
+}): TerminalSubscriptionRegistration {
+  const controller = new AbortController()
+  let released = false
+  let ended = false
+  let teardown: (() => void) | null = null
+  let stopWatchingExit = (): void => {}
+  let presence: { ptyId: string; clientId: string } | null = null
+
+  const end = (): void => {
+    if (ended) {
+      return
+    }
+    ended = true
+    emit({ type: 'end' })
+  }
+  const releaseOnce = (): void => {
+    // Why: the registry calls cleanup before recording it as in flight, so a re-entrant release must be a no-op.
+    if (released) {
+      return
+    }
+    released = true
+    requestSignal?.removeEventListener('abort', onRequestAbort)
+    try {
+      try {
+        stopWatchingExit()
+        teardown?.()
+      } finally {
+        // Why: the latch makes any retry a no-op, so a throwing teardown must not strand phone presence.
+        if (presence) {
+          runtime.handleMobileUnsubscribe(presence.ptyId, presence.clientId)
+        }
+      }
+    } finally {
+      controller.abort()
+    }
+  }
+  // Why: a closed socket hands out a pre-aborted signal; registering would evict the slot's live stream for a dead request.
+  const registryEntry = requestSignal?.aborted
+    ? null
+    : runtime.registerOwnedSubscriptionCleanup(
+        subscriptionId,
+        () => {
+          try {
+            releaseOnce()
+          } finally {
+            end()
+          }
+        },
+        connectionId,
+        requestId
+      )
+  // Why: route through the registry so the entry leaves with the release and a teardown error is contained there.
+  const release = (): void => registryEntry?.releaseIfCurrent()
+  const onRequestAbort = (): void => release()
+
+  const registration: TerminalSubscriptionRegistration = {
+    get released() {
+      return released
+    },
+    signal: controller.signal,
+    setTeardown(nextTeardown) {
+      if (released) {
+        nextTeardown()
+        return
+      }
+      teardown = nextTeardown
+    },
+    releaseOnPtyExit(ptyId) {
+      const unsubscribe = runtime.subscribeToPtyExit(ptyId, release)
+      if (released) {
+        // Why: an already-exited pty releases synchronously, before the unsubscribe exists to stop.
+        unsubscribe()
+        return
+      }
+      stopWatchingExit = unsubscribe
+    },
+    async addMobilePresence(ptyId, clientId, viewport) {
+      if (released) {
+        return
+      }
+      // Why: presence and the driver are set before the layout await, so a release during it must remove them.
+      presence = { ptyId, clientId }
+      await runtime.handleMobileSubscribe(ptyId, clientId, viewport)
+    },
+    release,
+    releaseSilently() {
+      ended = true
+      release()
+    }
+  }
+  if (registryEntry) {
+    requestSignal?.addEventListener('abort', onRequestAbort, { once: true })
+  } else {
+    releaseOnce()
+  }
+  return registration
+}
diff --git a/src/main/runtime/rpc/methods/terminal/terminal-viewport-methods.ts b/src/main/runtime/rpc/methods/terminal/terminal-viewport-methods.ts
index da1121c89df2..b977c1136681 100644
--- a/src/main/runtime/rpc/methods/terminal/terminal-viewport-methods.ts
+++ b/src/main/runtime/rpc/methods/terminal/terminal-viewport-methods.ts
@@ -83,6 +83,12 @@ export const TERMINAL_VIEWPORT_METHODS_AFTER_STREAMS = [
     name: 'terminal.unsubscribe',
     params: TerminalUnsubscribe,
     handler: async (params, { runtime, connectionId, subscriptionRegistrationVersion }) => {
+      if (params.requestId !== undefined) {
+        // Why: an unknown request already ended or never registered; falling back to the slot could end a newer stream.
+        runtime.releaseSubscriptionByRequest(connectionId, params.requestId)
+        return { unsubscribed: true }
+      }
+      // COMPAT(terminal request-addressed unsubscribe): slot path for phones that predate `requestId`.
       // Fence both socket replacement and a newer subscription on the same socket.
       let unsubscribed = runtime.cleanupSubscriptionIfOwnedByConnection(
         params.subscriptionId,
diff --git a/src/main/runtime/rpc/orchestration-mutation-executor.ts b/src/main/runtime/rpc/orchestration-mutation-executor.ts
index e6ad7952d8c8..010541357f57 100644
--- a/src/main/runtime/rpc/orchestration-mutation-executor.ts
+++ b/src/main/runtime/rpc/orchestration-mutation-executor.ts
@@ -4,6 +4,7 @@ import {
   isTerminalPromptMutation
 } from '../../../shared/orchestration-rpc-contract'
 import type { OrcaRuntimeService } from '../orca-runtime'
+import type { OrcaSessionId } from '../../../shared/orca-session-address'
 import { OrchestrationError } from '../orchestration/orchestration-error'
 import type { RpcRequest } from './core'
 import {
@@ -53,7 +54,9 @@ export class OrchestrationMutationExecutor {
     request: RpcRequest,
     params: unknown,
     invoke: (mutation?: DurableMutationInvocation) => unknown,
-    callerFingerprintOverride?: string
+    callerFingerprintOverride?: string,
+    /** The resolved session's Orca session id; it joins the payload so another caller cannot replay it. */
+    callerOrcaSessionId?: OrcaSessionId
   ): Promise<unknown> {
     const requestId = request.orchestrationRequestId
     if (!requestId || !isDurableMutation(request.method, params)) {
@@ -61,7 +64,7 @@ export class OrchestrationMutationExecutor {
     }
     const callerFingerprint =
       callerFingerprintOverride ?? this.getLocalAuthenticatedCallerFingerprint()
-    const stableParams = replayStableCallerParams(this.runtime, params)
+    const stableParams = replayStableCallerParams(this.runtime, params, callerOrcaSessionId)
     const basePayloadHash = hashCanonical({ method: request.method, params: stableParams })
     const key = `${callerFingerprint}:${requestId}`
     const db = this.runtime.getOrchestrationDb()
diff --git a/src/main/runtime/rpc/orchestration-mutation-receipt.ts b/src/main/runtime/rpc/orchestration-mutation-receipt.ts
index 25a3fa1c1779..1d94723550bc 100644
--- a/src/main/runtime/rpc/orchestration-mutation-receipt.ts
+++ b/src/main/runtime/rpc/orchestration-mutation-receipt.ts
@@ -2,6 +2,7 @@ import { createHash } from 'node:crypto'
 import { isTerminalPromptMutation } from '../../../shared/orchestration-rpc-contract'
 import { parsePaneKey } from '../../../shared/stable-pane-id'
 import type { OrcaRuntimeService } from '../orca-runtime'
+import type { OrcaSessionId } from '../../../shared/orca-session-address'
 
 export const EFFECT_FREE_WORKER_DONE_CHECKPOINT = JSON.stringify({
   pending: { effectFree: 'worker_done' }
@@ -13,12 +14,21 @@ export type MutationReplayNudge =
   | { kind: 'messages'; targets: { to: string; type: string }[] }
   | { kind: 'federation'; runId?: string }
 
-export function replayStableCallerParams(runtime: OrcaRuntimeService, params: unknown): unknown {
+const CALLER_ORCA_SESSION_ID_KEY = '__orcaCallerOrcaSessionId'
+
+export function replayStableCallerParams(
+  runtime: OrcaRuntimeService,
+  params: unknown,
+  callerOrcaSessionId?: OrcaSessionId
+): unknown {
   if (!params || typeof params !== 'object' || Array.isArray(params)) {
     return params
   }
   const source = params as Record<string, unknown>
-  const result = { ...source }
+  // Absent for terminal callers, so their payload hashes are unchanged.
+  const result: Record<string, unknown> = callerOrcaSessionId
+    ? { ...source, [CALLER_ORCA_SESSION_ID_KEY]: callerOrcaSessionId }
+    : { ...source }
   delete result.waitSubmitMs
   for (const property of ['from', 'callerTerminalHandle', 'terminal'] as const) {
     const handle = source[property]
diff --git a/src/main/runtime/rpc/orchestration-party-addressing.test.ts b/src/main/runtime/rpc/orchestration-party-addressing.test.ts
new file mode 100644
index 000000000000..5c281583f0a8
--- /dev/null
+++ b/src/main/runtime/rpc/orchestration-party-addressing.test.ts
@@ -0,0 +1,321 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { formatOrcaSessionAddress } from '../../../shared/orca-session-address'
+import { testOrcaSessionId } from '../../../shared/orca-session-address-test-fixture'
+import { ORCHESTRATION_SESSION_CALLER_ERROR_CODES as CODES } from '../../../shared/orchestration-session-caller-codes'
+import { ORCHESTRATION_TARGET_PARAM } from '../orchestration/orchestration-party'
+import {
+  mintStructuredWorkerHandle,
+  mintStructuredWorkerPaneKey,
+  structuredWorkerIdentities,
+  structuredWorkerProcessIncarnation
+} from '../structured-worker-identity'
+import {
+  ADDRESS_X,
+  ADDRESS_Y,
+  createSessionCallerHarness,
+  idOf,
+  orchestrationRequest,
+  resultOf,
+  SESSION_X,
+  SESSION_Y,
+  sessionRecord,
+  WORKER_HANDLE,
+  WORKER_PANE,
+  type SessionCallerHarness
+} from './orchestration-session-caller-test-fixture'
+
+const hostRef = vi.hoisted((): { current: unknown } => ({ current: null }))
+vi.mock('../../native-chat/agent-session-wire/structured-agent-session-registry', () => ({
+  getStructuredAgentSessionHost: () => hostRef.current
+}))
+
+type Row = Record<string, unknown>
+
+const SESSION_Z = testOrcaSessionId('3f9a1c7e-6b2d-4e85-a0c4-9d1e7b3f5a26')
+const ADDRESS_Z = formatOrcaSessionAddress(SESSION_Z)
+
+/** Worker Y's two spellings; a chat has only its session address. */
+const handle = mintStructuredWorkerHandle()
+const paneKey = mintStructuredWorkerPaneKey(SESSION_Y)
+const WORKER_SPELLINGS = [
+  ['its handle', handle],
+  ['its session address', ADDRESS_Y]
+] as const
+
+let h: SessionCallerHarness
+
+beforeEach(() => {
+  h = createSessionCallerHarness(hostRef)
+  h.records.set(SESSION_Z, sessionRecord(SESSION_Z))
+  structuredWorkerIdentities.register({
+    handle,
+    sessionId: SESSION_Y,
+    agent: 'claude',
+    paneKey,
+    processIncarnation: structuredWorkerProcessIncarnation(SESSION_Y),
+    worktreeId: 'wt_1',
+    hostScope: { kind: 'local', hostId: 'local' }
+  })
+})
+
+afterEach(() => {
+  h.close()
+  vi.restoreAllMocks()
+})
+
+function call(sessionId: string | undefined, method: string, params: Row) {
+  return h.dispatch(orchestrationRequest(method, params, { sessionId }))
+}
+
+async function as(sessionId: string | undefined, method: string, params: Row): Promise<Row> {
+  return resultOf(await call(sessionId, method, params))
+}
+
+function chatRun(sessionId = SESSION_X): Promise<string> {
+  return as(sessionId, 'orchestration.runCreate', { objective: 'o' }).then(({ run }) => idOf(run))
+}
+
+/** Worker Y assigned a Dispatch in `runId`, as `worker-start` leaves it. */
+function assignWorker(runId: string): string {
+  return h.db.createDispatchContext({
+    taskId: h.db.createTask({ runId, spec: 'work' }).id,
+    assigneeHandle: handle,
+    assigneePaneKey: paneKey,
+    processIncarnation: structuredWorkerProcessIncarnation(SESSION_Y),
+    creator: { kind: 'session', orcaSessionId: SESSION_X },
+    maxDepth: Number.MAX_SAFE_INTEGER
+  }).id
+}
+
+/** The PTY terminal assigned a Dispatch in a Run, so it may ask that Run's coordinator. */
+function assignTerminal(runId: string): void {
+  h.db.createDispatchContext({
+    taskId: h.db.createTask({ runId, spec: 'sub' }).id,
+    assigneeHandle: WORKER_HANDLE,
+    assigneePaneKey: WORKER_PANE,
+    creator: { kind: 'system' },
+    maxDepth: Number.MAX_SAFE_INTEGER
+  })
+}
+
+describe('every target param resolves both spellings of a party to one canonical address', () => {
+  it('covers exactly the target params the contract lists', () => {
+    expect(Object.keys(ORCHESTRATION_TARGET_PARAM).sort()).toEqual(
+      [
+        'orchestration.send',
+        'orchestration.ask',
+        'orchestration.dispatch',
+        'orchestration.inbox'
+      ].sort()
+    )
+  })
+
+  it.each(WORKER_SPELLINGS)('send: a worker at %s gets its Dispatch mailbox', async (_l, to) => {
+    const dispatchId = assignWorker(await chatRun())
+    const { message } = await as(undefined, 'orchestration.send', {
+      from: WORKER_HANDLE,
+      to,
+      subject: 's'
+    })
+    expect(message).toMatchObject({ to_handle: `dispatch:${dispatchId}` })
+  })
+
+  it("send: a chat's session address is its own direct mailbox", async () => {
+    const { message } = await as(undefined, 'orchestration.send', {
+      from: WORKER_HANDLE,
+      to: ADDRESS_Z,
+      subject: 's'
+    })
+    expect(message).toMatchObject({ to_handle: ADDRESS_Z })
+  })
+
+  it.each(WORKER_SPELLINGS)('ask: a worker coordinator is asked at %s', async (_l, to) => {
+    assignWorker(await chatRun())
+    const childRun = idOf((await as(SESSION_Y, 'orchestration.runCreate', { objective: 'c' })).run)
+    assignTerminal(childRun)
+    const asked = await as(undefined, 'orchestration.ask', {
+      from: WORKER_HANDLE,
+      to,
+      question: 'q',
+      timeoutMs: 0
+    })
+    expect(h.db.getQuestion(String(asked.messageId))).toMatchObject({ run_id: childRun })
+  })
+
+  it("ask: a chat coordinator is asked at its session address, and not at a worker's", async () => {
+    const runId = await chatRun()
+    assignTerminal(runId)
+    const ask = (to: string) =>
+      call(undefined, 'orchestration.ask', { from: WORKER_HANDLE, to, question: 'q', timeoutMs: 0 })
+
+    expect(await ask(ADDRESS_X)).toMatchObject({ ok: true })
+    expect(await ask(ADDRESS_Y)).toMatchObject({
+      ok: false,
+      error: { code: 'dispatch_run_mismatch' }
+    })
+  })
+
+  it.each(WORKER_SPELLINGS)(
+    'dispatch: a worker named by %s is the assignee, and its check reads the Dispatch',
+    async (_l, to) => {
+      const runId = await chatRun()
+      const task = h.db.createTask({ runId, spec: 'work' })
+
+      const { dispatch } = await as(SESSION_X, 'orchestration.dispatch', { task: task.id, to })
+
+      expect(dispatch).toMatchObject({
+        assignee_handle: handle,
+        assignee_orca_session_id: SESSION_Y
+      })
+      expect(await as(SESSION_Y, 'orchestration.check', { peek: true })).toMatchObject({
+        dispatchId: idOf(dispatch)
+      })
+    }
+  )
+
+  it('dispatch: refuses a chat assignee with no row written', async () => {
+    const runId = await chatRun()
+    const task = h.db.createTask({ runId, spec: 'work' })
+
+    const response = await call(SESSION_X, 'orchestration.dispatch', {
+      task: task.id,
+      to: ADDRESS_Z
+    })
+
+    expect(response).toMatchObject({
+      ok: false,
+      error: {
+        code: CODES.chatNotDispatchable,
+        message: `Agent session ${SESSION_Z} is a chat, and a chat can't receive a dispatch yet. Start a worker with worker-start instead. No effects were applied.`,
+        data: { effectsApplied: false }
+      }
+    })
+    expect(h.db.db.prepare('SELECT COUNT(*) AS n FROM dispatch_contexts').get()).toEqual({ n: 0 })
+    expect(h.db.getTask(task.id)?.status).toBe('ready')
+  })
+
+  it.each(WORKER_SPELLINGS)('inbox: a worker named by %s lists its mail', async (_l, terminal) => {
+    const runId = await chatRun()
+    h.db.insertMessage({ from: 'term_x', to: handle, subject: 'direct', body: '', runId })
+
+    const { messages } = await as(undefined, 'orchestration.inbox', { terminal })
+
+    expect(messages).toEqual([expect.objectContaining({ subject: 'direct', to_handle: handle })])
+  })
+
+  it("inbox: a chat's session address lists its direct mail", async () => {
+    await as(undefined, 'orchestration.send', { from: WORKER_HANDLE, to: ADDRESS_Z, subject: 'z' })
+    const { messages } = await as(undefined, 'orchestration.inbox', { terminal: ADDRESS_Z })
+    expect(messages).toEqual([expect.objectContaining({ subject: 'z' })])
+  })
+})
+
+describe('a caller declared by a session address, on a request with no session id', () => {
+  it.each(WORKER_SPELLINGS)(
+    'sends as the worker named by %s, from its handle',
+    async (_l, from) => {
+      const { message } = await as(undefined, 'orchestration.send', {
+        from,
+        to: ADDRESS_Z,
+        subject: 's'
+      })
+      expect(message).toMatchObject({ from_handle: handle })
+    }
+  )
+
+  it('checks the worker named by its session address as if it had named its handle', async () => {
+    const dispatchId = assignWorker(await chatRun())
+    await as(SESSION_X, 'orchestration.send', { to: handle, subject: 'work' })
+
+    const byAddress = await as(undefined, 'orchestration.check', { terminal: ADDRESS_Y, all: true })
+    const byHandle = await as(undefined, 'orchestration.check', { terminal: handle, all: true })
+
+    expect(byAddress).toEqual(byHandle)
+    expect(byAddress).toMatchObject({ dispatchId, messages: [{ subject: 'work' }] })
+  })
+
+  it("refuses a chat's session address, with no effects", async () => {
+    const response = await call(undefined, 'orchestration.send', {
+      from: ADDRESS_Z,
+      to: WORKER_HANDLE,
+      subject: 's'
+    })
+
+    expect(response).toMatchObject({
+      ok: false,
+      error: {
+        code: CODES.chatNotDeclarable,
+        message: expect.stringContaining(`Agent session ${SESSION_Z} is a chat`),
+        data: { effectsApplied: false }
+      }
+    })
+    expect(h.db.getInbox()).toEqual([])
+  })
+})
+
+describe('a structured worker that coordinates a child Run while assigned in its parent', () => {
+  it.each(WORKER_SPELLINGS)(
+    'gets mail at %s in the child Run it reads, even with no live pane',
+    async (_l, to) => {
+      assignWorker(await chatRun())
+      const childRun = idOf(
+        (await as(SESSION_Y, 'orchestration.runCreate', { objective: 'c' })).run
+      )
+      // The harness answers no live pane for a structured handle, as for an evicted session.
+      expect(h.runtime.getLiveTerminalPaneKey(handle)).toBeNull()
+
+      for (const sender of [SESSION_X, undefined]) {
+        const { message } = await as(sender, 'orchestration.send', {
+          ...(sender ? {} : { from: WORKER_HANDLE }),
+          to,
+          subject: `from ${sender ?? 'terminal'}`
+        })
+        expect(message).toMatchObject({ to_handle: `run:${childRun}` })
+      }
+      expect(await as(SESSION_Y, 'orchestration.check', { peek: true })).toMatchObject({
+        runId: childRun,
+        count: 2
+      })
+    }
+  )
+})
+
+describe('no writer stores a structured worker under its session address', () => {
+  it('keeps every to_handle and from_handle at the canonical address across every mail writer', async () => {
+    const runId = await chatRun()
+    const task = h.db.createTask({ runId, spec: 'work' })
+    await as(SESSION_X, 'orchestration.dispatch', { task: task.id, to: ADDRESS_Y })
+    assignTerminal(runId)
+
+    for (const to of [ADDRESS_Y, handle]) {
+      await as(SESSION_X, 'orchestration.send', { to, subject: 'down' })
+    }
+    const fromWorker = await as(SESSION_Y, 'orchestration.send', {
+      from: ADDRESS_Y,
+      to: ADDRESS_X,
+      subject: 'up'
+    })
+    await as(undefined, 'orchestration.send', { from: ADDRESS_Y, to: WORKER_HANDLE, subject: 'u' })
+    await as(SESSION_X, 'orchestration.reply', {
+      id: idOf(fromWorker.message),
+      body: 'noted'
+    })
+    await as(SESSION_X, 'orchestration.send', { to: '@all', subject: 'everyone' })
+    await as(undefined, 'orchestration.ask', {
+      from: WORKER_HANDLE,
+      to: ADDRESS_X,
+      question: 'q',
+      timeoutMs: 0
+    })
+
+    const stored = h.db.db
+      .prepare(
+        `SELECT m.id FROM messages AS m JOIN dispatch_contexts AS d
+           ON d.assignee_orca_session_id IS NOT NULL
+          AND 'session:' || d.assignee_orca_session_id IN (m.to_handle, m.from_handle)`
+      )
+      .all()
+    expect(h.db.getInbox(100).length).toBeGreaterThanOrEqual(7)
+    expect(stored).toEqual([])
+  })
+})
diff --git a/src/main/runtime/rpc/orchestration-party-agreement.test.ts b/src/main/runtime/rpc/orchestration-party-agreement.test.ts
new file mode 100644
index 000000000000..b0e0d3024748
--- /dev/null
+++ b/src/main/runtime/rpc/orchestration-party-agreement.test.ts
@@ -0,0 +1,207 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { formatOrcaSessionAddress, type OrcaSessionId } from '../../../shared/orca-session-address'
+import { testOrcaSessionId } from '../../../shared/orca-session-address-test-fixture'
+import { ORCHESTRATION_SESSION_CALLER_ERROR_CODES as CODES } from '../../../shared/orchestration-session-caller-codes'
+import {
+  mintStructuredWorkerHandle,
+  mintStructuredWorkerPaneKey,
+  structuredWorkerIdentities,
+  structuredWorkerProcessIncarnation
+} from '../structured-worker-identity'
+import {
+  ADDRESS_X,
+  createSessionCallerHarness,
+  idOf,
+  orchestrationRequest,
+  resultOf,
+  SESSION_X,
+  SESSION_Y,
+  sessionRecord,
+  WORKER_HANDLE,
+  type SessionCallerHarness
+} from './orchestration-session-caller-test-fixture'
+
+// A `/clear`ed member of X's lineage and of worker Y's, as a later lineage walk will map them.
+const ALIAS_X = testOrcaSessionId('5c7e2a94-1d3b-4f68-b9a0-e4c2d6f81b37')
+const ALIAS_Y = testOrcaSessionId('8a4d6f20-3e1c-4b79-a5d2-c0f7e9b3a164')
+
+const hostRef = vi.hoisted((): { current: unknown } => ({ current: null }))
+vi.mock('../../native-chat/agent-session-wire/structured-agent-session-registry', () => ({
+  getStructuredAgentSessionHost: () => hostRef.current
+}))
+vi.mock('../orchestration/canonical-orca-session-id', () => ({
+  canonicalOrcaSessionId: (id: string) =>
+    id === '5c7e2a94-1d3b-4f68-b9a0-e4c2d6f81b37'
+      ? '4a1f6c2e-8b3d-4e7a-9c15-0d2b6e8f1a37'
+      : id === '8a4d6f20-3e1c-4b79-a5d2-c0f7e9b3a164'
+        ? '7e3b9d15-2c4a-4f86-a0b1-5c9e2d7f3b64'
+        : id
+}))
+
+type Row = Record<string, unknown>
+
+const handle = mintStructuredWorkerHandle()
+const paneKey = mintStructuredWorkerPaneKey(SESSION_Y)
+let h: SessionCallerHarness
+
+beforeEach(() => {
+  h = createSessionCallerHarness(hostRef)
+  h.records.set(ALIAS_X, sessionRecord(ALIAS_X))
+  h.records.set(ALIAS_Y, sessionRecord(ALIAS_Y))
+})
+
+afterEach(() => {
+  h.close()
+  vi.restoreAllMocks()
+})
+
+function call(sessionId: string | undefined, method: string, params: Row) {
+  return h.dispatch(orchestrationRequest(method, params, { sessionId }))
+}
+
+async function as(sessionId: string | undefined, method: string, params: Row): Promise<Row> {
+  return resultOf(await call(sessionId, method, params))
+}
+
+function registerWorker(): void {
+  structuredWorkerIdentities.register({
+    handle,
+    sessionId: SESSION_Y,
+    agent: 'claude',
+    paneKey,
+    processIncarnation: structuredWorkerProcessIncarnation(SESSION_Y),
+    worktreeId: 'wt_1',
+    hostScope: { kind: 'local', hostId: 'local' }
+  })
+}
+
+/** A Dispatch naming Y as a structured worker, in a Run a terminal coordinates. */
+function recordWorkerDispatch(): void {
+  const run = h.db.createRun({
+    objective: 'pty',
+    coordinatorHandle: 'term_c',
+    coordinatorPaneKey: 'tab_c:13131313-1313-4313-8313-131313131313'
+  })
+  h.db.createDispatchContext({
+    taskId: h.db.createTask({ runId: run.id, spec: 'work' }).id,
+    assigneeHandle: handle,
+    assigneePaneKey: paneKey,
+    processIncarnation: structuredWorkerProcessIncarnation(SESSION_Y),
+    creator: { kind: 'system' },
+    maxDepth: Number.MAX_SAFE_INTEGER
+  })
+}
+
+type PartyState = { name: string; sessionId: OrcaSessionId; setup: () => Promise<void> | void }
+
+const PARTY_STATES: PartyState[] = [
+  { name: 'a chat with no Run', sessionId: SESSION_X, setup: () => {} },
+  {
+    name: 'a chat coordinating a Run',
+    sessionId: SESSION_X,
+    setup: async () => void (await as(SESSION_X, 'orchestration.runCreate', { objective: 'o' }))
+  },
+  {
+    name: 'a registered worker with a Dispatch',
+    sessionId: SESSION_Y,
+    setup: () => {
+      registerWorker()
+      recordWorkerDispatch()
+    }
+  },
+  {
+    name: 'a recorded worker whose identity is gone',
+    sessionId: SESSION_Y,
+    setup: recordWorkerDispatch
+  },
+  {
+    name: 'a chat that runs on another host',
+    sessionId: SESSION_X,
+    setup: () => {
+      h.records.set(SESSION_X, sessionRecord(SESSION_X, { location: { executionHostId: 'ssh:b' } }))
+    }
+  }
+]
+
+describe('the caller a session id resolves to and the recipient its address resolves to agree', () => {
+  it.each(PARTY_STATES.map((state) => [state.name, state] as const))('%s', async (_name, state) => {
+    await state.setup()
+    const sent = await call(undefined, 'orchestration.send', {
+      from: WORKER_HANDLE,
+      to: formatOrcaSessionAddress(state.sessionId),
+      subject: 'agree'
+    })
+    const read = await call(state.sessionId, 'orchestration.check', { peek: true })
+
+    // Both refuse, or the caller reads exactly the mail sent to its address.
+    expect(sent.ok).toBe(read.ok)
+    if (read.ok) {
+      expect(resultOf(read)).toMatchObject({ messages: [{ subject: 'agree' }] })
+    }
+  })
+
+  it('refuses a worker whose identity is gone with one code, as caller and as recipient', async () => {
+    recordWorkerDispatch()
+    const asCaller = await call(SESSION_Y, 'orchestration.runCurrent', {})
+    const asRecipient = await call(undefined, 'orchestration.send', {
+      from: WORKER_HANDLE,
+      to: formatOrcaSessionAddress(SESSION_Y),
+      subject: 's'
+    })
+    for (const response of [asCaller, asRecipient]) {
+      expect(response).toMatchObject({ ok: false, error: { code: CODES.notLive } })
+    }
+  })
+})
+
+describe('every session-to-party step goes through the canonical session id', () => {
+  it('binds a claimed alias as its canonical session', async () => {
+    const { run } = await as(ALIAS_X, 'orchestration.runCreate', { objective: 'o' })
+    expect(h.db.getRunRaw(idOf(run))?.coordinator_orca_session_id).toBe(SESSION_X)
+    expect(await as(SESSION_X, 'orchestration.runCurrent', {})).toMatchObject({
+      run: { id: idOf(run) }
+    })
+  })
+
+  it("delivers mail to an alias's address at the canonical session's mailbox", async () => {
+    const { message } = await as(undefined, 'orchestration.send', {
+      from: WORKER_HANDLE,
+      to: formatOrcaSessionAddress(ALIAS_X),
+      subject: 's'
+    })
+    expect(message).toMatchObject({ to_handle: ADDRESS_X })
+  })
+
+  it("resolves a worker alias's address to the worker's handle", async () => {
+    registerWorker()
+    const { message } = await as(undefined, 'orchestration.send', {
+      from: formatOrcaSessionAddress(ALIAS_Y),
+      to: ADDRESS_X,
+      subject: 's'
+    })
+    expect(message).toMatchObject({ from_handle: handle })
+  })
+
+  it.each([formatOrcaSessionAddress(ALIAS_X), ALIAS_X])(
+    'accepts the session declared as its alias %s',
+    async (declared) => {
+      const { run } = await as(SESSION_X, 'orchestration.runCreate', {
+        objective: 'o',
+        from: declared
+      })
+      expect(run).toMatchObject({ coordinator_handle: null })
+    }
+  )
+
+  it('refuses an alias of a chat declared on a request with no session id, naming the chat', async () => {
+    const response = await call(undefined, 'orchestration.send', {
+      from: formatOrcaSessionAddress(ALIAS_X),
+      to: WORKER_HANDLE,
+      subject: 's'
+    })
+    expect(response).toMatchObject({
+      ok: false,
+      error: { code: CODES.chatNotDeclarable, message: expect.stringContaining(SESSION_X) }
+    })
+  })
+})
diff --git a/src/main/runtime/rpc/orchestration-session-caller-test-fixture.ts b/src/main/runtime/rpc/orchestration-session-caller-test-fixture.ts
new file mode 100644
index 000000000000..396b0b2bec77
--- /dev/null
+++ b/src/main/runtime/rpc/orchestration-session-caller-test-fixture.ts
@@ -0,0 +1,167 @@
+import { vi } from 'vitest'
+import type { AgentSessionLease, AgentSessionRecord } from '../../../shared/agent-session-record'
+import {
+  agentSessionLeaseFixture,
+  agentSessionRecordFixture
+} from '../../../shared/agent-session-record.test-fixture'
+import type { OrchestrationCompatibilityEvidence } from '../../../shared/orchestration-compatibility-evidence'
+import { ORCHESTRATION_CONTRACT_VERSION } from '../../../shared/protocol-version'
+import { formatOrcaSessionAddress } from '../../../shared/orca-session-address'
+import { testOrcaSessionId } from '../../../shared/orca-session-address-test-fixture'
+import { OrcaRuntimeService } from '../orca-runtime'
+import { OrchestrationDb } from '../orchestration/db'
+import { structuredWorkerIdentities } from '../structured-worker-identity'
+import type { RpcRequest, RpcResponse } from './core'
+import { RpcDispatcher } from './dispatcher'
+import { ORCHESTRATION_METHODS } from './methods/orchestration'
+
+export const SESSION_X = testOrcaSessionId('4a1f6c2e-8b3d-4e7a-9c15-0d2b6e8f1a37')
+export const SESSION_Y = testOrcaSessionId('7e3b9d15-2c4a-4f86-a0b1-5c9e2d7f3b64')
+export const ADDRESS_X = formatOrcaSessionAddress(SESSION_X)
+export const ADDRESS_Y = formatOrcaSessionAddress(SESSION_Y)
+export const PROVIDER_ID_X = 'c0ffee11-2233-4455-8677-8899aabbccdd'
+export const WORKSPACE_X = 'repo_1::/work/tree-x'
+export const WORKER_HANDLE = 'term_worker'
+export const WORKER_PANE = 'tab_worker:77777777-7777-4777-8777-777777777777'
+
+export type SessionHostRef = { current: unknown }
+
+/** A live chat session record; the lease and location can be pushed into any state. */
+export function sessionRecord(
+  sessionId: string,
+  overrides: {
+    lease?: Partial<AgentSessionLease>
+    location?: Partial<AgentSessionRecord['location']>
+    providerId?: string
+  } = {}
+): AgentSessionRecord {
+  const base = agentSessionRecordFixture(
+    agentSessionLeaseFixture({ sessionId, runtimeKind: 'native', ...overrides.lease })
+  )
+  return {
+    ...base,
+    location: { ...base.location, workspaceId: WORKSPACE_X, ...overrides.location },
+    providerHandleChain: base.providerHandleChain.map((link) => ({
+      ...link,
+      handle: {
+        provider: 'claude' as const,
+        sessionId: overrides.providerId ?? `provider-${sessionId}`,
+        leafUuid: null
+      }
+    }))
+  }
+}
+
+export type SessionCallerHarness = {
+  runtime: OrcaRuntimeService
+  db: OrchestrationDb
+  dispatcher: RpcDispatcher
+  records: Map<string, AgentSessionRecord>
+  /** Unary socket route: what the local CLI's Unix socket and Electron IPC reach. */
+  dispatch: (request: RpcRequest) => Promise<RpcResponse>
+  /** Streaming dispatcher, optionally as a paired client on another host. */
+  dispatchStreaming: (request: RpcRequest, pairedDeviceId?: string) => Promise<unknown>
+  close: () => void
+}
+
+export function createSessionCallerHarness(hostRef: SessionHostRef): SessionCallerHarness {
+  const db = new OrchestrationDb(':memory:')
+  const runtime = new OrcaRuntimeService()
+  runtime.setOrchestrationDb(db)
+  vi.spyOn(runtime, 'ensureStructuredAgentSessionHost').mockResolvedValue()
+  vi.spyOn(runtime, 'getTerminalPaneKey').mockImplementation((handle) =>
+    handle === WORKER_HANDLE ? WORKER_PANE : null
+  )
+  vi.spyOn(runtime, 'getLiveTerminalPaneKey').mockImplementation((handle) =>
+    runtime.getTerminalPaneKey(handle)
+  )
+  const records = new Map<string, AgentSessionRecord>([
+    [SESSION_X, sessionRecord(SESSION_X, { providerId: PROVIDER_ID_X })],
+    [SESSION_Y, sessionRecord(SESSION_Y)]
+  ])
+  hostRef.current = {
+    deps: {
+      store: {
+        getRecord: (sessionId: string) => records.get(sessionId) ?? null,
+        listRecords: () => [...records.values()]
+      }
+    }
+  }
+  structuredWorkerIdentities.clear()
+  const dispatcher = new RpcDispatcher({ runtime, methods: ORCHESTRATION_METHODS })
+  return {
+    runtime,
+    db,
+    dispatcher,
+    records,
+    dispatch: (request) => dispatcher.dispatch(request),
+    dispatchStreaming: async (request, pairedDeviceId) => {
+      const replies: string[] = []
+      await dispatcher.dispatchStreaming(
+        request,
+        (reply) => replies.push(reply),
+        pairedDeviceId ? { pairedDeviceId } : {}
+      )
+      const [reply] = replies
+      if (replies.length !== 1 || reply === undefined) {
+        throw new Error(`expected exactly one reply, got ${replies.length}`)
+      }
+      const parsed: unknown = JSON.parse(reply)
+      return parsed
+    },
+    close: () => {
+      hostRef.current = null
+      structuredWorkerIdentities.clear()
+      db.close()
+    }
+  }
+}
+
+let requestCounter = 0
+
+/** An orchestration request as the CLI sends it, naming its caller by session id when given. */
+export function orchestrationRequest(
+  method: string,
+  params: Record<string, unknown>,
+  options: {
+    sessionId?: string
+    requestId?: string
+    evidence?: OrchestrationCompatibilityEvidence
+  } = {}
+): RpcRequest {
+  requestCounter += 1
+  const requestId = options.requestId ?? `req-${requestCounter}`
+  const evidence =
+    options.sessionId === undefined
+      ? options.evidence
+      : { ...options.evidence, agentSessionId: options.sessionId }
+  return {
+    id: `rpc-${requestCounter}`,
+    authToken: 'test',
+    method,
+    params,
+    orchestrationContractVersion: ORCHESTRATION_CONTRACT_VERSION,
+    orchestrationRequestId: requestId,
+    compatibilityInvocationId: requestId,
+    ...(evidence ? { orchestrationCompatibilityEvidence: evidence } : {})
+  }
+}
+
+export function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value)
+}
+
+export function resultOf(response: unknown): Record<string, unknown> {
+  if (!isRecord(response) || response.ok !== true || !isRecord(response.result)) {
+    throw new Error(`expected a successful response, got ${JSON.stringify(response)}`)
+  }
+  return response.result
+}
+
+/** The `id` of a row a receipt carries. */
+export function idOf(row: unknown): string {
+  if (!isRecord(row) || typeof row.id !== 'string') {
+    throw new Error(`expected a row with an id, got ${JSON.stringify(row)}`)
+  }
+  return row.id
+}
diff --git a/src/main/runtime/rpc/orchestration-session-caller.test.ts b/src/main/runtime/rpc/orchestration-session-caller.test.ts
new file mode 100644
index 000000000000..d96e214d4421
--- /dev/null
+++ b/src/main/runtime/rpc/orchestration-session-caller.test.ts
@@ -0,0 +1,404 @@
+import { mkdtempSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { ZodObject } from 'zod'
+import type { OrchestrationCompatibilityEvidence } from '../../../shared/orchestration-compatibility-evidence'
+import { ORCHESTRATION_SESSION_CALLER_ERROR_CODES as CODES } from '../../../shared/orchestration-session-caller-codes'
+import { DeviceRegistry } from '../device-registry'
+import { OrcaRuntimeRpcServer } from '../runtime-rpc'
+import { buildRegistry } from './core'
+import { ORCHESTRATION_METHODS } from './methods/orchestration'
+import {
+  mintStructuredWorkerHandle,
+  mintStructuredWorkerPaneKey,
+  structuredWorkerProcessIncarnation
+} from '../structured-worker-identity'
+import {
+  ADDRESS_X,
+  createSessionCallerHarness,
+  orchestrationRequest,
+  PROVIDER_ID_X,
+  idOf,
+  resultOf,
+  SESSION_X,
+  SESSION_Y,
+  sessionRecord,
+  type SessionCallerHarness
+} from './orchestration-session-caller-test-fixture'
+import {
+  needsOrchestrationCallerResolution,
+  ORCHESTRATION_CALLER_PARAM
+} from './orchestration-session-caller'
+import { ORCHESTRATION_TARGET_PARAM } from '../orchestration/orchestration-party'
+
+const hostRef = vi.hoisted((): { current: unknown } => ({ current: null }))
+vi.mock('../../native-chat/agent-session-wire/structured-agent-session-registry', () => ({
+  getStructuredAgentSessionHost: () => hostRef.current
+}))
+
+// Fields that can name a party: the caller in ORCHESTRATION_CALLER_PARAM, a target in ORCHESTRATION_TARGET_PARAM.
+const PARTY_NAMING_FIELDS = ['to', 'from', 'terminal', 'callerTerminalHandle'] as const
+// `method field` pairs with such a field that is neither, so never resolves as a party.
+const NAMES_NO_RESOLVED_PARTY: Readonly<Record<string, string>> = {
+  'orchestration.run from': 'retired; refused before any handler',
+  'orchestration.runShow from': 'reads a Run by id; `from` is unused',
+  'orchestration.dispatchShow from': '`from` only fills the preview preamble text',
+  'orchestration.workerStart terminal': 'adopts an existing PTY pane, which a session never has',
+  'orchestration.federationAttachStart terminal': 'names the remote worker terminal',
+  'orchestration.workerTerminalUserInput terminal': 'names the worker terminal'
+}
+
+/** One request per identity-consulting method, valid enough to reach the dispatcher entry. */
+const MINIMAL_PARAMS: Readonly<Record<string, Record<string, unknown>>> = {
+  'orchestration.runCreate': { objective: 'o' },
+  'orchestration.runUse': { id: 'run_missing' },
+  'orchestration.runCurrent': {},
+  'orchestration.check': {},
+  'orchestration.send': { subject: 's', to: 'term_worker' },
+  'orchestration.reply': { id: 'msg_missing', body: 'b' },
+  'orchestration.ask': { question: 'q', to: 'term_worker' },
+  'orchestration.dispatch': { task: 'task_missing', to: 'term_worker' },
+  'orchestration.gateCreate': { task: 'task_missing', question: 'q' },
+  'orchestration.gateResolve': { id: 'gate_missing', resolution: 'r' },
+  'orchestration.gateList': {},
+  'orchestration.taskCreate': { spec: 's' },
+  'orchestration.taskList': {},
+  'orchestration.taskUpdate': { id: 'task_missing', status: 'completed' },
+  'orchestration.workerStart': { spec: 's' }
+}
+
+describe('orchestration session callers at the dispatch entry', () => {
+  let h: SessionCallerHarness
+
+  beforeEach(() => {
+    h = createSessionCallerHarness(hostRef)
+  })
+
+  afterEach(() => {
+    h.close()
+    vi.restoreAllMocks()
+  })
+
+  it('classifies every party-naming field as the caller, a resolved target, or neither', () => {
+    const registry = buildRegistry(ORCHESTRATION_METHODS)
+    const partyNaming = [...registry.values()]
+      .flatMap((method) => {
+        const schema = method.params
+        return schema instanceof ZodObject
+          ? PARTY_NAMING_FIELDS.filter((field) => Object.hasOwn(schema.shape, field)).map(
+              (field) => `${method.name} ${field}`
+            )
+          : []
+      })
+      .sort()
+
+    // The population: 41 registered methods carrying 25 party-naming fields.
+    expect(registry.size).toBe(41)
+    expect(partyNaming).toHaveLength(25)
+    expect(partyNaming).toEqual(
+      [
+        ...Object.entries(ORCHESTRATION_CALLER_PARAM).map(
+          ([method, field]) => `${method} ${field}`
+        ),
+        ...Object.entries(ORCHESTRATION_TARGET_PARAM).map(
+          ([method, field]) => `${method} ${field}`
+        ),
+        ...Object.keys(NAMES_NO_RESOLVED_PARTY)
+      ].sort()
+    )
+    expect(Object.keys(MINIMAL_PARAMS).sort()).toEqual(
+      Object.keys(ORCHESTRATION_CALLER_PARAM).sort()
+    )
+  })
+
+  it.each(Object.keys(ORCHESTRATION_CALLER_PARAM))(
+    'refuses %s from a paired client before any effect, naming the host boundary',
+    async (method) => {
+      const response = await h.dispatchStreaming(
+        orchestrationRequest(method, MINIMAL_PARAMS[method] ?? {}, { sessionId: SESSION_X }),
+        'paired-device-1'
+      )
+
+      expect(response).toMatchObject({
+        ok: false,
+        error: {
+          code: CODES.hostBoundary,
+          message: expect.stringContaining('only on the host that runs that session'),
+          data: { effectsApplied: false }
+        }
+      })
+      expect(h.db.listRuns().runs.filter((run) => run.legacy === 0)).toEqual([])
+    }
+  )
+
+  it.each(Object.keys(ORCHESTRATION_CALLER_PARAM))(
+    'resolves %s on the local route as the session, never as a terminal',
+    async (method) => {
+      const spy = vi.spyOn(h.runtime, 'verifyOrchestrationCompatibilityCaller')
+      const response = await h.dispatch(
+        orchestrationRequest(method, MINIMAL_PARAMS[method] ?? {}, {
+          sessionId: SESSION_X,
+          evidence: {
+            terminalHandle: 'term_other',
+            paneKey: 'tab_other:1:2',
+            launchToken: 'secret'
+          }
+        })
+      )
+
+      // Whatever the method answers, it answered as the session: no host-boundary or session refusal,
+      // and terminal evidence on the same request never attested anyone.
+      if (!response.ok) {
+        expect(Object.values(CODES)).not.toContain(response.error.code)
+        expect(response.error.message).not.toContain('term_other')
+      }
+      for (const [evidence] of spy.mock.calls) {
+        expect(evidence?.terminalHandle).toBeUndefined()
+      }
+    }
+  )
+
+  it('admits the session on the real Unix-socket route and refuses it on the real paired route', async () => {
+    const userDataPath = mkdtempSync(join(tmpdir(), 'orca-session-caller-'))
+    const server = new OrcaRuntimeRpcServer({
+      runtime: h.runtime,
+      userDataPath,
+      enableWebSocket: false
+    })
+    server['deviceRegistry'] = new DeviceRegistry(userDataPath)
+    const device = server['deviceRegistry'].addDevice('laptop', 'runtime')
+    const request = orchestrationRequest(
+      'orchestration.runCreate',
+      { objective: 'o' },
+      {
+        sessionId: SESSION_X
+      }
+    )
+
+    const replies: string[] = []
+    await server['handleWebSocketMessage'](
+      JSON.stringify({ ...request, deviceToken: device.token }),
+      (reply) => replies.push(reply),
+      () => {},
+      undefined,
+      undefined,
+      device.token
+    )
+    expect(JSON.parse(replies[0] ?? '{}')).toMatchObject({
+      ok: false,
+      error: { code: CODES.hostBoundary }
+    })
+
+    const local = await server['handleMessage'](
+      JSON.stringify({ ...request, authToken: server['authToken'] })
+    )
+    expect(local).toMatchObject({ ok: true, result: { run: { objective: 'o' } } })
+    expect(
+      h.db.getCurrentRunForCoordinator({
+        terminalHandle: null,
+        paneKey: null,
+        orcaSessionId: SESSION_X
+      })
+    ).toMatchObject({ objective: 'o', coordinator_orca_session_id: SESSION_X })
+  })
+
+  describe('refuses a session that cannot act, before any destructive or consuming lookup', () => {
+    function seedPendingMail(): { runId: string; messageId: string } {
+      const run = h.db.createRun({
+        objective: 'x',
+        coordinatorHandle: null,
+        coordinatorPaneKey: null,
+        coordinatorOrcaSessionId: SESSION_X
+      })
+      const message = h.db.insertMessage({
+        from: 'term_worker',
+        to: ADDRESS_X,
+        subject: 'pending',
+        body: '',
+        runId: run.id
+      })
+      return { runId: run.id, messageId: message.id }
+    }
+
+    async function expectRefusedWithNoEffects(
+      sessionId: string,
+      code: string,
+      message: RegExp,
+      evidence?: OrchestrationCompatibilityEvidence
+    ): Promise<void> {
+      const { messageId } = seedPendingMail()
+      for (const [method, params] of [
+        ['orchestration.check', {}],
+        ['orchestration.reset', { messages: true }]
+      ] as const) {
+        const response = await h.dispatch(
+          orchestrationRequest(method, params, { sessionId, evidence })
+        )
+        expect(response, method).toMatchObject({
+          ok: false,
+          error: { code, message: expect.stringMatching(message) }
+        })
+      }
+      expect(h.db.getMessageById(messageId)).toMatchObject({ read: 0 })
+    }
+
+    it('an id that names no Orca session', async () => {
+      await expectRefusedWithNoEffects(
+        'ffffffff-0000-4000-8000-000000000000',
+        CODES.unknown,
+        /No Orca agent session .* exists on this host/
+      )
+    })
+
+    it('a terminal handle presented as a session id', async () => {
+      await expectRefusedWithNoEffects('term_4f2c9a0b', CODES.unknown, /not an Orca session id/)
+    })
+
+    it("a provider's session id, with a hint naming the Orca id", async () => {
+      const response = await h.dispatch(
+        orchestrationRequest('orchestration.runCurrent', {}, { sessionId: PROVIDER_ID_X })
+      )
+      expect(response).toMatchObject({
+        ok: false,
+        error: {
+          code: CODES.providerId,
+          message: expect.stringContaining(`This session's Orca id is ${SESSION_X}`),
+          data: { orcaSessionId: SESSION_X, effectsApplied: false }
+        }
+      })
+      await expectRefusedWithNoEffects(PROVIDER_ID_X, CODES.providerId, /changes on \/clear/)
+    })
+
+    it('a released lease', async () => {
+      h.records.set(SESSION_X, sessionRecord(SESSION_X, { lease: { claimStatus: 'released' } }))
+      await expectRefusedWithNoEffects(SESSION_X, CODES.notLive, /is not running right now/)
+    })
+
+    it('a lease mid owner change', async () => {
+      h.records.set(
+        SESSION_X,
+        sessionRecord(SESSION_X, {
+          lease: { handoffStage: 'new-owner-proving', handoffOperationId: 'op' }
+        })
+      )
+      await expectRefusedWithNoEffects(SESSION_X, CODES.notLive, /is changing owners/)
+    })
+
+    it('a lease the host has not reconciled since restart', async () => {
+      h.records.set(SESSION_X, sessionRecord(SESSION_X, { lease: { unreconciled: true } }))
+      await expectRefusedWithNoEffects(SESSION_X, CODES.notLive, /no live owner/)
+    })
+
+    it('a session whose record says it runs on another host', async () => {
+      h.records.set(
+        SESSION_X,
+        sessionRecord(SESSION_X, { location: { executionHostId: 'ssh:devbox' } })
+      )
+      await expectRefusedWithNoEffects(SESSION_X, CODES.hostBoundary, /runs on another host/)
+    })
+
+    it('a request from an SSH or WSL environment', async () => {
+      await expectRefusedWithNoEffects(SESSION_X, CODES.hostBoundary, /an SSH environment/, {
+        host: { kind: 'ssh', targetId: 't', connectionIncarnation: 'c', attachmentId: 'a' }
+      })
+      await expectRefusedWithNoEffects(SESSION_X, CODES.hostBoundary, /a WSL environment/, {
+        host: { kind: 'wsl', hostId: 'local', distro: 'Ubuntu' }
+      })
+    })
+
+    it('a structured worker session whose worker identity this host no longer has', async () => {
+      // A Dispatch recorded the session as a worker; no registry entry or custody row maps it now.
+      const run = h.db.createRun({
+        objective: 'pty',
+        coordinatorHandle: 'term_c',
+        coordinatorPaneKey: 'tab_c:13131313-1313-4313-8313-131313131313'
+      })
+      h.db.createDispatchContext({
+        taskId: h.db.createTask({ runId: run.id, spec: 'work' }).id,
+        assigneeHandle: mintStructuredWorkerHandle(),
+        assigneePaneKey: mintStructuredWorkerPaneKey(SESSION_Y),
+        processIncarnation: structuredWorkerProcessIncarnation(SESSION_Y),
+        creator: { kind: 'system' },
+        maxDepth: Number.MAX_SAFE_INTEGER
+      })
+
+      const response = await h.dispatch(
+        orchestrationRequest(
+          'orchestration.runCreate',
+          { objective: 'o' },
+          { sessionId: SESSION_Y }
+        )
+      )
+
+      expect(response).toMatchObject({
+        ok: false,
+        error: { code: CODES.notLive, message: expect.stringContaining('no longer has') }
+      })
+      expect(
+        h.db.listRuns().runs.filter((row) => row.coordinator_orca_session_id !== null)
+      ).toEqual([])
+    })
+
+    it('an agent-session host that cannot be brought up to verify it', async () => {
+      hostRef.current = null
+      await expectRefusedWithNoEffects(SESSION_X, CODES.notLive, /cannot be verified/)
+    })
+  })
+
+  describe('a declared caller must name the session', () => {
+    it('refuses a declared terminal handle that is not the session', async () => {
+      const response = await h.dispatch(
+        orchestrationRequest(
+          'orchestration.runCreate',
+          { objective: 'o', from: 'term_sibling' },
+          { sessionId: SESSION_X }
+        )
+      )
+      expect(response).toMatchObject({
+        ok: false,
+        error: {
+          code: 'consumer_fenced',
+          message: `This caller is agent session ${SESSION_X} and cannot act as term_sibling. No effects were applied.`
+        }
+      })
+      expect(h.db.listRuns().runs.filter((run) => run.legacy === 0)).toEqual([])
+    })
+
+    it("refuses a caller-supplied pane key on check, the restart fallback's substitute", async () => {
+      const response = await h.dispatch(
+        orchestrationRequest(
+          'orchestration.check',
+          { terminalPaneKey: 'tab_worker:77777777-7777-4777-8777-777777777777' },
+          { sessionId: SESSION_X }
+        )
+      )
+      expect(response).toMatchObject({ ok: false, error: { code: 'consumer_fenced' } })
+    })
+
+    it.each([ADDRESS_X, SESSION_X])('accepts the session named as %s', async (declared) => {
+      const run = resultOf(
+        await h.dispatch(
+          orchestrationRequest(
+            'orchestration.runCreate',
+            { objective: 'o', from: declared },
+            { sessionId: SESSION_X }
+          )
+        )
+      ).run
+      expect(run).toMatchObject({ objective: 'o', coordinator_handle: null })
+    })
+  })
+
+  it('leaves a terminal caller untouched: no claim, no normalization, no extra hop', async () => {
+    const request = orchestrationRequest('orchestration.runCreate', {
+      objective: 'o',
+      from: 'term_worker'
+    })
+    expect(needsOrchestrationCallerResolution(request)).toBe(false)
+
+    const run = resultOf(await h.dispatch(request)).run
+    expect(run).toMatchObject({ coordinator_handle: 'term_worker' })
+    expect(h.db.getRunRaw(idOf(run))?.coordinator_orca_session_id).toBeNull()
+  })
+})
diff --git a/src/main/runtime/rpc/orchestration-session-caller.ts b/src/main/runtime/rpc/orchestration-session-caller.ts
new file mode 100644
index 000000000000..e4bd09f2619f
--- /dev/null
+++ b/src/main/runtime/rpc/orchestration-session-caller.ts
@@ -0,0 +1,291 @@
+/**
+ * Resolves an orchestration caller that names itself by the Orca agent session id in its injected
+ * environment. Both dispatchers call this once, before params parse and the unary/streaming split,
+ * so it runs ahead of legacy compatibility, receipt lookup and every method. Before parsing, so a
+ * session caller need not name itself in a param that requires a caller.
+ *
+ * The id names the caller; nothing here is a credential. Every agent on this host runs as the same
+ * user, so the checks are about getting the identity right, not about keeping anyone out:
+ * - Same host only. A paired client, an SSH environment or a WSL shell is another host, where
+ *   "same machine, same user" does not hold, so a session claim from one is refused.
+ * - The Orca id, never the provider's: that one rotates on `/clear`.
+ * - A live lease: released, mid owner change or unreconciled sessions cannot act.
+ * - The session wins over any declared caller: a declared handle must name this same session, and
+ *   a structured worker's session id maps to the handle and pane it was minted.
+ * - A request with no session id that declares a `session:` caller gets the party it names: a
+ *   worker's handle, or a refusal for a chat, whose address alone identifies nobody.
+ */
+import { agentSessionLeaseAdmitsWriter } from '../../../shared/agent-session-lease-adjudication'
+import type { AgentSessionRecord } from '../../../shared/agent-session-record'
+import { isOrcaSessionId, parseOrcaSessionAddress } from '../../../shared/orca-session-address'
+import { ORCHESTRATION_SESSION_CALLER_ERROR_CODES as CODES } from '../../../shared/orchestration-session-caller-codes'
+import { getStructuredAgentSessionHost } from '../../native-chat/agent-session-wire/structured-agent-session-registry'
+import type { OrcaRuntimeService } from '../orca-runtime'
+import type { OrchestrationSessionCaller } from '../orchestration/orchestration-caller-identity'
+import { OrchestrationError } from '../orchestration/orchestration-error'
+import { canonicalOrcaSessionId } from '../orchestration/canonical-orca-session-id'
+import type { OrchestrationDb } from '../orchestration/db'
+import {
+  resolveDeclaredCallerParty,
+  resolveOrcaSessionParty,
+  resolveOrchestrationParty
+} from '../orchestration/orchestration-party'
+import { structuredWorkerHostScope } from '../structured-worker-identity'
+import type { RpcRequest } from './core'
+
+type CallerParam = 'from' | 'terminal' | 'callerTerminalHandle'
+
+/**
+ * Every method that consults caller identity, and the param it names its caller in. This list is
+ * the contract: a method that starts reading caller identity is added here with its own test.
+ * Methods not listed carry no caller identity for any caller; a session claim on them is still
+ * validated, then they run exactly as they do for a terminal caller.
+ */
+export const ORCHESTRATION_CALLER_PARAM: Readonly<Record<string, CallerParam>> = {
+  'orchestration.runCreate': 'from',
+  'orchestration.runUse': 'from',
+  'orchestration.runCurrent': 'from',
+  'orchestration.check': 'terminal',
+  'orchestration.send': 'from',
+  'orchestration.reply': 'from',
+  'orchestration.ask': 'from',
+  'orchestration.dispatch': 'from',
+  'orchestration.gateCreate': 'from',
+  'orchestration.gateResolve': 'from',
+  'orchestration.gateList': 'from',
+  'orchestration.taskCreate': 'callerTerminalHandle',
+  'orchestration.taskList': 'callerTerminalHandle',
+  'orchestration.taskUpdate': 'callerTerminalHandle',
+  'orchestration.workerStart': 'from'
+}
+
+export type OrchestrationRequestRoute = {
+  /** Set only by the paired WebSocket route: the request came from another host's client. */
+  pairedDeviceId?: string
+}
+
+export type ResolvedOrchestrationRequest = {
+  /** The request with its declared caller bound to the session and its evidence reduced to it. */
+  request: RpcRequest
+  caller?: OrchestrationSessionCaller
+}
+
+const NO_EFFECTS = { effectsApplied: false } as const
+
+/**
+ * Whether this request names its caller by a session id, or declares a `session:` address as its
+ * caller. Synchronous, so every other request, terminal callers included, takes no extra async hop.
+ */
+export function needsOrchestrationCallerResolution(request: RpcRequest): boolean {
+  if (!request.method.startsWith('orchestration.')) {
+    return false
+  }
+  return (
+    request.orchestrationCompatibilityEvidence?.agentSessionId !== undefined ||
+    declaredSessionAddress(request) !== undefined
+  )
+}
+
+function declaredSessionAddress(request: RpcRequest): string | undefined {
+  const name = ORCHESTRATION_CALLER_PARAM[request.method]
+  const params: unknown = request.params
+  if (!name || !params || typeof params !== 'object' || Array.isArray(params)) {
+    return undefined
+  }
+  const values: Record<string, unknown> = { ...params }
+  const declared = values[name]
+  return typeof declared === 'string' && parseOrcaSessionAddress(declared) ? declared : undefined
+}
+
+/** Only for a request `needsOrchestrationCallerResolution` accepts. Throws the refusal, if any. */
+export async function resolveOrchestrationSessionCaller(
+  runtime: OrcaRuntimeService,
+  request: RpcRequest,
+  route: OrchestrationRequestRoute | undefined
+): Promise<ResolvedOrchestrationRequest> {
+  const evidence = request.orchestrationCompatibilityEvidence
+  if (evidence?.agentSessionId === undefined) {
+    return { request: bindDeclaredSessionAddress(runtime.getOrchestrationDb(), request) }
+  }
+  const claimed: unknown = evidence?.agentSessionId
+  if (route?.pairedDeviceId !== undefined) {
+    throw hostBoundary(
+      'This request reached Orca from a paired client, and an agent session id identifies a caller only on the host that runs that session.'
+    )
+  }
+  if (evidence?.host) {
+    throw hostBoundary(
+      `This command ran in ${evidence.host.kind === 'ssh' ? 'an SSH' : 'a WSL'} environment, and an agent session id identifies a caller only on the host that runs that session.`
+    )
+  }
+  if (typeof claimed !== 'string' || !isOrcaSessionId(claimed)) {
+    throw new OrchestrationError(
+      CODES.unknown,
+      'The caller named an agent session id that is not an Orca session id. No effects were applied.',
+      NO_EFFECTS
+    )
+  }
+  const sessionId = claimed
+  const record = await readSessionRecord(runtime, sessionId)
+  assertSessionCanAct(sessionId, record)
+  const db = runtime.getOrchestrationDb()
+  const caller: OrchestrationSessionCaller = Object.freeze({
+    ...resolveOrcaSessionParty(sessionId, db),
+    sessionId,
+    workspaceId: record.location.workspaceId
+  })
+  return {
+    request: {
+      ...request,
+      params: bindDeclaredCaller(request.method, request.params, caller, db),
+      // Why: the session wins, so any terminal evidence on the same request never attests.
+      orchestrationCompatibilityEvidence: { agentSessionId: sessionId }
+    },
+    caller
+  }
+}
+
+async function readSessionRecord(
+  runtime: OrcaRuntimeService,
+  sessionId: string
+): Promise<AgentSessionRecord> {
+  let store: ReturnType<typeof sessionRecordStore>
+  try {
+    await runtime.ensureStructuredAgentSessionHost()
+    store = sessionRecordStore()
+  } catch {
+    store = null
+  }
+  if (!store) {
+    throw new OrchestrationError(
+      CODES.notLive,
+      `Agent session ${sessionId} cannot be verified: this Orca is not running its agent-session host. No effects were applied.`,
+      NO_EFFECTS
+    )
+  }
+  const record = store.getRecord(sessionId)
+  if (record) {
+    return record
+  }
+  const owner = store.listRecords().find((candidate) => namesProviderSession(candidate, sessionId))
+  if (owner) {
+    throw new OrchestrationError(
+      CODES.providerId,
+      `${sessionId} is the provider's own session id, which changes on /clear. This session's Orca id is ${owner.sessionId}; use that instead. No effects were applied.`,
+      { ...NO_EFFECTS, orcaSessionId: owner.sessionId }
+    )
+  }
+  throw new OrchestrationError(
+    CODES.unknown,
+    `No Orca agent session ${sessionId} exists on this host. No effects were applied.`,
+    NO_EFFECTS
+  )
+}
+
+function sessionRecordStore(): {
+  getRecord: (sessionId: string) => AgentSessionRecord | null
+  listRecords: () => AgentSessionRecord[]
+} | null {
+  return getStructuredAgentSessionHost()?.deps.store ?? null
+}
+
+function namesProviderSession(record: AgentSessionRecord, id: string): boolean {
+  return record.providerHandleChain.some(({ handle }) =>
+    handle.provider === 'claude' ? handle.sessionId === id : handle.threadId === id
+  )
+}
+
+function assertSessionCanAct(sessionId: string, record: AgentSessionRecord): void {
+  if (!structuredWorkerHostScope(record.location)) {
+    throw hostBoundary(
+      `Agent session ${sessionId} runs on another host, and an agent session id identifies a caller only on the host that runs that session.`
+    )
+  }
+  if (agentSessionLeaseAdmitsWriter(record.lease)) {
+    return
+  }
+  const { lease } = record
+  const reason =
+    lease.claimStatus === 'released'
+      ? // Why not "ended": a released lease is evicted and wakeable; only a running process may act.
+        'is not running right now. A new message or user turn revives it; retry then.'
+      : lease.handoffStage !== null
+        ? 'is changing owners on this host. Retry when that finishes.'
+        : 'has no live owner on this host right now. Retry once it is running.'
+  throw new OrchestrationError(
+    CODES.notLive,
+    `Agent session ${sessionId} ${reason} No effects were applied.`,
+    NO_EFFECTS
+  )
+}
+
+/** A request with no session id that declares a `session:` caller: a worker's is its handle. */
+function bindDeclaredSessionAddress(db: OrchestrationDb, request: RpcRequest): RpcRequest {
+  const name = ORCHESTRATION_CALLER_PARAM[request.method]
+  const declared = declaredSessionAddress(request)
+  const params: unknown = request.params
+  if (!name || declared === undefined || !params || typeof params !== 'object') {
+    return request
+  }
+  const party = resolveDeclaredCallerParty(declared, db)
+  return { ...request, params: { ...params, [name]: party.address } }
+}
+
+/** Whether a declared caller names this session: any spelling that resolves to its party. */
+function declaredNamesCaller(
+  declared: unknown,
+  caller: OrchestrationSessionCaller,
+  db: OrchestrationDb
+): boolean {
+  if (typeof declared !== 'string') {
+    return false
+  }
+  if (isOrcaSessionId(declared)) {
+    return canonicalOrcaSessionId(declared) === caller.orcaSessionId
+  }
+  try {
+    return resolveOrchestrationParty(declared, db).address === caller.address
+  } catch {
+    return false
+  }
+}
+
+/** The declared caller, if any, must name this session; it is then replaced by its address. */
+function bindDeclaredCaller(
+  method: string,
+  params: unknown,
+  caller: OrchestrationSessionCaller,
+  db: OrchestrationDb
+): unknown {
+  const name = ORCHESTRATION_CALLER_PARAM[method]
+  if (!name || !params || typeof params !== 'object' || Array.isArray(params)) {
+    return params
+  }
+  const values: Record<string, unknown> = { ...params }
+  const declared = values[name]
+  if (declared !== undefined && !declaredNamesCaller(declared, caller, db)) {
+    throw consumerFenced(caller, String(declared))
+  }
+  // Why: check's restart fallback takes a pane key from the caller; a session has its own or none.
+  if (values.terminalPaneKey !== undefined && values.terminalPaneKey !== caller.paneKey) {
+    throw consumerFenced(caller, `pane ${String(values.terminalPaneKey)}`)
+  }
+  values[name] = caller.address
+  return values
+}
+
+function consumerFenced(caller: OrchestrationSessionCaller, declared: string): OrchestrationError {
+  return new OrchestrationError(
+    'consumer_fenced',
+    `This caller is agent session ${caller.sessionId} and cannot act as ${declared}. No effects were applied.`,
+    NO_EFFECTS
+  )
+}
+
+function hostBoundary(reason: string): OrchestrationError {
+  return new OrchestrationError(
+    CODES.hostBoundary,
+    `${reason} Run the command on that host. No effects were applied.`,
+    NO_EFFECTS
+  )
+}
diff --git a/src/main/runtime/rpc/orchestration-session-coordinator.test.ts b/src/main/runtime/rpc/orchestration-session-coordinator.test.ts
new file mode 100644
index 000000000000..a60c3a169168
--- /dev/null
+++ b/src/main/runtime/rpc/orchestration-session-coordinator.test.ts
@@ -0,0 +1,637 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import {
+  mintStructuredWorkerHandle,
+  mintStructuredWorkerPaneKey,
+  structuredWorkerIdentities,
+  structuredWorkerProcessIncarnation
+} from '../structured-worker-identity'
+import {
+  ADDRESS_X,
+  ADDRESS_Y,
+  createSessionCallerHarness,
+  orchestrationRequest,
+  idOf,
+  resultOf,
+  SESSION_X,
+  SESSION_Y,
+  WORKER_HANDLE,
+  WORKER_PANE,
+  WORKSPACE_X,
+  type SessionCallerHarness
+} from './orchestration-session-caller-test-fixture'
+
+const hostRef = vi.hoisted((): { current: unknown } => ({ current: null }))
+vi.mock('../../native-chat/agent-session-wire/structured-agent-session-registry', () => ({
+  getStructuredAgentSessionHost: () => hostRef.current
+}))
+
+type Row = Record<string, unknown>
+
+describe('a structured chat coordinates through the same verbs as a terminal', () => {
+  let h: SessionCallerHarness
+
+  beforeEach(() => {
+    h = createSessionCallerHarness(hostRef)
+  })
+
+  afterEach(() => {
+    h.close()
+    vi.restoreAllMocks()
+  })
+
+  async function as(sessionId: string | undefined, method: string, params: Row): Promise<Row> {
+    return resultOf(await h.dispatch(orchestrationRequest(method, params, { sessionId })))
+  }
+
+  async function runCreate(sessionId: string, objective = 'o'): Promise<string> {
+    const { run } = await as(sessionId, 'orchestration.runCreate', { objective })
+    return idOf(run)
+  }
+
+  it('runs the supervised loop: run, task, dispatch, worker mail in, check, send, reply, gates', async () => {
+    const runId = await runCreate(SESSION_X)
+    expect(h.db.getRunRaw(runId)).toMatchObject({
+      coordinator_handle: null,
+      coordinator_pane_key: null,
+      coordinator_orca_session_id: SESSION_X
+    })
+    expect(await as(SESSION_X, 'orchestration.runCurrent', {})).toMatchObject({
+      run: { id: runId }
+    })
+
+    const { task } = await as(SESSION_X, 'orchestration.taskCreate', { spec: 'do it' })
+    const taskId = idOf(task)
+    expect(task).toMatchObject({ run_id: runId, created_by_terminal_handle: null })
+    expect(await as(SESSION_X, 'orchestration.taskList', {})).toMatchObject({ runId, count: 1 })
+
+    const { dispatch } = await as(SESSION_X, 'orchestration.dispatch', {
+      task: taskId,
+      to: WORKER_HANDLE
+    })
+    expect(dispatch).toMatchObject({
+      assignee_handle: WORKER_HANDLE,
+      creator_handle: null,
+      creator_pane_key: null,
+      creator_orca_session_id: SESSION_X,
+      depth: 1
+    })
+
+    // The worker writes to its coordinator's public address.
+    const { message: inbound } = await as(undefined, 'orchestration.send', {
+      from: WORKER_HANDLE,
+      to: ADDRESS_X,
+      subject: 'progress'
+    })
+    expect(inbound).toMatchObject({ to_handle: `run:${runId}`, run_id: runId })
+
+    const checked = await as(SESSION_X, 'orchestration.check', {})
+    expect(checked).toMatchObject({ runId, count: 1, messages: [{ subject: 'progress' }] })
+
+    const { message: outbound } = await as(SESSION_X, 'orchestration.send', {
+      to: WORKER_HANDLE,
+      subject: 'more'
+    })
+    expect(outbound).toMatchObject({
+      from_handle: ADDRESS_X,
+      to_handle: `dispatch:${idOf(dispatch)}`,
+      run_id: runId
+    })
+
+    const replied = await as(SESSION_X, 'orchestration.reply', {
+      id: idOf(inbound),
+      body: 'ack'
+    })
+    expect(replied).toMatchObject({
+      message: {
+        from_handle: ADDRESS_X,
+        to_handle: `dispatch:${idOf(dispatch)}`,
+        run_id: runId,
+        thread_id: idOf(inbound)
+      }
+    })
+    expect(await as(undefined, 'orchestration.check', { terminal: WORKER_HANDLE })).toMatchObject({
+      runId,
+      dispatchId: idOf(dispatch),
+      count: 2,
+      messages: [{ id: idOf(outbound) }, { id: idOf(replied.message) }]
+    })
+
+    const { gate } = await as(SESSION_X, 'orchestration.gateCreate', {
+      task: taskId,
+      question: 'ship?'
+    })
+    expect(await as(SESSION_X, 'orchestration.gateList', {})).toMatchObject({ runId, count: 1 })
+    expect(
+      await as(SESSION_X, 'orchestration.gateResolve', {
+        id: idOf(gate),
+        resolution: 'yes'
+      })
+    ).toMatchObject({ gate: { status: 'resolved' } })
+
+    expect(
+      await as(SESSION_X, 'orchestration.taskUpdate', { id: taskId, status: 'completed' })
+    ).toMatchObject({ task: { status: 'completed' } })
+  })
+
+  it("files a session's mail to a plain terminal under its own Run", async () => {
+    const runId = await runCreate(SESSION_X)
+    const { message } = await as(SESSION_X, 'orchestration.send', {
+      to: WORKER_HANDLE,
+      subject: 'no dispatch here'
+    })
+    expect(message).toMatchObject({
+      from_handle: ADDRESS_X,
+      to_handle: WORKER_HANDLE,
+      run_id: runId
+    })
+  })
+
+  it("addresses a group to the session's own Run", async () => {
+    await runCreate(SESSION_X)
+    const response = await h.dispatch(
+      orchestrationRequest(
+        'orchestration.send',
+        { to: '@all', subject: 'everyone' },
+        {
+          sessionId: SESSION_X
+        }
+      )
+    )
+    // The audience resolved to the session's Run; that Run simply has no workers yet.
+    expect(response).toMatchObject({
+      ok: false,
+      error: {
+        code: 'terminal_not_found',
+        message: 'No recipients resolved for group address: @all'
+      }
+    })
+  })
+
+  it('asks as a coordinator does: only a supervised worker may ask', async () => {
+    await runCreate(SESSION_X)
+    const response = await h.dispatch(
+      orchestrationRequest(
+        'orchestration.ask',
+        { question: 'q', to: WORKER_HANDLE },
+        {
+          sessionId: SESSION_X
+        }
+      )
+    )
+    expect(response).toMatchObject({ ok: false, error: { code: 'dispatch_inactive' } })
+  })
+
+  it("lets its worker ask it at its session address, the one the worker's preamble names", async () => {
+    const runId = await runCreate(SESSION_X)
+    const taskId = idOf((await as(SESSION_X, 'orchestration.taskCreate', { spec: 'q' })).task)
+    await as(SESSION_X, 'orchestration.dispatch', { task: taskId, to: WORKER_HANDLE })
+
+    const asked = await as(undefined, 'orchestration.ask', {
+      from: WORKER_HANDLE,
+      to: ADDRESS_X,
+      question: 'which way?',
+      timeoutMs: 0
+    })
+    expect(asked).toMatchObject({ timedOut: true })
+    expect(h.db.getQuestion(String(asked.messageId))).toMatchObject({ run_id: runId })
+  })
+
+  it("places a worker-start in the session's own workspace", async () => {
+    const runId = await runCreate(SESSION_X)
+    vi.spyOn(h.runtime, 'validateOrchestrationAgentLauncher').mockImplementation(() => {})
+    const placed = vi
+      .spyOn(h.runtime, 'showManagedTerminalWorkspace')
+      .mockRejectedValue(new Error('placement reached'))
+    const response = await h.dispatch(
+      orchestrationRequest(
+        'orchestration.workerStart',
+        { spec: 'work', run: runId, agent: 'claude' },
+        {
+          sessionId: SESSION_X
+        }
+      )
+    )
+    expect(placed).toHaveBeenCalledWith(`id:${WORKSPACE_X}`)
+    expect(response).toMatchObject({ ok: false, error: { message: 'placement reached' } })
+  })
+
+  it("never lets one chat's run-create unbind another chat's Run", async () => {
+    const xFirst = await runCreate(SESSION_X, 'x first')
+    const yRun = await runCreate(SESSION_Y, 'y')
+    const xSecond = await runCreate(SESSION_X, 'x second')
+
+    expect(await as(SESSION_Y, 'orchestration.runCurrent', {})).toMatchObject({
+      run: { id: yRun }
+    })
+    expect(await as(SESSION_X, 'orchestration.runCurrent', {})).toMatchObject({
+      run: { id: xSecond }
+    })
+    expect(h.db.getRunRaw(xFirst)?.coordinator_orca_session_id).toBeNull()
+  })
+
+  it('takes over a bound Run like a terminal does, and fences the previous coordinator', async () => {
+    const runId = await runCreate(SESSION_X)
+    await as(undefined, 'orchestration.send', {
+      from: WORKER_HANDLE,
+      to: ADDRESS_X,
+      subject: 'before takeover',
+      run: runId
+    })
+
+    expect(await as(SESSION_Y, 'orchestration.runUse', { id: runId })).toMatchObject({
+      run: { id: runId }
+    })
+
+    const previous = await h.dispatch(
+      orchestrationRequest('orchestration.check', { run: runId }, { sessionId: SESSION_X })
+    )
+    expect(previous).toMatchObject({
+      ok: false,
+      error: {
+        code: 'consumer_fenced',
+        message: `This coordinator terminal is no longer bound to Run ${runId}.`
+      }
+    })
+    expect(await as(SESSION_X, 'orchestration.runCurrent', {})).toMatchObject({ run: null })
+    expect(await as(SESSION_Y, 'orchestration.check', {})).toMatchObject({
+      runId,
+      messages: [{ subject: 'before takeover' }]
+    })
+  })
+
+  it("wakes the previous coordinator's waiting check as fenced when another session takes over", async () => {
+    const runId = await runCreate(SESSION_X)
+    const waiter = vi.spyOn(h.runtime, 'waitForMessage')
+    const waiting = h.dispatch(
+      orchestrationRequest(
+        'orchestration.check',
+        { run: runId, wait: true, timeoutMs: 5_000 },
+        {
+          sessionId: SESSION_X
+        }
+      )
+    )
+    await vi.waitFor(() => expect(waiter).toHaveBeenCalledWith(`run:${runId}`, expect.anything()))
+    const deliver = vi.spyOn(h.db, 'getOrCreateRunDelivery')
+    const acknowledge = vi.spyOn(h.db, 'acknowledgeRunDelivery')
+
+    await as(SESSION_Y, 'orchestration.runUse', { id: runId })
+
+    const fenced = await waiting
+    expect(fenced).toMatchObject({ ok: false, error: { code: 'consumer_fenced' } })
+    expect(fenced).not.toHaveProperty('result')
+
+    const { message } = await as(undefined, 'orchestration.send', {
+      from: WORKER_HANDLE,
+      to: ADDRESS_Y,
+      subject: 'after takeover',
+      run: runId
+    })
+    expect(
+      await h.dispatch(
+        orchestrationRequest('orchestration.check', { run: runId }, { sessionId: SESSION_X })
+      )
+    ).toMatchObject({ ok: false, error: { code: 'consumer_fenced' } })
+    expect(deliver).not.toHaveBeenCalled()
+
+    const replacement = await as(SESSION_Y, 'orchestration.check', {})
+    expect(replacement).toMatchObject({
+      runId,
+      count: 1,
+      messages: [{ id: idOf(message), to_handle: `run:${runId}`, run_id: runId }]
+    })
+    const ack = replacement.deliveryId
+    if (typeof ack !== 'string') {
+      throw new Error('Expected a Run Delivery')
+    }
+    expect(
+      await h.dispatch(
+        orchestrationRequest('orchestration.check', { run: runId, ack }, { sessionId: SESSION_X })
+      )
+    ).toMatchObject({ ok: false, error: { code: 'consumer_fenced' } })
+    expect(acknowledge).not.toHaveBeenCalled()
+    expect(h.db.getDeliveryRaw(ack)?.acknowledged_at).toBeNull()
+    expect(await as(SESSION_Y, 'orchestration.check', {})).toMatchObject({
+      deliveryId: ack,
+      replayed: true,
+      messages: [{ id: idOf(message) }]
+    })
+    expect(await as(SESSION_Y, 'orchestration.check', { ack })).toMatchObject({
+      acknowledged: ack,
+      count: 0
+    })
+    expect(h.db.getDeliveryRaw(ack)?.status).toBe('acknowledged')
+  })
+
+  it('stops counting a coordinator Orca session id once an older binary rebinds the Run to a terminal', async () => {
+    const runId = await runCreate(SESSION_X)
+    // An older binary's bindRun rewrites handle and pane and bumps the generation, never the Orca session id.
+    h.db.db
+      .prepare(
+        `UPDATE runs SET coordinator_handle = ?, coordinator_pane_key = ?,
+           consumer_generation = consumer_generation + 1
+         WHERE id = ?`
+      )
+      .run(WORKER_HANDLE, WORKER_PANE, runId)
+
+    expect(await as(SESSION_X, 'orchestration.runCurrent', {})).toMatchObject({ run: null })
+    expect(await as(undefined, 'orchestration.runCurrent', { from: WORKER_HANDLE })).toMatchObject({
+      run: { id: runId }
+    })
+  })
+
+  it('replays an idempotent retry from the same session and refuses it from another', async () => {
+    const first = await h.dispatch(
+      orchestrationRequest(
+        'orchestration.runCreate',
+        { objective: 'o' },
+        {
+          sessionId: SESSION_X,
+          requestId: 'retry-1'
+        }
+      )
+    )
+    const retry = await h.dispatch(
+      orchestrationRequest(
+        'orchestration.runCreate',
+        { objective: 'o' },
+        {
+          sessionId: SESSION_X,
+          requestId: 'retry-1'
+        }
+      )
+    )
+    const other = await h.dispatch(
+      orchestrationRequest(
+        'orchestration.runCreate',
+        { objective: 'o' },
+        {
+          sessionId: SESSION_Y,
+          requestId: 'retry-1'
+        }
+      )
+    )
+
+    const firstRun = idOf(resultOf(first).run)
+    expect(resultOf(retry)).toMatchObject({ run: { id: firstRun }, mutation: { replayed: true } })
+    expect(other).toMatchObject({ ok: false, error: { code: 'request_mismatch' } })
+    expect(h.db.listRuns().runs.filter((run) => run.legacy === 0)).toHaveLength(1)
+  })
+})
+
+describe('a session with no Run, and receipts that carry no caller param', () => {
+  let h: SessionCallerHarness
+
+  beforeEach(() => {
+    h = createSessionCallerHarness(hostRef)
+  })
+
+  afterEach(() => {
+    h.close()
+    vi.restoreAllMocks()
+  })
+
+  it('reads its direct mailbox on a consuming check, as a terminal with a live pane does', async () => {
+    h.db.insertMessage({ from: WORKER_HANDLE, to: ADDRESS_X, subject: 'direct', body: '' })
+
+    const checked = resultOf(
+      await h.dispatch(orchestrationRequest('orchestration.check', {}, { sessionId: SESSION_X }))
+    )
+
+    expect(checked).toMatchObject({ messages: [{ subject: 'direct', to_handle: ADDRESS_X }] })
+  })
+
+  it('binds a receipt to the session even when the method names no caller', async () => {
+    const reset = (sessionId: string) =>
+      h.dispatch(
+        orchestrationRequest(
+          'orchestration.reset',
+          { messages: true },
+          {
+            sessionId,
+            requestId: 'reset-1'
+          }
+        )
+      )
+
+    expect(await reset(SESSION_X)).toMatchObject({ ok: true })
+    expect(await reset(SESSION_X)).toMatchObject({
+      ok: true,
+      result: { mutation: { replayed: true } }
+    })
+    expect(await reset(SESSION_Y)).toMatchObject({
+      ok: false,
+      error: { code: 'request_mismatch' }
+    })
+  })
+})
+
+describe('a structured worker that names itself by session id', () => {
+  let h: SessionCallerHarness
+  const workerSession = SESSION_Y
+  const handle = mintStructuredWorkerHandle()
+  const paneKey = mintStructuredWorkerPaneKey(workerSession)
+
+  beforeEach(() => {
+    h = createSessionCallerHarness(hostRef)
+    structuredWorkerIdentities.register({
+      handle,
+      sessionId: workerSession,
+      agent: 'claude',
+      paneKey,
+      processIncarnation: structuredWorkerProcessIncarnation(workerSession),
+      worktreeId: 'wt_1',
+      hostScope: { kind: 'local', hostId: 'local' }
+    })
+  })
+
+  afterEach(() => {
+    h.close()
+    vi.restoreAllMocks()
+  })
+
+  function dispatchToWorker(): { runId: string; dispatchId: string } {
+    const run = h.db.createRun({
+      objective: 'pty coordinator',
+      coordinatorHandle: 'term_coord',
+      coordinatorPaneKey: 'tab_coord:12121212-1212-4212-8212-121212121212'
+    })
+    const dispatch = h.db.createDispatchContext({
+      taskId: h.db.createTask({ runId: run.id, spec: 'work' }).id,
+      assigneeHandle: handle,
+      assigneePaneKey: paneKey,
+      processIncarnation: structuredWorkerProcessIncarnation(workerSession),
+      creator: { kind: 'system' },
+      maxDepth: Number.MAX_SAFE_INTEGER
+    })
+    h.db.insertMessage({
+      from: 'term_coord',
+      to: `dispatch:${dispatch.id}`,
+      subject: 'instructions',
+      body: '',
+      runId: run.id
+    })
+    return { runId: run.id, dispatchId: dispatch.id }
+  }
+
+  it("reads its own Dispatch mailbox: the session id wins and maps to the worker's handle", async () => {
+    const { dispatchId } = dispatchToWorker()
+    expect(h.db.getDispatchContextById(dispatchId)?.assignee_orca_session_id).toBe(SESSION_Y)
+
+    const bySession = resultOf(
+      await h.dispatch(
+        orchestrationRequest('orchestration.check', { peek: true }, { sessionId: workerSession })
+      )
+    )
+    expect(bySession).toMatchObject({ messages: [{ subject: 'instructions' }] })
+
+    const namedByHandle = resultOf(
+      await h.dispatch(
+        orchestrationRequest(
+          'orchestration.check',
+          { peek: true, terminal: handle },
+          {
+            sessionId: workerSession
+          }
+        )
+      )
+    )
+    expect(namedByHandle).toEqual(bySession)
+  })
+
+  it.each([
+    ['its handle', handle],
+    ['its session address', ADDRESS_Y],
+    ['its bare session id', workerSession]
+  ])('accepts itself declared as %s and binds by its handle', async (_label, declared) => {
+    const { run } = resultOf(
+      await h.dispatch(
+        orchestrationRequest(
+          'orchestration.runCreate',
+          { objective: 'declared', from: declared },
+          { sessionId: workerSession }
+        )
+      )
+    )
+    expect(h.db.getRunRaw(idOf(run))).toMatchObject({
+      coordinator_handle: handle,
+      coordinator_orca_session_id: SESSION_Y
+    })
+  })
+
+  it('sends mail at either of its spellings to its Dispatch once assigned in a Run it coordinated before', async () => {
+    const { run } = resultOf(
+      await h.dispatch(
+        orchestrationRequest(
+          'orchestration.runCreate',
+          { objective: 'o' },
+          { sessionId: workerSession }
+        )
+      )
+    )
+    const runId = idOf(run)
+    // A chat takes the Run over; the worker's addresses stay remembered as a former coordinator's.
+    resultOf(
+      await h.dispatch(
+        orchestrationRequest('orchestration.runUse', { id: runId }, { sessionId: SESSION_X })
+      )
+    )
+    expect(h.db.getRunMailboxOwnerIdsForHandle(ADDRESS_Y)).toEqual([runId])
+    const dispatch = h.db.createDispatchContext({
+      taskId: h.db.createTask({ runId, spec: 'work' }).id,
+      assigneeHandle: handle,
+      assigneePaneKey: paneKey,
+      processIncarnation: structuredWorkerProcessIncarnation(workerSession),
+      creator: { kind: 'session', orcaSessionId: SESSION_X },
+      maxDepth: Number.MAX_SAFE_INTEGER
+    })
+
+    // Both spellings name one party, so both land in the one mailbox it reads, not the Run's.
+    for (const to of [ADDRESS_Y, handle]) {
+      const { message } = resultOf(
+        await h.dispatch(
+          orchestrationRequest('orchestration.send', { to, subject: to }, { sessionId: SESSION_X })
+        )
+      )
+      expect(message).toMatchObject({ to_handle: `dispatch:${dispatch.id}` })
+    }
+    const read = resultOf(
+      await h.dispatch(
+        orchestrationRequest('orchestration.check', { peek: true }, { sessionId: workerSession })
+      )
+    )
+    expect(read).toMatchObject({
+      count: 2,
+      messages: expect.arrayContaining([
+        expect.objectContaining({ subject: handle }),
+        expect.objectContaining({ subject: ADDRESS_Y })
+      ])
+    })
+  })
+
+  it('coordinates with its handle, pane and Orca session id, one mailbox at both spellings', async () => {
+    const { run } = resultOf(
+      await h.dispatch(
+        orchestrationRequest(
+          'orchestration.runCreate',
+          { objective: 'nested' },
+          {
+            sessionId: workerSession
+          }
+        )
+      )
+    )
+    const runId = idOf(run)
+
+    expect(h.db.getRunRaw(runId)).toMatchObject({
+      coordinator_handle: handle,
+      coordinator_pane_key: paneKey,
+      coordinator_orca_session_id: SESSION_Y
+    })
+    expect(h.db.getRunMailboxOwnerIdsForHandle(handle)).toEqual([runId])
+    for (const to of [handle, ADDRESS_Y]) {
+      const { message } = resultOf(
+        await h.dispatch(
+          orchestrationRequest('orchestration.send', { from: WORKER_HANDLE, to, subject: to })
+        )
+      )
+      expect(message).toMatchObject({ to_handle: `run:${runId}` })
+    }
+  })
+
+  it.each([
+    ['its handle', handle],
+    ['its session address', ADDRESS_Y]
+  ])('is asked by its own worker at %s', async (_label, to) => {
+    const { run } = resultOf(
+      await h.dispatch(
+        orchestrationRequest(
+          'orchestration.runCreate',
+          { objective: 'o' },
+          { sessionId: workerSession }
+        )
+      )
+    )
+    const runId = idOf(run)
+    h.db.createDispatchContext({
+      taskId: h.db.createTask({ runId, spec: 'sub' }).id,
+      assigneeHandle: WORKER_HANDLE,
+      assigneePaneKey: WORKER_PANE,
+      creator: { kind: 'terminal', handle, paneKey, orcaSessionId: workerSession },
+      maxDepth: Number.MAX_SAFE_INTEGER
+    })
+
+    const asked = resultOf(
+      await h.dispatch(
+        orchestrationRequest('orchestration.ask', {
+          from: WORKER_HANDLE,
+          to,
+          question: 'which way?',
+          timeoutMs: 0
+        })
+      )
+    )
+    expect(asked).toMatchObject({ timedOut: true })
+    expect(h.db.getQuestion(String(asked.messageId))).toMatchObject({ run_id: runId })
+  })
+})
diff --git a/src/main/runtime/rpc/orchestration-session-recipient.test.ts b/src/main/runtime/rpc/orchestration-session-recipient.test.ts
new file mode 100644
index 000000000000..bbf199e7f50d
--- /dev/null
+++ b/src/main/runtime/rpc/orchestration-session-recipient.test.ts
@@ -0,0 +1,121 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import {
+  mintStructuredWorkerHandle,
+  mintStructuredWorkerPaneKey,
+  structuredWorkerIdentities,
+  structuredWorkerProcessIncarnation
+} from '../structured-worker-identity'
+import {
+  ADDRESS_X,
+  ADDRESS_Y,
+  createSessionCallerHarness,
+  orchestrationRequest,
+  idOf,
+  resultOf,
+  SESSION_X,
+  SESSION_Y,
+  sessionRecord,
+  WORKER_HANDLE,
+  type SessionCallerHarness
+} from './orchestration-session-caller-test-fixture'
+
+const hostRef = vi.hoisted((): { current: unknown } => ({ current: null }))
+vi.mock('../../native-chat/agent-session-wire/structured-agent-session-registry', () => ({
+  getStructuredAgentSessionHost: () => hostRef.current
+}))
+
+type Row = Record<string, unknown>
+
+describe('mail sent to a session address reaches the mailbox that session reads', () => {
+  let h: SessionCallerHarness
+
+  beforeEach(() => {
+    h = createSessionCallerHarness(hostRef)
+  })
+
+  afterEach(() => {
+    h.close()
+    vi.restoreAllMocks()
+  })
+
+  async function as(sessionId: string | undefined, method: string, params: Row): Promise<Row> {
+    return resultOf(await h.dispatch(orchestrationRequest(method, params, { sessionId })))
+  }
+
+  function sendFromTerminal(to: string): Promise<Row> {
+    return as(undefined, 'orchestration.send', { from: WORKER_HANDLE, to, subject: 'hello' })
+  }
+
+  it("files it under the chat's current Run, as a terminal coordinator's pane does", async () => {
+    await as(SESSION_X, 'orchestration.runCreate', { objective: 'first' })
+    const current = idOf(
+      (await as(SESSION_X, 'orchestration.runCreate', { objective: 'next' })).run
+    )
+
+    const { message } = await sendFromTerminal(ADDRESS_X)
+
+    expect(message).toMatchObject({ to_handle: `run:${current}`, run_id: current })
+    expect(await as(SESSION_X, 'orchestration.check', {})).toMatchObject({
+      runId: current,
+      messages: [{ subject: 'hello' }]
+    })
+  })
+
+  it('delivers it to a chat with no Run, which reads its direct mailbox', async () => {
+    const { message } = await sendFromTerminal(ADDRESS_X)
+
+    expect(message).toMatchObject({ to_handle: ADDRESS_X })
+    expect(await as(SESSION_X, 'orchestration.check', {})).toMatchObject({
+      messages: [{ subject: 'hello' }]
+    })
+  })
+
+  it('refuses an Orca session this host does not run', async () => {
+    h.records.set(
+      SESSION_X,
+      sessionRecord(SESSION_X, { location: { executionHostId: 'ssh:devbox' } })
+    )
+    h.records.delete(SESSION_Y)
+
+    for (const to of [ADDRESS_X, ADDRESS_Y]) {
+      const response = await h.dispatch(
+        orchestrationRequest('orchestration.send', { from: WORKER_HANDLE, to, subject: 's' })
+      )
+      expect(response).toMatchObject({ ok: false, error: { code: 'terminal_not_found' } })
+    }
+  })
+
+  it("routes a structured worker's session address to the Dispatch it is working", async () => {
+    const handle = mintStructuredWorkerHandle()
+    const paneKey = mintStructuredWorkerPaneKey(SESSION_Y)
+    structuredWorkerIdentities.register({
+      handle,
+      sessionId: SESSION_Y,
+      agent: 'claude',
+      paneKey,
+      processIncarnation: structuredWorkerProcessIncarnation(SESSION_Y),
+      worktreeId: 'wt_1',
+      hostScope: { kind: 'local', hostId: 'local' }
+    })
+    const runId = idOf((await as(SESSION_X, 'orchestration.runCreate', { objective: 'o' })).run)
+    const dispatch = h.db.createDispatchContext({
+      taskId: h.db.createTask({ runId, spec: 'work' }).id,
+      assigneeHandle: handle,
+      assigneePaneKey: paneKey,
+      processIncarnation: structuredWorkerProcessIncarnation(SESSION_Y),
+      creator: { kind: 'session', orcaSessionId: SESSION_X },
+      maxDepth: Number.MAX_SAFE_INTEGER
+    })
+
+    const { message } = await as(SESSION_X, 'orchestration.send', {
+      to: ADDRESS_Y,
+      subject: 'to the worker'
+    })
+
+    expect(message).toMatchObject({ to_handle: `dispatch:${dispatch.id}`, run_id: runId })
+    expect(await as(SESSION_Y, 'orchestration.check', { peek: true })).toMatchObject({
+      dispatchId: dispatch.id,
+      messages: [{ subject: 'to the worker' }]
+    })
+  })
+})
diff --git a/src/main/runtime/rpc/orchestration-session-run-binding.test.ts b/src/main/runtime/rpc/orchestration-session-run-binding.test.ts
new file mode 100644
index 000000000000..0f6b65d6571d
--- /dev/null
+++ b/src/main/runtime/rpc/orchestration-session-run-binding.test.ts
@@ -0,0 +1,138 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import {
+  mintStructuredWorkerHandle,
+  mintStructuredWorkerPaneKey,
+  structuredWorkerIdentities,
+  structuredWorkerProcessIncarnation
+} from '../structured-worker-identity'
+import {
+  createSessionCallerHarness,
+  orchestrationRequest,
+  resultOf,
+  idOf,
+  SESSION_X,
+  SESSION_Y,
+  type SessionCallerHarness
+} from './orchestration-session-caller-test-fixture'
+
+const hostRef = vi.hoisted((): { current: unknown } => ({ current: null }))
+vi.mock('../../native-chat/agent-session-wire/structured-agent-session-registry', () => ({
+  getStructuredAgentSessionHost: () => hostRef.current
+}))
+
+function deliveryId(result: Record<string, unknown>): string {
+  if (typeof result.deliveryId === 'string') {
+    return result.deliveryId
+  }
+  throw new Error('Expected a Delivery')
+}
+
+describe('structured lead Run binding through the RPC dispatcher', () => {
+  let h: SessionCallerHarness
+  let dispatchId: string
+
+  function call(sessionId: string, method: string, params: Record<string, unknown> = {}) {
+    return h
+      .dispatch(orchestrationRequest(`orchestration.${method}`, params, { sessionId }))
+      .then(resultOf)
+  }
+
+  beforeEach(async () => {
+    h = createSessionCallerHarness(hostRef)
+    const handle = mintStructuredWorkerHandle()
+    const paneKey = mintStructuredWorkerPaneKey(SESSION_Y)
+    structuredWorkerIdentities.register({
+      handle,
+      sessionId: SESSION_Y,
+      agent: 'claude',
+      paneKey,
+      processIncarnation: structuredWorkerProcessIncarnation(SESSION_Y),
+      worktreeId: 'folder-workspace',
+      hostScope: { kind: 'local', hostId: 'local' }
+    })
+    const runId = idOf((await call(SESSION_X, 'runCreate', { objective: 'parent' })).run)
+    dispatchId = h.db.createDispatchContext({
+      taskId: h.db.createTask({ runId, spec: 'structured lead' }).id,
+      assigneeHandle: handle,
+      assigneePaneKey: paneKey,
+      processIncarnation: structuredWorkerProcessIncarnation(SESSION_Y),
+      creator: { kind: 'session', orcaSessionId: SESSION_X },
+      maxDepth: Number.MAX_SAFE_INTEGER
+    }).id
+  })
+  afterEach(() => {
+    h.runtime.cancelMessageWaiters(`dispatch:${dispatchId}`)
+    h.close()
+    vi.restoreAllMocks()
+  })
+
+  it.each(['runCreate', 'runUse'] as const)(
+    'cancels a parked session Dispatch check on %s',
+    async (method) => {
+      const params =
+        method === 'runCreate'
+          ? { objective: 'child' }
+          : {
+              id: h.db.createRun({
+                objective: 'unbound',
+                coordinatorHandle: null,
+                coordinatorPaneKey: null
+              }).id
+            }
+      const wait = vi.spyOn(h.runtime, 'waitForMessage')
+      const waiting = call(SESSION_Y, 'check', { wait: true, timeoutMs: 500 })
+      await vi.waitFor(() =>
+        expect(wait).toHaveBeenCalledWith(`dispatch:${dispatchId}`, expect.anything())
+      )
+      const child = idOf((await call(SESSION_Y, method, params)).run)
+      expect(await waiting).toMatchObject({ cancelled: true, timedOut: false })
+      const sent = await call(SESSION_X, 'send', {
+        to: `dispatch:${dispatchId}`,
+        subject: 'after bind'
+      })
+      expect(sent.message).toMatchObject({ to_handle: `run:${child}`, run_id: child })
+      expect(await call(SESSION_Y, 'check')).toMatchObject({
+        messages: [{ subject: 'after bind' }]
+      })
+      expect(h.db.getInbox()).toHaveLength(1)
+    }
+  )
+
+  it.each(['cancel', 'throw'] as const)(
+    'replays a pre-bind ack receipt after the following wait ends by %s',
+    async (ending) => {
+      await call(SESSION_X, 'send', { to: `dispatch:${dispatchId}`, subject: 'ack me' })
+      const ack = deliveryId(await call(SESSION_Y, 'check'))
+      const acknowledge = vi.spyOn(h.db, 'acknowledgeMailboxDelivery')
+      const wait = vi.spyOn(h.runtime, 'waitForMessage').mockImplementationOnce(async () => {
+        await call(SESSION_Y, 'runCreate', { objective: 'child' })
+        if (ending === 'throw') {
+          throw new Error('wait transport interrupted')
+        }
+        return 'cancelled'
+      })
+      const request = orchestrationRequest(
+        'orchestration.check',
+        { ack, wait: true, timeoutMs: 500 },
+        {
+          sessionId: SESSION_Y,
+          requestId: `bind-during-ack-${ending}`
+        }
+      )
+      const first = await h.dispatch(request)
+      if (ending === 'throw') {
+        expect(first).toMatchObject({ ok: false, error: { code: 'runtime_error' } })
+      } else {
+        expect(resultOf(first)).toMatchObject({ acknowledged: ack, count: 0, cancelled: true })
+      }
+      const replay = resultOf(await h.dispatch(request))
+      expect(replay).toMatchObject({ acknowledged: ack, count: 0, mutation: { replayed: true } })
+      if (ending === 'throw') {
+        expect(replay.waitInterrupted).toBe('outcome_unknown')
+      }
+      expect(acknowledge).toHaveBeenCalledTimes(1)
+      expect(wait).toHaveBeenCalledTimes(1)
+      expect(h.db.getDeliveryRaw(ack)?.status).toBe('acknowledged')
+    }
+  )
+})
diff --git a/src/main/runtime/rpc/rpc-streaming-dispatcher.ts b/src/main/runtime/rpc/rpc-streaming-dispatcher.ts
index 1428b72d1889..6c2faad902e5 100644
--- a/src/main/runtime/rpc/rpc-streaming-dispatcher.ts
+++ b/src/main/runtime/rpc/rpc-streaming-dispatcher.ts
@@ -1,4 +1,10 @@
-import { isStreamingMethod, type RpcEnvelopeMeta, type RpcRegistry, type RpcRequest } from './core'
+import {
+  isRegistrationFencedUnsubscribe,
+  isStreamingMethod,
+  type RpcEnvelopeMeta,
+  type RpcRegistry,
+  type RpcRequest
+} from './core'
 
 import { errorResponse, successResponse } from './errors'
 import type { OrcaRuntimeService } from '../orca-runtime'
@@ -15,6 +21,11 @@ import { parseRpcRequestParams } from './dispatcher-request-parsing'
 import { routeDispatcherClientHostedBrowserRpc } from './dispatcher-client-browser-routing'
 import { needsLocalCallerFingerprint } from './dispatcher-caller-fingerprint'
 import { createDispatcherStreamingFeatureEmitter } from './dispatcher-streaming-feature-emitter'
+import {
+  needsOrchestrationCallerResolution,
+  resolveOrchestrationSessionCaller,
+  type ResolvedOrchestrationRequest
+} from './orchestration-session-caller'
 
 export type RpcStreamingDispatcherDependencies = {
   runtime: OrcaRuntimeService
@@ -29,10 +40,11 @@ export class RpcStreamingDispatcher {
 
   // Why: streaming dispatch sends multiple responses through the reply callback instead of a Promise.
   async dispatch(
-    request: RpcRequest,
+    rawRequest: RpcRequest,
     reply: (response: string) => void,
     options?: RpcDispatchStreamingOptions
   ): Promise<void> {
+    let request = rawRequest
     const { runtime, registry, orchestrationMutations, legacyOrchestration, meta } =
       this.dependencies
     const envelopeMeta = meta()
@@ -57,23 +69,36 @@ export class RpcStreamingDispatcher {
       return
     }
 
+    // Why: before params parse and the unary/streaming split, so both branches see one caller.
+    let resolved: ResolvedOrchestrationRequest = { request }
+    if (needsOrchestrationCallerResolution(request)) {
+      try {
+        resolved = await resolveOrchestrationSessionCaller(runtime, request, options)
+      } catch (error) {
+        reply(JSON.stringify(mapDispatcherError(request, envelopeMeta, error)))
+        return
+      }
+    }
+    request = resolved.request
+    const orchestrationCaller = resolved.caller
     const parsedParams = parseRpcRequestParams(request, method, envelopeMeta)
     if (parsedParams.error) {
       reply(JSON.stringify(parsedParams.error))
       return
     }
+    const params = parsedParams.value
 
     if (!isStreamingMethod(method)) {
       try {
+        // Session tabs always need this fence. COMPAT(terminal request-addressed unsubscribe): terminal only for phones without `requestId`.
         // Capture before middleware yields to a replacement subscribe on the same connection.
-        const subscriptionRegistrationVersion =
-          request.method === 'terminal.unsubscribe'
-            ? runtime.getSubscriptionRegistrationVersion()
-            : undefined
+        const subscriptionRegistrationVersion = isRegistrationFencedUnsubscribe(request.method)
+          ? runtime.getSubscriptionRegistrationVersion()
+          : undefined
         const clientHostedBrowser = await routeDispatcherClientHostedBrowserRpc(
           runtime,
           request.method,
-          parsedParams.value
+          params
         )
         if (clientHostedBrowser.handled) {
           recordRuntimeFeatureInteraction(
@@ -88,16 +113,12 @@ export class RpcStreamingDispatcher {
           )
           return
         }
-        const compatibility = await legacyOrchestration.tryHandle(
-          request,
-          parsedParams.value,
-          options?.signal
-        )
+        const compatibility = await legacyOrchestration.tryHandle(request, params, options?.signal)
         if (compatibility.handled) {
           reply(JSON.stringify(successResponse(request.id, envelopeMeta, compatibility.result)))
           return
         }
-        const effectiveParams = compatibility.params ?? parsedParams.value
+        const effectiveParams = compatibility.params ?? params
         const legacyCoordinator = legacyOrchestration.createCoordinatorInvocation(
           request,
           compatibility.legacyCoordinatorAuthority
@@ -136,14 +157,16 @@ export class RpcStreamingDispatcher {
             revalidateLegacyCoordinator: legacyCoordinator?.revalidate,
             orchestrationCompatibilityCallerAuthority:
               compatibility.orchestrationCompatibilityCallerAuthority,
-            orchestrationCompatibilityEvidence: request.orchestrationCompatibilityEvidence
+            orchestrationCompatibilityEvidence: request.orchestrationCompatibilityEvidence,
+            orchestrationCaller
           })
         }
         const result = await orchestrationMutations.run(
           request,
           effectiveParams,
           invoke,
-          legacyCoordinator?.mutationCallerFingerprint ?? authenticatedCallerFingerprint
+          legacyCoordinator?.mutationCallerFingerprint ?? authenticatedCallerFingerprint,
+          orchestrationCaller?.orcaSessionId
         )
         recordRuntimeFeatureInteraction(runtime, request.method, result, undefined, request.params)
         reply(JSON.stringify(successResponse(request.id, envelopeMeta, result)))
@@ -162,7 +185,7 @@ export class RpcStreamingDispatcher {
 
     try {
       const result = await method.handler(
-        parsedParams.value,
+        params,
         {
           runtime,
           signal: options?.signal,
@@ -177,7 +200,8 @@ export class RpcStreamingDispatcher {
           pairing: options?.pairing,
           sendBinary: options?.sendBinary,
           registerBinaryStreamHandler: options?.registerBinaryStreamHandler,
-          registerBinaryMessageHandler: options?.registerBinaryMessageHandler
+          registerBinaryMessageHandler: options?.registerBinaryMessageHandler,
+          orchestrationCaller
         },
         emit
       )
diff --git a/src/main/runtime/rpc/static-web-client-handler-stream.test.ts b/src/main/runtime/rpc/static-web-client-handler-stream.test.ts
new file mode 100644
index 000000000000..91bd0f52053b
--- /dev/null
+++ b/src/main/runtime/rpc/static-web-client-handler-stream.test.ts
@@ -0,0 +1,255 @@
+import { once } from 'node:events'
+import type * as fs from 'node:fs'
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync, type ReadStream } from 'node:fs'
+import type * as fsPromises from 'node:fs/promises'
+import { createServer, type IncomingMessage, type Server, type ServerResponse } from 'node:http'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { PassThrough } from 'node:stream'
+import { afterEach, beforeEach, expect, it, vi } from 'vitest'
+import { createStaticWebClientHandler } from './static-web-client-handler'
+
+const observed = vi.hoisted(() => {
+  const streams: ReadStream[] = []
+  const state: {
+    statWait: Promise<void>
+    statError?: Error
+    missingPath?: string
+    onSource?: () => void
+  } = {
+    statWait: Promise.resolve()
+  }
+  return { streams, state, statCalls: 0, completedStats: 0 }
+})
+vi.mock('node:fs', async (importOriginal) => {
+  const original = await importOriginal<typeof fs>()
+  return {
+    ...original,
+    createReadStream: (...args: Parameters<typeof original.createReadStream>) => {
+      const stream = original.createReadStream(observed.state.missingPath ?? args[0], args[1])
+      observed.streams.push(stream)
+      observed.state.onSource?.()
+      return stream
+    }
+  }
+})
+vi.mock('node:fs/promises', async (importOriginal) => {
+  const original = await importOriginal<typeof fsPromises>()
+  return {
+    ...original,
+    stat: async (...args: Parameters<typeof original.stat>) => {
+      observed.statCalls++
+      const value = await original.stat(...args)
+      await observed.state.statWait
+      observed.completedStats++
+      if (observed.state.statError) {
+        throw observed.state.statError
+      }
+      return value
+    }
+  }
+})
+
+let root: string
+const servers: Server[] = []
+beforeEach(() => {
+  root = mkdtempSync(join(tmpdir(), 'orca-static-web-stream-'))
+  mkdirSync(join(root, 'assets'))
+  writeFileSync(join(root, 'assets', 'fixture.js'), Buffer.alloc(1024 * 1024, 1))
+  writeFileSync(join(root, 'web-index.html'), '<html>web</html>')
+  observed.state.statWait = Promise.resolve()
+  observed.state.statError = undefined
+  observed.state.missingPath = undefined
+  observed.state.onSource = undefined
+  observed.statCalls = 0
+  observed.completedStats = 0
+})
+afterEach(async () => {
+  await Promise.all(
+    servers.splice(0).map(async (server) => {
+      server.closeAllConnections()
+      await new Promise<void>((resolve) => server.close(() => resolve()))
+    })
+  )
+  await Promise.all(
+    observed.streams.splice(0).map(async (stream) => {
+      if (!stream.closed) {
+        const closed = new Promise<void>((resolve) => stream.once('close', resolve))
+        stream.destroy()
+        await closed
+      }
+    })
+  )
+  rmSync(root, { recursive: true, force: true })
+})
+
+function fakeResponse() {
+  return Object.assign(new PassThrough({ highWaterMark: 16 }), {
+    setHeader: vi.fn(),
+    statusCode: 0,
+    headersSent: false
+  })
+}
+function fileDescriptor(stream: ReadStream): number | null {
+  if ('fd' in stream && (typeof stream.fd === 'number' || stream.fd === null)) {
+    return stream.fd
+  }
+  throw new Error('Missing file descriptor')
+}
+function request(response = fakeResponse()) {
+  const handler = createStaticWebClientHandler(root)
+  handler(
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: This handler reads only these method/url fields.
+    { method: 'GET', url: '/assets/fixture.js' } as IncomingMessage,
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The fixture implements the writable response surface used by this handler.
+    response as unknown as ServerResponse
+  )
+  return response
+}
+async function latestSource(count: number): Promise<ReadStream> {
+  await expect.poll(() => observed.streams.length).toBe(count)
+  const source = observed.streams.at(-1)
+  if (!source) {
+    throw new Error('Missing file stream')
+  }
+  return source
+}
+async function startServer(): Promise<string> {
+  const server = createServer(createStaticWebClientHandler(root))
+  servers.push(server)
+  server.listen(0, '127.0.0.1')
+  await once(server, 'listening')
+  const address = server.address()
+  if (!address || typeof address === 'string') {
+    throw new Error('Missing HTTP address')
+  }
+  return `http://127.0.0.1:${address.port}`
+}
+
+it('closes 25 abandoned file readers and removes only owned response listeners', async () => {
+  const responses: ReturnType<typeof fakeResponse>[] = []
+  const otherClose = vi.fn()
+  const otherError = vi.fn()
+  for (let index = 0; index < 25; index++) {
+    const response = fakeResponse()
+    response.on('close', otherClose)
+    response.on('error', otherError)
+    request(response)
+    responses.push(response)
+    const source = await latestSource(index + 1)
+    await expect.poll(() => source.isPaused()).toBe(true)
+    const closed = once(response, 'close')
+    response.destroy()
+    await closed
+  }
+  await expect.poll(() => observed.streams.filter((stream) => !stream.closed).length).toBe(0)
+  expect(observed.streams.every((stream) => fileDescriptor(stream) === null)).toBe(true)
+  expect(responses.every((response) => response.listeners('close').length === 1)).toBe(true)
+  expect(responses.every((response) => response.listeners('error').length === 1)).toBe(true)
+  expect(otherClose).toHaveBeenCalledTimes(25)
+  expect(otherError).not.toHaveBeenCalled()
+})
+
+it('does not stat or open assets for an already closed response', async () => {
+  const response = fakeResponse()
+  const closed = once(response, 'close')
+  response.destroy()
+  await closed
+  request(response)
+  expect(observed.statCalls).toBe(0)
+  expect(observed.streams).toHaveLength(0)
+  expect(response.setHeader).not.toHaveBeenCalled()
+})
+
+it.each(['success', 'failure'])(
+  'does not revive a response closed during stat %s',
+  async (outcome) => {
+    let releaseStat = (): void => {}
+    observed.state.statWait = new Promise<void>((resolve) => {
+      releaseStat = resolve
+    })
+    if (outcome === 'failure') {
+      observed.state.statError = new Error('stat failed after abandonment')
+    }
+    const response = request()
+    expect(observed.statCalls).toBe(1)
+    const ended = vi.spyOn(response, 'end')
+    const closed = once(response, 'close')
+    response.destroy()
+    await closed
+    releaseStat()
+    await expect.poll(() => observed.completedStats).toBe(1)
+    expect(observed.streams).toHaveLength(0)
+    expect(response.setHeader).not.toHaveBeenCalled()
+    expect(ended).not.toHaveBeenCalled()
+  }
+)
+
+it('closes a file that is still opening when its response is destroyed', async () => {
+  const response = fakeResponse()
+  observed.state.onSource = () => {
+    const source = observed.streams.at(-1)
+    expect(source && fileDescriptor(source)).toBe(null)
+    response.destroy()
+  }
+  request(response)
+  const source = await latestSource(1)
+  await expect.poll(() => source.closed).toBe(true)
+  expect(fileDescriptor(source)).toBe(null)
+  expect(response.listenerCount('close')).toBe(0)
+  expect(response.listenerCount('error')).toBe(0)
+})
+
+it('closes its file reader when the response errors', async () => {
+  const response = request()
+  const source = await latestSource(1)
+  await expect.poll(() => source.isPaused()).toBe(true)
+  response.destroy(new Error('downstream failed'))
+  await expect.poll(() => source.closed).toBe(true)
+  expect(fileDescriptor(source)).toBe(null)
+  expect(response.listenerCount('close')).toBe(0)
+  expect(response.listenerCount('error')).toBe(0)
+})
+
+it('disconnects a response when its source fails after headers', async () => {
+  const response = request()
+  const source = await latestSource(1)
+  response.headersSent = true
+  const closed = once(response, 'close')
+  source.destroy(new Error('read failed after headers'))
+  await closed
+  await expect.poll(() => source.closed).toBe(true)
+  expect(response.statusCode).toBe(200)
+  expect(response.destroyed).toBe(true)
+  expect(response.listenerCount('close')).toBe(0)
+  expect(response.listenerCount('error')).toBe(0)
+})
+
+it('preserves actual HTTP GET bytes, cache headers and HEAD without a reader', async () => {
+  const url = await startServer()
+  const head = await fetch(`${url}/assets/fixture.js`, { method: 'HEAD' })
+  expect(head.status).toBe(200)
+  expect(head.headers.get('content-length')).toBe(String(1024 * 1024))
+  expect(await head.text()).toBe('')
+  expect(observed.streams).toHaveLength(0)
+  const get = await fetch(`${url}/assets/fixture.js`)
+  expect(get.status).toBe(200)
+  expect(get.headers.get('cache-control')).toBe('public, max-age=31536000, immutable')
+  expect(get.headers.get('content-type')).toBe('text/javascript; charset=utf-8')
+  expect(Buffer.from(await get.arrayBuffer())).toEqual(Buffer.alloc(1024 * 1024, 1))
+  await expect.poll(() => observed.streams.every((source) => source.closed)).toBe(true)
+  const index = await fetch(`${url}/`)
+  expect(index.headers.get('cache-control')).toBe('no-cache')
+  expect(await index.text()).toBe('<html>web</html>')
+})
+
+it('answers an actual file-open error with an empty 500 instead of the asset length', async () => {
+  observed.state.missingPath = join(root, 'missing-after-stat.js')
+  const url = await startServer()
+  const response = await fetch(`${url}/assets/fixture.js`)
+  expect(response.status).toBe(500)
+  expect(response.headers.get('content-length')).toBe('0')
+  expect(response.headers.get('cache-control')).toBe('no-store')
+  expect(await response.text()).toBe('')
+  await expect.poll(() => observed.streams.every((source) => source.closed)).toBe(true)
+})
diff --git a/src/main/runtime/rpc/static-web-client-handler.ts b/src/main/runtime/rpc/static-web-client-handler.ts
index 53ecd85c73fc..3ec8ed83919a 100644
--- a/src/main/runtime/rpc/static-web-client-handler.ts
+++ b/src/main/runtime/rpc/static-web-client-handler.ts
@@ -29,6 +29,9 @@ async function handleStaticRequest(
   request: IncomingMessage,
   response: ServerResponse
 ): Promise<void> {
+  if (response.destroyed) {
+    return
+  }
   if (request.method !== 'GET' && request.method !== 'HEAD') {
     response.setHeader('Allow', 'GET, HEAD')
     writeHttpStatus(response, 405)
@@ -59,6 +62,9 @@ async function handleStaticRequest(
     writeHttpStatus(response, 404)
     return
   }
+  if (response.destroyed) {
+    return
+  }
   if (!fileStat.isFile()) {
     writeHttpStatus(response, 404)
     return
@@ -80,8 +86,22 @@ async function handleStaticRequest(
   }
 
   const stream = createReadStream(absolutePath)
+  const stopReading = (): void => {
+    stream.destroy()
+  }
+  response.once('close', stopReading)
+  response.once('error', stopReading)
+  stream.once('close', () => {
+    response.off('close', stopReading)
+    response.off('error', stopReading)
+  })
   stream.on('error', () => {
+    if (response.destroyed) {
+      return
+    }
     if (!response.headersSent) {
+      response.setHeader('Content-Length', 0)
+      response.setHeader('Cache-Control', 'no-store')
       writeHttpStatus(response, 500)
       return
     }
@@ -136,6 +156,9 @@ function isAllowedStaticWebPath(pathname: string): boolean {
 }
 
 function writeHttpStatus(response: ServerResponse, statusCode: number): void {
+  if (response.destroyed) {
+    return
+  }
   response.statusCode = statusCode
   response.end()
 }
diff --git a/src/main/runtime/rpc/subscription-registry-test-double.ts b/src/main/runtime/rpc/subscription-registry-test-double.ts
index d74e8bc329fe..0ee0fc799602 100644
--- a/src/main/runtime/rpc/subscription-registry-test-double.ts
+++ b/src/main/runtime/rpc/subscription-registry-test-double.ts
@@ -1,14 +1,19 @@
 import type { SubscriptionRegistration } from '../orca-runtime'
 
 type Cleanup = () => void | Promise<void>
-type Entry = { cleanup: Cleanup; version: number }
+type Entry = {
+  cleanup: Cleanup
+  version: number
+  request?: { connectionId: string; requestId: string }
+}
 
 export type SubscriptionRegistryDouble = {
   registerSubscriptionCleanup: (id: string, cleanup: Cleanup, connectionId?: string) => void
   registerOwnedSubscriptionCleanup: (
     id: string,
     cleanup: Cleanup,
-    connectionId?: string
+    connectionId?: string,
+    requestId?: string
   ) => SubscriptionRegistration
   cleanupSubscription: (id: string) => void
   cleanupSubscriptionIfOwnedByConnection: (
@@ -17,14 +22,18 @@ export type SubscriptionRegistryDouble = {
     throughVersion?: number
   ) => boolean
   getSubscriptionRegistrationVersion: () => number
+  releaseSubscriptionByRequest: (connectionId: string | undefined, requestId: string) => void
   cleanupSubscriptionsForConnection: (connectionId: string) => void
   /** Test-only inspection; the runtime deliberately exposes no such accessor. */
   peekCleanup: (id: string) => Cleanup | undefined
+  /** Test-only inspection of the request-address index size. */
+  requestAddressCount: () => number
 }
 
 /**
  * Faithful double of the runtime subscription registry (`OrcaRuntimeService`,
- * `registerSubscriptionCleanup` through `cleanupSubscriptionsForConnection`).
+ * `registerSubscriptionCleanup` through `cleanupSubscriptionsForConnection`, plus
+ * `releaseSubscriptionByRequest`).
  *
  * This mirrors production line-for-line, so it can drift. If you change
  * `registerSubscriptionCleanup`, `cleanupSubscriptionAndWait`,
@@ -43,6 +52,20 @@ export function createSubscriptionRegistryDouble(): SubscriptionRegistryDouble {
   let registrationVersion = 0
   const byConnection = new Map<string, Set<string>>()
   const connectionByEntry = new Map<string, string>()
+  const byRequest = new Map<string, { id: string; entry: Entry }>()
+  const requestKey = (connectionId: string, requestId: string): string =>
+    JSON.stringify([connectionId, requestId])
+
+  // Mirrors removeRequestIndex: compare-and-delete, so a reused request id keeps its newer owner.
+  const removeRequestIndex = (entry: Entry): void => {
+    if (!entry.request) {
+      return
+    }
+    const key = requestKey(entry.request.connectionId, entry.request.requestId)
+    if (byRequest.get(key)?.entry === entry) {
+      byRequest.delete(key)
+    }
+  }
 
   const removeIndex = (id: string): void => {
     const connectionId = connectionByEntry.get(id)
@@ -84,6 +107,7 @@ export function createSubscriptionRegistryDouble(): SubscriptionRegistryDouble {
         }
         cleanups.delete(id)
         removeIndex(id)
+        removeRequestIndex(entry)
       })
       .finally(() => {
         if (inFlight.get(id)?.promise === promise) {
@@ -109,15 +133,21 @@ export function createSubscriptionRegistryDouble(): SubscriptionRegistryDouble {
   const registerSubscriptionCleanup = (
     id: string,
     cleanup: Cleanup,
-    connectionId?: string
+    connectionId?: string,
+    requestId?: string
   ): Entry => {
     const existing = cleanups.get(id)
     if (existing) {
       removeIndex(id)
+      removeRequestIndex(existing)
       cleanupOwned(id, existing)
     }
-    const entry = { cleanup, version: ++registrationVersion }
+    const request = connectionId && requestId ? { connectionId, requestId } : undefined
+    const entry: Entry = { cleanup, version: ++registrationVersion, request }
     cleanups.set(id, entry)
+    if (request) {
+      byRequest.set(requestKey(request.connectionId, request.requestId), { id, entry })
+    }
     if (!connectionId) {
       return entry
     }
@@ -133,14 +163,23 @@ export function createSubscriptionRegistryDouble(): SubscriptionRegistryDouble {
 
   return {
     registerSubscriptionCleanup,
-    registerOwnedSubscriptionCleanup: (id, cleanup, connectionId) => {
-      const entry = registerSubscriptionCleanup(id, cleanup, connectionId)
+    registerOwnedSubscriptionCleanup: (id, cleanup, connectionId, requestId) => {
+      const entry = registerSubscriptionCleanup(id, cleanup, connectionId, requestId)
       return {
         releaseIfCurrent: () => cleanupOwned(id, entry)
       }
     },
     cleanupSubscription,
     getSubscriptionRegistrationVersion: () => registrationVersion,
+    releaseSubscriptionByRequest: (connectionId, requestId) => {
+      if (!connectionId) {
+        return
+      }
+      const target = byRequest.get(requestKey(connectionId, requestId))
+      if (target) {
+        cleanupOwned(target.id, target.entry)
+      }
+    },
     cleanupSubscriptionIfOwnedByConnection: (id, connectionId, throughVersion) => {
       const entry = cleanups.get(id)
       // Mirrors the production early-out: an unregistered id is already gone, not refused.
@@ -173,6 +212,7 @@ export function createSubscriptionRegistryDouble(): SubscriptionRegistryDouble {
         byConnection.delete(connectionId)
       }
     },
-    peekCleanup: (id) => cleanups.get(id)?.cleanup
+    peekCleanup: (id) => cleanups.get(id)?.cleanup,
+    requestAddressCount: () => byRequest.size
   }
 }
diff --git a/src/main/runtime/rpc/terminal-agent-prompt-send.test.ts b/src/main/runtime/rpc/terminal-agent-prompt-send.test.ts
index 29254fbcf3ad..824513dd9993 100644
--- a/src/main/runtime/rpc/terminal-agent-prompt-send.test.ts
+++ b/src/main/runtime/rpc/terminal-agent-prompt-send.test.ts
@@ -45,6 +45,7 @@ describe('terminal agent prompt send RPC', () => {
     expect(response.ok).toBe(true)
     expect(runtime.isTerminalRunningSettledPromptAgent).toHaveBeenCalledWith('terminal-1')
     expect(sendTerminalAgentPrompt).toHaveBeenCalledWith('terminal-1', 'review this change', {
+      inputKind: 'driving',
       beforeWrite: undefined,
       signal: undefined
     })
@@ -81,7 +82,7 @@ describe('terminal agent prompt send RPC', () => {
     expect(sendTerminal).toHaveBeenCalledWith(
       'terminal-1',
       { text: 'echo x', enter: true, interrupt: false },
-      { beforeWrite: undefined, signal: undefined }
+      { inputKind: 'driving', beforeWrite: undefined, signal: undefined }
     )
     expect(sendTerminalAgentPrompt).not.toHaveBeenCalled()
   })
diff --git a/src/main/runtime/rpc/terminal-multiplex-ack-output-budget.test.ts b/src/main/runtime/rpc/terminal-multiplex-ack-output-budget.test.ts
index 3dc1f6b29181..f93b772994e5 100644
--- a/src/main/runtime/rpc/terminal-multiplex-ack-output-budget.test.ts
+++ b/src/main/runtime/rpc/terminal-multiplex-ack-output-budget.test.ts
@@ -241,11 +241,15 @@ describe('terminal multiplex RPC', () => {
       )!
     )
     await vi.waitFor(() =>
-      expect(runtime.sendTerminal).toHaveBeenCalledWith('terminal-1', {
-        text: 'still interactive\r',
-        enter: false,
-        interrupt: false
-      })
+      expect(runtime.sendTerminal).toHaveBeenCalledWith(
+        'terminal-1',
+        {
+          text: 'still interactive\r',
+          enter: false,
+          interrupt: false
+        },
+        { inputKind: 'driving' }
+      )
     )
 
     handlers.get(16)?.(
@@ -434,11 +438,15 @@ describe('terminal multiplex RPC', () => {
       )!
     )
     await vi.waitFor(() =>
-      expect(runtime.sendTerminal).toHaveBeenCalledWith('terminal-8', {
-        text: 'remote-still-interactive\r',
-        enter: false,
-        interrupt: false
-      })
+      expect(runtime.sendTerminal).toHaveBeenCalledWith(
+        'terminal-8',
+        {
+          text: 'remote-still-interactive\r',
+          enter: false,
+          interrupt: false
+        },
+        { inputKind: 'driving' }
+      )
     )
 
     const frameCountBeforeAck = binaryFrames.length
diff --git a/src/main/runtime/rpc/terminal-multiplex-ack-overflow-recovery.test.ts b/src/main/runtime/rpc/terminal-multiplex-ack-overflow-recovery.test.ts
index 03327859c621..57abea846ae4 100644
--- a/src/main/runtime/rpc/terminal-multiplex-ack-overflow-recovery.test.ts
+++ b/src/main/runtime/rpc/terminal-multiplex-ack-overflow-recovery.test.ts
@@ -413,11 +413,15 @@ describe('terminal multiplex RPC', () => {
       )!
     )
     await vi.waitFor(() =>
-      expect(runtime.sendTerminal).toHaveBeenCalledWith('terminal-1', {
-        text: 'still interactive\r',
-        enter: false,
-        interrupt: false
-      })
+      expect(runtime.sendTerminal).toHaveBeenCalledWith(
+        'terminal-1',
+        {
+          text: 'still interactive\r',
+          enter: false,
+          interrupt: false
+        },
+        { inputKind: 'driving' }
+      )
     )
 
     binaryFrames.splice(0)
diff --git a/src/main/runtime/rpc/terminal-multiplex-desktop-resize-routing.test.ts b/src/main/runtime/rpc/terminal-multiplex-desktop-resize-routing.test.ts
index 45ff2d77b8cd..562181b2752d 100644
--- a/src/main/runtime/rpc/terminal-multiplex-desktop-resize-routing.test.ts
+++ b/src/main/runtime/rpc/terminal-multiplex-desktop-resize-routing.test.ts
@@ -206,11 +206,15 @@ describe('terminal multiplex RPC', () => {
         )
       )
       await vi.waitFor(() =>
-        expect(runtime.sendTerminal).toHaveBeenCalledWith('terminal-1', {
-          text: 'ls\r',
-          enter: false,
-          interrupt: false
-        })
+        expect(runtime.sendTerminal).toHaveBeenCalledWith(
+          'terminal-1',
+          {
+            text: 'ls\r',
+            enter: false,
+            interrupt: false
+          },
+          { inputKind: 'driving' }
+        )
       )
       const sentAfterSuccessfulClaim = vi.mocked(runtime.sendTerminal).mock.calls.length
       vi.mocked(runtime.updateRemoteDesktopViewer).mockResolvedValueOnce(false)
@@ -248,11 +252,15 @@ describe('terminal multiplex RPC', () => {
         )
       }
       await vi.waitFor(() =>
-        expect(runtime.sendTerminal).toHaveBeenLastCalledWith('terminal-1', {
-          text: 'retry',
-          enter: false,
-          interrupt: false
-        })
+        expect(runtime.sendTerminal).toHaveBeenLastCalledWith(
+          'terminal-1',
+          {
+            text: 'retry',
+            enter: false,
+            interrupt: false
+          },
+          { inputKind: 'driving' }
+        )
       )
 
       dataListenerRef.current?.('a')
diff --git a/src/main/runtime/rpc/terminal-multiplex-input-write-rejection.test.ts b/src/main/runtime/rpc/terminal-multiplex-input-write-rejection.test.ts
index b7fb20b2f73f..ae2298a20dc8 100644
--- a/src/main/runtime/rpc/terminal-multiplex-input-write-rejection.test.ts
+++ b/src/main/runtime/rpc/terminal-multiplex-input-write-rejection.test.ts
@@ -327,11 +327,15 @@ describe('terminal multiplex RPC', () => {
     )
 
     await vi.waitFor(() =>
-      expect(runtime.sendTerminal).toHaveBeenCalledWith('terminal-1', {
-        text: 'echo one\necho two\r\n',
-        enter: false,
-        interrupt: false
-      })
+      expect(runtime.sendTerminal).toHaveBeenCalledWith(
+        'terminal-1',
+        {
+          text: 'echo one\necho two\r\n',
+          enter: false,
+          interrupt: false
+        },
+        { inputKind: 'driving' }
+      )
     )
 
     runtime.cleanupSubscription('terminal-multiplex:conn-byte-preserving')
@@ -403,11 +407,15 @@ describe('terminal multiplex RPC', () => {
     )
 
     await vi.waitFor(() =>
-      expect(runtime.sendTerminal).toHaveBeenCalledWith('terminal-1', {
-        text: 'printf a\nprintf b\r\n',
-        enter: false,
-        interrupt: false
-      })
+      expect(runtime.sendTerminal).toHaveBeenCalledWith(
+        'terminal-1',
+        {
+          text: 'printf a\nprintf b\r\n',
+          enter: false,
+          interrupt: false
+        },
+        { inputKind: 'driving' }
+      )
     )
 
     runtime.cleanupSubscription('terminal-1:desktop-1')
diff --git a/src/main/runtime/rpc/terminal-multiplex-output-pause-and-viewport.test.ts b/src/main/runtime/rpc/terminal-multiplex-output-pause-and-viewport.test.ts
index ef6087923bb3..eecd7b038591 100644
--- a/src/main/runtime/rpc/terminal-multiplex-output-pause-and-viewport.test.ts
+++ b/src/main/runtime/rpc/terminal-multiplex-output-pause-and-viewport.test.ts
@@ -309,7 +309,11 @@ describe('terminal multiplex RPC', () => {
       expect(runtime.sendTerminal).toHaveBeenCalledWith(
         'terminal-1',
         { text: 'x', enter: false, interrupt: false },
-        { reserveWrite: expect.any(Function), afterWrite: expect.any(Function) }
+        {
+          inputKind: 'driving',
+          reserveWrite: expect.any(Function),
+          afterWrite: expect.any(Function)
+        }
       )
     )
     expect(beginMobileInputFloor.mock.invocationCallOrder[0]).toBeLessThan(
diff --git a/src/main/runtime/rpc/terminal-multiplex-pty-wait-capacity.test.ts b/src/main/runtime/rpc/terminal-multiplex-pty-wait-capacity.test.ts
index 778cd0220681..a5b40b2f1eb2 100644
--- a/src/main/runtime/rpc/terminal-multiplex-pty-wait-capacity.test.ts
+++ b/src/main/runtime/rpc/terminal-multiplex-pty-wait-capacity.test.ts
@@ -595,7 +595,11 @@ describe('terminal multiplex RPC', () => {
     // Widened gate: a desktop client must mount + await its late PTY, not skip
     // straight to the bare scrollback path the way it did under the mobile-only gate.
     expect(runtime.requestRendererTerminalTabMount).toHaveBeenCalledWith('terminal-1')
-    expect(runtime.waitForLeafPtyId).toHaveBeenCalledWith('terminal-1', 10_000, undefined)
+    expect(runtime.waitForLeafPtyId).toHaveBeenCalledWith(
+      'terminal-1',
+      10_000,
+      expect.any(AbortSignal)
+    )
     expect(messages.map((msg) => JSON.parse(msg).result?.type)).toEqual(['subscribed', 'end'])
   })
 })
diff --git a/src/main/runtime/rpc/terminal-multiplex-test-harness.ts b/src/main/runtime/rpc/terminal-multiplex-test-harness.ts
index 13368bd680d3..c85e962d198a 100644
--- a/src/main/runtime/rpc/terminal-multiplex-test-harness.ts
+++ b/src/main/runtime/rpc/terminal-multiplex-test-harness.ts
@@ -16,10 +16,13 @@ export const SET_OUTPUT_PAUSED_OPCODE = 16 as TerminalStreamOpcode
 export const WRITE_UNAVAILABLE_OPCODE = 17 as TerminalStreamOpcode
 
 export function stubRuntime(overrides: Partial<OrcaRuntimeService> = {}): OrcaRuntimeService {
+  // Why: every terminal subscription registers at admission, even one that never reaches a pty.
+  const registry = createSubscriptionRegistryDouble()
   const serializeAuthoritativeTerminalBuffer =
     overrides.serializeAuthoritativeTerminalBuffer ??
     ((ptyId: string, opts?: { scrollbackRows?: number }) =>
       overrides.serializeTerminalBuffer?.(ptyId, opts))
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: This partial runtime supplies the terminal RPC methods these tests invoke.
   return {
     getRuntimeId: () => 'test-runtime',
     subscribeToPtyExit: vi.fn(() => vi.fn()),
@@ -40,6 +43,7 @@ export function stubRuntime(overrides: Partial<OrcaRuntimeService> = {}): OrcaRu
     isRemoteDesktopViewerOwner: vi.fn().mockReturnValue(false),
     serializeAuthoritativeTerminalBuffer,
     getPtyOutputSequence: vi.fn().mockReturnValue(0),
+    registerOwnedSubscriptionCleanup: registry.registerOwnedSubscriptionCleanup,
     ...overrides
   } as OrcaRuntimeService
 }
diff --git a/src/main/runtime/rpc/terminal-output-batching.test.ts b/src/main/runtime/rpc/terminal-output-batching.test.ts
index e597f5e5b137..214a5a2814e9 100644
--- a/src/main/runtime/rpc/terminal-output-batching.test.ts
+++ b/src/main/runtime/rpc/terminal-output-batching.test.ts
@@ -347,7 +347,11 @@ describe('terminal output batching', () => {
       expect(runtime.sendTerminal).toHaveBeenCalledWith(
         'terminal-1',
         { text: 'ls\r', enter: false, interrupt: false },
-        { reserveWrite: expect.any(Function), afterWrite: expect.any(Function) }
+        {
+          inputKind: 'driving',
+          reserveWrite: expect.any(Function),
+          afterWrite: expect.any(Function)
+        }
       )
     )
     expect(beginMobileInputFloor).toHaveBeenCalledWith('pty-1', 'mobile-1')
diff --git a/src/main/runtime/rpc/terminal-send.test.ts b/src/main/runtime/rpc/terminal-send.test.ts
index e9fb481aae06..9aa55eb823ea 100644
--- a/src/main/runtime/rpc/terminal-send.test.ts
+++ b/src/main/runtime/rpc/terminal-send.test.ts
@@ -232,6 +232,7 @@ describe('terminal send RPC', () => {
         interrupt: false
       },
       {
+        inputKind: 'driving',
         beforeWrite: undefined,
         reserveWrite: expect.any(Function),
         afterWrite: expect.any(Function)
@@ -370,7 +371,7 @@ describe('terminal send RPC', () => {
     expect(runtime.sendTerminal).toHaveBeenCalledWith(
       'terminal-1',
       { text: '\x1b[3;4R', enter: false, interrupt: false },
-      { beforeWrite: undefined }
+      { beforeWrite: undefined, inputKind: 'query-reply' }
     )
     expect(runtime.mobileTookFloor).not.toHaveBeenCalled()
   })
@@ -570,7 +571,7 @@ describe('terminal send RPC', () => {
         enter: false,
         interrupt: false
       },
-      { beforeWrite: undefined }
+      { inputKind: 'driving', beforeWrite: undefined }
     )
   })
 
@@ -653,7 +654,7 @@ describe('terminal send RPC', () => {
         enter: true,
         interrupt: false
       },
-      { beforeWrite: expect.any(Function) }
+      { inputKind: 'driving', beforeWrite: expect.any(Function) }
     )
   })
 
diff --git a/src/main/runtime/rpc/terminal-subscribe-admission.test.ts b/src/main/runtime/rpc/terminal-subscribe-admission.test.ts
new file mode 100644
index 000000000000..75df605d1c8a
--- /dev/null
+++ b/src/main/runtime/rpc/terminal-subscribe-admission.test.ts
@@ -0,0 +1,670 @@
+import { describe, expect, it, vi } from 'vitest'
+import { OrcaRuntimeService } from '../orca-runtime'
+import type { RpcRequest } from './core'
+import { RpcDispatcher } from './dispatcher'
+import { TERMINAL_METHODS } from './methods/terminal'
+import { TerminalUnsubscribe } from '../../../shared/rpc-contract/terminal-viewport-schemas-params'
+import { createSubscriptionRegistryDouble } from './subscription-registry-test-double'
+
+const PTY_ID = 'pty-1'
+const SUBSCRIPTION_ID = 'terminal-1:phone-1'
+
+const binaryParams = {
+  terminal: 'terminal-1',
+  client: { id: 'phone-1', type: 'mobile' },
+  viewport: { cols: 40, rows: 20 },
+  capabilities: { terminalBinaryStream: 1 }
+}
+
+const leaseOnlyParams = {
+  terminal: 'terminal-1',
+  client: { id: 'phone-1', type: 'mobile' },
+  capabilities: { terminalBinaryStream: 1, mobileInputLeaseOnly: 1 }
+}
+
+let nextRequestId = 0
+const subscribeRequest = (params: unknown): RpcRequest => ({
+  id: `req-${++nextRequestId}`,
+  authToken: 'tok',
+  method: 'terminal.subscribe',
+  params
+})
+const unsubscribeRequest = (): RpcRequest => ({
+  id: `req-${++nextRequestId}`,
+  authToken: 'tok',
+  method: 'terminal.unsubscribe',
+  params: { subscriptionId: SUBSCRIPTION_ID }
+})
+
+/** What a phone that addresses its request sends; the slot fields stay for older hosts. */
+const phoneUnsubscribeParams = (requestId: string) => ({
+  subscriptionId: SUBSCRIPTION_ID,
+  client: { id: 'phone-1' },
+  requestId
+})
+const requestUnsubscribe = (requestId: string): RpcRequest => ({
+  id: `req-${++nextRequestId}`,
+  authToken: 'tok',
+  method: 'terminal.unsubscribe',
+  params: phoneUnsubscribeParams(requestId)
+})
+
+const phoneConnection = (connectionId: string, signal?: AbortSignal) => ({
+  connectionId,
+  signal,
+  sendBinary: vi.fn(),
+  registerBinaryStreamHandler: vi.fn(() => vi.fn())
+})
+
+const resultTypes = (messages: string[]): unknown[] =>
+  messages.map((message) => JSON.parse(message).result?.type)
+
+const flush = (ms = 20): Promise<unknown> => new Promise((resolve) => setTimeout(resolve, ms))
+
+/** Resolves pending `waitForLeafPtyId` calls on demand and rejects them when their signal aborts, like the runtime. */
+function createPtyWaits() {
+  const waits: { resolve: (ptyId: string) => void }[] = []
+  return {
+    waits,
+    waitForLeafPtyId: vi.fn(
+      (_handle: string, _timeoutMs?: number, signal?: AbortSignal) =>
+        new Promise<string>((resolve, reject) => {
+          if (signal?.aborted) {
+            reject(new Error('request_aborted'))
+            return
+          }
+          signal?.addEventListener('abort', () => reject(new Error('request_aborted')), {
+            once: true
+          })
+          waits.push({ resolve })
+        })
+    ),
+    spawn: () => {
+      for (const wait of waits.splice(0)) {
+        wait.resolve(PTY_ID)
+      }
+    }
+  }
+}
+
+function stubRuntime(overrides: Record<string, unknown> = {}) {
+  const registry = createSubscriptionRegistryDouble()
+  const ptyWaits = createPtyWaits()
+  let ptyReady = false
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: This partial runtime supplies the terminal RPC methods these tests invoke.
+  const runtime = {
+    getRuntimeId: () => 'test-runtime',
+    registerRemoteTerminalViewSubscriber: () => () => {},
+    requestRendererTerminalTabMount: vi.fn(() => false),
+    resolveLeafForHandle: vi.fn(() => ({ ptyId: ptyReady ? PTY_ID : null })),
+    waitForLeafPtyId: ptyWaits.waitForLeafPtyId,
+    handleMobileSubscribe: vi.fn().mockResolvedValue(true),
+    handleMobileUnsubscribe: vi.fn(),
+    subscribeToTerminalData: vi.fn(() => vi.fn()),
+    readTerminal: vi.fn().mockResolvedValue({ tail: ['scrollback'], truncated: false }),
+    serializeTerminalBuffer: vi
+      .fn()
+      .mockResolvedValue({ data: 'snapshot', cols: 40, rows: 20, seq: 4 }),
+    getTerminalSize: vi.fn().mockReturnValue({ cols: 40, rows: 20 }),
+    getMobileDisplayMode: vi.fn().mockReturnValue('auto'),
+    getLayout: vi.fn().mockReturnValue({ seq: 1 }),
+    isTerminalAlternateScreen: vi.fn().mockReturnValue(false),
+    subscribeToTerminalResize: vi.fn(() => vi.fn()),
+    subscribeToFitOverrideChanges: vi.fn(() => vi.fn()),
+    subscribeToPtyExit: vi.fn(() => vi.fn()),
+    registerOwnedSubscriptionCleanup: registry.registerOwnedSubscriptionCleanup,
+    cleanupSubscriptionIfOwnedByConnection: registry.cleanupSubscriptionIfOwnedByConnection,
+    getSubscriptionRegistrationVersion: registry.getSubscriptionRegistrationVersion,
+    releaseSubscriptionByRequest: registry.releaseSubscriptionByRequest,
+    ...overrides
+  } as unknown as OrcaRuntimeService
+  const spawn = (): void => {
+    ptyReady = true
+    ptyWaits.spawn()
+  }
+  return { runtime, registry, ptyWaits, spawn }
+}
+
+/** The real runtime, with only handle resolution, the pty wait, the scrollback read and tab mounting doubled. */
+function createRealRuntime() {
+  const runtime = new OrcaRuntimeService()
+  const sizes = new Map<string, { cols: number; rows: number }>([[PTY_ID, { cols: 120, rows: 40 }]])
+  runtime.setPtyController({
+    write: () => true,
+    kill: () => true,
+    getForegroundProcess: async () => null,
+    resize: (ptyId, cols, rows) => {
+      sizes.set(ptyId, { cols, rows })
+      return true
+    },
+    getSize: (ptyId) => sizes.get(ptyId) ?? null
+  })
+  const ptyWaits = createPtyWaits()
+  let ptyReady = false
+  vi.spyOn(runtime, 'resolveLeafForHandle').mockImplementation(() => ({
+    ptyId: ptyReady ? PTY_ID : null
+  }))
+  vi.spyOn(runtime, 'waitForLeafPtyId').mockImplementation(ptyWaits.waitForLeafPtyId)
+  vi.spyOn(runtime, 'readTerminal').mockResolvedValue({
+    handle: 'terminal-1',
+    status: 'running',
+    tail: [],
+    truncated: false,
+    nextCursor: null
+  })
+  vi.spyOn(runtime, 'requestRendererTerminalTabMount').mockReturnValue(false)
+  const spawn = (): void => {
+    ptyReady = true
+    ptyWaits.spawn()
+  }
+  return { runtime, ptyWaits, spawn, sizes }
+}
+
+describe('terminal.subscribe registers at admission', () => {
+  it('lets an unsubscribe end a subscribe that is still waiting for its pty', async () => {
+    const { runtime, registry, ptyWaits, spawn } = stubRuntime()
+    const dispatcher = new RpcDispatcher({ runtime, methods: TERMINAL_METHODS })
+    const messages: string[] = []
+    const subscribe = dispatcher.dispatchStreaming(
+      subscribeRequest(binaryParams),
+      (message) => messages.push(message),
+      phoneConnection('conn-a')
+    )
+    await vi.waitFor(() => expect(ptyWaits.waitForLeafPtyId).toHaveBeenCalled())
+
+    const replies: string[] = []
+    await dispatcher.dispatchStreaming(unsubscribeRequest(), (reply) => replies.push(reply), {
+      connectionId: 'conn-a'
+    })
+    spawn()
+    await flush()
+
+    try {
+      expect(JSON.parse(replies[0]!).result).toEqual({ unsubscribed: true })
+      expect(registry.peekCleanup(SUBSCRIPTION_ID)).toBeUndefined()
+      expect(runtime.handleMobileSubscribe).not.toHaveBeenCalled()
+      expect(resultTypes(messages)).toEqual(['end'])
+    } finally {
+      registry.cleanupSubscriptionsForConnection('conn-a')
+      await subscribe
+    }
+  })
+
+  it('leaves the desktop driver idle when the phone leaves before the pty is ready', async () => {
+    const { runtime, ptyWaits, spawn } = createRealRuntime()
+    const dispatcher = new RpcDispatcher({ runtime, methods: TERMINAL_METHODS })
+    const messages: string[] = []
+    const subscribe = dispatcher.dispatchStreaming(
+      subscribeRequest(binaryParams),
+      (message) => messages.push(message),
+      phoneConnection('conn-a')
+    )
+    await vi.waitFor(() => expect(ptyWaits.waitForLeafPtyId).toHaveBeenCalled())
+
+    await dispatcher.dispatchStreaming(unsubscribeRequest(), vi.fn(), { connectionId: 'conn-a' })
+    spawn()
+    await flush()
+
+    try {
+      expect(runtime.getDriver(PTY_ID).kind).toBe('idle')
+      expect(runtime.getTerminalFitOverride(PTY_ID)).toBeNull()
+      expect(resultTypes(messages)).toEqual(['end'])
+    } finally {
+      runtime.cleanupSubscriptionsForConnection('conn-a')
+      await subscribe
+    }
+  })
+
+  it('ends a pending subscribe replaced by the same slot without adding its presence', async () => {
+    const { runtime, registry, ptyWaits, spawn } = stubRuntime()
+    const dispatcher = new RpcDispatcher({ runtime, methods: TERMINAL_METHODS })
+    const firstMessages: string[] = []
+    const first = dispatcher.dispatchStreaming(
+      subscribeRequest(binaryParams),
+      (message) => firstMessages.push(message),
+      phoneConnection('conn-a')
+    )
+    await vi.waitFor(() => expect(ptyWaits.waitForLeafPtyId).toHaveBeenCalledTimes(1))
+
+    const second = dispatcher.dispatchStreaming(
+      subscribeRequest(binaryParams),
+      vi.fn(),
+      phoneConnection('conn-b')
+    )
+    await vi.waitFor(() => expect(ptyWaits.waitForLeafPtyId).toHaveBeenCalledTimes(2))
+    const replacement = registry.peekCleanup(SUBSCRIPTION_ID)
+    spawn()
+    await first
+    await vi.waitFor(() => expect(runtime.handleMobileSubscribe).toHaveBeenCalled())
+    await flush()
+
+    try {
+      expect(resultTypes(firstMessages)).toEqual(['end'])
+      // Only the replacement joins; the evicted request never adds presence behind it.
+      expect(runtime.handleMobileSubscribe).toHaveBeenCalledOnce()
+      expect(runtime.handleMobileUnsubscribe).not.toHaveBeenCalled()
+      expect(registry.peekCleanup(SUBSCRIPTION_ID)).toBe(replacement)
+    } finally {
+      registry.cleanupSubscriptionsForConnection('conn-b')
+      await second
+    }
+  })
+
+  it('leaves the desktop driver idle when the phone leaves during the phone-fit layout', async () => {
+    const { runtime, sizes } = createRealRuntime()
+    const dispatcher = new RpcDispatcher({ runtime, methods: TERMINAL_METHODS })
+    let leaveDuringLayout = true
+    runtime.setPtyController({
+      write: () => true,
+      kill: () => true,
+      getForegroundProcess: async () => null,
+      resize: (ptyId, cols, rows) => {
+        sizes.set(ptyId, { cols, rows })
+        // The phone's unsubscribe lands while handleMobileSubscribe awaits its layout.
+        if (leaveDuringLayout) {
+          leaveDuringLayout = false
+          runtime.cleanupSubscriptionIfOwnedByConnection(SUBSCRIPTION_ID, 'conn-a')
+        }
+        return true
+      },
+      getSize: (ptyId) => sizes.get(ptyId) ?? null
+    })
+    vi.spyOn(runtime, 'resolveLeafForHandle').mockReturnValue({ ptyId: PTY_ID })
+    const messages: string[] = []
+
+    const subscribe = dispatcher.dispatchStreaming(
+      subscribeRequest(binaryParams),
+      (message) => messages.push(message),
+      phoneConnection('conn-a')
+    )
+    await vi.waitFor(() => expect(leaveDuringLayout).toBe(false))
+    await subscribe
+
+    await vi.waitFor(() => expect(runtime.getDriver(PTY_ID).kind).toBe('idle'), {
+      timeout: 2_000
+    })
+    expect(resultTypes(messages)).toEqual(['end'])
+  })
+
+  it('leaves no registration when the request aborts while the pty is pending', async () => {
+    const { runtime, registry, ptyWaits, spawn } = stubRuntime()
+    const dispatcher = new RpcDispatcher({ runtime, methods: TERMINAL_METHODS })
+    const request = new AbortController()
+    const messages: string[] = []
+    const subscribe = dispatcher.dispatchStreaming(
+      subscribeRequest(binaryParams),
+      (message) => messages.push(message),
+      phoneConnection('conn-a', request.signal)
+    )
+    await vi.waitFor(() => expect(ptyWaits.waitForLeafPtyId).toHaveBeenCalled())
+
+    request.abort()
+    spawn()
+    await subscribe
+    await flush()
+
+    expect(registry.peekCleanup(SUBSCRIPTION_ID)).toBeUndefined()
+    expect(runtime.handleMobileSubscribe).not.toHaveBeenCalled()
+    expect(runtime.subscribeToTerminalData).not.toHaveBeenCalled()
+    expect(resultTypes(messages)).toEqual(['end'])
+  })
+
+  it('does not follow a released stream end with an error', async () => {
+    let rejectSubscribe = (_error: Error): void => {}
+    const { runtime, registry } = stubRuntime({
+      resolveLeafForHandle: vi.fn(() => ({ ptyId: PTY_ID })),
+      handleMobileSubscribe: vi.fn(
+        () =>
+          new Promise<boolean>((_resolve, reject) => {
+            rejectSubscribe = reject
+          })
+      )
+    })
+    const dispatcher = new RpcDispatcher({ runtime, methods: TERMINAL_METHODS })
+    const messages: string[] = []
+    const subscribe = dispatcher.dispatchStreaming(
+      subscribeRequest(leaseOnlyParams),
+      (message) => messages.push(message),
+      phoneConnection('conn-a')
+    )
+    await vi.waitFor(() => expect(runtime.handleMobileSubscribe).toHaveBeenCalled())
+
+    registry.cleanupSubscriptionIfOwnedByConnection(SUBSCRIPTION_ID, 'conn-a')
+    rejectSubscribe(new Error('subscribe_failed'))
+    await subscribe
+
+    expect(messages.map((message) => JSON.parse(message))).toEqual([
+      expect.objectContaining({ ok: true, result: { type: 'end' } })
+    ])
+  })
+
+  it('fails without end when the stream errors before anything released it', async () => {
+    const { runtime, registry } = stubRuntime({
+      resolveLeafForHandle: vi.fn(() => ({ ptyId: PTY_ID })),
+      handleMobileSubscribe: vi.fn().mockRejectedValue(new Error('subscribe_failed'))
+    })
+    const dispatcher = new RpcDispatcher({ runtime, methods: TERMINAL_METHODS })
+    const messages: string[] = []
+
+    await dispatcher.dispatchStreaming(
+      subscribeRequest(leaseOnlyParams),
+      (message) => messages.push(message),
+      phoneConnection('conn-a')
+    )
+
+    expect(messages.map((message) => JSON.parse(message).ok)).toEqual([false])
+    expect(registry.peekCleanup(SUBSCRIPTION_ID)).toBeUndefined()
+    // Presence was added before the await, so the failed request still removes it.
+    expect(runtime.handleMobileUnsubscribe).toHaveBeenCalledWith(PTY_ID, 'phone-1')
+  })
+})
+
+describe('terminal.subscribe characterization', () => {
+  it('answers a dead pty with a scrollback preview, then one end, and keeps no registration', async () => {
+    const { runtime, registry } = stubRuntime({
+      waitForLeafPtyId: vi.fn().mockRejectedValue(new Error('Timed out waiting for PTY to spawn'))
+    })
+    const dispatcher = new RpcDispatcher({ runtime, methods: TERMINAL_METHODS })
+    const messages: string[] = []
+
+    await dispatcher.dispatchStreaming(
+      subscribeRequest(binaryParams),
+      (message) => messages.push(message),
+      phoneConnection('conn-a')
+    )
+
+    expect(runtime.waitForLeafPtyId).toHaveBeenCalled()
+    expect(messages.map((message) => JSON.parse(message).result)).toEqual([
+      { type: 'subscribed', streamId: null, lines: ['scrollback'], truncated: false },
+      { type: 'end' }
+    ])
+    expect(registry.peekCleanup(SUBSCRIPTION_ID)).toBeUndefined()
+  })
+
+  it('stops listening to a long-lived IPC signal once the stream is released', async () => {
+    const { runtime, registry } = stubRuntime({
+      resolveLeafForHandle: vi.fn(() => ({ ptyId: PTY_ID }))
+    })
+    const dispatcher = new RpcDispatcher({ runtime, methods: TERMINAL_METHODS })
+    // IPC keeps one controller per subscription id and it outlives the dispatch.
+    const ipcSubscription = new AbortController()
+    const addAbort = vi.spyOn(ipcSubscription.signal, 'addEventListener')
+    const removeAbort = vi.spyOn(ipcSubscription.signal, 'removeEventListener')
+    const messages: string[] = []
+    const subscribe = dispatcher.dispatchStreaming(
+      subscribeRequest(binaryParams),
+      (message) => messages.push(message),
+      { ...phoneConnection('ipc-a'), signal: ipcSubscription.signal }
+    )
+    await vi.waitFor(() => expect(runtime.handleMobileSubscribe).toHaveBeenCalled())
+    expect(addAbort).toHaveBeenCalledWith('abort', expect.any(Function), { once: true })
+
+    registry.cleanupSubscriptionIfOwnedByConnection(SUBSCRIPTION_ID, 'ipc-a')
+    await subscribe
+    expect(removeAbort).toHaveBeenCalledWith('abort', addAbort.mock.calls[0]![1])
+
+    ipcSubscription.abort()
+    await flush()
+    expect(runtime.handleMobileUnsubscribe).toHaveBeenCalledOnce()
+    expect(resultTypes(messages).filter((type) => type === 'end')).toHaveLength(1)
+  })
+
+  it('ends a stream when its IPC subscription is aborted', async () => {
+    const { runtime, registry } = stubRuntime({
+      resolveLeafForHandle: vi.fn(() => ({ ptyId: PTY_ID }))
+    })
+    const dispatcher = new RpcDispatcher({ runtime, methods: TERMINAL_METHODS })
+    const ipcSubscription = new AbortController()
+    const messages: string[] = []
+    const subscribe = dispatcher.dispatchStreaming(
+      subscribeRequest(binaryParams),
+      (message) => messages.push(message),
+      { ...phoneConnection('ipc-a'), signal: ipcSubscription.signal }
+    )
+    await vi.waitFor(() => expect(runtime.handleMobileSubscribe).toHaveBeenCalled())
+
+    ipcSubscription.abort()
+    await subscribe
+
+    expect(registry.peekCleanup(SUBSCRIPTION_ID)).toBeUndefined()
+    expect(runtime.handleMobileUnsubscribe).toHaveBeenCalledWith(PTY_ID, 'phone-1')
+    expect(resultTypes(messages).at(-1)).toBe('end')
+  })
+
+  it('rejects a phone without binary streaming before it can replace the live stream', async () => {
+    const { runtime, registry } = stubRuntime({
+      waitForLeafPtyId: vi.fn().mockRejectedValue(new Error('Timed out waiting for PTY to spawn'))
+    })
+    const live = vi.fn()
+    registry.registerOwnedSubscriptionCleanup(SUBSCRIPTION_ID, live, 'conn-a')
+    const dispatcher = new RpcDispatcher({ runtime, methods: TERMINAL_METHODS })
+    const messages: string[] = []
+
+    // A pre-binary phone subscribing to a pty that never spawned: this used to get a preview and end.
+    await dispatcher.dispatchStreaming(
+      subscribeRequest({ terminal: 'terminal-1', client: { id: 'phone-1', type: 'mobile' } }),
+      (message) => messages.push(message),
+      { connectionId: 'conn-b' }
+    )
+
+    expect(JSON.parse(messages[0]!)).toMatchObject({
+      ok: false,
+      error: { message: 'binary_terminal_stream_required' }
+    })
+    expect(messages).toHaveLength(1)
+    expect(runtime.waitForLeafPtyId).not.toHaveBeenCalled()
+    expect(live).not.toHaveBeenCalled()
+    expect(registry.peekCleanup(SUBSCRIPTION_ID)).toBe(live)
+  })
+})
+
+describe('terminal.unsubscribe addressed by request', () => {
+  const liveStub = () => stubRuntime({ resolveLeafForHandle: vi.fn(() => ({ ptyId: PTY_ID })) })
+
+  it('does not let a replaced request end the newer stream on the same slot', async () => {
+    const { runtime, registry } = liveStub()
+    const dispatcher = new RpcDispatcher({ runtime, methods: TERMINAL_METHODS })
+    const older = subscribeRequest(binaryParams)
+    const first = dispatcher.dispatchStreaming(older, vi.fn(), phoneConnection('conn-a'))
+    await vi.waitFor(() => expect(runtime.handleMobileSubscribe).toHaveBeenCalledTimes(1))
+    const newerMessages: string[] = []
+    const second = dispatcher.dispatchStreaming(
+      subscribeRequest(binaryParams),
+      (message) => newerMessages.push(message),
+      phoneConnection('conn-a')
+    )
+    await vi.waitFor(() => expect(runtime.handleMobileSubscribe).toHaveBeenCalledTimes(2))
+    const replacement = registry.peekCleanup(SUBSCRIPTION_ID)
+
+    // The phone disposes the older stream only after the newer one registered.
+    await dispatcher.dispatchStreaming(requestUnsubscribe(older.id), vi.fn(), {
+      connectionId: 'conn-a'
+    })
+    await flush()
+
+    try {
+      expect(registry.peekCleanup(SUBSCRIPTION_ID)).toBe(replacement)
+      expect(resultTypes(newerMessages)).not.toContain('end')
+    } finally {
+      registry.cleanupSubscriptionsForConnection('conn-a')
+      await Promise.all([first, second])
+    }
+  })
+
+  it('ends a subscribe still waiting for its pty, addressed by its request id', async () => {
+    const { runtime, ptyWaits, spawn } = createRealRuntime()
+    const dispatcher = new RpcDispatcher({ runtime, methods: TERMINAL_METHODS })
+    const pending = subscribeRequest(binaryParams)
+    const messages: string[] = []
+    const subscribe = dispatcher.dispatchStreaming(
+      pending,
+      (message) => messages.push(message),
+      phoneConnection('conn-a')
+    )
+    await vi.waitFor(() => expect(ptyWaits.waitForLeafPtyId).toHaveBeenCalled())
+
+    await dispatcher.dispatchStreaming(requestUnsubscribe(pending.id), vi.fn(), {
+      connectionId: 'conn-a'
+    })
+    spawn()
+    await flush()
+
+    try {
+      expect(runtime.getDriver(PTY_ID).kind).toBe('idle')
+      expect(runtime.getTerminalFitOverride(PTY_ID)).toBeNull()
+      expect(resultTypes(messages)).toEqual(['end'])
+    } finally {
+      runtime.cleanupSubscriptionsForConnection('conn-a')
+      await subscribe
+    }
+  })
+
+  it.each([
+    ['an unknown request', () => 'req-unknown'],
+    ['the unsubscribe itself', (unsubscribeId: string) => unsubscribeId],
+    ['a non-terminal stream', () => 'req-tabs']
+  ])('treats %s as a no-op without touching the slot', async (_label, target) => {
+    const { runtime, registry } = liveStub()
+    const tabsCleanup = vi.fn()
+    registry.registerSubscriptionCleanup('session.tabs:conn-a:wt:req-tabs', tabsCleanup, 'conn-a')
+    const dispatcher = new RpcDispatcher({ runtime, methods: TERMINAL_METHODS })
+    const messages: string[] = []
+    const subscribe = dispatcher.dispatchStreaming(
+      subscribeRequest(binaryParams),
+      (message) => messages.push(message),
+      phoneConnection('conn-a')
+    )
+    await vi.waitFor(() => expect(runtime.handleMobileSubscribe).toHaveBeenCalled())
+    const live = registry.peekCleanup(SUBSCRIPTION_ID)
+
+    const unsubscribeId = `req-${++nextRequestId}`
+    const replies: string[] = []
+    await dispatcher.dispatchStreaming(
+      {
+        id: unsubscribeId,
+        authToken: 'tok',
+        method: 'terminal.unsubscribe',
+        params: phoneUnsubscribeParams(target(unsubscribeId))
+      },
+      (reply) => replies.push(reply),
+      { connectionId: 'conn-a' }
+    )
+    await flush()
+
+    try {
+      expect(JSON.parse(replies[0]!).result).toEqual({ unsubscribed: true })
+      expect(registry.peekCleanup(SUBSCRIPTION_ID)).toBe(live)
+      expect(resultTypes(messages)).not.toContain('end')
+      expect(tabsCleanup).not.toHaveBeenCalled()
+    } finally {
+      registry.cleanupSubscriptionsForConnection('conn-a')
+      await subscribe
+    }
+  })
+
+  it('is a no-op on a socket without a connection id', async () => {
+    const { runtime, registry } = liveStub()
+    const dispatcher = new RpcDispatcher({ runtime, methods: TERMINAL_METHODS })
+    const live = subscribeRequest(binaryParams)
+    const subscribe = dispatcher.dispatchStreaming(live, vi.fn(), phoneConnection('conn-a'))
+    await vi.waitFor(() => expect(runtime.handleMobileSubscribe).toHaveBeenCalled())
+    const liveCleanup = registry.peekCleanup(SUBSCRIPTION_ID)
+
+    await dispatcher.dispatchStreaming(requestUnsubscribe(live.id), vi.fn())
+    await flush()
+
+    try {
+      expect(registry.peekCleanup(SUBSCRIPTION_ID)).toBe(liveCleanup)
+    } finally {
+      registry.cleanupSubscriptionsForConnection('conn-a')
+      await subscribe
+    }
+  })
+
+  it('lets a host without the field strip it and end the slot, as before', async () => {
+    // The shape every earlier host validates `terminal.unsubscribe` with; it is not strict.
+    const legacySchema = TerminalUnsubscribe.omit({ requestId: true })
+    const legacyParams = legacySchema.parse(phoneUnsubscribeParams('req-any'))
+    expect(legacyParams).toEqual({ subscriptionId: SUBSCRIPTION_ID, client: { id: 'phone-1' } })
+
+    const { runtime, registry } = liveStub()
+    const dispatcher = new RpcDispatcher({ runtime, methods: TERMINAL_METHODS })
+    const messages: string[] = []
+    const subscribe = dispatcher.dispatchStreaming(
+      subscribeRequest(binaryParams),
+      (message) => messages.push(message),
+      phoneConnection('conn-a')
+    )
+    await vi.waitFor(() => expect(runtime.handleMobileSubscribe).toHaveBeenCalled())
+
+    await dispatcher.dispatchStreaming(
+      {
+        id: `req-${++nextRequestId}`,
+        authToken: 'tok',
+        method: 'terminal.unsubscribe',
+        params: legacyParams
+      },
+      vi.fn(),
+      { connectionId: 'conn-a' }
+    )
+    await subscribe
+
+    expect(registry.peekCleanup(SUBSCRIPTION_ID)).toBeUndefined()
+    expect(resultTypes(messages).at(-1)).toBe('end')
+  })
+
+  it('never lets a back-to-back unsubscribe overtake the subscribe it names', async () => {
+    const { runtime, registry } = liveStub()
+    const register = vi.spyOn(runtime, 'registerOwnedSubscriptionCleanup')
+    const release = vi.spyOn(runtime, 'releaseSubscriptionByRequest')
+    const dispatcher = new RpcDispatcher({ runtime, methods: TERMINAL_METHODS })
+    const subscribe = subscribeRequest(binaryParams)
+    const messages: string[] = []
+
+    const streaming = dispatcher.dispatchStreaming(
+      subscribe,
+      (message) => messages.push(message),
+      phoneConnection('conn-a')
+    )
+    const unsubscribing = dispatcher.dispatchStreaming(requestUnsubscribe(subscribe.id), vi.fn(), {
+      connectionId: 'conn-a'
+    })
+    await Promise.all([streaming, unsubscribing])
+    await flush()
+
+    expect(register.mock.invocationCallOrder[0]).toBeLessThan(release.mock.invocationCallOrder[0]!)
+    expect(registry.peekCleanup(SUBSCRIPTION_ID)).toBeUndefined()
+    expect(registry.requestAddressCount()).toBe(0)
+    expect(resultTypes(messages).filter((type) => type === 'end')).toHaveLength(1)
+  })
+
+  it('heals a half-open socket: the replay on a new socket is what the leave ends', async () => {
+    const { runtime, spawn } = createRealRuntime()
+    spawn()
+    const dispatcher = new RpcDispatcher({ runtime, methods: TERMINAL_METHODS })
+    // Replay after a reconnect resends the same request id on the new socket.
+    const replayed = subscribeRequest(binaryParams)
+    const halfOpenMessages: string[] = []
+    const halfOpen = dispatcher.dispatchStreaming(
+      replayed,
+      (message) => halfOpenMessages.push(message),
+      phoneConnection('conn-1')
+    )
+    await vi.waitFor(() => expect(runtime.getDriver(PTY_ID).kind).toBe('mobile'))
+    const replay = dispatcher.dispatchStreaming(replayed, vi.fn(), phoneConnection('conn-2'))
+    await halfOpen
+    expect(resultTypes(halfOpenMessages).at(-1)).toBe('end')
+
+    await dispatcher.dispatchStreaming(requestUnsubscribe(replayed.id), vi.fn(), {
+      connectionId: 'conn-2'
+    })
+    await replay
+
+    await vi.waitFor(() => expect(runtime.getDriver(PTY_ID).kind).toBe('idle'), {
+      timeout: 2_000
+    })
+    // The half-open socket's eventual close finds nothing of its own left.
+    runtime.cleanupSubscriptionsForConnection('conn-1')
+    expect(runtime.getDriver(PTY_ID).kind).toBe('idle')
+  })
+})
diff --git a/src/main/runtime/rpc/terminal-subscribe-buffer.test.ts b/src/main/runtime/rpc/terminal-subscribe-buffer.test.ts
index b6c53668f2d7..a08458d8be53 100644
--- a/src/main/runtime/rpc/terminal-subscribe-buffer.test.ts
+++ b/src/main/runtime/rpc/terminal-subscribe-buffer.test.ts
@@ -13,8 +13,11 @@ import {
 } from '../../../shared/terminal-stream-protocol'
 
 function stubRuntime(overrides: Partial<OrcaRuntimeService> = {}): OrcaRuntimeService {
+  const registry = createSubscriptionRegistryDouble()
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: This partial runtime supplies the terminal RPC methods these tests invoke.
   return {
     getRuntimeId: () => 'test-runtime',
+    registerOwnedSubscriptionCleanup: registry.registerOwnedSubscriptionCleanup,
     subscribeToPtyExit: vi.fn(() => vi.fn()),
     // Why: subscribe streams register as remote view subscribers for Phase-5
     // query-authority suppression (terminal-query-authority.md).
@@ -76,7 +79,8 @@ describe('terminal subscribe buffering', () => {
 
       expect(await outcomePromise).toBe('settled')
       expect(runtime.readTerminal).not.toHaveBeenCalled()
-      expect(messages).toEqual([])
+      // The pending stream was registered, so its release ends it like any other.
+      expect(messages.map((msg) => JSON.parse(msg).result?.type)).toEqual(['end'])
     } finally {
       vi.useRealTimers()
     }
@@ -302,7 +306,8 @@ describe('terminal subscribe buffering', () => {
       expect(runtime.registerOwnedSubscriptionCleanup).toHaveBeenCalledWith(
         'terminal-1:desktop-1',
         expect.any(Function),
-        'conn-legacy-json'
+        'conn-legacy-json',
+        'req-1'
       )
       expect(registry.peekCleanup('terminal-1:desktop-1')).toBeUndefined()
       expect(runtime.waitForTerminal).not.toHaveBeenCalled()
diff --git a/src/main/runtime/rpc/terminal-subscribe-mount-replay.test.ts b/src/main/runtime/rpc/terminal-subscribe-mount-replay.test.ts
index c64747616cff..6dd443f14026 100644
--- a/src/main/runtime/rpc/terminal-subscribe-mount-replay.test.ts
+++ b/src/main/runtime/rpc/terminal-subscribe-mount-replay.test.ts
@@ -11,6 +11,11 @@ import { RpcDispatcher } from './dispatcher'
 import { TERMINAL_METHODS } from './methods/terminal'
 import { createSubscriptionRegistryDouble } from './subscription-registry-test-double'
 
+function asRuntime(double: Record<string, unknown>): OrcaRuntimeService {
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: terminal.subscribe reads only the members the double provides.
+  return double as unknown as OrcaRuntimeService
+}
+
 const request: RpcRequest = {
   id: 'req-1',
   authToken: 'tok',
@@ -97,7 +102,7 @@ describe('terminal subscribe mount replay', () => {
     let generation = 1
     let headlessPresent = false
     let serializeCalls = 0
-    const runtime = {
+    const runtime = asRuntime({
       getRuntimeId: () => 'test-runtime',
       subscribeToPtyExit: vi.fn(() => vi.fn()),
       resolveLeafForHandle: vi.fn().mockReturnValue({ ptyId: 'pty-1' }),
@@ -110,9 +115,9 @@ describe('terminal subscribe mount replay', () => {
       waitForRendererTerminalSerializer: vi.fn(async (_ptyId, afterGeneration) => {
         return generation > afterGeneration
       }),
+      // The phone fit's redraw creates suffix-only headless state.
       handleMobileSubscribe: vi.fn(async () => {
         headlessPresent = true
-        generation = 2
         return true
       }),
       handleMobileUnsubscribe: vi.fn(),
@@ -126,12 +131,15 @@ describe('terminal subscribe mount replay', () => {
         }
         return { data: 'raced idle prompt $ ', cols: 80, rows: 24, seq: 5 }
       }),
-      serializeRendererTerminalBuffer: vi.fn(async () => ({
-        data: 'raced idle prompt $ ',
-        cols: 80,
-        rows: 24,
-        seq: 5
-      })),
+      // Baseline race: the pane settles between the attachment answer and the wait, so the wait
+      // must still count that settle against the pre-fit generation.
+      serializeRendererTerminalBuffer: vi
+        .fn()
+        .mockImplementationOnce(async () => {
+          generation = 2
+          return null
+        })
+        .mockResolvedValue({ data: 'raced idle prompt $ ', cols: 80, rows: 24, seq: 5 }),
       getTerminalSize: vi.fn().mockReturnValue({ cols: 80, rows: 24 }),
       getMobileDisplayMode: vi.fn().mockReturnValue('auto'),
       getLayout: vi.fn().mockReturnValue({ seq: 1 }),
@@ -142,7 +150,7 @@ describe('terminal subscribe mount replay', () => {
       registerOwnedSubscriptionCleanup: vi.fn(registry.registerOwnedSubscriptionCleanup),
       cleanupSubscription: vi.fn(registry.cleanupSubscription),
       waitForTerminal: vi.fn(() => new Promise<RuntimeTerminalWait>(() => {}))
-    } as unknown as OrcaRuntimeService
+    })
     const dispatcher = new RpcDispatcher({ runtime, methods: TERMINAL_METHODS })
 
     const dispatchPromise = dispatcher.dispatchStreaming(request, vi.fn(), {
@@ -286,11 +294,8 @@ describe('terminal subscribe mount replay', () => {
     const registry = createSubscriptionRegistryDouble()
     let generation = 0
     let headlessPresent = false
-    const requestRendererTerminalTabMount = vi.fn(() => {
-      generation = 1
-      return true
-    })
-    const runtime = {
+    const requestRendererTerminalTabMount = vi.fn(() => true)
+    const runtime = asRuntime({
       getRuntimeId: () => 'test-runtime',
       subscribeToPtyExit: vi.fn(() => vi.fn()),
       resolveLeafForHandle: vi.fn().mockReturnValue(null),
@@ -320,11 +325,15 @@ describe('terminal subscribe mount replay', () => {
         rows: 24,
         seq: 1
       }),
-      serializeRendererTerminalBuffer: vi.fn().mockResolvedValue({
-        data: 'late leaf prompt $ ',
-        cols: 80,
-        rows: 24
-      }),
+      // Baseline race: the pre-PTY mount settles between the attachment answer and the wait, so the
+      // wait must still count that settle against the pre-mount generation.
+      serializeRendererTerminalBuffer: vi
+        .fn()
+        .mockImplementationOnce(async () => {
+          generation = 1
+          return null
+        })
+        .mockResolvedValue({ data: 'late leaf prompt $ ', cols: 80, rows: 24 }),
       getTerminalSize: vi.fn().mockReturnValue({ cols: 80, rows: 24 }),
       getMobileDisplayMode: vi.fn().mockReturnValue('auto'),
       getLayout: vi.fn().mockReturnValue({ seq: 1 }),
@@ -335,7 +344,7 @@ describe('terminal subscribe mount replay', () => {
       registerOwnedSubscriptionCleanup: vi.fn(registry.registerOwnedSubscriptionCleanup),
       cleanupSubscription: vi.fn(registry.cleanupSubscription),
       waitForTerminal: vi.fn(() => new Promise<RuntimeTerminalWait>(() => {}))
-    } as unknown as OrcaRuntimeService
+    })
     const dispatcher = new RpcDispatcher({ runtime, methods: TERMINAL_METHODS })
 
     const dispatchPromise = dispatcher.dispatchStreaming(request, vi.fn(), {
diff --git a/src/main/runtime/rpc/terminal-subscribe-mounted-pane.test.ts b/src/main/runtime/rpc/terminal-subscribe-mounted-pane.test.ts
new file mode 100644
index 000000000000..56720ff5d483
--- /dev/null
+++ b/src/main/runtime/rpc/terminal-subscribe-mounted-pane.test.ts
@@ -0,0 +1,370 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { RuntimeTerminalWait } from '../../../shared/runtime-types'
+import {
+  TerminalStreamOpcode,
+  decodeTerminalStreamFrame,
+  decodeTerminalStreamText
+} from '../../../shared/terminal-stream-protocol'
+import type { OrcaRuntimeService } from '../orca-runtime'
+import type { RpcRequest } from './core'
+import { RpcDispatcher } from './dispatcher'
+import { TERMINAL_METHODS } from './methods/terminal'
+import { createSubscriptionRegistryDouble } from './subscription-registry-test-double'
+
+const request: RpcRequest = {
+  id: 'req-1',
+  authToken: 'tok',
+  method: 'terminal.subscribe',
+  params: {
+    terminal: 'terminal-1',
+    client: { id: 'phone-1', type: 'mobile' },
+    capabilities: { terminalBinaryStream: 1 }
+  }
+}
+
+function asRuntime(double: Record<string, unknown>): OrcaRuntimeService {
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: terminal.subscribe reads only the members the double provides.
+  return double as unknown as OrcaRuntimeService
+}
+
+type PaneDouble = {
+  /** What the desktop renderer's serializer answers; null when no pane is registered. */
+  rendererScreen: () => string | null
+  /** How long each renderer serialize takes; the IPC answers null after 750 ms when no pane replies. */
+  rendererAnswerDelayMs?: number
+  /** PTY output high-water; a pane printing continuously advances it on every read. */
+  outputSequence?: () => number
+  /** Renderer-ordered seq; null when the pane does not order output itself. */
+  rendererSeq?: number | null
+  /** What the preference order serves before any renderer probe. */
+  chosenScreen?: string
+  /** Live output that arrives while the subscription is still buffering. */
+  pendingOutput?: string
+  /** Output offset at the end of the pending chunk. */
+  pendingOutputSeq?: number
+  waitForRendererTerminalSerializer: OrcaRuntimeService['waitForRendererTerminalSerializer']
+}
+
+function subscribeMobile(pane: PaneDouble) {
+  const binaryFrames: Uint8Array<ArrayBufferLike>[] = []
+  const registry = createSubscriptionRegistryDouble()
+  let emitData: (data: string, meta: { seq: number; rawLength: number }) => void = () => {}
+  const runtime = {
+    getRuntimeId: () => 'test-runtime',
+    subscribeToPtyExit: vi.fn(() => vi.fn()),
+    resolveLeafForHandle: vi.fn().mockReturnValue({ ptyId: 'pty-1' }),
+    // A daemon PTY reattached after a desktop restart has no headless model yet.
+    hasHeadlessTerminalState: vi.fn(() => false),
+    requestRendererTerminalTabMount: vi.fn(() => true),
+    getRendererTerminalSerializerGenerationForHandle: vi.fn(() => 1),
+    getRendererTerminalSerializerGeneration: vi.fn(() => 1),
+    getPtyOutputSequence: vi.fn(pane.outputSequence ?? (() => 4)),
+    replaceHeadlessTerminalFromRendererSnapshotForRecovery: vi.fn(),
+    waitForRendererTerminalSerializer: vi.fn(pane.waitForRendererTerminalSerializer),
+    handleMobileSubscribe: vi.fn().mockResolvedValue(true),
+    handleMobileUnsubscribe: vi.fn(),
+    subscribeToTerminalData: vi.fn((_ptyId: string, listener: typeof emitData) => {
+      emitData = listener
+      return vi.fn()
+    }),
+    registerRemoteTerminalViewSubscriber: vi.fn(() => vi.fn()),
+    readTerminal: vi.fn().mockResolvedValue({ tail: [], truncated: false }),
+    // The restored provider snapshot wins the preference order over the live renderer.
+    serializeTerminalBuffer: vi.fn(async () => {
+      if (pane.pendingOutput) {
+        emitData(pane.pendingOutput, {
+          seq: pane.pendingOutputSeq ?? 3,
+          rawLength: pane.pendingOutput.length
+        })
+      }
+      return {
+        data: pane.chosenScreen ?? 'restored provider history',
+        cols: 80,
+        rows: 24,
+        seq: 2
+      }
+    }),
+    serializeRendererTerminalBuffer: vi.fn(async () => {
+      if (pane.rendererAnswerDelayMs) {
+        await new Promise((resolve) => setTimeout(resolve, pane.rendererAnswerDelayMs))
+      }
+      const screen = pane.rendererScreen()
+      const seq = pane.rendererSeq === undefined ? 4 : pane.rendererSeq
+      return screen === null
+        ? null
+        : {
+            data: screen,
+            cols: 80,
+            rows: 24,
+            ...(seq === null ? {} : { seq }),
+            source: 'renderer' as const
+          }
+    }),
+    getTerminalSize: vi.fn().mockReturnValue({ cols: 80, rows: 24 }),
+    getMobileDisplayMode: vi.fn().mockReturnValue('auto'),
+    getLayout: vi.fn().mockReturnValue({ seq: 1 }),
+    isTerminalAlternateScreen: vi.fn().mockReturnValue(false),
+    subscribeToTerminalResize: vi.fn().mockReturnValue(vi.fn()),
+    subscribeToFitOverrideChanges: vi.fn().mockReturnValue(vi.fn()),
+    registerSubscriptionCleanup: vi.fn(registry.registerSubscriptionCleanup),
+    registerOwnedSubscriptionCleanup: vi.fn(registry.registerOwnedSubscriptionCleanup),
+    cleanupSubscription: vi.fn(registry.cleanupSubscription),
+    waitForTerminal: vi.fn(() => new Promise<RuntimeTerminalWait>(() => {}))
+  }
+  const dispatcher = new RpcDispatcher({ runtime: asRuntime(runtime), methods: TERMINAL_METHODS })
+  const done = dispatcher.dispatchStreaming(request, vi.fn(), {
+    connectionId: 'conn-phone',
+    sendBinary: (bytes) => {
+      binaryFrames.push(bytes)
+    },
+    registerBinaryStreamHandler: vi.fn(() => vi.fn())
+  })
+  const snapshotText = (): string =>
+    binaryFrames
+      .map((bytes) => decodeTerminalStreamFrame(bytes))
+      .filter((frame) => frame?.opcode === TerminalStreamOpcode.SnapshotChunk)
+      .map((frame) => decodeTerminalStreamText(frame!.payload))
+      .join('')
+  const outputText = (): string =>
+    binaryFrames
+      .map((bytes) => decodeTerminalStreamFrame(bytes))
+      .filter((frame) => frame?.opcode === TerminalStreamOpcode.Output)
+      .map((frame) => decodeTerminalStreamText(frame!.payload))
+      .join('')
+  const close = async (): Promise<void> => {
+    runtime.cleanupSubscription('terminal-1:phone-1')
+    await done
+  }
+  return { runtime, snapshotText, outputText, close }
+}
+
+describe('terminal subscribe for a pane the desktop already has mounted', () => {
+  beforeEach(() => {
+    vi.useFakeTimers()
+  })
+  afterEach(() => {
+    vi.useRealTimers()
+  })
+
+  it('adopts the live renderer screen over the chosen snapshot without waiting out the mount deadline', async () => {
+    // The renderer drops a mount request for a mounted tab, so no newer serializer settle ever arrives.
+    const subscription = subscribeMobile({
+      chosenScreen: 'suffix-only redraw',
+      rendererScreen: () => 'live desktop prompt $ ',
+      waitForRendererTerminalSerializer: (_ptyId, _after, _timeout, signal) =>
+        new Promise<boolean>((resolve) => {
+          signal?.addEventListener('abort', () => resolve(false), { once: true })
+        })
+    })
+
+    await vi.advanceTimersByTimeAsync(100)
+
+    expect(subscription.snapshotText()).toContain('live desktop prompt $ ')
+    expect(subscription.snapshotText()).not.toContain('suffix-only redraw')
+    expect(subscription.runtime.requestRendererTerminalTabMount).not.toHaveBeenCalled()
+    expect(subscription.runtime.waitForRendererTerminalSerializer).not.toHaveBeenCalled()
+    expect(
+      subscription.runtime.replaceHeadlessTerminalFromRendererSnapshotForRecovery
+    ).toHaveBeenCalledWith('pty-1', expect.objectContaining({ data: 'live desktop prompt $ ' }), [])
+    await subscription.close()
+  })
+
+  it('adopts a renderer-ordered screen even while output is pending', async () => {
+    // The screen's seq (4) is an exact seam inside the pending chunk (offsets 3..5), so only `z` replays.
+    const subscription = subscribeMobile({
+      rendererScreen: () => 'ordered desktop prompt $ ',
+      pendingOutput: 'Xz',
+      pendingOutputSeq: 5,
+      waitForRendererTerminalSerializer: (_ptyId, _after, _timeout, signal) =>
+        new Promise<boolean>((resolve) => {
+          signal?.addEventListener('abort', () => resolve(false), { once: true })
+        })
+    })
+
+    await vi.advanceTimersByTimeAsync(100)
+
+    expect(subscription.runtime.requestRendererTerminalTabMount).not.toHaveBeenCalled()
+    expect(subscription.snapshotText()).toContain('ordered desktop prompt $ ')
+    expect(subscription.snapshotText()).not.toContain('restored provider history')
+    expect(
+      subscription.runtime.replaceHeadlessTerminalFromRendererSnapshotForRecovery
+    ).toHaveBeenCalledWith(
+      'pty-1',
+      expect.objectContaining({ data: 'ordered desktop prompt $ ', seq: 4 }),
+      [{ data: 'z', seq: 5 }]
+    )
+    expect(subscription.outputText()).toBe('z')
+    await subscription.close()
+  })
+
+  it('answers at once for a mounted pane whose screen is still empty', async () => {
+    // A fresh shell that has printed nothing: the serializer is registered but its screen is blank.
+    const subscription = subscribeMobile({
+      rendererScreen: () => '',
+      waitForRendererTerminalSerializer: (_ptyId, _after, _timeout, signal) =>
+        new Promise<boolean>((resolve) => {
+          signal?.addEventListener('abort', () => resolve(false), { once: true })
+        })
+    })
+
+    await vi.advanceTimersByTimeAsync(100)
+
+    expect(subscription.runtime.requestRendererTerminalTabMount).not.toHaveBeenCalled()
+    // A blank renderer must not erase history the chosen snapshot already carries.
+    expect(subscription.snapshotText()).toContain('restored provider history')
+    expect(
+      subscription.runtime.replaceHeadlessTerminalFromRendererSnapshotForRecovery
+    ).not.toHaveBeenCalled()
+    await subscription.close()
+  })
+
+  it('answers at once for a mounted pane whose output never settles', async () => {
+    // A desktop agent printing continuously: every renderer serialize races a new byte.
+    let sequence = 4
+    const subscription = subscribeMobile({
+      rendererScreen: () => `agent frame ${sequence}`,
+      outputSequence: () => (sequence += 1),
+      waitForRendererTerminalSerializer: (_ptyId, _after, _timeout, signal) =>
+        new Promise<boolean>((resolve) => {
+          signal?.addEventListener('abort', () => resolve(false), { once: true })
+        })
+    })
+
+    await vi.advanceTimersByTimeAsync(100)
+
+    expect(subscription.runtime.requestRendererTerminalTabMount).not.toHaveBeenCalled()
+    expect(subscription.runtime.waitForRendererTerminalSerializer).not.toHaveBeenCalled()
+    // An unsettled screen has no exact seam against buffered output, so the chosen snapshot goes out.
+    expect(subscription.snapshotText()).toContain('restored provider history')
+    expect(
+      subscription.runtime.replaceHeadlessTerminalFromRendererSnapshotForRecovery
+    ).not.toHaveBeenCalled()
+    await subscription.close()
+  })
+
+  it('keeps the chosen snapshot for a seq-less mounted screen while output is pending', async () => {
+    // Without a seq, the buffered chunk would replay on top of a screen that already holds it.
+    const subscription = subscribeMobile({
+      rendererScreen: () => 'unordered desktop prompt $ ',
+      rendererSeq: null,
+      pendingOutput: 'pending byte',
+      waitForRendererTerminalSerializer: (_ptyId, _after, _timeout, signal) =>
+        new Promise<boolean>((resolve) => {
+          signal?.addEventListener('abort', () => resolve(false), { once: true })
+        })
+    })
+
+    await vi.advanceTimersByTimeAsync(100)
+
+    expect(subscription.runtime.requestRendererTerminalTabMount).not.toHaveBeenCalled()
+    expect(subscription.snapshotText()).toContain('restored provider history')
+    expect(subscription.snapshotText()).not.toContain('unordered desktop prompt $ ')
+    expect(
+      subscription.runtime.replaceHeadlessTerminalFromRendererSnapshotForRecovery
+    ).not.toHaveBeenCalled()
+    await subscription.close()
+  })
+
+  it('adopts a seq-less mounted screen when no output is pending', async () => {
+    // Right after a deferred cold restore the pane is not renderer-ordered yet; nothing can replay twice.
+    const subscription = subscribeMobile({
+      rendererScreen: () => 'unordered desktop prompt $ ',
+      rendererSeq: null,
+      waitForRendererTerminalSerializer: (_ptyId, _after, _timeout, signal) =>
+        new Promise<boolean>((resolve) => {
+          signal?.addEventListener('abort', () => resolve(false), { once: true })
+        })
+    })
+
+    await vi.advanceTimersByTimeAsync(100)
+
+    expect(subscription.runtime.requestRendererTerminalTabMount).not.toHaveBeenCalled()
+    expect(subscription.snapshotText()).toContain('unordered desktop prompt $ ')
+    expect(
+      subscription.runtime.replaceHeadlessTerminalFromRendererSnapshotForRecovery
+    ).toHaveBeenCalledWith(
+      'pty-1',
+      expect.objectContaining({ data: 'unordered desktop prompt $ ' }),
+      []
+    )
+    await subscription.close()
+  })
+
+  it('still requests the mount and waits for its settle when no pane is registered', async () => {
+    let mounted = false
+    const subscription = subscribeMobile({
+      rendererScreen: () => (mounted ? 'mounted idle prompt $ ' : null),
+      waitForRendererTerminalSerializer: (_ptyId, afterGeneration) => {
+        expect(afterGeneration).toBe(1)
+        return new Promise<boolean>((resolve) => {
+          setTimeout(() => {
+            mounted = true
+            resolve(true)
+          }, 500)
+        })
+      }
+    })
+
+    await vi.advanceTimersByTimeAsync(100)
+    expect(subscription.runtime.requestRendererTerminalTabMount).toHaveBeenCalledWith('terminal-1')
+    expect(subscription.snapshotText()).toBe('')
+    // No pane is registered, so nothing may spend a terminal read (which can reach the provider) before the settle.
+    expect(subscription.runtime.readTerminal).toHaveBeenCalledTimes(1)
+
+    await vi.advanceTimersByTimeAsync(400)
+    expect(subscription.snapshotText()).toContain('mounted idle prompt $ ')
+    expect(subscription.snapshotText()).not.toContain('restored provider history')
+    await subscription.close()
+  })
+
+  it('keeps the chosen snapshot after the mount wait when a seq-less screen meets pending output', async () => {
+    let mounted = false
+    const subscription = subscribeMobile({
+      rendererScreen: () => (mounted ? 'unordered mounted prompt $ ' : null),
+      rendererSeq: null,
+      pendingOutput: 'pending byte',
+      waitForRendererTerminalSerializer: () =>
+        new Promise<boolean>((resolve) => {
+          setTimeout(() => {
+            mounted = true
+            resolve(true)
+          }, 500)
+        })
+    })
+
+    await vi.advanceTimersByTimeAsync(500)
+
+    expect(subscription.runtime.requestRendererTerminalTabMount).toHaveBeenCalledWith('terminal-1')
+    expect(subscription.snapshotText()).toContain('restored provider history')
+    expect(
+      subscription.runtime.replaceHeadlessTerminalFromRendererSnapshotForRecovery
+    ).not.toHaveBeenCalled()
+    await subscription.close()
+  })
+
+  it('falls back to the mount wait within one serialize when the flag outlives its pane', async () => {
+    // Nothing clears the flag when a tab closes over a live PTY; the IPC then answers null at its
+    // 750 ms deadline while a busy PTY moves output under every attempt.
+    let sequence = 4
+    const subscription = subscribeMobile({
+      rendererScreen: () => null,
+      rendererAnswerDelayMs: 750,
+      outputSequence: () => (sequence += 1),
+      waitForRendererTerminalSerializer: (_ptyId, _after, _timeout, signal) =>
+        new Promise<boolean>((resolve) => {
+          signal?.addEventListener('abort', () => resolve(false), { once: true })
+        })
+    })
+
+    await vi.advanceTimersByTimeAsync(750)
+    expect(subscription.runtime.requestRendererTerminalTabMount).toHaveBeenCalledWith('terminal-1')
+    await vi.advanceTimersByTimeAsync(2_999)
+    expect(subscription.snapshotText()).toBe('')
+
+    // Worst case: one serialize plus the 3 s mount deadline.
+    await vi.advanceTimersByTimeAsync(1)
+    expect(subscription.snapshotText()).toContain('restored provider history')
+    expect(subscription.runtime.serializeRendererTerminalBuffer).toHaveBeenCalledTimes(1)
+    await subscription.close()
+  })
+})
diff --git a/src/main/runtime/rpc/terminal-subscribe-ownership.test.ts b/src/main/runtime/rpc/terminal-subscribe-ownership.test.ts
index d59287639b6a..fefe8efb28d3 100644
--- a/src/main/runtime/rpc/terminal-subscribe-ownership.test.ts
+++ b/src/main/runtime/rpc/terminal-subscribe-ownership.test.ts
@@ -119,7 +119,7 @@ describe('terminal.subscribe teardown ownership', () => {
     expect(registry.peekCleanup(SUBSCRIPTION_ID)).toBeUndefined()
   })
 
-  it('disposes an already-exited PTY observer before binding socket abort', async () => {
+  it('disposes an already-exited PTY observer and the request-abort listener', async () => {
     const registry = createSubscriptionRegistryDouble()
     const unsubscribeExit = vi.fn()
     const runtime = stubRuntime(registry, [], {
@@ -131,12 +131,14 @@ describe('terminal.subscribe teardown ownership', () => {
     const dispatcher = new RpcDispatcher({ runtime, methods: TERMINAL_METHODS })
     const conn = new AbortController()
     const addAbort = vi.spyOn(conn.signal, 'addEventListener')
+    const removeAbort = vi.spyOn(conn.signal, 'removeEventListener')
     const options = streamOptions('conn-a', conn.signal)
 
     await dispatcher.dispatchStreaming(makeRequest(binaryParams), vi.fn(), options)
 
     expect(unsubscribeExit).toHaveBeenCalledOnce()
-    expect(addAbort).not.toHaveBeenCalled()
+    expect(addAbort).toHaveBeenCalledOnce()
+    expect(removeAbort).toHaveBeenCalledWith('abort', addAbort.mock.calls[0]![1])
   })
 
   // Why: the synchronous release runs cleanup before setup, so anything registered after it never gets torn down.
diff --git a/src/main/runtime/runtime-automation-controller.ts b/src/main/runtime/runtime-automation-controller.ts
index d3ac55df4387..20d3725c34e1 100644
--- a/src/main/runtime/runtime-automation-controller.ts
+++ b/src/main/runtime/runtime-automation-controller.ts
@@ -113,7 +113,7 @@ export class RuntimeAutomationController {
     if (input.reuseSession && target.workspaceMode !== 'existing') {
       throw new Error('Session reuse requires an existing workspace target.')
     }
-    return this.store.createAutomation(
+    const automation = this.store.createAutomation(
       {
         creationKey: input.creationKey,
         name: input.name,
@@ -138,6 +138,8 @@ export class RuntimeAutomationController {
         ? { destination: destination ?? input.destination }
         : undefined
     )
+    await this.store.flushPendingOrThrowAsync?.({ drainToStableGeneration: false })
+    return automation
   }
 
   async update(
@@ -179,18 +181,21 @@ export class RuntimeAutomationController {
     if (!targetChanged && patch.reuseSession && current.workspaceMode !== 'existing') {
       throw new Error('Session reuse requires an existing workspace target.')
     }
-    return this.store.updateAutomation(id, patch, options)
+    const automation = this.store.updateAutomation(id, patch, options)
+    await this.store.flushPendingOrThrowAsync?.({ drainToStableGeneration: false })
+    return automation
   }
 
-  delete(
+  async delete(
     id: string,
     expectedOwner?: AutomationOwnerPrecondition
-  ): { removed: boolean; id: string } {
+  ): Promise<{ removed: boolean; id: string }> {
     if (!this.store?.deleteAutomation) {
       throw new Error('runtime_unavailable')
     }
     this.show(id)
     this.store.deleteAutomation(id, expectedOwner ? { expectedOwner } : undefined)
+    await this.store.flushPendingOrThrowAsync?.({ drainToStableGeneration: false })
     return { removed: true, id }
   }
 
diff --git a/src/main/runtime/runtime-client-settings-linear-team-projection.test.ts b/src/main/runtime/runtime-client-settings-linear-team-projection.test.ts
new file mode 100644
index 000000000000..c26eecb3d958
--- /dev/null
+++ b/src/main/runtime/runtime-client-settings-linear-team-projection.test.ts
@@ -0,0 +1,51 @@
+import { describe, expect, it } from 'vitest'
+import { RuntimeClientSettingsController } from './runtime-client-settings'
+import { createGlobalSettingsFixture } from '../../shared/global-settings-test-fixture'
+import type { GlobalSettings } from '../../shared/global-settings-types'
+
+// Why: the projection is what paired clients render page.tasks from, and a
+// non-array in the host store crashed that page in 1.4.207 (0a2b6e7f).
+function projectionOf(settings: Partial<GlobalSettings>) {
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: get() reads nothing but store.getSettings(); every other RuntimeStore member is unreachable from that path.
+  return new RuntimeClientSettingsController({ getSettings: () => settings } as never).get()
+}
+
+function hostSettings(overrides: Record<string, unknown>): Partial<GlobalSettings> {
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the override deliberately carries the malformed on-disk shape the projection must tolerate.
+  return {
+    ...createGlobalSettingsFixture({ workspaceDir: '/w' }),
+    ...overrides
+  } as Partial<GlobalSettings>
+}
+
+describe('RuntimeClientSettingsController Linear team selection projection', () => {
+  it('publishes a saved team array unchanged', () => {
+    expect(
+      projectionOf(hostSettings({ defaultLinearTeamSelection: ['t1', 't2'] }))
+        .defaultLinearTeamSelection
+    ).toEqual(['t1', 't2'])
+  })
+
+  it('publishes sticky-all as null', () => {
+    expect(
+      projectionOf(hostSettings({ defaultLinearTeamSelection: null })).defaultLinearTeamSelection
+    ).toBeNull()
+  })
+
+  it('publishes only string team IDs from a malformed array', () => {
+    expect(
+      projectionOf(hostSettings({ defaultLinearTeamSelection: ['t1', 7, null, {}, 't2'] }))
+        .defaultLinearTeamSelection
+    ).toEqual(['t1', 't2'])
+  })
+
+  it('publishes null when the host store holds a string or an object', () => {
+    expect(
+      projectionOf(hostSettings({ defaultLinearTeamSelection: 't1' })).defaultLinearTeamSelection
+    ).toBeNull()
+    expect(
+      projectionOf(hostSettings({ defaultLinearTeamSelection: { 0: 't1' } }))
+        .defaultLinearTeamSelection
+    ).toBeNull()
+  })
+})
diff --git a/src/main/runtime/runtime-client-settings.ts b/src/main/runtime/runtime-client-settings.ts
index 262021da0e59..76c7e772e5ce 100644
--- a/src/main/runtime/runtime-client-settings.ts
+++ b/src/main/runtime/runtime-client-settings.ts
@@ -107,7 +107,10 @@ export class RuntimeClientSettingsController {
       defaultTaskViewPreset: settings.defaultTaskViewPreset ?? 'issues',
       visibleTaskProviders: settings.visibleTaskProviders ?? [...TASK_PROVIDERS],
       defaultRepoSelection: settings.defaultRepoSelection ?? null,
-      defaultLinearTeamSelection: settings.defaultLinearTeamSelection ?? null,
+      // Persisted settings can violate the paired client's string-array contract.
+      defaultLinearTeamSelection: Array.isArray(settings.defaultLinearTeamSelection)
+        ? settings.defaultLinearTeamSelection.filter((id): id is string => typeof id === 'string')
+        : null,
       githubProjects: settings.githubProjects,
       experimentalNewWorktreeCardStyle: settings.experimentalNewWorktreeCardStyle === true,
       // The three that decide whether a new agent tab -- and so an orchestration worker -- is a
diff --git a/src/main/runtime/runtime-durable-store-fixture.ts b/src/main/runtime/runtime-durable-store-fixture.ts
new file mode 100644
index 000000000000..a5f2dc82793a
--- /dev/null
+++ b/src/main/runtime/runtime-durable-store-fixture.ts
@@ -0,0 +1,40 @@
+import type { DurableProfileStateMutation } from '../persistence/loading-store/store-runtime-state'
+import { profileStateWriterFailureOutcome } from '../persistence/profile-state/profile-state-writer-errors'
+
+/** Keep runtime fakes on the same reserved, durable-before-ack contract as Store. */
+export function withDurableRuntimeStore<
+  T extends {
+    flushOrThrow?: () => void
+    flushPendingOrThrowAsync?: (options?: { drainToStableGeneration?: boolean }) => Promise<void>
+  }
+>(store: T) {
+  let pending = Promise.resolve()
+  return Object.assign(store, {
+    runDurableMutation<Value>(mutate: () => DurableProfileStateMutation<Value>): Promise<Value> {
+      const write = pending.then(async () => {
+        const mutation = mutate()
+        if (mutation.persist === false) {
+          return mutation.value
+        }
+        try {
+          if (store.flushPendingOrThrowAsync) {
+            await store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
+          } else {
+            store.flushOrThrow?.()
+          }
+        } catch (error) {
+          if (profileStateWriterFailureOutcome(error) !== 'indeterminate') {
+            mutation.rollback?.()
+          }
+          throw error
+        }
+        return mutation.value
+      })
+      pending = write.then(
+        () => {},
+        () => {}
+      )
+      return write
+    }
+  })
+}
diff --git a/src/main/runtime/runtime-file-commands-search-runtime-files.ts b/src/main/runtime/runtime-file-commands-search-runtime-files.ts
index fd79941c1aea..5a192c4e50d4 100644
--- a/src/main/runtime/runtime-file-commands-search-runtime-files.ts
+++ b/src/main/runtime/runtime-file-commands-search-runtime-files.ts
@@ -13,6 +13,7 @@ import {
   listMarkdownDocuments,
   markdownDocumentsFromRelativePaths
 } from '../ipc/markdown-documents'
+import { getLocalGitOptionsForRegisteredWorktree } from '../ipc/local-worktree-runtime-options'
 import {
   validatePathExistenceBatch,
   type PathExistenceResult
@@ -82,7 +83,14 @@ export class RuntimeFileCommandsWithSearchRuntimeFiles extends RuntimeFileComman
       const relativePaths = await provider.listFiles(target.worktree.path)
       return markdownDocumentsFromRelativePaths(target.worktree.path, relativePaths)
     }
-    return listMarkdownDocuments(target.worktree.path)
+    return listMarkdownDocuments(
+      target.worktree.path,
+      getLocalGitOptionsForRegisteredWorktree(
+        this.host.requireStore(),
+        target.worktree.path,
+        target.worktree.path
+      )
+    )
   }
 
   async pathsExistRuntimeFiles(
diff --git a/src/main/runtime/runtime-file-commands-write-file-explorer-file.ts b/src/main/runtime/runtime-file-commands-write-file-explorer-file.ts
index 3336a86e7d77..92a356f987aa 100644
--- a/src/main/runtime/runtime-file-commands-write-file-explorer-file.ts
+++ b/src/main/runtime/runtime-file-commands-write-file-explorer-file.ts
@@ -64,12 +64,12 @@ export class RuntimeFileCommandsWithWriteFileExplorerFile extends RuntimeFileCom
       expectedSshConnectionGeneration
     )
     const provider = requireRuntimeFileProvider(target)
-    const content = Buffer.from(contentBase64, 'base64')
     if (provider) {
       await provider.writeFileBase64(target.path, contentBase64)
       return { ok: true }
     }
 
+    const content = Buffer.from(contentBase64, 'base64')
     const filePath = await resolveAuthorizedPath(target.path, this.host.requireStore())
     await mkdir(dirname(filePath), { recursive: true })
     await writeFile(filePath, content, { flag: 'wx' })
@@ -93,12 +93,12 @@ export class RuntimeFileCommandsWithWriteFileExplorerFile extends RuntimeFileCom
       expectedSshConnectionGeneration
     )
     const provider = requireRuntimeFileProvider(target)
-    const content = Buffer.from(contentBase64, 'base64')
     if (provider) {
       await provider.writeFileBase64Chunk(target.path, contentBase64, append)
       return { ok: true }
     }
 
+    const content = Buffer.from(contentBase64, 'base64')
     const filePath = await resolveAuthorizedPath(target.path, this.host.requireStore())
     await mkdir(dirname(filePath), { recursive: true })
     await writeFile(filePath, content, { flag: append ? 'a' : 'wx' })
diff --git a/src/main/runtime/runtime-file-target-execution-host.test.ts b/src/main/runtime/runtime-file-target-execution-host.test.ts
index d9770b182df1..40729da528cc 100644
--- a/src/main/runtime/runtime-file-target-execution-host.test.ts
+++ b/src/main/runtime/runtime-file-target-execution-host.test.ts
@@ -141,7 +141,7 @@ describe('runtime file target execution host', () => {
     await runtime.listRuntimeMarkdownDocuments(`id:${WORKTREE_ID}`)
 
     expect(m4air.listFiles).not.toHaveBeenCalled()
-    expect(mocks.listMarkdownDocuments).toHaveBeenCalledWith(REMOTE_PATH)
+    expect(mocks.listMarkdownDocuments).toHaveBeenCalledWith(REMOTE_PATH, {})
   })
 
   // A `runtime:` row's `connectionId` names a target in the *server's* namespace. Reading it here
diff --git a/src/main/runtime/runtime-file-upload-decode.test.ts b/src/main/runtime/runtime-file-upload-decode.test.ts
new file mode 100644
index 000000000000..a07ce9ded3e5
--- /dev/null
+++ b/src/main/runtime/runtime-file-upload-decode.test.ts
@@ -0,0 +1,236 @@
+import { dirname, join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { RuntimeFileCommandHost } from './runtime-file-command-host'
+import type { SshChannelMultiplexer } from '../ssh/ssh-channel-multiplexer'
+
+const mocks = vi.hoisted(() => ({
+  resolvePath: vi.fn(),
+  expectation: vi.fn(),
+  provider: vi.fn(),
+  authorize: vi.fn(),
+  requireStore: vi.fn(),
+  mkdir: vi.fn(),
+  writeFile: vi.fn(),
+  writeBuffer: vi.fn()
+}))
+
+vi.mock('./runtime-file-commands-read-file-explorer-preview', () => ({
+  RuntimeFileCommandsWithReadFileExplorerPreview: class {
+    resolveFileExplorerPath = mocks.resolvePath
+    host = { requireStore: mocks.requireStore }
+  }
+}))
+vi.mock('./runtime-file-commands-mobile-file-list-limit', () => ({
+  assertRuntimeFileMutationExpectation: mocks.expectation
+}))
+vi.mock('./runtime-file-command-target', () => ({ requireRuntimeFileProvider: mocks.provider }))
+vi.mock('../ipc/filesystem-auth', () => ({ resolveAuthorizedPath: mocks.authorize }))
+vi.mock('node:fs/promises', async (importOriginal) => ({
+  ...(await importOriginal()),
+  mkdir: mocks.mkdir,
+  writeFile: mocks.writeFile
+}))
+
+import { RuntimeFileCommandsWithWriteFileExplorerFile } from './runtime-file-commands-write-file-explorer-file'
+import { SshFilesystemProvider } from '../providers/ssh-filesystem-provider'
+
+function unexpectedHostCall(): never {
+  throw new Error('Unexpected access beyond the isolated file command')
+}
+
+const host: RuntimeFileCommandHost = {
+  getRuntimeId: unexpectedHostCall,
+  requireStore: unexpectedHostCall,
+  resolveWorktreeSelector: unexpectedHostCall,
+  resolveRuntimeFileTarget: unexpectedHostCall,
+  resolveRuntimeGitTarget: unexpectedHostCall,
+  openFile: unexpectedHostCall,
+  openDiff: unexpectedHostCall
+}
+const commands = new RuntimeFileCommandsWithWriteFileExplorerFile(host)
+const destination = join('workspace', 'uploads', 'binary.dat')
+const target = { executionHostId: 'local', path: destination }
+let remote = false
+
+function sshProvider(): SshFilesystemProvider {
+  remote = true
+  mocks.resolvePath.mockResolvedValue({ ...target, executionHostId: 'ssh:target' })
+  const mux = { onNotification: vi.fn(() => () => {}), request: unexpectedHostCall }
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: construction only subscribes; writes use the injected raw transfer and any mux request fails.
+  return new SshFilesystemProvider('target', mux as unknown as SshChannelMultiplexer, undefined, {
+    writeBuffer: mocks.writeBuffer
+  })
+}
+
+beforeEach(() => {
+  vi.resetAllMocks()
+  remote = false
+  mocks.resolvePath.mockResolvedValue(target)
+  mocks.provider.mockReturnValue(null)
+  mocks.authorize.mockResolvedValue(destination)
+  mocks.requireStore.mockReturnValue({})
+  mocks.mkdir.mockResolvedValue(undefined)
+  mocks.writeFile.mockResolvedValue(undefined)
+  mocks.writeBuffer.mockResolvedValue(undefined)
+})
+afterEach(() => vi.restoreAllMocks())
+
+describe.each(['whole', 'first', 'append'] as const)('runtime %s base64 write', (mode) => {
+  const write = (base64: string) => {
+    if (remote) {
+      return mode === 'whole'
+        ? commands.writeFileExplorerFileBase64(
+            'folder:workspace',
+            'uploads/binary.dat',
+            base64,
+            7,
+            'target',
+            'ssh:target'
+          )
+        : commands.writeFileExplorerFileBase64Chunk(
+            'folder:workspace',
+            'uploads/binary.dat',
+            base64,
+            mode === 'append',
+            7,
+            'target',
+            'ssh:target'
+          )
+    }
+    return mode === 'whole'
+      ? commands.writeFileExplorerFileBase64(
+          'folder:workspace',
+          'uploads/binary.dat',
+          base64,
+          undefined,
+          undefined,
+          'local'
+        )
+      : commands.writeFileExplorerFileBase64Chunk(
+          'folder:workspace',
+          'uploads/binary.dat',
+          base64,
+          mode === 'append',
+          undefined,
+          undefined,
+          'local'
+        )
+  }
+
+  it.each(['', 'AAH+/w==', 'AA', '%%%'])(
+    'preserves local decoding and flags for %j',
+    async (base64) => {
+      const expected = Buffer.from(base64, 'base64')
+      const decode = vi.spyOn(Buffer, 'from')
+      await expect(write(base64)).resolves.toEqual({ ok: true })
+      expect(
+        decode.mock.calls.filter((args) => args.at(0) === base64 && args.at(1) === 'base64')
+      ).toHaveLength(1)
+      expect(mocks.expectation).toHaveBeenCalledWith('local', 'local', undefined, undefined)
+      expect(mocks.provider).toHaveBeenCalledWith(target)
+      expect(mocks.authorize).toHaveBeenCalledWith(
+        destination,
+        mocks.requireStore.mock.results[0].value
+      )
+      expect(mocks.mkdir).toHaveBeenCalledWith(dirname(destination), { recursive: true })
+      expect(mocks.writeFile).toHaveBeenCalledWith(destination, expected, {
+        flag: mode === 'append' ? 'a' : 'wx'
+      })
+      expect(mocks.writeBuffer).not.toHaveBeenCalled()
+      expect(mocks.expectation.mock.invocationCallOrder[0]).toBeLessThan(
+        mocks.provider.mock.invocationCallOrder[0]
+      )
+      expect(decode.mock.invocationCallOrder[0]).toBeLessThan(
+        mocks.authorize.mock.invocationCallOrder[0]
+      )
+    }
+  )
+
+  it.each(['', 'AAH+/w==', 'AA', '%%%'])(
+    'decodes once through the SSH provider for %j',
+    async (base64) => {
+      const expected = Buffer.from(base64, 'base64')
+      const provider = sshProvider()
+      mocks.provider.mockReturnValue(provider)
+      const decode = vi.spyOn(Buffer, 'from')
+      await expect(write(base64)).resolves.toEqual({ ok: true })
+      expect(
+        decode.mock.calls.filter((args) => args.at(0) === base64 && args.at(1) === 'base64')
+      ).toHaveLength(1)
+      expect(mocks.expectation).toHaveBeenCalledWith('ssh:target', 'ssh:target', 'target', 7)
+      expect(mocks.writeBuffer).toHaveBeenCalledWith(destination, expected, {
+        append: mode === 'append',
+        exclusive: mode !== 'append'
+      })
+      expect(mocks.authorize).not.toHaveBeenCalled()
+      expect(mocks.mkdir).not.toHaveBeenCalled()
+      expect(mocks.writeFile).not.toHaveBeenCalled()
+      provider.dispose()
+    }
+  )
+
+  it('avoids a second decoded slice for a full upload chunk', async () => {
+    mocks.provider.mockReturnValue(sshProvider())
+    const bytes = Buffer.alloc(384 * 1024, 0xb7)
+    const base64 = bytes.toString('base64')
+    const decode = vi.spyOn(Buffer, 'from')
+    await write(base64)
+    expect(
+      decode.mock.calls.filter((args) => args.at(0) === base64 && args.at(1) === 'base64')
+    ).toHaveLength(1)
+    expect(mocks.writeBuffer.mock.calls[0][1]).toEqual(bytes)
+  })
+
+  it.each(['resolve', 'expectation', 'provider'] as const)(
+    'preserves %s failure before decoding or writes',
+    async (stage) => {
+      const failure = new Error(stage)
+      if (stage === 'resolve') {
+        mocks.resolvePath.mockRejectedValue(failure)
+      } else if (stage === 'expectation') {
+        mocks.expectation.mockImplementation(() => {
+          throw failure
+        })
+      } else {
+        mocks.provider.mockImplementation(() => {
+          throw failure
+        })
+      }
+      const decode = vi.spyOn(Buffer, 'from')
+      await expect(write('AA==')).rejects.toBe(failure)
+      expect(decode).not.toHaveBeenCalled()
+      expect(mocks.authorize).not.toHaveBeenCalled()
+      expect(mocks.writeFile).not.toHaveBeenCalled()
+      expect(mocks.writeBuffer).not.toHaveBeenCalled()
+      if (stage === 'resolve') {
+        expect(mocks.expectation).not.toHaveBeenCalled()
+      }
+      if (stage !== 'provider') {
+        expect(mocks.provider).not.toHaveBeenCalled()
+      }
+    }
+  )
+
+  it.each(['authorize', 'mkdir', 'writeFile'] as const)(
+    'preserves local %s failure without a remote fallback',
+    async (stage) => {
+      const failure = new Error(stage)
+      mocks[stage].mockRejectedValue(failure)
+      await expect(write('AA==')).rejects.toBe(failure)
+      expect(mocks.writeBuffer).not.toHaveBeenCalled()
+      if (stage !== 'writeFile') {
+        expect(mocks.writeFile).not.toHaveBeenCalled()
+      }
+    }
+  )
+
+  it('propagates SSH sink errors without a local fallback', async () => {
+    mocks.provider.mockReturnValue(sshProvider())
+    const failure = new Error('SSH sink failed')
+    mocks.writeBuffer.mockRejectedValue(failure)
+    await expect(write('AA==')).rejects.toBe(failure)
+    expect(mocks.authorize).not.toHaveBeenCalled()
+    expect(mocks.mkdir).not.toHaveBeenCalled()
+    expect(mocks.writeFile).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/main/runtime/runtime-git-generation-admission.test.ts b/src/main/runtime/runtime-git-generation-admission.test.ts
index 6631930082da..8e8391c10f3f 100644
--- a/src/main/runtime/runtime-git-generation-admission.test.ts
+++ b/src/main/runtime/runtime-git-generation-admission.test.ts
@@ -1,3 +1,4 @@
+import { setImmediate as nextTurn } from 'node:timers/promises'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import type { GlobalSettings } from '../../shared/global-settings-types'
 import type { RuntimeGitCommandHost, RuntimeGitTarget } from './runtime-git-command-target'
@@ -14,13 +15,19 @@ const mocks = vi.hoisted(() => ({
   resolveHostedReviewBodyForGeneration: vi.fn()
 }))
 
+const linkedLookup = vi.hoisted(() => ({ run: (): Promise<null> => Promise.resolve(null) }))
+
 vi.mock('../git/status', () => ({ getStagedCommitContext: mocks.getStagedCommitContext }))
 vi.mock('../git/runner', () => ({ gitExecFileAsync: mocks.gitExecFileAsync }))
 vi.mock('../text-generation/pull-request-context', () => ({
   getPullRequestDraftContext: mocks.getPullRequestDraftContext
 }))
 vi.mock('../source-control/pull-request-linked-issue', () => ({
-  loadPullRequestLinkedIssue: mocks.loadPullRequestLinkedIssue
+  loadPullRequestLinkedIssue: (...args: unknown[]) => {
+    mocks.loadPullRequestLinkedIssue(...args)
+    // A mock return observer would handle the rejection being tested.
+    return linkedLookup.run()
+  }
 }))
 vi.mock('../providers/ssh-git-dispatch', () => ({
   getSshGitProvider: mocks.getSshGitProvider,
@@ -77,7 +84,7 @@ describe('RuntimeGitGenerationCommands admission', () => {
   beforeEach(() => {
     vi.clearAllMocks()
     mocks.gitExecFileAsync.mockResolvedValue({ stdout: '', stderr: '' })
-    mocks.loadPullRequestLinkedIssue.mockResolvedValue(null)
+    linkedLookup.run = () => Promise.resolve(null)
     mocks.resolveHostedReviewBodyForGeneration.mockImplementation(async ({ body }) => body)
     mocks.prepareLocalCommitMessageAgentEnv.mockResolvedValue({ ok: true, env: {} })
     mocks.generateCommitMessageFromContext.mockResolvedValue({ success: true, message: 'feat' })
@@ -167,4 +174,103 @@ describe('RuntimeGitGenerationCommands admission', () => {
       expect.objectContaining({ connectionId: 'conn-1', localGitOptions: {} })
     )
   })
+
+  describe.each(['local', 'SSH'])('linked-issue lifetime on %s', (host) => {
+    function commands(): RuntimeGitGenerationCommands {
+      mocks.getSshGitProvider.mockReturnValue({ exec: vi.fn(), executeCommitMessagePlan: vi.fn() })
+      return makeCommands(
+        makeTarget('/repo', {
+          executionHostId: host === 'SSH' ? 'ssh:conn-1' : 'local'
+        })
+      )
+    }
+
+    const input = { base: 'main', title: '', body: '', draft: false, provider: 'gitlab' as const }
+
+    it.each(['no changes', 'context error', 'template error'])(
+      'observes a late lookup rejection after %s',
+      async (outcome) => {
+        const issue = Promise.withResolvers<null>()
+        linkedLookup.run = () => issue.promise
+        const preparationError = new Error('preparation failed')
+        mocks.getPullRequestDraftContext.mockResolvedValue(pullRequestContext)
+        if (outcome === 'no changes') {
+          mocks.getPullRequestDraftContext.mockResolvedValue(null)
+        } else if (outcome === 'context error') {
+          mocks.getPullRequestDraftContext.mockRejectedValue(preparationError)
+        } else {
+          mocks.resolveHostedReviewBodyForGeneration.mockRejectedValue(preparationError)
+        }
+        const unhandled = vi.fn()
+        process.on('unhandledRejection', unhandled)
+        try {
+          await expect(
+            commands().generateRuntimePullRequestFields('id:wt-1', input, settingsOverride)
+          ).resolves.toEqual({
+            success: false,
+            error:
+              outcome === 'no changes'
+                ? 'No branch changes to summarize.'
+                : preparationError.message
+          })
+          expect(mocks.loadPullRequestLinkedIssue).toHaveBeenCalledOnce()
+          issue.reject(new Error('Timed out waiting for a GitLab operation slot.'))
+          await nextTurn()
+          expect(unhandled).not.toHaveBeenCalled()
+          expect(mocks.generatePullRequestFieldsFromContext).not.toHaveBeenCalled()
+        } finally {
+          issue.resolve(null)
+          void issue.promise.catch(() => undefined)
+          process.off('unhandledRejection', unhandled)
+        }
+      }
+    )
+
+    it('observes rejection during preparation and preserves the later caller error', async () => {
+      const issue = Promise.withResolvers<null>()
+      const preparation = Promise.withResolvers<typeof pullRequestContext>()
+      const failure = new Error('lookup admission failed')
+      linkedLookup.run = () => issue.promise
+      mocks.getPullRequestDraftContext.mockReturnValue(preparation.promise)
+      const unhandled = vi.fn()
+      process.on('unhandledRejection', unhandled)
+      const result = commands()
+        .generateRuntimePullRequestFields('id:wt-1', input, settingsOverride)
+        .catch((error: unknown) => error)
+      try {
+        await nextTurn()
+        expect(mocks.getPullRequestDraftContext).toHaveBeenCalledOnce()
+        issue.reject(failure)
+        await nextTurn()
+        expect(unhandled).not.toHaveBeenCalled()
+        preparation.resolve(pullRequestContext)
+        expect(await result).toBe(failure)
+        expect(mocks.generatePullRequestFieldsFromContext).not.toHaveBeenCalled()
+      } finally {
+        issue.resolve(null)
+        preparation.resolve(pullRequestContext)
+        await result
+        process.off('unhandledRejection', unhandled)
+      }
+    })
+
+    it('still rejects the caller after successful preparation when the lookup fails', async () => {
+      const issue = Promise.withResolvers<null>()
+      const failure = new Error('lookup failed')
+      linkedLookup.run = () => issue.promise
+      mocks.getPullRequestDraftContext.mockResolvedValue(pullRequestContext)
+      const result = commands()
+        .generateRuntimePullRequestFields('id:wt-1', input, settingsOverride)
+        .catch((error: unknown) => error)
+      try {
+        await nextTurn()
+        issue.reject(failure)
+        expect(await result).toBe(failure)
+        expect(mocks.generatePullRequestFieldsFromContext).not.toHaveBeenCalled()
+      } finally {
+        issue.resolve(null)
+        await result
+      }
+    })
+  })
 })
diff --git a/src/main/runtime/runtime-git-generation-commands.ts b/src/main/runtime/runtime-git-generation-commands.ts
index bea10b2ef7d5..988e2ee096fe 100644
--- a/src/main/runtime/runtime-git-generation-commands.ts
+++ b/src/main/runtime/runtime-git-generation-commands.ts
@@ -182,6 +182,7 @@ export class RuntimeGitGenerationCommands {
               admissionTier: 'interactive'
             }
     })
+    void linkedIssueDetailsPromise.catch(() => undefined)
     let context: Awaited<ReturnType<typeof getPullRequestDraftContext>>
     try {
       const currentBody = await resolveHostedReviewBodyForGeneration({
diff --git a/src/main/runtime/runtime-legacy-worker-terminal-recovery-persistence.ts b/src/main/runtime/runtime-legacy-worker-terminal-recovery-persistence.ts
index df7945677372..345e2c08377a 100644
--- a/src/main/runtime/runtime-legacy-worker-terminal-recovery-persistence.ts
+++ b/src/main/runtime/runtime-legacy-worker-terminal-recovery-persistence.ts
@@ -12,7 +12,8 @@ import type {
   LegacyWorkerRecoveryResolution
 } from './runtime-legacy-worker-terminal-recovery-types'
 import { runtimeWorktreeIdsEqual } from './runtime-worktree-path-identity'
-import { rollbackWorkspaceSessionAfterFailedAsyncWrite } from './workspace-session-failed-write-rollback'
+import { cloneWorkspaceSessionState } from '../persistence/restoring-sessions/session-owner-fields'
+import { rollbackWorkspaceSessionAfterFailedAsyncWrite } from '../persistence/restoring-sessions/workspace-session-write-rollback'
 
 export class RuntimeLegacyWorkerTerminalRecoveryPersistence {
   constructor(
@@ -29,66 +30,68 @@ export class RuntimeLegacyWorkerTerminalRecoveryPersistence {
     resolutions: readonly LegacyWorkerRecoveryResolution[]
   ): Promise<ReadonlySet<string>> {
     const store = this.getStore()
-    if (
-      !store?.getWorkspaceSession ||
-      !store.setWorkspaceSession ||
-      (!store.flushPendingOrThrowAsync && !store.flushOrThrow)
-    ) {
+    if (!store?.getWorkspaceSession || !store.setWorkspaceSession || !store.runDurableMutation) {
       return new Set()
     }
+    const getWorkspaceSession = store.getWorkspaceSession.bind(store)
+    const setWorkspaceSession = store.setWorkspaceSession.bind(store)
     const originals = new Map<ExecutionHostId, WorkspaceSessionState>()
     const staged = new Map<ExecutionHostId, WorkspaceSessionState>()
     const dispatchIds = new Set<string>()
     try {
-      for (const { candidate, resolution } of resolutions) {
-        const hostId = this.getHostId(candidate.worktreeId)
-        const session = hostId ? store.getWorkspaceSession(hostId) : null
-        if (!hostId || !session) {
-          continue
+      return await store.runDurableMutation(() => {
+        for (const { candidate, resolution } of resolutions) {
+          const hostId = this.getHostId(candidate.worktreeId)
+          const session = hostId ? getWorkspaceSession(hostId) : null
+          if (!hostId || !session) {
+            continue
+          }
+          originals.set(hostId, originals.get(hostId) ?? cloneWorkspaceSessionState(session))
+          let next =
+            resolution === 'exited'
+              ? retireTerminalSurfaceFromPersistence(session, {
+                  worktreeId: candidate.worktreeId,
+                  parentTabId: candidate.tabId,
+                  leafId: candidate.leafId,
+                  ptyId: candidate.ptyId,
+                  incarnationId: candidate.incarnationId
+                })
+              : session
+          const record = next.sleepingAgentSessionsByPaneKey?.[candidate.paneKey]
+          if (record && runtimeWorktreeIdsEqual(record.worktreeId, candidate.worktreeId)) {
+            const sleeping = { ...next.sleepingAgentSessionsByPaneKey }
+            delete sleeping[candidate.paneKey]
+            next = { ...next, sleepingAgentSessionsByPaneKey: sleeping }
+          }
+          if (next !== session) {
+            setWorkspaceSession(next, hostId)
+          }
+          staged.set(hostId, cloneWorkspaceSessionState(getWorkspaceSession(hostId)))
+          dispatchIds.add(candidate.dispatchId)
         }
-        originals.set(hostId, originals.get(hostId) ?? session)
-        let next =
-          resolution === 'exited'
-            ? retireTerminalSurfaceFromPersistence(session, {
-                worktreeId: candidate.worktreeId,
-                parentTabId: candidate.tabId,
-                leafId: candidate.leafId,
-                ptyId: candidate.ptyId,
-                incarnationId: candidate.incarnationId
-              })
-            : session
-        const record = next.sleepingAgentSessionsByPaneKey?.[candidate.paneKey]
-        if (record && runtimeWorktreeIdsEqual(record.worktreeId, candidate.worktreeId)) {
-          const sleeping = { ...next.sleepingAgentSessionsByPaneKey }
-          delete sleeping[candidate.paneKey]
-          next = { ...next, sleepingAgentSessionsByPaneKey: sleeping }
+        return {
+          value: dispatchIds,
+          persist: dispatchIds.size > 0,
+          rollback: () => {
+            for (const [hostId, original] of originals) {
+              const stagedSession = staged.get(hostId)
+              const current = getWorkspaceSession(hostId)
+              if (!stagedSession || !current) {
+                continue
+              }
+              const rolledBack = rollbackWorkspaceSessionAfterFailedAsyncWrite(
+                original,
+                stagedSession,
+                current
+              )
+              if (rolledBack !== current) {
+                setWorkspaceSession(rolledBack, hostId)
+              }
+            }
+          }
         }
-        if (next !== session) {
-          store.setWorkspaceSession(next, hostId)
-        }
-        staged.set(hostId, store.getWorkspaceSession(hostId))
-        dispatchIds.add(candidate.dispatchId)
-      }
-      if (dispatchIds.size > 0) {
-        await this.flush(store)
-      }
-      return dispatchIds
+      })
     } catch (error) {
-      for (const [hostId, original] of originals) {
-        const stagedSession = staged.get(hostId)
-        const current = store.getWorkspaceSession(hostId)
-        if (!stagedSession || !current) {
-          continue
-        }
-        const rolledBack = rollbackWorkspaceSessionAfterFailedAsyncWrite(
-          original,
-          stagedSession,
-          current
-        )
-        if (rolledBack !== current) {
-          store.setWorkspaceSession(rolledBack, hostId)
-        }
-      }
       console.warn('[orchestration] failed to persist legacy worker recovery batch', {
         dispatchIds: [...dispatchIds],
         error
@@ -124,16 +127,4 @@ export class RuntimeLegacyWorkerTerminalRecoveryPersistence {
       return null
     }
   }
-
-  private async flush(store: RuntimeStore): Promise<void> {
-    if (store.flushPendingOrThrowAsync) {
-      await store.flushPendingOrThrowAsync({ drainToStableGeneration: false })
-      return
-    }
-    if (store.flushOrThrow) {
-      store.flushOrThrow()
-      return
-    }
-    throw new Error('workspace_session_persistence_unavailable')
-  }
 }
diff --git a/src/main/runtime/runtime-local-git-worktree-create.ts b/src/main/runtime/runtime-local-git-worktree-create.ts
index 36731ac3abb7..ccefaa822558 100644
--- a/src/main/runtime/runtime-local-git-worktree-create.ts
+++ b/src/main/runtime/runtime-local-git-worktree-create.ts
@@ -152,6 +152,9 @@ export async function createRuntimeLocalGitWorktree(args: {
           })
         : null
     // This path has no create-span recorder, so the miss reason is only observable on the IPC path.
+    if (preparedAttempt?.status === 'miss' && preparedAttempt.rearm) {
+      args.rearm.fire = preparedAttempt.rearm
+    }
     if (preparedAttempt?.status === 'hit') {
       addResult = preparedAttempt.result
       // Deferred, not fired: re-arming is a full `reset --hard`, and the caller still has
diff --git a/src/main/runtime/runtime-local-worktree-create.test.ts b/src/main/runtime/runtime-local-worktree-create.test.ts
index 4ad713111f5c..c673da996401 100644
--- a/src/main/runtime/runtime-local-worktree-create.test.ts
+++ b/src/main/runtime/runtime-local-worktree-create.test.ts
@@ -1,4 +1,5 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { resolve } from 'node:path'
 import type { Store } from '../persistence'
 import type { WorktreeMeta } from '../../shared/worktree/meta-types'
 import type { RuntimeManagedWorktreeCreateArgs } from './runtime-managed-worktree-create-types'
@@ -32,7 +33,7 @@ const mocks = vi.hoisted(() => ({
   resolveInclude: vi.fn<() => Promise<string[]>>(),
   copyPaths: vi.fn<() => Promise<string[]>>(),
   created: {
-    path: '/worktrees/app',
+    path: '',
     head: 'abc123',
     branch: 'app',
     isBare: false,
@@ -82,6 +83,8 @@ vi.mock('../ipc/worktree-symlinks', () => ({
 import { createRuntimeLocalManagedWorktree } from './runtime-local-worktree-create'
 import type { PreparationRearmHolder } from '../worktree-create-preparation'
 
+const worktreePath = resolve('/worktrees', 'app')
+
 function createWorktree(
   request: Partial<RuntimeManagedWorktreeCreateArgs> = {},
   rearm: PreparationRearmHolder = { fire: () => {} }
@@ -112,6 +115,7 @@ function createWorktree(
 
 beforeEach(() => {
   vi.resetAllMocks()
+  mocks.created.path = worktreePath
   mocks.routing.mockReturnValue({})
   mocks.defaultBase.mockImplementation(async () => {
     expect(resolveGitAdmissionTier()).toBe('interactive')
@@ -142,6 +146,36 @@ beforeEach(() => {
 })
 
 describe('runtime prepared-worktree replenishment', () => {
+  it('keeps a failed claim reserved through the normal-add fallback', async () => {
+    mocks.consume.mockResolvedValue({
+      status: 'miss',
+      reason: 'finalize_failed',
+      rearm: mocks.rearm
+    })
+    const rearm: PreparationRearmHolder = { fire: () => {} }
+    await createWorktree({}, rearm)
+
+    expect(mocks.add).toHaveBeenCalledOnce()
+    expect(mocks.rearm).not.toHaveBeenCalled()
+    rearm.fire()
+    expect(mocks.rearm).toHaveBeenCalledOnce()
+  })
+
+  it('keeps the failed claim release available when the fallback also fails', async () => {
+    mocks.consume.mockResolvedValue({
+      status: 'miss',
+      reason: 'prepare_failed',
+      rearm: mocks.rearm
+    })
+    mocks.add.mockRejectedValue(new Error('normal add failed'))
+    const rearm: PreparationRearmHolder = { fire: () => {} }
+    await expect(createWorktree({}, rearm)).rejects.toThrow('normal add failed')
+
+    expect(mocks.rearm).not.toHaveBeenCalled()
+    rearm.fire()
+    expect(mocks.rearm).toHaveBeenCalledOnce()
+  })
+
   it('leaves the re-arm holder armed but unfired once probes and include copies finish', async () => {
     const rearm: PreparationRearmHolder = { fire: () => {} }
     let finishProbe!: (paths: string[]) => void
@@ -207,8 +241,8 @@ describe('runtime create Git priority', () => {
       expect(mocks.remoteBase).toHaveBeenCalledWith('/repo', 'main', options)
       expect(mocks.hasBase).toHaveBeenCalledWith('/repo', 'main', options)
       expect(mocks.consume).toHaveBeenCalledWith(expect.objectContaining({ options }))
-      expect(mocks.pushTarget).toHaveBeenCalledWith('/worktrees/app', 'app', target, options)
-      expect(mocks.listing).toHaveBeenCalledWith('/repo', '/worktrees/app', 'app', options)
+      expect(mocks.pushTarget).toHaveBeenCalledWith(worktreePath, 'app', target, options)
+      expect(mocks.listing).toHaveBeenCalledWith('/repo', worktreePath, 'app', options)
       expect(mocks.resolveShared).toHaveBeenCalledWith('/repo', options)
       expect(mocks.resolveInclude).toHaveBeenCalledWith('/repo', options)
     }
@@ -240,7 +274,7 @@ describe('runtime create Git priority', () => {
       }
     )
     try {
-      await expect(createWorktree()).resolves.toHaveProperty('worktreePath', '/worktrees/app')
+      await expect(createWorktree()).resolves.toHaveProperty('worktreePath', worktreePath)
       expect(mocks.add).toHaveBeenCalledOnce()
     } finally {
       blocker.release()
@@ -262,7 +296,7 @@ describe('runtime create Git priority', () => {
     expect(mocks.refresh).toHaveBeenCalledWith('/repo', base, options)
     expect(mocks.addSparse).toHaveBeenCalledWith(
       '/repo',
-      '/worktrees/app',
+      worktreePath,
       'app',
       ['src'],
       'origin/main',
diff --git a/src/main/runtime/runtime-notifier-contract.ts b/src/main/runtime/runtime-notifier-contract.ts
index 9cdc365e1ba9..fa87d839cd5c 100644
--- a/src/main/runtime/runtime-notifier-contract.ts
+++ b/src/main/runtime/runtime-notifier-contract.ts
@@ -117,7 +117,10 @@ export type RuntimeNotifier = {
     baseVersion: string,
     content: string
   ): Promise<RuntimeMarkdownSaveTabResult>
-  closeTerminal(tabId: string, paneRuntimeId?: number): void
+  /** Closes the whole tab. */
+  closeTerminal(tabId: string): void
+  /** Drops one split pane main already closed; never closes its tab. */
+  closeTerminalPane?(tabId: string, leafId: string): void
   closeTerminalTab?(
     tabId: string,
     options?: { localPtyTeardownOwnedExternally?: boolean; force?: boolean }
diff --git a/src/main/runtime/runtime-pty-controller-contract.ts b/src/main/runtime/runtime-pty-controller-contract.ts
index bb23548ae6f5..7b540a05e9a5 100644
--- a/src/main/runtime/runtime-pty-controller-contract.ts
+++ b/src/main/runtime/runtime-pty-controller-contract.ts
@@ -12,6 +12,7 @@ import type { ExecutionHostId } from '../../shared/execution-host'
 import type { PtyProviderBufferSnapshot, PtyProcessInfo, PtySpawnResult } from '../providers/types'
 import type { PtyProcessInspection } from '../providers/pty-process-inspection'
 import type { WriteSettlement } from '../../shared/pty-write-settlement'
+import type { TerminalInputKind } from '../../shared/terminal-input-kind'
 
 export type RuntimePtyController = {
   claimStablePaneCreate?(args: {
@@ -93,9 +94,13 @@ export type RuntimePtyController = {
     stablePaneOwner?: { handle: string; tabId: string; leafId: string }
     agentSessionEnsure?: AgentSessionClaimedSpawnResult
   }>
-  write(ptyId: string, data: string): boolean
+  write(ptyId: string, data: string, inputKind: TerminalInputKind): boolean
   /** Three-valued settlement; local providers settle synchronously. */
-  writeWithSettlement?(ptyId: string, data: string): WriteSettlement | Promise<WriteSettlement>
+  writeWithSettlement?(
+    ptyId: string,
+    data: string,
+    inputKind: TerminalInputKind
+  ): WriteSettlement | Promise<WriteSettlement>
   /** Attach-only adoption of a live local daemon session so its output streams
    *  to main without a renderer pane; never creates, resizes, or focuses.
    *  False on doubt (absent session, SSH-scoped id, non-daemon provider). */
@@ -106,7 +111,9 @@ export type RuntimePtyController = {
     ptyId: string,
     opts?: { keepHistory?: boolean; deadlineMs?: number }
   ): Promise<boolean>
-  markReversibleStops?(ptyIds: readonly string[]): () => void
+  /** Durably records a kill order for an explicit close's unconfirmed stop, replayed when its SSH
+   *  host reconnects. True only when an order was written; local PTYs have no later host to ask. */
+  recordUnconfirmedStop?(ptyId: string): boolean
   getCwd?(ptyId: string): Promise<string | null>
   getForegroundProcess(ptyId: string): Promise<string | null>
   inspectProcess?(
diff --git a/src/main/runtime/runtime-registered-local-worktree-removal.ts b/src/main/runtime/runtime-registered-local-worktree-removal.ts
index e6658b73ef2e..011d30207fe2 100644
--- a/src/main/runtime/runtime-registered-local-worktree-removal.ts
+++ b/src/main/runtime/runtime-registered-local-worktree-removal.ts
@@ -20,16 +20,9 @@ import {
   isOrphanCompatiblePreflightError,
   isOrphanedWorktreeError
 } from '../ipc/worktree-logic'
-import {
-  getLocalWorktreePathAccess,
-  removeLocalWorktreePath,
-  toLocalWorktreeRuntimePath
-} from '../local-worktree-filesystem'
+import { cleanupLocalOrphanedWorktreeDirectory } from '../local-orphaned-worktree-cleanup'
 import { recoverLocalWindowsWorktreeRemoval } from '../local-worktree-removal-recovery'
-import {
-  canSafelyRemoveOrphanedWorktreeDirectory,
-  findRegisteredDeletableWorktree
-} from '../worktree-removal-safety'
+import { findRegisteredDeletableWorktree } from '../worktree-removal-safety'
 import { CLIENT_REMOVAL_HOME } from '../worktree-removal-home-guard'
 import type { RuntimeStore } from './runtime-store-contract'
 import type { RuntimeWorktreeRemovalTarget } from './runtime-worktree-selection'
@@ -160,7 +153,12 @@ export async function removeRuntimeRegisteredLocalWorktree(args: {
         removalResult = recovered
         completed = true
       } else if (isOrphanedWorktreeError(error)) {
-        await cleanupOrphanedDirectory(repo, canonicalPath, localOptions, args.closeWatchers)
+        await cleanupLocalOrphanedWorktreeDirectory(
+          repo.path,
+          canonicalPath,
+          localOptions,
+          args.closeWatchers
+        )
         await gitExecFileAsync(['worktree', 'prune'], { cwd: repo.path, ...localOptions }).catch(
           () => {}
         )
@@ -190,29 +188,6 @@ export async function removeRuntimeRegisteredLocalWorktree(args: {
   }
 }
 
-async function cleanupOrphanedDirectory(
-  repo: Repo,
-  path: string,
-  options: LocalProjectWorktreeGitOptions,
-  closeWatchers: (path: string) => Promise<void>
-): Promise<void> {
-  const access = getLocalWorktreePathAccess(options)
-  if (
-    await canSafelyRemoveOrphanedWorktreeDirectory(
-      toLocalWorktreeRuntimePath(path, options),
-      toLocalWorktreeRuntimePath(repo.path, options),
-      CLIENT_REMOVAL_HOME,
-      access.statPath,
-      access.readPath
-    )
-  ) {
-    await closeWatchers(path)
-    await removeLocalWorktreePath(path, options).catch(() => {})
-  } else {
-    console.warn(`[worktrees] Refusing recursive cleanup for unproven worktree directory: ${path}`)
-  }
-}
-
 async function cleanupPushTarget(
   args: Parameters<typeof removeRuntimeRegisteredLocalWorktree>[0]
 ): Promise<void> {
diff --git a/src/main/runtime/runtime-repository-hooks-commands.ts b/src/main/runtime/runtime-repository-hooks-commands.ts
index f5518b8e59a5..334def348d51 100644
--- a/src/main/runtime/runtime-repository-hooks-commands.ts
+++ b/src/main/runtime/runtime-repository-hooks-commands.ts
@@ -1,3 +1,4 @@
+import { getStoredRepoSshConnectionId } from '../repo-execution-host'
 import { createHash } from 'node:crypto'
 import { readFile } from 'node:fs/promises'
 import type { Repo } from '../../shared/repo-types'
@@ -27,8 +28,9 @@ export class RuntimeRepositoryHooksCommands {
 
   async getRepoHooks(repoSelector: string) {
     const repo = await this.deps.resolveRepo(repoSelector)
-    if (repo.connectionId) {
-      const fsProvider = getSshFilesystemProvider(repo.connectionId)
+    const connectionId = getStoredRepoSshConnectionId(repo)
+    if (connectionId) {
+      const fsProvider = getSshFilesystemProvider(connectionId)
       if (!fsProvider) {
         return {
           hasHooksFile: false,
@@ -73,8 +75,9 @@ export class RuntimeRepositoryHooksCommands {
     if (isFolderRepo(repo)) {
       return { status: 'ok' as const, hasHooks: false, hooks: null, mayNeedUpdate: false }
     }
-    if (repo.connectionId) {
-      const fsProvider = getSshFilesystemProvider(repo.connectionId)
+    const connectionId = getStoredRepoSshConnectionId(repo)
+    if (connectionId) {
+      const fsProvider = getSshFilesystemProvider(connectionId)
       if (!fsProvider) {
         return { status: 'error' as const, hasHooks: false, hooks: null, mayNeedUpdate: false }
       }
@@ -115,8 +118,9 @@ export class RuntimeRepositoryHooksCommands {
     }
     return inspectSetupScriptImportCandidates(async (relativePath) => {
       const filePath = joinWorktreeRelativePath(repo.path, relativePath)
-      if (repo.connectionId) {
-        const fsProvider = getSshFilesystemProvider(repo.connectionId)
+      const connectionId = getStoredRepoSshConnectionId(repo)
+      if (connectionId) {
+        const fsProvider = getSshFilesystemProvider(connectionId)
         if (!fsProvider) {
           return null
         }
diff --git a/src/main/runtime/runtime-repository-issue-command.ts b/src/main/runtime/runtime-repository-issue-command.ts
index 84509b8b1597..730dbe69e9dd 100644
--- a/src/main/runtime/runtime-repository-issue-command.ts
+++ b/src/main/runtime/runtime-repository-issue-command.ts
@@ -1,3 +1,4 @@
+import { getStoredRepoSshConnectionId } from '../repo-execution-host'
 import type { GitRuntimeOptions } from '../git/git-runtime-options'
 import type { Repo } from '../../shared/repo-types'
 import { parseOrcaYaml } from '../hooks'
@@ -31,11 +32,12 @@ export class RuntimeRepositoryIssueCommand {
         source: 'none' as const
       }
     }
-    if (!repo.connectionId) {
+    const connectionId = getStoredRepoSshConnectionId(repo)
+    if (!connectionId) {
       return readIssueCommand(repo.path)
     }
     const issueCommandPath = joinWorktreeRelativePath(repo.path, '.orca/issue-command')
-    const fsProvider = getSshFilesystemProvider(repo.connectionId)
+    const fsProvider = getSshFilesystemProvider(connectionId)
     if (!fsProvider) {
       return {
         localContent: null,
@@ -66,12 +68,13 @@ export class RuntimeRepositoryIssueCommand {
     if (isFolderRepo(repo)) {
       return { ok: true }
     }
-    if (!repo.connectionId) {
+    const connectionId = getStoredRepoSshConnectionId(repo)
+    if (!connectionId) {
       await writeIssueCommand(repo.path, content, () => this.deps.getLocalGitArgs(repo)[0] ?? {})
       return { ok: true }
     }
     const issueCommandPath = joinWorktreeRelativePath(repo.path, '.orca/issue-command')
-    const fsProvider = getSshFilesystemProvider(repo.connectionId)
+    const fsProvider = getSshFilesystemProvider(connectionId)
     if (!fsProvider) {
       return { ok: true }
     }
@@ -85,7 +88,7 @@ export class RuntimeRepositoryIssueCommand {
       return { ok: true }
     }
     await fsProvider.createDir(joinWorktreeRelativePath(repo.path, '.orca'))
-    if (!(await isIssueCommandIgnoredByGit(repo.path, repo.connectionId))) {
+    if (!(await isIssueCommandIgnoredByGit(repo.path, connectionId))) {
       await ensureRemoteOrcaDirIgnored(fsProvider, repo.path)
     }
     await fsProvider.writeFile(issueCommandPath, `${trimmed}\n`)
diff --git a/src/main/runtime/runtime-rpc/runtime-rpc-mobile-method-allowlist.ts b/src/main/runtime/runtime-rpc/runtime-rpc-mobile-method-allowlist.ts
index ce67fb94aff7..a543a8da45d0 100644
--- a/src/main/runtime/runtime-rpc/runtime-rpc-mobile-method-allowlist.ts
+++ b/src/main/runtime/runtime-rpc/runtime-rpc-mobile-method-allowlist.ts
@@ -230,6 +230,8 @@ export const MOBILE_RPC_METHOD_ALLOWLIST = new Set([
   'agentSession.history',
   'agentSession.subscribe',
   'agentSession.unsubscribe',
+  // No-ops on a current host; kept until MIN_COMPATIBLE_RUNTIME_CLIENT_VERSION passes the
+  // mobile builds that still call them.
   'agentSession.hold',
   'agentSession.release',
   'nativeChat.readSession',
diff --git a/src/main/runtime/runtime-service-command-surface.ts b/src/main/runtime/runtime-service-command-surface.ts
index 27a5ebdbdf9d..82b3204da522 100644
--- a/src/main/runtime/runtime-service-command-surface.ts
+++ b/src/main/runtime/runtime-service-command-surface.ts
@@ -26,6 +26,7 @@ export type RuntimeServiceCommandSurface = {
   cleanupSubscriptionsForConnection: RuntimeSubscriptionRegistry['cleanupForConnection']
   cleanupSubscriptionIfOwnedByConnection: RuntimeSubscriptionRegistry['cleanupIfOwnedByConnection']
   getSubscriptionRegistrationVersion: RuntimeSubscriptionRegistry['getRegistrationVersion']
+  releaseSubscriptionByRequest: RuntimeSubscriptionRegistry['releaseByRequest']
   onNotificationDispatched: RuntimeMobileNotificationController['onDispatched']
   getMobileNotificationListenerCount: RuntimeMobileNotificationController['getListenerCount']
   dispatchMobileNotification: RuntimeMobileNotificationController['dispatch']
@@ -116,6 +117,7 @@ export function installRuntimeServiceCommandSurface(
     cleanupSubscriptionIfOwnedByConnection:
       subscriptions.cleanupIfOwnedByConnection.bind(subscriptions),
     getSubscriptionRegistrationVersion: subscriptions.getRegistrationVersion.bind(subscriptions),
+    releaseSubscriptionByRequest: subscriptions.releaseByRequest.bind(subscriptions),
     onNotificationDispatched: notifications.onDispatched.bind(notifications),
     getMobileNotificationListenerCount: notifications.getListenerCount.bind(notifications),
     dispatchMobileNotification: notifications.dispatch.bind(notifications),
diff --git a/src/main/runtime/runtime-store-contract.ts b/src/main/runtime/runtime-store-contract.ts
index 6c1436395f16..86af6d3e15f8 100644
--- a/src/main/runtime/runtime-store-contract.ts
+++ b/src/main/runtime/runtime-store-contract.ts
@@ -48,6 +48,7 @@ export type RuntimeStore = {
   getWorkspaceSession?: Store['getWorkspaceSession']
   getWorkspaceSessionHostIds?: Store['getWorkspaceSessionHostIds']
   setWorkspaceSession?: Store['setWorkspaceSession']
+  runDurableMutation?: Store['runDurableMutation']
   flushOrThrow?: Store['flushOrThrow']
   flushPendingOrThrowAsync?: Store['flushPendingOrThrowAsync']
   persistPtyBinding?: Store['persistPtyBinding']
diff --git a/src/main/runtime/runtime-subscription-registry.test.ts b/src/main/runtime/runtime-subscription-registry.test.ts
index 093b855d483d..0d3a3e3f4d8a 100644
--- a/src/main/runtime/runtime-subscription-registry.test.ts
+++ b/src/main/runtime/runtime-subscription-registry.test.ts
@@ -123,3 +123,106 @@ describe('subscription registration versions', () => {
     expect(cleanup).toHaveBeenCalledTimes(2)
   })
 })
+
+describe('request-addressed release', () => {
+  const requestAddresses = (registry: RuntimeSubscriptionRegistry): number =>
+    registry['subscriptionsByRequest'].size
+  // Never `cleanupAndWait` here: it would run the cleanup itself and hide a missed release.
+  const settle = (): Promise<void> => new Promise((resolve) => setTimeout(resolve, 0))
+
+  it('releases the registration a request created, and forgets the address', async () => {
+    const registry = new RuntimeSubscriptionRegistry()
+    const cleanup = vi.fn()
+    registry.registerOwned('terminal:slot', cleanup, 'conn-a', 'req-1')
+    expect(requestAddresses(registry)).toBe(1)
+
+    registry.releaseByRequest('conn-a', 'req-1')
+    await settle()
+
+    expect(cleanup).toHaveBeenCalledOnce()
+    expect(requestAddresses(registry)).toBe(0)
+  })
+
+  it('ignores the request a same-slot replacement superseded', async () => {
+    const registry = new RuntimeSubscriptionRegistry()
+    const replacement = vi.fn()
+    registry.registerOwned('terminal:slot', vi.fn(), 'conn-a', 'req-old')
+    registry.registerOwned('terminal:slot', replacement, 'conn-a', 'req-new')
+    expect(requestAddresses(registry)).toBe(1)
+
+    registry.releaseByRequest('conn-a', 'req-old')
+    await settle()
+    expect(replacement).not.toHaveBeenCalled()
+
+    registry.releaseByRequest('conn-a', 'req-new')
+    await settle()
+    expect(replacement).toHaveBeenCalledOnce()
+  })
+
+  it('does not grow across replace and release cycles', async () => {
+    const registry = new RuntimeSubscriptionRegistry()
+    const cleanup = vi.fn()
+    for (let i = 0; i < 50; i++) {
+      registry.registerOwned('terminal:slot', cleanup, 'conn-a', `req-${2 * i}`)
+      registry.registerOwned('terminal:slot', cleanup, 'conn-a', `req-${2 * i + 1}`)
+      expect(requestAddresses(registry)).toBe(1)
+      registry.releaseByRequest('conn-a', `req-${2 * i + 1}`)
+      await settle()
+    }
+    expect(cleanup).toHaveBeenCalledTimes(100)
+    expect(requestAddresses(registry)).toBe(0)
+  })
+
+  it('keeps the newer owner when a reused request id outlives the old release', async () => {
+    const registry = new RuntimeSubscriptionRegistry()
+    const gate = Promise.withResolvers<void>()
+    const newer = vi.fn()
+    // IPC aborts a subscription and reuses its id before the old teardown settles.
+    const old = registry.registerOwned('terminal:old', () => gate.promise, 'ipc', 'sub-1')
+    old.releaseIfCurrent()
+    registry.registerOwned('terminal:new', newer, 'ipc', 'sub-1')
+    gate.resolve()
+    await settle()
+
+    registry.releaseByRequest('ipc', 'sub-1')
+    await settle()
+    expect(newer).toHaveBeenCalledOnce()
+    expect(requestAddresses(registry)).toBe(0)
+  })
+
+  it('keeps the address of a registration whose cleanup failed, so a retry still reaches it', async () => {
+    const registry = new RuntimeSubscriptionRegistry()
+    const consoleError = vi.spyOn(console, 'error').mockImplementation(() => {})
+    const cleanup = vi.fn().mockRejectedValueOnce(new Error('teardown failed'))
+    registry.registerOwned('terminal:slot', cleanup, 'conn-a', 'req-1')
+
+    registry.releaseByRequest('conn-a', 'req-1')
+    await settle()
+    expect(cleanup).toHaveBeenCalledOnce()
+    expect(requestAddresses(registry)).toBe(1)
+
+    registry.releaseByRequest('conn-a', 'req-1')
+    await settle()
+    expect(cleanup).toHaveBeenCalledTimes(2)
+    expect(requestAddresses(registry)).toBe(0)
+    consoleError.mockRestore()
+  })
+
+  it('addresses nothing without both a connection and a request id', async () => {
+    const registry = new RuntimeSubscriptionRegistry()
+    const unaddressed = vi.fn()
+    const addressed = vi.fn()
+    registry.registerOwned('terminal:no-conn', unaddressed, undefined, 'req-1')
+    registry.registerOwned('terminal:no-req', vi.fn(), 'conn-a')
+    registry.registerOwned('terminal:addressed', addressed, 'conn-a', 'req-1')
+    expect(requestAddresses(registry)).toBe(1)
+
+    registry.releaseByRequest(undefined, 'req-1')
+    registry.releaseByRequest('conn-b', 'req-1')
+    await settle()
+
+    expect(unaddressed).not.toHaveBeenCalled()
+    expect(addressed).not.toHaveBeenCalled()
+    await registry.cleanupAndWait('terminal:addressed')
+  })
+})
diff --git a/src/main/runtime/runtime-subscription-registry.ts b/src/main/runtime/runtime-subscription-registry.ts
index 93e046196186..eaa41dba1aff 100644
--- a/src/main/runtime/runtime-subscription-registry.ts
+++ b/src/main/runtime/runtime-subscription-registry.ts
@@ -1,6 +1,15 @@
 type SubscriptionCleanup = () => void | Promise<void>
 
-type SubscriptionEntry = { cleanup: SubscriptionCleanup; version: number }
+type RequestAddress = { connectionId: string; requestId: string }
+
+const requestKey = ({ connectionId, requestId }: RequestAddress): string =>
+  JSON.stringify([connectionId, requestId])
+
+type SubscriptionEntry = {
+  cleanup: SubscriptionCleanup
+  version: number
+  request?: RequestAddress
+}
 
 export type SubscriptionRegistration = {
   releaseIfCurrent(): void
@@ -14,19 +23,35 @@ export class RuntimeSubscriptionRegistry {
   >()
   private readonly subscriptionsByConnection = new Map<string, Set<string>>()
   private readonly connectionBySubscription = new Map<string, string>()
+  private readonly subscriptionsByRequest = new Map<
+    string,
+    { subscriptionId: string; version: number }
+  >()
   private registrationVersion = 0
 
   getRegistrationVersion(): number {
     return this.registrationVersion
   }
 
-  register(subscriptionId: string, cleanup: SubscriptionCleanup, connectionId?: string): void {
+  register(
+    subscriptionId: string,
+    cleanup: SubscriptionCleanup,
+    connectionId?: string,
+    requestId?: string
+  ): void {
     const existing = this.cleanups.get(subscriptionId)
     if (existing) {
       this.removeConnectionIndex(subscriptionId)
+      this.removeRequestIndex(existing)
       this.cleanup(subscriptionId)
     }
-    this.cleanups.set(subscriptionId, { cleanup, version: ++this.registrationVersion })
+    const version = ++this.registrationVersion
+    const request = connectionId && requestId ? { connectionId, requestId } : undefined
+    this.cleanups.set(subscriptionId, { cleanup, version, request })
+    if (request) {
+      // Why: IPC reuses a request id after aborting its previous subscription, so the newer one owns the address.
+      this.subscriptionsByRequest.set(requestKey(request), { subscriptionId, version })
+    }
     if (!connectionId) {
       return
     }
@@ -42,13 +67,26 @@ export class RuntimeSubscriptionRegistry {
   registerOwned(
     subscriptionId: string,
     cleanup: SubscriptionCleanup,
-    connectionId?: string
+    connectionId?: string,
+    requestId?: string
   ): SubscriptionRegistration {
-    this.register(subscriptionId, cleanup, connectionId)
+    this.register(subscriptionId, cleanup, connectionId, requestId)
     const version = this.registrationVersion
     return { releaseIfCurrent: () => this.cleanupOwned(subscriptionId, version) }
   }
 
+  /** Releases the registration a request created; an unknown, ended or replaced request is a no-op. */
+  releaseByRequest(connectionId: string | undefined, requestId: string): void {
+    // Why: some non-phone sockets carry no connection id, and a bare request id is not unique across sockets.
+    if (!connectionId) {
+      return
+    }
+    const target = this.subscriptionsByRequest.get(requestKey({ connectionId, requestId }))
+    if (target) {
+      this.cleanupOwned(target.subscriptionId, target.version)
+    }
+  }
+
   cleanupIfOwnedByConnection(
     subscriptionId: string,
     connectionId?: string,
@@ -121,6 +159,7 @@ export class RuntimeSubscriptionRegistry {
         }
         this.cleanups.delete(subscriptionId)
         this.removeConnectionIndex(subscriptionId)
+        this.removeRequestIndex(entry)
       })
       .finally(() => {
         if (this.cleanupPromises.get(subscriptionId)?.promise === promise) {
@@ -131,8 +170,13 @@ export class RuntimeSubscriptionRegistry {
     return promise
   }
 
-  cleanupByPrefix(prefix: string): void {
-    const ids = Array.from(this.cleanups.keys()).filter((id) => id.startsWith(prefix))
+  cleanupByPrefix(prefix: string, throughVersion?: number): void {
+    const ids = Array.from(this.cleanups.entries())
+      .filter(
+        ([id, entry]) =>
+          id.startsWith(prefix) && (throughVersion === undefined || entry.version <= throughVersion)
+      )
+      .map(([id]) => id)
     for (const id of ids) {
       this.cleanup(id)
     }
@@ -162,6 +206,17 @@ export class RuntimeSubscriptionRegistry {
     this.cleanup(subscriptionId)
   }
 
+  /** Compare-and-delete: a newer registration that reused the request id keeps its address. */
+  private removeRequestIndex(entry: SubscriptionEntry): void {
+    if (!entry.request) {
+      return
+    }
+    const key = requestKey(entry.request)
+    if (this.subscriptionsByRequest.get(key)?.version === entry.version) {
+      this.subscriptionsByRequest.delete(key)
+    }
+  }
+
   private removeConnectionIndex(subscriptionId: string): void {
     const connectionId = this.connectionBySubscription.get(subscriptionId)
     if (!connectionId) {
diff --git a/src/main/runtime/runtime-terminal-contracts.ts b/src/main/runtime/runtime-terminal-contracts.ts
index 5ee2cc8e7fcd..fa0e7a0afa0f 100644
--- a/src/main/runtime/runtime-terminal-contracts.ts
+++ b/src/main/runtime/runtime-terminal-contracts.ts
@@ -16,6 +16,7 @@ import type { TuiAgent } from '../../shared/tui-agent'
 import type { WorktreeStartupLaunch } from '../../shared/worktree/launch-types'
 import type { RuntimeTerminalSend } from '../../shared/runtime-terminal-contracts'
 import type { RuntimeTerminalWriteOptions } from './runtime-terminal-writer'
+import type { TerminalInputKind } from '../../shared/terminal-input-kind'
 import type { RuntimePtyController } from './runtime-pty-controller-contract'
 import type { RuntimeAgentRowSnapshot } from './runtime-worktree-agent-rows'
 import type { WorkerTerminalHostScope } from './orchestration/worker-terminal-process-liveness'
@@ -79,6 +80,8 @@ export type TerminalCreateOptions = {
   agentSessionCreateOperationId?: string
   signal?: AbortSignal
   onPtySpawnCommitted?: () => void
+  /** Called before the spawn request leaves this process; a throw before it proves nothing spawned. */
+  onPtySpawnDispatched?: () => void
   deferMobileSessionPublish?: boolean
 }
 
@@ -201,7 +204,9 @@ export type RuntimeProviderSnapshotReadOptions = {
 }
 
 /** Agent-prompt writes add the correlation inputs a queued-acceptance receipt needs. */
-export type RuntimeAgentPromptWriteOptions = RuntimeTerminalWriteOptions & {
+export type RuntimeAgentPromptWriteOptions = Omit<RuntimeTerminalWriteOptions, 'inputKind'> & {
+  /** `launch` for the prompt an agent starts with; `driving` for any prompt sent to a running one. */
+  inputKind: Exclude<TerminalInputKind, 'query-reply'>
   /** Raw prompt text for submit scheduling; not written, only used for line-aware delays. */
   promptForSchedule?: string
   /** See buildAgentPromptPasteBytes. */
diff --git a/src/main/runtime/runtime-terminal-idle-polls.test.ts b/src/main/runtime/runtime-terminal-idle-polls.test.ts
index 99622ce42df6..cab8e75ae468 100644
--- a/src/main/runtime/runtime-terminal-idle-polls.test.ts
+++ b/src/main/runtime/runtime-terminal-idle-polls.test.ts
@@ -3,6 +3,7 @@ import { RuntimeTerminalIdlePolls } from './runtime-terminal-idle-polls'
 import type { TerminalWaiter } from './runtime-terminal-contracts'
 import type { RuntimeLeafRecord, RuntimePtyWorktreeRecord } from './runtime-terminal-state-records'
 import type { RuntimeTerminalWait } from '../../shared/runtime-types'
+import type { TuiAgent } from '../../shared/tui-agent'
 
 const INTERVAL_MS = 2000
 
@@ -73,6 +74,8 @@ describe('RuntimeTerminalIdlePolls timer budget', () => {
       getAdoptedPtyIdleStatus: () => null,
       getPaneAgent: () => null,
       getFirstPartyAgentStatus: () => null,
+      readScreenLines: () => null,
+      readVisibleScreen: () => null,
       getLiveLeaf: (leaf) => leaf,
       resolve: (waiter, result) => resolved.push({ handle: waiter.handle, result })
     })
@@ -108,6 +111,8 @@ describe('RuntimeTerminalIdlePolls timer budget', () => {
       getAdoptedPtyIdleStatus: () => null,
       getPaneAgent: () => null,
       getFirstPartyAgentStatus: () => null,
+      readScreenLines: () => null,
+      readVisibleScreen: () => null,
       getLiveLeaf: (leaf) => leaf,
       resolve: () => {}
     })
@@ -133,6 +138,8 @@ describe('RuntimeTerminalIdlePolls timer budget', () => {
       getAdoptedPtyIdleStatus: () => null,
       getPaneAgent: () => null,
       getFirstPartyAgentStatus: () => null,
+      readScreenLines: () => null,
+      readVisibleScreen: () => null,
       getLiveLeaf: (leaf) => leaf,
       resolve: () => {}
     })
@@ -163,6 +170,8 @@ describe('RuntimeTerminalIdlePolls timer budget', () => {
       getAdoptedPtyIdleStatus: () => null,
       getPaneAgent: () => null,
       getFirstPartyAgentStatus: () => null,
+      readScreenLines: () => null,
+      readVisibleScreen: () => null,
       getLiveLeaf: (leaf) => leaf,
       resolve: (waiter) => resolved.push(waiter.handle)
     })
@@ -185,3 +194,163 @@ describe('RuntimeTerminalIdlePolls timer budget', () => {
     expect(polls.activeTimerCount).toBe(0)
   })
 })
+
+describe('RuntimeTerminalIdlePolls rendered-screen blocked prompts', () => {
+  beforeEach(() => {
+    vi.useFakeTimers()
+  })
+
+  afterEach(() => {
+    vi.useRealTimers()
+  })
+
+  const TRUST_SCREEN = [
+    'Accessing workspace:',
+    '/repo/app',
+    'Quick safety check: Is this a project you created or one you trust?',
+    '❯ No, exit',
+    '  Yes, I trust this folder',
+    'Enter to confirm · Esc to cancel'
+  ].join('\n')
+
+  function createPolls(
+    readVisibleScreen: (ptyId: string) => Promise<string | null> | null,
+    resolved: RuntimeTerminalWait[],
+    foreground: string | null = 'claude',
+    agent: TuiAgent | null = null
+  ): RuntimeTerminalIdlePolls {
+    return new RuntimeTerminalIdlePolls({
+      intervalMs: INTERVAL_MS,
+      quiescenceMs: 1500,
+      getTabTitle: () => null,
+      // Unknown agent + quiet pane: without the screen check this would settle idle.
+      getForegroundProcess: () => (foreground ? Promise.resolve(foreground) : null),
+      getAdoptedPtyIdleStatus: () => null,
+      getPaneAgent: () => agent,
+      getFirstPartyAgentStatus: () => null,
+      readScreenLines: () => null,
+      readVisibleScreen,
+      getLiveLeaf: (leaf) => leaf,
+      resolve: (_waiter, result) => resolved.push(result)
+    })
+  }
+
+  it('reports a dialog the tail lost but the screen still shows, ahead of a quiet-pane idle', async () => {
+    const resolved: RuntimeTerminalWait[] = []
+    const polls = createPolls(() => Promise.resolve(TRUST_SCREEN), resolved)
+    polls.startPty(makeWaiter('pty'), makePty('pty-1', { lastOutputAt: Date.now() - 10_000 }))
+    polls.startLeaf(makeWaiter('leaf'), makeLeaf('tab-1', { lastOutputAt: Date.now() - 10_000 }))
+
+    await vi.advanceTimersByTimeAsync(INTERVAL_MS)
+
+    expect(resolved).toHaveLength(2)
+    expect(resolved).toEqual([
+      expect.objectContaining({ satisfied: false, blockedReason: 'agent-trust-workspace' }),
+      expect.objectContaining({ satisfied: false, blockedReason: 'agent-trust-workspace' })
+    ])
+    expect(polls.activeTimerCount).toBe(0)
+  })
+
+  it('does not read the screen of an agent whose title says it is working', async () => {
+    const resolved: RuntimeTerminalWait[] = []
+    const reads: string[] = []
+    const polls = createPolls((ptyId) => {
+      reads.push(ptyId)
+      return Promise.resolve(TRUST_SCREEN)
+    }, resolved)
+    polls.startPty(makeWaiter('pty'), makePty('pty-1', { lastAgentStatus: 'working' }))
+    polls.startLeaf(makeWaiter('leaf'), makeLeaf('tab-1', { lastAgentStatus: 'working' }))
+
+    await vi.advanceTimersByTimeAsync(INTERVAL_MS * 3)
+
+    expect(reads).toEqual([])
+    expect(resolved).toEqual([])
+    expect(polls.activeTimerCount).toBe(1)
+  })
+
+  it('does not resolve a waiter that was cancelled while its screen read was pending', async () => {
+    const resolved: RuntimeTerminalWait[] = []
+    const finishRead = new Map<string, (screen: string) => void>()
+    const reads: string[] = []
+    const polls = createPolls(
+      (ptyId) => {
+        reads.push(ptyId)
+        return new Promise<string>((resolve) => {
+          finishRead.set(ptyId, resolve)
+        })
+      },
+      resolved,
+      null
+    )
+    const waiter = makeWaiter('pty')
+    polls.startPty(waiter, makePty('pty-1'))
+    polls.startPty(makeWaiter('other'), makePty('pty-2'))
+
+    await vi.advanceTimersByTimeAsync(INTERVAL_MS * 2)
+    // One read per waiter: the second sweep must not stack reads behind a pending one.
+    expect(reads).toEqual(['pty-1', 'pty-2'])
+
+    waiter.cancelIdlePoll?.()
+    finishRead.get('pty-1')?.(TRUST_SCREEN)
+    await vi.advanceTimersByTimeAsync(0)
+    expect(resolved).toEqual([])
+  })
+
+  // Why: a name-only title is the only rest signal these agents emit, but it cannot see a
+  // dialog the tail lost, so it settles only once the screen read comes back clear.
+  it.each(['grok', 'copilot', 'aider'] as const)(
+    "settles %s's name-only title only after its screen read",
+    async (agent) => {
+      const resolved: RuntimeTerminalWait[] = []
+      const screens: ((screen: string) => void)[] = []
+      const polls = createPolls(
+        () => new Promise<string>((resolve) => screens.push(resolve)),
+        resolved,
+        null,
+        agent
+      )
+      const pty = makePty('pty-1', { lastAgentStatus: 'idle', lastOscTitle: agent })
+      polls.startPty(makeWaiter('pty'), pty, { kind: 'ready-weak' })
+
+      await vi.advanceTimersByTimeAsync(0)
+      expect(screens).toHaveLength(1)
+      expect(resolved).toEqual([])
+
+      screens[0](`${agent} ready for input`)
+      await vi.advanceTimersByTimeAsync(0)
+      expect(resolved).toEqual([expect.objectContaining({ satisfied: true })])
+    }
+  )
+
+  it('reports a dialog on screen under a name-only title instead of settling ready', async () => {
+    const resolved: RuntimeTerminalWait[] = []
+    const polls = createPolls(() => Promise.resolve(TRUST_SCREEN), resolved, null, 'grok')
+    const pty = makePty('pty-1', { lastAgentStatus: 'idle', lastOscTitle: 'grok' })
+    polls.startPty(makeWaiter('pty'), pty, { kind: 'ready-weak' })
+
+    await vi.advanceTimersByTimeAsync(0)
+    expect(resolved).toEqual([
+      expect.objectContaining({ satisfied: false, blockedReason: 'agent-trust-workspace' })
+    ])
+  })
+
+  it("lets an agent's own idle title outrank dialog wording on its screen", async () => {
+    const resolved: RuntimeTerminalWait[] = []
+    const reads: string[] = []
+    const polls = createPolls(
+      (ptyId) => {
+        reads.push(ptyId)
+        return Promise.resolve(TRUST_SCREEN)
+      },
+      resolved,
+      null,
+      'claude'
+    )
+    const pty = makePty('pty-1', { lastAgentStatus: 'idle', lastOscTitle: '✳ Claude Code' })
+    polls.startPty(makeWaiter('pty'), pty)
+
+    await vi.advanceTimersByTimeAsync(INTERVAL_MS)
+    expect(reads).toEqual([])
+    expect(resolved).toEqual([expect.objectContaining({ satisfied: true })])
+  })
+})
diff --git a/src/main/runtime/runtime-terminal-idle-polls.ts b/src/main/runtime/runtime-terminal-idle-polls.ts
index 8960dc79d268..7306914af1fb 100644
--- a/src/main/runtime/runtime-terminal-idle-polls.ts
+++ b/src/main/runtime/runtime-terminal-idle-polls.ts
@@ -1,10 +1,9 @@
-import { isShellProcess, type AgentStatus } from '../../shared/agent-detection'
-import type { RuntimeTerminalWait } from '../../shared/runtime-types'
-import {
-  detectTerminalWaitBlockedReason,
-  isKnownReadyPromptPreview,
-  isMuseReadyPromptPreview
-} from './terminal-wait-detection'
+import { isShellProcess } from '../../shared/agent-detection'
+import type {
+  RuntimeTerminalWait,
+  RuntimeTerminalWaitBlockedReason
+} from '../../shared/runtime-types'
+import { detectTerminalWaitBlockedReason } from './terminal-wait-detection'
 import {
   buildPtyTerminalWaitBlockedResult,
   buildPtyTerminalWaitResult,
@@ -13,11 +12,12 @@ import {
 } from './terminal-wait-results'
 import { buildTerminalWaitText } from './terminal-wait-tail-state'
 import {
-  isTuiIdleSatisfied,
-  quietForegroundProcessProvesTuiIdle,
-  type FirstPartyAgentStatus
+  evaluateTuiIdle,
+  leafTuiIdleEvidence,
+  ptyTuiIdleEvidence,
+  type TuiIdleEvidenceSource,
+  type TuiIdleVerdict
 } from './tui-idle-evidence'
-import type { TuiAgent } from '../../shared/tui-agent'
 
 /**
  * Why null counts as quiet: a record with no output timestamp has produced nothing the
@@ -34,32 +34,32 @@ function isQuietForQuiescence(lastOutputAt: number | null, quiescenceMs: number)
 import type { TerminalWaiter } from './runtime-terminal-contracts'
 import type { RuntimeLeafRecord, RuntimePtyWorktreeRecord } from './runtime-terminal-state-records'
 
-type RuntimeTerminalIdlePollDependencies = {
+type RuntimeTerminalIdlePollDependencies = TuiIdleEvidenceSource & {
   intervalMs: number
-  quiescenceMs: number
-  getTabTitle(tabId: string): string | null
   getForegroundProcess(ptyId: string): Promise<string | null> | null
-  getAdoptedPtyIdleStatus(pty: RuntimePtyWorktreeRecord): AgentStatus | null
-  getPaneAgent(ptyId: string | null | undefined): TuiAgent | null
-  getFirstPartyAgentStatus(ptyId: string | null | undefined): FirstPartyAgentStatus
-  /** Re-read the record the waiter registered against; see `liveLeaf` below. */
+  /** The pane's rendered viewport, or null when the runtime holds no screen model for it. */
+  readVisibleScreen(ptyId: string): Promise<string | null> | null
+  /** Re-read the record the waiter registered against; see `sample` below. */
   getLiveLeaf(leaf: RuntimeLeafRecord): RuntimeLeafRecord
   resolve(waiter: TerminalWaiter, result: RuntimeTerminalWait): void
 }
 
-type IdlePollEntry =
-  | {
-      kind: 'leaf'
-      waiter: TerminalWaiter
-      leaf: RuntimeLeafRecord
-      foregroundPollInFlight: boolean
-    }
-  | {
-      kind: 'pty'
-      waiter: TerminalWaiter
-      pty: RuntimePtyWorktreeRecord
-      foregroundPollInFlight: boolean
-    }
+type IdlePollEntry = {
+  waiter: TerminalWaiter
+  foregroundPollInFlight: boolean
+  screenReadInFlight: boolean
+} & ({ kind: 'leaf'; leaf: RuntimeLeafRecord } | { kind: 'pty'; pty: RuntimePtyWorktreeRecord })
+
+/** One reading of a waiter's pane, and the results it would settle with. */
+type IdlePollSample = {
+  verdict: TuiIdleVerdict
+  ptyId: string | null
+  ready(): RuntimeTerminalWait
+  blocked(reason: RuntimeTerminalWaitBlockedReason): RuntimeTerminalWait
+  isQuiet(): boolean
+}
+
+const IDLE_ENTRY_FLAGS = { foregroundPollInFlight: false, screenReadInFlight: false }
 
 export class RuntimeTerminalIdlePolls {
   private readonly entries = new Set<IdlePollEntry>()
@@ -67,12 +67,13 @@ export class RuntimeTerminalIdlePolls {
 
   constructor(private readonly deps: RuntimeTerminalIdlePollDependencies) {}
 
-  startLeaf(waiter: TerminalWaiter, leaf: RuntimeLeafRecord): void {
-    this.start({ kind: 'leaf', waiter, leaf, foregroundPollInFlight: false })
+  /** `verdict` is what the caller just evaluated; weak ready is checked at once, not a sweep later. */
+  startLeaf(waiter: TerminalWaiter, leaf: RuntimeLeafRecord, verdict?: TuiIdleVerdict): void {
+    this.start({ kind: 'leaf', waiter, leaf, ...IDLE_ENTRY_FLAGS }, verdict)
   }
 
-  startPty(waiter: TerminalWaiter, pty: RuntimePtyWorktreeRecord): void {
-    this.start({ kind: 'pty', waiter, pty, foregroundPollInFlight: false })
+  startPty(waiter: TerminalWaiter, pty: RuntimePtyWorktreeRecord, verdict?: TuiIdleVerdict): void {
+    this.start({ kind: 'pty', waiter, pty, ...IDLE_ENTRY_FLAGS }, verdict)
   }
 
   /** Test/diagnostic seam: live sweep handles, which must stay at most one. */
@@ -80,7 +81,7 @@ export class RuntimeTerminalIdlePolls {
     return this.sweepTimer ? 1 : 0
   }
 
-  private start(entry: IdlePollEntry): void {
+  private start(entry: IdlePollEntry, verdict: TuiIdleVerdict | undefined): void {
     this.entries.add(entry)
     entry.waiter.cancelIdlePoll = () => this.stop(entry)
     // Why one shared timer for every waiter: a per-waiter interval multiplied idle
@@ -89,6 +90,11 @@ export class RuntimeTerminalIdlePolls {
     if (!this.sweepTimer) {
       this.sweepTimer = setInterval(() => this.sweep(), this.deps.intervalMs)
     }
+    // Why: the evidence is already in hand and only needs its screen read; a probe that
+    // times out under one interval (the automation start probe) would otherwise never see it.
+    if (verdict?.kind === 'ready-weak') {
+      void this.tick(entry)
+    }
   }
 
   private sweep(): void {
@@ -97,135 +103,90 @@ export class RuntimeTerminalIdlePolls {
     // slow `ps` must never delay another waiter's checks, and a waiter registered by a
     // resolve inside this sweep must wait for the next tick, as a fresh interval would.
     for (const entry of Array.from(this.entries)) {
-      void (entry.kind === 'leaf' ? this.tickLeaf(entry) : this.tickPty(entry))
+      void this.tick(entry)
     }
   }
 
-  private async tickLeaf(entry: IdlePollEntry & { kind: 'leaf' }): Promise<void> {
-    if (!this.entries.has(entry)) {
-      return
+  private sample(entry: IdlePollEntry): IdlePollSample {
+    const { handle } = entry.waiter
+    if (entry.kind === 'pty') {
+      // Why no re-read here: `ptysById` has a single create-once `set` site, so PTY
+      // records are mutated in place rather than swapped, and a capture stays live.
+      const { pty } = entry
+      const readWaitText = () =>
+        buildTerminalWaitText(pty.tailBuffer, pty.tailPartialLine, pty.preview)
+      return {
+        verdict: evaluateTuiIdle(ptyTuiIdleEvidence(this.deps, pty, readWaitText)),
+        ptyId: pty.ptyId,
+        ready: () => buildPtyTerminalWaitResult(handle, 'tui-idle', pty),
+        blocked: (reason) => buildPtyTerminalWaitBlockedResult(handle, 'tui-idle', pty, reason),
+        isQuiet: () => isQuietForQuiescence(pty.lastOutputAt, this.deps.quiescenceMs)
+      }
     }
-    const { waiter } = entry
     // Why re-read: `syncWindowGraph` rebuilds `this.leaves` with fresh objects on every
     // renderer publish, so the record captured at registration stops advancing. Its
-    // `lastOutputAt` freezes, the quiescence gate below then reads an ever-growing
-    // elapsed time, and the waiter settles while the pane is in fact still streaming.
+    // `lastOutputAt` freezes, the quiescence gate then reads an ever-growing elapsed
+    // time, and the waiter settles while the pane is in fact still streaming.
     const leaf = this.deps.getLiveLeaf(entry.leaf)
-    const agent = this.deps.getPaneAgent(leaf.ptyId)
-    let startedForegroundPoll = false
-    try {
-      const waitText = buildTerminalWaitText(leaf.tailBuffer, leaf.tailPartialLine, leaf.preview)
-      const blockedReason = detectTerminalWaitBlockedReason(waitText)
-      if (blockedReason) {
-        this.stop(entry)
-        this.deps.resolve(
-          waiter,
-          buildTerminalWaitBlockedResult(waiter.handle, 'tui-idle', leaf, blockedReason)
-        )
-        return
-      }
-      if (
-        isTuiIdleSatisfied({
-          record: leaf,
-          rendererTitle: leaf.paneTitle ?? this.deps.getTabTitle(leaf.tabId),
-          readPositiveBodyEvidence: () => isKnownReadyPromptPreview(waitText),
-          readMuseReadyBodyEvidence: () => isMuseReadyPromptPreview(waitText),
-          agent,
-          firstPartyStatus: this.deps.getFirstPartyAgentStatus(leaf.ptyId),
-          quiescenceMs: this.deps.quiescenceMs
-        })
-      ) {
-        this.stop(entry)
-        this.deps.resolve(waiter, buildTerminalWaitResult(waiter.handle, 'tui-idle', leaf))
-        return
-      }
-      if (
-        leaf.lastAgentStatus === null &&
-        quietForegroundProcessProvesTuiIdle(agent) &&
-        leaf.ptyId &&
-        !entry.foregroundPollInFlight
-      ) {
-        const foregroundRead = this.deps.getForegroundProcess(leaf.ptyId)
-        if (!foregroundRead) {
-          return
-        }
-        entry.foregroundPollInFlight = true
-        startedForegroundPoll = true
-        const foreground = await foregroundRead
-        const live = this.deps.getLiveLeaf(entry.leaf)
-        if (
-          foreground &&
-          !isShellProcess(foreground) &&
-          isQuietForQuiescence(live.lastOutputAt, this.deps.quiescenceMs)
-        ) {
-          this.stop(entry)
-          this.deps.resolve(waiter, buildTerminalWaitResult(waiter.handle, 'tui-idle', live))
-        }
-      }
-    } catch {
-      // Transient process inspection errors do not retire the waiter.
-    } finally {
-      if (startedForegroundPoll) {
-        entry.foregroundPollInFlight = false
-      }
+    const readWaitText = () =>
+      buildTerminalWaitText(leaf.tailBuffer, leaf.tailPartialLine, leaf.preview)
+    const live = () => this.deps.getLiveLeaf(entry.leaf)
+    return {
+      verdict: evaluateTuiIdle(leafTuiIdleEvidence(this.deps, leaf, readWaitText)),
+      ptyId: leaf.ptyId,
+      ready: () => buildTerminalWaitResult(handle, 'tui-idle', live()),
+      blocked: (reason) => buildTerminalWaitBlockedResult(handle, 'tui-idle', live(), reason),
+      isQuiet: () => isQuietForQuiescence(live().lastOutputAt, this.deps.quiescenceMs)
     }
   }
 
-  private async tickPty(entry: IdlePollEntry & { kind: 'pty' }): Promise<void> {
+  private async tick(entry: IdlePollEntry): Promise<void> {
     if (!this.entries.has(entry)) {
       return
     }
-    const { waiter, pty } = entry
-    // Why no re-read here: `ptysById` has a single create-once `set` site, so PTY
-    // records are mutated in place rather than swapped, and a capture stays live.
-    const agent = this.deps.getPaneAgent(pty.ptyId)
     let startedForegroundPoll = false
     try {
-      const waitText = buildTerminalWaitText(pty.tailBuffer, pty.tailPartialLine, pty.preview)
-      const blockedReason = detectTerminalWaitBlockedReason(waitText)
-      if (blockedReason) {
-        this.stop(entry)
-        this.deps.resolve(
-          waiter,
-          buildPtyTerminalWaitBlockedResult(waiter.handle, 'tui-idle', pty, blockedReason)
-        )
+      const sample = this.sample(entry)
+      const { verdict, ptyId } = sample
+      if (verdict.kind === 'blocked') {
+        this.settle(entry, sample.blocked(verdict.reason))
         return
       }
-      if (
-        isTuiIdleSatisfied({
-          record: pty,
-          readPositiveBodyEvidence: () =>
-            this.deps.getAdoptedPtyIdleStatus(pty) === 'idle' ||
-            isKnownReadyPromptPreview(waitText),
-          readMuseReadyBodyEvidence: () => isMuseReadyPromptPreview(waitText),
-          agent,
-          firstPartyStatus: this.deps.getFirstPartyAgentStatus(pty.ptyId),
-          quiescenceMs: this.deps.quiescenceMs
-        })
-      ) {
-        this.stop(entry)
-        this.deps.resolve(waiter, buildPtyTerminalWaitResult(waiter.handle, 'tui-idle', pty))
+      // Why strong ready outranks the screen: the detector is not scoped to a region, so dialog
+      // wording anywhere on a finished agent's screen would otherwise read as blocked.
+      if (verdict.kind === 'ready-strong') {
+        this.settle(entry, sample.ready())
         return
       }
-      if (
-        pty.lastAgentStatus === null &&
-        quietForegroundProcessProvesTuiIdle(agent) &&
-        !entry.foregroundPollInFlight
-      ) {
-        const foregroundRead = this.deps.getForegroundProcess(pty.ptyId)
+      // Why no screen read while working: its output can quote dialog wording (a diff of this
+      // detector), and the dialogs only the screen shows are start-up ones, painted before any title.
+      if (verdict.kind === 'working' || entry.screenReadInFlight) {
+        return
+      }
+      const screenRead = ptyId ? this.readScreenBlockedReason(entry, ptyId) : null
+      // Why await only a real read: a pane with no screen model keeps its tick synchronous.
+      const screenBlockedReason = screenRead ? await screenRead : null
+      if (!this.entries.has(entry)) {
+        return
+      }
+      if (screenBlockedReason) {
+        this.settle(entry, sample.blocked(screenBlockedReason))
+        return
+      }
+      if (verdict.kind === 'ready-weak') {
+        this.settle(entry, sample.ready())
+        return
+      }
+      if (verdict.quietForeground && ptyId && !entry.foregroundPollInFlight) {
+        const foregroundRead = this.deps.getForegroundProcess(ptyId)
         if (!foregroundRead) {
           return
         }
         entry.foregroundPollInFlight = true
         startedForegroundPoll = true
         const foreground = await foregroundRead
-        if (
-          foreground &&
-          !isShellProcess(foreground) &&
-          isQuietForQuiescence(pty.lastOutputAt, this.deps.quiescenceMs)
-        ) {
-          this.stop(entry)
-          this.deps.resolve(waiter, buildPtyTerminalWaitResult(waiter.handle, 'tui-idle', pty))
+        if (foreground && !isShellProcess(foreground) && sample.isQuiet()) {
+          this.settle(entry, sample.ready())
         }
       }
     } catch {
@@ -237,6 +198,29 @@ export class RuntimeTerminalIdlePolls {
     }
   }
 
+  /** Why the screen too: a dialog that parks the cursor above its own options (Claude's
+   *  workspace trust) loses those rows from the line tail; the rendered screen still has them. */
+  private readScreenBlockedReason(
+    entry: IdlePollEntry,
+    ptyId: string
+  ): Promise<RuntimeTerminalWaitBlockedReason | null> | null {
+    const screenRead = this.deps.readVisibleScreen(ptyId)
+    if (!screenRead) {
+      return null
+    }
+    entry.screenReadInFlight = true
+    return screenRead
+      .then((screen) => (screen ? detectTerminalWaitBlockedReason(screen) : null))
+      .finally(() => {
+        entry.screenReadInFlight = false
+      })
+  }
+
+  private settle(entry: IdlePollEntry, result: RuntimeTerminalWait): void {
+    this.stop(entry)
+    this.deps.resolve(entry.waiter, result)
+  }
+
   private stop(entry: IdlePollEntry): void {
     if (!this.entries.delete(entry)) {
       return
diff --git a/src/main/runtime/runtime-terminal-orphan-adoption.ts b/src/main/runtime/runtime-terminal-orphan-adoption.ts
index 59fbf76b857d..24df1cc1cbfb 100644
--- a/src/main/runtime/runtime-terminal-orphan-adoption.ts
+++ b/src/main/runtime/runtime-terminal-orphan-adoption.ts
@@ -13,7 +13,7 @@ import { buildRuntimeTerminalOrphanSession } from './runtime-terminal-orphan-ses
 import { validateRuntimeTerminalOrphanTopology } from './runtime-terminal-orphan-topology-validation'
 import type { RuntimeLeafRecord, RuntimePtyWorktreeRecord } from './runtime-terminal-state-records'
 import { runtimeWorktreeIdsEqual } from './runtime-worktree-path-identity'
-import { rollbackWorkspaceSessionAfterFailedAsyncWrite } from './workspace-session-failed-write-rollback'
+import { rollbackWorkspaceSessionAfterFailedAsyncWrite } from '../persistence/restoring-sessions/workspace-session-write-rollback'
 
 type RuntimeTerminalOrphanAdoptionPorts = {
   getPty: (handle: string) => RuntimePtyWorktreeRecord | null
diff --git a/src/main/runtime/runtime-terminal-wait.ts b/src/main/runtime/runtime-terminal-wait.ts
index 23d112c8e9fa..240f55085812 100644
--- a/src/main/runtime/runtime-terminal-wait.ts
+++ b/src/main/runtime/runtime-terminal-wait.ts
@@ -3,11 +3,6 @@ import type {
   RuntimeTerminalWaitCondition
 } from '../../shared/runtime-types'
 import { hasAntigravityTerminalHeader } from './antigravity-terminal-readiness'
-import {
-  detectTerminalWaitBlockedReason,
-  isKnownReadyPromptPreview,
-  isMuseReadyPromptPreview
-} from './terminal-wait-detection'
 import {
   buildPtyTerminalWaitBlockedResult,
   buildPtyTerminalWaitResult,
@@ -16,23 +11,23 @@ import {
   getTerminalState
 } from './terminal-wait-results'
 import { buildTerminalWaitText } from './terminal-wait-tail-state'
-import { isTuiIdleSatisfied, type FirstPartyAgentStatus } from './tui-idle-evidence'
+import {
+  evaluateTuiIdle,
+  leafTuiIdleEvidence,
+  ptyTuiIdleEvidence,
+  type TuiIdleEvidenceSource,
+  type TuiIdleVerdict
+} from './tui-idle-evidence'
 import type { TuiAgent } from '../../shared/tui-agent'
 import type { TerminalWaiter } from './runtime-terminal-contracts'
 import type { RuntimeLeafRecord, RuntimePtyWorktreeRecord } from './runtime-terminal-state-records'
-import type { AgentStatus } from '../../shared/agent-detection'
 import type { RuntimeTerminalIdlePolls } from './runtime-terminal-idle-polls'
 import type { RuntimeTerminalWaiterRegistry } from './runtime-terminal-waiter-registry'
 
-type RuntimeTerminalWaitDependencies = {
+type RuntimeTerminalWaitDependencies = TuiIdleEvidenceSource & {
   defaultTimeoutMs: number
   getLivePty(handle: string): { pty: RuntimePtyWorktreeRecord } | null
   getLiveLeaf(handle: string): { leaf: RuntimeLeafRecord }
-  getAdoptedPtyIdleStatus(pty: RuntimePtyWorktreeRecord): AgentStatus | null
-  getTabTitle(tabId: string): string | null
-  quiescenceMs: number
-  getPaneAgent(ptyId: string | null | undefined): TuiAgent | null
-  getFirstPartyAgentStatus(ptyId: string | null | undefined): FirstPartyAgentStatus
   startVisibleReadProbe(
     waiter: TerminalWaiter,
     waiterTimeoutMs: number,
@@ -49,28 +44,12 @@ export class RuntimeTerminalWait {
 
   /** Why one helper per record kind: every satisfaction site must rank the same way,
    *  or the immediate check and the poll disagree about the same pane. */
-  private ptySatisfied(pty: RuntimePtyWorktreeRecord, waitText: string): boolean {
-    return isTuiIdleSatisfied({
-      record: pty,
-      readPositiveBodyEvidence: () =>
-        this.deps.getAdoptedPtyIdleStatus(pty) === 'idle' || isKnownReadyPromptPreview(waitText),
-      readMuseReadyBodyEvidence: () => isMuseReadyPromptPreview(waitText),
-      agent: this.deps.getPaneAgent(pty.ptyId),
-      firstPartyStatus: this.deps.getFirstPartyAgentStatus(pty.ptyId),
-      quiescenceMs: this.deps.quiescenceMs
-    })
+  private evaluatePty(pty: RuntimePtyWorktreeRecord, waitText: string): TuiIdleVerdict {
+    return evaluateTuiIdle(ptyTuiIdleEvidence(this.deps, pty, () => waitText))
   }
 
-  private leafSatisfied(leaf: RuntimeLeafRecord, waitText: string): boolean {
-    return isTuiIdleSatisfied({
-      record: leaf,
-      rendererTitle: leaf.paneTitle ?? this.deps.getTabTitle(leaf.tabId),
-      readPositiveBodyEvidence: () => isKnownReadyPromptPreview(waitText),
-      readMuseReadyBodyEvidence: () => isMuseReadyPromptPreview(waitText),
-      agent: this.deps.getPaneAgent(leaf.ptyId),
-      firstPartyStatus: this.deps.getFirstPartyAgentStatus(leaf.ptyId),
-      quiescenceMs: this.deps.quiescenceMs
-    })
+  private evaluateLeaf(leaf: RuntimeLeafRecord, waitText: string): TuiIdleVerdict {
+    return evaluateTuiIdle(leafTuiIdleEvidence(this.deps, leaf, () => waitText))
   }
 
   async wait(
@@ -92,11 +71,13 @@ export class RuntimeTerminalWait {
         pty.pty.tailPartialLine,
         pty.pty.preview
       )
-      const ptyBlockedReason = detectTerminalWaitBlockedReason(ptyWaitText)
-      if (condition === 'tui-idle' && ptyBlockedReason) {
-        return buildPtyTerminalWaitBlockedResult(handle, condition, pty.pty, ptyBlockedReason)
+      // Why strong verdicts only, here and at every other synchronous site: weak evidence
+      // cannot see a dialog the tail lost, so it settles only on the poll, after a screen read.
+      const ptyVerdict = condition === 'tui-idle' ? this.evaluatePty(pty.pty, ptyWaitText) : null
+      if (ptyVerdict?.kind === 'blocked') {
+        return buildPtyTerminalWaitBlockedResult(handle, condition, pty.pty, ptyVerdict.reason)
       }
-      if (condition === 'tui-idle' && this.ptySatisfied(pty.pty, ptyWaitText)) {
+      if (ptyVerdict?.kind === 'ready-strong') {
         return buildPtyTerminalWaitResult(handle, condition, pty.pty)
       }
       return await new Promise<RuntimeTerminalWaitResult>((resolve, reject) => {
@@ -138,16 +119,16 @@ export class RuntimeTerminalWait {
             live.pty.tailPartialLine,
             live.pty.preview
           )
-          const blockedReason = detectTerminalWaitBlockedReason(livePtyWaitText)
-          if (blockedReason) {
+          const verdict = this.evaluatePty(live.pty, livePtyWaitText)
+          if (verdict.kind === 'blocked') {
             this.waiters.resolve(
               waiter,
-              buildPtyTerminalWaitBlockedResult(handle, condition, live.pty, blockedReason)
+              buildPtyTerminalWaitBlockedResult(handle, condition, live.pty, verdict.reason)
             )
-          } else if (this.ptySatisfied(live.pty, livePtyWaitText)) {
+          } else if (verdict.kind === 'ready-strong') {
             this.waiters.resolve(waiter, buildPtyTerminalWaitResult(handle, condition, live.pty))
           } else {
-            this.polls.startPty(waiter, live.pty)
+            this.polls.startPty(waiter, live.pty, verdict)
             const paneAgent = this.deps.getPaneAgent(live.pty.ptyId)
             if (
               // AGY can retain a stale working/blocked status after a trust dialog was
@@ -173,17 +154,15 @@ export class RuntimeTerminalWait {
     }
 
     const leafWaitText = buildTerminalWaitText(leaf.tailBuffer, leaf.tailPartialLine, leaf.preview)
-    const leafBlockedReason = detectTerminalWaitBlockedReason(leafWaitText)
-    if (condition === 'tui-idle' && leafBlockedReason) {
-      return buildTerminalWaitBlockedResult(handle, condition, leaf, leafBlockedReason)
+    const leafVerdict = condition === 'tui-idle' ? this.evaluateLeaf(leaf, leafWaitText) : null
+    if (leafVerdict?.kind === 'blocked') {
+      return buildTerminalWaitBlockedResult(handle, condition, leaf, leafVerdict.reason)
     }
 
-    // Why: if the agent already transitioned to idle (or permission) before the
-    // waiter was registered, resolve immediately. This uses the same OSC title
-    // detection that powers the renderer's "Task complete" notifications.
-    // Why: only 'idle' satisfies tui-idle, not 'permission'. Permission means the
+    // Why: if the agent already announced rest before the waiter was registered, resolve
+    // immediately. Only 'idle' satisfies tui-idle, not 'permission'. Permission means the
     // agent is blocked on user approval, not finished with its task.
-    if (condition === 'tui-idle' && this.leafSatisfied(leaf, leafWaitText)) {
+    if (leafVerdict?.kind === 'ready-strong') {
       return buildTerminalWaitResult(handle, condition, leaf)
     }
 
@@ -235,13 +214,13 @@ export class RuntimeTerminalWait {
             live.leaf.tailPartialLine,
             live.leaf.preview
           )
-          const blockedReason = detectTerminalWaitBlockedReason(liveLeafWaitText)
-          if (blockedReason) {
+          const verdict = this.evaluateLeaf(live.leaf, liveLeafWaitText)
+          if (verdict.kind === 'blocked') {
             this.waiters.resolve(
               waiter,
-              buildTerminalWaitBlockedResult(handle, condition, live.leaf, blockedReason)
+              buildTerminalWaitBlockedResult(handle, condition, live.leaf, verdict.reason)
             )
-          } else if (this.leafSatisfied(live.leaf, liveLeafWaitText)) {
+          } else if (verdict.kind === 'ready-strong') {
             // Why: don't clear lastAgentStatus here. It's a factual record of the
             // last detected OSC state, not a one-shot signal. Clearing it causes
             // subsequent tui-idle waiters to hang even though the agent is idle —
@@ -251,7 +230,7 @@ export class RuntimeTerminalWait {
             // Why: renderer-synced previews can show a known ready prompt even
             // while the last OSC title is still "working"; keep polling the
             // preview/title until the waiter resolves or hits its timeout.
-            this.polls.startLeaf(waiter, live.leaf)
+            this.polls.startLeaf(waiter, live.leaf, verdict)
             const paneAgent = this.deps.getPaneAgent(live.leaf.ptyId)
             if (
               (paneAgent === 'antigravity' ||
diff --git a/src/main/runtime/runtime-terminal-writer.ts b/src/main/runtime/runtime-terminal-writer.ts
index 7ff6ba4a7f34..10e94f3747f7 100644
--- a/src/main/runtime/runtime-terminal-writer.ts
+++ b/src/main/runtime/runtime-terminal-writer.ts
@@ -1,8 +1,10 @@
 import { resolveAgentPromptSubmitDelayForAgent } from '../../shared/agent-prompt-injection'
 import type { TuiAgent } from '../../shared/tui-agent'
 import { iterateTerminalInputChunks } from '../../shared/terminal-input'
+import type { TerminalInputKind } from '../../shared/terminal-input-kind'
 
 export type RuntimeTerminalWriteOptions = {
+  inputKind: TerminalInputKind
   signal?: AbortSignal
   beforeWrite?: (ptyId: string) => void | Promise<void>
   reserveWrite?: (ptyId: string) => void
@@ -12,7 +14,7 @@ export type RuntimeTerminalWriteOptions = {
 
 export class RuntimeTerminalWriter {
   constructor(
-    private readonly write: (ptyId: string, data: string) => boolean,
+    private readonly write: (ptyId: string, data: string, inputKind: TerminalInputKind) => boolean,
     private readonly getWriteHostPlatform: (ptyId: string) => NodeJS.Platform = () =>
       process.platform,
     private readonly getAgent: (ptyId: string) => TuiAgent | null = () => null
@@ -22,7 +24,7 @@ export class RuntimeTerminalWriter {
     ptyId: string,
     action: { text?: string; enter?: boolean; interrupt?: boolean },
     payload: string,
-    options: RuntimeTerminalWriteOptions = {}
+    options: RuntimeTerminalWriteOptions
   ): Promise<void> {
     // Why: direct terminal.send can carry paste-sized text from RPC/mobile
     // clients; chunk text before PTY/ConPTY while preserving suffix separation.
@@ -54,7 +56,7 @@ export class RuntimeTerminalWriter {
         throw error
       }
       options.reserveWrite?.(ptyId)
-      if (!this.write(ptyId, suffix)) {
+      if (!this.write(ptyId, suffix, options.inputKind)) {
         throw new Error(options.suffixFailureError ?? 'terminal_not_writable')
       }
       await options.afterWrite?.(ptyId)
@@ -65,7 +67,7 @@ export class RuntimeTerminalWriter {
     }
     await options.beforeWrite?.(ptyId)
     options.reserveWrite?.(ptyId)
-    if (!this.write(ptyId, payload)) {
+    if (!this.write(ptyId, payload, options.inputKind)) {
       throw new Error('terminal_not_writable')
     }
     await options.afterWrite?.(ptyId)
@@ -74,14 +76,14 @@ export class RuntimeTerminalWriter {
   async writeChunks(
     ptyId: string,
     text: string,
-    options: RuntimeTerminalWriteOptions = {}
+    options: RuntimeTerminalWriteOptions
   ): Promise<void> {
     const chunks = iterateTerminalInputChunks(text)
     let chunk = chunks.next()
     while (!chunk.done) {
       await options.beforeWrite?.(ptyId)
       options.reserveWrite?.(ptyId)
-      if (!this.write(ptyId, chunk.value)) {
+      if (!this.write(ptyId, chunk.value, options.inputKind)) {
         throw new Error('terminal_not_writable')
       }
       await options.afterWrite?.(ptyId)
diff --git a/src/main/runtime/runtime-workspace-session-controller.ts b/src/main/runtime/runtime-workspace-session-controller.ts
index c7472b914d2d..e45425b8dd3e 100644
--- a/src/main/runtime/runtime-workspace-session-controller.ts
+++ b/src/main/runtime/runtime-workspace-session-controller.ts
@@ -107,6 +107,15 @@ export class RuntimeWorkspaceSessionController {
     return hostId ? (this.deps.getStore()?.getWorkspaceSession?.(hostId) ?? null) : null
   }
 
+  /** The session only when the worktree's own host partition owns it, not a rotated-owner fallback. */
+  getOwnPartition(worktreeId: string): WorkspaceSessionState | null {
+    const store = this.deps.getStore()
+    const hostId = store ? this.getPreferredHostId(worktreeId, store) : null
+    return hostId && hostId === this.tryGetHostId(worktreeId)
+      ? (store?.getWorkspaceSession?.(hostId) ?? null)
+      : null
+  }
+
   set(worktreeId: string, session: WorkspaceSessionState): void {
     this.deps.getStore()?.setWorkspaceSession?.(session, this.getHostId(worktreeId))
   }
diff --git a/src/main/runtime/runtime-worktree-agent-rows-verdict.test.ts b/src/main/runtime/runtime-worktree-agent-rows-verdict.test.ts
new file mode 100644
index 000000000000..7b22a45d09d5
--- /dev/null
+++ b/src/main/runtime/runtime-worktree-agent-rows-verdict.test.ts
@@ -0,0 +1,224 @@
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { agentSessionFailureFact } from '../../shared/agent-session-failure'
+import { agentSessionFailureWords } from '../../shared/agent-session-failure-words'
+import { makeStructuredAgentStatusSubject } from '../../shared/agent-status-subject'
+import { agentSessionRecordFixture } from '../../shared/agent-session-record.test-fixture'
+import type {
+  AgentSessionStatusEvent,
+  AgentSessionStatusSummary
+} from '../../shared/agent-session-wire'
+import type { RuntimeWorktreePsSummary } from '../../shared/runtime-types'
+import { AgentHookServer, _internals } from '../agent-hooks/server'
+import { createTrackedJournalOpener } from '../native-chat/agent-session-journal/journal-store-test-open'
+import type { AgentSessionJournal } from '../native-chat/agent-session-journal/journal-store'
+import { StructuredAgentSessionStatusFeed } from '../native-chat/agent-session-wire/structured-agent-session-status-feed'
+import { indexedStatusFeedSession } from '../native-chat/agent-session-wire/structured-agent-session-status-feed-test-session'
+import { attachRuntimeWorktreeAgentRows } from './runtime-worktree-agent-rows'
+import { collectRuntimeWorktreeAgentSources } from './runtime-worktree-agent-sources'
+
+vi.mock('../telemetry/client', () => ({ track: vi.fn() }))
+vi.mock('../telemetry/cohort-classifier', () => ({
+  getCohortAtEmit: vi.fn(() => ({ nth_repo_added: 2 }))
+}))
+
+// A request that failed reads as failed on every surface the host feeds: the journal's verdict
+// travels the real feed, the status-store ingest and `worktree ps`, never just the projection.
+const SESSION = 'verdict-session'
+const WORKSPACE_ID = 'workspace-1'
+const SUBJECT = makeStructuredAgentStatusSubject(
+  {
+    executionHostId: 'local',
+    wslDistro: null,
+    workspaceId: WORKSPACE_ID,
+    workspaceKind: 'git-worktree'
+  },
+  SESSION
+)
+const TURN_IDENTITY = {
+  provider: 'codex',
+  threadId: 'thread-1',
+  turnId: 'turn-1',
+  ordinal: 0
+} as const
+
+let root: string
+const journals = createTrackedJournalOpener()
+
+beforeEach(async () => {
+  _internals.resetCachesForTests()
+  root = await mkdtemp(join(tmpdir(), 'orca-verdict-rows-'))
+})
+
+afterEach(async () => {
+  await journals.closeAll()
+  await rm(root, { recursive: true, force: true })
+})
+
+async function openJournal(): Promise<AgentSessionJournal> {
+  return journals.open({
+    identity: {
+      sessionId: SESSION,
+      workspaceId: WORKSPACE_ID,
+      hostId: 'local',
+      agent: 'codex',
+      providerHandle: { kind: 'codex', threadId: 'thread-1' }
+    },
+    journalDir: join(root, SESSION)
+  })
+}
+
+/** What the host's real feed publishes for this journal. */
+function publishedSummary(journal: AgentSessionJournal): AgentSessionStatusSummary {
+  const session = indexedStatusFeedSession({ journal })
+  const feed = new StructuredAgentSessionStatusFeed({
+    sessions: new Map([[SESSION, session]]),
+    getRecord: () => agentSessionRecordFixture(),
+    now: () => 1_000
+  })
+  const events: AgentSessionStatusEvent[] = []
+  feed.subscribe({ id: 'list', emit: (event) => events.push(event) })
+  const snapshot = events.find((event) => event.type === 'snapshot')
+  const summary = snapshot?.type === 'snapshot' ? snapshot.sessions[0] : undefined
+  if (!summary) {
+    throw new Error('the feed published no session')
+  }
+  return summary
+}
+
+function ingest(summary: AgentSessionStatusSummary) {
+  const store = new AgentHookServer()
+  store.ingestStructuredStatus(summary, SUBJECT)
+  const hookSnapshots = store.getStatusSnapshot()
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: attaching agent rows reads and writes only `worktreeId`, `status`, `hasHostSidebarActivity` and `agents`.
+  const row = {
+    worktreeId: WORKSPACE_ID,
+    status: 'inactive',
+    hasHostSidebarActivity: false,
+    agents: []
+  } as unknown as RuntimeWorktreePsSummary
+  attachRuntimeWorktreeAgentRows({
+    summaries: new Map([[WORKSPACE_ID, row]]),
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: `getSummary` below resolves every row by id, so the path index is never read.
+    pathIndex: { byPath: new Map(), byRealPath: new Map() } as never,
+    missingWorktreeIds: new Set(),
+    workingTerminalEvidenceByWorktreeId: new Map(),
+    rowSources: collectRuntimeWorktreeAgentSources({
+      mirroredWorktreeIdByTabId: new Map(),
+      connectedPtyEvidence: {
+        tabIds: new Set(),
+        paneKeys: new Set(),
+        ptyIdByTerminalHandle: new Map()
+      },
+      hookSnapshots
+    }),
+    orchestrationByPaneKey: null,
+    getSummary: (map, _p, _m, id) => map.get(id) ?? null
+  })
+  return { status: hookSnapshots[0], ps: row.agents[0] }
+}
+
+describe('a request that failed reads as failed through the feed, the ingest and worktree ps', () => {
+  it('reads a chat whose only send the agent start refused as failed, not interrupted', async () => {
+    const journal = await openJournal()
+    await journal.appendSubmission({
+      clientMessageId: 'first',
+      payloadFingerprint: 'fp',
+      body: { kind: 'message', role: 'user', blocks: [{ type: 'text', text: 'hello' }] },
+      fence: 1,
+      handoverRecorded: true
+    })
+    await journal.rejectQueuedSubmissions(
+      1,
+      agentSessionFailureWords(agentSessionFailureFact('notSignedIn'), {
+        surface: 'rejection',
+        agentName: 'Claude'
+      })
+    )
+
+    const summary = publishedSummary(journal)
+    expect(summary).toMatchObject({ status: 'idle', turnOutcome: 'failure', latestPrompt: 'hello' })
+    const { status, ps } = ingest(summary)
+    expect(status).toMatchObject({
+      state: 'done',
+      mainAgent: { state: 'done', outcome: 'failure' }
+    })
+    expect(status?.interrupted).not.toBe(true)
+    expect(ps).toMatchObject({
+      state: 'done',
+      mainAgent: { state: 'done', outcome: 'failure' },
+      interrupted: false
+    })
+  })
+
+  it('reads a cancelled structured turn as interrupted for readers that predate the verdict', async () => {
+    const journal = await openJournal()
+    await journal.appendItem(
+      TURN_IDENTITY,
+      {
+        kind: 'turn',
+        turnId: 'turn-1',
+        state: 'interrupted',
+        outcome: 'cancellation',
+        completedAt: 5
+      },
+      { fence: 1 }
+    )
+
+    const { status, ps } = ingest(publishedSummary(journal))
+    expect(status).toMatchObject({ state: 'done', interrupted: true })
+    expect(ps).toMatchObject({
+      mainAgent: { state: 'done', outcome: 'cancellation' },
+      interrupted: true
+    })
+  })
+
+  it('publishes a main agent that failed while its subagent runs, on the row that still works', async () => {
+    const journal = await openJournal()
+    await journal.appendItem(
+      TURN_IDENTITY,
+      { kind: 'turn', turnId: 'turn-1', state: 'completed', outcome: 'failure', completedAt: 5 },
+      { fence: 1 }
+    )
+    const summary: AgentSessionStatusSummary = {
+      ...publishedSummary(journal),
+      backgroundTasks: [{ id: 'child-1', kind: 'agent', state: 'working' }]
+    }
+
+    const { status, ps } = ingest(summary)
+    expect(status).toMatchObject({
+      state: 'working',
+      mainAgent: { state: 'done', outcome: 'failure' }
+    })
+    // The row carries the main agent's own clock, which dates the failure apart from the working row.
+    expect(ps).toMatchObject({
+      state: 'working',
+      mainAgent: {
+        state: 'done',
+        outcome: 'failure',
+        stateStartedAt: status?.mainAgent?.stateStartedAt
+      },
+      interrupted: false
+    })
+  })
+
+  it('lists nothing for a chat whose only send the user withdrew', async () => {
+    const journal = await openJournal()
+    await journal.appendSubmission({
+      clientMessageId: 'first',
+      payloadFingerprint: 'fp',
+      body: { kind: 'message', role: 'user', blocks: [{ type: 'text', text: 'hello' }] },
+      fence: 1,
+      handoverRecorded: true
+    })
+    await journal.rejectQueuedSubmissions(
+      1,
+      agentSessionFailureWords(agentSessionFailureFact('cancelled'), { surface: 'rejection' })
+    )
+
+    expect(publishedSummary(journal)).toMatchObject({ status: null })
+    expect(ingest(publishedSummary(journal)).ps).toBeUndefined()
+  })
+})
diff --git a/src/main/runtime/runtime-worktree-agent-rows.ts b/src/main/runtime/runtime-worktree-agent-rows.ts
index 20c17f9b01a3..310b0f6bc524 100644
--- a/src/main/runtime/runtime-worktree-agent-rows.ts
+++ b/src/main/runtime/runtime-worktree-agent-rows.ts
@@ -60,6 +60,7 @@ export function attachRuntimeWorktreeAgentRows(args: {
       toolName: source.toolName,
       toolInput: source.toolInput,
       interrupted: source.interrupted,
+      ...(source.mainAgent ? { mainAgent: source.mainAgent } : {}),
       stateStartedAt: source.stateStartedAt,
       updatedAt: source.updatedAt,
       ...(source.structuredHost === 'owned' ? { structuredHostOwned: true as const } : {})
diff --git a/src/main/runtime/runtime-worktree-agent-source.ts b/src/main/runtime/runtime-worktree-agent-source.ts
index 984f20e09553..fd98d7914b1d 100644
--- a/src/main/runtime/runtime-worktree-agent-source.ts
+++ b/src/main/runtime/runtime-worktree-agent-source.ts
@@ -1,5 +1,6 @@
 import type { StructuredHostStatus } from '../../shared/agent-hook-listener/listener-event'
 import type { ParsedAgentStatusPayload } from '../../shared/agent-status-types'
+import type { AgentMainAgentStatus } from '../../shared/main-agent-status'
 
 export type RuntimeWorktreeAgentSource = {
   paneKey: string
@@ -15,6 +16,7 @@ export type RuntimeWorktreeAgentSource = {
   toolName: string | null
   toolInput: string | null
   interrupted: boolean
+  mainAgent?: AgentMainAgentStatus
   stateStartedAt: number
   updatedAt: number
   /** Projected by the structured session host; `owned` rows stay fresh past the staleness window. */
diff --git a/src/main/runtime/runtime-worktree-agent-startup.test.ts b/src/main/runtime/runtime-worktree-agent-startup.test.ts
index e901555fa07d..deb2eea281af 100644
--- a/src/main/runtime/runtime-worktree-agent-startup.test.ts
+++ b/src/main/runtime/runtime-worktree-agent-startup.test.ts
@@ -22,6 +22,7 @@ vi.mock('../preflight/agent-detection', () => ({
   detectInstalledAgentsWithShellPathHydration: mocks.detectInstalledAgentsWithShellPathHydration
 }))
 
+import { AGENT_TRUST_WRITE_DEADLINE_MS } from '../agent-trust-write-deadline'
 import {
   buildWorktreeStartupForAgent,
   buildWorktreeStartupForDraft,
@@ -186,4 +187,41 @@ describe('markLocalWorktreeTrusted', () => {
 
     await expect(markLocalWorktreeTrusted('antigravity', '/workspace/app')).resolves.toBeUndefined()
   })
+
+  it('bounds a never-settling Codex trust write instead of holding the launch open', async () => {
+    vi.useFakeTimers()
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+    let release!: () => void
+    const write = new Promise<void>((resolve) => {
+      release = resolve
+    })
+    mocks.markCodexProjectTrusted.mockClear()
+    mocks.markCursorWorkspaceTrusted.mockClear()
+    mocks.markCopilotFolderTrusted.mockClear()
+    mocks.markAntigravityWorkspaceTrusted.mockClear()
+    mocks.markCodexProjectTrusted.mockReturnValueOnce(write)
+    let settled = false
+    const marking = markLocalWorktreeTrusted('codex', '/workspace/app').then(() => {
+      settled = true
+    })
+    try {
+      await vi.advanceTimersByTimeAsync(AGENT_TRUST_WRITE_DEADLINE_MS - 1)
+      expect(settled).toBe(false)
+      await vi.advanceTimersByTimeAsync(2)
+      await marking
+      expect(settled).toBe(true)
+      expect(String(warn.mock.calls[0]?.[0])).toContain('did not settle')
+      expect(vi.getTimerCount()).toBe(0)
+      // Fails closed: giving up writes nothing, retries nothing and never
+      // substitutes another preset's artifact, so Codex still prompts.
+      expect(mocks.markCodexProjectTrusted).toHaveBeenCalledTimes(1)
+      expect(mocks.markCursorWorkspaceTrusted).not.toHaveBeenCalled()
+      expect(mocks.markCopilotFolderTrusted).not.toHaveBeenCalled()
+      expect(mocks.markAntigravityWorkspaceTrusted).not.toHaveBeenCalled()
+    } finally {
+      warn.mockRestore()
+      release()
+      vi.useRealTimers()
+    }
+  })
 })
diff --git a/src/main/runtime/runtime-worktree-agent-startup.ts b/src/main/runtime/runtime-worktree-agent-startup.ts
index f71a81521a70..10f335a4b057 100644
--- a/src/main/runtime/runtime-worktree-agent-startup.ts
+++ b/src/main/runtime/runtime-worktree-agent-startup.ts
@@ -1,3 +1,4 @@
+import { markQoderWorkspaceTrusted } from '../qoder/workspace-trust'
 import type { AgentLaunchPreferences } from '../../shared/agent-session-host-authority'
 import { tuiAgentToAgentKind } from '../../shared/agent-kind'
 import type { Repo } from '../../shared/repo-types'
@@ -16,6 +17,7 @@ import {
   markCopilotFolderTrusted,
   markCursorWorkspaceTrusted
 } from '../agent-trust-presets'
+import { awaitAgentTrustWriteWithinDeadline } from '../agent-trust-write-deadline'
 import {
   detectInstalledAgentsWithShellPathHydration,
   detectRemoteAgents
@@ -194,13 +196,18 @@ export async function markLocalWorktreeTrusted(
     return
   }
   try {
-    if (preset === 'cursor') {
+    if (preset === 'qoder') {
+      markQoderWorkspaceTrusted(workspacePath)
+    } else if (preset === 'cursor') {
       markCursorWorkspaceTrusted(workspacePath)
     } else if (preset === 'copilot') {
       markCopilotFolderTrusted(workspacePath)
     } else if (preset === 'codex') {
-      // Why: the Codex write queues behind any in-flight hook grant, so the agent must not launch until it lands.
-      await markCodexProjectTrusted(workspacePath)
+      // Why: the Codex write queues behind any in-flight hook grant, so the agent must not launch until it lands. Bounded so a wedged lane degrades to the agent's own prompt instead of stalling the launch.
+      await awaitAgentTrustWriteWithinDeadline(markCodexProjectTrusted(workspacePath), {
+        preset,
+        workspacePath
+      })
     } else if (preset === 'antigravity') {
       markAntigravityWorkspaceTrusted(workspacePath)
     }
diff --git a/src/main/runtime/runtime-worktree-pty-agent-sources.ts b/src/main/runtime/runtime-worktree-pty-agent-sources.ts
index 058d378df111..e03f458134f2 100644
--- a/src/main/runtime/runtime-worktree-pty-agent-sources.ts
+++ b/src/main/runtime/runtime-worktree-pty-agent-sources.ts
@@ -4,6 +4,7 @@ import {
   type ParsedAgentStatusPayload
 } from '../../shared/agent-status-types'
 import { parseLegacyNumericPaneKey, parsePaneKey } from '../../shared/stable-pane-id'
+import { agentVerdictFields } from '../../shared/agent-main-agent-verdict'
 import { isWslHookRelayConnectionId } from '../../shared/wsl-hook-relay-contract'
 import type { RuntimeWorktreeAgentSource } from './runtime-worktree-agent-source'
 
@@ -47,7 +48,8 @@ export function collectRuntimeWorktreePtyAgentSources(args: {
       lastAssistantMessage: entry.lastAssistantMessage ?? null,
       toolName: entry.toolName ?? null,
       toolInput: entry.toolInput ?? null,
-      interrupted: entry.interrupted ?? false,
+      interrupted: false,
+      ...agentVerdictFields(entry),
       stateStartedAt: entry.stateStartedAt,
       // A replay advances delivery order, not the age of the evidence shown by worktree.ps.
       updatedAt: entry.evidenceObservedAt ?? entry.receivedAt,
diff --git a/src/main/runtime/runtime-worktree-startup-readiness.test.ts b/src/main/runtime/runtime-worktree-startup-readiness.test.ts
new file mode 100644
index 000000000000..e96a072f7ed2
--- /dev/null
+++ b/src/main/runtime/runtime-worktree-startup-readiness.test.ts
@@ -0,0 +1,71 @@
+import { readFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import {
+  waitForWorktreeStartupDraft,
+  type WorktreeStartupReadinessHost
+} from './runtime-worktree-startup-readiness'
+
+describe('fresh worker composer readiness', () => {
+  afterEach(() => vi.useRealTimers())
+
+  function fixture(replay?: string) {
+    let listener = (_data: string): void => {}
+    const unsubscribe = vi.fn()
+    const host: WorktreeStartupReadinessHost = {
+      getPtyId: () => 'pty-1',
+      getForegroundProcess: async () => 'zcode',
+      subscribeToData: (_ptyId, onData) => {
+        listener = onData
+        return unsubscribe
+      },
+      readRecentOutput: () => replay,
+      write: vi.fn()
+    }
+    return { host, emit: (data: string) => listener(data), unsubscribe }
+  }
+
+  it('accepts the captured composer while the banner continues repainting', async () => {
+    vi.useFakeTimers()
+    const h = fixture()
+    const pending = waitForWorktreeStartupDraft(h.host, 'term-1', 'zcode', {
+      timeoutMs: 45_000,
+      requireComposerMarker: true
+    })
+    const data = readFileSync(join(__dirname, '__fixtures__', 'zcode-composer-ready.txt'), 'utf8')
+    for (let offset = 0; offset < data.length; offset += 4096) {
+      h.emit(data.slice(offset, offset + 4096))
+    }
+    await expect(pending).resolves.toBe('pty-1')
+    expect(h.unsubscribe).toHaveBeenCalledOnce()
+    expect(h.host.write).not.toHaveBeenCalled()
+    expect(vi.getTimerCount()).toBe(0)
+  })
+
+  it('cleans up the deadline when the composer was already captured', async () => {
+    vi.useFakeTimers()
+    const h = fixture('\x1b[?1049h╭')
+    await expect(
+      waitForWorktreeStartupDraft(h.host, 'term-1', 'zcode', {
+        timeoutMs: 45_000,
+        requireComposerMarker: true
+      })
+    ).resolves.toBe('pty-1')
+    expect(h.unsubscribe).toHaveBeenCalledOnce()
+    expect(vi.getTimerCount()).toBe(0)
+  })
+
+  it('does not accept shell decoration or a square startup dialog', async () => {
+    vi.useFakeTimers()
+    const h = fixture('╭ shell\n\x1b[?1049h\x1b[?2004h┌ Sign in ┐')
+    const pending = waitForWorktreeStartupDraft(h.host, 'term-1', 'zcode', {
+      timeoutMs: 45_000,
+      requireComposerMarker: true
+    })
+    await vi.advanceTimersByTimeAsync(44_999)
+    expect(h.unsubscribe).not.toHaveBeenCalled()
+    await vi.advanceTimersByTimeAsync(1)
+    await expect(pending).resolves.toBeNull()
+    expect(h.unsubscribe).toHaveBeenCalledOnce()
+  })
+})
diff --git a/src/main/runtime/runtime-worktree-startup-readiness.ts b/src/main/runtime/runtime-worktree-startup-readiness.ts
index 77b4e1315db7..779f16ec6a40 100644
--- a/src/main/runtime/runtime-worktree-startup-readiness.ts
+++ b/src/main/runtime/runtime-worktree-startup-readiness.ts
@@ -4,6 +4,7 @@ import { createDraftPasteReadyScanner } from '../../shared/draft-paste-ready-sca
 import { resolveDraftPasteReadyTimeoutMs } from '../../shared/draft-paste-ready-timeout'
 import { TUI_AGENT_CONFIG } from '../../shared/tui-agent-config'
 import type { TuiAgent } from '../../shared/tui-agent'
+import type { TerminalInputKind } from '../../shared/terminal-input-kind'
 import type {
   WorktreeStartupDraftPaste,
   WorktreeStartupFollowup
@@ -19,7 +20,7 @@ export type WorktreeStartupReadinessHost = {
   hasChildProcesses?: (ptyId: string) => Promise<boolean>
   subscribeToData: (ptyId: string, listener: (data: string) => void) => () => void
   readRecentOutput: (ptyId: string) => string | undefined
-  write: (ptyId: string, data: string) => void
+  write: (ptyId: string, data: string, inputKind: TerminalInputKind) => void
 }
 
 export function pasteWorktreeStartupDraftWhenReady(
@@ -33,7 +34,7 @@ export function pasteWorktreeStartupDraftWhenReady(
         console.warn('[worktree-create] agent did not become ready for draft paste')
         return
       }
-      host.write(ptyId, `${BRACKETED_PASTE_BEGIN}${draft.content}${BRACKETED_PASTE_END}`)
+      host.write(ptyId, `${BRACKETED_PASTE_BEGIN}${draft.content}${BRACKETED_PASTE_END}`, 'launch')
     })
     .catch((error) => console.warn('[worktree-create] failed to paste startup draft:', error))
 }
@@ -49,7 +50,7 @@ export function sendWorktreeStartupFollowupWhenReady(
         console.warn('[worktree-create] agent did not become ready for follow-up prompt')
         return
       }
-      host.write(ptyId, `${followup.prompt}\r`)
+      host.write(ptyId, `${followup.prompt}\r`, 'launch')
     })
     .catch((error) =>
       console.warn('[worktree-create] failed to send startup follow-up prompt:', error)
@@ -89,7 +90,8 @@ export async function waitForWorktreeStartupFollowup(
 export function waitForWorktreeStartupDraft(
   host: WorktreeStartupReadinessHost,
   handle: string,
-  agent: TuiAgent
+  agent: TuiAgent,
+  options: { timeoutMs?: number; requireComposerMarker?: boolean } = {}
 ): Promise<string | null> {
   const ptyId = host.getPtyId(handle)
   if (!ptyId) {
@@ -118,11 +120,14 @@ export function waitForWorktreeStartupDraft(
       resolve(value)
     }
     const observe = (data: string): void => {
+      if (settled) {
+        return
+      }
       const result = scanner.observe(data)
       if (result.ready) {
         return finish(ptyId)
       }
-      if (result.armQuietTimer) {
+      if (result.armQuietTimer && !options.requireComposerMarker) {
         if (quietTimer) {
           clearTimeout(quietTimer)
         }
@@ -130,10 +135,13 @@ export function waitForWorktreeStartupDraft(
       }
     }
     unsubscribe = host.subscribeToData(ptyId, observe)
+    hardTimer = setTimeout(
+      () => finish(null),
+      options.timeoutMs ?? resolveDraftPasteReadyTimeoutMs(agent)
+    )
     const replay = host.readRecentOutput(ptyId)
     if (replay) {
       observe(replay)
     }
-    hardTimer = setTimeout(() => finish(null), resolveDraftPasteReadyTimeoutMs(agent))
   })
 }
diff --git a/src/main/runtime/runtime-worktree-structured-agent-rows-liveness.test.ts b/src/main/runtime/runtime-worktree-structured-agent-rows-liveness.test.ts
index b1e43a9025d2..27d5ba48b299 100644
--- a/src/main/runtime/runtime-worktree-structured-agent-rows-liveness.test.ts
+++ b/src/main/runtime/runtime-worktree-structured-agent-rows-liveness.test.ts
@@ -89,7 +89,7 @@ async function awaitingApproval() {
       SESSION,
       {
         journal,
-        hasProviderChild: true,
+        child: { phase: 'ready' as const },
         params: {
           location: {
             executionHostId: 'local' as const,
diff --git a/src/main/runtime/structured-agent-session-close.test.ts b/src/main/runtime/structured-agent-session-close.test.ts
index 531ca0aa129b..948bb01cce2d 100644
--- a/src/main/runtime/structured-agent-session-close.test.ts
+++ b/src/main/runtime/structured-agent-session-close.test.ts
@@ -19,6 +19,7 @@ vi.mock('../native-chat/agent-session-wire/structured-agent-session-registry', (
 const { closeStructuredAgentSessionChild } = await import('./structured-agent-session-close')
 
 const SESSION = 'session-1'
+const TAB_ID = 'tab-of-session-1'
 
 function record(sessionId: string): AgentSessionRecord {
   return {
@@ -85,14 +86,18 @@ function installHost(options: HostOptions = {}) {
     }
   })
   hostRef.current = {
-    deps: { store: { getRecord: (id: string) => (id === SESSION ? entry : null) } },
-    hasSession: (sessionId: string) => held.has(sessionId),
-    getPersistedVisibleSessionTabIndex: () => {
-      if (options.indexThrows) {
-        throw new Error('visible tab index unreadable')
+    deps: {
+      store: {
+        getRecord: (id: string) => (id === SESSION ? entry : null),
+        getSessionTabId: (id: string) => {
+          if (options.indexThrows) {
+            throw new Error('visible tab index unreadable')
+          }
+          return visible.has(id) ? TAB_ID : null
+        }
       }
-      return { present: true, sessionIds: [...visible] }
     },
+    hasSession: (sessionId: string) => held.has(sessionId),
     setSessionTabVisibility,
     close
   }
@@ -133,7 +138,7 @@ describe('closeStructuredAgentSessionChild tab-visibility rollback', () => {
     expect(host.visible.has(SESSION)).toBe(true)
     expect(host.setSessionTabVisibility.mock.calls).toEqual([
       [SESSION, false],
-      [SESSION, true]
+      [SESSION, true, TAB_ID]
     ])
   })
 
@@ -147,7 +152,7 @@ describe('closeStructuredAgentSessionChild tab-visibility rollback', () => {
     expect(host.visible.has(SESSION)).toBe(true)
     expect(host.setSessionTabVisibility.mock.calls).toEqual([
       [SESSION, false],
-      [SESSION, true]
+      [SESSION, true, TAB_ID]
     ])
   })
 
diff --git a/src/main/runtime/structured-agent-session-close.ts b/src/main/runtime/structured-agent-session-close.ts
index f65d1204db9b..668b7f218903 100644
--- a/src/main/runtime/structured-agent-session-close.ts
+++ b/src/main/runtime/structured-agent-session-close.ts
@@ -3,8 +3,8 @@
  *
  * Extracted from `stopStructuredWorker` so that orchestration settlement and worktree teardown
  * close a session the SAME way rather than one of them inventing a shorter version. Everything
- * dispatch-shaped — dropping the hold, the redrive subscription and the parked mail — stays with
- * the caller that has a dispatch; this is only the child.
+ * dispatch-shaped — dropping the redrive subscription, the registry entry and the parked mail —
+ * stays with the caller that has a dispatch; this is only the child.
  *
  * `host.close` returns void and keeps a failed close indexed for retry, so the only settlement
  * evidence is the observation AFTER it: a session the host no longer holds and whose lease is no
@@ -15,7 +15,10 @@ import type { StructuredAgentSessionHost } from '../native-chat/agent-session-wi
 import { getStructuredAgentSessionHost } from '../native-chat/agent-session-wire/structured-agent-session-registry'
 import type { OrcaRuntimeService } from './orca-runtime'
 import { retireSettledStructuredWorkerTab } from './structured-agent-session-tab-retirement'
-import { observeStructuredWorker } from './structured-worker-authority'
+import {
+  observeStructuredWorker,
+  structuredSessionCloseSettled
+} from './structured-worker-authority'
 
 export type StructuredAgentSessionCloseOutcome = {
   stopped: boolean
@@ -32,8 +35,8 @@ export type StructuredAgentSessionCloseOptions = {
   /**
    * Runs after the close is issued and BEFORE the proof is read.
    *
-   * Not after: an unsettled close returns early, so a dispatch that released its hold there would
-   * keep the child un-evictable for the life of the app. Every settlement has to reach it.
+   * Not after: an unsettled close returns early, so a dispatch released there would keep its
+   * redrive subscription nudging a session no dispatch owns. Every settlement has to reach it.
    */
   afterClose?: () => void
   /**
@@ -60,11 +63,11 @@ export async function closeStructuredAgentSessionChild(
       reason: 'The structured agent-session host is not installed; no session was closed.'
     }
   }
-  // Read BEFORE the hide, so a rollback puts the tab back exactly as it was. Restoring
-  // unconditionally would publish a tab for a session that was already hidden — a worker started
-  // without a chat tab, or one the user had closed — which is a new side effect, not an undo.
+  // Read BEFORE the hide, so a rollback puts the tab back exactly as it was, under the same id.
+  // Restoring unconditionally would publish a tab for a session that was already hidden — a worker
+  // started without a chat tab, or one the user had closed — which is a new side effect, not an undo.
   const restoreTabIfCloseFails =
-    options.restoreTabOnUnprovenClose !== false && readPersistedTabVisibility(host, sessionId)
+    options.restoreTabOnUnprovenClose !== false ? readPersistedTabId(host, sessionId) : null
   // Set only once the close is actually issued: `setSessionTabVisibility` throwing first leaves a
   // running child, and a receipt that still said `closed_agent_terminal` for it would be the
   // close-that-never-happened this flag exists to rule out.
@@ -86,8 +89,8 @@ export async function closeStructuredAgentSessionChild(
     }
   }
   options.afterClose?.()
-  const observation = observeStructuredWorker({ sessionId })
-  if (observation.status !== 'exited') {
+  if (!structuredSessionCloseSettled(sessionId)) {
+    const observation = observeStructuredWorker({ sessionId })
     await restorePersistedTabVisibility(host, sessionId, restoreTabIfCloseFails)
     return {
       stopped: false,
@@ -101,13 +104,13 @@ export async function closeStructuredAgentSessionChild(
   return { stopped: true, closeAttempted: true }
 }
 
-function readPersistedTabVisibility(host: StructuredAgentSessionHost, sessionId: string): boolean {
+function readPersistedTabId(host: StructuredAgentSessionHost, sessionId: string): string | null {
   try {
-    return host.getPersistedVisibleSessionTabIndex?.().sessionIds.includes(sessionId) ?? false
+    return host.deps.store.getSessionTabId(sessionId)
   } catch {
     // Unreadable index: claim nothing. A rollback that cannot prove the tab was visible must not
     // publish one, for the same reason the read exists at all.
-    return false
+    return null
   }
 }
 
@@ -135,13 +138,13 @@ function readPersistedTabVisibility(host: StructuredAgentSessionHost, sessionId:
 async function restorePersistedTabVisibility(
   host: StructuredAgentSessionHost,
   sessionId: string,
-  restoreTab: boolean
+  tabId: string | null
 ): Promise<void> {
-  if (!restoreTab || observeStructuredWorker({ sessionId }).status === 'exited') {
+  if (tabId === null || structuredSessionCloseSettled(sessionId)) {
     return
   }
   try {
-    await host.setSessionTabVisibility?.(sessionId, true)
+    await host.setSessionTabVisibility?.(sessionId, true, tabId)
   } catch (error) {
     console.warn(
       `[structured-session-close] could not restore the chat tab for ${sessionId} after a failed close`,
diff --git a/src/main/runtime/structured-agent-session-integration-replay.test.ts b/src/main/runtime/structured-agent-session-integration-replay.test.ts
index 4fa390be0fb9..a4e2500ffc46 100644
--- a/src/main/runtime/structured-agent-session-integration-replay.test.ts
+++ b/src/main/runtime/structured-agent-session-integration-replay.test.ts
@@ -317,11 +317,14 @@ describe('a structured codex session over agentSession.*', () => {
       body
     }
 
+    const turnStarts = () => codex.live().calls.filter((entry) => entry.method === 'turn/start')
     await ok('agentSession.send', params)
+    // Accepted first; the delivery loop hands it over once.
+    await vi.waitFor(() => expect(turnStarts()).toHaveLength(1))
     const replay = await call('agentSession.send', params)
 
     expect(replay).toMatchObject({ ok: true, result: { ok: true, replayed: true } })
-    expect(codex.live().calls.filter((entry) => entry.method === 'turn/start')).toHaveLength(1)
+    expect(turnStarts()).toHaveLength(1)
   })
 
   it('joins an acquired attach through journal bind before draining final rows', async () => {
diff --git a/src/main/runtime/structured-agent-session-integration.test.ts b/src/main/runtime/structured-agent-session-integration.test.ts
index 3f8adae4906a..1b7136a996df 100644
--- a/src/main/runtime/structured-agent-session-integration.test.ts
+++ b/src/main/runtime/structured-agent-session-integration.test.ts
@@ -218,6 +218,11 @@ function createIntentParams() {
 }
 
 let codex: CodexScript
+/** Accepted first; the delivery loop hands the send over as `turn/start` after the reply. */
+const handedOverAs = (params: Record<string, unknown>) =>
+  vi.waitFor(() =>
+    expect(codex.live().calls.at(-1)).toMatchObject({ method: 'turn/start', params })
+  )
 let root: string
 let dispatcher: RpcDispatcher
 let bootEnvironmentReads: number
@@ -284,10 +289,10 @@ function textOf(item: AgentJournalRenderItem): string {
 }
 
 /** The durable submission row, which settlement rewrites after the send returns. */
-function submissionOf(clientMessageId: string): AgentJournalSubmission | undefined {
-  return getStructuredAgentSessionHost()
-    ?.journalSnapshot(SESSION)
-    .submissions.find((entry) => entry.clientMessageId === clientMessageId)
+async function submissionOf(clientMessageId: string): Promise<AgentJournalSubmission | undefined> {
+  return (await getStructuredAgentSessionHost()?.journalSnapshot(SESSION))?.submissions.find(
+    (entry) => entry.clientMessageId === clientMessageId
+  )
 }
 
 async function historyPage(
@@ -466,10 +471,7 @@ describe('a structured codex session over agentSession.*', () => {
     // send coalesced into a running turn is answered with that turn's id, so
     // which message landed where is knowable only from the echo.
     expect(sent.submission).toMatchObject({ dispatchState: 'pending', providerItemId: null })
-    expect(codex.live().calls.at(-1)).toMatchObject({
-      method: 'turn/start',
-      params: { threadId: THREAD, clientUserMessageId: sent.clientMessageId }
-    })
+    await handedOverAs({ threadId: THREAD, clientUserMessageId: sent.clientMessageId })
 
     codex.notify('turn/started', { turn: { id: TURN } })
     // Codex echoes the message back carrying the `clientId` it was sent under,
@@ -493,8 +495,8 @@ describe('a structured codex session over agentSession.*', () => {
     // The echo is the first item of this turn, so the settled key is ordinal 0 —
     // minted by the same `identityFor` a history replay computes with, rather
     // than guessed from the turn/start response.
-    await vi.waitFor(() =>
-      expect(submissionOf(sent.clientMessageId)).toMatchObject({
+    await vi.waitFor(async () =>
+      expect(await submissionOf(sent.clientMessageId)).toMatchObject({
         dispatchState: 'accepted',
         providerItemId: `codex:${THREAD}:${TURN}:0`
       })
@@ -557,14 +559,11 @@ describe('a structured codex session over agentSession.*', () => {
     // "delivery unconfirmed" — it carries no identity yet, because the response
     // to a coalesced send names the running turn rather than this message.
     expect(sent.submission).toMatchObject({ dispatchState: 'pending', providerItemId: null })
-    expect(codex.live().calls.at(-1)).toMatchObject({
-      method: 'turn/start',
-      params: {
-        threadId: THREAD,
-        clientUserMessageId: sent.clientMessageId,
-        model: 'gpt-live',
-        effort: 'high'
-      }
+    await handedOverAs({
+      threadId: THREAD,
+      clientUserMessageId: sent.clientMessageId,
+      model: 'gpt-live',
+      effort: 'high'
     })
 
     // ── stream ──────────────────────────────────────────────────────────────
@@ -585,8 +584,8 @@ describe('a structured codex session over agentSession.*', () => {
     expect(itemsOf(stream).filter((item) => textOf(item) === 'list files')).toHaveLength(1)
     // Settled from the echo's own journal identity, so it is by construction the
     // key a replay recomputes for this row.
-    await vi.waitFor(() =>
-      expect(submissionOf(sent.clientMessageId)).toMatchObject({
+    await vi.waitFor(async () =>
+      expect(await submissionOf(sent.clientMessageId)).toMatchObject({
         dispatchState: 'accepted',
         providerItemId: `codex:${THREAD}:${TURN}:0`
       })
diff --git a/src/main/runtime/structured-agent-session-owner-probe.ts b/src/main/runtime/structured-agent-session-owner-probe.ts
index 47f92a08ca6c..d42959bcd280 100644
--- a/src/main/runtime/structured-agent-session-owner-probe.ts
+++ b/src/main/runtime/structured-agent-session-owner-probe.ts
@@ -10,8 +10,7 @@ import { readEchoedAgentSessionSpawnToken } from './agent-session-spawn-token-re
 
 /**
  * The lease's only source of truth about a previous owner. Everything it cannot
- * answer PID-reuse-safely reports `indeterminate`. An exact owner stays fenced in `recovering`;
- * an ownerless, unattributable reservation enters `manual-recovery`.
+ * answer PID-reuse-safely reports `indeterminate`, and recovery resolution concludes from there.
  */
 export function createStructuredAgentSessionOwnerProbe(
   hostId: string,
@@ -21,9 +20,6 @@ export function createStructuredAgentSessionOwnerProbe(
   return async (record) => {
     const owner = record.lease.ownerProcess
     if (!owner) {
-      if (record.lease.processlessAt !== undefined && record.lease.processlessAt !== null) {
-        return { outcome: 'reservation-unused' }
-      }
       const spawnToken = record.lease.reservedSpawnToken
       if (spawnToken === null) {
         if (record.lease.claimStatus === 'reserved') {
diff --git a/src/main/runtime/structured-agent-session-runtime-exit.test.ts b/src/main/runtime/structured-agent-session-runtime-exit.test.ts
index 7a3736b9009b..3da0c6f203d2 100644
--- a/src/main/runtime/structured-agent-session-runtime-exit.test.ts
+++ b/src/main/runtime/structured-agent-session-runtime-exit.test.ts
@@ -32,7 +32,7 @@ describe('structured session runtime provider-exit wiring', () => {
     }
   })
 
-  it('reacquires through the production callback and accepts a distinct next message', async () => {
+  it('does not respawn after a provider exit, and the next message starts a new child', async () => {
     root = await mkdtemp(join(tmpdir(), 'orca-runtime-provider-exit-'))
     operations = 0
     const connections: {
@@ -98,16 +98,17 @@ describe('structured session runtime provider-exit wiring', () => {
         JSON.stringify({ refusal: attached.refusal, connections: connections.length })
       )
     }
-    await host.hold(SESSION, 'desktop-chat:1')
-    const exitedFence = host.deps.store.getRecord(SESSION)?.lease.runtimeFence ?? 0
     const exited = connections[0]
     exited?.handlers.onExit?.(new Error('scripted provider exit'))
-
-    await vi.waitFor(() => expect(connections).toHaveLength(2))
+    await vi.waitFor(() =>
+      expect(host.deps.store.getRecord(SESSION)?.lease.claimStatus).toBe('released')
+    )
+    // Nothing restarts the child on its own; the exit is shown and the chat waits for a send.
+    await new Promise<void>((resolve) => setTimeout(resolve, 50))
+    expect(connections).toHaveLength(1)
     const recoveredFence = host.deps.store.getRecord(SESSION)?.lease.runtimeFence
-    expect(recoveredFence).toBeGreaterThan(exitedFence)
     if (recoveredFence === undefined) {
-      throw new Error('recovered lease omitted its fence')
+      throw new Error('released lease omitted its fence')
     }
     const body = hostTestMessage('continue with a distinct message')
     const envelope = {
@@ -128,7 +129,9 @@ describe('structured session runtime provider-exit wiring', () => {
     await expect(
       host.send({ callerKey: 'runtime-test' }, { envelope, body })
     ).resolves.toMatchObject({ ok: true, value: { submission: { dispatchState: 'pending' } } })
-    expect(turn).toBe(1)
+    // The send answers at acceptance; the delivery loop starts a new child and hands it over.
+    await vi.waitFor(() => expect(connections).toHaveLength(2))
+    await vi.waitFor(() => expect(turn).toBe(1))
   })
 
   it('does not reacquire when the production exit callback comes from a requested close', async () => {
@@ -199,7 +202,6 @@ describe('structured session runtime provider-exit wiring', () => {
         JSON.stringify({ refusal: attached.refusal, connections: connections.length })
       )
     }
-    await host.hold(SESSION, 'desktop-chat:requested-close')
 
     await stopStructuredAgentSessionRuntime()
     await new Promise<void>((resolve) => setImmediate(resolve))
@@ -223,7 +225,7 @@ describe('structured session runtime provider-exit wiring', () => {
       readProcessStartTime: async () => 1_700_000_000_000
     })
     await restarted.restoreReadableSessions()
-    const history = restarted.history({ sessionId: SESSION, direction: 'tail' })
+    const history = await restarted.history({ sessionId: SESSION, direction: 'tail' })
     expect(history.ok && history.page.items.some((item) => item.body.kind === 'status')).toBe(false)
     expect(restarted.deps.store.getRecord(SESSION)?.providerHandleChain.at(-1)?.handle).toEqual({
       provider: 'codex',
@@ -231,7 +233,7 @@ describe('structured session runtime provider-exit wiring', () => {
     })
   })
 
-  it('waits for an in-flight recovery before tearing down the runtime', async () => {
+  it('waits for a start a send began before tearing down the runtime', async () => {
     root = await mkdtemp(join(tmpdir(), 'orca-runtime-recovery-shutdown-'))
     let releaseRecovery!: () => void
     const recoveryReleased = new Promise<void>((resolve) => {
@@ -300,8 +302,28 @@ describe('structured session runtime provider-exit wiring', () => {
     attachParams.envelope.clientOperationId = operationId()
     const attached = await host.attach({ callerKey: 'runtime-test' }, attachParams)
     expect(attached.ok).toBe(true)
-    await host.hold(SESSION, 'desktop-chat:shutdown-race')
-    connections[0]?.handlers.onExit?.(new Error('recovery is still opening'))
+    connections[0]?.handlers.onExit?.(new Error('the first child exited'))
+    await vi.waitFor(() =>
+      expect(host.deps.store.getRecord(SESSION)?.lease.claimStatus).toBe('released')
+    )
+    const body = hostTestMessage('start again')
+    await host.send(
+      { callerKey: 'runtime-test' },
+      {
+        envelope: {
+          sessionId: SESSION,
+          clientOperationId: operationId(),
+          expectedRuntimeFence: host.deps.store.getRecord(SESSION)?.lease.runtimeFence ?? 0,
+          payloadFingerprint: computeAgentSessionPayloadFingerprint({
+            method: 'agentSession.send',
+            sessionId: SESSION,
+            fields: { body }
+          })
+        },
+        body
+      }
+    )
+    // The send's start is still opening its connection when the quit begins.
     await vi.waitFor(() => expect(opens).toBe(2))
 
     let stopped = false
@@ -387,7 +409,6 @@ describe('structured session runtime provider-exit wiring', () => {
     expect(await host.attach({ callerKey: 'runtime-test' }, attachParams)).toMatchObject({
       ok: true
     })
-    await host.hold(SESSION, 'desktop-chat:backstop')
 
     await expect(stopStructuredAgentSessionRuntime()).rejects.toThrow()
     await new Promise<void>((resolve) => setImmediate(resolve))
@@ -396,7 +417,7 @@ describe('structured session runtime provider-exit wiring', () => {
     expect(closeAttempts).toBeGreaterThanOrEqual(2)
     // The callback it delivered neither reacquired nor wrote a technical row.
     expect(connections).toHaveLength(1)
-    const history = host.history({ sessionId: SESSION, direction: 'tail' })
+    const history = await host.history({ sessionId: SESSION, direction: 'tail' })
     expect(history.ok && history.page.items.some((item) => item.body.kind === 'status')).toBe(false)
 
     // The aborted eviction left the session reachable, so the next teardown is a real retry.
diff --git a/src/main/runtime/structured-agent-session-runtime-provider-started.test.ts b/src/main/runtime/structured-agent-session-runtime-provider-started.test.ts
index 602507ef4d7e..91bf91738b5b 100644
--- a/src/main/runtime/structured-agent-session-runtime-provider-started.test.ts
+++ b/src/main/runtime/structured-agent-session-runtime-provider-started.test.ts
@@ -1,5 +1,5 @@
-// A Claude child proving its start must not wait on another session's exit recovery, and must
-// not make that recovery, or the session's own serialized operations, wait on the CLI: the host
+// A Claude child proving its start must not wait on another session's start, and must not make
+// that start, or the session's own serialized operations, wait on the CLI: the host
 // records what the child proved from what the adapter already holds.
 
 import { afterEach, describe, expect, it, vi } from 'vitest'
@@ -18,7 +18,7 @@ afterEach(async () => {
 })
 
 describe('a Claude child proving its start', () => {
-  it("never holds another session's exit recovery, or its own close, on a CLI read", async () => {
+  it("never holds another session's start, or its own close, on a CLI read", async () => {
     claude.behave(STALLED, { stallsControlReads: true })
     const host = await claude.install()
 
@@ -56,23 +56,15 @@ describe('a Claude child proving its start', () => {
     await vi.waitFor(() => expect(closed).toBe(true))
   })
 
-  it("flips to ready while another session's exit recovery is still acquiring", async () => {
+  it("flips to ready while another session's start is still acquiring", async () => {
     const host = await claude.install()
-    await expect(host.attach(CALLER, claude.attachParams(HEALTHY, null))).resolves.toMatchObject({
-      ok: true
-    })
-    await host.hold(HEALTHY, 'surface-1')
-    await waitForStructuredAgentSessionRecovery()
-
-    // Its exit recovery reacquires, and that spawn never returns. The exit hands the lease back
-    // and the restart queued behind it reserves it again at once, so `released` is not a state a
-    // poll can count on seeing; `reserved` with the spawn hanging is what "still acquiring" is.
+    // This start never returns from its spawn, so its lease stays reserved with no child.
     claude.behave(HEALTHY, { spawnHangs: true })
-    claude.child(HEALTHY).exit(new Error('claude stream-json exited (code 1): crashed'))
+    void host.attach(CALLER, claude.attachParams(HEALTHY, null)).catch(() => undefined)
     await vi.waitFor(() =>
       expect(host.deps.store.getRecord(HEALTHY)?.lease.claimStatus).toBe('reserved')
     )
-    expect(claude.children(HEALTHY)).toHaveLength(1)
+    const childrenWhileHung = claude.children(HEALTHY).length
 
     await expect(host.attach(CALLER, claude.attachParams(STALLED, null))).resolves.toMatchObject({
       ok: true
@@ -83,9 +75,9 @@ describe('a Claude child proving its start', () => {
         effort: 'high'
       })
     )
-    // The other recovery is still where it was: reserved, with no child yet.
+    // The other start is still where it was: reserved, with no new child.
     expect(host.deps.store.getRecord(HEALTHY)?.lease.claimStatus).toBe('reserved')
-    expect(claude.children(HEALTHY)).toHaveLength(1)
+    expect(claude.children(HEALTHY)).toHaveLength(childrenWhileHung)
   })
 
   it('is drained by the runtime before teardown proceeds', async () => {
diff --git a/src/main/runtime/structured-agent-session-runtime.test.ts b/src/main/runtime/structured-agent-session-runtime.test.ts
index 6b612c73d460..7749fc3c25b0 100644
--- a/src/main/runtime/structured-agent-session-runtime.test.ts
+++ b/src/main/runtime/structured-agent-session-runtime.test.ts
@@ -191,17 +191,6 @@ describe('structured agent-session owner probe', () => {
 
     expect(result.outcome).toBe('indeterminate')
   })
-
-  it('releases only a reservation carrying durable pre-spawn proof', async () => {
-    const probe = deadProbe()
-    const result = await createStructuredAgentSessionOwnerProbe(
-      HOST_ID,
-      probe
-    )(record(null, { processlessAt: 1_800_000_000_000, claimStatus: 'reserved' }))
-
-    expect(probe).not.toHaveBeenCalled()
-    expect(result).toEqual({ outcome: 'reservation-unused' })
-  })
 })
 
 describe('structured agent-session runtime install', () => {
diff --git a/src/main/runtime/structured-agent-session-runtime.ts b/src/main/runtime/structured-agent-session-runtime.ts
index a51da3f1c3c6..e6b458eb2602 100644
--- a/src/main/runtime/structured-agent-session-runtime.ts
+++ b/src/main/runtime/structured-agent-session-runtime.ts
@@ -104,6 +104,8 @@ export type StructuredAgentSessionRuntimeDeps = {
   onSessionStatusChanged?: StructuredAgentSessionHostDeps['onSessionStatusChanged']
   /** The agent-status store; see `StructuredAgentSessionHostDeps.statusSink`. */
   statusSink?: StructuredAgentSessionHostDeps['statusSink']
+  /** See `StructuredAgentSessionHostDeps.hasOpenDispatch`. */
+  hasOpenDispatch?: StructuredAgentSessionHostDeps['hasOpenDispatch']
   reapOrphanChildren?: typeof stopOrphanAgentSessionChildren
   /** The account home a structured launch would pin right now, for catalog
    *  reads with no session record. Absent disables the catalog surface. */
@@ -312,6 +314,7 @@ async function install(deps: StructuredAgentSessionRuntimeDeps): Promise<Install
       deps.onError?.({ scope: `structured-agent-session-journal:${sessionId}`, error }),
     ...(deps.onSessionStatusChanged ? { onSessionStatusChanged: deps.onSessionStatusChanged } : {}),
     ...(deps.statusSink ? { statusSink: deps.statusSink } : {}),
+    ...(deps.hasOpenDispatch ? { hasOpenDispatch: deps.hasOpenDispatch } : {}),
     ...(await modelCatalogHostDeps({ store, deps, envResolvers }))
   })
   setStructuredAgentSessionHost(host)
diff --git a/src/main/runtime/structured-claude-runtime-adapter.ts b/src/main/runtime/structured-claude-runtime-adapter.ts
index b0cb51eb1830..4160b81c4dea 100644
--- a/src/main/runtime/structured-claude-runtime-adapter.ts
+++ b/src/main/runtime/structured-claude-runtime-adapter.ts
@@ -60,12 +60,10 @@ export function structuredClaudeLifecycleEvent(
       type: 'ended',
       sessionId: event.sessionId,
       reason: event.reason,
+      ...(event.failure ? { failure: event.failure } : {}),
       cause: event.cause,
       fence: event.fence,
       acquisitionGeneration: event.acquisitionGeneration,
-      ...(event.settlementRetryRequired
-        ? { settlementRetryRequired: event.settlementRetryRequired }
-        : {}),
       ...(event.startupUnproven ? { startupUnproven: event.startupUnproven } : {})
     }
   }
diff --git a/src/main/runtime/structured-claude-scripted-runtime-test-support.ts b/src/main/runtime/structured-claude-scripted-runtime-test-support.ts
index af1bc9a4af71..33aa18f05706 100644
--- a/src/main/runtime/structured-claude-scripted-runtime-test-support.ts
+++ b/src/main/runtime/structured-claude-scripted-runtime-test-support.ts
@@ -1,6 +1,7 @@
 // A structured-session runtime whose Claude children are scripted: the production runtime,
 // adapter, record store and host, with only the CLI process replaced.
 
+import { providerDiagnostic, withProviderDiagnostic } from '../../shared/agent-session-failure'
 import { mkdir, mkdtemp, rm } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
@@ -20,6 +21,10 @@ import {
   stopStructuredAgentSessionRuntime
 } from './structured-agent-session-runtime'
 
+/** The error a real CLI's exit reaches the adapter as: Orca's message, the stderr as a log detail. */
+export function scriptedClaudeExitError(diagnostic: string): Error {
+  return withProviderDiagnostic(new Error(diagnostic), providerDiagnostic(diagnostic, 'log'))
+}
 export type ScriptedClaudeBehavior = {
   /** Initialize never answers; only the child's exit settles it. */
   initHangs?: boolean
@@ -37,6 +42,11 @@ export type ScriptedClaudeBehavior = {
   optionWritesHang?: boolean
   /** Startup's own settings read goes unanswered. */
   startupSettingsReadHangs?: boolean
+  /** Every option write loses its answer while the CLI keeps running (not a refusal), so a
+   *  start that restores one faults. */
+  optionWritesFail?: boolean
+  /** The init frame names another provider session than the one launched. */
+  initNamesForeignSession?: boolean
 }
 
 export type ScriptedClaudeChild = {
@@ -86,7 +96,13 @@ export function createScriptedClaudeRuntime(sessionIds: readonly string[]) {
     const never = <T>(): Promise<T> => new Promise<T>(() => {})
     const optionWrite = (subtype: string): Promise<void> => {
       child.calls.push(subtype)
-      return control(subtype, () => (behavior.optionWritesHang ? never() : Promise.resolve()))
+      return control(subtype, () =>
+        behavior.optionWritesFail
+          ? Promise.reject(new Error('Query closed before response received'))
+          : behavior.optionWritesHang
+            ? never()
+            : Promise.resolve()
+      )
     }
     let settingsReads = 0
     const child: ScriptedClaudeChild = {
@@ -110,7 +126,7 @@ export function createScriptedClaudeRuntime(sessionIds: readonly string[]) {
             handlers.onMessage?.({
               type: 'system',
               subtype: 'init',
-              session_id: providerSessionId,
+              session_id: behavior.initNamesForeignSession ? 'foreign-session' : providerSessionId,
               model: 'claude-sonnet-5',
               apiKeySource: 'none'
             })
@@ -175,7 +191,7 @@ export function createScriptedClaudeRuntime(sessionIds: readonly string[]) {
   }
   const exitAtSpawn = (child: ScriptedClaudeChild, diagnostic: string): void => {
     child.connection.closed = true
-    child.exit(new Error(diagnostic))
+    child.exit(scriptedClaudeExitError(diagnostic))
   }
   /** A pid whose process is gone has no start time to read. */
   const readProcessStartTime = async (pid: number): Promise<number | null> => {
diff --git a/src/main/runtime/structured-session-worktree-teardown.test.ts b/src/main/runtime/structured-session-worktree-teardown.test.ts
index 915fbd52986d..f33d7889b31f 100644
--- a/src/main/runtime/structured-session-worktree-teardown.test.ts
+++ b/src/main/runtime/structured-session-worktree-teardown.test.ts
@@ -62,8 +62,8 @@ function installHost(options: {
   /**
    * Sessions this host is not holding, so they observe `unverifiable` rather than `live`.
    *
-   * The everyday shape, not an edge case: the provider child belongs to the VISIBLE pane, so any
-   * chat outside the active workspace has already been evicted by the release clock.
+   * The everyday shape, not an edge case: the idle sweep has already put to rest any chat quiet for
+   * its window, on screen or not.
    */
   detached?: Set<string>
   /**
@@ -89,7 +89,13 @@ function installHost(options: {
     }
   }
   hostRef.current = {
-    deps: { store: { listRecords: () => options.records, getRecord: () => null } },
+    deps: {
+      store: {
+        listRecords: () => options.records,
+        getRecord: () => null,
+        getSessionTabId: (sessionId: string) => (visible.has(sessionId) ? `tab-${sessionId}` : null)
+      }
+    },
     hasSession: (sessionId: string) => held.has(sessionId),
     getPersistedVisibleSessionTabIndex: () => ({ present: true, sessionIds: [...visible] }),
     setSessionTabVisibility: async (sessionId: string, isVisible: boolean) => {
diff --git a/src/main/runtime/structured-session-worktree-teardown.ts b/src/main/runtime/structured-session-worktree-teardown.ts
index 46265a161118..3f8ab31b3ec7 100644
--- a/src/main/runtime/structured-session-worktree-teardown.ts
+++ b/src/main/runtime/structured-session-worktree-teardown.ts
@@ -27,7 +27,10 @@ import {
 } from '../../shared/execution-host'
 import { STILL_LIVE_DETAIL_PREFIX } from '../../shared/worktree/removal'
 import { getStructuredAgentSessionHost } from '../native-chat/agent-session-wire/structured-agent-session-registry'
-import { observeStructuredWorker } from './structured-worker-authority'
+import {
+  observeStructuredWorker,
+  structuredSessionCloseSettled
+} from './structured-worker-authority'
 import { closeStructuredAgentSessionChild } from './structured-agent-session-close'
 import { retireSettledStructuredWorkerTab } from './structured-agent-session-tab-retirement'
 import type { WorktreePtyHostFence } from './worktree-pty-host-fence'
@@ -86,12 +89,9 @@ export function structuredSessionTeardownHostId(
  * The workspace's structured sessions, split into what belongs to it and what is attached.
  *
  * MEMBERSHIP and LIVENESS answer different questions, and folding them into one list is what let
- * a chat tab outlive its workspace. A provider child is scoped to a VISIBLE pane — the hold that
- * keeps one is `enabled: isVisible && isWorktreeActive`, and dropping the last hold evicts the
- * child after the release grace — so `live` really means "this chat is the visible pane in the
- * active workspace, or was moments ago". Deleting a workspace from the sidebar while a different
- * one is active makes every chat in the target non-live. Those are exactly the sessions a
- * liveness-only list never saw.
+ * a chat tab outlive its workspace. A provider child runs from a send until the idle sweep rests
+ * it, so `live` only means "this chat's agent worked recently", and every chat at rest in the
+ * target is non-live. Those are exactly the sessions a liveness-only list never saw.
  */
 export type StructuredSessionsForWorktree = {
   /** Every session bound to this workspace on the fenced host, attached or not. */
@@ -256,11 +256,10 @@ export async function closeStructuredSessionsForWorktree(
   } = {}
 ): Promise<void> {
   const { runtime, mayRefuse } = options
-  // No `afterClose` for a dispatched worker: `host.close` drops the holds, so nothing keeps a
-  // provider child un-evictable, but the dispatch's redrive subscription and registry entry do
-  // survive until it settles by another verb. That is a bounded leak, not a hazard — and passing
-  // one here would mean resolving a dispatch id per session on a teardown path that must stay
-  // inside the sweep deadline.
+  // No `afterClose` for a dispatched worker: `host.close` stops the child, but the dispatch's
+  // redrive subscription and registry entry survive until it settles by another verb. That is a
+  // bounded leak, not a hazard — and passing one here would mean resolving a dispatch id per
+  // session on a teardown path that must stay inside the sweep deadline.
   for (const session of progress.sessions) {
     // Stops ISSUING new closes once the budget is spent; an in-flight one is left to finish, since
     // nothing here can cancel a provider round trip. Without this, one slow round trip starved
@@ -279,7 +278,7 @@ export async function closeStructuredSessionsForWorktree(
       // Re-observed rather than reusing the close's own reason string: what the user is asked to
       // waive is the state AFTER the attempt, and a close that threw never reached an observation.
       const status = observeStructuredWorker({ sessionId: session.sessionId }).status
-      if (status === 'exited') {
+      if (status === 'exited' || structuredSessionCloseSettled(session.sessionId)) {
         // The re-read can PROVE the exit a failed close could not — it threw past its own
         // observation, or the record's death evidence landed after it read. Refusing on a child
         // that is demonstrably gone is the defect this sweep exists to remove, so take the proof
@@ -307,7 +306,7 @@ export async function closeStructuredSessionsForWorktree(
  * The close path already does this for a session it CLOSED. This is the complement: the members
  * with no attached child, which the close list never contained and nothing else will hide. Their
  * durable reference survives every purge a removal already performs: the renderer drops `unifiedTabsByWorktree` and the main
- * process drops the workspace metadata, and neither touches `visibleSessionIds`. Startup replays
+ * process drops the workspace metadata, and neither touches the chat tab table. Startup replays
  * that index, restores the session from it and republishes the tab, so the chat comes back at the
  * next launch pointing at a workspace that is gone. Worktree ids are path-derived and can be
  * recreated, so a later workspace at the same path inherits the tab — which is the hazard
diff --git a/src/main/runtime/structured-worker-at-rest.test.ts b/src/main/runtime/structured-worker-at-rest.test.ts
new file mode 100644
index 000000000000..28317e4da884
--- /dev/null
+++ b/src/main/runtime/structured-worker-at-rest.test.ts
@@ -0,0 +1,347 @@
+// A structured worker whose agent is at rest: its dispatch keeps it running while open, and once it
+// rests it is still this runtime's worker — mail reaches it — until its chat tab is gone. Whether
+// its process runs is a separate answer, and a close counts a released lease as done.
+
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { AgentSessionRecord } from '../../shared/agent-session-record'
+import { OrchestrationDb } from './orchestration/db'
+
+const hostRef: { current: unknown } = { current: null }
+
+vi.mock('../native-chat/agent-session-wire/structured-agent-session-registry', () => ({
+  getStructuredAgentSessionHost: () => hostRef.current
+}))
+
+const { observeStructuredWorker, resolveStructuredWorkerAuthority, structuredSessionCloseSettled } =
+  await import('./structured-worker-authority')
+const { structuredWorkerOwesWork, structuredWorkerOwned } =
+  await import('./structured-worker-custody')
+const {
+  mintStructuredWorkerHandle,
+  mintStructuredWorkerPaneKey,
+  structuredWorkerIdentities,
+  structuredWorkerProcessIncarnation
+} = await import('./structured-worker-identity')
+const { listAddressableStructuredWorkers } =
+  await import('./orchestration/structured-worker-group-addressing')
+const { closeStructuredAgentSessionChild } = await import('./structured-agent-session-close')
+const { resolveGroupAddress } = await import('./orchestration/groups')
+const { createRestTestRig, foundRestTestChat, IDLE_MS, REST_TEST_SESSION, sweepTicks } =
+  await import('../native-chat/agent-session-wire/structured-agent-session-rest-test-rig')
+
+const SESSION = 'a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d'
+const LOCAL = JSON.stringify({ kind: 'local', hostId: 'local' })
+
+function record(lease: Partial<AgentSessionRecord['lease']>): AgentSessionRecord {
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: a partial record; the ownership and liveness reads touch only lease, location and provider.
+  return {
+    sessionId: SESSION,
+    provider: 'codex',
+    location: {
+      executionHostId: 'local',
+      wslDistro: null,
+      workspaceId: 'wt_1',
+      workspaceKind: 'git-worktree'
+    },
+    lease: { claimStatus: 'live', deathEvidence: null, runtimeFence: 3, ...lease }
+  } as AgentSessionRecord
+}
+
+function installHost(current: AgentSessionRecord | null, tabs: string[]) {
+  const host = {
+    deps: { store: { getRecord: () => current } },
+    hasSession: () => false,
+    getPersistedVisibleSessionTabIndex: () => ({ present: true, sessionIds: tabs }),
+    setSessionTabVisibility: vi.fn(async (_id: string, visible: boolean) => {
+      tabs.splice(0, tabs.length, ...(visible ? [SESSION] : []))
+    }),
+    close: vi.fn(async () => undefined)
+  }
+  hostRef.current = host
+  return host
+}
+
+let paneKey = ''
+
+function registerWorker(): string {
+  const handle = mintStructuredWorkerHandle()
+  paneKey = mintStructuredWorkerPaneKey(SESSION)
+  structuredWorkerIdentities.register({
+    handle,
+    sessionId: SESSION,
+    agent: 'codex',
+    paneKey,
+    processIncarnation: structuredWorkerProcessIncarnation(SESSION),
+    worktreeId: 'wt_1',
+    hostScope: { kind: 'local', hostId: 'local' }
+  })
+  return handle
+}
+
+beforeEach(() => {
+  structuredWorkerIdentities.clear()
+  hostRef.current = null
+})
+
+describe('an open dispatch keeps its worker running (P2-19 i)', () => {
+  let db: OrchestrationDb
+  beforeEach(() => {
+    db = new OrchestrationDb(':memory:')
+  })
+  afterEach(() => db.close())
+
+  function dispatchWorker(hostScope = LOCAL) {
+    const task = db.createTask({ runId: 'run_legacy_local', spec: 'structured work' })
+    const { dispatch } = db.createStartingWorkerDispatch({
+      taskId: task.id,
+      startOptions: {},
+      creator: { kind: 'system' },
+      maxDepth: 9
+    })
+    db.prepareStartingWorkerAuthority({
+      dispatchId: dispatch.id,
+      handle: mintStructuredWorkerHandle(),
+      paneKey: mintStructuredWorkerPaneKey(SESSION),
+      processIncarnation: structuredWorkerProcessIncarnation(SESSION),
+      worktreeId: 'wt_1',
+      effects: [],
+      setupState: 'not_configured',
+      hostScope,
+      terminalOwnership: 'created'
+    })
+    return dispatch
+  }
+
+  it('answers open while the dispatch starts, runs or stops, and closed once it settles', () => {
+    const dispatch = dispatchWorker()
+    expect(structuredWorkerOwesWork(db, record({}))).toBe(true)
+    db.markWorkerDispatchReady(dispatch.id)
+    expect(structuredWorkerOwesWork(db, record({}))).toBe(true)
+    db.beginWorkerStop(dispatch.id, 'epoch_home')
+    expect(structuredWorkerOwesWork(db, record({}))).toBe(true)
+    db.settleWorkerStop(dispatch.id)
+    expect(structuredWorkerOwesWork(db, record({}))).toBe(false)
+  })
+
+  // Custody is the list state coordinators see: `active` owes work, `reclaimable` does not.
+  it('lets a worker awaiting its coordinator rest, and keeps one whose stop is in doubt', () => {
+    const done = dispatchWorker()
+    db.markWorkerDispatchReady(done.id)
+    db.settleWorkerReport({
+      taskId: done.task_id,
+      dispatchId: done.id,
+      outcome: 'succeeded',
+      result: 'done'
+    })
+    expect(structuredWorkerOwesWork(db, record({}))).toBe(false)
+
+    const doubted = dispatchWorker()
+    db.markWorkerDispatchReady(doubted.id)
+    db.beginWorkerStop(doubted.id, 'epoch_home')
+    db.markWorkerStopUnknown(doubted.id, 'the close was not proven')
+    expect(structuredWorkerOwesWork(db, record({}))).toBe(true)
+  })
+
+  it('keeps a worker at rest after its dispatch settles a group recipient, until its tab goes (P2-19 ii)', () => {
+    const dispatch = dispatchWorker()
+    db.markWorkerDispatchReady(dispatch.id)
+    db.beginWorkerStop(dispatch.id, 'epoch_home')
+    db.settleWorkerStop(dispatch.id)
+    // Settlement forgets the in-memory entry; only the durable row and the record remain.
+    structuredWorkerIdentities.clear()
+    const tabs = [SESSION]
+    installHost(
+      record({
+        claimStatus: 'released',
+        deathEvidence: { kind: 'exit-observed', detail: 'stopped by the sweep', observedAt: 1 }
+      }),
+      tabs
+    )
+    const handle = db.getWorkerTerminalResourceByOwner(dispatch.id)!.terminal_handle
+    const recipients = () => listAddressableStructuredWorkers(db)
+
+    expect(recipients()).toEqual([{ handle, worktreeId: 'wt_1', agentIdentity: 'codex' }])
+    expect(resolveGroupAddress('@codex', 'term_sender', recipients(), () => 'idle')).toEqual([
+      handle
+    ])
+    expect(resolveGroupAddress('@claude', 'term_sender', recipients(), () => 'idle')).toEqual([])
+    // Direct mail resolves the same worker through the same ownership answer.
+    expect(resolveStructuredWorkerAuthority(handle, db)?.identity.handle).toBe(handle)
+
+    tabs.length = 0
+    expect(recipients()).toEqual([])
+    expect(resolveStructuredWorkerAuthority(handle, db)).toBeNull()
+  })
+
+  it('stops routing to a worker its coordinator abandoned and then released, and keeps its tab', () => {
+    const dispatch = dispatchWorker()
+    db.markWorkerDispatchReady(dispatch.id)
+    structuredWorkerIdentities.clear()
+    const tabs = [SESSION]
+    installHost(
+      record({
+        claimStatus: 'released',
+        deathEvidence: { kind: 'exit-observed', detail: 'stopped by the sweep', observedAt: 1 }
+      }),
+      tabs
+    )
+    const resource = db.getWorkerTerminalResourceByOwner(dispatch.id)!
+    const handle = resource.terminal_handle
+    const recipients = () => listAddressableStructuredWorkers(db)
+    // At rest, its dispatch abandoned: still a recipient, as a terminal worker left running is.
+    db.abandonWorkerDispatch(dispatch.id)
+    const worktreeGroup = () =>
+      resolveGroupAddress('@worktree:wt_1', 'term_sender', recipients(), () => 'idle')
+    expect(worktreeGroup()).toEqual([handle])
+    expect(resolveStructuredWorkerAuthority(handle, db)).not.toBeNull()
+
+    // The release finds the agent at rest, so it settles as released.
+    expect(db.requestWorkerTerminalRelease(dispatch.id)).toMatchObject({ disposition: 'retained' })
+    expect(
+      db.settleDeadWorkerTerminalRelease({
+        requestingDispatchId: dispatch.id,
+        resourceId: resource.id,
+        processIncarnation: resource.process_incarnation!
+      })
+    ).toMatchObject({ disposition: 'released' })
+
+    expect(tabs).toEqual([SESSION])
+    expect(worktreeGroup()).toEqual([])
+    // Direct mail routes through the same answer.
+    expect(resolveStructuredWorkerAuthority(handle, db)).toBeNull()
+  })
+
+  it('reads only this host scope, and no database answers no', () => {
+    dispatchWorker(JSON.stringify({ kind: 'ssh', targetId: 'elsewhere' }))
+    expect(structuredWorkerOwesWork(db, record({}))).toBe(false)
+    expect(structuredWorkerOwesWork(null, record({}))).toBe(false)
+  })
+})
+
+describe('ownership, not liveness (P2-19 ii-iv, P2-26)', () => {
+  it('owns a worker at rest while its tab is listed, and routes mail to it', () => {
+    const handle = registerWorker()
+    installHost(
+      record({
+        claimStatus: 'released',
+        deathEvidence: { kind: 'exit-observed', detail: 'stopped', observedAt: 1 }
+      }),
+      [SESSION]
+    )
+
+    expect(structuredWorkerOwned(SESSION)).toBe(true)
+    expect(observeStructuredWorker({ sessionId: SESSION }).status).toBe('exited')
+    expect(resolveStructuredWorkerAuthority(handle, null)?.identity.paneKey).toBe(paneKey)
+  })
+
+  it('retires a released worker whose tab is gone', () => {
+    const handle = registerWorker()
+    installHost(record({ claimStatus: 'released' }), [])
+
+    expect(structuredWorkerOwned(SESSION)).toBe(false)
+    expect(resolveStructuredWorkerAuthority(handle, null)).toBeNull()
+  })
+
+  it('keeps authority for a live session that has no tab', () => {
+    const handle = registerWorker()
+    installHost(record({ claimStatus: 'live' }), [])
+
+    expect(structuredWorkerOwned(SESSION)).toBe(true)
+    expect(resolveStructuredWorkerAuthority(handle, null)).not.toBeNull()
+  })
+
+  it('cannot answer without a host', () => {
+    expect(structuredWorkerOwned(SESSION)).toBeNull()
+  })
+})
+
+describe('a close whose stop could not be proven (P2-30)', () => {
+  it('closes on the first attempt, keeps the tab retired and leaves the verdict alone', async () => {
+    const released = record({ claimStatus: 'released', deathEvidence: null })
+    const tabs = [SESSION]
+    const host = installHost(released, tabs)
+    expect(observeStructuredWorker({ sessionId: SESSION }).status).toBe('unverifiable')
+
+    const outcome = await closeStructuredAgentSessionChild(SESSION)
+    expect(outcome).toMatchObject({ stopped: true, closeAttempted: true })
+    expect(host.close).toHaveBeenCalledOnce()
+    expect(tabs).toEqual([])
+    expect(host.setSessionTabVisibility).not.toHaveBeenCalledWith(SESSION, true)
+    expect(released.lease.deathEvidence).toBeNull()
+    expect(structuredSessionCloseSettled(SESSION)).toBe(true)
+  })
+
+  it('still refuses a close that left the lease live', () => {
+    installHost(record({ claimStatus: 'live' }), [SESSION])
+    expect(structuredSessionCloseSettled(SESSION)).toBe(false)
+  })
+})
+
+describe('a task dispatched into a worker whose own dispatch settled', () => {
+  it('keeps the worker running while that task is open, and lets it rest once the task settles', async () => {
+    const db = new OrchestrationDb(':memory:')
+    const rig = await createRestTestRig({
+      hasOpenDispatch: (current) => structuredWorkerOwesWork(db, current)
+    })
+    try {
+      hostRef.current = rig.host
+      await foundRestTestChat(rig)
+      const incarnation = structuredWorkerProcessIncarnation(REST_TEST_SESSION)
+      const handle = mintStructuredWorkerHandle()
+      const workerPane = mintStructuredWorkerPaneKey(REST_TEST_SESSION)
+      const first = db.createTask({ runId: 'run_legacy_local', spec: 'first task' })
+      const { dispatch: started } = db.createStartingWorkerDispatch({
+        taskId: first.id,
+        startOptions: {},
+        creator: { kind: 'system' },
+        maxDepth: 9
+      })
+      db.prepareStartingWorkerAuthority({
+        dispatchId: started.id,
+        handle,
+        paneKey: workerPane,
+        processIncarnation: incarnation,
+        worktreeId: 'wt_1',
+        effects: [],
+        setupState: 'not_configured',
+        hostScope: LOCAL,
+        terminalOwnership: 'created'
+      })
+      db.markWorkerDispatchReady(started.id)
+      expect(
+        db.settleWorkerReport({
+          taskId: first.id,
+          dispatchId: started.id,
+          outcome: 'succeeded',
+          result: 'done'
+        })
+      ).toMatchObject({ action: 'settled' })
+      // The coordinator hands the same worker its next task: a dispatch with no worker row.
+      const second = db.createTask({ runId: 'run_legacy_local', spec: 'second task' })
+      const handedOn = db.createDispatchContext({
+        taskId: second.id,
+        assigneeHandle: handle,
+        assigneePaneKey: workerPane,
+        processIncarnation: incarnation,
+        creator: { kind: 'system' },
+        maxDepth: 9
+      })
+      rig.clock.now += 2 * IDLE_MS
+
+      await sweepTicks(12)
+      expect(rig.adapter.closeSession).not.toHaveBeenCalled()
+      expect(observeStructuredWorker({ sessionId: REST_TEST_SESSION }).status).toBe('live')
+
+      db.completeDispatch(handedOn.id)
+      rig.clock.now += IDLE_MS + 1
+      await vi.waitFor(() =>
+        expect(observeStructuredWorker({ sessionId: REST_TEST_SESSION }).status).toBe('exited')
+      )
+      expect(rig.adapter.closeSession).toHaveBeenCalledWith(REST_TEST_SESSION)
+    } finally {
+      hostRef.current = null
+      await rig.dispose()
+      db.close()
+    }
+  })
+})
diff --git a/src/main/runtime/structured-worker-authority.ts b/src/main/runtime/structured-worker-authority.ts
index c11119878f63..24fda6b1456e 100644
--- a/src/main/runtime/structured-worker-authority.ts
+++ b/src/main/runtime/structured-worker-authority.ts
@@ -3,18 +3,22 @@
  *
  * The registry holds the handle→session mapping for this process; the durable worker-terminal
  * resource row is what survives a restart, so a miss falls back to rehydrating from it. The
- * durable agent-session record is the liveness half: a session whose claim is conflicted or
- * released, or pinned to another execution host, is no longer this runtime's structured worker.
+ * durable agent-session record, the chat's tab and the orchestration's own resource row decide
+ * custody: see `structured-worker-custody`.
+ * Whether its provider process runs is a separate fact, `observeStructuredWorker`, and routing
+ * never reads it — an agent at rest still receives mail, which starts it.
  */
 
 import type { AgentSessionRecord } from '../../shared/agent-session-record'
+import type { OrcaSessionId } from '../../shared/orca-session-address'
 import type { RuntimeTerminalState } from '../../shared/runtime-types'
 import { getStructuredAgentSessionHost } from '../native-chat/agent-session-wire/structured-agent-session-registry'
 import type { OrchestrationDb } from './orchestration/db'
+import { structuredWorkerAddressable } from './structured-worker-custody'
 import {
   isStructuredWorkerHandle,
   structuredWorkerIdentities,
-  structuredWorkerRecordIsCurrent,
+  structuredWorkerProcessIncarnation,
   type StructuredWorkerIdentity
 } from './structured-worker-identity'
 
@@ -47,7 +51,41 @@ export function resolveStructuredWorkerIdentity(
   return row ? structuredWorkerIdentities.rehydrate(row) : null
 }
 
-/** Identity plus a record that still proves this runtime owns the session. */
+/** The worker identity minted for a session, if that session is a structured worker. */
+export function resolveStructuredWorkerIdentityForSession(
+  sessionId: string,
+  db: OrchestrationDb | null | undefined
+): StructuredWorkerIdentity | null {
+  const known = structuredWorkerIdentities.getBySessionId(sessionId)
+  if (known) {
+    return known
+  }
+  const row = db?.getWorkerTerminalResourceByProcessIncarnation?.(
+    structuredWorkerProcessIncarnation(sessionId)
+  )
+  return row ? structuredWorkerIdentities.rehydrate(row) : null
+}
+
+/**
+ * Whether this session was assigned a Dispatch as a structured worker. Such a session acts with its
+ * worker handle, so one whose handle is gone must not act handle-less, as a chat would.
+ */
+export function isRecordedStructuredWorkerSession(
+  sessionId: OrcaSessionId,
+  db: OrchestrationDb
+): boolean {
+  return Boolean(
+    db.db
+      .prepare(
+        `SELECT 1 FROM dispatch_contexts
+         WHERE assignee_orca_session_id = ? AND process_incarnation = ? LIMIT 1`
+      )
+      .get(sessionId, structuredWorkerProcessIncarnation(sessionId))
+  )
+}
+
+/** Identity plus a record that still proves this runtime owns the session, for a worker its
+ *  orchestration has not released. */
 export function resolveStructuredWorkerAuthority(
   handle: string,
   db: OrchestrationDb | null | undefined
@@ -57,7 +95,14 @@ export function resolveStructuredWorkerAuthority(
     return null
   }
   const record = readStructuredAgentSessionRecord(identity.sessionId)
-  return record && structuredWorkerRecordIsCurrent(record) ? { identity, record } : null
+  return record &&
+    structuredWorkerAddressable(
+      db,
+      identity.sessionId,
+      db?.getWorkerTerminalResourceByHandle?.(identity.handle)
+    )
+    ? { identity, record }
+    : null
 }
 
 /**
@@ -80,6 +125,20 @@ export type StructuredWorkerObservation = {
   reason?: string
 }
 
+/**
+ * Whether a close left nothing running: `exited`, or `unverifiable` on a released lease — a release
+ * whose stop could not be proven, which sent no signal and is left as it is. Closing a chat is the
+ * user's action, and bookkeeping about a process already released must not refuse it.
+ */
+export function structuredSessionCloseSettled(sessionId: string): boolean {
+  const status = observeStructuredWorker({ sessionId }).status
+  return (
+    status === 'exited' ||
+    (status === 'unverifiable' &&
+      readStructuredAgentSessionRecord(sessionId)?.lease.claimStatus === 'released')
+  )
+}
+
 /**
  * The observation as the terminal state every read result reports.
  *
diff --git a/src/main/runtime/structured-worker-custody.ts b/src/main/runtime/structured-worker-custody.ts
new file mode 100644
index 000000000000..54e42b24d800
--- /dev/null
+++ b/src/main/runtime/structured-worker-custody.ts
@@ -0,0 +1,133 @@
+/**
+ * Whether orchestration still holds a structured worker, the one answer every reader derives from.
+ *
+ * Custody is the orchestration's own worker-terminal state, the list state `worker-list` shows
+ * coordinators, never whether the worker's process runs: a worker at rest is still held, and mail
+ * starts it. Routing, group addressing and `worker-show` ask whether it is addressable; the idle
+ * sweep asks whether it still owes work.
+ *
+ * Two policy decisions live here and nowhere else: only `released` ends addressability (a release
+ * pending or in doubt still routes, as for a terminal worker), and a settled worker awaiting its
+ * coordinator's decision (`reclaimable`) owes no work, so it may rest.
+ */
+
+import type { AgentSessionRecord } from '../../shared/agent-session-record'
+import type { OrchestrationDb } from './orchestration/db'
+import type { WorkerDispatchState } from './orchestration/types'
+import {
+  deriveWorkerTerminalListState,
+  type WorkerTerminalResourceRow
+} from './orchestration/worker-terminal-ownership'
+import { getStructuredAgentSessionHost } from '../native-chat/agent-session-wire/structured-agent-session-registry'
+import {
+  structuredWorkerHostScope,
+  structuredWorkerProcessIncarnation,
+  structuredWorkerRecordIsCurrent
+} from './structured-worker-identity'
+
+/**
+ * Whether this runtime still owns the worker's session: routing, addressing and authority ask
+ * this, never whether its process runs. Null when the host is not installed, because reading the
+ * record store would install it — not being able to look is not an answer.
+ */
+export function structuredWorkerOwned(sessionId: string): boolean | null {
+  const host = getStructuredAgentSessionHost()
+  if (!host) {
+    return null
+  }
+  let record: AgentSessionRecord | null
+  try {
+    record = host.deps.store.getRecord(sessionId)
+  } catch {
+    record = null
+  }
+  return structuredWorkerRecordIsCurrent(
+    record,
+    record?.lease.claimStatus === 'released' && structuredWorkerTabListed(host, sessionId)
+  )
+}
+
+/** Retirement is the tab index: every path that ends a chat for good hides its tab. */
+function structuredWorkerTabListed(
+  host: NonNullable<ReturnType<typeof getStructuredAgentSessionHost>>,
+  sessionId: string
+): boolean {
+  try {
+    return host.getPersistedVisibleSessionTabIndex?.().sessionIds.includes(sessionId) ?? false
+  } catch {
+    return false
+  }
+}
+
+type CustodyRow = Pick<
+  WorkerTerminalResourceRow,
+  'owner_dispatch_id' | 'terminal_handle' | 'ownership_state' | 'release_state'
+>
+
+function ownerState(
+  db: OrchestrationDb | null | undefined,
+  row: CustodyRow
+): WorkerDispatchState | undefined {
+  return (
+    db?.getWorkerDispatch?.(row.owner_dispatch_id)?.state ??
+    db?.getRemoteDispatchAttachment?.(row.owner_dispatch_id)?.state
+  )
+}
+
+/**
+ * The user still owns the chat and orchestration has not released the worker, as with a terminal
+ * worker whose terminal closed. Null when ownership cannot be read. A released worker's chat stays
+ * the user's; nothing routes to it.
+ */
+export function structuredWorkerAddressable(
+  db: OrchestrationDb | null | undefined,
+  sessionId: string,
+  row: CustodyRow | undefined
+): boolean | null {
+  const owned = structuredWorkerOwned(sessionId)
+  if (owned === null) {
+    return null
+  }
+  // Release is read off the row alone, so an owner whose state is unreadable still answers.
+  const custody = row
+    ? deriveWorkerTerminalListState({
+        workerState: ownerState(db, row) ?? 'unsupervised',
+        agentTerminalHandle: row.terminal_handle,
+        resource: row
+      })
+    : null
+  return owned && custody !== 'released'
+}
+
+/**
+ * Work orchestration still owes on this worker, read per sweep tick: any unsettled dispatch
+ * addressed to its incarnation, on a process this host owns a terminal for. That covers its own
+ * worker-start dispatch (whose context stays open while the worker is active, a stop in doubt
+ * included, because a supervised worker's context settles only with it) and any task later
+ * dispatched to it. A `reclaimable` worker's dispatch has settled, so it owes nothing.
+ */
+export function structuredWorkerOwesWork(
+  db: OrchestrationDb | null,
+  record: AgentSessionRecord
+): boolean {
+  const hostScope = structuredWorkerHostScope(record.location)
+  if (!db || !hostScope) {
+    return false
+  }
+  const incarnation = structuredWorkerProcessIncarnation(record.sessionId)
+  const owned = db.db
+    .prepare(
+      `SELECT 1 FROM worker_terminal_resources
+        WHERE process_incarnation = ? AND host_scope IS ? AND ownership_state = 'owned' LIMIT 1`
+    )
+    .get(incarnation, JSON.stringify(hostScope))
+  return (
+    owned !== undefined &&
+    db.db
+      .prepare(
+        `SELECT 1 FROM dispatch_contexts
+          WHERE process_incarnation = ? AND status IN ('pending', 'dispatched') LIMIT 1`
+      )
+      .get(incarnation) !== undefined
+  )
+}
diff --git a/src/main/runtime/structured-worker-identity.test.ts b/src/main/runtime/structured-worker-identity.test.ts
index 98989a85891c..d20cadf5c770 100644
--- a/src/main/runtime/structured-worker-identity.test.ts
+++ b/src/main/runtime/structured-worker-identity.test.ts
@@ -176,18 +176,24 @@ describe('structured worker identity', () => {
   it('keeps a recovered session current across a fence bump', () => {
     // The host bumps the fence on its own transparent crash recovery; fencing identity on it
     // would wedge the SAME worker as identity_unproven forever.
-    expect(structuredWorkerRecordIsCurrent(record({ runtimeFence: 1 }))).toBe(true)
-    expect(structuredWorkerRecordIsCurrent(record({ runtimeFence: 9 }))).toBe(true)
+    expect(structuredWorkerRecordIsCurrent(record({ runtimeFence: 1 }), false)).toBe(true)
+    expect(structuredWorkerRecordIsCurrent(record({ runtimeFence: 9 }), false)).toBe(true)
     expect(structuredWorkerProcessIncarnation(SESSION_ID)).toBe(
       structuredWorkerProcessIncarnation(SESSION_ID)
     )
   })
 
-  it('refuses a conflicted or released session', () => {
+  it('refuses a conflicted session, and a released one whose chat tab is gone', () => {
     // A terminal owner an older build recorded loads conflicted; it is not this worker.
-    expect(structuredWorkerRecordIsCurrent(record({ claimStatus: 'conflicted' }))).toBe(false)
-    expect(structuredWorkerRecordIsCurrent(record({ claimStatus: 'released' }))).toBe(false)
-    expect(structuredWorkerRecordIsCurrent(null)).toBe(false)
+    expect(structuredWorkerRecordIsCurrent(record({ claimStatus: 'conflicted' }), true)).toBe(false)
+    expect(structuredWorkerRecordIsCurrent(record({ claimStatus: 'released' }), false)).toBe(false)
+    expect(structuredWorkerRecordIsCurrent(null, true)).toBe(false)
+  })
+
+  it('keeps a released session with a listed tab: that worker is at rest, not gone', () => {
+    expect(structuredWorkerRecordIsCurrent(record({ claimStatus: 'released' }), true)).toBe(true)
+    // A live lease is owned whether or not a tab shows it.
+    expect(structuredWorkerRecordIsCurrent(record({ claimStatus: 'live' }), false)).toBe(true)
   })
 })
 
diff --git a/src/main/runtime/structured-worker-identity.ts b/src/main/runtime/structured-worker-identity.ts
index 5be84c336ae8..e09adee7c1e2 100644
--- a/src/main/runtime/structured-worker-identity.ts
+++ b/src/main/runtime/structured-worker-identity.ts
@@ -25,6 +25,7 @@ import {
   structuredAgentSessionTabId
 } from '../../shared/structured-agent-session-projection'
 import { isTerminalLeafId, makePaneKey, parsePaneKey } from '../../shared/stable-pane-id'
+import { isOrcaSessionId, type OrcaSessionId } from '../../shared/orca-session-address'
 import {
   parseWorkerTerminalHostScope,
   type WorkerTerminalHostScope
@@ -57,12 +58,13 @@ export function mintStructuredWorkerHandle(): string {
 /**
  * A RANDOM leaf, minted once per worker and persisted with the rest of the identity.
  *
- * Emphatically not `structuredAgentSessionPaneKey`, which is a sha256 of the session id. A pane
- * key is an identity credential on its own: `orchestration.check` is identity-gated, not
- * capability-gated, and accepts a caller-supplied `terminalPaneKey` that `getActiveDispatchForIdentity`
- * matches by leaf suffix. A derivable pane key would therefore let anyone who learns a session id —
- * which the tab id embeds in plain text — read and consume that worker's mailbox with no token.
- * PTY pane keys are safe only because their leaf UUID is random; this one has to be too.
+ * Emphatically not `structuredAgentSessionPaneKey`, which is a sha256 of the session id. A request
+ * that names no session — a PTY agent's, or any on the paired-client route, which refuses session
+ * ids — identifies its caller by pane: `orchestration.check` accepts a caller-supplied
+ * `terminalPaneKey` that `getActiveDispatchForIdentity` matches by leaf suffix. A pane key derivable
+ * from the session id, which the tab id embeds in plain text, would let such a request read and
+ * consume this worker's mailbox. On the same-host socket route the session id itself names the
+ * worker with no token, by design; the pane key is no credential there and must not become one.
  *
  * Restart stability comes from persisting the minted key, not from re-deriving it.
  */
@@ -122,6 +124,14 @@ export function sessionIdFromStructuredWorkerIncarnation(
   return sessionId.length > 0 ? sessionId : null
 }
 
+/** The Orca session id a `structured:<sessionId>` incarnation names; null for any other. */
+export function structuredWorkerOrcaSessionIdForIncarnation(
+  processIncarnation: string | null | undefined
+): OrcaSessionId | null {
+  const sessionId = sessionIdFromStructuredWorkerIncarnation(processIncarnation)
+  return sessionId !== null && isOrcaSessionId(sessionId) ? sessionId : null
+}
+
 /** Structured sessions can only exist local and outside WSL; anything else is not our authority. */
 export function structuredWorkerHostScope(
   location: AgentSessionExecutionLocation
@@ -131,19 +141,62 @@ export function structuredWorkerHostScope(
     : null
 }
 
-/** Whether the durable record still describes THIS worker under this host. */
+/**
+ * Whether the durable record still describes THIS worker under this host — ownership, not whether
+ * its process runs. A released lease is a worker at rest while its chat tab is listed; released
+ * with the tab gone is retired. `tabListed` is the persisted tab index's answer.
+ */
 export function structuredWorkerRecordIsCurrent(
-  record: AgentSessionRecord | null | undefined
+  record: AgentSessionRecord | null | undefined,
+  tabListed: boolean
 ): boolean {
   return Boolean(
     record &&
     // Why: a conflicted claim may name a terminal an older build recorded as owner, not this worker.
     record.lease.claimStatus !== 'conflicted' &&
-    record.lease.claimStatus !== 'released' &&
+    (record.lease.claimStatus !== 'released' || tabListed) &&
     structuredWorkerHostScope(record.location)
   )
 }
 
+type StructuredWorkerResourceRow = {
+  terminal_handle: string
+  pane_key: string | null
+  process_incarnation: string | null
+  worktree_id: string | null
+  host_scope: string | null
+}
+
+/** A worker's identity as its durable worker-terminal resource row records it, or null for a row
+ *  that is not a structured worker's or whose pane key does not belong to its own session. */
+export function structuredWorkerIdentityFromRow(
+  row: StructuredWorkerResourceRow
+): StructuredWorkerIdentity | null {
+  const sessionId = sessionIdFromStructuredWorkerIncarnation(row.process_incarnation)
+  const hostScope = parseWorkerTerminalHostScope(row.host_scope)
+  const paneKey = row.pane_key
+  if (
+    !sessionId ||
+    !hostScope ||
+    !row.worktree_id ||
+    !paneKey ||
+    !isStructuredWorkerHandle(row.terminal_handle) ||
+    !persistedStructuredWorkerPaneKeyIsValid(paneKey, sessionId)
+  ) {
+    return null
+  }
+  return {
+    handle: row.terminal_handle,
+    sessionId,
+    // The row does not carry the provider; callers that need it read the durable record.
+    agent: null,
+    paneKey,
+    processIncarnation: structuredWorkerProcessIncarnation(sessionId),
+    worktreeId: row.worktree_id,
+    hostScope
+  }
+}
+
 export class StructuredWorkerIdentityRegistry {
   private readonly byHandle = new Map<string, StructuredWorkerIdentity>()
   private readonly bySessionId = new Map<string, StructuredWorkerIdentity>()
@@ -183,35 +236,9 @@ export class StructuredWorkerIdentityRegistry {
    * only place a structured worker's pane key and host scope outlive this process. A row whose
    * pane key does not belong to its own recorded session is refused rather than trusted.
    */
-  rehydrate(row: {
-    terminal_handle: string
-    pane_key: string | null
-    process_incarnation: string | null
-    worktree_id: string | null
-    host_scope: string | null
-  }): StructuredWorkerIdentity | null {
-    const sessionId = sessionIdFromStructuredWorkerIncarnation(row.process_incarnation)
-    const hostScope = parseWorkerTerminalHostScope(row.host_scope)
-    if (
-      !sessionId ||
-      !hostScope ||
-      !row.worktree_id ||
-      !isStructuredWorkerHandle(row.terminal_handle) ||
-      // The durable row bootstraps the registry after restart, so validate it before registration.
-      !persistedStructuredWorkerPaneKeyIsValid(row.pane_key, sessionId)
-    ) {
-      return null
-    }
-    return this.register({
-      handle: row.terminal_handle,
-      sessionId,
-      // The row does not carry the provider; callers that need it read the durable record.
-      agent: null,
-      paneKey: row.pane_key,
-      processIncarnation: structuredWorkerProcessIncarnation(sessionId),
-      worktreeId: row.worktree_id,
-      hostScope
-    })
+  rehydrate(row: StructuredWorkerResourceRow): StructuredWorkerIdentity | null {
+    const identity = structuredWorkerIdentityFromRow(row)
+    return identity ? this.register(identity) : null
   }
 
   clear(): void {
diff --git a/src/main/runtime/structured-worker-mail-routing.test.ts b/src/main/runtime/structured-worker-mail-routing.test.ts
index c426132b8485..0413c7b6fa64 100644
--- a/src/main/runtime/structured-worker-mail-routing.test.ts
+++ b/src/main/runtime/structured-worker-mail-routing.test.ts
@@ -20,9 +20,16 @@ const prototype = OrcaRuntimeWithAdoptTerminalOrphansFromInventory.prototype
 const getLivePaneKey = prototype.getLiveTerminalPaneKey
 const resolveActiveTerminal = prototype.resolveActiveTerminal
 
-function installRecord(lease: { runtimeKind: string; claimStatus: string } | null): void {
+function installRecord(
+  lease: { runtimeKind: string; claimStatus: string } | null,
+  tabListed = false
+): void {
   hostRef.current = lease
     ? {
+        getPersistedVisibleSessionTabIndex: () => ({
+          present: true,
+          sessionIds: tabListed ? [SESSION_ID] : []
+        }),
         deps: {
           store: {
             getRecord: () => ({
@@ -73,10 +80,19 @@ describe('bare-handle direct mail to a structured session', () => {
     )
   })
 
-  it('withholds the pane key when the session is not proven live', () => {
-    // The PTY branch is connected-gated so mail is never routed to a corpse; so is this one.
+  it('routes to a worker at rest, whose agent the mail starts', () => {
+    // Released by the idle sweep with its chat tab still listed: owned, so mail reaches it.
     const handle = registerWorker()
-    installRecord({ runtimeKind: 'native', claimStatus: 'reserved' })
+    installRecord({ runtimeKind: 'native', claimStatus: 'released' }, true)
+    expect(getLivePaneKey.call(paneKeyStub, handle)).toBe(
+      structuredWorkerIdentities.get(handle)!.paneKey
+    )
+  })
+
+  it('withholds the pane key from a retired worker: released, with its tab gone', () => {
+    // Mail is never routed to a worker this runtime no longer owns.
+    const handle = registerWorker()
+    installRecord({ runtimeKind: 'native', claimStatus: 'released' }, false)
     expect(getLivePaneKey.call(paneKeyStub, handle)).toBeNull()
   })
 
diff --git a/src/main/runtime/structured-worker-terminal-read.test.ts b/src/main/runtime/structured-worker-terminal-read.test.ts
index 802b23733bca..e49f24ba1a15 100644
--- a/src/main/runtime/structured-worker-terminal-read.test.ts
+++ b/src/main/runtime/structured-worker-terminal-read.test.ts
@@ -75,22 +75,22 @@ describe('reading a structured worker through the terminal-read path', () => {
     hostRef.current = null
   })
 
-  it('serves the journal as terminal lines, with no dispatch and no capability', () => {
+  it('serves the journal as terminal lines, with no dispatch and no capability', async () => {
     // The defect this pins: a peer has no dispatch id and no coordinator standing, so `worker-read`
     // is closed to it, and `terminal read` threw `terminal_handle_stale` for a perfectly live
     // worker. A peer could not see a structured agent's recent output at all.
     const handle = registerWorker()
     installHost({ items: [message('i1', 'first line\nsecond line'), message('i2', 'done')] })
-    const read = readStructuredWorkerTerminal({ handle, db: null })
+    const read = await readStructuredWorkerTerminal({ handle, db: null })
     expect(read?.tail).toEqual(['[assistant] first line', 'second line', '[assistant] done'])
     expect(read?.status).toBe('running')
     expect(read?.truncated).toBe(false)
   })
 
-  it('honours limit, and claims no cursor space it cannot honour', () => {
+  it('honours limit, and claims no cursor space it cannot honour', async () => {
     const handle = registerWorker()
     installHost({ items: [message('i1', 'a'), message('i2', 'b'), message('i3', 'c')] })
-    const read = readStructuredWorkerTerminal({ handle, db: null, limit: 2 })
+    const read = await readStructuredWorkerTerminal({ handle, db: null, limit: 2 })
     expect(read?.tail).toEqual(['[assistant] b', '[assistant] c'])
     // No index is advertised: the next read re-projects a sliding window, so 0/length would name
     // positions that address different lines by then.
@@ -99,7 +99,7 @@ describe('reading a structured worker through the terminal-read path', () => {
     expect(read?.latestCursor).toBeUndefined()
   })
 
-  it('refuses a cursor read rather than silently misdelivering lines', () => {
+  it('refuses a cursor read rather than silently misdelivering lines', async () => {
     // The PTY cursor indexes an append-only completed-line buffer with a monotone count. This
     // window is a bounded tail re-projected every read, so a saved index addresses different lines
     // as the journal grows — and `truncated` could never fire to say so, because it tests
@@ -107,14 +107,10 @@ describe('reading a structured worker through the terminal-read path', () => {
     // duplicated lines with `truncated:false`.
     const handle = registerWorker()
     installHost({ items: [message('i1', 'a')] })
-    const refusal = (() => {
-      try {
-        readStructuredWorkerTerminal({ handle, db: null, cursor: 0 })
-        return ''
-      } catch (error) {
-        return (error as Error).message
-      }
-    })()
+    const refusal = await readStructuredWorkerTerminal({ handle, db: null, cursor: 0 }).then(
+      () => '',
+      (error: unknown) => (error instanceof Error ? error.message : String(error))
+    )
     expect(refusal).toMatch(/not line-addressable/)
     // Tells the caller what DOES work here. Polling a bounded newest-last tail and diffing fails
     // safe — a harmless re-read — where a broken cursor fails unsafe, as a silent hole.
@@ -125,35 +121,35 @@ describe('reading a structured worker through the terminal-read path', () => {
     expect(refusal).not.toContain('worker-read')
   })
 
-  it('reports dropped history as truncated rather than pretending the page is whole', () => {
+  it('reports dropped history as truncated rather than pretending the page is whole', async () => {
     const handle = registerWorker()
     installHost({ items: [message('i1', 'tail only')], hasOlder: true })
-    expect(readStructuredWorkerTerminal({ handle, db: null })?.truncated).toBe(true)
+    expect((await readStructuredWorkerTerminal({ handle, db: null }))?.truncated).toBe(true)
   })
 
-  it('redacts dispatch capability tokens the same way the archive path does', () => {
+  it('redacts dispatch capability tokens the same way the archive path does', async () => {
     const handle = registerWorker()
     const token = `dcap_${'a'.repeat(32)}`
     installHost({ items: [message('i1', `token is ${token} here`)] })
-    const tail = readStructuredWorkerTerminal({ handle, db: null })?.tail.join('\n') ?? ''
+    const tail = (await readStructuredWorkerTerminal({ handle, db: null }))?.tail.join('\n') ?? ''
     expect(tail).not.toContain(token)
     expect(tail).toContain('[dispatch capability redacted]')
   })
 
-  it('refuses when the session is not attached rather than answering an empty tail', () => {
+  it('refuses when the session is not attached rather than answering an empty tail', async () => {
     // An empty tail is the claim "this worker has produced no output", which is a different and
     // false statement — and the one a caller cannot tell apart from a real silence.
     const handle = registerWorker()
     installHost({ items: 'unreadable' })
-    expect(() => readStructuredWorkerTerminal({ handle, db: null })).toThrow(
+    await expect(readStructuredWorkerTerminal({ handle, db: null })).rejects.toThrow(
       'agent_session_ownership_unknown'
     )
   })
 
-  it('reports a session it cannot verify as unknown, never as running', () => {
+  it('reports a session it cannot verify as unknown, never as running', async () => {
     const handle = registerWorker()
     installHost({ items: [message('i1', 'said something')], hasSession: false })
-    expect(readStructuredWorkerTerminal({ handle, db: null })?.status).toBe('unknown')
+    expect((await readStructuredWorkerTerminal({ handle, db: null }))?.status).toBe('unknown')
   })
 
   it('is what `terminal read` answers with, ahead of the PTY lookup', async () => {
@@ -182,15 +178,15 @@ describe('reading a structured worker through the terminal-read path', () => {
     })
   })
 
-  it('leaves every handle that is not a live structured worker to the PTY path', () => {
+  it('leaves every handle that is not a live structured worker to the PTY path', async () => {
     const handle = registerWorker()
     installHost({ items: [message('i1', 'x')] })
-    expect(readStructuredWorkerTerminal({ handle: 'term_abc', db: null })).toBeNull()
+    expect(await readStructuredWorkerTerminal({ handle: 'term_abc', db: null })).toBeNull()
     // A terminal owner an older build recorded loads conflicted: not this runtime's worker.
     installHost({
       items: [message('i1', 'x')],
       lease: { runtimeKind: 'native', claimStatus: 'conflicted' }
     })
-    expect(readStructuredWorkerTerminal({ handle, db: null })).toBeNull()
+    expect(await readStructuredWorkerTerminal({ handle, db: null })).toBeNull()
   })
 })
diff --git a/src/main/runtime/structured-worker-terminal-read.ts b/src/main/runtime/structured-worker-terminal-read.ts
index 9b4a118b8ae4..3d31c4c863c7 100644
--- a/src/main/runtime/structured-worker-terminal-read.ts
+++ b/src/main/runtime/structured-worker-terminal-read.ts
@@ -48,12 +48,12 @@ import { readTerminalTail } from './terminal-tail-read'
  * IS a structured worker never falls through: an unreadable journal refuses rather than answering
  * an empty tail, which a caller cannot tell from a worker that has said nothing.
  */
-export function readStructuredWorkerTerminal(args: {
+export async function readStructuredWorkerTerminal(args: {
   handle: string
   db: OrchestrationDb | null
   cursor?: number
   limit?: number
-}): RuntimeTerminalRead | null {
+}): Promise<RuntimeTerminalRead | null> {
   const identity = resolveStructuredWorkerAuthority(args.handle, args.db)?.identity
   if (!identity) {
     return null
@@ -76,7 +76,7 @@ export function readStructuredWorkerTerminal(args: {
         'A structured session has no durable line anchor to page from — nothing else does either.'
     )
   }
-  const page = readStructuredJournalPage(identity.sessionId)
+  const page = await readStructuredJournalPage(identity.sessionId)
   if (!page) {
     // Honest refusal, and the same one the send lane reports: an empty tail would read as "this
     // worker has produced no output", which is a different and false claim.
diff --git a/src/main/runtime/terminal-chat-owner-persistence.test.ts b/src/main/runtime/terminal-chat-owner-persistence.test.ts
new file mode 100644
index 000000000000..a489285d27ee
--- /dev/null
+++ b/src/main/runtime/terminal-chat-owner-persistence.test.ts
@@ -0,0 +1,53 @@
+import { describe, expect, it } from 'vitest'
+import { OrcaRuntimeService } from './orca-runtime-test-mocks.spec'
+import {
+  HEADLESS_LEAF_ID,
+  TEST_WORKTREE_ID,
+  makeRuntimeStoreWithWorkspaceSession,
+  makeWorkspaceSessionWithHeadlessTerminal
+} from './orca-runtime-test-fixtures.spec'
+import { UpdatePaneLayout } from '../../shared/rpc-contract/session-tabs-schemas-params'
+import type { RuntimeStore } from './runtime-store-contract'
+
+describe('remote terminal chat ownership', () => {
+  it('preserves, changes, and explicitly clears the owner across the RPC and restart boundary', async () => {
+    const { runtimeStore, getSession } = makeRuntimeStoreWithWorkspaceSession(
+      makeWorkspaceSessionWithHeadlessTerminal()
+    )
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The shared fixture implements RuntimeStore; its annotation erases the Vitest mock call signatures.
+    const runtime = new OrcaRuntimeService(runtimeStore as RuntimeStore)
+    const update = (owner: string | null | undefined) => {
+      const params = UpdatePaneLayout.parse({
+        worktree: `id:${TEST_WORKTREE_ID}`,
+        tabId: 'host-tab',
+        root: getSession().terminalLayoutsByTabId['host-tab']!.root,
+        expandedLeafId: null,
+        ...(owner !== undefined ? { chatLeafId: owner } : {})
+      })
+      return runtime.updateMobileSessionPaneLayout(params.worktree, {
+        ...params,
+        expandedLeafId: params.expandedLeafId ?? null
+      })
+    }
+    await update(HEADLESS_LEAF_ID)
+    expect(getSession().terminalLayoutsByTabId['host-tab']?.chatLeafId).toBe(HEADLESS_LEAF_ID)
+    // An older client changing geometry must not clear the owner.
+    await update(undefined)
+    expect(getSession().terminalLayoutsByTabId['host-tab']?.chatLeafId).toBe(HEADLESS_LEAF_ID)
+    runtime['mobileSessionTabsByWorktree'].delete(TEST_WORKTREE_ID)
+    runtime['hydrateHeadlessMobileSessionTabsFromWorkspaceSession'](TEST_WORKTREE_ID)
+    const rehydrated = await runtime.listMobileSessionTabs(`id:${TEST_WORKTREE_ID}`)
+    const surface = rehydrated.tabs.find(
+      (tab) => tab.type === 'terminal' && tab.parentTabId === 'host-tab'
+    )
+    expect(surface?.type === 'terminal' && surface.parentLayout?.chatLeafId).toBe(HEADLESS_LEAF_ID)
+    await update(null)
+    expect(getSession().terminalLayoutsByTabId['host-tab']?.chatLeafId).toBeUndefined()
+    const cleared = await runtime.listMobileSessionTabs(`id:${TEST_WORKTREE_ID}`)
+    expect(
+      cleared.tabs
+        .filter((tab) => tab.type === 'terminal')
+        .every((tab) => !tab.parentLayout?.chatLeafId)
+    ).toBe(true)
+  })
+})
diff --git a/src/main/runtime/terminal-close-observed-exit-test-fixture.ts b/src/main/runtime/terminal-close-observed-exit-test-fixture.ts
index 468508f896dd..81287bafc596 100644
--- a/src/main/runtime/terminal-close-observed-exit-test-fixture.ts
+++ b/src/main/runtime/terminal-close-observed-exit-test-fixture.ts
@@ -37,8 +37,7 @@ export async function runObservedExitSocketScenario(scenario: ObservedExitSocket
       rememberSyntheticKillExit: harness.session.rememberSyntheticKillExit,
       sendPtyExitToRenderer: harness.session.sendPtyExitToRenderer,
       finishPtyShutdown,
-      retiredRejectedPtyIds: new Map<string, NodeJS.Timeout>(),
-      reversibleStopOwnersByPtyId: new Map<string, number>()
+      retiredRejectedPtyIds: new Map<string, NodeJS.Timeout>()
     }
     // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: stop/kill read only these controller ports and optional store; spawn ports are unused.
     const deps = ports as unknown as PtyRuntimeControllerDeps
@@ -103,8 +102,8 @@ const BINDING = {
 }
 
 class ObservedExitRuntime extends OrcaRuntimeService {
-  closeControl(): Promise<boolean> {
-    return this.stopExplicitlyClosedTabPtys([CONTROL_PTY_ID], CONTROL_PTY_ID)
+  async closeControl(): Promise<boolean> {
+    return (await this.stopExplicitlyClosedTabPtys([CONTROL_PTY_ID], CONTROL_PTY_ID)).stopped
   }
 }
 
diff --git a/src/main/runtime/terminal-input-kind-unchecked-call-sites.test.ts b/src/main/runtime/terminal-input-kind-unchecked-call-sites.test.ts
new file mode 100644
index 000000000000..e806e88320cc
--- /dev/null
+++ b/src/main/runtime/terminal-input-kind-unchecked-call-sites.test.ts
@@ -0,0 +1,80 @@
+import { resolve } from 'node:path'
+import { describe, expect, it } from 'vitest'
+import { scanSourceTree } from '../../shared/source-scan/source-tree-scan'
+import {
+  findCallsMissingArgument,
+  type RequiredCallArgument
+} from '../../shared/source-scan/call-argument-scan'
+
+/**
+ * Every PTY write names its input kind, and the compiler enforces that everywhere except the
+ * runtime files split out with `@ts-nocheck`. There a missing kind would compile and silently
+ * record nothing, so this scan is the ratchet for them.
+ */
+const MAIN_ROOT = resolve(__dirname, '..')
+
+const namesInputKind = (literal: string): boolean => /\binputKind\b|\.\.\./.test(literal)
+const kindAt = (index: number, receiver?: RegExp): RequiredCallArgument => ({
+  index,
+  ...(receiver ? { receiver } : {}),
+  acceptsObjectLiteral: namesInputKind
+})
+const CONTROLLER = /[Cc]ontroller\??\s*$/
+
+const KIND_ARGUMENT_BY_METHOD: Record<string, RequiredCallArgument> = {
+  write: kindAt(2, CONTROLLER),
+  writeWithSettlement: kindAt(2, CONTROLLER),
+  sendTerminal: kindAt(2),
+  sendTerminalAgentPrompt: kindAt(2),
+  writeTerminalAction: kindAt(3),
+  writeTerminalInputChunks: kindAt(2),
+  writeTerminalAgentPrompt: kindAt(4),
+  writeAction: kindAt(3),
+  writeChunks: kindAt(2)
+}
+
+// Why multiline: some unchecked files open with a lint directive before `@ts-nocheck`.
+const uncheckedSources = scanSourceTree(MAIN_ROOT).filter((file) =>
+  /^\/\/ @ts-nocheck\b/m.test(file.source)
+)
+
+describe('PTY write call sites the compiler cannot check', () => {
+  it('scans the unchecked runtime files that write to a PTY', () => {
+    expect(uncheckedSources.map((file) => file.relativePath)).toEqual(
+      expect.arrayContaining([
+        'runtime/orca-runtime-deliver-pending-messages.ts',
+        'runtime/orca-runtime-create-pty-headless-terminal-state.ts',
+        'runtime/orca-runtime-write-terminal-agent-prompt.ts',
+        'runtime/orca-runtime-sync-window-graph.ts'
+      ])
+    )
+  })
+
+  it('finds a write, prompt or send that leaves out its kind', () => {
+    const planted = [
+      '',
+      'this.ptyController?.write(ptyId, reply)',
+      "this.ptyController.write(ptyId, '\\r', 'launch')",
+      "await this.sendTerminal(handle, { text: 'a, b' }, { beforeWrite })",
+      'await this.sendTerminalAgentPrompt(handle, prompt, { ...options })',
+      'other.write(ptyId, data)',
+      'const controller = this.ptyController; controller.write(ptyId, data)'
+    ].join('\n')
+
+    expect(findCallsMissingArgument(planted, KIND_ARGUMENT_BY_METHOD)).toEqual([
+      '2: .write(ptyId, reply)',
+      "4: .sendTerminal(handle, { text: 'a, b' }, { beforeWrite })",
+      '7: .write(ptyId, data)'
+    ])
+  })
+
+  it('passes an input kind at every write', () => {
+    const missing = uncheckedSources.flatMap((file) =>
+      findCallsMissingArgument(file.source, KIND_ARGUMENT_BY_METHOD).map(
+        (site) => `${file.relativePath}:${site}`
+      )
+    )
+
+    expect(missing).toEqual([])
+  })
+})
diff --git a/src/main/runtime/terminal-intentional-stop-exit.test.ts b/src/main/runtime/terminal-intentional-stop-exit.test.ts
new file mode 100644
index 000000000000..0c3f996153f4
--- /dev/null
+++ b/src/main/runtime/terminal-intentional-stop-exit.test.ts
@@ -0,0 +1,288 @@
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import type { BrowserWindow } from 'electron'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { makePaneKey } from '../../shared/stable-pane-id'
+import { Store } from '../persistence/loading-store/store'
+import { ProfileStateSqliteAuthority } from '../persistence/profile-state/profile-state-sqlite-authority'
+import { wirePtyIpcSession } from '../ipc/pty/delivery/wire-session'
+import { SYNTHETIC_KILL_EXIT_DUPLICATE_WINDOW_MS } from '../ipc/pty/delivery/visibility-state'
+import { bindProviderListeners } from '../ipc/pty/provider/bind-listeners'
+import {
+  stopRendererOwnedPty,
+  stopReplacedPanePty,
+  type PtyKillIpcDeps
+} from '../ipc/pty/ipc/renderer-kill'
+import { ptyIncarnationById, ptyOwnership } from '../ipc/pty/provider/ownership-state'
+import { getLocalPtyProvider, setLocalPtyProvider } from '../ipc/pty/provider/registry'
+import { createPtyIpcSession } from '../ipc/pty/session'
+import type { IPtyProvider } from '../providers/types'
+import { OrcaRuntimeService } from './orca-runtime'
+import {
+  INCARNATION_ID,
+  LEAF_ID,
+  PTY_ID,
+  REPO_ID,
+  TAB_ID,
+  WORKTREE_ID,
+  WORKTREE_PATH,
+  makeSession
+} from './__fixtures__/orca-runtime-terminal-close-continuity-state-fixture'
+import { advanceTerminalTopologyRevision } from './workspace-session-terminal-membership-authority'
+
+const REPLACEMENT_PTY_ID = 'pty-close-continuity-replacement'
+const REPLACEMENT_INCARNATION_ID = '77777777-7777-4777-8777-777777777777'
+const LATER_INCARNATION_ID = '88888888-8888-4888-8888-888888888888'
+
+const directories: string[] = []
+const stores: Store[] = []
+const priorProvider = getLocalPtyProvider()
+afterEach(() => {
+  vi.useRealTimers()
+  setLocalPtyProvider(priorProvider)
+  ptyOwnership.delete(PTY_ID)
+  ptyIncarnationById.delete(PTY_ID)
+  for (const store of stores.splice(0)) {
+    store.freezeWrites()
+  }
+  for (const directory of directories.splice(0)) {
+    rmSync(directory, { recursive: true, force: true })
+  }
+})
+
+/** A real store and runtime with one bound pane, and main's exit delivery to a renderer stub.
+ *  `lateProviderExit`: the kill's reply overtakes the exit, so main synthesizes one and the
+ *  provider's own exit arrives later through its listener. */
+function createHarness(opts: { lateProviderExit?: boolean; folder?: boolean } = {}) {
+  const directory = mkdtempSync(join(tmpdir(), 'orca-intentional-stop-'))
+  directories.push(directory)
+  const store = new Store({
+    dataFile: join(directory, 'orca-data.json'),
+    profileStateAuthority: new ProfileStateSqliteAuthority(
+      join(directory, 'profile-state.db'),
+      'intentional-stop'
+    )
+  })
+  stores.push(store)
+  store.addRepo({
+    id: REPO_ID,
+    path: WORKTREE_PATH,
+    displayName: 'Fixture',
+    badgeColor: 'gray',
+    addedAt: 1,
+    // Why: a folder workspace resolves without git, which the sleep transaction needs.
+    ...(opts.folder ? { kind: 'folder' as const } : {})
+  })
+  store.setWorkspaceSession(advanceTerminalTopologyRevision(makeSession(), WORKTREE_ID))
+  store.flushOrThrow()
+  const runtime = new OrcaRuntimeService(store)
+  runtime.registerPty(PTY_ID, WORKTREE_ID, null, {
+    tabId: TAB_ID,
+    leafId: LEAF_ID,
+    incarnationId: INCARNATION_ID
+  })
+  ptyOwnership.set(PTY_ID, null)
+  ptyIncarnationById.set(PTY_ID, INCARNATION_ID)
+  let emitProviderExit:
+    | ((payload: { id: string; code: number; incarnationId?: string }) => void)
+    | undefined
+  const provider = {
+    onData: () => () => {},
+    onExit: (listener: typeof emitProviderExit) => {
+      emitProviderExit = listener
+      return () => {}
+    }
+  }
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the listeners bind only onData and onExit, and the renderer kill hands the provider to the shutdown port below.
+  setLocalPtyProvider(provider as unknown as IPtyProvider)
+  const rendererSend = vi.fn()
+  const window = { isDestroyed: () => false, webContents: { send: rendererSend } }
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: exit delivery reads only isDestroyed and webContents.send.
+  const session = createPtyIpcSession({ mainWindow: window as unknown as BrowserWindow, runtime })
+  wirePtyIpcSession(session)
+  bindProviderListeners(session)
+  const deps: PtyKillIpcDeps = {
+    store,
+    runtime,
+    getLocalPtyProviderStartupPromise: () => undefined,
+    // The provider's own exit, delivered the way its listener delivers it.
+    shutdownProviderAndDetectExit: async (_provider, id) => {
+      if (opts.lateProviderExit) {
+        return false
+      }
+      runtime.onPtyExit(id, 0, INCARNATION_ID, { providerExitObserved: true })
+      session.sendPtyExitToRenderer({ id, code: 0, incarnationId: INCARNATION_ID })
+      return true
+    },
+    rememberSyntheticKillExit: session.rememberSyntheticKillExit,
+    sendPtyExitToRenderer: session.sendPtyExitToRenderer
+  }
+  return {
+    store,
+    runtime,
+    deps,
+    emitProviderExit: (incarnationId: string) =>
+      emitProviderExit?.({ id: PTY_ID, code: 0, incarnationId }),
+    boundPtyId: () =>
+      store.getWorkspaceSession().terminalLayoutsByTabId[TAB_ID]?.ptyIdsByLeafId?.[LEAF_ID] ?? null,
+    tabIds: () => (store.getWorkspaceSession().tabsByWorktree[WORKTREE_ID] ?? []).map((t) => t.id),
+    rendererExits: () =>
+      rendererSend.mock.calls.filter(([channel]) => channel === 'pty:exit').map(([, p]) => p)
+  }
+}
+
+describe('intentional stops keep the pane through the exit', () => {
+  it('retires the pane when an ordinary close ends the process', async () => {
+    const harness = createHarness()
+
+    await stopRendererOwnedPty(harness.deps, { id: PTY_ID })
+
+    expect(harness.boundPtyId()).toBeNull()
+    expect(harness.rendererExits()).toEqual([
+      { id: PTY_ID, code: 0, incarnationId: INCARNATION_ID }
+    ])
+  })
+
+  it('keeps the tab and its wake binding when the renderer hibernates the pane', async () => {
+    const harness = createHarness()
+
+    await stopRendererOwnedPty(harness.deps, { id: PTY_ID, keepHistory: true })
+
+    expect(harness.tabIds()).toEqual([TAB_ID])
+    expect(harness.boundPtyId()).toBe(PTY_ID)
+    expect(harness.rendererExits()).toEqual([
+      { id: PTY_ID, code: 0, incarnationId: INCARNATION_ID, preserveRendererBinding: true }
+    ])
+  })
+
+  it('keeps a typed pane that a restart replaces, and binds the replacement', async () => {
+    const harness = createHarness()
+    harness.runtime.terminalRunFacts.recordSpawnCommit({
+      id: PTY_ID,
+      incarnationId: INCARNATION_ID
+    })
+    harness.runtime.terminalRunFacts.recordInput(PTY_ID, 'driving', 'ls\r')
+
+    await stopReplacedPanePty(harness.deps, PTY_ID)
+    expect(harness.boundPtyId()).toBe(PTY_ID)
+    await harness.store.persistPtyBinding({
+      worktreeId: WORKTREE_ID,
+      tabId: TAB_ID,
+      leafId: LEAF_ID,
+      ptyId: REPLACEMENT_PTY_ID,
+      incarnationId: REPLACEMENT_INCARNATION_ID,
+      origin: 'spawn'
+    })
+
+    expect(harness.tabIds()).toEqual([TAB_ID])
+    expect(harness.boundPtyId()).toBe(REPLACEMENT_PTY_ID)
+    expect(
+      harness.store.getWorkspaceSession().terminalPtyIncarnationsByPaneKey?.[
+        makePaneKey(TAB_ID, LEAF_ID)
+      ]
+    ).toBe(REPLACEMENT_INCARNATION_ID)
+    expect(harness.rendererExits()).toEqual([
+      { id: PTY_ID, code: 0, incarnationId: INCARNATION_ID, replacedByRestart: true }
+    ])
+  })
+
+  it('labels the exit for both a sleep and a restart that stop the same process', async () => {
+    const harness = createHarness()
+    const settleSleep = harness.runtime.intentionalPtyStops.mark(
+      PTY_ID,
+      'reversible',
+      INCARNATION_ID
+    )
+
+    await stopReplacedPanePty(harness.deps, PTY_ID)
+    settleSleep(true)
+
+    expect(harness.boundPtyId()).toBe(PTY_ID)
+    expect(harness.rendererExits()).toEqual([
+      {
+        id: PTY_ID,
+        code: 0,
+        incarnationId: INCARNATION_ID,
+        preserveRendererBinding: true,
+        replacedByRestart: true
+      }
+    ])
+  })
+
+  it('keeps the pane through the synthetic exit and the provider exit that follows it', async () => {
+    const harness = createHarness({ lateProviderExit: true })
+
+    await stopRendererOwnedPty(harness.deps, { id: PTY_ID, keepHistory: true })
+    harness.emitProviderExit(INCARNATION_ID)
+
+    expect(harness.tabIds()).toEqual([TAB_ID])
+    expect(harness.boundPtyId()).toBe(PTY_ID)
+    expect(harness.rendererExits()).toEqual([
+      { id: PTY_ID, code: -1, incarnationId: INCARNATION_ID, preserveRendererBinding: true }
+    ])
+  })
+
+  it('never reads the exit of a later process on the same id as the stop', async () => {
+    const harness = createHarness({ lateProviderExit: true })
+    await stopRendererOwnedPty(harness.deps, { id: PTY_ID, keepHistory: true })
+    harness.runtime.registerPty(PTY_ID, WORKTREE_ID, null, {
+      tabId: TAB_ID,
+      leafId: LEAF_ID,
+      incarnationId: LATER_INCARNATION_ID
+    })
+    ptyIncarnationById.set(PTY_ID, LATER_INCARNATION_ID)
+    await harness.store.persistPtyBinding({
+      worktreeId: WORKTREE_ID,
+      tabId: TAB_ID,
+      leafId: LEAF_ID,
+      ptyId: PTY_ID,
+      incarnationId: LATER_INCARNATION_ID,
+      origin: 'reattach'
+    })
+
+    harness.emitProviderExit(LATER_INCARNATION_ID)
+
+    // Why wait: an unstopped exit retires the pane through an async durable save.
+    await vi.waitFor(() => expect(harness.boundPtyId()).toBeNull())
+    expect(harness.rendererExits().at(-1)).toEqual({
+      id: PTY_ID,
+      code: 0,
+      incarnationId: LATER_INCARNATION_ID
+    })
+  })
+
+  it('forgets the stop once the duplicate-exit window after it closes', async () => {
+    vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout'] })
+    const harness = createHarness({ lateProviderExit: true })
+    await stopRendererOwnedPty(harness.deps, { id: PTY_ID, keepHistory: true })
+
+    vi.advanceTimersByTime(SYNTHETIC_KILL_EXIT_DUPLICATE_WINDOW_MS - 1)
+    expect(harness.runtime.intentionalPtyStops.claimExit(PTY_ID, INCARNATION_ID)).toEqual([
+      'reversible'
+    ])
+    vi.advanceTimersByTime(1)
+
+    expect(harness.runtime.intentionalPtyStops.claimExit(PTY_ID, INCARNATION_ID)).toEqual([])
+  })
+
+  it('keeps the tab and its wake binding when the runtime puts the worktree to sleep', async () => {
+    const harness = createHarness({ folder: true })
+    const inventories = [[{ id: PTY_ID, worktreeId: WORKTREE_ID, cwd: WORKTREE_PATH, title: 'a' }]]
+    harness.runtime.setPtyController({
+      write: () => true,
+      kill: () => true,
+      stopAndWait: async (ptyId) => {
+        harness.runtime.onPtyExit(ptyId, -1, INCARNATION_ID, { providerExitObserved: true })
+        return true
+      },
+      getForegroundProcess: async () => null,
+      listProcesses: async () => inventories.shift() ?? []
+    })
+
+    await harness.runtime.sleepTerminalsForWorktree(`id:${WORKTREE_ID}`)
+
+    expect(harness.tabIds()).toEqual([TAB_ID])
+    expect(harness.boundPtyId()).toBe(PTY_ID)
+  })
+})
diff --git a/src/main/runtime/terminal-intentional-stops.test.ts b/src/main/runtime/terminal-intentional-stops.test.ts
new file mode 100644
index 000000000000..d37fc4147e8b
--- /dev/null
+++ b/src/main/runtime/terminal-intentional-stops.test.ts
@@ -0,0 +1,112 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { SYNTHETIC_KILL_EXIT_DUPLICATE_WINDOW_MS } from '../ipc/pty/delivery/visibility-state'
+import { TerminalIntentionalStops } from './terminal-intentional-stops'
+
+afterEach(() => {
+  vi.useRealTimers()
+})
+
+describe('terminal intentional stops', () => {
+  it('keeps the mark while a second overlapping owner still holds it', () => {
+    const stops = new TerminalIntentionalStops()
+    const settleFirst = stops.mark('pty-1', 'reversible', 'inc-1')
+    const settleSecond = stops.mark('pty-1', 'reversible', 'inc-1')
+
+    settleFirst(false)
+
+    expect(stops.isReversibleStopInFlight('pty-1')).toBe(true)
+    expect(stops.claimExit('pty-1', 'inc-1')).toEqual(['reversible'])
+    settleSecond(false)
+    expect(stops.claimExit('pty-1', 'inc-1')).toEqual([])
+  })
+
+  it('still reads an exit that lands after the stop settled, until the window closes', () => {
+    vi.useFakeTimers()
+    const stops = new TerminalIntentionalStops()
+    const settle = stops.mark('pty-ssh', 'reversible', 'inc-1')
+
+    settle(true)
+    vi.advanceTimersByTime(SYNTHETIC_KILL_EXIT_DUPLICATE_WINDOW_MS - 1)
+
+    expect(stops.isReversibleStopInFlight('pty-ssh')).toBe(false)
+    expect(stops.claimExit('pty-ssh', 'inc-1')).toEqual(['reversible'])
+    vi.advanceTimersByTime(1)
+    expect(stops.claimExit('pty-ssh', 'inc-1')).toEqual([])
+  })
+
+  it('drops the mark at once when the stop fails', () => {
+    const stops = new TerminalIntentionalStops()
+
+    stops.mark('pty-1', 'replaced', 'inc-1')(false)
+
+    expect(stops.claimExit('pty-1', 'inc-1')).toEqual([])
+  })
+
+  it('reads the synthetic exit and the provider exit of the same process alike', () => {
+    const stops = new TerminalIntentionalStops()
+    const settle = stops.mark('pty-1', 'replaced', null)
+
+    expect(stops.claimExit('pty-1', 'inc-1')).toEqual(['replaced'])
+    settle(true)
+
+    expect(stops.claimExit('pty-1', 'inc-1')).toEqual(['replaced'])
+    expect(stops.claimExit('pty-1', 'inc-2')).toEqual([])
+  })
+
+  it('never marks the exit of another process that reuses the id', () => {
+    const stops = new TerminalIntentionalStops()
+    stops.mark('pty-1', 'reversible', 'inc-1')
+
+    expect(stops.claimExit('pty-1', 'inc-2')).toEqual([])
+  })
+
+  it('starts a new stop of the same id fresh once the prior one settled', () => {
+    const stops = new TerminalIntentionalStops()
+    stops.mark('pty-1', 'reversible', 'inc-1')(true)
+
+    const settle = stops.mark('pty-1', 'replaced', 'inc-2')
+
+    expect(stops.claimExit('pty-1', 'inc-1')).toEqual([])
+    expect(stops.claimExit('pty-1', 'inc-2')).toEqual(['replaced'])
+    settle(false)
+    expect(stops.claimExit('pty-1', 'inc-2')).toEqual([])
+  })
+
+  it('labels one exit with every kind of stop that overlapped on it', () => {
+    const stops = new TerminalIntentionalStops()
+    const settleSleep = stops.mark('pty-1', 'reversible', 'inc-1')
+    const settleRestart = stops.mark('pty-1', 'replaced', 'inc-1')
+
+    expect(stops.isReversibleStopInFlight('pty-1')).toBe(true)
+    expect(stops.claimExit('pty-1', 'inc-1')).toEqual(['reversible', 'replaced'])
+
+    settleSleep(true)
+    expect(stops.isReversibleStopInFlight('pty-1')).toBe(false)
+    settleRestart(false)
+    expect(stops.claimExit('pty-1', 'inc-1')).toEqual(['reversible'])
+  })
+
+  it('keeps a landed stop when a later stop of the same process fails', () => {
+    const stops = new TerminalIntentionalStops()
+    stops.mark('pty-1', 'reversible', 'inc-1')(true)
+
+    stops.mark('pty-1', 'reversible', 'inc-1')(false)
+
+    expect(stops.claimExit('pty-1', 'inc-1')).toEqual(['reversible'])
+  })
+
+  it('lets a new process on the id supersede a landed stop no exit pinned', () => {
+    const stops = new TerminalIntentionalStops()
+    stops.mark('pty-unpinned', 'reversible', null)(true)
+    stops.mark('pty-pinned', 'reversible', 'inc-1')(true)
+    stops.mark('pty-in-flight', 'replaced', null)
+
+    for (const ptyId of ['pty-unpinned', 'pty-pinned', 'pty-in-flight']) {
+      stops.noteSpawnCommit(ptyId)
+    }
+
+    expect(stops.claimExit('pty-unpinned', null)).toEqual([])
+    expect(stops.claimExit('pty-pinned', 'inc-1')).toEqual(['reversible'])
+    expect(stops.claimExit('pty-in-flight', null)).toEqual(['replaced'])
+  })
+})
diff --git a/src/main/runtime/terminal-intentional-stops.ts b/src/main/runtime/terminal-intentional-stops.ts
new file mode 100644
index 000000000000..b89bc709e5f2
--- /dev/null
+++ b/src/main/runtime/terminal-intentional-stops.ts
@@ -0,0 +1,122 @@
+import { SYNTHETIC_KILL_EXIT_DUPLICATE_WINDOW_MS } from '../ipc/pty/delivery/visibility-state'
+
+/**
+ * Why main stopped a PTY on purpose. Both kinds keep the pane's binding through the exit:
+ * - `reversible`: sleep or hibernation; the binding is the wake hint.
+ * - `replaced`: a restart stops the old process so a new one can take the pane.
+ */
+export type TerminalIntentionalStopKind = 'reversible' | 'replaced'
+
+type IntentionalStopOwners = { inFlight: number; stopped: boolean }
+
+type IntentionalStop = {
+  /** Null until known; the first exit that claims the stop pins it to that process. */
+  incarnationId: string | null
+  /** Why per kind: overlapping stops of different kinds each hold their own label on the exit. */
+  ownersByKind: Map<TerminalIntentionalStopKind, IntentionalStopOwners>
+  expiryTimer?: ReturnType<typeof setTimeout>
+}
+
+const NO_INTENTIONAL_STOP: readonly TerminalIntentionalStopKind[] = []
+
+function hasInFlightOwners(stop: IntentionalStop): boolean {
+  return [...stop.ownersByKind.values()].some((owners) => owners.inFlight > 0)
+}
+
+/** The one register of PTY stops main made on purpose, read by every exit path. */
+export class TerminalIntentionalStops {
+  private readonly stopsByPtyId = new Map<string, IntentionalStop>()
+
+  /** Registers one owner's stop; call the result once with whether the stop landed. */
+  mark(
+    ptyId: string,
+    kind: TerminalIntentionalStopKind,
+    incarnationId: string | null
+  ): (stopped: boolean) => void {
+    let stop = this.stopsByPtyId.get(ptyId)
+    if (stop && this.joins(stop, incarnationId)) {
+      clearTimeout(stop.expiryTimer)
+      stop.expiryTimer = undefined
+      stop.incarnationId ??= incarnationId
+    } else {
+      clearTimeout(stop?.expiryTimer)
+      stop = { incarnationId, ownersByKind: new Map() }
+      this.stopsByPtyId.set(ptyId, stop)
+    }
+    const owners = stop.ownersByKind.get(kind) ?? { inFlight: 0, stopped: false }
+    owners.inFlight += 1
+    stop.ownersByKind.set(kind, owners)
+    const owned = stop
+    let settled = false
+    return (stopped) => {
+      if (settled || this.stopsByPtyId.get(ptyId) !== owned) {
+        return
+      }
+      settled = true
+      owners.stopped ||= stopped
+      owners.inFlight -= 1
+      if (owners.inFlight === 0 && !owners.stopped) {
+        owned.ownersByKind.delete(kind)
+      }
+      this.settleIfIdle(ptyId, owned)
+    }
+  }
+
+  /** The kinds of stop this exit ends; empty when the process was not stopped on purpose. */
+  claimExit(
+    ptyId: string,
+    exitIncarnationId: string | null | undefined
+  ): readonly TerminalIntentionalStopKind[] {
+    const stop = this.stopsByPtyId.get(ptyId)
+    if (!stop) {
+      return NO_INTENTIONAL_STOP
+    }
+    if (stop.incarnationId && exitIncarnationId && stop.incarnationId !== exitIncarnationId) {
+      return NO_INTENTIONAL_STOP
+    }
+    stop.incarnationId ??= exitIncarnationId ?? null
+    return [...stop.ownersByKind.keys()]
+  }
+
+  /** Whether a stop of this PTY that may still be undone is in flight. */
+  isReversibleStopInFlight(ptyId: string): boolean {
+    return (this.stopsByPtyId.get(ptyId)?.ownersByKind.get('reversible')?.inFlight ?? 0) > 0
+  }
+
+  /** A process committed on this id. A landed stop's process is dead, so an entry no exit ever
+   *  pinned could otherwise claim the new process's exit as the stop. */
+  noteSpawnCommit(ptyId: string): void {
+    const stop = this.stopsByPtyId.get(ptyId)
+    if (stop && stop.incarnationId === null && !hasInFlightOwners(stop)) {
+      clearTimeout(stop.expiryTimer)
+      this.stopsByPtyId.delete(ptyId)
+    }
+  }
+
+  // Why: a settled entry joins only its own known process, so an id reused by a process whose
+  // incarnation is not yet known never inherits the old stop.
+  private joins(stop: IntentionalStop, incarnationId: string | null): boolean {
+    if (stop.incarnationId !== null && stop.incarnationId === incarnationId) {
+      return true
+    }
+    return hasInFlightOwners(stop) && (stop.incarnationId === null || incarnationId === null)
+  }
+
+  private settleIfIdle(ptyId: string, stop: IntentionalStop): void {
+    if (hasInFlightOwners(stop)) {
+      return
+    }
+    if (stop.ownersByKind.size === 0) {
+      this.stopsByPtyId.delete(ptyId)
+      return
+    }
+    // Why a window: an SSH exit can arrive after the stop settles, and a synthetic exit can be
+    // followed by the provider's own; both describe the same stopped process.
+    stop.expiryTimer = setTimeout(() => {
+      if (this.stopsByPtyId.get(ptyId) === stop) {
+        this.stopsByPtyId.delete(ptyId)
+      }
+    }, SYNTHETIC_KILL_EXIT_DUPLICATE_WINDOW_MS)
+    stop.expiryTimer.unref?.()
+  }
+}
diff --git a/src/main/runtime/terminal-interactive-wait-visibility.test.ts b/src/main/runtime/terminal-interactive-wait-visibility.test.ts
index 3a6470b41f9d..b79ea7a3270a 100644
--- a/src/main/runtime/terminal-interactive-wait-visibility.test.ts
+++ b/src/main/runtime/terminal-interactive-wait-visibility.test.ts
@@ -92,9 +92,9 @@ describe('terminal interactive-wait visibility (STA-4513, STA-3714)', () => {
       await expect(
         assertTerminalAgentSendable({ runtime, handle, assertWritable: () => {} })
       ).rejects.toThrow('terminal_guard_permission')
-      await expect(runtime.sendTerminalAgentPrompt(handle, 'coordinator preamble')).rejects.toThrow(
-        'agent_prompt_blocked'
-      )
+      await expect(
+        runtime.sendTerminalAgentPrompt(handle, 'coordinator preamble', { inputKind: 'driving' })
+      ).rejects.toThrow('agent_prompt_blocked')
     })
 
     it('lets a dispatch preamble through once the same lane is working', async () => {
diff --git a/src/main/runtime/terminal-list-pending-pty-registration.test.ts b/src/main/runtime/terminal-list-pending-pty-registration.test.ts
new file mode 100644
index 000000000000..62a5daf78e3b
--- /dev/null
+++ b/src/main/runtime/terminal-list-pending-pty-registration.test.ts
@@ -0,0 +1,144 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import {
+  createInventoryRuntime,
+  deferred,
+  processRow,
+  PREDECESSOR,
+  PTY,
+  WORKTREE
+} from './pty-inventory-lifecycle-fixture'
+
+const TAB = '40000000-0000-4000-8000-000000000001'
+const LEAF = '40000000-0000-4000-8000-000000000002'
+
+afterEach(() => vi.restoreAllMocks())
+
+describe('terminal listing while a spawn binding is being persisted', () => {
+  it.each([
+    { host: 'local', ptyId: PTY, connectionId: null, phase: 'binding', incarnationId: PREDECESSOR },
+    {
+      host: 'SSH',
+      ptyId: 'ssh:host-a@@pty2:pending-spawn:1',
+      connectionId: 'host-a',
+      phase: 'binding'
+    },
+    { host: 'local', ptyId: PTY, connectionId: null, phase: 'provider' },
+    {
+      host: 'SSH',
+      ptyId: 'ssh:host-a@@pty2:pending-spawn:1',
+      connectionId: 'host-a',
+      phase: 'provider'
+    }
+  ])(
+    'does not authorize orphan adoption during $host $phase admission',
+    async ({ ptyId, connectionId, phase, incarnationId }) => {
+      const bindingPersisted = deferred<void>()
+      const { runtime } = createInventoryRuntime(async () => [processRow(ptyId)])
+      runtime.attachWindow(1)
+      runtime.syncWindowGraph(1, {
+        tabs: [{ tabId: TAB, worktreeId: WORKTREE, title: '', activeLeafId: LEAF, layout: null }],
+        leaves: [
+          {
+            tabId: TAB,
+            worktreeId: WORKTREE,
+            leafId: LEAF,
+            paneRuntimeId: 1,
+            ptyId: null,
+            paneTitle: null,
+            title: ''
+          }
+        ]
+      })
+
+      const releaseSpawn =
+        phase === 'provider' ? await runtime.acquireWorktreeTerminalSpawn(WORKTREE) : undefined
+      if (phase === 'binding') {
+        runtime.beginPtyRegistration(ptyId, incarnationId)
+      }
+      // Spawn commit awaits durable binding persistence before publishing the runtime surface.
+      const commit = bindingPersisted.promise.then(() => {
+        runtime.registerPty(ptyId, WORKTREE, connectionId, {
+          tabId: TAB,
+          leafId: LEAF,
+          incarnationId: PREDECESSOR
+        })
+      })
+      try {
+        await expect(
+          runtime.listTerminals(`id:${WORKTREE}`, undefined, {
+            requireFreshPtyLiveness: true,
+            includeVisualLayouts: false
+          })
+        ).rejects.toThrow('terminal_surface_ownership_unavailable')
+        expect(runtime.capture(ptyId).verdict).toMatchObject({ status: 'live' })
+      } finally {
+        bindingPersisted.resolve()
+        try {
+          await commit
+        } finally {
+          releaseSpawn?.()
+        }
+      }
+
+      const committed = await runtime.listTerminals(`id:${WORKTREE}`, undefined, {
+        requireFreshPtyLiveness: true,
+        includeVisualLayouts: false
+      })
+      expect(committed.terminals).toEqual([
+        expect.objectContaining({
+          ptyId,
+          tabId: TAB,
+          leafId: LEAF,
+          connected: true,
+          incarnationId: PREDECESSOR,
+          orphaned: false
+        })
+      ])
+    }
+  )
+
+  it('continues reporting a committed surface while another spawn is pending', async () => {
+    const { runtime } = createInventoryRuntime(async () => [processRow()])
+    runtime.register()
+    const releaseSpawn = await runtime.acquireWorktreeTerminalSpawn(WORKTREE)
+    try {
+      const listed = await runtime.listTerminals(`id:${WORKTREE}`)
+      expect(listed.terminals).toEqual([
+        expect.objectContaining({ ptyId: PTY, connected: true, orphaned: false })
+      ])
+    } finally {
+      releaseSpawn()
+    }
+  })
+
+  it('does not block orphan recovery in an unrelated workspace', async () => {
+    const { runtime } = createInventoryRuntime(async () => [processRow()])
+    const releaseSpawn = await runtime.acquireWorktreeTerminalSpawn('repo::/tmp/another-workspace')
+    try {
+      const listed = await runtime.listTerminals(`id:${WORKTREE}`)
+      expect(listed.terminals).toEqual([
+        expect.objectContaining({ ptyId: PTY, connected: true, orphaned: true })
+      ])
+    } finally {
+      releaseSpawn()
+    }
+  })
+
+  it('permits orphan recovery once the competing spawn admission has ended', async () => {
+    const { runtime } = createInventoryRuntime(async () => [processRow()])
+    const releaseSpawn = await runtime.acquireWorktreeTerminalSpawn(WORKTREE)
+    runtime.beginPtyRegistration(PTY, PREDECESSOR)
+    try {
+      await expect(runtime.listTerminals(`id:${WORKTREE}`)).rejects.toThrow(
+        'terminal_surface_ownership_unavailable'
+      )
+    } finally {
+      runtime.cancelPendingPtyRegistration(PTY, PREDECESSOR)
+      releaseSpawn()
+    }
+    const listed = await runtime.listTerminals(`id:${WORKTREE}`)
+    expect(listed.terminals).toEqual([
+      expect.objectContaining({ ptyId: PTY, connected: true, orphaned: true })
+    ])
+  })
+})
diff --git a/src/main/runtime/terminal-query-responder.test.ts b/src/main/runtime/terminal-query-responder.test.ts
index 9db883529a00..f479be9e47ae 100644
--- a/src/main/runtime/terminal-query-responder.test.ts
+++ b/src/main/runtime/terminal-query-responder.test.ts
@@ -21,6 +21,7 @@ import {
   setTerminalViewAttributes
 } from './terminal-view-attribute-store'
 import type { TerminalViewAttributes, TerminalViewRgb } from '../../shared/terminal-view-attributes'
+import type { TerminalInputKind } from '../../shared/terminal-input-kind'
 
 const settingsState = {
   terminalMainSideEffectAuthority: true as boolean,
@@ -58,9 +59,11 @@ type RendererBufferStub = { data: string; cols: number; rows: number }
 function createResponderRuntime(opts: { rendererBuffer?: RendererBufferStub } = {}) {
   const runtime = new OrcaRuntimeService(store)
   const replies: { ptyId: string; data: string }[] = []
+  const inputKinds: TerminalInputKind[] = []
   runtime.setPtyController({
-    write: (ptyId, data) => {
+    write: (ptyId, data, inputKind) => {
       replies.push({ ptyId, data })
+      inputKinds.push(inputKind)
       return true
     },
     kill: () => true,
@@ -74,7 +77,7 @@ function createResponderRuntime(opts: { rendererBuffer?: RendererBufferStub } =
         }
       : {})
   })
-  return { runtime, replies }
+  return { runtime, replies, inputKinds }
 }
 
 /** Awaits the per-PTY emulator writeChain so queued chunk links (and the
@@ -146,7 +149,7 @@ describe('reply parity for hidden-dropped chunks', () => {
     ['kitty CSI ? u default flags', '\x1b[?u', ['\x1b[?0u']],
     ['kitty CSI ? u reports pushed flags', '\x1b[=5;1u\x1b[?u', ['\x1b[?5u']]
   ])('%s', async (_label, chunk, expectedReplies) => {
-    const { runtime, replies } = createResponderRuntime()
+    const { runtime, replies, inputKinds } = createResponderRuntime()
     markHiddenRendererPty('pty-q')
 
     runtime.onPtyData('pty-q', chunk, Date.now())
@@ -154,6 +157,8 @@ describe('reply parity for hidden-dropped chunks', () => {
 
     expect(replies.map((reply) => reply.data)).toEqual(expectedReplies)
     expect(replies.every((reply) => reply.ptyId === 'pty-q')).toBe(true)
+    // Why: a reply written as driving input would read the untouched run as typed.
+    expect(inputKinds).toEqual(expectedReplies.map(() => 'query-reply'))
   })
 
   it.each([
diff --git a/src/main/runtime/terminal-retirement-async-durability.test.ts b/src/main/runtime/terminal-retirement-async-durability.test.ts
new file mode 100644
index 000000000000..038832782d7b
--- /dev/null
+++ b/src/main/runtime/terminal-retirement-async-durability.test.ts
@@ -0,0 +1,70 @@
+import { afterEach, expect, it, vi } from 'vitest'
+import {
+  ACK_INCARNATION,
+  ACK_LEAF,
+  ACK_TAB,
+  createAcknowledgedTabRetirementFixture
+} from './acknowledged-terminal-tab-retirement-fixture'
+
+const fixtures: ReturnType<typeof createAcknowledgedTabRetirementFixture>[] = []
+afterEach(async () => {
+  for (const fixture of fixtures.splice(0)) {
+    await fixture.dispose()
+  }
+})
+function fixture() {
+  const result = createAcknowledgedTabRetirementFixture(true)
+  fixtures.push(result)
+  return result
+}
+
+it('withholds the acknowledged close until its host retirement is durable', async () => {
+  const f = fixture()
+  let acknowledged = false
+  const closing = f.close().then((result) => {
+    acknowledged = true
+    return result
+  })
+  await f.entered.promise
+  const gate = f.authority.pause()
+  f.acknowledgement.resolve()
+  await gate.started.promise
+  expect(acknowledged).toBe(false)
+  gate.finish.resolve()
+  await expect(closing).resolves.toEqual({ closed: true })
+  expect(f.hasTab()).toBe(false)
+})
+
+it('publishes physical-exit retirement only after durability', async () => {
+  const f = fixture()
+  await f.store.flushPendingOrThrowAsync()
+  const published = vi.fn()
+  const unsubscribe = f.runtime.onMobileSessionTabsChanged(published)
+  const gate = f.authority.pause()
+  const exiting = f.runtime.onPtyExit('pty-a', 0, ACK_INCARNATION, { providerExitObserved: true })
+  await gate.started.promise
+  expect(published).not.toHaveBeenCalled()
+  gate.finish.resolve()
+  await exiting
+  expect(published).toHaveBeenCalled()
+  expect(
+    f.store.getWorkspaceSession().terminalLayoutsByTabId[ACK_TAB].ptyIdsByLeafId?.[ACK_LEAF]
+  ).toBeUndefined()
+  unsubscribe()
+})
+
+it('does not publish a delayed exit over a newly admitted incarnation', async () => {
+  const f = fixture()
+  await f.store.flushPendingOrThrowAsync()
+  const published = vi.fn()
+  const unsubscribe = f.runtime.onMobileSessionTabsChanged(published)
+  const gate = f.authority.pause()
+  const exiting = f.runtime.onPtyExit('pty-a', 0, ACK_INCARNATION, { providerExitObserved: true })
+  await gate.started.promise
+  f.runtime.onPtySpawned('pty-a', 'new-incarnation')
+  published.mockClear()
+  gate.finish.resolve()
+  await exiting
+  expect(published).not.toHaveBeenCalled()
+  unsubscribe()
+})
diff --git a/src/main/runtime/terminal-run-facts-input.test.ts b/src/main/runtime/terminal-run-facts-input.test.ts
new file mode 100644
index 000000000000..a1f26d9b6861
--- /dev/null
+++ b/src/main/runtime/terminal-run-facts-input.test.ts
@@ -0,0 +1,244 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import type { TerminalInputKind } from '../../shared/terminal-input-kind'
+import { writePtyFromRuntimeController } from '../ipc/pty/runtime/operations'
+import { getLocalPtyProvider, setLocalPtyProvider } from '../ipc/pty/provider/registry'
+import type { IPtyProvider } from '../providers/types'
+import { settledWriteStub } from '../providers/settled-pty-write-stub'
+import { OrcaRuntimeService } from './orca-runtime'
+import type { RuntimePtyController } from './runtime-pty-controller-contract'
+import { writeOrchestrationPointerWithSettlement } from './orchestration/mailbox-pointer-pty-write'
+import { sendTerminalStreamInput } from './rpc/methods/terminal/terminal-input-delivery'
+import { makeStore } from './runtime-rpc-worktree-store-fixtures'
+import {
+  pasteWorktreeStartupDraftWhenReady,
+  sendWorktreeStartupFollowupWhenReady,
+  type WorktreeStartupReadinessHost
+} from './runtime-worktree-startup-readiness'
+
+vi.mock('../git/worktree', () => {
+  const worktrees = [
+    {
+      path: '/tmp/worktree-a',
+      head: 'abc',
+      branch: 'feature/run-facts',
+      isBare: false,
+      isMainWorktree: false
+    }
+  ]
+  return {
+    listWorktrees: vi.fn().mockResolvedValue(worktrees),
+    listWorktreesStrict: vi.fn().mockResolvedValue(worktrees)
+  }
+})
+
+const PTY_ID = 'pty-run-facts-input'
+const priorProvider = getLocalPtyProvider()
+
+type FreshRun = {
+  runtime: OrcaRuntimeService
+  controller: RuntimePtyController
+  handle: string
+  /** The kind each provider write was sent with, and whether input was recorded by then. */
+  writes: { data: string; inputRecorded: boolean }[]
+  kinds: TerminalInputKind[]
+  firstUserInputAt: () => number | null
+}
+
+/** A fresh shell whose controller writes go through main's real write funnel to a fake provider. */
+async function createFreshRun(): Promise<FreshRun> {
+  const runtime = new OrcaRuntimeService(makeStore() as never)
+  const firstUserInputAt = (): number | null =>
+    runtime.terminalRunFacts.read(PTY_ID, null).firstUserInputAt
+  const writes: FreshRun['writes'] = []
+  const kinds: TerminalInputKind[] = []
+  const write = (_id: string, data: string): boolean => {
+    writes.push({ data, inputRecorded: firstUserInputAt() !== null })
+    if (data.endsWith('\r')) {
+      runtime.onPtyData(PTY_ID, '\x1b]0;Codex working\x07', Date.now())
+    }
+    return true
+  }
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the write funnel calls only write and writeWithSettlement on the provider.
+  setLocalPtyProvider({
+    write,
+    writeWithSettlement: settledWriteStub(write)
+  } as unknown as IPtyProvider)
+  const controller: RuntimePtyController = {
+    spawn: async () => ({ id: PTY_ID }),
+    write: (id, data, inputKind) => {
+      kinds.push(inputKind)
+      return writePtyFromRuntimeController({ runtime }, id, data, inputKind)
+    },
+    writeWithSettlement: (id, data, inputKind) => {
+      kinds.push(inputKind)
+      return writePtyFromRuntimeController({ runtime }, id, data, inputKind, {
+        waitForSettlement: true
+      })
+    },
+    kill: () => true,
+    getForegroundProcess: async () => null
+  }
+  runtime.setPtyController(controller)
+  const terminal = await runtime.createTerminal('path:/tmp/worktree-a', { launchAgent: 'aider' })
+  runtime.terminalRunFacts.recordSpawnCommit({ id: PTY_ID })
+  return { runtime, controller, handle: terminal.handle, writes, kinds, firstUserInputAt }
+}
+
+afterEach(() => {
+  vi.useRealTimers()
+  setLocalPtyProvider(priorProvider)
+})
+
+describe('run facts: the controller write funnel', () => {
+  it('records terminal.send input before the write that could end the process', async () => {
+    const run = await createFreshRun()
+
+    await run.runtime.sendTerminal(
+      run.handle,
+      { text: 'exit', enter: true },
+      { inputKind: 'driving' }
+    )
+
+    expect(run.firstUserInputAt()).not.toBeNull()
+    expect(run.writes.map((write) => write.inputRecorded)).toEqual([true, true])
+  })
+
+  it('records stream input from a client', async () => {
+    const run = await createFreshRun()
+
+    await sendTerminalStreamInput(run.runtime, {
+      terminal: run.handle,
+      text: 'l',
+      client: undefined,
+      isMobile: false
+    })
+
+    expect(run.firstUserInputAt()).not.toBeNull()
+  })
+
+  it('records a dispatched agent prompt before its first write', async () => {
+    vi.useFakeTimers()
+    const run = await createFreshRun()
+
+    const submission = run.runtime.sendTerminalAgentPrompt(run.handle, 'review this', {
+      inputKind: 'driving'
+    })
+    await vi.runAllTimersAsync()
+    await submission.catch(() => undefined)
+
+    expect(run.firstUserInputAt()).not.toBeNull()
+    expect(run.writes[0]?.inputRecorded).toBe(true)
+  })
+
+  it('reads a run launched with a prompt as untyped until someone drives it', async () => {
+    vi.useFakeTimers()
+    const run = await createFreshRun()
+
+    const submission = run.runtime.sendTerminalAgentPrompt(run.handle, 'start here', {
+      inputKind: 'launch'
+    })
+    await vi.runAllTimersAsync()
+    await submission.catch(() => undefined)
+
+    expect(run.writes.length).toBeGreaterThan(0)
+    expect(run.firstUserInputAt()).toBeNull()
+
+    await run.runtime.sendTerminal(run.handle, { text: 'y' }, { inputKind: 'driving' })
+    expect(run.firstUserInputAt()).not.toBeNull()
+  })
+
+  it('records a mailbox pointer, which drives the running agent', async () => {
+    const run = await createFreshRun()
+
+    await writeOrchestrationPointerWithSettlement({
+      ptyId: PTY_ID,
+      data: 'You have 1 unread message.',
+      controller: run.controller
+    })
+
+    expect(run.kinds).toEqual(['driving'])
+    expect(run.firstUserInputAt()).not.toBeNull()
+  })
+
+  it('records nothing for a client query reply', async () => {
+    const run = await createFreshRun()
+
+    await run.runtime.sendTerminal(run.handle, { text: 'y' }, { inputKind: 'query-reply' })
+
+    expect(run.firstUserInputAt()).toBeNull()
+  })
+
+  it.each([
+    ['a terminal reply', '\x1b[3;4R'],
+    ['focus reports', '\x1b[I\x1b[O'],
+    ['the focus-in a desktop sends on reattaching a remote pane', '\x1b[I']
+  ])('records nothing for stream input that is only %s', async (_label, text) => {
+    const run = await createFreshRun()
+
+    await sendTerminalStreamInput(run.runtime, {
+      terminal: run.handle,
+      text,
+      client: undefined,
+      isMobile: false
+    })
+
+    expect(run.writes).toHaveLength(1)
+    expect(run.firstUserInputAt()).toBeNull()
+  })
+
+  it('records a reply mixed with a keystroke', async () => {
+    const run = await createFreshRun()
+
+    await run.runtime.sendTerminal(run.handle, { text: '\x1b[3;4Rx' }, { inputKind: 'driving' })
+
+    expect(run.firstUserInputAt()).not.toBeNull()
+  })
+
+  it('records dashboard preview typing before the write that could end the process', async () => {
+    const run = await createFreshRun()
+
+    await expect(run.runtime.writeTerminalPreviewInput(PTY_ID, 'exit\r')).resolves.toBe(true)
+
+    expect(run.writes.map((write) => write.inputRecorded)).toEqual([true])
+  })
+
+  it('records nothing for dashboard preview bytes that are only a reply or focus reports', async () => {
+    const run = await createFreshRun()
+
+    await run.runtime.writeTerminalPreviewInput(PTY_ID, '\x1b[3;4R')
+    await run.runtime.writeTerminalPreviewInput(PTY_ID, '\x1b[O\x1b[I')
+
+    expect(run.writes).toHaveLength(2)
+    expect(run.firstUserInputAt()).toBeNull()
+  })
+})
+
+describe('run facts: a created worktree’s startup writes', () => {
+  function readinessHost(run: FreshRun): WorktreeStartupReadinessHost {
+    return {
+      getPtyId: () => PTY_ID,
+      getForegroundProcess: async () => 'aider',
+      subscribeToData: () => () => {},
+      // Why: bracketed paste enabled, then quiet, is the default draft-ready signal.
+      readRecentOutput: () => '\x1b[?2004h',
+      write: (ptyId, data, inputKind) => run.controller.write(ptyId, data, inputKind)
+    }
+  }
+
+  it('reads a run whose only input was its create-time draft and follow-up as untyped', async () => {
+    vi.useFakeTimers()
+    const run = await createFreshRun()
+    const host = readinessHost(run)
+
+    pasteWorktreeStartupDraftWhenReady(host, run.handle, { agent: 'aider', content: 'plan it' })
+    sendWorktreeStartupFollowupWhenReady(host, run.handle, {
+      expectedProcess: 'aider',
+      prompt: 'and ship it'
+    })
+    await vi.runAllTimersAsync()
+
+    expect(run.kinds).toEqual(['launch', 'launch'])
+    expect(run.writes).toHaveLength(2)
+    expect(run.firstUserInputAt()).toBeNull()
+  })
+})
diff --git a/src/main/runtime/terminal-run-facts.test.ts b/src/main/runtime/terminal-run-facts.test.ts
new file mode 100644
index 000000000000..e1982ebc968b
--- /dev/null
+++ b/src/main/runtime/terminal-run-facts.test.ts
@@ -0,0 +1,65 @@
+import { describe, expect, it } from 'vitest'
+import { TerminalRunFactsRegister } from './terminal-run-facts'
+
+describe('terminal run facts', () => {
+  it('reads a run main never saw committed as not fresh', () => {
+    expect(new TerminalRunFactsRegister().read('pty-1', 'inc-1')).toEqual({
+      freshSpawn: false,
+      firstUserInputAt: null
+    })
+  })
+
+  it('keeps the first user input across later input and a re-registration of the same process', () => {
+    const facts = new TerminalRunFactsRegister()
+    facts.recordSpawnCommit({ id: 'pty-1', incarnationId: 'inc-1' })
+    facts.recordInput('pty-1', 'driving', 'ls\r', 100)
+    facts.recordInput('pty-1', 'driving', 'ls\r', 200)
+
+    facts.recordSpawnCommit({ id: 'pty-1', incarnationId: 'inc-1', isReattach: true })
+
+    expect(facts.read('pty-1', 'inc-1')).toEqual({ freshSpawn: true, firstUserInputAt: 100 })
+  })
+
+  it('starts a new process clean', () => {
+    const facts = new TerminalRunFactsRegister()
+    facts.recordSpawnCommit({ id: 'pty-1', incarnationId: 'inc-1' })
+    facts.recordInput('pty-1', 'driving', 'ls\r', 100)
+
+    facts.recordSpawnCommit({ id: 'pty-1', incarnationId: 'inc-2' }, { tabId: 'source-tab' })
+
+    expect(facts.read('pty-1', 'inc-2')).toEqual({ freshSpawn: true, firstUserInputAt: null })
+    expect(facts.read('pty-1', 'inc-1')).toEqual({ freshSpawn: false, firstUserInputAt: null })
+  })
+
+  it('never reads a reattached process as fresh', () => {
+    const facts = new TerminalRunFactsRegister()
+
+    facts.recordSpawnCommit({ id: 'pty-1', incarnationId: 'inc-1', isReattach: true })
+
+    expect(facts.read('pty-1', 'inc-1').freshSpawn).toBe(false)
+  })
+
+  it('starts clean when a commit carries no incarnation to tell it from a new process', () => {
+    const facts = new TerminalRunFactsRegister()
+    facts.recordSpawnCommit({ id: 'pty-1' })
+    facts.recordInput('pty-1', 'driving', 'ls\r', 100)
+
+    facts.recordSpawnCommit({ id: 'pty-1', isReattach: true })
+
+    expect(facts.read('pty-1', null)).toEqual({ freshSpawn: false, firstUserInputAt: null })
+  })
+
+  it.each([
+    ['a launch write', 'launch', 'echo startup\r'],
+    ['a query reply', 'query-reply', '\x1b[1;1R'],
+    ['driving bytes that are only a terminal reply', 'driving', '\x1b[1;1R'],
+    ['driving bytes that are only focus reports', 'driving', '\x1b[I\x1b[O']
+  ] as const)('records nothing for %s', (_label, inputKind, data) => {
+    const facts = new TerminalRunFactsRegister()
+    facts.recordSpawnCommit({ id: 'pty-1', incarnationId: 'inc-1' })
+
+    facts.recordInput('pty-1', inputKind, data, 100)
+
+    expect(facts.read('pty-1', 'inc-1').firstUserInputAt).toBeNull()
+  })
+})
diff --git a/src/main/runtime/terminal-run-facts.ts b/src/main/runtime/terminal-run-facts.ts
new file mode 100644
index 000000000000..1fb3e411b6c4
--- /dev/null
+++ b/src/main/runtime/terminal-run-facts.ts
@@ -0,0 +1,90 @@
+import {
+  spawnCommitBindingOrigin,
+  type PtySpawnCommitOrigin
+} from '../persistence/loading-store/pty-binding-span'
+import { isTerminalQueryReply } from '../../shared/terminal-query-reply'
+import type { TerminalInputKind } from '../../shared/terminal-input-kind'
+
+export type TerminalRunFacts = {
+  /** This process was started for its pane, not reattached, adopted or cold-restored. */
+  freshSpawn: boolean
+  /** When input first drove this process, from any client or driver; null if none has. */
+  firstUserInputAt: number | null
+}
+
+// Why: a paired client's xterm answers focus changes (CSI I / CSI O) through input that carries no
+// provenance; the desktop renderer already excludes them via xterm's user-input signal.
+// oxlint-disable-next-line no-control-regex -- focus reports are ESC-framed sequences by definition.
+const TERMINAL_FOCUS_REPORTS_ONLY_RE = new RegExp('^(?:\\u001b\\[[IO])+$')
+
+/** Input with no provenance that no person typed: a whole terminal reply or only focus reports. */
+function isUntypedTerminalInput(payload: string): boolean {
+  return isTerminalQueryReply(payload) || TERMINAL_FOCUS_REPORTS_ONLY_RE.test(payload)
+}
+
+export type TerminalSpawnCommit = Parameters<typeof spawnCommitBindingOrigin>[0] & {
+  id: string
+  incarnationId?: string
+  coldRestore?: object
+}
+
+/** A cold restore starts a new process for a pane that had one, so it is never fresh. */
+type TerminalRunSpawnOrigin = PtySpawnCommitOrigin | 'cold-restore'
+
+type TerminalRunRecord = {
+  incarnationId: string | null
+  spawnOrigin: TerminalRunSpawnOrigin
+  firstUserInputAt: number | null
+}
+
+/** Main's per-process facts about one PTY run, keyed by the incarnation they describe. */
+export class TerminalRunFactsRegister {
+  private readonly runsByPtyId = new Map<string, TerminalRunRecord>()
+
+  /** Once per process: a re-registration of the same incarnation keeps its facts. Without an
+   *  incarnation a commit cannot be told from a new process, so it starts clean. */
+  recordSpawnCommit(commit: TerminalSpawnCommit, expectedSourceBinding?: unknown): void {
+    const incarnationId = commit.incarnationId ?? null
+    if (
+      incarnationId !== null &&
+      this.runsByPtyId.get(commit.id)?.incarnationId === incarnationId
+    ) {
+      return
+    }
+    const origin = spawnCommitBindingOrigin(commit, expectedSourceBinding)
+    this.runsByPtyId.set(commit.id, {
+      incarnationId,
+      spawnOrigin: origin === 'spawn' && commit.coldRestore !== undefined ? 'cold-restore' : origin,
+      firstUserInputAt: null
+    })
+  }
+
+  /** The one record point both write funnels call just before the provider write, because input
+   *  such as `exit` can end the process before the write returns. The payload check backs up a
+   *  writer that labels a reply or focus report as driving. */
+  recordInput(ptyId: string, inputKind: TerminalInputKind, data: string, now = Date.now()): void {
+    if (inputKind !== 'driving') {
+      return
+    }
+    const run = this.runsByPtyId.get(ptyId)
+    if (run && run.firstUserInputAt === null && !isUntypedTerminalInput(data)) {
+      run.firstUserInputAt = now
+    }
+  }
+
+  /** A run main never saw committed reads as not fresh, which keeps today's close-on-exit. */
+  read(ptyId: string, incarnationId: string | null | undefined): TerminalRunFacts {
+    const run = this.runsByPtyId.get(ptyId)
+    if (!run || (run.incarnationId && incarnationId && run.incarnationId !== incarnationId)) {
+      return { freshSpawn: false, firstUserInputAt: null }
+    }
+    return {
+      freshSpawn: run.spawnOrigin === 'spawn' || run.spawnOrigin === 'split',
+      firstUserInputAt: run.firstUserInputAt
+    }
+  }
+
+  delete(ptyId: string): void {
+    this.runsByPtyId.delete(ptyId)
+  }
+}
diff --git a/src/main/runtime/terminal-send-stale-leaf-liveness.test.ts b/src/main/runtime/terminal-send-stale-leaf-liveness.test.ts
index b7c5ed950683..a25ed9817fb5 100644
--- a/src/main/runtime/terminal-send-stale-leaf-liveness.test.ts
+++ b/src/main/runtime/terminal-send-stale-leaf-liveness.test.ts
@@ -96,9 +96,9 @@ describe('sendTerminal absence gate for leaf-branch writes', () => {
     const probe = vi.fn(async () => false)
     const { runtime, handle, write } = await makeRuntimeWithLeafHandle({ probePtyLiveness: probe })
 
-    await expect(runtime.sendTerminal(handle, { text: 'ping' })).rejects.toThrow(
-      'terminal_not_writable'
-    )
+    await expect(
+      runtime.sendTerminal(handle, { text: 'ping' }, { inputKind: 'driving' })
+    ).rejects.toThrow('terminal_not_writable')
 
     expect(probe).toHaveBeenCalledWith(STALE_PTY_ID)
     expect(write).not.toHaveBeenCalled()
@@ -108,9 +108,9 @@ describe('sendTerminal absence gate for leaf-branch writes', () => {
     const probe = vi.fn(async () => false)
     const { runtime, handle, write } = await makeRuntimeWithLeafHandle({ probePtyLiveness: probe })
 
-    await expect(runtime.sendTerminalAgentPrompt(handle, 'do the thing')).rejects.toThrow(
-      'terminal_not_writable'
-    )
+    await expect(
+      runtime.sendTerminalAgentPrompt(handle, 'do the thing', { inputKind: 'driving' })
+    ).rejects.toThrow('terminal_not_writable')
 
     expect(write).not.toHaveBeenCalled()
   })
@@ -120,12 +120,14 @@ describe('sendTerminal absence gate for leaf-branch writes', () => {
       probePtyLiveness: async () => null
     })
 
-    await expect(runtime.sendTerminal(handle, { text: 'ping' })).resolves.toMatchObject({
+    await expect(
+      runtime.sendTerminal(handle, { text: 'ping' }, { inputKind: 'driving' })
+    ).resolves.toMatchObject({
       handle,
       accepted: true
     })
 
-    expect(write).toHaveBeenCalledWith(STALE_PTY_ID, 'ping')
+    expect(write).toHaveBeenCalledWith(STALE_PTY_ID, 'ping', 'driving')
   })
 
   it('treats a throwing probe as unknown and proceeds', async () => {
@@ -135,11 +137,13 @@ describe('sendTerminal absence gate for leaf-branch writes', () => {
       }
     })
 
-    await expect(runtime.sendTerminal(handle, { text: 'ping' })).resolves.toMatchObject({
+    await expect(
+      runtime.sendTerminal(handle, { text: 'ping' }, { inputKind: 'driving' })
+    ).resolves.toMatchObject({
       accepted: true
     })
 
-    expect(write).toHaveBeenCalledWith(STALE_PTY_ID, 'ping')
+    expect(write).toHaveBeenCalledWith(STALE_PTY_ID, 'ping', 'driving')
   })
 
   it('proceeds when the probe answers live (restored session before its pane remounts)', async () => {
@@ -147,21 +151,25 @@ describe('sendTerminal absence gate for leaf-branch writes', () => {
       probePtyLiveness: async () => true
     })
 
-    await expect(runtime.sendTerminal(handle, { text: 'ping' })).resolves.toMatchObject({
+    await expect(
+      runtime.sendTerminal(handle, { text: 'ping' }, { inputKind: 'driving' })
+    ).resolves.toMatchObject({
       accepted: true
     })
 
-    expect(write).toHaveBeenCalledWith(STALE_PTY_ID, 'ping')
+    expect(write).toHaveBeenCalledWith(STALE_PTY_ID, 'ping', 'driving')
   })
 
   it('proceeds unchanged when the controller exposes no probe', async () => {
     const { runtime, handle, write } = await makeRuntimeWithLeafHandle({})
 
-    await expect(runtime.sendTerminal(handle, { text: 'ping' })).resolves.toMatchObject({
+    await expect(
+      runtime.sendTerminal(handle, { text: 'ping' }, { inputKind: 'driving' })
+    ).resolves.toMatchObject({
       accepted: true
     })
 
-    expect(write).toHaveBeenCalledWith(STALE_PTY_ID, 'ping')
+    expect(write).toHaveBeenCalledWith(STALE_PTY_ID, 'ping', 'driving')
   })
 
   it('never probes when the provider synchronously knows the id (live pty)', async () => {
@@ -171,24 +179,26 @@ describe('sendTerminal absence gate for leaf-branch writes', () => {
       hasPty: (ptyId) => ptyId === STALE_PTY_ID
     })
 
-    await expect(runtime.sendTerminal(handle, { text: 'ping' })).resolves.toMatchObject({
+    await expect(
+      runtime.sendTerminal(handle, { text: 'ping' }, { inputKind: 'driving' })
+    ).resolves.toMatchObject({
       accepted: true
     })
 
     expect(probe).not.toHaveBeenCalled()
-    expect(write).toHaveBeenCalledWith(STALE_PTY_ID, 'ping')
+    expect(write).toHaveBeenCalledWith(STALE_PTY_ID, 'ping', 'driving')
   })
 
   it('reuses a proven-absent verdict across repeated sends instead of re-probing', async () => {
     const probe = vi.fn(async () => false)
     const { runtime, handle } = await makeRuntimeWithLeafHandle({ probePtyLiveness: probe })
 
-    await expect(runtime.sendTerminal(handle, { text: 'a' })).rejects.toThrow(
-      'terminal_not_writable'
-    )
-    await expect(runtime.sendTerminal(handle, { text: 'b' })).rejects.toThrow(
-      'terminal_not_writable'
-    )
+    await expect(
+      runtime.sendTerminal(handle, { text: 'a' }, { inputKind: 'driving' })
+    ).rejects.toThrow('terminal_not_writable')
+    await expect(
+      runtime.sendTerminal(handle, { text: 'b' }, { inputKind: 'driving' })
+    ).rejects.toThrow('terminal_not_writable')
 
     expect(probe).toHaveBeenCalledTimes(1)
   })
@@ -201,17 +211,19 @@ describe('sendTerminal absence gate for leaf-branch writes', () => {
       hasPty: (ptyId) => livePtyIds.has(ptyId)
     })
 
-    await expect(runtime.sendTerminal(handle, { text: 'a' })).rejects.toThrow(
-      'terminal_not_writable'
-    )
+    await expect(
+      runtime.sendTerminal(handle, { text: 'a' }, { inputKind: 'driving' })
+    ).rejects.toThrow('terminal_not_writable')
     // Same id recreated by a fresh spawn: provider knowledge must beat the verdict.
     livePtyIds.add(STALE_PTY_ID)
 
-    await expect(runtime.sendTerminal(handle, { text: 'b' })).resolves.toMatchObject({
+    await expect(
+      runtime.sendTerminal(handle, { text: 'b' }, { inputKind: 'driving' })
+    ).resolves.toMatchObject({
       accepted: true
     })
     expect(probe).toHaveBeenCalledTimes(1)
-    expect(write).toHaveBeenCalledWith(STALE_PTY_ID, 'b')
+    expect(write).toHaveBeenCalledWith(STALE_PTY_ID, 'b', 'driving')
   })
 })
 
diff --git a/src/main/runtime/terminal-surface-close.test.ts b/src/main/runtime/terminal-surface-close.test.ts
new file mode 100644
index 000000000000..e149958ff340
--- /dev/null
+++ b/src/main/runtime/terminal-surface-close.test.ts
@@ -0,0 +1,85 @@
+import { describe, expect, it } from 'vitest'
+import type { TerminalLayoutSnapshot } from '../../shared/terminal-tab-types'
+import {
+  resolveTerminalCloseTarget,
+  type TerminalCloseLayoutCopies
+} from './terminal-surface-close'
+
+const PANE = { kind: 'pane', tabId: 'tab-1', leafId: 'leaf-a' } as const
+
+function layout(...leafIds: string[]): TerminalLayoutSnapshot {
+  const [first, second] = leafIds
+  return {
+    root:
+      first === undefined
+        ? null
+        : second === undefined
+          ? { type: 'leaf', leafId: first }
+          : {
+              type: 'split',
+              direction: 'horizontal',
+              first: { type: 'leaf', leafId: first },
+              second: { type: 'leaf', leafId: second }
+            },
+    activeLeafId: first ?? null,
+    expandedLeafId: null
+  }
+}
+
+function copies(overrides: Partial<TerminalCloseLayoutCopies>): TerminalCloseLayoutCopies {
+  return {
+    rendererListsTab: false,
+    snapshotRows: [],
+    graphLeafIds: [],
+    sessionLayout: undefined,
+    ...overrides
+  }
+}
+
+describe('resolveTerminalCloseTarget', () => {
+  it('never widens a pane close when the owner copy records no panes', () => {
+    // A renderer tab registered before its panes, with nothing published for it yet.
+    expect(resolveTerminalCloseTarget(PANE, copies({ rendererListsTab: true }))).toBe('absent')
+    // A main-owned tab whose layout was saved before its pane mounted, and no other copy.
+    expect(resolveTerminalCloseTarget(PANE, copies({ sessionLayout: layout() }))).toBe('absent')
+  })
+
+  it("closes the tab only when a copy positively shows this pane as the tab's one pane", () => {
+    const cases: [string, Partial<TerminalCloseLayoutCopies>][] = [
+      ['renderer graph', { rendererListsTab: true, graphLeafIds: ['leaf-a'] }],
+      [
+        'renderer rows with no layout or graph panes',
+        { rendererListsTab: true, snapshotRows: [{ leafId: 'leaf-a' }] }
+      ],
+      ['main session layout', { sessionLayout: layout('leaf-a') }],
+      [
+        'rows published for a main-owned tab whose saved layout is empty',
+        { sessionLayout: layout(), snapshotRows: [{ leafId: 'leaf-a', parentLayout: layout() }] }
+      ]
+    ]
+    for (const [name, overrides] of cases) {
+      expect([name, resolveTerminalCloseTarget(PANE, copies(overrides))]).toEqual([
+        name,
+        'last-pane'
+      ])
+    }
+  })
+
+  it('reads past an empty copy to one that records the split', () => {
+    expect(
+      resolveTerminalCloseTarget(
+        PANE,
+        copies({
+          sessionLayout: layout(),
+          snapshotRows: [{ leafId: 'leaf-a', parentLayout: layout('leaf-a', 'leaf-b') }]
+        })
+      )
+    ).toBe('pane')
+  })
+
+  it('treats a pane the owner copy lacks as absent', () => {
+    expect(
+      resolveTerminalCloseTarget(PANE, copies({ rendererListsTab: true, graphLeafIds: ['leaf-b'] }))
+    ).toBe('absent')
+  })
+})
diff --git a/src/main/runtime/terminal-surface-close.ts b/src/main/runtime/terminal-surface-close.ts
new file mode 100644
index 000000000000..65756f12e4fb
--- /dev/null
+++ b/src/main/runtime/terminal-surface-close.ts
@@ -0,0 +1,195 @@
+import type { WorkspaceSessionState } from '../../shared/workspace-session-state-types'
+import type {
+  TerminalLayoutSnapshot,
+  TerminalPaneLayoutNode
+} from '../../shared/terminal-tab-types'
+import type { TerminalSurfaceCloseTarget } from '../../shared/terminal-surface-close-target'
+import {
+  closeTerminalTabInWorkspaceSession,
+  type WorkspaceSessionTerminalTabCloseResult
+} from '../../shared/workspace-session-terminal-tab-close'
+import { retireTerminalSurfaceFromPersistence } from './mobile-session-terminal-persistence-retirement'
+import { advanceTerminalTopologyRevision } from './workspace-session-terminal-membership-authority'
+import type { DurableProfileStateMutation } from '../persistence/loading-store/store-runtime-state'
+import type { ExecutionHostId } from '../../shared/execution-host'
+
+/** Where a pane close lands: its own removal, its tab's last pane, or a pane the copy lacks. */
+export type PaneCloseResolution = 'pane' | 'last-pane' | 'absent'
+
+export function collectTerminalLayoutLeafIds(
+  node: TerminalPaneLayoutNode | null | undefined
+): string[] {
+  if (!node) {
+    return []
+  }
+  if (node.type === 'leaf') {
+    return [node.leafId]
+  }
+  return [...collectTerminalLayoutLeafIds(node.first), ...collectTerminalLayoutLeafIds(node.second)]
+}
+
+/**
+ * Resolves a pane close against the panes one copy records. Only a copy that positively shows this
+ * pane as its tab's one pane widens the close; a copy recording no panes knows nothing about it.
+ */
+export function resolvePaneClose(
+  leafIds: readonly string[] | null,
+  leafId: string
+): PaneCloseResolution {
+  if (!leafIds?.includes(leafId)) {
+    return 'absent'
+  }
+  return leafIds.length === 1 ? 'last-pane' : 'pane'
+}
+
+/** Every copy of a tab's panes main can read when it resolves a close it started. */
+export type TerminalCloseLayoutCopies = {
+  /** The desktop renderer lists the tab, so it owns the tab's panes. */
+  rendererListsTab: boolean
+  /** The tab's rows in the published session snapshot. */
+  snapshotRows: readonly { leafId: string; parentLayout?: TerminalLayoutSnapshot }[]
+  /** The tab's panes in the renderer-published runtime graph. */
+  graphLeafIds: readonly string[]
+  sessionLayout: TerminalLayoutSnapshot | undefined
+}
+
+/** Reads the panes from whoever owns the tab's layout; `null` means no copy records any. */
+function readLayoutOwnerLeafIds(copies: TerminalCloseLayoutCopies): readonly string[] | null {
+  const published =
+    copies.snapshotRows
+      .map((row) => collectTerminalLayoutLeafIds(row.parentLayout?.root))
+      .find((leafIds) => leafIds.length > 0) ?? []
+  const rows = copies.snapshotRows.map((row) => row.leafId)
+  // Why: main's saved layout lacks a renderer split whose PTY binding has not committed yet;
+  // the published layout outranks the graph, which relay recovery can leave with stale panes.
+  const ownerCopies = copies.rendererListsTab
+    ? [published, copies.graphLeafIds, rows]
+    : [collectTerminalLayoutLeafIds(copies.sessionLayout?.root), published, rows]
+  // Why: a layout saved before its pane mounted (or a graph before its panes register) is empty.
+  return ownerCopies.find((leafIds) => leafIds.length > 0) ?? null
+}
+
+/**
+ * The only place main turns a pane close into its tab's close: `last-pane` sends callers down
+ * the tab path (and its renderer pin guard); anything else closes that pane or nothing.
+ * D1 (main as the single layout writer) collapses the owner read to main's session layout alone.
+ */
+export function resolveTerminalCloseTarget(
+  target: TerminalSurfaceCloseTarget,
+  copies: TerminalCloseLayoutCopies
+): PaneCloseResolution | 'tab' {
+  return target.kind === 'tab'
+    ? 'tab'
+    : resolvePaneClose(readLayoutOwnerLeafIds(copies), target.leafId)
+}
+
+export type TerminalSurfaceCloseResult = WorkspaceSessionTerminalTabCloseResult & {
+  resolution: PaneCloseResolution | 'tab'
+}
+
+/**
+ * The membership half of every explicit terminal close: removes a tab, or one pane of a split
+ * tab, and advances the repo's topology revision so a stale renderer save cannot restore it.
+ * A pane close only ever removes that pane; the resolution says why anything else was a no-op.
+ */
+export function closeTerminalSurfaceInWorkspaceSession(
+  session: WorkspaceSessionState,
+  worktreeId: string,
+  target: TerminalSurfaceCloseTarget,
+  options: { force?: boolean; paneIncarnationId?: string } = {}
+): TerminalSurfaceCloseResult {
+  if (target.kind === 'pane') {
+    const layout = session.terminalLayoutsByTabId[target.tabId]
+    const resolution = resolvePaneClose(
+      layout ? collectTerminalLayoutLeafIds(layout.root) : null,
+      target.leafId
+    )
+    // Why: the exit may already have retired this pane, leaving only live siblings to lose.
+    if (!layout || resolution !== 'pane') {
+      return { session, ptyIdsToKill: [], closed: false, pinned: false, resolution }
+    }
+    // The pane's own binding is passed so the retirement's stale-binding fence always admits it;
+    // the incarnation seen when the close was asked refuses a pane restarted since.
+    const retired = retireTerminalSurfaceFromPersistence(session, {
+      worktreeId,
+      parentTabId: target.tabId,
+      leafId: target.leafId,
+      ptyId: layout.ptyIdsByLeafId?.[target.leafId] ?? '',
+      ...(options.paneIncarnationId ? { incarnationId: options.paneIncarnationId } : {})
+    })
+    return {
+      session: retired,
+      ptyIdsToKill: [],
+      closed: retired !== session,
+      pinned: false,
+      resolution
+    }
+  }
+  const result = closeTerminalTabInWorkspaceSession(session, worktreeId, target.tabId, {
+    force: options.force
+  })
+  return {
+    ...result,
+    ...(result.closed
+      ? { session: advanceTerminalTopologyRevision(result.session, worktreeId) }
+      : {}),
+    resolution: 'tab'
+  }
+}
+
+/** What one close's durable mutation reads and writes, resolved when the writer admits it. */
+export type TerminalSurfaceCloseCommit = {
+  worktreeId: string
+  target: TerminalSurfaceCloseTarget
+  options: { allowMissing?: boolean; force?: boolean }
+  /** The session as it was when the close was asked, before the writer admitted it. */
+  requestedSession: WorkspaceSessionState | null | undefined
+  /** The tab's owner identity still matches the one the close was asked against. */
+  ownerMatches: () => boolean
+  hostId: () => ExecutionHostId
+  getSession: (hostId: ExecutionHostId) => WorkspaceSessionState | null | undefined
+  setSession: (session: WorkspaceSessionState, hostId: ExecutionHostId) => void
+  onClosed: (ptyIdsToKill: string[]) => void
+}
+
+/** Builds the close's durable mutation: a refusal persists nothing and is its value. */
+export function terminalSurfaceCloseMutation(
+  commit: TerminalSurfaceCloseCommit
+): () => DurableProfileStateMutation<Error | undefined> {
+  const { target } = commit
+  // Why: a pane is fenced by its own binding, so a sibling split during the write cannot refuse it.
+  const paneIncarnationId =
+    target.kind === 'pane'
+      ? commit.requestedSession?.terminalPtyIncarnationsByPaneKey?.[
+          `${target.tabId}:${target.leafId}`
+        ]
+      : undefined
+  return () => {
+    if (!commit.ownerMatches()) {
+      return { value: new Error('terminal_pane_owner_changed'), persist: false }
+    }
+    const hostId = commit.hostId()
+    const session = commit.getSession(hostId)
+    if (!session) {
+      return { value: new Error('workspace_session_unavailable'), persist: false }
+    }
+    const result = closeTerminalSurfaceInWorkspaceSession(session, commit.worktreeId, target, {
+      force: commit.options.force,
+      paneIncarnationId
+    })
+    if (result.pinned) {
+      return { value: new Error('terminal_tab_pinned'), persist: false }
+    }
+    if (!result.closed) {
+      return {
+        value: commit.options.allowMissing ? undefined : new Error('tab_not_found'),
+        persist: false
+      }
+    }
+    commit.setSession(result.session, hostId)
+    commit.onClosed(result.ptyIdsToKill)
+    // Why no rollback: bookkeeping must not undo a user's close or skip its kill; a failed write
+    // keeps the removal dirty in memory, so the next write persists it.
+    return { value: undefined }
+  }
+}
diff --git a/src/main/runtime/terminal-wait-detection.ts b/src/main/runtime/terminal-wait-detection.ts
index e2b22b10427c..bb102a3e7b88 100644
--- a/src/main/runtime/terminal-wait-detection.ts
+++ b/src/main/runtime/terminal-wait-detection.ts
@@ -1,3 +1,4 @@
+import { isQoderComposerReady } from './qoder-terminal-readiness'
 import { memoizeTitleClassification } from '../../shared/terminal-title-classification-memo'
 import {
   detectAgentStatusFromTitle,
@@ -5,6 +6,7 @@ import {
   type AgentStatus
 } from '../../shared/agent-detection'
 import type { RuntimeTerminalWaitBlockedReason } from '../../shared/runtime-types'
+import type { TuiAgent } from '../../shared/tui-agent'
 import { findAntigravityReadyPromptIndex } from './antigravity-terminal-readiness'
 import { startOfLastLines, startOfLastNonBlankLines } from './terminal-wait-tail-window'
 
@@ -43,22 +45,42 @@ export const detectExplicitIdleStatusFromTitle: (title: string) => AgentStatus |
 
 export function isKnownReadyPromptPreview(preview: string): boolean {
   const normalized = preview.toLowerCase()
-  const readyIndex = findKnownReadyPromptIndex(normalized)
-  if (readyIndex === null) {
+  return isReadyPromptUnblocked(normalized, findKnownReadyPromptIndex(normalized))
+}
+
+/**
+ * Tier 1 body evidence for every tui-idle site. `readScreenLines` yields the live emulator's
+ * visible grid, or null when the runtime has no trustworthy one.
+ *
+ * Why the screen: Codex repaints its header by cell diff (`ESC[5;3Hdir ESC[5;7Hctory:`), which
+ * only a grid reassembles — the line-folded wait text reads `dirctory:` forever.
+ * Why it can only add readiness: a grid out of step with the PTY (size mismatch, resize
+ * mid-paint) garbles the header, so the text rules keep every verdict they give today.
+ */
+export function isKnownReadyPromptBody(
+  waitText: string,
+  agent: TuiAgent | null,
+  readScreenLines: () => readonly string[] | null
+): boolean {
+  if (agent === 'qoder') {
+    return isQoderComposerReady(readScreenLines())
+  }
+  if (isKnownReadyPromptPreview(waitText)) {
+    return true
+  }
+  // Why the agent gate: another agent's screen can merely mention "OpenAI Codex".
+  if (agent !== null && agent !== 'codex') {
     return false
   }
-  const blockedSignal = findTerminalWaitBlockedSignal(normalized)
-  if (blockedSignal !== null && blockedSignal.index > readyIndex) {
+  const screenLines = readScreenLines()
+  if (screenLines === null) {
     return false
   }
-  return true
+  const screen = screenLines.join('\n').toLowerCase()
+  return isReadyPromptUnblocked(screen, findCodexScreenReadyPromptIndex(screen))
 }
 
-// Why separate from isKnownReadyPromptPreview: that one settles tier 1 immediately, while
-// a Muse ready screen only proves the TUI is up — the ranking holds it to quiescence.
-export function isMuseReadyPromptPreview(preview: string): boolean {
-  const normalized = preview.toLowerCase()
-  const readyIndex = findMuseReadyPromptIndex(normalized)
+function isReadyPromptUnblocked(normalized: string, readyIndex: number | null): boolean {
   if (readyIndex === null) {
     return false
   }
@@ -66,6 +88,13 @@ export function isMuseReadyPromptPreview(preview: string): boolean {
   return blockedSignal === null || blockedSignal.index <= readyIndex
 }
 
+// Why separate from isKnownReadyPromptPreview: that one settles tier 1 immediately, while
+// a Muse ready screen only proves the TUI is up — the ranking holds it to quiescence.
+export function isMuseReadyPromptPreview(preview: string): boolean {
+  const normalized = preview.toLowerCase()
+  return isReadyPromptUnblocked(normalized, findMuseReadyPromptIndex(normalized))
+}
+
 export function detectTerminalWaitBlockedReason(
   preview: string
 ): RuntimeTerminalWaitBlockedReason | null {
@@ -150,6 +179,24 @@ function findCodexReadyPromptIndex(normalized: string): number | null {
   return readySegment.includes('model:') && readySegment.includes('directory:') ? headerIndex : null
 }
 
+const CODEX_HEADER_LOADING_RE = /(?:model|directory):\s+loading/
+
+// Why the header box only: chat below it can mention "OpenAI Codex" or `model: loading`.
+// Why `loading`: a header still loading is not ready; the screen must not add readiness early.
+function findCodexScreenReadyPromptIndex(screen: string): number | null {
+  const headerIndex = screen.indexOf('openai codex')
+  if (headerIndex === -1) {
+    return null
+  }
+  const boxEnd = screen.indexOf('╰', headerIndex)
+  const header = screen.slice(headerIndex, boxEnd === -1 ? undefined : boxEnd)
+  return header.includes('model:') &&
+    header.includes('directory:') &&
+    !CODEX_HEADER_LOADING_RE.test(header)
+    ? headerIndex
+    : null
+}
+
 export const TERMINAL_WAIT_BLOCKED_SENTINEL_RE =
   /update available|choose working directory to|codex just got an upgrade|hooks need review|do you trust|trust this|trusted workspace|press enter to (?:confirm|continue|view|insert)|press t to trust|permission required|requires permission|allow once|allow always|run this command\?/i
 
diff --git a/src/main/runtime/terminal-wait-name-only-idle.test.ts b/src/main/runtime/terminal-wait-name-only-idle.test.ts
index 95cfa54be56e..3ad2e74d2e60 100644
--- a/src/main/runtime/terminal-wait-name-only-idle.test.ts
+++ b/src/main/runtime/terminal-wait-name-only-idle.test.ts
@@ -51,6 +51,8 @@ function createWait(options: {
     getAdoptedPtyIdleStatus: () => options.adoptedIdleStatus ?? null,
     getPaneAgent: () => options.agent ?? null,
     getFirstPartyAgentStatus: () => options.firstPartyStatus ?? null,
+    readScreenLines: () => null,
+    readVisibleScreen: () => null,
     quiescenceMs: QUIESCENCE_MS
   }
   const polls = new RuntimeTerminalIdlePolls({
diff --git a/src/main/runtime/tui-idle-evidence.test.ts b/src/main/runtime/tui-idle-evidence.test.ts
index d4c9adfa6fb1..ec88c3368a3d 100644
--- a/src/main/runtime/tui-idle-evidence.test.ts
+++ b/src/main/runtime/tui-idle-evidence.test.ts
@@ -1,9 +1,11 @@
 import { describe, expect, it } from 'vitest'
 import {
+  evaluateTuiIdle,
+  isTuiIdleReadyVerdict,
   hasQuietMuseReadyPrompt,
-  isTuiIdleSatisfied,
-  type TuiIdleEvidenceRecord,
-  type TuiIdleSatisfactionInput
+  nameOnlyIdleNeedsCorroboration,
+  type TuiIdleEvaluationInput,
+  type TuiIdleEvidenceRecord
 } from './tui-idle-evidence'
 
 const QUIESCENCE_MS = 3000
@@ -17,9 +19,10 @@ function record(overrides: Partial<TuiIdleEvidenceRecord> = {}): TuiIdleEvidence
   }
 }
 
-function input(overrides: Partial<TuiIdleSatisfactionInput> = {}): TuiIdleSatisfactionInput {
+function input(overrides: Partial<TuiIdleEvaluationInput> = {}): TuiIdleEvaluationInput {
   return {
     record: record(),
+    readTailBlockedReason: () => null,
     readPositiveBodyEvidence: () => false,
     readMuseReadyBodyEvidence: () => true,
     agent: 'muse',
@@ -65,14 +68,148 @@ describe('hasQuietMuseReadyPrompt', () => {
   })
 })
 
-describe('isTuiIdleSatisfied muse lane', () => {
+describe('evaluateTuiIdle muse lane', () => {
   it('settles a quiet Muse pane with no title signal at all', () => {
-    expect(isTuiIdleSatisfied(input())).toBe(true)
+    expect(evaluateTuiIdle(input())).toEqual({ kind: 'ready-strong' })
   })
 
   it('lets a fresh first-party working status veto the Muse body', () => {
     expect(
-      isTuiIdleSatisfied(input({ firstPartyStatus: { state: 'working', updatedAt: Date.now() } }))
+      evaluateTuiIdle(input({ firstPartyStatus: { state: 'working', updatedAt: Date.now() } }))
+    ).toEqual({ kind: 'working' })
+  })
+})
+
+describe('evaluateTuiIdle ranking', () => {
+  const noMuse = { readMuseReadyBodyEvidence: () => false }
+
+  it('ranks a blocking prompt in the tail above an explicit idle title', () => {
+    const verdict = evaluateTuiIdle(
+      input({
+        ...noMuse,
+        agent: 'claude',
+        record: record({ lastAgentStatus: 'idle', lastOscTitle: '✳ Claude Code' }),
+        readTailBlockedReason: () => 'agent-trust-workspace'
+      })
+    )
+    expect(verdict).toEqual({ kind: 'blocked', reason: 'agent-trust-workspace' })
+  })
+
+  it("calls an agent's own idle title strong", () => {
+    const verdict = evaluateTuiIdle(
+      input({
+        ...noMuse,
+        agent: 'claude',
+        record: record({ lastAgentStatus: 'idle', lastOscTitle: '✳ Claude Code' })
+      })
+    )
+    expect(verdict).toEqual({ kind: 'ready-strong' })
+  })
+
+  it('calls a name-only title weak, even for an agent it is the only rest signal of', () => {
+    const verdict = evaluateTuiIdle(
+      input({ ...noMuse, agent: 'grok', record: record({ lastAgentStatus: 'idle' }) })
+    )
+    expect(verdict).toEqual({ kind: 'ready-weak' })
+  })
+
+  it("holds Claude's bare name to the quiet window, as an agent that announces rest itself", () => {
+    const streaming = record({
+      lastAgentStatus: 'idle',
+      lastOscTitle: 'claude',
+      lastOutputAt: Date.now()
+    })
+    expect(evaluateTuiIdle(input({ ...noMuse, agent: 'claude', record: streaming }))).toEqual({
+      kind: 'pending',
+      quietForeground: false
+    })
+    const quiet = record({ lastAgentStatus: 'idle', lastOscTitle: 'claude' })
+    expect(evaluateTuiIdle(input({ ...noMuse, agent: 'claude', record: quiet }))).toEqual({
+      kind: 'ready-weak'
+    })
+  })
+
+  it('reads working, which suppresses the screen read, from a working title', () => {
+    const verdict = evaluateTuiIdle(
+      input({ ...noMuse, agent: 'claude', record: record({ lastAgentStatus: 'working' }) })
+    )
+    expect(verdict).toEqual({ kind: 'working' })
+  })
+
+  it('keeps a first-party blocked status pending, so the screen is still read', () => {
+    const verdict = evaluateTuiIdle(
+      input({
+        ...noMuse,
+        agent: null,
+        record: record({ lastAgentStatus: 'idle', lastOscTitle: 'claude' }),
+        firstPartyStatus: { state: 'blocked', updatedAt: Date.now() }
+      })
+    )
+    expect(verdict).toEqual({ kind: 'pending', quietForeground: false })
+  })
+
+  it('leaves the quiet-foreground lane open only for an unidentified pane with no title status', () => {
+    expect(evaluateTuiIdle(input({ ...noMuse, agent: null }))).toEqual({
+      kind: 'pending',
+      quietForeground: true
+    })
+    expect(evaluateTuiIdle(input({ ...noMuse, agent: 'claude' }))).toEqual({
+      kind: 'pending',
+      quietForeground: false
+    })
+  })
+})
+
+describe('nameOnlyIdleNeedsCorroboration', () => {
+  it('holds agents that announce rest with an explicit title, native or synthesized', () => {
+    expect(nameOnlyIdleNeedsCorroboration('claude')).toBe(true)
+    expect(nameOnlyIdleNeedsCorroboration('codex')).toBe(true)
+  })
+
+  it('exempts agents whose name is their only rest signal', () => {
+    expect(nameOnlyIdleNeedsCorroboration('grok')).toBe(false)
+  })
+
+  it("names an adopted pane's agent from a shell auto-title", () => {
+    expect(nameOnlyIdleNeedsCorroboration(null, 'claude')).toBe(true)
+    expect(nameOnlyIdleNeedsCorroboration(null, 'claude ~/p/repo')).toBe(true)
+  })
+})
+
+describe('a DSH pane settles tui-idle on its own hook', () => {
+  const base = {
+    record: { lastAgentStatus: null, lastOutputAt: null, lastOscTitle: '\u2726 \u{1F40B} repo' },
+    rendererTitle: undefined,
+    readPositiveBodyEvidence: () => false,
+    readMuseReadyBodyEvidence: () => false,
+    readTailBlockedReason: () => null,
+    agent: 'dsh' as const,
+    firstPartyStatus: { state: 'done' as const, updatedAt: Date.now() },
+    quiescenceMs: 1_000
+  } satisfies TuiIdleEvaluationInput
+
+  const ready = (over: Partial<TuiIdleEvaluationInput> = {}) =>
+    isTuiIdleReadyVerdict(evaluateTuiIdle({ ...base, ...over }))
+
+  it('settles on a fresh first-party done', () => {
+    // The regression: DSH's title carries no idle (its rest glyph is Gemini's working one),
+    // so every title-reading tier failed and `terminal wait --for tui-idle` ran to timeout
+    // against an already-ready composer.
+    expect(ready()).toBe(true)
+  })
+
+  it('does not settle while the same pane reports working', () => {
+    expect(ready({ firstPartyStatus: { state: 'working', updatedAt: Date.now() } })).toBe(false)
+  })
+
+  it('does not settle on a stale done', () => {
+    expect(
+      ready({ firstPartyStatus: { state: 'done', updatedAt: Date.now() - 31 * 60 * 1000 } })
     ).toBe(false)
   })
+
+  it('leaves other agents on the title lanes', () => {
+    // Scoped on purpose: an agent whose hooks report child turns can emit `done` mid-turn.
+    expect(ready({ agent: 'claude' })).toBe(false)
+  })
 })
diff --git a/src/main/runtime/tui-idle-evidence.ts b/src/main/runtime/tui-idle-evidence.ts
index 0ca43b15a6cd..87027ab4bc37 100644
--- a/src/main/runtime/tui-idle-evidence.ts
+++ b/src/main/runtime/tui-idle-evidence.ts
@@ -1,10 +1,20 @@
 import type { AgentStatus } from '../../shared/agent-detection'
-import { isFreshNonDoneAgentStatus } from '../../shared/agent-status-freshness'
+import {
+  AGENT_STATUS_STALE_AFTER_MS,
+  isFreshNonDoneAgentStatus
+} from '../../shared/agent-status-freshness'
 import type { AgentStatusState } from '../../shared/agent-status-types'
+import type { RuntimeTerminalWaitBlockedReason } from '../../shared/runtime-types'
 import { getSyntheticAgentTerminalTitle } from '../../shared/synthetic-agent-title'
 import { resolveExplicitTerminalTitleAgentType } from '../../shared/terminal-title-agent-type'
 import type { TuiAgent } from '../../shared/tui-agent'
-import { detectExplicitIdleStatusFromTitle } from './terminal-wait-detection'
+import type { RuntimeLeafRecord, RuntimePtyWorktreeRecord } from './runtime-terminal-state-records'
+import {
+  detectExplicitIdleStatusFromTitle,
+  detectTerminalWaitBlockedReason,
+  isKnownReadyPromptBody,
+  isMuseReadyPromptPreview
+} from './terminal-wait-detection'
 
 /**
  * Ranking the evidence that a `tui-idle` wait may settle on.
@@ -15,15 +25,21 @@ import { detectExplicitIdleStatusFromTitle } from './terminal-wait-detection'
  * stale spinner (#1437) — so a busy Codex/Devin pane is routinely titled idle, and
  * accepting it satisfied a wait in ~0s mid-turn (#6011).
  *
- *   1. POSITIVE — the agent states it is ready: an explicit idle marker in its own
+ *   0. BLOCKED — the tail shows a prompt waiting on the user.
+ *   1. STRONG READY — the agent states it is ready: an explicit idle marker in its own
  *      title, or a known ready-prompt body.
  *   1b. MUSE — Muse emits no title signal at all, so its ready-screen body stands in
- *      for the positive evidence, believed only once the stream has gone quiet.
- *   2. VETO — a fresh first-party agent status (OSC 9999) saying working/blocked/
- *      waiting. The agent's own account of itself outranks anything inferred.
- *   3. ABSENCE — a name-only title, or a quiet non-shell foreground process. A last
+ *      for the strong evidence, believed only once the stream has gone quiet.
+ *   2. WORKING — a fresh first-party agent status (OSC 9999) saying working/blocked/
+ *      waiting, or a working title. The agent's own account of itself outranks anything
+ *      inferred.
+ *   3. WEAK READY — a name-only title, or a quiet non-shell foreground process. A last
  *      resort, and only once sustained.
  *
+ * Why weak ready is a verdict class rather than a per-evidence flag: none of it can see a
+ * start-up dialog the line tail lost (Claude's workspace trust), so ONLY the poll may settle
+ * on it, after the rendered screen shows no blocker. Synchronous sites settle on tiers 0-1b.
+ *
  * Why derived here rather than stamped onto the record at write time: `syncWindowGraph`
  * rebuilds every leaf from an explicit field list, so a bespoke provenance field is
  * silently dropped on any renderer publish and the verdict silently flips. `lastOscTitle`
@@ -55,19 +71,53 @@ export function hasExplicitIdleTitle(
   return false
 }
 
+/**
+ * Tier 1, first-party: the agent's own hook says the turn ENDED.
+ *
+ * Why DSH needs its own lane: the other tiers all read the title, and DSH cannot carry idle
+ * there. Its rest prefix is `✦`, which is Gemini's WORKING glyph, so the title detector
+ * deliberately reports no status for a DSH pane at all (see agent-title-status.ts) — which
+ * left `tui-idle` with nothing to settle on, and a supervised worker waiting on a ready
+ * composer until its timeout.
+ *
+ * Why a hook `done` is trustworthy here where a title would not be: it is the agent's own
+ * account of its own turn, and `normalizeDshEvent` drops SubagentStart/SubagentStop, so a
+ * `done` row for a DSH pane is the LEAD's, never a child's finishing early.
+ *
+ * Scoped rather than general: for agents whose hooks do report child turns, a `done` row
+ * can arrive mid-turn, and settling on it is exactly the #6011 class this file exists to
+ * prevent.
+ */
+export function hasFreshDoneFirstPartyStatus(
+  agent: TuiAgent | null | undefined,
+  status: FirstPartyAgentStatus,
+  staleAfterMs = AGENT_STATUS_STALE_AFTER_MS
+): boolean {
+  if (agent !== 'dsh' || status?.state !== 'done') {
+    return false
+  }
+  return Date.now() - status.updatedAt <= staleAfterMs
+}
+
 /** Tier 2: the agent's own status stream says this turn is still open. */
 export function hasFreshWorkingFirstPartyStatus(status: FirstPartyAgentStatus): boolean {
   return isFreshNonDoneAgentStatus(status ?? undefined)
 }
 
+/** Agents that paint their own explicit rest title (Claude's `✳`). Gemini's `◇` would qualify
+ *  but is not yet held to it. */
+const NATIVE_EXPLICIT_IDLE_TITLE_AGENTS: ReadonlySet<TuiAgent> = new Set(['claude'])
+
 /**
- * Whether a name-only title from `agent` may be held to the tier-3 quiescence demand.
+ * Whether a name-only title from `agent` must be corroborated by a quiet stream.
  *
- * Only for agents that go on to announce rest with an explicit title of their own (the
- * hook-driven `Codex ready` / `Devin ready`). Grok, Copilot, Aider, Mimo, agy and
- * OpenCode emit their NAME and nothing more at rest, so holding them to it leaves no
- * settle signal at all: a real idle Grok pane repaints its banner about four times a
- * second forever, so the stream never quiesces and the wait runs to timeout.
+ * Only for agents that announce rest with an explicit title of their own: the hook-driven
+ * `Codex ready` / `Devin ready`, or Claude's `✳`. For them the bare name is not a rest signal —
+ * a shell auto-title (`claude`, `claude ~/repo`) names the agent from the moment it starts, over
+ * a start-up dialog or a busy turn alike. Grok, Copilot, Aider, Mimo, agy and OpenCode emit
+ * their NAME and nothing more at rest, so holding them to it leaves no settle signal at all:
+ * a real idle Grok pane repaints its banner about four times a second forever, so the stream
+ * never quiesces and the wait runs to timeout.
  */
 export function nameOnlyIdleNeedsCorroboration(
   agent: TuiAgent | null | undefined,
@@ -76,7 +126,11 @@ export function nameOnlyIdleNeedsCorroboration(
   // Why the title fallback: an adopted pane carries no launch metadata, but its
   // name-only title is exactly the thing that names the agent.
   const resolved = agent ?? (title ? resolveExplicitTerminalTitleAgentType(title) : null)
-  return getSyntheticAgentTerminalTitle(resolved, 'done') !== null
+  return (
+    resolved !== null &&
+    (NATIVE_EXPLICIT_IDLE_TITLE_AGENTS.has(resolved) ||
+      getSyntheticAgentTerminalTitle(resolved, 'done') !== null)
+  )
 }
 
 /** Tier 3: a title-derived idle, usable only once the stream has also gone quiet. */
@@ -112,8 +166,10 @@ export function quietForegroundProcessProvesTuiIdle(agent: TuiAgent | null | und
   return !agent
 }
 
-export type TuiIdleSatisfactionInput = {
+export type TuiIdleEvaluationInput = {
   record: TuiIdleEvidenceRecord
+  /** Tier 0: a blocking prompt in the line tail. */
+  readTailBlockedReason: () => RuntimeTerminalWaitBlockedReason | null
   /** Renderer-synced pane/tab title, when one exists. */
   rendererTitle?: string | null
   /** Tier 1 body evidence: a known ready prompt, or an adopted pane's explicit title.
@@ -128,6 +184,20 @@ export type TuiIdleSatisfactionInput = {
   quiescenceMs: number
 }
 
+export type TuiIdleVerdict =
+  | { kind: 'blocked'; reason: RuntimeTerminalWaitBlockedReason }
+  | { kind: 'ready-strong' }
+  /** Settles only on the poll, after a rendered-screen read finds no blocker. */
+  | { kind: 'ready-weak' }
+  /** The agent says it is mid-turn: nothing may settle, and its screen is not read. */
+  | { kind: 'working' }
+  /** `quietForeground`: whether a quiet non-shell foreground process may still settle it. */
+  | { kind: 'pending'; quietForeground: boolean }
+
+const READY_STRONG: TuiIdleVerdict = { kind: 'ready-strong' }
+const READY_WEAK: TuiIdleVerdict = { kind: 'ready-weak' }
+const WORKING: TuiIdleVerdict = { kind: 'working' }
+
 /**
  * Tier 1b: a Muse ready screen in the body, believed only once the stream has gone quiet.
  *
@@ -158,15 +228,40 @@ export function hasQuietMuseReadyPrompt(
   return Date.now() - record.lastOutputAt >= quiescenceMs
 }
 
-/** The one place the tiers are combined; every satisfaction site routes here. */
-export function isTuiIdleSatisfied(input: TuiIdleSatisfactionInput): boolean {
+/** The one place the tiers are combined; every settle site branches only on the verdict. */
+export function evaluateTuiIdle(input: TuiIdleEvaluationInput): TuiIdleVerdict {
+  const blockedReason = input.readTailBlockedReason()
+  if (blockedReason) {
+    return { kind: 'blocked', reason: blockedReason }
+  }
+  // Qoder publishes "Ready" before its trust dialog is dismissed; only its composer proves input is live.
+  if (input.agent === 'qoder') {
+    if (
+      hasFreshWorkingFirstPartyStatus(input.firstPartyStatus) ||
+      input.record.lastAgentStatus === 'working'
+    ) {
+      return WORKING
+    }
+    return input.readPositiveBodyEvidence()
+      ? READY_STRONG
+      : { kind: 'pending', quietForeground: false }
+  }
   // Why the title before the body: both are tier 1, so either settles, but the title is a
   // memoized lookup and the body is a fresh multi-KB scan. Same verdict, cheaper order.
   if (hasExplicitIdleTitle(input.record, input.rendererTitle) || input.readPositiveBodyEvidence()) {
-    return true
+    return READY_STRONG
+  }
+  // Why beside the title lane, not after the veto: both are tier 1, and a first-party `done`
+  // and a fresh `working` cannot both hold — the same row carries one state.
+  if (hasFreshDoneFirstPartyStatus(input.agent, input.firstPartyStatus)) {
+    return READY_STRONG
   }
   if (hasFreshWorkingFirstPartyStatus(input.firstPartyStatus)) {
-    return false
+    // Why blocked/waiting stays pending: the agent says it is waiting on the user, which is
+    // when a dialog is on screen, so the screen read must still run.
+    return input.firstPartyStatus?.state === 'working'
+      ? WORKING
+      : { kind: 'pending', quietForeground: false }
   }
   // Why after the veto: a first-party working account outranks inferred body evidence.
   if (
@@ -177,7 +272,76 @@ export function isTuiIdleSatisfied(input: TuiIdleSatisfactionInput): boolean {
       input.quiescenceMs
     )
   ) {
-    return true
+    return READY_STRONG
+  }
+  if (input.record.lastAgentStatus === 'working') {
+    return WORKING
+  }
+  if (hasSustainedTitleIdle(input.record, input.agent, input.quiescenceMs)) {
+    return READY_WEAK
+  }
+  return {
+    kind: 'pending',
+    quietForeground:
+      input.record.lastAgentStatus === null && quietForegroundProcessProvesTuiIdle(input.agent)
+  }
+}
+
+export function isTuiIdleReadyVerdict(verdict: TuiIdleVerdict): boolean {
+  return verdict.kind === 'ready-strong' || verdict.kind === 'ready-weak'
+}
+
+/** The runtime state every tui-idle site reads its evidence from. */
+export type TuiIdleEvidenceSource = {
+  quiescenceMs: number
+  getTabTitle(tabId: string): string | null
+  getAdoptedPtyIdleStatus(pty: RuntimePtyWorktreeRecord): AgentStatus | null
+  getPaneAgent(ptyId: string | null | undefined): TuiAgent | null
+  getFirstPartyAgentStatus(ptyId: string | null | undefined): FirstPartyAgentStatus
+  readScreenLines(ptyId: string | null | undefined): readonly string[] | null
+}
+
+function lazyWaitText(readWaitText: () => string): () => string {
+  let waitText: string | null = null
+  return () => (waitText ??= readWaitText())
+}
+
+export function leafTuiIdleEvidence(
+  source: TuiIdleEvidenceSource,
+  leaf: RuntimeLeafRecord,
+  readWaitText: () => string
+): TuiIdleEvaluationInput {
+  const waitText = lazyWaitText(readWaitText)
+  const agent = source.getPaneAgent(leaf.ptyId)
+  return {
+    record: leaf,
+    readTailBlockedReason: () => detectTerminalWaitBlockedReason(waitText()),
+    rendererTitle: leaf.paneTitle ?? source.getTabTitle(leaf.tabId),
+    readPositiveBodyEvidence: () =>
+      isKnownReadyPromptBody(waitText(), agent, () => source.readScreenLines(leaf.ptyId)),
+    readMuseReadyBodyEvidence: () => isMuseReadyPromptPreview(waitText()),
+    agent,
+    firstPartyStatus: source.getFirstPartyAgentStatus(leaf.ptyId),
+    quiescenceMs: source.quiescenceMs
+  }
+}
+
+export function ptyTuiIdleEvidence(
+  source: TuiIdleEvidenceSource,
+  pty: RuntimePtyWorktreeRecord,
+  readWaitText: () => string
+): TuiIdleEvaluationInput {
+  const waitText = lazyWaitText(readWaitText)
+  const agent = source.getPaneAgent(pty.ptyId)
+  return {
+    record: pty,
+    readTailBlockedReason: () => detectTerminalWaitBlockedReason(waitText()),
+    readPositiveBodyEvidence: () =>
+      (agent !== 'qoder' && source.getAdoptedPtyIdleStatus(pty) === 'idle') ||
+      isKnownReadyPromptBody(waitText(), agent, () => source.readScreenLines(pty.ptyId)),
+    readMuseReadyBodyEvidence: () => isMuseReadyPromptPreview(waitText()),
+    agent,
+    firstPartyStatus: source.getFirstPartyAgentStatus(pty.ptyId),
+    quiescenceMs: source.quiescenceMs
   }
-  return hasSustainedTitleIdle(input.record, input.agent, input.quiescenceMs)
 }
diff --git a/src/main/runtime/tui-idle-name-only-real-pty.integration.test.ts b/src/main/runtime/tui-idle-name-only-real-pty.integration.test.ts
index 0d265a0a5bbb..562ab23ee3ec 100644
--- a/src/main/runtime/tui-idle-name-only-real-pty.integration.test.ts
+++ b/src/main/runtime/tui-idle-name-only-real-pty.integration.test.ts
@@ -109,10 +109,8 @@ async function terminalWait(
 describe.skipIf(process.platform === 'win32')('tui-idle against a real agent pty', () => {
   it('does not satisfy while the real process streams under a name-only title', async () => {
     const { runtime, transcript, handle } = await startRealAgentPane('quiet', 60_000)
-    await new Promise((resolve) => setTimeout(resolve, 500))
-
-    // The OSC title really did reach the runtime as control bytes, not literal text.
-    expect(transcript.join('')).toContain(']0;Codex')
+    // Wait for real control bytes before measuring idle behavior.
+    await expect.poll(() => transcript.join(''), { timeout: 5_000 }).toContain(']0;Codex')
 
     const outcome = await terminalWait(runtime, handle, 8_000)
     expect(outcome.satisfied).toBe(false)
diff --git a/src/main/runtime/tui-idle-weak-evidence-seam.test.ts b/src/main/runtime/tui-idle-weak-evidence-seam.test.ts
new file mode 100644
index 000000000000..d608666fbdcd
--- /dev/null
+++ b/src/main/runtime/tui-idle-weak-evidence-seam.test.ts
@@ -0,0 +1,107 @@
+/**
+ * The seam a new weak-ready rank plugs into. Weak ready is a verdict class, not a per-evidence
+ * flag: no settle site may act on it before a rendered-screen read, whatever evidence produced
+ * it. The stand-in below fires over Claude's trust dialog itself, as a composer-ready signal
+ * such as bracketed paste would, and the dialog must still win.
+ */
+
+import { readFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { createTranscriptPane, TRANSCRIPT_PANE_PTY_ID } from './agent-transcript-pane-test-harness'
+import type * as TuiIdleEvidence from './tui-idle-evidence'
+
+const syntheticWeakEvidence = vi.hoisted(() => ({ fires: false }))
+
+vi.mock('./tui-idle-evidence', async (importOriginal) => {
+  const actual = await importOriginal<typeof TuiIdleEvidence>()
+  return {
+    ...actual,
+    evaluateTuiIdle: (
+      ...args: Parameters<typeof actual.evaluateTuiIdle>
+    ): TuiIdleEvidence.TuiIdleVerdict => {
+      const verdict = actual.evaluateTuiIdle(...args)
+      return syntheticWeakEvidence.fires && verdict.kind === 'pending'
+        ? { kind: 'ready-weak' }
+        : verdict
+    }
+  }
+})
+
+const POLL_INTERVAL_MS = 2_000
+
+function readDialog(): { data: string; size: { cols: number; rows: number } } {
+  const base = join(__dirname, '__fixtures__', 'claude-dialog-trust-workspace')
+  const meta: { cols: number; rows: number } = JSON.parse(readFileSync(`${base}.meta.json`, 'utf8'))
+  return { data: readFileSync(`${base}.txt`, 'utf8'), size: { cols: meta.cols, rows: meta.rows } }
+}
+
+async function createPane() {
+  const { data, size } = readDialog()
+  const { runtime, handle } = await createTranscriptPane({
+    paneTitle: 'Terminal',
+    foregroundProcess: 'claude',
+    launchAgent: 'claude',
+    size,
+    data: ''
+  })
+  vi.useFakeTimers()
+  const write = (chunk: string) => runtime.onPtyData(TRANSCRIPT_PANE_PTY_ID, chunk, Date.now())
+  const paintDialog = () => {
+    const bytes = Buffer.from(data, 'utf8')
+    const decoder = new TextDecoder()
+    for (let offset = 0; offset < bytes.length; offset += 1024) {
+      write(decoder.decode(bytes.subarray(offset, offset + 1024), { stream: true }))
+    }
+  }
+  const wait = () => {
+    const settled = vi.fn()
+    const promise = runtime.waitForTerminal(handle, { condition: 'tui-idle', timeoutMs: 60_000 })
+    promise.then(settled, () => {})
+    return { promise, settled }
+  }
+  return { write, paintDialog, wait }
+}
+
+describe('a new weak-ready rank', () => {
+  afterEach(() => {
+    syntheticWeakEvidence.fires = false
+    vi.useRealTimers()
+  })
+
+  it('settles a pane with nothing on screen, so the stand-in reaches the settle sites', async () => {
+    const pane = await createPane()
+    pane.write('starting\r\n')
+    syntheticWeakEvidence.fires = true
+    const { promise } = pane.wait()
+    await vi.advanceTimersByTimeAsync(0)
+    await expect(promise).resolves.toMatchObject({ satisfied: true })
+  })
+
+  it('reports the dialog to a wait registered after it painted', async () => {
+    const pane = await createPane()
+    pane.paintDialog()
+    syntheticWeakEvidence.fires = true
+    const { promise } = pane.wait()
+    await vi.advanceTimersByTimeAsync(0)
+    await expect(promise).resolves.toMatchObject({
+      satisfied: false,
+      blockedReason: 'agent-trust-workspace'
+    })
+  })
+
+  it('reports the dialog when a title change offers the evidence before it painted', async () => {
+    const pane = await createPane()
+    const { promise, settled } = pane.wait()
+    syntheticWeakEvidence.fires = true
+    pane.write('\x1b]0;claude ~/p/repo\x07')
+    await vi.advanceTimersByTimeAsync(0)
+    expect(settled).not.toHaveBeenCalled()
+    pane.paintDialog()
+    await vi.advanceTimersByTimeAsync(POLL_INTERVAL_MS)
+    await expect(promise).resolves.toMatchObject({
+      satisfied: false,
+      blockedReason: 'agent-trust-workspace'
+    })
+  })
+})
diff --git a/src/main/runtime/windows-mobile-firewall.test.ts b/src/main/runtime/windows-mobile-firewall.test.ts
index d561878a538f..162f46e682b2 100644
--- a/src/main/runtime/windows-mobile-firewall.test.ts
+++ b/src/main/runtime/windows-mobile-firewall.test.ts
@@ -67,6 +67,18 @@ describe('windows mobile firewall', () => {
     expect(script).toContain('$localPrefixLength = [int]$ip.PrefixLength')
   })
 
+  it('doubles typographic single quotes in the executable literal', async () => {
+    const runPowerShell = vi.fn().mockResolvedValue('not json')
+    await inspectWindowsMobileFirewall(
+      6768,
+      '192.168.0.108',
+      environment(runPowerShell, { executablePath: 'C:\\Users\\O\u2019Brien\\Orca\\Orca.exe' })
+    )
+    expect(runPowerShell.mock.calls[0]![0]).toContain(
+      "-Program 'C:\\Users\\O\u2019\u2019Brien\\Orca\\Orca.exe'"
+    )
+  })
+
   it('treats an overlapping inbound Block rule as overriding a matching Allow rule', async () => {
     const runPowerShell = vi.fn().mockResolvedValue(
       JSON.stringify({
diff --git a/src/main/runtime/windows-mobile-firewall.ts b/src/main/runtime/windows-mobile-firewall.ts
index c90a025cb141..5d17bf5f5a86 100644
--- a/src/main/runtime/windows-mobile-firewall.ts
+++ b/src/main/runtime/windows-mobile-firewall.ts
@@ -5,6 +5,7 @@ import type {
   WindowsMobileFirewallStatus,
   WindowsNetworkCategory
 } from '../../shared/windows-mobile-firewall'
+import { quotePowerShellLiteral } from '../../shared/powershell-native-argument'
 import { hasSufficientWindowsFirewallRemoteScope } from './windows-firewall-remote-scope'
 
 const FIREWALL_RULE_NAME = 'Orca.MobilePairing'
@@ -158,15 +159,11 @@ function parseNetworkCategory(value: string): WindowsNetworkCategory {
   return 'unknown'
 }
 
-function quotePowerShell(value: string): string {
-  return `'${value.replaceAll("'", "''")}'`
-}
-
 function buildInspectionScript(port: number, executablePath: string, address?: string): string {
   const addressLookup = address
     ? `
 try {
-  $ip = Get-NetIPAddress -IPAddress ${quotePowerShell(address)} -ErrorAction Stop | Select-Object -First 1
+  $ip = Get-NetIPAddress -IPAddress ${quotePowerShellLiteral(address)} -ErrorAction Stop | Select-Object -First 1
   $localAddress = [string]$ip.IPAddress
   $localPrefixLength = [int]$ip.PrefixLength
   $profile = Get-NetConnectionProfile -InterfaceIndex $ip.InterfaceIndex -ErrorAction Stop | Select-Object -First 1
@@ -180,7 +177,7 @@ try {
   return `$ErrorActionPreference = 'Stop'
 $matchingRuleScopes = @()
 $blockingRuleDetected = $false
-$rules = @(Get-NetFirewallApplicationFilter -PolicyStore ActiveStore -Program ${quotePowerShell(executablePath)} -ErrorAction SilentlyContinue | Get-NetFirewallRule | Where-Object { $_.Enabled -eq 'True' -and $_.Direction -eq 'Inbound' })
+$rules = @(Get-NetFirewallApplicationFilter -PolicyStore ActiveStore -Program ${quotePowerShellLiteral(executablePath)} -ErrorAction SilentlyContinue | Get-NetFirewallRule | Where-Object { $_.Enabled -eq 'True' -and $_.Direction -eq 'Inbound' })
 foreach ($rule in $rules) {
   $portFilter = $rule | Get-NetFirewallPortFilter
   $protocol = [string]$portFilter.Protocol
@@ -215,7 +212,7 @@ function buildRepairScript(port: number, executablePath: string): string {
   // Removal deliberately ignores the Block rule's remote-address scope,
   // mirroring the fail-closed inspection (the phone address is unknown).
   return `$ErrorActionPreference = 'Stop'
-$blockingRules = @(Get-NetFirewallApplicationFilter -Program ${quotePowerShell(executablePath)} -ErrorAction SilentlyContinue | Get-NetFirewallRule | Where-Object { $_.Enabled -eq 'True' -and $_.Direction -eq 'Inbound' -and $_.Action -eq 'Block' })
+$blockingRules = @(Get-NetFirewallApplicationFilter -Program ${quotePowerShellLiteral(executablePath)} -ErrorAction SilentlyContinue | Get-NetFirewallRule | Where-Object { $_.Enabled -eq 'True' -and $_.Direction -eq 'Inbound' -and $_.Action -eq 'Block' })
 foreach ($rule in $blockingRules) {
   $portFilter = $rule | Get-NetFirewallPortFilter
   $protocol = [string]$portFilter.Protocol
@@ -225,8 +222,8 @@ foreach ($rule in $blockingRules) {
     $rule | Remove-NetFirewallRule
   }
 }
-Get-NetFirewallRule -Name ${quotePowerShell(FIREWALL_RULE_NAME)} -ErrorAction SilentlyContinue | Remove-NetFirewallRule
-New-NetFirewallRule -Name ${quotePowerShell(FIREWALL_RULE_NAME)} -DisplayName ${quotePowerShell(FIREWALL_RULE_DISPLAY_NAME)} -Description 'Allows Orca Mobile to connect to this Orca desktop on private networks.' -Direction Inbound -Action Allow -Enabled True -Profile Private -Protocol TCP -LocalPort ${port} -Program ${quotePowerShell(executablePath)} -EdgeTraversalPolicy Block | Out-Null`
+Get-NetFirewallRule -Name ${quotePowerShellLiteral(FIREWALL_RULE_NAME)} -ErrorAction SilentlyContinue | Remove-NetFirewallRule
+New-NetFirewallRule -Name ${quotePowerShellLiteral(FIREWALL_RULE_NAME)} -DisplayName ${quotePowerShellLiteral(FIREWALL_RULE_DISPLAY_NAME)} -Description 'Allows Orca Mobile to connect to this Orca desktop on private networks.' -Direction Inbound -Action Allow -Enabled True -Profile Private -Protocol TCP -LocalPort ${port} -Program ${quotePowerShellLiteral(executablePath)} -EdgeTraversalPolicy Block | Out-Null`
 }
 
 // Why the elevated child keeps `-EncodedCommand` while the local runner does not: `Start-Process
@@ -237,7 +234,7 @@ New-NetFirewallRule -Name ${quotePowerShell(FIREWALL_RULE_NAME)} -DisplayName ${
 function buildElevationScript(powershellPath: string, encodedRepairScript: string): string {
   return `$ErrorActionPreference = 'Stop'
 try {
-  $process = Start-Process -FilePath ${quotePowerShell(powershellPath)} -ArgumentList @('-NoProfile', '-NonInteractive', '-EncodedCommand', '${encodedRepairScript}') -Verb RunAs -Wait -PassThru
+  $process = Start-Process -FilePath ${quotePowerShellLiteral(powershellPath)} -ArgumentList @('-NoProfile', '-NonInteractive', '-EncodedCommand', '${encodedRepairScript}') -Verb RunAs -Wait -PassThru
   [pscustomobject]@{ launched = $true; exitCode = $process.ExitCode } | ConvertTo-Json -Compress
 } catch {
   [pscustomobject]@{ launched = $false; nativeErrorCode = $_.Exception.NativeErrorCode } | ConvertTo-Json -Compress
diff --git a/src/main/runtime/workspace-session-failed-write-rollback.ts b/src/main/runtime/workspace-session-failed-write-rollback.ts
deleted file mode 100644
index 7234446cb9de..000000000000
--- a/src/main/runtime/workspace-session-failed-write-rollback.ts
+++ /dev/null
@@ -1,74 +0,0 @@
-import { isDeepStrictEqual } from 'node:util'
-import type { WorkspaceSessionState } from '../../shared/workspace-session-state-types'
-
-const MISSING = Symbol('missing')
-
-/** A JSON-shaped slot of persisted session state, or the absent-key sentinel. */
-type RollbackSlot =
-  | string
-  | number
-  | boolean
-  | null
-  | undefined
-  | typeof MISSING
-  | readonly RollbackSlot[]
-  | RollbackRecord
-
-type RollbackRecord = { readonly [key: string]: RollbackSlot }
-
-function isRecord(value: RollbackSlot): value is RollbackRecord {
-  return (
-    value !== MISSING &&
-    typeof value === 'object' &&
-    value !== null &&
-    !Array.isArray(value) &&
-    Object.getPrototypeOf(value) === Object.prototype
-  )
-}
-
-function rollbackValue(
-  original: RollbackSlot,
-  staged: RollbackSlot,
-  current: RollbackSlot
-): RollbackSlot {
-  if (isDeepStrictEqual(original, staged)) {
-    return current
-  }
-  if (isDeepStrictEqual(current, staged)) {
-    return original
-  }
-  if (!isRecord(original) || !isRecord(staged) || !isRecord(current)) {
-    return current
-  }
-  let changed = false
-  const next: Record<string, RollbackSlot> = { ...current }
-  for (const key of new Set([
-    ...Object.keys(original),
-    ...Object.keys(staged),
-    ...Object.keys(current)
-  ])) {
-    const value = rollbackValue(
-      Object.hasOwn(original, key) ? original[key] : MISSING,
-      Object.hasOwn(staged, key) ? staged[key] : MISSING,
-      Object.hasOwn(current, key) ? current[key] : MISSING
-    )
-    if (value === MISSING) {
-      if (Object.hasOwn(next, key)) {
-        delete next[key]
-        changed = true
-      }
-    } else if (!Object.hasOwn(current, key) || !isDeepStrictEqual(current[key], value)) {
-      next[key] = value
-      changed = true
-    }
-  }
-  return changed ? next : current
-}
-
-export function rollbackWorkspaceSessionAfterFailedAsyncWrite(
-  original: WorkspaceSessionState,
-  staged: WorkspaceSessionState,
-  current: WorkspaceSessionState
-): WorkspaceSessionState {
-  return rollbackValue(original, staged, current) as WorkspaceSessionState
-}
diff --git a/src/main/runtime/workspace-session-terminal-membership-authority.ts b/src/main/runtime/workspace-session-terminal-membership-authority.ts
index 76cbcdf4dada..7798ae7831c6 100644
--- a/src/main/runtime/workspace-session-terminal-membership-authority.ts
+++ b/src/main/runtime/workspace-session-terminal-membership-authority.ts
@@ -70,7 +70,7 @@ function rebaseUnifiedTabs(
     (tab) => tab.contentType !== 'terminal' || terminalUnifiedTabMatches(tab, terminalTabIds)
   )
   const representedTerminalIds = new Set(
-    result.filter((tab) => tab.contentType === 'terminal').flatMap((tab) => [tab.id, tab.entityId])
+    result.flatMap((tab) => (tab.contentType === 'terminal' ? [tab.id, tab.entityId] : []))
   )
   for (const tab of current) {
     if (
diff --git a/src/main/runtime/worktree-terminal-mutation-lock.test.ts b/src/main/runtime/worktree-terminal-mutation-lock.test.ts
index 822238034a86..b972bd02dec9 100644
--- a/src/main/runtime/worktree-terminal-mutation-lock.test.ts
+++ b/src/main/runtime/worktree-terminal-mutation-lock.test.ts
@@ -16,9 +16,13 @@ describe('WorktreeTerminalMutationLock', () => {
       lock.acquire(KEY, 'shared')
     ])
     expect(releases).toHaveLength(4)
+    expect(lock.hasActiveSpawns(KEY)).toBe(true)
+    expect(lock.hasActiveSpawns('other')).toBe(false)
     for (const release of releases) {
+      expect(lock.hasActiveSpawns(KEY)).toBe(true)
       release()
     }
+    expect(lock.hasActiveSpawns(KEY)).toBe(false)
     expect(lock.trackedKeyCount).toBe(0)
   })
 
diff --git a/src/main/runtime/worktree-terminal-mutation-lock.ts b/src/main/runtime/worktree-terminal-mutation-lock.ts
index b0af98b2d3bc..f76d84498268 100644
--- a/src/main/runtime/worktree-terminal-mutation-lock.ts
+++ b/src/main/runtime/worktree-terminal-mutation-lock.ts
@@ -35,6 +35,10 @@ export const WORKTREE_TERMINAL_SLEEP_TIMEOUT_ERROR = 'terminal_worktree_sleep_ti
 export class WorktreeTerminalMutationLock {
   private readonly entries = new Map<string, LockEntry>()
 
+  hasActiveSpawns(key: string): boolean {
+    return (this.entries.get(key)?.activeSpawns ?? 0) > 0
+  }
+
   /** Why exposed: entry deletion is the only thing keeping this map from
    *  becoming a per-worktree leak, so the tests assert on it directly. */
   get trackedKeyCount(): number {
diff --git a/src/main/runtime/zcode-readiness-transcript.test.ts b/src/main/runtime/zcode-readiness-transcript.test.ts
index 2319915ab681..bd9909f89de7 100644
--- a/src/main/runtime/zcode-readiness-transcript.test.ts
+++ b/src/main/runtime/zcode-readiness-transcript.test.ts
@@ -21,6 +21,18 @@ function readTranscript(): string {
 }
 
 describe('ZCode readiness from captured terminal bytes', () => {
+  it('accepts a fresh composer after the renderer adopts the terminal handle', async () => {
+    const { runtime, handle } = await createTranscriptPane({
+      paneTitle: 'worker-zcode',
+      foregroundProcess: 'zcode',
+      launchAgent: 'zcode',
+      data: '\x1b[?1049h╭'
+    })
+    await expect(
+      runtime.waitForFreshWorkerComposer(handle, 'zcode', 1_000)
+    ).resolves.toBeUndefined()
+  })
+
   it('never emits an OSC title, so no title lane can settle its wait', () => {
     const data = readTranscript()
     expect(data).toContain(String.fromCharCode(27))
diff --git a/src/main/shell-wrapper-file-writer.ts b/src/main/shell-wrapper-file-writer.ts
index 1e57a210bbae..a30dff1503e5 100644
--- a/src/main/shell-wrapper-file-writer.ts
+++ b/src/main/shell-wrapper-file-writer.ts
@@ -14,7 +14,8 @@ export type ShellWrapperFile = readonly [path: string, content: string]
 
 export function writeShellWrapperFiles(
   files: readonly ShellWrapperFile[],
-  logPrefix: string
+  logPrefix: string,
+  consequence = 'Shell will launch unwrapped'
 ): boolean {
   try {
     for (const [path, content] of files) {
@@ -38,7 +39,7 @@ export function writeShellWrapperFiles(
         ? `${error.message} (${(error as NodeJS.ErrnoException).code || 'unknown'})`
         : String(error)
     console.error(`${logPrefix} Failed to write shell wrapper files: ${errorMessage}`)
-    console.error(`${logPrefix} Shell will launch unwrapped`)
+    console.error(`${logPrefix} ${consequence}`)
     return false
   }
 }
diff --git a/src/main/skills/discovery-filter-sharing.test.ts b/src/main/skills/discovery-filter-sharing.test.ts
index 14f755d01009..14fe9faf580c 100644
--- a/src/main/skills/discovery-filter-sharing.test.ts
+++ b/src/main/skills/discovery-filter-sharing.test.ts
@@ -86,17 +86,20 @@ it('retains a newly requested name when its previously observed root becomes una
     const args = { homeDir: root, repos: [], includeCwd: false, sourceKinds: ['home' as const] }
     await repair.discoverSkills({ ...args, names: ['skill-0'] })
     const original = SkillScanCoalescer.prototype.run
-    vi.spyOn(SkillScanCoalescer.prototype, 'run').mockImplementation(
-      function (this: SkillScanCoalescer<unknown>, key, options, task) {
-        if (
-          key === `home\0${join(root, '.agents', 'skills')}` ||
-          key.startsWith(`home\0${join(root, '.agents', 'skills')}\0`)
-        ) {
-          return Promise.reject(new SkillScanShedError())
-        }
-        return original.call(this, key, options, task)
+    vi.spyOn(SkillScanCoalescer.prototype, 'run').mockImplementation(function (
+      this: SkillScanCoalescer<unknown>,
+      key,
+      options,
+      task
+    ) {
+      if (
+        key === `home\0${join(root, '.agents', 'skills')}` ||
+        key.startsWith(`home\0${join(root, '.agents', 'skills')}\0`)
+      ) {
+        return Promise.reject(new SkillScanShedError())
       }
-    )
+      return original.call(this, key, options, task)
+    })
     const next = await repair.discoverSkills({ ...args, names: ['skill-47'] })
     expect(next.skills.map((skill) => skill.name)).toEqual(['skill-47'])
     expect(next.sources.find((source) => source.id === 'home-agents')?.skippedReason).toBe(
diff --git a/src/main/source-control/hosted-review-branch-cache.ts b/src/main/source-control/hosted-review-branch-cache.ts
index 0e6f207ab9c5..7a9f02e50c8a 100644
--- a/src/main/source-control/hosted-review-branch-cache.ts
+++ b/src/main/source-control/hosted-review-branch-cache.ts
@@ -13,6 +13,15 @@ import {
   settleDetachedLookup,
   settleLookup
 } from './hosted-review-unsettled-lookups'
+import {
+  __resetHostedReviewInflightLookupsForTests,
+  expireOverdueInflight,
+  getInflightLookup,
+  releaseInflight,
+  retireInflightWithPrefix,
+  trackInflight,
+  type InflightToken
+} from './hosted-review-inflight-lookups'
 import {
   __resetHostedReviewScopeGenerationsForTests,
   bumpScopeGeneration,
@@ -29,7 +38,6 @@ import {
   ACTIVE_REFRESH_INTERVAL_MS,
   HOSTED_REVIEW_LOOKUP_DEADLINE_MS,
   MAX_BRANCH_MAP_ENTRIES,
-  MAX_INFLIGHT_LOOKUPS,
   NO_REVIEW_REFRESH_INTERVAL_MS
 } from './hosted-review-refresh-pacing'
 
@@ -59,22 +67,7 @@ type CacheEntry = {
   startedAt: number
 }
 
-declare const inflightTokenBrand: unique symbol
-
-/** Identity token for one lookup; only ever compared by reference. */
-type InflightToken = { readonly [inflightTokenBrand]?: never }
-
-type InflightRecord = {
-  /** Identity, so a detached lookup can only ever clear its own entry. */
-  token: InflightToken
-  startedAt: number
-  promise: Promise<HostedReviewInfo | null>
-  /** Releases the callers and unpins the branch; idempotent. */
-  expire: () => void
-}
-
 const entries = new Map<string, CacheEntry>()
-const inflight = new Map<string, InflightRecord>()
 // Why: NUL is the one byte a repo path or branch name cannot contain, so a
 // scope prefix cannot straddle a component boundary — invalidating `/a/b` must
 // not also flush the unrelated repo at `/a/b c`.
@@ -158,53 +151,6 @@ function storeEntry(key: string, entry: CacheEntry): void {
   }
 }
 
-/** Clears the key's in-flight record only if it is still this lookup's. */
-function releaseInflight(key: string, token: InflightToken): boolean {
-  if (inflight.get(key)?.token !== token) {
-    return false
-  }
-  inflight.delete(key)
-  return true
-}
-
-/**
- * Expires records that outlived the deadline without their timer firing. Main's
- * timers are suspended across a system sleep, so wall-clock age — not
- * `setTimeout` alone — is what actually bounds how long a branch stays pinned.
- *
- * The guarantee covers tracked records only: one the size cap evicted is no
- * longer reachable here and falls back to its own suspended timer.
- */
-function expireOverdueInflight(now: number): void {
-  let overdue: InflightRecord[] | undefined
-  for (const record of inflight.values()) {
-    if (now - record.startedAt >= HOSTED_REVIEW_LOOKUP_DEADLINE_MS) {
-      overdue ??= []
-      overdue.push(record)
-    }
-  }
-  // Expire after the walk: each one deletes its own entry from the map.
-  for (const record of overdue ?? []) {
-    record.expire()
-  }
-}
-
-function trackInflight(key: string, record: InflightRecord): void {
-  inflight.set(key, record)
-  while (inflight.size > MAX_INFLIGHT_LOOKUPS) {
-    const oldest = inflight.keys().next().value
-    if (oldest === undefined) {
-      break
-    }
-    // Why: drop the record without expiring it — its own deadline still
-    // releases its callers, and evicting is about memory, not about failing.
-    // It does forfeit the sweep's wall-clock release, so the cap must stay far
-    // above realistic concurrency: below it, sleep-suspended timers are all an
-    // evicted record's callers have left.
-    inflight.delete(oldest)
-  }
-}
-
 /**
  * Drops every cached answer for a repo. Called when Orca itself opens a review,
  * so the new one is visible immediately instead of after the no-review interval.
@@ -221,13 +167,14 @@ export function invalidateHostedReviewBranchCache(
       entries.delete(key)
     }
   }
+  retireInflightWithPrefix(prefix)
   dropFailuresWithPrefix(prefix)
 }
 
 /** @internal - exposed for tests only */
 export function __resetHostedReviewBranchCacheForTests(): void {
   entries.clear()
-  inflight.clear()
+  __resetHostedReviewInflightLookupsForTests()
   __resetHostedReviewLookupBackoffForTests()
   __resetHostedReviewActiveClaimsForTests()
   __resetUnsettledHostedReviewLookupsForTests()
@@ -244,7 +191,7 @@ export function __resetHostedReviewBranchCacheForTests(): void {
  * was about to give the real one.
  */
 function canAdoptDetachedAnswer(key: string, startedAt: number): boolean {
-  if (inflight.has(key)) {
+  if (getInflightLookup(key) !== undefined) {
     return false
   }
   const current = entries.get(key)
@@ -341,7 +288,7 @@ function startLookup(
       // straggler and has to prove it still outranks what is there.
       const stored =
         generation === scopeGeneration(scope) &&
-        (inflight.get(key)?.token === token || canAdoptDetachedAnswer(key, startedAt))
+        (getInflightLookup(key)?.token === token || canAdoptDetachedAnswer(key, startedAt))
       if (stored) {
         storeEntry(key, { review, fetchedAt: Date.now(), headOid, startedAt })
       }
@@ -360,7 +307,7 @@ function startLookup(
       }
       // Why: a record the size cap dropped has a live successor, and backing the
       // branch off would slow the retry that is already running.
-      if (inflight.get(key)?.token === token) {
+      if (getInflightLookup(key)?.token === token) {
         noteFailure(key)
       }
       // Why: the last good review beats an error card here just as it does on
@@ -417,7 +364,7 @@ export async function withHostedReviewBranchCache(
     return cached.review
   }
 
-  const pending = inflight.get(key)
+  const pending = getInflightLookup(key)
   if (pending) {
     return pending.promise
   }
diff --git a/src/main/source-control/hosted-review-execution-host.ts b/src/main/source-control/hosted-review-execution-host.ts
index 1def4d60492d..3f2ad49b303d 100644
--- a/src/main/source-control/hosted-review-execution-host.ts
+++ b/src/main/source-control/hosted-review-execution-host.ts
@@ -1,10 +1,5 @@
-import {
-  getRepoExecutionHostId,
-  getSshTargetIdForExecutionHost,
-  LOCAL_EXECUTION_HOST_ID,
-  type ExecutionHostId
-} from '../../shared/execution-host'
-import type { Repo } from '../../shared/repo-types'
+import type { ExecutionHostId } from '../../shared/execution-host'
+export { getStoredRepoExecutionHostId as getRepoHostedReviewExecutionHostId } from '../repo-execution-host'
 import {
   ExecutionHostNotDispatchableError,
   resolveGitRouteForHost
@@ -30,20 +25,3 @@ export function hostedReviewSshConnectionId(executionHostId: ExecutionHostId): s
   }
   return route.kind === 'ssh' ? route.connectionId : null
 }
-
-/**
- * The host this process may run a hosted review on for a row in *its own* store.
- *
- * `getSshTargetIdForExecutionHost` and not `getRepoSshConnectionId`: a `runtime:` stamp on a row in
- * this store is how a paired client addresses it, not a second machine holding the files. The
- * runtime registration controller only adopts that stamp onto a row with no `connectionId`
- * (`runtimeRepoMatchesExecutionHost` refuses to match an SSH row), so the checkout really is here
- * and this keeps the review that has always been created for it. A row whose files sit on an SSH
- * host keeps its own target — including one that carries only `executionHostId: ssh:…`.
- */
-export function getRepoHostedReviewExecutionHostId(
-  repo: Pick<Repo, 'connectionId' | 'executionHostId'>
-): ExecutionHostId {
-  const hostId = getRepoExecutionHostId(repo)
-  return getSshTargetIdForExecutionHost(hostId) ? hostId : LOCAL_EXECUTION_HOST_ID
-}
diff --git a/src/main/source-control/hosted-review-inflight-invalidation.test.ts b/src/main/source-control/hosted-review-inflight-invalidation.test.ts
new file mode 100644
index 000000000000..6d8653ba76bc
--- /dev/null
+++ b/src/main/source-control/hosted-review-inflight-invalidation.test.ts
@@ -0,0 +1,271 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { HostedReviewInfo } from '../../shared/hosted-review'
+import {
+  __resetHostedReviewBranchCacheForTests,
+  invalidateHostedReviewBranchCache,
+  withHostedReviewBranchCache
+} from './hosted-review-branch-cache'
+import {
+  HOSTED_REVIEW_LOOKUP_DEADLINE_MS,
+  MAX_UNSETTLED_LOOKUP_KEYS,
+  MAX_UNSETTLED_LOOKUPS_PER_KEY
+} from './hosted-review-refresh-pacing'
+
+const identity = {
+  repoPath: '/repo',
+  executionHostId: 'ssh:host-a' as const,
+  branch: 'feature/review',
+  localGitExecOptions: { admissionTier: 'background' }
+}
+const options = { headOid: null }
+const review: HostedReviewInfo = {
+  provider: 'gitlab',
+  number: 7,
+  title: 'Created review',
+  state: 'open',
+  url: 'https://git.example/team/repo/merge_requests/7',
+  status: 'neutral',
+  updatedAt: '',
+  mergeable: 'UNKNOWN'
+}
+
+beforeEach(() => {
+  __resetHostedReviewBranchCacheForTests()
+  vi.useFakeTimers()
+  vi.setSystemTime(1_000_000)
+})
+
+afterEach(() => {
+  __resetHostedReviewBranchCacheForTests()
+  vi.useRealTimers()
+})
+
+describe('hosted review in-flight invalidation', () => {
+  it.each(['before', 'after'] as const)(
+    'refreshes post-create readers when the old request finishes %s its replacement',
+    async (completionOrder) => {
+      const oldResponse = Promise.withResolvers<HostedReviewInfo | null>()
+      const freshResponse = Promise.withResolvers<HostedReviewInfo | null>()
+      const oldLookup = vi.fn(() => oldResponse.promise)
+      const freshLookup = vi.fn(() => freshResponse.promise)
+      const admitted = withHostedReviewBranchCache(identity, options, oldLookup)
+      expect(
+        await withHostedReviewBranchCache(
+          { ...identity, localGitExecOptions: { admissionTier: 'interactive' } },
+          options,
+          async () => null
+        )
+      ).toBeNull()
+
+      invalidateHostedReviewBranchCache(identity.repoPath, identity.executionHostId)
+      const next = withHostedReviewBranchCache(identity, options, freshLookup)
+      const concurrent = withHostedReviewBranchCache(identity, options, freshLookup)
+      try {
+        expect(freshLookup).toHaveBeenCalledTimes(1)
+        if (completionOrder === 'before') {
+          oldResponse.resolve(null)
+          expect(await admitted).toBeNull()
+        }
+        freshResponse.resolve(review)
+        expect(await next).toEqual(review)
+        expect(await concurrent).toEqual(review)
+        if (completionOrder === 'after') {
+          oldResponse.resolve(null)
+          expect(await admitted).toBeNull()
+        }
+        expect(await withHostedReviewBranchCache(identity, options, freshLookup)).toEqual(review)
+        expect(oldLookup).toHaveBeenCalledTimes(1)
+        expect(freshLookup).toHaveBeenCalledTimes(1)
+      } finally {
+        oldResponse.resolve(null)
+        freshResponse.resolve(review)
+        await Promise.all([admitted, next, concurrent])
+      }
+    }
+  )
+
+  it('does not make a post-create reader wait for a stale request deadline', async () => {
+    const oldResponse = Promise.withResolvers<HostedReviewInfo | null>()
+    const admitted = withHostedReviewBranchCache(identity, options, () => oldResponse.promise)
+    const admittedResult = admitted.catch(() => null)
+    await vi.advanceTimersByTimeAsync(10_000)
+    invalidateHostedReviewBranchCache(identity.repoPath, identity.executionHostId)
+    const freshLookup = vi.fn(async () => review)
+    let settled = false
+    const next = withHostedReviewBranchCache(identity, options, freshLookup).then((value) => {
+      settled = true
+      return value
+    })
+    try {
+      await vi.advanceTimersByTimeAsync(0)
+      expect(settled).toBe(true)
+      expect(await next).toEqual(review)
+      expect(freshLookup).toHaveBeenCalledTimes(1)
+      await vi.advanceTimersByTimeAsync(HOSTED_REVIEW_LOOKUP_DEADLINE_MS - 10_000)
+      expect(await admittedResult).toEqual(review)
+      expect(await withHostedReviewBranchCache(identity, options, freshLookup)).toEqual(review)
+      expect(freshLookup).toHaveBeenCalledTimes(2)
+    } finally {
+      oldResponse.resolve(null)
+      await Promise.all([admittedResult, next])
+    }
+  })
+
+  it('discards a retired answer that landed with no replacement to outrank it', async () => {
+    const oldResponse = Promise.withResolvers<HostedReviewInfo | null>()
+    const admitted = withHostedReviewBranchCache(identity, options, () => oldResponse.promise)
+    invalidateHostedReviewBranchCache(identity.repoPath, identity.executionHostId)
+    // Nothing replaced it, so only the scope generation stands between this
+    // pre-invalidation "no review" and the key it no longer owns. Adopting it
+    // would read as fresh and short-circuit the lookup for the review Orca just
+    // opened.
+    oldResponse.resolve(null)
+    expect(await admitted).toBeNull()
+    const freshLookup = vi.fn(async () => review)
+    expect(await withHostedReviewBranchCache(identity, options, freshLookup)).toEqual(review)
+    expect(freshLookup).toHaveBeenCalledTimes(1)
+  })
+
+  it('keeps other hosts, paths and their pending promises isolated', async () => {
+    const others = [
+      { ...identity, executionHostId: 'local' as const },
+      { ...identity, executionHostId: 'ssh:host-b' as const },
+      { ...identity, repoPath: '/repo-other' }
+    ].map((key) => {
+      const response = Promise.withResolvers<HostedReviewInfo | null>()
+      const lookup = vi.fn(() => response.promise)
+      return { key, response, lookup, admitted: withHostedReviewBranchCache(key, options, lookup) }
+    })
+    invalidateHostedReviewBranchCache(identity.repoPath, identity.executionHostId)
+    const readers = others.map(({ key, lookup }) =>
+      withHostedReviewBranchCache(key, options, lookup)
+    )
+    for (const other of others) {
+      expect(other.lookup).toHaveBeenCalledTimes(1)
+      other.response.resolve(review)
+    }
+    expect(await Promise.all(readers)).toEqual([review, review, review])
+    await Promise.all(others.map((other) => other.admitted))
+  })
+
+  it('sweeps invalidated readers after sleep without expiring their replacement', async () => {
+    const oldResponse = Promise.withResolvers<HostedReviewInfo | null>()
+    const freshResponse = Promise.withResolvers<HostedReviewInfo | null>()
+    const admitted = withHostedReviewBranchCache(identity, options, () => oldResponse.promise)
+    const admittedResult = admitted.catch((error: unknown) => error)
+    invalidateHostedReviewBranchCache(identity.repoPath, identity.executionHostId)
+    vi.setSystemTime(Date.now() + 90_000)
+    const freshLookup = vi.fn(() => freshResponse.promise)
+    const replacement = withHostedReviewBranchCache(identity, options, freshLookup).catch(
+      (error: unknown) => error
+    )
+    vi.setSystemTime(Date.now() + 40_000)
+    const joined = withHostedReviewBranchCache(identity, options, freshLookup).catch(
+      (error: unknown) => error
+    )
+    try {
+      await vi.advanceTimersByTimeAsync(0)
+      expect(await admittedResult).toMatchObject({
+        message: expect.stringContaining('timed out')
+      })
+      expect(freshLookup).toHaveBeenCalledTimes(1)
+      freshResponse.resolve(review)
+      expect(await replacement).toEqual(review)
+      expect(await joined).toEqual(review)
+      oldResponse.resolve(null)
+      expect(await withHostedReviewBranchCache(identity, options, freshLookup)).toEqual(review)
+      expect(freshLookup).toHaveBeenCalledTimes(1)
+    } finally {
+      oldResponse.resolve(null)
+      freshResponse.resolve(review)
+      await Promise.all([admittedResult, replacement, joined])
+    }
+  })
+
+  it('keeps the two-unsettled-request cap across repeated invalidation', async () => {
+    const first = Promise.withResolvers<HostedReviewInfo | null>()
+    const second = Promise.withResolvers<HostedReviewInfo | null>()
+    const firstRead = withHostedReviewBranchCache(identity, options, () => first.promise)
+    invalidateHostedReviewBranchCache(identity.repoPath, identity.executionHostId)
+    const secondRead = withHostedReviewBranchCache(identity, options, () => second.promise)
+    invalidateHostedReviewBranchCache(identity.repoPath, identity.executionHostId)
+    const thirdLookup = vi.fn(async () => review)
+    const third = withHostedReviewBranchCache(identity, options, thirdLookup)
+    const thirdResult = third.catch((error: unknown) => error)
+    try {
+      await vi.advanceTimersByTimeAsync(0)
+      expect(thirdLookup).not.toHaveBeenCalled()
+      first.resolve(null)
+      second.resolve(null)
+      await Promise.all([firstRead, secondRead])
+      expect(await thirdResult).toMatchObject({
+        message: expect.stringContaining('never answered')
+      })
+      expect(await withHostedReviewBranchCache(identity, options, thirdLookup)).toEqual(review)
+      expect(thirdLookup).toHaveBeenCalledTimes(1)
+    } finally {
+      first.resolve(null)
+      second.resolve(null)
+      await Promise.all([firstRead, secondRead, thirdResult])
+    }
+  })
+
+  it('does not let an invalidated rejection penalize the replacement', async () => {
+    const oldResponse = Promise.withResolvers<HostedReviewInfo | null>()
+    const freshResponse = Promise.withResolvers<HostedReviewInfo | null>()
+    const admitted = withHostedReviewBranchCache(identity, options, () => oldResponse.promise)
+    const rejected = expect(admitted).rejects.toThrow('old lookup failed')
+    invalidateHostedReviewBranchCache(identity.repoPath, identity.executionHostId)
+    const fresh = withHostedReviewBranchCache(identity, options, () => freshResponse.promise)
+    oldResponse.reject(new Error('old lookup failed'))
+    await rejected
+    freshResponse.resolve(review)
+    expect(await fresh).toEqual(review)
+    await vi.advanceTimersByTimeAsync(60_001)
+    const next = vi.fn(async () => review)
+    expect(await withHostedReviewBranchCache(identity, options, next)).toEqual(review)
+    expect(next).toHaveBeenCalledTimes(1)
+  })
+
+  it('bounds retired owners by admission and sweeps all of them after sleep', async () => {
+    const requests: ReturnType<typeof Promise.withResolvers<HostedReviewInfo | null>>[] = []
+    const readers: Promise<unknown>[] = []
+    for (let index = 0; index < MAX_UNSETTLED_LOOKUP_KEYS; index += 1) {
+      for (let attempt = 0; attempt < MAX_UNSETTLED_LOOKUPS_PER_KEY; attempt += 1) {
+        const response = Promise.withResolvers<HostedReviewInfo | null>()
+        requests.push(response)
+        readers.push(
+          withHostedReviewBranchCache(
+            { ...identity, branch: `branch-${index}` },
+            options,
+            () => response.promise
+          ).catch((error: unknown) => error)
+        )
+        invalidateHostedReviewBranchCache(identity.repoPath, identity.executionHostId)
+      }
+    }
+    const freshLookup = vi.fn(async () => review)
+    try {
+      await expect(withHostedReviewBranchCache(identity, options, freshLookup)).rejects.toThrow(
+        'Too many hosted review lookups are already in progress'
+      )
+      expect(freshLookup).not.toHaveBeenCalled()
+      expect(vi.getTimerCount()).toBe(MAX_UNSETTLED_LOOKUP_KEYS * MAX_UNSETTLED_LOOKUPS_PER_KEY)
+      vi.setSystemTime(Date.now() + HOSTED_REVIEW_LOOKUP_DEADLINE_MS)
+      await expect(withHostedReviewBranchCache(identity, options, freshLookup)).rejects.toThrow()
+      expect(vi.getTimerCount()).toBe(0)
+      expect(await Promise.all(readers)).toEqual(
+        requests.map(() =>
+          expect.objectContaining({ message: expect.stringContaining('timed out') })
+        )
+      )
+    } finally {
+      for (const response of requests) {
+        response.resolve(null)
+      }
+      await Promise.all(readers)
+    }
+    expect(await withHostedReviewBranchCache(identity, options, freshLookup)).toEqual(review)
+    expect(freshLookup).toHaveBeenCalledTimes(1)
+  })
+})
diff --git a/src/main/source-control/hosted-review-inflight-lookups.test.ts b/src/main/source-control/hosted-review-inflight-lookups.test.ts
new file mode 100644
index 000000000000..149de43c097d
--- /dev/null
+++ b/src/main/source-control/hosted-review-inflight-lookups.test.ts
@@ -0,0 +1,44 @@
+import { afterEach, expect, it, vi } from 'vitest'
+import {
+  __resetHostedReviewInflightLookupsForTests,
+  expireOverdueInflight,
+  getInflightLookup,
+  releaseInflight,
+  retireInflightWithPrefix,
+  trackInflight
+} from './hosted-review-inflight-lookups'
+import { HOSTED_REVIEW_LOOKUP_DEADLINE_MS } from './hosted-review-refresh-pacing'
+
+afterEach(__resetHostedReviewInflightLookupsForTests)
+
+it.each(['completion', 'deadline'])(
+  'releases a retired owner on %s while preserving its successor',
+  (outcome) => {
+    const oldToken = {}
+    const oldExpire = vi.fn(() => releaseInflight('repo\0branch', oldToken))
+    trackInflight('repo\0branch', {
+      token: oldToken,
+      startedAt: 0,
+      promise: Promise.resolve(null),
+      expire: oldExpire
+    })
+    retireInflightWithPrefix('repo\0')
+    const replacement = {
+      token: {},
+      startedAt: HOSTED_REVIEW_LOOKUP_DEADLINE_MS,
+      promise: Promise.resolve(null),
+      expire: vi.fn()
+    }
+    trackInflight('repo\0branch', replacement)
+    if (outcome === 'completion') {
+      expect(releaseInflight('repo\0branch', oldToken)).toBe(false)
+    }
+    expireOverdueInflight(HOSTED_REVIEW_LOOKUP_DEADLINE_MS)
+    expect(oldExpire).toHaveBeenCalledTimes(outcome === 'deadline' ? 1 : 0)
+    expect(replacement.expire).not.toHaveBeenCalled()
+    expect(getInflightLookup('repo\0branch')).toBe(replacement)
+    expireOverdueInflight(HOSTED_REVIEW_LOOKUP_DEADLINE_MS + 1)
+    expect(oldExpire).toHaveBeenCalledTimes(outcome === 'deadline' ? 1 : 0)
+    expect(releaseInflight('repo\0branch', replacement.token)).toBe(true)
+  }
+)
diff --git a/src/main/source-control/hosted-review-inflight-lookups.ts b/src/main/source-control/hosted-review-inflight-lookups.ts
new file mode 100644
index 000000000000..79d4f12ba13b
--- /dev/null
+++ b/src/main/source-control/hosted-review-inflight-lookups.ts
@@ -0,0 +1,101 @@
+import type { HostedReviewInfo } from '../../shared/hosted-review'
+import {
+  HOSTED_REVIEW_LOOKUP_DEADLINE_MS,
+  MAX_INFLIGHT_LOOKUPS
+} from './hosted-review-refresh-pacing'
+
+declare const inflightTokenBrand: unique symbol
+
+/** Identity token for one lookup; only ever compared by reference. */
+export type InflightToken = { readonly [inflightTokenBrand]?: never }
+
+export type InflightRecord = {
+  /** Identity, so a detached lookup can only ever clear its own entry. */
+  token: InflightToken
+  startedAt: number
+  promise: Promise<HostedReviewInfo | null>
+  /** Releases the callers and unpins the branch; idempotent. */
+  expire: () => void
+}
+
+const inflight = new Map<string, InflightRecord>()
+/**
+ * Owners an invalidation took off their key. They keep running — nothing here
+ * can cancel a lookup — but no new reader may join them, which is what stops a
+ * post-invalidation read from waiting out a stale request's deadline.
+ *
+ * Admission bounds these to two per key across at most 1,000 unsettled keys, so
+ * this map cannot outgrow the lookups already counted as in progress.
+ */
+const retired = new Map<InflightToken, InflightRecord>()
+
+export function getInflightLookup(key: string): InflightRecord | undefined {
+  return inflight.get(key)
+}
+
+/** Clears only this owner's records; the return value identifies the current owner. */
+export function releaseInflight(key: string, token: InflightToken): boolean {
+  retired.delete(token)
+  if (inflight.get(key)?.token !== token) {
+    return false
+  }
+  inflight.delete(key)
+  return true
+}
+
+/** Takes every owner under `prefix` off its key, without failing it. */
+export function retireInflightWithPrefix(prefix: string): void {
+  for (const [key, record] of inflight) {
+    if (key.startsWith(prefix)) {
+      retired.set(record.token, record)
+      inflight.delete(key)
+    }
+  }
+}
+
+/**
+ * Expires records that outlived the deadline without their timer firing. Main's
+ * timers are suspended across a system sleep, so wall-clock age — not
+ * `setTimeout` alone — is what actually bounds how long a branch stays pinned.
+ * Retired owners are swept too: their readers are gone, but their own callers
+ * still need releasing.
+ *
+ * The guarantee covers tracked records only: one the size cap evicted is in
+ * neither map and falls back to its own suspended timer.
+ */
+export function expireOverdueInflight(now: number): void {
+  let overdue: InflightRecord[] | undefined
+  for (const records of [inflight, retired]) {
+    for (const record of records.values()) {
+      if (now - record.startedAt >= HOSTED_REVIEW_LOOKUP_DEADLINE_MS) {
+        overdue ??= []
+        overdue.push(record)
+      }
+    }
+  }
+  for (const record of overdue ?? []) {
+    record.expire()
+  }
+}
+
+export function trackInflight(key: string, record: InflightRecord): void {
+  inflight.set(key, record)
+  while (inflight.size > MAX_INFLIGHT_LOOKUPS) {
+    const oldest = inflight.keys().next().value
+    if (oldest === undefined) {
+      break
+    }
+    // Why: drop the record without expiring it — its own deadline still releases
+    // its callers, and evicting is about memory, not about failing. It does
+    // forfeit the sweep above, so the cap must stay far above realistic
+    // concurrency: below it, sleep-suspended timers are all an evicted record's
+    // callers have left.
+    inflight.delete(oldest)
+  }
+}
+
+/** @internal - exposed for tests only */
+export function __resetHostedReviewInflightLookupsForTests(): void {
+  inflight.clear()
+  retired.clear()
+}
diff --git a/src/main/speech/stt-session-start.ts b/src/main/speech/stt-session-start.ts
index 5377699b3820..eb42418cd0be 100644
--- a/src/main/speech/stt-session-start.ts
+++ b/src/main/speech/stt-session-start.ts
@@ -138,7 +138,11 @@ async function startSttSession(
     isCurrent: () => state.worker === worker,
     onMessage: (event) => state.eventSink?.(event),
     onError: (error) => handleSttWorkerFailure(state, error),
-    onExit: () => handleSttWorkerFailure(state)
+    onExit: () => {
+      const stoppedSink = state.stopInFlight?.worker === worker ? null : state.eventSink
+      handleSttWorkerFailure(state)
+      stoppedSink?.({ type: 'stopped' })
+    }
   })
   initializeSttWorker(worker, {
     modelDir: state.modelManager.getModelDir(modelId),
diff --git a/src/main/sqlite/bun-readonly-wal.test.ts b/src/main/sqlite/bun-readonly-wal.test.ts
new file mode 100644
index 000000000000..f60482c8e0ed
--- /dev/null
+++ b/src/main/sqlite/bun-readonly-wal.test.ts
@@ -0,0 +1,180 @@
+import * as fs from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { runProcess } from '../../shared/child-process/run-process'
+import { initializeBunReadonlyWal } from './bun-readonly-wal'
+import Database from './sync-database'
+
+vi.mock('node:fs', async (importOriginal) => {
+  const original = await importOriginal<typeof fs>()
+  return { ...original, openSync: vi.fn(original.openSync) }
+})
+
+const directories: string[] = []
+
+afterEach(async () => {
+  vi.restoreAllMocks()
+  const original = await vi.importActual<typeof fs>('node:fs')
+  vi.mocked(fs.openSync).mockImplementation(original.openSync)
+  for (const directory of directories.splice(0)) {
+    fs.rmSync(directory, { recursive: true, force: true })
+  }
+})
+
+function fixture(wal = true): string {
+  const directory = fs.mkdtempSync(join(tmpdir(), 'orca-readonly-wal-'))
+  directories.push(directory)
+  const file = join(directory, 'state.db')
+  const db = new Database(file)
+  db.exec('CREATE TABLE state (id INTEGER PRIMARY KEY, value TEXT)')
+  if (wal) {
+    db.pragma('journal_mode=WAL')
+  }
+  db.close()
+  return file
+}
+
+describe('readonly WAL initialization', () => {
+  it.each(['EACCES', 'EPERM', 'EROFS'])(
+    'lets SQLite decide read access when WAL creation fails with %s',
+    async (code) => {
+      const file = fixture()
+      const { openSync: open } = await vi.importActual<typeof fs>('node:fs')
+      vi.mocked(fs.openSync).mockImplementation((path, flags, ...rest) => {
+        if (path === `${file}-wal` && flags === 'wx') {
+          throw Object.assign(new Error('read-only directory'), { code })
+        }
+        return open(path, flags, ...rest)
+      })
+      expect(() => initializeBunReadonlyWal(file)).not.toThrow()
+      expect(fs.existsSync(`${file}-wal`)).toBe(false)
+    }
+  )
+
+  it('still reports unexpected WAL creation failures', async () => {
+    const file = fixture()
+    const { openSync: open } = await vi.importActual<typeof fs>('node:fs')
+    vi.mocked(fs.openSync).mockImplementation((path, flags, ...rest) => {
+      if (path === `${file}-wal` && flags === 'wx') {
+        throw Object.assign(new Error('disk failure'), { code: 'EIO' })
+      }
+      return open(path, flags, ...rest)
+    })
+    expect(() => initializeBunReadonlyWal(file)).toThrow('disk failure')
+  })
+
+  it('allows a clean WAL database to reopen without changing its bytes or admitting SQL writes', () => {
+    const file = fixture()
+    const bytes = fs.readFileSync(file)
+    initializeBunReadonlyWal(file)
+    if (process.platform !== 'win32') {
+      expect(fs.statSync(`${file}-wal`).mode & 0o777).toBe(0o600)
+    }
+    const reader = new Database(file, { readonly: true })
+    try {
+      expect(reader.prepare('SELECT COUNT(*) AS count FROM state').get()).toEqual({ count: 0 })
+      expect(() => reader.exec("INSERT INTO state VALUES(1,'write')")).toThrow()
+    } finally {
+      reader.close()
+    }
+    expect(fs.readFileSync(file)).toEqual(bytes)
+  })
+
+  it('leaves a concurrent writer’s newly published WAL intact', async () => {
+    const file = fixture()
+    const { openSync: open } = await vi.importActual<typeof fs>('node:fs')
+    vi.mocked(fs.openSync).mockImplementation((path, flags, ...rest) => {
+      if (path === `${file}-wal` && flags === 'wx') {
+        fs.writeFileSync(path, 'concurrent writer evidence')
+      }
+      return open(path, flags, ...rest)
+    })
+    initializeBunReadonlyWal(file)
+    expect(fs.readFileSync(`${file}-wal`, 'utf8')).toBe('concurrent writer evidence')
+  })
+
+  it('leaves a current writer’s WAL bytes intact', () => {
+    const file = fixture()
+    const writer = new Database(file)
+    try {
+      writer.exec("INSERT INTO state VALUES(1,'durable')")
+      const before = fs.readFileSync(`${file}-wal`)
+      initializeBunReadonlyWal(file)
+      expect(fs.readFileSync(`${file}-wal`)).toEqual(before)
+      const reader = new Database(file, { readonly: true })
+      try {
+        expect(reader.prepare('SELECT value FROM state').get()).toEqual({ value: 'durable' })
+      } finally {
+        reader.close()
+      }
+    } finally {
+      writer.close()
+    }
+  })
+
+  it.skipIf(process.platform === 'win32')('opens a cold WAL database through a symlink', () => {
+    const file = fixture()
+    const alias = join(directories[0]!, 'alias.db')
+    fs.symlinkSync(file, alias)
+    const reader = new Database(alias, { readonly: true })
+    try {
+      expect(reader.prepare('SELECT COUNT(*) AS count FROM state').get()).toEqual({ count: 0 })
+      expect(fs.existsSync(`${alias}-wal`)).toBe(false)
+    } finally {
+      reader.close()
+    }
+  })
+
+  it('does not add recovery evidence to a rollback-journal database or malformed file', () => {
+    const file = fixture(false)
+    initializeBunReadonlyWal(file)
+    expect(fs.existsSync(`${file}-wal`)).toBe(false)
+    fs.writeFileSync(file, 'not SQLite')
+    initializeBunReadonlyWal(file)
+    expect(fs.existsSync(`${file}-wal`)).toBe(false)
+  })
+
+  it.skipIf(process.platform !== 'darwin' || !process.versions.bun)(
+    'preserves another connection’s exclusive lock while inspecting the database header',
+    async () => {
+      const file = fixture(false)
+      const writer = new Database(file)
+      const probe = () =>
+        runProcess({
+          program: process.execPath,
+          args: [
+            '-e',
+            `const { Database } = require('bun:sqlite')
+             const db = new Database(process.argv[1], { readonly: true })
+             try { db.prepare('SELECT * FROM state').all(); process.stdout.write('readable') }
+             catch (error) { process.stdout.write(error.code) }
+             finally { db.close(true) }`,
+            file
+          ],
+          timeoutMs: 5_000
+        })
+      try {
+        writer.exec("BEGIN EXCLUSIVE; INSERT INTO state VALUES(1,'uncommitted')")
+        expect(await probe()).toMatchObject({ code: 0, stdout: 'SQLITE_BUSY' })
+        const reader = new Database(file, { readonly: true })
+        reader.close()
+        expect(await probe()).toMatchObject({ code: 0, stdout: 'SQLITE_BUSY' })
+      } finally {
+        writer.close()
+      }
+    }
+  )
+
+  it.skipIf(process.platform === 'win32')(
+    'does not follow an existing dangling WAL symlink',
+    () => {
+      const file = fixture()
+      const outside = join(directories[0]!, 'unrelated')
+      fs.symlinkSync(outside, `${file}-wal`)
+      initializeBunReadonlyWal(file)
+      expect(fs.existsSync(outside)).toBe(false)
+      expect(fs.lstatSync(`${file}-wal`).isSymbolicLink()).toBe(true)
+    }
+  )
+})
diff --git a/src/main/sqlite/bun-readonly-wal.ts b/src/main/sqlite/bun-readonly-wal.ts
new file mode 100644
index 000000000000..b7cbd39880a8
--- /dev/null
+++ b/src/main/sqlite/bun-readonly-wal.ts
@@ -0,0 +1,37 @@
+import { closeSync, existsSync, openSync, readSync } from 'node:fs'
+
+/** Match SQLite's WAL creation without permitting writes through the database connection. */
+export function initializeBunReadonlyWal(path: string): void {
+  const wal = `${path}-wal`
+  if (existsSync(wal) || !hasWalHeader(path)) {
+    return
+  }
+  try {
+    // Apple's SQLite requires an existing WAL; exclusive creation preserves every existing byte.
+    closeSync(openSync(wal, 'wx', 0o600))
+  } catch (error) {
+    if (
+      typeof error !== 'object' ||
+      error === null ||
+      !('code' in error) ||
+      !['EEXIST', 'EACCES', 'EPERM', 'EROFS'].includes(String(error.code))
+    ) {
+      throw error
+    }
+  }
+}
+
+function hasWalHeader(path: string): boolean {
+  const file = openSync(path, 'r')
+  try {
+    const header = Buffer.alloc(20)
+    return (
+      readSync(file, header, 0, header.length, 0) === header.length &&
+      header.subarray(0, 16).toString() === 'SQLite format 3\0' &&
+      header[18] === 2 &&
+      header[19] === 2
+    )
+  } finally {
+    closeSync(file)
+  }
+}
diff --git a/src/main/sqlite/bun-sqlite-database.ts b/src/main/sqlite/bun-sqlite-database.ts
new file mode 100644
index 000000000000..b9695e08781a
--- /dev/null
+++ b/src/main/sqlite/bun-sqlite-database.ts
@@ -0,0 +1,129 @@
+import type { DatabaseSync } from 'node:sqlite'
+import { fileURLToPath, pathToFileURL } from 'node:url'
+import { BunSqliteStatement, type BunStatement } from './bun-sqlite-statement'
+import { initializeBunReadonlyWal } from './bun-readonly-wal'
+
+type BunDatabase = {
+  exec(sql: string): void
+  prepare(sql: string): BunStatement
+  readonly inTransaction: boolean
+  close(throwOnError: boolean): void
+  fileControl(command: number, value: Int32Array): number
+}
+
+type BunSqlite = {
+  Database: new (path: string, flags: number) => BunDatabase
+}
+
+const SQLITE_OPEN_READONLY = 0x01
+const SQLITE_OPEN_READWRITE = 0x02
+const SQLITE_OPEN_CREATE = 0x04
+const SQLITE_OPEN_URI = 0x40
+const SQLITE_FCNTL_PERSIST_WAL = 10
+
+export function loadBunSqlite(): BunSqlite | undefined {
+  if (!process.versions.bun || typeof process.getBuiltinModule !== 'function') {
+    return undefined
+  }
+  const sqlite: unknown = process.getBuiltinModule('bun:sqlite')
+  return isBunSqlite(sqlite) ? sqlite : undefined
+}
+
+function isBunSqlite(value: unknown): value is BunSqlite {
+  return (
+    typeof value === 'object' &&
+    value !== null &&
+    'Database' in value &&
+    typeof value.Database === 'function'
+  )
+}
+
+export class BunSqliteDatabase {
+  private readonly database: BunDatabase
+
+  constructor(
+    path: ConstructorParameters<typeof DatabaseSync>[0],
+    options: { readonly?: boolean; fileMustExist?: boolean; timeout?: number } = {}
+  ) {
+    const sqlite = loadBunSqlite()
+    if (!sqlite) {
+      throw new Error('SQLite is unavailable in this runtime')
+    }
+    const filename =
+      path instanceof URL ? fileURLToPath(path) : typeof path === 'string' ? path : path.toString()
+    const flags = options.readonly
+      ? SQLITE_OPEN_READONLY
+      : SQLITE_OPEN_READWRITE | (options.fileMustExist ? 0 : SQLITE_OPEN_CREATE)
+    this.database = new sqlite.Database(
+      filename === ':memory:' || filename === '' ? filename : sqliteFileUri(filename),
+      // URI parsing defaults differ between the platform SQLite libraries.
+      flags | SQLITE_OPEN_URI
+    )
+    try {
+      if (process.platform === 'darwin' && filename !== ':memory:' && filename !== '') {
+        // Apple's default retains WAL files; match the other shipped SQLite drivers.
+        if (this.database.fileControl(SQLITE_FCNTL_PERSIST_WAL, new Int32Array(2)) !== 0) {
+          throw new Error('SQLite cannot configure WAL cleanup')
+        }
+        if (options.readonly) {
+          const statement = this.database.prepare('PRAGMA database_list')
+          try {
+            const path = statement.get()?.file
+            if (typeof path !== 'string' || path.length === 0) {
+              throw new Error('SQLite did not report its database filename')
+            }
+            // SQLite resolves symlinks before locating its sidecars.
+            initializeBunReadonlyWal(path)
+          } finally {
+            statement.finalize()
+          }
+        }
+      }
+      const timeout = options.timeout ?? 0
+      if (!Number.isSafeInteger(timeout) || timeout < 0 || timeout > 2_147_483_647) {
+        throw new RangeError('SQLite busy timeout must be a nonnegative 32-bit integer')
+      }
+      this.database.exec(`PRAGMA foreign_keys = ON; PRAGMA busy_timeout = ${timeout}`)
+    } catch (error) {
+      this.database.close(true)
+      throw error
+    }
+  }
+
+  exec(sql: string): void {
+    this.database.exec(sql)
+  }
+
+  prepare(sql: string): BunSqliteStatement {
+    return new BunSqliteStatement(this.database.prepare(sql), () => this.database.prepare(sql))
+  }
+
+  get isTransaction(): boolean {
+    return this.database.inTransaction
+  }
+
+  /** Logical snapshot; implicit rowids may change. The caller runs this in its backup worker. */
+  backup(path: string): void {
+    const statement = this.database.prepare('VACUUM INTO ?')
+    try {
+      statement.run(sqliteFileUri(path))
+    } finally {
+      statement.finalize()
+    }
+  }
+
+  close(): void {
+    this.database.close(true)
+  }
+}
+
+function sqliteFileUri(path: string): string {
+  const url = pathToFileURL(path)
+  if (url.hostname) {
+    const hostname = url.hostname
+    url.hostname = ''
+    // SQLite accepts UNC paths with an empty URI authority on Windows.
+    url.pathname = `//${hostname}${url.pathname}`
+  }
+  return url.href
+}
diff --git a/src/main/sqlite/bun-sqlite-statement.ts b/src/main/sqlite/bun-sqlite-statement.ts
new file mode 100644
index 000000000000..01b8081721a2
--- /dev/null
+++ b/src/main/sqlite/bun-sqlite-statement.ts
@@ -0,0 +1,77 @@
+import type { SQLInputValue, StatementResultingChanges } from 'node:sqlite'
+import { SqliteIntegerReader } from './sqlite-integer-reader'
+import type { SqliteBindings, SqliteRow, SqliteStatement } from './sqlite-statement'
+
+type BunBindings = (SQLInputValue | SQLInputValue[])[]
+const EMPTY_BINDINGS: BunBindings = [[]]
+
+export type BunStatement = {
+  all(...parameters: BunBindings): SqliteRow[]
+  get(...parameters: BunBindings): SqliteRow | null
+  run(...parameters: BunBindings): StatementResultingChanges
+  iterate(...parameters: BunBindings): IterableIterator<SqliteRow>
+  finalize(): void
+  safeIntegers(enabled: boolean): void
+  readonly paramsCount: number
+}
+
+export class BunSqliteStatement implements SqliteStatement {
+  private readonly integers = new SqliteIntegerReader()
+  private readonly parameterCount: number
+
+  constructor(
+    private readonly statement: BunStatement,
+    private readonly prepareIterator: () => BunStatement
+  ) {
+    statement.safeIntegers(true)
+    this.parameterCount = statement.paramsCount
+  }
+
+  all(...parameters: SqliteBindings): SqliteRow[] {
+    const rows = this.statement.all(...this.bindings(parameters))
+    for (const row of rows) {
+      this.integers.row(row)
+    }
+    return rows
+  }
+
+  get(...parameters: SqliteBindings): SqliteRow | undefined {
+    const row = this.statement.get(...this.bindings(parameters))
+    return row === null ? undefined : this.integers.row(row)
+  }
+
+  run(...parameters: SqliteBindings): StatementResultingChanges {
+    return this.integers.result(this.statement.run(...this.bindings(parameters)))
+  }
+
+  *iterate(...parameters: SqliteBindings): IterableIterator<SqliteRow> {
+    // Bun leaves interrupted iterators positioned on their last row and exposes no reset.
+    const statement = this.prepareIterator()
+    try {
+      statement.safeIntegers(true)
+      for (const row of statement.iterate(...this.bindings(parameters))) {
+        yield this.integers.row(row)
+      }
+    } finally {
+      statement.finalize()
+    }
+  }
+
+  setReadBigInts(enabled: boolean): void {
+    this.integers.readBigInts = enabled
+  }
+
+  private bindings(parameters: SqliteBindings): BunBindings {
+    if (parameters.some((value) => value === undefined)) {
+      throw new TypeError('Undefined cannot be bound to a SQLite parameter')
+    }
+    // No arguments would reuse the driver's previous bindings.
+    if (parameters.length === 0) {
+      return EMPTY_BINDINGS
+    }
+    if (parameters.length >= this.parameterCount) {
+      return parameters
+    }
+    return [...parameters, ...Array<null>(this.parameterCount - parameters.length).fill(null)]
+  }
+}
diff --git a/src/main/sqlite/node-sqlite-statement.ts b/src/main/sqlite/node-sqlite-statement.ts
new file mode 100644
index 000000000000..53a831080865
--- /dev/null
+++ b/src/main/sqlite/node-sqlite-statement.ts
@@ -0,0 +1,39 @@
+import type { StatementResultingChanges } from 'node:sqlite'
+import { SqliteIntegerReader } from './sqlite-integer-reader'
+import type { SqliteBindings, SqliteRow, SqliteStatement } from './sqlite-statement'
+
+export class NodeSqliteStatement implements SqliteStatement {
+  private readonly integers = new SqliteIntegerReader()
+
+  constructor(private readonly statement: SqliteStatement) {
+    // Native number reads overflow their INT64_MIN guard on some builds and round insert rowids.
+    statement.setReadBigInts(true)
+  }
+
+  all(...parameters: SqliteBindings): SqliteRow[] {
+    const rows = this.statement.all(...parameters)
+    for (const row of rows) {
+      this.integers.row(row)
+    }
+    return rows
+  }
+
+  get(...parameters: SqliteBindings): SqliteRow | undefined {
+    const row = this.statement.get(...parameters)
+    return row === undefined ? undefined : this.integers.row(row)
+  }
+
+  run(...parameters: SqliteBindings): StatementResultingChanges {
+    return this.integers.result(this.statement.run(...parameters))
+  }
+
+  *iterate(...parameters: SqliteBindings): IterableIterator<SqliteRow> {
+    for (const row of this.statement.iterate(...parameters)) {
+      yield this.integers.row(row)
+    }
+  }
+
+  setReadBigInts(enabled: boolean): void {
+    this.integers.readBigInts = enabled
+  }
+}
diff --git a/src/main/sqlite/sqlite-integer-reader.ts b/src/main/sqlite/sqlite-integer-reader.ts
new file mode 100644
index 000000000000..e3a5821bcda7
--- /dev/null
+++ b/src/main/sqlite/sqlite-integer-reader.ts
@@ -0,0 +1,40 @@
+import type { StatementResultingChanges } from 'node:sqlite'
+import type { SqliteRow } from './sqlite-statement'
+
+export class SqliteIntegerReader {
+  readBigInts = false
+
+  row(row: SqliteRow): SqliteRow {
+    if (!this.readBigInts) {
+      for (const key of Object.keys(row)) {
+        const value = row[key]
+        if (typeof value === 'bigint') {
+          row[key] = this.integer(value)
+        }
+      }
+    }
+    return row
+  }
+
+  result(result: StatementResultingChanges): StatementResultingChanges {
+    return {
+      changes: this.integer(result.changes, false),
+      lastInsertRowid: this.integer(result.lastInsertRowid, false)
+    }
+  }
+
+  private integer(value: number | bigint, requireSafeNumber = true): number | bigint {
+    if (this.readBigInts) {
+      return BigInt(value)
+    }
+    const number = Number(value)
+    if (!Number.isSafeInteger(number)) {
+      // Metadata conversion must not report failure after a write has committed.
+      if (!requireSafeNumber) {
+        return BigInt(value)
+      }
+      throw new RangeError('SQLite integer cannot be represented safely as a JavaScript number')
+    }
+    return number
+  }
+}
diff --git a/src/main/sqlite/sqlite-read-failure.test.ts b/src/main/sqlite/sqlite-read-failure.test.ts
index 8bd43d54eaa4..fdb3dc883658 100644
--- a/src/main/sqlite/sqlite-read-failure.test.ts
+++ b/src/main/sqlite/sqlite-read-failure.test.ts
@@ -10,13 +10,12 @@ import { classifySqliteReadFailure, isTransientSqliteContention } from './sqlite
 // with no usable -shm reports errcode 14 ("unable to open database file"). The
 // two need opposite responses, so the classifier must never conflate them.
 
-let tempDirs: string[] = []
+const tempDirs: string[] = []
 
 afterEach(() => {
-  for (const dir of tempDirs) {
+  for (const dir of tempDirs.splice(0)) {
     rmSync(dir, { recursive: true, force: true })
   }
-  tempDirs = []
 })
 
 function contendedDatabase(): { path: string; release: () => void } {
@@ -40,18 +39,22 @@ function contendedDatabase(): { path: string; release: () => void } {
 describe('isTransientSqliteContention', () => {
   it('recognizes a real SQLITE_BUSY thrown by a read-only open', () => {
     const contended = contendedDatabase()
+    let reader: SyncDatabase | undefined
     let thrown: unknown
     try {
-      new SyncDatabase(contended.path, { readonly: true, timeout: 0 })
-        .prepare('SELECT id FROM session')
-        .all()
+      reader = new SyncDatabase(contended.path, { readonly: true, timeout: 0 })
+      reader.prepare('SELECT id FROM session').all()
     } catch (error) {
       thrown = error
     } finally {
-      contended.release()
+      try {
+        reader?.close()
+      } finally {
+        contended.release()
+      }
     }
 
-    expect((thrown as { errcode?: number }).errcode).toBe(5)
+    expect(thrown).toMatchObject({ [process.versions.bun ? 'errno' : 'errcode']: 5 })
     expect(isTransientSqliteContention(thrown)).toBe(true)
   })
 
diff --git a/src/main/sqlite/sqlite-read-failure.ts b/src/main/sqlite/sqlite-read-failure.ts
index f96176eee0ac..6919bf9e9cbf 100644
--- a/src/main/sqlite/sqlite-read-failure.ts
+++ b/src/main/sqlite/sqlite-read-failure.ts
@@ -6,20 +6,39 @@
 /** Primary result codes; extended codes pack the primary code in the low byte. */
 const SQLITE_BUSY = 5
 const SQLITE_LOCKED = 6
+const SQLITE_CORRUPT = 11
 const SQLITE_CANTOPEN = 14
+const SQLITE_NOTADB = 26
 
 // Shared with the Codex index-heal pass, which only ever sees a relayed message
 // string (app-server RPC drops `errcode`), so message matching is not optional.
 const CONTENTION_MESSAGE = /SQLITE_(?:BUSY|LOCKED)|database (?:is )?(?:busy|locked)/i
 
 function primaryErrcode(error: unknown): number | null {
-  if (!error || typeof error !== 'object' || !('errcode' in error)) {
+  if (!error || typeof error !== 'object') {
     return null
   }
-  const errcode = (error as { errcode?: unknown }).errcode
+  const errcode = 'errcode' in error ? error.errcode : 'errno' in error ? error.errno : undefined
   return typeof errcode === 'number' && Number.isFinite(errcode) ? errcode & 0xff : null
 }
 
+/** node:sqlite marks its errors `ERR_SQLITE_ERROR`; Bun names its class `SQLiteError`. */
+function isSqliteDriverError(error: unknown): boolean {
+  return (
+    error instanceof Error &&
+    (('code' in error && error.code === 'ERR_SQLITE_ERROR') || error.name === 'SQLiteError')
+  )
+}
+
+/** True only when SQLite itself reports the database damaged or not a database at all. */
+export function isSqliteCorruption(error: unknown): boolean {
+  if (!isSqliteDriverError(error)) {
+    return false
+  }
+  const errcode = primaryErrcode(error)
+  return errcode === SQLITE_CORRUPT || errcode === SQLITE_NOTADB
+}
+
 function errorText(error: unknown): string {
   return error instanceof Error ? error.message : String(error)
 }
diff --git a/src/main/sqlite/sqlite-statement.ts b/src/main/sqlite/sqlite-statement.ts
new file mode 100644
index 000000000000..32d1e183be00
--- /dev/null
+++ b/src/main/sqlite/sqlite-statement.ts
@@ -0,0 +1,12 @@
+import type { SQLInputValue, SQLOutputValue, StatementResultingChanges } from 'node:sqlite'
+
+export type SqliteBindings = SQLInputValue[]
+export type SqliteRow = Record<string, SQLOutputValue>
+
+export type SqliteStatement = {
+  all(...parameters: SqliteBindings): SqliteRow[]
+  get(...parameters: SqliteBindings): SqliteRow | undefined
+  run(...parameters: SqliteBindings): StatementResultingChanges
+  iterate(...parameters: SqliteBindings): IterableIterator<SqliteRow>
+  setReadBigInts(enabled: boolean): void
+}
diff --git a/src/main/sqlite/sync-database-concurrent-backup.test.ts b/src/main/sqlite/sync-database-concurrent-backup.test.ts
new file mode 100644
index 000000000000..94b6221e1d64
--- /dev/null
+++ b/src/main/sqlite/sync-database-concurrent-backup.test.ts
@@ -0,0 +1,86 @@
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { Worker } from 'node:worker_threads'
+import { expect, it } from 'vitest'
+import SyncDatabase from './sync-database'
+
+const WRITER_SOURCE = `
+  const { parentPort, workerData } = require('node:worker_threads')
+  const Database = process.versions.bun
+    ? require('bun:sqlite').Database
+    : require('node:sqlite').DatabaseSync
+  const db = new Database(workerData.path)
+  db.exec('PRAGMA busy_timeout=5000; PRAGMA synchronous=FULL')
+  const count = new Int32Array(workerData.count)
+  let revision = 0
+  function commit() {
+    revision += 1
+    db.exec('BEGIN IMMEDIATE; UPDATE marker SET revision=' + revision + '; COMMIT')
+    Atomics.store(count, 0, revision)
+    if (revision === 1) {
+      parentPort.once('message', commit)
+      parentPort.postMessage('writing')
+      return
+    }
+    if (revision < 40) setTimeout(commit, 2)
+    else { db.close(true); parentPort.close() }
+  }
+  commit()
+`
+
+it('backs up one complete revision while another thread commits to the WAL', async () => {
+  const directory = mkdtempSync(join(tmpdir(), 'orca-sqlite-concurrent-backup-'))
+  const path = join(directory, 'source.db')
+  const target = join(directory, 'snapshot.db')
+  const source = new SyncDatabase(path)
+  let writer: Worker | undefined
+  let snapshot: SyncDatabase | undefined
+  try {
+    source.exec(`
+      PRAGMA journal_mode=WAL;
+      PRAGMA synchronous=FULL;
+      CREATE TABLE marker(name TEXT PRIMARY KEY, revision INTEGER NOT NULL);
+      INSERT INTO marker VALUES('first',0),('second',0);
+      CREATE TABLE payload(id INTEGER PRIMARY KEY, value BLOB NOT NULL);
+      WITH RECURSIVE rows(id) AS (VALUES(1) UNION ALL SELECT id+1 FROM rows WHERE id<1024)
+      INSERT INTO payload SELECT id, zeroblob(65536) FROM rows;
+    `)
+    const sharedCount = new SharedArrayBuffer(Int32Array.BYTES_PER_ELEMENT)
+    const count = new Int32Array(sharedCount)
+    writer = new Worker(WRITER_SOURCE, { eval: true, workerData: { path, count: sharedCount } })
+    const firstCommit = new Promise<void>((resolve, reject) => {
+      writer?.once('message', () => resolve())
+      writer?.once('error', reject)
+    })
+    const writerExit = new Promise<void>((resolve, reject) => {
+      writer?.once('error', reject)
+      writer?.once('exit', (code) =>
+        code === 0 ? resolve() : reject(new Error(`Writer exited ${code}`))
+      )
+    })
+    // Attach failure handling before awaiting either event.
+    void writerExit.catch(() => {})
+    await firstCommit
+    const before = Atomics.load(count, 0)
+    // Keep the writer alive until this thread is ready to start the backup.
+    writer.postMessage('continue')
+    await source.backup(target)
+    const after = Atomics.load(count, 0)
+    expect(after).toBeGreaterThan(before)
+    await writerExit
+    snapshot = new SyncDatabase(target, { readonly: true, fileMustExist: true })
+    const rows = snapshot.prepare('SELECT revision FROM marker ORDER BY name').all()
+    expect(rows).toHaveLength(2)
+    expect(rows[0]).toEqual(rows[1])
+    expect(rows[0]?.revision).toBeGreaterThanOrEqual(before)
+    expect(rows[0]?.revision).toBeLessThanOrEqual(Atomics.load(count, 0))
+    expect(snapshot.prepare('SELECT count(*) AS count FROM payload').get()).toEqual({ count: 1024 })
+    expect(snapshot.pragma('integrity_check', { simple: true })).toBe('ok')
+  } finally {
+    await writer?.terminate()
+    snapshot?.close()
+    source.close()
+    rmSync(directory, { recursive: true, force: true })
+  }
+}, 20_000)
diff --git a/src/main/sqlite/sync-database-portability.test.ts b/src/main/sqlite/sync-database-portability.test.ts
new file mode 100644
index 000000000000..fe8534eaf982
--- /dev/null
+++ b/src/main/sqlite/sync-database-portability.test.ts
@@ -0,0 +1,278 @@
+import { existsSync, mkdtempSync, renameSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { pathToFileURL } from 'node:url'
+import { afterEach, describe, expect, it } from 'vitest'
+import SyncDatabase, { isSqliteAvailable } from './sync-database'
+
+const directories: string[] = []
+const databases: SyncDatabase[] = []
+
+function fixture(): string {
+  const directory = mkdtempSync(join(tmpdir(), 'orca-sqlite-runtime-'))
+  directories.push(directory)
+  return directory
+}
+
+function open(path: string): SyncDatabase {
+  const db = new SyncDatabase(path)
+  databases.push(db)
+  return db
+}
+
+afterEach(() => {
+  for (const database of databases.splice(0)) {
+    try {
+      database.close()
+    } catch {
+      // A close-contract test already released this connection.
+    }
+  }
+  for (const directory of directories.splice(0)) {
+    rmSync(directory, { recursive: true, force: true })
+  }
+})
+
+describe('SQLite runtime contract', () => {
+  it('restarts an interrupted cached iterator without skipping its failed row', () => {
+    const db = open(':memory:')
+    db.exec('CREATE TABLE rows(value INTEGER); INSERT INTO rows VALUES(1),(2),(3)')
+    const statement = db.prepare('SELECT value FROM rows ORDER BY value')
+    for (let attempt = 0; attempt < 3; attempt++) {
+      expect(() => {
+        for (const row of statement.iterate()) {
+          expect(row.value).toBe(1)
+          throw new Error('invalid row')
+        }
+      }).toThrow('invalid row')
+    }
+    expect([...statement.iterate()]).toEqual([{ value: 1 }, { value: 2 }, { value: 3 }])
+    db.exec('DROP TABLE rows')
+  })
+
+  it('admits the actual runtime driver', () => {
+    expect(isSqliteAvailable()).toBe(true)
+  })
+
+  it('enforces foreign keys by default', () => {
+    const db = open(':memory:')
+    db.exec(
+      'CREATE TABLE parents(id INTEGER PRIMARY KEY); CREATE TABLE children(parent INTEGER REFERENCES parents(id))'
+    )
+    expect(() => db.prepare('INSERT INTO children VALUES(?)').run(1)).toThrow()
+    expect(db.prepare('SELECT * FROM children').all()).toEqual([])
+    db.prepare('INSERT INTO parents VALUES(?)').run(1)
+    expect(db.prepare('INSERT INTO children VALUES(?)').run(1).changes).toBe(1)
+    expect(() => db.prepare('DELETE FROM parents WHERE id = ?').run(1)).toThrow()
+  })
+
+  it('returns safe integers as numbers without changing other SQLite values', () => {
+    const db = open(':memory:')
+    const row = db
+      .prepare('SELECT ? AS integer, ? AS real, ? AS text, ? AS blob, ? AS empty')
+      .get(Number.MAX_SAFE_INTEGER, 1.25, 'héllo', Buffer.from([0, 255, 17]), null)
+    expect(row).toEqual({
+      integer: Number.MAX_SAFE_INTEGER,
+      real: 1.25,
+      text: 'héllo',
+      blob: expect.any(Uint8Array),
+      empty: null
+    })
+    expect(row?.blob).toEqual(new Uint8Array([0, 255, 17]))
+  })
+
+  it('preserves 64-bit integers and rejects rounding in every reader by default', () => {
+    const db = open(':memory:')
+    const statement = db.prepare('SELECT ? AS integer')
+    for (const value of [
+      -(1n << 63n),
+      -(1n << 63n) + 1n,
+      -(1n << 53n),
+      1n << 53n,
+      (1n << 53n) + 1n,
+      (1n << 63n) - 1n
+    ]) {
+      expect(() => statement.get(value)).toThrow(RangeError)
+      expect(() => statement.all(value)).toThrow(RangeError)
+      expect(() => [...statement.iterate(value)]).toThrow(RangeError)
+      statement.setReadBigInts(true)
+      expect(statement.get(value)).toEqual({ integer: value })
+      expect(statement.all(value)).toEqual([{ integer: value }])
+      expect([...statement.iterate(value)]).toEqual([{ integer: value }])
+      statement.setReadBigInts(false)
+    }
+  })
+
+  it('distinguishes large REAL values from INTEGER values in the same column', () => {
+    const db = open(':memory:')
+    db.exec('CREATE TABLE values_by_type(value); INSERT INTO values_by_type VALUES(1)')
+    const statement = db.prepare('SELECT value FROM values_by_type')
+    for (const readBigInts of [false, true, false]) {
+      statement.setReadBigInts(readBigInts)
+      db.exec('DELETE FROM values_by_type; INSERT INTO values_by_type VALUES(9007199254740991)')
+      const safe = readBigInts ? 9007199254740991n : Number.MAX_SAFE_INTEGER
+      expect(statement.get()).toEqual({ value: safe })
+      db.exec(
+        'DELETE FROM values_by_type; INSERT INTO values_by_type VALUES(CAST(-9223372036854775808 AS REAL))'
+      )
+      const real = { value: Number(-(1n << 63n)) }
+      expect(statement.get()).toEqual(real)
+      expect(statement.all()).toEqual([real])
+      expect([...statement.iterate()]).toEqual([real])
+      db.exec('DELETE FROM values_by_type; INSERT INTO values_by_type VALUES(-9223372036854775808)')
+      if (readBigInts) {
+        expect(statement.get()).toEqual({ value: -(1n << 63n) })
+      } else {
+        expect(() => statement.get()).toThrow(RangeError)
+        expect(() => statement.all()).toThrow(RangeError)
+        expect(() => [...statement.iterate()]).toThrow(RangeError)
+      }
+    }
+  })
+
+  it('rejects integers outside SQLite range before changing rows', () => {
+    const db = open(':memory:')
+    db.exec('CREATE TABLE items(value INTEGER)')
+    const insert = db.prepare('INSERT INTO items VALUES(?)')
+    for (const value of [-(1n << 63n) - 1n, 1n << 63n]) {
+      expect(() => insert.run(value)).toThrow()
+    }
+    expect(db.prepare('SELECT count(*) AS count FROM items').get()).toEqual({ count: 0 })
+  })
+
+  it('clears old bindings and binds omitted positional values as null', () => {
+    const db = open(':memory:')
+    const statement = db.prepare('SELECT ? AS first, ? AS second')
+    expect(statement.get('old', 'secret')).toEqual({ first: 'old', second: 'secret' })
+    expect(statement.get('new')).toEqual({ first: 'new', second: null })
+    expect(statement.get()).toEqual({ first: null, second: null })
+    expect(statement.all()).toEqual([{ first: null, second: null }])
+    expect([...statement.iterate()]).toEqual([{ first: null, second: null }])
+    expect(db.prepare('SELECT 1 WHERE 0').get()).toBeUndefined()
+  })
+
+  it('reports changes and explicit rowids using the requested integer mode', () => {
+    const db = open(':memory:')
+    db.exec('CREATE TABLE items(id INTEGER PRIMARY KEY, value TEXT)')
+    const insert = db.prepare('INSERT INTO items VALUES(?, ?)')
+    expect(insert.run(3, 'first')).toEqual({ changes: 1, lastInsertRowid: 3 })
+    insert.setReadBigInts(true)
+    expect(insert.run(9007199254740993n, 'large')).toEqual({
+      changes: 1n,
+      lastInsertRowid: 9007199254740993n
+    })
+  })
+
+  it('preserves large write metadata without reporting a committed write as failed', () => {
+    const db = open(':memory:')
+    db.exec('CREATE TABLE items(id INTEGER PRIMARY KEY)')
+    const rowid = 9007199254740993n
+    expect(db.prepare('INSERT INTO items VALUES(?)').run(rowid)).toEqual({
+      changes: 1,
+      lastInsertRowid: rowid
+    })
+    expect(db.prepare('UPDATE items SET id=id').run()).toEqual({
+      changes: 1,
+      lastInsertRowid: rowid
+    })
+    const statement = db.prepare('SELECT id FROM items')
+    statement.setReadBigInts(true)
+    expect(statement.all()).toEqual([{ id: rowid }])
+  })
+
+  it('rejects explicit undefined bindings before modifying rows', () => {
+    const db = open(':memory:')
+    db.exec('CREATE TABLE items(value TEXT)')
+    const insert = db.prepare('INSERT INTO items VALUES(?)')
+    // @ts-expect-error Exercise invalid input from untyped callers.
+    expect(() => insert.run(undefined)).toThrow()
+    expect(db.prepare('SELECT count(*) AS count FROM items').get()).toEqual({ count: 0 })
+    const select = db.prepare('SELECT ? AS value')
+    // @ts-expect-error Exercise invalid input from untyped callers.
+    expect(() => select.get(undefined)).toThrow()
+    // @ts-expect-error Exercise invalid input from untyped callers.
+    expect(() => select.all(undefined)).toThrow()
+    // @ts-expect-error Exercise invalid input from untyped callers.
+    expect(() => [...select.iterate(undefined)]).toThrow()
+  })
+
+  it('releases statements and an unfinished iterator before filesystem retirement', () => {
+    const path = join(fixture(), 'database.db')
+    const db = open(path)
+    db.exec('CREATE TABLE items(id INTEGER PRIMARY KEY); INSERT INTO items VALUES(1),(2)')
+    db.exec("CREATE VIRTUAL TABLE search USING fts5(content); INSERT INTO search VALUES('needle')")
+    const statement = db.prepare('SELECT id FROM items ORDER BY id')
+    const search = db.prepare("SELECT content FROM search WHERE search MATCH 'needle'")
+    expect(search.get()).toEqual({ content: 'needle' })
+    const iterator = statement.iterate()
+    expect(iterator.next().value).toEqual({ id: 1 })
+    db.close()
+    expect(() => statement.get()).toThrow()
+    expect(() => search.get()).toThrow()
+    renameSync(path, `${path}.retired`)
+    const reopened = open(`${path}.retired`)
+    reopened.exec('DROP TABLE items')
+  })
+
+  it('opens literal filenames, URL paths and Buffer paths without treating them as data', () => {
+    const path = join(fixture(), "profile % # ' é.db")
+    const writer = open(path)
+    writer.exec('CREATE TABLE items(id INTEGER PRIMARY KEY); INSERT INTO items VALUES(9)')
+    for (const input of [pathToFileURL(path), Buffer.from(path)]) {
+      const reader = new SyncDatabase(input, { readonly: true, fileMustExist: true })
+      databases.push(reader)
+      expect(reader.prepare('SELECT id FROM items').get()).toEqual({ id: 9 })
+    }
+    expect(existsSync(path)).toBe(true)
+  })
+
+  it('refuses missing databases and changes through read-only connections', () => {
+    const path = join(fixture(), 'database.db')
+    for (const input of [path, pathToFileURL(path), Buffer.from(path)]) {
+      expect(() => new SyncDatabase(input, { fileMustExist: true })).toThrow()
+      expect(() => new SyncDatabase(input, { readonly: true, fileMustExist: true })).toThrow()
+      expect(existsSync(path)).toBe(false)
+    }
+    const writer = open(path)
+    writer.exec('CREATE TABLE items(id INTEGER PRIMARY KEY)')
+    const reader = new SyncDatabase(path, { readonly: true, timeout: 4321 })
+    databases.push(reader)
+    expect(reader.pragma('busy_timeout', { simple: true })).toBe(4321)
+    expect(() => reader.exec('INSERT INTO items VALUES(1)')).toThrow()
+    expect(writer.pragma('busy_timeout', { simple: true })).toBe(0)
+  })
+
+  it('copies committed WAL data through a read-only source into privately precreated output', async () => {
+    const directory = fixture()
+    const path = join(directory, 'database.db')
+    const target = join(directory, "snapshot % # '.db")
+    const writer = open(path)
+    writer.exec(
+      'PRAGMA journal_mode=WAL; PRAGMA synchronous=FULL; CREATE TABLE items(id INTEGER PRIMARY KEY, value TEXT)'
+    )
+    writer.prepare('INSERT INTO items VALUES(?, ?)').run(19, 'committed in WAL')
+    expect(existsSync(`${path}-wal`)).toBe(true)
+    const source = new SyncDatabase(path, { readonly: true, fileMustExist: true })
+    databases.push(source)
+    writeFileSync(target, '', { flag: 'wx', mode: 0o600 })
+    await source.backup(target)
+    const snapshot = open(target)
+    expect(snapshot.prepare('SELECT id, value FROM items').get()).toEqual({
+      id: 19,
+      value: 'committed in WAL'
+    })
+    expect(snapshot.pragma('integrity_check', { simple: true })).toBe('ok')
+  })
+
+  it('refuses an active transaction before creating any backup destination', async () => {
+    const directory = fixture()
+    const db = open(join(directory, 'database.db'))
+    db.exec(
+      'CREATE TABLE items(id INTEGER PRIMARY KEY); BEGIN IMMEDIATE; INSERT INTO items VALUES(1)'
+    )
+    const target = join(directory, 'backup.db')
+    await expect(db.backup(target)).rejects.toThrow(/idle/)
+    expect(existsSync(target)).toBe(false)
+    db.exec('ROLLBACK')
+  })
+})
diff --git a/src/main/sqlite/sync-database.test.ts b/src/main/sqlite/sync-database.test.ts
index 39cb443aeeb4..4c937197a43c 100644
--- a/src/main/sqlite/sync-database.test.ts
+++ b/src/main/sqlite/sync-database.test.ts
@@ -213,7 +213,7 @@ describe('SyncDatabase read-only opens under contention', () => {
       thrown = error
     }
 
-    expect((thrown as { errcode?: number }).errcode).toBe(5)
+    expect(thrown).toMatchObject({ [process.versions.bun ? 'errno' : 'errcode']: 5 })
     expect((thrown as Error).message).toContain('database is locked')
     expect(Date.now() - startedAt).toBeLessThan(200)
   })
diff --git a/src/main/sqlite/sync-database.ts b/src/main/sqlite/sync-database.ts
index 0bfa79e43f5c..5f27b52329e8 100644
--- a/src/main/sqlite/sync-database.ts
+++ b/src/main/sqlite/sync-database.ts
@@ -1,5 +1,8 @@
 import { existsSync } from 'node:fs'
-import type { DatabaseSync, StatementSync, SQLInputValue } from 'node:sqlite'
+import type { backup, BackupOptions, DatabaseSync, SQLInputValue } from 'node:sqlite'
+import { BunSqliteDatabase, loadBunSqlite } from './bun-sqlite-database'
+import { NodeSqliteStatement } from './node-sqlite-statement'
+import type { SqliteStatement } from './sqlite-statement'
 
 type SqlitePath = ConstructorParameters<typeof DatabaseSync>[0]
 
@@ -13,7 +16,7 @@ type PragmaOptions = {
   simple?: boolean
 }
 
-export type SqliteStatement = StatementSync
+export type { SqliteStatement } from './sqlite-statement'
 
 // Why: dynamic `IN (?,?,…)` clauses mint a new SQL string per arity, so the cache must stay bounded.
 const STATEMENT_CACHE_LIMIT = 256
@@ -32,28 +35,60 @@ function loadDatabaseSync(): typeof DatabaseSync {
   if (typeof process.getBuiltinModule !== 'function') {
     throw new Error('node:sqlite is unavailable in this Node.js runtime')
   }
-  return (process.getBuiltinModule('node:sqlite') as { DatabaseSync: typeof DatabaseSync })
-    .DatabaseSync
+  const sqlite: unknown = process.getBuiltinModule('node:sqlite')
+  if (!hasDatabaseSync(sqlite)) {
+    throw new Error('node:sqlite is unavailable in this Node.js runtime')
+  }
+  return sqlite.DatabaseSync
+}
+
+function hasDatabaseSync(value: unknown): value is { DatabaseSync: typeof DatabaseSync } {
+  return (
+    typeof value === 'object' &&
+    value !== null &&
+    'DatabaseSync' in value &&
+    typeof value.DatabaseSync === 'function'
+  )
+}
+
+function hasBackup(value: unknown): value is { backup: typeof backup } {
+  return (
+    typeof value === 'object' &&
+    value !== null &&
+    'backup' in value &&
+    typeof value.backup === 'function'
+  )
+}
+
+export function isSqliteAvailable(): boolean {
+  try {
+    if (process.versions.bun) {
+      return loadBunSqlite() !== undefined
+    }
+    const sqlite: unknown = process.getBuiltinModule?.('node:sqlite')
+    return hasDatabaseSync(sqlite) && hasBackup(sqlite)
+  } catch {
+    return false
+  }
 }
 
 class SyncDatabase {
-  private readonly db: DatabaseSync
-  private readonly statementCache = new Map<string, StatementSync>()
+  private readonly db: DatabaseSync | BunSqliteDatabase
+  private readonly statementCache = new Map<string, SqliteStatement>()
 
   constructor(path: SqlitePath, options: SyncDatabaseOptions = {}) {
-    if (
-      options.fileMustExist &&
-      typeof path === 'string' &&
-      path !== ':memory:' &&
-      !existsSync(path)
-    ) {
-      throw new Error(`SQLite database does not exist: ${path}`)
+    if (options.fileMustExist && path !== ':memory:' && !existsSync(path)) {
+      throw new Error(`SQLite database does not exist: ${String(path)}`)
+    }
+    if (process.versions.bun) {
+      this.db = new BunSqliteDatabase(path, options)
+    } else {
+      const DatabaseSync = loadDatabaseSync()
+      this.db = new DatabaseSync(path, {
+        readOnly: options.readonly,
+        timeout: options.timeout
+      })
     }
-    const DatabaseSync = loadDatabaseSync()
-    this.db = new DatabaseSync(path, {
-      readOnly: options.readonly,
-      timeout: options.timeout
-    })
   }
 
   exec(sql: string): void {
@@ -64,14 +99,17 @@ class SyncDatabase {
     this.db.exec(sql)
   }
 
-  prepare(sql: string): StatementSync {
+  prepare(sql: string): SqliteStatement {
     const cached = this.statementCache.get(sql)
     if (cached) {
       this.statementCache.delete(sql)
       this.statementCache.set(sql, cached)
       return cached
     }
-    const statement = this.db.prepare(sql)
+    const statement =
+      this.db instanceof BunSqliteDatabase
+        ? this.db.prepare(sql)
+        : new NodeSqliteStatement(this.db.prepare(sql))
     if (isStatementCacheable(sql)) {
       if (this.statementCache.size >= STATEMENT_CACHE_LIMIT) {
         const oldest = this.statementCache.keys().next().value
@@ -85,7 +123,7 @@ class SyncDatabase {
   }
 
   pragma(sql: string, options?: PragmaOptions): unknown {
-    const statement = this.db.prepare(`PRAGMA ${sql}`)
+    const statement = this.prepare(`PRAGMA ${sql}`)
     if (options?.simple) {
       const row = statement.get()
       if (!row) {
@@ -100,6 +138,28 @@ class SyncDatabase {
     return this.db.isTransaction
   }
 
+  /** Keep the source open until completion; Bun's compact snapshot runs synchronously. */
+  async backup(path: string, options?: BackupOptions): Promise<void> {
+    if (this.db.isTransaction) {
+      throw new Error('SQLite backup requires an idle database connection')
+    }
+    if (this.db instanceof BunSqliteDatabase) {
+      if (options && Object.keys(options).length > 0) {
+        throw new Error('Incremental SQLite backup options are unavailable in this runtime')
+      }
+      this.db.backup(path)
+      return
+    }
+    const sqlite: unknown =
+      typeof process.getBuiltinModule === 'function'
+        ? process.getBuiltinModule('node:sqlite')
+        : undefined
+    if (!hasBackup(sqlite)) {
+      throw new Error('Asynchronous SQLite backup is unavailable in this Node.js runtime')
+    }
+    await sqlite.backup(this.db, path, options ?? {})
+  }
+
   close(): void {
     this.statementCache.clear()
     this.db.close()
diff --git a/src/main/ssh-reattach-pane-cardinality.test.ts b/src/main/ssh-reattach-pane-cardinality.test.ts
index d71797033605..889f792abd4d 100644
--- a/src/main/ssh-reattach-pane-cardinality.test.ts
+++ b/src/main/ssh-reattach-pane-cardinality.test.ts
@@ -66,11 +66,11 @@ function sessionAfterClose() {
 }
 
 /** What the relay's reattach bind does per PTY — see `restoreReattachedPtyRuntime`. */
-function relayReattachBinds(
+async function relayReattachBinds(
   store: ReturnType<typeof createStore>,
   args: { tabId: string; leafId: string; ptyId: string; incarnationId?: string }
-): boolean | null {
-  return store.persistPtyBinding({
+): Promise<boolean | null> {
+  return await store.persistPtyBinding({
     worktreeId: WORKTREE,
     tabId: args.tabId,
     leafId: args.leafId,
@@ -95,10 +95,10 @@ function relayReattachBinds(
  * production uses; a raw session write is reconciled back to the attached lease's PTY by binding
  * recovery, which would make the fixture disagree with the real flow.
  */
-function paneSpawnCommits(
+async function paneSpawnCommits(
   store: ReturnType<typeof createStore>,
   args: { tabId: string; leafId: string; ptyId: string; leaseTabId?: string }
-): void {
+): Promise<void> {
   store.upsertSshRemotePtyLease({
     targetId: TARGET,
     ptyId: args.ptyId,
@@ -107,7 +107,7 @@ function paneSpawnCommits(
     leafId: args.leafId,
     state: 'attached'
   })
-  store.persistPtyBinding({
+  await store.persistPtyBinding({
     worktreeId: WORKTREE,
     tabId: args.tabId,
     leafId: args.leafId,
@@ -163,7 +163,7 @@ describe('STA-3077: an SSH reattach binds panes without grafting them back', ()
     // The user closes the tab; the remote kill never lands, so the lease survives untouched.
     store.setWorkspaceSession(sessionAfterClose())
 
-    const bound = relayReattachBinds(store, {
+    const bound = await relayReattachBinds(store, {
       tabId: TAB,
       leafId: TEST_LEAF_1,
       ptyId: 'pty-1',
@@ -189,7 +189,7 @@ describe('STA-3077: an SSH reattach binds panes without grafting them back', ()
     const resolvedTabId = findTerminalTabIdForLeaf(store.getWorkspaceSession(), TEST_LEAF_1)
     expect(resolvedTabId).toBe(OTHER_TAB)
 
-    const bound = relayReattachBinds(store, {
+    const bound = await relayReattachBinds(store, {
       tabId: resolvedTabId!,
       leafId: TEST_LEAF_1,
       ptyId: 'pty-2',
@@ -208,7 +208,7 @@ describe('STA-3077: an SSH reattach binds panes without grafting them back', ()
   it('still binds when the session is not yet authoritative for the worktree', async () => {
     const store = await createStore()
 
-    const bound = store.persistPtyBinding({
+    const bound = await store.persistPtyBinding({
       worktreeId: WORKTREE,
       tabId: TAB,
       leafId: TEST_LEAF_1,
@@ -250,7 +250,7 @@ describe('STA-3077: an SSH reattach binds panes without grafting them back', ()
 
     expect(store.getWorkspaceSession().terminalSurfaceTombstonesByPaneKey?.[paneKey]).toBeDefined()
     expect(
-      relayReattachBinds(store, {
+      await relayReattachBinds(store, {
         tabId: TAB,
         leafId: TEST_LEAF_1,
         ptyId: 'pty-1',
@@ -267,7 +267,7 @@ describe('STA-3077: an SSH reattach binds panes without grafting them back', ()
     const store = await createStore()
     store.setWorkspaceSession(sessionWithPane({ tabId: TAB, leafId: TEST_LEAF_1, ptyId: 'pty-1' }))
 
-    const bound = relayReattachBinds(store, {
+    const bound = await relayReattachBinds(store, {
       tabId: TAB,
       leafId: TEST_LEAF_2,
       ptyId: 'pty-2',
@@ -292,9 +292,9 @@ describe('STA-3077: an SSH reattach binds panes without grafting them back', ()
     const session = store.getWorkspaceSession()
     expect(session.terminalTopologyRevisionByRepoId?.repo1).toBeGreaterThan(0)
     expect(session.terminalSurfaceTombstonesByPaneKey ?? {}).toEqual({})
-    expect(relayReattachBinds(store, { tabId: TAB, leafId: TEST_LEAF_1, ptyId: 'pty-1' })).toBe(
-      false
-    )
+    expect(
+      await relayReattachBinds(store, { tabId: TAB, leafId: TEST_LEAF_1, ptyId: 'pty-1' })
+    ).toBe(false)
   })
 })
 
@@ -314,7 +314,7 @@ describe('STA-3077: one pane keeps at most one live remote lease', () => {
     const lease = { targetId: TARGET, worktreeId: WORKTREE, tabId: TAB, leafId: TEST_LEAF_1 }
     store.upsertSshRemotePtyLease({ ...lease, ptyId: 'pty-1', state: 'attached' })
 
-    paneSpawnCommits(store, { tabId: TAB, leafId: TEST_LEAF_1, ptyId: 'pty-2' })
+    await paneSpawnCommits(store, { tabId: TAB, leafId: TEST_LEAF_1, ptyId: 'pty-2' })
 
     expect(liveLeasePtyIds(store)).toEqual(['pty-2'])
   })
@@ -327,7 +327,7 @@ describe('STA-3077: one pane keeps at most one live remote lease', () => {
     const lease = { targetId: TARGET, worktreeId: WORKTREE, tabId: TAB, leafId: TEST_LEAF_1 }
     store.upsertSshRemotePtyLease({ ...lease, ptyId: 'pty-1', state: 'attached' })
 
-    paneSpawnCommits(store, { tabId: TAB, leafId: TEST_LEAF_1, ptyId: 'pty-2' })
+    await paneSpawnCommits(store, { tabId: TAB, leafId: TEST_LEAF_1, ptyId: 'pty-2' })
 
     const predecessor = store.getSshRemotePtyLeases(TARGET).find((entry) => entry.ptyId === 'pty-1')
     expect(predecessor?.state).toBe('expired')
@@ -339,7 +339,7 @@ describe('STA-3077: one pane keeps at most one live remote lease', () => {
     store.setWorkspaceSession(sessionWithPane({ tabId: TAB, leafId: TEST_LEAF_1, ptyId: 'pty-0' }))
 
     for (let reconnect = 0; reconnect < 10; reconnect++) {
-      paneSpawnCommits(store, { tabId: TAB, leafId: TEST_LEAF_1, ptyId: `pty-${reconnect}` })
+      await paneSpawnCommits(store, { tabId: TAB, leafId: TEST_LEAF_1, ptyId: `pty-${reconnect}` })
     }
 
     expect(liveLeasePtyIds(store)).toEqual(['pty-9'])
@@ -362,7 +362,7 @@ describe('STA-3077: one pane keeps at most one live remote lease', () => {
     // The successor's lease names the tab the pane sits in NOW; the predecessor's still names the
     // one it was written in. Only the leaf is common, so keying on the tab would stop the two
     // competing and leave both live — the cardinality growth.
-    paneSpawnCommits(store, {
+    await paneSpawnCommits(store, {
       tabId: TAB,
       leafId: TEST_LEAF_1,
       ptyId: 'pty-2',
@@ -401,7 +401,7 @@ describe('STA-3077: one pane keeps at most one live remote lease', () => {
     const lease = { targetId: TARGET, worktreeId: WORKTREE, tabId: TAB, leafId: TEST_LEAF_1 }
     store.upsertSshRemotePtyLease({ ...lease, ptyId: 'pty-1', state: 'attached' })
 
-    paneSpawnCommits(store, { tabId: TAB, leafId: TEST_LEAF_1, ptyId: 'pty-2' })
+    await paneSpawnCommits(store, { tabId: TAB, leafId: TEST_LEAF_1, ptyId: 'pty-2' })
 
     expect(liveLeasePtyIds(store).sort()).toEqual(['pty-2', 'sibling-pty'])
   })
@@ -461,7 +461,7 @@ describe('STA-3077: `expired` separates a superseded sibling from an orphan', ()
   it('never bulk-reattaches a superseded sibling', async () => {
     const store = await storeWithPane('pty-1')
 
-    paneSpawnCommits(store, { tabId: TAB, leafId: TEST_LEAF_1, ptyId: 'pty-2' })
+    await paneSpawnCommits(store, { tabId: TAB, leafId: TEST_LEAF_1, ptyId: 'pty-2' })
 
     const predecessor = store.getSshRemotePtyLeases(TARGET).find((entry) => entry.ptyId === 'pty-1')
     expect(predecessor).toMatchObject({ state: 'expired', supersededBy: 'pty-2' })
@@ -474,7 +474,7 @@ describe('STA-3077: `expired` separates a superseded sibling from an orphan', ()
     store.setWorkspaceSession(sessionWithPane({ tabId: TAB, leafId: TEST_LEAF_1, ptyId: 'pty-0' }))
 
     for (let reconnect = 0; reconnect < 10; reconnect++) {
-      paneSpawnCommits(store, { tabId: TAB, leafId: TEST_LEAF_1, ptyId: `pty-${reconnect}` })
+      await paneSpawnCommits(store, { tabId: TAB, leafId: TEST_LEAF_1, ptyId: `pty-${reconnect}` })
     }
 
     expect(bulkReattachPtyIds(store)).toEqual(['pty-9'])
@@ -500,7 +500,7 @@ describe('STA-3077: `expired` separates a superseded sibling from an orphan', ()
     store.markSshRemotePtyLease(TARGET, 'pty-1', 'expired')
     const orphanUpdatedAt = store.getSshRemotePtyLeases(TARGET)[0].updatedAt
 
-    paneSpawnCommits(store, { tabId: TAB, leafId: TEST_LEAF_1, ptyId: 'pty-2' })
+    await paneSpawnCommits(store, { tabId: TAB, leafId: TEST_LEAF_1, ptyId: 'pty-2' })
 
     const predecessor = store.getSshRemotePtyLeases(TARGET).find((entry) => entry.ptyId === 'pty-1')
     expect(predecessor).toMatchObject({ state: 'expired', supersededBy: 'pty-2' })
@@ -513,7 +513,7 @@ describe('STA-3077: `expired` separates a superseded sibling from an orphan', ()
   // belongs to the lease that lost, never to whatever claims the id next.
   it('clears the supersession mark when the id is re-upserted as a live lease', async () => {
     const store = await storeWithPane('pty-1')
-    paneSpawnCommits(store, { tabId: TAB, leafId: TEST_LEAF_1, ptyId: 'pty-2' })
+    await paneSpawnCommits(store, { tabId: TAB, leafId: TEST_LEAF_1, ptyId: 'pty-2' })
 
     // A restarted relay hands `pty-1` to a new shell for a different pane.
     store.upsertSshRemotePtyLease({
diff --git a/src/main/ssh/__tests__/ssh-connection-test-client.ts b/src/main/ssh/__tests__/ssh-connection-test-client.ts
index 5e57dea39363..46276f90c435 100644
--- a/src/main/ssh/__tests__/ssh-connection-test-client.ts
+++ b/src/main/ssh/__tests__/ssh-connection-test-client.ts
@@ -38,18 +38,32 @@ export const VALID_ED25519_HOST_KEY = Buffer.from(
 )
 
 // Knobs tests assign to; grouped because imported bindings cannot be reassigned.
-export const ssh2Mock = {
-  presentedHostKey: undefined as Buffer | undefined,
+export const ssh2Mock: {
+  presentedHostKey: Buffer | undefined
+  lastHostKeyAccepted: boolean | undefined
+  connectBehavior: 'ready' | 'error' | 'pending'
+  connectErrorMessage: string
+  connectErrorCode: string
+  destroyErrorMessage: string
+  connectSequence: ('ready' | 'silent' | Error)[]
+  execBehavior: 'callback' | 'pending'
+  sftpBehavior: 'callback' | 'pending'
+  notifyClientCreated: (() => void) | undefined
+} = {
+  presentedHostKey: undefined,
   /** What the verifier decided about the presented key on the most recent connect. */
-  lastHostKeyAccepted: undefined as boolean | undefined,
-  connectBehavior: 'ready' as 'ready' | 'error' | 'pending',
+  lastHostKeyAccepted: undefined,
+  connectBehavior: 'ready',
   connectErrorMessage: '',
   connectErrorCode: '',
   destroyErrorMessage: '',
-  connectSequence: [] as ('ready' | Error)[],
-  execBehavior: 'callback' as 'callback' | 'pending',
-  sftpBehavior: 'callback' as 'callback' | 'pending',
-  notifyClientCreated: undefined as (() => void) | undefined
+  // Why 'silent': leaves the connect attempt pending (no ready/error emitted)
+  // so a test can drive auth events (e.g. keyboard-interactive prompts)
+  // through emitSshEvent itself.
+  connectSequence: [],
+  execBehavior: 'callback',
+  sftpBehavior: 'callback',
+  notifyClientCreated: undefined
 }
 
 export const emitSshEvent = (event: string, ...args: unknown[]): void =>
@@ -137,6 +151,9 @@ export function createSsh2Module(): Ssh2ModuleMock {
           this.emit('ready')
           return
         }
+        if (next === 'silent') {
+          return
+        }
         if (ssh2Mock.connectBehavior === 'pending') {
           const configValue = this.lastConnectConfig
           const readyTimeout =
diff --git a/src/main/ssh/orcad-artifact-materializer.test.ts b/src/main/ssh/orcad-artifact-materializer.test.ts
new file mode 100644
index 000000000000..beff61176eea
--- /dev/null
+++ b/src/main/ssh/orcad-artifact-materializer.test.ts
@@ -0,0 +1,319 @@
+import { createHash } from 'node:crypto'
+import {
+  chmodSync,
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  rmSync,
+  statSync,
+  writeFileSync
+} from 'node:fs'
+import { tmpdir } from 'node:os'
+import { dirname, join } from 'node:path'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import {
+  ORCAD_BUILD_TARGET_FILENAME,
+  ORCAD_EMOJI_SHORTCODE_DATASET,
+  ORCAD_RIPGREP_ARTIFACTS,
+  ORCAD_TEMPLATE_MANIFEST_FILENAME,
+  ORCAD_TEMPLATE_TARGETS_DIR,
+  ORCAD_VERSION_FILENAME,
+  orcadArtifactFilenames,
+  orcadTemplateCommonFilenames
+} from '../../shared/orcad-artifacts'
+import type { OrcadBunTarget } from '../../shared/orcad-bun-runtime'
+import { z } from 'zod'
+import { readOrcadArtifactIdentity } from '../orcad/orcad-artifact-identity'
+import {
+  assembleOrcadArtifact,
+  materializeOrcadArtifact,
+  resetOrcadArtifactMaterializationsForTests
+} from './orcad-artifact-materializer'
+import { materializeCachedOrcadBunRuntime } from './orcad-bun-runtime-materializer'
+import type * as BunRuntimeMaterializer from './orcad-bun-runtime-materializer'
+
+vi.mock('./orcad-bun-runtime-materializer', async (importOriginal) => {
+  const actual = await importOriginal<typeof BunRuntimeMaterializer>()
+  return { ...actual, materializeCachedOrcadBunRuntime: vi.fn() }
+})
+
+const TARGET = 'linux-x64-glibc' as const
+const temporaryDirs: string[] = []
+
+afterEach(() => {
+  resetOrcadArtifactMaterializationsForTests()
+  vi.clearAllMocks()
+  for (const dir of temporaryDirs.splice(0)) {
+    rmSync(dir, { recursive: true, force: true })
+  }
+})
+
+function sha256(path: string): string {
+  return createHash('sha256').update(readFileSync(path)).digest('hex')
+}
+
+function write(path: string, contents: string): void {
+  mkdirSync(dirname(path), { recursive: true })
+  writeFileSync(path, contents)
+}
+
+function createTemplate(target: OrcadBunTarget = TARGET): {
+  root: string
+  templateDir: string
+  cacheRoot: string
+  runtimePath: string
+} {
+  const root = mkdtempSync(join(tmpdir(), 'orcad-artifact-template-'))
+  temporaryDirs.push(root)
+  const templateDir = join(root, 'template')
+  const cacheRoot = join(root, 'cache')
+  const runtimePath = join(root, 'bun-runtime')
+  const common: Record<string, string> = {
+    ...Object.fromEntries(orcadTemplateCommonFilenames().map((filename) => [filename, filename])),
+    'orcad.js': 'orcad-entry',
+    'daemon-entry.js': 'daemon-entry',
+    'profile-state-writer-worker-entry.js': 'writer-entry',
+    'profile-state-backup-worker-entry.js': 'backup-entry',
+    'windows-bun-pty-gate-entry.js': 'pty-gate-entry',
+    'parcel-watcher-process-entry.js': 'watcher-process',
+    'node_modules/@parcel/watcher/index.js': 'watcher-wrapper',
+    [ORCAD_EMOJI_SHORTCODE_DATASET]: '{}'
+  }
+  for (const [filename, contents] of Object.entries(common)) {
+    write(join(templateDir, filename), contents)
+  }
+  const targetDir = join(templateDir, ORCAD_TEMPLATE_TARGETS_DIR, target)
+  write(join(targetDir, ORCAD_BUILD_TARGET_FILENAME), `${target}\n`)
+  write(join(targetDir, 'watcher.node'), 'native-watcher')
+  write(join(targetDir, 'agent-browser-linux-x64'), 'browser')
+  write(runtimePath, 'bun-executable')
+  if (target.startsWith('win32-')) {
+    write(join(templateDir, 'windows-process-tree.node'), 'process-table')
+  }
+  write(
+    join(templateDir, ORCAD_TEMPLATE_MANIFEST_FILENAME),
+    JSON.stringify({
+      schemaVersion: 2,
+      commonSha256: Object.fromEntries(
+        Object.keys(common).map((filename) => [filename, sha256(join(templateDir, filename))])
+      ),
+      targets: {
+        [target]: {
+          targetSha256: sha256(join(targetDir, ORCAD_BUILD_TARGET_FILENAME)),
+          watcherSha256: sha256(join(targetDir, 'watcher.node')),
+          browserName: 'agent-browser-linux-x64',
+          browserSha256: sha256(join(targetDir, 'agent-browser-linux-x64'))
+        }
+      }
+    })
+  )
+  return { root, templateDir, cacheRoot, runtimePath }
+}
+
+describe('assembleOrcadArtifact', () => {
+  it.skipIf(process.platform === 'win32')(
+    'restores executable search modes from a template copied without them',
+    async () => {
+      const fixture = createTemplate()
+      const filenames = ORCAD_RIPGREP_ARTIFACTS.filter((filename) => filename.endsWith('/rg'))
+      for (const filename of filenames) {
+        chmodSync(join(fixture.templateDir, filename), 0o644)
+      }
+      const artifactDir = await assembleOrcadArtifact({ ...fixture, target: TARGET })
+      for (const filename of filenames) {
+        expect(statSync(join(artifactDir, filename)).mode & 0o777).toBe(0o755)
+      }
+    }
+  )
+
+  it('gives Windows executable naming a new immutable slot identity', async () => {
+    const target = 'win32-x64' as const
+    const fixture = createTemplate(target)
+    const artifactDir = await assembleOrcadArtifact({ ...fixture, target })
+    expect(readFileSync(join(artifactDir, 'bun-runtime.exe'), 'utf8')).toBe('bun-executable')
+    expect(existsSync(join(artifactDir, 'bun-runtime'))).toBe(false)
+    const oldHash = createHash('sha256')
+    for (const filename of orcadArtifactFilenames(target)) {
+      oldHash.update(readFileSync(join(artifactDir, filename)))
+    }
+    oldHash.update('browser')
+    const oldVersion = `0.1.0+${oldHash.digest('hex').slice(0, 12)}`
+    const oldDir = join(fixture.cacheRoot, target, oldVersion)
+    write(join(oldDir, 'bun-runtime'), 'legacy-slot-must-stay-unchanged')
+    expect(artifactDir).not.toBe(oldDir)
+    await expect(assembleOrcadArtifact({ ...fixture, target })).resolves.toBe(artifactDir)
+    expect(readFileSync(join(oldDir, 'bun-runtime'), 'utf8')).toBe(
+      'legacy-slot-must-stay-unchanged'
+    )
+  })
+
+  it('assembles a complete content-addressed target directory', async () => {
+    const fixture = createTemplate()
+    const artifactDir = await assembleOrcadArtifact({
+      templateDir: fixture.templateDir,
+      cacheRoot: fixture.cacheRoot,
+      target: TARGET,
+      runtimePath: fixture.runtimePath
+    })
+
+    const version = readFileSync(join(artifactDir, ORCAD_VERSION_FILENAME), 'utf8').trim()
+    expect(version).toMatch(/^0\.1\.0\+[a-f0-9]{12}$/u)
+    expect(await readOrcadArtifactIdentity(artifactDir)).toBe(version)
+    write(join(artifactDir, 'orcad.js'), 'changed-installed-bytes')
+    expect(await readOrcadArtifactIdentity(artifactDir)).not.toBe(version)
+    expect(artifactDir).toBe(join(fixture.cacheRoot, TARGET, version))
+    expect(readFileSync(join(artifactDir, ORCAD_BUILD_TARGET_FILENAME), 'utf8').trim()).toBe(TARGET)
+    for (const filename of orcadArtifactFilenames()) {
+      expect(readFileSync(join(artifactDir, filename)).byteLength).toBeGreaterThan(0)
+    }
+    expect(readFileSync(join(artifactDir, 'agent-browser-linux-x64'), 'utf8')).toBe('browser')
+  })
+
+  it('rejects a packaged native file that does not match its manifest', async () => {
+    const fixture = createTemplate()
+    write(
+      join(fixture.templateDir, ORCAD_TEMPLATE_TARGETS_DIR, TARGET, 'watcher.node'),
+      'corrupted'
+    )
+
+    await expect(
+      assembleOrcadArtifact({
+        templateDir: fixture.templateDir,
+        cacheRoot: fixture.cacheRoot,
+        target: TARGET,
+        runtimePath: fixture.runtimePath
+      })
+    ).rejects.toThrow('watcher checksum mismatch')
+  })
+
+  it('rejects a self-consistent target marker for a different native slot', async () => {
+    const fixture = createTemplate()
+    const targetPath = join(
+      fixture.templateDir,
+      ORCAD_TEMPLATE_TARGETS_DIR,
+      TARGET,
+      ORCAD_BUILD_TARGET_FILENAME
+    )
+    write(targetPath, 'linux-x64-musl\n')
+    const manifestPath = join(fixture.templateDir, ORCAD_TEMPLATE_MANIFEST_FILENAME)
+    const manifest = z
+      .object({
+        targets: z.record(z.string(), z.object({ targetSha256: z.string() }).passthrough())
+      })
+      .passthrough()
+      .parse(JSON.parse(readFileSync(manifestPath, 'utf8')))
+    const target = manifest.targets[TARGET]
+    if (!target) {
+      throw new Error('Missing target fixture')
+    }
+    target.targetSha256 = sha256(targetPath)
+    write(manifestPath, JSON.stringify(manifest))
+
+    await expect(
+      assembleOrcadArtifact({
+        templateDir: fixture.templateDir,
+        cacheRoot: fixture.cacheRoot,
+        target: TARGET,
+        runtimePath: fixture.runtimePath
+      })
+    ).rejects.toThrow('target identity does not match')
+  })
+
+  it('repairs corrupt artifacts beside the old entry and reuses the repair', async () => {
+    const fixture = createTemplate()
+    const first = await assembleOrcadArtifact({
+      templateDir: fixture.templateDir,
+      cacheRoot: fixture.cacheRoot,
+      target: TARGET,
+      runtimePath: fixture.runtimePath
+    })
+    write(join(first, 'orcad.js'), 'corrupted-cache-entry')
+
+    const repaired = await assembleOrcadArtifact({ ...fixture, target: TARGET })
+    expect(repaired).not.toBe(first)
+    expect(readFileSync(join(repaired, 'orcad.js'))).toEqual(
+      readFileSync(join(fixture.templateDir, 'orcad.js'))
+    )
+    expect(await assembleOrcadArtifact({ ...fixture, target: TARGET })).toBe(repaired)
+    expect(readFileSync(join(first, 'orcad.js'), 'utf8')).toBe('corrupted-cache-entry')
+  })
+
+  it('rejects an optional browser without a matching manifest checksum', async () => {
+    const fixture = createTemplate()
+    const manifestPath = join(fixture.templateDir, ORCAD_TEMPLATE_MANIFEST_FILENAME)
+    const manifest = z
+      .object({ targets: z.record(z.string(), z.record(z.string(), z.unknown())) })
+      .passthrough()
+      .parse(JSON.parse(readFileSync(manifestPath, 'utf8')))
+    delete manifest.targets[TARGET]?.browserSha256
+    write(manifestPath, JSON.stringify(manifest))
+
+    await expect(
+      assembleOrcadArtifact({
+        templateDir: fixture.templateDir,
+        cacheRoot: fixture.cacheRoot,
+        target: TARGET,
+        runtimePath: fixture.runtimePath
+      })
+    ).rejects.toThrow('browserName and browserSha256')
+  })
+
+  it('rejects a manifest that omits a required common artifact checksum', async () => {
+    const fixture = createTemplate()
+    const manifestPath = join(fixture.templateDir, ORCAD_TEMPLATE_MANIFEST_FILENAME)
+    const manifest = z
+      .object({ commonSha256: z.record(z.string(), z.string()) })
+      .passthrough()
+      .parse(JSON.parse(readFileSync(manifestPath, 'utf8')))
+    delete manifest.commonSha256['orcad.js']
+    write(manifestPath, JSON.stringify(manifest))
+
+    await expect(
+      assembleOrcadArtifact({
+        templateDir: fixture.templateDir,
+        cacheRoot: fixture.cacheRoot,
+        target: TARGET,
+        runtimePath: fixture.runtimePath
+      })
+    ).rejects.toThrow('manifest omits orcad.js')
+  })
+})
+
+describe('materializeOrcadArtifact cancellation', () => {
+  it('detaches either cancelled caller without cancelling their shared cache fill', async () => {
+    const fixture = createTemplate()
+    let complete: (path: string) => void = () => {}
+    vi.mocked(materializeCachedOrcadBunRuntime).mockReturnValue(
+      new Promise((resolve) => {
+        complete = resolve
+      })
+    )
+    const first = new AbortController()
+    const second = new AbortController()
+    const one = materializeOrcadArtifact(TARGET, { ...fixture, signal: first.signal })
+    const two = materializeOrcadArtifact(TARGET, { ...fixture, signal: second.signal })
+    const three = materializeOrcadArtifact(TARGET, fixture)
+    const firstRejected = expect(one).rejects.toThrow('first cancelled')
+    const secondRejected = expect(two).rejects.toThrow('second cancelled')
+    await vi.waitFor(() => expect(materializeCachedOrcadBunRuntime).toHaveBeenCalledOnce())
+    first.abort(new Error('first cancelled'))
+    second.abort(new Error('second cancelled'))
+    await Promise.all([firstRejected, secondRejected])
+    complete(fixture.runtimePath)
+    const artifact = await three
+    expect(readFileSync(join(artifact, 'orcad.js'), 'utf8')).toBe('orcad-entry')
+    expect(materializeCachedOrcadBunRuntime).toHaveBeenCalledWith(TARGET, fixture.cacheRoot, {
+      fetcher: undefined
+    })
+  })
+
+  it('refuses an already cancelled request before reading or fetching artifacts', async () => {
+    const controller = new AbortController()
+    controller.abort(new Error('cancelled'))
+    await expect(materializeOrcadArtifact(TARGET, { signal: controller.signal })).rejects.toThrow(
+      'cancelled'
+    )
+    expect(materializeCachedOrcadBunRuntime).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/main/ssh/orcad-artifact-materializer.ts b/src/main/ssh/orcad-artifact-materializer.ts
new file mode 100644
index 000000000000..2efe902b5042
--- /dev/null
+++ b/src/main/ssh/orcad-artifact-materializer.ts
@@ -0,0 +1,291 @@
+import { createHash, randomUUID } from 'node:crypto'
+import { createReadStream, existsSync } from 'node:fs'
+import { chmod, copyFile, mkdir, readFile, rename, rm, writeFile } from 'node:fs/promises'
+import { dirname, join } from 'node:path'
+import { z } from 'zod'
+import { getAppEnvironment } from '../../shared/app-environment'
+import { waitForPromiseWithSignal } from '../../shared/abort-signal-reason'
+import {
+  ORCAD_BUILD_TARGET_FILENAME,
+  orcadBunRuntimeFilename,
+  orcadArtifactHashPrefix,
+  ORCAD_TEMPLATE_MANIFEST_FILENAME,
+  ORCAD_TEMPLATE_TARGETS_DIR,
+  ORCAD_VERSION,
+  ORCAD_VERSION_FILENAME,
+  ORCAD_RIPGREP_ARTIFACTS,
+  orcadArtifactFilenames,
+  orcadTemplateCommonFilenames
+} from '../../shared/orcad-artifacts'
+import type { OrcadBunTarget } from '../../shared/orcad-bun-runtime'
+import { findOrcadCachePath } from './orcad-cache-path'
+import {
+  fileSha256,
+  materializeCachedOrcadBunRuntime,
+  verifyFileSha256,
+  type OrcadBunRuntimeMaterializeOptions
+} from './orcad-bun-runtime-materializer'
+
+const TemplateTargetSchema = z
+  .object({
+    targetSha256: z.string().regex(/^[a-f0-9]{64}$/u),
+    watcherSha256: z.string().regex(/^[a-f0-9]{64}$/u),
+    browserName: z
+      .string()
+      .regex(/^[A-Za-z0-9][A-Za-z0-9._-]*$/u)
+      .optional(),
+    browserSha256: z
+      .string()
+      .regex(/^[a-f0-9]{64}$/u)
+      .optional()
+  })
+  .refine((target) => Boolean(target.browserName) === Boolean(target.browserSha256), {
+    message: 'browserName and browserSha256 must either both be present or both be absent'
+  })
+const TemplateManifestSchema = z.object({
+  schemaVersion: z.literal(2),
+  commonSha256: z.record(z.string(), z.string().regex(/^[a-f0-9]{64}$/u)),
+  targets: z.record(z.string(), TemplateTargetSchema)
+})
+
+type MaterializeOptions = OrcadBunRuntimeMaterializeOptions & {
+  templateDir?: string
+  cacheRoot?: string
+}
+
+const materializations = new Map<string, Promise<string>>()
+
+export async function materializeOrcadArtifact(
+  target: OrcadBunTarget,
+  options: MaterializeOptions = {}
+): Promise<string> {
+  options.signal?.throwIfAborted()
+  const templateDir = options.templateDir ?? resolveOrcadTemplateDir()
+  const cacheRoot =
+    options.cacheRoot ?? join(getAppEnvironment().getPath('userData'), 'orcad-artifacts')
+  const key = `${templateDir}\0${cacheRoot}\0${target}`
+  const existing = materializations.get(key)
+  if (existing) {
+    return waitForPromiseWithSignal(existing, options.signal)
+  }
+  // Cancellation detaches one caller; the bounded cache fill still serves other deployments.
+  const pending = materializeOrcadArtifactInner(target, templateDir, cacheRoot, {
+    fetcher: options.fetcher
+  }).finally(() => materializations.delete(key))
+  materializations.set(key, pending)
+  return waitForPromiseWithSignal(pending, options.signal)
+}
+
+async function materializeOrcadArtifactInner(
+  target: OrcadBunTarget,
+  templateDir: string,
+  cacheRoot: string,
+  options: MaterializeOptions
+): Promise<string> {
+  const manifest = await readTemplateManifest(templateDir)
+  await verifyTemplate(templateDir, target, manifest)
+  const runtimePath = await materializeCachedOrcadBunRuntime(target, cacheRoot, options)
+  return await assembleOrcadArtifact({ templateDir, cacheRoot, target, runtimePath, manifest })
+}
+
+export async function assembleOrcadArtifact(args: {
+  templateDir: string
+  cacheRoot: string
+  target: OrcadBunTarget
+  runtimePath: string
+  manifest?: z.infer<typeof TemplateManifestSchema>
+}): Promise<string> {
+  const manifest = args.manifest ?? (await readTemplateManifest(args.templateDir))
+  await verifyTemplate(args.templateDir, args.target, manifest)
+  const sources = artifactSources(args.templateDir, args.target, args.runtimePath, manifest)
+  const { fullVersion, sourceHashes } = await computeArtifactIdentity(sources, args.target)
+  const targetRoot = join(args.cacheRoot, args.target)
+  const cached = await findOrcadCachePath(
+    (attempt) => join(targetRoot, `${fullVersion}${attempt ? `.repair-${attempt}` : ''}`),
+    (path) => isCompleteArtifact(path, fullVersion, sources, sourceHashes)
+  )
+  const targetDir = cached.path
+  if (cached.verified) {
+    return targetDir
+  }
+  await mkdir(targetRoot, { recursive: true })
+  const stagingDir = join(targetRoot, `.staging-${process.pid}-${randomUUID()}`)
+  try {
+    for (const source of sources) {
+      const destination = join(stagingDir, source.filename)
+      await mkdir(dirname(destination), { recursive: true })
+      await copyFile(source.path, destination)
+      if (source.executable && !args.target.startsWith('win32-')) {
+        await chmod(destination, 0o755)
+      }
+    }
+    await writeFile(join(stagingDir, ORCAD_VERSION_FILENAME), `${fullVersion}\n`, { mode: 0o600 })
+    if (!(await isCompleteArtifact(stagingDir, fullVersion, sources, sourceHashes))) {
+      throw new Error('Orcad artifact sources changed while copying')
+    }
+    try {
+      await rename(stagingDir, targetDir)
+    } catch (error) {
+      if (!(await isCompleteArtifact(targetDir, fullVersion, sources, sourceHashes))) {
+        throw new Error(`Orcad artifact cache entry is unavailable or corrupted: ${targetDir}`, {
+          cause: error
+        })
+      }
+    }
+    return targetDir
+  } finally {
+    await rm(stagingDir, { recursive: true, force: true })
+  }
+}
+
+function artifactSources(
+  templateDir: string,
+  target: OrcadBunTarget,
+  runtimePath: string,
+  manifest: z.infer<typeof TemplateManifestSchema>
+): { filename: string; path: string; executable?: boolean }[] {
+  const targetDir = join(templateDir, ORCAD_TEMPLATE_TARGETS_DIR, target)
+  const targetManifest = manifest.targets[target]
+  if (!targetManifest) {
+    throw new Error(`Packaged orcad template does not support ${target}`)
+  }
+  const required = orcadArtifactFilenames(target).map((filename) => ({
+    filename,
+    path:
+      filename === orcadBunRuntimeFilename(target)
+        ? runtimePath
+        : filename === ORCAD_BUILD_TARGET_FILENAME
+          ? join(targetDir, ORCAD_BUILD_TARGET_FILENAME)
+          : filename.endsWith('watcher.node')
+            ? join(targetDir, 'watcher.node')
+            : join(templateDir, filename),
+    executable:
+      filename === orcadBunRuntimeFilename(target) ||
+      ORCAD_RIPGREP_ARTIFACTS.some((artifact) => artifact === filename && artifact.endsWith('/rg'))
+  }))
+  if (!targetManifest.browserName) {
+    return required
+  }
+  return [
+    ...required,
+    {
+      filename: targetManifest.browserName,
+      path: join(targetDir, targetManifest.browserName),
+      executable: true
+    }
+  ]
+}
+
+async function computeArtifactIdentity(
+  sources: { filename: string; path: string }[],
+  target: OrcadBunTarget
+): Promise<{ fullVersion: string; sourceHashes: Map<string, string> }> {
+  const hash = createHash('sha256').update(orcadArtifactHashPrefix(target))
+  const sourceHashes = new Map<string, string>()
+  for (const source of sources) {
+    const sourceHash = createHash('sha256')
+    for await (const chunk of createReadStream(source.path)) {
+      hash.update(chunk)
+      sourceHash.update(chunk)
+    }
+    sourceHashes.set(source.filename, sourceHash.digest('hex'))
+  }
+  return {
+    fullVersion: `${ORCAD_VERSION}+${hash.digest('hex').slice(0, 12)}`,
+    sourceHashes
+  }
+}
+
+async function isCompleteArtifact(
+  dir: string,
+  fullVersion: string,
+  sources: { filename: string }[],
+  sourceHashes: Map<string, string>
+): Promise<boolean> {
+  try {
+    if ((await readFile(join(dir, ORCAD_VERSION_FILENAME), 'utf8')).trim() !== fullVersion) {
+      return false
+    }
+    for (const source of sources) {
+      if ((await fileSha256(join(dir, source.filename))) !== sourceHashes.get(source.filename)) {
+        return false
+      }
+    }
+    return true
+  } catch {
+    return false
+  }
+}
+
+async function readTemplateManifest(
+  templateDir: string
+): Promise<z.infer<typeof TemplateManifestSchema>> {
+  return TemplateManifestSchema.parse(
+    JSON.parse(await readFile(join(templateDir, ORCAD_TEMPLATE_MANIFEST_FILENAME), 'utf8'))
+  )
+}
+
+async function verifyTemplate(
+  templateDir: string,
+  target: OrcadBunTarget,
+  manifest: z.infer<typeof TemplateManifestSchema>
+): Promise<void> {
+  const targetManifest = manifest.targets[target]
+  if (!targetManifest) {
+    throw new Error(`Packaged orcad template does not support ${target}`)
+  }
+  const commonFilenames = orcadTemplateCommonFilenames()
+  for (const filename of commonFilenames) {
+    const expected = manifest.commonSha256[filename]
+    if (!expected) {
+      throw new Error(`Packaged orcad template manifest omits ${filename}`)
+    }
+    await verifyFileSha256(join(templateDir, filename), expected, `orcad template ${filename}`)
+  }
+  const targetDir = join(templateDir, ORCAD_TEMPLATE_TARGETS_DIR, target)
+  const targetIdentityPath = join(targetDir, ORCAD_BUILD_TARGET_FILENAME)
+  await verifyFileSha256(targetIdentityPath, targetManifest.targetSha256, `${target} build target`)
+  if ((await readFile(targetIdentityPath, 'utf8')).trim() !== target) {
+    throw new Error(`Packaged orcad template target identity does not match ${target}`)
+  }
+  await verifyFileSha256(
+    join(targetDir, 'watcher.node'),
+    targetManifest.watcherSha256,
+    `${target} watcher`
+  )
+  if (targetManifest.browserName && targetManifest.browserSha256) {
+    await verifyFileSha256(
+      join(targetDir, targetManifest.browserName),
+      targetManifest.browserSha256,
+      `${target} browser`
+    )
+  }
+}
+
+export function getOrcadTemplateCandidates(): string[] {
+  const candidates: string[] = []
+  if (process.env.ORCA_ORCAD_TEMPLATE_PATH) {
+    candidates.push(process.env.ORCA_ORCAD_TEMPLATE_PATH)
+  }
+  if (process.resourcesPath) {
+    candidates.push(join(process.resourcesPath, 'orcad-template'))
+  }
+  const appPath = getAppEnvironment().getAppPath()
+  candidates.push(
+    join(appPath, 'out', 'orcad-template'),
+    join(appPath, 'resources', 'orcad-template')
+  )
+  return [...new Set(candidates)]
+}
+
+function resolveOrcadTemplateDir(): string {
+  const found = getOrcadTemplateCandidates().find((candidate) => existsSync(candidate))
+  if (!found) {
+    throw new Error('The packaged orcad deployment template is missing')
+  }
+  return found
+}
+
+export function resetOrcadArtifactMaterializationsForTests(): void {
+  materializations.clear()
+}
diff --git a/src/main/ssh/orcad-bun-runtime-materializer.test.ts b/src/main/ssh/orcad-bun-runtime-materializer.test.ts
new file mode 100644
index 000000000000..de9ab5d939c4
--- /dev/null
+++ b/src/main/ssh/orcad-bun-runtime-materializer.test.ts
@@ -0,0 +1,299 @@
+import { createHash } from 'node:crypto'
+import { access, mkdir, mkdtemp, readFile, readdir, rm, stat, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { ORCAD_BUN_RUNTIME_FILENAME } from '../../shared/orcad-artifacts'
+import { ORCAD_BUN_RELEASE_ASSETS, ORCAD_BUN_VERSION } from '../../shared/orcad-bun-runtime'
+import { setMainHttpClient } from '../network/http-client'
+import { runProcess } from '../../shared/child-process/run-process'
+import { materializeCachedOrcadBunRuntime } from './orcad-bun-runtime-materializer'
+
+const extraction = vi.hoisted(() => ({ executable: new Uint8Array(), executableName: 'bun' }))
+
+vi.mock('../../shared/child-process/run-process', () => ({
+  runProcess: vi.fn(async (spec: { args: string[] }) => {
+    const extracted = join(spec.args.at(-1)!, 'bun-linux-x64')
+    await mkdir(extracted, { recursive: true })
+    await writeFile(join(extracted, extraction.executableName), extraction.executable)
+    return { code: 0, stdout: '', stderr: '' }
+  })
+}))
+
+const TARGET = 'linux-x64-glibc' as const
+const originalAsset = { ...ORCAD_BUN_RELEASE_ASSETS[TARGET] }
+let cacheRoot = ''
+
+function sha256(bytes: Uint8Array): string {
+  return createHash('sha256').update(bytes).digest('hex')
+}
+
+function responseFetcher(body: Uint8Array, declaredLength = body.byteLength): typeof fetch {
+  return vi.fn<typeof fetch>(
+    async () =>
+      new Response(Buffer.from(body), {
+        status: 200,
+        headers: { 'content-length': String(declaredLength) }
+      })
+  )
+}
+
+beforeEach(async () => {
+  extraction.executableName = 'bun'
+  cacheRoot = await mkdtemp(join(tmpdir(), 'orca-bun-runtime-materializer-'))
+  Object.assign(ORCAD_BUN_RELEASE_ASSETS[TARGET], originalAsset)
+})
+
+afterEach(async () => {
+  vi.useRealTimers()
+  vi.unstubAllEnvs()
+  setMainHttpClient(null)
+  Object.assign(ORCAD_BUN_RELEASE_ASSETS[TARGET], originalAsset)
+  await rm(cacheRoot, { recursive: true, force: true })
+})
+
+describe('materializeCachedOrcadBunRuntime', () => {
+  it('caches Windows PE files as .exe without renaming a legacy cache entry', async () => {
+    const target = 'win32-x64' as const
+    const savedAsset = { ...ORCAD_BUN_RELEASE_ASSETS[target] }
+    const archive = new TextEncoder().encode('windows archive')
+    const executable = new TextEncoder().encode('windows executable')
+    extraction.executable = executable
+    extraction.executableName = 'bun.exe'
+    Object.assign(ORCAD_BUN_RELEASE_ASSETS[target], {
+      sha256: sha256(archive),
+      executableSha256: sha256(executable)
+    })
+    const runtimeDir = join(cacheRoot, 'bun', `v${ORCAD_BUN_VERSION}`, target)
+    await mkdir(runtimeDir, { recursive: true })
+    await writeFile(join(runtimeDir, 'bun-runtime'), 'legacy')
+    try {
+      const runtimePath = await materializeCachedOrcadBunRuntime(target, cacheRoot, {
+        fetcher: responseFetcher(archive)
+      })
+      expect(runtimePath).toBe(join(runtimeDir, 'bun-runtime.exe'))
+      expect(await readFile(runtimePath)).toEqual(Buffer.from(executable))
+      expect(await readFile(join(runtimeDir, 'bun-runtime'), 'utf8')).toBe('legacy')
+    } finally {
+      Object.assign(ORCAD_BUN_RELEASE_ASSETS[target], savedAsset)
+    }
+  })
+
+  it('reuses a checksum-valid cached runtime without fetching', async () => {
+    const runtime = new TextEncoder().encode('cached bun')
+    ORCAD_BUN_RELEASE_ASSETS[TARGET].executableSha256 = sha256(runtime)
+    const runtimeDir = join(cacheRoot, 'bun', `v${ORCAD_BUN_VERSION}`, TARGET)
+    const runtimePath = join(runtimeDir, ORCAD_BUN_RUNTIME_FILENAME)
+    await mkdir(runtimeDir, { recursive: true })
+    await writeFile(runtimePath, runtime)
+    const fetcher = vi.fn<typeof fetch>()
+
+    await expect(materializeCachedOrcadBunRuntime(TARGET, cacheRoot, { fetcher })).resolves.toBe(
+      runtimePath
+    )
+    expect(fetcher).not.toHaveBeenCalled()
+    expect(await readFile(runtimePath)).toEqual(Buffer.from(runtime))
+  })
+
+  it('downloads, verifies, extracts, and atomically caches the runtime', async () => {
+    const archive = new TextEncoder().encode('pinned archive')
+    const executable = new TextEncoder().encode('pinned bun executable')
+    extraction.executable = executable
+    Object.assign(ORCAD_BUN_RELEASE_ASSETS[TARGET], {
+      sha256: sha256(archive),
+      executableSha256: sha256(executable)
+    })
+    const fetcher = responseFetcher(archive)
+
+    const runtimePath = await materializeCachedOrcadBunRuntime(TARGET, cacheRoot, { fetcher })
+
+    expect(await readFile(runtimePath)).toEqual(Buffer.from(executable))
+    if (process.platform !== 'win32') {
+      expect((await stat(runtimePath)).mode & 0o111).toBe(0o111)
+    }
+    expect(fetcher).toHaveBeenCalledWith(
+      expect.stringContaining(`/bun-v${ORCAD_BUN_VERSION}/bun-linux-x64.zip`),
+      expect.objectContaining({ redirect: 'follow' })
+    )
+    expect((await readdir(join(cacheRoot, 'bun', `v${ORCAD_BUN_VERSION}`, TARGET))).sort()).toEqual(
+      [ORCAD_BUN_RUNTIME_FILENAME]
+    )
+  })
+
+  it('refuses an oversized declared archive before reading its body', async () => {
+    const fetcher = responseFetcher(new Uint8Array([1]), 200 * 1024 * 1024 + 1)
+
+    await expect(materializeCachedOrcadBunRuntime(TARGET, cacheRoot, { fetcher })).rejects.toThrow(
+      'Bun download exceeded the archive size limit'
+    )
+    await expect(
+      access(join(cacheRoot, 'bun', `v${ORCAD_BUN_VERSION}`, TARGET, ORCAD_BUN_RUNTIME_FILENAME))
+    ).rejects.toThrow()
+    expect(await readdir(join(cacheRoot, 'bun', `v${ORCAD_BUN_VERSION}`, TARGET))).toEqual([])
+  })
+
+  it('removes temporary data after an archive checksum mismatch', async () => {
+    const archive = new TextEncoder().encode('tampered archive')
+    const fetcher = responseFetcher(archive)
+
+    await expect(materializeCachedOrcadBunRuntime(TARGET, cacheRoot, { fetcher })).rejects.toThrow(
+      'Bun archive checksum mismatch'
+    )
+    expect(await readdir(join(cacheRoot, 'bun', `v${ORCAD_BUN_VERSION}`, TARGET))).toEqual([])
+  })
+
+  it('refuses an executable mismatch even when the archive matches its pin', async () => {
+    const archive = new TextEncoder().encode('pinned archive')
+    extraction.executable = new TextEncoder().encode('incorrect executable')
+    ORCAD_BUN_RELEASE_ASSETS[TARGET].sha256 = sha256(archive)
+    await expect(
+      materializeCachedOrcadBunRuntime(TARGET, cacheRoot, { fetcher: responseFetcher(archive) })
+    ).rejects.toThrow('Bun executable checksum mismatch')
+    expect(await readdir(join(cacheRoot, 'bun', `v${ORCAD_BUN_VERSION}`, TARGET))).toEqual([])
+  })
+
+  // Both cases spawn for real, so the assertion is against the errno Node actually reports:
+  // a missing program rejects asynchronously with ENOENT, while a program path whose parent is a
+  // regular file throws ENOTDIR synchronously out of `spawn` itself.
+  it.each([
+    ['absent', (): string => join(cacheRoot, 'absent-extractor')],
+    ['unreachable through a file', (): string => join(cacheRoot, 'plain-file', 'unzip')]
+  ])('names the %s extractor and the override when it cannot be launched', async (_label, path) => {
+    const archive = new TextEncoder().encode('unextractable archive')
+    ORCAD_BUN_RELEASE_ASSETS[TARGET].sha256 = sha256(archive)
+    await writeFile(join(cacheRoot, 'plain-file'), 'not a directory')
+    const { runProcess: spawnForReal } = await vi.importActual<{
+      runProcess: typeof runProcess
+    }>('../../shared/child-process/run-process')
+    vi.mocked(runProcess).mockImplementationOnce(spawnForReal)
+    vi.stubEnv('ORCA_UNZIP_BIN', path())
+
+    await expect(
+      materializeCachedOrcadBunRuntime(TARGET, cacheRoot, { fetcher: responseFetcher(archive) })
+    ).rejects.toThrow(/install unzip, or set ORCA_UNZIP_BIN/)
+    expect(await readdir(join(cacheRoot, 'bun', `v${ORCAD_BUN_VERSION}`, TARGET))).toEqual([])
+  })
+
+  it('cleans an aborted download before publishing any executable', async () => {
+    const controller = new AbortController()
+    controller.abort(new Error('deployment cancelled'))
+    await expect(
+      materializeCachedOrcadBunRuntime(TARGET, cacheRoot, {
+        fetcher: responseFetcher(new Uint8Array([1])),
+        signal: controller.signal
+      })
+    ).rejects.toThrow('deployment cancelled')
+    await expect(access(join(cacheRoot, 'bun'))).rejects.toThrow()
+  })
+})
+
+it('publishes concurrent runtime downloads without removing or replacing the winning executable', async () => {
+  const archive = new TextEncoder().encode('pinned archive')
+  extraction.executable = new TextEncoder().encode('pinned runtime')
+  Object.assign(ORCAD_BUN_RELEASE_ASSETS[TARGET], {
+    sha256: sha256(archive),
+    executableSha256: sha256(extraction.executable)
+  })
+  let finishSecond: (response: Response) => void = () => {}
+  const secondFetcher = vi.fn<typeof fetch>(
+    () =>
+      new Promise<Response>((resolve) => {
+        finishSecond = resolve
+      })
+  )
+  const second = materializeCachedOrcadBunRuntime(TARGET, cacheRoot, { fetcher: secondFetcher })
+  await vi.waitFor(() => expect(secondFetcher).toHaveBeenCalledOnce())
+  const firstPath = await materializeCachedOrcadBunRuntime(TARGET, cacheRoot, {
+    fetcher: responseFetcher(archive)
+  })
+  const firstIdentity = await stat(firstPath)
+  finishSecond(new Response(Buffer.from(archive)))
+  expect(await second).toBe(firstPath)
+  expect((await stat(firstPath)).ino).toBe(firstIdentity.ino)
+  expect(await readFile(firstPath)).toEqual(Buffer.from(extraction.executable))
+})
+
+it('repairs a corrupt published runtime beside the old inode and reuses the repair', async () => {
+  const archive = new TextEncoder().encode('pinned archive')
+  extraction.executable = new TextEncoder().encode('pinned runtime')
+  Object.assign(ORCAD_BUN_RELEASE_ASSETS[TARGET], {
+    sha256: sha256(archive),
+    executableSha256: sha256(extraction.executable)
+  })
+  const runtimeDir = join(cacheRoot, 'bun', `v${ORCAD_BUN_VERSION}`, TARGET)
+  const runtimePath = join(runtimeDir, ORCAD_BUN_RUNTIME_FILENAME)
+  await mkdir(runtimeDir, { recursive: true })
+  await writeFile(runtimePath, 'corrupt')
+  const fetcher = responseFetcher(archive)
+  const repaired = await materializeCachedOrcadBunRuntime(TARGET, cacheRoot, { fetcher })
+  expect(repaired).not.toBe(runtimePath)
+  expect(await readFile(repaired)).toEqual(Buffer.from(extraction.executable))
+  expect(await materializeCachedOrcadBunRuntime(TARGET, cacheRoot, { fetcher })).toBe(repaired)
+  expect(fetcher).toHaveBeenCalledOnce()
+  expect(await readFile(runtimePath, 'utf8')).toBe('corrupt')
+})
+
+it('uses the configured HTTP client for deployment downloads', async () => {
+  const archive = new TextEncoder().encode('proxy archive')
+  extraction.executable = new TextEncoder().encode('proxy runtime')
+  Object.assign(ORCAD_BUN_RELEASE_ASSETS[TARGET], {
+    sha256: sha256(archive),
+    executableSha256: sha256(extraction.executable)
+  })
+  const fetcher = responseFetcher(archive)
+  setMainHttpClient({ fetch: fetcher, proxySession: () => null })
+  await materializeCachedOrcadBunRuntime(TARGET, cacheRoot, {})
+  expect(fetcher).toHaveBeenCalledOnce()
+})
+
+it('allows a progressing download to exceed two minutes', async () => {
+  vi.useFakeTimers()
+  const first = new TextEncoder().encode('first')
+  const second = new TextEncoder().encode('second')
+  extraction.executable = new TextEncoder().encode('slow runtime')
+  Object.assign(ORCAD_BUN_RELEASE_ASSETS[TARGET], {
+    sha256: sha256(Buffer.concat([first, second])),
+    executableSha256: sha256(extraction.executable)
+  })
+  let stream: ReadableStreamDefaultController<Uint8Array> | undefined
+  let signal: AbortSignal | null | undefined
+  const fetcher = vi.fn<typeof fetch>(async (_url, options) => {
+    signal = options?.signal
+    return new Response(
+      new ReadableStream({
+        start(controller) {
+          stream = controller
+        }
+      })
+    )
+  })
+  const pending = materializeCachedOrcadBunRuntime(TARGET, cacheRoot, { fetcher })
+  await vi.waitFor(() => expect(fetcher).toHaveBeenCalledOnce())
+  await vi.advanceTimersByTimeAsync(90_000)
+  stream!.enqueue(first)
+  await vi.waitFor(async () => {
+    const runtimeDir = join(cacheRoot, 'bun', `v${ORCAD_BUN_VERSION}`, TARGET)
+    const temporary = (await readdir(runtimeDir)).find((entry) => entry.startsWith('.download-'))!
+    expect(
+      (await stat(join(runtimeDir, temporary, ORCAD_BUN_RELEASE_ASSETS[TARGET].filename))).size
+    ).toBe(first.length)
+  })
+  await vi.advanceTimersByTimeAsync(90_000)
+  expect(signal?.aborted).toBe(false)
+  stream!.enqueue(second)
+  stream!.close()
+  expect(await readFile(await pending)).toEqual(Buffer.from(extraction.executable))
+})
+
+it('aborts a stalled body and removes the unfinished download', async () => {
+  vi.useFakeTimers()
+  const cancel = vi.fn()
+  const fetcher = vi.fn<typeof fetch>(async () => new Response(new ReadableStream({ cancel })))
+  const pending = materializeCachedOrcadBunRuntime(TARGET, cacheRoot, { fetcher })
+  const rejected = expect(pending).rejects.toThrow('Bun download stalled')
+  await vi.waitFor(() => expect(fetcher).toHaveBeenCalledOnce())
+  await vi.advanceTimersByTimeAsync(120_000)
+  await rejected
+  expect(cancel).toHaveBeenCalledOnce()
+  expect(await readdir(join(cacheRoot, 'bun', `v${ORCAD_BUN_VERSION}`, TARGET))).toEqual([])
+})
diff --git a/src/main/ssh/orcad-bun-runtime-materializer.ts b/src/main/ssh/orcad-bun-runtime-materializer.ts
new file mode 100644
index 000000000000..e52a87534eb1
--- /dev/null
+++ b/src/main/ssh/orcad-bun-runtime-materializer.ts
@@ -0,0 +1,228 @@
+import { createHash, randomUUID } from 'node:crypto'
+import { createReadStream, readdirSync } from 'node:fs'
+import { chmod, link, mkdir, open, rm } from 'node:fs/promises'
+import { basename, join } from 'node:path'
+import { runProcess, type ProcessResult } from '../../shared/child-process/run-process'
+import { waitForPromiseWithSignal } from '../../shared/abort-signal-reason'
+import { isDefinitiveAbsence } from '../../shared/definitive-filesystem-absence'
+import { getZipExtractorCommand } from '../../shared/zip-extractor-command'
+import { getMainHttpClient, type MainHttpClient } from '../network/http-client'
+import { findOrcadCachePath } from './orcad-cache-path'
+import { orcadBunRuntimeFilename } from '../../shared/orcad-artifacts'
+import {
+  ORCAD_BUN_RELEASE_ASSETS,
+  ORCAD_BUN_VERSION,
+  orcadBunReleaseUrl,
+  type OrcadBunTarget
+} from '../../shared/orcad-bun-runtime'
+
+const MAX_BUN_ARCHIVE_BYTES = 200 * 1024 * 1024
+
+export type OrcadBunRuntimeMaterializeOptions = {
+  fetcher?: MainHttpClient['fetch']
+  signal?: AbortSignal
+}
+
+export async function materializeCachedOrcadBunRuntime(
+  target: OrcadBunTarget,
+  cacheRoot: string,
+  options: OrcadBunRuntimeMaterializeOptions
+): Promise<string> {
+  options.signal?.throwIfAborted()
+  const asset = ORCAD_BUN_RELEASE_ASSETS[target]
+  const runtimeDir = join(cacheRoot, 'bun', `v${ORCAD_BUN_VERSION}`, target)
+  await mkdir(runtimeDir, { recursive: true })
+  const runtime = await findOrcadCachePath(
+    (attempt) =>
+      join(runtimeDir, `${attempt ? `repair-${attempt}-` : ''}${orcadBunRuntimeFilename(target)}`),
+    async (path) => (await fileSha256(path)) === asset.executableSha256
+  )
+  const runtimePath = runtime.path
+  if (runtime.verified) {
+    if (!target.startsWith('win32-')) {
+      await chmod(runtimePath, 0o755)
+    }
+    return runtimePath
+  }
+  const temporaryDir = join(runtimeDir, `.download-${process.pid}-${randomUUID()}`)
+  await mkdir(temporaryDir, { recursive: true })
+  try {
+    const archivePath = join(temporaryDir, basename(asset.filename))
+    await downloadVerifiedArchive(
+      orcadBunReleaseUrl(asset),
+      archivePath,
+      asset.sha256,
+      options.fetcher ?? getMainHttpClient().fetch,
+      options.signal
+    )
+    options.signal?.throwIfAborted()
+    const extractedDir = join(temporaryDir, 'extracted')
+    await mkdir(extractedDir)
+    const result = await extractArchive(archivePath, extractedDir, options.signal)
+    options.signal?.throwIfAborted()
+    if (result.code !== 0) {
+      throw new Error(`Bun archive extraction failed: ${result.stderr || result.stdout}`)
+    }
+    const executable = findExtractedBun(extractedDir, target)
+    await verifyFileSha256(executable, asset.executableSha256, `${target} Bun executable`)
+    if (!target.startsWith('win32-')) {
+      await chmod(executable, 0o755)
+    }
+    options.signal?.throwIfAborted()
+    try {
+      await link(executable, runtimePath)
+    } catch (error) {
+      if ((await fileSha256(runtimePath)) !== asset.executableSha256) {
+        throw new Error(`Bun runtime cache entry is unavailable or corrupted: ${runtimePath}`, {
+          cause: error
+        })
+      }
+    }
+    await verifyFileSha256(runtimePath, asset.executableSha256, `${target} cached Bun executable`)
+    return runtimePath
+  } finally {
+    await rm(temporaryDir, { recursive: true, force: true })
+  }
+}
+
+/**
+ * Why the extractor needs a message of its own: `unzip` is absent from a minimal POSIX install,
+ * and a bare `spawn unzip ENOENT` names neither the missing tool nor the override. A misconfigured
+ * `ORCA_UNZIP_BIN` whose parent is a file reports ENOTDIR instead, which is the same verdict.
+ *
+ * The errno is the program path's, not the caller's: `runProcess` leaves cwd unset, so the child
+ * inherits the parent's without resolving it. Measured on macOS, Linux and Windows — spawn still
+ * succeeds from a deleted cwd, even though `process.cwd()` itself throws ENOENT there.
+ */
+async function extractArchive(
+  archivePath: string,
+  extractDir: string,
+  signal?: AbortSignal
+): Promise<ProcessResult> {
+  const command = getZipExtractorCommand(archivePath, extractDir)
+  try {
+    return await runProcess({
+      program: command.file,
+      args: command.args,
+      timeoutMs: 120_000,
+      signal
+    })
+  } catch (error) {
+    if (isDefinitiveAbsence(error)) {
+      throw new Error(
+        `Bun archive extraction could not run ${command.file}: install ${command.label}, ` +
+          'or set ORCA_UNZIP_BIN to an unzip-compatible extractor.',
+        { cause: error }
+      )
+    }
+    throw error
+  }
+}
+
+async function downloadVerifiedArchive(
+  url: string,
+  destination: string,
+  expectedSha256: string,
+  fetcher: MainHttpClient['fetch'],
+  signal?: AbortSignal
+): Promise<void> {
+  const stall = new AbortController()
+  const downloadSignal = signal ? AbortSignal.any([signal, stall.signal]) : stall.signal
+  const stallTimer = setTimeout(() => stall.abort(new Error('Bun download stalled')), 120_000)
+  try {
+    const response = await fetcher(url, { redirect: 'follow', signal: downloadSignal })
+    if (!response.ok || !response.body) {
+      await response.body?.cancel().catch(() => undefined)
+      throw new Error(`Bun download failed: ${response.status} ${response.statusText}`)
+    }
+    const declaredLength = Number(response.headers.get('content-length'))
+    if (Number.isFinite(declaredLength) && declaredLength > MAX_BUN_ARCHIVE_BYTES) {
+      await response.body.cancel().catch(() => undefined)
+      throw new Error('Bun download exceeded the archive size limit')
+    }
+    const handle = await open(destination, 'wx', 0o600).catch(async (error) => {
+      await response.body?.cancel().catch(() => undefined)
+      throw error
+    })
+    const reader = response.body.getReader()
+    const hash = createHash('sha256')
+    let total = 0
+    try {
+      for (;;) {
+        downloadSignal.throwIfAborted()
+        const chunk = await waitForPromiseWithSignal(reader.read(), downloadSignal)
+        if (chunk.done) {
+          break
+        }
+        if (chunk.value.byteLength > 0) {
+          stallTimer.refresh()
+        }
+        total += chunk.value.byteLength
+        if (total > MAX_BUN_ARCHIVE_BYTES) {
+          throw new Error('Bun download exceeded the archive size limit')
+        }
+        hash.update(chunk.value)
+        await writeAll(handle, chunk.value)
+      }
+    } catch (error) {
+      await reader.cancel().catch(() => undefined)
+      throw error
+    } finally {
+      await handle.close()
+    }
+    const actual = hash.digest('hex')
+    if (actual !== expectedSha256) {
+      throw new Error(`Bun archive checksum mismatch: expected ${expectedSha256}, got ${actual}`)
+    }
+  } finally {
+    clearTimeout(stallTimer)
+  }
+}
+
+async function writeAll(
+  handle: Awaited<ReturnType<typeof open>>,
+  bytes: Uint8Array
+): Promise<void> {
+  let offset = 0
+  while (offset < bytes.byteLength) {
+    const { bytesWritten } = await handle.write(bytes, offset, bytes.byteLength - offset)
+    if (bytesWritten === 0) {
+      throw new Error('Bun archive write made no progress')
+    }
+    offset += bytesWritten
+  }
+}
+
+function findExtractedBun(root: string, target: OrcadBunTarget): string {
+  const expected = target.startsWith('win32-') ? 'bun.exe' : 'bun'
+  const entry = readdirSync(root, { recursive: true, withFileTypes: true }).find(
+    (candidate) => candidate.isFile() && candidate.name === expected
+  )
+  if (!entry) {
+    throw new Error(`Downloaded Bun archive contained no ${expected}`)
+  }
+  return join(entry.parentPath, entry.name)
+}
+
+export async function verifyFileSha256(
+  path: string,
+  expected: string,
+  label: string
+): Promise<void> {
+  const actual = await fileSha256(path)
+  if (actual !== expected) {
+    throw new Error(`${label} checksum mismatch: expected ${expected}, got ${actual ?? 'missing'}`)
+  }
+}
+
+export async function fileSha256(path: string): Promise<string | null> {
+  try {
+    const hash = createHash('sha256')
+    for await (const chunk of createReadStream(path)) {
+      hash.update(chunk)
+    }
+    return hash.digest('hex')
+  } catch {
+    return null
+  }
+}
diff --git a/src/main/ssh/orcad-cache-path.ts b/src/main/ssh/orcad-cache-path.ts
new file mode 100644
index 000000000000..2b31f6346422
--- /dev/null
+++ b/src/main/ssh/orcad-cache-path.ts
@@ -0,0 +1,22 @@
+import { lstat } from 'node:fs/promises'
+
+/** Recover beside corrupt entries; a published path may still belong to another reader. */
+export async function findOrcadCachePath(
+  candidate: (attempt: number) => string,
+  isValid: (path: string) => Promise<boolean>
+): Promise<{ path: string; verified: boolean }> {
+  for (let attempt = 0; ; attempt++) {
+    const path = candidate(attempt)
+    if (await isValid(path)) {
+      return { path, verified: true }
+    }
+    try {
+      await lstat(path)
+    } catch (error) {
+      if (error instanceof Error && 'code' in error && error.code === 'ENOENT') {
+        return { path, verified: false }
+      }
+      throw error
+    }
+  }
+}
diff --git a/src/main/ssh/orcad-deployment-target.test.ts b/src/main/ssh/orcad-deployment-target.test.ts
new file mode 100644
index 000000000000..db5915e659c0
--- /dev/null
+++ b/src/main/ssh/orcad-deployment-target.test.ts
@@ -0,0 +1,78 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { parseOrcadLinuxLibc, resolveOrcadDeploymentTarget } from './orcad-deployment-target'
+import { SshConnection } from './ssh-connection'
+import { createCallbacks, createTarget } from './ssh-connection-test-fixtures'
+import { execCommand } from './ssh-relay-deploy-helpers'
+import { getRemoteHostPlatform } from './ssh-remote-platform'
+
+vi.mock('./ssh-relay-deploy-helpers', () => ({ execCommand: vi.fn() }))
+beforeEach(() => vi.mocked(execCommand).mockReset())
+
+describe('deployment C library selection', () => {
+  it.each([
+    ['glibc 2.31', 'linux-x64-glibc'],
+    ['musl', 'linux-x64-musl']
+  ])('uses host fallback evidence %j when ldd is unavailable', async (evidence, target) => {
+    vi.mocked(execCommand).mockResolvedValueOnce('ldd: not found').mockResolvedValueOnce(evidence)
+    const conn = new SshConnection(createTarget(), createCallbacks())
+    await expect(
+      resolveOrcadDeploymentTarget({ conn, host: getRemoteHostPlatform('linux-x64') })
+    ).resolves.toBe(target)
+    expect(execCommand).toHaveBeenLastCalledWith(
+      conn,
+      expect.stringContaining('getconf GNU_LIBC_VERSION'),
+      expect.anything()
+    )
+  })
+
+  it('never guesses when neither probe identifies the host library', async () => {
+    vi.mocked(execCommand).mockResolvedValue('')
+    await expect(
+      resolveOrcadDeploymentTarget({
+        conn: new SshConnection(createTarget(), createCallbacks()),
+        host: getRemoteHostPlatform('linux-x64')
+      })
+    ).rejects.toThrow('Could not identify')
+  })
+
+  it('checks connection ownership again before the fallback probe', async () => {
+    const conn = new SshConnection(createTarget(), createCallbacks())
+    const generation = conn.getConnectGeneration()
+    const firstProbe = Promise.withResolvers<string>()
+    vi.mocked(execCommand).mockReturnValueOnce(firstProbe.promise)
+    const exec = vi.fn(async (command: string) => {
+      if (conn.getConnectGeneration() !== generation) {
+        throw new Error('SSH connection changed during SQLite runtime setup.')
+      }
+      return execCommand(conn, command)
+    })
+    const pending = resolveOrcadDeploymentTarget({
+      conn,
+      host: getRemoteHostPlatform('linux-x64'),
+      exec
+    })
+    expect(execCommand).toHaveBeenCalledOnce()
+
+    await conn.disconnect()
+    firstProbe.resolve('ldd: not found')
+
+    await expect(pending).rejects.toThrow('SSH connection changed')
+    expect(exec).toHaveBeenLastCalledWith(expect.stringContaining('getconf GNU_LIBC_VERSION'))
+    expect(execCommand).toHaveBeenCalledOnce()
+  })
+
+  it.each([
+    ['ldd (Ubuntu GLIBC 2.31-0ubuntu9) 2.31', 'glibc'],
+    ['ldd (GNU libc) 2.28', 'glibc'],
+    ['musl libc (x86_64)\nVersion 1.2.5', 'musl']
+  ])('recognizes %s', (output, expected) => {
+    expect(parseOrcadLinuxLibc(output)).toBe(expected)
+  })
+
+  it.each(['', 'ldd: command not found', 'Linux x86_64'])(
+    'refuses unproven target %j',
+    (output) => {
+      expect(() => parseOrcadLinuxLibc(output)).toThrow('Could not identify')
+    }
+  )
+})
diff --git a/src/main/ssh/orcad-deployment-target.ts b/src/main/ssh/orcad-deployment-target.ts
new file mode 100644
index 000000000000..9fd98fa8cfbd
--- /dev/null
+++ b/src/main/ssh/orcad-deployment-target.ts
@@ -0,0 +1,39 @@
+import type { OrcadBunTarget } from '../../shared/orcad-bun-runtime'
+import type { SshConnection } from './ssh-connection'
+import { execCommand } from './ssh-relay-deploy-helpers'
+import type { RemoteHostPlatform } from './ssh-remote-platform'
+
+export function parseOrcadLinuxLibc(output: string): 'glibc' | 'musl' {
+  if (/\bmusl\b/i.test(output)) {
+    return 'musl'
+  }
+  if (/\b(?:glibc|GNU libc|GNU C Library)\b/i.test(output)) {
+    return 'glibc'
+  }
+  throw new Error('Could not identify the host C library for the bundled Orca runtime')
+}
+
+export async function resolveOrcadDeploymentTarget(options: {
+  conn: SshConnection
+  host: RemoteHostPlatform
+  signal?: AbortSignal
+  exec?: (command: string) => Promise<string>
+}): Promise<OrcadBunTarget> {
+  const { host } = options
+  if (host.os !== 'linux') {
+    return `${host.os}-${host.arch}`
+  }
+  const exec =
+    options.exec ??
+    ((command: string) => execCommand(options.conn, command, { signal: options.signal }))
+  let output = await exec('ldd --version 2>&1 || true')
+  try {
+    return `linux-${host.arch}-${parseOrcadLinuxLibc(output)}`
+  } catch {
+    output = await exec(
+      'getconf GNU_LIBC_VERSION 2>/dev/null || ' +
+        'for loader in /lib/ld-musl-*.so.1; do [ ! -e "$loader" ] || { echo musl; break; }; done'
+    )
+  }
+  return `linux-${host.arch}-${parseOrcadLinuxLibc(output)}`
+}
diff --git a/src/main/ssh/orcad-remote-deploy-stop.ts b/src/main/ssh/orcad-remote-deploy-stop.ts
new file mode 100644
index 000000000000..8a00a1dfa037
--- /dev/null
+++ b/src/main/ssh/orcad-remote-deploy-stop.ts
@@ -0,0 +1,68 @@
+import type { SshConnection } from './ssh-connection'
+import { execCommand } from './ssh-relay-deploy-helpers'
+import { ORCAD_INSTALL_MODEL } from './remote-install-model'
+import { computeRemoteInstallDir } from './ssh-relay-versioned-install'
+import {
+  parseOrcadStopOutcome,
+  stopOrcadCommand,
+  type OrcadStopOutcome
+} from './orcad-remote-process-control'
+import type { RemoteHostPlatform } from './ssh-remote-platform'
+import { compareOrcadStateSnapshotCommand, orcadSnapshotIsUnchanged } from './orcad-state-snapshot'
+
+export type OrcadOutgoingStopOptions = {
+  conn: SshConnection
+  host: RemoteHostPlatform
+  remoteHome: string
+  nodePath: string
+  signal?: AbortSignal
+}
+
+/** Stop the outgoing runtime and return its execution-host verdict. */
+export async function stopOutgoingOrcad(
+  options: OrcadOutgoingStopOptions,
+  outgoingVersion: string
+): Promise<OrcadStopOutcome> {
+  const outgoingDir = computeRemoteInstallDir(
+    ORCAD_INSTALL_MODEL,
+    options.remoteHome,
+    outgoingVersion
+  )
+  const output = await execCommand(
+    options.conn,
+    stopOrcadCommand(options.host, outgoingDir, { waitSeconds: 20, nodePath: options.nodePath }),
+    {
+      wrapCommand: options.host.commandDialect !== 'powershell',
+      signal: options.signal
+    }
+  )
+  return parseOrcadStopOutcome(output)
+}
+
+/** The caller must confirm candidate exit before inspecting its shared state. */
+export async function rejectedOrcadStateRecoveryRefusal(
+  options: OrcadOutgoingStopOptions & { userDataDir: string },
+  incumbentVersion: string,
+  snapshotDir: string | undefined
+): Promise<string | undefined> {
+  const unchanged = snapshotDir
+    ? orcadSnapshotIsUnchanged(
+        await execCommand(
+          options.conn,
+          compareOrcadStateSnapshotCommand(options.host, options.userDataDir, snapshotDir),
+          { wrapCommand: options.host.commandDialect !== 'powershell', signal: options.signal }
+        ).catch(() => '')
+      )
+    : false
+  if (unchanged) {
+    return undefined
+  }
+  // RPC was already exposed; a prelaunch census cannot authorize discarding candidate writes.
+  const retainedSnapshot = snapshotDir ? ` at ${snapshotDir}.` : ', which is unavailable.'
+  return (
+    'The candidate is stopped, but profile state changed or could not be verified. ' +
+    `orcad ${incumbentVersion} was not restarted against potentially incompatible state. ` +
+    'Current state and daemon terminals are preserved; recovery requires a fresh host ' +
+    `terminal census before restoring the prelaunch snapshot${retainedSnapshot}`
+  )
+}
diff --git a/src/main/ssh/orcad-remote-deploy.test.ts b/src/main/ssh/orcad-remote-deploy.test.ts
index 1d9f87b009d0..38b9fc951f99 100644
--- a/src/main/ssh/orcad-remote-deploy.test.ts
+++ b/src/main/ssh/orcad-remote-deploy.test.ts
@@ -1,4 +1,8 @@
+import { chmodSync, mkdirSync, mkdtempSync, rmSync, statSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { dirname, join } from 'node:path'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { runProcess } from '../../shared/child-process/run-process'
 
 vi.mock('./ssh-relay-deploy-helpers', () => ({
   execCommand: vi.fn(),
@@ -21,18 +25,23 @@ import { execCommand } from './ssh-relay-deploy-helpers'
 import { acquireInstallLock } from './ssh-relay-install-lock'
 import { uploadRelayDirectory, writeRelayFile } from './ssh-relay-install-transfers'
 import { deployOrcad, type OrcadDeployOptions } from './orcad-remote-deploy'
+import { installOrcadBundle } from './orcad-remote-install'
+import {
+  abandonInstall,
+  finalizeInstall,
+  isRemoteInstallComplete
+} from './ssh-relay-versioned-install'
 import { emptyOrcadActivationRecord, withActivatedVersion } from './orcad-activation-record'
 import { getRemoteHostPlatform } from './ssh-remote-platform'
-import { finalizeInstall } from './ssh-relay-versioned-install'
 import type { SshConnection } from './ssh-connection'
 
 const mockExec = vi.mocked(execCommand)
-const NEW_VERSION = '0.2.0+bb01'
+const NEW_VERSION = '0.2.0+bb0100000000'
 const OLD_VERSION = '0.1.0+aa01'
 
 vi.mock('./ssh-relay-versioned-install', async (importOriginal) => ({
   ...(await importOriginal<Record<string, unknown>>()),
-  readLocalFullVersion: () => '0.2.0+bb01',
+  readLocalFullVersion: () => '0.2.0+bb0100000000',
   isRemoteInstallComplete: vi.fn().mockResolvedValue(false),
   finalizeInstall: vi.fn().mockResolvedValue(undefined),
   abandonInstall: vi.fn().mockResolvedValue(undefined)
@@ -82,6 +91,11 @@ type HostScript = {
   /** Readiness content per version dir, keyed by the version in the path. */
   readiness: Record<string, string>
   log: string[]
+  preflightResult?: string
+  snapshotResult?: string
+  comparisonResult?: string
+  candidateStopResult?: string
+  readinessAtMs?: number
 }
 
 function scriptHost(script: HostScript): void {
@@ -91,20 +105,42 @@ function scriptHost(script: HostScript): void {
       return script.activationRecord
     }
     if (text.includes('.orcad-readiness') && text.startsWith('cat ')) {
+      if (script.readinessAtMs !== undefined && Date.now() < script.readinessAtMs) {
+        return ''
+      }
       const version = Object.keys(script.readiness).find((v) => text.includes(v))
       return version ? script.readiness[version] : ''
     }
+    if (text.includes('--orcad-profile-state-preflight')) {
+      script.log.push('preflight')
+      return (
+        script.preflightResult ??
+        JSON.stringify({
+          type: 'orca_profile_state_ready',
+          nonce: text.match(/[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}/)?.[0],
+          runtime: 'bun',
+          runtimeVersion: '1.4.2',
+          sqliteVersion: '3.51.0',
+          artifactVersion: NEW_VERSION,
+          revision: 1
+        })
+      )
+    }
     if (text.includes('nohup')) {
       script.log.push(`launch:${text.includes(NEW_VERSION) ? NEW_VERSION : OLD_VERSION}`)
       return '9999'
     }
     if (text.includes('kill -TERM')) {
       script.log.push(`stop:${text.includes(NEW_VERSION) ? NEW_VERSION : OLD_VERSION}`)
-      return 'STOPPED'
+      return text.includes(NEW_VERSION) ? (script.candidateStopResult ?? 'STOPPED') : 'STOPPED'
     }
     if (text.includes('tar -C') && text.includes('-cf')) {
       script.log.push('snapshot')
-      return 'CAPTURED'
+      return script.snapshotResult ?? 'CAPTURED'
+    }
+    if (text.includes('verdict=UNCHANGED')) {
+      script.log.push('compare-state')
+      return script.comparisonResult ?? 'UNCHANGED'
     }
     return ''
   })
@@ -132,7 +168,105 @@ const ACTIVE_OLD = JSON.stringify(
   withActivatedVersion(emptyOrcadActivationRecord(), OLD_VERSION, null, new Date(0))
 )
 
+describe('orcad install lock ownership', () => {
+  const remoteDir = `/home/u/.orca-remote/orcad-${NEW_VERSION}`
+  const install = (signal?: AbortSignal) =>
+    installOrcadBundle(
+      { ...options({ signal }), localOrcadDir: '/local/out/orcad' },
+      NEW_VERSION,
+      remoteDir
+    )
+
+  beforeEach(() => {
+    vi.clearAllMocks()
+    vi.mocked(isRemoteInstallComplete).mockReset().mockResolvedValue(false)
+  })
+
+  it('leaves another install lock alone when the initial probe is complete', async () => {
+    vi.mocked(isRemoteInstallComplete).mockResolvedValueOnce(true)
+    await install()
+    expect(acquireInstallLock).not.toHaveBeenCalled()
+    expect(abandonInstall).not.toHaveBeenCalled()
+    expect(uploadRelayDirectory).not.toHaveBeenCalled()
+  })
+
+  it('releases its lock when another installer completed while acquisition waited', async () => {
+    vi.mocked(isRemoteInstallComplete).mockResolvedValueOnce(false).mockResolvedValueOnce(true)
+    await install()
+    expect(acquireInstallLock).toHaveBeenCalledOnce()
+    expect(abandonInstall).toHaveBeenCalledOnce()
+    expect(abandonInstall).toHaveBeenCalledWith(expect.anything(), remoteDir, options().host)
+    expect(uploadRelayDirectory).not.toHaveBeenCalled()
+    expect(finalizeInstall).not.toHaveBeenCalled()
+  })
+
+  it('publishes a complete install before releasing its lock once', async () => {
+    await install()
+    expect(uploadRelayDirectory).toHaveBeenCalledOnce()
+    expect(finalizeInstall).toHaveBeenCalledWith(expect.anything(), remoteDir, options().host, {
+      signal: undefined,
+      releaseLock: false
+    })
+    expect(abandonInstall).toHaveBeenCalledOnce()
+    expect(vi.mocked(finalizeInstall).mock.invocationCallOrder[0]).toBeLessThan(
+      vi.mocked(abandonInstall).mock.invocationCallOrder[0]
+    )
+  })
+
+  it('releases a failed upload without publishing it or replacing its error', async () => {
+    const error = new Error('upload interrupted')
+    vi.mocked(uploadRelayDirectory).mockRejectedValueOnce(error)
+    await expect(install()).rejects.toBe(error)
+    expect(abandonInstall).toHaveBeenCalledOnce()
+    expect(finalizeInstall).not.toHaveBeenCalled()
+  })
+
+  it('releases its lock without reusing an aborted operation signal', async () => {
+    const controller = new AbortController()
+    const error = new Error('deployment canceled')
+    vi.mocked(uploadRelayDirectory).mockImplementationOnce(async () => {
+      controller.abort(error)
+      controller.signal.throwIfAborted()
+    })
+    await expect(install(controller.signal)).rejects.toBe(error)
+    expect(abandonInstall).toHaveBeenCalledOnce()
+    expect(abandonInstall).toHaveBeenCalledWith(expect.anything(), remoteDir, options().host)
+    expect(finalizeInstall).not.toHaveBeenCalled()
+  })
+
+  it('does not release a lock when acquisition failed', async () => {
+    const error = new Error('lock held by another client')
+    vi.mocked(acquireInstallLock).mockRejectedValueOnce(error)
+    await expect(install()).rejects.toBe(error)
+    expect(abandonInstall).not.toHaveBeenCalled()
+    expect(uploadRelayDirectory).not.toHaveBeenCalled()
+  })
+})
+
 describe('deployOrcad', () => {
+  it.each(['', '{"type":"orca_profile_state_ready","revision":0}'])(
+    'leaves the incumbent and shared state alone when preflight returns %j',
+    async (preflightResult) => {
+      const script: HostScript = {
+        activationRecord: ACTIVE_OLD,
+        readiness: { [NEW_VERSION]: readyLine({}) },
+        log: [],
+        preflightResult
+      }
+      scriptHost(script)
+      expect(await deployOrcad(options())).toMatchObject({
+        outcome: 'installed-not-activated',
+        code: 'orcad_candidate_preflight_failed'
+      })
+      expect(script.log).toEqual(['preflight'])
+      expect(
+        vi
+          .mocked(writeRelayFile)
+          .mock.calls.some(([, , path]) => path.includes('orcad-active.json'))
+      ).toBe(false)
+    }
+  )
+
   beforeEach(() => {
     vi.clearAllMocks()
   })
@@ -166,6 +300,7 @@ describe('deployOrcad', () => {
       )
       expect(chmod).toBeGreaterThanOrEqual(0)
       expect(mockExec.mock.calls[chmod]?.[1]).toContain(`/ripgrep/${platform}/rg'`)
+      expect(mockExec.mock.calls[chmod]?.[1]).toContain("/bun-runtime'")
       expect(vi.mocked(uploadRelayDirectory).mock.invocationCallOrder[0]).toBeLessThan(
         mockExec.mock.invocationCallOrder[chmod]
       )
@@ -177,13 +312,17 @@ describe('deployOrcad', () => {
 
   it('does not run chmod on a Windows remote', async () => {
     scriptHost({ activationRecord: '', readiness: {}, log: [] })
-    await deployOrcad(
-      options({
+    await installOrcadBundle(
+      {
+        conn: options().conn,
         host: getRemoteHostPlatform('win32-x64'),
-        remoteHome: 'C:/Users/u',
-        census: { liveSessions: 1, startedSinceActivation: 0 }
-      })
+        localOrcadDir: '/local/out/orcad'
+      },
+      NEW_VERSION,
+      `C:/Users/u/.orca-remote/orcad-${NEW_VERSION}`
     )
+    expect(uploadRelayDirectory).toHaveBeenCalledOnce()
+    expect(finalizeInstall).toHaveBeenCalledOnce()
     expect(mockExec.mock.calls.some(([, command]) => String(command).startsWith('chmod '))).toBe(
       false
     )
@@ -200,6 +339,73 @@ describe('deployOrcad', () => {
     expect(vi.mocked(finalizeInstall)).not.toHaveBeenCalled()
   })
 
+  it.skipIf(process.platform === 'win32').each([undefined, 'linux-x64', 'linux-musl-x64'])(
+    'restores uploaded executable modes with optional browser %s',
+    async (browserTarget) => {
+      const directory = mkdtempSync(join(tmpdir(), 'orcad-install-modes-'))
+      const binaries = ['bun-runtime', 'ripgrep/linux-x64/rg']
+      if (browserTarget) {
+        binaries.push(`agent-browser-${browserTarget}`)
+      }
+      try {
+        for (const filename of binaries) {
+          const path = join(directory, filename)
+          mkdirSync(dirname(path), { recursive: true })
+          writeFileSync(path, 'uploaded executable')
+          chmodSync(path, 0o644)
+        }
+        mockExec.mockImplementation(async (_conn, command) => {
+          const result = await runProcess({ program: '/bin/sh', args: ['-c', command] })
+          if (result.code !== 0) {
+            throw new Error(result.stderr)
+          }
+          return result.stdout
+        })
+        await installOrcadBundle(
+          {
+            conn: options().conn,
+            host: getRemoteHostPlatform('linux-x64'),
+            localOrcadDir: directory
+          },
+          NEW_VERSION,
+          directory
+        )
+        expect(finalizeInstall).toHaveBeenCalledOnce()
+        for (const filename of binaries) {
+          expect(statSync(join(directory, filename)).mode & 0o777).toBe(0o755)
+        }
+      } finally {
+        mockExec.mockReset()
+        rmSync(directory, { recursive: true, force: true })
+      }
+    }
+  )
+
+  it('allows startup time after a slow bundled preflight', async () => {
+    let elapsedMs = 0
+    const clock = vi.spyOn(Date, 'now').mockImplementation(() => elapsedMs)
+    scriptHost({
+      activationRecord: '',
+      readiness: { [NEW_VERSION]: readyLine({}) },
+      readinessAtMs: 100_000,
+      log: []
+    })
+    try {
+      const result = await deployOrcad(
+        options({
+          readinessTimeoutMs: undefined,
+          sleep: async () => {
+            elapsedMs += 50_000
+          }
+        })
+      )
+      expect(result.outcome).toBe('installed-and-activated')
+      expect(elapsedMs).toBe(100_000)
+    } finally {
+      clock.mockRestore()
+    }
+  })
+
   it('activates a healthy candidate and records the outgoing version as the rollback target', async () => {
     const script: HostScript = {
       activationRecord: ACTIVE_OLD,
@@ -218,7 +424,7 @@ describe('deployOrcad', () => {
     })
   })
 
-  it('snapshots the shared data root before the candidate ever runs', async () => {
+  it('stops the incumbent before snapshotting, so SQLite WAL files are quiescent', async () => {
     const script: HostScript = {
       activationRecord: ACTIVE_OLD,
       readiness: { [NEW_VERSION]: readyLine({}) },
@@ -228,6 +434,7 @@ describe('deployOrcad', () => {
     await deployOrcad(options())
     expect(script.log.indexOf('snapshot')).toBeGreaterThan(-1)
     expect(script.log.indexOf('snapshot')).toBeLessThan(script.log.indexOf(`launch:${NEW_VERSION}`))
+    expect(script.log.indexOf(`stop:${OLD_VERSION}`)).toBeLessThan(script.log.indexOf('snapshot'))
   })
 
   it('installs but does not activate when terminals are running', async () => {
@@ -278,10 +485,12 @@ describe('deployOrcad', () => {
     const result = await deployOrcad(options())
     expect(result).toMatchObject({ outcome: 'installed-not-activated' })
     expect(script.log).toEqual([
-      'snapshot',
+      'preflight',
       `stop:${OLD_VERSION}`,
+      'snapshot',
       `launch:${NEW_VERSION}`,
       `stop:${NEW_VERSION}`,
+      'compare-state',
       `launch:${OLD_VERSION}`
     ])
     expect(result.outcome === 'installed-not-activated' && result.reason).toContain(
@@ -289,6 +498,81 @@ describe('deployOrcad', () => {
     )
   })
 
+  it.each(['CHANGED', 'UNKNOWN', ''])(
+    'preserves rejected candidate state when comparison is %s',
+    async (comparisonResult) => {
+      const script: HostScript = {
+        activationRecord: ACTIVE_OLD,
+        readiness: { [NEW_VERSION]: readyLine({ selfTestOk: false }) },
+        log: [],
+        comparisonResult
+      }
+      scriptHost(script)
+
+      const result = await deployOrcad(options())
+
+      expect(result).toMatchObject({ outcome: 'installed-not-activated' })
+      expect(script.log).toEqual([
+        'preflight',
+        `stop:${OLD_VERSION}`,
+        'snapshot',
+        `launch:${NEW_VERSION}`,
+        `stop:${NEW_VERSION}`,
+        'compare-state'
+      ])
+      expect(result.outcome === 'installed-not-activated' && result.reason).toContain(
+        'recovery requires a fresh host terminal census'
+      )
+      expect(result.outcome === 'installed-not-activated' && result.reason).toContain(
+        '/home/u/.orca-remote/orcad-state-snapshots/'
+      )
+      expect(mockExec.mock.calls.some(([, command]) => command.includes('echo RESTORED'))).toBe(
+        false
+      )
+    }
+  )
+
+  it('restarts the incumbent when a quiescent snapshot cannot be captured', async () => {
+    const script: HostScript = {
+      activationRecord: ACTIVE_OLD,
+      readiness: { [OLD_VERSION]: readyLine({}) },
+      log: [],
+      snapshotResult: 'tar: write failed'
+    }
+    scriptHost(script)
+
+    await expect(deployOrcad(options())).rejects.toThrow('incumbent was stopped')
+    expect(script.log).toEqual([
+      'preflight',
+      `stop:${OLD_VERSION}`,
+      'snapshot',
+      `launch:${OLD_VERSION}`
+    ])
+  })
+
+  it.each(['NO_PID', 'STILL_RUNNING', 'SIGNAL_FAILED', ''])(
+    'does not inspect or replace state without confirmed candidate exit: %s',
+    async (candidateStopResult) => {
+      const script: HostScript = {
+        activationRecord: ACTIVE_OLD,
+        readiness: { [NEW_VERSION]: readyLine({ selfTestOk: false }) },
+        log: [],
+        candidateStopResult
+      }
+      scriptHost(script)
+
+      await deployOrcad(options())
+
+      expect(script.log).toEqual([
+        'preflight',
+        `stop:${OLD_VERSION}`,
+        'snapshot',
+        `launch:${NEW_VERSION}`,
+        `stop:${NEW_VERSION}`
+      ])
+    }
+  )
+
   it('refuses to activate when a different build answered the port', async () => {
     const script: HostScript = {
       activationRecord: ACTIVE_OLD,
diff --git a/src/main/ssh/orcad-remote-deploy.ts b/src/main/ssh/orcad-remote-deploy.ts
index 88a4d923c847..f82b4014d57f 100644
--- a/src/main/ssh/orcad-remote-deploy.ts
+++ b/src/main/ssh/orcad-remote-deploy.ts
@@ -1,30 +1,14 @@
 /**
- * Installing orcad on a host and, only if it proves itself, making it the active one.
- *
- * The install half is the relay's transaction, parameterized: the same per-version lock,
- * staged SFTP write, `.install-complete` sentinel and stale-lock recovery, under
- * `orcad-<version>/` instead of `relay-<version>/`. That is what §02 marks reusable.
- *
- * The activation half has no relay equivalent, because the relay has no notion of a version
- * being *selected*. Bytes landing in a versioned directory neither picks a version nor rolls
- * one back; the activation record does, and it is written only after the candidate publishes
- * a health payload that survives `evaluateOrcadActivation`. A rejected candidate leaves the
- * previous version running and its own bytes on disk — nothing is lost, and a retry costs no
- * upload.
+ * Activate installed bytes only after the candidate proves healthy. A rejected candidate
+ * allows restarting the incumbent only when profile state is provably unchanged; otherwise
+ * preserve current state and the prelaunch snapshot for explicit recovery.
  */
 import type { SshConnection } from './ssh-connection'
+import { ORCAD_STARTUP_READINESS_TIMEOUT_MS } from '../../shared/orcad-profile-preflight'
 import { execCommand } from './ssh-relay-deploy-helpers'
-import { shellEscape } from './ssh-connection-utils'
 import { ORCAD_INSTALL_MODEL } from './remote-install-model'
-import { acquireInstallLock } from './ssh-relay-install-lock'
-import { uploadRelayDirectory, writeRelayFile } from './ssh-relay-install-transfers'
-import {
-  abandonInstall,
-  computeRemoteInstallDir,
-  finalizeInstall,
-  isRemoteInstallComplete,
-  readLocalFullVersion
-} from './ssh-relay-versioned-install'
+import { writeRelayFile } from './ssh-relay-install-transfers'
+import { computeRemoteInstallDir, readLocalFullVersion } from './ssh-relay-versioned-install'
 import { RELAY_REMOTE_DIR } from './relay-protocol'
 import {
   ORCAD_STATE_SNAPSHOT_DIR,
@@ -40,9 +24,9 @@ import {
   ORCAD_LOG_FILENAME,
   orcadLaunchCommand,
   parseOrcadReadinessOutput,
-  readOrcadReadinessCommand,
-  type OrcadLaunchSpec
+  readOrcadReadinessCommand
 } from './orcad-remote-launch'
+import { rejectedOrcadStateRecoveryRefusal, stopOutgoingOrcad } from './orcad-remote-deploy-stop'
 import {
   captureOrcadStateSnapshotCommand,
   orcadSnapshotDirName,
@@ -55,13 +39,18 @@ import {
 } from './orcad-remote-process-control'
 import { joinRemotePath, type RemoteHostPlatform } from './ssh-remote-platform'
 import { computeLocalOrcadBuildHash } from './orcad-local-build-hash'
+import { preflightInstalledOrcad } from './orcad-remote-preflight'
+import { assertPosixOrcadHost } from './orcad-remote-host-support'
+import { installOrcadBundle } from './orcad-remote-install'
+import { materializeOrcadArtifact } from './orcad-artifact-materializer'
+import { resolveOrcadDeploymentTarget } from './orcad-deployment-target'
 
 export type OrcadDeployOptions = {
   conn: SshConnection
   host: RemoteHostPlatform
   remoteHome: string
-  /** Local `out/orcad`, containing the artifacts and the `.version` marker. */
-  localOrcadDir: string
+  /** An already assembled bundle; otherwise materialize the packaged template for this host. */
+  localOrcadDir?: string
   nodePath: string
   userDataDir: string
   bindHost: string
@@ -84,18 +73,13 @@ export type OrcadDeployResult =
   | { outcome: 'already-active'; fullVersion: string }
   | { outcome: 'installed-not-activated'; fullVersion: string; code: string; reason: string }
 
-const DEFAULT_READINESS_TIMEOUT_MS = 90_000
 const READINESS_POLL_MS = 500
 const STOP_WAIT_SECONDS = 20
 
-function exec(
-  options: OrcadDeployOptions,
-  command: string,
-  signal = options.signal
-): Promise<string> {
+function exec(options: OrcadDeployOptions, command: string): Promise<string> {
   return execCommand(options.conn, command, {
     wrapCommand: options.host.commandDialect !== 'powershell',
-    signal
+    signal: options.signal
   })
 }
 
@@ -103,59 +87,14 @@ function baseDir(options: OrcadDeployOptions): string {
   return joinRemotePath(options.host, options.remoteHome, RELAY_REMOTE_DIR)
 }
 
-/** Install the bytes under `orcad-<version>/`, using the relay's install transaction. */
-async function installOrcadBundle(
-  options: OrcadDeployOptions,
-  fullVersion: string,
-  remoteDir: string
-): Promise<void> {
-  if (
-    await isRemoteInstallComplete(options.conn, ORCAD_INSTALL_MODEL, remoteDir, options.host, {
-      signal: options.signal
-    })
-  ) {
-    return
-  }
-  await acquireInstallLock(options.conn, remoteDir, options.host, { signal: options.signal })
-  try {
-    // Re-probe under the lock: a sibling deploy may have finished while we waited.
-    if (
-      await isRemoteInstallComplete(options.conn, ORCAD_INSTALL_MODEL, remoteDir, options.host, {
-        signal: options.signal
-      })
-    ) {
-      return
-    }
-    await uploadRelayDirectory(options.conn, options.localOrcadDir, remoteDir, options.host, {
-      signal: options.signal
-    })
-    const { host } = options
-    if (host.os !== 'win32') {
-      // SFTP creates uploaded files with 0644 even when the source binary is executable.
-      const binaryPath = joinRemotePath(host, remoteDir, 'ripgrep', host.relayPlatform, 'rg')
-      await exec(options, `chmod 755 ${shellEscape(binaryPath)}`)
-    }
-    await writeRelayFile(
-      options.conn,
-      options.host,
-      joinRemotePath(options.host, remoteDir, ORCAD_INSTALL_MODEL.versionFilename),
-      fullVersion,
-      { signal: options.signal }
-    )
-    await finalizeInstall(options.conn, remoteDir, options.host, { signal: options.signal })
-  } catch (error) {
-    // Leave a recoverable partial rather than a dir that probes complete.
-    await abandonInstall(options.conn, remoteDir, options.host)
-    throw error
-  }
-}
-
 async function captureSnapshot(
   options: OrcadDeployOptions,
   fullVersion: string,
   outgoingVersion: string | null,
   takenAt: Date
 ): Promise<OrcadStateSnapshot | null> {
+  // The caller has already stopped the outgoing runtime. This is required once profile state
+  // includes SQLite: a tar of a live WAL, main database, and SHM file is not a SQLite backup.
   const dirName = orcadSnapshotDirName(fullVersion, takenAt.getTime())
   const snapshotDir = joinRemotePath(
     options.host,
@@ -176,9 +115,8 @@ async function captureSnapshot(
         'way back. Refusing to activate.'
     )
   }
+  // Empty profiles need no rollback snapshot.
   if (capture === 'empty') {
-    // Nothing on the host to lose: a first deployment. Rollback will correctly report that
-    // it has no snapshot, rather than restoring an archive of nothing over a populated root.
     return null
   }
   return {
@@ -191,16 +129,20 @@ async function captureSnapshot(
 
 async function launchAndAwaitReadiness(
   options: OrcadDeployOptions,
-  spec: OrcadLaunchSpec
+  remoteInstallDir: string,
+  fullVersion: string
 ): Promise<ReturnType<typeof parseOrcadReadinessOutput>> {
-  await exec(options, orcadLaunchCommand(options.host, spec))
-  const deadline = Date.now() + (options.readinessTimeoutMs ?? DEFAULT_READINESS_TIMEOUT_MS)
+  await exec(
+    options,
+    orcadLaunchCommand(options.host, { ...options, remoteInstallDir, fullVersion })
+  )
+  const deadline = Date.now() + (options.readinessTimeoutMs ?? ORCAD_STARTUP_READINESS_TIMEOUT_MS)
   const sleep = options.sleep ?? ((ms: number) => new Promise((r) => setTimeout(r, ms)))
   let last = parseOrcadReadinessOutput('')
   while (Date.now() < deadline) {
     options.signal?.throwIfAborted()
     last = parseOrcadReadinessOutput(
-      await exec(options, readOrcadReadinessCommand(options.host, spec.remoteInstallDir))
+      await exec(options, readOrcadReadinessCommand(options.host, remoteInstallDir))
     )
     if (last.state !== 'pending') {
       return last
@@ -210,58 +152,61 @@ async function launchAndAwaitReadiness(
   return last
 }
 
-/**
- * Put the previous version back after a rejected candidate.
- *
- * Why this exists at all: activating means swapping which process owns the data root and the
- * port, so the incumbent has to stop before the candidate can start. A gate that rejected
- * and returned would leave the host with nothing running — a careful deploy causing the
- * outage it was being careful about. The returned sentence goes into the caller's reason so
- * the operator learns the host's actual state, not just why the candidate failed.
- */
+/** Restart the incumbent only when the candidate left shared state unchanged. */
 async function restoreIncumbent(
   options: OrcadDeployOptions,
   record: OrcadActivationRecord,
-  candidateDir: string
+  candidateDir?: string,
+  snapshot?: OrcadStateSnapshot | null
 ): Promise<string> {
-  const stopped = parseOrcadStopOutcome(
-    await exec(
-      options,
-      stopOrcadCommand(options.host, candidateDir, { waitSeconds: STOP_WAIT_SECONDS })
+  if (candidateDir) {
+    const stopped = parseOrcadStopOutcome(
+      await exec(
+        options,
+        stopOrcadCommand(options.host, candidateDir, {
+          waitSeconds: STOP_WAIT_SECONDS,
+          justLaunched: true
+        })
+      )
     )
-  )
-  if (!orcadStopFreedTheHost(stopped)) {
-    return `The candidate itself did not stop (${stopped}); the host may still be serving the rejected build.`
+    if (!orcadStopFreedTheHost(stopped)) {
+      return `The candidate itself did not stop (${stopped}); the host may still be serving the rejected build.`
+    }
   }
   if (!record.active) {
     return 'No previous version was active, so this host is now serving nothing.'
   }
+  if (candidateDir) {
+    const snapshotDir = snapshot
+      ? joinRemotePath(options.host, baseDir(options), ORCAD_STATE_SNAPSHOT_DIR, snapshot.dirName)
+      : undefined
+    const refusal = await rejectedOrcadStateRecoveryRefusal(options, record.active, snapshotDir)
+    if (refusal) {
+      return refusal
+    }
+  }
   const incumbentDir = computeRemoteInstallDir(
     ORCAD_INSTALL_MODEL,
     options.remoteHome,
     record.active
   )
-  const parsed = await launchAndAwaitReadiness(options, {
-    remoteInstallDir: incumbentDir,
-    nodePath: options.nodePath,
-    fullVersion: record.active,
-    userDataDir: options.userDataDir,
-    bindHost: options.bindHost,
-    port: options.port
-  })
+  const parsed = await launchAndAwaitReadiness(options, incumbentDir, record.active)
   return parsed.state === 'ready'
     ? `orcad ${record.active} was restarted and is serving again.`
     : `orcad ${record.active} was relaunched but has not published readiness; this host may be down.`
 }
 
-/**
- * Install, then activate only on a green cross-process health verdict.
- *
- * Every early return past the install leaves the bytes on disk and the previous version
- * serving, which is why they all report `installed-not-activated` rather than throwing: a
- * refusal to switch is a successful outcome of a deploy that was asked to be careful.
- */
-export async function deployOrcad(options: OrcadDeployOptions): Promise<OrcadDeployResult> {
+/** Activate on a healthy verdict; retain changed candidate state for explicit recovery. */
+export async function deployOrcad(input: OrcadDeployOptions): Promise<OrcadDeployResult> {
+  assertPosixOrcadHost(input.host)
+  const options = {
+    ...input,
+    localOrcadDir:
+      input.localOrcadDir ??
+      (await materializeOrcadArtifact(await resolveOrcadDeploymentTarget(input), {
+        signal: input.signal
+      }))
+  }
   const now = options.now ?? ((): Date => new Date())
   const fullVersion = readLocalFullVersion(options.localOrcadDir)
   const remoteDir = computeRemoteInstallDir(ORCAD_INSTALL_MODEL, options.remoteHome, fullVersion)
@@ -287,52 +232,67 @@ export async function deployOrcad(options: OrcadDeployOptions): Promise<OrcadDep
     }
   }
 
-  const snapshot = record.active
-    ? await captureSnapshot(options, fullVersion, record.active, now())
-    : null
+  try {
+    await preflightInstalledOrcad({
+      ...options,
+      remoteInstallDir: remoteDir,
+      fullVersion
+    })
+  } catch (error) {
+    options.signal?.throwIfAborted()
+    return {
+      outcome: 'installed-not-activated',
+      fullVersion,
+      code: 'orcad_candidate_preflight_failed',
+      reason: `Candidate profile preflight failed; the incumbent was not stopped: ${
+        error instanceof Error ? error.message : String(error)
+      }`
+    }
+  }
 
   if (record.active) {
-    const outgoingDir = computeRemoteInstallDir(
-      ORCAD_INSTALL_MODEL,
-      options.remoteHome,
-      record.active
-    )
-    const stopped = parseOrcadStopOutcome(
-      await exec(
-        options,
-        stopOrcadCommand(options.host, outgoingDir, {
-          waitSeconds: STOP_WAIT_SECONDS
-        })
-      )
-    )
+    const stopped = await stopOutgoingOrcad(options, record.active)
     if (!orcadStopFreedTheHost(stopped)) {
       return {
         outcome: 'installed-not-activated',
         fullVersion,
         code: 'orcad_outgoing_stop_incomplete',
         reason:
-          `orcad ${record.active} did not exit within ${STOP_WAIT_SECONDS}s of SIGTERM ` +
-          `(${stopped}). It is still holding the data root and the port, so the candidate ` +
-          'cannot start. Not escalating to SIGKILL: that skips the shutdown that releases ' +
-          'the instance lock, and the successor would then refuse to start.'
+          `Could not verify that orcad ${record.active} exited (${stopped}). ` +
+          'No snapshot was taken and the candidate was not started. Orca requires matching ' +
+          'runtime readiness before signaling an incumbent and confirmed exit before snapshotting.'
       }
     }
   }
 
-  const parsed = await launchAndAwaitReadiness(options, {
-    remoteInstallDir: remoteDir,
-    nodePath: options.nodePath,
-    fullVersion,
-    userDataDir: options.userDataDir,
-    bindHost: options.bindHost,
-    port: options.port
-  })
+  // A live SQLite WAL is not a backup boundary: tar can observe the main file, WAL and SHM
+  // at different points and restore a set SQLite cannot recover. Stop the incumbent first so
+  // its final durable flush has completed before capturing the pre-activation state.
+  let snapshot: OrcadStateSnapshot | null = null
+  if (record.active) {
+    try {
+      snapshot = await captureSnapshot(options, fullVersion, record.active, now())
+    } catch (error) {
+      const restored = await restoreIncumbent(options, record).catch(
+        (restartError: unknown) =>
+          `The incumbent could not be restarted: ${
+            restartError instanceof Error ? restartError.message : String(restartError)
+          }`
+      )
+      throw new Error(
+        `${error instanceof Error ? error.message : String(error)} The incumbent was stopped ` +
+          `before snapshotting; ${restored}`
+      )
+    }
+  }
+
+  const parsed = await launchAndAwaitReadiness(options, remoteDir, fullVersion)
   const verdict = evaluateOrcadActivation(parsed.state === 'ready' ? parsed.readiness : null, {
     buildHash: computeLocalOrcadBuildHash(options.localOrcadDir),
     fullVersion
   })
   if (verdict.decision === 'reject') {
-    const restored = await restoreIncumbent(options, record, remoteDir)
+    const restored = await restoreIncumbent(options, record, remoteDir, snapshot)
     return {
       outcome: 'installed-not-activated',
       fullVersion,
diff --git a/src/main/ssh/orcad-remote-gc.test.ts b/src/main/ssh/orcad-remote-gc.test.ts
index b25e3bb6b6d1..9d365c631ef4 100644
--- a/src/main/ssh/orcad-remote-gc.test.ts
+++ b/src/main/ssh/orcad-remote-gc.test.ts
@@ -35,7 +35,7 @@ const mockExec = vi.mocked(execCommand)
  */
 function scriptHost(options: {
   listing: string[]
-  liveness?: Record<string, 'LIVE' | 'DEAD' | 'UNKNOWN'>
+  liveness?: Record<string, 'LIVE' | 'DEAD' | 'UNKNOWN' | Error>
   removed: string[]
 }): void {
   mockExec.mockImplementation(async (_conn, command: string) => {
@@ -50,7 +50,11 @@ function scriptHost(options: {
     }
     if (command.includes('.orcad-pid')) {
       const dir = Object.keys(options.liveness ?? {}).find((name) => command.includes(name))
-      return dir ? (options.liveness?.[dir] ?? 'DEAD') : 'DEAD'
+      const result = dir ? (options.liveness?.[dir] ?? 'DEAD') : 'DEAD'
+      if (result instanceof Error) {
+        throw result
+      }
+      return result
     }
     if (command.startsWith('mv ')) {
       const match = command.match(/'([^']*)'/)
@@ -152,4 +156,49 @@ describe('orcad GC', () => {
     })
     expect(removed).toEqual(['orcad-0.0.9+dead'])
   })
+
+  it('stops before later versions when liveness probe termination is unconfirmed', async () => {
+    const removed: string[] = []
+    const error = Object.assign(new Error('Liveness probe termination is unconfirmed'), {
+      sshChannelCloseConfirmed: false
+    })
+    scriptHost({
+      listing: ['orcad-0.1.0+bb0', 'orcad-0.0.9+dead'],
+      liveness: { 'orcad-0.1.0+bb0': error },
+      removed
+    })
+
+    await expect(
+      gcOldOrcadVersions({
+        conn,
+        host,
+        remoteHome: '/home/u',
+        currentDirAbsPath: '/home/u/.orca-remote/orcad-0.3.0+cc0',
+        record: emptyOrcadActivationRecord()
+      })
+    ).rejects.toBe(error)
+
+    expect(removed).toEqual([])
+    expect(mockExec).toHaveBeenCalledTimes(4)
+    expect(mockExec.mock.calls.at(-1)?.[1]).toContain('.orcad-pid')
+  })
+
+  it('keeps a version after an ordinary probe failure and checks later versions', async () => {
+    const removed: string[] = []
+    scriptHost({
+      listing: ['orcad-0.1.0+bb0', 'orcad-0.0.9+dead'],
+      liveness: { 'orcad-0.1.0+bb0': new Error('Probe failed') },
+      removed
+    })
+
+    await gcOldOrcadVersions({
+      conn,
+      host,
+      remoteHome: '/home/u',
+      currentDirAbsPath: '/home/u/.orca-remote/orcad-0.3.0+cc0',
+      record: emptyOrcadActivationRecord()
+    })
+
+    expect(removed).toEqual(['orcad-0.0.9+dead'])
+  })
 })
diff --git a/src/main/ssh/orcad-remote-gc.ts b/src/main/ssh/orcad-remote-gc.ts
index a96b386fc1bb..09997dc40d35 100644
--- a/src/main/ssh/orcad-remote-gc.ts
+++ b/src/main/ssh/orcad-remote-gc.ts
@@ -15,6 +15,7 @@
  */
 import type { SshConnection } from './ssh-connection'
 import { execCommand } from './ssh-relay-deploy-helpers'
+import { isUnconfirmedSshCommandTermination } from './ssh-relay-exec-command'
 import { ORCAD_INSTALL_MODEL } from './remote-install-model'
 import { gcOldRemoteInstallVersions } from './ssh-relay-versioned-install'
 import { orcadGcPinnedDirNames, type OrcadActivationRecord } from './orcad-activation-record'
@@ -63,7 +64,10 @@ export async function gcOldOrcadVersions(options: OrcadGcOptions): Promise<void>
             }
           )
           return orcadLivenessBlocksGc(parseOrcadLiveness(probe))
-        } catch {
+        } catch (error) {
+          if (isUnconfirmedSshCommandTermination(error)) {
+            throw error
+          }
           // Why true: an unanswered probe is not evidence a tree is idle. Same rule the
           // relay's socket probe applies, for the same reason.
           return true
diff --git a/src/main/ssh/orcad-remote-host-support.ts b/src/main/ssh/orcad-remote-host-support.ts
index dfcb0f4b6e4d..7ef8548ecdfd 100644
--- a/src/main/ssh/orcad-remote-host-support.ts
+++ b/src/main/ssh/orcad-remote-host-support.ts
@@ -42,9 +42,17 @@ export const ORCAD_PID_FILENAME = '.orcad-pid'
  * A host without `ps` yields an empty state, which falls through to "alive" — the safe
  * direction for both callers.
  */
-export function posixProcessAliveShellFunction(): string {
+export function posixProcessAliveShellFunction(
+  options: { refuseUnverifiable?: boolean } = {}
+): string {
+  // Destructive lifecycle steps need explicit absence; permission failures cannot prove exit.
+  const probe = options.refuseUnverifiable
+    ? 'probe_error=$(LC_ALL=C kill -0 "$1" 2>&1) || { ' +
+      'case "$probe_error" in *"No such process"*) return 1;; ' +
+      '*) echo UNKNOWN; exit 0;; esac; }; '
+    : 'kill -0 "$1" 2>/dev/null || return 1; '
   return (
-    'orcad_alive() { kill -0 "$1" 2>/dev/null || return 1; ' +
+    `orcad_alive() { ${probe}` +
     'case "$(ps -o stat= -p "$1" 2>/dev/null)" in Z*) return 1;; esac; return 0; };'
   )
 }
diff --git a/src/main/ssh/orcad-remote-install-termination.test.ts b/src/main/ssh/orcad-remote-install-termination.test.ts
new file mode 100644
index 000000000000..fbc0dcb156c1
--- /dev/null
+++ b/src/main/ssh/orcad-remote-install-termination.test.ts
@@ -0,0 +1,158 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+vi.mock('./ssh-relay-deploy-helpers', () => ({ execCommand: vi.fn() }))
+vi.mock('./ssh-relay-install-lock', () => ({
+  acquireInstallLock: vi.fn().mockResolvedValue(undefined),
+  RELAY_INSTALL_LOCK_NAME: '.install-lock'
+}))
+vi.mock('./ssh-relay-install-transfers', () => ({
+  uploadRelayDirectory: vi.fn(),
+  writeRelayFile: vi.fn()
+}))
+
+import type { SshConnection } from './ssh-connection'
+import { execCommand } from './ssh-relay-deploy-helpers'
+import { uploadRelayDirectory, writeRelayFile } from './ssh-relay-install-transfers'
+import { installOrcadBundle } from './orcad-remote-install'
+import { getRemoteHostPlatform } from './ssh-remote-platform'
+import { decodeRemotePowerShellScript } from './ssh-remote-powershell'
+
+// oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: All connection operations are mocked.
+const conn = {} as SshConnection
+const mockExec = vi.mocked(execCommand)
+const mockUpload = vi.mocked(uploadRelayDirectory)
+const mockWrite = vi.mocked(writeRelayFile)
+const fullVersion = '0.2.0+abcdef123456'
+
+function issuedCommands(): string[] {
+  return mockExec.mock.calls.map(([, command]) => decodeRemotePowerShellScript(command))
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  mockExec.mockReset().mockResolvedValue('')
+  mockUpload.mockReset().mockResolvedValue(undefined)
+  mockWrite.mockReset().mockResolvedValue(undefined)
+})
+
+describe.each([
+  { platform: 'linux-x64' as const, remoteDir: '/home/u/.orca-remote/orcad-version' },
+  { platform: 'win32-x64' as const, remoteDir: 'C:/Users/u/.orca-remote/orcad-version' }
+])('orcad install termination on $platform', ({ platform, remoteDir }) => {
+  const host = getRemoteHostPlatform(platform)
+  const completionCommandNumber = host.os === 'win32' ? 3 : 4
+  const stages = [
+    { stage: 'locked recheck', commands: 2 },
+    { stage: 'upload', commands: 2 },
+    { stage: 'version write', commands: completionCommandNumber - 1 },
+    { stage: 'completion marker', commands: completionCommandNumber }
+  ]
+  const install = (signal?: AbortSignal): Promise<void> =>
+    installOrcadBundle(
+      { conn, host, localOrcadDir: '/local/orcad', signal },
+      fullVersion,
+      remoteDir
+    )
+
+  function failStage(stage: string, commandNumber: number, error: Error): void {
+    if (stage === 'upload') {
+      mockUpload.mockRejectedValueOnce(error)
+    } else if (stage === 'version write') {
+      mockWrite.mockRejectedValueOnce(error)
+    } else {
+      let calls = 0
+      mockExec.mockImplementation(async () => {
+        if (++calls === commandNumber) {
+          throw error
+        }
+        return ''
+      })
+    }
+  }
+
+  it.each(stages)('retains its lock after unconfirmed $stage', async ({ stage, commands }) => {
+    const error = Object.assign(new Error('SSH teardown not confirmed'), {
+      sshChannelCloseConfirmed: false
+    })
+    failStage(stage, commands, error)
+
+    await expect(install()).rejects.toBe(error)
+
+    expect(mockExec).toHaveBeenCalledTimes(commands)
+    expect(mockUpload).toHaveBeenCalledTimes(stage === 'locked recheck' ? 0 : 1)
+    expect(mockWrite).toHaveBeenCalledTimes(
+      stage === 'locked recheck' || stage === 'upload' ? 0 : 1
+    )
+    expect(issuedCommands().some((command) => command.includes('.install-lock'))).toBe(false)
+  })
+
+  it.each(stages)(
+    'still releases its lock after confirmed $stage failure',
+    async ({ stage, commands }) => {
+      const error = Object.assign(new Error('SSH command failed after closing'), {
+        sshChannelCloseConfirmed: true
+      })
+      failStage(stage, commands, error)
+
+      if (stage === 'locked recheck') {
+        await expect(install()).resolves.toBeUndefined()
+        expect(mockExec).toHaveBeenCalledTimes(completionCommandNumber + 1)
+      } else {
+        await expect(install()).rejects.toBe(error)
+        expect(mockExec).toHaveBeenCalledTimes(commands + 1)
+      }
+      expect(issuedCommands().at(-1)).toContain('.install-lock')
+    }
+  )
+
+  it('releases its lock once after successful completion', async () => {
+    await expect(install()).resolves.toBeUndefined()
+
+    expect(mockExec).toHaveBeenCalledTimes(completionCommandNumber + 1)
+    expect(issuedCommands()[completionCommandNumber - 1]).toContain('.install-complete')
+    expect(issuedCommands().at(-1)).toContain('.install-lock')
+    expect(mockUpload).toHaveBeenCalledOnce()
+    expect(mockWrite).toHaveBeenCalledOnce()
+  })
+
+  it('preserves an uncertain locked recheck when the caller also aborts', async () => {
+    const controller = new AbortController()
+    const error = Object.assign(new Error('SSH teardown not confirmed'), {
+      sshChannelCloseConfirmed: false
+    })
+    mockExec.mockResolvedValueOnce('').mockImplementationOnce(async () => {
+      controller.abort(new Error('deploy aborted'))
+      throw error
+    })
+
+    await expect(install(controller.signal)).rejects.toBe(error)
+    expect(mockExec).toHaveBeenCalledTimes(2)
+    expect(mockUpload).not.toHaveBeenCalled()
+  })
+
+  it('propagates an uncertain final lock release without retrying it', async () => {
+    const error = Object.assign(new Error('SSH teardown not confirmed'), {
+      sshChannelCloseConfirmed: false
+    })
+    failStage('release', completionCommandNumber + 1, error)
+
+    await expect(install()).rejects.toBe(error)
+    expect(mockExec).toHaveBeenCalledTimes(completionCommandNumber + 1)
+    expect(issuedCommands().at(-1)).toContain('.install-lock')
+  })
+
+  it.skipIf(host.os === 'win32')(
+    'retains its lock after unconfirmed executable permissions',
+    async () => {
+      const error = Object.assign(new Error('SSH teardown not confirmed'), {
+        sshChannelCloseConfirmed: false
+      })
+      failStage('permissions', 3, error)
+
+      await expect(install()).rejects.toBe(error)
+      expect(mockExec).toHaveBeenCalledTimes(3)
+      expect(issuedCommands().at(-1)).toContain('chmod')
+      expect(mockWrite).not.toHaveBeenCalled()
+    }
+  )
+})
diff --git a/src/main/ssh/orcad-remote-install.ts b/src/main/ssh/orcad-remote-install.ts
new file mode 100644
index 000000000000..9866f6666438
--- /dev/null
+++ b/src/main/ssh/orcad-remote-install.ts
@@ -0,0 +1,94 @@
+import { orcadBunRuntimeFilename } from '../../shared/orcad-artifacts'
+import { orcadAgentBrowserNativeName } from '../../shared/orcad-agent-browser-name'
+import { execCommand } from './ssh-relay-deploy-helpers'
+import { isUnconfirmedSshCommandTermination } from './ssh-relay-exec-command'
+import { shellEscape } from './ssh-connection-utils'
+import type { SshConnection } from './ssh-connection'
+import { joinRemotePath, type RemoteHostPlatform } from './ssh-remote-platform'
+import { ORCAD_INSTALL_MODEL } from './remote-install-model'
+import { acquireInstallLock } from './ssh-relay-install-lock'
+import { uploadRelayDirectory, writeRelayFile } from './ssh-relay-install-transfers'
+import {
+  abandonInstall,
+  finalizeInstall,
+  isRemoteInstallComplete
+} from './ssh-relay-versioned-install'
+
+/** Install the bytes under `orcad-<version>/`, using the relay's install transaction. */
+export async function installOrcadBundle(
+  options: {
+    conn: SshConnection
+    host: RemoteHostPlatform
+    localOrcadDir: string
+    signal?: AbortSignal
+  },
+  fullVersion: string,
+  remoteDir: string
+): Promise<void> {
+  if (
+    await isRemoteInstallComplete(options.conn, ORCAD_INSTALL_MODEL, remoteDir, options.host, {
+      signal: options.signal
+    })
+  ) {
+    return
+  }
+  await acquireInstallLock(options.conn, remoteDir, options.host, { signal: options.signal })
+  let preserveInstallLock = false
+  try {
+    // Re-probe under the lock: a sibling deploy may have finished while we waited.
+    if (
+      await isRemoteInstallComplete(options.conn, ORCAD_INSTALL_MODEL, remoteDir, options.host, {
+        signal: options.signal
+      })
+    ) {
+      return
+    }
+    await uploadRelayDirectory(options.conn, options.localOrcadDir, remoteDir, options.host, {
+      signal: options.signal
+    })
+    if (options.host.os !== 'win32') {
+      await execCommand(options.conn, executablePermissionsCommand(options.host, remoteDir), {
+        wrapCommand: options.host.commandDialect !== 'powershell',
+        signal: options.signal
+      })
+    }
+    await writeRelayFile(
+      options.conn,
+      options.host,
+      joinRemotePath(options.host, remoteDir, ORCAD_INSTALL_MODEL.versionFilename),
+      fullVersion,
+      { signal: options.signal }
+    )
+    await finalizeInstall(options.conn, remoteDir, options.host, {
+      signal: options.signal,
+      releaseLock: false
+    })
+  } catch (error) {
+    preserveInstallLock = isUnconfirmedSshCommandTermination(error)
+    throw error
+  } finally {
+    if (!preserveInstallLock) {
+      await abandonInstall(options.conn, remoteDir, options.host)
+    }
+  }
+}
+
+function executablePermissionsCommand(host: RemoteHostPlatform, directory: string): string {
+  const required = [
+    joinRemotePath(host, directory, orcadBunRuntimeFilename(host.os)),
+    joinRemotePath(host, directory, 'ripgrep', host.relayPlatform, 'rg')
+  ]
+  const browsers = new Set(
+    (['glibc', 'musl'] as const).map((libc) =>
+      shellEscape(
+        joinRemotePath(host, directory, orcadAgentBrowserNativeName(host.os, host.arch, libc))
+      )
+    )
+  )
+  // SFTP drops executable modes; missing optional browser binaries remain a supported install.
+  return (
+    `chmod 755 ${required.map(shellEscape).join(' ')} && ` +
+    `for executable in ${[...browsers].join(' ')}; do ` +
+    'if [ -f "$executable" ]; then chmod 755 "$executable" || exit $?; fi; done'
+  )
+}
diff --git a/src/main/ssh/orcad-remote-launch.test.ts b/src/main/ssh/orcad-remote-launch.test.ts
index 068ae588f657..0be9ddc76c1b 100644
--- a/src/main/ssh/orcad-remote-launch.test.ts
+++ b/src/main/ssh/orcad-remote-launch.test.ts
@@ -100,7 +100,10 @@ describe('liveness', () => {
 
 describe('stopping a running orcad', () => {
   it('sends SIGTERM and never SIGKILL', () => {
-    const command = stopOrcadCommand(posix, SPEC.remoteInstallDir, { waitSeconds: 20 })
+    const command = stopOrcadCommand(posix, SPEC.remoteInstallDir, {
+      waitSeconds: 20,
+      nodePath: SPEC.nodePath
+    })
     expect(command).toContain('kill -TERM')
     for (const kill of ['kill -9', 'kill -KILL', 'kill -SIGKILL', 'pkill']) {
       expect(command).not.toContain(kill)
@@ -110,9 +113,10 @@ describe('stopping a running orcad', () => {
   it.each([
     ['STOPPED', 'stopped', true],
     ['ALREADY_EXITED', 'already-exited', true],
-    ['NO_PID', 'no-pid', true],
+    ['NO_PID', 'no-pid', false],
     ['STILL_RUNNING', 'still-running', false],
     ['SIGNAL_FAILED', 'signal-failed', false],
+    ['UNKNOWN', 'unknown', false],
     ['', 'unknown', false]
   ])('parses %s and frees the host = %s', (output, expected, frees) => {
     expect(parseOrcadStopOutcome(output)).toBe(expected)
diff --git a/src/main/ssh/orcad-remote-launch.ts b/src/main/ssh/orcad-remote-launch.ts
index a76010ccbce5..d6c9640ad333 100644
--- a/src/main/ssh/orcad-remote-launch.ts
+++ b/src/main/ssh/orcad-remote-launch.ts
@@ -20,6 +20,7 @@ import {
   posixProcessAliveShellFunction
 } from './orcad-remote-host-support'
 import type { ServeReadiness } from '../server/serve-readiness'
+import { selectOrcadSlotRuntimeCommand } from './orcad-remote-runtime'
 
 /** Stdout of the launched candidate: exactly one `orca_server_ready` line, then nothing. */
 export const ORCAD_READINESS_FILENAME = '.orcad-readiness'
@@ -56,13 +57,15 @@ export function orcadLaunchCommand(host: RemoteHostPlatform, spec: OrcadLaunchSp
   const entry = shellEscape(joinRemotePath(host, spec.remoteInstallDir, 'orcad.js'))
   return [
     `cd ${dir} &&`,
+    `${selectOrcadSlotRuntimeCommand(host, spec.remoteInstallDir, spec.nodePath)} &&`,
     // Why truncate: a re-launch into a dir that already holds a previous readiness line would
     // otherwise let the deploy activate on the OLD process's health payload.
     `: > ${readiness} &&`,
     'umask 077 &&',
     `ORCA_VERSION=${shellEscape(spec.fullVersion)}`,
     `ORCA_USER_DATA=${shellEscape(spec.userDataDir)}`,
-    `nohup ${shellEscape(spec.nodePath)} ${entry}`,
+    // Keep $! equal to the runtime PID rather than a waiting shell's PID.
+    `exec nohup "$orcad_runtime" ${entry}`,
     `--json --bind ${shellEscape(spec.bindHost)} --port ${String(spec.port)}`,
     `> ${readiness} 2>> ${log} < /dev/null &`,
     `echo $! > ${pidFile} && cat ${pidFile}`
diff --git a/src/main/ssh/orcad-remote-preflight.ts b/src/main/ssh/orcad-remote-preflight.ts
new file mode 100644
index 000000000000..5bba386d4618
--- /dev/null
+++ b/src/main/ssh/orcad-remote-preflight.ts
@@ -0,0 +1,45 @@
+import { randomUUID } from 'node:crypto'
+import { ORCAD_BUN_VERSION } from '../../shared/orcad-bun-runtime'
+import { orcadBunRuntimeFilename } from '../../shared/orcad-artifacts'
+import {
+  ORCAD_PROFILE_PREFLIGHT_FLAG,
+  ORCAD_PROFILE_PREFLIGHT_TIMEOUT_MS,
+  parseOrcadProfilePreflight
+} from '../../shared/orcad-profile-preflight'
+import { assertPosixOrcadHost } from './orcad-remote-host-support'
+import { execCommand } from './ssh-relay-deploy-helpers'
+import { shellEscape } from './ssh-connection-utils'
+import { joinRemotePath, type RemoteHostPlatform } from './ssh-remote-platform'
+import type { SshConnection } from './ssh-connection'
+
+export function orcadProfilePreflightCommand(
+  host: RemoteHostPlatform,
+  directory: string,
+  nonce: string
+): string {
+  assertPosixOrcadHost(host)
+  return [
+    'ORCA_BACKGROUND_LAUNCH=1',
+    shellEscape(joinRemotePath(host, directory, orcadBunRuntimeFilename(host.os))),
+    shellEscape(joinRemotePath(host, directory, 'orcad.js')),
+    ORCAD_PROFILE_PREFLIGHT_FLAG,
+    shellEscape(nonce)
+  ].join(' ')
+}
+
+/** Failure leaves the incumbent and its data untouched, including an unconfirmed SSH exit. */
+export async function preflightInstalledOrcad(options: {
+  conn: SshConnection
+  host: RemoteHostPlatform
+  remoteInstallDir: string
+  fullVersion: string
+  signal?: AbortSignal
+}): Promise<void> {
+  const nonce = randomUUID()
+  const output = await execCommand(
+    options.conn,
+    orcadProfilePreflightCommand(options.host, options.remoteInstallDir, nonce),
+    { signal: options.signal, timeoutMs: ORCAD_PROFILE_PREFLIGHT_TIMEOUT_MS }
+  )
+  parseOrcadProfilePreflight(output, nonce, ORCAD_BUN_VERSION, options.fullVersion)
+}
diff --git a/src/main/ssh/orcad-remote-process-control.ts b/src/main/ssh/orcad-remote-process-control.ts
index 6a9038ea3d62..33fd877ba417 100644
--- a/src/main/ssh/orcad-remote-process-control.ts
+++ b/src/main/ssh/orcad-remote-process-control.ts
@@ -1,15 +1,13 @@
 /**
  * Stopping a running orcad on the host without taking its terminals with it.
  *
- * `SIGKILL` is absent on purpose. orcad's own escalation contract (`orcad-entry.ts`) is
- * SIGTERM, then a second SIGTERM meaning "your deadline elapsed, exit now"; a kill skips the
- * teardown that releases the instance lock and disconnects — rather than shuts down — the
- * terminal daemon. The daemon is detached and would survive a kill, but a stop that leaves
- * the lock file behind makes the successor refuse to start with
- * `orcad_data_root_shared`, so the update turns into an outage for no gain.
+ * SIGTERM starts one bounded durable shutdown. If it outlasts this wait, preserve the
+ * current owner; SIGKILL would skip flushing state and releasing the instance lock.
  */
 import { shellEscape } from './ssh-connection-utils'
 import { joinRemotePath, type RemoteHostPlatform } from './ssh-remote-platform'
+import { ORCAD_READINESS_FILENAME } from './orcad-remote-launch'
+import { selectOrcadSlotRuntimeCommand } from './orcad-remote-runtime'
 import {
   assertPosixOrcadHost as assertPosixHost,
   ORCAD_PID_FILENAME,
@@ -19,20 +17,38 @@ import {
 /**
  * Signal the orcad recorded in a version dir and wait for it to go.
  *
- * `escalate` sends the second SIGTERM orcad reads as "exit immediately". Callers use it only
- * after the first deadline elapses, so the two signals are never in the same command.
+ * `justLaunched` is only for this client's fixed exec launcher, including pre-readiness exits.
+ * Incumbents need their own readiness PID to corroborate the launcher's PID before any signal.
  */
 export function stopOrcadCommand(
   host: RemoteHostPlatform,
   remoteInstallDir: string,
-  options: { waitSeconds: number }
+  options: { waitSeconds: number } & (
+    | { justLaunched: true }
+    | { justLaunched?: false; nodePath: string }
+  )
 ): string {
   assertPosixHost(host)
   const pidFile = shellEscape(joinRemotePath(host, remoteInstallDir, ORCAD_PID_FILENAME))
+  const readiness = shellEscape(joinRemotePath(host, remoteInstallDir, ORCAD_READINESS_FILENAME))
+  const readRuntimePid = [
+    `const r = JSON.parse(require('node:fs').readFileSync(process.argv[1], 'utf8'));`,
+    `const pid = r?.type === 'orca_server_ready' ? r.health?.pid : null;`,
+    `if (!Number.isSafeInteger(pid) || pid <= 1) process.exit(1);`,
+    `process.stdout.write(String(pid));`
+  ].join(' ')
   return [
-    posixProcessAliveShellFunction(),
+    posixProcessAliveShellFunction({ refuseUnverifiable: true }),
     `pid=$(cat ${pidFile} 2>/dev/null);`,
     'case "$pid" in "" | *[!0-9]* ) echo NO_PID; exit 0;; esac;',
+    // Older launchers recorded a waiting shell, whose exit does not prove runtime exit.
+    ...(options.justLaunched
+      ? []
+      : [
+          `runtime_pid=$(${selectOrcadSlotRuntimeCommand(host, remoteInstallDir, options.nodePath)}; ` +
+            `"$orcad_runtime" -e ${shellEscape(readRuntimePid)} ${readiness} 2>/dev/null) || { echo UNKNOWN; exit 0; };`,
+          '[ "$pid" = "$runtime_pid" ] || { echo UNKNOWN; exit 0; };'
+        ]),
     'orcad_alive "$pid" || { echo ALREADY_EXITED; exit 0; };',
     'kill -TERM "$pid" 2>/dev/null || { echo SIGNAL_FAILED; exit 0; };',
     `i=0; while [ "$i" -lt ${options.waitSeconds} ]; do`,
@@ -69,5 +85,5 @@ export function parseOrcadStopOutcome(output: string): OrcadStopOutcome {
 
 /** True when the port is free and a successor may bind. */
 export function orcadStopFreedTheHost(outcome: OrcadStopOutcome): boolean {
-  return outcome === 'stopped' || outcome === 'already-exited' || outcome === 'no-pid'
+  return outcome === 'stopped' || outcome === 'already-exited'
 }
diff --git a/src/main/ssh/orcad-remote-rollback.test.ts b/src/main/ssh/orcad-remote-rollback.test.ts
index b9c74158a6d4..4d2f9150a75c 100644
--- a/src/main/ssh/orcad-remote-rollback.test.ts
+++ b/src/main/ssh/orcad-remote-rollback.test.ts
@@ -68,7 +68,10 @@ function readyLine(version: string): string {
   })
 }
 
-function scriptHost(log: string[], overrides: { restore?: string } = {}): void {
+function scriptHost(
+  log: string[],
+  overrides: { restore?: string; readinessAtMs?: number } = {}
+): void {
   mockExec.mockImplementation(async (_conn, command: string) => {
     const text = String(command)
     if (text.includes('state.tar') && text.includes('test -f') && !text.includes('tar -C')) {
@@ -90,6 +93,9 @@ function scriptHost(log: string[], overrides: { restore?: string } = {}): void {
       return '9999'
     }
     if (text.startsWith('cat ') && text.includes('.orcad-readiness')) {
+      if (overrides.readinessAtMs !== undefined && Date.now() < overrides.readinessAtMs) {
+        return ''
+      }
       return readyLine(TARGET)
     }
     return ''
@@ -130,6 +136,28 @@ describe('rollbackOrcad', () => {
     expect(log).toEqual([`stop:${ACTIVE}`, 'restore', `launch:${TARGET}`])
   })
 
+  it('allows rollback startup time after a slow bundled preflight', async () => {
+    let elapsedMs = 0
+    const clock = vi.spyOn(Date, 'now').mockImplementation(() => elapsedMs)
+    const log: string[] = []
+    scriptHost(log, { readinessAtMs: 100_000 })
+    try {
+      const result = await rollbackOrcad(
+        options({
+          readinessTimeoutMs: undefined,
+          sleep: async () => {
+            elapsedMs += 50_000
+          }
+        })
+      )
+      expect(result.outcome).toBe('rolled-back')
+      expect(elapsedMs).toBe(100_000)
+      expect(log).toEqual([`stop:${ACTIVE}`, 'restore', `launch:${TARGET}`])
+    } finally {
+      clock.mockRestore()
+    }
+  })
+
   it('refuses before touching anything when terminals started after activation', async () => {
     const log: string[] = []
     scriptHost(log)
diff --git a/src/main/ssh/orcad-remote-rollback.ts b/src/main/ssh/orcad-remote-rollback.ts
index 03df9479e4a3..412021c2f221 100644
--- a/src/main/ssh/orcad-remote-rollback.ts
+++ b/src/main/ssh/orcad-remote-rollback.ts
@@ -14,6 +14,7 @@
  * failure this is meant to avoid, arrived at from the other side.
  */
 import type { SshConnection } from './ssh-connection'
+import { ORCAD_STARTUP_READINESS_TIMEOUT_MS } from '../../shared/orcad-profile-preflight'
 import { execCommand } from './ssh-relay-deploy-helpers'
 import { ORCAD_INSTALL_MODEL } from './remote-install-model'
 import { computeRemoteInstallDir } from './ssh-relay-versioned-install'
@@ -71,7 +72,6 @@ export type OrcadRollbackResult =
   | { outcome: 'refused'; code: string; reason: string }
   | { outcome: 'failed'; code: string; reason: string }
 
-const DEFAULT_READINESS_TIMEOUT_MS = 90_000
 const READINESS_POLL_MS = 500
 const STOP_WAIT_SECONDS = 20
 
@@ -142,7 +142,10 @@ export async function rollbackOrcad(options: OrcadRollbackOptions): Promise<Orca
     const stopped = parseOrcadStopOutcome(
       await exec(
         options,
-        stopOrcadCommand(options.host, outgoingDir, { waitSeconds: STOP_WAIT_SECONDS })
+        stopOrcadCommand(options.host, outgoingDir, {
+          waitSeconds: STOP_WAIT_SECONDS,
+          nodePath: options.nodePath
+        })
       )
     )
     if (!orcadStopFreedTheHost(stopped)) {
@@ -150,9 +153,9 @@ export async function rollbackOrcad(options: OrcadRollbackOptions): Promise<Orca
         outcome: 'failed',
         code: 'orcad_rollback_stop_incomplete',
         reason:
-          `orcad ${options.record.active} did not exit within ${STOP_WAIT_SECONDS}s of SIGTERM ` +
-          `(${stopped}). Nothing was restored — the store is untouched and the host is still ` +
-          'serving the version you tried to leave.'
+          `Could not verify that orcad ${options.record.active} exited (${stopped}). ` +
+          'Nothing was restored. Orca requires matching runtime readiness before signaling ' +
+          'an incumbent and confirmed exit before replacing its state.'
       }
     }
   }
@@ -193,7 +196,7 @@ export async function rollbackOrcad(options: OrcadRollbackOptions): Promise<Orca
       port: options.port
     })
   )
-  const deadline = Date.now() + (options.readinessTimeoutMs ?? DEFAULT_READINESS_TIMEOUT_MS)
+  const deadline = Date.now() + (options.readinessTimeoutMs ?? ORCAD_STARTUP_READINESS_TIMEOUT_MS)
   const sleep = options.sleep ?? ((ms: number) => new Promise((r) => setTimeout(r, ms)))
   let parsed = parseOrcadReadinessOutput('')
   while (Date.now() < deadline && parsed.state === 'pending') {
diff --git a/src/main/ssh/orcad-remote-runtime.test.ts b/src/main/ssh/orcad-remote-runtime.test.ts
new file mode 100644
index 000000000000..637ab61e670a
--- /dev/null
+++ b/src/main/ssh/orcad-remote-runtime.test.ts
@@ -0,0 +1,67 @@
+import { mkdtempSync, rmSync, symlinkSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it } from 'vitest'
+import { runProcessSync } from '../../shared/child-process/run-process'
+import { getRemoteHostPlatform } from './ssh-remote-platform'
+import { selectOrcadSlotRuntimeCommand } from './orcad-remote-runtime'
+import { stopOrcadCommand } from './orcad-remote-process-control'
+
+const directories: string[] = []
+const host = getRemoteHostPlatform('linux-x64')
+
+afterEach(() => {
+  for (const directory of directories.splice(0)) {
+    rmSync(directory, { recursive: true, force: true })
+  }
+})
+
+function fixture(): string {
+  const directory = mkdtempSync(join(tmpdir(), "orca 'quoted' $slot-"))
+  directories.push(directory)
+  return directory
+}
+
+function launch(directory: string, nodePath: string) {
+  return runProcessSync({
+    program: '/bin/sh',
+    args: [
+      '-c',
+      `${selectOrcadSlotRuntimeCommand(host, directory, nodePath)}; ` +
+        '"$orcad_runtime" -e \'process.stdout.write("selected")\''
+    ]
+  })
+}
+
+describe.skipIf(process.platform === 'win32')('POSIX slot runtime selection', () => {
+  it('returns an unverifiable stop result when a bundled runtime cannot execute', () => {
+    const directory = fixture()
+    writeFileSync(join(directory, '.build-target'), 'linux-x64-glibc')
+    writeFileSync(join(directory, '.orcad-pid'), String(process.pid))
+    const result = runProcessSync({
+      program: '/bin/sh',
+      args: [
+        '-c',
+        stopOrcadCommand(host, directory, { waitSeconds: 1, nodePath: process.execPath })
+      ]
+    })
+    expect(result).toMatchObject({ code: 0, stdout: 'UNKNOWN\n' })
+  })
+
+  it('uses the bundled executable when host Node does not exist', () => {
+    const directory = fixture()
+    writeFileSync(join(directory, '.build-target'), 'linux-x64-glibc')
+    symlinkSync(process.execPath, join(directory, 'bun-runtime'))
+    expect(launch(directory, '/missing-host-node')).toMatchObject({ code: 0, stdout: 'selected' })
+  })
+
+  it('refuses an incomplete Bun slot before invoking a working host Node', () => {
+    const directory = fixture()
+    writeFileSync(join(directory, '.build-target'), 'linux-x64-glibc')
+    expect(launch(directory, process.execPath)).toMatchObject({ code: 78, stdout: '' })
+  })
+
+  it('retains the original runtime for a legacy slot', () => {
+    expect(launch(fixture(), process.execPath)).toMatchObject({ code: 0, stdout: 'selected' })
+  })
+})
diff --git a/src/main/ssh/orcad-remote-runtime.ts b/src/main/ssh/orcad-remote-runtime.ts
new file mode 100644
index 000000000000..505965620a0e
--- /dev/null
+++ b/src/main/ssh/orcad-remote-runtime.ts
@@ -0,0 +1,20 @@
+import { ORCAD_BUILD_TARGET_FILENAME, orcadBunRuntimeFilename } from '../../shared/orcad-artifacts'
+import { assertPosixOrcadHost } from './orcad-remote-host-support'
+import { shellEscape } from './ssh-connection-utils'
+import { joinRemotePath, type RemoteHostPlatform } from './ssh-remote-platform'
+
+/** Only legacy slots may use host Node; an incomplete Bun slot must not change runtimes. */
+export function selectOrcadSlotRuntimeCommand(
+  host: RemoteHostPlatform,
+  directory: string,
+  legacyNodePath: string
+): string {
+  assertPosixOrcadHost(host)
+  const runtime = shellEscape(joinRemotePath(host, directory, orcadBunRuntimeFilename(host.os)))
+  const target = shellEscape(joinRemotePath(host, directory, ORCAD_BUILD_TARGET_FILENAME))
+  return (
+    `if [ -e ${target} ] || [ -e ${runtime} ]; then ` +
+    `[ -x ${runtime} ] || exit 78; orcad_runtime=${runtime}; ` +
+    `else orcad_runtime=${shellEscape(legacyNodePath)}; fi`
+  )
+}
diff --git a/src/main/ssh/orcad-remote-shell-commands.integration.test.ts b/src/main/ssh/orcad-remote-shell-commands.integration.test.ts
index f43f82949ee0..4839fd7b2c21 100644
--- a/src/main/ssh/orcad-remote-shell-commands.integration.test.ts
+++ b/src/main/ssh/orcad-remote-shell-commands.integration.test.ts
@@ -6,20 +6,42 @@
  * never matches, a `tar` invocation that silently captures nothing. These run the strings.
  */
 import { execFileSync, spawn } from 'node:child_process'
-import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import {
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  rmSync,
+  symlinkSync,
+  writeFileSync
+} from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+import {
+  exportProfileStateJson,
+  importProfileStateJson
+} from '../persistence/profile-state/profile-state-documents'
+import { openProfileStateDatabase } from '../persistence/profile-state/profile-state-database'
 
 import {
+  orcadLaunchCommand,
   orcadLivenessProbeCommand,
   ORCAD_PID_FILENAME,
-  parseOrcadLiveness
+  ORCAD_READINESS_FILENAME,
+  parseOrcadLiveness,
+  parseOrcadReadinessOutput
 } from './orcad-remote-launch'
-import { parseOrcadStopOutcome, stopOrcadCommand } from './orcad-remote-process-control'
+import {
+  orcadStopFreedTheHost,
+  parseOrcadStopOutcome,
+  stopOrcadCommand
+} from './orcad-remote-process-control'
 import {
   captureOrcadStateSnapshotCommand,
+  compareOrcadStateSnapshotCommand,
   newestStateMtimeCommand,
+  orcadSnapshotIsUnchanged,
   parseNewestStateMtimeSeconds,
   parseOrcadSnapshotCapture,
   parseOrcadSnapshotRestore,
@@ -33,6 +55,7 @@ let root = ''
 let dataDir = ''
 let snapshotDir = ''
 let versionDir = ''
+const launchedPids = new Set<number>()
 
 function sh(command: string): string {
   return execFileSync('/bin/sh', ['-c', command], { encoding: 'utf8' })
@@ -52,10 +75,141 @@ beforeEach(() => {
 })
 
 afterEach(() => {
+  for (const pid of launchedPids) {
+    try {
+      process.kill(pid, 'SIGKILL')
+    } catch {
+      // Successful stops have already removed their test processes.
+    }
+  }
+  launchedPids.clear()
   rmSync(root, { recursive: true, force: true })
 })
 
+async function launchTestRuntime(legacyWrapper = false): Promise<{
+  runtimePid: number
+  recordedPid: number
+  terminatedFile: string
+}> {
+  const terminatedFile = join(versionDir, 'terminated')
+  writeFileSync(
+    join(versionDir, 'orcad.js'),
+    [
+      `process.on('SIGTERM', () => {`,
+      `  require('node:fs').writeFileSync(${JSON.stringify(terminatedFile)}, 'terminated');`,
+      `  process.exit(0);`,
+      `});`,
+      `console.log(JSON.stringify({type: 'orca_server_ready', health: {pid: process.pid}}));`,
+      `setTimeout(() => process.exit(1), 10_000);`
+    ].join('\n')
+  )
+  let command = orcadLaunchCommand(host, {
+    remoteInstallDir: versionDir,
+    nodePath: process.execPath,
+    fullVersion: '0.2.0+bb01',
+    userDataDir: dataDir,
+    bindHost: '127.0.0.1',
+    port: 0
+  })
+  if (legacyWrapper) {
+    // The trailing command retains the old macOS waiting-shell behavior on every POSIX shell.
+    command = command
+      .replace('exec nohup ', 'nohup ')
+      .replace('< /dev/null &', '< /dev/null && : &')
+  }
+  execFileSync('/bin/sh', ['-c', command], { stdio: 'ignore', timeout: 5_000 })
+  const recordedPid = Number(readFileSync(join(versionDir, ORCAD_PID_FILENAME), 'utf8').trim())
+  expect(recordedPid).toBeGreaterThan(1)
+  launchedPids.add(recordedPid)
+  const readRuntimePid = (): number => {
+    const parsed = parseOrcadReadinessOutput(
+      readFileSync(join(versionDir, ORCAD_READINESS_FILENAME), 'utf8')
+    )
+    return parsed.state === 'ready' ? (parsed.readiness.health?.pid ?? 0) : 0
+  }
+  await expect.poll(readRuntimePid, { timeout: 2_000, interval: 20 }).toBeGreaterThan(1)
+  const runtimePid = readRuntimePid()
+  launchedPids.add(runtimePid)
+  return { runtimePid, recordedPid, terminatedFile }
+}
+
+function stopTestRuntime(justLaunched = false): ReturnType<typeof parseOrcadStopOutcome> {
+  return parseOrcadStopOutcome(
+    execFileSync(
+      '/bin/sh',
+      [
+        '-c',
+        stopOrcadCommand(host, versionDir, {
+          waitSeconds: 3,
+          ...(justLaunched ? { justLaunched: true as const } : { nodePath: process.execPath })
+        })
+      ],
+      { encoding: 'utf8', timeout: 5_000 }
+    )
+  )
+}
+
 describe('state snapshot commands, run for real', () => {
+  it('detects candidate SQLite migration without modifying current state or the snapshot', () => {
+    sh(captureOrcadStateSnapshotCommand(host, dataDir, snapshotDir))
+    const archive = readFileSync(join(snapshotDir, 'state.tar'))
+    const compare = (): boolean =>
+      orcadSnapshotIsUnchanged(sh(compareOrcadStateSnapshotCommand(host, dataDir, snapshotDir)))
+    expect(compare()).toBe(true)
+    writeFileSync(join(dataDir, 'daemon', 'daemon.sock.token'), 'live-daemon-after-launch')
+    expect(compare()).toBe(true)
+
+    const databasePath = join(dataDir, 'profiles', 'p1', 'profile-state.db')
+    const candidate = openProfileStateDatabase(databasePath, 'p1')
+    try {
+      importProfileStateJson(candidate.db, '{"settings":{"theme":"dark"}}')
+    } finally {
+      candidate.db.close()
+    }
+    const databaseBytes = readFileSync(databasePath)
+
+    expect(compare()).toBe(false)
+    expect(readFileSync(databasePath)).toEqual(databaseBytes)
+    expect(readFileSync(join(snapshotDir, 'state.tar'))).toEqual(archive)
+    expect(readFileSync(join(dataDir, 'daemon', 'daemon.sock.token'), 'utf8')).toBe(
+      'live-daemon-after-launch'
+    )
+  })
+
+  it('requires an intact comparison snapshot before an older build can restart', () => {
+    expect(
+      orcadSnapshotIsUnchanged(sh(compareOrcadStateSnapshotCommand(host, dataDir, snapshotDir)))
+    ).toBe(false)
+    sh(captureOrcadStateSnapshotCommand(host, dataDir, snapshotDir))
+    writeFileSync(join(snapshotDir, 'state.tar'), 'not an archive')
+    expect(
+      orcadSnapshotIsUnchanged(sh(compareOrcadStateSnapshotCommand(host, dataDir, snapshotDir)))
+    ).toBe(false)
+    expect(readFileSync(join(dataDir, 'profiles', 'p1', 'orca-data.json'), 'utf8')).toBe(
+      '{"repos":"before"}'
+    )
+  })
+
+  it('rejects symlinked profile state that a tar snapshot does not preserve', () => {
+    const external = join(root, 'external-profile')
+    mkdirSync(external)
+    writeFileSync(join(external, 'orca-data.json'), '{"before":true}')
+    const profile = join(dataDir, 'profiles', 'linked')
+    symlinkSync(external, profile)
+
+    expect(
+      parseOrcadSnapshotCapture(sh(captureOrcadStateSnapshotCommand(host, dataDir, snapshotDir)))
+    ).toBe('failed')
+
+    mkdirSync(snapshotDir, { recursive: true })
+    execFileSync('tar', ['-C', dataDir, '-cf', join(snapshotDir, 'state.tar'), 'profiles'])
+    writeFileSync(join(external, 'orca-data.json'), '{"candidate":true}')
+    expect(
+      orcadSnapshotIsUnchanged(sh(compareOrcadStateSnapshotCommand(host, dataDir, snapshotDir)))
+    ).toBe(false)
+    expect(readFileSync(join(external, 'orca-data.json'), 'utf8')).toBe('{"candidate":true}')
+  })
+
   it('captures, then restores state the newer build overwrote', () => {
     expect(
       parseOrcadSnapshotCapture(sh(captureOrcadStateSnapshotCommand(host, dataDir, snapshotDir)))
@@ -74,6 +228,49 @@ describe('state snapshot commands, run for real', () => {
     expect(() => readFileSync(join(dataDir, 'profiles', 'p1', 'new-build-only.json'))).toThrow()
   })
 
+  it('round-trips a quiescent SQLite profile database with its WAL sidecars', () => {
+    const profileDirectory = join(dataDir, 'profiles', 'p1')
+    const databasePath = join(profileDirectory, 'profile-state.db')
+    const opened = openProfileStateDatabase(databasePath, 'p1')
+    try {
+      importProfileStateJson(
+        opened.db,
+        JSON.stringify({ settings: { theme: 'dark' }, snapshotMarker: 'before' })
+      )
+      // The connection remains open, so WAL/SHM are still part of the archive boundary while
+      // the generated command reads the now-quiescent files.
+      expect(existsSync(`${databasePath}-wal`)).toBe(true)
+      expect(
+        parseOrcadSnapshotCapture(sh(captureOrcadStateSnapshotCommand(host, dataDir, snapshotDir)))
+      ).toBe('captured')
+    } finally {
+      opened.db.close()
+    }
+
+    const changed = openProfileStateDatabase(databasePath, 'p1')
+    try {
+      importProfileStateJson(
+        changed.db,
+        JSON.stringify({ settings: { theme: 'light' }, snapshotMarker: 'after' })
+      )
+    } finally {
+      changed.db.close()
+    }
+    expect(
+      parseOrcadSnapshotRestore(sh(restoreOrcadStateSnapshotCommand(host, dataDir, snapshotDir)))
+    ).toBe('restored')
+
+    const restored = openProfileStateDatabase(databasePath, 'p1')
+    try {
+      expect(JSON.parse(exportProfileStateJson(restored.db))).toEqual({
+        settings: { theme: 'dark' },
+        snapshotMarker: 'before'
+      })
+    } finally {
+      restored.db.close()
+    }
+  })
+
   it('leaves the live daemon runtime dir untouched through capture and restore', () => {
     sh(captureOrcadStateSnapshotCommand(host, dataDir, snapshotDir))
     // The daemon is running across the rollback and rewrites its token; a restore that
@@ -115,7 +312,13 @@ describe('state snapshot commands, run for real', () => {
     expect(
       parseOrcadSnapshotCapture(sh(captureOrcadStateSnapshotCommand(host, nasty, snapshotDir)))
     ).toBe('captured')
+    expect(
+      orcadSnapshotIsUnchanged(sh(compareOrcadStateSnapshotCommand(host, nasty, snapshotDir)))
+    ).toBe(true)
     writeFileSync(join(nasty, 'orca-profile-index.json'), '{"v":"changed"}')
+    expect(
+      orcadSnapshotIsUnchanged(sh(compareOrcadStateSnapshotCommand(host, nasty, snapshotDir)))
+    ).toBe(false)
     expect(
       parseOrcadSnapshotRestore(sh(restoreOrcadStateSnapshotCommand(host, nasty, snapshotDir)))
     ).toBe('restored')
@@ -124,6 +327,85 @@ describe('state snapshot commands, run for real', () => {
 })
 
 describe('liveness and stop commands, run for real', () => {
+  it('records the runtime PID and waits for that runtime to exit when stopped', async () => {
+    const { runtimePid, recordedPid, terminatedFile } = await launchTestRuntime()
+    expect(recordedPid).toBe(runtimePid)
+    expect(stopTestRuntime()).toBe('stopped')
+    expect(readFileSync(terminatedFile, 'utf8')).toBe('terminated')
+    // An unreaped zombie has exited even though kill -0 still succeeds.
+    expect(sh(`ps -o stat= -p ${runtimePid} || true`).trim()).toMatch(/^(?:Z.*)?$/)
+    expect(existsSync(join(versionDir, ORCAD_PID_FILENAME))).toBe(true)
+    expect(stopTestRuntime()).toBe('already-exited')
+  })
+
+  it('refuses a legacy wrapper PID both before and after its shell exits', async () => {
+    const { runtimePid, recordedPid, terminatedFile } = await launchTestRuntime(true)
+    expect(recordedPid).not.toBe(runtimePid)
+    const beforeWrapperExit = stopTestRuntime()
+    expect(beforeWrapperExit).toBe('unknown')
+    expect(orcadStopFreedTheHost(beforeWrapperExit)).toBe(false)
+    expect(() => process.kill(recordedPid, 0)).not.toThrow()
+    expect(() => process.kill(runtimePid, 0)).not.toThrow()
+
+    process.kill(recordedPid, 'SIGTERM')
+    await expect
+      .poll(() => sh(`ps -o stat= -p ${recordedPid} || true`).trim(), { timeout: 2_000 })
+      .toMatch(/^(?:Z.*)?$/)
+    const afterWrapperExit = stopTestRuntime()
+    expect(afterWrapperExit).toBe('unknown')
+    expect(orcadStopFreedTheHost(afterWrapperExit)).toBe(false)
+    expect(() => process.kill(runtimePid, 0)).not.toThrow()
+    expect(existsSync(terminatedFile)).toBe(false)
+  })
+
+  it.each(['missing', 'malformed', 'without-health'])(
+    'refuses an incumbent with %s readiness proof',
+    async (proof) => {
+      const { runtimePid, terminatedFile } = await launchTestRuntime()
+      const readinessFile = join(versionDir, ORCAD_READINESS_FILENAME)
+      if (proof === 'missing') {
+        rmSync(readinessFile)
+      } else {
+        writeFileSync(readinessFile, proof === 'malformed' ? '{' : '{"type":"orca_server_ready"}')
+      }
+      expect(stopTestRuntime()).toBe('unknown')
+      expect(() => process.kill(runtimePid, 0)).not.toThrow()
+      expect(existsSync(terminatedFile)).toBe(false)
+    }
+  )
+
+  it('can stop a candidate just launched with exec without readiness', async () => {
+    const { runtimePid, recordedPid, terminatedFile } = await launchTestRuntime()
+    expect(recordedPid).toBe(runtimePid)
+    rmSync(join(versionDir, ORCAD_READINESS_FILENAME))
+    expect(stopTestRuntime(true)).toBe('stopped')
+    expect(readFileSync(terminatedFile, 'utf8')).toBe('terminated')
+    expect(sh(`ps -o stat= -p ${runtimePid} || true`).trim()).toMatch(/^(?:Z.*)?$/)
+  })
+
+  it.each(['before', 'after'])('refuses a permission-denied probe %s SIGTERM', async (phase) => {
+    const { runtimePid, terminatedFile } = await launchTestRuntime()
+    const deniedProbe = [
+      'term_sent=0; kill() {',
+      'if [ "$1" = -TERM ]; then term_sent=1; return 0; fi;',
+      `if [ '${phase}' = before ] || [ "$term_sent" = 1 ]; then`,
+      'echo "kill: Operation not permitted" >&2; return 1; fi;',
+      'command kill "$@"; };'
+    ].join(' ')
+    const outcome = parseOrcadStopOutcome(
+      sh(
+        `${deniedProbe} ${stopOrcadCommand(host, versionDir, {
+          waitSeconds: 1,
+          nodePath: process.execPath
+        })}`
+      )
+    )
+    expect(outcome).toBe('unknown')
+    expect(orcadStopFreedTheHost(outcome)).toBe(false)
+    expect(() => process.kill(runtimePid, 0)).not.toThrow()
+    expect(existsSync(terminatedFile)).toBe(false)
+  })
+
   it('reports UNKNOWN with no pid file, and DEAD for a pid that has exited', () => {
     expect(parseOrcadLiveness(sh(orcadLivenessProbeCommand(host, versionDir)))).toBe('UNKNOWN')
     writeFileSync(join(versionDir, ORCAD_PID_FILENAME), 'not-a-pid')
@@ -144,7 +426,9 @@ describe('liveness and stop commands, run for real', () => {
         child.once('exit', (_code, signal) => resolve(signal))
       )
       expect(
-        parseOrcadStopOutcome(sh(stopOrcadCommand(host, versionDir, { waitSeconds: 10 })))
+        parseOrcadStopOutcome(
+          sh(stopOrcadCommand(host, versionDir, { waitSeconds: 10, justLaunched: true }))
+        )
       ).toBe('stopped')
       expect(await exited).toBe('SIGTERM')
       expect(parseOrcadLiveness(sh(orcadLivenessProbeCommand(host, versionDir)))).toBe('DEAD')
@@ -166,7 +450,9 @@ describe('liveness and stop commands, run for real', () => {
       expect(sh(`kill -0 ${child.pid} 2>/dev/null && echo LIVE || echo DEAD`).trim()).toBe('LIVE')
       expect(parseOrcadLiveness(sh(orcadLivenessProbeCommand(host, versionDir)))).toBe('DEAD')
       expect(
-        parseOrcadStopOutcome(sh(stopOrcadCommand(host, versionDir, { waitSeconds: 1 })))
+        parseOrcadStopOutcome(
+          sh(stopOrcadCommand(host, versionDir, { waitSeconds: 1, justLaunched: true }))
+        )
       ).toBe('already-exited')
     } finally {
       child.unref()
@@ -176,14 +462,18 @@ describe('liveness and stop commands, run for real', () => {
   it('reports ALREADY_EXITED for a stale pid file rather than signalling a stranger', () => {
     const exited = Number(sh('sh -c "echo $$"').trim())
     writeFileSync(join(versionDir, ORCAD_PID_FILENAME), String(exited))
-    expect(parseOrcadStopOutcome(sh(stopOrcadCommand(host, versionDir, { waitSeconds: 1 })))).toBe(
-      'already-exited'
-    )
+    expect(
+      parseOrcadStopOutcome(
+        sh(stopOrcadCommand(host, versionDir, { waitSeconds: 1, justLaunched: true }))
+      )
+    ).toBe('already-exited')
   })
 
   it('reports NO_PID when the version dir was never launched', () => {
-    expect(parseOrcadStopOutcome(sh(stopOrcadCommand(host, versionDir, { waitSeconds: 1 })))).toBe(
-      'no-pid'
-    )
+    expect(
+      parseOrcadStopOutcome(
+        sh(stopOrcadCommand(host, versionDir, { waitSeconds: 1, nodePath: process.execPath }))
+      )
+    ).toBe('no-pid')
   })
 })
diff --git a/src/main/ssh/orcad-state-snapshot.test.ts b/src/main/ssh/orcad-state-snapshot.test.ts
index 0c50dc55fdbe..f660e95e5a42 100644
--- a/src/main/ssh/orcad-state-snapshot.test.ts
+++ b/src/main/ssh/orcad-state-snapshot.test.ts
@@ -4,6 +4,7 @@ import {
   ORCAD_SNAPSHOT_EXCLUDED,
   ORCAD_SNAPSHOT_MEMBERS,
   captureOrcadStateSnapshotCommand,
+  compareOrcadStateSnapshotCommand,
   newestStateMtimeCommand,
   orcadSnapshotDirName,
   parseNewestStateMtimeSeconds,
@@ -93,6 +94,7 @@ describe('Windows hosts', () => {
   it.each([
     ['capture', () => captureOrcadStateSnapshotCommand(windows, ROOT, SNAP)],
     ['restore', () => restoreOrcadStateSnapshotCommand(windows, ROOT, SNAP)],
+    ['compare', () => compareOrcadStateSnapshotCommand(windows, ROOT, SNAP)],
     ['mtime', () => newestStateMtimeCommand(windows, ROOT)]
   ])('refuses %s rather than emitting a POSIX command', (_label, build) => {
     expect(build).toThrow('orcad to a Windows host is not implemented')
diff --git a/src/main/ssh/orcad-state-snapshot.ts b/src/main/ssh/orcad-state-snapshot.ts
index 78ad8b47d2ac..7d0622754424 100644
--- a/src/main/ssh/orcad-state-snapshot.ts
+++ b/src/main/ssh/orcad-state-snapshot.ts
@@ -27,7 +27,9 @@ export const ORCAD_SNAPSHOT_MEMBERS = [
   'orca-profile-index.json',
   // Pre-profiles layout; still read as a migration source.
   'orca-data.json',
-  'profiles'
+  'profiles',
+  // Cross-profile SQLite moves must survive an orcad rollback too.
+  'profile-move-intents'
 ] as const
 
 /** Never captured and never restored — see the module comment. */
@@ -45,6 +47,10 @@ function assertPlainMemberName(member: string): string {
   return member
 }
 
+function noSymlinkedStateCommand(path: string): string {
+  return `links=$(find ${path} -type l -print) && [ -z "$links" ]`
+}
+
 export function orcadSnapshotDirName(fullVersion: string, takenAtMs: number): string {
   // Why the version and the timestamp: two activations of one version (a re-deploy after a
   // rejected activation) must not overwrite each other's snapshot.
@@ -72,8 +78,14 @@ export function captureOrcadStateSnapshotCommand(
     // Why the accumulated name is NOT quoted: `$members` is re-split by the shell before it
     // reaches tar, so a quoted name arrives as a literal `'profiles'` that tar cannot stat.
     // `assertPlainMemberName` is what makes leaving them bare safe.
-    (member) =>
-      `[ -e ${root}/${shellEscape(member)} ] && members="$members ${assertPlainMemberName(member)}";`
+    (member) => {
+      const path = `${root}/${shellEscape(member)}`
+      return (
+        `if [ -e ${path} ] || [ -L ${path} ]; then ` +
+        `${noSymlinkedStateCommand(path)} || { echo FAILED; exit 0; }; ` +
+        `members="$members ${assertPlainMemberName(member)}"; fi;`
+      )
+    }
   ).join(' ')
   return [
     `members=;`,
@@ -145,6 +157,42 @@ export function parseOrcadSnapshotRestore(output: string): OrcadSnapshotRestore
   return value === 'MISSING' ? 'missing' : 'failed'
 }
 
+/** Compare after stopping the candidate; a changed root cannot be handed to an older build. */
+export function compareOrcadStateSnapshotCommand(
+  host: RemoteHostPlatform,
+  userDataDir: string,
+  snapshotDir: string
+): string {
+  assertPosixHost(host)
+  const root = shellEscape(userDataDir)
+  const dir = shellEscape(snapshotDir)
+  const archive = shellEscape(joinRemotePath(host, snapshotDir, 'state.tar'))
+  const comparisons = ORCAD_SNAPSHOT_MEMBERS.map((member) => {
+    const name = shellEscape(member)
+    return [
+      `if [ -e ${root}/${name} ] || [ -L ${root}/${name} ]; then`,
+      `${noSymlinkedStateCommand(`${root}/${name}`)} || { echo UNKNOWN; exit 0; };`,
+      `diff -r ${root}/${name} "$comparison"/${name} >/dev/null 2>&1 || verdict=CHANGED;`,
+      `elif [ -e "$comparison"/${name} ] || [ -L "$comparison"/${name} ]; then verdict=CHANGED; fi;`
+    ].join(' ')
+  }).join(' ')
+  return [
+    `test -d ${root} && test -r ${root} && test -x ${root} || { echo UNKNOWN; exit 0; };`,
+    `test -f ${archive} || { echo UNKNOWN; exit 0; };`,
+    `comparison=$(mktemp -d ${dir}/compare.XXXXXX) || { echo UNKNOWN; exit 0; };`,
+    `trap 'rm -rf "$comparison"' EXIT HUP INT TERM;`,
+    `tar -C "$comparison" -xf ${archive} || { echo UNKNOWN; exit 0; };`,
+    `${noSymlinkedStateCommand('"$comparison"')} || { echo UNKNOWN; exit 0; };`,
+    'verdict=UNCHANGED;',
+    comparisons,
+    'echo "$verdict"'
+  ].join(' ')
+}
+
+export function orcadSnapshotIsUnchanged(output: string): boolean {
+  return output.trim().split('\n').pop()?.trim() === 'UNCHANGED'
+}
+
 /**
  * Has the shared store been written since `activatedAt`?
  *
diff --git a/src/main/ssh/relay-bundle-paths.ts b/src/main/ssh/relay-bundle-paths.ts
new file mode 100644
index 000000000000..d20dccb4cdbd
--- /dev/null
+++ b/src/main/ssh/relay-bundle-paths.ts
@@ -0,0 +1,18 @@
+import { join } from 'node:path'
+import type { RelayPlatform } from './relay-protocol'
+
+export function relayBundleCandidates(platform: RelayPlatform, appPath: string): string[] {
+  return [
+    ...new Set([
+      ...(process.env.ORCA_RELAY_PATH ? [join(process.env.ORCA_RELAY_PATH, platform)] : []),
+      ...(process.resourcesPath
+        ? [
+            join(process.resourcesPath, 'relay', platform),
+            join(process.resourcesPath, 'app.asar.unpacked', 'out', 'relay', platform)
+          ]
+        : []),
+      join(appPath, 'resources', 'relay', platform),
+      join(appPath, 'out', 'relay', platform)
+    ])
+  ]
+}
diff --git a/src/main/ssh/relay-socket-path-limit.test.ts b/src/main/ssh/relay-socket-path-limit.test.ts
index ce878765e8dc..8d58fbb10e09 100644
--- a/src/main/ssh/relay-socket-path-limit.test.ts
+++ b/src/main/ssh/relay-socket-path-limit.test.ts
@@ -1,5 +1,8 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
+vi.mock('./ssh-relay-opencode-runtime', () => ({
+  ensureRemoteOpenCodeRuntime: vi.fn().mockResolvedValue('ready')
+}))
 vi.mock('./ssh-relay-ripgrep-install', () => ({
   remoteRipgrepLayout: vi.fn().mockReturnValue(null),
   recordRemoteRipgrepReference: vi.fn().mockResolvedValue(false),
diff --git a/src/main/ssh/relay-socket-path-limit.ts b/src/main/ssh/relay-socket-path-limit.ts
index 417366e2bf6a..34ce21565b62 100644
--- a/src/main/ssh/relay-socket-path-limit.ts
+++ b/src/main/ssh/relay-socket-path-limit.ts
@@ -11,19 +11,13 @@
  */
 import { createHash } from 'node:crypto'
 import { isWindowsRemoteHost, type RemoteHostPlatform } from './ssh-remote-platform'
-
-/**
- * `sizeof(sun_path)` per remote OS, including the terminating NUL: 108 on Linux,
- * 104 on macOS/BSD. Compared against byte length, not character count — a non-ASCII
- * `$HOME` costs more bytes than characters.
- */
-const SUN_PATH_SIZE: Record<'linux' | 'darwin', number> = { linux: 108, darwin: 104 }
+import { unixSocketPathByteLimit } from '../../shared/unix-socket-path-limit'
 
 export function remoteUnixSocketPathByteLimit(host: RemoteHostPlatform): number | null {
   if (isWindowsRemoteHost(host)) {
     return null
   }
-  return SUN_PATH_SIZE[host.os === 'darwin' ? 'darwin' : 'linux'] - 1
+  return unixSocketPathByteLimit(host.os === 'darwin' ? 'darwin' : 'linux')
 }
 
 export function remoteSocketPathFitsLimit(host: RemoteHostPlatform, sockPath: string): boolean {
diff --git a/src/main/ssh/remote-install-gc-termination.test.ts b/src/main/ssh/remote-install-gc-termination.test.ts
new file mode 100644
index 000000000000..73b50e7b6f1f
--- /dev/null
+++ b/src/main/ssh/remote-install-gc-termination.test.ts
@@ -0,0 +1,183 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type * as DeployHelpers from './ssh-relay-deploy-helpers'
+
+vi.mock('./ssh-relay-deploy-helpers', async (importOriginal) => ({
+  ...(await importOriginal<typeof DeployHelpers>()),
+  execCommand: vi.fn()
+}))
+
+import type { SshConnection } from './ssh-connection'
+import { gcOldRelayVersions } from './remote-install-gc'
+import { execCommand } from './ssh-relay-deploy-helpers'
+import { gcRelayNativeDepsCache } from './ssh-relay-native-deps-cache-gc'
+import { gcRemoteRipgrepCache } from './ssh-relay-ripgrep-cache-gc'
+import { getRemoteHostPlatform } from './ssh-remote-platform'
+
+// oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: all connection access is replaced by execCommand's mock.
+const conn = {} as SshConnection
+const host = getRemoteHostPlatform('linux-x64')
+const home = '/home/u'
+const currentDir = `${home}/.orca-remote/relay-0.1.0+bbb`
+const nativeKey = 'linux-x64-0123456789abcdef'
+const mockExec = vi.mocked(execCommand)
+
+beforeEach(() => {
+  mockExec.mockReset()
+  mockExec.mockResolvedValue('')
+})
+
+function failAfter(replies: readonly string[], confirmed = false): Error {
+  for (const reply of replies) {
+    mockExec.mockResolvedValueOnce(reply)
+  }
+  const error = Object.assign(new Error('SSH command timed out'), {
+    sshChannelCloseConfirmed: confirmed
+  })
+  mockExec.mockRejectedValueOnce(error)
+  return error
+}
+
+function collectRelayVersions(): Promise<void> {
+  return gcOldRelayVersions(conn, home, currentDir, host, { nativeDepsCacheKeys: [nativeKey] })
+}
+
+const versionSteps = [
+  ['listing', 'relay-0.1.0+aaa\nrelay-0.1.0+ccc'],
+  ['install lock probe', 'OPEN'],
+  ['completion probe', 'COMPLETE'],
+  ['liveness probe', 'DEAD'],
+  ['claim acquisition', 'OK'],
+  ['claim owner write', ''],
+  ['claimed install lock probe', 'OPEN'],
+  ['claimed completion probe', 'COMPLETE'],
+  ['claimed liveness probe', 'DEAD'],
+  ['claim ownership probe', 'OWNED'],
+  ['rename', 'MOVED'],
+  ['claim release', 'RELEASED'],
+  ['tombstone deletion', '']
+] as const
+
+describe('version GC termination', () => {
+  it.each(versionSteps.map(([phase], index) => ({ phase, index })))(
+    'stops all cleanup after unconfirmed $phase termination',
+    async ({ index }) => {
+      const error = failAfter(versionSteps.slice(0, index).map(([, reply]) => reply))
+
+      await expect(collectRelayVersions()).rejects.toBe(error)
+
+      expect(mockExec).toHaveBeenCalledTimes(index + 1)
+    }
+  )
+
+  it.each([false, true])(
+    'stops after an unconfirmed stale lock probe with claim held: %s',
+    async (claimed) => {
+      const replies = claimed
+        ? versionSteps.slice(0, 6).map(([, reply]) => String(reply))
+        : [versionSteps[0][1]]
+      const error = failAfter([...replies, 'LOCKED'])
+
+      await expect(collectRelayVersions()).rejects.toBe(error)
+
+      expect(mockExec).toHaveBeenCalledTimes(replies.length + 2)
+    }
+  )
+
+  it('stops after unconfirmed abandoned tombstone deletion', async () => {
+    const error = failAfter([
+      'relay-0.1.0+aaa.gc-tombstone.1.1\nrelay-0.1.0+ccc.gc-tombstone.1.1\nrelay-0.1.0+ddd'
+    ])
+
+    await expect(collectRelayVersions()).rejects.toBe(error)
+
+    expect(mockExec).toHaveBeenCalledTimes(2)
+  })
+
+  it('preserves an unconfirmed native cache cleanup error for its caller', async () => {
+    const error = failAfter([''])
+
+    await expect(collectRelayVersions()).rejects.toBe(error)
+
+    expect(mockExec).toHaveBeenCalledTimes(2)
+  })
+})
+
+const caches = [
+  {
+    name: 'native dependencies',
+    collect: () => gcRelayNativeDepsCache(conn, host, home),
+    listing: `ENTRY ${nativeKey}\nENTRY linux-x64-fedcba9876543210\n__ORCA_NATIVE_CACHE__LIST_OK`,
+    references: '__ORCA_NATIVE_CACHE__REFS_OK'
+  },
+  {
+    name: 'ripgrep',
+    collect: () => gcRemoteRipgrepCache(conn, host, home),
+    listing:
+      'ENTRY 0123456789abcdef-linux-x64\nENTRY fedcba9876543210-linux-x64\n__ORCA_RG_CACHE__LIST_OK',
+    references: '__ORCA_RG_CACHE__REFS_OK'
+  }
+]
+
+describe.each(caches)('$name cache GC termination', ({ collect, listing, references }) => {
+  const steps = [
+    ['listing', listing],
+    ['reference scan', references],
+    ['rename', 'MOVED'],
+    ['reference recheck', references],
+    ['tombstone deletion', '']
+  ] as const
+
+  it.each(steps.map(([phase], index) => ({ phase, index })))(
+    'preserves unconfirmed $phase termination and stops collection',
+    async ({ index, phase }) => {
+      const error = failAfter(steps.slice(0, index).map(([, reply]) => reply))
+
+      await expect(collect()).rejects.toBe(error)
+
+      expect(mockExec).toHaveBeenCalledTimes(index + (phase === 'reference recheck' ? 2 : 1))
+      if (phase === 'reference recheck') {
+        expect(mockExec.mock.calls.at(-1)?.[1]).toContain('[ ! -e ')
+      }
+    }
+  )
+
+  it.each(steps.map(([phase], index) => ({ phase, index })))(
+    'keeps a confirmed $phase failure nonfatal',
+    async ({ index }) => {
+      failAfter(
+        steps.slice(0, index).map(([, reply]) => reply),
+        true
+      )
+
+      await expect(collect()).resolves.toBeUndefined()
+    }
+  )
+
+  it('stops when restoring a tombstone has unconfirmed termination', async () => {
+    const error = failAfter([listing, references, 'MOVED', 'unreadable references'])
+
+    await expect(collect()).rejects.toBe(error)
+
+    expect(mockExec).toHaveBeenCalledTimes(5)
+  })
+
+  it.each([false, true])(
+    'does not retry a failed restoration after an unconfirmed recheck: %s',
+    async (confirmed) => {
+      const error = failAfter([listing, references, 'MOVED'])
+      mockExec.mockRejectedValueOnce(
+        Object.assign(new Error('restore failed'), { sshChannelCloseConfirmed: confirmed })
+      )
+
+      await expect(collect()).rejects.toBe(error)
+
+      expect(mockExec).toHaveBeenCalledTimes(5)
+    }
+  )
+
+  it('keeps a confirmed restore failure nonfatal', async () => {
+    failAfter([listing, references, 'MOVED', 'unreadable references'], true)
+
+    await expect(collect()).resolves.toBeUndefined()
+  })
+})
diff --git a/src/main/ssh/remote-install-gc.ts b/src/main/ssh/remote-install-gc.ts
index a76d119cf8a4..986154e356e6 100644
--- a/src/main/ssh/remote-install-gc.ts
+++ b/src/main/ssh/remote-install-gc.ts
@@ -95,7 +95,10 @@ export async function gcOldRemoteInstallVersions(
       host,
       listRemoteInstallBaseDirsCommand(host, baseDir, model)
     )
-  } catch {
+  } catch (err) {
+    if (isUnconfirmedSshCommandTermination(err)) {
+      throw err
+    }
     return
   }
   const entries = listing
@@ -169,6 +172,9 @@ export async function gcOldRemoteInstallVersions(
       }
       removed.push(name)
     } catch (err) {
+      if (isUnconfirmedSshCommandTermination(err)) {
+        throw err
+      }
       console.warn(
         `[${model.id}] GC failed for ${dir}: ${err instanceof Error ? err.message : String(err)}`
       )
@@ -198,7 +204,10 @@ async function isCandidateSafeToRemove(
   let lockProbe: string
   try {
     lockProbe = await execHostCommand(conn, host, probeInstallLockExistsCommand(host, lockDir))
-  } catch {
+  } catch (err) {
+    if (isUnconfirmedSshCommandTermination(err)) {
+      throw err
+    }
     return false
   }
   const lockState = lockProbe.trim()
@@ -224,7 +233,12 @@ async function isCandidateSafeToRemove(
       conn,
       host,
       probeFileExistsCommand(host, completePath)
-    ).catch(() => 'PARTIAL')
+    ).catch((err) => {
+      if (isUnconfirmedSshCommandTermination(err)) {
+        throw err
+      }
+      return 'PARTIAL'
+    })
     if (completeProbe.trim() !== 'COMPLETE') {
       // Crashed-install partial; leave for the next deploy to recover.
       return false
@@ -263,7 +277,11 @@ export async function gcOldRelayVersions(
   if (options?.nativeDepsCacheKeys?.length) {
     await gcRelayNativeDepsCache(conn, host, remoteHome, {
       pinnedKeys: options.nativeDepsCacheKeys
-    }).catch(() => {})
+    }).catch((err) => {
+      if (isUnconfirmedSshCommandTermination(err)) {
+        throw err
+      }
+    })
   }
 }
 
@@ -294,7 +312,10 @@ async function hasLiveRelaySocket(
     )
     const state = out.trim()
     return state !== 'DEAD' && state !== 'WAITING'
-  } catch {
+  } catch (err) {
+    if (isUnconfirmedSshCommandTermination(err)) {
+      throw err
+    }
     // Why: an inconclusive liveness probe must never authorize deletion.
     return true
   }
diff --git a/src/main/ssh/remote-install-model.test.ts b/src/main/ssh/remote-install-model.test.ts
index a12b2e8342f6..fa32ea81940d 100644
--- a/src/main/ssh/remote-install-model.test.ts
+++ b/src/main/ssh/remote-install-model.test.ts
@@ -21,6 +21,18 @@ import {
 const RELAY_DIRS = ['relay-0.1.0+abcdef123456', 'relay-v0.1.0', 'relay-1.2.3']
 const ORCAD_DIRS = ['orcad-0.1.0+abcdef123456', 'orcad-v0.1.0', 'orcad-1.2.3']
 
+it.each([false, true])(
+  'requires the executable and both profile workers on Windows=%s',
+  (isWindows) => {
+    const artifacts = ORCAD_INSTALL_MODEL.requiredArtifacts(isWindows)
+    expect(artifacts).toContain(isWindows ? 'bun-runtime.exe' : 'bun-runtime')
+    expect(artifacts).not.toContain(isWindows ? 'bun-runtime' : 'bun-runtime.exe')
+    expect(artifacts).toContain('profile-state-writer-worker-entry.js')
+    expect(artifacts).toContain('profile-state-backup-worker-entry.js')
+    expect(artifacts.includes('windows-process-tree.node')).toBe(isWindows)
+  }
+)
+
 describe('remote install namespace', () => {
   it('names each model its own version dir', () => {
     expect(remoteInstallDirName(RELAY_INSTALL_MODEL, '0.1.0+aa')).toBe('relay-0.1.0+aa')
@@ -30,7 +42,9 @@ describe('remote install namespace', () => {
   it('requires every shipped search binary in a completed standalone runtime install', () => {
     const required = ORCAD_INSTALL_MODEL.requiredArtifacts(false)
     expect(required).toEqual(expect.arrayContaining([...ORCAD_RIPGREP_ARTIFACTS]))
-    expect(ORCAD_INSTALL_MODEL.requiredArtifacts(true)).toEqual(required)
+    expect(ORCAD_INSTALL_MODEL.requiredArtifacts(true)).toEqual(
+      expect.arrayContaining([...ORCAD_RIPGREP_ARTIFACTS])
+    )
   })
 
   it.skipIf(process.platform === 'win32')('rejects an install missing its search binary', () => {
diff --git a/src/main/ssh/remote-install-model.ts b/src/main/ssh/remote-install-model.ts
index 54be330a55f1..e2a46fda5475 100644
--- a/src/main/ssh/remote-install-model.ts
+++ b/src/main/ssh/remote-install-model.ts
@@ -53,9 +53,7 @@ export const ORCAD_INSTALL_MODEL: RemoteInstallModel = {
   nativeDepsPackageName: 'orca-orcad',
   versionFilename: ORCAD_VERSION_FILENAME,
   installCompleteFilename: ORCAD_INSTALL_COMPLETE_FILENAME,
-  // Why the parameter is ignored: orcad's forked children are the same three .js files on
-  // every host. The Windows-only console-list agent patch is a relay/node-pty concern.
-  requiredArtifacts: () => orcadArtifactFilenames()
+  requiredArtifacts: (isWindows) => orcadArtifactFilenames(isWindows ? 'win32' : '')
 }
 
 export const REMOTE_INSTALL_MODELS: readonly RemoteInstallModel[] = [
diff --git a/src/main/ssh/ssh-connection-auth-fallback.test.ts b/src/main/ssh/ssh-connection-auth-fallback.test.ts
index 9e3760616c2e..20c973e1b2cf 100644
--- a/src/main/ssh/ssh-connection-auth-fallback.test.ts
+++ b/src/main/ssh/ssh-connection-auth-fallback.test.ts
@@ -179,6 +179,7 @@ describe('SshConnection', () => {
       'target-1',
       'password',
       'example.com',
+      undefined,
       expect.any(AbortSignal)
     )
   })
@@ -244,7 +245,7 @@ describe('SshConnection', () => {
         ],
         finish
       )
-      for (let turn = 0; turn < 8 && finish.mock.calls.length === 0; turn += 1) {
+      for (let turn = 0; turn < 20 && finish.mock.calls.length === 0; turn += 1) {
         await Promise.resolve()
       }
 
@@ -254,6 +255,7 @@ describe('SshConnection', () => {
         'target-1',
         'keyboard-interactive',
         'Duo two-factor login\nSelect push or enter a passcode.\nOption:',
+        false,
         expect.any(AbortSignal)
       )
       expect(onCredentialRequest).toHaveBeenNthCalledWith(
@@ -261,6 +263,7 @@ describe('SshConnection', () => {
         'target-1',
         'keyboard-interactive',
         'Duo two-factor login\nSelect push or enter a passcode.\nPasscode:',
+        false,
         expect.any(AbortSignal)
       )
       expect(finish).toHaveBeenCalledWith(['1', '123456'])
@@ -311,7 +314,7 @@ describe('SshConnection', () => {
 
       await vi.advanceTimersByTimeAsync(100_000)
       firstResponse.resolve('1')
-      for (let turn = 0; turn < 4 && onCredentialRequest.mock.calls.length < 2; turn += 1) {
+      for (let turn = 0; turn < 20 && onCredentialRequest.mock.calls.length < 2; turn += 1) {
         await Promise.resolve()
       }
       expect(onCredentialRequest).toHaveBeenCalledTimes(2)
@@ -321,7 +324,7 @@ describe('SshConnection', () => {
       expect(finish).not.toHaveBeenCalled()
 
       secondResponse.resolve('123456')
-      for (let turn = 0; turn < 4 && finish.mock.calls.length === 0; turn += 1) {
+      for (let turn = 0; turn < 20 && finish.mock.calls.length === 0; turn += 1) {
         await Promise.resolve()
       }
       expect(finish).toHaveBeenCalledWith(['1', '123456'])
@@ -337,7 +340,13 @@ describe('SshConnection', () => {
     ssh2Mock.connectBehavior = 'pending'
     let credentialSignal: AbortSignal | undefined
     const onCredentialRequest = vi.fn(
-      (_targetId: string, _kind: string, _detail: string, signal?: AbortSignal) => {
+      (
+        _targetId: string,
+        _kind: string,
+        _detail: string,
+        _echo?: boolean,
+        signal?: AbortSignal
+      ) => {
         credentialSignal = signal
         const response = Promise.withResolvers<string | null>()
         if (signal?.aborted) {
@@ -405,6 +414,7 @@ describe('SshConnection', () => {
         'target-1',
         'passphrase',
         keyPath,
+        undefined,
         expect.any(AbortSignal)
       )
     } finally {
diff --git a/src/main/ssh/ssh-connection-gssapi-fallback.test.ts b/src/main/ssh/ssh-connection-gssapi-fallback.test.ts
index 7dcc25410a8e..8eeb6994a501 100644
--- a/src/main/ssh/ssh-connection-gssapi-fallback.test.ts
+++ b/src/main/ssh/ssh-connection-gssapi-fallback.test.ts
@@ -204,6 +204,7 @@ describe('SshConnection', () => {
       'target-1',
       'password',
       'example.com',
+      undefined,
       expect.any(AbortSignal)
     )
   })
diff --git a/src/main/ssh/ssh-connection-utils.test.ts b/src/main/ssh/ssh-connection-utils.test.ts
index 53cdbf07dd66..00abeeb2052f 100644
--- a/src/main/ssh/ssh-connection-utils.test.ts
+++ b/src/main/ssh/ssh-connection-utils.test.ts
@@ -514,6 +514,11 @@ describe('buildConnectConfig', () => {
     expect(config.keepaliveInterval).toBe(15_000)
   })
 
+  it('enables keyboard-interactive auth so MFA challenges can be answered', () => {
+    const config = buildConnectConfig(makeTarget(), null)
+    expect(config.tryKeyboard).toBe(true)
+  })
+
   it('uses agent auth when no explicit key and SSH_AUTH_SOCK is set', () => {
     const config = buildConnectConfig(makeTarget(), null)
     expect(config.agent).toBe('/tmp/agent.sock')
diff --git a/src/main/ssh/ssh-connection-utils.ts b/src/main/ssh/ssh-connection-utils.ts
index 216e23e62034..48057b9c0884 100644
--- a/src/main/ssh/ssh-connection-utils.ts
+++ b/src/main/ssh/ssh-connection-utils.ts
@@ -17,10 +17,13 @@ export type SshCredentialKind = 'passphrase' | 'password' | 'keyboard-interactiv
 
 export type SshConnectionCallbacks = {
   onStateChange: (targetId: string, state: SshConnectionState) => void
+  // Why: echo carries the server's RFC 4256 echo flag for keyboard-interactive
+  // prompts so the UI knows whether the typed response may be shown.
   onCredentialRequest?: (
     targetId: string,
     kind: SshCredentialKind,
     detail: string,
+    echo?: boolean,
     signal?: AbortSignal
   ) => Promise<string | null>
 }
@@ -202,6 +205,9 @@ export function buildConnectConfig(
     username: effectiveUser,
     readyTimeout: CONNECT_TIMEOUT_MS,
     keepaliveInterval: 15_000,
+    // Why: lets servers deliver keyboard-interactive challenges (RFC 4256,
+    // commonly MFA after a partial password success). SshConnection answers
+    // them through the credential prompt callback.
     tryKeyboard: true
   }
 
diff --git a/src/main/ssh/ssh-connection.test.ts b/src/main/ssh/ssh-connection.test.ts
index a20167c2f4ae..5535c5e7e8e4 100644
--- a/src/main/ssh/ssh-connection.test.ts
+++ b/src/main/ssh/ssh-connection.test.ts
@@ -2,6 +2,7 @@ import { describe, expect, it, vi, beforeEach } from 'vitest'
 import {
   clientInstances,
   createSsh2Module,
+  emitSshEvent,
   eventHandlers,
   resetSshConnectionMocks,
   VALID_ED25519_HOST_KEY,
@@ -277,4 +278,322 @@ describe('SshConnection', () => {
 
     await expect(conn.connect()).rejects.toThrow('Connection disposed')
   })
+
+  describe('keyboard-interactive MFA', () => {
+    it('completes password + keyboard-interactive MFA auth and forwards the prompt', async () => {
+      vi.stubEnv('SSH_AUTH_SOCK', '')
+      ssh2Mock.connectSequence = [
+        new Error('All configured authentication methods failed'),
+        'silent'
+      ]
+      const onCredentialRequest = vi.fn(async (_targetId: string, kind: string) =>
+        kind === 'password' ? 'password-123' : '1'
+      )
+      const conn = new SshConnection(createTarget(), createCallbacks({ onCredentialRequest }))
+
+      const connectPromise = conn.connect()
+      await vi.waitFor(() => {
+        expect(eventHandlers.get('keyboard-interactive')?.size ?? 0).toBeGreaterThan(0)
+        expect(clientInstances).toHaveLength(2)
+      })
+      const finish = vi.fn()
+      emitSshEvent(
+        'keyboard-interactive',
+        '',
+        'Choose a verification method:',
+        '',
+        [{ prompt: 'Passcode or option (1-2):', echo: true }],
+        finish
+      )
+      await vi.waitFor(() => expect(finish).toHaveBeenCalledWith(['1']))
+      emitSshEvent('ready')
+      await connectPromise
+
+      expect(conn.getState().status).toBe('connected')
+      expect(clientInstances[1].lastConnectConfig).toMatchObject({
+        tryKeyboard: true,
+        password: 'password-123'
+      })
+      expect(onCredentialRequest).toHaveBeenCalledWith(
+        'target-1',
+        'password',
+        'example.com',
+        undefined,
+        expect.any(AbortSignal)
+      )
+      expect(onCredentialRequest).toHaveBeenCalledWith(
+        'target-1',
+        'keyboard-interactive',
+        'Choose a verification method:\nPasscode or option (1-2):',
+        true,
+        expect.any(AbortSignal)
+      )
+    })
+
+    it('auto-answers a keyboard-interactive password prompt with the cached password (echo=false)', async () => {
+      vi.stubEnv('SSH_AUTH_SOCK', '')
+      ssh2Mock.connectSequence = [
+        new Error('All configured authentication methods failed'),
+        'silent'
+      ]
+      const onCredentialRequest = vi.fn(async () => 'password-123')
+      const conn = new SshConnection(createTarget(), createCallbacks({ onCredentialRequest }))
+
+      const connectPromise = conn.connect()
+      await vi.waitFor(() => {
+        expect(eventHandlers.get('keyboard-interactive')?.size ?? 0).toBeGreaterThan(0)
+        expect(clientInstances).toHaveLength(2)
+      })
+      const finish = vi.fn()
+      emitSshEvent(
+        'keyboard-interactive',
+        '',
+        '',
+        '',
+        [{ prompt: 'Password: ', echo: false }],
+        finish
+      )
+      await vi.waitFor(() => expect(finish).toHaveBeenCalledWith(['password-123']))
+      emitSshEvent('ready')
+      await connectPromise
+
+      expect(conn.getState().status).toBe('connected')
+      expect(onCredentialRequest).toHaveBeenCalledTimes(1)
+    })
+
+    it('caches a password collected through a keyboard-interactive prompt, but never caches an OTP', async () => {
+      vi.stubEnv('SSH_AUTH_SOCK', '')
+      ssh2Mock.connectSequence = ['silent']
+      const onCredentialRequest = vi.fn(async (_targetId: string, kind: string) =>
+        kind === 'password' ? 'password-123' : '654321'
+      )
+      const conn = new SshConnection(createTarget(), createCallbacks({ onCredentialRequest }))
+
+      const connectPromise = conn.connect()
+      await vi.waitFor(() =>
+        expect(eventHandlers.get('keyboard-interactive')?.size ?? 0).toBeGreaterThan(0)
+      )
+      const finish = vi.fn()
+      emitSshEvent(
+        'keyboard-interactive',
+        '',
+        '',
+        '',
+        [
+          { prompt: 'Password: ', echo: false },
+          { prompt: 'One-time password:', echo: false }
+        ],
+        finish
+      )
+      await vi.waitFor(() => expect(finish).toHaveBeenCalledWith(['password-123', '654321']))
+      emitSshEvent('ready')
+      await connectPromise
+
+      expect(onCredentialRequest).toHaveBeenCalledWith(
+        'target-1',
+        'password',
+        'example.com',
+        undefined,
+        expect.any(AbortSignal)
+      )
+      expect(onCredentialRequest).toHaveBeenCalledWith(
+        'target-1',
+        'keyboard-interactive',
+        'One-time password:',
+        false,
+        expect.any(AbortSignal)
+      )
+      expect(conn.hasCachedCredential()).toBe(true)
+
+      // Reconnect: the OTP prompt must be asked again (never auto-answered from a cache).
+      onCredentialRequest.mockClear()
+      ssh2Mock.connectSequence = ['silent']
+      const privateConn = conn as unknown as { attemptConnect: () => Promise<void> }
+      const reconnectPromise = privateConn.attemptConnect()
+      await vi.waitFor(() =>
+        expect(eventHandlers.get('keyboard-interactive')?.size ?? 0).toBeGreaterThan(0)
+      )
+      const finish2 = vi.fn()
+      emitSshEvent(
+        'keyboard-interactive',
+        '',
+        '',
+        '',
+        [{ prompt: 'One-time password:', echo: false }],
+        finish2
+      )
+      await vi.waitFor(() => expect(finish2).toHaveBeenCalledWith(['654321']))
+      // Why not answered from the password cache: this round only sends the
+      // OTP prompt (no password-looking prompt), so it must reach the user
+      // as a fresh 'keyboard-interactive' request every time.
+      expect(onCredentialRequest).toHaveBeenCalledWith(
+        'target-1',
+        'keyboard-interactive',
+        'One-time password:',
+        false,
+        expect.any(AbortSignal)
+      )
+      emitSshEvent('ready')
+      await reconnectPromise
+    })
+
+    it('re-prompts instead of replaying the cached password on a second keyboard-interactive round', async () => {
+      vi.stubEnv('SSH_AUTH_SOCK', '')
+      ssh2Mock.connectSequence = ['silent']
+      const onCredentialRequest = vi.fn(async () => 'password-123')
+      const conn = new SshConnection(createTarget(), createCallbacks({ onCredentialRequest }))
+
+      const connectPromise = conn.connect()
+      await vi.waitFor(() =>
+        expect(eventHandlers.get('keyboard-interactive')?.size ?? 0).toBeGreaterThan(0)
+      )
+      const finish = vi.fn()
+      emitSshEvent(
+        'keyboard-interactive',
+        '',
+        '',
+        '',
+        [{ prompt: 'Password: ', echo: false }],
+        finish
+      )
+      await vi.waitFor(() => expect(finish).toHaveBeenCalledWith(['password-123']))
+      expect(onCredentialRequest).toHaveBeenCalledTimes(1)
+
+      // The server rejected that password and opened a new round for it. Auto-answering from the
+      // cache again would replay the rejected value up to the round cap without asking the user.
+      onCredentialRequest.mockClear()
+      const finish2 = vi.fn()
+      emitSshEvent(
+        'keyboard-interactive',
+        '',
+        '',
+        '',
+        [{ prompt: 'Password: ', echo: false }],
+        finish2
+      )
+      await vi.waitFor(() => expect(finish2).toHaveBeenCalledWith(['password-123']))
+      expect(onCredentialRequest).toHaveBeenCalledWith(
+        'target-1',
+        'password',
+        'example.com',
+        undefined,
+        expect.any(AbortSignal)
+      )
+
+      emitSshEvent('ready')
+      await connectPromise
+    })
+
+    it('does not fall back to the password prompt after a cancelled keyboard-interactive prompt', async () => {
+      vi.stubEnv('SSH_AUTH_SOCK', '')
+      ssh2Mock.connectSequence = ['silent']
+      const onCredentialRequest = vi.fn(async () => null)
+      const conn = new SshConnection(createTarget(), createCallbacks({ onCredentialRequest }))
+
+      const connectPromise = conn.connect()
+      connectPromise.catch(() => {})
+      await vi.waitFor(() =>
+        expect(eventHandlers.get('keyboard-interactive')?.size ?? 0).toBeGreaterThan(0)
+      )
+      const finish = vi.fn()
+      emitSshEvent(
+        'keyboard-interactive',
+        '',
+        '',
+        '',
+        [{ prompt: 'Duo passcode:', echo: false }],
+        finish
+      )
+      await vi.waitFor(() => expect(finish).toHaveBeenCalledWith([]))
+
+      // Why no server error event: a cancelled prompt now fails the attempt
+      // immediately instead of waiting on a server round-trip that will
+      // never come from a user decision.
+      await expect(connectPromise).rejects.toThrow('Keyboard-interactive authentication cancelled')
+      expect(onCredentialRequest).toHaveBeenCalledTimes(1)
+      expect(conn.getState().status).toBe('auth-failed')
+    })
+
+    it('does not restore the password cache when a prompt resolves after disconnect', async () => {
+      vi.stubEnv('SSH_AUTH_SOCK', '')
+      ssh2Mock.connectSequence = ['silent']
+      let answer: (value: string) => void = () => {}
+      const onCredentialRequest = vi.fn(
+        () =>
+          new Promise<string>((resolve) => {
+            answer = resolve
+          })
+      )
+      const conn = new SshConnection(createTarget(), createCallbacks({ onCredentialRequest }))
+      const connecting = conn.connect()
+      connecting.catch(() => {})
+      await vi.waitFor(() => expect(eventHandlers.has('keyboard-interactive')).toBe(true))
+      const finish = vi.fn()
+      emitSshEvent(
+        'keyboard-interactive',
+        '',
+        '',
+        '',
+        [{ prompt: 'Password:', echo: false }],
+        finish
+      )
+      await vi.waitFor(() => expect(onCredentialRequest).toHaveBeenCalledOnce())
+      await conn.disconnect()
+      answer('obsolete-password')
+      await vi.waitFor(() => expect(finish).toHaveBeenCalledWith([]))
+      expect(conn.hasCachedCredential()).toBe(false)
+      expect(conn.getState().status).toBe('disconnected')
+      await expect(connecting).rejects.toThrow()
+    })
+
+    it('does not treat a missing credential callback as user cancellation', async () => {
+      vi.stubEnv('SSH_AUTH_SOCK', '')
+      ssh2Mock.connectSequence = ['silent']
+      const conn = new SshConnection(createTarget(), createCallbacks())
+      const connecting = conn.connect()
+      connecting.catch(() => {})
+      await vi.waitFor(() => expect(eventHandlers.has('keyboard-interactive')).toBe(true))
+      const finish = vi.fn()
+      emitSshEvent('keyboard-interactive', '', '', '', [{ prompt: 'Code:', echo: false }], finish)
+      await vi.waitFor(() => expect(finish).toHaveBeenCalledWith([]))
+      emitSshEvent('error', new Error('All configured authentication methods failed'))
+      await expect(connecting).rejects.toThrow('All configured authentication methods failed')
+      conn.disconnect()
+    })
+
+    it('fails auth (not cancellation) when the server rejects an incorrect MFA answer', async () => {
+      vi.stubEnv('SSH_AUTH_SOCK', '')
+      ssh2Mock.connectSequence = [
+        'silent',
+        new Error('All configured authentication methods failed')
+      ]
+      const onCredentialRequest = vi.fn(async () => '000000')
+      const conn = new SshConnection(createTarget(), createCallbacks({ onCredentialRequest }))
+
+      const connectPromise = conn.connect()
+      connectPromise.catch(() => {})
+      await vi.waitFor(() =>
+        expect(eventHandlers.get('keyboard-interactive')?.size ?? 0).toBeGreaterThan(0)
+      )
+      const finish = vi.fn()
+      emitSshEvent(
+        'keyboard-interactive',
+        '',
+        '',
+        '',
+        [{ prompt: 'Verification code:', echo: false }],
+        finish
+      )
+      await vi.waitFor(() => expect(finish).toHaveBeenCalledWith(['000000']))
+      // Why the second connectSequence entry is a plain error rather than
+      // another keyboard-interactive round: an incorrect OTP is a distinct
+      // case from cancellation — the user DID answer, the server rejected
+      // it — so this must not go through the keyboardInteractiveCancelled
+      // short-circuit at all.
+      emitSshEvent('error', new Error('All configured authentication methods failed'))
+
+      await expect(connectPromise).rejects.toThrow('All configured authentication methods failed')
+      expect(conn.getState().status).toBe('auth-failed')
+    })
+  })
 })
diff --git a/src/main/ssh/ssh-connection.ts b/src/main/ssh/ssh-connection.ts
index 98d383c5c927..448efe0ad388 100644
--- a/src/main/ssh/ssh-connection.ts
+++ b/src/main/ssh/ssh-connection.ts
@@ -45,6 +45,7 @@ import {
   type SshConnectionCallbacks,
   type SshCredentialKind
 } from './ssh-connection-utils'
+import { collectKeyboardInteractiveResponses } from './ssh-keyboard-interactive'
 import { resolveEffectiveProxy, spawnProxyCommand } from './ssh-proxy-command'
 import {
   createHostKeyVerifier,
@@ -114,7 +115,6 @@ const HOST_KEY_SOURCE_READ_TIMEOUT_MS = 5_000
 const SSH_KEYBOARD_INTERACTIVE_MAX_ROUNDS = 8
 const SSH_KEYBOARD_INTERACTIVE_READY_TIMEOUT_MS = SSH_CREDENTIAL_TIMEOUT_MS + 5_000
 const SSH_KEYBOARD_INTERACTIVE_MAX_PROMPTS = 8
-const SSH_KEYBOARD_INTERACTIVE_TEXT_MAX = 4_096
 
 // Upper bound on waiting for an aborted channel's open/close to settle before rejecting anyway.
 const ABORTED_CHANNEL_CLOSE_GRACE_MS = 5_000
@@ -206,6 +206,9 @@ export class SshConnection {
   private disposed = false
   private cachedPassphrase: string | null = null
   private cachedPassword: string | null = null
+  private keyboardInteractiveCancelled = false
+  // A rejected cached password must reach the user on the next round.
+  private keyboardInteractivePasswordState = { passwordAutoAnswered: false }
   private hostKeyFingerprint: string | undefined
   private connectGeneration = 0
 
@@ -224,6 +227,9 @@ export class SshConnection {
   getState(): SshConnectionState {
     return { ...this.state }
   }
+  getConnectGeneration(): number {
+    return this.connectGeneration
+  }
   getClient(): SshClient | null {
     return this.client
   }
@@ -733,7 +739,8 @@ export class SshConnection {
   private async requestCredential(
     kind: SshCredentialKind,
     detail: string,
-    connectGeneration: number
+    connectGeneration: number,
+    echo?: boolean
   ): Promise<string | null | undefined> {
     if (this.disposed || connectGeneration !== this.connectGeneration) {
       return undefined
@@ -742,14 +749,16 @@ export class SshConnection {
       this.target.id,
       kind,
       detail,
+      echo,
       this.credentialAbortController.signal
     )
   }
 
   private async answerKeyboardInteractive(
+    hostDetail: string,
     name: string,
     instructions: string,
-    prompts: readonly Prompt[],
+    prompts: Prompt[],
     connectGeneration: number,
     onPromptStart: () => void
   ): Promise<string[] | null> {
@@ -757,25 +766,36 @@ export class SshConnection {
       return null
     }
     const heading = [name.trim(), instructions.trim()].filter(Boolean).join('\n')
-    const responses: string[] = []
-    for (const prompt of prompts) {
-      onPromptStart()
-      const promptText = prompt.prompt.trim() || 'Verification response'
-      const detail = [heading, promptText]
-        .filter(Boolean)
-        .join('\n')
-        .slice(0, SSH_KEYBOARD_INTERACTIVE_TEXT_MAX)
-      const response = await this.requestCredential(
-        'keyboard-interactive',
-        detail,
-        connectGeneration
-      )
-      if (response === null || response === undefined) {
-        return null
-      }
-      responses.push(response)
-    }
-    return this.disposed || connectGeneration !== this.connectGeneration ? null : responses
+    const isCurrent = (): boolean => !this.disposed && connectGeneration === this.connectGeneration
+    const responses = await collectKeyboardInteractiveResponses(
+      {
+        targetId: this.target.id,
+        hostDetail,
+        // Preserve a missing prompter as a capability gap, not a cancellation.
+        requestCredential: this.callbacks.onCredentialRequest
+          ? async (_targetId, kind, detail, echo) =>
+              (await this.requestCredential(kind, detail, connectGeneration, echo)) ?? null
+          : undefined,
+        getCachedPassword: () => this.cachedPassword,
+        setCachedPassword: (value) => {
+          if (isCurrent()) {
+            this.cachedPassword = value
+          }
+        },
+        markCancelled: () => {
+          // A stale prompt must not cancel the current attempt.
+          if (isCurrent()) {
+            this.keyboardInteractiveCancelled = true
+          }
+        },
+        isCancelled: () => !isCurrent() || this.keyboardInteractiveCancelled,
+        state: this.keyboardInteractivePasswordState
+      },
+      heading,
+      prompts,
+      onPromptStart
+    )
+    return isCurrent() ? responses : null
   }
 
   private async attemptConnect(connectGeneration = ++this.connectGeneration): Promise<void> {
@@ -784,6 +804,8 @@ export class SshConnection {
     this.setState('connecting')
     this.proxyProcess?.kill()
     this.proxyProcess = null
+    this.keyboardInteractiveCancelled = false
+    this.keyboardInteractivePasswordState = { passwordAutoAnswered: false }
 
     const resolved = await resolveWithSshG(this.target.configHost || this.target.label).catch(
       () => null
@@ -871,6 +893,13 @@ export class SshConnection {
         throw err
       }
 
+      // Cancellation must stop the credential and transport fallback chain.
+      if (this.keyboardInteractiveCancelled) {
+        this.proxyProcess?.kill()
+        this.proxyProcess = null
+        throw err
+      }
+
       if (isSystemSshFallbackError(err)) {
         this.proxyProcess?.kill()
         this.proxyProcess = null
@@ -918,6 +947,12 @@ export class SshConnection {
               this.proxyProcess = null
               throw keyErr
             }
+            // Key fallback must honor the same cancellation boundary.
+            if (this.keyboardInteractiveCancelled) {
+              this.proxyProcess?.kill()
+              this.proxyProcess = null
+              throw keyErr
+            }
             authError = keyErr
             const passphraseKeyPath = getPassphrasePrivateKeyPath(keyConfig)
             // Why: with GSSAPI enabled, let the reactive system-ssh probe try a Kerberos ticket before prompting for the passphrase; the prompt still runs if it fails.
@@ -1526,10 +1561,33 @@ export class SshConnection {
           return
         }
         rearmStartupTimer(SSH_KEYBOARD_INTERACTIVE_READY_TIMEOUT_MS)
-        void this.answerKeyboardInteractive(name, instructions, prompts, connectGeneration, () =>
-          rearmStartupTimer(SSH_KEYBOARD_INTERACTIVE_READY_TIMEOUT_MS)
+        void this.answerKeyboardInteractive(
+          config.host || this.target.label,
+          name,
+          instructions,
+          prompts,
+          connectGeneration,
+          () => rearmStartupTimer(SSH_KEYBOARD_INTERACTIVE_READY_TIMEOUT_MS)
         ).then(
           (responses) => {
+            // Settle cancellation immediately, but still answer ssh2’s pending callback.
+            if (
+              responses === null &&
+              (connectGeneration !== this.connectGeneration || this.keyboardInteractiveCancelled)
+            ) {
+              finish([])
+              if (!settled) {
+                // Preserve the auth-failed state for explicit cancellation.
+                const cancelledError = Object.assign(
+                  new Error(
+                    `Keyboard-interactive authentication cancelled for ${this.target.label}`
+                  ),
+                  { level: 'client-authentication' }
+                )
+                onStartupError(cancelledError)
+              }
+              return
+            }
             const attemptIsCurrent =
               !settled && !this.disposed && connectGeneration === this.connectGeneration
             finish(attemptIsCurrent ? (responses ?? []) : [])
diff --git a/src/main/ssh/ssh-keyboard-interactive-wire.test.ts b/src/main/ssh/ssh-keyboard-interactive-wire.test.ts
new file mode 100644
index 000000000000..5f45f27a52d1
--- /dev/null
+++ b/src/main/ssh/ssh-keyboard-interactive-wire.test.ts
@@ -0,0 +1,118 @@
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { Server, utils, type Connection } from 'ssh2'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { SshConnection } from './ssh-connection'
+import { createCallbacks, createResolvedConfig, createTarget } from './ssh-connection-test-fixtures'
+import { initSshHostKeyStoreFile } from './ssh-host-key-store'
+import { resolveWithSshG } from './ssh-config-parser'
+import type * as SshConfigParser from './ssh-config-parser'
+
+vi.mock('./ssh-config-parser', async (importOriginal) => ({
+  ...(await importOriginal<typeof SshConfigParser>()),
+  resolveWithSshG: vi.fn()
+}))
+
+describe('keyboard-interactive over a real SSH socket', () => {
+  let profile: string
+  let server: Server
+  let conn: SshConnection | undefined
+  const sockets = new Set<Connection>()
+
+  beforeEach(() => {
+    profile = mkdtempSync(join(tmpdir(), 'orca-keyboard-wire-'))
+    initSshHostKeyStoreFile(join(profile, 'host-keys.json'))
+    vi.stubEnv('SSH_AUTH_SOCK', '')
+    vi.mocked(resolveWithSshG).mockResolvedValue(
+      createResolvedConfig({
+        hostname: '127.0.0.1',
+        identitiesOnly: true,
+        identityAgent: 'none',
+        proxyUseFdpass: false,
+        strictHostKeyChecking: 'no'
+      })
+    )
+  })
+
+  afterEach(async () => {
+    await conn?.disconnect()
+    for (const socket of sockets) {
+      socket.end()
+    }
+    sockets.clear()
+    if (server) {
+      await new Promise<void>((resolve) => server.close(() => resolve()))
+    }
+    vi.unstubAllEnvs()
+    rmSync(profile, { recursive: true, force: true })
+  })
+
+  it.each([false, true])(
+    'completes password then MFA with empty push response=%s',
+    async (empty) => {
+      const received: string[][] = []
+      const methods: string[] = []
+      server = new Server(
+        { hostKeys: [utils.generateKeyPairSync('ecdsa', { bits: 256 }).private] },
+        (socket) => {
+          sockets.add(socket)
+          socket.on('error', () => {})
+          socket.on('close', () => sockets.delete(socket))
+          let passwordAccepted = false
+          socket.on('authentication', (context) => {
+            methods.push(context.method)
+            if (context.method === 'password' && context.password === 'fixture-password') {
+              passwordAccepted = true
+              context.reject(['keyboard-interactive'], true)
+            } else if (context.method === 'keyboard-interactive' && passwordAccepted) {
+              context.prompt(
+                [
+                  {
+                    prompt: empty ? 'Press Enter for push:' : 'Passcode or option (1-2):',
+                    echo: true
+                  }
+                ],
+                'MFA',
+                'Choose verification:',
+                (answers) => {
+                  received.push(answers)
+                  if (answers[0] === (empty ? '' : '1')) {
+                    context.accept()
+                  } else {
+                    context.reject(['keyboard-interactive'])
+                  }
+                }
+              )
+            } else {
+              context.reject(['password'])
+            }
+          })
+        }
+      )
+      await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve))
+      const address = server.address()
+      if (!address || typeof address === 'string') {
+        throw new Error('Fixture did not bind')
+      }
+      const onCredentialRequest = vi.fn(async (_id: string, kind: string) =>
+        kind === 'password' ? 'fixture-password' : empty ? '' : '1'
+      )
+      conn = new SshConnection(
+        createTarget({ host: '127.0.0.1', port: address.port }),
+        createCallbacks({ onCredentialRequest })
+      )
+      await conn.connect()
+      expect(conn.getState().status).toBe('connected')
+      expect(received).toEqual([[empty ? '' : '1']])
+      expect(methods).toContain('password')
+      expect(onCredentialRequest).toHaveBeenLastCalledWith(
+        'target-1',
+        'keyboard-interactive',
+        `MFA\nChoose verification:\n${empty ? 'Press Enter for push:' : 'Passcode or option (1-2):'}`,
+        true,
+        expect.any(AbortSignal)
+      )
+    }
+  )
+})
diff --git a/src/main/ssh/ssh-keyboard-interactive.test.ts b/src/main/ssh/ssh-keyboard-interactive.test.ts
new file mode 100644
index 000000000000..0c426fbdb5f2
--- /dev/null
+++ b/src/main/ssh/ssh-keyboard-interactive.test.ts
@@ -0,0 +1,215 @@
+import { describe, expect, it, vi } from 'vitest'
+import {
+  collectKeyboardInteractiveResponses,
+  formatKeyboardInteractivePromptDetail,
+  isKeyboardInteractivePasswordPrompt,
+  type KeyboardInteractiveSession
+} from './ssh-keyboard-interactive'
+
+function createSession(
+  overrides: Partial<KeyboardInteractiveSession> = {}
+): KeyboardInteractiveSession & { cancelled: { value: boolean } } {
+  const cancelled = { value: false }
+  return {
+    targetId: 'target-1',
+    hostDetail: 'example.com',
+    requestCredential: vi.fn(async () => 'answer'),
+    getCachedPassword: () => null,
+    setCachedPassword: vi.fn(),
+    markCancelled: () => {
+      cancelled.value = true
+    },
+    isCancelled: () => cancelled.value,
+    state: { passwordAutoAnswered: false },
+    cancelled,
+    ...overrides
+  }
+}
+
+describe('isKeyboardInteractivePasswordPrompt', () => {
+  it('matches masked password prompts', () => {
+    expect(isKeyboardInteractivePasswordPrompt({ prompt: 'Password: ', echo: false })).toBe(true)
+    expect(isKeyboardInteractivePasswordPrompt({ prompt: "user@host's PASSWORD:" })).toBe(true)
+  })
+
+  it('rejects echoed prompts even when they mention a password', () => {
+    expect(isKeyboardInteractivePasswordPrompt({ prompt: 'Password: ', echo: true })).toBe(false)
+  })
+
+  it('rejects one-time password and OTP prompts', () => {
+    expect(isKeyboardInteractivePasswordPrompt({ prompt: 'One-time password:', echo: false })).toBe(
+      false
+    )
+    expect(isKeyboardInteractivePasswordPrompt({ prompt: 'OTP password code:', echo: false })).toBe(
+      false
+    )
+  })
+
+  it('rejects verification prompts that never mention a password', () => {
+    expect(isKeyboardInteractivePasswordPrompt({ prompt: 'Passcode:', echo: false })).toBe(false)
+    expect(isKeyboardInteractivePasswordPrompt({ prompt: 'Duo push sent', echo: false })).toBe(
+      false
+    )
+  })
+})
+
+describe('formatKeyboardInteractivePromptDetail', () => {
+  it('joins instructions and prompt on separate lines', () => {
+    expect(formatKeyboardInteractivePromptDetail('Pick an option:', 'Passcode: ')).toBe(
+      'Pick an option:\nPasscode:'
+    )
+  })
+
+  it('drops the missing half', () => {
+    expect(formatKeyboardInteractivePromptDetail('', 'Passcode: ')).toBe('Passcode:')
+    expect(formatKeyboardInteractivePromptDetail('Approve the push. ', '')).toBe(
+      'Approve the push.'
+    )
+  })
+})
+
+describe('collectKeyboardInteractiveResponses', () => {
+  it('forwards verification prompts with instructions and the echo flag', async () => {
+    const requestCredential = vi.fn(async () => '1')
+    const session = createSession({ requestCredential })
+
+    const responses = await collectKeyboardInteractiveResponses(session, 'Choose an option:', [
+      { prompt: 'Passcode or option (1-2):', echo: true }
+    ])
+
+    expect(responses).toEqual(['1'])
+    expect(requestCredential).toHaveBeenCalledWith(
+      'target-1',
+      'keyboard-interactive',
+      'Choose an option:\nPasscode or option (1-2):',
+      true
+    )
+  })
+
+  it('answers a password prompt from the cache without prompting', async () => {
+    const requestCredential = vi.fn(async () => 'unused')
+    const session = createSession({
+      requestCredential,
+      getCachedPassword: () => 'password-123'
+    })
+
+    const responses = await collectKeyboardInteractiveResponses(session, '', [
+      { prompt: 'Password: ', echo: false }
+    ])
+
+    expect(responses).toEqual(['password-123'])
+    expect(requestCredential).not.toHaveBeenCalled()
+    expect(session.state.passwordAutoAnswered).toBe(true)
+  })
+
+  it('re-prompts when the server rejects the auto-answered cached password', async () => {
+    const requestCredential = vi.fn(async () => 'corrected-password')
+    const setCachedPassword = vi.fn()
+    const session = createSession({
+      requestCredential,
+      getCachedPassword: () => 'stale-password',
+      setCachedPassword,
+      state: { passwordAutoAnswered: true }
+    })
+
+    const responses = await collectKeyboardInteractiveResponses(session, '', [
+      { prompt: 'Password: ', echo: false }
+    ])
+
+    expect(responses).toEqual(['corrected-password'])
+    expect(requestCredential).toHaveBeenCalledWith('target-1', 'password', 'example.com')
+    expect(setCachedPassword).toHaveBeenCalledWith('corrected-password')
+  })
+
+  it('collects and caches the password when nothing is cached yet', async () => {
+    const requestCredential = vi.fn(async () => 'password-123')
+    const setCachedPassword = vi.fn()
+    const session = createSession({ requestCredential, setCachedPassword })
+
+    const responses = await collectKeyboardInteractiveResponses(session, '', [
+      { prompt: 'Password: ', echo: false },
+      { prompt: 'Duo push approval', echo: false }
+    ])
+
+    expect(responses).toEqual(['password-123', 'password-123'])
+    expect(requestCredential).toHaveBeenNthCalledWith(1, 'target-1', 'password', 'example.com')
+    expect(requestCredential).toHaveBeenNthCalledWith(
+      2,
+      'target-1',
+      'keyboard-interactive',
+      'Duo push approval',
+      false
+    )
+    expect(setCachedPassword).toHaveBeenCalledWith('password-123')
+  })
+
+  it('returns null and marks the session cancelled when the user dismisses a prompt', async () => {
+    const session = createSession({ requestCredential: vi.fn(async () => null) })
+
+    const responses = await collectKeyboardInteractiveResponses(session, '', [
+      { prompt: 'Duo passcode:', echo: false }
+    ])
+
+    expect(responses).toBeNull()
+    expect(session.isCancelled()).toBe(true)
+  })
+
+  it('short-circuits every later round once cancelled', async () => {
+    const requestCredential = vi.fn(async () => 'answer')
+    const session = createSession({ requestCredential })
+    session.markCancelled()
+
+    const responses = await collectKeyboardInteractiveResponses(session, '', [
+      { prompt: 'Duo passcode:', echo: false }
+    ])
+
+    expect(responses).toBeNull()
+    expect(requestCredential).not.toHaveBeenCalled()
+  })
+
+  it('returns null when no credential prompter is available', async () => {
+    const session = createSession({ requestCredential: undefined })
+
+    const responses = await collectKeyboardInteractiveResponses(session, '', [
+      { prompt: 'Password: ', echo: false }
+    ])
+
+    expect(responses).toBeNull()
+  })
+
+  it('discards a password resolved after the attempt is cancelled', async () => {
+    let answer: (value: string) => void = () => {}
+    const requestCredential = vi
+      .fn(async () => 'code')
+      .mockImplementationOnce(
+        () =>
+          new Promise<string>((resolve) => {
+            answer = resolve
+          })
+      )
+    const setCachedPassword = vi.fn()
+    const session = createSession({ requestCredential, setCachedPassword })
+    const collecting = collectKeyboardInteractiveResponses(session, '', [
+      { prompt: 'Password:', echo: false },
+      { prompt: 'Code:', echo: false }
+    ])
+    session.markCancelled()
+    answer('obsolete-password')
+    expect(await collecting).toBeNull()
+    expect(setCachedPassword).not.toHaveBeenCalled()
+    expect(requestCredential).toHaveBeenCalledTimes(1)
+  })
+
+  it('accepts an empty response without caching it as a password', async () => {
+    const requestCredential = vi.fn(async () => '')
+    const setCachedPassword = vi.fn()
+    const session = createSession({ requestCredential, setCachedPassword })
+
+    const responses = await collectKeyboardInteractiveResponses(session, '', [
+      { prompt: 'Password: ', echo: false }
+    ])
+
+    expect(responses).toEqual([''])
+    expect(setCachedPassword).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/main/ssh/ssh-keyboard-interactive.ts b/src/main/ssh/ssh-keyboard-interactive.ts
new file mode 100644
index 000000000000..fae202878486
--- /dev/null
+++ b/src/main/ssh/ssh-keyboard-interactive.ts
@@ -0,0 +1,111 @@
+import type { Prompt } from 'ssh2'
+import type { SshConnectionCallbacks } from './ssh-connection-utils'
+
+// Why: servers commonly reuse keyboard-interactive (RFC 4256) to collect the
+// login password itself before issuing MFA challenges. Password-looking
+// prompts route through the password credential flow (and its cache) so
+// reconnects stay silent; every other prompt needs a fresh human answer.
+const PASSWORD_PROMPT = /password/i
+// Why: a one-time code answered with the cached login password would burn MFA
+// attempts (and can lock the account) on every reconnect.
+const ONE_TIME_PROMPT = /one.?time|otp/i
+// Why: bounds a malicious/misbehaving server's prompt text before it reaches the credential dialog.
+const PROMPT_DETAIL_MAX = 4_096
+
+export function isKeyboardInteractivePasswordPrompt(prompt: Prompt): boolean {
+  return (
+    prompt.echo !== true &&
+    PASSWORD_PROMPT.test(prompt.prompt) &&
+    !ONE_TIME_PROMPT.test(prompt.prompt)
+  )
+}
+
+export function formatKeyboardInteractivePromptDetail(
+  instructions: string,
+  promptText: string
+): string {
+  const trimmedInstructions = instructions.trim()
+  const trimmedPrompt = promptText.trim()
+  const detail =
+    !trimmedInstructions || !trimmedPrompt
+      ? trimmedInstructions || trimmedPrompt
+      : `${trimmedInstructions}\n${trimmedPrompt}`
+  return detail.slice(0, PROMPT_DETAIL_MAX)
+}
+
+export type KeyboardInteractiveSession = {
+  targetId: string
+  hostDetail: string
+  requestCredential: SshConnectionCallbacks['onCredentialRequest']
+  getCachedPassword: () => string | null
+  setCachedPassword: (value: string) => void
+  markCancelled: () => void
+  isCancelled: () => boolean
+  // Why: one cached-password auto-answer per connection attempt — a second
+  // password prompt in the same attempt means the server rejected the cached
+  // value, so the user must be asked again instead of looping a bad password.
+  state: { passwordAutoAnswered: boolean }
+}
+
+// Answers one keyboard-interactive round. Returns null when the user
+// cancelled (or no prompter is available); callers respond with no answers so
+// the server fails the round and the regular auth-error flow takes over.
+export async function collectKeyboardInteractiveResponses(
+  session: KeyboardInteractiveSession,
+  instructions: string,
+  prompts: Prompt[],
+  onPromptStart?: () => void
+): Promise<string[] | null> {
+  if (session.isCancelled()) {
+    return null
+  }
+  // Why: a missing prompter is a capability gap, not a user decision — it
+  // must return null WITHOUT calling markCancelled(), or SshConnection would
+  // treat it as an explicit decline and skip its passphrase/password rungs.
+  if (!session.requestCredential) {
+    return null
+  }
+  const responses: string[] = []
+  for (const prompt of prompts) {
+    onPromptStart?.()
+    const value = isKeyboardInteractivePasswordPrompt(prompt)
+      ? await answerPasswordPrompt(session)
+      : await session.requestCredential(
+          session.targetId,
+          'keyboard-interactive',
+          formatKeyboardInteractivePromptDetail(instructions, prompt.prompt),
+          prompt.echo
+        )
+    if (session.isCancelled()) {
+      return null
+    }
+    if (value == null) {
+      session.markCancelled()
+      return null
+    }
+    responses.push(value)
+  }
+  return responses
+}
+
+async function answerPasswordPrompt(
+  session: KeyboardInteractiveSession
+): Promise<string | null | undefined> {
+  const cached = session.getCachedPassword()
+  if (cached != null && !session.state.passwordAutoAnswered) {
+    session.state.passwordAutoAnswered = true
+    return cached
+  }
+  const value = await session.requestCredential?.(session.targetId, 'password', session.hostDetail)
+  if (session.isCancelled()) {
+    return null
+  }
+  if (value == null) {
+    return value
+  }
+  session.state.passwordAutoAnswered = true
+  if (value) {
+    session.setCachedPassword(value)
+  }
+  return value
+}
diff --git a/src/main/ssh/ssh-orphan-relay-pty-sweep.test.ts b/src/main/ssh/ssh-orphan-relay-pty-sweep.test.ts
index afb365c075c9..7a503f518677 100644
--- a/src/main/ssh/ssh-orphan-relay-pty-sweep.test.ts
+++ b/src/main/ssh/ssh-orphan-relay-pty-sweep.test.ts
@@ -214,7 +214,7 @@ describe('sweepOrphanedRelayPtys', () => {
       clearBindingsForTarget: () => {},
       clearBindingsForLeases: () => false,
       flush: () => {},
-      flushDurableStateOrThrowAsync: async () => {}
+      runDurableMutation: async (mutate) => mutate().value
     }
     // The same pane re-leases under a new relay id; pty-1 is expired, never terminated.
     upsertSshRemotePtyLease(operations, {
diff --git a/src/main/ssh/ssh-pty-consumer-recovery.ts b/src/main/ssh/ssh-pty-consumer-recovery.ts
index db49a45c399c..727f293b5728 100644
--- a/src/main/ssh/ssh-pty-consumer-recovery.ts
+++ b/src/main/ssh/ssh-pty-consumer-recovery.ts
@@ -96,10 +96,7 @@ export async function removeSshPtyConsumerOwnerRecovery(
   clientInstanceId: string,
   store: Store
 ): Promise<void> {
-  const persisted = store.getSshPtyConsumerRecovery(targetId)
-  if (persisted?.clientInstanceId === clientInstanceId) {
-    await store.removeSshPtyConsumerRecovery(targetId)
-  }
+  await store.removeSshPtyConsumerRecovery(targetId, clientInstanceId)
 }
 
 export function detachSshPtyConsumerRecovery(targetId: string, clientInstanceId: string): void {
diff --git a/src/main/ssh/ssh-relay-cross-version-isolation.test.ts b/src/main/ssh/ssh-relay-cross-version-isolation.test.ts
index acda3bf0d697..be66463206a7 100644
--- a/src/main/ssh/ssh-relay-cross-version-isolation.test.ts
+++ b/src/main/ssh/ssh-relay-cross-version-isolation.test.ts
@@ -45,6 +45,10 @@ vi.mock('./ssh-remote-node-resolution', () => ({
   resolveRemoteNodePath: vi.fn().mockResolvedValue('/usr/bin/node')
 }))
 
+vi.mock('./ssh-relay-opencode-runtime', () => ({
+  ensureRemoteOpenCodeRuntime: vi.fn().mockResolvedValue('not-needed')
+}))
+
 vi.mock('./ssh-relay-install-marker', async (importOriginal) => ({
   ...(await importOriginal<typeof RelayInstallMarkerModule>()),
   createRelayInstallMarkerFileName: () => '.sftp-namespace-00000000000000000000000000000000'
diff --git a/src/main/ssh/ssh-relay-deploy-incumbent-verdict.test.ts b/src/main/ssh/ssh-relay-deploy-incumbent-verdict.test.ts
index ef90e829f7b7..4826f3c4dcc2 100644
--- a/src/main/ssh/ssh-relay-deploy-incumbent-verdict.test.ts
+++ b/src/main/ssh/ssh-relay-deploy-incumbent-verdict.test.ts
@@ -1,5 +1,8 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
+vi.mock('./ssh-relay-opencode-runtime', () => ({
+  ensureRemoteOpenCodeRuntime: vi.fn().mockResolvedValue('ready')
+}))
 vi.mock('./ssh-relay-ripgrep-install', () => ({
   remoteRipgrepLayout: vi.fn().mockReturnValue(null),
   recordRemoteRipgrepReference: vi.fn().mockResolvedValue(false),
@@ -64,6 +67,7 @@ vi.mock('./ssh-relay-superseded-endpoints', () => ({
   sweepSupersededRelayEndpoints: vi.fn().mockResolvedValue([])
 }))
 import { sweepSupersededRelayEndpoints } from './ssh-relay-superseded-endpoints'
+import { ensureRemoteOpenCodeRuntime } from './ssh-relay-opencode-runtime'
 import { gcOldRelayVersions } from './ssh-relay-versioned-install'
 import { deployAndLaunchRelay } from './ssh-relay-deploy'
 import { execCommand, waitForSentinel } from './ssh-relay-deploy-helpers'
@@ -198,10 +202,18 @@ describe('deployAndLaunchRelay honours the incumbent verdict', () => {
         onClose: vi.fn()
       })
       vi.mocked(sweepSupersededRelayEndpoints).mockRejectedValueOnce(error)
-      await deployAndLaunchRelay(makeMockConnection())
+      vi.mocked(ensureRemoteOpenCodeRuntime).mockResolvedValueOnce('not-needed')
+      const result = await deployAndLaunchRelay(makeMockConnection())
       await vi.waitFor(() => expect(sweepSupersededRelayEndpoints).toHaveBeenCalledOnce())
       await new Promise((resolve) => setImmediate(resolve))
       expect(gcOldRelayVersions).toHaveBeenCalledTimes(expectedGcCalls)
+      const now = vi.spyOn(Date, 'now').mockReturnValue(Date.now() + 120_000)
+      try {
+        await result.prepareOpenCodeRuntime?.(new AbortController().signal)
+        expect(ensureRemoteOpenCodeRuntime).toHaveBeenCalledTimes(expectedGcCalls + 1)
+      } finally {
+        now.mockRestore()
+      }
     }
   )
 })
diff --git a/src/main/ssh/ssh-relay-deploy-staged-upload.test.ts b/src/main/ssh/ssh-relay-deploy-staged-upload.test.ts
index 467ddc5f7888..26ba5a2d9906 100644
--- a/src/main/ssh/ssh-relay-deploy-staged-upload.test.ts
+++ b/src/main/ssh/ssh-relay-deploy-staged-upload.test.ts
@@ -52,6 +52,9 @@ vi.mock('./ssh-remote-node-resolution', () => ({
 // Why: the post-launch ripgrep install is fire-and-forget and would drain the queued exec mocks.
 // Why: the post-launch ripgrep cache GC is fire-and-forget and would drain the queued exec mocks.
 vi.mock('./ssh-relay-ripgrep-cache-gc', () => ({ gcRemoteRipgrepCache: vi.fn() }))
+vi.mock('./ssh-relay-opencode-runtime', () => ({
+  ensureRemoteOpenCodeRuntime: vi.fn().mockResolvedValue('ready')
+}))
 vi.mock('./ssh-relay-ripgrep-install', async (importOriginal) => ({
   ...(await importOriginal<typeof RelayRipgrepInstallModule>()),
   ensureRemoteBundledRipgrep: vi.fn().mockResolvedValue('present'),
@@ -320,6 +323,70 @@ describe('deployAndLaunchRelay staged uploads', () => {
     expect(uploadStageRemovals[0]).toContain('/.orca-remote/.upload-stages/claim-0')
   })
 
+  it.each(['lock acquisition', 'locked recheck'])(
+    'preserves the stage after uncertain %s termination',
+    async (phase) => {
+      const conn = makeMockConnection()
+      const error = Object.assign(new Error('install command still running'), {
+        sshChannelCloseConfirmed: false
+      })
+      vi.mocked(isRelayAlreadyInstalled).mockResolvedValueOnce(false)
+      if (phase === 'lock acquisition') {
+        vi.mocked(acquireInstallLock).mockRejectedValueOnce(error)
+      } else {
+        vi.mocked(isRelayAlreadyInstalled).mockRejectedValueOnce(error)
+      }
+      vi.mocked(execCommand).mockImplementation(async (_conn, command) => {
+        if (command.includes('uname')) {
+          return '__ORCA_REMOTE_PLATFORM__ Linux x86_64'
+        }
+        if (command === 'echo $HOME') {
+          return '/home/user'
+        }
+        return stageCommandResponse(command) ?? ''
+      })
+      conn.writeFile = vi.fn().mockResolvedValue(undefined)
+      conn.uploadDirectory = vi.fn().mockResolvedValue(undefined)
+
+      await expect(deployAndLaunchRelay(conn)).rejects.toBe(error)
+      expect(
+        vi
+          .mocked(execCommand)
+          .mock.calls.some(
+            ([, command]) =>
+              /\.sftp-namespace-[0-9a-f]{32}/u.test(command) && command.includes('rm -rf')
+          )
+      ).toBe(false)
+      expect(conn.exec).not.toHaveBeenCalled()
+    }
+  )
+
+  it('stops before launch when owned-stage cleanup cannot confirm termination', async () => {
+    const conn = makeMockConnection()
+    const error = Object.assign(new Error('stage removal still running'), {
+      sshChannelCloseConfirmed: false
+    })
+    vi.mocked(isRelayAlreadyInstalled).mockResolvedValueOnce(false).mockResolvedValueOnce(true)
+    vi.mocked(execCommand).mockImplementation(async (_conn, command) => {
+      if (/\.sftp-namespace-[0-9a-f]{32}/u.test(command) && command.includes('rm -rf')) {
+        throw error
+      }
+      if (command.includes('uname')) {
+        return '__ORCA_REMOTE_PLATFORM__ Linux x86_64'
+      }
+      if (command === 'echo $HOME') {
+        return '/home/user'
+      }
+      return stageCommandResponse(command) ?? ''
+    })
+    conn.writeFile = vi.fn().mockResolvedValue(undefined)
+    conn.uploadDirectory = vi.fn().mockResolvedValue(undefined)
+
+    await expect(deployAndLaunchRelay(conn)).rejects.toBe(error)
+    expect(conn.exec).not.toHaveBeenCalled()
+    expect(ensureRemoteBundledRipgrep).not.toHaveBeenCalled()
+  })
+
   it('runs bounded fixed-path recovery before a fresh upload', async () => {
     const conn = makeMockConnection()
     const events: string[] = []
@@ -399,6 +466,7 @@ describe('deployAndLaunchRelay staged uploads', () => {
       await deployAndLaunchRelay(conn)
     }
 
+    await vi.waitFor(() => expect(events).toHaveLength(24))
     expect(events).toEqual(Array.from({ length: 12 }, () => ['launch-ready', 'recover']).flat())
     const commands = vi.mocked(execCommand).mock.calls.map(([, command]) => command)
     const recoveryCommands = commands.filter((command) => command.includes('deleting_old='))
@@ -575,12 +643,15 @@ describe('deployAndLaunchRelay staged uploads', () => {
     await deployAndLaunchRelay(conn)
     expect(conn.uploadDirectory).toHaveBeenCalledTimes(2)
   })
-  // Why: a cold host's rg upload is a multi-MB transfer. While the cleanup sweep was chained
-  // behind it, stale upload stages and superseded version dirs sat on the remote for that whole
-  // duration. A never-settling install stands in for that transfer.
-  it('sweeps stale upload stages without waiting for the ripgrep upload', async () => {
+  it('returns the relay before ripgrep finishes but defers stale-stage cleanup', async () => {
     const conn = makeMockConnection()
-    vi.mocked(ensureRemoteBundledRipgrep).mockReturnValueOnce(new Promise(() => {}))
+    let finishUpload = (): void => {}
+    vi.mocked(ensureRemoteBundledRipgrep).mockImplementationOnce(
+      () =>
+        new Promise((resolve) => {
+          finishUpload = () => resolve('present')
+        })
+    )
     let socketProbe = 0
     vi.mocked(execCommand).mockImplementation((_conn, command) => {
       if (command.includes('uname')) {
@@ -595,7 +666,15 @@ describe('deployAndLaunchRelay staged uploads', () => {
       return Promise.resolve('')
     })
 
-    await deployAndLaunchRelay(conn)
+    const deployed = await deployAndLaunchRelay(conn)
+    expect(deployed.transport).toBeDefined()
+    await new Promise<void>((resolve) => setImmediate(resolve))
+    expect(
+      vi
+        .mocked(execCommand)
+        .mock.calls.some(([, command]) => command.includes(RELAY_UPLOAD_STAGE_POOL_NAME))
+    ).toBe(false)
+    finishUpload()
 
     await vi.waitFor(() => {
       const commands = vi.mocked(execCommand).mock.calls.map(([, command]) => command)
diff --git a/src/main/ssh/ssh-relay-deploy-windows-pipe.test.ts b/src/main/ssh/ssh-relay-deploy-windows-pipe.test.ts
index 4c9132341175..1a49ec115901 100644
--- a/src/main/ssh/ssh-relay-deploy-windows-pipe.test.ts
+++ b/src/main/ssh/ssh-relay-deploy-windows-pipe.test.ts
@@ -64,6 +64,9 @@ vi.mock('../ripgrep/bundled-ripgrep-path', () => ({
 // Why: the fire-and-forget ripgrep install would drain the queued exec mocks.
 // Why: the post-launch ripgrep cache GC is fire-and-forget and would drain the queued exec mocks.
 vi.mock('./ssh-relay-ripgrep-cache-gc', () => ({ gcRemoteRipgrepCache: vi.fn() }))
+vi.mock('./ssh-relay-opencode-runtime', () => ({
+  ensureRemoteOpenCodeRuntime: vi.fn().mockResolvedValue('ready')
+}))
 vi.mock('./ssh-relay-ripgrep-install', async (importOriginal) => ({
   ...(await importOriginal<typeof RelayRipgrepInstallModule>()),
   ensureRemoteBundledRipgrep: vi.fn().mockResolvedValue('present'),
@@ -310,6 +313,7 @@ describe('deployAndLaunchRelay on Windows remotes', () => {
       .mockResolvedValueOnce('')
       .mockResolvedValueOnce('READY')
       .mockResolvedValueOnce('') // persist active pipe A
+      .mockResolvedValueOnce('') // deferred stale-stage cleanup A
       .mockRejectedValueOnce(new Error('uname not found')) // tagged POSIX platform probe B
       .mockResolvedValueOnce('__ORCA_REMOTE_PLATFORM__ Windows X64')
       .mockResolvedValueOnce('C:\\Users\\me user')
@@ -321,6 +325,7 @@ describe('deployAndLaunchRelay on Windows remotes', () => {
       .mockResolvedValueOnce('') // persist active pipe B
 
     await deployAndLaunchRelay(connA, undefined, 300, 'target-a')
+    await new Promise<void>((resolve) => setImmediate(resolve))
     await deployAndLaunchRelay(connB, undefined, 300, 'target-b')
 
     const markerPaths = mockExecCommand.mock.calls
diff --git a/src/main/ssh/ssh-relay-deploy.test.ts b/src/main/ssh/ssh-relay-deploy.test.ts
index f2fdaee4ed2b..27a70f60fdb7 100644
--- a/src/main/ssh/ssh-relay-deploy.test.ts
+++ b/src/main/ssh/ssh-relay-deploy.test.ts
@@ -62,6 +62,9 @@ vi.mock('../ripgrep/bundled-ripgrep-path', () => ({
 // Why: the fire-and-forget ripgrep install would drain the queued exec mocks.
 // Why: the post-launch ripgrep cache GC is fire-and-forget and would drain the queued exec mocks.
 vi.mock('./ssh-relay-ripgrep-cache-gc', () => ({ gcRemoteRipgrepCache: vi.fn() }))
+vi.mock('./ssh-relay-opencode-runtime', () => ({
+  ensureRemoteOpenCodeRuntime: vi.fn().mockResolvedValue('ready')
+}))
 vi.mock('./ssh-relay-ripgrep-install', async (importOriginal) => ({
   ...(await importOriginal<typeof RelayRipgrepInstallModule>()),
   ensureRemoteBundledRipgrep: vi.fn().mockResolvedValue('present'),
@@ -97,6 +100,7 @@ vi.mock('./ssh-connection-utils', () => ({
 }))
 
 import { deployAndLaunchRelay } from './ssh-relay-deploy'
+import { ensureRemoteOpenCodeRuntime } from './ssh-relay-opencode-runtime'
 import { execCommand, waitForSentinel } from './ssh-relay-deploy-helpers'
 import { resolveRemoteNodePath } from './ssh-remote-node-resolution'
 import { isRelayAlreadyInstalled, gcOldRelayVersions } from './ssh-relay-versioned-install'
@@ -105,6 +109,7 @@ import {
   ensureRemoteBundledRipgrep,
   recordRemoteRipgrepReference
 } from './ssh-relay-ripgrep-install'
+import { gcRemoteRipgrepCache } from './ssh-relay-ripgrep-cache-gc'
 import * as DeployTiming from './ssh-relay-deploy-timing'
 import type { SshConnection } from './ssh-connection'
 import type * as SshRemoteNodeResolution from './ssh-remote-node-resolution'
@@ -162,6 +167,7 @@ function detachedLaunchCommand(conn: SshConnection): string | undefined {
 describe('deployAndLaunchRelay', () => {
   beforeEach(() => {
     vi.clearAllMocks()
+    vi.mocked(ensureRemoteOpenCodeRuntime).mockReset().mockResolvedValue('ready')
     vi.mocked(execCommand).mockReset().mockResolvedValue('__ORCA_REMOTE_PLATFORM__ Linux x86_64')
     vi.mocked(waitForSentinel).mockReset().mockResolvedValue({
       write: vi.fn(),
@@ -445,24 +451,35 @@ describe('deployAndLaunchRelay', () => {
     expect(resolveRemoteNodePath).toHaveBeenCalledTimes(1)
   })
 
-  it('does not retry when a session-limit failure races with a real install-state failure', async () => {
-    const conn = makeMockConnection()
-    const mockExecCommand = vi.mocked(execCommand)
-    const sessionLimitError = Object.assign(new Error('(SSH) Channel open failure: open failed'), {
-      reason: 4
-    })
-    const installError = new Error('permission denied while checking relay install')
-    vi.mocked(resolveRemoteNodePath).mockRejectedValueOnce(sessionLimitError)
-    vi.mocked(isRelayAlreadyInstalled).mockRejectedValueOnce(installError)
-    mockExecCommand.mockResolvedValueOnce('__ORCA_REMOTE_PLATFORM__ Linux x86_64') // tagged POSIX platform probe
-    mockExecCommand.mockResolvedValueOnce('/home/user') // concurrent install-state $HOME
-
-    await expect(deployAndLaunchRelay(conn)).rejects.toBe(installError)
-    expect(isRelayAlreadyInstalled).toHaveBeenCalledTimes(1)
-    expect(resolveRemoteNodePath).toHaveBeenCalledTimes(1)
-  })
+  it.each([false, true])(
+    'does not retry after a sibling failure (unconfirmed abort: %s)',
+    async (unconfirmed) => {
+      const conn = makeMockConnection()
+      const mockExecCommand = vi.mocked(execCommand)
+      const sessionLimitError = Object.assign(
+        new Error('(SSH) Channel open failure: open failed'),
+        {
+          reason: 4
+        }
+      )
+      const installError = unconfirmed
+        ? Object.assign(new Error('probe still running'), {
+            name: 'AbortError',
+            sshChannelCloseConfirmed: false
+          })
+        : new Error('permission denied while checking relay install')
+      vi.mocked(resolveRemoteNodePath).mockRejectedValueOnce(sessionLimitError)
+      vi.mocked(isRelayAlreadyInstalled).mockRejectedValueOnce(installError)
+      mockExecCommand.mockResolvedValueOnce('__ORCA_REMOTE_PLATFORM__ Linux x86_64') // tagged POSIX platform probe
+      mockExecCommand.mockResolvedValueOnce('/home/user') // concurrent install-state $HOME
+
+      await expect(deployAndLaunchRelay(conn)).rejects.toBe(installError)
+      expect(isRelayAlreadyInstalled).toHaveBeenCalledTimes(1)
+      expect(resolveRemoteNodePath).toHaveBeenCalledTimes(1)
+    }
+  )
 
-  it('does not retry until the surviving first-attempt probe settles', async () => {
+  it('lets the surviving probe finish before retrying a refused SSH session', async () => {
     const conn = makeMockConnection()
     const mockExecCommand = vi.mocked(execCommand)
     const sessionLimitError = Object.assign(new Error('(SSH) Channel open failure: open failed'), {
@@ -471,13 +488,19 @@ describe('deployAndLaunchRelay', () => {
     mockExecCommand.mockResolvedValueOnce('__ORCA_REMOTE_PLATFORM__ Linux x86_64') // tagged POSIX platform probe
     let releaseRemoteHome: (home: string) => void = () => {}
     let remoteHomeSettled = false
-    mockExecCommand.mockReturnValueOnce(
-      new Promise<string>((resolve) => {
-        releaseRemoteHome = (home: string) => {
-          remoteHomeSettled = true
-          resolve(home)
-        }
-      })
+    const cancelledProbe = Object.assign(new Error('system SSH probe cancellation unconfirmed'), {
+      name: 'AbortError',
+      sshChannelCloseConfirmed: false
+    })
+    mockExecCommand.mockImplementationOnce(
+      (_conn, _command, options) =>
+        new Promise<string>((resolve, reject) => {
+          options?.signal?.addEventListener('abort', () => reject(cancelledProbe), { once: true })
+          releaseRemoteHome = (home: string) => {
+            remoteHomeSettled = true
+            resolve(home)
+          }
+        })
     )
     vi.mocked(resolveRemoteNodePath).mockImplementationOnce(() => Promise.reject(sessionLimitError))
     vi.mocked(resolveRemoteNodePath).mockImplementationOnce(() => {
@@ -487,7 +510,7 @@ describe('deployAndLaunchRelay', () => {
       return Promise.resolve('/usr/bin/node')
     })
 
-    const deployPromise = deployAndLaunchRelay(conn)
+    const deployPromise = deployAndLaunchRelay(conn).catch((error: unknown) => error)
     await vi.waitFor(() => expect(resolveRemoteNodePath).toHaveBeenCalledTimes(1))
     await new Promise<void>((resolve) => setImmediate(resolve))
     expect(resolveRemoteNodePath).toHaveBeenCalledTimes(1)
@@ -497,7 +520,7 @@ describe('deployAndLaunchRelay', () => {
     queueLaunchNamespaceAndDeadSocketProbe()
     mockExecCommand.mockResolvedValueOnce('READY') // socket poll
     releaseRemoteHome('/home/user')
-    await deployPromise
+    await expect(deployPromise).resolves.toHaveProperty('transport')
     expect(resolveRemoteNodePath).toHaveBeenCalledTimes(2)
   })
 
@@ -525,11 +548,16 @@ describe('deployAndLaunchRelay', () => {
     expect(launchCommand).not.toContain('.pty-source-credit-policy')
   })
 
-  it.each([false, true])(
-    'waits for the ripgrep upload before cleanup (upload failure: %s)',
-    async (fails) => {
+  it.each([
+    [false, false],
+    [false, true],
+    [true, false],
+    [true, true]
+  ])(
+    'waits for ripgrep before cleanup (concurrent exec: %s, upload failure: %s)',
+    async (concurrent, fails) => {
       const conn = makeMockConnection()
-      vi.mocked(conn.canRunConcurrentExecCommands).mockReturnValue(false)
+      vi.mocked(conn.canRunConcurrentExecCommands).mockReturnValue(concurrent)
       queueFreshLinuxDeploy()
       let finishUpload = (): void => {}
       vi.mocked(ensureRemoteBundledRipgrep).mockImplementationOnce(
@@ -544,11 +572,36 @@ describe('deployAndLaunchRelay', () => {
       await new Promise<void>((resolve) => setImmediate(resolve))
       expect(execCommand).toHaveBeenCalledTimes(execCount)
       expect(gcOldRelayVersions).not.toHaveBeenCalled()
+      expect(ensureRemoteOpenCodeRuntime).toHaveBeenCalledTimes(concurrent ? 1 : 0)
       finishUpload()
       await vi.waitFor(() => expect(gcOldRelayVersions).toHaveBeenCalledOnce())
     }
   )
 
+  it.each([false, true])(
+    'waits for SQLite setup before cleanup (concurrent exec: %s)',
+    async (concurrent) => {
+      const conn = makeMockConnection()
+      vi.mocked(conn.canRunConcurrentExecCommands).mockReturnValue(concurrent)
+      queueFreshLinuxDeploy()
+      let finishSetup!: () => void
+      vi.mocked(ensureRemoteOpenCodeRuntime).mockImplementationOnce(
+        () =>
+          new Promise((resolve) => {
+            finishSetup = () => resolve('failed')
+          })
+      )
+      await deployAndLaunchRelay(conn)
+      await vi.waitFor(() => expect(ensureRemoteOpenCodeRuntime).toHaveBeenCalledOnce())
+      const execCount = vi.mocked(execCommand).mock.calls.length
+      await new Promise<void>((resolve) => setImmediate(resolve))
+      expect(execCommand).toHaveBeenCalledTimes(execCount)
+      expect(gcOldRelayVersions).not.toHaveBeenCalled()
+      finishSetup()
+      await vi.waitFor(() => expect(gcOldRelayVersions).toHaveBeenCalledOnce())
+    }
+  )
+
   it('does not launch or upload an unprotected binary when recording its reference fails', async () => {
     const conn = makeMockConnection()
     queueFreshLinuxDeploy()
@@ -558,6 +611,84 @@ describe('deployAndLaunchRelay', () => {
     expect(ensureRemoteBundledRipgrep).not.toHaveBeenCalled()
   })
 
+  it.each([false, true])(
+    'skips cleanup after unconfirmed SQLite teardown (concurrent exec: %s)',
+    async (concurrent) => {
+      const conn = makeMockConnection()
+      vi.mocked(conn.canRunConcurrentExecCommands).mockReturnValue(concurrent)
+      queueFreshLinuxDeploy()
+      vi.mocked(ensureRemoteOpenCodeRuntime).mockResolvedValueOnce('teardown-unconfirmed')
+      await deployAndLaunchRelay(conn)
+      await vi.waitFor(() => expect(ensureRemoteOpenCodeRuntime).toHaveBeenCalledOnce())
+      const execCount = vi.mocked(execCommand).mock.calls.length
+      await new Promise<void>((resolve) => setImmediate(resolve))
+      expect(execCommand).toHaveBeenCalledTimes(execCount)
+      expect(gcOldRelayVersions).not.toHaveBeenCalled()
+      expect(gcRemoteRipgrepCache).not.toHaveBeenCalled()
+    }
+  )
+
+  it('does not launch after an unconfirmed ripgrep reference write', async () => {
+    const conn = makeMockConnection()
+    queueFreshLinuxDeploy()
+    const error = Object.assign(new Error('reference write still running'), {
+      sshChannelCloseConfirmed: false
+    })
+    vi.mocked(recordRemoteRipgrepReference).mockRejectedValueOnce(error)
+
+    await expect(deployAndLaunchRelay(conn)).rejects.toBe(error)
+    expect(detachedLaunchCommand(conn)).toBeUndefined()
+    expect(ensureRemoteBundledRipgrep).not.toHaveBeenCalled()
+  })
+
+  it.each([false, true])(
+    'blocks cleanup and runtime retry after uncertain ripgrep teardown (concurrent exec: %s)',
+    async (concurrent) => {
+      const conn = makeMockConnection()
+      vi.mocked(conn.canRunConcurrentExecCommands).mockReturnValue(concurrent)
+      queueFreshLinuxDeploy()
+      vi.mocked(ensureRemoteBundledRipgrep).mockRejectedValueOnce(
+        Object.assign(new Error('upload still running'), { sshChannelCloseConfirmed: false })
+      )
+      vi.mocked(ensureRemoteOpenCodeRuntime).mockResolvedValue('failed')
+      const deployed = await deployAndLaunchRelay(conn)
+      await new Promise<void>((resolve) => setImmediate(resolve))
+      expect(gcOldRelayVersions).not.toHaveBeenCalled()
+      expect(gcRemoteRipgrepCache).not.toHaveBeenCalled()
+      const execCount = vi.mocked(execCommand).mock.calls.length
+      const clock = vi.spyOn(Date, 'now').mockReturnValue(Date.now() + 60_001)
+      try {
+        await deployed.prepareOpenCodeRuntime?.(new AbortController().signal)
+        expect(ensureRemoteOpenCodeRuntime).toHaveBeenCalledTimes(concurrent ? 1 : 0)
+        expect(execCommand).toHaveBeenCalledTimes(execCount)
+      } finally {
+        clock.mockRestore()
+      }
+    }
+  )
+
+  it.each([false, true])(
+    'gates later cache cleanup and runtime retry on GC termination (confirmed: %s)',
+    async (confirmed) => {
+      const conn = makeMockConnection()
+      queueFreshLinuxDeploy()
+      vi.mocked(ensureRemoteOpenCodeRuntime).mockResolvedValueOnce('failed')
+      vi.mocked(gcOldRelayVersions).mockRejectedValueOnce(
+        Object.assign(new Error('GC interrupted'), { sshChannelCloseConfirmed: confirmed })
+      )
+      const deployed = await deployAndLaunchRelay(conn)
+      await vi.waitFor(() => expect(gcOldRelayVersions).toHaveBeenCalledOnce())
+      expect(gcRemoteRipgrepCache).not.toHaveBeenCalled()
+      const clock = vi.spyOn(Date, 'now').mockReturnValue(Date.now() + 60_001)
+      try {
+        await deployed.prepareOpenCodeRuntime?.(new AbortController().signal)
+        expect(ensureRemoteOpenCodeRuntime).toHaveBeenCalledTimes(confirmed ? 2 : 1)
+      } finally {
+        clock.mockRestore()
+      }
+    }
+  )
+
   it('allows an unlimited SSH disconnect grace window', async () => {
     const conn = makeMockConnection()
     queueFreshLinuxDeploy()
diff --git a/src/main/ssh/ssh-relay-deploy.ts b/src/main/ssh/ssh-relay-deploy.ts
index aab5e6c39d30..4424adc0c011 100644
--- a/src/main/ssh/ssh-relay-deploy.ts
+++ b/src/main/ssh/ssh-relay-deploy.ts
@@ -1,7 +1,7 @@
-import { join } from 'node:path'
 /* eslint-disable max-lines -- Why: one cohesive contract (version detect, install-locked deploy, native-deps probe, launch, GC); splitting risks install/GC drift. */
 import { existsSync } from 'node:fs'
 import { app } from 'electron'
+import { relayBundleCandidates } from './relay-bundle-paths'
 import type { SshConnection } from './ssh-connection'
 import { RELAY_REMOTE_DIR, type RelayPlatform } from './relay-protocol'
 import type { MultiplexerTransport } from './ssh-channel-multiplexer'
@@ -30,6 +30,11 @@ import {
   recordRemoteRipgrepReference
 } from './ssh-relay-ripgrep-install'
 import { gcRemoteRipgrepCache } from './ssh-relay-ripgrep-cache-gc'
+import { ensureRemoteOpenCodeRuntime } from './ssh-relay-opencode-runtime'
+import {
+  createRemoteOpenCodeRuntimeRetry,
+  type RemoteOpenCodeRuntimePreparation
+} from './ssh-relay-opencode-runtime-retry'
 import {
   readLocalFullVersion,
   computeRemoteRelayDir,
@@ -131,6 +136,7 @@ export type RelayDeployResult = {
   nodePath?: string
   sockPath?: string
   credentialFile?: string
+  prepareOpenCodeRuntime?: RemoteOpenCodeRuntimePreparation
 }
 
 class RelayDirectoryGcConflictError extends Error {
@@ -322,8 +328,17 @@ async function resolveRelayBootstrapState(
     signal?.throwIfAborted()
     return { ...installState, nodePath }
   } catch (err) {
-    abortController.abort()
+    // Let an admitted probe finish before retrying a refused parallel session.
+    if (!isSshSessionLimitError(err)) {
+      abortController.abort()
+    }
     const settled = await Promise.allSettled([installStatePromise, nodePathPromise])
+    const unconfirmed = settled.find(
+      (result) => result.status === 'rejected' && isUnconfirmedSshCommandTermination(result.reason)
+    )
+    if (unconfirmed?.status === 'rejected') {
+      throw unconfirmed.reason
+    }
     signal?.throwIfAborted()
     if (!isSshSessionLimitError(err)) {
       throw err
@@ -477,32 +492,18 @@ async function deployAndLaunchRelayAttempt(
     onProgress?.('Uploading relay...')
     console.log('[ssh-relay] Uploading relay...')
     try {
-      try {
-        await uploadRelay(
-          conn,
-          platform,
-          uploadStagePayloadDir,
-          fullVersion,
-          hostPlatform,
-          deploySignal,
-          { rootDir: uploadStage.slotDir, namespace: uploadStageSftpNamespace }
-        )
-      } catch (err) {
-        if (isUnconfirmedSshCommandTermination(err)) {
-          uploadStageCleanupAllowed = false
-        }
-        throw err
-      }
+      await uploadRelay(
+        conn,
+        platform,
+        uploadStagePayloadDir,
+        fullVersion,
+        hostPlatform,
+        deploySignal,
+        { rootDir: uploadStage.slotDir, namespace: uploadStageSftpNamespace }
+      )
 
-      try {
-        await acquireInstallLock(conn, remoteRelayDir, hostPlatform, { signal: deploySignal })
-        ownsInstallLock = true
-      } catch (err) {
-        if (isUnconfirmedSshCommandTermination(err)) {
-          ownsInstallLock = true
-        }
-        throw err
-      }
+      await acquireInstallLock(conn, remoteRelayDir, hostPlatform, { signal: deploySignal })
+      ownsInstallLock = true
       try {
         // Re-probe after acquiring the lock — a sibling installer may have finished while we waited.
         if (
@@ -517,26 +518,19 @@ async function deployAndLaunchRelayAttempt(
             homeRelativeRelayDir,
             deploySignal
           )
-          try {
-            const promotion = await execHostCommand(
-              conn,
+          const promotion = await execHostCommand(
+            conn,
+            hostPlatform,
+            promoteOwnedRelayUploadStageCommand(
               hostPlatform,
-              promoteOwnedRelayUploadStageCommand(
-                hostPlatform,
-                uploadStage,
-                uploadStageOwner,
-                remoteRelayDir
-              ),
-              { signal: deploySignal }
-            )
-            if (!relayUploadStagePromotionConfirmed(uploadStageOwner, promotion)) {
-              throw new Error('Relay upload stage ownership was lost before promotion')
-            }
-          } catch (err) {
-            if (isUnconfirmedSshCommandTermination(err)) {
-              uploadStageCleanupAllowed = false
-            }
-            throw err
+              uploadStage,
+              uploadStageOwner,
+              remoteRelayDir
+            ),
+            { signal: deploySignal }
+          )
+          if (!relayUploadStagePromotionConfirmed(uploadStageOwner, promotion)) {
+            throw new Error('Relay upload stage ownership was lost before promotion')
           }
           console.log('[ssh-relay] Upload complete')
 
@@ -568,13 +562,20 @@ async function deployAndLaunchRelayAttempt(
         }
         throw err
       }
+    } catch (error) {
+      uploadStageCleanupAllowed = !isUnconfirmedSshCommandTermination(error)
+      throw error
     } finally {
       if (uploadStageCleanupAllowed) {
         await execHostCommand(
           conn,
           hostPlatform,
           cleanupOwnedRelayUploadStageCommand(hostPlatform, uploadStage, uploadStageOwner)
-        ).catch(() => {})
+        ).catch((error) => {
+          if (isUnconfirmedSshCommandTermination(error)) {
+            throw error
+          }
+        })
       }
     }
   }
@@ -588,95 +589,135 @@ async function deployAndLaunchRelayAttempt(
       remoteRelayDir,
       ripgrepLayout.entryName
     ))
-  let launched: Awaited<ReturnType<typeof launchRelay>>
-  let launchLivenessObserved = false
+  deploySignal?.throwIfAborted()
+  onProgress?.('Starting relay...')
+  console.log('[ssh-relay] Launching relay...')
+  // A failed launch retains its fences until stale recovery can establish liveness.
+  const launched = await launchRelay(
+    conn,
+    remoteRelayDir,
+    hostPlatform,
+    nodePath,
+    graceTimeSeconds,
+    relayInstanceId,
+    deploySignal,
+    ripgrepReferenced ? ripgrepLayout.binaryPath : undefined
+  )
+  let launchCleanupSettled = true
   try {
-    deploySignal?.throwIfAborted()
-    onProgress?.('Starting relay...')
-    console.log('[ssh-relay] Launching relay...')
-    launched = await launchRelay(
-      conn,
-      remoteRelayDir,
-      hostPlatform,
-      nodePath,
-      graceTimeSeconds,
-      relayInstanceId,
-      deploySignal,
-      ripgrepReferenced ? ripgrepLayout.binaryPath : undefined
-    )
-    launchLivenessObserved = true
-  } finally {
-    // Why: older clients understand only the install lock; if launch never goes live, keep it so their GC can't race a caller waiting behind this owner.
-    if (ownsInstallLock && launchLivenessObserved) {
+    if (ownsInstallLock) {
       await abandonInstall(conn, remoteRelayDir, hostPlatform)
     }
-    // The detached start may outlive a timed-out SSH command; keep the fence on failed launch until stale recovery proves the handoff ended.
-    if (launchGcClaimToken && launchLivenessObserved) {
+    if (launchGcClaimToken) {
       await releaseRelayGcClaimWithRetry(conn, remoteRelayDir, launchGcClaimToken, hostPlatform)
     }
+  } catch (error) {
+    // Keep the connected transport, but stop optional commands after uncertain fence release.
+    launchCleanupSettled = !isUnconfirmedSshCommandTermination(error)
+    console.warn('[ssh-relay] Launch fence release failed:', error)
   }
   console.log('[ssh-relay] Relay started successfully')
 
   // Keep background commands serial for SSH transports that allow only one exec at a time.
   const ripgrepEntry = ripgrepLayout?.entryName
   const ripgrepInstall = (
-    ripgrepReferenced
+    ripgrepReferenced && launchCleanupSettled
       ? ensureRemoteBundledRipgrep(conn, hostPlatform, remoteHome, { signal: deploySignal })
       : Promise.resolve()
-  ).catch(() => {})
-  const cleanupReady = conn.canRunConcurrentExecCommands() ? Promise.resolve() : ripgrepInstall
+  ).then(
+    () => launchCleanupSettled,
+    (error) => !isUnconfirmedSshCommandTermination(error)
+  )
+  const runtimeInstall = (
+    conn.canRunConcurrentExecCommands() ? Promise.resolve(launchCleanupSettled) : ripgrepInstall
+  )
+    .then((ripgrepSettled) =>
+      ripgrepSettled
+        ? ensureRemoteOpenCodeRuntime(conn, hostPlatform, remoteHome, {
+            nodePath: launched.nodePath,
+            relayDir: remoteRelayDir,
+            signal: deploySignal
+          })
+        : ('teardown-unconfirmed' as const)
+    )
+    .catch(() => 'teardown-unconfirmed' as const)
 
-  void cleanupReady
-    .then(() =>
+  const cleanupReady = Promise.all([ripgrepInstall, runtimeInstall]).then(
+    ([ripgrepSettled, runtimeOutcome]) =>
+      ripgrepSettled && runtimeOutcome !== 'teardown-unconfirmed'
+  )
+  const backgroundCleanup = cleanupReady.then((ready) => {
+    if (!ready) {
+      return false
+    }
+    return (
       execHostCommand(
         conn,
         hostPlatform,
         recoverOneStaleRelayUploadStageCommand(hostPlatform, uploadStagePoolDir)
       )
-    )
-    .catch(() => {})
-    // Why before GC: a superseded relay pins its version dir via the live-socket probe, so the
-    // sweep has to settle first or GC keeps every orphan's tree forever.
-    .then(() =>
-      sweepSupersededRelayEndpoints(conn, hostPlatform, {
-        remoteHome,
-        currentRelayDir: remoteRelayDir,
-        sockName: relaySocketNameForInstanceId(relayInstanceId),
-        // Set only when this launch relocated past sun_path; the sweep must not reap
-        // the socket the transport it just handed back is talking to.
-        ...(launched.sockPath.startsWith(SHORT_RELAY_SOCKET_DIR_PREFIX)
-          ? {
-              currentShortSocketDir: launched.sockPath.slice(0, launched.sockPath.lastIndexOf('/'))
-            }
-          : {}),
-        nodePath: launched.nodePath
-      })
-    )
-    .catch((error) => {
-      if (error instanceof RelayProbeCleanupUnconfirmedError) {
-        throw error
-      }
-    })
-    .then(() =>
-      gcOldRelayVersions(conn, remoteHome, remoteRelayDir, hostPlatform, {
-        windowsNodePath: launched.nodePath,
-        windowsSockNames: [relaySocketNameForInstanceId(relayInstanceId)],
-        // Why pin rather than rely on the symlink alone: a deploy that fell back to a
-        // per-directory install has no reference to show, and its key must still survive.
-        nativeDepsCacheKeys: [
-          resolveRelayNativeDepsCacheKey({
-            platform,
-            localRelayDir,
-            deps: RELAY_NATIVE_DEPS
+        .catch((error) => {
+          if (isUnconfirmedSshCommandTermination(error)) {
+            throw error
+          }
+        })
+        // Why before GC: a superseded relay pins its version dir via the live-socket probe, so the
+        // sweep has to settle first or GC keeps every orphan's tree forever.
+        .then(() =>
+          sweepSupersededRelayEndpoints(conn, hostPlatform, {
+            remoteHome,
+            currentRelayDir: remoteRelayDir,
+            sockName: relaySocketNameForInstanceId(relayInstanceId),
+            // Set only when this launch relocated past sun_path; the sweep must not reap
+            // the socket the transport it just handed back is talking to.
+            ...(launched.sockPath.startsWith(SHORT_RELAY_SOCKET_DIR_PREFIX)
+              ? {
+                  currentShortSocketDir: launched.sockPath.slice(
+                    0,
+                    launched.sockPath.lastIndexOf('/')
+                  )
+                }
+              : {}),
+            nodePath: launched.nodePath
           })
-        ].filter((key): key is string => key !== null)
-      })
+        )
+        .catch((error) => {
+          if (
+            error instanceof RelayProbeCleanupUnconfirmedError ||
+            isUnconfirmedSshCommandTermination(error)
+          ) {
+            throw error
+          }
+        })
+        .then(() =>
+          gcOldRelayVersions(conn, remoteHome, remoteRelayDir, hostPlatform, {
+            windowsNodePath: launched.nodePath,
+            windowsSockNames: [relaySocketNameForInstanceId(relayInstanceId)],
+            // Why pin rather than rely on the symlink alone: a deploy that fell back to a
+            // per-directory install has no reference to show, and its key must still survive.
+            nativeDepsCacheKeys: [
+              resolveRelayNativeDepsCacheKey({
+                platform,
+                localRelayDir,
+                deps: RELAY_NATIVE_DEPS
+              })
+            ].filter((key): key is string => key !== null)
+          })
+        )
+        // Why after the version GC and not beside it: that pass is what removes the relay directories
+        // holding the references, so running second is what lets a superseded build become collectable
+        // in the same connect rather than the next one.
+        .then(() =>
+          gcRemoteRipgrepCache(conn, hostPlatform, remoteHome, { pinnedEntry: ripgrepEntry })
+        )
+        .then(() => true)
+        .catch(
+          (error) =>
+            !(error instanceof RelayProbeCleanupUnconfirmedError) &&
+            !isUnconfirmedSshCommandTermination(error)
+        )
     )
-    // Why after the version GC and not beside it: that pass is what removes the relay directories
-    // holding the references, so running second is what lets a superseded build become collectable
-    // in the same connect rather than the next one.
-    .then(() => gcRemoteRipgrepCache(conn, hostPlatform, remoteHome, { pinnedEntry: ripgrepEntry }))
-    .catch(() => {})
+  })
 
   return {
     transport: launched.transport,
@@ -687,7 +728,17 @@ async function deployAndLaunchRelayAttempt(
     remoteRelayDir,
     nodePath: launched.nodePath,
     sockPath: launched.sockPath,
-    credentialFile: launched.credentialFile
+    credentialFile: launched.credentialFile,
+    prepareOpenCodeRuntime: createRemoteOpenCodeRuntimeRetry(
+      runtimeInstall,
+      backgroundCleanup,
+      (signal) =>
+        ensureRemoteOpenCodeRuntime(conn, hostPlatform, remoteHome, {
+          nodePath: launched.nodePath,
+          relayDir: remoteRelayDir,
+          signal
+        })
+    )
   }
 }
 
@@ -964,7 +1015,9 @@ async function repairInstalledNativeDeps(
         signal
       })
     } catch (err) {
-      await abandonInstall(conn, remoteDir, hostPlatform)
+      if (!isUnconfirmedSshCommandTermination(err)) {
+        await abandonInstall(conn, remoteDir, hostPlatform)
+      }
       throw err
     }
     if (!stillInstalled) {
@@ -1111,7 +1164,9 @@ async function acquireRelayLaunchGcFence(
     // Why: a caller without the install lock still needs its own durable fence; never borrow another connection's lock through launch.
     return token
   } catch (err) {
-    await releaseRelayGcClaimWithRetry(conn, remoteDir, token, hostPlatform)
+    if (!isUnconfirmedSshCommandTermination(err)) {
+      await releaseRelayGcClaimWithRetry(conn, remoteDir, token, hostPlatform)
+    }
     throw err
   }
 }
@@ -1685,24 +1740,7 @@ function getLocalRelayPath(platform: RelayPlatform): string | null {
 }
 
 export function getLocalRelayCandidates(platform: RelayPlatform): string[] {
-  const candidates: string[] = []
-  if (process.env.ORCA_RELAY_PATH) {
-    candidates.push(join(process.env.ORCA_RELAY_PATH, platform))
-  }
-
-  // Why: electron-builder copies extraResources next to the app bundle, but app.getAppPath() points at app.asar in packaged builds.
-  if (process.resourcesPath) {
-    candidates.push(join(process.resourcesPath, 'relay', platform))
-    candidates.push(join(process.resourcesPath, 'app.asar.unpacked', 'out', 'relay', platform))
-  }
-
-  const appPath = app.getAppPath()
-  candidates.push(
-    join(appPath, 'resources', 'relay', platform),
-    join(appPath, 'out', 'relay', platform)
-  )
-
-  return [...new Set(candidates)]
+  return relayBundleCandidates(platform, app.getAppPath())
 }
 
 async function launchRelay(
diff --git a/src/main/ssh/ssh-relay-gc-claim-termination.test.ts b/src/main/ssh/ssh-relay-gc-claim-termination.test.ts
new file mode 100644
index 000000000000..d460e3e94b92
--- /dev/null
+++ b/src/main/ssh/ssh-relay-gc-claim-termination.test.ts
@@ -0,0 +1,216 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+vi.mock('./ssh-relay-deploy-helpers', () => ({ execCommand: vi.fn() }))
+
+import type { SshConnection } from './ssh-connection'
+import { execCommand } from './ssh-relay-deploy-helpers'
+import {
+  isRelayGcClaimOwned,
+  releaseRelayGcClaim,
+  releaseRelayGcClaimWithRetry,
+  tryAcquireRelayGcClaim,
+  waitForRelayGcClaimRelease
+} from './ssh-relay-gc-claim'
+import { getRemoteHostPlatform } from './ssh-remote-platform'
+
+// oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The mocked execCommand never reads the connection.
+const conn = {} as SshConnection
+const mockExec = vi.mocked(execCommand)
+const token = 'claim-owner'
+
+function unconfirmedTermination(): Error {
+  return Object.assign(new Error('SSH teardown not confirmed'), {
+    sshChannelCloseConfirmed: false
+  })
+}
+
+function confirmedFailure(): Error {
+  return Object.assign(new Error('SSH command failed after closing'), {
+    sshChannelCloseConfirmed: true
+  })
+}
+
+beforeEach(() => {
+  mockExec.mockReset()
+  mockExec.mockResolvedValue('OPEN')
+})
+
+afterEach(() => {
+  vi.useRealTimers()
+})
+
+describe.each([
+  { platform: 'linux-x64' as const, remoteDir: '/relay/version' },
+  { platform: 'win32-x64' as const, remoteDir: 'C:/relay/version' }
+])('relay GC claim termination on $platform', ({ platform, remoteDir }) => {
+  const host = getRemoteHostPlatform(platform)
+
+  it.each([
+    { stage: 'claim creation', replies: [] },
+    { stage: 'stale claim takeover', replies: ['BUSY'] },
+    { stage: 'new claim owner write', replies: ['OK'] },
+    { stage: 'recovered claim owner write', replies: ['BUSY', 'OK'] }
+  ])('preserves uncertainty during $stage without releasing or retrying', async ({ replies }) => {
+    const error = unconfirmedTermination()
+    for (const reply of replies) {
+      mockExec.mockResolvedValueOnce(reply)
+    }
+    mockExec.mockRejectedValueOnce(error)
+
+    await expect(tryAcquireRelayGcClaim(conn, remoteDir, host)).rejects.toBe(error)
+
+    expect(mockExec).toHaveBeenCalledTimes(replies.length + 1)
+  })
+
+  it('preserves acquisition uncertainty when the caller also aborts', async () => {
+    const controller = new AbortController()
+    const error = unconfirmedTermination()
+    mockExec.mockImplementationOnce(async () => {
+      controller.abort(new Error('deploy aborted'))
+      throw error
+    })
+
+    await expect(tryAcquireRelayGcClaim(conn, remoteDir, host, controller.signal)).rejects.toBe(
+      error
+    )
+    expect(mockExec).toHaveBeenCalledTimes(1)
+  })
+
+  it('preserves ownership probe uncertainty', async () => {
+    const error = unconfirmedTermination()
+    mockExec.mockRejectedValueOnce(error)
+
+    await expect(isRelayGcClaimOwned(conn, remoteDir, token, host)).rejects.toBe(error)
+    expect(mockExec).toHaveBeenCalledTimes(1)
+  })
+
+  it('preserves release uncertainty', async () => {
+    const error = unconfirmedTermination()
+    mockExec.mockRejectedValueOnce(error)
+
+    await expect(releaseRelayGcClaim(conn, remoteDir, token, host)).rejects.toBe(error)
+    expect(mockExec).toHaveBeenCalledTimes(1)
+  })
+
+  it.each([0, 1])(
+    'stops release retries after %i confirmed failures then uncertainty',
+    async (n) => {
+      const error = unconfirmedTermination()
+      for (let attempt = 0; attempt < n; attempt++) {
+        mockExec.mockRejectedValueOnce(confirmedFailure())
+      }
+      mockExec.mockRejectedValueOnce(error)
+
+      await expect(releaseRelayGcClaimWithRetry(conn, remoteDir, token, host)).rejects.toBe(error)
+      expect(mockExec).toHaveBeenCalledTimes(n + 1)
+    }
+  )
+
+  it.each([
+    { stage: 'claim probe', replies: [] },
+    { stage: 'stale claim takeover', replies: ['LOCKED'] },
+    { stage: 'owner write', replies: ['LOCKED', 'OK'] },
+    { stage: 'release', replies: ['LOCKED', 'OK', ''] }
+  ])('stops the claim waiter after an unconfirmed $stage', async ({ replies }) => {
+    const error = unconfirmedTermination()
+    for (const reply of replies) {
+      mockExec.mockResolvedValueOnce(reply)
+    }
+    mockExec.mockRejectedValueOnce(error)
+
+    await expect(waitForRelayGcClaimRelease(conn, remoteDir, host)).rejects.toBe(error)
+    expect(mockExec).toHaveBeenCalledTimes(replies.length + 1)
+  })
+
+  it('preserves claim probe uncertainty when the caller also aborts', async () => {
+    const controller = new AbortController()
+    const error = unconfirmedTermination()
+    mockExec.mockImplementationOnce(async () => {
+      controller.abort(new Error('deploy aborted'))
+      throw error
+    })
+
+    await expect(waitForRelayGcClaimRelease(conn, remoteDir, host, controller.signal)).rejects.toBe(
+      error
+    )
+    expect(mockExec).toHaveBeenCalledTimes(1)
+  })
+
+  it('stops when cleanup after a confirmed owner write failure is unconfirmed', async () => {
+    const error = unconfirmedTermination()
+    mockExec
+      .mockResolvedValueOnce('OK')
+      .mockRejectedValueOnce(confirmedFailure())
+      .mockRejectedValueOnce(error)
+
+    await expect(tryAcquireRelayGcClaim(conn, remoteDir, host)).rejects.toBe(error)
+    expect(mockExec).toHaveBeenCalledTimes(3)
+  })
+
+  it('keeps a confirmed acquisition failure as contention', async () => {
+    mockExec.mockRejectedValueOnce(confirmedFailure())
+
+    await expect(tryAcquireRelayGcClaim(conn, remoteDir, host)).resolves.toBeNull()
+    expect(mockExec).toHaveBeenCalledTimes(1)
+  })
+
+  it('conditionally releases after a confirmed owner write failure', async () => {
+    mockExec
+      .mockResolvedValueOnce('OK')
+      .mockRejectedValueOnce(confirmedFailure())
+      .mockResolvedValueOnce('RELEASED')
+
+    await expect(tryAcquireRelayGcClaim(conn, remoteDir, host)).resolves.toBeNull()
+    expect(mockExec).toHaveBeenCalledTimes(3)
+  })
+
+  it('keeps a confirmed ownership probe failure as lost ownership', async () => {
+    mockExec.mockRejectedValueOnce(confirmedFailure())
+
+    await expect(isRelayGcClaimOwned(conn, remoteDir, token, host)).resolves.toBe(false)
+    expect(mockExec).toHaveBeenCalledTimes(1)
+  })
+
+  it('retains bounded retries for confirmed release failures', async () => {
+    mockExec.mockRejectedValue(confirmedFailure())
+
+    await expect(releaseRelayGcClaimWithRetry(conn, remoteDir, token, host)).resolves.toBe(
+      'unknown'
+    )
+    expect(mockExec).toHaveBeenCalledTimes(3)
+  })
+
+  it('retries confirmed release failures until release succeeds', async () => {
+    mockExec.mockRejectedValueOnce(confirmedFailure()).mockResolvedValueOnce('RELEASED')
+
+    await expect(releaseRelayGcClaimWithRetry(conn, remoteDir, token, host)).resolves.toBe(
+      'released'
+    )
+    expect(mockExec).toHaveBeenCalledTimes(2)
+  })
+
+  it('still recovers a claim after a confirmed probe failure', async () => {
+    mockExec
+      .mockRejectedValueOnce(confirmedFailure())
+      .mockResolvedValueOnce('OK')
+      .mockResolvedValueOnce('')
+      .mockResolvedValueOnce('RELEASED')
+
+    await expect(waitForRelayGcClaimRelease(conn, remoteDir, host)).resolves.toBeUndefined()
+    expect(mockExec).toHaveBeenCalledTimes(4)
+  })
+
+  it('still polls after a confirmed stale takeover failure', async () => {
+    vi.useFakeTimers()
+    mockExec
+      .mockResolvedValueOnce('LOCKED')
+      .mockRejectedValueOnce(confirmedFailure())
+      .mockResolvedValueOnce('OPEN')
+
+    const waiting = waitForRelayGcClaimRelease(conn, remoteDir, host)
+    await vi.advanceTimersByTimeAsync(1_000)
+
+    await expect(waiting).resolves.toBeUndefined()
+    expect(mockExec).toHaveBeenCalledTimes(3)
+  })
+})
diff --git a/src/main/ssh/ssh-relay-gc-claim.ts b/src/main/ssh/ssh-relay-gc-claim.ts
index d0c8cc1221f6..3ce807fcabb0 100644
--- a/src/main/ssh/ssh-relay-gc-claim.ts
+++ b/src/main/ssh/ssh-relay-gc-claim.ts
@@ -2,6 +2,7 @@ import { randomUUID } from 'node:crypto'
 import type { SshConnection } from './ssh-connection'
 import { shellEscape } from './ssh-connection-utils'
 import { execCommand } from './ssh-relay-deploy-helpers'
+import { isUnconfirmedSshCommandTermination } from './ssh-relay-exec-command'
 import {
   probeInstallLockExistsCommand,
   tryCreateInstallLockCommand,
@@ -91,7 +92,10 @@ export async function tryAcquireRelayGcClaim(
       return null
     }
     return writeRelayGcClaimOwner(conn, remoteRelayDir, host, signal)
-  } catch {
+  } catch (error) {
+    if (isUnconfirmedSshCommandTermination(error)) {
+      throw error
+    }
     signal?.throwIfAborted()
     return null
   }
@@ -114,7 +118,10 @@ async function writeRelayGcClaimOwner(
   try {
     await execHostCommand(conn, host, command, signal)
     return token
-  } catch {
+  } catch (error) {
+    if (isUnconfirmedSshCommandTermination(error)) {
+      throw error
+    }
     // Why: the write may have succeeded remotely before SSH lost its reply.
     // A conditional release removes only the claim generation with our token.
     await releaseRelayGcClaim(conn, remoteRelayDir, token, host)
@@ -134,7 +141,12 @@ export async function isRelayGcClaimOwned(
         `if ((Get-Content -LiteralPath ${powerShellLiteral(ownerPath)} -Raw -ErrorAction SilentlyContinue) -ceq ${powerShellLiteral(token)}) { 'OWNED' } else { 'LOST' }`
       )
     : `test "$(cat ${shellEscape(ownerPath)} 2>/dev/null)" = ${shellEscape(token)} && echo OWNED || echo LOST`
-  const output = await execHostCommand(conn, host, command).catch(() => 'LOST')
+  const output = await execHostCommand(conn, host, command).catch((error) => {
+    if (isUnconfirmedSshCommandTermination(error)) {
+      throw error
+    }
+    return 'LOST'
+  })
   return output.trim() === 'OWNED'
 }
 
@@ -162,7 +174,12 @@ export async function releaseRelayGcClaim(
         `else ${removeRemoteTreeCommand(host, claimPath)} 2>/dev/null;`,
         `if test -e ${shellEscape(claimPath)}; then echo UNKNOWN; else echo RELEASED; fi; fi`
       ].join(' ')
-  const output = await execHostCommand(conn, host, command).catch(() => 'UNKNOWN')
+  const output = await execHostCommand(conn, host, command).catch((error) => {
+    if (isUnconfirmedSshCommandTermination(error)) {
+      throw error
+    }
+    return 'UNKNOWN'
+  })
   switch (output.trim()) {
     case 'RELEASED':
       return 'released'
@@ -193,7 +210,12 @@ export async function waitForRelayGcClaimRelease(
   signal?: AbortSignal
 ): Promise<void> {
   while (true) {
-    const claimed = await isRelayGcClaimed(conn, remoteRelayDir, host, signal).catch(() => true)
+    const claimed = await isRelayGcClaimed(conn, remoteRelayDir, host, signal).catch((error) => {
+      if (isUnconfirmedSshCommandTermination(error)) {
+        throw error
+      }
+      return true
+    })
     signal?.throwIfAborted()
     if (!claimed) {
       return
@@ -204,7 +226,12 @@ export async function waitForRelayGcClaimRelease(
       host,
       tryStealInstallLockCommand(host, claimPath, RELAY_GC_CLAIM_STALE_SECONDS),
       signal
-    ).catch(() => 'BUSY')
+    ).catch((error) => {
+      if (isUnconfirmedSshCommandTermination(error)) {
+        throw error
+      }
+      return 'BUSY'
+    })
     signal?.throwIfAborted()
     if (recovered.trim().endsWith('OK')) {
       const token = await writeRelayGcClaimOwner(conn, remoteRelayDir, host, signal)
diff --git a/src/main/ssh/ssh-relay-gc-retry.test.ts b/src/main/ssh/ssh-relay-gc-retry.test.ts
index ae70ff68fa64..18d99a926a9e 100644
--- a/src/main/ssh/ssh-relay-gc-retry.test.ts
+++ b/src/main/ssh/ssh-relay-gc-retry.test.ts
@@ -19,7 +19,10 @@ vi.mock('./ssh-relay-deploy-helpers', () => ({
     onData: vi.fn(),
     onClose: vi.fn()
   }),
-  isUnconfirmedSshCommandTermination: () => false,
+  isUnconfirmedSshCommandTermination: (error: unknown) =>
+    error instanceof Error &&
+    'sshChannelCloseConfirmed' in error &&
+    error.sshChannelCloseConfirmed === false,
   execCommand: vi.fn()
 }))
 vi.mock('./ssh-remote-node-resolution', () => ({
@@ -244,6 +247,72 @@ describe('relay GC deploy retry', () => {
     expect(releaseRelayGcClaimWithRetry).not.toHaveBeenCalled()
   })
 
+  it.each(['acquired', 'busy'] as const)(
+    'keeps the connected relay but stops setup after uncertain %s fence release',
+    async (lockResult) => {
+      const conn = makeConnection()
+      const error = Object.assign(new Error('release still running'), {
+        sshChannelCloseConfirmed: false
+      })
+      vi.mocked(tryAcquireRelayRepairLock).mockResolvedValueOnce(lockResult)
+      const release =
+        lockResult === 'acquired'
+          ? vi.mocked(abandonInstall)
+          : vi.mocked(releaseRelayGcClaimWithRetry)
+      release.mockRejectedValueOnce(error)
+      vi.mocked(execCommand).mockImplementation(async (_conn, command) => {
+        if (command.includes('__ORCA_REMOTE_PLATFORM__')) {
+          return '__ORCA_REMOTE_PLATFORM__ Linux x86_64'
+        }
+        if (command === 'echo $HOME') {
+          return '/home/user'
+        }
+        if (command.includes('node-pty')) {
+          return 'ORCA-NATIVE-DEPS-OK'
+        }
+        if (command.includes('var s=require("net").connect')) {
+          return 'READY'
+        }
+        return command.includes('test -S') ? 'DEAD' : ''
+      })
+
+      const deployed = await deployAndLaunchRelay(conn)
+      expect(deployed.transport).toBeDefined()
+      expect(release).toHaveBeenCalledOnce()
+      const execCount = vi.mocked(execCommand).mock.calls.length
+      await deployed.prepareOpenCodeRuntime?.(new AbortController().signal)
+      await new Promise<void>((resolve) => setImmediate(resolve))
+      expect(execCommand).toHaveBeenCalledTimes(execCount)
+    }
+  )
+
+  it.each(['acquired', 'busy'] as const)(
+    'preserves the %s fence after an unconfirmed installed-state recheck',
+    async (lockResult) => {
+      const conn = makeConnection()
+      const error = Object.assign(new Error('recheck still running'), {
+        sshChannelCloseConfirmed: false
+      })
+      vi.mocked(tryAcquireRelayRepairLock).mockResolvedValueOnce(lockResult)
+      vi.mocked(isRelayAlreadyInstalled).mockResolvedValueOnce(true).mockRejectedValueOnce(error)
+      vi.mocked(execCommand).mockImplementation(async (_conn, command) => {
+        if (command.includes('__ORCA_REMOTE_PLATFORM__')) {
+          return '__ORCA_REMOTE_PLATFORM__ Linux x86_64'
+        }
+        if (command === 'echo $HOME') {
+          return '/home/user'
+        }
+        return 'ORCA-NATIVE-DEPS-OK'
+      })
+
+      await expect(deployAndLaunchRelay(conn)).rejects.toBe(error)
+      expect(abandonInstall).not.toHaveBeenCalled()
+      expect(releaseRelayGcClaimWithRetry).not.toHaveBeenCalled()
+      expect(waitForRelayGcClaimRelease).not.toHaveBeenCalled()
+      expect(conn.exec).not.toHaveBeenCalled()
+    }
+  )
+
   it('keeps retrying repeated launch-claim contention within the deploy bound', async () => {
     const conn = makeConnection()
     vi.mocked(tryAcquireRelayRepairLock).mockResolvedValue('busy')
diff --git a/src/main/ssh/ssh-relay-gc-tombstone.ts b/src/main/ssh/ssh-relay-gc-tombstone.ts
index 95684d4d20e3..cc117981eadb 100644
--- a/src/main/ssh/ssh-relay-gc-tombstone.ts
+++ b/src/main/ssh/ssh-relay-gc-tombstone.ts
@@ -1,5 +1,6 @@
 import type { SshConnection } from './ssh-connection'
 import { execCommand } from './ssh-relay-deploy-helpers'
+import { isUnconfirmedSshCommandTermination } from './ssh-relay-exec-command'
 import { removeRemoteTreeCommand } from './ssh-remote-commands'
 import {
   getRemoteHostPlatform,
@@ -25,6 +26,9 @@ export async function cleanupRelayGcTombstones(
     await execCommand(conn, removeRemoteTreeCommand(host, tombstone), {
       wrapCommand: !isWindowsRemoteHost(host)
     }).catch((err) => {
+      if (isUnconfirmedSshCommandTermination(err)) {
+        throw err
+      }
       console.warn(
         `[ssh-relay] GC failed to remove tombstone ${tombstone}: ${err instanceof Error ? err.message : String(err)}`
       )
diff --git a/src/main/ssh/ssh-relay-install-lock-termination.test.ts b/src/main/ssh/ssh-relay-install-lock-termination.test.ts
new file mode 100644
index 000000000000..de4c57a49776
--- /dev/null
+++ b/src/main/ssh/ssh-relay-install-lock-termination.test.ts
@@ -0,0 +1,138 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+vi.mock('./ssh-relay-deploy-helpers', () => ({ execCommand: vi.fn() }))
+
+import type { SshConnection } from './ssh-connection'
+import { execCommand } from './ssh-relay-deploy-helpers'
+import { acquireInstallLock, isRelayInstallLockStale } from './ssh-relay-install-lock'
+import { getRemoteHostPlatform } from './ssh-remote-platform'
+
+// oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The mocked execCommand never reads the connection.
+const conn = {} as SshConnection
+const mockExec = vi.mocked(execCommand)
+const nextAcquisition = ['OPEN', '', 'OK', 'OPEN']
+
+const lockFailureStages = [
+  {
+    stage: 'claim probe after acquisition',
+    replies: ['OPEN', '', 'OK'],
+    recovery: ['', 'OK', 'OPEN']
+  },
+  {
+    stage: 'release after acquisition',
+    replies: ['OPEN', '', 'OK', 'LOCKED'],
+    recovery: ['OK', 'OPEN']
+  },
+  {
+    stage: 'stale lock takeover',
+    replies: ['OPEN', '', 'BUSY'],
+    recovery: nextAcquisition
+  },
+  {
+    stage: 'claim probe after stale takeover',
+    replies: ['OPEN', '', 'BUSY', 'OK'],
+    recovery: ['', ...nextAcquisition]
+  },
+  {
+    stage: 'release after stale takeover',
+    replies: ['OPEN', '', 'BUSY', 'OK', 'LOCKED'],
+    recovery: nextAcquisition
+  }
+]
+
+beforeEach(() => {
+  mockExec.mockReset()
+  mockExec.mockResolvedValue('OPEN')
+  vi.spyOn(console, 'warn').mockImplementation(() => {})
+  vi.spyOn(console, 'info').mockImplementation(() => {})
+})
+
+afterEach(() => {
+  vi.restoreAllMocks()
+  vi.useRealTimers()
+})
+
+describe.each([
+  { platform: 'linux-x64' as const, remoteDir: '/relay/version' },
+  { platform: 'win32-x64' as const, remoteDir: 'C:/relay/version' }
+])('install lock termination on $platform', ({ platform, remoteDir }) => {
+  const host = getRemoteHostPlatform(platform)
+
+  it.each(lockFailureStages)('stops after unconfirmed $stage', async ({ replies }) => {
+    const error = Object.assign(new Error('SSH teardown not confirmed'), {
+      sshChannelCloseConfirmed: false
+    })
+    for (const reply of replies) {
+      mockExec.mockResolvedValueOnce(reply)
+    }
+    mockExec.mockRejectedValueOnce(error)
+
+    await expect(acquireInstallLock(conn, remoteDir, host)).rejects.toBe(error)
+    expect(mockExec).toHaveBeenCalledTimes(replies.length + 1)
+  })
+
+  it.each(lockFailureStages)(
+    'keeps recovery after confirmed $stage failure',
+    async ({ replies, recovery }) => {
+      vi.useFakeTimers()
+      for (const reply of replies) {
+        mockExec.mockResolvedValueOnce(reply)
+      }
+      mockExec.mockRejectedValueOnce(
+        Object.assign(new Error('SSH command failed after closing'), {
+          sshChannelCloseConfirmed: true
+        })
+      )
+      for (const reply of recovery) {
+        mockExec.mockResolvedValueOnce(reply)
+      }
+
+      const acquiring = acquireInstallLock(conn, remoteDir, host)
+      await vi.advanceTimersByTimeAsync(1_000)
+
+      await expect(acquiring).resolves.toBeUndefined()
+      expect(mockExec).toHaveBeenCalledTimes(replies.length + recovery.length + 1)
+    }
+  )
+
+  it('preserves takeover uncertainty when the caller also aborts', async () => {
+    const controller = new AbortController()
+    const error = Object.assign(new Error('SSH teardown not confirmed'), {
+      sshChannelCloseConfirmed: false
+    })
+    mockExec
+      .mockResolvedValueOnce('OPEN')
+      .mockResolvedValueOnce('')
+      .mockResolvedValueOnce('BUSY')
+      .mockImplementationOnce(async () => {
+        controller.abort(new Error('deploy aborted'))
+        throw error
+      })
+
+    await expect(
+      acquireInstallLock(conn, remoteDir, host, { signal: controller.signal })
+    ).rejects.toBe(error)
+    expect(mockExec).toHaveBeenCalledTimes(4)
+  })
+
+  it('preserves uncertainty from the stale lock age probe', async () => {
+    const error = Object.assign(new Error('SSH teardown not confirmed'), {
+      sshChannelCloseConfirmed: false
+    })
+    mockExec.mockRejectedValueOnce(error)
+
+    await expect(isRelayInstallLockStale(conn, remoteDir, host)).rejects.toBe(error)
+    expect(mockExec).toHaveBeenCalledTimes(1)
+  })
+
+  it('keeps a confirmed stale age probe failure as not stale', async () => {
+    mockExec.mockRejectedValueOnce(
+      Object.assign(new Error('SSH command failed after closing'), {
+        sshChannelCloseConfirmed: true
+      })
+    )
+
+    await expect(isRelayInstallLockStale(conn, remoteDir, host)).resolves.toBe(false)
+    expect(mockExec).toHaveBeenCalledTimes(1)
+  })
+})
diff --git a/src/main/ssh/ssh-relay-install-lock.ts b/src/main/ssh/ssh-relay-install-lock.ts
index 7d5b26fdfaed..3831851cbe93 100644
--- a/src/main/ssh/ssh-relay-install-lock.ts
+++ b/src/main/ssh/ssh-relay-install-lock.ts
@@ -1,6 +1,7 @@
 import type { SshConnection } from './ssh-connection'
-import { execCommand, isUnconfirmedSshCommandTermination } from './ssh-relay-deploy-helpers'
+import { execCommand } from './ssh-relay-deploy-helpers'
 import { RELAY_DEPLOY_TIMEOUT_MS } from './ssh-relay-deploy-timing'
+import { isUnconfirmedSshCommandTermination } from './ssh-relay-exec-command'
 import { isRelayGcClaimed, waitForRelayGcClaimRelease } from './ssh-relay-gc-claim'
 import {
   acquireInstallLockParentCommand,
@@ -54,7 +55,10 @@ export async function isRelayInstallLockStale(
     const out = await execHostCommand(conn, host, lockAgeSecondsCommand(host, lockDir))
     const ageSec = Number.parseInt(out.trim(), 10)
     return Number.isFinite(ageSec) && ageSec >= 0 && ageSec * 1000 > INSTALL_LOCK_STALE_MS
-  } catch {
+  } catch (err) {
+    if (isUnconfirmedSshCommandTermination(err)) {
+      throw err
+    }
     return false
   }
 }
@@ -95,11 +99,20 @@ export async function acquireInstallLock(
           remoteRelayDir,
           host,
           options?.signal
-        ).catch(() => true)
+        ).catch((err) => {
+          if (isUnconfirmedSshCommandTermination(err)) {
+            throw err
+          }
+          return true
+        })
         if (!claimedAfterAcquire && !options?.signal?.aborted) {
           return
         }
-        await execHostCommand(conn, host, removeRemoteTreeCommand(host, lockDir)).catch(() => {})
+        await execHostCommand(conn, host, removeRemoteTreeCommand(host, lockDir)).catch((err) => {
+          if (isUnconfirmedSshCommandTermination(err)) {
+            throw err
+          }
+        })
         options?.signal?.throwIfAborted()
       }
     } catch (err) {
@@ -119,7 +132,12 @@ export async function acquireInstallLock(
         host,
         tryStealInstallLockCommand(host, lockDir, INSTALL_LOCK_STALE_SECONDS),
         { signal: options?.signal }
-      ).catch(() => 'BUSY')
+      ).catch((err) => {
+        if (isUnconfirmedSshCommandTermination(err)) {
+          throw err
+        }
+        return 'BUSY'
+      })
       options?.signal?.throwIfAborted()
       if (steal.trim().endsWith('OK')) {
         const reason = steal.trim().endsWith('REBOOT_OK') ? 'previous-boot' : 'stale'
@@ -129,11 +147,20 @@ export async function acquireInstallLock(
           remoteRelayDir,
           host,
           options?.signal
-        ).catch(() => true)
+        ).catch((err) => {
+          if (isUnconfirmedSshCommandTermination(err)) {
+            throw err
+          }
+          return true
+        })
         if (!claimedAfterSteal && !options?.signal?.aborted) {
           return
         }
-        await execHostCommand(conn, host, removeRemoteTreeCommand(host, lockDir)).catch(() => {})
+        await execHostCommand(conn, host, removeRemoteTreeCommand(host, lockDir)).catch((err) => {
+          if (isUnconfirmedSshCommandTermination(err)) {
+            throw err
+          }
+        })
         options?.signal?.throwIfAborted()
       }
     }
diff --git a/src/main/ssh/ssh-relay-native-deps-cache-commands.ts b/src/main/ssh/ssh-relay-native-deps-cache-commands.ts
index 52d09de1b193..f2ce32a2222a 100644
--- a/src/main/ssh/ssh-relay-native-deps-cache-commands.ts
+++ b/src/main/ssh/ssh-relay-native-deps-cache-commands.ts
@@ -10,6 +10,7 @@ import { shellEscape } from './ssh-connection-utils'
 import {
   RELAY_NATIVE_DEPS_CACHE_COMPLETE_NAME,
   RELAY_NATIVE_DEPS_CACHE_TOMBSTONE_PREFIX,
+  LEGACY_RELAY_NATIVE_DEPS_CACHE_TOMBSTONE_PREFIX,
   relayNativeDepsCacheBaseDir,
   relayNativeDepsCacheEntryDir,
   relayNativeDepsCacheNodeModulesPath,
@@ -34,9 +35,6 @@ export const RELAY_NATIVE_CACHE_REFS_ERR = '__ORCA_NATIVE_CACHE__REFS_ERR'
  */
 const CACHE_TAKEOVER_MINUTES = 120
 
-/** A crashed GC pass leaves a tombstone; it drains once no in-flight pass could still own it. */
-const CACHE_TOMBSTONE_SWEEP_MINUTES = 30
-
 /** Bounds every listing, matching `MAX_RELAY_GC_LISTING_ENTRIES`' role for version dirs. */
 export const MAX_RELAY_NATIVE_CACHE_LISTING_ENTRIES = 64
 
@@ -157,7 +155,7 @@ export function promoteRelayNativeDepsCacheCommand(paths: RelayNativeDepsCachePa
   ].join('\n')
 }
 
-/** Complete entries only; an incomplete one belongs to an installer, not to GC. */
+/** Complete entries and tombstones; deletion requires a separate reference scan. */
 export function listRelayNativeDepsCacheEntriesCommand(
   host: RemoteHostPlatform,
   remoteHome: string
@@ -166,13 +164,12 @@ export function listRelayNativeDepsCacheEntriesCommand(
   return [
     `base=${shellEscape(base)}`,
     `[ -d "$base" ] || { printf '%s\\n' ${RELAY_NATIVE_CACHE_LIST_OK}; exit 0; }`,
-    `find "$base" -maxdepth 1 -name ${shellEscape(`${RELAY_NATIVE_DEPS_CACHE_TOMBSTONE_PREFIX}*`)} -mmin +${CACHE_TOMBSTONE_SWEEP_MINUTES} -exec rm -rf {} + 2>/dev/null || true`,
     'n=0',
-    'for d in "$base"/*/; do',
+    `for d in "$base"/*/ "$base"/${RELAY_NATIVE_DEPS_CACHE_TOMBSTONE_PREFIX}*/ "$base"/${LEGACY_RELAY_NATIVE_DEPS_CACHE_TOMBSTONE_PREFIX}*/; do`,
     '  [ -d "$d" ] || continue',
-    `  [ -f "$d${RELAY_NATIVE_DEPS_CACHE_COMPLETE_NAME}" ] || continue`,
     '  name=${d%/}',
     '  name=${name##*/}',
+    `  case "$name" in ${RELAY_NATIVE_DEPS_CACHE_TOMBSTONE_PREFIX}*|${LEGACY_RELAY_NATIVE_DEPS_CACHE_TOMBSTONE_PREFIX}*) ;; *) [ -f "$d${RELAY_NATIVE_DEPS_CACHE_COMPLETE_NAME}" ] || continue ;; esac`,
     `  printf 'ENTRY %s\\n' "$name"`,
     '  n=$((n+1))',
     `  if [ "$n" -ge ${MAX_RELAY_NATIVE_CACHE_LISTING_ENTRIES} ]; then break; fi`,
@@ -196,8 +193,12 @@ export function listRelayNativeDepsCacheReferencesCommand(
   return [
     `root=${shellEscape(root)}`,
     `[ -d "$root" ] || { printf '%s\\n' ${RELAY_NATIVE_CACHE_REFS_OK}; exit 0; }`,
+    `[ -r "$root" ] && [ -x "$root" ] && ls -A "$root" >/dev/null 2>&1 || { printf '%s\\n' ${RELAY_NATIVE_CACHE_REFS_ERR}; exit 0; }`,
     'n=0',
-    'for d in "$root"/*/node_modules; do',
+    'for d in "$root"/*/; do',
+    '  [ -d "$d" ] || continue',
+    `  [ -r "$d" ] && [ -x "$d" ] || { printf '%s\\n' ${RELAY_NATIVE_CACHE_REFS_ERR}; exit 0; }`,
+    '  d="${d}node_modules"',
     '  [ -L "$d" ] || continue',
     '  t=$(readlink "$d" 2>/dev/null) || t=""',
     `  if [ -z "$t" ]; then printf '%s\\n' ${RELAY_NATIVE_CACHE_REFS_ERR}; exit 0; fi`,
@@ -208,3 +209,24 @@ export function listRelayNativeDepsCacheReferencesCommand(
     `printf '%s\\n' ${RELAY_NATIVE_CACHE_REFS_OK}`
   ].join('\n')
 }
+
+/** A missing completion marker means deletion began; leave that tree for later cleanup. */
+export function restoreRelayNativeDepsCacheTombstoneCommand(
+  tombstone: string,
+  entryDir: string
+): string {
+  const source = shellEscape(tombstone)
+  const destination = shellEscape(entryDir)
+  return `if [ -f ${source}/${RELAY_NATIVE_DEPS_CACHE_COMPLETE_NAME} ] && [ ! -e ${destination} ] && [ ! -L ${destination} ]; then mv ${source} ${destination} && echo MOVED; else echo BUSY; fi`
+}
+
+/** A symlinked tombstone is never followed, so only its own marker can be dropped. */
+export function dropRelayNativeDepsCacheCompletionMarkerCommand(tombstone: string): string {
+  const source = shellEscape(tombstone)
+  return `{ [ -L ${source} ] || rm -f ${source}/${RELAY_NATIVE_DEPS_CACHE_COMPLETE_NAME}; }`
+}
+
+/** Drops the completion marker first so an interrupted deletion can never be restored as complete. */
+export function removeRelayNativeDepsCacheTombstoneCommand(tombstone: string): string {
+  return `${dropRelayNativeDepsCacheCompletionMarkerCommand(tombstone)} && rm -rf ${shellEscape(tombstone)}`
+}
diff --git a/src/main/ssh/ssh-relay-native-deps-cache-deploy.test.ts b/src/main/ssh/ssh-relay-native-deps-cache-deploy.test.ts
index ffc859df2232..8d7a1988a97f 100644
--- a/src/main/ssh/ssh-relay-native-deps-cache-deploy.test.ts
+++ b/src/main/ssh/ssh-relay-native-deps-cache-deploy.test.ts
@@ -35,6 +35,9 @@ vi.mock('./ssh-relay-deploy-helpers', () => ({
   execCommand: vi.fn()
 }))
 
+vi.mock('./ssh-relay-opencode-runtime', () => ({
+  ensureRemoteOpenCodeRuntime: vi.fn().mockResolvedValue('ready')
+}))
 vi.mock('./ssh-relay-ripgrep-install', () => ({
   remoteRipgrepLayout: vi.fn().mockReturnValue(null),
   recordRemoteRipgrepReference: vi.fn().mockResolvedValue(false),
diff --git a/src/main/ssh/ssh-relay-native-deps-cache-gc-real.test.ts b/src/main/ssh/ssh-relay-native-deps-cache-gc-real.test.ts
new file mode 100644
index 000000000000..e04d4bcf6bde
--- /dev/null
+++ b/src/main/ssh/ssh-relay-native-deps-cache-gc-real.test.ts
@@ -0,0 +1,415 @@
+import {
+  chmodSync,
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  readdirSync,
+  readlinkSync,
+  renameSync,
+  rmSync,
+  symlinkSync,
+  utimesSync,
+  writeFileSync
+} from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { runProcessSync } from '../../shared/child-process/run-process'
+
+const { execMock } = vi.hoisted(() => ({ execMock: vi.fn() }))
+vi.mock('./ssh-relay-deploy-helpers', () => ({ execCommand: execMock }))
+
+import type { SshConnection } from './ssh-connection'
+import { shellEscape } from './ssh-connection-utils'
+import { getRemoteHostPlatform } from './ssh-remote-platform'
+import { gcRelayNativeDepsCache } from './ssh-relay-native-deps-cache-gc'
+import { listRelayNativeDepsCacheEntriesCommand } from './ssh-relay-native-deps-cache-commands'
+import {
+  relayNativeDepsCacheBaseDir,
+  relayNativeDepsCacheEntryDir,
+  LEGACY_RELAY_NATIVE_DEPS_CACHE_TOMBSTONE_PREFIX,
+  RELAY_NATIVE_DEPS_CACHE_TOMBSTONE_PREFIX
+} from './ssh-relay-native-deps-cache'
+
+const host = getRemoteHostPlatform('linux-x64')
+const key = 'linux-x64-0123456789abcdef'
+// oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: execCommand is replaced by a local shell for every connection access.
+const conn = {} as SshConnection
+const shells = ['/bin/sh', '/bin/dash'].filter(existsSync)
+
+describe.runIf(process.platform !== 'win32').each(shells)(
+  'native cache GC recovery (%s)',
+  (shell) => {
+    let home: string
+    let cache: string
+    let entry: string
+    let relay: string
+
+    function runShell(command: string): string {
+      const result = runProcessSync({ program: shell, args: ['-c', command], timeoutMs: 15_000 })
+      if (result.code !== 0) {
+        throw new Error(result.stderr || `Shell exited ${result.code}`)
+      }
+      return result.stdout
+    }
+
+    function tombstone(
+      timestamp = Date.now() - 60 * 60_000,
+      prefix = RELAY_NATIVE_DEPS_CACHE_TOMBSTONE_PREFIX
+    ): string {
+      const path = join(cache, `${prefix}${key}.123.${timestamp}`)
+      renameSync(entry, path)
+      return path
+    }
+
+    function referenceEntry(): void {
+      symlinkSync(join(entry, 'node_modules'), join(relay, 'node_modules'))
+    }
+
+    beforeEach(() => {
+      home = mkdtempSync(join(tmpdir(), 'orca native gc '))
+      cache = relayNativeDepsCacheBaseDir(host, home)
+      entry = relayNativeDepsCacheEntryDir(host, home, key)
+      relay = join(home, '.orca-remote', 'relay-0.1.0+abc')
+      mkdirSync(relay, { recursive: true })
+      mkdirSync(join(entry, 'node_modules'), { recursive: true })
+      writeFileSync(join(entry, 'node_modules', 'addon.node'), 'original')
+      writeFileSync(join(entry, '.deps-complete'), '')
+      utimesSync(entry, new Date(0), new Date(0))
+      execMock
+        .mockReset()
+        .mockImplementation(async (_conn: unknown, command: string) => runShell(command))
+    })
+
+    afterEach(() => {
+      chmodSync(join(home, '.orca-remote'), 0o755)
+      chmodSync(relay, 0o755)
+      rmSync(home, { recursive: true, force: true })
+    })
+
+    function tombstones(): string[] {
+      return readdirSync(cache).filter((name) =>
+        name.startsWith(RELAY_NATIVE_DEPS_CACHE_TOMBSTONE_PREFIX)
+      )
+    }
+
+    it('lists an ancient-mtime tombstone without deleting it and restores its live reference', async () => {
+      referenceEntry()
+      const path = tombstone()
+
+      expect(runShell(listRelayNativeDepsCacheEntriesCommand(host, home))).toContain(
+        `ENTRY ${RELAY_NATIVE_DEPS_CACHE_TOMBSTONE_PREFIX}`
+      )
+      expect(existsSync(join(path, 'node_modules', 'addon.node'))).toBe(true)
+
+      await gcRelayNativeDepsCache(conn, host, home)
+
+      expect(readFileSync(join(relay, 'node_modules', 'addon.node'), 'utf8')).toBe('original')
+      expect(readdirSync(cache)).toEqual([key])
+    })
+
+    async function runLaterPass(): Promise<void> {
+      const clock = vi.spyOn(Date, 'now').mockReturnValue(Date.now() + 31 * 60_000)
+      try {
+        await gcRelayNativeDepsCache(conn, host, home)
+      } finally {
+        clock.mockRestore()
+      }
+    }
+
+    it('claims a referenced legacy tombstone out of old sweeps but never restores it', async () => {
+      referenceEntry()
+      const path = tombstone(
+        Date.now() - 60 * 60_000,
+        LEGACY_RELAY_NATIVE_DEPS_CACHE_TOMBSTONE_PREFIX
+      )
+
+      await gcRelayNativeDepsCache(conn, host, home)
+
+      expect(existsSync(path)).toBe(false)
+      const [claimed] = tombstones()
+      expect(existsSync(join(cache, claimed, 'node_modules', 'addon.node'))).toBe(true)
+      expect(existsSync(join(cache, claimed, '.deps-complete'))).toBe(false)
+
+      await runLaterPass()
+
+      expect(existsSync(entry)).toBe(false)
+      expect(tombstones()).toHaveLength(1)
+    })
+
+    it('keeps a legacy tree unrestorable when its claim is interrupted after unmarking', async () => {
+      referenceEntry()
+      const path = tombstone(
+        Date.now() - 60 * 60_000,
+        LEGACY_RELAY_NATIVE_DEPS_CACHE_TOMBSTONE_PREFIX
+      )
+      execMock.mockImplementation(async (_conn: unknown, command: string) => {
+        if (command.startsWith(`mv ${shellEscape(path)}`)) {
+          throw new Error('claim interrupted')
+        }
+        return runShell(command)
+      })
+
+      await gcRelayNativeDepsCache(conn, host, home)
+
+      expect(existsSync(join(path, 'node_modules', 'addon.node'))).toBe(true)
+      expect(existsSync(join(path, '.deps-complete'))).toBe(false)
+
+      execMock.mockImplementation(async (_conn: unknown, command: string) => runShell(command))
+      await runLaterPass()
+      await runLaterPass()
+
+      expect(existsSync(entry)).toBe(false)
+    })
+
+    it('collects an unreferenced legacy tombstone', async () => {
+      tombstone(Date.now() - 60 * 60_000, LEGACY_RELAY_NATIVE_DEPS_CACHE_TOMBSTONE_PREFIX)
+
+      await gcRelayNativeDepsCache(conn, host, home)
+
+      expect(readdirSync(cache)).toEqual([])
+    })
+
+    it('lets exactly one of two passes claim the same abandoned tombstone', async () => {
+      const path = tombstone()
+      let releaseClaim!: () => void
+      const claimHeld = new Promise<void>((resolve) => {
+        releaseClaim = resolve
+      })
+      let heldPassReachedClaim!: () => void
+      const reachedClaim = new Promise<void>((resolve) => {
+        heldPassReachedClaim = resolve
+      })
+      let held = false
+      execMock.mockImplementation(async (_conn: unknown, command: string) => {
+        if (!held && command.startsWith(`mv ${shellEscape(path)}`)) {
+          held = true
+          heldPassReachedClaim()
+          await claimHeld
+        }
+        return runShell(command)
+      })
+
+      // The held pass sees the tree as unreferenced; the other pins its key and restores it.
+      const heldPass = gcRelayNativeDepsCache(conn, host, home)
+      await reachedClaim
+      await gcRelayNativeDepsCache(conn, host, home, { pinnedKeys: [key] })
+      releaseClaim()
+      await heldPass
+
+      expect(readdirSync(cache)).toEqual([key])
+      expect(readFileSync(join(entry, 'node_modules', 'addon.node'), 'utf8')).toBe('original')
+      expect(execMock.mock.calls.some(([, command]) => String(command).includes('rm -rf'))).toBe(
+        false
+      )
+    })
+
+    it('does not let another pass resurrect a tombstone while its owner deletes it', async () => {
+      tombstone()
+      let otherPass: Promise<void> | undefined
+      execMock.mockImplementation(async (_conn: unknown, command: string) => {
+        if (!otherPass && command.includes('rm -rf')) {
+          // Simulate the owner's deletion being midway: marker and one file already gone.
+          const [owned] = tombstones()
+          rmSync(join(cache, owned, '.deps-complete'))
+          rmSync(join(cache, owned, 'node_modules', 'addon.node'))
+          referenceEntry()
+          // A later pass on another client sees the owned name as stale and wants the key back.
+          const clock = vi.spyOn(Date, 'now').mockReturnValue(Date.now() + 31 * 60_000)
+          try {
+            otherPass = gcRelayNativeDepsCache(conn, host, home, { pinnedKeys: [key] })
+            await otherPass
+          } finally {
+            clock.mockRestore()
+          }
+        }
+        return runShell(command)
+      })
+
+      await gcRelayNativeDepsCache(conn, host, home)
+
+      expect(otherPass).toBeDefined()
+      expect(existsSync(entry)).toBe(false)
+      expect(
+        tombstones().filter((name) => existsSync(join(cache, name, '.deps-complete')))
+      ).toEqual([])
+    })
+
+    it('never restores a tree whose deletion was interrupted, even once its name is stale', async () => {
+      tombstone()
+      const interrupted = new Error('rm interrupted')
+      execMock.mockImplementation(async (_conn: unknown, command: string) => {
+        if (command.includes('rm -rf')) {
+          runShell(command.slice(0, command.indexOf(' && ')))
+          const [owned] = tombstones()
+          rmSync(join(cache, owned, 'node_modules', 'addon.node'))
+          throw interrupted
+        }
+        return runShell(command)
+      })
+      await gcRelayNativeDepsCache(conn, host, home)
+      const [owned] = tombstones()
+      expect(existsSync(join(cache, owned, 'node_modules'))).toBe(true)
+
+      referenceEntry()
+      execMock.mockImplementation(async (_conn: unknown, command: string) => runShell(command))
+      await runLaterPass()
+
+      expect(existsSync(entry)).toBe(false)
+      expect(tombstones()).toHaveLength(1)
+      expect(existsSync(join(cache, tombstones()[0], '.deps-complete'))).toBe(false)
+    })
+
+    it('preserves a referenced tombstone when the clock moves backward during the reference scan', async () => {
+      referenceEntry()
+      const now = Date.now()
+      const path = tombstone(now - 30 * 60_000 - 1)
+      const clock = vi.spyOn(Date, 'now').mockReturnValue(now)
+      execMock.mockImplementation(async (_conn: unknown, command: string) => {
+        if (command.includes('readlink')) {
+          clock.mockReturnValue(now - 60_000)
+        }
+        return runShell(command)
+      })
+      try {
+        await gcRelayNativeDepsCache(conn, host, home)
+        expect(readFileSync(join(relay, 'node_modules', 'addon.node'), 'utf8')).toBe('original')
+        expect(existsSync(path)).toBe(false)
+      } finally {
+        clock.mockRestore()
+      }
+    })
+
+    it('keeps new tombstones outside an old client mtime-only deletion sweep', () => {
+      const path = tombstone()
+      const legacy = join(cache, `${LEGACY_RELAY_NATIVE_DEPS_CACHE_TOMBSTONE_PREFIX}${key}.123.1`)
+      mkdirSync(legacy)
+      utimesSync(legacy, new Date(0), new Date(0))
+
+      runShell(
+        `find ${shellEscape(cache)} -maxdepth 1 -name '.gc-tombstone.*' -mmin +30 -exec rm -rf {} +`
+      )
+
+      expect(existsSync(join(path, 'node_modules', 'addon.node'))).toBe(true)
+      expect(existsSync(legacy)).toBe(false)
+    })
+
+    it.skipIf(process.getuid?.() === 0).each(['root', 'relay'])(
+      'preserves tombstones when the %s listing is unreadable',
+      async (scope) => {
+        const path = tombstone()
+        referenceEntry()
+        chmodSync(scope === 'root' ? join(home, '.orca-remote') : relay, 0o111)
+
+        await gcRelayNativeDepsCache(conn, host, home)
+
+        expect(existsSync(join(path, 'node_modules', 'addon.node'))).toBe(true)
+        expect(execMock.mock.calls.some(([, command]) => String(command).includes('rm -rf'))).toBe(
+          false
+        )
+      }
+    )
+
+    it('preserves tombstones when a reference cannot be attributed', async () => {
+      const path = tombstone()
+      symlinkSync('../unknown/node_modules', join(relay, 'node_modules'))
+
+      await gcRelayNativeDepsCache(conn, host, home)
+
+      expect(existsSync(join(path, 'node_modules', 'addon.node'))).toBe(true)
+      expect(execMock).toHaveBeenCalledTimes(2)
+    })
+
+    it('collects a stale tombstone only after two complete reference scans', async () => {
+      const path = tombstone()
+
+      await gcRelayNativeDepsCache(conn, host, home)
+
+      expect(existsSync(path)).toBe(false)
+      expect(
+        execMock.mock.calls.filter(([, command]) => String(command).includes('readlink'))
+      ).toHaveLength(2)
+    })
+
+    it('collects an interrupted tombstone deletion after its completion marker is gone', async () => {
+      const path = tombstone()
+      rmSync(join(path, '.deps-complete'))
+
+      await gcRelayNativeDepsCache(conn, host, home)
+
+      expect(existsSync(path)).toBe(false)
+    })
+
+    it('leaves incomplete ordinary entries owned by installers alone', async () => {
+      rmSync(join(entry, '.deps-complete'))
+
+      await gcRelayNativeDepsCache(conn, host, home)
+
+      expect(readFileSync(join(entry, 'node_modules', 'addon.node'), 'utf8')).toBe('original')
+      expect(execMock).toHaveBeenCalledTimes(1)
+    })
+
+    it.each([() => Date.now(), () => Date.now() + 60 * 60_000, () => Number.MAX_SAFE_INTEGER + 1])(
+      'keeps tombstones with a recent, future, or unsafe name timestamp despite ancient mtime',
+      async (timestamp) => {
+        const path = tombstone(timestamp())
+
+        await gcRelayNativeDepsCache(conn, host, home)
+
+        expect(existsSync(join(path, 'node_modules', 'addon.node'))).toBe(true)
+        expect(execMock).toHaveBeenCalledTimes(1)
+      }
+    )
+
+    it('restores a link created during rename when the recheck termination is unconfirmed', async () => {
+      const error = Object.assign(new Error('read-only recheck timed out'), {
+        sshChannelCloseConfirmed: false
+      })
+      let scans = 0
+      execMock.mockImplementation(async (_conn: unknown, command: string) => {
+        if (command.includes('readlink') && ++scans === 2) {
+          throw error
+        }
+        const output = runShell(command)
+        if (command.startsWith('mv ')) {
+          referenceEntry()
+        }
+        return output
+      })
+
+      await expect(gcRelayNativeDepsCache(conn, host, home)).rejects.toBe(error)
+
+      expect(readFileSync(join(relay, 'node_modules', 'addon.node'), 'utf8')).toBe('original')
+      expect(readdirSync(cache)).toEqual([key])
+      expect(execMock).toHaveBeenCalledTimes(5)
+    })
+
+    it.each(['directory', 'dangling symlink'])(
+      'does not overwrite or nest inside a recreated %s',
+      async (kind) => {
+        referenceEntry()
+        const path = tombstone()
+        if (kind === 'directory') {
+          mkdirSync(entry)
+          writeFileSync(join(entry, 'replacement'), 'new')
+        } else {
+          symlinkSync(join(cache, 'missing'), entry)
+        }
+
+        await gcRelayNativeDepsCache(conn, host, home)
+
+        expect(existsSync(path)).toBe(false)
+        const [claimed] = tombstones()
+        expect(readFileSync(join(cache, claimed, 'node_modules', 'addon.node'), 'utf8')).toBe(
+          'original'
+        )
+        if (kind === 'directory') {
+          expect(readdirSync(entry)).toEqual(['replacement'])
+        } else {
+          expect(readlinkSync(entry)).toBe(join(cache, 'missing'))
+        }
+      }
+    )
+  }
+)
diff --git a/src/main/ssh/ssh-relay-native-deps-cache-gc.ts b/src/main/ssh/ssh-relay-native-deps-cache-gc.ts
index e2349ad1bbf5..0febd709cd6f 100644
--- a/src/main/ssh/ssh-relay-native-deps-cache-gc.ts
+++ b/src/main/ssh/ssh-relay-native-deps-cache-gc.ts
@@ -14,23 +14,29 @@
  * linked the entry between the first listing and the rename shows up in the recheck, and its tree
  * is moved back.
  */
+import { randomInt } from 'node:crypto'
 import type { SshConnection } from './ssh-connection'
 import { execCommand } from './ssh-relay-deploy-helpers'
+import { isUnconfirmedSshCommandTermination } from './ssh-relay-exec-command'
 import {
   isRelayNativeDepsCacheEntryName,
   relayNativeDepsCacheBaseDir,
   relayNativeDepsCacheNodeModulesPath,
   supportsRelayNativeDepsCache,
-  RELAY_NATIVE_DEPS_CACHE_TOMBSTONE_PREFIX
+  RELAY_NATIVE_DEPS_CACHE_TOMBSTONE_PREFIX,
+  LEGACY_RELAY_NATIVE_DEPS_CACHE_TOMBSTONE_PREFIX
 } from './ssh-relay-native-deps-cache'
 import {
   listRelayNativeDepsCacheEntriesCommand,
   listRelayNativeDepsCacheReferencesCommand,
   MAX_RELAY_NATIVE_CACHE_LISTING_ENTRIES,
   RELAY_NATIVE_CACHE_LIST_OK,
-  RELAY_NATIVE_CACHE_REFS_OK
+  RELAY_NATIVE_CACHE_REFS_OK,
+  dropRelayNativeDepsCacheCompletionMarkerCommand,
+  removeRelayNativeDepsCacheTombstoneCommand,
+  restoreRelayNativeDepsCacheTombstoneCommand
 } from './ssh-relay-native-deps-cache-commands'
-import { moveRemoteTreeCommand, removeRemoteTreeCommand } from './ssh-remote-commands'
+import { moveRemoteTreeCommand } from './ssh-remote-commands'
 import { joinRemotePath, type RemoteHostPlatform } from './ssh-remote-platform'
 
 type ReferenceScan =
@@ -38,12 +44,34 @@ type ReferenceScan =
   /** Anything this client could not fully account for. No entry may be deleted on it. */
   | { readable: false }
 
+function staleTombstoneKey(name: string): string | null {
+  const prefix = [
+    RELAY_NATIVE_DEPS_CACHE_TOMBSTONE_PREFIX,
+    LEGACY_RELAY_NATIVE_DEPS_CACHE_TOMBSTONE_PREFIX
+  ].find((value) => name.startsWith(value))
+  if (!prefix) {
+    return null
+  }
+  const match = /^(.*)\.(\d+)\.(\d+)$/.exec(name.slice(prefix.length))
+  if (
+    !match ||
+    !isRelayNativeDepsCacheEntryName(match[1]) ||
+    !Number.isSafeInteger(Number(match[3])) ||
+    Date.now() - Number(match[3]) < 30 * 60_000
+  ) {
+    return null
+  }
+  return match[1]
+}
+
 function execHostCommand(
   conn: SshConnection,
   host: RemoteHostPlatform,
   command: string
 ): Promise<string> {
-  return execCommand(conn, command, { wrapCommand: host.commandDialect !== 'powershell' })
+  return execCommand(conn, command, {
+    wrapCommand: host.commandDialect !== 'powershell'
+  })
 }
 
 /**
@@ -64,12 +92,15 @@ export async function gcRelayNativeDepsCache(
     return
   }
   const base = relayNativeDepsCacheBaseDir(host, remoteHome)
-  let entries: string[]
+  let entries: CacheEntry[]
   try {
     entries = parseCacheEntryListing(
       await execHostCommand(conn, host, listRelayNativeDepsCacheEntriesCommand(host, remoteHome))
     )
-  } catch {
+  } catch (err) {
+    if (isUnconfirmedSshCommandTermination(err)) {
+      throw err
+    }
     return
   }
   if (entries.length === 0) {
@@ -80,10 +111,14 @@ export async function gcRelayNativeDepsCache(
     return
   }
   const pinned = new Set(options?.pinnedKeys ?? [])
-  const candidates = entries.filter((key) => !scan.referencedKeys.has(key) && !pinned.has(key))
   const removed: string[] = []
-  for (const key of candidates) {
-    if (await removeUnreferencedCacheEntry(conn, host, remoteHome, base, key)) {
+  for (const { name, key } of entries) {
+    const keep = scan.referencedKeys.has(key) || pinned.has(key)
+    const collected =
+      name === key
+        ? !keep && (await removeUnreferencedCacheEntry(conn, host, remoteHome, base, key))
+        : await recoverAbandonedTombstone(conn, host, remoteHome, base, name, key, keep)
+    if (collected) {
       removed.push(key)
     }
   }
@@ -94,55 +129,139 @@ export async function gcRelayNativeDepsCache(
   }
 }
 
-async function removeUnreferencedCacheEntry(
+// Why random rather than pid + clock: passes on different clients must never rename into one path.
+function ownedTombstonePath(host: RemoteHostPlatform, base: string, key: string): string {
+  const name = `${RELAY_NATIVE_DEPS_CACHE_TOMBSTONE_PREFIX}${key}.${randomInt(1, 2 ** 47)}.${Date.now()}`
+  return joinRemotePath(host, base, name)
+}
+
+async function moveTree(
   conn: SshConnection,
   host: RemoteHostPlatform,
-  remoteHome: string,
-  base: string,
-  key: string
+  source: string,
+  destination: string
 ): Promise<boolean> {
-  const entryDir = joinRemotePath(host, base, key)
-  const tombstone = joinRemotePath(
-    host,
-    base,
-    `${RELAY_NATIVE_DEPS_CACHE_TOMBSTONE_PREFIX}${key}.${process.pid}.${Date.now()}`
-  )
   try {
     const moved = await execHostCommand(
       conn,
       host,
-      moveRemoteTreeCommand(host, entryDir, tombstone)
+      moveRemoteTreeCommand(host, source, destination)
     )
-    if (moved.trim() !== 'MOVED') {
-      return false
+    return moved.trim() === 'MOVED'
+  } catch (err) {
+    if (isUnconfirmedSshCommandTermination(err)) {
+      throw err
     }
-  } catch {
     return false
   }
+}
+
+async function removeUnreferencedCacheEntry(
+  conn: SshConnection,
+  host: RemoteHostPlatform,
+  remoteHome: string,
+  base: string,
+  key: string
+): Promise<boolean> {
+  const entryDir = joinRemotePath(host, base, key)
+  const tombstone = ownedTombstonePath(host, base, key)
+  if (!(await moveTree(conn, host, entryDir, tombstone))) {
+    return false
+  }
+  return collectOwnedTombstone(conn, host, remoteHome, key, tombstone, entryDir)
+}
+
+/**
+ * Another pass may list the same abandoned tombstone, so only the pass whose rename wins may
+ * restore or delete it; the fresh name keeps every other pass off it for the stale window.
+ */
+async function recoverAbandonedTombstone(
+  conn: SshConnection,
+  host: RemoteHostPlatform,
+  remoteHome: string,
+  base: string,
+  name: string,
+  key: string,
+  keep: boolean
+): Promise<boolean> {
+  const source = joinRemotePath(host, base, name)
+  // Why unmark legacy trees before claiming them: an old client's mtime sweep may have left a
+  // partial tree with its marker, and the marker is all a later pass checks before restoring.
+  if (
+    name.startsWith(LEGACY_RELAY_NATIVE_DEPS_CACHE_TOMBSTONE_PREFIX) &&
+    !(await runOrDecline(conn, host, dropRelayNativeDepsCacheCompletionMarkerCommand(source)))
+  ) {
+    return false
+  }
+  const tombstone = ownedTombstonePath(host, base, key)
+  if (!(await moveTree(conn, host, source, tombstone))) {
+    return false
+  }
+  const entryDir = joinRemotePath(host, base, key)
+  if (keep) {
+    await restoreCacheEntry(conn, host, tombstone, entryDir)
+    return false
+  }
+  return collectOwnedTombstone(conn, host, remoteHome, key, tombstone, entryDir)
+}
+
+async function collectOwnedTombstone(
+  conn: SshConnection,
+  host: RemoteHostPlatform,
+  remoteHome: string,
+  key: string,
+  tombstone: string,
+  entryDir: string
+): Promise<boolean> {
   // Why recheck under the rename: a deploy that read `.deps-complete` before it moved can still
   // be creating its symlink. Its reference now names a path that no longer exists, so restoring
   // the tree is the only outcome that leaves that relay with working native deps.
-  let recheck: ReferenceScan
-  try {
-    recheck = await scanCacheReferences(conn, host, remoteHome)
-  } catch {
-    recheck = { readable: false }
-  }
+  const recheck = await scanCacheReferences(conn, host, remoteHome).catch(async (err: unknown) => {
+    // A read-only scan cannot conflict with restoring this pass's renamed tree.
+    await restoreCacheEntry(conn, host, tombstone, entryDir).catch(() => {})
+    throw err
+  })
   if (!recheck.readable || recheck.referencedKeys.has(key)) {
-    await execHostCommand(conn, host, moveRemoteTreeCommand(host, tombstone, entryDir)).catch(
-      () => {}
-    )
+    await restoreCacheEntry(conn, host, tombstone, entryDir)
     return false
   }
+  // A failed removal is retried by a later pass after its own recheck.
+  return runOrDecline(conn, host, removeRelayNativeDepsCacheTombstoneCommand(tombstone))
+}
+
+async function runOrDecline(
+  conn: SshConnection,
+  host: RemoteHostPlatform,
+  command: string
+): Promise<boolean> {
   try {
-    await execHostCommand(conn, host, removeRemoteTreeCommand(host, tombstone))
+    await execHostCommand(conn, host, command)
     return true
-  } catch {
-    // The sweep in the entry listing drains a tombstone this pass could not remove.
+  } catch (err) {
+    if (isUnconfirmedSshCommandTermination(err)) {
+      throw err
+    }
     return false
   }
 }
 
+async function restoreCacheEntry(
+  conn: SshConnection,
+  host: RemoteHostPlatform,
+  tombstone: string,
+  entryDir: string
+): Promise<void> {
+  await execHostCommand(
+    conn,
+    host,
+    restoreRelayNativeDepsCacheTombstoneCommand(tombstone, entryDir)
+  ).catch((err) => {
+    if (isUnconfirmedSshCommandTermination(err)) {
+      throw err
+    }
+  })
+}
+
 async function scanCacheReferences(
   conn: SshConnection,
   host: RemoteHostPlatform,
@@ -155,7 +274,10 @@ async function scanCacheReferences(
       host,
       listRelayNativeDepsCacheReferencesCommand(host, remoteHome)
     )
-  } catch {
+  } catch (err) {
+    if (isUnconfirmedSshCommandTermination(err)) {
+      throw err
+    }
     return { readable: false }
   }
   const lines = output.split(/\r?\n/).map((line) => line.trim())
@@ -219,12 +341,14 @@ function attributeReference(
     : { kind: 'unattributable' }
 }
 
-function parseCacheEntryListing(output: string): string[] {
+type CacheEntry = { name: string; key: string }
+
+function parseCacheEntryListing(output: string): CacheEntry[] {
   const lines = output.split(/\r?\n/).map((line) => line.trim())
   if (!lines.includes(RELAY_NATIVE_CACHE_LIST_OK)) {
     return []
   }
-  const entries: string[] = []
+  const entries: CacheEntry[] = []
   for (const line of lines) {
     if (!line.startsWith('ENTRY ')) {
       continue
@@ -232,11 +356,9 @@ function parseCacheEntryListing(output: string): string[] {
     const name = line.slice('ENTRY '.length)
     // Why re-validate a name the host produced: it is about to be interpolated into `mv` and
     // `rm -rf`. Only names this client could itself have minted are eligible.
-    if (
-      isRelayNativeDepsCacheEntryName(name) &&
-      entries.length < MAX_RELAY_NATIVE_CACHE_LISTING_ENTRIES
-    ) {
-      entries.push(name)
+    const key = isRelayNativeDepsCacheEntryName(name) ? name : staleTombstoneKey(name)
+    if (key && entries.length < MAX_RELAY_NATIVE_CACHE_LISTING_ENTRIES) {
+      entries.push({ name, key })
     }
   }
   return entries
diff --git a/src/main/ssh/ssh-relay-native-deps-cache.test.ts b/src/main/ssh/ssh-relay-native-deps-cache.test.ts
index bfe0c4819836..7fee587b3ec6 100644
--- a/src/main/ssh/ssh-relay-native-deps-cache.test.ts
+++ b/src/main/ssh/ssh-relay-native-deps-cache.test.ts
@@ -168,7 +168,7 @@ describe('gcRelayNativeDepsCache', () => {
 
     const last = mockExec.mock.calls.at(-1)?.[1] ?? ''
     expect(last).toContain('rm -rf')
-    expect(last).toContain('.gc-tombstone.')
+    expect(last).toContain('.native-gc-')
   })
 
   it('keeps an entry a live relay depends on', async () => {
@@ -179,7 +179,7 @@ describe('gcRelayNativeDepsCache', () => {
     await gcRelayNativeDepsCache(conn, POSIX, HOME)
 
     expect(mockExec).toHaveBeenCalledTimes(2)
-    expect(mockExec.mock.calls.some(([, c]) => c.startsWith('rm -rf'))).toBe(false)
+    expect(mockExec.mock.calls.some(([, c]) => c.includes('rm -rf'))).toBe(false)
   })
 
   it('keeps every entry when the reference listing never answers', async () => {
@@ -219,7 +219,7 @@ describe('gcRelayNativeDepsCache', () => {
 
     await gcRelayNativeDepsCache(conn, POSIX, HOME)
 
-    expect(mockExec.mock.calls.some(([, c]) => c.startsWith('rm -rf'))).toBe(true)
+    expect(mockExec.mock.calls.some(([, c]) => c.includes('rm -rf'))).toBe(true)
   })
 
   it('restores the tree when a deploy links the entry after the tombstone rename', async () => {
@@ -235,7 +235,7 @@ describe('gcRelayNativeDepsCache', () => {
     const last = mockExec.mock.calls.at(-1)?.[1] ?? ''
     expect(last).toContain('mv ')
     expect(last).toContain(relayNativeDepsCacheEntryDir(POSIX, HOME, KEY))
-    expect(mockExec.mock.calls.some(([, c]) => c.startsWith('rm -rf'))).toBe(false)
+    expect(mockExec.mock.calls.some(([, c]) => c.includes('rm -rf'))).toBe(false)
   })
 
   it('restores the tree when the recheck itself cannot answer', async () => {
@@ -248,7 +248,7 @@ describe('gcRelayNativeDepsCache', () => {
 
     await gcRelayNativeDepsCache(conn, POSIX, HOME)
 
-    expect(mockExec.mock.calls.some(([, c]) => c.startsWith('rm -rf'))).toBe(false)
+    expect(mockExec.mock.calls.some(([, c]) => c.includes('rm -rf'))).toBe(false)
   })
 
   it('never removes a pinned key', async () => {
diff --git a/src/main/ssh/ssh-relay-native-deps-cache.ts b/src/main/ssh/ssh-relay-native-deps-cache.ts
index 8400a467a913..79f04221c010 100644
--- a/src/main/ssh/ssh-relay-native-deps-cache.ts
+++ b/src/main/ssh/ssh-relay-native-deps-cache.ts
@@ -41,8 +41,9 @@ export const RELAY_NATIVE_DEPS_CACHE_DIR_NAME = 'native'
 /** Written last. Its presence is the only thing that makes an entry linkable. */
 export const RELAY_NATIVE_DEPS_CACHE_COMPLETE_NAME = '.deps-complete'
 
-/** Hidden so the entry listing skips it, and swept by age so a crashed pass drains. */
-export const RELAY_NATIVE_DEPS_CACHE_TOMBSTONE_PREFIX = '.gc-tombstone.'
+/** Older clients sweep the legacy prefix by mtime without checking references. */
+export const RELAY_NATIVE_DEPS_CACHE_TOMBSTONE_PREFIX = '.native-gc-'
+export const LEGACY_RELAY_NATIVE_DEPS_CACHE_TOMBSTONE_PREFIX = '.gc-tombstone.'
 
 /**
  * Bump when the remote install starts mutating the installed tree in a way the hashed inputs
diff --git a/src/main/ssh/ssh-relay-native-deps-install.test.ts b/src/main/ssh/ssh-relay-native-deps-install.test.ts
index df15135963a2..5c1e99eb80dc 100644
--- a/src/main/ssh/ssh-relay-native-deps-install.test.ts
+++ b/src/main/ssh/ssh-relay-native-deps-install.test.ts
@@ -46,6 +46,9 @@ vi.mock('./ssh-relay-install-marker', async (importOriginal) => ({
 // Why: the post-launch ripgrep install would consume this file's queued exec mocks.
 // Why: the post-launch ripgrep cache GC is fire-and-forget and would drain the queued exec mocks.
 vi.mock('./ssh-relay-ripgrep-cache-gc', () => ({ gcRemoteRipgrepCache: vi.fn() }))
+vi.mock('./ssh-relay-opencode-runtime', () => ({
+  ensureRemoteOpenCodeRuntime: vi.fn().mockResolvedValue('ready')
+}))
 vi.mock('./ssh-relay-ripgrep-install', async (importOriginal) => ({
   ...(await importOriginal<typeof RelayRipgrepInstallModule>()),
   ensureRemoteBundledRipgrep: vi.fn().mockResolvedValue('present'),
diff --git a/src/main/ssh/ssh-relay-native-deps-probe-verdict.test.ts b/src/main/ssh/ssh-relay-native-deps-probe-verdict.test.ts
index 395aed06f951..69c7ae1d2a59 100644
--- a/src/main/ssh/ssh-relay-native-deps-probe-verdict.test.ts
+++ b/src/main/ssh/ssh-relay-native-deps-probe-verdict.test.ts
@@ -35,6 +35,9 @@ vi.mock('./ssh-relay-deploy-helpers', () => ({
   execCommand: vi.fn()
 }))
 
+vi.mock('./ssh-relay-opencode-runtime', () => ({
+  ensureRemoteOpenCodeRuntime: vi.fn().mockResolvedValue('ready')
+}))
 vi.mock('./ssh-relay-ripgrep-install', () => ({
   remoteRipgrepLayout: vi.fn().mockReturnValue(null),
   recordRemoteRipgrepReference: vi.fn().mockResolvedValue(false),
diff --git a/src/main/ssh/ssh-relay-node-pty-spawn-repair.test.ts b/src/main/ssh/ssh-relay-node-pty-spawn-repair.test.ts
index 1f8fd69b8dd8..7eda53e684d7 100644
--- a/src/main/ssh/ssh-relay-node-pty-spawn-repair.test.ts
+++ b/src/main/ssh/ssh-relay-node-pty-spawn-repair.test.ts
@@ -6,6 +6,9 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import type * as RelayInstallMarkerModule from './ssh-relay-install-marker'
 
+vi.mock('./ssh-relay-opencode-runtime', () => ({
+  ensureRemoteOpenCodeRuntime: vi.fn().mockResolvedValue('ready')
+}))
 vi.mock('./ssh-relay-ripgrep-install', () => ({
   remoteRipgrepLayout: vi.fn().mockReturnValue(null),
   recordRemoteRipgrepReference: vi.fn().mockResolvedValue(false),
@@ -80,7 +83,7 @@ vi.mock('./ssh-connection-utils', () => ({
 import { deployAndLaunchRelay } from './ssh-relay-deploy'
 import { execCommand } from './ssh-relay-deploy-helpers'
 import { parseUnameToRelayPlatform } from './relay-protocol'
-import { isRelayAlreadyInstalled } from './ssh-relay-versioned-install'
+import { gcOldRelayVersions, isRelayAlreadyInstalled } from './ssh-relay-versioned-install'
 import { tryAcquireRelayRepairLock } from './ssh-relay-repair-lock'
 import {
   makeMockConnection,
@@ -221,6 +224,7 @@ describe('spawn-time node-pty repair through the locked deploy path', () => {
     feed(repairSucceedsResponses())
     const deploys = { count: 0 }
     await recover(conn, deploys)
+    await vi.waitFor(() => expect(gcOldRelayVersions).toHaveBeenCalledOnce())
     vi.mocked(execCommand).mockReset().mockResolvedValue('')
 
     const second = await recover(conn, deploys)
diff --git a/src/main/ssh/ssh-relay-opencode-runtime-commands.test.ts b/src/main/ssh/ssh-relay-opencode-runtime-commands.test.ts
new file mode 100644
index 000000000000..72b5254c322f
--- /dev/null
+++ b/src/main/ssh/ssh-relay-opencode-runtime-commands.test.ts
@@ -0,0 +1,274 @@
+import { createHash } from 'node:crypto'
+import { mkdir, mkdtemp, readFile, rm, stat, utimes, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it } from 'vitest'
+import { runProcess } from '../../shared/child-process/run-process'
+import { getRemoteHostPlatform } from './ssh-remote-platform'
+import { decodeRemotePowerShellScript } from './ssh-remote-powershell'
+import {
+  parseOpenCodeRuntimeResult,
+  probeOpenCodeRuntimeCacheCommand,
+  probeOpenCodeNodeSqliteCommand,
+  promoteOpenCodeRuntimeCommand,
+  publishOpenCodeRuntimeReferenceCommand
+} from './ssh-relay-opencode-runtime-commands'
+import {
+  cleanupOwnedRelayUploadStageCommand,
+  parseReservedRelayUploadStage,
+  recoverOneStaleRelayUploadStageCommand,
+  reserveRelayUploadStageCommand
+} from './ssh-relay-upload-stage-commands'
+
+const host = getRemoteHostPlatform('linux-x64')
+const nodePath = process.execPath
+const directories: string[] = []
+const expectedHash = createHash('sha256').update('verified runtime').digest('hex')
+const markerName = '.sftp-namespace-0123456789abcdef0123456789abcdef'
+
+afterEach(async () => {
+  await Promise.all(
+    directories.splice(0).map((directory) => rm(directory, { recursive: true, force: true }))
+  )
+})
+
+async function directory(): Promise<string> {
+  const result = await mkdtemp(join(tmpdir(), "orca-runtime spaces ' $-"))
+  directories.push(result)
+  return result
+}
+
+async function command(text: string, environment: NodeJS.ProcessEnv = {}) {
+  return runProcess({
+    program: 'sh',
+    args: ['-c', text],
+    timeoutMs: 10_000,
+    env: { ...process.env, OPENCODE_DB: '', XDG_DATA_HOME: '', ...environment }
+  })
+}
+
+async function reserveStage(root: string) {
+  const pool = join(root, '.upload-stages')
+  const result = await command(reserveRelayUploadStageCommand(host, pool, markerName))
+  expect(result.code, result.stderr).toBe(0)
+  return parseReservedRelayUploadStage(host, pool, markerName, result.stdout)
+}
+
+describe.skipIf(process.platform === 'win32')('host-owned SQLite setup commands', () => {
+  it('runs an actual SQLite read and identifies the executable', async () => {
+    const home = await directory()
+    const data = join(home, '.local', 'share', 'opencode')
+    await mkdir(data, { recursive: true })
+    await writeFile(join(data, 'opencode.db'), '')
+    const result = await command(probeOpenCodeNodeSqliteCommand(host, nodePath, home))
+    expect(result.code).toBe(0)
+    expect(parseOpenCodeRuntimeResult(result.stdout)).toEqual({
+      status: 'ready',
+      executable: nodePath
+    })
+  })
+
+  it('stages, verifies by bytes, promotes and atomically publishes under quoted paths', async () => {
+    const root = await directory()
+    const stage = await reserveStage(root)
+    const stageDir = stage.slotDir
+    const executable = join(root, expectedHash, 'bun')
+    const prepared = await command(
+      probeOpenCodeRuntimeCacheCommand({
+        host,
+        nodePath,
+        executable,
+        expectedHash,
+        reference: join(root, 'runtime.json')
+      })
+    )
+    expect(parseOpenCodeRuntimeResult(prepared.stdout).status).toBe('missing')
+    expect((await stat(join(stageDir, markerName))).isFile()).toBe(true)
+    const stagedBinary = join(stageDir, 'payload', 'bun')
+    await writeFile(stagedBinary, 'verified runtime')
+    const promoted = await command(
+      promoteOpenCodeRuntimeCommand({
+        host,
+        nodePath,
+        stagedBinary,
+        executable,
+        expectedHash,
+        repairToken: 'repair'
+      })
+    )
+    expect(parseOpenCodeRuntimeResult(promoted.stdout)).toEqual({ status: 'ready', executable })
+    expect(await readFile(executable, 'utf8')).toBe('verified runtime')
+    const reference = join(root, 'opencode-sqlite-runtime.json')
+    await writeFile(reference, '{"old":true}')
+    const stagedReference = join(stageDir, 'payload', 'ref.json')
+    await writeFile(stagedReference, JSON.stringify({ protocol: 1, executable }))
+    const published = await command(
+      publishOpenCodeRuntimeReferenceCommand({
+        host,
+        nodePath,
+        stagedReference,
+        reference,
+        token: 'one'
+      })
+    )
+    expect(parseOpenCodeRuntimeResult(published.stdout).status).toBe('published')
+    expect(JSON.parse(await readFile(reference, 'utf8'))).toEqual({ protocol: 1, executable })
+    await command(cleanupOwnedRelayUploadStageCommand(host, stage, markerName))
+    await expect(stat(stageDir)).rejects.toMatchObject({ code: 'ENOENT' })
+    expect(await readFile(executable, 'utf8')).toBe('verified runtime')
+  })
+
+  it('refuses equal-sized corrupt uploads instead of accepting a size match', async () => {
+    const root = await directory()
+    const stagedBinary = join(root, 'source')
+    const executable = join(root, 'installed', 'bun')
+    await writeFile(stagedBinary, 'corrupt! runtime')
+    expect((await stat(stagedBinary)).size).toBe(Buffer.byteLength('verified runtime'))
+    const result = await command(
+      promoteOpenCodeRuntimeCommand({
+        host,
+        nodePath,
+        stagedBinary,
+        executable,
+        expectedHash,
+        repairToken: 'one'
+      })
+    )
+    expect(result.code).not.toBe(0)
+    expect(result.stderr).toContain('checksum mismatch')
+    await expect(stat(executable)).rejects.toMatchObject({ code: 'ENOENT' })
+  })
+
+  it('preserves an existing corrupt binary and reuses its verified repair reference', async () => {
+    const root = await directory()
+    const executable = join(root, expectedHash, 'bun')
+    await mkdir(join(root, expectedHash))
+    await writeFile(executable, 'old binary still owned by another process')
+    const stagedBinary = join(root, 'source')
+    await writeFile(stagedBinary, 'verified runtime')
+    const promoted = await command(
+      promoteOpenCodeRuntimeCommand({
+        host,
+        nodePath,
+        stagedBinary,
+        executable,
+        expectedHash,
+        repairToken: 'two'
+      })
+    )
+    const repaired = join(root, expectedHash, 'repair-two', 'bun')
+    expect(parseOpenCodeRuntimeResult(promoted.stdout).executable).toBe(repaired)
+    expect(await readFile(executable, 'utf8')).toBe('old binary still owned by another process')
+    const reference = join(root, 'runtime.json')
+    await writeFile(reference, JSON.stringify({ protocol: 1, executable: repaired }))
+    const prepared = await command(
+      probeOpenCodeRuntimeCacheCommand({
+        host,
+        nodePath,
+        executable,
+        expectedHash,
+        reference
+      })
+    )
+    expect(parseOpenCodeRuntimeResult(prepared.stdout)).toEqual({
+      status: 'ready',
+      executable: repaired
+    })
+  })
+
+  it('defers an empty host, honors database overrides, and ignores in-memory databases', async () => {
+    const home = await directory()
+    const probe = probeOpenCodeNodeSqliteCommand(host, nodePath, home)
+    expect(parseOpenCodeRuntimeResult((await command(probe)).stdout).status).toBe('not-needed')
+    const xdg = join(home, 'other data')
+    await mkdir(join(xdg, 'opencode'), { recursive: true })
+    await writeFile(join(xdg, 'opencode', 'opencode-team.db'), '')
+    const environment = { XDG_DATA_HOME: xdg, OPENCODE_DB: 'opencode-team.db' }
+    expect(parseOpenCodeRuntimeResult((await command(probe, environment)).stdout).status).toBe(
+      'ready'
+    )
+    expect(
+      parseOpenCodeRuntimeResult(
+        (await command(probe, { ...environment, OPENCODE_DB: ':memory:' })).stdout
+      ).status
+    ).toBe('not-needed')
+  })
+
+  it('reclaims an abandoned binary through the shared pool while preserving fresh uploads', async () => {
+    const root = await directory()
+    const abandoned = await reserveStage(root)
+    await writeFile(join(abandoned.slotDir, 'payload', 'bun'), 'partial upload')
+    const fresh = await reserveStage(root)
+    await writeFile(join(fresh.slotDir, 'payload', 'bun'), 'active upload')
+    const old = new Date(Date.now() - 3_600_000)
+    await utimes(join(abandoned.slotDir, '.orca-upload-owner'), old, old)
+    const recovered = await command(recoverOneStaleRelayUploadStageCommand(host, abandoned.poolDir))
+    expect(recovered.code, recovered.stderr).toBe(0)
+    await expect(stat(abandoned.slotDir)).rejects.toMatchObject({ code: 'ENOENT' })
+    expect(await readFile(join(fresh.slotDir, 'payload', 'bun'), 'utf8')).toBe('active upload')
+  })
+
+  it('falls back to an atomic unique rename when the host filesystem rejects hard links', async () => {
+    const root = await directory()
+    const source = join(root, 'source')
+    await writeFile(source, 'verified runtime')
+    const preload = join(root, 'disable-hardlinks.cjs')
+    await writeFile(
+      preload,
+      "require('node:fs').promises.link=async()=>{throw Object.assign(Error('unsupported'),{code:'EPERM'})}"
+    )
+    const executable = join(root, expectedHash, 'bun')
+    const result = await command(
+      promoteOpenCodeRuntimeCommand({
+        host,
+        nodePath,
+        stagedBinary: source,
+        executable,
+        expectedHash,
+        repairToken: 'fallback'
+      }),
+      { NODE_OPTIONS: `--require ${JSON.stringify(preload)}` }
+    )
+    expect(result.code, result.stderr).toBe(0)
+    const repaired = join(root, expectedHash, 'repair-fallback', 'bun')
+    expect(parseOpenCodeRuntimeResult(result.stdout)).toEqual({
+      status: 'ready',
+      executable: repaired
+    })
+    expect(await readFile(repaired, 'utf8')).toBe('verified runtime')
+    await expect(stat(source)).rejects.toMatchObject({ code: 'ENOENT' })
+  })
+})
+
+it('carries Windows JavaScript and path arguments through the established PowerShell encoder', () => {
+  const windows = getRemoteHostPlatform('win32-x64')
+  const command = promoteOpenCodeRuntimeCommand({
+    host: windows,
+    nodePath: "C:/Program Files/O'Brien/node.exe",
+    stagedBinary: 'C:/Users/a & b/.upload/bun.exe',
+    executable: 'C:/Users/a & b/cache/bun.exe',
+    expectedHash,
+    repairToken: 'one'
+  })
+  const decoded = decodeRemotePowerShellScript(command)
+  expect(decoded).toContain("& 'C:/Program Files/O''Brien/node.exe'")
+  expect(decoded).toContain('createHash')
+  expect(decoded).toContain('C:/Users/a & b/.upload/bun.exe')
+  expect(command).not.toContain('-ExecutionPolicy')
+})
+
+it('rejects missing or malformed host confirmations', () => {
+  expect(() => parseOpenCodeRuntimeResult('login banner')).toThrow('did not confirm')
+  expect(() =>
+    parseOpenCodeRuntimeResult('ORCA_VAULT_SQLITE:{"status":"ready","executable":"node"}')
+  ).toThrow('invalid executable')
+})
+
+it('accepts an absolute Windows UNC executable path', () => {
+  const executable = String.raw`\\server\profile\vault-sqlite\bun.exe`
+  expect(
+    parseOpenCodeRuntimeResult(
+      `ORCA_VAULT_SQLITE:${JSON.stringify({ status: 'ready', executable })}`
+    )
+  ).toEqual({ status: 'ready', executable })
+})
diff --git a/src/main/ssh/ssh-relay-opencode-runtime-commands.ts b/src/main/ssh/ssh-relay-opencode-runtime-commands.ts
new file mode 100644
index 000000000000..14900f15e5bd
--- /dev/null
+++ b/src/main/ssh/ssh-relay-opencode-runtime-commands.ts
@@ -0,0 +1,151 @@
+import { shellEscape } from './ssh-connection-utils'
+import { posix, win32 } from 'node:path'
+import { powerShellCommand, powerShellLiteral, powerShellNativeArg } from './ssh-remote-powershell'
+import { isWindowsRemoteHost, type RemoteHostPlatform } from './ssh-remote-platform'
+
+export const OPENCODE_RUNTIME_RESULT = 'ORCA_VAULT_SQLITE:'
+
+function nodeCommand(
+  host: RemoteHostPlatform,
+  nodePath: string,
+  script: string,
+  args: string[]
+): string {
+  if (isWindowsRemoteHost(host)) {
+    return powerShellCommand(
+      `& ${powerShellLiteral(nodePath)} -e ${powerShellNativeArg(script)} -- ${args.map(powerShellNativeArg).join(' ')}; if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }`
+    )
+  }
+  return `${shellEscape(nodePath)} -e ${shellEscape(script)} -- ${args.map(shellEscape).join(' ')}`
+}
+
+const SEND = `const send=(value)=>console.log(${JSON.stringify(OPENCODE_RUNTIME_RESULT)}+JSON.stringify(value));`
+const HASH = `const fs=require('node:fs');const fsp=fs.promises;const path=require('node:path');
+async function hash(file){try{const digest=require('node:crypto').createHash('sha256');for await(const chunk of fs.createReadStream(file))digest.update(chunk);return digest.digest('hex')}catch(error){if(error.code==='ENOENT')return null;throw error}}
+`
+
+export function probeOpenCodeNodeSqliteCommand(
+  host: RemoteHostPlatform,
+  nodePath: string,
+  homeDirectory: string
+): string {
+  return nodeCommand(
+    host,
+    nodePath,
+    `${SEND}
+const fs=require('node:fs/promises');const path=require('node:path');
+(async()=>{const data=path.join(process.env.XDG_DATA_HOME?.trim()||path.join(process.argv[1],'.local','share'),'opencode');
+const override=process.env.OPENCODE_DB?.trim();let present=false;
+try{if(override&&override!==':memory:'){present=(await fs.stat(path.isAbsolute(override)?override:path.join(data,override))).isFile()}
+else if(!override){const directory=await fs.opendir(data);for await(const entry of directory){if(entry.isFile()&&/^opencode(?:-[A-Za-z0-9_.-]+)?\\.db$/.test(entry.name)){present=true;break}}}}
+catch(error){if(error.code!=='ENOENT'&&error.code!=='ENOTDIR')throw error}
+if(!present){send({status:'not-needed'});return}
+let db;try{db=new(require('node:sqlite').DatabaseSync)(':memory:');
+if(db.prepare('SELECT 1 AS ready').get().ready!==1)throw Error('SQLite read failed');
+send({status:'ready',executable:process.execPath})}catch{send({status:'unsupported'})}finally{if(db)db.close()}
+})().catch(error=>{console.error(error.message);process.exitCode=1})`,
+    [homeDirectory]
+  )
+}
+
+export function probeOpenCodeRuntimeCacheCommand(args: {
+  host: RemoteHostPlatform
+  nodePath: string
+  executable: string
+  expectedHash: string
+  reference: string
+}): string {
+  return nodeCommand(
+    args.host,
+    args.nodePath,
+    `${HASH}${SEND}
+(async()=>{const [executable,expected,reference]=process.argv.slice(1);
+let candidate=executable;let digest=candidate?await hash(candidate):null;
+if(candidate&&digest!==expected){try{const ref=JSON.parse(await fsp.readFile(reference,'utf8'));
+const relative=path.relative(path.dirname(executable),ref.executable);
+if(ref.protocol===1&&relative&&!relative.startsWith('..'+path.sep)&&relative!=='..'&&!path.isAbsolute(relative)){candidate=ref.executable;digest=await hash(candidate)}}catch{}}
+if(candidate&&digest===expected){if(process.platform!=='win32')await fsp.chmod(candidate,448);send({status:'ready',executable:candidate});return}
+send({status:'missing'})})().catch(error=>{console.error(error.message);process.exitCode=1})`,
+    [args.executable, args.expectedHash, args.reference]
+  )
+}
+
+export function promoteOpenCodeRuntimeCommand(args: {
+  host: RemoteHostPlatform
+  nodePath: string
+  stagedBinary: string
+  executable: string
+  expectedHash: string
+  repairToken: string
+}): string {
+  return nodeCommand(
+    args.host,
+    args.nodePath,
+    `${HASH}${SEND}
+(async()=>{const [source,destination,expected,token]=process.argv.slice(1);
+if(await hash(source)!==expected)throw Error('Uploaded SQLite runtime checksum mismatch');
+let executable=destination;const existing=await hash(destination);
+if(existing!==expected){
+if(existing!==null)executable=path.join(path.dirname(destination),'repair-'+token,path.basename(destination));
+await fsp.mkdir(path.dirname(executable),{recursive:true,mode:448});
+if(process.platform!=='win32')await fsp.chmod(source,448);
+try{await fsp.link(source,executable)}catch(error){if(await hash(executable)!==expected){
+if(!['EPERM','EOPNOTSUPP','ENOTSUP','ENOSYS','EXDEV'].includes(error.code))throw error;
+executable=path.join(path.dirname(destination),'repair-'+token,path.basename(destination));
+await fsp.mkdir(path.dirname(executable),{recursive:true,mode:448});await fsp.rename(source,executable)
+}}
+}
+send({status:'ready',executable})})().catch(error=>{console.error(error.message);process.exitCode=1})`,
+    [args.stagedBinary, args.executable, args.expectedHash, args.repairToken]
+  )
+}
+
+export function publishOpenCodeRuntimeReferenceCommand(args: {
+  host: RemoteHostPlatform
+  nodePath: string
+  stagedReference: string
+  reference: string
+  token: string
+}): string {
+  return nodeCommand(
+    args.host,
+    args.nodePath,
+    `${SEND}
+const fs=require('node:fs/promises');const path=require('node:path');
+(async()=>{const [source,destination,token]=process.argv.slice(1);const temporary=destination+'.upload-'+token;
+try{await fs.copyFile(source,temporary,require('node:fs').constants.COPYFILE_EXCL);
+await fs.rename(temporary,destination);send({status:'published'})}
+finally{await fs.rm(temporary,{force:true})}})().catch(error=>{console.error(error.message);process.exitCode=1})`,
+    [args.stagedReference, args.reference, args.token]
+  )
+}
+
+export function parseOpenCodeRuntimeResult(output: string): {
+  status: string
+  executable?: string
+} {
+  const line = output.split(/\r?\n/).findLast((entry) => entry.startsWith(OPENCODE_RUNTIME_RESULT))
+  if (!line) {
+    throw new Error('The host did not confirm SQLite runtime setup.')
+  }
+  const result: unknown = JSON.parse(line.slice(OPENCODE_RUNTIME_RESULT.length))
+  if (
+    typeof result !== 'object' ||
+    result === null ||
+    !('status' in result) ||
+    typeof result.status !== 'string'
+  ) {
+    throw new Error('Invalid SQLite runtime setup result.')
+  }
+  if ('executable' in result) {
+    if (
+      typeof result.executable !== 'string' ||
+      !(posix.isAbsolute(result.executable) || win32.isAbsolute(result.executable)) ||
+      /[\0\r\n]/.test(result.executable)
+    ) {
+      throw new Error('SQLite runtime setup returned an invalid executable path.')
+    }
+    return { status: result.status, executable: result.executable }
+  }
+  return { status: result.status }
+}
diff --git a/src/main/ssh/ssh-relay-opencode-runtime-retry.test.ts b/src/main/ssh/ssh-relay-opencode-runtime-retry.test.ts
new file mode 100644
index 000000000000..be8fde1fc5e6
--- /dev/null
+++ b/src/main/ssh/ssh-relay-opencode-runtime-retry.test.ts
@@ -0,0 +1,90 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { createRemoteOpenCodeRuntimeRetry } from './ssh-relay-opencode-runtime-retry'
+
+afterEach(() => vi.useRealTimers())
+
+describe('scan-triggered SSH OpenCode runtime preparation', () => {
+  it('rechecks an empty host after the cooldown, coalesces scans, and stops once ready', async () => {
+    vi.useFakeTimers()
+    const retry = vi.fn().mockResolvedValue('ready')
+    const prepare = createRemoteOpenCodeRuntimeRetry(
+      Promise.resolve('not-needed'),
+      Promise.resolve(true),
+      retry
+    )
+    const signal = new AbortController().signal
+    await prepare(signal)
+    expect(retry).not.toHaveBeenCalled()
+    await vi.advanceTimersByTimeAsync(60_000)
+    await Promise.all([prepare(signal), prepare(signal), prepare(signal)])
+    expect(retry).toHaveBeenCalledOnce()
+    await vi.advanceTimersByTimeAsync(60_000)
+    await prepare(signal)
+    expect(retry).toHaveBeenCalledOnce()
+  })
+
+  it('waits for initial background cleanup before a scan can retry', async () => {
+    vi.useFakeTimers()
+    let finish!: () => void
+    const cleanup = new Promise<boolean>((resolve) => {
+      finish = () => resolve(true)
+    })
+    const retry = vi.fn().mockResolvedValue('ready')
+    const prepare = createRemoteOpenCodeRuntimeRetry(Promise.resolve('failed'), cleanup, retry)
+    await prepare(new AbortController().signal)
+    await vi.advanceTimersByTimeAsync(30_000)
+    const pending = prepare(new AbortController().signal)
+    await Promise.resolve()
+    expect(retry).not.toHaveBeenCalled()
+    finish()
+    await pending
+    expect(retry).toHaveBeenCalledOnce()
+  })
+
+  it('cancels a queued retry on session teardown without starting a remote command', async () => {
+    vi.useFakeTimers()
+    const retry = vi.fn()
+    const prepare = createRemoteOpenCodeRuntimeRetry(
+      Promise.resolve('not-needed'),
+      new Promise(() => {}),
+      retry
+    )
+    const controller = new AbortController()
+    await prepare(controller.signal)
+    await vi.advanceTimersByTimeAsync(60_000)
+    const pending = prepare(controller.signal)
+    controller.abort()
+    await pending
+    await prepare(controller.signal)
+    expect(retry).not.toHaveBeenCalled()
+  })
+
+  it('never retries an unconfirmed remote teardown', async () => {
+    vi.useFakeTimers()
+    const retry = vi.fn()
+    const prepare = createRemoteOpenCodeRuntimeRetry(
+      Promise.resolve('teardown-unconfirmed'),
+      Promise.resolve(true),
+      retry
+    )
+    await vi.advanceTimersByTimeAsync(3600_000)
+    await prepare(new AbortController().signal)
+    expect(retry).not.toHaveBeenCalled()
+  })
+
+  it('never retries after deployment cleanup reports an unconfirmed command', async () => {
+    vi.useFakeTimers()
+    const retry = vi.fn()
+    const prepare = createRemoteOpenCodeRuntimeRetry(
+      Promise.resolve('not-needed'),
+      Promise.resolve(false),
+      retry
+    )
+    await prepare(new AbortController().signal)
+    await vi.advanceTimersByTimeAsync(60_000)
+    await prepare(new AbortController().signal)
+    await vi.advanceTimersByTimeAsync(3600_000)
+    await prepare(new AbortController().signal)
+    expect(retry).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/main/ssh/ssh-relay-opencode-runtime-retry.ts b/src/main/ssh/ssh-relay-opencode-runtime-retry.ts
new file mode 100644
index 000000000000..103da40a6cda
--- /dev/null
+++ b/src/main/ssh/ssh-relay-opencode-runtime-retry.ts
@@ -0,0 +1,42 @@
+import { waitForPromiseWithSignal } from '../../shared/abort-signal-reason'
+import type { RemoteOpenCodeRuntimeOutcome } from './ssh-relay-opencode-runtime'
+
+export type RemoteOpenCodeRuntimePreparation = (signal: AbortSignal) => Promise<void>
+
+export function createRemoteOpenCodeRuntimeRetry(
+  initialSetup: Promise<RemoteOpenCodeRuntimeOutcome>,
+  backgroundCleanup: Promise<boolean>,
+  retry: (signal: AbortSignal) => Promise<RemoteOpenCodeRuntimeOutcome>
+): RemoteOpenCodeRuntimePreparation {
+  let nextAttempt = Infinity
+  let pending: Promise<void> | undefined
+  const remember = (outcome: RemoteOpenCodeRuntimeOutcome): void => {
+    nextAttempt =
+      outcome === 'ready' || outcome === 'teardown-unconfirmed'
+        ? Infinity
+        : Date.now() + (outcome === 'not-needed' ? 60_000 : 30_000)
+  }
+  const initialized = initialSetup.then(remember).catch(() => {})
+  return (signal) => {
+    if (signal.aborted) {
+      return Promise.resolve()
+    }
+    pending ??= (async () => {
+      await waitForPromiseWithSignal(initialized, signal)
+      if (Date.now() < nextAttempt) {
+        return
+      }
+      if (!(await waitForPromiseWithSignal(backgroundCleanup, signal))) {
+        nextAttempt = Infinity
+        return
+      }
+      signal.throwIfAborted()
+      remember(await retry(signal))
+    })()
+      .catch(() => {})
+      .finally(() => {
+        pending = undefined
+      })
+    return pending
+  }
+}
diff --git a/src/main/ssh/ssh-relay-opencode-runtime.test.ts b/src/main/ssh/ssh-relay-opencode-runtime.test.ts
new file mode 100644
index 000000000000..ce3da563b97c
--- /dev/null
+++ b/src/main/ssh/ssh-relay-opencode-runtime.test.ts
@@ -0,0 +1,412 @@
+import { mkdtemp, readFile, readdir, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+const mocks = vi.hoisted(() => ({
+  exec: vi.fn(),
+  upload: vi.fn(),
+  write: vi.fn(),
+  materialize: vi.fn(),
+  target: vi.fn(),
+  warm: false,
+  checksumError: false,
+  cleanupError: false,
+  reservationError: false
+}))
+vi.mock('./ssh-relay-deploy-helpers', () => ({
+  execCommand: mocks.exec,
+  isUnconfirmedSshCommandTermination: (error: unknown) =>
+    error instanceof Error &&
+    'sshChannelCloseConfirmed' in error &&
+    error.sshChannelCloseConfirmed === false
+}))
+vi.mock('./ssh-relay-install-transfers', () => ({
+  uploadRelayDirectory: mocks.upload,
+  writeRelayFile: mocks.write
+}))
+vi.mock('./orcad-bun-runtime-materializer', () => ({
+  materializeCachedOrcadBunRuntime: mocks.materialize
+}))
+vi.mock('./orcad-deployment-target', () => ({ resolveOrcadDeploymentTarget: mocks.target }))
+
+import type { SshConnection } from './ssh-connection'
+import { getRemoteHostPlatform } from './ssh-remote-platform'
+import { ORCAD_BUN_RELEASE_ASSETS } from '../../shared/orcad-bun-runtime'
+import { ensureRemoteOpenCodeRuntime } from './ssh-relay-opencode-runtime'
+import { OPENCODE_RUNTIME_RESULT } from './ssh-relay-opencode-runtime-commands'
+
+const host = getRemoteHostPlatform('linux-x64')
+const remoteHome = '/home/ada'
+const relayDir = `${remoteHome}/.orca-remote/relay-build`
+const binary = `${remoteHome}/.orca-remote/vault-sqlite/${ORCAD_BUN_RELEASE_ASSETS['linux-x64-glibc'].executableSha256}/bun`
+let cacheRoot: string
+let runtime: string
+const frame = (status: string, executable?: string) =>
+  `${OPENCODE_RUNTIME_RESULT}${JSON.stringify({ status, executable })}\n`
+const options = () => ({ nodePath: '/usr/bin/node', relayDir, cacheRoot })
+
+function hostCommandResult(command: string): string {
+  if (command.includes('staging quota is full')) {
+    if (mocks.reservationError) {
+      throw new Error('staging quota is full')
+    }
+    return `__ORCA_UPLOAD_STAGE_SLOT__${command.match(/\.sftp-namespace-[0-9a-f]{32}/)?.[0]}:slot-0`
+  }
+  if (command.includes('SELECT 1 AS ready')) {
+    return frame('unsupported')
+  }
+  if (command.includes('checksum mismatch')) {
+    if (mocks.checksumError) {
+      throw new Error('Uploaded SQLite runtime checksum mismatch')
+    }
+    return frame('ready', binary)
+  }
+  if (command.includes('published')) {
+    return frame('published')
+  }
+  if (command.includes('status:')) {
+    return mocks.warm ? frame('ready', binary) : frame('missing')
+  }
+  if (mocks.cleanupError && command.includes('claim_identity') && !command.includes('old=')) {
+    throw Object.assign(new Error('Cleanup teardown is unconfirmed'), {
+      sshChannelCloseConfirmed: false
+    })
+  }
+  return ''
+}
+
+function connection(system = false): SshConnection {
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Setup reads only the mocked transport flag and connection generation; remote I/O is mocked.
+  return {
+    usesSystemSshTransport: () => system,
+    getConnectGeneration: () => 1
+  } as unknown as SshConnection
+}
+
+beforeEach(async () => {
+  vi.resetAllMocks()
+  vi.spyOn(console, 'warn').mockImplementation(() => {})
+  cacheRoot = await mkdtemp(join(tmpdir(), 'orca-vault-runtime-'))
+  runtime = join(cacheRoot, 'repair-1-orcad-bun')
+  await writeFile(runtime, 'verified runtime')
+  mocks.materialize.mockResolvedValue(runtime)
+  mocks.target.mockResolvedValue('linux-x64-glibc')
+  mocks.warm = false
+  mocks.checksumError = false
+  mocks.cleanupError = false
+  mocks.reservationError = false
+  mocks.exec.mockImplementation(async (_conn, command: string) => hostCommandResult(command))
+})
+
+afterEach(async () => {
+  vi.useRealTimers()
+  vi.restoreAllMocks()
+  await rm(cacheRoot, { recursive: true, force: true })
+})
+
+describe('SSH OpenCode runtime setup', () => {
+  it('publishes a capable existing Node without materializing or uploading Bun', async () => {
+    mocks.exec.mockResolvedValueOnce(frame('ready', '/opt/node 24/bin/node'))
+    expect(await ensureRemoteOpenCodeRuntime(connection(), host, remoteHome, options())).toBe(
+      'ready'
+    )
+    expect(mocks.target).not.toHaveBeenCalled()
+    expect(mocks.materialize).not.toHaveBeenCalled()
+    expect(mocks.upload).not.toHaveBeenCalled()
+    expect(JSON.parse(mocks.write.mock.calls[0][3])).toEqual({
+      protocol: 1,
+      executable: '/opt/node 24/bin/node'
+    })
+  })
+
+  it('uses the verified materializer cache after Node 18 fails the actual read probe', async () => {
+    mocks.upload.mockImplementation(async (_conn, localDir: string) => {
+      expect(await readdir(localDir)).toEqual(['bun'])
+      expect(await readFile(join(localDir, 'bun'), 'utf8')).toBe('verified runtime')
+    })
+    expect(await ensureRemoteOpenCodeRuntime(connection(), host, remoteHome, options())).toBe(
+      'ready'
+    )
+    expect(mocks.target).toHaveBeenCalledWith(
+      expect.objectContaining({ host, signal: expect.any(AbortSignal) })
+    )
+    expect(mocks.materialize).toHaveBeenCalledWith('linux-x64-glibc', cacheRoot, {
+      signal: expect.any(AbortSignal)
+    })
+    expect(await readdir(cacheRoot)).toEqual(['repair-1-orcad-bun'])
+    expect(JSON.parse(mocks.write.mock.calls[0][3])).toEqual({ protocol: 1, executable: binary })
+  })
+
+  it('reuses a remotely verified binary without downloading it again', async () => {
+    mocks.warm = true
+    expect(await ensureRemoteOpenCodeRuntime(connection(), host, remoteHome, options())).toBe(
+      'ready'
+    )
+    expect(mocks.materialize).not.toHaveBeenCalled()
+    expect(mocks.upload).not.toHaveBeenCalled()
+  })
+
+  it('uses one staging namespace for binary uploads and atomic reference writes', async () => {
+    await ensureRemoteOpenCodeRuntime(connection(), host, remoteHome, options())
+    const uploadOptions = mocks.upload.mock.calls[0][4]
+    const writeOptions = mocks.write.mock.calls[0][4]
+    expect(uploadOptions.sftpNamespace.homeRelativeNamespaceRoot).toMatch(
+      /^\.orca-remote\/\.upload-stages\/slot-0$/
+    )
+    expect(uploadOptions.sftpNamespace.shellProbePath).toBe(
+      writeOptions.sftpNamespace.shellProbePath
+    )
+    expect(writeOptions.sftpNamespace.homeRelativePath).toBe(
+      `${uploadOptions.sftpNamespace.homeRelativePath}/opencode-sqlite-runtime.json`
+    )
+  })
+
+  it('skips namespace probing on system SSH', async () => {
+    await ensureRemoteOpenCodeRuntime(connection(true), host, remoteHome, options())
+    expect(mocks.upload.mock.calls[0][4].sftpNamespace).toBeUndefined()
+    expect(mocks.write.mock.calls[0][4].sftpNamespace).toBeUndefined()
+  })
+
+  it('coalesces repeated setup for one execution connection and directory', async () => {
+    const conn = connection()
+    const result = await Promise.all([
+      ensureRemoteOpenCodeRuntime(conn, host, remoteHome, options()),
+      ensureRemoteOpenCodeRuntime(conn, host, remoteHome, options())
+    ])
+    expect(result).toEqual(['ready', 'ready'])
+    expect(mocks.upload).toHaveBeenCalledOnce()
+  })
+
+  it('coalesces the bounded target cache fill across hosts', async () => {
+    let finish!: (path: string) => void
+    mocks.materialize.mockReturnValue(
+      new Promise<string>((resolve) => {
+        finish = resolve
+      })
+    )
+    const first = ensureRemoteOpenCodeRuntime(connection(), host, remoteHome, options())
+    const second = ensureRemoteOpenCodeRuntime(connection(), host, remoteHome, options())
+    await vi.waitFor(() => expect(mocks.materialize).toHaveBeenCalledOnce())
+    finish(runtime)
+    expect(await Promise.all([first, second])).toEqual(['ready', 'ready'])
+    expect(mocks.upload).toHaveBeenCalledTimes(2)
+  })
+
+  it('never publishes a reference after a failed remote checksum', async () => {
+    mocks.checksumError = true
+    expect(await ensureRemoteOpenCodeRuntime(connection(), host, remoteHome, options())).toBe(
+      'failed'
+    )
+    expect(mocks.write).not.toHaveBeenCalled()
+  })
+
+  it('aborts an upload without publishing or running further host commands', async () => {
+    const controller = new AbortController()
+    mocks.upload.mockImplementation(async (_conn, _local, _remote, _host, transfer) => {
+      controller.abort()
+      transfer.signal.throwIfAborted()
+    })
+    expect(
+      await ensureRemoteOpenCodeRuntime(connection(), host, remoteHome, {
+        ...options(),
+        signal: controller.signal
+      })
+    ).toBe('teardown-unconfirmed')
+    expect(mocks.write).not.toHaveBeenCalled()
+    expect(mocks.exec).toHaveBeenCalledTimes(4)
+  })
+
+  it('bounds even an unresponsive setup operation at 180 seconds', async () => {
+    vi.useFakeTimers()
+    mocks.exec.mockReturnValue(new Promise(() => {}))
+    const conn = connection()
+    const result = ensureRemoteOpenCodeRuntime(conn, host, remoteHome, options())
+    await vi.advanceTimersByTimeAsync(180_000)
+    expect(await result).toBe('teardown-unconfirmed')
+    expect(mocks.exec.mock.calls[0][2].signal.aborted).toBe(true)
+    expect(mocks.materialize).not.toHaveBeenCalled()
+    expect(await ensureRemoteOpenCodeRuntime(conn, host, remoteHome, options())).toBe(
+      'teardown-unconfirmed'
+    )
+    expect(mocks.exec).toHaveBeenCalledOnce()
+  })
+
+  it('admits setup on a new connection generation after an unconfirmed teardown', async () => {
+    const conn = connection()
+    const generation = vi.spyOn(conn, 'getConnectGeneration')
+    mocks.exec.mockRejectedValueOnce(
+      Object.assign(new Error('Channel teardown is unconfirmed'), {
+        sshChannelCloseConfirmed: false
+      })
+    )
+    expect(await ensureRemoteOpenCodeRuntime(conn, host, remoteHome, options())).toBe(
+      'teardown-unconfirmed'
+    )
+    expect(await ensureRemoteOpenCodeRuntime(conn, host, remoteHome, options())).toBe(
+      'teardown-unconfirmed'
+    )
+    expect(mocks.exec).toHaveBeenCalledOnce()
+    generation.mockReturnValue(2)
+    mocks.exec.mockResolvedValueOnce(frame('ready', '/usr/bin/node'))
+    expect(await ensureRemoteOpenCodeRuntime(conn, host, remoteHome, options())).toBe('ready')
+    expect(mocks.write).toHaveBeenCalledOnce()
+  })
+
+  it.each(['ready', 'not-needed'] as const)(
+    'refuses a late %s result from a superseded setup',
+    async (status) => {
+      const conn = connection()
+      const generation = vi.spyOn(conn, 'getConnectGeneration')
+      mocks.exec.mockImplementationOnce(async () => {
+        generation.mockReturnValue(2)
+        return frame(status, '/usr/bin/node')
+      })
+      expect(await ensureRemoteOpenCodeRuntime(conn, host, remoteHome, options())).toBe('failed')
+      expect(mocks.exec).toHaveBeenCalledOnce()
+      expect(mocks.write).not.toHaveBeenCalled()
+    }
+  )
+
+  it.each(['publication', 'cleanup'] as const)(
+    'refuses completed setup when its generation changes during %s',
+    async (stage) => {
+      const conn = connection()
+      const generation = vi.spyOn(conn, 'getConnectGeneration')
+      const started = Promise.withResolvers<void>()
+      const finish = Promise.withResolvers<string>()
+      mocks.exec.mockImplementation(async (_conn, command: string) => {
+        if (command.includes('SELECT 1 AS ready')) {
+          return frame('ready', '/usr/bin/node')
+        }
+        const selected =
+          stage === 'publication'
+            ? command.includes('published')
+            : command.includes('claim_identity') && !command.includes('old=')
+        if (selected) {
+          started.resolve()
+          return finish.promise
+        }
+        return hostCommandResult(command)
+      })
+      const pending = ensureRemoteOpenCodeRuntime(conn, host, remoteHome, options())
+      await started.promise
+      generation.mockReturnValue(2)
+      finish.resolve(stage === 'publication' ? frame('published') : '')
+
+      expect(await pending).toBe('failed')
+      expect(mocks.exec).toHaveBeenCalledTimes(stage === 'publication' ? 4 : 5)
+      expect(mocks.write).toHaveBeenCalledOnce()
+    }
+  )
+
+  it('keeps a newer setup registered when the superseded setup finishes late', async () => {
+    const conn = connection()
+    const generation = vi.spyOn(conn, 'getConnectGeneration')
+    const oldProbe = Promise.withResolvers<string>()
+    const currentProbe = Promise.withResolvers<string>()
+    mocks.exec.mockReturnValueOnce(oldProbe.promise).mockReturnValueOnce(currentProbe.promise)
+    const oldSetup = ensureRemoteOpenCodeRuntime(conn, host, remoteHome, options())
+    generation.mockReturnValue(2)
+    const currentSetup = ensureRemoteOpenCodeRuntime(conn, host, remoteHome, options())
+    oldProbe.resolve(frame('not-needed'))
+    expect(await oldSetup).toBe('failed')
+
+    const joined = ensureRemoteOpenCodeRuntime(conn, host, remoteHome, options())
+    expect(mocks.exec).toHaveBeenCalledTimes(2)
+    currentProbe.resolve(frame('not-needed'))
+    expect(await Promise.all([currentSetup, joined])).toEqual(['not-needed', 'not-needed'])
+  })
+
+  it.each(['deadline', 'caller'] as const)(
+    'allows retry after local download cancellation by %s without reserving a stage',
+    async (cause) => {
+      const controller = new AbortController()
+      let finish!: (path: string) => void
+      mocks.materialize.mockReturnValueOnce(
+        new Promise<string>((resolve) => {
+          finish = resolve
+        })
+      )
+      if (cause === 'deadline') {
+        vi.useFakeTimers()
+      }
+      const conn = connection()
+      const pending = ensureRemoteOpenCodeRuntime(conn, host, remoteHome, {
+        ...options(),
+        signal: controller.signal
+      })
+      await vi.waitFor(() => expect(mocks.materialize).toHaveBeenCalledOnce())
+      expect(mocks.exec).toHaveBeenCalledTimes(2)
+      if (cause === 'deadline') {
+        await vi.advanceTimersByTimeAsync(180_000)
+      } else {
+        controller.abort()
+      }
+      expect(await pending).toBe('failed')
+      finish(runtime)
+      vi.useRealTimers()
+      await new Promise<void>((resolve) => setImmediate(resolve))
+      expect(mocks.exec).toHaveBeenCalledTimes(2)
+      expect(mocks.upload).not.toHaveBeenCalled()
+      expect(mocks.write).not.toHaveBeenCalled()
+      expect(await ensureRemoteOpenCodeRuntime(conn, host, remoteHome, options())).toBe('ready')
+      expect(mocks.upload).toHaveBeenCalledOnce()
+    }
+  )
+
+  it('retains the upload stage when a failed transfer may still be running', async () => {
+    mocks.upload.mockRejectedValue(
+      Object.assign(new Error('Upload teardown is unconfirmed'), {
+        sshChannelCloseConfirmed: false
+      })
+    )
+    const conn = connection()
+    expect(await ensureRemoteOpenCodeRuntime(conn, host, remoteHome, options())).toBe(
+      'teardown-unconfirmed'
+    )
+    expect(mocks.exec).toHaveBeenCalledTimes(4)
+    expect(mocks.write).not.toHaveBeenCalled()
+    expect(await ensureRemoteOpenCodeRuntime(conn, host, remoteHome, options())).toBe(
+      'teardown-unconfirmed'
+    )
+    expect(mocks.exec).toHaveBeenCalledTimes(4)
+  })
+
+  it('reports an unconfirmed stage cleanup to the deployment command queue', async () => {
+    mocks.exec.mockResolvedValueOnce(frame('ready', '/usr/bin/node'))
+    mocks.cleanupError = true
+    expect(await ensureRemoteOpenCodeRuntime(connection(), host, remoteHome, options())).toBe(
+      'teardown-unconfirmed'
+    )
+    expect(mocks.exec).toHaveBeenCalledTimes(5)
+  })
+
+  it('skips installation without data and retries when a database appears on the same connection', async () => {
+    const conn = connection()
+    mocks.exec.mockResolvedValueOnce(frame('not-needed'))
+    expect(await ensureRemoteOpenCodeRuntime(conn, host, remoteHome, options())).toBe('not-needed')
+    expect(mocks.exec).toHaveBeenCalledOnce()
+    expect(mocks.materialize).not.toHaveBeenCalled()
+    expect(mocks.upload).not.toHaveBeenCalled()
+    expect(await ensureRemoteOpenCodeRuntime(conn, host, remoteHome, options())).toBe('ready')
+    expect(mocks.upload).toHaveBeenCalledOnce()
+  })
+
+  it('fails optionally without uploading when all bounded stages are occupied', async () => {
+    mocks.reservationError = true
+    expect(await ensureRemoteOpenCodeRuntime(connection(), host, remoteHome, options())).toBe(
+      'failed'
+    )
+    expect(mocks.exec).toHaveBeenCalledTimes(4)
+    expect(mocks.upload).not.toHaveBeenCalled()
+  })
+
+  it('does not mistake an unanswered Node probe for an old runtime', async () => {
+    mocks.exec.mockResolvedValue('login banner only')
+    expect(await ensureRemoteOpenCodeRuntime(connection(), host, remoteHome, options())).toBe(
+      'failed'
+    )
+    expect(mocks.materialize).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/main/ssh/ssh-relay-opencode-runtime.ts b/src/main/ssh/ssh-relay-opencode-runtime.ts
new file mode 100644
index 000000000000..83657e8b7f29
--- /dev/null
+++ b/src/main/ssh/ssh-relay-opencode-runtime.ts
@@ -0,0 +1,298 @@
+import { randomBytes } from 'node:crypto'
+import { copyFile, link, mkdtemp, rm } from 'node:fs/promises'
+import { dirname, join } from 'node:path'
+import { getAppEnvironment } from '../../shared/app-environment'
+import { waitForPromiseWithSignal } from '../../shared/abort-signal-reason'
+import { ORCAD_BUN_RELEASE_ASSETS, type OrcadBunTarget } from '../../shared/orcad-bun-runtime'
+import type { SshConnection } from './ssh-connection'
+import { resolveOrcadDeploymentTarget } from './orcad-deployment-target'
+import { materializeCachedOrcadBunRuntime } from './orcad-bun-runtime-materializer'
+import { execCommand, isUnconfirmedSshCommandTermination } from './ssh-relay-deploy-helpers'
+import { uploadRelayDirectory, writeRelayFile } from './ssh-relay-install-transfers'
+import {
+  createRelayUploadStageNamespace,
+  relayUploadStageSftpNamespaceMapping
+} from './ssh-relay-install-namespace'
+import { isWindowsRemoteHost, joinRemotePath, type RemoteHostPlatform } from './ssh-remote-platform'
+import { RELAY_REMOTE_DIR } from './relay-protocol'
+import { createRelayInstallMarkerFileName } from './ssh-relay-install-marker'
+import {
+  cleanupOwnedRelayUploadStageCommand,
+  parseReservedRelayUploadStage,
+  recoverOneStaleRelayUploadStageCommand,
+  reserveRelayUploadStageCommand,
+  RELAY_UPLOAD_STAGE_POOL_NAME
+} from './ssh-relay-upload-stage-commands'
+import {
+  parseOpenCodeRuntimeResult,
+  probeOpenCodeRuntimeCacheCommand,
+  probeOpenCodeNodeSqliteCommand,
+  promoteOpenCodeRuntimeCommand,
+  publishOpenCodeRuntimeReferenceCommand
+} from './ssh-relay-opencode-runtime-commands'
+
+const SETUP_TIMEOUT_MS = 180_000
+export type RemoteOpenCodeRuntimeOutcome =
+  | 'ready'
+  | 'not-needed'
+  | 'failed'
+  | 'teardown-unconfirmed'
+const installations = new WeakMap<
+  SshConnection,
+  { generation: number; byDirectory: Map<string, Promise<RemoteOpenCodeRuntimeOutcome>> }
+>()
+const downloads = new Map<string, Promise<string>>()
+
+type SetupOptions = {
+  nodePath: string
+  relayDir: string
+  signal?: AbortSignal
+  cacheRoot?: string
+}
+type RemoteOperation = <T>(operation: () => Promise<T>) => Promise<T>
+
+/** Optional companion setup; the host's relay and terminals never depend on it. */
+export function ensureRemoteOpenCodeRuntime(
+  conn: SshConnection,
+  host: RemoteHostPlatform,
+  remoteHome: string,
+  options: SetupOptions
+): Promise<RemoteOpenCodeRuntimeOutcome> {
+  const generation = conn.getConnectGeneration()
+  let current = installations.get(conn)
+  if (current?.generation !== generation) {
+    current = { generation, byDirectory: new Map() }
+    installations.set(conn, current)
+  }
+  const { byDirectory } = current
+  const active = byDirectory.get(options.relayDir)
+  if (active) {
+    return waitForPromiseWithSignal(active, options.signal).catch(() => 'teardown-unconfirmed')
+  }
+  const timeout = new AbortController()
+  const timer = setTimeout(
+    () => timeout.abort(new Error('SSH SQLite runtime setup timed out.')),
+    SETUP_TIMEOUT_MS
+  )
+  timer.unref()
+  const signal = options.signal ? AbortSignal.any([options.signal, timeout.signal]) : timeout.signal
+  let remotePending = false
+  let remoteUnconfirmed = false
+  const assertCurrentGeneration = (): void => {
+    if (conn.getConnectGeneration() !== generation) {
+      throw new Error('SSH connection changed during SQLite runtime setup.')
+    }
+  }
+  const remote: RemoteOperation = async (operation) => {
+    signal.throwIfAborted()
+    assertCurrentGeneration()
+    remotePending = true
+    try {
+      const result = await operation()
+      assertCurrentGeneration()
+      return result
+    } catch (error) {
+      remoteUnconfirmed ||= signal.aborted || isUnconfirmedSshCommandTermination(error)
+      throw error
+    } finally {
+      remotePending = false
+    }
+  }
+  const pending = waitForPromiseWithSignal(
+    install(conn, host, remoteHome, options, signal, remote),
+    signal
+  )
+    .then((outcome) => {
+      assertCurrentGeneration()
+      return outcome
+    })
+    .catch((error: unknown) => {
+      console.warn(
+        '[ssh-relay] OpenCode history runtime setup did not finish:',
+        error instanceof Error ? error.message : String(error)
+      )
+      return remotePending || remoteUnconfirmed || isUnconfirmedSshCommandTermination(error)
+        ? ('teardown-unconfirmed' as const)
+        : ('failed' as const)
+    })
+    .then((outcome) => {
+      clearTimeout(timer)
+      // An unresolved channel must not admit another installer on this connection.
+      if (outcome !== 'teardown-unconfirmed') {
+        byDirectory.delete(options.relayDir)
+      }
+      return outcome
+    })
+  byDirectory.set(options.relayDir, pending)
+  return pending
+}
+
+async function install(
+  conn: SshConnection,
+  host: RemoteHostPlatform,
+  remoteHome: string,
+  options: SetupOptions,
+  signal: AbortSignal,
+  remote: RemoteOperation
+): Promise<RemoteOpenCodeRuntimeOutcome> {
+  const exec = async (command: string): Promise<string> => {
+    signal.throwIfAborted()
+    const output = await remote(() =>
+      execCommand(conn, command, {
+        signal,
+        wrapCommand: !isWindowsRemoteHost(host)
+      })
+    )
+    signal.throwIfAborted()
+    return output
+  }
+  const node = parseOpenCodeRuntimeResult(
+    await exec(probeOpenCodeNodeSqliteCommand(host, options.nodePath, remoteHome))
+  )
+  if (node.status === 'not-needed') {
+    return 'not-needed'
+  }
+  if (node.status !== 'ready' && node.status !== 'unsupported') {
+    throw new Error('The host did not complete its SQLite read probe.')
+  }
+  let executable = node.executable
+  let target: OrcadBunTarget | undefined
+  let localRuntime: string | undefined
+  if (node.status === 'unsupported') {
+    target = await resolveOrcadDeploymentTarget({ conn, host, signal, exec })
+    const expectedHash = ORCAD_BUN_RELEASE_ASSETS[target].executableSha256
+    executable = joinRemotePath(
+      host,
+      remoteHome,
+      RELAY_REMOTE_DIR,
+      'vault-sqlite',
+      expectedHash,
+      isWindowsRemoteHost(host) ? 'bun.exe' : 'bun'
+    )
+    const cached = parseOpenCodeRuntimeResult(
+      await exec(
+        probeOpenCodeRuntimeCacheCommand({
+          host,
+          nodePath: options.nodePath,
+          executable,
+          expectedHash,
+          reference: joinRemotePath(host, options.relayDir, 'opencode-sqlite-runtime.json')
+        })
+      )
+    )
+    if (cached.status === 'ready' && cached.executable) {
+      executable = cached.executable
+    } else if (cached.status === 'missing') {
+      const cacheRoot =
+        options.cacheRoot ?? join(getAppEnvironment().getPath('userData'), 'orcad-artifacts')
+      localRuntime = await cachedRuntime(target, cacheRoot, signal)
+      signal.throwIfAborted()
+    } else {
+      throw new Error('The host did not confirm its SQLite runtime cache.')
+    }
+  }
+  if (!executable) {
+    throw new Error('The host did not identify its SQLite executable.')
+  }
+  const token = randomBytes(12).toString('hex')
+  const relativePool = `${RELAY_REMOTE_DIR}/${RELAY_UPLOAD_STAGE_POOL_NAME}`
+  const poolDir = joinRemotePath(host, remoteHome, relativePool)
+  const owner = createRelayInstallMarkerFileName()
+  await exec(recoverOneStaleRelayUploadStageCommand(host, poolDir))
+  const stage = parseReservedRelayUploadStage(
+    host,
+    poolDir,
+    owner,
+    await exec(reserveRelayUploadStageCommand(host, poolDir, owner))
+  )
+  const stageDir = stage.slotDir
+  const namespace = createRelayUploadStageNamespace(`${relativePool}/${stage.slotName}`, owner)
+  const mapping = (file?: string) =>
+    !isWindowsRemoteHost(host) && conn.usesSystemSshTransport?.() !== true
+      ? relayUploadStageSftpNamespaceMapping(namespace, host, stageDir, file)
+      : undefined
+  let cleanupAllowed = true
+  try {
+    if (target && localRuntime) {
+      const localStage = await mkdtemp(join(dirname(localRuntime), '.vault-upload-'))
+      try {
+        const binaryName = isWindowsRemoteHost(host) ? 'bun.exe' : 'bun'
+        const localBinary = join(localStage, binaryName)
+        await link(localRuntime, localBinary).catch(() => copyFile(localRuntime, localBinary))
+        signal.throwIfAborted()
+        await remote(() =>
+          uploadRelayDirectory(conn, localStage, joinRemotePath(host, stageDir, 'payload'), host, {
+            signal,
+            sftpNamespace: mapping()
+          })
+        )
+        const promoted = parseOpenCodeRuntimeResult(
+          await exec(
+            promoteOpenCodeRuntimeCommand({
+              host,
+              nodePath: options.nodePath,
+              stagedBinary: joinRemotePath(host, stageDir, 'payload', binaryName),
+              executable,
+              expectedHash: ORCAD_BUN_RELEASE_ASSETS[target].executableSha256,
+              repairToken: token
+            })
+          )
+        )
+        if (promoted.status !== 'ready' || !promoted.executable) {
+          throw new Error('The host did not verify the uploaded SQLite runtime.')
+        }
+        executable = promoted.executable
+      } finally {
+        await rm(localStage, { recursive: true, force: true }).catch(() => {})
+      }
+    }
+    const referenceName = 'opencode-sqlite-runtime.json'
+    const stagedReference = joinRemotePath(host, stageDir, 'payload', referenceName)
+    signal.throwIfAborted()
+    await remote(() =>
+      writeRelayFile(conn, host, stagedReference, JSON.stringify({ protocol: 1, executable }), {
+        signal,
+        sftpNamespace: mapping(referenceName)
+      })
+    )
+    const published = parseOpenCodeRuntimeResult(
+      await exec(
+        publishOpenCodeRuntimeReferenceCommand({
+          host,
+          nodePath: options.nodePath,
+          stagedReference,
+          reference: joinRemotePath(host, options.relayDir, referenceName),
+          token
+        })
+      )
+    )
+    return published.status === 'published' ? 'ready' : 'failed'
+  } catch (error) {
+    cleanupAllowed = !isUnconfirmedSshCommandTermination(error)
+    throw error
+  } finally {
+    if (cleanupAllowed && !signal.aborted) {
+      await exec(cleanupOwnedRelayUploadStageCommand(host, stage, owner)).catch((error) => {
+        if (isUnconfirmedSshCommandTermination(error)) {
+          throw error
+        }
+      })
+    }
+  }
+}
+
+function cachedRuntime(
+  target: OrcadBunTarget,
+  cacheRoot: string,
+  signal: AbortSignal
+): Promise<string> {
+  const key = `${cacheRoot}\0${target}`
+  let pending = downloads.get(key)
+  if (!pending) {
+    pending = materializeCachedOrcadBunRuntime(target, cacheRoot, {
+      signal: AbortSignal.timeout(SETUP_TIMEOUT_MS)
+    }).finally(() => downloads.delete(key))
+    downloads.set(key, pending)
+  }
+  return waitForPromiseWithSignal(pending, signal)
+}
diff --git a/src/main/ssh/ssh-relay-pty-master-cloexec-install.test.ts b/src/main/ssh/ssh-relay-pty-master-cloexec-install.test.ts
index 5b2a42d87c7b..f7fd4d657947 100644
--- a/src/main/ssh/ssh-relay-pty-master-cloexec-install.test.ts
+++ b/src/main/ssh/ssh-relay-pty-master-cloexec-install.test.ts
@@ -1,6 +1,9 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import type * as RelayInstallMarkerModule from './ssh-relay-install-marker'
 
+vi.mock('./ssh-relay-opencode-runtime', () => ({
+  ensureRemoteOpenCodeRuntime: vi.fn().mockResolvedValue('ready')
+}))
 vi.mock('./ssh-relay-ripgrep-install', () => ({
   remoteRipgrepLayout: vi.fn().mockReturnValue(null),
   recordRemoteRipgrepReference: vi.fn().mockResolvedValue(false),
diff --git a/src/main/ssh/ssh-relay-repair-lock-termination.test.ts b/src/main/ssh/ssh-relay-repair-lock-termination.test.ts
new file mode 100644
index 000000000000..db73b92e2393
--- /dev/null
+++ b/src/main/ssh/ssh-relay-repair-lock-termination.test.ts
@@ -0,0 +1,137 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+vi.mock('./ssh-relay-deploy-helpers', () => ({ execCommand: vi.fn() }))
+
+import type { SshConnection } from './ssh-connection'
+import { execCommand } from './ssh-relay-deploy-helpers'
+import { tryAcquireRelayRepairLock } from './ssh-relay-repair-lock'
+import { getRemoteHostPlatform } from './ssh-remote-platform'
+
+// oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The mocked execCommand never reads the connection.
+const conn = {} as SshConnection
+const mockExec = vi.mocked(execCommand)
+const freshLockReplies = ['OPEN', 'LOCKED', '0']
+const contentionReplies = ['OPEN', '', 'BUSY', 'BUSY']
+
+const failureStages = [
+  { stage: 'initial claim probe', replies: [], recovery: [], result: 'error' },
+  { stage: 'parent creation', replies: ['OPEN'], recovery: freshLockReplies, result: 'busy' },
+  { stage: 'lock creation', replies: ['OPEN', ''], recovery: freshLockReplies, result: 'busy' },
+  {
+    stage: 'stale takeover',
+    replies: ['OPEN', '', 'BUSY'],
+    recovery: freshLockReplies,
+    result: 'busy'
+  },
+  {
+    stage: 'claim probe after creation',
+    replies: ['OPEN', '', 'OK'],
+    recovery: [''],
+    result: 'error'
+  },
+  {
+    stage: 'release after creation',
+    replies: ['OPEN', '', 'OK', 'LOCKED'],
+    recovery: [],
+    result: 'gc'
+  },
+  {
+    stage: 'claim probe after takeover',
+    replies: ['OPEN', '', 'BUSY', 'OK'],
+    recovery: [''],
+    result: 'error'
+  },
+  {
+    stage: 'release after takeover',
+    replies: ['OPEN', '', 'BUSY', 'OK', 'LOCKED'],
+    recovery: [],
+    result: 'gc'
+  },
+  { stage: 'contention claim probe', replies: contentionReplies, recovery: [], result: 'error' },
+  {
+    stage: 'contention lock probe',
+    replies: [...contentionReplies, 'OPEN'],
+    recovery: [],
+    result: 'error'
+  },
+  {
+    stage: 'contention lock age probe',
+    replies: [...contentionReplies, 'OPEN', 'LOCKED'],
+    recovery: [],
+    result: 'error'
+  }
+]
+
+beforeEach(() => {
+  mockExec.mockReset()
+  mockExec.mockResolvedValue('OPEN')
+  vi.spyOn(console, 'warn').mockImplementation(() => {})
+})
+
+afterEach(() => {
+  vi.restoreAllMocks()
+})
+
+describe.each([
+  { platform: 'linux-x64' as const, remoteDir: '/relay/version' },
+  { platform: 'win32-x64' as const, remoteDir: 'C:/relay/version' }
+])('repair lock termination on $platform', ({ platform, remoteDir }) => {
+  const host = getRemoteHostPlatform(platform)
+
+  describe.each([false, true])('with caller aborted = %s', (aborted) => {
+    it.each(failureStages)('stops after unconfirmed $stage', async ({ replies }) => {
+      const controller = new AbortController()
+      const error = Object.assign(new Error('SSH teardown not confirmed'), {
+        sshChannelCloseConfirmed: false
+      })
+      for (const reply of replies) {
+        mockExec.mockResolvedValueOnce(reply)
+      }
+      mockExec.mockImplementationOnce(async () => {
+        if (aborted) {
+          controller.abort(new Error('deploy aborted'))
+        }
+        throw error
+      })
+
+      await expect(
+        tryAcquireRelayRepairLock(conn, remoteDir, host, { signal: controller.signal })
+      ).rejects.toBe(error)
+      expect(mockExec).toHaveBeenCalledTimes(replies.length + 1)
+    })
+  })
+
+  it.each(failureStages)(
+    'keeps recovery after confirmed $stage failure',
+    async ({ replies, recovery, result }) => {
+      for (const reply of replies) {
+        mockExec.mockResolvedValueOnce(reply)
+      }
+      mockExec.mockRejectedValueOnce(
+        Object.assign(new Error('SSH command failed after closing'), {
+          sshChannelCloseConfirmed: true
+        })
+      )
+      for (const reply of recovery) {
+        mockExec.mockResolvedValueOnce(reply)
+      }
+
+      await expect(tryAcquireRelayRepairLock(conn, remoteDir, host)).resolves.toBe(result)
+      expect(mockExec).toHaveBeenCalledTimes(replies.length + recovery.length + 1)
+    }
+  )
+
+  it('stops when a contention probe after a confirmed acquisition failure is unconfirmed', async () => {
+    const error = Object.assign(new Error('SSH teardown not confirmed'), {
+      sshChannelCloseConfirmed: false
+    })
+    mockExec
+      .mockResolvedValueOnce('OPEN')
+      .mockResolvedValueOnce('')
+      .mockRejectedValueOnce(new Error('lock creation failed'))
+      .mockRejectedValueOnce(error)
+
+    await expect(tryAcquireRelayRepairLock(conn, remoteDir, host)).rejects.toBe(error)
+    expect(mockExec).toHaveBeenCalledTimes(4)
+  })
+})
diff --git a/src/main/ssh/ssh-relay-repair-lock.ts b/src/main/ssh/ssh-relay-repair-lock.ts
index 01d58e390e11..1e2b8b7a9d53 100644
--- a/src/main/ssh/ssh-relay-repair-lock.ts
+++ b/src/main/ssh/ssh-relay-repair-lock.ts
@@ -1,5 +1,6 @@
 import type { SshConnection } from './ssh-connection'
 import { execCommand } from './ssh-relay-deploy-helpers'
+import { isUnconfirmedSshCommandTermination } from './ssh-relay-exec-command'
 import {
   acquireInstallLockParentCommand,
   lockAgeSecondsCommand,
@@ -49,7 +50,12 @@ export async function tryAcquireRelayRepairLock(
       remoteRelayDir,
       host,
       options?.signal
-    ).catch(() => undefined)
+    ).catch((error) => {
+      if (isUnconfirmedSshCommandTermination(error)) {
+        throw error
+      }
+      return undefined
+    })
     options?.signal?.throwIfAborted()
     if (gcClaimedBeforeAcquire === true) {
       return 'gc'
@@ -83,7 +89,10 @@ export async function tryAcquireRelayRepairLock(
       return finishRepairLockAcquire(conn, remoteRelayDir, lockDir, host, options?.signal)
     }
     return classifyRepairLockContention(conn, remoteRelayDir, lockDir, host, options?.signal)
-  } catch {
+  } catch (error) {
+    if (isUnconfirmedSshCommandTermination(error)) {
+      throw error
+    }
     options?.signal?.throwIfAborted()
     return classifyRepairLockContention(conn, remoteRelayDir, lockDir, host, options?.signal)
   }
@@ -96,9 +105,12 @@ async function classifyRepairLockContention(
   host: RemoteHostPlatform,
   signal?: AbortSignal
 ): Promise<RelayRepairLockResult> {
-  const gcClaimed = await isRelayGcClaimed(conn, remoteRelayDir, host, signal).catch(
-    () => undefined
-  )
+  const gcClaimed = await isRelayGcClaimed(conn, remoteRelayDir, host, signal).catch((error) => {
+    if (isUnconfirmedSshCommandTermination(error)) {
+      throw error
+    }
+    return undefined
+  })
   signal?.throwIfAborted()
   if (gcClaimed === true) {
     return 'gc'
@@ -112,7 +124,12 @@ async function classifyRepairLockContention(
     host,
     probeInstallLockExistsCommand(host, lockDir),
     signal
-  ).catch(() => '')
+  ).catch((error) => {
+    if (isUnconfirmedSshCommandTermination(error)) {
+      throw error
+    }
+    return ''
+  })
   signal?.throwIfAborted()
   if (lockProbe.trim() !== 'LOCKED') {
     return 'error'
@@ -122,7 +139,12 @@ async function classifyRepairLockContention(
     host,
     lockAgeSecondsCommand(host, lockDir),
     signal
-  ).catch(() => '')
+  ).catch((error) => {
+    if (isUnconfirmedSshCommandTermination(error)) {
+      throw error
+    }
+    return ''
+  })
   signal?.throwIfAborted()
   const ageSeconds = Number.parseInt(ageOutput.trim(), 10)
   // Why: GC may remove stale locks, so only a positively observed fresh lock
@@ -139,15 +161,22 @@ async function finishRepairLockAcquire(
   host: RemoteHostPlatform,
   signal?: AbortSignal
 ): Promise<RelayRepairLockResult> {
-  const gcClaimed = await isRelayGcClaimed(conn, remoteRelayDir, host, signal).catch(
-    () => undefined
-  )
+  const gcClaimed = await isRelayGcClaimed(conn, remoteRelayDir, host, signal).catch((error) => {
+    if (isUnconfirmedSshCommandTermination(error)) {
+      throw error
+    }
+    return undefined
+  })
   if (gcClaimed === false && !signal?.aborted) {
     return 'acquired'
   }
   // Why: GC may win its stable sibling claim while this command creates the
   // in-tree lock. Back out before npm can mutate a directory being renamed.
-  await execHostCommand(conn, host, removeRemoteTreeCommand(host, lockDir)).catch(() => {})
+  await execHostCommand(conn, host, removeRemoteTreeCommand(host, lockDir)).catch((error) => {
+    if (isUnconfirmedSshCommandTermination(error)) {
+      throw error
+    }
+  })
   signal?.throwIfAborted()
   return gcClaimed ? 'gc' : 'error'
 }
diff --git a/src/main/ssh/ssh-relay-ripgrep-cache-gc-commands.ts b/src/main/ssh/ssh-relay-ripgrep-cache-gc-commands.ts
index 509ba9a0ebd9..9e0358fa4ca2 100644
--- a/src/main/ssh/ssh-relay-ripgrep-cache-gc-commands.ts
+++ b/src/main/ssh/ssh-relay-ripgrep-cache-gc-commands.ts
@@ -97,17 +97,3 @@ export function listReferencesCommand(host: RemoteHostPlatform, remoteHome: stri
     `printf '%s\\n' ${REFS_OK}`
   ].join('\n')
 }
-
-// A concurrent installer may already have recreated the original directory.
-export function restoreEntryCommand(
-  host: RemoteHostPlatform,
-  source: string,
-  destination: string
-): string {
-  if (isWindowsRemoteHost(host)) {
-    return powerShellCommand(
-      `if (-not (Test-Path -LiteralPath ${powerShellLiteral(destination)})) { Move-Item -LiteralPath ${powerShellLiteral(source)} -Destination ${powerShellLiteral(destination)} -ErrorAction Stop; 'MOVED' } else { 'BUSY' }`
-    )
-  }
-  return `if [ ! -e ${shellEscape(destination)} ]; then mv ${shellEscape(source)} ${shellEscape(destination)} && echo MOVED; else echo BUSY; fi`
-}
diff --git a/src/main/ssh/ssh-relay-ripgrep-cache-gc-real.test.ts b/src/main/ssh/ssh-relay-ripgrep-cache-gc-real.test.ts
index 8b3e657e523e..f29a9c52638d 100644
--- a/src/main/ssh/ssh-relay-ripgrep-cache-gc-real.test.ts
+++ b/src/main/ssh/ssh-relay-ripgrep-cache-gc-real.test.ts
@@ -5,6 +5,7 @@ import {
   mkdirSync,
   mkdtempSync,
   readdirSync,
+  renameSync,
   rmSync,
   writeFileSync
 } from 'node:fs'
@@ -112,6 +113,75 @@ describe('ripgrep cache shell transactions', () => {
     expect(readdirSync(cache)).toEqual([FIRST])
   })
 
+  it('restores an abandoned tombstone that a relay still references', async () => {
+    await recordRemoteRipgrepReference(conn, host, relay, FIRST)
+    await recordRemoteRipgrepReference(conn, host, relay, SECOND)
+    const tombstone = `.rg-gc-${SECOND}.123.${Date.now() - 60 * 60_000}`
+    renameSync(join(cache, SECOND), join(cache, tombstone))
+
+    await gcRemoteRipgrepCache(conn, host, home)
+
+    expect(readdirSync(cache).sort()).toEqual([FIRST, SECOND])
+    expect(existsSync(join(cache, SECOND, 'rg'))).toBe(true)
+  })
+
+  it('preserves a referenced tombstone when the clock moves backward during the reference scan', async () => {
+    await recordRemoteRipgrepReference(conn, host, relay, FIRST)
+    await recordRemoteRipgrepReference(conn, host, relay, SECOND)
+    const now = Date.now()
+    const tombstone = `.rg-gc-${SECOND}.123.${now - 30 * 60_000 - 1}`
+    renameSync(join(cache, SECOND), join(cache, tombstone))
+    const clock = vi.spyOn(Date, 'now').mockReturnValue(now)
+    let calls = 0
+    execMock.mockImplementation(async (_conn: unknown, command: string) => {
+      if (++calls === 2) {
+        clock.mockReturnValue(now - 60_000)
+      }
+      return runShell(command)
+    })
+    try {
+      await gcRemoteRipgrepCache(conn, host, home)
+      expect(readdirSync(cache).sort()).toEqual([FIRST, SECOND])
+      expect(existsSync(join(cache, SECOND, 'rg'))).toBe(true)
+    } finally {
+      clock.mockRestore()
+    }
+  })
+
+  it('lets exactly one of two passes claim the same abandoned tombstone', async () => {
+    await recordRemoteRipgrepReference(conn, host, relay, FIRST)
+    const tombstone = `.rg-gc-${SECOND}.123.${Date.now() - 60 * 60_000}`
+    renameSync(join(cache, SECOND), join(cache, tombstone))
+    let releaseClaim!: () => void
+    const claimHeld = new Promise<void>((resolve) => {
+      releaseClaim = resolve
+    })
+    let heldPassReachedClaim!: () => void
+    const reachedClaim = new Promise<void>((resolve) => {
+      heldPassReachedClaim = resolve
+    })
+    let held = false
+    execMock.mockImplementation(async (_conn: unknown, command: string) => {
+      const script = process.platform === 'win32' ? decodeRemotePowerShellScript(command) : command
+      if (!held && script.includes(tombstone)) {
+        held = true
+        heldPassReachedClaim()
+        await claimHeld
+      }
+      return runShell(command)
+    })
+
+    // The held pass sees SECOND as unreferenced; the other pins it and restores it.
+    const heldPass = gcRemoteRipgrepCache(conn, host, home)
+    await reachedClaim
+    await gcRemoteRipgrepCache(conn, host, home, { pinnedEntry: SECOND })
+    releaseClaim()
+    await heldPass
+
+    expect(readdirSync(cache).sort()).toEqual([FIRST, SECOND])
+    expect(existsSync(join(cache, SECOND, 'rg'))).toBe(true)
+  })
+
   it('does not nest a tombstone inside a directory recreated by a concurrent installer', async () => {
     await recordRemoteRipgrepReference(conn, host, relay, FIRST)
     let raced = false
diff --git a/src/main/ssh/ssh-relay-ripgrep-cache-gc.ts b/src/main/ssh/ssh-relay-ripgrep-cache-gc.ts
index 18cca2c4f5f8..0f479548499e 100644
--- a/src/main/ssh/ssh-relay-ripgrep-cache-gc.ts
+++ b/src/main/ssh/ssh-relay-ripgrep-cache-gc.ts
@@ -6,15 +6,20 @@ import {
   MAX_LISTING_ENTRIES,
   cacheDir,
   listEntriesCommand,
-  listReferencesCommand,
-  restoreEntryCommand
+  listReferencesCommand
 } from './ssh-relay-ripgrep-cache-gc-commands'
 // Relay installation references protect binaries until version GC removes their owners.
 // Unknown references block deletion; tombstones are rechecked before removal.
+import { randomInt } from 'node:crypto'
 import type { SshConnection } from './ssh-connection'
 import { execCommand } from './ssh-relay-deploy-helpers'
+import { isUnconfirmedSshCommandTermination } from './ssh-relay-exec-command'
 import { BUNDLED_RIPGREP_PLATFORMS } from '../../shared/bundled-ripgrep'
-import { moveRemoteTreeCommand, removeRemoteTreeCommand } from './ssh-remote-commands'
+import {
+  moveRemoteTreeCommand,
+  removeRemoteTreeCommand,
+  restoreRemoteTreeCommand
+} from './ssh-remote-commands'
 import { isWindowsRemoteHost, joinRemotePath, type RemoteHostPlatform } from './ssh-remote-platform'
 
 function entryNamePattern(): RegExp {
@@ -32,24 +37,33 @@ function staleTombstoneEntry(name: string): string | null {
     return null
   }
   const match = /^(.*)\.(\d+)\.(\d+)$/.exec(name.slice(TOMBSTONE_PREFIX.length))
-  if (!match || !ENTRY_NAME.test(match[1]) || Date.now() - Number(match[3]) < 30 * 60_000) {
+  if (
+    !match ||
+    !ENTRY_NAME.test(match[1]) ||
+    !Number.isSafeInteger(Number(match[3])) ||
+    Date.now() - Number(match[3]) < 30 * 60_000
+  ) {
     return null
   }
   return match[1]
 }
 
 function exec(conn: SshConnection, host: RemoteHostPlatform, command: string): Promise<string> {
-  return execCommand(conn, command, { wrapCommand: !isWindowsRemoteHost(host) })
+  return execCommand(conn, command, {
+    wrapCommand: !isWindowsRemoteHost(host)
+  })
 }
 
 type ReferenceScan = { readable: true; referenced: Set<string> } | { readable: false }
 
-function parseEntries(output: string): string[] {
+type CacheEntry = { name: string; entry: string }
+
+function parseEntries(output: string): CacheEntry[] {
   const lines = output.split(/\r?\n/).map((line) => line.trim())
   if (!lines.includes(LIST_OK)) {
     return []
   }
-  const entries: string[] = []
+  const entries: CacheEntry[] = []
   for (const line of lines) {
     if (!line.startsWith('ENTRY ')) {
       continue
@@ -57,11 +71,9 @@ function parseEntries(output: string): string[] {
     const name = line.slice('ENTRY '.length)
     // Why re-validate a name the host produced: it is about to be interpolated into `mv` and
     // `rm -rf`. Only names this client could itself have minted are eligible.
-    if (
-      (ENTRY_NAME.test(name) || staleTombstoneEntry(name)) &&
-      entries.length < MAX_LISTING_ENTRIES
-    ) {
-      entries.push(name)
+    const entry = ENTRY_NAME.test(name) ? name : staleTombstoneEntry(name)
+    if (entry && entries.length < MAX_LISTING_ENTRIES) {
+      entries.push({ name, entry })
     }
   }
   return entries
@@ -75,7 +87,10 @@ async function scanReferences(
   let output: string
   try {
     output = await exec(conn, host, listReferencesCommand(host, remoteHome))
-  } catch {
+  } catch (err) {
+    if (isUnconfirmedSshCommandTermination(err)) {
+      throw err
+    }
     return { readable: false }
   }
   const lines = output.split(/\r?\n/).map((line) => line.trim())
@@ -99,7 +114,7 @@ async function scanReferences(
   return { readable: true, referenced }
 }
 
-/** Collect ripgrep builds that no relay installation references. Never throws. */
+/** Collect unreferenced ripgrep builds; unconfirmed termination stops the caller's cleanup. */
 export async function gcRemoteRipgrepCache(
   conn: SshConnection,
   host: RemoteHostPlatform,
@@ -116,28 +131,51 @@ export async function gcRemoteRipgrepCache(
       return
     }
     const removed: string[] = []
-    for (const name of entries) {
-      const entry = staleTombstoneEntry(name) ?? name
-      if (scan.referenced.has(entry) || entry === options.pinnedEntry) {
-        continue
-      }
-      if (
-        await removeUnreferencedEntry(
-          conn,
-          host,
-          remoteHome,
-          entry,
-          name === entry ? undefined : name
-        )
-      ) {
+    for (const { name, entry } of entries) {
+      const keep = scan.referenced.has(entry) || entry === options.pinnedEntry
+      const collected =
+        name === entry
+          ? !keep && (await removeUnreferencedEntry(conn, host, remoteHome, entry))
+          : await recoverAbandonedTombstone(conn, host, remoteHome, name, entry, keep)
+      if (collected) {
         removed.push(entry)
       }
     }
     if (removed.length > 0) {
       console.log(`[ssh-relay] ripgrep cache GC: removed ${removed.length}: ${removed.join(', ')}`)
     }
-  } catch {
-    /* Never fails a deploy; the next connect tries again. */
+  } catch (err) {
+    if (isUnconfirmedSshCommandTermination(err)) {
+      throw err
+    }
+    // Confirmed cleanup failures are optional; the next connect tries again.
+  }
+}
+
+// Why random rather than pid + clock: passes on different clients must never rename into one path.
+function ownedTombstonePath(host: RemoteHostPlatform, base: string, entry: string): string {
+  return joinRemotePath(
+    host,
+    base,
+    `${TOMBSTONE_PREFIX}${entry}.${randomInt(1, 2 ** 47)}.${Date.now()}`
+  )
+}
+
+async function moveTree(
+  conn: SshConnection,
+  host: RemoteHostPlatform,
+  source: string,
+  destination: string
+): Promise<boolean> {
+  try {
+    return (
+      (await exec(conn, host, moveRemoteTreeCommand(host, source, destination))).trim() === 'MOVED'
+    )
+  } catch (err) {
+    if (isUnconfirmedSshCommandTermination(err)) {
+      throw err
+    }
+    return false
   }
 }
 
@@ -145,39 +183,80 @@ async function removeUnreferencedEntry(
   conn: SshConnection,
   host: RemoteHostPlatform,
   remoteHome: string,
+  entry: string
+): Promise<boolean> {
+  const base = cacheDir(host, remoteHome)
+  const entryDir = joinRemotePath(host, base, entry)
+  const tombstone = ownedTombstonePath(host, base, entry)
+  if (!(await moveTree(conn, host, entryDir, tombstone))) {
+    return false
+  }
+  return collectOwnedTombstone(conn, host, remoteHome, entry, tombstone, entryDir)
+}
+
+// Only the pass whose rename wins may restore or delete a tombstone other passes can also list.
+async function recoverAbandonedTombstone(
+  conn: SshConnection,
+  host: RemoteHostPlatform,
+  remoteHome: string,
+  name: string,
   entry: string,
-  abandonedTombstone?: string
+  keep: boolean
 ): Promise<boolean> {
   const base = cacheDir(host, remoteHome)
+  const tombstone = ownedTombstonePath(host, base, entry)
+  if (!(await moveTree(conn, host, joinRemotePath(host, base, name), tombstone))) {
+    return false
+  }
   const entryDir = joinRemotePath(host, base, entry)
-  const tombstone = joinRemotePath(
-    host,
-    base,
-    abandonedTombstone ?? `${TOMBSTONE_PREFIX}${entry}.${process.pid}.${Date.now()}`
-  )
-  try {
-    if (
-      !abandonedTombstone &&
-      (await exec(conn, host, moveRemoteTreeCommand(host, entryDir, tombstone))).trim() !== 'MOVED'
-    ) {
-      return false
-    }
-  } catch {
+  if (keep) {
+    await restoreCacheEntry(conn, host, tombstone, entryDir)
     return false
   }
+  return collectOwnedTombstone(conn, host, remoteHome, entry, tombstone, entryDir)
+}
+
+async function collectOwnedTombstone(
+  conn: SshConnection,
+  host: RemoteHostPlatform,
+  remoteHome: string,
+  entry: string,
+  tombstone: string,
+  entryDir: string
+): Promise<boolean> {
   // Why recheck under the rename: a deploy that read this entry as present can still be writing
   // its marker. Its reference now names a path that no longer exists, so restoring the tree is
   // the only outcome that leaves that relay with a working ripgrep.
-  const recheck = await scanReferences(conn, host, remoteHome)
+  const recheck = await scanReferences(conn, host, remoteHome).catch(async (err: unknown) => {
+    // A read-only scan cannot conflict with restoring this pass's renamed tree.
+    await restoreCacheEntry(conn, host, tombstone, entryDir).catch(() => {})
+    throw err
+  })
   if (!recheck.readable || recheck.referenced.has(entry)) {
-    await exec(conn, host, restoreEntryCommand(host, tombstone, entryDir)).catch(() => {})
+    await restoreCacheEntry(conn, host, tombstone, entryDir)
     return false
   }
   try {
     await exec(conn, host, removeRemoteTreeCommand(host, tombstone))
     return true
-  } catch {
+  } catch (err) {
+    if (isUnconfirmedSshCommandTermination(err)) {
+      throw err
+    }
     // A later pass retries after verifying references again.
     return false
   }
 }
+
+async function restoreCacheEntry(
+  conn: SshConnection,
+  host: RemoteHostPlatform,
+  tombstone: string,
+  entryDir: string
+): Promise<void> {
+  await exec(conn, host, restoreRemoteTreeCommand(host, tombstone, entryDir)).catch((err) => {
+    if (isUnconfirmedSshCommandTermination(err)) {
+      throw err
+    }
+  })
+}
diff --git a/src/main/ssh/ssh-relay-ripgrep-install.test.ts b/src/main/ssh/ssh-relay-ripgrep-install.test.ts
index dc41c281db2c..990e0ec0d54e 100644
--- a/src/main/ssh/ssh-relay-ripgrep-install.test.ts
+++ b/src/main/ssh/ssh-relay-ripgrep-install.test.ts
@@ -30,7 +30,7 @@ vi.mock('../ripgrep/bundled-ripgrep-path', () => ({
 }))
 
 import type { SshConnection } from './ssh-connection'
-import { getRemoteHostPlatform } from './ssh-remote-platform'
+import { getRemoteHostPlatform, joinRemotePath } from './ssh-remote-platform'
 import { decodeRemotePowerShellScript } from './ssh-remote-powershell'
 import { ensureRemoteBundledRipgrep, remoteRipgrepLayout } from './ssh-relay-ripgrep-install'
 
@@ -176,6 +176,85 @@ describe('ensureRemoteBundledRipgrep', () => {
     expect(execScripts()[1]).toMatch(/^rm -rf '\/home\/me\/\.orca-remote\/ripgrep\/\.upload-/)
   })
 
+  describe.each([
+    { platform: 'Linux', host: LINUX, home: '/home/me' },
+    { platform: 'Windows', host: WINDOWS, home: 'C:/Users/me user' }
+  ])('interrupted install on $platform', ({ host, home }) => {
+    it.each([
+      ['reference', 1, 0],
+      ['probe', 1, 0],
+      ['upload', 1, 1],
+      ['promotion', 2, 1],
+      ['cleanup', 2, 1]
+    ] as const)(
+      'preserves unconfirmed %s termination and starts no further operation',
+      async (phase, commands, uploads) => {
+        const error = Object.assign(new Error('Remote termination is unconfirmed'), {
+          sshChannelCloseConfirmed: false
+        })
+        if (phase === 'reference' || phase === 'probe') {
+          execCommandMock.mockRejectedValueOnce(error)
+        } else {
+          execCommandMock.mockResolvedValueOnce('ORCA-RG-STAGED\n')
+          if (phase === 'upload') {
+            uploadRelayDirectoryMock.mockRejectedValueOnce(error)
+          } else {
+            execCommandMock.mockRejectedValueOnce(error)
+            if (phase === 'cleanup') {
+              uploadRelayDirectoryMock.mockRejectedValueOnce(new Error('Upload failed'))
+            }
+          }
+        }
+
+        await expect(
+          ensureRemoteBundledRipgrep(connection(), host, home, {
+            relayDir:
+              phase === 'reference'
+                ? joinRemotePath(host, home, '.orca-remote', 'relay-1.2.3')
+                : undefined
+          })
+        ).rejects.toBe(error)
+
+        expect(execCommandMock).toHaveBeenCalledTimes(commands)
+        expect(uploadRelayDirectoryMock).toHaveBeenCalledTimes(uploads)
+      }
+    )
+
+    it.each(['upload', 'promotion'] as const)(
+      'removes the stage after confirmed %s termination and remains nonfatal',
+      async (phase) => {
+        const error = Object.assign(new Error('Remote operation stopped'), {
+          sshChannelCloseConfirmed: true
+        })
+        execCommandMock.mockResolvedValueOnce('ORCA-RG-STAGED\n')
+        if (phase === 'upload') {
+          uploadRelayDirectoryMock.mockRejectedValueOnce(error)
+        } else {
+          execCommandMock.mockRejectedValueOnce(error)
+        }
+        execCommandMock.mockResolvedValueOnce('')
+
+        await expect(ensureRemoteBundledRipgrep(connection(), host, home)).resolves.toBe('failed')
+
+        expect(execCommandMock).toHaveBeenCalledTimes(phase === 'upload' ? 2 : 3)
+        expect(execScripts().at(-1)).toContain(
+          host === WINDOWS ? 'Remove-Item -LiteralPath' : 'rm -rf'
+        )
+      }
+    )
+
+    it('keeps an ordinary stage cleanup failure nonfatal', async () => {
+      execCommandMock
+        .mockResolvedValueOnce('ORCA-RG-STAGED\n')
+        .mockRejectedValueOnce(new Error('Cleanup failed'))
+      uploadRelayDirectoryMock.mockRejectedValueOnce(new Error('Upload failed'))
+
+      await expect(ensureRemoteBundledRipgrep(connection(), host, home)).resolves.toBe('failed')
+
+      expect(execCommandMock).toHaveBeenCalledTimes(2)
+    })
+  })
+
   it('reports a failed size verification', async () => {
     execCommandMock
       .mockResolvedValueOnce('ORCA-RG-STAGED\n')
diff --git a/src/main/ssh/ssh-relay-ripgrep-install.ts b/src/main/ssh/ssh-relay-ripgrep-install.ts
index 02992ac811b1..333a21801bba 100644
--- a/src/main/ssh/ssh-relay-ripgrep-install.ts
+++ b/src/main/ssh/ssh-relay-ripgrep-install.ts
@@ -6,8 +6,8 @@
  *
  * Uploads land in a private `.upload-<token>` stage and are renamed into place only after a size
  * check, so an interrupted or concurrent deploy never leaves a truncated binary at the final path.
- * Every failure is reported, never thrown: the relay falls back to PATH `rg` and its git/readdir
- * chain, which is exactly what it did before this binary existed.
+ * Ordinary failures use the relay's PATH `rg` and git/readdir fallback; unconfirmed remote stops
+ * propagate so deployment cannot start more work while the previous operation may still run.
  */
 import { randomBytes } from 'node:crypto'
 import { statSync } from 'node:fs'
@@ -15,6 +15,7 @@ import { dirname } from 'node:path'
 import type { SshConnection } from './ssh-connection'
 import { RELAY_REMOTE_DIR } from './relay-protocol'
 import { execCommand } from './ssh-relay-deploy-helpers'
+import { isUnconfirmedSshCommandTermination } from './ssh-relay-exec-command'
 import { uploadRelayDirectory } from './ssh-relay-install-transfers'
 import {
   createRelayUploadStageNamespace,
@@ -52,7 +53,7 @@ export function remoteRipgrepRefFileName(entryName: string): string {
   return `${REMOTE_RIPGREP_REF_PREFIX}${entryName}`
 }
 
-/** Record which ripgrep build a relay directory runs against. Best-effort: never fails a deploy. */
+/** Record the relay's ripgrep build; only an unconfirmed remote stop rejects. */
 export async function recordRemoteRipgrepReference(
   conn: SshConnection,
   host: RemoteHostPlatform,
@@ -73,6 +74,9 @@ export async function recordRemoteRipgrepReference(
     )
     return true
   } catch (error) {
+    if (isUnconfirmedSshCommandTermination(error)) {
+      throw error
+    }
     console.warn(
       '[ssh-relay] Could not record the ripgrep reference; skipping the bundled binary:',
       error instanceof Error ? error.message : String(error)
@@ -117,7 +121,7 @@ export function remoteRipgrepLayout(
   }
 }
 
-/** Make sure the host has Orca's ripgrep at `remoteRipgrepLayout().binaryPath`; never throws. */
+/** Ensure the host has Orca's ripgrep; only an unconfirmed remote stop rejects. */
 export async function ensureRemoteBundledRipgrep(
   conn: SshConnection,
   host: RemoteHostPlatform,
@@ -150,6 +154,9 @@ async function installOrReport(
     }
     return await installRemoteRipgrep(conn, host, layout, localBinary, options.signal)
   } catch (error) {
+    if (isUnconfirmedSshCommandTermination(error)) {
+      throw error
+    }
     console.warn(
       '[ssh-relay] Bundled ripgrep install failed; the relay will use rg from PATH:',
       error instanceof Error ? error.message : String(error)
@@ -184,6 +191,7 @@ async function installRemoteRipgrep(
   }
 
   let promoted = false
+  let cleanupAllowed = true
   try {
     await uploadRelayDirectory(
       conn,
@@ -204,12 +212,19 @@ async function installRemoteRipgrep(
     }
     console.log(`[ssh-relay] Installed bundled ripgrep at ${layout.binaryPath} (${size} bytes)`)
     return 'installed'
+  } catch (error) {
+    cleanupAllowed = !isUnconfirmedSshCommandTermination(error)
+    throw error
   } finally {
-    if (!promoted) {
+    if (!promoted && cleanupAllowed) {
       // Why best-effort: the next deploy's probe also sweeps stale stages.
       await execCommand(conn, removeRemoteTreeCommand(host, stageDir), {
         wrapCommand: !isWindowsRemoteHost(host)
-      }).catch(() => {})
+      }).catch((error) => {
+        if (isUnconfirmedSshCommandTermination(error)) {
+          throw error
+        }
+      })
     }
   }
 }
diff --git a/src/main/ssh/ssh-relay-session-data-delivery.test.ts b/src/main/ssh/ssh-relay-session-data-delivery.test.ts
index e5683c0949ab..da528f7f95fb 100644
--- a/src/main/ssh/ssh-relay-session-data-delivery.test.ts
+++ b/src/main/ssh/ssh-relay-session-data-delivery.test.ts
@@ -344,7 +344,8 @@ describe('SshRelaySession data delivery', () => {
       })
     )
     session.dispose()
-    expect(mockStore.removeSshPtyConsumerRecovery).toHaveBeenCalledWith(targetId)
+    const removeRecovery = mockStore.removeSshPtyConsumerRecovery
+    expect(removeRecovery).toHaveBeenCalledWith(targetId, 'persisted-client')
   })
 
   it('voids checkpoints for a fresh claim without a second owner request', async () => {
diff --git a/src/main/ssh/ssh-relay-session-managed-hooks.test.ts b/src/main/ssh/ssh-relay-session-managed-hooks.test.ts
index 67351e081023..da10d8841a18 100644
--- a/src/main/ssh/ssh-relay-session-managed-hooks.test.ts
+++ b/src/main/ssh/ssh-relay-session-managed-hooks.test.ts
@@ -3,6 +3,8 @@ import {
   AGENT_HOOK_INSTALL_MANAGED_HOOKS_METHOD,
   AGENT_HOOK_INSTALL_PLUGINS_METHOD
 } from '../../shared/agent-hook-relay'
+import { getDefaultSettings } from '../../shared/constants'
+import type { Store } from '../persistence'
 import { SshRelaySession } from './ssh-relay-session'
 import type { SshConnection } from './ssh-connection'
 import { createMockDeps, mockDeploySuccess } from './ssh-relay-session-test-fixtures'
@@ -159,4 +161,45 @@ describe('SshRelaySession managed hooks', () => {
       })
     )
   })
+  it('refreshes OpenCode sources on settings changes and releases its subscription', async () => {
+    muxRequestMock.mockResolvedValue({ agents: [] })
+    const { mockStore, mockConn, mockPortForward, getMainWindow } = createMockDeps()
+    const settings = getDefaultSettings('/synthetic-home')
+    settings.disabledTuiAgents = ['opencode']
+    mockStore.getSettings = () => settings
+    let listener: Parameters<Store['onSettingsChanged']>[0] | undefined
+    const cleanup = vi.fn(() => {
+      listener = undefined
+    })
+    mockStore.onSettingsChanged = (callback) => {
+      listener = callback
+      return cleanup
+    }
+    const session = new SshRelaySession(
+      'target-settings',
+      getMainWindow,
+      mockStore,
+      mockPortForward
+    )
+    await session.establish(mockConn)
+    const lastSources = () =>
+      muxRequestMock.mock.calls.findLast(
+        ([method]) => method === AGENT_HOOK_INSTALL_PLUGINS_METHOD
+      )?.[1]
+    expect(lastSources()).toMatchObject({
+      opencodePluginSource: '',
+      opencode2PluginSource: expect.stringContaining('/hook/opencode2')
+    })
+    settings.disabledTuiAgents = ['opencode2']
+    listener?.({ disabledTuiAgents: settings.disabledTuiAgents }, settings)
+    expect(lastSources()).toMatchObject({
+      opencodePluginSource: expect.stringContaining('/hook/opencode'),
+      opencode2PluginSource: ''
+    })
+    settings.agentStatusHooksEnabled = false
+    listener?.({ agentStatusHooksEnabled: false }, settings)
+    expect(lastSources()).toMatchObject({ opencodePluginSource: '', opencode2PluginSource: '' })
+    session.dispose()
+    expect(cleanup).toHaveBeenCalledOnce()
+  })
 })
diff --git a/src/main/ssh/ssh-relay-session-reconnect-incarnation.test.ts b/src/main/ssh/ssh-relay-session-reconnect-incarnation.test.ts
index 6760a27821c7..3c405cd5dff9 100644
--- a/src/main/ssh/ssh-relay-session-reconnect-incarnation.test.ts
+++ b/src/main/ssh/ssh-relay-session-reconnect-incarnation.test.ts
@@ -3,7 +3,11 @@ import { randomUUID } from 'node:crypto'
 import type * as NodeCrypto from 'node:crypto'
 import { SshRelaySession } from './ssh-relay-session'
 import { runRemoteOrcaCli } from './ssh-remote-orca-cli'
-import { createMockDeps, mockDeploySuccess } from './ssh-relay-session-test-fixtures'
+import {
+  createMockDeps,
+  mockDeploySuccess,
+  recordedPtyBindings
+} from './ssh-relay-session-test-fixtures'
 import { getDefaultWorkspaceSession } from '../../shared/constants'
 import type { SshRemotePtyLease } from '../../shared/ssh-types'
 
@@ -439,7 +443,7 @@ describe('SshRelaySession reconnect incarnation ordering', () => {
       incarnationId
     })
     expect(runtime.onPtySpawned).not.toHaveBeenCalled()
-    expect(mockStore.persistPtyBinding).toHaveBeenCalledWith({
+    expect(recordedPtyBindings(mockStore)).toContainEqual({
       worktreeId: 'worktree-1',
       tabId: 'tab-1',
       leafId: INCARNATION_LEAF_ID,
@@ -643,7 +647,7 @@ describe('SshRelaySession reconnect incarnation ordering', () => {
       leafId: INCARNATION_LEAF_ID,
       incarnationId
     })
-    expect(mockStore.persistPtyBinding).toHaveBeenCalledWith(
+    expect(recordedPtyBindings(mockStore)).toContainEqual(
       expect.objectContaining({ tabId: movedTabId, ptyId: APP_PTY_ID, incarnationId })
     )
     expect(mockStore.markSshRemotePtyLease).not.toHaveBeenCalledWith(
@@ -763,7 +767,7 @@ describe('SshRelaySession reconnect incarnation ordering', () => {
       incarnationId: currentIncarnationId
     })
     expect(setPtyOwnership).toHaveBeenCalledWith(APP_PTY_ID, 'target-1')
-    expect(mockStore.persistPtyBinding).toHaveBeenCalledWith(
+    expect(recordedPtyBindings(mockStore)).toContainEqual(
       expect.objectContaining({ ptyId: APP_PTY_ID, incarnationId: currentIncarnationId })
     )
     expect(mockWindow.webContents.send).toHaveBeenCalledWith('pty:replay', {
diff --git a/src/main/ssh/ssh-relay-session-recovery-races.test.ts b/src/main/ssh/ssh-relay-session-recovery-races.test.ts
index 26dd798ac5ad..f4600bb23e6c 100644
--- a/src/main/ssh/ssh-relay-session-recovery-races.test.ts
+++ b/src/main/ssh/ssh-relay-session-recovery-races.test.ts
@@ -140,17 +140,21 @@ describe('SshRelaySession recovery race fencing', () => {
     mockDeploySuccess()
   })
 
-  function emitSourceFrame(args: {
-    targetId: string
-    token: string
-    clientGeneration: number
-    ownerGeneration: number
-    sourceStartSu: number
-    sourceEndSu: number
-  }): void {
-    ptyDataHandlerRef.current?.({
+  function emitSourceFrame(
+    args: {
+      targetId: string
+      token: string
+      clientGeneration: number
+      ownerGeneration: number
+      sourceStartSu: number
+      sourceEndSu: number
+      data?: string
+    },
+    sink = ptyDataHandlerRef.current
+  ): void {
+    sink?.({
       id: `ssh:${args.targetId}@@pty-1`,
-      data: 'late',
+      data: args.data ?? 'late',
       providerGeneration: 23,
       ptyIncarnation: 'incarnation-1',
       sequenceChars: args.sourceEndSu - args.sourceStartSu,
@@ -227,6 +231,66 @@ describe('SshRelaySession recovery race fencing', () => {
     return { session, deps }
   }
 
+  it('keeps source output contiguous while the recovered pane binding waits for disk', async () => {
+    const targetId = 'recovery-binding-disk-wait'
+    const { session, deps } = await prepareRecovery(targetId)
+    const binding = Promise.withResolvers<boolean>()
+    vi.mocked(deps.mockStore.getSshRemotePtyLeases).mockReturnValue([
+      {
+        targetId,
+        ptyId: 'pty-1',
+        worktreeId: 'worktree-1',
+        tabId: 'tab-1',
+        leafId: 'leaf-1',
+        state: 'detached',
+        createdAt: 1,
+        updatedAt: 1
+      }
+    ])
+    vi.mocked(deps.mockStore.persistPtyBinding).mockReturnValue(binding.promise)
+    const emit = (sourceStartSu: number, sink = ptyDataHandlerRef.current): void =>
+      emitSourceFrame(
+        {
+          targetId,
+          token: 'new-token',
+          clientGeneration: 2,
+          ownerGeneration: 2,
+          sourceStartSu,
+          sourceEndSu: sourceStartSu + 4
+        },
+        sink
+      )
+    let recoverySink: typeof ptyDataHandlerRef.current
+    const recoveryActivationLease = { commit: vi.fn(), retire: vi.fn() }
+    attachForReconnectMock.mockResolvedValue({
+      incarnationId: 'incarnation-1',
+      sourceRecovery: pendingRecovery(8),
+      sourceActivationLease: {
+        commit: vi.fn(),
+        rollback: vi.fn(async () => true),
+        transferToRecovery: (sink: (payload: unknown) => void) => {
+          recoverySink = sink
+          emit(4, sink)
+          completeRecovery({ id: 'pty-1', ...pendingRecovery(8) })
+          return recoveryActivationLease
+        }
+      }
+    })
+
+    const reconnect = session.reconnect(deps.mockConn)
+    await vi.waitFor(() => expect(deps.mockStore.persistPtyBinding).toHaveBeenCalledOnce())
+    emit(8, recoverySink)
+    expect(recoveryActivationLease.commit).not.toHaveBeenCalled()
+    binding.resolve(true)
+    await reconnect
+    emit(12)
+
+    expect(
+      acceptOutputDataMock.mock.calls.map(([payload]) => payload.source.sourceStartSu)
+    ).toEqual([4, 8, 12])
+    expect(recoveryActivationLease.commit).toHaveBeenCalledOnce()
+  })
+
   it('publishes held recovery data before an exact exit without waiting for completion', async () => {
     const targetId = 'exit-with-complete-private-body'
     const { session, deps } = await prepareRecovery(targetId)
@@ -235,22 +299,18 @@ describe('SshRelaySession recovery race fencing', () => {
       commit: vi.fn(),
       rollback: vi.fn(async () => true),
       transferToRecovery: vi.fn((sink: (payload: unknown) => void) => {
-        sink({
-          id: `ssh:${targetId}@@pty-1`,
-          data: 'held',
-          providerGeneration: 23,
-          ptyIncarnation: 'incarnation-1',
-          sequenceChars: 4,
-          source: {
-            relayPtyId: 'pty-1',
-            spanId: 'new-token:4:8',
+        emitSourceFrame(
+          {
+            targetId,
+            token: 'new-token',
             clientGeneration: 2,
             ownerGeneration: 2,
-            deliveryToken: 'new-token',
             sourceStartSu: 4,
-            sourceEndSu: 8
-          }
-        })
+            sourceEndSu: 8,
+            data: 'held'
+          },
+          sink
+        )
         return recoveryActivationLease
       })
     }
@@ -301,22 +361,18 @@ describe('SshRelaySession recovery race fencing', () => {
       commit: vi.fn(),
       rollback: vi.fn(async () => true),
       transferToRecovery: vi.fn((sink: (payload: unknown) => void) => {
-        sink({
-          id: `ssh:${targetId}@@pty-1`,
-          data: 'partial',
-          providerGeneration: 23,
-          ptyIncarnation: 'incarnation-1',
-          sequenceChars: 2,
-          source: {
-            relayPtyId: 'pty-1',
-            spanId: 'new-token:4:6',
+        emitSourceFrame(
+          {
+            targetId,
+            token: 'new-token',
             clientGeneration: 2,
             ownerGeneration: 2,
-            deliveryToken: 'new-token',
             sourceStartSu: 4,
-            sourceEndSu: 6
-          }
-        })
+            sourceEndSu: 6,
+            data: 'partial'
+          },
+          sink
+        )
         return recoveryActivationLease
       })
     }
@@ -501,38 +557,23 @@ describe('SshRelaySession recovery race fencing', () => {
       commit: vi.fn(),
       rollback: vi.fn(),
       transferToRecovery: vi.fn((sink: (payload: unknown) => void) => {
-        sink({
-          id: `ssh:${targetId}@@pty-1`,
-          data: 'x'.repeat(2 * 1024 * 1024 + 1),
-          providerGeneration: 23,
-          ptyIncarnation: 'incarnation-1',
-          sequenceChars: 4,
-          source: {
-            relayPtyId: 'pty-1',
-            spanId: 'new-token:4:8',
-            clientGeneration: 2,
-            ownerGeneration: 2,
-            deliveryToken: 'new-token',
-            sourceStartSu: 4,
-            sourceEndSu: 8
-          }
-        })
-        sink({
-          id: `ssh:${targetId}@@pty-1`,
-          data: 'later',
-          providerGeneration: 23,
-          ptyIncarnation: 'incarnation-1',
-          sequenceChars: 4,
-          source: {
-            relayPtyId: 'pty-1',
-            spanId: 'new-token:8:12',
-            clientGeneration: 2,
-            ownerGeneration: 2,
-            deliveryToken: 'new-token',
-            sourceStartSu: 8,
-            sourceEndSu: 12
-          }
-        })
+        for (const [data, sourceStartSu] of [
+          ['x'.repeat(2 * 1024 * 1024 + 1), 4],
+          ['later', 8]
+        ] as const) {
+          emitSourceFrame(
+            {
+              targetId,
+              token: 'new-token',
+              clientGeneration: 2,
+              ownerGeneration: 2,
+              sourceStartSu,
+              sourceEndSu: sourceStartSu + 4,
+              data
+            },
+            sink
+          )
+        }
         return recoveryActivationLease
       })
     }
diff --git a/src/main/ssh/ssh-relay-session-test-fixtures.ts b/src/main/ssh/ssh-relay-session-test-fixtures.ts
index ba0782b3a204..c186e922e931 100644
--- a/src/main/ssh/ssh-relay-session-test-fixtures.ts
+++ b/src/main/ssh/ssh-relay-session-test-fixtures.ts
@@ -1,6 +1,7 @@
 import { vi, type Mock } from 'vitest'
 import type { BrowserWindow } from 'electron'
 import type { SshConnection } from './ssh-connection'
+import type { PersistPtyBindingArgs } from '../persistence/loading-store/pty-binding-persistence'
 import type { Store } from '../persistence'
 import type { SshPortForwardManager } from './ssh-port-forward'
 import { deployAndLaunchRelay } from './ssh-relay-deploy'
@@ -13,8 +14,16 @@ type SshRelaySessionTestDeps = {
   mockWindow: BrowserWindow
 }
 
+const persistedBindings = new WeakMap<Store, PersistPtyBindingArgs[]>()
+
+export function recordedPtyBindings(store: Store): readonly PersistPtyBindingArgs[] {
+  return persistedBindings.get(store) ?? []
+}
+
 export function createMockDeps(): SshRelaySessionTestDeps {
+  const bindings: PersistPtyBindingArgs[] = []
   const mockConn = {} as SshConnection
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The relay fixture implements the Store methods exercised by session establishment and teardown.
   const mockStore = {
     getRepos: vi.fn().mockReturnValue([]),
     getSshPtyConsumerRecovery: vi.fn().mockReturnValue(null),
@@ -33,8 +42,16 @@ export function createMockDeps(): SshRelaySessionTestDeps {
     recordSshRemotePtyKillIntent: vi.fn(),
     clearSshRemotePtyKillIntent: vi.fn(),
     noteSshRemotePtyKillReplayAttempt: vi.fn(),
-    persistPtyBinding: vi.fn()
+    persistPtyBinding: vi.fn(async (input: Parameters<Store['persistPtyBinding']>[0]) => {
+      const binding = typeof input === 'function' ? input() : input
+      if (!binding) {
+        return false
+      }
+      bindings.push(binding)
+      return true
+    })
   } as unknown as Store
+  persistedBindings.set(mockStore, bindings)
   const mockPortForward = {
     removeAllForwards: vi.fn()
   } as unknown as SshPortForwardManager
diff --git a/src/main/ssh/ssh-relay-session.test.ts b/src/main/ssh/ssh-relay-session.test.ts
index dc9ff181b2fe..5b48337f0ab0 100644
--- a/src/main/ssh/ssh-relay-session.test.ts
+++ b/src/main/ssh/ssh-relay-session.test.ts
@@ -206,6 +206,27 @@ describe('SshRelaySession', () => {
     expect(registerSshGitProvider).toHaveBeenCalledWith('target-1', expect.anything())
   })
 
+  it('rechecks OpenCode preparation from scans and aborts it when the relay session disconnects', async () => {
+    const { mockConn, mockStore, mockPortForward, getMainWindow } = createMockDeps()
+    const prepareOpenCodeRuntime = vi.fn().mockResolvedValue(undefined)
+    vi.mocked(deployAndLaunchRelay).mockResolvedValueOnce({
+      transport: { write: vi.fn(), onData: vi.fn(), onClose: vi.fn() },
+      platform: 'linux-x64',
+      prepareOpenCodeRuntime
+    })
+    const session = new SshRelaySession('target-1', getMainWindow, mockStore, mockPortForward)
+    await session.establish(mockConn)
+    await session.requestAiVaultSessionList({})
+    await session.requestSessionSearch('sessionSearch.search', {})
+    expect(prepareOpenCodeRuntime).toHaveBeenCalledTimes(2)
+    const signal = prepareOpenCodeRuntime.mock.calls[0][0]
+    expect(signal.aborted).toBe(false)
+    await session.dispose()
+    expect(signal.aborted).toBe(true)
+    await expect(session.requestAiVaultSessionList({})).rejects.toThrow('not ready')
+    expect(prepareOpenCodeRuntime).toHaveBeenCalledTimes(2)
+  })
+
   it('continues provider registration when the relay managed-hook request fails', async () => {
     process.env.ORCA_FEATURE_REMOTE_AGENT_HOOKS = '1'
     muxRequestMock.mockImplementation(async (method: string) => {
diff --git a/src/main/ssh/ssh-relay-session.ts b/src/main/ssh/ssh-relay-session.ts
index 19e102b08ede..76b7bfb238c6 100644
--- a/src/main/ssh/ssh-relay-session.ts
+++ b/src/main/ssh/ssh-relay-session.ts
@@ -4,6 +4,7 @@
 import { randomUUID } from 'node:crypto'
 import type { BrowserWindow } from 'electron'
 import { deployAndLaunchRelay } from './ssh-relay-deploy'
+import type { RemoteOpenCodeRuntimePreparation } from './ssh-relay-opencode-runtime-retry'
 import { execCommand } from './ssh-relay-deploy-helpers'
 import { writeStringsViaSftp } from './sftp-upload'
 import { isRelayVersionMismatchError } from './ssh-relay-version-mismatch-error'
@@ -22,6 +23,7 @@ import { toAppSshPtyId, toRelaySshPtyId } from '../providers/ssh-pty-id'
 import { SshFilesystemProvider } from '../providers/ssh-filesystem-provider'
 import { isMethodNotFoundError } from './ssh-filesystem-stream-reader'
 import { SshGitProvider } from '../providers/ssh-git-provider'
+import { selectOpenCodePluginSources } from '../agent-hooks/opencode-plugin-settings'
 import { agentHookServer } from '../agent-hooks/server'
 import { isAgentStatusHooksEnabled } from '../agent-hooks/managed-agent-hook-controls'
 import {
@@ -317,6 +319,7 @@ export class SshRelaySession {
   private muxDisposeCleanup: (() => void) | null = null
   // Why: hold the notification-handler disposer so teardownProviders can release it on reconnect/shutdown (symmetric with muxDisposeCleanup).
   private muxNotificationCleanup: (() => void) | null = null
+  private pluginSettingsCleanup: (() => void) | null = null
   // Why: onStateChange never fires when the relay channel closes but SSH stays up; this callback lets ssh.ts drive relay-level reconnect.
   private _onRelayLost: ((targetId: string) => void) | null = null
   // Why: a version mismatch or a blocked owner admission is terminal, so it needs a separate callback
@@ -329,6 +332,10 @@ export class SshRelaySession {
   private lastGraceTimeSeconds: number | undefined = undefined
   private hostPlatform: RemoteHostPlatform | null = null
   private remoteCliBridgeEnv: RemoteCliBridgeEnv | null = null
+  private openCodeRuntimePreparation: {
+    run: RemoteOpenCodeRuntimePreparation
+    controller: AbortController
+  } | null = null
   private aiVaultListMethodSupported: boolean | null = null
   private aiVaultTitleMethodSupported: boolean | null = null
   private pendingPtyReattaches = new Map<string, PendingPtyReattach>()
@@ -460,6 +467,7 @@ export class SshRelaySession {
     if (!mux || mux.isDisposed() || this._state !== 'ready') {
       throw new Error('SSH relay is not ready')
     }
+    this.prepareOpenCodeRuntimeForScan()
     return mux.request(method, params, { timeoutMs: 15_000 })
   }
 
@@ -474,6 +482,7 @@ export class SshRelaySession {
     if (!mux || mux.isDisposed() || this._state !== 'ready') {
       throw new Error('SSH relay is not ready')
     }
+    this.prepareOpenCodeRuntimeForScan()
     try {
       const result = await mux.request(SSH_AI_VAULT_LIST_SESSIONS_METHOD, params, {
         signal: options.signal,
@@ -549,7 +558,8 @@ export class SshRelaySession {
         nodePath,
         sockPath,
         credentialFile,
-        hostPlatform
+        hostPlatform,
+        prepareOpenCodeRuntime
       } = await deployAndLaunchRelay(conn, undefined, graceTimeSeconds, this.targetId)
       this.hostPlatform = hostPlatform ?? null
       this.remoteCliBridgeEnv =
@@ -574,6 +584,9 @@ export class SshRelaySession {
       }
 
       const mux = new SshChannelMultiplexer(transport)
+      this.openCodeRuntimePreparation = prepareOpenCodeRuntime
+        ? { run: prepareOpenCodeRuntime, controller: new AbortController() }
+        : null
       this.mux = mux
       const isAttemptCurrent = (): boolean => this.mux === mux && !this.isDisposed()
       const shouldContinue = (): boolean => isAttemptCurrent() && !mux.isDisposed()
@@ -704,7 +717,8 @@ export class SshRelaySession {
         nodePath,
         sockPath,
         credentialFile,
-        hostPlatform
+        hostPlatform,
+        prepareOpenCodeRuntime
       } = await deployAndLaunchRelay(conn, undefined, graceTimeSeconds, this.targetId)
       this.hostPlatform = hostPlatform ?? null
       this.remoteCliBridgeEnv =
@@ -729,6 +743,9 @@ export class SshRelaySession {
       }
 
       const mux = new SshChannelMultiplexer(transport)
+      this.openCodeRuntimePreparation = prepareOpenCodeRuntime
+        ? { run: prepareOpenCodeRuntime, controller: new AbortController() }
+        : null
       this.mux = mux
 
       const isAttemptCurrent = (): boolean =>
@@ -1072,6 +1089,13 @@ export class SshRelaySession {
       return false
     }
 
+    this.pluginSettingsCleanup?.()
+    this.pluginSettingsCleanup =
+      this.store.onSettingsChanged?.((updates) => {
+        if ('disabledTuiAgents' in updates || 'agentStatusHooksEnabled' in updates) {
+          void this.installPluginsOnRelay(mux)
+        }
+      }) ?? null
     await this.installPluginsOnRelay(mux)
     if (shouldContinue && !shouldContinue()) {
       return false
@@ -1524,17 +1548,28 @@ export class SshRelaySession {
 
   // Why: ship plugin/extension source from Orca so agent-event changes don't force a relay redeploy — the relay is versioned independently. Best-effort: failure only costs agent status on this host.
   private async installPluginsOnRelay(mux: SshChannelMultiplexer): Promise<void> {
-    if (!isRemoteAgentHooksEnabled() || !this.areAgentStatusHooksEnabled()) {
+    if (!isRemoteAgentHooksEnabled()) {
       return
     }
     try {
-      await mux.request(AGENT_HOOK_INSTALL_PLUGINS_METHOD, {
-        opencodePluginSource: openCodeInternals.getOpenCodePluginSource(),
-        opencode2PluginSource: openCodeInternals.getOpenCode2PluginSource(),
-        piExtensionSource: getPiAgentStatusExtensionSource('pi'),
-        ompExtensionSource: getPiAgentStatusExtensionSource('omp'),
-        primeAgentExtensionSource: getPiAgentStatusExtensionSource('prime-agent')
-      })
+      const hooksEnabled = this.areAgentStatusHooksEnabled()
+      await mux.request(
+        AGENT_HOOK_INSTALL_PLUGINS_METHOD,
+        selectOpenCodePluginSources(
+          {
+            opencodePluginSource: openCodeInternals.getOpenCodePluginSource(),
+            opencode2PluginSource: openCodeInternals.getOpenCode2PluginSource(),
+            ...(hooksEnabled
+              ? {
+                  piExtensionSource: getPiAgentStatusExtensionSource('pi'),
+                  ompExtensionSource: getPiAgentStatusExtensionSource('omp'),
+                  primeAgentExtensionSource: getPiAgentStatusExtensionSource('prime-agent')
+                }
+              : {})
+          },
+          this.store.getSettings?.() ?? null
+        )
+      )
     } catch (err) {
       // Why: -32601 = older relay without the handler; CONNECTION_LOST/DISPOSED = routine mid-flight teardown — swallow both.
       const code = (err as { code?: unknown })?.code
@@ -1646,11 +1681,22 @@ export class SshRelaySession {
     })
   }
 
+  private prepareOpenCodeRuntimeForScan(): void {
+    const preparation = this.openCodeRuntimePreparation
+    if (preparation) {
+      void preparation.run(preparation.controller.signal)
+    }
+  }
+
   private teardownProviders(
     reason: 'shutdown' | 'connection_lost',
     outputGenerationReason: string = reason
   ): void {
+    this.openCodeRuntimePreparation?.controller.abort()
+    this.openCodeRuntimePreparation = null
     this.releaseRelayLossWatcher()
+    this.pluginSettingsCleanup?.()
+    this.pluginSettingsCleanup = null
     this.muxNotificationCleanup?.()
     this.muxNotificationCleanup = null
     for (const cleanup of this.ptyRecoveryNotificationCleanups) {
@@ -1799,10 +1845,6 @@ export class SshRelaySession {
       }
       const pending = this.pendingPtyReattaches.get(payload.id)
       if (pending && this.activePtyConsumerOwner()?.outputFlowControl) {
-        if (pending.livePassthrough) {
-          void this.acceptPtyData(payload).catch(() => {})
-          return
-        }
         this.quarantineReattachData(pending, payload)
         return
       }
@@ -2074,6 +2116,12 @@ export class SshRelaySession {
   }
 
   private quarantineReattachData(pending: PendingPtyReattach, payload: SshPtyDataPayload): void {
+    if (pending.livePassthrough) {
+      if (this.ownsPtyRecoveryAttempt(payload.id, pending)) {
+        void this.acceptPtyData(payload).catch(() => {})
+      }
+      return
+    }
     this.observePrivateRecoveryFrame(pending, payload)
     if (pending.restoreRequired) {
       return
@@ -2575,11 +2623,15 @@ export class SshRelaySession {
         return
       }
       if (attachResult.incarnationId) {
-        const restoreResult = this.restoreReattachedPtyRuntime(
+        const restoreResult = await this.restoreReattachedPtyRuntime(
           appPtyId,
           attachResult.incarnationId,
-          activeLease
+          activeLease,
+          () => shouldContinue() && this.ownsPtyRecoveryAttempt(appPtyId, pendingReattach)
         )
+        if (!shouldContinue() || !this.ownsPtyRecoveryAttempt(appPtyId, pendingReattach)) {
+          return
+        }
         if (restoreResult !== 'restored') {
           clearProviderPtyState(appPtyId)
           deletePtyOwnership(appPtyId)
@@ -2742,45 +2794,56 @@ export class SshRelaySession {
     deletePtyOwnership(appPtyId)
   }
 
-  private restoreReattachedPtyRuntime(
+  private async restoreReattachedPtyRuntime(
     appPtyId: string,
     incarnationId: string,
-    lease: SshPtyLease | undefined
-  ): ReattachedPtyRuntimeRestore {
+    lease: SshPtyLease | undefined,
+    shouldContinue: () => boolean
+  ): Promise<ReattachedPtyRuntimeRestore> {
     if (lease?.worktreeId && lease.tabId && lease.leafId) {
-      const session = this.store.getWorkspaceSession?.()
-      // The lease froze its tabId at write time; `detachTerminalPaneToTab` moves a live pane, so
-      // trusting it would fence this reattach to the tab the pane LEFT and refuse a pane that
-      // merely moved. Leaf is the identity, the tab is only where it currently sits.
-      // SSH spawns bind panes into `ssh:<target>` while this reattach binds into `local`, so a
-      // fence that consulted only one partition would read "no pane" for a pane the other holds.
-      const hostSession = this.store.getWorkspaceSession?.(toSshExecutionHostId(this.targetId))
-      const tabId =
-        findTerminalTabIdForLeaf(session, lease.leafId) ??
-        findTerminalTabIdForLeaf(hostSession, lease.leafId) ??
-        lease.tabId
-      // Absence of the pane only means "the user closed it" once the persisted membership
-      // speaks for this worktree. Before that it means the renderer has not published its
-      // layout yet, and refusing there drops a tab the user still has — the regression that
-      // reverted this fix twice. Losing a tab is worse than keeping a duplicate, so an
-      // unauthoritative session still gets the creating write.
-      // Authority is read from `local` because that is the partition this write lands in — it
-      // is local's absence we would be interpreting. But a pane the other partition still holds
-      // is not gone, so it keeps its creating write: refusing there would strand a live pane
-      // behind a binding reattach can no longer reach.
-      const mayCreate =
-        !hasHostAuthoritativeTerminalMembership(session, lease.worktreeId) ||
-        findTerminalTabIdForLeaf(hostSession, lease.leafId) !== undefined
-      const bound = this.store.persistPtyBinding({
-        worktreeId: lease.worktreeId,
-        tabId,
-        leafId: lease.leafId,
-        ptyId: appPtyId,
-        incarnationId,
-        ...(mayCreate ? {} : { mayCreate: false }),
-        mayReviveRetiredSurface: false,
-        origin: 'relay_reattach'
+      const { worktreeId, leafId, tabId: leaseTabId } = lease
+      let tabId = lease.tabId
+      const bound = await this.store.persistPtyBinding(() => {
+        if (!shouldContinue()) {
+          return null
+        }
+        const session = this.store.getWorkspaceSession?.()
+        // The lease froze its tabId at write time; `detachTerminalPaneToTab` moves a live pane, so
+        // trusting it would fence this reattach to the tab the pane LEFT and refuse a pane that
+        // merely moved. Leaf is the identity, the tab is only where it currently sits.
+        // SSH spawns bind panes into `ssh:<target>` while this reattach binds into `local`, so a
+        // fence that consulted only one partition would read "no pane" for a pane the other holds.
+        const hostSession = this.store.getWorkspaceSession?.(toSshExecutionHostId(this.targetId))
+        tabId =
+          findTerminalTabIdForLeaf(session, leafId) ??
+          findTerminalTabIdForLeaf(hostSession, leafId) ??
+          leaseTabId
+        // Absence of the pane only means "the user closed it" once the persisted membership
+        // speaks for this worktree. Before that it means the renderer has not published its
+        // layout yet, and refusing there drops a tab the user still has — the regression that
+        // reverted this fix twice. Losing a tab is worse than keeping a duplicate, so an
+        // unauthoritative session still gets the creating write.
+        // Authority is read from `local` because that is the partition this write lands in — it
+        // is local's absence we would be interpreting. But a pane the other partition still holds
+        // is not gone, so it keeps its creating write: refusing there would strand a live pane
+        // behind a binding reattach can no longer reach.
+        const mayCreate =
+          !hasHostAuthoritativeTerminalMembership(session, worktreeId) ||
+          findTerminalTabIdForLeaf(hostSession, leafId) !== undefined
+        return {
+          worktreeId: worktreeId,
+          tabId,
+          leafId: leafId,
+          ptyId: appPtyId,
+          incarnationId,
+          ...(mayCreate ? {} : { mayCreate: false }),
+          mayReviveRetiredSurface: false,
+          origin: 'relay_reattach' as const
+        }
       })
+      if (!shouldContinue()) {
+        return 'missing-surface'
+      }
       if (bound === false) {
         // Topology absence alone is not authority to kill a process, but neither refusal may
         // publish or replay into a missing pane.
diff --git a/src/main/ssh/ssh-relay-sftp-namespace-install.test.ts b/src/main/ssh/ssh-relay-sftp-namespace-install.test.ts
index 65459b8bcbaa..5bf0cc3ab538 100644
--- a/src/main/ssh/ssh-relay-sftp-namespace-install.test.ts
+++ b/src/main/ssh/ssh-relay-sftp-namespace-install.test.ts
@@ -7,6 +7,9 @@ import { EventEmitter } from 'node:events'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import type * as RelayInstallMarkerModule from './ssh-relay-install-marker'
 
+vi.mock('./ssh-relay-opencode-runtime', () => ({
+  ensureRemoteOpenCodeRuntime: vi.fn().mockResolvedValue('ready')
+}))
 vi.mock('./ssh-relay-ripgrep-install', () => ({
   remoteRipgrepLayout: vi.fn().mockReturnValue(null),
   recordRemoteRipgrepReference: vi.fn().mockResolvedValue(false),
diff --git a/src/main/ssh/ssh-relay-superseded-endpoints.test.ts b/src/main/ssh/ssh-relay-superseded-endpoints.test.ts
index dc091b677623..63d5ec29ca12 100644
--- a/src/main/ssh/ssh-relay-superseded-endpoints.test.ts
+++ b/src/main/ssh/ssh-relay-superseded-endpoints.test.ts
@@ -107,6 +107,60 @@ describe('classifySupersededRelay', () => {
 })
 
 describe('sweepSupersededRelayEndpoints', () => {
+  it.each(['listing', 'reap', 'removal'] as const)(
+    'stops after unconfirmed %s termination without examining another endpoint',
+    async (phase) => {
+      const secondSock = `${HOME}/.orca-remote/relay-0.1.0+cafebabe1234/${SOCK_NAME}`
+      const error = Object.assign(new Error('Remote termination is unconfirmed'), {
+        sshChannelCloseConfirmed: false
+      })
+      if (phase !== 'listing') {
+        execCommand
+          .mockResolvedValueOnce(`${OLD_SOCK}\n${secondSock}\n`)
+          .mockResolvedValueOnce(
+            probe(
+              phase === 'reap'
+                ? ['PRESENT=yes', 'LISTEN=accepted', 'HOLDERS_SOURCE=lsof', 'HOLDER=80583 yes 2 0']
+                : ['PRESENT=yes', 'LISTEN=refused', 'HOLDERS_SOURCE=lsof']
+            )
+          )
+      }
+      execCommand.mockRejectedValueOnce(error)
+
+      await expect(sweepSupersededRelayEndpoints(CONN, HOST, SWEEP)).rejects.toBe(error)
+
+      expect(issuedCommands()).toHaveLength(phase === 'listing' ? 1 : 3)
+    }
+  )
+
+  it.each(['reap', 'removal'] as const)(
+    'keeps an ordinary %s failure nonfatal and examines later endpoints',
+    async (phase) => {
+      const secondSock = `${HOME}/.orca-remote/relay-0.1.0+cafebabe1234/${SOCK_NAME}`
+      execCommand
+        .mockResolvedValueOnce(`${OLD_SOCK}\n${secondSock}\n`)
+        .mockResolvedValueOnce(
+          probe(
+            phase === 'reap'
+              ? ['PRESENT=yes', 'LISTEN=accepted', 'HOLDERS_SOURCE=lsof', 'HOLDER=80583 yes 2 0']
+              : ['PRESENT=yes', 'LISTEN=refused', 'HOLDERS_SOURCE=lsof']
+          )
+        )
+        .mockRejectedValueOnce(new Error('Operation failed'))
+        .mockResolvedValueOnce(
+          probe(['PRESENT=yes', 'LISTEN=unknown', 'HOLDERS_SOURCE=unavailable'])
+        )
+
+      const findings = await sweepSupersededRelayEndpoints(CONN, HOST, SWEEP)
+
+      expect(findings.map((finding) => finding.outcome)).toEqual([
+        phase === 'reap' ? 'reap-unconfirmed' : 'unverifiable',
+        'unverifiable'
+      ])
+      expect(issuedCommands()).toHaveLength(4)
+    }
+  )
+
   it('stops the sweep before cleanup when probe group termination is unconfirmed', async () => {
     execCommand
       .mockResolvedValueOnce(OLD_SOCK)
diff --git a/src/main/ssh/ssh-relay-superseded-endpoints.ts b/src/main/ssh/ssh-relay-superseded-endpoints.ts
index ade50943c320..c538988f11b4 100644
--- a/src/main/ssh/ssh-relay-superseded-endpoints.ts
+++ b/src/main/ssh/ssh-relay-superseded-endpoints.ts
@@ -21,6 +21,7 @@ import { shellEscape } from './ssh-connection-utils'
 import { RELAY_REMOTE_DIR } from './relay-protocol'
 import { SHORT_RELAY_SOCKET_DIR_PREFIX } from './relay-socket-path-limit'
 import { execCommand } from './ssh-relay-deploy-helpers'
+import { isUnconfirmedSshCommandTermination } from './ssh-relay-exec-command'
 import {
   describeRelayEndpointIncumbent,
   isReapableRelayHusk,
@@ -138,6 +139,9 @@ export async function sweepSupersededRelayEndpoints(
       signal: options.signal
     })
   } catch (err) {
+    if (isUnconfirmedSshCommandTermination(err)) {
+      throw err
+    }
     // Same reason the Windows arm logs: an abandoned pass and an empty host are the same return
     // value, and only the log tells them apart.
     console.warn(
@@ -201,7 +205,10 @@ async function applySupersededRelayDecision(
         signal: options.signal
       })
       return 'stale-endpoint-removed'
-    } catch {
+    } catch (error) {
+      if (isUnconfirmedSshCommandTermination(error)) {
+        throw error
+      }
       return 'unverifiable'
     }
   }
diff --git a/src/main/ssh/ssh-relay-upload-stage-commands.test.ts b/src/main/ssh/ssh-relay-upload-stage-commands.test.ts
index 8afb89228d0b..0b5d0a741493 100644
--- a/src/main/ssh/ssh-relay-upload-stage-commands.test.ts
+++ b/src/main/ssh/ssh-relay-upload-stage-commands.test.ts
@@ -15,6 +15,7 @@ import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, describe, expect, it } from 'vitest'
 import { getRemoteHostPlatform, type RemoteHostPlatform } from './ssh-remote-platform'
+import { powerShellCommand, powerShellLiteral } from './ssh-remote-powershell'
 import {
   cleanupOwnedRelayUploadStageCommand,
   parseReservedRelayUploadStage,
@@ -73,17 +74,19 @@ function runCommand(host: RemoteHostPlatform, command: string, prefix = '') {
   return spawnSync('/bin/sh', ['-c', `${prefix}\n${command}`], { encoding: 'utf8' })
 }
 
-function createStage(
-  host: RemoteHostPlatform,
+function createStage(host: RemoteHostPlatform, pool: string, index: number): string {
+  const reservation = runCommand(host, reserveRelayUploadStageCommand(host, pool, owner))
+  expect(reservation.status, reservation.stderr).toBe(0)
+  return populateReservedStage(pool, index)
+}
+
+function populateReservedStage(
   pool: string,
   index: number,
-  stageOwner = owner,
+  replacementOwner?: string,
   stale = false,
   state: 'slot' | 'claim' | 'delete' = 'slot'
 ): string {
-  const reservedOwner = /^\.sftp-namespace-[0-9a-f]{32}$/u.test(stageOwner) ? stageOwner : owner
-  const reservation = runCommand(host, reserveRelayUploadStageCommand(host, pool, reservedOwner))
-  expect(reservation.status, reservation.stderr).toBe(0)
   const slot = join(pool, `slot-${index}`)
   const stage = join(pool, `${state}-${index}`)
   if (stage !== slot) {
@@ -91,8 +94,8 @@ function createStage(
     renameSync(slot, stage)
   }
   const marker = join(stage, '.orca-upload-owner')
-  if (stageOwner !== reservedOwner) {
-    writeFileSync(marker, stageOwner)
+  if (replacementOwner !== undefined) {
+    writeFileSync(marker, replacementOwner)
   }
   writeFileSync(join(stage, 'payload', 'relay.js'), `relay-${index}`)
   if (stale) {
@@ -102,16 +105,48 @@ function createStage(
   return stage
 }
 
+function createStages(host: RemoteHostPlatform, pool: string, count: number): void {
+  if (host.commandDialect !== 'powershell' || count < 2) {
+    for (let index = 0; index < count; index += 1) {
+      createStage(host, pool, index)
+    }
+    return
+  }
+  const command = reserveRelayUploadStageCommand(host, pool, owner)
+  // Only fixture setup shares a process; each unmodified script gets a fresh local scope.
+  const batch = powerShellCommand(
+    [
+      "$ErrorActionPreference = 'Stop'",
+      `$fixtureScript = ${powerShellLiteral(decodePowerShellCommand(command))}`,
+      '$reservation = [PowerShell]::Create()',
+      'try {',
+      `foreach ($fixtureIndex in 1..${count}) {`,
+      '$reservation.Commands.Clear()',
+      '$reservation.Streams.Error.Clear()',
+      '$null = $reservation.AddScript($fixtureScript, $true)',
+      '$reservation.Invoke()',
+      'if ($reservation.InvocationStateInfo.State -ne "Completed") { throw $reservation.InvocationStateInfo.Reason }',
+      '}',
+      '} finally { $reservation.Dispose() }'
+    ].join('\n')
+  )
+  const result = runCommand(host, batch)
+  expect(result.status, result.stderr).toBe(0)
+  const reservations = result.stdout.trim().split(/\r?\n/u)
+  expect(reservations).toHaveLength(count)
+  for (const [index, output] of reservations.entries()) {
+    expect(parseReservedRelayUploadStage(host, pool, owner, output).slotName).toBe(`slot-${index}`)
+    populateReservedStage(pool, index)
+  }
+}
+
 afterEach(() => {
   for (const root of roots.splice(0)) {
     rmSync(root, { recursive: true, force: true })
   }
 })
 
-// Why: every case spawns a real interpreter per command, and on non-Windows hosts the PowerShell
-// path also forks `/usr/bin/stat` per file-identity lookup — the 8-entry reservation alone measured
-// ~50s idle, nearly all of it process-spawn sys time, and the full suite multiplies that under CPU
-// contention. Sized for spawn count, not the assertions, which run in microseconds.
+// Allow for real interpreter startup and file-identity probes under full-suite contention.
 const SPAWNED_INTERPRETER_TIMEOUT_MS = 240_000
 
 describe.each([
@@ -126,9 +161,7 @@ describe.each([
   (_label, host) => {
     it.each([0, 1, 7, 8, 9])('bounds reservation with %i occupied entries', (count) => {
       const pool = createPool()
-      for (let index = 0; index < Math.min(count, RELAY_UPLOAD_STAGE_SLOT_COUNT); index += 1) {
-        createStage(host, pool, index)
-      }
+      createStages(host, pool, Math.min(count, RELAY_UPLOAD_STAGE_SLOT_COUNT))
       if (count > RELAY_UPLOAD_STAGE_SLOT_COUNT) {
         mkdirSync(join(pool, 'foreign-extra'))
       }
@@ -204,9 +237,9 @@ describe.each([
 
     it('reclaims one stale owned stage but preserves fresh and foreign stages', () => {
       const pool = createPool()
-      createStage(host, pool, 0, owner, false)
-      createStage(host, pool, 1, '.foreign-owner', true)
-      createStage(host, pool, 2, owner, true)
+      createStages(host, pool, 3)
+      populateReservedStage(pool, 1, '.foreign-owner', true)
+      populateReservedStage(pool, 2, undefined, true)
 
       const result = runCommand(host, recoverOneStaleRelayUploadStageCommand(host, pool, 60))
 
@@ -218,8 +251,9 @@ describe.each([
 
     it('drains fixed stale claim and delete states across repeated deployments', () => {
       const pool = createPool()
-      createStage(host, pool, 0, owner, true, 'claim')
-      createStage(host, pool, 1, owner, true, 'delete')
+      createStages(host, pool, 2)
+      populateReservedStage(pool, 0, undefined, true, 'claim')
+      populateReservedStage(pool, 1, undefined, true, 'delete')
 
       for (let attempt = 0; attempt < 2; attempt += 1) {
         const result = runCommand(host, recoverOneStaleRelayUploadStageCommand(host, pool, 60))
diff --git a/src/main/ssh/ssh-relay-versioned-install-termination.test.ts b/src/main/ssh/ssh-relay-versioned-install-termination.test.ts
new file mode 100644
index 000000000000..7c5501751332
--- /dev/null
+++ b/src/main/ssh/ssh-relay-versioned-install-termination.test.ts
@@ -0,0 +1,114 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+vi.mock('./ssh-relay-deploy-helpers', () => ({ execCommand: vi.fn() }))
+
+import type { SshConnection } from './ssh-connection'
+import { REMOTE_INSTALL_MODELS } from './remote-install-model'
+import { execCommand } from './ssh-relay-deploy-helpers'
+import {
+  abandonInstall,
+  finalizeInstall,
+  isRemoteInstallComplete
+} from './ssh-relay-versioned-install'
+import { getRemoteHostPlatform } from './ssh-remote-platform'
+
+// oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The mocked execCommand never reads the connection.
+const conn = {} as SshConnection
+const mockExec = vi.mocked(execCommand)
+
+beforeEach(() => {
+  mockExec.mockReset()
+})
+
+describe.each([
+  { platform: 'linux-x64' as const, remoteDir: '/relay/version' },
+  { platform: 'win32-x64' as const, remoteDir: 'C:/relay/version' }
+])('install-complete probe termination on $platform', ({ platform, remoteDir }) => {
+  const host = getRemoteHostPlatform(platform)
+
+  it.each([abandonInstall, finalizeInstall])(
+    'preserves uncertainty from lock release by %s',
+    async (release) => {
+      const error = Object.assign(new Error('release still running'), {
+        sshChannelCloseConfirmed: false
+      })
+      mockExec.mockResolvedValue('')
+      if (release === finalizeInstall) {
+        mockExec.mockResolvedValueOnce('')
+      }
+      mockExec.mockRejectedValueOnce(error)
+      await expect(release(conn, remoteDir, host)).rejects.toBe(error)
+    }
+  )
+
+  it.each([abandonInstall, finalizeInstall])(
+    'keeps confirmed release failures nonfatal in %s',
+    async (release) => {
+      if (release === finalizeInstall) {
+        mockExec.mockResolvedValueOnce('')
+      }
+      mockExec.mockRejectedValueOnce(
+        Object.assign(new Error('release failed'), {
+          sshChannelCloseConfirmed: true
+        })
+      )
+      await expect(release(conn, remoteDir, host)).resolves.toBeUndefined()
+    }
+  )
+
+  describe.each(REMOTE_INSTALL_MODELS)('$id installs', (model) => {
+    it.each([
+      { aborted: false, rethrowSessionLimitErrors: false },
+      { aborted: false, rethrowSessionLimitErrors: true },
+      { aborted: true, rethrowSessionLimitErrors: false },
+      { aborted: true, rethrowSessionLimitErrors: true }
+    ])(
+      'preserves uncertainty with aborted=$aborted and strict=$rethrowSessionLimitErrors',
+      async ({ aborted, rethrowSessionLimitErrors }) => {
+        const controller = new AbortController()
+        const error = Object.assign(new Error('SSH teardown not confirmed'), {
+          sshChannelCloseConfirmed: false
+        })
+        mockExec.mockImplementationOnce(async () => {
+          if (aborted) {
+            controller.abort(new Error('deploy aborted'))
+          }
+          throw error
+        })
+
+        await expect(
+          isRemoteInstallComplete(conn, model, remoteDir, host, {
+            signal: controller.signal,
+            rethrowSessionLimitErrors
+          })
+        ).rejects.toBe(error)
+        expect(mockExec).toHaveBeenCalledTimes(1)
+      }
+    )
+
+    it('keeps a confirmed command failure as an incomplete install', async () => {
+      mockExec.mockRejectedValueOnce(
+        Object.assign(new Error('SSH command failed after closing'), {
+          sshChannelCloseConfirmed: true
+        })
+      )
+
+      await expect(isRemoteInstallComplete(conn, model, remoteDir, host)).resolves.toBe(false)
+    })
+
+    it('keeps caller cancellation after a confirmed command failure', async () => {
+      const controller = new AbortController()
+      const abortError = new Error('deploy aborted')
+      mockExec.mockImplementationOnce(async () => {
+        controller.abort(abortError)
+        throw Object.assign(new Error('SSH command failed after closing'), {
+          sshChannelCloseConfirmed: true
+        })
+      })
+
+      await expect(
+        isRemoteInstallComplete(conn, model, remoteDir, host, { signal: controller.signal })
+      ).rejects.toBe(abortError)
+    })
+  })
+})
diff --git a/src/main/ssh/ssh-relay-versioned-install.test.ts b/src/main/ssh/ssh-relay-versioned-install.test.ts
index 482b0e8b1133..1778ac1affc3 100644
--- a/src/main/ssh/ssh-relay-versioned-install.test.ts
+++ b/src/main/ssh/ssh-relay-versioned-install.test.ts
@@ -1,11 +1,13 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type * as DeployHelpers from './ssh-relay-deploy-helpers'
 
 vi.mock('fs', () => ({
   existsSync: vi.fn(),
   readFileSync: vi.fn()
 }))
 
-vi.mock('./ssh-relay-deploy-helpers', () => ({
+vi.mock('./ssh-relay-deploy-helpers', async (importOriginal) => ({
+  ...(await importOriginal<typeof DeployHelpers>()),
   execCommand: vi.fn()
 }))
 
@@ -909,7 +911,9 @@ describe('gcOldRelayVersions', () => {
       .mockResolvedValueOnce('OWNED')
       .mockRejectedValueOnce(unconfirmed)
 
-    await gcOldRelayVersions(conn, '/home/u', '/home/u/.orca-remote/relay-0.1.0+bbb')
+    await expect(
+      gcOldRelayVersions(conn, '/home/u', '/home/u/.orca-remote/relay-0.1.0+bbb')
+    ).rejects.toBe(unconfirmed)
 
     const releaseCommands = mockExec.mock.calls
       .map(([, command]) => command)
diff --git a/src/main/ssh/ssh-relay-versioned-install.ts b/src/main/ssh/ssh-relay-versioned-install.ts
index 5bd111bdec16..ee62c3402b28 100644
--- a/src/main/ssh/ssh-relay-versioned-install.ts
+++ b/src/main/ssh/ssh-relay-versioned-install.ts
@@ -8,6 +8,7 @@ import { join } from 'node:path'
 import { existsSync, readFileSync } from 'node:fs'
 import type { SshConnection } from './ssh-connection'
 import { execCommand } from './ssh-relay-deploy-helpers'
+import { isUnconfirmedSshCommandTermination } from './ssh-relay-exec-command'
 import { RELAY_INSTALL_LOCK_NAME } from './ssh-relay-install-lock'
 import { remoteInstallDirSegments } from './ssh-relay-install-namespace'
 import { RELAY_INSTALL_MODEL, type RemoteInstallModel } from './remote-install-model'
@@ -133,6 +134,9 @@ export async function isRemoteInstallComplete(
     )
     return probe.trim() === 'OK'
   } catch (err) {
+    if (isUnconfirmedSshCommandTermination(err)) {
+      throw err
+    }
     options?.signal?.throwIfAborted()
     if (options?.rethrowSessionLimitErrors && isSshSessionLimitError(err)) {
       throw err
@@ -160,7 +164,11 @@ export async function finalizeInstall(
   if (options?.releaseLock !== false) {
     await execHostCommand(conn, host, removeRemoteTreeCommand(host, lock), {
       signal: options?.signal
-    }).catch(() => {})
+    }).catch((error) => {
+      if (isUnconfirmedSshCommandTermination(error)) {
+        throw error
+      }
+    })
   }
   options?.signal?.throwIfAborted()
 }
@@ -175,13 +183,17 @@ export async function abandonInstall(
   host: RemoteHostPlatform = DEFAULT_REMOTE_HOST
 ): Promise<void> {
   const lock = joinRemotePath(host, remoteRelayDir, RELAY_INSTALL_LOCK_NAME)
-  await execHostCommand(conn, host, removeRemoteTreeCommand(host, lock)).catch(() => {})
+  await execHostCommand(conn, host, removeRemoteTreeCommand(host, lock)).catch((error) => {
+    if (isUnconfirmedSshCommandTermination(error)) {
+      throw error
+    }
+  })
 }
 
 /**
  * Garbage-collect old version directories: remove an idle, fully-installed,
- * unlocked sibling version dir (never the current one). Best-effort — errors
- * are swallowed so GC never blocks the user from connecting.
+ * unlocked sibling version dir (never the current one). Confirmed failures are
+ * best-effort; unconfirmed command termination stops later deployment commands.
  */
 // Why re-exported rather than moved outright: deploy and the relay tests import the whole
 // versioned-install surface from here, and the split exists for file size, not to redraw an API.
diff --git a/src/main/ssh/ssh-remote-commands.ts b/src/main/ssh/ssh-remote-commands.ts
index fc3e965193ed..f23a7c4c689e 100644
--- a/src/main/ssh/ssh-remote-commands.ts
+++ b/src/main/ssh/ssh-remote-commands.ts
@@ -72,6 +72,20 @@ export function moveRemoteTreeCommand(
   )
 }
 
+// A concurrent installer may already have recreated the original directory.
+export function restoreRemoteTreeCommand(
+  host: RemoteHostPlatform,
+  source: string,
+  destination: string
+): string {
+  if (isWindowsRemoteHost(host)) {
+    return powerShellCommand(
+      `if (-not (Test-Path -LiteralPath ${powerShellLiteral(destination)})) { Move-Item -LiteralPath ${powerShellLiteral(source)} -Destination ${powerShellLiteral(destination)} -ErrorAction Stop; 'MOVED' } else { 'BUSY' }`
+    )
+  }
+  return `if [ ! -e ${shellEscape(destination)} ] && [ ! -L ${shellEscape(destination)} ]; then mv ${shellEscape(source)} ${shellEscape(destination)} && echo MOVED; else echo BUSY; fi`
+}
+
 export function promoteRemoteTreeContentsCommand(
   host: RemoteHostPlatform,
   sourcePath: string,
diff --git a/src/main/ssh/ssh-remote-orca-cli.test.ts b/src/main/ssh/ssh-remote-orca-cli.test.ts
index 276d9cad87cd..637a0c55ce3e 100644
--- a/src/main/ssh/ssh-remote-orca-cli.test.ts
+++ b/src/main/ssh/ssh-remote-orca-cli.test.ts
@@ -84,6 +84,7 @@ describe('runRemoteOrcaCli', () => {
       getActiveDispatchForIdentity: vi.fn(() => undefined),
       getActiveDispatchMailboxOwners: vi.fn(() => []),
       getCurrentRunForPane: vi.fn(() => undefined),
+      getCurrentRunForCoordinator: vi.fn(() => undefined),
       getRunMailboxOwnerIdsForHandle: vi.fn(() => []),
       findActiveRemoteAttachmentForPane: vi.fn(() => undefined)
     }
@@ -584,7 +585,9 @@ describe('runRemoteOrcaCli', () => {
     )
 
     expect(result.exitCode).toBe(0)
-    expect(db.getCurrentRunForPane).toHaveBeenCalledWith('tab_ssh:leaf_ssh')
+    expect(db.getCurrentRunForCoordinator).toHaveBeenCalledWith(
+      expect.objectContaining({ paneKey: 'tab_ssh:leaf_ssh' })
+    )
     expect(db.getActiveDispatchForIdentity).toHaveBeenCalledWith(
       'term_stale_ssh',
       'tab_ssh:leaf_ssh'
@@ -608,7 +611,7 @@ describe('runRemoteOrcaCli', () => {
     )
 
     expect(result.exitCode).toBe(0)
-    expect(db.getCurrentRunForPane).not.toHaveBeenCalled()
+    expect(db.getCurrentRunForCoordinator).not.toHaveBeenCalled()
     expect(db.getActiveDispatchForIdentity).toHaveBeenCalledWith('term_legacy_worker', undefined)
   })
 
diff --git a/src/main/startup/browser-process-user-agent-ordering.test.ts b/src/main/startup/browser-process-user-agent-ordering.test.ts
index 5913890b5cf7..ee14f1a8d3e5 100644
--- a/src/main/startup/browser-process-user-agent-ordering.test.ts
+++ b/src/main/startup/browser-process-user-agent-ordering.test.ts
@@ -26,19 +26,36 @@ const mocks = vi.hoisted(() => {
       events.push('is-ready')
       return false
     }),
+    whenReady: vi.fn(() => Promise.resolve()),
     setName: vi.fn((name: string) => {
       events.push(`set-name:${name}`)
     })
   }
-  return { app, events, userAgent: () => userAgent }
+  return {
+    app,
+    events,
+    userAgent: () => userAgent,
+    showErrorBox: vi.fn(),
+    backgroundLaunch: vi.fn(() => true),
+    admission: vi.fn(),
+    lock: vi.fn(() => true),
+    afterIdentity: vi.fn((): void => {
+      throw new Error('preflight-test-stop')
+    }),
+    recoverMoves: vi.fn()
+  }
 })
 
 vi.mock('electron', () => ({
   app: mocks.app,
+  dialog: { showErrorBox: mocks.showErrorBox },
   ipcMain: {},
   powerMonitor: {},
   session: { defaultSession: {} }
 }))
+vi.mock('../window/foreground-activation-policy', () => ({
+  isBackgroundLaunch: mocks.backgroundLaunch
+}))
 vi.mock('@electron-toolkit/utils', () => ({ is: { dev: true } }))
 vi.mock('./cli-launch-redirect', () => ({
   maybeRedirectCliLaunch: () => ({ redirected: false, status: 0 })
@@ -83,10 +100,7 @@ vi.mock('./dev-instance-identity', () => ({
 }))
 vi.mock('./renderer-heap-headroom')
 vi.mock('./startup-diagnostics', () => ({
-  isStartupDiagnosticsEnabled: () => {
-    mocks.events.push('continued-after-browser-identity')
-    throw new Error('preflight-test-stop')
-  },
+  isStartupDiagnosticsEnabled: () => false,
   logStartupDiagnostic: vi.fn()
 }))
 vi.mock('./event-loop-stall-probe')
@@ -100,8 +114,11 @@ vi.mock('./serve-desktop-activation', () => ({
 }))
 vi.mock('./single-instance-lock', () => ({
   shouldBypassSingleInstanceLock: () => false,
-  shouldSkipSingleInstanceLock: () => true,
-  acquireSingleInstanceLock: vi.fn(),
+  shouldSkipSingleInstanceLock: () => false,
+  acquireSingleInstanceLock: () => {
+    mocks.events.push('single-instance-lock')
+    return mocks.lock()
+  },
   logSingleInstanceLockBypass: vi.fn(),
   logSingleInstanceLockFailure: vi.fn(),
   SINGLE_INSTANCE_ALREADY_RUNNING_EXIT_CODE: 1
@@ -109,7 +126,12 @@ vi.mock('./single-instance-lock', () => ({
 vi.mock('../../shared/app-environment', () => ({ setAppEnvironment: vi.fn() }))
 vi.mock('../host/electron-app-environment', () => ({ ElectronAppEnvironment: class {} }))
 vi.mock('../own-chromium-tree-kill-guard')
-vi.mock('../../shared/secret-store')
+vi.mock('../../shared/secret-store', () => ({
+  setSecretStore: () => {
+    mocks.events.push('continued-after-browser-identity')
+    mocks.afterIdentity()
+  }
+}))
 vi.mock('../host/electron-secret-store')
 vi.mock('../ipc/pty-host-bindings')
 vi.mock('../host/electron-runtime-desktop-surface')
@@ -127,9 +149,24 @@ vi.mock('../persistence', () => ({
   initDataPath: () => mocks.events.push('init-data-path'),
   getCanonicalUserDataPath: () => '/canonical-user-data'
 }))
+vi.mock('../persistence/profile-state/profile-state-access', () => ({
+  acquireProfileStateRuntimeAdmission: (root: string) => {
+    mocks.events.push(`admission:${root}`)
+    return mocks.admission()
+  }
+}))
 vi.mock('../macos-press-and-hold-default')
 vi.mock('../ai-vault/session-parse-cache-persistence')
-vi.mock('../orca-profiles/profile-index-store')
+vi.mock('../orca-profiles/profile-index-store', () => ({ initOrcaProfilePaths: vi.fn() }))
+vi.mock('../orca-profiles/profile-storage-paths', () => ({
+  getProfileUserDataPath: () => '/canonical-user-data'
+}))
+vi.mock('../orca-profiles/profile-project-move-intent', () => ({
+  recoverPendingProfileProjectMoves: mocks.recoverMoves
+}))
+vi.mock('../persistence/profile-state/profile-state-active-location', () => ({
+  getActiveProfileStateLocation: () => ({ profileId: 'active-profile' })
+}))
 vi.mock('../stats/collector')
 vi.mock('../claude-usage/store')
 vi.mock('../codex-usage/store')
@@ -163,23 +200,65 @@ vi.mock('../browser/browser-identity-mode-store', () => ({
 }))
 
 describe('browser process user-agent startup ordering', () => {
+  it('explains admission refusal before a desktop launch exits', async () => {
+    const { runMainProcessPreflight } = await import('./main-process-preflight')
+    const platform = vi.spyOn(process, 'platform', 'get').mockReturnValue('darwin')
+    mocks.backgroundLaunch.mockReturnValueOnce(false)
+    mocks.admission.mockImplementationOnce(() => {
+      throw new Error('Stop Orca and orcad before retrying profile recovery')
+    })
+    const error = vi.spyOn(console, 'error').mockImplementation(() => {})
+    try {
+      expect(
+        runMainProcessPreflight({ focusExistingWindow: vi.fn(), requestDesktopActivation: vi.fn() })
+      ).toBe(false)
+      expect(mocks.showErrorBox).toHaveBeenCalledWith(
+        'Orca could not start',
+        expect.stringContaining('Stop Orca and orcad before retrying profile recovery')
+      )
+      expect(mocks.app.isReady).not.toHaveBeenCalled()
+    } finally {
+      error.mockRestore()
+      platform.mockRestore()
+      mocks.showErrorBox.mockClear()
+      mocks.events.length = 0
+    }
+  })
+
+  it('does not acquire profile admission for a duplicate launch', async () => {
+    const { runMainProcessPreflight } = await import('./main-process-preflight')
+    mocks.events.length = 0
+    mocks.lock.mockReturnValueOnce(false)
+    expect(
+      runMainProcessPreflight({ focusExistingWindow: vi.fn(), requestDesktopActivation: vi.fn() })
+    ).toBe(false)
+    expect(mocks.events).not.toContain('admission:/canonical-user-data')
+    expect(mocks.events).not.toContain('read-mode:/canonical-user-data')
+    expect(mocks.app.exit).toHaveBeenCalledWith(1)
+    mocks.events.length = 0
+  })
+
   it('executes after the dev app name and before later preflight work', async () => {
     const { getBrowserProcessUserAgentIdentity } =
       await import('../browser/browser-process-user-agent')
     const { runMainProcessPreflight } = await import('./main-process-preflight')
 
-    expect(() =>
+    expect(
       runMainProcessPreflight({
         focusExistingWindow: vi.fn(),
         requestDesktopActivation: vi.fn()
       })
-    ).toThrow('preflight-test-stop')
+    ).toBe(false)
 
     const nameIndex = mocks.events.indexOf('set-name:Orca Development')
     const modeIndex = mocks.events.indexOf('read-mode:/canonical-user-data')
     const writeIndex = mocks.events.indexOf('write-user-agent')
     const continuationIndex = mocks.events.indexOf('continued-after-browser-identity')
     expect(mocks.events.indexOf('init-data-path')).toBeLessThan(nameIndex)
+    expect(mocks.events.indexOf('init-data-path')).toBeLessThan(
+      mocks.events.indexOf('admission:/canonical-user-data')
+    )
+    expect(mocks.events.indexOf('admission:/canonical-user-data')).toBeLessThan(modeIndex)
     expect(nameIndex).toBeLessThan(modeIndex)
     expect(modeIndex).toBeLessThan(writeIndex)
     expect(writeIndex).toBeLessThan(continuationIndex)
@@ -191,4 +270,193 @@ describe('browser process user-agent startup ordering', () => {
     expect(mocks.userAgent()).not.toMatch(/Electron/)
     expect(mocks.userAgent()).not.toMatch(/Orca|Development/)
   })
+
+  it('exits without reading profile state or revealing a window when recovery holds admission', async () => {
+    const { runMainProcessPreflight } = await import('./main-process-preflight')
+    mocks.events.length = 0
+    mocks.admission.mockImplementationOnce(() => {
+      throw new Error('Profile recovery is in progress')
+    })
+    const error = vi.spyOn(console, 'error').mockImplementation(() => {})
+    const focusExistingWindow = vi.fn()
+    const requestDesktopActivation = vi.fn()
+    try {
+      expect(runMainProcessPreflight({ focusExistingWindow, requestDesktopActivation })).toBe(false)
+      expect(mocks.app.exit).toHaveBeenCalledWith(1)
+      expect(mocks.events).toEqual([
+        'init-data-path',
+        'set-name:Orca Development',
+        'single-instance-lock',
+        'admission:/canonical-user-data'
+      ])
+      expect(focusExistingWindow).not.toHaveBeenCalled()
+      expect(requestDesktopActivation).not.toHaveBeenCalled()
+      expect(mocks.showErrorBox).not.toHaveBeenCalled()
+    } finally {
+      error.mockRestore()
+    }
+  })
+})
+
+it('exits and releases admission after pending profile move recovery fails', async () => {
+  const { resetBrowserProcessUserAgentForTests } =
+    await import('../browser/browser-process-user-agent')
+  resetBrowserProcessUserAgentForTests()
+  const release = vi.fn()
+  mocks.admission.mockReturnValueOnce({ release })
+  mocks.afterIdentity.mockImplementationOnce(() => undefined)
+  mocks.recoverMoves.mockImplementationOnce(() => {
+    throw new Error('unreadable move journal')
+  })
+  const { runMainProcessPreflight } = await import('./main-process-preflight')
+  expect(
+    runMainProcessPreflight({ focusExistingWindow: vi.fn(), requestDesktopActivation: vi.fn() })
+  ).toBe(false)
+  expect(mocks.recoverMoves).toHaveBeenCalledWith('/canonical-user-data', 'active-profile')
+  expect(release).toHaveBeenCalledOnce()
+  expect(mocks.app.exit).toHaveBeenCalledWith(1)
+})
+
+it('defers a Linux desktop startup failure until Electron is ready', async () => {
+  const { runMainProcessPreflight } = await import('./main-process-preflight')
+  const { resetBrowserProcessUserAgentForTests } =
+    await import('../browser/browser-process-user-agent')
+  resetBrowserProcessUserAgentForTests()
+  const release = vi.fn()
+  let resolveReady: (() => void) | undefined
+  const ready = new Promise<void>((resolve) => {
+    resolveReady = resolve
+  })
+  mocks.admission.mockReturnValueOnce({ release })
+  mocks.afterIdentity.mockImplementationOnce(() => {
+    throw new Error('Linux pre-ready failure')
+  })
+  mocks.app.whenReady.mockReturnValueOnce(ready)
+  mocks.app.exit.mockClear()
+  mocks.showErrorBox.mockClear()
+  const platform = vi.spyOn(process, 'platform', 'get').mockReturnValue('linux')
+  mocks.backgroundLaunch.mockReturnValueOnce(false)
+  const error = vi.spyOn(console, 'error').mockImplementation(() => {})
+  try {
+    expect(
+      runMainProcessPreflight({ focusExistingWindow: vi.fn(), requestDesktopActivation: vi.fn() })
+    ).toBe(false)
+    expect(release).toHaveBeenCalledOnce()
+    expect(mocks.app.whenReady).toHaveBeenCalledOnce()
+    expect(mocks.showErrorBox).not.toHaveBeenCalled()
+    expect(mocks.app.exit).not.toHaveBeenCalled()
+
+    resolveReady?.()
+    await ready
+    await Promise.resolve()
+    expect(mocks.showErrorBox).toHaveBeenCalledWith(
+      'Orca could not start',
+      expect.stringContaining('Linux pre-ready failure')
+    )
+    expect(mocks.app.exit).toHaveBeenCalledWith(1)
+  } finally {
+    error.mockRestore()
+    platform.mockRestore()
+    mocks.app.whenReady.mockClear()
+  }
+})
+
+it('exits after a Linux desktop readiness rejection without showing a dialog', async () => {
+  const { runMainProcessPreflight } = await import('./main-process-preflight')
+  const { resetBrowserProcessUserAgentForTests } =
+    await import('../browser/browser-process-user-agent')
+  resetBrowserProcessUserAgentForTests()
+  const release = vi.fn()
+  let rejectReady!: (error: Error) => void
+  const ready = new Promise<void>((_resolve, reject) => {
+    rejectReady = reject
+  })
+  mocks.admission.mockReturnValueOnce({ release })
+  mocks.afterIdentity.mockImplementationOnce(() => {
+    throw new Error('Linux pre-ready failure')
+  })
+  mocks.app.whenReady.mockReturnValueOnce(ready)
+  mocks.app.exit.mockClear()
+  mocks.showErrorBox.mockClear()
+  const platform = vi.spyOn(process, 'platform', 'get').mockReturnValue('linux')
+  mocks.backgroundLaunch.mockReturnValueOnce(false)
+  const error = vi.spyOn(console, 'error').mockImplementation(() => {})
+  try {
+    expect(
+      runMainProcessPreflight({ focusExistingWindow: vi.fn(), requestDesktopActivation: vi.fn() })
+    ).toBe(false)
+    expect(release).toHaveBeenCalledOnce()
+    rejectReady(new Error('Electron readiness failed'))
+    await ready.catch(() => undefined)
+    await Promise.resolve()
+    expect(mocks.showErrorBox).not.toHaveBeenCalled()
+    expect(mocks.app.exit).toHaveBeenCalledWith(1)
+  } finally {
+    error.mockRestore()
+    platform.mockRestore()
+    mocks.app.whenReady.mockClear()
+  }
+})
+
+it('keeps Linux background startup failures console-only and immediate', async () => {
+  const { runMainProcessPreflight } = await import('./main-process-preflight')
+  const { resetBrowserProcessUserAgentForTests } =
+    await import('../browser/browser-process-user-agent')
+  resetBrowserProcessUserAgentForTests()
+  const release = vi.fn()
+  mocks.admission.mockReturnValueOnce({ release })
+  mocks.afterIdentity.mockImplementationOnce(() => {
+    throw new Error('Linux background failure')
+  })
+  mocks.app.whenReady.mockClear()
+  mocks.app.exit.mockClear()
+  mocks.showErrorBox.mockClear()
+  const platform = vi.spyOn(process, 'platform', 'get').mockReturnValue('linux')
+  mocks.backgroundLaunch.mockReturnValueOnce(true)
+  const error = vi.spyOn(console, 'error').mockImplementation(() => {})
+  try {
+    expect(
+      runMainProcessPreflight({ focusExistingWindow: vi.fn(), requestDesktopActivation: vi.fn() })
+    ).toBe(false)
+    expect(release).toHaveBeenCalledOnce()
+    expect(mocks.app.whenReady).not.toHaveBeenCalled()
+    expect(mocks.showErrorBox).not.toHaveBeenCalled()
+    expect(mocks.app.exit).toHaveBeenCalledWith(1)
+  } finally {
+    error.mockRestore()
+    platform.mockRestore()
+  }
+})
+
+it('keeps Linux serve startup failures console-only and immediate', async () => {
+  const { runMainProcessPreflight } = await import('./main-process-preflight')
+  const { resetBrowserProcessUserAgentForTests } =
+    await import('../browser/browser-process-user-agent')
+  resetBrowserProcessUserAgentForTests()
+  const release = vi.fn()
+  const originalArgv = process.argv
+  process.argv = originalArgv.includes('--serve') ? [...originalArgv] : [...originalArgv, '--serve']
+  mocks.admission.mockReturnValueOnce({ release })
+  mocks.afterIdentity.mockImplementationOnce(() => {
+    throw new Error('Linux serve failure')
+  })
+  mocks.app.whenReady.mockClear()
+  mocks.app.exit.mockClear()
+  mocks.showErrorBox.mockClear()
+  const platform = vi.spyOn(process, 'platform', 'get').mockReturnValue('linux')
+  mocks.backgroundLaunch.mockReturnValueOnce(false)
+  const error = vi.spyOn(console, 'error').mockImplementation(() => {})
+  try {
+    expect(
+      runMainProcessPreflight({ focusExistingWindow: vi.fn(), requestDesktopActivation: vi.fn() })
+    ).toBe(false)
+    expect(release).toHaveBeenCalledOnce()
+    expect(mocks.app.whenReady).not.toHaveBeenCalled()
+    expect(mocks.showErrorBox).not.toHaveBeenCalled()
+    expect(mocks.app.exit).toHaveBeenCalledWith(1)
+  } finally {
+    error.mockRestore()
+    platform.mockRestore()
+    process.argv = originalArgv
+  }
 })
diff --git a/src/main/startup/cli-command-names.ts b/src/main/startup/cli-command-names.ts
index 0c001b74f444..22d90947cedf 100644
--- a/src/main/startup/cli-command-names.ts
+++ b/src/main/startup/cli-command-names.ts
@@ -48,6 +48,7 @@ export const CLI_COMMAND_NAMES = [
   'open-url',
   'orchestration',
   'pdf',
+  'profile',
   'project',
   'reload',
   'repo',
diff --git a/src/main/startup/codex-launch-preparation.ts b/src/main/startup/codex-launch-preparation.ts
index 3b94c00b11d7..3b4e7fcaec03 100644
--- a/src/main/startup/codex-launch-preparation.ts
+++ b/src/main/startup/codex-launch-preparation.ts
@@ -2,6 +2,7 @@ import { app } from 'electron'
 import type { CodexHomeLaunchContext } from '../ipc/pty'
 import type { CodexAccountSelectionTarget } from '../codex-accounts/runtime-selection'
 import { markCodexProjectTrusted } from '../agent-trust-presets'
+import { awaitAgentTrustWriteWithinDeadline } from '../agent-trust-write-deadline'
 import { codexHookService } from '../codex/hook-service'
 import { getDefaultWslDistro } from '../wsl'
 import { isAgentStatusHooksEnabled } from '../agent-hooks/managed-agent-hook-controls'
@@ -23,8 +24,14 @@ export async function prepareCodexRuntimeHomeForLaunch(
     launchContext.workspacePath
   ) {
     try {
-      // Why: renderer quick-launch cannot await trust IPC before its PTY mounts; launch prep runs before every recognized Codex spawn.
-      await markCodexProjectTrusted(launchContext.workspacePath)
+      // Why: renderer quick-launch cannot await trust IPC before its PTY mounts; launch prep runs before every recognized Codex spawn. Bounded so a wedged config lane cannot hang the spawn that waits on this prep.
+      await awaitAgentTrustWriteWithinDeadline(
+        markCodexProjectTrusted(launchContext.workspacePath),
+        {
+          preset: 'codex',
+          workspacePath: launchContext.workspacePath
+        }
+      )
     } catch (error) {
       console.warn('[codex-project-trust] failed to pre-mark launch workspace:', error)
     }
diff --git a/src/main/startup/codex-launch-trust-write-deadline.test.ts b/src/main/startup/codex-launch-trust-write-deadline.test.ts
new file mode 100644
index 000000000000..c7036d4f6a78
--- /dev/null
+++ b/src/main/startup/codex-launch-trust-write-deadline.test.ts
@@ -0,0 +1,207 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { VerifiedCodexResumeSource } from '../codex/codex-session-resume-preparation'
+
+/**
+ * Why this file exists: both Codex launch-prep entry points await the trust
+ * write, and the PTY spawn awaits them, so an unbounded write turns a stuck
+ * per-`config.toml` lane into a launch that never starts. These cases pin the
+ * bound and the fail-closed consequence: giving up writes nothing, so the
+ * workspace stays untrusted and Codex raises its own trust menu.
+ */
+const mocks = vi.hoisted(() => ({
+  markCodexProjectTrusted: vi.fn(),
+  prepareForCodexLaunchAsync: vi.fn(),
+  isHostSystemDefaultRealHomeSelected: vi.fn(() => false),
+  isHostSystemDefaultRealHome: vi.fn(() => false),
+  getHostCodexHomePathsForSessionDiscovery: vi.fn((): string[] => []),
+  resolveSelectedHostAccountCodexHomePathForResume: vi.fn(() => null),
+  prepareRuntimeHomeForLaunch: vi.fn(async () => ({ state: 'ok' as const })),
+  installForLaunchPrep: vi.fn(async () => {}),
+  refreshRuntimeUserHooksForLaunchPrep: vi.fn(async () => {}),
+  ensureRealHomeCodexHookState: vi.fn(async () => {}),
+  prepareCodexSessionResume: vi.fn(),
+  prepareLegacySharedCodexSessionResume: vi.fn(async () => ({ useRealCodexHome: false }))
+}))
+
+vi.mock('electron', () => ({ app: { getPath: vi.fn(() => '/tmp/orca-user-data') } }))
+vi.mock('../agent-trust-presets', () => ({
+  markCodexProjectTrusted: mocks.markCodexProjectTrusted
+}))
+vi.mock('../codex/hook-service', () => ({
+  codexHookService: {
+    prepareRuntimeHomeForLaunch: mocks.prepareRuntimeHomeForLaunch,
+    installForLaunchPrep: mocks.installForLaunchPrep,
+    refreshRuntimeUserHooksForLaunchPrep: mocks.refreshRuntimeUserHooksForLaunchPrep
+  }
+}))
+vi.mock('../codex/codex-real-home-hook-install', () => ({
+  ensureRealHomeCodexHookState: mocks.ensureRealHomeCodexHookState
+}))
+vi.mock('../agent-hooks/managed-agent-hook-controls', () => ({
+  isAgentStatusHooksEnabled: () => false
+}))
+vi.mock('../wsl', () => ({ getDefaultWslDistro: () => 'Ubuntu' }))
+vi.mock('../codex/codex-home-paths', () => ({
+  getSystemCodexHomePath: () => '/home/user/.codex',
+  getOrcaManagedCodexHomePath: () => '/managed/.codex'
+}))
+vi.mock('../codex/codex-session-resume-preparation', () => ({
+  prepareCodexSessionResume: mocks.prepareCodexSessionResume
+}))
+vi.mock('../codex/codex-legacy-session-resume', () => ({
+  prepareLegacySharedCodexSessionResume: mocks.prepareLegacySharedCodexSessionResume
+}))
+vi.mock('./main-process-state', () => ({
+  mainProcessState: {
+    codexRuntimeHome: {
+      prepareForCodexLaunchAsync: mocks.prepareForCodexLaunchAsync,
+      isHostSystemDefaultRealHomeSelected: mocks.isHostSystemDefaultRealHomeSelected,
+      isHostSystemDefaultRealHome: mocks.isHostSystemDefaultRealHome,
+      getHostCodexHomePathsForSessionDiscovery: mocks.getHostCodexHomePathsForSessionDiscovery,
+      resolveSelectedHostAccountCodexHomePathForResume:
+        mocks.resolveSelectedHostAccountCodexHomePathForResume
+    },
+    store: { getSettings: () => ({}) }
+  }
+}))
+
+import { AGENT_TRUST_WRITE_DEADLINE_MS } from '../agent-trust-write-deadline'
+import { prepareCodexRuntimeHomeForLaunch } from './codex-launch-preparation'
+import { prepareCodexSessionResumeForLaunch } from './codex-session-resume-launch'
+
+const WORKSPACE = '/workspace/app'
+const RESUME_HOME = '/accounts/one/.codex'
+
+function neverSettlingWrite(): { promise: Promise<void>; release: () => void } {
+  let release!: () => void
+  const promise = new Promise<void>((resolve) => {
+    release = resolve
+  })
+  return { promise, release }
+}
+
+describe('Codex launch-prep trust writes', () => {
+  let warn: ReturnType<typeof vi.spyOn>
+
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mocks.isHostSystemDefaultRealHomeSelected.mockReturnValue(false)
+    mocks.getHostCodexHomePathsForSessionDiscovery.mockReturnValue([])
+    mocks.resolveSelectedHostAccountCodexHomePathForResume.mockReturnValue(null)
+    mocks.prepareForCodexLaunchAsync.mockResolvedValue(RESUME_HOME)
+    mocks.prepareRuntimeHomeForLaunch.mockResolvedValue({ state: 'ok' as const })
+    mocks.prepareLegacySharedCodexSessionResume.mockResolvedValue({ useRealCodexHome: false })
+    mocks.prepareCodexSessionResume.mockImplementation(
+      async (args: {
+        resolveVerifiedResumeHome: (source: VerifiedCodexResumeSource) => Promise<string>
+      }) => {
+        const codexHomePath = await args.resolveVerifiedResumeHome({
+          homePath: RESUME_HOME,
+          transcriptPath: `${RESUME_HOME}/sessions/abc.jsonl`
+        })
+        return { outcome: 'resume' as const, codexHomePath, sessionId: 'abc' }
+      }
+    )
+    warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+  })
+
+  afterEach(() => {
+    warn.mockRestore()
+    vi.useRealTimers()
+  })
+
+  it('bounds a never-settling write in quick-launch prep and still returns the launch home', async () => {
+    vi.useFakeTimers()
+    const write = neverSettlingWrite()
+    mocks.markCodexProjectTrusted.mockReturnValue(write.promise)
+    let settled = false
+    const prep = prepareCodexRuntimeHomeForLaunch(
+      undefined,
+      {},
+      {
+        launchAgent: 'codex',
+        workspacePath: WORKSPACE
+      }
+    ).then((home) => {
+      settled = true
+      return home
+    })
+
+    await vi.advanceTimersByTimeAsync(AGENT_TRUST_WRITE_DEADLINE_MS - 1)
+    expect(settled).toBe(false)
+    await vi.advanceTimersByTimeAsync(2)
+    await expect(prep).resolves.toBe(RESUME_HOME)
+    expect(settled).toBe(true)
+    expect(String(warn.mock.calls[0]?.[0])).toContain('did not settle')
+    expect(vi.getTimerCount()).toBe(0)
+    // Fails closed: one abandoned write, no retry and no second trust path, so
+    // nothing in this prep can report the workspace as trusted.
+    expect(mocks.markCodexProjectTrusted).toHaveBeenCalledTimes(1)
+    expect(mocks.markCodexProjectTrusted).toHaveBeenCalledWith(WORKSPACE)
+    write.release()
+  })
+
+  it('keeps the quick-launch trust write ahead of the home the spawn waits on', async () => {
+    mocks.markCodexProjectTrusted.mockResolvedValue(undefined)
+    await prepareCodexRuntimeHomeForLaunch(
+      undefined,
+      {},
+      {
+        launchAgent: 'codex',
+        workspacePath: WORKSPACE
+      }
+    )
+    expect(mocks.markCodexProjectTrusted.mock.invocationCallOrder[0]).toBeLessThan(
+      mocks.prepareForCodexLaunchAsync.mock.invocationCallOrder[0] ?? Infinity
+    )
+  })
+
+  it('bounds a never-settling write in resume prep and still resolves the resume home', async () => {
+    vi.useFakeTimers()
+    const write = neverSettlingWrite()
+    mocks.markCodexProjectTrusted.mockReturnValue(write.promise)
+    let settled = false
+    const prep = prepareCodexSessionResumeForLaunch({
+      providerSession: { key: 'session_id', id: 'abc' },
+      target: { runtime: 'host' },
+      workspacePath: WORKSPACE
+    }).then((preparation) => {
+      settled = true
+      return preparation
+    })
+
+    await vi.advanceTimersByTimeAsync(AGENT_TRUST_WRITE_DEADLINE_MS - 1)
+    expect(settled).toBe(false)
+    await vi.advanceTimersByTimeAsync(2)
+    const preparation = await prep
+    expect(preparation?.outcome).toBe('resume')
+    expect(String(warn.mock.calls[0]?.[0])).toContain('did not settle')
+    expect(vi.getTimerCount()).toBe(0)
+    expect(mocks.markCodexProjectTrusted).toHaveBeenCalledTimes(1)
+    expect(mocks.markCodexProjectTrusted).toHaveBeenCalledWith(WORKSPACE)
+    write.release()
+  })
+
+  it('keeps the resume trust write ahead of the hook repair that precedes the spawn', async () => {
+    mocks.markCodexProjectTrusted.mockResolvedValue(undefined)
+    await prepareCodexSessionResumeForLaunch({
+      providerSession: { key: 'session_id', id: 'abc' },
+      target: { runtime: 'host' },
+      workspacePath: WORKSPACE
+    })
+    expect(mocks.markCodexProjectTrusted.mock.invocationCallOrder[0]).toBeLessThan(
+      mocks.refreshRuntimeUserHooksForLaunchPrep.mock.invocationCallOrder[0] ?? Infinity
+    )
+  })
+
+  it('contains a rejected resume trust write without trusting the workspace elsewhere', async () => {
+    mocks.markCodexProjectTrusted.mockRejectedValue(new Error('mock EACCES'))
+    const preparation = await prepareCodexSessionResumeForLaunch({
+      providerSession: { key: 'session_id', id: 'abc' },
+      target: { runtime: 'host' },
+      workspacePath: WORKSPACE
+    })
+    expect(preparation?.outcome).toBe('resume')
+    expect(mocks.markCodexProjectTrusted).toHaveBeenCalledTimes(1)
+  })
+})
diff --git a/src/main/startup/codex-session-resume-launch.ts b/src/main/startup/codex-session-resume-launch.ts
index c537c4f75ef9..0c5e4598de13 100644
--- a/src/main/startup/codex-session-resume-launch.ts
+++ b/src/main/startup/codex-session-resume-launch.ts
@@ -9,6 +9,7 @@ import { codexHookService } from '../codex/hook-service'
 import { ensureRealHomeCodexHookState } from '../codex/codex-real-home-hook-install'
 import { isAgentStatusHooksEnabled } from '../agent-hooks/managed-agent-hook-controls'
 import { markCodexProjectTrusted } from '../agent-trust-presets'
+import { awaitAgentTrustWriteWithinDeadline } from '../agent-trust-write-deadline'
 import { getOrcaManagedCodexHomePath, getSystemCodexHomePath } from '../codex/codex-home-paths'
 import { normalizeRuntimePathForComparison } from '../../shared/cross-platform-path'
 import { mainProcessState as state } from './main-process-state'
@@ -82,7 +83,11 @@ export async function prepareCodexSessionResumeForLaunch(args: {
       const resumeHome = migrated.useRealCodexHome ? systemHomePath : sessionSource.homePath
       if (args.workspacePath) {
         try {
-          await markCodexProjectTrusted(args.workspacePath)
+          // Why: the PTY spawn waits on the home this resolver returns, so the write stays ahead of the agent's trust menu — bounded so a wedged lane cannot hang the resume.
+          await awaitAgentTrustWriteWithinDeadline(markCodexProjectTrusted(args.workspacePath), {
+            preset: 'codex',
+            workspacePath: args.workspacePath
+          })
         } catch (error) {
           console.warn('[codex-project-trust] failed to pre-mark resumed workspace:', error)
         }
diff --git a/src/main/startup/configure-process-profile-state.test.ts b/src/main/startup/configure-process-profile-state.test.ts
new file mode 100644
index 000000000000..08db1989c61d
--- /dev/null
+++ b/src/main/startup/configure-process-profile-state.test.ts
@@ -0,0 +1,46 @@
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+
+vi.mock('electron', () => ({
+  app: {
+    getPath: vi.fn(() => ''),
+    quit: vi.fn(),
+    exit: vi.fn(),
+    isPackaged: false,
+    disableHardwareAcceleration: vi.fn(),
+    commandLine: { appendSwitch: vi.fn(), getSwitchValue: vi.fn(() => '') }
+  }
+}))
+
+const temporaryDirectories: string[] = []
+
+afterEach(() => {
+  for (const directory of temporaryDirectories.splice(0)) {
+    rmSync(directory, { recursive: true, force: true })
+  }
+})
+
+describe('pre-ready profile-state recovery boundary', () => {
+  it('ignores a matching marker when SQLite is missing but an export remains', async () => {
+    const { shouldDisableHttp2ForElectronNetworking } = await import('./configure-process')
+    const { writeHttp1CompatibilityMarker } = await import('./http1-compatibility-marker')
+    const { profileStateJsonExportPath } =
+      await import('../persistence/profile-state/legacy-json/profile-state-export-path')
+    const userDataPath = mkdtempSync(join(tmpdir(), 'orca-http1-profile-'))
+    temporaryDirectories.push(userDataPath)
+    const profileDirectory = join(userDataPath, 'profiles', 'profile-b')
+    mkdirSync(profileDirectory, { recursive: true })
+    writeFileSync(
+      join(userDataPath, 'orca-profile-index.json'),
+      JSON.stringify({ activeProfileId: 'profile-b', profiles: [{ id: 'profile-b' }] })
+    )
+    const dataFile = join(profileDirectory, 'orca-data.json')
+    writeFileSync(dataFile, JSON.stringify({ settings: { electronHttp1CompatibilityMode: true } }))
+    writeHttp1CompatibilityMarker(userDataPath, true, 'profile-b')
+    writeFileSync(profileStateJsonExportPath(dataFile, 7), '{}')
+
+    expect(shouldDisableHttp2ForElectronNetworking({ env: {}, userDataPath })).toBe(false)
+  })
+})
diff --git a/src/main/startup/configure-process.test.ts b/src/main/startup/configure-process.test.ts
index 7d7e2b0cc1a7..fd4379354c41 100644
--- a/src/main/startup/configure-process.test.ts
+++ b/src/main/startup/configure-process.test.ts
@@ -1,4 +1,4 @@
-import { existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
 import { homedir, tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, describe, expect, it, vi } from 'vitest'
@@ -420,6 +420,22 @@ describe('configureElectronNetworkCompatibility', () => {
     return userDataPath
   }
 
+  function createProfileState(
+    userDataPath: string,
+    profileId: string,
+    settings: Record<string, unknown>
+  ): string {
+    const profileDirectory = join(userDataPath, 'profiles', profileId)
+    mkdirSync(profileDirectory, { recursive: true })
+    writeFileSync(
+      join(userDataPath, 'orca-profile-index.json'),
+      JSON.stringify({ activeProfileId: profileId, profiles: [{ id: profileId }] }),
+      'utf-8'
+    )
+    writeFileSync(join(profileDirectory, 'orca-data.json'), JSON.stringify({ settings }), 'utf-8')
+    return profileDirectory
+  }
+
   afterEach(() => {
     for (const dir of tempDirs.splice(0)) {
       rmSync(dir, { recursive: true, force: true })
@@ -504,6 +520,40 @@ describe('configureElectronNetworkCompatibility', () => {
     ).toBe(false)
   })
 
+  it('scopes a profile marker to the active profile before trusting it', async () => {
+    const { shouldDisableHttp2ForElectronNetworking } = await import('./configure-process')
+    const { writeHttp1CompatibilityMarker } = await import('./http1-compatibility-marker')
+    const userDataPath = mkdtempSync(join(tmpdir(), 'orca-http1-profile-'))
+    tempDirs.push(userDataPath)
+    createProfileState(userDataPath, 'profile-b', { electronHttp1CompatibilityMode: false })
+    writeHttp1CompatibilityMarker(userDataPath, true, 'profile-a')
+
+    expect(shouldDisableHttp2ForElectronNetworking({ env: {}, userDataPath })).toBe(false)
+  })
+
+  it('uses a matching profile marker even when the legacy JSON is stale', async () => {
+    const { shouldDisableHttp2ForElectronNetworking } = await import('./configure-process')
+    const { writeHttp1CompatibilityMarker } = await import('./http1-compatibility-marker')
+    const userDataPath = mkdtempSync(join(tmpdir(), 'orca-http1-profile-'))
+    tempDirs.push(userDataPath)
+    createProfileState(userDataPath, 'profile-b', { electronHttp1CompatibilityMode: false })
+    writeHttp1CompatibilityMarker(userDataPath, true, 'profile-b')
+
+    expect(shouldDisableHttp2ForElectronNetworking({ env: {}, userDataPath })).toBe(true)
+  })
+
+  it('fails closed when a profile database exists without a trusted marker', async () => {
+    const { shouldDisableHttp2ForElectronNetworking } = await import('./configure-process')
+    const userDataPath = mkdtempSync(join(tmpdir(), 'orca-http1-profile-'))
+    tempDirs.push(userDataPath)
+    const profileDirectory = createProfileState(userDataPath, 'profile-b', {
+      electronHttp1CompatibilityMode: true
+    })
+    writeFileSync(join(profileDirectory, 'profile-state.db'), 'sqlite-present', 'utf-8')
+
+    expect(shouldDisableHttp2ForElectronNetworking({ env: {}, userDataPath })).toBe(false)
+  })
+
   it('appends Electron disable-http2 before sessions are created', async () => {
     const { app } = await import('electron')
     const { configureElectronNetworkCompatibility } = await import('./configure-process')
diff --git a/src/main/startup/configure-process.ts b/src/main/startup/configure-process.ts
index 13dbd70c2c39..95e1df91337c 100644
--- a/src/main/startup/configure-process.ts
+++ b/src/main/startup/configure-process.ts
@@ -1,11 +1,16 @@
 import { app } from 'electron'
-import { existsSync, mkdirSync, readFileSync } from 'node:fs'
+import { mkdirSync } from 'node:fs'
 import { homedir } from 'node:os'
 import { join, resolve } from 'node:path'
 import { getVersionManagerBinPaths } from '../codex-cli/command'
 import { getMainE2EConfig } from '../e2e-config'
 import { DISABLED_CHROMIUM_FEATURES } from './disabled-chromium-features'
 import { readHttp1CompatibilityMarker } from './http1-compatibility-marker'
+import {
+  hasMissingProfileStateDatabaseWithRetainedExport,
+  readActiveProfileId,
+  readPersistedHttp1CompatibilityMode
+} from './http1-compatibility-profile-state'
 
 const DEV_PARENT_SHUTDOWN_GRACE_MS = 3000
 const HTTP1_COMPATIBILITY_ENV_VAR = 'ORCA_DISABLE_HTTP2'
@@ -32,22 +37,6 @@ function parseBooleanEnvFlag(value: string | undefined): boolean | null {
   return null
 }
 
-function readPersistedHttp1CompatibilityMode(userDataPath: string): boolean {
-  const dataFile = join(userDataPath, 'orca-data.json')
-  if (!existsSync(dataFile)) {
-    return false
-  }
-
-  try {
-    const parsed = JSON.parse(readFileSync(dataFile, 'utf-8')) as {
-      settings?: { electronHttp1CompatibilityMode?: unknown }
-    }
-    return parsed.settings?.electronHttp1CompatibilityMode === true
-  } catch {
-    return false
-  }
-}
-
 export function shouldDisableHttp2ForElectronNetworking(
   options: NetworkCompatibilityOptions = {}
 ): boolean {
@@ -56,11 +45,22 @@ export function shouldDisableHttp2ForElectronNetworking(
     return envValue
   }
   const userDataPath = options.userDataPath ?? app.getPath('userData')
+  const activeProfileId = readActiveProfileId(userDataPath)
   // Why the marker first: this runs before app.whenReady(), and the settings file is the multi-MB
-  // orca-data.json the Store parses again moments later. The marker is refreshed whenever settings
-  // change, so the full read only happens on a profile that has never written one.
+  // profile document the Store parses again moments later. The marker is refreshed whenever
+  // settings change; an untrusted SQLite profile fails closed rather than falling back to JSON.
+  if (
+    activeProfileId !== undefined &&
+    activeProfileId !== null &&
+    hasMissingProfileStateDatabaseWithRetainedExport(userDataPath, activeProfileId)
+  ) {
+    return false
+  }
   return (
-    readHttp1CompatibilityMarker(userDataPath) ?? readPersistedHttp1CompatibilityMode(userDataPath)
+    (activeProfileId === null
+      ? null
+      : readHttp1CompatibilityMarker(userDataPath, activeProfileId)) ??
+    readPersistedHttp1CompatibilityMode(userDataPath)
   )
 }
 
diff --git a/src/main/startup/desktop-startup-ordering.test.ts b/src/main/startup/desktop-startup-ordering.test.ts
index 5e4d4cfe4289..40d20d73b03f 100644
--- a/src/main/startup/desktop-startup-ordering.test.ts
+++ b/src/main/startup/desktop-startup-ordering.test.ts
@@ -104,6 +104,30 @@ describe('startup ordering', () => {
     expect(foundationSource.split('initializeBrowserClientHostId(')).toHaveLength(2)
   })
 
+  it('fails closed with offline recovery guidance when profile state is unreadable', () => {
+    const entrySource = readFileSync(join(process.cwd(), 'src/main/index.ts'), 'utf8')
+
+    expect(entrySource).toContain('formatProfileStateStartupFailure')
+    expect(entrySource).toContain('formatProfileStateStartupFailure(error) ??')
+    expect(entrySource).toContain('presentProfileStateStartupRecoveryDialog')
+    expect(entrySource).toContain('!state.isServeMode && !isBackgroundLaunch()')
+    expect(entrySource).toContain(
+      "console.warn('[profile-state] Recovery dialog failed; exiting safely:'"
+    )
+    expect(entrySource).toContain('app.exit(1)')
+  })
+
+  it('initializes telemetry before publishing profile-state authority selection', () => {
+    const source = readFileSync(
+      join(process.cwd(), 'src/main/startup/main-process-observers.ts'),
+      'utf8'
+    )
+    const telemetryInit = source.indexOf('initTelemetry(store)')
+    const authoritySelection = source.indexOf("track('profile_state_authority_selected'")
+    expect(telemetryInit).toBeGreaterThanOrEqual(0)
+    expect(authoritySelection).toBeGreaterThan(telemetryInit)
+  })
+
   it('requires daemon authority before restored-subagent liveness runs', () => {
     const source = readFileSync(
       join(process.cwd(), 'src/main/startup/main-process-pty-startup.ts'),
diff --git a/src/main/startup/dev-education-suppression.test.ts b/src/main/startup/dev-education-suppression.test.ts
index e84541f0f68e..534c64b3aa27 100644
--- a/src/main/startup/dev-education-suppression.test.ts
+++ b/src/main/startup/dev-education-suppression.test.ts
@@ -133,7 +133,12 @@ describe('suppressDevEducationForStore', () => {
       outcome: 'dismissed',
       lastCompletedStep: 1
     })
-    expect(state.ui.featureTipsSeenIds).toEqual(['voice-dictation', 'orca-cli', 'cmd-j-palette'])
+    expect(state.ui.featureTipsSeenIds).toEqual([
+      'voice-dictation',
+      'agent-session-search',
+      'orca-cli',
+      'cmd-j-palette'
+    ])
     expect(state.ui.contextualToursSeenIds).toEqual([
       'tasks',
       ...CONTEXTUAL_TOUR_IDS.filter((id) => id !== 'tasks')
diff --git a/src/main/startup/gpu-lifecycle-install-dir-acl-guard.test.ts b/src/main/startup/gpu-lifecycle-install-dir-acl-guard.test.ts
index e35fe401cdc6..7c6e7dcaaecd 100644
--- a/src/main/startup/gpu-lifecycle-install-dir-acl-guard.test.ts
+++ b/src/main/startup/gpu-lifecycle-install-dir-acl-guard.test.ts
@@ -84,7 +84,7 @@ function reportProbePoisoned(): { finishRepair: () => Promise<void> } {
     release = resolve
   })
   startWindowsInstallDirAclRepairIfPoisoned(
-    { status: 'ok', matchesPoisonSignature: true, wellKnownNameCheckReliable: true },
+    { status: 'ok', matchesPoisonSignature: true },
     {
       ...recoveryOptions(),
       runProcessFn: (async () => {
@@ -115,7 +115,7 @@ async function reportProbePoisonedWithSettledRepair(
   userDataPath?: string
 ): Promise<void> {
   startWindowsInstallDirAclRepairIfPoisoned(
-    { status: 'ok', matchesPoisonSignature: true, wellKnownNameCheckReliable: true },
+    { status: 'ok', matchesPoisonSignature: true },
     {
       ...recoveryOptions(userDataPath),
       runProcessFn: (async () => ({
@@ -268,7 +268,7 @@ describe('handleGpuChildCrash vs the install-dir ACL verdict', () => {
 
     // The reading lands poisoned: the claim was false, and engagement stays withheld.
     startWindowsInstallDirAclRepairIfPoisoned(
-      { status: 'ok', matchesPoisonSignature: true, wellKnownNameCheckReliable: true },
+      { status: 'ok', matchesPoisonSignature: true },
       recoveryOptions(userData.path)
     )
     await decisive
diff --git a/src/main/startup/headless-pty-hydration-ordering.test.ts b/src/main/startup/headless-pty-hydration-ordering.test.ts
index 3b661dede99e..c761ccf0409f 100644
--- a/src/main/startup/headless-pty-hydration-ordering.test.ts
+++ b/src/main/startup/headless-pty-hydration-ordering.test.ts
@@ -40,7 +40,7 @@ describe('headless PTY registry hydration ordering', () => {
 
   it('hydrates orcad after Store and daemon readiness but before RPC and publication', () => {
     const source = readFileSync(join(process.cwd(), 'src/main/orcad/orcad-entry.ts'), 'utf8')
-    const store = source.indexOf('const store = new Store(')
+    const store = source.indexOf('createOrcadProfileStateStartup(runtimeUserDataPath)')
     const daemon = source.indexOf('await startOrcadDaemon()', store)
     const handlersAndHydration = source.indexOf('await registerHeadlessPtyRuntime(', daemon)
     const rpc = source.indexOf('await rpc.start()', handlersAndHydration)
@@ -57,7 +57,7 @@ describe('headless PTY registry hydration ordering', () => {
     const source = readFileSync(join(process.cwd(), 'src/main/orcad/orcad-entry.ts'), 'utf8')
     const cleanup = source.indexOf('registerCleanup(async () => {')
     const hookStop = source.indexOf('agentHookServer.stop()', cleanup)
-    const store = source.indexOf('const store = new Store(')
+    const store = source.indexOf('createOrcadProfileStateStartup(runtimeUserDataPath)')
     const hookStart = source.indexOf('await agentHookServer.start(', store)
     const daemon = source.indexOf('await startOrcadDaemon()', hookStart)
     const hookEnv = source.indexOf('buildAgentHookPtyEnv:', daemon)
diff --git a/src/main/startup/http1-compatibility-marker.ts b/src/main/startup/http1-compatibility-marker.ts
index 9e85a83be66f..88de78ab8085 100644
--- a/src/main/startup/http1-compatibility-marker.ts
+++ b/src/main/startup/http1-compatibility-marker.ts
@@ -1,8 +1,12 @@
-import { readFileSync, writeFileSync } from 'node:fs'
+import { readFileSync, rmSync } from 'node:fs'
 import { join } from 'node:path'
+import { durableWriteTempPath, writeFileDurableSync } from '../durable-file-write'
+import { bestEffortFsyncDirectorySync } from '../../shared/secure-file'
 
 /**
  * Cached copy of `settings.electronHttp1CompatibilityMode` for pre-`ready` startup.
+ * Version 2 carries the active profile ID so a profile switch cannot reuse the
+ * previous profile's network compatibility choice.
  *
  * Why a standalone file (not the Store): app.commandLine.appendSwitch('disable-http2') must run
  * before the first Electron session exists, which is before the settings Store is constructed.
@@ -12,11 +16,13 @@ import { join } from 'node:path'
  */
 
 export const HTTP1_COMPATIBILITY_MARKER_FILE = 'http1-compatibility.json'
-const MARKER_SCHEME_VERSION = 1
+const LEGACY_MARKER_SCHEME_VERSION = 1
+const MARKER_SCHEME_VERSION = 2
 
 type Http1CompatibilityMarker = {
   schemeVersion: number
   enabled: boolean
+  profileId?: string
 }
 
 function markerPath(userDataPath: string): string {
@@ -24,12 +30,30 @@ function markerPath(userDataPath: string): string {
 }
 
 /** Returns null when the marker is missing or unreadable, so callers fall back to the settings file. */
-export function readHttp1CompatibilityMarker(userDataPath: string): boolean | null {
+export function readHttp1CompatibilityMarker(
+  userDataPath: string,
+  expectedProfileId?: string
+): boolean | null {
   try {
     const parsed = JSON.parse(
       readFileSync(markerPath(userDataPath), 'utf-8')
     ) as Partial<Http1CompatibilityMarker>
-    if (parsed.schemeVersion !== MARKER_SCHEME_VERSION || typeof parsed.enabled !== 'boolean') {
+    if (typeof parsed.enabled !== 'boolean') {
+      return null
+    }
+    if (parsed.schemeVersion === LEGACY_MARKER_SCHEME_VERSION) {
+      // A v1 marker predates profile-scoped state. It remains useful for a
+      // legacy install with no profile index, but cannot be trusted once the
+      // active profile is known.
+      return expectedProfileId === undefined ? parsed.enabled : null
+    }
+    if (
+      parsed.schemeVersion !== MARKER_SCHEME_VERSION ||
+      typeof parsed.profileId !== 'string' ||
+      parsed.profileId.length === 0 ||
+      expectedProfileId === undefined ||
+      parsed.profileId !== expectedProfileId
+    ) {
       return null
     }
     return parsed.enabled
@@ -38,14 +62,28 @@ export function readHttp1CompatibilityMarker(userDataPath: string): boolean | nu
   }
 }
 
-export function writeHttp1CompatibilityMarker(userDataPath: string, enabled: boolean): void {
-  if (readHttp1CompatibilityMarker(userDataPath) === enabled) {
+export function writeHttp1CompatibilityMarker(
+  userDataPath: string,
+  enabled: boolean,
+  profileId?: string
+): void {
+  if (readHttp1CompatibilityMarker(userDataPath, profileId) === enabled) {
     return
   }
-  const marker: Http1CompatibilityMarker = { schemeVersion: MARKER_SCHEME_VERSION, enabled }
+  const marker: Http1CompatibilityMarker =
+    profileId === undefined
+      ? { schemeVersion: LEGACY_MARKER_SCHEME_VERSION, enabled }
+      : { schemeVersion: MARKER_SCHEME_VERSION, enabled, profileId }
   try {
-    writeFileSync(markerPath(userDataPath), JSON.stringify(marker))
+    const targetPath = markerPath(userDataPath)
+    writeFileDurableSync(durableWriteTempPath(targetPath), targetPath, JSON.stringify(marker))
   } catch {
-    // Best effort: a missing marker just costs the next launch the settings-file fallback.
+    // Best effort: a missing marker makes the next launch fail closed or read legacy JSON.
   }
 }
+
+/** Recovery must discard the old authority's cached setting before publishing JSON authority. */
+export function invalidateHttp1CompatibilityMarker(userDataPath: string): void {
+  rmSync(markerPath(userDataPath), { force: true })
+  bestEffortFsyncDirectorySync(userDataPath)
+}
diff --git a/src/main/startup/http1-compatibility-profile-state.test.ts b/src/main/startup/http1-compatibility-profile-state.test.ts
new file mode 100644
index 000000000000..d1c9b1b08a60
--- /dev/null
+++ b/src/main/startup/http1-compatibility-profile-state.test.ts
@@ -0,0 +1,141 @@
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it } from 'vitest'
+import {
+  hasMissingProfileStateDatabaseWithRetainedExport,
+  readActiveProfileId,
+  readPersistedHttp1CompatibilityMode
+} from './http1-compatibility-profile-state'
+import { profileStateJsonExportPath } from '../persistence/profile-state/legacy-json/profile-state-export-path'
+
+const temporaryDirectories: string[] = []
+
+afterEach(() => {
+  for (const directory of temporaryDirectories.splice(0)) {
+    rmSync(directory, { recursive: true, force: true })
+  }
+})
+
+function createUserData(): string {
+  const directory = mkdtempSync(join(tmpdir(), 'orca-http1-profile-state-'))
+  temporaryDirectories.push(directory)
+  return directory
+}
+
+function writeIndex(userDataPath: string, activeProfileId: string): void {
+  writeFileSync(
+    join(userDataPath, 'orca-profile-index.json'),
+    JSON.stringify({
+      schemaVersion: 1,
+      activeProfileId,
+      profiles: [{ id: activeProfileId }]
+    })
+  )
+}
+
+describe('pre-ready profile-state compatibility lookup', () => {
+  it('uses the legacy install-level JSON before a profile index exists', () => {
+    const userDataPath = createUserData()
+    writeFileSync(
+      join(userDataPath, 'orca-data.json'),
+      JSON.stringify({ settings: { electronHttp1CompatibilityMode: true } })
+    )
+
+    expect(readActiveProfileId(userDataPath)).toBeUndefined()
+    expect(readPersistedHttp1CompatibilityMode(userDataPath)).toBe(true)
+  })
+
+  it('reads only the active profile JSON once the index is valid', () => {
+    const userDataPath = createUserData()
+    writeIndex(userDataPath, 'work')
+    const profileDirectory = join(userDataPath, 'profiles', 'work')
+    mkdirSync(profileDirectory, { recursive: true })
+    writeFileSync(
+      join(userDataPath, 'orca-data.json'),
+      JSON.stringify({ settings: { electronHttp1CompatibilityMode: true } })
+    )
+    rmSync(join(userDataPath, 'orca-data.json'))
+    writeFileSync(
+      join(profileDirectory, 'orca-data.json'),
+      JSON.stringify({ settings: { electronHttp1CompatibilityMode: true } })
+    )
+
+    expect(readActiveProfileId(userDataPath)).toBe('work')
+    expect(readPersistedHttp1CompatibilityMode(userDataPath)).toBe(true)
+  })
+
+  it.each(['-wal', '-shm', '-journal'])('fails closed when only SQLite %s remains', (suffix) => {
+    const userDataPath = createUserData()
+    writeIndex(userDataPath, 'work')
+    const profileDirectory = join(userDataPath, 'profiles', 'work')
+    mkdirSync(profileDirectory, { recursive: true })
+    writeFileSync(
+      join(profileDirectory, 'orca-data.json'),
+      JSON.stringify({ settings: { electronHttp1CompatibilityMode: true } })
+    )
+    writeFileSync(join(profileDirectory, `profile-state.db${suffix}`), 'orphaned')
+
+    expect(readPersistedHttp1CompatibilityMode(userDataPath)).toBe(false)
+
+    writeFileSync(join(userDataPath, 'orca-profile-index.json'), '{ malformed')
+    writeFileSync(
+      join(userDataPath, 'orca-data.json'),
+      JSON.stringify({ settings: { electronHttp1CompatibilityMode: true } })
+    )
+    expect(readActiveProfileId(userDataPath)).toBe(null)
+    expect(readPersistedHttp1CompatibilityMode(userDataPath)).toBe(false)
+  })
+
+  it.each(['json-export', 'database-backup'])(
+    'fails closed when SQLite is missing but a retained %s remains',
+    (artifact) => {
+      const userDataPath = createUserData()
+      writeIndex(userDataPath, 'work')
+      const profileDirectory = join(userDataPath, 'profiles', 'work')
+      mkdirSync(profileDirectory, { recursive: true })
+      const dataFile = join(profileDirectory, 'orca-data.json')
+      writeFileSync(
+        dataFile,
+        JSON.stringify({ settings: { electronHttp1CompatibilityMode: true } })
+      )
+      writeFileSync(
+        artifact === 'json-export'
+          ? profileStateJsonExportPath(dataFile, 7)
+          : join(
+              profileDirectory,
+              'profile-state.db.backup.1789999999999-00000000-0000-4000-8000-000000000000.db'
+            ),
+        readFileSync(dataFile)
+      )
+
+      expect(readPersistedHttp1CompatibilityMode(userDataPath)).toBe(false)
+    }
+  )
+
+  it.each(['json-export', 'database-backup'])(
+    'detects a missing profile database with a retained %s',
+    (artifact) => {
+      const userDataPath = createUserData()
+      writeIndex(userDataPath, 'work')
+      const profileDirectory = join(userDataPath, 'profiles', 'work')
+      mkdirSync(profileDirectory, { recursive: true })
+      const dataFile = join(profileDirectory, 'orca-data.json')
+      writeFileSync(
+        dataFile,
+        JSON.stringify({ settings: { electronHttp1CompatibilityMode: true } })
+      )
+      writeFileSync(
+        artifact === 'json-export'
+          ? profileStateJsonExportPath(dataFile, 7)
+          : join(
+              profileDirectory,
+              'profile-state.db.backup.1789999999999-00000000-0000-4000-8000-000000000000.db'
+            ),
+        readFileSync(dataFile)
+      )
+
+      expect(hasMissingProfileStateDatabaseWithRetainedExport(userDataPath, 'work')).toBe(true)
+    }
+  )
+})
diff --git a/src/main/startup/http1-compatibility-profile-state.ts b/src/main/startup/http1-compatibility-profile-state.ts
new file mode 100644
index 000000000000..f63ec01dc20f
--- /dev/null
+++ b/src/main/startup/http1-compatibility-profile-state.ts
@@ -0,0 +1,122 @@
+import { existsSync, readFileSync } from 'node:fs'
+import { dirname, join } from 'node:path'
+import { profileStateJsonExportPaths } from '../persistence/profile-state/legacy-json/profile-state-export-path'
+import { profileStateDatabaseBackups } from '../persistence/profile-state/profile-state-backup-path'
+import { hasProfileStateDatabaseFiles } from '../persistence/profile-state/profile-state-storage-classification'
+
+// Keep the pre-ready graph small; this stable ID mirrors DEFAULT_LOCAL_ORCA_PROFILE_ID.
+const DEFAULT_LOCAL_PROFILE_ID = 'local-default'
+
+/** `null` means malformed index; `undefined` means a pre-profile legacy install. */
+export function readActiveProfileId(userDataPath: string): string | null | undefined {
+  const indexPath = join(userDataPath, 'orca-profile-index.json')
+  const candidates = [indexPath, `${indexPath}.bak`].filter(existsSync)
+  if (candidates.length === 0) {
+    return undefined
+  }
+  for (const candidate of candidates) {
+    try {
+      const parsed: unknown = JSON.parse(readFileSync(candidate, 'utf-8'))
+      if (!isRecord(parsed) || typeof parsed.activeProfileId !== 'string') {
+        continue
+      }
+      if (
+        /^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/.test(parsed.activeProfileId) &&
+        Array.isArray(parsed.profiles) &&
+        parsed.profiles.some(
+          (profile) => isRecord(profile) && profile.id === parsed.activeProfileId
+        )
+      ) {
+        return parsed.activeProfileId
+      }
+    } catch {
+      // A torn primary can still have a valid recovery index.
+    }
+  }
+  return null
+}
+
+/** Read JSON only when no profile database is present; pre-ready cannot open SQLite safely. */
+export function readPersistedHttp1CompatibilityMode(userDataPath: string): boolean {
+  const activeProfileId = readActiveProfileId(userDataPath)
+  if (activeProfileId === null) {
+    // A malformed profile index leaves the active profile unknowable.
+    return false
+  }
+
+  const profileDataFile =
+    activeProfileId === undefined
+      ? undefined
+      : join(userDataPath, 'profiles', activeProfileId, 'orca-data.json')
+  const profileDatabaseFile =
+    activeProfileId === undefined
+      ? undefined
+      : join(userDataPath, 'profiles', activeProfileId, 'profile-state.db')
+  // SQLite is authoritative once present; a missing marker therefore fails closed.
+  if (profileDatabaseFile !== undefined && hasProfileStateDatabaseFiles(profileDatabaseFile)) {
+    return false
+  }
+
+  if (
+    activeProfileId !== undefined &&
+    activeProfileId !== DEFAULT_LOCAL_PROFILE_ID &&
+    (profileDataFile === undefined || !existsSync(profileDataFile))
+  ) {
+    // A known but unseeded non-default profile has default settings. The
+    // install-level legacy file belongs to another profile and must not leak.
+    return false
+  }
+  const dataFile = profileDataFile ?? join(userDataPath, 'orca-data.json')
+  // A retained migration export proves SQLite was established. Do not let the
+  // pre-ready path read a stale JSON mirror while recovery is required.
+  try {
+    if (
+      profileStateJsonExportPaths(dataFile).length > 0 ||
+      profileStateDatabaseBackups(
+        profileDatabaseFile ?? join(dirname(dataFile), 'profile-state.db')
+      ).length > 0
+    ) {
+      return false
+    }
+  } catch {
+    return false
+  }
+  if (!existsSync(dataFile)) {
+    return false
+  }
+
+  try {
+    const parsed: unknown = JSON.parse(readFileSync(dataFile, 'utf-8'))
+    if (!isRecord(parsed) || !isRecord(parsed.settings)) {
+      return false
+    }
+    return parsed.settings.electronHttp1CompatibilityMode === true
+  } catch {
+    return false
+  }
+}
+
+/** Return whether a retained SQLite export makes pre-ready JSON/marker state untrusted. */
+export function hasMissingProfileStateDatabaseWithRetainedExport(
+  userDataPath: string,
+  profileId: string
+): boolean {
+  const profileDirectory = join(userDataPath, 'profiles', profileId)
+  const databaseFile = join(profileDirectory, 'profile-state.db')
+  if (hasProfileStateDatabaseFiles(databaseFile)) {
+    return false
+  }
+  const dataFile = join(profileDirectory, 'orca-data.json')
+  try {
+    return (
+      profileStateJsonExportPaths(dataFile).length > 0 ||
+      profileStateDatabaseBackups(databaseFile).length > 0
+    )
+  } catch {
+    return true
+  }
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value)
+}
diff --git a/src/main/startup/main-process-observers.ts b/src/main/startup/main-process-observers.ts
index b0ee60f88c2f..9f7f0639aae9 100644
--- a/src/main/startup/main-process-observers.ts
+++ b/src/main/startup/main-process-observers.ts
@@ -57,6 +57,16 @@ export function initializeMainProcessObservers(): void {
   }
   // Why: telemetry must init before any IPC handler/renderer can call track(); it's a no-op in dev and while TELEMETRY_ENABLED is false, so it's safe early.
   initTelemetry(store)
+  const profileStateStartup = state.profileStateStartup
+  if (profileStateStartup) {
+    track('profile_state_authority_selected', {
+      backend: profileStateStartup.backend,
+      classification: profileStateStartup.classification,
+      authority_mode: 'sqlite-established',
+      runtime: profileStateStartup.runtime,
+      migrated: profileStateStartup.migrated
+    })
+  }
   // Why: the breadcrumb alone never leaves the machine — it rides crash reports, and a hang is not
   // a crash (the app is force-quit, so no report is ever generated). Without this the incidence
   // number the watchdog exists to produce would sit unread on the user's disk. Must run after
diff --git a/src/main/startup/main-process-preflight-failure.ts b/src/main/startup/main-process-preflight-failure.ts
new file mode 100644
index 000000000000..0fcd47935cbd
--- /dev/null
+++ b/src/main/startup/main-process-preflight-failure.ts
@@ -0,0 +1,41 @@
+import { app, dialog } from 'electron'
+import { formatProfileStateStartupFailure } from '../persistence/profile-state/profile-state-startup-failure'
+import { isBackgroundLaunch } from '../window/foreground-activation-policy'
+import { mainProcessState as state } from './main-process-state'
+
+/** Ends a failed preflight without showing a Linux dialog before Electron is ready. */
+export function handleMainProcessPreflightFailure(error: unknown): void {
+  const message =
+    formatProfileStateStartupFailure(error) ??
+    (error instanceof Error ? error.message : String(error))
+  const shouldShowDialog = !state.isServeMode && !isBackgroundLaunch()
+  state.desktopActivationGate = null
+  const admission = state.profileStateAdmission
+  state.profileStateAdmission = undefined
+  try {
+    admission?.release()
+  } catch (releaseError) {
+    console.warn('[startup] Could not release profile state admission:', releaseError)
+  }
+
+  const showDialogAndExit = (): void => {
+    try {
+      dialog.showErrorBox('Orca could not start', message)
+    } catch (dialogError) {
+      console.warn('[startup] Could not show startup failure:', dialogError)
+    } finally {
+      app.exit(1)
+    }
+  }
+  if (process.platform === 'linux' && shouldShowDialog) {
+    try {
+      void app.whenReady().then(showDialogAndExit, () => app.exit(1))
+    } catch {
+      app.exit(1)
+    }
+  } else if (shouldShowDialog) {
+    showDialogAndExit()
+  } else {
+    app.exit(1)
+  }
+}
diff --git a/src/main/startup/main-process-preflight.ts b/src/main/startup/main-process-preflight.ts
index 98d41093c5f3..100f1e213863 100644
--- a/src/main/startup/main-process-preflight.ts
+++ b/src/main/startup/main-process-preflight.ts
@@ -3,6 +3,7 @@ import { is } from '@electron-toolkit/utils'
 import os from 'node:os'
 import { join } from 'node:path'
 import { maybeRedirectCliLaunch } from './cli-launch-redirect'
+import { runProfileStateRecoveryPreflight } from './profile-state-recovery-preflight'
 import { argvRequestsServeMode, normalizeServeModeArgv } from './serve-mode-argv'
 import {
   configureDevUserDataPath,
@@ -67,6 +68,8 @@ import { initDataPath, getCanonicalUserDataPath } from '../persistence'
 import { applyMacPressAndHoldDefaultAtStartup } from '../macos-press-and-hold-default'
 import { initSessionParseCachePersistence } from '../ai-vault/session-parse-cache-persistence'
 import { initOrcaProfilePaths } from '../orca-profiles/profile-index-store'
+import { getProfileUserDataPath } from '../orca-profiles/profile-storage-paths'
+import { recoverPendingProfileProjectMoves } from '../orca-profiles/profile-project-move-intent'
 import { initStatsPath } from '../stats/collector'
 import { initClaudeUsagePath } from '../claude-usage/store'
 import { initCodexUsagePath } from '../codex-usage/store'
@@ -89,6 +92,9 @@ import { mainProcessState as state } from './main-process-state'
 import { initializeSyntheticTitleRuntime } from './synthetic-title-runtime'
 import { initializeBrowserProcessUserAgent } from '../browser/browser-process-user-agent'
 import { initializeBrowserIdentityModeStore } from '../browser/browser-identity-mode-store'
+import { acquireProfileStateRuntimeAdmission } from '../persistence/profile-state/profile-state-access'
+import { getActiveProfileStateLocation } from '../persistence/profile-state/profile-state-active-location'
+import { handleMainProcessPreflightFailure } from './main-process-preflight-failure'
 
 export type MainProcessPreflightOptions = {
   focusExistingWindow: () => void
@@ -97,6 +103,19 @@ export type MainProcessPreflightOptions = {
 
 /** Performs all module-scope work that must happen before Electron's ready event. */
 export function runMainProcessPreflight(options: MainProcessPreflightOptions): boolean {
+  try {
+    return initializeMainProcessPreflight(options)
+  } catch (error) {
+    console.error('[startup] Preflight failed:', error)
+    handleMainProcessPreflightFailure(error)
+    return false
+  }
+}
+
+function initializeMainProcessPreflight(options: MainProcessPreflightOptions): boolean {
+  if (runProfileStateRecoveryPreflight()) {
+    return false
+  }
   // Why: on Windows a CLI launch that lost ELECTRON_RUN_AS_NODE would boot the GUI and exit silently; redirect to node mode before the lock gate below.
   // The redirect runs before the serve-argv rewrite so it still matches on the launch argv verbatim.
   // Direct serve stays in-process so its signal handlers own all children.
@@ -128,7 +147,9 @@ export function runMainProcessPreflight(options: MainProcessPreflightOptions): b
     ? state.devInstanceIdentity.appUserModelId
     : undefined
   state.desktopActivationGate = createServeDesktopActivationGate({
-    initialState: state.isServeMode ? 'initializing' : 'ready',
+    // Why held for desktop too: an activation before the startup window exists would open a
+    // second main window and abort launch; runtime launch releases it once that window exists.
+    initialState: 'initializing',
     activateWindow: () => {
       // Why: an updater replacement must not resurrect the old app bundle.
       if (!isQuittingForUpdate()) {
@@ -186,10 +207,6 @@ export function runMainProcessPreflight(options: MainProcessPreflightOptions): b
   if (state.devInstanceIdentity && shouldApplyPreReadyAppName(state.devInstanceIdentity)) {
     app.setName(state.devInstanceIdentity.appName)
   }
-  // Why: renderer and worker defaults are process-global and must be fixed before any session exists.
-  initializeBrowserProcessUserAgent(
-    initializeBrowserIdentityModeStore(getCanonicalUserDataPath()).appliedMode
-  )
   state.startupDiagnosticsEnabled = isStartupDiagnosticsEnabled()
   if (state.startupDiagnosticsEnabled) {
     logStartupDiagnostic('before-single-instance-lock', {
@@ -229,6 +246,11 @@ export function runMainProcessPreflight(options: MainProcessPreflightOptions): b
     app.exit(SINGLE_INSTANCE_ALREADY_RUNNING_EXIT_CODE)
     return false
   }
+  state.profileStateAdmission = acquireProfileStateRuntimeAdmission(getCanonicalUserDataPath())
+  // Renderer and worker defaults must be fixed before any session exists.
+  initializeBrowserProcessUserAgent(
+    initializeBrowserIdentityModeStore(getCanonicalUserDataPath()).appliedMode
+  )
   // Why first in this block: the accessor throws until installed and everything below may read a
   // credential. The constructor does not touch `safeStorage` — it resolves lazily per call — so
   // installing here changes no timing, in particular not the pre-ready Keychain service-name
@@ -282,6 +304,13 @@ export function runMainProcessPreflight(options: MainProcessPreflightOptions): b
     appVersion: app.getVersion()
   })
   initOrcaProfilePaths()
+  // A crash can leave a cross-profile SQLite move between its two commits. Resolve
+  // that journal before any Store opens a profile, so no reader observes a half-move.
+  const profileUserDataPath = getProfileUserDataPath()
+  recoverPendingProfileProjectMoves(
+    profileUserDataPath,
+    getActiveProfileStateLocation(profileUserDataPath)?.profileId
+  )
   // Why: same timing as initDataPath — capture userData before app.setName changes it. See persistence.ts:20-28.
   initStatsPath()
   initClaudeUsagePath()
diff --git a/src/main/startup/main-process-quit.ts b/src/main/startup/main-process-quit.ts
index 073791f6d3cb..ad4548db7bd4 100644
--- a/src/main/startup/main-process-quit.ts
+++ b/src/main/startup/main-process-quit.ts
@@ -195,12 +195,25 @@ function installWillQuitHandler(): void {
     browserManager.setBrowserGuestStateChangedListener(null)
     const emulatorShutdown =
       state.runtime?.getEmulatorBridge()?.destroyAllSessions() ?? Promise.resolve()
-    // Why immediately before store.flushAsync() with no await in between: beginSshShutdown() marks every
+    // Why immediately before the final store flush with no await in between: beginSshShutdown() marks every
     // active SSH lease detached in memory synchronously, and that flush is what persists it.
     const sshShutdown = beginSshShutdown()
     killAllPty()
     const watcherShutdown = shutdownWatchersOnce()
-    const storeFlush = state.store?.flushAsync() ?? Promise.resolve()
+    const finalStore = state.store
+    const storeFlush = (async () => {
+      if (!finalStore) {
+        return
+      }
+      try {
+        await finalStore.flushFinalOrThrowAsync({ exportJsonCompatibility: true })
+        await finalStore.freezeWritesAsync()
+        state.profileStateAdmission?.release()
+        state.profileStateAdmission = undefined
+      } catch (error) {
+        console.error('[persistence] Failed to finalize profile state:', error)
+      }
+    })()
     // Why: usage-cache writes are queued off the main thread, so a quit right after setEnabled or a
     // scan completion would drop the final snapshot. Captured before any await; joins the barrier below.
     const usageCacheFlush = Promise.all([
diff --git a/src/main/startup/main-process-ready-activation-failure.test.ts b/src/main/startup/main-process-ready-activation-failure.test.ts
new file mode 100644
index 000000000000..b3d265b3c25f
--- /dev/null
+++ b/src/main/startup/main-process-ready-activation-failure.test.ts
@@ -0,0 +1,133 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { MainProcessRuntimeLaunchOptions } from './main-process-runtime-launch'
+
+const phases = vi.hoisted(() => ({
+  foundation: vi.fn<() => Promise<void>>(),
+  runtimeServices: vi.fn<() => Promise<void>>(),
+  menu: vi.fn<() => Promise<void>>(),
+  launch: vi.fn<(options: MainProcessRuntimeLaunchOptions) => Promise<void>>()
+}))
+
+vi.mock('./main-process-ready-foundation', () => ({
+  initializeReadyFoundation: phases.foundation
+}))
+vi.mock('./main-process-ready-runtime', () => ({
+  initializeReadyRuntimeServices: phases.runtimeServices
+}))
+vi.mock('./main-process-i18n-menu', () => ({ initializeMainProcessI18nAndMenu: phases.menu }))
+vi.mock('./main-process-runtime-launch', () => ({
+  initializeMainProcessRuntimeLaunch: phases.launch
+}))
+
+const { initializeMainProcessReady } = await import('./main-process-ready')
+const { mainProcessState: state } = await import('./main-process-state')
+const { createServeDesktopActivationGate } = await import('./serve-desktop-activation')
+
+const activateWindow = vi.fn()
+const launchOptions: MainProcessRuntimeLaunchOptions = {
+  openMainWindow: vi.fn<MainProcessRuntimeLaunchOptions['openMainWindow']>(),
+  handleMacAppActivation: vi.fn()
+}
+
+describe('desktop activation after ready-phase failures', () => {
+  beforeEach(() => {
+    vi.resetAllMocks()
+    phases.foundation.mockResolvedValue(undefined)
+    phases.runtimeServices.mockResolvedValue(undefined)
+    phases.menu.mockResolvedValue(undefined)
+    phases.launch.mockResolvedValue(undefined)
+    state.isServeMode = false
+    state.desktopActivationGate = createServeDesktopActivationGate({
+      initialState: 'initializing',
+      activateWindow
+    })
+  })
+
+  afterEach(() => {
+    state.desktopActivationGate = null
+    state.isServeMode = false
+  })
+
+  it.each(['foundation', 'runtimeServices'] as const)(
+    'disables desktop activation after %s fails',
+    async (phase) => {
+      const error = new Error(`${phase} failed`)
+      phases[phase].mockRejectedValueOnce(error)
+      state.desktopActivationGate?.requestActivation()
+
+      await expect(initializeMainProcessReady(launchOptions)).rejects.toBe(error)
+
+      expect(activateWindow).not.toHaveBeenCalled()
+      expect(state.desktopActivationGate).toBeNull()
+      expect(phases.launch).not.toHaveBeenCalled()
+      state.desktopActivationGate?.requestActivation()
+      expect(activateWindow).not.toHaveBeenCalled()
+    }
+  )
+
+  it.each(['foundation', 'runtimeServices'] as const)(
+    'disables serve promotion after %s fails',
+    async (phase) => {
+      const error = new Error(`${phase} failed`)
+      phases[phase].mockRejectedValueOnce(error)
+      state.isServeMode = true
+      state.desktopActivationGate?.requestActivation()
+
+      await expect(initializeMainProcessReady(launchOptions)).rejects.toBe(error)
+
+      expect(state.desktopActivationGate).toBeNull()
+      state.desktopActivationGate?.requestActivation()
+      expect(activateWindow).not.toHaveBeenCalled()
+      expect(phases.launch).not.toHaveBeenCalled()
+    }
+  )
+
+  it('keeps activations held when menu failure leaves window creation still pending', async () => {
+    const error = new Error('menu failed')
+    let finishLaunch = (): void => {
+      throw new Error('launch has not started')
+    }
+    phases.menu.mockRejectedValueOnce(error)
+    phases.launch.mockImplementationOnce(
+      (options) =>
+        new Promise<void>((resolve) => {
+          finishLaunch = () => {
+            options.openMainWindow()
+            resolve()
+          }
+        })
+    )
+    state.desktopActivationGate?.requestActivation()
+
+    const ready = initializeMainProcessReady(launchOptions)
+    const rejected = expect(ready).rejects.toBe(error)
+    await vi.waitFor(() => expect(phases.launch).toHaveBeenCalledOnce())
+
+    expect(state.desktopActivationGate?.getState()).toBe('initializing')
+    expect(activateWindow).not.toHaveBeenCalled()
+    expect(launchOptions.openMainWindow).not.toHaveBeenCalled()
+    finishLaunch()
+    expect(launchOptions.openMainWindow).toHaveBeenCalledTimes(1)
+    expect(state.desktopActivationGate?.getState()).toBe('ready')
+    expect(activateWindow).toHaveBeenCalledTimes(1)
+    await rejected
+    expect(state.desktopActivationGate).toBeNull()
+  })
+
+  it('does not replay pending activations when window creation throws', async () => {
+    const error = new Error('window creation failed')
+    vi.mocked(launchOptions.openMainWindow).mockImplementationOnce(() => {
+      throw error
+    })
+    phases.launch.mockImplementationOnce(async (options) => {
+      options.openMainWindow()
+    })
+    state.desktopActivationGate?.requestActivation()
+
+    await expect(initializeMainProcessReady(launchOptions)).rejects.toBe(error)
+
+    expect(state.desktopActivationGate).toBeNull()
+    expect(activateWindow).not.toHaveBeenCalled()
+    expect(launchOptions.openMainWindow).toHaveBeenCalledTimes(1)
+  })
+})
diff --git a/src/main/startup/main-process-ready-foundation.ts b/src/main/startup/main-process-ready-foundation.ts
index 3c0e01fe09eb..238998bac49a 100644
--- a/src/main/startup/main-process-ready-foundation.ts
+++ b/src/main/startup/main-process-ready-foundation.ts
@@ -11,7 +11,8 @@ import {
 } from '../hang-watchdog/hang-detection-marker'
 import { browserCertificateTrustController } from '../browser/browser-manager'
 import { ensureActiveOrcaProfile } from '../orca-profiles/profile-index-store'
-import { Store, getCanonicalUserDataPath } from '../persistence'
+import { getCanonicalUserDataPath } from '../persistence'
+import { createProfileStateStoreForStartup } from '../persistence/profile-state/profile-state-startup-authority'
 import { initializeBrowserClientHostId } from '../browser/browser-client-host-id'
 import { scheduleSecretProtectionGapReport } from '../host/deferred-secret-protection-report'
 import { initSshHostKeyStoreFile } from '../ssh/ssh-host-key-store'
@@ -49,6 +50,7 @@ import { updateGpuAccelerationAboutPanel } from './gpu-lifecycle'
 import { reconcileManagedWslCliRegistrations } from '../cli/wsl-cli-registration-reconciliation'
 import { createWslCliReconciliationStartupBarrier } from './wsl-cli-reconciliation-startup-barrier'
 import { isAgentStatusHooksEnabled } from '../agent-hooks/managed-agent-hook-controls'
+import { reportProfileStateWriteFailure } from './profile-state-write-failure'
 
 export async function initializeReadyFoundation(): Promise<void> {
   logStartupMilestone('app-ready')
@@ -134,10 +136,21 @@ export async function initializeReadyFoundation(): Promise<void> {
   // Why this early: the first window stamps the hosting id into its renderer's argv, so the durable
   // read has to have happened by then or the renderer and the browser-host lease disagree.
   initializeBrowserClientHostId(profile.profileDirectory)
-  const store = new Store({
+  const profileState = await createProfileStateStoreForStartup({
     dataFile: profile.dataFile,
-    storageAuthority: state.isServeMode ? 'runtime' : 'desktop'
+    databaseFile: profile.stateDatabaseFile,
+    profileId: profile.profile.id,
+    runtime: 'desktop',
+    storageAuthority: state.isServeMode ? 'runtime' : 'desktop',
+    onPersistenceFailure: reportProfileStateWriteFailure
   })
+  state.profileStateStartup = {
+    backend: profileState.backend,
+    classification: profileState.classification,
+    runtime: 'desktop',
+    migrated: profileState.migrated
+  }
+  const store = profileState.store
   state.store = store
   // Why: create pending readiness before the guard can observe the default session.
   // Why parked on state instead of awaited here: Dock/Launchpad launches don't inherit shell
@@ -197,7 +210,8 @@ export async function initializeReadyFoundation(): Promise<void> {
   // Why: pre-`ready` startup reads this flag from a marker so it never has to parse orca-data.json.
   writeHttp1CompatibilityMarker(
     canonicalUserDataPath,
-    store.getSettings().electronHttp1CompatibilityMode === true
+    store.getSettings().electronHttp1CompatibilityMode === true,
+    profile.profile.id
   )
   // Why: apply initial fallback WSL distro from store settings for global git/CLI calls.
   setDefaultWslDistroOverride(store.getSettings().terminalWindowsWslDistro ?? null)
@@ -205,7 +219,8 @@ export async function initializeReadyFoundation(): Promise<void> {
     if ('electronHttp1CompatibilityMode' in updates) {
       writeHttp1CompatibilityMarker(
         canonicalUserDataPath,
-        settings.electronHttp1CompatibilityMode === true
+        settings.electronHttp1CompatibilityMode === true,
+        profile.profile.id
       )
     }
     if ('terminalWindowsWslDistro' in updates) {
diff --git a/src/main/startup/main-process-ready-identity-write.test.ts b/src/main/startup/main-process-ready-identity-write.test.ts
index 13011ccfb6b4..7f7d490dc88f 100644
--- a/src/main/startup/main-process-ready-identity-write.test.ts
+++ b/src/main/startup/main-process-ready-identity-write.test.ts
@@ -82,6 +82,16 @@ vi.mock('../persistence', () => ({
   },
   getCanonicalUserDataPath: () => mocks.userDataPath
 }))
+vi.mock('../persistence/profile-state/profile-state-startup-authority', () => ({
+  createProfileStateStoreForStartup: () => ({
+    store: {
+      getSettings: () => ({}),
+      onSettingsChanged: () => {},
+      getClaudeLivePtySessionIds: () => [],
+      getSshTargets: () => []
+    }
+  })
+}))
 // The registry reads the canonical path from this module, not from '../persistence'.
 vi.mock('../persistence/loading-store/user-data-path', () => ({
   getCanonicalUserDataPath: () => mocks.userDataPath
diff --git a/src/main/startup/main-process-ready-persistence-cleanup.test.ts b/src/main/startup/main-process-ready-persistence-cleanup.test.ts
new file mode 100644
index 000000000000..6deac0e8d510
--- /dev/null
+++ b/src/main/startup/main-process-ready-persistence-cleanup.test.ts
@@ -0,0 +1,130 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import {
+  createServeDesktopActivationGate,
+  type ServeDesktopActivationGate
+} from './serve-desktop-activation'
+
+const { state, foundation, runtime, i18n, launch } = vi.hoisted(() => ({
+  state: {
+    store: { freezeWritesAsync: vi.fn(async () => {}) },
+    profileStateAdmission: initialAdmission(),
+    desktopActivationGate: initialActivationGate(),
+    mainProcessI18nReady: Promise.resolve()
+  },
+  foundation: vi.fn(async () => {}),
+  runtime: vi.fn(async () => {}),
+  i18n: vi.fn(async () => {}),
+  launch: vi.fn(async () => {})
+}))
+
+function initialAdmission(): { release(): void } | undefined {
+  return undefined
+}
+
+function initialActivationGate(): ServeDesktopActivationGate | null {
+  return null
+}
+
+vi.mock('./main-process-state', () => ({ mainProcessState: state }))
+vi.mock('./main-process-ready-foundation', () => ({ initializeReadyFoundation: foundation }))
+vi.mock('./main-process-ready-runtime', () => ({ initializeReadyRuntimeServices: runtime }))
+vi.mock('./main-process-i18n-menu', () => ({ initializeMainProcessI18nAndMenu: i18n }))
+vi.mock('./main-process-runtime-launch', () => ({ initializeMainProcessRuntimeLaunch: launch }))
+
+import { initializeMainProcessReady } from './main-process-ready'
+
+const options = {
+  openMainWindow: (): never => {
+    throw new Error('Unexpected window creation in startup cleanup test')
+  },
+  handleMacAppActivation: () => {}
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  state.profileStateAdmission = { release: vi.fn() }
+  state.desktopActivationGate = null
+})
+
+describe('startup persistence lifetime', () => {
+  it('disables activations before a failed launch closes its profile writer', async () => {
+    const activateWindow = vi.fn()
+    state.desktopActivationGate = createServeDesktopActivationGate({
+      initialState: 'ready',
+      activateWindow
+    })
+    const failure = new Error('runtime startup failed')
+    launch.mockRejectedValueOnce(failure)
+    let finishFreeze = (): void => {}
+    state.store.freezeWritesAsync.mockImplementationOnce(
+      () =>
+        new Promise<void>((resolve) => {
+          finishFreeze = resolve
+        })
+    )
+    const rejected = expect(initializeMainProcessReady(options)).rejects.toBe(failure)
+
+    await vi.waitFor(() => expect(state.store.freezeWritesAsync).toHaveBeenCalledOnce())
+
+    expect(state.desktopActivationGate).toBeNull()
+    state.desktopActivationGate?.requestActivation()
+    expect(activateWindow).not.toHaveBeenCalled()
+    finishFreeze()
+    await rejected
+  })
+
+  it('awaits writer release after a later startup phase fails', async () => {
+    const failure = new Error('runtime startup failed')
+    const admission = state.profileStateAdmission
+    runtime.mockRejectedValueOnce(failure)
+    let release = () => {}
+    state.store.freezeWritesAsync.mockImplementationOnce(
+      () =>
+        new Promise<void>((resolve) => {
+          release = resolve
+        })
+    )
+    const ready = initializeMainProcessReady(options)
+    const rejected = expect(ready).rejects.toBe(failure)
+    await vi.waitFor(() => expect(state.store.freezeWritesAsync).toHaveBeenCalledOnce())
+    expect(admission?.release).not.toHaveBeenCalled()
+    release()
+    await rejected
+    expect(admission?.release).toHaveBeenCalledOnce()
+    expect(state.profileStateAdmission).toBeUndefined()
+    expect(launch).not.toHaveBeenCalled()
+  })
+
+  it('joins concurrent startup branches before closing their Store', async () => {
+    const failure = new Error('translations failed')
+    i18n.mockRejectedValueOnce(failure)
+    let release = () => {}
+    launch.mockImplementationOnce(
+      () =>
+        new Promise<void>((resolve) => {
+          release = resolve
+        })
+    )
+    const ready = initializeMainProcessReady(options)
+    const rejected = expect(ready).rejects.toBe(failure)
+    await vi.waitFor(() => expect(launch).toHaveBeenCalledOnce())
+    expect(state.store.freezeWritesAsync).not.toHaveBeenCalled()
+    release()
+    await rejected
+    expect(state.store.freezeWritesAsync).toHaveBeenCalledOnce()
+  })
+
+  it('keeps the original startup failure when cleanup also fails', async () => {
+    const log = vi.spyOn(console, 'error').mockImplementation(() => {})
+    const failure = new Error('foundation failed')
+    foundation.mockRejectedValueOnce(failure)
+    state.store.freezeWritesAsync.mockRejectedValueOnce(new Error('close failed'))
+    try {
+      await expect(initializeMainProcessReady(options)).rejects.toBe(failure)
+      expect(log).toHaveBeenCalledOnce()
+      expect(state.profileStateAdmission?.release).not.toHaveBeenCalled()
+    } finally {
+      log.mockRestore()
+    }
+  })
+})
diff --git a/src/main/startup/main-process-ready.ts b/src/main/startup/main-process-ready.ts
index 835c1f1dd134..7c27f73a4654 100644
--- a/src/main/startup/main-process-ready.ts
+++ b/src/main/startup/main-process-ready.ts
@@ -2,6 +2,7 @@ import { initializeMainProcessI18nAndMenu } from './main-process-i18n-menu'
 import { mainProcessState as state } from './main-process-state'
 import { initializeReadyFoundation } from './main-process-ready-foundation'
 import { initializeReadyRuntimeServices } from './main-process-ready-runtime'
+import { releaseDesktopActivationAfter } from './serve-desktop-activation'
 import {
   initializeMainProcessRuntimeLaunch,
   type MainProcessRuntimeLaunchOptions
@@ -9,14 +10,44 @@ import {
 
 /** Runs the ready-phase composition in the same dependency order as the legacy entry point. */
 export async function initializeMainProcessReady(
-  options: MainProcessRuntimeLaunchOptions
+  launchOptions: MainProcessRuntimeLaunchOptions
 ): Promise<void> {
-  await initializeReadyFoundation()
-  await initializeReadyRuntimeServices()
-  // Why concurrent: window creation reads no translated string and no menu item, and both the
-  // native menu and the tray only become reachable once the window shows — so serializing them
-  // ahead of openMainWindow only delayed the renderer (8 ms in English, more for a lazy locale).
-  const i18nAndMenuReady = initializeMainProcessI18nAndMenu()
-  state.mainProcessI18nReady = i18nAndMenuReady.catch(() => {})
-  await Promise.all([i18nAndMenuReady, initializeMainProcessRuntimeLaunch(options)])
+  const options: MainProcessRuntimeLaunchOptions = {
+    ...launchOptions,
+    openMainWindow: releaseDesktopActivationAfter(
+      state.desktopActivationGate,
+      launchOptions.openMainWindow
+    )
+  }
+  try {
+    await initializeReadyFoundation()
+    await initializeReadyRuntimeServices()
+    // Window creation can proceed while translations and the native menu initialize.
+    const i18nAndMenuReady = initializeMainProcessI18nAndMenu()
+    state.mainProcessI18nReady = i18nAndMenuReady.catch(() => {})
+    // Join both branches before cleanup can close the profile writer.
+    const results = await Promise.allSettled([
+      i18nAndMenuReady,
+      initializeMainProcessRuntimeLaunch(options)
+    ])
+    for (const result of results) {
+      if (result.status === 'rejected') {
+        throw result.reason
+      }
+    }
+  } catch (error) {
+    // Startup now exits after failure; reopening would use a closing profile writer.
+    state.desktopActivationGate = null
+    try {
+      await state.store?.freezeWritesAsync()
+      state.profileStateAdmission?.release()
+      state.profileStateAdmission = undefined
+    } catch (closeError) {
+      console.error(
+        '[persistence] Failed to close profile persistence after startup failure:',
+        closeError
+      )
+    }
+    throw error
+  }
 }
diff --git a/src/main/startup/main-process-runtime-launch-activation.test.ts b/src/main/startup/main-process-runtime-launch-activation.test.ts
new file mode 100644
index 000000000000..42813af450e7
--- /dev/null
+++ b/src/main/startup/main-process-runtime-launch-activation.test.ts
@@ -0,0 +1,232 @@
+import { readFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+const electronApp = vi.hoisted(() => ({
+  isPackaged: false,
+  on: vi.fn(),
+  getPath: vi.fn(() => '/tmp/orca-user-data'),
+  getVersion: vi.fn(() => '0.0.0-test'),
+  isReady: vi.fn(() => true),
+  focus: vi.fn()
+}))
+const launchHooks = vi.hoisted(() => ({
+  duringInstallDirRepair: (): void => {},
+  failBeforeWindow: false
+}))
+
+vi.mock('electron', () => ({ app: electronApp, powerMonitor: { on: vi.fn() } }))
+vi.mock('@electron-toolkit/utils', () => ({ is: { dev: false } }))
+vi.mock('../orca-profiles/profile-cloud-auth-config', () => ({
+  getOrcaCloudAuthConfig: () => ({ configured: false })
+}))
+vi.mock('../orca-profiles/profile-storage-paths', () => ({ getProfileUserDataPath: vi.fn() }))
+vi.mock('../persistence', () => ({
+  getCanonicalUserDataPath: () => '/tmp/orca-user-data',
+  migrateMobilePairingDataToCanonicalUserDataPath: vi.fn()
+}))
+vi.mock('../runtime/runtime-rpc', () => ({
+  OrcaRuntimeRpcServer: class {
+    start = vi.fn(async () => {})
+    setOnUnpairedDeviceAuthFailure = vi.fn()
+  }
+}))
+vi.mock('../ipc/mobile', () => ({ registerMobileHandlers: vi.fn() }))
+vi.mock('../ipc/pty', () => ({
+  getLocalPtyProvider: vi.fn(),
+  registerHeadlessPtyRuntime: vi.fn()
+}))
+vi.mock('../providers/local-pty-provider', () => ({ LocalPtyProvider: class {} }))
+vi.mock('../browser/offscreen-browser-backend', () => ({ OffscreenBrowserBackend: class {} }))
+vi.mock('../browser/browser-manager', () => ({ browserManager: {} }))
+vi.mock('./main-process-relay-status', () => ({
+  getDesktopRelayStatus: vi.fn(),
+  publishDesktopRelayStatus: vi.fn()
+}))
+vi.mock('../runtime/relay/desktop-relay-service', () => ({ DesktopRelayService: class {} }))
+vi.mock('./main-process-serve', () => ({
+  getServeOptions: vi.fn(() => null),
+  getBundledWebClientRoot: vi.fn(() => null),
+  printServeReady: vi.fn()
+}))
+vi.mock('./main-process-pty-startup', () => ({
+  bindTerminalRuntimeStartupServices: vi.fn(),
+  handleCodexHomePtySpawned: vi.fn(),
+  handlePtyExit: vi.fn(),
+  startTerminalRuntimeStartupServices: vi.fn(() => ({}))
+}))
+vi.mock('./codex-launch-preparation', () => ({ prepareCodexRuntimeHomeForLaunch: vi.fn() }))
+vi.mock('./codex-session-resume-launch', () => ({ prepareCodexSessionResumeForLaunch: vi.fn() }))
+vi.mock('./windows-install-dir-acl-recovery', () => ({
+  // The awaited gap before the first window, where a second-instance launch can land.
+  repairKnownPoisonedInstallDirBeforeWindow: vi.fn(async () => {
+    launchHooks.duringInstallDirRepair()
+    if (launchHooks.failBeforeWindow) {
+      throw new Error('install-dir repair failed')
+    }
+    return 'not-marked'
+  })
+}))
+vi.mock('./serve-signal-handlers', () => ({ registerServeSignalHandlers: vi.fn() }))
+vi.mock('../runtime/runtime-rpc-startup-failure', () => ({
+  recordRuntimeRpcStartFailure: vi.fn(),
+  showRuntimeRpcStartupFailureDialog: vi.fn()
+}))
+vi.mock('../cli/cli-installer', () => ({ CliInstaller: class {} }))
+vi.mock('../cli/linux-bare-orca-dispatcher', () => ({ installLinuxBareOrcaDispatcher: vi.fn() }))
+vi.mock('../terminal-history-deletion', () => ({ scheduleAllPendingHistoryTreeRemovals: vi.fn() }))
+vi.mock('../ipc/startup-notification-registration', () => ({
+  triggerStartupNotificationRegistration: vi.fn()
+}))
+vi.mock('./main-process-push-startup', () => ({ startDesktopPushService: vi.fn() }))
+vi.mock('./startup-diagnostics', () => ({ logStartupMilestone: vi.fn() }))
+vi.mock('../server/serve-stdout-boundary', () => ({ emitServeBrowserIdentityActionLine: vi.fn() }))
+vi.mock('../browser/browser-identity-mode-store', () => ({
+  getBrowserIdentityModeStatus: vi.fn()
+}))
+const showWindowWithoutStealingFocus = vi.hoisted(() => vi.fn())
+vi.mock('../window/foreground-activation-policy', () => ({
+  isBackgroundLaunch: () => true,
+  isWindowlessLaunch: () => false,
+  showWindowWithoutStealingFocus
+}))
+
+vi.mock('./main-process-ready-foundation', () => ({
+  initializeReadyFoundation: vi.fn(async () => {})
+}))
+vi.mock('./main-process-ready-runtime', () => ({
+  initializeReadyRuntimeServices: vi.fn(async () => {})
+}))
+vi.mock('./main-process-i18n-menu', () => ({
+  initializeMainProcessI18nAndMenu: vi.fn(async () => {})
+}))
+
+const { initializeMainProcessReady } = await import('./main-process-ready')
+const { mainProcessState: state } = await import('./main-process-state')
+const { createServeDesktopActivationGate } = await import('./serve-desktop-activation')
+const { focusExistingMainWindow } = await import('../window/focus-existing-window')
+
+type FakeWindow = {
+  id: number
+  webContents: { id: number }
+  isDestroyed: () => boolean
+  isMinimized: () => boolean
+  restore: () => void
+  once: () => void
+}
+
+const originalPlatform = process.platform
+
+describe('desktop startup activation', () => {
+  let windows: FakeWindow[]
+  let ipcHandles: Set<string>
+  let trustedRendererId: number | null
+
+  // Mirrors openMainWindow's non-idempotent side effects that broke in the field.
+  function openMainWindow(): FakeWindow {
+    const id = windows.length + 1
+    const window: FakeWindow = {
+      id,
+      webContents: { id },
+      isDestroyed: () => false,
+      isMinimized: () => false,
+      restore: vi.fn(),
+      once: vi.fn()
+    }
+    windows.push(window)
+    trustedRendererId = id
+    if (ipcHandles.has('window:isMaximized')) {
+      throw new Error("Attempted to register a second handler for 'window:isMaximized'")
+    }
+    ipcHandles.add('window:isMaximized')
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the launch only reads the fields FakeWindow provides.
+    state.mainWindow = window as unknown as NonNullable<typeof state.mainWindow>
+    return window
+  }
+
+  beforeEach(() => {
+    windows = []
+    showWindowWithoutStealingFocus.mockClear()
+    ipcHandles = new Set()
+    trustedRendererId = null
+    launchHooks.duringInstallDirRepair = () => {}
+    launchHooks.failBeforeWindow = false
+    state.mainWindow = null
+    state.isServeMode = false
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the launch only null-checks the runtime before the mocked RPC server takes it.
+    state.runtime = {} as NonNullable<typeof state.runtime>
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the launch only calls whenReady().
+    state.windowsShellPathHydration = {
+      whenReady: () => Promise.resolve()
+    } as unknown as NonNullable<typeof state.windowsShellPathHydration>
+    state.initialProxyApplicationReady = Promise.resolve()
+    // Built the way preflight builds it for a desktop launch.
+    state.desktopActivationGate = createServeDesktopActivationGate({
+      initialState: 'initializing',
+      activateWindow: () =>
+        focusExistingMainWindow({
+          app: electronApp,
+          getWindow: () => state.mainWindow,
+          // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: focusExistingMainWindow only calls the FakeWindow methods.
+          openWindow: () => openMainWindow() as unknown as NonNullable<typeof state.mainWindow>
+        })
+    })
+  })
+
+  afterEach(() => {
+    Object.defineProperty(process, 'platform', { value: originalPlatform })
+    electronApp.isPackaged = false
+  })
+
+  it.each([
+    ['darwin', false],
+    ['linux', false],
+    ['win32', true]
+  ] as const)(
+    'focuses the startup window when a second instance lands before it exists (%s)',
+    async (platform, isPackaged) => {
+      Object.defineProperty(process, 'platform', { value: platform })
+      electronApp.isPackaged = isPackaged
+      launchHooks.duringInstallDirRepair = () => state.desktopActivationGate?.requestActivation()
+
+      await initializeMainProcessReady({
+        // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the launch only calls once() on the returned window.
+        openMainWindow: () => openMainWindow() as unknown as NonNullable<typeof state.mainWindow>,
+        handleMacAppActivation: vi.fn()
+      })
+
+      expect(windows).toHaveLength(1)
+      expect(trustedRendererId).toBe(windows[0].id)
+      expect(state.mainWindow).toBe(windows[0])
+      expect(showWindowWithoutStealingFocus).toHaveBeenCalledWith(windows[0])
+      expect(state.desktopActivationGate?.getState()).toBe('ready')
+    }
+  )
+
+  it('does not replay an activation when launch fails before the startup window', async () => {
+    launchHooks.duringInstallDirRepair = () => state.desktopActivationGate?.requestActivation()
+    launchHooks.failBeforeWindow = true
+
+    await expect(
+      initializeMainProcessReady({
+        // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the launch only calls once() on the returned window.
+        openMainWindow: () => openMainWindow() as unknown as NonNullable<typeof state.mainWindow>,
+        handleMacAppActivation: vi.fn()
+      })
+    ).rejects.toThrow('install-dir repair failed')
+
+    expect(windows).toHaveLength(0)
+    expect(state.desktopActivationGate).toBeNull()
+  })
+
+  it('holds every launch mode behind the gate until startup settles it', () => {
+    const preflightSource = readFileSync(
+      join(process.cwd(), 'src/main/startup/main-process-preflight.ts'),
+      'utf8'
+    )
+    expect(preflightSource).toContain("initialState: 'initializing',")
+    expect(preflightSource).not.toContain(
+      "initialState: state.isServeMode ? 'initializing' : 'ready'"
+    )
+  })
+})
diff --git a/src/main/startup/main-process-runtime-launch.ts b/src/main/startup/main-process-runtime-launch.ts
index 858c6b757867..b3df23e5861c 100644
--- a/src/main/startup/main-process-runtime-launch.ts
+++ b/src/main/startup/main-process-runtime-launch.ts
@@ -208,7 +208,7 @@ async function launchServeMode(
   state.automations?.start()
   // Why: serve deletes worktrees too, and the history GC that normally drains delete tombstones is
   // armed from the main window — without this, a quit mid-removal leaks the tree until a desktop launch.
-  scheduleAllPendingHistoryTreeRemovals()
+  void scheduleAllPendingHistoryTreeRemovals()
   emitServeBrowserIdentityActionLine(getBrowserIdentityModeStatus())
   await printServeReady(serveOptions)
 }
diff --git a/src/main/startup/main-process-state.ts b/src/main/startup/main-process-state.ts
index 49f86136e895..f6e86423029e 100644
--- a/src/main/startup/main-process-state.ts
+++ b/src/main/startup/main-process-state.ts
@@ -45,6 +45,23 @@ import {
 } from '../crash-reporting/gpu-crash-fallback-decision'
 import type { GpuCrashDiagnosticsRecorder } from '../crash-reporting/gpu-crash-diagnostics'
 import { createWebContentsTimedFlag } from './web-contents-timed-flag'
+import type { ProfileStateStorageClassification } from '../persistence/profile-state/profile-state-storage-classification'
+import type { ProfileStateRuntimeAdmission } from '../persistence/profile-state/profile-state-access'
+
+export type ProfileStateStartupMetadata = {
+  backend: 'sqlite'
+  classification: ProfileStateStorageClassification
+  runtime: 'desktop' | 'orcad'
+  migrated: boolean
+}
+
+function createInitialProfileStateStartup(): ProfileStateStartupMetadata | null {
+  return null
+}
+
+function createInitialProfileStateAdmission(): ProfileStateRuntimeAdmission | undefined {
+  return undefined
+}
 
 /** Mutable composition-root state shared by startup, window, serve, and quit phases. */
 export const mainProcessState = {
@@ -52,6 +69,8 @@ export const mainProcessState = {
   /** Whether a manual app.quit() (Cmd+Q) is in progress; lets the close handler skip the running-process confirmation and go straight to close. */
   isQuitting: false,
   store: null as Store | null,
+  profileStateStartup: createInitialProfileStateStartup(),
+  profileStateAdmission: createInitialProfileStateAdmission(),
   stats: null as StatsCollector | null,
   claudeUsage: null as ClaudeUsageStore | null,
   codexUsage: null as CodexUsageStore | null,
diff --git a/src/main/startup/main-window-core-services.test.ts b/src/main/startup/main-window-core-services.test.ts
new file mode 100644
index 000000000000..50d0bd49db53
--- /dev/null
+++ b/src/main/startup/main-window-core-services.test.ts
@@ -0,0 +1,114 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const {
+  attachMainWindowServicesMock,
+  initTccPromptNoticeMock,
+  preserveAgentAuthBeforeRestartMock,
+  registerCoreHandlersMock,
+  state,
+  store
+} = vi.hoisted(() => {
+  const store = {
+    writeLatestProfileStateJsonCompatibilityExportAsync: vi.fn(async () => {}),
+    writeLatestProfileStateJsonExportAsync: vi.fn(async () => {}),
+    getSettings: vi.fn(() => ({}))
+  }
+  return {
+    attachMainWindowServicesMock: vi.fn(),
+    initTccPromptNoticeMock: vi.fn(),
+    preserveAgentAuthBeforeRestartMock: vi.fn(() => Promise.resolve()),
+    registerCoreHandlersMock: vi.fn(),
+    state: {
+      store,
+      runtime: {},
+      stats: {},
+      claudeUsage: {},
+      codexUsage: {},
+      openCodeUsage: {},
+      museUsage: {},
+      codexAccounts: {},
+      claudeAccounts: {},
+      rateLimits: { attach: vi.fn(), start: vi.fn() },
+      automations: { setWebContents: vi.fn(), start: vi.fn() },
+      keybindings: {},
+      codexRuntimeHome: {},
+      claudeRuntimeAuth: { prepareForClaudeLaunch: vi.fn() },
+      agentAwakeService: null,
+      crashReports: null,
+      pluginService: null,
+      pluginMarketplaceService: null,
+      pluginMarketplaceInstaller: null,
+      desktopRelayService: null,
+      isServeMode: false,
+      localPtyStartupReady: Promise.resolve(),
+      localPtyProviderStartupReady: Promise.resolve()
+    },
+    store
+  }
+})
+
+vi.mock('../ipc/register-core-handlers/register-core-handlers', () => ({
+  registerCoreHandlers: registerCoreHandlersMock
+}))
+vi.mock('../window/attach-main-window-services', () => ({
+  attachMainWindowServices: attachMainWindowServicesMock
+}))
+vi.mock('../macos-tcc-prompt-notice', () => ({ initTccPromptNotice: initTccPromptNoticeMock }))
+vi.mock('../updater', () => ({ resolveUpdateInstallMode: vi.fn(() => 'interactive') }))
+vi.mock('./main-process-state', () => ({ mainProcessState: state }))
+vi.mock('../agent-auth-restart-preservation', () => ({
+  preserveAgentAuthBeforeRestart: preserveAgentAuthBeforeRestartMock
+}))
+vi.mock('../codex/codex-ai-vault-session-resume', () => ({
+  prepareCodexAiVaultSessionResume: vi.fn()
+}))
+vi.mock('../codex/codex-session-source-home', () => ({
+  resolveHostCodexSessionSourceHome: vi.fn()
+}))
+vi.mock('./main-process-pty-startup', () => ({
+  emitPluginWorktreeLifecycle: vi.fn(),
+  handleCodexHomePtySpawned: vi.fn(),
+  handlePtyExit: vi.fn()
+}))
+vi.mock('./codex-launch-preparation', () => ({ prepareCodexRuntimeHomeForLaunch: vi.fn() }))
+vi.mock('./codex-session-resume-launch', () => ({ prepareCodexSessionResumeForLaunch: vi.fn() }))
+vi.mock('./main-window-lifecycle-flags', () => ({ isRecoveryReloadInFlight: vi.fn() }))
+
+const { attachMainWindowCoreServices } = await import('./main-window-core-services')
+
+describe('main window profile-state update preparation', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+  })
+
+  it('publishes both recovery forms with one profile checkpoint before an update quit', async () => {
+    const window = { webContents: { id: 17 } }
+
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: mocked BrowserWindow only needs webContents for this composition-root wiring test.
+    attachMainWindowCoreServices(window as never, {
+      markExpectedRendererReload: vi.fn(),
+      recordRendererReload: vi.fn()
+    })
+
+    const options = attachMainWindowServicesMock.mock.calls[0]?.[5]
+    if (
+      typeof options !== 'object' ||
+      options === null ||
+      !('onBeforeUpdateQuit' in options) ||
+      typeof options.onBeforeUpdateQuit !== 'function'
+    ) {
+      throw new Error('Expected update quit cleanup to be wired')
+    }
+
+    await options.onBeforeUpdateQuit()
+
+    expect(preserveAgentAuthBeforeRestartMock).toHaveBeenCalledWith({
+      codexRuntimeHome: state.codexRuntimeHome,
+      claudeRuntimeAuth: state.claudeRuntimeAuth,
+      store
+    })
+    expect(store.writeLatestProfileStateJsonExportAsync).not.toHaveBeenCalled()
+    expect(store.writeLatestProfileStateJsonCompatibilityExportAsync).toHaveBeenCalledOnce()
+    expect(options).toHaveProperty('onBeforeUpdateQuitFailure', 'abort')
+  })
+})
diff --git a/src/main/startup/main-window-core-services.ts b/src/main/startup/main-window-core-services.ts
index 8f9ef2118dfc..c292a4455c7c 100644
--- a/src/main/startup/main-window-core-services.ts
+++ b/src/main/startup/main-window-core-services.ts
@@ -126,8 +126,11 @@ export function attachMainWindowCoreServices(
       isRecoveryReloadInFlight,
       onCodexHomePtySpawned: handleCodexHomePtySpawned,
       onPtyExit: handlePtyExit,
-      onBeforeUpdateQuit: () =>
-        preserveAgentAuthBeforeRestart({ codexRuntimeHome, claudeRuntimeAuth, store }),
+      onBeforeUpdateQuit: async () => {
+        await preserveAgentAuthBeforeRestart({ codexRuntimeHome, claudeRuntimeAuth, store })
+        await store.writeLatestProfileStateJsonCompatibilityExportAsync()
+      },
+      onBeforeUpdateQuitFailure: 'abort',
       updateInstallMode: resolveUpdateInstallMode(state.isServeMode),
       onWorktreeLifecycle: emitPluginWorktreeLifecycle
     }
diff --git a/src/main/startup/pre-gone-crash-sampling-wiring.test.ts b/src/main/startup/pre-gone-crash-sampling-wiring.test.ts
index 2a8e008c0b3d..292645f874f3 100644
--- a/src/main/startup/pre-gone-crash-sampling-wiring.test.ts
+++ b/src/main/startup/pre-gone-crash-sampling-wiring.test.ts
@@ -44,6 +44,8 @@ describe('pre-gone crash sampling startup wiring', () => {
     expect(readySource).toContain(
       "import { initializeReadyRuntimeServices } from './main-process-ready-runtime'"
     )
-    expect(readySource).toContain('\n  await initializeReadyRuntimeServices()')
+    expect(readySource).toContain(
+      'try {\n    await initializeReadyFoundation()\n    await initializeReadyRuntimeServices()'
+    )
   })
 })
diff --git a/src/main/startup/profile-state-recovery-preflight.test.ts b/src/main/startup/profile-state-recovery-preflight.test.ts
new file mode 100644
index 000000000000..0170025ff217
--- /dev/null
+++ b/src/main/startup/profile-state-recovery-preflight.test.ts
@@ -0,0 +1,342 @@
+import type * as NodeFs from 'node:fs'
+import {
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  realpathSync,
+  rmSync,
+  writeFileSync
+} from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import {
+  PROFILE_STATE_DESKTOP_RECOVERY_FLAG,
+  PROFILE_STATE_RECOVERY_FLAG,
+  PROFILE_STATE_RECOVERY_RESULT_PREFIX
+} from '../../shared/profile-state-recovery-command'
+import { acquireProfileStateRuntimeAdmission } from '../persistence/profile-state/profile-state-access'
+import { profileStateJsonExportPath } from '../persistence/profile-state/legacy-json/profile-state-export-path'
+import {
+  createProfileStateDatabaseBackupId,
+  profileStateDatabaseBackupPath
+} from '../persistence/profile-state/profile-state-backup-path'
+import {
+  openProfileStateDatabase,
+  openProfileStateDatabaseReadOnly
+} from '../persistence/profile-state/profile-state-database'
+import {
+  importProfileStateJson,
+  readProfileStateSnapshot
+} from '../persistence/profile-state/profile-state-documents'
+import { writeProfileStateDatabaseSnapshotAsync } from '../persistence/profile-state/profile-state-database-snapshot'
+import * as marker from './http1-compatibility-marker'
+import {
+  profileStateDesktopRecoveryArgs,
+  runProfileStateRecoveryPreflight
+} from './profile-state-recovery-preflight'
+
+const mocks = vi.hoisted(() => ({
+  setPath: vi.fn(),
+  requestSingleInstanceLock: vi.fn(),
+  on: vi.fn(),
+  exit: vi.fn(),
+  relaunch: vi.fn(),
+  whenReady: vi.fn(),
+  showMessageBox: vi.fn(),
+  background: vi.fn(),
+  output: vi.fn()
+}))
+vi.mock('electron', () => ({
+  app: mocks,
+  dialog: { showMessageBox: mocks.showMessageBox }
+}))
+vi.mock('../window/foreground-activation-policy', () => ({
+  applyBackgroundActivationPolicy: mocks.background
+}))
+vi.mock('node:fs', async (original) => {
+  const fs = await original<typeof NodeFs>()
+  return {
+    ...fs,
+    writeFileSync: (...args: Parameters<typeof fs.writeFileSync>) => {
+      if (args[0] === 1) {
+        mocks.output(args[1])
+        return
+      }
+      return fs.writeFileSync(...args)
+    }
+  }
+})
+
+const roots: string[] = []
+beforeEach(() => {
+  vi.clearAllMocks()
+  mocks.requestSingleInstanceLock.mockReturnValue(true)
+  mocks.whenReady.mockResolvedValue(undefined)
+  mocks.showMessageBox.mockResolvedValue({ response: 0 })
+  vi.stubEnv('ORCA_USER_DATA_PATH', '/stale/inherited/root')
+  vi.stubEnv('ORCA_BYPASS_SINGLE_INSTANCE_LOCK', '1')
+  vi.stubEnv('ORCA_E2E_ENFORCE_SINGLE_INSTANCE_LOCK', '0')
+})
+afterEach(() => {
+  vi.restoreAllMocks()
+  vi.unstubAllEnvs()
+  for (const root of roots.splice(0)) {
+    rmSync(root, { recursive: true, force: true })
+  }
+})
+
+function fixture() {
+  const root = realpathSync(mkdtempSync(join(tmpdir(), 'orca-recovery-bridge-')))
+  roots.push(root)
+  const profileId = 'bridge-profile'
+  const directory = join(root, 'profiles', profileId)
+  mkdirSync(directory, { recursive: true })
+  writeFileSync(
+    join(root, 'orca-profile-index.json'),
+    JSON.stringify({ activeProfileId: profileId, profiles: [{ id: profileId }] })
+  )
+  const dataFile = join(directory, 'orca-data.json')
+  const databaseFile = join(directory, 'profile-state.db')
+  const exportFile = profileStateJsonExportPath(dataFile, 1)
+  const restored = {
+    settings: { electronHttp1CompatibilityMode: true },
+    unknown: { sealed: 'unchanged', missing: null }
+  }
+  writeFileSync(dataFile, JSON.stringify({ old: true }))
+  writeFileSync(databaseFile, 'broken database')
+  writeFileSync(exportFile, JSON.stringify(restored))
+  const argv = [
+    'Orca',
+    '--serve',
+    PROFILE_STATE_RECOVERY_FLAG,
+    JSON.stringify({ userDataPath: root, selector: { kind: 'json', revision: 1 } })
+  ]
+  return { root, profileId, dataFile, databaseFile, exportFile, restored, argv }
+}
+
+function response(): unknown {
+  const output: unknown = mocks.output.mock.calls[0]?.[0]
+  expect(typeof output).toBe('string')
+  if (typeof output !== 'string') {
+    throw new Error('Missing response')
+  }
+  return JSON.parse(output.slice(PROFILE_STATE_RECOVERY_RESULT_PREFIX.length))
+}
+
+describe('Electron recovery preflight', () => {
+  it('runs the recovery branch before CLI redirect or ordinary startup admission', () => {
+    const source = readFileSync(
+      join(process.cwd(), 'src/main/startup/main-process-preflight.ts'),
+      'utf8'
+    )
+    const start = source.indexOf('export function runMainProcessPreflight(')
+    const recovery = source.indexOf('if (runProfileStateRecoveryPreflight())', start)
+    const redirect = source.indexOf('const cliLaunchRedirect = maybeRedirectCliLaunch(', start)
+    const admission = source.indexOf('acquireProfileStateRuntimeAdmission(', start)
+    expect(start).toBeGreaterThanOrEqual(0)
+    expect(recovery).toBeGreaterThan(start)
+    expect(redirect).toBeGreaterThan(recovery)
+    expect(admission).toBeGreaterThan(redirect)
+    expect(source.slice(recovery, redirect)).toContain('return false')
+  })
+
+  it('leaves ordinary startup untouched', () => {
+    expect(runProfileStateRecoveryPreflight(['Orca', '--serve'])).toBe(false)
+    expect(mocks.background).not.toHaveBeenCalled()
+    expect(mocks.setPath).not.toHaveBeenCalled()
+    expect(mocks.exit).not.toHaveBeenCalled()
+  })
+
+  it.each(['json', 'current-json'] as const)(
+    'restores %s under both locks despite ordinary singleton bypasses',
+    (kind) => {
+      const item = fixture()
+      if (kind === 'current-json') {
+        writeFileSync(item.dataFile, JSON.stringify(item.restored))
+        item.argv[3] = JSON.stringify({ userDataPath: item.root, selector: { kind } })
+      }
+      mocks.requestSingleInstanceLock.mockImplementation(() => {
+        expect(mocks.setPath).toHaveBeenCalledWith('userData', item.root)
+        expect(() => acquireProfileStateRuntimeAdmission(item.root)).toThrow()
+        expect(readFileSync(item.databaseFile, 'utf8')).toBe('broken database')
+        return true
+      })
+      expect(runProfileStateRecoveryPreflight(item.argv)).toBe(true)
+      expect(process.env.ORCA_USER_DATA_PATH).toBe(item.root)
+      expect(process.env.ORCA_BACKGROUND_LAUNCH).toBe('1')
+      expect(mocks.background).toHaveBeenCalledOnce()
+      expect(mocks.requestSingleInstanceLock).toHaveBeenCalledOnce()
+      expect(response()).toMatchObject({
+        ok: true,
+        result: {
+          storage: 'json',
+          revision: kind === 'json' ? 1 : null,
+          restoredPath: item.dataFile
+        }
+      })
+      expect(JSON.parse(readFileSync(item.dataFile, 'utf8'))).toEqual(item.restored)
+      expect(existsSync(item.databaseFile)).toBe(false)
+      expect(existsSync(item.exportFile)).toBe(false)
+      expect(mocks.exit).toHaveBeenCalledWith(0)
+      const runtime = acquireProfileStateRuntimeAdmission(item.root)
+      runtime.release()
+    }
+  )
+
+  it('refuses an old native singleton owner without modifying authority or exports', () => {
+    const item = fixture()
+    mocks.requestSingleInstanceLock.mockReturnValue(false)
+    expect(runProfileStateRecoveryPreflight(item.argv)).toBe(true)
+    expect(response()).toMatchObject({
+      ok: false,
+      code: 'runtime_error',
+      message: expect.stringContaining('Stop Orca')
+    })
+    expect(readFileSync(item.databaseFile, 'utf8')).toBe('broken database')
+    expect(JSON.parse(readFileSync(item.dataFile, 'utf8'))).toEqual({ old: true })
+    expect(existsSync(item.exportFile)).toBe(true)
+    expect(mocks.exit).toHaveBeenCalledWith(1)
+    const runtime = acquireProfileStateRuntimeAdmission(item.root)
+    runtime.release()
+  })
+
+  it('exits quietly when the CLI closes its response pipe after a successful restore', () => {
+    const item = fixture()
+    mocks.output.mockImplementationOnce(() => {
+      throw new Error('EPIPE')
+    })
+    expect(() => runProfileStateRecoveryPreflight(item.argv)).not.toThrow()
+    expect(JSON.parse(readFileSync(item.dataFile, 'utf8'))).toEqual(item.restored)
+    expect(mocks.exit).toHaveBeenCalledWith(1)
+    const runtime = acquireProfileStateRuntimeAdmission(item.root)
+    runtime.release()
+  })
+
+  it('restores a real SQLite backup and retains root exclusion through marker publication', async () => {
+    const item = fixture()
+    rmSync(item.databaseFile)
+    const source = openProfileStateDatabase(item.databaseFile, item.profileId)
+    const backupId = createProfileStateDatabaseBackupId()
+    const backupFile = profileStateDatabaseBackupPath(item.databaseFile, backupId)
+    try {
+      importProfileStateJson(source.db, JSON.stringify(item.restored))
+      await writeProfileStateDatabaseSnapshotAsync(source.db, backupFile)
+      importProfileStateJson(source.db, JSON.stringify({ newer: true }), { expectedRevision: 1 })
+    } finally {
+      source.db.close()
+    }
+    const markerWrite = marker.writeHttp1CompatibilityMarker
+    const write = vi
+      .spyOn(marker, 'writeHttp1CompatibilityMarker')
+      .mockImplementation((...args) => {
+        expect(() => acquireProfileStateRuntimeAdmission(item.root)).toThrow()
+        expect(mocks.requestSingleInstanceLock).toHaveBeenCalledOnce()
+        markerWrite(...args)
+      })
+    const argv = [
+      'Orca',
+      '--serve',
+      PROFILE_STATE_RECOVERY_FLAG,
+      JSON.stringify({ userDataPath: item.root, selector: { kind: 'sqlite', backupId } })
+    ]
+    expect(runProfileStateRecoveryPreflight(argv)).toBe(true)
+    expect(response()).toMatchObject({
+      ok: true,
+      result: { storage: 'sqlite', backupId, revision: 1 }
+    })
+    expect(write).toHaveBeenCalledWith(item.root, true, item.profileId)
+    expect(existsSync(item.dataFile)).toBe(false)
+    expect(existsSync(backupFile)).toBe(true)
+    const restored = openProfileStateDatabaseReadOnly(item.databaseFile, item.profileId)
+    try {
+      expect(JSON.parse(readProfileStateSnapshot(restored.db).json)).toEqual(item.restored)
+    } finally {
+      restored.db.close()
+    }
+    expect(mocks.exit).toHaveBeenCalledWith(0)
+  })
+
+  it('refuses a participating Node runtime before asking for the Electron lock', () => {
+    const item = fixture()
+    const runtime = acquireProfileStateRuntimeAdmission(item.root)
+    try {
+      expect(runProfileStateRecoveryPreflight(item.argv)).toBe(true)
+      expect(response()).toMatchObject({ ok: false, code: 'runtime_error' })
+      expect(mocks.requestSingleInstanceLock).not.toHaveBeenCalled()
+      expect(existsSync(item.exportFile)).toBe(true)
+    } finally {
+      runtime.release()
+    }
+  })
+
+  it.each([
+    ['Orca', PROFILE_STATE_RECOVERY_FLAG, '{}'],
+    ['Orca', '--serve', PROFILE_STATE_RECOVERY_FLAG],
+    ['Orca', '--serve', PROFILE_STATE_RECOVERY_FLAG, '{}'],
+    [
+      'Orca',
+      '--serve',
+      PROFILE_STATE_RECOVERY_FLAG,
+      JSON.stringify({ userDataPath: 'relative', selector: { kind: 'json', revision: 1 } })
+    ],
+    ['Orca', '--serve', PROFILE_STATE_RECOVERY_FLAG, '{}', PROFILE_STATE_RECOVERY_FLAG, '{}']
+  ])('fails closed for malformed launch %j', (...argv) => {
+    expect(runProfileStateRecoveryPreflight(argv)).toBe(true)
+    expect(response()).toMatchObject({ ok: false })
+    expect(mocks.setPath).not.toHaveBeenCalled()
+    expect(mocks.requestSingleInstanceLock).not.toHaveBeenCalled()
+    expect(mocks.exit).toHaveBeenCalledWith(1)
+  })
+
+  describe('desktop choice relaunch', () => {
+    function desktopArgv(item: ReturnType<typeof fixture>) {
+      writeFileSync(item.dataFile, JSON.stringify(item.restored))
+      return [
+        'Orca',
+        ...profileStateDesktopRecoveryArgs(['Orca', '--inspect', 'orca://share/1'], {
+          userDataPath: item.root,
+          selector: { kind: 'current-json' }
+        })
+      ]
+    }
+
+    it('applies the choice without writing a CLI response, then relaunches ordinary startup', () => {
+      const item = fixture()
+      expect(runProfileStateRecoveryPreflight(desktopArgv(item))).toBe(true)
+      expect(JSON.parse(readFileSync(item.dataFile, 'utf8'))).toEqual(item.restored)
+      expect(existsSync(item.databaseFile)).toBe(false)
+      expect(mocks.output).not.toHaveBeenCalled()
+      expect(mocks.background).not.toHaveBeenCalled()
+      expect(mocks.relaunch).toHaveBeenCalledWith({ args: ['--inspect', 'orca://share/1'] })
+      expect(mocks.exit).toHaveBeenCalledWith(0)
+      acquireProfileStateRuntimeAdmission(item.root).release()
+    })
+
+    it('reports a failed choice instead of relaunching', async () => {
+      const item = fixture()
+      mocks.requestSingleInstanceLock.mockReturnValue(false)
+      vi.spyOn(console, 'error').mockImplementation(() => {})
+      expect(runProfileStateRecoveryPreflight(desktopArgv(item))).toBe(true)
+      await vi.waitFor(() => expect(mocks.exit).toHaveBeenCalledWith(1))
+      expect(mocks.relaunch).not.toHaveBeenCalled()
+      expect(mocks.showMessageBox).toHaveBeenCalledWith(
+        expect.objectContaining({ detail: expect.stringContaining('Stop Orca') })
+      )
+      expect(readFileSync(item.databaseFile, 'utf8')).toBe('broken database')
+    })
+
+    it.each([
+      ['Orca', PROFILE_STATE_DESKTOP_RECOVERY_FLAG, '{}'],
+      ['Orca', '--serve', PROFILE_STATE_DESKTOP_RECOVERY_FLAG, '{}'],
+      ['Orca', PROFILE_STATE_DESKTOP_RECOVERY_FLAG, '{}', PROFILE_STATE_RECOVERY_FLAG, '{}']
+    ])('fails closed for malformed desktop launch %j', async (...argv) => {
+      vi.spyOn(console, 'error').mockImplementation(() => {})
+      expect(runProfileStateRecoveryPreflight(argv)).toBe(true)
+      await vi.waitFor(() => expect(mocks.exit).toHaveBeenCalledWith(1))
+      expect(mocks.setPath).not.toHaveBeenCalled()
+      expect(mocks.relaunch).not.toHaveBeenCalled()
+    })
+  })
+})
diff --git a/src/main/startup/profile-state-recovery-preflight.ts b/src/main/startup/profile-state-recovery-preflight.ts
new file mode 100644
index 000000000000..7629f6241b9b
--- /dev/null
+++ b/src/main/startup/profile-state-recovery-preflight.ts
@@ -0,0 +1,151 @@
+import { writeFileSync, realpathSync } from 'node:fs'
+import { isAbsolute } from 'node:path'
+import { app, dialog } from 'electron'
+import {
+  PROFILE_STATE_DESKTOP_RECOVERY_FLAG,
+  PROFILE_STATE_RECOVERY_FLAG,
+  PROFILE_STATE_RECOVERY_RESULT_PREFIX,
+  ProfileStateRecoveryCommandError,
+  isProfileStateRecoveryCommandError,
+  profileStateRecoveryRequestSchema,
+  type ProfileStateRecoveryResponse
+} from '../../shared/profile-state-recovery-command'
+import { acquireProfileStateMaintenance } from '../persistence/profile-state/profile-state-access'
+import { rollbackProfileState } from '../persistence/profile-state/profile-state-recovery-command'
+import { applyBackgroundActivationPolicy } from '../window/foreground-activation-policy'
+import { acquireSingleInstanceLock } from './single-instance-lock'
+
+/** The process owning both locks performs recovery before Electron can initialize a runtime. */
+export function runProfileStateRecoveryPreflight(argv: readonly string[] = process.argv): boolean {
+  if (argv.includes(PROFILE_STATE_DESKTOP_RECOVERY_FLAG)) {
+    runDesktopRecovery(argv)
+    return true
+  }
+  const index = argv.indexOf(PROFILE_STATE_RECOVERY_FLAG)
+  if (index === -1) {
+    return false
+  }
+  process.env.ORCA_BACKGROUND_LAUNCH = '1'
+  applyBackgroundActivationPolicy()
+  const response =
+    !argv.includes('--serve') || argv.lastIndexOf(PROFILE_STATE_RECOVERY_FLAG) !== index
+      ? invalidLaunch()
+      : runRecoveryRequest(argv[index + 1])
+  let exitCode = response.ok ? 0 : 1
+  try {
+    writeFileSync(1, `${PROFILE_STATE_RECOVERY_RESULT_PREFIX}${JSON.stringify(response)}\n`)
+  } catch {
+    // The CLI may have exited while recovery held the locks; never open an Electron error dialog.
+    exitCode = 1
+  }
+  app.exit(exitCode)
+  return true
+}
+
+/** Build the relaunch argv that applies a startup-dialog choice before ordinary startup. */
+export function profileStateDesktopRecoveryArgs(
+  argv: readonly string[],
+  request: { userDataPath: string; selector: { kind: 'current-json' | 'current-sqlite' } }
+): string[] {
+  return [
+    ...stripRecoveryArgs(argv.slice(1)),
+    PROFILE_STATE_DESKTOP_RECOVERY_FLAG,
+    JSON.stringify(request)
+  ]
+}
+
+function runDesktopRecovery(argv: readonly string[]): void {
+  const index = argv.indexOf(PROFILE_STATE_DESKTOP_RECOVERY_FLAG)
+  const response =
+    argv.lastIndexOf(PROFILE_STATE_DESKTOP_RECOVERY_FLAG) !== index ||
+    argv.includes(PROFILE_STATE_RECOVERY_FLAG) ||
+    argv.includes('--serve')
+      ? invalidLaunch()
+      : runRecoveryRequest(argv[index + 1])
+  if (response.ok) {
+    // Why relaunch: ordinary startup must run in a process that never held maintenance.
+    app.relaunch({ args: stripRecoveryArgs(argv.slice(1)) })
+    app.exit(0)
+    return
+  }
+  console.error(`[profile-state] Desktop recovery failed: ${response.message}`)
+  void app
+    .whenReady()
+    .then(() =>
+      dialog.showMessageBox({
+        type: 'error',
+        buttons: ['Quit'],
+        title: 'Orca profile state was not changed',
+        message: 'Orca could not apply the selected profile state.',
+        detail: `${response.message}\n\nReopen Orca to choose again.`
+      })
+    )
+    .catch((error: unknown) => console.warn('[profile-state] Recovery error dialog failed:', error))
+    .finally(() => app.exit(1))
+}
+
+function runRecoveryRequest(payload: string | undefined): ProfileStateRecoveryResponse {
+  try {
+    let raw: unknown
+    try {
+      raw = JSON.parse(payload ?? '')
+    } catch {
+      raw = undefined
+    }
+    const parsed = profileStateRecoveryRequestSchema.safeParse(raw)
+    if (!parsed.success || !isAbsolute(parsed.data.userDataPath)) {
+      throw new ProfileStateRecoveryCommandError(
+        'invalid_argument',
+        'Invalid profile-state recovery request.'
+      )
+    }
+    const userDataPath = realpathSync(parsed.data.userDataPath)
+    app.setPath('userData', userDataPath)
+    process.env.ORCA_USER_DATA_PATH = userDataPath
+    const maintenance = acquireProfileStateMaintenance(userDataPath)
+    try {
+      // Force Electron's lock even when ordinary dev or diagnostic launches would bypass it.
+      if (!acquireSingleInstanceLock(app, () => {})) {
+        throw new ProfileStateRecoveryCommandError(
+          'runtime_error',
+          'Stop Orca before profile-state rollback so no process can write the SQLite database.'
+        )
+      }
+      return {
+        ok: true,
+        result: rollbackProfileState(userDataPath, parsed.data.selector, maintenance)
+      }
+    } finally {
+      maintenance.release()
+    }
+  } catch (error) {
+    return {
+      ok: false,
+      code: isProfileStateRecoveryCommandError(error) ? error.code : 'runtime_error',
+      message: error instanceof Error ? error.message : String(error)
+    }
+  }
+}
+
+function invalidLaunch(): ProfileStateRecoveryResponse {
+  return {
+    ok: false,
+    code: 'invalid_argument',
+    message: 'Invalid profile-state recovery launch.'
+  }
+}
+
+function stripRecoveryArgs(args: readonly string[]): string[] {
+  const kept: string[] = []
+  for (let i = 0; i < args.length; i++) {
+    if (
+      args[i] === PROFILE_STATE_DESKTOP_RECOVERY_FLAG ||
+      args[i] === PROFILE_STATE_RECOVERY_FLAG
+    ) {
+      i++
+      continue
+    }
+    kept.push(args[i])
+  }
+  return kept
+}
diff --git a/src/main/startup/profile-state-write-failure.test.ts b/src/main/startup/profile-state-write-failure.test.ts
new file mode 100644
index 000000000000..b434b3ca5730
--- /dev/null
+++ b/src/main/startup/profile-state-write-failure.test.ts
@@ -0,0 +1,53 @@
+import { afterEach, beforeEach, expect, it, vi } from 'vitest'
+import { reportProfileStateWriteFailure } from './profile-state-write-failure'
+
+const fixture = vi.hoisted(() => ({
+  show: vi.fn(),
+  background: false,
+  state: { isServeMode: false }
+}))
+vi.mock('electron', () => ({ dialog: { showMessageBox: fixture.show } }))
+vi.mock('../window/foreground-activation-policy', () => ({
+  isBackgroundLaunch: () => fixture.background
+}))
+vi.mock('./main-process-state', () => ({ mainProcessState: fixture.state }))
+
+beforeEach(() => {
+  fixture.background = false
+  fixture.state.isServeMode = false
+  fixture.show.mockResolvedValue({ response: 0 })
+  vi.spyOn(console, 'error').mockImplementation(() => {})
+  vi.spyOn(console, 'warn').mockImplementation(() => {})
+})
+afterEach(() => {
+  vi.restoreAllMocks()
+  vi.clearAllMocks()
+})
+
+it('tells desktop users saving stopped without silently restarting the writer', () => {
+  reportProfileStateWriteFailure(new Error('worker exited'))
+  expect(fixture.show).toHaveBeenCalledExactlyOnceWith({
+    type: 'error',
+    title: 'Saving stopped',
+    message: 'Orca has stopped saving this profile.',
+    detail: 'Recent changes may not be saved. Restart Orca before continuing.',
+    buttons: ['OK']
+  })
+})
+
+it.each(['background', 'serve'])('keeps %s runs free of native dialogs', (mode) => {
+  fixture.background = mode === 'background'
+  fixture.state.isServeMode = mode === 'serve'
+  reportProfileStateWriteFailure(new Error('worker exited'))
+  expect(fixture.show).not.toHaveBeenCalled()
+  expect(console.error).toHaveBeenCalledWith(
+    expect.stringContaining('stopped saving'),
+    expect.any(Error)
+  )
+})
+
+it('handles a failed dialog without an unhandled rejection', async () => {
+  fixture.show.mockRejectedValue(new Error('window system unavailable'))
+  reportProfileStateWriteFailure(new Error('worker exited'))
+  await vi.waitFor(() => expect(console.warn).toHaveBeenCalled())
+})
diff --git a/src/main/startup/profile-state-write-failure.ts b/src/main/startup/profile-state-write-failure.ts
new file mode 100644
index 000000000000..81668513ba64
--- /dev/null
+++ b/src/main/startup/profile-state-write-failure.ts
@@ -0,0 +1,18 @@
+import { dialog } from 'electron'
+import { isBackgroundLaunch } from '../window/foreground-activation-policy'
+import { mainProcessState } from './main-process-state'
+
+/** Report a retired writer without treating unacknowledged state as safe to overwrite. */
+export function reportProfileStateWriteFailure(error: Error): void {
+  const message = 'Orca has stopped saving this profile.'
+  const detail = 'Recent changes may not be saved. Restart Orca before continuing.'
+  console.error(`[persistence] ${message} ${detail}`, error)
+  if (mainProcessState.isServeMode || isBackgroundLaunch()) {
+    return
+  }
+  void dialog
+    .showMessageBox({ type: 'error', title: 'Saving stopped', message, detail, buttons: ['OK'] })
+    .catch((dialogError) =>
+      console.warn('[persistence] Could not show saving failure:', dialogError)
+    )
+}
diff --git a/src/main/startup/serve-desktop-activation.ts b/src/main/startup/serve-desktop-activation.ts
index 2b7ad5208916..0034c8859e06 100644
--- a/src/main/startup/serve-desktop-activation.ts
+++ b/src/main/startup/serve-desktop-activation.ts
@@ -27,6 +27,21 @@ export function settleServeDesktopActivation(
   gate.markReady()
 }
 
+/**
+ * Wraps the desktop startup-window opener so activations queued since preflight are let through
+ * only once that window exists: they then focus it, where earlier they would open a duplicate.
+ */
+export function releaseDesktopActivationAfter<TArgs extends unknown[], TResult>(
+  gate: ServeDesktopActivationGate | null,
+  open: (...args: TArgs) => TResult
+): (...args: TArgs) => TResult {
+  return (...args) => {
+    const result = open(...args)
+    gate?.markReady()
+    return result
+  }
+}
+
 export function createServeDesktopActivationGate(options: {
   initialState: 'initializing' | 'ready'
   activateWindow: () => void
diff --git a/src/main/startup/startup-diagnostics.test.ts b/src/main/startup/startup-diagnostics.test.ts
index dcf7a4237b3a..4ba75269d6c4 100644
--- a/src/main/startup/startup-diagnostics.test.ts
+++ b/src/main/startup/startup-diagnostics.test.ts
@@ -1,11 +1,24 @@
-import { describe, expect, it, vi } from 'vitest'
+import { afterEach, describe, expect, it, vi } from 'vitest'
 import {
   isStartupDiagnosticsEnabled,
   logStartupDiagnostic,
+  logStartupMilestone,
   STARTUP_DIAGNOSTICS_ENV,
   writeStartupDiagnosticLine
 } from './startup-diagnostics'
 
+afterEach(() => vi.unstubAllEnvs())
+
+it('does not compute lazy milestone details unless diagnostics are enabled', () => {
+  vi.stubEnv(STARTUP_DIAGNOSTICS_ENV, '0')
+  const details = vi.fn(() => ({ bytes: 123 }))
+  logStartupMilestone('persistence-load-done', details)
+  expect(details).not.toHaveBeenCalled()
+  vi.stubEnv(STARTUP_DIAGNOSTICS_ENV, '1')
+  logStartupMilestone('persistence-load-done', details)
+  expect(details).toHaveBeenCalledOnce()
+})
+
 describe('writeStartupDiagnosticLine', () => {
   it('writes directly to stderr fd 2 with a newline', () => {
     const write = vi.fn()
diff --git a/src/main/startup/startup-diagnostics.ts b/src/main/startup/startup-diagnostics.ts
index d5cd7718d881..dff09612711f 100644
--- a/src/main/startup/startup-diagnostics.ts
+++ b/src/main/startup/startup-diagnostics.ts
@@ -32,8 +32,12 @@ export function logStartupDiagnostic(
 
 // Why: startup benchmarking needs in-process timestamps — harness-side stderr
 // arrival times include pipe buffering jitter. `t` is ms since process start.
-export function logStartupMilestone(event: string, details: Record<string, unknown> = {}): void {
+export function logStartupMilestone(
+  event: string,
+  details: Record<string, unknown> | (() => Record<string, unknown>) = {}
+): void {
   if (isStartupDiagnosticsEnabled()) {
-    logStartupDiagnostic(event, { t: Math.round(performance.now()), ...details })
+    const t = Math.round(performance.now())
+    logStartupDiagnostic(event, { t, ...(typeof details === 'function' ? details() : details) })
   }
 }
diff --git a/src/main/startup/windows-install-dir-acl-probe.test.ts b/src/main/startup/windows-install-dir-acl-probe.test.ts
index da63e35cd777..5e1d67b12d52 100644
--- a/src/main/startup/windows-install-dir-acl-probe.test.ts
+++ b/src/main/startup/windows-install-dir-acl-probe.test.ts
@@ -1,4 +1,7 @@
+import { existsSync } from 'node:fs'
+import { tmpdir } from 'node:os'
 import { join } from 'node:path'
+import type { CrashReportBreadcrumbData } from '../../shared/crash-reporting'
 import { describe, expect, it, beforeEach, vi } from 'vitest'
 import {
   probeWindowsInstallDirAcl,
@@ -6,13 +9,10 @@ import {
   WINDOWS_INSTALL_DIR_ACL_BREADCRUMB,
   type WindowsInstallDirAclProbeOptions
 } from './windows-install-dir-acl-probe'
+import { isInstallDirAclPoisonVerdict } from './windows-install-dir-package-acl-repair'
 import {
   ALL_PACKAGES_ACE,
-  ENGLISH_BASELINE_ACES,
   fakeIcaclsSpawn,
-  FRENCH_BASELINE_ACES,
-  FRENCH_RESTRICTED_PACKAGES_ACE,
-  icaclsDacl,
   ORPHAN_PACKAGE_ACE,
   RESTRICTED_PACKAGES_ACE
 } from './windows-install-dir-acl.test-fixture'
@@ -21,10 +21,6 @@ const INSTALL_DIR = 'C:\\Users\\neil\\AppData\\Local\\Programs\\orca'
 const ORPHAN = ORPHAN_PACKAGE_ACE
 const RESTRICTED_GRANT = RESTRICTED_PACKAGES_ACE
 
-function dacl(target: string, firstAce: string, ...rest: string[]): string {
-  return icaclsDacl(target, [firstAce, ...rest])
-}
-
 const fakeSpawn = fakeIcaclsSpawn
 
 function probe(options: WindowsInstallDirAclProbeOptions): Promise<Record<string, unknown>> {
@@ -44,7 +40,7 @@ function probe(options: WindowsInstallDirAclProbeOptions): Promise<Record<string
 
 /** Every target returns the same ACE set on top of the system baseline. */
 function probeWith(...aces: string[]): Promise<Record<string, unknown>> {
-  return probe({ spawnFn: fakeSpawn((target) => dacl(target, aces[0], ...aces.slice(1))).spawnFn })
+  return probe({ spawnFn: fakeSpawn(() => aces).spawnFn })
 }
 
 describe('probeWindowsInstallDirAcl', () => {
@@ -54,7 +50,7 @@ describe('probeWindowsInstallDirAcl', () => {
 
   it('reports a clean DACL as unpoisoned', async () => {
     const data = await probe({
-      spawnFn: fakeSpawn((target) => icaclsDacl(target, [], ENGLISH_BASELINE_ACES)).spawnFn
+      spawnFn: fakeSpawn(() => []).spawnFn
     })
     expect(data.name).toBe(WINDOWS_INSTALL_DIR_ACL_BREADCRUMB)
     expect(data.status).toBe('ok')
@@ -82,8 +78,8 @@ describe('probeWindowsInstallDirAcl', () => {
   // orphan alongside it launched clean on win32 10.0.26200 / Electron 43.4.1 — so
   // it is not the reproduced state, however useless -1 is to an LPAC token.
   it.each([
-    ['the localized-safe name form', ALL_PACKAGES_ACE],
-    ['the raw SID form', 'S-1-15-2-1:(OI)(CI)(RX)']
+    ['the AC alias', ALL_PACKAGES_ACE],
+    ['the raw SID form', '(A;OICI;0x1200a9;;;S-1-15-2-1)']
   ])('clears the signature when only ALL APPLICATION PACKAGES grants (%s)', async (_l, ace) => {
     const data = await probeWith(ace, ORPHAN)
     expect(data.hasWellKnownPackageGrant).toBe(true)
@@ -94,10 +90,10 @@ describe('probeWindowsInstallDirAcl', () => {
   // The reproduced remedy was an additive *grant*; an ACE that grants nothing on
   // the object cannot satisfy the orphan, so it must not clear the signature.
   it.each([
-    ['deny', 'APPLICATION PACKAGE AUTHORITY\\ALL APPLICATION PACKAGES:(DENY)(OI)(CI)(F)'],
-    ['inherit-only', 'APPLICATION PACKAGE AUTHORITY\\ALL APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE)'],
-    ['raw-sid deny', 'S-1-15-2-2:(DENY)(F)'],
-    ['raw-sid inherit-only', 'S-1-15-2-1:(OI)(CI)(IO)(GR,GE)']
+    ['deny', '(D;OICI;FA;;;AC)'],
+    ['inherit-only', '(A;OICIIO;GRGX;;;AC)'],
+    ['restricted deny', '(D;;FA;;;S-1-15-2-2)'],
+    ['restricted inherit-only', '(A;CIOIIO;GRGX;;;S-1-15-2-2)']
   ])('does not let a %s well-known ACE satisfy an orphan', async (_label, ace) => {
     const data = await probeWith(ace, ORPHAN)
     expect(data.hasWellKnownPackageGrant).toBe(false)
@@ -108,67 +104,131 @@ describe('probeWindowsInstallDirAcl', () => {
   it('does not let a grant on one target mask its absence on another', async () => {
     const data = await probe({
       spawnFn: fakeSpawn((target) =>
-        target.endsWith('ffmpeg.dll')
-          ? dacl(target, ORPHAN)
-          : dacl(target, RESTRICTED_GRANT, ORPHAN)
+        target.endsWith('ffmpeg.dll') ? [ORPHAN] : [RESTRICTED_GRANT, ORPHAN]
       ).spawnFn
     })
     expect(data.hasWellKnownPackageGrant).toBe(true)
     expect(data.matchesPoisonSignature).toBe(true)
   })
 
-  it('reports whether the well-known name check could be trusted', async () => {
-    const english = await probeWith(ORPHAN)
-    expect(english.wellKnownNameCheckReliable).toBe(true)
-    const localized = await new Promise<Record<string, unknown>>((resolve) => {
-      resetWindowsInstallDirAclProbeForTest()
-      probeWindowsInstallDirAcl({
-        platform: 'win32',
-        installDir: INSTALL_DIR,
-        fileExists: () => false,
-        // fr-FR install that already carries the restricted grant: the name check
-        // cannot see it, so the signature is a false positive the flag must expose.
-        spawnFn: fakeSpawn((target) =>
-          icaclsDacl(target, [ORPHAN, FRENCH_RESTRICTED_PACKAGES_ACE], FRENCH_BASELINE_ACES)
-        ).spawnFn,
-        recordBreadcrumb: (_name, d) => {
-          resolve(d as Record<string, unknown>)
-          return undefined
-        }
-      })
+  // zh-CN/ja-JP/ko-KR icacls keeps "NT AUTHORITY" English but translates the package
+  // names and summary. A tree the repair just fixed read as poisoned AND reliable there,
+  // re-arming the pre-window repair and blaming the install on every launch.
+  it('reads a repaired tree as clean when icacls translates package names', async () => {
+    const zhDisplay = (target: string): string =>
+      [
+        `${target} S-1-15-2-999-999-999:(OI)(CI)(RX)`,
+        '    APPLICATION PACKAGE AUTHORITY\\所有受限制的应用程序包:(OI)(CI)(RX)',
+        '    NT AUTHORITY\\SYSTEM:(I)(OI)(CI)(F)',
+        '    BUILTIN\\Administrators:(I)(OI)(CI)(F)',
+        '',
+        '已成功处理 1 个文件; 处理 0 个文件时失败'
+      ].join('\r\n')
+    let verdict: CrashReportBreadcrumbData = {}
+    const data = await probe({
+      spawnFn: fakeSpawn(() => [ORPHAN, RESTRICTED_GRANT], zhDisplay).spawnFn,
+      onDone: (done) => (verdict = done)
     })
-    expect(localized.matchesPoisonSignature).toBe(true)
-    expect(localized.wellKnownNameCheckReliable).toBe(false)
+    expect(isInstallDirAclPoisonVerdict(verdict)).toBe(false)
+    expect(data.status).toBe('ok')
+    expect(data.orphanPackageSidCount).toBe(1)
+    expect(data.hasRestrictedPackageGrant).toBe(true)
   })
 
   it('matches the well-known SIDs exactly, not by prefix', async () => {
-    const data = await probeWith('S-1-15-2-1234567890:(OI)(CI)(RX)')
+    const data = await probeWith('(A;OICI;0x1200a9;;;S-1-15-2-1234567890)')
     expect(data.orphanPackageSidCount).toBe(1)
     expect(data.hasWellKnownPackageGrant).toBe(false)
     expect(data.matchesPoisonSignature).toBe(true)
   })
 
   it('ignores capability SIDs, which are a different family and harmless', async () => {
-    const data = await probeWith('S-1-15-3-65536-599108337-2355189375-1353122160:(S,X)')
+    const data = await probeWith('(A;;0x100020;;;S-1-15-3-65536-599108337-2355189375-1353122160)')
     expect(data.orphanPackageSidCount).toBe(0)
     expect(data.matchesPoisonSignature).toBe(false)
   })
 
   it('probes a content file, not just the directory object', async () => {
-    const fake = fakeSpawn((target) => dacl(target, ORPHAN))
+    const fake = fakeSpawn(() => [ORPHAN])
     await probe({ spawnFn: fake.spawnFn })
     expect(fake.calls.map((c) => c.args[0])).toEqual([INSTALL_DIR, join(INSTALL_DIR, 'ffmpeg.dll')])
   })
 
-  it('never passes a recursive or write flag', async () => {
-    const fake = fakeSpawn((target) => dacl(target, ORPHAN))
+  it('only saves the DACL to a temp file: no recursive or ACL-writing flag', async () => {
+    const fake = fakeSpawn(() => [ORPHAN])
     await probe({ spawnFn: fake.spawnFn })
     for (const call of fake.calls) {
-      expect(call.args).toHaveLength(1)
+      expect(call.args).toHaveLength(3)
       expect(call.args[0]).not.toMatch(/^\//)
+      expect(call.args[1]).toBe('/save')
+      expect(call.args[2].startsWith(tmpdir())).toBe(true)
+      expect(existsSync(call.args[2])).toBe(false)
     }
   })
 
+  // Verbatim `icacls <dir> /save` / `icacls <file> /save` output from win32 10.0.26200.
+  it.each([
+    [
+      'a repaired module file',
+      'ffmpeg.dll\r\nD:AI(A;;0x1200a9;;;S-1-15-2-2)(A;;0x1200a9;;;S-1-15-2-999-999-999)' +
+        '(A;ID;0x1200a9;;;S-1-15-2-999-999-999)(A;ID;FA;;;SY)(A;ID;FA;;;BA)' +
+        '(A;ID;FA;;;S-1-5-21-432636774-4279371817-3971399515-1001)\r\n',
+      false
+    ],
+    [
+      'a poisoned dir whose AC ACE denies',
+      'scan21acl\r\nD:AI(D;;0x100116;;;AC)(A;OICI;0x1200a9;;;S-1-15-2-999-999-999)' +
+        '(A;OICIID;FA;;;SY)(A;OICIID;FA;;;BA)' +
+        '(A;OICIID;FA;;;S-1-5-21-432636774-4279371817-3971399515-1001)\r\n',
+      true
+    ]
+  ])('reads a real icacls /save capture: %s', async (_label, saved, poisoned) => {
+    const data = await probe({
+      fileExists: () => false,
+      spawnFn: fakeSpawn(() => Buffer.from(saved, 'utf16le')).spawnFn
+    })
+    expect(data.orphanPackageSids).toBe('S-1-15-2-999-999-999')
+    expect(data.matchesPoisonSignature).toBe(poisoned)
+  })
+
+  it('keeps a conditional DACL unreadable instead of hiding a later package grant', async () => {
+    const saved =
+      'orca\r\nD:AI(A;OICI;0x1200a9;;;S-1-15-2-999-999-999)' +
+      '(XA;OICI;FA;;;WD;(@User.Department == "Finance"))' +
+      '(A;OICIID;0x1200a9;;;S-1-15-2-2)\r\n'
+    let verdict: CrashReportBreadcrumbData = {}
+    const data = await probe({
+      fileExists: () => false,
+      spawnFn: fakeSpawn(() => Buffer.from(saved, 'utf16le')).spawnFn,
+      onDone: (done) => (verdict = done)
+    })
+    expect(data).toMatchObject({ status: 'failed', reason: 'all-targets-unreadable' })
+    expect(data.matchesPoisonSignature).toBeUndefined()
+    expect(isInstallDirAclPoisonVerdict(verdict)).toBe(false)
+  })
+
+  it.each([1, null])('ignores a saved DACL when icacls exits with %s', async (exitCode) => {
+    const fake = fakeSpawn(() => [ORPHAN], undefined, exitCode)
+    let verdict: CrashReportBreadcrumbData = {}
+    const data = await probe({
+      fileExists: () => false,
+      spawnFn: fake.spawnFn,
+      onDone: (done) => (verdict = done)
+    })
+    expect(data).toMatchObject({ status: 'failed', reason: 'all-targets-unreadable' })
+    expect(isInstallDirAclPoisonVerdict(verdict)).toBe(false)
+    expect(fake.calls.every((call) => !existsSync(call.args[2]))).toBe(true)
+  })
+
+  it('does not report malformed saved output as a clean DACL', async () => {
+    const data = await probe({
+      fileExists: () => false,
+      spawnFn: fakeSpawn(() => Buffer.from('orca\r\n', 'utf16le')).spawnFn
+    })
+    expect(data).toMatchObject({ status: 'failed', reason: 'all-targets-unreadable' })
+    expect(data.matchesPoisonSignature).toBeUndefined()
+  })
+
   it('records a failure instead of throwing when icacls cannot be read', async () => {
     const data = await probe({ spawnFn: fakeSpawn(() => null).spawnFn })
     expect(data.status).toBe('failed')
@@ -180,7 +240,7 @@ describe('probeWindowsInstallDirAcl', () => {
     ['darwin', { platform: 'darwin' as NodeJS.Platform }],
     ['serve mode', { platform: 'win32' as NodeJS.Platform, isServeMode: true }]
   ])('does no work on %s', async (_label, options) => {
-    const fake = fakeSpawn((target) => dacl(target, ORPHAN))
+    const fake = fakeSpawn(() => [ORPHAN])
     const record = vi.fn()
     const fileExists = vi.fn(() => true)
     probeWindowsInstallDirAcl({
@@ -197,7 +257,7 @@ describe('probeWindowsInstallDirAcl', () => {
   })
 
   it('runs once per process', async () => {
-    const fake = fakeSpawn((target) => dacl(target, ORPHAN))
+    const fake = fakeSpawn(() => [ORPHAN])
     await probe({ spawnFn: fake.spawnFn })
     const before = fake.calls.length
     probeWindowsInstallDirAcl({ platform: 'win32', installDir: INSTALL_DIR, spawnFn: fake.spawnFn })
diff --git a/src/main/startup/windows-install-dir-acl-probe.ts b/src/main/startup/windows-install-dir-acl-probe.ts
index 25d1e581c9b8..a717c87c2414 100644
--- a/src/main/startup/windows-install-dir-acl-probe.ts
+++ b/src/main/startup/windows-install-dir-acl-probe.ts
@@ -1,5 +1,7 @@
 import { spawn } from 'node:child_process'
-import { existsSync } from 'node:fs'
+import { randomUUID } from 'node:crypto'
+import { existsSync, readFileSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
 import { dirname, join } from 'node:path'
 import {
   sanitizeCrashReportString,
@@ -36,23 +38,16 @@ const MODULE_SHORTLIST = ['ffmpeg.dll', 'libGLESv2.dll', 'libEGL.dll', 'icudtl.d
 
 const PROBE_BUDGET_MS = 5_000
 
-/** Raw S-1-15-2-* means icacls could not resolve it — locale-independent. */
-const RAW_PACKAGE_SID = /\bS-1-15-2-[0-9-]+\b/i
+// Why SDDL (`icacls /save`) rather than icacls's display: the display localizes
+// the well-known package names — and on zh/ja/ko even keeps "NT AUTHORITY" English
+// while doing so — so a repaired tree read as poisoned. SDDL prints SIDs on every locale.
+const PACKAGE_SID = /^S-1-15-2-[0-9-]+$/i
 /** ALL RESTRICTED APPLICATION PACKAGES: the grant the reproduced remedy added. */
-const RESTRICTED_PACKAGES_SID = 's-1-15-2-2'
-const WELL_KNOWN_PACKAGE_SIDS = new Set(['s-1-15-2-1', RESTRICTED_PACKAGES_SID])
-// icacls localizes these; the raw SID form is never printed for them. Orphan
-// detection stays SID-form and locale-independent, but this check is not — so we
-// report whether the output looked English at all, making a locale-induced
-// false positive recognizable instead of silent.
-const WELL_KNOWN_PACKAGE_NAMES = /ALL (RESTRICTED )?APPLICATION PACKAGES/i
-const RESTRICTED_PACKAGE_NAME = /ALL RESTRICTED APPLICATION PACKAGES/i
-// Not BUILTIN: fr-FR and es-ES print it verbatim while localizing the package
-// names, so it is evidence of nothing. SYSTEM's ACE is on every install tree.
-const ENGLISH_PRINCIPAL = /\b(NT AUTHORITY|APPLICATION PACKAGE AUTHORITY)\b/i
-// Why: an ACE that denies, or only propagates to children, grants nothing on this
-// object — so it cannot satisfy an orphan the way the reproduced fix did.
-const NON_GRANTING_FLAGS = /\((?:DENY|IO)\)/i
+const RESTRICTED_PACKAGES_SID = 'S-1-15-2-2'
+/** `AC` is SDDL's alias for ALL APPLICATION PACKAGES (S-1-15-2-1). */
+const WELL_KNOWN_PACKAGE_SIDS = new Set(['AC', 'S-1-15-2-1', RESTRICTED_PACKAGES_SID])
+/** (type;flags;rights;object;inheritedObject;sid[;condition]) */
+const SDDL_ACE = /\(([A-Z]+);([A-Z]*);[^;()]*;[^;()]*;[^;()]*;([^;()]+)[;)]/gi
 
 export type WindowsInstallDirAclProbeOptions = {
   platform?: NodeJS.Platform
@@ -69,80 +64,80 @@ type AclFacts = {
   orphanPackageSids: string[]
   hasWellKnownPackageGrant: boolean
   hasRestrictedPackageGrant: boolean
-  sawEnglishPrincipal: boolean
 }
 
-function readDacl(spawnFn: typeof spawn, target: string, deadlineMs: number): Promise<string> {
-  return new Promise((resolve) => {
-    // No flags: icacls with a bare path only reads. Never /T — a recursive walk on
-    // a real profile measured 62s and timed out (see windows-user-data-acl.ts).
-    const child = spawnFn(getIcaclsExePath(), [target], {
-      stdio: ['ignore', 'pipe', 'ignore'],
+function readSavedDacl(spawnFn: typeof spawn, target: string, deadlineMs: number): Promise<string> {
+  const saveFile = join(tmpdir(), `orca-install-acl-${randomUUID()}.txt`)
+  return new Promise<string>((resolve) => {
+    // /save only reads the target (it writes the temp file). Never /T — a recursive
+    // walk on a real profile measured 62s and timed out (see windows-user-data-acl.ts).
+    const child = spawnFn(getIcaclsExePath(), [target, '/save', saveFile], {
+      stdio: ['ignore', 'ignore', 'ignore'],
       windowsHide: true
     })
-    let out = ''
     let settled = false
-    const settle = (value: string): void => {
+    const settle = (read: boolean): void => {
       if (settled) {
         return
       }
       settled = true
       clearTimeout(timer)
-      resolve(value)
+      let out = ''
+      try {
+        // An empty read parses as a clean DACL, so a failed /save must stay ''.
+        out = read ? readFileSync(saveFile, 'utf16le') : ''
+      } catch {
+        out = ''
+      }
+      try {
+        // A killed icacls may still hold the file; a leftover temp file is harmless.
+        rmSync(saveFile, { force: true })
+      } catch {
+        // Nothing to do.
+      }
+      resolve(out)
     }
     const timer = setTimeout(() => {
       child.kill()
-      settle('')
+      settle(false)
     }, deadlineMs)
     timer.unref?.()
-    child.stdout?.on('data', (chunk: Buffer) => {
-      out += chunk.toString('utf-8')
-    })
-    child.on('error', () => settle(''))
-    // 'close' not 'exit': exit can fire before stdout drains, and an empty read
-    // would parse as a clean DACL — a false negative in the only case we care about.
-    child.on('close', () => settle(out))
+    child.on('error', () => settle(false))
+    child.on('close', (code) => settle(code === 0))
   })
 }
 
-function collectAclFacts(daclOutput: string): AclFacts {
+function collectAclFacts(savedDacl: string): AclFacts | null {
   const orphanPackageSids: string[] = []
   let hasWellKnownPackageGrant = false
   let hasRestrictedPackageGrant = false
-  let sawEnglishPrincipal = false
-  for (const line of daclOutput.split(/\r?\n/)) {
-    if (ENGLISH_PRINCIPAL.test(line)) {
-      sawEnglishPrincipal = true
-    }
-    // icacls glues the echoed path onto the first principal with no separator, so
-    // match the principal:(flags) tail rather than trying to split the line.
-    const ace = /([^\s:][^:]*):(\([^\s]*\))\s*$/.exec(line.trim())
-    if (!ace) {
-      continue
-    }
-    const [, principal, flags] = ace
-    const rawSid = RAW_PACKAGE_SID.exec(principal)?.[0]
-    const sid = rawSid?.toLowerCase()
-    if (rawSid && !WELL_KNOWN_PACKAGE_SIDS.has(rawSid.toLowerCase())) {
-      orphanPackageSids.push(rawSid)
+  // A partial DACL can hide a later grant; unsupported ACEs must stay unreadable.
+  const dacl = /^D:[A-Z]*((?:\([^()]*\))*)(?:S:.*)?$/im.exec(savedDacl)
+  if (!dacl) {
+    return null
+  }
+  for (const [, type, flags, rawSid] of dacl[1].matchAll(SDDL_ACE)) {
+    const sid = rawSid.toUpperCase()
+    if (!WELL_KNOWN_PACKAGE_SIDS.has(sid)) {
+      if (PACKAGE_SID.test(sid)) {
+        orphanPackageSids.push(rawSid)
+      }
       continue
     }
-    const isWellKnown = sid !== undefined || WELL_KNOWN_PACKAGE_NAMES.test(principal)
-    if (!isWellKnown || NON_GRANTING_FLAGS.test(flags)) {
+    // Why: an ACE that denies, or only propagates to children (IO), grants nothing
+    // on this object — so it cannot satisfy an orphan the way the reproduced fix did.
+    const flagTokens: string[] = flags.toUpperCase().match(/../g) ?? []
+    const inheritOnly = flagTokens.includes('IO')
+    if (type.toUpperCase() !== 'A' || inheritOnly) {
       continue
     }
     hasWellKnownPackageGrant = true
     // Reported, never the verdict: narrows which grant is present for triage.
-    if (sid === RESTRICTED_PACKAGES_SID || (!sid && RESTRICTED_PACKAGE_NAME.test(principal))) {
+    if (sid === RESTRICTED_PACKAGES_SID) {
       hasRestrictedPackageGrant = true
     }
   }
-  return {
-    orphanPackageSids,
-    hasWellKnownPackageGrant,
-    hasRestrictedPackageGrant,
-    sawEnglishPrincipal
-  }
+  return { orphanPackageSids, hasWellKnownPackageGrant, hasRestrictedPackageGrant }
 }
 
 function resolveTargets(installDir: string, fileExists: (path: string) => boolean): string[] {
@@ -162,9 +157,9 @@ async function runProbe(options: WindowsInstallDirAclProbeOptions): Promise<void
     for (const target of targets) {
       const remaining = PROBE_BUDGET_MS - (Date.now() - startedAt)
       // Why one shared budget: two targets must never cost two full timeouts.
-      outputs.push(remaining > 0 ? await readDacl(spawnFn, target, remaining) : '')
+      outputs.push(remaining > 0 ? await readSavedDacl(spawnFn, target, remaining) : '')
     }
-    const facts = outputs.map(collectAclFacts)
+    const facts = outputs.map(collectAclFacts).filter((fact) => fact !== null)
     const orphans = [...new Set(facts.flatMap((f) => f.orphanPackageSids))]
     const hasWellKnownPackageGrant = facts.some((f) => f.hasWellKnownPackageGrant)
     const hasRestrictedPackageGrant = facts.some((f) => f.hasRestrictedPackageGrant)
@@ -174,24 +169,22 @@ async function runProbe(options: WindowsInstallDirAclProbeOptions): Promise<void
     const poisoned = facts.some(
       (f) => f.orphanPackageSids.length > 0 && !f.hasWellKnownPackageGrant
     )
-    data = outputs.every((out) => out === '')
-      ? { status: 'failed', reason: 'all-targets-unreadable' }
-      : {
-          status: 'ok',
-          probedTargetCount: targets.length,
-          orphanPackageSidCount: orphans.length,
-          // Capped: correlating the same orphan across reports is what would
-          // identify the tool that left it, which is the point of recording it.
-          orphanPackageSids: sanitizeCrashReportString(orphans.slice(0, 3).join(','), 200),
-          // The verdict rides on this one: either well-known grant satisfies the orphan.
-          hasWellKnownPackageGrant,
-          // Diagnostic only — the -1-only shape launches clean on real hardware.
-          hasRestrictedPackageGrant,
-          // False positives are possible on a non-English Windows, where the
-          // well-known ACE resolves to a localized name this cannot match.
-          wellKnownNameCheckReliable: facts.some((f) => f.sawEnglishPrincipal),
-          matchesPoisonSignature: poisoned
-        }
+    data =
+      facts.length === 0
+        ? { status: 'failed', reason: 'all-targets-unreadable' }
+        : {
+            status: 'ok',
+            probedTargetCount: targets.length,
+            orphanPackageSidCount: orphans.length,
+            // Capped: correlating the same orphan across reports is what would
+            // identify the tool that left it, which is the point of recording it.
+            orphanPackageSids: sanitizeCrashReportString(orphans.slice(0, 3).join(','), 200),
+            // The verdict rides on this one: either well-known grant satisfies the orphan.
+            hasWellKnownPackageGrant,
+            // Diagnostic only — the -1-only shape launches clean on real hardware.
+            hasRestrictedPackageGrant,
+            matchesPoisonSignature: poisoned
+          }
   } catch (error) {
     data = { status: 'failed', reason: sanitizeCrashReportString(`probe: ${String(error)}`, 200) }
   }
diff --git a/src/main/startup/windows-install-dir-acl-recovery.test.ts b/src/main/startup/windows-install-dir-acl-recovery.test.ts
index 7641cdc0700b..23ca9de5062a 100644
--- a/src/main/startup/windows-install-dir-acl-recovery.test.ts
+++ b/src/main/startup/windows-install-dir-acl-recovery.test.ts
@@ -32,9 +32,6 @@ import {
 import {
   ALL_PACKAGES_ACE,
   fakeIcaclsSpawn,
-  FRENCH_BASELINE_ACES,
-  FRENCH_RESTRICTED_PACKAGES_ACE,
-  icaclsDacl,
   ORPHAN_PACKAGE_ACE,
   RESTRICTED_PACKAGES_ACE
 } from './windows-install-dir-acl.test-fixture'
@@ -49,7 +46,7 @@ type Runner = (spec: ProcessSpec) => Promise<ProcessResult>
  * which decides whether icacls ever runs. Only the two process seams are faked.
  */
 function probeThenRecover(
-  dacl: (target: string) => string,
+  savedAces: (target: string) => string[],
   options: { failRepair?: boolean } = {}
 ): Promise<ProcessSpec[]> {
   const specs: ProcessSpec[] = []
@@ -68,7 +65,7 @@ function probeThenRecover(
       platform: 'win32',
       installDir: INSTALL_DIR,
       fileExists: (path) => path.endsWith('ffmpeg.dll'),
-      spawnFn: fakeIcaclsSpawn(dacl).spawnFn,
+      spawnFn: fakeIcaclsSpawn(savedAces).spawnFn,
       recordBreadcrumb: () => undefined,
       onDone: (data) => {
         startWindowsInstallDirAclRepairIfPoisoned(data, {
@@ -95,7 +92,7 @@ describe('startWindowsInstallDirAclRepairIfPoisoned', () => {
   })
 
   it('repairs when the probe sees an orphan package ACE and no well-known grant', async () => {
-    const specs = await probeThenRecover((target) => icaclsDacl(target, [ORPHAN_PACKAGE_ACE]))
+    const specs = await probeThenRecover(() => [ORPHAN_PACKAGE_ACE])
     expect(specs.map((spec) => spec.args?.[2])).toEqual([
       '*S-1-15-2-2:(OI)(CI)(RX)',
       '*S-1-15-2-2:(RX)'
@@ -106,27 +103,13 @@ describe('startWindowsInstallDirAclRepairIfPoisoned', () => {
   // win32 10.0.26200 / Electron 43.4.1, so it earns neither an ACL write nor the
   // accusing dialog copy.
   it('leaves an install whose package grant is ALL APPLICATION PACKAGES alone', async () => {
-    const specs = await probeThenRecover((target) =>
-      icaclsDacl(target, [ORPHAN_PACKAGE_ACE, ALL_PACKAGES_ACE])
-    )
+    const specs = await probeThenRecover(() => [ORPHAN_PACKAGE_ACE, ALL_PACKAGES_ACE])
     expect(specs).toHaveLength(0)
     expect(describeInstallDirAclPoison()).toBeNull()
   })
 
   it('does not touch an install that already carries the restricted grant', async () => {
-    const specs = await probeThenRecover((target) =>
-      icaclsDacl(target, [ORPHAN_PACKAGE_ACE, RESTRICTED_PACKAGES_ACE])
-    )
-    expect(specs).toHaveLength(0)
-    expect(describeInstallDirAclPoison()).toBeNull()
-  })
-
-  // A localized icacls prints the grant under a name the probe cannot match, so
-  // the signature is unproven: neither icacls nor the accusing dialog copy.
-  it('does not act on a signature from a non-English icacls', async () => {
-    const specs = await probeThenRecover((target) =>
-      icaclsDacl(target, [ORPHAN_PACKAGE_ACE, FRENCH_RESTRICTED_PACKAGES_ACE], FRENCH_BASELINE_ACES)
-    )
+    const specs = await probeThenRecover(() => [ORPHAN_PACKAGE_ACE, RESTRICTED_PACKAGES_ACE])
     expect(specs).toHaveLength(0)
     expect(describeInstallDirAclPoison()).toBeNull()
   })
@@ -169,7 +152,7 @@ describe('describeInstallDirAclPoison', () => {
   })
 
   it('offers the copyable commands, and drops them once the repair lands', async () => {
-    await probeThenRecover((target) => icaclsDacl(target, [ORPHAN_PACKAGE_ACE]))
+    await probeThenRecover(() => [ORPHAN_PACKAGE_ACE])
     const repaired = describeInstallDirAclPoison()
     expect(repaired?.detail).toContain('Orca repaired the permissions')
     expect(repaired?.detail).not.toContain('Administrator Command Prompt')
@@ -180,7 +163,7 @@ describe('describeInstallDirAclPoison', () => {
   })
 
   it('walks a standard user through icacls when the repair could not write', async () => {
-    await probeThenRecover((target) => icaclsDacl(target, [ORPHAN_PACKAGE_ACE]), {
+    await probeThenRecover(() => [ORPHAN_PACKAGE_ACE], {
       failRepair: true
     })
     const failed = describeInstallDirAclPoison()
@@ -190,7 +173,7 @@ describe('describeInstallDirAclPoison', () => {
 
   it('reports the repair as in flight before icacls has answered', () => {
     startWindowsInstallDirAclRepairIfPoisoned(
-      { status: 'ok', matchesPoisonSignature: true, wellKnownNameCheckReliable: true },
+      { status: 'ok', matchesPoisonSignature: true },
       {
         platform: 'win32',
         installDir: INSTALL_DIR,
@@ -206,8 +189,7 @@ describe('describeInstallDirAclPoison', () => {
 
 const POISON_VERDICT: CrashReportBreadcrumbData = {
   status: 'ok',
-  matchesPoisonSignature: true,
-  wellKnownNameCheckReliable: true
+  matchesPoisonSignature: true
 }
 const GPU_ENV = { appVersion: APP_VERSION, electronVersion: '43.4.1', platform: 'win32' } as const
 
@@ -897,7 +879,7 @@ describe('the probe-pending grace window', () => {
       platform: 'win32' as const,
       installDir: INSTALL_DIR,
       fileExists: () => false,
-      spawnFn: fakeIcaclsSpawn((target) => icaclsDacl(target, [RESTRICTED_PACKAGES_ACE])).spawnFn,
+      spawnFn: fakeIcaclsSpawn(() => [RESTRICTED_PACKAGES_ACE]).spawnFn,
       recordBreadcrumb: () => undefined
     }
     let settleVerdict: () => void = () => undefined
diff --git a/src/main/startup/windows-install-dir-acl.test-fixture.ts b/src/main/startup/windows-install-dir-acl.test-fixture.ts
index ecbfec808f06..f28fe9c3d677 100644
--- a/src/main/startup/windows-install-dir-acl.test-fixture.ts
+++ b/src/main/startup/windows-install-dir-acl.test-fixture.ts
@@ -1,64 +1,69 @@
 import { EventEmitter } from 'node:events'
+import { writeFileSync } from 'node:fs'
+import { basename } from 'node:path'
 import type { spawn } from 'node:child_process'
 
-/** Shared icacls doubles for the install-dir DACL probe, repair, and recovery tests. */
+/**
+ * Shared icacls doubles for the install-dir DACL probe, repair, and recovery tests.
+ * ACEs are SDDL, the shape `icacls <target> /save <file>` writes (captured on
+ * win32 10.0.26200: the leaf name, CRLF, then `D:AI(...)(...)`, UTF-16LE).
+ */
 
-export const ORPHAN_PACKAGE_ACE = 'S-1-15-2-999-999-999:(OI)(CI)(RX)'
-export const RESTRICTED_PACKAGES_ACE =
-  'APPLICATION PACKAGE AUTHORITY\\ALL RESTRICTED APPLICATION PACKAGES:(OI)(CI)(RX)'
-/** The Program Files default: present on healthy installs, which launch clean. */
-export const ALL_PACKAGES_ACE = 'APPLICATION PACKAGE AUTHORITY\\ALL APPLICATION PACKAGES:(RX)'
+export const ORPHAN_PACKAGE_ACE = '(A;OICI;0x1200a9;;;S-1-15-2-999-999-999)'
+/** ALL RESTRICTED APPLICATION PACKAGES; SDDL has no alias for it. */
+export const RESTRICTED_PACKAGES_ACE = '(A;OICI;0x1200a9;;;S-1-15-2-2)'
+/** ALL APPLICATION PACKAGES (`AC`), the Program Files default: healthy installs launch clean. */
+export const ALL_PACKAGES_ACE = '(A;;0x1200a9;;;AC)'
 
-export const ENGLISH_BASELINE_ACES = [
-  'NT AUTHORITY\\SYSTEM:(I)(OI)(CI)(F)',
-  'BUILTIN\\Administrators:(I)(OI)(CI)(F)',
-  'awin\\neil:(I)(OI)(CI)(F)'
+export const BASELINE_ACES = [
+  '(A;OICIID;FA;;;SY)',
+  '(A;OICIID;FA;;;BA)',
+  '(A;OICIID;FA;;;S-1-5-21-432636774-4279371817-3971399515-1001)'
 ]
-/** fr-FR icacls: no principal the English name check can recognize. */
-export const FRENCH_BASELINE_ACES = [
-  'AUTORITE NT\\Systeme:(I)(OI)(CI)(F)',
-  'BUILTIN\\Administrateurs:(I)(OI)(CI)(F)'
-]
-export const FRENCH_RESTRICTED_PACKAGES_ACE =
-  "AUTORITE DE PACKAGE D'APPLICATION\\TOUS LES PACKAGES D'APPLICATION RESTREINTS:(RX)"
 
-/** Real icacls shape: the echoed path is glued onto the first principal. */
-export function icaclsDacl(
-  target: string,
-  aces: string[],
-  baseline: string[] = ENGLISH_BASELINE_ACES
-): string {
-  const [first, ...rest] = [...aces, ...baseline]
-  return [
-    `${target} ${first}`,
-    ...rest.map((ace) => `                    ${ace}`),
-    '',
-    'Successfully processed 1 files'
-  ].join('\r\n')
+/** The file `icacls <target> /save` writes for a target carrying these ACEs. */
+export function icaclsSavedAcl(target: string, aces: string[]): Buffer {
+  const leaf = basename(target.replaceAll('\\', '/'))
+  return Buffer.from(`${leaf}\r\nD:AI${[...aces, ...BASELINE_ACES].join('')}\r\n`, 'utf16le')
 }
 
-/** `null` output makes the spawn fail, as an unreadable target does. */
-export function fakeIcaclsSpawn(output: (target: string) => string | null): {
+/**
+ * `saved` returns the target's extra ACEs, or the raw saved file; `null` makes the
+ * spawn fail, as an unreadable target does. `display` is what a bare
+ * `icacls <target>` prints.
+ */
+export function fakeIcaclsSpawn(
+  saved: (target: string) => string[] | Buffer | null,
+  display: (target: string) => string = () => '',
+  exitCode: number | null = 0
+): {
   spawnFn: typeof spawn
   calls: { file: string; args: string[] }[]
 } {
   const calls: { file: string; args: string[] }[] = []
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: test double; the probe only touches kill/stdout/on of the child.
   const spawnFn = ((file: string, args: string[]) => {
     calls.push({ file, args })
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: both fields are assigned on the next two lines.
     const child = new EventEmitter() as EventEmitter & {
       stdout: EventEmitter
       kill: () => void
     }
     child.stdout = new EventEmitter()
     child.kill = () => undefined
-    const out = output(args[0])
+    const [target, verb, saveFile] = args
+    const aces = saved(target)
     setImmediate(() => {
-      if (out === null) {
+      if (aces === null) {
         child.emit('error', new Error('ENOENT'))
         return
       }
-      child.stdout.emit('data', Buffer.from(out, 'utf-8'))
-      child.emit('close', 0)
+      if (verb === '/save') {
+        writeFileSync(saveFile, Buffer.isBuffer(aces) ? aces : icaclsSavedAcl(target, aces))
+      } else {
+        child.stdout.emit('data', Buffer.from(display(target), 'utf-8'))
+      }
+      child.emit('close', exitCode)
     })
     return child
   }) as unknown as typeof spawn
diff --git a/src/main/startup/windows-install-dir-package-acl-repair.test.ts b/src/main/startup/windows-install-dir-package-acl-repair.test.ts
index cc41388b8119..e7222b016c01 100644
--- a/src/main/startup/windows-install-dir-package-acl-repair.test.ts
+++ b/src/main/startup/windows-install-dir-package-acl-repair.test.ts
@@ -312,8 +312,7 @@ describe('isInstallDirAclPoisonVerdict', () => {
     expect(
       isInstallDirAclPoisonVerdict({
         status: 'ok',
-        matchesPoisonSignature: true,
-        wellKnownNameCheckReliable: true
+        matchesPoisonSignature: true
       })
     ).toBe(true)
     expect(
@@ -324,16 +323,4 @@ describe('isInstallDirAclPoisonVerdict', () => {
     ).toBe(false)
     expect(isInstallDirAclPoisonVerdict({ status: 'failed', reason: 'unreadable' })).toBe(false)
   })
-
-  // A localized icacls hides the well-known grants behind translated names, so the
-  // signature there is unproven: repairing and blaming the install would be wrong.
-  it('refuses a signature the probe could not name-check', () => {
-    expect(
-      isInstallDirAclPoisonVerdict({
-        status: 'ok',
-        matchesPoisonSignature: true,
-        wellKnownNameCheckReliable: false
-      })
-    ).toBe(false)
-  })
 })
diff --git a/src/main/startup/windows-install-dir-package-acl-repair.ts b/src/main/startup/windows-install-dir-package-acl-repair.ts
index 6bd6505a2cb6..878f7c47411d 100644
--- a/src/main/startup/windows-install-dir-package-acl-repair.ts
+++ b/src/main/startup/windows-install-dir-package-acl-repair.ts
@@ -103,13 +103,11 @@ const MAX_REPAIR_ATTEMPTS = 3
 
 /**
  * The probe's verdict is the only trigger: an orphan package ACE with no
- * well-known package grant to satisfy it. A localized icacls prints those grants
- * under translated names the probe cannot match, so an unreliable name check is
- * not evidence of poison — acting on it would spawn icacls and tell a user with a
- * healthy install that their permissions are broken.
+ * well-known package grant to satisfy it. The probe reads SDDL, so the verdict
+ * holds on every Windows display language.
  */
 export function isInstallDirAclPoisonVerdict(data: CrashReportBreadcrumbData): boolean {
-  return data.matchesPoisonSignature === true && data.wellKnownNameCheckReliable !== false
+  return data.matchesPoisonSignature === true
 }
 
 /** The commands to hand a user whose account cannot write the install ACL. */
diff --git a/src/main/telemetry/client.ts b/src/main/telemetry/client.ts
index dc92cf1461d8..50fb8cfaa3b4 100644
--- a/src/main/telemetry/client.ts
+++ b/src/main/telemetry/client.ts
@@ -160,35 +160,47 @@ function waitForCaptureEnqueue(client: PostHog, event: EventName, uuid: string):
   })
 }
 
+/** Lets producers avoid preparing usage payloads when transmission is disabled. */
+export function isTelemetryEnabled(): boolean {
+  return (
+    (testTransportEnabled || (IS_OFFICIAL_BUILD && TELEMETRY_ENABLED)) &&
+    !shuttingDown &&
+    posthog !== null &&
+    commonProps !== null &&
+    storeRef !== null &&
+    resolveConsent(storeRef.getSettings()).effective === 'enabled'
+  )
+}
+
 // No-op in contributor / non-official builds; only official stable/rc builds (CI-injected `ORCA_BUILD_IDENTITY` + `ORCA_POSTHOG_WRITE_KEY`) transmit.
-export function track<N extends EventName>(name: N, props: EventProps<N>): void {
+export function track<N extends EventName>(name: N, props: EventProps<N>): boolean {
   if (!testTransportEnabled && (!IS_OFFICIAL_BUILD || !TELEMETRY_ENABLED)) {
-    return
+    return false
   }
 
   // (1) Shutdown gate: late IPC arrivals must not enqueue against a flushing client.
   if (shuttingDown) {
-    return
+    return false
   }
   if (!posthog || !commonProps || !storeRef) {
-    return
+    return false
   }
 
   // (2) Burst cap before consent: the O(1) cap drops floods before the costly settings read, so a compromised opted-out renderer can't burn CPU.
   if (!consumeBurstToken(name)) {
-    return
+    return false
   }
 
   // (3) Consent resolve — reads live settings every call so it can't drift from persisted state / env-var precedence.
   const consent = resolveConsent(storeRef.getSettings())
   if (consent.effective !== 'enabled') {
-    return
+    return false
   }
 
   // (4) Validator — single enforcement point for schema, enum, key set, and length caps.
   const result = validate(name, props)
   if (!result.ok) {
-    return
+    return false
   }
 
   // (5) Capture. `$process_person_profile: false` stops posthog-node creating a person per install_id (no init-time equivalent).
@@ -201,6 +213,7 @@ export function track<N extends EventName>(name: N, props: EventProps<N>): void
       $process_person_profile: false
     }
   })
+  return true
 }
 
 export async function setOptIn(via: OptInVia, optedIn: boolean): Promise<void> {
diff --git a/src/main/terminal-history-deletion.ts b/src/main/terminal-history-deletion.ts
index 1fea1128ebe9..97650a78ac34 100644
--- a/src/main/terminal-history-deletion.ts
+++ b/src/main/terminal-history-deletion.ts
@@ -1,5 +1,6 @@
 import { basename, dirname, join } from 'node:path'
-import { existsSync, mkdirSync, readdirSync, renameSync } from 'node:fs'
+import { existsSync, mkdirSync, renameSync } from 'node:fs'
+import { readdir } from 'node:fs/promises'
 import { removeHostTree } from './host-tree-removal'
 import { deleteFishHistoryFile, resolveFishHistoryDir } from './fish-history-session'
 import { readHistoryMeta } from './terminal-history'
@@ -20,6 +21,112 @@ const historyTreeRemovalAttempts = new Map<string, number>()
 const historyTreeRemovalRetryTimers = new Map<string, ReturnType<typeof setTimeout>>()
 const wslDistroByTombstone = new Map<string, string>()
 
+/** One root's undrained tombstone names from the last enumeration, plus its in-flight re-read. */
+type HistoryRemovalQueue = { names: string[]; refill: Promise<void> | null }
+// Why hold the names instead of re-reading per completion: one `readdir` already materialises every
+// name, so keeping it until it runs out makes a backlog of N tombstones cost a handful of reads, not N.
+const historyRemovalQueues = new Map<string, HistoryRemovalQueue>()
+
+function historyRemovalQueueFor(historyRoot: string): HistoryRemovalQueue {
+  const existing = historyRemovalQueues.get(historyRoot)
+  if (existing) {
+    return existing
+  }
+  const queue: HistoryRemovalQueue = { names: [], refill: null }
+  historyRemovalQueues.set(historyRoot, queue)
+  return queue
+}
+
+function historyTreeRemovalsAtCapacity(): boolean {
+  return (
+    pendingHistoryTreeRemovals.size + historyTreeRemovalRetryTimers.size >=
+    MAX_PENDING_HISTORY_TREE_REMOVALS
+  )
+}
+
+function isHistoryTreeRemovalTracked(dir: string): boolean {
+  return pendingHistoryTreeRemovals.has(dir) || historyTreeRemovalRetryTimers.has(dir)
+}
+
+/** Admit already-enumerated tombstones up to the admission cap; the rest stay queued for a later slot. */
+function admitQueuedHistoryTreeRemovals(historyRoot: string, queue: HistoryRemovalQueue): void {
+  const pendingRoot = getPendingDeleteRoot(historyRoot)
+  const wslDistro = wslDistroForHistoryRoot(historyRoot)
+  while (!historyTreeRemovalsAtCapacity()) {
+    const name = queue.names.pop()
+    if (name === undefined) {
+      return
+    }
+    // Safe to re-admit a name removed since enumeration: `removeHostTree` forces the rm.
+    scheduleHistoryTreeRemoval(join(pendingRoot, name), wslDistro)
+  }
+}
+
+/** Re-read one root's tombstone directory, coalescing concurrent requests onto a single readdir. */
+function refillHistoryRemovalQueue(historyRoot: string, queue: HistoryRemovalQueue): Promise<void> {
+  if (queue.refill) {
+    return queue.refill
+  }
+  const pendingRoot = getPendingDeleteRoot(historyRoot)
+  // Why snapshot rather than only test tracking when the read lands: a removal under way now can
+  // still show up in the read and also finish before it resolves, which would look admissible again.
+  const removalsUnderWay = new Set(pendingHistoryTreeRemovals.keys())
+  queue.refill = readTombstoneNames(historyRoot).then((names) => {
+    // A teardown that dropped this queue must not resurrect its removals.
+    if (historyRemovalQueues.get(historyRoot) !== queue) {
+      return
+    }
+    queue.refill = null
+    try {
+      // Dropping names already handled keeps the read that confirms a drained directory from
+      // re-queueing work, so the tail of a backlog does not cost one read per completion.
+      queue.names = names.filter((name) => {
+        const dir = join(pendingRoot, name)
+        return !removalsUnderWay.has(dir) && !isHistoryTreeRemovalTracked(dir)
+      })
+      admitQueuedHistoryTreeRemovals(historyRoot, queue)
+    } catch (err) {
+      // Non-fatal, and never a rejection: callers fire this off without awaiting it.
+      console.warn(
+        `[pty:history] Failed to queue pending history removals: ${err instanceof Error ? err.message : String(err)}`
+      )
+    }
+  })
+  return queue.refill
+}
+
+async function readTombstoneNames(historyRoot: string): Promise<string[]> {
+  try {
+    return await readdir(getPendingDeleteRoot(historyRoot))
+  } catch (err) {
+    // An absent root is the normal steady state; anything else means tombstones may linger until a
+    // later completion re-reads, so it is worth a line.
+    const code = err && typeof err === 'object' && 'code' in err ? String(err.code) : ''
+    if (code !== 'ENOENT') {
+      console.warn(
+        `[pty:history] Failed to read pending history removals for ${historyRoot}: ${err instanceof Error ? err.message : String(err)}`
+      )
+    }
+    return []
+  }
+}
+
+/** Reopen the admission window after a completion — from the queues, or one read once they empty. */
+function replenishHistoryTreeRemovals(historyRoot: string): void {
+  const queue = historyRemovalQueueFor(historyRoot)
+  admitQueuedHistoryTreeRemovals(historyRoot, queue)
+  // Why other roots too: a slot this root cannot fill is the only thing a sibling root displaced at
+  // the cap is waiting for, and nothing else would offer it one before the next startup.
+  for (const [otherRoot, otherQueue] of historyRemovalQueues) {
+    if (otherQueue !== queue) {
+      admitQueuedHistoryTreeRemovals(otherRoot, otherQueue)
+    }
+  }
+  if (queue.names.length === 0 && !historyTreeRemovalsAtCapacity()) {
+    void refillHistoryRemovalQueue(historyRoot, queue)
+  }
+}
+
 function wslDistroForHistoryRoot(historyRoot: string): string | undefined {
   return basename(dirname(historyRoot)) === 'terminal-history-wsl'
     ? basename(historyRoot)
@@ -83,10 +190,7 @@ function scheduleHistoryTreeRemoval(dir: string, wslDistro?: string): void {
     return
   }
   // Leave excess tombstones on disk; admission is intentionally bounded.
-  if (
-    pendingHistoryTreeRemovals.size + historyTreeRemovalRetryTimers.size >=
-    MAX_PENDING_HISTORY_TREE_REMOVALS
-  ) {
+  if (historyTreeRemovalsAtCapacity()) {
     return
   }
   // A rescan must not cancel a delayed retry for a real failure.
@@ -130,7 +234,7 @@ function scheduleHistoryTreeRemoval(dir: string, wslDistro?: string): void {
         pendingHistoryTreeRemovals.delete(dir)
       }
       if (removalSucceeded) {
-        schedulePendingHistoryTreeRemovals(historyRootForTombstone(dir))
+        replenishHistoryTreeRemovals(historyRootForTombstone(dir))
       }
     })
   pendingHistoryTreeRemovals.set(dir, removal)
@@ -159,31 +263,26 @@ export function scheduleWorktreeHistoryTreeDeletion(dir: string, historyRoot: st
   return true
 }
 
-/** Schedule tombstoned trees under one history root for async removal — the retry after a quit mid-rm. */
-export function schedulePendingHistoryTreeRemovals(historyRoot: string): void {
-  const pendingRoot = getPendingDeleteRoot(historyRoot)
-  if (!existsSync(pendingRoot)) {
-    return
-  }
-  try {
-    for (const entry of readdirSync(pendingRoot)) {
-      scheduleHistoryTreeRemoval(join(pendingRoot, entry), wslDistroForHistoryRoot(historyRoot))
-    }
-  } catch {
-    // Non-fatal.
-  }
+/** Schedule tombstoned trees under one history root for async removal — the retry after a quit mid-rm.
+ *  Resolves once the enumeration landed; the removals it admitted keep draining in the background. */
+export function schedulePendingHistoryTreeRemovals(historyRoot: string): Promise<void> {
+  return refillHistoryRemovalQueue(historyRoot, historyRemovalQueueFor(historyRoot))
 }
 
 /** Schedule tombstoned trees under every history root, native and WSL. */
-export function scheduleAllPendingHistoryTreeRemovals(): void {
-  schedulePendingHistoryTreeRemovals(getHistoryRoot())
-  for (const distroRoot of listWslHistoryRoots()) {
-    schedulePendingHistoryTreeRemovals(distroRoot)
-  }
+export async function scheduleAllPendingHistoryTreeRemovals(): Promise<void> {
+  await Promise.all([
+    schedulePendingHistoryTreeRemovals(getHistoryRoot()),
+    ...listWslHistoryRoots().map((distroRoot) => schedulePendingHistoryTreeRemovals(distroRoot))
+  ])
 }
 
-/** Drop every armed retry timer so a fixture teardown cannot resurrect a removal. Tests only. */
+/** Drop queued tombstone names and retries so fixture teardown cannot resurrect a removal. Tests only. */
 export function cancelPendingHistoryTreeRemovalRetries(): void {
+  historyRemovalQueues.clear()
+  // Why also the in-flight map: a fixture that never settles a held removal would otherwise leave it
+  // for the next test's flush to wait on forever.
+  pendingHistoryTreeRemovals.clear()
   for (const timer of historyTreeRemovalRetryTimers.values()) {
     clearTimeout(timer)
   }
@@ -195,11 +294,22 @@ export function cancelPendingHistoryTreeRemovalRetries(): void {
 /** Drain every history root's tombstones and await the in-flight removals. Tests only: production
  *  schedules the same drain from startup GC and headless serve without ever blocking on it. */
 export async function flushPendingWorktreeHistoryDeletions(): Promise<void> {
-  scheduleAllPendingHistoryTreeRemovals()
+  await scheduleAllPendingHistoryTreeRemovals()
   // Why loop: awaiting one snapshot of the map would return with a removal scheduled mid-batch still
-  // in flight. Each pass settles its batch and drains whatever was added while it ran.
-  while (pendingHistoryTreeRemovals.size > 0) {
-    await Promise.all(pendingHistoryTreeRemovals.values())
+  // in flight. Each pass admits every queued name the cap allows, then settles what is outstanding.
+  while (true) {
+    for (const [root, queue] of historyRemovalQueues) {
+      admitQueuedHistoryTreeRemovals(root, queue)
+    }
+    const outstanding = [
+      ...pendingHistoryTreeRemovals.values(),
+      ...[...historyRemovalQueues.values()].flatMap((queue) => (queue.refill ? [queue.refill] : []))
+    ]
+    if (outstanding.length === 0) {
+      // Nothing in flight and nothing admissible: only delayed retries can still make progress.
+      return
+    }
+    await Promise.all(outstanding)
   }
 }
 
diff --git a/src/main/terminal-history-gc-fs-call-count.test.ts b/src/main/terminal-history-gc-fs-call-count.test.ts
index d6c10b579515..4ed0cb816cd8 100644
--- a/src/main/terminal-history-gc-fs-call-count.test.ts
+++ b/src/main/terminal-history-gc-fs-call-count.test.ts
@@ -167,15 +167,20 @@ describe('history GC filesystem request count', () => {
 
     await runHistoryGc(live)
 
+    const tombstoneLists = fsCalls.readdir.filter((p) => p.endsWith(PENDING_DELETE_DIR_NAME))
+    const scanLists = fsCalls.readdir.filter((p) => !p.endsWith(PENDING_DELETE_DIR_NAME))
     // The size estimation walked into every directory; the pass now only lists the root.
-    expect(fsCalls.readdir).toEqual([historyRoot])
+    expect(scanLists).toEqual([historyRoot])
+    // The tombstone drain (formerly a blocking readdirSync per completion) lists pending-delete a
+    // bounded number of times, never once per entry it removes.
+    expect(tombstoneLists.length).toBeLessThanOrEqual(12)
     // No stat on the entries themselves: the root dirent already carries the type.
     expect(statsOnEntries()).toEqual([])
     // The one surviving stat per directory is readHistoryMetaAsync enforcing its size cap.
     expect(statsInsideEntries().sort()).toEqual(
       Array.from({ length: DIR_COUNT }, (_, i) => join(historyRoot, `wt-${i}`, 'meta.json')).sort()
     )
-    expect(fsCalls.readdir.length + fsCalls.stat.length).toBe(1 + DIR_COUNT)
+    expect(scanLists.length + fsCalls.stat.length).toBe(1 + DIR_COUNT)
 
     const after = survivingDirs()
     expect(expected.size).toBe(DIR_COUNT / ORPHAN_EVERY)
diff --git a/src/main/terminal-history-gc.ts b/src/main/terminal-history-gc.ts
index f62ebab9ee50..7882ec963a46 100644
--- a/src/main/terminal-history-gc.ts
+++ b/src/main/terminal-history-gc.ts
@@ -148,7 +148,7 @@ async function executeHistoryGc(liveWorktreeIds: Set<string>, signal: AbortSigna
     // Why: finish tombstones left by quit mid-rm before scanning live worktree hashes.
     // Safe ahead of the guard below: these entries were already condemned by a
     // completed GC, and leaving them renamed-but-present strands disk forever.
-    schedulePendingHistoryTreeRemovals(getHistoryRoot())
+    await schedulePendingHistoryTreeRemovals(getHistoryRoot())
     // Why refuse rather than treat every entry as orphaned: an empty live set is
     // what a store that fell back to default state looks like, and it cannot be
     // told apart from a user who genuinely has no worktrees — who also has no
@@ -169,7 +169,7 @@ async function executeHistoryGc(liveWorktreeIds: Set<string>, signal: AbortSigna
       if (signal.aborted) {
         break
       }
-      schedulePendingHistoryTreeRemovals(distroRoot)
+      await schedulePendingHistoryTreeRemovals(distroRoot)
       const r = await gcScanRoot(distroRoot, liveWorktreeIds, signal)
       wslTotals.totalDirs += r.totalDirs
       wslTotals.orphaned += r.orphaned
diff --git a/src/main/terminal-history-tombstone-retry.test.ts b/src/main/terminal-history-tombstone-retry.test.ts
index 1d7a606206a0..cbfb10cc2b75 100644
--- a/src/main/terminal-history-tombstone-retry.test.ts
+++ b/src/main/terminal-history-tombstone-retry.test.ts
@@ -30,6 +30,16 @@ import {
   schedulePendingHistoryTreeRemovals
 } from './terminal-history-deletion'
 
+// Captured before any fake clock replaces the global: refilling the removal queue reads the
+// tombstone directory for real, and only a turn of the actual event loop can land that read.
+const realSetImmediate = setImmediate
+
+async function settleTombstoneDirectoryReads(): Promise<void> {
+  for (let index = 0; index < 10; index++) {
+    await new Promise((resolve) => realSetImmediate(resolve))
+  }
+}
+
 /** A tombstone whose rm fails once used to sit on disk for the rest of the session — only the next
  *  process start re-queued it. Prove the failure re-arms in-process, and that it stays bounded. */
 describe('tombstoned history removal retries', () => {
@@ -124,9 +134,11 @@ describe('tombstoned history removal retries', () => {
     expect(deleteWslFishHistoryFileMock).toHaveBeenCalledTimes(64)
     expect(releases).toHaveLength(64)
 
-    while (releases.length > 0) {
+    for (let pass = 0; removeHostTreeMock.mock.calls.length < 1_000; pass++) {
+      expect(pass).toBeLessThan(200)
       releases.splice(0).forEach((release) => release())
       await vi.advanceTimersByTimeAsync(0)
+      await settleTombstoneDirectoryReads()
     }
     expect(removeHostTreeMock).toHaveBeenCalledTimes(1_000)
     expect(deleteWslFishHistoryFileMock).toHaveBeenCalledTimes(1_000)
diff --git a/src/main/terminal-history-tombstone-scan-cost.test.ts b/src/main/terminal-history-tombstone-scan-cost.test.ts
new file mode 100644
index 000000000000..002763750d67
--- /dev/null
+++ b/src/main/terminal-history-tombstone-scan-cost.test.ts
@@ -0,0 +1,280 @@
+import { mkdirSync, mkdtempSync, readdirSync, rmSync } from 'node:fs'
+import type * as NodeFsPromises from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { installFakeAppEnvironment } from '../../config/scripts/vitest-host-ports-setup'
+
+const reads = vi.hoisted(() => ({ count: 0, names: 0, failNext: 0 }))
+const { removeHostTreeMock } = vi.hoisted(() => ({
+  removeHostTreeMock: vi.fn<(dir: string) => Promise<void>>()
+}))
+
+vi.mock('node:fs/promises', async (importOriginal) => {
+  const fsp = await importOriginal<typeof NodeFsPromises>()
+  return {
+    ...fsp,
+    readdir: async (...args: Parameters<typeof fsp.readdir>) => {
+      if (!String(args[0]).endsWith('.pending-delete')) {
+        return fsp.readdir(...args)
+      }
+      reads.count++
+      if (reads.failNext > 0) {
+        reads.failNext--
+        throw new Error('EACCES: permission denied, scandir')
+      }
+      const result = await fsp.readdir(...args)
+      reads.names += Array.isArray(result) ? result.length : 0
+      return result
+    }
+  }
+})
+
+vi.mock('./host-tree-removal', () => ({ removeHostTree: removeHostTreeMock }))
+
+import {
+  cancelPendingHistoryTreeRemovalRetries,
+  flushPendingWorktreeHistoryDeletions,
+  HISTORY_TREE_REMOVAL_RETRY_DELAYS_MS,
+  MAX_PENDING_HISTORY_TREE_REMOVALS,
+  schedulePendingHistoryTreeRemovals
+} from './terminal-history-deletion'
+
+describe('terminal history tombstone scan cost', () => {
+  let userDataDir: string
+
+  beforeEach(() => {
+    userDataDir = mkdtempSync(join(tmpdir(), 'orca-history-scan-cost-'))
+    installFakeAppEnvironment({ getPath: () => userDataDir })
+    reads.count = 0
+    reads.names = 0
+    reads.failNext = 0
+    removeHostTreeMock.mockReset()
+  })
+
+  afterEach(() => {
+    cancelPendingHistoryTreeRemovalRetries()
+    vi.useRealTimers()
+    rmSync(userDataDir, { recursive: true, force: true })
+  })
+
+  function seedTombstones(root: string, count: number): void {
+    for (let index = 0; index < count; index++) {
+      mkdirSync(join(root, '.pending-delete', `old-session-${index}`), {
+        recursive: true
+      })
+    }
+  }
+
+  function holdRemovals(): (() => void)[] {
+    const releases: (() => void)[] = []
+    removeHostTreeMock.mockImplementation(
+      (dir) =>
+        new Promise<void>((resolve) =>
+          releases.push(() => {
+            rmSync(dir, { recursive: true, force: true })
+            resolve()
+          })
+        )
+    )
+    return releases
+  }
+
+  /** Drain only the microtask queue, so no queued directory read can land yet. */
+  async function settleRemovalPromises(): Promise<void> {
+    for (let index = 0; index < 8; index++) {
+      await Promise.resolve()
+    }
+  }
+
+  /** Let real filesystem reads land. Callers using fake timers must drive the clock instead. */
+  async function waitFor(label: string, condition: () => boolean): Promise<void> {
+    for (let index = 0; index < 500; index++) {
+      if (condition()) {
+        return
+      }
+      await new Promise((resolve) => setTimeout(resolve, 2))
+    }
+    throw new Error(`Timed out waiting for ${label}`)
+  }
+
+  it('drains 1024 tombstones without re-reading the directory per completion', async () => {
+    const root = join(userDataDir, 'terminal-history')
+    const pendingRoot = join(root, '.pending-delete')
+    seedTombstones(root, 1024)
+    const releases = holdRemovals()
+
+    await schedulePendingHistoryTreeRemovals(root)
+    expect(reads.count).toBe(1)
+    expect(removeHostTreeMock).toHaveBeenCalledTimes(MAX_PENDING_HISTORY_TREE_REMOVALS)
+    while (releases.length > 0) {
+      expect(releases.length).toBeLessThanOrEqual(MAX_PENDING_HISTORY_TREE_REMOVALS)
+      releases.splice(0).forEach((release) => release())
+      await settleRemovalPromises()
+    }
+
+    expect(removeHostTreeMock).toHaveBeenCalledTimes(1024)
+    expect(readdirSync(pendingRoot)).toEqual([])
+    // One read fills the queue; the handful after it only confirm the directory drained, so the
+    // count must stay flat in the backlog size rather than tracking completion batches.
+    expect(reads.count).toBeLessThanOrEqual(8)
+    expect(reads.names).toBeLessThanOrEqual(1024 + MAX_PENDING_HISTORY_TREE_REMOVALS)
+  })
+
+  it('picks up a tombstone created after the queued names were read', async () => {
+    const root = join(userDataDir, 'terminal-history')
+    const pendingRoot = join(root, '.pending-delete')
+    seedTombstones(root, 1)
+    const releases = holdRemovals()
+
+    await schedulePendingHistoryTreeRemovals(root)
+    mkdirSync(join(pendingRoot, 'late-session'))
+    releases.splice(0).forEach((release) => release())
+
+    // The completion exhausted the queue, so its refill read discovers the late arrival.
+    await waitFor('late tombstone admission', () => removeHostTreeMock.mock.calls.length === 2)
+    releases.splice(0).forEach((release) => release())
+    await flushPendingWorktreeHistoryDeletions()
+    expect(readdirSync(pendingRoot)).toEqual([])
+  })
+
+  it('drains both roots within the shared admission cap without per-completion reads', async () => {
+    const nativeRoot = join(userDataDir, 'terminal-history')
+    const wslRoot = join(userDataDir, 'terminal-history-wsl', 'Ubuntu')
+    seedTombstones(nativeRoot, 160)
+    seedTombstones(wslRoot, 160)
+    let inFlight = 0
+    let peakInFlight = 0
+    removeHostTreeMock.mockImplementation(async (dir) => {
+      inFlight++
+      peakInFlight = Math.max(peakInFlight, inFlight)
+      await new Promise((resolve) => setTimeout(resolve, 0))
+      rmSync(dir, { recursive: true, force: true })
+      inFlight--
+    })
+
+    await flushPendingWorktreeHistoryDeletions()
+
+    expect(removeHostTreeMock).toHaveBeenCalledTimes(320)
+    expect(peakInFlight).toBeLessThanOrEqual(MAX_PENDING_HISTORY_TREE_REMOVALS)
+    expect(readdirSync(join(nativeRoot, '.pending-delete'))).toEqual([])
+    expect(readdirSync(join(wslRoot, '.pending-delete'))).toEqual([])
+    // Two roots, so a couple of reads each rather than one per completion.
+    expect(reads.count).toBeLessThanOrEqual(12)
+  })
+
+  it('keeps draining after a directory read fails mid-drain', async () => {
+    const root = join(userDataDir, 'terminal-history')
+    const pendingRoot = join(root, '.pending-delete')
+    seedTombstones(root, MAX_PENDING_HISTORY_TREE_REMOVALS + 1)
+    const releases = holdRemovals()
+
+    await schedulePendingHistoryTreeRemovals(root)
+    expect(removeHostTreeMock).toHaveBeenCalledTimes(MAX_PENDING_HISTORY_TREE_REMOVALS)
+
+    // The refill these completions request is the one that fails.
+    reads.failNext = 1
+    releases.splice(0).forEach((release) => release())
+    await settleRemovalPromises()
+    // The queued 65th still came from memory, so the failed read cost no progress.
+    expect(removeHostTreeMock).toHaveBeenCalledTimes(MAX_PENDING_HISTORY_TREE_REMOVALS + 1)
+
+    mkdirSync(join(pendingRoot, 'late-after-failed-read'))
+    releases.splice(0).forEach((release) => release())
+    // A later completion must be able to read again rather than stay wedged on the failure.
+    await waitFor(
+      'recovery after failed read',
+      () => removeHostTreeMock.mock.calls.length === MAX_PENDING_HISTORY_TREE_REMOVALS + 2
+    )
+    releases.splice(0).forEach((release) => release())
+    await flushPendingWorktreeHistoryDeletions()
+    expect(readdirSync(pendingRoot)).toEqual([])
+  })
+
+  it('drops an in-flight refill during fixture cleanup', async () => {
+    const root = join(userDataDir, 'terminal-history')
+    seedTombstones(root, MAX_PENDING_HISTORY_TREE_REMOVALS + 1)
+    const releases = holdRemovals()
+
+    await schedulePendingHistoryTreeRemovals(root)
+    mkdirSync(join(root, '.pending-delete', 'late-session'))
+    releases.splice(0).forEach((release) => release())
+    await settleRemovalPromises()
+    const admittedBeforeCleanup = removeHostTreeMock.mock.calls.length
+
+    cancelPendingHistoryTreeRemovalRetries()
+    await waitFor('the dropped refill to land', () => reads.count >= 2)
+    await new Promise((resolve) => setTimeout(resolve, 10))
+    expect(removeHostTreeMock).toHaveBeenCalledTimes(admittedBeforeCleanup)
+  })
+
+  it('preserves delayed failure retries while successful removals replenish the queue', async () => {
+    // Fake timers must be armed before the failure so its retry lands on the test clock.
+    vi.useFakeTimers()
+    const root = join(userDataDir, 'terminal-history')
+    seedTombstones(root, 130)
+    const failedDir = join(root, '.pending-delete', 'old-session-0')
+    removeHostTreeMock.mockImplementation(async (dir) => {
+      if (dir === failedDir) {
+        throw new Error('EBUSY')
+      }
+      rmSync(dir, { recursive: true, force: true })
+    })
+    await flushPendingWorktreeHistoryDeletions()
+    expect(removeHostTreeMock).toHaveBeenCalledTimes(130)
+    expect(readdirSync(join(root, '.pending-delete'))).toEqual(['old-session-0'])
+
+    await vi.advanceTimersByTimeAsync(HISTORY_TREE_REMOVAL_RETRY_DELAYS_MS[0] - 1)
+    expect(removeHostTreeMock).toHaveBeenCalledTimes(130)
+    await vi.advanceTimersByTimeAsync(1)
+    expect(removeHostTreeMock).toHaveBeenCalledTimes(131)
+    await vi.advanceTimersByTimeAsync(HISTORY_TREE_REMOVAL_RETRY_DELAYS_MS[1])
+    expect(removeHostTreeMock).toHaveBeenCalledTimes(132)
+    expect(vi.getTimerCount()).toBe(0)
+  })
+
+  it('does not retry a tombstone past its attempt budget when another root frees slots', async () => {
+    vi.useFakeTimers()
+    const nativeRoot = join(userDataDir, 'terminal-history')
+    const wslRoot = join(userDataDir, 'terminal-history-wsl', 'Ubuntu')
+    seedTombstones(nativeRoot, 32)
+    seedTombstones(wslRoot, 130)
+    const releases: (() => void)[] = []
+    const attemptsByDir = new Map<string, number>()
+    removeHostTreeMock.mockImplementation((dir) => {
+      attemptsByDir.set(dir, (attemptsByDir.get(dir) ?? 0) + 1)
+      if (dir.startsWith(wslRoot)) {
+        return Promise.reject(new Error('EBUSY'))
+      }
+      return new Promise<void>((resolve) =>
+        releases.push(() => {
+          rmSync(dir, { recursive: true, force: true })
+          resolve()
+        })
+      )
+    })
+    await schedulePendingHistoryTreeRemovals(nativeRoot)
+    await schedulePendingHistoryTreeRemovals(wslRoot)
+
+    // Every WSL tombstone that was admitted exhausts its retries while native removals stay in flight.
+    for (const delay of HISTORY_TREE_REMOVAL_RETRY_DELAYS_MS) {
+      await vi.advanceTimersByTimeAsync(delay)
+    }
+    expect(vi.getTimerCount()).toBe(0)
+    const maxAttempts = 1 + HISTORY_TREE_REMOVAL_RETRY_DELAYS_MS.length
+    const exhausted = [...attemptsByDir.entries()].filter(([, count]) => count === maxAttempts)
+    expect(exhausted.length).toBeGreaterThan(0)
+
+    releases.splice(0).forEach((release) => release())
+    await vi.advanceTimersByTimeAsync(0)
+    await vi.advanceTimersByTimeAsync(0)
+    // Freeing another root's slots may give untried tombstones a first attempt, but must never hand
+    // an exhausted one a fresh attempt.
+    for (const count of attemptsByDir.values()) {
+      expect(count).toBeLessThanOrEqual(maxAttempts)
+    }
+    for (const [dir] of exhausted) {
+      expect(attemptsByDir.get(dir)).toBe(maxAttempts)
+    }
+  })
+})
diff --git a/src/main/terminal-history.test.ts b/src/main/terminal-history.test.ts
index 8dd25ea7ddf7..c5ce990f32ca 100644
--- a/src/main/terminal-history.test.ts
+++ b/src/main/terminal-history.test.ts
@@ -62,7 +62,9 @@ vi.mock('fs', () => ({
 // transitive readFile/mkdir would otherwise resolve to undefined.
 vi.mock('node:fs/promises', async () => ({
   ...(await vi.importActual<typeof FsPromises>('node:fs/promises')),
-  rm: rmAsyncMock
+  rm: rmAsyncMock,
+  // The tombstone drain lists pending-delete asynchronously; same fixture as the sync reads.
+  readdir: async (path: string) => readdirSyncMock(path) ?? []
 }))
 
 const { parseWslPathMock, toLinuxPathMock } = vi.hoisted(() => ({
diff --git a/src/main/text-generation/command-environment-process.test.ts b/src/main/text-generation/command-environment-process.test.ts
new file mode 100644
index 000000000000..bdc04daca3f6
--- /dev/null
+++ b/src/main/text-generation/command-environment-process.test.ts
@@ -0,0 +1,160 @@
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { tmpdir } from 'node:os'
+import { afterAll, describe, expect, it, vi } from 'vitest'
+import {
+  withCodexHomeProcessLock,
+  resolveCodexHomeProcessLockKey
+} from '../codex-cli/codex-home-process-lock'
+import { spawnSourceControlAgent } from './source-control-agent-launch'
+import { generateCommitMessage } from './source-control-text-generation-requests'
+import { discoverModelsLocal } from './commit-message-model-discovery'
+import {
+  discoverCommitMessageModelsLocal,
+  generateBranchNameFromContext,
+  generateCommitMessageFromContext,
+  generatePullRequestFieldsFromContext
+} from './commit-message-text-generation'
+
+const folder = mkdtempSync(join(tmpdir(), 'orca-command-env-'))
+const script = join(folder, 'agent.cjs')
+const literal = 'spaces $HOME;$(echo unsafe) `echo unsafe` * = value'
+writeFileSync(
+  script,
+  `
+let prompt = ''
+process.stdin.on('data', chunk => prompt += chunk)
+process.stdin.on('end', () => {
+  if (process.env.ORCA_COMMAND_VALUE !== ${JSON.stringify(literal)}) {
+    console.error('command environment missing or expanded')
+    process.exitCode = 3
+    return
+  }
+  if (process.argv.includes('debug')) console.log(JSON.stringify({models:[{slug:'gpt-5.5',display_name:'GPT-5.5'}]}))
+  else if (process.argv.includes('models')) console.log('anthropic/claude-sonnet-4')
+  else if (prompt.includes('branch name')) console.log('honor-command-environment')
+  else if (prompt.includes('JSON')) console.log(JSON.stringify({base:'main',title:'Honor command environment',body:'Passed environment.',draft:true}))
+  else console.log('Honor command environment')
+})
+`
+)
+afterAll(() => rmSync(folder, { recursive: true, force: true }))
+
+// Forward slashes remain valid Windows paths and avoid POSIX command-template escaping.
+const override = `ORCA_COMMAND_VALUE='${literal}' "${process.execPath.replaceAll('\\', '/')}" "${script.replaceAll('\\', '/')}"`
+const target = {
+  kind: 'local',
+  cwd: folder,
+  env: { ...process.env, ORCA_COMMAND_VALUE: 'base' }
+} as const
+const params = { agentId: 'custom', model: '', customAgentCommand: override } as const
+
+describe('environment-prefixed commands with real child processes', () => {
+  it.each(['generation', 'discovery'] as const)(
+    'queues Codex %s on the overridden home before spawning',
+    async (operation) => {
+      const home = join(folder, operation).replaceAll('\\', '/')
+      let release!: () => void
+      const held = withCodexHomeProcessLock(
+        resolveCodexHomeProcessLockKey(home),
+        () =>
+          new Promise<void>((resolve) => {
+            release = resolve
+          })
+      )
+      await Promise.resolve()
+      const spawnAgent = vi.fn(spawnSourceControlAgent)
+      const command = `CODEX_HOME="${home}" ${override}`
+      const pending =
+        operation === 'generation'
+          ? generateCommitMessage({
+              context: { branch: 'main', stagedSummary: 'M README.md', stagedPatch: '+test' },
+              params: { agentId: 'codex', model: 'gpt-5.5', agentCommandOverride: command },
+              target,
+              spawnAgent
+            })
+          : discoverModelsLocal({
+              agentId: 'codex',
+              env: target.env,
+              agentCommandOverride: command,
+              options: { cwd: folder },
+              backslash: process.platform === 'win32' ? 'literal' : 'escape',
+              spawnAgent
+            })
+      try {
+        await new Promise<void>((resolve) => setImmediate(resolve))
+        expect(spawnAgent).not.toHaveBeenCalled()
+      } finally {
+        release()
+        await held
+      }
+      await expect(pending).resolves.toMatchObject(
+        operation === 'discovery' ? { success: true, catalogOrigin: 'probe' } : { success: true }
+      )
+      expect(spawnAgent).toHaveBeenCalledWith(
+        expect.objectContaining({ env: expect.objectContaining({ CODEX_HOME: home }) })
+      )
+    }
+  )
+
+  it('generates commits from a custom command in a plain folder', async () => {
+    await expect(
+      generateCommitMessageFromContext(
+        { branch: 'main', stagedSummary: 'M README.md', stagedPatch: '+test' },
+        params,
+        target
+      )
+    ).resolves.toMatchObject({ success: true, message: 'Honor command environment' })
+  })
+
+  it('generates commits from a preset override', async () => {
+    await expect(
+      generateCommitMessageFromContext(
+        { branch: 'main', stagedSummary: 'M README.md', stagedPatch: '+test' },
+        { agentId: 'claude', model: 'sonnet', agentCommandOverride: override },
+        target
+      )
+    ).resolves.toMatchObject({ success: true, message: 'Honor command environment' })
+  })
+
+  it('generates branch names', async () => {
+    await expect(
+      generateBranchNameFromContext({ firstPrompt: 'Honor command environment' }, params, target)
+    ).resolves.toMatchObject({ success: true, slug: 'honor-command-environment' })
+  })
+
+  it.each(['github', 'gitlab'] as const)('generates %s review fields', async (provider) => {
+    await expect(
+      generatePullRequestFieldsFromContext(
+        {
+          branch: 'test',
+          base: 'main',
+          branchChangedByPreparation: false,
+          currentTitle: '',
+          currentBody: '',
+          currentDraft: true,
+          commitSummary: 'Change',
+          changeSummary: 'M README.md',
+          patch: '+test',
+          provider
+        },
+        params,
+        target
+      )
+    ).resolves.toMatchObject({
+      success: true,
+      fields: {
+        title: 'Honor command environment',
+        body: 'Passed environment.',
+        base: 'main',
+        draft: true
+      }
+    })
+  })
+
+  it('discovers models through the same override environment', async () => {
+    await expect(
+      discoverCommitMessageModelsLocal('opencode', target.env, override, { cwd: folder })
+    ).resolves.toMatchObject({ success: true, models: [{ id: 'anthropic/claude-sonnet-4' }] })
+  })
+})
diff --git a/src/main/text-generation/command-environment-wsl.test.ts b/src/main/text-generation/command-environment-wsl.test.ts
new file mode 100644
index 000000000000..e7408a2e0591
--- /dev/null
+++ b/src/main/text-generation/command-environment-wsl.test.ts
@@ -0,0 +1,49 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { wslAwareSpawn } from '../git/runner'
+import { spawnSourceControlAgent } from './source-control-agent-launch'
+import { withPlatform } from './commit-message-text-generation-test-harness'
+import { resolveCodexHomeProcessLockKeyForSpawnEnv } from '../codex-cli/codex-home-process-lock'
+
+vi.mock('../git/runner', () => ({ wslAwareSpawn: vi.fn() }))
+afterEach(() => vi.unstubAllEnvs())
+
+describe('command environment on WSL', () => {
+  it('applies literal assignments in the guest after the login shell, without changing launcher PATH', () => {
+    withPlatform('win32', () => {
+      spawnSourceControlAgent({
+        binary: 'claude',
+        args: ['-p'],
+        cwd: '\\\\wsl$\\Ubuntu\\repo',
+        wslDistro: 'Ubuntu',
+        env: undefined,
+        commandEnv: { PATH: '/guest/bin', VALUE: '$HOME;$(echo unsafe)' },
+        stdinMode: 'pipe',
+        useCwdForNative: true
+      })
+    })
+    expect(wslAwareSpawn).toHaveBeenCalledWith(
+      '/usr/bin/env',
+      ['PATH=/guest/bin', 'VALUE=$HOME;$(echo unsafe)', 'claude', '-p'],
+      expect.objectContaining({ wslDistro: 'Ubuntu', windowsHide: true, useWslLoginShell: true })
+    )
+    const options = vi.mocked(wslAwareSpawn).mock.calls[0][2]
+    expect(options.env?.PATH).not.toBe('/guest/bin')
+    expect(options.env?.VALUE).toBeUndefined()
+  })
+
+  it('locks an explicitly assigned guest Codex home even when it matches the host value', () => {
+    vi.stubEnv('CODEX_HOME', '/same/home')
+    const explicit = resolveCodexHomeProcessLockKeyForSpawnEnv(
+      { CODEX_HOME: '/same/home' },
+      'Ubuntu',
+      { CODEX_HOME: '/same/home' }
+    )
+    const managed = resolveCodexHomeProcessLockKeyForSpawnEnv(
+      { CODEX_HOME: '/other/home' },
+      'Ubuntu'
+    )
+    expect(explicit).toContain('/same/home')
+    expect(explicit).not.toContain('.orca-default-codex-home')
+    expect(explicit).not.toBe(managed)
+  })
+})
diff --git a/src/main/text-generation/commit-message-model-discovery-policy.ts b/src/main/text-generation/commit-message-model-discovery-policy.ts
index 88b8e1680e10..fa2b8869a37a 100644
--- a/src/main/text-generation/commit-message-model-discovery-policy.ts
+++ b/src/main/text-generation/commit-message-model-discovery-policy.ts
@@ -61,8 +61,8 @@ export function finalizeModelDiscoveryOutput(
   // should keep its configured provider even when discovery lists concrete models.
   const defaultModelId =
     spec.defaultModelId === 'default' || models.some((model) => model.id === spec.defaultModelId)
-    ? spec.defaultModelId
-    : models[0].id
+      ? spec.defaultModelId
+      : models[0].id
   return staticModelDiscoveryResult(spec, models, defaultModelId, 'probe')
 }
 
@@ -85,7 +85,8 @@ export function planModelDiscovery(
       binary: command.binary,
       args: [...command.prefixArgs, ...modelDiscovery.args],
       stdinPayload: modelDiscovery.stdinPayload ?? null,
-      label: spec.label
+      label: spec.label,
+      ...(command.env ? { env: command.env } : {})
     }
   }
 }
diff --git a/src/main/text-generation/commit-message-model-discovery.ts b/src/main/text-generation/commit-message-model-discovery.ts
index ec6be0f12bbe..80dbbb205a39 100644
--- a/src/main/text-generation/commit-message-model-discovery.ts
+++ b/src/main/text-generation/commit-message-model-discovery.ts
@@ -1,3 +1,4 @@
+import { mergeCommandEnvironment } from '../../shared/command-environment'
 import type { CommandTemplateBackslash } from '../../shared/commit-message-prompt'
 import type { CommitMessagePlan } from '../../shared/commit-message-plan'
 import { getAgentModelProbeSpec } from '../../shared/agent-model-probe-spec'
@@ -46,6 +47,16 @@ export async function discoverModelsLocal(input: {
     return staticModelDiscoveryResult(spec)
   }
 
+  const planned = planModelDiscovery(spec, input.agentCommandOverride, input.backslash)
+  if (!planned.ok) {
+    return { success: false, error: planned.error }
+  }
+  const env = mergeCommandEnvironment(
+    input.env,
+    planned.plan.env,
+    input.options.wslDistro ? 'linux' : process.platform
+  )
+
   const startDiscovery = (): LocalProcessExecution<DiscoverCommitMessageModelsResult> => {
     let markProcessClosed!: () => void
     const processClosed = new Promise<void>((resolve) => {
@@ -53,18 +64,13 @@ export async function discoverModelsLocal(input: {
     })
     const result = new Promise<DiscoverCommitMessageModelsResult>((resolve) => {
       let child: SpawnedSourceControlAgentProcess
-      const planned = planModelDiscovery(spec, input.agentCommandOverride, input.backslash)
-      if (!planned.ok) {
-        markProcessClosed()
-        resolve({ success: false, error: planned.error })
-        return
-      }
       try {
         child = input.spawnAgent({
           binary: planned.plan.binary,
           args: planned.plan.args,
           cwd: input.options.cwd,
-          env: input.env,
+          env: input.options.wslDistro ? input.env : env,
+          commandEnv: planned.plan.env,
           wslDistro: input.options.wslDistro,
           stdinMode: planned.plan.stdinPayload === null ? 'ignore' : 'pipe',
           useCwdForNative: false
@@ -172,7 +178,7 @@ export async function discoverModelsLocal(input: {
   }
   return input.agentId === 'codex'
     ? runCodexProcessWithHomeLock(
-        resolveCodexHomeProcessLockKeyForSpawnEnv(input.env, input.options.wslDistro),
+        resolveCodexHomeProcessLockKeyForSpawnEnv(env, input.options.wslDistro, planned.plan.env),
         startDiscovery
       )
     : startDiscovery().result
diff --git a/src/main/text-generation/source-control-agent-launch.ts b/src/main/text-generation/source-control-agent-launch.ts
index 8587497d3183..709c04813903 100644
--- a/src/main/text-generation/source-control-agent-launch.ts
+++ b/src/main/text-generation/source-control-agent-launch.ts
@@ -39,15 +39,23 @@ function buildWslLauncherEnv(explicitEnv: NodeJS.ProcessEnv | undefined): NodeJS
 export const spawnSourceControlAgent: SpawnSourceControlAgent = (input) => {
   const spawnEnv = input.env ?? process.env
   if (process.platform === 'win32' && input.wslDistro) {
-    // Same contract as spawnProcess: stdout/stderr are piped; stdin matches stdinMode.
-    return wslAwareSpawn(input.binary, input.args, {
-      cwd: input.cwd,
-      env: buildWslLauncherEnv(input.env),
-      stdio: [input.stdinMode, 'pipe', 'pipe'],
-      windowsHide: true,
-      wslDistro: input.wslDistro,
-      useWslLoginShell: true
-    }) as SpawnedSourceControlAgentProcess
+    // Apply assignments in the guest after its login shell, not to the Windows launcher.
+    const assignments = Object.entries(input.commandEnv ?? {}).map(
+      ([key, value]) => `${key}=${value}`
+    )
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: WSL spawn pipes both output streams and supplies the configured stdin stream.
+    return wslAwareSpawn(
+      assignments.length ? '/usr/bin/env' : input.binary,
+      assignments.length ? [...assignments, input.binary, ...input.args] : input.args,
+      {
+        cwd: input.cwd,
+        env: buildWslLauncherEnv(input.env),
+        stdio: [input.stdinMode, 'pipe', 'pipe'],
+        windowsHide: true,
+        wslDistro: input.wslDistro,
+        useWslLoginShell: true
+      }
+    ) as SpawnedSourceControlAgentProcess
   }
   const resolvedBinary =
     process.platform === 'win32'
diff --git a/src/main/text-generation/source-control-local-generation.ts b/src/main/text-generation/source-control-local-generation.ts
index f388fd1b03a2..d918b1ef4877 100644
--- a/src/main/text-generation/source-control-local-generation.ts
+++ b/src/main/text-generation/source-control-local-generation.ts
@@ -1,3 +1,4 @@
+import { mergeCommandEnvironment } from '../../shared/command-environment'
 import type { CommitMessagePlan } from '../../shared/commit-message-plan'
 import {
   resolveCodexHomeProcessLockKeyForSpawnEnv,
@@ -25,13 +26,21 @@ export function runLocalPlanForAgent(input: {
   operation: TextGenerationOperation
   spawnAgent: SpawnSourceControlAgent
 }): Promise<InternalTextGenerationResult> {
+  const target = {
+    ...input.target,
+    env: mergeCommandEnvironment(
+      input.target.env,
+      input.plan.env,
+      input.target.wslDistro ? 'linux' : process.platform
+    )
+  }
   const start = (
     holdHomeLockUntilExit = false
   ): LocalProcessExecution<InternalTextGenerationResult> =>
     runLocalSourceControlPlan({
       plan: input.plan,
       cwd: input.target.cwd,
-      env: input.target.env,
+      env: input.target.wslDistro ? input.target.env : target.env,
       emptyResultName: input.emptyResultName,
       operation: input.operation,
       wslDistro: input.target.wslDistro,
@@ -41,13 +50,14 @@ export function runLocalPlanForAgent(input: {
   if (input.agentId !== 'codex') {
     return start().result
   }
-  return runCodexLocalPlanUnderHomeLock(start, input.target, input.operation)
+  return runCodexLocalPlanUnderHomeLock(start, target, input.operation, input.plan.env)
 }
 
 function runCodexLocalPlanUnderHomeLock(
   start: (holdHomeLockUntilExit: boolean) => LocalProcessExecution<InternalTextGenerationResult>,
   target: LocalGenerationTarget,
-  operation: TextGenerationOperation
+  operation: TextGenerationOperation,
+  commandEnv?: Record<string, string>
 ): Promise<InternalTextGenerationResult> {
   const laneKey = localGenerationLaneKey(operation, target.cwd)
   let canceledWhileQueued = false
@@ -69,7 +79,7 @@ function runCodexLocalPlanUnderHomeLock(
   }
   setLocalGenerationCancelToken(laneKey, queuedCancel)
   void withCodexHomeProcessLock(
-    resolveCodexHomeProcessLockKeyForSpawnEnv(target.env, target.wslDistro),
+    resolveCodexHomeProcessLockKeyForSpawnEnv(target.env, target.wslDistro, commandEnv),
     async () => {
       if (canceledWhileQueued) {
         publishResult({ success: false, error: 'Generation canceled.', canceled: true })
diff --git a/src/main/text-generation/source-control-local-process.ts b/src/main/text-generation/source-control-local-process.ts
index 3f046494f0fc..da1a2f9a139d 100644
--- a/src/main/text-generation/source-control-local-process.ts
+++ b/src/main/text-generation/source-control-local-process.ts
@@ -66,6 +66,7 @@ export function runLocalSourceControlPlan(input: {
         args: plan.args,
         cwd,
         env: input.env,
+        commandEnv: plan.env,
         wslDistro: input.wslDistro,
         stdinMode: 'pipe',
         useCwdForNative: true
diff --git a/src/main/text-generation/source-control-text-generation-types.ts b/src/main/text-generation/source-control-text-generation-types.ts
index 2a8f2c9b8c68..a7b74c35d3a3 100644
--- a/src/main/text-generation/source-control-text-generation-types.ts
+++ b/src/main/text-generation/source-control-text-generation-types.ts
@@ -88,6 +88,8 @@ export type SpawnSourceControlAgent = (input: {
   cwd?: string
   env?: NodeJS.ProcessEnv
   wslDistro?: string
+  // WSL applies these in the guest; native callers already merge them into env.
+  commandEnv?: Record<string, string>
   stdinMode: 'ignore' | 'pipe'
   useCwdForNative: boolean
 }) => SpawnedSourceControlAgentProcess
diff --git a/src/main/updater.feed-attempt-lifetime.test.ts b/src/main/updater.feed-attempt-lifetime.test.ts
new file mode 100644
index 000000000000..3df242dfa13d
--- /dev/null
+++ b/src/main/updater.feed-attempt-lifetime.test.ts
@@ -0,0 +1,124 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { loadUpdaterModule, warmUpdaterModule } from './updater-test-module-loader'
+
+const { autoUpdaterMock, fetchNewerReleaseTagsMock, moduleFactories, resetUpdaterMocks } =
+  await vi.hoisted(async () => (await import('./updater-test-harness')).createUpdaterMocks())
+
+vi.mock('electron', () => moduleFactories.electron())
+vi.mock('electron-updater', () => moduleFactories.electronUpdater())
+vi.mock('./electron-updater-loader', () => moduleFactories.electronUpdaterLoader())
+vi.mock('@electron-toolkit/utils', () => moduleFactories.electronToolkitUtils())
+vi.mock('./ipc/pty', () => moduleFactories.ipcPty())
+vi.mock('./linux-update-package-type', () => moduleFactories.linuxUpdatePackageType())
+vi.mock('./updater-lifecycle-diagnostics', () => moduleFactories.updaterLifecycleDiagnostics())
+vi.mock('./updater-changelog', () => moduleFactories.updaterChangelog())
+vi.mock('./updater-nudge', () => moduleFactories.updaterNudge())
+vi.mock('./update-install-exit-watchdog', () => moduleFactories.updateInstallExitWatchdog())
+vi.mock('./updater-prerelease-feed', () => moduleFactories.updaterPrereleaseFeed())
+vi.mock('./local-builds/local-build-switch', () => moduleFactories.localBuildSwitch())
+vi.mock('./local-builds/local-build-feed-server', () => moduleFactories.localBuildFeedServer())
+
+warmUpdaterModule()
+
+type FeedResult =
+  | { tags: string[]; state: 'ready' | 'no-newer' }
+  | { tags: string[]; state: 'not-ready'; lastGoodTag: string }
+
+const expiredResults: FeedResult[] = [
+  { tags: ['v2.0.0'], state: 'ready' },
+  { tags: [], state: 'no-newer' },
+  { tags: [], state: 'not-ready', lastGoodTag: 'v1.9.0' }
+]
+
+function holdFirstPreflight(): (value: FeedResult) => void {
+  let finish = (_value: FeedResult): void => {}
+  fetchNewerReleaseTagsMock.mockImplementationOnce(
+    () =>
+      new Promise<FeedResult>((resolve) => {
+        finish = resolve
+      })
+  )
+  return (value) => finish(value)
+}
+
+async function setup() {
+  const updater = await loadUpdaterModule()
+  const mainWindow = { webContents: { send: vi.fn() } }
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Only webContents.send is used; all native Electron APIs are mocked.
+  updater.setupAutoUpdater(mainWindow as never, { getLastUpdateCheckAt: () => Date.now() })
+  return updater
+}
+
+describe('updater feed preflight ownership', () => {
+  beforeEach(() => {
+    resetUpdaterMocks()
+    vi.useFakeTimers()
+    autoUpdaterMock.checkForUpdates.mockImplementation(() => new Promise(() => {}))
+  })
+
+  it.each(expiredResults)('does not repin after a timed-out $state result', async (result) => {
+    const finish = holdFirstPreflight()
+    const updater = await setup()
+    updater.checkForUpdatesFromMenu()
+    await vi.advanceTimersByTimeAsync(45_000)
+    const settledStatus = updater.getUpdateStatus()
+    expect(settledStatus.state).toBe('error')
+    autoUpdaterMock.setFeedURL.mockClear()
+
+    finish(result)
+    await vi.advanceTimersByTimeAsync(0)
+
+    expect(autoUpdaterMock.setFeedURL).not.toHaveBeenCalled()
+    expect(autoUpdaterMock.checkForUpdates).not.toHaveBeenCalled()
+    expect(updater.getUpdateStatus()).toBe(settledStatus)
+  })
+
+  it.each(['manual', 'background'] as const)(
+    'preserves a newer feed after an older %s preflight resolves',
+    async (kind) => {
+      const finishOld = holdFirstPreflight()
+      fetchNewerReleaseTagsMock.mockResolvedValueOnce({ tags: ['v3.0.0'], state: 'ready' })
+      const updater = await setup()
+      if (kind === 'manual') {
+        updater.checkForUpdatesFromMenu()
+      } else {
+        updater.checkForUpdates()
+      }
+      await vi.advanceTimersByTimeAsync(45_000)
+      updater.checkForUpdatesFromMenu()
+      await vi.advanceTimersByTimeAsync(0)
+      expect(autoUpdaterMock.checkForUpdates).toHaveBeenCalledTimes(1)
+      expect(autoUpdaterMock.setFeedURL).toHaveBeenLastCalledWith({
+        provider: 'generic',
+        url: 'https://github.com/stablyai/orca/releases/download/v3.0.0'
+      })
+      autoUpdaterMock.setFeedURL.mockClear()
+
+      finishOld({ tags: ['v2.0.0'], state: 'ready' })
+      await vi.advanceTimersByTimeAsync(0)
+
+      expect(autoUpdaterMock.setFeedURL).not.toHaveBeenCalled()
+      expect(autoUpdaterMock.checkForUpdates).toHaveBeenCalledTimes(1)
+    }
+  )
+
+  it.each([
+    {
+      result: { tags: ['v3.0.0'], state: 'ready' },
+      url: 'https://github.com/stablyai/orca/releases/download/v3.0.0'
+    },
+    {
+      result: { tags: [], state: 'no-newer' },
+      url: 'https://github.com/stablyai/orca/releases/latest/download'
+    }
+  ])('keeps the active $result.state feed choice', async ({ result, url }) => {
+    fetchNewerReleaseTagsMock.mockResolvedValueOnce(result)
+    const updater = await setup()
+    autoUpdaterMock.setFeedURL.mockClear()
+    updater.checkForUpdatesFromMenu()
+    await vi.advanceTimersByTimeAsync(0)
+    expect(autoUpdaterMock.setFeedURL).toHaveBeenCalledTimes(1)
+    expect(autoUpdaterMock.setFeedURL).toHaveBeenLastCalledWith({ provider: 'generic', url })
+    expect(autoUpdaterMock.checkForUpdates).toHaveBeenCalledTimes(1)
+  })
+})
diff --git a/src/main/updater.quit-and-install.test.ts b/src/main/updater.quit-and-install.test.ts
index 0080db58991e..d5ba376e02ea 100644
--- a/src/main/updater.quit-and-install.test.ts
+++ b/src/main/updater.quit-and-install.test.ts
@@ -183,6 +183,98 @@ describe('updater', () => {
     )
   })
 
+  it('aborts native install when required pre-quit cleanup fails', async () => {
+    vi.useFakeTimers()
+
+    const onBeforeQuit = vi.fn().mockRejectedValue(new Error('profile state export failed'))
+    const sendMock = vi.fn()
+    const mainWindow = { webContents: { send: sendMock } }
+    const { setupAutoUpdater, quitAndInstall, isQuittingForUpdate } = await loadUpdaterModule()
+
+    setupAutoUpdater(mainWindow as never, {
+      onBeforeQuit,
+      onBeforeQuitFailure: 'abort'
+    })
+    quitAndInstall()
+
+    await vi.advanceTimersByTimeAsync(100)
+
+    expect(onBeforeQuit).toHaveBeenCalledTimes(1)
+    expect(autoUpdaterMock.quitAndInstall).not.toHaveBeenCalled()
+    expect(killAllPtyMock).not.toHaveBeenCalled()
+    expect(isQuittingForUpdate()).toBe(false)
+    expect(sendMock).toHaveBeenCalledWith(
+      'updater:status',
+      expect.objectContaining({
+        state: 'error',
+        message: expect.stringContaining('Could not restart to install the update')
+      })
+    )
+  })
+
+  it('keeps optional pre-quit cleanup fail-and-continue behavior by default', async () => {
+    vi.useFakeTimers()
+
+    const onBeforeQuit = vi.fn().mockRejectedValue(new Error('optional cleanup failed'))
+    const mainWindow = { webContents: { send: vi.fn() } }
+    const { setupAutoUpdater, quitAndInstall } = await loadUpdaterModule()
+
+    setupAutoUpdater(mainWindow as never, { onBeforeQuit })
+    quitAndInstall()
+
+    await vi.advanceTimersByTimeAsync(100)
+
+    expect(onBeforeQuit).toHaveBeenCalledTimes(1)
+    expect(autoUpdaterMock.quitAndInstall).toHaveBeenCalledTimes(1)
+    expect(killAllPtyMock).toHaveBeenCalledTimes(1)
+  })
+
+  it('allows a required profile export to finish beyond the optional cleanup budget', async () => {
+    vi.useFakeTimers()
+    const onBeforeQuit = vi.fn(() => new Promise<void>((resolve) => setTimeout(resolve, 5_000)))
+    const mainWindow = { webContents: { send: vi.fn() } }
+    const { setupAutoUpdater, quitAndInstall } = await loadUpdaterModule()
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: updater only reads the mocked webContents.send in this lifecycle test.
+    setupAutoUpdater(mainWindow as never, { onBeforeQuit, onBeforeQuitFailure: 'abort' })
+    quitAndInstall()
+    await vi.advanceTimersByTimeAsync(2_600)
+    expect(autoUpdaterMock.quitAndInstall).not.toHaveBeenCalled()
+    await vi.advanceTimersByTimeAsync(2_500)
+    expect(autoUpdaterMock.quitAndInstall).toHaveBeenCalledOnce()
+  })
+
+  it('aborts native install when required pre-quit cleanup times out', async () => {
+    vi.useFakeTimers()
+
+    const onBeforeQuit = vi.fn(() => new Promise<void>(() => {}))
+    const sendMock = vi.fn()
+    const mainWindow = { webContents: { send: sendMock } }
+    const { setupAutoUpdater, quitAndInstall, isQuittingForUpdate } = await loadUpdaterModule()
+
+    setupAutoUpdater(mainWindow as never, {
+      onBeforeQuit,
+      onBeforeQuitFailure: 'abort'
+    })
+    quitAndInstall()
+
+    await vi.advanceTimersByTimeAsync(100)
+    expect(autoUpdaterMock.quitAndInstall).not.toHaveBeenCalled()
+
+    await vi.advanceTimersByTimeAsync(90_000)
+
+    expect(onBeforeQuit).toHaveBeenCalledTimes(1)
+    expect(autoUpdaterMock.quitAndInstall).not.toHaveBeenCalled()
+    expect(killAllPtyMock).not.toHaveBeenCalled()
+    expect(isQuittingForUpdate()).toBe(false)
+    expect(sendMock).toHaveBeenCalledWith(
+      'updater:status',
+      expect.objectContaining({
+        state: 'error',
+        message: expect.stringContaining('Could not restart to install the update')
+      })
+    )
+  })
+
   it('ignores duplicate quitAndInstall requests while the shared delay is pending', async () => {
     vi.useFakeTimers()
 
diff --git a/src/main/updater.ts b/src/main/updater.ts
index 756835d4e4d4..503e82606268 100644
--- a/src/main/updater.ts
+++ b/src/main/updater.ts
@@ -13,12 +13,12 @@ import type {
 import type { ReleaseBuild, ReleaseChannel } from '../shared/release-channel'
 import type { ReleaseBuildListOptions } from './updater-release-build-cache'
 import { UpdaterSetup, type UpdaterSetupOptions } from './updater/updater-setup'
-import type { UpdateInstallMode } from './updater/updater-state'
+import type { PreQuitCleanupFailureMode, UpdateInstallMode } from './updater/updater-state'
 
 // Keep one service instance so all public API calls share updater state and event listeners.
 const updater = new UpdaterSetup()
 
-export type { UpdateInstallMode, UpdaterSetupOptions }
+export type { PreQuitCleanupFailureMode, UpdateInstallMode, UpdaterSetupOptions }
 
 export function resolveUpdateInstallMode(isServeMode: boolean): UpdateInstallMode {
   return updater.resolveUpdateInstallMode(isServeMode)
diff --git a/src/main/updater/updater-install-support.ts b/src/main/updater/updater-install-support.ts
index 175362dad057..2da273e152e6 100644
--- a/src/main/updater/updater-install-support.ts
+++ b/src/main/updater/updater-install-support.ts
@@ -10,7 +10,7 @@ import { disarmUpdateInstallExitWatchdog } from '../update-install-exit-watchdog
 import { resetMacInstallState } from '../updater-mac-install'
 import type { LinuxPackageInstallRecovery, UpdateStatus } from '../../shared/update-status-types'
 import { compareVersions } from '../updater-fallback'
-import { PRE_QUIT_CLEANUP_TIMEOUT_MS } from './updater-state'
+import { PRE_QUIT_CLEANUP_TIMEOUT_MS, REQUIRED_PRE_QUIT_CLEANUP_TIMEOUT_MS } from './updater-state'
 import { UpdaterCheckState } from './updater-check-state'
 
 export abstract class UpdaterInstallSupport extends UpdaterCheckState {
@@ -137,6 +137,10 @@ export abstract class UpdaterInstallSupport extends UpdaterCheckState {
       return
     }
 
+    const timeoutMs =
+      this.onBeforeQuitFailure === 'abort'
+        ? REQUIRED_PRE_QUIT_CLEANUP_TIMEOUT_MS
+        : PRE_QUIT_CLEANUP_TIMEOUT_MS
     let timeout: ReturnType<typeof setTimeout> | null = null
     const cleanup = Promise.resolve()
       .then(() => this.onBeforeQuitCleanup?.())
@@ -146,29 +150,42 @@ export abstract class UpdaterInstallSupport extends UpdaterCheckState {
           { errorType: error instanceof Error ? error.name : typeof error },
           {
             level: 'warn',
-            message: 'Pre-quit cleanup failed; continuing update install'
+            message:
+              this.onBeforeQuitFailure === 'abort'
+                ? 'Pre-quit cleanup failed; aborting update install'
+                : 'Pre-quit cleanup failed; continuing update install'
           }
         )
+        if (this.onBeforeQuitFailure === 'abort') {
+          throw error
+        }
       })
     const timeoutResult = new Promise<'timeout'>((resolve) => {
-      timeout = setTimeout(() => resolve('timeout'), PRE_QUIT_CLEANUP_TIMEOUT_MS)
+      timeout = setTimeout(() => resolve('timeout'), timeoutMs)
     })
 
-    const result = await Promise.race([cleanup.then(() => 'done' as const), timeoutResult])
-    if (result === 'timeout') {
-      recordUpdaterLifecycle(
-        'pre_quit_cleanup_timeout',
-        { timeoutMs: PRE_QUIT_CLEANUP_TIMEOUT_MS },
-        {
-          level: 'warn',
-          message: `Pre-quit cleanup exceeded ${PRE_QUIT_CLEANUP_TIMEOUT_MS}ms; continuing update install`
+    try {
+      const result = await Promise.race([cleanup.then(() => 'done' as const), timeoutResult])
+      if (result === 'timeout') {
+        recordUpdaterLifecycle(
+          'pre_quit_cleanup_timeout',
+          { timeoutMs },
+          {
+            level: 'warn',
+            message:
+              this.onBeforeQuitFailure === 'abort'
+                ? `Pre-quit cleanup exceeded ${timeoutMs}ms; aborting update install`
+                : `Pre-quit cleanup exceeded ${timeoutMs}ms; continuing update install`
+          }
+        )
+        if (this.onBeforeQuitFailure === 'abort') {
+          throw new Error(`Pre-quit cleanup exceeded ${timeoutMs}ms before update install`)
         }
-      )
-      return
-    }
-
-    if (timeout) {
-      clearTimeout(timeout)
+      }
+    } finally {
+      if (timeout) {
+        clearTimeout(timeout)
+      }
     }
   }
 
diff --git a/src/main/updater/updater-release-feed.ts b/src/main/updater/updater-release-feed.ts
index 0dde5f943d46..98ede095fb83 100644
--- a/src/main/updater/updater-release-feed.ts
+++ b/src/main/updater/updater-release-feed.ts
@@ -115,13 +115,14 @@ export abstract class UpdaterReleaseFeed extends UpdaterInstallExecution {
   }
 
   /**
-   * `attemptId` is the check this preflight serves. A pinned or local-build jump that starts while
-   * the feed is still being read takes the attempt over; the preflight then reports `superseded`
-   * without touching the feed or the fallback context, so the jump's own pin stays in place.
+   * `attemptId` is the check this preflight serves, by default the one active when it starts. A
+   * pinned or local-build jump that starts while the feed is still being read takes the attempt
+   * over; the preflight then reports `superseded` without touching the feed or the fallback
+   * context, so the jump's own pin stays in place.
    */
   protected async pinDefaultReleaseFeed(
     variant: UpdateCheckVariant = 'default',
-    attemptId?: number
+    attemptId: number | null = this.activeUpdateCheckAttemptId
   ): Promise<ReleaseFeedPreflightResult> {
     const autoUpdater = this.getAutoUpdater()
     // Why: the latest/download redirect can move between check and download, so pin the concrete tag (prerelease users resolve any channel, stable only stable).
@@ -161,7 +162,8 @@ export abstract class UpdaterReleaseFeed extends UpdaterInstallExecution {
         ...(isPrimarySource ? {} : { source })
       }
     )
-    if (attemptId !== undefined && !this.isActiveUpdateCheckAttempt(attemptId)) {
+    // A timed-out preflight must not overwrite a newer check's feed.
+    if (attemptId === null || !this.isActiveUpdateCheckAttempt(attemptId)) {
       console.info(`[updater] release feed preflight superseded: current=${currentVersion}`)
       return 'superseded'
     }
diff --git a/src/main/updater/updater-setup.ts b/src/main/updater/updater-setup.ts
index 629df61250d6..d0b5b787fc30 100644
--- a/src/main/updater/updater-setup.ts
+++ b/src/main/updater/updater-setup.ts
@@ -23,7 +23,7 @@ import { getLatestReleaseDownloadUrl } from '../updater-release-urls'
 import { getReleaseSourceOrPrimary } from '../../shared/release-sources'
 import { AUTO_UPDATE_CHECK_INTERVAL_MS } from './updater-state'
 import { UpdaterDownloadInstall } from './updater-download-install'
-import type { UpdateInstallMode } from './updater-state'
+import type { PreQuitCleanupFailureMode, UpdateInstallMode } from './updater-state'
 
 export type UpdaterSetupOptions = {
   getLastUpdateCheckAt?: () => number | null
@@ -35,6 +35,7 @@ export type UpdaterSetupOptions = {
   setDismissedUpdateNudgeId?: (id: string | null) => void
   getReleaseChannelOverride?: () => ReleaseChannel | null
   installMode?: UpdateInstallMode
+  onBeforeQuitFailure?: PreQuitCleanupFailureMode
 }
 
 /** Initializes electron-updater and attaches lifecycle/event bridges. */
@@ -122,6 +123,7 @@ export class UpdaterSetup extends UpdaterDownloadInstall {
   setupAutoUpdater(mainWindow: BrowserWindow, opts?: UpdaterSetupOptions): void {
     this.mainWindowRef = mainWindow
     this.onBeforeQuitCleanup = opts?.onBeforeQuit ?? null
+    this.onBeforeQuitFailure = opts?.onBeforeQuitFailure ?? 'continue'
     this.persistLastUpdateCheckAt = opts?.setLastUpdateCheckAt ?? null
     this._getLastUpdateCheckAt = opts?.getLastUpdateCheckAt ?? null
     this._getPendingUpdateNudgeId = opts?.getPendingUpdateNudgeId ?? null
diff --git a/src/main/updater/updater-state.ts b/src/main/updater/updater-state.ts
index 179f11fb8089..9708177d4057 100644
--- a/src/main/updater/updater-state.ts
+++ b/src/main/updater/updater-state.ts
@@ -14,6 +14,8 @@ export const NUDGE_POLL_INTERVAL_MS = 30 * 60 * 1000
 export const NUDGE_ACTIVATION_COOLDOWN_MS = 5 * 60 * 1000
 export const QUIT_AND_INSTALL_DELAY_MS = 100
 export const PRE_QUIT_CLEANUP_TIMEOUT_MS = 2_500
+// Required profile exports may each wait for a bounded writer request.
+export const REQUIRED_PRE_QUIT_CLEANUP_TIMEOUT_MS = 90_000
 export const UPDATE_CHECK_SILENT_SETTLE_DELAY_MS = 1_000
 export const UPDATE_CHECK_STALL_TIMEOUT_MS = 45_000
 
@@ -26,6 +28,7 @@ export type UpdateInstallMode =
   | 'interactive'
   | 'supervised-headless-serve'
   | 'unsupported-headless-serve'
+export type PreQuitCleanupFailureMode = 'continue' | 'abort'
 
 // Why: expected preflight outcomes need typed context so UI routing never depends on matching error text.
 export class ReleaseFeedPreflightError extends Error {
@@ -44,6 +47,7 @@ export abstract class UpdaterState {
   protected currentStatus: UpdateStatus = { state: 'idle' }
   protected userInitiatedCheck = false
   protected onBeforeQuitCleanup: (() => void | Promise<void>) | null = null
+  protected onBeforeQuitFailure: PreQuitCleanupFailureMode = 'continue'
   protected autoUpdaterInitialized = false
   // Why: modifier-clicking "Check for Updates" targets prerelease manifests; the feed still pins a concrete tag so cancelled prereleases without manifests are skipped.
   protected includePrereleaseActive = false
diff --git a/src/main/usage/agent-token-usage-reporter.test.ts b/src/main/usage/agent-token-usage-reporter.test.ts
new file mode 100644
index 000000000000..b7cae3de3b52
--- /dev/null
+++ b/src/main/usage/agent-token-usage-reporter.test.ts
@@ -0,0 +1,151 @@
+import { existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { agentTokenUsageSchema } from '../../shared/telemetry-agent-token-usage-schema'
+import { _enableTransportForTests, _setShuttingDownForTests } from '../telemetry/client'
+import {
+  cleanupTelemetryClientTest,
+  setupTelemetryClientTest,
+  type TelemetryClientTestState
+} from '../telemetry/client-test-harness'
+import { resetBurstCapsForSession } from '../telemetry/burst-cap'
+import { UsageCacheSnapshotWriter } from '../usage-cache-snapshot-writer'
+import { AgentTokenUsageReporter } from './agent-token-usage-reporter'
+
+const ID = '00000000-0000-4000-8000-000000000001'
+const row = {
+  providerSessionId: 'private-provider-session',
+  input_tokens: 100,
+  output_tokens: 20,
+  cached_input_tokens: 50,
+  cache_write_input_tokens: 10
+}
+let directory: string
+let file: string
+let telemetry: TelemetryClientTestState
+let reporters: AgentTokenUsageReporter[]
+const identity = vi.fn(async () => ID)
+function reporter(): AgentTokenUsageReporter {
+  const instance = new AgentTokenUsageReporter(file, 'claude', identity)
+  reporters.push(instance)
+  return instance
+}
+function captures() {
+  return telemetry.mock.capture.mock.calls.map(([message]) => message.properties)
+}
+beforeEach(() => {
+  directory = mkdtempSync(join(tmpdir(), 'orca-token-usage-'))
+  file = join(directory, 'tokens.json')
+  telemetry = setupTelemetryClientTest()
+  reporters = []
+  identity.mockReset().mockResolvedValue(ID)
+})
+afterEach(async () => {
+  await Promise.all(reporters.map((instance) => instance.flush()))
+  cleanupTelemetryClientTest(telemetry.envStash)
+  vi.restoreAllMocks()
+  rmSync(directory, { recursive: true, force: true })
+})
+
+describe('agent token usage', () => {
+  it('persists before capture, omits provider IDs, and retains revisions across restarts', async () => {
+    telemetry.mock.capture.mockImplementation(() => {
+      expect(JSON.parse(readFileSync(file, 'utf8')).snapshots[0].revision).toBeGreaterThan(0)
+    })
+    const original = reporter()
+    await original.report([row])
+    await original.report([row])
+    expect(captures()).toHaveLength(1)
+    expect(captures()[0]).toMatchObject({
+      analytics_session_id: ID,
+      revision: 1,
+      input_tokens: 100
+    })
+    expect(JSON.stringify(captures())).not.toContain(row.providerSessionId)
+    await original.report([{ ...row, input_tokens: 150 }])
+    expect(captures()[1]).toMatchObject({ revision: 2, input_tokens: 150 })
+    await reporter().report([{ ...row, input_tokens: 150 }])
+    expect(captures()[2]).toMatchObject({ revision: 2, input_tokens: 150 })
+    await reporter().report([{ ...row, input_tokens: 90 }])
+    expect(captures()[3]).toMatchObject({ revision: 3, input_tokens: 90 })
+  })
+
+  it.each(['opt-out', 'pending', 'environment', 'build', 'shutdown'])(
+    'does no identity or disk work for %s',
+    async (gate) => {
+      if (gate === 'opt-out' && telemetry.settings.telemetry) {
+        telemetry.settings.telemetry.optedIn = false
+      }
+      if (gate === 'pending' && telemetry.settings.telemetry) {
+        telemetry.settings.telemetry.optedIn = null
+      }
+      if (gate === 'environment') {
+        process.env.DO_NOT_TRACK = '1'
+      }
+      if (gate === 'build') {
+        _enableTransportForTests(false)
+      }
+      if (gate === 'shutdown') {
+        _setShuttingDownForTests(true)
+      }
+      await reporter().report([row])
+      expect(identity).not.toHaveBeenCalled()
+      expect(existsSync(file)).toBe(false)
+      expect(captures()).toEqual([])
+    }
+  )
+
+  it('rechecks consent after asynchronous identity persistence', async () => {
+    identity.mockImplementation(async () => {
+      if (telemetry.settings.telemetry) {
+        telemetry.settings.telemetry.optedIn = false
+      }
+      return ID
+    })
+    await reporter().report([row])
+    expect(captures()).toEqual([])
+  })
+
+  it('does not publish a revision whose write failed and retries it', async () => {
+    const instance = reporter()
+    const write = vi
+      .spyOn(UsageCacheSnapshotWriter.prototype, 'write')
+      .mockRejectedValueOnce(new Error('disk full'))
+    await expect(instance.report([row])).rejects.toThrow('disk full')
+    expect(captures()).toEqual([])
+    write.mockRestore()
+    await instance.report([row])
+    expect(captures()[0]).toMatchObject({ revision: 1 })
+  })
+
+  it('retries rate-limited snapshots without incrementing their revision', async () => {
+    const instance = reporter()
+    for (let count = 1; count <= 31; count++) {
+      await instance.report([{ ...row, input_tokens: count }])
+    }
+    expect(captures()).toHaveLength(30)
+    resetBurstCapsForSession()
+    await instance.report([{ ...row, input_tokens: 31 }])
+    expect(captures().at(-1)).toMatchObject({ revision: 31, input_tokens: 31 })
+  })
+
+  it('rejects corrupt saved revisions without replacing them', async () => {
+    writeFileSync(file, '{broken')
+    await expect(reporter().report([row])).rejects.toThrow()
+    expect(readFileSync(file, 'utf8')).toBe('{broken')
+    expect(captures()).toEqual([])
+  })
+
+  it('rejects invalid counts and unexpected content fields', async () => {
+    await reporter().report([{ ...row, input_tokens: -1 }])
+    expect(identity).not.toHaveBeenCalled()
+    const payload = { ...row, analytics_session_id: ID, revision: 1, provider: 'claude' }
+    expect(agentTokenUsageSchema.safeParse(payload).success).toBe(false)
+    const { providerSessionId: _, ...valid } = payload
+    expect(agentTokenUsageSchema.safeParse(valid).success).toBe(true)
+    for (const field of ['prompt', 'path', 'model', 'activity_timestamp', 'estimated_cost']) {
+      expect(agentTokenUsageSchema.safeParse({ ...valid, [field]: 'private' }).success).toBe(false)
+    }
+  })
+})
diff --git a/src/main/usage/agent-token-usage-reporter.ts b/src/main/usage/agent-token-usage-reporter.ts
new file mode 100644
index 000000000000..d79b605500a0
--- /dev/null
+++ b/src/main/usage/agent-token-usage-reporter.ts
@@ -0,0 +1,122 @@
+import { readFile } from 'node:fs/promises'
+import { z } from 'zod'
+import {
+  agentTokenCountsSchema,
+  agentTokenUsageSchema,
+  type AgentTokenUsage
+} from '../../shared/telemetry-agent-token-usage-schema'
+import { isTelemetryEnabled, track } from '../telemetry/client'
+import { UsageCacheSnapshotWriter } from '../usage-cache-snapshot-writer'
+import type { AgentTokenSession } from './agent-token-usage'
+
+const stateSchema = z
+  .object({
+    schemaVersion: z.literal(1),
+    snapshots: z.array(agentTokenUsageSchema)
+  })
+  .strict()
+
+/** Cumulative snapshots: consumers select the highest revision per provider/session, never sum retries. */
+export class AgentTokenUsageReporter {
+  private snapshots: Map<string, AgentTokenUsage> | null = null
+  private readonly sent = new Map<string, number>()
+  private readonly writer: UsageCacheSnapshotWriter
+  private pending: Promise<void> = Promise.resolve()
+
+  constructor(
+    private readonly file: string,
+    private readonly provider: AgentTokenUsage['provider'],
+    private readonly getSessionId: (providerSessionId: string) => Promise<string>
+  ) {
+    this.writer = new UsageCacheSnapshotWriter('[agent-token-usage]', () => file)
+  }
+
+  report(sessions: AgentTokenSession[]): Promise<void> {
+    const operation = this.pending.then(() => this.publish(sessions))
+    this.pending = operation.catch(() => {})
+    return operation
+  }
+
+  async flush(): Promise<void> {
+    await this.pending
+    await this.writer.flush()
+  }
+
+  private async publish(sessions: AgentTokenSession[]): Promise<void> {
+    if (!isTelemetryEnabled()) {
+      return
+    }
+    const previous = this.snapshots ?? (await this.load())
+    const next = new Map(previous)
+    let changed = false
+    for (const { providerSessionId, ...counts } of sessions) {
+      if (!isTelemetryEnabled()) {
+        return
+      }
+      const parsed = agentTokenCountsSchema.safeParse(counts)
+      if (!parsed.success) {
+        continue
+      }
+      const id = await this.getSessionId(providerSessionId)
+      const existing = next.get(id)
+      if (
+        existing &&
+        existing.input_tokens === counts.input_tokens &&
+        existing.output_tokens === counts.output_tokens &&
+        existing.cached_input_tokens === counts.cached_input_tokens &&
+        existing.cache_write_input_tokens === counts.cache_write_input_tokens
+      ) {
+        continue
+      }
+      next.set(
+        id,
+        agentTokenUsageSchema.parse({
+          ...parsed.data,
+          provider: this.provider,
+          analytics_session_id: id,
+          revision: (existing?.revision ?? 0) + 1
+        })
+      )
+      changed = true
+    }
+    // Persist revisions before capture so a restart can only retry the same snapshot or a newer one.
+    if (changed) {
+      await this.writer.write(() =>
+        JSON.stringify({ schemaVersion: 1, snapshots: [...next.values()] })
+      )
+    }
+    this.snapshots = next
+    for (const snapshot of next.values()) {
+      if (this.sent.get(snapshot.analytics_session_id) === snapshot.revision) {
+        continue
+      }
+      if (!track('agent_token_usage', snapshot)) {
+        break
+      }
+      this.sent.set(snapshot.analytics_session_id, snapshot.revision)
+    }
+  }
+
+  private async load(): Promise<Map<string, AgentTokenUsage>> {
+    let content: string
+    try {
+      content = await readFile(this.file, 'utf8')
+    } catch (error) {
+      if (error && typeof error === 'object' && 'code' in error && error.code === 'ENOENT') {
+        return new Map()
+      }
+      throw error
+    }
+    const state = stateSchema.parse(JSON.parse(content))
+    const snapshots = new Map(
+      state.snapshots.map((snapshot) => [snapshot.analytics_session_id, snapshot])
+    )
+    if (
+      snapshots.size !== state.snapshots.length ||
+      state.snapshots.some((snapshot) => snapshot.provider !== this.provider)
+    ) {
+      throw new Error('Invalid agent token usage state')
+    }
+    return snapshots
+  }
+}
diff --git a/src/main/usage/agent-token-usage.test.ts b/src/main/usage/agent-token-usage.test.ts
new file mode 100644
index 000000000000..e18c825212a6
--- /dev/null
+++ b/src/main/usage/agent-token-usage.test.ts
@@ -0,0 +1,117 @@
+import { describe, expect, it } from 'vitest'
+import type { ClaudeUsageSession } from '../claude-usage/types'
+import type { CodexUsageSession } from '../codex-usage/types'
+import type { OpenCodeUsageSession } from '../opencode-usage/types'
+import { claudeTokenSessions, codexOpenCodeTokenSessions } from './agent-token-usage'
+
+const claudeLocation = {
+  locationKey: '/private/path',
+  projectLabel: 'private-repo',
+  repoId: 'repo',
+  worktreeId: 'folder',
+  turnCount: 1,
+  inputTokens: 100,
+  outputTokens: 20,
+  cacheReadTokens: 30,
+  cacheWriteTokens: 10,
+  cacheWrite1hTokens: 5
+}
+const claude: ClaudeUsageSession = {
+  sessionId: 'session',
+  firstTimestamp: 'private-start',
+  lastTimestamp: 'private-end',
+  model: 'private-model',
+  lastCwd: '/private/path',
+  lastGitBranch: 'private-branch',
+  primaryWorktreeId: 'folder',
+  primaryRepoId: 'repo',
+  turnCount: 2,
+  totalInputTokens: 200,
+  totalOutputTokens: 40,
+  totalCacheReadTokens: 60,
+  totalCacheWriteTokens: 20,
+  totalCacheWrite1hTokens: 10,
+  locationBreakdown: [claudeLocation, { ...claudeLocation, worktreeId: null }]
+}
+const codexLocation = {
+  locationKey: '/private/path',
+  projectLabel: 'private-repo',
+  repoId: 'repo',
+  worktreeId: 'folder',
+  eventCount: 1,
+  inputTokens: 100,
+  cachedInputTokens: 30,
+  outputTokens: 20,
+  reasoningOutputTokens: 5,
+  totalTokens: 120,
+  hasInferredPricing: false,
+  longContextInputTokens: 0,
+  longContextCachedInputTokens: 0,
+  longContextOutputTokens: 0,
+  estimatedCostUsd: 1
+}
+const codex: CodexUsageSession = {
+  sessionId: 'session',
+  firstTimestamp: 'private-start',
+  lastTimestamp: 'private-end',
+  primaryModel: 'private-model',
+  hasMixedModels: false,
+  primaryProjectLabel: 'private-repo',
+  hasMixedLocations: true,
+  primaryWorktreeId: 'folder',
+  primaryRepoId: 'repo',
+  eventCount: 2,
+  totalInputTokens: 200,
+  totalCachedInputTokens: 60,
+  totalOutputTokens: 40,
+  totalReasoningOutputTokens: 10,
+  totalTokens: 240,
+  hasInferredPricing: false,
+  longContextInputTokens: 0,
+  longContextCachedInputTokens: 0,
+  longContextOutputTokens: 0,
+  locationBreakdown: [codexLocation, { ...codexLocation, worktreeId: null }],
+  modelBreakdown: [],
+  locationModelBreakdown: []
+}
+const opencode: OpenCodeUsageSession = {
+  ...codex,
+  estimatedCostUsd: 2,
+  locationBreakdown: [codexLocation, { ...codexLocation, worktreeId: null }],
+  modelBreakdown: [],
+  locationModelBreakdown: []
+}
+
+describe('Orca token projections', () => {
+  it('counts Claude cache writes once including the 1-hour subset and excludes outside usage', () => {
+    expect(claudeTokenSessions([claude])).toEqual([
+      {
+        providerSessionId: 'session',
+        input_tokens: 100,
+        output_tokens: 20,
+        cached_input_tokens: 30,
+        cache_write_input_tokens: 10
+      }
+    ])
+  })
+  it.each([codex, opencode])('separates cache reads from inclusive input counts', (session) => {
+    expect(codexOpenCodeTokenSessions([session])).toEqual([
+      {
+        providerSessionId: 'session',
+        input_tokens: 70,
+        output_tokens: 20,
+        cached_input_tokens: 30,
+        cache_write_input_tokens: 0
+      }
+    ])
+  })
+  it('does not fall back to unscoped session totals when attribution is missing', () => {
+    expect(claudeTokenSessions([{ ...claude, locationBreakdown: [] }])).toEqual([])
+    expect(codexOpenCodeTokenSessions([{ ...codex, locationBreakdown: [] }])).toEqual([])
+    expect(
+      codexOpenCodeTokenSessions([
+        { ...codex, locationBreakdown: [{ ...codexLocation, worktreeId: null }] }
+      ])
+    ).toEqual([])
+  })
+})
diff --git a/src/main/usage/agent-token-usage.ts b/src/main/usage/agent-token-usage.ts
new file mode 100644
index 000000000000..36cada6cf01f
--- /dev/null
+++ b/src/main/usage/agent-token-usage.ts
@@ -0,0 +1,48 @@
+import type { AgentTokenCounts } from '../../shared/telemetry-agent-token-usage-schema'
+import type { ClaudeUsageSession } from '../claude-usage/types'
+import type { CodexUsageSession } from '../codex-usage/types'
+import type { OpenCodeUsageSession } from '../opencode-usage/types'
+
+export type AgentTokenSession = AgentTokenCounts & { providerSessionId: string }
+
+export function claudeTokenSessions(sessions: ClaudeUsageSession[]): AgentTokenSession[] {
+  return sessions.flatMap((session) => {
+    const locations = session.locationBreakdown.filter((entry) => entry.worktreeId !== null)
+    if (locations.length === 0) {
+      return []
+    }
+    return [
+      {
+        providerSessionId: session.sessionId,
+        input_tokens: locations.reduce((sum, entry) => sum + entry.inputTokens, 0),
+        output_tokens: locations.reduce((sum, entry) => sum + entry.outputTokens, 0),
+        cached_input_tokens: locations.reduce((sum, entry) => sum + entry.cacheReadTokens, 0),
+        cache_write_input_tokens: locations.reduce((sum, entry) => sum + entry.cacheWriteTokens, 0)
+      }
+    ]
+  })
+}
+
+export function codexOpenCodeTokenSessions(
+  sessions: (CodexUsageSession | OpenCodeUsageSession)[]
+): AgentTokenSession[] {
+  return sessions.flatMap((session) => {
+    const locations = session.locationBreakdown.filter((entry) => entry.worktreeId !== null)
+    if (locations.length === 0) {
+      return []
+    }
+    return [
+      {
+        providerSessionId: session.sessionId,
+        // Codex/OpenCode include cache hits in input; Claude records them separately.
+        input_tokens: locations.reduce(
+          (sum, entry) => sum + entry.inputTokens - entry.cachedInputTokens,
+          0
+        ),
+        output_tokens: locations.reduce((sum, entry) => sum + entry.outputTokens, 0),
+        cached_input_tokens: locations.reduce((sum, entry) => sum + entry.cachedInputTokens, 0),
+        cache_write_input_tokens: 0
+      }
+    ]
+  })
+}
diff --git a/src/main/usage/analytics-session-id-store.test.ts b/src/main/usage/analytics-session-id-store.test.ts
new file mode 100644
index 000000000000..3ec5addfad25
--- /dev/null
+++ b/src/main/usage/analytics-session-id-store.test.ts
@@ -0,0 +1,197 @@
+import { existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import type * as FsPromises from 'node:fs/promises'
+import { join } from 'node:path'
+import { tmpdir } from 'node:os'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { AnalyticsSessionIdStore } from './analytics-session-id-store'
+
+type WriteGate = { entered: (() => void) | null; wait: Promise<void> | null; fail: boolean }
+
+const { writeGate } = vi.hoisted((): { writeGate: WriteGate } => ({
+  writeGate: {
+    entered: null,
+    wait: null,
+    fail: false
+  }
+}))
+vi.mock('node:fs/promises', async () => {
+  const actual = await vi.importActual<typeof FsPromises>('node:fs/promises')
+  return {
+    ...actual,
+    open: async (...args: Parameters<typeof actual.open>) => {
+      if (args[1] === 'w') {
+        writeGate.entered?.()
+        if (writeGate.wait) {
+          await writeGate.wait
+        }
+        if (writeGate.fail) {
+          throw new Error('simulated disk failure')
+        }
+      }
+      return actual.open(...args)
+    }
+  }
+})
+
+const UUID_V4 = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/
+let directory: string
+let file: string
+let stores: AnalyticsSessionIdStore[]
+/** Registers every instance for flush-before-cleanup, including simulated restarts. */
+function createStore(path = file): AnalyticsSessionIdStore {
+  const store = new AnalyticsSessionIdStore(path)
+  stores.push(store)
+  return store
+}
+beforeEach(() => {
+  directory = mkdtempSync(join(tmpdir(), 'orca-analytics-session-id-'))
+  file = join(directory, 'identities.json')
+  stores = []
+  writeGate.entered = null
+  writeGate.wait = null
+  writeGate.fail = false
+})
+afterEach(async () => {
+  await Promise.all(stores.map((store) => store.flush()))
+  rmSync(directory, { recursive: true, force: true })
+  vi.restoreAllMocks()
+})
+
+describe('AnalyticsSessionIdStore', () => {
+  it('is lazy and persists a random ID before returning it', async () => {
+    const store = createStore()
+    expect(existsSync(file)).toBe(false)
+    const id = await store.getOrCreate('provider-session-123')
+    expect(id).toMatch(UUID_V4)
+    expect(id).not.toContain('provider-session')
+    expect(JSON.parse(readFileSync(file, 'utf8'))).toEqual({
+      schemaVersion: 1,
+      entries: [['provider-session-123', id]]
+    })
+    expect(await store.getOrCreate('provider-session-123')).toBe(id)
+  })
+
+  it('restores the ID after a restart or session resume', async () => {
+    const original = createStore()
+    const id = await original.getOrCreate('resumed-session')
+    await original.flush()
+    expect(await createStore().getOrCreate('resumed-session')).toBe(id)
+  })
+
+  it('handles concurrent requests for the same and different sessions without lost writes', async () => {
+    const store = createStore()
+    const ids = await Promise.all(
+      Array.from({ length: 20 }, (_, index) => store.getOrCreate(`session-${index % 10}`))
+    )
+    expect(new Set(ids).size).toBe(10)
+    expect(ids.slice(0, 10)).toEqual(ids.slice(10))
+    const restored = createStore()
+    for (let index = 0; index < 10; index++) {
+      expect(await restored.getOrCreate(`session-${index}`)).toBe(ids[index])
+    }
+  })
+
+  it('isolates identical provider session IDs across provider and host/profile files', async () => {
+    const ids = await Promise.all([
+      createStore(join(directory, 'host-a', 'claude.json')).getOrCreate('same-session'),
+      createStore(join(directory, 'host-a', 'codex.json')).getOrCreate('same-session'),
+      createStore(join(directory, 'host-b', 'claude.json')).getOrCreate('same-session')
+    ])
+    expect(new Set(ids).size).toBe(3)
+  })
+
+  it.each(['', '   ', 'x'.repeat(1025)])(
+    'rejects invalid keys without creating a mapping',
+    async (key) => {
+      await expect(createStore().getOrCreate(key)).rejects.toThrow('Invalid provider session ID')
+      expect(existsSync(file)).toBe(false)
+    }
+  )
+
+  it('handles prototype names and delimiter characters as ordinary opaque keys', async () => {
+    const store = createStore()
+    const keys = ['__proto__', 'constructor', 'a::b/c', 'a/b::c']
+    const ids = await Promise.all(keys.map((key) => store.getOrCreate(key)))
+    expect(new Set(ids).size).toBe(keys.length)
+    const restored = createStore()
+    expect(await Promise.all(keys.map((key) => restored.getOrCreate(key)))).toEqual(ids)
+  })
+
+  it.each([
+    '{broken',
+    JSON.stringify({ schemaVersion: 2, entries: [] }),
+    JSON.stringify({ schemaVersion: 1, entries: [['session', 'provider-id']] }),
+    JSON.stringify({ schemaVersion: 1, entries: [], extra: 'secret' })
+  ])('fails closed on invalid persisted state without overwriting it', async (content) => {
+    writeFileSync(file, content)
+    await expect(createStore().getOrCreate('new-session')).rejects.toThrow(
+      'Invalid analytics session identity file'
+    )
+    expect(readFileSync(file, 'utf8')).toBe(content)
+  })
+
+  it('rejects conflicting provider keys and analytics IDs', async () => {
+    const first = '00000000-0000-4000-8000-000000000001'
+    const second = '00000000-0000-4000-8000-000000000002'
+    for (const entries of [
+      [
+        ['a', first],
+        ['a', second]
+      ],
+      [
+        ['a', first],
+        ['b', first]
+      ]
+    ]) {
+      writeFileSync(file, JSON.stringify({ schemaVersion: 1, entries }))
+      await expect(createStore().getOrCreate('new-session')).rejects.toThrow(
+        'Duplicate analytics session identity'
+      )
+    }
+  })
+
+  it('keeps all callers and shutdown waiting until the ID write completes', async () => {
+    let release!: () => void
+    let entered!: () => void
+    writeGate.wait = new Promise<void>((resolve) => {
+      release = resolve
+    })
+    const writing = new Promise<void>((resolve) => {
+      entered = resolve
+    })
+    writeGate.entered = entered
+    const store = createStore()
+    let resolved = false
+    let flushed = false
+    const first = store.getOrCreate('session').then((id) => {
+      resolved = true
+      return id
+    })
+    await writing
+    const second = store.getOrCreate('session')
+    const flush = store.flush().then(() => {
+      flushed = true
+    })
+    try {
+      await Promise.resolve()
+      expect(resolved).toBe(false)
+      expect(flushed).toBe(false)
+    } finally {
+      release()
+    }
+    expect(await first).toBe(await second)
+    await flush
+    expect(flushed).toBe(true)
+  })
+
+  it('does not return an unpersisted ID on write failure and allows retry', async () => {
+    vi.spyOn(console, 'error').mockImplementation(() => {})
+    const store = createStore()
+    writeGate.fail = true
+    await expect(store.getOrCreate('session')).rejects.toThrow('simulated disk failure')
+    expect(existsSync(file)).toBe(false)
+    writeGate.fail = false
+    const id = await store.getOrCreate('session')
+    expect(await createStore().getOrCreate('session')).toBe(id)
+  })
+})
diff --git a/src/main/usage/analytics-session-id-store.ts b/src/main/usage/analytics-session-id-store.ts
new file mode 100644
index 000000000000..0b921e8efaae
--- /dev/null
+++ b/src/main/usage/analytics-session-id-store.ts
@@ -0,0 +1,88 @@
+import { randomUUID } from 'node:crypto'
+import { readFile } from 'node:fs/promises'
+import { z } from 'zod'
+import { UsageCacheSnapshotWriter } from '../usage-cache-snapshot-writer'
+
+const providerSessionIdSchema = z
+  .string()
+  .min(1)
+  .max(1024)
+  .refine((id) => id.trim().length > 0)
+const analyticsSessionIdSchema = z.uuidv4().brand<'AnalyticsSessionId'>()
+export type AnalyticsSessionId = z.infer<typeof analyticsSessionIdSchema>
+const identityFileSchema = z
+  .object({
+    schemaVersion: z.literal(1),
+    entries: z.array(z.tuple([providerSessionIdSchema, analyticsSessionIdSchema]))
+  })
+  .strict()
+
+/** One owner per file, scoped to a provider's usage store on its execution host. */
+export class AnalyticsSessionIdStore {
+  private identities: Map<string, AnalyticsSessionId> | null = null
+  private pending: Promise<void> = Promise.resolve()
+  private writer: UsageCacheSnapshotWriter | null = null
+
+  constructor(private readonly file: string) {}
+
+  /** Resolves only after persistence succeeds, so an uploaded ID survives a restart. */
+  async getOrCreate(providerSessionId: string): Promise<AnalyticsSessionId> {
+    if (!providerSessionIdSchema.safeParse(providerSessionId).success) {
+      throw new Error('Invalid provider session ID')
+    }
+    // Serialize reads as well as writes so no caller sees an ID before it is durable.
+    const operation = this.pending.then(async () => {
+      const identities = this.identities ?? (await this.load())
+      this.identities = identities
+      const existing = identities.get(providerSessionId)
+      if (existing) {
+        return existing
+      }
+      const id = analyticsSessionIdSchema.parse(randomUUID())
+      const updated = new Map(identities).set(providerSessionId, id)
+      this.writer ??= new UsageCacheSnapshotWriter('[analytics-session-id]', () => this.file)
+      await this.writer.write(() => JSON.stringify({ schemaVersion: 1, entries: [...updated] }))
+      this.identities = updated
+      return id
+    })
+    this.pending = operation.then(
+      () => {},
+      () => {}
+    )
+    return operation
+  }
+
+  /** Includes queued lookups that have not reached the durable writer yet. */
+  async flush(): Promise<void> {
+    await this.pending
+    await this.writer?.flush()
+  }
+
+  private async load(): Promise<Map<string, AnalyticsSessionId>> {
+    let content: string
+    try {
+      content = await readFile(this.file, 'utf8')
+    } catch (error) {
+      if (error && typeof error === 'object' && 'code' in error && error.code === 'ENOENT') {
+        return new Map()
+      }
+      throw error
+    }
+    let raw: unknown
+    try {
+      raw = JSON.parse(content)
+    } catch {
+      throw new Error('Invalid analytics session identity file')
+    }
+    const parsed = identityFileSchema.safeParse(raw)
+    if (!parsed.success) {
+      throw new Error('Invalid analytics session identity file')
+    }
+    const identities = new Map(parsed.data.entries)
+    const analyticsIds = new Set(parsed.data.entries.map(([, id]) => id))
+    if (identities.size !== parsed.data.entries.length || analyticsIds.size !== identities.size) {
+      throw new Error('Duplicate analytics session identity')
+    }
+    return identities
+  }
+}
diff --git a/src/main/usage/usage-provider-store-lifecycle.test.ts b/src/main/usage/usage-provider-store-lifecycle.test.ts
index 02a5571363dc..ef8c820052a7 100644
--- a/src/main/usage/usage-provider-store-lifecycle.test.ts
+++ b/src/main/usage/usage-provider-store-lifecycle.test.ts
@@ -1,3 +1,7 @@
+import {
+  setupTelemetryClientTest,
+  cleanupTelemetryClientTest
+} from '../telemetry/client-test-harness'
 import { existsSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from 'node:fs'
 import type * as FsPromises from 'node:fs/promises'
 import { tmpdir } from 'node:os'
@@ -106,6 +110,17 @@ class TestUsageStore extends UsageProviderStoreLifecycle<
         getAllWorktreeMeta: () => ({})
       },
       {
+        tokenUsage: {
+          provider: 'claude',
+          selectSessions: (state) =>
+            state.sessions.map((session) => ({
+              providerSessionId: session.id,
+              input_tokens: 10,
+              output_tokens: 2,
+              cached_input_tokens: 3,
+              cache_write_input_tokens: 1
+            }))
+        },
         logTag: '[test-usage]',
         resolveCacheFile: () => cacheFile,
         createDefaultState: makeState,
@@ -156,6 +171,60 @@ describe('UsageProviderStoreLifecycle', () => {
     vi.restoreAllMocks()
   })
 
+  it('reports enabled scans and preserves revisions when the usage cache is rebuilt', async () => {
+    const telemetry = setupTelemetryClientTest()
+    try {
+      const cacheFile = join(tempDirectory, 'provider.json')
+      scan.mockResolvedValue({ ...emptyScanResult(), sessions: [{ id: 'provider-session' }] })
+      const original = createStore(cacheFile)
+      await original.refresh(true)
+      expect(telemetry.mock.capture).not.toHaveBeenCalled()
+      await original.setEnabled(true)
+      await original.refresh(true)
+      const first = telemetry.mock.capture.mock.calls[0]?.[0]
+      expect(first).toMatchObject({
+        event: 'agent_token_usage',
+        properties: { revision: 1, input_tokens: 10 }
+      })
+      await original.flush()
+      rmSync(cacheFile)
+      const rebuilt = createStore(cacheFile)
+      await rebuilt.setEnabled(true)
+      await rebuilt.refresh(true)
+      expect(telemetry.mock.capture.mock.calls[1]?.[0]).toEqual(first)
+    } finally {
+      cleanupTelemetryClientTest(telemetry.envStash)
+    }
+  })
+
+  it('keeps analytics identity separate from usage cache rebuilds and never puts it in snapshots', async () => {
+    const cacheFile = join(tempDirectory, 'provider.json')
+    const identityFile = join(tempDirectory, 'provider-analytics-session-ids.json')
+    const original = createStore(cacheFile)
+    expect(existsSync(identityFile)).toBe(false)
+    const id = await original.getAnalyticsSessionId('provider-session')
+    expect(existsSync(identityFile)).toBe(true)
+    await original.setEnabled(true)
+    await original.refresh(true)
+    await original.flush()
+    expect(JSON.stringify(original.getState())).not.toContain(id)
+    expect(readFileSync(cacheFile, 'utf8')).not.toContain(id)
+    rmSync(cacheFile)
+    const rebuilt = createStore(cacheFile)
+    expect(await rebuilt.getAnalyticsSessionId('provider-session')).toBe(id)
+    expect(await createStore().getAnalyticsSessionId('provider-session')).not.toBe(id)
+  })
+
+  it('flush waits for queued analytics identity creation', async () => {
+    const store = createStore()
+    const identity = store.getAnalyticsSessionId('session')
+    await store.flush()
+    const id = await identity
+    expect(
+      readFileSync(join(tempDirectory, 'usage-0-analytics-session-ids.json'), 'utf8')
+    ).toContain(id)
+  })
+
   it('skips disabled and fresh matching states', async () => {
     const store = createStore()
 
diff --git a/src/main/usage/usage-provider-store-lifecycle.ts b/src/main/usage/usage-provider-store-lifecycle.ts
index 850d9e61bda9..bbfd4be8e133 100644
--- a/src/main/usage/usage-provider-store-lifecycle.ts
+++ b/src/main/usage/usage-provider-store-lifecycle.ts
@@ -1,4 +1,10 @@
 import { existsSync, readFileSync } from 'node:fs'
+import { AgentTokenUsageReporter } from './agent-token-usage-reporter'
+import type { AgentTokenSession } from './agent-token-usage'
+import type { AgentTokenUsage } from '../../shared/telemetry-agent-token-usage-schema'
+import { isTelemetryEnabled } from '../telemetry/client'
+import { join, parse } from 'node:path'
+import { AnalyticsSessionIdStore, type AnalyticsSessionId } from './analytics-session-id-store'
 import type { Store } from '../persistence'
 import { UsageCacheSnapshotWriter } from '../usage-cache-snapshot-writer'
 import { loadKnownUsageWorktreesByRepo } from '../usage-worktree-metadata'
@@ -38,6 +44,10 @@ type UsageProviderStoreLifecycleConfig<
   sourceKey: SourceKey
   dataPresenceKey: DataPresenceKey
   jsonIndent?: number
+  tokenUsage?: {
+    provider: AgentTokenUsage['provider']
+    selectSessions: (state: State) => AgentTokenSession[]
+  }
   scan: (
     worktrees: UsageScanWorktreeRef[],
     previous: State[SourceKey]
@@ -55,6 +65,8 @@ export abstract class UsageProviderStoreLifecycle<
 > {
   protected state: State
   private scanPromise: Promise<void> | null = null
+  private tokenReporter: AgentTokenUsageReporter | null = null
+  private analyticsSessionIds: AnalyticsSessionIdStore | null = null
   private readonly writer: UsageCacheSnapshotWriter
 
   constructor(
@@ -74,9 +86,21 @@ export abstract class UsageProviderStoreLifecycle<
     } as PublicUsageProviderScanState<DataPresenceKey>
   }
 
+  /** Local identity only; callers must use the usage store on the execution host. */
+  getAnalyticsSessionId(providerSessionId: string): Promise<AnalyticsSessionId> {
+    if (!this.analyticsSessionIds) {
+      const { dir, name } = parse(this.config.resolveCacheFile())
+      this.analyticsSessionIds = new AnalyticsSessionIdStore(
+        join(dir, `${name}-analytics-session-ids.json`)
+      )
+    }
+    return this.analyticsSessionIds.getOrCreate(providerSessionId)
+  }
+
   /** Await queued cache writes so quit does not drop the final snapshot. */
-  flush(): Promise<void> {
-    return this.writer.flush()
+  async flush(): Promise<void> {
+    await this.tokenReporter?.flush()
+    await Promise.all([this.writer.flush(), this.analyticsSessionIds?.flush()])
   }
 
   async setEnabled(enabled: boolean): Promise<PublicUsageProviderScanState<DataPresenceKey>> {
@@ -152,6 +176,7 @@ export abstract class UsageProviderStoreLifecycle<
         this.state.scanState.lastScanError = null
         // Persistence failures do not turn a successful source scan into a scan failure.
         await this.writeToDisk().catch(() => {})
+        await this.reportTokenUsage()
       } catch (error) {
         this.state.scanState.lastScanError = error instanceof Error ? error.message : String(error)
         await this.writeToDisk().catch(() => {})
@@ -163,6 +188,29 @@ export abstract class UsageProviderStoreLifecycle<
     await this.scanPromise
   }
 
+  private async reportTokenUsage(): Promise<void> {
+    const config = this.config.tokenUsage
+    if (!config || !isTelemetryEnabled() || !this.state.scanState.enabled) {
+      return
+    }
+    try {
+      if (!this.tokenReporter) {
+        const { dir, name } = parse(this.config.resolveCacheFile())
+        this.tokenReporter = new AgentTokenUsageReporter(
+          join(dir, `${name}-token-usage.json`),
+          config.provider,
+          (id) => this.getAnalyticsSessionId(id)
+        )
+      }
+      await this.tokenReporter.report(config.selectSessions(this.state))
+    } catch {
+      // Reporting failures must not invalidate a successful local usage scan.
+      console.warn(
+        '[agent-token-usage] Could not report token usage; will retry after the next scan'
+      )
+    }
+  }
+
   private async getCurrentWorktreeFingerprint(): Promise<string> {
     const repos = this.store.getRepos()
     return getUsageWorktreeFingerprint(loadKnownUsageWorktreesByRepo(this.store, repos))
diff --git a/src/main/window/attach-main-window-services.test.ts b/src/main/window/attach-main-window-services.test.ts
index ae83f5b77124..9e5c5493f095 100644
--- a/src/main/window/attach-main-window-services.test.ts
+++ b/src/main/window/attach-main-window-services.test.ts
@@ -1,5 +1,6 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import type { Store } from '../persistence'
+import type { RuntimeNotifier } from '../runtime/runtime-notifier-contract'
 
 const {
   onMock,
@@ -154,7 +155,7 @@ type MainWindowStub = {
 
 type RuntimeStub = {
   attachWindow: MockFn
-  setNotifier: MockFn
+  setNotifier: ReturnType<typeof vi.fn<(notifier: RuntimeNotifier | null) => void>>
   markRendererReloading: MockFn
   markRendererReloadCancelled: MockFn
   markGraphReloadFailed: MockFn
@@ -195,7 +196,7 @@ function createStore(): Store & { flushPendingAsync: MockFn } {
 function createRuntime(): RuntimeStub {
   return {
     attachWindow: vi.fn(),
-    setNotifier: vi.fn(),
+    setNotifier: vi.fn<(notifier: RuntimeNotifier | null) => void>(),
     markRendererReloading: vi.fn(),
     markRendererReloadCancelled: vi.fn(),
     markGraphReloadFailed: vi.fn(),
@@ -290,8 +291,7 @@ describe('attachMainWindowServices', () => {
     await providerStartup.promise
     await Promise.resolve()
 
-    expect(hydrateLocalPtyRegistryAtBootMock).toHaveBeenCalledOnce()
-    expect(hydrateLocalPtyRegistryAtBootMock).toHaveBeenCalledWith(store)
+    expect(hydrateLocalPtyRegistryAtBootMock).toHaveBeenCalledExactlyOnceWith(store)
   })
 
   it('passes injected update quit cleanup to the auto-updater', async () => {
@@ -305,17 +305,23 @@ describe('attachMainWindowServices', () => {
       createRuntime() as never,
       undefined,
       undefined,
-      { onBeforeUpdateQuit, updateInstallMode: 'supervised-headless-serve' }
+      {
+        onBeforeUpdateQuit,
+        onBeforeUpdateQuitFailure: 'abort',
+        updateInstallMode: 'supervised-headless-serve'
+      }
     )
 
     // Deferred to first paint — must not be configured at attach time.
     expect(setupAutoUpdaterMock).not.toHaveBeenCalled()
     await fireReadyToShow(mainWindow)
     expect(setupAutoUpdaterMock).toHaveBeenCalledTimes(1)
-    expect(setupAutoUpdaterMock).toHaveBeenCalledWith(
-      mainWindow,
-      expect.objectContaining({ installMode: 'supervised-headless-serve' })
-    )
+    const [updaterWindow, updaterOptions] = setupAutoUpdaterMock.mock.calls[0]
+    expect(updaterWindow).toBe(mainWindow)
+    expect(updaterOptions).toMatchObject({
+      installMode: 'supervised-headless-serve',
+      onBeforeQuitFailure: 'abort'
+    })
     await setupAutoUpdaterMock.mock.calls[0][1].onBeforeQuit()
 
     expect(onBeforeUpdateQuit).toHaveBeenCalledTimes(1)
@@ -758,14 +764,9 @@ describe('attachMainWindowServices', () => {
     attachMainWindowServices(mainWindow as never, createStore(), runtime as never)
 
     expect(runtime.setNotifier).toHaveBeenCalledTimes(1)
-    const notifier = runtime.setNotifier.mock.calls[0][0] as {
-      worktreesChanged: (repoId: string) => void
-      reposChanged: () => void
-      activateWorktree: (
-        repoId: string,
-        worktreeId: string,
-        setup?: { runnerScriptPath: string; envVars: Record<string, string> }
-      ) => void
+    const notifier = runtime.setNotifier.mock.calls[0][0]
+    if (!notifier) {
+      throw new Error('Missing runtime notifier')
     }
 
     notifier.worktreesChanged('repo-1')
diff --git a/src/main/window/attach-main-window-services.ts b/src/main/window/attach-main-window-services.ts
index 78496abc1fc9..5a7aab6b145e 100644
--- a/src/main/window/attach-main-window-services.ts
+++ b/src/main/window/attach-main-window-services.ts
@@ -24,7 +24,7 @@ import { registerRemoteWorkspaceHandlers } from '../ipc/remote-workspace'
 import { browserManager } from '../browser/browser-manager'
 import { hasSystemMediaAccess, requestSystemMediaAccess } from '../browser/browser-media-access'
 import type { OrcaRuntimeService, RuntimeWorktreeLifecycleEvent } from '../runtime/orca-runtime'
-import type { UpdateInstallMode } from '../updater'
+import type { PreQuitCleanupFailureMode, UpdateInstallMode } from '../updater'
 import { scheduleHistoryGc } from '../terminal-history-gc'
 import { hydrateLocalPtyRegistryAtBoot } from '../memory/hydrate-local-pty-registry'
 import type { ClaudeRuntimeAuthPreparation } from '../claude-accounts/runtime-auth-service'
@@ -64,6 +64,7 @@ export function attachMainWindowServices(
     onCodexHomePtySpawned?: (args: CodexHomePtySpawnedLifecycleArgs) => void
     onPtyExit?: (id: string, exitSequence: number) => void
     onBeforeUpdateQuit?: () => void | Promise<void>
+    onBeforeUpdateQuitFailure?: PreQuitCleanupFailureMode
     updateInstallMode?: UpdateInstallMode
     onWorktreeLifecycle?: (event: RuntimeWorktreeLifecycleEvent) => void
   }
diff --git a/src/main/window/clipboard-file-copy.test.ts b/src/main/window/clipboard-file-copy.test.ts
index d1142705a92a..dfc58eb7e1c1 100644
--- a/src/main/window/clipboard-file-copy.test.ts
+++ b/src/main/window/clipboard-file-copy.test.ts
@@ -91,6 +91,17 @@ describe('writeFileToClipboard', () => {
     expect(args.join(' ')).toContain("Set-Clipboard -LiteralPath '/repo/o''brien.png'")
   })
 
+  it('doubles typographic single quotes, which PowerShell also treats as delimiters', async () => {
+    const runCommand = vi.fn(async (_command: string, _args: string[]) => {})
+    await writeFileToClipboard(
+      '/repo/o\u2019brien.png',
+      makeDeps({ platform: 'win32', runCommand })
+    )
+    expect(runCommand.mock.calls[0][1].join(' ')).toContain(
+      "Set-Clipboard -LiteralPath '/repo/o\u2019\u2019brien.png'"
+    )
+  })
+
   it('reports a failure (never throws) when PowerShell rejects on Windows', async () => {
     const runCommand = vi.fn(async (_command: string, _args: string[]) => {
       throw new Error('powershell.exe not found')
diff --git a/src/main/window/clipboard-file-copy.ts b/src/main/window/clipboard-file-copy.ts
index 63f5594f279a..bc09c27c19cf 100644
--- a/src/main/window/clipboard-file-copy.ts
+++ b/src/main/window/clipboard-file-copy.ts
@@ -1,5 +1,6 @@
 import { isAbsolute } from 'node:path'
 import { pathToFileURL } from 'node:url'
+import { quotePowerShellLiteral } from '../../shared/powershell-native-argument'
 
 export type ClipboardFileResult = { ok: boolean; reason?: string }
 
@@ -47,15 +48,14 @@ export async function writeFileToClipboard(
 
   if (deps.platform === 'win32') {
     // Set-Clipboard -LiteralPath populates CF_HDROP, which Explorer pastes as a
-    // file. Single-quote escaping for the PowerShell string literal. Guard the
-    // spawn so a missing/erroring PowerShell surfaces as a result, not a throw.
-    const escaped = clipboardPath.replace(/'/g, "''")
+    // file. Guard the spawn so a missing/erroring PowerShell surfaces as a
+    // result, not a throw.
     try {
       await deps.runCommand('powershell.exe', [
         '-NoProfile',
         '-NonInteractive',
         '-Command',
-        `Set-Clipboard -LiteralPath '${escaped}'`
+        `Set-Clipboard -LiteralPath ${quotePowerShellLiteral(clipboardPath)}`
       ])
       return { ok: true }
     } catch {
diff --git a/src/main/window/history-gc-profile-worktree-ids.test.ts b/src/main/window/history-gc-profile-worktree-ids.test.ts
index b3f0960eab98..3c01d0f2ea23 100644
--- a/src/main/window/history-gc-profile-worktree-ids.test.ts
+++ b/src/main/window/history-gc-profile-worktree-ids.test.ts
@@ -3,11 +3,14 @@
  * segment, while the Store the GC consults holds one profile's ids. Without
  * these, switching profiles makes every other profile's history look orphaned.
  */
-import { mkdtempSync, mkdirSync, writeFileSync, rmSync } from 'node:fs'
+import { existsSync, mkdtempSync, mkdirSync, readFileSync, writeFileSync, rmSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, describe, expect, it } from 'vitest'
 import { folderWorkspaceKey } from '../../shared/workspace-scope'
+import { importProfileStateJson } from '../persistence/profile-state/profile-state-documents'
+import { openProfileStateDatabase } from '../persistence/profile-state/profile-state-database'
+import { getOrcaProfileStateDatabaseFile } from '../orca-profiles/profile-storage-paths'
 import { getOtherProfileWorktreeIdsForHistoryGc } from './history-gc-profile-worktree-ids'
 
 const roots: string[] = []
@@ -103,6 +106,153 @@ describe('getOtherProfileWorktreeIdsForHistoryGc', () => {
     expect(getOtherProfileWorktreeIdsForHistoryGc(root).unreadableProfiles).toBe(1)
   })
 
+  it('prefers the profile database over a stale JSON export', () => {
+    const root = userDataWithProfiles('active', [
+      { id: 'active', state: {} },
+      {
+        id: 'other',
+        state: { worktreeMeta: { 'repo::/json': {} }, folderWorkspaces: [] }
+      }
+    ])
+    const database = openProfileStateDatabase(
+      getOrcaProfileStateDatabaseFile('other', root),
+      'other'
+    )
+    try {
+      importProfileStateJson(
+        database.db,
+        JSON.stringify({
+          worktreeMeta: { 'repo::/database': {} },
+          folderWorkspaces: [{ id: 'folder-database' }]
+        })
+      )
+    } finally {
+      database.db.close()
+    }
+
+    expect(getOtherProfileWorktreeIdsForHistoryGc(root)).toEqual({
+      unreadableProfiles: 0,
+      ids: new Set(['repo::/database', folderWorkspaceKey('folder-database')])
+    })
+  })
+
+  it('falls back to JSON without creating a database', () => {
+    const root = userDataWithProfiles('active', [
+      { id: 'active', state: {} },
+      { id: 'other', state: { worktreeMeta: { 'repo::/json': {} } } }
+    ])
+    const databaseFile = getOrcaProfileStateDatabaseFile('other', root)
+
+    expect(getOtherProfileWorktreeIdsForHistoryGc(root)).toEqual({
+      unreadableProfiles: 0,
+      ids: new Set(['repo::/json'])
+    })
+    expect(existsSync(databaseFile)).toBe(false)
+  })
+
+  it.each([true, false])(
+    'refuses history pruning when SQLite is missing but a retained export exists (JSON: %s)',
+    (hasJson) => {
+      const state = { worktreeMeta: { 'repo::/stale-json': {} } }
+      const root = userDataWithProfiles('active', [
+        { id: 'active', state: {} },
+        { id: 'other', ...(hasJson ? { state } : {}) }
+      ])
+      const dataFile = join(root, 'profiles', 'other', 'orca-data.json')
+      const exportPath = `${dataFile}.sqlite-export.1.json`
+      const exportJson = JSON.stringify({ worktreeMeta: { 'repo::/export': {} } })
+      writeFileSync(exportPath, exportJson)
+
+      expect(getOtherProfileWorktreeIdsForHistoryGc(root)).toEqual({
+        unreadableProfiles: 1,
+        ids: new Set()
+      })
+      expect(existsSync(getOrcaProfileStateDatabaseFile('other', root))).toBe(false)
+      expect(existsSync(dataFile)).toBe(hasJson)
+      if (hasJson) {
+        expect(readFileSync(dataFile, 'utf8')).toBe(JSON.stringify(state))
+      }
+      expect(readFileSync(exportPath, 'utf8')).toBe(exportJson)
+    }
+  )
+
+  it('reads SQLite-only profiles with retained exports without blocking history pruning', () => {
+    const root = userDataWithProfiles('active', [{ id: 'active', state: {} }, { id: 'other' }])
+    const database = openProfileStateDatabase(
+      getOrcaProfileStateDatabaseFile('other', root),
+      'other'
+    )
+    try {
+      importProfileStateJson(
+        database.db,
+        JSON.stringify({ worktreeMeta: { 'repo::/database': {} } })
+      )
+    } finally {
+      database.db.close()
+    }
+    const dataFile = join(root, 'profiles', 'other', 'orca-data.json')
+    writeFileSync(
+      `${dataFile}.sqlite-export.1.json`,
+      JSON.stringify({ worktreeMeta: { 'repo::/stale-export': {} } })
+    )
+
+    expect(getOtherProfileWorktreeIdsForHistoryGc(root)).toEqual({
+      unreadableProfiles: 0,
+      ids: new Set(['repo::/database'])
+    })
+    expect(existsSync(dataFile)).toBe(false)
+  })
+
+  it('does not fall back to JSON when an existing database is corrupt', () => {
+    const root = userDataWithProfiles('active', [
+      { id: 'active', state: {} },
+      { id: 'other', state: { worktreeMeta: { 'repo::/json': {} } } }
+    ])
+    writeFileSync(getOrcaProfileStateDatabaseFile('other', root), 'not a sqlite database')
+
+    expect(getOtherProfileWorktreeIdsForHistoryGc(root)).toEqual({
+      unreadableProfiles: 1,
+      ids: new Set()
+    })
+  })
+
+  it.each(['-wal', '-shm', '-journal'])(
+    'does not fall back to JSON when only %s remains',
+    (suffix) => {
+      const root = userDataWithProfiles('active', [
+        { id: 'active', state: {} },
+        { id: 'other', state: { worktreeMeta: { 'repo::/json': {} } } }
+      ])
+      writeFileSync(
+        `${getOrcaProfileStateDatabaseFile('other', root)}${suffix}`,
+        'orphaned evidence'
+      )
+
+      expect(getOtherProfileWorktreeIdsForHistoryGc(root)).toEqual({
+        unreadableProfiles: 1,
+        ids: new Set()
+      })
+    }
+  )
+
+  it('refuses history pruning for a future profile database schema', () => {
+    const root = userDataWithProfiles('active', [
+      { id: 'active', state: {} },
+      { id: 'other', state: { worktreeMeta: { 'repo::/json': {} } } }
+    ])
+    const database = openProfileStateDatabase(
+      getOrcaProfileStateDatabaseFile('other', root),
+      'other'
+    )
+    database.db.pragma('user_version = 99')
+    database.db.close()
+
+    expect(getOtherProfileWorktreeIdsForHistoryGc(root)).toEqual({
+      unreadableProfiles: 1,
+      ids: new Set()
+    })
+  })
+
   // A single-profile install must not pay for this, and no index at all is the
   // pre-profiles layout rather than an error.
   it('is empty and complete when there is no profile index', () => {
diff --git a/src/main/window/history-gc-profile-worktree-ids.ts b/src/main/window/history-gc-profile-worktree-ids.ts
index 6f82b96fc376..07a115b0ad86 100644
--- a/src/main/window/history-gc-profile-worktree-ids.ts
+++ b/src/main/window/history-gc-profile-worktree-ids.ts
@@ -1,10 +1,13 @@
-import { readFileSync } from 'node:fs'
+import { lstatSync, readFileSync } from 'node:fs'
 import { folderWorkspaceKey } from '../../shared/workspace-scope'
 import {
   getOrcaProfileDataFile,
+  getOrcaProfileStateDatabaseFile,
   getProfileUserDataPath
 } from '../orca-profiles/profile-storage-paths'
 import { getOrcaProfileIndexPath, readProfileIndex } from '../orca-profiles/profile-index-store'
+import { readProfileStateDomains } from '../persistence/profile-state/profile-state-domain-reader'
+import { assertNoRetainedProfileStateExports } from '../persistence/profile-state/profile-state-recovery-required'
 
 /**
  * Worktree ids owned by Orca profiles OTHER than the running one.
@@ -16,7 +19,7 @@ import { getOrcaProfileIndexPath, readProfileIndex } from '../orca-profiles/prof
  * switch every other profile's history looks orphaned, and the GC deletes shell
  * history those profiles are still using.
  *
- * Reading their data files directly is deliberate: a Store per profile would
+ * Reading their persisted state directly is deliberate: a Store per profile would
  * run migrations and normalization against state another profile owns. Only the
  * two id-bearing collections are read, and any unreadable profile is skipped —
  * a profile whose ids cannot be established must widen the live set's
@@ -37,7 +40,7 @@ export function getOtherProfileWorktreeIdsForHistoryGc(userDataPath = getProfile
     if (profile.id === index.activeProfileId) {
       continue
     }
-    const collected = readProfileWorktreeIds(getOrcaProfileDataFile(profile.id, userDataPath))
+    const collected = readProfileWorktreeIds(profile.id, userDataPath)
     if (!collected) {
       unreadableProfiles += 1
       continue
@@ -49,7 +52,99 @@ export function getOtherProfileWorktreeIdsForHistoryGc(userDataPath = getProfile
   return { ids, unreadableProfiles }
 }
 
-function readProfileWorktreeIds(dataFile: string): Set<string> | null {
+function readProfileWorktreeIds(profileId: string, userDataPath: string): Set<string> | null {
+  const databaseFile = getOrcaProfileStateDatabaseFile(profileId, userDataPath)
+  // A present database is authoritative. In particular, do not fall back to a
+  // stale JSON export after corruption or a future schema, because that could
+  // make live history look orphaned and delete it.
+  const databasePresence = profileStateDatabasePresence(databaseFile)
+  if (databasePresence === 'present') {
+    return readProfileWorktreeIdsFromDatabase(databaseFile, profileId)
+  }
+  if (databasePresence === 'unreadable') {
+    return null
+  }
+  const dataFile = getOrcaProfileDataFile(profileId, userDataPath)
+  try {
+    assertNoRetainedProfileStateExports({ dataFile, databaseFile, profileId })
+  } catch {
+    return null
+  }
+  return readProfileWorktreeIdsFromJson(dataFile)
+}
+
+function profileStateDatabasePresence(path: string): 'absent' | 'present' | 'unreadable' {
+  let mainDatabasePresent = false
+  try {
+    lstatSync(path)
+    mainDatabasePresent = true
+  } catch (error) {
+    if (error && typeof error === 'object' && 'code' in error && error.code === 'ENOENT') {
+      mainDatabasePresent = false
+    } else {
+      return 'unreadable'
+    }
+  }
+  if (mainDatabasePresent) {
+    return 'present'
+  }
+  for (const sidecar of [`${path}-wal`, `${path}-shm`, `${path}-journal`]) {
+    try {
+      lstatSync(sidecar)
+      return 'unreadable'
+    } catch (error) {
+      if (!error || typeof error !== 'object' || !('code' in error) || error.code !== 'ENOENT') {
+        return 'unreadable'
+      }
+    }
+  }
+  return 'absent'
+}
+
+function readProfileWorktreeIdsFromDatabase(
+  databaseFile: string,
+  profileId: string
+): Set<string> | null {
+  const domains = readProfileStateDomains(databaseFile, profileId, [
+    'worktreeMeta',
+    'folderWorkspaces'
+  ])
+  if (domains.kind === 'unreadable') {
+    return null
+  }
+
+  const ids = new Set<string>()
+  const worktreeMeta = domains.values.get('worktreeMeta')
+  if (worktreeMeta !== undefined) {
+    if (worktreeMeta === null) {
+      // Explicit null is a valid legacy state value and means no metadata.
+    } else if (!isRecord(worktreeMeta)) {
+      return null
+    } else {
+      for (const id of Object.keys(worktreeMeta)) {
+        ids.add(id)
+      }
+    }
+  }
+  const folderWorkspaces = domains.values.get('folderWorkspaces')
+  if (folderWorkspaces !== undefined) {
+    if (folderWorkspaces === null) {
+      // Explicit null is a valid legacy state value and means no workspaces.
+    } else if (!Array.isArray(folderWorkspaces)) {
+      return null
+    } else {
+      for (const workspace of folderWorkspaces) {
+        const id = isRecord(workspace) ? workspace.id : undefined
+        if (typeof id === 'string' && id) {
+          ids.add(folderWorkspaceKey(id))
+        }
+      }
+    }
+  }
+  return ids
+}
+
+function readProfileWorktreeIdsFromJson(dataFile: string): Set<string> | null {
   let parsed: unknown
   try {
     parsed = JSON.parse(readFileSync(dataFile, 'utf8'))
@@ -78,3 +173,7 @@ function readProfileWorktreeIds(dataFile: string): Set<string> | null {
   }
   return ids
 }
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value)
+}
diff --git a/src/main/window/main-window-updater.ts b/src/main/window/main-window-updater.ts
index 25fb99dfa231..c7fa40f267af 100644
--- a/src/main/window/main-window-updater.ts
+++ b/src/main/window/main-window-updater.ts
@@ -22,6 +22,7 @@ import {
   quitAndInstall,
   setupAutoUpdater,
   showLinuxPackage,
+  type PreQuitCleanupFailureMode,
   type UpdateInstallMode
 } from '../updater'
 
@@ -39,6 +40,7 @@ export function scheduleMainWindowAutoUpdaterSetup(
   store: Store,
   options?: {
     onBeforeUpdateQuit?: () => void | Promise<void>
+    onBeforeUpdateQuitFailure?: PreQuitCleanupFailureMode
     updateInstallMode?: UpdateInstallMode
   }
 ): void {
@@ -75,6 +77,7 @@ export function scheduleMainWindowAutoUpdaterSetup(
         store.updateUI({ dismissedUpdateNudgeId: id })
       },
       getReleaseChannelOverride: () => store.getUI().releaseChannelOverride ?? null,
+      onBeforeQuitFailure: options?.onBeforeUpdateQuitFailure,
       installMode: options?.updateInstallMode
     })
     logStartupMilestone('updater-setup-done')
diff --git a/src/main/window/runtime-window-lifecycle.ts b/src/main/window/runtime-window-lifecycle.ts
index 78c5f2ec4263..142389099c0f 100644
--- a/src/main/window/runtime-window-lifecycle.ts
+++ b/src/main/window/runtime-window-lifecycle.ts
@@ -198,7 +198,8 @@ export function registerRuntimeWindowLifecycle(
         baseVersion,
         content
       }) as Promise<RuntimeMarkdownSaveTabResult>,
-    closeTerminal: (tabId, paneRuntimeId) => send('ui:closeTerminal', { tabId, paneRuntimeId }),
+    closeTerminal: (tabId) => send('ui:closeTerminal', { kind: 'tab', tabId }),
+    closeTerminalPane: (tabId, leafId) => send('ui:closeTerminal', { kind: 'pane', tabId, leafId }),
     closeTerminalTab: (tabId, options) =>
       requestTerminalTabCloseFromRenderer(mainWindow, tabId, options),
     sleepWorktree: (worktreeId) => send('ui:sleepWorktree', { worktreeId }),
diff --git a/src/main/windows/windows-msys-job.win32.test.ts b/src/main/windows/windows-msys-job.win32.test.ts
index e7e0bee950a0..9bf5485102e9 100644
--- a/src/main/windows/windows-msys-job.win32.test.ts
+++ b/src/main/windows/windows-msys-job.win32.test.ts
@@ -37,8 +37,12 @@ describeOnWindows('MSYS terminal job ownership', () => {
     })
     let output = ''
     let childPid: number | undefined
+    let exit: { exitCode: number; signal?: number } | undefined
+    proc.onExit((event) => {
+      exit = event
+    })
     proc.onData((chunk) => {
-      output += chunk
+      output = (output + chunk).slice(-32_768)
       const match = /MSYS_OWNED_CHILD=(\d+)/.exec(output)
       if (match) {
         childPid = Number(match[1])
@@ -48,7 +52,14 @@ describeOnWindows('MSYS terminal job ownership', () => {
       proc.write(
         `${quotePosixShell(process.execPath.replace(/\\/g, '/'))} ${quotePosixShell(script.replace(/\\/g, '/'))}\r`
       )
-      await vi.waitFor(() => expect(childPid).toBeDefined(), { timeout: 15_000 })
+      try {
+        await vi.waitFor(() => expect(childPid).toBeDefined(), { timeout: 15_000 })
+      } catch (cause) {
+        throw new Error(
+          JSON.stringify({ shellPid: proc.pid, exit, jobPids: listPtyJobProcessIds(proc), output }),
+          { cause }
+        )
+      }
       expect(isAlive(childPid!)).toBe(true)
       expect(listPtyJobProcessIds(proc)).toContain(childPid)
       expect(terminatePtyJob(proc)).toBe('terminated')
diff --git a/src/main/windows/windows-process-creation-time.test.ts b/src/main/windows/windows-process-creation-time.test.ts
new file mode 100644
index 000000000000..3a316613b2b5
--- /dev/null
+++ b/src/main/windows/windows-process-creation-time.test.ts
@@ -0,0 +1,88 @@
+import { afterEach, beforeEach, expect, it, vi } from 'vitest'
+import {
+  __setWindowsProcessTreeLoaderForTests,
+  __setWindowsProcessTreeRequireForTests,
+  readWindowsProcessCreationTime
+} from './windows-process-table'
+
+const platform = Object.getOwnPropertyDescriptor(process, 'platform')
+const read = vi.fn<(pid: number) => number | undefined>()
+const scan = vi.fn()
+
+beforeEach(() => {
+  Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' })
+  read.mockReset().mockReturnValue(1_700_000_000_000)
+  scan.mockReset()
+  __setWindowsProcessTreeLoaderForTests(() => ({
+    ProcessDataFlag: { None: 0, CommandLine: 2, CreationTime: 4 },
+    getAllProcesses: scan,
+    getProcessCreationTime: read
+  }))
+})
+
+afterEach(() => {
+  __setWindowsProcessTreeRequireForTests()
+  if (platform) {
+    Object.defineProperty(process, 'platform', platform)
+  }
+})
+
+it('reads one PID afresh on each call without enumerating the table', () => {
+  expect(readWindowsProcessCreationTime(12)).toBe(1_700_000_000_000)
+  read.mockReturnValue(1_800_000_000_000)
+  expect(readWindowsProcessCreationTime(12)).toBe(1_800_000_000_000)
+  expect(read.mock.calls).toEqual([[12], [12]])
+  expect(scan).not.toHaveBeenCalled()
+})
+
+it.each([undefined, 0, -1, Number.NaN, Infinity, 1.5, Number.MAX_SAFE_INTEGER + 1])(
+  'keeps an unavailable or invalid native creation time unverifiable: %s',
+  (value) => {
+    read.mockReturnValue(value)
+    expect(readWindowsProcessCreationTime(12)).toBeNull()
+  }
+)
+
+it.each([0, -1, Number.NaN, Infinity, 1.5, 0x100000000])('refuses an invalid PID %s', (pid) => {
+  expect(readWindowsProcessCreationTime(pid)).toBeNull()
+  expect(read).not.toHaveBeenCalled()
+})
+
+it('keeps denied or failed native queries unverifiable', () => {
+  read.mockImplementation(() => {
+    throw Object.assign(new Error('access denied'), { code: 'EPERM' })
+  })
+  expect(readWindowsProcessCreationTime(12)).toBeNull()
+})
+
+it('does not invoke the reader off Windows', () => {
+  Object.defineProperty(process, 'platform', { configurable: true, value: 'linux' })
+  expect(readWindowsProcessCreationTime(12)).toBeNull()
+  expect(read).not.toHaveBeenCalled()
+})
+
+it.each([true, false])('does not scan or fork when native capability is missing: %s', (loaded) => {
+  __setWindowsProcessTreeLoaderForTests(() =>
+    loaded
+      ? {
+          ProcessDataFlag: { None: 0, CommandLine: 2, CreationTime: 4 },
+          supportedProcessDataFlags: 7,
+          getAllProcesses: scan
+        }
+      : null
+  )
+  expect(readWindowsProcessCreationTime(12)).toBeNull()
+  expect(scan).not.toHaveBeenCalled()
+})
+
+it('adapts the same identity getter from the staged relay addon', () => {
+  __setWindowsProcessTreeRequireForTests((specifier) => {
+    if (specifier === '@vscode/windows-process-tree') {
+      throw new Error('no package')
+    }
+    return { getProcessList: scan, getProcessCreationTime: read }
+  })
+  expect(readWindowsProcessCreationTime(12)).toBe(1_700_000_000_000)
+  expect(read).toHaveBeenCalledWith(12)
+  expect(scan).not.toHaveBeenCalled()
+})
diff --git a/src/main/windows/windows-process-table-native-addon.win32.test.ts b/src/main/windows/windows-process-table-native-addon.win32.test.ts
index 1120d8173b4a..64045b5b7796 100644
--- a/src/main/windows/windows-process-table-native-addon.win32.test.ts
+++ b/src/main/windows/windows-process-table-native-addon.win32.test.ts
@@ -1,6 +1,7 @@
 import { expect, it } from 'vitest'
 import {
   isWindowsProcessStartTimeAvailable,
+  readWindowsProcessCreationTime,
   readWindowsProcessTableFresh
 } from './windows-process-table'
 
@@ -22,5 +23,7 @@ it.runIf(process.platform === 'win32')(
     expect(typeof self?.creationTimeMs).toBe('number')
     expect(self?.creationTimeMs).toBeGreaterThan(Date.parse('2020-01-01T00:00:00Z'))
     expect(self?.creationTimeMs).toBeLessThanOrEqual(Date.now())
+    expect(readWindowsProcessCreationTime(process.pid)).toBe(self?.creationTimeMs)
+    expect(readWindowsProcessCreationTime(process.pid)).toBe(self?.creationTimeMs)
   }
 )
diff --git a/src/main/windows/windows-process-table.test.ts b/src/main/windows/windows-process-table.test.ts
index 16c411ceb717..959a0092ff05 100644
--- a/src/main/windows/windows-process-table.test.ts
+++ b/src/main/windows/windows-process-table.test.ts
@@ -481,6 +481,29 @@ describe('PowerShell fallback when the native binding is absent', () => {
     expect(cimScan).not.toHaveBeenCalled()
   })
 
+  it('says so in the log, once, rather than falling back silently', async () => {
+    // #16905 was this path running as the daemon's steady state with nothing to
+    // notice it. Absence is legitimate on a relay; being quiet about it is not.
+    const fallbackWarnings = (): number =>
+      warn.mock.calls.filter((call) =>
+        String(call[0]).includes('falling back to a powershell.exe CIM scan')
+      ).length
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+    __setWindowsProcessTreeLoaderForTests(() => null)
+
+    await readWindowsProcessTableFresh()
+    await readWindowsProcessTableFresh()
+    expect(fallbackWarnings()).toBe(1)
+
+    // Re-injecting resets the reader, so the next process-equivalent warns again.
+    // Asserting only the first count passes even with that reset removed, as long
+    // as an earlier test in this file happened to trip the fallback first.
+    __setWindowsProcessTreeLoaderForTests(() => null)
+    await readWindowsProcessTableFresh()
+    expect(fallbackWarnings()).toBe(2)
+    warn.mockRestore()
+  })
+
   it('rejects a scan missing our own pid instead of reporting an idle machine', async () => {
     __setWindowsProcessTreeLoaderForTests(() => null)
     cimScan.mockResolvedValue([{ pid: 200, ppid: 4, name: 'claude.exe', command: 'claude' }])
diff --git a/src/main/windows/windows-process-table.ts b/src/main/windows/windows-process-table.ts
index e30645601744..20f1ca000c24 100644
--- a/src/main/windows/windows-process-table.ts
+++ b/src/main/windows/windows-process-table.ts
@@ -82,6 +82,7 @@ type WindowsProcessTreeModule = {
    * prebuilt `.node` in place.
    */
   supportedProcessDataFlags?: number
+  getProcessCreationTime?: (pid: number) => number | undefined
   getAllProcesses: (
     callback: (processes: NativeProcessInfo[] | undefined) => void,
     flags?: number
@@ -112,6 +113,7 @@ let requireNative: NativeRequire = requireFromMain
  * binding straight to the addon drops a duplicate rather than losing a guard.
  */
 type WindowsProcessTreeAddon = {
+  getProcessCreationTime?: (pid: number) => number | undefined
   getProcessList: (
     callback: (processes: NativeProcessInfo[] | undefined) => void,
     flags: number
@@ -168,6 +170,13 @@ function stagedRelayAddonIsUnpatched(): boolean {
   }
 }
 
+/**
+ * Once per process, for the main and relay processes whose console is real. The
+ * daemon's stderr is destroyed once it reports ready, so it logs this capability
+ * to daemonLog at startup instead (daemon-entry.ts).
+ */
+let warnedAboutCimFallback = false
+
 let cachedModule: WindowsProcessTreeModule | null | undefined
 let moduleLoader: () => WindowsProcessTreeModule | null = loadWindowsProcessTree
 let cimScan: () => Promise<WindowsProcessRow[]> = readWindowsProcessRowsWithCim
@@ -177,6 +186,7 @@ function adaptAddon(addon: WindowsProcessTreeAddon): WindowsProcessTreeModule {
   return {
     ProcessDataFlag: PROCESS_DATA_FLAG,
     supportedProcessDataFlags: addon.supportedProcessDataFlags,
+    getProcessCreationTime: addon.getProcessCreationTime,
     getAllProcesses: (callback, flags) => addon.getProcessList(callback, flags ?? 0)
   }
 }
@@ -293,6 +303,7 @@ let nativeReadGate: Promise<unknown> = Promise.resolve()
 
 function resetNativeReaderState(): void {
   nativeReaderEpoch += 1
+  warnedAboutCimFallback = false
   unreturnedReads.clear()
   // Chain, never replace. Dropping the old chain lets a waiter still holding it
   // run against a read queued on the new one -- two concurrent calls into one
@@ -367,6 +378,12 @@ function readOneSnapshot<Row>(projection: ProcessRowProjection<Row>): Promise<Ro
       // never silently start forking shells at the caller's poll rate. Absence
       // is the one condition that can never resolve itself — see
       // docs/reference/windows-process-enumeration.md.
+      if (!warnedAboutCimFallback) {
+        warnedAboutCimFallback = true
+        console.warn(
+          '[windows-process-table] no native binding; falling back to a powershell.exe CIM scan at each caller poll. See docs/reference/windows-process-enumeration.md.'
+        )
+      }
       return projection.cimFallback()
     }
     // Reject rather than resolve empty: an empty table is a claim that nothing
@@ -528,6 +545,19 @@ export function isWindowsProcessStartTimeAvailable(): boolean {
   )
 }
 
+/** Fresh identity for synchronous profile admission; opens one PID without taking a table snapshot. */
+export function readWindowsProcessCreationTime(pid: number): number | null {
+  if (process.platform !== 'win32' || !Number.isSafeInteger(pid) || pid <= 0 || pid > 0xffffffff) {
+    return null
+  }
+  try {
+    const value = moduleLoader()?.getProcessCreationTime?.(pid)
+    return typeof value === 'number' && Number.isSafeInteger(value) && value > 0 ? value : null
+  } catch {
+    return null
+  }
+}
+
 function resetSnapshotReaders(): void {
   identityReader.reset()
   detailedReader.reset()
diff --git a/src/main/windows/windows-pty-job.ts b/src/main/windows/windows-pty-job.ts
index 169db375f3b0..814f2dbaa8ab 100644
--- a/src/main/windows/windows-pty-job.ts
+++ b/src/main/windows/windows-pty-job.ts
@@ -1,4 +1,6 @@
 import type { IPty } from 'node-pty'
+import { canUseBunPty } from '../daemon/pty-subprocess/bun-pty-process-capabilities'
+import { loadWindowsBunPtyJobNative } from '../daemon/pty-subprocess/windows-bun-pty-native'
 import { createRequire } from 'node:module'
 import { recordSelfInitiatedTreeKill } from '../crash-reporting/self-initiated-tree-kill-log'
 
@@ -33,6 +35,19 @@ type ConptyNative = {
   assignCurrentProcessToJob: () => boolean
 }
 
+type SelfOwnedPty = IPty & {
+  jobRootProcessIsWrapper?: true
+  shellProcessId?: number
+  terminateOwnedTree?: () => JobTerminationOutcome
+  listOwnedProcessIds?: () => readonly number[] | null
+}
+
+/** The gate's pid never proves that its user shell remains alive. */
+export function ptyShellProcessId(proc: IPty): number | undefined {
+  const owned: SelfOwnedPty = proc
+  return owned.jobRootProcessIsWrapper ? owned.shellProcessId : proc.pid
+}
+
 let cachedNative: ConptyNative | null | undefined
 let nativeLoader: () => ConptyNative | null = loadConptyNative
 
@@ -89,6 +104,23 @@ export type JobTerminationOutcome = 'terminated' | 'unavailable'
  * to be misread as "nothing to kill".
  */
 export function terminatePtyJob(proc: IPty): JobTerminationOutcome {
+  const owned: SelfOwnedPty = proc
+  if (typeof owned.terminateOwnedTree === 'function') {
+    let outcome: JobTerminationOutcome
+    try {
+      outcome = owned.terminateOwnedTree()
+    } catch {
+      return 'unavailable'
+    }
+    if (outcome === 'terminated') {
+      recordSelfInitiatedTreeKill({
+        pid: proc.pid,
+        site: 'windows-pty-job-teardown',
+        scope: 'win-pty-job'
+      })
+    }
+    return outcome
+  }
   const target = ptyJobTarget(proc)
   const native = nativeLoader()
   if (!target || !native) {
@@ -132,6 +164,14 @@ export function terminatePtyJob(proc: IPty): JobTerminationOutcome {
  * including children that detached from the console.
  */
 export function listPtyJobProcessIds(proc: IPty): readonly number[] | null {
+  const owned: SelfOwnedPty = proc
+  if (typeof owned.listOwnedProcessIds === 'function') {
+    try {
+      return owned.listOwnedProcessIds()
+    } catch {
+      return null
+    }
+  }
   const target = ptyJobTarget(proc)
   const native = nativeLoader()
   if (!target || !native) {
@@ -193,7 +233,7 @@ function assignHostProcessOnce(): boolean {
 
 /** Whether this build can own PTY trees with job objects at all. */
 export function isPtyJobOwnershipAvailable(): boolean {
-  return nativeLoader() !== null
+  return canUseBunPty() ? loadWindowsBunPtyJobNative() !== null : nativeLoader() !== null
 }
 
 /** Test-only: substitute the native module (it is resolved via createRequire). */
diff --git a/src/main/windows/windows-pty-job.win32.test.ts b/src/main/windows/windows-pty-job.win32.test.ts
index c5f408f73115..cb15463bff85 100644
--- a/src/main/windows/windows-pty-job.win32.test.ts
+++ b/src/main/windows/windows-pty-job.win32.test.ts
@@ -3,6 +3,7 @@ import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, describe, expect, it, vi } from 'vitest'
 import type { IPty } from 'node-pty'
+import { runProcess } from '../../shared/child-process/run-process'
 import {
   isPtyJobOwnershipAvailable,
   listPtyJobProcessIds,
@@ -102,6 +103,21 @@ describeOnWindows('ConPTY job ownership', () => {
     expect(isPtyJobOwnershipAvailable()).toBe(true)
   })
 
+  it('keeps the native table intact while shell cleanup overlaps new terminals', async () => {
+    const result = await runProcess({
+      program: process.execPath,
+      args: [join(process.cwd(), 'config', 'scripts', 'windows-pty-table-stress.cjs')],
+      env: { ...process.env, ORCA_BACKGROUND_LAUNCH: '1' },
+      timeoutMs: 90_000
+    })
+    const status = result.code === null ? 'null' : `0x${(result.code >>> 0).toString(16)}`
+    expect(
+      result,
+      `Native host exited ${status} (${result.signal}); timedOut=${result.timedOut}\n${result.stdout}\n${result.stderr}`
+    ).toMatchObject({ code: 0, timedOut: false })
+    expect(result.stdout).toContain('"phase":"complete"')
+  }, 100_000)
+
   it('counts a detached grandchild as part of the pane tree', async () => {
     const { proc, grandchildPid } = await spawnShellWithDetachedGrandchild()
 
diff --git a/src/main/worker-thread-entry-path.ts b/src/main/worker-thread-entry-path.ts
index 9c9de40eb801..265c3048b3ad 100644
--- a/src/main/worker-thread-entry-path.ts
+++ b/src/main/worker-thread-entry-path.ts
@@ -46,7 +46,10 @@ export function resolveWorkerThreadEntryPath(
 export function currentWorkerEntryLayout(moduleDir: string): WorkerEntryLayout {
   return {
     isPackaged: hasAppEnvironment() && getAppEnvironment().isPackaged(),
-    resourcesPath: process.resourcesPath,
+    resourcesPath:
+      'resourcesPath' in process && typeof process.resourcesPath === 'string'
+        ? process.resourcesPath
+        : undefined,
     moduleDir
   }
 }
diff --git a/src/main/worker-thread-request-queue.test.ts b/src/main/worker-thread-request-queue.test.ts
index d7f29266acd8..1c1616d88392 100644
--- a/src/main/worker-thread-request-queue.test.ts
+++ b/src/main/worker-thread-request-queue.test.ts
@@ -1,4 +1,5 @@
 import type { Worker } from 'node:worker_threads'
+import { getEventListeners } from 'node:events'
 import { afterEach, describe, expect, it, vi } from 'vitest'
 import { WorkerThreadRequestQueue } from './worker-thread-request-queue'
 
@@ -103,6 +104,88 @@ describe('WorkerThreadRequestQueue', () => {
     vi.useRealTimers()
   })
 
+  it('cancels queued requests without retiring active work and retires active cancellation', async () => {
+    const workers: FakeWorker[] = []
+    const queue = makeQueue(workers)
+    const active = new AbortController()
+    const queued = new AbortController()
+    const first = settle(
+      queue.dispatch((id) => ({ id, label: 'active' }), TIMEOUT_MS, active.signal)
+    )
+    const second = settle(
+      queue.dispatch((id) => ({ id, label: 'queued' }), TIMEOUT_MS, queued.signal)
+    )
+    const third = send(queue, 'survivor')
+    queued.abort(new Error('queued cancelled'))
+    await expect(second).resolves.toMatchObject({ message: 'queued cancelled' })
+    expect(workers[0].terminated).toBe(false)
+    active.abort(new Error('active cancelled'))
+    await expect(first).resolves.toMatchObject({ message: 'active cancelled' })
+    expect(workers[0].terminated).toBe(true)
+    expect(workers).toHaveLength(2)
+    expect(labels(workers[1])).toEqual(['survivor'])
+    workers[0].respond()
+    workers[1].respond()
+    await expect(third).resolves.toMatchObject({ label: 'survivor' })
+    queue.dispose()
+  })
+
+  it('never starts an already aborted request and rejects all work on disposal', async () => {
+    const workers: FakeWorker[] = []
+    const queue = makeQueue(workers)
+    await expect(
+      queue.dispatch(
+        (id) => ({ id, label: 'aborted' }),
+        TIMEOUT_MS,
+        AbortSignal.abort(new Error('cancelled'))
+      )
+    ).rejects.toThrow('cancelled')
+    expect(workers).toHaveLength(0)
+    const active = settle(send(queue, 'active'))
+    const queued = settle(send(queue, 'queued'))
+    queue.dispose()
+    await expect(active).resolves.toMatchObject({ message: 'Worker request queue disposed' })
+    await expect(queued).resolves.toMatchObject({ message: 'Worker request queue disposed' })
+    await expect(send(queue, 'later')).rejects.toThrow('disposed')
+    expect(workers[0].terminated).toBe(true)
+  })
+
+  it.each([false, true])(
+    'does not respawn for queued calls sharing the cancelled active signal (survivor: %s)',
+    async (hasSurvivor) => {
+      const workers: FakeWorker[] = []
+      const queue = makeQueue(workers)
+      const controller = new AbortController()
+      const reason = new Error('scan cancelled')
+      const pending = Array.from({ length: 8 }, (_, index) =>
+        settle(
+          queue.dispatch(
+            (id) => ({ id, label: `cancelled-${index}` }),
+            TIMEOUT_MS,
+            controller.signal
+          )
+        )
+      )
+      const survivor = hasSurvivor ? send(queue, 'survivor') : undefined
+      expect(getEventListeners(controller.signal, 'abort')).toHaveLength(8)
+
+      controller.abort(reason)
+
+      expect(await Promise.all(pending)).toEqual(Array.from({ length: 8 }, () => reason))
+      expect(workers[0].terminated).toBe(true)
+      expect(workers).toHaveLength(hasSurvivor ? 2 : 1)
+      expect(workers.flatMap(labels)).toEqual(
+        hasSurvivor ? ['cancelled-0', 'survivor'] : ['cancelled-0']
+      )
+      expect(getEventListeners(controller.signal, 'abort')).toHaveLength(0)
+      if (survivor) {
+        workers[1].respond()
+        await expect(survivor).resolves.toMatchObject({ label: 'survivor' })
+      }
+      queue.dispose()
+    }
+  )
+
   it('posts one request at a time and in the order it was dispatched', async () => {
     const workers: FakeWorker[] = []
     const queue = makeQueue(workers)
diff --git a/src/main/worker-thread-request-queue.ts b/src/main/worker-thread-request-queue.ts
index 3c8f6d0a711a..08c27e0eda45 100644
--- a/src/main/worker-thread-request-queue.ts
+++ b/src/main/worker-thread-request-queue.ts
@@ -43,6 +43,8 @@ type PendingCall<TRequest, TResponse> = {
   resolve: (value: TResponse) => void
   reject: (error: Error) => void
   timer: NodeJS.Timeout | null
+  signal?: AbortSignal
+  cleanupAbort: () => void
 }
 
 export class WorkerThreadRequestQueue<
@@ -53,6 +55,7 @@ export class WorkerThreadRequestQueue<
   private queue: PendingCall<TRequest, TResponse>[] = []
   private consecutiveDeaths = 0
   private nextId = 1
+  private disposed = false
   private readonly host: LazyWorkerThreadHost<TResponse>
 
   constructor(private readonly options: WorkerThreadRequestQueueOptions<TRequest>) {
@@ -73,8 +76,20 @@ export class WorkerThreadRequestQueue<
    * @param timeoutMs - Deadline measured from dispatch, not from enqueue.
    * @returns The worker's response; rejects on timeout, crash, or an unspawnable worker.
    */
-  dispatch(buildRequest: (id: number) => TRequest, timeoutMs: number): Promise<TResponse> {
+  dispatch(
+    buildRequest: (id: number) => TRequest,
+    timeoutMs: number,
+    signal?: AbortSignal
+  ): Promise<TResponse> {
     return new Promise((resolve, reject) => {
+      if (this.disposed) {
+        reject(new Error('Worker request queue disposed'))
+        return
+      }
+      if (signal?.aborted) {
+        reject(signal.reason ?? new Error('Worker request aborted'))
+        return
+      }
       // Built before the cap check so a rejection can name the dropped work;
       // the id it burns is only a correlation token, so a gap costs nothing.
       const request = buildRequest(this.nextId++)
@@ -88,21 +103,57 @@ export class WorkerThreadRequestQueue<
       if (!this.active && this.queue.length === 0) {
         this.consecutiveDeaths = 0
       }
-      this.queue.push({
+      const call: PendingCall<TRequest, TResponse> = {
         request,
         timeoutMs,
         resolve,
         reject,
-        timer: null
-      })
+        timer: null,
+        signal,
+        cleanupAbort: () => signal?.removeEventListener('abort', abort)
+      }
+      const abort = (): void => {
+        if (this.active === call) {
+          this.host.destroy()
+        } else {
+          this.queue = this.queue.filter((queued) => queued !== call)
+        }
+        this.settle(call, () => reject(signal?.reason ?? new Error('Worker request aborted')))
+        this.afterSettle()
+      }
+      signal?.addEventListener('abort', abort, { once: true })
+      this.queue.push(call)
       this.pump()
     })
   }
 
+  dispose(): void {
+    this.disposed = true
+    this.host.destroy()
+    const pending = this.active ? [this.active, ...this.queue] : this.queue
+    this.queue = []
+    for (const call of pending) {
+      this.settle(call, () => call.reject(new Error('Worker request queue disposed')))
+    }
+  }
+
   private pump(): void {
     if (this.active || this.queue.length === 0) {
       return
     }
+    // A shared signal is already aborted before its remaining listeners run.
+    while (this.queue[0]?.signal?.aborted) {
+      const cancelled = this.queue.shift()
+      if (cancelled) {
+        this.settle(cancelled, () =>
+          cancelled.reject(cancelled.signal?.reason ?? new Error('Worker request aborted'))
+        )
+      }
+    }
+    if (this.queue.length === 0) {
+      this.host.scheduleIdleTeardown()
+      return
+    }
     const worker = this.host.ensure()
     if (!worker) {
       this.failQueuedAsUnavailable()
@@ -115,7 +166,11 @@ export class WorkerThreadRequestQueue<
     this.active = call
     this.host.clearIdleTimer()
     this.armDeadline(call)
-    worker.postMessage(call.request)
+    try {
+      worker.postMessage(call.request)
+    } catch (error) {
+      this.onWorkerFault(error instanceof Error ? error : new Error(String(error)))
+    }
   }
 
   /**
@@ -199,6 +254,7 @@ export class WorkerThreadRequestQueue<
   }
 
   private settle(call: PendingCall<TRequest, TResponse>, run: () => void): void {
+    call.cleanupAbort()
     if (call.timer) {
       clearTimeout(call.timer)
       call.timer = null
diff --git a/src/main/worktree-create-preparation-contention.test.ts b/src/main/worktree-create-preparation-contention.test.ts
new file mode 100644
index 000000000000..9535d63cdee7
--- /dev/null
+++ b/src/main/worktree-create-preparation-contention.test.ts
@@ -0,0 +1,369 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { Store } from './persistence'
+import type { Repo } from '../shared/repo-types'
+import type { AddWorktreeResult } from './git/worktree'
+
+const mocks = vi.hoisted(() => ({
+  mkdir: vi.fn(),
+  listWorktreeGraph: vi.fn(),
+  prepare: vi.fn(),
+  finalize: vi.fn(),
+  discard: vi.fn(),
+  computeWorkspaceRootAsync: vi.fn(),
+  getWorktreeOptions: vi.fn(),
+  resolveBaseRef: vi.fn(),
+  measureDivergence: vi.fn()
+}))
+
+vi.mock('node:fs/promises', () => ({ mkdir: mocks.mkdir }))
+vi.mock('./git/worktree', () => ({ listWorktreeGraph: mocks.listWorktreeGraph }))
+vi.mock('./git/worktree-create-preparation', () => ({
+  prepareWorktreeCreateCheckout: mocks.prepare,
+  finalizePreparedWorktree: mocks.finalize,
+  discardPreparedWorktree: mocks.discard,
+  unlockPreparedWorktree: vi.fn()
+}))
+vi.mock('./git/worktree-base-ref-probe', () => ({
+  resolveLocalWorktreeBaseRef: mocks.resolveBaseRef
+}))
+vi.mock('./git/worktree-base-divergence', () => ({
+  measureRetargetDivergence: mocks.measureDivergence
+}))
+vi.mock('./project-runtime-git-options', () => ({
+  getLocalProjectWorktreeGitOptions: mocks.getWorktreeOptions,
+  getWorktreeMirrorDistro: () => undefined
+}))
+vi.mock('./ipc/worktree-logic', () => ({
+  computeWorkspaceRootAsync: mocks.computeWorkspaceRootAsync,
+  getWorktreePathSettings: () => ({ workspaceDir: '/workspace', nestWorkspaces: false })
+}))
+
+import {
+  _resetWorktreeCreatePreparationsForTests,
+  consumePreparedWorktreeCreate,
+  hasPendingWorktreeCreatePreparations,
+  prepareWorktreeCreateForRepo
+} from './worktree-create-preparation'
+import {
+  listPreparations,
+  releasePreparationClaim,
+  startPreparation,
+  takePreparation
+} from './worktree-create-preparation-pool'
+
+const repo: Repo = {
+  id: 'repo-1',
+  path: '/repo',
+  displayName: 'Repo',
+  badgeColor: 'blue',
+  addedAt: 0
+}
+// oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The tested path reads only getSettings from Store.
+const store = { getSettings: () => ({}) } as unknown as Store
+const flushBackgroundWork = (): Promise<void> => new Promise((resolve) => setTimeout(resolve, 0))
+
+function consume(baseBranch = 'origin/main') {
+  return consumePreparedWorktreeCreate({
+    repoPath: repo.path,
+    workspaceRoot: '/workspace',
+    worktreePath: '/workspace/new-worktree',
+    branch: 'feature/new-worktree',
+    baseBranch
+  })
+}
+
+beforeEach(() => {
+  mocks.mkdir.mockReset().mockResolvedValue(undefined)
+  mocks.listWorktreeGraph.mockReset().mockResolvedValue([])
+  mocks.prepare.mockReset().mockResolvedValue(undefined)
+  mocks.finalize.mockReset().mockResolvedValue({})
+  mocks.discard.mockReset().mockResolvedValue(undefined)
+  mocks.computeWorkspaceRootAsync.mockReset().mockResolvedValue('/workspace')
+  mocks.getWorktreeOptions.mockReset().mockReturnValue({})
+  mocks.resolveBaseRef
+    .mockReset()
+    .mockImplementation(async (_path: string, base: string) =>
+      base === 'main'
+        ? 'refs/heads/main'
+        : base === 'other/main'
+          ? 'refs/remotes/other/main'
+          : 'refs/remotes/origin/main'
+    )
+  mocks.measureDivergence.mockReset().mockResolvedValue('within')
+})
+
+afterEach(async () => {
+  await _resetWorktreeCreatePreparationsForTests()
+})
+
+describe('claimed worktree preparation', () => {
+  it('defers prefetch through checkout, finalization, and the remaining create work', async () => {
+    const checkout = Promise.withResolvers<void>()
+    const checkoutStarted = Promise.withResolvers<void>()
+    const finalize = Promise.withResolvers<AddWorktreeResult>()
+    const finalizeStarted = Promise.withResolvers<void>()
+    mocks.prepare.mockImplementationOnce(() => {
+      checkoutStarted.resolve()
+      return checkout.promise
+    })
+    mocks.finalize.mockImplementationOnce(() => {
+      finalizeStarted.resolve()
+      return finalize.promise
+    })
+    const preparation = prepareWorktreeCreateForRepo(store, repo, 'origin/main')
+    await checkoutStarted.promise
+    const create = consume()
+    await prepareWorktreeCreateForRepo(store, repo, 'origin/main')
+    expect(mocks.prepare).toHaveBeenCalledTimes(1)
+
+    checkout.resolve()
+    await preparation
+    await finalizeStarted.promise
+    await prepareWorktreeCreateForRepo(store, repo, 'origin/main')
+    expect(mocks.prepare).toHaveBeenCalledTimes(1)
+
+    finalize.resolve({})
+    const result = await create
+    expect(result.status).toBe('hit')
+    await prepareWorktreeCreateForRepo(store, repo, 'origin/main')
+    expect(mocks.prepare).toHaveBeenCalledTimes(1)
+    result.rearm?.()
+    await flushBackgroundWork()
+    expect(mocks.prepare).toHaveBeenCalledTimes(2)
+  })
+
+  it('coalesces mid-create prefetches and releases once at create completion', async () => {
+    await prepareWorktreeCreateForRepo(store, repo, 'origin/main')
+    const result = await consume()
+    expect(result.status).toBe('hit')
+    expect(hasPendingWorktreeCreatePreparations()).toBe(true)
+
+    await Promise.all([
+      prepareWorktreeCreateForRepo(store, repo, 'origin/main'),
+      prepareWorktreeCreateForRepo(store, repo, 'origin/main')
+    ])
+    expect(mocks.prepare).toHaveBeenCalledTimes(1)
+    if (result.status === 'hit') {
+      result.rearm()
+      result.rearm()
+    }
+    await flushBackgroundWork()
+    expect(mocks.prepare).toHaveBeenCalledTimes(2)
+    expect(hasPendingWorktreeCreatePreparations()).toBe(true)
+  })
+
+  it('does not let two creates claim the same prepared checkout', async () => {
+    await prepareWorktreeCreateForRepo(store, repo, 'origin/main')
+    const [first, second] = await Promise.all([consume(), consume()])
+
+    expect([first.status, second.status].sort()).toEqual(['hit', 'miss'])
+    expect(mocks.finalize).toHaveBeenCalledOnce()
+    expect(hasPendingWorktreeCreatePreparations()).toBe(true)
+    first.rearm?.()
+    second.rearm?.()
+    expect(hasPendingWorktreeCreatePreparations()).toBe(false)
+  })
+
+  it('keeps an explicit prefetch ahead of an automatic replacement for the same key', async () => {
+    await prepareWorktreeCreateForRepo(store, repo, 'origin/main')
+    const entry = listPreparations()[0]
+    if (!entry) {
+      throw new Error('expected a prepared checkout')
+    }
+    const claim = takePreparation(entry)
+    const base = {
+      repoPath: repo.path,
+      workspaceRoot: '/workspace',
+      baseBranch: 'origin/main',
+      canonicalBase: 'refs/remotes/origin/main'
+    }
+    await startPreparation({ ...base, options: {} }, 'automatic')
+    await startPreparation({ ...base, options: { admissionTier: 'background' } })
+    await startPreparation({ ...base, options: {} }, 'automatic')
+
+    const released = releasePreparationClaim(claim)
+    expect(released.pendingPreparations).toEqual([
+      {
+        kind: 'explicit',
+        args: { ...base, options: { admissionTier: 'background' } }
+      }
+    ])
+    expect(releasePreparationClaim(claim)).toEqual({ released: false, pendingPreparations: [] })
+  })
+
+  it('allows a fresh prefetch after an isolated create completes', async () => {
+    await prepareWorktreeCreateForRepo(store, repo, 'origin/main')
+    const result = await consume()
+    expect(result.status).toBe('hit')
+    if (result.status === 'hit') {
+      result.rearm()
+    }
+    expect(hasPendingWorktreeCreatePreparations()).toBe(false)
+
+    await prepareWorktreeCreateForRepo(store, repo, 'origin/main')
+    expect(mocks.prepare).toHaveBeenCalledTimes(2)
+  })
+
+  it('does not repeat a burst replacement when release runs twice', async () => {
+    await prepareWorktreeCreateForRepo(store, repo, 'origin/main')
+    const first = await consume()
+    if (first.status === 'hit') {
+      first.rearm()
+    }
+    await prepareWorktreeCreateForRepo(store, repo, 'origin/main')
+    const second = await consume()
+    expect(second.status).toBe('hit')
+    if (second.status === 'hit') {
+      second.rearm()
+      second.rearm()
+    }
+    await flushBackgroundWork()
+    expect(mocks.prepare).toHaveBeenCalledTimes(3)
+  })
+
+  it('reserves both the prepared and requested canonical bases on a retarget', async () => {
+    await prepareWorktreeCreateForRepo(store, repo, 'origin/main')
+    const result = await consume('main')
+    expect(result).toMatchObject({ status: 'hit', retargeted: true })
+
+    await prepareWorktreeCreateForRepo(store, repo, 'main')
+    expect(mocks.prepare).toHaveBeenCalledTimes(1)
+    if (result.status === 'hit') {
+      result.rearm()
+    }
+    await flushBackgroundWork()
+    expect(mocks.prepare).toHaveBeenCalledTimes(2)
+    expect(mocks.prepare.mock.calls[1]?.[2]).toBe('refs/heads/main')
+  })
+
+  it('preserves distinct prefetch bases while a retargeted create finishes', async () => {
+    await prepareWorktreeCreateForRepo(store, repo, 'origin/main')
+    const result = await consume('main')
+    expect(result.status).toBe('hit')
+
+    await prepareWorktreeCreateForRepo(store, repo, 'origin/main')
+    await prepareWorktreeCreateForRepo(store, repo, 'main')
+    expect(mocks.prepare).toHaveBeenCalledTimes(1)
+    if (result.status === 'hit') {
+      result.rearm()
+    }
+    await flushBackgroundWork()
+    expect(mocks.prepare).toHaveBeenCalledTimes(3)
+  })
+
+  it('passes a pending prefetch to another create claiming the same requested base', async () => {
+    await prepareWorktreeCreateForRepo(store, repo, 'origin/main')
+    await prepareWorktreeCreateForRepo(store, repo, 'other/main')
+    const first = await consume('main')
+    const second = await consume('main')
+    expect(first.status).toBe('hit')
+    expect(second.status).toBe('hit')
+
+    await prepareWorktreeCreateForRepo(store, repo, 'main')
+    expect(mocks.prepare).toHaveBeenCalledTimes(2)
+    if (second.status === 'hit') {
+      second.rearm()
+    }
+    await flushBackgroundWork()
+    expect(mocks.prepare).toHaveBeenCalledTimes(2)
+    if (first.status === 'hit') {
+      first.rearm()
+    }
+    await flushBackgroundWork()
+    expect(mocks.prepare).toHaveBeenCalledTimes(3)
+  })
+
+  it('keeps a burst replacement when the remaining claim is isolated', async () => {
+    let timestamp = 1_000
+    const now = vi.spyOn(Date, 'now').mockImplementation(() => timestamp++)
+    try {
+      await prepareWorktreeCreateForRepo(store, repo, 'other/main')
+      const seed = await consume('other/main')
+      expect(seed.status).toBe('hit')
+      seed.rearm?.()
+
+      await prepareWorktreeCreateForRepo(store, repo, 'origin/main')
+      await prepareWorktreeCreateForRepo(store, repo, 'other/main')
+      const burst = await consume('main')
+      const isolated = await consume('main')
+      expect(burst).toMatchObject({ status: 'hit', retargeted: true })
+      expect(isolated).toMatchObject({ status: 'hit', retargeted: true })
+      expect(mocks.prepare).toHaveBeenCalledTimes(3)
+
+      burst.rearm?.()
+      await flushBackgroundWork()
+      expect(mocks.prepare).toHaveBeenCalledTimes(3)
+      isolated.rearm?.()
+      await flushBackgroundWork()
+      expect(mocks.prepare).toHaveBeenCalledTimes(4)
+      expect(mocks.prepare.mock.calls[3]?.[2]).toBe('refs/heads/main')
+    } finally {
+      now.mockRestore()
+    }
+  })
+
+  it('does not hold another repo, workspace root, or Git host behind the claim', async () => {
+    await prepareWorktreeCreateForRepo(store, repo, 'origin/main')
+    const result = await consume()
+    expect(result.status).toBe('hit')
+
+    await prepareWorktreeCreateForRepo(store, { ...repo, path: '/other-repo' }, 'origin/main')
+    mocks.computeWorkspaceRootAsync.mockResolvedValueOnce('/other-workspace')
+    await prepareWorktreeCreateForRepo(store, repo, 'origin/main')
+    mocks.getWorktreeOptions.mockReturnValue({ wslDistro: 'Ubuntu' })
+    await prepareWorktreeCreateForRepo(store, repo, 'origin/main')
+    expect(mocks.prepare).toHaveBeenCalledTimes(4)
+    if (result.status === 'hit') {
+      result.rearm()
+    }
+  })
+
+  it('releases after failed finalization has discarded the claimed checkout', async () => {
+    await prepareWorktreeCreateForRepo(store, repo, 'origin/main')
+    let failFinalization!: (error: Error) => void
+    mocks.finalize.mockReturnValueOnce(
+      new Promise((_resolve, reject) => {
+        failFinalization = reject
+      })
+    )
+    const create = consume()
+    await flushBackgroundWork()
+    await prepareWorktreeCreateForRepo(store, repo, 'origin/main')
+    expect(mocks.prepare).toHaveBeenCalledTimes(1)
+
+    failFinalization(new Error('finalize failed'))
+    const result = await create
+    expect(result).toMatchObject({ status: 'miss', reason: 'finalize_failed' })
+    expect(mocks.discard).toHaveBeenCalledTimes(1)
+    await flushBackgroundWork()
+    expect(mocks.prepare).toHaveBeenCalledTimes(1)
+    result.rearm?.()
+    await flushBackgroundWork()
+    expect(mocks.prepare).toHaveBeenCalledTimes(2)
+  })
+
+  it('holds an explicit prefetch through a claimed checkout failure', async () => {
+    let failPreparation!: (error: Error) => void
+    mocks.prepare.mockReturnValueOnce(
+      new Promise((_resolve, reject) => {
+        failPreparation = reject
+      })
+    )
+    const initialPreparation = prepareWorktreeCreateForRepo(store, repo, 'origin/main')
+    const preparationFailure = initialPreparation.catch(() => {})
+    await flushBackgroundWork()
+    const create = consume()
+    await flushBackgroundWork()
+    await prepareWorktreeCreateForRepo(store, repo, 'origin/main')
+    expect(mocks.prepare).toHaveBeenCalledTimes(1)
+
+    failPreparation(new Error('checkout failed'))
+    const result = await create
+    await preparationFailure
+    expect(result).toMatchObject({ status: 'miss', reason: 'prepare_failed' })
+    expect(mocks.prepare).toHaveBeenCalledTimes(1)
+    result.rearm?.()
+    await flushBackgroundWork()
+    expect(mocks.prepare).toHaveBeenCalledTimes(2)
+  })
+})
diff --git a/src/main/worktree-create-preparation-pool.ts b/src/main/worktree-create-preparation-pool.ts
index 7a040373c578..a72972c9d200 100644
--- a/src/main/worktree-create-preparation-pool.ts
+++ b/src/main/worktree-create-preparation-pool.ts
@@ -51,7 +51,18 @@ export type StartPreparationArgs = {
   options: AddWorktreeOptions
 }
 
+export type DeferredPreparation = {
+  args: StartPreparationArgs
+  kind: 'explicit' | 'automatic'
+}
+
 const preparations = new Map<string, PreparationEntry>()
+export type PreparationClaim = {
+  entry: PreparationEntry
+  requestedKey: string
+  pendingPreparations: Map<string, DeferredPreparation>
+}
+const claims = new Set<PreparationClaim>()
 
 /** One repo on one Git host: the scope a stranded discard is retried under. */
 function preparationHostKey(repoPathKey: string, wslDistro: string): string {
@@ -60,7 +71,7 @@ function preparationHostKey(repoPathKey: string, wslDistro: string): string {
 
 /** A prepared checkout is a create that is either in flight or imminent. */
 export function hasPendingPreparations(): boolean {
-  return preparations.size > 0 || hasPendingStalePreparationCleanup()
+  return preparations.size > 0 || claims.size > 0 || hasPendingStalePreparationCleanup()
 }
 
 function pathOps(path: string): Pick<typeof posix, 'dirname' | 'join'> {
@@ -147,12 +158,83 @@ export function findPreparation(
 
 /** Removes an entry from the pool so no other create can claim it. Callers must run this in the
  *  same synchronous turn as the selection that produced `entry`. */
-export function takePreparation(entry: PreparationEntry): void {
+export function takePreparation(
+  entry: PreparationEntry,
+  requestedCanonicalBase = entry.canonicalBase
+): PreparationClaim {
   preparations.delete(entry.key)
   clearTimeout(entry.expiration)
+  const requestedKey = preparationEntryKey(
+    entry.repoPathKey,
+    entry.workspaceRootKey,
+    requestedCanonicalBase,
+    entry.wslDistro
+  )
+  const claim = { entry, requestedKey, pendingPreparations: new Map<string, DeferredPreparation>() }
+  claims.add(claim)
+  return claim
+}
+
+function matchingClaim(args: StartPreparationArgs): PreparationClaim | undefined {
+  const key = preparationEntryKey(
+    preparationPathKey(args.repoPath),
+    preparationPathKey(args.workspaceRoot),
+    args.canonicalBase,
+    args.options.wslDistro ?? ''
+  )
+  return [...claims]
+    .toReversed()
+    .find((claim) => claim.entry.key === key || claim.requestedKey === key)
+}
+
+/** Preserve one request per canonical key, with explicit prefetch taking precedence. */
+function deferPreparationForClaim(
+  args: StartPreparationArgs,
+  kind: DeferredPreparation['kind']
+): boolean {
+  const matching = matchingClaim(args)
+  if (!matching) {
+    return false
+  }
+  const key = preparationEntryKey(
+    preparationPathKey(args.repoPath),
+    preparationPathKey(args.workspaceRoot),
+    args.canonicalBase,
+    args.options.wslDistro ?? ''
+  )
+  if (kind === 'explicit' || !matching.pendingPreparations.has(key)) {
+    matching.pendingPreparations.set(key, { args, kind })
+  }
+  return true
 }
 
-export function startPreparation(args: StartPreparationArgs): Promise<void> {
+/** A second release is inert, including after a test reset. */
+export function releasePreparationClaim(claim: PreparationClaim): {
+  released: boolean
+  pendingPreparations: DeferredPreparation[]
+} {
+  if (!claims.delete(claim)) {
+    return { released: false, pendingPreparations: [] }
+  }
+  return { released: true, pendingPreparations: [...claim.pendingPreparations.values()] }
+}
+
+export function startPreparation(
+  args: StartPreparationArgs,
+  kind: DeferredPreparation['kind'] = 'explicit'
+): Promise<void> {
+  const existing = findPreparation(
+    preparationPathKey(args.repoPath),
+    preparationPathKey(args.workspaceRoot),
+    args.canonicalBase,
+    args.options.wslDistro ?? ''
+  )
+  if (existing) {
+    return existing.ready
+  }
+  if (deferPreparationForClaim(args, kind)) {
+    return Promise.resolve()
+  }
   return worktreePreparationGit.run(() => startBackgroundPreparation(args))
 }
 
@@ -227,6 +309,7 @@ function startBackgroundPreparation({
 export async function _resetPreparationPoolForTests(): Promise<void> {
   const entries = [...preparations.values()]
   preparations.clear()
+  claims.clear()
   await resetStalePreparationCleanupForTests()
   await Promise.all(
     entries.map(async (entry) => {
diff --git a/src/main/worktree-create-preparation-timing.test.ts b/src/main/worktree-create-preparation-timing.test.ts
new file mode 100644
index 000000000000..bd78f506201f
--- /dev/null
+++ b/src/main/worktree-create-preparation-timing.test.ts
@@ -0,0 +1,168 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { AddWorktreeResult } from './git/worktree'
+
+const mocks = vi.hoisted(() => ({
+  mkdir: vi.fn(),
+  prepare: vi.fn(),
+  finalize: vi.fn(),
+  discard: vi.fn(),
+  listWorktreeGraph: vi.fn()
+}))
+
+vi.mock('node:fs/promises', () => ({ mkdir: mocks.mkdir }))
+vi.mock('./git/worktree', () => ({ listWorktreeGraph: mocks.listWorktreeGraph }))
+vi.mock('./git/worktree-create-preparation', () => ({
+  prepareWorktreeCreateCheckout: mocks.prepare,
+  finalizePreparedWorktree: mocks.finalize,
+  discardPreparedWorktree: mocks.discard,
+  unlockPreparedWorktree: vi.fn()
+}))
+vi.mock('./git/worktree-base-ref-probe', () => ({ resolveLocalWorktreeBaseRef: vi.fn() }))
+vi.mock('./git/worktree-base-divergence', () => ({ measureRetargetDivergence: vi.fn() }))
+vi.mock('./project-runtime-git-options', () => ({
+  getLocalProjectWorktreeGitOptions: vi.fn(),
+  getWorktreeMirrorDistro: vi.fn()
+}))
+vi.mock('./ipc/worktree-logic', () => ({
+  computeWorkspaceRootAsync: vi.fn(),
+  getWorktreePathSettings: vi.fn()
+}))
+
+import {
+  _resetWorktreeCreatePreparationsForTests,
+  consumePreparedWorktreeCreate
+} from './worktree-create-preparation'
+import { startPreparation } from './worktree-create-preparation-pool'
+import { createWorktreeCreateTimingRecorder } from './worktree-create-timing'
+
+const request = {
+  repoPath: '/repo',
+  workspaceRoot: '/workspace',
+  worktreePath: '/workspace/feature',
+  branch: 'feature',
+  baseBranch: 'origin/main'
+}
+
+function prepare() {
+  return startPreparation({
+    repoPath: request.repoPath,
+    workspaceRoot: request.workspaceRoot,
+    baseBranch: request.baseBranch,
+    canonicalBase: 'refs/remotes/origin/main',
+    options: {}
+  })
+}
+
+beforeEach(() => {
+  mocks.mkdir.mockReset().mockResolvedValue(undefined)
+  mocks.prepare.mockReset().mockResolvedValue(undefined)
+  mocks.finalize.mockReset().mockResolvedValue({})
+  mocks.discard.mockReset().mockResolvedValue(undefined)
+  mocks.listWorktreeGraph.mockReset().mockResolvedValue([])
+})
+
+afterEach(async () => {
+  await _resetWorktreeCreatePreparationsForTests()
+  vi.restoreAllMocks()
+})
+
+describe('prepared checkout create timing', () => {
+  it('separates the remaining preparation wait from finalization', async () => {
+    const checkoutStarted = Promise.withResolvers<void>()
+    const checkout = Promise.withResolvers<void>()
+    const finalizeStarted = Promise.withResolvers<void>()
+    const finalize = Promise.withResolvers<AddWorktreeResult>()
+    mocks.prepare.mockImplementation(() => {
+      checkoutStarted.resolve()
+      return checkout.promise
+    })
+    mocks.finalize.mockImplementation(() => {
+      finalizeStarted.resolve()
+      return finalize.promise
+    })
+    const preparation = prepare()
+    await checkoutStarted.promise
+
+    let now = 40
+    const timing = createWorktreeCreateTimingRecorder(() => now)
+    const create = timing.time('git_worktree_add', () =>
+      consumePreparedWorktreeCreate({ ...request, timing })
+    )
+    now = 150
+    checkout.resolve()
+    await finalizeStarted.promise
+    now = 180
+    finalize.resolve({})
+
+    expect(await create).toMatchObject({ status: 'hit', retargeted: false })
+    await preparation
+    expect(timing.finish()).toEqual({
+      totalDurationMs: 140,
+      phases: [
+        { phase: 'prepared_checkout_wait', startedAtMs: 0, durationMs: 110 },
+        { phase: 'prepared_checkout_finalize', startedAtMs: 110, durationMs: 30 },
+        { phase: 'git_worktree_add', startedAtMs: 0, durationMs: 140 }
+      ]
+    })
+  })
+
+  it('records the wait when preparation fails and the create must fall back', async () => {
+    const checkoutStarted = Promise.withResolvers<void>()
+    const checkout = Promise.withResolvers<void>()
+    mocks.prepare.mockImplementation(() => {
+      checkoutStarted.resolve()
+      return checkout.promise
+    })
+    const preparation = Promise.allSettled([prepare()])
+    await checkoutStarted.promise
+    let now = 0
+    const timing = createWorktreeCreateTimingRecorder(() => now)
+    const create = consumePreparedWorktreeCreate({ ...request, timing })
+    now = 250
+    checkout.reject(new Error('checkout failed'))
+
+    expect(await create).toEqual({
+      status: 'miss',
+      reason: 'prepare_failed',
+      rearm: expect.any(Function)
+    })
+    await preparation
+    expect(timing.finish().phases).toEqual([
+      { phase: 'prepared_checkout_wait', startedAtMs: 0, durationMs: 250 }
+    ])
+    expect(mocks.finalize).not.toHaveBeenCalled()
+  })
+
+  it('records a failed finalization before its fallback cleanup', async () => {
+    vi.spyOn(console, 'warn').mockImplementation(() => {})
+    await prepare()
+    let now = 0
+    const timing = createWorktreeCreateTimingRecorder(() => now)
+    mocks.finalize.mockImplementation(async () => {
+      now = 80
+      throw new Error('move failed')
+    })
+    mocks.discard.mockImplementation(async () => {
+      now = 100
+    })
+
+    expect(await consumePreparedWorktreeCreate({ ...request, timing })).toEqual({
+      status: 'miss',
+      reason: 'finalize_failed',
+      rearm: expect.any(Function)
+    })
+    expect(timing.finish().phases).toEqual([
+      { phase: 'prepared_checkout_wait', startedAtMs: 0, durationMs: 0 },
+      { phase: 'prepared_checkout_finalize', startedAtMs: 0, durationMs: 80 }
+    ])
+  })
+
+  it('does not report a preparation wait when no checkout was armed', async () => {
+    const timing = createWorktreeCreateTimingRecorder(() => 0)
+    expect(await consumePreparedWorktreeCreate({ ...request, timing })).toEqual({
+      status: 'miss',
+      reason: 'none_armed'
+    })
+    expect(timing.finish().phases).toEqual([])
+  })
+})
diff --git a/src/main/worktree-create-preparation.test.ts b/src/main/worktree-create-preparation.test.ts
index 9b3291bc4637..e8c2bb97bce9 100644
--- a/src/main/worktree-create-preparation.test.ts
+++ b/src/main/worktree-create-preparation.test.ts
@@ -555,7 +555,7 @@ describe('worktree create preparation registry', () => {
         branch: 'feature/test',
         baseBranch: 'origin/main'
       })
-    ).resolves.toEqual({ status: 'miss', reason: 'finalize_failed' })
+    ).resolves.toMatchObject({ status: 'miss', reason: 'finalize_failed' })
     expect(mocks.mkdir).toHaveBeenCalledWith('/workspace', { recursive: true })
     expect(mocks.discard).toHaveBeenCalledTimes(1)
   })
@@ -637,9 +637,7 @@ describe('worktree create preparation registry', () => {
     expect(mocks.prepareCheckout).toHaveBeenCalledTimes(1)
   })
 
-  // `startPreparation` overwrites the map entry outright, so a thunk that armed over a prefetch
-  // would leave that prefetch's locked checkout on disk with nothing holding a reference to it.
-  it('skips the deferred re-arm when a prefetch armed the same key mid-create', async () => {
+  it('starts one explicit prefetch after the create completes', async () => {
     await prepareWorktreeCreateForRepo(store, repo, 'origin/main')
     await consumeOnce('first')
     await prepareWorktreeCreateForRepo(store, repo, 'origin/main')
@@ -655,6 +653,7 @@ describe('worktree create preparation registry', () => {
 
     // The user reopens the composer while the create is still finishing.
     await prepareWorktreeCreateForRepo(store, repo, 'origin/main')
+    expect(mocks.prepareCheckout).toHaveBeenCalledTimes(2)
     mocks.prepareCheckout.mockClear()
 
     if (attempt.status === 'hit') {
@@ -662,7 +661,7 @@ describe('worktree create preparation registry', () => {
     }
     await flushBackgroundWork()
 
-    expect(mocks.prepareCheckout).not.toHaveBeenCalled()
+    expect(mocks.prepareCheckout).toHaveBeenCalledTimes(1)
   })
 
   it('does not re-arm when finalization failed', async () => {
diff --git a/src/main/worktree-create-preparation.ts b/src/main/worktree-create-preparation.ts
index be7ea0d5a368..3ac022910eb5 100644
--- a/src/main/worktree-create-preparation.ts
+++ b/src/main/worktree-create-preparation.ts
@@ -12,11 +12,13 @@ import { resolveLocalWorktreeBaseRef } from './git/worktree-base-ref-probe'
 import { preparationPathKey, selectPreparationForCreate } from './worktree-create-preparation-claim'
 import {
   _resetPreparationPoolForTests,
-  findPreparation,
   hasPendingPreparations,
   listPreparations,
+  releasePreparationClaim,
   startPreparation,
   takePreparation,
+  type DeferredPreparation,
+  type PreparationClaim,
   type PreparationEntry
 } from './worktree-create-preparation-pool'
 import {
@@ -33,6 +35,7 @@ import {
   resetPreparationConsumeHistoryForTests
 } from './worktree-create-preparation-burst'
 import { toHostFilesystemPath } from './host-tree-removal'
+import type { WorktreeCreateTimingRecorder } from './worktree-create-timing'
 
 export {
   WORKTREE_CREATE_PREPARATION_LIMIT,
@@ -56,7 +59,7 @@ export type PreparedWorktreeCreateAttempt =
       /** Run after materialization/startup completes, before returning the create result. */
       rearm: () => void
     }
-  | { status: 'miss'; reason: PreparedCheckoutMissReason }
+  | { status: 'miss'; reason: PreparedCheckoutMissReason; rearm?: () => void }
 
 type ConsumePreparedWorktreeArgs = {
   repoPath: string
@@ -66,6 +69,7 @@ type ConsumePreparedWorktreeArgs = {
   baseBranch: string
   refreshLocalBaseRef?: boolean
   options?: AddWorktreeOptions
+  timing?: Pick<WorktreeCreateTimingRecorder, 'time'>
 }
 
 function canonicalBaseRef(
@@ -107,16 +111,6 @@ async function prepareWorktreeCreateInBackground(
     getWorktreePathSettings(repo, store.getSettings(), getWorktreeMirrorDistro(store, repo))
   )
   const canonicalBase = await canonicalBaseRef(repo.path, baseBranch, options)
-  const existing = findPreparation(
-    preparationPathKey(repo.path),
-    preparationPathKey(workspaceRoot),
-    canonicalBase,
-    options.wslDistro ?? ''
-  )
-  if (existing) {
-    return existing.ready
-  }
-
   return startPreparation({
     repoPath: repo.path,
     workspaceRoot,
@@ -127,8 +121,14 @@ async function prepareWorktreeCreateInBackground(
 }
 
 type ClaimedPreparation =
-  | { status: 'claimed'; entry: PreparationEntry; retargeted: boolean; canonicalBase: string }
-  | { status: 'miss'; reason: PreparedCheckoutMissReason }
+  | {
+      status: 'claimed'
+      entry: PreparationEntry
+      reservation: PreparationClaim
+      retargeted: boolean
+      canonicalBase: string
+    }
+  | { status: 'miss'; reason: PreparedCheckoutMissReason; rearm?: () => void }
 
 async function claimPreparedWorktree(
   args: ConsumePreparedWorktreeArgs,
@@ -187,17 +187,34 @@ async function claimPreparedWorktree(
     }
   }
   const entry = selection.candidate
-  takePreparation(entry)
+  const reservation = takePreparation(entry, selection.canonicalBase)
   try {
-    await entry.ready
+    await (args.timing
+      ? args.timing.time('prepared_checkout_wait', () => entry.ready)
+      : entry.ready)
     return {
       status: 'claimed',
       entry,
+      reservation,
       retargeted: selection.kind === 'retarget',
       canonicalBase: selection.canonicalBase
     }
   } catch {
-    return { status: 'miss', reason: 'prepare_failed' }
+    return { status: 'miss', reason: 'prepare_failed', rearm: releaseClaimAfterCreate(reservation) }
+  }
+}
+
+function startDeferredPreparation(preparation: DeferredPreparation): void {
+  void startPreparation(preparation.args, preparation.kind).catch(() => {
+    // A later create still has the normal add path if speculative preparation fails.
+  })
+}
+
+function releaseClaimAfterCreate(reservation: PreparationClaim): () => void {
+  return () => {
+    for (const preparation of releasePreparationClaim(reservation).pendingPreparations) {
+      startDeferredPreparation(preparation)
+    }
   }
 }
 
@@ -209,37 +226,38 @@ async function claimPreparedWorktree(
  *  Returns a thunk rather than launching: the replacement is a full `reset --hard`, which on a
  *  large repo holds a general admission slot for tens of seconds. Started mid-create it competes
  *  with the create's own git, so the caller runs it after materialization/startup completes. The burst
- *  bookkeeping still happens here — a prefetch that re-armed this key while we finalized would
- *  otherwise swallow the consume, and the next create would look isolated when it is really the
- *  middle of a burst. */
+ *  bookkeeping still happens here so a later create is recognized as part of a burst. An explicit
+ *  prefetch during this create takes precedence over the burst replacement at release. */
 function deferRearmPreparation(
   entry: PreparationEntry,
+  reservation: PreparationClaim,
   baseBranch: string,
   canonicalBase: string
 ): () => void {
   const continuesBurst = recordPreparationConsume(entry.key)
-  const alreadyArmed = (): boolean =>
-    findPreparation(entry.repoPathKey, entry.workspaceRootKey, canonicalBase, entry.wslDistro) !==
-    undefined
-  if (!continuesBurst || alreadyArmed()) {
-    return () => {}
-  }
   return () => {
-    // Re-checked here, not only at consume time: `startPreparation` overwrites the map entry
-    // outright, so arming over a prefetch that landed during the create would strand its
-    // checkout on disk with no owner to discard it.
-    if (alreadyArmed()) {
+    const { released, pendingPreparations } = releasePreparationClaim(reservation)
+    if (!released) {
       return
     }
-    void startPreparation({
-      repoPath: entry.repoPath,
-      workspaceRoot: entry.workspaceRoot,
-      baseBranch,
-      canonicalBase,
-      options: entry.options
-    }).catch(() => {
-      // Why: a warm-up failure is recovered by the normal add on the next create.
-    })
+    const requestedBaseArmed = pendingPreparations.some(
+      (preparation) => preparation.args.canonicalBase === canonicalBase
+    )
+    for (const preparation of pendingPreparations) {
+      startDeferredPreparation(preparation)
+    }
+    if (continuesBurst && !requestedBaseArmed) {
+      startDeferredPreparation({
+        args: {
+          repoPath: entry.repoPath,
+          workspaceRoot: entry.workspaceRoot,
+          baseBranch,
+          canonicalBase,
+          options: entry.options
+        },
+        kind: 'automatic'
+      })
+    }
   }
 }
 
@@ -249,9 +267,9 @@ export async function consumePreparedWorktreeCreate(
   const options = args.options ?? {}
   const claim = await claimPreparedWorktree(args, options)
   if (claim.status === 'miss') {
-    return { status: 'miss', reason: claim.reason }
+    return { status: 'miss', reason: claim.reason, ...(claim.rearm ? { rearm: claim.rearm } : {}) }
   }
-  const { entry } = claim
+  const { entry, reservation } = claim
   try {
     const parentDir = isWindowsAbsolutePathLike(args.worktreePath)
       ? win32.dirname(args.worktreePath)
@@ -259,18 +277,22 @@ export async function consumePreparedWorktreeCreate(
     await mkdir(toHostFilesystemPath(parentDir), { recursive: true })
     // Finalize resolves the requested base itself and resets the prepared checkout onto that
     // commit, so a retargeted claim is handed over at the requested commit or not at all.
-    const result = await finalizePreparedWorktree(
-      args.repoPath,
-      entry.preparedPath,
-      args.worktreePath,
-      args.branch,
-      args.baseBranch,
-      args.refreshLocalBaseRef,
-      options
-    )
+    const finalize = (): Promise<AddWorktreeResult> =>
+      finalizePreparedWorktree(
+        args.repoPath,
+        entry.preparedPath,
+        args.worktreePath,
+        args.branch,
+        args.baseBranch,
+        args.refreshLocalBaseRef,
+        options
+      )
+    const result = args.timing
+      ? await args.timing.time('prepared_checkout_finalize', finalize)
+      : await finalize()
     // Consuming the only prepared checkout leaves the next create cold. Re-arm for a user who is
     // creating in a burst; the TTL and the preparation limit still bound an unused replacement.
-    const rearm = deferRearmPreparation(entry, args.baseBranch, claim.canonicalBase)
+    const rearm = deferRearmPreparation(entry, reservation, args.baseBranch, claim.canonicalBase)
     return { status: 'hit', retargeted: claim.retargeted, result, rearm }
   } catch (error) {
     await discardPreparedWorktree(args.repoPath, entry.preparedPath, options).catch(() => {})
@@ -278,7 +300,11 @@ export async function consumePreparedWorktreeCreate(
       '[worktree-create] prepared checkout could not be finalized; using normal add',
       error
     )
-    return { status: 'miss', reason: 'finalize_failed' }
+    return {
+      status: 'miss',
+      reason: 'finalize_failed',
+      rearm: releaseClaimAfterCreate(reservation)
+    }
   }
 }
 
diff --git a/src/main/worktree-removal-safety.test.ts b/src/main/worktree-removal-safety.test.ts
index 9aa9775de44d..d32289a5fc76 100644
--- a/src/main/worktree-removal-safety.test.ts
+++ b/src/main/worktree-removal-safety.test.ts
@@ -6,7 +6,8 @@ import {
   canSafelyRemoveOrphanedWorktreeDirectory,
   findRegisteredDeletableWorktree,
   getRegisteredDeletableWorktree,
-  isDangerousWorktreeRemovalPath
+  isDangerousWorktreeRemovalPath,
+  isWorktreePathMissing
 } from './worktree-removal-safety'
 import { CLIENT_REMOVAL_HOME, executionHostRemovalHome } from './worktree-removal-home-guard'
 
@@ -349,6 +350,16 @@ describe('canSafelyRemoveOrphanedWorktreeDirectory', () => {
   })
 })
 
+describe('isWorktreePathMissing', () => {
+  it('does not treat an unreadable path as absent', async () => {
+    await expect(
+      isWorktreePathMissing('/workspaces/locked', async () => {
+        throw Object.assign(new Error('permission denied'), { code: 'EACCES' })
+      })
+    ).resolves.toBe(false)
+  })
+})
+
 describe('canCleanupUnregisteredOrcaLeftoverDirectory', () => {
   const repo = { path: '/repos/main' }
   const ownedMeta = { orcaCreatedAt: 1, orcaCreationSource: 'runtime' as const }
diff --git a/src/main/worktree-removal-session-partition-fencing.test.ts b/src/main/worktree-removal-session-partition-fencing.test.ts
index 89b7feafee65..03dc50a3dd54 100644
--- a/src/main/worktree-removal-session-partition-fencing.test.ts
+++ b/src/main/worktree-removal-session-partition-fencing.test.ts
@@ -1,3 +1,4 @@
+import { closeTestStores, createSqliteTestStore } from './persistence-test-harness'
 // Why this file exists: worktree removal writes to host session partitions, and the two hazards below
 // are only visible across a removal followed by a renderer session write — persistence.test.ts covers
 // removal and partitioning separately, so neither suite catches the interaction.
@@ -34,7 +35,7 @@ async function createStore() {
   vi.resetModules()
   const { Store, initDataPath } = await import('./persistence')
   initDataPath()
-  return new Store()
+  return createSqliteTestStore(Store, { dataFile: join(testState.dir, 'orca-data.json') })
 }
 
 const makeTerminalTab = (overrides: Partial<TerminalTab> = {}): TerminalTab => ({
@@ -58,7 +59,8 @@ describe('worktree removal across host session partitions', () => {
     testState.dir = mkdtempSync(join(tmpdir(), 'orca-test-'))
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    await closeTestStores()
     rmSync(testState.dir, { recursive: true, force: true })
   })
 
diff --git a/src/main/wsl-managed-cli-path-restore.test.ts b/src/main/wsl-managed-cli-path-restore.test.ts
new file mode 100644
index 000000000000..01d803900998
--- /dev/null
+++ b/src/main/wsl-managed-cli-path-restore.test.ts
@@ -0,0 +1,59 @@
+import { chmodSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterAll, describe, expect, it } from 'vitest'
+import { runProcessSync } from '../shared/child-process/run-process'
+import { WSL_MANAGED_CLI_PATH_RESTORE } from './wsl-managed-cli-path-restore'
+
+const posix = process.platform !== 'win32'
+const hasZsh = posix && runProcessSync({ program: 'sh', args: ['-c', 'command -v zsh'] }).code === 0
+const root = posix ? mkdtempSync(join(tmpdir(), 'orca managed cli restore ')) : ''
+if (posix) {
+  writeFileSync(join(root, 'orca-dev'), '#!/bin/sh\n')
+  chmodSync(join(root, 'orca-dev'), 0o755)
+  writeFileSync(join(root, 'orca-ide'), '#!/bin/sh\n')
+  chmodSync(join(root, 'orca-ide'), 0o644)
+}
+afterAll(() => {
+  if (root) {
+    rmSync(root, { recursive: true, force: true })
+  }
+})
+
+// Mirrors how each shell embeds the snippet: bash rcfile top level, zsh first-prompt hook.
+const SHELLS = [
+  { name: 'bash', enabled: posix, args: (body: string) => ['--norc', '--noprofile', '-uc', body] },
+  {
+    name: 'zsh',
+    enabled: hasZsh,
+    args: (body: string) => ['-fuc', `__orca_hook() {\n  emulate -L zsh\n${body}\n}\n__orca_hook`]
+  }
+] as const
+
+function run(
+  shell: (typeof SHELLS)[number],
+  env: Record<string, string>
+): { code: number | null; stdout: string; stderr: string } {
+  return runProcessSync({
+    program: shell.name,
+    args: shell.args(`${WSL_MANAGED_CLI_PATH_RESTORE}\nprintf '%s' "$PATH"`),
+    env: { PATH: '/usr/bin:/bin', ...env }
+  })
+}
+
+describe.each(SHELLS)('WSL_MANAGED_CLI_PATH_RESTORE in $name', (shell) => {
+  it.skipIf(!shell.enabled)('leads PATH with a directory holding an executable CLI', () => {
+    const result = run(shell, { ORCA_WSL_CLI_DIR: root, ORCA_CLI_COMMAND: 'orca-dev' })
+    expect(result).toMatchObject({ code: 0, stdout: `${root}:/usr/bin:/bin`, stderr: '' })
+  })
+
+  it.skipIf(!shell.enabled)('warns and keeps PATH when the CLI cannot run', () => {
+    const result = run(shell, { ORCA_WSL_CLI_DIR: root, ORCA_CLI_COMMAND: 'orca-ide' })
+    expect(result).toMatchObject({ code: 0, stdout: '/usr/bin:/bin' })
+    expect(result.stderr).toContain('Orca CLI unavailable')
+  })
+
+  it.skipIf(!shell.enabled)('does nothing without a managed directory', () => {
+    expect(run(shell, {})).toMatchObject({ code: 0, stdout: '/usr/bin:/bin', stderr: '' })
+  })
+})
diff --git a/src/main/wsl-managed-cli-path-restore.ts b/src/main/wsl-managed-cli-path-restore.ts
new file mode 100644
index 000000000000..d3091433a71b
--- /dev/null
+++ b/src/main/wsl-managed-cli-path-restore.ts
@@ -0,0 +1,8 @@
+/** Leads PATH with the managed WSL CLI after startup files ran; an unusable CLI only warns. */
+export const WSL_MANAGED_CLI_PATH_RESTORE = `if [ -n "\${ORCA_WSL_CLI_DIR:-}" ]; then
+  if [ -x "$ORCA_WSL_CLI_DIR/\${ORCA_CLI_COMMAND:-}" ]; then
+    export PATH="$ORCA_WSL_CLI_DIR\${PATH:+:$PATH}"
+  else
+    printf 'Orca CLI unavailable: cannot run %s. Check WSL Windows-drive mount options.\\n' "$ORCA_WSL_CLI_DIR/\${ORCA_CLI_COMMAND:-}" >&2
+  fi
+fi`
diff --git a/src/main/wsl-running-distro-cache.ts b/src/main/wsl-running-distro-cache.ts
index 436fbe419cb2..07a55a47bcd2 100644
--- a/src/main/wsl-running-distro-cache.ts
+++ b/src/main/wsl-running-distro-cache.ts
@@ -8,7 +8,8 @@ import { wslDistroListRetryDelayMs } from './wsl-distro-retry'
 let cache: string[] | null = null
 let retryAfterMs = 0
 let failureStreak = 0
-let inFlightProbe: Promise<string[]> | null = null
+type RunningDistroObservation = { distros: string[]; confirmed: boolean }
+let inFlightProbe: Promise<RunningDistroObservation> | null = null
 
 function armRetryAfterFailure(): void {
   const now = Date.now()
@@ -28,24 +29,37 @@ function armRetryAfterFailure(): void {
  * back to the cache and arms backoff. Bounds wsl.exe spawns under both IPC fan-out and a
  * broken/degraded host.
  */
-export function resolveRunningWslDistros(probe: () => Promise<string[]>): Promise<string[]> {
+export async function resolveRunningWslDistros(
+  probe: () => Promise<string[]>,
+  options: { requireConfirmed?: boolean } = {}
+): Promise<string[]> {
+  const observation = await observeRunningWslDistros(probe)
+  if (options.requireConfirmed && !observation.confirmed) {
+    throw new Error('WSL running-distro discovery is unavailable. Retry when WSL is reachable.')
+  }
+  return observation.distros
+}
+
+function observeRunningWslDistros(
+  probe: () => Promise<string[]>
+): Promise<RunningDistroObservation> {
   if (inFlightProbe) {
     return inFlightProbe
   }
   if (Date.now() < retryAfterMs) {
-    return Promise.resolve(cache ?? [])
+    return Promise.resolve({ distros: cache ?? [], confirmed: false })
   }
   const result = probe()
     .then((distros) => {
       cache = distros
       retryAfterMs = 0
       failureStreak = 0
-      return cache
+      return { distros, confirmed: true }
     })
     .catch((error: unknown) => {
       armRetryAfterFailure()
       console.warn('[wsl] running-distro probe failed; falling back to last-known-good list', error)
-      return cache ?? []
+      return { distros: cache ?? [], confirmed: false }
     })
     .finally(() => {
       if (inFlightProbe === result) {
diff --git a/src/main/wsl-running-distros.test.ts b/src/main/wsl-running-distros.test.ts
index 049c2f2e3796..4f80e5eb5c22 100644
--- a/src/main/wsl-running-distros.test.ts
+++ b/src/main/wsl-running-distros.test.ts
@@ -67,6 +67,65 @@ describe('running WSL distro discovery', () => {
     })
   })
 
+  it('rejects stale running state for launch admission through failure and backoff', async () => {
+    vi.useFakeTimers()
+    execFileMock.mockImplementationOnce((_command, _args, _options, callback) => {
+      callback(null, 'Ubuntu\n')
+    })
+
+    await withPlatform('win32', async () => {
+      await expect(listRunningWslDistrosAsync()).resolves.toEqual(['Ubuntu'])
+      execFileMock.mockImplementation((_command, _args, _options, callback) => {
+        callback(new Error('wsl unavailable'), '')
+      })
+      const paths = ['\\\\wsl.localhost\\Ubuntu\\home\\ada']
+      await expect(
+        filterPathsToRunningWslDistrosAsync(paths, { requireConfirmed: true })
+      ).rejects.toThrow('discovery is unavailable')
+      await expect(listRunningWslDistrosAsync()).resolves.toEqual(['Ubuntu'])
+      await expect(listRunningWslDistrosAsync({ requireConfirmed: true })).rejects.toThrow(
+        'discovery is unavailable'
+      )
+      expect(execFileMock).toHaveBeenCalledTimes(2)
+
+      execFileMock.mockImplementation((_command, _args, _options, callback) => {
+        callback(null, '')
+      })
+      await vi.advanceTimersByTimeAsync(15_001)
+      await expect(
+        filterPathsToRunningWslDistrosAsync(paths, { requireConfirmed: true })
+      ).resolves.toEqual([])
+      expect(execFileMock).toHaveBeenCalledTimes(3)
+    })
+  })
+
+  it.each([true, false])(
+    'shares the probe while preserving admission and observer failure policies (strict first: %s)',
+    async (strictFirst) => {
+      execFileMock.mockImplementationOnce((_command, _args, _options, callback) => {
+        callback(null, 'Ubuntu\n')
+      })
+
+      await withPlatform('win32', async () => {
+        await listRunningWslDistrosAsync()
+        let finishProbe: ((error: Error | null, output: string) => void) | undefined
+        execFileMock.mockImplementationOnce((_command, _args, _options, callback) => {
+          finishProbe = callback
+        })
+        const first = listRunningWslDistrosAsync({ requireConfirmed: strictFirst })
+        const second = listRunningWslDistrosAsync({ requireConfirmed: !strictFirst })
+        const strict = strictFirst ? first : second
+        const observer = strictFirst ? second : first
+        const rejected = expect(strict).rejects.toThrow('discovery is unavailable')
+        expect(execFileMock).toHaveBeenCalledTimes(2)
+        finishProbe?.(new Error('wsl unavailable'), '')
+        await rejected
+        await expect(observer).resolves.toEqual(['Ubuntu'])
+        expect(execFileMock).toHaveBeenCalledTimes(2)
+      })
+    }
+  )
+
   it('resolves homes only for the running distro set', async () => {
     execFileMock.mockImplementation((_command, args, _options, callback) => {
       callback(null, args.includes('--running') ? 'Ubuntu\n' : '/home/ada\n')
@@ -139,6 +198,21 @@ describe('running WSL distro discovery', () => {
     })
   })
 
+  it('shares a confirmed fresh probe between discovery and launch admission', async () => {
+    execFileMock.mockImplementationOnce((_command, _args, _options, callback) =>
+      callback(null, 'Ubuntu\n')
+    )
+    await withPlatform('win32', async () => {
+      expect(
+        await Promise.all([
+          listRunningWslDistrosAsync(),
+          listRunningWslDistrosAsync({ requireConfirmed: true })
+        ])
+      ).toEqual([['Ubuntu'], ['Ubuntu']])
+      expect(execFileMock).toHaveBeenCalledOnce()
+    })
+  })
+
   it('filters stopped-distro UNC paths while preserving host paths', async () => {
     execFileMock.mockImplementation((_command, _args, _options, callback) => {
       callback(null, 'Ubuntu\n')
diff --git a/src/main/wsl-running-path-filter.ts b/src/main/wsl-running-path-filter.ts
index 7384229757fc..370e5b4783c8 100644
--- a/src/main/wsl-running-path-filter.ts
+++ b/src/main/wsl-running-path-filter.ts
@@ -14,11 +14,12 @@ export function filterPathsToWslDistros(
 
 /** Keep host paths and WSL paths whose distro is running now. */
 export async function filterPathsToRunningWslDistrosAsync(
-  paths: readonly string[]
+  paths: readonly string[],
+  options?: { requireConfirmed?: boolean }
 ): Promise<string[]> {
   if (process.platform !== 'win32') {
     return [...paths]
   }
-  const runningDistros = paths.some(isWslUncPath) ? await listRunningWslDistrosAsync() : []
+  const runningDistros = paths.some(isWslUncPath) ? await listRunningWslDistrosAsync(options) : []
   return filterPathsToWslDistros(paths, runningDistros)
 }
diff --git a/src/main/wsl.ts b/src/main/wsl.ts
index be69dde401a1..007b2f1c8bca 100644
--- a/src/main/wsl.ts
+++ b/src/main/wsl.ts
@@ -230,15 +230,19 @@ export async function listWslDistrosAsync(): Promise<string[]> {
 
 /** Running user distros only — see `resolveRunningWslDistros` for the fallback/backoff and
  *  single-flight contract shared by every caller. */
-export async function listRunningWslDistrosAsync(): Promise<string[]> {
+export async function listRunningWslDistrosAsync(
+  options: { requireConfirmed?: boolean } = {}
+): Promise<string[]> {
   if (process.platform !== 'win32') {
     return []
   }
-  return resolveRunningWslDistros(() =>
-    execFileUtf8('wsl.exe', ['--list', '--running', '--quiet'], {
-      ...process.env,
-      WSL_UTF8: '1'
-    }).then((output) => filterUserWslDistros(parseWslDistros(output)))
+  return resolveRunningWslDistros(
+    () =>
+      execFileUtf8('wsl.exe', ['--list', '--running', '--quiet'], {
+        ...process.env,
+        WSL_UTF8: '1'
+      }).then((output) => filterUserWslDistros(parseWslDistros(output))),
+    options
   )
 }
 
diff --git a/src/main/zsh-startup-wrapper-builder.ts b/src/main/zsh-startup-wrapper-builder.ts
index 27a1e0b76157..49f706e57417 100644
--- a/src/main/zsh-startup-wrapper-builder.ts
+++ b/src/main/zsh-startup-wrapper-builder.ts
@@ -27,6 +27,7 @@
  * hook restores zsh option semantics for the body at call time.
  */
 import { getPosixOmpShellWrapper } from './pty/omp-shell-wrapper'
+import { WSL_MANAGED_CLI_PATH_RESTORE } from './wsl-managed-cli-path-restore'
 import { getPosixCodexShellLaunchPreflight } from './pty/codex-shell-launch-preflight'
 import {
   getZshShellReadyMarkerRegistrationBlock,
@@ -38,6 +39,8 @@ import {
 
 /** Runtime values the hook re-exports after the user's own startup files ran. */
 export type ZshWrapperRestoreSpec = {
+  /** The managed WSL CLI dir onto PATH — local wrappers only; a no-op outside WSL. */
+  managedWslCli: boolean
   /** Orca's agent-teams shim dir back onto PATH. */
   agentTeamsPath: boolean
   /** Remote CLI bin dir onto PATH — relay hosts only. */
@@ -170,6 +173,7 @@ ${indentBlock(getZshShellReadyMarkerRegistrationBlock(spec.readyMarkerEscaped, t
   builtin typeset -g precmd_functions
 ${permanentPrecmd}
 ${joinBlocks([
+  spec.restores.managedWslCli ? indentBlock(WSL_MANAGED_CLI_PATH_RESTORE, '  ') : null,
   featureGuard('overlay', getOverlayRestoreBlocks(spec)),
   // Why no /etc/zshrc repair branch: ZDOTDIR was handed back before that file
   // ran, so the value it derives is the user's own path. #11044 is unreachable.
diff --git a/src/preload/api-types.ts b/src/preload/api-types.ts
index 26527b9a1e55..7e4b2def4349 100644
--- a/src/preload/api-types.ts
+++ b/src/preload/api-types.ts
@@ -2,6 +2,7 @@ import type {
   ClaudeAccountsApi,
   CodexAccountsApi,
   CodexConfigSyncApi,
+  CursorAccountsApi,
   GrokAccountsApi,
   MinimaxCredentialsApi
 } from './api/agent-account-api'
@@ -143,6 +144,7 @@ export type PreloadApi = {
   rateLimits: RateLimitsApi
   minimaxCredentials: MinimaxCredentialsApi
   grokAccounts: GrokAccountsApi
+  cursorAccounts: CursorAccountsApi
   ssh: SshApi
   automations: AutomationsApi
   wsl: RuntimeApi['wsl']
diff --git a/src/preload/api/agent-account-api.ts b/src/preload/api/agent-account-api.ts
index f041e41f8b7a..e8d574c285bf 100644
--- a/src/preload/api/agent-account-api.ts
+++ b/src/preload/api/agent-account-api.ts
@@ -3,7 +3,7 @@ import type {
   CodexRateLimitAccountsState
 } from '../../shared/managed-account-types'
 import type { CodexConfigSyncStatus } from '../../shared/codex-config-sync-types'
-import type { GrokAccountStatus } from '../../shared/rate-limit-types'
+import type { CursorAccountStatus, GrokAccountStatus } from '../../shared/rate-limit-types'
 
 export type CodexAccountsApi = {
   list: () => Promise<CodexRateLimitAccountsState>
@@ -62,6 +62,10 @@ export type GrokAccountsApi = {
   getStatus: () => Promise<GrokAccountStatus>
 }
 
+export type CursorAccountsApi = {
+  getStatus: () => Promise<CursorAccountStatus>
+}
+
 export type MinimaxCredentialsApi = {
   // Why: cookie + API key each live in their own safeStorage file, so the
   // status separates them. 'configured' stays as the OR so existing callers
diff --git a/src/preload/api/agent-status-api.ts b/src/preload/api/agent-status-api.ts
index 7c538a990f14..8cd8fb6a2517 100644
--- a/src/preload/api/agent-status-api.ts
+++ b/src/preload/api/agent-status-api.ts
@@ -50,7 +50,7 @@ export type AgentStatusApi = {
 
 export type AgentTrustApi = {
   markTrusted: (args: {
-    preset: 'cursor' | 'copilot' | 'codex' | 'antigravity'
+    preset: 'cursor' | 'copilot' | 'codex' | 'antigravity' | 'qoder'
     workspacePath: string
     connectionId?: string
   }) => Promise<void>
diff --git a/src/preload/api/agent-trust-bridge.ts b/src/preload/api/agent-trust-bridge.ts
index a9afa9c363df..9d87c62eb491 100644
--- a/src/preload/api/agent-trust-bridge.ts
+++ b/src/preload/api/agent-trust-bridge.ts
@@ -3,7 +3,7 @@ import type { PreloadApi } from '../api-types'
 
 export const agentTrustApi = {
   markTrusted: (args: {
-    preset: 'cursor' | 'copilot' | 'codex' | 'antigravity'
+    preset: 'cursor' | 'copilot' | 'codex' | 'antigravity' | 'qoder'
     workspacePath: string
     connectionId?: string
   }): Promise<void> => ipcRenderer.invoke('agentTrust:markTrusted', args)
diff --git a/src/preload/api/cursor-accounts-bridge.ts b/src/preload/api/cursor-accounts-bridge.ts
new file mode 100644
index 000000000000..20f8d5d6a004
--- /dev/null
+++ b/src/preload/api/cursor-accounts-bridge.ts
@@ -0,0 +1,7 @@
+import { ipcRenderer } from 'electron'
+import type { CursorAccountStatus } from '../../shared/rate-limit-types'
+import type { PreloadApi } from '../api-types'
+
+export const cursorAccountsApi = {
+  getStatus: (): Promise<CursorAccountStatus> => ipcRenderer.invoke('cursorAccounts:getStatus')
+} satisfies PreloadApi['cursorAccounts']
diff --git a/src/preload/api/filesystem-api.ts b/src/preload/api/filesystem-api.ts
index 2a8f0612905f..d8b74cd93043 100644
--- a/src/preload/api/filesystem-api.ts
+++ b/src/preload/api/filesystem-api.ts
@@ -170,6 +170,8 @@ export type FilesystemApi = {
     listPythonEnvironments: (args: {
       filePath: string
       rootPath: string | null
+      /** False until the notebook is trusted: workspace envs are then listed without running them. */
+      runWorkspaceInterpreters: boolean
     }) => Promise<PythonEnvironments>
     describePython: (args: { path: string }) => Promise<PythonEnvironment | null>
     startKernel: (args: { filePath: string; python: string }) => Promise<KernelStartResult>
diff --git a/src/preload/api/orca-profiles-bridge.ts b/src/preload/api/orca-profiles-bridge.ts
index da58b2d9defa..201b6be97991 100644
--- a/src/preload/api/orca-profiles-bridge.ts
+++ b/src/preload/api/orca-profiles-bridge.ts
@@ -1,6 +1,13 @@
 import { ipcRenderer } from 'electron'
 import type { PreloadApi } from '../api-types'
-import { ORCA_PROFILE_AUTH_STATUS_CHANGED_CHANNEL } from '../../shared/orca-profiles'
+import {
+  ORCA_PROFILE_AUTH_STATUS_CHANGED_CHANNEL,
+  type OrcaProfileListResult,
+  type SwitchOrcaProfileResult,
+  type TransferOrcaProfileProjectResult
+} from '../../shared/orca-profiles'
+import { prepareAndInvokeAppRestart } from '../renderer-restart-wiring'
+import { awaitBeforeUnloadCheckpoint } from '../preload-runtime-support'
 
 export const orcaProfilesApi = {
   list: () => ipcRenderer.invoke('orcaProfiles:list'),
@@ -12,8 +19,30 @@ export const orcaProfilesApi = {
   },
   createLocal: (args) => ipcRenderer.invoke('orcaProfiles:createLocal', args),
   createCloudLinked: (args) => ipcRenderer.invoke('orcaProfiles:createCloudLinked', args),
-  switchProfile: (args) => ipcRenderer.invoke('orcaProfiles:switch', args),
-  transferProject: (args) => ipcRenderer.invoke('orcaProfiles:transferProject', args),
+  switchProfile: (args) =>
+    prepareAndInvokeAppRestart(
+      window,
+      (): Promise<SwitchOrcaProfileResult> => ipcRenderer.invoke('orcaProfiles:switch', args),
+      awaitBeforeUnloadCheckpoint,
+      (result) => result.status === 'relaunching'
+    ),
+  transferProject: async (args) => {
+    const invoke = (): Promise<TransferOrcaProfileProjectResult> =>
+      ipcRenderer.invoke('orcaProfiles:transferProject', args)
+    if (args.mode !== 'move') {
+      return invoke()
+    }
+    const current: OrcaProfileListResult = await ipcRenderer.invoke('orcaProfiles:list')
+    if (args.sourceProfileId !== current.activeProfileId) {
+      return invoke()
+    }
+    return prepareAndInvokeAppRestart(
+      window,
+      invoke,
+      awaitBeforeUnloadCheckpoint,
+      (result) => result.status === 'transferred' && result.willRelaunch === true
+    )
+  },
   findProjectProfiles: (args) => ipcRenderer.invoke('orcaProfiles:findProjectProfiles', args),
   connectCurrent: () => ipcRenderer.invoke('orcaProfiles:connectCurrent'),
   refreshAuth: () => ipcRenderer.invoke('orcaProfiles:refreshAuth'),
diff --git a/src/preload/api/pty-api.ts b/src/preload/api/pty-api.ts
index ca273aee07d6..55937134bb13 100644
--- a/src/preload/api/pty-api.ts
+++ b/src/preload/api/pty-api.ts
@@ -3,6 +3,7 @@ import type {
   SleepingAgentLaunchConfig
 } from '../../shared/agent-session-resume'
 import type { StartupCommandDelivery } from '../../shared/codex-startup-delivery'
+import type { TerminalInputKind } from '../../shared/terminal-input-kind'
 import type { ProjectExecutionRuntimeResolution } from '../../shared/project-execution-runtime'
 import type { PtyListedSession, PtySessionListScope } from '../../shared/pty-listed-session'
 import type { PtyMainDeliveryDiagnostics } from '../../shared/pty-delivery-diagnostics'
@@ -75,8 +76,8 @@ export type PtyApi = {
     /** Host verdict on the shell-ready marker; absent when the execution host predates the field. */
     shellReadyArmed?: boolean
   }>
-  write: (id: string, data: string) => void
-  writeAccepted: (id: string, data: string) => Promise<boolean>
+  write: (id: string, data: string, inputKind: TerminalInputKind) => void
+  writeAccepted: (id: string, data: string, inputKind: TerminalInputKind) => Promise<boolean>
   onWriteUnavailable?: (callback: (payload: { id: string }) => void) => () => void
   resize: (id: string, cols: number, rows: number) => void
   claimViewport: (id: string, cols: number, rows: number) => void
diff --git a/src/preload/api/pty-bridge-session-control.ts b/src/preload/api/pty-bridge-session-control.ts
index e9b19dbe43ab..225aec9618a2 100644
--- a/src/preload/api/pty-bridge-session-control.ts
+++ b/src/preload/api/pty-bridge-session-control.ts
@@ -1,6 +1,7 @@
 import { ipcRenderer } from 'electron'
 import type { ProjectExecutionRuntimeResolution } from '../../shared/project-execution-runtime'
 import type { StartupCommandDelivery } from '../../shared/codex-startup-delivery'
+import type { TerminalInputKind } from '../../shared/terminal-input-kind'
 import type {
   AgentProviderSessionMetadata,
   SleepingAgentLaunchConfig
@@ -71,11 +72,11 @@ export const ptySessionControlApi = {
     /** Host verdict on the shell-ready marker; absent when the execution host predates the field. */
     shellReadyArmed?: boolean
   }> => ipcRenderer.invoke('pty:spawn', opts),
-  write: (id: string, data: string): void => {
-    ipcRenderer.send('pty:write', { id, data })
+  write: (id: string, data: string, inputKind: TerminalInputKind): void => {
+    ipcRenderer.send('pty:write', { id, data, inputKind })
   },
-  writeAccepted: (id: string, data: string): Promise<boolean> =>
-    ipcRenderer.invoke('pty:writeAccepted', { id, data }),
+  writeAccepted: (id: string, data: string, inputKind: TerminalInputKind): Promise<boolean> =>
+    ipcRenderer.invoke('pty:writeAccepted', { id, data, inputKind }),
   onWriteUnavailable: (callback: (payload: { id: string }) => void): (() => void) => {
     const handler = (_event: Electron.IpcRendererEvent, payload: { id: string }): void =>
       callback(payload)
diff --git a/src/preload/api/session-bridge.ts b/src/preload/api/session-bridge.ts
index 22d342cd2c1f..537e15179ddd 100644
--- a/src/preload/api/session-bridge.ts
+++ b/src/preload/api/session-bridge.ts
@@ -7,6 +7,7 @@ export const sessionApi = {
   listHostIds: () => ipcRenderer.invoke('session:list-host-ids'),
   set: (args, hostId) => ipcRenderer.invoke('session:set', args, hostId),
   patch: (args, hostId) => ipcRenderer.invoke('session:patch', args, hostId),
+  closeTerminalSurface: (args) => ipcRenderer.invoke('session:close-terminal-surface', args),
   flush: () => ipcRenderer.invoke('session:flush'),
   readTerminalScrollback: (args) =>
     ipcRenderer.sendSync('session:read-terminal-scrollback-sync', args),
diff --git a/src/preload/api/ssh-api.ts b/src/preload/api/ssh-api.ts
index af198ad1080e..5fc64c030e5d 100644
--- a/src/preload/api/ssh-api.ts
+++ b/src/preload/api/ssh-api.ts
@@ -71,6 +71,7 @@ export type SshApi = {
       targetId: string
       kind: 'passphrase' | 'password' | 'keyboard-interactive'
       detail: string
+      echo?: boolean
     }) => void
   ) => () => void
   onCredentialResolved: (callback: (data: { requestId: string }) => void) => () => void
diff --git a/src/preload/api/ssh-bridge.ts b/src/preload/api/ssh-bridge.ts
index 03c10f9bc07b..240da3c95080 100644
--- a/src/preload/api/ssh-bridge.ts
+++ b/src/preload/api/ssh-bridge.ts
@@ -158,6 +158,7 @@ export const sshApi = {
       targetId: string
       kind: 'passphrase' | 'password' | 'keyboard-interactive'
       detail: string
+      echo?: boolean
     }) => void
   ): (() => void) => {
     const listener = (
@@ -167,6 +168,7 @@ export const sshApi = {
         targetId: string
         kind: 'passphrase' | 'password' | 'keyboard-interactive'
         detail: string
+        echo?: boolean
       }
     ) => callback(data)
     ipcRenderer.on('ssh:credential-request', listener)
diff --git a/src/preload/api/ui-bridge-clipboard-and-window-controls.ts b/src/preload/api/ui-bridge-clipboard-and-window-controls.ts
index 1738cb46d2a5..80f2c2dd3830 100644
--- a/src/preload/api/ui-bridge-clipboard-and-window-controls.ts
+++ b/src/preload/api/ui-bridge-clipboard-and-window-controls.ts
@@ -10,6 +10,7 @@ import {
   type RichMarkdownContextMenuTableTarget
 } from '../../shared/rich-markdown-context-menu'
 import type { NativeFileDropPayload } from '../../shared/native-file-drop'
+import type { TerminalSurfaceCloseTarget } from '../../shared/terminal-surface-close-target'
 import type { ClipboardImageThumbnail } from '../../shared/clipboard-image'
 import type { ReadClipboardTextOptions } from '../../shared/clipboard-text'
 import { subscribeNativeFileDrop } from '../preload-runtime-support'
@@ -49,13 +50,9 @@ export const uiClipboardAndWindowControlsApi = {
   respondMobileMarkdownRequest: (response: RuntimeMobileMarkdownResponse): void => {
     ipcRenderer.send('ui:mobileMarkdownResponse', response)
   },
-  onCloseTerminal: (
-    callback: (data: { tabId: string; paneRuntimeId?: number }) => void
-  ): (() => void) => {
-    const listener = (
-      _event: Electron.IpcRendererEvent,
-      data: { tabId: string; paneRuntimeId?: number }
-    ) => callback(data)
+  onCloseTerminal: (callback: (target: TerminalSurfaceCloseTarget) => void): (() => void) => {
+    const listener = (_event: Electron.IpcRendererEvent, target: TerminalSurfaceCloseTarget) =>
+      callback(target)
     ipcRenderer.on('ui:closeTerminal', listener)
     return () => ipcRenderer.removeListener('ui:closeTerminal', listener)
   },
diff --git a/src/preload/api/ui-command-event-api.ts b/src/preload/api/ui-command-event-api.ts
index d20ce87718b1..f6bb247bf91e 100644
--- a/src/preload/api/ui-command-event-api.ts
+++ b/src/preload/api/ui-command-event-api.ts
@@ -1,6 +1,7 @@
 import type { MarkdownDocument } from '../../shared/filesystem-entry-types'
 import type { PersistedUIState } from '../../shared/persisted-ui-state-types'
 import type { TuiAgent } from '../../shared/tui-agent'
+import type { TerminalSurfaceCloseTarget } from '../../shared/terminal-surface-close-target'
 import type {
   WorktreeDefaultTabsLaunch,
   WorktreeSetupLaunch,
@@ -236,9 +237,7 @@ export type UiCommandEventApi = {
   ) => () => void
   onMobileMarkdownRequest: (callback: (request: RuntimeMobileMarkdownRequest) => void) => () => void
   respondMobileMarkdownRequest: (response: RuntimeMobileMarkdownResponse) => void
-  onCloseTerminal: (
-    callback: (data: { tabId: string; paneRuntimeId?: number }) => void
-  ) => () => void
+  onCloseTerminal: (callback: (target: TerminalSurfaceCloseTarget) => void) => () => void
   onTerminalTabCloseRequest: (callback: (request: TerminalTabCloseRequest) => void) => () => void
   respondTerminalTabClose: (response: TerminalTabCloseResponse) => void
   onSleepWorktree: (callback: (data: { worktreeId: string }) => void) => () => void
diff --git a/src/preload/api/workspace-session-api.ts b/src/preload/api/workspace-session-api.ts
index 4c31b6e5db87..434b3795df1d 100644
--- a/src/preload/api/workspace-session-api.ts
+++ b/src/preload/api/workspace-session-api.ts
@@ -4,6 +4,7 @@ import type {
   WorkspaceSessionState
 } from '../../shared/workspace-session-state-types'
 import type { ExecutionHostId } from '../../shared/execution-host'
+import type { TerminalSurfaceCloseTarget } from '../../shared/terminal-surface-close-target'
 import type {
   RemoteWorkspaceChangedEvent,
   RemoteWorkspaceConnectedClient,
@@ -19,6 +20,11 @@ export type WorkspaceSessionApi = {
     listHostIds: () => Promise<ExecutionHostId[]>
     set: (args: WorkspaceSessionState, hostId?: ExecutionHostId) => Promise<void>
     patch: (args: WorkspaceSessionPatch, hostId?: ExecutionHostId) => Promise<void>
+    /** Commits a terminal tab or split-pane close into main's membership. */
+    closeTerminalSurface: (args: {
+      worktreeId: string
+      target: TerminalSurfaceCloseTarget
+    }) => Promise<void>
     flush: () => Promise<void>
     readTerminalScrollback: (args: { ref: string }) => string | null
     setSync: (args: WorkspaceSessionState, hostId?: ExecutionHostId) => void
diff --git a/src/preload/app-restart-checkpoint-routing.test.ts b/src/preload/app-restart-checkpoint-routing.test.ts
index b68f55989f58..2c44b9a5b7fe 100644
--- a/src/preload/app-restart-checkpoint-routing.test.ts
+++ b/src/preload/app-restart-checkpoint-routing.test.ts
@@ -124,4 +124,99 @@ describe('native preload destructive app actions', () => {
     expect(onKeyboardLayoutChanged).toHaveBeenCalledExactlyOnceWith(payload)
     expect(removeListener).toHaveBeenCalledWith(KEYBOARD_LAYOUT_CHANGED_CHANNEL, listener)
   })
+
+  it('awaits renderer durability before profile maintenance and preserves its result', async () => {
+    const api = await loadApi()
+    const started = vi.fn()
+    eventTarget.addEventListener(ORCA_APP_RESTART_STARTED_EVENT, started)
+    let finishCheckpoint = (_result: { ok: boolean }): void => {}
+    const checkpoint = new Promise((resolve) => {
+      finishCheckpoint = resolve
+    })
+    const result = { status: 'relaunching' }
+    invoke.mockImplementation((channel: string) =>
+      channel === 'app:await-before-unload-checkpoint' ? checkpoint : Promise.resolve(result)
+    )
+
+    const switching = api.orcaProfiles.switchProfile({ profileId: 'target' })
+    await vi.waitFor(() =>
+      expect(invoke).toHaveBeenCalledWith('app:await-before-unload-checkpoint')
+    )
+    expect(started).toHaveBeenCalledOnce()
+    expect(invoke).not.toHaveBeenCalledWith('orcaProfiles:switch', expect.anything())
+    finishCheckpoint({ ok: true })
+    await expect(switching).resolves.toBe(result)
+    expect(invoke).toHaveBeenLastCalledWith('orcaProfiles:switch', { profileId: 'target' })
+  })
+
+  it.each(['checkpoint-failed', 'switch-failed', 'already-active'])(
+    'resets restart preparation when profile switching returns %s',
+    async (outcome) => {
+      const api = await loadApi()
+      const aborted = vi.fn()
+      eventTarget.addEventListener(ORCA_APP_RESTART_ABORTED_EVENT, aborted)
+      invoke.mockImplementation(async (channel: string) => {
+        if (channel === 'app:await-before-unload-checkpoint') {
+          return { ok: outcome !== 'checkpoint-failed' }
+        }
+        if (outcome === 'switch-failed') {
+          throw new Error('switch failed')
+        }
+        return { status: 'already-active' }
+      })
+      const switching = api.orcaProfiles.switchProfile({ profileId: 'target' })
+      await (outcome === 'already-active'
+        ? expect(switching).resolves.toEqual({ status: 'already-active' })
+        : expect(switching).rejects.toThrow())
+      expect(aborted).toHaveBeenCalledOnce()
+      if (outcome === 'checkpoint-failed') {
+        expect(invoke).not.toHaveBeenCalledWith('orcaProfiles:switch', expect.anything())
+      }
+    }
+  )
+
+  it.each(['move', 'copy', 'inactive', 'duplicate', 'recovery'] as const)(
+    'prepares only a potentially relaunching project transfer: %s',
+    async (outcome) => {
+      const api = await loadApi()
+      const started = vi.fn()
+      const aborted = vi.fn()
+      eventTarget.addEventListener(ORCA_APP_RESTART_STARTED_EVENT, started)
+      eventTarget.addEventListener(ORCA_APP_RESTART_ABORTED_EVENT, aborted)
+      const args = {
+        sourceProfileId: outcome === 'inactive' ? 'inactive' : 'active',
+        targetProfileId: 'target',
+        repoId: 'repo',
+        mode: outcome === 'copy' ? ('copy' as const) : ('move' as const)
+      }
+      const result =
+        outcome === 'duplicate'
+          ? { status: 'duplicate-target' }
+          : { status: 'transferred', willRelaunch: outcome === 'move' }
+      invoke.mockImplementation(async (channel: string) => {
+        if (channel === 'orcaProfiles:list') {
+          return { activeProfileId: 'active' }
+        }
+        if (channel === 'app:await-before-unload-checkpoint') {
+          return { ok: true }
+        }
+        if (outcome === 'recovery') {
+          const listener = on.mock.calls.find(([name]) => name === 'app:restart-committed')?.[1]
+          expect(listener).toBeTypeOf('function')
+          listener()
+          throw new Error('move requires recovery')
+        }
+        return result
+      })
+
+      const transfer = api.orcaProfiles.transferProject(args)
+      await (outcome === 'recovery'
+        ? expect(transfer).rejects.toThrow('move requires recovery')
+        : expect(transfer).resolves.toBe(result))
+      const needsPreparation = outcome !== 'copy' && outcome !== 'inactive'
+      expect(started).toHaveBeenCalledTimes(needsPreparation ? 1 : 0)
+      expect(aborted).toHaveBeenCalledTimes(outcome === 'duplicate' ? 1 : 0)
+      expect(invoke).toHaveBeenLastCalledWith('orcaProfiles:transferProject', args)
+    }
+  )
 })
diff --git a/src/preload/index.ts b/src/preload/index.ts
index 3267b9817756..742a81681961 100644
--- a/src/preload/index.ts
+++ b/src/preload/index.ts
@@ -78,6 +78,7 @@ import { runtimeEnvironmentsApi } from './api/runtime-environments-bridge'
 import { rateLimitsApi } from './api/rate-limits-bridge'
 import { minimaxCredentialsApi } from './api/minimax-credentials-bridge'
 import { grokAccountsApi } from './api/grok-accounts-bridge'
+import { cursorAccountsApi } from './api/cursor-accounts-bridge'
 import { sshApi } from './api/ssh-bridge'
 import { automationsApi } from './api/automations-bridge'
 import { e2eApi } from './api/e2e-bridge'
@@ -177,6 +178,7 @@ const api = {
   rateLimits: rateLimitsApi,
   minimaxCredentials: minimaxCredentialsApi,
   grokAccounts: grokAccountsApi,
+  cursorAccounts: cursorAccountsApi,
   ssh: sshApi,
   automations: automationsApi,
   e2e: e2eApi,
diff --git a/src/preload/renderer-restart-wiring.test.ts b/src/preload/renderer-restart-wiring.test.ts
index bd896109b578..ba97195a5f52 100644
--- a/src/preload/renderer-restart-wiring.test.ts
+++ b/src/preload/renderer-restart-wiring.test.ts
@@ -1,38 +1,140 @@
 import { describe, expect, it, vi } from 'vitest'
+import { EventEmitter } from 'node:events'
 import { ORCA_RENDERER_UNLOAD_PREVENTED_EVENT } from '../shared/renderer-shutdown-events'
 import {
   ORCA_APP_RESTART_ABORTED_EVENT,
+  ORCA_APP_RESTART_STARTED_EVENT,
   ORCA_UPDATER_QUIT_AND_INSTALL_STARTED_EVENT
 } from '../shared/updater-renderer-events'
 import {
+  prepareAndInvokeAppRestart,
   prepareAndInvokeUpdaterInstall,
   registerRendererRestartIpcRelays
 } from './renderer-restart-wiring'
 
+function restartIpc(eventTarget: EventTarget) {
+  const ipcRenderer = Object.assign(new EventEmitter(), {
+    invoke: vi.fn(async () => {}),
+    postMessage: vi.fn(),
+    send: vi.fn(),
+    sendSync: vi.fn(),
+    sendToHost: vi.fn()
+  })
+  const relay = { handleStatus: vi.fn(), abort: vi.fn() }
+  registerRendererRestartIpcRelays(ipcRenderer, eventTarget, relay)
+  return { ipcRenderer, ...relay }
+}
+
 describe('renderer restart wiring', () => {
+  it.each(['no-op', 'failure'] as const)(
+    'keeps a committed restart prepared after a later %s',
+    async (outcome) => {
+      const eventTarget = new EventTarget()
+      const { ipcRenderer } = restartIpc(eventTarget)
+      const aborted = vi.fn()
+      const started = vi.fn()
+      const checkpoint = vi.fn(async () => {})
+      eventTarget.addEventListener(ORCA_APP_RESTART_ABORTED_EVENT, aborted)
+      eventTarget.addEventListener(ORCA_APP_RESTART_STARTED_EVENT, started)
+      await prepareAndInvokeAppRestart(
+        eventTarget,
+        async () => {
+          ipcRenderer.emit('app:restart-committed')
+          return true
+        },
+        checkpoint,
+        Boolean
+      )
+      const subsequent = prepareAndInvokeAppRestart(
+        eventTarget,
+        async () => {
+          if (outcome === 'failure') {
+            throw new Error('already finalized')
+          }
+          return false
+        },
+        checkpoint,
+        Boolean
+      )
+      await (outcome === 'failure'
+        ? expect(subsequent).rejects.toThrow('already finalized')
+        : expect(subsequent).resolves.toBe(false))
+      expect(checkpoint).toHaveBeenCalledOnce()
+      expect(started).toHaveBeenCalledOnce()
+      expect(aborted).not.toHaveBeenCalled()
+    }
+  )
+
+  it('refuses overlapping preparation without abandoning the accepted restart', async () => {
+    const eventTarget = new EventTarget()
+    const aborted = vi.fn()
+    eventTarget.addEventListener(ORCA_APP_RESTART_ABORTED_EVENT, aborted)
+    const checkpoint = Promise.withResolvers<void>()
+    const invoke = vi.fn(async () => true)
+    const first = prepareAndInvokeAppRestart(eventTarget, invoke, () => checkpoint.promise)
+    const refused = vi.fn(async () => false)
+    await expect(
+      prepareAndInvokeAppRestart(eventTarget, refused, async () => {}, Boolean)
+    ).rejects.toThrow('already in progress')
+    expect(refused).not.toHaveBeenCalled()
+    expect(aborted).not.toHaveBeenCalled()
+    checkpoint.resolve()
+    await expect(first).resolves.toBe(true)
+    expect(invoke).toHaveBeenCalledOnce()
+  })
+
+  it('retains late commitment across an unrelated unload veto', async () => {
+    const eventTarget = new EventTarget()
+    const abandoned = vi.fn()
+    eventTarget.addEventListener(ORCA_APP_RESTART_ABORTED_EVENT, abandoned)
+    eventTarget.addEventListener(ORCA_RENDERER_UNLOAD_PREVENTED_EVENT, abandoned)
+    const { ipcRenderer } = restartIpc(eventTarget)
+    const checkpoint = vi.fn(async () => {})
+    await prepareAndInvokeAppRestart(eventTarget, async () => true, checkpoint, Boolean)
+    ipcRenderer.emit('app:restart-committed')
+    await prepareAndInvokeAppRestart(eventTarget, async () => false, checkpoint, Boolean)
+    expect(checkpoint).toHaveBeenCalledOnce()
+    ipcRenderer.emit('window:unload-prevented')
+    await prepareAndInvokeAppRestart(eventTarget, async () => true, checkpoint, Boolean)
+    expect(checkpoint).toHaveBeenCalledOnce()
+    expect(abandoned).not.toHaveBeenCalled()
+  })
+
+  it('releases preparation ownership and its listener after checkpoint failure', async () => {
+    const eventTarget = new EventTarget()
+    const add = vi.spyOn(eventTarget, 'addEventListener')
+    const remove = vi.spyOn(eventTarget, 'removeEventListener')
+    await expect(
+      prepareAndInvokeAppRestart(
+        eventTarget,
+        async () => {},
+        async () => {
+          throw new Error('checkpoint failed')
+        }
+      )
+    ).rejects.toThrow('checkpoint failed')
+    await prepareAndInvokeAppRestart(
+      eventTarget,
+      async () => {},
+      async () => {}
+    )
+    expect(add.mock.calls).toHaveLength(2)
+    expect(remove.mock.calls).toEqual(add.mock.calls)
+  })
+
   it('relays updater status, aborted installs, and prevented unload events', () => {
     const eventTarget = new EventTarget()
     const unloadPrevented = vi.fn()
     const restartAborted = vi.fn()
-    const handleStatus = vi.fn()
-    const abort = vi.fn()
-    const listeners = new Map<string, (...args: unknown[]) => void>()
-    const ipcRenderer = {
-      on: vi.fn((channel: string, listener: (...args: unknown[]) => void) => {
-        listeners.set(channel, listener)
-        return ipcRenderer
-      })
-    } as unknown as Parameters<typeof registerRendererRestartIpcRelays>[0]
+    const { ipcRenderer, handleStatus, abort } = restartIpc(eventTarget)
     eventTarget.addEventListener(ORCA_RENDERER_UNLOAD_PREVENTED_EVENT, unloadPrevented)
     eventTarget.addEventListener(ORCA_APP_RESTART_ABORTED_EVENT, restartAborted)
-
-    registerRendererRestartIpcRelays(ipcRenderer, eventTarget, { handleStatus, abort })
-    listeners.get('updater:status')?.({}, { state: 'error', message: 'install failed' })
+    ipcRenderer.emit('updater:status', {}, { state: 'error', message: 'install failed' })
     // Why: main abandons an install without any status when its verdict outlived the cycle.
-    listeners.get('updater:quitAndInstallAborted')?.({})
-    listeners.get('window:unload-prevented')?.({})
+    ipcRenderer.emit('updater:quitAndInstallAborted')
+    ipcRenderer.emit('window:unload-prevented')
 
-    expect(ipcRenderer.on).toHaveBeenCalledTimes(3)
+    expect(ipcRenderer.eventNames()).toHaveLength(4)
     expect(handleStatus).toHaveBeenCalledWith({ state: 'error', message: 'install failed' })
     expect(abort).toHaveBeenCalledTimes(1)
     expect(unloadPrevented).toHaveBeenCalledTimes(1)
diff --git a/src/preload/renderer-restart-wiring.ts b/src/preload/renderer-restart-wiring.ts
index 2dd0ad316aa9..38ea1882b9fa 100644
--- a/src/preload/renderer-restart-wiring.ts
+++ b/src/preload/renderer-restart-wiring.ts
@@ -12,6 +12,18 @@ import {
   ORCA_UPDATER_QUIT_AND_INSTALL_STARTED_EVENT
 } from '../shared/updater-renderer-events'
 
+type AppRestartState = { committed: boolean; pending: boolean }
+const appRestartStates = new WeakMap<EventTarget, AppRestartState>()
+
+function appRestartState(eventTarget: EventTarget): AppRestartState {
+  let state = appRestartStates.get(eventTarget)
+  if (!state) {
+    state = { committed: false, pending: false }
+    appRestartStates.set(eventTarget, state)
+  }
+  return state
+}
+
 export function registerRendererRestartIpcRelays(
   ipcRenderer: Pick<IpcRenderer, 'on'>,
   eventTarget: EventTarget,
@@ -24,7 +36,14 @@ export function registerRendererRestartIpcRelays(
   ipcRenderer.on('updater:quitAndInstallAborted', () => {
     relay.abort()
   })
+  ipcRenderer.on('app:restart-committed', () => {
+    appRestartState(eventTarget).committed = true
+  })
   ipcRenderer.on('window:unload-prevented', () => {
+    // A quit veto cannot reopen a profile whose maintenance has already committed.
+    if (appRestartState(eventTarget).committed) {
+      return
+    }
     eventTarget.dispatchEvent(new Event(ORCA_RENDERER_UNLOAD_PREVENTED_EVENT))
     eventTarget.dispatchEvent(new Event(ORCA_APP_RESTART_ABORTED_EVENT))
   })
@@ -50,20 +69,39 @@ export async function prepareAndInvokeUpdaterInstall(
   }
 }
 
-export async function prepareAndInvokeAppRestart(
+export async function prepareAndInvokeAppRestart<T>(
   eventTarget: EventTarget,
-  invoke: () => Promise<unknown>,
-  awaitCheckpoint: () => Promise<void>
-): Promise<void> {
-  await prepareRendererForAppRestart(eventTarget, {
-    startedEventName: ORCA_APP_RESTART_STARTED_EVENT,
-    abortedEventName: ORCA_APP_RESTART_ABORTED_EVENT,
-    awaitCheckpoint
-  })
+  invoke: () => Promise<T>,
+  awaitCheckpoint: () => Promise<void>,
+  willRestart: (result: T) => boolean = () => true
+): Promise<T> {
+  const state = appRestartState(eventTarget)
+  if (state.pending) {
+    throw new Error('App restart preparation is already in progress')
+  }
+  state.pending = true
   try {
-    await invoke()
-  } catch (error) {
-    eventTarget.dispatchEvent(new Event(ORCA_APP_RESTART_ABORTED_EVENT))
-    throw error
+    if (!state.committed) {
+      await prepareRendererForAppRestart(eventTarget, {
+        startedEventName: ORCA_APP_RESTART_STARTED_EVENT,
+        abortedEventName: ORCA_APP_RESTART_ABORTED_EVENT,
+        awaitCheckpoint
+      })
+    }
+    try {
+      const result = await invoke()
+      if (!state.committed && !willRestart(result)) {
+        eventTarget.dispatchEvent(new Event(ORCA_APP_RESTART_ABORTED_EVENT))
+      }
+      return result
+    } catch (error) {
+      // A failed profile move can require recovery after its writer has already closed.
+      if (!state.committed) {
+        eventTarget.dispatchEvent(new Event(ORCA_APP_RESTART_ABORTED_EVENT))
+      }
+      throw error
+    }
+  } finally {
+    state.pending = false
   }
 }
diff --git a/src/relay/agent-exec-handler.test.ts b/src/relay/agent-exec-handler.test.ts
index 42a79469d425..87a2ef0403b4 100644
--- a/src/relay/agent-exec-handler.test.ts
+++ b/src/relay/agent-exec-handler.test.ts
@@ -36,6 +36,7 @@ describe('AgentExecHandler', () => {
   })
 
   afterEach(() => {
+    vi.unstubAllEnvs()
     for (const [key, value] of Object.entries(ambientGuardEnv)) {
       if (value !== undefined) {
         process.env[key] = value
@@ -84,6 +85,7 @@ describe('AgentExecHandler', () => {
   })
 
   it('merges caller-supplied provider environment into the spawned command environment', async () => {
+    vi.stubEnv('ORCA_EXEC_INHERITED', 'inherited-value')
     const child = createFakeChild()
     spawnMock.mockReturnValue(child as never)
     const handlers = createHandlers()
@@ -112,7 +114,7 @@ describe('AgentExecHandler', () => {
     expect(spawnMock).toHaveBeenCalledWith('codex', ['exec'], {
       cwd: '/repo',
       env: expect.objectContaining({
-        ...process.env,
+        ORCA_EXEC_INHERITED: 'inherited-value',
         CODEX_HOME: '/managed/codex-home',
         PATH: '/managed/bin'
       }),
@@ -121,6 +123,59 @@ describe('AgentExecHandler', () => {
     })
   })
 
+  it('honors Windows override casing while replacing indexed Git configuration', async () => {
+    const child = createFakeChild()
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: This fixture supplies every child event and stream used by the handler.
+    spawnMock.mockReturnValue(child as never)
+    const originalPlatform = process.platform
+    const originalPath = process.env.PATH
+    process.env.PATH = 'inherited-path'
+    process.env.GIT_CONFIG_COUNT = '2'
+    process.env.GIT_CONFIG_KEY_1 = 'stale.key'
+    process.env.GIT_CONFIG_VALUE_1 = 'stale-value'
+    try {
+      Object.defineProperty(process, 'platform', { configurable: true, value: 'win32' })
+      const handlers = createHandlers()
+      const pending = handlers.get('agent.execNonInteractive')!(
+        {
+          binary: 'agent.exe',
+          args: [],
+          env: {
+            Path: 'override-path',
+            token: 'override-token',
+            git_config_count: '1',
+            git_config_key_0: 'http.proxy',
+            git_config_value_0: 'proxy-value'
+          }
+        },
+        requestContext()
+      )
+      child.emit('close', 0)
+      await expect(pending).resolves.toMatchObject({ exitCode: 0 })
+      const env = spawnMock.mock.calls[0][2]?.env
+      expect(env).toMatchObject({
+        PATH: 'override-path',
+        TOKEN: 'override-token',
+        GIT_CONFIG_KEY_0: 'http.proxy',
+        GIT_CONFIG_VALUE_0: 'proxy-value'
+      })
+      expect(env).not.toHaveProperty('Path')
+      expect(env).not.toHaveProperty('git_config_count')
+      expect(Object.values(env ?? {})).not.toContain('stale.key')
+      expect(Object.values(env ?? {})).not.toContain('stale-value')
+    } finally {
+      Object.defineProperty(process, 'platform', { configurable: true, value: originalPlatform })
+      if (originalPath === undefined) {
+        delete process.env.PATH
+      } else {
+        process.env.PATH = originalPath
+      }
+      delete process.env.GIT_CONFIG_COUNT
+      delete process.env.GIT_CONFIG_KEY_1
+      delete process.env.GIT_CONFIG_VALUE_1
+    }
+  })
+
   it('consumes an unattended marker and applies the full Git guard on the relay host', async () => {
     const child = createFakeChild()
     spawnMock.mockReturnValue(child as never)
diff --git a/src/relay/agent-exec-handler.ts b/src/relay/agent-exec-handler.ts
index a82791dcf453..152e8bd72fbe 100644
--- a/src/relay/agent-exec-handler.ts
+++ b/src/relay/agent-exec-handler.ts
@@ -1,3 +1,4 @@
+import { mergeCommandEnvironment } from '../shared/command-environment'
 import { spawn, type ChildProcess } from 'node:child_process'
 import { existsSync } from 'node:fs'
 import { delimiter, join } from 'node:path'
@@ -148,10 +149,17 @@ export class AgentExecHandler {
       params.env && typeof params.env === 'object' && !Array.isArray(params.env)
         ? (params.env as Record<string, string>)
         : null
-    const spawnEnv = mergeGitConfigEnvProtocol(process.env, extraEnv ?? undefined) as Record<
-      string,
-      string
-    >
+    const baseEnv = mergeCommandEnvironment(
+      process.env,
+      extraEnv ? {} : undefined,
+      process.platform
+    )
+    const overrides = mergeCommandEnvironment({}, extraEnv ?? undefined, process.platform)
+    const spawnEnv = Object.fromEntries(
+      Object.entries(mergeGitConfigEnvProtocol(baseEnv ?? process.env, overrides)).filter(
+        (entry): entry is [string, string] => typeof entry[1] === 'string'
+      )
+    )
     // Why: this RPC has no interactive terminal, regardless of which wrapper
     // launches the agent or hook command.
     applyTerminalGitCredentialPromptGuard(spawnEnv, {
diff --git a/src/relay/agent-hook-integration.test.ts b/src/relay/agent-hook-integration.test.ts
index b5a0f1066e4d..7e5b21365e14 100644
--- a/src/relay/agent-hook-integration.test.ts
+++ b/src/relay/agent-hook-integration.test.ts
@@ -168,6 +168,77 @@ describe('Integration: relay hook server → mux → AgentHookServer.ingestRemot
     expect(payload.agentType).toBe(agent)
   })
 
+  it.each([0, 1, 2, 3])(
+    'delivers Cursor form payloads with %i BOMs to the host-owned status store',
+    async (count) => {
+      const { port, token } = hookServer.getCoordinates()
+      for (const [hookEventName, state] of [
+        ['beforeSubmitPrompt', 'working'],
+        ['stop', 'done']
+      ]) {
+        const payload = Buffer.concat([
+          ...Array.from({ length: count }, () => Buffer.from([0xef, 0xbb, 0xbf])),
+          Buffer.from(
+            JSON.stringify({
+              hook_event_name: hookEventName,
+              prompt: 'Synthetic café 😀',
+              status: 'completed'
+            })
+          )
+        ])
+        const response = await fetch(`http://127.0.0.1:${port}/hook/cursor`, {
+          method: 'POST',
+          headers: {
+            'Content-Type': 'application/x-www-form-urlencoded',
+            'X-Orca-Agent-Hook-Token': token
+          },
+          body: new URLSearchParams({
+            paneKey: `tab-7:${LEAF_7}`,
+            worktreeId: 'folder:synthetic-cursor',
+            payload: payload.toString('utf8')
+          }).toString()
+        })
+        expect(response.status).toBe(204)
+        await expect
+          .poll(() => orcaServer.getStatusSnapshot())
+          .toEqual([
+            expect.objectContaining({
+              paneKey: `tab-7:${LEAF_7}`,
+              worktreeId: 'folder:synthetic-cursor',
+              connectionId: 'conn-test',
+              state,
+              agentType: 'cursor',
+              prompt: 'Synthetic café 😀'
+            })
+          ])
+      }
+    }
+  )
+
+  it('acknowledges malformed Cursor form payloads without publishing status', async () => {
+    const { port, token } = hookServer.getCoordinates()
+    for (const payload of [
+      '',
+      '\uFEFF\uFEFFnot json',
+      ' \uFEFF{}',
+      '{\uFEFF"hook_event_name":"stop"}',
+      '\uFEFF\uFEFF{"hook_event_name":"unknown"}'
+    ]) {
+      const response = await fetch(`http://127.0.0.1:${port}/hook/cursor`, {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/x-www-form-urlencoded',
+          'X-Orca-Agent-Hook-Token': token
+        },
+        body: new URLSearchParams({ paneKey: `tab-7:${LEAF_7}`, payload }).toString()
+      })
+      expect(response.status).toBe(204)
+    }
+    await new Promise((resolve) => setImmediate(resolve))
+    expect(hookServer.replayCachedPayloadsForPanes()).toBe(0)
+    expect(orcaServer.getStatusSnapshot()).toEqual([])
+  })
+
   it('sheds an oversized assistant message through the production publication path', async () => {
     const events: { payload: { state: string; lastAssistantMessage?: string } }[] = []
     orcaServer.setListener((event) => {
diff --git a/src/relay/ai-vault-handler.test.ts b/src/relay/ai-vault-handler.test.ts
index eb90958d0a20..3951b58ea5f2 100644
--- a/src/relay/ai-vault-handler.test.ts
+++ b/src/relay/ai-vault-handler.test.ts
@@ -393,7 +393,10 @@ function createTestService(
   return {
     listSessions: (params, signal) =>
       scan({
-        provider: createRelayAiVaultFilesystemProvider(),
+        provider: createRelayAiVaultFilesystemProvider({
+          homeDirectory: remoteHome,
+          environment: {}
+        }),
         executionHostId: 'local',
         remoteHome,
         hostPlatform,
diff --git a/src/relay/ai-vault-opencode-reader.test.ts b/src/relay/ai-vault-opencode-reader.test.ts
new file mode 100644
index 000000000000..3d082205d5d4
--- /dev/null
+++ b/src/relay/ai-vault-opencode-reader.test.ts
@@ -0,0 +1,253 @@
+import { mkdtemp, mkdir, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import type { AiVaultScanIssue } from '../shared/ai-vault-types'
+import { getRemoteHostPlatform } from '../main/ssh/ssh-remote-platform'
+import { scanRemoteAiVaultSessions } from '../main/ai-vault/remote-session-scanner'
+import { resetRemoteSessionParseCacheForTests } from '../main/ai-vault/remote-session-parse-cache'
+import { listOpenCodeSqliteSessions } from '../main/ai-vault/session-scanner-opencode-sqlite-list'
+import { listOpenCode2SqliteSessions } from '../main/ai-vault/session-scanner-opencode2-sqlite-list'
+import { parseOpenCodeSqliteSession } from '../main/ai-vault/session-scanner-opencode-sqlite'
+import { parseOpenCode2SqliteSession } from '../main/ai-vault/session-scanner-opencode2-sqlite'
+import { writeOpenCodeSqliteDatabase } from '../main/ai-vault/session-scanner-opencode-sqlite-fixture'
+import { createRelayAiVaultFilesystemProvider } from './ai-vault-service-filesystem'
+import {
+  createRelayOpenCodeReader,
+  type RelayOpenCodeReaderOptions
+} from './ai-vault-opencode-reader'
+
+const directories: string[] = []
+const disposables: { dispose(): void }[] = []
+
+afterEach(async () => {
+  for (const disposable of disposables.splice(0)) {
+    disposable.dispose()
+  }
+  await Promise.all(directories.splice(0).map((path) => rm(path, { recursive: true, force: true })))
+  resetRemoteSessionParseCacheForTests()
+})
+
+async function temporaryDirectory(): Promise<string> {
+  const path = await mkdtemp(join(tmpdir(), 'orca-relay-opencode-'))
+  directories.push(path)
+  return path
+}
+
+function factory() {
+  const reader = { list: vi.fn(async () => []), parse: vi.fn(async () => null), dispose: vi.fn() }
+  return {
+    reader,
+    create: vi.fn(
+      (_options: Parameters<NonNullable<RelayOpenCodeReaderOptions['readerFactory']>>[0]) => reader
+    )
+  }
+}
+
+describe('relay OpenCode reader', () => {
+  it('coalesces a persistent reader selected by the provisioned runtime reference', async () => {
+    const baseDir = await temporaryDirectory()
+    const executable = join(baseDir, 'runtime', 'bun')
+    await writeFile(
+      join(baseDir, 'opencode-sqlite-runtime.json'),
+      JSON.stringify({ protocol: 1, executable })
+    )
+    const { reader, create } = factory()
+    const probe = vi.fn(() => false)
+    const provider = createRelayAiVaultFilesystemProvider({
+      baseDir,
+      readerFactory: create,
+      canReadSqlite: probe,
+      environment: {
+        HOME: baseDir,
+        NODE_OPTIONS: '--require=bad',
+        XDG_DATA_HOME: join(baseDir, 'data')
+      }
+    })
+    disposables.push(provider)
+    const issues: AiVaultScanIssue[] = []
+    const args = { dbPaths: [join(baseDir, 'opencode.db')], limit: 10, issues }
+    await Promise.all([provider.openCode?.list(args), provider.openCode?.list(args)])
+    expect(issues).toEqual([])
+    expect(create).toHaveBeenCalledTimes(1)
+    expect(create).toHaveBeenCalledWith(
+      expect.objectContaining({ executable, args: [join(baseDir, 'opencode-sqlite-reader.cjs')] })
+    )
+    expect(create.mock.calls[0]?.[0]?.env?.NODE_OPTIONS).toBeUndefined()
+    expect(probe).not.toHaveBeenCalled()
+    provider.dispose()
+    expect(reader.dispose).toHaveBeenCalledTimes(1)
+  })
+
+  it('reports an unavailable reader once per source and retries after provisioning', async () => {
+    const baseDir = await temporaryDirectory()
+    const { create } = factory()
+    const reader = createRelayOpenCodeReader({
+      baseDir,
+      readerFactory: create,
+      canReadSqlite: () => false
+    })
+    disposables.push(reader)
+    const issues: AiVaultScanIssue[] = []
+    const args = {
+      dbPaths: [join(baseDir, 'opencode.db'), join(baseDir, 'opencode-other.db')],
+      limit: 10,
+      issues
+    }
+    await reader.list(args)
+    expect(issues).toHaveLength(1)
+    expect(issues[0]).toMatchObject({
+      agent: 'opencode',
+      kind: 'scope',
+      message: expect.stringContaining('waiting')
+    })
+    expect(create).not.toHaveBeenCalled()
+    await writeFile(
+      join(baseDir, 'opencode-sqlite-runtime.json'),
+      JSON.stringify({ protocol: 1, executable: join(baseDir, 'bun') })
+    )
+    await reader.list({ ...args, issues: [] })
+    expect(create).toHaveBeenCalledTimes(1)
+  })
+
+  it('uses the current runtime only after a successful SQLite read probe', async () => {
+    const baseDir = await temporaryDirectory()
+    const { create } = factory()
+    const reader = createRelayOpenCodeReader({
+      baseDir,
+      readerFactory: create,
+      currentExecutable: process.execPath
+    })
+    disposables.push(reader)
+    const issues: AiVaultScanIssue[] = []
+    await reader.list({ dbPaths: [join(baseDir, 'opencode.db')], limit: 1, issues })
+    expect(issues).toEqual([])
+    expect(create).toHaveBeenCalledWith(expect.objectContaining({ executable: process.execPath }))
+  })
+
+  it('replaces the persistent reader after a repaired runtime reference changes', async () => {
+    const baseDir = await temporaryDirectory()
+    const referencePath = join(baseDir, 'opencode-sqlite-runtime.json')
+    await writeFile(
+      referencePath,
+      JSON.stringify({ protocol: 1, executable: join(baseDir, 'old-bun') })
+    )
+    const first = factory()
+    const second = factory()
+    const create = vi
+      .fn<NonNullable<RelayOpenCodeReaderOptions['readerFactory']>>()
+      .mockReturnValueOnce(first.reader)
+      .mockReturnValueOnce(second.reader)
+    const reader = createRelayOpenCodeReader({ baseDir, readerFactory: create })
+    disposables.push(reader)
+    const args = { dbPaths: [join(baseDir, 'opencode.db')], limit: 1, issues: [] }
+    await reader.list(args)
+    await writeFile(
+      referencePath,
+      JSON.stringify({ protocol: 1, executable: join(baseDir, 'repaired-bun') })
+    )
+    await reader.list(args)
+    expect(first.reader.dispose).toHaveBeenCalledOnce()
+    expect(second.reader.list).toHaveBeenCalledOnce()
+    expect(create).toHaveBeenLastCalledWith(
+      expect.objectContaining({ executable: join(baseDir, 'repaired-bun') })
+    )
+  })
+
+  it.each([
+    { protocol: 2, executable: '/runtime/bun' },
+    { protocol: 1, executable: 'bun' },
+    { protocol: 1, executable: '/runtime/bun\0bad' }
+  ])('refuses an invalid runtime reference: %j', async (reference) => {
+    const baseDir = await temporaryDirectory()
+    await writeFile(join(baseDir, 'opencode-sqlite-runtime.json'), JSON.stringify(reference))
+    const { create } = factory()
+    const reader = createRelayOpenCodeReader({
+      baseDir,
+      readerFactory: create,
+      canReadSqlite: () => true
+    })
+    disposables.push(reader)
+    const issues: AiVaultScanIssue[] = []
+    await reader.list({ dbPaths: ['opencode.db'], limit: 1, issues })
+    expect(issues).toHaveLength(1)
+    expect(create).not.toHaveBeenCalled()
+  })
+
+  it('retains the host database overrides including relative and in-memory paths', async () => {
+    const baseDir = await temporaryDirectory()
+    const data = join(baseDir, 'data')
+    const reader = createRelayOpenCodeReader({
+      baseDir,
+      environment: { XDG_DATA_HOME: data, OPENCODE_DB: 'opencode-team.db' }
+    })
+    expect(reader.dataDirectory).toBe(join(data, 'opencode'))
+    expect(reader.databasePath).toBe(join(data, 'opencode', 'opencode-team.db'))
+    expect(
+      createRelayOpenCodeReader({ environment: { OPENCODE_DB: ':memory:' } }).databasePath
+    ).toBeNull()
+  })
+
+  it('does not start a child for empty or cancelled scans', async () => {
+    const baseDir = await temporaryDirectory()
+    const { create } = factory()
+    const reader = createRelayOpenCodeReader({ baseDir, readerFactory: create })
+    disposables.push(reader)
+    await reader.list({ dbPaths: [], limit: 1, issues: [] })
+    const controller = new AbortController()
+    controller.abort()
+    await expect(
+      reader.list({ dbPaths: ['opencode.db'], limit: 1, issues: [], signal: controller.signal })
+    ).rejects.toMatchObject({ name: 'AbortError' })
+    expect(create).not.toHaveBeenCalled()
+  })
+
+  it('scans the host database and legacy JSON through the existing readers', async () => {
+    const baseDir = await temporaryDirectory()
+    const xdg = join(baseDir, 'data')
+    const dbPath = join(xdg, 'opencode', 'opencode-team.db')
+    writeOpenCodeSqliteDatabase(dbPath, [
+      { id: 'migrated', turns: [{ role: 'user', parts: ['Database prompt'] }] }
+    ])
+    const sessionDir = join(xdg, 'opencode', 'storage', 'session', 'project')
+    await mkdir(sessionDir, { recursive: true })
+    await writeFile(
+      join(sessionDir, 'migrated.json'),
+      JSON.stringify({ id: 'migrated', title: 'Stale title' })
+    )
+    await writeFile(
+      join(sessionDir, 'legacy.json'),
+      JSON.stringify({ id: 'legacy', title: 'Legacy title', directory: '/project' })
+    )
+    const readerFactory: NonNullable<RelayOpenCodeReaderOptions['readerFactory']> = () => ({
+      list: (args) =>
+        args.agent === 'opencode2'
+          ? listOpenCode2SqliteSessions(args)
+          : listOpenCodeSqliteSessions({ ...args, agent: 'opencode' }),
+      parse: async (args) =>
+        args.agent === 'opencode2'
+          ? parseOpenCode2SqliteSession(args)
+          : parseOpenCodeSqliteSession({ ...args, agent: 'opencode' }),
+      dispose() {}
+    })
+    const provider = createRelayAiVaultFilesystemProvider({
+      baseDir,
+      environment: { XDG_DATA_HOME: xdg, OPENCODE_DB: 'opencode-team.db' },
+      readerFactory
+    })
+    disposables.push(provider)
+    const result = await scanRemoteAiVaultSessions({
+      provider,
+      remoteHome: baseDir,
+      executionHostId: 'ssh:actual',
+      hostPlatform: getRemoteHostPlatform('linux-x64')
+    })
+    expect(result.issues).toEqual([])
+    expect(result.sessions.map((entry) => entry.sessionId).sort()).toEqual(['legacy', 'migrated'])
+    expect(result.sessions.find((entry) => entry.sessionId === 'migrated')).toMatchObject({
+      filePath: dbPath,
+      executionHostId: 'ssh:actual',
+      previewMessages: [expect.objectContaining({ text: 'Database prompt' })]
+    })
+  })
+})
diff --git a/src/relay/ai-vault-opencode-reader.ts b/src/relay/ai-vault-opencode-reader.ts
new file mode 100644
index 000000000000..d90f2e08cd13
--- /dev/null
+++ b/src/relay/ai-vault-opencode-reader.ts
@@ -0,0 +1,159 @@
+import { open } from 'node:fs/promises'
+import { homedir } from 'node:os'
+import { isAbsolute, join } from 'node:path'
+import type { RemoteOpenCodeSessionReader } from '../main/ai-vault/remote-session-scanner-types'
+import { throwIfAiVaultScanCancelled } from '../main/ai-vault/ai-vault-scan-cancellation'
+import { isMissingRemoteSessionPathError } from '../main/ai-vault/remote-session-file-stat'
+import { parseOpenCodeSessionFile } from '../main/ai-vault/session-scanner-opencode-parser'
+import { createOpenCodeSqliteProcessClient } from '../main/ai-vault/session-scanner-opencode-sqlite-process-client'
+import { buildRelayAiVaultServiceEnv } from '../main/ai-vault/session-scanner-service-env'
+import { resolveOpenCodeDataDirectory } from '../main/opencode/opencode-data-directory'
+import SyncDatabase from '../main/sqlite/sync-database'
+
+type Reader = Pick<RemoteOpenCodeSessionReader, 'list' | 'parse'> & { dispose(): void }
+
+export type RelayOpenCodeReaderOptions = {
+  baseDir?: string
+  environment?: NodeJS.ProcessEnv
+  homeDirectory?: string
+  currentExecutable?: string
+  readerFactory?: (options: Parameters<typeof createOpenCodeSqliteProcessClient>[0]) => Reader
+  canReadSqlite?: () => boolean
+}
+
+export function createRelayOpenCodeReader(
+  options: RelayOpenCodeReaderOptions = {}
+): RemoteOpenCodeSessionReader & { dispose(): void } {
+  const environment = options.environment ?? process.env
+  const dataDirectory = resolveOpenCodeDataDirectory(
+    environment,
+    options.homeDirectory ?? homedir()
+  )
+  const override = environment.OPENCODE_DB?.trim()
+  const baseDir = options.baseDir ?? __dirname
+  let reader: Reader | undefined
+  let executable: string | undefined
+  let pending: Promise<Reader> | undefined
+  let disposed = false
+  const getReader = (refreshRuntime = false): Promise<Reader> => {
+    if (disposed) {
+      return Promise.reject(new Error('OpenCode database reader was disposed.'))
+    }
+    if (reader && !refreshRuntime) {
+      return Promise.resolve(reader)
+    }
+    pending ??= (async () => {
+      const configured = await readRuntimeExecutable(join(baseDir, 'opencode-sqlite-runtime.json'))
+      if (!configured && !(options.canReadSqlite ?? canCurrentRuntimeReadSqlite)()) {
+        throw new Error('OpenCode history is waiting for its database reader on this host.')
+      }
+      if (disposed) {
+        throw new Error('OpenCode database reader was disposed.')
+      }
+      const nextExecutable = configured ?? options.currentExecutable ?? process.execPath
+      if (!reader || executable !== nextExecutable) {
+        reader?.dispose()
+        reader = (options.readerFactory ?? createOpenCodeSqliteProcessClient)({
+          executable: nextExecutable,
+          args: [join(baseDir, 'opencode-sqlite-reader.cjs')],
+          env: buildRelayAiVaultServiceEnv(environment)
+        })
+        executable = nextExecutable
+      }
+      return reader
+    })().finally(() => {
+      pending = undefined
+    })
+    return pending
+  }
+  return {
+    dataDirectory,
+    ...(override
+      ? {
+          databasePath:
+            override === ':memory:'
+              ? null
+              : isAbsolute(override)
+                ? override
+                : join(dataDirectory, override)
+        }
+      : {}),
+    async list(args) {
+      throwIfAiVaultScanCancelled(args.signal)
+      if (args.dbPaths.length === 0) {
+        return []
+      }
+      try {
+        return await (await getReader(true)).list(args)
+      } catch (error) {
+        throwIfAiVaultScanCancelled(args.signal)
+        args.issues.push({
+          agent: args.agent ?? 'opencode',
+          kind: 'scope',
+          path: args.dbPaths[0] ?? dataDirectory,
+          message: error instanceof Error ? error.message : String(error)
+        })
+        return []
+      }
+    },
+    async parse(args) {
+      throwIfAiVaultScanCancelled(args.signal)
+      return (await getReader()).parse(args)
+    },
+    parseLegacy: parseOpenCodeSessionFile,
+    dispose() {
+      if (disposed) {
+        return
+      }
+      disposed = true
+      reader?.dispose()
+    }
+  }
+}
+
+async function readRuntimeExecutable(path: string): Promise<string | undefined> {
+  let file
+  try {
+    file = await open(path, 'r')
+  } catch (error) {
+    if (isMissingRemoteSessionPathError(error)) {
+      return undefined
+    }
+    throw error
+  }
+  try {
+    const bytes = Buffer.alloc(16_385)
+    const { bytesRead } = await file.read(bytes, 0, bytes.length, 0)
+    if (bytesRead > 16_384) {
+      throw new Error('OpenCode database runtime reference exceeds its size limit.')
+    }
+    const reference: unknown = JSON.parse(bytes.subarray(0, bytesRead).toString('utf8'))
+    if (
+      typeof reference !== 'object' ||
+      reference === null ||
+      !('protocol' in reference) ||
+      reference.protocol !== 1 ||
+      !('executable' in reference) ||
+      typeof reference.executable !== 'string' ||
+      !isAbsolute(reference.executable) ||
+      reference.executable.includes('\0')
+    ) {
+      throw new Error('OpenCode database runtime reference is invalid.')
+    }
+    return reference.executable
+  } finally {
+    await file.close()
+  }
+}
+
+function canCurrentRuntimeReadSqlite(): boolean {
+  let db: SyncDatabase | undefined
+  try {
+    db = new SyncDatabase(':memory:')
+    return db.prepare('SELECT 1 AS ready').get()?.ready === 1
+  } catch {
+    return false
+  } finally {
+    db?.close()
+  }
+}
diff --git a/src/relay/ai-vault-service-client-state.ts b/src/relay/ai-vault-service-client-state.ts
index de623d19b07a..11cab3763d77 100644
--- a/src/relay/ai-vault-service-client-state.ts
+++ b/src/relay/ai-vault-service-client-state.ts
@@ -28,6 +28,18 @@ export function relayAiVaultError(error: unknown): Error {
   return error instanceof Error ? error : new Error(String(error))
 }
 
+export function armRelayAiVaultCallTimeout(
+  call: RelayAiVaultServiceCall,
+  onExpired: (timeout: number) => void
+): void {
+  const timeout =
+    call.request.operation === 'list'
+      ? RELAY_AI_VAULT_SCAN_TIMEOUT_MS
+      : RELAY_AI_VAULT_TITLE_TIMEOUT_MS
+  call.timer = setTimeout(() => onExpired(timeout), timeout)
+  call.timer.unref?.()
+}
+
 export function armRelayAiVaultCancellationTimeout(
   call: RelayAiVaultServiceCall,
   onExpired: () => void
@@ -53,7 +65,8 @@ export function createRelayAiVaultServiceCall(args: {
     onAbort: null,
     settled: false,
     sent: false,
-    startRetried: false
+    startRetried: false,
+    startAttempt: 0
   }
 }
 
@@ -110,6 +123,7 @@ export type RelayAiVaultServiceCall = {
   /** Whether the sidecar received the request; an unsent call gets no reply. */
   sent: boolean
   startRetried: boolean
+  startAttempt: number
 }
 
 export type RelayAiVaultServiceApi = {
diff --git a/src/relay/ai-vault-service-client.ts b/src/relay/ai-vault-service-client.ts
index c873c3805067..9197bce10807 100644
--- a/src/relay/ai-vault-service-client.ts
+++ b/src/relay/ai-vault-service-client.ts
@@ -1,4 +1,5 @@
 import type { ChildProcess } from 'node:child_process'
+import { PromiseSettlementWaiters } from '../shared/promise-settlement-waiters'
 import type { AiVaultListResult } from '../shared/ai-vault-types'
 import type {
   AiVaultSessionTitleRequest,
@@ -9,8 +10,7 @@ import {
   RELAY_AI_VAULT_MAX_CALLS,
   RELAY_AI_VAULT_IDLE_TIMEOUT_MS,
   RELAY_AI_VAULT_READY_TIMEOUT_MS,
-  RELAY_AI_VAULT_SCAN_TIMEOUT_MS,
-  RELAY_AI_VAULT_TITLE_TIMEOUT_MS,
+  armRelayAiVaultCallTimeout,
   armRelayAiVaultCancellationTimeout,
   createRelayAiVaultServiceCall,
   relayAiVaultAbortError,
@@ -37,7 +37,7 @@ import { relayLogLine } from './relay-diagnostic-log'
 
 export class RelayAiVaultServiceClient implements RelayAiVaultServiceApi {
   private child: ChildProcess | null = null
-  private ready: Promise<ChildProcess> | null = null
+  private ready: PromiseSettlementWaiters<ChildProcess> | null = null
   private readyReject: ((error: Error) => void) | null = null
   private readyTimer: NodeJS.Timeout | null = null
   private readonly active = new Map<RelayAiVaultServiceLane, RelayAiVaultServiceCall>()
@@ -74,6 +74,9 @@ export class RelayAiVaultServiceClient implements RelayAiVaultServiceApi {
     this.clearReadyTimer()
     this.restartPolicy.dispose()
     const error = new Error('Relay AI Vault service was disposed.')
+    this.readyReject?.(error)
+    this.readyReject = null
+    this.ready = null
     for (const call of [...this.active.values(), ...this.queue.splice(0)]) {
       settleRelayAiVaultServiceCall(call, error)
     }
@@ -128,17 +131,22 @@ export class RelayAiVaultServiceClient implements RelayAiVaultServiceApi {
       }
       const call = this.queue.splice(index, 1)[0]!
       this.active.set(lane, call)
-      void this.ensureChild(call.forceStart).then(
-        (child) => this.sendCall(child, call),
-        (error: Error) => {
-          if (this.active.get(lane) !== call) {
+      const attempt = ++call.startAttempt
+      const readiness = this.ensureChild(call.forceStart)
+      void readiness
+        .wait({
+          signal: call.signal,
+          createAbortError: relayAiVaultAbortError,
+          onFulfilled: (child) => this.sendCall(child, call)
+        })
+        .catch((error: Error) => {
+          if (this.active.get(lane) !== call || call.startAttempt !== attempt) {
             return
           }
           this.active.delete(lane)
           this.retryStartOrSettle(call, error)
           this.pump()
-        }
-      )
+        })
     }
     this.scheduleIdleIfNeeded()
   }
@@ -147,15 +155,9 @@ export class RelayAiVaultServiceClient implements RelayAiVaultServiceApi {
     if (this.active.get(call.lane) !== call || call.settled) {
       return
     }
-    const timeout =
-      call.request.operation === 'list'
-        ? RELAY_AI_VAULT_SCAN_TIMEOUT_MS
-        : RELAY_AI_VAULT_TITLE_TIMEOUT_MS
-    call.timer = setTimeout(
-      () => this.onFault(new Error(`Relay AI Vault service timed out after ${timeout}ms.`)),
-      timeout
+    armRelayAiVaultCallTimeout(call, (timeout) =>
+      this.onFault(new Error(`Relay AI Vault service timed out after ${timeout}ms.`))
     )
-    call.timer.unref?.()
     call.sent = true
     child.send(call.request)
   }
@@ -166,44 +168,46 @@ export class RelayAiVaultServiceClient implements RelayAiVaultServiceApi {
     }
   }
 
-  private ensureChild(forceStart: boolean): Promise<ChildProcess> {
+  private ensureChild(forceStart: boolean): PromiseSettlementWaiters<ChildProcess> {
     if (this.child && !this.ready) {
-      return Promise.resolve(this.child)
+      return new PromiseSettlementWaiters(Promise.resolve(this.child))
     }
     if (this.ready) {
       return this.ready
     }
     const startError = this.restartPolicy.startError(forceStart)
     if (startError) {
-      return Promise.reject(startError)
+      return new PromiseSettlementWaiters(Promise.reject(startError))
     }
     let child: ChildProcess
     try {
       child = this.options.processFactory()
     } catch (error) {
-      return Promise.reject(relayAiVaultError(error))
+      return new PromiseSettlementWaiters(Promise.reject(relayAiVaultError(error)))
     }
     this.child = child
-    this.ready = new Promise<ChildProcess>((resolve, reject) => {
-      this.readyReject = reject
-      // Why: held on the instance so a crash before ready cannot leave the deadline
-      // armed, where it would later fault the healthy replacement sidecar.
-      this.readyTimer = setTimeout(
-        () => this.onFault(new Error('Relay AI Vault service did not become ready.')),
-        RELAY_AI_VAULT_READY_TIMEOUT_MS
-      )
-      this.readyTimer.unref?.()
-      child.on('message', (message) => {
-        if (isRelayAiVaultServiceChildMessage(message) && message.type === 'ready') {
-          this.clearReadyTimer()
-          this.ready = null
-          this.readyReject = null
-          resolve(child)
-          return
-        }
-        this.onMessage(message)
+    this.ready = new PromiseSettlementWaiters(
+      new Promise<ChildProcess>((resolve, reject) => {
+        this.readyReject = reject
+        // Why: held on the instance so a crash before ready cannot leave the deadline
+        // armed, where it would later fault the healthy replacement sidecar.
+        this.readyTimer = setTimeout(
+          () => this.onFault(new Error('Relay AI Vault service did not become ready.')),
+          RELAY_AI_VAULT_READY_TIMEOUT_MS
+        )
+        this.readyTimer.unref?.()
+        child.on('message', (message) => {
+          if (isRelayAiVaultServiceChildMessage(message) && message.type === 'ready') {
+            this.clearReadyTimer()
+            this.ready = null
+            this.readyReject = null
+            resolve(child)
+            return
+          }
+          this.onMessage(message)
+        })
       })
-    })
+    )
     child.on('error', (error) => this.onFault(error))
     child.on('disconnect', () => this.onFault(new Error('Relay AI Vault service disconnected.')))
     child.on('exit', (code) => this.onFault(new Error(`Relay AI Vault service exited (${code}).`)))
diff --git a/src/relay/ai-vault-service-entry.ts b/src/relay/ai-vault-service-entry.ts
index 9bd3ea35786e..3f0a2b02aafe 100644
--- a/src/relay/ai-vault-service-entry.ts
+++ b/src/relay/ai-vault-service-entry.ts
@@ -19,7 +19,7 @@ if (!process.send) {
 const controllers = new Map<number, AbortController>()
 const cancelled = new Set<number>()
 const pending = new Set<number>()
-const provider = createRelayAiVaultFilesystemProvider()
+let provider: ReturnType<typeof createRelayAiVaultFilesystemProvider> | null = null
 let init: RelayAiVaultServiceInit | null = null
 let cacheLane = Promise.resolve()
 let interactiveLane = Promise.resolve()
@@ -36,7 +36,7 @@ async function execute(request: RelayAiVaultServiceRequest): Promise<void> {
     controller.abort()
   }
   try {
-    if (!init) {
+    if (!init || !provider) {
       throw new Error('Relay AI Vault service is not initialized.')
     }
     if (request.operation === 'titles') {
@@ -79,6 +79,7 @@ async function shutdown(): Promise<void> {
     controller.abort()
   }
   await Promise.allSettled([cacheLane, interactiveLane])
+  provider?.dispose()
   process.disconnect?.()
 }
 
@@ -89,6 +90,7 @@ process.on('message', (raw: RelayAiVaultServiceParentMessage) => {
       return
     }
     init = raw
+    provider = createRelayAiVaultFilesystemProvider({ homeDirectory: raw.remoteHome })
     send({ type: 'ready', protocol: RELAY_AI_VAULT_SERVICE_PROTOCOL, pid: process.pid })
     return
   }
diff --git a/src/relay/ai-vault-service-filesystem.ts b/src/relay/ai-vault-service-filesystem.ts
index fd5ff90a755e..58b1b1f2d6ec 100644
--- a/src/relay/ai-vault-service-filesystem.ts
+++ b/src/relay/ai-vault-service-filesystem.ts
@@ -2,9 +2,18 @@ import { readRelayTranscriptBytes } from './ai-vault-transcript-stream'
 import { lstat, readdir } from 'node:fs/promises'
 import type { RemoteSessionFilesystemProvider } from '../main/ai-vault/remote-session-scanner-types'
 import { readRelayFileContent } from './fs-handler-file-read'
+import {
+  createRelayOpenCodeReader,
+  type RelayOpenCodeReaderOptions
+} from './ai-vault-opencode-reader'
 
-export function createRelayAiVaultFilesystemProvider(): RemoteSessionFilesystemProvider {
+export function createRelayAiVaultFilesystemProvider(
+  options: RelayOpenCodeReaderOptions = {}
+): RemoteSessionFilesystemProvider & { dispose(): void } {
+  const openCode = createRelayOpenCodeReader(options)
   return {
+    openCode,
+    dispose: () => openCode.dispose(),
     async readDir(dirPath) {
       const entries = await readdir(dirPath, { withFileTypes: true })
       return entries.map((entry) => ({
diff --git a/src/relay/ai-vault-service-ready-retention.test.ts b/src/relay/ai-vault-service-ready-retention.test.ts
new file mode 100644
index 000000000000..53f845a4e903
--- /dev/null
+++ b/src/relay/ai-vault-service-ready-retention.test.ts
@@ -0,0 +1,202 @@
+import { setImmediate } from 'node:timers/promises'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { getRemoteHostPlatform } from '../main/ssh/ssh-remote-platform'
+import {
+  AiVaultServiceTestChild,
+  readyAiVaultServiceChild
+} from '../main/ai-vault/session-scanner-service-test-child'
+import type { AiVaultSessionTitleRequest } from '../shared/ai-vault-session-title'
+import { RelayAiVaultServiceClient } from './ai-vault-service-client'
+
+function fixture() {
+  const child = new AiVaultServiceTestChild()
+  const processFactory = vi.fn(() => child.asChildProcess())
+  const client = new RelayAiVaultServiceClient({
+    processFactory,
+    init: { remoteHome: '/home/ada', hostPlatform: getRemoteHostPlatform('linux-x64') }
+  })
+  return { client, child, processFactory }
+}
+
+async function collect(): Promise<void> {
+  if (!global.gc) {
+    throw new Error('This regression requires --expose-gc')
+  }
+  for (let turn = 0; turn < 3; turn++) {
+    await setImmediate()
+    global.gc()
+  }
+}
+
+function titleRequests(): AiVaultSessionTitleRequest[] {
+  return [{ agent: 'claude', sessionId: 'session', transcriptPath: '/home/ada/session.jsonl' }]
+}
+
+beforeEach(() => vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout'] }))
+afterEach(() => {
+  vi.clearAllTimers()
+  vi.useRealTimers()
+})
+
+describe('AI Vault readiness ownership', () => {
+  it('releases canceled request payloads while readiness remains pending', async () => {
+    const { client, child, processFactory } = fixture()
+    const canceled = await (async () => {
+      const refs: WeakRef<AiVaultSessionTitleRequest[]>[] = []
+      for (let index = 0; index < 1000; index++) {
+        const requests = titleRequests()
+        refs.push(new WeakRef(requests))
+        const controller = new AbortController()
+        const result = client.resolveSessionTitles(requests, controller.signal)
+        controller.abort()
+        const error = await result.catch((reason: unknown) => reason)
+        if (!(error instanceof Error) || error.name !== 'AbortError') {
+          throw new Error('Canceled title request did not reject with AbortError')
+        }
+      }
+      return refs
+    })()
+    await collect()
+    expect(canceled.filter((ref) => ref.deref() !== undefined)).toHaveLength(0)
+    expect(child.sent).toHaveLength(1)
+    expect(processFactory).toHaveBeenCalledOnce()
+
+    const live = client.resolveSessionTitles(titleRequests())
+    readyAiVaultServiceChild(child)
+    await Promise.resolve()
+    expect(child.sent.at(-1)).toMatchObject({ type: 'request', id: 1001, operation: 'titles' })
+    child.emit('message', { type: 'result', id: 1001, operation: 'titles', value: { titles: [] } })
+    await expect(live).resolves.toEqual({ titles: [] })
+    const disposed = client.dispose()
+    child.emit('exit', 0)
+    await disposed
+    expect(vi.getTimerCount()).toBe(0)
+  })
+
+  it('releases uncanceled readiness payloads when the client is disposed', async () => {
+    const { client, child } = fixture()
+    const discarded = await (async () => {
+      const requests = titleRequests()
+      const ref = new WeakRef(requests)
+      const result = client.resolveSessionTitles(requests)
+      const rejection = expect(result).rejects.toThrow('disposed')
+      const disposed = client.dispose()
+      child.emit('exit', 0)
+      await disposed
+      await rejection
+      return ref
+    })()
+    await collect()
+    expect(discarded.deref() === undefined).toBe(true)
+    expect(child.sent).toEqual([expect.objectContaining({ type: 'init' }), { type: 'shutdown' }])
+    expect(vi.getTimerCount()).toBe(0)
+    await expect(client.resolveSessionTitles([])).rejects.toThrow('disposed')
+  })
+
+  it('does not send a call canceled in the turn that readiness arrives', async () => {
+    const { client, child } = fixture()
+    const controller = new AbortController()
+    const canceled = client.resolveSessionTitles(titleRequests(), controller.signal)
+    readyAiVaultServiceChild(child)
+    controller.abort()
+    const live = client.resolveSessionTitles([])
+    await expect(canceled).rejects.toMatchObject({ name: 'AbortError' })
+    expect(child.sent).toEqual([
+      expect.objectContaining({ type: 'init' }),
+      { type: 'request', id: 2, operation: 'titles', requests: [] }
+    ])
+    child.emit('message', { type: 'result', id: 2, operation: 'titles', value: { titles: [] } })
+    await expect(live).resolves.toEqual({ titles: [] })
+    const disposed = client.dispose()
+    child.emit('exit', 0)
+    await disposed
+  })
+})
+
+it('retries an unsent lane after spawn fails while the other lane starts a child', async () => {
+  const child = new AiVaultServiceTestChild()
+  const processFactory = vi.fn(() => child.asChildProcess())
+  processFactory.mockImplementationOnce(() => {
+    throw new Error('temporary spawn failure')
+  })
+  const client = new RelayAiVaultServiceClient({
+    processFactory,
+    init: { remoteHome: '/home/ada', hostPlatform: getRemoteHostPlatform('linux-x64') }
+  })
+  const list = client.listSessions({})
+  const titles = client.resolveSessionTitles([])
+  void list.catch(() => undefined)
+  void titles.catch(() => undefined)
+  try {
+    readyAiVaultServiceChild(child)
+    await vi.waitFor(() => {
+      expect(child.sent).toContainEqual({ type: 'request', id: 1, operation: 'list', params: {} })
+    })
+    expect(processFactory).toHaveBeenCalledTimes(2)
+    expect(child.sent).toContainEqual({ type: 'request', id: 1, operation: 'list', params: {} })
+    expect(child.sent).toContainEqual({ type: 'request', id: 2, operation: 'titles', requests: [] })
+    child.emit('message', {
+      type: 'result',
+      id: 1,
+      operation: 'list',
+      value: { sessions: [], issues: [], scannedAt: '2026-09-25T00:00:00.000Z' }
+    })
+    child.emit('message', { type: 'result', id: 2, operation: 'titles', value: { titles: [] } })
+    await expect(list).resolves.toMatchObject({ sessions: [] })
+    await expect(titles).resolves.toEqual({ titles: [] })
+  } finally {
+    const disposed = client.dispose()
+    child.emit('exit', 0)
+    await disposed
+  }
+})
+
+it('ignores an earlier readiness rejection after a replacement startup begins', async () => {
+  const first = new AiVaultServiceTestChild()
+  const replacement = new AiVaultServiceTestChild()
+  const processFactory = vi.fn(() => replacement.asChildProcess())
+  processFactory.mockImplementationOnce(() => first.asChildProcess())
+  const client = new RelayAiVaultServiceClient({
+    processFactory,
+    init: { remoteHome: '/home/ada', hostPlatform: getRemoteHostPlatform('linux-x64') }
+  })
+  const list = client.listSessions({})
+  void list.catch(() => undefined)
+  try {
+    first.emit('exit', 1)
+    // Start the replacement before the old readiness rejection's microtasks run.
+    vi.advanceTimersByTime(250)
+    const titles = client.resolveSessionTitles([])
+    void titles.catch(() => undefined)
+    readyAiVaultServiceChild(replacement)
+    await setImmediate()
+
+    expect(processFactory).toHaveBeenCalledTimes(2)
+    expect(first.sent).toEqual([expect.objectContaining({ type: 'init' })])
+    expect(replacement.sent).toEqual([
+      expect.objectContaining({ type: 'init' }),
+      { type: 'request', id: 1, operation: 'list', params: {} },
+      { type: 'request', id: 2, operation: 'titles', requests: [] }
+    ])
+    replacement.emit('message', {
+      type: 'result',
+      id: 1,
+      operation: 'list',
+      value: { sessions: [], issues: [], scannedAt: '2026-09-25T00:00:00.000Z' }
+    })
+    replacement.emit('message', {
+      type: 'result',
+      id: 2,
+      operation: 'titles',
+      value: { titles: [] }
+    })
+    await expect(list).resolves.toMatchObject({ sessions: [] })
+    await expect(titles).resolves.toEqual({ titles: [] })
+    expect(processFactory).toHaveBeenCalledTimes(2)
+  } finally {
+    const disposed = client.dispose()
+    replacement.emit('exit', 0)
+    await disposed
+  }
+  expect(vi.getTimerCount()).toBe(0)
+})
diff --git a/src/relay/freebuff-status-projection.test.ts b/src/relay/freebuff-status-projection.test.ts
new file mode 100644
index 000000000000..b10214ef8010
--- /dev/null
+++ b/src/relay/freebuff-status-projection.test.ts
@@ -0,0 +1,43 @@
+import { readFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { describe, expect, it } from 'vitest'
+import { FreebuffStatusProjection } from './freebuff-status-projection'
+import { createAgentStatusOscProcessor } from '../shared/agent-status-osc'
+
+const transcript = readFileSync(
+  join(import.meta.dirname, '../main/runtime/__fixtures__/freebuff-lifecycle.txt'),
+  'utf8'
+)
+
+describe('Freebuff relay status projection', () => {
+  it.each([1, 137, 4096, transcript.length])(
+    'publishes host-observed states with %i-character PTY chunks',
+    (size) => {
+      const projection = new FreebuffStatusProjection(120, 40)
+      const parse = createAgentStatusOscProcessor()
+      const states: string[] = []
+      try {
+        for (let index = 0; index < transcript.length; index += size) {
+          const raw = transcript.slice(index, index + size)
+          const projected = projection.project(raw)
+          // oxlint-disable-next-line no-control-regex -- Terminal protocol delimiters contain ESC and BEL.
+          expect(projected.replace(/\x1b\]9999;[^\x07]*\x07/g, '')).toBe(raw)
+          for (const payload of parse(projected).payloads) {
+            expect(payload.agentType).toBe('freebuff')
+            if (states.at(-1) !== payload.state) {
+              states.push(payload.state)
+            }
+          }
+        }
+        expect(states).toContain('working')
+        expect(states).toContain('waiting')
+        expect(states.at(-1)).toBe('done')
+        projection.resize(90, 30)
+        projection.dispose()
+        expect(projection.project('later output')).toBe('later output')
+      } finally {
+        projection.dispose()
+      }
+    }
+  )
+})
diff --git a/src/relay/freebuff-status-projection.ts b/src/relay/freebuff-status-projection.ts
new file mode 100644
index 000000000000..6e8ea7d9de32
--- /dev/null
+++ b/src/relay/freebuff-status-projection.ts
@@ -0,0 +1,45 @@
+import { HeadlessEmulator } from '../main/daemon/headless-emulator'
+import {
+  FreebuffScreenStatusTracker,
+  splitFreebuffScreenUpdates
+} from '../shared/freebuff-screen-status'
+
+/** Emits the existing status OSC on the execution host, preserving the PTY's raw byte credit. */
+export class FreebuffStatusProjection {
+  private readonly emulator: HeadlessEmulator
+  private readonly tracker = new FreebuffScreenStatusTracker(true)
+  private disposed = false
+
+  constructor(cols: number, rows: number) {
+    this.emulator = new HeadlessEmulator({ cols, rows, scrollback: 0 })
+  }
+
+  project(data: string): string {
+    if (this.disposed) {
+      return data
+    }
+    return splitFreebuffScreenUpdates(data, this.emulator.partialEscapeTailAnsi)
+      .map((chunk) => {
+        if (!this.emulator.writeSync(chunk)) {
+          return chunk
+        }
+        const status = this.tracker.observe(chunk, () => ({
+          lines: this.emulator.getVisibleLines(),
+          alternate: this.emulator.isAlternateScreen
+        }))
+        return status ? `${chunk}\x1b]9999;${JSON.stringify(status)}\x07` : chunk
+      })
+      .join('')
+  }
+
+  resize(cols: number, rows: number): void {
+    if (!this.disposed) {
+      this.emulator.resize(cols, rows)
+    }
+  }
+
+  dispose(): void {
+    this.disposed = true
+    this.emulator.dispose()
+  }
+}
diff --git a/src/relay/fs-handler-git-fallback.ts b/src/relay/fs-handler-git-fallback.ts
index 6e1144cdf4ff..3298f369c9ec 100644
--- a/src/relay/fs-handler-git-fallback.ts
+++ b/src/relay/fs-handler-git-fallback.ts
@@ -6,10 +6,8 @@
  * and git grep as universal fallbacks — git is always available since this is
  * a git-focused app.
  */
-import { SearchSubprocessLineAccumulator } from '../shared/search-subprocess-lines'
 import { spawn } from 'node:child_process'
 import { fileListingCancellationError } from '../shared/file-listing-cancellation'
-import type { SearchOptions, SearchResult } from './fs-handler-utils'
 import {
   buildGitLsFilesArgsForQuickOpen,
   shouldExcludeQuickOpenRelPath,
@@ -19,14 +17,6 @@ import {
   expandQuickOpenGitFileListing,
   parseQuickOpenGitLsFilesEntry
 } from '../shared/quick-open-readdir-walk'
-import {
-  buildGitGrepArgs,
-  buildSubmatchRegex,
-  createAccumulator,
-  finalize,
-  ingestGitGrepLine,
-  SEARCH_TIMEOUT_MS
-} from '../shared/text-search'
 import { buildRelayGitEnv } from './relay-command-env'
 
 /**
@@ -266,81 +256,4 @@ export function listFilesWithGit(
     })
 }
 
-/**
- * Text search using `git grep`. Fallback when rg is not installed.
- */
-export function searchWithGitGrep(
-  rootPath: string,
-  query: string,
-  opts: SearchOptions
-): Promise<SearchResult> {
-  return new Promise((resolve) => {
-    const gitArgs = buildGitGrepArgs(query, opts)
-    const matchRegex = buildSubmatchRegex(query, opts)
-    const acc = createAccumulator()
-    const lines = new SearchSubprocessLineAccumulator(Number.MAX_SAFE_INTEGER)
-    let done = false
-
-    const child = spawn('git', gitArgs, {
-      cwd: rootPath,
-      env: buildRelayGitEnv(),
-      stdio: ['ignore', 'pipe', 'pipe']
-    })
-    let killTimeout: ReturnType<typeof setTimeout>
-
-    function resolveOnce(): void {
-      if (done) {
-        return
-      }
-      done = true
-      lines.clear()
-      clearTimeout(killTimeout)
-      // Why: child.kill() is advisory. If git ignores it, detach our
-      // closures so repeated relay searches do not retain old scans.
-      child.stdout!.off('data', handleStdoutData)
-      child.stderr!.off('data', handleStderrData)
-      child.off('error', handleError)
-      child.off('close', handleClose)
-      resolve(finalize(acc))
-    }
-
-    function processLine(line: string): void {
-      const verdict = ingestGitGrepLine(line, rootPath, matchRegex, acc, opts.maxResults)
-      if (verdict === 'stop') {
-        child.kill()
-      }
-    }
-
-    function handleStdoutData(chunk: string): void {
-      lines.push(chunk, processLine)
-    }
-
-    function handleStderrData(): void {
-      /* drain */
-    }
-
-    function handleError(): void {
-      resolveOnce()
-    }
-
-    function handleClose(): void {
-      const tail = lines.finish()
-      if (tail !== null) {
-        processLine(tail)
-      }
-      resolveOnce()
-    }
-
-    child.stdout!.setEncoding('utf-8')
-    child.stdout!.on('data', handleStdoutData)
-    child.stderr!.on('data', handleStderrData)
-    child.once('error', handleError)
-    child.once('close', handleClose)
-
-    killTimeout = setTimeout(() => {
-      acc.truncated = true
-      child.kill()
-      resolveOnce()
-    }, SEARCH_TIMEOUT_MS)
-  })
-}
+export { searchWithGitGrep } from './fs-handler-git-search'
diff --git a/src/relay/fs-handler-git-search.ts b/src/relay/fs-handler-git-search.ts
new file mode 100644
index 000000000000..c448c17d4769
--- /dev/null
+++ b/src/relay/fs-handler-git-search.ts
@@ -0,0 +1,130 @@
+import { SearchSubprocessLineAccumulator } from '../shared/search-subprocess-lines'
+import { spawnProcess } from '../shared/child-process/run-process'
+import { abortSignalReason } from '../shared/abort-signal-reason'
+import type { SearchOptions, SearchResult } from './fs-handler-utils'
+import {
+  buildGitGrepArgs,
+  buildSubmatchRegex,
+  createAccumulator,
+  finalize,
+  ingestGitGrepLine,
+  SEARCH_TIMEOUT_MS
+} from '../shared/text-search'
+import {
+  absorbPendingRipgrepSpawnError,
+  killSpawnedRipgrepProcess
+} from '../shared/ripgrep-process-availability'
+import { buildRelayGitEnv } from './relay-command-env'
+
+/**
+ * Text search using `git grep`. Fallback when rg is not installed.
+ */
+export function searchWithGitGrep(
+  rootPath: string,
+  query: string,
+  opts: SearchOptions
+): Promise<SearchResult> {
+  const { signal } = opts
+  if (signal?.aborted) {
+    return Promise.reject(abortSignalReason(signal))
+  }
+  return new Promise((resolve, reject) => {
+    const gitArgs = buildGitGrepArgs(query, opts)
+    const matchRegex = buildSubmatchRegex(query, opts)
+    const acc = createAccumulator()
+    const lines = new SearchSubprocessLineAccumulator(Number.MAX_SAFE_INTEGER)
+    let done = false
+    let processErrorObserved = false
+
+    const child = spawnProcess({
+      program: 'git',
+      args: gitArgs,
+      cwd: rootPath,
+      env: buildRelayGitEnv(),
+      stdio: ['ignore', 'pipe', 'pipe']
+    })
+    let killTimeout: ReturnType<typeof setTimeout>
+
+    function settle(): boolean {
+      if (done) {
+        return false
+      }
+      done = true
+      signal?.removeEventListener('abort', onAbort)
+      lines.clear()
+      clearTimeout(killTimeout)
+      // Why: child.kill() is advisory. If git ignores it, detach our
+      // closures so repeated relay searches do not retain old scans.
+      child.stdout!.off('data', handleStdoutData)
+      child.stderr!.off('data', handleStderrData)
+      child.off('error', handleError)
+      child.off('close', handleClose)
+      absorbPendingRipgrepSpawnError(child, {
+        errorObserved: processErrorObserved,
+        unavailableExitObserved: false
+      })
+      return true
+    }
+
+    function resolveOnce(): void {
+      if (settle()) {
+        resolve(finalize(acc))
+      }
+    }
+
+    function onAbort(): void {
+      if (signal && settle()) {
+        try {
+          killSpawnedRipgrepProcess(child)
+        } catch {
+          // A refused kill must still release the canceled request.
+        }
+        reject(abortSignalReason(signal))
+      }
+    }
+
+    function processLine(line: string): void {
+      const verdict = ingestGitGrepLine(line, rootPath, matchRegex, acc, opts.maxResults)
+      if (verdict === 'stop') {
+        child.kill()
+      }
+    }
+
+    function handleStdoutData(chunk: string): void {
+      lines.push(chunk, processLine)
+    }
+
+    function handleStderrData(): void {
+      /* drain */
+    }
+
+    function handleError(): void {
+      processErrorObserved = true
+      resolveOnce()
+    }
+
+    function handleClose(): void {
+      const tail = lines.finish()
+      if (tail !== null) {
+        processLine(tail)
+      }
+      resolveOnce()
+    }
+
+    child.stdout!.setEncoding('utf-8')
+    child.stdout!.on('data', handleStdoutData)
+    child.stderr!.on('data', handleStderrData)
+    child.once('error', handleError)
+    child.once('close', handleClose)
+
+    killTimeout = setTimeout(() => {
+      acc.truncated = true
+      child.kill()
+      resolveOnce()
+    }, SEARCH_TIMEOUT_MS)
+    signal?.addEventListener('abort', onAbort, { once: true })
+    if (signal?.aborted) {
+      onAbort()
+    }
+  })
+}
diff --git a/src/relay/fs-handler-list-files-ignored.test.ts b/src/relay/fs-handler-list-files-ignored.test.ts
index 3123d35241a1..483afec1c4cd 100644
--- a/src/relay/fs-handler-list-files-ignored.test.ts
+++ b/src/relay/fs-handler-list-files-ignored.test.ts
@@ -670,7 +670,12 @@ describe('relay quick open ignored file listing', () => {
       'rg',
       ['--version'],
       // windowsHide: the probe must never flash a console window on Windows.
-      { env: buildRelayCommandEnv(), stdio: 'ignore', windowsHide: true }
+      expect.objectContaining({
+        env: buildRelayCommandEnv(),
+        stdio: 'ignore',
+        windowsHide: true,
+        shell: false
+      })
     ])
     listProbe.emit('close', 0, null)
     await expect(listing).rejects.toThrow(`Search root is not reachable: ${missingRoot}`)
diff --git a/src/relay/fs-handler-utils.ts b/src/relay/fs-handler-utils.ts
index 8b93c6ac82e7..a3b2234ced04 100644
--- a/src/relay/fs-handler-utils.ts
+++ b/src/relay/fs-handler-utils.ts
@@ -6,7 +6,8 @@
  * so they are straightforward to test independently.
  */
 import { SearchSubprocessLineAccumulator } from '../shared/search-subprocess-lines'
-import { spawn } from 'node:child_process'
+import { spawnProcess } from '../shared/child-process/run-process'
+import { abortSignalReason } from '../shared/abort-signal-reason'
 import { open } from 'node:fs/promises'
 import {
   buildRgArgs,
@@ -83,6 +84,7 @@ export type SearchOptions = {
   includePattern?: string
   excludePattern?: string
   maxResults: number
+  signal?: AbortSignal
 }
 
 export type SearchResult = SharedSearchResult
@@ -104,6 +106,10 @@ export function searchWithRg(
   query: string,
   opts: SearchOptions
 ): Promise<SearchResult> {
+  const { signal } = opts
+  if (signal?.aborted) {
+    return Promise.reject(abortSignalReason(signal))
+  }
   return new Promise((resolve, reject) => {
     const rgArgs = buildRgArgs(query, rootPath, opts)
     const acc = createAccumulator()
@@ -127,13 +133,14 @@ export function searchWithRg(
     // Why a second binding: the closures below capture it, and narrowing does not reach them.
     const command: string = resolvedRgCommand
     const env = buildRelayCommandEnv()
-    let child: ReturnType<typeof spawn>
+    let child: ReturnType<typeof spawnProcess>
     try {
-      child = spawn(command, rgArgs, {
+      child = spawnProcess({
+        program: command,
+        args: rgArgs,
         cwd: rootPath,
         env,
-        stdio: ['ignore', 'pipe', 'pipe'],
-        windowsHide: true
+        stdio: ['ignore', 'pipe', 'pipe']
       })
     } catch {
       resolve(finalize(acc))
@@ -147,6 +154,7 @@ export function searchWithRg(
         return false
       }
       resolved = true
+      signal?.removeEventListener('abort', onAbort)
       lines.clear()
       clearTimeout(killTimeout)
       // Why: child.kill() is advisory over SSH; detach listeners if the
@@ -162,6 +170,17 @@ export function searchWithRg(
       return true
     }
 
+    function onAbort(): void {
+      if (signal && settle()) {
+        try {
+          killSpawnedRipgrepProcess(child)
+        } catch {
+          // A refused kill must still release the canceled request.
+        }
+        reject(abortSignalReason(signal))
+      }
+    }
+
     function resolveOnce(): void {
       if (settle()) {
         resolve(finalize(acc))
@@ -172,8 +191,11 @@ export function searchWithRg(
       if (launchFailureCheck) {
         return
       }
-      launchFailureCheck = retryRipgrepOnPathAfterLaunchFailure(command, rootPath, error).then(
-        async (retryOnPath) => {
+      launchFailureCheck = retryRipgrepOnPathAfterLaunchFailure(command, rootPath, error)
+        .then(async (retryOnPath) => {
+          if (resolved) {
+            return
+          }
           if (retryOnPath) {
             // Why: a launch failure produced no output, so rerunning on PATH rg loses nothing.
             if (settle()) {
@@ -184,19 +206,25 @@ export function searchWithRg(
           // Why not resolveOnce() on an unreachable root: an empty result reads as "no matches"
           // and the git/readdir chain never engages, because it only triggers on an unavailable
           // ripgrep. The workspace moving would otherwise look like a successful empty scan.
+          const failure = await classifyRipgrepLaunchFailure(
+            rootPath,
+            [command, pathRipgrepCommand()],
+            env,
+            signal
+          )
           if (settle()) {
             reject(
-              (await classifyRipgrepLaunchFailure(
-                rootPath,
-                [command, pathRipgrepCommand()],
-                env
-              )) === 'cwd-unreachable'
+              failure === 'cwd-unreachable'
                 ? ripgrepMissingCwdError(rootPath)
                 : new RipgrepUnavailableError()
             )
           }
-        }
-      )
+        })
+        .catch((error: unknown) => {
+          if (settle()) {
+            reject(error)
+          }
+        })
     }
 
     function processLine(line: string): void {
@@ -251,6 +279,10 @@ export function searchWithRg(
       killSpawnedRipgrepProcess(child)
       resolveOnce()
     }, SEARCH_TIMEOUT_MS)
+    signal?.addEventListener('abort', onAbort, { once: true })
+    if (signal?.aborted) {
+      onAbort()
+    }
   })
 }
 
diff --git a/src/relay/fs-handler.ts b/src/relay/fs-handler.ts
index 6286c71941e9..36765721ef33 100644
--- a/src/relay/fs-handler.ts
+++ b/src/relay/fs-handler.ts
@@ -101,7 +101,7 @@ export class FsHandler {
     this.dispatcher.onRequest('fs.renameNoClobber', (p) => renameRelayPathNoClobber(p))
     this.dispatcher.onRequest('fs.copy', (p) => copyRelayPath(p))
     this.dispatcher.onRequest('fs.realpath', (p) => realpathRelayPath(p))
-    this.dispatcher.onRequest('fs.search', (p) => this.search(p))
+    this.dispatcher.onRequest('fs.search', (p, context) => this.search(p, context))
     this.dispatcher.onRequest('fs.getCapabilities', async () => ({
       quickOpenSearchVersion: 1,
       rangedReadVersion: 1,
@@ -185,7 +185,7 @@ export class FsHandler {
     })
   }
 
-  private async search(params: Record<string, unknown>) {
+  private async search(params: Record<string, unknown>, context?: RequestContext) {
     const query = params.query as string
     const rootPath = expandTilde(params.rootPath as string)
     const caseSensitive = params.caseSensitive as boolean | undefined
@@ -204,7 +204,8 @@ export class FsHandler {
       useRegex,
       includePattern,
       excludePattern,
-      maxResults
+      maxResults,
+      signal: context?.signal
     }
     try {
       return await searchWithRg(rootPath, query, options)
diff --git a/src/relay/fs-search-cancellation.test.ts b/src/relay/fs-search-cancellation.test.ts
new file mode 100644
index 000000000000..329c74f07b4f
--- /dev/null
+++ b/src/relay/fs-search-cancellation.test.ts
@@ -0,0 +1,239 @@
+import { ChildProcess } from 'node:child_process'
+import type * as ChildProcessModule from 'node:child_process'
+import type * as RipgrepAvailability from '../shared/ripgrep-process-availability'
+import { getEventListeners } from 'node:events'
+import { PassThrough } from 'node:stream'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { spawnMock, resolveCommand, retryOnPath, classifyFailure } = vi.hoisted(() => ({
+  spawnMock: vi.fn(),
+  resolveCommand: vi.fn((): string | null => '/tools/rg'),
+  retryOnPath: vi.fn(async () => false),
+  classifyFailure: vi.fn(
+    async (): Promise<'cwd-unreachable' | 'ripgrep-unavailable'> => 'ripgrep-unavailable'
+  )
+}))
+vi.mock('node:child_process', async (importOriginal) => ({
+  ...(await importOriginal<typeof ChildProcessModule>()),
+  spawn: spawnMock
+}))
+vi.mock('../shared/ripgrep-process-availability', async (importOriginal) => ({
+  ...(await importOriginal<typeof RipgrepAvailability>()),
+  classifyRipgrepLaunchFailure: classifyFailure
+}))
+vi.mock('./relay-bundled-ripgrep', () => ({
+  resolveRelayRipgrepCommand: resolveCommand,
+  pathRipgrepCommand: () => '/tools/rg',
+  retryRipgrepOnPathAfterLaunchFailure: retryOnPath
+}))
+
+import { searchWithRg } from './fs-handler-utils'
+import { searchWithGitGrep } from './fs-handler-git-fallback'
+import { RelayDispatcher } from './dispatcher'
+import { FsHandler } from './fs-handler'
+import { RelayContext } from './context'
+import { encodeJsonRpcFrame } from './protocol'
+
+function createProcess(spawned = true) {
+  const child = new ChildProcess()
+  child.stdout = new PassThrough()
+  child.stderr = new PassThrough()
+  Object.defineProperty(child, 'pid', { value: spawned ? 4321 : undefined })
+  child.kill = vi.fn(() => true)
+  return child
+}
+
+beforeEach(() => {
+  vi.useFakeTimers()
+  spawnMock.mockReset()
+  resolveCommand.mockReturnValue('/tools/rg')
+  retryOnPath.mockResolvedValue(false)
+  classifyFailure.mockResolvedValue('ripgrep-unavailable')
+})
+afterEach(() => {
+  vi.restoreAllMocks()
+  vi.useRealTimers()
+})
+
+describe.each([
+  { name: 'ripgrep', search: searchWithRg },
+  { name: 'git grep', search: searchWithGitGrep }
+])('relay $name search cancellation', ({ search }) => {
+  it('does not start a child for an already canceled request', async () => {
+    const controller = new AbortController()
+    controller.abort()
+    await expect(
+      search('/remote/root', 'needle', { maxResults: 100, signal: controller.signal })
+    ).rejects.toMatchObject({ name: 'AbortError' })
+    expect(spawnMock).not.toHaveBeenCalled()
+  })
+
+  it('releases a canceled search even when its child never reports an exit', async () => {
+    const child = createProcess()
+    spawnMock.mockReturnValue(child)
+    const controller = new AbortController()
+    const result = search('/remote/root', 'needle', { maxResults: 100, signal: controller.signal })
+    const rejected = expect(result).rejects.toMatchObject({ name: 'AbortError' })
+    child.stdout?.emit('data', 'unfinished output')
+
+    controller.abort()
+    await rejected
+
+    expect(child.kill).toHaveBeenCalledOnce()
+    expect(child.stdout?.listenerCount('data')).toBe(0)
+    expect(child.stderr?.listenerCount('data')).toBe(0)
+    expect(child.listenerCount('close')).toBe(0)
+    expect(child.listenerCount('error')).toBe(0)
+    expect(getEventListeners(controller.signal, 'abort')).toHaveLength(0)
+    expect(vi.getTimerCount()).toBe(0)
+    child.emit('close', 0, null)
+    expect(spawnMock).toHaveBeenCalledOnce()
+  })
+
+  it('removes the abort listener after normal completion', async () => {
+    const child = createProcess()
+    spawnMock.mockReturnValue(child)
+    const controller = new AbortController()
+    const result = search('/remote/root', 'needle', { maxResults: 100, signal: controller.signal })
+    child.emit('close', 0, null)
+    await expect(result).resolves.toEqual({ files: [], totalMatches: 0, truncated: false })
+    expect(getEventListeners(controller.signal, 'abort')).toHaveLength(0)
+    controller.abort()
+    expect(child.kill).not.toHaveBeenCalled()
+  })
+
+  it('absorbs a queued spawn error after cancellation without signaling a missing PID', async () => {
+    const child = createProcess(false)
+    spawnMock.mockReturnValue(child)
+    const controller = new AbortController()
+    const result = search('/remote/root', 'needle', { maxResults: 100, signal: controller.signal })
+    const rejected = expect(result).rejects.toMatchObject({ name: 'AbortError' })
+    controller.abort()
+    await rejected
+    expect(child.kill).not.toHaveBeenCalled()
+    expect(() => child.emit('error', new Error('spawn ENOENT'))).not.toThrow()
+    expect(child.listenerCount('error')).toBe(0)
+  })
+})
+
+it('does not retry on PATH after cancellation during launch-failure diagnosis', async () => {
+  let finishRetry: (retry: boolean) => void = () => undefined
+  retryOnPath.mockReturnValueOnce(
+    new Promise<boolean>((resolve) => {
+      finishRetry = resolve
+    })
+  )
+  const child = createProcess(false)
+  spawnMock.mockReturnValue(child)
+  const controller = new AbortController()
+  const result = searchWithRg('/remote/root', 'needle', {
+    maxResults: 100,
+    signal: controller.signal
+  })
+  const rejected = expect(result).rejects.toMatchObject({ name: 'AbortError' })
+  child.emit('error', new Error('spawn ENOENT'))
+  controller.abort()
+  await rejected
+  finishRetry(true)
+  await Promise.resolve()
+  expect(spawnMock).toHaveBeenCalledOnce()
+})
+
+it('settles cancellation while launch-failure classification is still pending', async () => {
+  let finishClassification: (failure: 'ripgrep-unavailable') => void = () => undefined
+  classifyFailure.mockReturnValueOnce(
+    new Promise((resolve) => {
+      finishClassification = resolve
+    })
+  )
+  const child = createProcess(false)
+  spawnMock.mockReturnValue(child)
+  const controller = new AbortController()
+  const result = searchWithRg('/remote/root', 'needle', {
+    maxResults: 100,
+    signal: controller.signal
+  })
+  const rejected = expect(result).rejects.toMatchObject({ name: 'AbortError' })
+  child.emit('error', new Error('spawn ENOENT'))
+  await Promise.resolve()
+  controller.abort()
+  await rejected
+  finishClassification('ripgrep-unavailable')
+  await Promise.resolve()
+  expect(spawnMock).toHaveBeenCalledOnce()
+  expect(getEventListeners(controller.signal, 'abort')).toHaveLength(0)
+  expect(vi.getTimerCount()).toBe(0)
+})
+
+describe.each(['ripgrep', 'git grep'])('relay dispatcher cancels %s', (backend) => {
+  it.each(['detach', 'rpc.cancel', 'dispose'])(
+    'removes every search child and listener on %s',
+    async (cause) => {
+      if (backend === 'git grep') {
+        resolveCommand.mockReturnValue(null)
+      }
+      const children: ReturnType<typeof createProcess>[] = []
+      spawnMock.mockImplementation(() => {
+        const child = createProcess()
+        children.push(child)
+        return child
+      })
+      const dispatcher = new RelayDispatcher(() => true)
+      const handler = new FsHandler(dispatcher, new RelayContext(), {
+        dispose: vi.fn(),
+        forgetRoot: vi.fn(),
+        subscribe: vi.fn()
+      })
+      try {
+        const client = dispatcher.attachClient(() => true)
+        for (let id = 1; id <= 25; id++) {
+          dispatcher.feedClient(
+            client,
+            encodeJsonRpcFrame(
+              {
+                jsonrpc: '2.0',
+                id,
+                method: 'fs.search',
+                params: { rootPath: '/remote/root', query: 'needle' }
+              },
+              id,
+              0
+            )
+          )
+        }
+        await Promise.resolve()
+        expect(children).toHaveLength(25)
+        if (cause === 'detach') {
+          dispatcher.detachClient(client)
+        } else if (cause === 'dispose') {
+          dispatcher.dispose()
+        } else {
+          for (let id = 1; id <= 25; id++) {
+            dispatcher.feedClient(
+              client,
+              encodeJsonRpcFrame(
+                { jsonrpc: '2.0', method: 'rpc.cancel', params: { id } },
+                id + 25,
+                0
+              )
+            )
+          }
+        }
+        await Promise.resolve()
+        for (const child of children) {
+          expect(child.kill).toHaveBeenCalledOnce()
+          expect(child.stdout?.listenerCount('data')).toBe(0)
+          expect(child.listenerCount('close')).toBe(0)
+        }
+        expect(spawnMock).toHaveBeenCalledTimes(25)
+      } finally {
+        handler.dispose()
+        dispatcher.dispose()
+        for (const child of children) {
+          child.emit('close', 0, null)
+        }
+      }
+      expect(vi.getTimerCount()).toBe(0)
+    }
+  )
+})
diff --git a/src/relay/fs-search-diagnosis-cancellation.test.ts b/src/relay/fs-search-diagnosis-cancellation.test.ts
new file mode 100644
index 000000000000..e545c68485ab
--- /dev/null
+++ b/src/relay/fs-search-diagnosis-cancellation.test.ts
@@ -0,0 +1,190 @@
+import { ChildProcess } from 'node:child_process'
+import type * as ChildProcessModule from 'node:child_process'
+import type * as FsPromises from 'node:fs/promises'
+import { PassThrough } from 'node:stream'
+import { getEventListeners } from 'node:events'
+import { afterEach, beforeEach, expect, it, vi } from 'vitest'
+
+const { spawnMock, statMock } = vi.hoisted(() => ({ spawnMock: vi.fn(), statMock: vi.fn() }))
+vi.mock('node:child_process', async (importOriginal) => ({
+  ...(await importOriginal<typeof ChildProcessModule>()),
+  spawn: spawnMock
+}))
+vi.mock('node:fs/promises', async (importOriginal) => ({
+  ...(await importOriginal<typeof FsPromises>()),
+  stat: statMock,
+  access: vi.fn(async () => undefined)
+}))
+vi.mock('./relay-bundled-ripgrep', () => ({
+  resolveRelayRipgrepCommand: () => '/tools/rg',
+  pathRipgrepCommand: () => '/tools/rg',
+  retryRipgrepOnPathAfterLaunchFailure: async () => false
+}))
+import { searchWithRg } from './fs-handler-utils'
+import { classifyRipgrepLaunchFailure } from '../shared/ripgrep-process-availability'
+import { searchWithGitGrep } from './fs-handler-git-search'
+
+function child(spawned: boolean) {
+  const result = new ChildProcess()
+  result.stdout = new PassThrough()
+  result.stderr = new PassThrough()
+  Object.defineProperty(result, 'pid', { value: spawned ? 4321 : undefined })
+  result.kill = vi.fn(() => true)
+  return result
+}
+beforeEach(() => {
+  vi.useFakeTimers()
+  spawnMock.mockReset()
+  statMock.mockReset().mockResolvedValue({ isDirectory: () => false })
+})
+afterEach(() => vi.useRealTimers())
+it('does not start a version probe after canceled launch diagnosis resumes', async () => {
+  vi.useFakeTimers()
+  let completeStat: (value: { isDirectory: () => boolean }) => void = () => undefined
+  statMock.mockReturnValue(
+    new Promise((resolve) => {
+      completeStat = resolve
+    })
+  )
+  const failed = child(false)
+  const probe = child(true)
+  spawnMock.mockReturnValueOnce(failed).mockReturnValue(probe)
+  const controller = new AbortController()
+  const search = searchWithRg('/missing/root', 'needle', {
+    maxResults: 100,
+    signal: controller.signal
+  })
+  const canceled = expect(search).rejects.toMatchObject({ name: 'AbortError' })
+  failed.emit('error', new Error('spawn ENOENT'))
+  for (let tick = 0; tick < 5; tick += 1) {
+    await Promise.resolve()
+  }
+  expect(statMock).toHaveBeenCalledOnce()
+  controller.abort()
+  await canceled
+  completeStat({ isDirectory: () => false })
+  for (let tick = 0; tick < 10; tick += 1) {
+    await Promise.resolve()
+  }
+  const observed = spawnMock.mock.calls.map((args) => [args[0], args[1]])
+  probe.emit('close', 0)
+  expect(observed).toEqual([['/tools/rg', expect.not.arrayContaining(['--version'])]])
+})
+
+for (const [name, search] of [
+  ['rg', searchWithRg],
+  ['git', searchWithGitGrep]
+] as const) {
+  it.each(['emit', 'throw'])(
+    `settles ${name} cancellation when kill fails via %s`,
+    async (mode) => {
+      const process = child(true)
+      process.kill = vi.fn(() => {
+        const error = Object.assign(new Error('kill EPERM'), { code: 'EPERM' })
+        if (mode === 'throw') {
+          throw error
+        }
+        process.emit('error', error)
+        return false
+      })
+      spawnMock.mockReturnValue(process)
+      const controller = new AbortController()
+      const result = search('/root', 'needle', { maxResults: 100, signal: controller.signal })
+      const canceled = expect(result).rejects.toMatchObject({ name: 'AbortError' })
+      expect(() => controller.abort()).not.toThrow()
+      await canceled
+      expect(process.kill).toHaveBeenCalledOnce()
+      expect(process.stdout?.listenerCount('data')).toBe(0)
+      expect(getEventListeners(controller.signal, 'abort')).toHaveLength(0)
+      expect(vi.getTimerCount()).toBe(0)
+    }
+  )
+}
+
+it('terminates an active version probe and skips remaining candidates on abort', async () => {
+  const probe = child(true)
+  spawnMock.mockReturnValue(probe)
+  const controller = new AbortController()
+  const diagnosis = classifyRipgrepLaunchFailure(
+    '/missing/root',
+    ['/tools/rg', '/fallback/rg'],
+    {},
+    controller.signal
+  )
+  const canceled = expect(diagnosis).rejects.toMatchObject({ name: 'AbortError' })
+  for (let tick = 0; tick < 5; tick += 1) {
+    await Promise.resolve()
+  }
+  expect(spawnMock).toHaveBeenCalledOnce()
+  controller.abort()
+  await canceled
+  expect(probe.kill).toHaveBeenCalledOnce()
+  expect(probe.listenerCount('close')).toBe(0)
+  expect(getEventListeners(controller.signal, 'abort')).toHaveLength(0)
+  expect(vi.getTimerCount()).toBe(0)
+  probe.emit('close', 0)
+  expect(spawnMock).toHaveBeenCalledOnce()
+})
+
+it('preserves candidate fallback and cwd classification for a live caller', async () => {
+  const missing = child(true)
+  const available = child(true)
+  spawnMock.mockReturnValueOnce(missing).mockReturnValueOnce(available)
+  const controller = new AbortController()
+  const diagnosis = classifyRipgrepLaunchFailure(
+    '/missing/root',
+    ['/tools/rg', '/fallback/rg'],
+    {},
+    controller.signal
+  )
+  for (let tick = 0; tick < 5; tick += 1) {
+    await Promise.resolve()
+  }
+  missing.emit('close', 1)
+  for (let tick = 0; tick < 5; tick += 1) {
+    await Promise.resolve()
+  }
+  available.emit('close', 0)
+  await expect(diagnosis).resolves.toBe('cwd-unreachable')
+  expect(spawnMock.mock.calls.map(([program, args]) => [program, args])).toEqual([
+    ['/tools/rg', ['--version']],
+    ['/fallback/rg', ['--version']]
+  ])
+  expect(getEventListeners(controller.signal, 'abort')).toHaveLength(0)
+  expect(vi.getTimerCount()).toBe(0)
+  expect(missing.kill).not.toHaveBeenCalled()
+  expect(available.kill).not.toHaveBeenCalled()
+})
+
+it.each(['emit', 'throw'])(
+  'settles version-probe cancellation when kill fails via %s',
+  async (mode) => {
+    const probe = child(true)
+    probe.kill = vi.fn(() => {
+      const error = Object.assign(new Error('kill EPERM'), { code: 'EPERM' })
+      if (mode === 'throw') {
+        throw error
+      }
+      probe.emit('error', error)
+      return false
+    })
+    spawnMock.mockReturnValue(probe)
+    const controller = new AbortController()
+    const diagnosis = classifyRipgrepLaunchFailure(
+      '/missing/root',
+      ['/tools/rg', '/fallback/rg'],
+      {},
+      controller.signal
+    )
+    const canceled = expect(diagnosis).rejects.toMatchObject({ name: 'AbortError' })
+    for (let tick = 0; tick < 5; tick += 1) {
+      await Promise.resolve()
+    }
+    expect(() => controller.abort()).not.toThrow()
+    await canceled
+    expect(probe.kill).toHaveBeenCalledOnce()
+    expect(spawnMock).toHaveBeenCalledOnce()
+    expect(getEventListeners(controller.signal, 'abort')).toHaveLength(0)
+    expect(vi.getTimerCount()).toBe(0)
+  }
+)
diff --git a/src/relay/omp-fresh-launch-environment.test.ts b/src/relay/omp-fresh-launch-environment.test.ts
index 5f7cd57681f5..8697368567f2 100644
--- a/src/relay/omp-fresh-launch-environment.test.ts
+++ b/src/relay/omp-fresh-launch-environment.test.ts
@@ -91,7 +91,7 @@ it('prepares the execution host OMP config and status extension for a guarded la
     source.mockReturnValue(false)
     expect(
       await augment.mock.calls[1][0]({ id: 'other', shell: '/bin/bash', env: {}, command: 'codex' })
-    ).toEqual({ ORCA_OPENCODE_AGENT: 'opencode' })
+    ).toEqual({})
   } finally {
     runtime.stop()
     dispatcher.dispose()
diff --git a/src/relay/opencode-hook-selection.test.ts b/src/relay/opencode-hook-selection.test.ts
new file mode 100644
index 000000000000..336db284a476
--- /dev/null
+++ b/src/relay/opencode-hook-selection.test.ts
@@ -0,0 +1,188 @@
+import './mock-descendant-sweep'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { beginPtyHandlerTest, endPtyHandlerTest } from './pty-handler-test-harness'
+import { RelayAgentHookRuntime } from './relay-agent-hook-runtime'
+import type { RelayDispatcher } from './dispatcher'
+import { AGENT_HOOK_INSTALL_PLUGINS_METHOD } from '../shared/agent-hook-relay'
+
+const mocks = vi.hoisted(() => ({
+  mockPtySpawn: vi.fn(),
+  mockCreateShellPromptReadinessProbe: vi.fn(),
+  mockPtyInstance: {
+    pid: process.pid,
+    onData: vi.fn(),
+    onExit: vi.fn(),
+    write: vi.fn(),
+    resize: vi.fn(),
+    kill: vi.fn(),
+    clear: vi.fn(),
+    pause: vi.fn(),
+    resume: vi.fn()
+  }
+}))
+vi.mock('node-pty', () => ({ spawn: mocks.mockPtySpawn }))
+vi.mock('../main/shell-prompt-readiness-probe', () => ({
+  createShellPromptReadinessProbe: mocks.mockCreateShellPromptReadinessProbe
+}))
+vi.mock('../main/pty/posix-pty-process-groups', () => ({
+  forceKillPosixPtyProcessGroups: vi.fn((_pid: number, fallback: () => void) => fallback())
+}))
+vi.mock('./agent-hook-server', () => ({
+  RelayAgentHookServer: class {
+    start = async () => {}
+    stop = () => {}
+    buildPtyEnv = () => ({ ORCA_AGENT_HOOK_PORT: '12345' })
+    clearPaneState = () => {}
+  }
+}))
+let root: string
+let harness: ReturnType<typeof beginPtyHandlerTest>
+let runtime: RelayAgentHookRuntime
+let custom: string
+const plugin = (dir: string, agent: string) => join(dir, 'plugins', `orca-${agent}-status.js`)
+
+beforeEach(async () => {
+  root = mkdtempSync(join(tmpdir(), 'orca-relay-disabled-'))
+  custom = join(root, 'custom')
+  mkdirSync(custom)
+  writeFileSync(join(custom, 'opencode.json'), '{"model":"fixture"}')
+  vi.stubEnv('HOME', root)
+  vi.stubEnv('XDG_CONFIG_HOME', join(root, 'xdg'))
+  for (const key of [
+    'OPENCODE_CONFIG_DIR',
+    'ORCA_OPENCODE_CONFIG_DIR',
+    'ORCA_OPENCODE_SOURCE_CONFIG_DIR',
+    'ORCA_OPENCODE_AGENT',
+    'ZDOTDIR'
+  ]) {
+    vi.stubEnv(key, undefined)
+  }
+  harness = beginPtyHandlerTest(mocks)
+  runtime = new RelayAgentHookRuntime(
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: this harness implements the request registration used by the runtime; PTY and disk paths are real.
+    harness.dispatcher as unknown as RelayDispatcher,
+    harness.handler,
+    join(root, 'relay.sock')
+  )
+  await runtime.start()
+})
+afterEach(async () => {
+  runtime.stop()
+  await endPtyHandlerTest(harness.handler, harness.originalPlatform)
+  vi.unstubAllEnvs()
+  rmSync(root, { recursive: true, force: true })
+})
+async function install(v1: string, v2: string): Promise<void> {
+  await harness.dispatcher.callRequest(AGENT_HOOK_INSTALL_PLUGINS_METHOD, {
+    opencodePluginSource: v1,
+    opencode2PluginSource: v2
+  })
+}
+async function spawn(params: Record<string, unknown> = {}): Promise<Record<string, string>> {
+  await harness.dispatcher.callRequest('pty.spawn', {
+    cwd: root,
+    shell: '/bin/bash',
+    cols: 80,
+    rows: 24,
+    command: 'echo fixture',
+    ...params
+  })
+  return mocks.mockPtySpawn.mock.calls.at(-1)?.[2].env
+}
+
+describe('relay OpenCode source selection on real fixture files', () => {
+  it('leaves a standalone relay without supplied sources unconfigured', async () => {
+    const env = await spawn()
+    expect(env.ORCA_OPENCODE_AGENT).toBeUndefined()
+    expect(existsSync(join(root, 'xdg', 'opencode'))).toBe(false)
+  })
+  it.each([
+    { v1: '// v1', v2: '// v2', selected: 'opencode' },
+    { v1: '', v2: '// v2', selected: 'opencode2' },
+    { v1: '// v1', v2: '', selected: 'opencode' },
+    { v1: '', v2: '', selected: undefined }
+  ])('ordinary terminal with sources $v1 / $v2', async ({ v1, v2, selected }) => {
+    await install(v1, v2)
+    const env = await spawn()
+    expect(env.ORCA_OPENCODE_AGENT).toBe(selected)
+    for (const agent of ['opencode', 'opencode2']) {
+      expect(existsSync(plugin(join(root, 'xdg', 'opencode'), agent))).toBe(agent === selected)
+    }
+  })
+  it.each(['opencode', 'opencode2'] as const)(
+    'does not substitute another plugin for disabled explicit %s',
+    async (agent) => {
+      await install(agent === 'opencode' ? '' : '// v1', agent === 'opencode2' ? '' : '// v2')
+      for (const params of [{ command: `${agent} --session fixture` }, { launchAgent: agent }]) {
+        const env = await spawn(params)
+        expect(env.ORCA_OPENCODE_AGENT).toBeUndefined()
+        expect(existsSync(join(root, 'xdg', 'opencode'))).toBe(false)
+      }
+    }
+  )
+  it('updates cached sources on one runtime and leaves old plugin files intact', async () => {
+    await install('// v1', '// v2')
+    await spawn()
+    const original = plugin(join(root, 'xdg', 'opencode'), 'opencode')
+    writeFileSync(original, '// sentinel')
+    await install('', '// v2')
+    expect((await spawn()).ORCA_OPENCODE_AGENT).toBe('opencode2')
+    expect(readFileSync(original, 'utf8')).toBe('// sentinel')
+    await install('// refreshed v1', '// v2')
+    expect((await spawn()).ORCA_OPENCODE_AGENT).toBe('opencode')
+    expect(readFileSync(original, 'utf8')).toBe('// refreshed v1')
+  })
+  it('restores the real custom source when all OpenCode sources are revoked', async () => {
+    await install('// v1', '// v2')
+    const first = await spawn({ env: { OPENCODE_CONFIG_DIR: custom } })
+    const path = plugin(first.OPENCODE_CONFIG_DIR, 'opencode')
+    expect(readFileSync(path, 'utf8')).toBe('// v1')
+    await install('', '')
+    const env = await spawn({ env: first })
+    expect(env.OPENCODE_CONFIG_DIR).toBe(custom)
+    expect(env.ORCA_OPENCODE_AGENT).toBeUndefined()
+    expect(env.ORCA_OPENCODE_CONFIG_DIR).toBeUndefined()
+    expect(env.ORCA_OPENCODE_SOURCE_CONFIG_DIR).toBeUndefined()
+    expect(readFileSync(path, 'utf8')).toBe('// v1')
+    expect(env.ORCA_AGENT_HOOK_PORT).toBe('12345')
+  })
+})
+
+it.each([true, false])(
+  'preserves explicit config over inherited relay markers with hooks %s',
+  async (enabled) => {
+    await install(enabled ? '// v1' : '', '')
+    const stale = join(root, 'stale-source')
+    mkdirSync(stale)
+    writeFileSync(join(stale, 'opencode.json'), '{"model":"stale"}')
+    vi.stubEnv('ORCA_OPENCODE_CONFIG_DIR', join(root, 'old-overlay'))
+    vi.stubEnv('ORCA_OPENCODE_SOURCE_CONFIG_DIR', stale)
+    const env = await spawn({ env: { OPENCODE_CONFIG_DIR: custom } })
+    expect(readFileSync(join(env.OPENCODE_CONFIG_DIR, 'opencode.json'), 'utf8')).toBe(
+      '{"model":"fixture"}'
+    )
+    expect(env.ORCA_OPENCODE_SOURCE_CONFIG_DIR).toBe(enabled ? custom : undefined)
+    expect(existsSync(plugin(stale, 'opencode'))).toBe(false)
+  }
+)
+
+it.each([true, false])(
+  'restores legacy source-only overlay markers with hooks %s',
+  async (enabled) => {
+    await install('// v1', '')
+    const parent = await spawn({ env: { OPENCODE_CONFIG_DIR: custom } })
+    delete parent.ORCA_OPENCODE_CONFIG_DIR
+    if (!enabled) {
+      await install('', '')
+    }
+    const env = await spawn({ env: parent })
+    expect(env.OPENCODE_CONFIG_DIR).toEqual(enabled ? expect.any(String) : custom)
+    expect(readFileSync(join(env.OPENCODE_CONFIG_DIR, 'opencode.json'), 'utf8')).toBe(
+      '{"model":"fixture"}'
+    )
+    expect(env.ORCA_OPENCODE_SOURCE_CONFIG_DIR).toBe(enabled ? custom : undefined)
+  }
+)
diff --git a/src/relay/plugin-overlay.ts b/src/relay/plugin-overlay.ts
index 1c1c52000336..001309c1f931 100644
--- a/src/relay/plugin-overlay.ts
+++ b/src/relay/plugin-overlay.ts
@@ -79,7 +79,7 @@ function isUsableId(id: string): boolean {
   return typeof id === 'string' && id.length > 0 && id.length <= 1024
 }
 export type PluginSources = {
-  /** Source body of `orca-opencode-status.js` to drop into <overlay>/plugins/. */
+  /** Empty string revokes future installs; omission preserves the cached source. */
   opencodePluginSource?: string
   /** Source body of OpenCode 2's status plugin. */
   opencode2PluginSource?: string
@@ -158,7 +158,7 @@ export class PluginOverlayManager {
     }
   }
   hasOpenCodeSource(agent: 'opencode' | 'opencode2' = 'opencode'): boolean {
-    return (agent === 'opencode2' ? this.opencode2PluginSource : this.opencodePluginSource) !== null
+    return Boolean(agent === 'opencode2' ? this.opencode2PluginSource : this.opencodePluginSource)
   }
   hasPiSource(kind?: PiAgentKind): boolean {
     if (kind) {
diff --git a/src/relay/preflight-handler.ts b/src/relay/preflight-handler.ts
index b84166e76ba4..1be1a63f9d40 100644
--- a/src/relay/preflight-handler.ts
+++ b/src/relay/preflight-handler.ts
@@ -39,10 +39,7 @@ const CONSERVATIVE_SYSTEM_SHELL_DIRS = new Set(['/bin', '/usr/bin'])
 const AGENT_PATH_PREFIX = '__ORCA_AGENT_PATH__'
 
 export class PreflightHandler {
-  private dispatcher: RelayDispatcher
-
-  constructor(dispatcher: RelayDispatcher) {
-    this.dispatcher = dispatcher
+  constructor(private readonly dispatcher: RelayDispatcher) {
     this.registerHandlers()
   }
 
@@ -53,9 +50,7 @@ export class PreflightHandler {
     )
   }
 
-  // Why: the client sends the command list rather than importing TUI_AGENT_CONFIG
-  // on the relay side. This keeps the relay bundle minimal and makes the protocol
-  // self-describing — the relay doesn't need to know the agent catalog.
+  // Why: client-supplied commands keep the relay independent of the agent catalog.
   private async detectAgents(params: Record<string, unknown>): Promise<{
     agents: string[]
     versions?: Record<string, string>
@@ -66,9 +61,11 @@ export class PreflightHandler {
     }
     const probeCommands = [
       ...new Set(
-        commands
-          .filter((command) => !isDetectionUnsupportedInRuntime(command, process.platform))
-          .flatMap((command) => [command.cmd, ...(command.requiredCommands ?? [])])
+        commands.flatMap((command) =>
+          isDetectionUnsupportedInRuntime(command, process.platform)
+            ? []
+            : [command.cmd, ...(command.requiredCommands ?? [])]
+        )
       )
     ]
 
diff --git a/src/relay/pty-handler-output-streaming.test.ts b/src/relay/pty-handler-output-streaming.test.ts
index af0a4cbdfaa5..1030d98ca42b 100644
--- a/src/relay/pty-handler-output-streaming.test.ts
+++ b/src/relay/pty-handler-output-streaming.test.ts
@@ -1,3 +1,5 @@
+import { readFileSync } from 'node:fs'
+import { join } from 'node:path'
 import './mock-descendant-sweep'
 import { describe, expect, it, vi, beforeEach, afterEach } from 'vitest'
 import { PTY_STARTUP_INGRESS_VERSION } from '../shared/pty-startup-ingress'
@@ -150,6 +152,34 @@ describe('PtyHandler', () => {
     expect(dispatcher.notify).toHaveBeenCalledWith('pty.data', { id: PTY_1, data: 'hello world' })
   })
 
+  it('publishes Freebuff host status without charging synthetic OSC bytes to the PTY', async () => {
+    let onData: ((data: string) => void) | undefined
+    mockPtySpawn.mockReturnValue({
+      ...mockPtyInstance,
+      onData: vi.fn((callback: (data: string) => void) => {
+        onData = callback
+      })
+    })
+    await dispatcher.callRequest('pty.spawn', { launchAgent: 'freebuff', cols: 120, rows: 40 })
+    const raw = readFileSync(
+      join(import.meta.dirname, '../main/runtime/__fixtures__/freebuff-trust.txt'),
+      'utf8'
+    )
+    onData!(raw)
+    vi.advanceTimersByTime(8)
+    expect(dispatcher.notify).toHaveBeenCalledWith('pty.data', {
+      id: PTY_1,
+      data: expect.stringContaining('"state":"blocked"'),
+      rawLength: raw.length,
+      seq: raw.length,
+      transformed: true
+    })
+    dispatcher.notify.mockClear()
+    onData!('more output')
+    vi.advanceTimersByTime(8)
+    expect(dispatcher.notify).toHaveBeenCalledWith('pty.data', { id: PTY_1, data: 'more output' })
+  })
+
   it('consumes capable startup queries before relay replay and fanout', async () => {
     let dataCallback: ((data: string) => void) | undefined
     const term = {
diff --git a/src/relay/pty-handler-shell-recovery.test.ts b/src/relay/pty-handler-shell-recovery.test.ts
new file mode 100644
index 000000000000..0d34aa80ff90
--- /dev/null
+++ b/src/relay/pty-handler-shell-recovery.test.ts
@@ -0,0 +1,196 @@
+import './mock-descendant-sweep'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { PROCESS_BOUNDARY_GROUND } from '../shared/terminal-mode-reset-profiles'
+import { RelayDispatcher, type RelayClientSessionIdentity } from './dispatcher'
+import { encodeJsonRpcFrame, MessageType } from './protocol'
+import { PtyHandler } from './pty-handler'
+import { TEST_PTY_ID_MINT_EPOCH } from './pty-handler-test-harness'
+import { RelayPtySourcePublication } from './relay-pty-source-publication'
+import { SshPtyConsumerSessionAdapter } from './ssh-pty-consumer-session-adapter'
+
+const { mockPtySpawn, mockConfirmShellForeground } = vi.hoisted(() => ({
+  mockPtySpawn: vi.fn(),
+  mockConfirmShellForeground: vi.fn()
+}))
+
+vi.mock('node-pty', () => ({ spawn: mockPtySpawn }))
+vi.mock('../main/daemon/pty-subprocess/pty-shell-foreground-confirmation', () => ({
+  confirmPtyShellForeground: mockConfirmShellForeground
+}))
+
+const endpointIdentity: RelayClientSessionIdentity = {
+  principal: 'endpoint-principal',
+  authenticated: true,
+  allowSessionOwner: true,
+  authenticationKind: 'endpoint-credential'
+}
+
+// A command that pushed kitty keyboard flags and died without popping them.
+const DYING_COMMAND = '\x1b]133;C\x07\x1b[>1u'
+const COMMAND_DONE = '\x1b]133;D;130\x07'
+const PROMPT = '$ '
+
+type Frame = {
+  method?: string
+  id?: number
+  params?: Record<string, unknown>
+  result?: Record<string, unknown>
+}
+
+function requestFrame(id: number, method: string, params: Record<string, unknown>): Buffer {
+  return encodeJsonRpcFrame({ jsonrpc: '2.0', id, method, params }, id, 0)
+}
+
+function decode(buffer: Buffer): Frame | null {
+  if (buffer[0] !== MessageType.Regular) {
+    return null
+  }
+  const length = buffer.readUInt32BE(9)
+  return JSON.parse(buffer.subarray(13, 13 + length).toString('utf8'))
+}
+
+describe.each([
+  ['source-credit delivery', true],
+  ['legacy delivery', false]
+])('PtyHandler shell recovery over %s', (_, sourceCredit) => {
+  let dispatcher: RelayDispatcher
+  let handler: PtyHandler
+  let writes: Buffer[]
+  let emitData: (data: string) => void
+  let emitExit: (event: { exitCode: number }) => void
+  let ptyId: string
+  let originalPlatform: PropertyDescriptor | undefined
+
+  beforeEach(async () => {
+    vi.useFakeTimers()
+    originalPlatform = Object.getOwnPropertyDescriptor(process, 'platform')
+    Object.defineProperty(process, 'platform', { configurable: true, value: 'linux' })
+    writes = []
+    mockConfirmShellForeground.mockReset()
+    mockPtySpawn.mockReset()
+    mockPtySpawn.mockReturnValue({
+      pid: process.pid,
+      onData: vi.fn((callback: (data: string) => void) => (emitData = callback)),
+      onExit: vi.fn((callback: (event: { exitCode: number }) => void) => (emitExit = callback)),
+      write: vi.fn(),
+      resize: vi.fn(),
+      kill: vi.fn(),
+      clear: vi.fn(),
+      pause: vi.fn(),
+      resume: vi.fn(),
+      destroy: vi.fn()
+    })
+    dispatcher = new RelayDispatcher(
+      (data, settle) => {
+        writes.push(Buffer.from(data))
+        queueMicrotask(() => settle({ ok: true }))
+        return true
+      },
+      { supportsWriteCallback: true, writableHighWaterMark: () => 0 },
+      endpointIdentity
+    )
+    handler = new PtyHandler(dispatcher, undefined, TEST_PTY_ID_MINT_EPOCH)
+    if (sourceCredit) {
+      let publication: RelayPtySourcePublication | undefined
+      const adapter = new SshPtyConsumerSessionAdapter(dispatcher, 'build-a', undefined, (id) =>
+        publication?.onCreditAvailable(id)
+      )
+      publication = new RelayPtySourcePublication(dispatcher, adapter, (id) =>
+        handler.handleSourcePublicationCapacity(id)
+      )
+      handler.setSourcePublication(publication)
+      dispatcher.feed(
+        requestFrame(1, 'pty.openClient', {
+          protocolVersion: 1,
+          clientInstanceId: 'client-1',
+          requestedRole: 'session-owner',
+          capabilities: { outputFlowControl: { versions: [1], requestedWindowSu: 256 * 1024 } }
+        })
+      )
+      await vi.advanceTimersByTimeAsync(0)
+    }
+    dispatcher.feed(requestFrame(2, 'pty.spawn', {}))
+    await vi.advanceTimersByTimeAsync(0)
+    ptyId = String(response(2)?.id)
+  })
+
+  afterEach(async () => {
+    await handler.dispose({ waitForPhysicalExit: false }).catch(() => {})
+    dispatcher.dispose()
+    if (originalPlatform) {
+      Object.defineProperty(process, 'platform', originalPlatform)
+    }
+    vi.useRealTimers()
+  })
+
+  function response(id: number): Record<string, unknown> | undefined {
+    return writes.map(decode).find((frame) => frame?.id === id)?.result
+  }
+
+  function published(): string {
+    const frames = writes.map(decode).filter((frame) => frame?.method === 'pty.data')
+    if (sourceCredit) {
+      expect(frames.every((frame) => frame?.params?.sourceLengthSu !== undefined)).toBe(true)
+    }
+    return frames.map((frame) => frame?.params?.data).join('')
+  }
+
+  async function replay(): Promise<string> {
+    dispatcher.feed(
+      requestFrame(3, 'pty.attach', {
+        id: ptyId,
+        requireReplay: true,
+        suppressReplayNotification: true
+      })
+    )
+    await vi.advanceTimersByTimeAsync(0)
+    return String(response(3)?.replay ?? '')
+  }
+
+  async function stream(...chunks: string[]): Promise<void> {
+    for (const chunk of chunks) {
+      emitData(chunk)
+    }
+    await vi.advanceTimersByTimeAsync(50)
+  }
+
+  it('grounds a dead command before the prompt, live and in replay alike', async () => {
+    mockConfirmShellForeground.mockResolvedValue(true)
+    await stream(DYING_COMMAND, `${COMMAND_DONE}${PROMPT}`)
+
+    const expected = `${DYING_COMMAND}${COMMAND_DONE}${PROCESS_BOUNDARY_GROUND}${PROMPT}`
+    expect(mockConfirmShellForeground).toHaveBeenCalledOnce()
+    expect(published()).toBe(expected)
+    expect(await replay()).toBe(expected)
+  })
+
+  it('leaves the bytes unchanged when the shell does not own the foreground', async () => {
+    mockConfirmShellForeground.mockResolvedValue(false)
+    await stream(DYING_COMMAND, `${COMMAND_DONE}${PROMPT}`)
+
+    const expected = `${DYING_COMMAND}${COMMAND_DONE}${PROMPT}`
+    expect(published()).toBe(expected)
+    expect(await replay()).toBe(expected)
+  })
+
+  it('delivers a dying app’s oversized final frame and the ground behind it', async () => {
+    mockConfirmShellForeground.mockResolvedValue(true)
+    const finalFrame = 'x'.repeat(20 * 1024)
+    await stream(DYING_COMMAND, `${finalFrame}${COMMAND_DONE}${PROMPT}`)
+
+    const expected = `${DYING_COMMAND}${finalFrame}${COMMAND_DONE}${PROCESS_BOUNDARY_GROUND}${PROMPT}`
+    expect(published()).toBe(expected)
+    expect(await replay()).toBe(expected)
+  })
+
+  it('flushes the held prompt when the shell exits mid-proof', async () => {
+    mockConfirmShellForeground.mockReturnValue(new Promise(() => {}))
+    await stream(DYING_COMMAND, `${COMMAND_DONE}${PROMPT}`)
+    expect(published()).not.toContain(PROMPT)
+
+    emitExit({ exitCode: 0 })
+    await vi.advanceTimersByTimeAsync(50)
+
+    expect(published()).toBe(`${DYING_COMMAND}${COMMAND_DONE}${PROMPT}`)
+  })
+})
diff --git a/src/relay/pty-handler-spawn-environment.test.ts b/src/relay/pty-handler-spawn-environment.test.ts
index eff0f68f2fac..22993322a9c7 100644
--- a/src/relay/pty-handler-spawn-environment.test.ts
+++ b/src/relay/pty-handler-spawn-environment.test.ts
@@ -606,6 +606,54 @@ describe('PtyHandler', () => {
     expect(callArgs.env.ORCA_TAB_ID).toBe('tab-1')
   })
 
+  it('mirrors pane identity onto its scrub-safe aliases for a remote spawn', async () => {
+    // Why the relay and not just the shared helper: a remote pane's env is built here, and an
+    // agent whose harness drops KEY/TOKEN names (DSH) has nothing to attribute its hooks to.
+    await dispatcher.callRequest('pty.spawn', {
+      cols: 80,
+      rows: 24,
+      env: { ORCA_PANE_KEY: 'tab-1:0', ORCA_AGENT_LAUNCH_TOKEN: 't' }
+    })
+
+    const callArgs = mockPtySpawn.mock.calls[0][2] as { env: Record<string, string> }
+    expect(callArgs.env.ORCA_AGENT_PANE).toBe('tab-1:0')
+    expect(callArgs.env.ORCA_AGENT_LAUNCH).toBe('t')
+    expect(callArgs.env.ORCA_PANE_KEY).toBe('tab-1:0')
+  })
+
+  it("drops an alias the relay's own env carries when the spawn claims no identity", async () => {
+    // Why: the relay is itself startable from an Orca pane, so inheriting either name would
+    // attribute this pane's hooks to whichever row started the relay.
+    const previous = {
+      pane: process.env.ORCA_PANE_KEY,
+      launch: process.env.ORCA_AGENT_LAUNCH_TOKEN,
+      paneAlias: process.env.ORCA_AGENT_PANE
+    }
+    process.env.ORCA_PANE_KEY = 'relays-own-pane'
+    process.env.ORCA_AGENT_LAUNCH_TOKEN = 'relays-own-launch'
+    process.env.ORCA_AGENT_PANE = 'stale-alias'
+    try {
+      await dispatcher.callRequest('pty.spawn', { cols: 80, rows: 24 })
+    } finally {
+      for (const [key, value] of [
+        ['ORCA_PANE_KEY', previous.pane],
+        ['ORCA_AGENT_LAUNCH_TOKEN', previous.launch],
+        ['ORCA_AGENT_PANE', previous.paneAlias]
+      ] as const) {
+        if (value === undefined) {
+          delete process.env[key]
+        } else {
+          process.env[key] = value
+        }
+      }
+    }
+
+    const callArgs = mockPtySpawn.mock.calls[0][2] as { env: Record<string, string> }
+    expect(callArgs.env.ORCA_PANE_KEY).toBeUndefined()
+    expect(callArgs.env.ORCA_AGENT_PANE).toBeUndefined()
+    expect(callArgs.env.ORCA_AGENT_LAUNCH).toBeUndefined()
+  })
+
   it('passes PTY and explicit launch identity to env augmenters', async () => {
     const seenContexts: {
       id: string
diff --git a/src/relay/pty-handler.ts b/src/relay/pty-handler.ts
index 2daa4311234f..6f17479784fa 100644
--- a/src/relay/pty-handler.ts
+++ b/src/relay/pty-handler.ts
@@ -1,3 +1,4 @@
+import { FreebuffStatusProjection } from './freebuff-status-projection'
 /* oxlint-disable max-lines */
 import type { IPty } from 'node-pty'
 import { killWithDescendantSweep } from '../main/pty-descendant-termination'
@@ -18,6 +19,7 @@ import {
 import { inspectPtyChildProcesses, processHasChildren } from './pty-child-process-inspection'
 import { getRelayShellLaunchConfig, isRelayWslShell } from './pty-shell-launch'
 import { RetiredPaneSurfaceRegistry } from './retired-pane-surfaces'
+import { applyScrubSafeAgentEnvAliases } from '../shared/agent-hook-scrub-safe-env'
 import { addWslEnvKeys } from '../shared/wsl-env'
 import {
   ORCA_IMAGE_PROTOCOL_ENV,
@@ -76,6 +78,8 @@ import {
 } from '../shared/pty-startup-ingress'
 import { resolvePtyOwnerBackend, type PtyOwnerBackend } from '../shared/pty-owner-backend'
 import { RecentPtyOutputBuffer } from '../main/runtime/recent-pty-output-buffer'
+import { TerminalShellRecoveryBarrier } from '../main/daemon/terminal-shell-recovery-barrier'
+import { confirmPtyShellForeground } from '../main/daemon/pty-subprocess/pty-shell-foreground-confirmation'
 import {
   resolveAgentForegroundProcessesBatch,
   resolveRemoteForegroundEvidence,
@@ -202,6 +206,7 @@ function parseSourceRecoveryRequest(value: unknown): PtySourceRecoveryRequest |
 }
 
 type ManagedPty = {
+  freebuffStatus?: FreebuffStatusProjection
   id: string
   incarnationId: string
   pty: IPty
@@ -246,6 +251,7 @@ type ManagedPty = {
   forceKillSent?: boolean
   gracefulKillSent?: boolean
   startupIngress?: PtyStartupIngress
+  recoveryBarrier?: TerminalShellRecoveryBarrier
   startupIngressIntent?: ReturnType<typeof parsePtyStartupIngressIntent>
   ownerBackend: PtyOwnerBackend
   agentSessionOwners?: AgentSessionOwnerBinding[]
@@ -850,6 +856,22 @@ export class PtyHandler {
     if (!result.TERM) {
       result.TERM = 'xterm-256color'
     }
+    // Why: the relay's own process env can carry pane identity (it is itself startable from
+    // an Orca pane), and unlike the local and daemon builders this one never dropped it. A
+    // spawn that specified no identity would then inherit someone else's, and every agent's
+    // hook would report against that pane. Drop it before mirroring, so an alias can only
+    // ever carry identity this spawn actually asked for.
+    for (const key of ['ORCA_PANE_KEY', 'ORCA_AGENT_LAUNCH_TOKEN'] as const) {
+      if (!rendererEnv || !Object.hasOwn(rendererEnv, key)) {
+        delete result[key]
+      }
+    }
+    // Why here and not only in the local/daemon builders: a remote pane's env is built HERE,
+    // and the client forwards only the canonical pane-identity names. An agent whose harness
+    // scrubs those names (DSH drops any env var whose name contains KEY or TOKEN) would find
+    // nothing to attribute its hooks to, so remote status would silently never appear even
+    // with the remote hook installed.
+    applyScrubSafeAgentEnvAliases(result)
     // Why last, not beside the scrubbers above: the relay runs those BEFORE envToDelete,
     // so an envToDelete of CONDA_PREFIX would otherwise re-create the broken pair.
     dropIncoherentCondaActivationEnv(result, process.platform)
@@ -951,20 +973,29 @@ export class PtyHandler {
     this.notifyPoolListener(this.ptyPoolActiveListener, 'pty-pool-active')
     const emitIngressData = (emission: PtyIngressEmission): void => {
       const rawLength = emission.rawEndSeq - emission.rawStartSeq
-      this.appendReplayBuffer(managed, emission.data)
+      const data = managed.freebuffStatus?.project(emission.data) ?? emission.data
+      this.appendReplayBuffer(managed, data)
       this.enqueuePtyOutput(
         managed.id,
-        emission.data,
-        emission.transformed || rawLength !== emission.data.length
+        data,
+        emission.transformed || rawLength !== data.length
           ? { rawLength, seq: emission.rawEndSeq, transformed: true }
           : {}
       )
     }
-    managed.startupIngress ??= new PtyStartupIngress({
+    const isDead = (): boolean => managed.disposed === true
+    const recoveryBarrier = new TerminalShellRecoveryBarrier({
+      confirmShellForeground: () =>
+        confirmPtyShellForeground({ process: managed.pty, shellPath: managed.shellPath, isDead }),
+      release: emitIngressData,
+      isAlive: () => !isDead()
+    })
+    managed.recoveryBarrier = recoveryBarrier
+    managed.startupIngress = new PtyStartupIngress({
       ...(managed.startupIngressIntent ? { intent: managed.startupIngressIntent } : {}),
       ownerBackend: managed.ownerBackend,
       write: (data) => managed.pty.write(data),
-      onEmission: emitIngressData
+      onEmission: (emission) => recoveryBarrier.accept(emission)
     })
     const startup = managed.startupCommand
     if (startup?.waitForShellReady) {
@@ -1054,6 +1085,11 @@ export class PtyHandler {
       managed.startupCommand = undefined
     }
     managed.startupIngress?.drainAndClose()
+    // Why after drainAndClose: drained ingress bytes re-enter the barrier; a
+    // teardown mid-proof must still deliver the held prompt before exit.
+    managed.recoveryBarrier?.flushPending()
+    managed.recoveryBarrier?.dispose()
+    managed.freebuffStatus?.dispose()
   }
 
   private notifyExitListener(managed: ManagedPty): void {
@@ -1979,6 +2015,9 @@ export class PtyHandler {
     const ownerClientInstanceId =
       context === undefined ? null : (this.consumerIdentityResolver?.(context.clientId) ?? null)
     const managed: ManagedPty = {
+      ...(launchAgent === 'freebuff'
+        ? { freebuffStatus: new FreebuffStatusProjection(cols, rows) }
+        : {}),
       id,
       incarnationId: randomUUID(),
       pty: term,
@@ -2225,6 +2264,7 @@ export class PtyHandler {
     // npm, where the patch is not applied. So the catch below stays.
     try {
       managed.pty.resize(cols, rows)
+      managed.freebuffStatus?.resize(cols, rows)
     } catch (err) {
       // A failed ioctl observed the handle, not the host's process table, so on
       // its own it is `unverifiable`. Re-probe: a now-absent pid retires the
diff --git a/src/relay/pty-shell-overlay-wrappers.ts b/src/relay/pty-shell-overlay-wrappers.ts
index 376d422f073e..2231fc2b29b9 100644
--- a/src/relay/pty-shell-overlay-wrappers.ts
+++ b/src/relay/pty-shell-overlay-wrappers.ts
@@ -32,6 +32,7 @@ function getRelayZshWrapperSpec(): ZshStartupHookSpec {
     overlayRestoreComment:
       '# Why: remote startup files can re-export user defaults after relay spawn.',
     restores: {
+      managedWslCli: false,
       agentTeamsPath: false,
       remoteCliBinDir: true,
       codexHome: false,
diff --git a/src/relay/relay-agent-hook-runtime.ts b/src/relay/relay-agent-hook-runtime.ts
index 7ab4bf01162d..bc1cef971370 100644
--- a/src/relay/relay-agent-hook-runtime.ts
+++ b/src/relay/relay-agent-hook-runtime.ts
@@ -19,8 +19,9 @@ import {
   isPiCompatibleAgentType
 } from '../shared/pi-agent-kind'
 import { resolveSetupAgentSequenceLaunchCommand } from '../shared/setup-agent-sequencing'
-import { isOpenCode2LaunchCommand } from '../shared/opencode-launch-command'
+import { selectOpenCodeHookAgent } from '../shared/opencode-launch-command'
 import { relayLogLine } from './relay-diagnostic-log'
+import { restoreOrStripOverlayEnv } from '../shared/agent-overlay-env'
 import { registerManagedHookInstaller } from './managed-hook-installer'
 
 export class RelayAgentHookRuntime {
@@ -85,12 +86,22 @@ export class RelayAgentHookRuntime {
     const env: Record<string, string> = {}
     const overlayId = context.paneKey ?? context.id
     const launchCommandHint = resolveSetupAgentSequenceLaunchCommand(context.env, context.command)
-    const opencodeAgent =
-      context.launchAgent === 'opencode2' || isOpenCode2LaunchCommand(launchCommandHint)
-        ? 'opencode2'
-        : 'opencode'
-    env.ORCA_OPENCODE_AGENT = opencodeAgent
-    if (this.pluginOverlay.hasOpenCodeSource(opencodeAgent)) {
+    const opencodeAgent = selectOpenCodeHookAgent(context.launchAgent, launchCommandHint, (agent) =>
+      this.pluginOverlay.hasOpenCodeSource(agent)
+    )
+    restoreOrStripOverlayEnv(
+      context.env,
+      {
+        primary: 'OPENCODE_CONFIG_DIR',
+        overlay: 'ORCA_OPENCODE_CONFIG_DIR',
+        source: 'ORCA_OPENCODE_SOURCE_CONFIG_DIR',
+        preserveExplicitPrimary: true
+      },
+      {}
+    )
+    delete context.env.ORCA_OPENCODE_AGENT
+    if (opencodeAgent) {
+      env.ORCA_OPENCODE_AGENT = opencodeAgent
       const sourceDir = resolveOpenCodeSourceConfigDir(context.env, context.shell)
       const inheritedRelayOverlay = sourceDir
         ? this.pluginOverlay.isRelayOverlayPath(sourceDir)
diff --git a/src/relay/relay-watch-root-capacity-gate.ts b/src/relay/relay-watch-root-capacity-gate.ts
index 4e430332be22..c275e3035077 100644
--- a/src/relay/relay-watch-root-capacity-gate.ts
+++ b/src/relay/relay-watch-root-capacity-gate.ts
@@ -63,11 +63,19 @@ export class RelayWatchRootCapacityGate {
     this.waiting.add(rootKey)
     // Once, and never past the caller: a genuinely full cap must still reach the refusal that sends
     // the client dormant, and an unsubscribe that never settles must not park the request with it.
-    return (signal ? Promise.race([released, abortSignalSettled(signal)]) : released).finally(
-      () => {
-        this.waiting.delete(rootKey)
+    let onAbort = (): void => {}
+    const abandoned = new Promise<void>((resolve) => {
+      onAbort = () => resolve()
+      if (signal?.aborted) {
+        resolve()
+      } else {
+        signal?.addEventListener('abort', onAbort, { once: true })
       }
-    )
+    })
+    return (signal ? Promise.race([released, abandoned]) : released).finally(() => {
+      signal?.removeEventListener('abort', onAbort)
+      this.waiting.delete(rootKey)
+    })
   }
 
   /** Setup roots that currently hold a slot — a parked capacity waiter holds none. */
@@ -75,12 +83,3 @@ export class RelayWatchRootCapacityGate {
     return [...this.setupRoots.keys()].filter((key) => key === rootKey || !this.waiting.has(key))
   }
 }
-
-/** Resolves (never rejects) when the request is abandoned, so a race can drop out of a wait. */
-function abortSignalSettled(signal: AbortSignal): Promise<void> {
-  return signal.aborted
-    ? Promise.resolve()
-    : new Promise<void>((resolve) =>
-        signal.addEventListener('abort', () => resolve(), { once: true })
-      )
-}
diff --git a/src/relay/relay-watch-root-capacity.test.ts b/src/relay/relay-watch-root-capacity.test.ts
index de5a5fc2b4b0..12f70234c1d0 100644
--- a/src/relay/relay-watch-root-capacity.test.ts
+++ b/src/relay/relay-watch-root-capacity.test.ts
@@ -8,6 +8,7 @@ import type { RelayDispatcher } from './dispatcher'
 import { FsHandler } from './fs-handler'
 import { subscribeWithInProcessWatcher } from '../main/ipc/parcel-watcher-in-process-fallback'
 import { createMockDispatcher } from './relay-fs-test-dispatcher'
+import { RelayWatchRootCapacityGate } from './relay-watch-root-capacity-gate'
 
 const { mockSubscribe } = vi.hoisted(() => ({
   mockSubscribe: vi.fn()
@@ -39,6 +40,50 @@ describe('relay watch-root capacity', () => {
     await fs.rm(tmpDir, { recursive: true, force: true })
   })
 
+  it('removes an abort listener after capacity teardown settles', async () => {
+    const activeRoots = new Map(Array.from({ length: 20 }, (_, index) => [`active-${index}`, {}]))
+    let resolveTeardown!: () => void
+    const teardown = new Promise<void>((resolve) => {
+      resolveTeardown = resolve
+    })
+    const gate = new RelayWatchRootCapacityGate(activeRoots, new Map(), () => ({
+      rootPaths: () => ['retiring'],
+      settlePending: () => teardown
+    }))
+    const controller = new AbortController()
+    const addListener = vi.spyOn(controller.signal, 'addEventListener')
+    const removeListener = vi.spyOn(controller.signal, 'removeEventListener')
+
+    const waiting = gate.release('new-root', controller.signal)
+    expect(waiting).toBeDefined()
+    expect(addListener).toHaveBeenCalledTimes(1)
+    resolveTeardown()
+    await waiting
+
+    expect(removeListener).toHaveBeenCalledTimes(1)
+  })
+
+  it.each([false, true])(
+    'resolves abandoned capacity waits (already aborted=%s)',
+    async (alreadyAborted) => {
+      const activeRoots = new Map(Array.from({ length: 20 }, (_, index) => [`active-${index}`, {}]))
+      const gate = new RelayWatchRootCapacityGate(activeRoots, new Map(), () => ({
+        rootPaths: () => ['retiring'],
+        settlePending: () => new Promise<void>(() => {})
+      }))
+      const controller = new AbortController()
+      if (alreadyAborted) {
+        controller.abort()
+      }
+      const removeListener = vi.spyOn(controller.signal, 'removeEventListener')
+      const waiting = gate.release('new-root', controller.signal)
+      expect(waiting).toBeDefined()
+      controller.abort()
+      await expect(waiting).resolves.toBeUndefined()
+      expect(removeListener).toHaveBeenCalledTimes(1)
+    }
+  )
+
   it('blocks replacement watches behind physical unsubscribe and counts the pending slot', async () => {
     let resolveUnsubscribe: () => void = () => {}
     const unsubscribe = vi.fn(
diff --git a/src/renderer/src/app-shell/use-app-session-persistence.ts b/src/renderer/src/app-shell/use-app-session-persistence.ts
index e187ecb19d5c..4d1e9987a091 100644
--- a/src/renderer/src/app-shell/use-app-session-persistence.ts
+++ b/src/renderer/src/app-shell/use-app-session-persistence.ts
@@ -4,6 +4,7 @@ import {
   isDirectSshRemoteWorkspaceApplyInProgress,
   onDirectSshRemoteWorkspaceApplyWindowClosed
 } from '../hooks/remote-workspace-snapshot-apply'
+import { terminalLayoutNodeEqual } from '../lib/terminal-layout-equality'
 import { createSessionWriteSubscriber } from '../lib/session-write-subscriber'
 import { buildActiveViewUnloadPatch } from '../lib/active-view-persist'
 import {
@@ -37,6 +38,8 @@ import {
   ORCA_RENDERER_UNLOAD_PREVENTED_EVENT
 } from '../../../shared/renderer-shutdown-events'
 import type { AppState } from '../store/types'
+import type { DirectSshLayoutEdit } from '../store/terminals/terminal-state'
+import type { RemoteWorkspaceObservedPatchResult } from '../../../shared/remote-workspace-types'
 import { applyRemoteWorkspacePushStatus } from '../hooks/remote-workspace-push-status'
 
 // Why: bound the resume-record loss window on a hard kill to ~1 min; capture skips unchanged records so per-tick cost is negligible.
@@ -89,6 +92,26 @@ function remoteWorkspaceUploadAuthorityIsCurrent(
   )
 }
 
+function captureUploadedDirectSshLayoutEdits(
+  pendingLayoutEdits: AppState['pendingDirectSshLayoutEditsByTabId'],
+  targetId: string,
+  result: RemoteWorkspaceObservedPatchResult | undefined
+): Record<string, DirectSshLayoutEdit> {
+  if (!result?.ok) {
+    return {}
+  }
+  return Object.fromEntries(
+    Object.entries(pendingLayoutEdits).flatMap(([tabId, entry]) => {
+      const uploaded = result.snapshot.session.terminalLayoutsByTabId[tabId]
+      return entry.targetId === targetId &&
+        uploaded &&
+        terminalLayoutNodeEqual(entry.root, uploaded.root)
+        ? [[tabId, entry]]
+        : []
+    })
+  )
+}
+
 /**
  * Writes durable renderer session state to disk: the debounced per-host writer, the remote
  * workspace upload chain, and the synchronous shutdown checkpoint.
@@ -108,6 +131,7 @@ export function useAppSessionPersistence(): void {
         const localWrite = patchWorkspaceSessionByHost(window.api.session, patch, state)
         void localWrite
         const uploadAuthorities = captureRemoteWorkspaceUploadAuthorities(state)
+        const pendingLayoutEdits = state.pendingDirectSshLayoutEditsByTabId
         if (uploadAuthorities.length > 0) {
           void (async () => {
             try {
@@ -141,6 +165,11 @@ export function useAppSessionPersistence(): void {
               for (const { targetId, result } of results ?? []) {
                 const authority = currentAuthorityByTargetId.get(targetId)
                 if (authority && remoteWorkspaceUploadAuthorityIsCurrent(resultState, authority)) {
+                  if (result?.ok) {
+                    resultState.acknowledgeDirectSshLayoutEdits(
+                      captureUploadedDirectSshLayoutEdits(pendingLayoutEdits, targetId, result)
+                    )
+                  }
                   applyRemoteWorkspacePushStatus(resultState, targetId, result, authority)
                 }
               }
diff --git a/src/renderer/src/app-shell/use-floating-workspace-panel.ts b/src/renderer/src/app-shell/use-floating-workspace-panel.ts
index 49daaec55d80..7cd3763e4010 100644
--- a/src/renderer/src/app-shell/use-floating-workspace-panel.ts
+++ b/src/renderer/src/app-shell/use-floating-workspace-panel.ts
@@ -1,4 +1,11 @@
-import { useCallback, useEffect, useRef, useState, type SetStateAction } from 'react'
+import {
+  useCallback,
+  useEffect,
+  useLayoutEffect,
+  useRef,
+  useState,
+  type SetStateAction
+} from 'react'
 import {
   TOGGLE_FLOATING_TERMINAL_EVENT,
   requestFloatingTerminalOpenMaximized
@@ -111,7 +118,8 @@ export function useFloatingWorkspacePanel() {
     setOpenWithFocus(true)
   }, [setOpenWithFocus])
 
-  useEffect(() => {
+  // Why layout: enable-then-toggle callers dispatch a frame later, which a passive rebind can miss.
+  useLayoutEffect(() => {
     const toggleFloatingTerminal = (): void => {
       if (enabled) {
         setOpenWithFocus((current) => !current)
diff --git a/src/renderer/src/app-shell/use-onboarding-and-feature-tips.ts b/src/renderer/src/app-shell/use-onboarding-and-feature-tips.ts
index dc689fe15651..a170bcce16f7 100644
--- a/src/renderer/src/app-shell/use-onboarding-and-feature-tips.ts
+++ b/src/renderer/src/app-shell/use-onboarding-and-feature-tips.ts
@@ -11,6 +11,7 @@ import {
   trackOrcaCliFeatureTipShown
 } from '../components/feature-tips/feature-tip-telemetry'
 import { useAppStore } from '../store'
+import { isWebClientLocation } from '../lib/web-client-location'
 import type { OnboardingState } from '../../../shared/onboarding-state-types'
 
 export type OnboardingGate = ReturnType<typeof useOnboardingAndFeatureTips>
@@ -99,7 +100,8 @@ export function useOnboardingAndFeatureTips() {
       persistedUIReady,
       promptedThisSession: promptedThisSessionRef.current,
       settings,
-      suppressedByOnboardingThisSession: suppressedByOnboardingThisSessionRef.current
+      suppressedByOnboardingThisSession: suppressedByOnboardingThisSessionRef.current,
+      webClient: isWebClientLocation()
     })
 
     if (featureTipsDecision.kind === 'suppress-for-onboarding') {
@@ -120,7 +122,10 @@ export function useOnboardingAndFeatureTips() {
     }
     // Why: mark seen on show so a quit/crash before dismiss doesn't reappear it next launch.
     actions.markFeatureTipsSeen([featureTipsDecision.tipId])
-    actions.openModal('feature-tips', { source: 'app_open', tipId: featureTipsDecision.tipId })
+    actions.openModal('feature-tips', {
+      source: 'app_open',
+      tipId: featureTipsDecision.tipId
+    })
   }, [
     activeModal,
     actions,
diff --git a/src/renderer/src/assets/diff-comment-draft-card-shadow-style.test.ts b/src/renderer/src/assets/diff-comment-draft-card-shadow-style.test.ts
new file mode 100644
index 000000000000..3a28acf95c6f
--- /dev/null
+++ b/src/renderer/src/assets/diff-comment-draft-card-shadow-style.test.ts
@@ -0,0 +1,39 @@
+import fs from 'node:fs'
+import { describe, expect, it } from 'vitest'
+
+const mainCss = fs.readFileSync(new URL('./main.css', import.meta.url), 'utf8')
+
+function getCssRuleBody(selector: string): string {
+  const ruleMarker = mainCss.indexOf(`\n${selector} {`)
+  expect(ruleMarker).toBeGreaterThanOrEqual(0)
+
+  const ruleStart = ruleMarker + 1
+  const bodyStart = mainCss.indexOf('{', ruleStart) + 1
+  const bodyEnd = mainCss.indexOf('}', bodyStart)
+  return mainCss.slice(bodyStart, bodyEnd)
+}
+
+describe('diff comment draft card shadow', () => {
+  it('uses the documented shadow-xs tier instead of a hand-rolled fourth tier', () => {
+    const draftCard = getCssRuleBody('.orca-diff-comment-inline > .orca-diff-comment-draft-card')
+
+    // STYLEGUIDE.md caps elevation at border / shadow-xs / shadow-floating —
+    // no invented per-component shadow values.
+    expect(draftCard).toContain('shadow-xs')
+    expect(draftCard).not.toMatch(/box-shadow:\s*\n?\s*0/)
+    expect(draftCard).not.toContain('rgba(0, 0, 0,')
+  })
+
+  it('keeps the dark override at shadow-xs, not a hand-rolled or missing shadow', () => {
+    const darkDraftCard = getCssRuleBody(
+      '.dark .orca-diff-comment-inline > .orca-diff-comment-draft-card'
+    )
+
+    // Same selector specificity as `.dark .orca-diff-comment-popover` (its
+    // ancestor via the shared draft-card component), which sits later in the
+    // file — dropping this rule lets that popover's much larger floating
+    // shadow win the cascade in dark mode instead of shadow-xs.
+    expect(darkDraftCard).toContain('shadow-xs')
+    expect(darkDraftCard).not.toContain('rgba(0, 0, 0,')
+  })
+})
diff --git a/src/renderer/src/assets/main.css b/src/renderer/src/assets/main.css
index e0d1791606b5..05ffc6607320 100644
--- a/src/renderer/src/assets/main.css
+++ b/src/renderer/src/assets/main.css
@@ -412,6 +412,11 @@
   z-index: 40 !important;
 }
 
+/* Keep errors above standard modal backdrops at the existing popover tier. */
+body:has([data-slot='dialog-overlay'], [data-slot='sheet-overlay']) [data-sonner-toaster] {
+  z-index: 60 !important;
+}
+
 [data-sonner-toaster] [data-sonner-toast][data-styled='true'] {
   align-items: flex-start;
   flex-wrap: wrap;
@@ -719,7 +724,9 @@
   mask-image: linear-gradient(to right, transparent, #000 1.5rem, #000 100%);
 }
 
-.terminal-tab-strip--fade-end:not(.terminal-tab-strip--fade-start) {
+/* Why: the status bar's usage cluster reuses the end fade so a clipped cluster never cuts a glyph. */
+.terminal-tab-strip--fade-end:not(.terminal-tab-strip--fade-start),
+.status-bar-usage-cluster[data-overflowing='true'] {
   -webkit-mask-image: linear-gradient(to right, #000 0, #000 calc(100% - 1.5rem), transparent);
   mask-image: linear-gradient(to right, #000 0, #000 calc(100% - 1.5rem), transparent);
 }
@@ -2858,6 +2865,39 @@ html.native-shell .app-layout {
   max-width: 420px;
 }
 
+/* Why: embedded card in the diff flow, not a floating popup — use the
+   documented "subtle lift" tier (shadow-xs) rather than a hand-rolled shadow.
+   Restated under `.dark` (same value) so this still outranks the base
+   `.orca-diff-comment-popover` dark shadow at equal selector specificity. */
+.orca-diff-comment-inline > .orca-diff-comment-draft-card {
+  position: relative;
+  left: auto;
+  right: auto;
+  width: 100%;
+  max-width: 420px;
+  z-index: 1;
+  @apply shadow-xs;
+}
+
+.dark .orca-diff-comment-inline > .orca-diff-comment-draft-card {
+  @apply shadow-xs;
+}
+
+.orca-diff-comment-draft-margin {
+  width: 100%;
+  height: 100%;
+  display: flex;
+  justify-content: flex-end;
+}
+
+.orca-diff-comment-draft-margin::after {
+  content: '';
+  width: 3px;
+  height: 100%;
+  background: var(--primary);
+  border-radius: 1px;
+}
+
 /* Why: the saved note used to blend into the editor background because it
    reused the same muted/background mix the editor itself uses. Stay
    grayscale to match the rest of the UI, but lift the card off the editor
diff --git a/src/renderer/src/components/TerminalLegacyTerminalPanes.tsx b/src/renderer/src/components/TerminalLegacyTerminalPanes.tsx
index f095b77e0e17..b054a05b7172 100644
--- a/src/renderer/src/components/TerminalLegacyTerminalPanes.tsx
+++ b/src/renderer/src/components/TerminalLegacyTerminalPanes.tsx
@@ -1,5 +1,6 @@
 import { createPortal } from 'react-dom'
 import TerminalPane from './terminal-pane/TerminalPane'
+import { TerminalRestoringPlaceholder } from './terminal-pane/TerminalRestoringPlaceholder'
 import { findActivityTerminalPortal } from './activity/activity-terminal-portal'
 import { shouldMountBackgroundWorktreeTab } from './terminal/background-terminal-worktree-mount'
 import type { TerminalController } from './use-terminal-controller'
@@ -59,51 +60,54 @@ export function TerminalLegacyTerminalPanes({
               }
               aria-hidden={!isVisible}
             >
-              {(tabsByWorktree[workspace.id] ?? [])
-                .filter((tab) =>
-                  shouldMountBackgroundWorktreeTab(
+              {(tabsByWorktree[workspace.id] ?? []).map((tab) => {
+                const isActiveTerminalTab =
+                  isVisible && tab.id === activeTabId && activeTabType === 'terminal'
+                if (
+                  !shouldMountBackgroundWorktreeTab(
                     backgroundMountTabIdsByWorktreeRef.current.get(workspace.id) ?? null,
                     tab.id
                   )
+                ) {
+                  // Why only the startup hold lands here visible: reveal admits every other
+                  // visible deferred tab in the same render pass.
+                  return isActiveTerminalTab ? <TerminalRestoringPlaceholder key={tab.id} /> : null
+                }
+                const activityTerminalPortal = findActivityTerminalPortal(activityTerminalPortals, {
+                  worktreeId: workspace.id,
+                  tabId: tab.id
+                })
+                const isActivityPortalTab = activityTerminalPortal !== null
+                if (
+                  shouldColdParkTerminalPanes &&
+                  !isActivityPortalTab &&
+                  !evictionExemptTerminalTabIds.has(tab.id)
+                ) {
+                  return null
+                }
+                const terminalPane = (
+                  <TerminalPane
+                    key={`${tab.id}-${tab.generation ?? 0}`}
+                    tabId={tab.id}
+                    worktreeId={workspace.id}
+                    cwd={tab.startupCwd ?? workspace.path}
+                    isActive={isActiveTerminalTab || activityTerminalPortal?.active === true}
+                    isVisible={isActiveTerminalTab || isActivityPortalTab}
+                    isWorktreeActive={isVisible || isActivityPortalTab}
+                    isolatedPaneKey={activityTerminalPortal?.paneKey ?? null}
+                    onPtyExit={(ptyId, exitCode) => handlePtyExit(tab.id, ptyId, exitCode)}
+                    onCloseTab={() => handleCloseTab(tab.id)}
+                  />
                 )
-                .map((tab) => {
-                  const activityTerminalPortal = findActivityTerminalPortal(
-                    activityTerminalPortals,
-                    { worktreeId: workspace.id, tabId: tab.id }
+                if (activityTerminalPortal) {
+                  return createPortal(
+                    terminalPane,
+                    activityTerminalPortal.target,
+                    `activity-terminal-${tab.id}`
                   )
-                  const isActivityPortalTab = activityTerminalPortal !== null
-                  const isActiveTerminalTab =
-                    isVisible && tab.id === activeTabId && activeTabType === 'terminal'
-                  if (
-                    shouldColdParkTerminalPanes &&
-                    !isActivityPortalTab &&
-                    !evictionExemptTerminalTabIds.has(tab.id)
-                  ) {
-                    return null
-                  }
-                  const terminalPane = (
-                    <TerminalPane
-                      key={`${tab.id}-${tab.generation ?? 0}`}
-                      tabId={tab.id}
-                      worktreeId={workspace.id}
-                      cwd={tab.startupCwd ?? workspace.path}
-                      isActive={isActiveTerminalTab || activityTerminalPortal?.active === true}
-                      isVisible={isActiveTerminalTab || isActivityPortalTab}
-                      isWorktreeActive={isVisible || isActivityPortalTab}
-                      isolatedPaneKey={activityTerminalPortal?.paneKey ?? null}
-                      onPtyExit={(ptyId, exitCode) => handlePtyExit(tab.id, ptyId, exitCode)}
-                      onCloseTab={() => handleCloseTab(tab.id)}
-                    />
-                  )
-                  if (activityTerminalPortal) {
-                    return createPortal(
-                      terminalPane,
-                      activityTerminalPortal.target,
-                      `activity-terminal-${tab.id}`
-                    )
-                  }
-                  return terminalPane
-                })}
+                }
+                return terminalPane
+              })}
             </div>
           )
         })}
diff --git a/src/renderer/src/components/TerminalSplitWorkspaceSurfaces.tsx b/src/renderer/src/components/TerminalSplitWorkspaceSurfaces.tsx
index 5c3145360f65..cfe381ccce9f 100644
--- a/src/renderer/src/components/TerminalSplitWorkspaceSurfaces.tsx
+++ b/src/renderer/src/components/TerminalSplitWorkspaceSurfaces.tsx
@@ -1,5 +1,6 @@
 import { useAnyBrowserGuestNeedsPaint } from './browser-pane/host-guest/browser-guest-paint-retention'
 import { WorktreeSplitSurface } from './TerminalWorktreeSplitSurface'
+import { selectParkedEquivalentMountTabIds } from './terminal/startup-terminal-tab-hold'
 import type { TerminalController } from './use-terminal-controller'
 
 export function TerminalSplitWorkspaceSurfaces({
@@ -21,6 +22,7 @@ export function TerminalSplitWorkspaceSurfaces({
     measurableBackgroundWorktreeIdsRef,
     mountedWorktreeIdsRef,
     renderedActiveWorktreeId,
+    startupTerminalTabHold,
     workspaceSurfaces
   } = controller
   // Why: this and TerminalSurface are both strict ancestors of every browser <webview>, so a
@@ -69,9 +71,11 @@ export function TerminalSplitWorkspaceSurfaces({
               backgroundMountTabIds={
                 backgroundMountTabIdsByWorktreeRef.current.get(workspace.id) ?? null
               }
-              activationDeferredMountTabIds={
-                activationDeferredMountTabIdsByWorktreeRef.current.get(workspace.id) ?? null
-              }
+              activationDeferredMountTabIds={selectParkedEquivalentMountTabIds(
+                activationDeferredMountTabIdsByWorktreeRef.current.get(workspace.id),
+                startupTerminalTabHold,
+                workspace.id
+              )}
             />
           )
         })}
diff --git a/src/renderer/src/components/activity/activity-clear-completed.test.ts b/src/renderer/src/components/activity/activity-clear-completed.test.ts
index e0cee5aa9d89..79191ce32520 100644
--- a/src/renderer/src/components/activity/activity-clear-completed.test.ts
+++ b/src/renderer/src/components/activity/activity-clear-completed.test.ts
@@ -61,6 +61,7 @@ import {
   isClearableActivityThread,
   planClearCompletedActivity
 } from './activity-clear-completed'
+import { activityThreadStatusId } from './activity-thread-presentation'
 
 function makeThread(paneKey: string, overrides: Partial<AgentPaneThread> = {}): AgentPaneThread {
   return {
@@ -81,7 +82,7 @@ function makeThread(paneKey: string, overrides: Partial<AgentPaneThread> = {}):
   }
 }
 
-function doneEvent(interrupted: boolean): ActivityEvent {
+function doneEvent(interrupted: boolean, outcome?: 'failure'): ActivityEvent {
   return {
     id: 'evt',
     state: 'done',
@@ -89,7 +90,16 @@ function doneEvent(interrupted: boolean): ActivityEvent {
     observedAt: 5_000,
     worktree: makeWorktree(),
     repo: null,
-    entry: { interrupted } as ActivityEvent['entry'],
+    entry: {
+      paneKey: 'evt-pane',
+      state: 'done',
+      prompt: '',
+      updatedAt: 5_000,
+      stateStartedAt: 5_000,
+      stateHistory: [],
+      interrupted,
+      ...(outcome ? { mainAgent: { state: 'done', outcome, stateStartedAt: 5_000 } } : {})
+    },
     tab: makeTab(),
     agentType: 'claude',
     agentAlive: false,
@@ -102,6 +112,7 @@ const blockedThread = makeThread('t-blocked:1', { currentAgentState: 'blocked' }
 const waitingThread = makeThread('t-waiting:1', { currentAgentState: 'waiting' })
 const doneThread = makeThread('t-done:1', { latestEvent: doneEvent(false) })
 const interruptedThread = makeThread('t-interrupted:1', { latestEvent: doneEvent(true) })
+const failedThread = makeThread('t-failed:1', { latestEvent: doneEvent(false, 'failure') })
 
 function makeRetained(paneKey: string): RetainedAgentEntry {
   return {
@@ -125,10 +136,34 @@ describe('isClearableActivityThread', () => {
   it('clears only completed and interrupted threads', () => {
     expect(isClearableActivityThread(doneThread)).toBe(true)
     expect(isClearableActivityThread(interruptedThread)).toBe(true)
+    expect(activityThreadStatusId(failedThread)).toBe('failed')
+    expect(isClearableActivityThread(failedThread)).toBe(true)
     expect(isClearableActivityThread(workingThread)).toBe(false)
     expect(isClearableActivityThread(blockedThread)).toBe(false)
     expect(isClearableActivityThread(waitingThread)).toBe(false)
   })
+
+  it('reads a live thread whose main agent failed as failed, but keeps it while subagents run', () => {
+    const heldEntry = {
+      ...doneEvent(false).entry,
+      state: 'working' as const,
+      mainAgent: { state: 'done' as const, outcome: 'failure' as const, stateStartedAt: 5_000 }
+    }
+    const held = makeThread('t-held:1', {
+      currentAgentState: 'working',
+      currentAgentEntry: heldEntry
+    })
+    expect(activityThreadStatusId(held)).toBe('failed')
+    expect(isClearableActivityThread(held)).toBe(false)
+    const succeeded = makeThread('t-ok:1', {
+      currentAgentState: 'working',
+      currentAgentEntry: {
+        ...heldEntry,
+        mainAgent: { state: 'done', outcome: 'success', stateStartedAt: 5_000 }
+      }
+    })
+    expect(activityThreadStatusId(succeeded)).toBe('working')
+  })
 })
 
 describe('clearCompletedActivity', () => {
diff --git a/src/renderer/src/components/activity/activity-clear-completed.ts b/src/renderer/src/components/activity/activity-clear-completed.ts
index 2bb39fdff430..e365152c9bbe 100644
--- a/src/renderer/src/components/activity/activity-clear-completed.ts
+++ b/src/renderer/src/components/activity/activity-clear-completed.ts
@@ -18,11 +18,15 @@ export type ClearCompletedActivityPlan = {
   clearedThreadCount: number
 }
 
-/** A thread is clearable when it needs nothing from the user: completed or interrupted,
+/** A thread is clearable when it needs nothing from the user: completed, failed or interrupted,
  *  with no fresh live working/monitoring/blocked/waiting state. */
 export function isClearableActivityThread(thread: AgentPaneThread): boolean {
   const id = activityThreadStatusId(thread)
-  return id === 'done' || id === 'interrupted'
+  // Why: a failed main agent reads failed while its subagents still run; that thread is still live.
+  if (thread.currentAgentState) {
+    return false
+  }
+  return id === 'done' || id === 'failed' || id === 'interrupted'
 }
 
 export function planClearCompletedActivity(
diff --git a/src/renderer/src/components/activity/activity-pane-events.ts b/src/renderer/src/components/activity/activity-pane-events.ts
index 6a147beac816..0ee287af1878 100644
--- a/src/renderer/src/components/activity/activity-pane-events.ts
+++ b/src/renderer/src/components/activity/activity-pane-events.ts
@@ -27,7 +27,9 @@ function historyEntrySnapshot(
     toolName: undefined,
     toolInput: undefined,
     lastAssistantMessage: undefined,
-    interrupted: history.interrupted
+    interrupted: history.interrupted,
+    // The live row's main agent belongs to its current state, not to this snapshot.
+    mainAgent: history.mainAgent
   }
 }
 
diff --git a/src/renderer/src/components/activity/activity-thread-actions.test.ts b/src/renderer/src/components/activity/activity-thread-actions.test.ts
index 07f50bce92d8..f9baff7d60dd 100644
--- a/src/renderer/src/components/activity/activity-thread-actions.test.ts
+++ b/src/renderer/src/components/activity/activity-thread-actions.test.ts
@@ -1,4 +1,6 @@
-import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { FLOATING_TERMINAL_WORKTREE_ID } from '../../../../shared/constants'
+import { TOGGLE_FLOATING_TERMINAL_EVENT } from '@/lib/floating-terminal'
 import { makeRepo, makeTab, makeWorktree } from './ActivityPrototypePage-test-fixtures'
 import type { AgentPaneThread } from './activity-thread-types'
 
@@ -6,7 +8,9 @@ const mocks = vi.hoisted(() => ({
   getState: vi.fn(),
   activateTabAndFocusPane: vi.fn(),
   activateStructuredAgentSessionTab: vi.fn(),
-  activateAndRevealWorkspace: vi.fn()
+  activateAndRevealWorkspace: vi.fn(),
+  isFloatingWorkspacePanelVisible: vi.fn(),
+  dispatchEvent: vi.fn()
 }))
 
 vi.mock('@/store', () => ({ useAppStore: { getState: mocks.getState } }))
@@ -19,6 +23,9 @@ vi.mock('@/lib/structured-agent-session-tab-activation', () => ({
 vi.mock('@/lib/worktree-activation', () => ({
   activateAndRevealWorkspace: mocks.activateAndRevealWorkspace
 }))
+vi.mock('@/lib/floating-workspace-terminal-actions', () => ({
+  isFloatingWorkspacePanelVisible: mocks.isFloatingWorkspacePanelVisible
+}))
 
 import { createActivityThreadActions, hasActivityThreadWorkspace } from './activity-thread-actions'
 
@@ -62,6 +69,8 @@ describe('activity thread host routing', () => {
 
   beforeEach(() => {
     vi.clearAllMocks()
+    vi.stubGlobal('window', { dispatchEvent: mocks.dispatchEvent })
+    mocks.isFloatingWorkspacePanelVisible.mockReturnValue(false)
     mocks.activateStructuredAgentSessionTab.mockReturnValue(false)
     mocks.activateAndRevealWorkspace.mockReturnValue({ primaryTabId: null })
     getKnownWorktreeById.mockReturnValue(thread.worktree)
@@ -92,6 +101,76 @@ describe('activity thread host routing', () => {
     mocks.getState.mockImplementation(() => state)
   })
 
+  afterEach(() => vi.unstubAllGlobals())
+
+  function makeFloatingThread(): AgentPaneThread {
+    return {
+      ...thread,
+      worktree: { ...thread.worktree, id: FLOATING_TERMINAL_WORKTREE_ID },
+      repo: null,
+      tab: { ...thread.tab, worktreeId: FLOATING_TERMINAL_WORKTREE_ID }
+    }
+  }
+
+  it.each([false, true])(
+    'reveals the floating agent pane when the panel is open=%s without switching workspace',
+    (open) => {
+      const floatingThread = makeFloatingThread()
+      state.settings = { floatingTerminalEnabled: true }
+      state.tabsByWorktree = { [FLOATING_TERMINAL_WORKTREE_ID]: [floatingThread.tab] }
+      mocks.activateAndRevealWorkspace.mockReturnValue(false)
+      mocks.isFloatingWorkspacePanelVisible.mockReturnValue(open)
+
+      makeActions().selectThread(floatingThread)
+
+      expect(setSelectedPaneKey).toHaveBeenCalledWith(floatingThread.paneKey)
+      expect(mocks.activateAndRevealWorkspace).not.toHaveBeenCalled()
+      expect(setActiveWorktree).not.toHaveBeenCalled()
+      expect(mocks.dispatchEvent).toHaveBeenCalledTimes(open ? 0 : 1)
+      if (!open) {
+        expect(mocks.dispatchEvent).toHaveBeenCalledWith(
+          expect.objectContaining({ type: TOGGLE_FLOATING_TERMINAL_EVENT })
+        )
+      }
+      expect(mocks.activateTabAndFocusPane).toHaveBeenCalledWith(
+        floatingThread.tab.id,
+        '11111111-1111-4111-8111-111111111111',
+        { flashFocusedPane: true, scrollToBottomIfOutputSinceLastView: true }
+      )
+    }
+  )
+
+  it('enables a disabled floating workspace before revealing its agent pane', async () => {
+    const floatingThread = makeFloatingThread()
+    const updateSettings = vi.fn().mockResolvedValue(undefined)
+    const requestAnimationFrame = vi.fn((callback: FrameRequestCallback) => {
+      callback(0)
+      return 1
+    })
+    vi.stubGlobal('requestAnimationFrame', requestAnimationFrame)
+    state.settings = { floatingTerminalEnabled: false }
+    state.updateSettings = updateSettings
+    state.tabsByWorktree = { [FLOATING_TERMINAL_WORKTREE_ID]: [floatingThread.tab] }
+
+    makeActions().selectThread(floatingThread)
+
+    expect(updateSettings).toHaveBeenCalledWith({ floatingTerminalEnabled: true })
+    expect(mocks.dispatchEvent).not.toHaveBeenCalled()
+    expect(mocks.activateTabAndFocusPane).toHaveBeenCalled()
+    await vi.waitFor(() => expect(requestAnimationFrame).toHaveBeenCalledTimes(1))
+    expect(mocks.dispatchEvent).toHaveBeenCalledWith(
+      expect.objectContaining({ type: TOGGLE_FLOATING_TERMINAL_EVENT })
+    )
+  })
+
+  it('does not open the floating panel for a retained thread whose tab was closed', () => {
+    makeActions().selectThread(makeFloatingThread())
+
+    expect(mocks.activateAndRevealWorkspace).not.toHaveBeenCalled()
+    expect(mocks.dispatchEvent).not.toHaveBeenCalled()
+    expect(mocks.activateTabAndFocusPane).not.toHaveBeenCalled()
+  })
+
   it('routes the row click through the full activation sequence for the matching host', () => {
     makeActions().selectThread(thread)
 
diff --git a/src/renderer/src/components/activity/activity-thread-actions.ts b/src/renderer/src/components/activity/activity-thread-actions.ts
index 6e0d167a5a37..c2d99c23fc29 100644
--- a/src/renderer/src/components/activity/activity-thread-actions.ts
+++ b/src/renderer/src/components/activity/activity-thread-actions.ts
@@ -1,8 +1,11 @@
 import { activateTabAndFocusPane } from '@/lib/activate-tab-and-focus-pane'
+import { TOGGLE_FLOATING_TERMINAL_EVENT } from '@/lib/floating-terminal'
+import { isFloatingWorkspacePanelVisible } from '@/lib/floating-workspace-terminal-actions'
 import { activateStructuredAgentSessionTab } from '@/lib/structured-agent-session-tab-activation'
 import { activateAndRevealWorkspace } from '@/lib/worktree-activation'
 import { jumpToWorktreeFromSidebar } from '@/lib/worktree-jump-navigation'
 import { useAppStore } from '@/store'
+import { FLOATING_TERMINAL_WORKTREE_ID } from '../../../../shared/constants'
 import {
   getSettingsFocusedExecutionHostId,
   getWorktreeExecutionHostId,
@@ -45,6 +48,25 @@ export function hasActivityThreadWorkspace(
   )
 }
 
+function toggleFloatingWorkspacePanelIfHidden(): void {
+  if (!isFloatingWorkspacePanelVisible()) {
+    window.dispatchEvent(new Event(TOGGLE_FLOATING_TERMINAL_EVENT))
+  }
+}
+
+// Why enable first: floating tabs outlive a feature disable, and the panel ignores the toggle
+// while disabled, so a live floating agent row would otherwise be a silent no-op.
+function revealFloatingWorkspacePanel(state: AppState): void {
+  if (state.settings?.floatingTerminalEnabled === true) {
+    toggleFloatingWorkspacePanelIfHidden()
+    return
+  }
+  void state.updateSettings({ floatingTerminalEnabled: true }).then(() => {
+    // Why deferred a frame: the panel only honors the toggle once the enabled flag has reached React.
+    requestAnimationFrame(toggleFloatingWorkspacePanelIfHidden)
+  })
+}
+
 export function createActivityThreadActions({
   getMarkAllReadThreads,
   acknowledgeAgents,
@@ -75,6 +97,7 @@ export function createActivityThreadActions({
   }
 
   const activateThreadTarget = (thread: AgentPaneThread): void => {
+    const isFloatingTerminal = thread.worktree.id === FLOATING_TERMINAL_WORKTREE_ID
     const executionHostId = getActivityThreadExecutionHostId(
       thread,
       getSettingsFocusedExecutionHostId(useAppStore.getState().settings)
@@ -84,6 +107,7 @@ export function createActivityThreadActions({
     // resumeSleepingAgentSessionsForWorktree/ensureWorktreeHasInitialTerminal run inside here.
     // Probing tab residency first is what made a remote row click a silent no-op (#16731).
     if (
+      !isFloatingTerminal &&
       activateAndRevealWorkspace(thread.worktree.id, {
         executionHostId,
         revealInSidebar: false,
@@ -105,6 +129,10 @@ export function createActivityThreadActions({
       // no pane to focus and focusing a sibling would be worse than focusing nothing.
       return
     }
+    // Floating tabs have no catalog workspace; reveal their panel without changing the main workspace.
+    if (isFloatingTerminal) {
+      revealFloatingWorkspacePanel(activated)
+    }
     activated.setActiveTabType('terminal', thread.worktree.id)
     const parsed = parsePaneKey(thread.paneKey)
     activateTabAndFocusPane(
diff --git a/src/renderer/src/components/activity/activity-thread-grouping.ts b/src/renderer/src/components/activity/activity-thread-grouping.ts
index cab4fbcf8c34..9bf99cc67cf3 100644
--- a/src/renderer/src/components/activity/activity-thread-grouping.ts
+++ b/src/renderer/src/components/activity/activity-thread-grouping.ts
@@ -21,11 +21,11 @@ const ACTIVITY_STATUS_GROUP_RANK: Record<ActivityThreadStatusId, number> = {
   waiting: 0,
   blocked: 1,
   permission: 2,
-  interrupted: 3,
-  working: 4,
-  monitoring: 5,
-  unverifiable: 6,
-  failed: 7,
+  failed: 3,
+  interrupted: 4,
+  working: 5,
+  monitoring: 6,
+  unverifiable: 7,
   done: 8,
   idle: 9
 }
diff --git a/src/renderer/src/components/activity/activity-thread-presentation.ts b/src/renderer/src/components/activity/activity-thread-presentation.ts
index 5541b3da493a..e38c802f867a 100644
--- a/src/renderer/src/components/activity/activity-thread-presentation.ts
+++ b/src/renderer/src/components/activity/activity-thread-presentation.ts
@@ -2,6 +2,10 @@ import type { AgentDotState } from '@/components/AgentStateDot'
 import { formatAgentTypeLabel } from '@/lib/agent-status'
 import { getAgentRowPrimaryText } from '@/lib/agent-row-primary-text'
 import { showsAgentToolPreview } from '@/lib/agent-row-tool-preview'
+import {
+  agentMainAgentVerdict,
+  agentVerdictDisplayMark
+} from '../../../../shared/agent-main-agent-verdict'
 import {
   getActivityThreadTaskTitle,
   getActivityThreadWorkspaceTitle,
@@ -68,7 +72,12 @@ export function agentTitle(event: ActivityEvent): string {
     return 'Agent working'
   }
   if (event.state === 'done') {
-    return event.entry.interrupted ? 'Agent interrupted' : 'Agent finished'
+    const verdict = agentMainAgentVerdict(event.entry)
+    return verdict === 'failure'
+      ? 'Agent failed'
+      : verdict === 'cancellation'
+        ? 'Agent interrupted'
+        : 'Agent finished'
   }
   return event.state === 'waiting' ? 'Agent waiting for input' : 'Agent needs input'
 }
@@ -91,7 +100,12 @@ export function agentMeta(event: ActivityEvent): string {
     return `${agent} ${event.state}`
   }
   if (event.state === 'done') {
-    return event.entry.interrupted ? `${agent} interrupted` : `${agent} completed`
+    const verdict = agentMainAgentVerdict(event.entry)
+    return verdict === 'failure'
+      ? `${agent} failed`
+      : verdict === 'cancellation'
+        ? `${agent} interrupted`
+        : `${agent} completed`
   }
   return event.state === 'waiting' ? `${agent} waiting` : `${agent} blocked`
 }
@@ -120,13 +134,18 @@ export function statusPreviewForEntry(
 export type ActivityThreadStatusId = AgentDotState
 
 /** Single classifier behind grouping, labels, and clear-completed; the only place the
- *  interrupted predicate is spelled. */
+ *  verdict predicate is spelled. */
 export function activityThreadStatusId(thread: AgentPaneThread): ActivityThreadStatusId {
+  // Why: a failed main agent outranks the subagent work still holding its row live.
+  if (thread.currentAgentEntry && agentVerdictDisplayMark(thread.currentAgentEntry) === 'failed') {
+    return 'failed'
+  }
   const paneEntry = paneActivityEntry(thread)
   const state = threadCurrentState(thread) ?? 'done'
-  const interrupted = paneEntry ? paneEntry.interrupted : thread.latestEvent?.entry.interrupted
-  if (!thread.currentAgentState && state === 'done' && interrupted) {
-    return 'interrupted'
+  const verdictEntry = paneEntry ?? thread.latestEvent?.entry
+  const verdictDot = verdictEntry ? agentVerdictDisplayMark(verdictEntry) : null
+  if (!thread.currentAgentState && state === 'done' && verdictDot) {
+    return verdictDot
   }
   return state
 }
@@ -149,7 +168,7 @@ function threadCurrentState(
   )
 }
 
-// Interrupted rows deliberately keep the done glyph (#2569).
+// Interrupted rows deliberately keep the done glyph (#2569); a failure is a fault and does not.
 export function threadAgentState(thread: AgentPaneThread): AgentDotState {
   const id = activityThreadStatusId(thread)
   return id === 'interrupted' ? 'done' : id
diff --git a/src/renderer/src/components/artifacts/ArtifactCollection.test.tsx b/src/renderer/src/components/artifacts/ArtifactCollection.test.tsx
index 7a2754418857..7639cf82f9de 100644
--- a/src/renderer/src/components/artifacts/ArtifactCollection.test.tsx
+++ b/src/renderer/src/components/artifacts/ArtifactCollection.test.tsx
@@ -185,11 +185,11 @@ describe('ArtifactCollection', () => {
   // Why: happy-dom has no layout, and the virtualizer sizes its window from the scroller's
   // offsetHeight — left at 0 it mounts no rows at all and the assertions below would be vacuous.
   function stubScrollerViewport(): void {
-    vi.spyOn(HTMLElement.prototype, 'offsetHeight', 'get').mockImplementation(
-      function (this: HTMLElement) {
-        return this.classList.contains('overflow-auto') ? 600 : 53
-      }
-    )
+    vi.spyOn(HTMLElement.prototype, 'offsetHeight', 'get').mockImplementation(function (
+      this: HTMLElement
+    ) {
+      return this.classList.contains('overflow-auto') ? 600 : 53
+    })
   }
 
   function announcedSetSizes(container: HTMLElement): string[] {
diff --git a/src/renderer/src/components/artifacts/ArtifactPublishButton.test.tsx b/src/renderer/src/components/artifacts/ArtifactPublishButton.test.tsx
index 77f64b0217cc..2b79aa81d31e 100644
--- a/src/renderer/src/components/artifacts/ArtifactPublishButton.test.tsx
+++ b/src/renderer/src/components/artifacts/ArtifactPublishButton.test.tsx
@@ -1,12 +1,28 @@
 // @vitest-environment happy-dom
 
 import '@testing-library/jest-dom/vitest'
-import type { ReactNode } from 'react'
+import { createRef, type ReactNode } from 'react'
 import { cleanup, render, screen, waitFor } from '@testing-library/react'
 import userEvent from '@testing-library/user-event'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 
-const mocks = vi.hoisted(() => ({
+type ArtifactPublishButtonMocks = {
+  connect: ReturnType<typeof vi.fn>
+  openSettingsPage: ReturnType<typeof vi.fn>
+  openSettingsTarget: ReturnType<typeof vi.fn>
+  getPublishedLink: ReturnType<typeof vi.fn>
+  copyLink: ReturnType<typeof vi.fn>
+  openLink: ReturnType<typeof vi.fn>
+  publish: ReturnType<typeof vi.fn>
+  openPopover: ((open: boolean) => void) | null
+  closePopover: ((event: Event) => void) | null
+  state: {
+    orcaProfileAuthStatus: Record<string, unknown>
+    settings: { artifactSharingEnabled: boolean }
+  }
+}
+
+const mocks = vi.hoisted<ArtifactPublishButtonMocks>(() => ({
   connect: vi.fn(),
   openSettingsPage: vi.fn(),
   openSettingsTarget: vi.fn(),
@@ -14,9 +30,10 @@ const mocks = vi.hoisted(() => ({
   copyLink: vi.fn(),
   openLink: vi.fn(),
   publish: vi.fn(),
-  openPopover: null as ((open: boolean) => void) | null,
+  openPopover: null,
+  closePopover: null,
   state: {
-    orcaProfileAuthStatus: { configured: true, state: 'connected' } as Record<string, unknown>,
+    orcaProfileAuthStatus: { configured: true, state: 'connected' },
     settings: { artifactSharingEnabled: true }
   }
 }))
@@ -42,7 +59,17 @@ vi.mock('@/components/ui/popover', () => ({
     mocks.openPopover = onOpenChange ?? null
     return <>{children}</>
   },
-  PopoverContent: ({ children }: { children: ReactNode }) => <div>{children}</div>,
+  PopoverAnchor: ({ children }: { children?: ReactNode }) => <>{children}</>,
+  PopoverContent: ({
+    children,
+    onCloseAutoFocus
+  }: {
+    children: ReactNode
+    onCloseAutoFocus?: (event: Event) => void
+  }) => {
+    mocks.closePopover = onCloseAutoFocus ?? null
+    return <div>{children}</div>
+  },
   PopoverTrigger: ({ children }: { children: ReactNode }) => (
     <span onClick={() => mocks.openPopover?.(true)}>{children}</span>
   )
@@ -81,6 +108,7 @@ describe('ArtifactPublishButton', () => {
     mocks.getPublishedLink.mockResolvedValue(null)
     mocks.copyLink.mockResolvedValue(true)
     mocks.openPopover = null
+    mocks.closePopover = null
     mocks.state.orcaProfileAuthStatus = { configured: true, state: 'connected' }
     mocks.state.settings = { artifactSharingEnabled: true }
   })
@@ -101,6 +129,31 @@ describe('ArtifactPublishButton', () => {
     expect(screen.getByRole('button', { name: 'Update shared content' })).toBeInTheDocument()
   })
 
+  it('supports a controlled virtual anchor without rendering a second trigger', async () => {
+    const anchorRef = createRef<HTMLButtonElement>()
+    render(
+      <>
+        <button ref={anchorRef}>Overflow</button>
+        <ArtifactPublishButton
+          sourceKey="/repo/report.md"
+          createRequest={vi.fn()}
+          anchorRef={anchorRef}
+          open
+          onOpenChange={vi.fn()}
+        />
+      </>
+    )
+
+    expect(screen.queryByRole('button', { name: 'Share as artifact' })).toBeNull()
+    expect(await screen.findByRole('button', { name: 'Generate link' })).toBeInTheDocument()
+
+    const focus = vi.spyOn(anchorRef.current!, 'focus')
+    const closeEvent = new Event('close', { cancelable: true })
+    mocks.closePopover?.(closeEvent)
+    expect(closeEvent.defaultPrevented).toBe(true)
+    expect(focus).toHaveBeenCalledWith({ preventScroll: true })
+  })
+
   it('offers sign-in and blocks confirmation while signed out', async () => {
     const user = userEvent.setup()
     mocks.state.orcaProfileAuthStatus = { configured: true, state: 'local' }
diff --git a/src/renderer/src/components/artifacts/ArtifactPublishButton.tsx b/src/renderer/src/components/artifacts/ArtifactPublishButton.tsx
index bf6fb2360033..a90c1c037a9e 100644
--- a/src/renderer/src/components/artifacts/ArtifactPublishButton.tsx
+++ b/src/renderer/src/components/artifacts/ArtifactPublishButton.tsx
@@ -1,8 +1,8 @@
-import { useEffect, useRef, useState } from 'react'
+import { useEffect, useRef, useState, type RefObject } from 'react'
 import { ArrowRight, Loader2, Share2 } from 'lucide-react'
 import type { ArtifactWriteRequest } from '../../../../shared/artifacts'
 import { Button } from '@/components/ui/button'
-import { Popover, PopoverContent, PopoverTrigger } from '@/components/ui/popover'
+import { Popover, PopoverAnchor, PopoverContent, PopoverTrigger } from '@/components/ui/popover'
 import { Tooltip, TooltipContent, TooltipTrigger } from '@/components/ui/tooltip'
 import { translate } from '@/i18n/i18n'
 import { cn } from '@/lib/utils'
@@ -21,14 +21,26 @@ export function ArtifactPublishButton({
   sourceKey,
   createRequest,
   className,
-  disabled
+  disabled,
+  anchorRef,
+  open: controlledOpen,
+  onOpenChange
 }: {
   sourceKey: string
   createRequest: () => Promise<ArtifactWriteRequest>
   className?: string
   disabled?: boolean
-}): React.JSX.Element {
-  const [open, setOpen] = useState(false)
+} & (
+  | { anchorRef?: never; open?: never; onOpenChange?: never }
+  | {
+      anchorRef?: RefObject<HTMLButtonElement | null>
+      open: boolean
+      onOpenChange: (open: boolean) => void
+    }
+)): React.JSX.Element {
+  const [ownOpen, setOwnOpen] = useState(false)
+  const open = controlledOpen ?? ownOpen
+  const setOpen = onOpenChange ?? setOwnOpen
   const [publishing, setPublishing] = useState(false)
   const [lookupRevision, setLookupRevision] = useState(0)
   const [linkLookup, setLinkLookup] = useState<PublishedLinkLookup | null>(null)
@@ -111,25 +123,32 @@ export function ArtifactPublishButton({
   )
   return (
     <Popover open={open} onOpenChange={(nextOpen) => !busy && setOpen(nextOpen)}>
-      <Tooltip>
-        <TooltipTrigger asChild>
-          <PopoverTrigger asChild>
-            <Button
-              type="button"
-              variant="ghost"
-              size="icon-sm"
-              className={cn('shrink-0', className)}
-              disabled={blocked}
-              aria-label={label}
-            >
-              {publishing ? <Loader2 className="animate-spin" /> : <Share2 />}
-            </Button>
-          </PopoverTrigger>
-        </TooltipTrigger>
-        <TooltipContent side="bottom" sideOffset={4}>
-          {label}
-        </TooltipContent>
-      </Tooltip>
+      {anchorRef ? (
+        <PopoverAnchor
+          // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: DOM refs are transiently null before mount, though Radix's virtualRef type omits that lifecycle state.
+          virtualRef={anchorRef as RefObject<HTMLButtonElement>}
+        />
+      ) : (
+        <Tooltip>
+          <TooltipTrigger asChild>
+            <PopoverTrigger asChild>
+              <Button
+                type="button"
+                variant="ghost"
+                size="icon-sm"
+                className={cn('shrink-0', className)}
+                disabled={blocked}
+                aria-label={label}
+              >
+                {publishing ? <Loader2 className="animate-spin" /> : <Share2 />}
+              </Button>
+            </PopoverTrigger>
+          </TooltipTrigger>
+          <TooltipContent side="bottom" sideOffset={4}>
+            {label}
+          </TooltipContent>
+        </Tooltip>
+      )}
 
       <PopoverContent
         ref={popoverContentRef}
@@ -141,6 +160,13 @@ export function ArtifactPublishButton({
           event.preventDefault()
           popoverContentRef.current?.focus({ preventScroll: true })
         }}
+        onCloseAutoFocus={(event) => {
+          if (!anchorRef) {
+            return
+          }
+          event.preventDefault()
+          anchorRef.current?.focus({ preventScroll: true })
+        }}
       >
         <div className="space-y-1 border-b border-border/60 px-4 py-3.5">
           <h3 className="text-sm font-semibold">
diff --git a/src/renderer/src/components/artifacts/artifact-list-windowing.test.tsx b/src/renderer/src/components/artifacts/artifact-list-windowing.test.tsx
index 4723af3d0155..ca8a4a916c0c 100644
--- a/src/renderer/src/components/artifacts/artifact-list-windowing.test.tsx
+++ b/src/renderer/src/components/artifacts/artifact-list-windowing.test.tsx
@@ -303,11 +303,11 @@ beforeEach(() => {
   root = createRoot(host)
 
   vi.stubGlobal('ResizeObserver', MockResizeObserver)
-  vi.spyOn(HTMLElement.prototype, 'offsetHeight', 'get').mockImplementation(
-    function (this: HTMLElement) {
-      return elementHeight(this)
-    }
-  )
+  vi.spyOn(HTMLElement.prototype, 'offsetHeight', 'get').mockImplementation(function (
+    this: HTMLElement
+  ) {
+    return elementHeight(this)
+  })
   vi.spyOn(Element.prototype, 'getBoundingClientRect').mockImplementation(function (this: Element) {
     const top = topsByElement.get(this) ?? 0
     const height = elementHeight(this)
diff --git a/src/renderer/src/components/automations/AutomationPromptDisclosure.test.tsx b/src/renderer/src/components/automations/AutomationPromptDisclosure.test.tsx
index 6ac693aea826..e47619cf81fe 100644
--- a/src/renderer/src/components/automations/AutomationPromptDisclosure.test.tsx
+++ b/src/renderer/src/components/automations/AutomationPromptDisclosure.test.tsx
@@ -70,21 +70,21 @@ describe('AutomationPromptDisclosure', () => {
   beforeEach(async () => {
     await i18n.changeLanguage('en')
     vi.stubGlobal('ResizeObserver', PromptResizeObserver)
-    vi.spyOn(HTMLElement.prototype, 'clientHeight', 'get').mockImplementation(
-      function (this: HTMLElement) {
-        if (this.tagName !== 'P') {
-          return 0
-        }
-        return this.classList.contains('line-clamp-4')
-          ? Math.min(promptNaturalHeight, 80)
-          : promptNaturalHeight
+    vi.spyOn(HTMLElement.prototype, 'clientHeight', 'get').mockImplementation(function (
+      this: HTMLElement
+    ) {
+      if (this.tagName !== 'P') {
+        return 0
       }
-    )
-    vi.spyOn(HTMLElement.prototype, 'scrollHeight', 'get').mockImplementation(
-      function (this: HTMLElement) {
-        return this.tagName === 'P' ? promptNaturalHeight : 0
-      }
-    )
+      return this.classList.contains('line-clamp-4')
+        ? Math.min(promptNaturalHeight, 80)
+        : promptNaturalHeight
+    })
+    vi.spyOn(HTMLElement.prototype, 'scrollHeight', 'get').mockImplementation(function (
+      this: HTMLElement
+    ) {
+      return this.tagName === 'P' ? promptNaturalHeight : 0
+    })
   })
 
   afterEach(async () => {
diff --git a/src/renderer/src/components/automations/automation-orca-save-operations.ts b/src/renderer/src/components/automations/automation-orca-save-operations.ts
index b12874d00365..914a6b478431 100644
--- a/src/renderer/src/components/automations/automation-orca-save-operations.ts
+++ b/src/renderer/src/components/automations/automation-orca-save-operations.ts
@@ -33,6 +33,7 @@ import type { AutomationHostTarget } from './automation-host-client'
 import type { AutomationAuthorityChangeReason } from './automation-host-invalidation'
 import type { AutomationSaveContext } from './automation-save-context'
 import { automationAuthorityCatalogKey } from './automation-host-catalog-types'
+import { createBrowserUuid } from '@/lib/browser-uuid'
 
 export type AutomationMoveOperationContext = {
   automationDispatchContext: AutomationDispatchContext
@@ -165,7 +166,7 @@ export async function moveAutomationToDestination(
   }
 
   const operationKey = `${source.id}:${target.entry.stableKey}`
-  const creationKey = context.moveCreationKeysRef.current.get(operationKey) ?? crypto.randomUUID()
+  const creationKey = context.moveCreationKeysRef.current.get(operationKey) ?? createBrowserUuid()
   context.moveCreationKeysRef.current.set(operationKey, creationKey)
   const created = toDispatchResult(
     await createAutomationAtDestination(
diff --git a/src/renderer/src/components/browser-cookie-import-google-disclosure.test.tsx b/src/renderer/src/components/browser-cookie-import-google-disclosure.test.tsx
index b7c210c3818b..ed8cc04c31f8 100644
--- a/src/renderer/src/components/browser-cookie-import-google-disclosure.test.tsx
+++ b/src/renderer/src/components/browser-cookie-import-google-disclosure.test.tsx
@@ -4,7 +4,7 @@
  * STA-3811: imports never touch the Google cookie family, so every import menu must disclose it
  * at the moment of decision.
  */
-import { act, type ReactNode } from 'react'
+import { act, createRef, type ReactNode } from 'react'
 import { createRoot, type Root } from 'react-dom/client'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import en from '@/i18n/locales/en.json'
@@ -67,6 +67,12 @@ describe('cookie-import Google disclosure footer', () => {
           onImportFromFile={vi.fn()}
           viewportPresetId={null}
           onApplyViewportPreset={vi.fn()}
+          overflow={{
+            triggerRef: createRef<HTMLButtonElement>(),
+            tools: [],
+            deferUntilClose: vi.fn(),
+            onMenuCloseAutoFocus: vi.fn()
+          }}
         />
       )
     ],
diff --git a/src/renderer/src/components/browser-pane/assemble-chrome/BrowserImportHintButton.tsx b/src/renderer/src/components/browser-pane/assemble-chrome/BrowserImportHintButton.tsx
index 8e606c8a0e12..701430e19718 100644
--- a/src/renderer/src/components/browser-pane/assemble-chrome/BrowserImportHintButton.tsx
+++ b/src/renderer/src/components/browser-pane/assemble-chrome/BrowserImportHintButton.tsx
@@ -26,10 +26,12 @@ import { translate } from '@/i18n/i18n'
 
 type BrowserImportHintButtonProps = {
   profileId: string | null
+  compact?: boolean
 }
 
 export function BrowserImportHintButton({
-  profileId
+  profileId,
+  compact = false
 }: BrowserImportHintButtonProps): React.JSX.Element | null {
   const [open, setOpen] = useState(false)
   const [importMenuOpen, setImportMenuOpen] = useState(false)
@@ -178,7 +180,12 @@ export function BrowserImportHintButton({
           data-contextual-tour-target="browser-import-hint"
         >
           <Import className="size-3.5" />
-          {translate('auto.components.browser.pane.BrowserImportHintButton.b24fef25be', 'Import')}
+          {compact
+            ? null
+            : translate(
+                'auto.components.browser.pane.BrowserImportHintButton.b24fef25be',
+                'Import'
+              )}
         </Button>
       </PopoverTrigger>
       <PopoverContent align="end" side="bottom" sideOffset={6} className="w-80 p-3">
diff --git a/src/renderer/src/components/browser-pane/assemble-chrome/BrowserPane.remote-link-routing.test.ts b/src/renderer/src/components/browser-pane/assemble-chrome/BrowserPane.remote-link-routing.test.ts
index 856ac24c725a..1462681489be 100644
--- a/src/renderer/src/components/browser-pane/assemble-chrome/BrowserPane.remote-link-routing.test.ts
+++ b/src/renderer/src/components/browser-pane/assemble-chrome/BrowserPane.remote-link-routing.test.ts
@@ -16,5 +16,10 @@ describe('remote browser link routing', () => {
     expect(openRequest).toContain('workspaceId: worktreeId')
     expect(openRequest).toContain('expectedRuntimeEnvironmentId: runtimeEnvironmentId')
     expect(openRequest).toContain("placementPreference: 'server'")
+    // A background link follows its source wrapper and never selects the workspace again.
+    expect(openRequest).toContain(
+      '...(sourceUnifiedTab ? { afterTabId: sourceUnifiedTab.id } : {})'
+    )
+    expect(openRequest).toContain('selectWorktree: false')
   })
 })
diff --git a/src/renderer/src/components/browser-pane/assemble-chrome/BrowserToolbarMenu.tsx b/src/renderer/src/components/browser-pane/assemble-chrome/BrowserToolbarMenu.tsx
index 026931d2554f..c964a3fb6f35 100644
--- a/src/renderer/src/components/browser-pane/assemble-chrome/BrowserToolbarMenu.tsx
+++ b/src/renderer/src/components/browser-pane/assemble-chrome/BrowserToolbarMenu.tsx
@@ -12,6 +12,7 @@ import {
 import { BrowserToolbarMenuDropdown } from './browser-toolbar-menu-dropdown'
 import { BrowserToolbarProfileDialogs } from './browser-toolbar-profile-dialogs'
 import { translate } from '@/i18n/i18n'
+import type { BrowserChromeOverflowMenuProps } from './browser-chrome-folded-tools'
 
 type BrowserToolbarMenuProps = {
   currentProfileId: string | null
@@ -20,6 +21,7 @@ type BrowserToolbarMenuProps = {
   viewportPresetId: BrowserViewportPresetId | null
   onDestroyWebview: () => void
   isActive: boolean
+  overflow: BrowserChromeOverflowMenuProps
 }
 
 export function BrowserToolbarMenu({
@@ -28,7 +30,8 @@ export function BrowserToolbarMenu({
   browserPageId,
   viewportPresetId,
   onDestroyWebview,
-  isActive
+  isActive,
+  overflow
 }: BrowserToolbarMenuProps): React.JSX.Element {
   const browserSessionProfiles = useAppStore((s) => s.browserSessionProfiles)
   const detectedBrowsers = useAppStore((s) => s.detectedBrowsers)
@@ -241,6 +244,7 @@ export function BrowserToolbarMenu({
         onImportFromFile={() => void handleImportFromFile()}
         viewportPresetId={viewportPresetId}
         onApplyViewportPreset={applyViewportPreset}
+        overflow={overflow}
       />
 
       <BrowserToolbarProfileDialogs
diff --git a/src/renderer/src/components/browser-pane/assemble-chrome/browser-chrome-element-tool-buttons.tsx b/src/renderer/src/components/browser-pane/assemble-chrome/browser-chrome-element-tool-buttons.tsx
new file mode 100644
index 000000000000..b8c9bd5132d1
--- /dev/null
+++ b/src/renderer/src/components/browser-pane/assemble-chrome/browser-chrome-element-tool-buttons.tsx
@@ -0,0 +1,109 @@
+import { Crosshair, MessageSquarePlus } from 'lucide-react'
+import { Button } from '@/components/ui/button'
+import { Tooltip, TooltipContent, TooltipTrigger } from '@/components/ui/tooltip'
+import { translate } from '@/i18n/i18n'
+import { cn } from '@/lib/utils'
+import type { GrabIntent } from '../describe-page/browser-page-types'
+
+/** The in-guest element picker, driving both Grab (copy) and Annotate (comment). */
+export type BrowserChromeElementTools = {
+  /** The intent the picker is armed for right now, or null when it is idle. */
+  activeIntent: GrabIntent | null
+  onStartIntent: (intent: GrabIntent) => void
+  disabled: boolean
+  grabShortcutLabel: string
+  annotationCount: number
+}
+
+export function BrowserChromeElementToolButtons({
+  tools,
+  showGrab,
+  showAnnotate,
+  showTourAnchors
+}: {
+  tools: BrowserChromeElementTools
+  showGrab: boolean
+  showAnnotate: boolean
+  showTourAnchors: boolean
+}): React.JSX.Element {
+  return (
+    <>
+      {showGrab ? (
+        <Tooltip>
+          <TooltipTrigger asChild>
+            <span className="inline-flex">
+              <Button
+                size="icon"
+                variant={tools.activeIntent === 'copy' ? 'default' : 'ghost'}
+                className={cn(
+                  'h-8 w-8',
+                  tools.activeIntent === 'copy' &&
+                    'bg-foreground/80 text-background hover:bg-foreground/90'
+                )}
+                onClick={() => tools.onStartIntent('copy')}
+                disabled={tools.disabled}
+                aria-label={translate(
+                  'auto.components.browser.pane.BrowserPane.fdfc7fe0ef',
+                  'Grab page element'
+                )}
+                {...(showTourAnchors
+                  ? { 'data-contextual-tour-target': 'browser-grab-control' }
+                  : {})}
+              >
+                <Crosshair className="size-4" />
+              </Button>
+            </span>
+          </TooltipTrigger>
+          <TooltipContent side="bottom" sideOffset={4}>
+            {translate(
+              'auto.components.browser.pane.BrowserPane.acbe79fd01',
+              'Grab page element ({{value0}})',
+              { value0: tools.grabShortcutLabel }
+            )}
+          </TooltipContent>
+        </Tooltip>
+      ) : null}
+
+      {showAnnotate ? (
+        <Tooltip>
+          <TooltipTrigger asChild>
+            {/* Why: disabled buttons drop hover events, so the tooltip needs an enabled wrapper. */}
+            <span className="inline-flex">
+              <Button
+                size="icon"
+                variant={tools.activeIntent === 'annotate' ? 'default' : 'ghost'}
+                className={cn(
+                  'relative h-8 w-8',
+                  tools.activeIntent === 'annotate' &&
+                    'bg-foreground/80 text-background hover:bg-foreground/90'
+                )}
+                onClick={() => tools.onStartIntent('annotate')}
+                disabled={tools.disabled}
+                aria-label={translate(
+                  'auto.components.browser.pane.BrowserPane.fc9be38f6f',
+                  'Annotate page element'
+                )}
+                {...(showTourAnchors
+                  ? { 'data-contextual-tour-target': 'browser-annotation-control' }
+                  : {})}
+              >
+                <MessageSquarePlus className="size-4" />
+                {tools.annotationCount > 0 ? (
+                  <span className="absolute -top-1 -right-1 flex min-w-4 items-center justify-center rounded-full bg-primary px-1 text-[10px] leading-4 text-primary-foreground">
+                    {tools.annotationCount}
+                  </span>
+                ) : null}
+              </Button>
+            </span>
+          </TooltipTrigger>
+          <TooltipContent side="bottom" sideOffset={4}>
+            {translate(
+              'auto.components.browser.pane.BrowserPane.fc9be38f6f',
+              'Annotate page element'
+            )}
+          </TooltipContent>
+        </Tooltip>
+      ) : null}
+    </>
+  )
+}
diff --git a/src/renderer/src/components/browser-pane/assemble-chrome/browser-chrome-folded-tools.test.tsx b/src/renderer/src/components/browser-pane/assemble-chrome/browser-chrome-folded-tools.test.tsx
new file mode 100644
index 000000000000..0247f46509ba
--- /dev/null
+++ b/src/renderer/src/components/browser-pane/assemble-chrome/browser-chrome-folded-tools.test.tsx
@@ -0,0 +1,107 @@
+// @vitest-environment happy-dom
+import { cleanup, fireEvent, render, screen } from '@testing-library/react'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { Share2 } from 'lucide-react'
+
+vi.mock('@/components/ui/dropdown-menu', () => ({
+  DropdownMenuItem: ({
+    children,
+    onSelect,
+    role,
+    'aria-checked': ariaChecked
+  }: {
+    children: React.ReactNode
+    onSelect: () => void
+    role?: string
+    'aria-checked'?: boolean
+  }) => (
+    <button role={role} aria-checked={ariaChecked} onClick={onSelect}>
+      {children}
+    </button>
+  ),
+  DropdownMenuSeparator: () => <hr />,
+  DropdownMenuShortcut: ({ children }: { children: React.ReactNode }) => <span>{children}</span>
+}))
+
+import { BrowserChromeFoldedMenuItems } from './browser-chrome-folded-tools'
+
+afterEach(cleanup)
+
+describe('BrowserChromeFoldedMenuItems', () => {
+  it('runs ordinary actions directly', () => {
+    const onSelect = vi.fn()
+    render(
+      <BrowserChromeFoldedMenuItems
+        tools={[{ stage: 'share', label: 'Share', icon: Share2, onSelect }]}
+        deferUntilClose={vi.fn()}
+      />
+    )
+
+    fireEvent.click(screen.getByRole('button', { name: 'Share' }))
+    expect(onSelect).toHaveBeenCalledOnce()
+  })
+
+  it('defers popover actions until the menu closes', () => {
+    const onSelect = vi.fn()
+    const deferUntilClose = vi.fn()
+    render(
+      <BrowserChromeFoldedMenuItems
+        tools={[
+          {
+            stage: 'share',
+            label: 'Share',
+            icon: Share2,
+            onSelect,
+            deferUntilMenuClose: true
+          }
+        ]}
+        deferUntilClose={deferUntilClose}
+      />
+    )
+
+    fireEvent.click(screen.getByRole('button', { name: 'Share' }))
+    expect(onSelect).not.toHaveBeenCalled()
+    expect(deferUntilClose).toHaveBeenCalledWith(onSelect)
+  })
+
+  it('preserves active state for folded toggle tools', () => {
+    render(
+      <BrowserChromeFoldedMenuItems
+        tools={[
+          {
+            stage: 'draw',
+            label: 'Draw',
+            icon: Share2,
+            onSelect: vi.fn(),
+            active: true
+          }
+        ]}
+        deferUntilClose={vi.fn()}
+      />
+    )
+
+    expect(
+      screen.getByRole('menuitemcheckbox', { name: 'Draw' }).getAttribute('aria-checked')
+    ).toBe('true')
+  })
+
+  it('gives toggle tools their own section, split from the actions by a divider', () => {
+    const { container } = render(
+      <BrowserChromeFoldedMenuItems
+        tools={[
+          { stage: 'draw', label: 'Draw', icon: Share2, onSelect: vi.fn(), active: false },
+          { stage: 'share', label: 'Share', icon: Share2, onSelect: vi.fn() }
+        ]}
+        deferUntilClose={vi.fn()}
+      />
+    )
+
+    // Rendered order: Draw, divider, Share, closing divider.
+    expect(Array.from(container.querySelectorAll('button, hr')).map((el) => el.tagName)).toEqual([
+      'BUTTON',
+      'HR',
+      'BUTTON',
+      'HR'
+    ])
+  })
+})
diff --git a/src/renderer/src/components/browser-pane/assemble-chrome/browser-chrome-folded-tools.tsx b/src/renderer/src/components/browser-pane/assemble-chrome/browser-chrome-folded-tools.tsx
new file mode 100644
index 000000000000..3b6c4fd55e0c
--- /dev/null
+++ b/src/renderer/src/components/browser-pane/assemble-chrome/browser-chrome-folded-tools.tsx
@@ -0,0 +1,106 @@
+import { Check } from 'lucide-react'
+import type { LucideIcon } from 'lucide-react'
+import {
+  DropdownMenuItem,
+  DropdownMenuSeparator,
+  DropdownMenuShortcut
+} from '@/components/ui/dropdown-menu'
+import type { BrowserChromeFoldStage } from './use-browser-chrome-tool-fold'
+
+export type BrowserChromeFoldedTool = {
+  stage: BrowserChromeFoldStage
+  label: string
+  icon: LucideIcon
+  onSelect: () => void
+  disabled?: boolean
+  shortcut?: string
+  count?: number
+  /** Present for toggle tools, including false, so the menu preserves their pressed state. */
+  active?: boolean
+  /**
+   * Run only after the menu has closed and skip its focus return. A tool that opens its own
+   * popover needs this: focus landing back on the ⋯ trigger would dismiss that popover at once.
+   */
+  deferUntilMenuClose?: boolean
+}
+
+export type BrowserChromeOverflowMenuProps = {
+  triggerRef: React.RefObject<HTMLButtonElement | null>
+  tools: readonly BrowserChromeFoldedTool[]
+  deferUntilClose: (action: () => void) => void
+  onMenuCloseAutoFocus: (event: Event) => void
+}
+
+function FoldedToolContent({ tool }: { tool: BrowserChromeFoldedTool }): React.JSX.Element {
+  const showActiveCheck = tool.active === true
+  const showTrailing = showActiveCheck || Boolean(tool.count) || Boolean(tool.shortcut)
+  return (
+    <>
+      <tool.icon className="size-3.5" />
+      {tool.label}
+      {showTrailing ? (
+        // Why: a leading check column would push these icon rows out of line with the plain rows.
+        <span className="ml-auto flex items-center gap-2">
+          {showActiveCheck ? <Check className="size-3.5 text-foreground" /> : null}
+          {tool.count ? (
+            <span className="flex min-w-4 items-center justify-center rounded-full bg-primary px-1 text-[10px] leading-4 text-primary-foreground">
+              {tool.count}
+            </span>
+          ) : tool.shortcut ? (
+            <DropdownMenuShortcut>{tool.shortcut}</DropdownMenuShortcut>
+          ) : null}
+        </span>
+      ) : null}
+    </>
+  )
+}
+
+function FoldedToolRow({
+  tool,
+  deferUntilClose
+}: {
+  tool: BrowserChromeFoldedTool
+  deferUntilClose: (action: () => void) => void
+}): React.JSX.Element {
+  const onSelect = (): void =>
+    tool.deferUntilMenuClose ? deferUntilClose(tool.onSelect) : tool.onSelect()
+  return (
+    <DropdownMenuItem
+      disabled={tool.disabled}
+      onSelect={onSelect}
+      // Why: keeps toggle semantics without the checkbox item's reserved leading column,
+      // which would misalign this row's icon against the plain rows in the same menu.
+      {...(tool.active === undefined
+        ? {}
+        : { role: 'menuitemcheckbox', 'aria-checked': tool.active })}
+    >
+      <FoldedToolContent tool={tool} />
+    </DropdownMenuItem>
+  )
+}
+
+/** The toolbar tools that no longer fit, rendered at the top of a surface's ⋯ menu. */
+export function BrowserChromeFoldedMenuItems({
+  tools,
+  deferUntilClose
+}: Pick<BrowserChromeOverflowMenuProps, 'tools' | 'deferUntilClose'>): React.JSX.Element | null {
+  if (tools.length === 0) {
+    return null
+  }
+  // Why: the element/markup toggles fold first and carry on/off state, so they read as their own
+  // section ahead of the one-shot actions below rather than as one flat tool list.
+  const toggleTools = tools.filter((tool) => tool.active !== undefined)
+  const actionTools = tools.filter((tool) => tool.active === undefined)
+  return (
+    <>
+      {toggleTools.map((tool) => (
+        <FoldedToolRow key={tool.stage} tool={tool} deferUntilClose={deferUntilClose} />
+      ))}
+      {toggleTools.length > 0 && actionTools.length > 0 ? <DropdownMenuSeparator /> : null}
+      {actionTools.map((tool) => (
+        <FoldedToolRow key={tool.stage} tool={tool} deferUntilClose={deferUntilClose} />
+      ))}
+      <DropdownMenuSeparator />
+    </>
+  )
+}
diff --git a/src/renderer/src/components/browser-pane/assemble-chrome/browser-chrome-toolbar.test.tsx b/src/renderer/src/components/browser-pane/assemble-chrome/browser-chrome-toolbar.test.tsx
new file mode 100644
index 000000000000..5e014d3a8bfe
--- /dev/null
+++ b/src/renderer/src/components/browser-pane/assemble-chrome/browser-chrome-toolbar.test.tsx
@@ -0,0 +1,158 @@
+// @vitest-environment happy-dom
+import { cleanup, fireEvent, render, screen } from '@testing-library/react'
+import { useState } from 'react'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { BrowserChromeFoldStage } from './use-browser-chrome-tool-fold'
+import type { BrowserChromeFoldedTool } from './browser-chrome-folded-tools'
+
+const mocks = vi.hoisted(() => {
+  const stages: readonly BrowserChromeFoldStage[] = []
+  return { folded: new Set<BrowserChromeFoldStage>(), stages }
+})
+
+vi.mock('./use-browser-chrome-tool-fold', () => ({
+  BROWSER_CHROME_FOLD_ORDER: [
+    'import-label',
+    'external',
+    'devtools',
+    'share',
+    'import',
+    'draw',
+    'grab',
+    'annotate'
+  ],
+  useBrowserChromeToolFold: (_rowRef: unknown, stages: readonly BrowserChromeFoldStage[]) => {
+    mocks.stages = stages
+    return mocks.folded
+  }
+}))
+
+vi.mock('./browser-navigation-control-row', () => ({
+  BrowserNavigationControlRow: ({ children }: { children: React.ReactNode }) => (
+    <div>{children}</div>
+  )
+}))
+
+vi.mock('../annotate/MarkupDrawButton', () => ({
+  MarkupDrawButton: () => <button>Draw</button>
+}))
+
+vi.mock('./browser-chrome-element-tool-buttons', () => ({
+  BrowserChromeElementToolButtons: () => null
+}))
+
+import { BrowserChromeToolbar } from './browser-chrome-toolbar'
+
+const controls = {
+  canGoBack: false,
+  canGoForward: false,
+  loading: false,
+  goBack: vi.fn(),
+  goForward: vi.fn(),
+  reload: vi.fn(),
+  navigate: vi.fn()
+}
+const emptyOverflowMenu = (): null => null
+
+beforeEach(() => {
+  mocks.folded = new Set()
+  mocks.stages = []
+})
+
+afterEach(cleanup)
+
+describe('BrowserChromeToolbar', () => {
+  it('does not duplicate an action already provided by the surface menu', () => {
+    mocks.folded = new Set(['devtools', 'external'])
+    let foldedTools: readonly BrowserChromeFoldedTool[] = []
+
+    render(
+      <BrowserChromeToolbar
+        controls={controls}
+        addressSlot={null}
+        elementTools={null}
+        markup={{ active: false, disabled: false, onToggle: vi.fn(), canShowDiscoveryHint: false }}
+        viewSource={{
+          label: 'Open source file',
+          onSelect: vi.fn(),
+          alreadyInOverflowMenu: true
+        }}
+        openExternal={{ label: 'Open with default app', onSelect: vi.fn() }}
+        overflowMenu={(overflow) => {
+          foldedTools = overflow.tools
+          return null
+        }}
+      />
+    )
+
+    expect(foldedTools.map((tool) => tool.stage)).toEqual(['external'])
+  })
+
+  it('compacts the import hint before removing it', () => {
+    mocks.folded = new Set(['import-label'])
+    const importControl = vi.fn(() => null)
+
+    render(
+      <BrowserChromeToolbar
+        controls={controls}
+        addressSlot={null}
+        importControl={importControl}
+        elementTools={null}
+        markup={{ active: false, disabled: false, onToggle: vi.fn(), canShowDiscoveryHint: false }}
+        viewSource={null}
+        openExternal={null}
+        overflowMenu={emptyOverflowMenu}
+      />
+    )
+
+    expect(importControl).toHaveBeenCalledWith(true)
+  })
+
+  it('keeps the active tour control out of the fold sequence', () => {
+    render(
+      <BrowserChromeToolbar
+        controls={controls}
+        addressSlot={null}
+        pinnedStage="grab"
+        elementTools={{
+          activeIntent: null,
+          onStartIntent: vi.fn(),
+          disabled: false,
+          grabShortcutLabel: 'Cmd+Shift+C',
+          annotationCount: 0
+        }}
+        markup={{ active: false, disabled: false, onToggle: vi.fn(), canShowDiscoveryHint: false }}
+        viewSource={null}
+        openExternal={null}
+        overflowMenu={emptyOverflowMenu}
+      />
+    )
+
+    expect(mocks.stages).not.toContain('grab')
+    expect(mocks.stages).toContain('annotate')
+  })
+
+  it('keeps the same share control mounted when it moves into overflow', () => {
+    function StatefulShare(): React.JSX.Element {
+      const [clicks, setClicks] = useState(0)
+      return <button onClick={() => setClicks((count) => count + 1)}>Share state {clicks}</button>
+    }
+    const props = {
+      controls,
+      addressSlot: null,
+      elementTools: null,
+      markup: { active: false, disabled: false, onToggle: vi.fn(), canShowDiscoveryHint: false },
+      shareControl: () => <StatefulShare />,
+      viewSource: null,
+      openExternal: null,
+      overflowMenu: emptyOverflowMenu
+    }
+    const view = render(<BrowserChromeToolbar {...props} />)
+    fireEvent.click(screen.getByRole('button', { name: 'Share state 0' }))
+
+    mocks.folded = new Set(['share'])
+    view.rerender(<BrowserChromeToolbar {...props} />)
+
+    expect(screen.getByRole('button', { name: 'Share state 1' })).not.toBeNull()
+  })
+})
diff --git a/src/renderer/src/components/browser-pane/assemble-chrome/browser-chrome-toolbar.tsx b/src/renderer/src/components/browser-pane/assemble-chrome/browser-chrome-toolbar.tsx
index a314ed692159..59db797397d2 100644
--- a/src/renderer/src/components/browser-pane/assemble-chrome/browser-chrome-toolbar.tsx
+++ b/src/renderer/src/components/browser-pane/assemble-chrome/browser-chrome-toolbar.tsx
@@ -1,24 +1,35 @@
-import { cn } from '@/lib/utils'
-import { Crosshair, ExternalLink, MessageSquarePlus, SquareCode } from 'lucide-react'
+import { useRef, useState } from 'react'
+import {
+  Crosshair,
+  ExternalLink,
+  MessageSquarePlus,
+  PenTool,
+  Share2,
+  SquareCode
+} from 'lucide-react'
+import type { LucideIcon } from 'lucide-react'
 import { Button } from '@/components/ui/button'
-import { Tooltip, TooltipContent, TooltipTrigger } from '@/components/ui/tooltip'
 import { translate } from '@/i18n/i18n'
 import {
   BrowserNavigationControlRow,
   type BrowserNavigationControls
 } from './browser-navigation-control-row'
 import { MarkupDrawButton } from '../annotate/MarkupDrawButton'
-import type { GrabIntent } from '../describe-page/browser-page-types'
+import type {
+  BrowserChromeFoldedTool,
+  BrowserChromeOverflowMenuProps
+} from './browser-chrome-folded-tools'
+import {
+  BROWSER_CHROME_FOLD_ORDER,
+  useBrowserChromeToolFold,
+  type BrowserChromeFoldStage
+} from './use-browser-chrome-tool-fold'
+import {
+  BrowserChromeElementToolButtons,
+  type BrowserChromeElementTools
+} from './browser-chrome-element-tool-buttons'
 
-/** The in-guest element picker, driving both Grab (copy) and Annotate (comment). */
-export type BrowserChromeElementTools = {
-  /** The intent the picker is armed for right now, or null when it is idle. */
-  activeIntent: GrabIntent | null
-  onStartIntent: (intent: GrabIntent) => void
-  disabled: boolean
-  grabShortcutLabel: string
-  annotationCount: number
-}
+export type { BrowserChromeElementTools } from './browser-chrome-element-tool-buttons'
 
 export type BrowserChromeMarkupTool = {
   active: boolean
@@ -33,10 +44,40 @@ export type BrowserChromeMarkupTool = {
   canShowDiscoveryHint: boolean
 }
 
+export type BrowserChromeShareControl = {
+  open: boolean
+  onOpenChange: (open: boolean) => void
+  anchorRef?: React.RefObject<HTMLButtonElement | null>
+}
+
 export type BrowserChromeToolAction = {
   onSelect: () => void
   label: string
   disabled?: boolean
+  /** True when the surface's overflow menu already exposes this action. */
+  alreadyInOverflowMenu?: boolean
+}
+
+function BrowserChromeActionButton({
+  action,
+  icon: Icon
+}: {
+  action: BrowserChromeToolAction
+  icon: LucideIcon
+}): React.JSX.Element {
+  return (
+    <Button
+      size="icon"
+      variant="ghost"
+      className="h-7 w-7"
+      onClick={action.onSelect}
+      title={action.label}
+      aria-label={action.label}
+      disabled={action.disabled}
+    >
+      <Icon className="size-4" />
+    </Button>
+  )
 }
 
 /**
@@ -59,148 +100,170 @@ export function BrowserChromeToolbar({
   viewSource,
   openExternal,
   overflowMenu,
-  showTourAnchors = false
+  showTourAnchors = false,
+  pinnedStage
 }: {
   controls: BrowserNavigationControls
   addressSlot: React.ReactNode
   reloadControl?: React.ReactNode
   reloadLabel?: string
   /** Cookie import — a browsing session concept; null where there is no session to import into. */
-  importControl?: React.ReactNode
+  importControl?: ((compact: boolean) => React.ReactNode) | null
   elementTools: BrowserChromeElementTools | null
   markup: BrowserChromeMarkupTool
-  shareControl?: React.ReactNode
+  shareControl?: (control: BrowserChromeShareControl) => React.ReactNode
   viewSource: BrowserChromeToolAction | null
   openExternal: BrowserChromeToolAction | null
-  overflowMenu?: React.ReactNode
+  overflowMenu: (props: BrowserChromeOverflowMenuProps) => React.ReactNode
   /** Only the browsing pane anchors the contextual tour; a second anchor would steal its steps. */
   showTourAnchors?: boolean
+  /** Keeps the active contextual-tour control measurable while the remaining tools still fold. */
+  pinnedStage?: BrowserChromeFoldStage
 }): React.JSX.Element {
+  const rowRef = useRef<HTMLDivElement>(null)
+  const overflowTriggerRef = useRef<HTMLButtonElement>(null)
+  const present: Record<BrowserChromeFoldStage, boolean> = {
+    'import-label': importControl != null,
+    import: importControl != null,
+    external: openExternal !== null,
+    devtools: viewSource !== null,
+    share: shareControl != null,
+    draw: true,
+    grab: elementTools !== null,
+    annotate: elementTools !== null
+  }
+  const stages = BROWSER_CHROME_FOLD_ORDER.filter(
+    (stage) => present[stage] && stage !== pinnedStage
+  )
+  const folded = useBrowserChromeToolFold(rowRef, stages)
+
+  const [sharePopoverOpen, setSharePopoverOpen] = useState(false)
+  const afterMenuCloseRef = useRef<(() => void) | null>(null)
+
+  const foldedTools: BrowserChromeFoldedTool[] = []
+  if (elementTools && folded.has('grab')) {
+    foldedTools.push({
+      stage: 'grab',
+      label: translate('auto.components.browser.pane.BrowserPane.fdfc7fe0ef', 'Grab page element'),
+      icon: Crosshair,
+      onSelect: () => elementTools.onStartIntent('copy'),
+      disabled: elementTools.disabled,
+      shortcut: elementTools.grabShortcutLabel,
+      active: elementTools.activeIntent === 'copy'
+    })
+  }
+  if (elementTools && folded.has('annotate')) {
+    foldedTools.push({
+      stage: 'annotate',
+      label: translate(
+        'auto.components.browser.pane.BrowserPane.fc9be38f6f',
+        'Annotate page element'
+      ),
+      icon: MessageSquarePlus,
+      onSelect: () => elementTools.onStartIntent('annotate'),
+      disabled: elementTools.disabled,
+      count: elementTools.annotationCount,
+      active: elementTools.activeIntent === 'annotate'
+    })
+  }
+  if (folded.has('draw')) {
+    foldedTools.push({
+      stage: 'draw',
+      label: translate('auto.components.browser-pane.markup.drawButton', 'Draw on screenshot'),
+      icon: PenTool,
+      onSelect: markup.onToggle,
+      disabled: markup.disabled,
+      active: markup.active
+    })
+  }
+  if (shareControl && folded.has('share')) {
+    foldedTools.push({
+      stage: 'share',
+      label: translate(
+        'auto.components.artifacts.ArtifactPublishButton.a4a49da6af',
+        'Share as artifact'
+      ),
+      icon: Share2,
+      onSelect: () => setSharePopoverOpen(true),
+      deferUntilMenuClose: true
+    })
+  }
+  if (viewSource && folded.has('devtools') && !viewSource.alreadyInOverflowMenu) {
+    foldedTools.push({ stage: 'devtools', icon: SquareCode, ...viewSource })
+  }
+  if (openExternal && folded.has('external') && !openExternal.alreadyInOverflowMenu) {
+    foldedTools.push({ stage: 'external', icon: ExternalLink, ...openExternal })
+  }
+
+  const runAfterMenuClose = (action: () => void): void => {
+    afterMenuCloseRef.current = action
+  }
+  const onMenuCloseAutoFocus = (event: Event): void => {
+    const action = afterMenuCloseRef.current
+    if (!action) {
+      return
+    }
+    afterMenuCloseRef.current = null
+    event.preventDefault()
+    action()
+  }
+  const showFoldedAnnotationDot = folded.has('annotate') && (elementTools?.annotationCount ?? 0) > 0
+
   return (
     <BrowserNavigationControlRow
+      rowRef={rowRef}
       controls={controls}
       addressSlot={addressSlot}
       reloadControl={reloadControl}
       reloadLabel={reloadLabel}
       showTourAnchors={showTourAnchors}
     >
-      {importControl}
+      {folded.has('import') ? null : importControl?.(folded.has('import-label'))}
 
       {elementTools ? (
-        <>
-          <Tooltip>
-            <TooltipTrigger asChild>
-              <span className="inline-flex">
-                <Button
-                  size="icon"
-                  variant={elementTools.activeIntent === 'copy' ? 'default' : 'ghost'}
-                  className={cn(
-                    'h-8 w-8',
-                    elementTools.activeIntent === 'copy' &&
-                      'bg-foreground/80 text-background hover:bg-foreground/90'
-                  )}
-                  onClick={() => elementTools.onStartIntent('copy')}
-                  disabled={elementTools.disabled}
-                  aria-label={translate(
-                    'auto.components.browser.pane.BrowserPane.fdfc7fe0ef',
-                    'Grab page element'
-                  )}
-                  {...(showTourAnchors
-                    ? { 'data-contextual-tour-target': 'browser-grab-control' }
-                    : {})}
-                >
-                  <Crosshair className="size-4" />
-                </Button>
-              </span>
-            </TooltipTrigger>
-            <TooltipContent side="bottom" sideOffset={4}>
-              {translate(
-                'auto.components.browser.pane.BrowserPane.acbe79fd01',
-                'Grab page element ({{value0}})',
-                { value0: elementTools.grabShortcutLabel }
-              )}
-            </TooltipContent>
-          </Tooltip>
-
-          <Tooltip>
-            <TooltipTrigger asChild>
-              {/* Why: disabled <button> drops hover events, so wrap in a span so the tooltip trigger still fires. */}
-              <span className="inline-flex">
-                <Button
-                  size="icon"
-                  variant={elementTools.activeIntent === 'annotate' ? 'default' : 'ghost'}
-                  className={cn(
-                    'relative h-8 w-8',
-                    elementTools.activeIntent === 'annotate' &&
-                      'bg-foreground/80 text-background hover:bg-foreground/90'
-                  )}
-                  onClick={() => elementTools.onStartIntent('annotate')}
-                  disabled={elementTools.disabled}
-                  aria-label={translate(
-                    'auto.components.browser.pane.BrowserPane.fc9be38f6f',
-                    'Annotate page element'
-                  )}
-                  {...(showTourAnchors
-                    ? { 'data-contextual-tour-target': 'browser-annotation-control' }
-                    : {})}
-                >
-                  <MessageSquarePlus className="size-4" />
-                  {elementTools.annotationCount > 0 ? (
-                    <span className="absolute -top-1 -right-1 flex min-w-4 items-center justify-center rounded-full bg-primary px-1 text-[10px] leading-4 text-primary-foreground">
-                      {elementTools.annotationCount}
-                    </span>
-                  ) : null}
-                </Button>
-              </span>
-            </TooltipTrigger>
-            <TooltipContent side="bottom" sideOffset={4}>
-              {translate(
-                'auto.components.browser.pane.BrowserPane.fc9be38f6f',
-                'Annotate page element'
-              )}
-            </TooltipContent>
-          </Tooltip>
-        </>
+        <BrowserChromeElementToolButtons
+          tools={elementTools}
+          showGrab={!folded.has('grab')}
+          showAnnotate={!folded.has('annotate')}
+          showTourAnchors={showTourAnchors}
+        />
       ) : null}
 
-      <MarkupDrawButton
-        onClick={markup.onToggle}
-        disabled={markup.disabled}
-        active={markup.active}
-        surfaceActive={markup.canShowDiscoveryHint}
-      />
-
-      {shareControl}
-
-      {viewSource ? (
-        <Button
-          size="icon"
-          variant="ghost"
-          className="h-7 w-7"
-          onClick={viewSource.onSelect}
-          title={viewSource.label}
-          aria-label={viewSource.label}
-          disabled={viewSource.disabled}
-        >
-          <SquareCode className="size-4" />
-        </Button>
+      {folded.has('draw') ? null : (
+        <MarkupDrawButton
+          onClick={markup.onToggle}
+          disabled={markup.disabled}
+          active={markup.active}
+          surfaceActive={markup.canShowDiscoveryHint}
+        />
+      )}
+
+      {shareControl?.({
+        open: sharePopoverOpen,
+        onOpenChange: setSharePopoverOpen,
+        anchorRef: folded.has('share') ? overflowTriggerRef : undefined
+      })}
+
+      {viewSource && !folded.has('devtools') ? (
+        <BrowserChromeActionButton action={viewSource} icon={SquareCode} />
       ) : null}
 
-      {openExternal ? (
-        <Button
-          size="icon"
-          variant="ghost"
-          className="h-7 w-7"
-          onClick={openExternal.onSelect}
-          title={openExternal.label}
-          aria-label={openExternal.label}
-          disabled={openExternal.disabled}
-        >
-          <ExternalLink className="size-4" />
-        </Button>
+      {openExternal && !folded.has('external') ? (
+        <BrowserChromeActionButton action={openExternal} icon={ExternalLink} />
       ) : null}
 
-      {overflowMenu}
+      <span className="relative inline-flex">
+        {overflowMenu({
+          triggerRef: overflowTriggerRef,
+          tools: foldedTools,
+          deferUntilClose: runAfterMenuClose,
+          onMenuCloseAutoFocus
+        })}
+        {/* Why: keeps pending annotations visible once the annotate button has folded into ⋯. */}
+        {showFoldedAnnotationDot ? (
+          <span className="pointer-events-none absolute top-1 right-1 size-1.5 rounded-full bg-primary ring-2 ring-background" />
+        ) : null}
+      </span>
     </BrowserNavigationControlRow>
   )
 }
diff --git a/src/renderer/src/components/browser-pane/assemble-chrome/browser-navigation-control-row.tsx b/src/renderer/src/components/browser-pane/assemble-chrome/browser-navigation-control-row.tsx
index 236251c64ef5..999f890a37ff 100644
--- a/src/renderer/src/components/browser-pane/assemble-chrome/browser-navigation-control-row.tsx
+++ b/src/renderer/src/components/browser-pane/assemble-chrome/browser-navigation-control-row.tsx
@@ -36,6 +36,7 @@ export function BrowserNavigationControlRow({
   reloadControl,
   reloadLabel,
   showTourAnchors = true,
+  rowRef,
   children
 }: {
   controls: BrowserNavigationControls
@@ -46,10 +47,12 @@ export function BrowserNavigationControlRow({
   reloadLabel?: string
   /** Off for surfaces the browsing tour does not cover — a second anchor would steal its steps. */
   showTourAnchors?: boolean
+  rowRef?: React.Ref<HTMLDivElement>
   children?: React.ReactNode
 }): React.JSX.Element {
   return (
     <div
+      ref={rowRef}
       className="relative z-10 flex shrink-0 items-center gap-2 border-b border-border/70 bg-background/95 px-3 py-1.5"
       {...(showTourAnchors ? { 'data-contextual-tour-target': 'browser-toolbar' } : {})}
     >
diff --git a/src/renderer/src/components/browser-pane/assemble-chrome/browser-page-context-menu.tsx b/src/renderer/src/components/browser-pane/assemble-chrome/browser-page-context-menu.tsx
index fb1830bd41f5..22f12bfea4e4 100644
--- a/src/renderer/src/components/browser-pane/assemble-chrome/browser-page-context-menu.tsx
+++ b/src/renderer/src/components/browser-pane/assemble-chrome/browser-page-context-menu.tsx
@@ -11,6 +11,7 @@ import { createPortal } from 'react-dom'
 import { useAppStore } from '@/store'
 import { translate } from '@/i18n/i18n'
 import { normalizeExternalBrowserUrl } from '../../../../../shared/browser-url'
+import { resolveBrowserSourceUnifiedTab } from '@/lib/browser-workspace-source-resolution'
 import type { BrowserPageContextMenuState } from '../describe-page/browser-page-types'
 
 // `focus:` rather than `focus-visible:` — items are only ever focused programmatically
@@ -186,9 +187,18 @@ export function BrowserPageContextMenu({
               role="menuitem"
               className={MENU_ITEM_CLASS}
               onClick={() => {
+                const sourceUnifiedTab = resolveBrowserSourceUnifiedTab(
+                  useAppStore.getState(),
+                  browserPageId,
+                  worktreeId
+                )
                 createBrowserTab(worktreeId, contextMenu.linkUrl!, {
                   title: contextMenu.linkUrl!,
-                  activate: false
+                  activate: false,
+                  ...(sourceUnifiedTab ? { afterTabId: sourceUnifiedTab.id } : {}),
+                  ...(sourceUnifiedTab?.executionHostId
+                    ? { executionHostId: sourceUnifiedTab.executionHostId }
+                    : {})
                 })
                 closeMenu()
               }}
diff --git a/src/renderer/src/components/browser-pane/assemble-chrome/browser-page-toolbar.tsx b/src/renderer/src/components/browser-pane/assemble-chrome/browser-page-toolbar.tsx
index 616cca726ecb..f684e9a1b46a 100644
--- a/src/renderer/src/components/browser-pane/assemble-chrome/browser-page-toolbar.tsx
+++ b/src/renderer/src/components/browser-pane/assemble-chrome/browser-page-toolbar.tsx
@@ -1,6 +1,7 @@
 import type { Dispatch, RefObject, SetStateAction } from 'react'
 import { ArtifactPublishButton } from '@/components/artifacts/ArtifactPublishButton'
 import { translate } from '@/i18n/i18n'
+import { useAppStore } from '@/store'
 import type { BrowserReloadTrigger } from '../navigate/browser-reload-action'
 import BrowserAddressBar from './BrowserAddressBar'
 import { BrowserChromeToolbar } from './browser-chrome-toolbar'
@@ -102,9 +103,20 @@ export function BrowserPageToolbar({
   currentBrowserUrl: string
   externalUrl: string | null
 }): React.JSX.Element {
+  const browserTourStep = useAppStore((state) =>
+    state.activeContextualTourId === 'browser' ? state.activeContextualTourStepIndex : null
+  )
+  const pinnedStage =
+    browserTourStep === 0
+      ? ('grab' as const)
+      : browserTourStep === 1
+        ? ('annotate' as const)
+        : undefined
+
   return (
     <BrowserChromeToolbar
       showTourAnchors
+      pinnedStage={pinnedStage}
       controls={{
         canGoBack: canGoBack || Boolean(convertedFrom),
         canGoForward: canGoForward || Boolean(convertedTo),
@@ -161,7 +173,9 @@ export function BrowserPageToolbar({
           onHardReload={() => runReloadTrigger('hard-reload')}
         />
       }
-      importControl={<BrowserImportHintButton profileId={sessionProfileId} />}
+      importControl={(compact) => (
+        <BrowserImportHintButton profileId={sessionProfileId} compact={compact} />
+      )}
       elementTools={{
         activeIntent: grab.state !== 'idle' ? grabIntent : null,
         onStartIntent: startGrabIntent,
@@ -176,13 +190,16 @@ export function BrowserPageToolbar({
         canShowDiscoveryHint: isActive
       }}
       shareControl={
-        shareableArtifactFile ? (
-          <ArtifactPublishButton
-            sourceKey={shareableArtifactFile.filePath}
-            className="h-7 w-7"
-            createRequest={() => readBrowserHtmlArtifactRequest(currentBrowserUrl)}
-          />
-        ) : null
+        shareableArtifactFile
+          ? (control) => {
+              const props = {
+                sourceKey: shareableArtifactFile.filePath,
+                className: 'h-7 w-7',
+                createRequest: () => readBrowserHtmlArtifactRequest(currentBrowserUrl)
+              }
+              return <ArtifactPublishButton {...props} {...control} />
+            }
+          : undefined
       }
       viewSource={{
         onSelect: () => void window.api.browser.openDevTools({ browserPageId }),
@@ -204,7 +221,7 @@ export function BrowserPageToolbar({
         ),
         disabled: !externalUrl
       }}
-      overflowMenu={
+      overflowMenu={(overflow) => (
         <BrowserToolbarMenu
           currentProfileId={sessionProfileId}
           workspaceId={workspaceId}
@@ -212,8 +229,9 @@ export function BrowserPageToolbar({
           viewportPresetId={viewportPresetId}
           onDestroyWebview={() => destroyPersistentWebview(browserPageId)}
           isActive={isActive}
+          overflow={overflow}
         />
-      }
+      )}
     />
   )
 }
diff --git a/src/renderer/src/components/browser-pane/assemble-chrome/browser-toolbar-menu-dropdown.tsx b/src/renderer/src/components/browser-pane/assemble-chrome/browser-toolbar-menu-dropdown.tsx
index 0d088a44edd8..63098b9b2b48 100644
--- a/src/renderer/src/components/browser-pane/assemble-chrome/browser-toolbar-menu-dropdown.tsx
+++ b/src/renderer/src/components/browser-pane/assemble-chrome/browser-toolbar-menu-dropdown.tsx
@@ -30,6 +30,10 @@ type DetectedBrowserEntry = {
 }
 import { BROWSER_VIEWPORT_PRESETS } from '../../../../../shared/browser-viewport-presets'
 import { translate } from '@/i18n/i18n'
+import {
+  BrowserChromeFoldedMenuItems,
+  type BrowserChromeOverflowMenuProps
+} from './browser-chrome-folded-tools'
 
 type BrowserToolbarMenuDropdownProps = {
   menuOpen: boolean
@@ -45,6 +49,7 @@ type BrowserToolbarMenuDropdownProps = {
   onImportFromFile: () => void
   viewportPresetId: BrowserViewportPresetId | null
   onApplyViewportPreset: (nextId: BrowserViewportPresetId | null) => void
+  overflow: BrowserChromeOverflowMenuProps
 }
 
 export function BrowserToolbarMenuDropdown({
@@ -60,12 +65,14 @@ export function BrowserToolbarMenuDropdown({
   onImportFromBrowser,
   onImportFromFile,
   viewportPresetId,
-  onApplyViewportPreset
+  onApplyViewportPreset,
+  overflow
 }: BrowserToolbarMenuDropdownProps): React.JSX.Element {
   return (
     <DropdownMenu modal={false} open={menuOpen} onOpenChange={onMenuOpenChange}>
       <DropdownMenuTrigger asChild>
         <Button
+          ref={overflow.triggerRef}
           size="icon"
           variant="ghost"
           className="h-8 w-8"
@@ -77,7 +84,15 @@ export function BrowserToolbarMenuDropdown({
           <Ellipsis className="size-4" />
         </Button>
       </DropdownMenuTrigger>
-      <DropdownMenuContent align="end" className="w-56">
+      <DropdownMenuContent
+        align="end"
+        className="w-56"
+        onCloseAutoFocus={overflow.onMenuCloseAutoFocus}
+      >
+        <BrowserChromeFoldedMenuItems
+          tools={overflow.tools}
+          deferUntilClose={overflow.deferUntilClose}
+        />
         {allProfiles.map((profile) => {
           const isSelectedProfile = profile.id === effectiveProfileId
           return (
diff --git a/src/renderer/src/components/browser-pane/assemble-chrome/use-browser-chrome-tool-fold.test.tsx b/src/renderer/src/components/browser-pane/assemble-chrome/use-browser-chrome-tool-fold.test.tsx
new file mode 100644
index 000000000000..6edb0570a8cf
--- /dev/null
+++ b/src/renderer/src/components/browser-pane/assemble-chrome/use-browser-chrome-tool-fold.test.tsx
@@ -0,0 +1,159 @@
+// @vitest-environment happy-dom
+import { act, cleanup, render } from '@testing-library/react'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { useRef } from 'react'
+import { BROWSER_CHROME_ADDRESS_SLOT_ATTRIBUTE } from './browser-chrome-address-slot'
+import {
+  BROWSER_CHROME_ADDRESS_MIN_WIDTH_PX,
+  BROWSER_CHROME_FOLD_ORDER,
+  useBrowserChromeToolFold
+} from './use-browser-chrome-tool-fold'
+
+const FIXED_WIDTH = 100
+const TOOL_WIDTH = 30
+
+// A flex row where the address takes whatever the fixed controls and visible tools leave over.
+const layout = { rowWidth: 600, visibleTools: BROWSER_CHROME_FOLD_ORDER.length }
+let resizeCallbacks: (() => void)[] = []
+
+function Host({
+  onFolded,
+  stages = BROWSER_CHROME_FOLD_ORDER
+}: {
+  onFolded: (count: number) => void
+  stages?: readonly (typeof BROWSER_CHROME_FOLD_ORDER)[number][]
+}): React.JSX.Element {
+  const rowRef = useRef<HTMLDivElement>(null)
+  const folded = useBrowserChromeToolFold(rowRef, stages)
+  layout.visibleTools = stages.length - folded.size
+  onFolded(folded.size)
+  return (
+    <div ref={rowRef} data-testid="row">
+      <div {...{ [BROWSER_CHROME_ADDRESS_SLOT_ATTRIBUTE]: 'true' }} />
+    </div>
+  )
+}
+
+function contentWidth(): number {
+  return FIXED_WIDTH + TOOL_WIDTH * layout.visibleTools
+}
+
+beforeEach(() => {
+  resizeCallbacks = []
+  vi.stubGlobal(
+    'ResizeObserver',
+    class {
+      constructor(callback: () => void) {
+        resizeCallbacks.push(callback)
+      }
+      observe(): void {}
+      disconnect(): void {}
+    }
+  )
+  vi.spyOn(HTMLElement.prototype, 'clientWidth', 'get').mockImplementation(() => layout.rowWidth)
+  vi.spyOn(HTMLElement.prototype, 'scrollWidth', 'get').mockImplementation(() =>
+    Math.max(layout.rowWidth, contentWidth())
+  )
+  vi.spyOn(HTMLElement.prototype, 'getBoundingClientRect').mockImplementation(() =>
+    DOMRect.fromRect({ width: Math.max(0, layout.rowWidth - contentWidth()) })
+  )
+})
+
+afterEach(() => {
+  cleanup()
+  vi.restoreAllMocks()
+  vi.unstubAllGlobals()
+})
+
+function resizeTo(width: number): void {
+  layout.rowWidth = width
+  act(() => resizeCallbacks.forEach((callback) => callback()))
+}
+
+function expectedFolded(width: number): number {
+  const room = width - FIXED_WIDTH - BROWSER_CHROME_ADDRESS_MIN_WIDTH_PX
+  const fits = Math.max(0, Math.floor(room / TOOL_WIDTH))
+  return Math.max(0, BROWSER_CHROME_FOLD_ORDER.length - fits)
+}
+
+describe('useBrowserChromeToolFold', () => {
+  it('keeps every tool inline when the address has its minimum width', () => {
+    let folded = -1
+    layout.rowWidth = 600
+    render(<Host onFolded={(count) => (folded = count)} />)
+    expect(folded).toBe(0)
+  })
+
+  it('folds just enough tools to give the address its minimum width', () => {
+    let folded = -1
+    layout.rowWidth = 300
+    render(<Host onFolded={(count) => (folded = count)} />)
+    expect(folded).toBe(expectedFolded(300))
+    expect(folded).toBeGreaterThan(0)
+  })
+
+  it('unfolds as the row widens and refolds as it narrows', () => {
+    let folded = -1
+    layout.rowWidth = 600
+    render(<Host onFolded={(count) => (folded = count)} />)
+
+    resizeTo(260)
+    expect(folded).toBe(expectedFolded(260))
+
+    resizeTo(400)
+    expect(folded).toBe(expectedFolded(400))
+
+    resizeTo(700)
+    expect(folded).toBe(0)
+  })
+
+  it('folds everything but lets the address shrink once no tool is left', () => {
+    let folded = -1
+    layout.rowWidth = 150
+    render(<Host onFolded={(count) => (folded = count)} />)
+    expect(folded).toBe(BROWSER_CHROME_FOLD_ORDER.length)
+  })
+
+  it('leaves a hidden (zero-width) row alone', () => {
+    let folded = -1
+    layout.rowWidth = 0
+    render(<Host onFolded={(count) => (folded = count)} />)
+    expect(folded).toBe(0)
+  })
+
+  it('measures when a hidden row becomes visible', () => {
+    let folded = -1
+    layout.rowWidth = 0
+    render(<Host onFolded={(count) => (folded = count)} />)
+
+    resizeTo(300)
+    expect(folded).toBe(expectedFolded(300))
+  })
+
+  it('discards measurements when the available tools change', () => {
+    let folded = -1
+    layout.rowWidth = 300
+    const view = render(<Host onFolded={(count) => (folded = count)} />)
+    expect(folded).toBeGreaterThan(0)
+
+    view.rerender(<Host onFolded={(count) => (folded = count)} stages={['grab', 'annotate']} />)
+    expect(folded).toBe(0)
+
+    resizeTo(150)
+    expect(folded).toBe(2)
+  })
+
+  it('does not restore an obsolete fold level when a tool set returns', () => {
+    let folded = -1
+    layout.rowWidth = 300
+    const view = render(<Host onFolded={(count) => (folded = count)} />)
+    expect(folded).toBeGreaterThan(0)
+
+    layout.rowWidth = 600
+    view.rerender(<Host onFolded={(count) => (folded = count)} stages={['grab']} />)
+    expect(folded).toBe(0)
+
+    view.rerender(<Host onFolded={(count) => (folded = count)} />)
+    expect(folded).toBe(0)
+  })
+})
diff --git a/src/renderer/src/components/browser-pane/assemble-chrome/use-browser-chrome-tool-fold.ts b/src/renderer/src/components/browser-pane/assemble-chrome/use-browser-chrome-tool-fold.ts
new file mode 100644
index 000000000000..02b1fa7e9ec7
--- /dev/null
+++ b/src/renderer/src/components/browser-pane/assemble-chrome/use-browser-chrome-tool-fold.ts
@@ -0,0 +1,115 @@
+import { useLayoutEffect, useRef, useState, type RefObject } from 'react'
+import { BROWSER_CHROME_ADDRESS_SLOT_ATTRIBUTE } from './browser-chrome-address-slot'
+
+/**
+ * One step of toolbar compaction. Steps apply in this order as the row narrows, so the least-used
+ * tools leave first and the page tools the chrome exists for (grab, annotate) leave last.
+ */
+export type BrowserChromeFoldStage =
+  | 'import-label'
+  | 'external'
+  | 'devtools'
+  | 'share'
+  | 'import'
+  | 'draw'
+  | 'grab'
+  | 'annotate'
+
+export const BROWSER_CHROME_FOLD_ORDER: readonly BrowserChromeFoldStage[] = [
+  'import-label',
+  'external',
+  'devtools',
+  'share',
+  'import',
+  'draw',
+  'grab',
+  'annotate'
+]
+
+/** Below this the URL stops being readable, so tools fold before the address shrinks further. */
+export const BROWSER_CHROME_ADDRESS_MIN_WIDTH_PX = 120
+
+type RowMeasure = { address: number; overflow: number }
+
+function measureRow(row: HTMLElement | null): RowMeasure | null {
+  const slot = row?.querySelector(`[${BROWSER_CHROME_ADDRESS_SLOT_ATTRIBUTE}]`)
+  // Why: a hidden pane measures zero; folding everything there would flash on reveal.
+  if (!row || !slot || row.clientWidth === 0) {
+    return null
+  }
+  return {
+    address: slot.getBoundingClientRect().width,
+    overflow: Math.max(0, row.scrollWidth - row.clientWidth)
+  }
+}
+
+/**
+ * Folds `stages` one at a time until the address slot keeps its minimum width and the row stops
+ * overflowing, and unfolds as room returns.
+ *
+ * Why record the width each fold freed instead of re-measuring from zero on every resize: resetting
+ * would re-render the toolbar once per stage per resize frame. A fold is undone only when the
+ * address has that much slack, so an unfold can never immediately re-trigger its own fold.
+ */
+export function useBrowserChromeToolFold(
+  rowRef: RefObject<HTMLElement | null>,
+  stages: readonly BrowserChromeFoldStage[]
+): ReadonlySet<BrowserChromeFoldStage> {
+  const stagesKey = stages.join(',')
+  const [foldedCount, setFoldedCount] = useState(0)
+  const level = Math.min(foldedCount, stages.length)
+  const freedRef = useRef<{ stagesKey: string; widths: number[] }>({ stagesKey, widths: [] })
+  const pendingRef = useRef<(RowMeasure & { level: number }) | null>(null)
+
+  const checkRef = useRef<() => void>(() => {})
+  checkRef.current = () => {
+    if (freedRef.current.stagesKey !== stagesKey) {
+      freedRef.current = { stagesKey, widths: [] }
+      pendingRef.current = null
+    }
+    const measure = measureRow(rowRef.current)
+    if (!measure) {
+      return
+    }
+    const freed = freedRef.current.widths
+    const pending = pendingRef.current
+    if (pending && pending.level === level) {
+      freed[level - 1] = measure.address - pending.address + (pending.overflow - measure.overflow)
+      pendingRef.current = null
+    }
+    const shortfall =
+      Math.max(0, BROWSER_CHROME_ADDRESS_MIN_WIDTH_PX - measure.address) + measure.overflow
+    if (shortfall > 0.5 && level < stages.length) {
+      pendingRef.current = { ...measure, level: level + 1 }
+      setFoldedCount(level + 1)
+      return
+    }
+    const slack = measure.address - BROWSER_CHROME_ADDRESS_MIN_WIDTH_PX
+    if (shortfall <= 0.5 && level > 0 && slack >= (freed[level - 1] ?? 0)) {
+      setFoldedCount(level - 1)
+    }
+  }
+
+  // Why layout effect: each fold step re-measures before paint, so a squeeze never flashes clipped.
+  useLayoutEffect(() => {
+    checkRef.current()
+  }, [level, stagesKey])
+
+  useLayoutEffect(() => {
+    const row = rowRef.current
+    const slot = row?.querySelector(`[${BROWSER_CHROME_ADDRESS_SLOT_ATTRIBUTE}]`)
+    if (!row || typeof ResizeObserver === 'undefined') {
+      return
+    }
+    // Why both: the slot resizes when a sibling tool appears or hides, but stops resizing once it
+    // hits zero while the row keeps overflowing.
+    const observer = new ResizeObserver(() => checkRef.current())
+    observer.observe(row)
+    if (slot) {
+      observer.observe(slot)
+    }
+    return () => observer.disconnect()
+  }, [rowRef])
+
+  return new Set(stages.slice(0, level))
+}
diff --git a/src/renderer/src/components/browser-pane/navigate/browser-address-bar-navigation.test.ts b/src/renderer/src/components/browser-pane/navigate/browser-address-bar-navigation.test.ts
index a2f4cdc38ccb..2faf06e4929d 100644
--- a/src/renderer/src/components/browser-pane/navigate/browser-address-bar-navigation.test.ts
+++ b/src/renderer/src/components/browser-pane/navigate/browser-address-bar-navigation.test.ts
@@ -16,6 +16,17 @@ vi.mock('@/i18n/i18n', () => ({
 import { resolveBrowserAddressBarSubmission } from './browser-address-bar-navigation'
 
 describe('resolveBrowserAddressBarSubmission', () => {
+  it.each([
+    ['example.com:8443/docs', 'https://example.com:8443/docs'],
+    ['app.localhost:3000', 'http://app.localhost:3000/']
+  ])('submits %s as a navigation for local and client-hosted panes', (input, url) => {
+    expect(resolveBrowserAddressBarSubmission(input)).toEqual({ status: 'navigate', url })
+    expect(resolveBrowserAddressBarSubmission(input, { allowFileUrls: false })).toEqual({
+      status: 'navigate',
+      url
+    })
+  })
+
   it('falls back to the configured search engine instead of parsing a query as a host', () => {
     storeState.browserDefaultSearchEngine = 'google'
     expect(resolveBrowserAddressBarSubmission('google maps')).toEqual({
diff --git a/src/renderer/src/components/browser-pane/stream-remote/remote-browser-page-pane.tsx b/src/renderer/src/components/browser-pane/stream-remote/remote-browser-page-pane.tsx
index fb563f4c54b2..f447b5432d1b 100644
--- a/src/renderer/src/components/browser-pane/stream-remote/remote-browser-page-pane.tsx
+++ b/src/renderer/src/components/browser-pane/stream-remote/remote-browser-page-pane.tsx
@@ -5,6 +5,7 @@ import type { BrowserPage as BrowserPageState } from '../../../../../shared/brow
 import { runtimeEnvironmentSupportsCapability } from '@/runtime/runtime-rpc-client'
 import { convertBrowserPageToWorkspaceDoc } from '@/lib/file-preview'
 import { openWorkspaceBrowserTab } from '@/lib/workspace-browser-tab-open'
+import { resolveBrowserSourceUnifiedTab } from '@/lib/browser-workspace-source-resolution'
 import { useBrowserPageChromeFocus } from '../assemble-chrome/use-browser-page-chrome-focus'
 import { useBrowserAddressBarEditSession } from '../assemble-chrome/use-browser-address-bar-edit-session'
 import { useElementGuestFocus } from '../assemble-chrome/browser-page-guest-focus'
@@ -354,10 +355,17 @@ export function RemoteBrowserPagePane({
           onOpenLinkInOrcaBrowser={() => {
             const linkUrl = contextMenu.linkUrl!
             setContextMenu(null)
+            const sourceUnifiedTab = resolveBrowserSourceUnifiedTab(
+              useAppStore.getState(),
+              browserTab.id,
+              worktreeId
+            )
             void openWorkspaceBrowserTab({
               workspaceId: worktreeId,
               url: linkUrl,
+              ...(sourceUnifiedTab ? { afterTabId: sourceUnifiedTab.id } : {}),
               focusOnCreate: false,
+              selectWorktree: false,
               intent: { kind: 'url' },
               expectedRuntimeEnvironmentId: runtimeEnvironmentId,
               placementPreference: 'server'
diff --git a/src/renderer/src/components/browser-pane/use-ssh-workspace-browser-route.host-connection.test.tsx b/src/renderer/src/components/browser-pane/use-ssh-workspace-browser-route.host-connection.test.tsx
new file mode 100644
index 000000000000..26ee11c77ce8
--- /dev/null
+++ b/src/renderer/src/components/browser-pane/use-ssh-workspace-browser-route.host-connection.test.tsx
@@ -0,0 +1,225 @@
+// @vitest-environment happy-dom
+import { act, cleanup, renderHook } from '@testing-library/react'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { WorktreeHostConnection } from '@/lib/worktree-host-connection-phase'
+import type { SshConnectionStatus } from '../../../../shared/ssh-types'
+
+const mocks = vi.hoisted(() => {
+  const hostConnection: WorktreeHostConnection = {
+    phase: 'connecting',
+    targetId: 'target-a',
+    environmentId: null,
+    publishedStatus: 'connecting',
+    connectedEpoch: null
+  }
+  const route: { executionHostId: string | null } = { executionHostId: 'ssh:target-a' }
+  return { hostConnection, ...route, prepare: vi.fn() }
+})
+
+vi.mock('@/lib/worktree-runtime-owner', () => ({
+  getExecutionHostIdForWorktree: () => mocks.executionHostId
+}))
+vi.mock('@/lib/worktree-host-connection-phase', () => ({
+  selectWorktreeHostConnectionPhase: () => mocks.hostConnection,
+  useWorktreeHostConnection: () => mocks.hostConnection
+}))
+
+import { useSshWorkspaceBrowserRoute } from './use-ssh-workspace-browser-route'
+
+const READY_PARTITION = 'persist:orca-browser-v1-routed'
+
+const settle = () =>
+  act(async () => {
+    await new Promise((resolve) => setTimeout(resolve, 0))
+  })
+
+const STATUS_BY_PHASE: Record<WorktreeHostConnection['phase'], SshConnectionStatus | null> = {
+  local: null,
+  connecting: 'connecting',
+  connected: 'connected',
+  unavailable: 'disconnected',
+  unverifiable: null
+}
+
+function setHost(
+  phase: WorktreeHostConnection['phase'],
+  connectionGeneration: number | null = null
+): void {
+  mocks.hostConnection = {
+    phase,
+    targetId: 'target-a',
+    environmentId: null,
+    publishedStatus: STATUS_BY_PHASE[phase],
+    connectedEpoch: phase === 'connected' ? `target-a:${connectionGeneration}` : null
+  }
+}
+
+describe('useSshWorkspaceBrowserRoute under a reconnecting SSH host', () => {
+  beforeEach(() => {
+    mocks.prepare.mockReset()
+    mocks.executionHostId = 'ssh:target-a'
+    Object.defineProperty(window, 'api', {
+      configurable: true,
+      value: { browser: { prepareSshWorkspacePartition: mocks.prepare } }
+    })
+  })
+  afterEach(() => cleanup())
+
+  it('waits while the host connects, then prepares exactly once when it connects', async () => {
+    setHost('connecting')
+    mocks.prepare.mockResolvedValue({ partition: READY_PARTITION })
+    const { result, rerender } = renderHook(() => useSshWorkspaceBrowserRoute('wt-1', null))
+    await settle()
+    expect(result.current.state).toEqual({ kind: 'preparing' })
+    expect(mocks.prepare).not.toHaveBeenCalled()
+
+    setHost('connected', 1)
+    rerender()
+    await settle()
+    expect(mocks.prepare).toHaveBeenCalledOnce()
+    expect(result.current.state).toEqual({
+      kind: 'ready',
+      partition: READY_PARTITION,
+      targetId: 'target-a'
+    })
+  })
+
+  it('re-derives an ssh-unavailable error without Retry once the host connects', async () => {
+    setHost('unavailable')
+    mocks.prepare.mockRejectedValueOnce(new Error('browser_local_route_ssh_unavailable'))
+    mocks.prepare.mockResolvedValueOnce({ partition: READY_PARTITION })
+    const { result, rerender } = renderHook(() => useSshWorkspaceBrowserRoute('wt-1', null))
+    await settle()
+    expect(result.current.state.kind).toBe('error')
+
+    setHost('connecting')
+    rerender()
+    await settle()
+    // Why: a dial is a transient; the classified card stays until the host actually connects.
+    expect(result.current.state.kind).toBe('error')
+    expect(mocks.prepare).toHaveBeenCalledOnce()
+
+    setHost('connected', 1)
+    rerender()
+    await settle()
+    expect(mocks.prepare).toHaveBeenCalledTimes(2)
+    expect(result.current.state.kind).toBe('ready')
+  })
+
+  it('re-prepares a failed route when the host reconnects under a new generation', async () => {
+    setHost('connected', 1)
+    mocks.prepare.mockRejectedValueOnce(new Error('browser_local_route_ssh_unavailable'))
+    mocks.prepare.mockResolvedValueOnce({ partition: READY_PARTITION })
+    const { result, rerender } = renderHook(() => useSshWorkspaceBrowserRoute('wt-1', null))
+    await settle()
+    expect(result.current.state.kind).toBe('error')
+
+    setHost('connected', 2)
+    rerender()
+    await settle()
+    expect(mocks.prepare).toHaveBeenCalledTimes(2)
+    expect(result.current.state.kind).toBe('ready')
+  })
+
+  it('prepares once while connected and keeps a ready page mounted across a reconnect', async () => {
+    setHost('connected', 1)
+    mocks.prepare.mockResolvedValue({ partition: READY_PARTITION })
+    const { result, rerender } = renderHook(() => useSshWorkspaceBrowserRoute('wt-1', null))
+    await settle()
+    rerender()
+    rerender()
+    await settle()
+    expect(mocks.prepare).toHaveBeenCalledOnce()
+
+    setHost('connecting', 1)
+    rerender()
+    await settle()
+    expect(result.current.state.kind).toBe('ready')
+
+    setHost('connected', 2)
+    rerender()
+    await settle()
+    expect(mocks.prepare).toHaveBeenCalledOnce()
+    expect(result.current.state.kind).toBe('ready')
+  })
+
+  it('keeps a failed route on its card while another pane redials the host, then recovers on connect', async () => {
+    // The e2e sequence: the user disconnects, a browser tab classifies the dead host, and the
+    // workspace's terminal redials it. Dial transients must not swap the card for "preparing".
+    setHost('unavailable')
+    mocks.prepare.mockRejectedValueOnce(new Error('browser_local_route_ssh_unavailable'))
+    mocks.prepare.mockResolvedValueOnce({ partition: READY_PARTITION })
+    const { result, rerender } = renderHook(() => useSshWorkspaceBrowserRoute('wt-1', null))
+    await settle()
+    const card = result.current.state
+    expect(card).toMatchObject({ kind: 'error', errorKind: 'ssh-unavailable' })
+
+    for (const phase of ['connecting', 'unavailable', 'connecting', 'unavailable'] as const) {
+      setHost(phase)
+      rerender()
+      await settle()
+      expect(result.current.state).toEqual(card)
+    }
+    expect(mocks.prepare).toHaveBeenCalledOnce()
+
+    setHost('connected', 2)
+    rerender()
+    await settle()
+    expect(mocks.prepare).toHaveBeenCalledTimes(2)
+    expect(result.current.state.kind).toBe('ready')
+  })
+
+  it('waits for the connect when Retry is pressed while the host dials', async () => {
+    setHost('unavailable')
+    mocks.prepare.mockRejectedValueOnce(new Error('browser_local_route_ssh_unavailable'))
+    mocks.prepare.mockResolvedValueOnce({ partition: READY_PARTITION })
+    const { result, rerender } = renderHook(() => useSshWorkspaceBrowserRoute('wt-1', null))
+    await settle()
+    expect(result.current.state.kind).toBe('error')
+
+    setHost('connecting')
+    rerender()
+    await settle()
+    act(() => result.current.retry())
+    await settle()
+    expect(result.current.state).toEqual({ kind: 'preparing' })
+    expect(mocks.prepare).toHaveBeenCalledOnce()
+
+    setHost('connected', 1)
+    rerender()
+    await settle()
+    expect(mocks.prepare).toHaveBeenCalledTimes(2)
+    expect(result.current.state.kind).toBe('ready')
+  })
+
+  it('waits for a dialing host when the route becomes routed mid-dial', async () => {
+    // Why: an unrouted route is not an answer for the target it just gained.
+    mocks.executionHostId = null
+    setHost('connecting')
+    mocks.prepare.mockResolvedValue({ partition: READY_PARTITION })
+    const { result, rerender } = renderHook(() => useSshWorkspaceBrowserRoute('wt-1', null))
+    await settle()
+    expect(result.current.state).toEqual({ kind: 'unrouted' })
+
+    mocks.executionHostId = 'ssh:target-a'
+    rerender()
+    await settle()
+    expect(result.current.state).toEqual({ kind: 'preparing' })
+    expect(mocks.prepare).not.toHaveBeenCalled()
+
+    setHost('connected', 1)
+    rerender()
+    await settle()
+    expect(mocks.prepare).toHaveBeenCalledOnce()
+    expect(result.current.state.kind).toBe('ready')
+  })
+
+  it('prepares normally for a host it cannot verify instead of waiting on it', async () => {
+    setHost('unverifiable')
+    mocks.prepare.mockResolvedValue({ partition: READY_PARTITION })
+    const { result } = renderHook(() => useSshWorkspaceBrowserRoute('wt-1', null))
+    await settle()
+    expect(mocks.prepare).toHaveBeenCalledOnce()
+    expect(result.current.state.kind).toBe('ready')
+  })
+})
diff --git a/src/renderer/src/components/browser-pane/use-ssh-workspace-browser-route.ts b/src/renderer/src/components/browser-pane/use-ssh-workspace-browser-route.ts
index b7a1e432664f..6af3275c14c5 100644
--- a/src/renderer/src/components/browser-pane/use-ssh-workspace-browser-route.ts
+++ b/src/renderer/src/components/browser-pane/use-ssh-workspace-browser-route.ts
@@ -1,6 +1,7 @@
 import { useEffect, useState } from 'react'
 import { useAppStore } from '@/store'
 import { getExecutionHostIdForWorktree } from '@/lib/worktree-runtime-owner'
+import { useWorktreeHostConnection } from '@/lib/worktree-host-connection-phase'
 import { resolveSshWorkspaceBrowserRouteEligibility } from '@/lib/ssh-workspace-browser-route-eligibility'
 
 export type SshWorkspaceBrowserRouteErrorKind = 'forwarding-blocked' | 'ssh-unavailable' | 'unknown'
@@ -64,6 +65,24 @@ export function useSshWorkspaceBrowserRoute(
   const [state, setState] = useState<SshWorkspaceBrowserRouteState>(
     targetId ? { kind: 'preparing' } : { kind: 'unrouted' }
   )
+  const hostConnection = useWorktreeHostConnection(worktreeId)
+  const routeHost =
+    targetId !== null && hostConnection.targetId === targetId ? hostConnection : null
+  // Why only an unsettled route waits: a dial is a transient, so it must not unmount a ready
+  // page or swap a failed route's card for "preparing". A connect (below) re-derives a failed one.
+  // Unrouted and another target's page are unsettled too: neither answers for this target.
+  const routeReady = state.kind === 'ready' && state.targetId === targetId
+  const awaitingHost = routeHost?.phase === 'connecting' && state.kind !== 'error' && !routeReady
+  const connectedHostEpoch = routeHost?.connectedEpoch ?? null
+  const [seenConnectedHostEpoch, setSeenConnectedHostEpoch] = useState(connectedHostEpoch)
+  if (connectedHostEpoch !== seenConnectedHostEpoch) {
+    setSeenConnectedHostEpoch(connectedHostEpoch)
+    // Why: a host that connects — or reconnects under a new generation — re-derives a route
+    // it failed or held, the same as Retry, but keeps the user's probe choice.
+    if (connectedHostEpoch !== null && !routeReady) {
+      setAttempt((current) => ({ ...current, count: current.count + 1 }))
+    }
+  }
 
   // Why: a persisted "Try anyway" means the user vouched for this host once
   // (e.g. PermitOpen allows their sites while the loopback probe is refused);
@@ -74,8 +93,13 @@ export function useSshWorkspaceBrowserRoute(
       setState({ kind: 'unrouted' })
       return
     }
-    let cancelled = false
     setState({ kind: 'preparing' })
+    // Why: the SSH connection is still being established, so prepare could only fail with
+    // ssh-unavailable; the connected transition above restarts it.
+    if (awaitingHost) {
+      return
+    }
+    let cancelled = false
     window.api.browser
       .prepareSshWorkspacePartition({
         targetId,
@@ -100,7 +124,7 @@ export function useSshWorkspaceBrowserRoute(
     return () => {
       cancelled = true
     }
-  }, [targetId, browserProfileId, attempt, skipProbe])
+  }, [targetId, browserProfileId, attempt, skipProbe, awaitingHost])
 
   // Why (review P1-1): `state` lags one commit behind a targetId transition on
   // an already-mounted instance; returning stale 'unrouted' (or a stale
@@ -109,13 +133,21 @@ export function useSshWorkspaceBrowserRoute(
   // routed/unrouted decision must be derived from targetId in-render.
   const effectiveState: SshWorkspaceBrowserRouteState = !targetId
     ? { kind: 'unrouted' }
-    : state.kind === 'unrouted' || (state.kind === 'ready' && state.targetId !== targetId)
+    : awaitingHost ||
+        state.kind === 'unrouted' ||
+        (state.kind === 'ready' && state.targetId !== targetId)
       ? { kind: 'preparing' }
       : state
+  const rederive = (nextSkipProbe: boolean): void => {
+    // Why: landing on preparing with the new attempt lets the effect's first run see a dialing
+    // host and wait, instead of starting a prepare that its own preparing write then cancels.
+    setState({ kind: 'preparing' })
+    setAttempt((current) => ({ count: current.count + 1, skipProbe: nextSkipProbe }))
+  }
   return {
     state: effectiveState,
     targetId: sshTargetId,
-    retry: () => setAttempt((current) => ({ count: current.count + 1, skipProbe: false })),
+    retry: () => rederive(false),
     tryWithoutProbe: () => {
       // Persist the override so this host isn't re-nagged on every launch.
       if (sshTargetId && probeSkippedTargetIds?.includes(sshTargetId) !== true) {
@@ -126,7 +158,7 @@ export function useSshWorkspaceBrowserRoute(
           ]
         })
       }
-      setAttempt((current) => ({ count: current.count + 1, skipProbe: true }))
+      rederive(true)
     },
     browseFromThisDevice: () => {
       if (!sshTargetId) {
diff --git a/src/renderer/src/components/browser-pane/workspace-doc/HtmlDocPreview.toolbar.test.tsx b/src/renderer/src/components/browser-pane/workspace-doc/HtmlDocPreview.toolbar.test.tsx
index aaee9c6243f8..602581dc16d8 100644
--- a/src/renderer/src/components/browser-pane/workspace-doc/HtmlDocPreview.toolbar.test.tsx
+++ b/src/renderer/src/components/browser-pane/workspace-doc/HtmlDocPreview.toolbar.test.tsx
@@ -621,11 +621,11 @@ describe('HtmlDocPreview guest focus', () => {
 
   beforeEach(() => {
     focused = []
-    focusSpy = vi
-      .spyOn(HTMLElement.prototype, 'focus')
-      .mockImplementation(function (this: HTMLElement) {
-        focused.push(this)
-      })
+    focusSpy = vi.spyOn(HTMLElement.prototype, 'focus').mockImplementation(function (
+      this: HTMLElement
+    ) {
+      focused.push(this)
+    })
     container = document.createElement('div')
     document.body.appendChild(container)
     root = createRoot(container)
diff --git a/src/renderer/src/components/browser-pane/workspace-doc/doc-preview-overflow-menu.tsx b/src/renderer/src/components/browser-pane/workspace-doc/doc-preview-overflow-menu.tsx
index 801d153b28bf..29e35d8f87e3 100644
--- a/src/renderer/src/components/browser-pane/workspace-doc/doc-preview-overflow-menu.tsx
+++ b/src/renderer/src/components/browser-pane/workspace-doc/doc-preview-overflow-menu.tsx
@@ -8,6 +8,10 @@ import {
   DropdownMenuTrigger
 } from '@/components/ui/dropdown-menu'
 import { translate } from '@/i18n/i18n'
+import {
+  BrowserChromeFoldedMenuItems,
+  type BrowserChromeOverflowMenuProps
+} from '../assemble-chrome/browser-chrome-folded-tools'
 
 /**
  * The preview's overflow menu. It carries the document actions rather than the browsing pane's
@@ -18,7 +22,8 @@ export function DocPreviewOverflowMenu({
   onHardReload,
   onOpenSource,
   onCopyPath,
-  onCopyRelativePath
+  onCopyRelativePath,
+  overflow
 }: {
   onReload: () => void
   onHardReload: () => void
@@ -26,11 +31,13 @@ export function DocPreviewOverflowMenu({
   onCopyPath: () => void
   /** Why it lives here: the preview hides the editor's path header, which was the only way to copy it. */
   onCopyRelativePath: () => void
+  overflow: BrowserChromeOverflowMenuProps
 }): React.JSX.Element {
   return (
     <DropdownMenu>
       <DropdownMenuTrigger asChild>
         <Button
+          ref={overflow.triggerRef}
           size="icon"
           variant="ghost"
           className="h-7 w-7"
@@ -42,7 +49,11 @@ export function DocPreviewOverflowMenu({
           <MoreHorizontal className="size-4" />
         </Button>
       </DropdownMenuTrigger>
-      <DropdownMenuContent align="end">
+      <DropdownMenuContent align="end" onCloseAutoFocus={overflow.onMenuCloseAutoFocus}>
+        <BrowserChromeFoldedMenuItems
+          tools={overflow.tools}
+          deferUntilClose={overflow.deferUntilClose}
+        />
         <DropdownMenuItem onSelect={onReload}>
           <RefreshCw className="size-3.5" />
           {translate('auto.components.browser.pane.BrowserPane.0e080d820e', 'Reload')}
diff --git a/src/renderer/src/components/browser-pane/workspace-doc/doc-preview-toolbar.tsx b/src/renderer/src/components/browser-pane/workspace-doc/doc-preview-toolbar.tsx
index df8f9116ca23..871323a9aef1 100644
--- a/src/renderer/src/components/browser-pane/workspace-doc/doc-preview-toolbar.tsx
+++ b/src/renderer/src/components/browser-pane/workspace-doc/doc-preview-toolbar.tsx
@@ -102,7 +102,8 @@ export function DocPreviewToolbar({
         label: translate(
           'auto.components.editor.HtmlDocPreview.openSourceControl',
           'Open source file'
-        )
+        ),
+        alreadyInOverflowMenu: true
       }}
       openExternal={{
         onSelect: onOpenExternally,
@@ -111,15 +112,16 @@ export function DocPreviewToolbar({
           'Open with default app'
         )
       }}
-      overflowMenu={
+      overflowMenu={(overflow) => (
         <DocPreviewOverflowMenu
           onReload={onReload}
           onHardReload={onHardReload}
           onOpenSource={onOpenSource}
           onCopyPath={onCopyPath}
           onCopyRelativePath={onCopyRelativePath}
+          overflow={overflow}
         />
-      }
+      )}
     />
   )
 }
diff --git a/src/renderer/src/components/dashboard-popout/AgentTerminalPreview.settings-geometry.test.tsx b/src/renderer/src/components/dashboard-popout/AgentTerminalPreview.settings-geometry.test.tsx
new file mode 100644
index 000000000000..8ddb8a8ae757
--- /dev/null
+++ b/src/renderer/src/components/dashboard-popout/AgentTerminalPreview.settings-geometry.test.tsx
@@ -0,0 +1,254 @@
+// @vitest-environment happy-dom
+
+import { act, cleanup, render } from '@testing-library/react'
+import { afterEach, beforeEach, expect, it, vi } from 'vitest'
+import type { ITerminalOptions } from '@xterm/xterm'
+import type { GlobalSettings } from '../../../../shared/global-settings-types'
+import type { TerminalPreviewConnectResult } from '../../../../shared/terminal-preview'
+import { createGlobalSettingsFixture } from '../../../../shared/global-settings-test-fixture'
+import { useAppStore } from '@/store'
+import { AgentTerminalPreview } from './AgentTerminalPreview'
+
+type PreviewInstance = {
+  options: ITerminalOptions
+  container: HTMLElement | null
+  dispose: ReturnType<typeof vi.fn>
+}
+const harness = vi.hoisted(() => ({ instances: new Array<PreviewInstance>() }))
+
+vi.mock('@xterm/xterm', () => ({
+  Terminal: class {
+    cols = 80
+    rows = 24
+    buffer = { active: { cursorY: 14 } }
+    container: HTMLElement | null = null
+    screen = document.createElement('div')
+    write = vi.fn((_data: string, callback?: () => void) => callback?.())
+    focus = vi.fn()
+    resize = vi.fn()
+    reset = vi.fn()
+    onData = vi.fn(() => ({ dispose: vi.fn() }))
+    dispose = vi.fn(() => this.screen.remove())
+    constructor(public options: ITerminalOptions) {
+      harness.instances.push(this)
+    }
+    open(container: HTMLElement): void {
+      this.container = container
+      this.screen.className = 'xterm-screen'
+      Object.defineProperties(this.screen, {
+        offsetWidth: {
+          get: () =>
+            this.cols *
+            (this.options.fontSize === 18 ||
+            this.options.fontFamily?.includes('Fira Code') ||
+            this.options.fontWeight === 900 ||
+            this.options.fontWeightBold === 900
+              ? 12
+              : 10)
+        },
+        offsetHeight: { get: () => this.rows * 16 * (this.options.lineHeight ?? 1) }
+      })
+      const box = container.parentElement
+      if (!box) {
+        throw new Error('Missing preview box')
+      }
+      Object.defineProperties(box, {
+        clientWidth: { configurable: true, value: 600 },
+        clientHeight: { configurable: true, value: 240 }
+      })
+      container.append(this.screen)
+    }
+  }
+}))
+vi.mock('@/components/terminal-pane/terminal-user-input-signal', () => ({
+  subscribeToTerminalUserInput: () => ({ dispose: vi.fn() })
+}))
+vi.mock('@/components/terminal-pane/use-system-prefers-dark', () => ({
+  useSystemPrefersDark: () => false
+}))
+vi.mock('@/lib/keyboard-layout/use-effective-mac-option-as-alt', () => ({
+  useEffectiveMacOptionAsAlt: (value: string) => value
+}))
+vi.mock('./preview-terminal-ligatures', () => ({ syncPreviewTerminalLigatures: vi.fn() }))
+vi.mock('./preview-terminal-compatibility', () => ({
+  installPreviewTerminalCompatibility: () => vi.fn()
+}))
+vi.mock('./preview-terminal-ime-bridge', () => ({
+  installPreviewImeBridge: () => ({ claimKeyEvent: () => false, dispose: vi.fn() })
+}))
+vi.mock('./preview-terminal-key-handler', () => ({
+  installPreviewTerminalKeyHandler: () => vi.fn()
+}))
+vi.mock('@/components/terminal-pane/terminal-native-copy-gutter', () => ({
+  installTerminalNativeCopyGutterTrim: () => ({ dispose: vi.fn() })
+}))
+vi.mock('./preview-terminal-app-menu-clipboard', () => ({
+  installPreviewTerminalAppMenuClipboard: () => vi.fn()
+}))
+vi.mock('./preview-terminal-right-click-paste', () => ({
+  installPreviewTerminalRightClickPaste: () => vi.fn()
+}))
+
+const initial = useAppStore.getInitialState()
+const connect = vi.fn<Window['api']['terminalPreview']['connect']>()
+const fit = vi.fn(async (_ptyId: string, cols: number, rows: number) => ({ cols, rows }))
+const unsubscribe = vi.fn(async () => {})
+let settings: GlobalSettings
+let originalApi: PropertyDescriptor | undefined
+
+beforeEach(() => {
+  vi.useFakeTimers()
+  vi.clearAllMocks()
+  harness.instances.length = 0
+  // No resize notification or later output: replay must perform its own fit and grid claim.
+  vi.stubGlobal(
+    'ResizeObserver',
+    class {
+      observe = vi.fn()
+      disconnect = vi.fn()
+    }
+  )
+  settings = createGlobalSettingsFixture({
+    theme: 'dark',
+    activeRuntimeEnvironmentId: null,
+    terminalFontSize: 14,
+    terminalFontFamily: 'JetBrains Mono',
+    terminalFontWeight: 500,
+    terminalFontWeightBold: 700,
+    terminalLineHeight: 1,
+    terminalLigatures: 'off'
+  })
+  connect
+    .mockReset()
+    .mockResolvedValue({ snapshot: { data: '', cols: 80, rows: 24, seq: 1 }, replay: [] })
+  originalApi = Object.getOwnPropertyDescriptor(window, 'api')
+  Object.defineProperty(window, 'api', {
+    configurable: true,
+    value: {
+      settings: {
+        set: async (updates: Partial<GlobalSettings>) => {
+          settings = structuredClone({ ...settings, ...updates })
+          return settings
+        }
+      },
+      terminalPreview: { connect, fit, unsubscribe, onData: () => vi.fn() }
+    }
+  })
+  useAppStore.setState({ ...initial, settings }, true)
+})
+
+afterEach(() => {
+  cleanup()
+  for (const instance of harness.instances) {
+    expect(instance.dispose).toHaveBeenCalledOnce()
+  }
+  useAppStore.setState(initial, true)
+  if (originalApi) {
+    Object.defineProperty(window, 'api', originalApi)
+  } else {
+    Reflect.deleteProperty(window, 'api')
+  }
+  vi.unstubAllGlobals()
+  vi.useRealTimers()
+})
+
+async function settleGeometry(): Promise<void> {
+  await act(async () => {
+    await vi.advanceTimersByTimeAsync(250)
+  })
+}
+
+it.each([
+  {
+    updates: { terminalFontSize: 18 },
+    cols: 50,
+    rows: 15,
+    scale: 'scale(0.625)',
+    anchor: 'top left'
+  },
+  {
+    updates: { terminalFontFamily: 'Fira Code' },
+    cols: 50,
+    rows: 15,
+    scale: 'scale(0.625)',
+    anchor: 'top left'
+  },
+  {
+    updates: { terminalFontWeight: 900 },
+    cols: 50,
+    rows: 15,
+    scale: 'scale(0.625)',
+    anchor: 'top left'
+  },
+  {
+    updates: { terminalFontWeightBold: 900 },
+    cols: 50,
+    rows: 15,
+    scale: 'scale(0.625)',
+    anchor: 'top left'
+  },
+  {
+    updates: { terminalLineHeight: 1.5 },
+    cols: 60,
+    rows: 10,
+    scale: 'scale(0.75)',
+    anchor: 'bottom left'
+  },
+  {
+    updates: { terminalLigatures: 'on' },
+    cols: 60,
+    rows: 15,
+    scale: 'scale(0.75)',
+    anchor: 'top left'
+  }
+] satisfies {
+  updates: Partial<GlobalSettings>
+  cols: number
+  rows: number
+  scale: string
+  anchor: string
+}[])(
+  'recreates the owner and fits the new geometry for $updates',
+  async ({ updates, cols, rows, scale, anchor }) => {
+    render(<AgentTerminalPreview ptyId="pty-1" />)
+    await settleGeometry()
+    expect(fit).toHaveBeenLastCalledWith('pty-1', 60, 15)
+    await act(async () => useAppStore.getState().updateSettings(updates))
+    await settleGeometry()
+
+    expect(fit).toHaveBeenCalledTimes(2)
+    expect(fit).toHaveBeenLastCalledWith('pty-1', cols, rows)
+    expect(harness.instances).toHaveLength(2)
+    expect(connect).toHaveBeenCalledTimes(2)
+    expect(unsubscribe).toHaveBeenCalledExactlyOnceWith('pty-1')
+    expect(harness.instances[1]?.container?.style.transform).toBe(scale)
+    expect(harness.instances[1]?.container?.style.transformOrigin).toBe(anchor)
+  }
+)
+
+it('ignores a pending connection retired by a metric change', async () => {
+  const gate = Promise.withResolvers<TerminalPreviewConnectResult>()
+  connect.mockReturnValueOnce(gate.promise)
+  render(<AgentTerminalPreview ptyId="pty-1" />)
+  await act(async () => useAppStore.getState().updateSettings({ terminalFontSize: 18 }))
+  await settleGeometry()
+  await act(async () =>
+    gate.resolve({ snapshot: { data: '', cols: 80, rows: 24, seq: 1 }, replay: [] })
+  )
+  await settleGeometry()
+  expect(connect).toHaveBeenCalledTimes(2)
+  expect(harness.instances).toHaveLength(1)
+  expect(harness.instances[0]?.options.fontSize).toBe(18)
+  expect(fit).toHaveBeenCalledExactlyOnceWith('pty-1', 50, 15)
+})
+
+it('cancels an obsolete metric owner grid claim before the next change', async () => {
+  render(<AgentTerminalPreview ptyId="pty-1" />)
+  await settleGeometry()
+  await act(async () => useAppStore.getState().updateSettings({ terminalFontSize: 18 }))
+  await act(async () => useAppStore.getState().updateSettings({ terminalLineHeight: 1.5 }))
+  await settleGeometry()
+  expect(harness.instances).toHaveLength(3)
+  expect(fit).toHaveBeenCalledTimes(2)
+  expect(fit).toHaveBeenLastCalledWith('pty-1', 50, 10)
+})
diff --git a/src/renderer/src/components/dashboard-popout/AgentTerminalPreview.settings-lifetime.test.tsx b/src/renderer/src/components/dashboard-popout/AgentTerminalPreview.settings-lifetime.test.tsx
new file mode 100644
index 000000000000..84c0242e186c
--- /dev/null
+++ b/src/renderer/src/components/dashboard-popout/AgentTerminalPreview.settings-lifetime.test.tsx
@@ -0,0 +1,292 @@
+// @vitest-environment happy-dom
+
+import { act, cleanup, render } from '@testing-library/react'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { ITerminalOptions } from '@xterm/xterm'
+import type { GlobalSettings } from '../../../../shared/global-settings-types'
+import type { TerminalPreviewConnectResult } from '../../../../shared/terminal-preview'
+import { createGlobalSettingsFixture } from '../../../../shared/global-settings-test-fixture'
+import { makeCustomTerminalThemeSelection } from '../../../../shared/terminal-custom-themes'
+import { useAppStore } from '@/store'
+import { AgentTerminalPreview } from './AgentTerminalPreview'
+
+type PreviewInstance = {
+  options: ITerminalOptions
+  dispose: ReturnType<typeof vi.fn>
+  reset: ReturnType<typeof vi.fn>
+}
+
+const harness = vi.hoisted(() => ({
+  instances: new Array<PreviewInstance>(),
+  systemPrefersDark: false
+}))
+
+vi.mock('@xterm/xterm', () => ({
+  Terminal: class {
+    cols = 80
+    rows = 24
+    buffer = { active: { cursorY: 0 } }
+    options: ITerminalOptions
+    write = vi.fn((_data: string, callback?: () => void) => callback?.())
+    open = vi.fn()
+    focus = vi.fn()
+    dispose = vi.fn()
+    resize = vi.fn()
+    reset = vi.fn()
+    onData = vi.fn(() => ({ dispose: vi.fn() }))
+    constructor(options: ITerminalOptions) {
+      this.options = options
+      harness.instances.push(this)
+    }
+  }
+}))
+vi.mock('@/components/terminal-pane/terminal-user-input-signal', () => ({
+  subscribeToTerminalUserInput: () => ({ dispose: vi.fn() })
+}))
+vi.mock('@/components/terminal-pane/use-system-prefers-dark', () => ({
+  useSystemPrefersDark: () => harness.systemPrefersDark
+}))
+vi.mock('@/lib/keyboard-layout/use-effective-mac-option-as-alt', () => ({
+  useEffectiveMacOptionAsAlt: (value: string) => value
+}))
+vi.mock('./preview-grid-claim', () => ({
+  createPreviewGridClaim: () => ({ schedule: vi.fn(), dispose: vi.fn() })
+}))
+vi.mock('./preview-terminal-box-fit', () => ({
+  createPreviewBoxFit: () => ({ schedule: vi.fn() })
+}))
+vi.mock('./preview-terminal-ligatures', () => ({ syncPreviewTerminalLigatures: vi.fn() }))
+vi.mock('./preview-terminal-compatibility', () => ({
+  installPreviewTerminalCompatibility: () => vi.fn()
+}))
+vi.mock('./preview-terminal-ime-bridge', () => ({
+  installPreviewImeBridge: () => ({ claimKeyEvent: () => false, dispose: vi.fn() })
+}))
+vi.mock('./preview-terminal-key-handler', () => ({
+  installPreviewTerminalKeyHandler: () => vi.fn()
+}))
+vi.mock('@/components/terminal-pane/terminal-native-copy-gutter', () => ({
+  installTerminalNativeCopyGutterTrim: () => ({ dispose: vi.fn() })
+}))
+vi.mock('./preview-terminal-app-menu-clipboard', () => ({
+  installPreviewTerminalAppMenuClipboard: () => vi.fn()
+}))
+vi.mock('./preview-terminal-right-click-paste', () => ({
+  installPreviewTerminalRightClickPaste: () => vi.fn()
+}))
+
+const initial = useAppStore.getInitialState()
+const connect = vi.fn<Window['api']['terminalPreview']['connect']>()
+const unsubscribe = vi.fn(async () => {})
+const offData = vi.fn()
+const onData = vi.fn((listener: Parameters<Window['api']['terminalPreview']['onData']>[0]) => {
+  emitData = listener
+  return offData
+})
+const connection: TerminalPreviewConnectResult = {
+  snapshot: { data: 'agent prompt', cols: 80, rows: 24, seq: 1 },
+  replay: []
+}
+let settings: GlobalSettings
+let originalApi: PropertyDescriptor | undefined
+let emitData: Parameters<Window['api']['terminalPreview']['onData']>[0] | undefined
+
+async function updateSettings(updates: Partial<GlobalSettings>): Promise<void> {
+  await act(async () => useAppStore.getState().updateSettings(updates))
+}
+
+function terminal(index = 0): PreviewInstance {
+  const instance = harness.instances[index]
+  if (!instance) {
+    throw new Error(`Missing terminal ${index}`)
+  }
+  return instance
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  harness.instances.length = 0
+  harness.systemPrefersDark = false
+  emitData = undefined
+  settings = createGlobalSettingsFixture({ theme: 'dark', activeRuntimeEnvironmentId: null })
+  connect.mockReset().mockResolvedValue(connection)
+  originalApi = Object.getOwnPropertyDescriptor(window, 'api')
+  Object.defineProperty(window, 'api', {
+    configurable: true,
+    value: {
+      settings: {
+        set: async (updates: Partial<GlobalSettings>) => {
+          settings = structuredClone({ ...settings, ...updates })
+          return settings
+        }
+      },
+      terminalPreview: {
+        connect,
+        unsubscribe,
+        onData
+      }
+    }
+  })
+  useAppStore.setState({ ...initial, settings }, true)
+})
+
+afterEach(() => {
+  cleanup()
+  for (const instance of harness.instances) {
+    expect(instance.dispose).toHaveBeenCalledOnce()
+  }
+  expect(offData).toHaveBeenCalledTimes(onData.mock.calls.length)
+  useAppStore.setState(initial, true)
+  if (originalApi) {
+    Object.defineProperty(window, 'api', originalApi)
+  } else {
+    Reflect.deleteProperty(window, 'api')
+  }
+})
+
+describe('preview terminal settings lifetime', () => {
+  it('keeps one preview connection across ten unrelated settings snapshots', async () => {
+    render(<AgentTerminalPreview ptyId="pty-1" />)
+    await act(async () => {})
+    const theme = terminal().options.theme
+    for (let index = 1; index <= 10; index += 1) {
+      await updateSettings({ editorAutoSaveDelayMs: 1000 + index })
+    }
+    expect(connect).toHaveBeenCalledExactlyOnceWith('pty-1', { scrollbackRows: 24 })
+    expect(harness.instances).toHaveLength(1)
+    expect(terminal().options.theme).toBe(theme)
+    expect(unsubscribe).not.toHaveBeenCalled()
+  })
+
+  it('updates cursor options on the existing terminal', async () => {
+    render(<AgentTerminalPreview ptyId="pty-1" />)
+    await act(async () => {})
+    await updateSettings({
+      terminalCursorStyle: 'bar',
+      terminalCursorBlink: false
+    })
+    expect(connect).toHaveBeenCalledOnce()
+    expect(terminal().options).toMatchObject({
+      cursorStyle: 'bar',
+      cursorBlink: false
+    })
+  })
+
+  it.each([
+    { terminalThemeDark: 'Builtin Tango Light' },
+    { terminalColorOverrides: { background: '#123456' } },
+    { terminalBackgroundOpacity: 0.5 },
+    { terminalCursorOpacity: 0.5 },
+    { terminalMinimumContrastRatio: 7 }
+  ] satisfies Partial<GlobalSettings>[])(
+    'replaces the terminal when theme or contrast changes: %o',
+    async (updates) => {
+      render(<AgentTerminalPreview ptyId="pty-1" />)
+      await act(async () => {})
+      await updateSettings(updates)
+      expect(connect).toHaveBeenCalledTimes(2)
+      expect(unsubscribe).toHaveBeenCalledExactlyOnceWith('pty-1')
+      expect(terminal().dispose).toHaveBeenCalledOnce()
+      expect(harness.instances).toHaveLength(2)
+      if ('terminalMinimumContrastRatio' in updates) {
+        expect(terminal(1).options.minimumContrastRatio).toBe(7)
+      } else {
+        expect(terminal(1).options.theme).not.toEqual(terminal().options.theme)
+      }
+    }
+  )
+
+  it('keeps a cloned imported theme but reconnects when its selected colors change', async () => {
+    const custom = {
+      id: 'manual:preview',
+      name: 'Preview',
+      source: 'manual' as const,
+      mode: 'dark' as const,
+      terminal: { background: '#123456', foreground: '#eeeeee', red: '#ff0000' },
+      importedAt: '2026-09-25'
+    }
+    await updateSettings({
+      terminalCustomThemes: [custom],
+      terminalThemeDark: makeCustomTerminalThemeSelection(custom.id)
+    })
+    render(<AgentTerminalPreview ptyId="pty-1" />)
+    await act(async () => {})
+    expect(terminal().options.theme?.background).toBe('#123456')
+    await updateSettings({ editorAutoSaveDelayMs: 1234 })
+    expect(connect).toHaveBeenCalledOnce()
+    await updateSettings({
+      terminalCustomThemes: [{ ...custom, terminal: { ...custom.terminal, background: '#654321' } }]
+    })
+    expect(connect).toHaveBeenCalledTimes(2)
+    expect(terminal(1).options.theme?.background).toBe('#654321')
+  })
+
+  it('reconnects when the effective OS theme changes', async () => {
+    await updateSettings({ theme: 'system' })
+    const view = render(<AgentTerminalPreview ptyId="pty-1" />)
+    await act(async () => {})
+    harness.systemPrefersDark = true
+    view.rerender(<AgentTerminalPreview ptyId="pty-1" />)
+    await act(async () => {})
+    expect(connect).toHaveBeenCalledTimes(2)
+    expect(terminal(1).options.theme).not.toEqual(terminal().options.theme)
+  })
+
+  it('uses current live options when an unrelated update arrives during connect', async () => {
+    const gate = Promise.withResolvers<TerminalPreviewConnectResult>()
+    connect.mockReturnValueOnce(gate.promise)
+    render(<AgentTerminalPreview ptyId="pty-1" />)
+    await updateSettings({ terminalCursorStyle: 'bar' })
+    expect(connect).toHaveBeenCalledOnce()
+    await act(async () => gate.resolve(connection))
+    expect(harness.instances).toHaveLength(1)
+    expect(terminal().options.cursorStyle).toBe('bar')
+  })
+
+  it('ignores an old pending connection after a relevant theme change', async () => {
+    const gate = Promise.withResolvers<TerminalPreviewConnectResult>()
+    connect.mockReturnValueOnce(gate.promise)
+    render(<AgentTerminalPreview ptyId="pty-1" />)
+    await updateSettings({ terminalMinimumContrastRatio: 7 })
+    expect(connect).toHaveBeenCalledTimes(2)
+    expect(harness.instances).toHaveLength(1)
+    await act(async () => gate.resolve(connection))
+    expect(harness.instances).toHaveLength(1)
+    expect(terminal().options.minimumContrastRatio).toBe(7)
+  })
+
+  it('does not install a terminal after unmounting a pending connection', async () => {
+    const gate = Promise.withResolvers<TerminalPreviewConnectResult>()
+    connect.mockReturnValueOnce(gate.promise)
+    const view = render(<AgentTerminalPreview ptyId="ssh:host@@pty-1" />)
+    await updateSettings({ editorAutoSaveDelayMs: 1234 })
+    view.unmount()
+    await act(async () => gate.resolve(connection))
+    expect(harness.instances).toHaveLength(0)
+    expect(connect).toHaveBeenCalledOnce()
+    expect(unsubscribe).toHaveBeenCalledExactlyOnceWith('ssh:host@@pty-1')
+  })
+
+  it('keeps a hidden mounted preview connected through unrelated settings updates', async () => {
+    render(
+      <div hidden>
+        <AgentTerminalPreview ptyId="pty-1" />
+      </div>
+    )
+    await act(async () => {})
+    await updateSettings({ editorAutoSaveDelayMs: 1234 })
+    expect(connect).toHaveBeenCalledOnce()
+    expect(unsubscribe).not.toHaveBeenCalled()
+  })
+
+  it('still resyncs the same terminal after unrelated settings updates', async () => {
+    render(<AgentTerminalPreview ptyId="pty-1" />)
+    await act(async () => {})
+    await updateSettings({ editorAutoSaveDelayMs: 1234 })
+    await act(async () => emitData?.({ type: 'resync', ptyId: 'pty-1' }))
+    expect(connect).toHaveBeenCalledTimes(2)
+    expect(harness.instances).toHaveLength(1)
+    expect(terminal().reset).toHaveBeenCalledOnce()
+    expect(unsubscribe).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/renderer/src/components/dashboard-popout/AgentTerminalPreview.tsx b/src/renderer/src/components/dashboard-popout/AgentTerminalPreview.tsx
index f0360d2b795b..59ed54f68d2b 100644
--- a/src/renderer/src/components/dashboard-popout/AgentTerminalPreview.tsx
+++ b/src/renderer/src/components/dashboard-popout/AgentTerminalPreview.tsx
@@ -1,5 +1,6 @@
 import { useEffect, useLayoutEffect, useMemo, useRef, useState } from 'react'
-import { Terminal } from '@xterm/xterm'
+import { Terminal, type ITheme } from '@xterm/xterm'
+import { useShallow } from 'zustand/react/shallow'
 import '@xterm/xterm/css/xterm.css'
 import { getShortcutPlatform } from '@/lib/shortcut-platform'
 import { subscribeToTerminalUserInput } from '@/components/terminal-pane/terminal-user-input-signal'
@@ -71,7 +72,7 @@ export function AgentTerminalPreview({
   const settingsRef = useRef(settings)
   const macOptionAsAltRef = useRef(macOptionAsAlt)
   const terminalInputRef = useRef(terminalInput)
-  const { terminalTheme, terminalMode } = useMemo(() => {
+  const { terminalTheme: composedTheme, terminalMode } = useMemo(() => {
     if (!settings) {
       return { terminalTheme: null, terminalMode: 'dark' as const }
     }
@@ -82,6 +83,10 @@ export function AgentTerminalPreview({
     )
     return { terminalTheme: theme, terminalMode: appearance.mode }
   }, [settings, systemPrefersDark])
+  // Settings arrive as cloned snapshots; compare theme values before reconnecting.
+  const retainTheme = useShallow((theme: ITheme | null) => theme)
+  const terminalTheme = retainTheme(composedTheme)
+  const terminalMinimumContrastRatio = settings?.terminalMinimumContrastRatio
   // A null snapshot means no serializer knows this pty (it died or was never
   // spawned this session) — say so instead of painting a silent blank terminal.
   const [ptyGone, setPtyGone] = useState(false)
@@ -96,6 +101,7 @@ export function AgentTerminalPreview({
     terminalInputRef.current = terminalInput
   }, [settings, macOptionAsAlt, terminalInput])
 
+  // Font changes retain the replay-driven fit, grid claim and input-owner reset.
   useEffect(() => {
     setPtyGone(false)
     const container = containerRef.current
@@ -217,22 +223,6 @@ export function AgentTerminalPreview({
       })
     }
 
-    const installNativeCopyGutterTrim = (): void => {
-      if (!terminal) {
-        return
-      }
-      disposeNativeCopyGutterTrim = installTerminalNativeCopyGutterTrim(terminal).dispose
-    }
-
-    const installTerminalCompatibility = (): void => {
-      if (!terminal) {
-        return
-      }
-      disposeTerminalCompatibility = installPreviewTerminalCompatibility(terminal, {
-        getSettings: () => settingsRef.current
-      })
-    }
-
     const installInputRouting = (): void => {
       if (!terminal) {
         return
@@ -281,8 +271,10 @@ export function AgentTerminalPreview({
           return
         }
         terminalRef.current = terminal
-        installTerminalCompatibility()
-        installNativeCopyGutterTrim()
+        disposeTerminalCompatibility = installPreviewTerminalCompatibility(terminal, {
+          getSettings: () => settingsRef.current
+        })
+        disposeNativeCopyGutterTrim = installTerminalNativeCopyGutterTrim(terminal).dispose
         installInputRouting()
         installImeNativeTextBridge()
         installKeyHandler()
@@ -412,7 +404,18 @@ export function AgentTerminalPreview({
       terminal?.dispose()
       terminalRef.current = null
     }
-  }, [ptyId, terminalTheme, terminalMode])
+  }, [
+    ptyId,
+    terminalTheme,
+    terminalMode,
+    terminalMinimumContrastRatio,
+    settings?.terminalFontSize,
+    settings?.terminalFontFamily,
+    settings?.terminalFontWeight,
+    settings?.terminalFontWeightBold,
+    settings?.terminalLineHeight,
+    settings?.terminalLigatures
+  ])
 
   // Why: appearance settings must land on the open terminal, and the OS input
   // source can flip Option-as-Alt with no settings change at all. A remount
diff --git a/src/renderer/src/components/dashboard/DashboardAgentRow.tsx b/src/renderer/src/components/dashboard/DashboardAgentRow.tsx
index fb80712e65f0..4b38d8d1b0df 100644
--- a/src/renderer/src/components/dashboard/DashboardAgentRow.tsx
+++ b/src/renderer/src/components/dashboard/DashboardAgentRow.tsx
@@ -11,6 +11,7 @@ import { DashboardAgentRowToolStep } from './DashboardAgentRowToolStep'
 import { showsAgentToolPreview } from '@/lib/agent-row-tool-preview'
 import { agentNoUpdateLabel, formatCompactDuration } from '@/lib/agent-row-decay-state'
 import { agentRowDotState as asDotState } from '@/lib/agent-row-dot-state'
+import { agentVerdictDisplayMark } from '../../../../shared/agent-main-agent-verdict'
 import type { DashboardAgentRow as DashboardAgentRowData } from './useDashboardData'
 import { getAgentRowPrimaryText } from '@/lib/agent-row-primary-text'
 import { useAgentRowConversationName } from './use-agent-row-conversation-name'
@@ -29,7 +30,7 @@ function stateDotTooltipLabel(
   dotState: AgentDotState,
   now: number
 ): string {
-  if (agent.entry.interrupted === true) {
+  if (dotState === 'interrupted') {
     return 'Interrupted by user'
   }
   // Why: report the observation, not a verdict on the agent — the elapsed gap is what
@@ -141,7 +142,8 @@ const DashboardAgentRow = React.memo(function DashboardAgentRow({
   const toolName = showsTool ? (agent.entry.toolName?.trim() ?? '') : ''
   const toolInput = showsTool ? (agent.entry.toolInput?.trim() ?? '') : ''
   const lastAssistantMessage = agent.entry.lastAssistantMessage?.trim() ?? ''
-  const isInterrupted = agent.entry.interrupted === true
+  const verdictDotState = agentVerdictDisplayMark(agent.entry)
+  const isInterrupted = verdictDotState === 'interrupted'
   const lineage = agent.lineage
   const isLineageChild = lineage?.depth === 1
   const lineageChildCount = lineage?.childCount ?? 0
@@ -152,10 +154,10 @@ const DashboardAgentRow = React.memo(function DashboardAgentRow({
           lineageChildCount === 1 ? 'agent' : 'agents'
         }`
       : [formatAgentTypeLabel(agent.agentType), model].filter(Boolean).join(' · ')
-  // Why: interrupted is a terminal outcome, so surface it in the leading state dot.
-  const dotState: AgentDotState = isInterrupted
-    ? 'interrupted'
-    : asDotState(agent.state, agent.entry.workingMode)
+  // Why: a stop or a failure is a terminal outcome, so surface it in the leading state dot; a
+  // failure does so even while subagents still run.
+  const dotState: AgentDotState =
+    verdictDotState ?? asDotState(agent.state, agent.entry.workingMode)
   const dotTooltipLabel = stateDotTooltipLabel(agent, dotState, now)
   // Why: the elapsed gap is the whole content of an `unverifiable` row, so it rides the
   // row's own timestamp slot rather than hiding in a hover tooltip.
diff --git a/src/renderer/src/components/dashboard/agent-finished-timestamp.test.ts b/src/renderer/src/components/dashboard/agent-finished-timestamp.test.ts
index 91b445dd78f9..b5ee4ae239cf 100644
--- a/src/renderer/src/components/dashboard/agent-finished-timestamp.test.ts
+++ b/src/renderer/src/components/dashboard/agent-finished-timestamp.test.ts
@@ -51,6 +51,47 @@ describe('lastEnteredDoneAt shares the Smart Sort completion clock', () => {
     expect(lastEnteredDoneAt(row(entry))).toBe(2_000)
     expect(agentEntryCompletionAt(entry)).toBeNull()
   })
+
+  it('dates a failed turn as a completion, and a stopped one only for display', () => {
+    const verdictDone = (outcome: 'failure' | 'cancellation') =>
+      doneEntry({
+        stateStartedAt: 2_000,
+        mainAgent: { state: 'done', outcome, stateStartedAt: 2_000 }
+      })
+    expect(agentEntryCompletionAt(verdictDone('failure'))).toBe(2_000)
+    expect(lastEnteredDoneAt(row(verdictDone('failure')))).toBe(2_000)
+    expect(agentEntryCompletionAt(verdictDone('cancellation'))).toBeNull()
+    expect(lastEnteredDoneAt(row(verdictDone('cancellation')))).toBe(2_000)
+  })
+
+  it('dates a main agent that failed while its subagents run by when it failed', () => {
+    const held = (outcome: 'failure' | 'cancellation') =>
+      doneEntry({
+        state: 'working',
+        stateStartedAt: 3_000,
+        mainAgent: { state: 'done', outcome, stateStartedAt: 2_500 }
+      })
+    expect(agentEntryCompletionAt(held('failure'))).toBeNull()
+    expect(lastEnteredDoneAt(row(held('failure')))).toBe(2_500)
+    expect(lastEnteredDoneAt(row(held('cancellation')))).toBeNull()
+  })
+
+  it('reads the verdict history carries when a boundary displaced the completion', () => {
+    const history = { state: 'done' as const, prompt: '', startedAt: 1_500 }
+    const boundary = (outcome?: 'failure' | 'cancellation') =>
+      doneEntry({
+        sessionBoundary: true,
+        stateHistory: [
+          {
+            ...history,
+            ...(outcome ? { mainAgent: { state: 'done', outcome, stateStartedAt: 1_500 } } : {})
+          }
+        ]
+      })
+    expect(agentEntryCompletionAt(boundary())).toBe(1_500)
+    expect(agentEntryCompletionAt(boundary('failure'))).toBe(1_500)
+    expect(agentEntryCompletionAt(boundary('cancellation'))).toBeNull()
+  })
 })
 
 describe('lastEnteredDoneAt subagent rows', () => {
diff --git a/src/renderer/src/components/dashboard/agent-finished-timestamp.ts b/src/renderer/src/components/dashboard/agent-finished-timestamp.ts
index fe1018629579..28d7a2572bbb 100644
--- a/src/renderer/src/components/dashboard/agent-finished-timestamp.ts
+++ b/src/renderer/src/components/dashboard/agent-finished-timestamp.ts
@@ -1,4 +1,8 @@
 import { agentEntryCompletionAt } from '../../../../shared/agent-completion-time'
+import {
+  agentTurnStoppedByUser,
+  agentVerdictDisplayMark
+} from '../../../../shared/agent-main-agent-verdict'
 import type { DashboardAgentRow } from './useDashboardData'
 
 /**
@@ -22,10 +26,14 @@ export function lastEnteredDoneAt(
   if (completedAt !== null) {
     return completedAt
   }
-  // Why: display is looser than ranking — an interrupted turn still shows when it stopped.
-  if (entry.state === 'done' && entry.interrupted === true && entry.sessionBoundary !== true) {
+  // Why: display is looser than ranking — a stopped turn still shows when it ended.
+  if (entry.state === 'done' && agentTurnStoppedByUser(entry) && entry.sessionBoundary !== true) {
     return entry.stateStartedAt
   }
+  // Why: a failed main agent reads failed while its subagents run, so it shows when it failed.
+  if (entry.state !== 'done' && entry.mainAgent && agentVerdictDisplayMark(entry) === 'failed') {
+    return entry.mainAgent.stateStartedAt
+  }
   for (let i = (entry.stateHistory?.length ?? 0) - 1; i >= 0; i--) {
     if (entry.stateHistory[i].state === 'done') {
       return entry.stateHistory[i].startedAt
diff --git a/src/renderer/src/components/dashboard/agent-row-lineage-model.test.ts b/src/renderer/src/components/dashboard/agent-row-lineage-model.test.ts
index 016d1503e76e..15a3c4a8d83d 100644
--- a/src/renderer/src/components/dashboard/agent-row-lineage-model.test.ts
+++ b/src/renderer/src/components/dashboard/agent-row-lineage-model.test.ts
@@ -162,20 +162,20 @@ describe('buildAgentRowLineageTree', () => {
     )
     const iterate = Set.prototype[Symbol.iterator]
     let visitedSetEntries = 0
-    const spy = vi
-      .spyOn(Set.prototype, Symbol.iterator)
-      .mockImplementation(function (this: Set<unknown>) {
-        const iterator = iterate.call(this)
-        const next = iterator.next.bind(iterator)
-        iterator.next = () => {
-          const result = next()
-          if (!result.done) {
-            visitedSetEntries += 1
-          }
-          return result
+    const spy = vi.spyOn(Set.prototype, Symbol.iterator).mockImplementation(function (
+      this: Set<unknown>
+    ) {
+      const iterator = iterate.call(this)
+      const next = iterator.next.bind(iterator)
+      iterator.next = () => {
+        const result = next()
+        if (!result.done) {
+          visitedSetEntries += 1
         }
-        return iterator
-      })
+        return result
+      }
+      return iterator
+    })
     let tree: ReturnType<typeof buildAgentRowLineageTree>
     try {
       tree = buildAgentRowLineageTree(rows)
diff --git a/src/renderer/src/components/dashboard/useRetainedAgents.test.ts b/src/renderer/src/components/dashboard/useRetainedAgents.test.ts
index d1440f4e5ef0..97640f2c2ae5 100644
--- a/src/renderer/src/components/dashboard/useRetainedAgents.test.ts
+++ b/src/renderer/src/components/dashboard/useRetainedAgents.test.ts
@@ -68,7 +68,12 @@ function makeTab(overrides: Partial<TerminalTab> & { id: string }): TerminalTab
   }
 }
 
-function makeAgentRow(args: { paneKey: string; state: AgentStatusState; interrupted?: boolean }) {
+function makeAgentRow(args: {
+  paneKey: string
+  state: AgentStatusState
+  interrupted?: boolean
+  mainAgent?: AgentStatusEntry['mainAgent']
+}) {
   const entry: AgentStatusEntry = {
     state: args.state,
     prompt: 'Fix it',
@@ -78,7 +83,8 @@ function makeAgentRow(args: { paneKey: string; state: AgentStatusState; interrup
     terminalTitle: 'Claude',
     stateHistory: [],
     agentType: 'claude',
-    interrupted: args.interrupted
+    interrupted: args.interrupted,
+    mainAgent: args.mainAgent
   }
 
   return {
@@ -134,6 +140,34 @@ describe('collectRetainedAgentsOnDisappear', () => {
     expect(result.toRetain).toEqual([])
   })
 
+  it('retains a failed done row so the failure stays visible, but not a cancelled one', () => {
+    const retainedFor = (outcome: 'failure' | 'cancellation') =>
+      collectRetainedAgentsOnDisappear({
+        previousAgents: new Map([
+          [
+            'tab-1:1',
+            {
+              row: makeAgentRow({
+                paneKey: 'tab-1:1',
+                state: 'done',
+                mainAgent: { state: 'done', outcome, stateStartedAt: 100 }
+              }),
+              worktreeId: 'wt-1'
+            }
+          ]
+        ]),
+        currentAgents: new Map(),
+        retainedAgentsByPaneKey: {},
+        retentionSuppressedPaneKeys: {},
+        recentlyClosedAgentStatusTabIds: {},
+        recentlyRetiredAgentStatusPaneKeys: {}
+      }).toRetain
+
+    expect(retainedFor('failure')).toHaveLength(1)
+    expect(retainedFor('failure')[0]?.entry.mainAgent?.outcome).toBe('failure')
+    expect(retainedFor('cancellation')).toEqual([])
+  })
+
   it('refreshes the retained snapshot when a reused paneKey starts a newer run', () => {
     // Why: a reused paneKey (same tab+pane, fresh agent start after a prior
     // retained run) produces a newer startedAt. Without the freshness check
diff --git a/src/renderer/src/components/dashboard/useRetainedAgents.ts b/src/renderer/src/components/dashboard/useRetainedAgents.ts
index f0ab639e2ba0..f26baaafc37d 100644
--- a/src/renderer/src/components/dashboard/useRetainedAgents.ts
+++ b/src/renderer/src/components/dashboard/useRetainedAgents.ts
@@ -15,6 +15,7 @@ import {
   type AgentStatusEntry
 } from '../../../../shared/agent-status-types'
 import { parsePaneKey } from '../../../../shared/stable-pane-id'
+import { agentTurnStoppedByUser } from '../../../../shared/agent-main-agent-verdict'
 
 import {
   createWorktreeTabBucketProjection,
@@ -299,13 +300,12 @@ export function collectRetainedAgentsOnDisappear(args: {
     if (args.recentlyClosedAgentStatusTabIds[ownerTabId]) {
       continue
     }
-    // Why: only keep a sticky snapshot when the agent finished cleanly
-    // (state === 'done' and not interrupted). Explicit teardown paths mark
+    // Why: only keep a sticky snapshot when the agent finished and the user did not
+    // stop it; a failure is kept so it stays visible. Explicit teardown paths mark
     // pane keys as suppression candidates, so a close/quit/crash cannot
     // resurrect a stale `done` row on the next sync.
     const lastState = prev.row.state
-    const wasInterrupted = prev.row.entry.interrupted === true
-    if (lastState !== 'done' || wasInterrupted) {
+    if (lastState !== 'done' || agentTurnStoppedByUser(prev.row.entry)) {
       continue
     }
     toRetain.push({
diff --git a/src/renderer/src/components/diff-comments/DiffCommentDraftCard.test.tsx b/src/renderer/src/components/diff-comments/DiffCommentDraftCard.test.tsx
new file mode 100644
index 000000000000..68914826e6de
--- /dev/null
+++ b/src/renderer/src/components/diff-comments/DiffCommentDraftCard.test.tsx
@@ -0,0 +1,270 @@
+// @vitest-environment happy-dom
+import { act, cleanup, fireEvent, render } from '@testing-library/react'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { toast } from 'sonner'
+import { DiffCommentDraftCard } from './DiffCommentDraftCard'
+
+vi.mock('sonner', () => ({ toast: { error: vi.fn(), success: vi.fn(), info: vi.fn() } }))
+
+describe('DiffCommentDraftCard', () => {
+  let scrollHeight = 60
+
+  beforeEach(() => {
+    scrollHeight = 60
+    vi.spyOn(HTMLTextAreaElement.prototype, 'scrollHeight', 'get').mockImplementation(
+      () => scrollHeight
+    )
+  })
+
+  afterEach(() => {
+    cleanup()
+    vi.restoreAllMocks()
+  })
+
+  it('renders line header', () => {
+    const onCancel = vi.fn()
+    const onSubmit = vi.fn().mockResolvedValue(true)
+
+    const view = render(
+      <DiffCommentDraftCard lineNumber={42} onCancel={onCancel} onSubmit={onSubmit} />
+    )
+
+    expect(view.getByText('Line 42')).toBeDefined()
+    expect(view.queryByText('You')).toBeNull()
+    const textarea = view.getByPlaceholderText('Add note for the AI')
+    expect(textarea).toBeDefined()
+    expect(document.activeElement).toBe(textarea)
+    expect(view.getByRole('button', { name: 'Add note' })).toBeDefined()
+    expect(view.getByRole('button', { name: 'Cancel' })).toBeDefined()
+  })
+
+  it('renders range header when startLine is provided', () => {
+    const onCancel = vi.fn()
+    const onSubmit = vi.fn().mockResolvedValue(true)
+
+    const view = render(
+      <DiffCommentDraftCard
+        lineNumber={42}
+        startLine={38}
+        onCancel={onCancel}
+        onSubmit={onSubmit}
+      />
+    )
+
+    expect(view.getByText('Lines 38-42')).toBeDefined()
+  })
+
+  it('disables submit button when body is whitespace and enables when text is typed', () => {
+    const onCancel = vi.fn()
+    const onSubmit = vi.fn().mockResolvedValue(true)
+
+    const view = render(
+      <DiffCommentDraftCard lineNumber={10} onCancel={onCancel} onSubmit={onSubmit} />
+    )
+
+    const submitBtn = view.getByRole('button', { name: 'Add note' })
+    expect(submitBtn.hasAttribute('disabled')).toBe(true)
+
+    const textarea = view.getByRole('textbox')
+    fireEvent.change(textarea, { target: { value: '   ' } })
+    expect(submitBtn.hasAttribute('disabled')).toBe(true)
+
+    fireEvent.change(textarea, { target: { value: 'Refactor this loop' } })
+    expect(submitBtn.hasAttribute('disabled')).toBe(false)
+  })
+
+  it('parks focus on the textarea before the pressed submit button turns disabled', async () => {
+    let resolveSubmit: (result: boolean) => void = () => {}
+    const onSubmit = vi.fn(
+      () =>
+        new Promise<boolean>((resolve) => {
+          resolveSubmit = resolve
+        })
+    )
+    const view = render(
+      <DiffCommentDraftCard lineNumber={10} onCancel={vi.fn()} onSubmit={onSubmit} />
+    )
+    const textarea = view.getByRole('textbox')
+    fireEvent.change(textarea, { target: { value: 'Pending note' } })
+    const submitBtn = view.getByRole('button', { name: 'Add note' })
+    submitBtn.focus()
+    expect(document.activeElement).toBe(submitBtn)
+    fireEvent.click(submitBtn)
+
+    // Chromium moves focus to <body> when a focused button turns disabled, which would stop the
+    // draft zone from handing focus back to the editor once the save lands.
+    expect(onSubmit).toHaveBeenCalledTimes(1)
+    expect(submitBtn.hasAttribute('disabled')).toBe(true)
+    expect(document.activeElement).toBe(textarea)
+
+    await act(async () => resolveSubmit(true))
+  })
+
+  it('calls onSubmit when clicking submit button', async () => {
+    const onCancel = vi.fn()
+    const onSubmit = vi.fn().mockResolvedValue(true)
+
+    const view = render(
+      <DiffCommentDraftCard lineNumber={10} onCancel={onCancel} onSubmit={onSubmit} />
+    )
+
+    const textarea = view.getByRole('textbox')
+    fireEvent.change(textarea, { target: { value: 'Needs revision' } })
+
+    const submitBtn = view.getByRole('button', { name: 'Add note' })
+    await act(async () => {
+      fireEvent.click(submitBtn)
+    })
+
+    expect(onSubmit).toHaveBeenCalledWith('Needs revision')
+  })
+
+  it('calls onSubmit on Enter without Shift, but allows Shift+Enter for newlines', async () => {
+    const onCancel = vi.fn()
+    const onSubmit = vi.fn().mockResolvedValue(true)
+
+    const view = render(
+      <DiffCommentDraftCard lineNumber={10} onCancel={onCancel} onSubmit={onSubmit} />
+    )
+
+    const textarea = view.getByRole('textbox')
+    fireEvent.change(textarea, { target: { value: 'First line' } })
+
+    // Shift+Enter should NOT submit
+    fireEvent.keyDown(textarea, { key: 'Enter', shiftKey: true })
+    expect(onSubmit).not.toHaveBeenCalled()
+
+    // Plain Enter SHOULD submit
+    await act(async () => {
+      fireEvent.keyDown(textarea, { key: 'Enter', shiftKey: false })
+    })
+    expect(onSubmit).toHaveBeenCalledWith('First line')
+  })
+
+  it('submits Cmd+Shift+Enter and ignores duplicate submits while pending', async () => {
+    let resolveSubmit: (result: boolean) => void = () => {}
+    const onSubmit = vi.fn(
+      () =>
+        new Promise<boolean>((resolve) => {
+          resolveSubmit = resolve
+        })
+    )
+    const onCancel = vi.fn()
+    const view = render(
+      <DiffCommentDraftCard lineNumber={10} onCancel={onCancel} onSubmit={onSubmit} />
+    )
+    const textarea = view.getByRole('textbox')
+    fireEvent.change(textarea, { target: { value: 'Pending note' } })
+    const submitButton = view.getByRole('button', { name: 'Add note' })
+
+    fireEvent.keyDown(textarea, { key: 'Enter', metaKey: true, shiftKey: true })
+    fireEvent.click(submitButton)
+    fireEvent.keyDown(textarea, { key: 'Escape' })
+
+    expect(onSubmit).toHaveBeenCalledTimes(1)
+    expect(view.getByRole('button', { name: 'Cancel' }).hasAttribute('disabled')).toBe(true)
+    expect(onCancel).not.toHaveBeenCalled()
+
+    await act(async () => resolveSubmit(true))
+  })
+
+  it('reports a rejected save to the user and re-enables the card', async () => {
+    const error = new Error('network down')
+    const onSubmit = vi.fn().mockRejectedValue(error)
+    const consoleError = vi.spyOn(console, 'error').mockImplementation(() => {})
+    const view = render(
+      <DiffCommentDraftCard lineNumber={10} onCancel={vi.fn()} onSubmit={onSubmit} />
+    )
+    fireEvent.change(view.getByRole('textbox'), { target: { value: 'Rejected note' } })
+
+    await act(async () => {
+      fireEvent.click(view.getByRole('button', { name: 'Add note' }))
+    })
+
+    expect(toast.error).toHaveBeenCalledWith('Failed to save comment')
+    expect(consoleError).toHaveBeenCalled()
+    expect(view.getByRole('button', { name: 'Add note' }).hasAttribute('disabled')).toBe(false)
+  })
+
+  it('seeds and reports draft text so a re-anchored card can carry it', () => {
+    const onBodyChange = vi.fn()
+    const view = render(
+      <DiffCommentDraftCard
+        lineNumber={10}
+        initialBody="Carried note"
+        onBodyChange={onBodyChange}
+        onCancel={vi.fn()}
+        onSubmit={vi.fn().mockResolvedValue(true)}
+      />
+    )
+    const textarea = view.getByRole('textbox')
+    expect(textarea instanceof HTMLTextAreaElement).toBe(true)
+    if (textarea instanceof HTMLTextAreaElement) {
+      expect(textarea.value).toBe('Carried note')
+    }
+    fireEvent.change(textarea, { target: { value: 'Updated note' } })
+    expect(onBodyChange).toHaveBeenCalledWith('Updated note')
+  })
+
+  it('does not submit on Enter when IME composition is active', async () => {
+    const onCancel = vi.fn()
+    const onSubmit = vi.fn().mockResolvedValue(true)
+
+    const view = render(
+      <DiffCommentDraftCard lineNumber={10} onCancel={onCancel} onSubmit={onSubmit} />
+    )
+
+    const textarea = view.getByRole('textbox')
+    fireEvent.change(textarea, { target: { value: 'nihon' } })
+
+    // IME composition
+    fireEvent.keyDown(textarea, { key: 'Enter', isComposing: true })
+    expect(onSubmit).not.toHaveBeenCalled()
+  })
+
+  it('calls onCancel when clicking Cancel or pressing Escape', () => {
+    const onCancel = vi.fn()
+    const onSubmit = vi.fn().mockResolvedValue(true)
+
+    const view = render(
+      <DiffCommentDraftCard lineNumber={10} onCancel={onCancel} onSubmit={onSubmit} />
+    )
+
+    const cancelBtn = view.getByRole('button', { name: 'Cancel' })
+    fireEvent.click(cancelBtn)
+    expect(onCancel).toHaveBeenCalledTimes(1)
+
+    const textarea = view.getByRole('textbox')
+    fireEvent.keyDown(textarea, { key: 'Escape' })
+    expect(onCancel).toHaveBeenCalledTimes(2)
+  })
+
+  it('notifies onContentResize when textarea height changes', () => {
+    const onContentResize = vi.fn()
+    const onCancel = vi.fn()
+    const onSubmit = vi.fn().mockResolvedValue(true)
+
+    const view = render(
+      <DiffCommentDraftCard
+        lineNumber={10}
+        onCancel={onCancel}
+        onSubmit={onSubmit}
+        onContentResize={onContentResize}
+      />
+    )
+
+    const textarea = view.getByRole('textbox')
+    // Called once on initial layout to settle view zone height
+    expect(onContentResize).toHaveBeenCalledTimes(1)
+
+    // Same height (60)
+    fireEvent.change(textarea, { target: { value: 'line 1' } })
+    expect(onContentResize).toHaveBeenCalledTimes(1)
+
+    // Height increases
+    scrollHeight = 120
+    fireEvent.change(textarea, { target: { value: 'line 1\nline 2\nline 3' } })
+    expect(onContentResize).toHaveBeenCalledTimes(2)
+    expect(textarea.style.height).toBe('120px')
+  })
+})
diff --git a/src/renderer/src/components/diff-comments/DiffCommentDraftCard.tsx b/src/renderer/src/components/diff-comments/DiffCommentDraftCard.tsx
new file mode 100644
index 000000000000..f81444106af3
--- /dev/null
+++ b/src/renderer/src/components/diff-comments/DiffCommentDraftCard.tsx
@@ -0,0 +1,268 @@
+import { useCallback, useEffect, useId, useLayoutEffect, useRef, useState } from 'react'
+import { CornerDownLeft } from 'lucide-react'
+import { Button } from '@/components/ui/button'
+import { useMountedRef } from '@/hooks/useMountedRef'
+import { translate } from '@/i18n/i18n'
+import {
+  getCommentBodySubmitState,
+  hasBoundedCommentBodyText
+} from '@/lib/comment-body-submit-state'
+import { toast } from 'sonner'
+import { installOpenDraftAddReviewNoteGuard } from '../editor/editor-shortcuts'
+
+export type DiffCommentDraftCardProps = {
+  lineNumber: number
+  startLine?: number
+  placeholder?: string
+  submitLabel?: string
+  submittingLabel?: string
+  initialBody?: string
+  onBodyChange?: (body: string) => void
+  onCancel: () => void
+  onSubmit: (body: string) => Promise<boolean>
+  onContentResize?: () => void
+}
+
+function resizeDraftTextarea(textarea: HTMLTextAreaElement): boolean {
+  const previousHeight = textarea.style.height
+  textarea.style.height = 'auto'
+  textarea.style.height = `${Math.min(Math.max(textarea.scrollHeight, 60), 240)}px`
+  return textarea.style.height !== previousHeight
+}
+
+export function DiffCommentDraftCard({
+  lineNumber,
+  startLine,
+  placeholder,
+  submitLabel,
+  submittingLabel,
+  onCancel,
+  onSubmit,
+  onContentResize,
+  initialBody = '',
+  onBodyChange
+}: DiffCommentDraftCardProps): React.JSX.Element {
+  const [body, setBody] = useState(initialBody)
+  const bodyRef = useRef(body)
+  const [submitting, setSubmitting] = useState(false)
+  const mountedRef = useMountedRef()
+  const textareaRef = useRef<HTMLTextAreaElement | null>(null)
+  const cardRef = useRef<HTMLDivElement | null>(null)
+  const onContentResizeRef = useRef(onContentResize)
+
+  useEffect(() => {
+    bodyRef.current = body
+  }, [body])
+
+  useEffect(() => {
+    onContentResizeRef.current = onContentResize
+  }, [onContentResize])
+
+  const labelId = useId()
+  const headerLabel =
+    startLine && startLine !== lineNumber
+      ? translate(
+          'auto.components.diff.comments.DiffCommentPopover.c845170b3b',
+          'Lines {{value0}}-{{value1}}',
+          { value0: startLine, value1: lineNumber }
+        )
+      : translate(
+          'auto.components.diff.comments.DiffCommentPopover.e05063cfc1',
+          'Line {{value0}}',
+          { value0: lineNumber }
+        )
+
+  const focusTextareaRef = useCallback((textarea: HTMLTextAreaElement | null): void => {
+    textareaRef.current = textarea
+    textarea?.focus()
+  }, [])
+
+  useEffect(() => {
+    const focusTextarea = (): void => textareaRef.current?.focus()
+    focusTextarea()
+    if (typeof requestAnimationFrame !== 'function') {
+      return
+    }
+    const frame = requestAnimationFrame(focusTextarea)
+    return () => cancelAnimationFrame(frame)
+  }, [])
+
+  useLayoutEffect(() => {
+    const card = cardRef.current
+    if (!card || !onContentResizeRef.current) {
+      return
+    }
+    const textarea = textareaRef.current
+    if (textarea) {
+      resizeDraftTextarea(textarea)
+    }
+    onContentResizeRef.current()
+    if (typeof ResizeObserver === 'undefined') {
+      return
+    }
+    const observer = new ResizeObserver(() => {
+      onContentResizeRef.current?.()
+    })
+    observer.observe(card)
+    return () => observer.disconnect()
+  }, [])
+
+  useEffect(() => {
+    const card = cardRef.current
+    if (!card) {
+      return
+    }
+    return installOpenDraftAddReviewNoteGuard(card)
+  }, [])
+
+  useEffect(() => {
+    const onDocumentMouseDown = (event: MouseEvent): void => {
+      const card = cardRef.current
+      const target = event.target
+      if (!card || (target instanceof Node && card.contains(target))) {
+        return
+      }
+      // Keep a non-empty draft alive when the user clicks another line's add button.
+      if (/\S/u.test(bodyRef.current)) {
+        return
+      }
+      onCancel()
+    }
+    document.addEventListener('mousedown', onDocumentMouseDown)
+    return () => document.removeEventListener('mousedown', onDocumentMouseDown)
+  }, [onCancel])
+
+  const handleSubmit = async (): Promise<void> => {
+    if (submitting) {
+      return
+    }
+    const bodyState = getCommentBodySubmitState(body)
+    if (bodyState.status === 'empty') {
+      return
+    }
+    if (bodyState.status === 'too-large-leading-whitespace') {
+      toast.error(
+        translate(
+          'auto.components.diff.comments.DiffCommentPopover.commentTooLarge',
+          'Comment is too large to submit safely.'
+        )
+      )
+      return
+    }
+    // Chromium drops focus to <body> when the pressed button turns disabled, and the zone only
+    // hands focus back to Monaco while the card still holds it. Park it on the textarea first.
+    textareaRef.current?.focus()
+    setSubmitting(true)
+    try {
+      const result = await onSubmit(bodyState.body)
+      if (result === false && mountedRef.current) {
+        setSubmitting(false)
+      }
+    } catch (err) {
+      console.error('Failed to submit diff comment draft:', err)
+      // A rejected save never reaches the caller's own failure toast, so report it here.
+      toast.error(
+        translate('auto.components.editor.diffCommentSaveFailed', 'Failed to save comment')
+      )
+      if (mountedRef.current) {
+        setSubmitting(false)
+      }
+    }
+  }
+
+  const handleKeyDown = (e: React.KeyboardEvent<HTMLTextAreaElement>): void => {
+    e.stopPropagation()
+
+    if (e.key === 'Escape') {
+      e.preventDefault()
+      if (submitting) {
+        return
+      }
+      onCancel()
+      return
+    }
+
+    const isEnter = e.key === 'Enter' && !e.nativeEvent.isComposing
+    const isCmdOrCtrl = e.metaKey || e.ctrlKey
+    // Plain Shift+Enter inserts a newline; Cmd/Ctrl+Enter submits even with Shift.
+    if (isEnter && (isCmdOrCtrl || !e.shiftKey)) {
+      e.preventDefault()
+      if (submitting) {
+        return
+      }
+      void handleSubmit()
+    }
+  }
+
+  const canSubmit = !submitting && hasBoundedCommentBodyText(body)
+
+  return (
+    <div
+      ref={cardRef}
+      className="orca-diff-comment-popover orca-diff-comment-draft-card"
+      role="region"
+      aria-labelledby={labelId}
+      onMouseDown={(ev) => ev.stopPropagation()}
+      onClick={(ev) => ev.stopPropagation()}
+    >
+      <div className="orca-diff-comment-content-col gap-2">
+        <div id={labelId} className="orca-diff-comment-popover-label">
+          {headerLabel}
+        </div>
+
+        {/* Textarea */}
+        <textarea
+          ref={focusTextareaRef}
+          className="orca-diff-comment-popover-textarea"
+          placeholder={
+            placeholder ??
+            translate(
+              'auto.components.diff.comments.DiffCommentPopover.f6c449191e',
+              'Add note for the AI'
+            )
+          }
+          value={body}
+          rows={3}
+          onChange={(e) => {
+            setBody(e.target.value)
+            onBodyChange?.(e.target.value)
+            if (resizeDraftTextarea(e.currentTarget)) {
+              onContentResizeRef.current?.()
+            }
+          }}
+          onKeyDown={handleKeyDown}
+        />
+
+        {/* Footer */}
+        <div className="orca-diff-comment-popover-footer">
+          <Button type="button" variant="ghost" size="sm" onClick={onCancel} disabled={submitting}>
+            {translate('auto.components.diff.comments.DiffCommentPopover.2b3ce6d394', 'Cancel')}
+          </Button>
+          <Button
+            type="button"
+            size="sm"
+            aria-label={
+              submitLabel ??
+              translate('auto.components.diff.comments.DiffCommentPopover.5fa4bfebaa', 'Add note')
+            }
+            onClick={() => void handleSubmit()}
+            disabled={!canSubmit}
+          >
+            {submitting
+              ? (submittingLabel ??
+                translate(
+                  'auto.components.diff.comments.DiffCommentPopover.5e9b3d0c2e',
+                  'Adding...'
+                ))
+              : (submitLabel ??
+                translate(
+                  'auto.components.diff.comments.DiffCommentPopover.5fa4bfebaa',
+                  'Add note'
+                ))}
+            {!submitting && <CornerDownLeft className="ml-1 size-3 opacity-70" />}
+          </Button>
+        </div>
+      </div>
+    </div>
+  )
+}
diff --git a/src/renderer/src/components/diff-comments/diff-comment-add-note-shortcut.ts b/src/renderer/src/components/diff-comments/diff-comment-add-note-shortcut.ts
index 3dab9d053b87..a58ac12d725a 100644
--- a/src/renderer/src/components/diff-comments/diff-comment-add-note-shortcut.ts
+++ b/src/renderer/src/components/diff-comments/diff-comment-add-note-shortcut.ts
@@ -55,8 +55,9 @@ export function installDiffCommentAddNoteShortcut({
   onOpenComposer: (args: { lineNumber: number; startLine?: number; top: number }) => void
 }): () => void {
   return installEditorAddReviewNoteShortcut(editor.getContainerDomNode(), () => {
-    // Why: an open draft consumes the chord itself (DiffCommentPopover's guard); claiming it here
-    // too would remount the composer and drop what the user already typed.
+    // Why: an open draft card owns the chord (isComposerOpen reports it, and the card's own guard
+    // eats presses from its textarea); claiming it here too would re-open the card at the editor's
+    // selection and move what the user already typed.
     if (isComposerOpen()) {
       return true
     }
diff --git a/src/renderer/src/components/diff-comments/diff-comment-draft-zone.test.tsx b/src/renderer/src/components/diff-comments/diff-comment-draft-zone.test.tsx
new file mode 100644
index 000000000000..76be7f554a7f
--- /dev/null
+++ b/src/renderer/src/components/diff-comments/diff-comment-draft-zone.test.tsx
@@ -0,0 +1,313 @@
+// @vitest-environment happy-dom
+import { act, fireEvent, renderHook, within } from '@testing-library/react'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import {
+  useDiffCommentDraftZone,
+  type UseDiffCommentDraftZoneArgs
+} from './diff-comment-draft-zone'
+import {
+  createFakeDiffCommentEditor,
+  type FakeDiffCommentEditor
+} from './diff-comment-editor-test-fixture'
+
+const DRAFT_LINE = 5
+const OTHER_LINE = 9
+const BODY = 'Needs revision'
+
+type CreateComment = NonNullable<UseDiffCommentDraftZoneArgs['onCreateComment']>
+
+function renderDraftZone(fake: FakeDiffCommentEditor, onCreateComment: CreateComment) {
+  return renderHook(
+    ({ monacoModelIdentity }: { monacoModelIdentity: string }) =>
+      useDiffCommentDraftZone({ editor: fake.editor, monacoModelIdentity, onCreateComment }),
+    { initialProps: { monacoModelIdentity: 'model-v1' } }
+  )
+}
+
+function openDraftAt(hook: ReturnType<typeof renderDraftZone>, lineNumber: number): void {
+  act(() => {
+    hook.result.current.onAddCommentClickRef.current({ lineNumber, top: 0 })
+  })
+}
+
+// The single open draft card, attached to the editor node the way Monaco would mount its zone.
+function draftCard(fake: FakeDiffCommentEditor): {
+  dom: HTMLElement
+  textarea: HTMLTextAreaElement
+} {
+  const zones = [...fake.zones.values()]
+  expect(zones).toHaveLength(1)
+  const dom = zones[0].domNode
+  if (!dom.isConnected) {
+    fake.domNode.appendChild(dom)
+  }
+  const textarea = dom.querySelector('textarea')
+  if (!(textarea instanceof HTMLTextAreaElement)) {
+    throw new Error('draft card did not render a textarea')
+  }
+  return { dom, textarea }
+}
+
+function typeDraft(fake: FakeDiffCommentEditor, body: string): void {
+  fireEvent.change(draftCard(fake).textarea, { target: { value: body } })
+}
+
+function submitDraft(fake: FakeDiffCommentEditor, body: string): void {
+  typeDraft(fake, body)
+  fireEvent.click(within(draftCard(fake).dom).getByRole('button', { name: 'Add note' }))
+}
+
+function deferredCreateComment(): {
+  onCreateComment: CreateComment & ReturnType<typeof vi.fn>
+  settle: (result: boolean) => Promise<void>
+} {
+  let resolve: (result: boolean) => void = () => {}
+  const onCreateComment = vi.fn(
+    () =>
+      new Promise<boolean>((r) => {
+        resolve = r
+      })
+  )
+  return {
+    onCreateComment,
+    settle: (result) =>
+      act(async () => {
+        resolve(result)
+      })
+  }
+}
+
+const frames = new Map<number, FrameRequestCallback>()
+let nextFrameId = 0
+
+function pumpFrames(): void {
+  const pending = [...frames.values()]
+  frames.clear()
+  act(() => {
+    for (const callback of pending) {
+      callback(16)
+    }
+  })
+}
+
+beforeEach(() => {
+  frames.clear()
+  vi.stubGlobal('requestAnimationFrame', (callback: FrameRequestCallback): number => {
+    nextFrameId += 1
+    frames.set(nextFrameId, callback)
+    return nextFrameId
+  })
+  vi.stubGlobal('cancelAnimationFrame', (id: number) => {
+    frames.delete(id)
+  })
+})
+
+afterEach(() => {
+  vi.unstubAllGlobals()
+  document.body.replaceChildren()
+  vi.clearAllMocks()
+})
+
+describe('useDiffCommentDraftZone re-anchoring', () => {
+  it('keeps the carried body when a second model swap lands before the re-anchor frame', () => {
+    const fake = createFakeDiffCommentEditor()
+    const hook = renderDraftZone(fake, vi.fn().mockResolvedValue(true))
+    openDraftAt(hook, DRAFT_LINE)
+    typeDraft(fake, BODY)
+
+    hook.rerender({ monacoModelIdentity: 'model-v2' })
+    hook.rerender({ monacoModelIdentity: 'model-v3' })
+    expect(fake.zones.size).toBe(0)
+    pumpFrames()
+
+    const { textarea } = draftCard(fake)
+    expect(textarea.value).toBe(BODY)
+    expect([...fake.zones.values()][0].afterLineNumber).toBe(DRAFT_LINE)
+    expect(hook.result.current.isDraftOpen()).toBe(true)
+  })
+
+  it('re-anchors the typed body onto a replacement editor', () => {
+    const first = createFakeDiffCommentEditor()
+    const replacement = createFakeDiffCommentEditor()
+    const onCreateComment = vi.fn().mockResolvedValue(true)
+    const hook = renderHook(
+      ({
+        fake,
+        monacoModelIdentity
+      }: {
+        fake: FakeDiffCommentEditor
+        monacoModelIdentity: string
+      }) => useDiffCommentDraftZone({ editor: fake.editor, monacoModelIdentity, onCreateComment }),
+      { initialProps: { fake: first, monacoModelIdentity: 'model-v1' } }
+    )
+    act(() => {
+      hook.result.current.onAddCommentClickRef.current({ lineNumber: DRAFT_LINE, top: 0 })
+    })
+    typeDraft(first, BODY)
+
+    hook.rerender({ fake: replacement, monacoModelIdentity: 'model-v2' })
+    expect(first.zones.size).toBe(0)
+    pumpFrames()
+
+    expect(draftCard(replacement).textarea.value).toBe(BODY)
+    expect([...replacement.zones.values()][0].afterLineNumber).toBe(DRAFT_LINE)
+  })
+
+  it('lets a click on another line win over a scheduled re-anchor', () => {
+    const fake = createFakeDiffCommentEditor()
+    const hook = renderDraftZone(fake, vi.fn().mockResolvedValue(true))
+    openDraftAt(hook, DRAFT_LINE)
+    typeDraft(fake, BODY)
+    hook.rerender({ monacoModelIdentity: 'model-v2' })
+
+    openDraftAt(hook, OTHER_LINE)
+    expect(draftCard(fake).textarea.value).toBe(BODY)
+    pumpFrames()
+
+    const zones = [...fake.zones.values()]
+    expect(zones).toHaveLength(1)
+    expect(zones[0].afterLineNumber).toBe(OTHER_LINE)
+    expect(draftCard(fake).textarea.value).toBe(BODY)
+  })
+})
+
+describe('useDiffCommentDraftZone in-flight submit', () => {
+  it('does not carry a submitting draft across a model swap and clears it once the save lands', async () => {
+    const fake = createFakeDiffCommentEditor()
+    const { onCreateComment, settle } = deferredCreateComment()
+    const hook = renderDraftZone(fake, onCreateComment)
+    openDraftAt(hook, DRAFT_LINE)
+    submitDraft(fake, BODY)
+    expect(onCreateComment).toHaveBeenCalledTimes(1)
+
+    hook.rerender({ monacoModelIdentity: 'model-v2' })
+    pumpFrames()
+    // The in-flight save owns the text: no replacement card that could submit it a second time.
+    expect(fake.zones.size).toBe(0)
+
+    await settle(true)
+    pumpFrames()
+    expect(fake.zones.size).toBe(0)
+    expect(hook.result.current.isDraftOpen()).toBe(false)
+    expect(onCreateComment).toHaveBeenCalledTimes(1)
+  })
+
+  it('brings the draft back for retry when its save fails after a model swap', async () => {
+    const fake = createFakeDiffCommentEditor()
+    const { onCreateComment, settle } = deferredCreateComment()
+    const hook = renderDraftZone(fake, onCreateComment)
+    openDraftAt(hook, DRAFT_LINE)
+    submitDraft(fake, BODY)
+    hook.rerender({ monacoModelIdentity: 'model-v2' })
+    expect(fake.zones.size).toBe(0)
+
+    await settle(false)
+
+    const { textarea } = draftCard(fake)
+    expect(textarea.value).toBe(BODY)
+    expect([...fake.zones.values()][0].afterLineNumber).toBe(DRAFT_LINE)
+    expect(hook.result.current.isDraftOpen()).toBe(true)
+  })
+
+  it('does not carry a submitting body into a draft opened on another line', async () => {
+    const fake = createFakeDiffCommentEditor()
+    const { onCreateComment, settle } = deferredCreateComment()
+    const hook = renderDraftZone(fake, onCreateComment)
+    openDraftAt(hook, DRAFT_LINE)
+    submitDraft(fake, BODY)
+
+    openDraftAt(hook, OTHER_LINE)
+    expect(draftCard(fake).textarea.value).toBe('')
+
+    await settle(true)
+    const zones = [...fake.zones.values()]
+    expect(zones).toHaveLength(1)
+    expect(zones[0].afterLineNumber).toBe(OTHER_LINE)
+    expect(onCreateComment).toHaveBeenCalledTimes(1)
+  })
+})
+
+describe('useDiffCommentDraftZone focus handoff', () => {
+  it('returns focus to the editor when a save succeeds while the card holds it', async () => {
+    const fake = createFakeDiffCommentEditor()
+    const { onCreateComment, settle } = deferredCreateComment()
+    const hook = renderDraftZone(fake, onCreateComment)
+    openDraftAt(hook, DRAFT_LINE)
+    draftCard(fake).textarea.focus()
+    submitDraft(fake, BODY)
+
+    await settle(true)
+
+    expect(fake.zones.size).toBe(0)
+    expect(fake.focusCount()).toBe(1)
+  })
+
+  it('returns focus to the editor when the save was started from the submit button', async () => {
+    const fake = createFakeDiffCommentEditor()
+    const { onCreateComment, settle } = deferredCreateComment()
+    const hook = renderDraftZone(fake, onCreateComment)
+    openDraftAt(hook, DRAFT_LINE)
+    typeDraft(fake, BODY)
+    const submit = within(draftCard(fake).dom).getByRole('button', { name: 'Add note' })
+    submit.focus()
+    fireEvent.click(submit)
+    // The card must still hold focus while the save is pending, on a control that stays enabled.
+    expect(document.activeElement).toBe(draftCard(fake).textarea)
+
+    await settle(true)
+
+    expect(fake.zones.size).toBe(0)
+    expect(fake.focusCount()).toBe(1)
+  })
+
+  it('leaves focus alone when the save settles after the user clicked away', async () => {
+    const fake = createFakeDiffCommentEditor()
+    const { onCreateComment, settle } = deferredCreateComment()
+    const hook = renderDraftZone(fake, onCreateComment)
+    openDraftAt(hook, DRAFT_LINE)
+    submitDraft(fake, BODY)
+
+    const elsewhere = document.createElement('input')
+    document.body.appendChild(elsewhere)
+    elsewhere.focus()
+    await settle(true)
+
+    expect(fake.zones.size).toBe(0)
+    expect(fake.focusCount()).toBe(0)
+  })
+})
+
+describe('useDiffCommentDraftZone open state', () => {
+  it('reports the draft closed again after cancel so the chord is not deadened', () => {
+    const fake = createFakeDiffCommentEditor()
+    const hook = renderDraftZone(fake, vi.fn().mockResolvedValue(true))
+    openDraftAt(hook, DRAFT_LINE)
+    expect(hook.result.current.isDraftOpen()).toBe(true)
+
+    fireEvent.click(within(draftCard(fake).dom).getByRole('button', { name: 'Cancel' }))
+
+    expect(hook.result.current.isDraftOpen()).toBe(false)
+    expect(fake.zones.size).toBe(0)
+
+    openDraftAt(hook, OTHER_LINE)
+    expect(hook.result.current.isDraftOpen()).toBe(true)
+    expect([...fake.zones.values()][0].afterLineNumber).toBe(OTHER_LINE)
+  })
+})
+
+describe('useDiffCommentDraftZone teardown', () => {
+  it('does not resurrect a card when a failed save settles after unmount', async () => {
+    const fake = createFakeDiffCommentEditor()
+    const { onCreateComment, settle } = deferredCreateComment()
+    const hook = renderDraftZone(fake, onCreateComment)
+    openDraftAt(hook, DRAFT_LINE)
+    submitDraft(fake, BODY)
+
+    hook.unmount()
+    expect(fake.zones.size).toBe(0)
+
+    await settle(false)
+    pumpFrames()
+    expect(fake.zones.size).toBe(0)
+  })
+})
diff --git a/src/renderer/src/components/diff-comments/diff-comment-draft-zone.ts b/src/renderer/src/components/diff-comments/diff-comment-draft-zone.ts
new file mode 100644
index 000000000000..ef7340250411
--- /dev/null
+++ b/src/renderer/src/components/diff-comments/diff-comment-draft-zone.ts
@@ -0,0 +1,323 @@
+import { useCallback, useEffect, useRef } from 'react'
+import type { editor as monacoEditor } from 'monaco-editor'
+import { createRoot } from 'react-dom/client'
+import { installDiffCommentZoneMouseDownStopper } from './diff-comment-zone-mouse-events'
+import { renderDiffCommentDraftCard } from './diff-comment-zone-card'
+import {
+  resizeDiffCommentZone,
+  DRAFT_ZONE_DEFAULT_HEIGHT,
+  type DraftZoneEntry
+} from './diff-comment-view-zone-entry'
+
+export type DiffCommentDraft = {
+  lineNumber: number
+  startLine?: number
+}
+
+type CarriedDraft = { draft: DiffCommentDraft; body: string }
+
+export type UseDiffCommentDraftZoneArgs = {
+  editor: monacoEditor.ICodeEditor | null
+  monacoModelIdentity?: string
+  canOpenDraft?: boolean
+  onCreateComment?: (args: {
+    lineNumber: number
+    startLine?: number
+    body: string
+  }) => Promise<boolean>
+  draftPlaceholder?: string
+  draftSubmitLabel?: string
+  onAddCommentClick?: (args: { lineNumber: number; startLine?: number; top: number }) => void
+}
+
+export type DiffCommentDraftZoneHandle = {
+  disposeDraftZone: (focusEditor?: boolean) => void
+  isDraftOpen: () => boolean
+  onAddCommentClickRef: React.RefObject<
+    (args: { lineNumber: number; startLine?: number; top: number }) => void
+  >
+}
+
+export function useDiffCommentDraftZone({
+  editor,
+  monacoModelIdentity,
+  canOpenDraft = true,
+  onCreateComment,
+  draftPlaceholder,
+  draftSubmitLabel,
+  onAddCommentClick
+}: UseDiffCommentDraftZoneArgs): DiffCommentDraftZoneHandle {
+  const draftZoneRef = useRef<DraftZoneEntry | null>(null)
+  // The only copy of a draft between its card being torn down and the replacement mounting.
+  const pendingDraftRef = useRef<CarriedDraft | null>(null)
+  const previousModelIdentityRef = useRef(monacoModelIdentity)
+  const reanchorFrameRef = useRef<number | null>(null)
+  const onAddCommentClickRef = useRef<
+    (args: { lineNumber: number; startLine?: number; top: number }) => void
+  >(() => {})
+
+  // A save can settle after unmount; without this its retry would mount a card nobody disposes.
+  const unmountedRef = useRef(false)
+  const onCreateCommentRef = useRef(onCreateComment)
+  const onLegacyAddCommentClickRef = useRef(onAddCommentClick)
+
+  useEffect(() => {
+    unmountedRef.current = false
+    return () => {
+      unmountedRef.current = true
+    }
+  }, [])
+
+  useEffect(() => {
+    onCreateCommentRef.current = onCreateComment
+    onLegacyAddCommentClickRef.current = onAddCommentClick
+  }, [onAddCommentClick, onCreateComment])
+
+  const isDraftOpen = useCallback((): boolean => draftZoneRef.current !== null, [])
+
+  const cancelReanchorFrame = useCallback((): void => {
+    if (reanchorFrameRef.current === null) {
+      return
+    }
+    cancelAnimationFrame(reanchorFrameRef.current)
+    reanchorFrameRef.current = null
+  }, [])
+
+  const disposeDraftZone = useCallback((focusEditor = false): void => {
+    const entry = draftZoneRef.current
+    if (!entry) {
+      return
+    }
+    draftZoneRef.current = null
+    if (entry.editor.getModel()) {
+      entry.editor.changeViewZones((accessor) => accessor.removeZone(entry.zoneId))
+    }
+    entry.disposeMouseDownStopper()
+    queueMicrotask(() => entry.root.unmount())
+    if (focusEditor) {
+      entry.editor.focus()
+    }
+  }, [])
+
+  // Latest openDraft for callers that outlive a render: the re-anchor frame and a settling submit.
+  const openDraftRef = useRef<(draft: DiffCommentDraft, initialBody?: string) => boolean>(
+    () => false
+  )
+
+  // A save that failed after its card was torn down (model swap, editor refresh) brings the text
+  // back for a retry; an open card means the user already moved on, and the failure toast covers it.
+  const restoreFailedSubmit = useCallback((draft: DiffCommentDraft, body: string): void => {
+    if (unmountedRef.current || draftZoneRef.current || openDraftRef.current(draft, body)) {
+      return
+    }
+    pendingDraftRef.current = { draft, body }
+  }, [])
+
+  const openDraft = useCallback(
+    (draft: DiffCommentDraft, initialBody = ''): boolean => {
+      if (!editor || !editor.getModel() || !onCreateCommentRef.current || !canOpenDraft) {
+        return false
+      }
+
+      disposeDraftZone()
+      editor.changeViewZones((accessor) => {
+        const dom = document.createElement('div')
+        dom.className = 'orca-diff-comment-inline'
+        const marginDom = document.createElement('div')
+        marginDom.className = 'orca-diff-comment-draft-margin'
+        const disposeDomMouseDownStopper = installDiffCommentZoneMouseDownStopper(dom)
+        const disposeMarginMouseDownStopper = installDiffCommentZoneMouseDownStopper(marginDom)
+        const root = createRoot(dom)
+        let didFocus = false
+        const delegate: monacoEditor.IViewZone = {
+          afterLineNumber: draft.lineNumber,
+          heightInPx: DRAFT_ZONE_DEFAULT_HEIGHT,
+          domNode: dom,
+          marginDomNode: marginDom,
+          suppressMouseDown: false,
+          onDomNodeTop: () => {
+            if (didFocus) {
+              return
+            }
+            const textarea = dom.querySelector<HTMLTextAreaElement>('textarea')
+            if (!textarea) {
+              return
+            }
+            didFocus = true
+            textarea.focus()
+          }
+        }
+        const zoneId = accessor.addZone(delegate)
+        const entry: DraftZoneEntry = {
+          editor,
+          zoneId,
+          domNode: dom,
+          marginDomNode: marginDom,
+          delegate,
+          root,
+          draft,
+          body: initialBody,
+          submitting: false,
+          disposeMouseDownStopper: () => {
+            disposeDomMouseDownStopper()
+            disposeMarginMouseDownStopper()
+          }
+        }
+        draftZoneRef.current = entry
+
+        renderDiffCommentDraftCard(root, draft, {
+          placeholder: draftPlaceholder,
+          submitLabel: draftSubmitLabel,
+          initialBody,
+          onBodyChange: (body) => {
+            if (draftZoneRef.current === entry) {
+              entry.body = body
+            }
+          },
+          resizeZone: () => {
+            if (draftZoneRef.current === entry) {
+              resizeDiffCommentZone(editor, entry)
+            }
+          },
+          onCancel: () => disposeDraftZone(true),
+          onSubmit: async (body) => {
+            const createComment = onCreateCommentRef.current
+            if (!createComment) {
+              return false
+            }
+            entry.submitting = true
+            let succeeded = false
+            try {
+              const result = await createComment({
+                lineNumber: draft.lineNumber,
+                startLine: draft.startLine,
+                body
+              })
+              succeeded = result !== false
+              return result
+            } finally {
+              entry.submitting = false
+              if (succeeded) {
+                if (draftZoneRef.current === entry) {
+                  // Hand focus back to Monaco only if the card still holds it: a slow save can
+                  // settle after the user has clicked away, and stealing focus back is worse.
+                  disposeDraftZone(entry.domNode.contains(document.activeElement))
+                }
+              } else if (draftZoneRef.current !== entry) {
+                restoreFailedSubmit(draft, body)
+              }
+            }
+          }
+        })
+      })
+      // Report what actually mounted: the re-anchor frame drops its only copy of the draft on true.
+      return draftZoneRef.current !== null
+    },
+    [
+      canOpenDraft,
+      disposeDraftZone,
+      draftPlaceholder,
+      draftSubmitLabel,
+      editor,
+      restoreFailedSubmit
+    ]
+  )
+
+  useEffect(() => {
+    openDraftRef.current = openDraft
+  }, [openDraft])
+
+  // The stash is only cleared once a card actually mounts: the editor may still be mid-refresh
+  // when the frame fires, and a later editor/identity change re-schedules from the same stash.
+  const scheduleReanchor = useCallback((): void => {
+    if (reanchorFrameRef.current !== null) {
+      return
+    }
+    reanchorFrameRef.current = requestAnimationFrame(() => {
+      reanchorFrameRef.current = null
+      const pending = pendingDraftRef.current
+      if (pending && openDraftRef.current(pending.draft, pending.body)) {
+        pendingDraftRef.current = null
+      }
+    })
+  }, [])
+
+  const openDraftFromArgs = useCallback(
+    (args: { lineNumber: number; startLine?: number; top: number }): void => {
+      if (!canOpenDraft) {
+        return
+      }
+      if (!onCreateCommentRef.current) {
+        onLegacyAddCommentClickRef.current?.(args)
+        return
+      }
+      const current = draftZoneRef.current
+      const pending = pendingDraftRef.current
+      // A submitting card's text is already on its way to the store; carrying it would post it twice.
+      const carriedBody =
+        (current && !current.submitting ? current.body : '') || pending?.body || ''
+      // The user picked a new anchor, so a scheduled re-anchor must not move the card back afterwards.
+      cancelReanchorFrame()
+      pendingDraftRef.current = null
+      if (!openDraft({ lineNumber: args.lineNumber, startLine: args.startLine }, carriedBody)) {
+        pendingDraftRef.current = pending
+      }
+    },
+    [canOpenDraft, cancelReanchorFrame, openDraft]
+  )
+
+  useEffect(() => {
+    onAddCommentClickRef.current = openDraftFromArgs
+  }, [openDraftFromArgs])
+
+  useEffect(() => {
+    if (previousModelIdentityRef.current === monacoModelIdentity) {
+      return
+    }
+    previousModelIdentityRef.current = monacoModelIdentity
+    cancelReanchorFrame()
+    const current = draftZoneRef.current
+    if (current) {
+      // A save in flight owns its text: the settling submit disposes on success and re-opens on
+      // failure, so carrying it here would mount a second card that could submit the same note.
+      if (!current.submitting) {
+        pendingDraftRef.current = { draft: current.draft, body: current.body }
+      }
+      disposeDraftZone()
+    }
+    if (pendingDraftRef.current) {
+      scheduleReanchor()
+    }
+  }, [cancelReanchorFrame, disposeDraftZone, monacoModelIdentity, scheduleReanchor])
+
+  // A combined-diff model refresh can briefly clear the editor ref before the replacement mounts.
+  // Re-anchor any carried draft when that replacement becomes available.
+  useEffect(() => {
+    if (!editor || !canOpenDraft || !pendingDraftRef.current) {
+      return
+    }
+    scheduleReanchor()
+    return cancelReanchorFrame
+  }, [cancelReanchorFrame, canOpenDraft, editor, scheduleReanchor])
+
+  useEffect(() => {
+    if (!editor) {
+      return
+    }
+    return () => {
+      cancelReanchorFrame()
+      // Runs before the identity effect on a same-render swap, so stash here or the draft is lost.
+      const current = draftZoneRef.current
+      if (!unmountedRef.current && current && !current.submitting) {
+        pendingDraftRef.current = { draft: current.draft, body: current.body }
+      }
+      disposeDraftZone(false)
+    }
+  }, [cancelReanchorFrame, disposeDraftZone, editor])
+
+  return {
+    disposeDraftZone,
+    isDraftOpen,
+    onAddCommentClickRef
+  }
+}
diff --git a/src/renderer/src/components/diff-comments/diff-comment-editor-test-fixture.ts b/src/renderer/src/components/diff-comments/diff-comment-editor-test-fixture.ts
index 253bb7850743..3e13e6784a56 100644
--- a/src/renderer/src/components/diff-comments/diff-comment-editor-test-fixture.ts
+++ b/src/renderer/src/components/diff-comments/diff-comment-editor-test-fixture.ts
@@ -22,6 +22,8 @@ export type FakeDiffCommentEditor = {
   decorations: () => readonly FakeDecoration[]
   decorationWrites: () => number
   scrollTop: () => number
+  /** How many times the editor was asked to take focus back. */
+  focusCount: () => number
   emitMouseMove: (lineNumber: number) => void
   emitDispose: () => void
   /** Viewport-relative Y for a line, as the fake hit-test reads it. */
@@ -69,6 +71,7 @@ export function createFakeDiffCommentEditor(
   let scrollTop = 0
   let decorations: FakeDecoration[] = []
   let decorationWrites = 0
+  let focusCount = 0
   const mouseMoveListeners: ((e: { target: { position: { lineNumber: number } } }) => void)[] = []
   const disposeListeners: (() => void)[] = []
   const noopDisposable: IDisposable = { dispose: () => {} }
@@ -100,6 +103,9 @@ export function createFakeDiffCommentEditor(
     getScrollHeight: () => lineCount * FAKE_LINE_HEIGHT_PX,
     getLayoutInfo: () => ({ height: FAKE_EDITOR_HEIGHT_PX, contentLeft: 60 }),
     getSelection: () => null,
+    focus: () => {
+      focusCount += 1
+    },
     deltaDecorations: () => [],
     createDecorationsCollection: () => ({
       set: (next: MonacoEditor.IModelDeltaDecoration[]) => {
@@ -161,6 +167,7 @@ export function createFakeDiffCommentEditor(
     decorations: () => decorations,
     decorationWrites: () => decorationWrites,
     scrollTop: () => scrollTop,
+    focusCount: () => focusCount,
     clientYForLine,
     setLineCount: (next) => {
       lineCount = next
diff --git a/src/renderer/src/components/diff-comments/diff-comment-view-zone-entry.ts b/src/renderer/src/components/diff-comments/diff-comment-view-zone-entry.ts
index 7e72732a6080..56e785f51b3e 100644
--- a/src/renderer/src/components/diff-comments/diff-comment-view-zone-entry.ts
+++ b/src/renderer/src/components/diff-comments/diff-comment-view-zone-entry.ts
@@ -13,13 +13,37 @@ export type ZoneEntry = {
   laidOut: boolean
 }
 
+export type DraftZoneEntry = {
+  editor: monacoEditor.ICodeEditor
+  zoneId: string
+  domNode: HTMLElement
+  marginDomNode: HTMLElement
+  delegate: monacoEditor.IViewZone
+  root: Root
+  draft: { lineNumber: number; startLine?: number }
+  body: string
+  // A save is in flight: the body must not be carried to another card, or the note could post twice.
+  submitting: boolean
+  disposeMouseDownStopper: () => void
+}
+
 // Card chrome + per-line body height; used by the initial estimate and the live resize, so keep in lockstep.
 export const ZONE_CHROME_PX = 68
 export const ZONE_LINE_PX = 20
 export const ZONE_MIN_PX = 88
+export const DRAFT_ZONE_DEFAULT_HEIGHT = 152
+
+export type ResizableZoneEntry = {
+  zoneId: string
+  domNode: HTMLElement
+  delegate: monacoEditor.IViewZone
+}
 
 // Re-measure/re-layout the zone: mutate delegate.heightInPx first (Monaco's _layoutZone re-reads it) so inline edit expands without clipping.
-export function resizeDiffCommentZone(editor: monacoEditor.ICodeEditor, entry: ZoneEntry): void {
+export function resizeDiffCommentZone(
+  editor: monacoEditor.ICodeEditor,
+  entry: ResizableZoneEntry
+): void {
   const child = entry.domNode.firstElementChild
   const wrapperStyle = window.getComputedStyle(entry.domNode)
   const verticalPadding =
diff --git a/src/renderer/src/components/diff-comments/diff-comment-zone-card.tsx b/src/renderer/src/components/diff-comments/diff-comment-zone-card.tsx
index 097b70d79725..d34de51a2bc5 100644
--- a/src/renderer/src/components/diff-comments/diff-comment-zone-card.tsx
+++ b/src/renderer/src/components/diff-comments/diff-comment-zone-card.tsx
@@ -5,6 +5,7 @@ import { formatDiffComments } from '@/lib/diff-comments-format'
 import { TooltipProvider } from '@/components/ui/tooltip'
 import type { DiffCommentDeliverySnapshot } from '@/store/slices/diffComments'
 import { DiffCommentCard } from './DiffCommentCard'
+import { DiffCommentDraftCard } from './DiffCommentDraftCard'
 import type { DecoratedDiffComment } from './decorated-diff-comment'
 import { NotesSendMenu, type NotesSendMenuScope } from '../editor/NotesSendMenu'
 import { translate } from '@/i18n/i18n'
@@ -118,3 +119,46 @@ export function renderDiffCommentZoneCard(
     </TooltipProvider>
   )
 }
+
+export type DiffCommentDraftCardContext = {
+  placeholder?: string
+  submitLabel?: string
+  submittingLabel?: string
+  initialBody?: string
+  onBodyChange?: (body: string) => void
+  resizeZone: () => void
+  onCancel: () => void
+  onSubmit: (body: string) => Promise<boolean>
+}
+
+export function renderDiffCommentDraftCard(
+  root: Root,
+  draft: { lineNumber: number; startLine?: number },
+  {
+    placeholder,
+    submitLabel,
+    submittingLabel,
+    initialBody,
+    onBodyChange,
+    resizeZone,
+    onCancel,
+    onSubmit
+  }: DiffCommentDraftCardContext
+): void {
+  root.render(
+    <TooltipProvider delayDuration={400}>
+      <DiffCommentDraftCard
+        lineNumber={draft.lineNumber}
+        startLine={draft.startLine}
+        placeholder={placeholder}
+        submitLabel={submitLabel}
+        submittingLabel={submittingLabel}
+        initialBody={initialBody}
+        onBodyChange={onBodyChange}
+        onCancel={onCancel}
+        onSubmit={onSubmit}
+        onContentResize={resizeZone}
+      />
+    </TooltipProvider>
+  )
+}
diff --git a/src/renderer/src/components/diff-comments/useDiffCommentDecorator.range-selection.test.tsx b/src/renderer/src/components/diff-comments/useDiffCommentDecorator.range-selection.test.tsx
index e09747b5932d..2708e63a1375 100644
--- a/src/renderer/src/components/diff-comments/useDiffCommentDecorator.range-selection.test.tsx
+++ b/src/renderer/src/components/diff-comments/useDiffCommentDecorator.range-selection.test.tsx
@@ -1,5 +1,5 @@
 // @vitest-environment happy-dom
-import { renderHook } from '@testing-library/react'
+import { act, renderHook } from '@testing-library/react'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import type { Selection } from 'monaco-editor'
 import type * as DiffCommentZoneCardModule from './diff-comment-zone-card'
@@ -37,6 +37,12 @@ type DecoratorProps = {
   commentableLineNumbers?: readonly number[]
   addNoteShortcutEnabled?: boolean
   onAddCommentClick?: (args: { lineNumber: number; startLine?: number; top: number }) => void
+  // Present on the inline-draft surfaces; absent for the legacy popover callers.
+  onCreateComment?: (args: {
+    lineNumber: number
+    startLine?: number
+    body: string
+  }) => Promise<boolean>
 }
 
 function renderDecorator(fake: FakeDiffCommentEditor, initialProps: DecoratorProps = {}) {
@@ -51,6 +57,7 @@ function renderDecorator(fake: FakeDiffCommentEditor, initialProps: DecoratorPro
         pendingCommentTarget: props.pendingCommentTarget ?? null,
         addNoteShortcutEnabled: props.addNoteShortcutEnabled ?? false,
         onAddCommentClick: props.onAddCommentClick ?? vi.fn(),
+        onCreateComment: props.onCreateComment,
         onDeleteComment: vi.fn()
       }),
     { initialProps }
@@ -102,19 +109,19 @@ function firePointerEvent(
 }
 
 // Mod+Shift+A on the platform this test's user agent reports.
-function pressAddReviewNoteChord(node: HTMLElement): void {
+function pressAddReviewNoteChord(node: HTMLElement): KeyboardEvent {
   const isMac = navigator.userAgent.includes('Mac')
-  node.dispatchEvent(
-    new KeyboardEvent('keydown', {
-      key: 'A',
-      code: 'KeyA',
-      shiftKey: true,
-      metaKey: isMac,
-      ctrlKey: !isMac,
-      bubbles: true,
-      cancelable: true
-    })
-  )
+  const event = new KeyboardEvent('keydown', {
+    key: 'A',
+    code: 'KeyA',
+    shiftKey: true,
+    metaKey: isMac,
+    ctrlKey: !isMac,
+    bubbles: true,
+    cancelable: true
+  })
+  node.dispatchEvent(event)
+  return event
 }
 
 const frameCallbacks: FrameRequestCallback[] = []
@@ -377,4 +384,29 @@ describe('useDiffCommentDecorator add-note chord', () => {
 
     expect(onAddCommentClick).toHaveBeenCalledTimes(1)
   })
+
+  it('leaves the chord to an open inline draft card instead of re-anchoring it', () => {
+    const fake = createFakeDiffCommentEditor()
+    vi.spyOn(fake.editor, 'getSelection').mockReturnValue(selectionOf(9, 1, 14, 8))
+    renderDecorator(fake, {
+      addNoteShortcutEnabled: true,
+      onCreateComment: vi.fn().mockResolvedValue(true)
+    })
+
+    act(() => {
+      pressAddReviewNoteChord(fake.domNode)
+    })
+    const [zone] = [...fake.zones.values()]
+    expect(zone?.afterLineNumber).toBe(14)
+
+    // The selection moved on, but the open card must keep its anchor and its text.
+    vi.spyOn(fake.editor, 'getSelection').mockReturnValue(selectionOf(30, 1, 32, 4))
+    const secondChord: { event?: KeyboardEvent } = {}
+    act(() => {
+      secondChord.event = pressAddReviewNoteChord(fake.domNode)
+    })
+
+    expect(secondChord.event?.defaultPrevented).toBe(true)
+    expect([...fake.zones.values()]).toEqual([zone])
+  })
 })
diff --git a/src/renderer/src/components/diff-comments/useDiffCommentDecorator.tsx b/src/renderer/src/components/diff-comments/useDiffCommentDecorator.tsx
index 6abbadc25cff..e94bb6fc59e2 100644
--- a/src/renderer/src/components/diff-comments/useDiffCommentDecorator.tsx
+++ b/src/renderer/src/components/diff-comments/useDiffCommentDecorator.tsx
@@ -7,7 +7,6 @@ import {
   installDiffCommentAddButtonOverlay,
   type DiffCommentAddButtonOverlayHandle
 } from './diff-comment-add-button-overlay'
-import type { DiffCommentLineRange, DiffCommentLineTarget } from './diff-comment-line-range'
 import { installDiffCommentAddNoteShortcut } from './diff-comment-add-note-shortcut'
 import { installDiffCommentZoneMouseDownStopper } from './diff-comment-zone-mouse-events'
 import { getRenderSignature, renderDiffCommentZoneCard } from './diff-comment-zone-card'
@@ -19,6 +18,10 @@ import {
   ZONE_MIN_PX,
   type ZoneEntry
 } from './diff-comment-view-zone-entry'
+import type { DiffCommentLineRange, DiffCommentLineTarget } from './diff-comment-line-range'
+import { useDiffCommentDraftZone, type DiffCommentDraft } from './diff-comment-draft-zone'
+
+export type { DiffCommentDraft }
 
 type DecoratorArgs = {
   editor: monacoEditor.ICodeEditor | null
@@ -29,13 +32,19 @@ type DecoratorArgs = {
   comments: readonly DecoratedDiffComment[]
   commentableLineNumbers?: readonly number[]
   addButtonLabel?: string
-  // The open composer's anchor — pass the composer state itself. Its lines stay lit while the
-  // note is written, and because the composer owns the range the band cannot outlive it.
   pendingCommentTarget?: DiffCommentLineTarget | null
   // Bind the Add Review Note chord to this editor. Off for the markdown editor, which already
   // binds it through its own input bindings.
   addNoteShortcutEnabled?: boolean
-  onAddCommentClick: (args: { lineNumber: number; startLine?: number; top: number }) => void
+  onCreateComment?: (args: {
+    lineNumber: number
+    startLine?: number
+    body: string
+  }) => Promise<boolean>
+  draftPlaceholder?: string
+  draftSubmitLabel?: string
+  canOpenDraft?: boolean
+  onAddCommentClick?: (args: { lineNumber: number; startLine?: number; top: number }) => void
   onDeleteComment: (commentId: string) => void
   // Present only on surfaces that allow editing (local diffs); PR review notes are remote and can't be edited here.
   onUpdateComment?: (commentId: string, body: string) => Promise<boolean>
@@ -55,6 +64,10 @@ export function useDiffCommentDecorator({
   addButtonLabel = 'Add note for the AI',
   pendingCommentTarget = null,
   addNoteShortcutEnabled = false,
+  onCreateComment,
+  draftPlaceholder,
+  draftSubmitLabel,
+  canOpenDraft,
   onAddCommentClick,
   onDeleteComment,
   onUpdateComment,
@@ -68,8 +81,6 @@ export function useDiffCommentDecorator({
   )
   const hoverLineRef = useRef<number | null>(null)
   const overlayRef = useRef<DiffCommentAddButtonOverlayHandle | null>(null)
-  // Mirrored so the overlay's install effect can re-apply the live range without depending on it;
-  // the effect below owns the value, and runs in the same commit as the install.
   const pendingCommentRangeRef = useRef<DiffCommentLineRange | null>(null)
   const setPendingCommentRange = useCallback((range: DiffCommentLineRange | null): void => {
     pendingCommentRangeRef.current = range
@@ -82,16 +93,25 @@ export function useDiffCommentDecorator({
   // Stash the diff-zones effect's scrollToZone closure so the request-effect can invoke the latest version.
   const scrollToZoneRef = useRef<((commentId: string) => void) | null>(null)
   const scrollToZoneFrameRef = useRef<number | null>(null)
+
   // Stash callbacks in refs so the effect doesn't tear down + re-attach on every parent render (parent passes inline arrows) — avoids flicker.
-  const onAddCommentClickRef = useRef(onAddCommentClick)
   const onDeleteCommentRef = useRef(onDeleteComment)
   const onUpdateCommentRef = useRef(onUpdateComment)
   const onPendingScrollConsumedRef = useRef(onPendingScrollConsumed)
-  onAddCommentClickRef.current = onAddCommentClick
   onDeleteCommentRef.current = onDeleteComment
   onUpdateCommentRef.current = onUpdateComment
   onPendingScrollConsumedRef.current = onPendingScrollConsumed
 
+  const { onAddCommentClickRef, isDraftOpen } = useDiffCommentDraftZone({
+    editor,
+    monacoModelIdentity,
+    onCreateComment,
+    draftPlaceholder,
+    draftSubmitLabel,
+    canOpenDraft,
+    onAddCommentClick
+  })
+
   const cancelScrollToZoneFrame = useCallback((): void => {
     if (scrollToZoneFrameRef.current === null) {
       return
@@ -135,19 +155,13 @@ export function useDiffCommentDecorator({
       onAddCommentClickRef
     })
     overlayRef.current = overlay
-    // A rebuild (model swap, widened commentable set) must not drop the open composer's band.
     overlay.setPendingRange(pendingCommentRangeRef.current)
     return () => {
       overlayRef.current = null
       overlay.dispose()
     }
-    // Why: the pending range is read through a ref and applied by the effect below, so opening or
-    // closing a composer must not tear down and rebuild the overlay mid-gesture.
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [addButtonLabel, commentableLineSet, editor, monacoModelIdentity])
+  }, [addButtonLabel, commentableLineSet, editor, monacoModelIdentity, onAddCommentClickRef])
 
-  // Keyed on the two line numbers, not the composer object: the composer's `top` is rewritten on
-  // every scroll frame, and none of that should reach a decoration write.
   const pendingLineNumber = pendingCommentTarget?.lineNumber ?? null
   const pendingStartLine = pendingCommentTarget?.startLine ?? null
   useEffect(() => {
@@ -158,6 +172,7 @@ export function useDiffCommentDecorator({
     setPendingCommentRange(range)
   }, [pendingLineNumber, pendingStartLine, setPendingCommentRange])
 
+  const hasDraftComposer = onCreateComment !== undefined
   useEffect(() => {
     if (!editor || !addNoteShortcutEnabled) {
       return
@@ -165,19 +180,24 @@ export function useDiffCommentDecorator({
     return installDiffCommentAddNoteShortcut({
       editor,
       commentableLineSet,
-      // The composer consumes the chord itself once open (DiffCommentPopover's guard); claiming
-      // it here as well would remount the composer over the user's draft. A live gutter drag owns
-      // the band the same way, and its range isn't committed yet — opening from the stale editor
-      // selection would remount the composer the moment the press lands.
+      // An open draft card owns the chord: claiming it here would re-open the card at the editor's
+      // selection and move the user's text. The card mounts synchronously, so a second chord in the
+      // same event turn already sees it. A live gutter drag owns the band the same way; opening
+      // from the stale editor selection during a drag would remount the card mid-gesture.
       isComposerOpen: () =>
-        pendingCommentRangeRef.current !== null || overlayRef.current?.isDragging() === true,
+        isDraftOpen() ||
+        pendingCommentRangeRef.current !== null ||
+        overlayRef.current?.isDragging() === true,
       onOpenComposer: (args) => {
-        // Claim synchronously so a second chord in the same event turn cannot open another draft
-        // before React commits the parent state update.
-        setPendingCommentRange({
-          startLine: args.startLine ?? args.lineNumber,
-          endLine: args.lineNumber
-        })
+        // Legacy popover callers commit composer state through React, so claim now or a same-turn
+        // repeat opens a second one; their pendingCommentTarget releases the claim on close. The
+        // inline draft card never passes one, so a claim here would never be released.
+        if (!hasDraftComposer) {
+          setPendingCommentRange({
+            startLine: args.startLine ?? args.lineNumber,
+            endLine: args.lineNumber
+          })
+        }
         onAddCommentClickRef.current(args)
       }
     })
@@ -185,7 +205,10 @@ export function useDiffCommentDecorator({
     addNoteShortcutEnabled,
     commentableLineSet,
     editor,
+    hasDraftComposer,
+    isDraftOpen,
     monacoModelIdentity,
+    onAddCommentClickRef,
     setPendingCommentRange
   ])
 
@@ -376,12 +399,12 @@ export function useDiffCommentDecorator({
     activeGroupId,
     cancelScrollToZoneFrame,
     clearDeliveredDiffComments,
+    comments,
     editor,
     filePath,
     formatCommentPrompt,
     monacoModelIdentity,
-    worktreeId,
-    comments
+    worktreeId
   ])
 
   // Scroll-to-note resolution splits across this effect (request after layout) and onDomNodeTop (before), via pendingScrollRef.
diff --git a/src/renderer/src/components/editor/DiffSectionBody.tsx b/src/renderer/src/components/editor/DiffSectionBody.tsx
index 3a21d2828615..869d0de5a730 100644
--- a/src/renderer/src/components/editor/DiffSectionBody.tsx
+++ b/src/renderer/src/components/editor/DiffSectionBody.tsx
@@ -1,10 +1,8 @@
-import type { RefObject } from 'react'
 import { lazyWithRetry as lazy } from '@/lib/lazy-with-retry'
 import { AlertCircle, RefreshCw } from 'lucide-react'
 import { DiffEditor, type DiffOnMount } from '@monaco-editor/react'
 import { cn } from '@/lib/utils'
 import { Button } from '@/components/ui/button'
-import { DiffCommentPopover } from '../diff-comments/DiffCommentPopover'
 import { combinedDiffSectionScrollbarOptions } from './diff-editor-scrollbar-options'
 import { isCombinedDiffSizeUnknown } from './combined-diff-on-demand-load'
 import type { DiffSection } from './diff-section-types'
@@ -21,18 +19,8 @@ const ImageDiffViewer = lazy(() => import('./ImageDiffViewer'))
 type DiffSectionBodyProps = {
   section: DiffSection
   index: number
-  sectionBodyRef: RefObject<HTMLDivElement | null>
   sectionBodyHeight: number | undefined
   useIntrinsicImageHeight: boolean
-  popover: {
-    lineNumber: number
-    startLine?: number
-    top: number
-    left?: number
-    lineHeight: number
-  } | null
-  addLineCommentPlaceholder?: string
-  addLineCommentLabel?: string
   isBranchMode: boolean
   sideBySide: boolean
   isDark: boolean
@@ -43,8 +31,6 @@ type DiffSectionBodyProps = {
   diffWordWrap?: boolean
   diffShowWhitespace?: boolean
   editorFontFamily?: string
-  onCancelComment: () => void
-  onSubmitComment: (body: string) => Promise<void>
   onRetrySection: (index: number) => void
   onLoadDeferredSection: (index: number) => void
   onSaveLimitedDiff: () => void
@@ -54,12 +40,8 @@ type DiffSectionBodyProps = {
 export function DiffSectionBody({
   section,
   index,
-  sectionBodyRef,
   sectionBodyHeight,
   useIntrinsicImageHeight,
-  popover,
-  addLineCommentPlaceholder,
-  addLineCommentLabel,
   isBranchMode,
   sideBySide,
   isDark,
@@ -70,8 +52,6 @@ export function DiffSectionBody({
   diffWordWrap,
   diffShowWhitespace,
   editorFontFamily,
-  onCancelComment,
-  onSubmitComment,
   onRetrySection,
   onLoadDeferredSection,
   onSaveLimitedDiff,
@@ -86,27 +66,9 @@ export function DiffSectionBody({
 
   return (
     <div
-      ref={sectionBodyRef}
       className={cn('relative', useIntrinsicImageHeight && 'overflow-visible')}
       style={sectionBodyHeight === undefined ? undefined : { height: sectionBodyHeight }}
     >
-      {popover && !renderLimit?.limited ? (
-        // Why: key by lineNumber so the popover remounts when the anchor
-        // line changes instead of leaking draft state across lines.
-        <DiffCommentPopover
-          key={`${popover.startLine ?? popover.lineNumber}:${popover.lineNumber}`}
-          lineNumber={popover.lineNumber}
-          startLine={popover.startLine}
-          top={popover.top}
-          left={popover.left}
-          lineHeight={popover.lineHeight}
-          placeholder={addLineCommentPlaceholder}
-          submitLabel={addLineCommentLabel}
-          submittingLabel="Posting…"
-          onCancel={onCancelComment}
-          onSubmit={onSubmitComment}
-        />
-      ) : null}
       {section.loadOnDemand ? (
         <LargeDiffLoadPrompt
           sizeUnknown={isCombinedDiffSizeUnknown(section)}
diff --git a/src/renderer/src/components/editor/DiffSectionItem.tsx b/src/renderer/src/components/editor/DiffSectionItem.tsx
index d1be74ca1995..45ddd300f22a 100644
--- a/src/renderer/src/components/editor/DiffSectionItem.tsx
+++ b/src/renderer/src/components/editor/DiffSectionItem.tsx
@@ -1,16 +1,11 @@
-import { useEffect, useMemo, useRef, useState } from 'react'
+import { useCallback, useEffect, useMemo, useRef, useState } from 'react'
 import type { DiffOnMount } from '@monaco-editor/react'
 import type { editor as monacoEditor } from 'monaco-editor'
-import { monaco } from '@/lib/monaco-setup'
 import { detectLanguage } from '@/lib/language-detect'
 import { useAppStore } from '@/store'
 import { computeDiffEditorFontSize, resolveEditorFontFamily } from '@/lib/editor-font-zoom'
 import { selectWorktreeDiffComments } from '@/store/worktree-diff-comments-selector'
 import { useDiffCommentDecorator } from '../diff-comments/useDiffCommentDecorator'
-import {
-  getDiffCommentPopoverLeft,
-  getDiffCommentPopoverTop
-} from '../diff-comments/diff-comment-popover-position'
 import { applyDiffEditorLineNumberOptions } from './diff-editor-line-number-options'
 import { DiffSectionHeader } from './DiffSectionHeader'
 import type { DiffComment } from '../../../../shared/diff-comment-types'
@@ -82,15 +77,7 @@ export function DiffSectionItem({
 
   const [modifiedEditor, setModifiedEditor] = useState<monacoEditor.ICodeEditor | null>(null)
   const diffEditorRef = useRef<monacoEditor.IStandaloneDiffEditor | null>(null)
-  const sectionBodyRef = useRef<HTMLDivElement | null>(null)
   const lineNumberOptionsSubRef = useRef<{ dispose: () => void } | null>(null)
-  const [popover, setPopover] = useState<{
-    lineNumber: number
-    startLine?: number
-    top: number
-    left?: number
-    lineHeight: number
-  } | null>(null)
   const hasLineCommentAction = Boolean(worktreeId || onAddLineComment)
 
   const { disposeDiffModels, setSectionRootNode } = useDiffSectionModelLifecycle({
@@ -98,6 +85,12 @@ export function DiffSectionItem({
     collapsed: section.collapsed
   })
 
+  const { lineStats, sectionBodyHeight, useIntrinsicImageHeight, isLargeDiffLimited } =
+    useDiffSectionLayoutMetrics({
+      section,
+      sectionHeight
+    })
+
   // Why: only forward the pending scroll id when it matches a comment in this
   // section so unrelated sections don't keep re-rendering their decorator
   // every time the sidebar requests a scroll elsewhere.
@@ -108,25 +101,41 @@ export function DiffSectionItem({
     return diffComments.some((c) => c.id === scrollToDiffCommentId) ? scrollToDiffCommentId : null
   }, [scrollToDiffCommentId, diffComments])
 
+  const handleCreateComment = useCallback(
+    async ({
+      lineNumber,
+      startLine,
+      body
+    }: {
+      lineNumber: number
+      startLine?: number
+      body: string
+    }): Promise<boolean> => {
+      return submitDiffSectionComment({
+        addDiffComment,
+        body,
+        onAddLineComment,
+        target: { lineNumber, startLine },
+        section,
+        worktreeId
+      })
+    },
+    [addDiffComment, onAddLineComment, section, worktreeId]
+  )
+
   useDiffCommentDecorator({
     editor: hasLineCommentAction ? modifiedEditor : null,
+    monacoModelIdentity: `${modelPathBase}:modified`,
     filePath: section.path,
     worktreeId: worktreeId ?? '',
     comments: inlineComments ?? (worktreeId ? diffComments : []),
     commentableLineNumbers: getCommentableLineNumbers?.(section),
     addButtonLabel: addLineCommentLabel,
-    pendingCommentTarget: popover,
     addNoteShortcutEnabled: hasLineCommentAction,
-    onAddCommentClick: ({ lineNumber, startLine, top }) =>
-      setPopover({
-        lineNumber,
-        startLine,
-        top,
-        left: modifiedEditor
-          ? (getDiffCommentPopoverLeft(modifiedEditor, sectionBodyRef.current) ?? undefined)
-          : undefined,
-        lineHeight: modifiedEditor?.getOption(monaco.editor.EditorOption.lineHeight) ?? 0
-      }),
+    onCreateComment: handleCreateComment,
+    draftPlaceholder: addLineCommentPlaceholder,
+    draftSubmitLabel: addLineCommentLabel,
+    canOpenDraft: !isLargeDiffLimited,
     onDeleteComment: (id) => {
       if (worktreeId) {
         void deleteDiffComment(worktreeId, id)
@@ -137,36 +146,6 @@ export function DiffSectionItem({
     onPendingScrollConsumed: () => setScrollToDiffCommentId(null)
   })
 
-  useEffect(() => {
-    if (!modifiedEditor || !popover) {
-      return
-    }
-    const update = (): void => {
-      const lineHeight = modifiedEditor.getOption(monaco.editor.EditorOption.lineHeight)
-      const top = getDiffCommentPopoverTop(modifiedEditor, popover.lineNumber, lineHeight)
-      if (top == null) {
-        setPopover(null)
-        return
-      }
-      const left = getDiffCommentPopoverLeft(modifiedEditor, sectionBodyRef.current)
-      setPopover((prev) =>
-        prev ? { ...prev, top, left: left == null ? prev.left : left, lineHeight } : prev
-      )
-    }
-    const scrollSub = modifiedEditor.onDidScrollChange(update)
-    const contentSub = modifiedEditor.onDidContentSizeChange(update)
-    const layoutSub = modifiedEditor.onDidLayoutChange(update)
-    return () => {
-      scrollSub.dispose()
-      contentSub.dispose()
-      layoutSub.dispose()
-    }
-    // Why: depend on popover.lineNumber (not the whole popover object) so the
-    // effect doesn't re-subscribe on every top update it dispatches. The guard
-    // on `popover` above handles the popover-closed case.
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [modifiedEditor, popover?.lineNumber])
-
   useEffect(() => {
     const diffEditor = diffEditorRef.current
     if (!diffEditor) {
@@ -180,29 +159,6 @@ export function DiffSectionItem({
     }
   }, [sideBySide])
 
-  const handleSubmitComment = async (body: string): Promise<void> => {
-    if (!popover) {
-      return
-    }
-    const submitted = await submitDiffSectionComment({
-      addDiffComment,
-      body,
-      onAddLineComment,
-      popover,
-      section,
-      worktreeId
-    })
-    if (submitted) {
-      setPopover(null)
-    }
-  }
-
-  const { lineStats, sectionBodyHeight, useIntrinsicImageHeight, isLargeDiffLimited } =
-    useDiffSectionLayoutMetrics({
-      section,
-      sectionHeight
-    })
-
   useDiffSectionFallbackCleanup({
     disposeDiffModels,
     index,
@@ -256,7 +212,7 @@ export function DiffSectionItem({
     // Why: Monaco disposes inner editors when the DiffEditor container is
     // unmounted (e.g. section collapse, tab change). Clearing the state
     // prevents decorator effects and scroll subscriptions from invoking
-    // methods on a disposed editor instance, and avoids `popover` pointing
+    // methods on a disposed editor instance, and avoids stale draft state pointing
     // at a line in an editor that no longer exists.
     modified.onDidDispose(() => {
       contentSizeSub.dispose()
@@ -272,7 +228,6 @@ export function DiffSectionItem({
         modifiedEditorsRef.current.delete(index)
       }
       setModifiedEditor(null)
-      setPopover(null)
     })
 
     if (!isEditable) {
@@ -361,12 +316,8 @@ export function DiffSectionItem({
         <DiffSectionBody
           section={section}
           index={index}
-          sectionBodyRef={sectionBodyRef}
           sectionBodyHeight={sectionBodyHeight}
           useIntrinsicImageHeight={useIntrinsicImageHeight}
-          popover={popover}
-          addLineCommentPlaceholder={addLineCommentPlaceholder}
-          addLineCommentLabel={addLineCommentLabel}
           isBranchMode={isBranchMode}
           sideBySide={sideBySide}
           isDark={isDark}
@@ -377,8 +328,6 @@ export function DiffSectionItem({
           diffWordWrap={settings?.diffWordWrap}
           diffShowWhitespace={settings?.diffShowWhitespace}
           editorFontFamily={resolveEditorFontFamily(settings)}
-          onCancelComment={() => setPopover(null)}
-          onSubmitComment={handleSubmitComment}
           onRetrySection={retrySection}
           onLoadDeferredSection={loadDeferredSection ?? loadSection}
           onSaveLimitedDiff={() => void handleSectionSaveRef.current(index)}
diff --git a/src/renderer/src/components/editor/DiffViewer.tsx b/src/renderer/src/components/editor/DiffViewer.tsx
index 77610151f7e2..e48ff20b325d 100644
--- a/src/renderer/src/components/editor/DiffViewer.tsx
+++ b/src/renderer/src/components/editor/DiffViewer.tsx
@@ -3,16 +3,12 @@ import { DiffEditor, type DiffOnMount } from '@monaco-editor/react'
 import type { editor } from 'monaco-editor'
 import { useAppStore } from '@/store'
 import { diffViewStateCache, setWithLRU } from '@/lib/scroll-cache'
-import { monaco } from '@/lib/monaco-setup'
 import { computeDiffEditorFontSize, resolveEditorFontFamily } from '@/lib/editor-font-zoom'
 import { useContextualCopySetup } from './useContextualCopySetup'
 import { selectWorktreeDiffComments } from '@/store/worktree-diff-comments-selector'
 import { useDiffCommentDecorator } from '../diff-comments/useDiffCommentDecorator'
-import { DiffCommentPopover } from '../diff-comments/DiffCommentPopover'
-import {
-  getDiffCommentPopoverLeft,
-  getDiffCommentPopoverTop
-} from '../diff-comments/diff-comment-popover-position'
+import { toast } from 'sonner'
+import { translate } from '@/i18n/i18n'
 import { applyDiffEditorLineNumberOptions } from './diff-editor-line-number-options'
 import type { DiffComment } from '../../../../shared/diff-comment-types'
 import { isDiffComment } from '@/lib/diff-comment-compat'
@@ -73,16 +69,8 @@ export default function DiffViewer({
 
   const diffEditorRef = useRef<editor.IStandaloneDiffEditor | null>(null)
   const { registerDiffEditor, unregisterDiffEditor } = useDiffEditorRegistration()
-  const diffBodyRef = useRef<HTMLDivElement | null>(null)
   const lineNumberOptionsSubRef = useRef<{ dispose: () => void } | null>(null)
   const [modifiedEditor, setModifiedEditor] = useState<editor.ICodeEditor | null>(null)
-  const [popover, setPopover] = useState<{
-    lineNumber: number
-    startLine?: number
-    top: number
-    left?: number
-    lineHeight: number
-  } | null>(null)
 
   const renderLimit = useMemo(
     () => largeDiffRenderLimit ?? getLargeDiffRenderLimit({ originalContent, modifiedContent }),
@@ -98,6 +86,45 @@ export default function DiffViewer({
     return diffComments.some((c) => c.id === scrollToDiffCommentId) ? scrollToDiffCommentId : null
   }, [scrollToDiffCommentId, diffComments, worktreeId])
 
+  const handleCreateComment = useCallback(
+    async ({
+      lineNumber,
+      startLine,
+      body
+    }: {
+      lineNumber: number
+      startLine?: number
+      body: string
+    }): Promise<boolean> => {
+      if (onAddLineComment) {
+        return onAddLineComment({
+          lineNumber,
+          startLine,
+          body
+        })
+      }
+      if (!worktreeId) {
+        return false
+      }
+      const result = await addDiffComment({
+        worktreeId,
+        filePath: relativePath,
+        source: 'diff',
+        startLine,
+        lineNumber,
+        body,
+        side: 'modified'
+      })
+      if (!result) {
+        toast.error(
+          translate('auto.components.editor.diffCommentSaveFailed', 'Failed to save comment')
+        )
+      }
+      return Boolean(result)
+    },
+    [addDiffComment, onAddLineComment, relativePath, worktreeId]
+  )
+
   // Why: gate the decorator on a comment target; updateDiffComment is only wired for local diffs (worktreeId present).
   useDiffCommentDecorator({
     editor: hasLineCommentAction ? modifiedEditor : null,
@@ -107,18 +134,11 @@ export default function DiffViewer({
     comments: worktreeId ? diffComments : [],
     commentableLineNumbers,
     addButtonLabel: addLineCommentLabel,
-    pendingCommentTarget: popover,
     addNoteShortcutEnabled: hasLineCommentAction,
-    onAddCommentClick: ({ lineNumber, startLine, top }) =>
-      setPopover({
-        lineNumber,
-        startLine,
-        top,
-        left: modifiedEditor
-          ? (getDiffCommentPopoverLeft(modifiedEditor, diffBodyRef.current) ?? undefined)
-          : undefined,
-        lineHeight: modifiedEditor?.getOption(monaco.editor.EditorOption.lineHeight) ?? 0
-      }),
+    onCreateComment: handleCreateComment,
+    draftPlaceholder: addLineCommentPlaceholder,
+    draftSubmitLabel: addLineCommentLabel,
+    canOpenDraft: !renderLimit.limited,
     onDeleteComment: (id) => {
       if (worktreeId) {
         void deleteDiffComment(worktreeId, id)
@@ -129,34 +149,6 @@ export default function DiffViewer({
     onPendingScrollConsumed: () => setScrollToDiffCommentId(null)
   })
 
-  useEffect(() => {
-    if (!modifiedEditor || !popover) {
-      return
-    }
-    const update = (): void => {
-      const lineHeight = modifiedEditor.getOption(monaco.editor.EditorOption.lineHeight)
-      const top = getDiffCommentPopoverTop(modifiedEditor, popover.lineNumber, lineHeight)
-      if (top == null) {
-        setPopover(null)
-        return
-      }
-      const left = getDiffCommentPopoverLeft(modifiedEditor, diffBodyRef.current)
-      setPopover((prev) =>
-        prev ? { ...prev, top, left: left == null ? prev.left : left, lineHeight } : prev
-      )
-    }
-    const scrollSub = modifiedEditor.onDidScrollChange(update)
-    const contentSub = modifiedEditor.onDidContentSizeChange(update)
-    const layoutSub = modifiedEditor.onDidLayoutChange(update)
-    return () => {
-      scrollSub.dispose()
-      contentSub.dispose()
-      layoutSub.dispose()
-    }
-    // Why: depend on popover.lineNumber (not the whole object) so the effect doesn't re-subscribe on every top update.
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [modifiedEditor, popover?.lineNumber])
-
   useDiffViewerFirstChangeAutoScroll({
     diffEditorRef,
     modifiedEditor,
@@ -175,44 +167,8 @@ export default function DiffViewer({
       unregisterDiffEditor(fallenBackEditor)
     }
     setModifiedEditor(null)
-    setPopover(null)
   }, [unregisterDiffEditor])
 
-  const handleSubmitComment = async (body: string): Promise<void> => {
-    if (!popover) {
-      return
-    }
-    if (onAddLineComment) {
-      const ok = await onAddLineComment({
-        lineNumber: popover.lineNumber,
-        startLine: popover.startLine,
-        body
-      })
-      if (ok) {
-        setPopover(null)
-      }
-      return
-    }
-    if (!worktreeId) {
-      return
-    }
-    // Why: await persistence — a null result (failed save) keeps the popover open for retry instead of losing the draft.
-    const result = await addDiffComment({
-      worktreeId,
-      filePath: relativePath,
-      source: 'diff',
-      startLine: popover.startLine,
-      lineNumber: popover.lineNumber,
-      body,
-      side: 'modified'
-    })
-    if (result) {
-      setPopover(null)
-    } else {
-      console.error('Failed to add diff comment — draft preserved')
-    }
-  }
-
   // Keep refs to latest callbacks so the mounted editor always calls current versions
   const onSaveRef = useRef(onSave)
   onSaveRef.current = onSave
@@ -287,7 +243,6 @@ export default function DiffViewer({
         diffEditorRef.current = null
         unregisterDiffEditor(diffEditor)
         setModifiedEditor(null)
-        setPopover(null)
       })
     },
     [editable, setupCopy, modelKey, filePath, sideBySide, registerDiffEditor, unregisterDiffEditor]
@@ -321,22 +276,7 @@ export default function DiffViewer({
 
   return (
     <div className="flex flex-col flex-1 min-h-0">
-      <div ref={diffBodyRef} className="flex-1 min-h-0 relative">
-        {popover && hasLineCommentAction && !renderLimit.limited && (
-          <DiffCommentPopover
-            key={`${popover.startLine ?? popover.lineNumber}:${popover.lineNumber}`}
-            lineNumber={popover.lineNumber}
-            startLine={popover.startLine}
-            top={popover.top}
-            left={popover.left}
-            lineHeight={popover.lineHeight}
-            placeholder={addLineCommentPlaceholder}
-            submitLabel={addLineCommentLabel}
-            submittingLabel="Posting…"
-            onCancel={() => setPopover(null)}
-            onSubmit={handleSubmitComment}
-          />
-        )}
+      <div className="flex-1 min-h-0 relative">
         {renderLimit.limited ? (
           <LargeDiffFallback
             filePath={relativePath}
diff --git a/src/renderer/src/components/editor/IpynbCellToolbar.tsx b/src/renderer/src/components/editor/IpynbCellToolbar.tsx
index 04adc0849040..2ca3f42b0b61 100644
--- a/src/renderer/src/components/editor/IpynbCellToolbar.tsx
+++ b/src/renderer/src/components/editor/IpynbCellToolbar.tsx
@@ -41,33 +41,47 @@ function cellKindLabel(kind: IpynbCellKind): string {
 export function IpynbToolbarButton({
   label,
   disabled = false,
+  disabledReason,
   shortcut,
   onClick,
   children
 }: {
   label: string
   disabled?: boolean
+  /** Shown instead of the label while disabled, so the user learns why. */
+  disabledReason?: string
   shortcut?: ShortcutKeyComboDetails
   onClick: () => void
   children: ReactNode
 }): React.JSX.Element {
+  const reason = disabled ? disabledReason : undefined
+  const button = (
+    <Button
+      type="button"
+      variant="ghost"
+      size="icon-xs"
+      aria-label={label}
+      disabled={disabled}
+      onClick={onClick}
+    >
+      {children}
+    </Button>
+  )
   return (
     <Tooltip>
       <TooltipTrigger asChild>
-        <Button
-          type="button"
-          variant="ghost"
-          size="icon-xs"
-          aria-label={label}
-          disabled={disabled}
-          onClick={onClick}
-        >
-          {children}
-        </Button>
+        {/* Why the span: a disabled button gets no pointer or focus events, so its tooltip never opens. */}
+        {reason ? (
+          <span tabIndex={0} aria-label={reason} className="inline-flex">
+            {button}
+          </span>
+        ) : (
+          button
+        )}
       </TooltipTrigger>
       <TooltipContent side="top" sideOffset={4}>
         <span className="flex items-center gap-2">
-          <span>{label}</span>
+          <span>{reason ?? label}</span>
           {shortcut && shortcut.keys.length > 0 ? (
             <ShortcutKeyCombo keys={shortcut.keys} doubleTap={shortcut.doubleTap} />
           ) : null}
diff --git a/src/renderer/src/components/editor/IpynbKernelToolbar.test.tsx b/src/renderer/src/components/editor/IpynbKernelToolbar.test.tsx
index 71348f4839a0..cd68eec18bca 100644
--- a/src/renderer/src/components/editor/IpynbKernelToolbar.test.tsx
+++ b/src/renderer/src/components/editor/IpynbKernelToolbar.test.tsx
@@ -1,25 +1,100 @@
 // @vitest-environment happy-dom
-import { cleanup, fireEvent, render, screen } from '@testing-library/react'
+import { act, cleanup, fireEvent, render, screen, waitFor } from '@testing-library/react'
 import { afterEach, describe, expect, it, vi } from 'vitest'
 import { TooltipProvider } from '@/components/ui/tooltip'
 
-vi.hoisted(() => {
+const { listPythonEnvironments } = vi.hoisted(() => {
+  const listPythonEnvironments = vi.fn()
   // The kernel session subscribes to kernel frames when it loads.
   Object.defineProperty(window, 'api', {
     configurable: true,
-    value: { notebook: { onKernelFrame: () => () => {} } }
+    value: { notebook: { onKernelFrame: () => () => {}, listPythonEnvironments } }
   })
+  return { listPythonEnvironments }
 })
 vi.mock('@/i18n/i18n', () => ({ translate: (_key: string, fallback: string) => fallback }))
 vi.mock('@/store', () => ({ useAppStore: { subscribe: () => () => {} } }))
 
 import { IpynbKernelToolbar } from './IpynbKernelToolbar'
+import { trustNotebook } from './ipynb-kernel-session'
 import { getSession, setEnvironment, updateSession } from './ipynb-kernel-store'
 
 const FILE = '/repo/nb.ipynb'
+const CREATE_VENV = /^Create virtual environment…/
+const TRUST_FIRST = 'Run a cell to trust this notebook first'
 
 afterEach(cleanup)
 
+function renderToolbar(filePath: string) {
+  return render(
+    <TooltipProvider>
+      <IpynbKernelToolbar
+        filePath={filePath}
+        rootPath="/repo"
+        onRunAll={vi.fn()}
+        onClearAll={vi.fn()}
+      />
+    </TooltipProvider>
+  )
+}
+
+function togglePicker(label: string): void {
+  fireEvent.pointerDown(screen.getByRole('button', { name: label }), {
+    button: 0,
+    ctrlKey: false,
+    pointerType: 'mouse'
+  })
+}
+
+describe('kernel picker trust', () => {
+  it('lists workspace envs without running them until the notebook is trusted', async () => {
+    const file = '/repo/untrusted.ipynb'
+    const venv = { path: '/repo/.venv/bin/python', name: '.venv' }
+    listPythonEnvironments.mockResolvedValue({
+      workspace: [venv],
+      path: [{ path: '/usr/bin/python3', name: 'python3', version: '3.12.1' }]
+    })
+    renderToolbar(file)
+
+    togglePicker('Select Kernel')
+    await screen.findByText('/repo/.venv/bin/python')
+    expect(listPythonEnvironments).toHaveBeenLastCalledWith({
+      filePath: file,
+      rootPath: '/repo',
+      runWorkspaceInterpreters: false
+    })
+    // A version read from nowhere shows the bare env name.
+    expect(screen.getByText('.venv')).toBeTruthy()
+    // Creating a .venv would reuse, and so run, one the repo shipped; the item says why it is off.
+    expect(screen.getByRole('menuitem', { name: CREATE_VENV }).dataset.disabled).toBe('')
+    expect(screen.getByText(TRUST_FIRST)).toBeTruthy()
+
+    act(() => trustNotebook(file))
+    await waitFor(() =>
+      expect(listPythonEnvironments).toHaveBeenLastCalledWith({
+        filePath: file,
+        rootPath: '/repo',
+        runWorkspaceInterpreters: true
+      })
+    )
+    expect(screen.getByRole('menuitem', { name: CREATE_VENV }).dataset.disabled).toBeUndefined()
+    expect(screen.queryByText(TRUST_FIRST)).toBeNull()
+  })
+
+  it('keeps Restart kernel disabled, and says why, until the notebook is trusted', () => {
+    const file = '/repo/saved-env.ipynb'
+    setEnvironment(file, { path: '/repo/.venv/bin/python', name: '.venv', version: '3.12.1' })
+    renderToolbar(file)
+    expect(screen.getByRole('button', { name: 'Restart kernel' })).toHaveProperty('disabled', true)
+    // The focusable wrapper is what lets the disabled button's tooltip open.
+    expect(screen.getByLabelText(TRUST_FIRST).getAttribute('tabindex')).toBe('0')
+
+    act(() => trustNotebook(file))
+    expect(screen.getByRole('button', { name: 'Restart kernel' })).toHaveProperty('disabled', false)
+    expect(screen.queryByLabelText(TRUST_FIRST)).toBeNull()
+  })
+})
+
 describe('ipykernel setup dialog', () => {
   it('Cancel drops the waiting cells, as Esc does', () => {
     const venv = { path: '/repo/.venv/bin/python', name: '.venv', version: '3.12.1' }
diff --git a/src/renderer/src/components/editor/IpynbKernelToolbar.tsx b/src/renderer/src/components/editor/IpynbKernelToolbar.tsx
index c15b4f69c139..00092c3719c0 100644
--- a/src/renderer/src/components/editor/IpynbKernelToolbar.tsx
+++ b/src/renderer/src/components/editor/IpynbKernelToolbar.tsx
@@ -40,7 +40,7 @@ import { useNotebookKernelState } from './ipynb-kernel-store'
 type KernelState = ReturnType<typeof useNotebookKernelState>
 
 function environmentLabel({ name, version }: PythonEnvironment): string {
-  return `${name} (Python ${version})`
+  return version ? `${name} (Python ${version})` : name
 }
 
 function kernelLabel({ environment, status, setup }: KernelState): string {
@@ -109,21 +109,27 @@ export function IpynbKernelToolbar({
     kernel.status === 'starting' || (kernel.setup !== null && kernel.setup.phase !== 'idle')
   // A PATH interpreter, not the selected one: that may be the very .venv being (re)created.
   const venvBase = environments?.path[0]
+  const untrustedHint = translate(
+    'auto.components.editor.IpynbViewer.trustFirst',
+    'Run a cell to trust this notebook first'
+  )
 
   useEffect(() => {
     if (!pickerOpen) {
       return
     }
     let current = true
-    void window.api.notebook.listPythonEnvironments({ filePath, rootPath }).then((found) => {
-      if (current) {
-        setEnvironments(found)
-      }
-    })
+    void window.api.notebook
+      .listPythonEnvironments({ filePath, rootPath, runWorkspaceInterpreters: kernel.trusted })
+      .then((found) => {
+        if (current) {
+          setEnvironments(found)
+        }
+      })
     return () => {
       current = false
     }
-  }, [filePath, pickerOpen, rootPath])
+  }, [filePath, kernel.trusted, pickerOpen, rootPath])
 
   const choose = (path: string): void => {
     const environment = [...(environments?.workspace ?? []), ...(environments?.path ?? [])].find(
@@ -146,7 +152,9 @@ export function IpynbKernelToolbar({
       ) : null}
       <IpynbToolbarButton
         label={translate('auto.components.editor.IpynbViewer.restart', 'Restart kernel')}
-        disabled={!kernel.environment || settling}
+        // No kernel can start before trust, so a restart there would silently do nothing.
+        disabled={!kernel.environment || !kernel.trusted || settling}
+        disabledReason={kernel.environment && !kernel.trusted ? untrustedHint : undefined}
         onClick={() => restartKernel(filePath)}
       >
         <RotateCcw />
@@ -220,8 +228,9 @@ export function IpynbKernelToolbar({
             <FolderOpen />
             {translate('auto.components.editor.IpynbViewer.browsePython', 'Browse for Python…')}
           </DropdownMenuItem>
+          {/* Why trusted: it reuses an existing .venv, running a Python the repo may have shipped. */}
           <DropdownMenuItem
-            disabled={!venvBase}
+            disabled={!venvBase || !kernel.trusted}
             onSelect={() => {
               if (venvBase) {
                 offerVirtualEnvironment(filePath, venvBase)
@@ -229,10 +238,17 @@ export function IpynbKernelToolbar({
             }}
           >
             <Plus />
-            {translate(
-              'auto.components.editor.IpynbViewer.createVenvItem',
-              'Create virtual environment…'
-            )}
+            <span className="flex min-w-0 flex-col">
+              <span>
+                {translate(
+                  'auto.components.editor.IpynbViewer.createVenvItem',
+                  'Create virtual environment…'
+                )}
+              </span>
+              {venvBase && !kernel.trusted ? (
+                <span className="text-xs text-muted-foreground">{untrustedHint}</span>
+              ) : null}
+            </span>
           </DropdownMenuItem>
         </DropdownMenuContent>
       </DropdownMenu>
diff --git a/src/renderer/src/components/editor/PdfFind.test.tsx b/src/renderer/src/components/editor/PdfFind.test.tsx
new file mode 100644
index 000000000000..a08f26404588
--- /dev/null
+++ b/src/renderer/src/components/editor/PdfFind.test.tsx
@@ -0,0 +1,153 @@
+// @vitest-environment happy-dom
+
+import { act, cleanup, fireEvent, render } from '@testing-library/react'
+// PDF.js's legacy entry supplies the runtime polyfills for Node-based tests.
+import 'pdfjs-dist/legacy/build/pdf.mjs'
+import { EventBus, FindState } from 'pdfjs-dist/web/pdf_viewer.mjs'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import PdfFind from './PdfFind'
+
+vi.mock('@/i18n/i18n', () => ({
+  translate: (_key: string, fallback: string, values?: { value0: number; value1: number }) =>
+    fallback
+      .replace('{{value0}}', String(values?.value0))
+      .replace('{{value1}}', String(values?.value1))
+}))
+
+afterEach(() => {
+  cleanup()
+  vi.restoreAllMocks()
+})
+
+function setup() {
+  const bus = new EventBus()
+  const eventBusRef = { current: bus }
+  const onClose = vi.fn()
+  const view = render(<PdfFind isOpen onClose={onClose} eventBusRef={eventBusRef} />)
+  const query = (value: string): void => {
+    fireEvent.change(view.getByPlaceholderText('Find in page...'), { target: { value } })
+  }
+  const count = (current: number, total: number): void => {
+    act(() =>
+      bus.dispatch('updatefindmatchescount', { source: bus, matchesCount: { current, total } })
+    )
+  }
+  const control = (current: number, total: number, state = FindState.FOUND): void => {
+    act(() =>
+      bus.dispatch('updatefindcontrolstate', {
+        source: bus,
+        state,
+        previous: false,
+        entireWord: false,
+        rawQuery: 'needle',
+        matchesCount: { current, total }
+      })
+    )
+  }
+  const open = (isOpen: boolean): void => {
+    view.rerender(<PdfFind isOpen={isOpen} onClose={onClose} eventBusRef={eventBusRef} />)
+  }
+  return { bus, view, query, count, control, open, onClose }
+}
+
+describe('PDF find event synchronization', () => {
+  it('follows progressive totals and control-state navigation, wrap, and no results', () => {
+    const { view, query, count, control } = setup()
+    query('needle')
+    count(1, 2)
+    expect(view.getByText('1 of 2')).toBeTruthy()
+    count(1, 6)
+    expect(view.getByText('1 of 6')).toBeTruthy()
+    control(2, 6)
+    expect(view.getByText('2 of 6')).toBeTruthy()
+    control(6, 6, FindState.WRAPPED)
+    expect(view.getByText('6 of 6')).toBeTruthy()
+    query('absent')
+    control(6, 6, FindState.PENDING)
+    control(0, 0, FindState.NOT_FOUND)
+    expect(view.getByText('No matches')).toBeTruthy()
+    query('beacon')
+    count(1, 2)
+    expect(view.getByText('1 of 2')).toBeTruthy()
+  })
+
+  it('subscribes before a synchronous cached result on reopening', () => {
+    const { bus, view, query, count, open } = setup()
+    query('needle')
+    count(2, 6)
+    open(false)
+    bus.on('find', () => {
+      bus.dispatch('updatefindcontrolstate', {
+        source: bus,
+        state: FindState.PENDING,
+        rawQuery: 'needle',
+        matchesCount: { current: 2, total: 6 }
+      })
+    })
+    open(true)
+    expect(view.getByText('2 of 6')).toBeTruthy()
+  })
+
+  it('removes both listeners on close and unmount without accumulating on reopen', () => {
+    const { view, open, query, control } = setup()
+    const on = vi.spyOn(EventBus.prototype, 'on')
+    const off = vi.spyOn(EventBus.prototype, 'off')
+    open(false)
+    expect(off.mock.calls.map(([name]) => name)).toEqual([
+      'updatefindmatchescount',
+      'updatefindcontrolstate'
+    ])
+    off.mockClear()
+    for (let cycle = 0; cycle < 3; cycle += 1) {
+      open(true)
+      query('needle')
+      control(3, 6)
+      expect(view.getByText('3 of 6')).toBeTruthy()
+      if (cycle < 2) {
+        open(false)
+      }
+    }
+    view.unmount()
+    expect(on.mock.calls).toHaveLength(6)
+    expect(off.mock.calls).toEqual(on.mock.calls)
+  })
+
+  it('keeps empty queries clear even if a pending scan reports late', () => {
+    const { view, query, count, control } = setup()
+    query('needle')
+    count(2, 6)
+    query('')
+    count(3, 6)
+    control(3, 6)
+    expect(view.queryByText('3 of 6')).toBeNull()
+    query('absent')
+    expect(view.getByText('No matches')).toBeTruthy()
+  })
+
+  it('dispatches next and previous from buttons and Enter without changing the query', () => {
+    const { view, query, onClose } = setup()
+    const dispatch = vi.spyOn(EventBus.prototype, 'dispatch')
+    query('needle')
+    const input = view.getByPlaceholderText('Find in page...')
+    fireEvent.click(view.getByTitle('Next match'))
+    fireEvent.click(view.getByTitle('Previous match'))
+    fireEvent.keyDown(input, { key: 'Enter' })
+    fireEvent.keyDown(input, { key: 'Enter', shiftKey: true })
+    expect(dispatch.mock.calls.filter(([name]) => name === 'find')).toEqual(
+      ['', 'again', 'again', 'again', 'again'].map((type, index) => [
+        'find',
+        {
+          source: null,
+          type,
+          query: 'needle',
+          highlightAll: true,
+          caseSensitive: false,
+          entireWord: false,
+          findPrevious: index === 2 || index === 4
+        }
+      ])
+    )
+    fireEvent.keyDown(input, { key: 'Escape' })
+    expect(onClose).toHaveBeenCalledOnce()
+  })
+})
diff --git a/src/renderer/src/components/editor/PdfFind.tsx b/src/renderer/src/components/editor/PdfFind.tsx
index 16b42e7effb3..a186123bcfac 100644
--- a/src/renderer/src/components/editor/PdfFind.tsx
+++ b/src/renderer/src/components/editor/PdfFind.tsx
@@ -60,20 +60,7 @@ export default function PdfFind({
     input.select()
   }, [])
 
-  useEffect(() => {
-    if (!isOpen) {
-      return
-    }
-    if (!requestQuery) {
-      const eventBus = eventBusRef.current
-      if (eventBus) {
-        eventBus.dispatch('findbarclose', { source: null })
-      }
-      return
-    }
-    dispatchFind('')
-  }, [requestQuery, isOpen, dispatchFind, eventBusRef])
-
+  // Subscribe before dispatching: PDF.js can report cached counts synchronously.
   useEffect(() => {
     const eventBus = eventBusRef.current
     if (!eventBus || !isOpen) {
@@ -86,11 +73,28 @@ export default function PdfFind({
       setTotalMatches(evt.matchesCount.total)
     }
     eventBus.on('updatefindmatchescount', handleMatchesCount)
+    // Navigation and zero-result searches report counts on the control-state event.
+    eventBus.on('updatefindcontrolstate', handleMatchesCount)
     return () => {
       eventBus.off('updatefindmatchescount', handleMatchesCount)
+      eventBus.off('updatefindcontrolstate', handleMatchesCount)
     }
   }, [eventBusRef, isOpen])
 
+  useEffect(() => {
+    if (!isOpen) {
+      return
+    }
+    if (!requestQuery) {
+      const eventBus = eventBusRef.current
+      if (eventBus) {
+        eventBus.dispatch('findbarclose', { source: null })
+      }
+      return
+    }
+    dispatchFind('')
+  }, [requestQuery, isOpen, dispatchFind, eventBusRef])
+
   const handleKeyDown = useCallback(
     (e: React.KeyboardEvent) => {
       e.stopPropagation()
diff --git a/src/renderer/src/components/editor/RichMarkdownEditorSurface.tsx b/src/renderer/src/components/editor/RichMarkdownEditorSurface.tsx
index 8e2ca1e4abbe..6c71a126ecd2 100644
--- a/src/renderer/src/components/editor/RichMarkdownEditorSurface.tsx
+++ b/src/renderer/src/components/editor/RichMarkdownEditorSurface.tsx
@@ -35,6 +35,14 @@ function shouldFocusEmptyEditorFromSurfaceClick(
   return !target.closest('.rich-markdown-editor-shell button, .rich-markdown-editor-shell input')
 }
 
+function shouldReturnFocusToEditor(event: React.MouseEvent<HTMLDivElement>): boolean {
+  if (event.button !== 0) {
+    return false
+  }
+  const target = event.target
+  return target instanceof Element && Boolean(target.closest('.ProseMirror'))
+}
+
 type RichMarkdownEditorSurfaceProps = {
   editor: Editor | null
   editorFontZoomLevel: number
@@ -209,6 +217,11 @@ export function RichMarkdownEditorSurface({
             // Image layout must not anchor-scroll over the restored tab position.
             className="relative h-full overflow-auto scrollbar-editor [overflow-anchor:none]"
             onMouseDown={(event) => {
+              if (shouldReturnFocusToEditor(event)) {
+                // Keep the find bar open while handing keyboard focus back to the document.
+                searchState.searchInputRef.current?.blur()
+                editor?.commands.focus()
+              }
               if (!shouldFocusEmptyEditorFromSurfaceClick(event, editor)) {
                 return
               }
diff --git a/src/renderer/src/components/editor/closed-editor-model-lifetime.test.ts b/src/renderer/src/components/editor/closed-editor-model-lifetime.test.ts
index 0b69a239526e..e3e904643a95 100644
--- a/src/renderer/src/components/editor/closed-editor-model-lifetime.test.ts
+++ b/src/renderer/src/components/editor/closed-editor-model-lifetime.test.ts
@@ -1,5 +1,5 @@
 // @vitest-environment happy-dom
-import * as monaco from 'monaco-editor'
+import * as monaco from 'monaco-editor/esm/vs/editor/editor.api.js'
 import { afterEach, expect, it, vi } from 'vitest'
 import {
   attachModelLifetimeView,
diff --git a/src/renderer/src/components/editor/closed-editor-model-reentrancy.test.ts b/src/renderer/src/components/editor/closed-editor-model-reentrancy.test.ts
index 1ebfbe29c9d3..ad32f6fd0f04 100644
--- a/src/renderer/src/components/editor/closed-editor-model-reentrancy.test.ts
+++ b/src/renderer/src/components/editor/closed-editor-model-reentrancy.test.ts
@@ -13,7 +13,7 @@ import {
   diffViewStateCache,
   pdfViewPositionCache
 } from '@/lib/scroll-cache'
-import * as monaco from 'monaco-editor'
+import * as monaco from 'monaco-editor/esm/vs/editor/editor.api.js'
 
 vi.mock('sonner', () => ({ toast: { info: vi.fn(), error: vi.fn(), success: vi.fn() } }))
 afterEach(resetModelLifetimeFixtures)
diff --git a/src/renderer/src/components/editor/closed-editor-model-registry.test.ts b/src/renderer/src/components/editor/closed-editor-model-registry.test.ts
index 5caf134efe2c..91818243edfc 100644
--- a/src/renderer/src/components/editor/closed-editor-model-registry.test.ts
+++ b/src/renderer/src/components/editor/closed-editor-model-registry.test.ts
@@ -1,5 +1,5 @@
 // @vitest-environment happy-dom
-import * as monaco from 'monaco-editor'
+import * as monaco from 'monaco-editor/esm/vs/editor/editor.api.js'
 import { afterEach, expect, it, vi } from 'vitest'
 import {
   attachModelLifetimeView,
diff --git a/src/renderer/src/components/editor/closed-editor-model-shell.test.tsx b/src/renderer/src/components/editor/closed-editor-model-shell.test.tsx
index 67f423c2f49d..5471ebce54bf 100644
--- a/src/renderer/src/components/editor/closed-editor-model-shell.test.tsx
+++ b/src/renderer/src/components/editor/closed-editor-model-shell.test.tsx
@@ -1,7 +1,7 @@
 // @vitest-environment happy-dom
 import React from 'react'
 import { useStore, type StoreApi } from 'zustand'
-import * as monaco from 'monaco-editor'
+import * as monaco from 'monaco-editor/esm/vs/editor/editor.api.js'
 import { act, cleanup, render, waitFor } from '@testing-library/react'
 import { afterEach, expect, it, vi } from 'vitest'
 import type { AppState } from '@/store/types'
diff --git a/src/renderer/src/components/editor/closed-editor-view-state-retention.test.ts b/src/renderer/src/components/editor/closed-editor-view-state-retention.test.ts
index 89c49aaeafcd..1b88f0ccbb6c 100644
--- a/src/renderer/src/components/editor/closed-editor-view-state-retention.test.ts
+++ b/src/renderer/src/components/editor/closed-editor-view-state-retention.test.ts
@@ -1,5 +1,5 @@
 // @vitest-environment happy-dom
-import * as monaco from 'monaco-editor'
+import * as monaco from 'monaco-editor/esm/vs/editor/editor.api.js'
 import { createStore } from 'zustand/vanilla'
 import { afterEach, expect, it } from 'vitest'
 import type { OpenFile } from '@/store/slices/editor'
diff --git a/src/renderer/src/components/editor/combined-diff/browse-files/combined-diff-file-tree-windowing.test.tsx b/src/renderer/src/components/editor/combined-diff/browse-files/combined-diff-file-tree-windowing.test.tsx
index ba5848e3f67c..e913d6bde35e 100644
--- a/src/renderer/src/components/editor/combined-diff/browse-files/combined-diff-file-tree-windowing.test.tsx
+++ b/src/renderer/src/components/editor/combined-diff/browse-files/combined-diff-file-tree-windowing.test.tsx
@@ -57,11 +57,11 @@ beforeEach(() => {
   document.body.appendChild(host)
   root = createRoot(host)
   vi.stubGlobal('ResizeObserver', NoopResizeObserver)
-  vi.spyOn(HTMLElement.prototype, 'offsetHeight', 'get').mockImplementation(
-    function (this: HTMLElement) {
-      return this.classList.contains('overflow-auto') ? VIEWPORT_HEIGHT_PX : TREE_ROW_HEIGHT_PX
-    }
-  )
+  vi.spyOn(HTMLElement.prototype, 'offsetHeight', 'get').mockImplementation(function (
+    this: HTMLElement
+  ) {
+    return this.classList.contains('overflow-auto') ? VIEWPORT_HEIGHT_PX : TREE_ROW_HEIGHT_PX
+  })
   vi.spyOn(Element.prototype, 'getBoundingClientRect').mockImplementation(function (this: Element) {
     const height = this.classList.contains('overflow-auto')
       ? VIEWPORT_HEIGHT_PX
diff --git a/src/renderer/src/components/editor/conflict-review-file-tree-windowing.test.tsx b/src/renderer/src/components/editor/conflict-review-file-tree-windowing.test.tsx
index e7612a30a39d..596a148db9f8 100644
--- a/src/renderer/src/components/editor/conflict-review-file-tree-windowing.test.tsx
+++ b/src/renderer/src/components/editor/conflict-review-file-tree-windowing.test.tsx
@@ -51,13 +51,13 @@ beforeEach(() => {
   document.body.appendChild(host)
   root = createRoot(host)
   vi.stubGlobal('ResizeObserver', NoopResizeObserver)
-  vi.spyOn(HTMLElement.prototype, 'offsetHeight', 'get').mockImplementation(
-    function (this: HTMLElement) {
-      return this.classList.contains('overflow-auto')
-        ? VIEWPORT_HEIGHT_PX
-        : CONFLICT_REVIEW_ROW_HEIGHT_PX
-    }
-  )
+  vi.spyOn(HTMLElement.prototype, 'offsetHeight', 'get').mockImplementation(function (
+    this: HTMLElement
+  ) {
+    return this.classList.contains('overflow-auto')
+      ? VIEWPORT_HEIGHT_PX
+      : CONFLICT_REVIEW_ROW_HEIGHT_PX
+  })
   vi.spyOn(Element.prototype, 'getBoundingClientRect').mockImplementation(function (this: Element) {
     const top = synthesizedTop(this)
     const height = this.classList.contains('overflow-auto')
diff --git a/src/renderer/src/components/editor/diff-section-comment-submit.test.ts b/src/renderer/src/components/editor/diff-section-comment-submit.test.ts
new file mode 100644
index 000000000000..0332839c134b
--- /dev/null
+++ b/src/renderer/src/components/editor/diff-section-comment-submit.test.ts
@@ -0,0 +1,40 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { toast } from 'sonner'
+import { submitDiffSectionComment } from './diff-section-comment-submit'
+import type { DiffSection } from './diff-section-types'
+
+vi.mock('sonner', () => ({ toast: { error: vi.fn() } }))
+
+const section: DiffSection = {
+  key: 'section-1',
+  path: 'src/example.ts',
+  status: 'modified',
+  originalContent: 'before',
+  modifiedContent: 'after',
+  collapsed: false,
+  loading: false,
+  dirty: false,
+  diffResult: null,
+  largeDiffRenderLimit: null
+}
+
+describe('submitDiffSectionComment', () => {
+  beforeEach(() => {
+    vi.mocked(toast.error).mockClear()
+  })
+
+  it('surfaces persistence failures while keeping the draft open', async () => {
+    const addDiffComment = vi.fn().mockResolvedValue(null)
+
+    const result = await submitDiffSectionComment({
+      addDiffComment,
+      body: 'Needs revision',
+      target: { lineNumber: 4 },
+      section,
+      worktreeId: 'worktree-1'
+    })
+
+    expect(result).toBe(false)
+    expect(toast.error).toHaveBeenCalledWith('Failed to save comment')
+  })
+})
diff --git a/src/renderer/src/components/editor/diff-section-comment-submit.ts b/src/renderer/src/components/editor/diff-section-comment-submit.ts
index 99a2cde8ce5f..0d011a9dd6f1 100644
--- a/src/renderer/src/components/editor/diff-section-comment-submit.ts
+++ b/src/renderer/src/components/editor/diff-section-comment-submit.ts
@@ -1,6 +1,8 @@
 import type { DiffSection } from './diff-section-types'
+import { toast } from 'sonner'
+import { translate } from '@/i18n/i18n'
 
-type DiffSectionPopoverTarget = {
+type DiffSectionCommentTarget = {
   lineNumber: number
   startLine?: number
 }
@@ -19,7 +21,7 @@ export async function submitDiffSectionComment({
   addDiffComment,
   body,
   onAddLineComment,
-  popover,
+  target,
   section,
   worktreeId
 }: {
@@ -33,14 +35,14 @@ export async function submitDiffSectionComment({
       body: string
     }
   ) => Promise<boolean>
-  popover: DiffSectionPopoverTarget
+  target: DiffSectionCommentTarget
   section: DiffSection
   worktreeId?: string
 }): Promise<boolean> {
   if (onAddLineComment) {
     return onAddLineComment(section, {
-      lineNumber: popover.lineNumber,
-      startLine: popover.startLine,
+      lineNumber: target.lineNumber,
+      startLine: target.startLine,
       body
     })
   }
@@ -53,13 +55,13 @@ export async function submitDiffSectionComment({
     worktreeId,
     filePath: section.path,
     source: 'diff',
-    startLine: popover.startLine,
-    lineNumber: popover.lineNumber,
+    startLine: target.startLine,
+    lineNumber: target.lineNumber,
     body,
     side: 'modified'
   })
   if (!result) {
-    console.error('Failed to add diff comment — draft preserved')
+    toast.error(translate('auto.components.editor.diffCommentSaveFailed', 'Failed to save comment'))
   }
   return Boolean(result)
 }
diff --git a/src/renderer/src/components/editor/editor-model-lifetime-fixture.ts b/src/renderer/src/components/editor/editor-model-lifetime-fixture.ts
index a7ecac75d855..5ec2466f452c 100644
--- a/src/renderer/src/components/editor/editor-model-lifetime-fixture.ts
+++ b/src/renderer/src/components/editor/editor-model-lifetime-fixture.ts
@@ -1,4 +1,4 @@
-import * as monaco from 'monaco-editor'
+import * as monaco from 'monaco-editor/esm/vs/editor/editor.api.js'
 import { vi } from 'vitest'
 import { createEditorModelRegistry } from '@/lib/editor-model-registry'
 import { createTestStore, makeWorktree, TEST_REPO } from '@/store/slices/store-test-helpers'
diff --git a/src/renderer/src/components/editor/ipynb-kernel-session.test.ts b/src/renderer/src/components/editor/ipynb-kernel-session.test.ts
index 1dffc0ab6a76..e609bae9e2cb 100644
--- a/src/renderer/src/components/editor/ipynb-kernel-session.test.ts
+++ b/src/renderer/src/components/editor/ipynb-kernel-session.test.ts
@@ -55,9 +55,50 @@ beforeEach(() => {
     listener({ openFiles: openFiles.current }, { openFiles: [] })
   }
   openFiles.current = [{ filePath: FILE }]
+  // Cells only reach runCells after the user trusts the notebook.
+  for (const filePath of [
+    FILE,
+    '/repo/nb.ipynb',
+    '/other.ipynb',
+    '/third.ipynb',
+    '/fourth.ipynb'
+  ]) {
+    session.trustNotebook(filePath)
+  }
 })
 
 describe('notebook kernel session', () => {
+  it('runs no interpreter before trust: a pick or restart only records the choice', async () => {
+    const untrusted = '/untrusted/nb.ipynb'
+    const shipped = { path: '/untrusted/.venv/bin/python', name: '.venv' }
+    openFiles.current = [{ filePath: untrusted }]
+    session.selectEnvironment(untrusted, shipped)
+    session.restartKernel(untrusted)
+    await Promise.resolve()
+    expect(notebookApi.startKernel).not.toHaveBeenCalled()
+    expect(notebookApi.listPythonEnvironments).not.toHaveBeenCalled()
+    expect(getSession(untrusted)).toMatchObject({ status: 'off', trusted: false, queue: [] })
+
+    session.trustNotebook(untrusted)
+    await session.runCells(untrusted, [{ key: 'a', code: 'x' }], '/untrusted')
+    expect(notebookApi.startKernel).toHaveBeenCalledWith({
+      filePath: untrusted,
+      python: shipped.path
+    })
+    expect(notebookApi.execute).toHaveBeenCalledWith({ filePath: untrusted, code: 'x' })
+  })
+
+  it('discovers with workspace interpreters once trusted', async () => {
+    openFiles.current = [{ filePath: '/fifth.ipynb' }]
+    session.trustNotebook('/fifth.ipynb')
+    await session.runCells('/fifth.ipynb', [{ key: 'a', code: 'x' }], '/proj')
+    expect(notebookApi.listPythonEnvironments).toHaveBeenCalledWith({
+      filePath: '/fifth.ipynb',
+      rootPath: '/proj',
+      runWorkspaceInterpreters: true
+    })
+  })
+
   it('starts the recommended env, runs queued cells in order, and stops the queue on an error', async () => {
     await session.runCells(
       FILE,
diff --git a/src/renderer/src/components/editor/ipynb-kernel-session.ts b/src/renderer/src/components/editor/ipynb-kernel-session.ts
index de0c15bfe772..a75f406138af 100644
--- a/src/renderer/src/components/editor/ipynb-kernel-session.ts
+++ b/src/renderer/src/components/editor/ipynb-kernel-session.ts
@@ -64,7 +64,11 @@ async function discoverEnvironment(
   filePath: string,
   rootPath: string | null
 ): Promise<PythonEnvironment | undefined> {
-  const found = await window.api.notebook.listPythonEnvironments({ filePath, rootPath })
+  const found = await window.api.notebook.listPythonEnvironments({
+    filePath,
+    rootPath,
+    runWorkspaceInterpreters: true
+  })
   const recommended = found.workspace[0] ?? found.path[0]
   if (recommended && isOpen(filePath)) {
     setEnvironment(filePath, recommended)
@@ -72,7 +76,11 @@ async function discoverEnvironment(
   return recommended
 }
 
+/** Starts the notebook's kernel; the one place a notebook's Python runs, so it refuses until trusted. */
 async function start(filePath: string, rootPath: string | null = null): Promise<void> {
+  if (!getSession(filePath).trusted) {
+    return
+  }
   // Why 'starting' before discovery: a second run meanwhile must queue, not start another kernel.
   updateSession(filePath, () => ({ status: 'starting' }))
   let result: KernelStartResult | null
@@ -156,7 +164,7 @@ export function restartKernel(filePath: string): void {
   void start(filePath)
 }
 
-/** Switching interpreters restarts a running kernel; otherwise queued cells wait for the new one. */
+/** Switching interpreters restarts a running kernel; before trust it only records the choice. */
 export function selectEnvironment(filePath: string, environment: PythonEnvironment): void {
   setEnvironment(filePath, environment)
   // A pick replaces an open setup prompt; the new env reopens it if it lacks ipykernel too.
diff --git a/src/renderer/src/components/editor/ipynb-kernel-setup-commands.test.ts b/src/renderer/src/components/editor/ipynb-kernel-setup-commands.test.ts
index 873dc2bb0a43..599cfac726ce 100644
--- a/src/renderer/src/components/editor/ipynb-kernel-setup-commands.test.ts
+++ b/src/renderer/src/components/editor/ipynb-kernel-setup-commands.test.ts
@@ -13,6 +13,7 @@ describe('copyable setup commands', () => {
     expect(windows('C:\\My Env\\python.exe')).toBe(`& 'C:\\My Env\\python.exe'${pip}`)
     expect(windows('C:\\Dev&Test\\python.exe')).toBe(`& 'C:\\Dev&Test\\python.exe'${pip}`)
     expect(windows("C:\\Bob's\\python.exe")).toBe(`& 'C:\\Bob''s\\python.exe'${pip}`)
+    expect(windows('C:\\Bob\u2019s\\python.exe')).toBe(`& 'C:\\Bob\u2019\u2019s\\python.exe'${pip}`)
   })
 
   it('creates the venv and installs into it only when creation succeeded', () => {
diff --git a/src/renderer/src/components/editor/ipynb-kernel-setup-commands.ts b/src/renderer/src/components/editor/ipynb-kernel-setup-commands.ts
index 0d9fa553de8a..dd15a8586c58 100644
--- a/src/renderer/src/components/editor/ipynb-kernel-setup-commands.ts
+++ b/src/renderer/src/components/editor/ipynb-kernel-setup-commands.ts
@@ -1,9 +1,10 @@
 import { getRendererAppPlatform } from '@/lib/renderer-app-platform'
 import { venvInterpreterSegments } from '../../../../shared/notebook-venv-location'
+import { quotePowerShellLiteral } from '../../../../shared/powershell-native-argument'
 
 /** Quotes a path for a shell; single quotes are literal in POSIX shells and PowerShell. */
 function shellQuote(path: string, windows: boolean): string {
-  return windows ? `'${path.replaceAll("'", "''")}'` : `'${path.replaceAll("'", "'\\''")}'`
+  return windows ? quotePowerShellLiteral(path) : `'${path.replaceAll("'", "'\\''")}'`
 }
 
 /** PowerShell runs a quoted program path only through `&`. */
diff --git a/src/renderer/src/components/editor/ipynb-kernel-store.ts b/src/renderer/src/components/editor/ipynb-kernel-store.ts
index abdf8cab9b39..057e8f552f54 100644
--- a/src/renderer/src/components/editor/ipynb-kernel-store.ts
+++ b/src/renderer/src/components/editor/ipynb-kernel-store.ts
@@ -54,11 +54,15 @@ function loadEnvironments(): Record<string, PythonEnvironment> {
     return isRecord(stored)
       ? Object.fromEntries(
           Object.entries(stored).flatMap(([filePath, env]) =>
-            isRecord(env) &&
-            typeof env.path === 'string' &&
-            typeof env.name === 'string' &&
-            typeof env.version === 'string'
-              ? [[filePath, { path: env.path, name: env.name, version: env.version }]]
+            isRecord(env) && typeof env.path === 'string' && typeof env.name === 'string'
+              ? [
+                  [
+                    filePath,
+                    typeof env.version === 'string'
+                      ? { path: env.path, name: env.name, version: env.version }
+                      : { path: env.path, name: env.name }
+                  ]
+                ]
               : []
           )
         )
diff --git a/src/renderer/src/components/editor/local-host-test-fixture.ts b/src/renderer/src/components/editor/local-host-test-fixture.ts
new file mode 100644
index 000000000000..d6ef4f7128a4
--- /dev/null
+++ b/src/renderer/src/components/editor/local-host-test-fixture.ts
@@ -0,0 +1,18 @@
+import type { WorktreeHostConnection } from '@/lib/worktree-host-connection-phase'
+
+/** Stands in for the host-connection module in suites that mock the store: every worktree is local. */
+const LOCAL_HOST_CONNECTION: WorktreeHostConnection = {
+  phase: 'local',
+  targetId: null,
+  environmentId: null,
+  publishedStatus: null,
+  connectedEpoch: null
+}
+
+export function selectWorktreeHostConnectionPhase(): WorktreeHostConnection {
+  return LOCAL_HOST_CONNECTION
+}
+
+export function useWorktreeHostConnection(): WorktreeHostConnection {
+  return LOCAL_HOST_CONNECTION
+}
diff --git a/src/renderer/src/components/editor/markdown-directive-tokenizer.ts b/src/renderer/src/components/editor/markdown-directive-tokenizer.ts
new file mode 100644
index 000000000000..7356d99eddf3
--- /dev/null
+++ b/src/renderer/src/components/editor/markdown-directive-tokenizer.ts
@@ -0,0 +1,19 @@
+import type { NodeConfig } from '@tiptap/core'
+import { createMarkdownTokenizerStart } from './markdown-tokenizer-start'
+
+export function guardMarkdownDirectiveTokenizer(
+  tokenizer: NodeConfig['markdownTokenizer'],
+  name: string
+): NodeConfig['markdownTokenizer'] {
+  if (!tokenizer || typeof tokenizer === 'function') {
+    return tokenizer
+  }
+  const marker = `:::${name}`
+  return {
+    ...tokenizer,
+    start: createMarkdownTokenizerStart(marker, true),
+    tokenize(source, tokens, lexer) {
+      return source.startsWith(marker) ? tokenizer.tokenize(source, tokens, lexer) : undefined
+    }
+  }
+}
diff --git a/src/renderer/src/components/editor/markdown-tokenizer-start.test.ts b/src/renderer/src/components/editor/markdown-tokenizer-start.test.ts
new file mode 100644
index 000000000000..c190b3b7e5af
--- /dev/null
+++ b/src/renderer/src/components/editor/markdown-tokenizer-start.test.ts
@@ -0,0 +1,96 @@
+import { expect, it, vi } from 'vitest'
+import { createTiptapMarkedFacade } from './tiptap-marked-facade'
+import {
+  createMarkdownTokenizerStart,
+  registerMarkdownTokenizerStart
+} from './markdown-tokenizer-start'
+
+it.each([
+  'x\n:::detailsSummary',
+  'x\r:::detailsSummary',
+  'x\u2028:::detailsSummary',
+  'x\u2029:::detailsSummary',
+  'x:::detailsSummary\n:::detailsSummary',
+  'ordinary text'
+])('matches the upstream multiline directive start: %j', (source) => {
+  expect(createMarkdownTokenizerStart(':::detailsSummary', true)(source)).toBe(
+    source.match(/^:::detailsSummary/m)?.index ?? -1
+  )
+})
+
+it('does not search each remaining suffix for an absent marker', () => {
+  const marked = createTiptapMarkedFacade()
+  const start = createMarkdownTokenizerStart('MARKER')
+  marked.use({
+    extensions: [{ name: 'marker', level: 'block', start, tokenizer: () => undefined }]
+  })
+  const includes = vi.spyOn(String.prototype, 'includes')
+  const indexOf = vi.spyOn(String.prototype, 'indexOf')
+  try {
+    marked.lexer('Prose\n\n'.repeat(1000))
+    expect(includes.mock.calls.filter(([value]) => value === 'MARKER')).toHaveLength(1)
+    expect(indexOf.mock.calls.filter(([value]) => value === 'MARKER')).toHaveLength(0)
+  } finally {
+    includes.mockRestore()
+    indexOf.mockRestore()
+  }
+})
+
+it('restores searches for nested generated input and later parses', () => {
+  const marked = createTiptapMarkedFacade()
+  const start = createMarkdownTokenizerStart('MARKER')
+  marked.use({
+    extensions: [
+      {
+        name: 'marker',
+        level: 'block',
+        start,
+        tokenizer(source) {
+          return source.startsWith('MARKER')
+            ? { type: 'marker', raw: 'MARKER', text: 'found' }
+            : undefined
+        }
+      },
+      {
+        name: 'wrapper',
+        level: 'block',
+        tokenizer(source) {
+          if (!source.startsWith('WRAPPER')) {
+            return undefined
+          }
+          return {
+            type: 'wrapper',
+            raw: 'WRAPPER',
+            tokens: this.lexer.blockTokens('prose\nMARKER')
+          }
+        }
+      }
+    ]
+  })
+  const nested = marked.lexer('WRAPPER')
+  expect(nested[0]).toMatchObject({
+    type: 'wrapper',
+    tokens: [{ type: 'paragraph' }, { type: 'marker' }]
+  })
+  expect(marked.lexer('prose\nMARKER').map((token) => token.type)).toEqual(['paragraph', 'marker'])
+  expect(createTiptapMarkedFacade().lexer('MARKER')[0].type).toBe('paragraph')
+})
+
+it('skips custom searches when their required marker is absent', () => {
+  const marked = createTiptapMarkedFacade()
+  const search = vi.fn((source: string) => source.search(/<details\b/i))
+  marked.use({
+    extensions: [
+      {
+        name: 'details',
+        level: 'block',
+        start: registerMarkdownTokenizerStart('<', search),
+        tokenizer: () => undefined
+      }
+    ]
+  })
+  marked.lexer('Prose\n\n'.repeat(1000))
+  expect(search).not.toHaveBeenCalled()
+  marked.lexer('Prose\n<DETAILS>')
+  expect(search).toHaveReturnedWith(5)
+})
diff --git a/src/renderer/src/components/editor/markdown-tokenizer-start.ts b/src/renderer/src/components/editor/markdown-tokenizer-start.ts
new file mode 100644
index 000000000000..b32a4539facc
--- /dev/null
+++ b/src/renderer/src/components/editor/markdown-tokenizer-start.ts
@@ -0,0 +1,22 @@
+const startMarkers = new WeakMap<(source: string) => number | void, string>()
+
+export function registerMarkdownTokenizerStart(marker: string, start: (source: string) => number) {
+  startMarkers.set(start, marker)
+  return start
+}
+
+/** Let a lexer skip suffix searches for markers absent from its entire input. */
+export function createMarkdownTokenizerStart(marker: string, lineStart = false) {
+  const start = (source: string): number => {
+    let position = source.indexOf(marker)
+    while (lineStart && position > 0 && !'\n\r\u2028\u2029'.includes(source[position - 1])) {
+      position = source.indexOf(marker, position + marker.length)
+    }
+    return position
+  }
+  return registerMarkdownTokenizerStart(marker, start)
+}
+
+export function getMarkdownTokenizerStartMarker(start: (source: string) => number | void) {
+  return startMarkers.get(start)
+}
diff --git a/src/renderer/src/components/editor/monaco-content-sync.undo-history.test.ts b/src/renderer/src/components/editor/monaco-content-sync.undo-history.test.ts
index 7118634a3b13..380a44ec8d43 100644
--- a/src/renderer/src/components/editor/monaco-content-sync.undo-history.test.ts
+++ b/src/renderer/src/components/editor/monaco-content-sync.undo-history.test.ts
@@ -1,5 +1,5 @@
 // @vitest-environment happy-dom
-import * as monaco from 'monaco-editor'
+import * as monaco from 'monaco-editor/esm/vs/editor/editor.api.js'
 import { afterEach, describe, expect, it } from 'vitest'
 import { syncContentUpdate } from './monaco-content-sync'
 
diff --git a/src/renderer/src/components/editor/monaco-cursor-line-lifetime.test.ts b/src/renderer/src/components/editor/monaco-cursor-line-lifetime.test.ts
new file mode 100644
index 000000000000..3c7baa5bf2c3
--- /dev/null
+++ b/src/renderer/src/components/editor/monaco-cursor-line-lifetime.test.ts
@@ -0,0 +1,75 @@
+import { describe, expect, it, vi } from 'vitest'
+import type { editor } from 'monaco-editor'
+import type { OpenFile } from '@/store/slices/editor'
+import { createEditorStore } from '@/store/slices/editor-slice-test-harness'
+import { installMonacoViewStateTracking } from './monaco-view-state-persistence'
+
+function makeFile(id: string, filePath: string): OpenFile {
+  return {
+    id,
+    filePath,
+    relativePath: 'file.ts',
+    worktreeId: 'wt-1',
+    language: 'typescript',
+    mode: 'edit',
+    isDirty: false
+  }
+}
+
+function startTracking(
+  store: ReturnType<typeof createEditorStore>,
+  file: OpenFile,
+  line: number
+): ReturnType<typeof installMonacoViewStateTracking> {
+  const mockEditor = {
+    getPosition: () => ({ lineNumber: line, column: 1 }),
+    onDidChangeCursorPosition: () => ({ dispose: vi.fn() }),
+    onDidScrollChange: () => ({ dispose: vi.fn() })
+  }
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Cursor tracking calls only the three mocked editor methods above.
+  const editorInstance = mockEditor as unknown as editor.IStandaloneCodeEditor
+  const params = {
+    editorInstance,
+    fileIdRef: { current: file.id },
+    viewStateKey: file.id,
+    scrollThrottleTimerRef: { current: null },
+    setEditorCursorLine: store.getState().setEditorCursorLine
+  }
+  return installMonacoViewStateTracking(params)
+}
+
+describe('Monaco cursor-line ownership lifetime', () => {
+  it('releases positions after 250 distinct owned editor tabs close', () => {
+    const store = createEditorStore()
+    for (let index = 0; index < 250; index += 1) {
+      const file = makeFile(`editor:wt-1:local:file-${index}`, `/repo/file-${index}.ts`)
+      store.setState({ openFiles: [file] })
+      const tracking = startTracking(store, file, index + 1)
+      tracking.cursorPositionSub.dispose()
+      tracking.scrollStateSub.dispose()
+      store.getState().closeFile(file.id)
+    }
+
+    expect(store.getState().openFiles).toHaveLength(0)
+    expect(Object.keys(store.getState().editorCursorLine)).toHaveLength(0)
+  })
+
+  it('isolates same-path positions and closes only the selected file identity', () => {
+    const store = createEditorStore()
+    const local = makeFile('editor:wt-1:local:file.ts', '/repo/file.ts')
+    const remote = makeFile('editor:wt-1:remote-a:file.ts', '/repo/file.ts')
+    store.setState({ openFiles: [local, remote] })
+    const localTracking = startTracking(store, local, 12)
+    const remoteTracking = startTracking(store, remote, 35)
+
+    expect(store.getState().editorCursorLine).toEqual({ [local.id]: 12, [remote.id]: 35 })
+    localTracking.cursorPositionSub.dispose()
+    localTracking.scrollStateSub.dispose()
+    store.getState().closeFile(local.id)
+    expect(store.getState().editorCursorLine).toEqual({ [remote.id]: 35 })
+    remoteTracking.cursorPositionSub.dispose()
+    remoteTracking.scrollStateSub.dispose()
+    store.getState().closeFile(remote.id)
+    expect(store.getState().editorCursorLine).toEqual({})
+  })
+})
diff --git a/src/renderer/src/components/editor/monaco-view-state-persistence.test.ts b/src/renderer/src/components/editor/monaco-view-state-persistence.test.ts
index 60dfe48cdeb6..a8001fdffb49 100644
--- a/src/renderer/src/components/editor/monaco-view-state-persistence.test.ts
+++ b/src/renderer/src/components/editor/monaco-view-state-persistence.test.ts
@@ -76,7 +76,7 @@ describe('Monaco view state persistence', () => {
 
     installMonacoViewStateTracking({
       editorInstance,
-      filePath: 'file.ts',
+      fileIdRef: { current: 'file.ts' },
       viewStateKey: 'file.ts::tab-1',
       scrollThrottleTimerRef: { current: null },
       setEditorCursorLine
diff --git a/src/renderer/src/components/editor/monaco-view-state-persistence.ts b/src/renderer/src/components/editor/monaco-view-state-persistence.ts
index 46272e9ee396..33c5a963923a 100644
--- a/src/renderer/src/components/editor/monaco-view-state-persistence.ts
+++ b/src/renderer/src/components/editor/monaco-view-state-persistence.ts
@@ -4,7 +4,7 @@ import { editorSelectionCache, scrollTopCache, setWithLRU } from '@/lib/scroll-c
 
 type MonacoViewStateTrackingParams = {
   editorInstance: editor.IStandaloneCodeEditor
-  filePath: string
+  fileIdRef: MutableRefObject<string>
   viewStateKey: string
   scrollThrottleTimerRef: MutableRefObject<ReturnType<typeof setTimeout> | null>
   setEditorCursorLine: (fileId: string, line: number) => void
@@ -14,16 +14,16 @@ export function installMonacoViewStateTracking(params: MonacoViewStateTrackingPa
   cursorPositionSub: { dispose: () => void }
   scrollStateSub: { dispose: () => void }
 } {
-  const { editorInstance, filePath, viewStateKey, scrollThrottleTimerRef, setEditorCursorLine } =
+  const { editorInstance, fileIdRef, viewStateKey, scrollThrottleTimerRef, setEditorCursorLine } =
     params
 
   // Track cursor line for "copy path to line" feature
   const pos = editorInstance.getPosition()
   if (pos) {
-    setEditorCursorLine(filePath, pos.lineNumber)
+    setEditorCursorLine(fileIdRef.current, pos.lineNumber)
   }
   const cursorPositionSub = editorInstance.onDidChangeCursorPosition((e) => {
-    setEditorCursorLine(filePath, e.position.lineNumber)
+    setEditorCursorLine(fileIdRef.current, e.position.lineNumber)
   })
 
   // Why: only the resting scroll position matters, so trailing-throttle writes (~150ms) instead of writing every 60fps frame.
diff --git a/src/renderer/src/components/editor/raw-markdown-html.ts b/src/renderer/src/components/editor/raw-markdown-html.ts
index edcf87158087..226979b030c7 100644
--- a/src/renderer/src/components/editor/raw-markdown-html.ts
+++ b/src/renderer/src/components/editor/raw-markdown-html.ts
@@ -1,3 +1,4 @@
+import { createMarkdownTokenizerStart } from './markdown-tokenizer-start'
 import { Node, mergeAttributes } from '@tiptap/core'
 import { isEditableDetailsHtmlBlock, matchDetailsHtmlBlock } from './details-markdown-html'
 import { formatMarkdownDocLinkBody, parseMarkdownDocLink } from './markdown-doc-links'
@@ -44,11 +45,7 @@ function isLineOnlyHtml(line: string): boolean {
 function matchBlockHtml(content: string, start: number): string | null {
   const lineEnd = findLineEnd(content, start)
   const line = content.slice(start, lineEnd)
-  if (!isLineOnlyHtml(line)) {
-    return null
-  }
-
-  return line
+  return isLineOnlyHtml(line) ? line : null
 }
 
 export function encodeRawMarkdownHtmlForRichEditor(
@@ -282,7 +279,9 @@ function createRawSourceNode({
     markdownTokenizer: {
       name,
       level: inline ? 'inline' : 'block',
-      start: inline ? skipInlineTransportStartScan : transport.startFor(kind),
+      start: inline
+        ? skipInlineTransportStartScan
+        : createMarkdownTokenizerStart(transport.startFor(kind)),
       tokenize(src) {
         const matched = transport.match(src, kind)
         if (!matched) {
diff --git a/src/renderer/src/components/editor/rich-markdown-block-source-work.test.ts b/src/renderer/src/components/editor/rich-markdown-block-source-work.test.ts
new file mode 100644
index 000000000000..ef8d64b0a2f3
--- /dev/null
+++ b/src/renderer/src/components/editor/rich-markdown-block-source-work.test.ts
@@ -0,0 +1,52 @@
+import { Editor } from '@tiptap/core'
+import { expect, it, vi } from 'vitest'
+import { createRichMarkdownEditorCodec } from './rich-markdown-source-transport'
+import { createRichMarkdownExtensions } from './rich-markdown-extensions'
+import { commitRichMarkdownSerialization } from './rich-markdown-serialization-commit'
+
+function create(source: string) {
+  return new Editor({
+    element: null,
+    extensions: createRichMarkdownExtensions({ codec: createRichMarkdownEditorCodec() }),
+    content: source,
+    contentType: 'markdown'
+  })
+}
+
+it('proves the assembled document without reparsing every unchanged source block', () => {
+  const source = `${Array.from(
+    { length: 1000 },
+    (_, index) => `Paragraph ${index} with _emphasis_.\n\n> [!NOTE]\n> - Callout ${index}\n\n`
+  ).join('')}End\n`
+  const editor = create(source)
+  const refs = {
+    originalSourceRef: { current: source },
+    baseCanonicalRef: { current: editor.getMarkdown() },
+    lastCommittedMarkdownRef: { current: source }
+  }
+  const parse = vi.spyOn(editor.markdown!, 'parse')
+  let expected = source
+  try {
+    for (let edit = 0; edit < 3; edit++) {
+      parse.mockClear()
+      editor.commands.insertContentAt(1, { type: 'text', text: 'x' })
+      expected = `x${expected}`
+      const result = commitRichMarkdownSerialization(editor, refs, (markdown) => {
+        const reopened = create(markdown)
+        try {
+          return reopened.getMarkdown()
+        } finally {
+          reopened.destroy()
+        }
+      })
+      expect(result.markdown).toBe(expected)
+      expect(parse.mock.calls.filter(([markdown]) => markdown.length > 50_000)).toHaveLength(
+        edit === 0 ? 2 : 1
+      )
+      expect(parse.mock.calls.length).toBeLessThanOrEqual(3)
+    }
+  } finally {
+    parse.mockRestore()
+    editor.destroy()
+  }
+})
diff --git a/src/renderer/src/components/editor/rich-markdown-block-source.ts b/src/renderer/src/components/editor/rich-markdown-block-source.ts
new file mode 100644
index 000000000000..514e40d486e3
--- /dev/null
+++ b/src/renderer/src/components/editor/rich-markdown-block-source.ts
@@ -0,0 +1,208 @@
+import type { Editor } from '@tiptap/core'
+import { getRichMarkdownSerializationDocument } from './rich-markdown-trailing-paragraph'
+import type { Node as ProseMirrorNode } from '@tiptap/pm/model'
+import { diffArrays } from 'diff'
+import { extractAbsorbedBlankLines } from '@tiptap/markdown'
+import { encodeRawMarkdownHtmlForRichEditor } from './raw-markdown-html'
+import type { RichMarkdownEditorCodec } from './rich-markdown-source-transport'
+import {
+  reconcileSerializedMarkdown,
+  restoreMarkdownSourceEol
+} from './rich-markdown-source-reconcile'
+
+type SourceBlock = { node: ProseMirrorNode; source: string; separator: string }
+type SourceDocument = { source: string; leading: string; blocks: SourceBlock[] }
+type SourceContext = {
+  codec: RichMarkdownEditorCodec
+  htmlSuperscriptLinks: boolean
+  baseline?: SourceDocument
+}
+
+const contexts = new WeakMap<Editor, SourceContext>()
+
+export function registerRichMarkdownBlockSource(
+  editor: Editor,
+  codec: RichMarkdownEditorCodec,
+  htmlSuperscriptLinks: boolean
+): void {
+  contexts.set(editor, { codec, htmlSuperscriptLinks })
+}
+
+function parse(editor: Editor, context: SourceContext, source: string): ProseMirrorNode {
+  return editor.schema.nodeFromJSON(
+    editor.markdown!.parse(encodeRawMarkdownHtmlForRichEditor(source, context.codec, context))
+  )
+}
+
+function readSourceDocument(
+  editor: Editor,
+  context: SourceContext,
+  source: string,
+  expected?: ProseMirrorNode
+): SourceDocument | null {
+  const normalized = source.replace(/\r\n/g, '\n')
+  const document = expected ?? parse(editor, context, normalized)
+  const tokens = extractAbsorbedBlankLines(context.codec.marked.lexer(normalized))
+  // Definitions and custom source owners may cross token boundaries; never guess their spans.
+  if (tokens.map((token) => token.raw).join('') !== normalized) {
+    return null
+  }
+  const blocks: SourceBlock[] = []
+  let leading = ''
+  const lastContentIndex = tokens.findLastIndex((token) => token.type !== 'space')
+  for (const [tokenIndex, token] of tokens.entries()) {
+    const raw = token.raw
+    if (raw === undefined) {
+      return null
+    }
+    if (token.type === 'space') {
+      const pieces: string[] = []
+      let offset = 0
+      for (const match of raw.matchAll(/\n\n/g)) {
+        pieces.push(raw.slice(offset, match.index + 2))
+        offset = match.index + 2
+      }
+      const remainder = raw.slice(offset)
+      const previous = blocks.at(-1)
+      if (pieces.length === 0) {
+        if (previous) {
+          previous.separator += remainder
+        } else {
+          leading += remainder
+        }
+        continue
+      }
+      const atEnd = tokenIndex > lastContentIndex
+      if (previous) {
+        previous.separator += pieces.shift()!
+      }
+      // Match the parser's implicit paragraphs, including leading/trailing blank runs.
+      for (const separator of pieces) {
+        blocks.push({ node: editor.schema.nodes.paragraph.create(), source: '', separator })
+      }
+      if (previous && atEnd) {
+        blocks.push({
+          node: editor.schema.nodes.paragraph.create(),
+          source: '',
+          separator: remainder
+        })
+      } else {
+        blocks.at(-1)!.separator += remainder
+      }
+      continue
+    }
+    const text = raw.replace(/\n+$/, '')
+    if (blocks.length >= document.childCount) {
+      return null
+    }
+    // These spans are provisional; the assembled document must pass the full parse proof below.
+    blocks.push({
+      node: document.child(blocks.length),
+      source: text,
+      separator: raw.slice(text.length)
+    })
+  }
+  if (
+    document.childCount !== blocks.length ||
+    blocks.some((block, index) => !block.node.eq(document.child(index)))
+  ) {
+    return null
+  }
+  return { source, leading, blocks }
+}
+
+/** Reuse exact source for equal blocks, even when character-level reconciliation cannot match. */
+export function reconcileRichMarkdownBlockSource(
+  editor: Editor,
+  originalSource: string,
+  edited: string,
+  roundTrip: (source: string) => string | null
+): string | null {
+  const context = contexts.get(editor)
+  if (!context) {
+    return null
+  }
+  try {
+    const baseline =
+      context.baseline?.source === originalSource
+        ? context.baseline
+        : readSourceDocument(editor, context, originalSource)
+    if (!baseline) {
+      return null
+    }
+    context.baseline = baseline
+    const document = getRichMarkdownSerializationDocument(editor)
+    const current = readSourceDocument(editor, context, edited, document)
+    if (!current) {
+      return null
+    }
+    // Bound replacement-heavy diffs; ordinary single-block edits remain linear in document size.
+    const changes = diffArrays(baseline.blocks, current.blocks, {
+      comparator: (before, after) => before.node.eq(after.node),
+      maxEditLength: 256
+    })
+    if (!changes) {
+      return null
+    }
+    const blocks: SourceBlock[] = []
+    let originalIndex = 0
+    let removed: SourceBlock[] = []
+    for (const change of changes) {
+      if (change.added) {
+        for (const [index, block] of change.value.entries()) {
+          const previous = removed.length === change.count ? removed[index] : undefined
+          const canonical = previous ? roundTrip(previous.source) : null
+          const source =
+            previous && canonical !== null
+              ? reconcileSerializedMarkdown({
+                  originalSource: previous.source,
+                  baseCanonical: canonical,
+                  edited: block.source,
+                  roundTrip
+                })
+              : block.source
+          blocks.push({ ...block, source, separator: previous?.separator ?? block.separator })
+        }
+        removed = []
+      } else if (change.removed) {
+        removed = baseline.blocks.slice(originalIndex, originalIndex + change.count)
+        originalIndex += change.count
+      } else {
+        removed = []
+        blocks.push(...baseline.blocks.slice(originalIndex, originalIndex + change.count))
+        originalIndex += change.count
+      }
+    }
+    // A moved EOF block needs a separator before the next block.
+    for (let index = 0; index < blocks.length - 1; index++) {
+      if (!blocks[index].separator) {
+        blocks[index] = { ...blocks[index], separator: '\n\n' }
+      }
+    }
+    const assemble = () =>
+      baseline.leading + blocks.map((block) => block.source + block.separator).join('')
+    let candidate = assemble()
+    // Validate the assembled document, including cross-block reference and delimiter interactions.
+    if (!parse(editor, context, candidate).eq(document)) {
+      const originalIndices = new Map(baseline.blocks.map((block, index) => [block, index]))
+      for (let index = 0; index < blocks.length - 1; index++) {
+        const originalIndex = originalIndices.get(blocks[index])
+        const unchangedBoundary =
+          originalIndex !== undefined &&
+          originalIndices.get(blocks[index + 1]) === originalIndex + 1
+        if (!unchangedBoundary && !blocks[index].separator.includes('\n\n')) {
+          blocks[index] = { ...blocks[index], separator: '\n\n' }
+        }
+      }
+      candidate = assemble()
+      if (!parse(editor, context, candidate).eq(document)) {
+        return null
+      }
+    }
+    const result = restoreMarkdownSourceEol(candidate, originalSource)
+    context.baseline = { source: result, leading: baseline.leading, blocks }
+    return result
+  } catch {
+    return null
+  }
+}
diff --git a/src/renderer/src/components/editor/rich-markdown-details-case.test.ts b/src/renderer/src/components/editor/rich-markdown-details-case.test.ts
new file mode 100644
index 000000000000..caf92d90a049
--- /dev/null
+++ b/src/renderer/src/components/editor/rich-markdown-details-case.test.ts
@@ -0,0 +1,25 @@
+import { Editor } from '@tiptap/core'
+import { expect, it } from 'vitest'
+import { createRichMarkdownExtensions } from './rich-markdown-extensions'
+import { createRichMarkdownEditorCodec } from './rich-markdown-source-transport'
+
+it.each(['details', 'Details', 'DETAILS', 'dEtAiLs'])(
+  'opens %s after prose as an editable toggle',
+  (tag) => {
+    const editor = new Editor({
+      element: null,
+      extensions: createRichMarkdownExtensions({ codec: createRichMarkdownEditorCodec() }),
+      content: `Before\n<${tag}><summary>Title</summary>\n\nBody\n\n</${tag}>`,
+      contentType: 'markdown'
+    })
+    try {
+      expect(editor.state.doc.child(0).textContent).toBe('Before')
+      const toggle = editor.state.doc.child(1)
+      expect(toggle.type.name).toBe('details')
+      expect(toggle.child(0).textContent).toBe('Title')
+      expect(toggle.child(1).textContent).toBe('Body')
+    } finally {
+      editor.destroy()
+    }
+  }
+)
diff --git a/src/renderer/src/components/editor/rich-markdown-details-extension.ts b/src/renderer/src/components/editor/rich-markdown-details-extension.ts
index 1bfcfc09a15d..f7e28fd16c27 100644
--- a/src/renderer/src/components/editor/rich-markdown-details-extension.ts
+++ b/src/renderer/src/components/editor/rich-markdown-details-extension.ts
@@ -1,3 +1,5 @@
+import { registerMarkdownTokenizerStart } from './markdown-tokenizer-start'
+import { guardMarkdownDirectiveTokenizer } from './markdown-directive-tokenizer'
 import { decodeHtmlEntities, type AnyExtension, type Editor } from '@tiptap/core'
 import { Details, DetailsContent, DetailsSummary } from '@tiptap/extension-details'
 import type { PlaceholderOptions } from '@tiptap/extension-placeholder'
@@ -228,7 +230,7 @@ const OrcaDetails = Details.extend({
   markdownTokenizer: {
     name: 'details',
     level: 'block',
-    start: '<details',
+    start: registerMarkdownTokenizerStart('<', (source) => source.search(/<details\b/i)),
     tokenize(src, _tokens, lexer) {
       const detailsBlock = matchDetailsHtmlBlock(src, 0)
       if (!detailsBlock || !isEditableDetailsHtmlBlock(detailsBlock)) {
@@ -287,6 +289,10 @@ const OrcaDetails = Details.extend({
 })
 
 const OrcaDetailsSummary = DetailsSummary.extend({
+  markdownTokenizer: guardMarkdownDirectiveTokenizer(
+    DetailsSummary.config.markdownTokenizer,
+    'detailsSummary'
+  ),
   // Why: the summary parser runs parseInline, which emits image/math nodes that
   // upstream's text*-only summary rejects, so the doc is schema-invalid until the
   // first edit reassembles the summary and ProseMirror throws.
@@ -294,6 +300,10 @@ const OrcaDetailsSummary = DetailsSummary.extend({
 })
 
 const OrcaDetailsContent = DetailsContent.extend({
+  markdownTokenizer: guardMarkdownDirectiveTokenizer(
+    DetailsContent.config.markdownTokenizer,
+    'detailsContent'
+  ),
   // Why: detailsContent's double-Enter escape must run before StarterKit's
   // generic paragraph split, otherwise users can get stuck inside a toggle.
   priority: 1000,
diff --git a/src/renderer/src/components/editor/rich-markdown-document-fidelity.test.ts b/src/renderer/src/components/editor/rich-markdown-document-fidelity.test.ts
new file mode 100644
index 000000000000..974a32f4d74a
--- /dev/null
+++ b/src/renderer/src/components/editor/rich-markdown-document-fidelity.test.ts
@@ -0,0 +1,147 @@
+import { reconcileRichMarkdownBlockSource } from './rich-markdown-block-source'
+import { Editor } from '@tiptap/core'
+import { describe, expect, it } from 'vitest'
+import { createRichMarkdownExtensions } from './rich-markdown-extensions'
+import { createRichMarkdownEditorCodec } from './rich-markdown-source-transport'
+import { encodeRawMarkdownHtmlForRichEditor } from './raw-markdown-html'
+import { normalizeEmptyListItems } from './rich-markdown-normalize'
+import { commitRichMarkdownSerialization } from './rich-markdown-serialization-commit'
+
+function createEditor(source: string) {
+  const codec = createRichMarkdownEditorCodec()
+  const editor = new Editor({
+    element: null,
+    extensions: createRichMarkdownExtensions({ codec }),
+    content: encodeRawMarkdownHtmlForRichEditor(source, codec),
+    contentType: 'markdown'
+  })
+  normalizeEmptyListItems(editor)
+  return editor
+}
+
+function serialize(source: string) {
+  const editor = createEditor(source)
+  try {
+    return editor.getMarkdown()
+  } finally {
+    editor.destroy()
+  }
+}
+
+const article = [
+  '# Der Turing-Test',
+  '',
+  'Der Turing-Test ist ein Gedankenexperiment aus dem Jahr 1950.',
+  '',
+  '> [!wissenswert] Das Original war ein Ratespiel um Mann und Frau',
+  '> In Turings Aufsatz heißt der Test "Imitation Game".',
+  '',
+  'Ein zweiter Absatz mit user_name_field, feature~2 und [^1].',
+  '',
+  '> [!zeitstrahl] 75 Jahre Imitation Game',
+  '> - 1950 · Alan Turing veröffentlicht seinen Aufsatz.',
+  '> - 1980 · John Searle widerspricht.',
+  '',
+  'Ein dritter Absatz mit *echter Betonung*.',
+  '',
+  '> [!achtung] Heißt „bestanden“, dass die Maschine denkt?',
+  '> Nein, und das ist der Einwand von John Searle.',
+  '',
+  '> [!selbsttest]',
+  '> - Was hat Turing mit dem Test erreichen wollen?',
+  '> - Was bedeutet Intelligenz?',
+  ''
+].join('\n')
+
+describe('rich Markdown document source fidelity', () => {
+  it.each([article, article.repeat(100), article.replaceAll('\n\n', '\n\n\n\n').repeat(60)])(
+    'only changes edited prose across successive commits (%#)',
+    (source) => {
+      const editor = createEditor(source)
+      const refs = {
+        originalSourceRef: { current: source },
+        baseCanonicalRef: { current: editor.getMarkdown() },
+        lastCommittedMarkdownRef: { current: source }
+      }
+      let expected = source
+      try {
+        for (const text of ['1950.', '[^1].', '*echter Betonung*.']) {
+          const needle = text.replace(/\*/g, '')
+          let position = -1
+          editor.state.doc.descendants((node, pos) => {
+            if (position === -1 && node.isText && node.text?.includes(needle)) {
+              position = pos + node.text.indexOf(needle) + needle.length
+            }
+          })
+          // The final period is a separate text node after the italic mark.
+          if (position === -1) {
+            editor.state.doc.descendants((node, pos) => {
+              if (
+                position === -1 &&
+                node.type.name === 'paragraph' &&
+                node.textContent.includes('Ein dritter')
+              ) {
+                position = pos + node.nodeSize - 1
+              }
+            })
+          }
+          expect(position).toBeGreaterThan(0)
+          editor.commands.insertContentAt(position, { type: 'text', text: ' rgffggf' })
+          expected = expected.replace(text, `${text} rgffggf`)
+          const result = commitRichMarkdownSerialization(editor, refs, serialize)
+          expect(result.markdown).toBe(expected)
+          const reopened = createEditor(result.markdown)
+          try {
+            expect(reopened.getJSON()).toEqual(editor.getJSON())
+          } finally {
+            reopened.destroy()
+          }
+        }
+      } finally {
+        editor.destroy()
+      }
+    }
+  )
+})
+
+describe('block source reconciliation when a whole-document patch cannot be applied', () => {
+  it.each([
+    ['\n\n_Keep_\n\n\n\nEnd\n\n', '\n\n_Keep_\n\n\n\nChanged\n\n', '\n\n_Keep_\n\n\n\nChanged\n\n'],
+    [
+      '_Keep_\n\n> [!NOTE]\n> - a\n',
+      '_Keep_\n\n> [!NOTE]\n> - a\n\nAdded paragraph\n',
+      '_Keep_\n\n> [!NOTE]\n> - a\n\nAdded paragraph'
+    ],
+    ['_Keep_\n', '_Keep_\n\nAdded paragraph', '_Keep_\n\nAdded paragraph'],
+    [
+      '_Keep_\n\nRemove this\n\n> [!NOTE]\n> - a\n',
+      '_Keep_\n\n> [!NOTE]\n> - a\n',
+      '_Keep_\n\n> [!NOTE]\n> - a\n'
+    ],
+    [
+      '_Keep_\n\nRepeat\n\nRepeat\n\nEnd\n',
+      '_Keep_\n\nRepeat\n\nChanged\n\nEnd\n',
+      '_Keep_\n\nRepeat\n\nChanged\n\nEnd\n'
+    ],
+    ['_Keep_\r\n\r\nEnd\r\n', '_Keep_\n\nChanged', '_Keep_\r\n\r\nChanged\r\n'],
+    [
+      '_Keep_\n\n```text\n[] \\_ ~ ` *\n```\n\nEnd\n',
+      '_Keep_\n\n```text\n[] \\_ ~ ` *\n```\n\nChanged\n',
+      '_Keep_\n\n```text\n[] \\_ ~ ` *\n```\n\nChanged\n'
+    ]
+  ])('preserves source through structural changes (%#)', (source, changed, expected) => {
+    const editor = createEditor(changed)
+    try {
+      const result = reconcileRichMarkdownBlockSource(
+        editor,
+        source,
+        editor.getMarkdown(),
+        serialize
+      )
+      expect(result).toBe(expected)
+      expect(serialize(result!)).toBe(editor.getMarkdown())
+    } finally {
+      editor.destroy()
+    }
+  })
+})
diff --git a/src/renderer/src/components/editor/rich-markdown-escape-fidelity.test.ts b/src/renderer/src/components/editor/rich-markdown-escape-fidelity.test.ts
new file mode 100644
index 000000000000..5f2584495e4b
--- /dev/null
+++ b/src/renderer/src/components/editor/rich-markdown-escape-fidelity.test.ts
@@ -0,0 +1,212 @@
+import { Editor, type JSONContent } from '@tiptap/core'
+import StarterKit from '@tiptap/starter-kit'
+import { describe, expect, it, vi } from 'vitest'
+import { encodeRawMarkdownHtmlForRichEditor } from './raw-markdown-html'
+import { createRichMarkdownExtensions } from './rich-markdown-extensions'
+import { createRichMarkdownEditorCodec } from './rich-markdown-source-transport'
+import { createIsolatedMarkdownExtensionForTests } from './isolated-markdown-extension-for-tests'
+
+function createEditor(content: JSONContent | string) {
+  return new Editor({
+    element: null,
+    extensions: [StarterKit, createIsolatedMarkdownExtensionForTests()],
+    content,
+    ...(typeof content === 'string' ? { contentType: 'markdown' as const } : {})
+  })
+}
+
+function paragraph(text: string): JSONContent {
+  return { type: 'paragraph', content: [{ type: 'text', text }] }
+}
+
+function expectReopens(editor: Editor, reopen = createEditor): void {
+  const reopened = reopen(editor.getMarkdown())
+  try {
+    expect(reopened.getJSON()).toEqual(editor.getJSON())
+  } finally {
+    reopened.destroy()
+  }
+}
+
+function createRichEditor(content: JSONContent | string) {
+  const codec = createRichMarkdownEditorCodec()
+  return new Editor({
+    element: null,
+    extensions: createRichMarkdownExtensions({ codec }),
+    content:
+      typeof content === 'string' ? encodeRawMarkdownHtmlForRichEditor(content, codec) : content,
+    ...(typeof content === 'string' ? { contentType: 'markdown' as const } : {})
+  })
+}
+
+describe('optional Markdown escapes', () => {
+  it.each(['user_name_field', 'a_2_b', 'a__b', 'пристаням_стремятся', '𐐀_𐐁', 'é_value'])(
+    'preserves intraword underscores in %s',
+    (text) => {
+      const editor = createEditor({ type: 'doc', content: [paragraph(text)] })
+      try {
+        expect(editor.getMarkdown()).toBe(text)
+        expectReopens(editor)
+      } finally {
+        editor.destroy()
+      }
+    }
+  )
+
+  it.each(['__init__', '___init___', '_word_', 'see a. __b__c', 'a\\_b', 'a\\\\_b'])(
+    'keeps literal delimiter runs and backslashes safe: %s',
+    (text) => {
+      const editor = createEditor({ type: 'doc', content: [paragraph(text)] })
+      try {
+        expectReopens(editor)
+      } finally {
+        editor.destroy()
+      }
+    }
+  )
+
+  it.each(['feature~2', 'an unmatched ` tick', 'a single * marker', 'a~b_c*d`e'])(
+    'omits optional escapes only when the parser proves the literal survives: %s',
+    (text) => {
+      const editor = createEditor({ type: 'doc', content: [paragraph(text)] })
+      try {
+        expect(editor.getMarkdown()).toBe(text)
+        expectReopens(editor)
+      } finally {
+        editor.destroy()
+      }
+    }
+  )
+
+  it.each([
+    '~5 dollars, see v2~beta',
+    '~~deleted~~',
+    '*italic*',
+    '**bold**',
+    '`code`',
+    '[label](url)',
+    '[literal] *bold* feature~2'
+  ])('retains escapes that prevent new Markdown syntax: %s', (text) => {
+    const editor = createEditor({ type: 'doc', content: [paragraph(text)] })
+    try {
+      expectReopens(editor)
+      if (text.includes('feature~2')) {
+        expect(editor.getMarkdown()).toContain('feature~2')
+      }
+    } finally {
+      editor.destroy()
+    }
+  })
+
+  it('preserves identifiers alongside emphasis-like literals', () => {
+    const editor = createEditor({ type: 'doc', content: [paragraph('__init__ user_name')] })
+    try {
+      expect(editor.getMarkdown()).toContain('user_name')
+      expectReopens(editor)
+    } finally {
+      editor.destroy()
+    }
+  })
+
+  it('preserves callouts and identifiers in nested containers', () => {
+    const source = '> [!NOTE] user_name\n>\n> - [literal] a__b\n\n- outer_name\n  - inner_name'
+    const editor = createEditor(source)
+    try {
+      expect(editor.getMarkdown()).toContain('> [!NOTE] user_name')
+      expect(editor.getMarkdown()).toContain('[literal] a__b')
+      expect(editor.getMarkdown()).toContain('inner_name')
+      expectReopens(editor)
+    } finally {
+      editor.destroy()
+    }
+  })
+
+  it('validates marks across adjacent text nodes', () => {
+    const editor = createEditor({
+      type: 'doc',
+      content: [
+        {
+          type: 'paragraph',
+          content: [
+            { type: 'text', text: 'a_' },
+            { type: 'text', text: '_b_', marks: [{ type: 'bold' }] },
+            { type: 'text', text: '_c user_name' }
+          ]
+        }
+      ]
+    })
+    try {
+      expect(editor.getMarkdown()).toContain('user_name')
+      expectReopens(editor)
+    } finally {
+      editor.destroy()
+    }
+  })
+
+  it('does not activate definitions nested in another block', () => {
+    const editor = createEditor({
+      type: 'doc',
+      content: [paragraph('[ref]'), { type: 'blockquote', content: [paragraph('[ref]: /target')] }]
+    })
+    try {
+      expectReopens(editor)
+    } finally {
+      editor.destroy()
+    }
+  })
+})
+
+describe('literal escape validation boundaries', () => {
+  it('validates a nested container once and caches unchanged blocks', () => {
+    const editor = createEditor('> [!NOTE] user_name\n>\n> - inner_value')
+    const parse = vi.spyOn(editor.markdown!, 'parse')
+    try {
+      expect(editor.getMarkdown()).toContain('[!NOTE] user_name')
+      expect(parse).toHaveBeenCalledTimes(1)
+      editor.getMarkdown()
+      expect(parse).toHaveBeenCalledTimes(1)
+      editor.commands.insertContentAt(3, { type: 'text', text: 'edit ' })
+      editor.getMarkdown()
+      expect(parse).toHaveBeenCalledTimes(2)
+      expectReopens(editor)
+    } finally {
+      parse.mockRestore()
+      editor.destroy()
+    }
+  })
+
+  it('skips optional validation for an oversized block', () => {
+    const editor = createEditor({ type: 'doc', content: [paragraph(`${'a_'.repeat(25_001)}b`)] })
+    const parse = vi.spyOn(editor.markdown!, 'parse')
+    try {
+      expect(editor.getMarkdown()).toContain('a\\_')
+      expect(parse).not.toHaveBeenCalled()
+    } finally {
+      parse.mockRestore()
+      editor.destroy()
+    }
+  })
+
+  it.each([
+    '> [!TIP] user_name\n>\n> - [x] inner_value',
+    '> user_name <span data-value="literal_[]">raw\\_value</span>',
+    '<div>literal\\_[]</div>\n\nuser_name',
+    '> user_name `literal\\_[]`',
+    '```text\nliteral\\_[]\n```\n\nuser_name',
+    '[ref]\n\n> [ref]: /target\n>\n> tail',
+    '> [ref]\n\n[ref]: /target'
+  ])('preserves source ownership and reopen semantics: %s', (source) => {
+    const editor = createRichEditor(source)
+    try {
+      expectReopens(editor, createRichEditor)
+      if (source.includes('<div>')) {
+        expect(editor.getMarkdown()).toContain('<div>literal\\_[]</div>')
+      }
+      if (source.includes('<span')) {
+        expect(editor.getMarkdown()).toContain('<span data-value="literal_[]">')
+      }
+    } finally {
+      editor.destroy()
+    }
+  })
+})
diff --git a/src/renderer/src/components/editor/rich-markdown-extension.ts b/src/renderer/src/components/editor/rich-markdown-extension.ts
index c36c692b4b95..06d93579abf0 100644
--- a/src/renderer/src/components/editor/rich-markdown-extension.ts
+++ b/src/renderer/src/components/editor/rich-markdown-extension.ts
@@ -1,4 +1,5 @@
 import { Markdown } from '@tiptap/markdown'
+import { registerRichMarkdownBlockSource } from './rich-markdown-block-source'
 import { preserveLiteralMarkdownSource } from './rich-markdown-literal-serialization'
 import type { RichMarkdownEditorCodec } from './rich-markdown-source-transport'
 
@@ -23,6 +24,7 @@ export function createRichMarkdownExtension(
     onBeforeCreate(event) {
       this.parent?.(event)
       preserveLiteralMarkdownSource(this.editor, codec, htmlSuperscriptLinks)
+      registerRichMarkdownBlockSource(this.editor, codec, htmlSuperscriptLinks)
     }
   })
 }
diff --git a/src/renderer/src/components/editor/rich-markdown-extensions.ts b/src/renderer/src/components/editor/rich-markdown-extensions.ts
index 9a4f292f0425..c7e69917c253 100644
--- a/src/renderer/src/components/editor/rich-markdown-extensions.ts
+++ b/src/renderer/src/components/editor/rich-markdown-extensions.ts
@@ -1,11 +1,13 @@
+import { createMarkdownTokenizerStart } from './markdown-tokenizer-start'
 import type { AnyExtension } from '@tiptap/core'
 import StarterKit from '@tiptap/starter-kit'
+import { RichMarkdownTrailingParagraph } from './rich-markdown-trailing-paragraph'
 import Link from '@tiptap/extension-link'
 import { Code } from '@tiptap/extension-code'
 import Image from '@tiptap/extension-image'
 import Placeholder from '@tiptap/extension-placeholder'
 import TaskItem from '@tiptap/extension-task-item'
-import { Table } from '@tiptap/extension-table'
+import { RichMarkdownTable } from './rich-markdown-table'
 import { TableCell } from '@tiptap/extension-table-cell'
 import { TableHeader } from '@tiptap/extension-table-header'
 import { TableRow } from '@tiptap/extension-table-row'
@@ -73,9 +75,11 @@ export function createRichMarkdownExtensions({
       code: false,
       codeBlock: false,
       orderedList: false,
-      paragraph: false
+      paragraph: false,
+      trailingNode: false
     }),
     RichMarkdownParagraph,
+    RichMarkdownTrailingParagraph,
     RichMarkdownCode,
     RichMarkdownCodeBlockLowlight.extend({
       addNodeView() {
@@ -218,7 +222,7 @@ export function createRichMarkdownExtensions({
       nested: true
     }),
     ...createOrcaDetailsExtensions(),
-    Table.configure({
+    RichMarkdownTable.configure({
       resizable: false
     }),
     TableRow,
@@ -229,7 +233,16 @@ export function createRichMarkdownExtensions({
         throwOnError: false
       }
     }),
-    BlockMath.configure({
+    BlockMath.extend({
+      markdownTokenizer:
+        BlockMath.config.markdownTokenizer &&
+        typeof BlockMath.config.markdownTokenizer !== 'function'
+          ? {
+              ...BlockMath.config.markdownTokenizer,
+              start: createMarkdownTokenizerStart('$$')
+            }
+          : BlockMath.config.markdownTokenizer
+    }).configure({
       katexOptions: {
         displayMode: true,
         throwOnError: false
diff --git a/src/renderer/src/components/editor/rich-markdown-literal-serialization.ts b/src/renderer/src/components/editor/rich-markdown-literal-serialization.ts
index d294bec3e069..3a998fe04952 100644
--- a/src/renderer/src/components/editor/rich-markdown-literal-serialization.ts
+++ b/src/renderer/src/components/editor/rich-markdown-literal-serialization.ts
@@ -1,11 +1,24 @@
 import type { Editor, JSONContent } from '@tiptap/core'
+import { getRichMarkdownSerializationDocument } from './rich-markdown-trailing-paragraph'
 import type { Node as ProseMirrorNode } from '@tiptap/pm/model'
 import { encodeRawMarkdownHtmlForRichEditor } from './raw-markdown-html'
 import type { RichMarkdownEditorCodec } from './rich-markdown-source-transport'
 
+const MAX_LITERAL_BLOCK_CODE_UNITS = 50_000
+const LITERAL_BLOCK_TYPES = new Set([
+  'paragraph',
+  'heading',
+  'blockquote',
+  'bulletList',
+  'orderedList',
+  'taskList'
+])
+
 function withoutOptionalEscapes(markdown: string): string {
-  return markdown.replace(/\\([\\_[\]])/g, (escaped, character) =>
-    character === '\\' ? escaped : character
+  // Consume escaped backslashes first; underscore runs must be wholly inside a word.
+  return markdown.replace(
+    /\\\\|(?<=[\p{L}\p{N}\p{M}])(?:\\_)+(?=[\p{L}\p{N}\p{M}])|\\[[\]]/gu,
+    (escaped) => (escaped === '\\\\' ? escaped : escaped.replace(/\\/g, ''))
   )
 }
 
@@ -16,51 +29,74 @@ export function preserveLiteralMarkdownSource(
 ): void {
   const manager = editor.markdown!
   const render = manager.renderNodeToMarkdown.bind(manager)
-  const serialize = editor.getMarkdown.bind(editor)
   const cache = new WeakMap<ProseMirrorNode, { markdown: string; result: string }>()
   let blocks: Map<JSONContent, ProseMirrorNode> | undefined
 
   manager.renderNodeToMarkdown = (node, ...args) => {
     const markdown = render(node, ...args)
     const block = blocks?.get(node)
-    if (!block || !/\\[[\]]/.test(markdown)) {
+    if (!block || !/\\[_[\]~`*]/.test(markdown)) {
+      return markdown
+    }
+    // Retain existing large paragraph/heading fidelity; cap only the expanded validation.
+    const preservesBrackets =
+      (node.type === 'paragraph' || node.type === 'heading') && /\\[[\]]/.test(markdown)
+    if (markdown.length > MAX_LITERAL_BLOCK_CODE_UNITS && !preservesBrackets) {
       return markdown
     }
     const cached = cache.get(block)
     if (cached?.markdown === markdown) {
       return cached.result
     }
-    const candidate = withoutOptionalEscapes(markdown)
     let result = markdown
-    try {
-      const parsed = manager.parse(
-        encodeRawMarkdownHtmlForRichEditor(candidate, codec, { htmlSuperscriptLinks })
+    const candidates = [
+      withoutOptionalEscapes,
+      ...['~', '`', '*'].map(
+        (character) => (source: string) =>
+          source.replace(/\\([\\_~`*])/g, (escaped, value) =>
+            value === character ? value : escaped
+          )
       )
-      // Every mark, attribute and text position must survive reopening this block.
-      if (parsed.content?.length === 1 && editor.schema.nodeFromJSON(parsed.content[0]).eq(block)) {
-        result = candidate
+    ]
+    for (const unescape of candidates) {
+      const candidate = unescape(result)
+      if (candidate === result) {
+        continue
+      }
+      try {
+        const parsed = manager.parse(
+          encodeRawMarkdownHtmlForRichEditor(candidate, codec, { htmlSuperscriptLinks })
+        )
+        // Every mark, attribute and text position must survive reopening this block.
+        if (
+          parsed.content?.length === 1 &&
+          editor.schema.nodeFromJSON(parsed.content[0]).eq(block)
+        ) {
+          result = candidate
+        }
+      } catch {
+        // Keep escapes when a custom parser cannot prove equivalence.
       }
-    } catch {
-      // Keep the upstream escaped output when a custom parser cannot prove equivalence.
     }
     cache.set(block, { markdown, result })
     return result
   }
 
   editor.getMarkdown = () => {
-    const markdown = serialize()
-    if (!/\\[[\]]/.test(markdown)) {
+    const document = getRichMarkdownSerializationDocument(editor)
+    const json = document.toJSON()
+    const markdown = manager.serialize(json)
+    if (!/\\[_[\]~`*]/.test(markdown)) {
       return markdown
     }
     // Reference definitions can change inline meaning across block boundaries.
-    if (/^ {0,3}\[[^\n]*\]:/m.test(withoutOptionalEscapes(markdown))) {
+    if (/\][ \t]*:/.test(withoutOptionalEscapes(markdown))) {
       return markdown
     }
-    const json = editor.getJSON()
     blocks = new Map()
     json.content?.forEach((node, index) => {
-      if (node.type === 'paragraph' || node.type === 'heading') {
-        blocks!.set(node, editor.state.doc.child(index))
+      if (node.type && LITERAL_BLOCK_TYPES.has(node.type)) {
+        blocks!.set(node, document.child(index))
       }
     })
     try {
diff --git a/src/renderer/src/components/editor/rich-markdown-save-benchmark.test.ts b/src/renderer/src/components/editor/rich-markdown-save-benchmark.test.ts
new file mode 100644
index 000000000000..4051a8e9b912
--- /dev/null
+++ b/src/renderer/src/components/editor/rich-markdown-save-benchmark.test.ts
@@ -0,0 +1,54 @@
+import { Editor } from '@tiptap/core'
+import { it, expect } from 'vitest'
+import { createRichMarkdownEditorCodec } from './rich-markdown-source-transport'
+import { createRichMarkdownExtensions } from './rich-markdown-extensions'
+import { commitRichMarkdownSerialization } from './rich-markdown-serialization-commit'
+function create(source: string) {
+  return new Editor({
+    element: null,
+    extensions: createRichMarkdownExtensions({ codec: createRichMarkdownEditorCodec() }),
+    content: source,
+    contentType: 'markdown'
+  })
+}
+// Run with ORCA_MARKDOWN_SAVE_BENCHMARK=1; timings are evidence, not a machine-dependent CI gate.
+it.skipIf(process.env.ORCA_MARKDOWN_SAVE_BENCHMARK !== '1')(
+  'measures source preservation at supported document sizes',
+  () => {
+    for (const count of [100, 500, 1500, 6000]) {
+      const source = `${Array.from(
+        { length: count },
+        (_, i) => `Paragraph ${i} with _emphasis_ and user_name.\n\n> [!NOTE]\n> - Callout ${i}\n\n`
+      ).join('')}End\n`
+      const editor = create(source)
+      const refs = {
+        originalSourceRef: { current: source },
+        baseCanonicalRef: { current: editor.getMarkdown() },
+        lastCommittedMarkdownRef: { current: source }
+      }
+      const times: number[] = []
+      for (let j = 0; j < 3; j++) {
+        editor.commands.insertContentAt(2, { type: 'text', text: 'x' })
+        const start = performance.now()
+        const result = commitRichMarkdownSerialization(editor, refs, (text) => {
+          const round = create(text)
+          try {
+            return round.getMarkdown()
+          } finally {
+            round.destroy()
+          }
+        })
+        times.push(Math.round(performance.now() - start))
+        expect(result.markdown).toContain('> [!NOTE]\n> - Callout 0')
+      }
+      process.stdout.write(
+        `${JSON.stringify({
+          bytes: source.length,
+          blocks: editor.state.doc.childCount,
+          milliseconds: times
+        })}\n`
+      )
+      editor.destroy()
+    }
+  }
+)
diff --git a/src/renderer/src/components/editor/rich-markdown-serialization-commit.ts b/src/renderer/src/components/editor/rich-markdown-serialization-commit.ts
index dcebdf60dbd6..e21089a0a2e7 100644
--- a/src/renderer/src/components/editor/rich-markdown-serialization-commit.ts
+++ b/src/renderer/src/components/editor/rich-markdown-serialization-commit.ts
@@ -1,5 +1,6 @@
 import type { MutableRefObject } from 'react'
 import type { Editor } from '@tiptap/react'
+import { reconcileRichMarkdownBlockSource } from './rich-markdown-block-source'
 import {
   reconcileSerializedMarkdown,
   restoreMarkdownSourceEol
@@ -58,6 +59,22 @@ export function commitRichMarkdownSerialization(
     reconciled = restoreMarkdownSourceEol(edited, refs.originalSourceRef.current)
   }
 
+  if (
+    editor &&
+    edited !== refs.baseCanonicalRef.current &&
+    reconciled === restoreMarkdownSourceEol(edited, refs.originalSourceRef.current)
+  ) {
+    const preserved = reconcileRichMarkdownBlockSource(
+      editor,
+      refs.originalSourceRef.current,
+      edited,
+      roundTrip
+    )
+    if (preserved !== null) {
+      reconciled = preserved
+    }
+  }
+
   refs.originalSourceRef.current = reconciled
   // Why: reconciled ≡ edited semantically, so its canonical form is `edited`
   // (also correct in every fallback branch, which returns `edited` verbatim).
diff --git a/src/renderer/src/components/editor/rich-markdown-table.test.ts b/src/renderer/src/components/editor/rich-markdown-table.test.ts
new file mode 100644
index 000000000000..b3c79eee9616
--- /dev/null
+++ b/src/renderer/src/components/editor/rich-markdown-table.test.ts
@@ -0,0 +1,56 @@
+import { Table } from '@tiptap/extension-table'
+import { afterEach, expect, it, vi } from 'vitest'
+import { RichMarkdownTable } from './rich-markdown-table'
+
+afterEach(() => vi.restoreAllMocks())
+
+it.each([
+  '',
+  'prose',
+  '| A | B |\n| --- | :---: |\n| a | b |',
+  'A | B\n--- | ---\na | b',
+  '| A |\nnot a separator\n',
+  'one\n\n| A |\n| --- |',
+  '| A |\r\n| --- |\r\n',
+  '| A |\n| - |',
+  '| A |\n| : |',
+  `| A |\n| - |\n${'prose\n'.repeat(10_000)}`
+])('matches the upstream table detector: %j', (source) => {
+  const base = Table.config.markdownTokenizer
+  const guarded = RichMarkdownTable.config.markdownTokenizer
+  if (
+    !base ||
+    typeof base === 'function' ||
+    typeof base.start !== 'function' ||
+    !guarded ||
+    typeof guarded === 'function' ||
+    typeof guarded.start !== 'function'
+  ) {
+    throw new Error('Table tokenizer contract changed')
+  }
+  expect(guarded.start(source)).toBe(base.start(source))
+})
+
+it('only passes the first two lines to the upstream detector', () => {
+  const base = Table.config.markdownTokenizer
+  const guarded = RichMarkdownTable.config.markdownTokenizer
+  if (
+    !base ||
+    typeof base === 'function' ||
+    typeof base.start !== 'function' ||
+    !guarded ||
+    typeof guarded === 'function' ||
+    typeof guarded.start !== 'function'
+  ) {
+    throw new Error('Table tokenizer contract changed')
+  }
+  const original = base.start
+  const start = vi.fn(original)
+  base.start = start
+  try {
+    guarded.start(`first\nsecond\n${'rest\n'.repeat(10_000)}`)
+    expect(start).toHaveBeenCalledExactlyOnceWith('first\nsecond')
+  } finally {
+    base.start = original
+  }
+})
diff --git a/src/renderer/src/components/editor/rich-markdown-table.ts b/src/renderer/src/components/editor/rich-markdown-table.ts
new file mode 100644
index 000000000000..4e2855313907
--- /dev/null
+++ b/src/renderer/src/components/editor/rich-markdown-table.ts
@@ -0,0 +1,22 @@
+import { Table } from '@tiptap/extension-table'
+
+const tokenizer = Table.config.markdownTokenizer
+
+export const RichMarkdownTable = Table.extend({
+  markdownTokenizer:
+    tokenizer && typeof tokenizer !== 'function'
+      ? {
+          ...tokenizer,
+          start(source) {
+            const firstEnd = source.indexOf('\n')
+            if (firstEnd === -1) {
+              return -1
+            }
+            const secondEnd = source.indexOf('\n', firstEnd + 1)
+            // Upstream tests only two lines, but splits the entire remaining document.
+            const prefix = secondEnd === -1 ? source : source.slice(0, secondEnd)
+            return typeof tokenizer.start === 'function' ? tokenizer.start(prefix) : -1
+          }
+        }
+      : tokenizer
+})
diff --git a/src/renderer/src/components/editor/rich-markdown-trailing-paragraph.test.ts b/src/renderer/src/components/editor/rich-markdown-trailing-paragraph.test.ts
new file mode 100644
index 000000000000..042c1d25a72e
--- /dev/null
+++ b/src/renderer/src/components/editor/rich-markdown-trailing-paragraph.test.ts
@@ -0,0 +1,77 @@
+// @vitest-environment happy-dom
+import { Editor } from '@tiptap/core'
+import { afterEach, describe, expect, it } from 'vitest'
+import { createRichMarkdownExtensions } from './rich-markdown-extensions'
+import { createRichMarkdownEditorCodec } from './rich-markdown-source-transport'
+import { commitRichMarkdownSerialization } from './rich-markdown-serialization-commit'
+
+const editors: Editor[] = []
+function createEditor(content: string) {
+  const editor = new Editor({
+    element: document.createElement('div'),
+    extensions: createRichMarkdownExtensions({ codec: createRichMarkdownEditorCodec() }),
+    content,
+    contentType: 'markdown'
+  })
+  editors.push(editor)
+  return editor
+}
+function serialize(source: string) {
+  return createEditor(source).getMarkdown()
+}
+afterEach(() => editors.splice(0).forEach((editor) => editor.destroy()))
+
+describe('the synthetic trailing paragraph', () => {
+  it.each(['> [!NOTE]\n> - A list item', '# Heading', '- List item', '```text\ncode\n```'])(
+    'does not change serialization on selection or an unrelated edit: %s',
+    (ending) => {
+      const source = `\nProse to edit.\n\n${ending}\n`
+      const editor = createEditor(source)
+      const refs = {
+        originalSourceRef: { current: source },
+        baseCanonicalRef: { current: editor.getMarkdown() },
+        lastCommittedMarkdownRef: { current: source }
+      }
+      editor.commands.setTextSelection(2)
+      expect(editor.state.doc.lastChild?.type.name).toBe('paragraph')
+      expect(editor.getMarkdown()).toBe(refs.baseCanonicalRef.current)
+      editor.commands.insertContentAt(1, { type: 'text', text: 'Edited ' })
+      expect(commitRichMarkdownSerialization(editor, refs, serialize).markdown).toBe(
+        source.replace('Prose', 'Edited Prose')
+      )
+    }
+  )
+
+  it('saves text typed into the trailing paragraph and survives undo/redo', () => {
+    const editor = createEditor('> Quote')
+    editor.commands.setTextSelection(2)
+    editor.commands.insertContentAt(editor.state.doc.content.size - 1, {
+      type: 'text',
+      text: 'New paragraph'
+    })
+    expect(editor.getMarkdown()).toBe('> Quote\n\nNew paragraph')
+    editor.commands.undo()
+    expect(editor.getMarkdown()).toBe('> Quote\n\n')
+    editor.commands.redo()
+    expect(editor.getMarkdown()).toBe('> Quote\n\nNew paragraph')
+  })
+
+  it('keeps an intentionally added blank paragraph', () => {
+    const editor = createEditor('> Quote')
+    editor.commands.setTextSelection(2)
+    editor.commands.setTextSelection(editor.state.doc.content.size - 1)
+    editor.commands.splitBlock()
+    expect(createEditor(editor.getMarkdown()).getJSON()).toEqual(editor.getJSON())
+    expect(editor.state.doc.childCount).toBe(3)
+  })
+
+  it('keeps authored trailing blank paragraphs after loading and replacing content', () => {
+    const editor = createEditor('> Quote\n\n')
+    editor.commands.setTextSelection(2)
+    expect(editor.getMarkdown()).toBe('> Quote\n\n')
+    editor.commands.setContent('# Heading', { contentType: 'markdown' })
+    expect(editor.getMarkdown()).toBe('# Heading')
+    editor.commands.setContent('# Heading\n\n', { contentType: 'markdown' })
+    expect(editor.getMarkdown()).toBe('# Heading\n\n')
+  })
+})
diff --git a/src/renderer/src/components/editor/rich-markdown-trailing-paragraph.ts b/src/renderer/src/components/editor/rich-markdown-trailing-paragraph.ts
new file mode 100644
index 000000000000..614f3ddace7a
--- /dev/null
+++ b/src/renderer/src/components/editor/rich-markdown-trailing-paragraph.ts
@@ -0,0 +1,65 @@
+import type { Editor } from '@tiptap/core'
+import { TrailingNode } from '@tiptap/extensions'
+import type { Node as ProseMirrorNode } from '@tiptap/pm/model'
+import { Plugin, PluginKey } from '@tiptap/pm/state'
+
+const trailingParagraph = new PluginKey<ProseMirrorNode | null>('richMarkdownTrailingParagraph')
+
+// The click target below a final quote/list is UI scaffolding until the user edits it.
+export const RichMarkdownTrailingParagraph = TrailingNode.extend({
+  addProseMirrorPlugins() {
+    const plugins = (this.parent?.() ?? []).map((plugin) => {
+      const append = plugin.spec.appendTransaction
+      if (!append) {
+        return plugin
+      }
+      return new Plugin({
+        ...plugin.spec,
+        appendTransaction(transactions, oldState, state) {
+          const transaction = append.call(plugin, transactions, oldState, state)
+          if (transaction) {
+            transaction.setMeta(trailingParagraph, transaction.doc.lastChild)
+          }
+          return transaction
+        }
+      })
+    })
+    return [
+      ...plugins,
+      new Plugin<ProseMirrorNode | null>({
+        key: trailingParagraph,
+        state: {
+          init: () => null,
+          apply(transaction, previous, oldState) {
+            const inserted: unknown = transaction.getMeta(trailingParagraph)
+            if (inserted === transaction.doc.lastChild && transaction.doc.lastChild) {
+              return transaction.doc.lastChild
+            }
+            if (!previous || !transaction.docChanged) {
+              return previous
+            }
+            let start = oldState.doc.content.size - previous.nodeSize
+            let touched = false
+            for (const map of transaction.mapping.maps) {
+              map.forEach((from, to) => {
+                if (from <= start + previous.nodeSize && to > start) {
+                  touched = true
+                }
+              })
+              start = map.map(start, 1)
+            }
+            return !touched && transaction.doc.lastChild === previous ? previous : null
+          }
+        }
+      })
+    ]
+  }
+})
+
+export function getRichMarkdownSerializationDocument(editor: Editor): ProseMirrorNode {
+  const document = editor.state.doc
+  const synthetic = trailingParagraph.getState(editor.state)
+  return synthetic && document.lastChild === synthetic
+    ? document.copy(document.content.cut(0, document.content.size - synthetic.nodeSize))
+    : document
+}
diff --git a/src/renderer/src/components/editor/tiptap-marked-facade.ts b/src/renderer/src/components/editor/tiptap-marked-facade.ts
index 80cadb343f90..196bb8e16c8b 100644
--- a/src/renderer/src/components/editor/tiptap-marked-facade.ts
+++ b/src/renderer/src/components/editor/tiptap-marked-facade.ts
@@ -1,3 +1,4 @@
+import { getMarkdownTokenizerStartMarker } from './markdown-tokenizer-start'
 import {
   Hooks,
   Lexer,
@@ -19,6 +20,27 @@ export function createTiptapMarkedFacade(): typeof marked {
   // Why: Tiptap 3.22.5 registers on the injected instance but parses with
   // `new instance.Lexer()`, so the constructor must retain the private registry.
   class RegistryLexer extends Lexer {
+    private readonly registeredExtensions = this.options.extensions
+    blockTokens(source: string, tokens?: TokensList, lastParagraphClipped?: boolean): TokensList
+    blockTokens(source: string, tokens?: Token[], lastParagraphClipped?: boolean): Token[]
+    blockTokens(source: string, tokens?: Token[], lastParagraphClipped?: boolean): Token[] {
+      const previousExtensions = this.options.extensions
+      const extensions = this.registeredExtensions
+      if (!extensions?.startBlock) {
+        return super.blockTokens(source, tokens, lastParagraphClipped)
+      }
+      const startBlock = extensions.startBlock.filter((start) => {
+        const marker = getMarkdownTokenizerStartMarker(start)
+        return !marker || source.includes(marker)
+      })
+      this.options.extensions = { ...extensions, startBlock }
+      try {
+        return super.blockTokens(source, tokens, lastParagraphClipped)
+      } finally {
+        this.options.extensions = previousExtensions
+      }
+    }
+
     constructor(options?: MarkedOptions) {
       super({
         ...registry.defaults,
diff --git a/src/renderer/src/components/editor/use-monaco-editor-mount.cursor-owner.test.tsx b/src/renderer/src/components/editor/use-monaco-editor-mount.cursor-owner.test.tsx
new file mode 100644
index 000000000000..667e3be75304
--- /dev/null
+++ b/src/renderer/src/components/editor/use-monaco-editor-mount.cursor-owner.test.tsx
@@ -0,0 +1,177 @@
+// @vitest-environment happy-dom
+import { cleanup, renderHook } from '@testing-library/react'
+import { Suspense } from 'react'
+import { afterEach, expect, it, vi } from 'vitest'
+import type { editor } from 'monaco-editor'
+import type { OnMount } from '@monaco-editor/react'
+import { createEditorTabsStore } from '@/store/slices/editor-slice-test-harness'
+import { captureEditorFileOperationProvenance } from '@/lib/editor-file-operation-owner'
+import type { MonacoEditorMountParams } from './monaco-editor-mount-params'
+import { useMonacoEditorMount } from './use-monaco-editor-mount'
+
+vi.mock('@/store', () => ({
+  useAppStore: { getState: () => ({ pendingEditorReveal: null, pendingEditorFocusRequest: null }) }
+}))
+vi.mock('./monaco-markdown-doc-link-decorations', () => ({
+  createMarkdownDocLinkDecorationController: vi.fn()
+}))
+vi.mock('./monaco-markdown-doc-completions', () => ({
+  ensureMarkdownDocCompletionProvider: vi.fn()
+}))
+vi.mock('./monaco-e2e-probe', () => ({ installMonacoE2EProbe: () => vi.fn() }))
+vi.mock('./monaco-editor-input-bindings', () => ({
+  installMonacoEditorInputBindings: () => ({ disposeInputBindings: vi.fn() })
+}))
+
+afterEach(cleanup)
+
+it('keeps a retained cursor listener on the current file ID after same-path owner migration', () => {
+  const store = createEditorTabsStore()
+  const filePath = '/repo/file.ts'
+  const oldId = 'restored-file'
+  store.setState({
+    activeFileId: null,
+    openFiles: [
+      {
+        id: oldId,
+        filePath,
+        relativePath: 'file.ts',
+        worktreeId: 'old-workspace',
+        language: 'typescript',
+        mode: 'edit',
+        isDirty: false
+      }
+    ],
+    runtimeEnvironments: [],
+    detectedWorktreesByRepo: {}
+  })
+  const params: MonacoEditorMountParams = {
+    fileId: oldId,
+    filePath,
+    viewStateKey: 'stable-tab-view',
+    viewStateId: 'stable-tab',
+    worktreeId: 'old-workspace',
+    autoHeight: false,
+    autoHeightLineHeight: 20,
+    editorRef: { current: null },
+    editorContainerRef: { current: null },
+    languageRef: { current: 'typescript' },
+    propsRef: {
+      current: {
+        relativePath: 'file.ts',
+        language: 'typescript',
+        onSave: vi.fn(),
+        onContentChange: vi.fn()
+      }
+    },
+    readOnlyRef: { current: false },
+    scrollThrottleTimerRef: { current: null },
+    unregisterFileSearchSelectionRef: { current: null },
+    setMountedEditor: vi.fn(),
+    setAutoHeightContentHeight: vi.fn(),
+    setEditorCursorLine: store.getState().setEditorCursorLine,
+    setupCopy: vi.fn(),
+    queueReveal: vi.fn(),
+    contentSync: {
+      contentRef: { current: '' },
+      lastSyncedContentRef: { current: '' },
+      contentSyncModeRef: { current: 'undoable' },
+      isApplyingProgrammaticContentRef: { current: false },
+      isApplyingLargePasteRef: { current: false }
+    },
+    decorations: {
+      markdownDocLinkDecorationsRef: { current: null },
+      conflictDecorationsRef: { current: null },
+      updateMarkdownCompletionDocuments: vi.fn()
+    },
+    annotations: {
+      commentPopoverRef: { current: null },
+      shouldShowMarkdownAnnotationsRef: { current: false },
+      setCommentPopover: vi.fn(),
+      setSelectionAnnotationTarget: vi.fn()
+    },
+    gutterMenu: {
+      setGutterMenuOpen: vi.fn(),
+      setGutterMenuPoint: vi.fn(),
+      setGutterMenuLine: vi.fn()
+    }
+  }
+  let emitCursor:
+    | ((event: { position: { lineNumber: number; column: number } }) => void)
+    | undefined
+  let disposeEditor: (() => void) | undefined
+  const cursorDispose = vi.fn()
+  const mockEditor = {
+    getModel: () => null,
+    getPosition: () => ({ lineNumber: 1, column: 1 }),
+    focus: vi.fn(),
+    onDidChangeCursorPosition: (listener: NonNullable<typeof emitCursor>) => {
+      emitCursor = listener
+      return { dispose: cursorDispose }
+    },
+    onDidScrollChange: () => ({ dispose: vi.fn() }),
+    onMouseDown: () => ({ dispose: vi.fn() }),
+    onDidDispose: (listener: () => void) => {
+      disposeEditor = listener
+    }
+  }
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Mount and tracking use only the editor methods mocked above; decorations/input/probe integrations are mocked.
+  const editorInstance = mockEditor as unknown as editor.IStandaloneCodeEditor
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The mocked mount integrations do not access Monaco, and the mouse listener is not invoked.
+  const monaco = {} as Parameters<OnMount>[1]
+  const suspendedRender = vi.fn()
+  const neverCommits = new Promise<void>(() => {})
+  const view = renderHook(
+    ({ next, suspend }: { next: MonacoEditorMountParams; suspend: boolean }) => {
+      const onMount = useMonacoEditorMount(next)
+      if (suspend) {
+        suspendedRender()
+        throw neverCommits
+      }
+      return onMount
+    },
+    {
+      initialProps: { next: params, suspend: false },
+      wrapper: ({ children }) => <Suspense fallback={null}>{children}</Suspense>
+    }
+  )
+  view.result.current(editorInstance, monaco)
+  expect(store.getState().editorCursorLine).toEqual({ [oldId]: 1 })
+
+  view.rerender({ next: { ...params, fileId: 'uncommitted-owner' }, suspend: true })
+  expect(suspendedRender).toHaveBeenCalled()
+  emitCursor?.({ position: { lineNumber: 7, column: 1 } })
+  expect(store.getState().editorCursorLine).toEqual({ [oldId]: 7 })
+
+  const result = store.getState().reparentRestoredEditorFileOwner({
+    fileId: oldId,
+    targetWorktreeId: 'wt-1',
+    targetRelativePath: 'file.ts',
+    targetExecutionHostId: 'local',
+    targetRuntimeEnvironmentId: null,
+    targetOperationProvenance: captureEditorFileOperationProvenance(
+      store.getState(),
+      'wt-1',
+      null,
+      true
+    )
+  })
+  expect(result.ok).toBe(true)
+  if (!result.ok) {
+    throw new Error(`Owner migration failed: ${result.reason}`)
+  }
+  expect(store.getState().openFiles[0].filePath).toBe(filePath)
+  view.rerender({
+    next: { ...params, fileId: result.fileId, worktreeId: 'wt-1' },
+    suspend: false
+  })
+  emitCursor?.({ position: { lineNumber: 42, column: 1 } })
+
+  expect(store.getState().editorCursorLine).toEqual({ [result.fileId]: 42 })
+  disposeEditor?.()
+  expect(cursorDispose).toHaveBeenCalledOnce()
+  params.unregisterFileSearchSelectionRef.current?.()
+  view.unmount()
+  store.getState().closeFile(result.fileId)
+  expect(store.getState().editorCursorLine).toEqual({})
+})
diff --git a/src/renderer/src/components/editor/use-monaco-editor-mount.ts b/src/renderer/src/components/editor/use-monaco-editor-mount.ts
index 6860d2a7091e..da97dc6ec32a 100644
--- a/src/renderer/src/components/editor/use-monaco-editor-mount.ts
+++ b/src/renderer/src/components/editor/use-monaco-editor-mount.ts
@@ -1,4 +1,4 @@
-import { useCallback } from 'react'
+import { useCallback, useLayoutEffect, useRef } from 'react'
 import type { OnMount } from '@monaco-editor/react'
 import { useAppStore } from '@/store'
 import { registerFileSearchSelectedTextProvider } from '@/lib/file-search-selection'
@@ -61,6 +61,11 @@ export function useMonacoEditorMount(params: MonacoEditorMountParams): OnMount {
     },
     gutterMenu: { setGutterMenuOpen, setGutterMenuPoint, setGutterMenuLine }
   } = params
+  // Why: retained listeners must follow committed ownership, never an abandoned render.
+  const fileIdRef = useRef(fileId)
+  useLayoutEffect(() => {
+    fileIdRef.current = fileId
+  }, [fileId])
 
   return useCallback<OnMount>(
     (editorInstance, monaco) => {
@@ -145,7 +150,7 @@ export function useMonacoEditorMount(params: MonacoEditorMountParams): OnMount {
 
       const { cursorPositionSub, scrollStateSub } = installMonacoViewStateTracking({
         editorInstance,
-        filePath,
+        fileIdRef,
         viewStateKey,
         scrollThrottleTimerRef,
         setEditorCursorLine
diff --git a/src/renderer/src/components/editor/useEditorPanelContentState.test.tsx b/src/renderer/src/components/editor/useEditorPanelContentState.test.tsx
index 14b704650873..6df420f6abca 100644
--- a/src/renderer/src/components/editor/useEditorPanelContentState.test.tsx
+++ b/src/renderer/src/components/editor/useEditorPanelContentState.test.tsx
@@ -41,6 +41,8 @@ vi.mock('@/lib/connection-context', () => ({
   isWorktreeConnectionResolved: mocks.isWorktreeConnectionResolved
 }))
 
+vi.mock('@/lib/worktree-host-connection-phase', () => import('./local-host-test-fixture'))
+
 vi.mock('@/lib/runtime-workspace-file-route', () => ({
   findWorkspaceFileRoute: vi.fn(() => null)
 }))
diff --git a/src/renderer/src/components/editor/useEditorPanelFileContentLoader.ts b/src/renderer/src/components/editor/useEditorPanelFileContentLoader.ts
index 005887aca11e..e7fdfc88754e 100644
--- a/src/renderer/src/components/editor/useEditorPanelFileContentLoader.ts
+++ b/src/renderer/src/components/editor/useEditorPanelFileContentLoader.ts
@@ -6,6 +6,7 @@ import { getDiskBaselineSignature } from './diff-content-signature'
 import { getRuntimeFileReadScope, readRuntimeFileContent } from '@/runtime/runtime-file-client'
 import { RuntimeRpcCallError, settingsForRuntimeOwner } from '@/runtime/runtime-rpc-client'
 import { findWorkspaceFileRoute } from '@/lib/runtime-workspace-file-route'
+import { selectWorktreeHostConnectionPhase } from '@/lib/worktree-host-connection-phase'
 import {
   LOCAL_EXECUTION_HOST_ID,
   toRuntimeExecutionHostId,
@@ -81,6 +82,7 @@ export function useEditorPanelFileContentLoader({
       fileReadGenerationCounterRef.current = generation
       fileReadGenerationRef.current[id] = generation
       outstandingFileReadsRef.current[id] = generation
+      let readConnectionId: string | undefined
       try {
         const resolvedConnectionId = getConnectionIdForFile(worktreeId ?? null, filePath)
         const connectionId = resolvedConnectionId ?? undefined
@@ -94,7 +96,7 @@ export function useEditorPanelFileContentLoader({
         // worktree's SSH owner must never be inferred for them (a stamp still routes).
         const isLiveTailLogTab =
           restoredOpenFile?.readOnly === true && restoredOpenFile.liveTail === true
-        let readConnectionId = connectionId
+        readConnectionId = connectionId
         let readWorktreeId = worktreeId
         let readRelativePath = restoredOpenFile?.relativePath ?? relativePath
         if (
@@ -204,10 +206,25 @@ export function useEditorPanelFileContentLoader({
         if (fileReadGenerationRef.current[id] !== generation) {
           return
         }
-        const message = err instanceof Error ? err.message : String(err)
+        const hostConnection = selectWorktreeHostConnectionPhase(
+          useAppStore.getState(),
+          worktreeId ?? null
+        )
+        // Why: a read through an SSH host that is still connecting failed on the connection,
+        // not the file; the retry gate waits for it rather than showing "connection dropped".
+        const hostConnecting =
+          hostConnection.phase === 'connecting' &&
+          readConnectionId !== undefined &&
+          readConnectionId === hostConnection.targetId
+        const message = hostConnecting
+          ? WORKTREE_OWNER_NOT_READY_ERROR
+          : err instanceof Error
+            ? err.message
+            : String(err)
         // Why: a host may put prose on the message and the machine token on `.code`;
         // classifiers downstream must see the token, not only its rendering (#21041).
-        const loadErrorCode = err instanceof RuntimeRpcCallError ? err.code : undefined
+        const loadErrorCode =
+          !hostConnecting && err instanceof RuntimeRpcCallError ? err.code : undefined
         setFileContents((prev) => ({
           ...prev,
           [id]: {
diff --git a/src/renderer/src/components/editor/useEditorPanelFileLoadRetry.host-connection.test.tsx b/src/renderer/src/components/editor/useEditorPanelFileLoadRetry.host-connection.test.tsx
new file mode 100644
index 000000000000..ad6b4cb012a0
--- /dev/null
+++ b/src/renderer/src/components/editor/useEditorPanelFileLoadRetry.host-connection.test.tsx
@@ -0,0 +1,257 @@
+// @vitest-environment happy-dom
+
+import { act, type Dispatch, type SetStateAction } from 'react'
+import { createRoot, type Root } from 'react-dom/client'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { OpenFile } from '@/store/slices/editor'
+import type { WorktreeHostConnection } from '@/lib/worktree-host-connection-phase'
+import type { SshConnectionStatus } from '../../../../shared/ssh-types'
+import {
+  WORKTREE_OWNER_NOT_READY_ERROR,
+  WORKTREE_OWNER_UNREACHABLE_ERROR,
+  type FileContent
+} from './editor-panel-content-types'
+
+const mocks = vi.hoisted(() => {
+  const hostConnection: WorktreeHostConnection = {
+    phase: 'connecting',
+    targetId: 'ssh-a',
+    environmentId: null,
+    publishedStatus: 'connecting',
+    connectedEpoch: null
+  }
+  return { hostConnection, readRuntimeFileContent: vi.fn() }
+})
+
+vi.mock('@/lib/worktree-host-connection-phase', () => ({
+  selectWorktreeHostConnectionPhase: () => mocks.hostConnection,
+  useWorktreeHostConnection: () => mocks.hostConnection
+}))
+vi.mock('@/lib/connection-context', () => ({
+  getConnectionIdForFile: () => 'ssh-a',
+  isWorktreeConnectionResolved: () => true
+}))
+vi.mock('@/runtime/runtime-file-client', () => ({
+  getRuntimeFileReadScope: (_settings: unknown, connectionId: string | undefined) =>
+    connectionId ?? 'local',
+  readRuntimeFileContent: mocks.readRuntimeFileContent
+}))
+
+import {
+  OWNER_NOT_READY_RETRY_DELAY_MS,
+  useEditorPanelFileLoadRetry
+} from './useEditorPanelFileLoadRetry'
+import {
+  useEditorPanelFileContentLoader,
+  type EditorPanelFileContentLoader
+} from './useEditorPanelFileContentLoader'
+
+const SSH_PROVIDER_UNAVAILABLE =
+  'Remote connection dropped. Click Reconnect on the SSH target before retrying.'
+
+const STATUS_BY_PHASE: Record<WorktreeHostConnection['phase'], SshConnectionStatus | null> = {
+  local: null,
+  connecting: 'connecting',
+  connected: 'connected',
+  unavailable: 'disconnected',
+  unverifiable: null
+}
+
+function setHost(
+  phase: WorktreeHostConnection['phase'],
+  connectionGeneration: number | null = null
+): void {
+  mocks.hostConnection = {
+    phase,
+    targetId: 'ssh-a',
+    environmentId: null,
+    publishedStatus: STATUS_BY_PHASE[phase],
+    connectedEpoch: phase === 'connected' ? `ssh-a:${connectionGeneration}` : null
+  }
+}
+
+const file: OpenFile = {
+  id: 'tab-1',
+  filePath: '/home/user/project/src/index.ts',
+  relativePath: 'src/index.ts',
+  worktreeId: 'repo-ssh::/home/user/project',
+  language: 'typescript',
+  isDirty: false,
+  mode: 'edit'
+}
+const OPEN_FILES_REF = { current: [file] }
+
+function RetryHarness({
+  fileContents,
+  attemptsRef,
+  loadFileContent,
+  setFileContents
+}: {
+  fileContents: Record<string, FileContent>
+  attemptsRef: { current: Record<string, number> }
+  loadFileContent: () => Promise<void>
+  setFileContents: Dispatch<SetStateAction<Record<string, FileContent>>>
+}): null {
+  useEditorPanelFileLoadRetry({
+    activeFile: file,
+    fileContents,
+    fileLoadRetryAttemptsRef: attemptsRef,
+    loadFileContent,
+    openFilesRef: OPEN_FILES_REF,
+    setFileContents
+  })
+  return null
+}
+
+describe('editor file loads while the SSH host connects', () => {
+  let container: HTMLDivElement
+  let root: Root
+
+  beforeEach(() => {
+    vi.useFakeTimers()
+    mocks.readRuntimeFileContent.mockReset()
+    container = document.createElement('div')
+    document.body.appendChild(container)
+    root = createRoot(container)
+  })
+
+  afterEach(() => {
+    act(() => root.unmount())
+    container.remove()
+    vi.useRealTimers()
+  })
+
+  it('shows the connecting copy, not "connection dropped", for a read that failed mid-connect', async () => {
+    setHost('connecting')
+    mocks.readRuntimeFileContent.mockRejectedValue(new Error(SSH_PROVIDER_UNAVAILABLE))
+    let fileContents: Record<string, FileContent> = {}
+    let load: EditorPanelFileContentLoader | null = null
+    function LoaderHarness(): null {
+      load = useEditorPanelFileContentLoader({
+        fileLoadRetryAttemptsRef: { current: {} },
+        fileReadGenerationCounterRef: { current: 0 },
+        fileReadGenerationRef: { current: {} },
+        openFilesRef: OPEN_FILES_REF,
+        outstandingFileReadsRef: { current: {} },
+        setFileContents: (updater) => {
+          fileContents = typeof updater === 'function' ? updater(fileContents) : updater
+        }
+      })
+      return null
+    }
+    act(() => root.render(<LoaderHarness />))
+    await act(async () => load?.(file.filePath, file.id, file.worktreeId, file.relativePath))
+    expect(fileContents[file.id]?.loadError).toBe(WORKTREE_OWNER_NOT_READY_ERROR)
+
+    setHost('unavailable')
+    await act(async () => load?.(file.filePath, file.id, file.worktreeId, file.relativePath))
+    expect(fileContents[file.id]?.loadError).toBe(SSH_PROVIDER_UNAVAILABLE)
+  })
+
+  it('spends no retry budget while connecting, then reloads exactly once when the host connects', () => {
+    setHost('connecting')
+    const attemptsRef: { current: Record<string, number> } = { current: {} }
+    let fileContents: Record<string, FileContent> = {
+      [file.id]: { content: '', isBinary: false, loadError: WORKTREE_OWNER_NOT_READY_ERROR }
+    }
+    const setFileContents: Dispatch<SetStateAction<Record<string, FileContent>>> = (updater) => {
+      fileContents = typeof updater === 'function' ? updater(fileContents) : updater
+    }
+    const loadFileContent = vi.fn(async () => undefined)
+    const render = (): void =>
+      act(() =>
+        root.render(
+          <RetryHarness
+            fileContents={fileContents}
+            attemptsRef={attemptsRef}
+            loadFileContent={loadFileContent}
+            setFileContents={setFileContents}
+          />
+        )
+      )
+
+    render()
+    act(() => vi.advanceTimersByTime(OWNER_NOT_READY_RETRY_DELAY_MS * 10))
+    expect(loadFileContent).not.toHaveBeenCalled()
+    expect(attemptsRef.current[file.id]).toBeUndefined()
+
+    setHost('connected', 1)
+    render()
+    expect(loadFileContent).toHaveBeenCalledOnce()
+    expect(attemptsRef.current[file.id]).toBe(0)
+    expect(fileContents[file.id]).toBeUndefined()
+
+    render()
+    act(() => vi.advanceTimersByTime(OWNER_NOT_READY_RETRY_DELAY_MS * 10))
+    expect(loadFileContent).toHaveBeenCalledOnce()
+  })
+
+  it('re-arms an exhausted budget when the host reconnects under a new generation', () => {
+    setHost('connected', 1)
+    const attemptsRef: { current: Record<string, number> } = { current: { [file.id]: 3 } }
+    let fileContents: Record<string, FileContent> = {
+      [file.id]: { content: '', isBinary: false, loadError: WORKTREE_OWNER_UNREACHABLE_ERROR }
+    }
+    const setFileContents: Dispatch<SetStateAction<Record<string, FileContent>>> = (updater) => {
+      fileContents = typeof updater === 'function' ? updater(fileContents) : updater
+    }
+    const loadFileContent = vi.fn(async () => undefined)
+    const render = (): void =>
+      act(() =>
+        root.render(
+          <RetryHarness
+            fileContents={fileContents}
+            attemptsRef={attemptsRef}
+            loadFileContent={loadFileContent}
+            setFileContents={setFileContents}
+          />
+        )
+      )
+
+    render()
+    expect(loadFileContent).not.toHaveBeenCalled()
+
+    setHost('connected', 2)
+    render()
+    expect(loadFileContent).toHaveBeenCalledOnce()
+    expect(attemptsRef.current[file.id]).toBe(0)
+  })
+
+  it('keeps retrying for a host it cannot verify, then reloads once it connects', () => {
+    setHost('unverifiable')
+    const attemptsRef: { current: Record<string, number> } = { current: {} }
+    let fileContents: Record<string, FileContent> = {
+      [file.id]: { content: '', isBinary: false, loadError: WORKTREE_OWNER_NOT_READY_ERROR }
+    }
+    const setFileContents: Dispatch<SetStateAction<Record<string, FileContent>>> = (updater) => {
+      fileContents = typeof updater === 'function' ? updater(fileContents) : updater
+    }
+    const loadFileContent = vi.fn(async () => {
+      fileContents = {
+        [file.id]: { content: '', isBinary: false, loadError: WORKTREE_OWNER_NOT_READY_ERROR }
+      }
+    })
+    const render = (): void =>
+      act(() =>
+        root.render(
+          <RetryHarness
+            fileContents={fileContents}
+            attemptsRef={attemptsRef}
+            loadFileContent={loadFileContent}
+            setFileContents={setFileContents}
+          />
+        )
+      )
+
+    // Unverifiable is not "connecting": the ordinary owner-not-ready poll keeps running.
+    render()
+    act(() => vi.advanceTimersByTime(OWNER_NOT_READY_RETRY_DELAY_MS))
+    expect(loadFileContent).toHaveBeenCalledOnce()
+    expect(attemptsRef.current[file.id]).toBe(1)
+
+    setHost('connected', 1)
+    render()
+    expect(loadFileContent).toHaveBeenCalledTimes(2)
+    expect(attemptsRef.current[file.id]).toBe(0)
+  })
+})
diff --git a/src/renderer/src/components/editor/useEditorPanelFileLoadRetry.ts b/src/renderer/src/components/editor/useEditorPanelFileLoadRetry.ts
index 571ccf548c05..4f3057e7b1ad 100644
--- a/src/renderer/src/components/editor/useEditorPanelFileLoadRetry.ts
+++ b/src/renderer/src/components/editor/useEditorPanelFileLoadRetry.ts
@@ -1,5 +1,6 @@
-import { useEffect, type Dispatch, type MutableRefObject, type SetStateAction } from 'react'
+import { useEffect, useRef, type Dispatch, type MutableRefObject, type SetStateAction } from 'react'
 import type { OpenFile } from '@/store/slices/editor'
+import { useWorktreeHostConnection } from '@/lib/worktree-host-connection-phase'
 import { hasRuntimeRpcErrorCode } from '../../../../shared/runtime-rpc-error-code'
 import {
   WORKTREE_HOST_SELECTOR_NOT_FOUND_CODE,
@@ -79,13 +80,61 @@ export function useEditorPanelFileLoadRetry({
   const activeFileLoadErrorCode = activeFileLoadRetryId
     ? fileContents[activeFileLoadRetryId]?.loadErrorCode
     : undefined
+  const hostConnection = useWorktreeHostConnection(activeFile?.worktreeId ?? null)
+  const hostTargetId = hostConnection.targetId
+  const hostConnecting = hostConnection.phase === 'connecting'
+  const connectedHostEpoch = hostConnection.connectedEpoch
+  const seenHostRef = useRef({ targetId: hostTargetId, connectedEpoch: connectedHostEpoch })
 
   useEffect(() => {
+    // Why the same target: switching to a file on another host is not that host connecting.
+    const hostJustConnected =
+      connectedHostEpoch !== null &&
+      seenHostRef.current.targetId === hostTargetId &&
+      seenHostRef.current.connectedEpoch !== connectedHostEpoch
+    seenHostRef.current = { targetId: hostTargetId, connectedEpoch: connectedHostEpoch }
+    if (!activeFileLoadRetryId || !activeFileLoadError) {
+      return
+    }
+    const reload = (nextRetryCount: number): void => {
+      const currentFile = openFilesRef.current.find((file) => file.id === activeFileLoadRetryId)
+      if (
+        !currentFile ||
+        (currentFile.mode !== 'edit' && currentFile.mode !== 'markdown-preview')
+      ) {
+        return
+      }
+      fileLoadRetryAttemptsRef.current[activeFileLoadRetryId] = nextRetryCount
+      setFileContents((prev) => {
+        if (prev[currentFile.id]?.loadError !== activeFileLoadError) {
+          return prev
+        }
+        const next = { ...prev }
+        delete next[currentFile.id]
+        return next
+      })
+      void loadFileContent(
+        currentFile.filePath,
+        currentFile.id,
+        currentFile.worktreeId,
+        currentFile.relativePath
+      )
+    }
+    // Why: the connected transition below re-arms the read, so waiting spends no budget.
+    if (hostConnecting) {
+      return
+    }
+    // Why: a host that just connected (or reconnected) can serve a read a lost connection
+    // failed — including one whose budget already ran out — so reload once on a fresh budget.
     if (
-      !activeFileLoadRetryId ||
-      !activeFileLoadError ||
-      !shouldRetryFileLoadError(activeFileLoadError, activeFileLoadErrorCode)
+      hostJustConnected &&
+      (activeFileLoadError === WORKTREE_OWNER_UNREACHABLE_ERROR ||
+        shouldRetryFileLoadError(activeFileLoadError, activeFileLoadErrorCode))
     ) {
+      reload(0)
+      return
+    }
+    if (!shouldRetryFileLoadError(activeFileLoadError, activeFileLoadErrorCode)) {
       return
     }
     const ownerNotReady = isOwnerNotReadyError(activeFileLoadError)
@@ -127,35 +176,15 @@ export function useEditorPanelFileLoadRetry({
     const delayMs = ownerNotReady
       ? OWNER_NOT_READY_RETRY_DELAY_MS
       : (FILE_LOAD_RETRY_DELAYS_MS[retryCount] ?? FILE_LOAD_RETRY_DELAYS_MS[0])
-    const timeoutId = window.setTimeout(() => {
-      const currentFile = openFilesRef.current.find((file) => file.id === activeFileLoadRetryId)
-      if (
-        !currentFile ||
-        (currentFile.mode !== 'edit' && currentFile.mode !== 'markdown-preview')
-      ) {
-        return
-      }
-      fileLoadRetryAttemptsRef.current[activeFileLoadRetryId] = retryCount + 1
-      setFileContents((prev) => {
-        if (prev[currentFile.id]?.loadError !== activeFileLoadError) {
-          return prev
-        }
-        const next = { ...prev }
-        delete next[currentFile.id]
-        return next
-      })
-      void loadFileContent(
-        currentFile.filePath,
-        currentFile.id,
-        currentFile.worktreeId,
-        currentFile.relativePath
-      )
-    }, delayMs)
+    const timeoutId = window.setTimeout(() => reload(retryCount + 1), delayMs)
     return () => window.clearTimeout(timeoutId)
   }, [
     activeFileLoadRetryId,
     activeFileLoadError,
     activeFileLoadErrorCode,
+    connectedHostEpoch,
+    hostConnecting,
+    hostTargetId,
     fileLoadRetryAttemptsRef,
     loadFileContent,
     openFilesRef,
diff --git a/src/renderer/src/components/editor/useEditorPanelHostUnresolvedContentState.test.tsx b/src/renderer/src/components/editor/useEditorPanelHostUnresolvedContentState.test.tsx
index ddd9938c42e8..c6ff09f8c97a 100644
--- a/src/renderer/src/components/editor/useEditorPanelHostUnresolvedContentState.test.tsx
+++ b/src/renderer/src/components/editor/useEditorPanelHostUnresolvedContentState.test.tsx
@@ -33,6 +33,8 @@ vi.mock('@/lib/connection-context', () => ({
   isWorktreeConnectionResolved: vi.fn(() => true)
 }))
 
+vi.mock('@/lib/worktree-host-connection-phase', () => import('./local-host-test-fixture'))
+
 vi.mock('@/lib/runtime-workspace-file-route', () => ({
   findWorkspaceFileRoute: vi.fn(() => null)
 }))
diff --git a/src/renderer/src/components/editor/useEditorPanelRemoteSiblingContentState.test.tsx b/src/renderer/src/components/editor/useEditorPanelRemoteSiblingContentState.test.tsx
index 6666302d0a9d..08fcc4df79a3 100644
--- a/src/renderer/src/components/editor/useEditorPanelRemoteSiblingContentState.test.tsx
+++ b/src/renderer/src/components/editor/useEditorPanelRemoteSiblingContentState.test.tsx
@@ -37,6 +37,8 @@ vi.mock('@/lib/connection-context', () => ({
   isWorktreeConnectionResolved: vi.fn(() => true)
 }))
 
+vi.mock('@/lib/worktree-host-connection-phase', () => import('./local-host-test-fixture'))
+
 vi.mock('@/lib/runtime-workspace-file-route', () => ({
   findWorkspaceFileRoute: mocks.findWorkspaceFileRoute
 }))
diff --git a/src/renderer/src/components/editor/useEditorPanelVisibilityContentState.test.tsx b/src/renderer/src/components/editor/useEditorPanelVisibilityContentState.test.tsx
index 317fa6257793..818f50107beb 100644
--- a/src/renderer/src/components/editor/useEditorPanelVisibilityContentState.test.tsx
+++ b/src/renderer/src/components/editor/useEditorPanelVisibilityContentState.test.tsx
@@ -32,6 +32,8 @@ vi.mock('@/lib/connection-context', () => ({
   isWorktreeConnectionResolved: vi.fn(() => true)
 }))
 
+vi.mock('@/lib/worktree-host-connection-phase', () => import('./local-host-test-fixture'))
+
 vi.mock('@/lib/runtime-workspace-file-route', () => ({
   findWorkspaceFileRoute: vi.fn(() => null)
 }))
diff --git a/src/renderer/src/components/emulator-pane/use-emulator-video-stream.ts b/src/renderer/src/components/emulator-pane/use-emulator-video-stream.ts
index 35857aa2b7d3..1dc9f18593d5 100644
--- a/src/renderer/src/components/emulator-pane/use-emulator-video-stream.ts
+++ b/src/renderer/src/components/emulator-pane/use-emulator-video-stream.ts
@@ -1,4 +1,5 @@
 import { useEffect, useRef, useState } from 'react'
+import { createBrowserUuid } from '@/lib/browser-uuid'
 
 // Decodes the Android H.264 stream (scrcpy access units forwarded over the
 // emulator:videoStream* IPC) with WebCodecs and paints it to a <canvas>. The
@@ -32,7 +33,7 @@ const H264_CODEC = 'avc1.640028'
 type StreamSize = { width: number; height: number }
 
 function newVideoStreamId(): string {
-  return globalThis.crypto?.randomUUID?.() ?? `${Date.now()}-${Math.random()}`
+  return createBrowserUuid()
 }
 
 export function useEmulatorVideoStream(
diff --git a/src/renderer/src/components/feature-tips/CliSetupTipDialog.tsx b/src/renderer/src/components/feature-tips/CliSetupTipDialog.tsx
new file mode 100644
index 000000000000..62404ff0ee0f
--- /dev/null
+++ b/src/renderer/src/components/feature-tips/CliSetupTipDialog.tsx
@@ -0,0 +1,152 @@
+import type { JSX } from 'react'
+import type { FeatureTip } from '../../../../shared/feature-tips'
+import { Button } from '@/components/ui/button'
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle
+} from '@/components/ui/dialog'
+import { translate } from '@/i18n/i18n'
+import { CliFeatureTipVisual } from './CliFeatureTipVisual'
+import { CliSkillSetupTerminal } from './CliSkillSetupTerminal'
+import { FeatureTipActions } from './FeatureTipActions'
+
+function WorktreePromptTerm({ children }: { children: string }): JSX.Element {
+  return (
+    <span className="rounded-sm bg-foreground/10 px-1 py-0.5 font-medium text-foreground">
+      {children}
+    </span>
+  )
+}
+
+export function CliSetupTipDialog({
+  open,
+  tip,
+  primaryBusy,
+  skillTerminalOpen,
+  onOpenChange,
+  onPrimaryAction,
+  onSkip
+}: {
+  open: boolean
+  tip: FeatureTip
+  primaryBusy: boolean
+  skillTerminalOpen: boolean
+  onOpenChange: (open: boolean) => void
+  onPrimaryAction: () => void
+  onSkip: () => void
+}): JSX.Element {
+  return (
+    <Dialog open={open} onOpenChange={onOpenChange}>
+      {/* Why: the CLI tip sits over terminal surfaces, so it needs a local token-mixed surface. */}
+      <DialogContent
+        className="!flex max-h-[calc(100vh-2rem)] flex-col gap-0 overflow-hidden bg-[color-mix(in_srgb,var(--foreground)_8%,var(--background))] p-0 dark:bg-[color-mix(in_srgb,var(--foreground)_16%,var(--background))] sm:max-w-4xl md:!h-[min(31rem,calc(100vh-2rem))] md:!flex-row"
+        showCloseButton={!skillTerminalOpen}
+      >
+        <div
+          className={`scrollbar-sleek flex min-h-0 min-w-0 flex-1 flex-col justify-between overflow-y-auto px-8 py-9 transition-[flex-basis] duration-500 ease-[cubic-bezier(0.22,1,0.36,1)] motion-reduce:transition-none md:shrink-0 ${
+            skillTerminalOpen ? 'basis-auto md:basis-full' : 'basis-auto md:basis-[47.5%]'
+          }`}
+        >
+          <DialogHeader className={`${skillTerminalOpen ? 'gap-2' : 'gap-4'} text-left`}>
+            <div>
+              <DialogTitle
+                className={`text-3xl font-semibold leading-tight tracking-tight ${
+                  skillTerminalOpen ? 'max-w-2xl' : 'max-w-[22rem]'
+                }`}
+              >
+                {tip.title}
+              </DialogTitle>
+              <DialogDescription className="mt-3 max-w-2xl text-sm leading-relaxed">
+                {tip.description}
+              </DialogDescription>
+              <div
+                aria-hidden={skillTerminalOpen}
+                className={`max-w-sm space-y-2 overflow-hidden rounded-md border text-sm leading-relaxed text-muted-foreground transition-[max-height,opacity,transform,margin,padding,border-color] duration-300 ease-out motion-reduce:transition-none ${
+                  skillTerminalOpen
+                    ? 'pointer-events-none mt-0 max-h-0 -translate-y-2 border-transparent p-0 opacity-0'
+                    : 'mt-3 max-h-64 translate-y-0 border-border/70 bg-muted/35 p-3 opacity-100'
+                }`}
+              >
+                <p className="font-medium text-foreground">
+                  {translate(
+                    'auto.components.feature.tips.FeatureTipsModal.4795ac2d4a',
+                    'Try asking:'
+                  )}
+                </p>
+                <p>
+                  {translate(
+                    'auto.components.feature.tips.FeatureTipsModal.55846c7f95',
+                    '“Split this PR into two'
+                  )}
+                  <WorktreePromptTerm>
+                    {translate(
+                      'auto.components.feature.tips.FeatureTipsModal.27c567a89c',
+                      'worktrees'
+                    )}
+                  </WorktreePromptTerm>{' '}
+                  {translate(
+                    'auto.components.feature.tips.FeatureTipsModal.7fc6f02099',
+                    'and create PRs for each.”'
+                  )}
+                </p>
+                <p>
+                  {translate(
+                    'auto.components.feature.tips.FeatureTipsModal.864e2db28f',
+                    '“When the agent in'
+                  )}
+                  <WorktreePromptTerm>
+                    {translate(
+                      'auto.components.feature.tips.FeatureTipsModal.298301b7a0',
+                      'worktree'
+                    )}
+                  </WorktreePromptTerm>{' '}
+                  {translate(
+                    'auto.components.feature.tips.FeatureTipsModal.3c6c478462',
+                    'X finishes, send it the review task.”'
+                  )}
+                </p>
+              </div>
+            </div>
+            {skillTerminalOpen ? <CliSkillSetupTerminal /> : null}
+          </DialogHeader>
+
+          <DialogFooter className="mt-8 flex sm:justify-stretch">
+            {skillTerminalOpen ? (
+              <Button className="w-full" onClick={onSkip}>
+                {translate('auto.components.feature.tips.FeatureTipsModal.c169298e4d', 'Done')}
+              </Button>
+            ) : (
+              <FeatureTipActions
+                currentTip={tip}
+                primaryBusy={primaryBusy}
+                onPrimaryAction={onPrimaryAction}
+                onSkip={onSkip}
+                showSkip={false}
+                fullWidth
+              />
+            )}
+          </DialogFooter>
+        </div>
+        <div
+          className={`min-h-0 min-w-0 shrink-0 overflow-hidden transition-[flex-basis,max-height] duration-500 ease-[cubic-bezier(0.22,1,0.36,1)] motion-reduce:transition-none ${
+            skillTerminalOpen
+              ? 'pointer-events-none max-h-0 basis-0 md:max-h-none md:basis-0'
+              : 'max-h-[40rem] basis-auto md:basis-[52.5%]'
+          }`}
+        >
+          <div
+            className={`h-full transition-[transform,opacity] duration-500 ease-[cubic-bezier(0.22,1,0.36,1)] motion-reduce:transition-none md:w-[29.4rem] ${
+              skillTerminalOpen ? 'translate-x-full opacity-0' : 'translate-x-0 opacity-100'
+            }`}
+          >
+            {skillTerminalOpen ? null : <CliFeatureTipVisual />}
+          </div>
+        </div>
+      </DialogContent>
+    </Dialog>
+  )
+}
diff --git a/src/renderer/src/components/feature-tips/CmdJPaletteTipDialog.tsx b/src/renderer/src/components/feature-tips/CmdJPaletteTipDialog.tsx
index 427bb947ff0e..e7ee26b8594f 100644
--- a/src/renderer/src/components/feature-tips/CmdJPaletteTipDialog.tsx
+++ b/src/renderer/src/components/feature-tips/CmdJPaletteTipDialog.tsx
@@ -1,17 +1,14 @@
 import type { JSX } from 'react'
 import type { FeatureTip } from '../../../../shared/feature-tips'
-import { Badge } from '@/components/ui/badge'
-import {
-  Dialog,
-  DialogContent,
-  DialogDescription,
-  DialogFooter,
-  DialogHeader,
-  DialogTitle
-} from '@/components/ui/dialog'
+import { DialogDescription, DialogFooter, DialogHeader, DialogTitle } from '@/components/ui/dialog'
 import { formatShortcutLabel, useShortcutLabel } from '@/hooks/useShortcutLabel'
 import { CmdJPaletteFeatureTipVisual } from './CmdJPaletteFeatureTipVisual'
 import { FeatureTipActions } from './FeatureTipActions'
+import {
+  FeatureTipDialogFrame,
+  FeatureTipEyebrow,
+  FeatureTipSettingsLine
+} from './FeatureTipDialogFrame'
 import { translate } from '@/i18n/i18n'
 
 export function CmdJPaletteTipDialog({
@@ -49,80 +46,61 @@ export function CmdJPaletteTipDialog({
   // CLI tip for a consistent "feature education" presentation; keeps the palette demo
   // prominent on the right.
   return (
-    <Dialog open={open} onOpenChange={onOpenChange}>
-      <DialogContent
-        className="!flex max-h-[calc(100vh-2rem)] flex-col gap-0 overflow-hidden bg-[color-mix(in_srgb,var(--foreground)_8%,var(--background))] p-0 dark:bg-[color-mix(in_srgb,var(--foreground)_16%,var(--background))] sm:max-w-4xl md:!h-[min(27rem,calc(100vh-2rem))] md:!flex-row"
-        showCloseButton
-        // Why: Radix auto-focuses the first focusable child; without this the
-        // inline rebind link in the description gets the focus ring on open.
-        onOpenAutoFocus={(event) => event.preventDefault()}
-      >
-        <div className="scrollbar-sleek flex min-h-0 min-w-0 flex-1 flex-col justify-between overflow-y-auto px-8 py-9 md:shrink-0 md:basis-1/2">
-          <DialogHeader className="gap-4 text-left">
-            <div>
-              {/* Why: uppercase eyebrow reads as a category label, not a feature launch. */}
-              <Badge
-                variant="outline"
-                className="mb-3 rounded-md px-2 py-0.5 text-[10px] font-semibold uppercase tracking-[0.12em] text-muted-foreground"
-              >
-                {tip.eyebrow.toUpperCase()}
-              </Badge>
-              {/* Why: flow the shortcut chip as inline text (not a flex item) so the
-                  short Mac label (⌘⇧J) stays on one line, while a wide label like
-                  "Ctrl+Shift+J" wraps to the next line only when it doesn't fit —
-                  instead of being pushed to the right edge on Win/Linux. */}
-              <DialogTitle className="text-2xl font-semibold leading-tight tracking-tight md:text-[1.75rem]">
-                {titlePrefix.trimEnd()}
-                {displayShortcutLabel ? (
-                  <>
-                    {' '}
-                    <kbd className="ml-0.5 inline-flex items-center whitespace-nowrap rounded-md border border-border bg-card px-2 py-0.5 align-middle font-mono text-base font-medium text-foreground">
-                      {displayShortcutLabel}
-                    </kbd>
-                  </>
-                ) : null}
-                {titleSuffix ? ` ${titleSuffix}` : null}
-              </DialogTitle>
-              <DialogDescription className="mt-3 max-w-2xl space-y-3 text-sm leading-relaxed">
-                <span className="block">{tip.description}</span>
-                <span className="block text-muted-foreground">
-                  {translate(
-                    'auto.components.feature.tips.CmdJPaletteTipDialog.8241897205',
-                    'Rebind the shortcut anytime in'
-                  )}{' '}
-                  <button
-                    type="button"
-                    onClick={onRebindClick}
-                    className="inline appearance-none border-0 bg-transparent p-0 font-medium text-foreground underline decoration-foreground/30 underline-offset-2 transition-colors hover:decoration-foreground focus-visible:outline-none focus-visible:decoration-foreground"
-                  >
-                    {translate(
-                      'auto.components.feature.tips.CmdJPaletteTipDialog.c0bb9f869b',
-                      'Settings → Shortcuts'
-                    )}
-                  </button>
-                  .
-                </span>
-              </DialogDescription>
-            </div>
-          </DialogHeader>
-
-          <DialogFooter className="mt-8 flex sm:justify-stretch">
-            <FeatureTipActions
-              currentTip={tip}
-              primaryBusy={primaryBusy}
-              onPrimaryAction={onPrimaryAction}
-              onSkip={onSkip}
-              showSkip={false}
-              fullWidth
+    <FeatureTipDialogFrame
+      open={open}
+      onOpenChange={onOpenChange}
+      // Why: Radix auto-focuses the first focusable child; without this the
+      // inline rebind link in the description gets the focus ring on open.
+      onOpenAutoFocus={(event) => event.preventDefault()}
+      visual={<CmdJPaletteFeatureTipVisual />}
+    >
+      <DialogHeader className="gap-4 text-left">
+        <div>
+          {/* Why: uppercase eyebrow reads as a category label, not a feature launch. */}
+          <FeatureTipEyebrow label={tip.eyebrow} />
+          {/* Why: flow the shortcut chip as inline text (not a flex item) so the
+                short Mac label (⌘⇧J) stays on one line, while a wide label like
+                "Ctrl+Shift+J" wraps to the next line only when it doesn't fit —
+                instead of being pushed to the right edge on Win/Linux. */}
+          <DialogTitle className="text-2xl font-semibold leading-tight tracking-tight md:text-[1.75rem]">
+            {titlePrefix.trimEnd()}
+            {displayShortcutLabel ? (
+              <>
+                {' '}
+                <kbd className="ml-0.5 inline-flex items-center whitespace-nowrap rounded-md border border-border bg-card px-2 py-0.5 align-middle font-mono text-base font-medium text-foreground">
+                  {displayShortcutLabel}
+                </kbd>
+              </>
+            ) : null}
+            {titleSuffix ? ` ${titleSuffix}` : null}
+          </DialogTitle>
+          <DialogDescription className="mt-3 max-w-2xl space-y-3 text-sm leading-relaxed">
+            <span className="block">{tip.description}</span>
+            <FeatureTipSettingsLine
+              lead={translate(
+                'auto.components.feature.tips.CmdJPaletteTipDialog.8241897205',
+                'Rebind the shortcut anytime in'
+              )}
+              link={translate(
+                'auto.components.feature.tips.CmdJPaletteTipDialog.c0bb9f869b',
+                'Settings → Shortcuts'
+              )}
+              onClick={onRebindClick}
             />
-          </DialogFooter>
+          </DialogDescription>
         </div>
-        <div className="flex min-h-0 min-w-0 shrink-0 self-stretch overflow-hidden bg-muted/60 md:basis-1/2 md:border-l md:border-border/70">
-          <div className="h-full min-h-[23rem] w-full md:w-[29.4rem]">
-            <CmdJPaletteFeatureTipVisual />
-          </div>
-        </div>
-      </DialogContent>
-    </Dialog>
+      </DialogHeader>
+
+      <DialogFooter className="mt-8 flex sm:justify-stretch">
+        <FeatureTipActions
+          currentTip={tip}
+          primaryBusy={primaryBusy}
+          onPrimaryAction={onPrimaryAction}
+          onSkip={onSkip}
+          showSkip={false}
+          fullWidth
+        />
+      </DialogFooter>
+    </FeatureTipDialogFrame>
   )
 }
diff --git a/src/renderer/src/components/feature-tips/FeatureTipActions.tsx b/src/renderer/src/components/feature-tips/FeatureTipActions.tsx
index f12f2613405d..358e6a17e9cf 100644
--- a/src/renderer/src/components/feature-tips/FeatureTipActions.tsx
+++ b/src/renderer/src/components/feature-tips/FeatureTipActions.tsx
@@ -8,6 +8,9 @@ function getPrimaryBusyLabel(action: FeatureTipAction): string {
   if (action === 'setup-cli') {
     return 'Installing...'
   }
+  if (action === 'enable-session-search') {
+    return 'Turning on...'
+  }
   return 'Working...'
 }
 
@@ -18,7 +21,8 @@ export function FeatureTipActions({
   onSkip,
   showSkip = true,
   fullWidth = false,
-  primaryButtonRef
+  primaryButtonRef,
+  label = currentTip.ctaLabel
 }: {
   currentTip: FeatureTip
   primaryBusy: boolean
@@ -27,6 +31,8 @@ export function FeatureTipActions({
   showSkip?: boolean
   fullWidth?: boolean
   primaryButtonRef?: Ref<HTMLButtonElement>
+  /** Overrides the tip's CTA for tips whose button changes with their state. */
+  label?: string
 }): JSX.Element {
   return (
     <>
@@ -47,7 +53,7 @@ export function FeatureTipActions({
             {getPrimaryBusyLabel(currentTip.action)}
           </>
         ) : (
-          currentTip.ctaLabel
+          label
         )}
       </Button>
     </>
diff --git a/src/renderer/src/components/feature-tips/FeatureTipDialogFrame.tsx b/src/renderer/src/components/feature-tips/FeatureTipDialogFrame.tsx
new file mode 100644
index 000000000000..6891cca9e612
--- /dev/null
+++ b/src/renderer/src/components/feature-tips/FeatureTipDialogFrame.tsx
@@ -0,0 +1,71 @@
+import type { ComponentProps, JSX, ReactNode } from 'react'
+import { Badge } from '@/components/ui/badge'
+import { Dialog, DialogContent } from '@/components/ui/dialog'
+
+/** Shared two-column tip layout: copy and actions on the left, a feature visual on the right. */
+export function FeatureTipDialogFrame({
+  open,
+  onOpenChange,
+  onOpenAutoFocus,
+  visual,
+  children
+}: {
+  open: boolean
+  onOpenChange: (open: boolean) => void
+  onOpenAutoFocus: ComponentProps<typeof DialogContent>['onOpenAutoFocus']
+  visual: ReactNode
+  children: ReactNode
+}): JSX.Element {
+  return (
+    <Dialog open={open} onOpenChange={onOpenChange}>
+      <DialogContent
+        className="!flex max-h-[calc(100vh-2rem)] flex-col gap-0 overflow-hidden bg-[color-mix(in_srgb,var(--foreground)_8%,var(--background))] p-0 dark:bg-[color-mix(in_srgb,var(--foreground)_16%,var(--background))] sm:max-w-4xl md:!h-[min(27rem,calc(100vh-2rem))] md:!flex-row"
+        showCloseButton
+        onOpenAutoFocus={onOpenAutoFocus}
+      >
+        <div className="scrollbar-sleek flex min-h-0 min-w-0 flex-1 flex-col justify-between overflow-y-auto px-8 py-9 md:shrink-0 md:basis-1/2">
+          {children}
+        </div>
+        <div className="flex min-h-0 min-w-0 shrink-0 self-stretch overflow-hidden bg-muted/60 md:basis-1/2 md:border-l md:border-border/70">
+          <div className="h-full min-h-[23rem] w-full md:w-[29.4rem]">{visual}</div>
+        </div>
+      </DialogContent>
+    </Dialog>
+  )
+}
+
+export function FeatureTipEyebrow({ label }: { label: string }): JSX.Element {
+  return (
+    <Badge
+      variant="outline"
+      className="mb-3 rounded-md px-2 py-0.5 text-[10px] font-semibold uppercase tracking-[0.12em] text-muted-foreground"
+    >
+      {label.toUpperCase()}
+    </Badge>
+  )
+}
+
+/** A muted "Change it anytime in Settings → X." line whose link leaves the tip for Settings. */
+export function FeatureTipSettingsLine({
+  lead,
+  link,
+  onClick
+}: {
+  lead: string
+  link: string
+  onClick: () => void
+}): JSX.Element {
+  return (
+    <span className="block text-muted-foreground">
+      {lead}{' '}
+      <button
+        type="button"
+        onClick={onClick}
+        className="inline appearance-none border-0 bg-transparent p-0 font-medium text-foreground underline decoration-foreground/30 underline-offset-2 transition-colors hover:decoration-foreground focus-visible:outline-none focus-visible:decoration-foreground"
+      >
+        {link}
+      </button>
+      .
+    </span>
+  )
+}
diff --git a/src/renderer/src/components/feature-tips/FeatureTipsModal.tsx b/src/renderer/src/components/feature-tips/FeatureTipsModal.tsx
index 336f2afeee82..631c121cc154 100644
--- a/src/renderer/src/components/feature-tips/FeatureTipsModal.tsx
+++ b/src/renderer/src/components/feature-tips/FeatureTipsModal.tsx
@@ -6,20 +6,9 @@ import {
   ORCHESTRATION_SETUP_DISMISSED_STORAGE_KEY,
   notifyOrchestrationSetupStateChanged
 } from '@/lib/orchestration-setup-state'
-import {
-  Dialog,
-  DialogContent,
-  DialogDescription,
-  DialogFooter,
-  DialogHeader,
-  DialogTitle
-} from '@/components/ui/dialog'
-import { Button } from '@/components/ui/button'
 import { useAppStore } from '@/store'
-import { CliFeatureTipVisual } from './CliFeatureTipVisual'
+import { CliSetupTipDialog } from './CliSetupTipDialog'
 import { CmdJPaletteTipDialog } from './CmdJPaletteTipDialog'
-import { CliSkillSetupTerminal } from './CliSkillSetupTerminal'
-import { FeatureTipActions } from './FeatureTipActions'
 import { installCliFromFeatureTip } from './feature-tip-cli-install-action'
 import { getFeatureTipForModal } from './feature-tip-modal-state'
 import {
@@ -29,17 +18,12 @@ import {
   trackOrcaCliFeatureTipSetupResult
 } from './feature-tip-telemetry'
 import { useMountedRef } from '@/hooks/useMountedRef'
+import { isWebClientLocation } from '@/lib/web-client-location'
 import { translate } from '@/i18n/i18n'
+import { SessionSearchTipDialog } from './SessionSearchTipDialog'
+import { useSessionSearchTipSetup } from './use-session-search-tip-setup'
 import { VoiceDictationTipDialog } from './VoiceDictationTipDialog'
 
-function WorktreePromptTerm({ children }: { children: string }): JSX.Element {
-  return (
-    <span className="rounded-sm bg-foreground/10 px-1 py-0.5 font-medium text-foreground">
-      {children}
-    </span>
-  )
-}
-
 export default function FeatureTipsModal(): JSX.Element | null {
   const activeModal = useAppStore((s) => s.activeModal)
   const closeModal = useAppStore((s) => s.closeModal)
@@ -51,6 +35,7 @@ export default function FeatureTipsModal(): JSX.Element | null {
   const featureInteractions = useAppStore((s) => s.featureInteractions)
   const markFeatureTipsSeen = useAppStore((s) => s.markFeatureTipsSeen)
   const modalData = useAppStore((s) => s.modalData)
+  const showAiVaultSearch = useAppStore((s) => s.showAiVaultSearch)
   const mountedRef = useMountedRef()
   const activeModalRef = useRef(activeModal)
   const setupRequestIdRef = useRef(0)
@@ -62,7 +47,11 @@ export default function FeatureTipsModal(): JSX.Element | null {
     modalData,
     seenTipIds,
     featureInteractions,
-    settings
+    settings,
+    webClient: isWebClientLocation()
+  })
+  const sessionSearchSetup = useSessionSearchTipSetup({
+    dialogOpen: isOpen && currentTip?.id === 'agent-session-search'
   })
 
   useEffect(() => {
@@ -115,6 +104,13 @@ export default function FeatureTipsModal(): JSX.Element | null {
     openSettingsPage()
   }
 
+  const openSessionSearchSettings = (): void => {
+    markCurrentTipSeen()
+    closeModal()
+    openSettingsTarget({ pane: 'session-history', repoId: null })
+    openSettingsPage()
+  }
+
   const enableOrchestrationSkillSetup = (): void => {
     localStorage.setItem(ORCHESTRATION_ENABLED_STORAGE_KEY, '1')
     localStorage.removeItem(ORCHESTRATION_SETUP_DISMISSED_STORAGE_KEY)
@@ -150,6 +146,20 @@ export default function FeatureTipsModal(): JSX.Element | null {
         openSettingsPage()
         break
       }
+      case 'enable-session-search': {
+        if (sessionSearchSetup.stage === 'offer') {
+          // Why: stay open through the first index so search is never offered half-built.
+          setPrimaryBusy(true)
+          await sessionSearchSetup.enable()
+          setPrimaryBusy(false)
+          break
+        }
+        closeModal()
+        if (sessionSearchSetup.stage === 'ready') {
+          showAiVaultSearch()
+        }
+        break
+      }
       case 'setup-cli': {
         const setupRequestId = setupRequestIdRef.current + 1
         setupRequestIdRef.current = setupRequestId
@@ -240,114 +250,15 @@ export default function FeatureTipsModal(): JSX.Element | null {
 
   if (currentTip.action === 'setup-cli') {
     return (
-      <Dialog open={isOpen} onOpenChange={handleOpenChange}>
-        {/* Why: the CLI tip sits over terminal surfaces, so it needs a local token-mixed surface. */}
-        <DialogContent
-          className="!flex max-h-[calc(100vh-2rem)] flex-col gap-0 overflow-hidden bg-[color-mix(in_srgb,var(--foreground)_8%,var(--background))] p-0 dark:bg-[color-mix(in_srgb,var(--foreground)_16%,var(--background))] sm:max-w-4xl md:!h-[min(31rem,calc(100vh-2rem))] md:!flex-row"
-          showCloseButton={!skillTerminalOpen}
-        >
-          <div
-            className={`scrollbar-sleek flex min-h-0 min-w-0 flex-1 flex-col justify-between overflow-y-auto px-8 py-9 transition-[flex-basis] duration-500 ease-[cubic-bezier(0.22,1,0.36,1)] motion-reduce:transition-none md:shrink-0 ${
-              skillTerminalOpen ? 'basis-auto md:basis-full' : 'basis-auto md:basis-[47.5%]'
-            }`}
-          >
-            <DialogHeader className={`${skillTerminalOpen ? 'gap-2' : 'gap-4'} text-left`}>
-              <div>
-                <DialogTitle
-                  className={`text-3xl font-semibold leading-tight tracking-tight ${
-                    skillTerminalOpen ? 'max-w-2xl' : 'max-w-[22rem]'
-                  }`}
-                >
-                  {currentTip.title}
-                </DialogTitle>
-                <DialogDescription className="mt-3 max-w-2xl text-sm leading-relaxed">
-                  {currentTip.description}
-                </DialogDescription>
-                <div
-                  aria-hidden={skillTerminalOpen}
-                  className={`max-w-sm space-y-2 overflow-hidden rounded-md border text-sm leading-relaxed text-muted-foreground transition-[max-height,opacity,transform,margin,padding,border-color] duration-300 ease-out motion-reduce:transition-none ${
-                    skillTerminalOpen
-                      ? 'pointer-events-none mt-0 max-h-0 -translate-y-2 border-transparent p-0 opacity-0'
-                      : 'mt-3 max-h-64 translate-y-0 border-border/70 bg-muted/35 p-3 opacity-100'
-                  }`}
-                >
-                  <p className="font-medium text-foreground">
-                    {translate(
-                      'auto.components.feature.tips.FeatureTipsModal.4795ac2d4a',
-                      'Try asking:'
-                    )}
-                  </p>
-                  <p>
-                    {translate(
-                      'auto.components.feature.tips.FeatureTipsModal.55846c7f95',
-                      '“Split this PR into two'
-                    )}
-                    <WorktreePromptTerm>
-                      {translate(
-                        'auto.components.feature.tips.FeatureTipsModal.27c567a89c',
-                        'worktrees'
-                      )}
-                    </WorktreePromptTerm>{' '}
-                    {translate(
-                      'auto.components.feature.tips.FeatureTipsModal.7fc6f02099',
-                      'and create PRs for each.”'
-                    )}
-                  </p>
-                  <p>
-                    {translate(
-                      'auto.components.feature.tips.FeatureTipsModal.864e2db28f',
-                      '“When the agent in'
-                    )}
-                    <WorktreePromptTerm>
-                      {translate(
-                        'auto.components.feature.tips.FeatureTipsModal.298301b7a0',
-                        'worktree'
-                      )}
-                    </WorktreePromptTerm>{' '}
-                    {translate(
-                      'auto.components.feature.tips.FeatureTipsModal.3c6c478462',
-                      'X finishes, send it the review task.”'
-                    )}
-                  </p>
-                </div>
-              </div>
-              {skillTerminalOpen ? <CliSkillSetupTerminal /> : null}
-            </DialogHeader>
-
-            <DialogFooter className="mt-8 flex sm:justify-stretch">
-              {skillTerminalOpen ? (
-                <Button className="w-full" onClick={handleSkip}>
-                  {translate('auto.components.feature.tips.FeatureTipsModal.c169298e4d', 'Done')}
-                </Button>
-              ) : (
-                <FeatureTipActions
-                  currentTip={currentTip}
-                  primaryBusy={primaryBusy}
-                  onPrimaryAction={() => void handlePrimaryAction()}
-                  onSkip={handleSkip}
-                  showSkip={false}
-                  fullWidth
-                />
-              )}
-            </DialogFooter>
-          </div>
-          <div
-            className={`min-h-0 min-w-0 shrink-0 overflow-hidden transition-[flex-basis,max-height] duration-500 ease-[cubic-bezier(0.22,1,0.36,1)] motion-reduce:transition-none ${
-              skillTerminalOpen
-                ? 'pointer-events-none max-h-0 basis-0 md:max-h-none md:basis-0'
-                : 'max-h-[40rem] basis-auto md:basis-[52.5%]'
-            }`}
-          >
-            <div
-              className={`h-full transition-[transform,opacity] duration-500 ease-[cubic-bezier(0.22,1,0.36,1)] motion-reduce:transition-none md:w-[29.4rem] ${
-                skillTerminalOpen ? 'translate-x-full opacity-0' : 'translate-x-0 opacity-100'
-              }`}
-            >
-              {skillTerminalOpen ? null : <CliFeatureTipVisual />}
-            </div>
-          </div>
-        </DialogContent>
-      </Dialog>
+      <CliSetupTipDialog
+        open={isOpen}
+        tip={currentTip}
+        primaryBusy={primaryBusy}
+        skillTerminalOpen={skillTerminalOpen}
+        onOpenChange={handleOpenChange}
+        onPrimaryAction={() => void handlePrimaryAction()}
+        onSkip={handleSkip}
+      />
     )
   }
 
@@ -365,6 +276,21 @@ export default function FeatureTipsModal(): JSX.Element | null {
     )
   }
 
+  if (currentTip.action === 'enable-session-search') {
+    return (
+      <SessionSearchTipDialog
+        open={isOpen}
+        tip={currentTip}
+        primaryBusy={primaryBusy}
+        onOpenChange={handleOpenChange}
+        onPrimaryAction={() => void handlePrimaryAction()}
+        onSettingsClick={openSessionSearchSettings}
+        stage={sessionSearchSetup.stage}
+        status={sessionSearchSetup.status}
+      />
+    )
+  }
+
   if (currentTip.action !== 'enable-voice') {
     currentTip.action satisfies never
     return null
diff --git a/src/renderer/src/components/feature-tips/SessionSearchFeatureTipVisual.tsx b/src/renderer/src/components/feature-tips/SessionSearchFeatureTipVisual.tsx
new file mode 100644
index 000000000000..78f3dc393abc
--- /dev/null
+++ b/src/renderer/src/components/feature-tips/SessionSearchFeatureTipVisual.tsx
@@ -0,0 +1,236 @@
+import { useEffect, useState, type JSX, type ReactNode } from 'react'
+import { Files, GitBranch, ListChecks, PanelRight } from 'lucide-react'
+import { AI_VAULT_AGENT_LABELS, AI_VAULT_AGENTS } from '../../../../shared/ai-vault-types'
+import {
+  getLocalExecutionHostLabel,
+  LOCAL_EXECUTION_HOST_ID
+} from '../../../../shared/execution-host'
+import { usePrefersReducedMotion } from '@/components/feature-wall/feature-wall-modal-helpers'
+import { AgentSessionHistoryIcon } from '@/components/right-sidebar/agent-session-history-icon'
+import { AiVaultPanelHeader } from '@/components/right-sidebar/AiVaultPanelHeader'
+import { highlightedSearchSnippet } from '@/components/right-sidebar/AiVaultSearchEvidence'
+import { DEFAULT_AI_VAULT_SESSION_LIMIT } from '@/components/right-sidebar/ai-vault-session-limit'
+import {
+  DEFAULT_AI_VAULT_GROUP,
+  DEFAULT_AI_VAULT_HIDE_EMPTY_SESSIONS
+} from '@/components/right-sidebar/ai-vault-view-defaults'
+import { AgentIcon } from '@/lib/agent-catalog'
+import { translate } from '@/i18n/i18n'
+import {
+  getSessionSearchDemoRecentRows,
+  getSessionSearchDemoScenes,
+  type SessionSearchDemoRow
+} from './session-search-feature-tip-demo'
+
+type DemoPhase = 'idle' | 'typing' | 'searching' | 'results' | 'focused' | 'erasing'
+type DemoState = { scene: number; phase: DemoPhase; chars: number }
+
+// Per-step delay; typing and erasing advance one character per step.
+const PHASE_MS: Record<DemoPhase, number> = {
+  idle: 1100,
+  typing: 65,
+  searching: 550,
+  results: 1300,
+  focused: 2200,
+  erasing: 24
+}
+const ROW_STAGGER_MS = 90
+
+function noop(): void {}
+
+// The real panel header, inert, with everything but the query held still.
+const DEMO_HEADER_PROPS = {
+  hasScanResult: true,
+  activeWorktreePath: '/demo',
+  activeProjectKey: 'demo',
+  scope: 'all',
+  executionHostScope: LOCAL_EXECUTION_HOST_ID,
+  hostScopeOptions: [{ id: LOCAL_EXECUTION_HOST_ID, label: getLocalExecutionHostLabel() }],
+  agents: AI_VAULT_AGENTS,
+  group: DEFAULT_AI_VAULT_GROUP,
+  hideEmptySessions: DEFAULT_AI_VAULT_HIDE_EMPTY_SESSIONS,
+  sessionLimit: DEFAULT_AI_VAULT_SESSION_LIMIT,
+  adjustmentCount: 0,
+  onQueryChange: noop,
+  onScopeChange: noop,
+  onExecutionHostScopeChange: noop,
+  onAgentEnabledChange: noop,
+  onAllAgentsEnabledChange: noop,
+  onGroupChange: noop,
+  onHideEmptySessionsChange: noop,
+  onSessionLimitChange: noop,
+  onReset: noop,
+  onRefresh: noop
+} as const
+
+function nextDemoState(state: DemoState, queryLength: number, sceneCount: number): DemoState {
+  switch (state.phase) {
+    case 'idle':
+      return { ...state, phase: 'typing', chars: 0 }
+    case 'typing':
+      return state.chars < queryLength
+        ? { ...state, chars: state.chars + 1 }
+        : { ...state, phase: 'searching' }
+    case 'searching':
+      return { ...state, phase: 'results' }
+    case 'results':
+      return { ...state, phase: 'focused' }
+    case 'focused':
+      return { ...state, phase: 'erasing' }
+    case 'erasing':
+      return state.chars > 0
+        ? { ...state, chars: state.chars - 1 }
+        : { scene: (state.scene + 1) % sceneCount, phase: 'idle', chars: 0 }
+  }
+}
+
+function DemoActivityTab({
+  active = false,
+  children
+}: {
+  active?: boolean
+  children: ReactNode
+}): JSX.Element {
+  return (
+    <span
+      data-active={active}
+      className="flex size-7 items-center justify-center rounded-md text-muted-foreground data-[active=true]:bg-sidebar-accent data-[active=true]:text-foreground"
+    >
+      {children}
+    </span>
+  )
+}
+
+// Mirrors the right sidebar's tab row so the tip shows where the panel lives.
+function DemoActivityStrip(): JSX.Element {
+  return (
+    <div className="flex h-10 items-center gap-1 border-b border-sidebar-border px-2">
+      <DemoActivityTab>
+        <Files className="size-4" />
+      </DemoActivityTab>
+      <DemoActivityTab active>
+        <AgentSessionHistoryIcon size={16} />
+      </DemoActivityTab>
+      <DemoActivityTab>
+        <GitBranch className="size-4" />
+      </DemoActivityTab>
+      <DemoActivityTab>
+        <ListChecks className="size-4" />
+      </DemoActivityTab>
+      <span className="flex-1" />
+      <DemoActivityTab>
+        <PanelRight className="size-4" />
+      </DemoActivityTab>
+    </div>
+  )
+}
+
+function DemoSessionRow({
+  row,
+  isHit,
+  focused,
+  index
+}: {
+  row: SessionSearchDemoRow
+  isHit: boolean
+  focused: boolean
+  index: number
+}): JSX.Element {
+  return (
+    <div
+      data-focused={focused}
+      className="flex flex-col border-b border-sidebar-border px-3 py-2 transition-colors duration-300 animate-in fade-in-0 slide-in-from-bottom-1 [animation-fill-mode:both] data-[focused=true]:bg-sidebar-accent/55 motion-reduce:animate-none"
+      style={{ animationDelay: `${index * ROW_STAGGER_MS}ms` }}
+    >
+      <div className="line-clamp-1 text-[13px] font-medium leading-5 text-foreground">
+        {row.title}
+      </div>
+      <div className="mt-0.5 line-clamp-2 text-[12px] leading-4 text-muted-foreground">
+        <span className="font-medium text-foreground/80">{row.role}</span>
+        <span>: {isHit ? highlightedSearchSnippet(row.text) : row.text}</span>
+      </div>
+      <div className="mt-1 flex min-w-0 items-center gap-1.5 text-[11px] leading-4 text-muted-foreground">
+        <AgentIcon agent={row.agent} size={14} />
+        <span className="truncate">{AI_VAULT_AGENT_LABELS[row.agent]}</span>
+        <span className="shrink-0 tabular-nums">
+          {translate(
+            'auto.components.right.sidebar.AiVaultSessionRow.messageCount',
+            '{{value0}} msgs',
+            { value0: row.messages }
+          )}
+        </span>
+        <span className="shrink-0 text-muted-foreground/55">·</span>
+        <span className="shrink-0">{row.age}</span>
+      </div>
+    </div>
+  )
+}
+
+export function SessionSearchFeatureTipVisual(): JSX.Element {
+  const reducedMotion = usePrefersReducedMotion()
+  const scenes = getSessionSearchDemoScenes()
+  const recentRows = getSessionSearchDemoRecentRows()
+  const [state, setState] = useState<DemoState>({ scene: 0, phase: 'idle', chars: 0 })
+  // Why: reduced motion freezes on the first answered search instead of looping.
+  const shown: DemoState = reducedMotion
+    ? { scene: 0, phase: 'results', chars: scenes[0].query.length }
+    : state
+  const scene = scenes[shown.scene]
+  const queryLength = scene.query.length
+
+  useEffect(() => {
+    if (reducedMotion) {
+      return
+    }
+    const timeoutId = window.setTimeout(
+      () => setState((current) => nextDemoState(current, queryLength, scenes.length)),
+      // Why: a beat after the last keystroke before the search starts.
+      state.phase === 'typing' && state.chars === queryLength
+        ? PHASE_MS.typing * 2
+        : PHASE_MS[state.phase]
+    )
+    return () => window.clearTimeout(timeoutId)
+  }, [queryLength, reducedMotion, scenes.length, state])
+
+  const showingHits =
+    shown.phase === 'results' || shown.phase === 'focused' || shown.phase === 'erasing'
+  const rows = showingHits ? scene.hits : recentRows
+  const dimmed =
+    shown.phase === 'typing' || shown.phase === 'searching' || shown.phase === 'erasing'
+
+  return (
+    <div
+      className="relative flex h-full min-h-[23rem] flex-col items-center justify-center overflow-hidden px-6 py-7"
+      aria-hidden="true"
+    >
+      {/* Why: the real panel header is interactive; inert keeps its controls out of the tab order. */}
+      <div
+        inert
+        className="@container/ai-vault relative flex h-[22rem] w-full max-w-[22rem] flex-col overflow-hidden rounded-xl border border-border/80 bg-sidebar text-left shadow-xs"
+      >
+        <DemoActivityStrip />
+        <AiVaultPanelHeader
+          {...DEMO_HEADER_PROPS}
+          query={scene.query.slice(0, shown.chars)}
+          searching={shown.chars > 0}
+          loading={shown.phase === 'searching'}
+        />
+        <div
+          data-dimmed={dimmed}
+          className="min-h-0 flex-1 overflow-hidden transition-opacity duration-200 data-[dimmed=true]:opacity-45"
+        >
+          {rows.map((row, index) => (
+            <DemoSessionRow
+              key={row.title}
+              row={row}
+              isHit={showingHits}
+              focused={shown.phase === 'focused' && index === 0}
+              index={index}
+            />
+          ))}
+        </div>
+        <div className="pointer-events-none absolute inset-x-0 bottom-0 h-10 bg-gradient-to-t from-sidebar to-transparent" />
+      </div>
+    </div>
+  )
+}
diff --git a/src/renderer/src/components/feature-tips/SessionSearchTipDialog.test.tsx b/src/renderer/src/components/feature-tips/SessionSearchTipDialog.test.tsx
new file mode 100644
index 000000000000..7877c4fe4516
--- /dev/null
+++ b/src/renderer/src/components/feature-tips/SessionSearchTipDialog.test.tsx
@@ -0,0 +1,91 @@
+import type { ReactNode } from 'react'
+import { renderToStaticMarkup } from 'react-dom/server'
+import { describe, expect, it, vi } from 'vitest'
+import { unavailableSessionSearchStatus } from '../../../../shared/ai-vault-search-client'
+import type { AiVaultSearchStatus } from '../../../../shared/ai-vault-search-types'
+import { FEATURE_TIPS, type FeatureTip } from '../../../../shared/feature-tips'
+import { SessionSearchTipDialog } from './SessionSearchTipDialog'
+import type { SessionSearchTipStage } from './use-session-search-tip-setup'
+
+vi.mock('./SessionSearchFeatureTipVisual', () => ({
+  SessionSearchFeatureTipVisual: () => <div data-testid="session-search-visual" />
+}))
+
+vi.mock('@/components/ui/dialog', () => ({
+  Dialog: ({ children }: { children: ReactNode }) => <div>{children}</div>,
+  DialogContent: ({ children }: { children: ReactNode }) => <div>{children}</div>,
+  DialogDescription: ({ children }: { children: ReactNode }) => <div>{children}</div>,
+  DialogFooter: ({ children }: { children: ReactNode }) => <footer>{children}</footer>,
+  DialogHeader: ({ children }: { children: ReactNode }) => <header>{children}</header>,
+  DialogTitle: ({ children }: { children: ReactNode }) => <h1>{children}</h1>
+}))
+
+function getTip(): FeatureTip {
+  const tip = FEATURE_TIPS.find((entry) => entry.id === 'agent-session-search')
+  if (!tip) {
+    throw new Error('Expected agent-session-search feature tip fixture')
+  }
+  return tip
+}
+
+function render(stage: SessionSearchTipStage, status: AiVaultSearchStatus | null): string {
+  return renderToStaticMarkup(
+    <SessionSearchTipDialog
+      open
+      tip={getTip()}
+      primaryBusy={false}
+      onOpenChange={() => {}}
+      onPrimaryAction={() => {}}
+      onSettingsClick={() => {}}
+      stage={stage}
+      status={status}
+    />
+  )
+}
+
+describe('SessionSearchTipDialog', () => {
+  it('offers to turn search on and links to its settings', () => {
+    const html = render('offer', null)
+    expect(html).toContain('Search every agent session')
+    expect(html).toContain('Turn on session search')
+    expect(html).toContain('Settings → Agent Session Search')
+    expect(html).toContain('session-search-visual')
+  })
+
+  it('shows live progress and lets indexing continue in the background', () => {
+    const html = render('indexing', {
+      ...unavailableSessionSearchStatus(),
+      enabled: true,
+      phase: 'indexing',
+      filesIndexed: 120,
+      filesDue: 380,
+      messagesIndexed: 5000
+    })
+    expect(html).toContain('Indexing your agent sessions')
+    expect(html).toContain('Settings → Agent Session Search')
+    expect(html).toContain('120 of 500 sessions')
+    expect(html).toContain('Continue in background')
+    expect(html).not.toMatch(/<button[^>]*\sdisabled=""/)
+    expect(html).toContain('session-search-visual')
+  })
+
+  it('does not call a not-yet-started indexer unavailable', () => {
+    const html = render('indexing', { ...unavailableSessionSearchStatus(), enabled: true })
+    expect(html).toContain('Finding your sessions')
+    expect(html).not.toContain('not available')
+  })
+
+  it('offers to start searching once the index is ready', () => {
+    const html = render('ready', {
+      ...unavailableSessionSearchStatus(),
+      enabled: true,
+      phase: 'current',
+      filesIndexed: 500,
+      lastSweepCompletedAt: 1
+    })
+    expect(html).toContain('Session search is ready')
+    expect(html).toContain('Start searching')
+    expect(html).toContain('Settings → Agent Session Search')
+    expect(html).not.toMatch(/<button[^>]*\sdisabled=""/)
+  })
+})
diff --git a/src/renderer/src/components/feature-tips/SessionSearchTipDialog.tsx b/src/renderer/src/components/feature-tips/SessionSearchTipDialog.tsx
new file mode 100644
index 000000000000..af42dec8eae2
--- /dev/null
+++ b/src/renderer/src/components/feature-tips/SessionSearchTipDialog.tsx
@@ -0,0 +1,161 @@
+import { useRef, type JSX } from 'react'
+import type { AiVaultSearchStatus } from '../../../../shared/ai-vault-search-types'
+import type { FeatureTip } from '../../../../shared/feature-tips'
+import {
+  sessionSearchStatusDetails,
+  sessionSearchStatusMessage
+} from '@/components/settings/session-history-status-copy'
+import { DialogDescription, DialogFooter, DialogHeader, DialogTitle } from '@/components/ui/dialog'
+import { translate } from '@/i18n/i18n'
+import { FeatureTipActions } from './FeatureTipActions'
+import {
+  FeatureTipDialogFrame,
+  FeatureTipEyebrow,
+  FeatureTipSettingsLine
+} from './FeatureTipDialogFrame'
+import { SessionSearchFeatureTipVisual } from './SessionSearchFeatureTipVisual'
+import type { SessionSearchTipStage } from './use-session-search-tip-setup'
+
+function stageCopy(
+  tip: FeatureTip,
+  stage: SessionSearchTipStage
+): { title: string; description: string; cta: string } {
+  switch (stage) {
+    case 'offer':
+      return { title: tip.title, description: tip.description, cta: tip.ctaLabel }
+    case 'indexing':
+      return {
+        title: translate('featureTips.sessionSearch.indexingTitle', 'Indexing your agent sessions'),
+        description: translate(
+          'featureTips.sessionSearch.indexingDescription',
+          'Orca is reading your past agent transcripts so you can search them. This can take a few minutes.'
+        ),
+        cta: translate('featureTips.sessionSearch.continueInBackground', 'Continue in background')
+      }
+    case 'ready':
+      return {
+        title: translate('featureTips.sessionSearch.readyTitle', 'Session search is ready'),
+        description: translate(
+          'featureTips.sessionSearch.readyDescription',
+          'Every agent session on this computer can now be found by what was said in it.'
+        ),
+        cta: translate('featureTips.sessionSearch.startSearching', 'Start searching')
+      }
+  }
+}
+
+function progressMessage(status: AiVaultSearchStatus | null): string {
+  // Why: right after turning on, the indexer may not have started; the shared copy would call that unavailable.
+  if (!status?.enabled || status.phase === 'idle' || status.phase === 'closed') {
+    return translate('featureTips.sessionSearch.progressStarting', 'Finding your sessions…')
+  }
+  return sessionSearchStatusMessage(status)
+}
+
+function IndexProgress({
+  indexing,
+  status
+}: {
+  indexing: boolean
+  status: AiVaultSearchStatus | null
+}): JSX.Element {
+  return (
+    <span className="block space-y-2" role="status" aria-live="polite">
+      {indexing ? (
+        // Why: the total grows as the pass discovers files, so this is indeterminate, never a percentage.
+        <span className="block h-1 overflow-hidden rounded-full bg-secondary">
+          <span className="block h-full w-2/5 animate-[skill-update-slide_1.35s_ease-in-out_infinite] rounded-full bg-primary motion-reduce:w-full motion-reduce:animate-none motion-reduce:opacity-40" />
+        </span>
+      ) : null}
+      <span className="block text-xs font-medium tabular-nums text-foreground">
+        {progressMessage(status)}
+      </span>
+      {sessionSearchStatusDetails(status).map((line) => (
+        <span key={line} className="block text-xs text-muted-foreground">
+          {line}
+        </span>
+      ))}
+    </span>
+  )
+}
+
+export function SessionSearchTipDialog({
+  open,
+  tip,
+  primaryBusy,
+  onOpenChange,
+  onPrimaryAction,
+  onSettingsClick,
+  stage,
+  status
+}: {
+  open: boolean
+  tip: FeatureTip
+  primaryBusy: boolean
+  onOpenChange: (open: boolean) => void
+  onPrimaryAction: () => void
+  onSettingsClick: () => void
+  stage: SessionSearchTipStage
+  status: AiVaultSearchStatus | null
+}): JSX.Element {
+  const primaryButtonRef = useRef<HTMLButtonElement>(null)
+  const copy = stageCopy(tip, stage)
+
+  return (
+    <FeatureTipDialogFrame
+      open={open}
+      onOpenChange={onOpenChange}
+      onOpenAutoFocus={(event) => {
+        event.preventDefault()
+        primaryButtonRef.current?.focus()
+      }}
+      visual={<SessionSearchFeatureTipVisual />}
+    >
+      <DialogHeader className="gap-4 text-left">
+        <div>
+          <FeatureTipEyebrow label={tip.eyebrow} />
+          <DialogTitle className="text-2xl font-semibold leading-tight tracking-tight md:text-[1.75rem]">
+            {copy.title}
+          </DialogTitle>
+          <DialogDescription className="mt-3 max-w-2xl space-y-3 text-sm leading-relaxed">
+            <span className="block">{copy.description}</span>
+            {stage === 'offer' ? (
+              <span className="block">
+                {translate(
+                  'featureTips.sessionSearch.agentsInstruction',
+                  'Your agents can search it too. Ask one to “find the session where we fixed the login timeout.”'
+                )}
+              </span>
+            ) : (
+              <IndexProgress indexing={stage === 'indexing'} status={status} />
+            )}
+            <FeatureTipSettingsLine
+              lead={translate(
+                'featureTips.sessionSearch.consentInstruction',
+                'Change or turn it off anytime in'
+              )}
+              link={translate(
+                'featureTips.sessionSearch.settingsLink',
+                'Settings → Agent Session Search'
+              )}
+              onClick={onSettingsClick}
+            />
+          </DialogDescription>
+        </div>
+      </DialogHeader>
+
+      <DialogFooter className="mt-8 flex sm:justify-stretch">
+        <FeatureTipActions
+          currentTip={tip}
+          primaryBusy={primaryBusy}
+          onPrimaryAction={onPrimaryAction}
+          onSkip={() => onOpenChange(false)}
+          showSkip={false}
+          fullWidth
+          primaryButtonRef={primaryButtonRef}
+          label={copy.cta}
+        />
+      </DialogFooter>
+    </FeatureTipDialogFrame>
+  )
+}
diff --git a/src/renderer/src/components/feature-tips/VoiceDictationTipDialog.tsx b/src/renderer/src/components/feature-tips/VoiceDictationTipDialog.tsx
index 5cdb98445f47..f088cdf6b333 100644
--- a/src/renderer/src/components/feature-tips/VoiceDictationTipDialog.tsx
+++ b/src/renderer/src/components/feature-tips/VoiceDictationTipDialog.tsx
@@ -1,18 +1,15 @@
 import { useRef, type JSX } from 'react'
 import type { FeatureTip } from '../../../../shared/feature-tips'
 import { ShortcutKeyCombo } from '@/components/ShortcutKeyCombo'
-import { Badge } from '@/components/ui/badge'
-import {
-  Dialog,
-  DialogContent,
-  DialogDescription,
-  DialogFooter,
-  DialogHeader,
-  DialogTitle
-} from '@/components/ui/dialog'
+import { DialogDescription, DialogFooter, DialogHeader, DialogTitle } from '@/components/ui/dialog'
 import { useShortcutKeyDetails } from '@/hooks/useShortcutLabel'
 import { translate } from '@/i18n/i18n'
 import { FeatureTipActions } from './FeatureTipActions'
+import {
+  FeatureTipDialogFrame,
+  FeatureTipEyebrow,
+  FeatureTipSettingsLine
+} from './FeatureTipDialogFrame'
 import { VoiceDictationFeatureTipVisual } from './VoiceDictationFeatureTipVisual'
 
 export function VoiceDictationTipDialog({
@@ -36,97 +33,74 @@ export function VoiceDictationTipDialog({
   const primaryButtonRef = useRef<HTMLButtonElement>(null)
 
   return (
-    <Dialog open={open} onOpenChange={onOpenChange}>
-      <DialogContent
-        className="!flex max-h-[calc(100vh-2rem)] flex-col gap-0 overflow-hidden bg-[color-mix(in_srgb,var(--foreground)_8%,var(--background))] p-0 dark:bg-[color-mix(in_srgb,var(--foreground)_16%,var(--background))] sm:max-w-4xl md:!h-[min(27rem,calc(100vh-2rem))] md:!flex-row"
-        showCloseButton
-        onOpenAutoFocus={(event) => {
-          event.preventDefault()
-          primaryButtonRef.current?.focus()
-        }}
-      >
-        <div className="scrollbar-sleek flex min-h-0 min-w-0 flex-1 flex-col justify-between overflow-y-auto px-8 py-9 md:shrink-0 md:basis-1/2">
-          <DialogHeader className="gap-4 text-left">
-            <div>
-              <Badge
-                variant="outline"
-                className="mb-3 rounded-md px-2 py-0.5 text-[10px] font-semibold uppercase tracking-[0.12em] text-muted-foreground"
-              >
-                {tip.eyebrow.toUpperCase()}
-              </Badge>
-              <DialogTitle className="text-2xl font-semibold leading-tight tracking-tight md:text-[1.75rem]">
-                {tip.title}
-              </DialogTitle>
-              <DialogDescription className="mt-3 max-w-2xl space-y-3 text-sm leading-relaxed">
-                {shortcut.keys.length > 0 ? (
-                  <span className="block">
-                    {translate(
-                      'featureTips.voice.focusPaneInstruction',
-                      'Focus a terminal, editor, or agent prompt, then press'
-                    )}{' '}
-                    <ShortcutKeyCombo
-                      keys={shortcut.keys}
-                      doubleTap={shortcut.doubleTap}
-                      className="mx-1 align-middle"
-                      keyCapClassName="min-w-0 bg-card px-1.5 py-0 text-[11px] text-foreground shadow-none"
-                    />{' '}
-                    {translate(
-                      'featureTips.voice.startInstruction',
-                      'to start voice dictation. Press'
-                    )}{' '}
-                    <ShortcutKeyCombo
-                      keys={shortcut.keys}
-                      doubleTap={shortcut.doubleTap}
-                      className="mx-1 align-middle"
-                      keyCapClassName="min-w-0 bg-card px-1.5 py-0 text-[11px] text-foreground shadow-none"
-                    />{' '}
-                    {translate('featureTips.voice.stopInstruction', 'again to stop.')}
-                  </span>
-                ) : (
-                  <span className="block">
-                    {translate(
-                      'featureTips.voice.unassignedInstruction',
-                      'Assign a dictation shortcut before starting voice dictation in a focused pane.'
-                    )}
-                  </span>
+    <FeatureTipDialogFrame
+      open={open}
+      onOpenChange={onOpenChange}
+      onOpenAutoFocus={(event) => {
+        event.preventDefault()
+        primaryButtonRef.current?.focus()
+      }}
+      visual={<VoiceDictationFeatureTipVisual />}
+    >
+      <DialogHeader className="gap-4 text-left">
+        <div>
+          <FeatureTipEyebrow label={tip.eyebrow} />
+          <DialogTitle className="text-2xl font-semibold leading-tight tracking-tight md:text-[1.75rem]">
+            {tip.title}
+          </DialogTitle>
+          <DialogDescription className="mt-3 max-w-2xl space-y-3 text-sm leading-relaxed">
+            {shortcut.keys.length > 0 ? (
+              <span className="block">
+                {translate(
+                  'featureTips.voice.focusPaneInstruction',
+                  'Focus a terminal, editor, or agent prompt, then press'
+                )}{' '}
+                <ShortcutKeyCombo
+                  keys={shortcut.keys}
+                  doubleTap={shortcut.doubleTap}
+                  className="mx-1 align-middle"
+                  keyCapClassName="min-w-0 bg-card px-1.5 py-0 text-[11px] text-foreground shadow-none"
+                />{' '}
+                {translate('featureTips.voice.startInstruction', 'to start voice dictation. Press')}{' '}
+                <ShortcutKeyCombo
+                  keys={shortcut.keys}
+                  doubleTap={shortcut.doubleTap}
+                  className="mx-1 align-middle"
+                  keyCapClassName="min-w-0 bg-card px-1.5 py-0 text-[11px] text-foreground shadow-none"
+                />{' '}
+                {translate('featureTips.voice.stopInstruction', 'again to stop.')}
+              </span>
+            ) : (
+              <span className="block">
+                {translate(
+                  'featureTips.voice.unassignedInstruction',
+                  'Assign a dictation shortcut before starting voice dictation in a focused pane.'
                 )}
-                <span className="block text-muted-foreground">
-                  {translate(
-                    'featureTips.voice.settingsInstruction',
-                    'Change the model, dictation mode, or shortcut anytime in'
-                  )}{' '}
-                  <button
-                    type="button"
-                    onClick={onVoiceSettingsClick}
-                    className="inline appearance-none border-0 bg-transparent p-0 font-medium text-foreground underline decoration-foreground/30 underline-offset-2 transition-colors hover:decoration-foreground focus-visible:outline-none focus-visible:decoration-foreground"
-                  >
-                    {translate('featureTips.voice.settingsLink', 'Settings → Voice')}
-                  </button>
-                  .
-                </span>
-              </DialogDescription>
-            </div>
-          </DialogHeader>
-
-          <DialogFooter className="mt-8 flex sm:justify-stretch">
-            <FeatureTipActions
-              currentTip={tip}
-              primaryBusy={primaryBusy}
-              onPrimaryAction={onPrimaryAction}
-              onSkip={onSkip}
-              showSkip={false}
-              fullWidth
-              primaryButtonRef={primaryButtonRef}
+              </span>
+            )}
+            <FeatureTipSettingsLine
+              lead={translate(
+                'featureTips.voice.settingsInstruction',
+                'Change the model, dictation mode, or shortcut anytime in'
+              )}
+              link={translate('featureTips.voice.settingsLink', 'Settings → Voice')}
+              onClick={onVoiceSettingsClick}
             />
-          </DialogFooter>
+          </DialogDescription>
         </div>
+      </DialogHeader>
 
-        <div className="flex min-h-0 min-w-0 shrink-0 self-stretch overflow-hidden bg-muted/60 md:basis-1/2 md:border-l md:border-border/70">
-          <div className="h-full min-h-[23rem] w-full md:w-[29.4rem]">
-            <VoiceDictationFeatureTipVisual />
-          </div>
-        </div>
-      </DialogContent>
-    </Dialog>
+      <DialogFooter className="mt-8 flex sm:justify-stretch">
+        <FeatureTipActions
+          currentTip={tip}
+          primaryBusy={primaryBusy}
+          onPrimaryAction={onPrimaryAction}
+          onSkip={onSkip}
+          showSkip={false}
+          fullWidth
+          primaryButtonRef={primaryButtonRef}
+        />
+      </DialogFooter>
+    </FeatureTipDialogFrame>
   )
 }
diff --git a/src/renderer/src/components/feature-tips/feature-tip-modal-state.test.ts b/src/renderer/src/components/feature-tips/feature-tip-modal-state.test.ts
index c224d5e1c8cf..d5e40c9c0514 100644
--- a/src/renderer/src/components/feature-tips/feature-tip-modal-state.test.ts
+++ b/src/renderer/src/components/feature-tips/feature-tip-modal-state.test.ts
@@ -3,12 +3,17 @@ import { getDefaultVoiceSettings } from '../../../../shared/constants'
 import type { GlobalSettings } from '../../../../shared/global-settings-types'
 import { getFeatureTipForModal } from './feature-tip-modal-state'
 
-function makeSettings(voiceEnabled = false): Pick<GlobalSettings, 'voice'> {
+// Session search defaults on so tests about the older tips don't see the session-search tip first.
+function makeSettings(
+  voiceEnabled = false,
+  sessionSearchEnabled = true
+): Pick<GlobalSettings, 'voice' | 'aiVaultSearch'> {
   return {
     voice: {
       ...getDefaultVoiceSettings(),
       enabled: voiceEnabled
-    }
+    },
+    aiVaultSearch: { enabled: sessionSearchEnabled, historyDays: null }
   }
 }
 
@@ -19,7 +24,8 @@ describe('feature tip modal state', () => {
       modalData: { tipId: 'voice-dictation' },
       seenTipIds: ['voice-dictation'],
       featureInteractions: {},
-      settings: makeSettings()
+      settings: makeSettings(),
+      webClient: false
     })
 
     expect(tip?.id).toBe('voice-dictation')
@@ -31,7 +37,8 @@ describe('feature tip modal state', () => {
       modalData: {},
       seenTipIds: [],
       featureInteractions: {},
-      settings: makeSettings()
+      settings: makeSettings(),
+      webClient: false
     })
 
     expect(tip?.id).toBe('orca-cli')
@@ -43,7 +50,8 @@ describe('feature tip modal state', () => {
       modalData: {},
       seenTipIds: ['voice-dictation'],
       featureInteractions: {},
-      settings: makeSettings()
+      settings: makeSettings(),
+      webClient: false
     })
 
     expect(tip?.id).toBe('orca-cli')
@@ -55,7 +63,8 @@ describe('feature tip modal state', () => {
       modalData: {},
       seenTipIds: ['orca-cli'],
       featureInteractions: {},
-      settings: makeSettings()
+      settings: makeSettings(),
+      webClient: false
     })
 
     expect(tip?.id).toBe('cmd-j-palette')
@@ -67,7 +76,8 @@ describe('feature tip modal state', () => {
       modalData: {},
       seenTipIds: ['voice-dictation', 'orca-cli', 'cmd-j-palette'],
       featureInteractions: {},
-      settings: makeSettings()
+      settings: makeSettings(),
+      webClient: false
     })
 
     expect(tip).toBeNull()
@@ -79,7 +89,8 @@ describe('feature tip modal state', () => {
       modalData: {},
       seenTipIds: ['voice-dictation', 'cmd-j-palette'],
       featureInteractions: {},
-      settings: makeSettings()
+      settings: makeSettings(),
+      webClient: false
     })
 
     expect(tip).toBeNull()
@@ -93,7 +104,8 @@ describe('feature tip modal state', () => {
       featureInteractions: {
         'voice-dictation': { firstInteractedAt: 100, interactionCount: 1 }
       },
-      settings: makeSettings()
+      settings: makeSettings(),
+      webClient: false
     })
 
     expect(tip).toBeNull()
diff --git a/src/renderer/src/components/feature-tips/feature-tip-modal-state.ts b/src/renderer/src/components/feature-tips/feature-tip-modal-state.ts
index 780b40894b12..8e38bcafaea8 100644
--- a/src/renderer/src/components/feature-tips/feature-tip-modal-state.ts
+++ b/src/renderer/src/components/feature-tips/feature-tip-modal-state.ts
@@ -1,34 +1,24 @@
-import type { GlobalSettings } from '../../../../shared/global-settings-types'
 import type { FeatureInteractionState } from '../../../../shared/feature-interactions'
 import {
   FEATURE_TIPS,
-  getCompletedFeatureTipIds,
-  getOrderedUnseenFeatureTips,
   isFeatureTipId,
   type FeatureTip,
   type FeatureTipId
 } from '../../../../shared/feature-tips'
+import { getPendingFeatureTips, type FeatureTipSettings } from './feature-tip-startup-gate'
 
 export function getFeatureTipForModal(args: {
   cliInstalled: boolean
   modalData: Record<string, unknown>
   seenTipIds: readonly FeatureTipId[]
   featureInteractions: FeatureInteractionState
-  settings: { voice?: GlobalSettings['voice'] } | null | undefined
+  settings: FeatureTipSettings | null | undefined
+  webClient: boolean
 }): FeatureTip | null {
   const modalTipId = isFeatureTipId(args.modalData.tipId) ? args.modalData.tipId : null
   if (modalTipId) {
     return FEATURE_TIPS.find((tip) => tip.id === modalTipId) ?? null
   }
 
-  const pendingTips = getOrderedUnseenFeatureTips({
-    seenTipIds: new Set(args.seenTipIds),
-    completedTipIds: getCompletedFeatureTipIds({
-      cliInstalled: args.cliInstalled,
-      voiceDictationEnabled: args.settings?.voice?.enabled === true,
-      featureInteractions: args.featureInteractions
-    })
-  })
-
-  return pendingTips[0] ?? null
+  return getPendingFeatureTips(args)[0] ?? null
 }
diff --git a/src/renderer/src/components/feature-tips/feature-tip-startup-gate.test.ts b/src/renderer/src/components/feature-tips/feature-tip-startup-gate.test.ts
index cac13f108fd0..0c5da4935f33 100644
--- a/src/renderer/src/components/feature-tips/feature-tip-startup-gate.test.ts
+++ b/src/renderer/src/components/feature-tips/feature-tip-startup-gate.test.ts
@@ -3,7 +3,11 @@ import { getDefaultOnboardingState, getDefaultVoiceSettings } from '../../../../
 import type { CliInstallStatus } from '../../../../shared/cli-install-types'
 import type { GlobalSettings } from '../../../../shared/global-settings-types'
 import type { OnboardingState } from '../../../../shared/onboarding-state-types'
-import { getFeatureTipsAppOpenDecision, isCliFeatureTipCompleted } from './feature-tip-startup-gate'
+import {
+  getFeatureTipsAppOpenDecision,
+  isCliFeatureTipCompleted,
+  isSessionSearchFeatureTipCompleted
+} from './feature-tip-startup-gate'
 
 const existingUserOnboarding: OnboardingState = {
   ...getDefaultOnboardingState(),
@@ -14,12 +18,17 @@ const existingUserOnboarding: OnboardingState = {
 
 const firstTimeOnboarding: OnboardingState = getDefaultOnboardingState()
 
-function makeSettings(voiceEnabled = false): Pick<GlobalSettings, 'voice'> {
+// Session search defaults on so tests about the older tips don't see the session-search tip first.
+function makeSettings(
+  voiceEnabled = false,
+  sessionSearchEnabled = true
+): Pick<GlobalSettings, 'voice' | 'aiVaultSearch'> {
   return {
     voice: {
       ...getDefaultVoiceSettings(),
       enabled: voiceEnabled
-    }
+    },
+    aiVaultSearch: { enabled: sessionSearchEnabled, historyDays: null }
   }
 }
 
@@ -53,7 +62,8 @@ describe('feature tip startup gate', () => {
         persistedUIReady: true,
         promptedThisSession: false,
         settings: makeSettings(),
-        suppressedByOnboardingThisSession: false
+        suppressedByOnboardingThisSession: false,
+        webClient: false
       })
     ).toEqual({ kind: 'open', tipId: 'orca-cli' })
   })
@@ -69,7 +79,8 @@ describe('feature tip startup gate', () => {
         persistedUIReady: true,
         promptedThisSession: false,
         settings: makeSettings(),
-        suppressedByOnboardingThisSession: false
+        suppressedByOnboardingThisSession: false,
+        webClient: false
       })
     ).toEqual({ kind: 'suppress-for-onboarding' })
   })
@@ -85,7 +96,8 @@ describe('feature tip startup gate', () => {
         persistedUIReady: true,
         promptedThisSession: false,
         settings: makeSettings(),
-        suppressedByOnboardingThisSession: true
+        suppressedByOnboardingThisSession: true,
+        webClient: false
       })
     ).toEqual({ kind: 'skip' })
   })
@@ -101,7 +113,8 @@ describe('feature tip startup gate', () => {
         persistedUIReady: true,
         promptedThisSession: false,
         settings: makeSettings(),
-        suppressedByOnboardingThisSession: false
+        suppressedByOnboardingThisSession: false,
+        webClient: false
       })
     ).toEqual({ kind: 'open', tipId: 'orca-cli' })
   })
@@ -117,7 +130,8 @@ describe('feature tip startup gate', () => {
         persistedUIReady: true,
         promptedThisSession: false,
         settings: makeSettings(true),
-        suppressedByOnboardingThisSession: false
+        suppressedByOnboardingThisSession: false,
+        webClient: false
       })
     ).toEqual({ kind: 'open', tipId: 'orca-cli' })
   })
@@ -133,7 +147,8 @@ describe('feature tip startup gate', () => {
         persistedUIReady: true,
         promptedThisSession: false,
         settings: makeSettings(),
-        suppressedByOnboardingThisSession: false
+        suppressedByOnboardingThisSession: false,
+        webClient: false
       })
     ).toEqual({ kind: 'open', tipId: 'cmd-j-palette' })
   })
@@ -149,7 +164,8 @@ describe('feature tip startup gate', () => {
         persistedUIReady: true,
         promptedThisSession: false,
         settings: makeSettings(),
-        suppressedByOnboardingThisSession: false
+        suppressedByOnboardingThisSession: false,
+        webClient: false
       })
     ).toEqual({ kind: 'skip' })
   })
@@ -165,7 +181,8 @@ describe('feature tip startup gate', () => {
         persistedUIReady: true,
         promptedThisSession: false,
         settings: makeSettings(false),
-        suppressedByOnboardingThisSession: false
+        suppressedByOnboardingThisSession: false,
+        webClient: false
       })
     ).toEqual({ kind: 'skip' })
   })
@@ -181,7 +198,8 @@ describe('feature tip startup gate', () => {
         persistedUIReady: true,
         promptedThisSession: false,
         settings: makeSettings(),
-        suppressedByOnboardingThisSession: false
+        suppressedByOnboardingThisSession: false,
+        webClient: false
       })
     ).toEqual({ kind: 'skip' })
   })
@@ -197,7 +215,8 @@ describe('feature tip startup gate', () => {
         persistedUIReady: true,
         promptedThisSession: false,
         settings: makeSettings(),
-        suppressedByOnboardingThisSession: false
+        suppressedByOnboardingThisSession: false,
+        webClient: false
       })
     ).toEqual({ kind: 'skip' })
   })
@@ -213,7 +232,8 @@ describe('feature tip startup gate', () => {
         persistedUIReady: true,
         promptedThisSession: false,
         settings: makeSettings(),
-        suppressedByOnboardingThisSession: false
+        suppressedByOnboardingThisSession: false,
+        webClient: false
       })
     ).toEqual({ kind: 'skip' })
   })
@@ -231,7 +251,8 @@ describe('feature tip startup gate', () => {
         persistedUIReady: true,
         promptedThisSession: false,
         settings: makeSettings(),
-        suppressedByOnboardingThisSession: false
+        suppressedByOnboardingThisSession: false,
+        webClient: false
       })
     ).toEqual({ kind: 'skip' })
   })
@@ -252,4 +273,55 @@ describe('feature tip startup gate', () => {
       )
     ).toBe(true)
   })
+
+  function decideForExistingUser(args: {
+    sessionSearchEnabled: boolean
+    webClient: boolean
+    featureTipsSeenIds?: ('agent-session-search' | 'orca-cli')[]
+  }): ReturnType<typeof getFeatureTipsAppOpenDecision> {
+    return getFeatureTipsAppOpenDecision({
+      activeModal: 'none',
+      cliInstalled: false,
+      featureTipsSeenIds: args.featureTipsSeenIds ?? [],
+      featureInteractions: {},
+      onboarding: existingUserOnboarding,
+      persistedUIReady: true,
+      promptedThisSession: false,
+      settings: makeSettings(false, args.sessionSearchEnabled),
+      suppressedByOnboardingThisSession: false,
+      webClient: args.webClient
+    })
+  }
+
+  it('opens the session search tip first while search is off', () => {
+    expect(decideForExistingUser({ sessionSearchEnabled: false, webClient: false })).toEqual({
+      kind: 'open',
+      tipId: 'agent-session-search'
+    })
+  })
+
+  it('skips the session search tip once it has been seen', () => {
+    expect(
+      decideForExistingUser({
+        sessionSearchEnabled: false,
+        webClient: false,
+        featureTipsSeenIds: ['agent-session-search']
+      })
+    ).toEqual({ kind: 'open', tipId: 'orca-cli' })
+  })
+
+  it('skips the session search tip when search is already on or on a web client', () => {
+    expect(decideForExistingUser({ sessionSearchEnabled: true, webClient: false })).toEqual({
+      kind: 'open',
+      tipId: 'orca-cli'
+    })
+    expect(decideForExistingUser({ sessionSearchEnabled: false, webClient: true })).toEqual({
+      kind: 'open',
+      tipId: 'orca-cli'
+    })
+  })
+
+  it('treats a profile with no session search settings as search off', () => {
+    expect(isSessionSearchFeatureTipCompleted({}, false)).toBe(false)
+  })
 })
diff --git a/src/renderer/src/components/feature-tips/feature-tip-startup-gate.ts b/src/renderer/src/components/feature-tips/feature-tip-startup-gate.ts
index 4ad80028fd87..973c61bb62dc 100644
--- a/src/renderer/src/components/feature-tips/feature-tip-startup-gate.ts
+++ b/src/renderer/src/components/feature-tips/feature-tip-startup-gate.ts
@@ -1,8 +1,10 @@
-import type { FeatureTipId } from '../../../../shared/feature-tips'
 import {
   getCompletedFeatureTipIds,
-  getOrderedUnseenFeatureTips
+  getOrderedUnseenFeatureTips,
+  type FeatureTip,
+  type FeatureTipId
 } from '../../../../shared/feature-tips'
+import { resolveAiVaultSearchSettings } from '../../../../shared/ai-vault-search-settings'
 import type { CliInstallStatus } from '../../../../shared/cli-install-types'
 import type { FeatureInteractionState } from '../../../../shared/feature-interactions'
 import type { GlobalSettings } from '../../../../shared/global-settings-types'
@@ -20,6 +22,38 @@ export function isCliFeatureTipCompleted(status: CliInstallStatus): boolean {
   return !status.supported || (status.state === 'installed' && status.pathConfigured === true)
 }
 
+export type FeatureTipSettings = {
+  voice?: GlobalSettings['voice']
+  aiVaultSearch?: GlobalSettings['aiVaultSearch']
+}
+
+export function isSessionSearchFeatureTipCompleted(
+  settings: FeatureTipSettings | null | undefined,
+  webClient: boolean
+): boolean {
+  // Why: the browser client cannot index transcripts, so there is nothing to turn on.
+  return webClient || resolveAiVaultSearchSettings(settings).enabled
+}
+
+/** Unseen tips whose feature the user has not already set up, in display order. */
+export function getPendingFeatureTips(args: {
+  seenTipIds: readonly FeatureTipId[]
+  cliInstalled: boolean
+  featureInteractions: FeatureInteractionState
+  settings: FeatureTipSettings | null | undefined
+  webClient: boolean
+}): FeatureTip[] {
+  return getOrderedUnseenFeatureTips({
+    seenTipIds: new Set(args.seenTipIds),
+    completedTipIds: getCompletedFeatureTipIds({
+      cliInstalled: args.cliInstalled,
+      voiceDictationEnabled: args.settings?.voice?.enabled === true,
+      sessionSearchTipCompleted: isSessionSearchFeatureTipCompleted(args.settings, args.webClient),
+      featureInteractions: args.featureInteractions
+    })
+  })
+}
+
 export function getFeatureTipsAppOpenDecision(args: {
   activeModal: string
   cliInstalled: boolean | null
@@ -28,8 +62,9 @@ export function getFeatureTipsAppOpenDecision(args: {
   onboarding: OnboardingState | null
   persistedUIReady: boolean
   promptedThisSession: boolean
-  settings: { voice?: GlobalSettings['voice'] } | null | undefined
+  settings: FeatureTipSettings | null | undefined
   suppressedByOnboardingThisSession: boolean
+  webClient: boolean
 }): FeatureTipsAppOpenDecision {
   if (args.onboarding !== null && shouldShowOnboarding(args.onboarding)) {
     return { kind: 'suppress-for-onboarding' }
@@ -48,15 +83,12 @@ export function getFeatureTipsAppOpenDecision(args: {
     return { kind: 'skip' }
   }
 
-  const unseenTips = getOrderedUnseenFeatureTips({
-    seenTipIds: new Set<FeatureTipId>(args.featureTipsSeenIds),
-    completedTipIds: getCompletedFeatureTipIds({
-      cliInstalled: args.cliInstalled,
-      voiceDictationEnabled: args.settings.voice?.enabled === true,
-      featureInteractions: args.featureInteractions
-    })
-  })
-
-  const nextTip = unseenTips[0]
+  const nextTip = getPendingFeatureTips({
+    seenTipIds: args.featureTipsSeenIds,
+    cliInstalled: args.cliInstalled,
+    featureInteractions: args.featureInteractions,
+    settings: args.settings,
+    webClient: args.webClient
+  })[0]
   return nextTip ? { kind: 'open', tipId: nextTip.id } : { kind: 'skip' }
 }
diff --git a/src/renderer/src/components/feature-tips/session-search-feature-tip-demo.ts b/src/renderer/src/components/feature-tips/session-search-feature-tip-demo.ts
new file mode 100644
index 000000000000..123c917e15f1
--- /dev/null
+++ b/src/renderer/src/components/feature-tips/session-search-feature-tip-demo.ts
@@ -0,0 +1,144 @@
+import { translate } from '@/i18n/i18n'
+
+export type SessionSearchDemoRow = {
+  agent: 'claude' | 'codex'
+  title: string
+  role: string
+  /** Hit snippets use the index's [[match]] markers so the demo highlights like real results. */
+  text: string
+  messages: number
+  age: string
+}
+
+export type SessionSearchDemoScene = { query: string; hits: SessionSearchDemoRow[] }
+
+function assistantRole(): string {
+  return translate('featureTips.sessionSearch.demoRoleAssistant', 'Assistant')
+}
+
+function userRole(): string {
+  return translate('featureTips.sessionSearch.demoRoleUser', 'User')
+}
+
+/** What the panel lists before anything is typed. */
+export function getSessionSearchDemoRecentRows(): SessionSearchDemoRow[] {
+  return [
+    {
+      agent: 'claude',
+      title: translate('featureTips.sessionSearch.recent1Title', 'Tidy the settings sidebar'),
+      role: assistantRole(),
+      text: translate(
+        'featureTips.sessionSearch.recent1Text',
+        'Moved the search entries under Workflows and updated the tests.'
+      ),
+      messages: 42,
+      age: translate('featureTips.sessionSearch.ageMinutes', '12m')
+    },
+    {
+      agent: 'codex',
+      title: translate('featureTips.sessionSearch.recent2Title', 'Bump the lockfile'),
+      role: userRole(),
+      text: translate(
+        'featureTips.sessionSearch.recent2Text',
+        'Update the dependencies and make sure the build still passes.'
+      ),
+      messages: 18,
+      age: translate('featureTips.sessionSearch.ageHours', '2h')
+    },
+    {
+      agent: 'claude',
+      title: translate('featureTips.sessionSearch.recent3Title', 'Release notes draft'),
+      role: assistantRole(),
+      text: translate(
+        'featureTips.sessionSearch.recent3Text',
+        'Here is a first pass at the notes, grouped by area.'
+      ),
+      messages: 9,
+      age: translate('featureTips.sessionSearch.ageYesterday', '1d')
+    }
+  ]
+}
+
+export function getSessionSearchDemoScenes(): SessionSearchDemoScene[] {
+  return [
+    {
+      query: translate('featureTips.sessionSearch.demoQuery', 'login timeout'),
+      hits: [
+        {
+          agent: 'claude',
+          title: translate('featureTips.sessionSearch.demoHit1Title', 'Fix flaky auth redirect'),
+          role: assistantRole(),
+          text: translate(
+            'featureTips.sessionSearch.demoHit1Snippet',
+            'Raised the [[login timeout]] to 30s and added a retry on the token refresh.'
+          ),
+          messages: 64,
+          age: translate('featureTips.sessionSearch.demoHit1Age', '3d')
+        },
+        {
+          agent: 'codex',
+          title: translate(
+            'featureTips.sessionSearch.demoHit2Title',
+            'Session refresh after sleep'
+          ),
+          role: userRole(),
+          text: translate(
+            'featureTips.sessionSearch.demoHit2Snippet',
+            'Why does the [[login]] page hang after a [[timeout]] on wake?'
+          ),
+          messages: 27,
+          age: translate('featureTips.sessionSearch.demoHit2Age', '1w')
+        },
+        {
+          agent: 'claude',
+          title: translate('featureTips.sessionSearch.demoHit3Title', 'Auth e2e hardening'),
+          role: assistantRole(),
+          text: translate(
+            'featureTips.sessionSearch.demoHit3Snippet',
+            'Added a test that covers the [[login timeout]] path end to end.'
+          ),
+          messages: 31,
+          age: translate('featureTips.sessionSearch.demoHit3Age', '2w')
+        }
+      ]
+    },
+    {
+      query: translate('featureTips.sessionSearch.demoQuery2', 'migration rollback'),
+      hits: [
+        {
+          agent: 'codex',
+          title: translate('featureTips.sessionSearch.demoHit4Title', 'Orders table migration'),
+          role: assistantRole(),
+          text: translate(
+            'featureTips.sessionSearch.demoHit4Snippet',
+            'The [[rollback]] drops the new index first, then restores the old column.'
+          ),
+          messages: 53,
+          age: translate('featureTips.sessionSearch.demoHit4Age', '5d')
+        },
+        {
+          agent: 'claude',
+          title: translate('featureTips.sessionSearch.demoHit5Title', 'Staging deploy failed'),
+          role: userRole(),
+          text: translate(
+            'featureTips.sessionSearch.demoHit5Snippet',
+            'Can you write a [[migration]] [[rollback]] plan before we retry?'
+          ),
+          messages: 22,
+          age: translate('featureTips.sessionSearch.demoHit5Age', '3w')
+        },
+        {
+          agent: 'claude',
+          title: translate('featureTips.sessionSearch.demoHit6Title', 'Schema review notes'),
+          role: assistantRole(),
+          text: translate(
+            'featureTips.sessionSearch.demoHit6Snippet',
+            'Every [[migration]] here is reversible except the enum rename.'
+          ),
+          messages: 14,
+          age: translate('featureTips.sessionSearch.demoHit6Age', '1mo')
+        }
+      ]
+    }
+  ]
+}
diff --git a/src/renderer/src/components/feature-tips/use-session-search-tip-setup.test.tsx b/src/renderer/src/components/feature-tips/use-session-search-tip-setup.test.tsx
new file mode 100644
index 000000000000..9582eed3a705
--- /dev/null
+++ b/src/renderer/src/components/feature-tips/use-session-search-tip-setup.test.tsx
@@ -0,0 +1,172 @@
+// @vitest-environment happy-dom
+
+import { act } from 'react'
+import { createRoot } from 'react-dom/client'
+import { toast } from 'sonner'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { unavailableSessionSearchStatus } from '../../../../shared/ai-vault-search-client'
+import type { AiVaultSearchStatus } from '../../../../shared/ai-vault-search-types'
+import {
+  useSessionSearchTipSetup,
+  type SessionSearchTipSetup
+} from './use-session-search-tip-setup'
+
+type Mocks = {
+  settings: { aiVaultSearch: { enabled: boolean; historyDays: null } }
+  status: AiVaultSearchStatus | null
+  updateSettingsOrThrow: () => Promise<void>
+  showAiVaultSearch: () => void
+}
+
+const mocks = vi.hoisted((): Mocks => ({
+  settings: { aiVaultSearch: { enabled: false, historyDays: null } },
+  status: null,
+  updateSettingsOrThrow: async () => {},
+  showAiVaultSearch: vi.fn()
+}))
+
+vi.mock('@/store', () => {
+  const state = () => ({
+    settings: mocks.settings,
+    showAiVaultSearch: mocks.showAiVaultSearch,
+    updateSettingsOrThrow: mocks.updateSettingsOrThrow
+  })
+  const useAppStore = Object.assign(
+    (selector: (s: ReturnType<typeof state>) => unknown) => selector(state()),
+    { getState: state }
+  )
+  return { useAppStore }
+})
+
+vi.mock('@/components/settings/use-session-search-status', () => ({
+  useSessionSearchStatus: () => ({
+    status: mocks.status,
+    failed: false,
+    hostTooOld: false,
+    adopt: () => {}
+  })
+}))
+
+vi.mock('sonner', () => ({ toast: { success: vi.fn(), error: vi.fn() } }))
+
+let latest: SessionSearchTipSetup | null = null
+let dialogOpen = true
+function Probe(): null {
+  latest = useSessionSearchTipSetup({ dialogOpen })
+  return null
+}
+
+const container = document.createElement('div')
+const root = createRoot(container)
+
+afterEach(() => {
+  act(() => root.render(null))
+  mocks.settings = { aiVaultSearch: { enabled: false, historyDays: null } }
+  mocks.status = null
+  dialogOpen = true
+  vi.mocked(toast.success).mockClear()
+})
+
+const indexing = (): AiVaultSearchStatus => ({
+  ...unavailableSessionSearchStatus(),
+  enabled: true,
+  phase: 'indexing'
+})
+const ready = (): AiVaultSearchStatus => ({
+  ...unavailableSessionSearchStatus(),
+  enabled: true,
+  phase: 'current',
+  lastSweepCompletedAt: 1
+})
+const searchOn = { aiVaultSearch: { enabled: true, historyDays: null } }
+
+function render(): void {
+  act(() => root.render(<Probe />))
+}
+
+describe('useSessionSearchTipSetup', () => {
+  it('moves from offer to indexing to ready as the first index builds', async () => {
+    render()
+    expect(latest?.stage).toBe('offer')
+
+    await act(async () => {
+      await latest?.enable()
+    })
+    mocks.settings = { aiVaultSearch: { enabled: true, historyDays: null } }
+    mocks.status = { ...unavailableSessionSearchStatus(), enabled: true, phase: 'indexing' }
+    render()
+    expect(latest?.stage).toBe('indexing')
+
+    mocks.status = {
+      ...unavailableSessionSearchStatus(),
+      enabled: true,
+      phase: 'current',
+      lastSweepCompletedAt: 1
+    }
+    render()
+    expect(latest?.stage).toBe('ready')
+  })
+
+  it('returns to the offer when search is turned off in Settings mid-build', async () => {
+    render()
+    await act(async () => {
+      await latest?.enable()
+    })
+    mocks.settings = { aiVaultSearch: { enabled: true, historyDays: null } }
+    mocks.status = { ...unavailableSessionSearchStatus(), enabled: true, phase: 'indexing' }
+    render()
+    expect(latest?.stage).toBe('indexing')
+
+    mocks.settings = { aiVaultSearch: { enabled: false, historyDays: null } }
+    mocks.status = unavailableSessionSearchStatus()
+    render()
+    expect(latest?.stage).toBe('offer')
+  })
+
+  it('shows progress for a build turned on from Settings', () => {
+    mocks.settings = { aiVaultSearch: { enabled: true, historyDays: null } }
+    mocks.status = {
+      ...unavailableSessionSearchStatus(),
+      enabled: true,
+      phase: 'indexing',
+      filesIndexed: 4369,
+      filesDue: 2951
+    }
+    render()
+    expect(latest?.stage).toBe('indexing')
+    expect(latest?.status?.filesIndexed).toBe(4369)
+  })
+
+  it('toasts once when a build the user closed mid-index finishes', () => {
+    mocks.settings = searchOn
+    mocks.status = indexing()
+    render()
+    dialogOpen = false
+    render()
+    expect(toast.success).not.toHaveBeenCalled()
+
+    mocks.status = ready()
+    render()
+    render()
+    expect(toast.success).toHaveBeenCalledTimes(1)
+    expect(vi.mocked(toast.success).mock.calls[0][1]).toMatchObject({
+      action: { label: 'Open', onClick: mocks.showAiVaultSearch }
+    })
+  })
+
+  it('does not toast when another tip closes or the ready dialog closes', () => {
+    mocks.settings = searchOn
+    mocks.status = indexing()
+    dialogOpen = false
+    render()
+    mocks.status = ready()
+    render()
+    expect(toast.success).not.toHaveBeenCalled()
+
+    dialogOpen = true
+    render()
+    dialogOpen = false
+    render()
+    expect(toast.success).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/renderer/src/components/feature-tips/use-session-search-tip-setup.ts b/src/renderer/src/components/feature-tips/use-session-search-tip-setup.ts
new file mode 100644
index 000000000000..e5675c64c729
--- /dev/null
+++ b/src/renderer/src/components/feature-tips/use-session-search-tip-setup.ts
@@ -0,0 +1,94 @@
+import { useEffect, useState } from 'react'
+import { toast } from 'sonner'
+import { resolveAiVaultSearchSettings } from '../../../../shared/ai-vault-search-settings'
+import type { AiVaultSearchStatus } from '../../../../shared/ai-vault-search-types'
+import { LOCAL_EXECUTION_HOST_ID } from '../../../../shared/execution-host'
+import {
+  isSessionSearchIndexReady,
+  sessionSearchStatusMessage
+} from '@/components/settings/session-history-status-copy'
+import { useSessionSearchStatus } from '@/components/settings/use-session-search-status'
+import { translate } from '@/i18n/i18n'
+import { useAppStore } from '@/store'
+
+export type SessionSearchTipStage = 'offer' | 'indexing' | 'ready'
+
+export type SessionSearchTipSetup = {
+  stage: SessionSearchTipStage
+  status: AiVaultSearchStatus | null
+  /** Turns local search on; the stage then follows the index. */
+  enable: () => Promise<void>
+}
+
+/**
+ * The tip's view of local session search, read from the setting and the index itself so a
+ * build started from Settings shows the same progress. The feature-tips modal stays mounted
+ * after it closes, so a build the user left mid-index is still watched and toasts once ready.
+ */
+export function useSessionSearchTipSetup({
+  dialogOpen
+}: {
+  dialogOpen: boolean
+}): SessionSearchTipSetup {
+  const showAiVaultSearch = useAppStore((s) => s.showAiVaultSearch)
+  const searchEnabled = useAppStore((s) => resolveAiVaultSearchSettings(s.settings).enabled)
+  const [wasOpen, setWasOpen] = useState(dialogOpen)
+  const [toastWhenReady, setToastWhenReady] = useState(false)
+  const [readyToastStatus, setReadyToastStatus] = useState<AiVaultSearchStatus | null>(null)
+  const read = useSessionSearchStatus({
+    executionHostId: LOCAL_EXECUTION_HOST_ID,
+    active: searchEnabled && (dialogOpen || toastWhenReady)
+  })
+  let stage: SessionSearchTipStage = 'offer'
+  if (searchEnabled) {
+    stage = isSessionSearchIndexReady(read.status) ? 'ready' : 'indexing'
+  }
+
+  // Why: closing this tip mid-index is the only thing that asks for a later toast.
+  if (wasOpen !== dialogOpen) {
+    setWasOpen(dialogOpen)
+    if (!dialogOpen && stage === 'indexing') {
+      setToastWhenReady(true)
+    }
+  }
+  if (toastWhenReady && !searchEnabled) {
+    setToastWhenReady(false)
+  }
+  if (toastWhenReady && stage === 'ready' && read.status) {
+    setToastWhenReady(false)
+    setReadyToastStatus(read.status)
+  }
+
+  useEffect(() => {
+    if (!readyToastStatus) {
+      return
+    }
+    toast.success(translate('featureTips.sessionSearch.readyToast', 'Session search is ready'), {
+      description: sessionSearchStatusMessage(readyToastStatus),
+      action: {
+        label: translate('featureTips.sessionSearch.readyToastOpen', 'Open'),
+        onClick: showAiVaultSearch
+      }
+    })
+  }, [readyToastStatus, showAiVaultSearch])
+
+  return {
+    stage,
+    status: read.status,
+    enable: async () => {
+      const store = useAppStore.getState()
+      try {
+        await store.updateSettingsOrThrow({
+          aiVaultSearch: { ...resolveAiVaultSearchSettings(store.settings), enabled: true }
+        })
+      } catch {
+        toast.error(
+          translate(
+            'featureTips.sessionSearch.enableFailed',
+            'Could not turn on session search. Try again.'
+          )
+        )
+      }
+    }
+  }
+}
diff --git a/src/renderer/src/components/floating-terminal/FloatingTerminalPanel.tab-lifecycle.test.tsx b/src/renderer/src/components/floating-terminal/FloatingTerminalPanel.tab-lifecycle.test.tsx
index a4c58f7ad049..1d8624ba4356 100644
--- a/src/renderer/src/components/floating-terminal/FloatingTerminalPanel.tab-lifecycle.test.tsx
+++ b/src/renderer/src/components/floating-terminal/FloatingTerminalPanel.tab-lifecycle.test.tsx
@@ -209,7 +209,11 @@ describe('FloatingTerminalPanel close behavior', () => {
     const element = await renderPanel(true)
     const tabBar = findByTypeName(element, 'TabBar')
     ;(tabBar.props.onNewBrowserTab as () => void)()
-    ;(tabBar.props.onDuplicateBrowserTab as (browserTabId: string) => void)('browser-1')
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: TabBarProps types this callback; the test tree erases it.
+    ;(tabBar.props.onDuplicateBrowserTab as (browserTabId: string, unifiedTabId: string) => void)(
+      'browser-1',
+      'browser-unified-1'
+    )
 
     expect(mocks.createWebRuntimeSessionBrowserTab).not.toHaveBeenCalled()
     expect(mocks.createBrowserTab).toHaveBeenNthCalledWith(
@@ -231,7 +235,7 @@ describe('FloatingTerminalPanel close behavior', () => {
         title: 'Example',
         sessionProfileId: 'profile-1',
         sessionPartition: 'persist:orca-browser-session-profile-1',
-        targetGroupId: 'floating-group',
+        afterTabId: 'browser-unified-1',
         browserRuntimeEnvironmentId: null
       }
     )
diff --git a/src/renderer/src/components/floating-terminal/FloatingTerminalPanelSurface.tsx b/src/renderer/src/components/floating-terminal/FloatingTerminalPanelSurface.tsx
index e3a57fb0c41e..bd2311e7ada3 100644
--- a/src/renderer/src/components/floating-terminal/FloatingTerminalPanelSurface.tsx
+++ b/src/renderer/src/components/floating-terminal/FloatingTerminalPanelSurface.tsx
@@ -60,7 +60,6 @@ export function renderFloatingTerminalPanelSurface({
   activeTabType,
   browserTabs,
   createBrowserTab,
-  activeGroup,
   closeAllFiles,
   makePreviewFilePermanent,
   pinFile,
@@ -177,14 +176,14 @@ export function renderFloatingTerminalPanelSurface({
               onCloseFile={closeFloatingItemConfirmed}
               onActivateBrowserTab={activateFloatingItem}
               onCloseBrowserTab={closeFloatingItemConfirmed}
-              onDuplicateBrowserTab={(browserTabId) => {
+              onDuplicateBrowserTab={(browserTabId, sourceUnifiedTabId) => {
                 const source = browserTabs.find((tab) => tab.id === browserTabId)
                 if (!source) {
                   return
                 }
                 createBrowserTab(FLOATING_TERMINAL_WORKTREE_ID, source.url, {
                   ...buildDuplicatedBrowserTabOptions(source),
-                  targetGroupId: activeGroup?.id,
+                  afterTabId: sourceUnifiedTabId,
                   browserRuntimeEnvironmentId: null
                 })
               }}
diff --git a/src/renderer/src/components/native-chat-resume-failed-chat-watch.test.ts b/src/renderer/src/components/native-chat-resume-failed-chat-watch.test.ts
index 308e7b878e89..7dfc8938373e 100644
--- a/src/renderer/src/components/native-chat-resume-failed-chat-watch.test.ts
+++ b/src/renderer/src/components/native-chat-resume-failed-chat-watch.test.ts
@@ -25,8 +25,8 @@ vi.mock('@/runtime/structured-agent-session-client', () => ({
 }))
 vi.mock('sonner', () => ({ toast: vi.fn() }))
 
-// After a restart action leaves a chat failed, the user's reply in that chat must retire the status
-// bar entry without the user reopening anything, and nothing may run while nothing failed.
+// When the user sends in an offered or failed chat, its status bar entry must retire without the
+// user reopening anything, and nothing may run while nothing is offered or failed.
 
 const failure = {
   sessionId: 'a',
@@ -91,7 +91,26 @@ afterEach(() => {
   vi.useRealTimers()
 })
 
-it('opens no status stream while nothing failed', async () => {
+// The host withdraws a pending offer once the chat moves on; the status bar must not keep counting it.
+it('re-reads once when the user sends in an offered chat, and the count drops', async () => {
+  const { failedAt: _failedAt, outcome: _outcome, reason: _reason, ...candidate } = failure
+  mocks.rpc
+    .mockResolvedValueOnce({ sessions: [candidate], failed: [] })
+    .mockResolvedValue({ sessions: [], failed: [] })
+  await refreshNativeChatRestartOffer()
+  await vi.advanceTimersByTimeAsync(0)
+  expect(getNativeChatRestartOffer().candidates).toHaveLength(1)
+  expect(mocks.subscribeStatus).toHaveBeenCalledOnce()
+
+  hostEmit()({ type: 'status', session: summary('working', 'Something else', Date.now() + 10_000) })
+  await vi.advanceTimersByTimeAsync(500)
+
+  expect(offerReads()).toBe(2)
+  expect(getNativeChatRestartOffer().candidates).toEqual([])
+  expect(mocks.unsubscribe).toHaveBeenCalledOnce()
+})
+
+it('opens no status stream while nothing is offered or failed', async () => {
   mocks.rpc.mockResolvedValue({ sessions: [], failed: [] })
   await refreshNativeChatRestartOffer()
   await vi.advanceTimersByTimeAsync(0)
diff --git a/src/renderer/src/components/native-chat-resume-on-restart-store.ts b/src/renderer/src/components/native-chat-resume-on-restart-store.ts
index a3012495a3c4..78c5fa207b67 100644
--- a/src/renderer/src/components/native-chat-resume-on-restart-store.ts
+++ b/src/renderer/src/components/native-chat-resume-on-restart-store.ts
@@ -58,42 +58,47 @@ const LAUNCH_READ_RETRY_DELAYS_MS = [100, 250, 500] as const
  *  actually moves the offer. */
 function publish(next: NativeChatRestartOffer): void {
   offer = next
-  syncFailedChatWatch()
+  syncOfferedChatWatch()
   for (const listener of listeners) {
     listener()
   }
 }
 
 /**
- * Re-reads the host once a failed chat shows new activity, so a reply the user sent there retires
- * its entry here too. The host stays the judge; this only asks again.
+ * Re-reads the host once an offered or failed chat shows new activity, so a message the user sent
+ * there, or its agent starting, retires its entry here too. The host stays the judge; this only
+ * asks again.
  *
- * Held only while something failed. Keyed on status and prompt rather than every summary, so an
- * agent streaming in a failed chat costs one re-read, not one per tool call.
+ * Held only while something is offered or failed. Keyed on status and prompt rather than every
+ * summary, so an agent streaming in such a chat costs one re-read, not one per tool call.
  */
-const FAILED_CHAT_REFRESH_DELAY_MS = 500
-let failedChatWatch: {
+const OFFERED_CHAT_REFRESH_DELAY_MS = 500
+let offeredChatWatch: {
   feed: StructuredAgentSessionStatusFeedOwner
   seen: Map<string, string>
   release: () => void
 } | null = null
-let failedChatRefresh: ReturnType<typeof setTimeout> | null = null
+let offeredChatRefresh: ReturnType<typeof setTimeout> | null = null
 
-function failedChatActivityKey(summary: AgentSessionStatusSummary): string {
+function offeredChatIds(): Set<string> {
+  return new Set([...offer.candidates, ...offer.failed].map((entry) => entry.sessionId))
+}
+
+function offeredChatActivityKey(summary: AgentSessionStatusSummary): string {
   return `${summary.status ?? ''}\u0000${summary.latestPrompt}`
 }
 
-function syncFailedChatWatch(): void {
-  const failedIds = new Set(offer.failed.map((failure) => failure.sessionId))
-  if (failedIds.size === 0) {
-    releaseFailedChatWatch()
+function syncOfferedChatWatch(): void {
+  const offeredIds = offeredChatIds()
+  if (offeredIds.size === 0) {
+    releaseOfferedChatWatch()
     return
   }
-  if (!failedChatWatch) {
+  if (!offeredChatWatch) {
     const feed = getStructuredAgentSessionStatusFeed(LOCAL)
-    const unsubscribe = feed.subscribe(noticeFailedChatActivity)
+    const unsubscribe = feed.subscribe(noticeOfferedChatActivity)
     const deactivate = feed.activate()
-    failedChatWatch = {
+    offeredChatWatch = {
       feed,
       seen: new Map(),
       release: () => {
@@ -102,60 +107,60 @@ function syncFailedChatWatch(): void {
       }
     }
   }
-  const { feed, seen } = failedChatWatch
+  const { feed, seen } = offeredChatWatch
   for (const sessionId of seen.keys()) {
-    if (!failedIds.has(sessionId)) {
+    if (!offeredIds.has(sessionId)) {
       seen.delete(sessionId)
     }
   }
   // What the feed already holds is what this listing answered.
-  for (const sessionId of failedIds) {
+  for (const sessionId of offeredIds) {
     const summary = feed.getSnapshot().get(sessionId)
     if (summary && !seen.has(sessionId)) {
-      seen.set(sessionId, failedChatActivityKey(summary))
+      seen.set(sessionId, offeredChatActivityKey(summary))
     }
   }
 }
 
-function noticeFailedChatActivity(): void {
-  if (!failedChatWatch) {
+function noticeOfferedChatActivity(): void {
+  if (!offeredChatWatch) {
     return
   }
-  const { feed, seen } = failedChatWatch
+  const { feed, seen } = offeredChatWatch
   const snapshot = feed.getSnapshot()
   let changed = false
-  for (const failure of offer.failed) {
-    const summary = snapshot.get(failure.sessionId)
+  for (const sessionId of offeredChatIds()) {
+    const summary = snapshot.get(sessionId)
     if (!summary) {
       continue
     }
-    const key = failedChatActivityKey(summary)
-    const previous = seen.get(failure.sessionId)
+    const key = offeredChatActivityKey(summary)
+    const previous = seen.get(sessionId)
     if (previous !== key) {
-      seen.set(failure.sessionId, key)
+      seen.set(sessionId, key)
       // A first sighting is news only if newer than the list; a change to a known chat always is,
       // since the host may have answered the list just before the change was delivered here.
       changed ||= previous !== undefined || summary.updatedAt > offer.listedAt
     }
   }
-  if (changed && failedChatRefresh === null) {
-    failedChatRefresh = setTimeout(() => {
-      failedChatRefresh = null
+  if (changed && offeredChatRefresh === null) {
+    offeredChatRefresh = setTimeout(() => {
+      offeredChatRefresh = null
       if (actionsBegun === actionsSettled) {
         const issued = actionsBegun
         void readNativeChatRestartOffer(() => actionsBegun === issued)
       }
-    }, FAILED_CHAT_REFRESH_DELAY_MS)
+    }, OFFERED_CHAT_REFRESH_DELAY_MS)
   }
 }
 
-function releaseFailedChatWatch(): void {
-  if (failedChatRefresh !== null) {
-    clearTimeout(failedChatRefresh)
-    failedChatRefresh = null
+function releaseOfferedChatWatch(): void {
+  if (offeredChatRefresh !== null) {
+    clearTimeout(offeredChatRefresh)
+    offeredChatRefresh = null
   }
-  failedChatWatch?.release()
-  failedChatWatch = null
+  offeredChatWatch?.release()
+  offeredChatWatch = null
 }
 
 export function getNativeChatRestartOffer(): NativeChatRestartOffer {
@@ -358,7 +363,7 @@ export function useNativeChatRestartOffer(enabled: boolean): NativeChatRestartOf
 
 /** @internal - tests need a clean module between cases. */
 export function _resetNativeChatRestartOffer(): void {
-  releaseFailedChatWatch()
+  releaseOfferedChatWatch()
   offer = EMPTY
   actionsBegun = 0
   actionsSettled = 0
diff --git a/src/renderer/src/components/native-chat/NativeChatAwaitingInputRow.tsx b/src/renderer/src/components/native-chat/NativeChatAwaitingInputRow.tsx
index 0f9dab5720b0..8e621a8a441b 100644
--- a/src/renderer/src/components/native-chat/NativeChatAwaitingInputRow.tsx
+++ b/src/renderer/src/components/native-chat/NativeChatAwaitingInputRow.tsx
@@ -1,11 +1,17 @@
+import { useCallback, useRef, useState } from 'react'
+import { ChevronRight } from 'lucide-react'
 import { cn } from '@/lib/utils'
 import { translate } from '@/i18n/i18n'
 import {
   NATIVE_CHAT_ASK_ROW_COPY,
   type NativeChatAskRowSubject
 } from '../../../../shared/native-chat-ask-row'
+import { useNativeChatDisclosure } from './native-chat-disclosure-store'
 import { NativeChatToolRunIcon } from './NativeChatToolIcon'
 
+const ROW_CLASS_NAME =
+  'flex min-h-6 w-full items-center gap-1.5 py-0.5 text-left text-sm leading-relaxed text-muted-foreground'
+
 /**
  * The row a question tool call draws in place of its raw input. The agent is
  * blocked on the reader, so the row says that in plain words and names what was
@@ -13,16 +19,59 @@ import { NativeChatToolRunIcon } from './NativeChatToolIcon'
  *
  * Only the label breathes: the question is the part worth reading, and animating
  * it would make the one line the reader has to act on the hardest one to read.
+ *
+ * A question too long for the line becomes a disclosure, and so does a grouped
+ * prompt, whose line names only a count. Once answered, this row may be the only
+ * place the questions are still shown, so the full text opens below the toggle,
+ * outside it, where it can be selected and copied like any other prose.
  */
 export function NativeChatAwaitingInputRow({
   subject,
-  pending
+  pending,
+  disclosureKey,
+  listsQuestions = true
 }: {
   /** Null when the payload named no question; the label carries the row alone. */
   subject: NativeChatAskRowSubject | null
   /** Still waiting on an answer; a settled prompt reports what was asked. */
   pending: boolean
+  /** Identity the opened question is remembered under while the row is unmounted. */
+  disclosureKey?: string
+  /** False when the caller already shows each question of a grouped prompt in full. */
+  listsQuestions?: boolean
 }): React.JSX.Element {
+  // The list and a lone question are separate disclosures: a pending Codex group is
+  // keyed by its first question, which becomes its own row once answered.
+  const { open, setOpen } = useNativeChatDisclosure(
+    disclosureKey !== undefined && subject?.kind === 'questions'
+      ? `${disclosureKey}:questions`
+      : disclosureKey,
+    false
+  )
+  // Seeded from `open`: a row remounted open was clipped when the reader opened
+  // it, and dropping the toggle as it folds would drop keyboard focus with it.
+  const [clipped, setClipped] = useState(open)
+  const observerRef = useRef<ResizeObserver | null>(null)
+  // Attached to the question only while it sits on the line; an open row keeps its verdict.
+  const measureLine = useCallback((line: HTMLSpanElement | null) => {
+    observerRef.current?.disconnect()
+    observerRef.current = null
+    if (!line) {
+      return
+    }
+    const measure = (): void => setClipped(line.scrollWidth > line.clientWidth)
+    measure()
+    if (typeof ResizeObserver === 'undefined') {
+      return
+    }
+    observerRef.current = new ResizeObserver(measure)
+    observerRef.current.observe(line)
+  }, [])
+
+  const question = subject?.kind === 'question' ? subject.text : null
+  const questions = subject?.kind === 'questions' && listsQuestions ? subject.questions : null
+  // A count always hides its questions, so the list needs no clipping measurement.
+  const toggles = questions !== null || (question !== null && (open || clipped))
   const label = pending
     ? translate('components.native-chat.ask.awaiting', NATIVE_CHAT_ASK_ROW_COPY.awaiting)
     : translate('components.native-chat.ask.asked', NATIVE_CHAT_ASK_ROW_COPY.asked)
@@ -34,20 +83,72 @@ export function NativeChatAwaitingInputRow({
         : translate(
             'components.native-chat.ask.questionCount',
             NATIVE_CHAT_ASK_ROW_COPY.questionCount,
-            { value0: subject.count }
+            { value0: subject.questions.length }
           )
+  const header = (
+    <>
+      <NativeChatToolRunIcon iconName="message-square-more" className="text-muted-foreground" />
+      <span className={cn('shrink-0', pending && 'animate-pulse motion-reduce:animate-none')}>
+        {label}
+      </span>
+      {question !== null && toggles && open ? null : (
+        <span
+          ref={question === null ? undefined : measureLine}
+          className="min-w-0 truncate text-foreground/85"
+        >
+          {text}
+        </span>
+      )}
+      {toggles ? (
+        <ChevronRight
+          aria-hidden
+          className={cn(
+            'size-3.5 shrink-0 text-muted-foreground transition-all',
+            open
+              ? 'rotate-90'
+              : 'can-hover:opacity-0 group-hover/ask-row:opacity-100 group-focus-visible/ask-row:opacity-100'
+          )}
+        />
+      ) : null}
+    </>
+  )
 
   return (
     <div
-      className="flex min-h-6 w-full items-center gap-1.5 py-0.5 text-sm leading-relaxed text-muted-foreground"
       data-native-chat-ask-row={pending ? 'awaiting' : 'asked'}
       aria-live={pending ? 'polite' : undefined}
     >
-      <NativeChatToolRunIcon iconName="message-square-more" className="text-muted-foreground" />
-      <span className={cn('shrink-0', pending && 'animate-pulse motion-reduce:animate-none')}>
-        {label}
-      </span>
-      <span className="min-w-0 truncate text-foreground/85">{text}</span>
+      {toggles ? (
+        <button
+          type="button"
+          onClick={() => setOpen(!open)}
+          className={cn(
+            ROW_CLASS_NAME,
+            'group/ask-row rounded-md focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-inset focus-visible:ring-ring/70'
+          )}
+          aria-expanded={open}
+        >
+          {header}
+        </button>
+      ) : (
+        <div className={ROW_CLASS_NAME}>{header}</div>
+      )}
+      {toggles && open && question !== null ? (
+        // Indented to the label, past the icon slot and its gap.
+        <p className="whitespace-pre-wrap break-words pl-5.5 text-sm leading-relaxed text-foreground/85">
+          {question}
+        </p>
+      ) : null}
+      {open && questions !== null ? (
+        // Numbers hang in the icon slot so each question starts under the label.
+        <ol className="list-decimal space-y-1 pl-5.5 text-sm leading-relaxed text-foreground/85 marker:text-muted-foreground">
+          {questions.map((entry) => (
+            <li key={entry} className="whitespace-pre-wrap break-words">
+              {entry}
+            </li>
+          ))}
+        </ol>
+      ) : null}
     </div>
   )
 }
diff --git a/src/renderer/src/components/native-chat/NativeChatDeliveryRetry.test.tsx b/src/renderer/src/components/native-chat/NativeChatDeliveryRetry.test.tsx
new file mode 100644
index 000000000000..a897588f7c54
--- /dev/null
+++ b/src/renderer/src/components/native-chat/NativeChatDeliveryRetry.test.tsx
@@ -0,0 +1,57 @@
+// @vitest-environment happy-dom
+import '@testing-library/jest-dom/vitest'
+import { cleanup, render, screen } from '@testing-library/react'
+import { afterEach, describe, expect, it } from 'vitest'
+import {
+  createStructuredAgentSessionOutboxEntry,
+  type StructuredAgentSessionOutboxEntry
+} from '../../../../shared/structured-agent-session-outbox'
+import { NativeChatDeliveryRetry } from './NativeChatDeliveryRetry'
+
+const blocked = createStructuredAgentSessionOutboxEntry({
+  clientMessageId: 'client-1',
+  sessionId: 'session-1',
+  text: 'hello',
+  attachments: [],
+  queuedAt: 1
+})
+
+function renderRow(entry: StructuredAgentSessionOutboxEntry): void {
+  render(
+    <NativeChatDeliveryRetry
+      outbox={[entry]}
+      blockedClientMessageId={entry.clientMessageId}
+      retry={() => {}}
+    />
+  )
+}
+
+afterEach(cleanup)
+
+describe("the Retry row's reason", () => {
+  it('chooses its words from the saved failure when it is shown', () => {
+    renderRow({
+      ...blocked,
+      lastFailure: { kind: 'refused', code: 'agent_session_owner_restart_failed' }
+    })
+
+    expect(
+      screen.getByText("The agent couldn't restart. Your message was not sent.")
+    ).toBeInTheDocument()
+  })
+
+  it("shows a provider's rejection in the provider's words", () => {
+    renderRow({
+      ...blocked,
+      lastFailure: { kind: 'rejected', reason: 'Claude messages support at most 20 images' }
+    })
+
+    expect(screen.getByText('Claude messages support at most 20 images')).toBeInTheDocument()
+  })
+
+  it('says only that the message was not sent when nothing more is known', () => {
+    renderRow(blocked)
+
+    expect(screen.getByText('Message was not sent.')).toBeInTheDocument()
+  })
+})
diff --git a/src/renderer/src/components/native-chat/NativeChatDeliveryRetry.tsx b/src/renderer/src/components/native-chat/NativeChatDeliveryRetry.tsx
index 5958e2a8d543..e37016d646d2 100644
--- a/src/renderer/src/components/native-chat/NativeChatDeliveryRetry.tsx
+++ b/src/renderer/src/components/native-chat/NativeChatDeliveryRetry.tsx
@@ -3,6 +3,8 @@ import {
   admitStructuredAgentSessionOutboxEntry,
   type StructuredAgentSessionOutboxEntry
 } from '../../../../shared/structured-agent-session-outbox'
+import { structuredAgentSessionAttemptFailureParts } from '../../../../shared/structured-agent-session-send-disposition'
+import { agentSessionWriteNoticeText } from './agent-session-write-notice-text'
 import { Button } from '@/components/ui/button'
 import { translate } from '@/i18n/i18n'
 
@@ -16,9 +18,13 @@ export function NativeChatDeliveryRetry({
   retry: (clientMessageId: string) => void
 }): React.JSX.Element | null {
   // Why: read through the drain's own rule, so Retry can never name an entry other than the one
-  // the queue actually stopped on -- which is no longer always the head.
+  // the queue actually stopped on -- which is no longer always the head. A rejected entry holds
+  // nothing up, so it is offered only when the queue itself is not stopped.
   const admission = admitStructuredAgentSessionOutboxEntry(outbox, blockedClientMessageId)
-  const retryable = admission.state === 'blocked' ? admission.entry : null
+  const retryable =
+    admission.state === 'blocked'
+      ? admission.entry
+      : (outbox.find((entry) => entry.state === 'rejected') ?? null)
   if (!retryable) {
     return null
   }
@@ -30,10 +36,14 @@ export function NativeChatDeliveryRetry({
               'auto.components.native.chat.NativeChatStructuredSession.1f772bb5d0',
               'Message delivery is unconfirmed.'
             )
-          : translate(
-              'auto.components.native.chat.NativeChatStructuredSession.93ef441197',
-              'Message was not sent.'
-            )}
+          : retryable.lastFailure
+            ? agentSessionWriteNoticeText(
+                structuredAgentSessionAttemptFailureParts(retryable.lastFailure)
+              )
+            : translate(
+                'auto.components.native.chat.NativeChatStructuredSession.93ef441197',
+                'Message was not sent.'
+              )}
       </span>
       <Button
         type="button"
diff --git a/src/renderer/src/components/native-chat/NativeChatEmptyState.test.tsx b/src/renderer/src/components/native-chat/NativeChatEmptyState.test.tsx
new file mode 100644
index 000000000000..dc2639afca20
--- /dev/null
+++ b/src/renderer/src/components/native-chat/NativeChatEmptyState.test.tsx
@@ -0,0 +1,38 @@
+// @vitest-environment happy-dom
+
+import '@testing-library/jest-dom/vitest'
+
+import { cleanup, render, screen } from '@testing-library/react'
+import { afterEach, expect, it } from 'vitest'
+import { NativeChatEmptyState } from './NativeChatEmptyState'
+
+afterEach(cleanup)
+
+it('keeps pointing the terminal-backed chat back to its terminal when a read fails', () => {
+  render(<NativeChatEmptyState kind="error" />)
+  expect(
+    screen.getByText(
+      'The transcript could not be read. Toggle back to the terminal to keep working.'
+    )
+  ).toBeInTheDocument()
+})
+
+it('tells the structured chat its read keeps retrying', () => {
+  render(<NativeChatEmptyState kind="error" retrying />)
+  expect(
+    screen.getByText('The transcript could not be read. Orca keeps trying to load it.')
+  ).toBeInTheDocument()
+})
+
+it('shows the host message in place of the terminal-backed default', () => {
+  render(<NativeChatEmptyState kind="error" message="disk full" />)
+  expect(screen.getByText('disk full')).toBeInTheDocument()
+  expect(screen.queryByText(/Toggle back to the terminal/)).toBeNull()
+})
+
+it('keeps the structured chat retrying line when the host sent a message', () => {
+  render(<NativeChatEmptyState kind="error" retrying message="disk full" />)
+  expect(
+    screen.getByText('The transcript could not be read. Orca keeps trying to load it.')
+  ).toBeInTheDocument()
+})
diff --git a/src/renderer/src/components/native-chat/NativeChatEmptyState.tsx b/src/renderer/src/components/native-chat/NativeChatEmptyState.tsx
index f7c20ef51f45..ed2299d2fc29 100644
--- a/src/renderer/src/components/native-chat/NativeChatEmptyState.tsx
+++ b/src/renderer/src/components/native-chat/NativeChatEmptyState.tsx
@@ -7,13 +7,17 @@ import type { NativeChatSession } from '../../../../shared/native-chat-types'
 export function NativeChatEmptyState({
   kind,
   message,
-  agent
+  agent,
+  retrying = false
 }: {
   kind: 'loading' | 'empty' | 'error' | 'not-agent'
   message?: string
   agent?: NativeChatSession['agent']
+  /** The read retries on its own (structured chat), so the error says so instead of pointing
+   *  back to the terminal. The host's message is on the pane's status line already. */
+  retrying?: boolean
 }): React.JSX.Element {
-  const copy = emptyStateCopy(kind, message, agent)
+  const copy = emptyStateCopy(kind, message, agent, retrying)
   return (
     <div className="flex h-full w-full flex-col items-center justify-center gap-3 p-6 text-center">
       <div
@@ -40,7 +44,8 @@ export function NativeChatEmptyState({
 function emptyStateCopy(
   kind: 'loading' | 'empty' | 'error' | 'not-agent',
   message?: string,
-  agent?: NativeChatSession['agent']
+  agent?: NativeChatSession['agent'],
+  retrying = false
 ): { title: string; subtitle: string | null } {
   switch (kind) {
     case 'loading':
@@ -60,12 +65,16 @@ function emptyStateCopy(
           'components.native-chat.state.error.title',
           NATIVE_CHAT_EMPTY_STATE_COPY.error.title
         ),
-        subtitle:
-          message ??
-          translate(
-            'components.native-chat.state.error.subtitle',
-            NATIVE_CHAT_EMPTY_STATE_COPY.error.subtitle
-          )
+        subtitle: retrying
+          ? translate(
+              'components.native-chat.state.error.retryingSubtitle',
+              NATIVE_CHAT_EMPTY_STATE_COPY.retryingError.subtitle
+            )
+          : (message ??
+            translate(
+              'components.native-chat.state.error.subtitle',
+              NATIVE_CHAT_EMPTY_STATE_COPY.error.subtitle
+            ))
       }
     case 'not-agent':
       return {
diff --git a/src/renderer/src/components/native-chat/NativeChatMessageList.task-list-frames.test.tsx b/src/renderer/src/components/native-chat/NativeChatMessageList.task-list-frames.test.tsx
index 1408342336a0..4be1ea7cdb38 100644
--- a/src/renderer/src/components/native-chat/NativeChatMessageList.task-list-frames.test.tsx
+++ b/src/renderer/src/components/native-chat/NativeChatMessageList.task-list-frames.test.tsx
@@ -113,6 +113,8 @@ describe('live Codex checklist frames', () => {
       role: 'assistant',
       timestamp: 1,
       source: 'transcript',
+      // Journalled like the frames it sits between.
+      journalPosition: { sequence: 1, index: 0 },
       blocks: [
         {
           type: 'tool-call',
diff --git a/src/renderer/src/components/native-chat/NativeChatMessageList.tsx b/src/renderer/src/components/native-chat/NativeChatMessageList.tsx
index 626315f73e08..d8ea96d2f0cd 100644
--- a/src/renderer/src/components/native-chat/NativeChatMessageList.tsx
+++ b/src/renderer/src/components/native-chat/NativeChatMessageList.tsx
@@ -394,7 +394,7 @@ export function NativeChatMessageList({
                 {showTurnStatus && showLiveTurnActivity && isWorking ? (
                   <NativeChatTurnActivityLine
                     activity={turnActivity}
-                    status={turnStatuses.active}
+                    thinking={turnStatuses.active?.thinking === true}
                   />
                 ) : null}
                 {!showTurnStatus && showTypingIndicator ? <NativeChatTypingIndicatorRow /> : null}
diff --git a/src/renderer/src/components/native-chat/NativeChatMessageList.turn-indicator.test.tsx b/src/renderer/src/components/native-chat/NativeChatMessageList.turn-indicator.test.tsx
index 4c72c96a194b..b58c91fe31fe 100644
--- a/src/renderer/src/components/native-chat/NativeChatMessageList.turn-indicator.test.tsx
+++ b/src/renderer/src/components/native-chat/NativeChatMessageList.turn-indicator.test.tsx
@@ -56,7 +56,8 @@ const session: NativeChatLiveSession = {
   readPhase: 'ready'
 }
 
-// The live turn renders exactly one indicator row; a settled turn keeps its own.
+// The live turn has two rows: the clock bar under the prompt, and a tail line that
+// says what the turn is doing. A settled turn keeps only the bar.
 describe('NativeChatMessageList turn indicator', () => {
   it('keeps a reduced-motion-safe spinner on the live row of a no-tool Codex turn', () => {
     render(
@@ -87,7 +88,7 @@ describe('NativeChatMessageList turn indicator', () => {
       />
     )
 
-    const activity = screen.getByText('Working for 0s')
+    const activity = screen.getByText('Working…')
     const row = activity.closest('[data-native-chat-turn-activity]')
     const spinner = row?.querySelector('svg')
     expect(activity).not.toHaveClass('animate-pulse', 'animate-spin')
@@ -131,7 +132,7 @@ describe('NativeChatMessageList turn indicator', () => {
     expect(toolLabel).toHaveClass('animate-pulse')
     expect(screen.getAllByText('Running 1 command')).toHaveLength(1)
     expect(screen.getByText('pnpm test')).toBeInTheDocument()
-    const activity = screen.getByText('Working for 0s')
+    const activity = screen.getByText('Working…')
     expect(activity.textContent).not.toBe(toolLabel.textContent)
     expect(activity).not.toHaveTextContent('shell')
     expect(activity).not.toHaveTextContent('pnpm test')
@@ -209,7 +210,7 @@ describe('NativeChatMessageList turn indicator', () => {
 
     // The settled run heads with the command it ran; the live row is separate.
     const settledTool = screen.getByText('pnpm test')
-    const activity = screen.getByText('Working for 0s')
+    const activity = screen.getByText('Working…')
     expect(activity.textContent).not.toBe(settledTool.textContent)
     expect(activity).not.toHaveTextContent('shell')
     expect(activity).not.toHaveTextContent('pnpm test')
@@ -390,7 +391,7 @@ describe('NativeChatMessageList turn indicator', () => {
     expect(screen.queryByText(/AskUserQuestion/)).toBeNull()
   })
 
-  it('reads "Thinking" on the one live row while the turn is reasoning', () => {
+  it('reads "Thinking" on the tail line while the bar keeps the clock', () => {
     const { container } = render(
       <NativeChatMessageList
         session={{
@@ -414,10 +415,12 @@ describe('NativeChatMessageList turn indicator', () => {
     )
 
     const user = screen.getByText('Start the task')
+    const bar = screen.getByText('Working for 0s')
     const thinking = screen.getByText('Thinking')
-    expect(user.compareDocumentPosition(thinking)).toBe(Node.DOCUMENT_POSITION_FOLLOWING)
-    // One indicator, not a "Thinking" row stacked above a spinning "Working…" row.
-    expect(container.querySelectorAll('[data-native-chat-turn-status]')).toHaveLength(1)
+    expect(user.compareDocumentPosition(bar)).toBe(Node.DOCUMENT_POSITION_FOLLOWING)
+    expect(bar.compareDocumentPosition(thinking)).toBe(Node.DOCUMENT_POSITION_FOLLOWING)
+    expect(screen.getAllByText('Thinking')).toHaveLength(1)
+    expect(screen.queryByText('Working…')).toBeNull()
     expect(thinking.closest('[data-native-chat-turn-activity]')?.querySelector('svg')).toHaveClass(
       'animate-spin'
     )
@@ -451,10 +454,10 @@ describe('NativeChatMessageList turn indicator', () => {
     )
 
     expect(screen.queryByText('Thinking')).toBeNull()
-    expect(screen.getByText('Working for 0s')).toBeInTheDocument()
+    expect(screen.getByText('Working…')).toBeInTheDocument()
   })
 
-  it('lets provider activity text beat the reasoning label on the same single row', () => {
+  it('lets provider activity text beat the reasoning label on the tail line', () => {
     const { container } = render(
       <NativeChatMessageList
         session={{
@@ -480,10 +483,11 @@ describe('NativeChatMessageList turn indicator', () => {
 
     expect(screen.getByText('Exploring the repo layout')).toBeInTheDocument()
     expect(screen.queryByText('Thinking')).toBeNull()
+    expect(container.querySelectorAll('[data-native-chat-turn-activity]')).toHaveLength(1)
     expect(container.querySelectorAll('[data-native-chat-turn-status]')).toHaveLength(1)
   })
 
-  it('places the one live row after the newest content in the turn', () => {
+  it('puts the clock bar under the prompt and the tail line after the newest content', () => {
     render(
       <NativeChatMessageList
         session={{
@@ -512,20 +516,35 @@ describe('NativeChatMessageList turn indicator', () => {
       />
     )
 
-    const status = screen.getByText('Working for 0s')
+    const user = screen.getByText('Run the checks')
+    const bar = screen.getByText('Working for 0s')
     const assistant = screen.getByText('I am checking now.')
-    // The live row trails the newest content instead of sitting under the prompt.
-    expect(assistant.compareDocumentPosition(status)).toBe(Node.DOCUMENT_POSITION_FOLLOWING)
-    expect(document.querySelectorAll('[data-native-chat-turn-status]')).toHaveLength(1)
+    const tail = screen.getByText('Working…')
+    expect(user.compareDocumentPosition(bar)).toBe(Node.DOCUMENT_POSITION_FOLLOWING)
+    expect(bar.compareDocumentPosition(assistant)).toBe(Node.DOCUMENT_POSITION_FOLLOWING)
+    expect(assistant.compareDocumentPosition(tail)).toBe(Node.DOCUMENT_POSITION_FOLLOWING)
+    expect(bar.closest('[data-native-chat-turn-status]')).toHaveAttribute(
+      'data-native-chat-turn-status',
+      'active'
+    )
+    // The clock is said once, on the bar.
+    expect(screen.getAllByText(/Working for/)).toHaveLength(1)
   })
 
-  it('shows elapsed working time once tool activity starts', () => {
+  it('shows elapsed working time on the bar while a tool runs', () => {
     render(
       <NativeChatMessageList
         session={{
           ...session,
           status: 'working',
           messages: [
+            {
+              id: 'user-tool',
+              role: 'user',
+              blocks: [{ type: 'text', text: 'Wait a bit' }],
+              timestamp: 1,
+              source: 'transcript'
+            },
             {
               id: 'tool-1',
               role: 'assistant',
@@ -583,6 +602,11 @@ describe('NativeChatMessageList turn indicator', () => {
         fontScale={1}
       />
     )
+    // The live bar sits where the settled one will, so settling never moves it.
+    const liveBar = screen.getByText('Working for 3s')
+    expect(screen.getByText('Complete this task').compareDocumentPosition(liveBar)).toBe(
+      Node.DOCUMENT_POSITION_FOLLOWING
+    )
 
     rerender(
       <NativeChatMessageList
@@ -596,6 +620,10 @@ describe('NativeChatMessageList turn indicator', () => {
 
     const user = screen.getByText('Complete this task')
     const status = screen.getByText('Worked for 3s')
+    // Settled in place: the same bar, not a remount.
+    expect(status.closest('[data-native-chat-turn-status]')).toBe(
+      liveBar.closest('[data-native-chat-turn-status]')
+    )
     const assistant = screen.getByText('Task complete.')
     expect(user.compareDocumentPosition(status)).toBe(Node.DOCUMENT_POSITION_FOLLOWING)
     expect(status.compareDocumentPosition(assistant)).toBe(Node.DOCUMENT_POSITION_FOLLOWING)
diff --git a/src/renderer/src/components/native-chat/NativeChatQuestionCard.test.tsx b/src/renderer/src/components/native-chat/NativeChatQuestionCard.test.tsx
index 9b1a29676820..189815f24786 100644
--- a/src/renderer/src/components/native-chat/NativeChatQuestionCard.test.tsx
+++ b/src/renderer/src/components/native-chat/NativeChatQuestionCard.test.tsx
@@ -69,6 +69,21 @@ function clickAction(text: string): void {
   click(button, text)
 }
 
+function typeAnswer(value: string): void {
+  const input = container.querySelector('input')!
+  act(() => {
+    const setter = Object.getOwnPropertyDescriptor(HTMLInputElement.prototype, 'value')!.set!
+    setter.call(input, value)
+    input.dispatchEvent(new Event('input', { bubbles: true }))
+  })
+}
+
+function optionPressed(label: string): string | null | undefined {
+  return [...container.querySelectorAll('button[aria-pressed]')]
+    .find((b) => b.textContent?.includes(label))
+    ?.getAttribute('aria-pressed')
+}
+
 const tabsOrSpaces: AskPrompt = {
   questions: [
     {
@@ -222,4 +237,123 @@ describe('NativeChatQuestionCard', () => {
       { indices: [], other: 'SSH host' }
     ])
   })
+
+  it('replaces a picked option with a typed answer on a single-select question', () => {
+    const onAnswer = vi.fn()
+    render(tabsOrSpaces, onAnswer)
+
+    clickOption('Spaces')
+    typeAnswer('two spaces')
+    expect(optionPressed('Spaces')).toBe('false')
+    clickAction('Submit')
+
+    expect(onAnswer).toHaveBeenCalledWith([{ indices: [], other: 'two spaces' }])
+  })
+
+  it('keeps typed text in the field but sends a later-picked option', () => {
+    const onAnswer = vi.fn()
+    render(tabsOrSpaces, onAnswer)
+
+    typeAnswer('two spaces')
+    clickOption('Tabs')
+    expect(container.querySelector('input')!.value).toBe('two spaces')
+    clickAction('Submit')
+
+    expect(onAnswer).toHaveBeenCalledWith([{ indices: [0], other: '' }])
+  })
+
+  it('chooses the kept typed text again when its field is clicked', () => {
+    const onAnswer = vi.fn()
+    render(tabsOrSpaces, onAnswer)
+
+    typeAnswer('two spaces')
+    clickOption('Tabs')
+    act(() => {
+      container.querySelector('input')!.dispatchEvent(new MouseEvent('click', { bubbles: true }))
+    })
+    expect(optionPressed('Tabs')).toBe('false')
+    clickAction('Submit')
+
+    expect(onAnswer).toHaveBeenCalledWith([{ indices: [], other: 'two spaces' }])
+  })
+
+  it('ignores a click on the answer field while the answer is sending', () => {
+    const renderCard = (isSubmitting: boolean): void => {
+      act(() => {
+        root.render(
+          <NativeChatQuestionCard
+            prompt={tabsOrSpaces}
+            onAnswer={vi.fn()}
+            onCancel={() => {}}
+            isSubmitting={isSubmitting}
+          />
+        )
+      })
+    }
+    renderCard(false)
+    typeAnswer('two spaces')
+    clickOption('Tabs')
+    renderCard(true)
+    // Chromium still delivers pointer events to a disabled input.
+    const input = container.querySelector('input')!
+    act(() => {
+      input.dispatchEvent(new MouseEvent('pointerdown', { bubbles: true }))
+      input.dispatchEvent(new MouseEvent('click', { bubbles: true }))
+    })
+
+    expect(optionPressed('Tabs')).toBe('true')
+  })
+
+  it('keeps the picked option when keyboard focus passes through the field', () => {
+    const onAnswer = vi.fn()
+    render(tabsOrSpaces, onAnswer)
+
+    typeAnswer('two spaces')
+    clickOption('Tabs')
+    act(() => {
+      container.querySelector('input')!.dispatchEvent(new FocusEvent('focusin', { bubbles: true }))
+    })
+    clickAction('Submit')
+
+    expect(onAnswer).toHaveBeenCalledWith([{ indices: [0], other: '' }])
+  })
+
+  it('leaves nothing chosen when a picked option is unpicked over kept text', () => {
+    const onAnswer = vi.fn()
+    render(tabsOrSpaces, onAnswer)
+
+    typeAnswer('two spaces')
+    clickOption('Tabs')
+    clickOption('Tabs')
+
+    expect(optionPressed('Tabs')).toBe('false')
+    expect(
+      [...container.querySelectorAll('button')].some((b) => b.textContent?.trim() === 'Skip')
+    ).toBe(true)
+    expect(onAnswer).not.toHaveBeenCalled()
+  })
+
+  it('sends picked options and typed text together on a multi-select question', () => {
+    const onAnswer = vi.fn()
+    render(
+      {
+        questions: [
+          {
+            question: 'Which targets?',
+            multiSelect: true,
+            options: [{ label: 'Web' }, { label: 'Mobile' }]
+          }
+        ]
+      },
+      onAnswer
+    )
+
+    clickOption('Mobile')
+    typeAnswer('Desktop')
+    typeAnswer('')
+    typeAnswer('Desktop app')
+    clickAction('Submit')
+
+    expect(onAnswer).toHaveBeenCalledWith([{ indices: [1], other: 'Desktop app' }])
+  })
 })
diff --git a/src/renderer/src/components/native-chat/NativeChatQuestionCard.tsx b/src/renderer/src/components/native-chat/NativeChatQuestionCard.tsx
index 0167fbb61f39..e26131d96f09 100644
--- a/src/renderer/src/components/native-chat/NativeChatQuestionCard.tsx
+++ b/src/renderer/src/components/native-chat/NativeChatQuestionCard.tsx
@@ -18,11 +18,16 @@ export type NativeChatQuestionCardProps = {
   answerInputRef?: RefObject<HTMLInputElement | null>
 }
 
+// Selection entry for the typed answer (never a real option index), so a single-select
+// question holds exactly one choice: an option or the typed answer.
+const TYPED_ANSWER = -1
+
 /**
  * Native renderer for an agent's AskUserQuestion prompt: a numbered pick-list
  * (mobile/Claude-Code parity) with a header + close, a hover-highlighted row per
  * option, and an optional free-text row for a custom answer. Single-select
- * commits on click; multi-select toggles and confirms via the trailing action.
+ * holds one answer (an option or the typed text, whichever was chosen last);
+ * multi-select toggles options, adds any typed text, and confirms via the trailing action.
  * Multi-question prompts step through tabs across the top. Neutral shadcn tokens.
  */
 export function NativeChatQuestionCard({
@@ -44,29 +49,55 @@ export function NativeChatQuestionCard({
   const q = prompt.questions[index]!
   const questionAllowsOther = Array.isArray(allowOther) ? (allowOther[index] ?? false) : allowOther
 
+  // Picking an option replaces a chosen typed answer on single-select; the text stays in
+  // the field, unsent, until the user types or clicks there again.
+  const typedAnswerChosen = (qi: number, sel = selections, oth = otherText): boolean =>
+    (sel[qi] ?? []).includes(TYPED_ANSWER) && (oth[qi] ?? '').trim().length > 0
+
+  const chooseTypedAnswer = (qi: number): void => {
+    setSelections((prev) => {
+      const cur = prev[qi] ?? []
+      if (cur.includes(TYPED_ANSWER)) {
+        return prev
+      }
+      const chosen = prompt.questions[qi]?.multiSelect ? [...cur, TYPED_ANSWER] : [TYPED_ANSWER]
+      return prev.map((s, i) => (i === qi ? chosen : s))
+    })
+  }
+
+  const pickedOptions = (qi: number, sel = selections): number[] =>
+    (sel[qi] ?? []).filter((choice) => choice !== TYPED_ANSWER)
+
   const setOther = (qi: number, value: string): void => {
     setOtherText((prev) => {
       const next = [...prev]
       next[qi] = value
       return next
     })
+    if (value.trim().length > 0) {
+      chooseTypedAnswer(qi)
+    }
   }
 
-  // The resolved answer for a question: picked labels plus any typed free-text.
+  // The resolved answer for a question: picked labels plus the typed answer when chosen.
   const answerFor = (qi: number, sel = selections, oth = otherText): string => {
     const question = prompt.questions[qi]
-    const picked = (sel[qi] ?? [])
+    const picked = pickedOptions(qi, sel)
       .map((optionIndex) => question?.options[optionIndex]?.label ?? '')
       .filter((label) => label.length > 0)
-    const other = (oth[qi] ?? '').trim()
+    const other = typedAnswerChosen(qi, sel, oth) ? (oth[qi] ?? '').trim() : ''
     return [...picked, ...(other ? [other] : [])].join(', ')
   }
 
   const currentAnswered = answerFor(index).length > 0
+  const currentTypedAnswerChosen = typedAnswerChosen(index)
 
   const submitAll = (sel: number[][], oth: string[]): void => {
     const resolved: AskAnswerSelection[] = prompt.questions.map((_, i) => {
-      return { indices: [...(sel[i] ?? [])], other: (oth[i] ?? '').trim() }
+      return {
+        indices: pickedOptions(i, sel),
+        other: typedAnswerChosen(i, sel, oth) ? (oth[i] ?? '').trim() : ''
+      }
     })
     const anyAnswered = resolved.some((s) => s.indices.length > 0 || (s.other ?? '').length > 0)
     if (anyAnswered) {
@@ -192,8 +223,19 @@ export function NativeChatQuestionCard({
             <div className="flex items-center gap-3 px-3.5 py-2.5">
               {questionAllowsOther ? (
                 <>
-                  <span className="flex size-6 shrink-0 items-center justify-center rounded-md bg-muted text-muted-foreground">
-                    <Pencil className="size-3.5" />
+                  <span
+                    className={cn(
+                      'flex size-6 shrink-0 items-center justify-center rounded-md',
+                      currentTypedAnswerChosen
+                        ? 'bg-primary text-primary-foreground'
+                        : 'bg-muted text-muted-foreground'
+                    )}
+                  >
+                    {currentTypedAnswerChosen ? (
+                      <Check className="size-3.5" strokeWidth={3} />
+                    ) : (
+                      <Pencil className="size-3.5" />
+                    )}
                   </span>
                   {/* No `/` or `@` picker here — that autocomplete belongs to the composer,
                       which this card replaces. What you type is delivered verbatim as the
@@ -205,6 +247,13 @@ export function NativeChatQuestionCard({
                     disabled={isSubmitting}
                     value={otherText[index]}
                     onChange={(e) => setOther(index, e.target.value)}
+                    // Click, not focus: tabbing through the field toward Submit must not
+                    // replace the option the user just picked.
+                    onClick={() => {
+                      if ((otherText[index] ?? '').trim().length > 0) {
+                        chooseTypedAnswer(index)
+                      }
+                    }}
                     onKeyDown={(e) => {
                       if (e.key === 'Enter') {
                         e.preventDefault()
@@ -215,7 +264,12 @@ export function NativeChatQuestionCard({
                       'components.native-chat.question.otherPlaceholder',
                       'Type your answer'
                     )}
-                    className="min-w-0 flex-1 bg-transparent text-sm text-foreground outline-none placeholder:text-muted-foreground/60 disabled:cursor-default disabled:opacity-50"
+                    className={cn(
+                      'min-w-0 flex-1 bg-transparent text-sm outline-none placeholder:text-muted-foreground/60 disabled:cursor-default disabled:opacity-50',
+                      currentTypedAnswerChosen || !otherText[index]
+                        ? 'text-foreground'
+                        : 'text-muted-foreground'
+                    )}
                   />
                 </>
               ) : (
diff --git a/src/renderer/src/components/native-chat/NativeChatResolutionReceipt.test.tsx b/src/renderer/src/components/native-chat/NativeChatResolutionReceipt.test.tsx
index 8dc70aab15e1..72f1f62c21d3 100644
--- a/src/renderer/src/components/native-chat/NativeChatResolutionReceipt.test.tsx
+++ b/src/renderer/src/components/native-chat/NativeChatResolutionReceipt.test.tsx
@@ -1,11 +1,19 @@
 // @vitest-environment happy-dom
 import '@testing-library/jest-dom/vitest'
-import { act, cleanup, render, screen } from '@testing-library/react'
+import { act, cleanup, fireEvent, render, screen } from '@testing-library/react'
 import { afterEach, describe, expect, it } from 'vitest'
 import { i18n } from '@/i18n/i18n'
-import type { AgentJournalQuestionItem } from '../../../../shared/agent-session-journal-types'
+import type {
+  AgentJournalQuestionItem,
+  AgentJournalRenderItem
+} from '../../../../shared/agent-session-journal-types'
 import { encodeAgentSessionQuestionAnswers } from '../../../../shared/agent-session-question-answer'
 import { NativeChatResolutionReceipt } from './NativeChatResolutionReceipt'
+import { structuredQuestionTranscript } from './structured-agent-question-projection'
+import {
+  NativeChatDisclosureContext,
+  useNativeChatDisclosures
+} from './native-chat-disclosure-store'
 import {
   nativeChatReceiptAnswers,
   type NativeChatResolvedPrompt
@@ -210,6 +218,203 @@ describe('resolution receipts', () => {
     expect(screen.queryByText('1 grouped question from Claude')).toBeNull()
   })
 
+  it('keeps an opened question open once it is answered', () => {
+    const scrollWidth = Object.getOwnPropertyDescriptor(HTMLElement.prototype, 'scrollWidth')
+    Object.defineProperty(HTMLElement.prototype, 'scrollWidth', {
+      configurable: true,
+      get: () => 400
+    })
+    const pendingBody: AgentJournalQuestionItem = {
+      kind: 'question',
+      question: 'Which of the three migration strategies should I use?',
+      options: [{ id: 'a', label: 'Strategy A' }],
+      resolution: { ...approval.resolution, state: 'pending', selectedOptionId: null }
+    }
+    function Harness({ body }: { body: AgentJournalQuestionItem }): React.JSX.Element {
+      const disclosures = useNativeChatDisclosures()
+      return (
+        <NativeChatDisclosureContext.Provider value={disclosures}>
+          <NativeChatResolutionReceipt body={body} disclosureId="message-1" />
+        </NativeChatDisclosureContext.Provider>
+      )
+    }
+    try {
+      const { rerender } = render(<Harness body={pendingBody} />)
+      fireEvent.click(screen.getByRole('button', { name: /Awaiting user input:/ }))
+
+      rerender(
+        <Harness
+          body={{ ...pendingBody, resolution: { ...approval.resolution, selectedOptionId: 'a' } }}
+        />
+      )
+      expect(screen.getByRole('button', { name: /Asked:/ })).toHaveAttribute(
+        'aria-expanded',
+        'true'
+      )
+    } finally {
+      if (scrollWidth) {
+        Object.defineProperty(HTMLElement.prototype, 'scrollWidth', scrollWidth)
+      } else {
+        Reflect.deleteProperty(HTMLElement.prototype, 'scrollWidth')
+      }
+    }
+  })
+
+  describe('a grouped question', () => {
+    const FIRST = 'Which of the three migration strategies should I use for the orders table?'
+    const SECOND = 'Should the old columns be dropped in the same release?'
+    const grouped: AgentJournalQuestionItem = {
+      kind: 'question',
+      question: '2 grouped questions from Claude',
+      options: [],
+      questions: [
+        { id: 'q1', question: FIRST, multiSelect: false, options: [{ id: 'a', label: 'A' }] },
+        { id: 'q2', question: SECOND, multiSelect: false, options: [{ id: 'y', label: 'Yes' }] }
+      ],
+      resolution: { state: 'cancelled', selectedOptionId: null, resolvedBy: null, resolvedAt: null }
+    }
+
+    function Harness({
+      body,
+      mounted = true
+    }: {
+      body: AgentJournalQuestionItem
+      mounted?: boolean
+    }): React.JSX.Element {
+      const disclosures = useNativeChatDisclosures()
+      return (
+        <NativeChatDisclosureContext.Provider value={disclosures}>
+          {mounted ? <NativeChatResolutionReceipt body={body} disclosureId="message-1" /> : null}
+        </NativeChatDisclosureContext.Provider>
+      )
+    }
+
+    it('lists every question of a cancelled prompt below its toggle', () => {
+      const { rerender } = render(<Harness body={grouped} />)
+      const toggle = screen.getByRole('button', { name: /Asked:\s*2 questions/ })
+      expect(toggle).toHaveAttribute('aria-expanded', 'false')
+      expect(screen.queryByText(FIRST)).toBeNull()
+
+      fireEvent.click(toggle)
+      expect(toggle).toHaveAttribute('aria-expanded', 'true')
+      // The count stays on the line; the list opens outside the button, as prose.
+      expect(toggle).toHaveTextContent('2 questions')
+      const items = screen.getAllByRole('listitem')
+      expect(items.map((item) => item.textContent)).toEqual([FIRST, SECOND])
+      expect(items[0]?.closest('button')).toBeNull()
+      fireEvent.click(items[0]!)
+      expect(toggle).toHaveAttribute('aria-expanded', 'true')
+
+      rerender(<Harness body={grouped} mounted={false} />)
+      rerender(<Harness body={grouped} />)
+      const remounted = screen.getByRole('button', { name: /Asked:/ })
+      expect(remounted).toHaveAttribute('aria-expanded', 'true')
+      expect(screen.getByText(SECOND)).toBeInTheDocument()
+
+      // Folding keeps the same control, so keyboard focus is not dropped.
+      remounted.focus()
+      fireEvent.click(remounted)
+      expect(document.activeElement).toBe(remounted)
+      expect(remounted).toHaveAttribute('aria-expanded', 'false')
+      expect(screen.queryByRole('list')).toBeNull()
+    })
+
+    it('lists the questions of a pending group the card may not be showing', () => {
+      render(
+        <Harness body={{ ...grouped, resolution: { ...grouped.resolution, state: 'pending' } }} />
+      )
+      fireEvent.click(screen.getByRole('button', { name: /Awaiting user input:\s*2 questions/ }))
+      expect(screen.getAllByRole('listitem').map((item) => item.textContent)).toEqual([
+        FIRST,
+        SECOND
+      ])
+    })
+
+    it('does not carry an opened Codex group onto its first question once answered', () => {
+      const codexQuestion = (
+        itemId: string,
+        question: string,
+        resolution: AgentJournalQuestionItem['resolution'] = {
+          state: 'pending',
+          selectedOptionId: null,
+          resolvedBy: null,
+          resolvedAt: null
+        }
+      ): AgentJournalRenderItem => ({
+        itemId,
+        sequence: 1,
+        revision: 1,
+        observedAt: 1,
+        body: {
+          kind: 'question',
+          question,
+          options: [{ id: `${itemId}-a`, label: 'A' }],
+          resolution
+        }
+      })
+      const receiptFor = (items: AgentJournalRenderItem[]): AgentJournalQuestionItem => {
+        const body = structuredQuestionTranscript(items).receipts.get('message-1')
+        if (body?.kind !== 'question') {
+          throw new Error('expected a question receipt')
+        }
+        return body
+      }
+      const second = codexQuestion('message-2', SECOND)
+      const { rerender } = render(
+        <Harness body={receiptFor([codexQuestion('message-1', 'Branch?'), second])} />
+      )
+      fireEvent.click(screen.getByRole('button', { name: /Awaiting user input:\s*2 questions/ }))
+      expect(screen.getByText('Branch?')).toBeInTheDocument()
+
+      // Answering the first question gives it its own row under the group's id.
+      const answered = codexQuestion('message-1', 'Branch?', {
+        state: 'resolved',
+        selectedOptionId: 'message-1-a',
+        resolvedBy: null,
+        resolvedAt: 1000
+      })
+      rerender(<Harness body={receiptFor([answered, second])} />)
+      expect(screen.getByText('Branch?')).toHaveClass('truncate')
+      expect(screen.queryByRole('button')).toBeNull()
+    })
+
+    it('stays plain once answered, since each question is listed with its answer', () => {
+      render(
+        <Harness
+          body={{
+            ...grouped,
+            resolution: {
+              state: 'resolved',
+              selectedOptionId: null,
+              answers: [
+                { questionId: 'q1', optionIds: ['a'] },
+                { questionId: 'q2', optionIds: ['y'] }
+              ],
+              resolvedBy: null,
+              resolvedAt: 1000
+            }
+          }}
+        />
+      )
+      expect(screen.getByText('2 questions')).toBeInTheDocument()
+      expect(screen.queryByRole('button')).toBeNull()
+      expect(screen.getAllByText(FIRST)).toHaveLength(1)
+      expect(screen.getAllByText(SECOND)).toHaveLength(1)
+      expect(screen.getByText('Yes')).toBeInTheDocument()
+    })
+
+    it('leaves a cancelled single question that fits its line as plain text', () => {
+      render(
+        <Harness
+          body={{ ...grouped, question: FIRST, questions: grouped.questions?.slice(0, 1) }}
+        />
+      )
+      expect(screen.getByText(FIRST)).toHaveClass('truncate')
+      expect(screen.queryByRole('button')).toBeNull()
+      expect(screen.queryByRole('list')).toBeNull()
+    })
+  })
+
   it('decodes single free-text answers only for the declared question', () => {
     const body: AgentJournalQuestionItem = {
       kind: 'question',
@@ -225,4 +430,22 @@ describe('resolution receipts', () => {
       ).toEqual([{ question: null, answer: null }])
     }
   })
+
+  it('reads the recorded structured answers before the packed form', () => {
+    const typed = 'Wait for the capture to finish. '.repeat(50).trim()
+    const body: AgentJournalQuestionItem = {
+      kind: 'question',
+      question: 'Name?',
+      options: [{ id: 'q1:choice-1', label: 'Default' }],
+      freeTextQuestionId: 'q1',
+      resolution: {
+        ...approval.resolution,
+        // The packed copy only older clients read; it must not win over the recorded answer.
+        selectedOptionId: 'q1:choice-1',
+        answers: [{ questionId: 'q1', optionIds: [], other: typed }]
+      }
+    }
+
+    expect(nativeChatReceiptAnswers(body)).toEqual([{ question: null, answer: typed }])
+  })
 })
diff --git a/src/renderer/src/components/native-chat/NativeChatResolutionReceipt.tsx b/src/renderer/src/components/native-chat/NativeChatResolutionReceipt.tsx
index d6587fe9f001..a1906a27197b 100644
--- a/src/renderer/src/components/native-chat/NativeChatResolutionReceipt.tsx
+++ b/src/renderer/src/components/native-chat/NativeChatResolutionReceipt.tsx
@@ -8,15 +8,19 @@ import {
 } from './native-chat-resolution-receipt'
 
 export function NativeChatResolutionReceipt({
-  body
+  body,
+  disclosureId
 }: {
   body: NativeChatResolvedPrompt
+  /** Message this receipt stands in for; keys the question row's disclosure. */
+  disclosureId?: string
 }): React.JSX.Element | null {
+  const askDisclosureKey = disclosureId === undefined ? undefined : `ask:${disclosureId}`
   const subject: NativeChatAskRowSubject | null =
     body.kind !== 'question'
       ? null
       : body.questions && body.questions.length > 1
-        ? { kind: 'count', count: body.questions.length }
+        ? { kind: 'questions', questions: body.questions.map((entry) => entry.question) }
         : {
             kind: 'question',
             // Claude keeps a generic grouped label for a single multi-select
@@ -31,11 +35,12 @@ export function NativeChatResolutionReceipt({
           }
   if (body.resolution.state === 'pending') {
     return body.kind === 'question' ? (
-      <NativeChatAwaitingInputRow subject={subject} pending />
+      <NativeChatAwaitingInputRow subject={subject} pending disclosureKey={askDisclosureKey} />
     ) : null
   }
   const { resolution } = body
   const title = body.kind === 'approval' ? (body.displayName ?? body.title) : body.question
+  // Non-empty only once resolved, and then each question is listed with its answer.
   const answers = nativeChatReceiptAnswers(body)
   return (
     <div
@@ -43,7 +48,12 @@ export function NativeChatResolutionReceipt({
       data-native-chat-receipt={body.kind}
     >
       {body.kind === 'question' ? (
-        <NativeChatAwaitingInputRow pending={false} subject={subject} />
+        <NativeChatAwaitingInputRow
+          pending={false}
+          subject={subject}
+          disclosureKey={askDisclosureKey}
+          listsQuestions={answers.length === 0}
+        />
       ) : (
         <div className="font-medium">{title}</div>
       )}
diff --git a/src/renderer/src/components/native-chat/NativeChatStructuredSession.read-error.test.tsx b/src/renderer/src/components/native-chat/NativeChatStructuredSession.read-error.test.tsx
new file mode 100644
index 000000000000..8edcd625ef44
--- /dev/null
+++ b/src/renderer/src/components/native-chat/NativeChatStructuredSession.read-error.test.tsx
@@ -0,0 +1,53 @@
+// @vitest-environment happy-dom
+
+import { cleanup, render, screen } from '@testing-library/react'
+import { afterEach, expect, it, vi } from 'vitest'
+
+const { mocks, moduleFactories, resetStructuredSessionMocks } = await vi.hoisted(async () =>
+  (await import('./NativeChatStructuredSession.test-harness')).createStructuredSessionMocks()
+)
+
+vi.mock('@/runtime/structured-agent-session-client', () =>
+  moduleFactories.structuredAgentSessionClient()
+)
+vi.mock('./use-structured-agent-session', () => moduleFactories.useStructuredAgentSession())
+vi.mock('./use-native-chat-font-scale', () => moduleFactories.useNativeChatFontScale())
+vi.mock('./use-native-chat-file-link-context', () => moduleFactories.useNativeChatFileLinkContext())
+vi.mock('./use-native-chat-file-link-click', () => moduleFactories.useNativeChatFileLinkClick())
+vi.mock('./NativeChatMessageList', () => moduleFactories.nativeChatMessageList())
+vi.mock('./NativeChatComposer', () => moduleFactories.nativeChatComposer())
+vi.mock('./NativeChatApprovalCard', () => moduleFactories.nativeChatApprovalCard())
+vi.mock('./NativeChatQuestionCard', () => moduleFactories.nativeChatQuestionCard())
+
+import { NativeChatStructuredSession } from './NativeChatStructuredSession'
+
+afterEach(() => {
+  cleanup()
+  resetStructuredSessionMocks()
+})
+
+// The read transport always hands the pane the host's words, so the retrying line must not hide
+// behind them; those words show once, on the status line.
+it('says a failed read keeps retrying, and shows the host message once', () => {
+  mocks.status = 'error'
+  mocks.readError = 'journal unreadable'
+  mocks.messages = []
+
+  render(
+    <NativeChatStructuredSession
+      isVisible
+      isFocusedGroup
+      tabId="structured-read-error-tab"
+      sessionId="read-error-session"
+      target={{ kind: 'local' }}
+      agent="codex"
+    />
+  )
+
+  expect(screen.getByText('Could not load conversation')).toBeTruthy()
+  expect(
+    screen.getByText('The transcript could not be read. Orca keeps trying to load it.')
+  ).toBeTruthy()
+  expect(screen.getAllByText('journal unreadable')).toHaveLength(1)
+  expect(screen.queryByText(/Toggle back to the terminal/)).toBeNull()
+})
diff --git a/src/renderer/src/components/native-chat/NativeChatStructuredSession.test-harness.tsx b/src/renderer/src/components/native-chat/NativeChatStructuredSession.test-harness.tsx
index 86963cb542bb..5690c879db18 100644
--- a/src/renderer/src/components/native-chat/NativeChatStructuredSession.test-harness.tsx
+++ b/src/renderer/src/components/native-chat/NativeChatStructuredSession.test-harness.tsx
@@ -49,6 +49,7 @@ export function createStructuredSessionMocks() {
     controllerProps: nullable<{ transportEnabled?: boolean }>(),
     mode: 'static' as 'static' | 'outbox',
     status: 'ready' as 'idle' | 'loading' | 'ready' | 'error',
+    readError: nullable<string>(),
     messages: null as null | unknown[],
     messageListProps: initialMessageListProps,
     composerProps: null as null | {
@@ -123,7 +124,7 @@ export function createStructuredSessionMocks() {
                     }
                   ]),
             status: mocks.status,
-            error: outbox.error,
+            error: mocks.readError ?? outbox.error,
             hasOlder: mocks.hasOlder,
             loadingOlder: mocks.loadingOlder,
             olderHistoryGeneration: mocks.olderHistoryGeneration,
@@ -243,6 +244,7 @@ export function createStructuredSessionMocks() {
     mocks.controllerProps = null
     mocks.mode = 'static'
     mocks.status = 'ready'
+    mocks.readError = null
     mocks.messages = null
     mocks.messageListProps = null
     mocks.composerProps = null
diff --git a/src/renderer/src/components/native-chat/NativeChatStructuredSession.test.tsx b/src/renderer/src/components/native-chat/NativeChatStructuredSession.test.tsx
index 286ae50a3c8c..e766955b83ec 100644
--- a/src/renderer/src/components/native-chat/NativeChatStructuredSession.test.tsx
+++ b/src/renderer/src/components/native-chat/NativeChatStructuredSession.test.tsx
@@ -2,7 +2,6 @@
 
 import { act, cleanup, fireEvent, render, screen, waitFor } from '@testing-library/react'
 import { afterEach, describe, expect, it, vi } from 'vitest'
-import { decodeAgentSessionQuestionAnswers } from '../../../../shared/agent-session-question-answer'
 import type { AgentJournalRenderItem } from '../../../../shared/agent-session-journal-types'
 import { useAppStore } from '@/store'
 import {
@@ -293,7 +292,10 @@ describe('NativeChatStructuredSession', () => {
     expect(document.querySelector('[data-native-chat-background-tasks="true"]')).not.toBeNull()
 
     act(() => mocks.approvalCardProps?.onChoose('allow'))
-    expect(mocks.respond).toHaveBeenCalledWith(approvalItems[0], 'allow')
+    expect(mocks.respond).toHaveBeenCalledWith(approvalItems[0], {
+      kind: 'option',
+      optionId: 'allow'
+    })
     expect(mocks.messageListProps?.showLiveTurnActivity).toBe(false)
 
     act(() => mocks.approvalCardProps?.onCancel?.())
@@ -535,14 +537,16 @@ describe('NativeChatStructuredSession', () => {
       { indices: [0, 1], other: '' },
       { indices: [], other: 'SSH host' }
     ])
-    const encoded = mocks.respond.mock.calls[0]?.[1]
-    expect(decodeAgentSessionQuestionAnswers(encoded)).toEqual([
-      { questionId: 'q1', optionIds: ['target-web', 'target-mobile'] },
-      { questionId: 'q2', optionIds: [], other: 'SSH host' }
-    ])
+    expect(mocks.respond).toHaveBeenCalledWith(mocks.promptItems[0], {
+      kind: 'answers',
+      answers: [
+        { questionId: 'q1', optionIds: ['target-web', 'target-mobile'] },
+        { questionId: 'q2', optionIds: [], other: 'SSH host' }
+      ]
+    })
   })
 
-  it('keeps legacy single-question option ids and free text behavior', () => {
+  it('answers a single-question item as its one question', () => {
     mocks.promptItems = legacySingleQuestionPromptItems
 
     render(
@@ -568,6 +572,14 @@ describe('NativeChatStructuredSession', () => {
       }
     ])
     card.onAnswer([{ indices: [1], other: '' }])
-    expect(mocks.respond).toHaveBeenCalledWith(mocks.promptItems[0], 'q1:choice-2')
+    expect(mocks.respond).toHaveBeenLastCalledWith(mocks.promptItems[0], {
+      kind: 'answers',
+      answers: [{ questionId: 'q1', optionIds: ['q1:choice-2'] }]
+    })
+    card.onAnswer([{ indices: [], other: ' Svelte ' }])
+    expect(mocks.respond).toHaveBeenLastCalledWith(mocks.promptItems[0], {
+      kind: 'answers',
+      answers: [{ questionId: 'q1', optionIds: [], other: 'Svelte' }]
+    })
   })
 })
diff --git a/src/renderer/src/components/native-chat/NativeChatStructuredSession.tsx b/src/renderer/src/components/native-chat/NativeChatStructuredSession.tsx
index 4e18f0bf9c88..8d20c65bd48a 100644
--- a/src/renderer/src/components/native-chat/NativeChatStructuredSession.tsx
+++ b/src/renderer/src/components/native-chat/NativeChatStructuredSession.tsx
@@ -1,5 +1,5 @@
 import { useMemo, useRef, useState } from 'react'
-import { encodeAgentSessionQuestionAnswers } from '../../../../shared/agent-session-question-answer'
+import { agentSessionPromptQuestions } from '../../../../shared/agent-session-question-answer'
 import { dispatchStructuredAgentSessionComposerCommand } from '../../../../shared/structured-agent-session-composer'
 import { structuredAgentSessionPaneKey } from '../../../../shared/structured-agent-session-projection'
 import type { NativeChatLiveSession } from './use-native-chat-live-session'
@@ -27,10 +27,6 @@ import { useStructuredAgentSessionHostExecutionPhase } from './StructuredAgentSe
 import { structuredAgentLabel } from '@/lib/structured-agent-session-launch-label'
 import { NativeChatThreadGoalBanner } from './NativeChatThreadGoalBanner'
 
-function encodeQuestionAnswer(questionId: string, answer: string): string {
-  return `${encodeURIComponent(questionId)}:${encodeURIComponent(answer)}`
-}
-
 export function NativeChatStructuredSession(
   props: Omit<NativeChatStructuredViewProps, 'mode'>
 ): React.JSX.Element {
@@ -104,7 +100,7 @@ export function NativeChatStructuredSession(
     }),
     [controller, props.agent, props.sessionId]
   )
-  const viewState = selectNativeChatViewState(session)
+  const viewState = selectNativeChatViewState(session, { readRetries: true })
   const fontScale = useNativeChatFontScale(viewState.kind === 'ready')
   const imageRuntimeContext = useNativeChatImageRuntimeContext(props.tabId)
   const { onLinkClick, linkActionRequest, closeLinkActions } = useNativeChatLinkActions(
@@ -146,21 +142,7 @@ export function NativeChatStructuredSession(
     composerReady: prompt === null
   })
   const questionBody = prompt?.body.kind === 'question' ? prompt.body : null
-  const questions =
-    questionBody?.questions ??
-    (questionBody
-      ? [
-          {
-            id: questionBody.freeTextQuestionId ?? 'q1',
-            question: questionBody.question,
-            options: questionBody.options,
-            multiSelect: false,
-            ...(questionBody.freeTextQuestionId
-              ? { freeTextQuestionId: questionBody.freeTextQuestionId }
-              : {})
-          }
-        ]
-      : [])
+  const questions = questionBody ? agentSessionPromptQuestions(questionBody) : []
   const structuredTransport = useMemo(() => {
     const threadGoal = controller.threadGoal
     const setThreadGoalObjective = threadGoal
@@ -235,7 +217,7 @@ export function NativeChatStructuredSession(
         {viewState.kind === 'loading' ? (
           <NativeChatEmptyState kind="loading" />
         ) : viewState.kind === 'error' ? (
-          <NativeChatEmptyState kind="error" message={viewState.message} />
+          <NativeChatEmptyState kind="error" retrying />
         ) : viewState.kind === 'empty' ? (
           <NativeChatEmptyState kind="empty" agent={props.agent} />
         ) : (
@@ -295,7 +277,7 @@ export function NativeChatStructuredSession(
         <NativeChatApprovalCard
           key={`${prompt.itemId}:${prompt.revision}`}
           approval={approval}
-          onChoose={(optionId) => void controller.respond(prompt, optionId)}
+          onChoose={(optionId) => void controller.respond(prompt, { kind: 'option', optionId })}
           onCancel={cancelPrompt}
           shouldFocus={props.isVisible && props.isFocusedGroup}
           onLinkClick={onLinkClick}
@@ -318,35 +300,17 @@ export function NativeChatStructuredSession(
           }}
           allowOther={questions.map((question) => Boolean(question.freeTextQuestionId))}
           onAnswer={(answers) => {
-            if (questionBody.questions) {
-              const grouped = questions.map((question, questionIndex) => {
-                const answer = answers[questionIndex]
-                const other = answer?.other?.trim()
-                const optionIds = (answer?.indices ?? []).flatMap((optionIndex) => {
-                  const optionId = question.options[optionIndex]?.id
-                  return optionId ? [optionId] : []
-                })
-                return {
-                  questionId: question.id,
-                  optionIds: question.multiSelect || !other ? optionIds : [],
-                  ...(other ? { other } : {})
-                }
+            const chosen = questions.map((question, questionIndex) => {
+              const answer = answers[questionIndex]
+              const other = answer?.other?.trim()
+              const optionIds = (answer?.indices ?? []).flatMap((optionIndex) => {
+                const optionId = question.options[optionIndex]?.id
+                return optionId ? [optionId] : []
               })
-              if (grouped.every((answer) => answer.optionIds.length > 0 || answer.other)) {
-                void controller.respond(prompt, encodeAgentSessionQuestionAnswers(grouped))
-              }
-              return
-            }
-            const index = answers[0]?.indices[0]
-            const other = answers[0]?.other?.trim()
-            const optionId =
-              typeof index === 'number'
-                ? questionBody.options[index]?.id
-                : questionBody.freeTextQuestionId && other
-                  ? encodeQuestionAnswer(questionBody.freeTextQuestionId, other)
-                  : undefined
-            if (optionId) {
-              void controller.respond(prompt, optionId)
+              return { questionId: question.id, optionIds, ...(other ? { other } : {}) }
+            })
+            if (chosen.every((answer) => answer.optionIds.length > 0 || answer.other)) {
+              void controller.respond(prompt, { kind: 'answers', answers: chosen })
             }
           }}
           onCancel={cancelPrompt}
diff --git a/src/renderer/src/components/native-chat/NativeChatToolRun.ask-row.test.tsx b/src/renderer/src/components/native-chat/NativeChatToolRun.ask-row.test.tsx
index 4de5a0d214b6..870bf39a4095 100644
--- a/src/renderer/src/components/native-chat/NativeChatToolRun.ask-row.test.tsx
+++ b/src/renderer/src/components/native-chat/NativeChatToolRun.ask-row.test.tsx
@@ -2,10 +2,14 @@
 
 import '@testing-library/jest-dom/vitest'
 
-import { cleanup, render, screen } from '@testing-library/react'
+import { cleanup, fireEvent, render, screen } from '@testing-library/react'
 import { afterEach, describe, expect, it } from 'vitest'
 import type { NativeChatBlock } from '../../../../shared/native-chat-types'
 import { NativeChatToolRun } from './NativeChatToolRun'
+import {
+  NativeChatDisclosureContext,
+  useNativeChatDisclosures
+} from './native-chat-disclosure-store'
 
 afterEach(cleanup)
 
@@ -16,6 +20,46 @@ function askBlocks(state: 'running' | 'completed'): NativeChatBlock[] {
   return [{ type: 'tool-call', name: 'AskUserQuestion', input: ASK_INPUT, state }]
 }
 
+/** Lays every element out wider than its box, as a long question is on its line. */
+function clipEveryLine(): () => void {
+  const originals = ['scrollWidth', 'clientWidth'].map(
+    (name) => [name, Object.getOwnPropertyDescriptor(HTMLElement.prototype, name)] as const
+  )
+  Object.defineProperty(HTMLElement.prototype, 'scrollWidth', {
+    configurable: true,
+    get: () => 400
+  })
+  Object.defineProperty(HTMLElement.prototype, 'clientWidth', {
+    configurable: true,
+    get: () => 100
+  })
+  return () => {
+    for (const [name, original] of originals) {
+      if (original) {
+        Object.defineProperty(HTMLElement.prototype, name, original)
+      } else {
+        Reflect.deleteProperty(HTMLElement.prototype, name)
+      }
+    }
+  }
+}
+
+function DisclosureHarness({ mounted }: { mounted: boolean }): React.JSX.Element {
+  const disclosures = useNativeChatDisclosures()
+  return (
+    <NativeChatDisclosureContext.Provider value={disclosures}>
+      {mounted ? (
+        <NativeChatToolRun
+          blocks={askBlocks('completed')}
+          expandSignal
+          activeTurnIsWorking={false}
+          disclosureId="message-1"
+        />
+      ) : null}
+    </NativeChatDisclosureContext.Provider>
+  )
+}
+
 describe('NativeChatToolRun awaiting-input row', () => {
   it('does not revive stale tool state after a turn stops', () => {
     render(
@@ -80,9 +124,89 @@ describe('NativeChatToolRun awaiting-input row', () => {
     expect(screen.getByText('Asked:')).not.toHaveClass('animate-pulse')
     expect(screen.getByText(QUESTION)).toBeInTheDocument()
     // A run that is only the ask has no work left to head, so it draws no header.
+    expect(container.querySelector('[data-native-chat-tool-run-state]')).toBeNull()
+  })
+
+  it('leaves a question that fits on its line as plain text', () => {
+    const { container } = render(
+      <NativeChatToolRun blocks={askBlocks('completed')} expandSignal activeTurnIsWorking={false} />
+    )
+    expect(screen.getByText(QUESTION)).toHaveClass('truncate')
     expect(container.querySelector('button')).toBeNull()
   })
 
+  it('opens a clipped question below the toggle and folds it back', () => {
+    const restore = clipEveryLine()
+    try {
+      render(
+        <NativeChatToolRun
+          blocks={askBlocks('completed')}
+          expandSignal
+          activeTurnIsWorking={false}
+        />
+      )
+      const toggle = screen.getByRole('button', { name: /Asked:/ })
+      expect(toggle).toHaveAttribute('aria-expanded', 'false')
+
+      fireEvent.click(toggle)
+      expect(toggle).toHaveAttribute('aria-expanded', 'true')
+      const full = screen.getByText(QUESTION)
+      expect(full).not.toHaveClass('truncate')
+      // Outside the button, so it selects like prose and a click in it keeps it open.
+      expect(full.closest('button')).toBeNull()
+      fireEvent.click(full)
+      expect(toggle).toHaveAttribute('aria-expanded', 'true')
+
+      fireEvent.click(toggle)
+      expect(toggle).toHaveAttribute('aria-expanded', 'false')
+      expect(screen.getByText(QUESTION)).toHaveClass('truncate')
+    } finally {
+      restore()
+    }
+  })
+
+  it('keeps an opened question open when the windowed row remounts', () => {
+    const restore = clipEveryLine()
+    try {
+      const { rerender } = render(<DisclosureHarness mounted />)
+      fireEvent.click(screen.getByRole('button', { name: /Asked:/ }))
+
+      rerender(<DisclosureHarness mounted={false} />)
+      expect(screen.queryByText(QUESTION)).toBeNull()
+      rerender(<DisclosureHarness mounted />)
+
+      const toggle = screen.getByRole('button', { name: /Asked:/ })
+      expect(toggle).toHaveAttribute('aria-expanded', 'true')
+      expect(screen.getByText(QUESTION).closest('button')).toBeNull()
+
+      // Folding it keeps the same control, so keyboard focus is not dropped.
+      toggle.focus()
+      fireEvent.click(toggle)
+      expect(document.activeElement).toBe(toggle)
+      expect(toggle).toHaveAttribute('aria-expanded', 'false')
+    } finally {
+      restore()
+    }
+  })
+
+  it('offers no expansion when the row names only a question count', () => {
+    const restore = clipEveryLine()
+    try {
+      const input = { questions: [{ question: 'First?' }, { question: 'Second?' }] }
+      render(
+        <NativeChatToolRun
+          blocks={[{ type: 'tool-call', name: 'AskUserQuestion', input, state: 'completed' }]}
+          expandSignal
+          activeTurnIsWorking={false}
+        />
+      )
+      expect(screen.getByText('2 questions')).toBeInTheDocument()
+      expect(screen.queryByRole('button', { name: /Asked:/ })).toBeNull()
+    } finally {
+      restore()
+    }
+  })
+
   it('counts only the work that ran in the header beside the ask', () => {
     const blocks: NativeChatBlock[] = [
       { type: 'tool-call', name: 'Read', input: { file_path: 'a.ts' }, state: 'completed' },
diff --git a/src/renderer/src/components/native-chat/NativeChatToolRun.tsx b/src/renderer/src/components/native-chat/NativeChatToolRun.tsx
index bb8d9f963020..141ae7398862 100644
--- a/src/renderer/src/components/native-chat/NativeChatToolRun.tsx
+++ b/src/renderer/src/components/native-chat/NativeChatToolRun.tsx
@@ -217,7 +217,13 @@ export function NativeChatToolRun({
     <div className="mt-3">
       {standaloneRows}
       {hasAskCall ? (
-        <NativeChatAwaitingInputRow subject={askSubject} pending={askIsActive} />
+        <NativeChatAwaitingInputRow
+          subject={askSubject}
+          pending={askIsActive}
+          disclosureKey={disclosureId === undefined ? undefined : `ask:${disclosureId}`}
+          // A grouped ask here still names only its count.
+          listsQuestions={false}
+        />
       ) : null}
       {!showsHeader ? null : (
         // One element for the run's whole life. Live and settled are states of
diff --git a/src/renderer/src/components/native-chat/NativeChatTranscriptRow.tsx b/src/renderer/src/components/native-chat/NativeChatTranscriptRow.tsx
index 266f528ebfd6..b27736c71bbe 100644
--- a/src/renderer/src/components/native-chat/NativeChatTranscriptRow.tsx
+++ b/src/renderer/src/components/native-chat/NativeChatTranscriptRow.tsx
@@ -45,7 +45,7 @@ export const NativeChatTranscriptRow = memo(function NativeChatTranscriptRow({
   return (
     <div className="flex flex-col gap-5">
       {receipt ? (
-        <NativeChatResolutionReceipt body={receipt} />
+        <NativeChatResolutionReceipt body={receipt} disclosureId={message.id} />
       ) : (
         <MessageRow
           message={message}
@@ -69,7 +69,6 @@ export const NativeChatTranscriptRow = memo(function NativeChatTranscriptRow({
       {status ? (
         <NativeChatWorkingStatus
           startedAt={status.startedAt}
-          thinking={status.thinking}
           workedSeconds={status.workedSeconds}
           expanded={expanded === true}
           onToggleExpanded={
diff --git a/src/renderer/src/components/native-chat/NativeChatTurnActivityLine.tsx b/src/renderer/src/components/native-chat/NativeChatTurnActivityLine.tsx
index 72e11ad25a81..3813ff8d2038 100644
--- a/src/renderer/src/components/native-chat/NativeChatTurnActivityLine.tsx
+++ b/src/renderer/src/components/native-chat/NativeChatTurnActivityLine.tsx
@@ -1,55 +1,30 @@
 import { Loader2 } from 'lucide-react'
 import { translate } from '@/i18n/i18n'
 import type { NativeChatTurnActivity } from '../../../../shared/native-chat-turn-activity'
-import {
-  describeNativeChatActiveTurnLabel,
-  NATIVE_CHAT_TURN_STATUS_COPY,
-  type NativeChatTurnStatus
-} from '../../../../shared/native-chat-turn-status'
-import { useNativeChatElapsedSeconds } from './use-native-chat-elapsed-seconds'
+import { describeNativeChatActiveTurnLabel } from '../../../../shared/native-chat-turn-status'
 
-/** The live turn's one indicator: a spinner plus whatever the turn can say about
- *  itself — the provider's activity text, else that it is reasoning, else how
- *  long it has been working. A settled turn keeps its own `NativeChatWorkingStatus`
- *  row; this one is only ever rendered while the turn is in flight. */
+/** The live turn's tail line: a spinner plus what the turn is doing right now —
+ *  the provider's activity text, else that it is reasoning, else plain "Working…".
+ *  The clock lives in the turn bar under the user's message, not here. */
 export function NativeChatTurnActivityLine({
   activity,
-  status
+  thinking
 }: {
   activity?: NativeChatTurnActivity | null
-  status?: NativeChatTurnStatus | null
+  thinking: boolean
 }): React.JSX.Element {
-  const thinking = status?.thinking === true
-  // The clock only ticks when its number is the label; activity text and
-  // "Thinking" carry no duration.
-  const counting = status != null && !thinking && !activity?.text
-  const elapsedSeconds = useNativeChatElapsedSeconds(status?.startedAt ?? null, counting)
-  const resolved = describeNativeChatActiveTurnLabel({
-    activityText: activity?.text,
-    thinking,
-    elapsedSeconds
-  })
+  const resolved = describeNativeChatActiveTurnLabel({ activityText: activity?.text, thinking })
   const label =
     resolved.source === 'activity'
       ? resolved.text
-      : status == null
-        ? translate('components.native-chat.status.working', 'Working…')
-        : resolved.key === 'thinking'
-          ? translate(
-              'components.native-chat.status.thinking',
-              NATIVE_CHAT_TURN_STATUS_COPY.thinking
-            )
-          : translate(
-              'components.native-chat.status.workingFor',
-              NATIVE_CHAT_TURN_STATUS_COPY.workingFor,
-              { value0: resolved.duration }
-            )
+      : resolved.key === 'thinking'
+        ? translate('components.native-chat.status.thinking', 'Thinking')
+        : translate('components.native-chat.status.working', 'Working…')
 
   return (
     <div
       className="flex min-h-6 items-center gap-1.5 text-sm leading-relaxed text-muted-foreground"
       data-native-chat-turn-activity="true"
-      data-native-chat-turn-status="active"
       aria-live="polite"
       aria-atomic="true"
     >
diff --git a/src/renderer/src/components/native-chat/NativeChatWorkingStatus.tsx b/src/renderer/src/components/native-chat/NativeChatWorkingStatus.tsx
index c610abff7d6e..53e31157075b 100644
--- a/src/renderer/src/components/native-chat/NativeChatWorkingStatus.tsx
+++ b/src/renderer/src/components/native-chat/NativeChatWorkingStatus.tsx
@@ -9,27 +9,22 @@ import { useNativeChatElapsedSeconds } from './use-native-chat-elapsed-seconds'
 
 export { formatNativeChatDuration }
 
+/** The turn bar under the user's message: a running clock while the turn works,
+ *  then the settled duration, which toggles the turn's folded detail. */
 export function NativeChatWorkingStatus({
   startedAt,
-  thinking,
   workedSeconds,
   expanded = false,
   onToggleExpanded
 }: {
   startedAt: number | null
-  thinking: boolean
   workedSeconds?: number | null
   expanded?: boolean
   onToggleExpanded?: () => void
 }): React.JSX.Element {
-  const counting = !thinking && workedSeconds == null
-  const elapsedSeconds = useNativeChatElapsedSeconds(startedAt, counting)
+  const elapsedSeconds = useNativeChatElapsedSeconds(startedAt, workedSeconds == null)
 
-  const { key, duration } = describeNativeChatTurnStatus({
-    thinking,
-    workedSeconds,
-    elapsedSeconds
-  })
+  const { key, duration } = describeNativeChatTurnStatus({ workedSeconds, elapsedSeconds })
   const label =
     key === 'workedFor'
       ? translate(
@@ -39,15 +34,14 @@ export function NativeChatWorkingStatus({
             value0: duration
           }
         )
-      : key === 'thinking'
-        ? translate('components.native-chat.status.thinking', NATIVE_CHAT_TURN_STATUS_COPY.thinking)
-        : translate(
-            'components.native-chat.status.workingFor',
-            NATIVE_CHAT_TURN_STATUS_COPY.workingFor,
-            { value0: duration }
-          )
+      : translate(
+          'components.native-chat.status.workingFor',
+          NATIVE_CHAT_TURN_STATUS_COPY.workingFor,
+          { value0: duration }
+        )
   // `tabular-nums`: the live clock reflows its own label every second otherwise.
-  const className = `flex min-h-8 items-center gap-1 text-sm text-muted-foreground tabular-nums${thinking ? '' : ' border-b border-border'}`
+  const className =
+    'flex min-h-8 items-center gap-1 border-b border-border text-sm text-muted-foreground tabular-nums'
   const caret =
     workedSeconds != null && onToggleExpanded ? (
       <ChevronRight
@@ -82,9 +76,8 @@ export function NativeChatWorkingStatus({
         'components.native-chat.status.responding',
         NATIVE_CHAT_TURN_STATUS_COPY.responding
       )}
-      aria-live="polite"
     >
-      <span className={thinking ? 'animate-pulse' : undefined}>{label}</span>
+      <span>{label}</span>
       {caret}
     </div>
   )
diff --git a/src/renderer/src/components/native-chat/StructuredAgentSessionAttentionBridge.test.tsx b/src/renderer/src/components/native-chat/StructuredAgentSessionAttentionBridge.test.tsx
index ba210d74994c..4b31d0b03572 100644
--- a/src/renderer/src/components/native-chat/StructuredAgentSessionAttentionBridge.test.tsx
+++ b/src/renderer/src/components/native-chat/StructuredAgentSessionAttentionBridge.test.tsx
@@ -10,6 +10,7 @@ import { act, cleanup, render, waitFor } from '@testing-library/react'
 import { afterEach, beforeEach, describe, expect, it, vi, type Mock } from 'vitest'
 import type { AgentJournalTurnOutcome } from '../../../../shared/agent-session-journal-types'
 import type {
+  AgentSessionStatusEvent,
   AgentSessionTurnCompletion,
   AgentSessionTurnCompletionEvent
 } from '../../../../shared/agent-session-wire'
@@ -27,7 +28,9 @@ type TestStore = {
 type BridgeMocks = {
   store: TestStore | null
   emitters: ((event: AgentSessionTurnCompletionEvent) => void)[]
+  statusEmitters: ((event: AgentSessionStatusEvent) => void)[]
   subscribeCompletions: Mock
+  subscribeStatus: Mock
   supportsCapability: Mock
   unsubscribe: Mock
 }
@@ -35,7 +38,9 @@ type BridgeMocks = {
 const mocks = vi.hoisted<BridgeMocks>(() => ({
   store: null,
   emitters: [],
+  statusEmitters: [],
   subscribeCompletions: vi.fn(),
+  subscribeStatus: vi.fn(),
   supportsCapability: vi.fn(),
   unsubscribe: vi.fn()
 }))
@@ -58,11 +63,16 @@ vi.mock('@/runtime/runtime-rpc-client', async (importOriginal) => ({
 }))
 
 vi.mock('@/runtime/structured-agent-session-client', () => ({
-  subscribeStructuredAgentSessionTurnCompletions: mocks.subscribeCompletions
+  subscribeStructuredAgentSessionTurnCompletions: mocks.subscribeCompletions,
+  subscribeStructuredAgentSessionStatus: mocks.subscribeStatus
 }))
 
 import { StructuredAgentSessionAttentionBridge } from './StructuredAgentSessionAttentionBridge'
 import { resetStructuredAgentSessionTurnCompletionFeedsForTests } from '@/runtime/structured-agent-session-turn-completion-feed'
+import {
+  getStructuredAgentSessionStatusFeed,
+  resetStructuredAgentSessionStatusFeedsForTests
+} from '@/runtime/structured-agent-session-status-feed'
 import {
   makeTabGroup,
   makeUnifiedTab,
@@ -176,7 +186,15 @@ describe('StructuredAgentSessionAttentionBridge', () => {
       }
     })
     resetStructuredAgentSessionTurnCompletionFeedsForTests()
+    resetStructuredAgentSessionStatusFeedsForTests()
     mocks.emitters.length = 0
+    mocks.statusEmitters.length = 0
+    mocks.subscribeStatus.mockImplementation(
+      (_target: unknown, emit: (event: AgentSessionStatusEvent) => void) => {
+        mocks.statusEmitters.push(emit)
+        return Promise.resolve({ unsubscribe: vi.fn() })
+      }
+    )
     mocks.subscribeCompletions.mockImplementation(
       (_target: unknown, emit: (event: AgentSessionTurnCompletionEvent) => void) => {
         mocks.emitters.push(emit)
@@ -215,6 +233,7 @@ describe('StructuredAgentSessionAttentionBridge', () => {
     cleanup()
     vi.unstubAllGlobals()
     resetStructuredAgentSessionTurnCompletionFeedsForTests()
+    resetStructuredAgentSessionStatusFeedsForTests()
   })
 
   it('lights the unread indicators when the host reports a successful turn', async () => {
@@ -235,14 +254,14 @@ describe('StructuredAgentSessionAttentionBridge', () => {
       worktreeId: WORKSPACE,
       paneKey: CHAT_SUBJECT,
       agentState: 'done',
-      agentInterrupted: false
+      agentTurnOutcome: 'success'
     })
   })
 
   // A settled turn is news whichever way it settled, exactly as the CLI lane treats one. The
-  // difference is wording, and it rides the notification flag that already says "stopped".
+  // difference is wording, which main picks from the verdict.
   it.each(['failure', 'cancellation'] as const)(
-    'lights the indicators and says stopped for a %s the host reports',
+    'lights the indicators and hands main the %s the host reports',
     async (outcome) => {
       render(<StructuredAgentSessionAttentionBridge />)
       await waitFor(() => expect(mocks.subscribeCompletions).toHaveBeenCalledOnce())
@@ -254,7 +273,7 @@ describe('StructuredAgentSessionAttentionBridge', () => {
         paneDot: 'agent-completion',
         tabDot: 'agent-completion'
       })
-      expect(onlyDispatch()).toMatchObject({ agentState: 'done', agentInterrupted: true })
+      expect(onlyDispatch()).toMatchObject({ agentState: 'done', agentTurnOutcome: outcome })
     }
   )
 
@@ -299,6 +318,48 @@ describe('StructuredAgentSessionAttentionBridge', () => {
     }
   )
 
+  // Remote clients receive the status and completion streams over separate sockets, unordered, so
+  // the wording must come from the completion alone. The mirror is set to disagree in each case.
+  function mirrorStatus(status: 'idle' | 'attention'): void {
+    mocks.statusEmitters[0]?.({
+      type: 'status',
+      session: {
+        sessionId: SESSION,
+        workspaceId: 'host-side-workspace',
+        agent: 'claude',
+        status,
+        latestPrompt: 'Ship it',
+        updatedAt: 1
+      }
+    })
+  }
+
+  it.each([
+    { awaitingUser: true, mirror: 'idle', agentState: 'blocked' },
+    { awaitingUser: undefined, mirror: 'attention', agentState: 'done' }
+  ] as const)(
+    'words awaitingUser=$awaitingUser as $agentState whatever the status mirror says ($mirror)',
+    async ({ awaitingUser, mirror, agentState }) => {
+      const stopStatus = getStructuredAgentSessionStatusFeed({ kind: 'local' }).activate()
+      render(<StructuredAgentSessionAttentionBridge />)
+      await waitFor(() => expect(mocks.subscribeCompletions).toHaveBeenCalledOnce())
+      await waitFor(() => expect(mocks.subscribeStatus).toHaveBeenCalledOnce())
+      const completion = turnCompletion()
+
+      act(() => {
+        mirrorStatus(mirror)
+        hostStream()({
+          type: 'completion',
+          completion: awaitingUser ? { ...completion, awaitingUser } : completion
+        })
+      })
+
+      expect(indicators().paneDot).toBe('agent-completion')
+      expect(onlyDispatch()).toMatchObject({ agentState, agentTurnOutcome: 'success' })
+      stopStatus()
+    }
+  )
+
   it('lights nothing for a turn whose outcome the host never stated', async () => {
     render(<StructuredAgentSessionAttentionBridge />)
     await waitFor(() => expect(mocks.subscribeCompletions).toHaveBeenCalledOnce())
diff --git a/src/renderer/src/components/native-chat/StructuredAgentSessionStatusBridge.tsx b/src/renderer/src/components/native-chat/StructuredAgentSessionStatusBridge.tsx
index 92d3128d0821..b0c546b3f9b6 100644
--- a/src/renderer/src/components/native-chat/StructuredAgentSessionStatusBridge.tsx
+++ b/src/renderer/src/components/native-chat/StructuredAgentSessionStatusBridge.tsx
@@ -8,7 +8,8 @@ import {
 } from '../../../../shared/agent-status-child-work-projection'
 import {
   continueMainAgentStatus,
-  isAgentStatusHeldOpenByChildWork
+  isAgentStatusHeldOpenByChildWork,
+  mainAgentTurnInterrupted
 } from '../../../../shared/agent-lead-status-fold'
 import { mainAgentStatusEqual, agentSubagentsEqual } from '../../../../shared/agent-status-types'
 import { structuredAgentSessionPaneKey } from '../../../../shared/structured-agent-session-projection'
@@ -98,6 +99,8 @@ function projectStatus(
     state: agentStatus.state,
     ...(agentStatus.workingMode ? { workingMode: agentStatus.workingMode } : {}),
     mainAgent,
+    // Derived from `mainAgent`, so the equality below needs no second check of it.
+    interrupted: mainAgentTurnInterrupted(mainAgent),
     prompt: summary.latestPrompt,
     agentType: tab.agentSessionAgent,
     // The host projects these from the journal so the row reads like a hook-reported one:
diff --git a/src/renderer/src/components/native-chat/agent-session-write-notice-text.test.ts b/src/renderer/src/components/native-chat/agent-session-write-notice-text.test.ts
new file mode 100644
index 000000000000..260c910d01e2
--- /dev/null
+++ b/src/renderer/src/components/native-chat/agent-session-write-notice-text.test.ts
@@ -0,0 +1,41 @@
+import { afterEach, describe, expect, it } from 'vitest'
+import { i18n } from '@/i18n/i18n'
+import en from '@/i18n/locales/en.json'
+import { agentSessionWriteNoticeEnglish } from '../../../../shared/agent-session-refusal-notice'
+import {
+  AGENT_SESSION_WRITE_NOTICE_COPY,
+  type AgentSessionWriteNoticeSentence
+} from '../../../../shared/agent-session-write-notice-copy'
+import { agentSessionWriteNoticeText } from './agent-session-write-notice-text'
+
+const SENTENCES = Object.keys(AGENT_SESSION_WRITE_NOTICE_COPY).filter(
+  (key): key is AgentSessionWriteNoticeSentence => key in AGENT_SESSION_WRITE_NOTICE_COPY
+)
+
+afterEach(async () => {
+  await i18n.changeLanguage('en')
+})
+
+describe('desktop words for a write that did not happen', () => {
+  it('says exactly what the phone says in English', () => {
+    for (const sentence of SENTENCES) {
+      expect(agentSessionWriteNoticeText([sentence])).toBe(
+        agentSessionWriteNoticeEnglish([sentence])
+      )
+    }
+  })
+
+  it('keeps the English catalog in step with the shared copy', () => {
+    expect(en.components['native-chat'].writeNotice).toEqual(AGENT_SESSION_WRITE_NOTICE_COPY)
+  })
+
+  it('translates each sentence whole and shows a provider reason as written', async () => {
+    await i18n.changeLanguage('fr')
+    expect(agentSessionWriteNoticeText(['restartFailed', 'notDoneSend'])).toBe(
+      "L'agent n'a pas pu redémarrer. Votre message n'a pas été envoyé."
+    )
+    expect(
+      agentSessionWriteNoticeText([{ text: 'Claude messages support at most 20 images' }])
+    ).toBe('Claude messages support at most 20 images')
+  })
+})
diff --git a/src/renderer/src/components/native-chat/agent-session-write-notice-text.ts b/src/renderer/src/components/native-chat/agent-session-write-notice-text.ts
new file mode 100644
index 000000000000..812197d6e336
--- /dev/null
+++ b/src/renderer/src/components/native-chat/agent-session-write-notice-text.ts
@@ -0,0 +1,124 @@
+// Desktop words for a chat write that did not happen: each sentence translated whole, with the
+// shared English as its fallback so desktop and mobile never say it differently.
+
+import { translate } from '@/i18n/i18n'
+import { agentSessionWriteNoticeParts } from '../../../../shared/agent-session-refusal-notice'
+import {
+  AGENT_SESSION_WRITE_NOTICE_COPY as COPY,
+  type AgentSessionWriteNoticePart,
+  type AgentSessionWriteNoticeSentence
+} from '../../../../shared/agent-session-write-notice-copy'
+import type {
+  AgentSessionWriteFailure,
+  AgentSessionWriteKind
+} from '../../../../shared/agent-session-write-failure'
+
+const SENTENCES: Record<AgentSessionWriteNoticeSentence, () => string> = {
+  notDoneReadHistory: () =>
+    translate('components.native-chat.writeNotice.notDoneReadHistory', COPY.notDoneReadHistory),
+  notDoneSend: () => translate('components.native-chat.writeNotice.notDoneSend', COPY.notDoneSend),
+  tryAgainComposerSend: () =>
+    translate('components.native-chat.writeNotice.tryAgainComposerSend', COPY.tryAgainComposerSend),
+  notDoneStop: () => translate('components.native-chat.writeNotice.notDoneStop', COPY.notDoneStop),
+  notDoneStopTask: () =>
+    translate('components.native-chat.writeNotice.notDoneStopTask', COPY.notDoneStopTask),
+  notDoneStopTasks: () =>
+    translate('components.native-chat.writeNotice.notDoneStopTasks', COPY.notDoneStopTasks),
+  notDoneAnswer: () =>
+    translate('components.native-chat.writeNotice.notDoneAnswer', COPY.notDoneAnswer),
+  notDoneOption: () =>
+    translate('components.native-chat.writeNotice.notDoneOption', COPY.notDoneOption),
+  notDoneCommand: () =>
+    translate('components.native-chat.writeNotice.notDoneCommand', COPY.notDoneCommand),
+  notDoneGoal: () => translate('components.native-chat.writeNotice.notDoneGoal', COPY.notDoneGoal),
+  restartFailed: () =>
+    translate('components.native-chat.writeNotice.restartFailed', COPY.restartFailed),
+  capacity: () => translate('components.native-chat.writeNotice.capacity', COPY.capacity),
+  outcomeUnknown: () =>
+    translate('components.native-chat.writeNotice.outcomeUnknown', COPY.outcomeUnknown),
+  questionChanged: () =>
+    translate('components.native-chat.writeNotice.questionChanged', COPY.questionChanged),
+  historyUnreadable: () =>
+    translate('components.native-chat.writeNotice.historyUnreadable', COPY.historyUnreadable),
+  historyUnusable: () =>
+    translate('components.native-chat.writeNotice.historyUnusable', COPY.historyUnusable),
+  historyUnavailable: () =>
+    translate('components.native-chat.writeNotice.historyUnavailable', COPY.historyUnavailable),
+  unsupported: () => translate('components.native-chat.writeNotice.unsupported', COPY.unsupported),
+  unreachable: () => translate('components.native-chat.writeNotice.unreachable', COPY.unreachable),
+  recordFailed: () =>
+    translate('components.native-chat.writeNotice.recordFailed', COPY.recordFailed),
+  conversationCleared: () =>
+    translate('components.native-chat.writeNotice.conversationCleared', COPY.conversationCleared),
+  openCurrentConversation: () =>
+    translate(
+      'components.native-chat.writeNotice.openCurrentConversation',
+      COPY.openCurrentConversation
+    ),
+  clearUnfinished: () =>
+    translate('components.native-chat.writeNotice.clearUnfinished', COPY.clearUnfinished),
+  commandRunning: () =>
+    translate('components.native-chat.writeNotice.commandRunning', COPY.commandRunning),
+  waitForCommand: () =>
+    translate('components.native-chat.writeNotice.waitForCommand', COPY.waitForCommand),
+  agentStarting: () =>
+    translate('components.native-chat.writeNotice.agentStarting', COPY.agentStarting),
+  waitForStart: () =>
+    translate('components.native-chat.writeNotice.waitForStart', COPY.waitForStart),
+  turnActive: () => translate('components.native-chat.writeNotice.turnActive', COPY.turnActive),
+  waitForTurn: () => translate('components.native-chat.writeNotice.waitForTurn', COPY.waitForTurn),
+  promptPending: () =>
+    translate('components.native-chat.writeNotice.promptPending', COPY.promptPending),
+  answerFirst: () => translate('components.native-chat.writeNotice.answerFirst', COPY.answerFirst),
+  backgroundTasksRunning: () =>
+    translate(
+      'components.native-chat.writeNotice.backgroundTasksRunning',
+      COPY.backgroundTasksRunning
+    ),
+  waitForBackgroundTasks: () =>
+    translate(
+      'components.native-chat.writeNotice.waitForBackgroundTasks',
+      COPY.waitForBackgroundTasks
+    ),
+  messagesUnsettled: () =>
+    translate('components.native-chat.writeNotice.messagesUnsettled', COPY.messagesUnsettled),
+  settleEarlierMessage: () =>
+    translate('components.native-chat.writeNotice.settleEarlierMessage', COPY.settleEarlierMessage),
+  optionRejected: () =>
+    translate('components.native-chat.writeNotice.optionRejected', COPY.optionRejected),
+  goalsUnsupported: () =>
+    translate('components.native-chat.writeNotice.goalsUnsupported', COPY.goalsUnsupported),
+  agentRefused: () =>
+    translate('components.native-chat.writeNotice.agentRefused', COPY.agentRefused),
+  ownerUnproven: () =>
+    translate('components.native-chat.writeNotice.ownerUnproven', COPY.ownerUnproven),
+  reopenChat: () => translate('components.native-chat.writeNotice.reopenChat', COPY.reopenChat),
+  terminalAgentHoldsChat: () =>
+    translate(
+      'components.native-chat.writeNotice.terminalAgentHoldsChat',
+      COPY.terminalAgentHoldsChat
+    ),
+  quitTerminalAgent: () =>
+    translate('components.native-chat.writeNotice.quitTerminalAgent', COPY.quitTerminalAgent),
+  hostReconciling: () =>
+    translate('components.native-chat.writeNotice.hostReconciling', COPY.hostReconciling),
+  waitMoment: () => translate('components.native-chat.writeNotice.waitMoment', COPY.waitMoment),
+  recordUnreadable: () =>
+    translate('components.native-chat.writeNotice.recordUnreadable', COPY.recordUnreadable),
+  chatNotFound: () =>
+    translate('components.native-chat.writeNotice.chatNotFound', COPY.chatNotFound),
+  startNewChat: () =>
+    translate('components.native-chat.writeNotice.startNewChat', COPY.startNewChat),
+  tryAgain: () => translate('components.native-chat.writeNotice.tryAgain', COPY.tryAgain)
+}
+
+export function agentSessionWriteNoticeText(parts: readonly AgentSessionWriteNoticePart[]): string {
+  return parts.map((part) => (typeof part === 'string' ? SENTENCES[part]() : part.text)).join(' ')
+}
+
+export function agentSessionWriteFailureText(
+  failure: AgentSessionWriteFailure,
+  write: AgentSessionWriteKind
+): string {
+  return agentSessionWriteNoticeText(agentSessionWriteNoticeParts(failure, write))
+}
diff --git a/src/renderer/src/components/native-chat/claude-model-switch-confirmation.ts b/src/renderer/src/components/native-chat/claude-model-switch-confirmation.ts
index eedf8506e1c6..334e4639add8 100644
--- a/src/renderer/src/components/native-chat/claude-model-switch-confirmation.ts
+++ b/src/renderer/src/components/native-chat/claude-model-switch-confirmation.ts
@@ -147,7 +147,7 @@ export function createClaudeModelSwitchConfirmationObserver(args: {
         // exact Claude warning defaults to “Yes” and needs only one Enter.
         const accepted = args.submitConfirmation
           ? args.submitConfirmation() !== false
-          : sendRuntimePtyInput(args.settings, args.ptyId, NATIVE_CHAT_SUBMIT)
+          : sendRuntimePtyInput(args.settings, args.ptyId, NATIVE_CHAT_SUBMIT, 'driving')
         if (!accepted) {
           finish('unknown')
           return
diff --git a/src/renderer/src/components/native-chat/native-chat-leaf-routing.test.ts b/src/renderer/src/components/native-chat/native-chat-leaf-routing.test.ts
index b435d40f7976..47a4d020a252 100644
--- a/src/renderer/src/components/native-chat/native-chat-leaf-routing.test.ts
+++ b/src/renderer/src/components/native-chat/native-chat-leaf-routing.test.ts
@@ -135,7 +135,7 @@ describe('resolveNativeChatLeafRoute', () => {
     ).toEqual({ chatLeafId: 'agent-leaf', exitChat: false })
   })
 
-  it('moves chat to an eligible active sibling after its leaf closes', () => {
+  it('exits chat when the user closes its pane', () => {
     expect(
       resolveNativeChatLeafRoute({
         isChatViewMode: true,
@@ -144,7 +144,7 @@ describe('resolveNativeChatLeafRoute', () => {
         chatLeafStillMounted: false,
         activeLeafIsEligible: true
       })
-    ).toEqual({ chatLeafId: 'agent-sibling', exitChat: false })
+    ).toEqual({ chatLeafId: null, exitChat: true })
   })
 
   it('does not move chat when its mounted leaf temporarily becomes ineligible', () => {
diff --git a/src/renderer/src/components/native-chat/native-chat-leaf-routing.ts b/src/renderer/src/components/native-chat/native-chat-leaf-routing.ts
index 45eaa451b95f..176194952dcf 100644
--- a/src/renderer/src/components/native-chat/native-chat-leaf-routing.ts
+++ b/src/renderer/src/components/native-chat/native-chat-leaf-routing.ts
@@ -107,6 +107,11 @@ export function resolveNativeChatLeafRoute(args: {
   if (!args.activeLeafId && !confirmedAgentExit) {
     return { chatLeafId: args.chatLeafId, exitChat: false }
   }
+  if (args.chatLeafId && !args.chatLeafStillMounted && !confirmedAgentExit) {
+    // A user-closed chat pane is an explicit close, not an agent handoff. Do not
+    // retarget the chat surface to whichever sibling became active.
+    return { chatLeafId: null, exitChat: true }
+  }
   if (args.activeLeafIsEligible && (!confirmedAgentExit || args.activeLeafId !== args.chatLeafId)) {
     return { chatLeafId: args.activeLeafId, exitChat: false }
   }
diff --git a/src/renderer/src/components/native-chat/native-chat-rail-outline-parity.test.ts b/src/renderer/src/components/native-chat/native-chat-rail-outline-parity.test.ts
index 3057be1f9083..385899ae91f8 100644
--- a/src/renderer/src/components/native-chat/native-chat-rail-outline-parity.test.ts
+++ b/src/renderer/src/components/native-chat/native-chat-rail-outline-parity.test.ts
@@ -60,7 +60,8 @@ const JOURNAL: AgentJournalRenderItem[] = [
   ]),
   row(10, { kind: 'message', role: 'assistant', blocks: [{ type: 'text', text: 'Done.' }] }),
   user(11, [{ type: 'text', text: 'Thanks' }]),
-  // Journalled after `Thanks` but observed before `Done.`: the transcript orders by observation.
+  // Recovered after a crash: journalled after `Thanks`, but carrying the provider's clock from
+  // before `Done.`. The transcript orders by journal position, never observation.
   { ...user(12, [{ type: 'text', text: 'Observed earlier' }]), observedAt: 1_009.5 }
 ]
 
@@ -107,13 +108,13 @@ describe('conversation outline parity with the loaded rail', () => {
       }))
     ).toEqual(loaded.map(({ id, text, hasImages }) => ({ id, text, hasImages })))
     // Anti-vacuous: the folded tool result, the refused send, the harness turn and the empty
-    // prompt were all dropped, and the late-journalled row sits where it was observed.
+    // prompt were all dropped, and the recovered row sits where it was journalled.
     expect(outline.map((entry) => entry.itemId)).toEqual([
       'item-1',
       'item-5',
       'item-9',
-      'item-12',
-      'item-11'
+      'item-11',
+      'item-12'
     ])
   })
 
@@ -123,8 +124,8 @@ describe('conversation outline parity with the loaded rail', () => {
       { itemId: 'item-1', sequence: 1, preview: 'Fix the parser', imageCount: 0 },
       { itemId: 'item-5', sequence: 5, preview: '', imageCount: 1 },
       { itemId: 'item-9', sequence: 9, preview: 'Compare these', imageCount: 2 },
-      { itemId: 'item-12', sequence: 12, preview: 'Observed earlier', imageCount: 0 },
-      { itemId: 'item-11', sequence: 11, preview: 'Thanks', imageCount: 0 }
+      { itemId: 'item-11', sequence: 11, preview: 'Thanks', imageCount: 0 },
+      { itemId: 'item-12', sequence: 12, preview: 'Observed earlier', imageCount: 0 }
     ])
   })
 })
diff --git a/src/renderer/src/components/native-chat/native-chat-resolution-receipt.ts b/src/renderer/src/components/native-chat/native-chat-resolution-receipt.ts
index f9a0c64437df..475966a1b03a 100644
--- a/src/renderer/src/components/native-chat/native-chat-resolution-receipt.ts
+++ b/src/renderer/src/components/native-chat/native-chat-resolution-receipt.ts
@@ -2,7 +2,10 @@ import type {
   AgentJournalApprovalItem,
   AgentJournalQuestionItem
 } from '../../../../shared/agent-session-journal-types'
-import { decodeAgentSessionQuestionAnswers } from '../../../../shared/agent-session-question-answer'
+import {
+  agentSessionPromptQuestions,
+  legacyAgentSessionQuestionAnswers
+} from '../../../../shared/agent-session-question-answer'
 
 export type NativeChatResolvedPrompt = AgentJournalApprovalItem | AgentJournalQuestionItem
 export type NativeChatReceiptAnswer = { question: string | null; answer: string | null }
@@ -14,16 +17,19 @@ export function nativeChatReceiptAnswers(
     return []
   }
   const selected = body.resolution.selectedOptionId
-  if (body.kind === 'question' && body.questions) {
-    const answers = selected ? decodeAgentSessionQuestionAnswers(selected) : null
-    return body.questions.map((question) => {
+  if (body.kind === 'question') {
+    // Rows written before hosts recorded structured answers carry only the packed form.
+    const answers =
+      body.resolution.answers ??
+      (selected ? legacyAgentSessionQuestionAnswers(body, selected) : null)
+    return agentSessionPromptQuestions(body).map((question) => {
       const answer = answers?.find((entry) => entry.questionId === question.id)
       const labels = answer?.optionIds.map(
         (id) => question.options.find((option) => option.id === id)?.label
       )
       const valid = labels?.every((label) => label !== undefined)
       return {
-        question: question.question,
+        question: body.questions ? question.question : null,
         answer: valid
           ? [...(labels ?? []), ...(answer?.other ? [answer.other] : [])].join(' · ') || null
           : null
@@ -31,20 +37,5 @@ export function nativeChatReceiptAnswers(
     })
   }
   const option = body.options.find((option) => option.id === selected)
-  if (option) {
-    return [{ question: null, answer: option.label }]
-  }
-  if (body.kind === 'question' && body.freeTextQuestionId && selected) {
-    const prefix = `${encodeURIComponent(body.freeTextQuestionId)}:`
-    if (selected.startsWith(prefix)) {
-      try {
-        return [
-          { question: null, answer: decodeURIComponent(selected.slice(prefix.length)) || null }
-        ]
-      } catch {
-        // Malformed persisted answers remain readable as an unavailable selection.
-      }
-    }
-  }
-  return [{ question: null, answer: null }]
+  return [{ question: null, answer: option?.label ?? null }]
 }
diff --git a/src/renderer/src/components/native-chat/native-chat-runtime-image-send.ts b/src/renderer/src/components/native-chat/native-chat-runtime-image-send.ts
index f77ba77e2749..aba65acf8db0 100644
--- a/src/renderer/src/components/native-chat/native-chat-runtime-image-send.ts
+++ b/src/renderer/src/components/native-chat/native-chat-runtime-image-send.ts
@@ -56,20 +56,20 @@ export function sendNativeChatMessageWithImageAttachments(
           ),
           trimmedText.length > 0
         )) {
-          sendRuntimePtyInput(settings, ptyId, payload)
+          sendRuntimePtyInput(settings, ptyId, payload, 'driving')
         }
         if (trimmedText.length > 0) {
           delay(NATIVE_CHAT_IMAGE_ATTACHMENT_SETTLE_MS, () => {
-            sendRuntimePtyInput(settings, ptyId, buildNativeChatPasteBytes(text))
+            sendRuntimePtyInput(settings, ptyId, buildNativeChatPasteBytes(text), 'driving')
             delay(NATIVE_CHAT_SUBMIT_DELAY_MS, () => {
-              sendRuntimePtyInput(settings, ptyId, NATIVE_CHAT_SUBMIT)
+              sendRuntimePtyInput(settings, ptyId, NATIVE_CHAT_SUBMIT, 'driving')
               markSubmitted()
             })
           })
           return
         }
         delay(NATIVE_CHAT_SUBMIT_DELAY_MS, () => {
-          sendRuntimePtyInput(settings, ptyId, NATIVE_CHAT_SUBMIT)
+          sendRuntimePtyInput(settings, ptyId, NATIVE_CHAT_SUBMIT, 'driving')
           markSubmitted()
         })
       })
diff --git a/src/renderer/src/components/native-chat/native-chat-runtime-send.test.ts b/src/renderer/src/components/native-chat/native-chat-runtime-send.test.ts
index d8cf90167ec8..0071b73b21d7 100644
--- a/src/renderer/src/components/native-chat/native-chat-runtime-send.test.ts
+++ b/src/renderer/src/components/native-chat/native-chat-runtime-send.test.ts
@@ -138,7 +138,12 @@ describe('sendNativeChatMessage', () => {
     ])
 
     await vi.advanceTimersByTimeAsync(NATIVE_CHAT_SUBMIT_DELAY_MS)
-    expect(sendRuntimePtyInput).toHaveBeenLastCalledWith(SETTINGS, PTY, NATIVE_CHAT_SUBMIT)
+    expect(sendRuntimePtyInput).toHaveBeenLastCalledWith(
+      SETTINGS,
+      PTY,
+      NATIVE_CHAT_SUBMIT,
+      'driving'
+    )
     expect(sendRuntimePtyInput).toHaveBeenCalledTimes(6)
   })
 
@@ -194,13 +199,19 @@ describe('sendNativeChatMessageVerified', () => {
     expect(sendRuntimePtyInputVerified).toHaveBeenCalledWith(
       SETTINGS,
       PTY,
-      buildNativeChatPasteBytes('/model sonnet')
+      buildNativeChatPasteBytes('/model sonnet'),
+      'driving'
     )
 
     await vi.advanceTimersByTimeAsync(NATIVE_CHAT_SUBMIT_DELAY_MS)
 
     expect(await result).toBe(true)
-    expect(sendRuntimePtyInputVerified).toHaveBeenLastCalledWith(SETTINGS, PTY, NATIVE_CHAT_SUBMIT)
+    expect(sendRuntimePtyInputVerified).toHaveBeenLastCalledWith(
+      SETTINGS,
+      PTY,
+      NATIVE_CHAT_SUBMIT,
+      'driving'
+    )
     expect(
       sendRuntimePtyInputVerified.mock.calls.some(
         (call) => call[2] === NATIVE_CHAT_CLEAR_UNSUBMITTED_INPUT
@@ -234,7 +245,12 @@ describe('sendNativeChatMessageVerified', () => {
     const submits = sendRuntimePtyInput.mock.calls.filter((call) => call[2] === NATIVE_CHAT_SUBMIT)
     // Only the verified path's Enter — chat's delayed Enter was cancelled.
     expect(submits).toHaveLength(0)
-    expect(sendRuntimePtyInputVerified).toHaveBeenCalledWith(SETTINGS, PTY, NATIVE_CHAT_SUBMIT)
+    expect(sendRuntimePtyInputVerified).toHaveBeenCalledWith(
+      SETTINGS,
+      PTY,
+      NATIVE_CHAT_SUBMIT,
+      'driving'
+    )
   })
 
   it('returns false when the delayed Enter wait is aborted', async () => {
@@ -347,9 +363,14 @@ describe('sendNativeChatMessageWithImageAttachments', () => {
       '\x1b[200~@"C:\\Images\\screen shot.png"\x1b[201~ '
     ])
     vi.advanceTimersByTime(NATIVE_CHAT_IMAGE_ATTACHMENT_SETTLE_MS)
-    expect(sendRuntimePtyInput).toHaveBeenLastCalledWith(SETTINGS, PTY, 'describe')
+    expect(sendRuntimePtyInput).toHaveBeenLastCalledWith(SETTINGS, PTY, 'describe', 'driving')
     vi.advanceTimersByTime(NATIVE_CHAT_SUBMIT_DELAY_MS)
-    expect(sendRuntimePtyInput).toHaveBeenLastCalledWith(SETTINGS, PTY, NATIVE_CHAT_SUBMIT)
+    expect(sendRuntimePtyInput).toHaveBeenLastCalledWith(
+      SETTINGS,
+      PTY,
+      NATIVE_CHAT_SUBMIT,
+      'driving'
+    )
   })
 
   it('clears the line, then bracket-pastes image paths before prompt text', () => {
@@ -372,10 +393,20 @@ describe('sendNativeChatMessageWithImageAttachments', () => {
     ])
 
     vi.advanceTimersByTime(NATIVE_CHAT_IMAGE_ATTACHMENT_SETTLE_MS)
-    expect(sendRuntimePtyInput).toHaveBeenLastCalledWith(SETTINGS, PTY, 'what do you see?')
+    expect(sendRuntimePtyInput).toHaveBeenLastCalledWith(
+      SETTINGS,
+      PTY,
+      'what do you see?',
+      'driving'
+    )
 
     vi.advanceTimersByTime(NATIVE_CHAT_SUBMIT_DELAY_MS)
-    expect(sendRuntimePtyInput).toHaveBeenLastCalledWith(SETTINGS, PTY, NATIVE_CHAT_SUBMIT)
+    expect(sendRuntimePtyInput).toHaveBeenLastCalledWith(
+      SETTINGS,
+      PTY,
+      NATIVE_CHAT_SUBMIT,
+      'driving'
+    )
     expect(sendRuntimePtyInput).toHaveBeenCalledTimes(4)
   })
 
@@ -396,7 +427,12 @@ describe('sendNativeChatMessageWithImageAttachments', () => {
 
     vi.advanceTimersByTime(1)
     expect(sendRuntimePtyInput).toHaveBeenCalledTimes(3)
-    expect(sendRuntimePtyInput).toHaveBeenLastCalledWith(SETTINGS, PTY, NATIVE_CHAT_SUBMIT)
+    expect(sendRuntimePtyInput).toHaveBeenLastCalledWith(
+      SETTINGS,
+      PTY,
+      NATIVE_CHAT_SUBMIT,
+      'driving'
+    )
   })
 
   it('treats whitespace-only prompt input as attachment-only', () => {
@@ -450,7 +486,7 @@ describe('empty prompt submit', () => {
   it('submits an empty prompt with a bare Enter', () => {
     submitNativeChatPrompt(SETTINGS, PTY)
     expect(sendRuntimePtyInput).toHaveBeenCalledOnce()
-    expect(sendRuntimePtyInput).toHaveBeenCalledWith(SETTINGS, PTY, NATIVE_CHAT_SUBMIT)
+    expect(sendRuntimePtyInput).toHaveBeenCalledWith(SETTINGS, PTY, NATIVE_CHAT_SUBMIT, 'driving')
   })
 })
 
@@ -483,16 +519,17 @@ describe('sendNativeChatAskAnswer', () => {
     )
 
     vi.advanceTimersByTime(0)
-    expect(sendRuntimePtyInput).toHaveBeenCalledWith(SETTINGS, PTY, '1')
+    expect(sendRuntimePtyInput).toHaveBeenCalledWith(SETTINGS, PTY, '1', 'driving')
 
     vi.advanceTimersByTime(NATIVE_CHAT_QUESTION_STEP_MS)
-    expect(sendRuntimePtyInput).toHaveBeenCalledWith(SETTINGS, PTY, '2')
+    expect(sendRuntimePtyInput).toHaveBeenCalledWith(SETTINGS, PTY, '2', 'driving')
 
     vi.advanceTimersByTime(NATIVE_CHAT_QUESTION_STEP_MS)
     expect(sendRuntimePtyInput).toHaveBeenLastCalledWith(
       SETTINGS,
       PTY,
-      buildNativeChatPasteBytes('custom answer')
+      buildNativeChatPasteBytes('custom answer'),
+      'driving'
     )
   })
 
@@ -533,7 +570,7 @@ describe('sendNativeChatAskAnswer', () => {
     const handle = sendNativeChatAskAnswer(SETTINGS, PTY, [{ raw: '2' }], onSettled)
     await vi.advanceTimersByTimeAsync(handle.settleAfterMs)
 
-    expect(sendRuntimePtyInputVerified).toHaveBeenCalledWith(SETTINGS, PTY, '2')
+    expect(sendRuntimePtyInputVerified).toHaveBeenCalledWith(SETTINGS, PTY, '2', 'driving')
     expect(onSettled).not.toHaveBeenCalled()
 
     resolveAccepted(true)
diff --git a/src/renderer/src/components/native-chat/native-chat-runtime-send.ts b/src/renderer/src/components/native-chat/native-chat-runtime-send.ts
index a845fe10d168..1eb7a676103e 100644
--- a/src/renderer/src/components/native-chat/native-chat-runtime-send.ts
+++ b/src/renderer/src/components/native-chat/native-chat-runtime-send.ts
@@ -72,7 +72,12 @@ export function clearUnsubmittedAgentInput(
   ptyId: string,
   options?: NativeChatSendOptions
 ): void {
-  sendRuntimePtyInput(settings, ptyId, options?.clearInput ?? NATIVE_CHAT_CLEAR_UNSUBMITTED_INPUT)
+  sendRuntimePtyInput(
+    settings,
+    ptyId,
+    options?.clearInput ?? NATIVE_CHAT_CLEAR_UNSUBMITTED_INPUT,
+    'driving'
+  )
 }
 
 /**
@@ -104,7 +109,7 @@ export function clearThenWrite(
       // An unreadable terminal is unconfirmed; the maximal clear remains safe.
     }
     if (!cleared) {
-      sendRuntimePtyInput(settings, ptyId, AGENT_TUI_CLEAR_INPUT_MAX)
+      sendRuntimePtyInput(settings, ptyId, AGENT_TUI_CLEAR_INPUT_MAX, 'driving')
     }
     writeBody()
   })
@@ -140,11 +145,11 @@ export function sendNativeChatMessage(
         if (isCancelled()) {
           return
         }
-        sendRuntimePtyInput(settings, ptyId, buildNativeChatPasteBytes(text))
+        sendRuntimePtyInput(settings, ptyId, buildNativeChatPasteBytes(text), 'driving')
         // Schedule from the actual body write: an overdue clear-confirm callback
         // must not collapse the required body-to-Enter gap after a renderer stall.
         delay(NATIVE_CHAT_SUBMIT_DELAY_MS, () => {
-          sendRuntimePtyInput(settings, ptyId, NATIVE_CHAT_SUBMIT)
+          sendRuntimePtyInput(settings, ptyId, NATIVE_CHAT_SUBMIT, 'driving')
           markSubmitted()
         })
       })
@@ -203,12 +208,13 @@ export async function sendNativeChatMessageVerified(
   const bodyAccepted = await sendRuntimePtyInputVerified(
     settings,
     ptyId,
-    buildNativeChatPasteBytes(text)
+    buildNativeChatPasteBytes(text),
+    'driving'
   )
   if (!bodyAccepted || signal?.aborted || !(await waitForNativeChatSubmit(signal))) {
     return false
   }
-  return sendRuntimePtyInputVerified(settings, ptyId, NATIVE_CHAT_SUBMIT)
+  return sendRuntimePtyInputVerified(settings, ptyId, NATIVE_CHAT_SUBMIT, 'driving')
 }
 
 /** Types a slash command as individual keys so Codex opens its command palette. */
@@ -224,7 +230,7 @@ export async function typeNativeChatCommand(
     command,
     signal,
     write: async (key) =>
-      (await sendRuntimePtyInputVerified(settings, ptyId, key)) ? 'accepted' : 'rejected'
+      (await sendRuntimePtyInputVerified(settings, ptyId, key, 'driving')) ? 'accepted' : 'rejected'
   })
   return outcome === 'accepted'
 }
@@ -253,7 +259,9 @@ export function sendNativeChatTypedCommand(
           if (isCancelled()) {
             return 'rejected'
           }
-          return (await sendRuntimePtyInputVerified(settings, ptyId, key)) ? 'accepted' : 'rejected'
+          return (await sendRuntimePtyInputVerified(settings, ptyId, key, 'driving'))
+            ? 'accepted'
+            : 'rejected'
         }
       }).then(finish, () => finish('rejected'))
     },
@@ -269,7 +277,7 @@ export function sendNativeChatTypedCommand(
 /** Submit a TUI prompt with no body (Enter only) — e.g. a plain submit when the
  *  composer is empty. */
 export function submitNativeChatPrompt(settings: RuntimeSettings, ptyId: string): void {
-  sendRuntimePtyInput(settings, ptyId, NATIVE_CHAT_SUBMIT)
+  sendRuntimePtyInput(settings, ptyId, NATIVE_CHAT_SUBMIT, 'driving')
 }
 
 /**
@@ -297,10 +305,10 @@ export function sendNativeChatAskAnswer(
           // Why: inference must use the remote host's acceptance result, not
           // the fire-and-forget renderer dispatch result.
           verifiedWrites.push(
-            sendRuntimePtyInputVerified(settings, ptyId, bytes).catch(() => false)
+            sendRuntimePtyInputVerified(settings, ptyId, bytes, 'driving').catch(() => false)
           )
         } else {
-          sendRuntimePtyInput(settings, ptyId, bytes)
+          sendRuntimePtyInput(settings, ptyId, bytes, 'driving')
         }
       }, index * NATIVE_CHAT_QUESTION_STEP_MS)
     )
diff --git a/src/renderer/src/components/native-chat/native-chat-session-assembler.ts b/src/renderer/src/components/native-chat/native-chat-session-assembler.ts
index eb61380967ff..674e14d6bf8b 100644
--- a/src/renderer/src/components/native-chat/native-chat-session-assembler.ts
+++ b/src/renderer/src/components/native-chat/native-chat-session-assembler.ts
@@ -7,7 +7,7 @@ import {
   type NativeChatSessionStatus
 } from '../../../../shared/native-chat-types'
 import { NATIVE_CHAT_STREAMING_ID } from '../../../../shared/native-chat-streaming'
-import { compareNativeChatMessagesByTime } from '../../../../shared/native-chat-transcript-projection'
+import { compareNativeChatTranscriptMessages } from '../../../../shared/native-chat-transcript-projection'
 import {
   hasImagePromptMarker,
   isImageSourceUserTurn,
@@ -105,14 +105,14 @@ function messageSortRank(message: NativeChatMessage): number {
   return 0
 }
 
-// Rank first; within a tier the transcript's shared time order.
+// Rank first; within a tier the transcript's shared order.
 export function compareMessages(a: NativeChatMessage, b: NativeChatMessage): number {
   const ar = messageSortRank(a)
   const br = messageSortRank(b)
   if (ar !== br) {
     return ar - br
   }
-  return compareNativeChatMessagesByTime(a, b)
+  return compareNativeChatTranscriptMessages(a, b)
 }
 
 /**
diff --git a/src/renderer/src/components/native-chat/native-chat-transcript-slots.test.ts b/src/renderer/src/components/native-chat/native-chat-transcript-slots.test.ts
index ecb6a183f4ea..f22d25bfa8f5 100644
--- a/src/renderer/src/components/native-chat/native-chat-transcript-slots.test.ts
+++ b/src/renderer/src/components/native-chat/native-chat-transcript-slots.test.ts
@@ -139,14 +139,15 @@ describe('transcript slots', () => {
     expect(slots[0]?.receipt).toBe(receipt)
   })
 
-  it('leaves the running turn status to the single transcript-tail indicator', () => {
+  it('puts the running turn bar under the prompt it answers', () => {
     const status: NativeChatTurnStatus = { startedAt: 1, thinking: false, workedSeconds: null }
-    const slots = build([text('u', 'ask', 'user')], {
+    const slots = build([text('u', 'ask', 'user'), text('a', 'answer')], {
       latestUserIndex: 0,
       turnStatuses: { active: status, completedByTurn: {} },
       isWorking: true
     })
-    expect(slots[0]?.status).toBeUndefined()
+    expect(slots[0]?.status).toBe(status)
+    expect(slots[1]?.status).toBeUndefined()
   })
 
   it('reserves a height for every slot it keeps', () => {
diff --git a/src/renderer/src/components/native-chat/native-chat-transcript-slots.ts b/src/renderer/src/components/native-chat/native-chat-transcript-slots.ts
index bf1b3f3e75cc..a0fe23b6df34 100644
--- a/src/renderer/src/components/native-chat/native-chat-transcript-slots.ts
+++ b/src/renderer/src/components/native-chat/native-chat-transcript-slots.ts
@@ -135,8 +135,8 @@ export function buildNativeChatTranscriptSlots(
         : message.role === 'user' && turnKey
           ? turnStatuses.completedByTurn[turnKey]
           : undefined
-    const status =
-      showTurnStatus && candidateStatus?.workedSeconds != null ? candidateStatus : undefined
+    // The live turn's bar carries its running clock; it settles in place.
+    const status = showTurnStatus ? (candidateStatus ?? undefined) : undefined
     const turnDiff = turnKey && turnKeys[index + 1] !== turnKey ? turnDiffs.get(turnKey) : undefined
     const folded = foldedRows.has(index)
     // Skipping a folded row entirely is what keeps windowing honest: a counted
diff --git a/src/renderer/src/components/native-chat/native-chat-view-state.test.ts b/src/renderer/src/components/native-chat/native-chat-view-state.test.ts
index ea97ec99a191..39bf20322b50 100644
--- a/src/renderer/src/components/native-chat/native-chat-view-state.test.ts
+++ b/src/renderer/src/components/native-chat/native-chat-view-state.test.ts
@@ -34,7 +34,30 @@ describe('selectNativeChatViewState', () => {
     })
   })
 
-  it('maps error with its message', () => {
+  it('maps error with its message when nothing has loaded (P2-21)', () => {
+    const state = selectNativeChatViewState(
+      session({ messages: [], status: 'error', error: 'boom' })
+    )
+    expect(state).toEqual({ kind: 'error', message: 'boom' })
+  })
+
+  // The pane's own translated line fills in, which for the structured chat says the read retries.
+  it('maps an error with no text to no message', () => {
+    expect(selectNativeChatViewState(session({ messages: [], status: 'error' }))).toEqual({
+      kind: 'error'
+    })
+  })
+
+  it('keeps a loaded transcript on screen when a later read fails (P2-21)', () => {
+    const state = selectNativeChatViewState(session({ status: 'error', error: 'boom' }), {
+      readRetries: true
+    })
+    expect(state).toEqual({ kind: 'ready', isWorking: false })
+  })
+
+  // The terminal-backed read does not retry; its only messages on error are local echoes (a launch
+  // prompt, a pending send), which must not hide the error and its way back to the terminal.
+  it('shows a terminal-backed read error over local echoes', () => {
     const state = selectNativeChatViewState(session({ status: 'error', error: 'boom' }))
     expect(state).toEqual({ kind: 'error', message: 'boom' })
   })
diff --git a/src/renderer/src/components/native-chat/native-chat-view-state.ts b/src/renderer/src/components/native-chat/native-chat-view-state.ts
index 775635df1229..13a7e8a5afe6 100644
--- a/src/renderer/src/components/native-chat/native-chat-view-state.ts
+++ b/src/renderer/src/components/native-chat/native-chat-view-state.ts
@@ -10,23 +10,36 @@ import type { NativeChatSession } from '../../../../shared/native-chat-types'
  *  live in-flight indicator. The rest are full-pane states. */
 export type NativeChatViewState =
   | { kind: 'loading' }
-  | { kind: 'error'; message: string }
+  | { kind: 'error'; message?: string }
   | { kind: 'empty' }
   | { kind: 'ready'; isWorking: false }
   | { kind: 'ready'; isWorking: true }
 
 /**
- * Decide which surface to render. Error is terminal, but any renderable message
- * wins over loading/empty so optimistic first sends never get replaced by a
- * full-pane placeholder while transcript discovery catches up.
+ * Decide which surface to render. Any renderable message wins over loading/empty so optimistic
+ * first sends never get replaced while transcript discovery catches up. Where the read retries on
+ * its own (the structured chat), messages win over an error too: a read that fails after the
+ * transcript loaded keeps it, and the error reaches the composer's error line. The terminal-backed
+ * read does not retry, and its only messages on error are local echoes, so its error takes the pane.
  */
-export function selectNativeChatViewState(session: NativeChatSession): NativeChatViewState {
-  if (session.status === 'error') {
-    return { kind: 'error', message: session.error ?? 'Conversation could not be loaded.' }
+export function selectNativeChatViewState(
+  session: NativeChatSession,
+  { readRetries = false }: { readRetries?: boolean } = {}
+): NativeChatViewState {
+  // No text of its own: the empty state supplies the pane's translated line.
+  const error: NativeChatViewState | null =
+    session.status === 'error'
+      ? { kind: 'error', ...(session.error ? { message: session.error } : {}) }
+      : null
+  if (error && !readRetries) {
+    return error
   }
   if (session.messages.length > 0) {
     return { kind: 'ready', isWorking: session.status === 'working' }
   }
+  if (error) {
+    return error
+  }
   if (session.status === 'loading') {
     return { kind: 'loading' }
   }
diff --git a/src/renderer/src/components/native-chat/native-chat-working-status-shared-clock.test.tsx b/src/renderer/src/components/native-chat/native-chat-working-status-shared-clock.test.tsx
index e4bae2920046..8600d40c3caa 100644
--- a/src/renderer/src/components/native-chat/native-chat-working-status-shared-clock.test.tsx
+++ b/src/renderer/src/components/native-chat/native-chat-working-status-shared-clock.test.tsx
@@ -20,7 +20,7 @@ function renderTurns(count: number, startedAt: number): void {
     root.render(
       <>
         {Array.from({ length: count }, (_, index) => (
-          <NativeChatWorkingStatus key={index} startedAt={startedAt} thinking={false} />
+          <NativeChatWorkingStatus key={index} startedAt={startedAt} />
         ))}
       </>
     )
@@ -61,9 +61,7 @@ describe('native chat working status elapsed clock', () => {
 
   it('renders the compact duration in the completed status label', () => {
     act(() => {
-      root.render(
-        <NativeChatWorkingStatus startedAt={1_000_000} thinking={false} workedSeconds={69} />
-      )
+      root.render(<NativeChatWorkingStatus startedAt={1_000_000} workedSeconds={69} />)
     })
 
     expect(elapsedLabels()).toEqual(['Worked for 1m 9s'])
@@ -96,14 +94,9 @@ describe('native chat working status elapsed clock', () => {
     expect(vi.getTimerCount()).toBe(1)
   })
 
-  it('holds no timer for a thinking turn or a completed turn', () => {
+  it('holds no timer for a completed turn', () => {
     act(() => {
-      root.render(
-        <>
-          <NativeChatWorkingStatus startedAt={1_000_000} thinking />
-          <NativeChatWorkingStatus startedAt={1_000_000} thinking={false} workedSeconds={12} />
-        </>
-      )
+      root.render(<NativeChatWorkingStatus startedAt={1_000_000} workedSeconds={12} />)
     })
     expect(vi.getTimerCount()).toBe(0)
   })
diff --git a/src/renderer/src/components/native-chat/structured-agent-question-projection.ts b/src/renderer/src/components/native-chat/structured-agent-question-projection.ts
index b56fa1c7ab0e..9469c443d0a8 100644
--- a/src/renderer/src/components/native-chat/structured-agent-question-projection.ts
+++ b/src/renderer/src/components/native-chat/structured-agent-question-projection.ts
@@ -4,6 +4,7 @@ import type {
 } from '../../../../shared/agent-session-journal-types'
 import { isAskUserQuestionTool } from '../../../../shared/agent-question-answered-intent'
 import { parseAskFromToolInput } from '../../../../shared/native-chat-ask'
+import { agentJournalItemRowOrigin } from '../../../../shared/agent-session-journal-position'
 import type { NativeChatMessage } from '../../../../shared/native-chat-types'
 import { projectStructuredItemToNativeChat } from '../../../../shared/structured-agent-session-projection'
 import { readAgentJournalTurn } from '../../../../shared/agent-session-turn-record'
@@ -69,10 +70,8 @@ function projectItem(item: AgentJournalRenderItem): Projection {
     if (body.resolution.state === 'pending') {
       // A system row preserves question identity through tool folding; the receipt renders its body.
       message = {
-        id: item.itemId,
+        ...agentJournalItemRowOrigin(item),
         role: 'system',
-        timestamp: item.observedAt,
-        source: 'transcript',
         blocks: [{ type: 'text', text: body.question }]
       }
     }
diff --git a/src/renderer/src/components/native-chat/structured-agent-session-outbox-dispatch.ts b/src/renderer/src/components/native-chat/structured-agent-session-outbox-dispatch.ts
index fc2d5adf1508..9f91b9f9b3b1 100644
--- a/src/renderer/src/components/native-chat/structured-agent-session-outbox-dispatch.ts
+++ b/src/renderer/src/components/native-chat/structured-agent-session-outbox-dispatch.ts
@@ -10,6 +10,7 @@ import {
 import type { RuntimeClientTarget } from '@/runtime/runtime-rpc-client'
 import { callStructuredAgentSession } from '@/runtime/structured-agent-session-client'
 import {
+  stageStructuredAgentSessionOutboxEntryForSend,
   structuredAgentSessionSendRequest,
   updateStructuredAgentSessionOutboxEntry,
   type StructuredAgentSessionOutboxEntry
@@ -56,6 +57,18 @@ export function readMountedStructuredAgentSessionOutbox(
   )
 }
 
+/** A send left dispatching when its owner changed goes out again, under the same id. */
+export function requeueInterruptedStructuredAgentSessionDispatches(
+  entries: StructuredAgentSessionOutboxEntry[],
+  fence: number | null
+): StructuredAgentSessionOutboxEntry[] {
+  return entries.map((entry) =>
+    entry.state === 'dispatching' && !hasInFlightLaunchDispatch(entry, fence)
+      ? { ...entry, state: 'queued' as const }
+      : entry
+  )
+}
+
 export function dispatchStructuredAgentSessionOutboxEntry(args: {
   next: StructuredAgentSessionOutboxEntry
   persisted: readonly StructuredAgentSessionOutboxEntry[]
@@ -77,7 +90,7 @@ export function dispatchStructuredAgentSessionOutboxEntry(args: {
     const staged = updateStructuredAgentSessionOutboxEntry(
       args.persisted,
       args.next.clientMessageId,
-      (entry) => ({ ...entry, state: 'dispatching' as const, lastAttemptAt: Date.now() })
+      (entry) => stageStructuredAgentSessionOutboxEntryForSend(entry, Date.now())
     )
     if (!writeOutbox(args.sessionId, staged)) {
       args.inFlightIdRef.current = null
diff --git a/src/renderer/src/components/native-chat/structured-agent-session-outbox-storage.test.ts b/src/renderer/src/components/native-chat/structured-agent-session-outbox-storage.test.ts
index f289feb7c34b..9b8b3c537a67 100644
--- a/src/renderer/src/components/native-chat/structured-agent-session-outbox-storage.test.ts
+++ b/src/renderer/src/components/native-chat/structured-agent-session-outbox-storage.test.ts
@@ -1,9 +1,13 @@
 // @vitest-environment happy-dom
 
 import { beforeEach, describe, expect, it, vi } from 'vitest'
-import { createStructuredAgentSessionOutboxEntry } from '../../../../shared/structured-agent-session-outbox'
+import {
+  createStructuredAgentSessionOutboxEntry,
+  type StructuredAgentSessionAttemptFailure
+} from '../../../../shared/structured-agent-session-outbox'
 import {
   hasUndeliveredStructuredAgentSessionOutbox,
+  readOutbox,
   resetUndeliveredStructuredAgentSessionOutboxForTests,
   subscribeToUndeliveredStructuredAgentSessionOutbox,
   writeOutbox
@@ -103,3 +107,102 @@ describe('undelivered structured agent session outbox projection', () => {
     releaseRemount()
   })
 })
+
+describe("a saved message's last failure", () => {
+  beforeEach(() => {
+    localStorage.clear()
+  })
+
+  it.each<StructuredAgentSessionAttemptFailure>([
+    { kind: 'refused', code: 'agent_session_checkpoint_stale' },
+    { kind: 'refused', code: 'agent_session_conflict', details: { reason: 'chatStarting' } },
+    {
+      kind: 'refused',
+      code: 'agent_session_ownership_unknown',
+      details: { reason: 'ownerUnproven', ownerVerdict: 'unverifiable' }
+    },
+    { kind: 'rejected', reason: 'Claude messages support at most 20 images' },
+    {
+      kind: 'rejected',
+      reason: 'Claude accepts at most 20 images in one message, so this message was not sent.',
+      rejection: { kind: 'attachmentInvalid', attachment: { reason: 'tooMany', limit: 20 } }
+    },
+    { kind: 'rejected', reason: null },
+    { kind: 'failed' }
+  ])('reads back $kind as it was saved', (lastFailure) => {
+    writeOutbox('session-a', [{ ...entry('session-a', 'client-1'), lastFailure }])
+
+    expect(readOutbox('session-a')[0]?.lastFailure).toEqual(lastFailure)
+  })
+
+  it('keeps the message and drops a failure it cannot read', () => {
+    localStorage.setItem(
+      'orca:desktopStructuredAgentSessionOutbox:v1:session-a',
+      JSON.stringify([
+        { ...entry('session-a', 'client-1'), lastFailure: 'The agent was restarting.' },
+        { ...entry('session-a', 'client-2'), lastFailure: { kind: 'rejected', reason: 7 } }
+      ])
+    )
+
+    const read = readOutbox('session-a')
+    expect(read.map((saved) => saved.clientMessageId)).toEqual(['client-1', 'client-2'])
+    expect(read.every((saved) => saved.lastFailure === undefined)).toBe(true)
+  })
+
+  // Written by a build that kept only the code or the reason; it reads as that build meant it.
+  it('reads an entry saved before failures carried details as it was', () => {
+    localStorage.setItem(
+      'orca:desktopStructuredAgentSessionOutbox:v1:session-a',
+      JSON.stringify([
+        {
+          ...entry('session-a', 'client-1'),
+          lastFailure: { kind: 'refused', code: 'agent_session_checkpoint_stale' }
+        },
+        { ...entry('session-a', 'client-2'), lastFailure: { kind: 'rejected', reason: 'Nope.' } }
+      ])
+    )
+
+    expect(readOutbox('session-a').map((saved) => saved.lastFailure)).toEqual([
+      { kind: 'refused', code: 'agent_session_checkpoint_stale' },
+      { kind: 'rejected', reason: 'Nope.' }
+    ])
+  })
+
+  it('keeps only what a newer build saved that this one can place', () => {
+    localStorage.setItem(
+      'orca:desktopStructuredAgentSessionOutbox:v1:session-a',
+      JSON.stringify([
+        {
+          ...entry('session-a', 'client-1'),
+          lastFailure: {
+            kind: 'refused',
+            code: 'agent_session_checkpoint_stale',
+            details: { reason: 'fromTheFuture', currentFence: 4 }
+          }
+        },
+        {
+          ...entry('session-a', 'client-2'),
+          lastFailure: {
+            kind: 'rejected',
+            reason: 'Claude stopped before it finished starting.',
+            rejection: { kind: 'providerStartFailed', detail: { text: 'exit 1', audience: 'log' } }
+          }
+        },
+        {
+          ...entry('session-a', 'client-3'),
+          lastFailure: { kind: 'rejected', reason: 'Nope.', rejection: { kind: 'fromTheFuture' } }
+        }
+      ])
+    )
+
+    expect(readOutbox('session-a').map((saved) => saved.lastFailure)).toEqual([
+      { kind: 'refused', code: 'agent_session_checkpoint_stale' },
+      {
+        kind: 'rejected',
+        reason: 'Claude stopped before it finished starting.',
+        rejection: { kind: 'providerStartFailed' }
+      },
+      { kind: 'rejected', reason: 'Nope.' }
+    ])
+  })
+})
diff --git a/src/renderer/src/components/native-chat/structured-agent-session-outbox-storage.ts b/src/renderer/src/components/native-chat/structured-agent-session-outbox-storage.ts
index b96fb55ea60f..8e9bb342638d 100644
--- a/src/renderer/src/components/native-chat/structured-agent-session-outbox-storage.ts
+++ b/src/renderer/src/components/native-chat/structured-agent-session-outbox-storage.ts
@@ -4,6 +4,7 @@ import {
   type StructuredAgentSessionOutboxEntry
 } from '../../../../shared/structured-agent-session-outbox'
 import { createStructuredAgentSessionOperationId } from '../../../../shared/structured-agent-session-mutation'
+import { createBrowserUuid } from '@/lib/browser-uuid'
 
 const OUTBOX_PREFIX = 'orca:desktopStructuredAgentSessionOutbox:v1:'
 
@@ -103,7 +104,7 @@ export function enqueueStructuredAgentSessionLaunchPrompt(
 ): StructuredAgentSessionOutboxEntry | null {
   const entry = {
     ...createStructuredAgentSessionOutboxEntry({
-      clientMessageId: createStructuredAgentSessionOperationId(() => crypto.randomUUID()),
+      clientMessageId: createStructuredAgentSessionOperationId(createBrowserUuid),
       sessionId,
       text,
       attachments: [],
diff --git a/src/renderer/src/components/native-chat/structured-agent-session-read-transport.test.ts b/src/renderer/src/components/native-chat/structured-agent-session-read-transport.test.ts
index 5e5be1b6b3b4..0305b93cb6d4 100644
--- a/src/renderer/src/components/native-chat/structured-agent-session-read-transport.test.ts
+++ b/src/renderer/src/components/native-chat/structured-agent-session-read-transport.test.ts
@@ -269,7 +269,7 @@ describe('structured agent-session read transport unattached refusals', () => {
       // ...and the failure is owed once it has passed.
       await vi.advanceTimersByTimeAsync(750)
       attempts.at(-1)?.onError(rpcRefusal(UNATTACHED))
-      expect(applyError).toHaveBeenCalledWith(`RuntimeRpcCallError: ${UNATTACHED}`)
+      expect(applyError).toHaveBeenCalledWith(UNATTACHED)
       transport.dispose()
     } finally {
       vi.useRealTimers()
@@ -284,7 +284,7 @@ describe('structured agent-session read transport unattached refusals', () => {
         throw new Error('journal read failed')
       }, applyError)
       await flushPromises()
-      expect(applyError).toHaveBeenCalledExactlyOnceWith('Error: journal read failed')
+      expect(applyError).toHaveBeenCalledExactlyOnceWith('journal read failed')
       transport.dispose()
     } finally {
       vi.useRealTimers()
@@ -303,7 +303,32 @@ describe('structured agent-session read transport unattached refusals', () => {
       expect(applyError).not.toHaveBeenCalled()
 
       attempts[0].onError({ code: 'runtime_error', message: 'transport died' })
-      expect(applyError).toHaveBeenCalledOnce()
+      // The host's own words, never `[object Object]` (P2-04).
+      expect(applyError).toHaveBeenCalledExactlyOnceWith('transport died')
+      transport.dispose()
+    } finally {
+      vi.useRealTimers()
+    }
+  })
+
+  it('re-opens after a failed open and leaves the error once the conversation reads (P2-04)', async () => {
+    vi.useFakeTimers()
+    try {
+      const applyError = vi.fn()
+      const applyEvent = vi.fn()
+      const transport = startWithHydration(async () => undefined, applyError, applyEvent)
+      await flushPromises()
+      attempts[0].onError({ code: 'agent_session_journal_unreadable', message: 'disk full' })
+      attempts[0].closed.resolve({ unsubscribe: attempts[0].unsubscribe })
+      await flushPromises()
+      expect(applyError).toHaveBeenCalledExactlyOnceWith('disk full')
+
+      // The retry re-asks, and the host's open runs again: a fault that cleared now reads.
+      await vi.advanceTimersByTimeAsync(750)
+      expect(attempts).toHaveLength(2)
+      attempts[1].onEvent(snapshot(1))
+      await flushPromises()
+      expect(applyEvent).toHaveBeenCalledWith(expect.objectContaining({ type: 'snapshot' }))
       transport.dispose()
     } finally {
       vi.useRealTimers()
diff --git a/src/renderer/src/components/native-chat/structured-agent-session-read-transport.ts b/src/renderer/src/components/native-chat/structured-agent-session-read-transport.ts
index f4310cec8904..ed8423fd079b 100644
--- a/src/renderer/src/components/native-chat/structured-agent-session-read-transport.ts
+++ b/src/renderer/src/components/native-chat/structured-agent-session-read-transport.ts
@@ -8,6 +8,25 @@ import {
 import type { RuntimeClientTarget } from '@/runtime/runtime-rpc-client'
 import { subscribeStructuredAgentSession } from '@/runtime/structured-agent-session-client'
 
+// A stream hands its failure over as the raw `{ code, message }` payload; `String()` of that is `[object Object]`.
+function readFailureText(error: unknown): string {
+  if (error instanceof Error) {
+    return error.message || 'Something went wrong.'
+  }
+  if (typeof error === 'string') {
+    return error || 'Something went wrong.'
+  }
+  if (typeof error === 'object' && error !== null) {
+    if ('message' in error && typeof error.message === 'string' && error.message.length > 0) {
+      return error.message
+    }
+    if ('code' in error && typeof error.code === 'string' && error.code.length > 0) {
+      return error.code
+    }
+  }
+  return 'Something went wrong.'
+}
+
 function createReconnectScheduler(args: { shouldStop: () => boolean; reconnect: () => void }) {
   let timer: ReturnType<typeof setTimeout> | null = null
   return {
@@ -69,8 +88,8 @@ export function startStructuredAgentSessionReadTransport(args: {
    * A read failure, reported to the pane only once it is one.
    *
    * A refusal saying this host holds no attached session is the retry loop's own subject, not a
-   * verdict: the reconnect below re-asks, and either the hold that attaches the session or the tab
-   * retirement that ends the pane resolves it. Painting the pane red inside that window turned an
+   * verdict: the reconnect below re-asks, and either the host opening the session or the tab
+   * retirement that ends the pane resolves it. Only an older host still refuses this way. Painting the pane red inside that window turned an
    * ordinary chat close into a `Could not load conversation` the user could do nothing about.
    *
    * A window, not a mute. An unattached read still refusing past the grace is no longer
@@ -79,13 +98,13 @@ export function startStructuredAgentSessionReadTransport(args: {
   const reportReadFailure = (error: unknown): void => {
     if (!isUnattachedAgentSessionReadRefusal(error)) {
       clearUnattachedReadGrace()
-      args.applyError(String(error))
+      args.applyError(readFailureText(error))
       return
     }
     const now = Date.now()
     unattachedSince ??= now
     if (now - unattachedSince >= AGENT_SESSION_UNATTACHED_READ_GRACE_MS) {
-      args.applyError(String(error))
+      args.applyError(readFailureText(error))
     }
   }
   const captureHistoryReadGuard = (): (() => boolean) => {
diff --git a/src/renderer/src/components/native-chat/structured-agent-session-transcript-order.test.ts b/src/renderer/src/components/native-chat/structured-agent-session-transcript-order.test.ts
new file mode 100644
index 000000000000..ea9b3a0cf3bf
--- /dev/null
+++ b/src/renderer/src/components/native-chat/structured-agent-session-transcript-order.test.ts
@@ -0,0 +1,130 @@
+import { describe, expect, it } from 'vitest'
+import type {
+  AgentJournalItemBody,
+  AgentJournalRenderItem,
+  AgentJournalSubmission
+} from '../../../../shared/agent-session-journal-types'
+import { projectAgentSessionConversationOutline } from '../../../../shared/agent-session-conversation-outline'
+import { agentJournalSubmissionKey } from '../../../../shared/agent-session-journal-item-key'
+import {
+  createStructuredAgentSessionOutboxEntry,
+  type StructuredAgentSessionOutboxEntry
+} from '../../../../shared/structured-agent-session-outbox'
+import { createNativeChatMessageListProjection } from './native-chat-message-list-projection'
+import { projectStructuredAgentSessionMessages } from './structured-agent-session-message-projection'
+
+function journalItem(
+  itemId: string,
+  sequence: number,
+  observedAt: number,
+  body: AgentJournalItemBody,
+  extra: Partial<AgentJournalRenderItem> = {}
+): AgentJournalRenderItem {
+  return { itemId, revision: 1, sequence, observedAt, body, ...extra }
+}
+
+function said(role: 'user' | 'assistant', text: string): AgentJournalItemBody {
+  return { kind: 'message', role, blocks: [{ type: 'text', text }] }
+}
+
+function answered(question: string): AgentJournalItemBody {
+  return {
+    kind: 'question',
+    question,
+    options: [{ id: 'yes', label: 'Yes' }],
+    resolution: { state: 'resolved', selectedOptionId: 'yes', resolvedBy: 'client', resolvedAt: 9 }
+  }
+}
+
+/** The ids the desktop transcript list draws, top to bottom. */
+function drawn(
+  items: AgentJournalRenderItem[],
+  outbox: StructuredAgentSessionOutboxEntry[] = [],
+  submissions: AgentJournalSubmission[] = []
+): string[] {
+  return createNativeChatMessageListProjection()(
+    projectStructuredAgentSessionMessages(items, outbox, submissions)
+  ).map(({ id }) => id)
+}
+
+function queued(clientMessageId: string, text: string, queuedAt: number) {
+  return createStructuredAgentSessionOutboxEntry({
+    clientMessageId,
+    sessionId: 'session',
+    text,
+    attachments: [],
+    queuedAt
+  })
+}
+
+describe('structured transcript order', () => {
+  it('draws a row recovered after a crash at its journal position, not its earlier clock', () => {
+    // The provider logged the last prompt before the crash; the host journalled it on recovery.
+    const items = [
+      journalItem('ask', 1, 100, said('user', 'Fix the parser')),
+      journalItem('reply', 2, 300, said('assistant', 'Working on it')),
+      journalItem('steer', 3, 310, said('user', 'Keep the old API')),
+      journalItem('recovered', 4, 200, said('user', 'Also add a test'), {
+        recovered: true,
+        recoveredAt: 400
+      })
+    ]
+    expect(drawn(items)).toEqual(['ask', 'reply', 'steer', 'recovered'])
+    // The host's outline, published to every client, uses the same order.
+    expect(projectAgentSessionConversationOutline(items, []).map(({ itemId }) => itemId)).toEqual([
+      'ask',
+      'steer',
+      'recovered'
+    ])
+  })
+
+  it("draws one write's questions by their place in it, whatever order they arrive in", () => {
+    // One Codex ask: a single journal write, one sequence and one timestamp. Neither
+    // the ids nor the arrival order below spell the order it was asked in.
+    const scope = journalItem('q:scope', 5, 500, answered('Which files?'))
+    const priority = journalItem('q:priority', 5, 500, answered('What matters?'), {
+      sequenceIndex: 1
+    })
+    const deadline = journalItem('q:deadline', 5, 500, answered('When?'), { sequenceIndex: 2 })
+    expect(drawn([priority, deadline, scope])).toEqual(['q:scope', 'q:priority', 'q:deadline'])
+  })
+
+  it('keeps a send the journal does not hold yet below every row it does', () => {
+    // The composer's clock can trail the host's; the unsent message still reads last.
+    const outbox = [queued('queued', 'One more thing', 150)]
+    const items = [
+      journalItem('ask', 1, 100, said('user', 'Fix the parser')),
+      journalItem('reply', 2, 200, said('assistant', 'Working on it'))
+    ]
+    expect(drawn(items, outbox)).toEqual(['ask', 'reply', agentJournalSubmissionKey('queued')])
+  })
+
+  it('keeps a send the journal recorded and the provider refused at its journal place', () => {
+    // The agent kept writing after the refused steer; its Retry stays with the composer.
+    const refused = agentJournalSubmissionKey('steer')
+    const items = [
+      journalItem('ask', 1, 100, said('user', 'Fix the parser')),
+      journalItem(refused, 2, 200, said('user', 'Keep the old API')),
+      journalItem('reply', 3, 300, said('assistant', 'Done.'))
+    ]
+    const submissions: AgentJournalSubmission[] = [
+      {
+        clientMessageId: 'steer',
+        fence: 1,
+        payloadFingerprint: 'fingerprint',
+        dispatchState: 'rejected',
+        providerItemId: null,
+        reason: 'provider_refused',
+        submittedAt: 200,
+        resolvedAt: 250
+      }
+    ]
+    expect(
+      drawn(
+        items,
+        [queued('steer', 'Keep the old API', 190), queued('next', 'And docs', 400)],
+        submissions
+      )
+    ).toEqual(['ask', refused, 'reply', agentJournalSubmissionKey('next')])
+  })
+})
diff --git a/src/renderer/src/components/native-chat/structured-attention-dispatch.test.ts b/src/renderer/src/components/native-chat/structured-attention-dispatch.test.ts
index 573eca9d4553..76a49ff8e3bc 100644
--- a/src/renderer/src/components/native-chat/structured-attention-dispatch.test.ts
+++ b/src/renderer/src/components/native-chat/structured-attention-dispatch.test.ts
@@ -10,6 +10,7 @@ import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import type { FolderWorkspace } from '../../../../shared/folder-workspace-types'
 import type { GlobalSettings } from '../../../../shared/global-settings-types'
 import type { AgentSessionTurnCompletion } from '../../../../shared/agent-session-wire'
+import { agentJournalSubmissionKey } from '../../../../shared/agent-session-journal-item-key'
 import { structuredAgentSessionPaneKey } from '../../../../shared/structured-agent-session-projection'
 import {
   createTestStore,
@@ -230,7 +231,7 @@ describe('dispatchStructuredTurnCompletionAttention', () => {
     expect(indicators().paneDot).toBe('agent-completion')
   })
 
-  it('words a successful turn as finished and a stopped one through the shipped interrupted flag', () => {
+  it('hands main the host verdict, which picks finished, failed or stopped', () => {
     dispatchStructuredTurnCompletionAttention(structuredTab(), completion())
     // 'done' is the host's report that the turn settled, not a reading of the status row: main
     // words a 'working' state as "working", which would announce a finished turn as unfinished.
@@ -238,16 +239,39 @@ describe('dispatchStructuredTurnCompletionAttention', () => {
       source: 'agent-task-complete',
       surface: 'agent-session',
       agentState: 'done',
-      agentInterrupted: false
+      agentTurnOutcome: 'success'
     })
 
-    dispatched.length = 0
-    seed()
+    for (const [outcome, turnId] of [
+      ['cancellation', 'turn-2'],
+      ['failure', 'turn-3']
+    ] as const) {
+      dispatched.length = 0
+      seed()
+      dispatchStructuredTurnCompletionAttention(structuredTab(), completion({ outcome, turnId }))
+      expect(onlyDispatch()).toMatchObject({ agentState: 'done', agentTurnOutcome: outcome })
+    }
+  })
+
+  it('calls back a send refused before any turn, named by its journal item key, as failed', () => {
     dispatchStructuredTurnCompletionAttention(
       structuredTab(),
-      completion({ outcome: 'cancellation', turnId: 'turn-2' })
+      completion({ outcome: 'failure', turnId: agentJournalSubmissionKey('m1') })
     )
-    expect(onlyDispatch()).toMatchObject({ agentState: 'done', agentInterrupted: true })
+    expect(indicators().paneDot).toBe('agent-completion')
+    expect(onlyDispatch()).toMatchObject({ agentState: 'done', agentTurnOutcome: 'failure' })
+  })
+
+  it('asks for input when the host settled a request while a prompt waits on the user', () => {
+    // e.g. a subagent's approval is unanswered.
+    dispatchStructuredTurnCompletionAttention(structuredTab(), completion({ awaitingUser: true }))
+    expect(indicators().paneDot).toBe('agent-completion')
+    expect(onlyDispatch()).toMatchObject({ agentState: 'blocked', agentTurnOutcome: 'success' })
+
+    dispatched.length = 0
+    seed()
+    dispatchStructuredTurnCompletionAttention(structuredTab(), completion())
+    expect(onlyDispatch()).toMatchObject({ agentState: 'done' })
   })
 
   it('says done even while the status row still reads working, because the host settled the turn', () => {
@@ -270,7 +294,7 @@ describe('dispatchStructuredTurnCompletionAttention', () => {
       }
     })
     dispatchStructuredTurnCompletionAttention(structuredTab(), completion())
-    expect(onlyDispatch()).toMatchObject({ agentState: 'done', agentInterrupted: false })
+    expect(onlyDispatch()).toMatchObject({ agentState: 'done', agentTurnOutcome: 'success' })
   })
 
   it('delivers an id the acknowledgement round trip dismisses when the user reads the chat', () => {
diff --git a/src/renderer/src/components/native-chat/structured-attention-dispatch.ts b/src/renderer/src/components/native-chat/structured-attention-dispatch.ts
index f0afca80e133..4553d79b0a52 100644
--- a/src/renderer/src/components/native-chat/structured-attention-dispatch.ts
+++ b/src/renderer/src/components/native-chat/structured-attention-dispatch.ts
@@ -13,10 +13,11 @@
  * adapter, and the same delivery tail — so suppression, acknowledgement, addressing, the success
  * sound and the blocked-permission fallback all have exactly one implementation.
  *
- * EVERY SETTLED TURN NOTIFIES, matching the CLI lane: success says "finished", and failure and
- * cancellation say "stopped" through the shipped `agentInterrupted` flag rather than a second
- * vocabulary. A turn with no outcome is UNKNOWN — the host sends no event for one, and nothing
- * here may turn that absence into success.
+ * EVERY SETTLED TURN NOTIFIES, matching the CLI lane: the outcome picks the wording — "finished",
+ * "failed" or "stopped" — exactly as the hook lane's verdict does. A turn with no outcome is UNKNOWN — the host sends no event for one, and nothing
+ * here may turn that absence into success. A request that settles while a prompt (a subagent's
+ * approval, say) waits on the user is worded "needs input" instead, as the hook lane words a
+ * blocked row.
  *
  * Unread and delivery come out of ONE `resolveAgentAttention` decision. "Do not alert me about
  * something I am watching" is already answered by focus, in the surface adapter's viewed gates and
@@ -107,10 +108,10 @@ export function dispatchStructuredTurnCompletionAttention(
           ...(row?.agentType ? { agentType: row.agentType } : {}),
           // 'done' is what the host told us, not an inference from the row — the row's own state
           // can still read 'working' when the completion outruns the status re-projection, and
-          // main words a 'working' notification as "working". The outcome picks the wording from
-          // there: interrupted covers failure and cancellation alike.
-          agentState: 'done',
-          agentInterrupted: completion.outcome !== 'success',
+          // main words a 'working' notification as "working". The outcome picks the wording from there.
+          // `awaitingUser` is the row's 'blocked': the user has a prompt to answer.
+          agentState: completion.awaitingUser ? 'blocked' : 'done',
+          agentTurnOutcome: completion.outcome,
           ...(row?.prompt ? { agentPrompt: row.prompt } : {}),
           ...(row?.lastAssistantMessage
             ? { agentLastAssistantMessage: row.lastAssistantMessage }
diff --git a/src/renderer/src/components/native-chat/structured-conversation-command-send.ts b/src/renderer/src/components/native-chat/structured-conversation-command-send.ts
index 77be7d336e74..51575e4ae03a 100644
--- a/src/renderer/src/components/native-chat/structured-conversation-command-send.ts
+++ b/src/renderer/src/components/native-chat/structured-conversation-command-send.ts
@@ -3,6 +3,7 @@ import type {
   AgentSessionConversationCommandResult
 } from '../../../../shared/agent-session-conversation-command'
 import { translate } from '@/i18n/i18n'
+import type { StructuredAgentSessionWriteOutcome } from './use-structured-agent-session-mutate'
 
 export async function sendStructuredConversationCommand(input: {
   command: AgentSessionConversationCommand
@@ -10,7 +11,7 @@ export async function sendStructuredConversationCommand(input: {
   blocked: boolean
   send: (
     command: AgentSessionConversationCommand
-  ) => Promise<AgentSessionConversationCommandResult | null>
+  ) => Promise<StructuredAgentSessionWriteOutcome<AgentSessionConversationCommandResult>>
 }): Promise<{ accepted: boolean; error: string | null }> {
   if (input.pending.current || input.blocked) {
     return {
@@ -23,7 +24,11 @@ export async function sendStructuredConversationCommand(input: {
   }
   input.pending.current = true
   try {
-    const result = await input.send(input.command)
+    const outcome = await input.send(input.command)
+    if (outcome.kind === 'not-done') {
+      return { accepted: false, error: outcome.notice }
+    }
+    const result = outcome.kind === 'done' ? outcome.value : null
     return {
       accepted: result?.state === 'completed' && !result.error,
       error:
diff --git a/src/renderer/src/components/native-chat/use-native-chat-composer-interrupt.ts b/src/renderer/src/components/native-chat/use-native-chat-composer-interrupt.ts
index 71a654c09270..f59d86303f14 100644
--- a/src/renderer/src/components/native-chat/use-native-chat-composer-interrupt.ts
+++ b/src/renderer/src/components/native-chat/use-native-chat-composer-interrupt.ts
@@ -25,7 +25,7 @@ export function useNativeChatComposerInterrupt(args: {
     }
     const target = resolveTarget()
     if (target) {
-      sendRuntimePtyInput(target.settings, target.ptyId, ESC)
+      sendRuntimePtyInput(target.settings, target.ptyId, ESC, 'driving')
     }
   }, [cancelPendingSends, isWorking, onStop, resolveTarget])
 }
diff --git a/src/renderer/src/components/native-chat/use-native-chat-interactive-send.test.tsx b/src/renderer/src/components/native-chat/use-native-chat-interactive-send.test.tsx
index 864c62f6f910..f2cbd8df93ca 100644
--- a/src/renderer/src/components/native-chat/use-native-chat-interactive-send.test.tsx
+++ b/src/renderer/src/components/native-chat/use-native-chat-interactive-send.test.tsx
@@ -195,7 +195,8 @@ describe('useNativeChatInteractiveSend', () => {
     expect(mocks.sendRuntimePtyInput).toHaveBeenCalledWith(
       { terminalTabId: 'tab-1' },
       'pty-1',
-      '\x1b'
+      '\x1b',
+      'driving'
     )
   })
 
diff --git a/src/renderer/src/components/native-chat/use-native-chat-interactive-send.ts b/src/renderer/src/components/native-chat/use-native-chat-interactive-send.ts
index 43adabae8f38..3d270cde49bf 100644
--- a/src/renderer/src/components/native-chat/use-native-chat-interactive-send.ts
+++ b/src/renderer/src/components/native-chat/use-native-chat-interactive-send.ts
@@ -76,7 +76,12 @@ export function useNativeChatInteractiveSend(
       if (!targetPtyId) {
         return
       }
-      sendRuntimePtyInput(getSettingsForAgentTabRuntimeOwner(terminalTabId), targetPtyId, raw)
+      sendRuntimePtyInput(
+        getSettingsForAgentTabRuntimeOwner(terminalTabId),
+        targetPtyId,
+        raw,
+        'driving'
+      )
     },
     [terminalTabId, targetPtyId]
   )
diff --git a/src/renderer/src/components/native-chat/use-native-chat-provisional-launch.test.tsx b/src/renderer/src/components/native-chat/use-native-chat-provisional-launch.test.tsx
index 304168a328ad..d19e114e6b96 100644
--- a/src/renderer/src/components/native-chat/use-native-chat-provisional-launch.test.tsx
+++ b/src/renderer/src/components/native-chat/use-native-chat-provisional-launch.test.tsx
@@ -7,13 +7,14 @@ import type * as LaunchIntentModule from '@/lib/launch-structured-agent-session'
 
 const mocks = vi.hoisted(() => ({
   call: vi.fn<(target: unknown, method: string, params?: unknown) => Promise<unknown>>(),
-  launch: vi.fn<(intent: { sessionId: string }) => Promise<{ sessionId: string; fence: number }>>()
+  launch: vi.fn<(intent: { sessionId: string }) => Promise<{ sessionId: string; fence: number }>>(),
+  toastError: vi.fn()
 }))
 
 let readState: StructuredAgentSessionState
 let publishedTabs: unknown[] = []
 
-vi.mock('sonner', () => ({ toast: { error: vi.fn(), message: vi.fn() } }))
+vi.mock('sonner', () => ({ toast: { error: mocks.toastError, message: vi.fn() } }))
 
 vi.mock('@/runtime/structured-agent-session-client', () => ({
   callStructuredAgentSession: mocks.call
@@ -169,7 +170,9 @@ describe('a chat pane over its own launch', () => {
       await launch.launchResult
     })
     rerender()
-    await waitFor(() => expect(result.current.error).toBe('GPT-5.6 Luna is not available'))
+    await waitFor(() =>
+      expect(mocks.toastError).toHaveBeenCalledWith("The setting wasn't changed.")
+    )
     // Reverted to what the chat runs; the refusal never kept the launch from publishing.
     expect(currentModel(result.current.optionSnapshot)).toBe('gpt-5.5')
   })
diff --git a/src/renderer/src/components/native-chat/use-structured-agent-session-hold.ts b/src/renderer/src/components/native-chat/use-structured-agent-session-hold.ts
index 628a369281bb..f484f500a56f 100644
--- a/src/renderer/src/components/native-chat/use-structured-agent-session-hold.ts
+++ b/src/renderer/src/components/native-chat/use-structured-agent-session-hold.ts
@@ -8,6 +8,9 @@
 //
 // The release CHAINS off the hold rather than racing it: an unmount during the hold's round trip
 // would otherwise release a hold that has not landed yet, and the late hold would never be undone.
+//
+// A current host ignores both: it starts an agent only for a send. They stay for older hosts, until
+// MIN_COMPATIBLE_RUNTIME_SERVER_VERSION passes the first host that ignores them.
 
 import { useEffect, useRef } from 'react'
 import { structuredAgentSessionHolderId } from '../../../../shared/structured-agent-session-holder'
diff --git a/src/renderer/src/components/native-chat/use-structured-agent-session-mutate.ts b/src/renderer/src/components/native-chat/use-structured-agent-session-mutate.ts
index d7706913d21d..328d76d05344 100644
--- a/src/renderer/src/components/native-chat/use-structured-agent-session-mutate.ts
+++ b/src/renderer/src/components/native-chat/use-structured-agent-session-mutate.ts
@@ -3,23 +3,46 @@
 // The client operation id is keyed on (session, method, payload) so a retry of
 // the same request reuses it and the host upserts one row instead of two, and
 // every result is discarded unless the runtime fence it was issued against is
-// still the current one.
+// still the current one. A write that did not happen is reported once, in the
+// person's words, by the caller that knows where to say it; nothing latches.
 
-import { useCallback, useEffect, useRef, useState } from 'react'
+import { useCallback, useEffect, useRef } from 'react'
+import { toast } from 'sonner'
 import * as conversationCommands from './structured-conversation-command-send'
 import type { AgentSessionMutationResult } from '../../../../shared/agent-session-wire'
+import {
+  agentSessionRefusalFailure,
+  agentSessionRpcErrorFailure,
+  agentSessionWriteKindForMethod as writeKind
+} from '../../../../shared/agent-session-write-failure'
 import { agentSessionRefusalOperationState } from '../../../../shared/agent-session-refusal-retry'
 import { structuredAgentSessionPayloadFingerprint } from '../../../../shared/structured-agent-session-mutation'
 import type { RuntimeClientTarget } from '@/runtime/runtime-rpc-client'
+import { RuntimeRpcCallError } from '@/runtime/runtime-rpc-result'
 import { callStructuredAgentSession } from '@/runtime/structured-agent-session-client'
 import { structuredSessionOperationId } from './use-structured-agent-session-outbox'
+import { agentSessionWriteFailureText } from './agent-session-write-notice-text'
 
-export type StructuredAgentSessionMutate = <T>(
+export type StructuredAgentSessionWriteOutcome<T> =
+  | { kind: 'done'; value: T }
+  /** Refused or failed, with what to tell the person. */
+  | { kind: 'not-done'; notice: string }
+  /** Settled for an owner or session this pane no longer shows; there is nothing to say. */
+  | { kind: 'dropped' }
+
+type WriteArgs = [
   method: string,
   fingerprintMethod: string,
   fields: Record<string, unknown>,
   operationIdOverride?: string | null
-) => Promise<T | null>
+]
+
+export type StructuredAgentSessionWrite = <T>(
+  ...args: WriteArgs
+) => Promise<StructuredAgentSessionWriteOutcome<T>>
+
+/** A write whose failure is shown as a toast; the control that sent it is the way to try again. */
+export type StructuredAgentSessionMutate = <T>(...args: WriteArgs) => Promise<T | null>
 
 export function useStructuredAgentSessionMutate(args: {
   sessionId: string
@@ -29,13 +52,10 @@ export function useStructuredAgentSessionMutate(args: {
    *  is in flight, and a result from the previous fence is not this session's. */
   stateRef: { current: { fence: number | null } }
 }): {
+  write: StructuredAgentSessionWrite
   mutate: StructuredAgentSessionMutate
-  writeError: string | null
-  /** A write this hook did not send, refused all the same (a pick applied by the launch). */
-  reportWriteError: (message: string) => void
 } {
   const { enabled = true, sessionId, stateRef, target } = args
-  const [writeError, setWriteError] = useState<string | null>(null)
   const operationIds = useRef(new Map<string, string>())
   const enabledRef = useRef(enabled)
   useEffect(() => {
@@ -43,15 +63,15 @@ export function useStructuredAgentSessionMutate(args: {
     enabledRef.current = enabled
   }, [enabled])
 
-  const mutate = useCallback(
+  const write = useCallback(
     async <T>(
       method: string,
       fingerprintMethod: string,
       fields: Record<string, unknown>,
       operationIdOverride?: string | null
-    ): Promise<T | null> => {
+    ): Promise<StructuredAgentSessionWriteOutcome<T>> => {
       if (!enabled || !enabledRef.current || stateRef.current.fence === null) {
-        return null
+        return { kind: 'dropped' }
       }
       const targetFence = stateRef.current.fence
       const key = `${sessionId}:${fingerprintMethod}:${JSON.stringify(fields)}`
@@ -74,31 +94,53 @@ export function useStructuredAgentSessionMutate(args: {
           ...fields
         })
       } catch (error) {
-        if (enabledRef.current && stateRef.current.fence === targetFence) {
-          setWriteError(error instanceof Error ? error.message : 'Request was not sent')
-        }
-        return null
+        return enabledRef.current && stateRef.current.fence === targetFence
+          ? {
+              kind: 'not-done',
+              notice: agentSessionWriteFailureText(
+                agentSessionRpcErrorFailure(
+                  error instanceof RuntimeRpcCallError ? error.code : undefined
+                ),
+                writeKind(fingerprintMethod, fields)
+              )
+            }
+          : { kind: 'dropped' }
       }
       if (!result.ok) {
         if (agentSessionRefusalOperationState(result.refusal.code) === 'settled-rejected') {
           operationIds.current.delete(key)
         }
-        if (enabledRef.current && stateRef.current.fence === targetFence) {
-          setWriteError(result.refusal.message)
-        }
-        return null
+        return enabledRef.current && stateRef.current.fence === targetFence
+          ? {
+              kind: 'not-done',
+              notice: agentSessionWriteFailureText(
+                agentSessionRefusalFailure(result.refusal),
+                writeKind(fingerprintMethod, fields)
+              )
+            }
+          : { kind: 'dropped' }
       }
       if (!enabledRef.current || stateRef.current.fence !== targetFence) {
-        return null
+        return { kind: 'dropped' }
       }
       if (!conversationCommands.isUnconfirmedConversationCommand(fingerprintMethod, result.value)) {
         operationIds.current.delete(key)
       }
-      setWriteError(null)
-      return result.value
+      return { kind: 'done', value: result.value }
     },
     [enabled, sessionId, stateRef, target]
   )
 
-  return { mutate, writeError, reportWriteError: setWriteError }
+  const mutate = useCallback(
+    async <T>(...writeArgs: WriteArgs): Promise<T | null> => {
+      const outcome = await write<T>(...writeArgs)
+      if (outcome.kind === 'not-done') {
+        toast.error(outcome.notice)
+      }
+      return outcome.kind === 'done' ? outcome.value : null
+    },
+    [write]
+  )
+
+  return { write, mutate }
 }
diff --git a/src/renderer/src/components/native-chat/use-structured-agent-session-options.test.tsx b/src/renderer/src/components/native-chat/use-structured-agent-session-options.test.tsx
index 65b39be9a94c..53e582af5de4 100644
--- a/src/renderer/src/components/native-chat/use-structured-agent-session-options.test.tsx
+++ b/src/renderer/src/components/native-chat/use-structured-agent-session-options.test.tsx
@@ -7,9 +7,11 @@ const mocks = vi.hoisted(() => ({
   call: vi.fn(),
   enqueue: vi.fn(),
   hold: vi.fn<(sessionId: string, id: string, encoded: string) => Promise<unknown> | null>(),
-  reportWriteError: vi.fn<(message: string) => void>()
+  toastError: vi.fn<(message: string) => void>()
 }))
 
+vi.mock('sonner', () => ({ toast: { error: mocks.toastError } }))
+
 vi.mock('@/runtime/structured-agent-session-client', () => ({
   callStructuredAgentSession: mocks.call
 }))
@@ -99,7 +101,6 @@ function renderOptions(initial: RenderProps, mutate: StructuredAgentSessionMutat
         turnId: props.turnId ?? null,
         unloadedTurnRevisions: undefined,
         mutate,
-        reportWriteError: mocks.reportWriteError,
         ...(props.launch
           ? {
               launch: {
@@ -164,7 +165,7 @@ describe('useStructuredAgentSessionOptions', () => {
     mocks.call.mockReset()
     mocks.enqueue.mockReset()
     mocks.hold.mockReset()
-    mocks.reportWriteError.mockReset()
+    mocks.toastError.mockReset()
   })
 
   it('upgrades the seed with the host catalog while the live read is still pending', async () => {
@@ -408,7 +409,7 @@ describe('useStructuredAgentSessionOptions', () => {
           picks: [{ modelId: 'gpt-5.6-luna', optionId: 'model', value: 'gpt-5.6-luna' }]
         })
       )
-      expect(mocks.reportWriteError).not.toHaveBeenCalled()
+      expect(mocks.toastError).not.toHaveBeenCalled()
       unmount()
     })
 
@@ -416,7 +417,7 @@ describe('useStructuredAgentSessionOptions', () => {
       answer({})
       mocks.hold.mockResolvedValue({
         kind: 'refused',
-        message: 'Model gpt-5.6-luna is unavailable'
+        failure: { kind: 'refused', code: 'agent_session_operation_capacity' }
       })
       const { result, unmount } = renderOptions(
         { ...PROVISIONAL, launchSeedOptions: SEED },
@@ -426,7 +427,9 @@ describe('useStructuredAgentSessionOptions', () => {
         await result.current.setStructuredOption('model', 'gpt-5.6-luna')
       })
       await waitFor(() =>
-        expect(mocks.reportWriteError).toHaveBeenCalledWith('Model gpt-5.6-luna is unavailable')
+        expect(mocks.toastError).toHaveBeenCalledWith(
+          "Orca has received too many requests in the last day. The setting wasn't changed."
+        )
       )
       expect(mocks.enqueue).not.toHaveBeenCalled()
       unmount()
diff --git a/src/renderer/src/components/native-chat/use-structured-agent-session-options.ts b/src/renderer/src/components/native-chat/use-structured-agent-session-options.ts
index 3cd1f94add8d..e3ee7cd1de05 100644
--- a/src/renderer/src/components/native-chat/use-structured-agent-session-options.ts
+++ b/src/renderer/src/components/native-chat/use-structured-agent-session-options.ts
@@ -1,3 +1,4 @@
+import { toast } from 'sonner'
 import { useCallback, useMemo } from 'react'
 import type {
   AgentSessionOptionResult,
@@ -23,6 +24,7 @@ import { encodeStructuredAgentSessionOptionValue } from '../../../../shared/stru
 import type { StructuredAgentSessionMutate } from './use-structured-agent-session-mutate'
 import { useHostModelCatalogUpgrade } from './use-host-model-catalog-upgrade'
 import { useStructuredAgentSessionOptionState } from './use-structured-agent-session-option-state'
+import { agentSessionWriteFailureText } from './agent-session-write-notice-text'
 import type { StructuredAgentSessionLaunchView } from './use-native-chat-provisional-launch'
 import {
   getStructuredAgentSessionLaunchSelection,
@@ -44,7 +46,6 @@ export function useStructuredAgentSessionOptions(args: {
   turnId: string | null
   unloadedTurnRevisions: number | undefined
   mutate: StructuredAgentSessionMutate
-  reportWriteError: (message: string) => void
   launch?: StructuredAgentSessionLaunchView
 }) {
   const {
@@ -53,7 +54,6 @@ export function useStructuredAgentSessionOptions(args: {
     launch,
     mutate,
     providerVisible,
-    reportWriteError,
     sessionId,
     target,
     transportEnabled,
@@ -187,7 +187,7 @@ export function useStructuredAgentSessionOptions(args: {
   const settleLaunchOptionPick = useCallback(
     (outcome: StructuredLaunchOptionOutcome) => {
       if (outcome.kind === 'refused') {
-        reportWriteError(outcome.message)
+        toast.error(agentSessionWriteFailureText(outcome.failure, 'option'))
       } else if (outcome.kind === 'accepted') {
         rememberOptionPicks(
           structuredAgentSessionOptionView(
@@ -199,7 +199,7 @@ export function useStructuredAgentSessionOptions(args: {
         )
       }
     },
-    [launchSeedOptions, optionStateRef, rememberOptionPicks, reportWriteError]
+    [launchSeedOptions, optionStateRef, rememberOptionPicks]
   )
   const optionSnapshot = useMemo(() => {
     const snapshot = structuredAgentSessionOptionSnapshot(
diff --git a/src/renderer/src/components/native-chat/use-structured-agent-session-outbox-fence.test.tsx b/src/renderer/src/components/native-chat/use-structured-agent-session-outbox-fence.test.tsx
new file mode 100644
index 000000000000..61b5ea95e727
--- /dev/null
+++ b/src/renderer/src/components/native-chat/use-structured-agent-session-outbox-fence.test.tsx
@@ -0,0 +1,139 @@
+// @vitest-environment happy-dom
+
+// A moved fence is not a reason to send anything again on a host that records every send before it
+// starts an agent. There, only a Retry or a new send goes out. An older host, which restarts the
+// agent inside the send and refuses it unrecorded when that fails, keeps the resend on a new fence.
+
+import { act, renderHook, waitFor } from '@testing-library/react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+import { AGENT_SESSION_ACCEPTED_SEND_RUNTIME_CAPABILITY } from '../../../../shared/protocol-version'
+
+const mocks = vi.hoisted(() => ({ call: vi.fn() }))
+
+vi.mock('@/runtime/structured-agent-session-client', () => ({
+  callStructuredAgentSession: mocks.call
+}))
+
+import { setLocalRuntimeCapabilitiesForTests } from '@/runtime/local-runtime-capabilities'
+import { useStructuredAgentSessionOutbox } from './use-structured-agent-session-outbox'
+
+const LOCAL_TARGET = { kind: 'local' } as const
+
+function deferred<T>() {
+  let resolve!: (value: T) => void
+  const promise = new Promise<T>((next) => {
+    resolve = next
+  })
+  return { promise, resolve }
+}
+
+function pendingResult(clientMessageId: string) {
+  return {
+    ok: true,
+    replayed: false,
+    fence: 1,
+    cursor: { epoch: 'epoch-1', sequence: 1 },
+    value: {
+      clientMessageId,
+      submission: {
+        clientMessageId,
+        fence: 1,
+        payloadFingerprint: 'fingerprint',
+        dispatchState: 'pending' as const,
+        handoverRecorded: true,
+        providerItemId: null,
+        reason: null,
+        submittedAt: 1,
+        resolvedAt: null
+      }
+    }
+  }
+}
+
+function sentId(call: number): string {
+  const id: unknown = mocks.call.mock.calls[call]?.[2].envelope.clientOperationId
+  return String(id)
+}
+
+function render() {
+  return renderHook(
+    ({ fence }) =>
+      useStructuredAgentSessionOutbox({
+        sessionId: 'session-1',
+        target: LOCAL_TARGET,
+        fence,
+        submissions: []
+      }),
+    { initialProps: { fence: 1 } }
+  )
+}
+
+/** Long enough for any effect a fence change schedules to have sent. */
+async function settle(): Promise<void> {
+  await act(() => new Promise<void>((resolve) => setTimeout(resolve, 50)))
+}
+
+describe('an outbox on a host that accepts a send before any agent has it', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    localStorage.clear()
+    setLocalRuntimeCapabilitiesForTests([AGENT_SESSION_ACCEPTED_SEND_RUNTIME_CAPABILITY])
+  })
+
+  it('neither resends nor drops the answer of a send in flight when the fence moves', async () => {
+    const answer = deferred<ReturnType<typeof pendingResult>>()
+    mocks.call.mockReturnValueOnce(answer.promise)
+    const { result, rerender } = render()
+
+    act(() => expect(result.current.send('hello')).toBe(true))
+    await waitFor(() => expect(mocks.call).toHaveBeenCalledTimes(1))
+    // A start or restart on the host moves the fence while the send is out.
+    rerender({ fence: 2 })
+    rerender({ fence: 3 })
+    await settle()
+    expect(mocks.call).toHaveBeenCalledTimes(1)
+
+    await act(async () => answer.resolve(pendingResult(sentId(0))))
+    // The answer lands: the entry is the host's now, not re-queued behind a moved fence.
+    expect(result.current.outbox).toMatchObject([{ state: 'dispatching' }])
+    await settle()
+    expect(mocks.call).toHaveBeenCalledTimes(1)
+  })
+
+  it('keeps a blocked head blocked across a fence change; only Retry sends it', async () => {
+    mocks.call.mockRejectedValueOnce(new Error('send failed')).mockResolvedValue({ ok: true })
+    const { result, rerender } = render()
+
+    act(() => expect(result.current.send('hello')).toBe(true))
+    await waitFor(() => expect(result.current.blockedClientMessageId).not.toBeNull())
+    rerender({ fence: 2 })
+    await settle()
+    expect(mocks.call).toHaveBeenCalledTimes(1)
+    // The failure stays on the message; the fence change neither clears nor resends it.
+    expect(result.current.outbox[0]?.lastFailure).toEqual({ kind: 'failed' })
+
+    act(() => result.current.retry(result.current.outbox[0]!.clientMessageId))
+    await waitFor(() => expect(mocks.call).toHaveBeenCalledTimes(2))
+  })
+})
+
+describe('an outbox on an older host', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    localStorage.clear()
+    setLocalRuntimeCapabilitiesForTests([])
+  })
+
+  it('still resends a send in flight when the fence moves, as the new owner may take it', async () => {
+    mocks.call.mockReturnValueOnce(new Promise(() => {})).mockReturnValue(new Promise(() => {}))
+    const { result, rerender } = render()
+
+    act(() => expect(result.current.send('hello')).toBe(true))
+    await waitFor(() => expect(mocks.call).toHaveBeenCalledTimes(1))
+    rerender({ fence: 2 })
+
+    await waitFor(() => expect(mocks.call).toHaveBeenCalledTimes(2))
+    expect(sentId(1)).toBe(sentId(0))
+  })
+})
diff --git a/src/renderer/src/components/native-chat/use-structured-agent-session-outbox-rejection-cause.test.tsx b/src/renderer/src/components/native-chat/use-structured-agent-session-outbox-rejection-cause.test.tsx
index d66f579ed0d8..a8b9f01b20b9 100644
--- a/src/renderer/src/components/native-chat/use-structured-agent-session-outbox-rejection-cause.test.tsx
+++ b/src/renderer/src/components/native-chat/use-structured-agent-session-outbox-rejection-cause.test.tsx
@@ -1,7 +1,9 @@
 // @vitest-environment happy-dom
 
 import { act, renderHook, waitFor } from '@testing-library/react'
-import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { AgentJournalSubmission } from '../../../../shared/agent-session-journal-types'
+import { DISPATCH_REJECTED_CANCELLED } from '../../../../shared/structured-agent-session-dispatch-rejection'
 
 const mocks = vi.hoisted(() => ({
   call: vi.fn()
@@ -11,12 +13,45 @@ vi.mock('@/runtime/structured-agent-session-client', () => ({
   callStructuredAgentSession: mocks.call
 }))
 
+import { setLocalRuntimeCapabilitiesForTests } from '@/runtime/local-runtime-capabilities'
 import { useStructuredAgentSessionOutbox } from './use-structured-agent-session-outbox'
+import { agentSessionWriteNoticeEnglish } from '../../../../shared/agent-session-refusal-notice'
+import { structuredAgentSessionAttemptFailureParts } from '../../../../shared/structured-agent-session-send-disposition'
+import type { StructuredAgentSessionOutboxEntry } from '../../../../shared/structured-agent-session-outbox'
+
+function shownFailure(entry: StructuredAgentSessionOutboxEntry | undefined): string | undefined {
+  return (
+    entry?.lastFailure &&
+    agentSessionWriteNoticeEnglish(structuredAgentSessionAttemptFailureParts(entry.lastFailure))
+  )
+}
 
 // What the host answers when the child it restarted for this send died before starting.
 const REASON =
   'The provider stopped before it finished starting: claude stream-json exited (code 1): claude: not signed in.'
 
+function acceptedResultFor(clientMessageId: string) {
+  return {
+    ok: true,
+    replayed: false,
+    fence: 1,
+    cursor: { epoch: 'epoch-1', sequence: 2 },
+    value: {
+      clientMessageId,
+      submission: {
+        clientMessageId,
+        fence: 1,
+        payloadFingerprint: 'fingerprint',
+        dispatchState: 'accepted',
+        providerItemId: `provider-${clientMessageId}`,
+        reason: null,
+        submittedAt: 1,
+        resolvedAt: 1
+      }
+    }
+  }
+}
+
 function rejectedResultFor(clientMessageId: string) {
   return {
     ok: true,
@@ -45,7 +80,7 @@ describe('a send the host rejected because the agent never started', () => {
     localStorage.clear()
   })
 
-  it('names the cause under the composer and keeps the message for Retry', async () => {
+  it('names the cause on the message and keeps it for Retry', async () => {
     mocks.call.mockImplementationOnce(
       async (
         _target: unknown,
@@ -64,8 +99,309 @@ describe('a send the host rejected because the agent never started', () => {
 
     act(() => expect(result.current.send('hello')).toBe(true))
 
-    await waitFor(() => expect(result.current.error).toBe(REASON))
-    expect(result.current.outbox[0]?.state).toBe('queued')
-    expect(result.current.blockedClientMessageId).toBe(result.current.outbox[0]?.clientMessageId)
+    await waitFor(() => expect(shownFailure(result.current.outbox[0])).toBe(REASON))
+    // Settled as not delivered: it waits for Retry and holds no later message up.
+    expect(result.current.error).toBeNull()
+    expect(result.current.outbox[0]?.state).toBe('rejected')
+    expect(result.current.blockedClientMessageId).toBeNull()
+  })
+
+  it('sends a new message past one the host could not start the agent for, without resending it', async () => {
+    const message = "Claude couldn't restart: Not logged in. Please run /login."
+    mocks.call.mockImplementation(async (_target, _method, params) => {
+      const request = params as {
+        envelope: { clientOperationId: string }
+        body: { blocks: { text?: string }[] }
+      }
+      return request.body.blocks[0]?.text === 'first'
+        ? { ok: false, refusal: { code: 'agent_session_owner_restart_failed', message } }
+        : acceptedResultFor(request.envelope.clientOperationId)
+    })
+    const { result } = renderHook(() =>
+      useStructuredAgentSessionOutbox({
+        sessionId: 'session-1',
+        target: { kind: 'local' },
+        fence: 1,
+        submissions: []
+      })
+    )
+
+    act(() => expect(result.current.send('first')).toBe(true))
+    await waitFor(() => expect(result.current.outbox[0]?.state).toBe('rejected'))
+    const rejectedId = result.current.outbox[0]!.clientMessageId
+
+    // The user's next message is the retry of the start: it goes out on its own.
+    act(() => expect(result.current.send('second')).toBe(true))
+    await waitFor(() => expect(mocks.call).toHaveBeenCalledTimes(2))
+    await act(() => new Promise((resolve) => setTimeout(resolve, 50)))
+
+    const sent = mocks.call.mock.calls.map(
+      (call) => (call[2] as { body?: { blocks?: { text?: string }[] } })?.body?.blocks?.[0]?.text
+    )
+    expect(sent).toEqual(['first', 'second'])
+    expect(result.current.outbox.map((entry) => [entry.clientMessageId, entry.state])).toEqual([
+      [rejectedId, 'rejected']
+    ])
+  })
+
+  it('keeps a message the host accepted and then could not deliver, with its reason and Retry', async () => {
+    const reason = "Codex couldn't restart: spawn codex ENOENT."
+    mocks.call.mockImplementation(
+      async (
+        _target: unknown,
+        _method: unknown,
+        params: { envelope: { clientOperationId: string } }
+      ) => pendingResultFor(params.envelope.clientOperationId)
+    )
+    const target = { kind: 'local' } as const
+    const { result, rerender } = renderHook(
+      (props: { submissions: AgentJournalSubmission[] }) =>
+        useStructuredAgentSessionOutbox({
+          sessionId: 'session-1',
+          target,
+          fence: 1,
+          submissions: props.submissions
+        }),
+      { initialProps: { submissions: NO_SUBMISSIONS } }
+    )
+
+    act(() => expect(result.current.send('hello')).toBe(true))
+    await waitFor(() => expect(result.current.outbox[0]?.state).toBe('dispatching'))
+    const id = result.current.outbox[0]!.clientMessageId
+
+    rerender({
+      submissions: [{ ...pendingResultFor(id).value.submission, dispatchState: 'rejected', reason }]
+    })
+
+    await waitFor(() => expect(result.current.outbox[0]?.state).toBe('rejected'))
+    expect(shownFailure(result.current.outbox[0])).toBe(reason)
+    expect(result.current.error).toBeNull()
+    expect(result.current.blockedClientMessageId).toBeNull()
+
+    // Retry is a new message with the same text: a fresh id, sent once.
+    act(() => result.current.retry(id))
+    await waitFor(() => expect(mocks.call).toHaveBeenCalledTimes(2))
+    const retried: {
+      envelope: { clientOperationId: string }
+      body: { blocks: { text?: string }[] }
+    } = mocks.call.mock.calls[1]![2]
+    expect(retried.envelope.clientOperationId).not.toBe(id)
+    expect(retried.body.blocks[0]?.text).toBe('hello')
+  })
+
+  it('says nothing when a Stop withdrew the message', async () => {
+    mocks.call.mockImplementation(
+      async (
+        _target: unknown,
+        _method: unknown,
+        params: { envelope: { clientOperationId: string } }
+      ) => pendingResultFor(params.envelope.clientOperationId)
+    )
+    const target = { kind: 'local' } as const
+    const { result, rerender } = renderHook(
+      (props: { submissions: AgentJournalSubmission[] }) =>
+        useStructuredAgentSessionOutbox({
+          sessionId: 'session-1',
+          target,
+          fence: 1,
+          submissions: props.submissions
+        }),
+      { initialProps: { submissions: NO_SUBMISSIONS } }
+    )
+
+    act(() => expect(result.current.send('hello')).toBe(true))
+    await waitFor(() => expect(result.current.outbox[0]?.state).toBe('dispatching'))
+    const id = result.current.outbox[0]!.clientMessageId
+
+    rerender({
+      submissions: [
+        {
+          ...pendingResultFor(id).value.submission,
+          dispatchState: 'rejected',
+          reason: DISPATCH_REJECTED_CANCELLED
+        }
+      ]
+    })
+
+    await waitFor(() => expect(result.current.outbox).toEqual([]))
+    expect(result.current.error).toBeNull()
+  })
+
+  it('reads a message rejected while the chat was closed as not sent, and sends past it', async () => {
+    const reason = "Codex couldn't restart: spawn codex ENOENT."
+    mocks.call.mockImplementation(
+      async (
+        _target: unknown,
+        _method: unknown,
+        params: { envelope: { clientOperationId: string } }
+      ) => pendingResultFor(params.envelope.clientOperationId)
+    )
+    const target = { kind: 'local' } as const
+    const first = renderHook(() =>
+      useStructuredAgentSessionOutbox({
+        sessionId: 'session-1',
+        target,
+        fence: 1,
+        submissions: NO_SUBMISSIONS
+      })
+    )
+    act(() => expect(first.result.current.send('hello')).toBe(true))
+    await waitFor(() => expect(first.result.current.outbox[0]?.state).toBe('dispatching'))
+    const id = first.result.current.outbox[0]!.clientMessageId
+    first.unmount()
+
+    // Reopened after the start failed, or after a quit settled the message as not sent.
+    const rejected = [
+      { ...pendingResultFor(id).value.submission, dispatchState: 'rejected' as const, reason }
+    ]
+    const { result } = renderHook(() =>
+      useStructuredAgentSessionOutbox({
+        sessionId: 'session-1',
+        target,
+        fence: 1,
+        submissions: rejected
+      })
+    )
+
+    await waitFor(() => expect(result.current.outbox[0]?.state).toBe('rejected'))
+    expect(shownFailure(result.current.outbox[0])).toBe(reason)
+    act(() => expect(result.current.send('second')).toBe(true))
+    await waitFor(() => expect(mocks.call).toHaveBeenCalledTimes(2))
+  })
+
+  it('keeps the rejection when the journal settles the message before the send answers', async () => {
+    const reason = "Codex couldn't restart: spawn codex ENOENT."
+    let answer: (value: unknown) => void = () => undefined
+    mocks.call.mockImplementationOnce(
+      () =>
+        new Promise((resolve) => {
+          answer = resolve
+        })
+    )
+    const target = { kind: 'local' } as const
+    const { result, rerender } = renderHook(
+      (props: { submissions: AgentJournalSubmission[] }) =>
+        useStructuredAgentSessionOutbox({
+          sessionId: 'session-1',
+          target,
+          fence: 1,
+          submissions: props.submissions
+        }),
+      { initialProps: { submissions: NO_SUBMISSIONS } }
+    )
+
+    act(() => expect(result.current.send('hello')).toBe(true))
+    await waitFor(() => expect(result.current.outbox[0]?.state).toBe('dispatching'))
+    const id = result.current.outbox[0]!.clientMessageId
+
+    // A start refused at once: the rejection frame lands before the send's own `pending` answer.
+    rerender({
+      submissions: [{ ...pendingResultFor(id).value.submission, dispatchState: 'rejected', reason }]
+    })
+    await waitFor(() => expect(result.current.outbox[0]?.state).toBe('rejected'))
+    await act(async () => answer(pendingResultFor(id)))
+
+    expect(result.current.outbox[0]?.state).toBe('rejected')
+    expect(shownFailure(result.current.outbox[0])).toBe(reason)
+    expect(result.current.error).toBeNull()
+  })
+})
+
+const NO_SUBMISSIONS: AgentJournalSubmission[] = []
+
+function pendingResultFor(clientMessageId: string) {
+  const submission: AgentJournalSubmission = {
+    clientMessageId,
+    fence: 1,
+    payloadFingerprint: 'fingerprint',
+    dispatchState: 'pending',
+    providerItemId: null,
+    reason: null,
+    submittedAt: 1,
+    resolvedAt: null,
+    handoverRecorded: true
+  }
+  return {
+    ok: true,
+    replayed: false,
+    fence: 1,
+    cursor: { epoch: 'epoch-1', sequence: 2 },
+    value: {
+      clientMessageId,
+      submission
+    }
+  }
+}
+
+// Stable across renders, as a mounted pane's target is.
+const LOCAL_TARGET = { kind: 'local' } as const
+
+function submission(
+  clientMessageId: string,
+  dispatchState: 'pending' | 'accepted'
+): AgentJournalSubmission {
+  return {
+    clientMessageId,
+    fence: 3,
+    payloadFingerprint: 'fingerprint',
+    dispatchState,
+    providerItemId: null,
+    reason: null,
+    submittedAt: 10,
+    resolvedAt: dispatchState === 'accepted' ? 11 : null
+  }
+}
+
+// An older host: it restarts the agent inside the send, so a new fence is its word to send again.
+describe('a send refused while its agent restarted', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    localStorage.clear()
+    setLocalRuntimeCapabilitiesForTests([])
+  })
+
+  afterEach(() => {
+    setLocalRuntimeCapabilitiesForTests(null)
+  })
+
+  // The live order: the restart takes seconds, so the journal settles the resend before its reply.
+  it('leaves no error behind once a send refused before an agent restart is delivered', async () => {
+    mocks.call
+      .mockResolvedValueOnce({
+        ok: false,
+        refusal: {
+          code: 'agent_session_checkpoint_stale',
+          message: 'Expected runtime fence 1; the session is at 3.'
+        }
+      })
+      .mockReturnValueOnce(new Promise(() => {}))
+    const { result, rerender } = renderHook(
+      ({ fence, submissions }: { fence: number; submissions: AgentJournalSubmission[] }) =>
+        useStructuredAgentSessionOutbox({
+          sessionId: 'session-1',
+          target: LOCAL_TARGET,
+          fence,
+          submissions
+        }),
+      { initialProps: { fence: 1, submissions: NO_SUBMISSIONS } }
+    )
+
+    act(() => expect(result.current.send('hello')).toBe(true))
+    await waitFor(() =>
+      expect(shownFailure(result.current.outbox[0])).toBe('Your message was not sent.')
+    )
+
+    // The pane learns the new owner and sends the same message again.
+    rerender({ fence: 3, submissions: [] })
+    await waitFor(() => expect(mocks.call).toHaveBeenCalledTimes(2))
+    expect(result.current.outbox[0]).toMatchObject({ state: 'dispatching' })
+    expect(shownFailure(result.current.outbox[0])).toBeUndefined()
+
+    const id = result.current.outbox[0]!.clientMessageId
+    rerender({ fence: 3, submissions: [submission(id, 'pending')] })
+    rerender({ fence: 3, submissions: [submission(id, 'accepted')] })
+    await waitFor(() => expect(result.current.outbox).toHaveLength(0))
+    expect(result.current.error).toBeNull()
+    expect(result.current.blockedClientMessageId).toBeNull()
   })
 })
diff --git a/src/renderer/src/components/native-chat/use-structured-agent-session-outbox.test.tsx b/src/renderer/src/components/native-chat/use-structured-agent-session-outbox.test.tsx
index 613a599c2a62..04b25f93e8ad 100644
--- a/src/renderer/src/components/native-chat/use-structured-agent-session-outbox.test.tsx
+++ b/src/renderer/src/components/native-chat/use-structured-agent-session-outbox.test.tsx
@@ -233,6 +233,7 @@ describe('useStructuredAgentSessionOutbox', () => {
   it.each(['agent_session_operation_conflict', 'agent_session_operation_expired'] as const)(
     'rotates a send operation after %s',
     async (code) => {
+      // oxlint-disable-next-line no-restricted-properties -- stubbing the global the generator reads, to pin ids in this test
       vi.mocked(globalThis.crypto.randomUUID)
         .mockReturnValueOnce('11111111-1111-4111-8111-111111111111')
         .mockReturnValueOnce('22222222-2222-4222-8222-222222222222')
@@ -247,7 +248,7 @@ describe('useStructuredAgentSessionOutbox', () => {
       )
 
       act(() => expect(result.current.send('hello')).toBe(true))
-      await waitFor(() => expect(result.current.outbox[0]?.state).toBe('queued'))
+      await waitFor(() => expect(result.current.outbox[0]?.state).toBe('rejected'))
       const firstId = (mocks.call.mock.calls[0]![2] as { envelope: { clientOperationId: string } })
         .envelope.clientOperationId
       const retryId = result.current.outbox[0]!.clientMessageId
@@ -322,7 +323,8 @@ describe('useStructuredAgentSessionOutbox', () => {
     await waitFor(() => expect(mocks.call).toHaveBeenCalledTimes(1))
     const id = result.current.outbox[0]!.clientMessageId
     await waitFor(() => expect(result.current.outbox[0]?.state).toBe('unconfirmed'))
-    expect(result.current.error).toBe('Message delivery is unconfirmed')
+    // The Retry row already says delivery is unconfirmed; nothing repeats it.
+    expect([result.current.error, result.current.outbox[0]?.lastFailure]).toEqual([null, undefined])
 
     rerender({
       submissions: [
@@ -529,7 +531,7 @@ describe('useStructuredAgentSessionOutbox', () => {
     ).toBe(firstId)
   })
 
-  it('stops on a host that could not restart the agent and shows its message', async () => {
+  it('stops on a host that could not restart the agent and keeps its refusal on the message', async () => {
     const message = "Claude couldn't restart: Not logged in. Please run /login."
     mocks.call.mockResolvedValue({
       ok: false,
@@ -545,12 +547,20 @@ describe('useStructuredAgentSessionOutbox', () => {
     )
 
     act(() => expect(result.current.send('hello')).toBe(true))
-    await waitFor(() => expect(result.current.error).toBe(message))
+    await waitFor(() =>
+      expect(result.current.outbox[0]?.lastFailure).toEqual({
+        kind: 'refused',
+        code: 'agent_session_owner_restart_failed'
+      })
+    )
+    expect(result.current.error).toBeNull()
     await act(() => new Promise((resolve) => setTimeout(resolve, 50)))
 
     expect(mocks.call).toHaveBeenCalledOnce()
     expect(result.current.outbox).toHaveLength(1)
-    expect(result.current.blockedClientMessageId).toBe(result.current.outbox[0]?.clientMessageId)
+    // Never sent, and never re-sent on its own: it waits for Retry and holds nothing up.
+    expect(result.current.outbox[0]?.state).toBe('rejected')
+    expect(result.current.blockedClientMessageId).toBeNull()
     // Settled, not pending: the refused id never ran, so a Retry is a new operation.
     const sentId: unknown = mocks.call.mock.calls[0]![2].envelope.clientOperationId
     const retryId = result.current.outbox[0]!.clientMessageId
@@ -591,6 +601,7 @@ describe('useStructuredAgentSessionOutbox', () => {
   })
 
   it('retries an unknown head and advances a queued tail', async () => {
+    // oxlint-disable-next-line no-restricted-properties -- stubbing the global the generator reads, to pin ids in this test
     vi.mocked(globalThis.crypto.randomUUID)
       .mockReturnValueOnce('aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa')
       .mockReturnValueOnce('bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb')
@@ -653,6 +664,7 @@ describe('useStructuredAgentSessionOutbox', () => {
   })
 
   it('rotates a history-rejected unknown head so the queued tail can advance', async () => {
+    // oxlint-disable-next-line no-restricted-properties -- stubbing the global the generator reads, to pin ids in this test
     vi.mocked(globalThis.crypto.randomUUID)
       .mockReturnValueOnce('aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa')
       .mockReturnValueOnce('bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb')
@@ -713,6 +725,7 @@ describe('useStructuredAgentSessionOutbox', () => {
   })
 
   it('rotates the id after a refused write and delivers the message exactly once', async () => {
+    // oxlint-disable-next-line no-restricted-properties -- stubbing the global the generator reads, to pin ids in this test
     vi.mocked(globalThis.crypto.randomUUID)
       .mockReturnValueOnce('aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa')
       .mockReturnValueOnce('bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb')
@@ -761,16 +774,11 @@ describe('useStructuredAgentSessionOutbox', () => {
     await waitFor(() => expect(mocks.call).toHaveBeenCalledOnce())
     const firstId = mocks.call.mock.calls[0]![2].envelope.clientOperationId as string
 
-    // A refused write is answered, not doubted: the entry parks with human copy
-    // rather than under the "delivery is unconfirmed" banner. The durable reason
-    // stays `provider_write_failed: …`; it must not reach the screen.
-    await waitFor(() =>
-      expect(result.current.error).toBe(
-        "Couldn't reach the agent. Your message was not sent — Retry to send it again."
-      )
-    )
-    expect(result.current.outbox[0]?.state).toBe('queued')
-    expect(result.current.blockedClientMessageId).toBe(firstId)
+    // A refused write is answered, not doubted: the entry parks with its rejection rather than
+    // under the "delivery is unconfirmed" banner. The disposition tests pin its words.
+    await waitFor(() => expect(result.current.outbox[0]?.lastFailure?.kind).toBe('rejected'))
+    expect(result.current.outbox[0]?.state).toBe('rejected')
+    expect(result.current.blockedClientMessageId).toBeNull()
 
     // Retry immediately, before the journal subscription can publish the rejected row.
     act(() => result.current.retry(firstId))
@@ -838,7 +846,9 @@ describe('useStructuredAgentSessionOutbox', () => {
     )
 
     act(() => expect(result.current.send('hello')).toBe(true))
-    await waitFor(() => expect(result.current.error).toBe('agent_session_checkpoint_stale'))
+    const refused = { kind: 'refused', code: 'agent_session_checkpoint_stale' }
+    await waitFor(() => expect(result.current.outbox[0]?.lastFailure).toEqual(refused))
+    expect(result.current.error).toBeNull()
 
     rerender({ sessionId: 'session-2' })
     expect(result.current.error).toBeNull()
diff --git a/src/renderer/src/components/native-chat/use-structured-agent-session-outbox.ts b/src/renderer/src/components/native-chat/use-structured-agent-session-outbox.ts
index e38709b9fed7..254c936cf63b 100644
--- a/src/renderer/src/components/native-chat/use-structured-agent-session-outbox.ts
+++ b/src/renderer/src/components/native-chat/use-structured-agent-session-outbox.ts
@@ -7,25 +7,30 @@ import {
   reconcileStructuredAgentSessionOutbox,
   type StructuredAgentSessionOutboxEntry
 } from '../../../../shared/structured-agent-session-outbox'
-import type { StructuredAgentSessionSendDisposition } from '../../../../shared/structured-agent-session-send-disposition'
+import {
+  journalAnswersInFlightSend,
+  type StructuredAgentSessionSendDisposition
+} from '../../../../shared/structured-agent-session-send-disposition'
 import type { RuntimeClientTarget } from '@/runtime/runtime-rpc-client'
 import { readOutbox, writeOutbox } from './structured-agent-session-outbox-storage'
 import {
   dispatchStructuredAgentSessionOutboxEntry,
-  hasInFlightLaunchDispatch,
-  readMountedStructuredAgentSessionOutbox
+  readMountedStructuredAgentSessionOutbox,
+  requeueInterruptedStructuredAgentSessionDispatches
 } from './structured-agent-session-outbox-dispatch'
 import { getStructuredAgentLaunchPromptDispatch } from '@/lib/structured-agent-session-launch-prompt'
+import { useStructuredAgentSessionOutboxOwnerChange } from '@/runtime/structured-agent-session-accepted-send-capability'
+import { createBrowserUuid } from '@/lib/browser-uuid'
 
 export function structuredSessionOperationId(): string {
-  return createStructuredAgentSessionOperationId(() => crypto.randomUUID())
+  return createStructuredAgentSessionOperationId(createBrowserUuid)
 }
 
 const UNCONFIRMED_PROBE_BASE_DELAY_MS = 1_000
 /** No attempt ceiling: a transport outage outlives any fixed budget, and giving up
  *  restores the wedge this fixes. Growth caps the rate at one status query per 16s.
- *  A refusal that blocks the head still ends probing until a fence change or a manual
- *  Retry, because the entry leaves `unconfirmed` -- pre-existing, not closed here. */
+ *  A refusal that blocks the head still ends probing until a manual Retry (or, on an older
+ *  host, a fence change), because the entry leaves `unconfirmed`. */
 const UNCONFIRMED_PROBE_MAX_DELAY_MS = 16_000
 
 export function useStructuredAgentSessionOutbox(args: {
@@ -35,7 +40,8 @@ export function useStructuredAgentSessionOutbox(args: {
   submissions: readonly AgentJournalSubmission[]
 }) {
   const { fence, sessionId, submissions, target } = args
-  const targetKey = target.kind === 'local' ? 'local' : `environment:${target.environmentId}`
+  // What resends, unblocks and drops a send in flight besides a Retry or a new send; see the hook.
+  const owner = useStructuredAgentSessionOutboxOwnerChange(target, fence)
   const [outbox, setOutbox] = useState<StructuredAgentSessionOutboxEntry[]>(() =>
     readMountedStructuredAgentSessionOutbox(sessionId, fence, readOutbox)
   )
@@ -67,19 +73,15 @@ export function useStructuredAgentSessionOutbox(args: {
     blockedIdRef.current = null
     retryWithFreshClientMessageIdRef.current = null
     probeAttemptsRef.current = { id: null, attempts: 0 }
-  }, [fence, sessionId, targetKey])
+  }, [owner.ownerChange, owner.targetKey, sessionId])
 
   useEffect(() => {
     const sessionChanged = outboxSessionRef.current !== sessionId
     outboxSessionRef.current = sessionId
     const current = sessionChanged
-      ? readMountedStructuredAgentSessionOutbox(sessionId, fence, readOutbox)
+      ? readMountedStructuredAgentSessionOutbox(sessionId, owner.fenceRef.current, readOutbox)
       : outboxRef.current
-    const next = current.map((entry) =>
-      entry.state === 'dispatching' && !hasInFlightLaunchDispatch(entry, fence)
-        ? { ...entry, state: 'queued' as const }
-        : entry
-    )
+    const next = requeueInterruptedStructuredAgentSessionDispatches(current, owner.fenceRef.current)
     if (
       sessionChanged ||
       next.some((entry, index) => entry !== current[index]) ||
@@ -89,7 +91,7 @@ export function useStructuredAgentSessionOutbox(args: {
       setOutbox(next)
       writeOutbox(sessionId, next)
     }
-  }, [fence, sessionId, target])
+  }, [owner.fenceRef, owner.ownerChange, sessionId, target])
 
   useEffect(() => {
     const current = outboxRef.current
@@ -102,7 +104,7 @@ export function useStructuredAgentSessionOutbox(args: {
         .map((submission) => submission.clientMessageId)
     )
     const next = reconcileStructuredAgentSessionOutbox(current, submissions)
-    const admittedInFlight = inFlightIdRef.current !== null && hostOwns.has(inFlightIdRef.current)
+    const admittedInFlight = journalAnswersInFlightSend(submissions, inFlightIdRef.current)
     if (
       admittedInFlight ||
       next.some((entry, index) => entry !== current[index]) ||
@@ -239,7 +241,7 @@ export function useStructuredAgentSessionOutbox(args: {
   const probeSettled =
     probeId !== null && submissions.some((submission) => submission.clientMessageId === probeId)
   useEffect(() => {
-    if (probeId === null || probeSettled || fence === null) {
+    if (probeId === null || probeSettled || !owner.attached) {
       return
     }
     const attempts = probeAttemptsRef.current.id === probeId ? probeAttemptsRef.current.attempts : 0
@@ -256,7 +258,7 @@ export function useStructuredAgentSessionOutbox(args: {
       Math.min(UNCONFIRMED_PROBE_BASE_DELAY_MS * 2 ** attempts, UNCONFIRMED_PROBE_MAX_DELAY_MS)
     )
     return () => clearTimeout(timer)
-  }, [fence, probeId, probeSettled, sessionId, targetKey])
+  }, [owner.attached, owner.ownerChange, owner.targetKey, probeId, probeSettled, sessionId])
 
   const send = useCallback(
     (text: string, attachments: readonly { path: string; previewUri: string }[] = []): boolean => {
diff --git a/src/renderer/src/components/native-chat/use-structured-agent-session-question-answers.test.tsx b/src/renderer/src/components/native-chat/use-structured-agent-session-question-answers.test.tsx
new file mode 100644
index 000000000000..337b22b4f5ec
--- /dev/null
+++ b/src/renderer/src/components/native-chat/use-structured-agent-session-question-answers.test.tsx
@@ -0,0 +1,164 @@
+// @vitest-environment happy-dom
+
+import { act, renderHook } from '@testing-library/react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const mocks = vi.hoisted(() => ({
+  call: vi.fn(),
+  promptCancelSupported: vi.fn(),
+  questionAnswersSupported: vi.fn(),
+  operationId: vi.fn(() => 'operation-1')
+}))
+
+vi.mock('@/runtime/structured-agent-session-client', () => ({
+  callStructuredAgentSession: mocks.call,
+  supportsStructuredAgentSessionPromptCancel: mocks.promptCancelSupported,
+  supportsStructuredAgentSessionQuestionAnswers: mocks.questionAnswersSupported
+}))
+vi.mock('./use-structured-agent-session-read', () => ({
+  useStructuredAgentSessionRead: () => ({
+    state: {
+      fence: 3,
+      items,
+      submissions: [],
+      status: 'ready',
+      error: null,
+      hasOlder: false,
+      handoff: null
+    },
+    loadingOlder: false,
+    loadOlder: vi.fn()
+  })
+}))
+vi.mock('./use-structured-agent-session-outbox', () => ({
+  structuredSessionOperationId: mocks.operationId,
+  useStructuredAgentSessionOutbox: () => ({
+    outbox: [],
+    blockedClientMessageId: null,
+    error: null,
+    send: vi.fn(),
+    retry: vi.fn()
+  })
+}))
+
+import type { AgentJournalRenderItem } from '../../../../shared/agent-session-journal-types'
+import { encodeAgentSessionQuestionAnswers } from '../../../../shared/agent-session-question-answer'
+import {
+  useStructuredAgentSession,
+  type StructuredPromptItem
+} from './use-structured-agent-session'
+
+let items: AgentJournalRenderItem[] = []
+const target = { kind: 'local' } as const
+
+const question: StructuredPromptItem = {
+  itemId: 'question-1',
+  revision: 2,
+  sequence: 2,
+  observedAt: 2,
+  body: {
+    kind: 'question',
+    question: '1 grouped question from Claude',
+    options: [],
+    questions: [
+      {
+        id: 'q1',
+        question: 'Which option?',
+        multiSelect: false,
+        options: [{ id: 'q1:choice-1', label: 'Alpha' }],
+        freeTextQuestionId: 'q1'
+      }
+    ],
+    resolution: { state: 'pending', selectedOptionId: null, resolvedBy: null, resolvedAt: null }
+  }
+}
+
+const approval: StructuredPromptItem = {
+  itemId: 'approval-1',
+  revision: 3,
+  sequence: 3,
+  observedAt: 3,
+  body: {
+    kind: 'approval',
+    title: 'Allow Bash?',
+    detail: null,
+    options: [{ id: 'allow', label: 'Allow' }],
+    resolution: { state: 'pending', selectedOptionId: null, resolvedBy: null, resolvedAt: null }
+  }
+}
+
+const answers = [{ questionId: 'q1', optionIds: [], other: 'Wait for the capture. '.repeat(80) }]
+
+function respondCall(): Record<string, unknown> | undefined {
+  return mocks.call.mock.calls.find(([, method]) =>
+    String(method).startsWith('agentSession.respondTo')
+  )?.[2]
+}
+
+describe('desktop structured prompt answers', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    items = [question, approval]
+    mocks.call.mockResolvedValue({ ok: true, value: { itemId: 'question-1', revision: 3 } })
+  })
+
+  it('sends structured answers to a host that takes them', async () => {
+    mocks.questionAnswersSupported.mockResolvedValue(true)
+    const { result } = renderHook(() =>
+      useStructuredAgentSession({
+        sessionId: 'session-1',
+        target,
+        agent: 'claude',
+        isVisible: true
+      })
+    )
+
+    await act(async () => {
+      await result.current.respond(question, { kind: 'answers', answers })
+    })
+
+    expect(mocks.questionAnswersSupported).toHaveBeenCalledWith(target)
+    expect(respondCall()).toMatchObject({ itemId: 'question-1', expectedRevision: 2, answers })
+    expect(respondCall()).not.toHaveProperty('optionId')
+  })
+
+  it('packs the answer into an option id for a host that predates structured answers', async () => {
+    mocks.questionAnswersSupported.mockResolvedValue(false)
+    const { result } = renderHook(() =>
+      useStructuredAgentSession({
+        sessionId: 'session-1',
+        target,
+        agent: 'claude',
+        isVisible: true
+      })
+    )
+
+    await act(async () => {
+      await result.current.respond(question, { kind: 'answers', answers })
+    })
+
+    expect(respondCall()).toMatchObject({
+      itemId: 'question-1',
+      optionId: encodeAgentSessionQuestionAnswers(answers)
+    })
+    expect(respondCall()).not.toHaveProperty('answers')
+  })
+
+  it('sends an approval decision without probing the host', async () => {
+    const { result } = renderHook(() =>
+      useStructuredAgentSession({
+        sessionId: 'session-1',
+        target,
+        agent: 'claude',
+        isVisible: true
+      })
+    )
+
+    await act(async () => {
+      await result.current.respond(approval, { kind: 'option', optionId: 'allow' })
+    })
+
+    expect(mocks.questionAnswersSupported).not.toHaveBeenCalled()
+    expect(respondCall()).toMatchObject({ itemId: 'approval-1', optionId: 'allow' })
+  })
+})
diff --git a/src/renderer/src/components/native-chat/use-structured-agent-session-transport.ts b/src/renderer/src/components/native-chat/use-structured-agent-session-transport.ts
index 7bf979f8ff0a..f0c3eaa59a83 100644
--- a/src/renderer/src/components/native-chat/use-structured-agent-session-transport.ts
+++ b/src/renderer/src/components/native-chat/use-structured-agent-session-transport.ts
@@ -20,10 +20,8 @@ export function useStructuredAgentSessionTransport(args: {
     enabled: providerVisible
   })
   // A worktree switch hides the pane, but a message the user already sent is still owed a
-  // delivery. The read is what carries the journal rows that retire it, and its subscription
-  // takes a retaining hold — without which the host evicts the session once its idle window runs
-  // out and then refuses the send outright. Gated on `enabled`: a session not yet published has
-  // nothing to read. Attention is not the signal; owed work is.
+  // delivery, and the read is what carries the journal rows that retire it. Gated on `enabled`:
+  // a session not yet published has nothing to read. Attention is not the signal; owed work is.
   const hasUndelivered = useUndeliveredStructuredAgentSessionOutbox(sessionId)
   const read = useStructuredAgentSessionRead({
     sessionId,
diff --git a/src/renderer/src/components/native-chat/use-structured-agent-session-write-refusal.test.tsx b/src/renderer/src/components/native-chat/use-structured-agent-session-write-refusal.test.tsx
new file mode 100644
index 000000000000..0336e81401a7
--- /dev/null
+++ b/src/renderer/src/components/native-chat/use-structured-agent-session-write-refusal.test.tsx
@@ -0,0 +1,193 @@
+// @vitest-environment happy-dom
+
+import { act, renderHook } from '@testing-library/react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const mocks = vi.hoisted(() => ({
+  call: vi.fn(),
+  toastError: vi.fn()
+}))
+
+vi.mock('sonner', () => ({ toast: { error: mocks.toastError, message: vi.fn() } }))
+
+vi.mock('@/runtime/structured-agent-session-client', () => ({
+  callStructuredAgentSession: mocks.call
+}))
+
+vi.mock('./use-structured-agent-session-read', () => ({
+  useStructuredAgentSessionRead: () => ({
+    state: {
+      fence: 3,
+      items: [],
+      submissions: [],
+      status: 'ready',
+      error: null,
+      hasOlder: false,
+      handoff: null
+    },
+    loadingOlder: false,
+    loadOlder: vi.fn()
+  })
+}))
+
+vi.mock('./use-structured-agent-session-outbox', () => ({
+  structuredSessionOperationId: () => 'operation-1',
+  useStructuredAgentSessionOutbox: () => ({
+    outbox: [],
+    blockedClientMessageId: null,
+    error: null,
+    send: vi.fn(),
+    retry: vi.fn()
+  })
+}))
+
+import { useStructuredAgentSession } from './use-structured-agent-session'
+import { RuntimeRpcCallError } from '@/runtime/runtime-rpc-result'
+
+const LOCAL_TARGET = { kind: 'local' } as const
+const OPTIONS = { models: [], current: {} }
+
+describe('a chat write the host refused', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+  })
+
+  it('says a refused Stop once, in plain words, and leaves nothing latched', async () => {
+    mocks.call.mockImplementation((_target, method) =>
+      method === 'agentSession.options'
+        ? Promise.resolve(OPTIONS)
+        : Promise.resolve({
+            ok: false,
+            refusal: {
+              code: 'agent_session_checkpoint_stale',
+              message: 'Expected runtime fence 1; the session is at 3.'
+            }
+          })
+    )
+    const { result } = renderHook(() =>
+      useStructuredAgentSession({
+        sessionId: 'session-1',
+        target: LOCAL_TARGET,
+        agent: 'claude',
+        isVisible: true
+      })
+    )
+
+    await act(async () => {
+      await expect(result.current.cancel('turn-1')).resolves.toBeNull()
+    })
+
+    expect(mocks.toastError).toHaveBeenCalledWith("The agent wasn't stopped.")
+    expect(result.current.error).toBeNull()
+  })
+
+  it('does not say a Stop failed when its request timed out after it may have run', async () => {
+    mocks.call.mockImplementation((_target, method) =>
+      method === 'agentSession.options'
+        ? Promise.resolve(OPTIONS)
+        : Promise.reject(
+            new RuntimeRpcCallError({
+              id: 'request-1',
+              ok: false,
+              error: {
+                code: 'runtime_timeout',
+                message: 'Timed out waiting for the remote Orca runtime to respond.'
+              },
+              _meta: { runtimeId: 'runtime-1' }
+            })
+          )
+    )
+    const { result } = renderHook(() =>
+      useStructuredAgentSession({
+        sessionId: 'session-1',
+        target: LOCAL_TARGET,
+        agent: 'claude',
+        isVisible: true
+      })
+    )
+
+    await act(async () => {
+      await expect(result.current.cancel('turn-1')).resolves.toBeNull()
+    })
+
+    expect(mocks.toastError).toHaveBeenCalledWith(
+      "Orca couldn't confirm what happened. Check the chat."
+    )
+  })
+
+  it('answers a refused conversation command inline, where the command was typed', async () => {
+    mocks.call.mockImplementation((_target, method) =>
+      method === 'agentSession.options'
+        ? Promise.resolve(OPTIONS)
+        : Promise.resolve({
+            ok: false,
+            refusal: {
+              code: 'agent_session_operation_invalid',
+              message: 'agent_session_rewind:outcome-unknown'
+            }
+          })
+    )
+    const { result } = renderHook(() =>
+      useStructuredAgentSession({
+        sessionId: 'session-1',
+        target: LOCAL_TARGET,
+        agent: 'claude',
+        isVisible: true
+      })
+    )
+
+    await act(async () => {
+      await expect(result.current.runConversationCommand('compact')).resolves.toEqual({
+        accepted: false,
+        // The code does not say why, so no next step is offered that could be false.
+        error: "The command didn't run."
+      })
+    })
+
+    expect(mocks.toastError).not.toHaveBeenCalled()
+    expect(result.current.error).toBeNull()
+  })
+
+  it('says the reason the host named, for a Stop and for a command', async () => {
+    mocks.call.mockImplementation((_target, method) =>
+      method === 'agentSession.options'
+        ? Promise.resolve(OPTIONS)
+        : Promise.resolve({
+            ok: false,
+            refusal:
+              method === 'agentSession.cancel'
+                ? {
+                    code: 'agent_session_conflict',
+                    message: 'The chat is still starting.',
+                    details: { reason: 'chatStarting' }
+                  }
+                : {
+                    code: 'agent_session_operation_invalid',
+                    message: 'Wait for the current turn to finish before using this command.',
+                    details: { reason: 'turnActive' }
+                  }
+          })
+    )
+    const { result } = renderHook(() =>
+      useStructuredAgentSession({
+        sessionId: 'session-1',
+        target: LOCAL_TARGET,
+        agent: 'claude',
+        isVisible: true
+      })
+    )
+
+    await act(async () => {
+      await expect(result.current.cancel('turn-1')).resolves.toBeNull()
+      await expect(result.current.runConversationCommand('compact')).resolves.toEqual({
+        accepted: false,
+        error:
+          "The agent is still responding. The command didn't run. Wait for the agent to finish responding, or stop it."
+      })
+    })
+
+    expect(mocks.toastError).toHaveBeenCalledWith(
+      "The agent is still starting. The agent wasn't stopped. Wait for the agent to finish starting."
+    )
+  })
+})
diff --git a/src/renderer/src/components/native-chat/use-structured-agent-session.test.tsx b/src/renderer/src/components/native-chat/use-structured-agent-session.test.tsx
index be20364c1dcc..719fa29be616 100644
--- a/src/renderer/src/components/native-chat/use-structured-agent-session.test.tsx
+++ b/src/renderer/src/components/native-chat/use-structured-agent-session.test.tsx
@@ -6,8 +6,11 @@ import { beforeEach, describe, expect, it, vi } from 'vitest'
 const mocks = vi.hoisted(() => ({
   call: vi.fn(),
   operationId: vi.fn(),
-  enqueueSettingsWrite: vi.fn()
+  enqueueSettingsWrite: vi.fn(),
+  toastError: vi.fn()
 }))
+
+vi.mock('sonner', () => ({ toast: { error: mocks.toastError, message: vi.fn() } }))
 let fence = 3
 let sessionCommands: { name: string; kind: 'command' | 'skill' }[] | undefined
 let items: AgentJournalRenderItem[] = []
@@ -255,7 +258,12 @@ describe('useStructuredAgentSession options', () => {
       expect(await result.current.setStructuredOption('model', 'gpt-fast')).toBe(false)
     })
 
-    expect(result.current.error).toBe('provider rejected option')
+    // Said once, without the transport's text, and without claiming an outcome the failure
+    // cannot prove; nothing stays behind under the composer.
+    expect(mocks.toastError).toHaveBeenCalledWith(
+      "Orca couldn't confirm what happened. Check the chat."
+    )
+    expect(result.current.error).toBeNull()
     expect(result.current.optionSnapshot.find((entry) => entry.id === 'model')).toMatchObject({
       settable: true
     })
@@ -411,6 +419,7 @@ describe('useStructuredAgentSession options', () => {
     })
 
     expect(result.current.error).toBeNull()
+    expect(mocks.toastError).not.toHaveBeenCalled()
   })
 
   it('includes one background task id in the cancel fingerprint and payload', async () => {
diff --git a/src/renderer/src/components/native-chat/use-structured-agent-session.ts b/src/renderer/src/components/native-chat/use-structured-agent-session.ts
index 640b3b2a7c49..e45699e830cf 100644
--- a/src/renderer/src/components/native-chat/use-structured-agent-session.ts
+++ b/src/renderer/src/components/native-chat/use-structured-agent-session.ts
@@ -8,7 +8,14 @@ import type {
 } from '../../../../shared/agent-session-conversation-command'
 import type { AgentType } from '../../../../shared/agent-status-types'
 import type { RuntimeClientTarget } from '@/runtime/runtime-rpc-client'
-import { supportsStructuredAgentSessionPromptCancel } from '@/runtime/structured-agent-session-client'
+import {
+  supportsStructuredAgentSessionPromptCancel,
+  supportsStructuredAgentSessionQuestionAnswers
+} from '@/runtime/structured-agent-session-client'
+import {
+  legacyAgentSessionSelectedOptionId,
+  type AgentSessionPromptResponse
+} from '../../../../shared/agent-session-question-answer'
 import {
   pendingStructuredSessionPrompts,
   type StructuredPromptItem
@@ -46,21 +53,13 @@ export function useStructuredAgentSession(args: {
     target,
     transportEnabled = true
   } = args
-  const {
-    state,
-    loadingOlder,
-    olderHistoryGeneration,
-    loadOlder,
-    mutate,
-    writeError,
-    reportWriteError,
-    providerVisible
-  } = useStructuredAgentSessionTransport({
-    sessionId,
-    target,
-    isVisible,
-    enabled: transportEnabled
-  })
+  const { state, loadingOlder, olderHistoryGeneration, loadOlder, mutate, write, providerVisible } =
+    useStructuredAgentSessionTransport({
+      sessionId,
+      target,
+      isVisible,
+      enabled: transportEnabled
+    })
   const commandPending = useRef(false)
   const transportState = useStructuredAgentSessionTransportState(state, transportEnabled)
   const {
@@ -82,7 +81,6 @@ export function useStructuredAgentSession(args: {
     turnId: transportState.turnId,
     unloadedTurnRevisions: state.unloadedTurnRevisions,
     mutate,
-    reportWriteError,
     ...(launch ? { launch } : {})
   })
   const outboxController = useStructuredAgentSessionOutbox({
@@ -129,7 +127,7 @@ export function useStructuredAgentSession(args: {
           outbox.length
         ),
         send: (command) =>
-          mutate<AgentSessionConversationCommandResult>(
+          write<AgentSessionConversationCommandResult>(
             'agentSession.conversationCommand',
             'agentSession.conversationCommand',
             { command }
@@ -138,9 +136,7 @@ export function useStructuredAgentSession(args: {
     journalItems: transportState.journalItems,
     messages,
     status: transportEnabled ? state.status : 'ready',
-    error: transportEnabled
-      ? (state.error ?? writeError ?? outboxController.error)
-      : outboxController.error,
+    error: transportEnabled ? (state.error ?? outboxController.error) : outboxController.error,
     hasOlder: transportEnabled && state.hasOlder,
     railOutline: transportEnabled ? railOutline : null,
     loadingOlder: transportEnabled && loadingOlder,
@@ -174,14 +170,32 @@ export function useStructuredAgentSession(args: {
         scope: 'background-tasks',
         ...(taskId ? { taskId } : {})
       }),
-    respond: (item: StructuredPromptItem, optionId: string) =>
-      mutate<AgentSessionPromptResult>(
+    respond: async (item: StructuredPromptItem, response: AgentSessionPromptResponse) => {
+      const promptTarget = { itemId: item.itemId, expectedRevision: item.revision }
+      let fields: Record<string, unknown>
+      if (response.kind === 'option') {
+        fields = { ...promptTarget, optionId: response.optionId }
+      } else if (await supportsStructuredAgentSessionQuestionAnswers(target)) {
+        // Negotiated before mutate fingerprints the call: older hosts reject the strict field.
+        fields = { ...promptTarget, answers: response.answers }
+      } else {
+        const optionId =
+          item.body.kind === 'question'
+            ? legacyAgentSessionSelectedOptionId(item.body, response.answers)
+            : null
+        if (optionId === null) {
+          return null
+        }
+        fields = { ...promptTarget, optionId }
+      }
+      return mutate<AgentSessionPromptResult>(
         item.body.kind === 'approval'
           ? 'agentSession.respondToApproval'
           : 'agentSession.respondToQuestion',
         `agentSession.respondTo:${item.body.kind}`,
-        { itemId: item.itemId, expectedRevision: item.revision, optionId }
-      ),
+        fields
+      )
+    },
     optionSnapshot,
     optionSurface,
     sessionCommands: transportEnabled ? (state.commands ?? undefined) : undefined,
diff --git a/src/renderer/src/components/right-sidebar/AiVaultPanel.legacy-filter.test.tsx b/src/renderer/src/components/right-sidebar/AiVaultPanel.legacy-filter.test.tsx
index 92424db05067..f94f077e47df 100644
--- a/src/renderer/src/components/right-sidebar/AiVaultPanel.legacy-filter.test.tsx
+++ b/src/renderer/src/components/right-sidebar/AiVaultPanel.legacy-filter.test.tsx
@@ -26,7 +26,7 @@ const updateSettingsOrThrow = vi.fn(async (next: { aiVaultSearch: { enabled: boo
 
 vi.mock('@/store', () => ({
   useAppStore: Object.assign((select: (state: typeof mockState) => unknown) => select(mockState), {
-    getState: () => ({ ...mockState, updateSettingsOrThrow })
+    getState: () => ({ ...mockState, updateSettingsOrThrow, markFeatureTipsSeen: vi.fn() })
   })
 }))
 vi.mock('@/store/selectors', () => ({
diff --git a/src/renderer/src/components/right-sidebar/AiVaultPanelSearch.test.tsx b/src/renderer/src/components/right-sidebar/AiVaultPanelSearch.test.tsx
index 4e7caa91396a..afce262f459c 100644
--- a/src/renderer/src/components/right-sidebar/AiVaultPanelSearch.test.tsx
+++ b/src/renderer/src/components/right-sidebar/AiVaultPanelSearch.test.tsx
@@ -1,13 +1,19 @@
 // @vitest-environment happy-dom
 
-import { cleanup, render, screen } from '@testing-library/react'
+import { act, cleanup, fireEvent, render, screen } from '@testing-library/react'
 import { afterEach, describe, expect, it, vi } from 'vitest'
 import { searchResults } from '../../../../shared/ai-vault-search-test-fixture'
 import { getExecutionHostLabel } from '../../../../shared/execution-host'
 import { AiVaultPanelSearch } from './AiVaultPanelSearch'
 import type { useAiVaultPanelSearch } from './use-ai-vault-search'
 
-vi.mock('@/store', () => ({ useAppStore: { getState: () => ({}) } }))
+const store = vi.hoisted(() => ({
+  settings: null,
+  markFeatureTipsSeen: vi.fn(),
+  updateSettingsOrThrow: vi.fn(async () => {})
+}))
+
+vi.mock('@/store', () => ({ useAppStore: { getState: () => store } }))
 
 afterEach(cleanup)
 
@@ -140,4 +146,17 @@ describe('AiVaultPanelSearch', () => {
     expect(screen.queryByText(/choose one computer/i)).toBeNull()
     expect(screen.getByText('results')).toBeTruthy()
   })
+
+  it('retires the session search tip when the user turns search on here', async () => {
+    const search = panelSearch({ needsLocalConsent: true })
+    renderPanel(search)
+    await act(async () => {
+      fireEvent.click(screen.getByRole('button', { name: 'Enable' }))
+    })
+    expect(store.markFeatureTipsSeen).toHaveBeenCalledWith(['agent-session-search'])
+    expect(store.updateSettingsOrThrow).toHaveBeenCalledWith({
+      aiVaultSearch: { enabled: true, historyDays: null }
+    })
+    expect(search.retry).toHaveBeenCalled()
+  })
 })
diff --git a/src/renderer/src/components/right-sidebar/AiVaultPanelSearch.tsx b/src/renderer/src/components/right-sidebar/AiVaultPanelSearch.tsx
index d7294bcf3042..833921a9ce49 100644
--- a/src/renderer/src/components/right-sidebar/AiVaultPanelSearch.tsx
+++ b/src/renderer/src/components/right-sidebar/AiVaultPanelSearch.tsx
@@ -72,6 +72,7 @@ export function AiVaultPanelSearch({
       await store.updateSettingsOrThrow({
         aiVaultSearch: { ...resolveAiVaultSearchSettings(store.settings), enabled: true }
       })
+      store.markFeatureTipsSeen(['agent-session-search'])
       onRetry()
     } catch {
       setSaveError(true)
diff --git a/src/renderer/src/components/right-sidebar/SourceControl.virtual-file-list.test.tsx b/src/renderer/src/components/right-sidebar/SourceControl.virtual-file-list.test.tsx
index 2970693dfe48..4d3c172c1ba9 100644
--- a/src/renderer/src/components/right-sidebar/SourceControl.virtual-file-list.test.tsx
+++ b/src/renderer/src/components/right-sidebar/SourceControl.virtual-file-list.test.tsx
@@ -203,13 +203,13 @@ beforeEach(() => {
   // and 24px rows (both rect + row measurement read offsetHeight), and keep
   // the observer path inert so measurements stay deterministic.
   vi.stubGlobal('ResizeObserver', NoopResizeObserver)
-  vi.spyOn(HTMLElement.prototype, 'offsetHeight', 'get').mockImplementation(
-    function (this: HTMLElement) {
-      return this.classList.contains('overflow-auto')
-        ? VIEWPORT_HEIGHT_PX
-        : VIRTUALIZED_LIST_ROW_HEIGHT_PX
-    }
-  )
+  vi.spyOn(HTMLElement.prototype, 'offsetHeight', 'get').mockImplementation(function (
+    this: HTMLElement
+  ) {
+    return this.classList.contains('overflow-auto')
+      ? VIEWPORT_HEIGHT_PX
+      : VIRTUALIZED_LIST_ROW_HEIGHT_PX
+  })
   vi.spyOn(Element.prototype, 'getBoundingClientRect').mockImplementation(function (this: Element) {
     // The panel scroller acts as the fixed viewport; everything inside it
     // shifts up by scrollTop, which is what the list's scroll-margin math
diff --git a/src/renderer/src/components/right-sidebar/ai-vault-session-refresh.test.ts b/src/renderer/src/components/right-sidebar/ai-vault-session-refresh.test.ts
index 19f0d47ce825..567e080360a7 100644
--- a/src/renderer/src/components/right-sidebar/ai-vault-session-refresh.test.ts
+++ b/src/renderer/src/components/right-sidebar/ai-vault-session-refresh.test.ts
@@ -13,6 +13,7 @@ import {
   useAiVaultSessionRefresh
 } from './ai-vault-session-refresh'
 import { DEFAULT_AI_VAULT_SESSION_LIMIT, type AiVaultSessionLimit } from './ai-vault-session-limit'
+import { withNonSecureContextCrypto } from '@/lib/non-secure-context-crypto-stub'
 
 const EMPTY_RESULT: AiVaultListResult = {
   sessions: [],
@@ -801,3 +802,28 @@ describe('useAiVaultSessionRefresh in-app agent session behavior', () => {
     expect(listSessionsMock.mock.calls.length).toBe(callsWhileHealthy)
   })
 })
+
+// Regression for #18096: over plain HTTP the browser hides crypto.randomUUID, so minting
+// the request token with a raw call threw during render and the panel showed "The right
+// sidebar hit an error". The fallback must still be a well-formed v4 UUID.
+describe('useAiVaultSessionRefresh in a non-secure context', () => {
+  it('mints a request token when crypto.randomUUID is unavailable', async () => {
+    await withNonSecureContextCrypto(async () => {
+      await renderHook()
+      await flushMicrotasks()
+
+      expect(lastCallArgs()).toMatchObject({
+        requestToken: expect.stringMatching(
+          /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/
+        )
+      })
+    })
+  })
+
+  // Guards the stub itself: an own-property stub of randomUUID is unrestorable, so a
+  // leaky teardown would silently strip the real method from every later test in the file.
+  it('leaves the real crypto.randomUUID in place afterwards', () => {
+    // oxlint-disable-next-line no-restricted-properties -- asserting the restore this case exists for
+    expect(typeof globalThis.crypto.randomUUID).toBe('function')
+  })
+})
diff --git a/src/renderer/src/components/right-sidebar/ai-vault-session-refresh.ts b/src/renderer/src/components/right-sidebar/ai-vault-session-refresh.ts
index b8787af49f9c..9ace8fbd3999 100644
--- a/src/renderer/src/components/right-sidebar/ai-vault-session-refresh.ts
+++ b/src/renderer/src/components/right-sidebar/ai-vault-session-refresh.ts
@@ -21,6 +21,7 @@ import {
   readCachedAiVaultSessionResult,
   resetAiVaultSessionResultCacheForTest
 } from './ai-vault-session-result-cache'
+import { createBrowserUuid } from '@/lib/browser-uuid'
 
 // In-app session creation bypasses the cache so the new session appears promptly.
 // Keep the budget at module scope so tab remounts cannot amplify full scans.
@@ -94,7 +95,7 @@ export function useAiVaultSessionRefresh(
   const [loading, setLoading] = useState(false)
   const [error, setError] = useState<string | null>(null)
   const requestTokenRef = useRef<string>(undefined!)
-  requestTokenRef.current ??= crypto.randomUUID()
+  requestTokenRef.current ??= createBrowserUuid()
   const refreshIdRef = useRef(0)
   const refreshInFlightRef = useRef(false)
   const pendingRefreshRef = useRef(false)
diff --git a/src/renderer/src/components/right-sidebar/parent-pr-checks-projection-selector.test.ts b/src/renderer/src/components/right-sidebar/parent-pr-checks-projection-selector.test.ts
index 7d7e1b1e4ad9..6706b5ea0ad7 100644
--- a/src/renderer/src/components/right-sidebar/parent-pr-checks-projection-selector.test.ts
+++ b/src/renderer/src/components/right-sidebar/parent-pr-checks-projection-selector.test.ts
@@ -56,6 +56,39 @@ function review(number: number): HostedReviewInfo {
 }
 
 describe('parent PR checks projection selector', () => {
+  it.each([false, true])(
+    'releases unrelated store data while keeping the projection cached (replacement=%s)',
+    async (replacement) => {
+      if (typeof globalThis.gc !== 'function') {
+        throw new Error('Run with the repository Vitest --expose-gc config')
+      }
+      const select = createParentPrChecksProjectionSelector({
+        worktrees: [worktree(0)],
+        repos: [repo()],
+        settings: null,
+        refreshOutcomes: new Map()
+      })
+      if (replacement) {
+        select({ hostedReviewCache: {}, prCache: {}, checksCache: {} })
+      }
+      const caches = { hostedReviewCache: {}, prCache: {}, checksCache: {} }
+      function selectRetiredState(): WeakRef<object> {
+        const unrelatedData = { content: new Uint8Array(1024 * 1024) }
+        const state = { ...caches, unrelatedData }
+        select(state)
+        return new WeakRef(unrelatedData)
+      }
+      const retired = selectRetiredState()
+      const projection = select(caches)
+      for (let round = 0; round < 3; round++) {
+        await new Promise<void>((resolve) => setImmediate(resolve))
+        globalThis.gc()
+      }
+      expect(retired.deref()).toBeUndefined()
+      expect(select(caches)).toBe(projection)
+    }
+  )
+
   it('does not inspect tracked keys when cache map references are unchanged', () => {
     const cacheRead = vi.fn()
     const observedCache = new Proxy(
diff --git a/src/renderer/src/components/right-sidebar/parent-pr-checks-projection-selector.ts b/src/renderer/src/components/right-sidebar/parent-pr-checks-projection-selector.ts
index 42ad55de0a8f..4c4f04cb7ace 100644
--- a/src/renderer/src/components/right-sidebar/parent-pr-checks-projection-selector.ts
+++ b/src/renderer/src/components/right-sidebar/parent-pr-checks-projection-selector.ts
@@ -18,6 +18,15 @@ type CacheDependency = {
   value: unknown
 }
 
+function selectCacheReferences(state: ReviewCacheState): ReviewCacheState {
+  // Pick narrows the type, not the object received from the store.
+  return {
+    hostedReviewCache: state.hostedReviewCache,
+    prCache: state.prCache,
+    checksCache: state.checksCache
+  }
+}
+
 function trackCacheReads<K extends ReviewCacheName>(
   state: ReviewCacheState,
   cacheName: K,
@@ -74,7 +83,7 @@ export function createParentPrChecksProjectionSelector(
       }
       if (dependenciesAreCurrent(state, cached.cacheReferences, cached.dependencies)) {
         // Why: adopting unrelated replacement maps keeps later store notifications O(1).
-        cached.cacheReferences = state
+        cached.cacheReferences = selectCacheReferences(state)
         return cached.projection
       }
     }
@@ -88,7 +97,7 @@ export function createParentPrChecksProjectionSelector(
       prCache: trackCacheReads(state, 'prCache', dependencies),
       checksCache: trackCacheReads(state, 'checksCache', dependencies)
     })
-    cached = { cacheReferences: state, dependencies, projection }
+    cached = { cacheReferences: selectCacheReferences(state), dependencies, projection }
     return projection
   }
 }
diff --git a/src/renderer/src/components/settings/AccountsPane.section-lifetime.test.tsx b/src/renderer/src/components/settings/AccountsPane.section-lifetime.test.tsx
new file mode 100644
index 000000000000..ff46d9637327
--- /dev/null
+++ b/src/renderer/src/components/settings/AccountsPane.section-lifetime.test.tsx
@@ -0,0 +1,257 @@
+// @vitest-environment happy-dom
+import { act, cleanup, fireEvent, render, screen } from '@testing-library/react'
+import { afterEach, beforeEach, expect, it, vi } from 'vitest'
+import { getDefaultSettings } from '../../../../shared/constants'
+import { AccountsPane } from './AccountsPane'
+
+const fake = vi.hoisted(() => ({
+  query: '',
+  cursorStatus: vi.fn(async () => ({
+    signedIn: false,
+    email: null,
+    displayName: null,
+    credentialSource: null,
+    planType: null,
+    tokenFresh: false,
+    error: null
+  })),
+  cursorRefresh: vi.fn(async () => {}),
+  cursorUsage: { updatedAt: 0 },
+  status: vi.fn(async () => ({
+    signedIn: false,
+    email: null,
+    teamId: null,
+    tokenFresh: false,
+    error: null
+  })),
+  pending: vi.fn(async () => null),
+  subscribe: vi.fn(() => vi.fn()),
+  refresh: vi.fn(async () => {}),
+  write: vi.fn(),
+  watcher: vi.fn(() => ({ close: vi.fn() })),
+  grokUsage: { updatedAt: 0 }
+}))
+vi.mock('@/i18n/i18n', () => ({
+  i18n: { language: 'en' },
+  translate: (_key: string, fallback: string, values?: Record<string, string | number>) =>
+    Object.entries(values ?? {}).reduce(
+      (text, [key, value]) => text.replaceAll(`{{${key}}}`, String(value)),
+      fallback
+    )
+}))
+vi.mock('@/store', () => ({
+  useAppStore: (selector: (state: Record<string, unknown>) => unknown) =>
+    selector({
+      settingsSearchQuery: fake.query,
+      rateLimits: {
+        codex: null,
+        codexTarget: { runtime: 'host', wslDistro: null },
+        minimax: null,
+        cursor: fake.cursorUsage,
+        grok: fake.grokUsage
+      },
+      runtimeEnvironments: [],
+      refreshRateLimits: fake.cursorRefresh,
+      refreshGrokRateLimits: fake.refresh,
+      recordFeatureInteraction: fake.write,
+      fetchSettings: fake.write
+    })
+}))
+vi.mock('@/runtime/runtime-provider-accounts-client', () => ({
+  emptyClaudeAccountsState: () => ({
+    accounts: [],
+    activeAccountId: null,
+    activeAccountIdsByRuntime: { host: null, wsl: {} }
+  }),
+  emptyCodexAccountsState: () => ({
+    accounts: [],
+    activeAccountId: null,
+    activeAccountIdsByRuntime: { host: null, wsl: {} }
+  }),
+  hasRemoteProviderAccountOwner: (settings: { activeRuntimeEnvironmentId?: string }) =>
+    Boolean(settings.activeRuntimeEnvironmentId),
+  watchProviderAccounts: fake.watcher,
+  selectClaudeProviderAccount: fake.write,
+  selectCodexProviderAccount: fake.write,
+  removeClaudeProviderAccount: fake.write,
+  removeCodexProviderAccount: fake.write
+}))
+beforeEach(() => {
+  vi.clearAllMocks()
+  fake.query = ''
+  fake.grokUsage = { updatedAt: 0 }
+  fake.cursorUsage = { updatedAt: 0 }
+  Object.assign(window, {
+    api: {
+      minimaxCredentials: {
+        getStatus: vi.fn(async () => ({ cookieConfigured: false, apiKeyConfigured: false }))
+      },
+      codexConfigSync: {
+        status: vi.fn(async () => ({
+          state: 'synced',
+          reason: null,
+          systemConfigPath: '/synthetic/config.toml'
+        }))
+      },
+      codexAccounts: { getPendingLoginUrl: fake.pending, onPendingLoginUrlChanged: fake.subscribe },
+      cursorAccounts: { getStatus: fake.cursorStatus },
+      grokAccounts: { getStatus: fake.status }
+    }
+  })
+})
+afterEach(() => {
+  cleanup()
+  Reflect.deleteProperty(window, 'api')
+})
+
+it.each([false, true])(
+  'retains Grok status reads with Windows account support %s',
+  async (wslSupportedPlatform) => {
+    const props = {
+      settings: getDefaultSettings('/synthetic'),
+      updateSettings: fake.write,
+      wslSupportedPlatform
+    }
+    const view = render(<AccountsPane {...props} />)
+    await act(async () => {})
+    // The invariant is identity, not a magic number: the matched section keeps the same DOM
+    // node across every query edit, so editing the query cannot cost an extra read or watcher.
+    const mountedHeading = screen.getByText('Grok (xAI)', { exact: true })
+    const watchersAfterMount = fake.watcher.mock.calls.length
+    const statusReadsAfterMount = fake.status.mock.calls.length
+    for (const query of ['g', 'gr', 'gro', 'grok', '', 'g', 'gr', 'gro', 'grok']) {
+      fake.query = query
+      await act(async () => view.rerender(<AccountsPane {...props} />))
+      expect(screen.getByText('Grok (xAI)', { exact: true })).toBe(mountedHeading)
+    }
+    expect(fake.watcher.mock.calls.length).toBe(watchersAfterMount)
+    expect(fake.status.mock.calls.length).toBe(statusReadsAfterMount)
+  }
+)
+it.each([false, true])(
+  'retains Codex login reads with Windows account support %s',
+  async (wslSupportedPlatform) => {
+    const props = {
+      settings: getDefaultSettings('/synthetic'),
+      updateSettings: fake.write,
+      wslSupportedPlatform
+    }
+    const view = render(<AccountsPane {...props} />)
+    await act(async () => {})
+    const mountedHeading = screen.getByText('Codex', { exact: true })
+    const pendingReadsAfterMount = fake.pending.mock.calls.length
+    const subscriptionsAfterMount = fake.subscribe.mock.calls.length
+    for (const query of [
+      'c',
+      'co',
+      'cod',
+      'code',
+      'codex',
+      '',
+      'c',
+      'co',
+      'cod',
+      'code',
+      'codex'
+    ]) {
+      fake.query = query
+      await act(async () => view.rerender(<AccountsPane {...props} />))
+      expect(screen.getByText('Codex', { exact: true })).toBe(mountedHeading)
+    }
+    expect(fake.pending.mock.calls.length).toBe(pendingReadsAfterMount)
+    expect(fake.subscribe.mock.calls.length).toBe(subscriptionsAfterMount)
+  }
+)
+it('preserves explicit Grok refresh and real hide/reopen status reads', async () => {
+  fake.query = 'grok'
+  const props = { settings: getDefaultSettings('/synthetic'), updateSettings: fake.write }
+  const view = render(<AccountsPane {...props} />)
+  await act(async () => {})
+  fireEvent.click(screen.getByRole('button', { name: 'Refresh usage' }))
+  await act(async () => {})
+  expect(fake.refresh).toHaveBeenCalledTimes(1)
+  expect(fake.status).toHaveBeenCalledTimes(2)
+  fake.query = 'codex'
+  await act(async () => view.rerender(<AccountsPane {...props} />))
+  expect(screen.queryByText('Grok (xAI)', { exact: true })).toBeNull()
+  fake.query = 'grok'
+  await act(async () => view.rerender(<AccountsPane {...props} />))
+  expect(fake.status).toHaveBeenCalledTimes(3)
+  expect(fake.write).not.toHaveBeenCalled()
+})
+
+it('keeps usage-driven Grok status refreshes while the section stays mounted', async () => {
+  fake.query = 'grok'
+  const props = { settings: getDefaultSettings('/synthetic'), updateSettings: fake.write }
+  const view = render(<AccountsPane {...props} />)
+  await act(async () => {})
+  fake.grokUsage = { updatedAt: 10 }
+  await act(async () => view.rerender(<AccountsPane {...props} />))
+  expect(fake.status).toHaveBeenCalledTimes(2)
+  fake.query = 'gro'
+  await act(async () => view.rerender(<AccountsPane {...props} />))
+  expect(fake.status).toHaveBeenCalledTimes(2)
+  fake.grokUsage = { updatedAt: 11 }
+  await act(async () => view.rerender(<AccountsPane {...props} />))
+  expect(fake.status).toHaveBeenCalledTimes(3)
+})
+
+it('keeps the login subscription until Codex genuinely hides', async () => {
+  const props = { settings: getDefaultSettings('/synthetic'), updateSettings: fake.write }
+  const view = render(<AccountsPane {...props} />)
+  await act(async () => {})
+  const unsubscribe = fake.subscribe.mock.results[0].value
+  fake.query = 'codex'
+  await act(async () => view.rerender(<AccountsPane {...props} />))
+  expect(unsubscribe).not.toHaveBeenCalled()
+  fake.query = 'grok'
+  await act(async () => view.rerender(<AccountsPane {...props} />))
+  expect(unsubscribe).toHaveBeenCalledTimes(1)
+  fake.query = 'codex'
+  await act(async () => view.rerender(<AccountsPane {...props} />))
+  expect(fake.subscribe).toHaveBeenCalledTimes(2)
+  view.unmount()
+  expect(fake.subscribe.mock.results[1].value).toHaveBeenCalledTimes(1)
+})
+
+it.each([false, true])(
+  'retains Cursor status reads with Windows account support %s',
+  async (wslSupportedPlatform) => {
+    const props = {
+      settings: getDefaultSettings('/synthetic'),
+      updateSettings: fake.write,
+      wslSupportedPlatform
+    }
+    const view = render(<AccountsPane {...props} />)
+    await act(async () => {})
+    const mountedHeading = screen.getByText('Cursor', { exact: true })
+    const statusReadsAfterMount = fake.cursorStatus.mock.calls.length
+    for (const query of ['c', 'cu', 'cur', 'curs', 'curso', 'cursor', '', 'c', 'cu', 'cursor']) {
+      fake.query = query
+      await act(async () => view.rerender(<AccountsPane {...props} />))
+      expect(screen.getByText('Cursor', { exact: true })).toBe(mountedHeading)
+    }
+    expect(fake.cursorStatus.mock.calls.length).toBe(statusReadsAfterMount)
+    expect(fake.write).not.toHaveBeenCalled()
+  }
+)
+
+it('keeps Cursor refresh driven by usage updates and genuine reopen', async () => {
+  fake.query = 'cursor'
+  const props = { settings: getDefaultSettings('/synthetic'), updateSettings: fake.write }
+  const view = render(<AccountsPane {...props} />)
+  await act(async () => {})
+  fireEvent.click(screen.getByRole('button', { name: 'Refresh usage' }))
+  await act(async () => {})
+  expect(fake.cursorRefresh).toHaveBeenCalledTimes(1)
+  expect(fake.cursorStatus).toHaveBeenCalledTimes(1)
+  fake.cursorUsage = { updatedAt: 1 }
+  await act(async () => view.rerender(<AccountsPane {...props} />))
+  expect(fake.cursorStatus).toHaveBeenCalledTimes(2)
+  fake.query = 'codex'
+  await act(async () => view.rerender(<AccountsPane {...props} />))
+  expect(screen.queryByText('Cursor', { exact: true })).toBeNull()
+  fake.query = 'cursor'
+  await act(async () => view.rerender(<AccountsPane {...props} />))
+  expect(fake.cursorStatus).toHaveBeenCalledTimes(3)
+})
diff --git a/src/renderer/src/components/settings/AccountsPane.tsx b/src/renderer/src/components/settings/AccountsPane.tsx
index 3af24a986fd0..a418aa9916ba 100644
--- a/src/renderer/src/components/settings/AccountsPane.tsx
+++ b/src/renderer/src/components/settings/AccountsPane.tsx
@@ -18,6 +18,7 @@ import {
   getAccountsClaudeSearchEntries,
   getAccountsCodexSearchEntries,
   getAccountsGeminiSearchEntries,
+  getAccountsCursorSearchEntries,
   getAccountsGrokSearchEntries,
   getAccountsLocationSearchEntries,
   getAccountsMiniMaxSearchEntries,
@@ -26,6 +27,7 @@ import {
 } from './accounts-search'
 import { getRemoteAccountsPaneScope } from './provider-account-scope'
 import { ProviderHostScopeControl } from './ProviderHostScopeControl'
+import { SettingsSectionStack } from './SettingsSectionStack'
 import { matchesSettingsSearch } from './settings-search'
 import { getCodexAccountAuthWarning } from './codex-account-auth-warning'
 import { getCodexConfigSyncWarning } from './codex-config-sync-warning'
@@ -34,8 +36,8 @@ import {
   providerAccountIsActiveInView,
   providerAccountMatchesView
 } from './provider-account-visibility'
-import { Separator } from '../ui/separator'
 import { GrokAccountsSection } from './GrokAccountsSection'
+import { CursorAccountsSection } from './CursorAccountsSection'
 import type {
   AccountsPaneProps,
   AccountsPaneSectionModel,
@@ -379,18 +381,16 @@ export function AccountsPane({
       : null,
     matchesSettingsSearch(searchQuery, getAccountsGrokSearchEntries()) ? (
       <GrokAccountsSection key="grok" />
+    ) : null,
+    matchesSettingsSearch(searchQuery, getAccountsCursorSearchEntries()) ? (
+      <CursorAccountsSection key="cursor" />
     ) : null
-  ].filter(Boolean)
+  ]
 
   return (
     <div className="space-y-8">
       {renderAccountsRemovalDialogs(model, removeCodexTarget, removeClaudeTarget)}
-      {visibleSections.map((section, index) => (
-        <div key={index} className="space-y-8">
-          {index > 0 ? <Separator /> : null}
-          {section}
-        </div>
-      ))}
+      <SettingsSectionStack sections={visibleSections} spacing="group" />
     </div>
   )
 }
diff --git a/src/renderer/src/components/settings/AppearanceWindowSidebarSection.tsx b/src/renderer/src/components/settings/AppearanceWindowSidebarSection.tsx
index 1d82af8ed7d4..03c7912a7722 100644
--- a/src/renderer/src/components/settings/AppearanceWindowSidebarSection.tsx
+++ b/src/renderer/src/components/settings/AppearanceWindowSidebarSection.tsx
@@ -53,7 +53,8 @@ function recordStatusBarToggleInteraction(
     id === 'kimi' ||
     id === 'antigravity' ||
     id === 'minimax' ||
-    id === 'grok'
+    id === 'grok' ||
+    id === 'cursor'
   ) {
     recordFeatureInteraction('usage-tracking')
   }
diff --git a/src/renderer/src/components/settings/BrowserPane.search-catalog.test.tsx b/src/renderer/src/components/settings/BrowserPane.search-catalog.test.tsx
new file mode 100644
index 000000000000..20517cf7276a
--- /dev/null
+++ b/src/renderer/src/components/settings/BrowserPane.search-catalog.test.tsx
@@ -0,0 +1,129 @@
+// @vitest-environment happy-dom
+import { cleanup, fireEvent, render, screen } from '@testing-library/react'
+import { afterEach, beforeEach, expect, it, vi } from 'vitest'
+import { getDefaultSettings } from '../../../../shared/constants'
+import { BrowserPane } from './BrowserPane'
+import { getBrowserPaneSearchEntries } from './browser-search'
+import type * as BrowserSearch from './browser-search'
+
+const fake = vi.hoisted(() => ({
+  query: '',
+  locale: { language: 'en' },
+  translate: vi.fn((_key: string, fallback: string) => fallback),
+  setHost: vi.fn(),
+  profiles: [],
+  repos: [],
+  map: new Map(),
+  environments: [],
+  hostOptions: [{ id: 'local', kind: 'local', label: 'Local' }]
+}))
+vi.mock('@/i18n/i18n', () => ({ i18n: fake.locale, translate: fake.translate }))
+vi.mock('./browser-search', async (importOriginal) => {
+  const original = await importOriginal<typeof BrowserSearch>()
+  return { ...original, getBrowserPaneSearchEntries: vi.fn(original.getBrowserPaneSearchEntries) }
+})
+vi.mock('@/store', () => ({
+  useAppStore: (selector: (state: Record<string, unknown>) => unknown) =>
+    selector({
+      settingsSearchQuery: fake.query,
+      browserDefaultUrl: '',
+      browserSessionProfiles: fake.profiles,
+      repos: fake.repos,
+      sshTargetLabels: fake.map,
+      sshConnectionStates: fake.map,
+      runtimeEnvironments: fake.environments,
+      runtimeStatusByEnvironmentId: fake.map,
+      browserSessionHostIdOverride: null,
+      setBrowserSessionHostId: fake.setHost
+    })
+}))
+vi.mock('@/components/terminal-pane/pane-helpers', () => ({ isMacUserAgent: () => false }))
+vi.mock('../sidebar/sidebar-host-options', () => ({
+  buildSidebarHostOptions: () => fake.hostOptions
+}))
+vi.mock('./BrowserHomePageSetting', () => ({
+  BrowserHomePageSetting: ({
+    value,
+    onChange
+  }: {
+    value: string
+    onChange: (value: string) => void
+  }) => (
+    <input
+      aria-label="Home page draft"
+      value={value}
+      onChange={(event) => onChange(event.target.value)}
+    />
+  )
+}))
+vi.mock('./BrowserUsePane', () => ({ BrowserUseSetup: () => <span>Browser use row</span> }))
+vi.mock('./BrowserDefaultZoomSetting', () => ({
+  BrowserDefaultZoomSetting: () => <span>Zoom row</span>
+}))
+vi.mock('./BrowserSearchEngineSetting', () => ({
+  BrowserSearchEngineSetting: () => <span>Search row</span>
+}))
+vi.mock('./BrowserLinkRoutingSetting', () => ({
+  BrowserLinkRoutingSetting: () => <span>Routing row</span>
+}))
+vi.mock('./BrowserLinkRoutingModifierSetting', () => ({
+  BrowserLinkRoutingModifierSetting: () => <span>Modifier row</span>
+}))
+vi.mock('./BrowserTerminalLinkActionsSetting', () => ({
+  BrowserTerminalLinkActionsSetting: () => <span>Terminal links row</span>
+}))
+vi.mock('./BrowserLocalhostWorktreeLabelsSetting', () => ({
+  BrowserLocalhostWorktreeLabelsSetting: () => <span>Localhost row</span>
+}))
+vi.mock('./BrowserClientHostedRemoteSetting', () => ({
+  BrowserClientHostedRemoteSetting: () => <span>Remote row</span>
+}))
+vi.mock('./BrowserSshWorkspaceRoutingSetting', () => ({
+  BrowserSshWorkspaceRoutingSetting: () => <span>SSH row</span>
+}))
+vi.mock('./BrowserUserAgentSetting', () => ({
+  BrowserUserAgentSetting: () => <span>Identity row</span>
+}))
+vi.mock('./SettingsFormControls', () => ({ SettingsSubsectionHeader: () => null }))
+vi.mock('./BrowserSessionCookiesSection', () => ({
+  BrowserSessionCookiesSection: () => <span>Cookies row</span>
+}))
+vi.mock('./BrowserNewProfileDialog', () => ({ BrowserNewProfileDialog: () => null }))
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  fake.query = ''
+  fake.locale.language = 'en'
+  fake.translate.mockImplementation((_key, fallback) => fallback)
+})
+afterEach(cleanup)
+it('builds one catalog per render while typing a home page draft', () => {
+  render(<BrowserPane settings={getDefaultSettings('/synthetic')} updateSettings={vi.fn()} />)
+  vi.clearAllMocks()
+  for (let index = 1; index <= 20; index++) {
+    fireEvent.change(screen.getByRole('textbox'), { target: { value: 'x'.repeat(index) } })
+  }
+  expect(getBrowserPaneSearchEntries).toHaveBeenCalledTimes(20)
+})
+it('keeps targeted search visibility', () => {
+  fake.query = 'Default Home Page'
+  render(<BrowserPane settings={getDefaultSettings('/synthetic')} updateSettings={vi.fn()} />)
+  expect(screen.getByRole('textbox')).toBeTruthy()
+  expect(screen.queryByText('Cookies row')).toBeNull()
+})
+
+it('rebuilds metadata in the next render after the language changes', () => {
+  fake.query = 'Default Home Page'
+  const settings = getDefaultSettings('/synthetic')
+  const view = render(<BrowserPane settings={settings} updateSettings={vi.fn()} />)
+  expect(screen.getByRole('textbox')).toBeTruthy()
+  fake.locale.language = 'synthetic-locale'
+  fake.query = 'Translated home'
+  fake.translate.mockImplementation((_key, fallback) =>
+    fallback === 'Default Home Page' ? 'Translated home' : fallback
+  )
+  vi.mocked(getBrowserPaneSearchEntries).mockClear()
+  view.rerender(<BrowserPane settings={settings} updateSettings={vi.fn()} />)
+  expect(screen.getByRole('textbox')).toBeTruthy()
+  expect(screen.queryByText('Cookies row')).toBeNull()
+})
diff --git a/src/renderer/src/components/settings/BrowserPane.tsx b/src/renderer/src/components/settings/BrowserPane.tsx
index be271b617852..41b330b2c333 100644
--- a/src/renderer/src/components/settings/BrowserPane.tsx
+++ b/src/renderer/src/components/settings/BrowserPane.tsx
@@ -102,25 +102,18 @@ export function BrowserPane({
 
   const selectedSearchEngine = browserDefaultSearchEngine ?? 'google'
 
-  const showHomePage = matchesSettingsSearch(searchQuery, [getBrowserPaneSearchEntries()[0]])
-  const showSearchEngine = matchesSettingsSearch(searchQuery, [getBrowserPaneSearchEntries()[1]])
-  const showDefaultZoom = matchesSettingsSearch(searchQuery, [getBrowserPaneSearchEntries()[2]])
-  const showLinkRouting = matchesSettingsSearch(searchQuery, [getBrowserPaneSearchEntries()[3]])
-  const showLinkRoutingModifier = matchesSettingsSearch(searchQuery, [
-    getBrowserPaneSearchEntries()[4]
-  ])
-  const showTerminalLinkActions = matchesSettingsSearch(searchQuery, [
-    getBrowserPaneSearchEntries()[5]
-  ])
-  const showLocalhostLabels = matchesSettingsSearch(searchQuery, [getBrowserPaneSearchEntries()[6]])
-  const showCookies = matchesSettingsSearch(searchQuery, [getBrowserPaneSearchEntries()[7]])
-  const showClientHostedRemote = matchesSettingsSearch(searchQuery, [
-    getBrowserPaneSearchEntries()[8]
-  ])
-  const showSshWorkspaceRouting = matchesSettingsSearch(searchQuery, [
-    getBrowserPaneSearchEntries()[9]
-  ])
-  const showUserAgent = matchesSettingsSearch(searchQuery, [getBrowserPaneSearchEntries()[10]])
+  const browserSearchEntries = getBrowserPaneSearchEntries()
+  const showHomePage = matchesSettingsSearch(searchQuery, [browserSearchEntries[0]])
+  const showSearchEngine = matchesSettingsSearch(searchQuery, [browserSearchEntries[1]])
+  const showDefaultZoom = matchesSettingsSearch(searchQuery, [browserSearchEntries[2]])
+  const showLinkRouting = matchesSettingsSearch(searchQuery, [browserSearchEntries[3]])
+  const showLinkRoutingModifier = matchesSettingsSearch(searchQuery, [browserSearchEntries[4]])
+  const showTerminalLinkActions = matchesSettingsSearch(searchQuery, [browserSearchEntries[5]])
+  const showLocalhostLabels = matchesSettingsSearch(searchQuery, [browserSearchEntries[6]])
+  const showCookies = matchesSettingsSearch(searchQuery, [browserSearchEntries[7]])
+  const showClientHostedRemote = matchesSettingsSearch(searchQuery, [browserSearchEntries[8]])
+  const showSshWorkspaceRouting = matchesSettingsSearch(searchQuery, [browserSearchEntries[9]])
+  const showUserAgent = matchesSettingsSearch(searchQuery, [browserSearchEntries[10]])
   const showBrowserUse = matchesSettingsSearch(searchQuery, getBrowserUsePaneSearchEntries())
   const isMac = isMacUserAgent()
   const linkRoutingDescription = getBrowserLinkRoutingDescription(
diff --git a/src/renderer/src/components/settings/CursorAccountsSection.tsx b/src/renderer/src/components/settings/CursorAccountsSection.tsx
new file mode 100644
index 000000000000..705e7a6e33bf
--- /dev/null
+++ b/src/renderer/src/components/settings/CursorAccountsSection.tsx
@@ -0,0 +1,281 @@
+import { useCallback, useEffect, useRef, useState } from 'react'
+import { ExternalLink, Loader2, RefreshCw, ShieldCheck } from 'lucide-react'
+import { AgentIcon } from '@/lib/agent-catalog'
+import { translate } from '@/i18n/i18n'
+import { cn } from '@/lib/utils'
+import { useAppStore } from '../../store'
+import { Badge } from '../ui/badge'
+import { Button } from '../ui/button'
+import type { CursorAccountStatus } from '../../../../shared/rate-limit-types'
+import { SearchableSetting } from './SearchableSetting'
+
+const CURSOR_USAGE_DASHBOARD_URL = 'https://cursor.com/dashboard/spending'
+const SEARCH_KEYWORDS = ['cursor', 'usage', 'plan', 'spend', 'billing', 'rate limit']
+
+function credentialSourceLabel(source: CursorAccountStatus['credentialSource']): string | null {
+  if (source === 'keychain') {
+    return translate(
+      'auto.components.settings.CursorAccountsSection.source.keychain',
+      'macOS Keychain (cursor-agent)'
+    )
+  }
+  if (source === 'cli') {
+    return translate(
+      'auto.components.settings.CursorAccountsSection.source.cli',
+      'Cursor CLI auth file'
+    )
+  }
+  if (source === 'desktop') {
+    return translate('auto.components.settings.CursorAccountsSection.source.desktop', 'Cursor IDE')
+  }
+  return null
+}
+
+export function CursorAccountsSection(): React.JSX.Element {
+  const refreshRateLimits = useAppStore((s) => s.refreshRateLimits)
+  const cursorUsage = useAppStore((s) => s.rateLimits.cursor)
+  const [status, setStatus] = useState<CursorAccountStatus | null>(null)
+  const [loading, setLoading] = useState(true)
+  const [refreshing, setRefreshing] = useState(false)
+
+  // Why a generation counter: two usage updates can overlap, and the slower read
+  // would otherwise land last and repaint the pane with the older account.
+  const latestLoad = useRef(0)
+
+  const loadStatus = useCallback(async (): Promise<void> => {
+    const generation = latestLoad.current + 1
+    latestLoad.current = generation
+    const apply = (next: CursorAccountStatus): void => {
+      if (latestLoad.current !== generation) {
+        return
+      }
+      setStatus(next)
+      setLoading(false)
+    }
+    try {
+      apply(await window.api.cursorAccounts.getStatus())
+    } catch (error) {
+      console.error('Failed to load Cursor account status:', error)
+      apply({
+        signedIn: false,
+        email: null,
+        displayName: null,
+        credentialSource: null,
+        planType: null,
+        tokenFresh: false,
+        error: error instanceof Error ? error.message : 'Unable to read Cursor sign-in'
+      })
+    }
+  }, [])
+
+  // Why: after a background usage fetch, sign-in state may change — reload status then.
+  useEffect(() => {
+    void loadStatus()
+  }, [loadStatus, cursorUsage?.updatedAt])
+
+  // Why: the effect below already reloads status when the refresh lands a new
+  // snapshot, and each load is a keychain read for an item Orca does not own.
+  const handleRefreshUsage = async (): Promise<void> => {
+    setRefreshing(true)
+    try {
+      await refreshRateLimits()
+    } finally {
+      setRefreshing(false)
+    }
+  }
+
+  const signedIn = status?.signedIn === true
+  const tokenFresh = status?.tokenFresh === true
+  const sourceLabel = credentialSourceLabel(status?.credentialSource ?? null)
+  const pools = cursorUsage?.buckets ?? []
+  const monthly = cursorUsage?.monthly ?? null
+  // Why: hiding the row entirely leaves signed-in users with no explanation when
+  // Cursor reports no allowance or the refresh failed — never let unknown usage
+  // read as healthy, and never let a failed fetch render as an empty section.
+  const unavailableReason =
+    signedIn && pools.length === 0 && !monthly
+      ? cursorUsage?.status === 'unavailable' || cursorUsage?.status === 'error'
+        ? (cursorUsage.error ?? null)
+        : null
+      : null
+  // Why separate from the row above: a stale snapshot still renders its numbers,
+  // so the failure has to be said beside them rather than instead of them.
+  const staleUsageError =
+    signedIn && cursorUsage?.status === 'error' && (pools.length > 0 || monthly)
+      ? (cursorUsage.error ?? null)
+      : null
+
+  return (
+    <section id="accounts-cursor" className="space-y-4 scroll-mt-6">
+      <div className="flex items-start justify-between gap-3">
+        <div className="space-y-1">
+          <h3 className="flex items-center gap-2 text-sm font-semibold">
+            <AgentIcon agent="cursor" size={16} />
+            {translate('auto.components.settings.CursorAccountsSection.title', 'Cursor')}
+          </h3>
+          <p className="text-xs text-muted-foreground">
+            {translate(
+              'auto.components.settings.CursorAccountsSection.subtitle',
+              'Shows your monthly Cursor plan usage from the sign-in already on this computer. Orca only reads it — it never changes your Cursor login.'
+            )}
+          </p>
+        </div>
+        <a
+          href={CURSOR_USAGE_DASHBOARD_URL}
+          target="_blank"
+          rel="noopener noreferrer"
+          className="inline-flex items-center gap-1 text-xs text-muted-foreground hover:text-foreground"
+        >
+          {translate(
+            'auto.components.settings.CursorAccountsSection.dashboardLink',
+            'Cursor dashboard'
+          )}
+          <ExternalLink className="size-3" />
+        </a>
+      </div>
+
+      <div
+        className={cn(
+          'flex items-start gap-3 rounded-lg border bg-muted/20 p-3',
+          signedIn && tokenFresh ? 'border-border/60' : 'border-border/40'
+        )}
+      >
+        <ShieldCheck
+          className={cn(
+            'mt-0.5 size-4 shrink-0',
+            signedIn && tokenFresh ? 'text-foreground' : 'text-muted-foreground'
+          )}
+        />
+        <div className="min-w-0 flex-1 space-y-1">
+          {loading ? (
+            <p className="text-xs text-muted-foreground">
+              {translate('auto.components.settings.CursorAccountsSection.loading', 'Loading…')}
+            </p>
+          ) : signedIn ? (
+            <>
+              <p className="truncate text-xs font-medium">
+                {status?.email ??
+                  status?.displayName ??
+                  translate('auto.components.settings.CursorAccountsSection.signedIn', 'Signed in')}
+              </p>
+              <p className="text-xs text-muted-foreground">
+                {tokenFresh
+                  ? sourceLabel
+                    ? translate(
+                        'auto.components.settings.CursorAccountsSection.signedInFrom',
+                        'Signed in. Orca reads the session stored in {{source}}.',
+                        { source: sourceLabel }
+                      )
+                    : translate(
+                        'auto.components.settings.CursorAccountsSection.signedInGeneric',
+                        'Signed in. Orca reads the Cursor session stored on this computer.'
+                      )
+                  : translate(
+                      'auto.components.settings.CursorAccountsSection.expired',
+                      'Sign-in expired — run cursor-agent login on the computer running Orca, then click Refresh usage.'
+                    )}
+              </p>
+            </>
+          ) : (
+            <>
+              <p className="text-xs font-medium">
+                {translate(
+                  'auto.components.settings.CursorAccountsSection.signedOut',
+                  'No Cursor sign-in found on this computer'
+                )}
+              </p>
+              <p className="text-xs text-muted-foreground">
+                {translate(
+                  'auto.components.settings.CursorAccountsSection.signedOutHelp',
+                  'Sign in with Cursor IDE, or run cursor-agent login in a terminal, then click Refresh usage here.'
+                )}
+              </p>
+            </>
+          )}
+          {status?.error ? <p className="text-xs text-destructive">{status.error}</p> : null}
+        </div>
+        <Button
+          variant="outline"
+          size="xs"
+          disabled={refreshing}
+          onClick={() => void handleRefreshUsage()}
+          className="shrink-0"
+        >
+          {refreshing ? (
+            <Loader2 className="size-3 animate-spin" />
+          ) : (
+            <RefreshCw className="size-3" />
+          )}
+          {translate(
+            'auto.components.settings.CursorAccountsSection.refreshUsage',
+            'Refresh usage'
+          )}
+        </Button>
+      </div>
+
+      {pools.length > 0 || monthly ? (
+        <SearchableSetting
+          title={translate(
+            'auto.components.settings.CursorAccountsSection.usageTitle',
+            'Monthly plan usage'
+          )}
+          description={translate(
+            'auto.components.settings.CursorAccountsSection.usageDescription',
+            'Cursor bills two pools that reset with your billing cycle, plus on-demand spend once they run out.'
+          )}
+          keywords={SEARCH_KEYWORDS}
+        >
+          <div className="space-y-1">
+            {pools.map((pool) => (
+              <div key={pool.name} className="flex items-center gap-2 text-xs">
+                <Badge variant="secondary">
+                  <span className="tabular-nums">{Math.round(pool.usedPercent)}%</span>
+                </Badge>
+                <span className="text-muted-foreground">{pool.name}</span>
+              </div>
+            ))}
+            {monthly ? (
+              <div className="flex items-center gap-2 text-xs">
+                <Badge variant="secondary">
+                  <span className="tabular-nums">{Math.round(monthly.usedPercent)}%</span>
+                </Badge>
+                <span className="text-muted-foreground">
+                  {translate('auto.components.settings.CursorAccountsSection.planTotal', 'Plan')}
+                </span>
+              </div>
+            ) : null}
+            {(monthly ?? pools[0])?.resetDescription ? (
+              <p className="text-xs text-muted-foreground">
+                {translate(
+                  'auto.components.settings.CursorAccountsSection.resets',
+                  'Resets {{when}}',
+                  { when: (monthly ?? pools[0])?.resetDescription ?? '' }
+                )}
+              </p>
+            ) : null}
+            {staleUsageError ? (
+              <p className="text-xs text-destructive">
+                {translate(
+                  'auto.components.settings.CursorAccountsSection.staleUsage',
+                  'Last known usage — the latest refresh failed: {{reason}}',
+                  { reason: staleUsageError }
+                )}
+              </p>
+            ) : null}
+          </div>
+        </SearchableSetting>
+      ) : unavailableReason ? (
+        <SearchableSetting
+          title={translate('auto.components.settings.CursorAccountsSection.usageLabel', 'Usage')}
+          description={translate(
+            'auto.components.settings.CursorAccountsSection.noAllowance',
+            'Cursor reported no usage allowance for this account.'
+          )}
+          keywords={SEARCH_KEYWORDS}
+        >
+          <p className="text-xs text-muted-foreground">{unavailableReason}</p>
+        </SearchableSetting>
+      ) : null}
+    </section>
+  )
+}
diff --git a/src/renderer/src/components/settings/GeneralPane.section-lifetime.test.tsx b/src/renderer/src/components/settings/GeneralPane.section-lifetime.test.tsx
new file mode 100644
index 000000000000..65311898711d
--- /dev/null
+++ b/src/renderer/src/components/settings/GeneralPane.section-lifetime.test.tsx
@@ -0,0 +1,206 @@
+// @vitest-environment happy-dom
+import { act, cleanup, fireEvent, render, screen } from '@testing-library/react'
+import { afterEach, beforeEach, expect, it, vi } from 'vitest'
+import { getDefaultSettings } from '../../../../shared/constants'
+import { GeneralPane } from './GeneralPane'
+const fake = vi.hoisted(() => ({
+  query: '',
+  getVersion: vi.fn(async () => '1.4.100'),
+  refresh: vi.fn(async () => {}),
+  action: vi.fn(),
+  updates: new Map([
+    ['synthetic-host', { environmentId: 'synthetic-host', phase: 'current', name: 'Synthetic' }]
+  ])
+}))
+vi.mock('@/i18n/i18n', () => ({
+  i18n: { language: 'en' },
+  translate: (_key: string, fallback: string, values?: Record<string, string | number>) =>
+    Object.entries(values ?? {}).reduce(
+      (text, [key, value]) => text.replaceAll(`{{${key}}}`, String(value)),
+      fallback
+    )
+}))
+vi.mock('@/store', () => ({
+  useAppStore: (selector: (state: Record<string, unknown>) => unknown) =>
+    selector({
+      settingsSearchQuery: fake.query,
+      updateStatus: { state: 'idle' },
+      remoteServerUpdates: fake.updates,
+      remoteServerUpdatesChecking: false,
+      remoteServerUpdatesRunning: false,
+      refreshRemoteServerUpdates: fake.refresh,
+      setRemoteServerUpdateDialogOpen: fake.action
+    })
+}))
+vi.mock('@/components/settings/GeneralWorkspaceSettingsSection', () => ({
+  GeneralWorkspaceSettingsSection: () => null
+}))
+vi.mock('@/components/settings/CliSection', () => ({ CliSection: () => null }))
+vi.mock('@/components/settings/GeneralSupportSection', () => ({
+  GeneralSupportSection: () => null
+}))
+vi.mock('@/components/settings/ReleaseChannelSection', () => ({
+  ReleaseChannelSection: () => <div>Release picker open</div>
+}))
+vi.mock('@/components/settings/DefaultWindowsProjectRuntimeSetting', () => ({
+  DefaultWindowsProjectRuntimeSetting: () => null
+}))
+beforeEach(() => {
+  vi.clearAllMocks()
+  fake.query = ''
+  fake.updates = new Map([
+    ['synthetic-host', { environmentId: 'synthetic-host', phase: 'current', name: 'Synthetic' }]
+  ])
+  Object.assign(window, { api: { updater: { getVersion: fake.getVersion } } })
+})
+afterEach(() => {
+  cleanup()
+  Reflect.deleteProperty(window, 'api')
+})
+it.each([false, true])(
+  'retains update sections with Windows runtime support %s',
+  async (wslSupportedPlatform) => {
+    const props = {
+      settings: getDefaultSettings('/synthetic'),
+      updateSettings: vi.fn(),
+      fontSuggestions: [],
+      wslSupportedPlatform
+    }
+    const view = render(<GeneralPane {...props} />)
+    await act(async () => {})
+    // The invariant is identity, not a magic number: the matched section keeps the same DOM
+    // node across every query edit, so editing the query cannot cost an extra read.
+    const mountedHeading = screen.getByText('Updates', { exact: true })
+    const versionReadsAfterMount = fake.getVersion.mock.calls.length
+    const remoteRefreshesAfterMount = fake.refresh.mock.calls.length
+    for (const query of [
+      'u',
+      'up',
+      'upd',
+      'upda',
+      'updat',
+      'update',
+      '',
+      'v',
+      've',
+      'ver',
+      'vers',
+      'versi',
+      'versio',
+      'version'
+    ]) {
+      fake.query = query
+      await act(async () => view.rerender(<GeneralPane {...props} />))
+      expect(screen.getByText('Updates', { exact: true })).toBe(mountedHeading)
+    }
+    expect(fake.getVersion.mock.calls.length).toBe(versionReadsAfterMount)
+    expect(fake.refresh.mock.calls.length).toBe(remoteRefreshesAfterMount)
+  }
+)
+
+it('keeps showing store-published remote update state without a remount', async () => {
+  const props = {
+    settings: getDefaultSettings('/synthetic'),
+    updateSettings: vi.fn(),
+    fontSuggestions: []
+  }
+  fake.query = 'update'
+  const view = render(<GeneralPane {...props} />)
+  await act(async () => {})
+  const mountedHeading = screen.getByText('Updates', { exact: true })
+  expect(screen.getByText('1 paired server · 1 up to date')).toBeTruthy()
+  // Remote update entries live in the store, so a retained section stays fresh through the
+  // subscription rather than through the remount a query edit used to force.
+  fake.updates = new Map([
+    ['synthetic-host', { environmentId: 'synthetic-host', phase: 'available', name: 'Synthetic' }]
+  ])
+  fake.query = 'updat'
+  await act(async () => view.rerender(<GeneralPane {...props} />))
+  expect(screen.getByText('Updates', { exact: true })).toBe(mountedHeading)
+  expect(screen.getByText('1 paired server · 1 ready to update')).toBeTruthy()
+  expect(fake.refresh.mock.calls.length).toBe(1)
+})
+it('keeps explicit remote refresh and true hide/reopen reads', async () => {
+  const props = {
+    settings: getDefaultSettings('/synthetic'),
+    updateSettings: vi.fn(),
+    fontSuggestions: []
+  }
+  const view = render(<GeneralPane {...props} />)
+  await act(async () => {})
+  fireEvent.click(screen.getByRole('button', { name: 'Check for Server Updates' }))
+  expect(fake.refresh).toHaveBeenCalledTimes(2)
+  fake.query = 'Tab Order'
+  await act(async () => view.rerender(<GeneralPane {...props} />))
+  expect(screen.queryByText('Updates', { exact: true })).toBeNull()
+  fake.query = 'update'
+  await act(async () => view.rerender(<GeneralPane {...props} />))
+  expect(fake.getVersion).toHaveBeenCalledTimes(2)
+  expect(fake.refresh).toHaveBeenCalledTimes(3)
+})
+
+it('preserves an autosave draft until external settings change or the section hides', async () => {
+  const settings = { ...getDefaultSettings('/synthetic'), editorAutoSaveDelayMs: 1000 }
+  const props = { settings, updateSettings: vi.fn(), fontSuggestions: [] }
+  const view = render(<GeneralPane {...props} />)
+  await act(async () => {})
+  fireEvent.change(screen.getByRole('spinbutton'), { target: { value: '2500' } })
+  fake.query = 'Auto Save'
+  await act(async () => view.rerender(<GeneralPane {...props} />))
+  expect(screen.getByRole('spinbutton').getAttribute('value')).toBe('2500')
+  expect(props.updateSettings).not.toHaveBeenCalled()
+  const changedProps = { ...props, settings: { ...settings, editorAutoSaveDelayMs: 3000 } }
+  await act(async () => view.rerender(<GeneralPane {...changedProps} />))
+  expect(screen.getByRole('spinbutton').getAttribute('value')).toBe('3000')
+  fireEvent.change(screen.getByRole('spinbutton'), { target: { value: '3500' } })
+  fake.query = 'Tab Order'
+  await act(async () => view.rerender(<GeneralPane {...changedProps} />))
+  expect(screen.queryByRole('spinbutton')).toBeNull()
+  fake.query = 'Auto Save'
+  await act(async () => view.rerender(<GeneralPane {...changedProps} />))
+  expect(screen.getByRole('spinbutton').getAttribute('value')).toBe('3000')
+  expect(props.updateSettings).not.toHaveBeenCalled()
+})
+it('retains the revealed release picker only while Updates remains visible', async () => {
+  const props = {
+    settings: getDefaultSettings('/synthetic'),
+    updateSettings: vi.fn(),
+    fontSuggestions: []
+  }
+  const view = render(<GeneralPane {...props} />)
+  await act(async () => {})
+  fireEvent.click(screen.getByText('Updates', { exact: true }), { altKey: true })
+  expect(screen.getByText('Release picker open')).toBeTruthy()
+  fake.query = 'update'
+  await act(async () => view.rerender(<GeneralPane {...props} />))
+  expect(screen.getByText('Release picker open')).toBeTruthy()
+  fake.query = 'Tab Order'
+  await act(async () => view.rerender(<GeneralPane {...props} />))
+  fake.query = 'update'
+  await act(async () => view.rerender(<GeneralPane {...props} />))
+  expect(screen.queryByText('Release picker open')).toBeNull()
+})
+it('does not publish a version result from a genuinely unmounted section', async () => {
+  let resolveOld: ((value: string) => void) | undefined
+  fake.getVersion.mockImplementationOnce(
+    () =>
+      new Promise<string>((resolve) => {
+        resolveOld = resolve
+      })
+  )
+  const props = {
+    settings: getDefaultSettings('/synthetic'),
+    updateSettings: vi.fn(),
+    fontSuggestions: []
+  }
+  const view = render(<GeneralPane {...props} />)
+  await act(async () => {})
+  fake.query = 'Tab Order'
+  await act(async () => view.rerender(<GeneralPane {...props} />))
+  fake.query = 'update'
+  await act(async () => view.rerender(<GeneralPane {...props} />))
+  expect(screen.getByText('Current version: 1.4.100')).toBeTruthy()
+  await act(async () => resolveOld?.('1.0.0'))
+  expect(screen.getByText('Current version: 1.4.100')).toBeTruthy()
+  expect(screen.queryByText('Current version: 1.0.0')).toBeNull()
+})
diff --git a/src/renderer/src/components/settings/GeneralPane.tsx b/src/renderer/src/components/settings/GeneralPane.tsx
index 981e5d530e94..e9b9fc4bc30b 100644
--- a/src/renderer/src/components/settings/GeneralPane.tsx
+++ b/src/renderer/src/components/settings/GeneralPane.tsx
@@ -1,7 +1,6 @@
 import type React from 'react'
 import type { GlobalSettings } from '../../../../shared/global-settings-types'
 import { useAppStore } from '../../store'
-import { Separator } from '../ui/separator'
 import { CliSection } from './CliSection'
 import { GeneralEditorSettingsSection } from './GeneralEditorSettingsSection'
 import { GeneralSupportSection } from './GeneralSupportSection'
@@ -18,6 +17,7 @@ import {
 } from './general-search'
 import { getGeneralProjectRuntimeSearchEntries } from './general-project-runtime-search'
 import { RecentTabOrderControl } from './RecentTabOrderControl'
+import { SettingsSectionStack } from './SettingsSectionStack'
 import { matchesSettingsSearch, type SettingsSearchEntry } from './settings-search'
 import { SearchableSetting } from './SearchableSetting'
 import { SettingsSubsectionHeader, SettingsSwitchRow } from './SettingsFormControls'
@@ -279,18 +279,15 @@ export function GeneralPane({
     // its own loading placeholder and its own collapsing Separator. Without
     // that separation, a dangling divider would remain above the collapsed
     // section.
-  ].filter(Boolean)
+  ]
 
   return (
     <div className="space-y-6">
-      {visibleSections.map((section, index) => (
-        <div key={index} className="space-y-6">
-          {index > 0 ? <Separator /> : null}
-          {section}
-        </div>
-      ))}
+      <SettingsSectionStack sections={visibleSections} spacing="section" />
       {matchesSettingsSearch(searchQuery, getGeneralSupportSearchEntries()) ? (
-        <GeneralSupportSection hasPrecedingSections={visibleSections.length > 0} />
+        <GeneralSupportSection
+          hasPrecedingSections={visibleSections.some((section) => section !== null)}
+        />
       ) : null}
     </div>
   )
diff --git a/src/renderer/src/components/settings/GlobalWorktreeVisibilitySourcesSetting.tsx b/src/renderer/src/components/settings/GlobalWorktreeVisibilitySourcesSetting.tsx
index 1cf9a026cd97..b660b25a3f3e 100644
--- a/src/renderer/src/components/settings/GlobalWorktreeVisibilitySourcesSetting.tsx
+++ b/src/renderer/src/components/settings/GlobalWorktreeVisibilitySourcesSetting.tsx
@@ -17,6 +17,7 @@ import WorktreeVisibilitySourceList, {
   type WorktreeVisibilitySourceRow
 } from '../sidebar/WorktreeVisibilitySourceList'
 import { translate } from '@/i18n/i18n'
+import { createBrowserUuid } from '@/lib/browser-uuid'
 
 type Props = {
   settings: GlobalSettings
@@ -105,7 +106,7 @@ export function GlobalWorktreeVisibilitySourcesSetting({
       if (customSources.length >= MAX_CUSTOM_WORKTREE_VISIBILITY_SOURCES) {
         return 'limit'
       }
-      const id = crypto.randomUUID().replaceAll('-', '')
+      const id = createBrowserUuid().replaceAll('-', '')
       const candidate = normalizeCustomWorktreeVisibilitySources([{ id, rootPath }])?.[0]
       if (!candidate) {
         return 'invalid-path'
diff --git a/src/renderer/src/components/settings/OpenInMenuSetting.tsx b/src/renderer/src/components/settings/OpenInMenuSetting.tsx
index aa18ec951f15..33db6a1b4bc8 100644
--- a/src/renderer/src/components/settings/OpenInMenuSetting.tsx
+++ b/src/renderer/src/components/settings/OpenInMenuSetting.tsx
@@ -23,6 +23,7 @@ import {
   type OpenInAppPreset
 } from '@/lib/open-in-app-catalog'
 import { translate } from '@/i18n/i18n'
+import { createBrowserUuid } from '@/lib/browser-uuid'
 
 type OpenInMenuSettingProps = {
   applications: OpenInApplication[] | undefined
@@ -36,9 +37,7 @@ type OpenInApplicationsDraftState = {
 
 function createOpenInApplication(): OpenInApplication {
   return {
-    id:
-      globalThis.crypto?.randomUUID?.() ??
-      `open-in-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}`,
+    id: createBrowserUuid(),
     label: '',
     command: ''
   }
diff --git a/src/renderer/src/components/settings/SessionHistorySettingsPane.test.tsx b/src/renderer/src/components/settings/SessionHistorySettingsPane.test.tsx
index 909b2839b116..b147f98e3182 100644
--- a/src/renderer/src/components/settings/SessionHistorySettingsPane.test.tsx
+++ b/src/renderer/src/components/settings/SessionHistorySettingsPane.test.tsx
@@ -23,7 +23,8 @@ const mocks = vi.hoisted(() => {
     environments,
     details,
     closeSettingsPage: vi.fn(),
-    showAiVaultSearch: vi.fn()
+    showAiVaultSearch: vi.fn(),
+    markFeatureTipsSeen: vi.fn()
   }
 })
 vi.mock('./use-runtime-environment-catalog', () => ({
@@ -42,7 +43,8 @@ vi.mock('@/store', () => ({
       openSettingsPage: vi.fn(),
       openSettingsTarget: vi.fn(),
       closeSettingsPage: mocks.closeSettingsPage,
-      showAiVaultSearch: mocks.showAiVaultSearch
+      showAiVaultSearch: mocks.showAiVaultSearch,
+      markFeatureTipsSeen: mocks.markFeatureTipsSeen
     })
 }))
 vi.mock('@/lib/web-client-location', () => ({ isWebClientLocation: () => mocks.web }))
@@ -169,6 +171,7 @@ it('turns search on from the switch alone, touching no transcript while it is of
   })
   expect(confirm).not.toHaveBeenCalled()
   expect(save).toHaveBeenCalledWith({ aiVaultSearch: { enabled: true, historyDays: null } })
+  expect(mocks.markFeatureTipsSeen).toHaveBeenCalledWith(['agent-session-search'])
 })
 
 it('sends the user to the sidebar panel with one click', async () => {
@@ -190,6 +193,7 @@ it('turns search off from the switch alone', async () => {
   })
   expect(confirm).not.toHaveBeenCalled()
   expect(save).toHaveBeenCalledWith({ aiVaultSearch: { enabled: false, historyDays: null } })
+  expect(mocks.markFeatureTipsSeen).toHaveBeenCalledWith(['agent-session-search'])
 })
 
 it('keeps the stored retention window without offering a control for it', async () => {
diff --git a/src/renderer/src/components/settings/SessionHistorySettingsPane.tsx b/src/renderer/src/components/settings/SessionHistorySettingsPane.tsx
index cee4abc22c03..943db1265133 100644
--- a/src/renderer/src/components/settings/SessionHistorySettingsPane.tsx
+++ b/src/renderer/src/components/settings/SessionHistorySettingsPane.tsx
@@ -45,6 +45,7 @@ export function SessionHistorySettingsPane({
   const isWebClient = isWebClientLocation()
   const closeSettingsPage = useAppStore((state) => state.closeSettingsPage)
   const showAiVaultSearch = useAppStore((state) => state.showAiVaultSearch)
+  const markFeatureTipsSeen = useAppStore((state) => state.markFeatureTipsSeen)
   const [busy, setBusy] = useState(false)
   const [error, setError] = useState<string | null>(null)
   const [refresh, setRefresh] = useState(0)
@@ -91,6 +92,10 @@ export function SessionHistorySettingsPane({
   )
 
   function writePolicy(updates: Partial<typeof policy>): Promise<void> {
+    if (updates.enabled !== undefined) {
+      // Why: switching search proves the user found it; turning it off later must not re-offer the tip.
+      markFeatureTipsSeen(['agent-session-search'])
+    }
     return updateSettings({
       aiVaultSearch: AiVaultSearchSettingsSchema.parse({ ...policy, ...updates })
     })
diff --git a/src/renderer/src/components/settings/SettingsSectionStack.tsx b/src/renderer/src/components/settings/SettingsSectionStack.tsx
new file mode 100644
index 000000000000..c243980eafa0
--- /dev/null
+++ b/src/renderer/src/components/settings/SettingsSectionStack.tsx
@@ -0,0 +1,27 @@
+import type { ReactElement } from 'react'
+import { Separator } from '../ui/separator'
+
+// Why: settings panes rebuild their section list from the search query, so a pane-local
+// `key={index}` re-binds every key when an earlier section drops out. React then tears down
+// and remounts each surviving section, discarding its unsaved drafts and re-issuing its
+// loads once per keystroke. Keying by the section's own element key keeps a section that
+// stays matched mounted for the whole search.
+export function SettingsSectionStack({
+  sections,
+  spacing
+}: {
+  sections: readonly (ReactElement | null)[]
+  spacing: 'section' | 'group'
+}): ReactElement {
+  const visibleSections = sections.filter((section): section is ReactElement => section !== null)
+  return (
+    <>
+      {visibleSections.map((section, index) => (
+        <div key={section.key} className={spacing === 'group' ? 'space-y-8' : 'space-y-6'}>
+          {index > 0 ? <Separator /> : null}
+          {section}
+        </div>
+      ))}
+    </>
+  )
+}
diff --git a/src/renderer/src/components/settings/SshPassphraseDialog.tsx b/src/renderer/src/components/settings/SshPassphraseDialog.tsx
index 7f9e2ff61c31..922e795fe28b 100644
--- a/src/renderer/src/components/settings/SshPassphraseDialog.tsx
+++ b/src/renderer/src/components/settings/SshPassphraseDialog.tsx
@@ -61,7 +61,10 @@ export function SshPassphraseDialog(): React.JSX.Element | null {
   )
 
   const handleSubmit = useCallback(async () => {
-    if (!request || !value) {
+    // Why: keyboard-interactive servers may accept an empty response (e.g.
+    // plain Enter to trigger a default MFA push); passwords and passphrases
+    // are never empty.
+    if (!request || (!value && request.kind !== 'keyboard-interactive')) {
       return
     }
     setSubmitting(true)
@@ -186,7 +189,7 @@ export function SshPassphraseDialog(): React.JSX.Element | null {
           <Input
             id="ssh-credential-input"
             ref={setInputRef}
-            type="password"
+            type={isKeyboardInteractive && request.echo ? 'text' : 'password'}
             value={value}
             onChange={(e) => setValue(e.target.value)}
             onKeyDown={(e) => {
@@ -224,7 +227,11 @@ export function SshPassphraseDialog(): React.JSX.Element | null {
           >
             {translate('auto.components.settings.SshPassphraseDialog.d5a234456f', 'Cancel')}
           </Button>
-          <Button size="sm" onClick={() => void handleSubmit()} disabled={!value || submitting}>
+          <Button
+            size="sm"
+            onClick={() => void handleSubmit()}
+            disabled={(!value && !isKeyboardInteractive) || submitting}
+          >
             {isKeyboardInteractive
               ? translate('auto.components.settings.SshPassphraseDialog.c624f64b86', 'Continue')
               : isPassword
diff --git a/src/renderer/src/components/settings/accounts-search.ts b/src/renderer/src/components/settings/accounts-search.ts
index 856e22213caf..60fa795caa99 100644
--- a/src/renderer/src/components/settings/accounts-search.ts
+++ b/src/renderer/src/components/settings/accounts-search.ts
@@ -217,6 +217,38 @@ export const getAccountsGrokSearchEntries = createLocalizedCatalog(() => [
   }
 ])
 
+export const getAccountsCursorSearchEntries = createLocalizedCatalog(() => [
+  {
+    title: translate('auto.components.settings.accounts.search.cursor.title', 'Cursor Usage'),
+    description: translate(
+      'auto.components.settings.accounts.search.cursor.description',
+      'Monthly plan usage read from the Cursor sign-in already on this computer (cursor-agent login).'
+    ),
+    keywords: [
+      ...translateSearchKeyword(
+        'auto.components.settings.accounts.search.cursor.kw.cursor',
+        'cursor'
+      ),
+      ...translateSearchKeyword(
+        'auto.components.settings.accounts.search.cursor.kw.usage',
+        'usage'
+      ),
+      ...translateSearchKeyword(
+        'auto.components.settings.accounts.search.cursor.kw.spend',
+        'spend'
+      ),
+      ...translateSearchKeyword(
+        'auto.components.settings.accounts.search.cursor.kw.rateLimit',
+        'rate limit'
+      ),
+      ...translateSearchKeyword(
+        'auto.components.settings.accounts.search.cursor.kw.statusBar',
+        'status bar'
+      )
+    ]
+  }
+])
+
 export const getAccountsPaneSearchEntries = createLocalizedCatalog((): SettingsSearchEntry[] => [
   ...getAccountsLocationSearchEntries(),
   ...getAccountsClaudeSearchEntries(),
@@ -224,5 +256,6 @@ export const getAccountsPaneSearchEntries = createLocalizedCatalog((): SettingsS
   ...getAccountsGeminiSearchEntries(),
   ...getAccountsOpencodeSearchEntries(),
   ...getAccountsMiniMaxSearchEntries(),
-  ...getAccountsGrokSearchEntries()
+  ...getAccountsGrokSearchEntries(),
+  ...getAccountsCursorSearchEntries()
 ])
diff --git a/src/renderer/src/components/settings/appearance-status-bar-cursor-toggle-search.ts b/src/renderer/src/components/settings/appearance-status-bar-cursor-toggle-search.ts
new file mode 100644
index 000000000000..efff55c67f62
--- /dev/null
+++ b/src/renderer/src/components/settings/appearance-status-bar-cursor-toggle-search.ts
@@ -0,0 +1,39 @@
+import type { StatusBarItem } from '../../../../shared/ui-chrome-types'
+import { translate } from '@/i18n/i18n'
+import { translateSearchKeyword } from './settings-search-keywords'
+
+export function getCursorStatusBarToggleSearchEntry(): {
+  id: StatusBarItem
+  title: string
+  description: string
+  keywords: string[]
+  toggleDescription: string
+} {
+  return {
+    id: 'cursor',
+    title: translate('auto.components.settings.appearance.search.cursor.title', 'Cursor Usage'),
+    description: translate(
+      'auto.components.settings.appearance.search.cursor.description',
+      'Show monthly Cursor plan usage from the Cursor sign-in on this computer.'
+    ),
+    keywords: [
+      ...translateSearchKeyword(
+        'auto.components.settings.appearance.search.896eb53fd4',
+        'status bar'
+      ),
+      ...translateSearchKeyword(
+        'auto.components.settings.appearance.search.cursor.kw.cursor',
+        'cursor'
+      ),
+      ...translateSearchKeyword('auto.components.settings.appearance.search.00a028f25f', 'usage'),
+      ...translateSearchKeyword(
+        'auto.components.settings.appearance.search.de586def95',
+        'subscription'
+      )
+    ],
+    toggleDescription: translate(
+      'settings.appearance.statusBar.cursorToggleDescription',
+      'Show Cursor plan usage when signed in through cursor-agent or Cursor IDE.'
+    )
+  }
+}
diff --git a/src/renderer/src/components/settings/appearance-status-bar-minimax-toggle-search.ts b/src/renderer/src/components/settings/appearance-status-bar-minimax-toggle-search.ts
new file mode 100644
index 000000000000..4b514acd2eb8
--- /dev/null
+++ b/src/renderer/src/components/settings/appearance-status-bar-minimax-toggle-search.ts
@@ -0,0 +1,41 @@
+import type { StatusBarItem } from '../../../../shared/ui-chrome-types'
+import { translate } from '@/i18n/i18n'
+import { translateSearchKeyword } from './settings-search-keywords'
+
+export function getMiniMaxStatusBarToggleSearchEntry(): {
+  id: StatusBarItem
+  title: string
+  description: string
+  keywords: string[]
+  toggleDescription: string
+} {
+  return {
+    id: 'minimax',
+    title: translate('auto.components.settings.appearance.search.0f08f6b483', 'MiniMax Usage'),
+    description: translate(
+      'auto.components.settings.appearance.search.e46178eb1b',
+      'Show MiniMax subscription usage in the status bar.'
+    ),
+    keywords: [
+      ...translateSearchKeyword(
+        'auto.components.settings.appearance.search.896eb53fd4',
+        'status bar'
+      ),
+      ...translateSearchKeyword('auto.components.settings.appearance.search.d16378a88f', 'minimax'),
+      ...translateSearchKeyword('auto.components.settings.appearance.search.00a028f25f', 'usage'),
+      ...translateSearchKeyword(
+        'auto.components.settings.appearance.search.de586def95',
+        'subscription'
+      ),
+      ...translateSearchKeyword('auto.components.settings.appearance.search.d9e7cef86f', 'cookie'),
+      ...translateSearchKeyword(
+        'auto.components.settings.appearance.search.25e51b62ee',
+        'rate limit'
+      )
+    ],
+    toggleDescription: translate(
+      'settings.appearance.statusBar.minimaxToggleDescription',
+      'Show MiniMax subscription usage for the active workspace.'
+    )
+  }
+}
diff --git a/src/renderer/src/components/settings/appearance-status-bar-search.test.ts b/src/renderer/src/components/settings/appearance-status-bar-search.test.ts
index 3518bcba8aac..bc8596d564d3 100644
--- a/src/renderer/src/components/settings/appearance-status-bar-search.test.ts
+++ b/src/renderer/src/components/settings/appearance-status-bar-search.test.ts
@@ -31,6 +31,16 @@ describe('getStatusBarToggles', () => {
     )
   })
 
+  it('includes ZCode quota in Appearance search', () => {
+    const toggle = getStatusBarToggles().find((entry) => entry.id === 'zcode')
+
+    expect(toggle).toMatchObject({
+      title: 'ZCode Usage',
+      toggleDescription: 'Show ZCode Coding Plan quota usage.'
+    })
+    expect(toggle?.keywords).toEqual(expect.arrayContaining(['zcode', 'zai', 'glm']))
+  })
+
   it('includes MiniMax usage so Appearance can toggle the default-on status item', () => {
     const miniMaxToggle = getStatusBarToggles().find((entry) => entry.id === 'minimax')
 
diff --git a/src/renderer/src/components/settings/appearance-status-bar-search.ts b/src/renderer/src/components/settings/appearance-status-bar-search.ts
index 9be73da6a912..16749f4ab311 100644
--- a/src/renderer/src/components/settings/appearance-status-bar-search.ts
+++ b/src/renderer/src/components/settings/appearance-status-bar-search.ts
@@ -3,7 +3,10 @@ import { createLocalizedCatalog } from '@/i18n/localized-catalog'
 import { translate } from '@/i18n/i18n'
 import { translateSearchKeyword } from './settings-search-keywords'
 import { getAntigravityStatusBarToggleSearchEntry } from './appearance-status-bar-antigravity-toggle-search'
+import { getMiniMaxStatusBarToggleSearchEntry } from './appearance-status-bar-minimax-toggle-search'
 import { getGrokStatusBarToggleSearchEntry } from './appearance-status-bar-grok-toggle-search'
+import { getCursorStatusBarToggleSearchEntry } from './appearance-status-bar-cursor-toggle-search'
+import { getZcodeStatusBarToggleSearchEntry } from './appearance-status-bar-zcode-toggle-search'
 
 export const getStatusBarToggles = createLocalizedCatalog(
   (): readonly {
@@ -164,42 +167,10 @@ export const getStatusBarToggles = createLocalizedCatalog(
         'Show Kimi subscription usage for the active workspace.'
       )
     },
-    {
-      id: 'minimax',
-      title: translate('auto.components.settings.appearance.search.0f08f6b483', 'MiniMax Usage'),
-      description: translate(
-        'auto.components.settings.appearance.search.e46178eb1b',
-        'Show MiniMax subscription usage in the status bar.'
-      ),
-      keywords: [
-        ...translateSearchKeyword(
-          'auto.components.settings.appearance.search.896eb53fd4',
-          'status bar'
-        ),
-        ...translateSearchKeyword(
-          'auto.components.settings.appearance.search.d16378a88f',
-          'minimax'
-        ),
-        ...translateSearchKeyword('auto.components.settings.appearance.search.00a028f25f', 'usage'),
-        ...translateSearchKeyword(
-          'auto.components.settings.appearance.search.de586def95',
-          'subscription'
-        ),
-        ...translateSearchKeyword(
-          'auto.components.settings.appearance.search.d9e7cef86f',
-          'cookie'
-        ),
-        ...translateSearchKeyword(
-          'auto.components.settings.appearance.search.25e51b62ee',
-          'rate limit'
-        )
-      ],
-      toggleDescription: translate(
-        'settings.appearance.statusBar.minimaxToggleDescription',
-        'Show MiniMax subscription usage for the active workspace.'
-      )
-    },
+    getMiniMaxStatusBarToggleSearchEntry(),
     getGrokStatusBarToggleSearchEntry(),
+    getCursorStatusBarToggleSearchEntry(),
+    getZcodeStatusBarToggleSearchEntry(),
     {
       id: 'ssh',
       title: translate('auto.components.settings.appearance.search.57fb424c56', 'Remote Hosts'),
diff --git a/src/renderer/src/components/settings/appearance-status-bar-zcode-toggle-search.ts b/src/renderer/src/components/settings/appearance-status-bar-zcode-toggle-search.ts
new file mode 100644
index 000000000000..1d618a65dc39
--- /dev/null
+++ b/src/renderer/src/components/settings/appearance-status-bar-zcode-toggle-search.ts
@@ -0,0 +1,34 @@
+import type { StatusBarItem } from '../../../../shared/ui-chrome-types'
+import { translate } from '@/i18n/i18n'
+import { translateSearchKeyword } from './settings-search-keywords'
+
+export function getZcodeStatusBarToggleSearchEntry(): {
+  id: StatusBarItem
+  title: string
+  description: string
+  keywords: string[]
+  toggleDescription: string
+} {
+  return {
+    id: 'zcode',
+    title: translate('auto.components.settings.appearance.search.zcodeUsageTitle', 'ZCode Usage'),
+    description: translate(
+      'auto.components.settings.appearance.search.zcodeUsageDescription',
+      'Show ZCode Coding Plan quota usage in the status bar.'
+    ),
+    keywords: [
+      ...translateSearchKeyword(
+        'auto.components.settings.appearance.search.896eb53fd4',
+        'status bar'
+      ),
+      ...translateSearchKeyword('auto.components.settings.appearance.search.zcode', 'zcode'),
+      ...translateSearchKeyword('auto.components.settings.appearance.search.00a028f25f', 'usage'),
+      ...translateSearchKeyword('auto.components.settings.appearance.search.zai', 'zai'),
+      ...translateSearchKeyword('auto.components.settings.appearance.search.glm', 'glm')
+    ],
+    toggleDescription: translate(
+      'settings.appearance.statusBar.zcodeToggleDescription',
+      'Show ZCode Coding Plan quota usage.'
+    )
+  }
+}
diff --git a/src/renderer/src/components/settings/session-history-status-copy.test.ts b/src/renderer/src/components/settings/session-history-status-copy.test.ts
new file mode 100644
index 000000000000..e750f3eeaf3f
--- /dev/null
+++ b/src/renderer/src/components/settings/session-history-status-copy.test.ts
@@ -0,0 +1,43 @@
+import { describe, expect, it } from 'vitest'
+import type { AiVaultSearchStatus } from '../../../../shared/ai-vault-search-types'
+import { unavailableSessionSearchStatus } from '../../../../shared/ai-vault-search-client'
+import { isSessionSearchIndexReady } from './session-history-status-copy'
+
+function status(overrides: Partial<AiVaultSearchStatus>): AiVaultSearchStatus {
+  return { ...unavailableSessionSearchStatus(), enabled: true, ...overrides }
+}
+
+describe('isSessionSearchIndexReady', () => {
+  it('is ready once a whole sweep finished with nothing due', () => {
+    expect(isSessionSearchIndexReady(status({ phase: 'current', lastSweepCompletedAt: 1 }))).toBe(
+      true
+    )
+  })
+
+  it('counts a finished sweep with unreadable files as ready', () => {
+    expect(
+      isSessionSearchIndexReady(
+        status({ phase: 'degraded', filesFailed: 2, filesDue: 0, lastSweepCompletedAt: 1 })
+      )
+    ).toBe(true)
+  })
+
+  it('is not ready before the first sweep finishes', () => {
+    expect(isSessionSearchIndexReady(null)).toBe(false)
+    expect(isSessionSearchIndexReady(status({ phase: 'idle' }))).toBe(false)
+    expect(isSessionSearchIndexReady(status({ phase: 'indexing', filesDue: 40 }))).toBe(false)
+    // A degraded pass that has not completed a sweep yet is still building.
+    expect(isSessionSearchIndexReady(status({ phase: 'degraded', filesFailed: 1 }))).toBe(false)
+    expect(
+      isSessionSearchIndexReady(status({ phase: 'degraded', filesDue: 3, lastSweepCompletedAt: 1 }))
+    ).toBe(false)
+  })
+
+  it('is not ready while search is off', () => {
+    expect(
+      isSessionSearchIndexReady(
+        status({ enabled: false, phase: 'current', lastSweepCompletedAt: 1 })
+      )
+    ).toBe(false)
+  })
+})
diff --git a/src/renderer/src/components/settings/session-history-status-copy.ts b/src/renderer/src/components/settings/session-history-status-copy.ts
index 3d4790f8d7be..da51bb9f6710 100644
--- a/src/renderer/src/components/settings/session-history-status-copy.ts
+++ b/src/renderer/src/components/settings/session-history-status-copy.ts
@@ -13,6 +13,14 @@ export function isSweepingSessionSearch(status: AiVaultSearchStatus | null): boo
   return status.phase === 'indexing' || (status.phase === 'degraded' && status.filesDue > 0)
 }
 
+/** A whole sweep has finished with nothing left due; failures alone do not hold readiness back. */
+export function isSessionSearchIndexReady(status: AiVaultSearchStatus | null): boolean {
+  if (!status?.enabled || status.lastSweepCompletedAt === null || status.filesDue > 0) {
+    return false
+  }
+  return status.phase === 'current' || status.phase === 'degraded'
+}
+
 export function sessionSearchPollIntervalMs(status: AiVaultSearchStatus | null): number {
   return isSweepingSessionSearch(status)
     ? SESSION_SEARCH_SWEEPING_POLL_MS
diff --git a/src/renderer/src/components/settings/worktree-symlink-path-filter.scan-budget.test.ts b/src/renderer/src/components/settings/worktree-symlink-path-filter.scan-budget.test.ts
new file mode 100644
index 000000000000..cde893fca59f
--- /dev/null
+++ b/src/renderer/src/components/settings/worktree-symlink-path-filter.scan-budget.test.ts
@@ -0,0 +1,115 @@
+import { expect, it } from 'vitest'
+import {
+  getWorktreeSymlinkPathFilterState,
+  WORKTREE_SYMLINK_PATH_MAX_SUGGESTIONS
+} from './worktree-symlink-path-filter'
+
+it.each([100, 1_000, 50_000])('bounds matching name reads across %i entries', (size) => {
+  let nameReads = 0
+  const suggestions = Array.from({ length: size }, (_, index) => ({
+    get name() {
+      nameReads++
+      return `package-${index}`
+    },
+    isDirectory: true
+  }))
+  const result = getWorktreeSymlinkPathFilterState({
+    query: 'package',
+    suggestions,
+    existingPaths: []
+  })
+  expect(result.filtered).toHaveLength(WORKTREE_SYMLINK_PATH_MAX_SUGGESTIONS)
+  expect(nameReads).toBe(WORKTREE_SYMLINK_PATH_MAX_SUGGESTIONS * 2)
+  expect(result.filtered[0]).toBe(suggestions[0])
+  expect(result.filtered.at(-1)).toBe(suggestions[49])
+  expect(result.showLiteralItem).toBe(true)
+})
+
+it('keeps the stock filter and slice results, identities and literal choice', () => {
+  const suggestions = Array.from({ length: 120 }, (_, index) => ({
+    name: index % 3 === 0 ? `PACKAGE-${index}` : `other-${index}`,
+    isDirectory: index % 2 === 0
+  }))
+  const limits = [0, 1, 5, 50, 500, -1, -5, 2.8, Number.NaN, Infinity, -Infinity]
+  for (const query of ['', '  /package ', 'OTHER', 'PACKAGE-3', 'missing']) {
+    const queryTrimmed = query.trim().replace(/^\/+/, '')
+    const normalizedQuery = queryTrimmed.toLowerCase()
+    for (const maxSuggestions of limits) {
+      const filtered = (
+        normalizedQuery
+          ? suggestions.filter((entry) => entry.name.toLowerCase().includes(normalizedQuery))
+          : suggestions
+      ).slice(0, maxSuggestions)
+      const result = getWorktreeSymlinkPathFilterState({
+        query,
+        suggestions,
+        existingPaths: ['missing'],
+        maxSuggestions
+      })
+      expect(result).toEqual({
+        queryTrimmed,
+        filtered,
+        showLiteralItem:
+          queryTrimmed.length > 0 &&
+          !filtered.some((entry) => entry.name === queryTrimmed) &&
+          queryTrimmed !== 'missing',
+        isQueryTooLarge: false
+      })
+      expect(result.filtered.every((entry, index) => entry === filtered[index])).toBe(true)
+    }
+  }
+})
+
+it('searches past nonmatches and preserves sparse-array filtering', () => {
+  const suggestions = Array.from({ length: 1_000 }, (_, index) => ({
+    name: index % 30 === 0 ? `target-${index}` : `other-${index}`,
+    isDirectory: true
+  }))
+  delete suggestions[0]
+  const result = getWorktreeSymlinkPathFilterState({
+    query: 'target',
+    suggestions,
+    existingPaths: [],
+    maxSuggestions: 5
+  })
+  expect(result.filtered).toEqual(
+    suggestions.filter((entry) => entry.name.includes('target')).slice(0, 5)
+  )
+  expect(result.filtered.map((entry) => entry.name)).toEqual([
+    'target-30',
+    'target-60',
+    'target-90',
+    'target-120',
+    'target-150'
+  ])
+})
+
+it('does not inspect names when no suggestions can be returned', () => {
+  const result = getWorktreeSymlinkPathFilterState({
+    query: 'target',
+    suggestions: [
+      {
+        get name(): string {
+          throw new Error('a zero result budget must not inspect names')
+        },
+        isDirectory: true
+      }
+    ],
+    existingPaths: [],
+    maxSuggestions: 0
+  })
+  expect(result.filtered).toEqual([])
+  expect(result.showLiteralItem).toBe(true)
+})
+
+it('retains the literal choice when an exact match falls after the visible limit', () => {
+  const suggestions = Array.from({ length: 50 }, (_, index) => ({
+    name: `target-${index}`,
+    isDirectory: true
+  }))
+  suggestions.push({ name: 'target', isDirectory: true })
+  expect(
+    getWorktreeSymlinkPathFilterState({ query: 'target', suggestions, existingPaths: [] })
+      .showLiteralItem
+  ).toBe(true)
+})
diff --git a/src/renderer/src/components/settings/worktree-symlink-path-filter.ts b/src/renderer/src/components/settings/worktree-symlink-path-filter.ts
index 1dc8d393d8db..f50a2f99cd1e 100644
--- a/src/renderer/src/components/settings/worktree-symlink-path-filter.ts
+++ b/src/renderer/src/components/settings/worktree-symlink-path-filter.ts
@@ -44,11 +44,26 @@ export function getWorktreeSymlinkPathFilterState<T extends WorktreeSymlinkPathS
   }
 
   const normalizedQuery = queryTrimmed.toLowerCase()
-  const filtered = (
-    normalizedQuery
-      ? suggestions.filter((entry) => entry.name.toLowerCase().includes(normalizedQuery))
-      : suggestions
-  ).slice(0, maxSuggestions)
+  let filtered: T[]
+  if (normalizedQuery && Number.isInteger(maxSuggestions) && maxSuggestions >= 0) {
+    filtered = []
+    for (let index = 0; index < suggestions.length && filtered.length < maxSuggestions; index++) {
+      if (!(index in suggestions)) {
+        continue
+      }
+      const entry = suggestions[index]
+      if (entry.name.toLowerCase().includes(normalizedQuery)) {
+        filtered.push(entry)
+      }
+    }
+  } else {
+    // Preserve slice semantics for empty queries and unusual caller-supplied limits.
+    filtered = (
+      normalizedQuery
+        ? suggestions.filter((entry) => entry.name.toLowerCase().includes(normalizedQuery))
+        : suggestions
+    ).slice(0, maxSuggestions)
+  }
   const hasExactMatch = filtered.some((entry) => entry.name === queryTrimmed)
 
   return {
diff --git a/src/renderer/src/components/sidebar/StatusIndicator.tsx b/src/renderer/src/components/sidebar/StatusIndicator.tsx
index fdce0b62f83b..10f65234c6f8 100644
--- a/src/renderer/src/components/sidebar/StatusIndicator.tsx
+++ b/src/renderer/src/components/sidebar/StatusIndicator.tsx
@@ -25,6 +25,7 @@ const AGENT_STATUS_TOOLTIP_STATUSES = new Set<Status>([
   'working',
   'monitoring',
   'permission',
+  'failed',
   'interrupted',
   'done'
 ])
@@ -58,7 +59,7 @@ const StatusIndicator = React.memo(function StatusIndicator({
         <Activity className="size-3 text-yellow-500" aria-hidden="true" />
       </span>
     )
-  } else if (status === 'interrupted') {
+  } else if (status === 'failed' || status === 'interrupted') {
     indicator = (
       <span
         className={cn('inline-flex h-3 w-3 shrink-0 items-center justify-center', className)}
diff --git a/src/renderer/src/components/sidebar/WorktreeCardAgents.acknowledgement-emphasis.test.tsx b/src/renderer/src/components/sidebar/WorktreeCardAgents.acknowledgement-emphasis.test.tsx
new file mode 100644
index 000000000000..1459e7f1bb30
--- /dev/null
+++ b/src/renderer/src/components/sidebar/WorktreeCardAgents.acknowledgement-emphasis.test.tsx
@@ -0,0 +1,179 @@
+// @vitest-environment happy-dom
+
+import { renderToStaticMarkup } from 'react-dom/server'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type { DashboardAgentRow } from '@/components/dashboard/useDashboardData'
+import { TooltipProvider } from '@/components/ui/tooltip'
+import { makePaneKey } from '../../../../shared/stable-pane-id'
+import {
+  clearWorktreeAgentExpansionStateForTests,
+  seedWorktreeAgentExpansionStateForTests
+} from './worktree-card-agents-expansion-state'
+import WorktreeCardAgents from './WorktreeCardAgents'
+
+const WORKSPACE = 'acknowledgement-workspace'
+const PANE_A = makePaneKey('tab-a', '11111111-1111-4111-8111-111111111111')
+const PANE_B = makePaneKey('tab-b', '22222222-2222-4222-8222-222222222222')
+let acknowledgements: Record<string, number> = {}
+let focusedPaneKey: string | null = null
+
+vi.mock('@/store', () => ({
+  useAppStore: (selector: (state: unknown) => unknown) =>
+    selector({
+      agentActivityDisplayMode: 'compact',
+      acknowledgedAgentsByPaneKey: acknowledgements,
+      agentSendPopoverTargetMode: null,
+      dropAgentStatus: vi.fn(),
+      dismissRetainedAgent: vi.fn(),
+      sendPromptToSidebarAgentTarget: vi.fn()
+    })
+}))
+vi.mock('./useWorktreeAgentRows', () => ({ useWorktreeAgentRows: () => [] }))
+vi.mock('@/lib/worktree-activation', () => ({ activateAndRevealWorktree: vi.fn() }))
+vi.mock('@/lib/activate-tab-and-focus-pane', () => ({ activateTabAndFocusPane: vi.fn() }))
+vi.mock('@/hooks/use-now', () => ({ useNow: () => 5000 }))
+vi.mock('./focused-agent-row-highlight', () => ({
+  useFocusedAgentPaneKey: () => focusedPaneKey
+}))
+vi.mock('@/components/dashboard/use-agent-row-conversation-name', () => ({
+  useAgentRowConversationName: () => null
+}))
+vi.mock('./CacheTimer', () => ({
+  default: () => null,
+  usePromptCacheCountdownForPane: () => null
+}))
+
+function agentRow(
+  paneKey: string,
+  state: DashboardAgentRow['state'] = 'done',
+  entry: Partial<DashboardAgentRow['entry']> = {}
+): DashboardAgentRow {
+  const tabId = paneKey === PANE_A ? 'tab-a' : 'tab-b'
+  return {
+    paneKey,
+    agentType: 'codex',
+    rowSource: 'live',
+    state,
+    startedAt: 1000,
+    tab: {
+      id: tabId,
+      ptyId: null,
+      worktreeId: WORKSPACE,
+      title: tabId,
+      customTitle: null,
+      color: null,
+      sortOrder: 0,
+      createdAt: 1000
+    },
+    entry: {
+      paneKey,
+      worktreeId: WORKSPACE,
+      state: state === 'idle' || state === 'unverifiable' ? 'done' : state,
+      prompt: paneKey === PANE_A ? 'Review agent A' : 'Review agent B',
+      lastAssistantMessage: 'Result details',
+      stateStartedAt: 2000,
+      updatedAt: 2000,
+      stateHistory: [],
+      ...entry
+    }
+  }
+}
+
+function renderLabels(agents: DashboardAgentRow[]): HTMLElement[] {
+  const container = document.createElement('div')
+  container.innerHTML = renderToStaticMarkup(
+    <TooltipProvider>
+      <WorktreeCardAgents worktreeId={WORKSPACE} agents={agents} />
+    </TooltipProvider>
+  )
+  return [
+    ...container.querySelectorAll<HTMLElement>('.compact-agent-row .flex-1 > span:first-child')
+  ]
+}
+
+function expectEmphasis(label: HTMLElement | undefined, unvisited: boolean): void {
+  expect(label).toBeDefined()
+  expect(label?.classList.contains('font-semibold')).toBe(unvisited)
+  expect(label?.classList.contains('font-normal')).toBe(!unvisited)
+  expect(label?.classList.contains('text-foreground')).toBe(unvisited)
+}
+
+beforeEach(() => {
+  acknowledgements = { [PANE_B]: 2000 }
+  focusedPaneKey = null
+  clearWorktreeAgentExpansionStateForTests()
+  seedWorktreeAgentExpansionStateForTests(WORKSPACE, {
+    compactRootListExpanded: true,
+    collapsedLineageParents: new Set()
+  })
+})
+
+describe('compact acknowledgement emphasis through WorktreeCardAgents', () => {
+  it('changes only A when its acknowledgement covers its current turn', () => {
+    const agents = [agentRow(PANE_A), agentRow(PANE_B)]
+    const [aBefore, bBefore] = renderLabels(agents)
+    expectEmphasis(aBefore, true)
+    expectEmphasis(bBefore, false)
+    acknowledgements = { ...acknowledgements, [PANE_A]: 2000 }
+    const [aAfter, bAfter] = renderLabels(agents)
+    expectEmphasis(aAfter, false)
+    expect(bAfter?.outerHTML).toBe(bBefore?.outerHTML)
+  })
+
+  it.each([
+    { ack: undefined, timestamp: 2000, emphasized: true },
+    { ack: 1999, timestamp: 2000, emphasized: true },
+    { ack: 2000, timestamp: 2000, emphasized: false },
+    { ack: 2001, timestamp: 2000, emphasized: false },
+    { ack: undefined, timestamp: 0, emphasized: false }
+  ])('uses ack $ack against timestamp $timestamp', ({ ack, timestamp, emphasized }) => {
+    acknowledgements = ack === undefined ? {} : { [PANE_A]: ack }
+    const [label] = renderLabels([agentRow(PANE_A, 'done', { stateStartedAt: timestamp })])
+    expectEmphasis(label, emphasized)
+  })
+
+  it.each(['working', 'blocked', 'waiting', 'done', 'idle', 'unverifiable'] as const)(
+    'uses the same age rule for %s rows',
+    (state) => {
+      const row = agentRow(PANE_A, state)
+      expectEmphasis(renderLabels([row])[0], true)
+      acknowledgements = { [PANE_A]: 2000 }
+      expectEmphasis(renderLabels([row])[0], false)
+    }
+  )
+
+  it.each([false, true])('preserves focused contrast when unvisited is %s', (unvisited) => {
+    focusedPaneKey = PANE_A
+    acknowledgements = unvisited ? {} : { [PANE_A]: 2000 }
+    const [label] = renderLabels([agentRow(PANE_A)])
+    expect(label?.classList.contains('text-foreground')).toBe(true)
+    expect(label?.classList.contains('font-semibold')).toBe(unvisited)
+    expect(label?.classList.contains('font-normal')).toBe(!unvisited)
+    expect(label?.nextElementSibling?.className).toBe('text-foreground/70')
+  })
+
+  it('emphasizes the monitoring label while preserving prompt ordering', () => {
+    const [label] = renderLabels([agentRow(PANE_A, 'working', { workingMode: 'monitoring' })])
+    expectEmphasis(label, true)
+    expect(label?.textContent).toBe('Monitoring background tasks')
+    expect(label?.nextElementSibling?.textContent).toContain('Review agent A')
+  })
+
+  it('keeps interruption text secondary to the acknowledgement signal', () => {
+    const [label] = renderLabels([agentRow(PANE_A, 'done', { interrupted: true })])
+    expectEmphasis(label, true)
+    expect(label?.nextElementSibling?.textContent).toContain('Interrupted by user')
+  })
+
+  it('does not treat same-state output as a new turn, but admits a newer timestamp', () => {
+    acknowledgements = { [PANE_A]: 2000 }
+    expectEmphasis(renderLabels([agentRow(PANE_A)])[0], false)
+    expectEmphasis(
+      renderLabels([
+        agentRow(PANE_A, 'done', { updatedAt: 3000, lastAssistantMessage: 'More output' })
+      ])[0],
+      false
+    )
+    expectEmphasis(renderLabels([agentRow(PANE_A, 'done', { stateStartedAt: 3000 })])[0], true)
+  })
+})
diff --git a/src/renderer/src/components/sidebar/WorktreeCardAgents.test.tsx b/src/renderer/src/components/sidebar/WorktreeCardAgents.test.tsx
index ffe49ff22e6b..f63d9459572a 100644
--- a/src/renderer/src/components/sidebar/WorktreeCardAgents.test.tsx
+++ b/src/renderer/src/components/sidebar/WorktreeCardAgents.test.tsx
@@ -222,7 +222,7 @@ describe('WorktreeCardAgents', () => {
     expect(markup).not.toContain('data-testid="agent-row"')
   })
 
-  it('dims non-focused compact agent row text', async () => {
+  it('emphasizes unvisited non-focused compact agent row text', async () => {
     mockAgentActivityDisplayMode = 'compact'
     mockAgents = [
       mockAgent({
@@ -236,7 +236,7 @@ describe('WorktreeCardAgents', () => {
 
     const markup = renderToStaticMarkup(<WorktreeCardAgents worktreeId="wt-1" />)
 
-    expect(markup).toContain('<span class="text-muted-foreground/90">Run tests</span>')
+    expect(markup).toContain('<span class="font-semibold text-foreground">Run tests</span>')
     expect(markup).toContain('<span class="text-muted-foreground/65"> - Inspecting changes</span>')
     expect(markup).not.toContain('data-focused-agent-pane="true"')
     expect(markup).not.toContain('<span class="text-foreground">Run tests</span>')
@@ -258,7 +258,7 @@ describe('WorktreeCardAgents', () => {
     const markup = renderToStaticMarkup(<WorktreeCardAgents worktreeId="wt-1" />)
 
     expect(markup).toContain('data-focused-agent-pane="true"')
-    expect(markup).toContain('<span class="text-foreground">Focused prompt</span>')
+    expect(markup).toContain('<span class="font-semibold text-foreground">Focused prompt</span>')
     expect(markup).toContain('<span class="text-foreground/70"> - Reading output</span>')
     expect(markup).not.toContain('<span class="text-muted-foreground/90">Focused prompt</span>')
   })
diff --git a/src/renderer/src/components/sidebar/WorktreeCardAgents.tsx b/src/renderer/src/components/sidebar/WorktreeCardAgents.tsx
index f1ba5cf4d529..42deab4bee3e 100644
--- a/src/renderer/src/components/sidebar/WorktreeCardAgents.tsx
+++ b/src/renderer/src/components/sidebar/WorktreeCardAgents.tsx
@@ -322,6 +322,7 @@ const WorktreeCardAgentsBody = React.memo(function WorktreeCardAgentsBody({
         <CompactAgentRow
           agent={agent}
           now={now}
+          isUnvisited={unvisitedByPaneKey[agent.paneKey] ?? false}
           onActivate={
             agent.rowSource === 'retained' ? handleActivateRetainedAgent : handleActivateAgentTab
           }
diff --git a/src/renderer/src/components/sidebar/WorktreeVisibilityDialog.tsx b/src/renderer/src/components/sidebar/WorktreeVisibilityDialog.tsx
index 3ce9a85d2756..3eadb6ca0d48 100644
--- a/src/renderer/src/components/sidebar/WorktreeVisibilityDialog.tsx
+++ b/src/renderer/src/components/sidebar/WorktreeVisibilityDialog.tsx
@@ -56,6 +56,7 @@ import {
   shouldUseGlobalWorktreeVisibility
 } from './worktree-visibility-use-global'
 import { createWorktreeVisibilitySourceMutation } from './worktree-visibility-source-mutation'
+import { createBrowserUuid } from '@/lib/browser-uuid'
 
 export default function WorktreeVisibilityDialog(): React.JSX.Element | null {
   const activeModal = useAppStore((s) => s.activeModal)
@@ -277,7 +278,7 @@ export default function WorktreeVisibilityDialog(): React.JSX.Element | null {
       if ((existing?.length ?? 0) >= MAX_CUSTOM_WORKTREE_VISIBILITY_SOURCES) {
         return 'limit'
       }
-      const id = crypto.randomUUID().replaceAll('-', '')
+      const id = createBrowserUuid().replaceAll('-', '')
       const candidate = normalizeCustomWorktreeVisibilitySources([{ id, rootPath }])?.[0]
       if (!candidate) {
         return 'invalid-path'
diff --git a/src/renderer/src/components/sidebar/add-repo-skip-finalization.test.ts b/src/renderer/src/components/sidebar/add-repo-skip-finalization.test.ts
index fac6aaa7a242..cafcf2225dae 100644
--- a/src/renderer/src/components/sidebar/add-repo-skip-finalization.test.ts
+++ b/src/renderer/src/components/sidebar/add-repo-skip-finalization.test.ts
@@ -36,6 +36,7 @@ function makeState(overrides: Partial<AddRepoSkipFinalizationState>): AddRepoSki
     hideDefaultBranchWorkspace: false,
     showSleepingWorkspaces: true,
     alwaysShowDefaultBranchWorkspace: true,
+    repos: [],
     worktreesByRepo: {},
     setActiveRepo: vi.fn(),
     setFilterRepoIds: vi.fn(),
@@ -94,6 +95,69 @@ describe('finalizeImportedRepoAfterSkip', () => {
     expect(state.setHideDefaultBranchWorkspace).toHaveBeenCalledWith(false)
   })
 
+  it('clears default-branch hiding for a folder project whose only row is its root', () => {
+    const state = makeState({
+      hideDefaultBranchWorkspace: true,
+      repos: [{ id: 'folder-new', kind: 'folder' }],
+      worktreesByRepo: {
+        'folder-new': [
+          makeWorktree({
+            id: 'folder-new::/notes',
+            repoId: 'folder-new',
+            isMainWorktree: true,
+            head: '',
+            branch: ''
+          })
+        ]
+      }
+    })
+
+    finalizeImportedRepoAfterSkip(state, 'folder-new')
+
+    expect(state.setHideDefaultBranchWorkspace).toHaveBeenCalledWith(false)
+  })
+
+  it.each([false, true])(
+    'ignores archived siblings when revealing a folder root after Skip (root archived: %s)',
+    (rootArchived) => {
+      const state = makeState({
+        hideDefaultBranchWorkspace: true,
+        showSleepingWorkspaces: false,
+        alwaysShowDefaultBranchWorkspace: false,
+        repos: [{ id: 'folder-new', kind: 'folder' }],
+        worktreesByRepo: {
+          'folder-new': [
+            makeWorktree({
+              id: 'folder-new::/notes',
+              repoId: 'folder-new',
+              isMainWorktree: true,
+              head: '',
+              branch: '',
+              isArchived: rootArchived
+            }),
+            makeWorktree({
+              id: 'folder-new::/notes::workspace:archived',
+              repoId: 'folder-new',
+              head: '',
+              branch: '',
+              isArchived: true
+            })
+          ]
+        }
+      })
+
+      finalizeImportedRepoAfterSkip(state, 'folder-new')
+
+      if (rootArchived) {
+        expect(state.setHideDefaultBranchWorkspace).not.toHaveBeenCalled()
+        expect(state.setAlwaysShowDefaultBranchWorkspace).not.toHaveBeenCalled()
+      } else {
+        expect(state.setHideDefaultBranchWorkspace).toHaveBeenCalledWith(false)
+        expect(state.setAlwaysShowDefaultBranchWorkspace).toHaveBeenCalledWith(true)
+      }
+    }
+  )
+
   it('re-enables the default-branch exemption when the import would land asleep and hidden', () => {
     const state = makeState({
       showSleepingWorkspaces: false,
diff --git a/src/renderer/src/components/sidebar/add-repo-skip-finalization.ts b/src/renderer/src/components/sidebar/add-repo-skip-finalization.ts
index a37d14fd8f25..42a7c00b99a4 100644
--- a/src/renderer/src/components/sidebar/add-repo-skip-finalization.ts
+++ b/src/renderer/src/components/sidebar/add-repo-skip-finalization.ts
@@ -1,3 +1,4 @@
+import type { Repo } from '../../../../shared/repo-types'
 import type { Worktree } from '../../../../shared/worktree/types'
 import { isDefaultBranchWorkspace } from './default-branch-workspace'
 import { revealRepoInProjectFilter, type ProjectFilterRevealState } from './project-filter-reveal'
@@ -8,6 +9,7 @@ export type AddRepoSkipFinalizationState = ProjectFilterRevealState & {
   hideDefaultBranchWorkspace: boolean
   showSleepingWorkspaces: boolean
   alwaysShowDefaultBranchWorkspace: boolean
+  repos: readonly Pick<Repo, 'id' | 'kind'>[]
   worktreesByRepo: Record<string, Worktree[]>
   setActiveRepo: (repoId: string | null) => void
   setShowActiveOnly: (value: boolean) => void
@@ -19,7 +21,10 @@ export function finalizeImportedRepoAfterSkip(
   state: AddRepoSkipFinalizationState,
   importedRepoId: string
 ): void {
-  const importedWorktrees = state.worktreesByRepo[importedRepoId] ?? []
+  const importedWorktrees = (state.worktreesByRepo[importedRepoId] ?? []).filter(
+    (worktree) => !worktree.isArchived
+  )
+  const importedRepo = state.repos.find((repo) => repo.id === importedRepoId)
 
   // Why: Skip means "do not open or create a worktree", not "hide the
   // imported project behind sidebar filters so it looks like nothing landed."
@@ -33,7 +38,7 @@ export function finalizeImportedRepoAfterSkip(
   if (
     importedWorktrees.length > 0 &&
     state.hideDefaultBranchWorkspace &&
-    importedWorktrees.every((worktree) => isDefaultBranchWorkspace(worktree))
+    importedWorktrees.every((worktree) => isDefaultBranchWorkspace(worktree, importedRepo))
   ) {
     state.setHideDefaultBranchWorkspace(false)
   }
diff --git a/src/renderer/src/components/sidebar/default-branch-folder-project-root.test.ts b/src/renderer/src/components/sidebar/default-branch-folder-project-root.test.ts
new file mode 100644
index 000000000000..36ea57f2e9c9
--- /dev/null
+++ b/src/renderer/src/components/sidebar/default-branch-folder-project-root.test.ts
@@ -0,0 +1,139 @@
+import { describe, expect, it } from 'vitest'
+import { LOCAL_EXECUTION_HOST_ID } from '../../../../shared/execution-host'
+import type { Repo } from '../../../../shared/repo-types'
+import type { WorktreeLineage } from '../../../../shared/worktree/lineage-types'
+import type { Worktree } from '../../../../shared/worktree/types'
+import { isDefaultBranchWorkspace } from './default-branch-workspace'
+import { computeVisibleWorktreeIds } from './visible-worktrees'
+
+function makeRepo(id: string, path: string, kind: Repo['kind']): Repo {
+  return { id, path, displayName: id, badgeColor: '#000', addedAt: 0, kind }
+}
+
+function makeRow(repo: Repo, overrides: Partial<Worktree> & { id: string }): Worktree {
+  return {
+    repoId: repo.id,
+    path: repo.path,
+    head: 'abc123',
+    branch: 'refs/heads/main',
+    isBare: false,
+    isMainWorktree: true,
+    displayName: repo.id,
+    comment: '',
+    linkedIssue: null,
+    linkedPR: null,
+    linkedLinearIssue: null,
+    isArchived: false,
+    isUnread: false,
+    isPinned: false,
+    sortOrder: 0,
+    lastActivityAt: 0,
+    ...overrides
+  }
+}
+
+// Mirrors mergeFolderWorkspace: every row of a folder project has no head or branch,
+// and only the root (id `${repoId}::${path}`) is the main worktree.
+function folderProjectRows(repo: Repo): { root: Worktree; instance: Worktree } {
+  const rootId = `${repo.id}::${repo.path}`
+  return {
+    root: makeRow(repo, { id: rootId, head: '', branch: '' }),
+    instance: makeRow(repo, {
+      id: `${rootId}::workspace:task-1`,
+      head: '',
+      branch: '',
+      isMainWorktree: false
+    })
+  }
+}
+
+function visibleWithHideDefault(
+  repos: Repo[],
+  worktrees: Worktree[],
+  worktreeLineageById: Record<string, WorktreeLineage> = {},
+  injectLineageAncestors = true
+): string[] {
+  const worktreesByRepo: Record<string, Worktree[]> = {}
+  for (const worktree of worktrees) {
+    ;(worktreesByRepo[worktree.repoId] ??= []).push(worktree)
+  }
+  return computeVisibleWorktreeIds(
+    worktreesByRepo,
+    worktrees.map((worktree) => worktree.id),
+    {
+      filterRepoIds: [],
+      showSleepingWorkspaces: true,
+      tabsByWorktree: {},
+      ptyIdsByTabId: {},
+      browserTabsByWorktree: {},
+      worktreeIdsWithLiveAgent: new Set(),
+      hideDefaultBranchWorkspace: true,
+      hideAutomationGeneratedWorkspaces: false,
+      hideCliCreatedWorkspaces: false,
+      hideDetachedHeadWorkspaces: false,
+      hideWorkspacesFromOtherDevices: false,
+      pairedDeviceIdsByEnvironment: new Map(),
+      repoMap: new Map(repos.map((repo) => [repo.id, repo])),
+      workspaceHostScope: 'all',
+      defaultHostId: LOCAL_EXECUTION_HOST_ID,
+      worktreeLineageById,
+      injectLineageAncestors
+    }
+  )
+}
+
+describe('"Hide default branch" on folder projects', () => {
+  it('hides the root of a non-git folder project and keeps its other workspaces', () => {
+    const repo = makeRepo('notes', '/Users/me/notes', 'folder')
+    const { root, instance } = folderProjectRows(repo)
+
+    expect(isDefaultBranchWorkspace(root, repo)).toBe(true)
+    expect(isDefaultBranchWorkspace(instance, repo)).toBe(false)
+    expect(visibleWithHideDefault([repo], [root, instance])).toEqual([instance.id])
+  })
+
+  it('hides the root of a folder project added from a git subdirectory', () => {
+    const repo = makeRepo('app', '/Users/me/monorepo/packages/app', 'folder')
+    const { root, instance } = folderProjectRows(repo)
+
+    expect(visibleWithHideDefault([repo], [root, instance])).toEqual([instance.id])
+  })
+
+  it('preserves the sidebar hierarchy exception for a folder root with a visible child', () => {
+    const repo = makeRepo('notes', '/notes', 'folder')
+    const rows = folderProjectRows(repo)
+    const root = { ...rows.root, instanceId: 'root-instance' }
+    const child = { ...rows.instance, instanceId: 'child-instance' }
+    const lineage: WorktreeLineage = {
+      worktreeId: child.id,
+      worktreeInstanceId: child.instanceId,
+      parentWorktreeId: root.id,
+      parentWorktreeInstanceId: root.instanceId,
+      origin: 'cli',
+      capture: { source: 'terminal-context', confidence: 'inferred' },
+      createdAt: 1
+    }
+
+    expect(visibleWithHideDefault([repo], [root, child], { [child.id]: lineage })).toEqual([
+      root.id,
+      child.id
+    ])
+    expect(visibleWithHideDefault([repo], [root, child], { [child.id]: lineage }, false)).toEqual([
+      child.id
+    ])
+  })
+
+  it('keeps an empty-branch git main visible: detached HEAD, or an SSH row synthesized offline', () => {
+    const repo = makeRepo('repo', '/code/repo', 'git')
+    const remoteRepo = makeRepo('remote', '/srv/remote', 'git')
+    const detached = makeRow(repo, { id: 'repo::/code/repo', branch: '' })
+    const sshOffline = makeRow(remoteRepo, { id: 'remote::/srv/remote', branch: '', head: '' })
+
+    expect(isDefaultBranchWorkspace(detached, repo)).toBe(false)
+    expect(isDefaultBranchWorkspace(sshOffline, remoteRepo)).toBe(false)
+    expect(visibleWithHideDefault([repo, remoteRepo], [detached, sshOffline])).toEqual([
+      detached.id,
+      sshOffline.id
+    ])
+  })
+})
diff --git a/src/renderer/src/components/sidebar/default-branch-visible-under-hide-sleeping.test.ts b/src/renderer/src/components/sidebar/default-branch-visible-under-hide-sleeping.test.ts
index a0452e2f508c..c2fb8091390a 100644
--- a/src/renderer/src/components/sidebar/default-branch-visible-under-hide-sleeping.test.ts
+++ b/src/renderer/src/components/sidebar/default-branch-visible-under-hide-sleeping.test.ts
@@ -68,7 +68,7 @@ function visibleOptions(overrides: Partial<VisibleOptions> = {}): VisibleOptions
 
 describe('#8873 default-branch workspace under "Hide sleeping"', () => {
   it('is genuinely the default-branch row the "Hide default branch" toggle targets', () => {
-    expect(isDefaultBranchWorkspace(makeDefaultBranchWorktree())).toBe(true)
+    expect(isDefaultBranchWorkspace(makeDefaultBranchWorktree(), repoMap.get('repo1'))).toBe(true)
   })
 
   it('stays in the sidebar when it is sleeping and "Hide sleeping" is on', () => {
@@ -154,16 +154,14 @@ describe('the "Hide sleeping" exemption for project entry-point rows', () => {
   })
 
   it('keeps a sleeping folder workspace, which has no sibling row to fall back to', () => {
-    // Folder-mode projects are main worktrees with an empty branch/head, so the
-    // default-branch predicate rejects them; sweeping them drops the whole project.
+    // Folder-mode projects are main worktrees with an empty branch/head; sweeping
+    // them drops the whole project.
     const folder: Worktree = {
       ...makeDefaultBranchWorktree(),
       id: 'wt-folder',
       branch: '',
       head: ''
     }
-    expect(isDefaultBranchWorkspace(folder)).toBe(false)
-
     expect(visible([folder], { alwaysShowDefaultBranchWorkspace: true })).toEqual([folder.id])
   })
 
diff --git a/src/renderer/src/components/sidebar/default-branch-workspace.ts b/src/renderer/src/components/sidebar/default-branch-workspace.ts
index 434042320669..c57d2c68c5de 100644
--- a/src/renderer/src/components/sidebar/default-branch-workspace.ts
+++ b/src/renderer/src/components/sidebar/default-branch-workspace.ts
@@ -1,10 +1,16 @@
+import { isFolderRepo } from '../../../../shared/repo-kind'
+import type { Repo } from '../../../../shared/repo-types'
 import type { Worktree } from '../../../../shared/worktree/types'
 
 /** Keeps provisioned roots visible because they are the recipe-created workspace, not a source-repo row. */
-export function isDefaultBranchWorkspace(worktree: Worktree): boolean {
-  return (
-    worktree.isMainWorktree &&
-    worktree.branch.trim() !== '' &&
-    worktree.ephemeralVmCheckoutMode !== 'provisioned-root'
-  )
+export function isDefaultBranchWorkspace(
+  worktree: Worktree,
+  repo: Pick<Repo, 'kind'> | undefined
+): boolean {
+  if (!worktree.isMainWorktree || worktree.ephemeralVmCheckoutMode === 'provisioned-root') {
+    return false
+  }
+  // Why: a folder project's root is its default workspace but has no branch; on a git repo an
+  // empty branch means detached HEAD or an offline SSH row, which stay visible.
+  return worktree.branch.trim() !== '' || (repo !== undefined && isFolderRepo(repo))
 }
diff --git a/src/renderer/src/components/sidebar/folder-workspace-composer-expiry.test.tsx b/src/renderer/src/components/sidebar/folder-workspace-composer-expiry.test.tsx
new file mode 100644
index 000000000000..1361252d5ff8
--- /dev/null
+++ b/src/renderer/src/components/sidebar/folder-workspace-composer-expiry.test.tsx
@@ -0,0 +1,309 @@
+// @vitest-environment happy-dom
+
+import { act, cleanup, renderHook } from '@testing-library/react'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { ProjectGroup } from '../../../../shared/project-group-types'
+import { FOLDER_WORKSPACE_PATH_STATUS_TTL_MS } from '../../../../shared/folder-workspace-path-status'
+import type { FolderWorkspacePathStatusCacheEntry } from '@/store/repos/repo-state'
+import { useAppStore } from '@/store'
+import { getFolderWorkspaceStatusRequestSnapshot } from '@/store/folder-workspaces/folder-path-status'
+import { useFolderWorkspaceComposerPathStatus } from './folder-workspace-composer-path-status'
+
+const initialState = useAppStore.getInitialState()
+const group: ProjectGroup = {
+  id: 'selected',
+  name: 'Folder',
+  parentPath: '/folder',
+  parentGroupId: null,
+  createdFrom: 'manual',
+  tabOrder: 0,
+  isCollapsed: false,
+  color: null,
+  createdAt: 0,
+  updatedAt: 0
+}
+const request = { scope: 'project-group', projectGroupId: group.id } as const
+const getPathStatus = vi.fn<Window['api']['folderWorkspaces']['getPathStatus']>()
+let originalApi: PropertyDescriptor | undefined
+
+function unrelatedEntries(): Record<string, FolderWorkspacePathStatusCacheEntry> {
+  const entries: Record<string, FolderWorkspacePathStatusCacheEntry> = {}
+  for (let index = 1; index <= 100; index += 1) {
+    entries[`local:project-group:unrelated-${index}`] = {
+      status: { path: `/unrelated-${index}`, exists: true },
+      checkedAt: Date.now() - FOLDER_WORKSPACE_PATH_STATUS_TTL_MS + index * 10,
+      requestSnapshot: 'unrelated'
+    }
+  }
+  return entries
+}
+
+async function expireUnrelatedEntries(): Promise<void> {
+  for (let index = 0; index < 1010; index += 1) {
+    await act(async () => vi.advanceTimersByTimeAsync(1))
+  }
+}
+
+beforeEach(() => {
+  vi.useFakeTimers()
+  vi.setSystemTime(100_000)
+  getPathStatus.mockReset().mockResolvedValue({ path: '/folder', exists: true })
+  originalApi = Object.getOwnPropertyDescriptor(window, 'api')
+  Object.defineProperty(window, 'api', {
+    configurable: true,
+    value: { folderWorkspaces: { getPathStatus } }
+  })
+  useAppStore.setState(
+    {
+      ...initialState,
+      projectGroups: [group],
+      folderWorkspaces: [],
+      repos: [],
+      folderWorkspacePathStatuses: unrelatedEntries(),
+      settings: null
+    },
+    true
+  )
+})
+
+afterEach(() => {
+  cleanup()
+  expect(vi.getTimerCount()).toBe(0)
+  vi.restoreAllMocks()
+  vi.useRealTimers()
+  useAppStore.setState(initialState, true)
+  if (originalApi) {
+    Object.defineProperty(window, 'api', originalApi)
+  } else {
+    Reflect.deleteProperty(window, 'api')
+  }
+})
+
+describe('folder composer cache expiry requests', () => {
+  it('retains unrelated-expiry and reopen retries after an uncached failure', async () => {
+    vi.spyOn(console, 'error').mockImplementation(() => {})
+    getPathStatus.mockRejectedValueOnce(new Error('Unavailable'))
+    const hook = renderHook(({ open }) => useFolderWorkspaceComposerPathStatus(group, open, null), {
+      initialProps: { open: true }
+    })
+    await act(async () => {})
+    await expireUnrelatedEntries()
+    expect(getPathStatus).toHaveBeenCalledTimes(2)
+    expect(hook.result.current.pathStatusBlocksCreate).toBe(false)
+    hook.rerender({ open: false })
+    hook.rerender({ open: true })
+    await act(async () => {})
+    expect(getPathStatus).toHaveBeenCalledTimes(3)
+    expect(hook.result.current.pathStatusBlocksCreate).toBe(false)
+  })
+
+  it('does not refetch a fresh selected folder when other entries expire', async () => {
+    const hook = renderHook(() => useFolderWorkspaceComposerPathStatus(group, true, null))
+    await act(async () => {})
+    await expireUnrelatedEntries()
+
+    expect(getPathStatus).toHaveBeenCalledExactlyOnceWith(request)
+    expect(hook.result.current.pathStatusBlocksCreate).toBe(false)
+  })
+
+  it('retains expiry-triggered checks while the first result is unknown', async () => {
+    const gate = Promise.withResolvers<{ path: string; exists: boolean }>()
+    getPathStatus.mockReturnValue(gate.promise)
+    const hook = renderHook(() => useFolderWorkspaceComposerPathStatus(group, true, null))
+    await expireUnrelatedEntries()
+
+    expect(getPathStatus).toHaveBeenCalledTimes(101)
+    expect(hook.result.current.pathStatusBlocksCreate).toBe(true)
+    await act(async () => gate.resolve({ path: '/folder', exists: true }))
+    expect(hook.result.current.pathStatusBlocksCreate).toBe(false)
+  })
+
+  it('refreshes at the selected entry expiry and blocks while that refresh is pending', async () => {
+    useAppStore.setState({ folderWorkspacePathStatuses: {} })
+    const gate = Promise.withResolvers<{ path: string; exists: boolean }>()
+    getPathStatus
+      .mockResolvedValueOnce({ path: '/folder', exists: true })
+      .mockReturnValueOnce(gate.promise)
+    const hook = renderHook(() => useFolderWorkspaceComposerPathStatus(group, true, null))
+    await act(async () => {})
+    await act(async () => vi.advanceTimersByTimeAsync(FOLDER_WORKSPACE_PATH_STATUS_TTL_MS))
+    expect(getPathStatus).toHaveBeenCalledOnce()
+    await act(async () => vi.advanceTimersByTimeAsync(1))
+
+    expect(getPathStatus).toHaveBeenCalledTimes(2)
+    expect(hook.result.current.pathStatusBlocksCreate).toBe(true)
+    await act(async () => gate.resolve({ path: '/folder', exists: true }))
+    expect(hook.result.current.pathStatusBlocksCreate).toBe(false)
+  })
+
+  it('does not check a folder without a selected group', async () => {
+    renderHook(() => useFolderWorkspaceComposerPathStatus(null, true, null))
+    await expireUnrelatedEntries()
+    expect(getPathStatus).not.toHaveBeenCalled()
+  })
+
+  it.each(['missing', 'not-directory', 'ambiguous-connection'] as const)(
+    'retains unrelated-expiry recovery after a cached %s refresh fails',
+    async (reason) => {
+      vi.spyOn(console, 'error').mockImplementation(() => {})
+      getPathStatus
+        .mockResolvedValueOnce({ path: '/folder', exists: false, reason })
+        .mockRejectedValueOnce(new Error('Unavailable'))
+      const hook = renderHook(() => useFolderWorkspaceComposerPathStatus(group, true, null))
+      await act(async () => {})
+      await expireUnrelatedEntries()
+      expect(getPathStatus).toHaveBeenCalledOnce()
+      expect(hook.result.current.pathStatusBlocksCreate).toBe(true)
+      await act(async () => vi.advanceTimersByTimeAsync(8991))
+      expect(getPathStatus).toHaveBeenCalledTimes(2)
+      expect(hook.result.current.pathStatusBlocksCreate).toBe(true)
+      await act(async () => {
+        useAppStore.setState((state) => ({
+          folderWorkspacePathStatuses: {
+            ...state.folderWorkspacePathStatuses,
+            unrelated: {
+              checkedAt: Date.now() - FOLDER_WORKSPACE_PATH_STATUS_TTL_MS + 10,
+              requestSnapshot: '',
+              status: { path: '/other', exists: true }
+            }
+          }
+        }))
+      })
+      await act(async () => vi.advanceTimersByTimeAsync(11))
+      expect(getPathStatus).toHaveBeenCalledTimes(3)
+      expect(hook.result.current.pathStatusBlocksCreate).toBe(false)
+    }
+  )
+
+  it('forces the initial check even when a matching fresh result is already cached', async () => {
+    const snapshot = getFolderWorkspaceStatusRequestSnapshot(useAppStore.getState(), request)
+    expect(snapshot).not.toBeNull()
+    useAppStore.setState({
+      folderWorkspacePathStatuses: {
+        'local:project-group:selected': {
+          checkedAt: Date.now(),
+          requestSnapshot: snapshot ?? '',
+          status: { path: '/folder', exists: false, reason: 'missing' }
+        }
+      }
+    })
+    const hook = renderHook(() => useFolderWorkspaceComposerPathStatus(group, true, null))
+    await act(async () => {})
+    expect(getPathStatus).toHaveBeenCalledExactlyOnceWith(request)
+    expect(hook.result.current.pathStatusBlocksCreate).toBe(false)
+  })
+
+  it('retries a fresh timestamp whose request snapshot is no longer current', async () => {
+    vi.spyOn(console, 'error').mockImplementation(() => {})
+    getPathStatus.mockRejectedValueOnce(new Error('Unavailable'))
+    useAppStore.setState((state) => ({
+      folderWorkspacePathStatuses: {
+        ...state.folderWorkspacePathStatuses,
+        'local:project-group:selected': {
+          checkedAt: Date.now(),
+          requestSnapshot: 'old-folder-snapshot',
+          status: { path: '/old-folder', exists: false, reason: 'missing' }
+        }
+      }
+    }))
+    const hook = renderHook(() => useFolderWorkspaceComposerPathStatus(group, true, null))
+    await act(async () => {})
+    expect(hook.result.current.pathStatusBlocksCreate).toBe(true)
+    await act(async () => vi.advanceTimersByTimeAsync(11))
+    expect(getPathStatus).toHaveBeenCalledTimes(2)
+    expect(hook.result.current.pathStatusBlocksCreate).toBe(false)
+  })
+
+  it('does not report a nonexistent pending check when cache is cleared after a skipped expiry', async () => {
+    const hook = renderHook(() => useFolderWorkspaceComposerPathStatus(group, true, null))
+    await act(async () => {})
+    await act(async () => vi.advanceTimersByTimeAsync(11))
+    expect(getPathStatus).toHaveBeenCalledOnce()
+    await act(async () => useAppStore.setState({ folderWorkspacePathStatuses: {} }))
+    expect(getPathStatus).toHaveBeenCalledOnce()
+    expect(vi.getTimerCount()).toBe(0)
+    expect(hook.result.current.pathStatusBlocksCreate).toBe(false)
+  })
+
+  it('keeps a real pending check pending when fresh cache is removed after unrelated expiry', async () => {
+    const snapshot = getFolderWorkspaceStatusRequestSnapshot(useAppStore.getState(), request)
+    expect(snapshot).not.toBeNull()
+    useAppStore.setState((state) => ({
+      folderWorkspacePathStatuses: {
+        ...state.folderWorkspacePathStatuses,
+        'local:project-group:selected': {
+          checkedAt: Date.now(),
+          requestSnapshot: snapshot ?? '',
+          status: { path: '/folder', exists: true }
+        }
+      }
+    }))
+    const gate = Promise.withResolvers<{ path: string; exists: boolean }>()
+    getPathStatus.mockReturnValue(gate.promise)
+    const hook = renderHook(() => useFolderWorkspaceComposerPathStatus(group, true, null))
+    await act(async () => vi.advanceTimersByTimeAsync(11))
+    expect(getPathStatus).toHaveBeenCalledTimes(2)
+    await act(async () => useAppStore.setState({ folderWorkspacePathStatuses: {} }))
+    expect(hook.result.current.pathStatusBlocksCreate).toBe(true)
+    await act(async () => gate.resolve({ path: '/folder', exists: true }))
+    expect(hook.result.current.pathStatusBlocksCreate).toBe(false)
+  })
+
+  it('uses the selected runtime cache entry instead of a same-group local entry', async () => {
+    const fetchStatus = vi.fn().mockResolvedValue(null)
+    const snapshot = getFolderWorkspaceStatusRequestSnapshot(useAppStore.getState(), request)
+    expect(snapshot).not.toBeNull()
+    const makeEntry = (checkedAt: number): FolderWorkspacePathStatusCacheEntry => ({
+      checkedAt,
+      status: { path: '/folder', exists: true },
+      requestSnapshot: snapshot ?? ''
+    })
+    useAppStore.setState({
+      fetchFolderWorkspacePathStatus: fetchStatus,
+      folderWorkspacePathStatuses: {
+        'local:project-group:selected': makeEntry(90_010),
+        'environment:env-1:project-group:selected': makeEntry(100_000)
+      }
+    })
+    const hook = renderHook(() => useFolderWorkspaceComposerPathStatus(group, true, 'env-1'))
+    await act(async () => {})
+    await act(async () => vi.advanceTimersByTimeAsync(11))
+    expect(fetchStatus).toHaveBeenCalledExactlyOnceWith(request, {
+      force: true,
+      runtimeEnvironmentId: 'env-1'
+    })
+    expect(hook.result.current.pathStatusBlocksCreate).toBe(false)
+    await act(async () => vi.advanceTimersByTimeAsync(9990))
+    expect(fetchStatus).toHaveBeenCalledTimes(2)
+  })
+
+  it('replaces the timer when the selected group changes', async () => {
+    const secondGroup: ProjectGroup = { ...group, id: 'second', parentPath: '/second' }
+    useAppStore.setState({ projectGroups: [group, secondGroup], folderWorkspacePathStatuses: {} })
+    getPathStatus.mockImplementation(async (input) => ({
+      path:
+        input.scope === 'project-group' && input.projectGroupId === 'second'
+          ? '/second'
+          : '/folder',
+      exists: true
+    }))
+    const hook = renderHook(
+      ({ selected }) => useFolderWorkspaceComposerPathStatus(selected, true, null),
+      {
+        initialProps: { selected: group }
+      }
+    )
+    await act(async () => {})
+    await act(async () => vi.advanceTimersByTimeAsync(5000))
+    hook.rerender({ selected: secondGroup })
+    await act(async () => {})
+    getPathStatus.mockClear()
+    await act(async () => vi.advanceTimersByTimeAsync(5001))
+    expect(getPathStatus).not.toHaveBeenCalled()
+    await act(async () => vi.advanceTimersByTimeAsync(5000))
+    expect(getPathStatus).toHaveBeenCalledExactlyOnceWith({
+      scope: 'project-group',
+      projectGroupId: 'second'
+    })
+  })
+})
diff --git a/src/renderer/src/components/sidebar/folder-workspace-composer-path-status.ts b/src/renderer/src/components/sidebar/folder-workspace-composer-path-status.ts
index 911c373191d3..f014c915f3e2 100644
--- a/src/renderer/src/components/sidebar/folder-workspace-composer-path-status.ts
+++ b/src/renderer/src/components/sidebar/folder-workspace-composer-path-status.ts
@@ -37,6 +37,14 @@ export function useFolderWorkspaceComposerPathStatus(
   )
   const cacheExpiryTick = useFolderWorkspacePathStatusCacheExpiryTick(folderWorkspacePathStatuses)
   const activePathStatusRefreshIdRef = useRef(0)
+  const previousPathStatusRefreshRef = useRef<{
+    request: typeof pathStatusRequest
+    cacheKey: string
+    refreshKey: string
+    runtimeEnvironmentId: typeof runtimeEnvironmentId
+    fetchStatus: typeof fetchFolderWorkspacePathStatus
+    pending: boolean
+  } | null>(null)
   const [completedPathStatusRefreshKeys, setCompletedPathStatusRefreshKeys] = useState<
     ReadonlySet<string>
   >(() => new Set())
@@ -72,7 +80,40 @@ export function useFolderWorkspaceComposerPathStatus(
   ])
 
   useEffect(() => {
-    if (!open || !pathStatusRequest || pathStatusRefreshKey === null) {
+    if (!open || !pathStatusRequest || pathStatusRefreshKey === null || !pathStatusCacheKey) {
+      previousPathStatusRefreshRef.current = null
+      return
+    }
+    const previousRefresh = previousPathStatusRefreshRef.current
+    const refresh = {
+      request: pathStatusRequest,
+      cacheKey: pathStatusCacheKey,
+      refreshKey: pathStatusRefreshKey,
+      runtimeEnvironmentId,
+      fetchStatus: fetchFolderWorkspacePathStatus,
+      pending: true
+    }
+    previousPathStatusRefreshRef.current = refresh
+    const completeRefresh = (): void => {
+      refresh.pending = false
+      setCompletedPathStatusRefreshKeys((current) => {
+        if (current.has(pathStatusRefreshKey)) {
+          return current
+        }
+        return new Set(current).add(pathStatusRefreshKey)
+      })
+    }
+    // Another folder's expiry does not invalidate this folder's fresh result.
+    if (
+      previousRefresh?.request === pathStatusRequest &&
+      previousRefresh.cacheKey === pathStatusCacheKey &&
+      previousRefresh.refreshKey !== pathStatusRefreshKey &&
+      previousRefresh.runtimeEnvironmentId === runtimeEnvironmentId &&
+      previousRefresh.fetchStatus === fetchFolderWorkspacePathStatus &&
+      !previousRefresh.pending &&
+      getFreshFolderWorkspacePathStatus(pathStatusRequest, pathStatusRouteOptions) !== null
+    ) {
+      completeRefresh()
       return
     }
     const refreshId = activePathStatusRefreshIdRef.current + 1
@@ -91,18 +132,16 @@ export function useFolderWorkspaceComposerPathStatus(
       if (activePathStatusRefreshIdRef.current !== refreshId) {
         return
       }
-      setCompletedPathStatusRefreshKeys((current) => {
-        if (current.has(pathStatusRefreshKey)) {
-          return current
-        }
-        return new Set(current).add(pathStatusRefreshKey)
-      })
+      completeRefresh()
     })
   }, [
     fetchFolderWorkspacePathStatus,
+    getFreshFolderWorkspacePathStatus,
     open,
+    pathStatusCacheKey,
     pathStatusRefreshKey,
     pathStatusRequest,
+    pathStatusRouteOptions,
     runtimeEnvironmentId
   ])
 
diff --git a/src/renderer/src/components/sidebar/sidebar-filter-state.test.ts b/src/renderer/src/components/sidebar/sidebar-filter-state.test.ts
index c6945a7f0412..5722f8e0b0ef 100644
--- a/src/renderer/src/components/sidebar/sidebar-filter-state.test.ts
+++ b/src/renderer/src/components/sidebar/sidebar-filter-state.test.ts
@@ -7,6 +7,8 @@ import {
 import { isDefaultBranchWorkspace } from './default-branch-workspace'
 import type { Worktree } from '../../../../shared/worktree/types'
 
+const gitRepo = { kind: 'git' } as const
+
 function makeWorktree(id: string, repoId = 'repo1'): Worktree {
   return {
     id,
@@ -50,26 +52,34 @@ describe('isDefaultBranchWorkspace', () => {
   it('returns true for a branch-backed main worktree', () => {
     const main = makeWorktree('main')
     main.isMainWorktree = true
-    expect(isDefaultBranchWorkspace(main)).toBe(true)
+    expect(isDefaultBranchWorkspace(main, gitRepo)).toBe(true)
+  })
+
+  it('returns false for an empty-branch git main (detached HEAD or offline SSH row)', () => {
+    const detached = makeWorktree('detached')
+    detached.isMainWorktree = true
+    detached.branch = ''
+    expect(isDefaultBranchWorkspace(detached, gitRepo)).toBe(false)
   })
 
-  it('returns false for folder-mode main worktrees (empty branch)', () => {
+  it('returns true for a folder project root, which has no branch', () => {
     const folder = makeWorktree('folder')
     folder.isMainWorktree = true
     folder.branch = ''
-    expect(isDefaultBranchWorkspace(folder)).toBe(false)
+    folder.head = ''
+    expect(isDefaultBranchWorkspace(folder, { kind: 'folder' })).toBe(true)
   })
 
   it('returns false for non-main worktrees even on the default branch', () => {
     const feature = makeWorktree('feature')
-    expect(isDefaultBranchWorkspace(feature)).toBe(false)
+    expect(isDefaultBranchWorkspace(feature, gitRepo)).toBe(false)
   })
 
   it('keeps a provisioned root visible as the recipe-created workspace', () => {
     const provisionedRoot = makeWorktree('provisioned-root')
     provisionedRoot.isMainWorktree = true
     provisionedRoot.ephemeralVmCheckoutMode = 'provisioned-root'
-    expect(isDefaultBranchWorkspace(provisionedRoot)).toBe(false)
+    expect(isDefaultBranchWorkspace(provisionedRoot, gitRepo)).toBe(false)
   })
 })
 
diff --git a/src/renderer/src/components/sidebar/smart-attention.test.ts b/src/renderer/src/components/sidebar/smart-attention.test.ts
index e8bcfad610ab..c1868cb9496d 100644
--- a/src/renderer/src/components/sidebar/smart-attention.test.ts
+++ b/src/renderer/src/components/sidebar/smart-attention.test.ts
@@ -102,6 +102,27 @@ describe('mostRecentAttentionInHistory', () => {
     ).toBe(NOW - 4_000)
   })
 
+  it('counts a failed history done as attention and skips a cancelled one', () => {
+    expect(
+      mostRecentAttentionInHistory([
+        makeHistory('done', NOW - 4_000),
+        {
+          ...makeHistory('done', NOW - 1_000),
+          mainAgent: { state: 'done', outcome: 'failure', stateStartedAt: NOW - 1_000 }
+        }
+      ])
+    ).toBe(NOW - 1_000)
+    expect(
+      mostRecentAttentionInHistory([
+        makeHistory('done', NOW - 4_000),
+        {
+          ...makeHistory('done', NOW - 1_000),
+          mainAgent: { state: 'done', outcome: 'cancellation', stateStartedAt: NOW - 1_000 }
+        }
+      ])
+    ).toBe(NOW - 4_000)
+  })
+
   it('returns null when only interrupted dones exist', () => {
     expect(mostRecentAttentionInHistory([makeHistory('done', NOW - 1_000, true)])).toBeNull()
   })
@@ -181,6 +202,31 @@ describe('resolveAttention', () => {
     expect(resolveAttention([hookPane(entry)], NOW)).toEqual(IDLE)
   })
 
+  it('ranks a failed done in Class 2 at its end time, like a completion', () => {
+    const entry = makeEntry({
+      paneKey: 't:1',
+      state: 'done',
+      mainAgent: { state: 'done', outcome: 'failure', stateStartedAt: NOW - 90_000 },
+      stateStartedAt: NOW - 90_000,
+      updatedAt: NOW - 30_000
+    })
+    expect(resolveAttention([hookPane(entry)], NOW)).toEqual({
+      cls: 2,
+      attentionTimestamp: NOW - 90_000
+    })
+  })
+
+  it('still demotes a done the user stopped, recorded as a cancellation verdict', () => {
+    const entry = makeEntry({
+      paneKey: 't:1',
+      state: 'done',
+      mainAgent: { state: 'done', outcome: 'cancellation', stateStartedAt: NOW - 90_000 },
+      stateStartedAt: NOW - 90_000,
+      updatedAt: NOW - 30_000
+    })
+    expect(resolveAttention([hookPane(entry)], NOW)).toEqual(IDLE)
+  })
+
   it('treats a session boundary as idle unless it displaced a real completion', () => {
     const boundary = makeEntry({
       paneKey: 't:1',
diff --git a/src/renderer/src/components/sidebar/smart-attention.ts b/src/renderer/src/components/sidebar/smart-attention.ts
index 481dd0c20109..5130efe9379a 100644
--- a/src/renderer/src/components/sidebar/smart-attention.ts
+++ b/src/renderer/src/components/sidebar/smart-attention.ts
@@ -1,5 +1,6 @@
 import { classifyTitleActivity, isExplicitAgentStatusFresh } from '@/lib/pane-agent-evidence'
 import { agentEntryCompletionAt } from '../../../../shared/agent-completion-time'
+import { agentTurnStoppedByUser } from '../../../../shared/agent-main-agent-verdict'
 import { migrationUnsupportedToAgentStatusEntry } from '@/lib/migration-unsupported-agent-entry'
 import { resolveDecayedAgentRowState } from '@/lib/agent-row-decay-state'
 import { tabHasLivePty } from '@/lib/tab-has-live-pty'
@@ -85,18 +86,15 @@ export function hasFreshAttributedAgentStatus(
 
 /**
  * Return the timestamp of the most recent `done`/`blocked`/`waiting` history row, ignoring
- * interrupted `done` rows (Ctrl+C). Returns `null` when no qualifying row exists.
+ * `done` rows the user stopped (Ctrl+C). Returns `null` when no qualifying row exists.
  */
 export function mostRecentAttentionInHistory(history: AgentStateHistoryEntry[]): number | null {
   let max = 0
   for (const h of history) {
-    // Why: setAgentStatus preserves `interrupted` on history rows, so filter them like the current entry.
-    if (h.state === 'done' && h.interrupted) {
-      continue
-    }
+    // Why: history rows keep the verdict, so filter a stopped turn like the current entry.
     if (h.state === 'done' || h.state === 'blocked' || h.state === 'waiting') {
       // Why: Infinity from a corrupted row would pin the worktree atop Class 3 forever; treat non-finite as missing.
-      if (!Number.isFinite(h.startedAt)) {
+      if (agentTurnStoppedByUser(h) || !Number.isFinite(h.startedAt)) {
         continue
       }
       if (h.startedAt > max) {
@@ -163,8 +161,8 @@ export function resolveAttention(panes: PaneInput[], now: number): WorktreeAtten
         ts = entry.stateStartedAt
         cause = entry.state
       } else if (entry.state === 'done') {
-        // Why: null covers interrupted `done` (Ctrl+C — user is finished with it) and idle session
-        // boundaries; neither is attention.
+        // Why: null covers a stopped `done` (not a completion) and idle session boundaries;
+        // neither is attention. A failed `done` ranks here: it is news the user has not seen.
         const completedAt = agentEntryCompletionAt(entry)
         if (completedAt === null) {
           continue
diff --git a/src/renderer/src/components/sidebar/smart-sort.test.ts b/src/renderer/src/components/sidebar/smart-sort.test.ts
index 3c0193fbc2ed..6be13b7ceaf8 100644
--- a/src/renderer/src/components/sidebar/smart-sort.test.ts
+++ b/src/renderer/src/components/sidebar/smart-sort.test.ts
@@ -85,7 +85,8 @@ function makeEntry(overrides: Partial<AgentStatusEntry> & { paneKey: string }):
     tabId: overrides.tabId,
     terminalTitle: overrides.terminalTitle,
     stateHistory: overrides.stateHistory ?? [],
-    interrupted: overrides.interrupted
+    interrupted: overrides.interrupted,
+    mainAgent: overrides.mainAgent
   }
 }
 
@@ -334,6 +335,31 @@ describe('smart sort — interrupted and stale handling', () => {
     expect(sorted.map((w) => w.id)).toEqual(['real-done', 'interrupted'])
   })
 
+  it('ranks a failed turn above an idle worktree and a cancelled one below it', () => {
+    const idle = makeWorktree({ id: 'idle', displayName: 'Idle', lastActivityAt: NOW - 10_000 })
+    const failed = makeWorktree({ id: 'failed', displayName: 'Failed', lastActivityAt: 0 })
+    const stopped = makeWorktree({ id: 'stopped', displayName: 'Stopped', lastActivityAt: 0 })
+    const tabs = {
+      [idle.id]: [makeTab({ id: 'tab-idle', worktreeId: idle.id })],
+      [failed.id]: [makeTab({ id: 'tab-failed', worktreeId: failed.id })],
+      [stopped.id]: [makeTab({ id: 'tab-stopped', worktreeId: stopped.id })]
+    }
+    const doneWith = (tabId: string, outcome: 'failure' | 'cancellation') =>
+      makeEntry({
+        paneKey: paneKey(tabId, '1'),
+        state: 'done',
+        mainAgent: { state: 'done', outcome, stateStartedAt: NOW - 60_000 },
+        stateStartedAt: NOW - 60_000,
+        updatedAt: NOW - 1_000
+      })
+    const entries = {
+      [paneKey('tab-failed', '1')]: doneWith('tab-failed', 'failure'),
+      [paneKey('tab-stopped', '1')]: doneWith('tab-stopped', 'cancellation')
+    }
+    const sorted = sortSmart([stopped, idle, failed], tabs, entries)
+    expect(sorted.map((w) => w.id)).toEqual(['failed', 'idle', 'stopped'])
+  })
+
   it('stale entries fall to Class 4', () => {
     const stale = makeWorktree({
       id: 'stale',
diff --git a/src/renderer/src/components/sidebar/use-worktree-activity-status.ts b/src/renderer/src/components/sidebar/use-worktree-activity-status.ts
index d6325f675a64..e3f346c62594 100644
--- a/src/renderer/src/components/sidebar/use-worktree-activity-status.ts
+++ b/src/renderer/src/components/sidebar/use-worktree-activity-status.ts
@@ -26,9 +26,11 @@ export function useWorktreeActivityStatus(worktreeId: string): WorktreeStatus {
     hasPermission,
     hasLiveWorking,
     hasLiveMonitoring,
+    hasFailed,
     hasInterrupted,
     hasLiveDone,
     hasRetainedDone,
+    hasRetainedFailed,
     agentStatusPaneIdsByTabId,
     stalePaneIdsByTabId
   } = useAppStore(useShallow((s) => selectWorktreeAgentActivitySummary(s, worktreeId)))
@@ -49,9 +51,11 @@ export function useWorktreeActivityStatus(worktreeId: string): WorktreeStatus {
         hasPermission,
         hasLiveWorking,
         hasLiveMonitoring,
+        hasFailed,
         hasInterrupted,
         hasLiveDone,
-        hasRetainedDone
+        hasRetainedDone,
+        hasRetainedFailed
       }),
     [
       tabs,
@@ -64,9 +68,11 @@ export function useWorktreeActivityStatus(worktreeId: string): WorktreeStatus {
       hasPermission,
       hasLiveWorking,
       hasLiveMonitoring,
+      hasFailed,
       hasInterrupted,
       hasLiveDone,
-      hasRetainedDone
+      hasRetainedDone,
+      hasRetainedFailed
     ]
   )
 }
diff --git a/src/renderer/src/components/sidebar/use-worktree-activity-statuses.ts b/src/renderer/src/components/sidebar/use-worktree-activity-statuses.ts
index d62573307a1e..6d1c00545177 100644
--- a/src/renderer/src/components/sidebar/use-worktree-activity-statuses.ts
+++ b/src/renderer/src/components/sidebar/use-worktree-activity-statuses.ts
@@ -34,9 +34,11 @@ export function selectWorktreeActivityStatuses(
       hasPermission,
       hasLiveWorking,
       hasLiveMonitoring,
+      hasFailed,
       hasInterrupted,
       hasLiveDone,
       hasRetainedDone,
+      hasRetainedFailed,
       agentStatusPaneIdsByTabId,
       stalePaneIdsByTabId
     } = selectWorktreeAgentActivitySummary(statusInputs, worktreeId)
@@ -53,9 +55,11 @@ export function selectWorktreeActivityStatuses(
         hasPermission,
         hasLiveWorking,
         hasLiveMonitoring,
+        hasFailed,
         hasInterrupted,
         hasLiveDone,
-        hasRetainedDone
+        hasRetainedDone,
+        hasRetainedFailed
       })
     )
   }
diff --git a/src/renderer/src/components/sidebar/visible-worktrees.test.ts b/src/renderer/src/components/sidebar/visible-worktrees.test.ts
index 597d4b91e616..81b2ff9d1f48 100644
--- a/src/renderer/src/components/sidebar/visible-worktrees.test.ts
+++ b/src/renderer/src/components/sidebar/visible-worktrees.test.ts
@@ -389,18 +389,18 @@ describe('computeVisibleWorktreeIds', () => {
     expect(result).toEqual([feature.id])
   })
 
-  it('keeps folder-mode main worktrees visible when default branch workspaces are hidden', () => {
-    const folder = makeWorktree('folder')
-    folder.isMainWorktree = true
-    folder.branch = ''
+  it('keeps an empty-branch git main visible when default branch workspaces are hidden', () => {
+    const detached = makeWorktree('detached')
+    detached.isMainWorktree = true
+    detached.branch = ''
 
     const result = computeVisibleWorktreeIds(
-      { repo1: [folder] },
-      [folder.id],
+      { repo1: [detached] },
+      [detached.id],
       visibleOptions({ hideDefaultBranchWorkspace: true })
     )
 
-    expect(result).toEqual([folder.id])
+    expect(result).toEqual([detached.id])
   })
 
   it('filters worktrees to a selected SSH host scope', () => {
diff --git a/src/renderer/src/components/sidebar/visible-worktrees.ts b/src/renderer/src/components/sidebar/visible-worktrees.ts
index 194c363568e5..82b72109fb18 100644
--- a/src/renderer/src/components/sidebar/visible-worktrees.ts
+++ b/src/renderer/src/components/sidebar/visible-worktrees.ts
@@ -56,10 +56,10 @@ import { getWorktreeHostIdentity } from '../../../../shared/worktree/host-qualif
  * Whether the "Hide sleeping" sweep must keep this row (#8873).
  *
  * Why isMainWorktree and not isDefaultBranchWorkspace: the project's primary
- * checkout is the repo's only guaranteed entry point. Folder workspaces and
- * detached-HEAD mains fail the default-branch predicate yet often have no
- * sibling row at all, so sweeping them drops the entire project out of the
- * sidebar, Cmd+J and the board with no way back except changing a filter.
+ * checkout is the repo's only guaranteed entry point. Detached-HEAD and offline
+ * SSH mains fail the default-branch predicate yet often have no sibling row at
+ * all, so sweeping them drops the entire project out of the sidebar, Cmd+J and
+ * the board with no way back except changing a filter.
  *
  * Why shared: the sidebar pipeline and the jump palette both apply this, and a
  * second copy is how the two surfaces drift.
@@ -109,7 +109,7 @@ export function computeVisibleWorktrees(
   }
 
   if (opts.hideDefaultBranchWorkspace) {
-    all = all.filter((w) => !isDefaultBranchWorkspace(w))
+    all = all.filter((w) => !isDefaultBranchWorkspace(w, opts.repoMap.get(w.repoId)))
   }
 
   if (opts.hideAutomationGeneratedWorkspaces) {
diff --git a/src/renderer/src/components/sidebar/worktree-agent-activity-summary.test.ts b/src/renderer/src/components/sidebar/worktree-agent-activity-summary.test.ts
index 7b3bdd42849e..a4ac0369bf79 100644
--- a/src/renderer/src/components/sidebar/worktree-agent-activity-summary.test.ts
+++ b/src/renderer/src/components/sidebar/worktree-agent-activity-summary.test.ts
@@ -22,6 +22,7 @@ function makeAgentStatusEntry(args: {
   restoredUnconfirmed?: true
   workingMode?: AgentStatusEntry['workingMode']
   interrupted?: true
+  mainAgent?: AgentStatusEntry['mainAgent']
 }): AgentStatusEntry {
   return {
     paneKey: args.paneKey,
@@ -34,6 +35,7 @@ function makeAgentStatusEntry(args: {
     restoredUnconfirmed: args.restoredUnconfirmed,
     workingMode: args.workingMode,
     interrupted: args.interrupted,
+    mainAgent: args.mainAgent,
     orchestration: args.parentPaneKey
       ? {
           taskId: 'task-1',
@@ -223,6 +225,134 @@ describe('selectWorktreeAgentActivitySummary', () => {
     expect(summary).toMatchObject({ hasInterrupted: true, hasLiveDone: false })
   })
 
+  it('separates a failed outcome from clean completion and from a cancellation', () => {
+    vi.spyOn(Date, 'now').mockReturnValue(2_000)
+    const paneKey = makePaneKey('tab-1', LEAF_ID)
+    const summary = selectWorktreeAgentActivitySummary(
+      {
+        tabsByWorktree: { 'repo::/wt-1': [makeTab('tab-1', 'repo::/wt-1')] },
+        agentStatusEpoch: 3,
+        agentStatusByPaneKey: {
+          [paneKey]: makeAgentStatusEntry({
+            paneKey,
+            state: 'done',
+            mainAgent: { state: 'done', outcome: 'failure', stateStartedAt: 1_000 }
+          })
+        },
+        migrationUnsupportedByPtyId: {},
+        runtimeAgentOrchestrationByPaneKey: {},
+        retainedAgentsByPaneKey: {}
+      },
+      'repo::/wt-1'
+    )
+
+    expect(summary).toMatchObject({ hasFailed: true, hasInterrupted: false, hasLiveDone: false })
+  })
+
+  it('reports a main agent that failed while its subagents run, beside their pending question', () => {
+    vi.spyOn(Date, 'now').mockReturnValue(2_000)
+    const paneKey = makePaneKey('tab-1', LEAF_ID)
+    const summaryFor = (state: 'working' | 'waiting', outcome: 'failure' | 'success') =>
+      selectWorktreeAgentActivitySummary(
+        {
+          tabsByWorktree: { 'repo::/wt-1': [makeTab('tab-1', 'repo::/wt-1')] },
+          agentStatusEpoch: state === 'working' ? (outcome === 'failure' ? 5 : 6) : 7,
+          agentStatusByPaneKey: {
+            [paneKey]: makeAgentStatusEntry({
+              paneKey,
+              state,
+              mainAgent: { state: 'done', outcome, stateStartedAt: 1_000 }
+            })
+          },
+          migrationUnsupportedByPtyId: {},
+          runtimeAgentOrchestrationByPaneKey: {},
+          retainedAgentsByPaneKey: {}
+        },
+        'repo::/wt-1'
+      )
+
+    expect(summaryFor('working', 'failure')).toMatchObject({
+      hasFailed: true,
+      hasLiveWorking: false
+    })
+    expect(summaryFor('working', 'success')).toMatchObject({
+      hasFailed: false,
+      hasLiveWorking: true
+    })
+    expect(summaryFor('waiting', 'failure')).toMatchObject({ hasFailed: true, hasPermission: true })
+  })
+
+  describe('a failed agent on the worktree card', () => {
+    const worktreeId = 'repo::/wt-2'
+    const liveTab = makeTab('tab-1', worktreeId)
+    const retainedTab = makeTab('tab-2', worktreeId)
+    const failure = { state: 'done', outcome: 'failure', stateStartedAt: 1_000 } as const
+    const workingKey = makePaneKey('tab-1', LEAF_ID)
+    const failedKey = makePaneKey('tab-1', '22222222-2222-4222-8222-222222222222')
+    const working = makeAgentStatusEntry({ paneKey: workingKey, state: 'working' })
+    const retainedFailure = {
+      'tab-2:0': {
+        entry: makeAgentStatusEntry({ paneKey: 'tab-2:0', state: 'done', mainAgent: failure }),
+        worktreeId,
+        tab: retainedTab,
+        agentType: 'claude' as const,
+        startedAt: 1_000
+      }
+    }
+    let epoch = 100
+    const cardFor = (
+      agentStatusByPaneKey: AgentActivityInput['agentStatusByPaneKey'],
+      retainedAgentsByPaneKey: AgentActivityInput['retainedAgentsByPaneKey']
+    ) => {
+      vi.spyOn(Date, 'now').mockReturnValue(2_000)
+      const summary = selectWorktreeAgentActivitySummary(
+        {
+          tabsByWorktree: { [worktreeId]: [liveTab, retainedTab] },
+          agentStatusEpoch: epoch++,
+          agentStatusByPaneKey,
+          migrationUnsupportedByPtyId: {},
+          runtimeAgentOrchestrationByPaneKey: {},
+          retainedAgentsByPaneKey
+        },
+        worktreeId
+      )
+      return {
+        summary,
+        status: resolveWorktreeStatus({ tabs: [], browserTabs: [], ptyIdsByTabId: {}, ...summary })
+      }
+    }
+
+    it('reads a retained failure as failed once nothing else is live, not done', () => {
+      const { summary, status } = cardFor({}, retainedFailure)
+
+      expect(summary).toMatchObject({ hasRetainedFailed: true, hasRetainedDone: false })
+      expect(status).toBe('failed')
+    })
+
+    it('lets live work outrank a departed agent that failed', () => {
+      const { summary, status } = cardFor({ [workingKey]: working }, retainedFailure)
+
+      expect(summary).toMatchObject({ hasFailed: false, hasRetainedFailed: true })
+      expect(status).toBe('working')
+    })
+
+    it('keeps a live failure above live work', () => {
+      const { status } = cardFor(
+        {
+          [workingKey]: working,
+          [failedKey]: makeAgentStatusEntry({
+            paneKey: failedKey,
+            state: 'done',
+            mainAgent: failure
+          })
+        },
+        {}
+      )
+
+      expect(status).toBe('failed')
+    })
+  })
+
   it('lets an unconfirmed restored row suppress only its pane title', () => {
     vi.spyOn(Date, 'now').mockReturnValue(2_000)
     const paneKey = makePaneKey('tab-1', LEAF_ID)
diff --git a/src/renderer/src/components/sidebar/worktree-agent-activity-summary.ts b/src/renderer/src/components/sidebar/worktree-agent-activity-summary.ts
index 589b7c468540..52d1fb23268b 100644
--- a/src/renderer/src/components/sidebar/worktree-agent-activity-summary.ts
+++ b/src/renderer/src/components/sidebar/worktree-agent-activity-summary.ts
@@ -8,18 +8,23 @@ import {
 } from '@/lib/agent-status-worktree-attribution'
 import {
   AGENT_STATUS_STALE_AFTER_MS,
-  type AgentStatusEntry,
   type AgentStatusOrchestrationContext
 } from '../../../../shared/agent-status-types'
+import { agentVerdictDisplayMark } from '../../../../shared/agent-main-agent-verdict'
+import { applyAgentPaneActivityFlags } from '@/lib/agent-pane-activity-flags'
 
 export type WorktreeAgentActivitySummary = {
   hasPermission: boolean
   hasLiveWorking: boolean
   hasLiveMonitoring: boolean
+  /** A fresh failed main agent, also while its subagents run; kept apart from clean done. */
+  hasFailed: boolean
   /** Fresh interrupted completion, kept separate from clean done outcomes. */
   hasInterrupted: boolean
   hasLiveDone: boolean
   hasRetainedDone: boolean
+  /** A departed agent's failure; unlike `hasFailed` it yields to live work. */
+  hasRetainedFailed: boolean
   agentStatusPaneIdsByTabId: Record<string, ReadonlySet<string>>
   /** Stale rows suppress generated permission labels while preserving native title fallback. */
   stalePaneIdsByTabId: Record<string, ReadonlySet<string>>
@@ -31,9 +36,11 @@ const EMPTY_SUMMARY: WorktreeAgentActivitySummary = {
   hasPermission: false,
   hasLiveWorking: false,
   hasLiveMonitoring: false,
+  hasFailed: false,
   hasInterrupted: false,
   hasLiveDone: false,
   hasRetainedDone: false,
+  hasRetainedFailed: false,
   agentStatusPaneIdsByTabId: EMPTY_AGENT_STATUS_PANE_IDS_BY_TAB_ID,
   stalePaneIdsByTabId: EMPTY_AGENT_STATUS_PANE_IDS_BY_TAB_ID
 }
@@ -134,7 +141,7 @@ function getWorktreeAgentActivitySummaries(
     if (entry.state === 'done') {
       addParentPaneId(summary, orchestration, worktreeId, tabIdToWorktreeId)
     }
-    applyLiveAgentState(summary, entry)
+    applyAgentPaneActivityFlags(summary, entry)
   }
 
   for (const unsupported of Object.values(state.migrationUnsupportedByPtyId ?? {})) {
@@ -147,7 +154,12 @@ function getWorktreeAgentActivitySummaries(
 
   for (const retained of Object.values(state.retainedAgentsByPaneKey ?? {})) {
     const summary = summaryForWorktree(retained.worktreeId)
-    summary.hasRetainedDone = true
+    // Why: a failed agent is retained so its failure stays visible, not so it reads done.
+    if (agentVerdictDisplayMark(retained.entry) === 'failed') {
+      summary.hasRetainedFailed = true
+    } else {
+      summary.hasRetainedDone = true
+    }
     const paneIdentity = parseAgentStatusPaneIdentity(retained.entry?.paneKey)
     if (paneIdentity) {
       addAgentStatusPaneId(summary, paneIdentity.tabId, paneIdentity.paneId)
@@ -190,9 +202,11 @@ function summariesEqual(
     previous.hasPermission === next.hasPermission &&
     previous.hasLiveWorking === next.hasLiveWorking &&
     previous.hasLiveMonitoring === next.hasLiveMonitoring &&
+    previous.hasFailed === next.hasFailed &&
     previous.hasInterrupted === next.hasInterrupted &&
     previous.hasLiveDone === next.hasLiveDone &&
     previous.hasRetainedDone === next.hasRetainedDone &&
+    previous.hasRetainedFailed === next.hasRetainedFailed &&
     agentStatusPaneIdsByTabIdEqual(
       previous.agentStatusPaneIdsByTabId,
       next.agentStatusPaneIdsByTabId
@@ -227,26 +241,6 @@ function agentStatusPaneIdsByTabIdEqual(
   return true
 }
 
-function applyLiveAgentState(
-  summary: WorktreeAgentActivitySummary,
-  entry: Pick<AgentStatusEntry, 'state' | 'workingMode' | 'interrupted'>
-): void {
-  if (entry.state === 'blocked' || entry.state === 'waiting') {
-    summary.hasPermission = true
-  } else if (entry.interrupted === true) {
-    // Interrupted is encoded as done, so it must be checked first.
-    summary.hasInterrupted = true
-  } else if (entry.state === 'working') {
-    if (entry.workingMode === 'monitoring') {
-      summary.hasLiveMonitoring = true
-    } else {
-      summary.hasLiveWorking = true
-    }
-  } else if (entry.state === 'done') {
-    summary.hasLiveDone = true
-  }
-}
-
 function addAgentStatusPaneId(
   summary: WorktreeAgentActivitySummary,
   tabId: string,
diff --git a/src/renderer/src/components/sidebar/worktree-card-agent-summary.test.ts b/src/renderer/src/components/sidebar/worktree-card-agent-summary.test.ts
index e303ed2c4027..7f1215c980a5 100644
--- a/src/renderer/src/components/sidebar/worktree-card-agent-summary.test.ts
+++ b/src/renderer/src/components/sidebar/worktree-card-agent-summary.test.ts
@@ -5,6 +5,7 @@ import { TooltipProvider } from '@/components/ui/tooltip'
 import type { DashboardAgentRow as DashboardAgentRowData } from '@/components/dashboard/useDashboardData'
 import { CompactAgentRow, getCompactAgentSecondary } from './worktree-card-compact-agent-row'
 import { getAgentDotState, summarizeAgents } from './worktree-card-agent-summary'
+import { buildSubagentChildRows } from './worktree-subagent-child-rows'
 
 function monitoringAgent(): DashboardAgentRowData {
   return {
@@ -102,4 +103,72 @@ describe('worktree card agent summary', () => {
 
     expect(summarizeAgents([done, interrupted], 'Agents')).toBe('Agents: 1 interrupted, 1 done')
   })
+
+  it('lists a failed turn as failed, not done, ahead of an interrupted one', () => {
+    const done = monitoringAgent()
+    done.state = 'done'
+    done.entry.state = 'done'
+    done.entry.workingMode = undefined
+    const failed = {
+      ...done,
+      paneKey: 'tab-1:leaf-3',
+      entry: {
+        ...done.entry,
+        paneKey: 'tab-1:leaf-3',
+        mainAgent: { state: 'done' as const, outcome: 'failure' as const, stateStartedAt: 1 }
+      }
+    }
+    const interrupted = {
+      ...done,
+      paneKey: 'tab-1:leaf-2',
+      entry: { ...done.entry, paneKey: 'tab-1:leaf-2', interrupted: true }
+    }
+
+    expect(getAgentDotState(failed)).toBe('failed')
+    expect(getCompactAgentSecondary(failed, 0)).toBe('Failed')
+    expect(getCompactAgentSecondary(interrupted, 0)).toBe('Interrupted by user')
+    expect(summarizeAgents([done, interrupted, failed], 'Agents')).toBe(
+      'Agents: 1 failed, 1 interrupted, 1 done'
+    )
+  })
+
+  it('reads a main agent that failed while its subagent works as failed, ranked above working', () => {
+    const held = (outcome: 'failure' | 'success' | 'cancellation'): DashboardAgentRowData => {
+      const agent = monitoringAgent()
+      agent.entry.workingMode = undefined
+      agent.entry.mainAgent = { state: 'done', outcome, stateStartedAt: 1 }
+      return agent
+    }
+    const working = monitoringAgent()
+    working.paneKey = 'tab-1:leaf-2'
+    working.entry = { ...working.entry, paneKey: 'tab-1:leaf-2', workingMode: undefined }
+
+    expect(getAgentDotState(held('failure'))).toBe('failed')
+    expect(getCompactAgentSecondary(held('failure'), 0)).toBe('Failed')
+    expect(summarizeAgents([working, held('failure')], 'Agents')).toBe(
+      'Agents: 1 failed, 1 working'
+    )
+    // Only a failure outranks live work; a success or a stop with a live subagent reads working.
+    expect(getAgentDotState(held('success'))).toBe('working')
+    expect(getAgentDotState(held('cancellation'))).toBe('working')
+    expect(getCompactAgentSecondary(held('cancellation'), 0)).not.toBe('Interrupted by user')
+  })
+
+  it('keeps a subagent row on its own state while its failed main agent reads failed', () => {
+    const parent = monitoringAgent()
+    parent.entry = {
+      ...parent.entry,
+      workingMode: undefined,
+      mainAgent: { state: 'done', outcome: 'failure', stateStartedAt: 1 },
+      subagents: [{ id: 'child-1', state: 'working', startedAt: 1 }]
+    }
+    const [child] = buildSubagentChildRows({
+      parentEntry: parent.entry,
+      tab: parent.tab,
+      parentIsFresh: true
+    })
+
+    expect(getAgentDotState(parent)).toBe('failed')
+    expect(getAgentDotState(child)).toBe('working')
+  })
 })
diff --git a/src/renderer/src/components/sidebar/worktree-card-agent-summary.ts b/src/renderer/src/components/sidebar/worktree-card-agent-summary.ts
index 314aa430d160..4ce3f1ad4176 100644
--- a/src/renderer/src/components/sidebar/worktree-card-agent-summary.ts
+++ b/src/renderer/src/components/sidebar/worktree-card-agent-summary.ts
@@ -2,6 +2,7 @@ import type { AgentDotState } from '@/components/AgentStateDot'
 import type { DashboardAgentRow as DashboardAgentRowData } from '@/components/dashboard/useDashboardData'
 import { formatAgentTypeLabel } from '@/lib/agent-status'
 import { agentRowDotState } from '@/lib/agent-row-dot-state'
+import { agentVerdictDisplayMark } from '../../../../shared/agent-main-agent-verdict'
 
 export type SummaryAgentGroup = {
   state: AgentDotState
@@ -11,6 +12,8 @@ export type SummaryAgentGroup = {
 const SUMMARY_STATE_ORDER: AgentDotState[] = [
   'waiting',
   'blocked',
+  // Why: a failed main agent outranks live work; a pending question still comes first.
+  'failed',
   'working',
   'monitoring',
   'interrupted',
@@ -21,10 +24,9 @@ const SUMMARY_STATE_ORDER: AgentDotState[] = [
 ]
 
 export function getAgentDotState(agent: DashboardAgentRowData): AgentDotState {
-  if (agent.entry.interrupted === true) {
-    return 'interrupted'
-  }
-  return agentRowDotState(agent.state, agent.entry.workingMode)
+  return (
+    agentVerdictDisplayMark(agent.entry) ?? agentRowDotState(agent.state, agent.entry.workingMode)
+  )
 }
 
 export function formatSummaryStateLabel(state: AgentDotState): string {
diff --git a/src/renderer/src/components/sidebar/worktree-card-compact-agent-row.tsx b/src/renderer/src/components/sidebar/worktree-card-compact-agent-row.tsx
index f0d63d5d11f9..ab043fadb449 100644
--- a/src/renderer/src/components/sidebar/worktree-card-compact-agent-row.tsx
+++ b/src/renderer/src/components/sidebar/worktree-card-compact-agent-row.tsx
@@ -14,6 +14,7 @@ import { useAgentRowConversationName } from '@/components/dashboard/use-agent-ro
 import { lastEnteredDoneAt } from '@/components/dashboard/agent-finished-timestamp'
 import CacheTimer, { usePromptCacheCountdownForPane } from './CacheTimer'
 import { formatShortTimeAgo } from '@/lib/short-time-ago'
+import { agentVerdictDisplayMark } from '../../../../shared/agent-main-agent-verdict'
 
 function getCompactAgentPrimary(
   agent: DashboardAgentRowData,
@@ -28,9 +29,13 @@ export function getCompactAgentSecondary(
   now: number,
   lastAssistantMessageOverride?: string
 ): string {
-  if (agent.entry.interrupted === true) {
+  const verdictMark = agentVerdictDisplayMark(agent.entry)
+  if (verdictMark === 'interrupted') {
     return 'Interrupted by user'
   }
+  if (verdictMark === 'failed') {
+    return 'Failed'
+  }
   // Why: the only honest thing to say about a pane Orca still holds but no longer hears
   // from is how long the silence has run; the user supplies the meaning.
   if (agent.state === 'unverifiable') {
@@ -89,6 +94,7 @@ type CompactAgentRowProps = {
   isFocusedPane?: boolean
   hideIdentityIcon?: boolean
   cacheTimerActive?: boolean
+  isUnvisited?: boolean
 }
 
 export const CompactAgentRow = React.memo(function CompactAgentRow({
@@ -104,7 +110,8 @@ export const CompactAgentRow = React.memo(function CompactAgentRow({
   disclosureInGutter = false,
   isFocusedPane = false,
   hideIdentityIcon = false,
-  cacheTimerActive = true
+  cacheTimerActive = true,
+  isUnvisited = false
 }: CompactAgentRowProps) {
   const hasChildDisclosure =
     typeof childAgentCount === 'number' &&
@@ -231,7 +238,12 @@ export const CompactAgentRow = React.memo(function CompactAgentRow({
       >
         {/* Why: the selected-row fill is strong enough to wash out the dimmed
             prompt/secondary text, so lift both toward full foreground when focused. */}
-        <span className={isFocusedPane ? 'text-foreground' : 'text-muted-foreground/90'}>
+        <span
+          className={cn(
+            isUnvisited ? 'font-semibold text-foreground' : 'font-normal text-muted-foreground/90',
+            isFocusedPane && !isUnvisited && 'text-foreground'
+          )}
+        >
           {leadingText}
         </span>
         {trailingText && (
diff --git a/src/renderer/src/components/sidebar/worktree-card-surface.tsx b/src/renderer/src/components/sidebar/worktree-card-surface.tsx
index 8d3e03ebeaa6..df0cd67b4120 100644
--- a/src/renderer/src/components/sidebar/worktree-card-surface.tsx
+++ b/src/renderer/src/components/sidebar/worktree-card-surface.tsx
@@ -51,7 +51,7 @@ export function WorktreeCardSurface({ card }: { card: WorktreeCardController }):
         'relative flex cursor-pointer flex-col pr-1.5 transition-[background-color,border-color,opacity,box-shadow] duration-200 outline-none select-none',
         titleOnlyCard ? 'py-2' : 'pt-1.25 pb-1.5',
         flushSurface ? 'ml-1 w-[calc(100%-0.25rem)]' : 'ml-1',
-        'rounded-lg',
+        'overflow-hidden rounded-lg',
         // Why: the live data attribute updates before React state during navigation,
         // so it must own the complete active style without stale utility classes.
         isLineageDropTarget
diff --git a/src/renderer/src/components/sidebar/worktree-list/listing/use-filters.ts b/src/renderer/src/components/sidebar/worktree-list/listing/use-filters.ts
index 38b15bab63e2..bb8629d7276c 100644
--- a/src/renderer/src/components/sidebar/worktree-list/listing/use-filters.ts
+++ b/src/renderer/src/components/sidebar/worktree-list/listing/use-filters.ts
@@ -96,7 +96,7 @@ export function useSidebarWorktreeFilters() {
     if (scopedHostIds && !scopedHostIds.includes(targetHostId)) {
       state.setVisibleWorkspaceHostIds([...scopedHostIds, targetHostId])
     }
-    if (state.hideDefaultBranchWorkspace && isDefaultBranchWorkspace(worktree)) {
+    if (state.hideDefaultBranchWorkspace && isDefaultBranchWorkspace(worktree, repo)) {
       state.setHideDefaultBranchWorkspace(false)
     }
     if (state.hideAutomationGeneratedWorkspaces && isAutomationGeneratedWorkspace(worktree)) {
diff --git a/src/renderer/src/components/sidebar/worktree-list/navigation/use-keyboard.focus.test.tsx b/src/renderer/src/components/sidebar/worktree-list/navigation/use-keyboard.focus.test.tsx
new file mode 100644
index 000000000000..53783410ef4b
--- /dev/null
+++ b/src/renderer/src/components/sidebar/worktree-list/navigation/use-keyboard.focus.test.tsx
@@ -0,0 +1,287 @@
+// @vitest-environment happy-dom
+import { act, useRef, useState } from 'react'
+import { createRoot, type Root } from 'react-dom/client'
+import { useVirtualizer } from '@tanstack/react-virtual'
+import { Terminal } from '@xterm/xterm'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { HostSectionRow } from '../../host-section-rows'
+import { repo, worktree } from '../../worktree-list-groups-test-fixtures'
+import { focusPanePreservingOverlays } from '@/lib/pane-manager/pane-overlay-focus'
+import { getShortcutPlatform } from '@/lib/shortcut-platform'
+
+const state = {
+  keybindings: undefined,
+  activeView: 'terminal',
+  activeTabType: 'terminal',
+  activeWorktreeId: 'a',
+  activeTabId: 'tab-a',
+  tabsByWorktree: {
+    a: [{ id: 'tab-a' }],
+    b: [{ id: 'tab-b' }],
+    c: [{ id: 'tab-c' }],
+    'folder:one': [{ id: 'folder-tab' }]
+  }
+}
+const activate = vi.fn()
+const focusRuntime = vi.fn()
+vi.mock('@/store', () => ({
+  useAppStore: Object.assign((selector: (s: typeof state) => unknown) => selector(state), {
+    getState: () => state
+  })
+}))
+vi.mock('@/lib/worktree-activation', () => ({
+  activateAndRevealWorktree: (...args: unknown[]) => activate(...args)
+}))
+vi.mock('@/runtime/sync-runtime-graph', () => ({
+  focusRuntimeTerminalSurface: (...args: unknown[]) => focusRuntime(...args)
+}))
+const { useWorktreeListKeyboardNavigation } = await import('./use-keyboard')
+Object.assign(globalThis, { IS_REACT_ACT_ENVIRONMENT: true })
+
+const rows: HostSectionRow[] = ['a', 'b', 'c'].map((id) => ({
+  type: 'item',
+  rowKey: id,
+  sectionKey: repo.id,
+  worktree: { ...worktree, id, hostId: 'ssh:fixture' },
+  repo,
+  depth: 0,
+  groupDepth: 0,
+  lineageTrail: [],
+  isLastLineageChild: false,
+  lineageChildCount: 0
+}))
+let root: Root
+let container: HTMLDivElement
+let list: HTMLDivElement
+let terminal: Terminal
+let textarea: HTMLTextAreaElement
+let autoFocus: () => void
+let modal = 'none'
+
+function Probe() {
+  const scrollRef = useRef<HTMLDivElement>(null)
+  const [activeId, setActiveId] = useState(state.activeWorktreeId)
+  const virtualizer = useVirtualizer<HTMLDivElement, HTMLDivElement>({
+    count: rows.length,
+    getScrollElement: () => scrollRef.current,
+    estimateSize: () => 30
+  })
+  activate.mockImplementation((id: string) => {
+    state.activeWorktreeId = id
+    state.activeTabId = `tab-${id}`
+    setActiveId(id)
+    autoFocus()
+  })
+  const { handleContainerKeyDown } = useWorktreeListKeyboardNavigation({
+    rows,
+    renderRows: rows,
+    activeWorktreeId: activeId,
+    activeWorkspaceExecutionHostId: 'ssh:fixture',
+    pinnedDisplayPolicy: 'single-location',
+    virtualizer,
+    scrollRef,
+    activeModal: modal,
+    markDirectScrollInput: () => {}
+  })
+  return (
+    <div
+      ref={scrollRef}
+      data-worktree-sidebar
+      role="listbox"
+      tabIndex={0}
+      onKeyDown={handleContainerKeyDown}
+    >
+      <button>Row action</button>
+    </div>
+  )
+}
+
+function press(key: string, init: KeyboardEventInit = {}, target: HTMLElement = list) {
+  act(() => {
+    target.dispatchEvent(
+      new KeyboardEvent('keydown', { key, code: key, bubbles: true, cancelable: true, ...init })
+    )
+  })
+}
+
+beforeEach(() => {
+  Object.assign(state, {
+    activeView: 'terminal',
+    activeTabType: 'terminal',
+    activeWorktreeId: 'a',
+    activeTabId: 'tab-a'
+  })
+  activate.mockReset()
+  focusRuntime.mockReset()
+  modal = 'none'
+  container = document.createElement('div')
+  textarea = document.createElement('textarea')
+  textarea.className = 'xterm-helper-textarea'
+  document.body.append(container, textarea)
+  terminal = new Terminal()
+  vi.spyOn(terminal, 'focus').mockImplementation(() => textarea.focus())
+  autoFocus = () => focusPanePreservingOverlays({ container, terminal })
+  root = createRoot(container)
+  act(() => root.render(<Probe />))
+  const element = container.querySelector('[data-worktree-sidebar]')
+  if (!(element instanceof HTMLDivElement)) {
+    throw new Error('List missing')
+  }
+  list = element
+  list.focus()
+})
+
+afterEach(() => {
+  act(() => root.unmount())
+  terminal.dispose()
+  vi.restoreAllMocks()
+  document.body.innerHTML = ''
+})
+
+describe('workspace list focus ownership', () => {
+  it('keeps repeated arrows in the list across activation and rerenders', () => {
+    press('ArrowDown')
+    expect(document.activeElement).toBe(list)
+    press('ArrowDown')
+    expect(document.activeElement).toBe(list)
+    press('ArrowUp')
+    expect(activate.mock.calls.map(([id]) => id)).toEqual(['b', 'c', 'b'])
+    expect(activate).toHaveBeenLastCalledWith('b', { executionHostId: 'ssh:fixture' })
+    expect(terminal.focus).not.toHaveBeenCalled()
+  })
+
+  it('keeps delayed terminal readiness from taking focus', () => {
+    autoFocus = () => {}
+    press('ArrowDown')
+    focusPanePreservingOverlays({ container, terminal })
+    expect(document.activeElement).toBe(list)
+  })
+
+  it.each(['inside', 'outside'])(
+    'releases ownership before an explicit %s pointer action',
+    (where) => {
+      press('ArrowDown')
+      const target = where === 'inside' ? list : textarea
+      target.dispatchEvent(new Event('pointerdown', { bubbles: true }))
+      focusPanePreservingOverlays({ container, terminal })
+      expect(document.activeElement).toBe(textarea)
+    }
+  )
+
+  it('does not revive old ownership when leaving and reentering the list', () => {
+    press('ArrowDown')
+    textarea.focus()
+    list.focus()
+    focusPanePreservingOverlays({ container, terminal })
+    expect(document.activeElement).toBe(textarea)
+  })
+
+  it('drops ownership when the list unmounts and remounts', () => {
+    press('ArrowDown')
+    act(() => root.render(null))
+    focusPanePreservingOverlays({ container, terminal })
+    expect(document.activeElement).toBe(textarea)
+    act(() => root.render(<Probe />))
+    container.querySelector<HTMLElement>('[data-worktree-sidebar]')?.focus()
+    focusPanePreservingOverlays({ container, terminal })
+    expect(document.activeElement).toBe(textarea)
+  })
+
+  it.each(['Mac', 'Windows', 'Linux'])(
+    'keeps CmdOrCtrl cycling as terminal navigation on %s',
+    (platform) => {
+      vi.spyOn(navigator, 'userAgent', 'get').mockReturnValue(platform)
+      press('ArrowDown')
+      const mod = getShortcutPlatform() === 'darwin' ? { metaKey: true } : { ctrlKey: true }
+      press('ArrowDown', { ...mod, shiftKey: true })
+      expect(activate.mock.calls.map(([id]) => id)).toEqual(['b', 'c'])
+      expect(document.activeElement).toBe(textarea)
+    }
+  )
+
+  it('does not navigate while an application modal is active', () => {
+    modal = 'settings'
+    act(() => root.render(<Probe />))
+    press('ArrowDown')
+    press('Enter')
+    expect(activate).not.toHaveBeenCalled()
+    expect(focusRuntime).not.toHaveBeenCalled()
+  })
+
+  it.each(['dialog', 'menu'])('does not navigate behind a visible %s', (role) => {
+    const overlay = document.createElement('div')
+    overlay.setAttribute('role', role)
+    document.body.append(overlay)
+    press('ArrowDown')
+    press('Enter')
+    expect(activate).not.toHaveBeenCalled()
+    expect(focusRuntime).not.toHaveBeenCalled()
+    expect(document.activeElement).toBe(list)
+  })
+
+  it('does not consume Enter from a row action', () => {
+    const button = list.querySelector('button')
+    if (!button) {
+      throw new Error('Button missing')
+    }
+    button.focus()
+    press('Enter', {}, button)
+    expect(document.activeElement).toBe(button)
+    expect(focusRuntime).not.toHaveBeenCalled()
+  })
+
+  it('asks the workspace-scoped pane API to focus the selected active pane', () => {
+    press('ArrowDown')
+    focusRuntime.mockImplementation(() => {
+      textarea.focus()
+      return true
+    })
+    press('Enter')
+    expect(focusRuntime).toHaveBeenCalledWith('tab-b', null, 'b')
+    expect(document.activeElement).toBe(textarea)
+    expect(list.hasAttribute('data-keyboard-navigation')).toBe(false)
+  })
+
+  it('uses folder workspace identity when handing focus to its terminal', () => {
+    Object.assign(state, { activeWorktreeId: 'folder:one', activeTabId: 'folder-tab' })
+    press('Enter')
+    expect(focusRuntime).toHaveBeenCalledWith('folder-tab', null, 'folder:one')
+  })
+
+  it.each([false, true])(
+    'keeps ownership when Enter returns %s without moving focus',
+    (handled) => {
+      press('ArrowDown')
+      focusRuntime.mockReturnValue(handled)
+      press('Enter')
+      expect(document.activeElement).toBe(list)
+      focusPanePreservingOverlays({ container, terminal })
+      expect(document.activeElement).toBe(list)
+      expect(terminal.focus).not.toHaveBeenCalled()
+    }
+  )
+
+  it.each(['editor', 'browser', 'agent', 'empty', 'unowned', 'unmounted', 'other-view'])(
+    'leaves focus in the list for %s targets instead of another terminal',
+    (target) => {
+      if (['editor', 'browser', 'agent'].includes(target)) {
+        state.activeTabType = target
+      }
+      if (target === 'empty') {
+        state.activeWorktreeId = ''
+      }
+      if (target === 'unowned') {
+        state.activeTabId = 'tab-b'
+      }
+      if (target === 'other-view') {
+        state.activeView = 'settings'
+      }
+      focusRuntime.mockReturnValue(false)
+      press('Enter')
+      expect(document.activeElement).toBe(list)
+      if (target !== 'unmounted') {
+        expect(focusRuntime).not.toHaveBeenCalled()
+      }
+    }
+  )
+})
diff --git a/src/renderer/src/components/sidebar/worktree-list/navigation/use-keyboard.ts b/src/renderer/src/components/sidebar/worktree-list/navigation/use-keyboard.ts
index c8d3ec5d80d4..cff03054692b 100644
--- a/src/renderer/src/components/sidebar/worktree-list/navigation/use-keyboard.ts
+++ b/src/renderer/src/components/sidebar/worktree-list/navigation/use-keyboard.ts
@@ -3,6 +3,8 @@ import type React from 'react'
 import type { Virtualizer } from '@tanstack/react-virtual'
 import { useAppStore } from '@/store'
 import { activateAndRevealWorktree } from '@/lib/worktree-activation'
+import { focusRuntimeTerminalSurface } from '@/runtime/sync-runtime-graph'
+import { hasVisibleOverlay } from '@/lib/visible-overlay'
 import type { ExecutionHostId } from '../../../../../../shared/execution-host'
 import { getShortcutPlatform } from '@/lib/shortcut-platform'
 import { keybindingMatchesAction } from '../../../../../../shared/keybindings'
@@ -112,13 +114,19 @@ export function useWorktreeListKeyboardNavigation(args: {
   )
 
   useEffect(() => {
+    const endListNavigation = () => {
+      scrollRef.current?.removeAttribute('data-keyboard-navigation')
+    }
     const handleKeyDown = (e: KeyboardEvent) => {
       if (activeModal !== 'none' || isEditableTarget(e.target)) {
         return
       }
 
       const platform = getShortcutPlatform()
-      if (keybindingMatchesAction('sidebar.focusWorktreeList', e, platform, keybindings)) {
+      if (
+        keybindingMatchesAction('sidebar.focusWorktreeList', e, platform, keybindings) &&
+        !hasVisibleOverlay()
+      ) {
         scrollRef.current?.focus()
         e.preventDefault()
         return
@@ -129,7 +137,8 @@ export function useWorktreeListKeyboardNavigation(args: {
         : keybindingMatchesAction('worktree.navigateDown', e, platform, keybindings)
           ? 'down'
           : null
-      if (direction) {
+      if (direction && !hasVisibleOverlay()) {
+        endListNavigation()
         markDirectScrollInput()
         navigateWorktree(direction)
         e.preventDefault()
@@ -137,31 +146,50 @@ export function useWorktreeListKeyboardNavigation(args: {
     }
 
     window.addEventListener('keydown', handleKeyDown, { capture: true })
-    return () => window.removeEventListener('keydown', handleKeyDown, { capture: true })
+    window.addEventListener('pointerdown', endListNavigation, { capture: true })
+    window.addEventListener('focusout', endListNavigation, { capture: true })
+    return () => {
+      window.removeEventListener('keydown', handleKeyDown, { capture: true })
+      window.removeEventListener('pointerdown', endListNavigation, { capture: true })
+      window.removeEventListener('focusout', endListNavigation, { capture: true })
+    }
   }, [activeModal, keybindings, markDirectScrollInput, navigateWorktree, scrollRef])
 
   const handleContainerKeyDown = useCallback(
     (e: React.KeyboardEvent) => {
+      if (
+        e.defaultPrevented ||
+        e.target !== e.currentTarget ||
+        activeModal !== 'none' ||
+        hasVisibleOverlay()
+      ) {
+        return
+      }
       if (e.key === 'ArrowUp' || e.key === 'ArrowDown') {
-        if (e.target !== e.currentTarget) {
-          return
-        }
+        // The focused DOM node owns navigation, including while a new terminal mounts.
+        e.currentTarget.setAttribute('data-keyboard-navigation', '')
         markDirectScrollInput()
         navigateWorktree(e.key === 'ArrowUp' ? 'up' : 'down')
         e.preventDefault()
       } else if (e.key === 'Enter') {
-        const helper = document.querySelector(
-          '.xterm-helper-textarea'
-        ) as HTMLTextAreaElement | null
-        if (helper) {
-          helper.focus()
+        const { activeView, activeWorktreeId, activeTabType, activeTabId, tabsByWorktree } =
+          useAppStore.getState()
+        if (
+          activeView === 'terminal' &&
+          activeTabType === 'terminal' &&
+          activeWorktreeId &&
+          activeTabId &&
+          tabsByWorktree[activeWorktreeId]?.some((tab) => tab.id === activeTabId)
+        ) {
+          // The registered manager owns the active split; unavailable surfaces keep list focus.
+          focusRuntimeTerminalSurface(activeTabId, null, activeWorktreeId)
         }
         e.preventDefault()
       } else if (['PageUp', 'PageDown', 'Home', 'End', ' '].includes(e.key)) {
         markDirectScrollInput()
       }
     },
-    [markDirectScrollInput, navigateWorktree]
+    [activeModal, markDirectScrollInput, navigateWorktree]
   )
 
   return { handleContainerKeyDown }
diff --git a/src/renderer/src/components/sidebar/worktree-snapshot-prune-batch.ts b/src/renderer/src/components/sidebar/worktree-snapshot-prune-batch.ts
index 91e970291fd8..f8cbd049cf87 100644
--- a/src/renderer/src/components/sidebar/worktree-snapshot-prune-batch.ts
+++ b/src/renderer/src/components/sidebar/worktree-snapshot-prune-batch.ts
@@ -1,3 +1,5 @@
+import { createBrowserUuid } from '@/lib/browser-uuid'
+
 export type WorktreeSnapshotPruneBatch = {
   batchId: string
   finish: () => Promise<void>
@@ -14,7 +16,7 @@ export function beginWorktreeSnapshotPruneBatch(): Promise<WorktreeSnapshotPrune
   if (typeof begin !== 'function' || typeof record !== 'function' || typeof finish !== 'function') {
     return null
   }
-  const batchId = crypto.randomUUID()
+  const batchId = createBrowserUuid()
   return begin({ batchId })
     .then(() => ({ batchId, finish: () => finish({ batchId }) }))
     .catch((error: unknown) => {
diff --git a/src/renderer/src/components/skills/SkillBundleInstallFlow.tsx b/src/renderer/src/components/skills/SkillBundleInstallFlow.tsx
index 3663ac4e81a4..e4115f5ba133 100644
--- a/src/renderer/src/components/skills/SkillBundleInstallFlow.tsx
+++ b/src/renderer/src/components/skills/SkillBundleInstallFlow.tsx
@@ -24,6 +24,7 @@ import { translate } from '@/i18n/i18n'
 import { checklistItemsFromVersion } from './skill-package-checklist-items'
 import { summarizeSkillInstallRisk } from './skill-package-install-risk'
 import { retryableSkillIds } from './skill-bundle-retry-selection'
+import { createBrowserUuid } from '@/lib/browser-uuid'
 
 type BundleVersion = SkillCloudVersion & {
   manifest: Extract<SkillCloudVersion['manifest'], { skills: unknown }>
@@ -169,7 +170,7 @@ export function SkillBundleInstallFlow(props: {
           return
         }
       }
-      const operationId = crypto.randomUUID()
+      const operationId = createBrowserUuid()
       installProgress.begin(operationId)
       const operation = await window.api.skills.installBundleShare({
         shareId: props.shareId,
diff --git a/src/renderer/src/components/skills/SkillInstallDialog.tsx b/src/renderer/src/components/skills/SkillInstallDialog.tsx
index 6ad6edcbedfd..8f150708ee90 100644
--- a/src/renderer/src/components/skills/SkillInstallDialog.tsx
+++ b/src/renderer/src/components/skills/SkillInstallDialog.tsx
@@ -26,6 +26,7 @@ import { translate } from '@/i18n/i18n'
 import { resolveSkillShareForInstall } from './skill-warning-preview-gate'
 import { useSkillInstallRisk } from './use-skill-install-risk'
 import { SkillInstallDialogFooter } from './SkillInstallDialogFooter'
+import { createBrowserUuid } from '@/lib/browser-uuid'
 
 export function SkillInstallDialog({
   open,
@@ -193,7 +194,7 @@ export function SkillInstallDialog({
           return
         }
       }
-      const operationId = crypto.randomUUID()
+      const operationId = createBrowserUuid()
       installProgress.begin(operationId)
       const operation = await window.api.skills.installShare({
         shareId: preview.shareId,
diff --git a/src/renderer/src/components/skills/SkillInstallManagementDialog.tsx b/src/renderer/src/components/skills/SkillInstallManagementDialog.tsx
index d1a6016655f3..7dabac57dfe9 100644
--- a/src/renderer/src/components/skills/SkillInstallManagementDialog.tsx
+++ b/src/renderer/src/components/skills/SkillInstallManagementDialog.tsx
@@ -17,6 +17,7 @@ import {
 } from './skill-managed-install-groups'
 import { translate } from '@/i18n/i18n'
 import { SkillInstallManagementDialogContent } from './SkillInstallManagementDialogContent'
+import { createBrowserUuid } from '@/lib/browser-uuid'
 
 export function SkillInstallManagementDialog({
   open,
@@ -158,7 +159,7 @@ export function SkillInstallManagementDialog({
     setBusy(true)
     setError(null)
     setNotice(null)
-    const operationId = crypto.randomUUID()
+    const operationId = createBrowserUuid()
     installProgress.begin(operationId)
     try {
       const version = details?.versions.find((candidate) => candidate.versionId === versionId)
diff --git a/src/renderer/src/components/skills/use-skill-delete-flow.ts b/src/renderer/src/components/skills/use-skill-delete-flow.ts
index 654cefedc6d6..1ca6f6035de6 100644
--- a/src/renderer/src/components/skills/use-skill-delete-flow.ts
+++ b/src/renderer/src/components/skills/use-skill-delete-flow.ts
@@ -22,6 +22,7 @@ import {
   skillDeletePlacementSummary,
   skillDeleteRetainedSourceLines
 } from './skill-delete-copy'
+import { createBrowserUuid } from '@/lib/browser-uuid'
 
 export type SkillDeleteFlow = {
   /** False while the target is unresolved or the host predates the capability. */
@@ -38,7 +39,7 @@ export type SkillDeleteFlow = {
 
 function toRequest(skills: readonly DiscoveredSkill[]): SkillDeleteRequest {
   return {
-    operationId: crypto.randomUUID(),
+    operationId: createBrowserUuid(),
     skills: skills.map((skill) => ({
       id: skill.id,
       directoryPath: skill.directoryPath,
diff --git a/src/renderer/src/components/star-nag/StarNagAgentValueMomentObserver.test.tsx b/src/renderer/src/components/star-nag/StarNagAgentValueMomentObserver.test.tsx
index 3a689eac09a2..846b3fa9034a 100644
--- a/src/renderer/src/components/star-nag/StarNagAgentValueMomentObserver.test.tsx
+++ b/src/renderer/src/components/star-nag/StarNagAgentValueMomentObserver.test.tsx
@@ -177,6 +177,36 @@ describe('StarNagAgentValueMomentObserver', () => {
     expect(showAgentValueMoment).not.toHaveBeenCalled()
   })
 
+  it('ignores a prompted done whose turn failed', async () => {
+    ;({ root, container } = renderObserver())
+
+    setAgentEntries({ pane: entry({ state: 'working' }) })
+    setAgentEntries({
+      pane: entry({
+        state: 'done',
+        mainAgent: { state: 'done', outcome: 'failure', stateStartedAt: 1 }
+      })
+    })
+    await act(async () => {
+      vi.advanceTimersByTime(2400)
+    })
+
+    expect(agentValueMoment).not.toHaveBeenCalled()
+  })
+
+  it('ignores a return to a done dated before the work it ended', async () => {
+    ;({ root, container } = renderObserver())
+
+    setAgentEntries({ pane: entry({ state: 'done', stateStartedAt: 1 }) })
+    setAgentEntries({ pane: entry({ state: 'working', stateStartedAt: 5 }) })
+    setAgentEntries({ pane: entry({ state: 'done', stateStartedAt: 1 }) })
+    await act(async () => {
+      vi.advanceTimersByTime(2400)
+    })
+
+    expect(agentValueMoment).not.toHaveBeenCalled()
+  })
+
   it('waits for other live agents and recent typing to quiet', async () => {
     ;({ root, container } = renderObserver())
 
diff --git a/src/renderer/src/components/star-nag/StarNagAgentValueMomentObserver.tsx b/src/renderer/src/components/star-nag/StarNagAgentValueMomentObserver.tsx
index 42f6145b1f38..ace4491a13c3 100644
--- a/src/renderer/src/components/star-nag/StarNagAgentValueMomentObserver.tsx
+++ b/src/renderer/src/components/star-nag/StarNagAgentValueMomentObserver.tsx
@@ -1,5 +1,6 @@
 import { useCallback, useEffect, useRef } from 'react'
 import type { AgentStatusEntry } from '../../../../shared/agent-status-types'
+import { agentTurnEndedUncleanly } from '../../../../shared/agent-main-agent-verdict'
 import { useAppStore } from '@/store'
 
 // Why: leave a short quiet window after agents finish so the prompt does not
@@ -36,7 +37,9 @@ function hasSuccessfulDoneTransition(
       // Why: a session-boundary done is an idle connect (STA-3386), not a value moment —
       // a stale working row + resume would otherwise nag on launch.
       entry.sessionBoundary !== true &&
-      !entry.interrupted &&
+      !agentTurnEndedUncleanly(entry) &&
+      // A new done, not a return to one dated before the work it ended (a command at rest).
+      entry.stateStartedAt >= previousEntry.stateStartedAt &&
       hasMeaningfulPrompt(entry)
     ) {
       return true
diff --git a/src/renderer/src/components/status-bar/StatusBarProviderSegment.tsx b/src/renderer/src/components/status-bar/StatusBarProviderSegment.tsx
index 24de1094534f..f3aaa6cbeded 100644
--- a/src/renderer/src/components/status-bar/StatusBarProviderSegment.tsx
+++ b/src/renderer/src/components/status-bar/StatusBarProviderSegment.tsx
@@ -6,11 +6,19 @@ import {
   type UsagePercentageDisplay
 } from '../../../../shared/usage-percentage-display'
 import type { StatusBarUsageMode } from '../../../../shared/status-bar-usage-mode'
-import { ProviderIcon, clampUsedPercent, getProviderUsageStatusLabel } from './tooltip'
+import {
+  ProviderIcon,
+  USAGE_URGENT_PERCENT,
+  USAGE_WARNING_PERCENT,
+  clampUsedPercent,
+  getProviderDisplayName,
+  getProviderUsageStatusLabel
+} from './tooltip'
 import { getTightestUsageSection } from './UsageRosterPanel'
 import { formatRateLimitWindowChipLabel } from '@/lib/window-label-formatter'
 import { formatUsagePercentageLabel } from './usage-percentage-label'
 import { translate } from '@/i18n/i18n'
+import { isCursorUsageBucket } from '../../../../shared/cursor-usage-buckets'
 
 function MiniBar({
   usedPct,
@@ -66,6 +74,65 @@ export function ProviderLetterBadge({ p }: { p: ProviderRateLimits }): React.JSX
   )
 }
 
+export type UsageTone = 'urgent' | 'warning' | 'normal'
+
+/** Urgency by consumption, matching the usage bar colors, whatever % display the user chose. */
+export function getUsageTone(p: ProviderRateLimits): UsageTone {
+  const tightest = getTightestUsageSection(p)
+  const used = tightest ? clampUsedPercent(tightest.window.usedPercent) : 0
+  return used >= USAGE_URGENT_PERCENT
+    ? 'urgent'
+    : used >= USAGE_WARNING_PERCENT
+      ? 'warning'
+      : 'normal'
+}
+
+/**
+ * Stands in for usage chips a narrow bar can't fit. Always rendered at the collapsing
+ * density so its width is known before anything collapses; out of the row while empty.
+ */
+export function UsageOverflowChip({
+  hidden,
+  display
+}: {
+  hidden: readonly ProviderRateLimits[]
+  display: UsagePercentageDisplay
+}): React.JSX.Element {
+  const tones = hidden.map(getUsageTone)
+  const tone = tones.includes('urgent')
+    ? 'urgent'
+    : tones.includes('warning')
+      ? 'warning'
+      : 'normal'
+  const names = hidden
+    .map((p) => {
+      const tightest = getTightestUsageSection(p)
+      const name = getProviderDisplayName(p.provider)
+      return tightest
+        ? `${name} ${formatUsagePercentageLabel(tightest.window.usedPercent, display)}`
+        : name
+    })
+    .join(', ')
+  return (
+    <span
+      data-usage-more
+      data-usage-collapsed={hidden.length === 0}
+      data-tone={tone}
+      aria-hidden={hidden.length === 0}
+      title={translate(
+        'auto.components.status.bar.StatusBar.hiddenUsageProviders',
+        'Also: {{value0}}',
+        {
+          value0: names
+        }
+      )}
+      className="inline-flex h-4 items-center rounded-full border border-border px-1.5 text-[11px] font-medium tabular-nums text-foreground data-[tone=urgent]:border-destructive/40 data-[tone=urgent]:text-destructive data-[tone=warning]:border-status-warning-border data-[tone=warning]:text-status-warning data-[usage-collapsed=true]:invisible data-[usage-collapsed=true]:absolute"
+    >
+      +{Math.max(1, hidden.length)}
+    </span>
+  )
+}
+
 function getProviderLetter(provider: ProviderRateLimits['provider']): string {
   switch (provider) {
     case 'claude':
@@ -82,6 +149,10 @@ function getProviderLetter(provider: ProviderRateLimits['provider']): string {
       return 'M'
     case 'grok':
       return 'R'
+    case 'cursor':
+      return 'U'
+    case 'zcode':
+      return 'Z'
     case 'codex':
       return 'X'
   }
@@ -94,6 +165,12 @@ function getProviderLetter(provider: ProviderRateLimits['provider']): string {
 // Why: Gemini exposes extra experimental buckets that made the pre-existing verbose footer noisy.
 const STATUS_BAR_BUCKET_NAMES = new Set(['Flash', 'Pro', '1.5 Pro'])
 
+// Why: the allowlist above is Gemini's. Cursor's pools are its whole meter — filtering
+// them out leaves a signed-in account with an icon and no number at all.
+function isVisibleStatusBarBucket(name: string): boolean {
+  return STATUS_BAR_BUCKET_NAMES.has(name) || isCursorUsageBucket(name)
+}
+
 function VerboseProviderUsage({
   p,
   display
@@ -102,7 +179,10 @@ function VerboseProviderUsage({
   display: UsagePercentageDisplay
 }): React.JSX.Element {
   if (p.buckets && p.buckets.length > 0) {
-    const visibleBuckets = p.buckets.filter((bucket) => STATUS_BAR_BUCKET_NAMES.has(bucket.name))
+    const visibleBuckets = p.buckets.filter((bucket) => isVisibleStatusBarBucket(bucket.name))
+    // Why: a provider whose buckets are all filtered out still has a headline
+    // window worth showing rather than rendering an empty segment.
+    const fallbackWindow = p.session ?? p.monthly ?? null
     return (
       <>
         {visibleBuckets.map((bucket, index) => (
@@ -113,10 +193,10 @@ function VerboseProviderUsage({
             </span>
           </React.Fragment>
         ))}
-        {visibleBuckets.length === 0 && p.session ? (
+        {visibleBuckets.length === 0 && fallbackWindow ? (
           <WindowLabel
-            w={p.session}
-            label={formatRateLimitWindowChipLabel(p.session)}
+            w={fallbackWindow}
+            label={formatRateLimitWindowChipLabel(fallbackWindow)}
             display={display}
           />
         ) : null}
diff --git a/src/renderer/src/components/status-bar/StatusBarSurface.tsx b/src/renderer/src/components/status-bar/StatusBarSurface.tsx
index dfdcbb926db7..844eeabe5045 100644
--- a/src/renderer/src/components/status-bar/StatusBarSurface.tsx
+++ b/src/renderer/src/components/status-bar/StatusBarSurface.tsx
@@ -8,7 +8,6 @@ import {
   DropdownMenuTrigger
 } from '@/components/ui/dropdown-menu'
 import { translate } from '@/i18n/i18n'
-import { getProviderDisplayName } from './tooltip'
 import { UsageRosterPanel } from './UsageRosterPanel'
 import { getUsageProviderAccountsSectionId } from './usage-provider-settings-target'
 import {
@@ -27,7 +26,7 @@ import { FloatingTerminalIconContextMenu } from '@/components/floating-terminal/
 import { ClaudeSwitcherMenu } from './ClaudeSwitcherMenu'
 import { CodexSwitcherMenu } from './CodexSwitcherMenu'
 import { ProviderDetailsMenu, CLOSE_ALL_CONTEXT_MENUS_EVENT } from './ProviderDetailsMenu'
-import { ProviderLetterBadge, ProviderSegment } from './StatusBarProviderSegment'
+import { ProviderSegment, UsageOverflowChip, getUsageTone } from './StatusBarProviderSegment'
 import { useStatusBarController } from './use-status-bar-controller'
 import { StatusBarVisibilityMenu } from './StatusBarVisibilityMenu'
 import { isPairedWebClientWindow } from '@/lib/desktop-window-chrome'
@@ -61,8 +60,10 @@ export function StatusBarSurface({
   const {
     anyFetching,
     anyVisible,
+    barRef,
+    collapseUsage,
+    collapsedUsageProviders,
     compact,
-    containerRefCallback,
     floatingTerminalActionLabel,
     floatingTerminalShortcut,
     handleManageAccounts,
@@ -71,11 +72,13 @@ export function StatusBarSurface({
     handleUsageDetails,
     handleUsageMenuOpenChange,
     hasVisibleUsageMeters,
-    iconOnly,
     isEmptyUsageState,
     isRefreshing,
+    overflowing,
     petEnabled,
     rosterProviders,
+    segmentsIconOnly,
+    segmentsRef,
     setMenuOpen,
     setMenuPoint,
     setStatusBarUsageMode,
@@ -88,13 +91,16 @@ export function StatusBarSurface({
     statusBarUsageMode,
     usageMenuFocusHandoff,
     usageMenuOpen,
-    usagePercentageDisplay
+    usagePercentageDisplay,
+    usageRef,
+    usageTightestOnly
   } = controller
 
   return (
     <div
-      ref={containerRefCallback}
-      className="flex items-center h-6 min-h-[24px] px-3 gap-4 border-t border-border bg-[var(--bg-titlebar,var(--card))] text-xs select-none shrink-0 relative"
+      ref={barRef}
+      // Why: one line at any width — density steps down first. overflow-clip (not hidden) so focus can't scroll the bar; the clip margin spares focus rings and badge dots.
+      className="flex items-center h-6 min-h-[24px] px-3 gap-4 overflow-clip [overflow-clip-margin:3px] whitespace-nowrap border-t border-border bg-[var(--bg-titlebar,var(--card))] text-xs select-none shrink-0 relative"
       onContextMenuCapture={(event) => {
         if (!shouldOpenStatusBarContextMenu(event.target)) {
           return
@@ -107,193 +113,217 @@ export function StatusBarSurface({
         setMenuOpen(true)
       }}
     >
-      <div className="flex items-center gap-3">
-        {isEmptyUsageState ? (
-          showEmptyUsageCta ? (
-            <StatusBarUsageEmptyCta />
-          ) : null
-        ) : hasVisibleUsageMeters ? (
-          // Consolidated roster pill → opens the all-agents Usage popover (mock parity).
-          <UsagePercentageDisplayChangeNotice hasVisibleUsageMeters={hasVisibleUsageMeters}>
-            <DropdownMenu
-              open={usageMenuOpen}
-              onOpenChange={handleUsageMenuOpenChange}
-              modal={false}
-            >
-              <DropdownMenuTrigger asChild>
-                <button
-                  type="button"
-                  className="inline-flex items-center gap-3 rounded px-1 py-0.5 hover:bg-accent/70"
-                  aria-label={translate(
-                    'auto.components.status.bar.UsageRosterPanel.title',
-                    'Usage'
-                  )}
-                >
-                  {rosterProviders.map((p) =>
-                    iconOnly ? (
-                      // Narrow status bar: fall back to main's compact letter badge.
-                      <span key={p.provider} title={getProviderDisplayName(p.provider)}>
-                        <ProviderLetterBadge p={p} />
-                      </span>
-                    ) : (
-                      <ProviderSegment
-                        key={p.provider}
-                        p={p}
-                        compact={compact}
-                        display={usagePercentageDisplay}
-                        mode={statusBarUsageMode}
-                      />
-                    )
-                  )}
-                </button>
-              </DropdownMenuTrigger>
-              <DropdownMenuContent
-                {...STATUS_BAR_CONTEXT_MENU_EXEMPT_PROPS}
-                side="top"
-                align="start"
-                sideOffset={8}
-                // Keep the popover (and its drill-in submenus) above the status
-                // bar instead of overlapping it — bottom padding ≈ footer height.
-                collisionPadding={{ top: 8, bottom: 32, left: 8, right: 8 }}
-                className="w-[360px] p-0"
-                onPointerDownOutside={usageMenuFocusHandoff.onPointerDownOutside}
-                onCloseAutoFocus={usageMenuFocusHandoff.onCloseAutoFocus}
+      {/* Why: usage gives way first — what it drops stays one click away in its popover. */}
+      <div
+        className="status-bar-usage-cluster flex min-w-0 flex-1 items-center overflow-clip [overflow-clip-margin:3px]"
+        data-overflowing={overflowing}
+      >
+        <div ref={usageRef} className="flex shrink-0 items-center gap-3">
+          {isEmptyUsageState ? (
+            showEmptyUsageCta ? (
+              <StatusBarUsageEmptyCta />
+            ) : null
+          ) : hasVisibleUsageMeters ? (
+            // Consolidated roster pill → opens the all-agents Usage popover (mock parity).
+            <UsagePercentageDisplayChangeNotice hasVisibleUsageMeters={hasVisibleUsageMeters}>
+              <DropdownMenu
+                open={usageMenuOpen}
+                onOpenChange={handleUsageMenuOpenChange}
+                modal={false}
               >
-                <UsageRosterPanel
-                  providers={rosterProviders}
-                  display={usagePercentageDisplay}
-                  statusBarUsageMode={statusBarUsageMode}
-                  onStatusBarUsageModeChange={setStatusBarUsageMode}
-                  isRefreshing={isRefreshing || anyFetching}
-                  onRefresh={handleRefresh}
-                  onOpenProvider={handleOpenProviderAccounts}
-                  onSignIn={handleOpenProviderAccounts}
-                  canSignIn={(provider) => getUsageProviderAccountsSectionId(provider) !== null}
-                  onManageAccounts={handleManageAccounts}
-                  onUsageDetails={handleUsageDetails}
-                  renderRow={(p, rowNode) => {
-                    // Every provider drills into its detail panel (parity with the
-                    // per-provider dropdowns on main); Claude/Codex additionally get
-                    // the account switcher + runtime toggle + Codex reset credits.
-                    if (p.provider === 'claude') {
-                      return (
-                        <ClaudeSwitcherMenu
-                          claude={p}
+                <DropdownMenuTrigger asChild>
+                  <button
+                    type="button"
+                    className="inline-flex items-center gap-3 rounded px-1 py-0.5 hover:bg-accent/70"
+                    aria-label={translate(
+                      'auto.components.status.bar.UsageRosterPanel.title',
+                      'Usage'
+                    )}
+                  >
+                    {rosterProviders.map((p) => (
+                      // Why: collapsed chips leave the row but stay measurable, so the density hook can bring them back.
+                      <span
+                        key={p.provider}
+                        data-usage-chip={p.provider}
+                        data-usage-urgent={getUsageTone(p) === 'urgent'}
+                        data-usage-collapsed={collapsedUsageProviders.includes(p.provider)}
+                        aria-hidden={collapsedUsageProviders.includes(p.provider)}
+                        className="inline-flex data-[usage-collapsed=true]:invisible data-[usage-collapsed=true]:absolute"
+                      >
+                        <ProviderSegment
+                          p={p}
                           compact={compact}
-                          iconOnly={false}
-                          asSubmenu
-                          triggerContent={rowNode}
+                          display={usagePercentageDisplay}
+                          mode={usageTightestOnly ? 'compact' : statusBarUsageMode}
                         />
-                      )
-                    }
-                    if (p.provider === 'codex') {
+                      </span>
+                    ))}
+                    {collapseUsage ? (
+                      <UsageOverflowChip
+                        hidden={rosterProviders.filter((p) =>
+                          collapsedUsageProviders.includes(p.provider)
+                        )}
+                        display={usagePercentageDisplay}
+                      />
+                    ) : null}
+                  </button>
+                </DropdownMenuTrigger>
+                <DropdownMenuContent
+                  {...STATUS_BAR_CONTEXT_MENU_EXEMPT_PROPS}
+                  side="top"
+                  align="start"
+                  sideOffset={8}
+                  // Keep the popover (and its drill-in submenus) above the status
+                  // bar instead of overlapping it — bottom padding ≈ footer height.
+                  collisionPadding={{ top: 8, bottom: 32, left: 8, right: 8 }}
+                  className="w-[360px] p-0"
+                  onPointerDownOutside={usageMenuFocusHandoff.onPointerDownOutside}
+                  onCloseAutoFocus={usageMenuFocusHandoff.onCloseAutoFocus}
+                >
+                  <UsageRosterPanel
+                    providers={rosterProviders}
+                    display={usagePercentageDisplay}
+                    statusBarUsageMode={statusBarUsageMode}
+                    onStatusBarUsageModeChange={setStatusBarUsageMode}
+                    isRefreshing={isRefreshing || anyFetching}
+                    onRefresh={handleRefresh}
+                    onOpenProvider={handleOpenProviderAccounts}
+                    onSignIn={handleOpenProviderAccounts}
+                    canSignIn={(provider) => getUsageProviderAccountsSectionId(provider) !== null}
+                    onManageAccounts={handleManageAccounts}
+                    onUsageDetails={handleUsageDetails}
+                    renderRow={(p, rowNode) => {
+                      // Every provider drills into its detail panel (parity with the
+                      // per-provider dropdowns on main); Claude/Codex additionally get
+                      // the account switcher + runtime toggle + Codex reset credits.
+                      if (p.provider === 'claude') {
+                        return (
+                          <ClaudeSwitcherMenu
+                            claude={p}
+                            compact={compact}
+                            iconOnly={false}
+                            asSubmenu
+                            triggerContent={rowNode}
+                          />
+                        )
+                      }
+                      if (p.provider === 'codex') {
+                        return (
+                          <CodexSwitcherMenu
+                            codex={p}
+                            compact={compact}
+                            iconOnly={false}
+                            asSubmenu
+                            triggerContent={rowNode}
+                          />
+                        )
+                      }
                       return (
-                        <CodexSwitcherMenu
-                          codex={p}
+                        <ProviderDetailsMenu
+                          provider={p}
                           compact={compact}
                           iconOnly={false}
                           asSubmenu
                           triggerContent={rowNode}
+                          ariaLabel={translate(
+                            'auto.components.status.bar.UsageRosterPanel.openDetails',
+                            'Open usage details'
+                          )}
                         />
                       )
-                    }
-                    return (
-                      <ProviderDetailsMenu
-                        provider={p}
-                        compact={compact}
-                        iconOnly={false}
-                        asSubmenu
-                        triggerContent={rowNode}
-                        ariaLabel={translate(
-                          'auto.components.status.bar.UsageRosterPanel.openDetails',
-                          'Open usage details'
-                        )}
-                      />
-                    )
-                  }}
-                />
-              </DropdownMenuContent>
-            </DropdownMenu>
-          </UsagePercentageDisplayChangeNotice>
-        ) : null}
-        {anyVisible && !isEmptyUsageState && (
-          <Tooltip>
-            <TooltipTrigger asChild>
-              <button
-                onClick={handleRefresh}
-                disabled={isRefreshing}
-                className="p-0.5 rounded hover:bg-accent text-muted-foreground hover:text-foreground transition-colors disabled:opacity-40"
-                aria-label={translate(
-                  'auto.components.status.bar.StatusBar.3325d996cb',
-                  'Refresh rate limits'
-                )}
-              >
-                <RefreshCw
-                  size={11}
-                  className={isRefreshing || anyFetching ? 'animate-spin' : ''}
-                />
-              </button>
-            </TooltipTrigger>
-            <TooltipContent side="top" sideOffset={6}>
-              {translate('auto.components.status.bar.StatusBar.c8857b40f7', 'Refresh usage data')}
-            </TooltipContent>
-          </Tooltip>
-        )}
-      </div>
-
-      <div className="flex-1" />
-
-      <div className="flex items-center gap-3">
-        {!isPairedWebClientWindow() ? <CaffeinateStatusSegment iconOnly={iconOnly} /> : null}
-        <RemoteServerUpdateStatusSegment iconOnly={iconOnly} />
-        <SkillUpdateStatusSegment iconOnly={iconOnly} />
-        <NativeChatResumeStatusSegment iconOnly={iconOnly} />
-        <UpdateStatusSegment compact={compact} iconOnly={iconOnly} />
-        <React.Suspense fallback={null}>
-          {petEnabled ? <PetStatusSegment /> : null}
-          {showResourceUsage ? (
-            <ResourceUsageStatusSegment compact={compact} iconOnly={iconOnly} />
+                    }}
+                  />
+                </DropdownMenuContent>
+              </DropdownMenu>
+            </UsagePercentageDisplayChangeNotice>
           ) : null}
-          {showPorts ? <PortsStatusSegment compact={compact} iconOnly={iconOnly} /> : null}
-          {showSsh ? <SshStatusSegment compact={compact} iconOnly={iconOnly} /> : null}
-        </React.Suspense>
-        {showFloatingTerminalToggle && (
-          <FloatingTerminalIconContextMenu currentLocation="status-bar" className="relative">
+          {anyVisible && !isEmptyUsageState && (
             <Tooltip>
               <TooltipTrigger asChild>
                 <button
-                  type="button"
-                  className="relative inline-flex size-5 cursor-pointer items-center justify-center rounded border border-border bg-secondary text-secondary-foreground shadow-xs transition-colors hover:bg-accent hover:text-accent-foreground"
-                  aria-label={
-                    showFloatingWorkspaceAttentionDot
-                      ? translate(
-                          'auto.components.status.bar.StatusBar.floatingTerminalNewActivity',
-                          '{{label}}, new activity',
-                          { label: floatingTerminalActionLabel }
-                        )
-                      : floatingTerminalActionLabel
-                  }
-                  onClick={() => {
-                    window.dispatchEvent(new CustomEvent(TOGGLE_FLOATING_TERMINAL_EVENT))
-                  }}
+                  onClick={handleRefresh}
+                  disabled={isRefreshing}
+                  className="p-0.5 rounded hover:bg-accent text-muted-foreground hover:text-foreground transition-colors disabled:opacity-40"
+                  aria-label={translate(
+                    'auto.components.status.bar.StatusBar.3325d996cb',
+                    'Refresh rate limits'
+                  )}
                 >
-                  <PanelsTopLeft className="size-3.5" />
-                  {showFloatingWorkspaceAttentionDot ? (
-                    // Why: amber = Orca's "needs attention" convention; ring matches the fill so the dot reads on the icon.
-                    <span
-                      aria-hidden
-                      data-floating-terminal-attention
-                      className="pointer-events-none absolute right-0.5 top-0.5 size-1.5 rounded-full bg-amber-500 ring-1 ring-secondary"
-                    />
-                  ) : null}
+                  <RefreshCw
+                    size={11}
+                    className={isRefreshing || anyFetching ? 'animate-spin' : ''}
+                  />
                 </button>
               </TooltipTrigger>
               <TooltipContent side="top" sideOffset={6}>
-                {floatingTerminalActionLabel} ({floatingTerminalShortcut})
+                {translate('auto.components.status.bar.StatusBar.c8857b40f7', 'Refresh usage data')}
               </TooltipContent>
             </Tooltip>
-          </FloatingTerminalIconContextMenu>
-        )}
+          )}
+        </div>
+      </div>
+
+      {/* Why: attention segments never clip; below the tightest density they scroll rather than vanish. */}
+      <div
+        className="min-w-0 data-[overflowing=true]:overflow-x-auto data-[overflowing=true]:scrollbar-none"
+        data-overflowing={overflowing}
+      >
+        <div ref={segmentsRef} className="flex w-max items-center gap-3">
+          {!isPairedWebClientWindow() ? (
+            <CaffeinateStatusSegment iconOnly={segmentsIconOnly} />
+          ) : null}
+          <RemoteServerUpdateStatusSegment iconOnly={segmentsIconOnly} />
+          <SkillUpdateStatusSegment iconOnly={segmentsIconOnly} />
+          <NativeChatResumeStatusSegment iconOnly={segmentsIconOnly} />
+          <UpdateStatusSegment compact={compact} iconOnly={segmentsIconOnly} />
+          <React.Suspense fallback={null}>
+            {petEnabled ? <PetStatusSegment /> : null}
+            {showResourceUsage ? (
+              <ResourceUsageStatusSegment compact={compact} iconOnly={segmentsIconOnly} />
+            ) : null}
+            {showPorts ? (
+              <PortsStatusSegment compact={compact} iconOnly={segmentsIconOnly} />
+            ) : null}
+            {showSsh ? <SshStatusSegment compact={compact} iconOnly={segmentsIconOnly} /> : null}
+          </React.Suspense>
+          {showFloatingTerminalToggle && (
+            <FloatingTerminalIconContextMenu currentLocation="status-bar" className="relative">
+              <Tooltip>
+                <TooltipTrigger asChild>
+                  <button
+                    type="button"
+                    className="relative inline-flex size-5 cursor-pointer items-center justify-center rounded border border-border bg-secondary text-secondary-foreground shadow-xs transition-colors hover:bg-accent hover:text-accent-foreground"
+                    aria-label={
+                      showFloatingWorkspaceAttentionDot
+                        ? translate(
+                            'auto.components.status.bar.StatusBar.floatingTerminalNewActivity',
+                            '{{label}}, new activity',
+                            { label: floatingTerminalActionLabel }
+                          )
+                        : floatingTerminalActionLabel
+                    }
+                    onClick={() => {
+                      window.dispatchEvent(new CustomEvent(TOGGLE_FLOATING_TERMINAL_EVENT))
+                    }}
+                  >
+                    <PanelsTopLeft className="size-3.5" />
+                    {showFloatingWorkspaceAttentionDot ? (
+                      // Why: amber = Orca's "needs attention" convention; ring matches the fill so the dot reads on the icon.
+                      <span
+                        aria-hidden
+                        data-floating-terminal-attention
+                        className="pointer-events-none absolute right-0.5 top-0.5 size-1.5 rounded-full bg-amber-500 ring-1 ring-secondary"
+                      />
+                    ) : null}
+                  </button>
+                </TooltipTrigger>
+                <TooltipContent side="top" sideOffset={6}>
+                  {floatingTerminalActionLabel} ({floatingTerminalShortcut})
+                </TooltipContent>
+              </Tooltip>
+            </FloatingTerminalIconContextMenu>
+          )}
+        </div>
       </div>
 
       <StatusBarVisibilityMenu controller={controller} />
diff --git a/src/renderer/src/components/status-bar/StatusBarVisibilityMenu.tsx b/src/renderer/src/components/status-bar/StatusBarVisibilityMenu.tsx
index 7b47b6bb6d29..c98f91c673ec 100644
--- a/src/renderer/src/components/status-bar/StatusBarVisibilityMenu.tsx
+++ b/src/renderer/src/components/status-bar/StatusBarVisibilityMenu.tsx
@@ -133,6 +133,28 @@ export function StatusBarVisibilityMenu({
             {translate('auto.components.status.bar.StatusBar.grokUsageMenu', 'Grok Usage')}
           </DropdownMenuCheckboxItem>
         )}
+        {isStatusBarItemAvailable('zcode', detectedAgentIds) && (
+          <DropdownMenuCheckboxItem
+            checked={statusBarItems.includes('zcode')}
+            onCheckedChange={() => {
+              recordFeatureInteraction('usage-tracking')
+              toggleStatusBarItem('zcode')
+            }}
+          >
+            <AgentIcon agent="zcode" size={14} />
+            {translate('auto.components.status.bar.StatusBar.zcodeUsageMenu', 'ZCode Usage')}
+          </DropdownMenuCheckboxItem>
+        )}
+        <DropdownMenuCheckboxItem
+          checked={statusBarItems.includes('cursor')}
+          onCheckedChange={() => {
+            recordFeatureInteraction('usage-tracking')
+            toggleStatusBarItem('cursor')
+          }}
+        >
+          <AgentIcon agent="cursor" size={14} />
+          {translate('auto.components.status.bar.StatusBar.cursorUsageMenu', 'Cursor Usage')}
+        </DropdownMenuCheckboxItem>
         <DropdownMenuCheckboxItem
           checked={statusBarItems.includes('ssh')}
           onCheckedChange={() => {
diff --git a/src/renderer/src/components/status-bar/UsageRosterPanel.test.tsx b/src/renderer/src/components/status-bar/UsageRosterPanel.test.tsx
index de4f5a0e06f8..4f538ea852fa 100644
--- a/src/renderer/src/components/status-bar/UsageRosterPanel.test.tsx
+++ b/src/renderer/src/components/status-bar/UsageRosterPanel.test.tsx
@@ -247,6 +247,35 @@ describe('UsageRow', () => {
     expect(markup).toContain('25%')
     expect(markup).toContain('60%')
   })
+
+  it('labels ZCode MCP separately from Coding Plan windows in both roster modes', () => {
+    const zcode: ProviderRateLimits = {
+      provider: 'zcode',
+      session: { usedPercent: 1, windowMinutes: 300, resetsAt: null, resetDescription: null },
+      weekly: { usedPercent: 94, windowMinutes: 10_080, resetsAt: null, resetDescription: null },
+      monthly: { usedPercent: 97, windowMinutes: 43_200, resetsAt: null, resetDescription: null },
+      updatedAt: mocks.now,
+      status: 'ok',
+      error: null
+    }
+    const renderRow = (mode: 'verbose' | 'compact') =>
+      renderToStaticMarkup(
+        <UsageRow
+          p={zcode}
+          display="used"
+          mode={mode}
+          state={{ kind: 'usage', statusLabel: null }}
+          showSignInAction={false}
+          now={mocks.now}
+        />
+      )
+
+    expect(renderRow('verbose')).toContain('data-usage-window="MCP"')
+    expect(renderRow('verbose')).toContain('MCP')
+    expect(renderRow('verbose')).not.toContain('30d')
+    expect(renderRow('compact')).toContain('MCP')
+    expect(renderRow('compact')).not.toContain('30d')
+  })
 })
 
 describe('UsageRosterPanel density picker', () => {
diff --git a/src/renderer/src/components/status-bar/UsageRosterPanel.tsx b/src/renderer/src/components/status-bar/UsageRosterPanel.tsx
index feb066fadca4..6163f1ba5489 100644
--- a/src/renderer/src/components/status-bar/UsageRosterPanel.tsx
+++ b/src/renderer/src/components/status-bar/UsageRosterPanel.tsx
@@ -49,6 +49,9 @@ function shortLabel(
   if (section.window === p.fableWeekly) {
     return 'Fable'
   }
+  if (p.provider === 'zcode' && section.window === p.monthly) {
+    return section.label
+  }
   return useRemainingDuration
     ? formatRateLimitWindowChipLabel(section.window)
     : formatWindowLabel(section.window.windowMinutes)
diff --git a/src/renderer/src/components/status-bar/status-bar-agent-gating.test.ts b/src/renderer/src/components/status-bar/status-bar-agent-gating.test.ts
index cd98315df505..4c7ada35a47d 100644
--- a/src/renderer/src/components/status-bar/status-bar-agent-gating.test.ts
+++ b/src/renderer/src/components/status-bar/status-bar-agent-gating.test.ts
@@ -20,6 +20,7 @@ describe('isStatusBarItemAvailable', () => {
     expect(isStatusBarItemAvailable('gemini', null)).toBe(true)
     expect(isStatusBarItemAvailable('antigravity', null)).toBe(true)
     expect(isStatusBarItemAvailable('grok', null)).toBe(true)
+    expect(isStatusBarItemAvailable('zcode', null)).toBe(true)
   })
 
   it('hides CLI items not detected on PATH', () => {
@@ -28,6 +29,7 @@ describe('isStatusBarItemAvailable', () => {
     expect(isStatusBarItemAvailable('gemini', ['claude', 'codex'])).toBe(false)
     expect(isStatusBarItemAvailable('antigravity', ['claude', 'codex'])).toBe(false)
     expect(isStatusBarItemAvailable('grok', ['claude', 'kimi'])).toBe(false)
+    expect(isStatusBarItemAvailable('zcode', ['claude', 'kimi'])).toBe(false)
   })
 
   it('shows CLI items detected on PATH', () => {
@@ -36,5 +38,6 @@ describe('isStatusBarItemAvailable', () => {
     expect(isStatusBarItemAvailable('gemini', ['gemini'])).toBe(true)
     expect(isStatusBarItemAvailable('antigravity', ['antigravity'])).toBe(true)
     expect(isStatusBarItemAvailable('grok', ['grok'])).toBe(true)
+    expect(isStatusBarItemAvailable('zcode', ['zcode'])).toBe(true)
   })
 })
diff --git a/src/renderer/src/components/status-bar/status-bar-agent-gating.ts b/src/renderer/src/components/status-bar/status-bar-agent-gating.ts
index 145abef3a900..85f641b96d2d 100644
--- a/src/renderer/src/components/status-bar/status-bar-agent-gating.ts
+++ b/src/renderer/src/components/status-bar/status-bar-agent-gating.ts
@@ -13,7 +13,8 @@ const CLI_GATED_ITEMS: ReadonlySet<StatusBarItem> = new Set([
   'gemini',
   'kimi',
   'antigravity',
-  'grok'
+  'grok',
+  'zcode'
 ])
 
 export function isStatusBarItemAvailable(
diff --git a/src/renderer/src/components/status-bar/status-bar-container-observer.ts b/src/renderer/src/components/status-bar/status-bar-container-observer.ts
deleted file mode 100644
index 627b982efcde..000000000000
--- a/src/renderer/src/components/status-bar/status-bar-container-observer.ts
+++ /dev/null
@@ -1,12 +0,0 @@
-export function observeStatusBarContainer(
-  node: HTMLDivElement,
-  onWidthChange: (width: number) => void
-): ResizeObserver {
-  const observer = new ResizeObserver((entries) => {
-    for (const entry of entries) {
-      onWidthChange(entry.contentRect.width)
-    }
-  })
-  observer.observe(node)
-  return observer
-}
diff --git a/src/renderer/src/components/status-bar/status-bar-cursor-segment.test.tsx b/src/renderer/src/components/status-bar/status-bar-cursor-segment.test.tsx
new file mode 100644
index 000000000000..eb3781af391c
--- /dev/null
+++ b/src/renderer/src/components/status-bar/status-bar-cursor-segment.test.tsx
@@ -0,0 +1,96 @@
+import { renderToStaticMarkup } from 'react-dom/server'
+import { describe, expect, it, vi } from 'vitest'
+import {
+  CURSOR_MODELS_BUCKET_NAME,
+  CURSOR_OTHER_MODELS_BUCKET_NAME
+} from '../../../../shared/cursor-usage-buckets'
+import type { ProviderRateLimits, RateLimitWindow } from '../../../../shared/rate-limit-types'
+
+vi.mock('@/i18n/i18n', () => ({
+  i18n: { language: 'en' },
+  translate: (_key: string, fallback: string, values?: Record<string, string>) => {
+    let result = fallback
+    for (const [key, value] of Object.entries(values ?? {})) {
+      result = result.replace(`{{${key}}}`, value)
+    }
+    return result
+  }
+}))
+
+vi.mock('@/lib/agent-catalog', () => ({
+  AgentIcon: () => null
+}))
+
+vi.mock('../../store', () => ({
+  useAppStore: (selector: (state: { usagePercentageDisplay: 'used' | 'remaining' }) => unknown) =>
+    selector({ usagePercentageDisplay: 'used' })
+}))
+
+function windowOf(usedPercent: number): RateLimitWindow {
+  return { usedPercent, windowMinutes: 43_200, resetsAt: null, resetDescription: null }
+}
+
+function cursorLimits(overrides: Partial<ProviderRateLimits> = {}): ProviderRateLimits {
+  return {
+    provider: 'cursor',
+    session: null,
+    weekly: null,
+    monthly: windowOf(92),
+    buckets: [
+      { name: CURSOR_MODELS_BUCKET_NAME, ...windowOf(45) },
+      { name: CURSOR_OTHER_MODELS_BUCKET_NAME, ...windowOf(50) }
+    ],
+    updatedAt: Date.now(),
+    error: null,
+    status: 'ok',
+    ...overrides
+  }
+}
+
+describe('Cursor status-bar segment', () => {
+  it('renders both plan pools instead of filtering them out as unknown buckets', async () => {
+    // Why: the verbose bucket allowlist was written for Gemini's experimental
+    // models. Cursor's pools are its whole meter, so a signed-in account
+    // rendered an icon with no percentage at all.
+    const { ProviderSegment } = await import('./StatusBar')
+    const markup = renderToStaticMarkup(
+      <ProviderSegment p={cursorLimits()} compact={false} display="used" mode="verbose" />
+    )
+    expect(markup).toContain(CURSOR_MODELS_BUCKET_NAME)
+    expect(markup).toContain(CURSOR_OTHER_MODELS_BUCKET_NAME)
+    expect(markup).toContain('45%')
+    expect(markup).toContain('50%')
+  })
+
+  it('falls back to the plan total when no bucket is renderable', async () => {
+    const { ProviderSegment } = await import('./StatusBar')
+    const markup = renderToStaticMarkup(
+      <ProviderSegment
+        p={cursorLimits({ buckets: [{ name: 'Unknown pool', ...windowOf(70) }] })}
+        compact={false}
+        display="used"
+        mode="verbose"
+      />
+    )
+    expect(markup).not.toContain('Unknown pool')
+    expect(markup).toContain('92%')
+  })
+})
+
+describe('getWindowSections for Cursor', () => {
+  it('keeps the plan total beside the pools', async () => {
+    // Why: Cursor puts the headline number in `monthly` and the sub-pools in
+    // buckets. Dropping `monthly` hid the figure closest to the user's cap — a
+    // plan at 92% read as 50% in the roster and the tooltip.
+    const { getWindowSections } = await import('./tooltip')
+    const sections = getWindowSections(cursorLimits())
+    expect(sections.find((section) => section.label === 'Plan')?.window?.usedPercent).toBe(92)
+    expect(sections.map((section) => section.label)).toContain(CURSOR_MODELS_BUCKET_NAME)
+  })
+
+  it('leaves other providers unchanged when they report no monthly window', async () => {
+    const { getWindowSections } = await import('./tooltip')
+    const sections = getWindowSections(cursorLimits({ monthly: null, provider: 'gemini' }))
+    expect(sections.some((section) => section.label === 'Plan')).toBe(false)
+  })
+})
diff --git a/src/renderer/src/components/status-bar/status-bar-density.test.ts b/src/renderer/src/components/status-bar/status-bar-density.test.ts
new file mode 100644
index 000000000000..2197e74fef9f
--- /dev/null
+++ b/src/renderer/src/components/status-bar/status-bar-density.test.ts
@@ -0,0 +1,43 @@
+import { describe, expect, it } from 'vitest'
+import {
+  STATUS_BAR_DENSITY_LEVELS,
+  pickStatusBarDensityLevel,
+  recordStatusBarDensityWidth
+} from './status-bar-density'
+
+const TIGHTEST = STATUS_BAR_DENSITY_LEVELS.length - 1
+
+describe('pickStatusBarDensityLevel', () => {
+  it('keeps the roomiest level that fits', () => {
+    expect(pickStatusBarDensityLevel([700, 600, 500, 400, 300], 800)).toBe(0)
+    expect(pickStatusBarDensityLevel([700, 600, 500, 400, 300], 550)).toBe(2)
+  })
+
+  it('probes an unmeasured level before settling on a tighter one', () => {
+    expect(pickStatusBarDensityLevel([700, undefined, 500], 650)).toBe(1)
+    expect(pickStatusBarDensityLevel([], 650)).toBe(0)
+  })
+
+  it('falls back to the tightest level when nothing fits', () => {
+    expect(pickStatusBarDensityLevel([700, 600, 500, 400, 300], 200)).toBe(TIGHTEST)
+  })
+
+  it('tolerates sub-pixel rounding at the boundary', () => {
+    expect(pickStatusBarDensityLevel([600.6], 600)).toBe(0)
+  })
+})
+
+describe('recordStatusBarDensityWidth', () => {
+  it('fills in a level without disturbing the others', () => {
+    expect(recordStatusBarDensityWidth([700, undefined, 500], 1, 600)).toEqual([700, 600, 500])
+  })
+
+  it('forgets other levels when a level re-measures differently', () => {
+    // A segment appeared or vanished, so the other levels' widths no longer describe the bar.
+    expect(recordStatusBarDensityWidth([700, 600, 500], 1, 640)).toEqual([undefined, 640])
+  })
+
+  it('keeps other levels on a sub-pixel re-measure', () => {
+    expect(recordStatusBarDensityWidth([700, 600, 500], 1, 600.5)).toEqual([700, 600.5, 500])
+  })
+})
diff --git a/src/renderer/src/components/status-bar/status-bar-density.ts b/src/renderer/src/components/status-bar/status-bar-density.ts
new file mode 100644
index 000000000000..078a4cf44df7
--- /dev/null
+++ b/src/renderer/src/components/status-bar/status-bar-density.ts
@@ -0,0 +1,165 @@
+import { useCallback, useEffect, useLayoutEffect, useMemo, useRef, useState } from 'react'
+import type { MutableRefObject } from 'react'
+import { measureUsageRow, pickCollapsedUsageChips } from './status-bar-usage-collapse'
+
+export type StatusBarDensity = {
+  /** Drop usage mini bars and secondary segment labels. */
+  compact: boolean
+  /** One percentage per provider, whatever the chosen usage mode. */
+  usageTightestOnly: boolean
+  /** Right-side segments show icon + count; tooltips carry the label. */
+  segmentsIconOnly: boolean
+  /** Calm providers give way to a "+N" chip when even one percentage each doesn't fit. */
+  collapseUsage: boolean
+}
+
+// Why: ordered roomiest → tightest so each step gives up the least useful detail first;
+// usage verbosity goes before right-side labels because the Usage popover holds it all.
+export const STATUS_BAR_DENSITY_LEVELS: readonly StatusBarDensity[] = [
+  { compact: false, usageTightestOnly: false, segmentsIconOnly: false, collapseUsage: false },
+  { compact: true, usageTightestOnly: false, segmentsIconOnly: false, collapseUsage: false },
+  { compact: true, usageTightestOnly: true, segmentsIconOnly: false, collapseUsage: false },
+  { compact: true, usageTightestOnly: true, segmentsIconOnly: true, collapseUsage: true }
+]
+const NO_COLLAPSED_USAGE: readonly string[] = []
+
+const WIDTH_TOLERANCE_PX = 1
+
+/** Roomiest level known to fit; an unmeasured level is returned so it gets probed. */
+export function pickStatusBarDensityLevel(
+  requiredWidths: readonly (number | undefined)[],
+  availableWidth: number
+): number {
+  const tightest = STATUS_BAR_DENSITY_LEVELS.length - 1
+  for (let level = 0; level < tightest; level++) {
+    const required = requiredWidths[level]
+    if (required === undefined || required <= availableWidth + WIDTH_TOLERANCE_PX) {
+      return level
+    }
+  }
+  return tightest
+}
+
+/** A level measuring differently than before means the content changed, so every other level's width is stale. */
+export function recordStatusBarDensityWidth(
+  requiredWidths: readonly (number | undefined)[],
+  level: number,
+  required: number
+): (number | undefined)[] {
+  const previous = requiredWidths[level]
+  const next =
+    previous !== undefined && Math.abs(previous - required) > WIDTH_TOLERANCE_PX
+      ? []
+      : [...requiredWidths]
+  next[level] = required
+  return next
+}
+
+type ElementRef = MutableRefObject<HTMLElement | null>
+
+function measureWidth(ref: ElementRef): number {
+  return ref.current?.getBoundingClientRect().width ?? 0
+}
+
+/**
+ * Picks the roomiest density at which the usage cluster and the right-side segments fit
+ * on one line. Widths are measured from the rendered content, so a transient segment
+ * (update ready, chats to resume) condenses the bar only while it is present. At the
+ * tightest level it also names the usage chips that give way to a "+N" chip.
+ */
+export function useStatusBarDensity(): {
+  density: StatusBarDensity
+  overflowing: boolean
+  collapsedUsageProviders: readonly string[]
+  barRef: (node: HTMLElement | null) => void
+  usageRef: (node: HTMLElement | null) => void
+  segmentsRef: (node: HTMLElement | null) => void
+} {
+  const [level, setLevel] = useState(0)
+  const [overflowing, setOverflowing] = useState(false)
+  const [collapsedUsageProviders, setCollapsedUsageProviders] = useState(NO_COLLAPSED_USAGE)
+  const committedLevelRef = useRef(0)
+  const overflowingRef = useRef(false)
+  const collapsedUsageRef = useRef(NO_COLLAPSED_USAGE)
+  const requiredWidthsRef = useRef<(number | undefined)[]>([])
+  const barElementRef = useRef<HTMLElement | null>(null)
+  const usageElementRef = useRef<HTMLElement | null>(null)
+  const segmentsElementRef = useRef<HTMLElement | null>(null)
+  const observerRef = useRef<ResizeObserver | null>(null)
+
+  const evaluate = useCallback((): void => {
+    const bar = barElementRef.current
+    if (!bar) {
+      return
+    }
+    const style = getComputedStyle(bar)
+    const available =
+      bar.clientWidth - Number.parseFloat(style.paddingLeft) - Number.parseFloat(style.paddingRight)
+    const usage = measureUsageRow(usageElementRef.current)
+    const fixedWidth = (Number.parseFloat(style.columnGap) || 0) + measureWidth(segmentsElementRef)
+    const required = usage.naturalWidth + fixedWidth
+    requiredWidthsRef.current = recordStatusBarDensityWidth(
+      requiredWidthsRef.current,
+      committedLevelRef.current,
+      required
+    )
+    const nextLevel = pickStatusBarDensityLevel(requiredWidthsRef.current, available)
+    if (nextLevel !== committedLevelRef.current) {
+      setLevel(nextLevel)
+    }
+    const collapsible =
+      nextLevel === committedLevelRef.current && STATUS_BAR_DENSITY_LEVELS[nextLevel].collapseUsage
+    const nextCollapsed = collapsible
+      ? pickCollapsedUsageChips(
+          usage.chips,
+          required - available - WIDTH_TOLERANCE_PX,
+          usage.moreChipWidth,
+          usage.chipGap
+        )
+      : NO_COLLAPSED_USAGE
+    if (nextCollapsed.join() !== collapsedUsageRef.current.join()) {
+      collapsedUsageRef.current = nextCollapsed
+      setCollapsedUsageProviders(nextCollapsed)
+    }
+    const nextOverflowing = usage.renderedWidth + fixedWidth > available + WIDTH_TOLERANCE_PX
+    if (nextOverflowing !== overflowingRef.current) {
+      overflowingRef.current = nextOverflowing
+      setOverflowing(nextOverflowing)
+    }
+  }, [])
+
+  // Why: runs before paint, so probing a roomier level that turns out not to fit never flashes.
+  useLayoutEffect(() => {
+    committedLevelRef.current = level
+    evaluate()
+  })
+
+  useEffect(() => () => observerRef.current?.disconnect(), [])
+
+  const refs = useMemo(() => {
+    const bind =
+      (target: ElementRef) =>
+      (node: HTMLElement | null): void => {
+        observerRef.current ??= new ResizeObserver(() => evaluate())
+        if (target.current) {
+          observerRef.current.unobserve(target.current)
+        }
+        target.current = node
+        if (node) {
+          observerRef.current.observe(node)
+        }
+      }
+    return {
+      barRef: bind(barElementRef),
+      usageRef: bind(usageElementRef),
+      segmentsRef: bind(segmentsElementRef)
+    }
+  }, [evaluate])
+
+  return {
+    density: STATUS_BAR_DENSITY_LEVELS[level],
+    overflowing,
+    collapsedUsageProviders,
+    ...refs
+  }
+}
diff --git a/src/renderer/src/components/status-bar/status-bar-provider-visibility.test.ts b/src/renderer/src/components/status-bar/status-bar-provider-visibility.test.ts
index 239c3314eb35..987bb91c040e 100644
--- a/src/renderer/src/components/status-bar/status-bar-provider-visibility.test.ts
+++ b/src/renderer/src/components/status-bar/status-bar-provider-visibility.test.ts
@@ -77,6 +77,7 @@ function usageSettings(overrides: Partial<UsageProviderSettings> = {}): UsagePro
     minimaxApiKeyConfigured: false,
     opencodeGoApiKeyConfigured: false,
     grokAuthConfigured: false,
+    cursorAuthConfigured: false,
     ...overrides
   }
 }
@@ -394,6 +395,35 @@ describe('getVisibleUsageProvider', () => {
 })
 
 describe('isUsageEmptyState', () => {
+  it('keeps the Cursor bar visible on a local session before the first snapshot', () => {
+    // Why: the credential lives on disk, not in settings, so main's flag is the
+    // only durable signal that the bar has an account behind it.
+    const pending = getVisibleUsageProvider(
+      'cursor',
+      null,
+      usageSettings({ cursorAuthConfigured: true })
+    )
+    expect(pending).toMatchObject({ provider: 'cursor', status: 'fetching' })
+    expect(getVisibleUsageProvider('cursor', null, usageSettings())).toBeNull()
+  })
+
+  it('hides the Cursor bar when no local session exists, even on an unavailable snapshot', () => {
+    // Why: 'unavailable' is how a signed-out host reports Cursor; without the
+    // durable flag there is no account to show a bar for.
+    const unavailable = provider('unavailable', { provider: 'cursor' })
+    expect(getVisibleUsageProvider('cursor', unavailable, usageSettings())).toBeNull()
+    // With a session on disk the row stays, so "no allowance" is explained
+    // rather than silently vanishing.
+    expect(
+      getVisibleUsageProvider('cursor', unavailable, usageSettings({ cursorAuthConfigured: true }))
+    ).toBe(unavailable)
+  })
+
+  it('keeps a failing Cursor refresh visible so the error is not silently hidden', () => {
+    const failing = provider('error', { provider: 'cursor' })
+    expect(getVisibleUsageProvider('cursor', failing, usageSettings())).toBe(failing)
+  })
+
   it('waits for provider snapshots before showing the setup CTA', () => {
     expect(isUsageEmptyState(createEmptyRateLimitState(), usageSettings())).toBe(false)
   })
@@ -409,7 +439,8 @@ describe('isUsageEmptyState', () => {
           kimi: provider('unavailable', { provider: 'kimi' }),
           antigravity: undefined,
           minimax: undefined,
-          grok: undefined
+          grok: undefined,
+          cursor: undefined
         },
         usageSettings()
       )
@@ -427,7 +458,9 @@ describe('isUsageEmptyState', () => {
           kimi: provider('unavailable', { provider: 'kimi' }),
           antigravity: provider('unavailable', { provider: 'antigravity' }),
           minimax: provider('unavailable', { provider: 'minimax' }),
-          grok: provider('unavailable', { provider: 'grok' })
+          grok: provider('unavailable', { provider: 'grok' }),
+          cursor: provider('unavailable', { provider: 'cursor' }),
+          zcode: provider('unavailable', { provider: 'zcode' })
         },
         usageSettings()
       )
@@ -445,7 +478,9 @@ describe('isUsageEmptyState', () => {
           kimi: provider('unavailable', { provider: 'kimi' }),
           antigravity: provider('unavailable', { provider: 'antigravity' }),
           minimax: provider('unavailable', { provider: 'minimax' }),
-          grok: provider('unavailable', { provider: 'grok' })
+          grok: provider('unavailable', { provider: 'grok' }),
+          cursor: provider('unavailable', { provider: 'cursor' }),
+          zcode: provider('unavailable', { provider: 'zcode' })
         },
         usageSettings({
           codexManagedAccounts: [
@@ -468,21 +503,21 @@ describe('isUsageEmptyState', () => {
   })
 
   it('shows the setup CTA for a loaded profile with no configured usage provider', () => {
-    expect(
-      isUsageEmptyState(
-        {
-          claude: provider('unavailable', { provider: 'claude' }),
-          codex: provider('unavailable', { provider: 'codex' }),
-          gemini: provider('unavailable'),
-          opencodeGo: provider('unavailable', { provider: 'opencode-go' }),
-          kimi: provider('unavailable', { provider: 'kimi' }),
-          antigravity: null,
-          minimax: provider('unavailable', { provider: 'minimax' }),
-          grok: provider('unavailable', { provider: 'grok' })
-        },
-        usageSettings()
-      )
-    ).toBe(true)
+    const settledProviders = {
+      claude: provider('unavailable', { provider: 'claude' }),
+      codex: provider('unavailable', { provider: 'codex' }),
+      gemini: provider('unavailable'),
+      opencodeGo: provider('unavailable', { provider: 'opencode-go' }),
+      kimi: provider('unavailable', { provider: 'kimi' }),
+      antigravity: null,
+      minimax: provider('unavailable', { provider: 'minimax' }),
+      grok: provider('unavailable', { provider: 'grok' }),
+      cursor: provider('unavailable', { provider: 'cursor' }),
+      zcode: provider('unavailable', { provider: 'zcode' })
+    }
+    expect(isUsageEmptyState(settledProviders, usageSettings())).toBe(true)
+    expect(isUsageEmptyState({ ...settledProviders, zcode: undefined }, usageSettings())).toBe(true)
+    expect(isUsageEmptyState({ ...settledProviders, zcode: null }, usageSettings())).toBe(false)
   })
 
   it('does not show the setup CTA while checked Antigravity usage is awaiting a snapshot', () => {
@@ -496,7 +531,9 @@ describe('isUsageEmptyState', () => {
           kimi: provider('unavailable', { provider: 'kimi' }),
           antigravity: null,
           grok: provider('unavailable', { provider: 'grok' }),
-          minimax: provider('unavailable', { provider: 'minimax' })
+          minimax: provider('unavailable', { provider: 'minimax' }),
+          cursor: provider('unavailable', { provider: 'cursor' }),
+          zcode: provider('unavailable', { provider: 'zcode' })
         },
         usageSettings({ antigravityUsageConfigured: true, geminiCliOAuthEnabled: true })
       )
@@ -516,7 +553,9 @@ describe('isUsageEmptyState', () => {
           kimi: provider('unavailable', { provider: 'kimi' }),
           antigravity: null,
           grok: provider('unavailable', { provider: 'grok' }),
-          minimax: provider('unavailable', { provider: 'minimax' })
+          minimax: provider('unavailable', { provider: 'minimax' }),
+          cursor: provider('unavailable', { provider: 'cursor' }),
+          zcode: provider('unavailable', { provider: 'zcode' })
         },
         usageSettings({ antigravityUsageConfigured: true })
       )
diff --git a/src/renderer/src/components/status-bar/status-bar-provider-visibility.ts b/src/renderer/src/components/status-bar/status-bar-provider-visibility.ts
index c14f0a23a39e..24392aa48ab3 100644
--- a/src/renderer/src/components/status-bar/status-bar-provider-visibility.ts
+++ b/src/renderer/src/components/status-bar/status-bar-provider-visibility.ts
@@ -21,6 +21,7 @@ export type UsageProviderSettings = Pick<
   // store, neither of which the renderer can see; main reports presence.
   opencodeGoApiKeyConfigured: boolean
   grokAuthConfigured: boolean
+  cursorAuthConfigured: boolean
 }
 
 type UsageProviderSnapshots = {
@@ -32,6 +33,8 @@ type UsageProviderSnapshots = {
   antigravity: ProviderRateLimits | null | undefined
   minimax: ProviderRateLimits | null | undefined
   grok: ProviderRateLimits | null | undefined
+  cursor: ProviderRateLimits | null | undefined
+  zcode?: ProviderRateLimits | null
 }
 
 type UsageProviderId = ProviderRateLimits['provider']
@@ -83,7 +86,8 @@ export function hasUsageProviderSettings(
     // already covered by the gemini term above.
     settings?.minimaxCookieConfigured === true ||
     settings?.minimaxApiKeyConfigured === true ||
-    settings?.grokAuthConfigured === true
+    settings?.grokAuthConfigured === true ||
+    settings?.cursorAuthConfigured === true
   )
 }
 
@@ -121,6 +125,9 @@ export function hasUsageProviderSettingsForProvider(
   if (providerId === 'grok') {
     return settings.grokAuthConfigured === true
   }
+  if (providerId === 'cursor') {
+    return settings.cursorAuthConfigured === true
+  }
   return false
 }
 
@@ -130,7 +137,7 @@ function createPendingProviderSnapshot(providerId: UsageProviderId): ProviderRat
     session: null,
     weekly: null,
     ...(providerId === 'opencode-go' ? { monthly: null } : {}),
-    ...(providerId === 'gemini' ? { buckets: [] } : {}),
+    ...(providerId === 'gemini' || providerId === 'cursor' ? { buckets: [] } : {}),
     updatedAt: 0,
     error: null,
     status: 'fetching'
@@ -174,7 +181,9 @@ export function isUsageEmptyState(
     isProviderSnapshotPending(providers.kimi) ||
     antigravitySnapshotPending ||
     isProviderSnapshotPending(providers.minimax) ||
-    isProviderSnapshotPending(providers.grok)
+    isProviderSnapshotPending(providers.grok) ||
+    isProviderSnapshotPending(providers.cursor) ||
+    (providers.zcode !== undefined && isProviderSnapshotPending(providers.zcode))
   ) {
     return false
   }
@@ -187,6 +196,8 @@ export function isUsageEmptyState(
     !isProviderConfigured(providers.kimi) &&
     !isProviderConfigured(providers.antigravity) &&
     !isProviderConfigured(providers.minimax) &&
-    !isProviderConfigured(providers.grok)
+    !isProviderConfigured(providers.grok) &&
+    !isProviderConfigured(providers.cursor) &&
+    !isProviderConfigured(providers.zcode)
   )
 }
diff --git a/src/renderer/src/components/status-bar/status-bar-usage-collapse.test.ts b/src/renderer/src/components/status-bar/status-bar-usage-collapse.test.ts
new file mode 100644
index 000000000000..9abddbb902ee
--- /dev/null
+++ b/src/renderer/src/components/status-bar/status-bar-usage-collapse.test.ts
@@ -0,0 +1,46 @@
+import { describe, expect, it } from 'vitest'
+import { pickCollapsedUsageChips } from './status-bar-usage-collapse'
+
+const GAP = 12
+const MORE = 20
+// Roster order, as the status bar renders it.
+const chips = [
+  { provider: 'claude', width: 60, urgent: false },
+  { provider: 'codex', width: 60, urgent: false },
+  { provider: 'gemini', width: 60, urgent: false },
+  { provider: 'grok', width: 60, urgent: false },
+  { provider: 'cursor', width: 60, urgent: true }
+]
+
+describe('pickCollapsedUsageChips', () => {
+  it('collapses nothing when the row fits', () => {
+    expect(pickCollapsedUsageChips(chips, 0, MORE, GAP)).toEqual([])
+    expect(pickCollapsedUsageChips(chips, -40, MORE, GAP)).toEqual([])
+  })
+
+  it('drops calm agents from the end of the roster and keeps the urgent one', () => {
+    // 10px over: one chip frees 72px, which also pays for the "+N" chip (20 + 12).
+    expect(pickCollapsedUsageChips(chips, 10, MORE, GAP)).toEqual(['grok'])
+    expect(pickCollapsedUsageChips(chips, 60, MORE, GAP)).toEqual(['grok', 'gemini'])
+  })
+
+  it('reserves room for the "+N" chip it introduces', () => {
+    // 41px over + 32px for "+N" = 73px, one more than a single chip frees.
+    expect(pickCollapsedUsageChips(chips, 41, MORE, GAP)).toEqual(['grok', 'gemini'])
+  })
+
+  it('drops urgent agents only after every calm one', () => {
+    expect(pickCollapsedUsageChips(chips, 300, MORE, GAP)).toEqual([
+      'grok',
+      'gemini',
+      'codex',
+      'claude',
+      'cursor'
+    ])
+  })
+
+  it('drops urgent agents from the end of the roster too', () => {
+    const allUrgent = chips.map((chip) => ({ ...chip, urgent: true }))
+    expect(pickCollapsedUsageChips(allUrgent, 10, MORE, GAP)).toEqual(['cursor'])
+  })
+})
diff --git a/src/renderer/src/components/status-bar/status-bar-usage-collapse.ts b/src/renderer/src/components/status-bar/status-bar-usage-collapse.ts
new file mode 100644
index 000000000000..581b1b3643d9
--- /dev/null
+++ b/src/renderer/src/components/status-bar/status-bar-usage-collapse.ts
@@ -0,0 +1,77 @@
+export type UsageChipMeasure = {
+  provider: string
+  width: number
+  urgent: boolean
+  collapsed: boolean
+}
+
+export type UsageRowMeasure = {
+  /** Width of the usage row as if every chip were shown, so collapsing never reads as a content change. */
+  naturalWidth: number
+  /** Width the row actually occupies right now. */
+  renderedWidth: number
+  chips: UsageChipMeasure[]
+  moreChipWidth: number
+  chipGap: number
+}
+
+/**
+ * Chooses which usage chips give way so the row sheds `overflowPx`. Calm agents go first,
+ * from the end of the roster; urgent ones only when calm ones can't free enough room.
+ */
+export function pickCollapsedUsageChips(
+  chips: readonly Pick<UsageChipMeasure, 'provider' | 'width' | 'urgent'>[],
+  overflowPx: number,
+  moreChipWidth: number,
+  chipGap: number
+): string[] {
+  if (overflowPx <= 0) {
+    return []
+  }
+  // The first collapsed chip brings the "+N" chip (and its gap) into the row.
+  const needed = overflowPx + moreChipWidth + chipGap
+  const dropOrder = [
+    ...chips.filter((chip) => !chip.urgent).toReversed(),
+    ...chips.filter((chip) => chip.urgent).toReversed()
+  ]
+  const collapsed: string[] = []
+  let freed = 0
+  for (const chip of dropOrder) {
+    if (freed >= needed) {
+      break
+    }
+    collapsed.push(chip.provider)
+    freed += chip.width + chipGap
+  }
+  return collapsed
+}
+
+/** Reads the `data-usage-*` markers the status bar renders on its usage chips and "+N" chip. */
+export function measureUsageRow(usage: HTMLElement | null): UsageRowMeasure {
+  if (!usage) {
+    return { naturalWidth: 0, renderedWidth: 0, chips: [], moreChipWidth: 0, chipGap: 0 }
+  }
+  const renderedWidth = usage.getBoundingClientRect().width
+  const chipElements = [...usage.querySelectorAll<HTMLElement>('[data-usage-chip]')]
+  const chipRow = chipElements[0]?.parentElement
+  const chipGap = chipRow ? Number.parseFloat(getComputedStyle(chipRow).columnGap) || 0 : 0
+  const chips = chipElements.map((element) => ({
+    provider: element.dataset.usageChip ?? '',
+    width: element.getBoundingClientRect().width,
+    urgent: element.dataset.usageUrgent === 'true',
+    collapsed: element.dataset.usageCollapsed === 'true'
+  }))
+  const more = usage.querySelector<HTMLElement>('[data-usage-more]')
+  const moreChipWidth = more?.getBoundingClientRect().width ?? 0
+  const moreInRow = more !== null && more.dataset.usageCollapsed !== 'true'
+  const collapsedWidth = chips
+    .filter((chip) => chip.collapsed)
+    .reduce((sum, chip) => sum + chip.width + chipGap, 0)
+  return {
+    naturalWidth: renderedWidth + collapsedWidth - (moreInRow ? moreChipWidth + chipGap : 0),
+    renderedWidth,
+    chips,
+    moreChipWidth,
+    chipGap
+  }
+}
diff --git a/src/renderer/src/components/status-bar/tooltip.test.ts b/src/renderer/src/components/status-bar/tooltip.test.ts
index fd7561e250cd..f08f1e4a1ebd 100644
--- a/src/renderer/src/components/status-bar/tooltip.test.ts
+++ b/src/renderer/src/components/status-bar/tooltip.test.ts
@@ -54,7 +54,8 @@ const PROVIDER_IDS: ProviderRateLimits['provider'][] = [
   'opencode-go',
   'kimi',
   'minimax',
-  'grok'
+  'grok',
+  'zcode'
 ]
 
 afterEach(() => {
@@ -294,6 +295,18 @@ describe('provider usage error copy', () => {
 })
 
 describe('getWindowSections', () => {
+  it('keeps ZCode Coding Plan windows separate from MCP quota', () => {
+    const session = { usedPercent: 25, windowMinutes: 300, resetsAt: null, resetDescription: null }
+    const weekly = { usedPercent: 40, windowMinutes: 10080, resetsAt: null, resetDescription: null }
+    const mcp = { usedPercent: 10, windowMinutes: 43200, resetsAt: null, resetDescription: null }
+    const sections = getWindowSections(
+      provider({ provider: 'zcode', session, weekly, monthly: mcp })
+    )
+
+    expect(sections.map((section) => section.label)).toEqual(['Session', 'Weekly', 'MCP'])
+    expect(sections[2].window).toBe(mcp)
+  })
+
   it('returns buckets as sections when present', () => {
     const p: ProviderRateLimits = {
       provider: 'gemini',
diff --git a/src/renderer/src/components/status-bar/tooltip.tsx b/src/renderer/src/components/status-bar/tooltip.tsx
index 2a82f7318dd9..735452c9e266 100644
--- a/src/renderer/src/components/status-bar/tooltip.tsx
+++ b/src/renderer/src/components/status-bar/tooltip.tsx
@@ -97,6 +97,12 @@ export function ProviderIcon({ provider }: { provider: string }): React.JSX.Elem
   if (provider === 'grok') {
     return <AgentIcon agent="grok" size={13} />
   }
+  if (provider === 'zcode') {
+    return <AgentIcon agent="zcode" size={13} />
+  }
+  if (provider === 'cursor') {
+    return <AgentIcon agent="cursor" size={13} />
+  }
   return <ClaudeIcon size={13} />
 }
 
@@ -146,6 +152,19 @@ export function getWindowSections(
     const bucketSections = p.buckets.map((b) => ({ label: b.name, window: b as RateLimitWindow }))
     return [
       ...bucketSections,
+      // Why: Cursor reports the plan total in `monthly` and its pools as buckets,
+      // so dropping it here would hide the number closest to the user's cap.
+      ...(p.monthly
+        ? [
+            {
+              label:
+                p.provider === 'cursor'
+                  ? translate('auto.components.status.bar.tooltip.cursor.plan', 'Plan')
+                  : translate('auto.components.status.bar.tooltip.7f7f208060', 'Monthly'),
+              window: p.monthly
+            }
+          ]
+        : []),
       {
         label: translate('auto.components.status.bar.tooltip.252c096536', 'Weekly'),
         window: p.weekly
@@ -170,7 +189,10 @@ export function getWindowSections(
   }
   if (p.monthly !== undefined && p.monthly !== null) {
     sections.push({
-      label: translate('auto.components.status.bar.tooltip.7f7f208060', 'Monthly'),
+      label:
+        p.provider === 'zcode'
+          ? translate('auto.components.status.bar.tooltip.zcode.mcp', 'MCP')
+          : translate('auto.components.status.bar.tooltip.7f7f208060', 'Monthly'),
       window: p.monthly
     })
   }
@@ -188,11 +210,14 @@ export function getWindowSections(
 
 // Why: urgency color tracks % used even when fill represents % remaining;
 // low usage stays neutral so persistent chrome stays quiet.
+export const USAGE_WARNING_PERCENT = 60
+export const USAGE_URGENT_PERCENT = 80
+
 export function barColor(usedPct: number): string {
-  if (usedPct < 60) {
+  if (usedPct < USAGE_WARNING_PERCENT) {
     return 'bg-muted-foreground/40'
   }
-  if (usedPct < 80) {
+  if (usedPct < USAGE_URGENT_PERCENT) {
     return 'bg-yellow-500'
   }
   return 'bg-red-500'
diff --git a/src/renderer/src/components/status-bar/usage-error-copy.ts b/src/renderer/src/components/status-bar/usage-error-copy.ts
index 8dd8ec7f2aa8..95942ddb5b72 100644
--- a/src/renderer/src/components/status-bar/usage-error-copy.ts
+++ b/src/renderer/src/components/status-bar/usage-error-copy.ts
@@ -26,6 +26,12 @@ export function getProviderDisplayName(provider: ProviderRateLimits['provider'])
   if (provider === 'grok') {
     return 'Grok'
   }
+  if (provider === 'zcode') {
+    return 'ZCode'
+  }
+  if (provider === 'cursor') {
+    return 'Cursor'
+  }
   return provider
 }
 
@@ -117,6 +123,11 @@ export function getProviderUsageStatusLabel(p: ProviderRateLimits): string {
   if (p.provider === 'minimax' && p.usageMetadata?.failureKind === 'stale-token') {
     return translate('auto.components.status.bar.tooltip.minimax.expired.label', 'Sign-in expired')
   }
+  // Why: cursor-agent owns its own token rotation, so a lapsed Cursor session is
+  // fixed by signing in to the CLI, not by Orca retrying the fetch.
+  if (p.provider === 'cursor' && p.usageMetadata?.failureKind === 'stale-token') {
+    return translate('auto.components.status.bar.tooltip.cursor.expired.label', 'Sign-in expired')
+  }
   // Why: an unsubscribed account is a settled answer about the account, not a
   // failed refresh; "Refresh failed" sends the user hunting a bug that is not there.
   if (p.usageMetadata?.failureKind === 'no-subscription') {
@@ -152,6 +163,12 @@ export function getProviderUsageErrorMessage(p: ProviderRateLimits): string {
       'Run kimi in a terminal on the computer running Orca and wait for it to start, then retry usage.'
     )
   }
+  if (p.provider === 'cursor' && p.usageMetadata?.failureKind === 'stale-token') {
+    return translate(
+      'auto.components.status.bar.tooltip.cursor.expired.message',
+      'Run cursor-agent login in a terminal on the computer running Orca, then retry usage.'
+    )
+  }
   if (p.provider === 'claude') {
     switch (p.usageMetadata?.failureKind) {
       case 'deferred-by-live-session':
diff --git a/src/renderer/src/components/status-bar/usage-provider-settings-target.ts b/src/renderer/src/components/status-bar/usage-provider-settings-target.ts
index 59ea71042490..b531bffd161e 100644
--- a/src/renderer/src/components/status-bar/usage-provider-settings-target.ts
+++ b/src/renderer/src/components/status-bar/usage-provider-settings-target.ts
@@ -18,8 +18,12 @@ export function getUsageProviderAccountsSectionId(
       return 'accounts-minimax'
     case 'grok':
       return 'accounts-grok'
+    case 'cursor':
+      return 'accounts-cursor'
     case 'kimi':
+    case 'zcode':
       // Why: Orca must not mutate Kimi's CLI-owned credential lifecycle.
+      // ZCode likewise owns its Coding Plan credential in ~/.zcode/cli/config.json.
       return null
   }
 }
diff --git a/src/renderer/src/components/status-bar/use-status-bar-controller.ts b/src/renderer/src/components/status-bar/use-status-bar-controller.ts
index d2f9a21ea18d..8ec0bcfce437 100644
--- a/src/renderer/src/components/status-bar/use-status-bar-controller.ts
+++ b/src/renderer/src/components/status-bar/use-status-bar-controller.ts
@@ -9,7 +9,7 @@ import { isStatusBarItemAvailable } from './status-bar-agent-gating'
 import { getVisibleUsageProvider, isUsageEmptyState } from './status-bar-provider-visibility'
 import { getUsageProviderAccountsSectionId } from './usage-provider-settings-target'
 import { CLOSE_ALL_CONTEXT_MENUS_EVENT, useStatusBarMenuFocusHandoff } from './ProviderDetailsMenu'
-import { observeStatusBarContainer } from './status-bar-container-observer'
+import { useStatusBarDensity } from './status-bar-density'
 
 export function useStatusBarController(floatingTerminalOpen: boolean) {
   const floatingTerminalShortcut = useShortcutLabel('floatingTerminal.toggle')
@@ -40,14 +40,18 @@ export function useStatusBarController(floatingTerminalOpen: boolean) {
   const petEnabled = useAppStore((s) => s.settings?.experimentalPet === true)
   const toggleStatusBarItem = useAppStore((s) => s.toggleStatusBarItem)
   const usageEmptyStateDismissed = useAppStore((s) => s.usageEmptyStateDismissed)
-  const containerRef = useRef<HTMLDivElement>(null)
   const mountedRef = useRef(true)
   const [isRefreshing, setIsRefreshing] = useState(false)
   const [menuOpen, setMenuOpen] = useState(false)
   const [menuPoint, setMenuPoint] = useState({ x: 0, y: 0 })
-
-  const [containerWidth, setContainerWidth] = useState(900)
-  const resizeObserverRef = useRef<ResizeObserver | null>(null)
+  const {
+    density: { compact, usageTightestOnly, segmentsIconOnly, collapseUsage },
+    overflowing,
+    collapsedUsageProviders,
+    barRef,
+    usageRef,
+    segmentsRef
+  } = useStatusBarDensity()
 
   useEffect(() => {
     mountedRef.current = true
@@ -67,18 +71,6 @@ export function useStatusBarController(floatingTerminalOpen: boolean) {
     void ensureDetectedAgents()
   }, [ensureDetectedAgents])
 
-  const containerRefCallback = useCallback((node: HTMLDivElement | null) => {
-    if (resizeObserverRef.current) {
-      resizeObserverRef.current.disconnect()
-      resizeObserverRef.current = null
-    }
-    if (node) {
-      containerRef.current = node
-      resizeObserverRef.current = observeStatusBarContainer(node, setContainerWidth)
-      setContainerWidth(node.getBoundingClientRect().width)
-    }
-  }, [])
-
   const refreshDetectedAgents = useAppStore((s) => s.refreshDetectedAgents)
   const handleRefresh = useCallback(async () => {
     if (isRefreshing) {
@@ -99,7 +91,8 @@ export function useStatusBarController(floatingTerminalOpen: boolean) {
     return null
   }
 
-  const { claude, codex, gemini, opencodeGo, kimi, antigravity, minimax, grok } = rateLimits
+  const { claude, codex, gemini, opencodeGo, kimi, antigravity, minimax, grok, cursor, zcode } =
+    rateLimits
 
   // Why: a bar is earned by a live snapshot or durable Settings setup; detection-gating hides per-CLI bars when the agent isn't on PATH.
   // Why: Antigravity has no persisted credential, so a checked status item + detected CLI is the durable "show its slot" signal.
@@ -114,7 +107,8 @@ export function useStatusBarController(floatingTerminalOpen: boolean) {
     minimaxCookieConfigured: rateLimits.minimaxCookieConfigured,
     minimaxApiKeyConfigured: rateLimits.minimaxApiKeyConfigured,
     opencodeGoApiKeyConfigured: rateLimits.opencodeGoApiKeyConfigured,
-    grokAuthConfigured: rateLimits.grokAuthConfigured
+    grokAuthConfigured: rateLimits.grokAuthConfigured,
+    cursorAuthConfigured: rateLimits.cursorAuthConfigured
   }
   const visibleClaude = getVisibleUsageProvider('claude', claude, usageSettings)
   const visibleCodex = getVisibleUsageProvider('codex', codex, usageSettings)
@@ -123,6 +117,8 @@ export function useStatusBarController(floatingTerminalOpen: boolean) {
   const visibleAntigravity = getVisibleUsageProvider('antigravity', antigravity, usageSettings)
   const visibleMiniMax = getVisibleUsageProvider('minimax', minimax, usageSettings)
   const visibleGrok = getVisibleUsageProvider('grok', grok, usageSettings)
+  const visibleCursor = getVisibleUsageProvider('cursor', cursor, usageSettings)
+  const visibleZcode = getVisibleUsageProvider('zcode', zcode, usageSettings)
   const showClaude =
     visibleClaude !== null &&
     statusBarItems.includes('claude') &&
@@ -149,6 +145,13 @@ export function useStatusBarController(floatingTerminalOpen: boolean) {
     visibleGrok !== null &&
     statusBarItems.includes('grok') &&
     isStatusBarItemAvailable('grok', detectedAgentIds)
+  // Why: a Cursor session can come from the IDE alone, so PATH detection of
+  // cursor-agent would hide a real meter from IDE-only users.
+  const showCursor = visibleCursor !== null && statusBarItems.includes('cursor')
+  const showZcode =
+    visibleZcode !== null &&
+    statusBarItems.includes('zcode') &&
+    isStatusBarItemAvailable('zcode', detectedAgentIds)
   // Why: OpenCode Go is web/cookie-auth, not a CLI on PATH, so detection-gating doesn't apply.
   const visibleOpencodeGo = getVisibleUsageProvider('opencode-go', opencodeGo, usageSettings)
   const showOpencodeGo = visibleOpencodeGo !== null && statusBarItems.includes('opencode-go')
@@ -166,11 +169,13 @@ export function useStatusBarController(floatingTerminalOpen: boolean) {
     showKimi ||
     showAntigravity ||
     showMiniMax ||
-    showGrok
+    showGrok ||
+    showCursor ||
+    showZcode
   const anyVisible = hasVisibleUsageMeters || showResourceUsage
   // Why: include Settings so durable managed accounts count — a configured user isn't shown the empty state while snapshots hydrate.
   const isEmptyUsageState = isUsageEmptyState(
-    { claude, codex, gemini, opencodeGo, kimi, antigravity, minimax, grok },
+    { claude, codex, gemini, opencodeGo, kimi, antigravity, minimax, grok, cursor, zcode },
     usageSettings
   )
   // Why: one-time nudge — once dismissed, stays hidden even if providers reconnect later.
@@ -183,10 +188,10 @@ export function useStatusBarController(floatingTerminalOpen: boolean) {
     kimi?.status === 'fetching' ||
     antigravity?.status === 'fetching' ||
     minimax?.status === 'fetching' ||
-    grok?.status === 'fetching'
+    grok?.status === 'fetching' ||
+    cursor?.status === 'fetching' ||
+    zcode?.status === 'fetching'
 
-  const compact = containerWidth < 900
-  const iconOnly = containerWidth < 500
   const floatingTerminalActionLabel = floatingTerminalOpen
     ? 'Minimize Floating Workspace'
     : 'Show Floating Workspace'
@@ -202,7 +207,9 @@ export function useStatusBarController(floatingTerminalOpen: boolean) {
     showOpencodeGo ? visibleOpencodeGo : null,
     showKimi ? visibleKimi : null,
     showMiniMax ? visibleMiniMax : null,
-    showGrok ? visibleGrok : null
+    showGrok ? visibleGrok : null,
+    showCursor ? visibleCursor : null,
+    showZcode ? visibleZcode : null
   ].filter((p): p is ProviderRateLimits => p !== null)
 
   const handleManageAccounts = (): void => {
@@ -235,8 +242,10 @@ export function useStatusBarController(floatingTerminalOpen: boolean) {
   return {
     anyFetching,
     anyVisible,
+    barRef,
+    collapseUsage,
+    collapsedUsageProviders,
     compact,
-    containerRefCallback,
     detectedAgentIds,
     floatingTerminalActionLabel,
     floatingTerminalShortcut,
@@ -246,14 +255,16 @@ export function useStatusBarController(floatingTerminalOpen: boolean) {
     handleUsageDetails,
     handleUsageMenuOpenChange,
     hasVisibleUsageMeters,
-    iconOnly,
     isEmptyUsageState,
     isRefreshing,
     menuOpen,
     menuPoint,
+    overflowing,
     petEnabled,
     recordFeatureInteraction,
     rosterProviders,
+    segmentsIconOnly,
+    segmentsRef,
     setMenuOpen,
     setMenuPoint,
     setStatusBarUsageMode,
@@ -268,7 +279,9 @@ export function useStatusBarController(floatingTerminalOpen: boolean) {
     toggleStatusBarItem,
     usageMenuFocusHandoff,
     usageMenuOpen,
-    usagePercentageDisplay
+    usagePercentageDisplay,
+    usageRef,
+    usageTightestOnly
   }
 }
 
diff --git a/src/renderer/src/components/tab-bar/TabBarCreateEntry.search.test.tsx b/src/renderer/src/components/tab-bar/TabBarCreateEntry.search.test.tsx
index b40166cbc1db..8a168bcb6844 100644
--- a/src/renderer/src/components/tab-bar/TabBarCreateEntry.search.test.tsx
+++ b/src/renderer/src/components/tab-bar/TabBarCreateEntry.search.test.tsx
@@ -99,6 +99,66 @@ afterEach(() => {
 })
 
 describe('TabBarCreateEntry search behavior', () => {
+  it.each([false, true])('searches weak file matches on Enter (delayed listing: %s)', (delayed) => {
+    const readyListing = {
+      files: [
+        'tests/e2e/terminal-split-activation-latency-main-probe.ts',
+        'src/main/linear/issue-context-inline-media.test.ts',
+        'src/renderer/src/components/editor/combined-diff/resolve-changes/combined-diff-section-cache-match.ts'
+      ],
+      loading: false,
+      loadError: null
+    }
+    fileListMock.current = delayed ? { files: [], loading: true, loadError: null } : readyListing
+    const onOpenEntry = vi.fn().mockResolvedValue(undefined)
+    renderEntry({ onOpenEntry })
+    setQuery('asciinema')
+
+    if (delayed) {
+      expect(container.querySelector('[aria-selected="true"]')).toBeNull()
+      submit()
+      expect(onOpenEntry).not.toHaveBeenCalled()
+      fileListMock.current = readyListing
+      renderEntry({ onOpenEntry })
+    }
+
+    expect(container.querySelector('[role="option"]')?.textContent).toContain('Search Google')
+    expect(container.querySelector('[aria-selected="true"]')?.textContent).toContain(
+      'Search Google'
+    )
+    submit()
+    expect(onOpenEntry).toHaveBeenCalledWith(
+      expect.objectContaining({
+        classification: { kind: 'search', engine: 'google', query: 'asciinema' }
+      })
+    )
+  })
+
+  it.each(['a', 'ab', 'asciinema'])('waits for an exact filename before arming %s', (query) => {
+    fileListMock.current = { files: [], loading: true, loadError: null }
+    const onOpenEntry = vi.fn().mockResolvedValue(undefined)
+    renderEntry({ onOpenEntry })
+    setQuery(query)
+
+    expect(container.querySelector('[aria-selected="true"]')).toBeNull()
+    submit()
+    expect(onOpenEntry).not.toHaveBeenCalled()
+
+    fileListMock.current = { files: [`docs/${query}`], loading: false, loadError: null }
+    renderEntry({ onOpenEntry })
+    expect(container.querySelector('[aria-selected="true"]')?.textContent).toContain('Open file')
+    submit()
+    expect(onOpenEntry).toHaveBeenCalledWith(
+      expect.objectContaining({
+        classification: {
+          kind: 'existing-file',
+          matchKind: 'exact-basename',
+          relativePath: `docs/${query}`
+        }
+      })
+    )
+  })
+
   it('tracks the configured provider and submits its exact classification', () => {
     const onOpenEntry = vi.fn().mockResolvedValue(undefined)
     renderEntry({ onOpenEntry })
diff --git a/src/renderer/src/components/tab-bar/tab-bar-item-surface.tsx b/src/renderer/src/components/tab-bar/tab-bar-item-surface.tsx
index 08f3df3bc98a..449b9628ca89 100644
--- a/src/renderer/src/components/tab-bar/tab-bar-item-surface.tsx
+++ b/src/renderer/src/components/tab-bar/tab-bar-item-surface.tsx
@@ -175,7 +175,7 @@ export function renderTabBarItems({
           onCloseToLeft={() => onCloseToLeft(item.id)}
           onDuplicate={
             runtime.managedBrowserCreationEnabled
-              ? () => onDuplicateBrowserTab?.(item.id)
+              ? () => onDuplicateBrowserTab?.(item.id, item.unifiedTabId)
               : undefined
           }
           onTogglePin={() => togglePinned(item)}
diff --git a/src/renderer/src/components/tab-bar/tab-bar-props.ts b/src/renderer/src/components/tab-bar/tab-bar-props.ts
index c7ee410530a3..a6dae82bba52 100644
--- a/src/renderer/src/components/tab-bar/tab-bar-props.ts
+++ b/src/renderer/src/components/tab-bar/tab-bar-props.ts
@@ -47,7 +47,7 @@ export type TabBarProps = {
   onActivateBrowserTab?: (tabId: string) => void
   onActivateAgentSession?: (tabId: string) => void
   onCloseBrowserTab?: (tabId: string) => void
-  onDuplicateBrowserTab?: (tabId: string) => void
+  onDuplicateBrowserTab?: (tabId: string, unifiedTabId: string) => void
   onCloseAllFiles?: () => void
   onMakePreviewFilePermanent?: (fileId: string, tabId?: string) => void
   onPinFile?: (fileId: string, tabId?: string) => void
diff --git a/src/renderer/src/components/tab-bar/tab-create-entry-classifier.test.ts b/src/renderer/src/components/tab-bar/tab-create-entry-classifier.test.ts
index 54bb018c96ec..0a272dad7e0f 100644
--- a/src/renderer/src/components/tab-bar/tab-create-entry-classifier.test.ts
+++ b/src/renderer/src/components/tab-bar/tab-create-entry-classifier.test.ts
@@ -194,9 +194,9 @@ describe('tab create entry classification', () => {
       relativePath: 'src/components/Button.tsx'
     })
     expect(classifyTabEntryQuery('btn', files)).toEqual({
-      kind: 'existing-file',
-      matchKind: 'fuzzy',
-      relativePath: 'src/components/Button.tsx'
+      kind: 'search',
+      engine: 'google',
+      query: 'btn'
     })
   })
 
@@ -212,6 +212,18 @@ describe('tab create entry classification', () => {
     ])
   })
 
+  it('keeps literal filename matches after an exact basename match', () => {
+    expect(
+      getTabEntryOptions('Makefile', readyFiles(['build/Makefile', 'build/Makefile.am'])).map(
+        (option) => option.classification
+      )
+    ).toEqual([
+      { kind: 'existing-file', matchKind: 'exact-basename', relativePath: 'build/Makefile' },
+      { kind: 'search', engine: 'google', query: 'Makefile' },
+      { kind: 'existing-file', matchKind: 'literal-basename', relativePath: 'build/Makefile.am' }
+    ])
+  })
+
   it('prefers creating typed file paths over fuzzy matches', () => {
     expect(
       getTabEntryOptions('read.md', readyFiles(['README.md'])).map(
@@ -224,7 +236,7 @@ describe('tab create entry classification', () => {
     ])
   })
 
-  it('keeps single-token quick-open matches ahead of search, but not phrases', () => {
+  it('keeps literal filename matches ahead of search, but not phrases', () => {
     expect(
       getTabEntryOptions('typescript', readyFiles(['docs/typescript-guide.md'])).map(
         (option) => option.classification
@@ -232,7 +244,7 @@ describe('tab create entry classification', () => {
     ).toEqual([
       {
         kind: 'existing-file',
-        matchKind: 'fuzzy',
+        matchKind: 'literal-basename',
         relativePath: 'docs/typescript-guide.md'
       },
       { kind: 'search', engine: 'google', query: 'typescript' },
@@ -260,7 +272,7 @@ describe('tab create entry classification', () => {
   })
 
   // Fuzzy matching is a subsequence scan, so a short token matches broadly.
-  it('keeps a search slot when fuzzy matches would fill the whole list', () => {
+  it('puts search ahead of fuzzy filename and path matches', () => {
     const files = [
       'src/components/Button.tsx',
       'src/lib/bootstrap-nav.ts',
@@ -269,15 +281,14 @@ describe('tab create entry classification', () => {
       'src/bin/tune.ts'
     ]
     expect(getTabEntryOptions('btn', readyFiles(files)).map((o) => o.classification.kind)).toEqual([
+      'search',
       'existing-file',
       'existing-file',
-      'existing-file',
-      'search'
+      'existing-file'
     ])
-    // A one-slot list still answers with the file, so Enter keeps quick-open.
     expect(
       getTabEntryOptions('btn', readyFiles(files), 1).map((o) => o.classification.kind)
-    ).toEqual(['existing-file'])
+    ).toEqual(['search'])
   })
 
   it('ranks search before ordinary create-file actions', () => {
diff --git a/src/renderer/src/components/tab-bar/tab-create-entry-classifier.ts b/src/renderer/src/components/tab-bar/tab-create-entry-classifier.ts
index 78de06106a80..5c1b715d5f14 100644
--- a/src/renderer/src/components/tab-bar/tab-create-entry-classifier.ts
+++ b/src/renderer/src/components/tab-bar/tab-create-entry-classifier.ts
@@ -3,7 +3,11 @@ import type { RuntimeFileListState } from '../quick-open-file-list'
 import { translate } from '@/i18n/i18n'
 import { getTabEntryOmniboxPlaceholder } from './tab-create-entry-copy'
 import { DEFAULT_SEARCH_ENGINE, type SearchEngine } from '../../../../shared/browser-url'
-import { findExistingFileMatches, isLikelyNewFileIntent } from './tab-create-entry-file-matches'
+import {
+  findExistingFileMatches,
+  isLikelyNewFileIntent,
+  type ExistingFileMatch
+} from './tab-create-entry-file-matches'
 import { parseForcedSearchQuery } from './tab-create-entry-forced-search'
 import {
   isTabEntryAbsolutePathLike,
@@ -31,11 +35,7 @@ export const TAB_ENTRY_ABSOLUTE_PATH_REMOTE_BLOCKED_MESSAGE =
 export type TabEntryClassification =
   | { kind: 'empty'; message: string }
   | { kind: 'explicit-url'; url: string }
-  | {
-      kind: 'existing-file'
-      matchKind: 'exact-path' | 'exact-basename' | 'fuzzy'
-      relativePath: string
-    }
+  | ExistingFileMatch
   | { kind: 'host-url'; url: string }
   | { kind: 'search'; engine: SearchEngine; query: string }
   | { kind: 'new-file'; relativePath: string }
@@ -223,8 +223,9 @@ export function getTabEntryOptions(
     getPreparedQuickOpenFiles(fileList.files),
     Math.max(actionLimit, 1)
   )
-  const exactExistingFiles = existingFiles.filter((file) => file.matchKind !== 'fuzzy')
-  const fuzzyExistingFiles = existingFiles.filter((file) => file.matchKind === 'fuzzy')
+  const exactExistingFiles = existingFiles.filter(
+    (file) => file.matchKind === 'exact-path' || file.matchKind === 'exact-basename'
+  )
 
   if (exactExistingFiles.length > 0) {
     const options: TabEntryActionClassification[] = [...exactExistingFiles]
@@ -233,37 +234,41 @@ export function getTabEntryOptions(
     } else if (!hostUrl && newFile) {
       options.push(search)
     }
+    options.push(...existingFiles.filter((file) => file.matchKind === 'literal-basename'))
     return toOptions(options, actionLimit)
   }
   if (hostUrl?.kind === 'blocked') {
     return [blockedOption('invalid-url', hostUrl.message)]
   }
   if (hostUrl?.kind === 'host-url') {
-    return toOptions([hostUrl, ...fuzzyExistingFiles], actionLimit)
+    return toOptions([hostUrl, ...existingFiles], actionLimit)
   }
   if (pathError || !newFile) {
     // Why: an unusable path is still a live quick-open prefix — "src/" cannot be
     // created, but it matches real files, and dropping them turns every typed
     // separator into an error row mid-keystroke.
-    return fuzzyExistingFiles.length > 0
-      ? toOptions(fuzzyExistingFiles, actionLimit)
+    return existingFiles.length > 0
+      ? toOptions(existingFiles, actionLimit)
       : [invalidPathOption(pathError)]
   }
   if (isLikelyNewFileIntent(trimmed)) {
-    return toOptions([newFile, search, ...fuzzyExistingFiles], actionLimit)
+    return toOptions([newFile, search, ...existingFiles], actionLimit)
   }
   // Why no create row: a spaced, extension-less phrase is a web query, and a
   // stray arrow/click on "Create file" leaves an empty `release notes` on disk
   // that then outranks search as an exact match forever after.
   if (/\s/.test(trimmed)) {
-    return toOptions([search, ...fuzzyExistingFiles], actionLimit)
+    return toOptions([search, ...existingFiles], actionLimit)
+  }
+  // Short Latin tokens match too many filenames to imply file intent; CJK words can be short.
+  if (/^[\p{Script=Latin}\p{Nd}]{1,2}$/u.test(trimmed.normalize('NFC'))) {
+    return toOptions([search, ...existingFiles, newFile], actionLimit)
   }
-  // Why: a single token is still a quick-open attempt ("btn" → Button.tsx), so
-  // only phrases promote web search over fuzzy matches. Fuzzy matching is a
-  // subsequence scan that fills every slot in a real repo, so hold one back —
-  // otherwise search silently disappears from the list it should always offer.
+  const literalFiles = existingFiles.filter((file) => file.matchKind === 'literal-basename')
+  const fuzzyFiles = existingFiles.filter((file) => file.matchKind === 'fuzzy')
+  // Reserve a search slot even when literal filename matches fill the list.
   return toOptions(
-    [...fuzzyExistingFiles.slice(0, Math.max(actionLimit - 1, 1)), search, newFile],
+    [...literalFiles.slice(0, Math.max(actionLimit - 1, 1)), search, ...fuzzyFiles, newFile],
     actionLimit
   )
 }
diff --git a/src/renderer/src/components/tab-bar/tab-create-entry-file-matches.test.ts b/src/renderer/src/components/tab-bar/tab-create-entry-file-matches.test.ts
index 8ac46512051b..b271d168e78e 100644
--- a/src/renderer/src/components/tab-bar/tab-create-entry-file-matches.test.ts
+++ b/src/renderer/src/components/tab-bar/tab-create-entry-file-matches.test.ts
@@ -2,6 +2,7 @@ import { expect, it, vi } from 'vitest'
 import { prepareQuickOpenFiles, rankQuickOpenFiles } from '../quick-open-search'
 import { findExistingFileMatches } from './tab-create-entry-file-matches'
 import type * as QuickOpenSearch from '../quick-open-search'
+import { compareFileNames } from '../../../../shared/file-name-sort'
 
 const ranking = vi.hoisted(() => ({ calls: 0 }))
 vi.mock('../quick-open-search', async (importOriginal) => {
@@ -28,6 +29,20 @@ it('skips fuzzy ranking when exact matches fill the requested window', () => {
   expect(ranking.calls).toBe(0)
 })
 
+it('selects literal filenames from a large inventory without running fuzzy ranking', () => {
+  const files = prepareQuickOpenFiles([
+    ...Array.from({ length: 100_000 }, (_, index) => `a/s/c/i/i/n/e/m/a/file-${index}.ts`),
+    'docs/asciinema-10.md',
+    'docs/asciinema-2.md'
+  ])
+  ranking.calls = 0
+  expect(findExistingFileMatches('asciinema', files, 2).map((file) => file.relativePath)).toEqual([
+    'docs/asciinema-2.md',
+    'docs/asciinema-10.md'
+  ])
+  expect(ranking.calls).toBe(0)
+})
+
 it('deduplicates exact paths and still fills remaining slots with fuzzy matches', () => {
   const files = prepareQuickOpenFiles(['a.md', 'a.md', 'other/a.md', 'abc.md'])
   expect(findExistingFileMatches('a.md', files, 4)).toEqual([
@@ -37,14 +52,12 @@ it('deduplicates exact paths and still fills remaining slots with fuzzy matches'
   ])
 })
 
-// Why: skipping the ranker is only sound because a fuzzy hit can never outrank an
-// exact one — exact results are concatenated first and dedupe is first-wins, so the
-// exact prefix is exactly what a full ranked-then-sliced list would have returned.
-// This re-runs the pre-skip pipeline and holds the shipped one to it.
+// Sort every literal candidate to check the bounded selection against a full reference.
 function rankThenSlice(
   query: string,
   files: readonly QuickOpenSearch.QuickOpenIndexedFile[],
-  limit: number
+  limit: number,
+  preferLiteralFilenames = false
 ): { kind: string; matchKind: string; relativePath: string }[] {
   const normalized = query.trim().replace(/\\/g, '/')
   if (!normalized || limit <= 0) {
@@ -56,6 +69,12 @@ function rankThenSlice(
     ...files
       .filter((f) => f.lowerFilename === lower)
       .map((f) => ['exact-basename', f.path] as const),
+    ...(preferLiteralFilenames
+      ? files
+          .filter((file) => file.lowerFilename.includes(lower))
+          .sort((a, b) => compareFileNames(a.path, b.path))
+          .map((file) => ['literal-basename', file.path] as const)
+      : []),
     ...rankQuickOpenFiles(normalized, files, limit).map((f) => ['fuzzy', f.path] as const)
   ]
   const seen = new Set<string>()
@@ -65,7 +84,7 @@ function rankThenSlice(
     .slice(0, limit)
 }
 
-it('returns what rank-then-slice would have returned, including at limit 1', () => {
+it('preserves quick-open ordering for explicit file and path queries, including at limit 1', () => {
   const corpus = [
     ['a.md', 'ab.md', 'abc.md', 'deep/nested/a.md'],
     ['ab.md', 'abc.md', 'deep/nested/a.md'],
@@ -74,7 +93,7 @@ it('returns what rank-then-slice would have returned, including at limit 1', ()
     ['README.md', 'docs/readme.md', 'readme.mdx'],
     ['only-fuzzy.md']
   ]
-  const queries = ['a.md', 'index.ts', 'readme.md', 'src/index.ts', 'a', 'nope.md']
+  const queries = ['a.md', 'index.ts', 'readme.md', 'src/index.ts', 'nope.md']
   for (const paths of corpus) {
     const files = prepareQuickOpenFiles(paths)
     for (const query of queries) {
@@ -90,6 +109,46 @@ it('returns what rank-then-slice would have returned, including at limit 1', ()
   }
 })
 
+it('matches the full literal-first reference for bare tokens across limits and input orders', () => {
+  const queries = ['a', 'ab', 'abc', 'BTN', 'button', 'asciinema', '工具', 'é']
+  for (const query of queries) {
+    const paths = [
+      ...Array.from({ length: 12 }, (_, index) => `${[...query].join('/')}/file-${index}.ts`),
+      `docs/${query}-10.md`,
+      `docs/${query}-2.md`,
+      `docs/${query}-2.md`,
+      `docs\\${query.toLowerCase()}-guide.md`,
+      `docs/a${'x'.repeat(120)}-${query.toUpperCase()}.md`,
+      'unrelated.txt'
+    ]
+    for (const corpus of [paths, [...paths, query, `docs/${query}`, query]]) {
+      for (const orderedPaths of [corpus, corpus.toReversed()]) {
+        const files = prepareQuickOpenFiles(orderedPaths)
+        for (const limit of [0, 1, 2, 3, 5, 20]) {
+          expect({
+            query,
+            limit,
+            matches: findExistingFileMatches(` ${query} `, files, limit)
+          }).toEqual({ query, limit, matches: rankThenSlice(query, files, limit, true) })
+        }
+      }
+    }
+  }
+})
+
+it('does not let duplicate literal candidates consume the result limit', () => {
+  const files = prepareQuickOpenFiles([
+    ...Array.from({ length: 10 }, () => 'docs/button-1.md'),
+    'docs/button-2.md'
+  ])
+  ranking.calls = 0
+  expect(findExistingFileMatches('button', files, 2)).toEqual([
+    { kind: 'existing-file', matchKind: 'literal-basename', relativePath: 'docs/button-1.md' },
+    { kind: 'existing-file', matchKind: 'literal-basename', relativePath: 'docs/button-2.md' }
+  ])
+  expect(ranking.calls).toBe(0)
+})
+
 it('takes the exact match at limit 1 without consulting the ranker at all', () => {
   const files = prepareQuickOpenFiles(['a.md', 'ab.md', 'abc.md', 'deep/nested/a.md'])
   ranking.calls = 0
diff --git a/src/renderer/src/components/tab-bar/tab-create-entry-file-matches.ts b/src/renderer/src/components/tab-bar/tab-create-entry-file-matches.ts
index eb2f19576d89..72233be30758 100644
--- a/src/renderer/src/components/tab-bar/tab-create-entry-file-matches.ts
+++ b/src/renderer/src/components/tab-bar/tab-create-entry-file-matches.ts
@@ -1,8 +1,12 @@
-import { rankQuickOpenFiles, type QuickOpenIndexedFile } from '../quick-open-search'
+import {
+  QuickOpenPathRanker,
+  rankQuickOpenFiles,
+  type QuickOpenIndexedFile
+} from '../quick-open-search'
 
 export type ExistingFileMatch = {
   kind: 'existing-file'
-  matchKind: 'exact-path' | 'exact-basename' | 'fuzzy'
+  matchKind: 'exact-path' | 'exact-basename' | 'literal-basename' | 'fuzzy'
   relativePath: string
 }
 
@@ -36,6 +40,27 @@ export function isLikelyNewFileIntent(query: string): boolean {
   return hasFilenameExtension(trimmed) || /^\.[^.].*$/.test(trimmed)
 }
 
+function findLiteralFilenameMatches(
+  query: string,
+  files: readonly QuickOpenIndexedFile[],
+  limit: number
+): ExistingFileMatch[] {
+  // Natural ordering avoids arbitrary fuzzy scores among literal filename matches.
+  const ranker = new QuickOpenPathRanker('', limit)
+  const seen = new Set<string>()
+  for (const file of files) {
+    if (file.lowerFilename.includes(query) && !seen.has(file.path)) {
+      seen.add(file.path)
+      ranker.consider(file.path)
+    }
+  }
+  return ranker.result().paths.map((relativePath) => ({
+    kind: 'existing-file',
+    matchKind: 'literal-basename',
+    relativePath
+  }))
+}
+
 function dedupeMatches(matches: ExistingFileMatch[]): ExistingFileMatch[] {
   const seen = new Set<string>()
   return matches.filter((match) => {
@@ -75,11 +100,21 @@ export function findExistingFileMatches(
   if (exactMatches.length >= limit) {
     return exactMatches.slice(0, limit)
   }
+  const preferFilenames = !isLikelyNewFileIntent(normalizedQuery) && !/\s/.test(normalizedQuery)
+  const preferredMatches = preferFilenames
+    ? dedupeMatches([
+        ...exactMatches,
+        ...findLiteralFilenameMatches(lowerQuery, indexedFiles, limit)
+      ])
+    : exactMatches
+  if (preferredMatches.length >= limit) {
+    return preferredMatches.slice(0, limit)
+  }
   const fuzzyMatches = rankQuickOpenFiles(normalizedQuery, indexedFiles, limit).map((file) => ({
     kind: 'existing-file' as const,
     matchKind: 'fuzzy' as const,
     relativePath: file.path
   }))
 
-  return dedupeMatches([...exactMatches, ...fuzzyMatches]).slice(0, limit)
+  return dedupeMatches([...preferredMatches, ...fuzzyMatches]).slice(0, limit)
 }
diff --git a/src/renderer/src/components/tab-bar/tab-create-entry-history-placement.test.ts b/src/renderer/src/components/tab-bar/tab-create-entry-history-placement.test.ts
index 7907a075b252..d0557dfd13a3 100644
--- a/src/renderer/src/components/tab-bar/tab-create-entry-history-placement.test.ts
+++ b/src/renderer/src/components/tab-bar/tab-create-entry-history-placement.test.ts
@@ -2,10 +2,11 @@ import { describe, expect, it } from 'vitest'
 import { insertHistoryRowsBelowFileMatches } from './tab-create-entry-history-placement'
 import type { BrowserHistoryOmniboxRow } from './tab-create-entry-active-option'
 import type { TabEntryOption } from './tab-create-entry-action'
+import type { ExistingFileMatch } from './tab-create-entry-file-matches'
 
 function fileOption(
   relativePath: string,
-  matchKind: 'exact-path' | 'exact-basename' | 'fuzzy'
+  matchKind: ExistingFileMatch['matchKind']
 ): TabEntryOption {
   return {
     id: `existing-file:${relativePath}`,
@@ -40,7 +41,7 @@ describe('tab create entry history placement', () => {
     const placed = insertHistoryRowsBelowFileMatches(
       [
         fileOption('README.md', 'exact-basename'),
-        fileOption('docs/readme-notes.md', 'fuzzy'),
+        fileOption('docs/readme-notes.md', 'literal-basename'),
         newFileOption,
         searchOption
       ],
@@ -53,9 +54,9 @@ describe('tab create entry history placement', () => {
     expect(placed[3]).toMatchObject({ option: { id: 'new-file:readme' } })
   })
 
-  it('stays below a fuzzy match that is the only file row', () => {
+  it.each(['literal-basename', 'fuzzy'] as const)('stays below a lone %s file row', (matchKind) => {
     const placed = insertHistoryRowsBelowFileMatches(
-      [fileOption('docs/readme-notes.md', 'fuzzy'), searchOption],
+      [fileOption('docs/readme-notes.md', matchKind), searchOption],
       rows
     )
 
diff --git a/src/renderer/src/components/tab-bar/tab-create-entry-search-ranking.test.ts b/src/renderer/src/components/tab-bar/tab-create-entry-search-ranking.test.ts
new file mode 100644
index 000000000000..82a9a2bfb14a
--- /dev/null
+++ b/src/renderer/src/components/tab-bar/tab-create-entry-search-ranking.test.ts
@@ -0,0 +1,139 @@
+import { describe, expect, it } from 'vitest'
+import { classifyTabEntryQuery, getTabEntryOptions } from './tab-create-entry-classifier'
+import { prepareQuickOpenFiles } from '../quick-open-search'
+import { findExistingFileMatches } from './tab-create-entry-file-matches'
+
+const unrelatedFiles = [
+  'tests/e2e/terminal-split-activation-latency-main-probe.ts',
+  'src/main/linear/issue-context-inline-media.test.ts',
+  'src/renderer/src/components/editor/combined-diff/resolve-changes/combined-diff-section-cache-match.ts'
+]
+const readyFiles = (files: string[]) => ({ files, loading: false, loadError: null })
+
+describe('new-tab file matches versus web search', () => {
+  it('puts search ahead of scattered path matches for asciinema', () => {
+    const options = getTabEntryOptions('asciinema', readyFiles(unrelatedFiles))
+    expect(options.map((option) => option.classification.kind)).toEqual([
+      'search',
+      'existing-file',
+      'existing-file',
+      'existing-file'
+    ])
+    expect(classifyTabEntryQuery('asciinema', readyFiles(unrelatedFiles))).toEqual({
+      kind: 'search',
+      engine: 'google',
+      query: 'asciinema'
+    })
+  })
+
+  it('keeps an actual filename match ahead of search and weak matches below it', () => {
+    const options = getTabEntryOptions(
+      'asciinema',
+      readyFiles([...unrelatedFiles, 'docs/asciinema-guide.md'])
+    )
+    expect(options[0].classification).toMatchObject({
+      kind: 'existing-file',
+      relativePath: 'docs/asciinema-guide.md'
+    })
+    expect(options[1].classification.kind).toBe('search')
+    expect(options.slice(2).every((option) => option.classification.kind === 'existing-file')).toBe(
+      true
+    )
+  })
+
+  it.each([1, 2, 4, 8])('finds a literal filename before limiting to %i actions', (limit) => {
+    const files = readyFiles([
+      ...Array.from({ length: 10 }, (_, index) => `b/u/t/t/o/n/file-${index}.ts`),
+      'src/components/Button.tsx'
+    ])
+    expect(getTabEntryOptions('button', files, limit)[0].classification).toMatchObject({
+      kind: 'existing-file',
+      relativePath: 'src/components/Button.tsx'
+    })
+  })
+
+  it('offers fuzzy filename abbreviations below search', () => {
+    expect(
+      getTabEntryOptions('btn', readyFiles(['src/components/Button.tsx'])).map(
+        (option) => option.classification
+      )
+    ).toEqual([
+      { kind: 'search', engine: 'google', query: 'btn' },
+      { kind: 'existing-file', matchKind: 'fuzzy', relativePath: 'src/components/Button.tsx' },
+      { kind: 'new-file', relativePath: 'btn' }
+    ])
+  })
+
+  it('finds literal filenames even when their old fuzzy score falls outside the result limit', () => {
+    const target = `docs/a${'x'.repeat(120)}-asciinema.md`
+    const files = readyFiles([
+      ...Array.from({ length: 10 }, (_, index) => `a/s/c/i/i/n/e/m/a/file-${index}.ts`),
+      target
+    ])
+    expect(getTabEntryOptions('asciinema', files)[0].classification).toMatchObject({
+      kind: 'existing-file',
+      relativePath: target
+    })
+  })
+
+  it.each([
+    ['btn', 'src/components/Button.tsx', false],
+    ['button', 'src/components/Button.tsx', true],
+    ['asciinema', 'docs/ASCIINEMA-guide.md', true],
+    ['asciinema', 'docs\\ASCIINEMA-guide.md', true],
+    ['asciinema', `docs/a${'x'.repeat(120)}-asciinema.md`, true],
+    ['asciinema', unrelatedFiles[0], false],
+    ['asciinema', unrelatedFiles[1], false],
+    ['asciinema', unrelatedFiles[2], false],
+    ['abc', 'alphabet-biology-chemistry.md', false],
+    ['abc', 'a----b----c.md', false],
+    ['btn', 'src/base/tone.ts', false]
+  ])('reports literal filename matching for %s in %s', (query, path, matches) => {
+    const results = findExistingFileMatches(query, prepareQuickOpenFiles([path]), 1)
+    expect(results.some((result) => result.matchKind === 'literal-basename')).toBe(matches)
+  })
+
+  it.each(['a', 'AB', 'é', 'e\u0301', '12'])('puts search first for short token %s', (query) => {
+    const files = readyFiles(
+      Array.from({ length: 10 }, (_, index) => `docs/${query}-guide-${index}.md`)
+    )
+    for (const limit of [1, 2, 4, 8]) {
+      const options = getTabEntryOptions(query, files, limit)
+      expect(options[0].classification).toEqual({ kind: 'search', engine: 'google', query })
+      expect(options.slice(1).map((option) => option.classification)).toEqual(
+        Array.from({ length: limit - 1 }, (_, index) => ({
+          kind: 'existing-file',
+          matchKind: 'literal-basename',
+          relativePath: `docs/${query}-guide-${index}.md`
+        }))
+      )
+    }
+  })
+
+  it.each(['a', 'ab'])('keeps exact short filename %s ahead of search', (query) => {
+    for (const relativePath of [query, `docs/${query}`]) {
+      const files = readyFiles([`${query}-guide.md`, relativePath])
+      expect(classifyTabEntryQuery(query, files)).toEqual({
+        kind: 'existing-file',
+        matchKind: relativePath === query ? 'exact-path' : 'exact-basename',
+        relativePath
+      })
+    }
+  })
+
+  it.each(['文', '工具'])('keeps short CJK filename matches ahead of search for %s', (query) => {
+    expect(classifyTabEntryQuery(query, readyFiles([`docs/${query}指南.md`]))).toEqual({
+      kind: 'existing-file',
+      matchKind: 'literal-basename',
+      relativePath: `docs/${query}指南.md`
+    })
+  })
+
+  it('reserves search when literal filenames fill the list', () => {
+    const files = readyFiles(['button.tsx', 'button.css', 'button.test.ts', 'button.md'])
+    expect(getTabEntryOptions('button', files).map((option) => option.classification.kind)).toEqual(
+      ['existing-file', 'existing-file', 'existing-file', 'search']
+    )
+    expect(classifyTabEntryQuery('button', files).kind).toBe('existing-file')
+  })
+})
diff --git a/src/renderer/src/components/tab-bar/tab-strip-growth-scroll.test.tsx b/src/renderer/src/components/tab-bar/tab-strip-growth-scroll.test.tsx
new file mode 100644
index 000000000000..f18f8333ee3a
--- /dev/null
+++ b/src/renderer/src/components/tab-bar/tab-strip-growth-scroll.test.tsx
@@ -0,0 +1,141 @@
+// @vitest-environment happy-dom
+import { act, cleanup, render } from '@testing-library/react'
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+import { useTabStripOverflowNavigation } from './tab-strip-overflow-navigation'
+
+const TAB_WIDTH = 100
+const VIEWPORT_WIDTH = 300
+
+const scrollLeftByElement = new WeakMap<Element, number>()
+const originals = {
+  rect: HTMLElement.prototype.getBoundingClientRect,
+  scrollIntoView: HTMLElement.prototype.scrollIntoView,
+  scrollLeft: Object.getOwnPropertyDescriptor(HTMLElement.prototype, 'scrollLeft'),
+  scrollWidth: Object.getOwnPropertyDescriptor(HTMLElement.prototype, 'scrollWidth'),
+  clientWidth: Object.getOwnPropertyDescriptor(HTMLElement.prototype, 'clientWidth')
+}
+
+function isStrip(el: Element): boolean {
+  return el.hasAttribute('data-strip')
+}
+
+function rect(left: number, width: number): DOMRect {
+  return DOMRect.fromRect({ x: left, y: 0, width, height: 20 })
+}
+
+/** 100px tabs in a 300px strip; a tab's x is its index minus the strip's scroll. */
+function installStripLayout(): void {
+  Object.defineProperty(HTMLElement.prototype, 'scrollWidth', {
+    configurable: true,
+    get(this: Element) {
+      return isStrip(this) ? this.children.length * TAB_WIDTH : 0
+    }
+  })
+  Object.defineProperty(HTMLElement.prototype, 'clientWidth', {
+    configurable: true,
+    get(this: Element) {
+      return isStrip(this) ? VIEWPORT_WIDTH : 0
+    }
+  })
+  Object.defineProperty(HTMLElement.prototype, 'scrollLeft', {
+    configurable: true,
+    get(this: Element) {
+      return scrollLeftByElement.get(this) ?? 0
+    },
+    set(this: Element, value: number) {
+      const max = Math.max(0, this.scrollWidth - this.clientWidth)
+      scrollLeftByElement.set(this, Math.min(max, Math.max(0, value)))
+    }
+  })
+  HTMLElement.prototype.getBoundingClientRect = function (this: HTMLElement): DOMRect {
+    if (isStrip(this)) {
+      return rect(0, VIEWPORT_WIDTH)
+    }
+    const strip = this.parentElement
+    if (strip && isStrip(strip)) {
+      const index = Array.from(strip.children).indexOf(this)
+      return rect(index * TAB_WIDTH - strip.scrollLeft, TAB_WIDTH)
+    }
+    return rect(0, 0)
+  }
+  HTMLElement.prototype.scrollIntoView = function (): void {}
+}
+
+function restoreStripLayout(): void {
+  HTMLElement.prototype.getBoundingClientRect = originals.rect
+  HTMLElement.prototype.scrollIntoView = originals.scrollIntoView
+  for (const key of ['scrollLeft', 'scrollWidth', 'clientWidth'] as const) {
+    const descriptor = originals[key]
+    if (descriptor) {
+      Object.defineProperty(HTMLElement.prototype, key, descriptor)
+    } else {
+      Reflect.deleteProperty(HTMLElement.prototype, key)
+    }
+  }
+}
+
+function Strip({ tabs, active }: { tabs: string[]; active: string }): React.JSX.Element {
+  const navigation = useTabStripOverflowNavigation({
+    activeVisibleTabId: active,
+    layoutKey: tabs.join(','),
+    tabCount: tabs.length,
+    worktreeId: 'wt-1'
+  })
+  return (
+    <div data-strip="" ref={navigation.tabStripRef}>
+      {tabs.map((id) => (
+        <div key={id} data-tab-id={id} />
+      ))}
+    </div>
+  )
+}
+
+const TABS = ['A', 'B', 'C', 'D', 'E', 'F', 'G', 'H', 'I', 'J']
+
+function mountScrolled(active: string, scrollLeft: number) {
+  const view = render(<Strip tabs={TABS} active={active} />)
+  const strip = view.container.querySelector<HTMLElement>('[data-strip]')!
+  act(() => {
+    strip.scrollLeft = scrollLeft
+    strip.dispatchEvent(new Event('scroll'))
+  })
+  return { ...view, strip }
+}
+
+function tabX(strip: HTMLElement, id: string): number {
+  return strip.querySelector<HTMLElement>(`[data-tab-id="${id}"]`)!.getBoundingClientRect().left
+}
+
+describe('tab strip scroll when tabs are added', () => {
+  beforeEach(installStripLayout)
+  afterEach(() => {
+    cleanup()
+    restoreStripLayout()
+  })
+
+  it('keeps the viewed tab still when a background tab lands to its left', () => {
+    const { strip, rerender } = mountScrolled('F', 400)
+    expect(tabX(strip, 'F')).toBe(100)
+    rerender(<Strip tabs={['A', 'B', 'N', ...TABS.slice(2)]} active="F" />)
+    expect(tabX(strip, 'F')).toBe(100)
+  })
+
+  it('keeps the viewed tab still when a background tab lands after it', () => {
+    const { strip, rerender } = mountScrolled('F', 400)
+    rerender(<Strip tabs={[...TABS.slice(0, 6), 'N', ...TABS.slice(6)]} active="F" />)
+    expect(strip.scrollLeft).toBe(400)
+    expect(tabX(strip, 'F')).toBe(100)
+  })
+
+  it('does not jump to the end for a background tab while pinned to the end', () => {
+    const { strip, rerender } = mountScrolled('J', 700)
+    rerender(<Strip tabs={[...TABS, 'N']} active="J" />)
+    expect(tabX(strip, 'J')).toBe(200)
+  })
+
+  it('scrolls to the end for a foreground tab appended at the end', () => {
+    const { strip, rerender } = mountScrolled('C', 0)
+    rerender(<Strip tabs={[...TABS, 'N']} active="N" />)
+    expect(strip.scrollLeft).toBe(800)
+  })
+})
diff --git a/src/renderer/src/components/tab-bar/tab-strip-overflow-navigation.ts b/src/renderer/src/components/tab-bar/tab-strip-overflow-navigation.ts
index 77af550b748a..462a97e9405d 100644
--- a/src/renderer/src/components/tab-bar/tab-strip-overflow-navigation.ts
+++ b/src/renderer/src/components/tab-bar/tab-strip-overflow-navigation.ts
@@ -6,6 +6,12 @@ import {
   type TabStripScrollMetrics
 } from './tab-strip-scroll-metrics'
 import { isTabStripPointerGestureActive } from './tab-strip-pointer-gesture'
+import {
+  captureTabStripScrollAnchor,
+  isLastTabStripTab,
+  restoreTabStripScrollAnchor,
+  type TabStripScrollAnchor
+} from './tab-strip-scroll-anchor'
 
 const TAB_STRIP_SCROLL_FRACTION = 0.75
 const TAB_STRIP_MIN_SCROLL_STEP_PX = 120
@@ -25,6 +31,11 @@ export function scrollTabStripByStep(
   })
 }
 
+function isTabStripScrolledToEnd(el: HTMLElement): boolean {
+  const max = Math.max(0, el.scrollWidth - el.clientWidth)
+  return el.scrollLeft >= max - 2
+}
+
 const EMPTY_TAB_STRIP_OVERFLOW_STATE: TabStripScrollMetrics = {
   hasOverflow: false,
   canScrollStart: false,
@@ -51,6 +62,11 @@ export function useTabStripOverflowNavigation({
   const tabStripRef = useRef<HTMLDivElement>(null)
   const prevStripLenRef = useRef<{ worktreeId: string; len: number } | null>(null)
   const stickToEndRef = useRef(false)
+  const activeTabIdRef = useRef<string | null>(null)
+  const scrollAnchorRef = useRef<{
+    activeTabId: string | null
+    anchor: TabStripScrollAnchor | null
+  } | null>(null)
   const [tabStripOverflowState, setTabStripOverflowState] = useState<TabStripScrollMetrics>(
     EMPTY_TAB_STRIP_OVERFLOW_STATE
   )
@@ -74,6 +90,14 @@ export function useTabStripOverflowNavigation({
     },
     []
   )
+  const recordScrollAnchor = useCallback((): void => {
+    const el = tabStripRef.current
+    if (!el) {
+      return
+    }
+    const activeTabId = activeTabIdRef.current
+    scrollAnchorRef.current = { activeTabId, anchor: captureTabStripScrollAnchor(el, activeTabId) }
+  }, [])
 
   useEffect(() => {
     const el = tabStripRef.current
@@ -96,14 +120,11 @@ export function useTabStripOverflowNavigation({
     if (!el) {
       return
     }
-    const isAtEnd = (): boolean => {
-      const max = Math.max(0, el.scrollWidth - el.clientWidth)
-      return el.scrollLeft >= max - 2
-    }
     const onScroll = (): void => {
       // Only keep sticking while the user hasn't intentionally scrolled away.
-      stickToEndRef.current = isAtEnd()
+      stickToEndRef.current = isTabStripScrolledToEnd(el)
       updateTabStripOverflowState()
+      recordScrollAnchor()
     }
     el.addEventListener('scroll', onScroll, { passive: true })
     onScroll()
@@ -112,13 +133,10 @@ export function useTabStripOverflowNavigation({
       updateTabStripOverflowState()
       // If the user is pinned to the right edge, keep it pinned even as tab
       // labels (e.g. "Terminal 5" -> branch name) expand and change scrollWidth.
-      if (!stickToEndRef.current) {
-        return
-      }
-      if (isTabStripPointerGestureActive()) {
-        return
+      if (stickToEndRef.current && !isTabStripPointerGestureActive()) {
+        el.scrollLeft = Math.max(0, el.scrollWidth - el.clientWidth)
       }
-      el.scrollLeft = Math.max(0, el.scrollWidth - el.clientWidth)
+      recordScrollAnchor()
     }
 
     const disconnectResizeObservers = bindTabStripContentResizeObservers(el, handleStripResize)
@@ -127,7 +145,12 @@ export function useTabStripOverflowNavigation({
       el.removeEventListener('scroll', onScroll)
       disconnectResizeObservers()
     }
-  }, [updateTabStripOverflowState])
+  }, [recordScrollAnchor, updateTabStripOverflowState])
+
+  // Why a ref set first: the growth effect below must see this commit's active tab without re-running on every tab switch.
+  useLayoutEffect(() => {
+    activeTabIdRef.current = activeVisibleTabId
+  }, [activeVisibleTabId])
 
   useLayoutEffect(() => {
     const strip = tabStripRef.current
@@ -142,56 +165,65 @@ export function useTabStripOverflowNavigation({
       return
     }
     const pointerGestureActive = isTabStripPointerGestureActive()
-    if (stickToEndRef.current && !pointerGestureActive) {
-      const scrollToEnd = (): void => {
-        const el = tabStripRef.current
-        if (!el) {
-          return
-        }
-        el.scrollLeft = Math.max(0, el.scrollWidth - el.clientWidth)
-        updateTabStripOverflowState()
+    const scrollToEnd = (stick: boolean): void => {
+      const el = tabStripRef.current
+      if (!el) {
+        return
       }
-      scrollToEnd()
-      requestAnimationFrame(scrollToEnd)
+      el.scrollLeft = Math.max(0, el.scrollWidth - el.clientWidth)
+      if (stick) {
+        stickToEndRef.current = true
+      }
+      updateTabStripOverflowState()
     }
+    const recorded = scrollAnchorRef.current
     if (tabCount > prev.len && !pointerGestureActive) {
-      const scrollToEnd = (): void => {
-        const el = tabStripRef.current
-        if (!el) {
-          return
+      if (recorded?.activeTabId === activeTabIdRef.current) {
+        // Why: a background open must not move the tab the user is looking at; insertions
+        // around it keep its on-screen x, the way VS Code and Chrome leave the viewed tab still.
+        if (recorded.anchor) {
+          restoreTabStripScrollAnchor(strip, recorded.anchor)
         }
-        el.scrollLeft = Math.max(0, el.scrollWidth - el.clientWidth)
-        stickToEndRef.current = true
-        updateTabStripOverflowState()
+        stickToEndRef.current = isTabStripScrolledToEnd(strip)
+      } else if (isLastTabStripTab(strip, activeTabIdRef.current)) {
+        scrollToEnd(true)
+        requestAnimationFrame(() => scrollToEnd(true))
       }
-      scrollToEnd()
-      requestAnimationFrame(scrollToEnd)
+      // A foreground tab opened mid-strip is revealed by the active-tab effect below.
+    } else if (stickToEndRef.current && !pointerGestureActive) {
+      scrollToEnd(false)
+      requestAnimationFrame(() => scrollToEnd(false))
     }
     prevStripLenRef.current = { worktreeId, len: tabCount }
     updateTabStripOverflowState()
     requestAnimationFrame(updateTabStripOverflowState)
-  }, [layoutKey, tabCount, updateTabStripOverflowState, worktreeId])
+    recordScrollAnchor()
+  }, [layoutKey, recordScrollAnchor, tabCount, updateTabStripOverflowState, worktreeId])
 
   useLayoutEffect(() => {
     const strip = tabStripRef.current
     if (!strip || !activeVisibleTabId) {
+      recordScrollAnchor()
       return
     }
     const activeTab = strip.querySelector<HTMLElement>(
       `[data-tab-id="${CSS.escape(activeVisibleTabId)}"]`
     )
     if (!activeTab) {
+      recordScrollAnchor()
       return
     }
     if (isTabStripPointerGestureActive()) {
       // Why: active-tab preview changes during a tab press must not move the
       // strip under a stationary pointer before the release decides click/drag.
       requestAnimationFrame(updateTabStripOverflowState)
+      recordScrollAnchor()
       return
     }
     activeTab.scrollIntoView({ block: 'nearest', inline: 'nearest' })
     requestAnimationFrame(updateTabStripOverflowState)
-  }, [activeVisibleTabId, updateTabStripOverflowState])
+    recordScrollAnchor()
+  }, [activeVisibleTabId, recordScrollAnchor, updateTabStripOverflowState])
 
   return { tabStripRef, tabStripOverflowState, scrollTabStrip }
 }
diff --git a/src/renderer/src/components/tab-bar/tab-strip-scroll-anchor.ts b/src/renderer/src/components/tab-bar/tab-strip-scroll-anchor.ts
new file mode 100644
index 000000000000..b7f38ba281a7
--- /dev/null
+++ b/src/renderer/src/components/tab-bar/tab-strip-scroll-anchor.ts
@@ -0,0 +1,54 @@
+/** A tab's on-screen x inside the strip viewport, recorded before tabs are inserted around it. */
+export type TabStripScrollAnchor = {
+  tabId: string
+  offset: number
+}
+
+function tabElements(strip: HTMLElement): HTMLElement[] {
+  return Array.from(strip.querySelectorAll<HTMLElement>('[data-tab-id]'))
+}
+
+function findTab(strip: HTMLElement, tabId: string): HTMLElement | undefined {
+  return tabElements(strip).find((tab) => tab.dataset.tabId === tabId)
+}
+
+/** The active tab when it is on screen, else the first visible tab; null when nothing is visible. */
+export function captureTabStripScrollAnchor(
+  strip: HTMLElement,
+  activeTabId: string | null
+): TabStripScrollAnchor | null {
+  const stripRect = strip.getBoundingClientRect()
+  const isVisible = (tab: HTMLElement): boolean => {
+    const rect = tab.getBoundingClientRect()
+    return rect.width > 0 && rect.right > stripRect.left && rect.left < stripRect.right
+  }
+  const active = activeTabId ? findTab(strip, activeTabId) : undefined
+  const anchor =
+    active && isVisible(active) ? active : tabElements(strip).find((tab) => isVisible(tab))
+  const tabId = anchor?.dataset.tabId
+  if (!anchor || !tabId) {
+    return null
+  }
+  return { tabId, offset: anchor.getBoundingClientRect().left - stripRect.left }
+}
+
+/** Scroll so the anchor tab is back at its recorded x; false when that tab is gone. */
+export function restoreTabStripScrollAnchor(
+  strip: HTMLElement,
+  anchor: TabStripScrollAnchor
+): boolean {
+  const tab = findTab(strip, anchor.tabId)
+  if (!tab) {
+    return false
+  }
+  const drift =
+    tab.getBoundingClientRect().left - strip.getBoundingClientRect().left - anchor.offset
+  if (drift !== 0) {
+    strip.scrollLeft += drift
+  }
+  return true
+}
+
+export function isLastTabStripTab(strip: HTMLElement, tabId: string | null): boolean {
+  return tabId !== null && tabElements(strip).at(-1)?.dataset.tabId === tabId
+}
diff --git a/src/renderer/src/components/tab-bar/terminal-tab-activity-status.test.ts b/src/renderer/src/components/tab-bar/terminal-tab-activity-status.test.ts
index fc626b99132b..129d290d5712 100644
--- a/src/renderer/src/components/tab-bar/terminal-tab-activity-status.test.ts
+++ b/src/renderer/src/components/tab-bar/terminal-tab-activity-status.test.ts
@@ -163,6 +163,39 @@ describe('resolveTerminalTabActivityStatus', () => {
     ).toBe('interrupted')
   })
 
+  it('reports a failed done as failed, and not as a clean finish', () => {
+    const failed = entry(FIRST_LEAF_ID, 'done', {
+      mainAgent: { state: 'done', outcome: 'failure', stateStartedAt: NOW }
+    })
+    const finished = entry(SECOND_LEAF_ID, 'done')
+    expect(
+      resolveTerminalTabActivityStatus({
+        tab: TAB,
+        agentStatusByPaneKey: { [failed.paneKey]: failed, [finished.paneKey]: finished },
+        ptyIdsByTabId: LIVE_PTY
+      })
+    ).toBe('failed')
+  })
+
+  it('reads a main agent that failed while its subagent works as failed; success or stop as working', () => {
+    const status = (outcome: 'failure' | 'success' | 'cancellation') => {
+      const held = entry(FIRST_LEAF_ID, 'working', {
+        mainAgent: { state: 'done', outcome, stateStartedAt: NOW }
+      })
+      return resolveTerminalTabActivityStatus({
+        tab: TAB,
+        agentStatusByPaneKey: { [held.paneKey]: held },
+        ptyIdsByTabId: LIVE_PTY
+      })
+    }
+    expect(status('failure')).toBe('failed')
+    expect(resolveTerminalTabAttentionBadge({ status: status('failure'), hasUnread: false })).toBe(
+      'failed'
+    )
+    expect(status('success')).toBe('working')
+    expect(status('cancellation')).toBe('working')
+  })
+
   it('does not let a finished sibling mask an interrupted outcome', () => {
     const interrupted = entry(FIRST_LEAF_ID, 'done', { interrupted: true })
     const finished = entry(SECOND_LEAF_ID, 'done')
diff --git a/src/renderer/src/components/tab-bar/terminal-tab-activity-status.ts b/src/renderer/src/components/tab-bar/terminal-tab-activity-status.ts
index 7a31cdb8ace2..63cae98e2d98 100644
--- a/src/renderer/src/components/tab-bar/terminal-tab-activity-status.ts
+++ b/src/renderer/src/components/tab-bar/terminal-tab-activity-status.ts
@@ -9,6 +9,10 @@ import {
   type AgentStatusEntry
 } from '../../../../shared/agent-status-types'
 import { parseLegacyNumericPaneKey, parsePaneKey } from '../../../../shared/stable-pane-id'
+import {
+  applyAgentPaneActivityFlags,
+  type AgentPaneActivityFlags
+} from '@/lib/agent-pane-activity-flags'
 import type { TerminalLayoutSnapshot, TerminalTab } from '../../../../shared/terminal-tab-types'
 
 // Why: a terminal tab is a container of panes, exactly like a worktree card is
@@ -17,15 +21,8 @@ import type { TerminalLayoutSnapshot, TerminalTab } from '../../../../shared/ter
 // skip the card's retained-done promotion — see resolveTerminalTabActivityStatus).
 export type TerminalTabActivityStatus = WorktreeStatus
 
-// Per-tab live-hook flags, mirroring applyLiveAgentState in
-// worktree-agent-activity-summary.ts. blocked/waiting collapse to permission,
-// matching every other status surface in the app.
-type TerminalTabActivityFlags = {
-  hasPermission: boolean
-  hasLiveWorking: boolean
-  hasLiveMonitoring: boolean
-  hasInterrupted: boolean
-  hasLiveDone: boolean
+// Per-tab live-hook flags, folded by the same applyAgentPaneActivityFlags as the worktree card.
+type TerminalTabActivityFlags = AgentPaneActivityFlags & {
   paneIds: Set<string>
   /** Panes whose row went stale; suppress generated permission labels only. */
   stalePaneIds: Set<string>
@@ -84,20 +81,7 @@ function getTerminalTabActivityFlags(
 
     const flags = getOrCreateTerminalTabActivityFlags(flagsByTabId, identity.tabId)
     flags.paneIds.add(identity.paneId)
-    if (entry.state === 'blocked' || entry.state === 'waiting') {
-      flags.hasPermission = true
-    } else if (entry.state === 'working') {
-      if (entry.workingMode === 'monitoring') {
-        flags.hasLiveMonitoring = true
-      } else {
-        flags.hasLiveWorking = true
-      }
-    } else if (entry.interrupted === true) {
-      // Interrupted is encoded as done, so it must be checked first.
-      flags.hasInterrupted = true
-    } else if (entry.state === 'done') {
-      flags.hasLiveDone = true
-    }
+    applyAgentPaneActivityFlags(flags, entry)
   }
 
   flagsCache = { agentStatusByPaneKey, agentStatusEpoch, flagsByTabId }
@@ -114,6 +98,7 @@ function getOrCreateTerminalTabActivityFlags(
       hasPermission: false,
       hasLiveWorking: false,
       hasLiveMonitoring: false,
+      hasFailed: false,
       hasInterrupted: false,
       hasLiveDone: false,
       paneIds: new Set(),
@@ -178,6 +163,7 @@ export function resolveTerminalTabActivityStatus({
     hasPermission: flags?.hasPermission ?? false,
     hasLiveWorking: flags?.hasLiveWorking ?? false,
     hasLiveMonitoring: flags?.hasLiveMonitoring ?? false,
+    hasFailed: flags?.hasFailed ?? false,
     hasInterrupted: flags?.hasInterrupted ?? false,
     hasLiveDone: flags?.hasLiveDone ?? false,
     // Why: retained/orchestration promotions are worktree-aggregate concerns;
@@ -199,6 +185,7 @@ export type TerminalTabAttentionBadge =
   | 'working'
   | 'monitoring'
   | 'permission'
+  | 'failed'
   | 'interrupted'
   | 'unread'
   | 'done'
@@ -229,8 +216,8 @@ export function resolveTerminalTabAttentionBadge({
   if (status === 'done') {
     return 'done'
   }
-  if (status === 'interrupted') {
-    return 'interrupted'
+  if (status === 'failed' || status === 'interrupted') {
+    return status
   }
   return null
 }
@@ -238,11 +225,12 @@ export function resolveTerminalTabAttentionBadge({
 /** Map a container activity status onto AgentStateDot's vocabulary (no unread — that's a bell). */
 export function terminalTabActivityToAgentDotState(
   status: TerminalTabActivityStatus
-): 'working' | 'monitoring' | 'permission' | 'interrupted' | 'done' | null {
+): 'working' | 'monitoring' | 'permission' | 'failed' | 'interrupted' | 'done' | null {
   switch (status) {
     case 'working':
     case 'monitoring':
     case 'permission':
+    case 'failed':
     case 'interrupted':
     case 'done':
       return status
diff --git a/src/renderer/src/components/tab-group/useTabGroupCreationCommands.ts b/src/renderer/src/components/tab-group/useTabGroupCreationCommands.ts
index d0fae789882d..609a0e6579ce 100644
--- a/src/renderer/src/components/tab-group/useTabGroupCreationCommands.ts
+++ b/src/renderer/src/components/tab-group/useTabGroupCreationCommands.ts
@@ -99,7 +99,7 @@ export function useTabGroupCreationCommands({
     openEntry: async (args: TabCreateEntryArgs) => {
       await openTabBarEntry(args)
     },
-    duplicateBrowserTab: (browserTabId: string) => {
+    duplicateBrowserTab: (browserTabId: string, sourceUnifiedTabId: string) => {
       void (async () => {
         const state = useAppStore.getState()
         const tabs = state.browserTabsByWorktree[worktreeId] ?? []
@@ -123,17 +123,19 @@ export function useTabGroupCreationCommands({
             environmentId: runtimeEnvironmentId,
             url: source.url,
             profileId: source.sessionProfileId,
-            targetGroupId: groupId
+            targetGroupId: groupId,
+            clientAfterTabId: sourceUnifiedTabId
           })
           if (created) {
             return
           }
           throw new Error('The paired runtime could not duplicate the managed browser tab.')
         }
+        // Why no targetGroupId: a source-following duplicate joins the source's live group.
         createBrowserTab(worktreeId, source.url, {
           ...buildDuplicatedBrowserTabOptions(source),
           ...(runtimeEnvironmentId ? { browserRuntimeEnvironmentId: null } : {}),
-          targetGroupId: groupId
+          afterTabId: sourceUnifiedTabId
         })
       })().catch((error) => {
         toast.error(error instanceof Error ? error.message : String(error))
diff --git a/src/renderer/src/components/tab-group/useTabGroupWorkspaceModel.focus.test.ts b/src/renderer/src/components/tab-group/useTabGroupWorkspaceModel.focus.test.ts
index 290fb5c59845..b438f5ecee8c 100644
--- a/src/renderer/src/components/tab-group/useTabGroupWorkspaceModel.focus.test.ts
+++ b/src/renderer/src/components/tab-group/useTabGroupWorkspaceModel.focus.test.ts
@@ -659,13 +659,13 @@ describe('useTabGroupWorkspaceModel terminal activation focus', () => {
     const { useTabGroupWorkspaceModel } = await import('./useTabGroupWorkspaceModel')
     const model = useTabGroupWorkspaceModel({ groupId: 'group-1', worktreeId: 'wt-1' })
 
-    model.commands.duplicateBrowserTab('browser-workspace-1')
+    model.commands.duplicateBrowserTab('browser-workspace-1', 'browser-unified-1')
 
     expect(mocks.createBrowserTab).toHaveBeenCalledWith('wt-1', 'https://example.com', {
       title: 'Example',
       sessionProfileId: 'profile-1',
       sessionPartition: 'persist:orca-browser-session-profile-1',
-      targetGroupId: 'group-1'
+      afterTabId: 'browser-unified-1'
     })
   })
 
diff --git a/src/renderer/src/components/task-page-linear-team-selection.test.ts b/src/renderer/src/components/task-page-linear-team-selection.test.ts
index 6eb1878fbbd0..b75b64040805 100644
--- a/src/renderer/src/components/task-page-linear-team-selection.test.ts
+++ b/src/renderer/src/components/task-page-linear-team-selection.test.ts
@@ -1,6 +1,9 @@
 import { describe, expect, it } from 'vitest'
 import type { LinearTeam } from '../../../shared/linear/workspace-types'
-import { reconcileLinearTeamSelection } from './task-page-linear-team-selection'
+import {
+  reconcileLinearTeamSelection,
+  storedLinearTeamSelection
+} from './task-page-linear-team-selection'
 
 function team(id: string): LinearTeam {
   return {
@@ -34,4 +37,39 @@ describe('reconcileLinearTeamSelection', () => {
       'd'
     ])
   })
+
+  // Why: 0a2b6e7f (1.4.207) crashed page.tasks with "(t ?? []).filter is not a
+  // function": the persisted setting reached the renderer as a string, which
+  // `new Set(value)` in the hook initializer accepts and this call did not.
+  it('treats a saved selection of the wrong shape as sticky-all', () => {
+    expect(Array.from(reconcileLinearTeamSelection([team('a'), team('b')], 'a'))).toEqual([
+      'a',
+      'b'
+    ])
+    expect(Array.from(reconcileLinearTeamSelection([team('a'), team('b')], { 0: 'a' }))).toEqual([
+      'a',
+      'b'
+    ])
+  })
+})
+
+describe('storedLinearTeamSelection', () => {
+  it('keeps a string array', () => {
+    expect(storedLinearTeamSelection(['a', 'b'])).toEqual(['a', 'b'])
+  })
+
+  it('reads null and undefined as sticky-all', () => {
+    expect(storedLinearTeamSelection(null)).toBeNull()
+    expect(storedLinearTeamSelection(undefined)).toBeNull()
+  })
+
+  it('reads a string, an object or a number as sticky-all instead of throwing', () => {
+    expect(storedLinearTeamSelection('a')).toBeNull()
+    expect(storedLinearTeamSelection({ 0: 'a' })).toBeNull()
+    expect(storedLinearTeamSelection(7)).toBeNull()
+  })
+
+  it('drops non-string entries from a mixed array', () => {
+    expect(storedLinearTeamSelection(['a', 1, null, 'b'])).toEqual(['a', 'b'])
+  })
 })
diff --git a/src/renderer/src/components/task-page-linear-team-selection.ts b/src/renderer/src/components/task-page-linear-team-selection.ts
index 3ec82284a592..9cebac902b75 100644
--- a/src/renderer/src/components/task-page-linear-team-selection.ts
+++ b/src/renderer/src/components/task-page-linear-team-selection.ts
@@ -1,8 +1,18 @@
 import type { LinearTeam } from '../../../shared/linear/workspace-types'
 
+// Why: the persisted value is not validated on the way in and a string reached
+// 1.4.207 (0a2b6e7f); anything but a string array reads as sticky-all.
+export function storedLinearTeamSelection(value: unknown): string[] | null {
+  if (!Array.isArray(value)) {
+    return null
+  }
+  return value.filter((id): id is string => typeof id === 'string')
+}
+
+// Why `unknown`: this is the crash site, so it must hold for the raw setting too.
 export function reconcileLinearTeamSelection(
   availableTeams: LinearTeam[],
-  storedSelection: readonly string[] | null | undefined
+  storedSelection: unknown
 ): ReadonlySet<string> {
   const availableIds = availableTeams.map((team) => team.id)
   if (availableIds.length === 0) {
@@ -10,7 +20,9 @@ export function reconcileLinearTeamSelection(
   }
 
   const availableIdSet = new Set(availableIds)
-  const validStoredSelection = (storedSelection ?? []).filter((id) => availableIdSet.has(id))
+  const validStoredSelection = (storedLinearTeamSelection(storedSelection) ?? []).filter((id) =>
+    availableIdSet.has(id)
+  )
   if (validStoredSelection.length > 0) {
     return new Set(validStoredSelection)
   }
diff --git a/src/renderer/src/components/terminal-cold-activation.ts b/src/renderer/src/components/terminal-cold-activation.ts
index 8b6e96467eef..2d8cf075b572 100644
--- a/src/renderer/src/components/terminal-cold-activation.ts
+++ b/src/renderer/src/components/terminal-cold-activation.ts
@@ -1,11 +1,15 @@
 import { useAppStore } from '../store'
 import {
+  canAdmitTerminalTabsForStartup,
   canDeferColdActivationTabsForHost,
-  canMountTerminalWorkspaceForStartup,
   planColdActivationTabDeferral,
   pruneClosedBackgroundMountTabs,
   revealActivationDeferredTabs
 } from './terminal/background-terminal-worktree-mount'
+import {
+  holdTerminalTabsForStartup,
+  releaseStartupTerminalTabHold
+} from './terminal/startup-terminal-tab-hold'
 import { hasRegisteredRuntimeTerminalTab } from '../runtime/sync-runtime-graph'
 import { anyMountedWorktreeHasLayout as computeAnyMountedWorktreeHasLayout } from './terminal/split-group-mount'
 import { isParkRestorableTerminalPty } from './terminal-pane/terminal-hidden-view-parking'
@@ -32,6 +36,7 @@ export function applyTerminalColdActivation(controller: TerminalParkingFoundatio
     pairedRuntimeParkingEnvironmentIds,
     pendingStartupByTabId,
     renderedActiveWorktreeId,
+    startupTerminalTabHoldRef,
     startupWorktreeRefreshCompleted,
     tabsByWorktree,
     terminalParkingEnabled,
@@ -40,14 +45,26 @@ export function applyTerminalColdActivation(controller: TerminalParkingFoundatio
     workspaceSurfaceIds,
     workspaceSurfaceIdSet
   } = controller
-  if (
+  // Why the surface mounts on the tab model alone: the hydrated tabs, groups, and layout are
+  // everything the tab strip and the chat, browser, and editor panes need. Only terminal
+  // panes wait, held below, for startup restoration to publish PTY ownership — gating the
+  // whole surface on that chain left a restored session blank until its last step.
+  const startupHeldWorktreeId =
     renderedActiveWorktreeId &&
-    canMountTerminalWorkspaceForStartup({
+    !canAdmitTerminalTabsForStartup({
       workspaceSessionReady,
       hydrationSucceeded,
       startupWorktreeRefreshCompleted
     })
-  ) {
+      ? renderedActiveWorktreeId
+      : null
+  releaseStartupTerminalTabHold(
+    startupTerminalTabHoldRef,
+    backgroundMountTabIdsByWorktreeRef.current,
+    mountedWorktreeIdsRef.current,
+    startupHeldWorktreeId
+  )
+  if (renderedActiveWorktreeId && !startupHeldWorktreeId) {
     const worktreeTabs = tabsByWorktree[renderedActiveWorktreeId] ?? []
     const coldActivationDeferralEnabled =
       terminalParkingEnabled && terminalTitleSnapshotAuthorityEnabled
@@ -157,6 +174,15 @@ export function applyTerminalColdActivation(controller: TerminalParkingFoundatio
     tabsByWorktree,
     activationDeferredMountTabIdsByWorktreeRef.current
   )
+  if (startupHeldWorktreeId) {
+    holdTerminalTabsForStartup(
+      startupTerminalTabHoldRef,
+      backgroundMountTabIdsByWorktreeRef.current,
+      mountedWorktreeIdsRef.current,
+      startupHeldWorktreeId,
+      (tabsByWorktree[startupHeldWorktreeId] ?? []).map((tab) => tab.id)
+    )
+  }
   for (const id of mountedWorktreeIdsRef.current) {
     if (!workspaceSurfaceIdSet.has(id)) {
       mountedWorktreeIdsRef.current.delete(id)
@@ -173,7 +199,8 @@ export function applyTerminalColdActivation(controller: TerminalParkingFoundatio
   )
   return {
     anyMountedWorktreeHasLayout,
-    activationDeferralPlanRevision: activationDeferralPlanRevisionRef.current
+    activationDeferralPlanRevision: activationDeferralPlanRevisionRef.current,
+    startupTerminalTabHold: startupTerminalTabHoldRef.current
   }
 }
 
diff --git a/src/renderer/src/components/terminal-pane/TerminalErrorToast.test.ts b/src/renderer/src/components/terminal-pane/TerminalErrorToast.test.ts
index 31febbd6c21a..18069a846b59 100644
--- a/src/renderer/src/components/terminal-pane/TerminalErrorToast.test.ts
+++ b/src/renderer/src/components/terminal-pane/TerminalErrorToast.test.ts
@@ -361,6 +361,19 @@ describe('TerminalErrorToast environment footer', () => {
     await waitFor(() => expect(environmentMocks.resolveFooter).not.toHaveBeenCalled())
   })
 
+  it('shows the issue request once for a host error that already asks for one', () => {
+    const view = render(
+      React.createElement(TerminalErrorToast, {
+        error:
+          'Failed to spawn shell "/bin/zsh": boom (shell: /bin/zsh). If this persists, please file an issue.',
+        onDismiss: vi.fn()
+      })
+    )
+
+    expect(view.container.textContent?.match(/If this persists/g)).toHaveLength(1)
+    expect(view.container.textContent).toContain('(shell: /bin/zsh).')
+  })
+
   it('renders owner-unverified as a warning without an issue link', () => {
     const onRetry = vi.fn().mockResolvedValue(true)
     const view = render(
diff --git a/src/renderer/src/components/terminal-pane/TerminalErrorToast.tsx b/src/renderer/src/components/terminal-pane/TerminalErrorToast.tsx
index 8b627a9651f8..a31b0c37856b 100644
--- a/src/renderer/src/components/terminal-pane/TerminalErrorToast.tsx
+++ b/src/renderer/src/components/terminal-pane/TerminalErrorToast.tsx
@@ -3,6 +3,10 @@ import { translate } from '@/i18n/i18n'
 import { resolveClientEnvironmentFooter } from '@/lib/client-environment-info'
 import { Button } from '@/components/ui/button'
 import { hasClientEnvironmentFooter } from '../../../../shared/client-environment-info'
+import {
+  localizeTerminalSpawnHints,
+  withoutTerminalSpawnIssueRequest
+} from './terminal-spawn-error-display'
 
 const SSH_PREFIX = 'SSH connection is not active'
 // Produced by pty-connection.ts reportError() when a PTY reattach can't reach its SSH host.
@@ -112,7 +116,7 @@ function humanizeUnreattachableSession(error: string): string {
 
 /** Swaps raw daemon-boundary codes for copy a user can act on. */
 export function humanizeTerminalError(error: string): string {
-  let humanized = error
+  let humanized = localizeTerminalSpawnHints(error)
   if (humanized.includes(PANE_OWNER_UNVERIFIED_MARKER)) {
     const explanation = isPaneOwnerUnverifiedError(humanized)
       ? translate(
@@ -178,7 +182,11 @@ export function TerminalErrorToast({
   // Restart cannot recover a session after its owning daemon exits.
   const showIssueLink =
     !ssh && !paneOwnerUnverified && !showDaemonRestart && !isExplainedTerminalError(error)
-  const displayError = humanizeTerminalError(error)
+  const humanizedError = humanizeTerminalError(error)
+  // Why: the toast appends its own linked request, so the host's plain-text one would repeat it.
+  const displayError = showIssueLink
+    ? withoutTerminalSpawnIssueRequest(humanizedError)
+    : humanizedError
   const tint = paneOwnerUnverified
     ? null
     : ssh
diff --git a/src/renderer/src/components/terminal-pane/TerminalPaneNativeChatPortal.test.tsx b/src/renderer/src/components/terminal-pane/TerminalPaneNativeChatPortal.test.tsx
index 08155fb7c25f..292aa0449e79 100644
--- a/src/renderer/src/components/terminal-pane/TerminalPaneNativeChatPortal.test.tsx
+++ b/src/renderer/src/components/terminal-pane/TerminalPaneNativeChatPortal.test.tsx
@@ -4,9 +4,14 @@ import { cleanup, render } from '@testing-library/react'
 import { afterEach, describe, expect, it, vi } from 'vitest'
 import type { TerminalPaneController } from './use-terminal-pane-controller'
 
-const mocks = vi.hoisted(() => ({
-  nativeChatViewProps: null as null | { isFocusedGroup: boolean }
-}))
+const mocks = vi.hoisted(
+  (): {
+    nativeChatViewProps: null | {
+      isFocusedGroup: boolean
+      contextMenuActions: { onClosePane: () => void }
+    }
+  } => ({ nativeChatViewProps: null })
+)
 
 vi.mock('@/store', () => ({
   useAppStore: (
@@ -24,7 +29,10 @@ vi.mock('@/store', () => ({
 }))
 
 vi.mock('../native-chat/NativeChatView', () => ({
-  default: (props: { isFocusedGroup: boolean }) => {
+  default: (props: {
+    isFocusedGroup: boolean
+    contextMenuActions: { onClosePane: () => void }
+  }) => {
     mocks.nativeChatViewProps = props
     return <span data-focused-group={String(props.isFocusedGroup)} />
   }
@@ -38,6 +46,22 @@ afterEach(() => {
 })
 
 describe('TerminalPaneNativeChatPortal', () => {
+  it('targets the restored chat pane when its sibling is active', () => {
+    const portalContainer = document.createElement('div')
+    const controller = makeController(portalContainer, { activePaneIsChatLeaf: false })
+    if (!controller.chatPane) {
+      throw new Error('fixture must have a chat pane')
+    }
+    controller.chatPane.id = 42
+    controller.contextMenu.onClosePane = vi.fn()
+    render(<TerminalPaneNativeChatPortal controller={controller} />)
+    mocks.nativeChatViewProps?.contextMenuActions.onClosePane()
+    expect(controller.contextMenu.runForPane).toHaveBeenCalledWith(
+      42,
+      controller.contextMenu.onClosePane
+    )
+  })
+
   it('only gives the composer focus ownership to the active split leaf', () => {
     const portalContainer = document.createElement('div')
     document.body.appendChild(portalContainer)
diff --git a/src/renderer/src/components/terminal-pane/TerminalPaneOverlayLayer.tsx b/src/renderer/src/components/terminal-pane/TerminalPaneOverlayLayer.tsx
index 2cb20783f53e..63e75e9cdd57 100644
--- a/src/renderer/src/components/terminal-pane/TerminalPaneOverlayLayer.tsx
+++ b/src/renderer/src/components/terminal-pane/TerminalPaneOverlayLayer.tsx
@@ -9,7 +9,9 @@ import {
 } from '../activity/activity-terminal-portal'
 import { shouldMountBackgroundWorktreeTab } from '../terminal/background-terminal-worktree-mount'
 import { useNativeChatToggleShortcut } from '../native-chat/use-native-chat-toggle-shortcut'
+import { RetainedPaneHost } from '../tab-group/RetainedPaneHost'
 import { TerminalOverlaySlot } from './TerminalOverlaySlot'
+import { TerminalRestoringPlaceholder } from './TerminalRestoringPlaceholder'
 import { useTerminalTabColdParking } from './use-terminal-tab-cold-parking'
 
 type TerminalOverlayAssignment = {
@@ -132,40 +134,50 @@ const TerminalPaneOverlayLayer = memo(function TerminalPaneOverlayLayer({
 
   return (
     <>
-      {terminalTabs
-        .filter((terminalTab) =>
-          shouldMountBackgroundWorktreeTab(backgroundMountTabIds, terminalTab.id)
-        )
-        .map((terminalTab) => {
-          const assignment = assignments.get(terminalTab.id)
-          const isVisible = Boolean(isWorktreeActive && assignment?.isActiveInGroup)
-          const isActive = Boolean(isVisible && assignment?.groupId === activeGroupId)
-          const activityTerminalPortal = findActivityTerminalPortal(activityTerminalPortals, {
-            worktreeId,
-            tabId: terminalTab.id
-          })
-          if (parkedTerminalTabIds.has(terminalTab.id)) {
-            return null
-          }
-          return (
-            <TerminalOverlaySlot
+      {terminalTabs.map((terminalTab) => {
+        const assignment = assignments.get(terminalTab.id)
+        const isVisible = Boolean(isWorktreeActive && assignment?.isActiveInGroup)
+        if (!shouldMountBackgroundWorktreeTab(backgroundMountTabIds, terminalTab.id)) {
+          // Why only the startup hold lands here visible: reveal admits every other visible
+          // deferred tab in the same render pass.
+          return isVisible ? (
+            <RetainedPaneHost
               key={terminalTab.id}
-              terminalTabId={terminalTab.id}
-              terminalGeneration={terminalTab.generation}
-              worktreeId={worktreeId}
-              worktreePath={worktreePath}
-              startupCwd={terminalTab.startupCwd}
               groupId={assignment?.groupId}
-              isWorktreeActive={isWorktreeActive}
-              isVisible={isVisible}
-              isActive={isActive}
-              activityTerminalPortal={activityTerminalPortal}
+              isVisible
               onFocusOwningGroup={focusOwningGroup}
-              consumeSuppressedPtyExit={consumeSuppressedPtyExit}
-              leaveWorktreeIfEmpty={leaveWorktreeIfEmpty}
-            />
-          )
-        })}
+            >
+              <TerminalRestoringPlaceholder />
+            </RetainedPaneHost>
+          ) : null
+        }
+        const isActive = Boolean(isVisible && assignment?.groupId === activeGroupId)
+        const activityTerminalPortal = findActivityTerminalPortal(activityTerminalPortals, {
+          worktreeId,
+          tabId: terminalTab.id
+        })
+        if (parkedTerminalTabIds.has(terminalTab.id)) {
+          return null
+        }
+        return (
+          <TerminalOverlaySlot
+            key={terminalTab.id}
+            terminalTabId={terminalTab.id}
+            terminalGeneration={terminalTab.generation}
+            worktreeId={worktreeId}
+            worktreePath={worktreePath}
+            startupCwd={terminalTab.startupCwd}
+            groupId={assignment?.groupId}
+            isWorktreeActive={isWorktreeActive}
+            isVisible={isVisible}
+            isActive={isActive}
+            activityTerminalPortal={activityTerminalPortal}
+            onFocusOwningGroup={focusOwningGroup}
+            consumeSuppressedPtyExit={consumeSuppressedPtyExit}
+            leaveWorktreeIfEmpty={leaveWorktreeIfEmpty}
+          />
+        )
+      })}
     </>
   )
 })
diff --git a/src/renderer/src/components/terminal-pane/TerminalRestoringPlaceholder.tsx b/src/renderer/src/components/terminal-pane/TerminalRestoringPlaceholder.tsx
new file mode 100644
index 000000000000..4a2bb775e0d2
--- /dev/null
+++ b/src/renderer/src/components/terminal-pane/TerminalRestoringPlaceholder.tsx
@@ -0,0 +1,20 @@
+import { Loader2 } from 'lucide-react'
+import { translate } from '@/i18n/i18n'
+
+/** Fills a terminal tab's slot while startup restoration holds its pane unmounted. */
+export function TerminalRestoringPlaceholder(): React.JSX.Element {
+  return (
+    <div
+      className="absolute inset-0 flex items-center justify-center gap-2 text-sm text-muted-foreground"
+      role="status"
+      aria-live="polite"
+      data-terminal-restoring-placeholder=""
+    >
+      <Loader2 className="size-4 animate-spin" />
+      {translate(
+        'auto.components.terminal.pane.TerminalRestoringPlaceholder.restoring',
+        'Restoring terminal…'
+      )}
+    </div>
+  )
+}
diff --git a/src/renderer/src/components/terminal-pane/closed-terminal-leaf-notice.test.ts b/src/renderer/src/components/terminal-pane/closed-terminal-leaf-notice.test.ts
new file mode 100644
index 000000000000..cfb0ab967252
--- /dev/null
+++ b/src/renderer/src/components/terminal-pane/closed-terminal-leaf-notice.test.ts
@@ -0,0 +1,103 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { TerminalLayoutSnapshot } from '../../../../shared/terminal-tab-types'
+import { CLOSE_TERMINAL_PANE_EVENT } from '@/constants/terminal'
+
+const TAB_ID = 'tab-1'
+const LEAF_ID = '11111111-1111-4111-8111-111111111111'
+const SIBLING_LEAF_ID = '22222222-2222-4222-8222-222222222222'
+
+const splitLayout: TerminalLayoutSnapshot = {
+  root: {
+    type: 'split',
+    direction: 'vertical',
+    first: { type: 'leaf', leafId: LEAF_ID },
+    second: { type: 'leaf', leafId: SIBLING_LEAF_ID }
+  },
+  activeLeafId: LEAF_ID,
+  expandedLeafId: null,
+  ptyIdsByLeafId: { [LEAF_ID]: 'pty-closed', [SIBLING_LEAF_ID]: 'pty-sibling' }
+}
+
+const layouts: Record<string, TerminalLayoutSnapshot> = {}
+const state = {
+  tabsByWorktree: {},
+  terminalLayoutsByTabId: layouts,
+  runtimePaneTitlesByTabId: {},
+  clearTabLaunchAgent: vi.fn(),
+  updateTabTitle: vi.fn(),
+  setTabLayout: vi.fn((tabId: string, layout: TerminalLayoutSnapshot) => {
+    state.terminalLayoutsByTabId[tabId] = layout
+  })
+}
+
+vi.mock('@/store', () => ({ useAppStore: { getState: () => state } }))
+
+import { applyClosedTerminalLeafNotice } from './closed-terminal-leaf-notice'
+import { applyTerminalPaneCloseRequest } from './terminal-pane-lifecycle-close'
+import { parkedWatchersByTabId } from './terminal-parked-watcher-registry'
+
+function leafIds(layout: TerminalLayoutSnapshot | undefined): string[] {
+  return Object.keys(layout?.ptyIdsByLeafId ?? {})
+}
+
+beforeEach(() => {
+  state.terminalLayoutsByTabId = { [TAB_ID]: splitLayout }
+  state.setTabLayout.mockClear()
+  vi.stubGlobal('window', new EventTarget())
+})
+
+afterEach(() => {
+  parkedWatchersByTabId.clear()
+  vi.unstubAllGlobals()
+})
+
+describe('a split pane main already closed', () => {
+  it('reaches a mounted pane as a leaf-addressed close', () => {
+    const details: unknown[] = []
+    window.addEventListener(CLOSE_TERMINAL_PANE_EVENT, (event) =>
+      details.push(event instanceof CustomEvent ? event.detail : null)
+    )
+
+    applyClosedTerminalLeafNotice(TAB_ID, LEAF_ID)
+
+    expect(details).toEqual([{ tabId: TAB_ID, leafId: LEAF_ID }])
+  })
+
+  it('is ignored by a mounted pane whose exit already removed that leaf', () => {
+    const manager = {
+      closePane: vi.fn(),
+      detachPaneForExternalMove: vi.fn(),
+      retirePanePreservingPty: vi.fn(),
+      getNumericIdForLeaf: () => null,
+      getPanes: () => [{ id: 2 }]
+    }
+    const closeTab = vi.fn()
+
+    const result = applyTerminalPaneCloseRequest({
+      detail: { tabId: TAB_ID, leafId: LEAF_ID },
+      manager,
+      closeTab,
+      closeTabPreservingPty: vi.fn()
+    })
+
+    // Why: a numeric pane id would have reached the last-pane branch and closed the whole tab.
+    expect(result).toBe('ignored')
+    expect(closeTab).not.toHaveBeenCalled()
+    expect(manager.closePane).not.toHaveBeenCalled()
+  })
+
+  it('collapses a parked tab stored layout once, whichever of notice or exit lands first', () => {
+    parkedWatchersByTabId.set(TAB_ID, {
+      worktreeId: 'repo::/worktree',
+      tabPtyId: 'pty-closed',
+      disposersByPtyId: new Map([['pty-closed', vi.fn()]]),
+      paneIdByPtyId: new Map()
+    })
+
+    applyClosedTerminalLeafNotice(TAB_ID, LEAF_ID)
+    applyClosedTerminalLeafNotice(TAB_ID, LEAF_ID)
+
+    expect(leafIds(state.terminalLayoutsByTabId[TAB_ID])).toEqual([SIBLING_LEAF_ID])
+    expect(state.setTabLayout).toHaveBeenCalledTimes(1)
+  })
+})
diff --git a/src/renderer/src/components/terminal-pane/closed-terminal-leaf-notice.ts b/src/renderer/src/components/terminal-pane/closed-terminal-leaf-notice.ts
new file mode 100644
index 000000000000..2b465db28781
--- /dev/null
+++ b/src/renderer/src/components/terminal-pane/closed-terminal-leaf-notice.ts
@@ -0,0 +1,16 @@
+import { CLOSE_TERMINAL_PANE_EVENT, type CloseTerminalPaneDetail } from '@/constants/terminal'
+import { collapseParkedTerminalLeaf } from './terminal-parked-pty-watcher'
+import { isTerminalTabParked } from './terminal-parked-watcher-registry'
+
+/**
+ * Drops a split pane main already closed. Addressed by leaf, so it is a no-op once the pane's own
+ * exit handling removed it, and the exit is a no-op after it: whichever lands first wins.
+ */
+export function applyClosedTerminalLeafNotice(tabId: string, leafId: string): void {
+  if (isTerminalTabParked(tabId)) {
+    collapseParkedTerminalLeaf(tabId, leafId)
+    return
+  }
+  const detail: CloseTerminalPaneDetail = { tabId, leafId }
+  window.dispatchEvent(new CustomEvent(CLOSE_TERMINAL_PANE_EVENT, { detail }))
+}
diff --git a/src/renderer/src/components/terminal-pane/deferred-split-pane-handoff.test.ts b/src/renderer/src/components/terminal-pane/deferred-split-pane-handoff.test.ts
index cba19b43c2fd..c77339bfe2e5 100644
--- a/src/renderer/src/components/terminal-pane/deferred-split-pane-handoff.test.ts
+++ b/src/renderer/src/components/terminal-pane/deferred-split-pane-handoff.test.ts
@@ -30,39 +30,52 @@ describe('deferred split pane handoff', () => {
     const cwdPromise = Promise.resolve('/source/cwd')
     const initial = beginDeferredSplitPaneHandoff(key, cwdPromise)
 
-    appendDeferredSplitPaneInput(initial, { data: 'typed', kind: 'ordinary' })
-    appendDeferredSplitPaneInput(initial, { data: '\x1b[0n', kind: 'immediate' })
-    appendDeferredSplitPaneInput(initial, { data: '\x03', kind: 'accepted' })
+    appendDeferredSplitPaneInput(initial, { data: 'typed', kind: 'ordinary', inputKind: 'driving' })
+    appendDeferredSplitPaneInput(initial, {
+      data: '\x1b[0n',
+      kind: 'immediate',
+      inputKind: 'query-reply'
+    })
+    appendDeferredSplitPaneInput(initial, { data: '\x03', kind: 'accepted', inputKind: 'driving' })
 
     const remounted = claimDeferredSplitPaneHandoff(key)
 
     expect(remounted?.cwdPromise).toBe(cwdPromise)
     expect(remounted?.preconnectInput).toEqual([
-      { data: 'typed', kind: 'ordinary' },
-      { data: '\x1b[0n', kind: 'immediate' },
-      { data: '\x03', kind: 'accepted' }
+      { data: 'typed', kind: 'ordinary', inputKind: 'driving' },
+      { data: '\x1b[0n', kind: 'immediate', inputKind: 'query-reply' },
+      { data: '\x03', kind: 'accepted', inputKind: 'driving' }
     ])
   })
 
   it('keeps input across repeated remounts and fences stale owners', () => {
     const key = makePaneKey('tab-1', LEAF_1)
     const initial = beginDeferredSplitPaneHandoff(key, Promise.resolve('/source/cwd'))
-    appendDeferredSplitPaneInput(initial, { data: 'before-first-remount', kind: 'ordinary' })
+    appendDeferredSplitPaneInput(initial, {
+      data: 'before-first-remount',
+      kind: 'ordinary',
+      inputKind: 'driving'
+    })
     const firstRemount = claimDeferredSplitPaneHandoff(key)
     expect(firstRemount).not.toBeNull()
 
-    appendDeferredSplitPaneInput(initial, { data: 'stale-input', kind: 'ordinary' })
+    appendDeferredSplitPaneInput(initial, {
+      data: 'stale-input',
+      kind: 'ordinary',
+      inputKind: 'driving'
+    })
     clearDeferredSplitPaneHandoff(initial)
     clearDeferredSplitPaneHandoff(initial)
     appendDeferredSplitPaneInput(firstRemount!.handle, {
       data: 'before-second-remount',
-      kind: 'ordinary'
+      kind: 'ordinary',
+      inputKind: 'driving'
     })
 
     const secondRemount = claimDeferredSplitPaneHandoff(key)
     expect(secondRemount?.preconnectInput).toEqual([
-      { data: 'before-first-remount', kind: 'ordinary' },
-      { data: 'before-second-remount', kind: 'ordinary' }
+      { data: 'before-first-remount', kind: 'ordinary', inputKind: 'driving' },
+      { data: 'before-second-remount', kind: 'ordinary', inputKind: 'driving' }
     ])
 
     clearDeferredSplitPaneHandoff(firstRemount!.handle)
@@ -74,21 +87,33 @@ describe('deferred split pane handoff', () => {
   it('releases an unmounted owner without dropping its pending handoff', () => {
     const key = makePaneKey('tab-1', LEAF_1)
     const initial = beginDeferredSplitPaneHandoff(key, Promise.resolve('/source/cwd'))
-    appendDeferredSplitPaneInput(initial, { data: 'before-unmount', kind: 'ordinary' })
+    appendDeferredSplitPaneInput(initial, {
+      data: 'before-unmount',
+      kind: 'ordinary',
+      inputKind: 'driving'
+    })
 
     releaseDeferredSplitPaneHandoff(initial)
-    appendDeferredSplitPaneInput(initial, { data: 'late-stale', kind: 'ordinary' })
+    appendDeferredSplitPaneInput(initial, {
+      data: 'late-stale',
+      kind: 'ordinary',
+      inputKind: 'driving'
+    })
     clearDeferredSplitPaneHandoff(initial)
 
     expect(claimDeferredSplitPaneHandoff(key)?.preconnectInput).toEqual([
-      { data: 'before-unmount', kind: 'ordinary' }
+      { data: 'before-unmount', kind: 'ordinary', inputKind: 'driving' }
     ])
   })
 
   it('lets a late close discard a released handoff by its stable pane key', () => {
     const key = makePaneKey('tab-1', LEAF_1)
     const owner = beginDeferredSplitPaneHandoff(key, Promise.resolve('/source/cwd'))
-    appendDeferredSplitPaneInput(owner, { data: 'must-not-replay', kind: 'ordinary' })
+    appendDeferredSplitPaneInput(owner, {
+      data: 'must-not-replay',
+      kind: 'ordinary',
+      inputKind: 'driving'
+    })
 
     // Whole-tab cleanup releases the mount-local handle before a stale close callback can run.
     releaseDeferredSplitPaneHandoff(owner)
@@ -112,7 +137,11 @@ describe('deferred split pane handoff', () => {
   it('drops a stale record when an authoritative restored PTY wins the key', () => {
     const key = makePaneKey('tab-authoritative', LEAF_1)
     const stale = beginDeferredSplitPaneHandoff(key, Promise.resolve('/stale'))
-    appendDeferredSplitPaneInput(stale, { data: 'must-not-replay', kind: 'ordinary' })
+    appendDeferredSplitPaneInput(stale, {
+      data: 'must-not-replay',
+      kind: 'ordinary',
+      inputKind: 'driving'
+    })
 
     discardDeferredSplitPaneHandoffForKey(key)
 
@@ -123,26 +152,44 @@ describe('deferred split pane handoff', () => {
   it('replaces an older handoff for the same stable pane key', () => {
     const key = makePaneKey('tab-1', LEAF_1)
     const stale = beginDeferredSplitPaneHandoff(key, Promise.resolve('/stale'))
-    appendDeferredSplitPaneInput(stale, { data: 'stale', kind: 'ordinary' })
+    appendDeferredSplitPaneInput(stale, { data: 'stale', kind: 'ordinary', inputKind: 'driving' })
     const currentPromise = Promise.resolve('/current')
     const current = beginDeferredSplitPaneHandoff(key, currentPromise)
 
-    appendDeferredSplitPaneInput(stale, { data: 'late-stale', kind: 'ordinary' })
+    appendDeferredSplitPaneInput(stale, {
+      data: 'late-stale',
+      kind: 'ordinary',
+      inputKind: 'driving'
+    })
     clearDeferredSplitPaneHandoff(stale)
-    appendDeferredSplitPaneInput(current, { data: 'current', kind: 'ordinary' })
+    appendDeferredSplitPaneInput(current, {
+      data: 'current',
+      kind: 'ordinary',
+      inputKind: 'driving'
+    })
 
     const claimed = claimDeferredSplitPaneHandoff(key)
     expect(claimed?.cwdPromise).toBe(currentPromise)
-    expect(claimed?.preconnectInput).toEqual([{ data: 'current', kind: 'ordinary' }])
+    expect(claimed?.preconnectInput).toEqual([
+      { data: 'current', kind: 'ordinary', inputKind: 'driving' }
+    ])
   })
 
   it('retains input within the shared preconnect entry and code-unit caps', () => {
     const entryKey = makePaneKey('tab-entries', LEAF_1)
     const entryHandle = beginDeferredSplitPaneHandoff(entryKey, Promise.resolve('/entries'))
     for (let index = 0; index < PTY_PRECONNECT_INPUT_MAX_ENTRIES; index += 1) {
-      appendDeferredSplitPaneInput(entryHandle, { data: '', kind: 'ordinary' })
+      appendDeferredSplitPaneInput(entryHandle, {
+        data: '',
+        kind: 'ordinary',
+        inputKind: 'driving'
+      })
     }
-    appendDeferredSplitPaneInput(entryHandle, { data: 'overflow', kind: 'ordinary' })
+    appendDeferredSplitPaneInput(entryHandle, {
+      data: 'overflow',
+      kind: 'ordinary',
+      inputKind: 'driving'
+    })
     expect(claimDeferredSplitPaneHandoff(entryKey)?.preconnectInput).toHaveLength(
       PTY_PRECONNECT_INPUT_MAX_ENTRIES
     )
@@ -154,11 +201,20 @@ describe('deferred split pane handoff', () => {
     )
     appendDeferredSplitPaneInput(codeUnitHandle, {
       data: 'x'.repeat(PTY_PRECONNECT_INPUT_MAX_CODE_UNITS),
-      kind: 'ordinary'
+      kind: 'ordinary',
+      inputKind: 'driving'
+    })
+    appendDeferredSplitPaneInput(codeUnitHandle, {
+      data: 'overflow',
+      kind: 'ordinary',
+      inputKind: 'driving'
     })
-    appendDeferredSplitPaneInput(codeUnitHandle, { data: 'overflow', kind: 'ordinary' })
     expect(claimDeferredSplitPaneHandoff(codeUnitKey)?.preconnectInput).toEqual([
-      { data: 'x'.repeat(PTY_PRECONNECT_INPUT_MAX_CODE_UNITS), kind: 'ordinary' }
+      {
+        data: 'x'.repeat(PTY_PRECONNECT_INPUT_MAX_CODE_UNITS),
+        kind: 'ordinary',
+        inputKind: 'driving'
+      }
     ])
   })
 
@@ -209,12 +265,12 @@ describe('deferred split pane handoff', () => {
   it('does not expose the registry input array by reference', () => {
     const key = makePaneKey('tab-1', LEAF_1)
     const handle = beginDeferredSplitPaneHandoff(key, Promise.resolve('/source/cwd'))
-    appendDeferredSplitPaneInput(handle, { data: 'kept', kind: 'ordinary' })
+    appendDeferredSplitPaneInput(handle, { data: 'kept', kind: 'ordinary', inputKind: 'driving' })
     const firstClaim = claimDeferredSplitPaneHandoff(key)
     firstClaim?.preconnectInput.splice(0)
 
     expect(claimDeferredSplitPaneHandoff(key)?.preconnectInput).toEqual([
-      { data: 'kept', kind: 'ordinary' }
+      { data: 'kept', kind: 'ordinary', inputKind: 'driving' }
     ])
   })
 })
diff --git a/src/renderer/src/components/terminal-pane/deferred-split-pane-handoff.ts b/src/renderer/src/components/terminal-pane/deferred-split-pane-handoff.ts
index 6dfa1f30866a..046b43daa9c8 100644
--- a/src/renderer/src/components/terminal-pane/deferred-split-pane-handoff.ts
+++ b/src/renderer/src/components/terminal-pane/deferred-split-pane-handoff.ts
@@ -135,7 +135,7 @@ export function appendDeferredSplitPaneInput(
   ) {
     return
   }
-  owned.record.preconnectInput.push({ data: input.data, kind: input.kind })
+  owned.record.preconnectInput.push({ ...input })
   owned.record.inputCodeUnits += input.data.length
 }
 
diff --git a/src/renderer/src/components/terminal-pane/ipc-pty-connect.ts b/src/renderer/src/components/terminal-pane/ipc-pty-connect.ts
index 52b983c51fda..ea5a4dda3aae 100644
--- a/src/renderer/src/components/terminal-pane/ipc-pty-connect.ts
+++ b/src/renderer/src/components/terminal-pane/ipc-pty-connect.ts
@@ -1,5 +1,5 @@
 import { isRuntimeOwnedSshTargetId } from '../../../../shared/execution-host'
-import { extractIpcErrorMessage } from '@/lib/ipc-error'
+import { readIpcErrorDetail } from '@/lib/ipc-error'
 import { ensurePtyDispatcher } from './pty-dispatcher'
 import {
   clearConsumedPreHandlerPtyExit,
@@ -39,7 +39,7 @@ export async function connectIpcPty(
   context: IpcPtyConnectContext
 ): Promise<void | string | PtyConnectResult> {
   const { transportOptions, handlers } = context
-  const { onPtySpawn } = transportOptions
+  const { onPtySpawn, retainDisposedSpawn } = transportOptions
   context.setCallbacks(options.callbacks)
   ensurePtyDispatcher()
 
@@ -89,36 +89,37 @@ export async function connectIpcPty(
     // recorded before we asked for a PTY, so it belongs to that earlier owner, not to us.
     const priorIncarnationFence = currentPreHandlerPtySequence()
     const spawnResult = await spawnIpcPty(transportOptions, options, admittedSessionId)
-    const retireFreshSpawn = async (): Promise<void> => {
+    const retireFreshSpawn = async (path: 'disposed' | 'refused'): Promise<void> => {
       if (context.handleExplicitlyClosedConnect?.(spawnResult.id)) {
         return
       }
       // A newer generation may already own a recycled id; an id-only kill would retire its PTY.
-      if (
-        !spawnResult.isReattach &&
-        !spawnResult.coldRestore &&
-        !context.ownsPtyId(spawnResult.id)
-      ) {
+      if (spawnResult.isReattach || spawnResult.coldRestore || context.ownsPtyId(spawnResult.id)) {
+        return
+      }
+      // Only disposed transports can have a successor; live refusal must still retire the PTY (#11003).
+      const retained = path === 'disposed' && retainDisposedSpawn?.() === true
+      if (!retained) {
         await window.api.pty.kill(spawnResult.id)
       }
     }
 
     if (context.isDestroyed()) {
-      await retireFreshSpawn()
+      await retireFreshSpawn('disposed')
       return
     }
     if (options.admitPtyId && !options.admitPtyId(spawnResult.id)) {
-      await retireFreshSpawn()
+      await retireFreshSpawn('refused')
       return context.isDestroyed() ? undefined : spawnResult
     }
     if (context.isDestroyed()) {
-      await retireFreshSpawn()
+      await retireFreshSpawn('disposed')
       return
     }
     if (spawnResult.isReattach && !admittedSessionId) {
       context.getCallbacks().onReattachDetermined?.()
       if (context.isDestroyed()) {
-        await retireFreshSpawn()
+        await retireFreshSpawn('disposed')
         return
       }
     }
@@ -180,10 +181,8 @@ function handleConnectError(
   context: IpcPtyConnectContext
 ): PtyConnectResult | undefined {
   const { connectionId } = context.transportOptions
-  const message = extractIpcErrorMessage(
-    error,
-    error instanceof Error ? error.message : String(error)
-  )
+  const message =
+    readIpcErrorDetail(error) ?? (error instanceof Error ? error.message : String(error))
   if (connectionId && options.sessionId && isSshSessionGoneError(message)) {
     return { id: options.sessionId, sessionExpired: true }
   }
diff --git a/src/renderer/src/components/terminal-pane/keyboard-handlers-ime-enter-keyup.test.tsx b/src/renderer/src/components/terminal-pane/keyboard-handlers-ime-enter-keyup.test.tsx
index 7e6f9a02549c..8a84eddbcefb 100644
--- a/src/renderer/src/components/terminal-pane/keyboard-handlers-ime-enter-keyup.test.tsx
+++ b/src/renderer/src/components/terminal-pane/keyboard-handlers-ime-enter-keyup.test.tsx
@@ -328,7 +328,7 @@ describe('Windows IME Enter-keyup press-time evidence', () => {
     vi.runAllTimers()
 
     expect(harness.sendInput).toHaveBeenCalledTimes(1)
-    expect(harness.sendInput).toHaveBeenCalledWith('\x1b\r')
+    expect(harness.sendInput).toHaveBeenCalledWith('\x1b\r', 'driving')
     hook.unmount()
     harness.dispose()
   })
@@ -351,7 +351,7 @@ describe('Windows IME Enter-keyup press-time evidence', () => {
     vi.runAllTimers()
 
     expect(harness.sendInput).toHaveBeenCalledTimes(1)
-    expect(harness.sendInput).toHaveBeenCalledWith('\x1b\r')
+    expect(harness.sendInput).toHaveBeenCalledWith('\x1b\r', 'driving')
     hook.unmount()
     harness.dispose()
   })
@@ -374,7 +374,7 @@ describe('Windows IME Enter-keyup press-time evidence', () => {
 
     expect(harness.setActivePane).toHaveBeenCalledWith(2, { focus: false })
     expect(harness.sendInput).toHaveBeenCalledOnce()
-    expect(harness.sendInput).toHaveBeenCalledWith('\x1b\r')
+    expect(harness.sendInput).toHaveBeenCalledWith('\x1b\r', 'driving')
     hook.unmount()
     harness.dispose()
   })
diff --git a/src/renderer/src/components/terminal-pane/pane-helpers.test.ts b/src/renderer/src/components/terminal-pane/pane-helpers.test.ts
index ee962bd49aee..909be3c41a54 100644
--- a/src/renderer/src/components/terminal-pane/pane-helpers.test.ts
+++ b/src/renderer/src/components/terminal-pane/pane-helpers.test.ts
@@ -69,6 +69,8 @@ describe('fitAndFocusPanes', () => {
       )
     }
 
+    matches = vi.fn(() => false)
+
     closest: (selector: string) => Element | null
   }
 
diff --git a/src/renderer/src/components/terminal-pane/pending-split-close.test.ts b/src/renderer/src/components/terminal-pane/pending-split-close.test.ts
index 5a022ef9c993..3ab94611f941 100644
--- a/src/renderer/src/components/terminal-pane/pending-split-close.test.ts
+++ b/src/renderer/src/components/terminal-pane/pending-split-close.test.ts
@@ -191,3 +191,18 @@ it('retires a local folder-workspace split without a git worktree row', async ()
   await p.connecting
   expect(window.api.pty.kill).toHaveBeenCalledTimes(2)
 })
+
+it('commits the explicit split close in main by its leaf without waiting for its write', async () => {
+  const p = await preparePendingSplitClose()
+  // Main's durable write never settles here: the pane must still leave and be killed at once.
+  const closeTerminalSurface = vi.fn(() => new Promise<void>(() => {}))
+  Object.assign(window.api, { session: { ...window.api.session, closeTerminalSurface } })
+  p.actions.executeClosePane(1)
+  expect(closeTerminalSurface).toHaveBeenCalledExactlyOnceWith({
+    worktreeId: 'workspace',
+    target: { kind: 'pane', tabId: p.tabId, leafId: p.leafId }
+  })
+  expect(p.transports.has(1)).toBe(false)
+  expect(p.state.terminalLayoutsByTabId[p.tabId].ptyIdsByLeafId?.[p.leafId]).toBeUndefined()
+  expect(window.api.pty.kill).toHaveBeenCalledExactlyOnceWith('pty-restored')
+})
diff --git a/src/renderer/src/components/terminal-pane/pty-connection-cold-restore-resume-command.test.ts b/src/renderer/src/components/terminal-pane/pty-connection-cold-restore-resume-command.test.ts
index 89bcc7254d19..757f3260fbcb 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection-cold-restore-resume-command.test.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection-cold-restore-resume-command.test.ts
@@ -457,7 +457,7 @@ describe('connectPanePty', () => {
     ).resolves.toBe("codex '--dangerously-bypass-approvals-and-sandbox' 'resume' 'codex-session-1'")
   })
 
-  it('keeps a contentless reattach when the sleeping record represents a live session', async () => {
+  async function expectLiveNoteKeepsContentlessReattach(state: 'working' | 'done'): Promise<void> {
     const { connectPanePty } = await import('./pty-connection')
     const paneKey = makePaneKey('tab-1', LEAF_2)
     const transport = createMockTransport('restored-session')
@@ -488,6 +488,7 @@ describe('connectPanePty', () => {
         }
       }
     } as StoreState
+    Object.assign(mockStoreState.sleepingAgentSessionsByPaneKey[paneKey] ?? {}, { state })
     const pane = createPane(2)
     const manager = createManager(2)
     const deps = createDeps({
@@ -502,7 +503,13 @@ describe('connectPanePty', () => {
     expect(transport.disconnect).not.toHaveBeenCalled()
     expect(deps.syncPanePtyLayoutBinding).toHaveBeenCalledWith(2, 'restored-session')
     expect(mockStoreState.clearSleepingAgentSession).not.toHaveBeenCalled()
-  })
+  }
+
+  // Why: a live note is the idle anchor of a running pane, done or not, never hibernation evidence.
+  it.each(['working', 'done'] as const)(
+    'keeps a contentless reattach when a live-origin %s note represents a running session',
+    expectLiveNoteKeepsContentlessReattach
+  )
 
   it('keeps a contentless reattach when a live status supersedes passive sleep evidence', async () => {
     const { connectPanePty } = await import('./pty-connection')
diff --git a/src/renderer/src/components/terminal-pane/pty-connection-command-finished-cleanup.test.ts b/src/renderer/src/components/terminal-pane/pty-connection-command-finished-cleanup.test.ts
index 279f99d3ede7..45a603f9e7fb 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection-command-finished-cleanup.test.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection-command-finished-cleanup.test.ts
@@ -1,6 +1,7 @@
 import type * as React from 'react'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { POST_REPLAY_REATTACH_RESET } from '../../../../shared/terminal-mode-reset-profiles'
+import { TerminalKittyKeyboardModeTracker } from '../../../../shared/terminal-kitty-keyboard-mode-tracker'
 import { makePaneKey } from '../../../../shared/stable-pane-id'
 import { flushAsyncTicks, createDeferred } from './pty-connection-test-async'
 import {
@@ -532,11 +533,13 @@ describe('connectPanePty', () => {
     const paneKey = makePaneKey('tab-1', LEAF_1)
     const pane = createPane(1)
     const { writes } = captureCallbackTerminalWrites(pane)
+    const deps = createDeps({ isVisibleRef: { current: false } })
 
     connectPanePty(
       pane as never,
       createManager(1) as never,
-      createDeps({ isVisibleRef: { current: false } }) as never
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: fixture types intentionally model the production connection boundary.
+      deps as never
     )
     await vi.advanceTimersByTimeAsync(20)
     await flushAsyncTicks()
@@ -545,11 +548,15 @@ describe('connectPanePty', () => {
       identity: { agentType: 'droid' }
     }
 
+    // The agent negotiates Kitty keys across a chunk split, then dies armed.
+    dataCallbackRef.current?.('\x1b[>')
+    dataCallbackRef.current?.('5u')
     // A SIGKILLed agent emits no mode teardown; only the shell's next prompt
     // mark arrives. The bare 133;D must not disarm yet — the foreground read
     // has not confirmed the agent is gone.
     dataCallbackRef.current?.('\x1b]133;D;0\x07')
     expect(writes.some((w) => w.includes(POST_REPLAY_REATTACH_RESET))).toBe(false)
+    expect(deps.paneKittyKeyboardModesRef.current.get(pane.id)?.flags).toBe(5)
 
     await vi.advanceTimersByTimeAsync(350)
     await flushAsyncTicks()
@@ -559,6 +566,58 @@ describe('connectPanePty', () => {
     // The live shell re-arms bracketed paste at its prompt before the disarm
     // fires; the reset must not strip it.
     expect(disarm).not.toContain('\x1b[?2004l')
+    // Shortcut policy reads the mirror, so it must drop the dead app's flags with xterm.
+    expect(deps.paneKittyKeyboardModesRef.current.get(pane.id)?.flags).toBe(0)
+  })
+
+  it('grounds xterm and the input mirror in stream order when output is still queued', async () => {
+    vi.useFakeTimers()
+    const { connectPanePty } = await import('./pty-connection')
+    const confirmRead = createDeferred<string>()
+    vi.mocked(window.api.pty.confirmForegroundProcess).mockReturnValue(confirmRead.promise)
+    const dataCallbackRef: { current: ((data: string) => void) | null } = { current: null }
+    const ptyId = 'pty-stale-mode-queued-output'
+    const transport = createMockTransport(ptyId)
+    transport.connect.mockImplementation(async ({ callbacks }: { callbacks: ConnectCallbacks }) => {
+      dataCallbackRef.current = callbacks.onData ?? null
+      return { id: ptyId }
+    })
+    transportFactoryQueue.push(transport)
+    const paneKey = makePaneKey('tab-1', LEAF_1)
+    const pane = createPane(1)
+    const { writes } = captureCallbackTerminalWrites(pane)
+    const deps = createDeps({ isVisibleRef: { current: false } })
+
+    connectPanePty(
+      pane as never,
+      createManager(1) as never,
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: fixture types intentionally model the production connection boundary.
+      deps as never
+    )
+    await vi.advanceTimersByTimeAsync(20)
+    await flushAsyncTicks()
+    mockStoreState.agentLaunchConfigByPaneKey[paneKey] = {
+      launchConfig: { agentArgs: '', agentEnv: {} },
+      identity: { agentType: 'droid' }
+    }
+    dataCallbackRef.current?.('\x1b]133;D;0\x07')
+    await vi.advanceTimersByTimeAsync(350)
+    await flushAsyncTicks()
+    expect(window.api.pty.confirmForegroundProcess).toHaveBeenCalled()
+
+    // Hidden-pane output sits in the background queue when the shell proof lands.
+    dataCallbackRef.current?.('\x1b[>5u')
+    expect(writes.some((w) => w.includes('\x1b[>5u'))).toBe(false)
+    confirmRead.resolve('bash')
+    await flushAsyncTicks()
+    await vi.advanceTimersByTimeAsync(100)
+
+    // Parsing what xterm received, in order, must match the mirror.
+    const xtermView = new TerminalKittyKeyboardModeTracker()
+    writes.forEach((write) => xtermView.scan(write))
+    expect(writes.some((w) => w.includes(POST_REPLAY_REATTACH_RESET))).toBe(true)
+    expect(deps.paneKittyKeyboardModesRef.current.get(pane.id)?.flags).toBe(0)
+    expect(xtermView.flags).toBe(0)
   })
 
   it('keeps armed modes while the agent still owns the foreground after a leaked 133;D', async () => {
@@ -576,11 +635,13 @@ describe('connectPanePty', () => {
     const paneKey = makePaneKey('tab-1', LEAF_1)
     const pane = createPane(1)
     const { writes } = captureCallbackTerminalWrites(pane)
+    const deps = createDeps({ isVisibleRef: { current: false } })
 
     connectPanePty(
       pane as never,
       createManager(1) as never,
-      createDeps({ isVisibleRef: { current: false } }) as never
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: fixture types intentionally model the production connection boundary.
+      deps as never
     )
     await vi.advanceTimersByTimeAsync(20)
     await flushAsyncTicks()
@@ -589,6 +650,7 @@ describe('connectPanePty', () => {
       identity: { agentType: 'droid' }
     }
 
+    dataCallbackRef.current?.('\x1b[>5u')
     // A full-screen agent's nested command shell leaks a 133;D onto the main
     // PTY; the confirming read republishes the live agent, so its armed
     // mouse/kitty modes must survive untouched.
@@ -597,6 +659,7 @@ describe('connectPanePty', () => {
     await flushAsyncTicks()
 
     expect(writes.some((w) => w.includes(POST_REPLAY_REATTACH_RESET))).toBe(false)
+    expect(deps.paneKittyKeyboardModesRef.current.get(pane.id)?.flags).toBe(5)
   })
 
   it('retires stale routing after unavailable command-finish reads without asserting shell', async () => {
diff --git a/src/renderer/src/components/terminal-pane/pty-connection-foreground-write-path.test.ts b/src/renderer/src/components/terminal-pane/pty-connection-foreground-write-path.test.ts
index 743f06f6f424..f2dfe0bd6377 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection-foreground-write-path.test.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection-foreground-write-path.test.ts
@@ -240,7 +240,7 @@ describe('connectPanePty', () => {
 
     const forward = deferPtyInput.mock.calls[0]?.[2] as (data: string) => void
     forward('a')
-    expect(transport.sendInput).toHaveBeenCalledWith('a')
+    expect(transport.sendInput).toHaveBeenCalledWith('a', 'query-reply')
   })
 
   it('forwards terminal input directly when the host supplies no deferPtyInput', async () => {
@@ -253,7 +253,7 @@ describe('connectPanePty', () => {
     await flushAsyncTicks()
     sendTerminalInputThroughPane(pane, 'a')
 
-    expect(transport.sendInput).toHaveBeenCalledWith('a')
+    expect(transport.sendInput).toHaveBeenCalledWith('a', 'query-reply')
   })
 
   it('keeps large ANSI redraws after captured shortcut input on the immediate path', async () => {
diff --git a/src/renderer/src/components/terminal-pane/pty-connection-fresh-spawn-guards.test.ts b/src/renderer/src/components/terminal-pane/pty-connection-fresh-spawn-guards.test.ts
index d6d7246f0175..02c99e2aa4b3 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection-fresh-spawn-guards.test.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection-fresh-spawn-guards.test.ts
@@ -221,6 +221,44 @@ describe('connectPanePty', () => {
     expect(deps.onPtyErrorRef.current).not.toHaveBeenCalled()
   })
 
+  // The disposed-spawn kill in ipc-pty-connect asks this callback before retiring a PTY; it must
+  // answer from the live store, or a remounted pane's shell dies under it.
+  it('lets a disposed spawn survive while the pane surface still exists in the store', async () => {
+    const { connectPanePty } = await import('./pty-connection')
+    const transport = createMockTransport()
+    transportFactoryQueue.push(transport)
+    const deps = createDeps({ tabId: 'tab-retain-disposed-spawn' })
+    mockStoreState = {
+      ...mockStoreState,
+      tabsByWorktree: { 'wt-1': [{ id: 'tab-retain-disposed-spawn', ptyId: null }] }
+    }
+
+    connectPanePty(createPane(1) as never, createManager(1) as never, deps as never)
+    await flushAsyncTicks()
+
+    const retain = createdTransportOptions[0]?.retainDisposedSpawn
+    if (typeof retain !== 'function') {
+      throw new Error('pane transport was built without retainDisposedSpawn')
+    }
+    expect(retain()).toBe(true)
+    mockStoreState = {
+      ...mockStoreState,
+      deleteStateByWorktreeId: { 'wt-1': { isDeleting: true, phase: 'deleting' } }
+    }
+    expect(retain()).toBe(false)
+    mockStoreState = {
+      ...mockStoreState,
+      deleteStateByWorktreeId: { 'local|wt-1': { isDeleting: true, phase: 'deleting' } }
+    }
+    expect(retain()).toBe(false)
+    mockStoreState = {
+      ...mockStoreState,
+      deleteStateByWorktreeId: {},
+      tabsByWorktree: { 'wt-1': [] }
+    }
+    expect(retain()).toBe(false)
+  })
+
   it('fresh-spawns normally when the pane worktree is not being deleted', async () => {
     const { connectPanePty } = await import('./pty-connection')
     const transport = createMockTransport()
@@ -452,7 +490,7 @@ describe('connectPanePty', () => {
     // Released (via the guard's fallback or parse completion): input flows again.
     deps.replayingPanesRef.current.delete(pane.id)
     sendTerminalInputThroughPane(pane, 'echo hi\r')
-    expect(transport.sendInput).toHaveBeenCalledWith('echo hi\r')
+    expect(transport.sendInput).toHaveBeenCalledWith('echo hi\r', 'query-reply')
   })
 
   it('preserves classified user input during replay while suppressing synthetic replies', async () => {
@@ -495,7 +533,7 @@ describe('connectPanePty', () => {
     for (const forward of deferred.splice(0)) {
       forward()
     }
-    expect(transport.sendInput).toHaveBeenCalledExactlyOnceWith('input_under_flood\r')
+    expect(transport.sendInput).toHaveBeenCalledExactlyOnceWith('input_under_flood\r', 'driving')
 
     // A wheel over a replayed alt-screen frame becomes cursor keys; the fresh shell must not recall history from them.
     pane.terminal.buffer.active.type = 'alternate'
@@ -506,7 +544,7 @@ describe('connectPanePty', () => {
     for (const forward of deferred.splice(0)) {
       forward()
     }
-    expect(transport.sendInput).toHaveBeenCalledExactlyOnceWith('input_under_flood\r')
+    expect(transport.sendInput).toHaveBeenCalledExactlyOnceWith('input_under_flood\r', 'driving')
 
     // The same bytes on the normal buffer can only be a keyboard arrow, which survives replay.
     pane.terminal.buffer.active.type = 'normal'
@@ -518,7 +556,7 @@ describe('connectPanePty', () => {
       forward()
     }
     expect(transport.sendInput).toHaveBeenCalledTimes(2)
-    expect(transport.sendInput).toHaveBeenLastCalledWith('\x1b[B')
+    expect(transport.sendInput).toHaveBeenLastCalledWith('\x1b[B', 'driving')
 
     // Once the guard releases, the same mouse report is ordinary input again.
     deps.replayingPanesRef.current.delete(pane.id)
@@ -529,7 +567,7 @@ describe('connectPanePty', () => {
     for (const forward of deferred.splice(0)) {
       forward()
     }
-    expect(transport.sendInput).toHaveBeenLastCalledWith('\x1b[<0;12;4M')
+    expect(transport.sendInput).toHaveBeenLastCalledWith('\x1b[<0;12;4M', 'driving')
   })
 
   it('settles a queued startup only after the pane binds its spawned PTY', async () => {
diff --git a/src/renderer/src/components/terminal-pane/pty-connection-hibernation-wake.test.ts b/src/renderer/src/components/terminal-pane/pty-connection-hibernation-wake.test.ts
index 7aa4de64a1d4..7855e756226f 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection-hibernation-wake.test.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection-hibernation-wake.test.ts
@@ -209,6 +209,52 @@ describe('connectPanePty', () => {
     expect(transport.connect.mock.calls.length).toBe(connectCallsAfterWake)
   })
 
+  // Why: pins #16308's incidental effect. Hibernation writes a worktree-sleep note, yet any
+  // suppressed exit over a finished turn's live idle anchor now arms a resume on reveal.
+  it('arms an in-place resume from a finished turn idle anchor on a suppressed exit', async () => {
+    const { connectPanePty } = await import('./pty-connection')
+    const transport = createMockTransport('pty-pane-2')
+    transportFactoryQueue.push(transport)
+    const deps = createDeps({
+      consumeSuppressedPtyExit: vi.fn(() => true),
+      isVisibleRef: { current: false }
+    })
+    const pane = createPane(2)
+    const paneKey = `tab-1:${leafIdForPane(2)}`
+    mockStoreState.sleepingAgentSessionsByPaneKey[paneKey] = {
+      paneKey,
+      tabId: 'tab-1',
+      worktreeId: 'wt-1',
+      agent: 'claude',
+      providerSession: { key: 'session_id', id: 'sess-idle-anchor' },
+      prompt: '',
+      state: 'done',
+      capturedAt: 1,
+      updatedAt: 1,
+      origin: 'live'
+    }
+    mockStoreState.suppressedPtyExitIds['tab-pty'] = true
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the fixtures implement the pane, manager and deps members connectPanePty reads.
+    const args = [pane, createManager(1), deps] as unknown as Parameters<typeof connectPanePty>
+    const binding = connectPanePty(...args)
+    await flushAsyncTicks()
+    const onPtyExit = createdTransportOptions[0]?.onPtyExit
+    expect(onPtyExit).toBeTypeOf('function')
+    const connectCallsBeforeExit = transport.connect.mock.calls.length
+    if (typeof onPtyExit === 'function') {
+      onPtyExit('tab-pty')
+    }
+    await flushAsyncTicks()
+
+    binding.noteVisibilityResume()
+    await flushAsyncTicks()
+
+    const resumeConnectOptions: { command?: string } | undefined =
+      transport.connect.mock.calls.at(-1)?.[0]
+    expect(transport.connect.mock.calls.length).toBeGreaterThan(connectCallsBeforeExit)
+    expect(resumeConnectOptions?.command).toContain('sess-idle-anchor')
+  })
+
   it('resumes a hibernated agent from a navigation-free wake without a visibility reveal', async () => {
     // Mobile wake fanout drives wakeHibernatedAgentIfArmed on a still-hidden pane (no isVisible flip): the armed --resume must fire exactly once even if delivered twice (INV-1).
     const { connectPanePty } = await import('./pty-connection')
@@ -692,7 +738,7 @@ describe('connectPanePty', () => {
     sendTerminalInputThroughPane(pane, '\x1b[O')
     expect(mockStoreState.recordTerminalInput).not.toHaveBeenCalled()
     // The reply still reaches the shell; only the activity recording is gated.
-    expect(transport.sendInput).toHaveBeenCalledWith('\x1b[O')
+    expect(transport.sendInput).toHaveBeenCalledWith('\x1b[O', 'query-reply')
 
     // Real user input fires the core signal and records activity.
     for (const listener of userInputListeners) {
diff --git a/src/renderer/src/components/terminal-pane/pty-connection-hook-completion-bell-arbitration.test.ts b/src/renderer/src/components/terminal-pane/pty-connection-hook-completion-bell-arbitration.test.ts
index e315563f0c66..ef49288f3eb5 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection-hook-completion-bell-arbitration.test.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection-hook-completion-bell-arbitration.test.ts
@@ -528,7 +528,7 @@ describe('connectPanePty', () => {
       'terminal-bell'
     )
     expect(deps.clearTerminalPaneUnread).not.toHaveBeenCalled()
-    expect(transport.sendInput).toHaveBeenCalledWith('a')
+    expect(transport.sendInput).toHaveBeenCalledWith('a', 'query-reply')
   })
 
   // Why: xterm auto-replies during replay must not count as user interaction, or a BELed pane would self-dismiss unseen.
diff --git a/src/renderer/src/components/terminal-pane/pty-connection-hook-completion-side-effects.test.ts b/src/renderer/src/components/terminal-pane/pty-connection-hook-completion-side-effects.test.ts
index e61460ee4902..c3221a7753bf 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection-hook-completion-side-effects.test.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection-hook-completion-side-effects.test.ts
@@ -463,8 +463,8 @@ describe('connectPanePty', () => {
       sendTerminalInputThroughPane(pane, '\x1b[I')
       sendTerminalInputThroughPane(pane, '\x7f')
       expect(transport.sendInput).toHaveBeenCalledTimes(2)
-      expect(transport.sendInput).toHaveBeenNthCalledWith(1, '\x1b[I')
-      expect(transport.sendInput).toHaveBeenLastCalledWith('\x7f')
+      expect(transport.sendInput).toHaveBeenNthCalledWith(1, '\x1b[I', 'query-reply')
+      expect(transport.sendInput).toHaveBeenLastCalledWith('\x7f', 'query-reply')
     } finally {
       restoreUserAgent()
     }
diff --git a/src/renderer/src/components/terminal-pane/pty-connection-hook-idle-arbitration.test.ts b/src/renderer/src/components/terminal-pane/pty-connection-hook-idle-arbitration.test.ts
index 1b6cfd4f0493..e7af721d19af 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection-hook-idle-arbitration.test.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection-hook-idle-arbitration.test.ts
@@ -225,7 +225,7 @@ describe('connectPanePty', () => {
         agentToolName: 'Edit',
         agentToolInput: 'src/main/ipc/notifications.ts',
         agentLastAssistantMessage: 'Implemented the formatter.',
-        agentInterrupted: false
+        agentTurnOutcome: undefined
       })
     )
   })
diff --git a/src/renderer/src/components/terminal-pane/pty-connection-interrupt-inference.test.ts b/src/renderer/src/components/terminal-pane/pty-connection-interrupt-inference.test.ts
index 4b1f376b7732..7e9034c1d619 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection-interrupt-inference.test.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection-interrupt-inference.test.ts
@@ -364,7 +364,7 @@ describe('connectPanePty', () => {
     vi.advanceTimersByTime(500)
     await flushAsyncTicks()
 
-    expect(transport.sendInput).toHaveBeenCalledWith('\x03')
+    expect(transport.sendInput).toHaveBeenCalledWith('\x03', 'query-reply')
     expect(window.api.agentStatus.inferInterrupt).not.toHaveBeenCalled()
     expect(deps.setRuntimePaneTitle).not.toHaveBeenCalled()
     expect(deps.updateTabTitle).not.toHaveBeenCalled()
@@ -478,7 +478,7 @@ describe('connectPanePty', () => {
     vi.advanceTimersByTime(500)
     await flushAsyncTicks()
 
-    expect(transport.sendInputAccepted).toHaveBeenCalledWith('\x1b[99;5u')
+    expect(transport.sendInputAccepted).toHaveBeenCalledWith('\x1b[99;5u', 'query-reply')
     expect(window.api.agentStatus.inferInterrupt).toHaveBeenCalledWith({
       paneKey,
       baselineUpdatedAt: 1_000,
@@ -652,7 +652,7 @@ describe('connectPanePty', () => {
     vi.advanceTimersByTime(500)
     await flushAsyncTicks()
 
-    expect(transport.sendInput).toHaveBeenCalledWith('\x03')
+    expect(transport.sendInput).toHaveBeenCalledWith('\x03', 'query-reply')
     expect(window.api.agentStatus.inferInterrupt).not.toHaveBeenCalled()
   })
 
diff --git a/src/renderer/src/components/terminal-pane/pty-connection-pi-synchronized-input.test.ts b/src/renderer/src/components/terminal-pane/pty-connection-pi-synchronized-input.test.ts
index a7917a1ccdfb..173c721d25c7 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection-pi-synchronized-input.test.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection-pi-synchronized-input.test.ts
@@ -164,8 +164,8 @@ describe('connectPanePty', () => {
       const pane = createPane(1)
       const synchronizedOutput = { synchronizedOutput: false }
       const renderRows = vi.fn()
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: test fixture exposes xterm's private render state to observe the DEC 2026 present.
       ;(
-        // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: test fixture exposes xterm's private render state to observe the DEC 2026 present.
         pane.terminal as unknown as {
           _core: {
             coreService: { decPrivateModes: typeof synchronizedOutput }
diff --git a/src/renderer/src/components/terminal-pane/pty-connection-reattach-mode-reset.test.ts b/src/renderer/src/components/terminal-pane/pty-connection-reattach-mode-reset.test.ts
index 99c54dad2eb4..1e8ad402de7b 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection-reattach-mode-reset.test.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection-reattach-mode-reset.test.ts
@@ -275,8 +275,8 @@ describe('connectPanePty', () => {
     transport.sendInputImmediate.mockClear()
     sendTerminalInputThroughPane(pane, 'yes')
     sendTerminalInputThroughPane(pane, '\x1b[A') // arrow-key auto-repeat stays batched
-    expect(transport.sendInput).toHaveBeenCalledWith('yes')
-    expect(transport.sendInput).toHaveBeenCalledWith('\x1b[A')
+    expect(transport.sendInput).toHaveBeenCalledWith('yes', 'query-reply')
+    expect(transport.sendInput).toHaveBeenCalledWith('\x1b[A', 'query-reply')
     expect(transport.sendInputImmediate).not.toHaveBeenCalled()
 
     // terminal-query-reply.test proves real xterm emits this as one framed onData reply; this pins it to the immediate path.
@@ -291,7 +291,7 @@ describe('connectPanePty', () => {
     const printableInputs = [']10;hello', '>|xterm.js(6.1.0-beta.287)', ']|literal-text']
     for (const data of printableInputs) {
       sendTerminalInputThroughPane(pane, data)
-      expect(transport.sendInput).toHaveBeenCalledWith(data)
+      expect(transport.sendInput).toHaveBeenCalledWith(data, 'query-reply')
     }
     expect(transport.sendInputImmediate).not.toHaveBeenCalled()
   })
@@ -368,7 +368,7 @@ describe('connectPanePty', () => {
       connectPanePty(pane as never, manager as never, deps as never)
       await flushAsyncTicks(20)
 
-      expect(transport.sendInput).toHaveBeenCalledWith('\x1b[I')
+      expect(transport.sendInput).toHaveBeenCalledWith('\x1b[I', 'query-reply')
       // Snapshot ends with ?25l (Cursor Agent parks/hides the cursor); the reset must preserve it, not force ?25h, or a stray block paints.
       expect(pane.terminal.write).toHaveBeenCalledWith(
         `${RESET_TERMINAL_CURSOR_STYLE}${RESET_KITTY_KEYBOARD_PROTOCOL}`,
diff --git a/src/renderer/src/components/terminal-pane/pty-connection-replay-payload-handling.test.ts b/src/renderer/src/components/terminal-pane/pty-connection-replay-payload-handling.test.ts
index 559060108eee..a83236b5378c 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection-replay-payload-handling.test.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection-replay-payload-handling.test.ts
@@ -400,7 +400,7 @@ describe('connectPanePty', () => {
         POST_REPLAY_LIVE_AGENT_REATTACH_RESET,
         expect.any(Function)
       )
-      expect(transport.sendInput).toHaveBeenCalledWith('\x1b[I')
+      expect(transport.sendInput).toHaveBeenCalledWith('\x1b[I', 'query-reply')
       return connection
     })
     disposable.dispose()
diff --git a/src/renderer/src/components/terminal-pane/pty-connection-setup-split-spawn.test.ts b/src/renderer/src/components/terminal-pane/pty-connection-setup-split-spawn.test.ts
index c61fb188cafc..924389689846 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection-setup-split-spawn.test.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection-setup-split-spawn.test.ts
@@ -600,7 +600,7 @@ describe('connectPanePty', () => {
       writes.join('').indexOf('NEWER-LIVE-SSH-OUTPUT')
     )
     expect(transport.sendInput).not.toHaveBeenCalledWith('codex resume provider-session\r')
-    expect(transport.sendInput).toHaveBeenCalledWith('AFTER_ADOPTION_REPLAY\r')
+    expect(transport.sendInput).toHaveBeenCalledWith('AFTER_ADOPTION_REPLAY\r', 'query-reply')
     expect(deps.syncPanePtyLayoutBinding).toHaveBeenCalledWith(1, stablePtyId)
   })
 
@@ -642,7 +642,7 @@ describe('connectPanePty', () => {
     setFitOverride('pty-live', 'remote-desktop-fit', 80, 24)
     transport.claimViewport.mockClear()
     ;(onDataHandler as (data: string) => void)('a')
-    expect(transport.sendInput).toHaveBeenCalledWith('a')
+    expect(transport.sendInput).toHaveBeenCalledWith('a', 'query-reply')
     expect(transport.claimViewport).toHaveBeenCalledTimes(1)
     ;(onDataHandler as (data: string) => void)('b')
     // The renderer stays parked until runtime convergence is acknowledged, so a second keystroke can retry a transient failed resize.
diff --git a/src/renderer/src/components/terminal-pane/pty-connection-ssh-startup-draft-delivery.test.ts b/src/renderer/src/components/terminal-pane/pty-connection-ssh-startup-draft-delivery.test.ts
index 2538c9e0cecc..59fdc6decd7c 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection-ssh-startup-draft-delivery.test.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection-ssh-startup-draft-delivery.test.ts
@@ -222,7 +222,10 @@ describe('connectPanePty', () => {
 
     expect(createdTransportOptions[0]?.commandDelivery).toBe('provider')
     expect(transport.sendInput).not.toHaveBeenCalledWith('droid\r')
-    expect(transport.sendInputAccepted).toHaveBeenCalledWith(`\x1b[200~${prompt}\x1b[201~`)
+    expect(transport.sendInputAccepted).toHaveBeenCalledWith(
+      `\x1b[200~${prompt}\x1b[201~`,
+      'launch'
+    )
   })
 
   it('waits past 8s for a cold Codex composer and preserves input ordering', async () => {
@@ -279,7 +282,8 @@ describe('connectPanePty', () => {
     await flushAsyncTicks()
 
     expect(transport.sendInputAccepted).toHaveBeenCalledWith(
-      '\x1b[200~https://github.com/stablyai/orca/issues/42\x1b[201~'
+      '\x1b[200~https://github.com/stablyai/orca/issues/42\x1b[201~',
+      'launch'
     )
     expect(transport.sendInput.mock.calls.map(([data]) => data)).toEqual([
       '\x1b[I',
@@ -354,7 +358,8 @@ describe('connectPanePty', () => {
 
     expect(transport.sendInputAccepted).toHaveBeenCalledTimes(1)
     expect(transport.sendInputAccepted).toHaveBeenCalledWith(
-      '\x1b[200~Linked Linear issue: STA-905\x1b[201~'
+      '\x1b[200~Linked Linear issue: STA-905\x1b[201~',
+      'launch'
     )
   })
 
diff --git a/src/renderer/src/components/terminal-pane/pty-connection-startup-command-delivery.test.ts b/src/renderer/src/components/terminal-pane/pty-connection-startup-command-delivery.test.ts
index 969bf836594e..f85917e28c61 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection-startup-command-delivery.test.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection-startup-command-delivery.test.ts
@@ -525,7 +525,7 @@ describe('connectPanePty', () => {
       await flushAsyncTicks()
 
       expect(pane.terminal.paste).toHaveBeenCalledWith(command)
-      expect(transport.sendInput).toHaveBeenCalledWith('\r')
+      expect(transport.sendInput).toHaveBeenCalledWith('\r', 'launch')
       expect(transport.sendInput).not.toHaveBeenCalledWith(`${command}\r`)
     } finally {
       globalThis.setTimeout = originalSetTimeout
diff --git a/src/renderer/src/components/terminal-pane/pty-connection-task-complete-dispatch.test.ts b/src/renderer/src/components/terminal-pane/pty-connection-task-complete-dispatch.test.ts
index 4767de833820..25b40d861831 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection-task-complete-dispatch.test.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection-task-complete-dispatch.test.ts
@@ -699,7 +699,7 @@ describe('connectPanePty', () => {
     expect('agentToolName' in dispatchArgs).toBe(false)
     expect('agentToolInput' in dispatchArgs).toBe(false)
     expect('agentLastAssistantMessage' in dispatchArgs).toBe(false)
-    expect('agentInterrupted' in dispatchArgs).toBe(false)
+    expect('agentTurnOutcome' in dispatchArgs).toBe(false)
   })
 
   // Why: agent-row removal belongs to process/PTY lifecycle, not title reversion, so interrupts can't disappear the activity row.
diff --git a/src/renderer/src/components/terminal-pane/pty-connection-terminal-input-gating.test.ts b/src/renderer/src/components/terminal-pane/pty-connection-terminal-input-gating.test.ts
index 4659fccb5c56..4a2d2ee12063 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection-terminal-input-gating.test.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection-terminal-input-gating.test.ts
@@ -191,7 +191,7 @@ describe('connectPanePty', () => {
     }
     ;(onDataHandler as (data: string) => void)('a')
 
-    expect(transport.sendInput).toHaveBeenCalledWith('a')
+    expect(transport.sendInput).toHaveBeenCalledWith('a', 'query-reply')
   })
 
   it('uses the current worktree tab for Codex stale fallback without enumerating all worktrees', async () => {
@@ -234,7 +234,7 @@ describe('connectPanePty', () => {
     }
     ;(onDataHandler as (data: string) => void)('a')
 
-    expect(transport.sendInput).toHaveBeenCalledWith('a')
+    expect(transport.sendInput).toHaveBeenCalledWith('a', 'query-reply')
   })
 
   it('blocks stale Codex fallback input from the current worktree tab without enumerating all worktrees', async () => {
@@ -313,7 +313,7 @@ describe('connectPanePty', () => {
     }
     ;(onDataHandler as (data: string) => void)('a')
 
-    expect(transport.sendInput).toHaveBeenCalledWith('a')
+    expect(transport.sendInput).toHaveBeenCalledWith('a', 'query-reply')
   })
 
   it('restores input through the tab fallback when the dismissed pane has no live PTY binding', async () => {
@@ -347,7 +347,7 @@ describe('connectPanePty', () => {
     }
     ;(onDataHandler as (data: string) => void)('a')
 
-    expect(transport.sendInput).toHaveBeenCalledWith('a')
+    expect(transport.sendInput).toHaveBeenCalledWith('a', 'query-reply')
   })
 
   it('keeps a dismissed split pane typing while a sibling still holds the prompt', async () => {
@@ -389,7 +389,7 @@ describe('connectPanePty', () => {
     ;(onDataHandler as (data: string) => void)('a')
 
     expect((transport.getPtyId as unknown as () => string | null)()).toBe('pty-dismissed')
-    expect(transport.sendInput).toHaveBeenCalledWith('a')
+    expect(transport.sendInput).toHaveBeenCalledWith('a', 'query-reply')
   })
 
   it('keeps blocking a pane with its own unanswered notice next to a dismissed sibling', async () => {
@@ -466,7 +466,7 @@ describe('connectPanePty', () => {
     ;(onDataHandler as (data: string) => void)('a')
 
     expect((transport.getPtyId as unknown as () => string | null)()).toBe('pty-plain-shell')
-    expect(transport.sendInput).toHaveBeenCalledWith('a')
+    expect(transport.sendInput).toHaveBeenCalledWith('a', 'query-reply')
   })
 
   it('keeps blocking input on a pane whose restart is requested but not yet run', async () => {
@@ -782,7 +782,7 @@ describe('connectPanePty', () => {
     await flushAsyncTicks()
     vi.advanceTimersByTime(500)
 
-    expect(transport.sendInputAccepted).toHaveBeenCalledWith('\x03')
+    expect(transport.sendInputAccepted).toHaveBeenCalledWith('\x03', 'query-reply')
     expect(transport.sendInput).not.toHaveBeenCalled()
     expect(window.api.agentStatus.inferInterrupt).not.toHaveBeenCalled()
   })
@@ -843,7 +843,7 @@ describe('connectPanePty', () => {
     expect(transport.sendInput).not.toHaveBeenCalledWith('\r')
     // The terminator disarmed it, so the next real command reaches the shell.
     sendTerminalInputThroughPane(pane, 'ls\r')
-    expect(transport.sendInput).toHaveBeenCalledWith('ls\r')
+    expect(transport.sendInput).toHaveBeenCalledWith('ls\r', 'query-reply')
     _resetTerminalPaneRecoveryForTests()
   })
 
@@ -867,7 +867,7 @@ describe('connectPanePty', () => {
     vi.advanceTimersByTime(WRITE_PIPELINE_STALL_CHECK_MS * 2)
     await flushAsyncTicks()
 
-    expect(transport.sendInput).toHaveBeenCalledWith('x')
+    expect(transport.sendInput).toHaveBeenCalledWith('x', 'query-reply')
     expect(pane.terminal.write).toHaveBeenCalledWith('', expect.any(Function))
     expect(remountTerminalTabForRecovery).toHaveBeenCalledWith('tab-1', AUTOMATIC_REQUEST)
     binding.dispose()
@@ -892,7 +892,7 @@ describe('connectPanePty', () => {
     vi.advanceTimersByTime(WRITE_PIPELINE_STALL_CHECK_MS * 2)
     await flushAsyncTicks()
 
-    expect(transport.sendInputAccepted).toHaveBeenCalledWith('\x03')
+    expect(transport.sendInputAccepted).toHaveBeenCalledWith('\x03', 'query-reply')
     expect(pane.terminal.write).not.toHaveBeenCalledWith('', expect.any(Function))
     binding.dispose()
   })
diff --git a/src/renderer/src/components/terminal-pane/pty-connection-test-deps.ts b/src/renderer/src/components/terminal-pane/pty-connection-test-deps.ts
index cc7536afcb71..e37ab960e3b7 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection-test-deps.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection-test-deps.ts
@@ -2,6 +2,7 @@ import { vi } from 'vitest'
 import type { Mock } from 'vitest'
 import { leafIdForPane } from './pty-connection-test-pane-fixtures'
 import type { StoreState } from './pty-connection-test-store-state'
+import type { TerminalKittyKeyboardModeTracker } from '../../../../shared/terminal-kitty-keyboard-mode-tracker'
 
 type MockRef = { current: Mock }
 
@@ -16,7 +17,7 @@ export type PaneConnectionDeps = {
   mountFollowsTerminalPark: boolean
   paneTransportsRef: { current: Map<number, unknown> }
   paneMode2031Ref: { current: Map<number, unknown> }
-  paneKittyKeyboardModesRef: { current: Map<number, unknown> }
+  paneKittyKeyboardModesRef: { current: Map<number, TerminalKittyKeyboardModeTracker> }
   paneLastThemeModeRef: { current: Map<number, unknown> }
   replayingPanesRef: { current: Map<number, unknown> }
   isActiveRef: { current: boolean }
diff --git a/src/renderer/src/components/terminal-pane/pty-connection-typed-agent-identity.test.ts b/src/renderer/src/components/terminal-pane/pty-connection-typed-agent-identity.test.ts
index 119e61e121ee..73105c0248aa 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection-typed-agent-identity.test.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection-typed-agent-identity.test.ts
@@ -182,7 +182,7 @@ describe('connectPanePty', () => {
       agentType: 'pi'
     })
 
-    expect(transport.sendInput).toHaveBeenCalledWith('omp\r')
+    expect(transport.sendInput).toHaveBeenCalledWith('omp\r', 'query-reply')
     expect(deps.setRuntimePaneTitle).toHaveBeenCalledWith('tab-1', 1, 'OMP ready')
     expect(deps.updateTabTitle).toHaveBeenCalledWith('tab-1', 'OMP ready')
     expect(mockStoreState.agentStatusByPaneKey[paneKey]).toMatchObject({
@@ -436,7 +436,7 @@ describe('connectPanePty', () => {
       agentType: 'pi'
     })
 
-    expect(transport.sendInput).toHaveBeenCalledWith('pi \x17omp\r')
+    expect(transport.sendInput).toHaveBeenCalledWith('pi \x17omp\r', 'query-reply')
     expect(deps.setRuntimePaneTitle).toHaveBeenCalledWith('tab-1', 1, 'OMP ready')
     expect(mockStoreState.agentStatusByPaneKey[paneKey]).toMatchObject({
       state: 'done',
@@ -474,7 +474,7 @@ describe('connectPanePty', () => {
       agentType: 'pi'
     })
 
-    expect(transport.sendInput).toHaveBeenCalledWith('pi\r')
+    expect(transport.sendInput).toHaveBeenCalledWith('pi\r', 'query-reply')
     expect(deps.setRuntimePaneTitle).toHaveBeenCalledWith('tab-1', 1, 'Pi ready')
     expect(deps.updateTabTitle).toHaveBeenCalledWith('tab-1', 'Pi ready')
     expect(mockStoreState.agentStatusByPaneKey[paneKey]).toMatchObject({
@@ -525,7 +525,7 @@ describe('connectPanePty', () => {
       agentType: 'pi'
     })
 
-    expect(transport.sendInput).toHaveBeenCalledWith('omp\r')
+    expect(transport.sendInput).toHaveBeenCalledWith('omp\r', 'query-reply')
     expect(deps.setRuntimePaneTitle).toHaveBeenCalledWith('tab-1', 1, 'Pi ready')
     expect(mockStoreState.agentStatusByPaneKey[paneKey]).toMatchObject({
       state: 'done',
@@ -564,7 +564,7 @@ describe('connectPanePty', () => {
       agentType: 'pi'
     })
 
-    expect(transport.sendInput).toHaveBeenCalledWith('omp\r')
+    expect(transport.sendInput).toHaveBeenCalledWith('omp\r', 'query-reply')
     expect(deps.setRuntimePaneTitle).toHaveBeenCalledWith('tab-1', 1, 'Pi ready')
     expect(mockStoreState.agentStatusByPaneKey[paneKey]).toMatchObject({
       state: 'done',
@@ -650,7 +650,7 @@ describe('connectPanePty', () => {
       agentType: 'pi'
     })
 
-    expect(transport.sendInput).toHaveBeenCalledWith('op\x1b[Dm\r')
+    expect(transport.sendInput).toHaveBeenCalledWith('op\x1b[Dm\r', 'query-reply')
     expect(mockStoreState.agentStatusByPaneKey[paneKey]).toMatchObject({
       state: 'done',
       agentType: 'omp',
diff --git a/src/renderer/src/components/terminal-pane/pty-connection-windows-keyboard-reset.test.ts b/src/renderer/src/components/terminal-pane/pty-connection-windows-keyboard-reset.test.ts
index 471e237a2004..552f62c54bb3 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection-windows-keyboard-reset.test.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection-windows-keyboard-reset.test.ts
@@ -254,7 +254,7 @@ describe('connectPanePty', () => {
       )
       transport.sendInput.mockClear()
       sendTerminalInputThroughPane(pane, '\x1b[I')
-      expect(transport.sendInput).toHaveBeenCalledWith('\x1b[I')
+      expect(transport.sendInput).toHaveBeenCalledWith('\x1b[I', 'query-reply')
     } finally {
       restoreUserAgent()
     }
@@ -311,7 +311,7 @@ describe('connectPanePty', () => {
         )
         transport.sendInput.mockClear()
         sendTerminalInputThroughPane(pane, '\x1b[I')
-        expect(transport.sendInput).toHaveBeenCalledWith('\x1b[I')
+        expect(transport.sendInput).toHaveBeenCalledWith('\x1b[I', 'query-reply')
       } finally {
         restoreUserAgent()
       }
@@ -568,7 +568,7 @@ describe('connectPanePty', () => {
       notifyStoreSubscribers()
 
       sendTerminalInputThroughPane(pane, '\x1b[I')
-      expect(transport.sendInput).toHaveBeenCalledWith('\x1b[I')
+      expect(transport.sendInput).toHaveBeenCalledWith('\x1b[I', 'query-reply')
     } finally {
       restoreUserAgent()
     }
@@ -621,8 +621,8 @@ describe('connectPanePty', () => {
         sendTerminalInputThroughPane(pane, '\x1b[O')
         sendTerminalInputThroughPane(pane, '\x1b[I')
 
-        expect(transport.sendInput).toHaveBeenNthCalledWith(1, '\x1b[O')
-        expect(transport.sendInput).toHaveBeenNthCalledWith(2, '\x1b[I')
+        expect(transport.sendInput).toHaveBeenNthCalledWith(1, '\x1b[O', 'query-reply')
+        expect(transport.sendInput).toHaveBeenNthCalledWith(2, '\x1b[I', 'query-reply')
       } finally {
         restoreUserAgent()
       }
@@ -667,8 +667,8 @@ describe('connectPanePty', () => {
 
       sendTerminalInputThroughPane(pane, '\x7f')
       sendTerminalInputThroughPane(pane, 'x')
-      expect(transport.sendInput).toHaveBeenNthCalledWith(1, '\x7f')
-      expect(transport.sendInput).toHaveBeenNthCalledWith(2, 'x')
+      expect(transport.sendInput).toHaveBeenNthCalledWith(1, '\x7f', 'query-reply')
+      expect(transport.sendInput).toHaveBeenNthCalledWith(2, 'x', 'query-reply')
       expect(pane.terminal.modes.sendFocusMode).toBe(true)
 
       mockStoreState.agentStatusByPaneKey[paneKey] = {
@@ -679,7 +679,7 @@ describe('connectPanePty', () => {
       transport.sendInput.mockClear()
 
       sendTerminalInputThroughPane(pane, '\x1b[I')
-      expect(transport.sendInput).toHaveBeenCalledWith('\x1b[I')
+      expect(transport.sendInput).toHaveBeenCalledWith('\x1b[I', 'query-reply')
       expect(pane.terminal.modes.sendFocusMode).toBe(true)
 
       mockStoreState.agentStatusByPaneKey[paneKey] = {
@@ -689,7 +689,7 @@ describe('connectPanePty', () => {
       notifyStoreSubscribers()
       transport.sendInput.mockClear()
       sendTerminalInputThroughPane(pane, '\x1b[O')
-      expect(transport.sendInput).toHaveBeenCalledWith('\x1b[O')
+      expect(transport.sendInput).toHaveBeenCalledWith('\x1b[O', 'query-reply')
     } finally {
       restoreUserAgent()
     }
@@ -725,8 +725,8 @@ describe('connectPanePty', () => {
       sendTerminalInputThroughPane(pane, '\x1b[O')
       sendTerminalInputThroughPane(pane, '\x1b[I')
 
-      expect(transport.sendInput).toHaveBeenNthCalledWith(1, '\x1b[O')
-      expect(transport.sendInput).toHaveBeenNthCalledWith(2, '\x1b[I')
+      expect(transport.sendInput).toHaveBeenNthCalledWith(1, '\x1b[O', 'query-reply')
+      expect(transport.sendInput).toHaveBeenNthCalledWith(2, '\x1b[I', 'query-reply')
       expect(pane.terminal.modes.sendFocusMode).toBe(true)
     } finally {
       restoreUserAgent()
diff --git a/src/renderer/src/components/terminal-pane/pty-connection/agent-resume-recovery-install.test.ts b/src/renderer/src/components/terminal-pane/pty-connection/agent-resume-recovery-install.test.ts
index 1b9aa0005ce1..9306026ba170 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection/agent-resume-recovery-install.test.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection/agent-resume-recovery-install.test.ts
@@ -255,7 +255,7 @@ describe('recovery triggers', () => {
     expect(session.transport.disconnect).toHaveBeenCalled()
     expect(session.clearExitedPanePtyLayoutBinding).toHaveBeenCalledWith('pty-1')
     expect(session.startFreshColdRestoreAgentResume).toHaveBeenCalled()
-    const disconnectOrder = session.transport.disconnect.mock.invocationCallOrder[0]
+    const disconnectOrder = vi.mocked(session.transport.disconnect).mock.invocationCallOrder[0]
     const spawnOrder = session.startFreshColdRestoreAgentResume.mock.invocationCallOrder[0]
     expect(disconnectOrder).toBeLessThan(spawnOrder)
   })
diff --git a/src/renderer/src/components/terminal-pane/pty-connection/connect-pane-pty-session.ts b/src/renderer/src/components/terminal-pane/pty-connection/connect-pane-pty-session.ts
index c6a25e0d4618..417ccd812da1 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection/connect-pane-pty-session.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection/connect-pane-pty-session.ts
@@ -1,5 +1,6 @@
 import type { ManagedPane, PaneManager } from '@/lib/pane-manager/pane-manager'
 import type { PtyConnectionDeps } from '../pty-connection-types'
+import type { PtyTransport } from '../pty-transport-types'
 
 // Why: connectPanePty is a single closure factory. The bag lets extracted
 // installers share the same mutable bindings without changing call order.
@@ -7,6 +8,8 @@ export type ConnectPanePtySession = {
   pane: ManagedPane
   manager: PaneManager
   deps: PtyConnectionDeps
+  // Why typed: every PTY write must name its input kind, and the bag's `any` would hide a missing one.
+  transport: PtyTransport
   // oxlint-disable-next-line typescript/no-explicit-any -- session bag for mechanical extract
   [key: string]: any
 }
diff --git a/src/renderer/src/components/terminal-pane/pty-connection/connect-pane-pty.ts b/src/renderer/src/components/terminal-pane/pty-connection/connect-pane-pty.ts
index d67272f731fc..9ab8885810e7 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection/connect-pane-pty.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection/connect-pane-pty.ts
@@ -163,10 +163,9 @@ export function connectPanePty(
   // Why: paneKey crosses PTY env, hook IPC, retained rows, and reload/replay.
   // Use the stable layout leaf UUID, not the renderer-local numeric pane id.
   session.cacheKey = makePaneKey(session.deps.tabId, session.pane.leafId)
-  // Why: mirrors the kitty keyboard flags the pane's application negotiates.
-  // Fed only from application output (live PTY bytes + daemon replay
-  // payloads), never from renderer-generated resets, so it reflects what the
-  // application expects even after defensive renderer-side kitty wipes.
+  // Why: mirrors the kitty keyboard flags the pane's application negotiates,
+  // so it still reflects what a live application expects after the renderer's
+  // defensive kitty wipes; see TerminalKittyKeyboardModeTracker for its feeds.
   session.kittyKeyboardModes = (() => {
     const existing = session.deps.paneKittyKeyboardModesRef.current.get(session.pane.id)
     if (existing) {
diff --git a/src/renderer/src/components/terminal-pane/pty-connection/deferred-cold-restore-and-snapshot.ts b/src/renderer/src/components/terminal-pane/pty-connection/deferred-cold-restore-and-snapshot.ts
index 6c3a0628f797..f2a91feb98c8 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection/deferred-cold-restore-and-snapshot.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection/deferred-cold-restore-and-snapshot.ts
@@ -91,7 +91,7 @@ export function bindDeferredColdRestoreAndSnapshot(session: ConnectPanePtySessio
     if (result.status !== 'pasted' || !isStartupPasteTargetCurrent(ptyId)) {
       return false
     }
-    return session.transport.sendInput('\r')
+    return session.transport.sendInput('\r', 'launch')
   }
   session.schedulePendingStartupCommandDelivery = (): void => {
     const startup = session.pendingStartupCommand
@@ -116,7 +116,7 @@ export function bindDeferredColdRestoreAndSnapshot(session: ConnectPanePtySessio
         const command = startup.command
         const submitted = session.shouldDeliverStartupViaTerminalPaste
           ? await runTerminalPasteStartupCommand(command)
-          : session.transport.sendInput(`${command}\r`)
+          : session.transport.sendInput(`${command}\r`, 'launch')
         if (submitted) {
           session.armStartupDraftReadinessObservation()
         } else {
diff --git a/src/renderer/src/components/terminal-pane/pty-connection/deferred-session-reattach-choice.ts b/src/renderer/src/components/terminal-pane/pty-connection/deferred-session-reattach-choice.ts
index f56f3c54f6cb..6d045232a367 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection/deferred-session-reattach-choice.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection/deferred-session-reattach-choice.ts
@@ -27,7 +27,10 @@ export function runDeferredSessionReattachChoice(session: ConnectPanePtySession)
   const existingPtyId = storeSnapshot.tabsByWorktree[session.deps.worktreeId]?.find(
     (t) => t.id === session.deps.tabId
   )?.ptyId
-  const hasSleepingAgentSession = Boolean(session.getSleepingRecordForPane(storeSnapshot))
+  // Why: the host owns a mirrored tab's agent liveness and answers it at connect; a client note must not divert its start.
+  const resumesFromSleepingNote =
+    !isWebTerminalSurfaceTabId(session.deps.tabId) &&
+    Boolean(session.getSleepingRecordForPane(storeSnapshot))
 
   // Why: the tab-level fallback must not steal a PTY a setup sibling already published while the main pane waited for split geometry.
   const tabFallbackPtyId =
@@ -41,7 +44,7 @@ export function runDeferredSessionReattachChoice(session: ConnectPanePtySession)
 
   const restoredSessionId = restoredPtyId ?? null
   const sleptRemoteRuntimeSessionId =
-    restoredSessionId && isRemoteRuntimePtyId(restoredSessionId) && hasSleepingAgentSession
+    restoredSessionId && isRemoteRuntimePtyId(restoredSessionId) && resumesFromSleepingNote
       ? restoredSessionId
       : null
   const detachedLivePtyId =
@@ -53,7 +56,7 @@ export function runDeferredSessionReattachChoice(session: ConnectPanePtySession)
         : tabFallbackPtyId
       : null
   const detachedRemoteLeafPtyId =
-    restoredSessionId && isRemoteRuntimePtyId(restoredSessionId) && !hasSleepingAgentSession
+    restoredSessionId && isRemoteRuntimePtyId(restoredSessionId) && !resumesFromSleepingNote
       ? restoredSessionId
       : null
   const candidateReattachSessionId =
@@ -171,7 +174,7 @@ export function runDeferredSessionReattachChoice(session: ConnectPanePtySession)
                 `Pending PTY spawn for tab ${session.deps.tabId} resolved without a PTY id, retrying fresh spawn`
               )
             }
-            if (sleptRemoteColdRestoreStartup || hasSleepingAgentSession) {
+            if (sleptRemoteColdRestoreStartup || resumesFromSleepingNote) {
               session.startFreshColdRestoreAgentResume(sleptRemoteColdRestoreStartup ?? undefined)
             } else {
               session.startFreshSpawn()
@@ -202,7 +205,7 @@ export function runDeferredSessionReattachChoice(session: ConnectPanePtySession)
         })
     } else {
       recordPtyConnectDiagnostic(`pane=${session.pane.id} -> FRESH SPAWN`)
-      if (sleptRemoteColdRestoreStartup || hasSleepingAgentSession) {
+      if (sleptRemoteColdRestoreStartup || resumesFromSleepingNote) {
         session.startFreshColdRestoreAgentResume(sleptRemoteColdRestoreStartup ?? undefined)
       } else {
         session.startFreshSpawn()
diff --git a/src/renderer/src/components/terminal-pane/pty-connection/deferred-session-reattach-live-bookmark.test.ts b/src/renderer/src/components/terminal-pane/pty-connection/deferred-session-reattach-live-bookmark.test.ts
new file mode 100644
index 000000000000..6f2b55aec244
--- /dev/null
+++ b/src/renderer/src/components/terminal-pane/pty-connection/deferred-session-reattach-live-bookmark.test.ts
@@ -0,0 +1,205 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type { ConnectPanePtySession } from './connect-pane-pty-session'
+import { runDeferredSessionReattachChoice } from './deferred-session-reattach-choice'
+import type * as PairedParkedTerminalRestore from './paired-parked-terminal-restore'
+
+// Reproduction: a mirrored remote web-terminal pane whose host PTY is alive, with a periodic
+// origin:'live' crash-recovery bookmark, must attach to that PTY, not cold-restore a fresh agent.
+
+const TAB_ID = 'web-terminal-tab-1'
+const LEAF_ID = 'leaf-1'
+const ENV_ID = 'env-1'
+const REMOTE_PTY_ID = `remote:${ENV_ID}@@term_1`
+const WORKTREE_ID = 'repo-1::/workspaces/wt-1'
+
+const mocks = vi.hoisted(() => {
+  const state: Record<string, unknown> = {}
+  return { state, startDeferredSessionReattach: vi.fn(), canRestorePairedParked: false }
+})
+
+vi.mock('@/store', () => ({
+  useAppStore: { getState: () => mocks.state }
+}))
+vi.mock('@/runtime/sync-runtime-graph', () => ({ scheduleRuntimeGraphSync: vi.fn() }))
+vi.mock('../pty-dispatcher', () => ({ getEagerPtyBufferHandle: () => null }))
+vi.mock('./paired-parked-terminal-restore', async (importOriginal) => ({
+  ...(await importOriginal<typeof PairedParkedTerminalRestore>()),
+  canRestorePairedParkedTerminal: () => mocks.canRestorePairedParked
+}))
+vi.mock('./deferred-session-reattach-connect', () => ({
+  startDeferredSessionReattach: mocks.startDeferredSessionReattach
+}))
+
+const now = Date.UTC(2026, 8, 25)
+
+const codexLiveBookmark = {
+  worktreeId: WORKTREE_ID,
+  tabId: TAB_ID,
+  leafId: LEAF_ID,
+  agent: 'codex',
+  providerSession: { key: 'session_id', id: 'codex-conv-1' },
+  connectionId: null,
+  state: 'done',
+  origin: 'live',
+  capturedAt: now,
+  updatedAt: now,
+  launchConfig: { agentCommand: "codex '--dangerously-bypass-approvals-and-sandbox'" }
+}
+
+const claudeLiveBookmark = {
+  worktreeId: WORKTREE_ID,
+  tabId: TAB_ID,
+  leafId: LEAF_ID,
+  agent: 'claude',
+  providerSession: { key: 'session_id', id: 'claude-conv-1' },
+  connectionId: ENV_ID,
+  state: 'working',
+  origin: 'live',
+  capturedAt: now,
+  updatedAt: now
+}
+
+function setStore(sleepingRecord: Record<string, unknown> | null, tabId = TAB_ID): void {
+  const paneKey = `${tabId}:${LEAF_ID}`
+  mocks.state = {
+    tabsByWorktree: { [WORKTREE_ID]: [{ id: tabId, ptyId: REMOTE_PTY_ID }] },
+    ptyIdsByTabId: { [tabId]: [REMOTE_PTY_ID] },
+    sleepingAgentSessionsByPaneKey: sleepingRecord ? { [paneKey]: sleepingRecord } : {},
+    runtimeStatusByEnvironmentId: new Map()
+  }
+}
+
+function buildSession(
+  tabId = TAB_ID,
+  overrides: Record<string, unknown> = {}
+): ConnectPanePtySession {
+  const paneKey = `${tabId}:${LEAF_ID}`
+  let attachedPtyId: string | null = null
+  const transport = {
+    attach: vi.fn((opts: { existingPtyId: string }) => {
+      attachedPtyId = opts.existingPtyId
+    }),
+    getPtyId: () => attachedPtyId
+  }
+  const session = {
+    pane: { id: 1, leafId: LEAF_ID },
+    cacheKey: paneKey,
+    pendingSpawnKey: paneKey,
+    tabGeneration: 0,
+    transport,
+    cols: 80,
+    rows: 24,
+    disposed: false,
+    hadExistingPaneTransportAtConnect: false,
+    mountFollowsTerminalPark: false,
+    runtimeEnvironmentId: ENV_ID,
+    connectionId: null,
+    allowInitialIdleCacheSeed: true,
+    deps: {
+      tabId,
+      worktreeId: WORKTREE_ID,
+      restoredLeafId: LEAF_ID,
+      restoredPtyIdByLeafId: { [LEAF_ID]: REMOTE_PTY_ID },
+      paneTransportsRef: { current: new Map([[1, transport]]) },
+      clearTabPtyId: vi.fn()
+    },
+    // Mirrors installSleepingRecordAccess's stable-key lookup, which does not filter on origin.
+    getSleepingRecordForPane: (state: {
+      sleepingAgentSessionsByPaneKey: Record<string, unknown>
+    }) => {
+      const record = state.sleepingAgentSessionsByPaneKey[paneKey]
+      return record ? { paneKey, record } : null
+    },
+    buildColdRestoreAgentResumeStartup: vi.fn(() => ({ command: 'resume' })),
+    syncPanePtyLayoutBinding: vi.fn(),
+    clearPaneMode2031State: vi.fn(),
+    clearHiddenOutputRestoreState: vi.fn(),
+    captureTransportOutputCallbacks: vi.fn(() => ({ callbacks: {}, generation: 0 })),
+    bindActivePanePty: vi.fn(),
+    registerPaneSerializerFor: vi.fn(),
+    reportError: vi.fn(),
+    startFreshSpawn: vi.fn(),
+    startFreshColdRestoreAgentResume: vi.fn(),
+    armDirectSshPaneRetryTimeout: vi.fn(),
+    canAdoptCapturedDirectSshRetryPty: vi.fn(() => true),
+    ...overrides
+  }
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: test bag covers every member runDeferredSessionReattachChoice reads.
+  return session as unknown as ConnectPanePtySession
+}
+
+function expectAttachedToLiveRemotePty(session: ConnectPanePtySession): void {
+  expect(session.transport.attach).toHaveBeenCalledWith(
+    expect.objectContaining({ existingPtyId: REMOTE_PTY_ID })
+  )
+  expect(session.startFreshColdRestoreAgentResume).not.toHaveBeenCalled()
+  expect(session.startFreshSpawn).not.toHaveBeenCalled()
+  expect(session.deps.clearTabPtyId).not.toHaveBeenCalled()
+  expect(session.syncPanePtyLayoutBinding).not.toHaveBeenCalledWith(null)
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  mocks.canRestorePairedParked = false
+})
+
+describe('deferred reattach choice: mirrored remote pane with a live crash-recovery bookmark', () => {
+  it('attaches to the restored remote PTY when there is no sleeping note', () => {
+    setStore(null)
+    const session = buildSession()
+    runDeferredSessionReattachChoice(session)
+    expectAttachedToLiveRemotePty(session)
+    expect(mocks.startDeferredSessionReattach).not.toHaveBeenCalled()
+  })
+
+  it.each([
+    ['a done codex', codexLiveBookmark],
+    ['a working claude', claudeLiveBookmark]
+  ])('still attaches to the live remote PTY under %s live bookmark', (_label, record) => {
+    setStore(record)
+    const session = buildSession()
+    runDeferredSessionReattachChoice(session)
+    expectAttachedToLiveRemotePty(session)
+  })
+
+  // Why: the host owns a mirrored tab's liveness, so no client note may divert its start.
+  it.each(['worktree-sleep', 'quit'])(
+    'still attaches to the host PTY under a genuine %s sleep note',
+    (origin) => {
+      setStore({ ...codexLiveBookmark, origin })
+      const session = buildSession()
+      runDeferredSessionReattachChoice(session)
+      expectAttachedToLiveRemotePty(session)
+      expect(session.buildColdRestoreAgentResumeStartup).not.toHaveBeenCalled()
+    }
+  )
+
+  it('reattaches a parked-tab mount under a live note without clearing the binding', () => {
+    mocks.canRestorePairedParked = true
+    setStore(codexLiveBookmark)
+    const session = buildSession(TAB_ID, { mountFollowsTerminalPark: true })
+    runDeferredSessionReattachChoice(session)
+    expect(mocks.startDeferredSessionReattach).toHaveBeenCalledWith(session, REMOTE_PTY_ID)
+    expect(session.syncPanePtyLayoutBinding).not.toHaveBeenCalledWith(null)
+    expect(session.deps.clearTabPtyId).not.toHaveBeenCalled()
+    expect(session.startFreshColdRestoreAgentResume).not.toHaveBeenCalled()
+    expect(session.buildColdRestoreAgentResumeStartup).not.toHaveBeenCalled()
+  })
+})
+
+describe('deferred reattach choice: client-created runtime tab keeps its sleep note', () => {
+  it.each(['worktree-sleep', 'quit'])(
+    'takes the slept branch under a real %s sleep note',
+    (origin) => {
+      const tabId = 'client-tab-1'
+      setStore({ ...codexLiveBookmark, tabId, origin }, tabId)
+      const session = buildSession(tabId)
+      runDeferredSessionReattachChoice(session)
+      expect(session.transport.attach).not.toHaveBeenCalled()
+      expect(session.syncPanePtyLayoutBinding).toHaveBeenCalledWith(null)
+      expect(session.deps.clearTabPtyId).toHaveBeenCalledWith(tabId, REMOTE_PTY_ID)
+      expect(session.startFreshColdRestoreAgentResume).toHaveBeenCalledWith({ command: 'resume' })
+      expect(session.startFreshSpawn).not.toHaveBeenCalled()
+    }
+  )
+})
diff --git a/src/renderer/src/components/terminal-pane/pty-connection/disposed-spawn-retention.test.ts b/src/renderer/src/components/terminal-pane/pty-connection/disposed-spawn-retention.test.ts
new file mode 100644
index 000000000000..0aa1422e5523
--- /dev/null
+++ b/src/renderer/src/components/terminal-pane/pty-connection/disposed-spawn-retention.test.ts
@@ -0,0 +1,120 @@
+import { describe, expect, it } from 'vitest'
+import { composeWorktreeHostIdentity } from '../../../../../shared/worktree/host-qualified-identity'
+import type { TerminalLayoutSnapshot, TerminalTab } from '../../../../../shared/terminal-tab-types'
+import type { WorktreeDeleteState } from '@/store/slices/worktree-delete-state-types'
+import { shouldRetainDisposedPaneSpawn } from './disposed-spawn-retention'
+
+const WT = 'wt'
+const TAB = 'tab-a'
+const LEAF = '11111111-1111-4111-8111-111111111111'
+const OTHER_LEAF = '22222222-2222-4222-8222-222222222222'
+
+function tab(id: string): TerminalTab {
+  return {
+    id,
+    ptyId: null,
+    worktreeId: WT,
+    title: 'Terminal 1',
+    customTitle: null,
+    color: null,
+    sortOrder: 0,
+    createdAt: 0
+  }
+}
+
+function layout(leafId: string): TerminalLayoutSnapshot {
+  return { root: { type: 'leaf', leafId }, activeLeafId: leafId, expandedLeafId: null }
+}
+
+function state(overrides: {
+  tabs?: Record<string, TerminalTab[]>
+  layouts?: Record<string, TerminalLayoutSnapshot>
+  deleting?: Record<string, WorktreeDeleteState>
+}) {
+  return {
+    tabsByWorktree: overrides.tabs ?? { [WT]: [tab(TAB)] },
+    terminalLayoutsByTabId: overrides.layouts ?? {},
+    deleteStateByWorktreeId: overrides.deleting ?? {}
+  }
+}
+
+const deleting: WorktreeDeleteState = {
+  isDeleting: true,
+  error: null,
+  canForceDelete: false,
+  forceDeleteReason: null
+}
+
+describe('shouldRetainDisposedPaneSpawn', () => {
+  it('keeps the PTY for a tab that still exists and has no layout root yet', () => {
+    expect(shouldRetainDisposedPaneSpawn(state({}), WT, TAB, LEAF)).toBe(true)
+  })
+
+  it('keeps the PTY when the layout still names the leaf', () => {
+    expect(
+      shouldRetainDisposedPaneSpawn(state({ layouts: { [TAB]: layout(LEAF) } }), WT, TAB, LEAF)
+    ).toBe(true)
+  })
+
+  it('kills the PTY when the tab is gone from every worktree', () => {
+    expect(
+      shouldRetainDisposedPaneSpawn(state({ tabs: { [WT]: [tab('other-tab')] } }), WT, TAB, LEAF)
+    ).toBe(false)
+  })
+
+  it('kills the PTY when the leaf was removed from the layout', () => {
+    expect(
+      shouldRetainDisposedPaneSpawn(
+        state({ layouts: { [TAB]: layout(OTHER_LEAF) } }),
+        WT,
+        TAB,
+        LEAF
+      )
+    ).toBe(false)
+  })
+
+  it('kills the PTY when its worktree is being deleted even though the tab is still listed', () => {
+    expect(
+      shouldRetainDisposedPaneSpawn(state({ deleting: { [WT]: deleting } }), WT, TAB, LEAF)
+    ).toBe(false)
+    expect(
+      shouldRetainDisposedPaneSpawn(state({ deleting: { other: deleting } }), WT, TAB, LEAF)
+    ).toBe(true)
+  })
+
+  it.each(['local', 'ssh:target', 'runtime:paired'] as const)(
+    'retires a disposed spawn when its %s workspace is being deleted',
+    (executionHostId) => {
+      const deletingState = state({
+        deleting: { [composeWorktreeHostIdentity(executionHostId, WT)]: deleting }
+      })
+
+      expect(shouldRetainDisposedPaneSpawn(deletingState, WT, TAB, LEAF, executionHostId)).toBe(
+        false
+      )
+      expect(shouldRetainDisposedPaneSpawn(deletingState, WT, TAB, LEAF, 'ssh:other-target')).toBe(
+        true
+      )
+    }
+  )
+
+  it('keeps legacy deletion entries scoped to their recorded execution host', () => {
+    const deletingState = state({
+      deleting: { [WT]: { ...deleting, executionHostId: 'ssh:target' } }
+    })
+
+    expect(shouldRetainDisposedPaneSpawn(deletingState, WT, TAB, LEAF, 'ssh:target')).toBe(false)
+    expect(shouldRetainDisposedPaneSpawn(deletingState, WT, TAB, LEAF, 'ssh:other-target')).toBe(
+      true
+    )
+    expect(
+      shouldRetainDisposedPaneSpawn(state({ deleting: { [WT]: deleting } }), WT, TAB, LEAF, 'local')
+    ).toBe(false)
+  })
+
+  it('finds the tab under a worktree other than the one it was opened in', () => {
+    expect(
+      shouldRetainDisposedPaneSpawn(state({ tabs: { [WT]: [], other: [tab(TAB)] } }), WT, TAB, LEAF)
+    ).toBe(true)
+  })
+})
diff --git a/src/renderer/src/components/terminal-pane/pty-connection/disposed-spawn-retention.ts b/src/renderer/src/components/terminal-pane/pty-connection/disposed-spawn-retention.ts
new file mode 100644
index 000000000000..98eeec0d0dbb
--- /dev/null
+++ b/src/renderer/src/components/terminal-pane/pty-connection/disposed-spawn-retention.ts
@@ -0,0 +1,33 @@
+import type { AppState } from '@/store/types'
+import type { ExecutionHostId } from '../../../../../shared/execution-host'
+import { composeWorktreeHostIdentity } from '../../../../../shared/worktree/host-qualified-identity'
+import { collectLeafIdsInOrder } from '../terminal-layout-leaf-ids'
+
+// Main can give a remounted pane the same PTY, so disposal alone does not make it ownerless.
+export function shouldRetainDisposedPaneSpawn(
+  state: Pick<AppState, 'tabsByWorktree' | 'terminalLayoutsByTabId' | 'deleteStateByWorktreeId'>,
+  worktreeId: string,
+  tabId: string,
+  leafId: string,
+  executionHostId?: ExecutionHostId
+): boolean {
+  const deleteState =
+    (executionHostId
+      ? state.deleteStateByWorktreeId?.[composeWorktreeHostIdentity(executionHostId, worktreeId)]
+      : undefined) ?? state.deleteStateByWorktreeId?.[worktreeId]
+  if (
+    deleteState?.isDeleting &&
+    (!deleteState.executionHostId || deleteState.executionHostId === executionHostId)
+  ) {
+    return false
+  }
+  const tabPresent = Object.values(state.tabsByWorktree).some((tabs) =>
+    tabs.some((tab) => tab.id === tabId)
+  )
+  if (!tabPresent) {
+    return false
+  }
+  // A new single-pane tab has no layout root until its first pane binds.
+  const root = state.terminalLayoutsByTabId[tabId]?.root
+  return !root || collectLeafIdsInOrder(root).includes(leafId)
+}
diff --git a/src/renderer/src/components/terminal-pane/pty-connection/empty-reattach-retire-evidence.test.ts b/src/renderer/src/components/terminal-pane/pty-connection/empty-reattach-retire-evidence.test.ts
new file mode 100644
index 000000000000..086cfb820811
--- /dev/null
+++ b/src/renderer/src/components/terminal-pane/pty-connection/empty-reattach-retire-evidence.test.ts
@@ -0,0 +1,84 @@
+import { describe, expect, it } from 'vitest'
+import {
+  hasEmptyReattachRetireEvidence,
+  isHibernationDoneRecord
+} from './empty-reattach-retire-evidence'
+import type { SleepingAgentSessionRecord } from '../../../../../shared/agent-session-resume'
+import type { ColdRestoreAgentResumeStartup } from './fresh-spawn-types'
+
+function note(overrides: Partial<SleepingAgentSessionRecord> = {}): SleepingAgentSessionRecord {
+  return {
+    paneKey: 'tab-1:leaf-1',
+    worktreeId: 'wt-1',
+    agent: 'codex',
+    providerSession: { key: 'session_id', id: 'conv-1' },
+    prompt: '',
+    state: 'done',
+    capturedAt: 1,
+    updatedAt: 1,
+    ...overrides
+  }
+}
+
+function resumeStartup(
+  record: SleepingAgentSessionRecord | null,
+  useLiveEntry = false
+): ColdRestoreAgentResumeStartup {
+  return {
+    command: 'codex resume conv-1',
+    agent: 'codex',
+    resumeProviderSession: { key: 'session_id', id: 'conv-1' },
+    launchConfig: { agentArgs: '', agentEnv: {} },
+    launchToken: 'token-1',
+    useLiveEntry,
+    hasSleepingRecord: record !== null,
+    sleepingRecordEntry: record ? { paneKey: record.paneKey, record } : null
+  }
+}
+
+const WORKTREE_SLEEP_DONE = note({ origin: 'worktree-sleep' })
+
+describe('isHibernationDoneRecord', () => {
+  it.each([
+    ['a legacy originless done note', true, note()],
+    ['a worktree-sleep done note', true, WORKTREE_SLEEP_DONE],
+    ['a live done note (the idle anchor of a running pane)', false, note({ origin: 'live' })],
+    [
+      'a live done note marked not interrupted',
+      false,
+      note({ origin: 'live', interrupted: false })
+    ],
+    ['a quit done note', false, note({ origin: 'quit' })],
+    [
+      'a worktree-sleep note still working',
+      false,
+      note({ origin: 'worktree-sleep', state: 'working' })
+    ]
+  ])('%s -> %s', (_label, expected, record) => {
+    expect(isHibernationDoneRecord(record)).toBe(expected)
+  })
+})
+
+describe('hasEmptyReattachRetireEvidence', () => {
+  it.each([
+    ['a local pty', 'local-pty-1'],
+    ['a local daemon session id', 'wt-1@@daemon-session-1']
+  ])('retires %s under a hibernation done note', (_label, ptyId) => {
+    expect(hasEmptyReattachRetireEvidence(ptyId, resumeStartup(WORKTREE_SLEEP_DONE))).toBe(true)
+  })
+
+  it('never retires a remote runtime pty, whose disconnect leaves the host PTY alive', () => {
+    expect(
+      hasEmptyReattachRetireEvidence('remote:env-1@@term_1', resumeStartup(WORKTREE_SLEEP_DONE))
+    ).toBe(false)
+  })
+
+  it.each([
+    ['no resume startup', undefined],
+    ['a startup resuming the live entry', resumeStartup(WORKTREE_SLEEP_DONE, true)],
+    ['a startup without a sleeping note', resumeStartup(null)],
+    ['a live done note', resumeStartup(note({ origin: 'live' }))]
+  ])('keeps a local pty with %s', (_label, startup) => {
+    expect(hasEmptyReattachRetireEvidence('local-pty-1', startup)).toBe(false)
+  })
+})
diff --git a/src/renderer/src/components/terminal-pane/pty-connection/empty-reattach-retire-evidence.ts b/src/renderer/src/components/terminal-pane/pty-connection/empty-reattach-retire-evidence.ts
new file mode 100644
index 000000000000..eaa7638df6fe
--- /dev/null
+++ b/src/renderer/src/components/terminal-pane/pty-connection/empty-reattach-retire-evidence.ts
@@ -0,0 +1,22 @@
+import type { SleepingAgentSessionRecord } from '../../../../../shared/agent-session-resume'
+import type { ColdRestoreAgentResumeStartup } from './fresh-spawn-types'
+import { isRemoteRuntimePtyId } from './paired-parked-terminal-restore'
+
+// Why not activationTreatsNoteAsFinished: a live+done note is a finished turn's idle anchor for a running pane, not sleep.
+export function isHibernationDoneRecord(record: SleepingAgentSessionRecord): boolean {
+  return (
+    (record.origin === undefined || record.origin === 'worktree-sleep') && record.state === 'done'
+  )
+}
+
+// Why: never remote, where disconnect() only closes this viewer's stream, so the retry re-lands on the same live PTY and loops.
+export function hasEmptyReattachRetireEvidence(
+  ptyId: string,
+  coldRestoreStartup: ColdRestoreAgentResumeStartup | null | undefined
+): boolean {
+  const record =
+    coldRestoreStartup && !coldRestoreStartup.useLiveEntry
+      ? coldRestoreStartup.sleepingRecordEntry?.record
+      : undefined
+  return !isRemoteRuntimePtyId(ptyId) && record !== undefined && isHibernationDoneRecord(record)
+}
diff --git a/src/renderer/src/components/terminal-pane/pty-connection/foreground-output-refresh.ts b/src/renderer/src/components/terminal-pane/pty-connection/foreground-output-refresh.ts
index dff163f81d8c..9c1b45051bed 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection/foreground-output-refresh.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection/foreground-output-refresh.ts
@@ -151,6 +151,7 @@ export function bindForegroundOutputRefresh(session: ConnectPanePtySession): voi
       session.hiddenDeliverySyncedPtyId = null
     }
     if (
+      !ptyId ||
       !session.isHiddenDeliveryGateManagedPty(ptyId) ||
       !session.canUseHiddenOutputSnapshot(ptyId)
     ) {
diff --git a/src/renderer/src/components/terminal-pane/pty-connection/foreground-output-scan.test.ts b/src/renderer/src/components/terminal-pane/pty-connection/foreground-output-scan.test.ts
new file mode 100644
index 000000000000..7d2a280eafc6
--- /dev/null
+++ b/src/renderer/src/components/terminal-pane/pty-connection/foreground-output-scan.test.ts
@@ -0,0 +1,80 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import {
+  scanSynchronizedForegroundOutput,
+  SYNCHRONIZED_OUTPUT_START_SEQUENCE as start,
+  SYNCHRONIZED_OUTPUT_END_SEQUENCE as end
+} from './foreground-output-scan'
+
+afterEach(() => vi.restoreAllMocks())
+
+describe('foreground synchronized output scan', () => {
+  it.each([start, end])('bounds searched characters for a flood of %j markers', (marker) => {
+    const data = marker.repeat(8192)
+    const originalIndexOf = String.prototype.indexOf
+    let searchedCharacters = 0
+    const spy = vi.spyOn(String.prototype, 'indexOf').mockImplementation(function (
+      this: string,
+      search: string,
+      position = 0
+    ): number {
+      const result = originalIndexOf.call(this, search, position)
+      if (this === data && (search === start || search === end)) {
+        searchedCharacters += (result < 0 ? data.length : result + search.length) - position
+      }
+      return result
+    })
+    const result = scanSynchronizedForegroundOutput(data, '', false)
+    spy.mockRestore()
+    console.info(JSON.stringify({ markers: 8192, chars: data.length, searchedCharacters }))
+    expect(result).toEqual({
+      started: marker === start,
+      ended: marker === end,
+      active: marker === start,
+      markerTail: data.slice(-7)
+    })
+    expect(searchedCharacters).toBeLessThanOrEqual(data.length * 2)
+  })
+
+  it('preserves the last marker and records both transitions in the current chunk', () => {
+    expect(scanSynchronizedForegroundOutput(`${end}paint${start}`, '', true)).toEqual({
+      started: true,
+      ended: true,
+      active: true,
+      markerTail: start.slice(1)
+    })
+    expect(scanSynchronizedForegroundOutput(`${start}paint${end}`, '', false)).toEqual({
+      started: true,
+      ended: true,
+      active: false,
+      markerTail: end.slice(1)
+    })
+  })
+
+  it.each([start, end])('recognizes %j at every socket split', (marker) => {
+    for (let split = 1; split < marker.length; split++) {
+      const first = scanSynchronizedForegroundOutput(marker.slice(0, split), '', marker === end)
+      const second = scanSynchronizedForegroundOutput(
+        marker.slice(split),
+        first.markerTail,
+        first.active
+      )
+      expect(second).toEqual({
+        started: marker === start,
+        ended: marker === end,
+        active: marker === start,
+        markerTail: marker.slice(1)
+      })
+    }
+  })
+
+  it('leaves the latch unchanged for empty output and malformed lookalikes', () => {
+    for (const data of ['', 'ordinary output', '\x1b[?2026x'.repeat(2048)]) {
+      expect(scanSynchronizedForegroundOutput(data, '', true)).toEqual({
+        started: false,
+        ended: false,
+        active: true,
+        markerTail: data.slice(-7)
+      })
+    }
+  })
+})
diff --git a/src/renderer/src/components/terminal-pane/pty-connection/foreground-output-scan.ts b/src/renderer/src/components/terminal-pane/pty-connection/foreground-output-scan.ts
index 8d8d53eebb69..b74f44a6d09a 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection/foreground-output-scan.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection/foreground-output-scan.ts
@@ -58,27 +58,30 @@ export function scanSynchronizedForegroundOutput(
   let active = wasActive
   let started = false
   let ended = false
-  let offset = 0
+  let startIndex = scanData.indexOf(SYNCHRONIZED_OUTPUT_START_SEQUENCE)
+  let endIndex = scanData.indexOf(SYNCHRONIZED_OUTPUT_END_SEQUENCE)
 
-  while (offset < scanData.length) {
-    const startIndex = scanData.indexOf(SYNCHRONIZED_OUTPUT_START_SEQUENCE, offset)
-    const endIndex = scanData.indexOf(SYNCHRONIZED_OUTPUT_END_SEQUENCE, offset)
-    if (startIndex === -1 && endIndex === -1) {
-      break
-    }
+  // Each marker search advances independently, so a missing counterpart is scanned only once.
+  while (startIndex !== -1 || endIndex !== -1) {
     if (endIndex !== -1 && (startIndex === -1 || endIndex < startIndex)) {
       active = false
       if (endIndex + SYNCHRONIZED_OUTPUT_END_SEQUENCE.length > currentChunkStartIndex) {
         ended = true
       }
-      offset = endIndex + SYNCHRONIZED_OUTPUT_END_SEQUENCE.length
+      endIndex = scanData.indexOf(
+        SYNCHRONIZED_OUTPUT_END_SEQUENCE,
+        endIndex + SYNCHRONIZED_OUTPUT_END_SEQUENCE.length
+      )
       continue
     }
     active = true
     if (startIndex + SYNCHRONIZED_OUTPUT_START_SEQUENCE.length > currentChunkStartIndex) {
       started = true
     }
-    offset = startIndex + SYNCHRONIZED_OUTPUT_START_SEQUENCE.length
+    startIndex = scanData.indexOf(
+      SYNCHRONIZED_OUTPUT_START_SEQUENCE,
+      startIndex + SYNCHRONIZED_OUTPUT_START_SEQUENCE.length
+    )
   }
 
   return {
diff --git a/src/renderer/src/components/terminal-pane/pty-connection/pane-agent-identity.ts b/src/renderer/src/components/terminal-pane/pty-connection/pane-agent-identity.ts
index 40cd96b6a302..c2a462b313f7 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection/pane-agent-identity.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection/pane-agent-identity.ts
@@ -2,6 +2,7 @@ import { agentTypeToIconAgent } from '@/lib/agent-status'
 import { useAppStore } from '@/store'
 import { getConnectionId } from '@/lib/connection-context'
 import { replayIntoTerminal } from '../replay-guard'
+import { flushTerminalOutput } from '@/lib/pane-manager/pane-terminal-output-scheduler'
 import { POST_REPLAY_REATTACH_RESET } from '../../../../../shared/terminal-mode-reset-profiles'
 import {
   isLocalNativeWindowsConpty,
@@ -198,6 +199,10 @@ export function installPaneAgentIdentity(session: ConnectPanePtySession): void {
       // Why: a hard-killed agent leaves mouse/focus/kitty modes armed, and the
       // surviving shell then receives pointer moves as typed SGR reports; the
       // replay guard keeps xterm's auto-replies from leaking to the shell.
+      // The input mirror scans the same bytes so shortcuts stop encoding for the dead app;
+      // draining queued output first keeps both in stream order.
+      flushTerminalOutput(session.pane.terminal)
+      session.kittyKeyboardModes.scan(POST_REPLAY_REATTACH_RESET)
       replayIntoTerminal(session.pane, session.deps.replayingPanesRef, POST_REPLAY_REATTACH_RESET, {
         breadcrumbIdentity: {
           tabId: session.deps.tabId,
diff --git a/src/renderer/src/components/terminal-pane/pty-connection/pane-serializer-settle.ts b/src/renderer/src/components/terminal-pane/pty-connection/pane-serializer-settle.ts
index 9ca1202e9b1b..8015e49dd11f 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection/pane-serializer-settle.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection/pane-serializer-settle.ts
@@ -122,16 +122,22 @@ export function bindSettlePaneSerializer(session: ConnectPanePtySession): void {
     )
     // Why: xterm focus reports share this transport queue. Bypassing it can
     // race CSI I against the draft on ConPTY and expose a literal `[I` prefix.
-    void sendAgentDraftPasteContent(settings, ptyId, session.startupDraftPrompt, async (data) => {
-      const accepted = await writeTerminalPastePtyInput(session.transport, data)
-      if (accepted && !startupDraftInputRecorded) {
-        // Why: this transport write bypasses xterm's user-input signal; keep
-        // the composed draft from being discarded by later hibernation.
-        startupDraftInputRecorded = true
-        session.recordTerminalInputForHibernation()
+    void sendAgentDraftPasteContent(
+      settings,
+      ptyId,
+      session.startupDraftPrompt,
+      'launch',
+      async (data) => {
+        const accepted = await writeTerminalPastePtyInput(session.transport, data, 'launch')
+        if (accepted && !startupDraftInputRecorded) {
+          // Why: this transport write bypasses xterm's user-input signal; keep
+          // the composed draft from being discarded by later hibernation.
+          startupDraftInputRecorded = true
+          session.recordTerminalInputForHibernation()
+        }
+        return accepted
       }
-      return accepted
-    })
+    )
       .catch(() => false)
       .finally(() => {
         startupDraftPasteInFlight = false
diff --git a/src/renderer/src/components/terminal-pane/pty-connection/pty-exit-hibernate.test.ts b/src/renderer/src/components/terminal-pane/pty-connection/pty-exit-hibernate.test.ts
new file mode 100644
index 000000000000..5bd07b591418
--- /dev/null
+++ b/src/renderer/src/components/terminal-pane/pty-connection/pty-exit-hibernate.test.ts
@@ -0,0 +1,40 @@
+import { describe, expect, it } from 'vitest'
+import type { SleepingAgentSessionRecord } from '../../../../../shared/agent-session-resume'
+import { noteArmsHibernatedPaneWake } from './pty-exit-hibernate'
+
+function note(overrides: Partial<SleepingAgentSessionRecord> = {}): SleepingAgentSessionRecord {
+  return {
+    paneKey: 'tab-1:leaf-1',
+    worktreeId: 'wt-1',
+    agent: 'codex',
+    providerSession: { key: 'session_id', id: 'conv-1' },
+    prompt: '',
+    state: 'done',
+    capturedAt: 1,
+    updatedAt: 1,
+    ...overrides
+  }
+}
+
+describe('noteArmsHibernatedPaneWake', () => {
+  it.each([
+    ['a hibernation note (worktree-sleep done)', true, note({ origin: 'worktree-sleep' })],
+    ['a legacy originless done note', true, note()],
+    // Why: #16308's incidental widening, kept; pty-connection-hibernation-wake.test.ts pins its effect.
+    ['a finished turn idle anchor (live done)', true, note({ origin: 'live' })],
+    ['an interrupted live turn', false, note({ origin: 'live', interrupted: true })],
+    [
+      'a failed live turn',
+      false,
+      note({ origin: 'live', mainAgent: { state: 'done', outcome: 'failure', stateStartedAt: 1 } })
+    ],
+    ['a quit capture', false, note({ origin: 'quit' })],
+    [
+      'a manual-sleep note still working',
+      false,
+      note({ origin: 'worktree-sleep', state: 'working' })
+    ]
+  ])('%s -> %s', (_label, expected, record) => {
+    expect(noteArmsHibernatedPaneWake(record)).toBe(expected)
+  })
+})
diff --git a/src/renderer/src/components/terminal-pane/pty-connection/pty-exit-hibernate.ts b/src/renderer/src/components/terminal-pane/pty-connection/pty-exit-hibernate.ts
index cdf4b869b124..3ea62593ed30 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection/pty-exit-hibernate.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection/pty-exit-hibernate.ts
@@ -9,10 +9,9 @@ import {
 import { replayIntoTerminal } from '../replay-guard'
 import { POST_REPLAY_MODE_RESET } from '../../../../../shared/terminal-mode-reset-profiles'
 import { isProvenProcessExit } from '../../../../../shared/terminal-exit-cause'
-import {
-  getProviderSessionClaimKey,
-  isPassiveCompletedHibernationEvidence
-} from '@/lib/sleeping-agent-pane-ownership'
+import { getProviderSessionClaimKey } from '@/lib/sleeping-agent-pane-ownership'
+import type { SleepingAgentSessionRecord } from '../../../../../shared/agent-session-resume'
+import { agentTurnEndedUncleanly } from '../../../../../shared/agent-main-agent-verdict'
 import {
   createGitBashConsoleCapacityDetector,
   type GitBashConsoleCapacityDetector
@@ -22,6 +21,15 @@ import type { PtyPaneStartup } from '../pty-connection-types'
 import type { ConnectPanePtySession } from './connect-pane-pty-session'
 import { isPtyExitReplacedByRestart } from '../pty-exit-delivery'
 
+// Why live+done arms too: kept from #16308's wake-sweep widening; hibernation itself only writes worktree-sleep notes.
+export function noteArmsHibernatedPaneWake(record: SleepingAgentSessionRecord): boolean {
+  return (
+    record.state === 'done' &&
+    record.origin !== 'quit' &&
+    !(record.origin === 'live' && agentTurnEndedUncleanly(record))
+  )
+}
+
 /** PTY exit handling, hibernated-pane wake targets, and post-exit focus transfer. */
 export function installPtyExitHibernate(session: ConnectPanePtySession): void {
   type ProcessExitState = {
@@ -259,10 +267,7 @@ export function installPtyExitHibernate(session: ConnectPanePtySession): void {
       // is a wake hint or should be discarded; runtime cleanup above is enough.
       session.manager.setPaneGpuRendering(session.pane.id, true)
       const sleepingRecordEntry = session.getSleepingRecordForPane(useAppStore.getState())
-      if (
-        sleepingRecordEntry &&
-        isPassiveCompletedHibernationEvidence(sleepingRecordEntry.record)
-      ) {
+      if (sleepingRecordEntry && noteArmsHibernatedPaneWake(sleepingRecordEntry.record)) {
         // Why: hibernation killed this pane's PTY while hidden. The frozen TUI
         // frame still has mouse-tracking/bracketed-paste armed, which silently
         // eats every click and keystroke against a dead transport — disarm the
diff --git a/src/renderer/src/components/terminal-pane/pty-connection/pty-input-forward.ts b/src/renderer/src/components/terminal-pane/pty-connection/pty-input-forward.ts
index ed144ca8d6f6..cf54867b325d 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection/pty-input-forward.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection/pty-input-forward.ts
@@ -102,6 +102,8 @@ export function installPtyInputForward(session: ConnectPanePtySession): void {
       session.clearPendingTerminalInputIntent()
       return
     }
+    // Why xterm's provenance: its own focus reports reach onData too, and no person typed them.
+    const inputKind = wasUserInput ? 'driving' : 'query-reply'
     const intent = session.pendingTerminalInputIntent
     // Why: real xterm can deliver the terminal byte even when our DOM keydown
     // listener missed the press. Exact Ctrl+C/Escape bytes are still safe to
@@ -125,7 +127,7 @@ export function installPtyInputForward(session: ConnectPanePtySession): void {
       }
       session.clearPendingTerminalInputIntent()
       const writePromise = session.transport
-        .sendInputAccepted(data)
+        .sendInputAccepted(data, inputKind)
         .then((accepted): boolean | Promise<boolean> | null => {
           if (accepted) {
             // Why: rejected writes use transport recovery and must not arm a parser probe.
@@ -154,7 +156,7 @@ export function installPtyInputForward(session: ConnectPanePtySession): void {
     }
     if (intent) {
       session.claimViewportForUserActivity()
-      if (session.transport.sendInput(data)) {
+      if (session.transport.sendInput(data, inputKind)) {
         session.markAcceptedTerminalInputSent()
         session.observeAcceptedShellCommandInput(data)
         session.observeAcceptedTerminalInput(data, intent)
@@ -165,7 +167,7 @@ export function installPtyInputForward(session: ConnectPanePtySession): void {
       return
     }
     session.claimViewportForUserActivity()
-    if (session.transport.sendInput(data)) {
+    if (session.transport.sendInput(data, inputKind)) {
       session.markAcceptedTerminalInputSent()
       session.observeAcceptedShellCommandInput(data)
       session.observeAcceptedTerminalInput(data)
@@ -207,14 +209,9 @@ export function installPtyInputForward(session: ConnectPanePtySession): void {
     )
   }
 
-  session.isRendererPtyResizeAuthoritative = (): boolean => {
-    if (session.deps.isVisibleRef.current) {
-      return true
-    }
-    // Why: hidden-tab layout churn is not authoritative; visible resume
-    // owns correction, and hidden SIGWINCH can reset full-screen TUIs.
-    return false
-  }
+  // Why: hidden-tab layout churn is not authoritative; visible resume
+  // owns correction, and hidden SIGWINCH can reset full-screen TUIs.
+  session.isRendererPtyResizeAuthoritative = (): boolean => session.deps.isVisibleRef.current
 
   session.forwardPtyResize = (cols: number, rows: number): void => {
     if (!session.isRendererPtyResizeAuthoritative()) {
diff --git a/src/renderer/src/components/terminal-pane/pty-connection/pty-input-recovery.ts b/src/renderer/src/components/terminal-pane/pty-connection/pty-input-recovery.ts
index cec1da623695..4533a02cd21d 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection/pty-input-recovery.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection/pty-input-recovery.ts
@@ -21,6 +21,7 @@ import {
 
 import { isRemoteRuntimePtyId } from './paired-parked-terminal-restore'
 import { TRANSPORT_CONNECT_SETTLE_GRACE_MS } from './pty-connect-limits'
+import { shouldRetainDisposedPaneSpawn } from './disposed-spawn-retention'
 
 import type { ConnectPanePtySession } from './connect-pane-pty-session'
 import { resolveTerminalInlineImagesEnabled } from '../../../../../shared/terminal-inline-images-settings'
@@ -112,6 +113,14 @@ export function installPtyInputRecovery(session: ConnectPanePtySession): void {
     onPtyExit: session.onExit,
     onPtySpawn: session.onPtySpawn,
     onPtyRebind: session.onPtyRebind,
+    retainDisposedSpawn: () =>
+      shouldRetainDisposedPaneSpawn(
+        useAppStore.getState(),
+        session.deps.worktreeId,
+        session.deps.tabId,
+        session.pane.leafId,
+        session.executionHostId
+      ),
     ...(session.mainSideEffectAuthority
       ? {}
       : {
diff --git a/src/renderer/src/components/terminal-pane/pty-connection/reattach-result-handler-park-reveal-verdict.test.ts b/src/renderer/src/components/terminal-pane/pty-connection/reattach-result-handler-park-reveal-verdict.test.ts
index 86237ac8f214..addf17ba8e86 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection/reattach-result-handler-park-reveal-verdict.test.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection/reattach-result-handler-park-reveal-verdict.test.ts
@@ -4,6 +4,7 @@ import { bindSerializeHiddenOutputSnapshot } from './hidden-output-snapshot-seri
 import type { ConnectPanePtySession } from './connect-pane-pty-session'
 import type { HiddenOutputSnapshotResult } from './hidden-output-snapshot-serialize'
 import type { ReattachPayloadContext } from './reattach-payload-context'
+import type { ColdRestoreAgentResumeStartup } from './fresh-spawn-types'
 
 /**
  * A park-reveal of a remote-runtime pty arrives with `replay: ''`, so the host
@@ -333,3 +334,64 @@ describe('handleReattachResult park-reveal snapshot verdict', () => {
     expect(bag.retryUnverifiableParkRevealSnapshot).toHaveBeenCalledOnce()
   })
 })
+
+// Retiring an empty reattach converges only locally: a remote disconnect() closes this viewer's
+// stream, so the resume would re-land on the same live host PTY and loop.
+describe('handleReattachResult empty reattach under a hibernation note', () => {
+  const record = {
+    paneKey: 'tab-1:leaf-1',
+    worktreeId: 'wt-1',
+    agent: 'codex',
+    providerSession: { key: 'session_id', id: 'conv-1' },
+    prompt: '',
+    state: 'done',
+    origin: 'worktree-sleep',
+    capturedAt: 1,
+    updatedAt: 1
+  } as const
+  const startup: ColdRestoreAgentResumeStartup = {
+    command: 'codex resume conv-1',
+    agent: 'codex',
+    resumeProviderSession: record.providerSession,
+    launchConfig: { agentArgs: '', agentEnv: {} },
+    launchToken: 'token-1',
+    useLiveEntry: false,
+    hasSleepingRecord: true,
+    sleepingRecordEntry: { paneKey: record.paneKey, record }
+  }
+
+  // The wake-hint row passes a non-remote stale id: only the result's remote id may decide.
+  it.each([
+    ['a fresh-spawn adoption', false, null],
+    ['a paired-parked reveal', true, REMOTE_PTY_ID],
+    ['a host wake-hint reattach', false, 'term_1']
+  ])('keeps the live remote PTY on %s', async (_label, mountFollowsTerminalPark, staleId) => {
+    const bag = buildParkRevealSession({
+      mountFollowsTerminalPark,
+      serializeHiddenOutputSnapshot: probeAnswers({ kind: 'snapshot', snapshot: HOST_IMAGE })
+    })
+
+    await expect(
+      bag.session.handleReattachResult(PARK_REVEAL_RESULT, staleId, startup)
+    ).resolves.toBe(true)
+
+    expect(bag.transport.disconnect).not.toHaveBeenCalled()
+    expect(bag.session.startFreshColdRestoreAgentResume).not.toHaveBeenCalled()
+    expect(bag.session.setPanePtyFitBinding).toHaveBeenCalledWith(REMOTE_PTY_ID)
+  })
+
+  it('retires an empty local fresh-spawn adoption and resumes the provider session', async () => {
+    const bag = buildParkRevealSession({ mountFollowsTerminalPark: false })
+
+    await expect(
+      bag.session.handleReattachResult({ id: 'local-pty-1', isReattach: true }, null, startup)
+    ).resolves.toBe(false)
+
+    expect(bag.transport.disconnect).toHaveBeenCalledOnce()
+    expect(bag.session.syncPanePtyLayoutBinding).toHaveBeenCalledWith(null)
+    expect(bag.session.startFreshColdRestoreAgentResume).toHaveBeenCalledExactlyOnceWith(startup, {
+      forceBlankRestoredViewport: true
+    })
+    expect(bag.session.setPanePtyFitBinding).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/renderer/src/components/terminal-pane/pty-connection/reattach-result-handler.ts b/src/renderer/src/components/terminal-pane/pty-connection/reattach-result-handler.ts
index 25e5445a417a..f141b6719529 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection/reattach-result-handler.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection/reattach-result-handler.ts
@@ -5,12 +5,12 @@ import { warnTerminalLifecycleAnomaly } from '../terminal-lifecycle-diagnostics'
 // actually attached — nothing is inspectable while the session hydrates.
 import { notifyCodexPaneBoundForStaleSweep } from '@/lib/codex-stale-pane-sweep'
 import { useAppStore } from '@/store'
-import { isPassiveCompletedHibernationEvidence } from '@/lib/sleeping-agent-pane-ownership'
 import { parseAppSshPtyId } from '../../../../../shared/ssh-pty-id'
 import { resolveHiddenRestoreScrollbackRows } from '../terminal-hidden-restore-scrollback'
 import { shouldIgnoreStalePanePtyLayoutBinding } from './pane-pty-layout-binding'
 
 import { isRemoteRuntimePtyId } from './paired-parked-terminal-restore'
+import { hasEmptyReattachRetireEvidence } from './empty-reattach-retire-evidence'
 import type { ColdRestoreAgentResumeStartup } from './fresh-spawn-types'
 
 import type { ConnectPanePtySession } from './connect-pane-pty-session'
@@ -187,14 +187,12 @@ export function bindHandleReattachResult(sessionBag: ConnectPanePtySession): voi
     const hasStructuralReplay = Boolean(
       connectResult?.snapshot || connectResult?.replay || connectResult?.coldRestore
     )
-    const resumeComesFromPassiveHibernation = Boolean(
-      coldRestoreStartup &&
-      !coldRestoreStartup.useLiveEntry &&
-      coldRestoreStartup.sleepingRecordEntry &&
-      isPassiveCompletedHibernationEvidence(coldRestoreStartup.sleepingRecordEntry.record)
-    )
-    // Why: reattach drops startup commands; only passive hibernation is authority to retire an empty adopted shell and resume its provider session.
-    if (!hasStructuralReplay && connectResult?.isReattach && resumeComesFromPassiveHibernation) {
+    // Why: reattach drops startup commands; only real hibernation is authority to retire an empty adopted shell and resume its provider session.
+    if (
+      !hasStructuralReplay &&
+      connectResult?.isReattach &&
+      hasEmptyReattachRetireEvidence(ptyId, coldRestoreStartup)
+    ) {
       session.transport.disconnect()
       if (staleSessionId) {
         session.clearExitedPanePtyLayoutBinding(staleSessionId)
diff --git a/src/renderer/src/components/terminal-pane/pty-connection/replay-data-drain.ts b/src/renderer/src/components/terminal-pane/pty-connection/replay-data-drain.ts
index 81ac85ed752d..bd3d7284ac9a 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection/replay-data-drain.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection/replay-data-drain.ts
@@ -63,7 +63,7 @@ export function bindReplayDataDrain(session: ConnectPanePtySession): void {
       if (!session.shouldSendFocusedAgentReattachFocusIn() || !sendFocusMode) {
         return
       }
-      session.transport.sendInput(TERMINAL_FOCUS_IN_SEQUENCE)
+      session.transport.sendInput(TERMINAL_FOCUS_IN_SEQUENCE, 'query-reply')
     })
   }
 
diff --git a/src/renderer/src/components/terminal-pane/pty-connection/session-reconcile-dispose.ts b/src/renderer/src/components/terminal-pane/pty-connection/session-reconcile-dispose.ts
index c458061749d6..575f916d92e0 100644
--- a/src/renderer/src/components/terminal-pane/pty-connection/session-reconcile-dispose.ts
+++ b/src/renderer/src/components/terminal-pane/pty-connection/session-reconcile-dispose.ts
@@ -9,10 +9,7 @@ import { cancelPendingSafeFitContinuations } from '@/lib/pane-manager/pane-tree-
 import { PANE_PTY_RESIZE_HOLD_FLUSH_EVENT } from '@/lib/pane-manager/pane-pty-resize-hold'
 import { discardTerminalOutput } from '@/lib/pane-manager/pane-terminal-output-scheduler'
 import { clearPendingAgentResumeChoicesForOwner } from '@/lib/pending-agent-resume-choices'
-import {
-  getProviderSessionClaimKey,
-  isPassiveCompletedHibernationEvidence
-} from '@/lib/sleeping-agent-pane-ownership'
+import { getProviderSessionClaimKey } from '@/lib/sleeping-agent-pane-ownership'
 import { releaseRendererPtyVisibilityClaim } from '../pty-renderer-delivery-claims'
 
 import { REMOTE_PTY_ID_PREFIX } from './pty-connect-limits'
@@ -20,6 +17,7 @@ import { SHIFT_ENTER_RECONFIRM_IDLE_MS } from './foreground-output-scan'
 import type { PanePtyBinding } from './pane-pty-binding'
 
 import type { ConnectPanePtySession } from './connect-pane-pty-session'
+import { noteArmsHibernatedPaneWake } from './pty-exit-hibernate'
 
 export function installSessionReconcileDispose(session: ConnectPanePtySession): PanePtyBinding {
   session.reconcileIfSessionDead = (
@@ -139,7 +137,7 @@ export function installSessionReconcileDispose(session: ConnectPanePtySession):
       const currentPtyId = session.transport.getPtyId()
       if (
         recordEntry &&
-        isPassiveCompletedHibernationEvidence(recordEntry.record) &&
+        noteArmsHibernatedPaneWake(recordEntry.record) &&
         currentPtyId !== null &&
         state.suppressedPtyExitIds[currentPtyId] === true &&
         !session.disposed &&
diff --git a/src/renderer/src/components/terminal-pane/pty-input-write-queue-contract.ts b/src/renderer/src/components/terminal-pane/pty-input-write-queue-contract.ts
index 6ac6068f0685..b3a2236fe1c2 100644
--- a/src/renderer/src/components/terminal-pane/pty-input-write-queue-contract.ts
+++ b/src/renderer/src/components/terminal-pane/pty-input-write-queue-contract.ts
@@ -1,3 +1,5 @@
+import type { TerminalInputKind } from '../../../../shared/terminal-input-kind'
+
 export const TERMINAL_INPUT_COALESCE_MAX_CODE_UNITS = 4096
 export const PTY_INPUT_WRITE_QUEUE_MAX_PENDING_REPLIES = 64
 export const PTY_INPUT_WRITE_QUEUE_MAX_PENDING_REPLY_CODE_UNITS =
@@ -8,6 +10,7 @@ export type PendingPtyInputWrite = {
   id: string
   text: string
   replyOnly: boolean
+  inputKind: TerminalInputKind
   resolveAccepted: ((accepted: boolean) => void) | undefined
   tooLarge: boolean | Promise<boolean>
   chunks?: Iterator<string>
@@ -15,17 +18,17 @@ export type PendingPtyInputWrite = {
 }
 
 export type PtyInputWriteQueue = {
-  enqueue: (id: string, data: string) => boolean
+  enqueue: (id: string, data: string, inputKind: TerminalInputKind) => boolean
   enqueueQueryReply: (id: string, data: string) => boolean
-  enqueueAccepted: (id: string, data: string) => Promise<boolean>
+  enqueueAccepted: (id: string, data: string, inputKind: TerminalInputKind) => Promise<boolean>
   waitForDrain: () => Promise<void>
   clear: () => void
 }
 
 export type PtyInputWriteQueueDeps = {
   isWritable: (id: string) => boolean
-  write: (id: string, data: string) => void
-  writeAccepted?: (id: string, data: string) => Promise<boolean>
+  write: (id: string, data: string, inputKind: TerminalInputKind) => void
+  writeAccepted?: (id: string, data: string, inputKind: TerminalInputKind) => Promise<boolean>
   yieldBetweenWrites?: () => Promise<void>
   onDrainFailure?: (id: string) => void
 }
diff --git a/src/renderer/src/components/terminal-pane/pty-input-write-queue.test.ts b/src/renderer/src/components/terminal-pane/pty-input-write-queue.test.ts
index 556ba19f8a63..9b3099d0326e 100644
--- a/src/renderer/src/components/terminal-pane/pty-input-write-queue.test.ts
+++ b/src/renderer/src/components/terminal-pane/pty-input-write-queue.test.ts
@@ -81,7 +81,7 @@ describe('pty input write queue', () => {
     // Simulates a 2s aggressive trackpad gesture at 120Hz: 240 SGR reports
     // enqueued while the drain cannot run between events.
     for (let i = 0; i < 240; i += 1) {
-      expect(queue.enqueue('pty-1', WHEEL_UP_REPORT)).toBe(true)
+      expect(queue.enqueue('pty-1', WHEEL_UP_REPORT, 'driving')).toBe(true)
     }
     await queue.waitForDrain()
 
@@ -98,7 +98,7 @@ describe('pty input write queue', () => {
 
     const inputs = ['a', '\x1b[<65;1;1M', 'bc', '\x1b[A', 'd']
     for (const input of inputs) {
-      queue.enqueue('pty-1', input)
+      queue.enqueue('pty-1', input, 'driving')
     }
     await queue.waitForDrain()
 
@@ -112,10 +112,10 @@ describe('pty input write queue', () => {
       write: (id, data) => writes.push({ id, data })
     })
 
-    queue.enqueue('pty-1', 'a')
-    queue.enqueue('pty-1', 'b')
-    queue.enqueue('pty-2', 'c')
-    queue.enqueue('pty-1', 'd')
+    queue.enqueue('pty-1', 'a', 'driving')
+    queue.enqueue('pty-1', 'b', 'driving')
+    queue.enqueue('pty-2', 'c', 'driving')
+    queue.enqueue('pty-1', 'd', 'driving')
     await queue.waitForDrain()
 
     expect(writes).toEqual([
@@ -131,7 +131,7 @@ describe('pty input write queue', () => {
 
     const piece = 'x'.repeat(1000)
     for (let i = 0; i < 12; i += 1) {
-      queue.enqueue('pty-1', piece)
+      queue.enqueue('pty-1', piece, 'driving')
     }
     await queue.waitForDrain()
 
@@ -146,9 +146,9 @@ describe('pty input write queue', () => {
     const { writes, queue } = createRecordingQueue()
 
     const large = 'y'.repeat(TERMINAL_INPUT_CHUNK_MAX_BYTES * 2 + 100)
-    queue.enqueue('pty-1', 'before')
-    queue.enqueue('pty-1', large)
-    queue.enqueue('pty-1', 'after')
+    queue.enqueue('pty-1', 'before', 'driving')
+    queue.enqueue('pty-1', large, 'driving')
+    queue.enqueue('pty-1', 'after', 'driving')
     await queue.waitForDrain()
 
     expect(writes.map((write) => write.data).join('')).toBe(`before${large}after`)
@@ -161,7 +161,7 @@ describe('pty input write queue', () => {
   it('rejects input over the terminal input byte limit without writing', async () => {
     const { writes, queue } = createRecordingQueue()
 
-    expect(queue.enqueue('pty-1', 'z'.repeat(TERMINAL_INPUT_MAX_BYTES + 1))).toBe(false)
+    expect(queue.enqueue('pty-1', 'z'.repeat(TERMINAL_INPUT_MAX_BYTES + 1), 'driving')).toBe(false)
     await queue.waitForDrain()
 
     expect(writes).toEqual([])
@@ -171,9 +171,9 @@ describe('pty input write queue', () => {
     let writable = true
     const { writes, queue } = createRecordingQueue({ writable: () => writable })
 
-    queue.enqueue('pty-1', 'a')
+    queue.enqueue('pty-1', 'a', 'driving')
     writable = false
-    queue.enqueue('pty-1', 'b')
+    queue.enqueue('pty-1', 'b', 'driving')
     await queue.waitForDrain()
 
     expect(writes).toEqual([{ id: 'pty-1', data: 'a' }])
@@ -210,7 +210,7 @@ describe('pty input write queue', () => {
     const reply = mode2031SequenceFor('dark')
 
     queue.enqueueQueryReply('pty-1', reply)
-    queue.enqueue('pty-1', 'y')
+    queue.enqueue('pty-1', 'y', 'driving')
     await queue.waitForDrain()
 
     expect(writes).toEqual([
@@ -231,7 +231,7 @@ describe('pty input write queue', () => {
       allAccepted = queue.enqueueQueryReply('pty-1', reply) && allAccepted
     }
     expect(allAccepted).toBe(true)
-    expect(queue.enqueue('pty-1', 'k')).toBe(true)
+    expect(queue.enqueue('pty-1', 'k', 'driving')).toBe(true)
 
     await Promise.resolve()
     expect(pendingYields).toHaveLength(1)
@@ -256,7 +256,7 @@ describe('pty input write queue', () => {
     for (const reply of replies) {
       expect(queue.enqueueQueryReply('pty-1', reply)).toBe(true)
     }
-    expect(queue.enqueue('pty-1', 'k')).toBe(true)
+    expect(queue.enqueue('pty-1', 'k', 'driving')).toBe(true)
 
     await Promise.resolve()
     for (let turn = 0; turn < PTY_INPUT_WRITE_QUEUE_MAX_PENDING_REPLIES; turn += 1) {
@@ -286,10 +286,10 @@ describe('pty input write queue', () => {
     expect(second.length * 3).toBeGreaterThan(PTY_INPUT_WRITE_QUEUE_MAX_PENDING_REPLY_CODE_UNITS)
     queue.enqueueQueryReply('pty-1', first)
     queue.enqueueQueryReply('pty-1', dropped)
-    queue.enqueue('pty-1', 'x')
+    queue.enqueue('pty-1', 'x', 'driving')
     queue.enqueueQueryReply('pty-1', second)
     queue.enqueueQueryReply('pty-1', third)
-    queue.enqueue('pty-1', 'k')
+    queue.enqueue('pty-1', 'k', 'driving')
 
     await Promise.resolve()
     expect(pendingYields).toHaveLength(1)
@@ -365,7 +365,7 @@ describe('pty input write queue', () => {
     const replies = Array.from({ length: 10_000 }, (_, index) => `\x1b[?${index};1n`)
 
     for (const input of ordinary) {
-      expect(queue.enqueue('pty-1', input)).toBe(true)
+      expect(queue.enqueue('pty-1', input, 'driving')).toBe(true)
     }
     for (const reply of replies) {
       expect(queue.enqueueQueryReply('pty-1', reply)).toBe(true)
@@ -386,7 +386,7 @@ describe('pty input write queue', () => {
     const replies = Array.from({ length: 10_000 }, (_, index) => `\x1b[?${index};1n`)
 
     expect(queue.enqueueQueryReply('pty-1', '\x1b[?10000;1n')).toBe(true)
-    expect(queue.enqueue('pty-1', ordinary)).toBe(true)
+    expect(queue.enqueue('pty-1', ordinary, 'driving')).toBe(true)
     for (const reply of replies) {
       expect(queue.enqueueQueryReply('pty-1', reply)).toBe(true)
     }
@@ -413,14 +413,14 @@ describe('pty input write queue', () => {
     })
 
     try {
-      expect(queue.enqueue('pty-1', 'stale')).toBe(true)
-      expect(queue.enqueue('pty-1', 'also-stale')).toBe(false)
+      expect(queue.enqueue('pty-1', 'stale', 'driving')).toBe(true)
+      expect(queue.enqueue('pty-1', 'also-stale', 'driving')).toBe(false)
       await expect(queue.waitForDrain()).resolves.toBeUndefined()
 
       shouldThrow = false
-      expect(queue.enqueue('pty-1', 'still-stale')).toBe(false)
+      expect(queue.enqueue('pty-1', 'still-stale', 'driving')).toBe(false)
       queue.clear()
-      expect(queue.enqueue('pty-1', 'fresh')).toBe(true)
+      expect(queue.enqueue('pty-1', 'fresh', 'driving')).toBe(true)
       await queue.waitForDrain()
 
       expect(writes).toEqual([{ id: 'pty-1', data: 'fresh' }])
@@ -443,9 +443,9 @@ describe('pty input write queue', () => {
       }
     })
 
-    expect(queue.enqueue('pty-1', 'first')).toBe(true)
-    const accepted = queue.enqueueAccepted('pty-1', 'second')
-    expect(queue.enqueue('pty-1', 'third')).toBe(true)
+    expect(queue.enqueue('pty-1', 'first', 'driving')).toBe(true)
+    const accepted = queue.enqueueAccepted('pty-1', 'second', 'driving')
+    expect(queue.enqueue('pty-1', 'third', 'driving')).toBe(true)
     expect(queue.enqueueQueryReply('pty-1', 'fourth')).toBe(true)
     await flushAsyncTicks()
 
@@ -475,13 +475,13 @@ describe('pty input write queue', () => {
         delivered.push(`accepted:${data}`)
         if (!reentered) {
           reentered = true
-          queue.enqueue('pty-1', 'later')
+          queue.enqueue('pty-1', 'later', 'driving')
         }
         return acceptedWrite.promise
       }
     })
 
-    const accepted = queue.enqueueAccepted('pty-1', 'first')
+    const accepted = queue.enqueueAccepted('pty-1', 'first', 'driving')
     await flushAsyncTicks()
 
     expect(delivered).toEqual(['accepted:first'])
@@ -503,12 +503,12 @@ describe('pty input write queue', () => {
       writeAccepted: (_id, data) => {
         delivered.push(`accepted:${data}`)
         queue.clear()
-        queue.enqueue('pty-1', 'fresh')
+        queue.enqueue('pty-1', 'fresh', 'driving')
         return acceptedWrite.promise
       }
     })
 
-    const accepted = queue.enqueueAccepted('pty-1', 'stale')
+    const accepted = queue.enqueueAccepted('pty-1', 'stale', 'driving')
 
     await expect(accepted).resolves.toBe(false)
     await queue.waitForDrain()
@@ -533,12 +533,12 @@ describe('pty input write queue', () => {
         return acceptedWrite.promise
       }
     })
-    const active = queue.enqueueAccepted('pty-1', 'stale-active')
-    const pending = queue.enqueueAccepted('pty-1', 'stale-pending')
+    const active = queue.enqueueAccepted('pty-1', 'stale-active', 'driving')
+    const pending = queue.enqueueAccepted('pty-1', 'stale-pending', 'driving')
     await acceptedStarted.promise
 
     queue.clear()
-    expect(queue.enqueue('pty-1', 'fresh')).toBe(true)
+    expect(queue.enqueue('pty-1', 'fresh', 'driving')).toBe(true)
 
     await expect(active).resolves.toBe(false)
     await expect(pending).resolves.toBe(false)
@@ -567,7 +567,9 @@ describe('pty input write queue', () => {
     })
 
     try {
-      expect(queue.enqueue('pty-1', 'x'.repeat(TERMINAL_INPUT_CHUNK_MAX_BYTES * 2))).toBe(true)
+      expect(
+        queue.enqueue('pty-1', 'x'.repeat(TERMINAL_INPUT_CHUNK_MAX_BYTES * 2), 'driving')
+      ).toBe(true)
       expect(rejectYield).toBeDefined()
       rejectYield?.(failure)
       await queue.waitForDrain()
@@ -607,11 +609,13 @@ describe('pty input write queue', () => {
     })
 
     try {
-      expect(queue.enqueue('pty-1', 'x'.repeat(TERMINAL_INPUT_CHUNK_MAX_BYTES * 2))).toBe(true)
+      expect(
+        queue.enqueue('pty-1', 'x'.repeat(TERMINAL_INPUT_CHUNK_MAX_BYTES * 2), 'driving')
+      ).toBe(true)
       expect(rejectYield).toBeDefined()
       queue.clear()
       rejectNextYield = false
-      expect(queue.enqueue('pty-2', 'fresh')).toBe(true)
+      expect(queue.enqueue('pty-2', 'fresh', 'driving')).toBe(true)
       rejectYield?.(failure)
       await queue.waitForDrain()
 
@@ -697,8 +701,8 @@ describe('pty input write queue', () => {
     })
 
     const large = 'y'.repeat(TERMINAL_INPUT_CHUNK_MAX_BYTES * 3)
-    queue.enqueue('pty-1', large)
-    queue.enqueue('pty-1', 'tail')
+    queue.enqueue('pty-1', large, 'driving')
+    queue.enqueue('pty-1', 'tail', 'driving')
     // First chunk is written synchronously, then the drain parks on the yield.
     expect(writes.length).toBe(1)
 
@@ -716,9 +720,9 @@ describe('pty input write queue', () => {
     const stale = 'é'.repeat(CLIPBOARD_TEXT_MEASURE_YIELD_CODE_UNITS + 1)
 
     try {
-      expect(queue.enqueue('pty-1', stale)).toBe(true)
+      expect(queue.enqueue('pty-1', stale, 'driving')).toBe(true)
       queue.clear()
-      expect(queue.enqueue('pty-1', 'fresh')).toBe(true)
+      expect(queue.enqueue('pty-1', 'fresh', 'driving')).toBe(true)
 
       await vi.runAllTimersAsync()
       await queue.waitForDrain()
@@ -755,7 +759,7 @@ describe('pty input write queue', () => {
     globalThis.gc?.()
     const heapBefore = process.memoryUsage().heapUsed
     for (let index = 0; index < 20_000; index += 1) {
-      await queue.enqueueAccepted('pty-1', 'x')
+      await queue.enqueueAccepted('pty-1', 'x', 'driving')
     }
     await queue.waitForDrain()
     globalThis.gc?.()
diff --git a/src/renderer/src/components/terminal-pane/pty-input-write-queue.ts b/src/renderer/src/components/terminal-pane/pty-input-write-queue.ts
index 31b37ed6af51..7f646354b275 100644
--- a/src/renderer/src/components/terminal-pane/pty-input-write-queue.ts
+++ b/src/renderer/src/components/terminal-pane/pty-input-write-queue.ts
@@ -12,6 +12,7 @@ import {
   type PtyInputWriteQueue,
   type PtyInputWriteQueueDeps
 } from './pty-input-write-queue-contract'
+import type { TerminalInputKind } from '../../../../shared/terminal-input-kind'
 import {
   createHeadQueue,
   peekHeadQueue,
@@ -111,7 +112,7 @@ export function createPtyInputWriteQueue(deps: PtyInputWriteQueueDeps): PtyInput
   // Why: one cancel per in-flight write rather than `.then()` on a queue-lifetime
   // promise — those reactions are retained until that promise settles, so a
   // long-lived pane accumulated one record per acknowledged write (Esc, Ctrl+C).
-  async function writeAcceptedChunk(id: string, data: string): Promise<boolean> {
+  async function writeAcceptedChunk(item: PendingPtyInputWrite, data: string): Promise<boolean> {
     let cancel = (): void => undefined
     const cancelled = new Promise<boolean>((resolve) => {
       cancel = () => resolve(false)
@@ -122,7 +123,9 @@ export function createPtyInputWriteQueue(deps: PtyInputWriteQueueDeps): PtyInput
     try {
       return await Promise.race([
         cancelled,
-        Promise.resolve(deps.writeAccepted?.(id, data) ?? false).catch(() => false)
+        Promise.resolve(deps.writeAccepted?.(item.id, data, item.inputKind) ?? false).catch(
+          () => false
+        )
       ])
     } finally {
       pendingAcceptedCancels.delete(cancel)
@@ -173,6 +176,7 @@ export function createPtyInputWriteQueue(deps: PtyInputWriteQueueDeps): PtyInput
               peek.tooLarge !== false ||
               peek.chunks !== undefined ||
               !isCoalesciblePtyInput(peek) ||
+              peek.inputKind !== next.inputKind ||
               payload.length + peek.text.length > TERMINAL_INPUT_COALESCE_MAX_CODE_UNITS
             ) {
               break
@@ -180,7 +184,7 @@ export function createPtyInputWriteQueue(deps: PtyInputWriteQueueDeps): PtyInput
             payload += peek.text
             removePending(peek)
           }
-          deps.write(next.id, payload)
+          deps.write(next.id, payload, next.inputKind)
           if (firstPending()) {
             await yieldBetweenWrites()
           }
@@ -196,8 +200,8 @@ export function createPtyInputWriteQueue(deps: PtyInputWriteQueueDeps): PtyInput
         }
         const writeGeneration = generation
         const accepted = next.resolveAccepted
-          ? await writeAcceptedChunk(next.id, chunk.value)
-          : (deps.write(next.id, chunk.value), true)
+          ? await writeAcceptedChunk(next, chunk.value)
+          : (deps.write(next.id, chunk.value, next.inputKind), true)
         if (generation !== writeGeneration || firstPending() !== next) {
           continue
         }
@@ -249,8 +253,9 @@ export function createPtyInputWriteQueue(deps: PtyInputWriteQueueDeps): PtyInput
 
   function enqueueInput(
     id: string,
-    data: string,
+    text: string,
     queryReply: boolean,
+    inputKind: TerminalInputKind,
     resolveAccepted?: PendingPtyInputWrite['resolveAccepted']
   ): boolean {
     try {
@@ -260,20 +265,28 @@ export function createPtyInputWriteQueue(deps: PtyInputWriteQueueDeps): PtyInput
       }
       // Every query reply stays atomic so host-side ordering can classify it (#13892).
       const replyOnly = queryReply
-      if (replyOnly && !admitReply(data)) {
+      if (replyOnly && !admitReply(text)) {
         return false
       }
-      const tooLarge = replyOnly ? false : isTerminalInputTooLargeWithDeferredMeasurement(data)
+      const tooLarge = replyOnly ? false : isTerminalInputTooLargeWithDeferredMeasurement(text)
       if (tooLarge === true) {
         resolveAccepted?.(false)
         return false
       }
-      const item = { sequence: nextSequence, id, text: data, replyOnly, tooLarge, resolveAccepted }
+      const item = {
+        sequence: nextSequence,
+        id,
+        text,
+        replyOnly,
+        inputKind,
+        tooLarge,
+        resolveAccepted
+      }
       nextSequence += 1
       if (replyOnly) {
         pendingReplies.items.push(item)
         pendingReplyCount += 1
-        pendingReplyCodeUnits += data.length
+        pendingReplyCodeUnits += text.length
       } else {
         pendingOrdinary.items.push(item)
       }
@@ -286,17 +299,17 @@ export function createPtyInputWriteQueue(deps: PtyInputWriteQueueDeps): PtyInput
   }
 
   return {
-    enqueue(id: string, data: string): boolean {
-      return enqueueInput(id, data, false)
+    enqueue(id: string, data: string, inputKind: TerminalInputKind): boolean {
+      return enqueueInput(id, data, false, inputKind)
     },
 
     enqueueQueryReply(id: string, data: string): boolean {
-      return enqueueInput(id, data, true)
+      return enqueueInput(id, data, true, 'query-reply')
     },
 
-    enqueueAccepted: (id, data) =>
+    enqueueAccepted: (id, data, inputKind) =>
       new Promise((resolve) => {
-        enqueueInput(id, data, false, resolve)
+        enqueueInput(id, data, false, inputKind, resolve)
       }),
 
     async waitForDrain(): Promise<void> {
diff --git a/src/renderer/src/components/terminal-pane/pty-preconnect-input-buffer.test.ts b/src/renderer/src/components/terminal-pane/pty-preconnect-input-buffer.test.ts
index d36c3a274ed3..2595863cb3d4 100644
--- a/src/renderer/src/components/terminal-pane/pty-preconnect-input-buffer.test.ts
+++ b/src/renderer/src/components/terminal-pane/pty-preconnect-input-buffer.test.ts
@@ -11,9 +11,9 @@ describe('createPtyPreconnectInputBuffer', () => {
     const acceptedWrite = createDeferred<boolean>()
     const buffer = createPtyPreconnectInputBuffer()
     const delivered: string[] = []
-    const accepted = buffer.enqueueAccepted('first')
-    expect(buffer.enqueue('second', 'ordinary')).toBe(true)
-    expect(buffer.enqueue('third', 'immediate')).toBe(true)
+    const accepted = buffer.enqueueAccepted('first', 'driving')
+    expect(buffer.enqueue('second', 'ordinary', 'driving')).toBe(true)
+    expect(buffer.enqueue('third', 'immediate', 'driving')).toBe(true)
     const writer = {
       isCurrent: () => true,
       sendInput: (data: string) => {
@@ -52,9 +52,9 @@ describe('createPtyPreconnectInputBuffer', () => {
       const writeStarted = createDeferred<void>()
       const buffer = createPtyPreconnectInputBuffer()
       const sendInput = vi.fn(() => true)
-      const accepted = buffer.enqueueAccepted('first')
-      const laterAccepted = buffer.enqueueAccepted('third')
-      expect(buffer.enqueue('second', 'ordinary')).toBe(true)
+      const accepted = buffer.enqueueAccepted('first', 'driving')
+      const laterAccepted = buffer.enqueueAccepted('third', 'driving')
+      expect(buffer.enqueue('second', 'ordinary', 'driving')).toBe(true)
       const flushing = buffer.flush({
         isCurrent: () => true,
         sendInput,
@@ -72,7 +72,7 @@ describe('createPtyPreconnectInputBuffer', () => {
       await expect(laterAccepted).resolves.toBe(false)
       await expect(flushing).resolves.toBeUndefined()
       expect(sendInput).not.toHaveBeenCalled()
-      expect(buffer.enqueue('after-clear', 'ordinary')).toBe(false)
+      expect(buffer.enqueue('after-clear', 'ordinary', 'driving')).toBe(false)
 
       if (lateOutcome === 'resolve') {
         acceptedWrite.resolve(true)
@@ -91,7 +91,8 @@ describe('createPtyPreconnectInputBuffer', () => {
     const codeUnitWriteStarted = createDeferred<void>()
     const codeUnitBuffer = createPtyPreconnectInputBuffer()
     const codeUnitAccepted = codeUnitBuffer.enqueueAccepted(
-      'x'.repeat(PTY_PRECONNECT_INPUT_MAX_CODE_UNITS)
+      'x'.repeat(PTY_PRECONNECT_INPUT_MAX_CODE_UNITS),
+      'driving'
     )
     const codeUnitFlush = codeUnitBuffer.flush({
       isCurrent: () => true,
@@ -104,7 +105,7 @@ describe('createPtyPreconnectInputBuffer', () => {
     })
     await codeUnitWriteStarted.promise
 
-    expect(codeUnitBuffer.enqueue('overflow', 'ordinary')).toBe(false)
+    expect(codeUnitBuffer.enqueue('overflow', 'ordinary', 'driving')).toBe(false)
 
     codeUnitBuffer.clear()
     codeUnitWrite.resolve(true)
@@ -114,9 +115,9 @@ describe('createPtyPreconnectInputBuffer', () => {
     const entryWrite = createDeferred<boolean>()
     const entryWriteStarted = createDeferred<void>()
     const entryBuffer = createPtyPreconnectInputBuffer()
-    const entryAccepted = entryBuffer.enqueueAccepted('first')
+    const entryAccepted = entryBuffer.enqueueAccepted('first', 'driving')
     for (let index = 1; index < PTY_PRECONNECT_INPUT_MAX_ENTRIES; index += 1) {
-      expect(entryBuffer.enqueue('', 'ordinary')).toBe(true)
+      expect(entryBuffer.enqueue('', 'ordinary', 'driving')).toBe(true)
     }
     const entryFlush = entryBuffer.flush({
       isCurrent: () => true,
@@ -129,7 +130,7 @@ describe('createPtyPreconnectInputBuffer', () => {
     })
     await entryWriteStarted.promise
 
-    expect(entryBuffer.enqueue('', 'ordinary')).toBe(false)
+    expect(entryBuffer.enqueue('', 'ordinary', 'driving')).toBe(false)
 
     entryBuffer.clear()
     entryWrite.resolve(true)
@@ -141,12 +142,13 @@ describe('createPtyPreconnectInputBuffer', () => {
     const entryBuffer = createPtyPreconnectInputBuffer(
       Array.from({ length: PTY_PRECONNECT_INPUT_MAX_ENTRIES + 1 }, () => ({
         data: '',
-        kind: 'ordinary' as const
+        kind: 'ordinary' as const,
+        inputKind: 'driving' as const
       }))
     )
     let entryWrites = 0
 
-    expect(entryBuffer.enqueue('', 'ordinary')).toBe(false)
+    expect(entryBuffer.enqueue('', 'ordinary', 'driving')).toBe(false)
     await entryBuffer.flush({
       isCurrent: () => true,
       sendInput: () => {
@@ -158,12 +160,16 @@ describe('createPtyPreconnectInputBuffer', () => {
     expect(entryWrites).toBe(PTY_PRECONNECT_INPUT_MAX_ENTRIES)
 
     const codeUnitBuffer = createPtyPreconnectInputBuffer([
-      { data: 'x'.repeat(PTY_PRECONNECT_INPUT_MAX_CODE_UNITS), kind: 'ordinary' },
-      { data: 'overflow', kind: 'ordinary' }
+      {
+        data: 'x'.repeat(PTY_PRECONNECT_INPUT_MAX_CODE_UNITS),
+        kind: 'ordinary',
+        inputKind: 'driving'
+      },
+      { data: 'overflow', kind: 'ordinary', inputKind: 'driving' }
     ])
     const codeUnitWrites: number[] = []
 
-    expect(codeUnitBuffer.enqueue('new', 'ordinary')).toBe(false)
+    expect(codeUnitBuffer.enqueue('new', 'ordinary', 'driving')).toBe(false)
     await codeUnitBuffer.flush({
       isCurrent: () => true,
       sendInput: (data) => {
@@ -179,7 +185,7 @@ describe('createPtyPreconnectInputBuffer', () => {
     // Regression: an abandoned deferred spawn never reaches connect(), so nothing
     // drained the buffer and a paste awaiting sendInputAccepted hung forever.
     const buffer = createPtyPreconnectInputBuffer()
-    const pastePending = buffer.enqueueAccepted('pasted text')
+    const pastePending = buffer.enqueueAccepted('pasted text', 'driving')
     let settled = false
     void pastePending.then(() => {
       settled = true
diff --git a/src/renderer/src/components/terminal-pane/pty-preconnect-input-buffer.ts b/src/renderer/src/components/terminal-pane/pty-preconnect-input-buffer.ts
index 3dce1962bb96..cb8dec2d6d0f 100644
--- a/src/renderer/src/components/terminal-pane/pty-preconnect-input-buffer.ts
+++ b/src/renderer/src/components/terminal-pane/pty-preconnect-input-buffer.ts
@@ -1,4 +1,5 @@
 import { CLIPBOARD_TEXT_MEASURE_YIELD_CODE_UNITS } from '../../../../shared/clipboard-text'
+import type { TerminalInputKind } from '../../../../shared/terminal-input-kind'
 
 export const PTY_PRECONNECT_INPUT_MAX_ENTRIES = 1024
 // Why: a retention budget, not the 16MB single-write ceiling. The deferral lasts
@@ -12,6 +13,7 @@ export type PtyPreconnectInputKind = 'ordinary' | 'immediate' | 'accepted'
 export type PtyPreconnectInputEntry = {
   data: string
   kind: PtyPreconnectInputKind
+  inputKind: TerminalInputKind
 }
 
 type BufferedInput = PtyPreconnectInputEntry & {
@@ -20,9 +22,9 @@ type BufferedInput = PtyPreconnectInputEntry & {
 
 type PreconnectInputWriter = {
   isCurrent: () => boolean
-  sendInput: (data: string) => boolean
+  sendInput: (data: string, inputKind: TerminalInputKind) => boolean
   sendInputImmediate: (data: string) => boolean
-  sendInputAccepted?: (data: string) => Promise<boolean>
+  sendInputAccepted?: (data: string, inputKind: TerminalInputKind) => Promise<boolean>
 }
 
 export type PtyPreconnectInputBuffer = {
@@ -30,10 +32,12 @@ export type PtyPreconnectInputBuffer = {
   enqueue: (
     data: string,
     kind: 'ordinary' | 'immediate',
+    inputKind: TerminalInputKind,
     onRetained?: (entry: PtyPreconnectInputEntry) => void
   ) => boolean
   enqueueAccepted: (
     data: string,
+    inputKind: TerminalInputKind,
     onRetained?: (entry: PtyPreconnectInputEntry) => void
   ) => Promise<boolean>
   flush: (writer: PreconnectInputWriter) => Promise<void>
@@ -70,14 +74,15 @@ export function createPtyPreconnectInputBuffer(
   const createInput = (
     data: string,
     kind: PtyPreconnectInputKind,
+    inputKind: TerminalInputKind,
     resolve?: BufferedInput['resolve']
-  ): BufferedInput => ({ data, kind, ...(resolve ? { resolve } : {}) })
+  ): BufferedInput => ({ data, kind, inputKind, ...(resolve ? { resolve } : {}) })
   const notifyRetained = (
     onRetained: ((entry: PtyPreconnectInputEntry) => void) | undefined,
     input: BufferedInput
   ): void => {
     try {
-      onRetained?.({ data: input.data, kind: input.kind })
+      onRetained?.({ data: input.data, kind: input.kind, inputKind: input.inputKind })
     } catch {
       // Handoff capture is advisory; a callback failure must not reject input admission.
     }
@@ -86,7 +91,7 @@ export function createPtyPreconnectInputBuffer(
   // Seeded entries came from a predecessor transport and must not be reported
   // back to that predecessor's handoff owner as newly typed input.
   for (const entry of initialEntries) {
-    retain(createInput(entry.data, entry.kind))
+    retain(createInput(entry.data, entry.kind, entry.inputKind))
   }
   const clear = (): void => {
     const dropped = pending
@@ -124,8 +129,8 @@ export function createPtyPreconnectInputBuffer(
             accepted = await Promise.race([
               Promise.resolve(
                 writer.sendInputAccepted
-                  ? writer.sendInputAccepted(input.data)
-                  : writer.sendInput(input.data)
+                  ? writer.sendInputAccepted(input.data, input.inputKind)
+                  : writer.sendInput(input.data, input.inputKind)
               ),
               flushStopped.then(() => null)
             ])
@@ -152,7 +157,7 @@ export function createPtyPreconnectInputBuffer(
         const accepted =
           input.kind === 'immediate'
             ? writer.sendInputImmediate(input.data)
-            : writer.sendInput(input.data)
+            : writer.sendInput(input.data, input.inputKind)
         if (!accepted) {
           clear()
           return
@@ -186,17 +191,17 @@ export function createPtyPreconnectInputBuffer(
 
   return {
     isBuffering: () => buffering,
-    enqueue(data, kind, onRetained) {
-      const input = createInput(data, kind)
+    enqueue(data, kind, inputKind, onRetained) {
+      const input = createInput(data, kind, inputKind)
       const retained = retain(input)
       if (retained) {
         notifyRetained(onRetained, input)
       }
       return retained
     },
-    enqueueAccepted(data, onRetained) {
+    enqueueAccepted(data, inputKind, onRetained) {
       return new Promise<boolean>((resolve) => {
-        const input = createInput(data, 'accepted', resolve)
+        const input = createInput(data, 'accepted', inputKind, resolve)
         if (!retain(input)) {
           resolve(false)
           return
diff --git a/src/renderer/src/components/terminal-pane/pty-transport-connect-spawn.test.ts b/src/renderer/src/components/terminal-pane/pty-transport-connect-spawn.test.ts
index 129c920f976b..ed9c029d14cf 100644
--- a/src/renderer/src/components/terminal-pane/pty-transport-connect-spawn.test.ts
+++ b/src/renderer/src/components/terminal-pane/pty-transport-connect-spawn.test.ts
@@ -68,6 +68,22 @@ describe('createIpcPtyTransport', () => {
     expect(spawn).not.toHaveBeenCalled()
   })
 
+  it('keeps the recovery hint and raw diagnostic from a wrapped spawn error', async () => {
+    const { createIpcPtyTransport } = await import('./pty-transport')
+    vi.mocked(window.api.pty.spawn).mockRejectedValueOnce(
+      new Error(
+        "Error invoking remote method 'pty:spawn': Error: Close unused terminals, then try again.\nnode-pty: open_slave failed: EMFILE (errno 24)"
+      )
+    )
+    const onError = vi.fn()
+
+    await createIpcPtyTransport({}).connect({ url: '', callbacks: { onError } })
+
+    expect(onError).toHaveBeenCalledWith(
+      'Close unused terminals, then try again.\nnode-pty: open_slave failed: EMFILE (errno 24)'
+    )
+  })
+
   it('threads provider command ownership through the spawn IPC', async () => {
     const { createIpcPtyTransport } = await import('./pty-transport')
     const transport = createIpcPtyTransport({
diff --git a/src/renderer/src/components/terminal-pane/pty-transport-detach-attach-handoff.test.ts b/src/renderer/src/components/terminal-pane/pty-transport-detach-attach-handoff.test.ts
index 7cac93840529..3d1cec9ea771 100644
--- a/src/renderer/src/components/terminal-pane/pty-transport-detach-attach-handoff.test.ts
+++ b/src/renderer/src/components/terminal-pane/pty-transport-detach-attach-handoff.test.ts
@@ -169,6 +169,46 @@ describe('createIpcPtyTransport', () => {
     expect(transport.getPtyId()).toBeNull()
   })
 
+  // A pane remounted mid-spawn is handed the same PTY by main's pane-spawn reservation, so a kill
+  // from the disposed transport lands on the successor's shell. The surface owner decides.
+  it('keeps a fresh spawn that resolves after destroy when the pane surface still owns it', async () => {
+    const { createIpcPtyTransport } = await import('./pty-transport')
+    const kill = vi.mocked(window.api.pty.kill)
+    let resolveSpawn: (result: { id: string }) => void = () => {}
+    vi.mocked(window.api.pty.spawn).mockImplementation(
+      () =>
+        new Promise((resolve) => {
+          resolveSpawn = resolve
+        })
+    )
+    const transport = createIpcPtyTransport({ retainDisposedSpawn: () => true })
+    const pending = transport.connect({ url: '', callbacks: {} })
+    await transport.destroy?.()
+    resolveSpawn({ id: 'pty-shared-with-successor' })
+
+    await expect(pending).resolves.toBeUndefined()
+    expect(kill).not.toHaveBeenCalled()
+  })
+
+  it('still kills a fresh spawn that resolves after destroy when nothing owns the surface', async () => {
+    const { createIpcPtyTransport } = await import('./pty-transport')
+    const kill = vi.mocked(window.api.pty.kill)
+    let resolveSpawn: (result: { id: string }) => void = () => {}
+    vi.mocked(window.api.pty.spawn).mockImplementation(
+      () =>
+        new Promise((resolve) => {
+          resolveSpawn = resolve
+        })
+    )
+    const transport = createIpcPtyTransport({ retainDisposedSpawn: () => false })
+    const pending = transport.connect({ url: '', callbacks: {} })
+    await transport.destroy?.()
+    resolveSpawn({ id: 'pty-orphaned' })
+
+    await expect(pending).resolves.toBeUndefined()
+    expect(kill).toHaveBeenCalledWith('pty-orphaned')
+  })
+
   it('drops the exit observer when abandoning an obsolete reattach without killing it', async () => {
     const { createIpcPtyTransport } = await import('./pty-transport')
     const onPtyExit = vi.fn()
diff --git a/src/renderer/src/components/terminal-pane/pty-transport-input-write.test.ts b/src/renderer/src/components/terminal-pane/pty-transport-input-write.test.ts
index 1060d617dd21..df2c11e08d43 100644
--- a/src/renderer/src/components/terminal-pane/pty-transport-input-write.test.ts
+++ b/src/renderer/src/components/terminal-pane/pty-transport-input-write.test.ts
@@ -65,8 +65,8 @@ describe('createIpcPtyTransport', () => {
       const transport = createIpcPtyTransport({})
       await transport.connect({ url: '', callbacks: { onWriteUnavailable: recovery } })
 
-      expect(transport.sendInput('input')).toBe(true)
-      expect(transport.sendInput('later-input')).toBe(false)
+      expect(transport.sendInput('input', 'driving')).toBe(true)
+      expect(transport.sendInput('later-input', 'driving')).toBe(false)
 
       expect(recovery).toHaveBeenCalledOnce()
       expect(warn).toHaveBeenCalledWith('[pty-input-write-queue] drain failed:', failure)
@@ -80,8 +80,8 @@ describe('createIpcPtyTransport', () => {
     const localTransport = createIpcPtyTransport({})
 
     await localTransport.connect({ url: '', callbacks: {} })
-    await expect(localTransport.sendInputAccepted?.('\x03')).resolves.toBe(true)
-    expect(window.api.pty.writeAccepted).toHaveBeenCalledWith('pty-1', '\x03')
+    await expect(localTransport.sendInputAccepted?.('\x03', 'driving')).resolves.toBe(true)
+    expect(window.api.pty.writeAccepted).toHaveBeenCalledWith('pty-1', '\x03', 'driving')
 
     const sshTransport = createIpcPtyTransport({ connectionId: 'ssh-1' })
     await sshTransport.connect({ url: '', callbacks: {} })
@@ -103,8 +103,8 @@ describe('createIpcPtyTransport', () => {
     const transport = createIpcPtyTransport({ bufferInputUntilConnect: true })
 
     const connecting = transport.connect({ url: '', callbacks: {} })
-    expect(transport.sendInput('first-')).toBe(true)
-    const accepted = transport.sendInputAccepted?.('second-')
+    expect(transport.sendInput('first-', 'driving')).toBe(true)
+    const accepted = transport.sendInputAccepted?.('second-', 'driving')
     expect(transport.sendInputImmediate('third')).toBe(true)
     expect(window.api.pty.write).not.toHaveBeenCalled()
     expect(window.api.pty.writeAccepted).not.toHaveBeenCalled()
@@ -133,21 +133,21 @@ describe('createIpcPtyTransport', () => {
     const transport = createIpcPtyTransport({
       bufferInputUntilConnect: true,
       preconnectInput: [
-        { data: 'before-remount-', kind: 'ordinary' },
-        { data: '\x1b[0n', kind: 'immediate' },
-        { data: '\x03', kind: 'accepted' }
+        { data: 'before-remount-', kind: 'ordinary', inputKind: 'driving' },
+        { data: '\x1b[0n', kind: 'immediate', inputKind: 'query-reply' },
+        { data: '\x03', kind: 'accepted', inputKind: 'driving' }
       ],
       onPreconnectInput
     })
 
     const connecting = transport.connect({ url: '', callbacks: {} })
-    expect(transport.sendInput('new-ordinary-')).toBe(true)
+    expect(transport.sendInput('new-ordinary-', 'driving')).toBe(true)
     expect(transport.sendInputImmediate('new-immediate-')).toBe(true)
-    const accepted = transport.sendInputAccepted?.('new-accepted')
+    const accepted = transport.sendInputAccepted?.('new-accepted', 'driving')
     expect(onPreconnectInput.mock.calls).toEqual([
-      [{ data: 'new-ordinary-', kind: 'ordinary' }],
-      [{ data: 'new-immediate-', kind: 'immediate' }],
-      [{ data: 'new-accepted', kind: 'accepted' }]
+      [{ data: 'new-ordinary-', kind: 'ordinary', inputKind: 'driving' }],
+      [{ data: 'new-immediate-', kind: 'immediate', inputKind: 'query-reply' }],
+      [{ data: 'new-accepted', kind: 'accepted', inputKind: 'driving' }]
     ])
 
     spawn.resolve({ id: 'pty-1' })
@@ -180,8 +180,8 @@ describe('createIpcPtyTransport', () => {
       onPreconnectInput: (input) => captured.push(input)
     })
 
-    const predecessorAccepted = predecessor.sendInputAccepted?.('\x03')
-    expect(captured).toEqual([{ data: '\x03', kind: 'accepted' }])
+    const predecessorAccepted = predecessor.sendInputAccepted?.('\x03', 'driving')
+    expect(captured).toEqual([{ data: '\x03', kind: 'accepted', inputKind: 'driving' }])
 
     const successor = createIpcPtyTransport({ preconnectInput: captured })
     const connecting = successor.connect({ url: '', callbacks: {} })
@@ -205,17 +205,17 @@ describe('createIpcPtyTransport', () => {
       onPreconnectInput
     })
 
-    expect(transport.sendInput('ordinary')).toBe(true)
+    expect(transport.sendInput('ordinary', 'driving')).toBe(true)
     expect(transport.sendInputImmediate('immediate')).toBe(true)
-    const accepted = transport.sendInputAccepted?.('accepted')
+    const accepted = transport.sendInputAccepted?.('accepted', 'driving')
     expect(onPreconnectInput).toHaveBeenCalledTimes(3)
 
     await transport.connect({ url: '', callbacks: {} })
 
     await expect(accepted).resolves.toBe(true)
-    expect(window.api.pty.write).toHaveBeenCalledWith('pty-1', 'ordinary')
-    expect(window.api.pty.write).toHaveBeenCalledWith('pty-1', 'immediate')
-    expect(window.api.pty.writeAccepted).toHaveBeenCalledWith('pty-1', 'accepted')
+    expect(window.api.pty.write).toHaveBeenCalledWith('pty-1', 'ordinary', 'driving')
+    expect(window.api.pty.write).toHaveBeenCalledWith('pty-1', 'immediate', 'query-reply')
+    expect(window.api.pty.writeAccepted).toHaveBeenCalledWith('pty-1', 'accepted', 'driving')
   })
 
   it('keeps live acknowledged input ahead of later ordinary and immediate writes', async () => {
@@ -235,9 +235,9 @@ describe('createIpcPtyTransport', () => {
       const transport = createIpcPtyTransport({})
       await transport.connect({ url: '', callbacks: {} })
 
-      expect(transport.sendInput('first')).toBe(true)
-      const accepted = transport.sendInputAccepted?.('second')
-      expect(transport.sendInput('third')).toBe(true)
+      expect(transport.sendInput('first', 'driving')).toBe(true)
+      const accepted = transport.sendInputAccepted?.('second', 'driving')
+      expect(transport.sendInput('third', 'driving')).toBe(true)
       expect(transport.sendInputImmediate('fourth')).toBe(true)
       await flushAsyncTicks()
 
@@ -275,11 +275,11 @@ describe('createIpcPtyTransport', () => {
       const slowInput = 'é'.repeat(CLIPBOARD_TEXT_MEASURE_YIELD_CODE_UNITS + 1)
 
       const connecting = transport.connect({ url: '', callbacks: {} })
-      expect(transport.sendInput(slowInput)).toBe(true)
+      expect(transport.sendInput(slowInput, 'driving')).toBe(true)
       await connecting
 
-      const accepted = transport.sendInputAccepted?.('accepted')
-      expect(transport.sendInput('later')).toBe(true)
+      const accepted = transport.sendInputAccepted?.('accepted', 'driving')
+      expect(transport.sendInput('later', 'driving')).toBe(true)
       expect(transport.sendInputImmediate('reply')).toBe(true)
       expect(delivered).toEqual([])
 
@@ -318,14 +318,14 @@ describe('createIpcPtyTransport', () => {
     const { createIpcPtyTransport } = await import('./pty-transport')
     const transport = createIpcPtyTransport({ bufferInputUntilConnect: true })
 
-    expect(transport.sendInput('ordinary')).toBe(true)
-    const accepted = transport.sendInputAccepted?.('accepted')
+    expect(transport.sendInput('ordinary', 'driving')).toBe(true)
+    const accepted = transport.sendInputAccepted?.('accepted', 'driving')
     await transport.destroy?.()
 
     await expect(accepted).resolves.toBe(false)
-    expect(transport.sendInput('after-destroy')).toBe(false)
+    expect(transport.sendInput('after-destroy', 'driving')).toBe(false)
     expect(transport.sendInputImmediate('after-destroy')).toBe(false)
-    await expect(transport.sendInputAccepted?.('after-destroy')).resolves.toBe(false)
+    await expect(transport.sendInputAccepted?.('after-destroy', 'driving')).resolves.toBe(false)
     expect(window.api.pty.write).not.toHaveBeenCalled()
     expect(window.api.pty.writeAccepted).not.toHaveBeenCalled()
   })
@@ -341,11 +341,11 @@ describe('createIpcPtyTransport', () => {
       const transport = createIpcPtyTransport({ bufferInputUntilConnect: true })
 
       const connecting = transport.connect({ url: '', callbacks: {} })
-      const accepted = transport.sendInputAccepted?.('first')
-      expect(transport.sendInput('later')).toBe(true)
+      const accepted = transport.sendInputAccepted?.('first', 'driving')
+      expect(transport.sendInput('later', 'driving')).toBe(true)
       spawn.resolve({ id: 'pty-1' })
       await flushAsyncTicks()
-      expect(window.api.pty.writeAccepted).toHaveBeenCalledWith('pty-1', 'first')
+      expect(window.api.pty.writeAccepted).toHaveBeenCalledWith('pty-1', 'first', 'driving')
 
       if (teardown === 'disconnect') {
         transport.disconnect()
@@ -358,7 +358,7 @@ describe('createIpcPtyTransport', () => {
       await expect(accepted).resolves.toBe(false)
       await expect(connecting).resolves.toBe('pty-1')
       expect(window.api.pty.write).not.toHaveBeenCalled()
-      expect(transport.sendInput('after-teardown')).toBe(false)
+      expect(transport.sendInput('after-teardown', 'driving')).toBe(false)
 
       acceptedWrite.resolve(true)
       await flushAsyncTicks()
@@ -377,10 +377,10 @@ describe('createIpcPtyTransport', () => {
       const transport = createIpcPtyTransport({})
       await transport.connect({ url: '', callbacks: {} })
 
-      const accepted = transport.sendInputAccepted?.('first')
-      expect(transport.sendInput('later')).toBe(true)
+      const accepted = transport.sendInputAccepted?.('first', 'driving')
+      expect(transport.sendInput('later', 'driving')).toBe(true)
       await flushAsyncTicks()
-      expect(window.api.pty.writeAccepted).toHaveBeenCalledWith('pty-1', 'first')
+      expect(window.api.pty.writeAccepted).toHaveBeenCalledWith('pty-1', 'first', 'driving')
 
       if (teardown === 'disconnect') {
         transport.disconnect()
@@ -392,7 +392,7 @@ describe('createIpcPtyTransport', () => {
 
       await expect(accepted).resolves.toBe(false)
       expect(window.api.pty.write).not.toHaveBeenCalled()
-      expect(transport.sendInput('after-teardown')).toBe(false)
+      expect(transport.sendInput('after-teardown', 'driving')).toBe(false)
 
       acceptedWrite.resolve(true)
       await flushAsyncTicks()
@@ -412,7 +412,7 @@ describe('createIpcPtyTransport', () => {
       const onConnect = vi.fn()
 
       const connecting = transport.connect({ url: '', callbacks: { onConnect } })
-      const accepted = transport.sendInputAccepted?.('pending')
+      const accepted = transport.sendInputAccepted?.('pending', 'driving')
       if (teardown === 'disconnect') {
         transport.disconnect()
       } else {
@@ -551,18 +551,18 @@ describe('createIpcPtyTransport', () => {
       const chunk = 'x'.repeat(TERMINAL_INPUT_CHUNK_MAX_BYTES)
       await transport.connect({ url: '', callbacks: {} })
 
-      expect(transport.sendInput(`${chunk}${chunk}`)).toBe(true)
-      expect(window.api.pty.write).toHaveBeenCalledExactlyOnceWith('pty-1', chunk)
+      expect(transport.sendInput(`${chunk}${chunk}`, 'driving')).toBe(true)
+      expect(window.api.pty.write).toHaveBeenCalledExactlyOnceWith('pty-1', chunk, 'driving')
 
       onExit?.({ id: 'pty-1', code: 0 })
       transport.attach({ existingPtyId: 'pty-1', callbacks: {} })
-      expect(transport.sendInput('fresh')).toBe(true)
+      expect(transport.sendInput('fresh', 'driving')).toBe(true)
 
       await vi.runAllTimersAsync()
 
       expect(vi.mocked(window.api.pty.write).mock.calls).toEqual([
-        ['pty-1', chunk],
-        ['pty-1', 'fresh']
+        ['pty-1', chunk, 'driving'],
+        ['pty-1', 'fresh', 'driving']
       ])
     } finally {
       vi.useRealTimers()
@@ -577,22 +577,22 @@ describe('createIpcPtyTransport', () => {
     const chunk = 'x'.repeat(TERMINAL_INPUT_CHUNK_MAX_BYTES)
     await transport.connect({ url: '', callbacks: {} })
 
-    const accepted = transport.sendInputAccepted?.(`${chunk}stale-tail`)
+    const accepted = transport.sendInputAccepted?.(`${chunk}stale-tail`, 'driving')
     await flushAsyncTicks()
-    expect(window.api.pty.writeAccepted).toHaveBeenCalledExactlyOnceWith('pty-1', chunk)
+    expect(window.api.pty.writeAccepted).toHaveBeenCalledExactlyOnceWith('pty-1', chunk, 'driving')
 
     onExit?.({ id: 'pty-1', code: 0 })
     transport.attach({ existingPtyId: 'pty-1', callbacks: {} })
-    expect(transport.sendInput('fresh')).toBe(true)
+    expect(transport.sendInput('fresh', 'driving')).toBe(true)
 
     await expect(accepted).resolves.toBe(false)
     await flushAsyncTicks()
-    expect(window.api.pty.write).toHaveBeenCalledExactlyOnceWith('pty-1', 'fresh')
+    expect(window.api.pty.write).toHaveBeenCalledExactlyOnceWith('pty-1', 'fresh', 'driving')
 
     acceptedWrite.resolve(true)
     await flushAsyncTicks()
 
-    expect(window.api.pty.writeAccepted).toHaveBeenCalledExactlyOnceWith('pty-1', chunk)
+    expect(window.api.pty.writeAccepted).toHaveBeenCalledExactlyOnceWith('pty-1', chunk, 'driving')
     await expect(accepted).resolves.toBe(false)
   })
 
@@ -601,13 +601,13 @@ describe('createIpcPtyTransport', () => {
     const transport = createIpcPtyTransport({ bufferInputUntilConnect: true })
 
     expect(transport.sendInputImmediate('immediate')).toBe(true)
-    const accepted = transport.sendInputAccepted?.('accepted')
+    const accepted = transport.sendInputAccepted?.('accepted', 'driving')
     transport.disconnect()
 
     await expect(accepted).resolves.toBe(false)
-    expect(transport.sendInput('after-disconnect')).toBe(false)
+    expect(transport.sendInput('after-disconnect', 'driving')).toBe(false)
     expect(transport.sendInputImmediate('after-disconnect')).toBe(false)
-    await expect(transport.sendInputAccepted?.('after-disconnect')).resolves.toBe(false)
+    await expect(transport.sendInputAccepted?.('after-disconnect', 'driving')).resolves.toBe(false)
     expect(window.api.pty.write).not.toHaveBeenCalled()
     expect(window.api.pty.writeAccepted).not.toHaveBeenCalled()
   })
@@ -619,13 +619,13 @@ describe('createIpcPtyTransport', () => {
     bufferPreHandlerPtyExit(ptyId, 0)
     const { createIpcPtyTransport } = await import('./pty-transport')
     const transport = createIpcPtyTransport({ bufferInputUntilConnect: true })
-    const accepted = transport.sendInputAccepted?.('input')
+    const accepted = transport.sendInputAccepted?.('input', 'driving')
 
     transport.attach({ existingPtyId: ptyId, callbacks: {} })
 
     await expect(accepted).resolves.toBe(false)
     expect(transport.isConnected()).toBe(false)
-    expect(transport.sendInput('after-exit')).toBe(false)
+    expect(transport.sendInput('after-exit', 'driving')).toBe(false)
     clearPreHandlerPtyState(ptyId)
   })
 
@@ -635,7 +635,7 @@ describe('createIpcPtyTransport', () => {
     })
     const { createIpcPtyTransport } = await import('./pty-transport')
     const transport = createIpcPtyTransport({ bufferInputUntilConnect: true })
-    const accepted = transport.sendInputAccepted?.('input')
+    const accepted = transport.sendInputAccepted?.('input', 'driving')
 
     expect(() => transport.attach({ existingPtyId: 'pty-attach-failure', callbacks: {} })).toThrow(
       'dispatcher attach failed'
@@ -643,7 +643,7 @@ describe('createIpcPtyTransport', () => {
 
     await expect(accepted).resolves.toBe(false)
     expect(transport.isConnected()).toBe(false)
-    expect(transport.sendInput('after-failure')).toBe(false)
+    expect(transport.sendInput('after-failure', 'driving')).toBe(false)
   })
 
   it('settles and drops preconnect input when the split spawn fails', async () => {
@@ -652,14 +652,14 @@ describe('createIpcPtyTransport', () => {
     const transport = createIpcPtyTransport({ bufferInputUntilConnect: true })
     const onError = vi.fn()
 
-    expect(transport.sendInput('ordinary')).toBe(true)
-    const accepted = transport.sendInputAccepted?.('accepted')
+    expect(transport.sendInput('ordinary', 'driving')).toBe(true)
+    const accepted = transport.sendInputAccepted?.('accepted', 'driving')
     await transport.connect({ url: '', callbacks: { onError } })
 
     await expect(accepted).resolves.toBe(false)
-    expect(transport.sendInput('after-failure')).toBe(false)
+    expect(transport.sendInput('after-failure', 'driving')).toBe(false)
     expect(transport.sendInputImmediate('after-failure')).toBe(false)
-    await expect(transport.sendInputAccepted?.('after-failure')).resolves.toBe(false)
+    await expect(transport.sendInputAccepted?.('after-failure', 'driving')).resolves.toBe(false)
     expect(onError).toHaveBeenCalledWith('spawn failed')
     expect(window.api.pty.write).not.toHaveBeenCalled()
     expect(window.api.pty.writeAccepted).not.toHaveBeenCalled()
@@ -673,16 +673,16 @@ describe('createIpcPtyTransport', () => {
     const transport = createIpcPtyTransport({ bufferInputUntilConnect: true })
 
     const connecting = transport.connect({ url: '', callbacks: {} })
-    expect(transport.sendInput('first')).toBe(true)
-    const accepted = transport.sendInputAccepted?.('second')
-    expect(transport.sendInput('third')).toBe(true)
+    expect(transport.sendInput('first', 'driving')).toBe(true)
+    const accepted = transport.sendInputAccepted?.('second', 'driving')
+    expect(transport.sendInput('third', 'driving')).toBe(true)
 
     spawn.resolve({ id: 'pty-1' })
     await connecting
 
     await expect(accepted).resolves.toBe(false)
     expect(window.api.pty.write).toHaveBeenCalledOnce()
-    expect(window.api.pty.write).toHaveBeenCalledWith('pty-1', 'first')
+    expect(window.api.pty.write).toHaveBeenCalledWith('pty-1', 'first', 'driving')
   })
 
   it('drops acknowledged preconnect input when an earlier ordinary write fails', async () => {
@@ -695,8 +695,8 @@ describe('createIpcPtyTransport', () => {
     const transport = createIpcPtyTransport({ bufferInputUntilConnect: true })
 
     try {
-      expect(transport.sendInput('first')).toBe(true)
-      const accepted = transport.sendInputAccepted?.('second')
+      expect(transport.sendInput('first', 'driving')).toBe(true)
+      const accepted = transport.sendInputAccepted?.('second', 'driving')
       await transport.connect({ url: '', callbacks: {} })
 
       await expect(accepted).resolves.toBe(false)
@@ -712,12 +712,14 @@ describe('createIpcPtyTransport', () => {
     const transport = createIpcPtyTransport({ bufferInputUntilConnect: true })
 
     for (let index = 0; index < PTY_PRECONNECT_INPUT_MAX_ENTRIES; index += 1) {
-      expect(transport.sendInput('x')).toBe(true)
+      expect(transport.sendInput('x', 'driving')).toBe(true)
     }
-    expect(transport.sendInput('overflow')).toBe(false)
+    expect(transport.sendInput('overflow', 'driving')).toBe(false)
 
     const oversized = createIpcPtyTransport({ bufferInputUntilConnect: true })
-    expect(oversized.sendInput('x'.repeat(PTY_PRECONNECT_INPUT_MAX_CODE_UNITS + 1))).toBe(false)
+    expect(
+      oversized.sendInput('x'.repeat(PTY_PRECONNECT_INPUT_MAX_CODE_UNITS + 1), 'driving')
+    ).toBe(false)
     await transport.destroy?.()
     await oversized.destroy?.()
   })
@@ -731,14 +733,14 @@ describe('createIpcPtyTransport', () => {
 
       await transport.connect({ url: '', callbacks: {} })
 
-      expect(transport.sendInput(`${chunk}tail`)).toBe(true)
+      expect(transport.sendInput(`${chunk}tail`, 'driving')).toBe(true)
       expect(window.api.pty.write).toHaveBeenCalledTimes(1)
-      expect(window.api.pty.write).toHaveBeenNthCalledWith(1, 'pty-1', chunk)
+      expect(window.api.pty.write).toHaveBeenNthCalledWith(1, 'pty-1', chunk, 'driving')
 
       await vi.runOnlyPendingTimersAsync()
 
       expect(window.api.pty.write).toHaveBeenCalledTimes(2)
-      expect(window.api.pty.write).toHaveBeenNthCalledWith(2, 'pty-1', 'tail')
+      expect(window.api.pty.write).toHaveBeenNthCalledWith(2, 'pty-1', 'tail', 'driving')
     } finally {
       vi.useRealTimers()
     }
@@ -755,7 +757,7 @@ describe('createIpcPtyTransport', () => {
 
       await transport.connect({ url: '', callbacks: {} })
       expect(transport.sendInputImmediate(first)).toBe(true)
-      expect(transport.sendInput(ordinary)).toBe(true)
+      expect(transport.sendInput(ordinary, 'driving')).toBe(true)
       for (const reply of replies) {
         expect(transport.sendInputImmediate(reply)).toBe(true)
       }
@@ -763,11 +765,11 @@ describe('createIpcPtyTransport', () => {
       await vi.runAllTimersAsync()
 
       expect(vi.mocked(window.api.pty.write).mock.calls).toEqual([
-        ['pty-1', first],
-        ['pty-1', ordinary],
+        ['pty-1', first, 'query-reply'],
+        ['pty-1', ordinary, 'driving'],
         ...replies
           .slice(-PTY_INPUT_WRITE_QUEUE_MAX_PENDING_REPLIES)
-          .map((reply) => ['pty-1', reply])
+          .map((reply) => ['pty-1', reply, 'query-reply'])
       ])
     } finally {
       vi.useRealTimers()
@@ -783,7 +785,7 @@ describe('createIpcPtyTransport', () => {
 
       await transport.connect({ url: '', callbacks: {} })
 
-      expect(transport.sendInput(text)).toBe(true)
+      expect(transport.sendInput(text, 'driving')).toBe(true)
       expect(window.api.pty.write).not.toHaveBeenCalled()
 
       await vi.runAllTimersAsync()
@@ -805,7 +807,7 @@ describe('createIpcPtyTransport', () => {
 
     await transport.connect({ url: '', callbacks: {} })
 
-    expect(transport.sendInput('x'.repeat(TERMINAL_INPUT_MAX_BYTES + 1))).toBe(false)
+    expect(transport.sendInput('x'.repeat(TERMINAL_INPUT_MAX_BYTES + 1), 'driving')).toBe(false)
     expect(window.api.pty.write).not.toHaveBeenCalled()
   })
 
@@ -818,16 +820,16 @@ describe('createIpcPtyTransport', () => {
 
       await transport.connect({ url: '', callbacks: {} })
 
-      const accepted = transport.sendInputAccepted?.(`${chunk}tail`)
+      const accepted = transport.sendInputAccepted?.(`${chunk}tail`, 'driving')
       await Promise.resolve()
       expect(window.api.pty.writeAccepted).toHaveBeenCalledTimes(1)
-      expect(window.api.pty.writeAccepted).toHaveBeenNthCalledWith(1, 'pty-1', chunk)
+      expect(window.api.pty.writeAccepted).toHaveBeenNthCalledWith(1, 'pty-1', chunk, 'driving')
 
       await vi.runOnlyPendingTimersAsync()
 
       await expect(accepted).resolves.toBe(true)
       expect(window.api.pty.writeAccepted).toHaveBeenCalledTimes(2)
-      expect(window.api.pty.writeAccepted).toHaveBeenNthCalledWith(2, 'pty-1', 'tail')
+      expect(window.api.pty.writeAccepted).toHaveBeenNthCalledWith(2, 'pty-1', 'tail', 'driving')
     } finally {
       vi.useRealTimers()
     }
@@ -842,7 +844,7 @@ describe('createIpcPtyTransport', () => {
 
       await transport.connect({ url: '', callbacks: {} })
 
-      const accepted = transport.sendInputAccepted?.(text)
+      const accepted = transport.sendInputAccepted?.(text, 'driving')
       await Promise.resolve()
       expect(window.api.pty.writeAccepted).not.toHaveBeenCalled()
 
@@ -867,7 +869,7 @@ describe('createIpcPtyTransport', () => {
     await transport.connect({ url: '', callbacks: {} })
 
     await expect(
-      transport.sendInputAccepted?.('x'.repeat(TERMINAL_INPUT_MAX_BYTES + 1))
+      transport.sendInputAccepted?.('x'.repeat(TERMINAL_INPUT_MAX_BYTES + 1), 'driving')
     ).resolves.toBe(false)
     expect(window.api.pty.writeAccepted).not.toHaveBeenCalled()
   })
diff --git a/src/renderer/src/components/terminal-pane/pty-transport-reattach-admission.test.ts b/src/renderer/src/components/terminal-pane/pty-transport-reattach-admission.test.ts
index 879db477f40a..b10fd3fe1bad 100644
--- a/src/renderer/src/components/terminal-pane/pty-transport-reattach-admission.test.ts
+++ b/src/renderer/src/components/terminal-pane/pty-transport-reattach-admission.test.ts
@@ -92,7 +92,7 @@ describe('createIpcPtyTransport', () => {
     await transport.connect({ url: '', callbacks: { onError } })
     expect(onError).toHaveBeenCalled()
     expect(transport.isConnected()).toBe(false)
-    expect(transport.sendInput('echo hello\r')).toBe(false)
+    expect(transport.sendInput('echo hello\r', 'driving')).toBe(false)
     await flushPtySideEffects()
     expect(write).not.toHaveBeenCalled()
 
@@ -102,7 +102,7 @@ describe('createIpcPtyTransport', () => {
     await transport.connect({ url: '', callbacks: { onError: onErrorKilled } })
     expect(onErrorKilled).not.toHaveBeenCalled()
     expect(transport.isConnected()).toBe(false)
-    expect(transport.sendInput('echo hello\r')).toBe(false)
+    expect(transport.sendInput('echo hello\r', 'driving')).toBe(false)
     await flushPtySideEffects()
     expect(write).not.toHaveBeenCalled()
   })
@@ -153,7 +153,10 @@ describe('createIpcPtyTransport', () => {
     const onDataCallback = vi.fn()
     const onExitCallback = vi.fn()
     spawn.mockResolvedValueOnce({ id: 'pty-fresh-fallback', sessionExpired: true })
-    const transport = createIpcPtyTransport({ onPtySpawn })
+    // Built the way installPtyInputRecovery builds it: every real pane supplies
+    // retainDisposedSpawn, and for a live pane refusing its own id it answers "retain". The refusal
+    // must kill anyway — this transport is the pane's only one, so nothing else owns the PTY.
+    const transport = createIpcPtyTransport({ onPtySpawn, retainDisposedSpawn: () => true })
 
     const result = await transport.connect({
       url: '',
@@ -184,7 +187,7 @@ describe('createIpcPtyTransport', () => {
     const retirementError = new Error('provider shutdown refused')
     spawn.mockResolvedValueOnce({ id: 'pty-fresh-fallback', sessionExpired: true })
     kill.mockRejectedValueOnce(retirementError)
-    const transport = createIpcPtyTransport({ onPtySpawn })
+    const transport = createIpcPtyTransport({ onPtySpawn, retainDisposedSpawn: () => true })
 
     await expect(
       transport.connect({
diff --git a/src/renderer/src/components/terminal-pane/pty-transport-recycled-pty-incarnation.test.ts b/src/renderer/src/components/terminal-pane/pty-transport-recycled-pty-incarnation.test.ts
index 7936300fb065..2c521261b73a 100644
--- a/src/renderer/src/components/terminal-pane/pty-transport-recycled-pty-incarnation.test.ts
+++ b/src/renderer/src/components/terminal-pane/pty-transport-recycled-pty-incarnation.test.ts
@@ -10,7 +10,8 @@ import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import {
   installIpcPtyWindow,
   restorePtySpecWindow,
-  type PtyExitPayload
+  type PtyExitPayload,
+  type PtyStreamPayload
 } from './pty-transport-test-harness'
 
 const RECYCLED_PTY_ID = 'ssh:target@@pty-1'
@@ -20,11 +21,16 @@ const FRESH_INCARNATION_ID = 'incarnation-of-the-shell-now-attaching'
 describe('createIpcPtyTransport against a relay-recycled PTY id', () => {
   const originalWindow = (globalThis as { window?: typeof window }).window
   let onExit: ((payload: PtyExitPayload) => void) | null = null
+  let onData: ((payload: PtyStreamPayload) => void) | null = null
 
   beforeEach(() => {
     vi.resetModules()
     onExit = null
+    onData = null
     installIpcPtyWindow(originalWindow, {
+      data: (callback) => {
+        onData = callback
+      },
       exit: (callback) => {
         onExit = callback
       }
@@ -82,6 +88,42 @@ describe('createIpcPtyTransport against a relay-recycled PTY id', () => {
     expect(paneExit).toHaveBeenCalledWith(3)
   })
 
+  it('delivers an authentication failure and exit after the main-side binding cleanup', async () => {
+    const { createIpcPtyTransport } = await import('./pty-transport')
+    const spawn = vi.mocked(window.api.pty.spawn)
+    let release!: () => void
+    const cleanup = new Promise<void>((resolve) => {
+      release = resolve
+    })
+    spawn.mockImplementationOnce(async () => {
+      onData?.({ id: RECYCLED_PTY_ID, data: 'Authentication failed: sign in again.\r\n' })
+      onExit?.({ id: RECYCLED_PTY_ID, code: 1, incarnationId: FRESH_INCARNATION_ID })
+      await cleanup
+      return { id: RECYCLED_PTY_ID, incarnationId: FRESH_INCARNATION_ID }
+    })
+    const output = vi.fn()
+    const exit = vi.fn()
+    const error = vi.fn()
+    const connected = vi.fn()
+    const transport = createIpcPtyTransport()
+    const pending = transport.connect({
+      url: '',
+      callbacks: {
+        onData: output,
+        onExit: exit,
+        onError: error,
+        onConnect: connected
+      }
+    })
+    release()
+    expect(await pending).toEqual({ id: RECYCLED_PTY_ID, exitedBeforeAttach: true })
+    expect(output).toHaveBeenCalledWith('Authentication failed: sign in again.\r\n')
+    expect(exit).toHaveBeenCalledWith(1)
+    expect(output.mock.invocationCallOrder[0]).toBeLessThan(exit.mock.invocationCallOrder[0])
+    expect(error).not.toHaveBeenCalled()
+    expect(connected).not.toHaveBeenCalled()
+  })
+
   // Absence is unknown, never a mismatch — so an SSH host predating the field, and the relay's own
   // unnamed `{ id, code: -1 }` drop, keep exactly the behaviour #16970 shipped. (`remote:` runtime
   // PTYs are not covered by this: their exits never traverse `pty:exit` at all.)
diff --git a/src/renderer/src/components/terminal-pane/pty-transport-types.ts b/src/renderer/src/components/terminal-pane/pty-transport-types.ts
index c7753abbd3e6..7fd0de6952e7 100644
--- a/src/renderer/src/components/terminal-pane/pty-transport-types.ts
+++ b/src/renderer/src/components/terminal-pane/pty-transport-types.ts
@@ -10,6 +10,7 @@ import type {
 import type { StartupCommandDelivery } from '../../../../shared/codex-startup-delivery'
 import type { ProjectExecutionRuntimeResolution } from '../../../../shared/project-execution-runtime'
 import type { EventProps } from '../../../../shared/telemetry-events'
+import type { TerminalInputKind } from '../../../../shared/terminal-input-kind'
 import type { TerminalOscColorQueryReplyColors } from '../../../../shared/terminal-osc-color-reply'
 import type { TuiAgent } from '../../../../shared/tui-agent'
 import type { ExecutionHostId } from '../../../../shared/execution-host'
@@ -182,7 +183,7 @@ export type PtyTransport = {
     callbacks: PtyCallbacks
   }) => void
   disconnect: () => void
-  sendInput: (data: string) => boolean
+  sendInput: (data: string, inputKind: TerminalInputKind) => boolean
   // Why: latency-critical terminal query replies (CPR/DSR/DA/OSC color/pixel
   // size) must skip input coalescing — a querying program reads them in raw
   // mode with a short timeout, so a debounced reply lands on the shell prompt
@@ -190,7 +191,7 @@ export type PtyTransport = {
   // this is `sendInput` for them; the remote transport flushes pending input
   // (preserving order) and sends the reply immediately.
   sendInputImmediate: (data: string) => boolean
-  sendInputAccepted?: (data: string) => Promise<boolean>
+  sendInputAccepted?: (data: string, inputKind: TerminalInputKind) => Promise<boolean>
   /** Settles retained pre-connect input when a deferred spawn is abandoned before connect. */
   abandonPreconnectInput?: () => void
   claimViewport?: (cols: number, rows: number) => boolean
@@ -278,6 +279,9 @@ export type IpcPtyTransportOptions = {
   onPtyExit?: (ptyId: string, exitCode?: number) => void
   onTitleChange?: (title: string, rawTitle: string) => void
   onPtySpawn?: (ptyId: string) => void
+  /** Asked when a fresh spawn resolves after this transport was destroyed: true keeps the PTY for
+   *  the pane's successor (disposed-spawn-retention.ts); absent or false kills it. */
+  retainDisposedSpawn?: () => boolean
   /** Rebind an existing pane after its provider replaces the PTY identity. */
   onPtyRebind?: (ptyId: string, replacedPtyId: string, incarnationId?: string | null) => void
   onBell?: () => void
diff --git a/src/renderer/src/components/terminal-pane/pty-transport-user-input.test.ts b/src/renderer/src/components/terminal-pane/pty-transport-user-input.test.ts
new file mode 100644
index 000000000000..34a71b81b8c7
--- /dev/null
+++ b/src/renderer/src/components/terminal-pane/pty-transport-user-input.test.ts
@@ -0,0 +1,89 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { createDeferred, flushAsyncTicks } from './pty-connection-test-async'
+import type { PtyPreconnectInputEntry } from './pty-preconnect-input-buffer'
+import { installIpcPtyWindow, restorePtySpecWindow } from './pty-transport-test-harness'
+
+describe('createIpcPtyTransport: input kind', () => {
+  const originalWindow: typeof window | undefined = globalThis.window
+
+  beforeEach(() => {
+    vi.resetModules()
+    installIpcPtyWindow(originalWindow, {})
+  })
+
+  afterEach(() => {
+    restorePtySpecWindow(originalWindow)
+  })
+
+  it('sends every write with the kind its writer gave it', async () => {
+    const { createIpcPtyTransport } = await import('./pty-transport')
+    const transport = createIpcPtyTransport({})
+    await transport.connect({ url: '', callbacks: {} })
+
+    transport.sendInput('typed', 'driving')
+    await flushAsyncTicks()
+    transport.sendInput('\x1b[I', 'query-reply')
+    await flushAsyncTicks()
+    transport.sendInputImmediate('\x1b[1;1R')
+    await flushAsyncTicks()
+    await transport.sendInputAccepted?.('echo startup\r', 'launch')
+
+    expect(vi.mocked(window.api.pty.write).mock.calls).toEqual([
+      ['pty-1', 'typed', 'driving'],
+      ['pty-1', '\x1b[I', 'query-reply'],
+      ['pty-1', '\x1b[1;1R', 'query-reply']
+    ])
+    expect(window.api.pty.writeAccepted).toHaveBeenCalledWith('pty-1', 'echo startup\r', 'launch')
+    transport.disconnect()
+  })
+
+  it('never merges bytes of different kinds', async () => {
+    const { createIpcPtyTransport } = await import('./pty-transport')
+    const transport = createIpcPtyTransport({})
+    await transport.connect({ url: '', callbacks: {} })
+
+    // The first write drains at once; what queues behind it would otherwise coalesce.
+    transport.sendInput('\x1b[O', 'query-reply')
+    transport.sendInput('\x1b[I', 'query-reply')
+    transport.sendInput('a', 'driving')
+    transport.sendInput('b', 'driving')
+
+    await vi.waitFor(() =>
+      expect(vi.mocked(window.api.pty.write).mock.calls).toEqual([
+        ['pty-1', '\x1b[O', 'query-reply'],
+        ['pty-1', '\x1b[I', 'query-reply'],
+        ['pty-1', 'ab', 'driving']
+      ])
+    )
+    transport.disconnect()
+  })
+
+  it('keeps the kind of input written before the spawn connects and across a remount', async () => {
+    const spawn = createDeferred<Awaited<ReturnType<typeof window.api.pty.spawn>>>()
+    vi.mocked(window.api.pty.spawn).mockReturnValue(spawn.promise)
+    const { createIpcPtyTransport } = await import('./pty-transport')
+    const captured: PtyPreconnectInputEntry[] = []
+    const predecessor = createIpcPtyTransport({
+      bufferInputUntilConnect: true,
+      onPreconnectInput: (entry) => captured.push(entry)
+    })
+    void predecessor.connect({ url: '', callbacks: {} })
+    predecessor.sendInput('typed-early', 'driving')
+    predecessor.sendInput('startup', 'launch')
+    predecessor.destroy?.()
+
+    const successor = createIpcPtyTransport({ preconnectInput: captured })
+    spawn.resolve({ id: 'pty-1' })
+    await successor.connect({ url: '', callbacks: {} })
+    await flushAsyncTicks()
+
+    expect(captured).toEqual([
+      { data: 'typed-early', kind: 'ordinary', inputKind: 'driving' },
+      { data: 'startup', kind: 'ordinary', inputKind: 'launch' }
+    ])
+    expect(vi.mocked(window.api.pty.write).mock.calls).toEqual([
+      ['pty-1', 'typed-early', 'driving'],
+      ['pty-1', 'startup', 'launch']
+    ])
+  })
+})
diff --git a/src/renderer/src/components/terminal-pane/pty-transport.ts b/src/renderer/src/components/terminal-pane/pty-transport.ts
index a8adfccb7ac7..fd26a7324b5d 100644
--- a/src/renderer/src/components/terminal-pane/pty-transport.ts
+++ b/src/renderer/src/components/terminal-pane/pty-transport.ts
@@ -5,6 +5,7 @@ import { createPtyInputWriteQueue } from './pty-input-write-queue'
 import { createPtyOutputProcessor } from './pty-output-processor'
 import { createPtyPreconnectInputBuffer } from './pty-preconnect-input-buffer'
 import type { IpcPtyTransportOptions, PtyTransport } from './pty-transport-types'
+import type { TerminalInputKind } from '../../../../shared/terminal-input-kind'
 
 export {
   ensurePtyDispatcher,
@@ -57,8 +58,8 @@ export function createIpcPtyTransport(opts: IpcPtyTransportOptions = {}): PtyTra
 
   const inputWriteQueue = createPtyInputWriteQueue({
     isWritable: (id) => !destroyed && connected && ptyId === id,
-    write: (id, data) => window.api.pty.write(id, data),
-    writeAccepted: (id, data) => window.api.pty.writeAccepted(id, data),
+    write: (id, data, inputKind) => window.api.pty.write(id, data, inputKind),
+    writeAccepted: (id, data, inputKind) => window.api.pty.writeAccepted(id, data, inputKind),
     onDrainFailure: (id) => {
       if (ptyId === id) {
         storedCallbacks.onWriteUnavailable?.()
@@ -115,12 +116,13 @@ export function createIpcPtyTransport(opts: IpcPtyTransportOptions = {}): PtyTra
     }
     await preconnectInputBuffer.flush({
       isCurrent: () => !destroyed && connected && ptyId === id,
-      sendInput: (data) => inputWriteQueue.enqueue(id, data),
+      sendInput: (data, inputKind) => inputWriteQueue.enqueue(id, data, inputKind),
       sendInputImmediate: (data) => inputWriteQueue.enqueueQueryReply(id, data),
       ...(connectionId
         ? {}
         : {
-            sendInputAccepted: (data: string) => inputWriteQueue.enqueueAccepted(id, data)
+            sendInputAccepted: (data: string, inputKind: TerminalInputKind) =>
+              inputWriteQueue.enqueueAccepted(id, data, inputKind)
           })
     })
   }
@@ -213,16 +215,23 @@ export function createIpcPtyTransport(opts: IpcPtyTransportOptions = {}): PtyTra
       storedCallbacks = {}
     },
 
-    sendInput(data) {
+    sendInput(data, inputKind) {
       if (!destroyed && preconnectInputBuffer?.isBuffering()) {
-        return preconnectInputBuffer.enqueue(data, 'ordinary', opts.onPreconnectInput)
+        return preconnectInputBuffer.enqueue(data, 'ordinary', inputKind, opts.onPreconnectInput)
       }
-      return !destroyed && connected && ptyId ? inputWriteQueue.enqueue(ptyId, data) : false
+      return !destroyed && connected && ptyId
+        ? inputWriteQueue.enqueue(ptyId, data, inputKind)
+        : false
     },
 
     sendInputImmediate(data) {
       if (!destroyed && preconnectInputBuffer?.isBuffering()) {
-        return preconnectInputBuffer.enqueue(data, 'immediate', opts.onPreconnectInput)
+        return preconnectInputBuffer.enqueue(
+          data,
+          'immediate',
+          'query-reply',
+          opts.onPreconnectInput
+        )
       }
       return !destroyed && connected && ptyId
         ? inputWriteQueue.enqueueQueryReply(ptyId, data)
@@ -232,14 +241,14 @@ export function createIpcPtyTransport(opts: IpcPtyTransportOptions = {}): PtyTra
     ...(connectionId
       ? {}
       : {
-          async sendInputAccepted(data: string): Promise<boolean> {
+          async sendInputAccepted(data: string, inputKind: TerminalInputKind): Promise<boolean> {
             if (!destroyed && preconnectInputBuffer?.isBuffering()) {
-              return preconnectInputBuffer.enqueueAccepted(data, opts.onPreconnectInput)
+              return preconnectInputBuffer.enqueueAccepted(data, inputKind, opts.onPreconnectInput)
             }
             if (destroyed || !connected || !ptyId) {
               return false
             }
-            return inputWriteQueue.enqueueAccepted(ptyId, data)
+            return inputWriteQueue.enqueueAccepted(ptyId, data, inputKind)
           }
         }),
 
diff --git a/src/renderer/src/components/terminal-pane/remote-pane-layout-push.test.ts b/src/renderer/src/components/terminal-pane/remote-pane-layout-push.test.ts
index 737339f47057..4ede67a89904 100644
--- a/src/renderer/src/components/terminal-pane/remote-pane-layout-push.test.ts
+++ b/src/renderer/src/components/terminal-pane/remote-pane-layout-push.test.ts
@@ -65,6 +65,7 @@ describe('createRemotePaneLayoutPusher', () => {
       tabId: 'tab-1',
       root: layout.root,
       expandedLeafId: layout.expandedLeafId,
+      chatLeafId: null,
       titlesByLeafId: layout.titlesByLeafId
     })
   })
@@ -79,6 +80,18 @@ describe('createRemotePaneLayoutPusher', () => {
     expect(updateWebRuntimePaneLayout.mock.calls[0][0]).not.toHaveProperty('titlesByLeafId')
   })
 
+  it('publishes owner changes and an explicit clear without a geometry change', () => {
+    const pusher = createRemotePaneLayoutPusher()
+    for (const chatLeafId of ['leaf-a', 'leaf-b', undefined]) {
+      pusher.push({ worktreeId: 'wt-1', tabId: 'tab-1', layout: makeLayout({ chatLeafId }) })
+    }
+    expect(updateWebRuntimePaneLayout.mock.calls.map(([args]) => args.chatLeafId)).toEqual([
+      'leaf-a',
+      'leaf-b',
+      null
+    ])
+  })
+
   it('pushes again for every host-visible change', () => {
     const pusher = createRemotePaneLayoutPusher()
     pusher.push({ worktreeId: 'wt-1', tabId: 'tab-1', layout: makeLayout() })
diff --git a/src/renderer/src/components/terminal-pane/remote-pane-layout-push.ts b/src/renderer/src/components/terminal-pane/remote-pane-layout-push.ts
index 963d4b78355c..35ef17b949ba 100644
--- a/src/renderer/src/components/terminal-pane/remote-pane-layout-push.ts
+++ b/src/renderer/src/components/terminal-pane/remote-pane-layout-push.ts
@@ -35,6 +35,7 @@ export function createRemotePaneLayoutPusher(): RemotePaneLayoutPusher {
         tabId,
         root: layout.root,
         expandedLeafId: layout.expandedLeafId,
+        chatLeafId: layout.chatLeafId ?? null,
         ...(layout.titlesByLeafId ? { titlesByLeafId: layout.titlesByLeafId } : {})
       }).then((updated) => {
         // Why: a disconnected or timed-out push carried no information, so the next persist must retry it.
diff --git a/src/renderer/src/components/terminal-pane/remote-runtime-error-surface-dismissal.test.ts b/src/renderer/src/components/terminal-pane/remote-runtime-error-surface-dismissal.test.ts
index 1df9a355a051..b07afbb20d34 100644
--- a/src/renderer/src/components/terminal-pane/remote-runtime-error-surface-dismissal.test.ts
+++ b/src/renderer/src/components/terminal-pane/remote-runtime-error-surface-dismissal.test.ts
@@ -48,18 +48,18 @@ describe('remote runtime error surface dismissal', () => {
     const onError = vi.fn()
     const transport = await attachTransportWithFatalSends(onError)
 
-    expect(await transport.sendInputAccepted?.('a')).toBe(false)
-    expect(await transport.sendInputAccepted?.('b')).toBe(false)
+    expect(await transport.sendInputAccepted?.('a', 'driving')).toBe(false)
+    expect(await transport.sendInputAccepted?.('b', 'driving')).toBe(false)
     // Contract preserved: one continuous outage still surfaces the repeated error once.
     expect(onError.mock.calls).toEqual([[FATAL_ERROR]])
 
     transport.notifyErrorSurfaceDismissed?.()
 
-    expect(await transport.sendInputAccepted?.('c')).toBe(false)
+    expect(await transport.sendInputAccepted?.('c', 'driving')).toBe(false)
     expect(onError.mock.calls).toEqual([[FATAL_ERROR], [FATAL_ERROR]])
 
     // The memory re-arms: repeats after the re-surfaced error are suppressed again until the next dismissal.
-    expect(await transport.sendInputAccepted?.('d')).toBe(false)
+    expect(await transport.sendInputAccepted?.('d', 'driving')).toBe(false)
     expect(onError).toHaveBeenCalledTimes(2)
     transport.destroy?.()
   })
@@ -68,9 +68,9 @@ describe('remote runtime error surface dismissal', () => {
     const onError = vi.fn()
     const transport = await attachTransportWithFatalSends(onError)
 
-    expect(await transport.sendInputAccepted?.('a')).toBe(false)
-    expect(await transport.sendInputAccepted?.('b')).toBe(false)
-    expect(await transport.sendInputAccepted?.('c')).toBe(false)
+    expect(await transport.sendInputAccepted?.('a', 'driving')).toBe(false)
+    expect(await transport.sendInputAccepted?.('b', 'driving')).toBe(false)
+    expect(await transport.sendInputAccepted?.('c', 'driving')).toBe(false)
 
     expect(onError).toHaveBeenCalledTimes(1)
     transport.destroy?.()
diff --git a/src/renderer/src/components/terminal-pane/remote-runtime-pty-query-reply-immediate.test.ts b/src/renderer/src/components/terminal-pane/remote-runtime-pty-query-reply-immediate.test.ts
index ec46891e9d53..6d8616a1baa8 100644
--- a/src/renderer/src/components/terminal-pane/remote-runtime-pty-query-reply-immediate.test.ts
+++ b/src/renderer/src/components/terminal-pane/remote-runtime-pty-query-reply-immediate.test.ts
@@ -71,7 +71,7 @@ describe('remote transport sendInputImmediate (#7329)', () => {
       await vi.waitFor(() => expect(runtimeSubscribe).toHaveBeenCalled())
 
       // Typed input: debounced — nothing sent before the 8ms flush.
-      expect(transport.sendInput('yes')).toBe(true)
+      expect(transport.sendInput('yes', 'driving')).toBe(true)
       expect(terminalSendCalls()).toEqual([])
 
       // Query reply (OSC 11 background color): sent immediately, no timer.
@@ -139,10 +139,10 @@ describe('remote transport sendInputImmediate (#7329)', () => {
     // A paste above CLIPBOARD_TEXT_MEASURE_YIELD_CODE_UNITS forces the async
     // validation path, so its bytes are captured in validationTail, not pending.
     const paste = 'p'.repeat(CLIPBOARD_TEXT_MEASURE_YIELD_CODE_UNITS + 1)
-    expect(transport.sendInput(paste)).toBe(true)
+    expect(transport.sendInput(paste, 'driving')).toBe(true)
     // Immediately (validation still pending) a TUI emits a CPR reply.
     expect(transport.sendInputImmediate('\x1b[3;1R')).toBe(true)
-    expect(transport.sendInput('z')).toBe(true)
+    expect(transport.sendInput('z', 'driving')).toBe(true)
 
     // Wait until the reply is actually flushed instead of sleeping a fixed
     // interval: the reply legitimately trails the paste's async validation plus
diff --git a/src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-host-session-launch.test.ts b/src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-host-session-launch.test.ts
index 6185198d59e0..f5861cbc8105 100644
--- a/src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-host-session-launch.test.ts
+++ b/src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-host-session-launch.test.ts
@@ -523,7 +523,7 @@ describe('createRemoteRuntimePtyTransport', () => {
       }
       send.mockClear()
 
-      expect(transport.sendInput('ls\r')).toBe(true)
+      expect(transport.sendInput('ls\r', 'driving')).toBe(true)
       await vi.runOnlyPendingTimersAsync()
       expect(runtimeCall).not.toHaveBeenCalled()
       const inputFrame = decodeTerminalStreamFrame(send.mock.calls[0][0])
diff --git a/src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-host-surface-replacement.test.ts b/src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-host-surface-replacement.test.ts
index 398efce980ae..58034193be8f 100644
--- a/src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-host-surface-replacement.test.ts
+++ b/src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-host-surface-replacement.test.ts
@@ -249,7 +249,9 @@ describe('createRemoteRuntimePtyTransport', () => {
       expect(handleEvents.getWebSessionTerminalHandleSubscriberCountForTests()).toBe(1)
 
       const listCallsAfterBound = hostListCalls
-      await expect(transport.sendInputAccepted?.('retry while reconnecting')).resolves.toBe(false)
+      await expect(
+        transport.sendInputAccepted?.('retry while reconnecting', 'driving')
+      ).resolves.toBe(false)
       await vi.advanceTimersByTimeAsync(16_000)
 
       // The accepted-snapshot listener already owns recovery. User input must
diff --git a/src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-input-coalescing.test.ts b/src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-input-coalescing.test.ts
index 999716aa43d3..b77f0b26e82f 100644
--- a/src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-input-coalescing.test.ts
+++ b/src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-input-coalescing.test.ts
@@ -143,9 +143,9 @@ describe('createRemoteRuntimePtyTransport', () => {
       })
       await vi.waitFor(() => expect(runtimeSubscribe).toHaveBeenCalled())
       expect(transport.claimViewport?.(101, 33)).toBe(true)
-      expect(transport.sendInput('x')).toBe(true)
+      expect(transport.sendInput('x', 'driving')).toBe(true)
       expect(transport.sendInputImmediate('\x1b[?1;2c')).toBe(true)
-      expect(transport.sendInput('z')).toBe(true)
+      expect(transport.sendInput('z', 'driving')).toBe(true)
       await vi.advanceTimersByTimeAsync(8)
       expect(runtimeCall).not.toHaveBeenCalledWith(
         expect.objectContaining({ method: 'terminal.send' })
@@ -193,8 +193,8 @@ describe('createRemoteRuntimePtyTransport', () => {
       runtimeCall.mockClear()
       subscriptionSendBinary.mockClear()
 
-      expect(transport.sendInput('a')).toBe(true)
-      expect(transport.sendInput('b')).toBe(true)
+      expect(transport.sendInput('a', 'driving')).toBe(true)
+      expect(transport.sendInput('b', 'driving')).toBe(true)
       expect(runtimeCall).not.toHaveBeenCalled()
 
       await vi.runOnlyPendingTimersAsync()
@@ -225,8 +225,8 @@ describe('createRemoteRuntimePtyTransport', () => {
       runtimeCall.mockClear()
       subscriptionSendBinary.mockClear()
 
-      expect(transport.sendInput('a')).toBe(true)
-      expect(transport.sendInput('b')).toBe(true)
+      expect(transport.sendInput('a', 'driving')).toBe(true)
+      expect(transport.sendInput('b', 'driving')).toBe(true)
       await vi.runOnlyPendingTimersAsync()
 
       expect(runtimeCall).not.toHaveBeenCalled()
@@ -256,14 +256,14 @@ describe('createRemoteRuntimePtyTransport', () => {
       subscriptionSendBinary.mockClear()
 
       const chunk = 'x'.repeat(TERMINAL_INPUT_CHUNK_MAX_BYTES)
-      expect(transport.sendInput(chunk)).toBe(true)
+      expect(transport.sendInput(chunk, 'driving')).toBe(true)
       expect(subscriptionSendBinary).toHaveBeenCalledTimes(1)
       let frame = decodeTerminalStreamFrame(subscriptionSendBinary.mock.calls[0][0])
       expect(frame?.opcode).toBe(TerminalStreamOpcode.Input)
       expect(frame?.streamId).toBe(streamId)
       expect(frame ? decodeTerminalStreamText(frame.payload) : '').toBe(chunk)
 
-      expect(transport.sendInput('tail')).toBe(true)
+      expect(transport.sendInput('tail', 'driving')).toBe(true)
       await vi.runOnlyPendingTimersAsync()
 
       expect(runtimeCall).not.toHaveBeenCalled()
@@ -299,7 +299,7 @@ describe('createRemoteRuntimePtyTransport', () => {
 
     await transport.connect({ url: '', callbacks: {} })
 
-    await expect(transport.sendInputAccepted?.('\x03')).resolves.toBe(true)
+    await expect(transport.sendInputAccepted?.('\x03', 'driving')).resolves.toBe(true)
     expect(runtimeCall).toHaveBeenCalledWith({
       selector: 'env-1',
       method: 'terminal.send',
@@ -339,8 +339,8 @@ describe('createRemoteRuntimePtyTransport', () => {
       await transport.connect({ url: '', callbacks: {} })
       subscriptionSendBinary.mockClear()
 
-      expect(transport.sendInput('a')).toBe(true)
-      await expect(transport.sendInputAccepted?.('\x03')).resolves.toBe(true)
+      expect(transport.sendInput('a', 'driving')).toBe(true)
+      await expect(transport.sendInputAccepted?.('\x03', 'driving')).resolves.toBe(true)
       await vi.runOnlyPendingTimersAsync()
 
       expect(runtimeCall).toHaveBeenCalledWith({
@@ -383,7 +383,7 @@ describe('createRemoteRuntimePtyTransport', () => {
 
     await transport.connect({ url: '', callbacks: {} })
 
-    await expect(transport.sendInputAccepted?.('\x03')).resolves.toBe(false)
+    await expect(transport.sendInputAccepted?.('\x03', 'driving')).resolves.toBe(false)
   })
 
   it('splits large acknowledged remote input before terminal.send RPCs', async () => {
@@ -415,7 +415,7 @@ describe('createRemoteRuntimePtyTransport', () => {
     await transport.connect({ url: '', callbacks: {} })
 
     const chunk = '😀'.repeat(TERMINAL_INPUT_CHUNK_MAX_BYTES / 4)
-    await expect(transport.sendInputAccepted?.(`${chunk}tail`)).resolves.toBe(true)
+    await expect(transport.sendInputAccepted?.(`${chunk}tail`, 'driving')).resolves.toBe(true)
 
     const sendCalls = runtimeCall.mock.calls.filter((call) => call[0].method === 'terminal.send')
     expect(sendCalls).toHaveLength(2)
@@ -455,7 +455,7 @@ describe('createRemoteRuntimePtyTransport', () => {
       await transport.connect({ url: '', callbacks: {} })
       runtimeCall.mockClear()
 
-      const accepted = transport.sendInputAccepted?.(text)
+      const accepted = transport.sendInputAccepted?.(text, 'driving')
       await Promise.resolve()
 
       expect(runtimeCall).not.toHaveBeenCalled()
@@ -502,9 +502,9 @@ describe('createRemoteRuntimePtyTransport', () => {
 
     await transport.connect({ url: '', callbacks: {} })
 
-    await expect(transport.sendInputAccepted?.(`${firstChunk}${rejectedChunk}after`)).resolves.toBe(
-      false
-    )
+    await expect(
+      transport.sendInputAccepted?.(`${firstChunk}${rejectedChunk}after`, 'driving')
+    ).resolves.toBe(false)
 
     const sendTexts = runtimeCall.mock.calls
       .filter((call) => call[0].method === 'terminal.send')
@@ -530,7 +530,10 @@ describe('createRemoteRuntimePtyTransport', () => {
     runtimeCall.mockClear()
 
     await expect(
-      transport.sendInputAccepted?.('😀'.repeat(Math.floor(TERMINAL_INPUT_MAX_BYTES / 4) + 1))
+      transport.sendInputAccepted?.(
+        '😀'.repeat(Math.floor(TERMINAL_INPUT_MAX_BYTES / 4) + 1),
+        'driving'
+      )
     ).resolves.toBe(false)
     expect(runtimeCall).not.toHaveBeenCalled()
   })
@@ -550,7 +553,7 @@ describe('createRemoteRuntimePtyTransport', () => {
       runtimeCall.mockClear()
       subscriptionSendBinary.mockClear()
 
-      expect(transport.sendInput('echo one\necho two\r\n')).toBe(true)
+      expect(transport.sendInput('echo one\necho two\r\n', 'driving')).toBe(true)
       await vi.runOnlyPendingTimersAsync()
 
       expect(runtimeCall).not.toHaveBeenCalled()
@@ -614,7 +617,7 @@ describe('createRemoteRuntimePtyTransport', () => {
       subscriptionSendBinary.mockClear()
 
       expect(transport.claimViewport?.(101, 33)).toBe(true)
-      expect(transport.sendInput('x')).toBe(true)
+      expect(transport.sendInput('x', 'driving')).toBe(true)
       await vi.runOnlyPendingTimersAsync()
 
       const frames = subscriptionSendBinary.mock.calls.map((call) =>
diff --git a/src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-input-fallback.test.ts b/src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-input-fallback.test.ts
index 6230bd00d8f4..30c03745abed 100644
--- a/src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-input-fallback.test.ts
+++ b/src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-input-fallback.test.ts
@@ -60,7 +60,7 @@ describe('createRemoteRuntimePtyTransport', () => {
         callbacks: { onWriteUnavailable }
       })
       await vi.waitFor(() => expect(transport.getPtyId()).toBe('remote:env-1@@terminal-1'))
-      expect(transport.sendInput('x')).toBe(true)
+      expect(transport.sendInput('x', 'driving')).toBe(true)
       await vi.advanceTimersByTimeAsync(8)
 
       await vi.waitFor(() => expect(onWriteUnavailable).toHaveBeenCalledOnce())
@@ -103,7 +103,7 @@ describe('createRemoteRuntimePtyTransport', () => {
         callbacks: { onWriteUnavailable, onError }
       })
       await vi.waitFor(() => expect(transport.getPtyId()).toBe('remote:env-1@@terminal-1'))
-      expect(transport.sendInput('x')).toBe(true)
+      expect(transport.sendInput('x', 'driving')).toBe(true)
       await vi.advanceTimersByTimeAsync(8)
 
       await vi.waitFor(() => expect(onWriteUnavailable).toHaveBeenCalledOnce())
@@ -148,7 +148,7 @@ describe('createRemoteRuntimePtyTransport', () => {
         callbacks: { onWriteUnavailable: oldWriteUnavailable }
       })
       await vi.waitFor(() => expect(transport.getPtyId()).toBe('remote:env-1@@terminal-1'))
-      expect(transport.sendInput('old')).toBe(true)
+      expect(transport.sendInput('old', 'driving')).toBe(true)
       await vi.advanceTimersByTimeAsync(8)
       await vi.waitFor(() =>
         expect(runtimeCall).toHaveBeenCalledWith(
@@ -205,7 +205,7 @@ describe('createRemoteRuntimePtyTransport', () => {
         callbacks: {}
       })
       await vi.waitFor(() => expect(transport.getPtyId()).toBe('remote:env-1@@terminal-old'))
-      expect(transport.sendInput('queued-for-old')).toBe(true)
+      expect(transport.sendInput('queued-for-old', 'driving')).toBe(true)
 
       resolvedPaneHandle = 'terminal-new'
       transport.attach({
@@ -322,7 +322,7 @@ describe('createRemoteRuntimePtyTransport', () => {
       subscriptionSendBinary.mockClear()
 
       // Why: replacement input stays disabled until terminal.resolvePane proves the new handle belongs to this pane.
-      expect(transport.sendInput('x')).toBe(false)
+      expect(transport.sendInput('x', 'driving')).toBe(false)
       vi.advanceTimersByTime(8)
 
       const inputFrames = subscriptionSendBinary.mock.calls
diff --git a/src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-stale-handle-recovery.test.ts b/src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-stale-handle-recovery.test.ts
index 53c1921fe745..cec529588521 100644
--- a/src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-stale-handle-recovery.test.ts
+++ b/src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-stale-handle-recovery.test.ts
@@ -226,7 +226,7 @@ describe('createRemoteRuntimePtyTransport', () => {
     if (!sendInputAccepted) {
       throw new Error('Expected acknowledged remote terminal input')
     }
-    const pendingSend = sendInputAccepted('sent-before-rebind')
+    const pendingSend = sendInputAccepted('sent-before-rebind', 'driving')
     await vi.waitFor(() =>
       expect(runtimeCall).toHaveBeenCalledWith(expect.objectContaining({ method: 'terminal.send' }))
     )
@@ -293,7 +293,7 @@ describe('createRemoteRuntimePtyTransport', () => {
     if (!sendInputAccepted) {
       throw new Error('Expected acknowledged remote terminal input')
     }
-    const pendingSend = sendInputAccepted('sent-before-close')
+    const pendingSend = sendInputAccepted('sent-before-close', 'driving')
     await vi.waitFor(() =>
       expect(runtimeCall).toHaveBeenCalledWith(expect.objectContaining({ method: 'terminal.send' }))
     )
@@ -390,7 +390,7 @@ describe('createRemoteRuntimePtyTransport', () => {
       if (!sendInputAccepted) {
         throw new Error('Expected acknowledged remote terminal input')
       }
-      const pendingSend = sendInputAccepted('sent-before-stream-end')
+      const pendingSend = sendInputAccepted('sent-before-stream-end', 'driving')
       await vi.waitFor(() =>
         expect(runtimeCall).toHaveBeenCalledWith(
           expect.objectContaining({ method: 'terminal.send' })
diff --git a/src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-sticky-replacement-policy.test.ts b/src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-sticky-replacement-policy.test.ts
index 5a61a5587e67..ce689695bc02 100644
--- a/src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-sticky-replacement-policy.test.ts
+++ b/src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-sticky-replacement-policy.test.ts
@@ -76,7 +76,7 @@ describe('createRemoteRuntimePtyTransport', () => {
       if (!sendInputAccepted) {
         throw new Error('Expected acknowledged remote terminal input')
       }
-      const pendingSend = sendInputAccepted('sent-before-stream-end')
+      const pendingSend = sendInputAccepted('sent-before-stream-end', 'driving')
       await vi.waitFor(() =>
         expect(runtimeCall).toHaveBeenCalledWith(
           expect.objectContaining({ method: 'terminal.send' })
@@ -361,7 +361,10 @@ describe('createRemoteRuntimePtyTransport', () => {
     if (!sendInputAccepted) {
       throw new Error('Expected acknowledged remote terminal input')
     }
-    const sends = Promise.all([sendInputAccepted('first'), sendInputAccepted('second')])
+    const sends = Promise.all([
+      sendInputAccepted('first', 'driving'),
+      sendInputAccepted('second', 'driving')
+    ])
     await vi.waitFor(() => expect(hostListCalls).toBe(1))
     await expect(sends).resolves.toEqual([false, false])
 
diff --git a/src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-stream-reconnect.test.ts b/src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-stream-reconnect.test.ts
index e0b85414e3f8..c3d61a8b3d37 100644
--- a/src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-stream-reconnect.test.ts
+++ b/src/renderer/src/components/terminal-pane/remote-runtime-pty-transport-stream-reconnect.test.ts
@@ -466,7 +466,7 @@ describe('createRemoteRuntimePtyTransport', () => {
       })
 
       expect(transport.isConnected()).toBe(false)
-      expect(transport.sendInput(`detached-${cycle}`)).toBe(false)
+      expect(transport.sendInput(`detached-${cycle}`, 'driving')).toBe(false)
       expect(unsubscribeByEpoch[cycle]).toHaveBeenCalledTimes(1)
       await vi.waitFor(() => expect(runtimeSubscribe).toHaveBeenCalledTimes(cycle + 2))
       await vi.waitFor(() => expect(latestSubscribePayload().terminal).toBe('terminal-1'))
@@ -542,7 +542,7 @@ describe('createRemoteRuntimePtyTransport', () => {
       expect(disconnectedState?.phase).toBe('disconnected')
       expect(transport.getPtyId()).toBe('remote:env-1@@terminal-1')
       expect(transport.isConnected()).toBe(false)
-      expect(transport.sendInput('must not reach a stale socket')).toBe(false)
+      expect(transport.sendInput('must not reach a stale socket', 'driving')).toBe(false)
       expect(onError).not.toHaveBeenCalled()
       await vi.advanceTimersByTimeAsync(5 * 60_000)
       expect(runtimeSubscribe).toHaveBeenCalledTimes(callsAtCutoff)
@@ -591,7 +591,7 @@ describe('createRemoteRuntimePtyTransport', () => {
     subscriptionCallbacks?.onClose?.()
     await vi.waitFor(() => expect(runtimeSubscribe).toHaveBeenCalledTimes(2))
     expect(transport.claimViewport?.(101, 33)).toBe(true)
-    const accepted = transport.sendInputAccepted?.('\x03')
+    const accepted = transport.sendInputAccepted?.('\x03', 'driving')
     await Promise.resolve()
     rejectReconnect(new Error('reconnect failed'))
 
@@ -610,7 +610,7 @@ describe('createRemoteRuntimePtyTransport', () => {
     const { streamId } = latestSubscribePayload()
 
     expect(transport.claimViewport?.(101, 33)).toBe(true)
-    const accepted = transport.sendInputAccepted?.('x')
+    const accepted = transport.sendInputAccepted?.('x', 'driving')
     subscriptionCallbacks?.onResponse({
       ok: true,
       result: { type: 'end', streamId }
diff --git a/src/renderer/src/components/terminal-pane/remote-runtime-pty-transport.ts b/src/renderer/src/components/terminal-pane/remote-runtime-pty-transport.ts
index 17d78934e530..a8e8a727ad88 100644
--- a/src/renderer/src/components/terminal-pane/remote-runtime-pty-transport.ts
+++ b/src/renderer/src/components/terminal-pane/remote-runtime-pty-transport.ts
@@ -2583,6 +2583,8 @@ export function createRemoteRuntimePtyTransport(
       storedCallbacks = {}
     },
 
+    // Why no kind: terminal.send has no launch kind, and its query-reply kind is for mobile
+    // clients, so the host classifies a desktop's bytes itself.
     sendInput(data: string): boolean {
       if (!connected || !handle || recoveryBlocksIo()) {
         return false
diff --git a/src/renderer/src/components/terminal-pane/scan22-ssh-new-tab-disposed-spawn-kill.repro.test.ts b/src/renderer/src/components/terminal-pane/scan22-ssh-new-tab-disposed-spawn-kill.repro.test.ts
new file mode 100644
index 000000000000..ed142fea393e
--- /dev/null
+++ b/src/renderer/src/components/terminal-pane/scan22-ssh-new-tab-disposed-spawn-kill.repro.test.ts
@@ -0,0 +1,50 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { installIpcPtyWindow, restorePtySpecWindow } from './pty-transport-test-harness'
+
+// Scan-22 repro: a new SSH tab whose pane remounts while its first pty:spawn is in flight.
+// Main's pane-spawn reservation hands the successor the SAME PTY id; the disposed
+// predecessor then killed it on resolve (tab closes on pty-exit, or goes input-dead).
+describe('scan22: disposed mid-spawn SSH transport vs successor on the same PTY', () => {
+  const originalWindow = (globalThis as { window?: typeof window }).window
+  beforeEach(() => {
+    vi.resetModules()
+    installIpcPtyWindow(originalWindow, {})
+  })
+  afterEach(() => restorePtySpecWindow(originalWindow))
+
+  it('does not kill the PTY the remounted successor is bound to', async () => {
+    const { createIpcPtyTransport } = await import('./pty-transport')
+    let resolveFirst: (value: { id: string }) => void = () => {}
+    const spawn = vi.mocked(window.api.pty.spawn)
+    spawn.mockImplementationOnce(
+      () =>
+        new Promise((resolve) => {
+          resolveFirst = resolve
+        })
+    )
+    // Successor is handed the same id by main's (worktree, connection, paneKey) reservation.
+    spawn.mockResolvedValueOnce({ id: 'ssh-conn@@pty-7' })
+    // As installPtyInputRecovery wires it: the tab and its leaf still exist in the store.
+    const paneOptions = {
+      connectionId: 'ssh-conn',
+      worktreeId: 'wt',
+      tabId: 'tab-2',
+      leafId: 'leaf-a',
+      retainDisposedSpawn: () => true
+    }
+
+    const first = createIpcPtyTransport(paneOptions)
+    const firstConnect = first.connect({ url: '', callbacks: {} })
+    // Pane remount (generation bump / recovery / park flip) while spawn is in flight.
+    first.destroy?.()
+
+    const successor = createIpcPtyTransport(paneOptions)
+    await successor.connect({ url: '', callbacks: {} })
+    expect(successor.getPtyId()).toBe('ssh-conn@@pty-7')
+
+    resolveFirst({ id: 'ssh-conn@@pty-7' })
+    await firstConnect
+
+    expect(window.api.pty.kill).not.toHaveBeenCalledWith('ssh-conn@@pty-7')
+  })
+})
diff --git a/src/renderer/src/components/terminal-pane/sleeping-record-park-exemption.test.ts b/src/renderer/src/components/terminal-pane/sleeping-record-park-exemption.test.ts
index 37fe50db1a16..79e2ec738f3f 100644
--- a/src/renderer/src/components/terminal-pane/sleeping-record-park-exemption.test.ts
+++ b/src/renderer/src/components/terminal-pane/sleeping-record-park-exemption.test.ts
@@ -75,4 +75,22 @@ describe('selectSleepingRecordParkExemptTabIds', () => {
 
     expect([...selectSleepingRecordParkExemptTabIds(stateWith({}), 'wt-1')]).toEqual([])
   })
+
+  // Why: pins #16308's incidental effect — a finished turn's idle anchor no longer pins its hidden tab mounted.
+  it('lets a finished turn park but keeps running and interrupted turns mounted', () => {
+    const note = (tabId: string, overrides: Partial<SleepingAgentSessionRecord>) =>
+      sleepingRecord({ paneKey: `${tabId}:${LEAF_ID}`, origin: 'live', ...overrides })
+    const records = {
+      a: note('tab-idle-anchor', { state: 'done' }),
+      b: note('tab-running', { state: 'working' }),
+      c: note('tab-interrupted', { state: 'done', interrupted: true }),
+      d: note('tab-quit', { state: 'done', origin: 'quit' })
+    }
+
+    expect([...selectSleepingRecordParkExemptTabIds(stateWith(records), 'wt-1')]).toEqual([
+      'tab-running',
+      'tab-interrupted',
+      'tab-quit'
+    ])
+  })
 })
diff --git a/src/renderer/src/components/terminal-pane/sleeping-record-park-exemption.ts b/src/renderer/src/components/terminal-pane/sleeping-record-park-exemption.ts
index 4859edade2b0..7e572ab6904f 100644
--- a/src/renderer/src/components/terminal-pane/sleeping-record-park-exemption.ts
+++ b/src/renderer/src/components/terminal-pane/sleeping-record-park-exemption.ts
@@ -1,6 +1,6 @@
 import type { SleepingAgentSessionRecord } from '../../../../shared/agent-session-resume'
 import { parseLegacyNumericPaneKey, parsePaneKey } from '../../../../shared/stable-pane-id'
-import { isPassiveCompletedHibernationEvidence } from '../../lib/sleeping-agent-pane-ownership'
+import { activationTreatsNoteAsFinished } from '../../lib/sleeping-agent-pane-ownership'
 import { createWorktreeRecordSelector } from '@/store/worktree-record-selector-cache'
 
 const EMPTY_TAB_IDS: ReadonlySet<string> = new Set()
@@ -11,8 +11,8 @@ type SleepingRecordParkExemptionState = {
 
 /** Tab ids whose panes own a sleeping record a mount can actually consume.
  *  Why: a parked pane can never cold-restore, so per-tab parks must exempt
- *  these — but only these: passive-completed records never resume,
- *  and exempting them would pin a hidden pane mounted indefinitely.
+ *  these — but not notes activation treats as finished: exempting those
+ *  would pin every hidden finished-agent pane mounted indefinitely.
  *
  *  Why memoized on the record map's identity (STA-7552): zustand re-runs every
  *  mounted subscriber's selector on every store write, so an unrelated pane
@@ -36,7 +36,7 @@ export const selectSleepingRecordParkExemptTabIds = createWorktreeRecordSelector
       if (!record || record.worktreeId !== worktreeId) {
         continue
       }
-      if (isPassiveCompletedHibernationEvidence(record)) {
+      if (activationTreatsNoteAsFinished(record)) {
         continue
       }
       // Why: malformed pane keys must yield no owner instead of a truncated tab id.
diff --git a/src/renderer/src/components/terminal-pane/terminal-captured-input-dispatch.test.ts b/src/renderer/src/components/terminal-pane/terminal-captured-input-dispatch.test.ts
index df997a87afc7..05513b53c66f 100644
--- a/src/renderer/src/components/terminal-pane/terminal-captured-input-dispatch.test.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-captured-input-dispatch.test.ts
@@ -27,7 +27,7 @@ describe('sendCapturedTerminalInput', () => {
           data: '\r'
         })
       ).toBe(true)
-      expect(transport.sendInput).toHaveBeenCalledWith('\r')
+      expect(transport.sendInput).toHaveBeenCalledWith('\r', 'driving')
     }
   )
 
diff --git a/src/renderer/src/components/terminal-pane/terminal-captured-input-dispatch.ts b/src/renderer/src/components/terminal-pane/terminal-captured-input-dispatch.ts
index 7a2780a5d32e..5409d5420de5 100644
--- a/src/renderer/src/components/terminal-pane/terminal-captured-input-dispatch.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-captured-input-dispatch.ts
@@ -32,7 +32,7 @@ export function sendCapturedTerminalInput({
   ) {
     return false
   }
-  const sent = capturedTransport.sendInput(data)
+  const sent = capturedTransport.sendInput(data, 'driving')
   if (sent) {
     onAccepted?.()
   }
diff --git a/src/renderer/src/components/terminal-pane/terminal-chat-ownership-lifecycle.test.tsx b/src/renderer/src/components/terminal-pane/terminal-chat-ownership-lifecycle.test.tsx
new file mode 100644
index 000000000000..350c27667fa5
--- /dev/null
+++ b/src/renderer/src/components/terminal-pane/terminal-chat-ownership-lifecycle.test.tsx
@@ -0,0 +1,269 @@
+// @vitest-environment happy-dom
+import { act, cleanup, renderHook } from '@testing-library/react'
+import { useEffect, useState } from 'react'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { TerminalLayoutSnapshot } from '../../../../shared/terminal-tab-types'
+import { useTerminalPaneChatState } from './use-terminal-pane-chat-state'
+import { useTerminalPaneLayoutPersistence } from './use-terminal-pane-layout-persistence'
+import { resolveNativeChatLeafRoute } from '../native-chat/native-chat-leaf-routing'
+import { detachTerminalLayoutLeaf } from './terminal-layout-leaf-detach'
+import { parseWorkspaceSession } from '../../../../shared/workspace-session-schema'
+import type { RemotePaneLayoutPusher } from './remote-pane-layout-push'
+
+const LEFT = '11111111-1111-4111-8111-111111111111'
+const RIGHT = '22222222-2222-4222-8222-222222222222'
+const mocks = vi.hoisted(() => {
+  const layouts: Record<string, TerminalLayoutSnapshot> = {}
+  const tab = { id: 'tab', entityId: 'tab', contentType: 'terminal', viewMode: 'chat' }
+  const state = {
+    terminalLayoutsByTabId: layouts,
+    unifiedTabsByWorktree: { wt: [tab] },
+    tabsByWorktree: {},
+    settings: { experimentalNativeChat: true },
+    pendingCodexPaneRestartIds: [],
+    runtimePaneTitlesByTabId: { tab: { 1: 'codex', 2: 'codex' } },
+    agentStatusByPaneKey: {},
+    paneForegroundAgentByPaneKey: {},
+    setTabLayout: (_id: string, layout: TerminalLayoutSnapshot) => {
+      layouts.tab = layout
+    },
+    setTabViewMode: (_id: string, mode: string) => {
+      state.unifiedTabsByWorktree = { wt: [{ ...tab, viewMode: mode }] }
+    },
+    toggleTabViewMode: (id: string): void => {
+      state.setTabViewMode(
+        id,
+        state.unifiedTabsByWorktree.wt[0].viewMode === 'chat' ? 'terminal' : 'chat'
+      )
+    }
+  }
+  return { state }
+})
+vi.mock('../../store', async () => {
+  const { create } = await import('zustand')
+  const { terminalLayoutEqual } = await import('@/lib/terminal-layout-equality')
+  mocks.state.setTabLayout = (id, layout) => {
+    if (terminalLayoutEqual(mocks.state.terminalLayoutsByTabId[id], layout)) {
+      return
+    }
+    mocks.state.terminalLayoutsByTabId = { ...mocks.state.terminalLayoutsByTabId, [id]: layout }
+    useAppStore.setState({ terminalLayoutsByTabId: mocks.state.terminalLayoutsByTabId })
+  }
+  mocks.state.setTabViewMode = (_id, mode) => {
+    mocks.state.unifiedTabsByWorktree = {
+      wt: [{ ...mocks.state.unifiedTabsByWorktree.wt[0], viewMode: mode }]
+    }
+    useAppStore.setState({ unifiedTabsByWorktree: mocks.state.unifiedTabsByWorktree })
+  }
+  const useAppStore = create(() => mocks.state)
+  return { useAppStore }
+})
+vi.mock('@/runtime/web-runtime-session', () => ({ clearWebRuntimeTerminalBuffer: vi.fn() }))
+
+function makeFixture(paneIds = [1, 2], remotePusher?: RemotePaneLayoutPusher) {
+  const container = document.createElement('div')
+  const split = document.createElement('div')
+  split.className = 'pane-split'
+  container.append(split)
+  const panes = [LEFT, RIGHT].map((leafId, index) => {
+    const element = document.createElement('div')
+    element.className = 'pane'
+    element.dataset.paneId = String(paneIds[index])
+    element.dataset.leafId = leafId
+    split.append(element)
+    return { id: paneIds[index], leafId, container: element }
+  })
+  const manager = {
+    getPanes: () => panes,
+    getActivePane: () => panes[0],
+    getLeafIdMap: () => new Map(panes.map((pane) => [pane.id, pane.leafId]))
+  }
+  return {
+    managerRef: { current: manager },
+    containerRef: { current: container },
+    nativeChatTranscriptIsLocalReadable: true,
+    onAgentExitedRef: { current: vi.fn() },
+    paneCount: 2,
+    tabId: 'tab',
+    worktreeId: 'wt',
+    tabWideAgentHintLeafId: null,
+    setTabWideAgentHintLeafId: vi.fn(),
+    clearedScrollbackLeafIdsRef: { current: new Set<string>() },
+    expandedPaneIdRef: { current: null },
+    paneTitles: {},
+    paneTitlesRef: { current: {} },
+    paneTransportsRef: { current: new Map() },
+    remotePaneLayoutPusherRef: { current: remotePusher ?? null },
+    removedTitleLeafIdsRef: { current: new Set<string>() },
+    setPaneTitles: vi.fn()
+  }
+}
+function useFixture(fixture: ReturnType<typeof makeFixture>, initialOwner: string | null) {
+  const [chatLeafId, setChatLeafId] = useState(initialOwner)
+  const input = { ...fixture, chatLeafId, setChatLeafId }
+  const chat = useTerminalPaneChatState(
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The fixture supplies every field read by the chat hook.
+    input as unknown as Parameters<typeof useTerminalPaneChatState>[0]
+  )
+  const layoutInput = { ...input, ...chat, setTabLayout: mocks.state.setTabLayout }
+  const layout = useTerminalPaneLayoutPersistence(
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The fixture supplies every field read by the persistence hook.
+    layoutInput as unknown as Parameters<typeof useTerminalPaneLayoutPersistence>[0]
+  )
+  const activeLeafId = fixture.managerRef.current.getActivePane()?.leafId ?? null
+  const mounted = fixture.managerRef.current.getPanes().some((pane) => pane.leafId === chatLeafId)
+  const { applyNativeChatLeafRoute, isChatViewMode, isChatEligibleForLeaf } = chat
+  useEffect(() => {
+    applyNativeChatLeafRoute(
+      resolveNativeChatLeafRoute({
+        isChatViewMode,
+        chatLeafId,
+        activeLeafId,
+        chatLeafStillMounted: mounted,
+        activeLeafIsEligible: isChatEligibleForLeaf(activeLeafId)
+      })
+    )
+  }, [
+    applyNativeChatLeafRoute,
+    isChatEligibleForLeaf,
+    isChatViewMode,
+    chatLeafId,
+    activeLeafId,
+    mounted
+  ])
+  return { ...chat, ...layout, chatLeafId, setChatLeafId }
+}
+
+beforeEach(() => {
+  mocks.state.settings.experimentalNativeChat = true
+  mocks.state.setTabViewMode('tab', 'chat')
+  mocks.state.setTabLayout('tab', {
+    root: {
+      type: 'split',
+      direction: 'vertical',
+      first: { type: 'leaf', leafId: LEFT },
+      second: { type: 'leaf', leafId: RIGHT }
+    },
+    activeLeafId: LEFT,
+    expandedLeafId: null,
+    chatLeafId: RIGHT
+  })
+})
+afterEach(cleanup)
+
+describe('terminal chat ownership lifecycle', () => {
+  it('batches a pane toggle into chat and back without selecting the active sibling', () => {
+    mocks.state.setTabViewMode('tab', 'terminal')
+    const fixture = makeFixture()
+    const hook = renderHook(() => useFixture(fixture, null))
+    act(() => hook.result.current.toggleNativeChatForLeaf(RIGHT))
+    expect(hook.result.current.chatLeafId).toBe(RIGHT)
+    expect(mocks.state.unifiedTabsByWorktree.wt[0].viewMode).toBe('chat')
+    expect(mocks.state.terminalLayoutsByTabId.tab.chatLeafId).toBe(RIGHT)
+    act(() => hook.result.current.toggleNativeChatForLeaf(RIGHT))
+    expect(hook.result.current.chatLeafId).toBeNull()
+    expect(mocks.state.unifiedTabsByWorktree.wt[0].viewMode).toBe('terminal')
+    expect(mocks.state.terminalLayoutsByTabId.tab.chatLeafId).toBeUndefined()
+  })
+
+  it('preserves the saved owner when this client disables native chat', () => {
+    const push = vi.fn()
+    const fixture = makeFixture(undefined, { push })
+    mocks.state.terminalLayoutsByTabId.tab.ptyIdsByLeafId = {
+      [LEFT]: 'remote:host:terminal',
+      [RIGHT]: 'remote:host:chat'
+    }
+    const hook = renderHook(() => useFixture(fixture, RIGHT))
+    mocks.state.settings.experimentalNativeChat = false
+    hook.rerender()
+    hook.result.current.persistLayoutSnapshot()
+    expect(hook.result.current.effectiveChatViewMode).toBe(false)
+    expect(mocks.state.unifiedTabsByWorktree.wt[0].viewMode).toBe('chat')
+    expect(mocks.state.terminalLayoutsByTabId.tab.chatLeafId).toBe(RIGHT)
+    expect(push).toHaveBeenLastCalledWith(
+      expect.objectContaining({
+        layout: expect.objectContaining({ chatLeafId: RIGHT })
+      })
+    )
+  })
+
+  it('clears ownership when the tab-bar turns chat off, then targets the active sibling', () => {
+    const fixture = makeFixture()
+    const hook = renderHook(() => useFixture(fixture, RIGHT))
+    act(() => mocks.state.setTabViewMode('tab', 'terminal'))
+    hook.rerender()
+    expect(hook.result.current.chatLeafId).toBeNull()
+    expect(mocks.state.terminalLayoutsByTabId.tab.chatLeafId).toBeUndefined()
+    act(() => mocks.state.setTabViewMode('tab', 'chat'))
+    hook.rerender()
+    expect(hook.result.current.chatLeafId).toBe(LEFT)
+  })
+
+  it('keeps the current owner when a mount-time callback captures a pane for detaching', () => {
+    const fixture = makeFixture()
+    const hook = renderHook(() => useFixture(fixture, RIGHT))
+    const mountedPersist = hook.result.current.persistLayoutSnapshot
+    act(() => hook.result.current.toggleNativeChatForLeaf(LEFT))
+    expect(hook.result.current.chatLeafId).toBe(LEFT)
+    mountedPersist()
+    const detached = detachTerminalLayoutLeaf(mocks.state.terminalLayoutsByTabId.tab, LEFT)
+    expect(detached?.detachedLayout.chatLeafId).toBe(LEFT)
+    expect(detached?.sourceLayout.chatLeafId).toBeUndefined()
+  })
+
+  it('does not resurrect an owner after chat is turned off and the split is resized', () => {
+    const fixture = makeFixture()
+    const hook = renderHook(() => useFixture(fixture, RIGHT))
+    const mountedPersist = hook.result.current.persistLayoutSnapshot
+    act(() => hook.result.current.switchNativeChatToTerminal())
+    mountedPersist()
+    expect(mocks.state.terminalLayoutsByTabId.tab.chatLeafId).toBeUndefined()
+  })
+
+  it('closing the chat leaf leaves an eligible terminal sibling in terminal mode', () => {
+    const fixture = makeFixture()
+    const hook = renderHook(() => useFixture(fixture, RIGHT))
+    fixture.managerRef.current.getPanes().pop()?.container.remove()
+    hook.rerender()
+    expect(hook.result.current.chatLeafId).toBeNull()
+    expect(mocks.state.unifiedTabsByWorktree.wt[0].viewMode).toBe('terminal')
+  })
+
+  it('restores chat on the right with the left active and different numeric pane IDs', () => {
+    const initialFixture = makeFixture()
+    const original = renderHook(() => useFixture(initialFixture, RIGHT))
+    original.result.current.persistLayoutSnapshot()
+    const session = parseWorkspaceSession(
+      JSON.parse(
+        JSON.stringify({
+          activeRepoId: null,
+          activeWorktreeId: 'wt',
+          activeTabId: 'tab',
+          tabsByWorktree: {},
+          terminalLayoutsByTabId: mocks.state.terminalLayoutsByTabId
+        })
+      )
+    )
+    expect(session.ok).toBe(true)
+    if (!session.ok) {
+      throw new Error('session did not parse')
+    }
+    original.unmount()
+    const saved = session.value.terminalLayoutsByTabId.tab!
+    mocks.state.setTabLayout('tab', saved)
+    expect(saved.activeLeafId).toBe(LEFT)
+    expect(saved.root).toMatchObject({ first: { leafId: LEFT }, second: { leafId: RIGHT } })
+    const restored = makeFixture([20, 10])
+    const hook = renderHook(() => useFixture(restored, saved.chatLeafId ?? null))
+    const chatPane = restored.managerRef.current
+      .getPanes()
+      .find((pane) => pane.leafId === hook.result.current.chatLeafId)
+    expect(chatPane?.id).toBe(10)
+    // Closing the restored chat leaf must leave the left terminal untouched.
+    restored.managerRef.current.getPanes().pop()?.container.remove()
+    hook.rerender()
+    expect(restored.managerRef.current.getPanes().map((pane) => pane.leafId)).toEqual([LEFT])
+    expect(hook.result.current.chatLeafId).toBeNull()
+    expect(mocks.state.unifiedTabsByWorktree.wt[0].viewMode).toBe('terminal')
+  })
+})
diff --git a/src/renderer/src/components/terminal-pane/terminal-cold-park-withheld-tabs.test.ts b/src/renderer/src/components/terminal-pane/terminal-cold-park-withheld-tabs.test.ts
index 75ca204c5cde..7fe3ca858de5 100644
--- a/src/renderer/src/components/terminal-pane/terminal-cold-park-withheld-tabs.test.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-cold-park-withheld-tabs.test.ts
@@ -22,6 +22,7 @@ function pinnedRecord(pinnedUntilMs: number | null): ParkVerdictFlipRecord {
     windowStartMs: 0,
     flips: 0,
     notified: false,
+    lastFlipMs: 0,
     burstStartMs: 0,
     burstFlips: 0,
     pinnedUntilMs
diff --git a/src/renderer/src/components/terminal-pane/terminal-drop-handler.test.ts b/src/renderer/src/components/terminal-pane/terminal-drop-handler.test.ts
index ee6a492f642d..26e8f21d3fe5 100644
--- a/src/renderer/src/components/terminal-pane/terminal-drop-handler.test.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-drop-handler.test.ts
@@ -156,7 +156,8 @@ describe('handleTerminalFileDrop', () => {
       { assertCurrent: expect.any(Function) }
     )
     expect(sendInput).toHaveBeenCalledWith(
-      wrapTerminalBracketedPasteText('/remote/repo/.orca/drops/logo.png')
+      wrapTerminalBracketedPasteText('/remote/repo/.orca/drops/logo.png'),
+      'driving'
     )
     expect(focus).toHaveBeenCalled()
     expect(mocks.recordTerminalUserInputForLeaf).toHaveBeenCalledWith('tab-1', 'leaf-1')
@@ -252,7 +253,8 @@ describe('handleTerminalFileDrop', () => {
       { assertCurrent: expect.any(Function) }
     )
     expect(sendInput).toHaveBeenCalledWith(
-      wrapTerminalBracketedPasteText('\\\\server\\share\\repo\\.orca\\drops\\logo.png')
+      wrapTerminalBracketedPasteText('\\\\server\\share\\repo\\.orca\\drops\\logo.png'),
+      'driving'
     )
   })
 
@@ -308,7 +310,7 @@ describe('handleTerminalFileDrop', () => {
       '/remote/repo/.orca/drops',
       { assertCurrent: expect.any(Function) }
     )
-    expect(sendInput).toHaveBeenCalledWith('/remote/repo/.orca/drops/spec.pdf ')
+    expect(sendInput).toHaveBeenCalledWith('/remote/repo/.orca/drops/spec.pdf ', 'driving')
   })
 
   it('keeps explicit local worktree drops local while a runtime is focused', async () => {
@@ -335,7 +337,7 @@ describe('handleTerminalFileDrop', () => {
     })
 
     expect(mocks.importExternalPathsToRuntime).not.toHaveBeenCalled()
-    expect(sendInput).toHaveBeenCalledWith('/Users/me/spec.pdf ')
+    expect(sendInput).toHaveBeenCalledWith('/Users/me/spec.pdf ', 'driving')
     expect(focus).toHaveBeenCalled()
   })
 
@@ -382,8 +384,12 @@ describe('handleTerminalFileDrop', () => {
     })
 
     expect(mocks.importExternalPathsToRuntime).not.toHaveBeenCalled()
-    expect(sendInput).toHaveBeenNthCalledWith(1, "'/mnt/c/Users/alice/Desktop/notes one.txt' ")
-    expect(sendInput).toHaveBeenNthCalledWith(2, '/home/alice/repo/README.md ')
+    expect(sendInput).toHaveBeenNthCalledWith(
+      1,
+      "'/mnt/c/Users/alice/Desktop/notes one.txt' ",
+      'driving'
+    )
+    expect(sendInput).toHaveBeenNthCalledWith(2, '/home/alice/repo/README.md ', 'driving')
     expect(mocks.recordTerminalUserInputForLeaf).toHaveBeenCalledWith('tab-1', 'leaf-1')
   })
 
@@ -413,7 +419,7 @@ describe('handleTerminalFileDrop', () => {
       data: { paths: ['/Users/me/spec.pdf'], target: 'terminal' }
     })
 
-    expect(sendInputAccepted).toHaveBeenCalledWith('/Users/me/spec.pdf ')
+    expect(sendInputAccepted).toHaveBeenCalledWith('/Users/me/spec.pdf ', 'driving')
     expect(sendInput).not.toHaveBeenCalled()
     expect(focus).toHaveBeenCalled()
     expect(mocks.recordTerminalUserInputForLeaf).toHaveBeenCalledWith('tab-1', 'leaf-1')
@@ -452,7 +458,7 @@ describe('handleTerminalFileDrop', () => {
 
     expect(activeSendInput).not.toHaveBeenCalled()
     expect(activeFocus).not.toHaveBeenCalled()
-    expect(targetSendInput).toHaveBeenCalledWith('/Users/me/spec.pdf ')
+    expect(targetSendInput).toHaveBeenCalledWith('/Users/me/spec.pdf ', 'driving')
     expect(targetFocus).toHaveBeenCalled()
     expect(mocks.recordTerminalUserInputForLeaf).toHaveBeenCalledWith('tab-1', 'leaf-target')
   })
@@ -508,8 +514,8 @@ describe('handleTerminalFileDrop', () => {
       worktreePath: '\\\\wsl.localhost\\Ubuntu-24.04\\home\\user\\repo'
     })
     expect(sendInput.mock.calls).toEqual([
-      ["'/mnt/c/Users/Name/My Project/file.txt' "],
-      ['/home/user/repo/README.md ']
+      ["'/mnt/c/Users/Name/My Project/file.txt' ", 'driving'],
+      ['/home/user/repo/README.md ', 'driving']
     ])
     expect(focus).toHaveBeenCalled()
     expect(mocks.recordTerminalUserInputForLeaf).toHaveBeenCalledWith('tab-1', 'leaf-1')
@@ -608,7 +614,7 @@ describe('handleTerminalFileDrop', () => {
       expectedSshTargetId: 'ssh-win',
       expectedSshConnectionGeneration: 4
     })
-    expect(sendInput).toHaveBeenCalledWith('"C:\\Remote Repo\\A&B.txt" ')
+    expect(sendInput).toHaveBeenCalledWith('"C:\\Remote Repo\\A&B.txt" ', 'driving')
     expect(focus).toHaveBeenCalled()
     expect(mocks.recordTerminalUserInputForLeaf).toHaveBeenCalledWith('tab-1', 'leaf-1')
   })
@@ -684,6 +690,6 @@ describe('handleTerminalFileDrop', () => {
       data: { paths: ["/Users/me/it's here.txt"], target: 'terminal' }
     })
 
-    expect(sendInput).toHaveBeenCalledWith("'/remote/repo/it'\\''s here.txt' ")
+    expect(sendInput).toHaveBeenCalledWith("'/remote/repo/it'\\''s here.txt' ", 'driving')
   })
 })
diff --git a/src/renderer/src/components/terminal-pane/terminal-drop-internal-handler.test.ts b/src/renderer/src/components/terminal-pane/terminal-drop-internal-handler.test.ts
index 2c1c2652e87c..cd42929c2480 100644
--- a/src/renderer/src/components/terminal-pane/terminal-drop-internal-handler.test.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-drop-internal-handler.test.ts
@@ -116,7 +116,10 @@ describe('handleInternalTerminalFileDrop', () => {
     })
 
     expect(result).toEqual({ status: 'pasted', pathCount: 2 })
-    expect(sendInput.mock.calls).toEqual([['/repo/a.ts '], ["'/repo/my file.ts' "]])
+    expect(sendInput.mock.calls).toEqual([
+      ['/repo/a.ts ', 'driving'],
+      ["'/repo/my file.ts' ", 'driving']
+    ])
     expect(mocks.recordTerminalUserInputForLeaf).toHaveBeenCalledWith('tab-1', 'leaf-1')
     expect(focus).toHaveBeenCalled()
   })
@@ -155,7 +158,7 @@ describe('handleInternalTerminalFileDrop', () => {
 
     expect(result).toEqual({ status: 'cancelled', reason: 'target-stale', pathCount: 1 })
     expect(sendInputAccepted).toHaveBeenCalledTimes(1)
-    expect(sendInputAccepted).toHaveBeenCalledWith('/repo/a.ts ')
+    expect(sendInputAccepted).toHaveBeenCalledWith('/repo/a.ts ', 'driving')
     expect(sendInput).not.toHaveBeenCalled()
     expect(replacementSendInput).not.toHaveBeenCalled()
     expect(mocks.recordTerminalUserInputForLeaf).toHaveBeenCalledWith('tab-1', 'leaf-1')
@@ -187,7 +190,7 @@ describe('handleInternalTerminalFileDrop', () => {
     })
 
     expect(result).toEqual({ status: 'pasted', pathCount: 1 })
-    expect(sendInputAccepted).toHaveBeenCalledWith('/repo/a.ts ')
+    expect(sendInputAccepted).toHaveBeenCalledWith('/repo/a.ts ', 'driving')
     expect(sendInput).not.toHaveBeenCalled()
     expect(mocks.recordTerminalUserInputForLeaf).toHaveBeenCalledWith('tab-1', 'leaf-1')
     expect(focus).toHaveBeenCalled()
@@ -254,7 +257,7 @@ describe('handleInternalTerminalFileDrop', () => {
     })
 
     expect(result).toEqual({ status: 'pasted', pathCount: 1 })
-    expect(sendInput).toHaveBeenCalledWith('"C:\\repo\\a&b.txt" ')
+    expect(sendInput).toHaveBeenCalledWith('"C:\\repo\\a&b.txt" ', 'driving')
   })
 
   it('uses SSH remote platform metadata for Windows internal file drops', async () => {
@@ -293,7 +296,7 @@ describe('handleInternalTerminalFileDrop', () => {
     })
 
     expect(result).toEqual({ status: 'pasted', pathCount: 1 })
-    expect(sendInput).toHaveBeenCalledWith('"C:\\Remote Repo\\A&B.txt" ')
+    expect(sendInput).toHaveBeenCalledWith('"C:\\Remote Repo\\A&B.txt" ', 'driving')
     expect(mocks.recordTerminalUserInputForLeaf).toHaveBeenCalledWith('tab-1', 'leaf-1')
     expect(focus).toHaveBeenCalled()
   })
@@ -334,7 +337,7 @@ describe('handleInternalTerminalFileDrop', () => {
     })
 
     expect(result).toEqual({ status: 'pasted', pathCount: 1 })
-    expect(sendInput).toHaveBeenCalledWith("'/remote/repo/it'\\''s here.txt' ")
+    expect(sendInput).toHaveBeenCalledWith("'/remote/repo/it'\\''s here.txt' ", 'driving')
     expect(mocks.recordTerminalUserInputForLeaf).toHaveBeenCalledWith('tab-1', 'leaf-1')
     expect(focus).toHaveBeenCalled()
   })
@@ -387,7 +390,7 @@ describe('handleInternalTerminalFileDrop', () => {
     expect(result).toEqual({ status: 'pasted', pathCount: 1 })
     expect(activeSendInput).not.toHaveBeenCalled()
     expect(activeFocus).not.toHaveBeenCalled()
-    expect(targetSendInput).toHaveBeenCalledWith('/repo/drop-target.ts ')
+    expect(targetSendInput).toHaveBeenCalledWith('/repo/drop-target.ts ', 'driving')
     expect(targetFocus).toHaveBeenCalled()
     expect(mocks.recordTerminalUserInputForLeaf).toHaveBeenCalledWith('tab-1', 'leaf-target')
   })
diff --git a/src/renderer/src/components/terminal-pane/terminal-drop-path-writer.test.ts b/src/renderer/src/components/terminal-pane/terminal-drop-path-writer.test.ts
index 7fcb898d7eb1..20fe46c1fdac 100644
--- a/src/renderer/src/components/terminal-pane/terminal-drop-path-writer.test.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-drop-path-writer.test.ts
@@ -48,7 +48,7 @@ describe('terminal drop path writer', () => {
       failureReason: 'write-rejected'
     })
     expect(sendInputAccepted).toHaveBeenCalledTimes(1)
-    expect(sendInputAccepted).toHaveBeenCalledWith('/repo/a.ts ')
+    expect(sendInputAccepted).toHaveBeenCalledWith('/repo/a.ts ', 'driving')
     expect(sendInput).not.toHaveBeenCalled()
   })
 
@@ -70,7 +70,8 @@ describe('terminal drop path writer', () => {
     // Why: image attachment detection in terminal TUIs keys off bracketed paste
     // of the literal path — no shell-escaping, no trailing space.
     expect(sendInputAccepted).toHaveBeenCalledWith(
-      wrapTerminalBracketedPasteText('/repo/My Screenshot.png')
+      wrapTerminalBracketedPasteText('/repo/My Screenshot.png'),
+      'driving'
     )
   })
 
@@ -88,10 +89,11 @@ describe('terminal drop path writer', () => {
       targetShell: 'posix'
     })
 
-    expect(sendInputAccepted).toHaveBeenNthCalledWith(1, '/repo/a.ts ')
+    expect(sendInputAccepted).toHaveBeenNthCalledWith(1, '/repo/a.ts ', 'driving')
     expect(sendInputAccepted).toHaveBeenNthCalledWith(
       2,
-      wrapTerminalBracketedPasteText('/repo/shot.png')
+      wrapTerminalBracketedPasteText('/repo/shot.png'),
+      'driving'
     )
   })
 
@@ -113,9 +115,10 @@ describe('terminal drop path writer', () => {
     // non-image path would collide with it without an explicit separator.
     expect(sendInputAccepted).toHaveBeenNthCalledWith(
       1,
-      `${wrapTerminalBracketedPasteText('/repo/shot.png')} `
+      `${wrapTerminalBracketedPasteText('/repo/shot.png')} `,
+      'driving'
     )
-    expect(sendInputAccepted).toHaveBeenNthCalledWith(2, '/repo/a.ts ')
+    expect(sendInputAccepted).toHaveBeenNthCalledWith(2, '/repo/a.ts ', 'driving')
   })
 
   it('does not insert a separator between back-to-back image pastes', async () => {
@@ -136,11 +139,13 @@ describe('terminal drop path writer', () => {
     // TUI input between the two attachments.
     expect(sendInputAccepted).toHaveBeenNthCalledWith(
       1,
-      wrapTerminalBracketedPasteText('/repo/one.png')
+      wrapTerminalBracketedPasteText('/repo/one.png'),
+      'driving'
     )
     expect(sendInputAccepted).toHaveBeenNthCalledWith(
       2,
-      wrapTerminalBracketedPasteText('/repo/two.png')
+      wrapTerminalBracketedPasteText('/repo/two.png'),
+      'driving'
     )
   })
 
@@ -158,7 +163,10 @@ describe('terminal drop path writer', () => {
       targetShell: 'posix'
     })
 
-    expect(sendInputAccepted).toHaveBeenCalledWith("'/repo/a.png; touch /tmp/pwned #.png' ")
+    expect(sendInputAccepted).toHaveBeenCalledWith(
+      "'/repo/a.png; touch /tmp/pwned #.png' ",
+      'driving'
+    )
   })
 
   it('falls back to shell escaping for image paths with Windows shell metacharacters', async () => {
@@ -175,7 +183,7 @@ describe('terminal drop path writer', () => {
       targetShell: 'windows'
     })
 
-    expect(sendInputAccepted).toHaveBeenCalledWith('"C:\\Users\\me\\Pictures\\a&b.png" ')
+    expect(sendInputAccepted).toHaveBeenCalledWith('"C:\\Users\\me\\Pictures\\a&b.png" ', 'driving')
   })
 
   it('separates an image paste from a following image path that must be shell escaped', async () => {
@@ -194,9 +202,14 @@ describe('terminal drop path writer', () => {
 
     expect(sendInputAccepted).toHaveBeenNthCalledWith(
       1,
-      `${wrapTerminalBracketedPasteText('/repo/shot.png')} `
+      `${wrapTerminalBracketedPasteText('/repo/shot.png')} `,
+      'driving'
+    )
+    expect(sendInputAccepted).toHaveBeenNthCalledWith(
+      2,
+      "'/repo/a.png; touch /tmp/pwned #.png' ",
+      'driving'
     )
-    expect(sendInputAccepted).toHaveBeenNthCalledWith(2, "'/repo/a.png; touch /tmp/pwned #.png' ")
   })
 
   it('times out dropped path writes that never receive PTY acknowledgement', async () => {
diff --git a/src/renderer/src/components/terminal-pane/terminal-drop-path-writer.ts b/src/renderer/src/components/terminal-pane/terminal-drop-path-writer.ts
index f8ed3766251c..824a812ddb7d 100644
--- a/src/renderer/src/components/terminal-pane/terminal-drop-path-writer.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-drop-path-writer.ts
@@ -72,7 +72,7 @@ export async function writeTerminalDropPathsToCapturedTarget({
         )
       : `${shellEscapePath(path, targetShell)} `
     const writeResult = await runTerminalPasteOperationWithTimeout(
-      () => writeTerminalPastePtyInput(liveTransport, payload),
+      () => writeTerminalPastePtyInput(liveTransport, payload, 'driving'),
       operationTimeoutMs
     )
     if (writeResult.timedOut) {
diff --git a/src/renderer/src/components/terminal-pane/terminal-ime-composition-route.ts b/src/renderer/src/components/terminal-pane/terminal-ime-composition-route.ts
index 7b7ed78989fb..45fe1ee23ab9 100644
--- a/src/renderer/src/components/terminal-pane/terminal-ime-composition-route.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-ime-composition-route.ts
@@ -99,8 +99,8 @@ export function readTerminalImeCompositionSessionDetail(
 export function installTerminalImeCompositionRoute(args: {
   terminalElement: HTMLElement | null | undefined
   terminal: Pick<Terminal, 'input'>
-  capturedTransport: PtyTransport
-  getCurrentTransport: () => PtyTransport | undefined
+  capturedTransport: Pick<PtyTransport, 'getPtyId'>
+  getCurrentTransport: () => Pick<PtyTransport, 'getPtyId'> | undefined
 }): IDisposable {
   const terminalElement = args.terminalElement
   const sessions = new Map<number, CapturedCompositionSession>()
diff --git a/src/renderer/src/components/terminal-pane/terminal-ime-user-input-provenance.test.ts b/src/renderer/src/components/terminal-pane/terminal-ime-user-input-provenance.test.ts
new file mode 100644
index 000000000000..5b0accad22cb
--- /dev/null
+++ b/src/renderer/src/components/terminal-pane/terminal-ime-user-input-provenance.test.ts
@@ -0,0 +1,174 @@
+// @vitest-environment happy-dom
+// IME and Hangul commits bypass xterm's key path and enter through `terminal.input`. Main records
+// a run's first user input from xterm's user-input signal, so every commit route must carry it.
+import { Terminal } from '@xterm/xterm'
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+import type { IDisposable } from '@xterm/xterm'
+import type { PtyTransport } from './pty-transport'
+import {
+  installTerminalImeCompositionRoute,
+  XTERM_COMPOSITION_SESSION_END_EVENT,
+  XTERM_COMPOSITION_SESSION_START_EVENT
+} from './terminal-ime-composition-route'
+import { IPAD_DESKTOP_MODE_UA, pretendIosWeb } from './terminal-ios-hangul-preedit-fixture'
+import { installTerminalPaneInputHandling } from './terminal-pane-pane-input'
+import { subscribeToTerminalInputData } from './terminal-user-input-signal'
+
+const MAC_UA =
+  'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36'
+
+type ForwardedInput = { data: string; wasUserInput: boolean }
+
+const disposables: IDisposable[] = []
+
+function openPane(): {
+  terminal: Terminal
+  textarea: HTMLTextAreaElement
+  forwarded: ForwardedInput[]
+} {
+  const container = document.createElement('div')
+  document.body.appendChild(container)
+  const terminal = new Terminal({ cols: 40, rows: 8 })
+  disposables.push(terminal)
+  terminal.open(container)
+  installTerminalPaneInputHandling({
+    pane: { id: 1, terminal },
+    managerRef: { current: null },
+    paneKittyKeyboardModesRef: { current: new Map() },
+    settingsRef: { current: {} },
+    imeCompositionDisposablesRef: { current: new Map() },
+    imeNativeTextForwarderDisposablesRef: { current: new Map() }
+  })
+  const forwarded: ForwardedInput[] = []
+  disposables.push(
+    subscribeToTerminalInputData(terminal, (data, wasUserInput) =>
+      forwarded.push({ data, wasUserInput })
+    )
+  )
+  return { terminal, textarea: terminal.textarea!, forwarded }
+}
+
+function key(
+  textarea: HTMLTextAreaElement,
+  type: 'keydown' | 'keypress' | 'keyup',
+  init: { key: string; code: string; keyCode: number }
+): KeyboardEvent {
+  const event = new KeyboardEvent(type, { ...init, bubbles: true, cancelable: true })
+  // happy-dom drops the legacy numeric fields from KeyboardEventInit; xterm's key paths read them.
+  Object.defineProperty(event, 'keyCode', { value: init.keyCode })
+  Object.defineProperty(event, 'charCode', { value: type === 'keypress' ? init.keyCode : 0 })
+  textarea.dispatchEvent(event)
+  return event
+}
+
+function insertText(textarea: HTMLTextAreaElement, inputType: string, data: string | null): void {
+  const event = new InputEvent('input', { bubbles: true })
+  Object.defineProperty(event, 'inputType', { value: inputType })
+  Object.defineProperty(event, 'data', { value: data })
+  Object.defineProperty(event, 'composed', { value: true })
+  textarea.dispatchEvent(event)
+}
+
+describe('IME and Hangul commits reach the PTY as user input', () => {
+  let originalUserAgent: PropertyDescriptor | undefined
+  let originalMaxTouchPoints: PropertyDescriptor | undefined
+  let originalGetContext: PropertyDescriptor | undefined
+
+  beforeEach(() => {
+    originalUserAgent = Object.getOwnPropertyDescriptor(navigator, 'userAgent')
+    originalMaxTouchPoints = Object.getOwnPropertyDescriptor(navigator, 'maxTouchPoints')
+    // happy-dom has no 2d context, which the DOM renderer's WidthCache requires.
+    originalGetContext = Object.getOwnPropertyDescriptor(HTMLCanvasElement.prototype, 'getContext')
+    Object.defineProperty(HTMLCanvasElement.prototype, 'getContext', {
+      configurable: true,
+      value: () => ({ measureText: () => ({ width: 10 }) })
+    })
+  })
+
+  afterEach(() => {
+    for (const disposable of disposables.splice(0)) {
+      disposable.dispose()
+    }
+    for (const [property, descriptor] of [
+      ['userAgent', originalUserAgent],
+      ['maxTouchPoints', originalMaxTouchPoints]
+    ] as const) {
+      // Why delete: with no own descriptor the real value lives on the prototype, which the stub shadows.
+      if (descriptor) {
+        Object.defineProperty(navigator, property, descriptor)
+      } else {
+        Reflect.deleteProperty(navigator, property)
+      }
+    }
+    if (originalGetContext) {
+      Object.defineProperty(HTMLCanvasElement.prototype, 'getContext', originalGetContext)
+    } else {
+      Reflect.deleteProperty(HTMLCanvasElement.prototype, 'getContext')
+    }
+    document.body.replaceChildren()
+  })
+
+  it('marks a macOS input-source substitution as user input', () => {
+    pretendIosWeb(0, MAC_UA)
+    const { textarea, forwarded } = openPane()
+
+    const keydown = key(textarea, 'keydown', { key: ',', code: 'Comma', keyCode: 188 })
+    expect(keydown.defaultPrevented).toBe(false)
+    textarea.value = '，'
+    insertText(textarea, 'insertText', '，')
+    key(textarea, 'keyup', { key: ',', code: 'Comma', keyCode: 188 })
+
+    expect(forwarded).toEqual([{ data: '，', wasUserInput: true }])
+  })
+
+  it('marks an iPadOS Hangul syllable commit as user input', async () => {
+    pretendIosWeb(5, IPAD_DESKTOP_MODE_UA)
+    const { textarea, forwarded } = openPane()
+    const typeJamo = async (jamo: string, written: string, replaces: boolean) => {
+      if (
+        !key(textarea, 'keydown', { key: jamo, code: 'KeyQ', keyCode: jamo.charCodeAt(0) })
+          .defaultPrevented
+      ) {
+        key(textarea, 'keypress', { key: jamo, code: 'KeyQ', keyCode: jamo.charCodeAt(0) })
+      }
+      if (replaces) {
+        textarea.value = textarea.value.slice(0, -1)
+        insertText(textarea, 'deleteContentBackward', null)
+      }
+      textarea.value += written
+      insertText(textarea, 'insertText', written)
+      await new Promise((resolve) => window.setTimeout(resolve, 0))
+    }
+
+    await typeJamo('ㅎ', 'ㅎ', false)
+    await typeJamo('ㅏ', '하', true)
+    await typeJamo('ㄴ', '한', true)
+    await typeJamo('ㄱ', 'ㄱ', false)
+
+    expect(forwarded).toEqual([{ data: '한', wasUserInput: true }])
+  })
+
+  it('marks a composition the route delivers after a pane switch as user input', () => {
+    const { terminal, forwarded } = openPane()
+    const transport: Pick<PtyTransport, 'getPtyId'> = { getPtyId: () => 'pty-1' }
+    disposables.push(
+      installTerminalImeCompositionRoute({
+        terminalElement: terminal.element!,
+        terminal,
+        capturedTransport: transport,
+        getCurrentTransport: () => transport
+      })
+    )
+    const session = (type: string, data?: string): CustomEvent =>
+      new CustomEvent(type, {
+        bubbles: true,
+        cancelable: true,
+        detail: { id: 1, data, dataPendingReconciliation: false }
+      })
+
+    terminal.element!.dispatchEvent(session(XTERM_COMPOSITION_SESSION_START_EVENT))
+    terminal.element!.dispatchEvent(session(XTERM_COMPOSITION_SESSION_END_EVENT, '한'))
+
+    expect(forwarded).toEqual([{ data: '한', wasUserInput: true }])
+  })
+})
diff --git a/src/renderer/src/components/terminal-pane/terminal-ime-xterm-midline-preedit-tail.test.ts b/src/renderer/src/components/terminal-pane/terminal-ime-xterm-midline-preedit-tail.test.ts
index 46861938efef..ff8ec1d3408c 100644
--- a/src/renderer/src/components/terminal-pane/terminal-ime-xterm-midline-preedit-tail.test.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-ime-xterm-midline-preedit-tail.test.ts
@@ -52,17 +52,17 @@ type RigOptions = {
  * overflow. This gives the preedit span a width and the screen its cols*rows box.
  */
 function stubCompositionLayout(preeditWidth: () => number): void {
-  vi.spyOn(HTMLElement.prototype, 'getBoundingClientRect').mockImplementation(
-    function (this: HTMLElement) {
-      if (this.classList.contains('xterm-composition-preedit')) {
-        return DOMRect.fromRect({ height: CELL_HEIGHT_PX, width: preeditWidth() })
-      }
-      if (this.classList.contains('xterm-screen')) {
-        return DOMRect.fromRect({ height: 24 * CELL_HEIGHT_PX, width: 80 * CELL_WIDTH_PX })
-      }
-      return DOMRect.fromRect({ height: 0, width: 0 })
+  vi.spyOn(HTMLElement.prototype, 'getBoundingClientRect').mockImplementation(function (
+    this: HTMLElement
+  ) {
+    if (this.classList.contains('xterm-composition-preedit')) {
+      return DOMRect.fromRect({ height: CELL_HEIGHT_PX, width: preeditWidth() })
     }
-  )
+    if (this.classList.contains('xterm-screen')) {
+      return DOMRect.fromRect({ height: 24 * CELL_HEIGHT_PX, width: 80 * CELL_WIDTH_PX })
+    }
+    return DOMRect.fromRect({ height: 0, width: 0 })
+  })
 }
 
 function openTerminal(options: RigOptions = {}): Rig {
diff --git a/src/renderer/src/components/terminal-pane/terminal-ime-xterm-preedit-cell-grid.test.ts b/src/renderer/src/components/terminal-pane/terminal-ime-xterm-preedit-cell-grid.test.ts
index 083b1c43ebd5..38f10c0db500 100644
--- a/src/renderer/src/components/terminal-pane/terminal-ime-xterm-preedit-cell-grid.test.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-ime-xterm-preedit-cell-grid.test.ts
@@ -99,12 +99,13 @@ describe('IME preedit advances on the terminal cell grid (#19315)', () => {
       'letterSpacing'
     )!.set!
     // happy-dom drops calc(var(...)); Electron coverage checks the resulting layout.
-    vi.spyOn(CSSStyleDeclaration.prototype, 'letterSpacing', 'set').mockImplementation(
-      function (this: CSSStyleDeclaration, value) {
-        assignedSpacing.set(this, value)
-        setter.call(this, value)
-      }
-    )
+    vi.spyOn(CSSStyleDeclaration.prototype, 'letterSpacing', 'set').mockImplementation(function (
+      this: CSSStyleDeclaration,
+      value
+    ) {
+      assignedSpacing.set(this, value)
+      setter.call(this, value)
+    })
     vi.spyOn(HTMLCanvasElement.prototype, 'getContext').mockImplementation(() => {
       const context: CanvasRenderingContext2D = Object.create(null)
       context.font = '13px monospace'
diff --git a/src/renderer/src/components/terminal-pane/terminal-ios-hangul-preedit-coexistence.test.ts b/src/renderer/src/components/terminal-pane/terminal-ios-hangul-preedit-coexistence.test.ts
index 5f65a429922e..42f032b17f46 100644
--- a/src/renderer/src/components/terminal-pane/terminal-ios-hangul-preedit-coexistence.test.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-ios-hangul-preedit-coexistence.test.ts
@@ -210,7 +210,7 @@ describe('the iPadOS Hangul path alongside everything else', () => {
     pretendIosWeb()
     const rig = openIosTerminal()
     const sent: string[] = []
-    writeTerminalPastePtyInput({ sendInput: (data) => (sent.push(data), true) }, 'echo ')
+    writeTerminalPastePtyInput({ sendInput: (data) => (sent.push(data), true) }, 'echo ', 'driving')
     expect(sent).toEqual(['echo '])
 
     await typeHangeul(rig)
diff --git a/src/renderer/src/components/terminal-pane/terminal-layout-leaf-detach.ts b/src/renderer/src/components/terminal-pane/terminal-layout-leaf-detach.ts
index 4287e4eeee2d..ffa88d60783d 100644
--- a/src/renderer/src/components/terminal-pane/terminal-layout-leaf-detach.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-layout-leaf-detach.ts
@@ -94,6 +94,7 @@ export function detachTerminalLayoutLeaf(
       ptyIdsByLeafId
     }),
     expandedLeafId: layout.expandedLeafId === leafId ? null : layout.expandedLeafId,
+    ...(layout.chatLeafId && layout.chatLeafId !== leafId ? { chatLeafId: layout.chatLeafId } : {}),
     ...(ptyIdsByLeafId ? { ptyIdsByLeafId } : {}),
     ...(buffersByLeafId ? { buffersByLeafId } : {}),
     ...(scrollbackRefsByLeafId ? { scrollbackRefsByLeafId } : {}),
@@ -110,6 +111,7 @@ export function detachTerminalLayoutLeaf(
       root: { type: 'leaf', leafId },
       activeLeafId: leafId,
       expandedLeafId: null,
+      ...(layout.chatLeafId === leafId ? { chatLeafId: leafId } : {}),
       ...(detachedPtyIdsByLeafId ? { ptyIdsByLeafId: detachedPtyIdsByLeafId } : {}),
       ...(detachedBuffersByLeafId ? { buffersByLeafId: detachedBuffersByLeafId } : {}),
       ...(detachedScrollbackRefsByLeafId
diff --git a/src/renderer/src/components/terminal-pane/terminal-layout-leaf-ids.ts b/src/renderer/src/components/terminal-pane/terminal-layout-leaf-ids.ts
index 37870c03d70d..7ea60830f9ca 100644
--- a/src/renderer/src/components/terminal-pane/terminal-layout-leaf-ids.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-layout-leaf-ids.ts
@@ -182,6 +182,7 @@ function normalizeTerminalLayoutLeafIds(snapshot: TerminalLayoutSnapshot | null
   // selection ids must not strand focus on a missing pane.
   const remappedActiveLeafId = getRemappedLeafId(activeLeafId, rewrite) ?? firstLeafId(root)
   const remappedExpandedLeafId = getRemappedLeafId(expandedLeafId, rewrite)
+  const remappedChatLeafId = getRemappedLeafId(snapshot.chatLeafId, rewrite)
   const ptyIdsByLeafId = remapLeafRecord(snapshot.ptyIdsByLeafId, rewrite)
   const buffersByLeafId = remapLeafRecord(snapshot.buffersByLeafId, rewrite)
   const scrollbackRefsByLeafId = remapLeafRecord(snapshot.scrollbackRefsByLeafId, rewrite)
@@ -191,6 +192,7 @@ function normalizeTerminalLayoutLeafIds(snapshot: TerminalLayoutSnapshot | null
     buffersByLeafId: _oldBuffersByLeafId,
     scrollbackRefsByLeafId: _oldScrollbackRefsByLeafId,
     titlesByLeafId: _oldTitlesByLeafId,
+    chatLeafId: _oldChatLeafId,
     ...snapshotWithoutLeafRecords
   } = snapshot
   return {
@@ -203,6 +205,7 @@ function normalizeTerminalLayoutLeafIds(snapshot: TerminalLayoutSnapshot | null
         ptyIdsByLeafId
       }),
       expandedLeafId: remappedExpandedLeafId,
+      ...(remappedChatLeafId ? { chatLeafId: remappedChatLeafId } : {}),
       ...(ptyIdsByLeafId ? { ptyIdsByLeafId } : {}),
       ...(buffersByLeafId ? { buffersByLeafId } : {}),
       ...(scrollbackRefsByLeafId ? { scrollbackRefsByLeafId } : {}),
diff --git a/src/renderer/src/components/terminal-pane/terminal-layout-pty-ownership.ts b/src/renderer/src/components/terminal-pane/terminal-layout-pty-ownership.ts
index 3687621f1519..001be213fab1 100644
--- a/src/renderer/src/components/terminal-pane/terminal-layout-pty-ownership.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-layout-pty-ownership.ts
@@ -205,6 +205,9 @@ export function normalizeTerminalLayoutPtyOwnership(
   const ptyIdsByLeafId = coalesceLeafRecord(snapshot.ptyIdsByLeafId, retainedLeafIdByRemovedLeafId)
   const rootLeafIds = collectLeafIds(root)
   const activeLeafId = resolveOwnedActiveLeafId(rootLeafIds, mappedActiveLeafId, ptyIdsByLeafId)
+  const remappedChatLeafId = snapshot.chatLeafId
+    ? resolveRetainedLeafId(snapshot.chatLeafId, retainedLeafIdByRemovedLeafId)
+    : null
   const { buffersByLeafId, scrollbackRefsByLeafId } = coalesceScrollbackRecords(
     snapshot.buffersByLeafId,
     snapshot.scrollbackRefsByLeafId,
@@ -217,6 +220,7 @@ export function normalizeTerminalLayoutPtyOwnership(
     buffersByLeafId: _oldBuffersByLeafId,
     scrollbackRefsByLeafId: _oldScrollbackRefsByLeafId,
     titlesByLeafId: _oldTitlesByLeafId,
+    chatLeafId: _oldChatLeafId,
     ...snapshotWithoutLeafRecords
   } = snapshot
 
@@ -231,6 +235,9 @@ export function normalizeTerminalLayoutPtyOwnership(
         rootLeafIds.includes(snapshot.expandedLeafId)
           ? snapshot.expandedLeafId
           : null,
+      ...(remappedChatLeafId && rootLeafIds.includes(remappedChatLeafId)
+        ? { chatLeafId: remappedChatLeafId }
+        : {}),
       ...(ptyIdsByLeafId ? { ptyIdsByLeafId } : {}),
       ...(buffersByLeafId ? { buffersByLeafId } : {}),
       ...(scrollbackRefsByLeafId ? { scrollbackRefsByLeafId } : {}),
diff --git a/src/renderer/src/components/terminal-pane/terminal-pane-hook-order-parity.test.ts b/src/renderer/src/components/terminal-pane/terminal-pane-hook-order-parity.test.ts
index 8645d8cecb06..ded0bbf5c2ac 100644
--- a/src/renderer/src/components/terminal-pane/terminal-pane-hook-order-parity.test.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-pane-hook-order-parity.test.ts
@@ -24,8 +24,10 @@ const TERMINAL_PANE_HOOK_SOURCE_PATTERN =
 // (the confirmed-close continuation) (212 hooks, still 8 useMemo).
 // Then the dead adopted-structured-session portal went with its local target `useMemo`
 // in projection (211 hooks, 7 useMemo).
+// Then chat ownership through toggles and restore (#23049) added a `useRef`, a `useLayoutEffect`
+// and a `useEffect` across chat-state, layout-persistence and title-effects (214 hooks, still 7 useMemo).
 const PRE_REFACTOR_HOOK_ORDER_SHA256 =
-  '8293793dd40900d869b110ddbe8b4412080f8f505da0baeb4337102147886053'
+  '3736b71c612bb28b9b5298c7704ee1b32c7afc0254e75d0072ff4df870ec3be9'
 
 const sourceFiles = readdirSync(__dirname)
   .filter((name) => TERMINAL_PANE_HOOK_SOURCE_PATTERN.test(name))
@@ -90,7 +92,7 @@ function readFlattenedHookOrder(): string[] {
 describe('TerminalPane refactor hook parity', () => {
   it('preserves the recursively flattened render hook order', () => {
     const hooks = readFlattenedHookOrder()
-    expect(hooks).toHaveLength(211)
+    expect(hooks).toHaveLength(214)
     expect(hooks.filter((hook) => hook === 'useMemo')).toHaveLength(7)
     expect(createHash('sha256').update(hooks.join('\n')).digest('hex')).toBe(
       PRE_REFACTOR_HOOK_ORDER_SHA256
diff --git a/src/renderer/src/components/terminal-pane/terminal-pane-host-state-memo.test.ts b/src/renderer/src/components/terminal-pane/terminal-pane-host-state-memo.test.ts
index ba9c169295d1..ba4bb48f1c36 100644
--- a/src/renderer/src/components/terminal-pane/terminal-pane-host-state-memo.test.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-pane-host-state-memo.test.ts
@@ -54,6 +54,23 @@ beforeEach(() => {
 })
 
 describe('selectTerminalPaneHostState memo', () => {
+  it('releases the last store snapshot when no terminal selects again', async () => {
+    if (typeof globalThis.gc !== 'function') {
+      throw new Error('Run with the repository Vitest --expose-gc config')
+    }
+    function selectRetiredState(): WeakRef<AppState> {
+      const state = makeState()
+      selectTerminalPaneHostState(state, LOCAL_WORKTREE)
+      return new WeakRef(state)
+    }
+    const retired = selectRetiredState()
+    for (let round = 0; round < 3; round++) {
+      await new Promise<void>((resolve) => setImmediate(resolve))
+      globalThis.gc()
+    }
+    expect(retired.deref()).toBeUndefined()
+  })
+
   it('returns the same object across an unrelated store write', () => {
     const first = makeState()
     const before = selectTerminalPaneHostState(first, LOCAL_WORKTREE)
diff --git a/src/renderer/src/components/terminal-pane/terminal-pane-host-state.test.ts b/src/renderer/src/components/terminal-pane/terminal-pane-host-state.test.ts
index c9614690e4bf..fef6ce122247 100644
--- a/src/renderer/src/components/terminal-pane/terminal-pane-host-state.test.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-pane-host-state.test.ts
@@ -1,5 +1,6 @@
 import { describe, expect, it } from 'vitest'
 import type { AppState } from '@/store/types'
+import { selectWorktreeHostConnectionPhase } from '@/lib/worktree-host-connection-phase'
 import { selectTerminalPaneHostState } from './terminal-pane-host-state'
 
 function makeState(overrides: Record<string, unknown>): AppState {
@@ -161,4 +162,71 @@ describe('selectTerminalPaneHostState', () => {
       sshReconnectTargetRemoved: false
     })
   })
+
+  // The terminal reads the shared host signal but names the published status: an undialed
+  // target during startup restoration stays "disconnected" here (the overlay and error
+  // ownership are unchanged) even though the other panes read that window as connecting.
+  it('reports the published status through the shared signal, across startup and connect', () => {
+    const repos = [{ id: 'repo-ssh', connectionId: 'ssh-a' }]
+    const worktreesByRepo = { 'repo-ssh': [{ id: 'wt-ssh', repoId: 'repo-ssh' }] }
+    const withStatus = (status: string | null): AppState =>
+      makeState({
+        repos,
+        worktreesByRepo,
+        terminalStartupRestorationReady: false,
+        sshConnectionStates: new Map(
+          status ? [['ssh-a', { targetId: 'ssh-a', status, error: null, reconnectAttempt: 0 }]] : []
+        )
+      })
+
+    expect(selectWorktreeHostConnectionPhase(withStatus(null), 'wt-ssh').phase).toBe('connecting')
+    expect(selectTerminalPaneHostState(withStatus(null), 'wt-ssh').sshReconnectStatus).toBe(
+      'disconnected'
+    )
+    expect(selectTerminalPaneHostState(withStatus('connecting'), 'wt-ssh').sshReconnectStatus).toBe(
+      'connecting'
+    )
+    expect(selectTerminalPaneHostState(withStatus('connected'), 'wt-ssh').sshReconnectStatus).toBe(
+      'connected'
+    )
+  })
+
+  // An owning runtime that has not published its SSH state is unverifiable, not down: the
+  // terminal keeps reporting no status, so it shows no reconnect overlay for it.
+  it('reports no status for a nested target whose runtime has not published its SSH state', () => {
+    const state = makeState({
+      repos: [{ id: 'repo-runtime', connectionId: 'ssh-nested', executionHostId: 'runtime:env-a' }],
+      runtimeStatusByEnvironmentId: new Map([
+        ['env-a', { status: { runtimeId: 'runtime-a' }, checkedAt: 1 }]
+      ]),
+      sshStateByEnvironment: new Map([
+        [
+          'env-a',
+          {
+            connectionStates: new Map(),
+            targetLabels: new Map(),
+            removedTargetLabels: new Map(),
+            targetsHydrated: false
+          }
+        ]
+      ]),
+      worktreesByRepo: {
+        'repo-runtime': [
+          {
+            id: 'wt-runtime',
+            repoId: 'repo-runtime',
+            hostId: 'runtime:env-a',
+            runtimeOwnerEnvironmentId: 'env-a'
+          }
+        ]
+      }
+    })
+
+    expect(selectWorktreeHostConnectionPhase(state, 'wt-runtime').phase).toBe('unverifiable')
+    expect(selectTerminalPaneHostState(state, 'wt-runtime')).toMatchObject({
+      sshReconnectEnvironmentId: 'env-a',
+      sshReconnectStatus: null,
+      sshReconnectTargetId: 'ssh-nested'
+    })
+  })
 })
diff --git a/src/renderer/src/components/terminal-pane/terminal-pane-host-state.ts b/src/renderer/src/components/terminal-pane/terminal-pane-host-state.ts
index 6b40bdf379cd..19471a706e71 100644
--- a/src/renderer/src/components/terminal-pane/terminal-pane-host-state.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-pane-host-state.ts
@@ -1,21 +1,22 @@
 import type { AppState } from '@/store/types'
 import { getConnectionIdFromState } from '@/lib/connection-context'
-import { getExplicitRuntimeEnvironmentIdForWorktree } from '@/lib/worktree-runtime-owner'
+import {
+  resolveWorktreeHostConnection,
+  type WorktreeHostConnection
+} from '@/lib/worktree-host-connection-phase'
 import { isNativeChatTranscriptLocalReadable } from '@/lib/native-chat-transcript-readability'
 import {
   selectRuntimeAwareSshError,
-  selectRuntimeAwareSshStatus,
   selectRuntimeAwareSshTargetLabel,
   selectRuntimeAwareSshTargetRemoved
 } from '@/store/slices/runtime-environment-ssh'
-import { isRuntimeOwnedSshTargetId } from '../../../../shared/execution-host'
 
 export type TerminalPaneHostState = {
   nativeChatTranscriptIsLocalReadable: boolean
   sshReconnectEnvironmentId: string | null
   /** The failure detail behind the status; the overlay shows only a canned sentence without it. */
   sshReconnectError: string | null
-  sshReconnectStatus: ReturnType<typeof selectRuntimeAwareSshStatus>
+  sshReconnectStatus: WorktreeHostConnection['publishedStatus']
   sshReconnectTargetId: string | null
   sshReconnectTargetLabel: string
   sshReconnectTargetRemoved: boolean
@@ -25,9 +26,8 @@ function computeTerminalPaneHostState(state: AppState, worktreeId: string): Term
   const connectionId = getConnectionIdFromState(state, worktreeId)
   const nativeChatTranscriptIsLocalReadableResult =
     isNativeChatTranscriptLocalReadable(connectionId)
-  const sshReconnectTargetId =
-    connectionId && !isRuntimeOwnedSshTargetId(connectionId) ? connectionId : null
-  if (!sshReconnectTargetId) {
+  const host = resolveWorktreeHostConnection(state, worktreeId, connectionId)
+  if (!host.targetId) {
     return {
       nativeChatTranscriptIsLocalReadable: nativeChatTranscriptIsLocalReadableResult,
       sshReconnectEnvironmentId: null,
@@ -38,7 +38,7 @@ function computeTerminalPaneHostState(state: AppState, worktreeId: string): Term
       sshReconnectTargetRemoved: false
     }
   }
-  const sshReconnectEnvironmentId = getExplicitRuntimeEnvironmentIdForWorktree(state, worktreeId)
+  const { targetId: sshReconnectTargetId, environmentId: sshReconnectEnvironmentId } = host
   return {
     nativeChatTranscriptIsLocalReadable: nativeChatTranscriptIsLocalReadableResult,
     sshReconnectEnvironmentId,
@@ -47,11 +47,7 @@ function computeTerminalPaneHostState(state: AppState, worktreeId: string): Term
       sshReconnectEnvironmentId,
       sshReconnectTargetId
     ),
-    sshReconnectStatus: selectRuntimeAwareSshStatus(
-      state,
-      sshReconnectEnvironmentId,
-      sshReconnectTargetId
-    ),
+    sshReconnectStatus: host.publishedStatus,
     sshReconnectTargetId,
     sshReconnectTargetLabel: selectRuntimeAwareSshTargetLabel(
       state,
@@ -78,7 +74,8 @@ function isSameHostState(a: TerminalPaneHostState, b: TerminalPaneHostState): bo
   )
 }
 
-let cachedState: AppState | null = null
+// Identity checks must not keep a retired store alive after the last pane unmounts.
+let cachedState: WeakRef<AppState> | null = null
 let cachedByWorktreeId = new Map<string, TerminalPaneHostState>()
 let previousByWorktreeId = new Map<string, TerminalPaneHostState>()
 
@@ -100,10 +97,10 @@ export function selectTerminalPaneHostState(
   state: AppState,
   worktreeId: string
 ): TerminalPaneHostState {
-  if (state !== cachedState) {
+  if (state !== cachedState?.deref()) {
     previousByWorktreeId = cachedByWorktreeId
     cachedByWorktreeId = new Map()
-    cachedState = state
+    cachedState = new WeakRef(state)
   }
   const cached = cachedByWorktreeId.get(worktreeId)
   if (cached) {
diff --git a/src/renderer/src/components/terminal-pane/terminal-pane-menu-paste.ts b/src/renderer/src/components/terminal-pane/terminal-pane-menu-paste.ts
index 295b7e35c53f..b27900d20975 100644
--- a/src/renderer/src/components/terminal-pane/terminal-pane-menu-paste.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-pane-menu-paste.ts
@@ -89,7 +89,7 @@ export const executeTerminalPaneMenuPasteText = async (
   const execution = await executeTerminalPastePlan(plan, {
     pasteText: (pasteText, pasteOptions) =>
       pasteTerminalText(pane.terminal, pasteText, pasteOptions),
-    writePty: (data) => writeTerminalPastePtyInput(transport, data),
+    writePty: (data) => writeTerminalPastePtyInput(transport, data, 'driving'),
     isTargetCurrent: () => isPanePasteTargetMounted(context, pane, transport, ptyId),
     canContinue: () => isPanePasteTargetMounted(context, pane, transport, ptyId)
   })
diff --git a/src/renderer/src/components/terminal-pane/terminal-pane-pane-input.ts b/src/renderer/src/components/terminal-pane/terminal-pane-pane-input.ts
index b639d3b6ef8f..6ecab6f332bf 100644
--- a/src/renderer/src/components/terminal-pane/terminal-pane-pane-input.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-pane-pane-input.ts
@@ -33,7 +33,7 @@ import { syncTerminalScrollIntentSoon } from '@/lib/pane-manager/terminal-scroll
 import { resetTerminalKeyboardProtocolAfterInterrupt } from './terminal-pane-lifecycle-primitives'
 
 type PaneInputContext = {
-  pane: ManagedPane
+  pane: Pick<ManagedPane, 'id' | 'terminal'>
   managerRef: React.RefObject<PaneManager | null>
   paneKittyKeyboardModesRef: UseTerminalPaneLifecycleDeps['paneKittyKeyboardModesRef']
   settingsRef: React.RefObject<Record<string, unknown> | null | undefined>
diff --git a/src/renderer/src/components/terminal-pane/terminal-pane-paste-execution.ts b/src/renderer/src/components/terminal-pane/terminal-pane-paste-execution.ts
index e436bd2cc6a0..309c42dc18da 100644
--- a/src/renderer/src/components/terminal-pane/terminal-pane-paste-execution.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-pane-paste-execution.ts
@@ -93,7 +93,7 @@ export function createTerminalPanePasteExecution(
     const execution = await executeTerminalPastePlan(plan, {
       pasteText: (pasteText, pasteOptions) =>
         pasteTerminalText(pane.terminal, pasteText, pasteOptions),
-      writePty: (data) => writeTerminalPastePtyInput(transport, data),
+      writePty: (data) => writeTerminalPastePtyInput(transport, data, 'driving'),
       isTargetCurrent: () => {
         if (!isPanePasteTargetMounted(pane, transport, ptyId)) {
           return false
diff --git a/src/renderer/src/components/terminal-pane/terminal-pane-tab-detach.test.ts b/src/renderer/src/components/terminal-pane/terminal-pane-tab-detach.test.ts
index 209ac9dd5e91..8586db21e419 100644
--- a/src/renderer/src/components/terminal-pane/terminal-pane-tab-detach.test.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-pane-tab-detach.test.ts
@@ -271,6 +271,31 @@ describe('resolveTerminalTabStripDropTarget', () => {
 })
 
 describe('detachTerminalPaneToTab', () => {
+  it.each([LEAF_1, LEAF_2])('moves chat mode only with its owning leaf %s', (chatLeafId) => {
+    const store = createStore({ ...splitLayout(), chatLeafId })
+    detachTerminalPaneToTab({
+      getStore: () => store,
+      manager: {
+        getPanes: () => [{ id: 1 }, { id: 2 }],
+        getLeafId: () => LEAF_2,
+        detachPaneForExternalMove: () => true
+      },
+      persistLayoutSnapshot: vi.fn(),
+      sourcePaneId: 2,
+      sourceTabId: SOURCE_TAB_ID,
+      targetGroupId: TARGET_GROUP_ID,
+      worktreeId: WORKTREE_ID
+    })
+    const options = vi.mocked(store.createTab).mock.calls[0]?.[3]
+    expect(options?.viewMode ?? 'terminal').toBe(chatLeafId === LEAF_2 ? 'chat' : 'terminal')
+    expect(store.terminalLayoutsByTabId['tab-detached']?.chatLeafId).toBe(
+      chatLeafId === LEAF_2 ? LEAF_2 : undefined
+    )
+    expect(store.terminalLayoutsByTabId[SOURCE_TAB_ID]?.chatLeafId).toBe(
+      chatLeafId === LEAF_1 ? LEAF_1 : undefined
+    )
+  })
+
   it('creates a new terminal tab with the detached leaf layout and PTY id', () => {
     const store = createStore()
     const manager = {
diff --git a/src/renderer/src/components/terminal-pane/terminal-pane-tab-detach.ts b/src/renderer/src/components/terminal-pane/terminal-pane-tab-detach.ts
index ed63e48c2a85..27c97538d2df 100644
--- a/src/renderer/src/components/terminal-pane/terminal-pane-tab-detach.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-pane-tab-detach.ts
@@ -140,6 +140,7 @@ export function detachTerminalPaneToTab(args: {
   )?.shellOverride
   const tab = latestStore.createTab(args.worktreeId, args.targetGroupId, sourceShellOverride, {
     activate: true,
+    ...(detachedLayout.chatLeafId ? { viewMode: 'chat' as const } : {}),
     initialPtyId: ptyId ?? undefined,
     ...(!ptyId
       ? {
diff --git a/src/renderer/src/components/terminal-pane/terminal-park-verdict-flip-telemetry.test.ts b/src/renderer/src/components/terminal-pane/terminal-park-verdict-flip-telemetry.test.ts
index 6f99c97eeaf9..709d820db268 100644
--- a/src/renderer/src/components/terminal-pane/terminal-park-verdict-flip-telemetry.test.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-park-verdict-flip-telemetry.test.ts
@@ -1,9 +1,11 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type { CrashReportBreadcrumbData } from '../../../../shared/crash-reporting'
 import {
   TERMINAL_TAB_PARK_FLIP_BURST_LIMIT,
   TERMINAL_TAB_PARK_FLIP_BURST_WINDOW_MS,
   TERMINAL_TAB_PARK_FLIP_COMMIT_COST,
   TERMINAL_TAB_PARK_FLIP_NOTICE_LIMIT,
+  TERMINAL_TAB_PARK_FLIP_SUSTAINED_PIN_MAX_MS,
   TERMINAL_TAB_PARK_FLIP_WINDOW_MS,
   getParkVerdictUnparkPinUntilMs,
   recordParkVerdictFlips,
@@ -11,11 +13,19 @@ import {
   type ParkVerdictFlipRecord
 } from './terminal-park-verdict-flip-telemetry'
 
-const recordBreadcrumb = vi.fn()
+const recordBreadcrumb = vi.fn<(name: string, data?: CrashReportBreadcrumbData) => void>()
 vi.mock('@/lib/crash-breadcrumb-recorder', () => ({
-  recordRendererCrashBreadcrumb: (name: string, data?: unknown) => recordBreadcrumb(name, data)
+  recordRendererCrashBreadcrumb: (name: string, data?: CrashReportBreadcrumbData) =>
+    recordBreadcrumb(name, data)
 }))
 
+function pinDuration(data?: CrashReportBreadcrumbData): number {
+  if (typeof data?.pinnedForMs !== 'number') {
+    throw new Error('Missing numeric pin duration')
+  }
+  return data.pinnedForMs
+}
+
 const TAB = 'tab-1'
 /** Slower than the burst window, so only the notice limit can fire. */
 const SLOW_CHURN_STEP_MS = TERMINAL_TAB_PARK_FLIP_BURST_WINDOW_MS * 4
@@ -112,15 +122,373 @@ describe('recordParkVerdictFlips', () => {
     )
   })
 
-  // Why: slow churn must not be damped — parking it out for a minute would cost
-  // a mounted pane's memory for a verdict that was never near React's bail.
-  it('does not pin churn spread past the burst window', () => {
+  // Why this replaced "does not pin churn spread past the burst window": that
+  // rule read the pin as purely a React #185 guard, so slow churn was left to
+  // run rather than spend a mounted pane's memory on it. The field disagreed —
+  // slow churn remounts the pane every ~3.8s for as long as it lasts, and a
+  // remount re-establishes a remote terminal. Memory is the cheaper side.
+  it('pins churn that is too slow to burst but reaches the notice limit', () => {
     const records = new Map<string, ParkVerdictFlipRecord>()
     for (let i = 0; i < TERMINAL_TAB_PARK_FLIP_NOTICE_LIMIT + 1; i += 1) {
       observe({ records, parked: i % 2 === 0, nowMs: 1_000 + i * SLOW_CHURN_STEP_MS })
     }
 
-    expect(records.get(TAB)?.pinnedUntilMs ?? null).toBeNull()
+    const noticeMs = 1_000 + TERMINAL_TAB_PARK_FLIP_NOTICE_LIMIT * SLOW_CHURN_STEP_MS
+    expect(records.get(TAB)?.pinnedUntilMs).toBe(noticeMs + TERMINAL_TAB_PARK_FLIP_WINDOW_MS)
+    expect(recordBreadcrumb).toHaveBeenCalledWith(
+      'terminal_park_verdict_churn',
+      expect.objectContaining({
+        trigger: 'window',
+        pinnedForMs: TERMINAL_TAB_PARK_FLIP_WINDOW_MS,
+        sustainedPinCount: 1
+      })
+    )
+  })
+
+  // Why these cadences and not round numbers: they are the field's. Bundle
+  // Nz4kzIG_NwLd8KObgjJDKA (v1.4.201, win32) carries 52 churn crumbs, and they
+  // are TWO unrelated episodes in two launches, not one run:
+  //   L3 (09-14 00:53) 35 crumbs, 1 tab, 46.9 min, 34 window + 1 burst
+  //   L4 (09-14 17:07) 17 crumbs, 4 tabs,  8.9 min, 17 window + 0 burst
+  // The user filed from L4, 12.3 min after its churn had already stopped.
+  //
+  // Per-flip cadence is elapsedMs / (NOTICE_LIMIT - 1), NOT / NOTICE_LIMIT: the
+  // window opens ON a flip (resetFlipWindows then `flips += 1`), so the 12th
+  // flip sits 11 intervals later. L3 runs 3197/4627/5442 ms per flip
+  // (min/median/max); L4 runs 3193/3203/5014.
+  //
+  // The slow end is where this matters. The limit needs 12 flips inside 60s, so
+  // it is unreachable past 60s/11 = 5454.5 ms per flip — and the field's slowest
+  // observed episode sits 12.7 ms inside that, not comfortably clear of it. The
+  // cadences below therefore span the real range INCLUDING that edge, and the
+  // edge case asserts the weaker damping that actually happens there.
+  describe('sustained field-cadence churn', () => {
+    const FIELD_FLIP_INTERVAL_MS = 4_627
+    const FIELD_SLOWEST_FLIP_INTERVAL_MS = 5_442
+    const FIELD_CHURN_DURATION_MS = 47 * 60_000
+
+    // Fixed duration rather than a fixed flip count, so every cadence covers
+    // the same 47 minutes the field bundle spans and the crumb budget compares.
+    function runFieldChurn(stepMs = FIELD_FLIP_INTERVAL_MS): {
+      flips: number
+      pinnedPasses: number
+      crumbs: number
+    } {
+      const records = new Map<string, ParkVerdictFlipRecord>()
+      const flips = Math.ceil(FIELD_CHURN_DURATION_MS / stepMs)
+      let pinnedPasses = 0
+      for (let i = 0; i < flips; i += 1) {
+        const nowMs = 1_000 + i * stepMs
+        observe({ records, parked: i % 2 === 0, nowMs })
+        const { pinnedTabIds } = selectParkVerdictPinnedTabIds({
+          records,
+          tabIds: [TAB],
+          nowMs
+        })
+        if (pinnedTabIds.size > 0) {
+          pinnedPasses += 1
+        }
+      }
+      return {
+        flips,
+        pinnedPasses,
+        crumbs: recordBreadcrumb.mock.calls.filter(
+          (call) => call[0] === 'terminal_park_verdict_churn'
+        ).length
+      }
+    }
+
+    // Two harnesses, and the difference between them matters.
+    //
+    // This one is OPEN-LOOP: it drives the parked flag unconditionally. The real
+    // hook subtracts pinned tabs from the rendered verdict, so a pinned tab
+    // records no flip at all — and engaging the pin is itself a transition, so a
+    // flip lands INSIDE the live pin. Three successive defects in this file were
+    // invisible here and visible the moment the pin was fed back. Keep it as a
+    // cheap regression guard; read 'keeps the back-off when the pin engagement
+    // is itself a flip' for behaviour.
+    //
+    // The user-visible quantity is verdict transitions — two per mount/unmount
+    // cycle — measured over 47 simulated minutes with the pin applied in the
+    // same commit cascade as the flip that caused it:
+    //
+    //   per flip   transitions before -> after   ceiling reached
+    //   3193 ms    884 -> 96   (9.2x fewer)      8x
+    //   4627 ms    610 -> 96   (6.4x fewer)      8x
+    //   4800 ms    588 -> 96   (6.1x fewer)      8x
+    //   5000 ms    564 -> 126  (4.5x fewer)      8x
+    //   5442 ms    519 -> 156  (3.3x fewer)      8x
+    //
+    // The slow end is weaker but no longer collapses: reaching 12 flips takes 11
+    // intervals, so past ~4.7s per flip each window only barely makes the limit
+    // and damping engages later. It still reaches the ceiling everywhere.
+    it.each([
+      ['fastest observed', 3_193, 0.5],
+      ['median', FIELD_FLIP_INTERVAL_MS, 0.5],
+      ['slowest observed', FIELD_SLOWEST_FLIP_INTERVAL_MS, 0.4]
+    ])('damps %s field churn instead of letting it run all session', (_label, stepMs, floor) => {
+      const { flips, pinnedPasses, crumbs } = runFieldChurn(stepMs)
+
+      expect(pinnedPasses).toBeGreaterThan(flips * floor)
+      expect(crumbs).toBeLessThan(20)
+    })
+
+    // Why this asserts the gap rather than closing it: reaching the notice
+    // limit takes NOTICE_LIMIT - 1 intervals, so churn averaging slower than
+    // 60s/11 = 5454.5ms per flip never reaches it and stays undamped — before
+    // this change and after, which is why the crumb count is 0 rather than 43.
+    // The edge is sharp: this harness pins 60% of passes at 5450ms and 0% at
+    // 5460ms. Closing the gap means widening the window, which would also
+    // re-arm the pin on honest parking — that round-trips on the order of
+    // minutes.
+    //
+    // The field is NOT comfortably clear of this: its slowest observed episode
+    // runs 5441.8ms per flip, 12.7ms inside the edge. Churn a hair slower than
+    // anything yet observed would evade the damper entirely. Recorded so a
+    // later change to either constant cannot move the edge unnoticed.
+    it('leaves churn slower than the window undamped', () => {
+      const tooSlowMs =
+        Math.ceil(TERMINAL_TAB_PARK_FLIP_WINDOW_MS / (TERMINAL_TAB_PARK_FLIP_NOTICE_LIMIT - 1)) + 1
+      const { pinnedPasses, crumbs } = runFieldChurn(tooSlowMs)
+
+      expect(pinnedPasses).toBe(0)
+      expect(crumbs).toBe(0)
+    })
+
+    it('backs the pin off to the ceiling while the churn persists', () => {
+      const records = new Map<string, ParkVerdictFlipRecord>()
+      const flips = Math.ceil(FIELD_CHURN_DURATION_MS / FIELD_FLIP_INTERVAL_MS)
+      for (let i = 0; i < flips; i += 1) {
+        observe({ records, parked: i % 2 === 0, nowMs: 1_000 + i * FIELD_FLIP_INTERVAL_MS })
+      }
+
+      const pinnedForMs = recordBreadcrumb.mock.calls
+        .filter((call) => call[0] === 'terminal_park_verdict_churn')
+        .map((call) => pinDuration(call[1]))
+      expect(pinnedForMs[0]).toBe(TERMINAL_TAB_PARK_FLIP_WINDOW_MS)
+      expect(pinnedForMs.at(-1)).toBe(TERMINAL_TAB_PARK_FLIP_SUSTAINED_PIN_MAX_MS)
+    })
+
+    // Why this drives the loop the way useTerminalParkVerdictPin does — record
+    // first, then subtract the pinned set from the NEXT pass's verdict — and
+    // why every other test here must not: with the pin fed back, a pinned tab
+    // records no flip at all, and that is the state the back-off has to survive.
+    // The open-loop harness above cannot see it, and shipped a fix whose
+    // exponential back-off never left 1x in production: the quiet-branch reset
+    // measured staleness from windowStartMs, which a pin always makes older
+    // than a full window, so every lapse wiped the count.
+    function runClosedLoopChurn(stepMs: number, durationMs = 20 * 60_000) {
+      const records = new Map<string, ParkVerdictFlipRecord>()
+      const passes = Math.ceil(durationMs / stepMs)
+      let pinned = new Set<string>()
+      let remounts = 0
+      let previouslyParked = false
+      for (let i = 0; i < passes; i += 1) {
+        const nowMs = 1_000 + i * stepMs
+        const candidateParked = i % 2 === 0
+        const renderedParked = candidateParked && !pinned.has(TAB)
+        recordParkVerdictFlips({
+          records,
+          liveTabIds: new Set([TAB]),
+          nextParkedTabIds: new Set(renderedParked ? [TAB] : []),
+          nowMs
+        })
+        pinned = selectParkVerdictPinnedTabIds({ records, tabIds: [TAB], nowMs }).pinnedTabIds
+        if (renderedParked !== previouslyParked) {
+          remounts += 1
+          previouslyParked = renderedParked
+        }
+      }
+      const crumbs = recordBreadcrumb.mock.calls.filter(
+        (call) => call[0] === 'terminal_park_verdict_churn'
+      )
+      return {
+        remounts,
+        crumbs: crumbs.length,
+        pinnedForMs: crumbs.map((call) => pinDuration(call[1]))
+      }
+    }
+
+    it('reaches the ceiling under the real pin feedback loop', () => {
+      const { pinnedForMs } = runClosedLoopChurn(FIELD_FLIP_INTERVAL_MS)
+
+      // The whole sequence, not just its ends: a base-8 back-off, or a reset
+      // that fires one window early, both pass an ends-only assertion.
+      expect(pinnedForMs.length).toBeGreaterThan(3)
+      expect(pinnedForMs.slice(0, 4)).toEqual([
+        TERMINAL_TAB_PARK_FLIP_WINDOW_MS,
+        TERMINAL_TAB_PARK_FLIP_WINDOW_MS * 2,
+        TERMINAL_TAB_PARK_FLIP_WINDOW_MS * 4,
+        TERMINAL_TAB_PARK_FLIP_WINDOW_MS * 8
+      ])
+      expect(pinnedForMs.at(-1)).toBe(TERMINAL_TAB_PARK_FLIP_SUSTAINED_PIN_MAX_MS)
+    })
+
+    // The user-visible quantity. Every flip that survives the pin is one pane
+    // remount; the percentages elsewhere are a pin duty cycle, not this.
+    it('cuts remounts against the undamped baseline', () => {
+      const { remounts, crumbs } = runClosedLoopChurn(FIELD_FLIP_INTERVAL_MS)
+
+      // Undamped, 20 min at 4627ms/flip is 260 remounts and 20 crumbs.
+      expect(remounts).toBeLessThan(80)
+      expect(crumbs).toBeLessThan(10)
+    })
+
+    // Why this drives the pin into the SAME pass that records the flip: engaging
+    // the pin is itself a rendered verdict transition — the hook drops the tab
+    // from the parked set and the effect re-runs on the changed dep — so a flip
+    // lands while the pin is live. That flip used to overwrite the pin deadline
+    // with the current time, and the back-off then cleared one window later
+    // rather than one window after the pin ended.
+    //
+    // It also kills `easedFlipCount -> noticeLimit`, which is behaviourally the
+    // revision this one replaced and which the open-loop tests cannot see.
+    it('keeps the back-off when the pin engagement is itself a flip', () => {
+      const records = new Map<string, ParkVerdictFlipRecord>()
+      const stepMs = 5_000
+      let pinned = new Set<string>()
+      for (let i = 0; i < 400; i += 1) {
+        const nowMs = 1_000 + i * stepMs
+        const candidateParked = i % 2 === 0
+        recordParkVerdictFlips({
+          records,
+          liveTabIds: new Set([TAB]),
+          nextParkedTabIds: new Set(candidateParked && !pinned.has(TAB) ? [TAB] : []),
+          nowMs
+        })
+        pinned = selectParkVerdictPinnedTabIds({ records, tabIds: [TAB], nowMs }).pinnedTabIds
+        // The re-render the pin itself causes, in the same commit cascade.
+        recordParkVerdictFlips({
+          records,
+          liveTabIds: new Set([TAB]),
+          nextParkedTabIds: new Set(candidateParked && !pinned.has(TAB) ? [TAB] : []),
+          nowMs
+        })
+      }
+
+      const pinnedForMs = recordBreadcrumb.mock.calls
+        .filter((call) => call[0] === 'terminal_park_verdict_churn')
+        .map((call) => pinDuration(call[1]))
+      expect(Math.max(...pinnedForMs)).toBe(TERMINAL_TAB_PARK_FLIP_SUSTAINED_PIN_MAX_MS)
+    })
+
+    // Why: the back-off must not accumulate across episodes that are not
+    // consecutive. Four isolated 12-flip episodes six hours apart previously
+    // reached the 8-minute ceiling, because the flip path's reset was gated on
+    // `flips < noticeLimit` and the notice path leaves `flips` at exactly
+    // noticeLimit — so a window reopening after hours of silence did not reset.
+    // Each episode resumes ON a flip, so nothing lands in the quiet branch.
+    it('does not accumulate across episodes hours apart', () => {
+      const records = new Map<string, ParkVerdictFlipRecord>()
+      let nowMs = 1_000
+      let parked = false
+      for (let episode = 0; episode < 4; episode += 1) {
+        for (let i = 0; i <= TERMINAL_TAB_PARK_FLIP_NOTICE_LIMIT; i += 1) {
+          parked = !parked
+          observe({ records, parked, nowMs })
+          nowMs += SLOW_CHURN_STEP_MS
+        }
+        nowMs += 6 * 60 * 60 * 1_000
+      }
+
+      const pinnedForMs = recordBreadcrumb.mock.calls
+        .filter((call) => call[0] === 'terminal_park_verdict_churn')
+        .map((call) => pinDuration(call[1]))
+      expect(pinnedForMs).toHaveLength(4)
+      expect(pinnedForMs.every((ms) => ms === TERMINAL_TAB_PARK_FLIP_WINDOW_MS)).toBe(true)
+    })
+
+    // Why this range and not one cadence: past roughly 4.7s per flip a lapsing
+    // pin pushes the next window out of alignment so it closes at 11 of 12.
+    // Gating the reset on `flips < noticeLimit` read that as the churn easing
+    // and reset the back-off every cycle, leaving it stuck at 1x across the
+    // slower half of the field's own observed range — the half where damping is
+    // weakest to begin with. The back-off must still climb there.
+    it.each([4_800, 5_000, FIELD_SLOWEST_FLIP_INTERVAL_MS])(
+      'still backs off above the alignment cliff at %ims per flip',
+      (stepMs) => {
+        runFieldChurn(stepMs)
+
+        const pinnedForMs = recordBreadcrumb.mock.calls
+          .filter((call) => call[0] === 'terminal_park_verdict_churn')
+          .map((call) => pinDuration(call[1]))
+        expect(Math.max(...pinnedForMs)).toBeGreaterThan(TERMINAL_TAB_PARK_FLIP_WINDOW_MS)
+      }
+    )
+
+    // Why: without this the back-off is a ratchet — a tab that churned once at
+    // launch would still be carrying an 8-minute pin hours later.
+    it('starts over at one window after a quiet window', () => {
+      const records = new Map<string, ParkVerdictFlipRecord>()
+      for (let i = 0; i < TERMINAL_TAB_PARK_FLIP_NOTICE_LIMIT + 1; i += 1) {
+        observe({ records, parked: i % 2 === 0, nowMs: 1_000 + i * SLOW_CHURN_STEP_MS })
+      }
+      expect(records.get(TAB)?.sustainedPinCount).toBe(1)
+
+      const quietMs = 1_000 + TERMINAL_TAB_PARK_FLIP_SUSTAINED_PIN_MAX_MS * 4
+      observe({ records, parked: true, nowMs: quietMs })
+      expect(records.get(TAB)?.sustainedPinCount).toBe(0)
+
+      recordBreadcrumb.mockClear()
+      for (let i = 1; i <= TERMINAL_TAB_PARK_FLIP_NOTICE_LIMIT; i += 1) {
+        observe({ records, parked: i % 2 === 0, nowMs: quietMs + i * SLOW_CHURN_STEP_MS })
+      }
+      expect(recordBreadcrumb).toHaveBeenCalledWith(
+        'terminal_park_verdict_churn',
+        expect.objectContaining({
+          pinnedForMs: TERMINAL_TAB_PARK_FLIP_WINDOW_MS,
+          sustainedPinCount: 1
+        })
+      )
+    })
+  })
+
+  // Why this is NOT the test that covers the below-limit reset: its gap is also
+  // a full quiet window, so the quiet disjunct alone satisfies it and deleting
+  // the below-limit clause stays invisible here. The sparse-churn test below is
+  // the one that distinguishes them; this one only pins that a reset exists.
+  it('clears the back-off when a window closes below the notice limit', () => {
+    const records = new Map<string, ParkVerdictFlipRecord>()
+    for (let i = 0; i < TERMINAL_TAB_PARK_FLIP_NOTICE_LIMIT + 1; i += 1) {
+      observe({ records, parked: i % 2 === 0, nowMs: 1_000 + i * SLOW_CHURN_STEP_MS })
+    }
+    expect(records.get(TAB)?.sustainedPinCount).toBe(1)
+
+    // One flip, a full window later: the window closes holding far fewer than
+    // the notice limit, which is the only proof the churn actually stopped.
+    const nextWindowMs = 1_000 + TERMINAL_TAB_PARK_FLIP_SUSTAINED_PIN_MAX_MS * 2
+    observe({ records, parked: false, nowMs: nextWindowMs })
+    observe({ records, parked: true, nowMs: nextWindowMs + TERMINAL_TAB_PARK_FLIP_WINDOW_MS + 1 })
+
+    expect(records.get(TAB)?.sustainedPinCount).toBe(0)
+  })
+
+  // Why this shape and not a quiet gap: it is the only one that separates the
+  // two reset conditions. One flip every 20s is three per window — below the
+  // eased threshold, so the below-limit clause fires — while the last flip is
+  // never a full window old, so the quiet clause never does. Without the
+  // below-limit clause the back-off stays armed indefinitely under churn that
+  // has demonstrably eased, and the next notice pins for the ceiling rather
+  // than one window. Four mutations of that clause survived every other test.
+  it('clears the back-off under churn that eased but never stopped', () => {
+    const records = new Map<string, ParkVerdictFlipRecord>()
+    let nowMs = 1_000
+    let parked = false
+    for (let i = 0; i <= TERMINAL_TAB_PARK_FLIP_NOTICE_LIMIT; i += 1) {
+      parked = !parked
+      observe({ records, parked, nowMs })
+      nowMs += SLOW_CHURN_STEP_MS
+    }
+    expect(records.get(TAB)?.sustainedPinCount).toBe(1)
+
+    nowMs = (records.get(TAB)?.pinnedUntilMs ?? nowMs) + 1_000
+    for (let i = 0; i < 12; i += 1) {
+      parked = !parked
+      observe({ records, parked, nowMs })
+      nowMs += 20_000
+    }
+
+    expect(records.get(TAB)?.sustainedPinCount).toBe(0)
   })
 
   it('re-arms after the window elapses', () => {
diff --git a/src/renderer/src/components/terminal-pane/terminal-park-verdict-flip-telemetry.ts b/src/renderer/src/components/terminal-pane/terminal-park-verdict-flip-telemetry.ts
index aee6c2d744a6..a7482ab94c83 100644
--- a/src/renderer/src/components/terminal-pane/terminal-park-verdict-flip-telemetry.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-park-verdict-flip-telemetry.ts
@@ -1,7 +1,20 @@
 /**
  * Cold-park verdict telemetry and a safe-side circuit breaker.
  * Field breadcrumbs prove render-cadence flips, but not which eligibility input
- * oscillates; burst damping keeps the pane mounted before React reaches #185.
+ * oscillates; damping keeps the pane mounted rather than let it cycle.
+ *
+ * Two horizons, because churn harms in two ways: a burst reaches React's commit
+ * bail (#185), while churn merely sustained remounts the pane over and over.
+ * A remount does not reconnect a terminal — parking deliberately keeps the PTY
+ * alive (see terminal-parked-tab-watchers), SSH restores from main's snapshot,
+ * and a remote runtime re-subscribes a stream on a per-environment multiplexer
+ * that outlives the pane. What it costs is a remount each time, indefinitely.
+ * Retention force-parks bypass sustained pins; burst protection still applies.
+ *
+ * What this is NOT: a fix for whatever keeps re-proposing the park. That input
+ * is still unidentified, so this caps the remount rate of an oscillation rather
+ * than ending it — the pin masks the rendered verdict, and the driver resumes
+ * the moment each pin lapses.
  *
  * Scope: flips are counted on the rendered verdict and the pin subtracts from
  * that same verdict (selectParkVerdictPinnedTabIds), so churn driven by any
@@ -14,8 +27,18 @@ import { recordRendererCrashBreadcrumb } from '@/lib/crash-breadcrumb-recorder'
 import { REACT_NESTED_UPDATE_LIMIT } from '../../../../shared/react-update-depth-attribution'
 
 export const TERMINAL_TAB_PARK_FLIP_WINDOW_MS = 60_000
-/** Flips per window that no sane park policy should reach. Breadcrumb only. */
+/** Flips per window that no sane park policy should reach. */
 export const TERMINAL_TAB_PARK_FLIP_NOTICE_LIMIT = 12
+/**
+ * Ceiling for the sustained-churn pin. Each consecutive notice-limit window
+ * doubles the pin, so a verdict that cannot settle is re-proposed on the order
+ * of minutes instead of every ~45s. A tab restarts at 1x once it has been quiet
+ * for a full window past its pin deadline — so roughly nine minutes of real
+ * silence at the ceiling, not one window. See lastFlipMs.
+ *
+ * Only sustained churn backs off; burst protection keeps its one-window pin.
+ */
+export const TERMINAL_TAB_PARK_FLIP_SUSTAINED_PIN_MAX_MS = 8 * TERMINAL_TAB_PARK_FLIP_WINDOW_MS
 
 /** Measured upper bound after the passive-effect pin engages. */
 const PARK_PIN_SETTLE_COMMITS = 6
@@ -38,8 +61,26 @@ export type ParkVerdictFlipRecord = {
   notified: boolean
   burstStartMs: number
   burstFlips: number
-  /** Set when a flip burst engaged damping; the verdict stays unparked until then. */
+  /** Set when flip churn engaged damping; the verdict stays unparked until then. */
   pinnedUntilMs?: number | null
+  pinTrigger?: 'burst' | 'window'
+  /** Consecutive notice-limit windows; backs the pin off for churn that persists. */
+  sustainedPinCount?: number
+  /**
+   * When this tab was last active: a flip, or the deadline of a pin that was
+   * suppressing flips, whichever is later. The back-off clears a full window
+   * after that.
+   *
+   * Why a pin counts as activity: while pinned the hook subtracts the tab from
+   * the rendered verdict, so no flip can be recorded. Without this, the first
+   * idle pass after a long pin lapsed saw a flip timestamp up to eight minutes
+   * old and cleared the back-off that the pin had just earned.
+   *
+   * Consequence worth stating: "quiet for one window" is therefore measured from
+   * the PIN DEADLINE, so a tab at the 8-minute ceiling needs about nine minutes
+   * of real silence before the back-off clears, not one.
+   */
+  lastFlipMs: number
 }
 
 // Why it leaves pinnedUntilMs alone: the notice window is 60s from the first
@@ -52,6 +93,37 @@ function resetFlipWindows(record: ParkVerdictFlipRecord, nowMs: number): void {
   record.burstFlips = 0
 }
 
+/**
+ * Whether the tab has genuinely gone quiet: a full window with no flip recorded,
+ * counting from the last one or from the pin deadline, whichever is later.
+ *
+ * Why not `nowMs - windowStartMs`: on the flip path that is a tautology, because
+ * the branch that would consult it only runs once the window is already a window
+ * old. And while a tab is pinned the hook subtracts it from the rendered verdict,
+ * so no flip is recorded and `windowStartMs` does not advance either — measuring
+ * from it reads continuous churn as quiet in both directions.
+ */
+function hasBeenQuietForAWindow(
+  record: ParkVerdictFlipRecord,
+  nowMs: number,
+  flipWindowMs: number
+): boolean {
+  return nowMs - record.lastFlipMs >= flipWindowMs
+}
+
+/**
+ * Flips in a closing window below which the churn has genuinely eased.
+ *
+ * Why half and not the notice limit itself: past ~4.7s per flip a lapsing pin
+ * pushes the next window out of alignment, so it closes at 11 of 12 while the
+ * churn has not slowed at all. Treating that as "eased" reset the back-off on
+ * every cycle and left it stuck at 1x across the slower half of the field's own
+ * cadence range — the half where it is needed most.
+ */
+function easedFlipCount(noticeLimit: number): number {
+  return Math.ceil(noticeLimit / 2)
+}
+
 // Why liveness and not presence: a tab pinned while cold-park-eligible can stop
 // being a candidate before its deadline, and nothing would consult it again. An
 // expired pin must stop damping and stop gating breadcrumbs on its own.
@@ -72,6 +144,7 @@ export function getParkVerdictUnparkPinUntilMs(args: {
   if (!isParkVerdictPinLive(record, args.nowMs) || args.nowMs < record.windowStartMs) {
     resetFlipWindows(record, args.nowMs)
     record.pinnedUntilMs = null
+    record.pinTrigger = undefined
     return null
   }
   return record.pinnedUntilMs
@@ -87,6 +160,8 @@ export function recordParkVerdictFlips(args: {
   noticeLimit?: number
   burstWindowMs?: number
   burstLimit?: number
+  sustainedPinMaxMs?: number
+  allowSustainedPin?: boolean
 }): void {
   const {
     records,
@@ -96,7 +171,9 @@ export function recordParkVerdictFlips(args: {
     flipWindowMs = TERMINAL_TAB_PARK_FLIP_WINDOW_MS,
     noticeLimit = TERMINAL_TAB_PARK_FLIP_NOTICE_LIMIT,
     burstWindowMs = TERMINAL_TAB_PARK_FLIP_BURST_WINDOW_MS,
-    burstLimit = TERMINAL_TAB_PARK_FLIP_BURST_LIMIT
+    burstLimit = TERMINAL_TAB_PARK_FLIP_BURST_LIMIT,
+    sustainedPinMaxMs = TERMINAL_TAB_PARK_FLIP_SUSTAINED_PIN_MAX_MS,
+    allowSustainedPin = true
   } = args
 
   for (const tabId of Array.from(records.keys())) {
@@ -117,11 +194,30 @@ export function recordParkVerdictFlips(args: {
         notified: false,
         burstStartMs: nowMs,
         burstFlips: 0,
-        pinnedUntilMs: null
+        pinnedUntilMs: null,
+        lastFlipMs: nowMs
       })
       continue
     }
+    // Retention eviction must also release pins earned before the force-park.
+    if (!allowSustainedPin && record.pinTrigger === 'window') {
+      resetFlipWindows(record, nowMs)
+      record.pinnedUntilMs = null
+      record.pinTrigger = undefined
+      record.sustainedPinCount = 0
+      record.lastFlipMs = nowMs
+    }
     if (parked === record.parked) {
+      // Why the back-off clears here and not only on a flip: churn stopping
+      // looks like no flips at all, so a flip-gated reset would ratchet — a tab
+      // that churned once at launch would still carry a ceiling pin hours on.
+      //
+      // Why no isParkVerdictPinLive check: a live pin puts lastFlipMs in the
+      // future, so the window test already fails. Asserting it too reads as the
+      // guard protecting this invariant when it is not.
+      if (record.sustainedPinCount && hasBeenQuietForAWindow(record, nowMs, flipWindowMs)) {
+        record.sustainedPinCount = 0
+      }
       continue
     }
 
@@ -129,6 +225,20 @@ export function recordParkVerdictFlips(args: {
     // elapsed value as a fresh window rather than trusting the delta.
     const elapsedMs = nowMs - record.windowStartMs
     if (elapsedMs >= flipWindowMs || elapsedMs < 0) {
+      // Why quiet and not `flips < noticeLimit`: a window closing below the limit
+      // is not proof the churn stopped. Past ~4.7s per flip the pin lapse pushes
+      // the next window out of alignment so it closes at 11, and that false
+      // signal reset the count on every cycle — leaving the back-off stuck at 1x
+      // for the slower half of the field's own cadence range, which is where it
+      // is needed most. It also failed in the other direction: `flips` is left at
+      // exactly noticeLimit by the notice path, so a window reopening after hours
+      // of silence did NOT reset, and isolated episodes ratcheted to the ceiling.
+      if (
+        record.flips < easedFlipCount(noticeLimit) ||
+        hasBeenQuietForAWindow(record, nowMs, flipWindowMs)
+      ) {
+        record.sustainedPinCount = 0
+      }
       resetFlipWindows(record, nowMs)
     }
     const burstElapsedMs = nowMs - record.burstStartMs
@@ -140,9 +250,19 @@ export function recordParkVerdictFlips(args: {
     record.parked = parked
     record.flips += 1
     record.burstFlips += 1
+    // Why the max and not a bare assignment: engaging the pin IS a rendered
+    // verdict transition — the hook drops the tab from the parked set, the
+    // effect re-runs on the changed dep, and that flip lands while the pin is
+    // live. A bare assignment overwrote the future deadline with the current
+    // time, so the quiet branch cleared the back-off one window later instead of
+    // one window after the pin ended, defeating this mechanism at exactly the
+    // slow cadences it exists for.
+    record.lastFlipMs = Math.max(nowMs, record.pinnedUntilMs ?? 0)
 
     if (!isParkVerdictPinLive(record, nowMs) && record.burstFlips >= burstLimit) {
       record.pinnedUntilMs = nowMs + flipWindowMs
+      record.pinTrigger = 'burst'
+      record.lastFlipMs = record.pinnedUntilMs
       recordRendererCrashBreadcrumb('terminal_park_verdict_churn', {
         tabId,
         trigger: 'burst',
@@ -158,6 +278,20 @@ export function recordParkVerdictFlips(args: {
     // exists to keep down.
     if (!isParkVerdictPinLive(record, nowMs) && !record.notified && record.flips >= noticeLimit) {
       record.notified = true
+      // Why this pins too: the burst window only catches churn fast enough to
+      // reach React's commit bail. Churn one flip every ~3-5s never bursts, so
+      // it used to run unbounded — 47min in one field launch, 9min in another.
+      // Each remount is user-visible, so the notice limit damps on its own.
+      let pinData: { pinnedForMs: number; sustainedPinCount: number } | undefined
+      if (allowSustainedPin) {
+        const sustainedPinCount = (record.sustainedPinCount ?? 0) + 1
+        const pinnedForMs = Math.min(flipWindowMs * 2 ** (sustainedPinCount - 1), sustainedPinMaxMs)
+        record.sustainedPinCount = sustainedPinCount
+        record.pinnedUntilMs = nowMs + pinnedForMs
+        record.pinTrigger = 'window'
+        record.lastFlipMs = record.pinnedUntilMs
+        pinData = { pinnedForMs, sustainedPinCount }
+      }
       // Why: flips is always exactly noticeLimit here, so elapsedMs is the only
       // field that separates slow churn from a burst the damping already caught.
       recordRendererCrashBreadcrumb('terminal_park_verdict_churn', {
@@ -165,7 +299,8 @@ export function recordParkVerdictFlips(args: {
         trigger: 'window',
         flips: record.flips,
         elapsedMs: nowMs - record.windowStartMs,
-        windowMs: flipWindowMs
+        windowMs: flipWindowMs,
+        ...pinData
       })
     }
   }
diff --git a/src/renderer/src/components/terminal-pane/terminal-parked-pty-watcher.ts b/src/renderer/src/components/terminal-pane/terminal-parked-pty-watcher.ts
index 158d03e8bb02..f70599f148c6 100644
--- a/src/renderer/src/components/terminal-pane/terminal-parked-pty-watcher.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-parked-pty-watcher.ts
@@ -181,9 +181,15 @@ export function collapseParkedExitedLeaf(tabId: string, ptyId: string): void {
   const leafId =
     capturedPanesByTabId.get(tabId)?.panes.find((pane) => pane.ptyId === ptyId)?.leafId ??
     Object.entries(layout?.ptyIdsByLeafId ?? {}).find(([, boundPtyId]) => boundPtyId === ptyId)?.[0]
-  if (!leafId) {
-    return
+  if (leafId) {
+    collapseParkedTerminalLeaf(tabId, leafId, ptyId)
   }
+}
+
+/** Removes one leaf from a parked tab's stored layout; a no-op once the leaf is gone. */
+export function collapseParkedTerminalLeaf(tabId: string, leafId: string, ptyId?: string): void {
+  const state = useAppStore.getState()
+  const layout = state.terminalLayoutsByTabId[tabId]
   const detached = detachTerminalLayoutLeaf(layout, leafId)
   if (!detached) {
     return
@@ -191,7 +197,7 @@ export function collapseParkedExitedLeaf(tabId: string, ptyId: string): void {
   const terminalTab = Object.values(state.tabsByWorktree)
     .flat()
     .find((candidate) => candidate.id === tabId)
-  if (shouldClearLaunchAgentForClosedPane(terminalTab, ptyId)) {
+  if (shouldClearLaunchAgentForClosedPane(terminalTab, ptyId ?? layout?.ptyIdsByLeafId?.[leafId])) {
     state.clearTabLaunchAgent(tabId)
   }
   state.setTabLayout(tabId, detached.sourceLayout)
diff --git a/src/renderer/src/components/terminal-pane/terminal-paste-operation-order.test.ts b/src/renderer/src/components/terminal-pane/terminal-paste-operation-order.test.ts
index b36f0d06f65d..f08926b2c81d 100644
--- a/src/renderer/src/components/terminal-pane/terminal-paste-operation-order.test.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-paste-operation-order.test.ts
@@ -54,7 +54,13 @@ describe('terminal paste operation ordering', () => {
       pasteText: () => {},
       writePty,
       yieldToEventLoop: async () => {
-        startupDraft ??= sendAgentDraftPasteContent(null, 'pty-1', 'GENERATED_CONTEXT', writePty)
+        startupDraft ??= sendAgentDraftPasteContent(
+          null,
+          'pty-1',
+          'GENERATED_CONTEXT',
+          'launch',
+          writePty
+        )
       }
     })
     await startupDraft
@@ -80,6 +86,7 @@ describe('terminal paste operation ordering', () => {
       null,
       'pty-1',
       'G'.repeat(64 * 1024 + 1),
+      'launch',
       async (data) => {
         writes.push({ owner: 'startup', data })
         if (data === BRACKETED_PASTE_START) {
diff --git a/src/renderer/src/components/terminal-pane/terminal-programmatic-text-paste.ts b/src/renderer/src/components/terminal-pane/terminal-programmatic-text-paste.ts
index f92427e4729a..4f3549a15eef 100644
--- a/src/renderer/src/components/terminal-pane/terminal-programmatic-text-paste.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-programmatic-text-paste.ts
@@ -66,7 +66,7 @@ export function handleTerminalProgrammaticTextPaste({
     .then((plan) =>
       executeTerminalPastePlan(plan, {
         pasteText: (text, options) => pasteTerminalText(pane.terminal, text, options),
-        writePty: (data) => writeTerminalPastePtyInput(transport, data),
+        writePty: (data) => writeTerminalPastePtyInput(transport, data, 'driving'),
         isTargetCurrent: () =>
           isTerminalPanePasteTargetCurrent({
             manager: getManager(),
diff --git a/src/renderer/src/components/terminal-pane/terminal-pty-paste-writer.test.ts b/src/renderer/src/components/terminal-pane/terminal-pty-paste-writer.test.ts
index e501c50402d1..5a587c6acc9f 100644
--- a/src/renderer/src/components/terminal-pane/terminal-pty-paste-writer.test.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-pty-paste-writer.test.ts
@@ -8,21 +8,21 @@ describe('terminal PTY paste writer', () => {
     const sendInputAccepted = vi.fn().mockResolvedValue(true)
 
     await expect(
-      writeTerminalPastePtyInput({ sendInput, sendInputAccepted }, 'payload')
+      writeTerminalPastePtyInput({ sendInput, sendInputAccepted }, 'payload', 'driving')
     ).resolves.toBe(true)
 
-    expect(sendInputAccepted).toHaveBeenCalledWith('payload')
+    expect(sendInputAccepted).toHaveBeenCalledWith('payload', 'driving')
     expect(sendInput).not.toHaveBeenCalled()
   })
 
   it('falls back to queued PTY writes when acknowledged writes are unavailable', () => {
     const sendInput = vi.fn().mockReturnValue(true)
 
-    expect(writeTerminalPastePtyInput({ sendInput }, 'payload')).toBe(true)
-    expect(sendInput).toHaveBeenCalledWith('payload')
+    expect(writeTerminalPastePtyInput({ sendInput }, 'payload', 'driving')).toBe(true)
+    expect(sendInput).toHaveBeenCalledWith('payload', 'driving')
   })
 
   it('rejects writes without a transport', () => {
-    expect(writeTerminalPastePtyInput(undefined, 'payload')).toBe(false)
+    expect(writeTerminalPastePtyInput(undefined, 'payload', 'driving')).toBe(false)
   })
 })
diff --git a/src/renderer/src/components/terminal-pane/terminal-pty-paste-writer.ts b/src/renderer/src/components/terminal-pane/terminal-pty-paste-writer.ts
index dd7e257615a1..d1fffbc76fbc 100644
--- a/src/renderer/src/components/terminal-pane/terminal-pty-paste-writer.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-pty-paste-writer.ts
@@ -1,15 +1,17 @@
 import type { PtyTransport } from './pty-transport'
+import type { TerminalInputKind } from '../../../../shared/terminal-input-kind'
 
 type TerminalPastePtyWriter = Pick<PtyTransport, 'sendInput' | 'sendInputAccepted'>
 
 export function writeTerminalPastePtyInput(
   transport: TerminalPastePtyWriter | undefined,
-  data: string
+  data: string,
+  inputKind: TerminalInputKind
 ): boolean | Promise<boolean> {
   if (!transport) {
     return false
   }
   // Why: paste chunking must respect PTY backpressure. sendInput only queues
   // local writes, while sendInputAccepted resolves after the PTY accepts them.
-  return transport.sendInputAccepted?.(data) ?? transport.sendInput(data)
+  return transport.sendInputAccepted?.(data, inputKind) ?? transport.sendInput(data, inputKind)
 }
diff --git a/src/renderer/src/components/terminal-pane/terminal-quick-command-dispatch.test.ts b/src/renderer/src/components/terminal-pane/terminal-quick-command-dispatch.test.ts
index 7759e8802bf3..11c0449bd968 100644
--- a/src/renderer/src/components/terminal-pane/terminal-quick-command-dispatch.test.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-quick-command-dispatch.test.ts
@@ -40,7 +40,7 @@ describe('sendTerminalQuickCommandToPane', () => {
     })
 
     expect(sent).toBe(true)
-    expect(sendInput).toHaveBeenCalledWith('git status\r')
+    expect(sendInput).toHaveBeenCalledWith('git status\r', 'driving')
     expect(pane.terminal.focus).toHaveBeenCalledOnce()
     expect(mocks.recordTerminalUserInputForLeaf).toHaveBeenCalledWith('tab-1', 'leaf-1')
   })
@@ -62,7 +62,7 @@ describe('sendTerminalQuickCommandToPane', () => {
     })
 
     expect(sent).toBe(false)
-    expect(sendInput).toHaveBeenCalledWith('npm test')
+    expect(sendInput).toHaveBeenCalledWith('npm test', 'driving')
     expect(pane.terminal.focus).not.toHaveBeenCalled()
     expect(mocks.recordTerminalUserInputForLeaf).not.toHaveBeenCalled()
   })
@@ -85,7 +85,7 @@ describe('sendTerminalQuickCommandToPane', () => {
     })
 
     expect(sent).toBe(true)
-    expect(sendInput).toHaveBeenCalledWith('cd packages; bun run build; cd ..\r')
+    expect(sendInput).toHaveBeenCalledWith('cd packages; bun run build; cd ..\r', 'driving')
     expect(pane.terminal.focus).toHaveBeenCalledOnce()
   })
 
@@ -107,7 +107,7 @@ describe('sendTerminalQuickCommandToPane', () => {
     })
 
     expect(sent).toBe(true)
-    expect(sendInput).toHaveBeenCalledWith('echo one; echo two')
+    expect(sendInput).toHaveBeenCalledWith('echo one; echo two', 'driving')
     expect(pane.terminal.focus).toHaveBeenCalledOnce()
   })
 
diff --git a/src/renderer/src/components/terminal-pane/terminal-quick-command-dispatch.ts b/src/renderer/src/components/terminal-pane/terminal-quick-command-dispatch.ts
index 39d49d02c866..5c8d3622b002 100644
--- a/src/renderer/src/components/terminal-pane/terminal-quick-command-dispatch.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-quick-command-dispatch.ts
@@ -5,6 +5,7 @@ import {
   isTerminalAgentQuickCommand
 } from '../../../../shared/terminal-quick-commands'
 import { recordTerminalUserInputForLeaf } from './terminal-input-activity'
+import type { PtyTransport } from './pty-transport-types'
 
 type QuickCommandPane = {
   leafId: string
@@ -13,9 +14,7 @@ type QuickCommandPane = {
   }
 }
 
-type QuickCommandTransport = {
-  sendInput: (data: string) => boolean
-}
+type QuickCommandTransport = Pick<PtyTransport, 'sendInput'>
 
 export function sendTerminalQuickCommandToPane({
   command,
@@ -36,7 +35,8 @@ export function sendTerminalQuickCommandToPane({
   }
 
   const sent = transport.sendInput(
-    buildTerminalQuickCommandInput(flattenTerminalQuickCommand(command))
+    buildTerminalQuickCommandInput(flattenTerminalQuickCommand(command)),
+    'driving'
   )
   if (sent) {
     recordTerminalUserInputForLeaf(tabId, pane.leafId)
diff --git a/src/renderer/src/components/terminal-pane/terminal-render-desync-evidence-persistence.test.ts b/src/renderer/src/components/terminal-pane/terminal-render-desync-evidence-persistence.test.ts
new file mode 100644
index 000000000000..2bfe39c2971e
--- /dev/null
+++ b/src/renderer/src/components/terminal-pane/terminal-render-desync-evidence-persistence.test.ts
@@ -0,0 +1,27 @@
+import { describe, expect, it } from 'vitest'
+import { TERMINAL_RENDER_DESYNC_CAPTURE_ID_PATTERN } from '../../../../shared/terminal-render-desync-evidence'
+import { makePaneKey } from '../../../../shared/stable-pane-id'
+import { createBrowserUuid } from '@/lib/browser-uuid'
+import { createCaptureId } from './terminal-render-desync-evidence-persistence'
+
+describe('createCaptureId', () => {
+  // A real paneKey is two UUIDs joined by ':'. Unbounded, the id ran 124 chars and main
+  // rejected every capture with 'Invalid render-desync capture id'.
+  it('stays inside the id main will accept for a realistic paneKey', () => {
+    const paneKey = makePaneKey(createBrowserUuid(), createBrowserUuid())
+
+    expect(createCaptureId(paneKey)).toMatch(TERMINAL_RENDER_DESYNC_CAPTURE_ID_PATTERN)
+  })
+
+  it('keeps the leaf id so a capture is still traceable to its pane', () => {
+    const leafId = createBrowserUuid()
+
+    expect(createCaptureId(makePaneKey(createBrowserUuid(), leafId))).toContain(leafId)
+  })
+
+  it('does not collide for repeated captures of the same pane', () => {
+    const paneKey = makePaneKey(createBrowserUuid(), createBrowserUuid())
+
+    expect(createCaptureId(paneKey)).not.toBe(createCaptureId(paneKey))
+  })
+})
diff --git a/src/renderer/src/components/terminal-pane/terminal-render-desync-evidence-persistence.ts b/src/renderer/src/components/terminal-pane/terminal-render-desync-evidence-persistence.ts
index 036f677a02b8..ee3be4f4eb6b 100644
--- a/src/renderer/src/components/terminal-pane/terminal-render-desync-evidence-persistence.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-render-desync-evidence-persistence.ts
@@ -1,4 +1,5 @@
 import type { SentinelEvidence } from './terminal-render-desync-sentinel'
+import { createBrowserUuid } from '@/lib/browser-uuid'
 
 /**
  * Durable persistence for render-desync captures, split from the sentinel so
@@ -59,8 +60,13 @@ export async function persistHealedReference(
   }
 }
 
+/** Why: a real paneKey is `${tabId}:${leafId}` — two UUIDs, 73 chars — which pushes the full
+ *  id past main's 120-char cap, so every capture was rejected. The trailing leaf id is the
+ *  identifying half, and the UUID nonce already guarantees uniqueness. */
+const MAX_CAPTURE_ID_PANE_PART_LENGTH = 40
+
 export function createCaptureId(paneKey: string): string {
-  const panePart = paneKey.replace(/[^a-zA-Z0-9_-]/g, '-')
-  const nonce = globalThis.crypto?.randomUUID?.() ?? Math.random().toString(36).slice(2)
+  const panePart = paneKey.replace(/[^a-zA-Z0-9_-]/g, '-').slice(-MAX_CAPTURE_ID_PANE_PART_LENGTH)
+  const nonce = createBrowserUuid()
   return `${Date.now()}-${panePart}-${nonce}`
 }
diff --git a/src/renderer/src/components/terminal-pane/terminal-retention-churn-pins.test.tsx b/src/renderer/src/components/terminal-pane/terminal-retention-churn-pins.test.tsx
new file mode 100644
index 000000000000..a84ee6f2eb17
--- /dev/null
+++ b/src/renderer/src/components/terminal-pane/terminal-retention-churn-pins.test.tsx
@@ -0,0 +1,220 @@
+// @vitest-environment happy-dom
+import { act, renderHook } from '@testing-library/react'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { CrashReportBreadcrumbData } from '../../../../shared/crash-reporting'
+import type { TerminalTab } from '../../../../shared/terminal-tab-types'
+
+const harness = vi.hoisted(() => ({
+  state: {
+    pendingStartupByTabId: {},
+    ptyIdsByTabId: {},
+    runtimeStatusByEnvironmentId: new Map(),
+    runtimePaneTitlesByTabId: {},
+    settings: {},
+    terminalLayoutsByTabId: {},
+    sleepingAgentSessionsByPaneKey: {},
+    repos: []
+  },
+  breadcrumb: vi.fn<(name: string, data?: CrashReportBreadcrumbData) => void>(),
+  syncWatchers: vi.fn()
+}))
+
+vi.mock('../../store', () => ({
+  useAppStore: Object.assign(
+    (selector: (state: typeof harness.state) => unknown) => selector(harness.state),
+    { getState: () => harness.state }
+  )
+}))
+
+vi.mock('./terminal-parked-tab-watchers', () => ({
+  canWatcherCoverParkedTerminalTab: () => true,
+  resolveParkedTerminalPaneCandidates: () => [],
+  disposeParkedTerminalWatchersForWorktree: vi.fn(),
+  syncParkedTerminalTabWatchers: harness.syncWatchers
+}))
+
+// Isolate the worktree verdict from the separate per-tab aging policy.
+vi.mock('./terminal-parking-e2e-overrides', () => ({
+  getTerminalParkingPolicyOverrides: () => ({ coldParkDelayMs: 24 * 60 * 60_000 })
+}))
+
+vi.mock('@/lib/crash-breadcrumb-recorder', () => ({
+  recordRendererCrashBreadcrumb: harness.breadcrumb
+}))
+
+import { useTerminalTabColdParking } from './use-terminal-tab-cold-parking'
+import {
+  TERMINAL_TAB_PARK_FLIP_BURST_LIMIT,
+  TERMINAL_TAB_PARK_FLIP_SUSTAINED_PIN_MAX_MS,
+  TERMINAL_TAB_PARK_FLIP_WINDOW_MS
+} from './terminal-park-verdict-flip-telemetry'
+
+const WORKTREE_ID = 'retention-churn'
+const TAB_ID = 'restorable-ssh-tab'
+const EXEMPT_TAB_ID = 'local-live-shell'
+const STEP_MS = 4_000
+
+function terminalTab(id: string, ptyId: string): TerminalTab {
+  return {
+    id,
+    ptyId,
+    worktreeId: WORKTREE_ID,
+    title: id,
+    customTitle: null,
+    color: null,
+    sortOrder: 0,
+    createdAt: 0
+  }
+}
+
+type ParkingArgs = Parameters<typeof useTerminalTabColdParking>[0]
+
+function parkingArgs(isForceParked = false): ParkingArgs {
+  return {
+    worktreeId: WORKTREE_ID,
+    terminalTabs: [
+      terminalTab(TAB_ID, 'ssh:host@@session-1'),
+      terminalTab(EXEMPT_TAB_ID, 'local-fail-open-pty')
+    ],
+    assignments: new Map(),
+    isWorktreeActive: false,
+    activeTerminalTabId: null,
+    coldParkTerminalPanes: false,
+    isForceParked,
+    shouldMeasureHiddenWorktree: false,
+    activityTerminalPortals: []
+  }
+}
+
+function churn(
+  rerender: (args: ParkingArgs) => void,
+  args: ParkingArgs,
+  flips = 13,
+  stepMs = STEP_MS
+): void {
+  for (let flip = 1; flip <= flips; flip += 1) {
+    act(() => {
+      vi.advanceTimersByTime(stepMs)
+      rerender({ ...args, coldParkTerminalPanes: flip % 2 === 1 })
+    })
+  }
+}
+
+describe('retention force-parking and churn pins', () => {
+  beforeEach(() => {
+    vi.useFakeTimers()
+    vi.setSystemTime(1_000_000)
+    harness.breadcrumb.mockClear()
+    harness.syncWatchers.mockClear()
+  })
+
+  afterEach(() => vi.useRealTimers())
+
+  it('releases an earned sustained pin when forced, preserving the live-shell exemption', () => {
+    const args = parkingArgs()
+    const { result, rerender } = renderHook(useTerminalTabColdParking, { initialProps: args })
+    churn(rerender, args)
+    expect(result.current.size).toBe(0)
+    expect(harness.breadcrumb).toHaveBeenCalledWith(
+      'terminal_park_verdict_churn',
+      expect.objectContaining({ trigger: 'window', pinnedForMs: TERMINAL_TAB_PARK_FLIP_WINDOW_MS })
+    )
+
+    act(() => rerender({ ...args, coldParkTerminalPanes: true, isForceParked: true }))
+
+    expect(result.current).toEqual(new Set([TAB_ID]))
+    expect(harness.syncWatchers).toHaveBeenLastCalledWith(
+      expect.objectContaining({ parkedTabIds: new Set([TAB_ID]) })
+    )
+  })
+
+  it('does not rearm sustained pins while forced and resumes damping after force-parking ends', () => {
+    const args = parkingArgs(true)
+    const { result, rerender } = renderHook(useTerminalTabColdParking, { initialProps: args })
+    for (let flip = 1; flip <= 30; flip += 1) {
+      act(() => {
+        vi.advanceTimersByTime(STEP_MS)
+        rerender({ ...args, coldParkTerminalPanes: flip % 2 === 1 })
+      })
+      expect(result.current).toEqual(flip % 2 === 1 ? new Set([TAB_ID]) : new Set())
+    }
+    expect(harness.breadcrumb).toHaveBeenCalledWith(
+      'terminal_park_verdict_churn',
+      expect.objectContaining({ trigger: 'window' })
+    )
+    expect(harness.breadcrumb.mock.calls.some(([, data]) => data?.pinnedForMs !== undefined)).toBe(
+      false
+    )
+
+    act(() => vi.advanceTimersByTime(TERMINAL_TAB_PARK_FLIP_WINDOW_MS))
+    churn(rerender, { ...args, isForceParked: false })
+    expect(result.current.size).toBe(0)
+    expect(harness.breadcrumb).toHaveBeenCalledWith(
+      'terminal_park_verdict_churn',
+      expect.objectContaining({ trigger: 'window', pinnedForMs: TERMINAL_TAB_PARK_FLIP_WINDOW_MS })
+    )
+  })
+
+  it.each([false, true])('preserves the burst deadline with initial force-parking %s', (forced) => {
+    const args = parkingArgs(forced)
+    const { result, rerender } = renderHook(useTerminalTabColdParking, { initialProps: args })
+    churn(rerender, args, TERMINAL_TAB_PARK_FLIP_BURST_LIMIT, 10)
+    expect(result.current.size).toBe(0)
+    expect(harness.breadcrumb).toHaveBeenCalledWith(
+      'terminal_park_verdict_churn',
+      expect.objectContaining({ trigger: 'burst', pinnedForMs: TERMINAL_TAB_PARK_FLIP_WINDOW_MS })
+    )
+
+    act(() => {
+      vi.advanceTimersByTime(10_000)
+      rerender({ ...args, coldParkTerminalPanes: true, isForceParked: true })
+    })
+    expect(result.current.size).toBe(0)
+    act(() => vi.advanceTimersByTime(TERMINAL_TAB_PARK_FLIP_WINDOW_MS - 10_000))
+    expect(result.current).toEqual(new Set([TAB_ID]))
+  })
+
+  it('releases an ordinary pane at the eight-minute ceiling without further input changes', () => {
+    const args = parkingArgs()
+    args.terminalTabs = [terminalTab(TAB_ID, 'ssh:host@@session-1')]
+    const { result, rerender, unmount } = renderHook(useTerminalTabColdParking, {
+      initialProps: args
+    })
+    const reachedCeiling = () =>
+      harness.breadcrumb.mock.calls.some(
+        ([, data]) => data?.pinnedForMs === TERMINAL_TAB_PARK_FLIP_SUSTAINED_PIN_MAX_MS
+      )
+    for (let flip = 1; flip <= 600 && !reachedCeiling(); flip += 1) {
+      act(() => {
+        vi.advanceTimersByTime(STEP_MS)
+        rerender({ ...args, coldParkTerminalPanes: flip % 2 === 1 })
+      })
+    }
+    expect(reachedCeiling()).toBe(true)
+    act(() => rerender({ ...args, coldParkTerminalPanes: true }))
+    expect(result.current.size).toBe(0)
+
+    act(() => vi.advanceTimersByTime(TERMINAL_TAB_PARK_FLIP_SUSTAINED_PIN_MAX_MS - 1))
+    expect(result.current.size).toBe(0)
+    act(() => vi.advanceTimersByTime(1))
+    expect(result.current).toEqual(new Set([TAB_ID]))
+    expect(harness.syncWatchers).toHaveBeenLastCalledWith(
+      expect.objectContaining({ parkedTabIds: new Set([TAB_ID]) })
+    )
+    unmount()
+    expect(vi.getTimerCount()).toBe(0)
+  })
+
+  it('clears a live sustained-pin timer when its worktree unmounts', () => {
+    const args = parkingArgs()
+    const { rerender, unmount } = renderHook(useTerminalTabColdParking, { initialProps: args })
+    churn(rerender, args)
+    expect(harness.breadcrumb).toHaveBeenCalledWith(
+      'terminal_park_verdict_churn',
+      expect.objectContaining({ trigger: 'window', pinnedForMs: TERMINAL_TAB_PARK_FLIP_WINDOW_MS })
+    )
+    expect(vi.getTimerCount()).toBeGreaterThan(0)
+    unmount()
+    expect(vi.getTimerCount()).toBe(0)
+  })
+})
diff --git a/src/renderer/src/components/terminal-pane/terminal-shutdown-layout-capture.test.ts b/src/renderer/src/components/terminal-pane/terminal-shutdown-layout-capture.test.ts
index 066aadfdb462..7e75da603eeb 100644
--- a/src/renderer/src/components/terminal-pane/terminal-shutdown-layout-capture.test.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-shutdown-layout-capture.test.ts
@@ -190,7 +190,8 @@ describe('captureTerminalShutdownLayout', () => {
       expandedPaneId: null,
       paneTransports: new Map([[1, { getPtyId: vi.fn(() => 'pty-1') }]]),
       paneTitlesByPaneId: { 1: 'build logs' },
-      existingLayout: undefined
+      existingLayout: undefined,
+      chatLeafId: LEAF_ID
     })
 
     expect(order).toEqual(['flush', 'serialize'])
@@ -200,7 +201,8 @@ describe('captureTerminalShutdownLayout', () => {
       expandedLeafId: null,
       buffersByLeafId: { [LEAF_ID]: `snapshot:queued-before-quit${CURSOR_HOME}` },
       ptyIdsByLeafId: { [LEAF_ID]: 'pty-1' },
-      titlesByLeafId: { [LEAF_ID]: 'build logs' }
+      titlesByLeafId: { [LEAF_ID]: 'build logs' },
+      chatLeafId: LEAF_ID
     })
   })
 
diff --git a/src/renderer/src/components/terminal-pane/terminal-shutdown-layout-capture.ts b/src/renderer/src/components/terminal-pane/terminal-shutdown-layout-capture.ts
index 523db618d337..f53c96347d8b 100644
--- a/src/renderer/src/components/terminal-pane/terminal-shutdown-layout-capture.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-shutdown-layout-capture.ts
@@ -25,6 +25,7 @@ type CaptureTerminalShutdownLayoutArgs = {
   paneTransports: ReadonlyMap<number, Pick<PtyTransport, 'getPtyId'>>
   paneTitlesByPaneId: Record<number, string>
   existingLayout: TerminalLayoutSnapshot | undefined
+  chatLeafId?: string | null
   /** Merge prior for buffers, resolved across both scrollback homes; defaults to the shared layout's. */
   priorBuffersByLeafId?: Record<string, string>
   captureBuffers?: boolean
@@ -98,6 +99,7 @@ export function captureTerminalShutdownLayout({
   paneTransports,
   paneTitlesByPaneId,
   existingLayout,
+  chatLeafId,
   priorBuffersByLeafId = existingLayout?.buffersByLeafId,
   captureBuffers = true,
   clearedScrollbackLeafIds
@@ -141,6 +143,9 @@ export function captureTerminalShutdownLayout({
     new Map(panes.map((pane) => [pane.id, pane.leafId]))
   )
   const currentLeafIds = new Set(panes.map((p) => p.leafId))
+  if (chatLeafId && panes.some((pane) => pane.leafId === chatLeafId)) {
+    layout.chatLeafId = chatLeafId
+  }
   const livePtyIdsByLeafId: Record<string, string> = {}
   const preservedPtyIdsByLeafId: Record<string, string> = {}
   for (const pane of panes) {
diff --git a/src/renderer/src/components/terminal-pane/terminal-spawn-error-display.test.ts b/src/renderer/src/components/terminal-pane/terminal-spawn-error-display.test.ts
new file mode 100644
index 000000000000..fad9f9d7c204
--- /dev/null
+++ b/src/renderer/src/components/terminal-pane/terminal-spawn-error-display.test.ts
@@ -0,0 +1,70 @@
+import { describe, expect, it, vi } from 'vitest'
+import {
+  LEGACY_PTY_ALLOCATION_HINT,
+  LEGACY_TERMINAL_PROCESS_LIMIT_HINT,
+  PTY_ALLOCATION_HINT,
+  TERMINAL_PROCESS_LIMIT_HINT
+} from '../../../../shared/terminal-spawn-error-copy'
+
+// Why a locale stand-in: English fallbacks equal the host copy, so only a translation shows the swap.
+vi.mock('@/i18n/i18n', () => ({
+  translate: (key: string, fallback: string) =>
+    ({
+      'auto.components.terminal.pane.TerminalErrorToast.ptyAllocationLimit':
+        '系统无法再分配 pty 设备。',
+      'auto.components.terminal.pane.TerminalErrorToast.terminalProcessLimit':
+        '系统无法再启动终端进程。'
+    })[key] ?? fallback
+}))
+
+import {
+  localizeTerminalSpawnHints,
+  withoutTerminalSpawnIssueRequest
+} from './terminal-spawn-error-display'
+
+const RAW =
+  'Failed to spawn shell "/bin/zsh": node-pty: open_slave failed: EMFILE (errno 24, Too many open files) (shell: /bin/zsh). If this persists, please file an issue.'
+
+describe('localizeTerminalSpawnHints', () => {
+  it('translates the pty allocation hint and keeps the raw diagnostic', () => {
+    expect(localizeTerminalSpawnHints(`${PTY_ALLOCATION_HINT}\n${RAW}`)).toBe(
+      `系统无法再分配 pty 设备。\n${RAW}`
+    )
+  })
+
+  it('translates the terminal process limit hint', () => {
+    expect(localizeTerminalSpawnHints(TERMINAL_PROCESS_LIMIT_HINT)).toBe('系统无法再启动终端进程。')
+  })
+
+  it('translates the multi-line hints an older host publishes', () => {
+    expect(localizeTerminalSpawnHints(`${LEGACY_PTY_ALLOCATION_HINT} ${RAW}`)).toBe(
+      `系统无法再分配 pty 设备。 ${RAW}`
+    )
+    expect(localizeTerminalSpawnHints(LEGACY_TERMINAL_PROCESS_LIMIT_HINT)).toBe(
+      '系统无法再启动终端进程。'
+    )
+  })
+
+  it('leaves unrelated errors untouched', () => {
+    expect(localizeTerminalSpawnHints('Paste failed.')).toBe('Paste failed.')
+  })
+})
+
+describe('withoutTerminalSpawnIssueRequest', () => {
+  it('drops the host issue request and keeps the diagnostic', () => {
+    expect(withoutTerminalSpawnIssueRequest(RAW)).toBe(
+      'Failed to spawn shell "/bin/zsh": node-pty: open_slave failed: EMFILE (errno 24, Too many open files) (shell: /bin/zsh).'
+    )
+  })
+
+  it('drops the request from an error before another pane error', () => {
+    expect(withoutTerminalSpawnIssueRequest(`${RAW}\nPaste failed.`)).toBe(
+      'Failed to spawn shell "/bin/zsh": node-pty: open_slave failed: EMFILE (errno 24, Too many open files) (shell: /bin/zsh).\nPaste failed.'
+    )
+  })
+
+  it('keeps the same words when they are part of the diagnostic', () => {
+    const error = `Command printed: If this persists, please file an issue.\nMore detail follows.`
+    expect(withoutTerminalSpawnIssueRequest(error)).toBe(error)
+  })
+})
diff --git a/src/renderer/src/components/terminal-pane/terminal-spawn-error-display.ts b/src/renderer/src/components/terminal-pane/terminal-spawn-error-display.ts
new file mode 100644
index 000000000000..faa79292388e
--- /dev/null
+++ b/src/renderer/src/components/terminal-pane/terminal-spawn-error-display.ts
@@ -0,0 +1,39 @@
+import { translate } from '@/i18n/i18n'
+import {
+  LEGACY_PTY_ALLOCATION_HINT,
+  LEGACY_TERMINAL_PROCESS_LIMIT_HINT,
+  PTY_ALLOCATION_HINT,
+  TERMINAL_PROCESS_LIMIT_HINT,
+  TERMINAL_SPAWN_ISSUE_REQUEST
+} from '../../../../shared/terminal-spawn-error-copy'
+
+/** Swaps the host's English resource-limit hints for the viewer's locale. */
+export function localizeTerminalSpawnHints(error: string): string {
+  const ptyAllocation = translate(
+    'auto.components.terminal.pane.TerminalErrorToast.ptyAllocationLimit',
+    PTY_ALLOCATION_HINT
+  )
+  const processLimit = translate(
+    'auto.components.terminal.pane.TerminalErrorToast.terminalProcessLimit',
+    TERMINAL_PROCESS_LIMIT_HINT
+  )
+  // Why a replacer: a translation containing `$&` would otherwise be read as a substitution.
+  return error
+    .replaceAll(LEGACY_PTY_ALLOCATION_HINT, () => ptyAllocation)
+    .replaceAll(PTY_ALLOCATION_HINT, () => ptyAllocation)
+    .replaceAll(LEGACY_TERMINAL_PROCESS_LIMIT_HINT, () => processLimit)
+    .replaceAll(TERMINAL_PROCESS_LIMIT_HINT, () => processLimit)
+}
+
+/** Drops the host's plain-text issue request where the toast renders its own linked one. */
+export function withoutTerminalSpawnIssueRequest(error: string): string {
+  const suffix = ` ${TERMINAL_SPAWN_ISSUE_REQUEST}`
+  return error
+    .split('\n')
+    .map((line) =>
+      line.includes('Failed to spawn shell "') && line.endsWith(suffix)
+        ? line.slice(0, -suffix.length)
+        : line
+    )
+    .join('\n')
+}
diff --git a/src/renderer/src/components/terminal-pane/terminal-startup-command-paste.ts b/src/renderer/src/components/terminal-pane/terminal-startup-command-paste.ts
index 3a2307cd87dc..913c8b6cfdcd 100644
--- a/src/renderer/src/components/terminal-pane/terminal-startup-command-paste.ts
+++ b/src/renderer/src/components/terminal-pane/terminal-startup-command-paste.ts
@@ -47,7 +47,7 @@ export async function executeTerminalStartupCommandPaste({
 
   return executeTerminalPastePlan(plan, {
     pasteText: (text, options) => pasteTerminalText(pane.terminal, text, options),
-    writePty: (data) => writeTerminalPastePtyInput(transport, data),
+    writePty: (data) => writeTerminalPastePtyInput(transport, data, 'launch'),
     isTargetCurrent: isCurrent,
     canContinue: isCurrent
   })
diff --git a/src/renderer/src/components/terminal-pane/title-agent-identity.ts b/src/renderer/src/components/terminal-pane/title-agent-identity.ts
index 8a496052335f..157d082a9197 100644
--- a/src/renderer/src/components/terminal-pane/title-agent-identity.ts
+++ b/src/renderer/src/components/terminal-pane/title-agent-identity.ts
@@ -1,3 +1,4 @@
+import { isQoderTerminalTitle } from '../../../../shared/qoder-terminal-title'
 import {
   detectAgentStatusFromTitle,
   isGeminiTerminalTitle,
@@ -21,6 +22,7 @@ export function titleHasExplicitAgentIdentity(title: string): boolean {
     title.startsWith('. ') ||
     title.startsWith('* ') ||
     title.startsWith('\u2733') ||
+    isQoderTerminalTitle(title) ||
     isGeminiTerminalTitle(title) ||
     isPiTerminalTitle(title)
   ) {
diff --git a/src/renderer/src/components/terminal-pane/use-notification-dispatch-verdict.test.ts b/src/renderer/src/components/terminal-pane/use-notification-dispatch-verdict.test.ts
new file mode 100644
index 000000000000..2178d357c7aa
--- /dev/null
+++ b/src/renderer/src/components/terminal-pane/use-notification-dispatch-verdict.test.ts
@@ -0,0 +1,53 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { dispatchTerminalNotification } from './use-notification-dispatch'
+import {
+  PANE_KEY,
+  getLastNotificationDispatchArg,
+  makeAgentStatus,
+  resetNotificationDispatchMockState,
+  type NotificationDispatchMockState
+} from './notification-dispatch-test-harness'
+
+vi.mock('@/store', async () => {
+  const harness = await import('./notification-dispatch-test-harness')
+  return harness.createNotificationDispatchStoreModuleMock()
+})
+
+vi.mock('@/lib/desktop-notification-sound', async () => {
+  const harness = await import('./notification-dispatch-test-harness')
+  return harness.createDesktopNotificationSoundModuleMock()
+})
+
+let mockState: NotificationDispatchMockState
+
+// The hook lane hands main the row's verdict, read through the one accessor, so a terminal
+// agent's StopFailure is worded "failed" rather than "finished".
+describe('dispatchTerminalNotification verdict', () => {
+  beforeEach(() => {
+    mockState = resetNotificationDispatchMockState()
+  })
+
+  afterEach(() => {
+    vi.unstubAllGlobals()
+  })
+
+  it.each([
+    [{ mainAgent: { state: 'done', outcome: 'failure', stateStartedAt: 1 } }, 'failure'],
+    [{ mainAgent: { state: 'done', outcome: 'cancellation', stateStartedAt: 1 } }, 'cancellation'],
+    [{ interrupted: true }, 'cancellation'],
+    [{}, undefined]
+  ] as const)('passes %j as the turn outcome %s', (overrides, outcome) => {
+    mockState.agentStatusByPaneKey[PANE_KEY] = makeAgentStatus(PANE_KEY, overrides)
+
+    dispatchTerminalNotification('wt-primary', {
+      source: 'agent-task-complete',
+      terminalTitle: 'codex',
+      paneKey: PANE_KEY
+    })
+
+    expect(getLastNotificationDispatchArg()).toMatchObject({
+      agentState: 'done',
+      agentTurnOutcome: outcome
+    })
+  })
+})
diff --git a/src/renderer/src/components/terminal-pane/use-notification-dispatch.ts b/src/renderer/src/components/terminal-pane/use-notification-dispatch.ts
index 304e844d99db..3e4e4b4cb987 100644
--- a/src/renderer/src/components/terminal-pane/use-notification-dispatch.ts
+++ b/src/renderer/src/components/terminal-pane/use-notification-dispatch.ts
@@ -2,6 +2,7 @@ import { useCallback } from 'react'
 import { useAppStore } from '@/store'
 import { resolveCommittedTitleAgentType } from '@/lib/pane-agent-evidence'
 import { buildAgentNotificationId } from '../../../../shared/agent-notification-id'
+import { agentMainAgentVerdict } from '../../../../shared/agent-main-agent-verdict'
 import { shareCompatibleTitleIdentityGroup } from '../../../../shared/agent-title-owner'
 import {
   isFreshNonDoneAgentStatus,
@@ -146,7 +147,7 @@ export function dispatchTerminalNotification(
         agentToolName: agentStatus.toolName,
         agentToolInput: agentStatus.toolInput,
         agentLastAssistantMessage: agentStatus.lastAssistantMessage,
-        agentInterrupted: agentStatus.interrupted
+        agentTurnOutcome: agentMainAgentVerdict(agentStatus) ?? undefined
       }
     : {}
   const notificationId =
diff --git a/src/renderer/src/components/terminal-pane/use-terminal-pane-chat-state.ts b/src/renderer/src/components/terminal-pane/use-terminal-pane-chat-state.ts
index 5f6985936b36..06c3b979f633 100644
--- a/src/renderer/src/components/terminal-pane/use-terminal-pane-chat-state.ts
+++ b/src/renderer/src/components/terminal-pane/use-terminal-pane-chat-state.ts
@@ -33,6 +33,7 @@ export function useTerminalPaneChatState(controller: TerminalPaneTitleController
     clearCodexRestartNotice,
     consumePendingCodexPaneRestart,
     setTabCanExpandPane,
+    setTabLayout,
     setTabPaneExpanded,
     setTabViewMode,
     suppressPtyExit,
@@ -148,15 +149,35 @@ export function useTerminalPaneChatState(controller: TerminalPaneTitleController
   )
   const applyNativeChatLeafRoute = useCallback(
     (route: NativeChatLeafRoute): void => {
+      const state = useAppStore.getState()
+      const currentMode = selectUnifiedTerminalTabFields(
+        state.unifiedTabsByWorktree,
+        worktreeId,
+        tabId
+      ).isChatViewMode
+      if (!isChatViewMode && currentMode && chatLeafId && route.chatLeafId === null) {
+        // Keep the owner through the batched toggle that turns chat mode on.
+        return
+      }
       if (route.chatLeafId !== chatLeafId) {
         setChatLeafId(route.chatLeafId)
       }
+      const existingLayout = useAppStore.getState().terminalLayoutsByTabId[tabId]
+      if (existingLayout && existingLayout.chatLeafId !== (route.chatLeafId ?? undefined)) {
+        if (route.chatLeafId) {
+          setTabLayout(tabId, { ...existingLayout, chatLeafId: route.chatLeafId })
+        } else if (existingLayout?.chatLeafId) {
+          const nextLayout = { ...existingLayout }
+          delete nextLayout.chatLeafId
+          setTabLayout(tabId, nextLayout)
+        }
+      }
       if (route.exitChat && unifiedTabId) {
         setTabViewMode(unifiedTabId, 'terminal')
       }
     },
     // oxlint-disable-next-line react-hooks/exhaustive-deps -- Preserve the pre-split dependency contract.
-    [chatLeafId, setTabViewMode, unifiedTabId]
+    [chatLeafId, isChatViewMode, setTabLayout, setTabViewMode, tabId, unifiedTabId, worktreeId]
   )
   const handleConfirmedAgentExit = useCallback(
     (leafId: string): void => {
diff --git a/src/renderer/src/components/terminal-pane/use-terminal-pane-close-actions.ts b/src/renderer/src/components/terminal-pane/use-terminal-pane-close-actions.ts
index 3e8dd463a30e..bcdbd9b41b30 100644
--- a/src/renderer/src/components/terminal-pane/use-terminal-pane-close-actions.ts
+++ b/src/renderer/src/components/terminal-pane/use-terminal-pane-close-actions.ts
@@ -16,6 +16,7 @@ import { clearPaneTerminalError } from './terminal-error-accumulation'
 import type { TerminalPaneBindingController } from './use-terminal-pane-layout-bindings'
 import { retireUnboundIpcTerminalPane } from './retire-unbound-ipc-terminal-pane'
 import { capturePendingTerminalPaneClose } from './terminal-pane-close-admission'
+import { commitTerminalSurfaceClose } from '@/store/terminals/terminal-surface-close-intent'
 
 export function useTerminalPaneCloseActions(controller: TerminalPaneBindingController) {
   const confirmedCloseRef = useRef<(() => void) | null>(null)
@@ -50,6 +51,7 @@ export function useTerminalPaneCloseActions(controller: TerminalPaneBindingContr
         clearSessionRestoredBannerForPane(paneId)
         const leafId = manager.getLeafId(paneId)
         if (leafId) {
+          commitTerminalSurfaceClose(worktreeId, { kind: 'pane', tabId, leafId })
           retireUnboundIpcTerminalPane({
             getState: useAppStore.getState,
             tabId,
@@ -82,7 +84,8 @@ export function useTerminalPaneCloseActions(controller: TerminalPaneBindingContr
       onCloseTab,
       syncPanePtyLayoutBinding,
       syncPanePtyLayoutBindingForLeaf,
-      tabId
+      tabId,
+      worktreeId
     ]
   )
   const getCloseDialogCopyKind = useCallback(
diff --git a/src/renderer/src/components/terminal-pane/use-terminal-pane-foundation.ts b/src/renderer/src/components/terminal-pane/use-terminal-pane-foundation.ts
index 7114b07e1bba..7a0da0ec79ed 100644
--- a/src/renderer/src/components/terminal-pane/use-terminal-pane-foundation.ts
+++ b/src/renderer/src/components/terminal-pane/use-terminal-pane-foundation.ts
@@ -123,7 +123,9 @@ export function useTerminalPaneFoundation(
   const [quickCommandEditorOpen, setQuickCommandEditorOpen] = useState(false)
   const [quickCommandEditorHostId, setQuickCommandEditorHostId] =
     useState<ExecutionHostId>(LOCAL_EXECUTION_HOST_ID)
-  const [chatLeafId, setChatLeafId] = useState<string | null>(null)
+  const [chatLeafId, setChatLeafId] = useState<string | null>(
+    () => useAppStore.getState().terminalLayoutsByTabId[tabId]?.chatLeafId ?? null
+  )
   const onAgentExitedRef = useRef<(leafId: string) => void>(() => {})
   const [tabWideAgentHintLeafId, setTabWideAgentHintLeafId] = useState<string | null | undefined>(
     undefined
diff --git a/src/renderer/src/components/terminal-pane/use-terminal-pane-layout-persistence.ts b/src/renderer/src/components/terminal-pane/use-terminal-pane-layout-persistence.ts
index b211a4ae4ba6..d981232874d6 100644
--- a/src/renderer/src/components/terminal-pane/use-terminal-pane-layout-persistence.ts
+++ b/src/renderer/src/components/terminal-pane/use-terminal-pane-layout-persistence.ts
@@ -1,4 +1,4 @@
-import { useCallback, useEffect } from 'react'
+import { useCallback, useEffect, useLayoutEffect, useRef } from 'react'
 import { useAppStore } from '../../store'
 import type { ManagedPane } from '@/lib/pane-manager/pane-manager'
 import { serializeTerminalLayout } from './layout-serialization'
@@ -16,7 +16,9 @@ import type { TerminalPaneStartupController } from './use-terminal-pane-startup-
 export function useTerminalPaneLayoutPersistence(controller: TerminalPaneStartupController) {
   const {
     clearedScrollbackLeafIdsRef,
+    chatLeafId,
     containerRef,
+    isChatViewMode,
     expandedPaneIdRef,
     managerRef,
     paneCount,
@@ -32,6 +34,10 @@ export function useTerminalPaneLayoutPersistence(controller: TerminalPaneStartup
     terminalTab,
     worktreeId
   } = controller
+  const chatOwnerRef = useRef({ chatLeafId, isChatViewMode })
+  useLayoutEffect(() => {
+    chatOwnerRef.current = { chatLeafId, isChatViewMode }
+  }, [chatLeafId, isChatViewMode])
   const persistLayoutSnapshot = useCallback((): void => {
     const manager = managerRef.current
     const container = containerRef.current
@@ -49,6 +55,11 @@ export function useTerminalPaneLayoutPersistence(controller: TerminalPaneStartup
     const existing = useAppStore.getState().terminalLayoutsByTabId[tabId]
     const currentPanes = manager.getPanes()
     const currentLeafIds = new Set(currentPanes.map((pane) => pane.leafId))
+    // PaneManager retains this callback for its entire mount.
+    const { chatLeafId, isChatViewMode } = chatOwnerRef.current
+    if (isChatViewMode && chatLeafId && currentPanes.some((pane) => pane.leafId === chatLeafId)) {
+      layout.chatLeafId = chatLeafId
+    }
     const clearedScrollbackLeafIds = clearedScrollbackLeafIdsRef.current
     const scrollbackPreserveLeafIds = new Set(
       [...currentLeafIds].filter((leafId) => !clearedScrollbackLeafIds.has(leafId))
@@ -122,6 +133,10 @@ export function useTerminalPaneLayoutPersistence(controller: TerminalPaneStartup
     // oxlint-disable-next-line react-hooks/exhaustive-deps -- Preserve the pre-split dependency contract.
   }, [tabId, setTabLayout, worktreeId])
 
+  useEffect(() => {
+    persistLayoutSnapshot()
+  }, [chatLeafId, isChatViewMode, persistLayoutSnapshot])
+
   const clearPaneScrollback = useCallback(
     (pane: ManagedPane): void => {
       clearedScrollbackLeafIdsRef.current.add(pane.leafId)
diff --git a/src/renderer/src/components/terminal-pane/use-terminal-pane-mobile-actions.ts b/src/renderer/src/components/terminal-pane/use-terminal-pane-mobile-actions.ts
index 5ce2bfc438e5..009ab6b800a0 100644
--- a/src/renderer/src/components/terminal-pane/use-terminal-pane-mobile-actions.ts
+++ b/src/renderer/src/components/terminal-pane/use-terminal-pane-mobile-actions.ts
@@ -196,7 +196,7 @@ export function useTerminalPaneMobileActions(controller: TerminalPaneContextCont
         const execution = await executeTerminalPastePlan(plan, {
           pasteText: (pasteText, pasteOptions) =>
             pasteTerminalText(clickedPane.terminal, pasteText, pasteOptions),
-          writePty: (data) => writeTerminalPastePtyInput(transport, data),
+          writePty: (data) => writeTerminalPastePtyInput(transport, data, 'driving'),
           isTargetCurrent: targetStillMounted,
           canContinue: targetStillMounted
         })
diff --git a/src/renderer/src/components/terminal-pane/use-terminal-pane-title-effects.ts b/src/renderer/src/components/terminal-pane/use-terminal-pane-title-effects.ts
index 6ca710a55d56..9ac662e89cc3 100644
--- a/src/renderer/src/components/terminal-pane/use-terminal-pane-title-effects.ts
+++ b/src/renderer/src/components/terminal-pane/use-terminal-pane-title-effects.ts
@@ -29,10 +29,12 @@ export function useTerminalPaneTitleEffects(controller: TerminalPaneCloseControl
     clearTerminalPaneUnread,
     clearTerminalTabUnread,
     clearWorktreeUnread,
+    chatLeafId,
     clearedScrollbackLeafIdsRef,
     containerRef,
     expandedPaneId,
     expandedPaneIdRef,
+    isChatViewMode,
     isolatedPaneKey,
     isVisible,
     managerRef,
@@ -215,6 +217,7 @@ export function useTerminalPaneTitleEffects(controller: TerminalPaneCloseControl
         paneTransports: paneTransportsRef.current,
         paneTitlesByPaneId: paneTitlesRef.current,
         existingLayout: existing,
+        chatLeafId: isChatViewMode ? chatLeafId : null,
         // Why resolved: a pane that serializes empty mid-replay must fall back to whichever home
         // holds its last good copy, not only the shared one.
         priorBuffersByLeafId: resolveLeafScrollbackBuffers({
@@ -247,7 +250,7 @@ export function useTerminalPaneTitleEffects(controller: TerminalPaneCloseControl
       }
     }
     // oxlint-disable-next-line react-hooks/exhaustive-deps -- Preserve the pre-split dependency contract.
-  }, [tabId, worktreeId, setTabLayout, setTabLocalOnlyScrollback])
+  }, [chatLeafId, isChatViewMode, tabId, worktreeId, setTabLayout, setTabLocalOnlyScrollback])
 
   useEffect(() => {
     if (renamingPaneId === null) {
diff --git a/src/renderer/src/components/terminal-pane/use-terminal-park-verdict-pin.ts b/src/renderer/src/components/terminal-pane/use-terminal-park-verdict-pin.ts
index 1941d4592199..a8db91077c41 100644
--- a/src/renderer/src/components/terminal-pane/use-terminal-park-verdict-pin.ts
+++ b/src/renderer/src/components/terminal-pane/use-terminal-park-verdict-pin.ts
@@ -47,8 +47,9 @@ export function useTerminalParkVerdictPin(args: {
   terminalTabs: readonly TerminalTab[]
   /** Park verdict before damping — every input already merged. */
   candidateParkedTabIds: ReadonlySet<string>
+  allowSustainedPin: boolean
 }): ReadonlySet<string> {
-  const { records, terminalTabs, candidateParkedTabIds } = args
+  const { records, terminalTabs, candidateParkedTabIds, allowSustainedPin } = args
   const [pinnedTabIds, setPinnedTabIds] = useState<ReadonlySet<string>>(EMPTY_TAB_IDS)
   const pinnedTabIdsRef = useRef(pinnedTabIds)
   // Why a revision and not a raw timer callback: the pin lapse must re-run the
@@ -81,7 +82,8 @@ export function useTerminalParkVerdictPin(args: {
       records: flipRecords,
       liveTabIds,
       nextParkedTabIds: parkedTabIds,
-      nowMs
+      nowMs,
+      allowSustainedPin
     })
     const { pinnedTabIds: nextPinnedTabIds, earliestPinExpiryMs } = selectParkVerdictPinnedTabIds({
       records: flipRecords,
@@ -113,7 +115,7 @@ export function useTerminalParkVerdictPin(args: {
         Math.max(1, earliestPinExpiryMs - nowMs)
       )
     }
-  }, [parkedTabIds, pinExpiryRevision, records, terminalTabs])
+  }, [allowSustainedPin, parkedTabIds, pinExpiryRevision, records, terminalTabs])
 
   // Why separate from the observation effect: that effect intentionally keeps a
   // live timer across its own re-runs, so its cleanup cannot own disposal.
diff --git a/src/renderer/src/components/terminal-pane/use-terminal-tab-cold-parking.ts b/src/renderer/src/components/terminal-pane/use-terminal-tab-cold-parking.ts
index 685546854bc1..28794cf6dbf3 100644
--- a/src/renderer/src/components/terminal-pane/use-terminal-tab-cold-parking.ts
+++ b/src/renderer/src/components/terminal-pane/use-terminal-tab-cold-parking.ts
@@ -365,7 +365,8 @@ export function useTerminalTabColdParking(args: {
   const parkedTerminalTabIds = useTerminalParkVerdictPin({
     records: parkVerdictRecordsRef,
     terminalTabs,
-    candidateParkedTabIds: candidateParkedTerminalTabIds
+    candidateParkedTabIds: candidateParkedTerminalTabIds,
+    allowSustainedPin: !isForceParked
   })
 
   // Why: runs in the same effect flush as the commit that parked/revealed the
diff --git a/src/renderer/src/components/terminal-parked-watcher-sync-entries.test.tsx b/src/renderer/src/components/terminal-parked-watcher-sync-entries.test.tsx
index efcc2fb8d448..37b40a20053d 100644
--- a/src/renderer/src/components/terminal-parked-watcher-sync-entries.test.tsx
+++ b/src/renderer/src/components/terminal-parked-watcher-sync-entries.test.tsx
@@ -80,6 +80,7 @@ function renderWatcherEffects(overrides: Partial<WatcherController> = {}): Promi
     pendingStartupByTabId: {},
     // Another workspace is on screen, so the mounted one is hidden and parks.
     renderedActiveWorktreeId: 'repo-1::/worktree-9',
+    startupTerminalTabHold: null,
     tabsByWorktree: {
       [PARKED_WORKTREE_ID]: [
         terminalTab('tab-parked', PARKED_WORKTREE_ID),
@@ -127,6 +128,20 @@ describe('parked terminal watcher sync entries', () => {
     expect([...(parkedEntry?.parkedTabIds ?? [])]).toEqual(['tab-parked'])
   })
 
+  it('watches the tabs a startup hold keeps unmounted on the visible workspace', async () => {
+    const heldWorktreeId = surfaceIds[9]
+    const tab = terminalTab('held-agent', heldWorktreeId, 'live-pty')
+    await renderWatcherEffects({
+      mountedWorktreeIdsRef: { current: new Set([heldWorktreeId]) },
+      startupTerminalTabHold: { worktreeId: heldWorktreeId, heldTabIds: new Set([tab.id]) },
+      tabsByWorktree: { [heldWorktreeId]: [tab] }
+    })
+
+    const entry = lastSyncEntries().get(heldWorktreeId)
+    expect([...entry!.parkedTabIds]).toEqual([tab.id])
+    expect([...entry!.restoreTitleOnStartTabIds!]).toEqual([tab.id])
+  })
+
   it('does not allocate a parked-tab-id set per unmounted surface', async () => {
     await renderWatcherEffects()
 
diff --git a/src/renderer/src/components/terminal-split-workspace-surfaces-startup-hold.test.tsx b/src/renderer/src/components/terminal-split-workspace-surfaces-startup-hold.test.tsx
new file mode 100644
index 000000000000..b8e1040995ee
--- /dev/null
+++ b/src/renderer/src/components/terminal-split-workspace-surfaces-startup-hold.test.tsx
@@ -0,0 +1,86 @@
+// @vitest-environment happy-dom
+import { act } from 'react'
+import { createRoot, type Root } from 'react-dom/client'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { TerminalSplitWorkspaceSurfaces } from './TerminalSplitWorkspaceSurfaces'
+import type { StartupTerminalTabHold } from './terminal/startup-terminal-tab-hold'
+import type { TerminalController } from './use-terminal-controller'
+
+const mocks = vi.hoisted(() => ({
+  surfaceProps: new Map<string, ReadonlySet<string> | null>()
+}))
+vi.mock('./TerminalWorktreeSplitSurface', () => ({
+  WorktreeSplitSurface: (props: {
+    worktreeId: string
+    activationDeferredMountTabIds: ReadonlySet<string> | null
+  }) => {
+    mocks.surfaceProps.set(props.worktreeId, props.activationDeferredMountTabIds)
+    return null
+  }
+}))
+vi.mock('./browser-pane/host-guest/browser-guest-paint-retention', () => ({
+  useAnyBrowserGuestNeedsPaint: () => false
+}))
+Object.assign(globalThis, { IS_REACT_ACT_ENVIRONMENT: true })
+
+const HELD_WORKTREE_ID = 'repo::/held'
+const DEFERRED_WORKTREE_ID = 'repo::/deferred'
+const OTHER_WORKTREE_ID = 'repo::/other'
+const WORKTREE_IDS = [HELD_WORKTREE_ID, DEFERRED_WORKTREE_ID, OTHER_WORKTREE_ID]
+
+let root: Root | undefined
+afterEach(async () => {
+  await act(async () => root?.unmount())
+  root = undefined
+  mocks.surfaceProps.clear()
+})
+
+async function renderSurfaces(
+  hold: StartupTerminalTabHold | null,
+  deferred: Map<string, ReadonlySet<string>>
+): Promise<void> {
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: TerminalSplitWorkspaceSurfaces reads only the fields listed here; the rest of the controller is machinery this render never touches.
+  const controller = {
+    activationDeferredMountTabIdsByWorktreeRef: { current: deferred },
+    activeGroupIdByWorktree: {},
+    activeView: 'terminal',
+    activityTerminalPortals: [],
+    anyMountedWorktreeHasLayout: true,
+    backgroundMountTabIdsByWorktreeRef: { current: new Map() },
+    effectiveActiveLayout: { type: 'leaf', groupId: 'group-1' },
+    effectiveParkedTerminalWorktreeIds: new Set(),
+    forceParkedTerminalWorktreeIds: new Set(),
+    getEffectiveLayoutForWorktree: () => ({ type: 'leaf', groupId: 'group-1' }),
+    measurableBackgroundWorktreeIdsRef: { current: new Set() },
+    mountedWorktreeIdsRef: { current: new Set(WORKTREE_IDS) },
+    renderedActiveWorktreeId: HELD_WORKTREE_ID,
+    startupTerminalTabHold: hold,
+    workspaceSurfaces: WORKTREE_IDS.map((id) => ({ id, path: `/${id}` }))
+  } as unknown as TerminalController
+  const container = document.createElement('div')
+  root = createRoot(container)
+  await act(async () => root?.render(<TerminalSplitWorkspaceSurfaces controller={controller} />))
+}
+
+describe('split workspace surfaces under a startup terminal hold', () => {
+  it('hands each surface its parked-equivalent tabs: deferral set, else held tabs, else none', async () => {
+    const hold: StartupTerminalTabHold = {
+      worktreeId: HELD_WORKTREE_ID,
+      heldTabIds: new Set(['held-tab'])
+    }
+    const deferredTabIds = new Set(['deferred-tab'])
+
+    await renderSurfaces(hold, new Map([[DEFERRED_WORKTREE_ID, deferredTabIds]]))
+
+    // Held tabs render no pane, so the surface must hand them to parked watchers.
+    expect(mocks.surfaceProps.get(HELD_WORKTREE_ID)).toBe(hold.heldTabIds)
+    expect(mocks.surfaceProps.get(DEFERRED_WORKTREE_ID)).toBe(deferredTabIds)
+    expect(mocks.surfaceProps.get(OTHER_WORKTREE_ID)).toBeNull()
+  })
+
+  it('passes no held tabs once the hold is released', async () => {
+    await renderSurfaces(null, new Map())
+
+    expect(mocks.surfaceProps.get(HELD_WORKTREE_ID)).toBeNull()
+  })
+})
diff --git a/src/renderer/src/components/terminal-startup-hold-placeholder.test.tsx b/src/renderer/src/components/terminal-startup-hold-placeholder.test.tsx
new file mode 100644
index 000000000000..be648b543b48
--- /dev/null
+++ b/src/renderer/src/components/terminal-startup-hold-placeholder.test.tsx
@@ -0,0 +1,222 @@
+// @vitest-environment happy-dom
+import { act } from 'react'
+import { createRoot, type Root } from 'react-dom/client'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { Tab, TabGroup } from '../../../shared/tab-types'
+import type { TerminalTab } from '../../../shared/terminal-tab-types'
+import type { TerminalController } from './use-terminal-controller'
+
+vi.mock('../store', async () => {
+  const { create } = await import('zustand')
+  const activeGroupIdByWorktree: Record<string, string | undefined> = {}
+  const groupsByWorktree: Record<string, TabGroup[]> = {}
+  const tabsByWorktree: Record<string, TerminalTab[]> = {}
+  const unifiedTabsByWorktree: Record<string, Tab[]> = {}
+  const useAppStore = create(() => ({
+    activeGroupIdByWorktree,
+    groupsByWorktree,
+    tabsByWorktree,
+    unifiedTabsByWorktree,
+    consumeSuppressedPtyExit: () => false,
+    focusGroup: () => {},
+    reconcileWorktreeTabModel: () => ({ renderableTabCount: 1 }),
+    setActiveWorktree: () => {}
+  }))
+  return { useAppStore }
+})
+vi.mock('./native-chat/use-native-chat-toggle-shortcut', () => ({
+  useNativeChatToggleShortcut: () => {}
+}))
+vi.mock('./terminal-pane/use-terminal-tab-cold-parking', () => ({
+  useTerminalTabColdParking: () => new Set()
+}))
+vi.mock('./terminal-pane/TerminalOverlaySlot', () => ({
+  TerminalOverlaySlot: (props: { terminalTabId: string }) => (
+    <div data-terminal-pane-tab-id={props.terminalTabId} />
+  )
+}))
+vi.mock('./terminal-pane/TerminalPane', () => ({
+  default: (props: { tabId: string }) => <div data-terminal-pane-tab-id={props.tabId} />
+}))
+vi.mock('./tab-group/RetainedPaneHost', () => ({
+  RetainedPaneHost: (props: { groupId?: string; children: React.ReactNode }) => (
+    <div data-retained-pane-group-id={props.groupId}>{props.children}</div>
+  )
+}))
+
+import { useAppStore } from '../store'
+import TerminalPaneOverlayLayer from './terminal-pane/TerminalPaneOverlayLayer'
+import { TerminalLegacyTerminalPanes } from './TerminalLegacyTerminalPanes'
+
+Object.assign(globalThis, { IS_REACT_ACT_ENVIRONMENT: true })
+
+const WORKTREE_ID = 'repo::/held'
+const GROUP_ID = 'group-a'
+const NO_ADMITTED_TABS: ReadonlySet<string> = new Set()
+
+function terminalTab(id: string): TerminalTab {
+  return {
+    id,
+    worktreeId: WORKTREE_ID,
+    ptyId: null,
+    title: id,
+    customTitle: null,
+    color: null,
+    sortOrder: 0,
+    createdAt: 0,
+    generation: 0
+  }
+}
+
+function unifiedTerminalTab(id: string): Tab {
+  return {
+    id: `unified-${id}`,
+    entityId: id,
+    worktreeId: WORKTREE_ID,
+    groupId: GROUP_ID,
+    contentType: 'terminal',
+    label: id,
+    customLabel: null,
+    color: null,
+    sortOrder: 0,
+    createdAt: 0
+  }
+}
+
+function setTabs(tabIds: string[], activeTabId: string): void {
+  const group: TabGroup = {
+    id: GROUP_ID,
+    worktreeId: WORKTREE_ID,
+    activeTabId: `unified-${activeTabId}`,
+    tabOrder: tabIds.map((tabId) => `unified-${tabId}`)
+  }
+  useAppStore.setState({
+    activeGroupIdByWorktree: { [WORKTREE_ID]: GROUP_ID },
+    groupsByWorktree: { [WORKTREE_ID]: [group] },
+    tabsByWorktree: { [WORKTREE_ID]: tabIds.map(terminalTab) },
+    unifiedTabsByWorktree: { [WORKTREE_ID]: tabIds.map(unifiedTerminalTab) }
+  })
+}
+
+let container: HTMLDivElement
+let root: Root
+
+beforeEach(() => {
+  container = document.createElement('div')
+  document.body.appendChild(container)
+  root = createRoot(container)
+})
+afterEach(() => {
+  act(() => root.unmount())
+  container.remove()
+})
+
+function placeholders(): Element[] {
+  return [...container.querySelectorAll('[data-terminal-restoring-placeholder]')]
+}
+
+function mountedPaneTabIds(): string[] {
+  return [...container.querySelectorAll('[data-terminal-pane-tab-id]')].map(
+    (element) => element.getAttribute('data-terminal-pane-tab-id') ?? ''
+  )
+}
+
+describe('overlay layer under the startup terminal hold', () => {
+  function renderOverlay(backgroundMountTabIds: ReadonlySet<string> | null): void {
+    act(() =>
+      root.render(
+        <TerminalPaneOverlayLayer
+          worktreeId={WORKTREE_ID}
+          worktreePath="/held"
+          isWorktreeActive
+          backgroundMountTabIds={backgroundMountTabIds}
+        />
+      )
+    )
+  }
+
+  it('fills the visible held tab slot, including a tab created under the hold, until the gate opens', () => {
+    setTabs(['tab-a', 'tab-b'], 'tab-a')
+    renderOverlay(NO_ADMITTED_TABS)
+    // Only the visible tab gets a placeholder; the hidden held tab renders nothing.
+    expect(placeholders()).toHaveLength(1)
+    expect(placeholders()[0].parentElement?.getAttribute('data-retained-pane-group-id')).toBe(
+      GROUP_ID
+    )
+    expect(mountedPaneTabIds()).toEqual([])
+
+    setTabs(['tab-a', 'tab-b', 'tab-new'], 'tab-new')
+    renderOverlay(NO_ADMITTED_TABS)
+    expect(placeholders()).toHaveLength(1)
+    expect(mountedPaneTabIds()).toEqual([])
+
+    renderOverlay(null)
+    expect(placeholders()).toHaveLength(0)
+    expect(mountedPaneTabIds()).toEqual(['tab-a', 'tab-b', 'tab-new'])
+  })
+
+  it('renders no placeholder while the held worktree is not the active one', () => {
+    setTabs(['tab-a'], 'tab-a')
+    act(() =>
+      root.render(
+        <TerminalPaneOverlayLayer
+          worktreeId={WORKTREE_ID}
+          worktreePath="/held"
+          isWorktreeActive={false}
+          backgroundMountTabIds={NO_ADMITTED_TABS}
+        />
+      )
+    )
+    expect(placeholders()).toHaveLength(0)
+  })
+})
+
+describe('legacy terminal panes under the startup terminal hold', () => {
+  function renderLegacy(
+    tabIds: string[],
+    activeTabId: string,
+    restriction: ReadonlySet<string> | null
+  ): void {
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: TerminalLegacyTerminalPanes reads only the fields listed here.
+    const controller = {
+      activeTabId,
+      activeTabType: 'terminal',
+      activeView: 'terminal',
+      activityTerminalPortals: [],
+      backgroundMountTabIdsByWorktreeRef: {
+        current: new Map(restriction ? [[WORKTREE_ID, restriction]] : [])
+      },
+      effectiveParkedTerminalWorktreeIds: new Set(),
+      evictionExemptTerminalTabIds: new Set(),
+      handleCloseTab: () => {},
+      handlePtyExit: () => {},
+      measurableBackgroundWorktreeIdsRef: { current: new Set() },
+      mountedWorktreeIdsRef: { current: new Set([WORKTREE_ID]) },
+      renderedActiveWorktreeId: WORKTREE_ID,
+      tabsByWorktree: { [WORKTREE_ID]: tabIds.map(terminalTab) },
+      worktreeBrowserTabs: [],
+      worktreeFiles: [],
+      workspaceSurfaces: [{ id: WORKTREE_ID, path: '/held' }]
+    } as unknown as TerminalController
+    act(() => root.render(<TerminalLegacyTerminalPanes controller={controller} />))
+  }
+
+  it('fills the active held tab, including a tab created under the hold, until the gate opens', () => {
+    renderLegacy(['tab-a', 'tab-b'], 'tab-a', NO_ADMITTED_TABS)
+    expect(placeholders()).toHaveLength(1)
+    expect(mountedPaneTabIds()).toEqual([])
+
+    renderLegacy(['tab-a', 'tab-b', 'tab-new'], 'tab-new', NO_ADMITTED_TABS)
+    expect(placeholders()).toHaveLength(1)
+
+    renderLegacy(['tab-a', 'tab-b', 'tab-new'], 'tab-new', null)
+    expect(placeholders()).toHaveLength(0)
+    expect(mountedPaneTabIds()).toEqual(['tab-a', 'tab-b', 'tab-new'])
+  })
+
+  it('renders no placeholder when the active tab is not a held one', () => {
+    renderLegacy(['tab-a', 'tab-b'], 'tab-a', new Set(['tab-a']))
+    expect(placeholders()).toHaveLength(0)
+    expect(mountedPaneTabIds()).toEqual(['tab-a'])
+  })
+})
diff --git a/src/renderer/src/components/terminal-workspace-surface-ids.test.tsx b/src/renderer/src/components/terminal-workspace-surface-ids.test.tsx
index f93b06a3b052..d21b878c2184 100644
--- a/src/renderer/src/components/terminal-workspace-surface-ids.test.tsx
+++ b/src/renderer/src/components/terminal-workspace-surface-ids.test.tsx
@@ -77,6 +77,7 @@ describe('workspace surface ids', () => {
   it('does not rebuild a surface-id array or set on a cold-activation render', () => {
     const ids = Array.from({ length: 423 }, (_, index) => `repo::/worktree-${index}`)
     const { surfaces, mapCalls } = countingSurfaces(ids)
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: applyTerminalColdActivation reads only the fields listed here; the rest of the foundation is render machinery this test never exercises.
     const controller = {
       activationDeferralPlanRevisionRef: { current: 0 },
       activationDeferredMountTabIdsByWorktreeRef: { current: new Map() },
@@ -89,6 +90,7 @@ describe('workspace surface ids', () => {
       groupsByWorktree: {},
       hydrationSucceeded: false,
       lastActivationWorktreeIdRef: { current: null },
+      startupTerminalTabHoldRef: { current: null },
       layoutByWorktree: {},
       mountedWorktreeIdsRef: { current: new Set(['repo::/worktree-0', 'repo::/gone']) },
       pairedRuntimeParkingEnvironmentIds: new Set(),
diff --git a/src/renderer/src/components/terminal/background-terminal-worktree-mount.test.ts b/src/renderer/src/components/terminal/background-terminal-worktree-mount.test.ts
index 0978393bba7f..117f049978ee 100644
--- a/src/renderer/src/components/terminal/background-terminal-worktree-mount.test.ts
+++ b/src/renderer/src/components/terminal/background-terminal-worktree-mount.test.ts
@@ -11,7 +11,7 @@ import {
   addBackgroundMountedTerminalWorktree,
   applyBackgroundMountTabRestriction,
   canDeferColdActivationTabsForHost,
-  canMountTerminalWorkspaceForStartup,
+  canAdmitTerminalTabsForStartup,
   collectDeferredMountTabIds,
   hasRequestedBackgroundTerminalWorktreeMount,
   planColdActivationTabDeferral,
@@ -23,24 +23,24 @@ import {
   shouldMountBackgroundWorktreeTab
 } from './background-terminal-worktree-mount'
 
-describe('terminal workspace startup mount gate', () => {
+describe('startup terminal tab admission gate', () => {
   it('waits for hydration unless startup entered degraded mode', () => {
     expect(
-      canMountTerminalWorkspaceForStartup({
+      canAdmitTerminalTabsForStartup({
         workspaceSessionReady: true,
         hydrationSucceeded: false,
         startupWorktreeRefreshCompleted: false
       })
     ).toBe(false)
     expect(
-      canMountTerminalWorkspaceForStartup({
+      canAdmitTerminalTabsForStartup({
         workspaceSessionReady: true,
         hydrationSucceeded: true,
         startupWorktreeRefreshCompleted: false
       })
     ).toBe(true)
     expect(
-      canMountTerminalWorkspaceForStartup({
+      canAdmitTerminalTabsForStartup({
         workspaceSessionReady: true,
         hydrationSucceeded: false,
         startupWorktreeRefreshCompleted: true
diff --git a/src/renderer/src/components/terminal/background-terminal-worktree-mount.ts b/src/renderer/src/components/terminal/background-terminal-worktree-mount.ts
index 8f8bf4461b0f..4f4214e07fc1 100644
--- a/src/renderer/src/components/terminal/background-terminal-worktree-mount.ts
+++ b/src/renderer/src/components/terminal/background-terminal-worktree-mount.ts
@@ -150,7 +150,14 @@ export function shouldMountBackgroundWorktreeTab(
 // working set (and later tab switches) ends up exactly where it was before.
 export const COLD_ACTIVATION_TAB_DEFER_THRESHOLD = 0
 
-export function canMountTerminalWorkspaceForStartup(args: {
+/**
+ * Whether restored terminal tabs may mount their panes. Why this fences panes and not the
+ * workspace surface: a pane binds a PTY on mount, and until startup restoration has fenced
+ * the daemon provider, reconnected SSH targets, and published PTY ownership, that bind would
+ * attach to a not-yet-restored session or spawn a duplicate shell. The tab strip and the
+ * chat, browser, and editor panes bind nothing, so they mount from the hydrated tab model.
+ */
+export function canAdmitTerminalTabsForStartup(args: {
   workspaceSessionReady: boolean
   hydrationSucceeded: boolean
   startupWorktreeRefreshCompleted: boolean
diff --git a/src/renderer/src/components/terminal/cold-activation-deferral-stranding.test.ts b/src/renderer/src/components/terminal/cold-activation-deferral-stranding.test.ts
index 89737f429916..40ab1847a4e3 100644
--- a/src/renderer/src/components/terminal/cold-activation-deferral-stranding.test.ts
+++ b/src/renderer/src/components/terminal/cold-activation-deferral-stranding.test.ts
@@ -31,6 +31,7 @@ import {
 import { capturedPanesByTabId } from '../terminal-pane/terminal-parked-watcher-registry'
 import type { TerminalTab } from '../../../../shared/terminal-tab-types'
 import type { TerminalParkingFoundation } from '../use-terminal-parking-foundation'
+import type { StartupTerminalTabHold } from './startup-terminal-tab-hold'
 
 const WORKTREE_ID = 'repo::/worktree'
 const OTHER_WORKTREE_ID = 'repo::/other-worktree'
@@ -82,9 +83,11 @@ function useStrandingHarness(props: HarnessProps) {
   const backgroundMountTabIdsByWorktreeRef = useRef(new Map<string, ReadonlySet<string>>())
   const activationDeferredMountTabIdsByWorktreeRef = useRef(new Map<string, ReadonlySet<string>>())
   const lastActivationWorktreeIdRef = useRef<string | null>(null)
+  const startupTerminalTabHoldRef = useRef<StartupTerminalTabHold | null>(null)
   const mountedWorktreeIdsRef = useRef(new Set<string>())
   const activationDeferralPlanRevisionRef = useRef(0)
   const [backgroundMountRevision, setBackgroundMountRevision] = useState(0)
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: applyTerminalColdActivation and the admission hook read only the fields listed here; the rest of the foundation is render machinery this harness never exercises.
   const foundation = {
     activationDeferralPlanRevisionRef,
     activationDeferredMountTabIdsByWorktreeRef,
@@ -98,6 +101,7 @@ function useStrandingHarness(props: HarnessProps) {
     groupsByWorktree: {},
     hydrationSucceeded: props.gateOpen,
     lastActivationWorktreeIdRef,
+    startupTerminalTabHoldRef,
     layoutByWorktree: {},
     mountedWorktreeIdsRef,
     pairedRuntimeParkingEnvironmentIds: new Set<string>(),
diff --git a/src/renderer/src/components/terminal/initial-terminal-structured-launch.test.tsx b/src/renderer/src/components/terminal/initial-terminal-structured-launch.test.tsx
index ec897d479da4..d9799888a2e4 100644
--- a/src/renderer/src/components/terminal/initial-terminal-structured-launch.test.tsx
+++ b/src/renderer/src/components/terminal/initial-terminal-structured-launch.test.tsx
@@ -1,19 +1,23 @@
 // @vitest-environment happy-dom
-import { act } from 'react'
+import { act, StrictMode } from 'react'
 import { createRoot, type Root } from 'react-dom/client'
 import { afterEach, describe, expect, it, vi } from 'vitest'
 import { useTerminalWatcherEffects } from '../use-terminal-watcher-effects'
 
-const mocks = vi.hoisted(() => ({
-  gate: vi.fn(),
-  resume: vi.fn(),
-  authority: 'none',
-  launchStatus: vi.fn((_worktreeId: string, _provider: string): string => 'idle'),
-  createTab: vi.fn()
-}))
+const mocks = vi.hoisted(() => {
+  const storeTabsByWorktree: Record<string, unknown[]> = {}
+  return {
+    gate: vi.fn(),
+    resume: vi.fn(),
+    authority: 'none',
+    launchStatus: vi.fn((_worktreeId: string, _provider: string): string => 'idle'),
+    createTab: vi.fn(),
+    storeTabsByWorktree
+  }
+})
 vi.mock('@/store', () => ({
   useAppStore: Object.assign(() => mocks.authority, {
-    getState: () => ({ activeWorktreeId: 'wt-1' })
+    getState: () => ({ activeWorktreeId: 'wt-1', tabsByWorktree: mocks.storeTabsByWorktree })
   })
 }))
 vi.mock('@/lib/worktree-agent-activation-gate', () => ({
@@ -41,6 +45,7 @@ afterEach(async () => {
   await act(async () => root?.unmount())
   vi.clearAllMocks()
   mocks.authority = 'none'
+  mocks.storeTabsByWorktree = {}
 })
 
 function Watcher({ restored = true, hydrated = false, worktreeId = 'wt-1' } = {}): null {
@@ -72,6 +77,7 @@ function Watcher({ restored = true, hydrated = false, worktreeId = 'wt-1' } = {}
     pairedRuntimeParkingEnvironmentIds: new Set(),
     pendingStartupByTabId: {},
     renderedActiveWorktreeId: worktreeId,
+    startupTerminalTabHold: null,
     terminalParkingEnabled: false,
     terminalProviderSnapshotCapabilityRevision: 0,
     terminalSshParkingEnabled: false,
@@ -108,6 +114,93 @@ describe('passive terminal seeding during native chat creation', () => {
   })
 })
 
+function deferredGate(): (outcome: 'empty' | 'blocked') => Promise<void> {
+  let finishGate!: (outcome: 'empty' | 'blocked') => void
+  // One shared promise, as the gate's in-flight dedupe hands every rerun.
+  mocks.gate.mockReturnValue(
+    new Promise((resolve) => {
+      finishGate = resolve
+    })
+  )
+  return async (outcome) => act(async () => finishGate(outcome))
+}
+
+describe('passive terminal seeding retries until a decision applies', () => {
+  it('seeds once after a StrictMode double run', async () => {
+    const finishGate = deferredGate()
+    const renderStrict = () =>
+      root?.render(
+        <StrictMode>
+          <Watcher />
+        </StrictMode>
+      )
+    root = createRoot(document.createElement('div'))
+    await act(async () => renderStrict())
+    await finishGate('empty')
+    expect(mocks.createTab).toHaveBeenCalledTimes(1)
+
+    // The applied decision is final: a later run neither re-checks nor seeds again.
+    await act(async () => renderStrict())
+    expect(mocks.createTab).toHaveBeenCalledTimes(1)
+    expect(mocks.gate).toHaveBeenCalledTimes(2)
+  })
+
+  it('seeds once when an input changes mid-check', async () => {
+    const finishGate = deferredGate()
+    root = createRoot(document.createElement('div'))
+    await act(async () => root?.render(<Watcher />))
+    // Each render passes a fresh reconcile callback, so this rerun cancels the first check.
+    await act(async () => root?.render(<Watcher />))
+    await finishGate('empty')
+    expect(mocks.createTab).toHaveBeenCalledTimes(1)
+    expect(mocks.gate).toHaveBeenCalledTimes(2)
+  })
+
+  it('seeds once across two empty checks separated by leaving the workspace', async () => {
+    const resolvers: ((outcome: 'empty') => void)[] = []
+    mocks.gate.mockImplementation(
+      () =>
+        new Promise((resolve) => {
+          resolvers.push(resolve)
+        })
+    )
+    root = createRoot(document.createElement('div'))
+    await act(async () => root?.render(<Watcher />))
+    await act(async () => root?.render(<Watcher worktreeId="wt-2" />))
+    await act(async () => root?.render(<Watcher />))
+    await act(async () => resolvers.forEach((resolve) => resolve('empty')))
+    await act(async () => root?.render(<Watcher />))
+
+    expect(mocks.createTab).toHaveBeenCalledTimes(1)
+    expect(mocks.gate).toHaveBeenCalledTimes(3)
+  })
+
+  it('does not seed a workspace whose last terminal closed during the check', async () => {
+    const finishGate = deferredGate()
+    root = createRoot(document.createElement('div'))
+    await act(async () => root?.render(<Watcher />))
+    mocks.storeTabsByWorktree = { 'wt-1': [] }
+    await finishGate('empty')
+    expect(mocks.createTab).not.toHaveBeenCalled()
+  })
+
+  it('seeds after leaving and returning to a blocked workspace', async () => {
+    mocks.gate.mockResolvedValue('blocked')
+    root = createRoot(document.createElement('div'))
+    await act(async () => root?.render(<Watcher />))
+    expect(mocks.createTab).not.toHaveBeenCalled()
+
+    await act(async () => root?.render(<Watcher worktreeId="wt-2" />))
+    mocks.gate.mockResolvedValue('empty')
+    await act(async () => root?.render(<Watcher />))
+    expect(mocks.createTab).toHaveBeenCalledTimes(1)
+    expect(mocks.createTab).toHaveBeenCalledWith('wt-1', undefined, undefined, {
+      pendingActivationSpawn: true
+    })
+    expect(mocks.gate.mock.calls.map(([id]) => id)).toEqual(['wt-1', 'wt-2', 'wt-1'])
+  })
+})
+
 describe('startup agent recovery host inventory', () => {
   it('keeps recovery available until the execution host answers', async () => {
     mocks.authority = 'unverifiable'
diff --git a/src/renderer/src/components/terminal/initial-terminal-wiring.test.ts b/src/renderer/src/components/terminal/initial-terminal-wiring.test.ts
index ed56289625ef..8908ecefa406 100644
--- a/src/renderer/src/components/terminal/initial-terminal-wiring.test.ts
+++ b/src/renderer/src/components/terminal/initial-terminal-wiring.test.ts
@@ -15,8 +15,11 @@ function readSource(relativePath: string): string {
 describe('Terminal auto-create wiring', () => {
   const source = readSource(TERMINAL_PATH)
 
-  it('derives the tombstone from the active worktree row', () => {
-    expect(source).toContain('Object.hasOwn(tabsByWorktree, activeWorktreeId)')
+  it('derives the tombstone from the active worktree row at decision time', () => {
+    // Why the live store: a render-captured row goes stale while the activation check runs.
+    expect(source).toMatch(
+      /Object\.hasOwn\(\s*useAppStore\.getState\(\)\.tabsByWorktree,\s*activeWorktreeId\s*\)/
+    )
   })
 
   it('passes that derivation into shouldAutoCreateInitialTerminal', () => {
@@ -31,10 +34,4 @@ describe('Terminal auto-create wiring', () => {
       'shouldAutoCreateInitialTerminal(renderableTabCount, activeWorktreeHasTerminalState)'
     )
   })
-
-  it('keeps that derivation in the effect dependencies', () => {
-    // Why: without the dep the effect never re-runs when the row appears or disappears.
-    // Anchored to the neighbouring dep so a stray trailing comma elsewhere can't satisfy it.
-    expect(source).toContain('activeWorktreeId,\n    activeWorktreeHasTerminalState,')
-  })
 })
diff --git a/src/renderer/src/components/terminal/startup-terminal-tab-hold.test.ts b/src/renderer/src/components/terminal/startup-terminal-tab-hold.test.ts
new file mode 100644
index 000000000000..d49d4a511cd8
--- /dev/null
+++ b/src/renderer/src/components/terminal/startup-terminal-tab-hold.test.ts
@@ -0,0 +1,349 @@
+// @vitest-environment happy-dom
+
+/**
+ * Defect under test: the restored workspace surface used to wait for the whole
+ * startup chain (SSH reconnect, PTY reconnect, legacy worker recovery) before it
+ * mounted, so a session whose tab model had been in the store for seconds painted
+ * nothing at all. Only terminal panes need that chain — they bind a PTY on mount.
+ * The surface now mounts on the tab model, and terminal tabs are held unadmitted
+ * until the gate opens and the activation plan replaces the hold.
+ */
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { act, cleanup, renderHook } from '@testing-library/react'
+import { useRef, useState } from 'react'
+import { useAppStore } from '@/store'
+import { applyTerminalColdActivation } from '../terminal-cold-activation'
+import { useActivationDeferredTabAdmission } from './use-activation-deferred-tab-admission'
+import {
+  pruneClosedBackgroundMountTabs,
+  revealActivationDeferredTabs,
+  shouldMountBackgroundWorktreeTab
+} from './background-terminal-worktree-mount'
+import {
+  holdTerminalTabsForStartup,
+  releaseStartupTerminalTabHold,
+  selectParkedEquivalentMountTabIds,
+  type StartupTerminalTabHold
+} from './startup-terminal-tab-hold'
+import type { TabGroup, TabGroupLayoutNode } from '../../../../shared/tab-types'
+import type { TerminalTab } from '../../../../shared/terminal-tab-types'
+import type { TerminalParkingFoundation } from '../use-terminal-parking-foundation'
+
+const WORKTREE_ID = 'repo::/worktree'
+const OTHER_WORKTREE_ID = 'repo::/other-worktree'
+const TAB_1 = 'tab-1'
+const TAB_2 = 'tab-2'
+const GROUP_ID = 'group-1'
+const SURFACE_IDS = [WORKTREE_ID, OTHER_WORKTREE_ID]
+
+const initialState = useAppStore.getInitialState()
+const originalRequestIdle = globalThis.requestIdleCallback
+const originalCancelIdle = globalThis.cancelIdleCallback
+
+function terminalTab(id: string, worktreeId: string): TerminalTab {
+  return {
+    id,
+    ptyId: `${worktreeId}@@${id}`,
+    worktreeId,
+    title: id,
+    customTitle: null,
+    color: null,
+    sortOrder: 0,
+    createdAt: 1
+  }
+}
+
+function leafLayout(worktreeId: string): {
+  groups: TabGroup[]
+  layout: TabGroupLayoutNode
+} {
+  return {
+    groups: [
+      { id: GROUP_ID, worktreeId, activeTabId: TAB_1, tabOrder: [TAB_1, TAB_2], recentTabIds: [] }
+    ],
+    layout: { type: 'leaf', groupId: GROUP_ID }
+  }
+}
+
+type HarnessProps = { worktreeId: string | null; gateOpen: boolean }
+
+/** Mirrors use-terminal-controller.ts: cold activation during render, then admission. */
+function useStartupHoldHarness(props: HarnessProps) {
+  const backgroundMountTabIdsByWorktreeRef = useRef(new Map<string, ReadonlySet<string>>())
+  const activationDeferredMountTabIdsByWorktreeRef = useRef(new Map<string, ReadonlySet<string>>())
+  const lastActivationWorktreeIdRef = useRef<string | null>(null)
+  const startupTerminalTabHoldRef = useRef<StartupTerminalTabHold | null>(null)
+  const mountedWorktreeIdsRef = useRef(new Set<string>())
+  const activationDeferralPlanRevisionRef = useRef(0)
+  const [backgroundMountRevision, setBackgroundMountRevision] = useState(0)
+  const restored = leafLayout(props.worktreeId ?? WORKTREE_ID)
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: applyTerminalColdActivation and the admission hook read only the fields listed here; the rest of the foundation is render machinery this harness never exercises.
+  const foundation = {
+    activationDeferralPlanRevisionRef,
+    activationDeferredMountTabIdsByWorktreeRef,
+    activeGroupIdByWorktree: props.worktreeId ? { [props.worktreeId]: GROUP_ID } : {},
+    activeTabId: TAB_1,
+    activeTabIdByWorktree: props.worktreeId ? { [props.worktreeId]: TAB_1 } : {},
+    activeWorktreeDeferralHostId: 'local',
+    activityTerminalPortals: [],
+    backgroundMountRevision,
+    backgroundMountTabIdsByWorktreeRef,
+    groupsByWorktree: props.worktreeId ? { [props.worktreeId]: restored.groups } : {},
+    hydrationSucceeded: props.gateOpen,
+    lastActivationWorktreeIdRef,
+    layoutByWorktree: props.worktreeId ? { [props.worktreeId]: restored.layout } : {},
+    mountedWorktreeIdsRef,
+    pairedRuntimeParkingEnvironmentIds: new Set<string>(),
+    pendingStartupByTabId: {},
+    renderedActiveWorktreeId: props.worktreeId,
+    setBackgroundMountRevision,
+    startupTerminalTabHoldRef,
+    startupWorktreeRefreshCompleted: props.gateOpen,
+    tabsByWorktree: useAppStore.getState().tabsByWorktree,
+    terminalParkingEnabled: true,
+    terminalTitleSnapshotAuthorityEnabled: true,
+    workspaceSessionReady: props.gateOpen,
+    workspaceSurfaceIds: SURFACE_IDS,
+    workspaceSurfaceIdSet: new Set(SURFACE_IDS)
+  } as unknown as TerminalParkingFoundation
+  const coldActivation = Object.assign(foundation, applyTerminalColdActivation(foundation))
+  useActivationDeferredTabAdmission(coldActivation)
+  return {
+    activationDeferredMountTabIdsByWorktreeRef,
+    anyMountedWorktreeHasLayout: coldActivation.anyMountedWorktreeHasLayout,
+    backgroundMountTabIdsByWorktreeRef,
+    mountedWorktreeIdsRef,
+    startupTerminalTabHold: coldActivation.startupTerminalTabHold
+  }
+}
+
+function admits(
+  restrictions: Map<string, ReadonlySet<string>>,
+  worktreeId: string,
+  tabId: string
+): boolean {
+  return shouldMountBackgroundWorktreeTab(restrictions.get(worktreeId) ?? null, tabId)
+}
+
+describe('startup terminal tab hold', () => {
+  beforeEach(() => {
+    useAppStore.setState(initialState, true)
+    useAppStore.setState({
+      tabsByWorktree: {
+        [WORKTREE_ID]: [terminalTab(TAB_1, WORKTREE_ID), terminalTab(TAB_2, WORKTREE_ID)],
+        [OTHER_WORKTREE_ID]: [terminalTab(TAB_1, OTHER_WORKTREE_ID)]
+      }
+    })
+    // Deterministic drain: force scheduleActivationDeferredAdmission onto timers.
+    // @ts-expect-error -- exercising the no-requestIdleCallback environment
+    globalThis.requestIdleCallback = undefined
+    // @ts-expect-error -- exercising the no-requestIdleCallback environment
+    globalThis.cancelIdleCallback = undefined
+    vi.useFakeTimers()
+  })
+
+  afterEach(() => {
+    cleanup()
+    vi.useRealTimers()
+    globalThis.requestIdleCallback = originalRequestIdle
+    globalThis.cancelIdleCallback = originalCancelIdle
+    useAppStore.setState(initialState, true)
+  })
+
+  it('mounts the restored surface before the gate opens and holds every terminal tab', () => {
+    const { result, rerender } = renderHook(useStartupHoldHarness, {
+      initialProps: { worktreeId: WORKTREE_ID, gateOpen: false }
+    })
+    const restrictions = result.current.backgroundMountTabIdsByWorktreeRef.current
+
+    // The surface mounts from the tab model alone...
+    expect(result.current.mountedWorktreeIdsRef.current.has(WORKTREE_ID)).toBe(true)
+    expect(result.current.anyMountedWorktreeHasLayout).toBe(true)
+    // ...while no terminal pane may bind a PTY yet, and none is idle-admission work.
+    expect(admits(restrictions, WORKTREE_ID, TAB_1)).toBe(false)
+    expect(admits(restrictions, WORKTREE_ID, TAB_2)).toBe(false)
+    expect(result.current.activationDeferredMountTabIdsByWorktreeRef.current.has(WORKTREE_ID)).toBe(
+      false
+    )
+    // Held tabs stay parked-equivalent, so watchers own their bells, titles, and completions.
+    expect(result.current.startupTerminalTabHold).toEqual({
+      worktreeId: WORKTREE_ID,
+      heldTabIds: new Set([TAB_1, TAB_2])
+    })
+    act(() => {
+      vi.advanceTimersByTime(1_000)
+    })
+    expect(admits(restrictions, WORKTREE_ID, TAB_1)).toBe(false)
+
+    // The gate opening runs the activation plan, which replaces the hold.
+    rerender({ worktreeId: WORKTREE_ID, gateOpen: true })
+    expect(result.current.mountedWorktreeIdsRef.current.has(WORKTREE_ID)).toBe(true)
+    expect(admits(restrictions, WORKTREE_ID, TAB_1)).toBe(true)
+    expect(admits(restrictions, WORKTREE_ID, TAB_2)).toBe(true)
+    expect(result.current.startupTerminalTabHold).toBeNull()
+  })
+
+  it('returns a workspace switched away from mid-startup to the unmounted world', () => {
+    const { result, rerender } = renderHook(useStartupHoldHarness, {
+      initialProps: { worktreeId: WORKTREE_ID, gateOpen: false }
+    })
+    expect(result.current.mountedWorktreeIdsRef.current.has(WORKTREE_ID)).toBe(true)
+
+    rerender({ worktreeId: OTHER_WORKTREE_ID, gateOpen: false })
+    const restrictions = result.current.backgroundMountTabIdsByWorktreeRef.current
+    expect(result.current.mountedWorktreeIdsRef.current.has(WORKTREE_ID)).toBe(false)
+    expect(restrictions.has(WORKTREE_ID)).toBe(false)
+    expect(result.current.mountedWorktreeIdsRef.current.has(OTHER_WORKTREE_ID)).toBe(true)
+    expect(admits(restrictions, OTHER_WORKTREE_ID, TAB_1)).toBe(false)
+
+    rerender({ worktreeId: OTHER_WORKTREE_ID, gateOpen: true })
+    expect(admits(restrictions, OTHER_WORKTREE_ID, TAB_1)).toBe(true)
+  })
+
+  it('returns a workspace left for no workspace mid-startup to the unmounted world', () => {
+    const initialProps: HarnessProps = { worktreeId: WORKTREE_ID, gateOpen: false }
+    const { result, rerender } = renderHook(useStartupHoldHarness, { initialProps })
+    expect(result.current.mountedWorktreeIdsRef.current.has(WORKTREE_ID)).toBe(true)
+
+    rerender({ worktreeId: null, gateOpen: false })
+    expect(result.current.mountedWorktreeIdsRef.current.has(WORKTREE_ID)).toBe(false)
+    expect(result.current.backgroundMountTabIdsByWorktreeRef.current.has(WORKTREE_ID)).toBe(false)
+    expect(result.current.startupTerminalTabHold).toBeNull()
+
+    rerender({ worktreeId: null, gateOpen: true })
+    expect(result.current.mountedWorktreeIdsRef.current.size).toBe(0)
+  })
+
+  it('keeps holding a widened hold whose targeted tab closed', () => {
+    const { result, rerender } = renderHook(useStartupHoldHarness, {
+      initialProps: { worktreeId: WORKTREE_ID, gateOpen: false }
+    })
+    const restrictions = result.current.backgroundMountTabIdsByWorktreeRef.current
+    // A targeted background mount widens the hold to its tab.
+    restrictions.set(WORKTREE_ID, new Set([TAB_1]))
+    act(() => {
+      useAppStore.setState({
+        tabsByWorktree: {
+          ...useAppStore.getState().tabsByWorktree,
+          [WORKTREE_ID]: [terminalTab(TAB_2, WORKTREE_ID)]
+        }
+      })
+    })
+    rerender({ worktreeId: WORKTREE_ID, gateOpen: false })
+
+    expect(result.current.mountedWorktreeIdsRef.current.has(WORKTREE_ID)).toBe(true)
+    expect(admits(restrictions, WORKTREE_ID, TAB_2)).toBe(false)
+    expect(result.current.startupTerminalTabHold?.heldTabIds).toEqual(new Set([TAB_2]))
+  })
+
+  it('does not mount a surface with no active workspace', () => {
+    const { result } = renderHook(useStartupHoldHarness, {
+      initialProps: { worktreeId: null, gateOpen: false }
+    })
+    expect(result.current.mountedWorktreeIdsRef.current.size).toBe(0)
+    expect(result.current.backgroundMountTabIdsByWorktreeRef.current.size).toBe(0)
+  })
+})
+
+describe('holdTerminalTabsForStartup', () => {
+  it('admits no terminal tab of a worktree that has not mounted yet', () => {
+    const hold: { current: StartupTerminalTabHold | null } = { current: null }
+    const restrictions = new Map<string, ReadonlySet<string>>()
+    const mounted = new Set<string>()
+
+    holdTerminalTabsForStartup(hold, restrictions, mounted, 'wt-active', ['tab-1'])
+
+    expect(restrictions.get('wt-active')).toEqual(new Set())
+    expect(mounted.has('wt-active')).toBe(true)
+    expect(shouldMountBackgroundWorktreeTab(restrictions.get('wt-active') ?? null, 'tab-1')).toBe(
+      false
+    )
+    expect(hold.current).toEqual({ worktreeId: 'wt-active', heldTabIds: new Set(['tab-1']) })
+  })
+
+  it('keeps a targeted background mount that landed first and never narrows a full mount', () => {
+    const hold: { current: StartupTerminalTabHold | null } = { current: null }
+    const restrictions = new Map<string, ReadonlySet<string>>([['wt-active', new Set(['tab-1'])]])
+    const mounted = new Set<string>(['wt-full'])
+
+    holdTerminalTabsForStartup(hold, restrictions, mounted, 'wt-active', ['tab-1', 'tab-2'])
+    expect(restrictions.get('wt-active')).toEqual(new Set(['tab-1']))
+    expect(hold.current?.heldTabIds).toEqual(new Set(['tab-2']))
+
+    releaseStartupTerminalTabHold(hold, restrictions, mounted, 'wt-full')
+    holdTerminalTabsForStartup(hold, restrictions, mounted, 'wt-full', ['tab-1'])
+    expect(restrictions.has('wt-full')).toBe(false)
+    expect(hold.current?.heldTabIds).toEqual(new Set())
+  })
+
+  it('keeps the held set identity while the hold is unchanged', () => {
+    const hold: { current: StartupTerminalTabHold | null } = { current: null }
+    const restrictions = new Map<string, ReadonlySet<string>>()
+    const mounted = new Set<string>()
+    holdTerminalTabsForStartup(hold, restrictions, mounted, 'wt-active', ['tab-1'])
+    const first = hold.current
+
+    holdTerminalTabsForStartup(hold, restrictions, mounted, 'wt-active', ['tab-1'])
+
+    expect(hold.current).toBe(first)
+  })
+
+  it('survives prune and reveal passes untouched', () => {
+    const hold: { current: StartupTerminalTabHold | null } = { current: null }
+    const restrictions = new Map<string, ReadonlySet<string>>()
+    const deferred = new Map<string, ReadonlySet<string>>()
+    const mounted = new Set<string>()
+    holdTerminalTabsForStartup(hold, restrictions, mounted, 'wt-active', ['tab-1'])
+
+    expect(
+      pruneClosedBackgroundMountTabs(
+        restrictions,
+        mounted,
+        { 'wt-active': [{ id: 'tab-1' }] },
+        deferred
+      )
+    ).toBe(false)
+    revealActivationDeferredTabs({
+      restrictions,
+      deferredMountTabIdsByWorktree: deferred,
+      worktreeId: 'wt-active',
+      allTabIds: ['tab-1'],
+      immediateTabIds: new Set(['tab-1'])
+    })
+    expect(restrictions.get('wt-active')).toEqual(new Set())
+    expect(mounted.has('wt-active')).toBe(true)
+  })
+
+  it('releases an unwidened hold and leaves a widened one as a targeted restriction', () => {
+    const hold: { current: StartupTerminalTabHold | null } = { current: null }
+    const restrictions = new Map<string, ReadonlySet<string>>()
+    const mounted = new Set<string>()
+    holdTerminalTabsForStartup(hold, restrictions, mounted, 'wt-previous', ['tab-1'])
+
+    releaseStartupTerminalTabHold(hold, restrictions, mounted, 'wt-previous')
+    expect(hold.current?.worktreeId).toBe('wt-previous')
+
+    releaseStartupTerminalTabHold(hold, restrictions, mounted, null)
+    expect(restrictions.has('wt-previous')).toBe(false)
+    expect(mounted.has('wt-previous')).toBe(false)
+    expect(hold.current).toBeNull()
+
+    holdTerminalTabsForStartup(hold, restrictions, mounted, 'wt-targeted', ['tab-wake', 'tab-2'])
+    restrictions.set('wt-targeted', new Set(['tab-wake']))
+    releaseStartupTerminalTabHold(hold, restrictions, mounted, 'wt-active')
+    expect(restrictions.get('wt-targeted')).toEqual(new Set(['tab-wake']))
+    expect(mounted.has('wt-targeted')).toBe(true)
+  })
+})
+
+describe('selectParkedEquivalentMountTabIds', () => {
+  const hold: StartupTerminalTabHold = { worktreeId: 'wt-held', heldTabIds: new Set(['tab-1']) }
+
+  it('prefers the activation deferral, then the hold, for the held worktree only', () => {
+    const deferred = new Set(['tab-deferred'])
+    expect(selectParkedEquivalentMountTabIds(deferred, hold, 'wt-held')).toBe(deferred)
+    expect(selectParkedEquivalentMountTabIds(undefined, hold, 'wt-held')).toBe(hold.heldTabIds)
+    expect(selectParkedEquivalentMountTabIds(undefined, hold, 'wt-other')).toBeNull()
+    expect(selectParkedEquivalentMountTabIds(undefined, null, 'wt-held')).toBeNull()
+  })
+})
diff --git a/src/renderer/src/components/terminal/startup-terminal-tab-hold.ts b/src/renderer/src/components/terminal/startup-terminal-tab-hold.ts
new file mode 100644
index 000000000000..6398911e5c3b
--- /dev/null
+++ b/src/renderer/src/components/terminal/startup-terminal-tab-hold.ts
@@ -0,0 +1,77 @@
+import {
+  applyBackgroundMountTabRestriction,
+  collectDeferredMountTabIds
+} from './background-terminal-worktree-mount'
+
+export type StartupTerminalTabHold = {
+  worktreeId: string
+  /** Tabs the hold keeps unmounted — parked-equivalent, so watchers own their side effects. */
+  heldTabIds: ReadonlySet<string>
+}
+
+/**
+ * Ends the hold unless `nextHeldWorktreeId` is still the held worktree. Must run before the
+ * activation plan, which would otherwise read the hold as a plan it had installed.
+ *
+ * Why an unwidened hold unmounts: nothing but the surface was mounted under it, so a worktree
+ * switched away from — or left for no workspace — mid-startup returns to the unmounted world
+ * where parked watchers cover it. A hold a targeted background mount widened keeps that mount's
+ * tabs, like any targeted restriction.
+ */
+export function releaseStartupTerminalTabHold(
+  hold: { current: StartupTerminalTabHold | null },
+  restrictions: Map<string, ReadonlySet<string>>,
+  mountedWorktreeIds: Set<string>,
+  nextHeldWorktreeId: string | null
+): void {
+  const held = hold.current
+  if (!held || held.worktreeId === nextHeldWorktreeId) {
+    return
+  }
+  hold.current = null
+  if (restrictions.get(held.worktreeId)?.size === 0) {
+    restrictions.delete(held.worktreeId)
+    mountedWorktreeIds.delete(held.worktreeId)
+  }
+}
+
+/**
+ * Keeps the worktree's terminal tabs unmounted while startup restoration is still publishing
+ * PTY ownership, so the workspace surface can mount from the hydrated tab model without a pane
+ * binding a PTY early. Runs after prune, so no prune pass can drop the hold before render.
+ *
+ * Why an empty admitted set and no deferral entry: reveal and idle admission act only on
+ * worktrees with a deferral entry, so nothing admits a held tab until the startup gate opens
+ * and the activation plan replaces the hold. A targeted background mount widens it to its
+ * tabs, as it widens any restriction; a worktree already fully mounted is never narrowed.
+ */
+export function holdTerminalTabsForStartup(
+  hold: { current: StartupTerminalTabHold | null },
+  restrictions: Map<string, ReadonlySet<string>>,
+  mountedWorktreeIds: Set<string>,
+  worktreeId: string,
+  tabIds: readonly string[]
+): void {
+  applyBackgroundMountTabRestriction(restrictions, mountedWorktreeIds, worktreeId, [])
+  mountedWorktreeIds.add(worktreeId)
+  const heldTabIds = collectDeferredMountTabIds(restrictions.get(worktreeId) ?? null, tabIds)
+  const previous = hold.current
+  // Why reuse: the set feeds a memoized surface prop, so an unchanged hold keeps its identity.
+  if (
+    previous?.worktreeId === worktreeId &&
+    previous.heldTabIds.size === heldTabIds.size &&
+    Array.from(heldTabIds).every((tabId) => previous.heldTabIds.has(tabId))
+  ) {
+    return
+  }
+  hold.current = { worktreeId, heldTabIds }
+}
+
+/** The watcher-coverage set for a mounted worktree: activation-deferred tabs, else held tabs. */
+export function selectParkedEquivalentMountTabIds(
+  activationDeferredMountTabIds: ReadonlySet<string> | undefined,
+  hold: StartupTerminalTabHold | null,
+  worktreeId: string
+): ReadonlySet<string> | null {
+  return activationDeferredMountTabIds ?? (hold?.worktreeId === worktreeId ? hold.heldTabIds : null)
+}
diff --git a/src/renderer/src/components/use-task-page-jira-list-effects.test.ts b/src/renderer/src/components/use-task-page-jira-list-effects.test.ts
new file mode 100644
index 000000000000..9a1f6e4973ea
--- /dev/null
+++ b/src/renderer/src/components/use-task-page-jira-list-effects.test.ts
@@ -0,0 +1,83 @@
+// @vitest-environment happy-dom
+import { act, renderHook, waitFor } from '@testing-library/react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type { TaskPageLinearCollectionEffectsModel } from './use-task-page-linear-collection-effects'
+import { useTaskPageJiraListEffects } from './use-task-page-jira-list-effects'
+
+const listJiraIssues = vi.fn().mockResolvedValue([])
+const searchJiraIssues = vi.fn().mockResolvedValue([])
+
+function createModel(): TaskPageLinearCollectionEffectsModel {
+  const model = {
+    settings: null,
+    setTaskResumeState: vi.fn(),
+    searchJiraIssues,
+    listJiraIssues,
+    jiraConnected: true,
+    selectedJiraSiteId: 'site-1',
+    taskSource: 'jira',
+    jiraTaskSourceContext: null,
+    jiraTaskSourceScopeKey: 'fixture',
+    jiraSearchPersistReadyRef: { current: true },
+    taskResumeApplied: true,
+    selectedJiraIssueKey: null,
+    setSelectedJiraIssueKey: vi.fn(),
+    selectedJiraIssueFallback: null,
+    setSelectedJiraIssueFallback: vi.fn(),
+    setJiraIssues: vi.fn(),
+    setJiraLoading: vi.fn(),
+    setJiraError: vi.fn(),
+    setJiraErrorDetailsOpen: vi.fn(),
+    jiraSearchInput: '',
+    appliedJiraSearch: '',
+    setAppliedJiraSearch: vi.fn(),
+    activeJiraPreset: 'assigned',
+    jiraRefreshNonce: 0,
+    setJiraProjectStatusOrder: vi.fn(),
+    displayedJiraIssues: []
+  }
+  // SAFETY: the hook only reads the Jira fields above; the preceding pipeline model is intentionally not constructed in this isolated wiring test.
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the partial fixture intentionally models only fields read by this hook.
+  return model as unknown as TaskPageLinearCollectionEffectsModel
+}
+
+describe('useTaskPageJiraListEffects refresh wiring', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    listJiraIssues.mockResolvedValue([])
+    searchJiraIssues.mockResolvedValue([])
+  })
+
+  it('passes force only for a refresh nonce change', async () => {
+    const model = createModel()
+    const { rerender } = renderHook(() => useTaskPageJiraListEffects(model))
+
+    await waitFor(() => expect(listJiraIssues).toHaveBeenCalledTimes(1))
+    expect(listJiraIssues).toHaveBeenNthCalledWith(1, 'assigned', 50, {
+      sourceContext: null,
+      force: false
+    })
+
+    await act(async () => {
+      model.jiraRefreshNonce = 1
+      rerender()
+      await Promise.resolve()
+    })
+    await waitFor(() => expect(listJiraIssues).toHaveBeenCalledTimes(2))
+    expect(listJiraIssues).toHaveBeenNthCalledWith(2, 'assigned', 50, {
+      sourceContext: null,
+      force: true
+    })
+
+    await act(async () => {
+      model.activeJiraPreset = 'reported'
+      rerender()
+      await Promise.resolve()
+    })
+    await waitFor(() => expect(listJiraIssues).toHaveBeenCalledTimes(3))
+    expect(listJiraIssues).toHaveBeenNthCalledWith(3, 'reported', 50, {
+      sourceContext: null,
+      force: false
+    })
+  })
+})
diff --git a/src/renderer/src/components/use-task-page-jira-list-effects.ts b/src/renderer/src/components/use-task-page-jira-list-effects.ts
index b39a145bd89a..cd0f9a067bfb 100644
--- a/src/renderer/src/components/use-task-page-jira-list-effects.ts
+++ b/src/renderer/src/components/use-task-page-jira-list-effects.ts
@@ -1,5 +1,5 @@
 import type { TaskPageLinearCollectionEffectsModel } from './use-task-page-linear-collection-effects'
-import { useEffect } from 'react'
+import { useEffect, useRef } from 'react'
 import {
   getSingleJiraProjectScope,
   getTaskPageJiraStatusOrderScopeKey,
@@ -57,6 +57,7 @@ export function useTaskPageJiraListEffects(model: TaskPageLinearCollectionEffect
       jiraQuery: appliedJiraSearch.trim()
     })
   }, [appliedJiraSearch, setTaskResumeState, taskResumeApplied, jiraSearchPersistReadyRef])
+  const previousJiraRefreshNonceRef = useRef(jiraRefreshNonce)
   useEffect(() => {
     if (!taskResumeApplied) {
       return
@@ -67,6 +68,8 @@ export function useTaskPageJiraListEffects(model: TaskPageLinearCollectionEffect
     if (!jiraConnected) {
       return
     }
+    const force = previousJiraRefreshNonceRef.current !== jiraRefreshNonce
+    previousJiraRefreshNonceRef.current = jiraRefreshNonce
     let cancelled = false
     setJiraLoading(true)
     setJiraError(null)
@@ -75,10 +78,12 @@ export function useTaskPageJiraListEffects(model: TaskPageLinearCollectionEffect
     const request =
       trimmed.length > 0
         ? searchJiraIssues(trimmed, JIRA_ITEM_LIMIT, {
-            sourceContext: jiraTaskSourceContext
+            sourceContext: jiraTaskSourceContext,
+            force
           })
         : listJiraIssues(activeJiraPreset, JIRA_ITEM_LIMIT, {
-            sourceContext: jiraTaskSourceContext
+            sourceContext: jiraTaskSourceContext,
+            force
           })
     void request
       .then((issues) => {
diff --git a/src/renderer/src/components/use-task-page-linear-list-selection.ts b/src/renderer/src/components/use-task-page-linear-list-selection.ts
index 8c8de172f9ad..ae2e03f06032 100644
--- a/src/renderer/src/components/use-task-page-linear-list-selection.ts
+++ b/src/renderer/src/components/use-task-page-linear-list-selection.ts
@@ -7,7 +7,10 @@ import {
   buildLinearTeamUrl,
   getLinearOrganizationUrlKeyFromIssueUrl
 } from '../../../shared/linear/links'
-import { reconcileLinearTeamSelection } from '@/components/task-page-linear-team-selection'
+import {
+  reconcileLinearTeamSelection,
+  storedLinearTeamSelection
+} from '@/components/task-page-linear-team-selection'
 import { useTaskPageLinearFilterSelection } from './use-task-page-linear-filter-selection'
 export type TaskPageLinearListSelectionPreludeModel = ReturnType<
   typeof useTaskPageLinearListSelectionPrelude
@@ -42,7 +45,13 @@ export function useTaskPageLinearListSelectionPrelude(model: TaskPageGitLabLoadi
     linearCustomViewContentsError,
     availableTeams
   } = model
-  const defaultLinearTeamSelection = settings?.defaultLinearTeamSelection
+  // Why memoized: the normalized array feeds an effect that sets state, and a
+  // fresh array per render would re-run it every render.
+  const rawLinearTeamSelection = settings?.defaultLinearTeamSelection
+  const defaultLinearTeamSelection = useMemo(
+    () => storedLinearTeamSelection(rawLinearTeamSelection),
+    [rawLinearTeamSelection]
+  )
   const [linearTeamSelection, setLinearTeamSelection] = useState<ReadonlySet<string>>(() => {
     if (!defaultLinearTeamSelection) {
       return new Set<string>()
diff --git a/src/renderer/src/components/use-terminal-create-actions.test.tsx b/src/renderer/src/components/use-terminal-create-actions.test.tsx
index b12fd7730c6e..0c05e2a172cc 100644
--- a/src/renderer/src/components/use-terminal-create-actions.test.tsx
+++ b/src/renderer/src/components/use-terminal-create-actions.test.tsx
@@ -93,7 +93,7 @@ describe('useTerminalCreateActions creation gates', () => {
 
   it('toasts instead of duplicating a browser tab when the provider forbids it', () => {
     mocks.browserAvailability = { state: 'hidden', reason: 'no browser here' }
-    renderActions().handleDuplicateBrowserTab('browser-1')
+    renderActions().handleDuplicateBrowserTab('browser-1', 'unified-browser-1')
     expect(mocks.toastError).toHaveBeenCalledWith('no browser here')
     expect(mocks.createBrowserTab).not.toHaveBeenCalled()
   })
diff --git a/src/renderer/src/components/use-terminal-create-actions.ts b/src/renderer/src/components/use-terminal-create-actions.ts
index 0d958ce70e0c..c67f7a664f34 100644
--- a/src/renderer/src/components/use-terminal-create-actions.ts
+++ b/src/renderer/src/components/use-terminal-create-actions.ts
@@ -168,7 +168,7 @@ export function useTerminalCreateActions(controller: TerminalColdActivationContr
   }, [])
 
   const handleDuplicateBrowserTab = useCallback(
-    (browserTabId: string) => {
+    (browserTabId: string, sourceUnifiedTabId: string) => {
       if (!activeWorktreeId) {
         return
       }
@@ -195,14 +195,16 @@ export function useTerminalCreateActions(controller: TerminalColdActivationContr
           worktreeId: activeWorktreeId,
           environmentId: runtimeEnvironmentId,
           url: source.url,
-          profileId: source.sessionProfileId
+          profileId: source.sessionProfileId,
+          clientAfterTabId: sourceUnifiedTabId
         }).catch(showClientCreationActionError)
         return
       }
       try {
         createBrowserTab(activeWorktreeId, source.url, {
           ...buildDuplicatedBrowserTabOptions(source),
-          ...(runtimeEnvironmentId ? { browserRuntimeEnvironmentId: null } : {})
+          ...(runtimeEnvironmentId ? { browserRuntimeEnvironmentId: null } : {}),
+          afterTabId: sourceUnifiedTabId
         })
       } catch (error) {
         showClientCreationActionError(error)
diff --git a/src/renderer/src/components/use-terminal-parking-foundation.ts b/src/renderer/src/components/use-terminal-parking-foundation.ts
index c368b299471e..3123a881d209 100644
--- a/src/renderer/src/components/use-terminal-parking-foundation.ts
+++ b/src/renderer/src/components/use-terminal-parking-foundation.ts
@@ -12,6 +12,7 @@ import {
   takeAllPendingBackgroundTerminalWorktreeMounts,
   takePendingBackgroundTerminalWorktreeMount
 } from './terminal/background-terminal-worktree-mount'
+import type { StartupTerminalTabHold } from './terminal/startup-terminal-tab-hold'
 import {
   combineTerminalWorktreeParkIds,
   useManualTerminalWorktreeParking
@@ -68,6 +69,7 @@ export function useTerminalParkingFoundation(controller: TerminalEditorCloseCont
   const backgroundMountTabIdsByWorktreeRef = useRef(new Map<string, ReadonlySet<string>>())
   const activationDeferredMountTabIdsByWorktreeRef = useRef(new Map<string, ReadonlySet<string>>())
   const lastActivationWorktreeIdRef = useRef<string | null>(null)
+  const startupTerminalTabHoldRef = useRef<StartupTerminalTabHold | null>(null)
   // Why a ref, not state: the cold-activation pass runs during render, where a
   // setState would be a render-phase update; the pass returns the count instead.
   const activationDeferralPlanRevisionRef = useRef(0)
@@ -167,6 +169,7 @@ export function useTerminalParkingFoundation(controller: TerminalEditorCloseCont
     backgroundMountTabIdsByWorktreeRef,
     activationDeferredMountTabIdsByWorktreeRef,
     lastActivationWorktreeIdRef,
+    startupTerminalTabHoldRef,
     activationDeferralPlanRevisionRef
   }
 }
diff --git a/src/renderer/src/components/use-terminal-watcher-effects.ts b/src/renderer/src/components/use-terminal-watcher-effects.ts
index e840c3f9ba05..0de705d9df5b 100644
--- a/src/renderer/src/components/use-terminal-watcher-effects.ts
+++ b/src/renderer/src/components/use-terminal-watcher-effects.ts
@@ -15,6 +15,7 @@ import { createWorkspaceTerminalHostAuthoritySelector } from '@/lib/workspace-te
 import { getStructuredAgentLaunchStatus } from '@/lib/structured-agent-session-launch'
 import { AGENT_SESSION_PROVIDER_HANDLE_PROVIDERS } from '../../../shared/agent-session-provider-handle'
 import type { TerminalColdActivationController } from './terminal-cold-activation'
+import { selectParkedEquivalentMountTabIds } from './terminal/startup-terminal-tab-hold'
 
 // Why shared: surfaces without watchable live tabs need no per-pass allocation.
 const NO_PARKED_TAB_IDS: ReadonlySet<string> = new Set()
@@ -41,6 +42,7 @@ type TerminalWatcherController = Pick<
   | 'pendingStartupByTabId'
   | 'reconcileWorktreeTabModel'
   | 'renderedActiveWorktreeId'
+  | 'startupTerminalTabHold'
   | 'tabsByWorktree'
   | 'terminalParkingEnabled'
   | 'terminalProviderSnapshotCapabilityRevision'
@@ -73,6 +75,7 @@ export function useTerminalWatcherEffects(controller: TerminalWatcherController)
     pendingStartupByTabId,
     reconcileWorktreeTabModel,
     renderedActiveWorktreeId,
+    startupTerminalTabHold,
     tabsByWorktree,
     terminalParkingEnabled,
     terminalProviderSnapshotCapabilityRevision,
@@ -118,7 +121,11 @@ export function useTerminalWatcherEffects(controller: TerminalWatcherController)
             }
           }
         }
-        deferredTabIds = activationDeferredMountTabIdsByWorktreeRef.current.get(workspaceId) ?? null
+        deferredTabIds = selectParkedEquivalentMountTabIds(
+          activationDeferredMountTabIdsByWorktreeRef.current.get(workspaceId),
+          startupTerminalTabHold,
+          workspaceId
+        )
         for (const tab of tabs) {
           if (
             deferredTabIds?.has(tab.id) &&
@@ -172,6 +179,7 @@ export function useTerminalWatcherEffects(controller: TerminalWatcherController)
     pairedRuntimeParkingEnvironmentIds,
     pendingStartupByTabId,
     renderedActiveWorktreeId,
+    startupTerminalTabHold,
     tabsByWorktree,
     terminalParkingEnabled,
     terminalProviderSnapshotCapabilityRevision,
@@ -183,11 +191,6 @@ export function useTerminalWatcherEffects(controller: TerminalWatcherController)
   useEffect(() => () => disposeAllParkedTerminalWatchers(), [])
 
   const startupActivationGateWorktreeIdsRef = useRef(new Set<string>())
-  // Why (main): a missing row means never initialized, an explicit empty row means the user
-  // closed the last terminal — so the gate must not re-seed one in the second case.
-  const activeWorktreeHasTerminalState = activeWorktreeId
-    ? Object.hasOwn(tabsByWorktree, activeWorktreeId)
-    : false
   // Why a store subscription rather than a read inside the effects: the verdict flips to `none` the
   // moment the execution host answers, and that transition is what re-runs the passes below.
   // Why the retained selector: resolution walks the owner catalogs, so recomputing it on every store
@@ -210,16 +213,21 @@ export function useTerminalWatcherEffects(controller: TerminalWatcherController)
     if (startupActivationGateWorktreeIdsRef.current.has(activeWorktreeId)) {
       return
     }
-    startupActivationGateWorktreeIdsRef.current.add(activeWorktreeId)
     let cancelled = false
     void gateWorktreeAgentActivation(activeWorktreeId).then((outcome) => {
       if (
         cancelled ||
-        outcome !== 'empty' ||
+        outcome === 'blocked' ||
         useAppStore.getState().activeWorktreeId !== activeWorktreeId
       ) {
         return
       }
+      // Why mark only once a decision applies: a cancelled or blocked check must stay retryable,
+      // and a rerun shares the gate's in-flight promise instead of repeating its work.
+      startupActivationGateWorktreeIdsRef.current.add(activeWorktreeId)
+      if (outcome !== 'empty') {
+        return
+      }
       // A pending or unanswered chat create owns the surface even before its tab is published.
       if (
         AGENT_SESSION_PROVIDER_HANDLE_PROVIDERS.some(
@@ -230,6 +238,12 @@ export function useTerminalWatcherEffects(controller: TerminalWatcherController)
       }
       // Why: the activation gate reconciles durable/live agent state first; only an actually empty, never-visited workspace receives a default shell.
       const { renderableTabCount } = reconcileWorktreeTabModel(activeWorktreeId)
+      // Why (main): a missing row means never initialized, an explicit empty row means the user
+      // closed the last terminal. Read at decision time: the row can change while the check runs.
+      const activeWorktreeHasTerminalState = Object.hasOwn(
+        useAppStore.getState().tabsByWorktree,
+        activeWorktreeId
+      )
       if (shouldAutoCreateInitialTerminal(renderableTabCount, activeWorktreeHasTerminalState)) {
         // Why: tag this never-visited-worktree tab so its PTY spawn doesn't count as activity and reshuffle the sidebar (explicit New Tab still bumps).
         createTab(activeWorktreeId, undefined, undefined, { pendingActivationSpawn: true })
@@ -240,7 +254,6 @@ export function useTerminalWatcherEffects(controller: TerminalWatcherController)
     }
   }, [
     activeWorktreeId,
-    activeWorktreeHasTerminalState,
     activeWorktreeHostAuthority,
     createTab,
     reconcileWorktreeTabModel,
diff --git a/src/renderer/src/components/use-worktree-jump-palette-worktrees.ts b/src/renderer/src/components/use-worktree-jump-palette-worktrees.ts
index 37b1decc41f7..348e6b82b10e 100644
--- a/src/renderer/src/components/use-worktree-jump-palette-worktrees.ts
+++ b/src/renderer/src/components/use-worktree-jump-palette-worktrees.ts
@@ -97,7 +97,10 @@ export function useWorktreeJumpPaletteWorktrees({
         if (filterPredicate && !filterPredicate.matchesWorktree(worktree)) {
           return false
         }
-        if (hideDefaultBranchWorkspace && isDefaultBranchWorkspace(worktree)) {
+        if (
+          hideDefaultBranchWorkspace &&
+          isDefaultBranchWorkspace(worktree, repoMap.get(worktree.repoId))
+        ) {
           return false
         }
         if (hideAutomationGeneratedWorkspaces && isAutomationGeneratedWorkspace(worktree)) {
@@ -143,6 +146,7 @@ export function useWorktreeJumpPaletteWorktrees({
       hideWorkspacesFromOtherDevices,
       pairedDeviceIdsByEnvironment,
       ptyIdsByTabId,
+      repoMap,
       showSleepingWorkspaces,
       tabsByWorktree,
       worktreeIdsWithLiveAgent,
diff --git a/src/renderer/src/components/virtualized-list.test.tsx b/src/renderer/src/components/virtualized-list.test.tsx
index 7320c19ea62e..7de8428cef4e 100644
--- a/src/renderer/src/components/virtualized-list.test.tsx
+++ b/src/renderer/src/components/virtualized-list.test.tsx
@@ -89,13 +89,13 @@ beforeEach(() => {
   root = createRoot(host)
 
   vi.stubGlobal('ResizeObserver', MockResizeObserver)
-  vi.spyOn(HTMLElement.prototype, 'offsetHeight', 'get').mockImplementation(
-    function (this: HTMLElement) {
-      return this.classList.contains('overflow-auto')
-        ? VIEWPORT_HEIGHT_PX
-        : VIRTUALIZED_LIST_ROW_HEIGHT_PX
-    }
-  )
+  vi.spyOn(HTMLElement.prototype, 'offsetHeight', 'get').mockImplementation(function (
+    this: HTMLElement
+  ) {
+    return this.classList.contains('overflow-auto')
+      ? VIEWPORT_HEIGHT_PX
+      : VIRTUALIZED_LIST_ROW_HEIGHT_PX
+  })
   vi.spyOn(Element.prototype, 'getBoundingClientRect').mockImplementation(function (this: Element) {
     const top = topsByElement.get(this) ?? 0
     const height = this.classList.contains('overflow-auto')
diff --git a/src/renderer/src/components/workspace-cleanup/use-workspace-cleanup-git-evidence.ts b/src/renderer/src/components/workspace-cleanup/use-workspace-cleanup-git-evidence.ts
index ffd416655230..5e14cd962e2d 100644
--- a/src/renderer/src/components/workspace-cleanup/use-workspace-cleanup-git-evidence.ts
+++ b/src/renderer/src/components/workspace-cleanup/use-workspace-cleanup-git-evidence.ts
@@ -6,6 +6,7 @@ import {
   selectWorkspaceCleanupGitEvidenceTargets,
   WORKSPACE_CLEANUP_GIT_EVIDENCE_MAX_TARGETS
 } from './workspace-cleanup-git-evidence'
+import { createBrowserUuid } from '@/lib/browser-uuid'
 
 export type WorkspaceCleanupGitEvidenceState = {
   /** Focused re-scan results, keyed by host-qualified identity. */
@@ -79,7 +80,7 @@ export function useWorkspaceCleanupGitEvidence({
     // would silently drop the overflow ids while marking them attempted.
     const worktreeIds = queueRef.current.slice(0, WORKSPACE_CLEANUP_GIT_EVIDENCE_MAX_TARGETS)
     queueRef.current = queueRef.current.slice(worktreeIds.length)
-    const scanId = crypto.randomUUID()
+    const scanId = createBrowserUuid()
     activeScanIdRef.current = scanId
     for (const worktreeId of worktreeIds) {
       queuedRef.current.delete(worktreeId)
diff --git a/src/renderer/src/components/workspace-cleanup/workspace-cleanup-snapshot-prune-batch.ts b/src/renderer/src/components/workspace-cleanup/workspace-cleanup-snapshot-prune-batch.ts
index b633f610d936..9081604e7142 100644
--- a/src/renderer/src/components/workspace-cleanup/workspace-cleanup-snapshot-prune-batch.ts
+++ b/src/renderer/src/components/workspace-cleanup/workspace-cleanup-snapshot-prune-batch.ts
@@ -1,4 +1,5 @@
 import type { WorkspaceCleanupBackgroundRemovalArgs } from './workspace-cleanup-background-removal'
+import { createBrowserUuid } from '@/lib/browser-uuid'
 
 export function createWorkspaceCleanupSnapshotPruneBatch():
   | WorkspaceCleanupBackgroundRemovalArgs['snapshotPruneBatch']
@@ -9,7 +10,7 @@ export function createWorkspaceCleanupSnapshotPruneBatch():
   if (typeof begin !== 'function' || typeof record !== 'function' || typeof finish !== 'function') {
     return undefined
   }
-  const batchId = crypto.randomUUID()
+  const batchId = createBrowserUuid()
   return {
     batchId,
     begin: () => begin({ batchId }),
diff --git a/src/renderer/src/components/worktree-jump-palette-recent-inclusion.test.ts b/src/renderer/src/components/worktree-jump-palette-recent-inclusion.test.ts
new file mode 100644
index 000000000000..654324782323
--- /dev/null
+++ b/src/renderer/src/components/worktree-jump-palette-recent-inclusion.test.ts
@@ -0,0 +1,85 @@
+import { describe, expect, it } from 'vitest'
+import type { WorkspaceTabPaletteSearchResult } from '@/lib/workspace-tab-palette-search'
+import type { TabPaneInputSources } from '@/components/sidebar/smart-attention'
+import type { AgentJournalTurnOutcome } from '../../../shared/agent-turn-outcome'
+import type { AgentStatusEntry } from '../../../shared/agent-status-types'
+import { shouldIncludeOpenTabInRecentSection } from './worktree-jump-palette-recent-inclusion'
+import { makeAgentEntry, makeWorktree } from './worktree-jump-palette-test-fixtures'
+
+const NOW = 1_700_000_000_000
+const TAB_ID = 'terminal-1'
+
+function currentTabResult(): WorkspaceTabPaletteSearchResult {
+  return {
+    tabId: 'unified-terminal-1',
+    entityId: TAB_ID,
+    worktreeId: 'wt-1',
+    groupId: 'group-1',
+    contentType: 'terminal',
+    occupantAgent: null,
+    title: 'Terminal',
+    secondaryText: '',
+    secondaryMatches: [],
+    repoName: 'repo/orca',
+    worktreeName: 'Palette Worktree',
+    branchName: 'main',
+    titleRanges: [],
+    secondaryRanges: [],
+    repoRanges: [],
+    worktreeRanges: [],
+    branchRanges: [],
+    typeAliasMatches: [],
+    isCurrentTab: true,
+    isCurrentWorktree: true,
+    score: 0,
+    qualityClass: null,
+    rank: null,
+    paletteIdentity: `terminal\u0000wt-1\u0000group-1\u0000unified-terminal-1`,
+    lastActiveAt: null,
+    activity: { ageBucket: null, timestamp: 0 }
+  }
+}
+
+function includesCurrentTabWith(entry: AgentStatusEntry): boolean {
+  const paneSources: TabPaneInputSources = {
+    entriesByTabId: new Map([[TAB_ID, [entry]]]),
+    ptyIdsByTabId: {},
+    runtimePaneTitlesByTabId: {}
+  }
+  return shouldIncludeOpenTabInRecentSection({
+    item: { id: 'item-1', type: 'workspace-tab', result: currentTabResult() },
+    worktree: makeWorktree('wt-1', 'Palette Worktree'),
+    row: {
+      id: TAB_ID,
+      worktreeId: 'wt-1',
+      unifiedTabId: 'unified-terminal-1',
+      terminalTab: { id: TAB_ID, title: 'zsh' },
+      worktreeLastActivityAt: 0
+    },
+    paneSources,
+    unreadTerminalTabs: {},
+    unreadAgentCompletionPanes: {},
+    now: NOW
+  })
+}
+
+function doneWith(outcome?: AgentJournalTurnOutcome): AgentStatusEntry {
+  return makeAgentEntry(
+    TAB_ID,
+    'done',
+    NOW - 1_000,
+    outcome ? { mainAgent: { state: 'done', outcome, stateStartedAt: NOW - 1_000 } } : {}
+  )
+}
+
+describe('shouldIncludeOpenTabInRecentSection', () => {
+  it('keeps the current tab out of Recent once its turn settled, a failure like a completion', () => {
+    expect(includesCurrentTabWith(doneWith())).toBe(false)
+    expect(includesCurrentTabWith(doneWith('cancellation'))).toBe(false)
+    expect(includesCurrentTabWith(doneWith('failure'))).toBe(false)
+  })
+
+  it('keeps the current tab in Recent while its agent still works', () => {
+    expect(includesCurrentTabWith(makeAgentEntry(TAB_ID, 'working', NOW - 1_000))).toBe(true)
+  })
+})
diff --git a/src/renderer/src/components/worktree-jump-palette-recent-inclusion.ts b/src/renderer/src/components/worktree-jump-palette-recent-inclusion.ts
index 61cc3960d07f..41712a4c7719 100644
--- a/src/renderer/src/components/worktree-jump-palette-recent-inclusion.ts
+++ b/src/renderer/src/components/worktree-jump-palette-recent-inclusion.ts
@@ -46,5 +46,6 @@ export function shouldIncludeOpenTabInRecentSection({
       unreadAgentCompletionPanes
     })
   })
-  return badge != null && badge !== 'done' && badge !== 'interrupted'
+  // Why: a settled outcome on the tab you are on is not news; a failure ranks like a completion.
+  return badge != null && badge !== 'done' && badge !== 'failed' && badge !== 'interrupted'
 }
diff --git a/src/renderer/src/hooks/__tests__/remote-workspace-target-sync-test-harness.ts b/src/renderer/src/hooks/__tests__/remote-workspace-target-sync-test-harness.ts
index fcc8909af3c1..3884704d2a1e 100644
--- a/src/renderer/src/hooks/__tests__/remote-workspace-target-sync-test-harness.ts
+++ b/src/renderer/src/hooks/__tests__/remote-workspace-target-sync-test-harness.ts
@@ -82,6 +82,7 @@ export function worktree(id = 'repo-a::/remote/work') {
 }
 
 export function appState(overrides: Record<string, unknown> = {}): AppState {
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: this fixture intentionally supplies only the slices used by target-sync tests.
   return {
     workspaceSessionReady: true,
     repos: [repo()],
@@ -100,6 +101,7 @@ export function appState(overrides: Record<string, unknown> = {}): AppState {
     directSshPaneRetryByTabId: {},
     directSshLivePtyBindingByTabId: {},
     terminalLayoutsByTabId: {},
+    pendingDirectSshLayoutEditsByTabId: {},
     activeTabIdByWorktree: {},
     openFiles: [],
     editorDrafts: {},
@@ -125,6 +127,7 @@ export function appState(overrides: Record<string, unknown> = {}): AppState {
     markRemoteWorkspaceHydrated: vi.fn(),
     clearRemoteWorkspaceHydrated: vi.fn(),
     setRemoteWorkspaceSyncStatus: vi.fn(),
+    acknowledgeDirectSshLayoutEdits: vi.fn(),
     reconnectPersistedTerminals: vi.fn(async () => {}),
     ...overrides
   } as unknown as AppState
diff --git a/src/renderer/src/hooks/composer-state/attachment-drop-lifetime.test.tsx b/src/renderer/src/hooks/composer-state/attachment-drop-lifetime.test.tsx
new file mode 100644
index 000000000000..d1d7b6859d86
--- /dev/null
+++ b/src/renderer/src/hooks/composer-state/attachment-drop-lifetime.test.tsx
@@ -0,0 +1,264 @@
+// @vitest-environment happy-dom
+
+import { act, cleanup, renderHook } from '@testing-library/react'
+import { createRef, StrictMode } from 'react'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { NativeFileDropPayload } from '../../../../shared/native-file-drop'
+import { useAttachmentDropState } from './attachment-drop-state'
+
+const mocks = vi.hoisted(() => ({ toastError: vi.fn() }))
+vi.mock('sonner', () => ({ toast: { error: mocks.toastError } }))
+vi.mock('@/store', () => ({ useAppStore: { getState: () => ({}) } }))
+vi.mock('@/runtime/runtime-file-client', () => ({ importExternalPathsToRuntime: vi.fn() }))
+
+const listeners = new Set<(data: NativeFileDropPayload) => void>()
+const authorize = vi.fn(async (_input: { targetPath: string }) => {})
+const stat = vi.fn(async (_input: { filePath: string }) => ({ isDirectory: false }))
+let originalApi: PropertyDescriptor | undefined
+
+function renderDrop(strict = false) {
+  const attach = vi.fn()
+  const prompt = vi.fn()
+  const hook = renderHook(
+    () =>
+      useAttachmentDropState({
+        agentPromptRef: { current: '' },
+        cancelPromptCaretFrame: () => {},
+        connectionId: null,
+        promptCaretFrameRef: { current: null },
+        promptTextareaRef: createRef<HTMLTextAreaElement>(),
+        selectedRepoPath: '/folder-workspace',
+        selectedRepoSettings: null,
+        setAgentPrompt: prompt,
+        setAttachmentPaths: attach
+      }),
+    { wrapper: strict ? StrictMode : undefined }
+  )
+  return { ...hook, attach, prompt }
+}
+
+function nativeDrop(paths: string[]): void {
+  for (const listener of listeners) {
+    listener({ target: 'composer', paths })
+  }
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  authorize.mockReset().mockResolvedValue(undefined)
+  stat.mockReset().mockResolvedValue({ isDirectory: false })
+  originalApi = Object.getOwnPropertyDescriptor(window, 'api')
+  Object.defineProperty(window, 'api', {
+    configurable: true,
+    value: {
+      fs: { authorizeExternalPath: authorize, stat },
+      ui: {
+        onFileDrop: (listener: (data: NativeFileDropPayload) => void) => {
+          listeners.add(listener)
+          return () => listeners.delete(listener)
+        }
+      }
+    }
+  })
+})
+
+afterEach(() => {
+  cleanup()
+  expect(listeners.size).toBe(0)
+  if (originalApi) {
+    Object.defineProperty(window, 'api', originalApi)
+  } else {
+    Reflect.deleteProperty(window, 'api')
+  }
+})
+
+describe('local composer drop lifetime', () => {
+  it.each(['authorize', 'stat'] as const)(
+    'stops a large batch after unmount during %s',
+    async (phase) => {
+      const gate = Promise.withResolvers<void>()
+      if (phase === 'authorize') {
+        authorize.mockImplementationOnce(() => gate.promise)
+      } else {
+        stat.mockImplementationOnce(async () => {
+          await gate.promise
+          return { isDirectory: false }
+        })
+      }
+      const hook = renderDrop()
+      const paths = Array.from({ length: 1000 }, (_, index) => `/drop/item-${index}`)
+      const pending = hook.result.current.applyLocalComposerDrop(paths)
+      await vi.waitFor(() =>
+        expect(phase === 'authorize' ? authorize : stat).toHaveBeenCalledOnce()
+      )
+      hook.unmount()
+      gate.resolve()
+      await pending
+
+      expect(authorize).toHaveBeenCalledOnce()
+      expect(stat).toHaveBeenCalledTimes(phase === 'authorize' ? 0 : 1)
+      expect(hook.attach).not.toHaveBeenCalled()
+      expect(hook.prompt).not.toHaveBeenCalled()
+      expect(mocks.toastError).not.toHaveBeenCalled()
+    }
+  )
+
+  it.each(['authorize', 'stat'] as const)(
+    'stops silently when a held %s fails after unmount',
+    async (phase) => {
+      const gate = Promise.withResolvers<never>()
+      if (phase === 'authorize') {
+        authorize.mockImplementationOnce(() => gate.promise)
+      } else {
+        stat.mockImplementationOnce(() => gate.promise)
+      }
+      const hook = renderDrop()
+      const pending = hook.result.current.applyLocalComposerDrop(['/drop/one', '/drop/two'])
+      await vi.waitFor(() =>
+        expect(phase === 'authorize' ? authorize : stat).toHaveBeenCalledOnce()
+      )
+      hook.unmount()
+      gate.reject(new Error('EACCES: no access'))
+      await pending
+
+      expect(authorize).toHaveBeenCalledOnce()
+      expect(stat).toHaveBeenCalledTimes(phase === 'authorize' ? 0 : 1)
+      expect(hook.attach).not.toHaveBeenCalled()
+      expect(mocks.toastError).not.toHaveBeenCalled()
+    }
+  )
+
+  it('does no work through a callback saved before unmount', async () => {
+    const hook = renderDrop()
+    const applyDrop = hook.result.current.applyLocalComposerDrop
+    hook.unmount()
+    await applyDrop(['/drop/late'])
+
+    expect(authorize).not.toHaveBeenCalled()
+    expect(stat).not.toHaveBeenCalled()
+    expect(hook.attach).not.toHaveBeenCalled()
+  })
+
+  it('keeps the current request pending until it settles', async () => {
+    const gate = Promise.withResolvers<void>()
+    authorize.mockImplementationOnce(() => gate.promise)
+    const hook = renderDrop()
+    const settled = vi.fn()
+    const pending = hook.result.current.applyLocalComposerDrop(['/drop/one']).then(settled)
+    hook.unmount()
+    await Promise.resolve()
+    expect(settled).not.toHaveBeenCalled()
+    gate.resolve()
+    await pending
+    expect(settled).toHaveBeenCalledOnce()
+    expect(stat).not.toHaveBeenCalled()
+  })
+
+  it('preserves mixed results, order, duplicate filtering and one failure report', async () => {
+    const order: string[] = []
+    authorize.mockImplementation(async ({ targetPath }) => {
+      order.push(`authorize:${targetPath}`)
+    })
+    stat.mockImplementation(async ({ filePath }) => {
+      order.push(`stat:${filePath}`)
+      if (filePath === '/drop/missing') {
+        throw new Error('ENOENT: missing')
+      }
+      return { isDirectory: filePath === '/drop/folder' }
+    })
+    const hook = renderDrop()
+    const paths = ['/drop/one', '/drop/folder', '/drop/missing', '/drop/two', '/drop/one']
+    await hook.result.current.applyLocalComposerDrop(paths)
+
+    expect(order).toEqual(paths.flatMap((path) => [`authorize:${path}`, `stat:${path}`]))
+    expect(hook.attach).toHaveBeenCalledOnce()
+    expect(hook.attach.mock.calls[0]?.[0](['/existing'])).toEqual([
+      '/existing',
+      '/drop/one',
+      '/drop/two'
+    ])
+    expect(hook.prompt).toHaveBeenCalledWith('/drop/folder')
+    expect(mocks.toastError).toHaveBeenCalledExactlyOnceWith(
+      '1 of 5 items could not be attached.',
+      { id: 'composer-drop-failure', description: 'No longer at its original path.' }
+    )
+  })
+})
+
+describe('native composer ownership during a local drop', () => {
+  it.each([false, true])(
+    'stops after actual listener cleanup (Strict Mode: %s)',
+    async (strict) => {
+      const gate = Promise.withResolvers<void>()
+      authorize.mockImplementationOnce(() => gate.promise)
+      const hook = renderDrop(strict)
+      act(() => nativeDrop(['/drop/one', '/drop/two']))
+      await vi.waitFor(() => expect(authorize).toHaveBeenCalledOnce())
+      hook.unmount()
+      expect(listeners.size).toBe(0)
+      await act(async () => gate.resolve())
+
+      expect(authorize).toHaveBeenCalledOnce()
+      expect(stat).not.toHaveBeenCalled()
+      expect(hook.attach).not.toHaveBeenCalled()
+    }
+  )
+
+  it('continues while temporarily covered and applies if ownership returns', async () => {
+    const first = Promise.withResolvers<void>()
+    const second = Promise.withResolvers<void>()
+    authorize
+      .mockImplementationOnce(() => first.promise)
+      .mockImplementationOnce(() => second.promise)
+    const older = renderDrop()
+    act(() => nativeDrop(['/drop/one', '/drop/two']))
+    await vi.waitFor(() => expect(authorize).toHaveBeenCalledOnce())
+    const newer = renderDrop()
+    await act(async () => first.resolve())
+    expect(authorize).toHaveBeenCalledTimes(2)
+    expect(stat).toHaveBeenCalledOnce()
+    expect(older.attach).not.toHaveBeenCalled()
+    newer.unmount()
+    await act(async () => second.resolve())
+
+    expect(older.attach).toHaveBeenCalledOnce()
+    expect(newer.attach).not.toHaveBeenCalled()
+  })
+
+  it('withholds a completed drop while a newer owner remains mounted', async () => {
+    const gate = Promise.withResolvers<void>()
+    authorize.mockImplementationOnce(() => gate.promise)
+    const older = renderDrop()
+    act(() => nativeDrop(['/drop/one', '/drop/two']))
+    await vi.waitFor(() => expect(authorize).toHaveBeenCalledOnce())
+    const newer = renderDrop()
+    await act(async () => gate.resolve())
+
+    expect(authorize).toHaveBeenCalledTimes(2)
+    expect(stat).toHaveBeenCalledTimes(2)
+    expect(older.attach).not.toHaveBeenCalled()
+    expect(newer.attach).not.toHaveBeenCalled()
+  })
+
+  it('does not revive an old batch when another composer mounts', async () => {
+    const gate = Promise.withResolvers<void>()
+    authorize.mockImplementationOnce(() => gate.promise)
+    const older = renderDrop()
+    act(() => nativeDrop(['/drop/old-one', '/drop/old-two']))
+    await vi.waitFor(() => expect(authorize).toHaveBeenCalledOnce())
+    older.unmount()
+    const newer = renderDrop()
+    await act(async () => {
+      nativeDrop(['/drop/new'])
+      gate.resolve()
+    })
+
+    expect(authorize.mock.calls.map(([input]) => input.targetPath)).toEqual([
+      '/drop/old-one',
+      '/drop/new'
+    ])
+    expect(stat.mock.calls.map(([input]) => input.filePath)).toEqual(['/drop/new'])
+    expect(older.attach).not.toHaveBeenCalled()
+    expect(newer.attach).toHaveBeenCalledOnce()
+  })
+})
diff --git a/src/renderer/src/hooks/composer-state/attachment-drop-state.ts b/src/renderer/src/hooks/composer-state/attachment-drop-state.ts
index ace0e0ba4f7a..03d1f15dc246 100644
--- a/src/renderer/src/hooks/composer-state/attachment-drop-state.ts
+++ b/src/renderer/src/hooks/composer-state/attachment-drop-state.ts
@@ -28,6 +28,7 @@ import {
   type ComposerDropItemResult
 } from '../composer-drop-result'
 import { applyComposerNativeFileDrop } from '../composer-native-file-drop'
+import { useMountedRef } from '../useMountedRef'
 import { useComposerDropListener } from './composer-drop-listener'
 
 // Local drops bypass the runtime importer's skip classification.
@@ -53,6 +54,7 @@ export function useAttachmentDropState(input: AttachmentDropStateInput) {
     setAgentPrompt,
     setAttachmentPaths
   } = input
+  const mountedRef = useMountedRef()
 
   const addComposerAttachments = useCallback(
     (paths: string[]): void => {
@@ -214,8 +216,14 @@ export function useAttachmentDropState(input: AttachmentDropStateInput) {
     async (paths: string[], canApply: () => boolean = () => true): Promise<void> => {
       const results: ComposerDropItemResult[] = []
       for (const filePath of paths) {
+        if (!mountedRef.current) {
+          return
+        }
         try {
           await window.api.fs.authorizeExternalPath({ targetPath: filePath })
+          if (!mountedRef.current) {
+            return
+          }
           const stat = await window.api.fs.stat({ filePath })
           results.push({
             status: 'imported',
@@ -227,7 +235,7 @@ export function useAttachmentDropState(input: AttachmentDropStateInput) {
         }
       }
 
-      if (!canApply()) {
+      if (!mountedRef.current || !canApply()) {
         return
       }
       const dropResult = collectComposerDropResult(results)
@@ -241,7 +249,7 @@ export function useAttachmentDropState(input: AttachmentDropStateInput) {
         })
       }
     },
-    [addComposerAttachments, insertComposerFolderPaths]
+    [addComposerAttachments, insertComposerFolderPaths, mountedRef]
   )
 
   const applyNativeDrop = useCallback(
diff --git a/src/renderer/src/hooks/direct-ssh-host-catalog-noop.test.ts b/src/renderer/src/hooks/direct-ssh-host-catalog-noop.test.ts
new file mode 100644
index 000000000000..0568f79bf9b5
--- /dev/null
+++ b/src/renderer/src/hooks/direct-ssh-host-catalog-noop.test.ts
@@ -0,0 +1,162 @@
+import { describe, expect, it, vi } from 'vitest'
+import type { Repo } from '../../../shared/repo-types'
+import type { DirectSshAuthority, SshProviderEpoch } from '../../../shared/ssh-types'
+import { createTestStore } from '../store/slices/store-test-helpers'
+import { createDirectSshHostHydration } from './direct-ssh-host-hydration'
+
+const authority: DirectSshAuthority = {
+  targetId: 'target-a',
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The fixture uses one opaque epoch identity throughout.
+  providerEpoch: 'catalog-epoch' as SshProviderEpoch,
+  connectionGeneration: 1
+}
+
+const remoteRepo: Repo = {
+  id: 'shared',
+  path: '/srv/repo',
+  displayName: 'Remote repo',
+  badgeColor: '',
+  addedAt: 1,
+  connectionId: authority.targetId,
+  executionHostId: 'ssh:target-a',
+  hookSettings: { mode: 'auto', scripts: { setup: 'echo ready', archive: '' } },
+  symlinkPaths: ['.env'],
+  repoIcon: { type: 'lucide', name: 'Box' }
+}
+
+function fixture() {
+  const localRepo: Repo = {
+    ...remoteRepo,
+    path: '/local/repo',
+    connectionId: null,
+    executionHostId: 'local'
+  }
+  const folderRepo: Repo = { ...remoteRepo, id: 'folder', kind: 'folder', path: '/srv/folder' }
+  const initialRepos = [remoteRepo, localRepo, folderRepo]
+  const store = createTestStore()
+  store.setState({
+    repos: initialRepos,
+    manualRepoOrder: [
+      { hostId: 'ssh:target-a', repoId: 'shared' },
+      { hostId: 'local', repoId: 'shared' },
+      { hostId: 'ssh:target-a', repoId: 'folder' }
+    ]
+  })
+  let fetched: readonly Repo[] = [remoteRepo, folderRepo]
+  const hydration = createDirectSshHostHydration({
+    store,
+    listRepos: async () => ({
+      authoritative: true,
+      authority: { kind: 'direct-ssh', executionHostId: 'ssh:target-a', ...authority },
+      repos: structuredClone(fetched)
+    }),
+    listLineage: vi.fn(),
+    isCurrentAuthority: () => true
+  })
+  const listener = vi.fn()
+  store.subscribe(listener)
+  return {
+    store,
+    hydration,
+    listener,
+    initialRepos,
+    localRepo,
+    folderRepo,
+    setFetched: (repos: readonly Repo[]) => {
+      fetched = repos
+    }
+  }
+}
+
+describe('direct SSH host catalog publication', () => {
+  it('does not publish cloned equal repos across twenty refreshes', async () => {
+    const { store, hydration, listener, initialRepos } = fixture()
+    const initialState = store.getState()
+    for (let index = 0; index < 20; index++) {
+      await hydration.capturePreparationInput(authority, 'wake-refresh')
+    }
+    expect(store.getState().repos).toBe(initialRepos)
+    expect(store.getState()).toBe(initialState)
+    expect(listener).not.toHaveBeenCalled()
+    hydration.stop()
+  })
+
+  it('publishes a nested change once and retains equal sibling identities', async () => {
+    const { store, hydration, listener, localRepo, folderRepo, setFetched } = fixture()
+    const changed = { ...remoteRepo, symlinkPaths: ['.env', '.env.local'] }
+    setFetched([changed, folderRepo])
+    await hydration.capturePreparationInput(authority, 'wake-refresh')
+    expect(store.getState().repos).toEqual([changed, localRepo, folderRepo])
+    expect(store.getState().repos[0]).not.toBe(remoteRepo)
+    expect(store.getState().repos[1]).toBe(localRepo)
+    expect(store.getState().repos[2]).toBe(folderRepo)
+    expect(listener).toHaveBeenCalledOnce()
+    await hydration.capturePreparationInput(authority, 'wake-refresh')
+    expect(listener).toHaveBeenCalledOnce()
+    hydration.stop()
+  })
+
+  it('removes only target rows and retains manual order when adding a repo', async () => {
+    const { store, hydration, listener, localRepo, folderRepo, setFetched } = fixture()
+    const added = { ...remoteRepo, id: 'added', path: '/srv/added' }
+    setFetched([added, folderRepo])
+    await hydration.capturePreparationInput(authority, 'wake-refresh')
+    expect(store.getState().repos).toEqual([localRepo, folderRepo, added])
+    expect(store.getState().repos[0]).toBe(localRepo)
+    expect(store.getState().repos[1]).toBe(folderRepo)
+    expect(listener).toHaveBeenCalledOnce()
+    hydration.stop()
+  })
+
+  it('still advances catalog observation revisions when rows stay equal', async () => {
+    const { hydration, listener } = fixture()
+    const first = await hydration.capturePreparationInput(authority, 'reconnect')
+    const second = await hydration.capturePreparationInput(authority, 'wake-refresh')
+    expect(first).not.toBeNull()
+    expect(second?.catalogRevision).toBe(first!.catalogRevision + 1)
+    const repoFingerprint = JSON.stringify([
+      ['ssh:target-a', 'folder'],
+      ['ssh:target-a', 'shared']
+    ])
+    expect(
+      hydration.isPreparationTokenCurrent({
+        authority,
+        catalogRevision: first!.catalogRevision,
+        repoFingerprint
+      })
+    ).toBe(false)
+    expect(
+      hydration.isPreparationTokenCurrent({
+        authority,
+        catalogRevision: second!.catalogRevision,
+        repoFingerprint
+      })
+    ).toBe(true)
+    expect(listener).not.toHaveBeenCalled()
+    hydration.stop()
+  })
+
+  // Why these two shapes: the gate must fail closed on a field no previous row carried, so a
+  // `Repo` field added after this gate landed still publishes without anyone revisiting the
+  // comparison. `'auto'` is documented as semantically identical to an absent
+  // `issueSourcePreference`, which makes it the sharpest case for the strict own-key policy.
+  it.each([
+    {
+      label: 'an optional key no previous row carried',
+      changed: { ...remoteRepo, issueSourcePreference: 'auto' } satisfies Repo
+    },
+    {
+      label: 'a nested record no previous row carried',
+      changed: { ...remoteRepo, upstream: { owner: 'octo', repo: 'remote' } } satisfies Repo
+    }
+  ])('publishes when a fetched row gains $label', async ({ changed }) => {
+    const { store, hydration, listener, folderRepo, setFetched } = fixture()
+    setFetched([changed, folderRepo])
+    await hydration.capturePreparationInput(authority, 'wake-refresh')
+    expect(listener).toHaveBeenCalledOnce()
+    expect(store.getState().repos).toContainEqual(changed)
+    await hydration.capturePreparationInput(authority, 'wake-refresh')
+    expect(listener).toHaveBeenCalledOnce()
+    hydration.stop()
+  })
+})
diff --git a/src/renderer/src/hooks/direct-ssh-host-hydration.ts b/src/renderer/src/hooks/direct-ssh-host-hydration.ts
index 2c3265017600..32b97b50a557 100644
--- a/src/renderer/src/hooks/direct-ssh-host-hydration.ts
+++ b/src/renderer/src/hooks/direct-ssh-host-hydration.ts
@@ -6,7 +6,7 @@ import { applyManualRepoOrder } from '../../../shared/manual-repo-order'
 import type { DirectSshAuthority } from '../../../shared/ssh-types'
 import { isWorkspaceKey } from '../../../shared/workspace-scope'
 import type { AppState } from '../store/types'
-import { reuseEqualRecordMap } from '../store/slices/repo-identity-reconcile'
+import { reconcileFetchedRepos, reuseEqualRecordMap } from '../store/slices/repo-identity-reconcile'
 import type {
   DirectSshLineageOutcome,
   DirectSshPreparationInput,
@@ -66,13 +66,14 @@ function mergeExactHostCatalog(state: AppState, snapshot: HostRepoCatalogSnapsho
   const hostId = snapshot.authority.executionHostId
   // Why re-apply the overlay: re-appending the host's rows puts them at the tail, which would
   // undo the user's manual cross-host order on every connect.
-  return {
-    ...state,
-    repos: applyManualRepoOrder(
+  const repos = reconcileFetchedRepos(
+    state.repos,
+    applyManualRepoOrder(
       [...state.repos.filter((repo) => getRepoExecutionHostId(repo) !== hostId), ...snapshot.repos],
       state.manualRepoOrder
     )
-  }
+  )
+  return repos === state.repos ? state : { ...state, repos }
 }
 
 // Why: the host owns every in-scope key, so drop the stale in-scope rows, overlay the snapshot's,
diff --git a/src/renderer/src/hooks/ipc-events-close-routing-test-harness.ts b/src/renderer/src/hooks/ipc-events-close-routing-test-harness.ts
index 3883f7ac8af6..249e435b9a47 100644
--- a/src/renderer/src/hooks/ipc-events-close-routing-test-harness.ts
+++ b/src/renderer/src/hooks/ipc-events-close-routing-test-harness.ts
@@ -3,6 +3,7 @@
    calls back out would duplicate them into all 4 specs. */
 import type * as ReactModule from 'react'
 import { vi } from 'vitest'
+import type { TerminalSurfaceCloseTarget } from '../../../shared/terminal-surface-close-target'
 
 export type RequestTabCloseListener = (data: {
   requestId: string
@@ -12,7 +13,7 @@ export type RequestTabCloseListener = (data: {
 export type CloseActiveTabListener = (payload?: { sourceId: string }) => void
 export type CloseFloatingItemListener = (payload: { sourceId: string }) => void
 export type SelectFloatingIndexListener = (payload: { index: number }) => void
-export type CloseTerminalListener = (data: { tabId: string; paneRuntimeId?: number | null }) => void
+export type CloseTerminalListener = (target: TerminalSurfaceCloseTarget) => void
 export type CloseSessionTabListener = (data: { tabId: string; worktreeId: string }) => void
 export type SessionTabCloseRequestListener = (data: {
   requestId: string
diff --git a/src/renderer/src/hooks/ipc-events/browser-state-ipc-bridge.ts b/src/renderer/src/hooks/ipc-events/browser-state-ipc-bridge.ts
index 47da67cdc857..f55604032695 100644
--- a/src/renderer/src/hooks/ipc-events/browser-state-ipc-bridge.ts
+++ b/src/renderer/src/hooks/ipc-events/browser-state-ipc-bridge.ts
@@ -1,5 +1,6 @@
 import { rememberLiveBrowserUrl } from '@/components/browser-pane/describe-page/live-browser-url-registry'
 import { getRuntimeEnvironmentIdForWorktree } from '@/lib/worktree-runtime-owner'
+import { resolveBrowserSourceUnifiedTab } from '@/lib/browser-workspace-source-resolution'
 import { redactKagiSessionToken } from '../../../../shared/browser-url'
 import { useAppStore } from '../../store'
 import {
@@ -121,9 +122,18 @@ export function registerBrowserStateIpcBridge(
       const sourceTab = (store.browserTabsByWorktree[sourcePage.worktreeId] ?? []).find(
         (tab) => tab.id === sourcePage.workspaceId
       )
+      const sourceUnifiedTab = resolveBrowserSourceUnifiedTab(
+        store,
+        browserPageId,
+        sourcePage.worktreeId
+      )
       store.createBrowserTab(sourcePage.worktreeId, url, {
         title: url,
         activate: activate ?? true,
+        ...(sourceUnifiedTab ? { afterTabId: sourceUnifiedTab.id } : {}),
+        ...(sourceUnifiedTab?.executionHostId
+          ? { executionHostId: sourceUnifiedTab.executionHostId }
+          : {}),
         ...(sourceTab
           ? {
               sessionProfileId: sourceTab.sessionProfileId,
diff --git a/src/renderer/src/hooks/ipc-events/browser-state-open-link-profile.test.ts b/src/renderer/src/hooks/ipc-events/browser-state-open-link-profile.test.ts
index 446a0dc74359..9db3d4ee5f5d 100644
--- a/src/renderer/src/hooks/ipc-events/browser-state-open-link-profile.test.ts
+++ b/src/renderer/src/hooks/ipc-events/browser-state-open-link-profile.test.ts
@@ -80,6 +80,12 @@ describe('link-opened Orca tabs', () => {
           }
         ]
       },
+      unifiedTabsByWorktree: {
+        'worktree-1': [
+          { id: 'unified-1', entityId: 'workspace-1', contentType: 'browser', groupId: 'group-1' }
+        ]
+      },
+      groupsByWorktree: { 'worktree-1': [{ id: 'group-1', tabOrder: ['unified-1'] }] },
       createBrowserTab: createBrowserTabMock
     }
 
@@ -89,6 +95,7 @@ describe('link-opened Orca tabs', () => {
       'worktree-1',
       'https://docs.example.com/guide',
       expect.objectContaining({
+        afterTabId: 'unified-1',
         sessionProfileId: 'profile-client-a',
         sessionPartition: 'persist:orca-browser-session-client-a'
       })
diff --git a/src/renderer/src/hooks/ipc-events/direct-ssh-connect-reply-routing.test.ts b/src/renderer/src/hooks/ipc-events/direct-ssh-connect-reply-routing.test.ts
new file mode 100644
index 000000000000..85023d75f4f5
--- /dev/null
+++ b/src/renderer/src/hooks/ipc-events/direct-ssh-connect-reply-routing.test.ts
@@ -0,0 +1,291 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { useAppStore } from '@/store'
+import type {
+  DirectSshAuthority,
+  SshConnectionState,
+  SshProviderEpoch
+} from '../../../../shared/ssh-types'
+import { createDirectSshBridgeRuntime } from './direct-ssh-bridge-runtime'
+import { registerDirectSshStateIpcBridge } from './direct-ssh-state-ipc-bridge'
+
+function connectedState(
+  targetId = 'target-a',
+  generation = 1
+): SshConnectionState & DirectSshAuthority {
+  return {
+    targetId,
+    status: 'connected',
+    error: null,
+    reconnectAttempt: 0,
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Tests issue a fixed opaque provider token for each target.
+    providerEpoch: `epoch-${targetId}` as SshProviderEpoch,
+    connectionGeneration: generation
+  }
+}
+
+function authority(state: DirectSshAuthority): DirectSshAuthority {
+  return {
+    targetId: state.targetId,
+    providerEpoch: state.providerEpoch,
+    connectionGeneration: state.connectionGeneration
+  }
+}
+
+async function settle(): Promise<void> {
+  for (let index = 0; index < 60; index += 1) {
+    await Promise.resolve()
+  }
+}
+
+const originalStore = useAppStore.getState()
+const cleanups: (() => void)[] = []
+
+async function createHarness(
+  initialStates: readonly SshConnectionState[] = [],
+  reconciledStates: readonly SshConnectionState[] = []
+) {
+  const states = new Map(initialStates.map((state) => [state.targetId, state]))
+  const reconciled = new Map(reconciledStates.map((state) => [state.targetId, state]))
+  let stateListener: ((event: { targetId: string; state: unknown }) => void) | undefined
+  const getState = vi.fn(async ({ targetId }: { targetId: string }) => {
+    const state = states.get(targetId) ?? null
+    const next = reconciled.get(targetId)
+    if (next) {
+      states.set(targetId, next)
+    }
+    return state
+  })
+  const targets = ['target-a', 'target-b'].map((id) => ({ id, label: id }))
+  vi.stubGlobal('window', {
+    addEventListener: () => {},
+    removeEventListener: () => {},
+    api: {
+      ui: {},
+      repos: {},
+      worktrees: {},
+      ssh: {
+        listTargets: async () => targets,
+        listRemovedTargetLabels: async () => ({}),
+        getState,
+        listPortForwards: async () => [],
+        listDetectedPorts: async () => [],
+        onCredentialRequest: () => () => {},
+        onCredentialResolved: () => () => {},
+        onPortForwardsChanged: () => () => {},
+        onDetectedPortsChanged: () => () => {},
+        onStateChanged: (listener: typeof stateListener) => {
+          stateListener = listener
+          return () => {}
+        }
+      }
+    }
+  })
+  const store = useAppStore.getState()
+  const invalidate = vi.spyOn(store, 'invalidateStaleDirectSshTargetPtyBindings').mockReturnValue(1)
+  const retry = vi.spyOn(store, 'retryDirectSshTargetPanes').mockReturnValue(1)
+  const clearBindings = vi.spyOn(store, 'clearDirectSshTargetPtyBindings').mockReturnValue(1)
+  const runtime = createDirectSshBridgeRuntime()
+  const requestReconnect = vi.spyOn(runtime.reconnectCoordinator, 'requestReconnect')
+  const prepareAndSync = vi.spyOn(runtime, 'prepareAndSync')
+  const unsubs: (() => void)[] = []
+  cleanups.push(() => {
+    for (const unsubscribe of unsubs) {
+      unsubscribe()
+    }
+    runtime.stop()
+  })
+  registerDirectSshStateIpcBridge(unsubs, runtime)
+  await settle()
+  return {
+    runtime,
+    getState,
+    invalidate,
+    retry,
+    clearBindings,
+    requestReconnect,
+    prepareAndSync,
+    emit: (state: SshConnectionState) => {
+      if (!stateListener) {
+        throw new Error('SSH state listener was not registered')
+      }
+      stateListener({ targetId: state.targetId, state })
+    },
+    applyConnectReply: (state: SshConnectionState) => {
+      useAppStore.getState().setSshConnectionState(state.targetId, state)
+    }
+  }
+}
+
+beforeEach(() => {
+  useAppStore.setState(originalStore, true)
+})
+
+afterEach(async () => {
+  for (const cleanup of cleanups.splice(0)) {
+    cleanup()
+  }
+  await settle()
+  vi.restoreAllMocks()
+  useAppStore.setState(originalStore, true)
+  vi.unstubAllGlobals()
+})
+
+describe('direct SSH connect reply routing', () => {
+  it.each(['reply-first', 'push-first'] as const)(
+    'retries through the real coordinator once when connection ordering is %s',
+    async (ordering) => {
+      const harness = await createHarness()
+      const state = connectedState()
+      if (ordering === 'reply-first') {
+        harness.applyConnectReply(state)
+      }
+      harness.emit(state)
+      if (ordering === 'push-first') {
+        harness.applyConnectReply(state)
+      }
+
+      expect(harness.requestReconnect).toHaveBeenCalledExactlyOnceWith(authority(state))
+      expect(harness.invalidate).toHaveBeenCalledExactlyOnceWith(authority(state))
+      expect(harness.retry).toHaveBeenCalledExactlyOnceWith(authority(state))
+      expect(harness.runtime.reconnectAuthorityByTarget.get(state.targetId)).toEqual(
+        authority(state)
+      )
+      await settle()
+
+      harness.retry.mockClear()
+      harness.emit({ ...state })
+
+      expect(harness.requestReconnect).toHaveBeenCalledOnce()
+      expect(harness.invalidate).toHaveBeenCalledOnce()
+      expect(harness.retry).toHaveBeenCalledExactlyOnceWith(authority(state))
+      expect(harness.prepareAndSync).toHaveBeenLastCalledWith(authority(state), 'wake-refresh')
+    }
+  )
+
+  it('keeps hydration preparation-only and corrects its duplicate without requesting reconnect', async () => {
+    const state = connectedState()
+    const harness = await createHarness([state])
+
+    expect(harness.prepareAndSync).toHaveBeenCalledExactlyOnceWith(
+      authority(state),
+      'initial-hydration'
+    )
+    expect(harness.requestReconnect).not.toHaveBeenCalled()
+    expect(harness.invalidate).not.toHaveBeenCalled()
+    expect(harness.retry).not.toHaveBeenCalled()
+
+    harness.emit({ ...state })
+
+    expect(harness.requestReconnect).not.toHaveBeenCalled()
+    expect(harness.retry).toHaveBeenCalledExactlyOnceWith(authority(state))
+    expect(harness.runtime.reconnectAuthorityByTarget.size).toBe(0)
+
+    const next = connectedState(state.targetId, 2)
+    harness.applyConnectReply(next)
+    harness.retry.mockClear()
+    harness.emit(next)
+
+    expect(harness.requestReconnect).toHaveBeenCalledExactlyOnceWith(authority(next))
+    expect(harness.retry).toHaveBeenCalledExactlyOnceWith(authority(next))
+  })
+
+  it.each(['disconnected', 'error'] as const)(
+    'forgets a routed authority after %s even when the next connect reply reaches the store first',
+    async (status) => {
+      const state = connectedState()
+      const harness = await createHarness([state])
+      harness.emit({ ...state, status })
+
+      expect(harness.clearBindings).toHaveBeenCalledExactlyOnceWith(state.targetId)
+      harness.applyConnectReply(state)
+      harness.emit(state)
+
+      expect(harness.requestReconnect).toHaveBeenCalledExactlyOnceWith(authority(state))
+      expect(harness.retry).toHaveBeenCalledExactlyOnceWith(authority(state))
+      expect(harness.runtime.reconnectAuthorityByTarget.get(state.targetId)).toEqual(
+        authority(state)
+      )
+    }
+  )
+
+  it.each(['providerEpoch', 'connectionGeneration'] as const)(
+    'preserves initial hydration routing when %s must be reconciled',
+    async (missingField) => {
+      const state = connectedState()
+      const partial: SshConnectionState = { ...state }
+      delete partial[missingField]
+      const harness = await createHarness([partial], [state])
+
+      expect(useAppStore.getState().sshConnectionStates.get(state.targetId)).toEqual(state)
+      expect(harness.prepareAndSync).toHaveBeenCalledExactlyOnceWith(
+        authority(state),
+        'initial-hydration'
+      )
+      expect(harness.requestReconnect).not.toHaveBeenCalled()
+      expect(harness.retry).not.toHaveBeenCalled()
+
+      harness.emit(state)
+
+      expect(harness.requestReconnect).not.toHaveBeenCalled()
+      expect(harness.retry).toHaveBeenCalledExactlyOnceWith(authority(state))
+      expect(harness.runtime.reconnectAuthorityByTarget.size).toBe(0)
+    }
+  )
+
+  it.each(['providerEpoch', 'connectionGeneration'] as const)(
+    'waits for partial authority reconciliation when %s is missing',
+    async (missingField) => {
+      const harness = await createHarness()
+      const state = connectedState()
+      let resolveState!: (state: SshConnectionState) => void
+      harness.getState.mockImplementationOnce(
+        () =>
+          new Promise((resolve) => {
+            resolveState = resolve
+          })
+      )
+      harness.applyConnectReply(state)
+      const partial: SshConnectionState = { ...state }
+      delete partial[missingField]
+      harness.emit(partial)
+
+      expect(harness.requestReconnect).not.toHaveBeenCalled()
+      expect(harness.retry).not.toHaveBeenCalled()
+      resolveState(state)
+      await settle()
+
+      expect(harness.requestReconnect).toHaveBeenCalledExactlyOnceWith(authority(state))
+      expect(harness.invalidate).toHaveBeenCalledExactlyOnceWith(authority(state))
+      expect(harness.retry).toHaveBeenCalledWith(authority(state))
+      harness.emit(state)
+      expect(harness.requestReconnect).toHaveBeenCalledOnce()
+    }
+  )
+
+  it('keeps routed authorities and disconnect cleanup separate for each target', async () => {
+    const harness = await createHarness()
+    const first = connectedState('target-a')
+    const second = connectedState('target-b')
+    for (const state of [first, second]) {
+      harness.applyConnectReply(state)
+      harness.emit(state)
+    }
+    await settle()
+    expect(harness.requestReconnect.mock.calls).toEqual([[authority(first)], [authority(second)]])
+
+    harness.emit({ ...first, status: 'disconnected' })
+    harness.retry.mockClear()
+    harness.emit(second)
+
+    expect(harness.requestReconnect).toHaveBeenCalledTimes(2)
+    expect(harness.retry).toHaveBeenCalledExactlyOnceWith(authority(second))
+    expect(harness.runtime.reconnectAuthorityByTarget.get(second.targetId)).toEqual(
+      authority(second)
+    )
+    expect(harness.runtime.reconnectAuthorityByTarget.has(first.targetId)).toBe(false)
+
+    harness.applyConnectReply(first)
+    harness.emit(first)
+    expect(harness.requestReconnect).toHaveBeenNthCalledWith(3, authority(first))
+  })
+})
diff --git a/src/renderer/src/hooks/ipc-events/direct-ssh-state-ipc-bridge.ts b/src/renderer/src/hooks/ipc-events/direct-ssh-state-ipc-bridge.ts
index 11ceff832fc5..2efacc7765d4 100644
--- a/src/renderer/src/hooks/ipc-events/direct-ssh-state-ipc-bridge.ts
+++ b/src/renderer/src/hooks/ipc-events/direct-ssh-state-ipc-bridge.ts
@@ -22,6 +22,8 @@ export function registerDirectSshStateIpcBridge(
     prepareAndSync
   } = runtime
   const sshStateWatermarkByTargetId = new Map<string, number>()
+  // Connect replies can update the store before this bridge routes the matching push.
+  const routedAuthorityByTarget = new Map<string, DirectSshAuthority>()
   const pendingPortHydrationByTargetId = new Map<
     string,
     { receivedForwardPush: boolean; receivedDetectedPush: boolean }
@@ -152,10 +154,10 @@ export function registerDirectSshStateIpcBridge(
     origin: DirectSshConnectedStateOrigin
   ): void => {
     const store = useAppStore.getState()
-    const previous = store.sshConnectionStates?.get(targetId)
     store.setSshConnectionState(targetId, state)
 
     if (canConnectSshStatus(state.status)) {
+      routedAuthorityByTarget.delete(targetId)
       reconnectAuthorityByTarget.delete(targetId)
       reconnectCoordinator.invalidate(targetId)
       store.clearRemoteDetectedAgents(targetId)
@@ -175,16 +177,8 @@ export function registerDirectSshStateIpcBridge(
       reconcileSshAuthority(targetId, state, origin, sshStateWatermarkByTargetId.get(targetId) ?? 0)
       return
     }
-    const previousAuthority =
-      previous?.status === 'connected' &&
-      previous.providerEpoch &&
-      previous.connectionGeneration !== undefined
-        ? {
-            targetId,
-            providerEpoch: previous.providerEpoch,
-            connectionGeneration: previous.connectionGeneration
-          }
-        : null
+    const previousAuthority = routedAuthorityByTarget.get(targetId) ?? null
+    routedAuthorityByTarget.set(targetId, authority)
     routeDirectSshConnectedState(
       {
         coordinator: reconnectCoordinator,
@@ -235,6 +229,7 @@ export function registerDirectSshStateIpcBridge(
           }
           const latestStore = useAppStore.getState()
           if (!targets.some((target) => target.id === data.targetId)) {
+            routedAuthorityByTarget.delete(data.targetId)
             latestStore.clearRemovedSshTargetState(data.targetId)
             return
           }
diff --git a/src/renderer/src/hooks/ipc-events/host-session-tab-target.ts b/src/renderer/src/hooks/ipc-events/host-session-tab-target.ts
new file mode 100644
index 000000000000..86397dd464d3
--- /dev/null
+++ b/src/renderer/src/hooks/ipc-events/host-session-tab-target.ts
@@ -0,0 +1,13 @@
+import { LOCAL_STRUCTURED_SESSION_OWNER } from '@/runtime/local-structured-session-owner'
+import { resolveLocalTabIdForHostSessionTab } from '@/runtime/web-session-tabs-sync/tracking-mappings'
+
+/** Main addresses its own session-tab ids; a mirrored chat tab lives here under a different id. */
+export function resolveWindowTabIdForHostTab(worktreeId: string, tabId: string): string {
+  return (
+    resolveLocalTabIdForHostSessionTab({
+      environmentId: LOCAL_STRUCTURED_SESSION_OWNER,
+      worktreeId,
+      hostTabId: tabId
+    }) ?? tabId
+  )
+}
diff --git a/src/renderer/src/hooks/ipc-events/mobile-terminal-close-ipc-bridge.ts b/src/renderer/src/hooks/ipc-events/mobile-terminal-close-ipc-bridge.ts
index aaf1686e702f..43a7e5905585 100644
--- a/src/renderer/src/hooks/ipc-events/mobile-terminal-close-ipc-bridge.ts
+++ b/src/renderer/src/hooks/ipc-events/mobile-terminal-close-ipc-bridge.ts
@@ -1,5 +1,4 @@
-import { CLOSE_TERMINAL_PANE_EVENT } from '@/constants/terminal'
-import type { CloseTerminalPaneDetail } from '@/constants/terminal'
+import { applyClosedTerminalLeafNotice } from '@/components/terminal-pane/closed-terminal-leaf-notice'
 import { closeTerminalTab } from '@/components/terminal/terminal-tab-actions'
 import { detectLanguage } from '@/lib/language-detect'
 import { runSleepWorktree } from '@/components/sidebar/sleep-worktree-flow'
@@ -53,14 +52,12 @@ export function registerMobileAndTerminalCloseIpcBridge(
   )
 
   unsubs.push(
-    window.api.ui.onCloseTerminal(({ tabId, paneRuntimeId }) => {
-      if (paneRuntimeId != null) {
-        // Why: route pane closes via the lifecycle hook for sibling promotion (falls through to closeTab on the last pane).
-        const detail: CloseTerminalPaneDetail = { tabId, paneRuntimeId }
-        window.dispatchEvent(new CustomEvent(CLOSE_TERMINAL_PANE_EVENT, { detail }))
+    window.api.ui.onCloseTerminal((target) => {
+      if (target.kind === 'pane') {
+        applyClosedTerminalLeafNotice(target.tabId, target.leafId)
       } else {
         // Why: the CLI/RPC caller is answered immediately, so it cannot wait on a modal.
-        closeTerminalTab(tabId, { skipRunningProcessConfirm: true })
+        closeTerminalTab(target.tabId, { skipRunningProcessConfirm: true })
       }
     })
   )
diff --git a/src/renderer/src/hooks/ipc-events/runtime-client-ipc-bridge-ownership.test.ts b/src/renderer/src/hooks/ipc-events/runtime-client-ipc-bridge-ownership.test.ts
new file mode 100644
index 000000000000..cd1b231da18c
--- /dev/null
+++ b/src/renderer/src/hooks/ipc-events/runtime-client-ipc-bridge-ownership.test.ts
@@ -0,0 +1,179 @@
+import { afterEach, beforeEach, expect, it, vi } from 'vitest'
+import { useAppStore } from '@/store'
+import { subscribeRuntimeEnvironmentFromPreload } from '../../../../preload/runtime-environment-subscriptions'
+import { tagRuntimeSubscriptionReplayResponse } from '../../../../shared/runtime-subscription-replay'
+import { createCompatibleRuntimeStatusResponse } from '@/runtime/runtime-compatibility-test-fixture'
+import { registerRuntimeClientIpcBridge } from './runtime-client-ipc-bridge'
+
+const initialState = useAppStore.getState()
+
+beforeEach(() => vi.useFakeTimers())
+afterEach(() => {
+  useAppStore.setState(initialState, true)
+  vi.useRealTimers()
+  vi.unstubAllGlobals()
+})
+
+function createHarness() {
+  type Ipc = Parameters<typeof subscribeRuntimeEnvironmentFromPreload>[0]
+  type Args = Parameters<typeof subscribeRuntimeEnvironmentFromPreload>[1]
+  type Callbacks = Parameters<typeof subscribeRuntimeEnvironmentFromPreload>[2]
+  let listener: Parameters<Ipc['on']>[1] | undefined
+  const pending: ReturnType<typeof Promise.withResolvers<unknown>>[] = []
+  const issueRead = Promise.withResolvers<null>()
+  const ipc: Ipc = {
+    invoke: vi.fn((channel) => {
+      if (channel !== 'runtimeEnvironments:subscribe') {
+        return Promise.resolve()
+      }
+      const setup = Promise.withResolvers<unknown>()
+      pending.push(setup)
+      return setup.promise
+    }),
+    send: vi.fn(),
+    on: (_channel, callback) => {
+      listener = callback
+    },
+    removeListener: vi.fn()
+  }
+  const getIssue = vi.fn(() => issueRead.promise)
+  const refreshStatus = vi.fn(async () => true)
+  let nextId = 0
+  vi.stubGlobal('window', {
+    api: {
+      runtimeEnvironments: {
+        subscribe: (args: Args, callbacks: Callbacks) =>
+          subscribeRuntimeEnvironmentFromPreload(ipc, args, callbacks, () => `sub-${nextId++}`),
+        call: vi.fn(async () => ({ id: 'r', ok: true, result: [] }))
+      },
+      linear: { getIssue }
+    }
+  })
+  const status = createCompatibleRuntimeStatusResponse()
+  if (!status.ok) {
+    throw new Error('expected valid runtime status fixture')
+  }
+  useAppStore.setState({
+    settings: null,
+    runtimeEnvironments: [
+      {
+        id: 'host-a',
+        name: 'Host A',
+        createdAt: 1,
+        updatedAt: 1,
+        lastUsedAt: null,
+        runtimeId: null,
+        endpoints: [
+          { id: 'ws-a', kind: 'websocket', label: 'WS', endpoint: 'ws://example.invalid' }
+        ],
+        preferredEndpointId: 'ws-a'
+      }
+    ],
+    runtimeStatusByEnvironmentId: new Map([['host-a', { status: status.result, checkedAt: 1 }]]),
+    linearIssueCache: {},
+    linearSearchCache: {},
+    linearListCache: {},
+    linearProjectIssueCache: {},
+    linearCustomViewIssueCache: {},
+    checkLinearConnection: vi.fn(async () => {}),
+    refreshRuntimeEnvironmentStatus: refreshStatus
+  })
+  const starts: (() => void)[] = []
+  const start = (): (() => void) => {
+    const unsubs: (() => void)[] = []
+    const unsubscribeStore = registerRuntimeClientIpcBridge(unsubs, {
+      worktreeChangeRefreshQueue: { enqueue: vi.fn(), dispose: vi.fn() },
+      activateNotifiedWorktree: vi.fn(async () => {})
+    })
+    const stop = (): void => {
+      unsubscribeStore()
+      unsubs.forEach((unsubscribe) => unsubscribe())
+    }
+    starts.push(stop)
+    return stop
+  }
+  return {
+    start,
+    getIssue,
+    refreshStatus,
+    pending,
+    ipc,
+    emit: (index: number, replay = false) => {
+      const response = {
+        id: 'r',
+        ok: true as const,
+        _meta: { runtimeId: 'remote-runtime' },
+        result: {
+          type: 'linearLinkedIssueUpdated',
+          identifier: 'ISSUE-1',
+          workspaceId: 'workspace-a'
+        }
+      }
+      listener?.(null, {
+        subscriptionId: `sub-${index}`,
+        type: 'response',
+        response: replay ? tagRuntimeSubscriptionReplayResponse(response) : response
+      })
+    },
+    finish: async () => {
+      starts.forEach((stop) => stop())
+      pending.forEach((setup, index) =>
+        setup.resolve({ subscriptionId: `sub-${index}`, requestId: 'r' })
+      )
+      issueRead.resolve(null)
+      for (let index = 0; index < 30; index += 1) {
+        await Promise.resolve()
+      }
+    }
+  }
+}
+
+it('does no Linear read dispatch or cache publication after cleanup while setup is pending', async () => {
+  const h = createHarness()
+  let publications = 0
+  const stopCounting = useAppStore.subscribe((state, previous) => {
+    if (state.linearIssueCache !== previous.linearIssueCache) {
+      publications += 1
+    }
+  })
+  try {
+    h.start()()
+    for (let index = 0; index < 100; index += 1) {
+      h.emit(0)
+    }
+    expect(h.getIssue).not.toHaveBeenCalled()
+    expect(publications).toBe(0)
+  } finally {
+    stopCounting()
+    await h.finish()
+  }
+  expect(h.ipc.removeListener).toHaveBeenCalledOnce()
+})
+
+it('does no replay recovery or resubscription after cleanup', async () => {
+  const h = createHarness()
+  try {
+    h.start()()
+    h.emit(0, true)
+    expect(h.refreshStatus).not.toHaveBeenCalled()
+    expect(h.pending).toHaveLength(1)
+    expect(h.getIssue).not.toHaveBeenCalled()
+  } finally {
+    await h.finish()
+  }
+})
+
+it('accepts a fresh bridge early frame while rejecting the previous bridge frame', async () => {
+  const h = createHarness()
+  try {
+    h.start()()
+    h.start()
+    h.emit(0)
+    h.emit(1)
+    expect(h.getIssue).toHaveBeenCalledOnce()
+    expect(h.getIssue).toHaveBeenCalledWith({ id: 'ISSUE-1', workspaceId: 'workspace-a' })
+  } finally {
+    await h.finish()
+  }
+  expect(h.ipc.removeListener).toHaveBeenCalledOnce()
+})
diff --git a/src/renderer/src/hooks/ipc-events/runtime-client-ipc-bridge.ts b/src/renderer/src/hooks/ipc-events/runtime-client-ipc-bridge.ts
index a5db87bbce10..ae014d702300 100644
--- a/src/renderer/src/hooks/ipc-events/runtime-client-ipc-bridge.ts
+++ b/src/renderer/src/hooks/ipc-events/runtime-client-ipc-bridge.ts
@@ -137,7 +137,7 @@ export function registerRuntimeClientIpcBridge(
   const runtimeClientEventsSync = createRuntimeClientEventsSync({
     getDesiredEnvironmentIds: () => getRuntimeClientEventEnvironmentIds(useAppStore.getState()),
     getSubscriptionKey: (environmentId) => buildRuntimeClientEventEnvironmentKey([environmentId]),
-    subscribe: (environmentId, onEvent, onError) => {
+    subscribe: (environmentId, onEvent, onError, isCurrent) => {
       const sshGeneration = getEnvironmentSshStateGeneration(environmentId)
       const runtimeGeneration = getRuntimeEnvironmentConnectionGeneration(environmentId)
       const runtimeRevision = getRuntimeEnvironmentRevision(environmentId)
@@ -154,6 +154,9 @@ export function registerRuntimeClientIpcBridge(
         },
         onError,
         () => {
+          if (!isCurrent()) {
+            return
+          }
           invalidateRuntimeClientEventReplay({
             getSshStateReference: () => useAppStore.getState().sshStateByEnvironment,
             refreshRuntimeStatus: () => {
diff --git a/src/renderer/src/hooks/ipc-events/session-tab-ipc-bridge.ts b/src/renderer/src/hooks/ipc-events/session-tab-ipc-bridge.ts
index 474640720349..7cd2b65efb9b 100644
--- a/src/renderer/src/hooks/ipc-events/session-tab-ipc-bridge.ts
+++ b/src/renderer/src/hooks/ipc-events/session-tab-ipc-bridge.ts
@@ -13,6 +13,7 @@ import {
 } from '../../store/pinned-tab-close-guard'
 import { useAppStore } from '../../store'
 import { resolveBrowserSessionTabTarget } from './browser-session-tab-target'
+import { resolveWindowTabIdForHostTab } from './host-session-tab-target'
 
 export function registerSessionTabIpcBridge(unsubs: (() => void)[]): void {
   unsubs.push(
@@ -20,8 +21,9 @@ export function registerSessionTabIpcBridge(unsubs: (() => void)[]): void {
       if (isLocalSessionTabCloseOwned(worktreeId, tabId)) {
         return
       }
+      const localTabId = resolveWindowTabIdForHostTab(worktreeId, tabId)
       const store = useAppStore.getState()
-      const browserTarget = resolveBrowserSessionTabTarget(store, worktreeId, tabId)
+      const browserTarget = resolveBrowserSessionTabTarget(store, worktreeId, localTabId)
       if (browserTarget) {
         guardPinnedTabClose({
           isPinned: isUnifiedTabPinned(store, worktreeId, browserTarget.workspaceId),
@@ -31,11 +33,11 @@ export function registerSessionTabIpcBridge(unsubs: (() => void)[]): void {
         return
       }
       guardPinnedTabClose({
-        isPinned: isUnifiedTabPinned(store, worktreeId, tabId),
-        tabLabel: resolvePinnedTabLabel(store, worktreeId, tabId),
+        isPinned: isUnifiedTabPinned(store, worktreeId, localTabId),
+        tabLabel: resolvePinnedTabLabel(store, worktreeId, localTabId),
         onClose: () => {
           const currentStore = useAppStore.getState()
-          closeMobileSessionTabInStore(currentStore, worktreeId, tabId)
+          closeMobileSessionTabInStore(currentStore, worktreeId, localTabId)
         }
       })
     })
@@ -43,8 +45,9 @@ export function registerSessionTabIpcBridge(unsubs: (() => void)[]): void {
 
   unsubs.push(
     window.api.ui.onSessionTabCloseRequest(({ requestId, tabId, worktreeId, expiresAt }) => {
+      const localTabId = resolveWindowTabIdForHostTab(worktreeId, tabId)
       const store = useAppStore.getState()
-      const browserTarget = resolveBrowserSessionTabTarget(store, worktreeId, tabId)
+      const browserTarget = resolveBrowserSessionTabTarget(store, worktreeId, localTabId)
       let cancelConfirmation: (() => void) | undefined
       let timeout: ReturnType<typeof setTimeout> | undefined
       let settled = false
@@ -78,7 +81,11 @@ export function registerSessionTabIpcBridge(unsubs: (() => void)[]): void {
             respond()
             return
           }
-          const closed = closeMobileSessionTabInStore(useAppStore.getState(), worktreeId, tabId)
+          const closed = closeMobileSessionTabInStore(
+            useAppStore.getState(),
+            worktreeId,
+            localTabId
+          )
           respond(closed ? undefined : SESSION_TAB_NOT_FOUND_ERROR)
         } catch (error) {
           respond(error instanceof Error ? error.message : SESSION_TAB_CLOSE_FAILED_ERROR)
@@ -92,7 +99,7 @@ export function registerSessionTabIpcBridge(unsubs: (() => void)[]): void {
         )
         return
       }
-      const visibleId = browserTarget?.workspaceId ?? tabId
+      const visibleId = browserTarget?.workspaceId ?? localTabId
       cancelConfirmation = guardPinnedTabClose({
         isPinned: isUnifiedTabPinned(store, worktreeId, visibleId),
         tabLabel: resolvePinnedTabLabel(store, worktreeId, visibleId),
diff --git a/src/renderer/src/hooks/ipc-events/terminal-ui-routing-ipc-bridge.ts b/src/renderer/src/hooks/ipc-events/terminal-ui-routing-ipc-bridge.ts
index 85460c888413..29ddc098726e 100644
--- a/src/renderer/src/hooks/ipc-events/terminal-ui-routing-ipc-bridge.ts
+++ b/src/renderer/src/hooks/ipc-events/terminal-ui-routing-ipc-bridge.ts
@@ -9,6 +9,7 @@ import { activateTabAndFocusPane } from '@/lib/activate-tab-and-focus-pane'
 import { useAppStore } from '../../store'
 import type { AppState } from '../../store/types'
 import { resolveBrowserSessionTabTarget } from './browser-session-tab-target'
+import { resolveWindowTabIdForHostTab } from './host-session-tab-target'
 import {
   activateTerminalInitiatedWorktree,
   focusTerminalInitiatedTab
@@ -146,9 +147,12 @@ export function registerTerminalUiRoutingIpcBridge(unsubs: (() => void)[]): void
 
   unsubs.push(
     window.api.ui.onFocusEditorTab(({ tabId, worktreeId, userInitiated }) => {
+      const localTabId = resolveWindowTabIdForHostTab(worktreeId, tabId)
       const store = useAppStore.getState()
-      const tab = (store.unifiedTabsByWorktree[worktreeId] ?? []).find((item) => item.id === tabId)
-      const browserTarget = resolveBrowserSessionTabTarget(store, worktreeId, tabId)
+      const tab = (store.unifiedTabsByWorktree[worktreeId] ?? []).find(
+        (item) => item.id === localTabId
+      )
+      const browserTarget = resolveBrowserSessionTabTarget(store, worktreeId, localTabId)
       // Why: chat-completion focus is a courtesy reveal, not navigation — never yank the user
       // back into a workspace they deliberately left. A notification click is the opposite: the
       // user asked for this workspace, and the activateWorktree that precedes it is async, so
diff --git a/src/renderer/src/hooks/remote-workspace-session-merge.ts b/src/renderer/src/hooks/remote-workspace-session-merge.ts
index 1932ad30eca2..964c942e0ad8 100644
--- a/src/renderer/src/hooks/remote-workspace-session-merge.ts
+++ b/src/renderer/src/hooks/remote-workspace-session-merge.ts
@@ -33,7 +33,8 @@ export function mergeDirectSshRemoteWorkspaceSession(
   liveTabsByWorktree: AppState['tabsByWorktree'],
   preserveLocalTerminalTabIds: ReadonlySet<string>,
   replaceExecutionHostId?: ExecutionHostId,
-  remoteRevision?: number
+  remoteRevision?: number,
+  preserveLocalLayoutTabIds: ReadonlySet<string> = new Set()
 ): WorkspaceSessionState {
   // Live tabs across the worktrees this snapshot replaces. Close-suppression consults it so a tab
   // that is still live locally always beats its own tombstone.
@@ -243,15 +244,16 @@ export function mergeDirectSshRemoteWorkspaceSession(
         )
       })
     )
+  const preservedLayoutTabIds = new Set([...locallyPreservedTabIds, ...preserveLocalLayoutTabIds])
   const terminalLayoutsByTabId = {
     ...Object.fromEntries(
       Object.entries(current.terminalLayoutsByTabId).filter(
-        ([tabId]) => !replacedTabIds.has(tabId) || locallyPreservedTabIds.has(tabId)
+        ([tabId]) => !replacedTabIds.has(tabId) || preservedLayoutTabIds.has(tabId)
       )
     ),
     ...Object.fromEntries(
       Object.entries(remote.terminalLayoutsByTabId)
-        .filter(([tabId]) => !locallyPreservedTabIds.has(tabId) && !suppressedTabIds.has(tabId))
+        .filter(([tabId]) => !preservedLayoutTabIds.has(tabId) && !suppressedTabIds.has(tabId))
         // Why: this replace is wholesale, and a park capture does not bump tab.generation, so a
         // just-parked tab is not locally preserved and the only client-side copy of its remote
         // scrollback would go with its layout. Structure stays the host's.
diff --git a/src/renderer/src/hooks/remote-workspace-snapshot-apply-deferred-session-write.test.ts b/src/renderer/src/hooks/remote-workspace-snapshot-apply-deferred-session-write.test.ts
index 9b78320a9be0..00b2e8b0c263 100644
--- a/src/renderer/src/hooks/remote-workspace-snapshot-apply-deferred-session-write.test.ts
+++ b/src/renderer/src/hooks/remote-workspace-snapshot-apply-deferred-session-write.test.ts
@@ -9,6 +9,8 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import type * as AgentStatusModule from '@/lib/agent-status'
 import type { RemoteWorkspaceObservedSnapshot } from '../../../shared/remote-workspace-types'
+import { toAppSshPtyId } from '../../../shared/ssh-pty-id'
+import type { TerminalLayoutSnapshot } from '../../../shared/terminal-tab-types'
 import type { DirectSshAuthority, SshProviderEpoch } from '../../../shared/ssh-types'
 import { createTestStore, makeWorktree } from '../store/slices/store-test-helpers'
 import {
@@ -139,11 +141,15 @@ describe('session writes deferred by a direct-SSH apply', () => {
     vi.useRealTimers()
   })
 
-  async function applyTargetA(store: TestStore, onApplied: () => void): Promise<void> {
-    await applyDirectSshRemoteWorkspaceSnapshot({
+  async function applyTargetA(
+    store: TestStore,
+    onApplied: () => void,
+    remote = snapshot(1)
+  ): Promise<void> {
+    const result = await applyDirectSshRemoteWorkspaceSnapshot({
       store,
-      snapshot: snapshot(1),
-      token: token(1),
+      snapshot: remote,
+      token: token(remote.revision),
       arrival: 1,
       isArrivalCurrent: () => true,
       isPreparationTokenCurrent: () => true,
@@ -154,6 +160,7 @@ describe('session writes deferred by a direct-SSH apply', () => {
         return 0
       }
     })
+    expect(result).toBe('applied')
   }
 
   function seedBothTargets(store: TestStore): void {
@@ -214,6 +221,78 @@ describe('session writes deferred by a direct-SSH apply', () => {
     }
   })
 
+  it.each(['missing', 'outdated'] as const)(
+    'preserves a local split awaiting upload when reconnect has a %s layout',
+    async (remoteLayout) => {
+      const store = createTestStore()
+      seedCatalog(store)
+      const first = '11111111-1111-4111-8111-111111111111'
+      const second = '22222222-2222-4222-8222-222222222222'
+      const original: TerminalLayoutSnapshot = {
+        root: { type: 'leaf', leafId: first },
+        activeLeafId: first,
+        expandedLeafId: null,
+        ptyIdsByLeafId: { [first]: 'pty-tab-a' }
+      }
+      const initial = snapshot(1)
+      initial.session.terminalLayoutsByTabId = { 'tab-a': original }
+      const persist = vi.fn<(payload: WorkspaceSessionWrite) => void>()
+      const cleanup = createSessionWriteSubscriber({
+        store,
+        persist,
+        shouldSchedulePersist: () => !isDirectSshRemoteWorkspaceApplyInProgress(),
+        subscribeToPersistGateOpen: onDirectSshRemoteWorkspaceApplyWindowClosed
+      })
+      try {
+        store.setState({ workspaceSessionReady: true, hydrationSucceeded: true })
+        await applyTargetA(store, () => {}, initial)
+        store.getState().updateTabPtyId('tab-a', toAppSshPtyId(TARGET_A, 'pty-tab-a'))
+        vi.advanceTimersByTime(1_200)
+        persist.mockClear()
+        const generation = store.getState().tabsByWorktree[WORKTREE_A][0].generation
+        const split: TerminalLayoutSnapshot = {
+          ...original,
+          root: {
+            type: 'split',
+            direction: 'vertical',
+            first: { type: 'leaf', leafId: first },
+            second: { type: 'leaf', leafId: second }
+          },
+          activeLeafId: second,
+          ptyIdsByLeafId: {
+            [first]: toAppSshPtyId(TARGET_A, 'pty-tab-a'),
+            [second]: toAppSshPtyId(TARGET_A, 'pty-split')
+          }
+        }
+        store.getState().setTabLayout('tab-a', split)
+        expect(store.getState().tabsByWorktree[WORKTREE_A][0].generation).toBe(generation)
+        expect(persist).not.toHaveBeenCalled()
+
+        store.getState().clearDirectSshTargetPtyBindings(TARGET_A)
+        expect(store.getState().directSshPaneRetryByTabId).toEqual({})
+        expect(store.getState().directSshLivePtyBindingByTabId).toEqual({})
+        expect(store.getState().tabsByWorktree[WORKTREE_A][0].pendingActivationSpawn).toBeFalsy()
+        const stale = snapshot(1)
+        stale.session.tabsByWorktreePath[PATH_A][0].generation = generation
+        if (remoteLayout === 'outdated') {
+          stale.session.terminalLayoutsByTabId = { 'tab-a': original }
+        }
+        await applyTargetA(store, () => {}, stale)
+        vi.advanceTimersByTime(1_200)
+
+        const restored = store.getState().terminalLayoutsByTabId['tab-a']
+        expect(restored?.root).toEqual(split.root)
+        expect(restored?.ptyIdsByLeafId).toEqual(split.ptyIdsByLeafId)
+        expect(persist).toHaveBeenCalledTimes(1)
+        expect(persist.mock.calls[0][0].patch.terminalLayoutsByTabId?.['tab-a']?.root).toEqual(
+          split.root
+        )
+      } finally {
+        cleanup()
+      }
+    }
+  )
+
   it('still wakes the deferred write when the wall clock steps back during the tail', async () => {
     const store = createTestStore()
     seedBothTargets(store)
diff --git a/src/renderer/src/hooks/remote-workspace-snapshot-apply.ts b/src/renderer/src/hooks/remote-workspace-snapshot-apply.ts
index af2e845ab512..e304ff175972 100644
--- a/src/renderer/src/hooks/remote-workspace-snapshot-apply.ts
+++ b/src/renderer/src/hooks/remote-workspace-snapshot-apply.ts
@@ -182,7 +182,17 @@ export async function applyDirectSshRemoteWorkspaceSnapshot({
     state.tabsByWorktree,
     currentRecoveryTabIds(state, authority, worktreeIds),
     toSshExecutionHostId(authority.targetId),
-    snapshot.revision
+    snapshot.revision,
+    new Set(
+      [...worktreeIds].flatMap((id) =>
+        (state.tabsByWorktree[id] ?? [])
+          .filter(
+            (tab) =>
+              state.pendingDirectSshLayoutEditsByTabId[tab.id]?.targetId === authority.targetId
+          )
+          .map((tab) => tab.id)
+      )
+    )
   )
   if (!isArrivalCurrent(authority.targetId, arrival) || !isPreparationTokenCurrent(token)) {
     return 'stale'
diff --git a/src/renderer/src/hooks/remote-workspace-target-sync.test.ts b/src/renderer/src/hooks/remote-workspace-target-sync.test.ts
index 7d9f662ffe0a..65f7d2c02041 100644
--- a/src/renderer/src/hooks/remote-workspace-target-sync.test.ts
+++ b/src/renderer/src/hooks/remote-workspace-target-sync.test.ts
@@ -45,6 +45,34 @@ describe('createRemoteWorkspaceTargetSync', () => {
     )
   })
 
+  it('acknowledges the captured blank-host edit when a newer null-root edit arrives', async () => {
+    const firstEdit = { targetId: 'target-a', root: null }
+    const newerEdit = { targetId: 'target-a', root: null }
+    const acknowledgeDirectSshLayoutEdits = vi.fn()
+    const state = appState({
+      tabsByWorktree: {
+        'repo-a::/remote/work': [{ id: 'tab-a', worktreeId: 'repo-a::/remote/work', ptyId: null }]
+      },
+      pendingDirectSshLayoutEditsByTabId: { 'tab-a': firstEdit },
+      acknowledgeDirectSshLayoutEdits
+    })
+    const harness = createHarness(state, async () => snapshot(0))
+    const uploaded = snapshot(1)
+    uploaded.session.terminalLayoutsByTabId = {
+      'tab-a': { root: null, activeLeafId: null, expandedLeafId: null }
+    }
+    harness.setForConnectedTargets.mockImplementationOnce(async () => {
+      state.pendingDirectSshLayoutEditsByTabId = { 'tab-a': newerEdit }
+      return [{ targetId: owner.targetId, result: { ok: true, snapshot: uploaded } }]
+    })
+
+    await harness.sync.syncAfterConnect(token())
+
+    const acknowledged = acknowledgeDirectSshLayoutEdits.mock.calls[0]?.[0]?.['tab-a']
+    expect(acknowledged).toBe(firstEdit)
+    expect(state.pendingDirectSshLayoutEditsByTabId['tab-a']).toBe(newerEdit)
+  })
+
   it.each([
     ['stale-revision', 'Workspace changed on another device'],
     ['unavailable', 'Remote workspace sync unavailable']
diff --git a/src/renderer/src/hooks/remote-workspace-target-sync.ts b/src/renderer/src/hooks/remote-workspace-target-sync.ts
index c3d99224dbca..05d027ece2e7 100644
--- a/src/renderer/src/hooks/remote-workspace-target-sync.ts
+++ b/src/renderer/src/hooks/remote-workspace-target-sync.ts
@@ -12,6 +12,7 @@ import { applyDirectSshRemoteWorkspaceSnapshot } from './remote-workspace-snapsh
 import { createRemoteWorkspaceSnapshotArrivalCoordinator } from './remote-workspace-snapshot-arrival-coordinator'
 import { createDeferredSnapshotPlacementRetries } from './remote-workspace-deferred-placement-retry'
 import { applyRemoteWorkspacePushStatus } from './remote-workspace-push-status'
+import { terminalLayoutNodeEqual } from '../lib/terminal-layout-equality'
 import { waitForRemoteWorkspaceSessionReady } from './remote-workspace-session-readiness'
 import type {
   RemoteWorkspaceTargetSync,
@@ -191,6 +192,7 @@ export function createRemoteWorkspaceTargetSync(
     if (!isArrivalCurrent(authority.targetId, arrival) || !deps.isPreparationTokenCurrent(token)) {
       return
     }
+    const pendingLayoutEdits = deps.store.getState().pendingDirectSshLayoutEditsByTabId
     const results = await deps.remoteWorkspace.setForConnectedTargets({
       session: buildWorkspaceSessionPayload(deps.store.getState()),
       hydratedTargetIds: [authority.targetId],
@@ -203,6 +205,21 @@ export function createRemoteWorkspaceTargetSync(
       return
     }
     const result = results.find((entry) => entry.targetId === authority.targetId)?.result
+    if (result?.ok) {
+      const currentState = deps.store.getState()
+      currentState.acknowledgeDirectSshLayoutEdits(
+        Object.fromEntries(
+          Object.entries(pendingLayoutEdits ?? {}).flatMap(([tabId, entry]) => {
+            const uploaded = result.snapshot.session.terminalLayoutsByTabId[tabId]
+            return entry.targetId === authority.targetId &&
+              uploaded &&
+              terminalLayoutNodeEqual(entry.root, uploaded.root)
+              ? [[tabId, entry]]
+              : []
+          })
+        )
+      )
+    }
     applyRemoteWorkspacePushStatus(deps.store.getState(), authority.targetId, result, snapshot)
   }
 
diff --git a/src/renderer/src/hooks/runtime-client-events-sync-ownership.test.ts b/src/renderer/src/hooks/runtime-client-events-sync-ownership.test.ts
new file mode 100644
index 000000000000..8383c8637811
--- /dev/null
+++ b/src/renderer/src/hooks/runtime-client-events-sync-ownership.test.ts
@@ -0,0 +1,297 @@
+import { describe, expect, it, vi } from 'vitest'
+import type { RuntimeClientEvent } from '../../../shared/runtime-client-events'
+import {
+  createRuntimeClientEventsSync,
+  type RuntimeClientEventSubscriptionHandle
+} from './runtime-client-events-sync'
+
+function makeHarness() {
+  let desired = ['A', 'B']
+  let key = 'A:1'
+  const records: {
+    environmentId: string
+    emit: () => void
+    resolve: () => void
+    reject: () => void
+    unsubscribe: ReturnType<typeof vi.fn>
+  }[] = []
+  const onEvent = vi.fn()
+  const manager = createRuntimeClientEventsSync({
+    getDesiredEnvironmentIds: () => desired,
+    getSubscriptionKey: (id) => (id === 'A' ? key : id),
+    subscribe: (environmentId, notify) => {
+      const pending = Promise.withResolvers<RuntimeClientEventSubscriptionHandle>()
+      const unsubscribe = vi.fn()
+      const event: RuntimeClientEvent = { type: 'reposChanged' }
+      records.push({
+        environmentId,
+        emit: () => notify(event),
+        resolve: () => pending.resolve({ unsubscribe }),
+        reject: () => pending.reject(new Error('setup failed')),
+        unsubscribe
+      })
+      notify(event)
+      return pending.promise
+    },
+    onEvent
+  })
+  return {
+    manager,
+    onEvent,
+    records,
+    setDesired: (next: string[]) => {
+      desired = next
+    },
+    rekey: () => {
+      key = 'A:2'
+    }
+  }
+}
+
+async function settle(): Promise<void> {
+  for (let index = 0; index < 4; index += 1) {
+    await Promise.resolve()
+  }
+}
+
+describe('runtime event subscription ownership', () => {
+  it.each([{ desired: ['A'] }, { desired: ['A', 'B'] }])(
+    'keeps the nested desired set after an initial frame replaces $desired',
+    async ({ desired }) => {
+      const h = makeHarness()
+      h.setDesired(desired)
+      h.onEvent.mockImplementation((id: string) => {
+        if (id === 'A') {
+          h.setDesired(['C'])
+          h.manager.sync()
+        }
+      })
+      h.manager.sync()
+      expect(h.records.map(({ environmentId }) => environmentId)).toEqual(['A', 'C'])
+      h.onEvent.mockClear()
+      h.records.forEach((record) => record.emit())
+      expect(h.onEvent.mock.calls.map(([id]) => id)).toEqual(['C'])
+      h.records.forEach((record) => record.resolve())
+      await settle()
+      expect(h.records[0].unsubscribe).toHaveBeenCalledOnce()
+      expect(h.records[1].unsubscribe).not.toHaveBeenCalled()
+      h.manager.sync()
+      expect(h.records).toHaveLength(2)
+      h.manager.stop()
+      expect(h.records[1].unsubscribe).toHaveBeenCalledOnce()
+    }
+  )
+
+  it('keeps a retained owner when unsubscribe replaces an outer empty desired set', async () => {
+    const h = makeHarness()
+    h.manager.sync()
+    h.records.forEach((record) => record.resolve())
+    await settle()
+    h.records[0].unsubscribe.mockImplementation(() => {
+      h.setDesired(['B', 'C'])
+      h.manager.sync()
+    })
+    h.setDesired([])
+    h.manager.sync()
+    expect(h.records[0].unsubscribe).toHaveBeenCalledOnce()
+    expect(h.records[1].unsubscribe).not.toHaveBeenCalled()
+    h.onEvent.mockClear()
+    h.records.forEach((record) => record.emit())
+    expect(h.onEvent.mock.calls.map(([id]) => id)).toEqual(['B', 'C'])
+    h.records[2].resolve()
+    await settle()
+    expect(h.records[2].unsubscribe).not.toHaveBeenCalled()
+    h.manager.stop()
+    h.records.forEach((record) => expect(record.unsubscribe).toHaveBeenCalledOnce())
+  })
+
+  it('detaches stopped subscriptions before unsubscribe starts a new owner', async () => {
+    const h = makeHarness()
+    h.manager.sync()
+    h.records.forEach((record) => record.resolve())
+    await settle()
+    h.records[0].unsubscribe.mockImplementation(() => {
+      h.setDesired(['C'])
+      h.manager.sync()
+    })
+    h.manager.stop()
+    expect(h.records[0].unsubscribe).toHaveBeenCalledOnce()
+    expect(h.records[1].unsubscribe).toHaveBeenCalledOnce()
+    h.onEvent.mockClear()
+    h.records.forEach((record) => record.emit())
+    expect(h.onEvent.mock.calls.map(([id]) => id)).toEqual(['C'])
+    h.records[2].resolve()
+    await settle()
+    expect(h.records[2].unsubscribe).not.toHaveBeenCalled()
+    h.manager.stop()
+    expect(h.records[2].unsubscribe).toHaveBeenCalledOnce()
+  })
+
+  it('preserves a new owner started synchronously by the last initial frame', async () => {
+    let desired = ['A']
+    const records: {
+      emit: () => void
+      setup: ReturnType<typeof Promise.withResolvers<RuntimeClientEventSubscriptionHandle>>
+      unsubscribe: ReturnType<typeof vi.fn<() => void>>
+    }[] = []
+    const onEvent = vi.fn((id: string) => {
+      if (id === 'A') {
+        manager.stop()
+        desired = ['B']
+        manager.sync()
+      }
+    })
+    const manager = createRuntimeClientEventsSync({
+      getDesiredEnvironmentIds: () => desired,
+      subscribe: (_id, notify) => {
+        const setup = Promise.withResolvers<RuntimeClientEventSubscriptionHandle>()
+        const unsubscribe = vi.fn()
+        const emit = (): void => notify({ type: 'reposChanged' })
+        records.push({ emit, setup, unsubscribe })
+        emit()
+        return setup.promise
+      },
+      onEvent
+    })
+    manager.sync()
+    onEvent.mockClear()
+    records[0].emit()
+    records[1].emit()
+    expect(onEvent.mock.calls.map(([id]) => id)).toEqual(['B'])
+    records.forEach(({ setup, unsubscribe }) => setup.resolve({ unsubscribe }))
+    await settle()
+    expect(records[0].unsubscribe).toHaveBeenCalledOnce()
+    expect(records[1].unsubscribe).not.toHaveBeenCalled()
+    manager.stop()
+  })
+
+  it('stops starting further subscriptions when an initial frame synchronously stops the owner', async () => {
+    const pending = Promise.withResolvers<RuntimeClientEventSubscriptionHandle>()
+    const unsubscribe = vi.fn()
+    const subscribe = vi.fn((_id: string, notify: (event: RuntimeClientEvent) => void) => {
+      notify({ type: 'reposChanged' })
+      return pending.promise
+    })
+    const manager = createRuntimeClientEventsSync({
+      getDesiredEnvironmentIds: () => ['A', 'B'],
+      subscribe,
+      onEvent: () => manager.stop()
+    })
+    manager.sync()
+    expect(subscribe).toHaveBeenCalledOnce()
+    pending.resolve({ unsubscribe })
+    await settle()
+    expect(unsubscribe).toHaveBeenCalledOnce()
+  })
+
+  it('admits synchronous initial frames, pending frames and settled live frames', async () => {
+    const h = makeHarness()
+    h.manager.sync()
+    expect(h.onEvent).toHaveBeenCalledTimes(2)
+    h.records[0].emit()
+    h.records[0].resolve()
+    await settle()
+    h.records[0].emit()
+    expect(h.onEvent).toHaveBeenCalledTimes(4)
+    h.manager.stop()
+  })
+
+  it('drops pending and settled callbacks after stop and releases the late handle', async () => {
+    const h = makeHarness()
+    h.manager.sync()
+    h.records[1].resolve()
+    await settle()
+    h.manager.stop()
+    h.onEvent.mockClear()
+    h.records.forEach((record) => record.emit())
+    expect(h.onEvent).not.toHaveBeenCalled()
+    h.records[0].resolve()
+    await settle()
+    h.records.forEach((record) => expect(record.unsubscribe).toHaveBeenCalledOnce())
+  })
+
+  it.each([false, true])(
+    'drops a replaced owner while another host stays live (settled=%s)',
+    async (settled) => {
+      const h = makeHarness()
+      h.manager.sync()
+      h.records[1].resolve()
+      if (settled) {
+        h.records[0].resolve()
+      }
+      await settle()
+      h.setDesired(['B'])
+      h.manager.sync()
+      h.setDesired(['A', 'B'])
+      h.manager.sync()
+      h.onEvent.mockClear()
+      h.records[0].emit()
+      h.records[1].emit()
+      h.records[2].emit()
+      expect(h.onEvent.mock.calls.map(([id]) => id)).toEqual(['B', 'A'])
+      h.records[0].resolve()
+      h.records[2].resolve()
+      await settle()
+      expect(h.records[0].unsubscribe).toHaveBeenCalledOnce()
+      expect(h.records[2].unsubscribe).not.toHaveBeenCalled()
+      h.manager.stop()
+    }
+  )
+
+  it('rejects callbacks from the old key and admits its replacement before setup completes', async () => {
+    const h = makeHarness()
+    h.manager.sync()
+    h.rekey()
+    h.manager.sync()
+    h.onEvent.mockClear()
+    h.records[0].emit()
+    h.records[2].emit()
+    expect(h.onEvent).toHaveBeenCalledTimes(1)
+    h.records[0].resolve()
+    h.records[2].resolve()
+    await settle()
+    expect(h.records[0].unsubscribe).toHaveBeenCalledOnce()
+    h.manager.stop()
+  })
+
+  it('permits restarting after stop without reviving the old callback', () => {
+    const h = makeHarness()
+    h.manager.sync()
+    h.manager.stop()
+    h.manager.sync()
+    h.onEvent.mockClear()
+    h.records[0].emit()
+    h.records[2].emit()
+    expect(h.onEvent).toHaveBeenCalledTimes(1)
+    h.manager.stop()
+  })
+
+  it('drops callbacks from a rejected setup while retry is waiting', async () => {
+    const h = makeHarness()
+    const warning = vi.spyOn(console, 'warn').mockImplementation(() => {})
+    try {
+      h.manager.sync()
+      h.records[0].reject()
+      await settle()
+      h.onEvent.mockClear()
+      h.records[0].emit()
+      expect(h.onEvent).not.toHaveBeenCalled()
+    } finally {
+      h.manager.stop()
+      warning.mockRestore()
+    }
+  })
+
+  it('revokes an owner before its unsubscribe callback can reenter delivery', async () => {
+    const h = makeHarness()
+    h.manager.sync()
+    h.records[0].resolve()
+    await settle()
+    h.records[0].unsubscribe.mockImplementation(h.records[0].emit)
+    h.onEvent.mockClear()
+    h.setDesired(['B'])
+    h.manager.sync()
+    expect(h.onEvent).not.toHaveBeenCalled()
+    h.manager.stop()
+  })
+})
diff --git a/src/renderer/src/hooks/runtime-client-events-sync.ts b/src/renderer/src/hooks/runtime-client-events-sync.ts
index 6388c35e3aca..ae44fe789071 100644
--- a/src/renderer/src/hooks/runtime-client-events-sync.ts
+++ b/src/renderer/src/hooks/runtime-client-events-sync.ts
@@ -13,7 +13,9 @@ export type RuntimeClientEventsSyncDeps = {
   subscribe: (
     environmentId: string,
     onEvent: (event: RuntimeClientEvent) => void,
-    onError: (error: unknown) => void
+    onError: (error: unknown) => void,
+    /** Use for subscription-side recovery that runs before event delivery. */
+    isCurrent: () => boolean
   ) => Promise<RuntimeClientEventSubscriptionHandle>
   onEvent: (environmentId: string, event: RuntimeClientEvent) => void
   /** Base retry delay; doubles per consecutive failure up to retryMaxDelayMs. */
@@ -49,8 +51,12 @@ export type RuntimeClientEventsSync = {
 export function createRuntimeClientEventsSync(
   deps: RuntimeClientEventsSyncDeps
 ): RuntimeClientEventsSync {
-  const subscriptions = new Map<string, { key: string; unsubscribe: () => void }>()
-  const pending = new Map<string, { key: string; generation: number }>()
+  type SubscriptionToken = { key: string; generation: number }
+  const subscriptions = new Map<
+    string,
+    { key: string; token: SubscriptionToken; unsubscribe: () => void }
+  >()
+  const pending = new Map<string, SubscriptionToken>()
   const retryTimers = new Map<string, ReturnType<typeof setTimeout>>()
   const consecutiveFailures = new Map<string, { key: string; count: number }>()
   const retryDelayMs = deps.retryDelayMs ?? 1_000
@@ -58,6 +64,7 @@ export function createRuntimeClientEventsSync(
   const random = deps.random ?? Math.random
   const getSubscriptionKey = deps.getSubscriptionKey ?? ((environmentId: string) => environmentId)
   let generation = 0
+  let syncInvocation = 0
 
   const clearRetryTimer = (environmentId: string): void => {
     const retryTimer = retryTimers.get(environmentId)
@@ -109,9 +116,7 @@ export function createRuntimeClientEventsSync(
 
   const stop = (): void => {
     generation += 1
-    for (const subscription of subscriptions.values()) {
-      subscription.unsubscribe()
-    }
+    const stoppedSubscriptions = [...subscriptions.values()]
     subscriptions.clear()
     pending.clear()
     for (const retryTimer of retryTimers.values()) {
@@ -119,9 +124,14 @@ export function createRuntimeClientEventsSync(
     }
     retryTimers.clear()
     consecutiveFailures.clear()
+    for (const subscription of stoppedSubscriptions) {
+      subscription.unsubscribe()
+    }
   }
 
   const sync = (): void => {
+    const syncGeneration = generation
+    const currentSyncInvocation = ++syncInvocation
     const desiredIds = new Set(deps.getDesiredEnvironmentIds())
     for (const environmentId of retryTimers.keys()) {
       if (desiredIds.has(environmentId)) {
@@ -136,14 +146,20 @@ export function createRuntimeClientEventsSync(
     }
 
     for (const [environmentId, subscription] of subscriptions) {
+      if (syncGeneration !== generation || currentSyncInvocation !== syncInvocation) {
+        return
+      }
       if (desiredIds.has(environmentId) && subscription.key === getSubscriptionKey(environmentId)) {
         continue
       }
-      subscription.unsubscribe()
       subscriptions.delete(environmentId)
+      subscription.unsubscribe()
     }
 
     for (const environmentId of desiredIds) {
+      if (syncGeneration !== generation || currentSyncInvocation !== syncInvocation) {
+        return
+      }
       const subscriptionKey = getSubscriptionKey(environmentId)
       const pendingSubscription = pending.get(environmentId)
       if (pendingSubscription && pendingSubscription.key !== subscriptionKey) {
@@ -159,13 +175,23 @@ export function createRuntimeClientEventsSync(
       const subscribeGeneration = generation
       const pendingSubscriptionToken = { key: subscriptionKey, generation: subscribeGeneration }
       pending.set(environmentId, pendingSubscriptionToken)
+      const isCurrent = (): boolean =>
+        subscribeGeneration === generation &&
+        (pending.get(environmentId) === pendingSubscriptionToken ||
+          subscriptions.get(environmentId)?.token === pendingSubscriptionToken)
       void deps
         .subscribe(
           environmentId,
-          (event) => deps.onEvent(environmentId, event),
+          (event) => {
+            // Initial frames arrive before setup settles; only the owning attempt may deliver.
+            if (isCurrent()) {
+              deps.onEvent(environmentId, event)
+            }
+          },
           (error) => {
             console.warn('[runtime-client-events] subscription error:', error)
-          }
+          },
+          isCurrent
         )
         .then((subscription) => {
           const isCurrentPending = pending.get(environmentId) === pendingSubscriptionToken
@@ -192,6 +218,7 @@ export function createRuntimeClientEventsSync(
           consecutiveFailures.delete(environmentId)
           subscriptions.set(environmentId, {
             key: subscriptionKey,
+            token: pendingSubscriptionToken,
             unsubscribe: subscription.unsubscribe
           })
         })
@@ -224,6 +251,9 @@ export function createRuntimeClientEventsSync(
         })
     }
 
+    if (syncGeneration !== generation || currentSyncInvocation !== syncInvocation) {
+      return
+    }
     for (const [environmentId, pendingSubscription] of pending) {
       if (
         desiredIds.has(environmentId) &&
diff --git a/src/renderer/src/hooks/useIpcEvents-close-routing-session-tabs.test.ts b/src/renderer/src/hooks/useIpcEvents-close-routing-session-tabs.test.ts
index 5240ea803f7a..e22c6b41e0f9 100644
--- a/src/renderer/src/hooks/useIpcEvents-close-routing-session-tabs.test.ts
+++ b/src/renderer/src/hooks/useIpcEvents-close-routing-session-tabs.test.ts
@@ -92,7 +92,7 @@ describe('useIpcEvents browser tab close routing', () => {
       getState: () => ({})
     })
 
-    closeTerminalListenerRef.current?.({ tabId: 'terminal-1' })
+    closeTerminalListenerRef.current?.({ kind: 'tab', tabId: 'terminal-1' })
 
     // The CLI/RPC caller is answered immediately, so this close must never raise a modal.
     expect(closeTerminalTabMock).toHaveBeenCalledWith('terminal-1', {
diff --git a/src/renderer/src/i18n/en-runtime-required.json b/src/renderer/src/i18n/en-runtime-required.json
index cf74ae8c0115..dbfcdeacfe81 100644
--- a/src/renderer/src/i18n/en-runtime-required.json
+++ b/src/renderer/src/i18n/en-runtime-required.json
@@ -2464,6 +2464,10 @@
           "MobileDriverOverlay": {
             "3eed73394f": "Your keyboard is paused"
           },
+          "TerminalErrorToast": {
+            "ptyAllocationLimit": "Your system cannot allocate any more pty devices. Close some terminals you are not using, in Orca or another program, then try again.",
+            "terminalProcessLimit": "Your system cannot start another terminal process. Close unused terminals or quit unused processes, then try again."
+          },
           "TerminalRemoteRuntimeReconnectBanner": {
             "retryingBody": "Orca will retry for up to one minute. This terminal will resume if the connection returns."
           },
@@ -2672,6 +2676,7 @@
           "title": "Start a chat with {{value0}}"
         },
         "error": {
+          "retryingSubtitle": "The transcript could not be read. Orca keeps trying to load it.",
           "subtitle": "The transcript could not be read. Toggle back to the terminal to keep working.",
           "title": "Could not load conversation"
         },
@@ -2708,6 +2713,56 @@
         "runningPreview": "Running {{preview}}",
         "usedManySummary": "Used {{toolCount}} tools",
         "usedOneSummary": "Used 1 tool"
+      },
+      "writeNotice": {
+        "agentRefused": "The agent turned this down.",
+        "agentStarting": "The agent is still starting.",
+        "answerFirst": "Answer the question or approval first.",
+        "backgroundTasksRunning": "Background tasks are still running.",
+        "capacity": "Orca has received too many requests in the last day.",
+        "chatNotFound": "The Orca running this chat has no record of it.",
+        "clearUnfinished": "The last /clear didn't finish.",
+        "commandRunning": "A /compact or /clear is still running.",
+        "conversationCleared": "This conversation has been cleared.",
+        "goalsUnsupported": "This agent doesn't support goals.",
+        "historyUnavailable": "Orca couldn't open this chat's history right now.",
+        "historyUnreadable": "Orca couldn't read this chat's saved history.",
+        "historyUnusable": "Unable to load this chat.",
+        "hostReconciling": "Orca is still checking on this chat after restarting.",
+        "messagesUnsettled": "A message you sent earlier hasn't been confirmed yet.",
+        "notDoneAnswer": "Your answer was not sent.",
+        "notDoneCommand": "The command didn't run.",
+        "notDoneGoal": "The goal wasn't changed.",
+        "notDoneOption": "The setting wasn't changed.",
+        "notDoneReadHistory": "This chat's history couldn't be loaded.",
+        "notDoneSend": "Your message was not sent.",
+        "notDoneStop": "The agent wasn't stopped.",
+        "notDoneStopTask": "The background task wasn't stopped.",
+        "notDoneStopTasks": "The background tasks weren't stopped.",
+        "openCurrentConversation": "Open the current conversation to continue.",
+        "optionRejected": "The agent didn't accept this setting.",
+        "outcomeUnknown": "Orca couldn't confirm what happened. Check the chat.",
+        "ownerUnproven": "Orca hasn't confirmed that this chat's previous agent stopped.",
+        "promptPending": "The agent is waiting for an answer to a question or approval.",
+        "questionChanged": "This question was already answered or has changed.",
+        "quitTerminalAgent": "Quit that agent to continue the chat here.",
+        "recordFailed": "Orca couldn't record it in this chat's history.",
+        "recordUnreadable": "Orca couldn't read this chat's saved state.",
+        "reopenChat": "Reopen the chat to check again.",
+        "restartFailed": "The agent couldn't restart.",
+        "settleEarlierMessage": "Wait for your earlier message to go through, or retry it.",
+        "startNewChat": "Start a new chat to continue.",
+        "terminalAgentHoldsChat": "This chat is still open in a terminal agent.",
+        "tryAgain": "Try again.",
+        "tryAgainComposerSend": "Send it again.",
+        "turnActive": "The agent is still responding.",
+        "unreachable": "Orca couldn't reach the agent.",
+        "unsupported": "The Orca running this chat doesn't support this. Update Orca, then try again.",
+        "waitForBackgroundTasks": "Wait for the background tasks to finish.",
+        "waitForCommand": "Wait for the /compact or /clear to finish.",
+        "waitForStart": "Wait for the agent to finish starting.",
+        "waitForTurn": "Wait for the agent to finish responding, or stop it.",
+        "waitMoment": "Wait a moment."
       }
     },
     "onboarding": {
diff --git a/src/renderer/src/i18n/locales/en.json b/src/renderer/src/i18n/locales/en.json
index 2708b70fbaa7..1590e0e1ca55 100644
--- a/src/renderer/src/i18n/locales/en.json
+++ b/src/renderer/src/i18n/locales/en.json
@@ -150,7 +150,9 @@
         "resourceUsageToggleDescription": "Show the Resource Manager. Click it for CPU, memory, sessions, daemon controls, and workspace disk scans.",
         "portsToggleDescription": "Show live workspace ports. Click it for workspace-scoped ports and external listeners.",
         "antigravityToggleDescription": "Show Antigravity subscription usage for the active workspace.",
-        "grokToggleDescription": "Show Grok subscription credit usage when signed in via Grok CLI."
+        "grokToggleDescription": "Show Grok subscription credit usage when signed in via Grok CLI.",
+        "cursorToggleDescription": "Show Cursor plan usage when signed in through cursor-agent or Cursor IDE.",
+        "zcodeToggleDescription": "Show ZCode Coding Plan quota usage."
       },
       "menuBarIcon": {
         "title": "Show Menu Bar Icon",
@@ -584,6 +586,7 @@
           "9e2a9bb87b": "Continue",
           "6f8056a565": "Command Code",
           "4238b771b5": "Codebuff",
+          "freebuff_label": "Freebuff",
           "cbaf0c2e0b": "Cline",
           "1f8a19e9ad": "Autohand Code",
           "5e8eff11b3": "Auggie",
@@ -608,6 +611,8 @@
           "da41abbdd4": "Ante",
           "060d152fb5": "Trae",
           "muse_label": "Muse",
+          "dsh_label": "DeepSeek Harness",
+          "qoder_label": "Qoder CLI",
           "zcode_label": "ZCode",
           "d443a47995": "Prime Agent",
           "mimo_code_label": "MiMo Code",
@@ -3223,7 +3228,9 @@
             "e16012e31e": "The terminal daemon that owned this session exited, so the session and its scrollback could not be recovered. Open a new terminal to continue.",
             "sessionUnavailable": "Orca couldn't reattach to this pane's terminal session on the host. Open a new terminal to continue.",
             "sourceRestoring": "Reconnecting this terminal — its output is being re-established. The session is still running.",
-            "remoteTerminalClosed": "Remote terminal was closed."
+            "remoteTerminalClosed": "Remote terminal was closed.",
+            "ptyAllocationLimit": "Your system cannot allocate any more pty devices. Close some terminals you are not using, in Orca or another program, then try again.",
+            "terminalProcessLimit": "Your system cannot start another terminal process. Close unused terminals or quit unused processes, then try again."
           },
           "TerminalProcessExitOverlay": {
             "capacityTitle": "Git Bash console limit reached",
@@ -3396,6 +3403,9 @@
           "TerminalQuickCommandsSubmenu": {
             "3ccc7981bb": "Host unavailable",
             "54f29b7c0d": "Loading host…"
+          },
+          "TerminalRestoringPlaceholder": {
+            "restoring": "Restoring terminal…"
           }
         }
       },
@@ -3815,7 +3825,10 @@
             "grokUsageMenu": "Grok Usage",
             "floatingTerminalNewActivity": "{{label}}, new activity",
             "codexSignInSuccess": "Signed in to Codex",
-            "codexSignInError": "Codex sign-in failed. Please try again."
+            "codexSignInError": "Codex sign-in failed. Please try again.",
+            "cursorUsageMenu": "Cursor Usage",
+            "hiddenUsageProviders": "Also: {{value0}}",
+            "zcodeUsageMenu": "ZCode Usage"
           },
           "StatusBarUsageEmptyCta": {
             "828c764a79": "Connect an account",
@@ -3962,6 +3975,7 @@
             }
           },
           "tooltip": {
+            "zcode": { "mcp": "MCP" },
             "cedb7b99e3": "% used",
             "6d6df77f41": "No data available",
             "7f7f208060": "Monthly",
@@ -4006,6 +4020,13 @@
               "noSubscription": {
                 "label": "No subscription"
               }
+            },
+            "cursor": {
+              "expired": {
+                "label": "Sign-in expired",
+                "message": "Run cursor-agent login in a terminal on the computer running Orca, then retry usage."
+              },
+              "plan": "Plan"
             }
           },
           "SshTargetStatusRow": {
@@ -9103,7 +9124,18 @@
             "b2c4e7f1a8": "endpoint",
             "3a9b6d2c4e": "api key",
             "5d8f1a3b7c": "china",
-            "7e2a4b8c1d": "overseas"
+            "7e2a4b8c1d": "overseas",
+            "cursor": {
+              "title": "Cursor Usage",
+              "description": "Monthly plan usage read from the Cursor sign-in already on this computer (cursor-agent login).",
+              "kw": {
+                "cursor": "cursor",
+                "usage": "usage",
+                "spend": "spend",
+                "rateLimit": "rate limit",
+                "statusBar": "status bar"
+              }
+            }
           }
         },
         "advanced": {
@@ -9352,6 +9384,11 @@
             "c5b9f8d1e3": "xai",
             "usagePercentageDisplayTitle": "Usage percentages",
             "usagePercentageDisplayDescription": "Choose whether provider limits show the percentage used or remaining.",
+            "zcodeUsageTitle": "ZCode Usage",
+            "zcodeUsageDescription": "Show ZCode Coding Plan quota usage in the status bar.",
+            "zcode": "zcode",
+            "zai": "zai",
+            "glm": "glm",
             "tray": {
               "tray": "tray",
               "system": "system tray",
@@ -9359,6 +9396,13 @@
               "close": "close",
               "notification": "notification area",
               "background": "background"
+            },
+            "cursor": {
+              "title": "Cursor Usage",
+              "description": "Show monthly Cursor plan usage from the Cursor sign-in on this computer.",
+              "kw": {
+                "cursor": "cursor"
+              }
             }
           }
         },
@@ -12178,6 +12222,31 @@
         "settingsProjectList": {
           "removeOwnerUnverifiable": "Could not reach the host that owns this project",
           "removeOwnerUnverifiableDescription": "Orca could not confirm the removal with {{host}}. Reconnect that host and try again, or remove the project from the sidebar to clear this computer’s records only."
+        },
+        "CursorAccountsSection": {
+          "source": {
+            "keychain": "macOS Keychain (cursor-agent)",
+            "cli": "Cursor CLI auth file",
+            "desktop": "Cursor IDE"
+          },
+          "title": "Cursor",
+          "subtitle": "Shows your monthly Cursor plan usage from the sign-in already on this computer. Orca only reads it — it never changes your Cursor login.",
+          "dashboardLink": "Cursor dashboard",
+          "loading": "Loading…",
+          "signedIn": "Signed in",
+          "signedInFrom": "Signed in. Orca reads the session stored in {{source}}.",
+          "signedInGeneric": "Signed in. Orca reads the Cursor session stored on this computer.",
+          "expired": "Sign-in expired — run cursor-agent login on the computer running Orca, then click Refresh usage.",
+          "signedOut": "No Cursor sign-in found on this computer",
+          "signedOutHelp": "Sign in with Cursor IDE, or run cursor-agent login in a terminal, then click Refresh usage here.",
+          "refreshUsage": "Refresh usage",
+          "usageTitle": "Monthly plan usage",
+          "usageDescription": "Cursor bills two pools that reset with your billing cycle, plus on-demand spend once they run out.",
+          "planTotal": "Plan",
+          "resets": "Resets {{when}}",
+          "usageLabel": "Usage",
+          "noAllowance": "Cursor reported no usage allowance for this account.",
+          "staleUsage": "Last known usage — the latest refresh failed: {{reason}}"
         }
       },
       "right": {
@@ -14982,6 +15051,7 @@
           "f1aa04b5cf": "This file",
           "8b87612461": "All unsent notes"
         },
+        "diffCommentSaveFailed": "Failed to save comment",
         "DiffSectionBody": {
           "35d6afb5be": "Binary file changed",
           "cef4cf0ff5": "Retry",
@@ -15129,6 +15199,7 @@
           "tryAgain": "Try again",
           "kernelCreatingVenv": "Creating .venv…",
           "createVenvItem": "Create virtual environment…",
+          "trustFirst": "Run a cell to trust this notebook first",
           "kernelStartFailed": "The kernel failed to start.",
           "noPython": "Python was not found on this computer. Install it from [python.org](https://www.python.org/downloads/), then run the cell again.",
           "kernelDied": "The kernel died.",
@@ -15624,7 +15695,10 @@
             "2b3ce6d394": "Cancel",
             "e05063cfc1": "Line {{value0}}",
             "c845170b3b": "Lines {{value0}}-{{value1}}",
-            "commentTooLarge": "Comment is too large to submit safely."
+            "commentTooLarge": "Comment is too large to submit safely.",
+            "f6c449191e": "Add note for the AI",
+            "5fa4bfebaa": "Add note",
+            "5e9b3d0c2e": "Adding..."
           },
           "useDiffCommentDecorator": {
             "995fa28b50": "This note"
@@ -17316,6 +17390,13 @@
         "dispatchRejected": "The agent refused the “continue” message. Open the chat and send one yourself.",
         "unsupported": "This chat can’t be resumed by Orca. Open it to see where it stopped.",
         "fallback": "Orca couldn’t resume this chat. Open it to continue manually."
+      },
+      "web": {
+        "preloadApi": {
+          "cursorAccounts": {
+            "hostOnly": "Cursor sign-in details are only readable on the computer running Orca."
+          }
+        }
       }
     },
     "i18n": {
@@ -17424,6 +17505,56 @@
       "empty": "No users found"
     },
     "native-chat": {
+      "writeNotice": {
+        "notDoneReadHistory": "This chat's history couldn't be loaded.",
+        "notDoneSend": "Your message was not sent.",
+        "tryAgainComposerSend": "Send it again.",
+        "notDoneStop": "The agent wasn't stopped.",
+        "notDoneStopTask": "The background task wasn't stopped.",
+        "notDoneStopTasks": "The background tasks weren't stopped.",
+        "notDoneAnswer": "Your answer was not sent.",
+        "notDoneOption": "The setting wasn't changed.",
+        "notDoneCommand": "The command didn't run.",
+        "notDoneGoal": "The goal wasn't changed.",
+        "restartFailed": "The agent couldn't restart.",
+        "capacity": "Orca has received too many requests in the last day.",
+        "outcomeUnknown": "Orca couldn't confirm what happened. Check the chat.",
+        "questionChanged": "This question was already answered or has changed.",
+        "historyUnreadable": "Orca couldn't read this chat's saved history.",
+        "historyUnusable": "Unable to load this chat.",
+        "historyUnavailable": "Orca couldn't open this chat's history right now.",
+        "unsupported": "The Orca running this chat doesn't support this. Update Orca, then try again.",
+        "unreachable": "Orca couldn't reach the agent.",
+        "recordFailed": "Orca couldn't record it in this chat's history.",
+        "conversationCleared": "This conversation has been cleared.",
+        "openCurrentConversation": "Open the current conversation to continue.",
+        "clearUnfinished": "The last /clear didn't finish.",
+        "commandRunning": "A /compact or /clear is still running.",
+        "waitForCommand": "Wait for the /compact or /clear to finish.",
+        "agentStarting": "The agent is still starting.",
+        "waitForStart": "Wait for the agent to finish starting.",
+        "turnActive": "The agent is still responding.",
+        "waitForTurn": "Wait for the agent to finish responding, or stop it.",
+        "promptPending": "The agent is waiting for an answer to a question or approval.",
+        "answerFirst": "Answer the question or approval first.",
+        "backgroundTasksRunning": "Background tasks are still running.",
+        "waitForBackgroundTasks": "Wait for the background tasks to finish.",
+        "messagesUnsettled": "A message you sent earlier hasn't been confirmed yet.",
+        "settleEarlierMessage": "Wait for your earlier message to go through, or retry it.",
+        "optionRejected": "The agent didn't accept this setting.",
+        "goalsUnsupported": "This agent doesn't support goals.",
+        "agentRefused": "The agent turned this down.",
+        "ownerUnproven": "Orca hasn't confirmed that this chat's previous agent stopped.",
+        "reopenChat": "Reopen the chat to check again.",
+        "terminalAgentHoldsChat": "This chat is still open in a terminal agent.",
+        "quitTerminalAgent": "Quit that agent to continue the chat here.",
+        "hostReconciling": "Orca is still checking on this chat after restarting.",
+        "waitMoment": "Wait a moment.",
+        "recordUnreadable": "Orca couldn't read this chat's saved state.",
+        "chatNotFound": "The Orca running this chat has no record of it.",
+        "startNewChat": "Start a new chat to continue.",
+        "tryAgain": "Try again."
+      },
       "taskList": {
         "title": "Tasks",
         "completed": "Completed",
@@ -17657,7 +17788,8 @@
         },
         "error": {
           "title": "Could not load conversation",
-          "subtitle": "The transcript could not be read. Toggle back to the terminal to keep working."
+          "subtitle": "The transcript could not be read. Toggle back to the terminal to keep working.",
+          "retryingSubtitle": "The transcript could not be read. Orca keeps trying to load it."
         },
         "pairHost": "Pair a host to view agent chat history.",
         "notAgent": {
@@ -18226,6 +18358,52 @@
       "unassignedInstruction": "Assign a dictation shortcut before starting voice dictation in a focused pane.",
       "settingsInstruction": "Change the model, dictation mode, or shortcut anytime in",
       "settingsLink": "Settings → Voice"
+    },
+    "sessionSearch": {
+      "enableFailed": "Could not turn on session search. Try again.",
+      "progressStarting": "Finding your sessions…",
+      "settingsLink": "Settings → Agent Session Search",
+      "agentsInstruction": "Your agents can search it too. Ask one to “find the session where we fixed the login timeout.”",
+      "consentInstruction": "Change or turn it off anytime in",
+      "readyDescription": "Every agent session on this computer can now be found by what was said in it.",
+      "indexingDescription": "Orca is reading your past agent transcripts so you can search them. This can take a few minutes.",
+      "indexingTitle": "Indexing your agent sessions",
+      "readyTitle": "Session search is ready",
+      "continueInBackground": "Continue in background",
+      "startSearching": "Start searching",
+      "demoRoleAssistant": "Assistant",
+      "demoRoleUser": "User",
+      "recent1Title": "Tidy the settings sidebar",
+      "recent1Text": "Moved the search entries under Workflows and updated the tests.",
+      "ageMinutes": "12m",
+      "recent2Title": "Bump the lockfile",
+      "recent2Text": "Update the dependencies and make sure the build still passes.",
+      "ageHours": "2h",
+      "recent3Title": "Release notes draft",
+      "recent3Text": "Here is a first pass at the notes, grouped by area.",
+      "ageYesterday": "1d",
+      "demoQuery": "login timeout",
+      "demoHit1Title": "Fix flaky auth redirect",
+      "demoHit1Snippet": "Raised the [[login timeout]] to 30s and added a retry on the token refresh.",
+      "demoHit1Age": "3d",
+      "demoHit2Title": "Session refresh after sleep",
+      "demoHit2Snippet": "Why does the [[login]] page hang after a [[timeout]] on wake?",
+      "demoHit2Age": "1w",
+      "demoHit3Title": "Auth e2e hardening",
+      "demoHit3Snippet": "Added a test that covers the [[login timeout]] path end to end.",
+      "demoHit3Age": "2w",
+      "demoQuery2": "migration rollback",
+      "demoHit4Title": "Orders table migration",
+      "demoHit4Snippet": "The [[rollback]] drops the new index first, then restores the old column.",
+      "demoHit4Age": "5d",
+      "demoHit5Title": "Staging deploy failed",
+      "demoHit5Snippet": "Can you write a [[migration]] [[rollback]] plan before we retry?",
+      "demoHit5Age": "3w",
+      "demoHit6Title": "Schema review notes",
+      "demoHit6Snippet": "Every [[migration]] here is reversible except the enum rename.",
+      "demoHit6Age": "1mo",
+      "readyToast": "Session search is ready",
+      "readyToastOpen": "Open"
     }
   },
   "quickOpen": {
@@ -18275,6 +18453,7 @@
       "needsInput": "needs input",
       "working": "working",
       "stopped": "stopped",
+      "failed": "failed",
       "finished": "finished"
     }
   },
diff --git a/src/renderer/src/i18n/locales/es.json b/src/renderer/src/i18n/locales/es.json
index 8dd1f76871ac..bbc27d088e04 100644
--- a/src/renderer/src/i18n/locales/es.json
+++ b/src/renderer/src/i18n/locales/es.json
@@ -34,7 +34,8 @@
         "resourceUsageToggleDescription": "Muestra el Administrador de recursos. Haz clic para ver CPU, memoria, sesiones, controles del daemon y análisis de disco de los espacios de trabajo.",
         "portsToggleDescription": "Muestra los puertos activos de los espacios de trabajo. Haz clic para ver los puertos de cada espacio de trabajo y los puertos externos.",
         "antigravityToggleDescription": "Muestra el uso de suscripción de Antigravity para el espacio de trabajo activo.",
-        "grokToggleDescription": "Muestra el uso de créditos de suscripción de Grok cuando has iniciado sesión con Grok CLI."
+        "grokToggleDescription": "Muestra el uso de créditos de suscripción de Grok cuando has iniciado sesión con Grok CLI.",
+        "cursorToggleDescription": "Muestra el uso del plan de Cursor cuando inicias sesión con cursor-agent o el IDE de Cursor."
       },
       "menuBarIcon": {
         "title": "Mostrar icono en la barra de menús",
@@ -727,7 +728,8 @@
             "tooMany": "You can attach up to {{maxCount}} images.",
             "dimensionsTooLarge": "{{fileName}} has dimensions that are too large to preview safely.",
             "invalidImage": "{{fileName}} is not a valid supported image.",
-            "additionalErrors": "{{count}} additional images could not be attached."
+            "additionalErrors": "{{count}} additional images could not be attached.",
+            "totalTooLarge": "{{fileName}} superaría el total de {{maxSize}} de archivos adjuntos."
           }
         }
       }
@@ -2775,7 +2777,9 @@
             "a7e2fd2699": "abre un issue",
             "5c8ce20be6": "Si esto persiste, por favor",
             "cc6d997c65": "Reinicia el servicio del terminal desde aquí para borrar el estado obsoleto.",
-            "remoteTerminalClosed": "La terminal remota se cerró."
+            "remoteTerminalClosed": "La terminal remota se cerró.",
+            "ptyAllocationLimit": "Tu sistema no puede asignar más dispositivos pty. Cierra algunas terminales que no estés usando, en Orca o en otro programa, y vuelve a intentarlo.",
+            "terminalProcessLimit": "Tu sistema no puede iniciar otro proceso de terminal. Cierra las terminales que no uses o sal de los procesos que no necesites y vuelve a intentarlo."
           },
           "TerminalProcessExitOverlay": {
             "capacityTitle": "Se alcanzó el límite de consolas de Git Bash",
@@ -2802,7 +2806,7 @@
             "missing": {
               "tui": {
                 "title": "This ZCode build has no terminal UI",
-                "description": "Orca's hooks installed correctly \u2014 the zcode on your PATH just cannot open a session. The ZCode desktop app bundles the agent runtime without its terminal UI. Install a zcode that ships the TUI, then run zcode outside Orca to confirm."
+                "description": "Orca's hooks installed correctly — the zcode on your PATH just cannot open a session. The ZCode desktop app bundles the agent runtime without its terminal UI. Install a zcode that ships the TUI, then run zcode outside Orca to confirm."
               }
             }
           },
@@ -2925,6 +2929,9 @@
             "retryingBody": "Orca is retrying automatically. This terminal will resume if the connection returns.",
             "disconnectedBody": "Automatic retries stopped. Reconnect to resume this terminal session.",
             "reconnectButton": "Reconnect"
+          },
+          "TerminalRestoringPlaceholder": {
+            "restoring": "Restaurando terminal…"
           }
         }
       },
@@ -3339,7 +3346,9 @@
             "grokUsageMenu": "Uso de Grok",
             "floatingTerminalNewActivity": "{{label}}, nueva actividad",
             "codexSignInSuccess": "Sesión iniciada en Codex",
-            "codexSignInError": "No se pudo iniciar sesión en Codex. Inténtalo de nuevo."
+            "codexSignInError": "No se pudo iniciar sesión en Codex. Inténtalo de nuevo.",
+            "cursorUsageMenu": "Uso de Cursor",
+            "hiddenUsageProviders": "También: {{value0}}"
           },
           "StatusBarUsageEmptyCta": {
             "828c764a79": "Conectar una cuenta",
@@ -3507,6 +3516,13 @@
               "noSubscription": {
                 "label": "Sin suscripción"
               }
+            },
+            "cursor": {
+              "expired": {
+                "label": "Inicio de sesión caducado",
+                "message": "Ejecuta cursor-agent login en una terminal del equipo donde se ejecuta Orca y vuelve a intentar consultar el uso."
+              },
+              "plan": "Plan"
             }
           },
           "SshTargetStatusRow": {
@@ -4452,7 +4468,9 @@
           "69969ba364": "Envío…",
           "imageReadFailed": "Could not read the attached images. Try attaching them again.",
           "attachWhileSending": "Wait for the current feedback to finish sending before attaching more images.",
-          "imagesNotDelivered": "Feedback sent, but image delivery could not be confirmed."
+          "imagesNotDelivered": "Feedback sent, but image delivery could not be confirmed.",
+          "imagesNotIncluded": "Comentarios enviados. No se pudieron subir tus capturas de pantalla y no se incluyeron.",
+          "imagesRejected": "Comentarios enviados. Tus capturas de pantalla eran demasiado grandes para subirlas y no se incluyeron."
         },
         "SidebarFilter": {
           "e3b3898218": "Agregar proyecto",
@@ -5334,7 +5352,8 @@
         },
         "SidebarFeedbackImageAttachments": {
           "attachImages": "Attach",
-          "removeImage": "Remove {{fileName}}"
+          "removeImage": "Remove {{fileName}}",
+          "screenshotsHint": "Adjunta hasta {{count}} capturas de pantalla, {{maxSize}} en total"
         },
         "WorkspaceKanbanSearchField": {
           "bdb753c78d": "Ningún espacio de trabajo coincide",
@@ -6064,7 +6083,8 @@
             "shellEnvNamesAlwaysPassed": "PATH, la configuración regional y SSH_AUTH_SOCK se pasan siempre. Se aplica la próxima vez que un chat se inicie o se reanude.",
             "shellEnvTitle": "Usar el entorno de tu shell",
             "shellEnvCopy": "Los chats de Codex y Claude empiezan con todas las variables que exporta tu shell de inicio de sesión, igual que un terminal. Desactívalo para elegir cuáles reciben.",
-            "shellEnvToggleLabel": "Alternar el uso del entorno de tu shell"
+            "shellEnvToggleLabel": "Alternar el uso del entorno de tu shell",
+            "resumeCopy": "Cuando Orca se cierra o instala una actualización, los chats que estaban trabajando se reanudan automáticamente al volver a abrir Orca."
           },
           "agentDashboard": {
             "title": "Panel de agentes",
@@ -7813,7 +7833,18 @@
             "d2c6a0e8f1": "grok",
             "c1b5f9d7e0": "xai",
             "b0a4e8c6d9": "OAuth",
-            "a9f3d7b5c8": "inicio de sesión"
+            "a9f3d7b5c8": "inicio de sesión",
+            "cursor": {
+              "description": "Uso mensual del plan obtenido del inicio de sesión de Cursor que ya está en este equipo (cursor-agent login).",
+              "kw": {
+                "cursor": "cursor",
+                "rateLimit": "rate limit",
+                "spend": "gasto",
+                "statusBar": "barra de estado",
+                "usage": "uso"
+              },
+              "title": "Uso de Cursor"
+            }
           }
         },
         "advanced": {
@@ -8040,7 +8071,14 @@
             "d6c0a9e2f4": "grok",
             "c5b9f8d1e3": "xai",
             "usagePercentageDisplayTitle": "Porcentajes de uso",
-            "usagePercentageDisplayDescription": "Elige si los límites del proveedor muestran el porcentaje usado o restante."
+            "usagePercentageDisplayDescription": "Elige si los límites del proveedor muestran el porcentaje usado o restante.",
+            "cursor": {
+              "description": "Muestra el uso mensual del plan de Cursor a partir del inicio de sesión de Cursor en este equipo.",
+              "kw": {
+                "cursor": "cursor"
+              },
+              "title": "Uso de Cursor"
+            }
           }
         },
         "auto": {
@@ -10432,6 +10470,31 @@
           "saveFailed": "No se pudieron guardar los valores predeterminados de visibilidad.",
           "updateServer": "Actualiza este servidor para configurar los valores predeterminados de las fuentes.",
           "updateServerDefaults": "Actualiza este servidor para configurar los valores predeterminados de visibilidad."
+        },
+        "CursorAccountsSection": {
+          "dashboardLink": "Panel de Cursor",
+          "expired": "Inicio de sesión caducado — ejecuta cursor-agent login en el equipo donde se ejecuta Orca y haz clic en Actualizar uso.",
+          "loading": "Cargando…",
+          "noAllowance": "Cursor no reportó ninguna cuota de uso para esta cuenta.",
+          "planTotal": "Plan",
+          "refreshUsage": "Actualizar uso",
+          "resets": "Se restablece {{when}}",
+          "signedIn": "Sesión iniciada",
+          "signedInFrom": "Sesión iniciada. Orca lee la sesión almacenada en {{source}}.",
+          "signedInGeneric": "Sesión iniciada. Orca lee la sesión de Cursor almacenada en este equipo.",
+          "signedOut": "No se encontró ningún inicio de sesión de Cursor en este equipo",
+          "signedOutHelp": "Inicia sesión con el IDE de Cursor o ejecuta cursor-agent login en una terminal, y haz clic en Actualizar uso aquí.",
+          "source": {
+            "cli": "Archivo de autenticación de Cursor CLI",
+            "desktop": "IDE de Cursor",
+            "keychain": "Llavero de macOS (cursor-agent)"
+          },
+          "staleUsage": "Último uso conocido — falló la actualización más reciente: {{reason}}",
+          "subtitle": "Muestra tu uso mensual del plan de Cursor a partir del inicio de sesión que ya está en este equipo. Orca solo lo lee — nunca modifica tu inicio de sesión de Cursor.",
+          "title": "Cursor",
+          "usageDescription": "Cursor factura dos cuotas que se restablecen con tu ciclo de facturación, más gasto bajo demanda cuando se agotan.",
+          "usageLabel": "Uso",
+          "usageTitle": "Uso mensual del plan"
         }
       },
       "right": {
@@ -12974,6 +13037,7 @@
           "f1aa04b5cf": "Este archivo",
           "8b87612461": "Todas las notas no enviadas"
         },
+        "diffCommentSaveFailed": "No se pudo guardar el comentario",
         "DiffSectionBody": {
           "35d6afb5be": "Archivo binario cambiado",
           "cef4cf0ff5": "Reintentar",
@@ -13091,6 +13155,7 @@
           "notPython": "Ese archivo no es un intérprete de Python.",
           "interrupt": "Interrumpir",
           "restart": "Reiniciar kernel",
+          "trustFirst": "Ejecuta una celda para confiar primero en este notebook",
           "runAll": "Ejecutar todo",
           "clearAll": "Borrar todas las salidas",
           "notResponding": "Sin respuesta. Reinicia el kernel",
@@ -13106,7 +13171,22 @@
           "noPython": "No se encontró Python en este equipo. Instálalo desde [python.org](https://www.python.org/downloads/) y vuelve a ejecutar la celda.",
           "kernelDied": "El kernel murió.",
           "localOnly": "Las celdas del notebook solo pueden ejecutarse para archivos de este equipo.",
-          "pythonOnly": "Solo los notebooks de Python pueden ejecutarse en Orca."
+          "pythonOnly": "Solo los notebooks de Python pueden ejecutarse en Orca.",
+          "commandCopied": "Comando copiado",
+          "createVenv": "Crear .venv",
+          "createVenvItem": "Crear entorno virtual…",
+          "createVenvTitle": "¿Crear un entorno virtual?",
+          "creatingButton": "Creando…",
+          "creatingVenvDescription": "Creando .venv en {{folder}} e instalando ipykernel en él. Esto puede tardar un minuto.",
+          "creatingVenvTitle": "Creando entorno virtual…",
+          "installingButton": "Instalando…",
+          "installingDescription": "Instalando ipykernel en '{{env}}' con pip. Esto puede tardar un minuto.",
+          "installingTitle": "Instalando ipykernel…",
+          "kernelCreatingVenv": "Creando .venv…",
+          "setupFailed": "No funcionó. Salida de Python:",
+          "tryAgain": "Intentar de nuevo",
+          "useAnotherPython": "Usar otro Python…",
+          "venvDescription": "Orca creará un .venv en {{folder}} desde '{{env}}', instalará ipykernel en él y ejecutará este notebook allí."
         },
         "MarkdownPreview": {
           "e4683f70c4": "Cancelar",
@@ -13554,7 +13634,10 @@
             "2b3ce6d394": "Cancelar",
             "e05063cfc1": "Línea {{value0}}",
             "c845170b3b": "Líneas {{value0}}-{{value1}}",
-            "commentTooLarge": "El comentario es demasiado grande para enviarlo de forma segura."
+            "commentTooLarge": "El comentario es demasiado grande para enviarlo de forma segura.",
+            "f6c449191e": "Agregar nota para la IA",
+            "5fa4bfebaa": "Agregar nota",
+            "5e9b3d0c2e": "Agregando..."
           },
           "useDiffCommentDecorator": {
             "995fa28b50": "esta nota"
@@ -14747,7 +14830,17 @@
         "notConfirmedOtherOne": "No se pudo confirmar que 1 otro chat se reanudó",
         "notConfirmedOtherMany": "No se pudo confirmar que {{value0}} otros chats se reanudaron",
         "show": "Mostrar",
-        "dismiss": "Descartar"
+        "dismiss": "Descartar",
+        "activityApproval": "Esperando tu aprobación: {{value0}}",
+        "activityMidReply": "Estaba respondiendo",
+        "activityMonitorMany": "Supervisando {{value0}} tareas en segundo plano",
+        "activityMonitorOne": "Supervisando: {{value0}}",
+        "activityQuestion": "Esperando tu respuesta: {{value0}}",
+        "activitySubagentMany": "{{value0}} subagentes en ejecución",
+        "activitySubagentOne": "Subagente en ejecución: {{value0}}",
+        "activityUnnamed": "sin nombre",
+        "updateBody": "Estos chats estaban trabajando cuando Orca instaló una actualización. Al reanudarlos, cada uno se restaura donde se detuvo, con su contexto completo, y se pide al agente que revise lo que estaba haciendo antes de continuar. Tu propio prompt no se vuelve a enviar.",
+        "body": "Estos chats estaban trabajando cuando Orca se cerró. Al reanudarlos, cada uno se restaura donde se detuvo, con su contexto completo, y se pide al agente que revise lo que estaba haciendo antes de continuar. Tu propio prompt no se vuelve a enviar."
       },
       "NativeChatResumeOutcomeRow": {
         "openChat": "Abrir chat",
@@ -14768,6 +14861,13 @@
         "dispatchRejected": "El agente rechazó el mensaje “continue”. Abre el chat y envía uno tú mismo.",
         "unsupported": "Orca no puede reanudar este chat. Ábrelo para ver dónde se detuvo.",
         "fallback": "Orca no pudo reanudar este chat. Ábrelo para continuar manualmente."
+      },
+      "web": {
+        "preloadApi": {
+          "cursorAccounts": {
+            "hostOnly": "Los detalles del inicio de sesión de Cursor solo se pueden leer en el equipo donde se ejecuta Orca."
+          }
+        }
       }
     },
     "i18n": {
@@ -14830,6 +14930,56 @@
   },
   "components": {
     "native-chat": {
+      "writeNotice": {
+        "notDoneReadHistory": "No se pudo cargar el historial de este chat.",
+        "notDoneSend": "Su mensaje no se envió.",
+        "tryAgainComposerSend": "Vuelva a enviarlo.",
+        "notDoneStop": "El agente no se detuvo.",
+        "notDoneStopTask": "La tarea en segundo plano no se detuvo.",
+        "notDoneStopTasks": "Las tareas en segundo plano no se detuvieron.",
+        "notDoneAnswer": "Su respuesta no se envió.",
+        "notDoneOption": "La configuración no se cambió.",
+        "notDoneCommand": "El comando no se ejecutó.",
+        "notDoneGoal": "El objetivo no se cambió.",
+        "restartFailed": "El agente no pudo reiniciarse.",
+        "capacity": "Orca ha recibido demasiadas solicitudes en el último día.",
+        "outcomeUnknown": "Orca no pudo confirmar qué pasó. Revise el chat.",
+        "questionChanged": "Esta pregunta ya se respondió o ha cambiado.",
+        "historyUnreadable": "Orca no pudo leer el historial guardado de este chat.",
+        "historyUnusable": "No se puede cargar este chat.",
+        "historyUnavailable": "Orca no pudo abrir el historial de este chat en este momento.",
+        "unsupported": "La versión de Orca que ejecuta este chat no lo admite. Actualice Orca y vuelva a intentarlo.",
+        "unreachable": "Orca no pudo comunicarse con el agente.",
+        "recordFailed": "Orca no pudo registrarlo en el historial de este chat.",
+        "conversationCleared": "Esta conversación se borró.",
+        "openCurrentConversation": "Abra la conversación actual para continuar.",
+        "clearUnfinished": "El último /clear no terminó.",
+        "commandRunning": "Todavía se está ejecutando un /compact o /clear.",
+        "waitForCommand": "Espere a que termine el /compact o /clear.",
+        "agentStarting": "El agente todavía se está iniciando.",
+        "waitForStart": "Espere a que el agente termine de iniciarse.",
+        "turnActive": "El agente todavía está respondiendo.",
+        "waitForTurn": "Espere a que el agente termine de responder o deténgalo.",
+        "promptPending": "El agente está esperando una respuesta a una pregunta o aprobación.",
+        "answerFirst": "Responda primero a la pregunta o aprobación.",
+        "backgroundTasksRunning": "Todavía hay tareas en segundo plano en ejecución.",
+        "waitForBackgroundTasks": "Espere a que terminen las tareas en segundo plano.",
+        "messagesUnsettled": "Un mensaje que envió antes todavía no se ha confirmado.",
+        "settleEarlierMessage": "Espere a que se entregue su mensaje anterior o vuelva a intentarlo.",
+        "optionRejected": "El agente no aceptó este ajuste.",
+        "goalsUnsupported": "Este agente no admite objetivos.",
+        "agentRefused": "El agente lo rechazó.",
+        "ownerUnproven": "Orca no ha confirmado que el agente anterior de este chat se haya detenido.",
+        "reopenChat": "Vuelva a abrir el chat para comprobarlo de nuevo.",
+        "terminalAgentHoldsChat": "Este chat sigue abierto en un agente de terminal.",
+        "quitTerminalAgent": "Cierre ese agente para continuar el chat aquí.",
+        "hostReconciling": "Orca todavía está comprobando este chat después de reiniciarse.",
+        "waitMoment": "Espere un momento.",
+        "recordUnreadable": "Orca no pudo leer el estado guardado de este chat.",
+        "chatNotFound": "La versión de Orca que ejecuta este chat no tiene ningún registro de él.",
+        "startNewChat": "Inicie un chat nuevo para continuar.",
+        "tryAgain": "Vuelva a intentarlo."
+      },
       "composer": {
         "imageUnsupported": "Este agente no admite pegar imágenes.",
         "send": "Enviar",
@@ -14907,7 +15057,8 @@
         },
         "error": {
           "title": "No se pudo cargar la conversación",
-          "subtitle": "No se pudo leer la transcripción. Vuelva a la terminal para seguir trabajando."
+          "subtitle": "No se pudo leer la transcripción. Vuelva a la terminal para seguir trabajando.",
+          "retryingSubtitle": "No se pudo leer la transcripción. Orca sigue intentando cargarla."
         },
         "pairHost": "Empareje un host para ver el historial de chat del agente.",
         "notAgent": {
@@ -15176,7 +15327,56 @@
       "needsInput": "necesita información",
       "working": "trabajando",
       "stopped": "detenido",
+      "failed": "fallido",
       "finished": "finalizado"
     }
+  },
+  "featureTips": {
+    "sessionSearch": {
+      "ageHours": "2 h",
+      "ageMinutes": "12 min",
+      "ageYesterday": "1 d",
+      "agentsInstruction": "Tus agentes también pueden buscar en él. Pide a uno que “encuentre la sesión donde corregimos el tiempo de espera del inicio de sesión”.",
+      "consentInstruction": "Cámbialo o desactívalo cuando quieras en",
+      "continueInBackground": "Continuar en segundo plano",
+      "demoHit1Age": "3 d",
+      "demoHit1Snippet": "Aumentó el [[tiempo de espera de inicio de sesión]] a 30 s y agregó un reintento en la actualización del token.",
+      "demoHit1Title": "Corregir redirección de autenticación inestable",
+      "demoHit2Age": "1 sem",
+      "demoHit2Snippet": "¿Por qué se cuelga la página de [[inicio de sesión]] después de un [[tiempo de espera]] al reactivar?",
+      "demoHit2Title": "Actualización de sesión tras suspensión",
+      "demoHit3Age": "2 sem",
+      "demoHit3Snippet": "Agregó una prueba que cubre la ruta de [[tiempo de espera de inicio de sesión]] de principio a fin.",
+      "demoHit3Title": "Refuerzo e2e de autenticación",
+      "demoHit4Age": "5 d",
+      "demoHit4Snippet": "La [[reversión]] elimina primero el índice nuevo y luego restaura la columna anterior.",
+      "demoHit4Title": "Migración de la tabla de pedidos",
+      "demoHit5Age": "3 sem",
+      "demoHit5Snippet": "¿Puedes escribir un plan de [[reversión]] de la [[migración]] antes de reintentar?",
+      "demoHit5Title": "Falló la implementación en staging",
+      "demoHit6Age": "1 mes",
+      "demoHit6Snippet": "Cada [[migración]] aquí es reversible excepto el cambio de nombre del enum.",
+      "demoHit6Title": "Notas de revisión del esquema",
+      "demoQuery": "tiempo de espera de inicio de sesión",
+      "demoQuery2": "reversión de migración",
+      "demoRoleAssistant": "Asistente",
+      "demoRoleUser": "Usuario",
+      "enableFailed": "No se pudo activar la búsqueda de sesiones. Inténtalo de nuevo.",
+      "indexingDescription": "Orca está leyendo tus transcripciones anteriores de agentes para que puedas buscar en ellas. Esto puede tardar unos minutos.",
+      "indexingTitle": "Indexando tus sesiones de agentes",
+      "progressStarting": "Buscando tus sesiones…",
+      "readyDescription": "Todas las sesiones de agentes de este equipo ya se pueden encontrar por lo que se dijo en ellas.",
+      "readyTitle": "La búsqueda de sesiones está lista",
+      "readyToast": "La búsqueda de sesiones está lista",
+      "readyToastOpen": "Abrir",
+      "recent1Text": "Movió las entradas de búsqueda a Flujos de trabajo y actualizó las pruebas.",
+      "recent1Title": "Ordenar la barra lateral de ajustes",
+      "recent2Text": "Actualiza las dependencias y asegúrate de que la compilación siga pasando.",
+      "recent2Title": "Actualizar el archivo de bloqueo",
+      "recent3Text": "Esta es una primera versión de las notas, agrupadas por área.",
+      "recent3Title": "Borrador de notas de la versión",
+      "settingsLink": "Ajustes → Búsqueda de sesiones de agentes",
+      "startSearching": "Empezar a buscar"
+    }
   }
 }
diff --git a/src/renderer/src/i18n/locales/fr.json b/src/renderer/src/i18n/locales/fr.json
index c771d560bc43..23e86dc673b3 100644
--- a/src/renderer/src/i18n/locales/fr.json
+++ b/src/renderer/src/i18n/locales/fr.json
@@ -133,7 +133,8 @@
         "resourceUsageToggleDescription": "Afficher le gestionnaire de ressources. Cliquez dessus pour le CPU, la mémoire, les sessions, les contrôles des daemons et les analyses disque des espaces de travail.",
         "portsToggleDescription": "Afficher les ports actifs de l'espace de travail. Cliquez dessus pour les ports par espace de travail et les écouteurs externes.",
         "antigravityToggleDescription": "Afficher l'utilisation de l'abonnement Antigravity pour l'espace de travail actif.",
-        "grokToggleDescription": "Afficher l'utilisation des crédits de l'abonnement Grok lorsque vous êtes connecté via Grok CLI."
+        "grokToggleDescription": "Afficher l'utilisation des crédits de l'abonnement Grok lorsque vous êtes connecté via Grok CLI.",
+        "cursorToggleDescription": "Afficher l'utilisation du forfait Cursor lorsque vous êtes connecté via cursor-agent ou Cursor IDE."
       },
       "menuBarIcon": {
         "title": "Afficher l'icône dans la barre de menus",
@@ -968,7 +969,8 @@
             "tooMany": "Vous pouvez joindre jusqu'à {{maxCount}} images.",
             "dimensionsTooLarge": "{{fileName}} a des dimensions trop grandes pour un aperçu sans risque.",
             "invalidImage": "{{fileName}} n'est pas une image valide prise en charge.",
-            "additionalErrors": "{{count}} images supplémentaires n'ont pas pu être jointes."
+            "additionalErrors": "{{count}} images supplémentaires n'ont pas pu être jointes.",
+            "totalTooLarge": "{{fileName}} ferait dépasser {{maxSize}} au total pour les pièces jointes."
           }
         }
       },
@@ -3169,7 +3171,9 @@
             "ownerUnknown": "Orca n'a pas pu vérifier le propriétaire de ce terminal.",
             "42b283ecfc": "Orca n'a pas pu reconnecter ce terminal en toute sécurité car l'hôte n'a pas pu vérifier sa session enregistrée. Orca a laissé la session enregistrée inchangée. Cliquez sur Réessayer pour essayer de vous reconnecter maintenant. S'il ne parvient toujours pas à se reconnecter, ouvrez un nouveau terminal.",
             "sourceRestoring": "Reconnexion de ce terminal - sa sortie est en cours de rétablissement. La session est toujours en cours.",
-            "remoteTerminalClosed": "Le terminal distant était fermé."
+            "remoteTerminalClosed": "Le terminal distant était fermé.",
+            "ptyAllocationLimit": "Votre système ne peut plus allouer de périphériques pty. Fermez quelques terminaux inutilisés, dans Orca ou dans un autre programme, puis réessayez.",
+            "terminalProcessLimit": "Votre système ne peut pas démarrer un autre processus de terminal. Fermez les terminaux inutilisés ou quittez les processus inutiles, puis réessayez."
           },
           "TerminalProcessExitOverlay": {
             "capacityTitle": "Limite de consoles Git Bash atteinte",
@@ -3215,7 +3219,7 @@
             "missing": {
               "tui": {
                 "title": "This ZCode build has no terminal UI",
-                "description": "Orca's hooks installed correctly \u2014 the zcode on your PATH just cannot open a session. The ZCode desktop app bundles the agent runtime without its terminal UI. Install a zcode that ships the TUI, then run zcode outside Orca to confirm."
+                "description": "Orca's hooks installed correctly — the zcode on your PATH just cannot open a session. The ZCode desktop app bundles the agent runtime without its terminal UI. Install a zcode that ships the TUI, then run zcode outside Orca to confirm."
               }
             }
           },
@@ -3342,6 +3346,9 @@
           "TerminalQuickCommandsSubmenu": {
             "3ccc7981bb": "Hôte indisponible",
             "54f29b7c0d": "Chargement de l'hôte…"
+          },
+          "TerminalRestoringPlaceholder": {
+            "restoring": "Restauration du terminal…"
           }
         }
       },
@@ -3761,7 +3768,9 @@
             "grokUsageMenu": "Utilisation Grok",
             "floatingTerminalNewActivity": "{{label}}, nouvelle activité",
             "codexSignInSuccess": "Connecté à Codex",
-            "codexSignInError": "Échec de la connexion à Codex. Veuillez réessayer."
+            "codexSignInError": "Échec de la connexion à Codex. Veuillez réessayer.",
+            "cursorUsageMenu": "Utilisation Cursor",
+            "hiddenUsageProviders": "Aussi : {{value0}}"
           },
           "StatusBarUsageEmptyCta": {
             "828c764a79": "Connecter un compte",
@@ -3952,6 +3961,13 @@
               "noSubscription": {
                 "label": "Aucun abonnement"
               }
+            },
+            "cursor": {
+              "expired": {
+                "label": "Connexion expirée",
+                "message": "Exécutez cursor-agent login dans un terminal sur l'ordinateur qui exécute Orca, puis réessayez."
+              },
+              "plan": "Forfait"
             }
           },
           "SshTargetStatusRow": {
@@ -5341,7 +5357,9 @@
           "69969ba364": "Envoi…",
           "imageReadFailed": "Impossible de lire les images jointes. Essayez de les joindre à nouveau.",
           "attachWhileSending": "Attendez la fin de l'envoi du commentaire en cours avant de joindre d'autres images.",
-          "imagesNotDelivered": "Commentaire envoyé, mais la livraison des images n'a pas pu être confirmée."
+          "imagesNotDelivered": "Commentaire envoyé, mais la livraison des images n'a pas pu être confirmée.",
+          "imagesNotIncluded": "Commentaire envoyé. Vos captures d'écran n'ont pas pu être téléversées et n'ont pas été incluses.",
+          "imagesRejected": "Commentaire envoyé. Vos captures d'écran étaient trop volumineuses pour être téléversées et n'ont pas été incluses."
         },
         "SidebarFilter": {
           "e3b3898218": "Ajouter un projet",
@@ -6241,7 +6259,8 @@
         },
         "SidebarFeedbackImageAttachments": {
           "attachImages": "Joindre",
-          "removeImage": "Supprimer {{fileName}}"
+          "removeImage": "Supprimer {{fileName}}",
+          "screenshotsHint": "Joignez jusqu'à {{count}} captures d'écran, {{maxSize}} au total"
         },
         "WorkspaceKanbanSearchField": {
           "bdb753c78d": "Aucun espace de travail correspondant",
@@ -9023,7 +9042,18 @@
             "b2c4e7f1a8": "point final",
             "3a9b6d2c4e": "clé API",
             "5d8f1a3b7c": "Chine",
-            "7e2a4b8c1d": "outre-mer"
+            "7e2a4b8c1d": "outre-mer",
+            "cursor": {
+              "description": "Utilisation mensuelle du forfait lue depuis la connexion Cursor déjà présente sur cet ordinateur (cursor-agent login).",
+              "kw": {
+                "cursor": "cursor",
+                "rateLimit": "limite de débit",
+                "spend": "dépenses",
+                "statusBar": "barre d'état",
+                "usage": "utilisation"
+              },
+              "title": "Utilisation Cursor"
+            }
           }
         },
         "advanced": {
@@ -9279,6 +9309,13 @@
               "close": "fermer",
               "notification": "zone de notification",
               "background": "arrière-plan"
+            },
+            "cursor": {
+              "description": "Afficher l'utilisation mensuelle du forfait Cursor à partir de la connexion Cursor sur cet ordinateur.",
+              "kw": {
+                "cursor": "cursor"
+              },
+              "title": "Utilisation Cursor"
             }
           }
         },
@@ -12097,6 +12134,31 @@
         "TerminalRenderingSection": {
           "6d4c55bacc": "Images en ligne",
           "fffab5890b": "Affichez les images directement dans le terminal à l'aide des protocoles graphiques SIXEL, iTerm2 (IIP) et Kitty."
+        },
+        "CursorAccountsSection": {
+          "dashboardLink": "Tableau de bord Cursor",
+          "expired": "Connexion expirée — exécutez cursor-agent login sur l'ordinateur qui exécute Orca, puis cliquez sur Actualiser l'utilisation.",
+          "loading": "Chargement…",
+          "noAllowance": "Cursor n'a signalé aucun quota d'utilisation pour ce compte.",
+          "planTotal": "Forfait",
+          "refreshUsage": "Actualiser l'utilisation",
+          "resets": "Réinitialisation {{when}}",
+          "signedIn": "Connecté",
+          "signedInFrom": "Connecté. Orca lit la session stockée dans {{source}}.",
+          "signedInGeneric": "Connecté. Orca lit la session Cursor stockée sur cet ordinateur.",
+          "signedOut": "Aucune connexion Cursor trouvée sur cet ordinateur",
+          "signedOutHelp": "Connectez-vous avec Cursor IDE, ou exécutez cursor-agent login dans un terminal, puis cliquez ici sur Actualiser l'utilisation.",
+          "source": {
+            "cli": "Fichier d'authentification du CLI Cursor",
+            "desktop": "Cursor IDE",
+            "keychain": "Trousseau macOS (cursor-agent)"
+          },
+          "staleUsage": "Dernière utilisation connue — la dernière actualisation a échoué : {{reason}}",
+          "subtitle": "Affiche l'utilisation mensuelle de votre forfait Cursor à partir de la connexion déjà présente sur cet ordinateur. Orca se contente de la lire — il ne modifie jamais votre connexion Cursor.",
+          "title": "Cursor",
+          "usageDescription": "Cursor facture deux enveloppes qui se réinitialisent avec votre cycle de facturation, plus des dépenses à la demande une fois épuisées.",
+          "usageLabel": "Utilisation",
+          "usageTitle": "Utilisation mensuelle du forfait"
         }
       },
       "right": {
@@ -14901,6 +14963,7 @@
           "f1aa04b5cf": "Ce fichier",
           "8b87612461": "Toutes les notes non envoyées"
         },
+        "diffCommentSaveFailed": "Échec de l'enregistrement du commentaire",
         "DiffSectionBody": {
           "35d6afb5be": "Fichier binaire modifié",
           "cef4cf0ff5": "Réessayer",
@@ -15022,6 +15085,7 @@
           "notPython": "Ce fichier n'est pas un interpréteur Python.",
           "interrupt": "Interrompre",
           "restart": "Redémarrer le kernel",
+          "trustFirst": "Exécutez une cellule pour d'abord faire confiance à ce notebook",
           "runAll": "Tout exécuter",
           "clearAll": "Effacer toutes les sorties",
           "notResponding": "Ne répond pas. Redémarrez le kernel",
@@ -15037,7 +15101,22 @@
           "noPython": "Python est introuvable sur cet ordinateur. Installez-le depuis [python.org](https://www.python.org/downloads/), puis réexécutez la cellule.",
           "kernelDied": "Le kernel est mort.",
           "localOnly": "Les cellules du notebook ne peuvent s'exécuter que pour des fichiers sur cet ordinateur.",
-          "pythonOnly": "Seuls les notebooks Python peuvent s'exécuter dans Orca."
+          "pythonOnly": "Seuls les notebooks Python peuvent s'exécuter dans Orca.",
+          "commandCopied": "Commande copiée.",
+          "createVenv": "Créer .venv",
+          "createVenvItem": "Créer un environnement virtuel…",
+          "createVenvTitle": "Créer un environnement virtuel ?",
+          "creatingButton": "Création…",
+          "creatingVenvDescription": "Création de .venv dans {{folder}} et installation d'ipykernel. Cela peut prendre une minute.",
+          "creatingVenvTitle": "Création de l'environnement virtuel…",
+          "installingButton": "Installation…",
+          "installingDescription": "Installation d'ipykernel dans « {{env}} » avec pip. Cela peut prendre une minute.",
+          "installingTitle": "Installation d'ipykernel…",
+          "kernelCreatingVenv": "Création de .venv…",
+          "setupFailed": "Cela n'a pas fonctionné. Sortie de Python :",
+          "tryAgain": "Réessayer",
+          "useAnotherPython": "Utiliser un autre Python…",
+          "venvDescription": "Orca va créer un .venv dans {{folder}} à partir de « {{env}} », y installer ipykernel, puis y exécuter ce notebook."
         },
         "MarkdownPreview": {
           "e4683f70c4": "Annuler",
@@ -15528,7 +15607,10 @@
             "2b3ce6d394": "Annuler",
             "e05063cfc1": "Ligne {{value0}}",
             "c845170b3b": "Lignes {{value0}}-{{value1}}",
-            "commentTooLarge": "Le commentaire est trop volumineux pour être envoyé sans risque."
+            "commentTooLarge": "Le commentaire est trop volumineux pour être envoyé sans risque.",
+            "f6c449191e": "Ajouter une note pour l'IA",
+            "5fa4bfebaa": "Ajouter une note",
+            "5e9b3d0c2e": "Ajout..."
           },
           "useDiffCommentDecorator": {
             "995fa28b50": "Cette note"
@@ -17256,6 +17338,13 @@
         "dispatchRejected": "L'agent a refusé le message “continue”. Ouvrez le chat et envoyez-en un vous-même.",
         "unsupported": "Orca ne peut pas reprendre ce chat. Ouvrez-le pour voir où il s'est arrêté.",
         "fallback": "Orca n'a pas pu reprendre ce chat. Ouvrez-le pour continuer manuellement."
+      },
+      "web": {
+        "preloadApi": {
+          "cursorAccounts": {
+            "hostOnly": "Les détails de connexion Cursor ne sont lisibles que sur l'ordinateur qui exécute Orca."
+          }
+        }
       }
     },
     "i18n": {
@@ -17324,6 +17413,56 @@
   },
   "components": {
     "native-chat": {
+      "writeNotice": {
+        "notDoneReadHistory": "L'historique de ce chat n'a pas pu être chargé.",
+        "notDoneSend": "Votre message n'a pas été envoyé.",
+        "tryAgainComposerSend": "Renvoyez-le.",
+        "notDoneStop": "L'agent n'a pas été arrêté.",
+        "notDoneStopTask": "La tâche en arrière-plan n'a pas été arrêtée.",
+        "notDoneStopTasks": "Les tâches en arrière-plan n'ont pas été arrêtées.",
+        "notDoneAnswer": "Votre réponse n'a pas été envoyée.",
+        "notDoneOption": "Le paramètre n'a pas été modifié.",
+        "notDoneCommand": "La commande n'a pas été exécutée.",
+        "notDoneGoal": "L'objectif n'a pas été modifié.",
+        "restartFailed": "L'agent n'a pas pu redémarrer.",
+        "capacity": "Orca a reçu trop de requêtes au cours de la dernière journée.",
+        "outcomeUnknown": "Orca n'a pas pu confirmer ce qui s'est passé. Vérifiez le chat.",
+        "questionChanged": "Cette question a déjà reçu une réponse ou a changé.",
+        "historyUnreadable": "Orca n'a pas pu lire l'historique enregistré de ce chat.",
+        "historyUnusable": "Impossible de charger ce chat.",
+        "historyUnavailable": "Orca n'a pas pu ouvrir l'historique de ce chat pour le moment.",
+        "unsupported": "L'instance d'Orca qui exécute ce chat ne le prend pas en charge. Mettez Orca à jour, puis réessayez.",
+        "unreachable": "Orca n'a pas pu joindre l'agent.",
+        "recordFailed": "Orca n'a pas pu l'enregistrer dans l'historique de ce chat.",
+        "conversationCleared": "Cette conversation a été effacée.",
+        "openCurrentConversation": "Ouvrez la conversation actuelle pour continuer.",
+        "clearUnfinished": "Le dernier /clear ne s'est pas terminé.",
+        "commandRunning": "Un /compact ou /clear est encore en cours.",
+        "waitForCommand": "Attendez la fin du /compact ou /clear.",
+        "agentStarting": "L'agent est encore en cours de démarrage.",
+        "waitForStart": "Attendez que l'agent ait fini de démarrer.",
+        "turnActive": "L'agent est encore en train de répondre.",
+        "waitForTurn": "Attendez que l'agent ait fini de répondre, ou arrêtez-le.",
+        "promptPending": "L'agent attend une réponse à une question ou à une demande d'approbation.",
+        "answerFirst": "Répondez d'abord à la question ou à la demande d'approbation.",
+        "backgroundTasksRunning": "Des tâches en arrière-plan sont encore en cours.",
+        "waitForBackgroundTasks": "Attendez la fin des tâches en arrière-plan.",
+        "messagesUnsettled": "Un message que vous avez envoyé plus tôt n'a pas encore été confirmé.",
+        "settleEarlierMessage": "Attendez que votre message précédent soit transmis, ou renvoyez-le.",
+        "optionRejected": "L'agent n'a pas accepté ce réglage.",
+        "goalsUnsupported": "Cet agent ne prend pas en charge les objectifs.",
+        "agentRefused": "L'agent l'a refusé.",
+        "ownerUnproven": "Orca n'a pas confirmé l'arrêt de l'agent précédent de ce chat.",
+        "reopenChat": "Rouvrez le chat pour vérifier à nouveau.",
+        "terminalAgentHoldsChat": "Ce chat est encore ouvert dans un agent de terminal.",
+        "quitTerminalAgent": "Quittez cet agent pour continuer le chat ici.",
+        "hostReconciling": "Orca vérifie encore ce chat après son redémarrage.",
+        "waitMoment": "Patientez un instant.",
+        "recordUnreadable": "Orca n'a pas pu lire l'état enregistré de ce chat.",
+        "chatNotFound": "L'instance d'Orca qui exécute ce chat n'en a aucune trace.",
+        "startNewChat": "Démarrez un nouveau chat pour continuer.",
+        "tryAgain": "Réessayez."
+      },
       "composer": {
         "imageUnsupported": "Le collage d'image n'est pas pris en charge pour cet agent.",
         "send": "Envoyer",
@@ -17464,9 +17603,9 @@
         "responding": "L'agent répond",
         "working": "Fonctionnement…",
         "thinking": "Réflexion",
-        "workingFor": "Travailler pour {{value0}}",
-        "workedFor": "A travaillé pour {{value0}}",
-        "toggleDetails": "Basculer les détails du virage"
+        "workingFor": "En cours depuis {{value0}}",
+        "workedFor": "A travaillé pendant {{value0}}",
+        "toggleDetails": "Basculer les détails du tour"
       },
       "jumpToLatest": "Aller au dernier message",
       "toggle": {
@@ -17480,7 +17619,8 @@
         },
         "error": {
           "title": "Impossible de charger la conversation",
-          "subtitle": "La transcription n'a pas pu être lue. Rebasculez sur le terminal pour continuer à travailler."
+          "subtitle": "La transcription n'a pas pu être lue. Rebasculez sur le terminal pour continuer à travailler.",
+          "retryingSubtitle": "La transcription n'a pas pu être lue. Orca continue d'essayer de la charger."
         },
         "pairHost": "Associez un hôte pour consulter l'historique de chat des agents.",
         "notAgent": {
@@ -18163,6 +18303,52 @@
       "unassignedInstruction": "Assignez un raccourci de dictée avant de lancer la dictée vocale dans un volet actif.",
       "settingsInstruction": "Modifiez le modèle, le mode de dictée ou le raccourci à tout moment dans",
       "settingsLink": "Paramètres → Voix"
+    },
+    "sessionSearch": {
+      "ageHours": "2 h",
+      "ageMinutes": "12 min",
+      "ageYesterday": "1 j",
+      "agentsInstruction": "Vos agents peuvent aussi la fouiller. Demandez à l'un d'eux de « retrouver la session où nous avons corrigé le délai de connexion ».",
+      "consentInstruction": "Modifiez ce réglage ou désactivez-le à tout moment dans",
+      "continueInBackground": "Continuer en arrière-plan",
+      "demoHit1Age": "3 j",
+      "demoHit1Snippet": "Le [[délai de connexion]] est passé à 30 s avec un nouvel essai sur l'actualisation du jeton.",
+      "demoHit1Title": "Corriger la redirection d'authentification instable",
+      "demoHit2Age": "1 sem.",
+      "demoHit2Snippet": "Pourquoi la page de [[connexion]] se fige-t-elle après un [[délai dépassé]] au réveil ?",
+      "demoHit2Title": "Actualisation de session après la mise en veille",
+      "demoHit3Age": "2 sem.",
+      "demoHit3Snippet": "Ajout d'un test couvrant le parcours [[délai de connexion]] de bout en bout.",
+      "demoHit3Title": "Renforcement des tests e2e d'authentification",
+      "demoHit4Age": "5 j",
+      "demoHit4Snippet": "Le [[retour en arrière]] supprime d'abord le nouvel index, puis restaure l'ancienne colonne.",
+      "demoHit4Title": "Migration de la table des commandes",
+      "demoHit5Age": "3 sem.",
+      "demoHit5Snippet": "Pouvez-vous rédiger un plan de [[retour en arrière]] de [[migration]] avant le nouvel essai ?",
+      "demoHit5Title": "Échec du déploiement en préproduction",
+      "demoHit6Age": "1 mois",
+      "demoHit6Snippet": "Chaque [[migration]] ici est réversible, sauf le renommage de l'enum.",
+      "demoHit6Title": "Notes de révision du schéma",
+      "demoQuery": "délai de connexion",
+      "demoQuery2": "retour en arrière de migration",
+      "demoRoleAssistant": "Assistant",
+      "demoRoleUser": "Utilisateur",
+      "enableFailed": "Impossible d'activer la recherche de session. Réessayez.",
+      "indexingDescription": "Orca lit vos transcriptions d'agent passées pour vous permettre de les rechercher. Cela peut prendre quelques minutes.",
+      "indexingTitle": "Indexation de vos sessions d'agent",
+      "progressStarting": "Recherche de vos sessions…",
+      "readyDescription": "Chaque session d'agent sur cet ordinateur peut désormais être retrouvée par son contenu.",
+      "readyTitle": "La recherche de session est prête",
+      "readyToast": "La recherche de session est prête",
+      "readyToastOpen": "Ouvrir",
+      "recent1Text": "Entrées de recherche déplacées sous Flux de travail et tests mis à jour.",
+      "recent1Title": "Ranger la barre latérale des paramètres",
+      "recent2Text": "Mettez à jour les dépendances et vérifiez que la compilation réussit toujours.",
+      "recent2Title": "Mettre à jour le fichier de verrouillage",
+      "recent3Text": "Voici une première version des notes, regroupées par domaine.",
+      "recent3Title": "Brouillon des notes de version",
+      "settingsLink": "Paramètres → Recherche de session d'agent",
+      "startSearching": "Commencer la recherche"
     }
   },
   "quickOpen": {
@@ -18173,6 +18359,7 @@
       "needsInput": "attend une réponse",
       "working": "en cours",
       "stopped": "arrêté",
+      "failed": "échoué",
       "finished": "terminé"
     }
   },
diff --git a/src/renderer/src/i18n/locales/ja.json b/src/renderer/src/i18n/locales/ja.json
index b1df9e4916cf..254a422405a7 100644
--- a/src/renderer/src/i18n/locales/ja.json
+++ b/src/renderer/src/i18n/locales/ja.json
@@ -34,7 +34,8 @@
         "resourceUsageToggleDescription": "リソースマネージャーを表示します。クリックすると、CPU、メモリ、セッション、デーモンコントロール、ワークスペースディスクスキャンの情報を確認できます。",
         "portsToggleDescription": "ライブワークスペースポートを表示します。ワークスペーススコープのポートと外部リスナーの場合はこれをクリックします。",
         "antigravityToggleDescription": "アクティブなワークスペースの Antigravity サブスクリプション使用量を表示します。",
-        "grokToggleDescription": "Grok CLI でサインインしている場合に Grok サブスクリプションのクレジット使用量を表示します。"
+        "grokToggleDescription": "Grok CLI でサインインしている場合に Grok サブスクリプションのクレジット使用量を表示します。",
+        "cursorToggleDescription": "cursor-agent または Cursor IDE でサインインしている場合に Cursor プランの使用状況を表示します。"
       },
       "menuBarIcon": {
         "title": "メニューバーアイコンを表示",
@@ -869,7 +870,8 @@
             "tooMany": "画像は最大 {{maxCount}} 件まで添付できます。",
             "dimensionsTooLarge": "{{fileName}} は画像サイズが大きすぎるため、安全にプレビューできません。",
             "invalidImage": "{{fileName}} は有効な画像として読み取れません。",
-            "additionalErrors": "ほかに {{count}} 件の画像を添付できませんでした。"
+            "additionalErrors": "ほかに {{count}} 件の画像を添付できませんでした。",
+            "totalTooLarge": "{{fileName}} を追加すると添付ファイルの合計が {{maxSize}} を超えます。"
           }
         }
       },
@@ -3066,7 +3068,9 @@
             "42b283ecfc": "ホストが保存されたセッションを確認できなかったため、Orca はこのターミナルを安全に再接続できませんでした。 Orca は保存されたセッションを変更せずに残しました。今すぐ再接続を試みるには、「再試行」をクリックします。それでも再接続できない場合は、新規ターミナルを開きます。",
             "e16012e31e": "このセッションを所有していたターミナルデーモンが終了したため、セッションとそのスクロールバックを回復できませんでした。続行するには、新規ターミナルを開いてください。",
             "sessionUnavailable": "Orca はホスト上のこのペインのターミナルセッションに再接続できませんでした。続行するには、新規ターミナルを開いてください。",
-            "sourceRestoring": "このターミナルを再接続しています — その出力が再確立されています。セッションはまだ実行中です。"
+            "sourceRestoring": "このターミナルを再接続しています — その出力が再確立されています。セッションはまだ実行中です。",
+            "ptyAllocationLimit": "システムはこれ以上 pty デバイスを割り当てられません。Orca または他のプログラムで使っていないターミナルをいくつか閉じてから、もう一度お試しください。",
+            "terminalProcessLimit": "システムはこれ以上ターミナルプロセスを起動できません。使っていないターミナルを閉じるか、不要なプロセスを終了してから、もう一度お試しください。"
           },
           "TerminalProcessExitOverlay": {
             "capacityTitle": "Git Bash のコンソール上限に達しました",
@@ -3093,7 +3097,7 @@
             "missing": {
               "tui": {
                 "title": "This ZCode build has no terminal UI",
-                "description": "Orca's hooks installed correctly \u2014 the zcode on your PATH just cannot open a session. The ZCode desktop app bundles the agent runtime without its terminal UI. Install a zcode that ships the TUI, then run zcode outside Orca to confirm."
+                "description": "Orca's hooks installed correctly — the zcode on your PATH just cannot open a session. The ZCode desktop app bundles the agent runtime without its terminal UI. Install a zcode that ships the TUI, then run zcode outside Orca to confirm."
               }
             }
           },
@@ -3239,6 +3243,9 @@
           "TerminalQuickCommandsSubmenu": {
             "3ccc7981bb": "ホストが利用不可",
             "54f29b7c0d": "ホストを読み込み中…"
+          },
+          "TerminalRestoringPlaceholder": {
+            "restoring": "ターミナルを復元中…"
           }
         }
       },
@@ -3666,7 +3673,9 @@
             "grokUsageMenu": "Grok の使用状況",
             "floatingTerminalNewActivity": "{{label}}、新規アクティビティ",
             "codexSignInSuccess": "Codex にサインインしました",
-            "codexSignInError": "Codex のサインインに失敗しました。もう一度お試しください。"
+            "codexSignInError": "Codex のサインインに失敗しました。もう一度お試しください。",
+            "cursorUsageMenu": "Cursor の使用状況",
+            "hiddenUsageProviders": "ほかに: {{value0}}"
           },
           "StatusBarUsageEmptyCta": {
             "828c764a79": "アカウントを接続する",
@@ -3841,6 +3850,13 @@
               "noSubscription": {
                 "label": "サブスクリプションなし"
               }
+            },
+            "cursor": {
+              "expired": {
+                "label": "サインインの有効期限切れ",
+                "message": "Orca を実行しているコンピュータのターミナルで cursor-agent login を実行し、使用状況を再試行してください。"
+              },
+              "plan": "プラン"
             }
           },
           "SshTargetStatusRow": {
@@ -5204,7 +5220,9 @@
           "69969ba364": "送信中…",
           "imageReadFailed": "添付された画像を読み取れませんでした。もう一度添付してください。",
           "attachWhileSending": "現在のフィードバックの送信が完了してから、画像を追加してください。",
-          "imagesNotDelivered": "フィードバックを送信しましたが、画像が届いたかどうかは確認できませんでした。"
+          "imagesNotDelivered": "フィードバックを送信しましたが、画像が届いたかどうかは確認できませんでした。",
+          "imagesNotIncluded": "フィードバックを送信しました。スクリーンショットをアップロードできなかったため、含まれていません。",
+          "imagesRejected": "フィードバックを送信しました。スクリーンショットが大きすぎてアップロードできなかったため、含まれていません。"
         },
         "SidebarFilter": {
           "e3b3898218": "プロジェクトを追加",
@@ -6164,7 +6182,8 @@
         },
         "SidebarFeedbackImageAttachments": {
           "attachImages": "Attach",
-          "removeImage": "{{fileName}} を削除"
+          "removeImage": "{{fileName}} を削除",
+          "screenshotsHint": "スクリーンショットを最大 {{count}} 件、合計 {{maxSize}} まで添付できます"
         },
         "WorkspaceKanbanSearchField": {
           "bdb753c78d": "一致するワークスペースはありません",
@@ -8900,7 +8919,18 @@
             "b2c4e7f1a8": "終点",
             "3a9b6d2c4e": "APIキー",
             "5d8f1a3b7c": "中国",
-            "7e2a4b8c1d": "海外"
+            "7e2a4b8c1d": "海外",
+            "cursor": {
+              "description": "このコンピュータに既にある Cursor のサインイン（cursor-agent login）から読み取った月間プラン使用状況。",
+              "kw": {
+                "cursor": "cursor",
+                "rateLimit": "レート制限",
+                "spend": "追加料金",
+                "statusBar": "ステータスバー",
+                "usage": "使用量"
+              },
+              "title": "Cursor の使用状況"
+            }
           }
         },
         "advanced": {
@@ -9156,6 +9186,13 @@
               "close": "近い",
               "notification": "通知領域",
               "background": "背景"
+            },
+            "cursor": {
+              "description": "このコンピュータの Cursor サインインから月間 Cursor プラン使用状況を表示します。",
+              "kw": {
+                "cursor": "cursor"
+              },
+              "title": "Cursor の使用状況"
             }
           }
         },
@@ -11994,6 +12031,31 @@
         "TerminalRenderingSection": {
           "6d4c55bacc": "インライン画像",
           "fffab5890b": "SIXEL、iTerm2 (IIP)、および Kitty グラフィックスプロトコルを使用して、ターミナルに画像を直接表示します。"
+        },
+        "CursorAccountsSection": {
+          "dashboardLink": "Cursor ダッシュボード",
+          "expired": "サインインの有効期限が切れています — Orca を実行しているコンピュータで cursor-agent login を実行し、「使用状況を更新」をクリックしてください。",
+          "loading": "読み込み中…",
+          "noAllowance": "Cursor によると、このアカウントには使用量の割り当てがありません。",
+          "planTotal": "プラン",
+          "refreshUsage": "使用状況を更新",
+          "resets": "{{when}} にリセット",
+          "signedIn": "サインイン済み",
+          "signedInFrom": "サインイン済み。Orca は {{source}} に保存されたセッションを読み取ります。",
+          "signedInGeneric": "サインイン済み。Orca はこのコンピュータに保存された Cursor セッションを読み取ります。",
+          "signedOut": "このコンピュータに Cursor のサインインが見つかりません",
+          "signedOutHelp": "Cursor IDE でサインインするか、ターミナルで cursor-agent login を実行してから、ここで「使用状況を更新」をクリックしてください。",
+          "source": {
+            "cli": "Cursor CLI 認証ファイル",
+            "desktop": "Cursor IDE",
+            "keychain": "macOS キーチェーン（cursor-agent）"
+          },
+          "staleUsage": "最後に確認できた使用状況 — 最新の更新に失敗しました: {{reason}}",
+          "subtitle": "このコンピュータに既にある Cursor のサインインから、月間の Cursor プラン使用状況を表示します。Orca は読み取るだけで、Cursor のログインを変更することはありません。",
+          "title": "Cursor",
+          "usageDescription": "Cursor は請求サイクルとともにリセットされる 2 つのプールの利用に課金し、使い切るとオンデマンドの追加料金が発生します。",
+          "usageLabel": "使用量",
+          "usageTitle": "月間プラン使用状況"
         }
       },
       "right": {
@@ -14798,6 +14860,7 @@
           "f1aa04b5cf": "このファイル",
           "8b87612461": "すべての未送信のメモ"
         },
+        "diffCommentSaveFailed": "コメントの保存に失敗しました",
         "DiffSectionBody": {
           "35d6afb5be": "バイナリファイルが変更されました",
           "cef4cf0ff5": "再試行",
@@ -14919,6 +14982,7 @@
           "notPython": "そのファイルは Python インタープリターではありません。",
           "interrupt": "中断",
           "restart": "カーネルを再起動",
+          "trustFirst": "先にセルを実行して、このノートブックを信頼してください",
           "runAll": "すべて実行",
           "clearAll": "すべての出力をクリア",
           "notResponding": "応答がありません。カーネルを再起動してください",
@@ -14934,11 +14998,26 @@
           "noPython": "このコンピュータに Python が見つかりません。[python.org](https://www.python.org/downloads/) からインストールして、セルを再実行してください。",
           "kernelDied": "カーネルが停止しました。",
           "localOnly": "ノートブックセルはこのコンピュータ上のファイルでのみ実行できます。",
-          "pythonOnly": "Orca では Python ノートブックのみ実行できます。"
+          "pythonOnly": "Orca では Python ノートブックのみ実行できます。",
+          "commandCopied": "コマンドをコピーしました",
+          "createVenv": ".venv を作成",
+          "createVenvItem": "仮想環境を作成…",
+          "createVenvTitle": "仮想環境を作成しますか？",
+          "creatingButton": "作成中…",
+          "creatingVenvDescription": "{{folder}} に .venv を作成し、ipykernel をインストールしています。数分かかることがあります。",
+          "creatingVenvTitle": "仮想環境を作成中…",
+          "installingButton": "インストール中…",
+          "installingDescription": "pip で '{{env}}' に ipykernel をインストールしています。数分かかることがあります。",
+          "installingTitle": "ipykernel をインストール中…",
+          "kernelCreatingVenv": ".venv を作成中…",
+          "setupFailed": "処理に失敗しました。Python の出力:",
+          "tryAgain": "再試行",
+          "useAnotherPython": "別の Python を使用…",
+          "venvDescription": "Orca は '{{env}}' から {{folder}} に .venv を作成し、ipykernel をインストールして、このノートブックをそこで実行します。"
         },
         "MarkdownPreview": {
           "e4683f70c4": "キャンセル",
-          "d737791433": "AI に関するメモを追加",
+          "d737791433": "AI 向けのメモを追加",
           "b1bfc04034": "選択したテキスト",
           "f37b98999e": "このメモ",
           "2b2b31382c": "フロントマター",
@@ -15425,7 +15504,10 @@
             "2b3ce6d394": "キャンセル",
             "e05063cfc1": "{{value0}} 行目",
             "c845170b3b": "行 {{value0}}-{{value1}}",
-            "commentTooLarge": "コメントが大きすぎるため安全に送信できません。"
+            "commentTooLarge": "コメントが大きすぎるため安全に送信できません。",
+            "f6c449191e": "AI 向けのメモを追加",
+            "5fa4bfebaa": "メモを追加",
+            "5e9b3d0c2e": "追加中…"
           },
           "useDiffCommentDecorator": {
             "995fa28b50": "このメモ"
@@ -17157,6 +17239,13 @@
         "dispatchRejected": "Agent が “continue” メッセージを拒否しました。チャットを開いて自分で送信してください。",
         "unsupported": "このチャットは Orca で再開できません。開いて停止位置を確認してください。",
         "fallback": "Orca はこのチャットを再開できませんでした。開いて手動で続けてください。"
+      },
+      "web": {
+        "preloadApi": {
+          "cursorAccounts": {
+            "hostOnly": "Cursor のサインイン詳細は、Orca を実行しているコンピュータでのみ読み取れます。"
+          }
+        }
       }
     },
     "i18n": {
@@ -17260,6 +17349,56 @@
       }
     },
     "native-chat": {
+      "writeNotice": {
+        "notDoneReadHistory": "このチャットの履歴を読み込めませんでした。",
+        "notDoneSend": "メッセージは送信されませんでした。",
+        "tryAgainComposerSend": "もう一度送信してください。",
+        "notDoneStop": "Agent は停止されませんでした。",
+        "notDoneStopTask": "バックグラウンドタスクは停止されませんでした。",
+        "notDoneStopTasks": "バックグラウンドタスクは停止されませんでした。",
+        "notDoneAnswer": "回答は送信されませんでした。",
+        "notDoneOption": "設定は変更されませんでした。",
+        "notDoneCommand": "コマンドは実行されませんでした。",
+        "notDoneGoal": "目標は変更されませんでした。",
+        "restartFailed": "Agent を再起動できませんでした。",
+        "capacity": "Orca が過去 1 日に受け取ったリクエストが多すぎます。",
+        "outcomeUnknown": "Orca は何が起きたかを確認できませんでした。チャットを確認してください。",
+        "questionChanged": "この質問はすでに回答済みか、変更されています。",
+        "historyUnreadable": "Orca はこのチャットの保存済み履歴を読み取れませんでした。",
+        "historyUnusable": "このチャットを読み込めません。",
+        "historyUnavailable": "Orca は現在このチャットの履歴を開けませんでした。",
+        "unsupported": "このチャットを実行している Orca はこの操作に対応していません。Orca を更新してから、もう一度お試しください。",
+        "unreachable": "Orca は Agent に接続できませんでした。",
+        "recordFailed": "Orca はこのチャットの履歴に記録できませんでした。",
+        "conversationCleared": "この会話はクリアされました。",
+        "openCurrentConversation": "続けるには、現在の会話を開いてください。",
+        "clearUnfinished": "前回の /clear は完了しませんでした。",
+        "commandRunning": "/compact または /clear がまだ実行中です。",
+        "waitForCommand": "/compact または /clear が終わるまでお待ちください。",
+        "agentStarting": "Agent はまだ起動中です。",
+        "waitForStart": "Agent の起動が終わるまでお待ちください。",
+        "turnActive": "Agent はまだ応答中です。",
+        "waitForTurn": "Agent の応答が終わるまで待つか、Agent を停止してください。",
+        "promptPending": "Agent は質問または承認への回答を待っています。",
+        "answerFirst": "先に質問または承認に回答してください。",
+        "backgroundTasksRunning": "バックグラウンドタスクがまだ実行中です。",
+        "waitForBackgroundTasks": "バックグラウンドタスクが終わるまでお待ちください。",
+        "messagesUnsettled": "以前に送信したメッセージがまだ確認されていません。",
+        "settleEarlierMessage": "以前のメッセージが届くまで待つか、再試行してください。",
+        "optionRejected": "Agent はこの設定を受け入れませんでした。",
+        "goalsUnsupported": "この Agent は目標に対応していません。",
+        "agentRefused": "Agent がこれを拒否しました。",
+        "ownerUnproven": "Orca は、このチャットの以前の Agent が停止したことをまだ確認できていません。",
+        "reopenChat": "もう一度確認するには、チャットを開き直してください。",
+        "terminalAgentHoldsChat": "このチャットはまだターミナルの Agent で開かれています。",
+        "quitTerminalAgent": "ここでチャットを続けるには、その Agent を終了してください。",
+        "hostReconciling": "Orca は再起動後、このチャットをまだ確認しています。",
+        "waitMoment": "しばらくお待ちください。",
+        "recordUnreadable": "Orca はこのチャットの保存済みの状態を読み取れませんでした。",
+        "chatNotFound": "このチャットを実行している Orca には、このチャットの記録がありません。",
+        "startNewChat": "続けるには、新しいチャットを開始してください。",
+        "tryAgain": "もう一度お試しください。"
+      },
       "composer": {
         "imageUnsupported": "この Agent では画像の貼り付けはサポートされていません。",
         "send": "送信",
@@ -17400,8 +17539,8 @@
         "responding": "Agent が応答中です",
         "working": "処理中…",
         "thinking": "考え",
-        "workingFor": "{{value0}} で働いています",
-        "workedFor": "{{value0}}で働いていました",
+        "workingFor": "{{value0}} 処理中",
+        "workedFor": "{{value0}} で完了",
         "toggleDetails": "ターンの詳細を切り替えます"
       },
       "jumpToLatest": "最新にジャンプ",
@@ -17416,7 +17555,8 @@
         },
         "error": {
           "title": "会話を読み込めませんでした",
-          "subtitle": "トランスクリプトを読み取ることができませんでした。作業を続けるには、ターミナルに切り替えてください。"
+          "subtitle": "トランスクリプトを読み取ることができませんでした。作業を続けるには、ターミナルに切り替えてください。",
+          "retryingSubtitle": "トランスクリプトを読み取ることができませんでした。Orca は読み込みを再試行し続けます。"
         },
         "pairHost": "ホストをペアリングして、Agent のチャット履歴を表示します。",
         "notAgent": {
@@ -17784,7 +17924,7 @@
           "appliedFilters": "適用されたフィルター",
           "removeFilter": "フィルター {{value0}} を削除します",
           "chip": {
-            "idleDays": "アイドル {{value0}}d+",
+            "idleDays": "アイドル {{value0}}日以上",
             "neverVisited": "訪れたことがない",
             "minSize": "少なくとも {{value0}} MB",
             "maxSize": "最大 {{value0}} MB",
@@ -17920,9 +18060,9 @@
     "cmd-j": {
       "paletteSessionAge": {
         "minutes": "{{value0}}分",
-        "hours": "{{value0}}h",
-        "days": "{{value0}}d",
-        "underOneMinute": "<1m"
+        "hours": "{{value0}}時間",
+        "days": "{{value0}}日",
+        "underOneMinute": "<1分"
       }
     },
     "settings": {
@@ -18168,6 +18308,7 @@
       "needsInput": "入力待ち",
       "working": "処理中",
       "stopped": "停止",
+      "failed": "失敗",
       "finished": "完了"
     }
   },
@@ -18200,6 +18341,52 @@
       "unassignedInstruction": "フォーカスされたペインで音声ディクテーションを開始する前に、ディクテーションショートカットを割り当てます。",
       "settingsInstruction": "いつでもモデル、ディクテーションモード、ショートカットを変更できます。",
       "settingsLink": "設定→音声"
+    },
+    "sessionSearch": {
+      "ageHours": "2時間前",
+      "ageMinutes": "12分前",
+      "ageYesterday": "1日前",
+      "agentsInstruction": "Agent も検索できます。「ログインタイムアウトを修正したセッションを探して」と頼んでみてください。",
+      "consentInstruction": "いつでも以下で変更またはオフにできます:",
+      "continueInBackground": "バックグラウンドで続行",
+      "demoHit1Age": "3日前",
+      "demoHit1Snippet": "[[ログインタイムアウト]]を 30 秒に引き上げ、トークン更新時の再試行を追加しました。",
+      "demoHit1Title": "不安定な認証リダイレクトの修正",
+      "demoHit2Age": "1週間前",
+      "demoHit2Snippet": "スリープ復帰後に[[ログイン]]ページが[[タイムアウト]]で止まるのはなぜですか？",
+      "demoHit2Title": "スリープ後のセッション更新",
+      "demoHit3Age": "2週間前",
+      "demoHit3Snippet": "[[ログインタイムアウト]]の経路をエンドツーエンドでカバーするテストを追加しました。",
+      "demoHit3Title": "認証 E2E の強化",
+      "demoHit4Age": "5日前",
+      "demoHit4Snippet": "[[ロールバック]]では新規インデックスを先に削除し、古いカラムを復元します。",
+      "demoHit4Title": "注文テーブルの移行",
+      "demoHit5Age": "3週間前",
+      "demoHit5Snippet": "再試行の前に[[移行]][[ロールバック]]計画を書いてもらえますか？",
+      "demoHit5Title": "ステージングのデプロイに失敗",
+      "demoHit6Age": "1か月前",
+      "demoHit6Snippet": "ここの[[移行]]は enum の名前変更を除きすべて可逆です。",
+      "demoHit6Title": "スキーマレビューメモ",
+      "demoQuery": "ログインタイムアウト",
+      "demoQuery2": "移行 ロールバック",
+      "demoRoleAssistant": "アシスタント",
+      "demoRoleUser": "ユーザー",
+      "enableFailed": "セッション検索をオンにできませんでした。再試行してください。",
+      "indexingDescription": "過去の Agent の会話を読み取り、検索できるようにしています。数分かかることがあります。",
+      "indexingTitle": "Agent セッションをインデックス作成中",
+      "progressStarting": "セッションを探しています…",
+      "readyDescription": "このコンピュータ上のすべての Agent セッションを、会話内容から検索できるようになりました。",
+      "readyTitle": "セッション検索の準備ができました",
+      "readyToast": "セッション検索の準備ができました",
+      "readyToastOpen": "オープン",
+      "recent1Text": "検索エントリをワークフロー配下に移動し、テストを更新しました。",
+      "recent1Title": "設定サイドバーの整理",
+      "recent2Text": "依存関係を更新し、ビルドが通ることを確認します。",
+      "recent2Title": "ロックファイルの更新",
+      "recent3Text": "メモの初版です。分野別にまとめています。",
+      "recent3Title": "リリースノートの下書き",
+      "settingsLink": "設定 → Agent セッションの検索",
+      "startSearching": "検索を開始"
     }
   },
   "quickOpen": {
diff --git a/src/renderer/src/i18n/locales/ko.json b/src/renderer/src/i18n/locales/ko.json
index abff3e46d18e..cf88bb810291 100644
--- a/src/renderer/src/i18n/locales/ko.json
+++ b/src/renderer/src/i18n/locales/ko.json
@@ -34,7 +34,8 @@
         "resourceUsageToggleDescription": "리소스 관리자를 표시합니다. 클릭하면 CPU, 메모리, 세션, 데몬 제어, 워크스페이스 디스크 스캔을 볼 수 있습니다.",
         "portsToggleDescription": "라이브 워크스페이스 포트를 표시합니다. 워크스페이스 범위 포트 및 외부 수신기를 보려면 클릭하세요.",
         "antigravityToggleDescription": "활성 워크스페이스에 대한 Antigravity 구독 사용량을 표시합니다.",
-        "grokToggleDescription": "Grok CLI로 로그인한 경우 Grok 구독 크레딧 사용량을 표시합니다."
+        "grokToggleDescription": "Grok CLI로 로그인한 경우 Grok 구독 크레딧 사용량을 표시합니다.",
+        "cursorToggleDescription": "cursor-agent 또는 Cursor IDE로 로그인한 경우 Cursor 플랜 사용량을 표시합니다."
       },
       "menuBarIcon": {
         "title": "메뉴 바 아이콘 표시",
@@ -869,7 +870,8 @@
             "tooMany": "You can attach up to {{maxCount}} images.",
             "dimensionsTooLarge": "{{fileName}} has dimensions that are too large to preview safely.",
             "invalidImage": "{{fileName}} is not a valid supported image.",
-            "additionalErrors": "{{count}} additional images could not be attached."
+            "additionalErrors": "{{count}} additional images could not be attached.",
+            "totalTooLarge": "{{fileName}}을(를) 포함하면 첨부 파일 합계가 {{maxSize}}를 초과합니다."
           }
         }
       },
@@ -3066,7 +3068,9 @@
             "42b283ecfc": "호스트가 저장된 세션을 확인할 수 없기 때문에 Orca가 이 터미널을 안전하게 다시 연결할 수 없습니다. 오르카는 저장된 세션을 변경하지 않고 그대로 두었습니다. 지금 다시 연결을 시도하려면 재시도를 클릭하세요. 그래도 다시 연결할 수 없으면 새 터미널을 엽니다.",
             "e16012e31e": "이 세션을 소유한 터미널 데몬이 종료되었으므로 세션과 해당 스크롤백을 복구할 수 없습니다. 계속하려면 새 터미널을 여세요.",
             "sessionUnavailable": "Orca가 호스트에서 이 창의 터미널 세션에 다시 연결할 수 없습니다. 계속하려면 새 터미널을 여세요.",
-            "sourceRestoring": "이 터미널을 다시 연결하는 중 - 출력이 다시 설정되고 있습니다. 세션이 아직 실행 중입니다."
+            "sourceRestoring": "이 터미널을 다시 연결하는 중 - 출력이 다시 설정되고 있습니다. 세션이 아직 실행 중입니다.",
+            "ptyAllocationLimit": "시스템에서 더 이상 pty 장치를 할당할 수 없습니다. Orca 또는 다른 프로그램에서 사용하지 않는 터미널을 몇 개 닫은 후 다시 시도하세요.",
+            "terminalProcessLimit": "시스템에서 터미널 프로세스를 더 시작할 수 없습니다. 사용하지 않는 터미널을 닫거나 불필요한 프로세스를 종료한 후 다시 시도하세요."
           },
           "TerminalProcessExitOverlay": {
             "capacityTitle": "Git Bash 콘솔 한도에 도달했습니다",
@@ -3093,7 +3097,7 @@
             "missing": {
               "tui": {
                 "title": "This ZCode build has no terminal UI",
-                "description": "Orca's hooks installed correctly \u2014 the zcode on your PATH just cannot open a session. The ZCode desktop app bundles the agent runtime without its terminal UI. Install a zcode that ships the TUI, then run zcode outside Orca to confirm."
+                "description": "Orca's hooks installed correctly — the zcode on your PATH just cannot open a session. The ZCode desktop app bundles the agent runtime without its terminal UI. Install a zcode that ships the TUI, then run zcode outside Orca to confirm."
               }
             }
           },
@@ -3239,6 +3243,9 @@
           "TerminalQuickCommandsSubmenu": {
             "3ccc7981bb": "호스트를 사용할 수 없음",
             "54f29b7c0d": "호스트 로드 중…"
+          },
+          "TerminalRestoringPlaceholder": {
+            "restoring": "터미널 복원 중…"
           }
         }
       },
@@ -3666,7 +3673,9 @@
             "grokUsageMenu": "Grok 사용량",
             "floatingTerminalNewActivity": "{{label}}, 새 활동",
             "codexSignInSuccess": "Codex에 로그인했습니다",
-            "codexSignInError": "Codex 로그인에 실패했습니다. 다시 시도해 주세요."
+            "codexSignInError": "Codex 로그인에 실패했습니다. 다시 시도해 주세요.",
+            "cursorUsageMenu": "Cursor 사용량",
+            "hiddenUsageProviders": "그 외: {{value0}}"
           },
           "StatusBarUsageEmptyCta": {
             "828c764a79": "계정 연결",
@@ -3841,6 +3850,13 @@
               "noSubscription": {
                 "label": "구독 없음"
               }
+            },
+            "cursor": {
+              "expired": {
+                "label": "로그인 만료",
+                "message": "Orca가 실행 중인 컴퓨터의 터미널에서 cursor-agent login을 실행한 뒤 사용량을 다시 시도하세요."
+              },
+              "plan": "플랜"
             }
           },
           "SshTargetStatusRow": {
@@ -5204,7 +5220,9 @@
           "69969ba364": "전송 중…",
           "imageReadFailed": "Could not read the attached images. Try attaching them again.",
           "attachWhileSending": "Wait for the current feedback to finish sending before attaching more images.",
-          "imagesNotDelivered": "Feedback sent, but image delivery could not be confirmed."
+          "imagesNotDelivered": "Feedback sent, but image delivery could not be confirmed.",
+          "imagesNotIncluded": "피드백을 보냈습니다. 스크린샷을 업로드하지 못해 포함되지 않았습니다.",
+          "imagesRejected": "피드백을 보냈습니다. 스크린샷이 너무 커서 업로드하지 못해 포함되지 않았습니다."
         },
         "SidebarFilter": {
           "e3b3898218": "프로젝트 추가",
@@ -6164,7 +6182,8 @@
         },
         "SidebarFeedbackImageAttachments": {
           "attachImages": "Attach",
-          "removeImage": "Remove {{fileName}}"
+          "removeImage": "Remove {{fileName}}",
+          "screenshotsHint": "최대 {{count}}장, 총 {{maxSize}}까지 스크린샷을 첨부하세요."
         },
         "WorkspaceKanbanSearchField": {
           "bdb753c78d": "일치하는 워크스페이스가 없습니다",
@@ -8863,7 +8882,18 @@
             "b2c4e7f1a8": "끝점",
             "3a9b6d2c4e": "API 키",
             "5d8f1a3b7c": "중국",
-            "7e2a4b8c1d": "해외"
+            "7e2a4b8c1d": "해외",
+            "cursor": {
+              "description": "이 컴퓨터에 이미 있는 Cursor 로그인(cursor-agent login)에서 읽은 월간 플랜 사용량입니다.",
+              "kw": {
+                "cursor": "cursor",
+                "rateLimit": "속도 제한",
+                "spend": "지출",
+                "statusBar": "상태 표시줄",
+                "usage": "사용량"
+              },
+              "title": "Cursor 사용량"
+            }
           }
         },
         "advanced": {
@@ -9119,6 +9149,13 @@
               "close": "닫다",
               "notification": "알림 영역",
               "background": "배경"
+            },
+            "cursor": {
+              "description": "이 컴퓨터의 Cursor 로그인에서 월간 Cursor 플랜 사용량을 표시합니다.",
+              "kw": {
+                "cursor": "cursor"
+              },
+              "title": "Cursor 사용량"
             }
           }
         },
@@ -11994,6 +12031,31 @@
         "TerminalRenderingSection": {
           "6d4c55bacc": "인라인 이미지",
           "fffab5890b": "SIXEL, iTerm2(IIP) 및 Kitty 그래픽 프로토콜을 사용하여 터미널에 이미지를 직접 표시합니다."
+        },
+        "CursorAccountsSection": {
+          "dashboardLink": "Cursor 대시보드",
+          "expired": "로그인이 만료되었습니다 — Orca가 실행 중인 컴퓨터에서 cursor-agent login을 실행한 뒤 사용량 새로고침을 클릭하세요.",
+          "loading": "로드 중…",
+          "noAllowance": "Cursor에서 이 계정에 사용 한도가 없다고 보고했습니다.",
+          "planTotal": "플랜",
+          "refreshUsage": "사용량 새로고침",
+          "resets": "{{when}}에 초기화",
+          "signedIn": "로그인됨",
+          "signedInFrom": "로그인되었습니다. Orca는 {{source}}에 저장된 세션을 읽습니다.",
+          "signedInGeneric": "로그인되었습니다. Orca는 이 컴퓨터에 저장된 Cursor 세션을 읽습니다.",
+          "signedOut": "이 컴퓨터에서 Cursor 로그인을 찾을 수 없습니다",
+          "signedOutHelp": "Cursor IDE로 로그인하거나 터미널에서 cursor-agent login을 실행한 뒤 여기서 사용량 새로고침을 클릭하세요.",
+          "source": {
+            "cli": "Cursor CLI 인증 파일",
+            "desktop": "Cursor IDE",
+            "keychain": "macOS 키체인(cursor-agent)"
+          },
+          "staleUsage": "마지막으로 확인된 사용량 — 최신 새로고침이 실패했습니다: {{reason}}",
+          "subtitle": "이 컴퓨터에 이미 있는 로그인에서 Cursor 월간 플랜 사용량을 보여줍니다. Orca는 읽기만 하며 Cursor 로그인을 변경하지 않습니다.",
+          "title": "Cursor",
+          "usageDescription": "Cursor는 요금 주기에 따라 초기화되는 두 가지 풀과, 소진 후에 발생하는 주문형 지출로 과금합니다.",
+          "usageLabel": "사용량",
+          "usageTitle": "월간 플랜 사용량"
         }
       },
       "right": {
@@ -14798,6 +14860,7 @@
           "f1aa04b5cf": "이 파일",
           "8b87612461": "보내지 않은 모든 메모"
         },
+        "diffCommentSaveFailed": "댓글을 저장하지 못했습니다.",
         "DiffSectionBody": {
           "35d6afb5be": "바이너리 파일이 변경됨",
           "cef4cf0ff5": "다시 시도",
@@ -14919,6 +14982,7 @@
           "notPython": "해당 파일은 Python 인터프리터가 아닙니다.",
           "interrupt": "중단",
           "restart": "커널 다시 시작",
+          "trustFirst": "먼저 셀을 실행하여 이 노트북을 신뢰하세요",
           "runAll": "모두 실행",
           "clearAll": "모든 출력 지우기",
           "notResponding": "응답 없음. 커널을 다시 시작하세요",
@@ -14934,11 +14998,26 @@
           "noPython": "이 컴퓨터에서 Python을 찾을 수 없습니다. [python.org](https://www.python.org/downloads/)에서 설치한 뒤 셀을 다시 실행하세요.",
           "kernelDied": "커널이 종료되었습니다.",
           "localOnly": "노트북 셀은 이 컴퓨터의 파일에 대해서만 실행할 수 있습니다.",
-          "pythonOnly": "Orca에서는 Python 노트북만 실행할 수 있습니다."
+          "pythonOnly": "Orca에서는 Python 노트북만 실행할 수 있습니다.",
+          "commandCopied": "명령이 복사되었습니다.",
+          "createVenv": ".venv 만들기",
+          "createVenvItem": "가상 환경 만들기…",
+          "createVenvTitle": "가상 환경을 만들까요?",
+          "creatingButton": "만드는 중…",
+          "creatingVenvDescription": "{{folder}}에 .venv를 만들고 ipykernel을 설치하고 있습니다. 1분 정도 걸릴 수 있습니다.",
+          "creatingVenvTitle": "가상 환경 만드는 중…",
+          "installingButton": "설치 중…",
+          "installingDescription": "pip로 '{{env}}'에 ipykernel을 설치하고 있습니다. 1분 정도 걸릴 수 있습니다.",
+          "installingTitle": "ipykernel 설치 중…",
+          "kernelCreatingVenv": ".venv 만드는 중…",
+          "setupFailed": "실패했습니다. Python 출력:",
+          "tryAgain": "다시 시도",
+          "useAnotherPython": "다른 Python 사용…",
+          "venvDescription": "Orca가 '{{env}}'에서 {{folder}}에 .venv를 만들고, ipykernel을 설치한 뒤 이 노트북을 거기서 실행합니다."
         },
         "MarkdownPreview": {
           "e4683f70c4": "취소",
-          "d737791433": "AI에 대한 메모 추가",
+          "d737791433": "AI에게 전달할 메모 추가",
           "b1bfc04034": "선택한 텍스트",
           "f37b98999e": "이 메모",
           "2b2b31382c": "머리말",
@@ -15425,7 +15504,10 @@
             "2b3ce6d394": "취소",
             "e05063cfc1": "라인 {{value0}}",
             "c845170b3b": "라인 {{value0}}-{{value1}}",
-            "commentTooLarge": "댓글이 너무 길어 안전하게 제출할 수 없습니다."
+            "commentTooLarge": "댓글이 너무 길어 안전하게 제출할 수 없습니다.",
+            "f6c449191e": "AI에게 전달할 메모 추가",
+            "5fa4bfebaa": "메모 추가",
+            "5e9b3d0c2e": "추가 중..."
           },
           "useDiffCommentDecorator": {
             "995fa28b50": "이 메모"
@@ -17157,6 +17239,13 @@
         "dispatchRejected": "에이전트가 “continue” 메시지를 거부했습니다. 채팅을 열어 직접 보내세요.",
         "unsupported": "이 채팅은 Orca에서 재개할 수 없습니다. 열어서 중단된 위치를 확인하세요.",
         "fallback": "Orca가 이 채팅을 재개하지 못했습니다. 열어서 수동으로 계속하세요."
+      },
+      "web": {
+        "preloadApi": {
+          "cursorAccounts": {
+            "hostOnly": "Cursor 로그인 정보는 Orca가 실행 중인 컴퓨터에서만 읽을 수 있습니다."
+          }
+        }
       }
     },
     "i18n": {
@@ -17260,6 +17349,56 @@
       }
     },
     "native-chat": {
+      "writeNotice": {
+        "notDoneReadHistory": "이 채팅의 기록을 불러오지 못했습니다.",
+        "notDoneSend": "메시지가 전송되지 않았습니다.",
+        "tryAgainComposerSend": "다시 보내세요.",
+        "notDoneStop": "에이전트가 중지되지 않았습니다.",
+        "notDoneStopTask": "백그라운드 작업이 중지되지 않았습니다.",
+        "notDoneStopTasks": "백그라운드 작업이 중지되지 않았습니다.",
+        "notDoneAnswer": "답변이 전송되지 않았습니다.",
+        "notDoneOption": "설정이 변경되지 않았습니다.",
+        "notDoneCommand": "명령이 실행되지 않았습니다.",
+        "notDoneGoal": "목표가 변경되지 않았습니다.",
+        "restartFailed": "에이전트를 다시 시작하지 못했습니다.",
+        "capacity": "Orca가 지난 하루 동안 너무 많은 요청을 받았습니다.",
+        "outcomeUnknown": "Orca가 무슨 일이 있었는지 확인하지 못했습니다. 채팅을 확인하세요.",
+        "questionChanged": "이 질문은 이미 답변되었거나 변경되었습니다.",
+        "historyUnreadable": "Orca가 이 채팅의 저장된 기록을 읽지 못했습니다.",
+        "historyUnusable": "이 채팅을 불러올 수 없습니다.",
+        "historyUnavailable": "Orca가 지금 이 채팅의 기록을 열지 못했습니다.",
+        "unsupported": "이 채팅을 실행 중인 Orca가 이 기능을 지원하지 않습니다. Orca를 업데이트한 후 다시 시도하세요.",
+        "unreachable": "Orca가 에이전트에 연결하지 못했습니다.",
+        "recordFailed": "Orca가 이 채팅의 기록에 저장하지 못했습니다.",
+        "conversationCleared": "이 대화는 지워졌습니다.",
+        "openCurrentConversation": "계속하려면 현재 대화를 여세요.",
+        "clearUnfinished": "마지막 /clear가 완료되지 않았습니다.",
+        "commandRunning": "/compact 또는 /clear가 아직 실행 중입니다.",
+        "waitForCommand": "/compact 또는 /clear가 끝날 때까지 기다리세요.",
+        "agentStarting": "에이전트가 아직 시작 중입니다.",
+        "waitForStart": "에이전트가 시작을 마칠 때까지 기다리세요.",
+        "turnActive": "에이전트가 아직 응답 중입니다.",
+        "waitForTurn": "에이전트가 응답을 마칠 때까지 기다리거나 에이전트를 중지하세요.",
+        "promptPending": "에이전트가 질문 또는 승인에 대한 응답을 기다리고 있습니다.",
+        "answerFirst": "먼저 질문 또는 승인에 응답하세요.",
+        "backgroundTasksRunning": "백그라운드 작업이 아직 실행 중입니다.",
+        "waitForBackgroundTasks": "백그라운드 작업이 끝날 때까지 기다리세요.",
+        "messagesUnsettled": "앞서 보낸 메시지가 아직 확인되지 않았습니다.",
+        "settleEarlierMessage": "앞서 보낸 메시지가 전달될 때까지 기다리거나 다시 시도하세요.",
+        "optionRejected": "에이전트가 이 설정을 받아들이지 않았습니다.",
+        "goalsUnsupported": "이 에이전트는 목표를 지원하지 않습니다.",
+        "agentRefused": "에이전트가 이를 거부했습니다.",
+        "ownerUnproven": "Orca가 이 채팅의 이전 에이전트가 중지되었는지 아직 확인하지 못했습니다.",
+        "reopenChat": "다시 확인하려면 채팅을 다시 여세요.",
+        "terminalAgentHoldsChat": "이 채팅은 아직 터미널 에이전트에서 열려 있습니다.",
+        "quitTerminalAgent": "여기에서 채팅을 계속하려면 해당 에이전트를 종료하세요.",
+        "hostReconciling": "Orca가 다시 시작된 후 이 채팅을 아직 확인하고 있습니다.",
+        "waitMoment": "잠시 기다리세요.",
+        "recordUnreadable": "Orca가 이 채팅의 저장된 상태를 읽지 못했습니다.",
+        "chatNotFound": "이 채팅을 실행하는 Orca에 이 채팅의 기록이 없습니다.",
+        "startNewChat": "계속하려면 새 채팅을 시작하세요.",
+        "tryAgain": "다시 시도하세요."
+      },
       "composer": {
         "imageUnsupported": "이 에이전트는 이미지 붙여넣기를 지원하지 않습니다.",
         "send": "보내기",
@@ -17400,9 +17539,9 @@
         "responding": "Agent이 응답 중입니다.",
         "working": "일하고 있는…",
         "thinking": "생각",
-        "workingFor": "{{value0}}에서 근무",
-        "workedFor": "{{value0}}에서 근무함",
-        "toggleDetails": "회전 세부정보 전환"
+        "workingFor": "{{value0}} 작업 중",
+        "workedFor": "{{value0}} 작업 완료",
+        "toggleDetails": "턴 세부정보 전환"
       },
       "jumpToLatest": "최신으로 이동",
       "toggle": {
@@ -17416,7 +17555,8 @@
         },
         "error": {
           "title": "대화를 로드할 수 없습니다.",
-          "subtitle": "스크립트를 읽을 수 없습니다. 계속 작업하려면 terminal로 다시 전환하세요."
+          "subtitle": "스크립트를 읽을 수 없습니다. 계속 작업하려면 terminal로 다시 전환하세요.",
+          "retryingSubtitle": "스크립트를 읽을 수 없습니다. Orca가 계속 다시 불러오기를 시도합니다."
         },
         "pairHost": "호스트를 페어링하여 에이전트 채팅 기록을 확인하세요.",
         "notAgent": {
@@ -17848,7 +17988,7 @@
           "justNow": "방금",
           "minutesAgo": "{{value0}}분 전",
           "hoursAgo": "{{value0}}시간 전",
-          "daysAgo": "{{value0}}d 전"
+          "daysAgo": "{{value0}}일 전"
         },
         "host": {
           "label": "호스트: {{value0}}",
@@ -17919,9 +18059,9 @@
     },
     "cmd-j": {
       "paletteSessionAge": {
-        "minutes": "{{value0}}m",
-        "hours": "{{value0}}h",
-        "days": "{{value0}}d",
+        "minutes": "{{value0}}분",
+        "hours": "{{value0}}시간",
+        "days": "{{value0}}일",
         "underOneMinute": "1분 미만"
       }
     },
@@ -18168,6 +18308,7 @@
       "needsInput": "입력 필요",
       "working": "작업 중",
       "stopped": "중지됨",
+      "failed": "실패함",
       "finished": "완료됨"
     }
   },
@@ -18200,6 +18341,52 @@
       "unassignedInstruction": "초점이 맞춰진 창에서 음성 받아쓰기를 시작하기 전에 받아쓰기 바로가기를 할당하세요.",
       "settingsInstruction": "언제든지 모델, 받아쓰기 모드 또는 바로가기를 변경할 수 있습니다.",
       "settingsLink": "설정 → 음성"
+    },
+    "sessionSearch": {
+      "ageHours": "2시간",
+      "ageMinutes": "12분",
+      "ageYesterday": "1일",
+      "agentsInstruction": "에이전트도 검색할 수 있습니다. 에이전트에게 “로그인 시간 초과를 수정한 세션을 찾아줘”라고 요청해 보세요.",
+      "consentInstruction": "언제든지 다음에서 변경하거나 끄기",
+      "continueInBackground": "백그라운드에서 계속하기",
+      "demoHit1Age": "3일",
+      "demoHit1Snippet": "[[로그인 시간 초과]]를 30초로 늘리고 토큰 새로고침에 재시도를 추가했습니다.",
+      "demoHit1Title": "불안정한 인증 리디렉션 수정",
+      "demoHit2Age": "1주",
+      "demoHit2Snippet": "절전 모드 해제 후 [[로그인]] 페이지가 [[시간 초과]] 후에 멈추는 이유는 무엇인가요?",
+      "demoHit2Title": "절전 후 세션 새로고침",
+      "demoHit3Age": "2주",
+      "demoHit3Snippet": "[[로그인 시간 초과]] 경로를 처음부터 끝까지 다루는 테스트를 추가했습니다.",
+      "demoHit3Title": "인증 e2e 강화",
+      "demoHit4Age": "5일",
+      "demoHit4Snippet": "[[롤백]]이 새 인덱스를 먼저 삭제한 뒤 이전 컬럼을 복원합니다.",
+      "demoHit4Title": "주문 테이블 마이그레이션",
+      "demoHit5Age": "3주",
+      "demoHit5Snippet": "다시 시도하기 전에 [[마이그레이션]] [[롤백]] 계획을 작성해 줄 수 있나요?",
+      "demoHit5Title": "스테이징 배포 실패",
+      "demoHit6Age": "1개월",
+      "demoHit6Snippet": "여기의 모든 [[마이그레이션]]은 enum 이름 변경을 제외하고 되돌릴 수 있습니다.",
+      "demoHit6Title": "스키마 검토 메모",
+      "demoQuery": "로그인 시간 초과",
+      "demoQuery2": "마이그레이션 롤백",
+      "demoRoleAssistant": "어시스턴트",
+      "demoRoleUser": "사용자",
+      "enableFailed": "세션 검색을 켜지 못했습니다. 다시 시도하세요.",
+      "indexingDescription": "Orca가 이전 에이전트 대화를 읽어 검색할 수 있도록 준비하고 있습니다. 몇 분 정도 걸릴 수 있습니다.",
+      "indexingTitle": "에이전트 세션을 색인화하는 중",
+      "progressStarting": "세션을 찾는 중…",
+      "readyDescription": "이제 이 컴퓨터의 모든 에이전트 세션을 대화 내용으로 찾을 수 있습니다.",
+      "readyTitle": "세션 검색이 준비되었습니다",
+      "readyToast": "세션 검색이 준비되었습니다",
+      "readyToastOpen": "열기",
+      "recent1Text": "검색 항목을 워크플로 아래로 옮기고 테스트를 업데이트했습니다.",
+      "recent1Title": "설정 사이드바 정리",
+      "recent2Text": "의존성을 업데이트하고 빌드가 여전히 통과하는지 확인하세요.",
+      "recent2Title": "잠금 파일 업데이트",
+      "recent3Text": "초안 메모입니다. 영역별로 정리했습니다.",
+      "recent3Title": "릴리스 노트 초안",
+      "settingsLink": "설정 → 에이전트 세션 검색",
+      "startSearching": "검색 시작하기"
     }
   },
   "quickOpen": {
diff --git a/src/renderer/src/i18n/locales/zh.json b/src/renderer/src/i18n/locales/zh.json
index d2b845662602..4f7a76e20cc9 100644
--- a/src/renderer/src/i18n/locales/zh.json
+++ b/src/renderer/src/i18n/locales/zh.json
@@ -34,7 +34,8 @@
         "resourceUsageToggleDescription": "显示资源管理器。点击可查看 CPU、内存、会话、守护进程控制和工作区磁盘扫描。",
         "portsToggleDescription": "显示实时工作区端口。点击可查看工作区范围的端口和外部监听器。",
         "antigravityToggleDescription": "显示当前工作区的 Antigravity 订阅使用情况。",
-        "grokToggleDescription": "通过 Grok CLI 登录后显示 Grok 订阅额度使用情况。"
+        "grokToggleDescription": "通过 Grok CLI 登录后显示 Grok 订阅额度使用情况。",
+        "cursorToggleDescription": "通过 cursor-agent 或 Cursor IDE 登录后显示 Cursor 套餐用量。"
       },
       "menuBarIcon": {
         "title": "显示菜单栏图标",
@@ -869,7 +870,8 @@
             "tooMany": "最多可附加 {{maxCount}} 张图片。",
             "dimensionsTooLarge": "{{fileName}} 的尺寸过大，无法安全预览。",
             "invalidImage": "{{fileName}} 不是有效的受支持图片。",
-            "additionalErrors": "还有 {{count}} 张图片无法附加。"
+            "additionalErrors": "还有 {{count}} 张图片无法附加。",
+            "totalTooLarge": "{{fileName}} 将使附件总大小超过 {{maxSize}}。"
           }
         }
       },
@@ -3066,7 +3068,9 @@
             "42b283ecfc": "Orca 无法安全地重新连接此终端，因为主机无法验证其保存的会话。 Orca 保持保存的会话不变。单击“重试”立即尝试重新连接。如果仍然无法重新连接，请打开一个新终端。",
             "e16012e31e": "拥有该会话的终端守护程序已退出，因此该会话及其回滚无法恢复。打开新终端以继续。",
             "sessionUnavailable": "Orca 无法重新连接到主机上此窗格的终端会话。打开新终端以继续。",
-            "sourceRestoring": "重新连接该终端 — 正在重新建立其输出。会话仍在进行。"
+            "sourceRestoring": "重新连接该终端 — 正在重新建立其输出。会话仍在进行。",
+            "ptyAllocationLimit": "系统无法再分配 pty 设备。请在 Orca 或其他程序中关闭一些不用的终端，然后重试。",
+            "terminalProcessLimit": "系统无法再启动终端进程。请关闭不用的终端或退出不用的进程，然后重试。"
           },
           "TerminalProcessExitOverlay": {
             "capacityTitle": "已达到 Git Bash 控制台上限",
@@ -3093,7 +3097,7 @@
             "missing": {
               "tui": {
                 "title": "This ZCode build has no terminal UI",
-                "description": "Orca's hooks installed correctly \u2014 the zcode on your PATH just cannot open a session. The ZCode desktop app bundles the agent runtime without its terminal UI. Install a zcode that ships the TUI, then run zcode outside Orca to confirm."
+                "description": "Orca's hooks installed correctly — the zcode on your PATH just cannot open a session. The ZCode desktop app bundles the agent runtime without its terminal UI. Install a zcode that ships the TUI, then run zcode outside Orca to confirm."
               }
             }
           },
@@ -3239,6 +3243,9 @@
           "TerminalQuickCommandsSubmenu": {
             "3ccc7981bb": "主机不可用",
             "54f29b7c0d": "正在加载主机..."
+          },
+          "TerminalRestoringPlaceholder": {
+            "restoring": "正在恢复终端…"
           }
         }
       },
@@ -3666,7 +3673,9 @@
             "grokUsageMenu": "Grok 使用情况",
             "floatingTerminalNewActivity": "{{label}}，有新活动",
             "codexSignInSuccess": "已登录 Codex",
-            "codexSignInError": "Codex 登录失败，请重试。"
+            "codexSignInError": "Codex 登录失败，请重试。",
+            "cursorUsageMenu": "Cursor 用量",
+            "hiddenUsageProviders": "另有：{{value0}}"
           },
           "StatusBarUsageEmptyCta": {
             "828c764a79": "连接账户",
@@ -3841,6 +3850,13 @@
               "noSubscription": {
                 "label": "无订阅"
               }
+            },
+            "cursor": {
+              "expired": {
+                "label": "登录已过期",
+                "message": "请在运行 Orca 的电脑上的终端中运行 cursor-agent login，然后重新刷新用量。"
+              },
+              "plan": "套餐"
             }
           },
           "SshTargetStatusRow": {
@@ -5204,7 +5220,9 @@
           "69969ba364": "正在发送...",
           "imageReadFailed": "无法读取附加的图片。请重新附加。",
           "attachWhileSending": "请等待当前反馈发送完成，再附加更多图片。",
-          "imagesNotDelivered": "反馈已发送，但无法确认图片已送达。"
+          "imagesNotDelivered": "反馈已发送，但无法确认图片已送达。",
+          "imagesNotIncluded": "反馈已发送。您的截图无法上传，未包含在内。",
+          "imagesRejected": "反馈已发送。您的截图过大，无法上传，未包含在内。"
         },
         "SidebarFilter": {
           "e3b3898218": "添加项目",
@@ -6164,7 +6182,8 @@
         },
         "SidebarFeedbackImageAttachments": {
           "attachImages": "Attach",
-          "removeImage": "Remove {{fileName}}"
+          "removeImage": "Remove {{fileName}}",
+          "screenshotsHint": "最多附加 {{count}} 张截图，总计 {{maxSize}}"
         },
         "WorkspaceKanbanSearchField": {
           "bdb753c78d": "没有匹配的工作区",
@@ -8863,7 +8882,18 @@
             "7e2a4b8c1d": "海外",
             "37020a02c2": "安慰",
             "25591bf95b": "粘贴完整的 opencode.ai Cookie 标头，包括 __Host-console_session，以进行速率限制提取。",
-            "d16378a88f": "极小极大"
+            "d16378a88f": "极小极大",
+            "cursor": {
+              "description": "从此电脑上已有的 Cursor 登录（cursor-agent login）读取每月套餐用量。",
+              "kw": {
+                "cursor": "cursor",
+                "rateLimit": "速率限制",
+                "spend": "支出",
+                "statusBar": "状态栏",
+                "usage": "用量"
+              },
+              "title": "Cursor 用量"
+            }
           }
         },
         "advanced": {
@@ -9119,6 +9149,13 @@
               "close": "关闭",
               "notification": "通知区",
               "background": "背景"
+            },
+            "cursor": {
+              "description": "显示来自此电脑上 Cursor 登录的每月 Cursor 套餐用量。",
+              "kw": {
+                "cursor": "cursor"
+              },
+              "title": "Cursor 用量"
             }
           }
         },
@@ -11994,6 +12031,31 @@
         "TerminalRenderingSection": {
           "6d4c55bacc": "内嵌图像",
           "fffab5890b": "使用 SIXEL、iTerm2 (IIP) 和 Kitty 图形协议直接在终端中显示图像。"
+        },
+        "CursorAccountsSection": {
+          "dashboardLink": "Cursor 仪表盘",
+          "expired": "登录已过期 — 请在运行 Orca 的电脑上执行 cursor-agent login，然后点击“刷新用量”。",
+          "loading": "加载中…",
+          "noAllowance": "Cursor 报告此账号没有可用额度。",
+          "planTotal": "套餐",
+          "refreshUsage": "刷新用量",
+          "resets": "{{when}}重置",
+          "signedIn": "已登录",
+          "signedInFrom": "已登录。Orca 读取存储在{{source}}中的会话。",
+          "signedInGeneric": "已登录。Orca 读取存储在此电脑上的 Cursor 会话。",
+          "signedOut": "在此电脑上未找到 Cursor 登录",
+          "signedOutHelp": "请使用 Cursor IDE 登录，或在终端中运行 cursor-agent login，然后在此点击“刷新用量”。",
+          "source": {
+            "cli": "Cursor CLI 认证文件",
+            "desktop": "Cursor IDE",
+            "keychain": "macOS 钥匙串（cursor-agent）"
+          },
+          "staleUsage": "上次已知用量 — 最近一次刷新失败：{{reason}}",
+          "subtitle": "显示来自此电脑上已有登录的每月 Cursor 套餐用量。Orca 仅读取，不会更改您的 Cursor 登录。",
+          "title": "Cursor",
+          "usageDescription": "Cursor 按两个随账单周期重置的额度池计费，用完后按需计费。",
+          "usageLabel": "用量",
+          "usageTitle": "每月套餐用量"
         }
       },
       "right": {
@@ -14798,6 +14860,7 @@
           "f1aa04b5cf": "这个文件",
           "8b87612461": "所有未发送的笔记"
         },
+        "diffCommentSaveFailed": "保存评论失败",
         "DiffSectionBody": {
           "35d6afb5be": "二进制文件已更改",
           "cef4cf0ff5": "重试",
@@ -14919,6 +14982,7 @@
           "notPython": "该文件不是 Python 解释器。",
           "interrupt": "中断",
           "restart": "重启内核",
+          "trustFirst": "请先运行一个单元格以信任此笔记本",
           "runAll": "全部运行",
           "clearAll": "清除所有输出",
           "notResponding": "无响应。请重启内核",
@@ -14934,7 +14998,22 @@
           "noPython": "在此电脑上未找到 Python。请从 [python.org](https://www.python.org/downloads/) 安装，然后重新运行单元格。",
           "kernelDied": "内核已停止。",
           "localOnly": "笔记本单元格只能针对此电脑上的文件运行。",
-          "pythonOnly": "Orca 中只能运行 Python 笔记本。"
+          "pythonOnly": "Orca 中只能运行 Python 笔记本。",
+          "commandCopied": "命令已复制",
+          "createVenv": "创建 .venv",
+          "createVenvItem": "创建虚拟环境…",
+          "createVenvTitle": "创建虚拟环境？",
+          "creatingButton": "正在创建…",
+          "creatingVenvDescription": "正在 {{folder}} 中创建 .venv 并安装 ipykernel。这可能需要一分钟。",
+          "creatingVenvTitle": "正在创建虚拟环境…",
+          "installingButton": "正在安装…",
+          "installingDescription": "正在使用 pip 将 ipykernel 安装到“{{env}}”。这可能需要一分钟。",
+          "installingTitle": "正在安装 ipykernel…",
+          "kernelCreatingVenv": "正在创建 .venv…",
+          "setupFailed": "操作失败。Python 输出：",
+          "tryAgain": "重试",
+          "useAnotherPython": "使用其他 Python…",
+          "venvDescription": "Orca 将基于“{{env}}”在 {{folder}} 中创建 .venv，安装 ipykernel，并在其中运行此笔记本。"
         },
         "MarkdownPreview": {
           "e4683f70c4": "取消",
@@ -15425,7 +15504,10 @@
             "2b3ce6d394": "取消",
             "e05063cfc1": "行 {{value0}}",
             "c845170b3b": "行 {{value0}}-{{value1}}",
-            "commentTooLarge": "评论过长，无法安全提交。"
+            "commentTooLarge": "评论过长，无法安全提交。",
+            "f6c449191e": "为AI添加注释",
+            "5fa4bfebaa": "添加备注",
+            "5e9b3d0c2e": "添加..."
           },
           "useDiffCommentDecorator": {
             "995fa28b50": "此注"
@@ -17157,6 +17239,13 @@
         "dispatchRejected": "代理拒绝了“continue”消息。请打开聊天并自行发送一条。",
         "unsupported": "此聊天无法由 Orca 恢复。请将其打开以查看停止位置。",
         "fallback": "Orca 无法恢复此聊天。请将其打开以手动继续。"
+      },
+      "web": {
+        "preloadApi": {
+          "cursorAccounts": {
+            "hostOnly": "Cursor 登录详情仅可在运行 Orca 的电脑上读取。"
+          }
+        }
       }
     },
     "i18n": {
@@ -17225,6 +17314,56 @@
   },
   "components": {
     "native-chat": {
+      "writeNotice": {
+        "notDoneReadHistory": "无法加载此聊天的历史记录。",
+        "notDoneSend": "您的消息未发送。",
+        "tryAgainComposerSend": "请重新发送。",
+        "notDoneStop": "智能体未停止。",
+        "notDoneStopTask": "后台任务未停止。",
+        "notDoneStopTasks": "后台任务未停止。",
+        "notDoneAnswer": "您的回答未发送。",
+        "notDoneOption": "设置未更改。",
+        "notDoneCommand": "命令未运行。",
+        "notDoneGoal": "目标未更改。",
+        "restartFailed": "智能体无法重新启动。",
+        "capacity": "Orca 在过去一天内收到的请求过多。",
+        "outcomeUnknown": "Orca 无法确认发生了什么。请查看聊天。",
+        "questionChanged": "此问题已被回答或已更改。",
+        "historyUnreadable": "Orca 无法读取此聊天的已保存历史记录。",
+        "historyUnusable": "无法加载此聊天。",
+        "historyUnavailable": "Orca 目前无法打开此聊天的历史记录。",
+        "unsupported": "运行此聊天的 Orca 不支持此操作。请更新 Orca 后重试。",
+        "unreachable": "Orca 无法连接到智能体。",
+        "recordFailed": "Orca 无法将其记录到此聊天的历史记录中。",
+        "conversationCleared": "此对话已被清除。",
+        "openCurrentConversation": "请打开当前对话以继续。",
+        "clearUnfinished": "上一次 /clear 未完成。",
+        "commandRunning": "/compact 或 /clear 仍在运行。",
+        "waitForCommand": "请等待 /compact 或 /clear 完成。",
+        "agentStarting": "智能体仍在启动。",
+        "waitForStart": "请等待智能体完成启动。",
+        "turnActive": "智能体仍在回复。",
+        "waitForTurn": "请等待智能体完成回复，或将其停止。",
+        "promptPending": "智能体正在等待您回答问题或审批。",
+        "answerFirst": "请先回答问题或审批。",
+        "backgroundTasksRunning": "后台任务仍在运行。",
+        "waitForBackgroundTasks": "请等待后台任务完成。",
+        "messagesUnsettled": "您之前发送的一条消息尚未确认。",
+        "settleEarlierMessage": "请等待之前的消息送达，或重试该消息。",
+        "optionRejected": "智能体未接受此设置。",
+        "goalsUnsupported": "此智能体不支持目标。",
+        "agentRefused": "智能体拒绝了此请求。",
+        "ownerUnproven": "Orca 尚未确认此聊天之前的智能体已停止。",
+        "reopenChat": "请重新打开聊天以再次检查。",
+        "terminalAgentHoldsChat": "此聊天仍在终端智能体中打开。",
+        "quitTerminalAgent": "请退出该智能体，以便在此处继续聊天。",
+        "hostReconciling": "Orca 重启后仍在检查此聊天。",
+        "waitMoment": "请稍候。",
+        "recordUnreadable": "Orca 无法读取此聊天的已保存状态。",
+        "chatNotFound": "运行此聊天的 Orca 没有此聊天的记录。",
+        "startNewChat": "请开始新的聊天以继续。",
+        "tryAgain": "请重试。"
+      },
       "composer": {
         "imageUnsupported": "此智能体不支持粘贴图片。",
         "send": "发送",
@@ -17365,9 +17504,9 @@
         "responding": "智能体正在回复",
         "working": "处理中…",
         "thinking": "思维",
-        "workingFor": "为 {{value0}} 工作",
-        "workedFor": "为 {{value0}} 工作",
-        "toggleDetails": "切换转弯详情"
+        "workingFor": "已工作 {{value0}}",
+        "workedFor": "工作了 {{value0}}",
+        "toggleDetails": "切换回合详情"
       },
       "jumpToLatest": "跳到最新消息",
       "toggle": {
@@ -17381,7 +17520,8 @@
         },
         "error": {
           "title": "无法加载对话",
-          "subtitle": "无法读取记录。请切回终端继续工作。"
+          "subtitle": "无法读取记录。请切回终端继续工作。",
+          "retryingSubtitle": "无法读取记录。Orca 会继续尝试加载。"
         },
         "pairHost": "配对主机以查看智能体聊天记录。",
         "notAgent": {
@@ -17919,10 +18059,10 @@
     },
     "cmd-j": {
       "paletteSessionAge": {
-        "minutes": "{{value0}}米",
-        "hours": "{{value0}}h",
-        "days": "{{value0}}d",
-        "underOneMinute": "<1m"
+        "minutes": "{{value0}}分",
+        "hours": "{{value0}}小时",
+        "days": "{{value0}}天",
+        "underOneMinute": "<1分钟"
       }
     },
     "settings": {
@@ -18168,6 +18308,7 @@
       "needsInput": "需要输入",
       "working": "处理中",
       "stopped": "已停止",
+      "failed": "已失败",
       "finished": "已完成"
     }
   },
@@ -18200,6 +18341,52 @@
       "unassignedInstruction": "在焦点窗格中开始语音听写之前指定听写快捷方式。",
       "settingsInstruction": "随时更改模型、听写模式或快捷方式",
       "settingsLink": "设置 → 语音"
+    },
+    "sessionSearch": {
+      "ageHours": "2小时",
+      "ageMinutes": "12分钟",
+      "ageYesterday": "1天",
+      "agentsInstruction": "您的代理也可以搜索。让它“找到我们修复登录超时的那次会话”。",
+      "consentInstruction": "随时可在以下位置更改或关闭",
+      "continueInBackground": "在后台继续",
+      "demoHit1Age": "3天",
+      "demoHit1Snippet": "将 [[登录超时]] 延长至 30 秒，并在令牌刷新时添加了重试。",
+      "demoHit1Title": "修复不稳定的身份验证重定向",
+      "demoHit2Age": "1周",
+      "demoHit2Snippet": "为什么唤醒后 [[登录]] 页面在 [[超时]] 后卡住？",
+      "demoHit2Title": "睡眠后会话刷新",
+      "demoHit3Age": "2周",
+      "demoHit3Snippet": "添加了覆盖 [[登录超时]] 路径的端到端测试。",
+      "demoHit3Title": "身份验证端到端加固",
+      "demoHit4Age": "5天",
+      "demoHit4Snippet": "[[回滚]] 会先删除新索引，再恢复旧列。",
+      "demoHit4Title": "订单表迁移",
+      "demoHit5Age": "3周",
+      "demoHit5Snippet": "在重试之前，你能写一份 [[迁移]] [[回滚]] 计划吗？",
+      "demoHit5Title": "预发布部署失败",
+      "demoHit6Age": "1个月",
+      "demoHit6Snippet": "这里的每个 [[迁移]] 都是可逆的，除了枚举重命名。",
+      "demoHit6Title": "表结构评审记录",
+      "demoQuery": "登录超时",
+      "demoQuery2": "迁移回滚",
+      "demoRoleAssistant": "助手",
+      "demoRoleUser": "用户",
+      "enableFailed": "无法开启会话搜索。请重试。",
+      "indexingDescription": "Orca 正在读取您过去的代理会话记录，以便您可以搜索它们。这可能需要几分钟。",
+      "indexingTitle": "正在索引您的代理会话",
+      "progressStarting": "正在查找您的会话…",
+      "readyDescription": "现在可以通过会话内容找到此电脑上的每个代理会话。",
+      "readyTitle": "会话搜索已就绪",
+      "readyToast": "会话搜索已就绪",
+      "readyToastOpen": "打开",
+      "recent1Text": "将搜索入口移至“工作流程”下，并更新了测试。",
+      "recent1Title": "整理设置侧边栏",
+      "recent2Text": "更新依赖项并确保构建仍然通过。",
+      "recent2Title": "更新 lockfile",
+      "recent3Text": "这是按领域分组的记录初稿。",
+      "recent3Title": "发布说明草稿",
+      "settingsLink": "设置 → 代理会话搜索",
+      "startSearching": "开始搜索"
     }
   },
   "quickOpen": {
diff --git a/src/renderer/src/i18n/notification-agent-status-locales.test.ts b/src/renderer/src/i18n/notification-agent-status-locales.test.ts
new file mode 100644
index 000000000000..47828fa580a0
--- /dev/null
+++ b/src/renderer/src/i18n/notification-agent-status-locales.test.ts
@@ -0,0 +1,22 @@
+import { describe, expect, it } from 'vitest'
+import en from './locales/en.json'
+import es from './locales/es.json'
+import fr from './locales/fr.json'
+import ja from './locales/ja.json'
+import ko from './locales/ko.json'
+import zh from './locales/zh.json'
+
+// Main words a notification from these keys with an English fallback, so a locale missing one
+// silently notifies in English; no other gate catches it.
+describe('notification agent status locales', () => {
+  it.each(Object.entries({ en, es, fr, ja, ko, zh }))(
+    '%s words every verdict',
+    (_locale, catalog) => {
+      const words = catalog.notifications.agentStatus
+      for (const key of ['needsInput', 'working', 'stopped', 'failed', 'finished'] as const) {
+        expect(words[key]).toEqual(expect.any(String))
+        expect(words[key].length).toBeGreaterThan(0)
+      }
+    }
+  )
+})
diff --git a/src/renderer/src/i18n/relative-duration-copy-localization.test.ts b/src/renderer/src/i18n/relative-duration-copy-localization.test.ts
new file mode 100644
index 000000000000..65e5175e639f
--- /dev/null
+++ b/src/renderer/src/i18n/relative-duration-copy-localization.test.ts
@@ -0,0 +1,70 @@
+/**
+ * Guards the localized relative-duration copy for the Cmd+J session-age badge and the
+ * native-chat turn row. The English source values ("{{value0}}m/h/d", "Working for N") are
+ * ambiguous, so bootstrap re-translation rendered them as a metre (米), a location particle
+ * (で / 에서), or a French infinitive. These are the reviewed values.
+ */
+import { describe, expect, it } from 'vitest'
+import fr from './locales/fr.json'
+import ja from './locales/ja.json'
+import ko from './locales/ko.json'
+import zh from './locales/zh.json'
+
+const catalogs = { fr, ja, ko, zh } as const
+
+function isStringRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value)
+}
+
+function getByPath(node: unknown, path: string): string | undefined {
+  let current: unknown = node
+  for (const key of path.split('.')) {
+    if (!isStringRecord(current)) {
+      return undefined
+    }
+    current = current[key]
+  }
+  return typeof current === 'string' ? current : undefined
+}
+
+type Locale = keyof typeof catalogs
+
+const AGE_PATHS = 'components.cmd-j.paletteSessionAge'
+const STATUS_PATHS = 'components.native-chat.status'
+
+const cases: [Locale, string, string][] = [
+  // Cmd+J session-age badge: the unit must be a real duration word, not a bare Latin "m/h/d".
+  ['zh', `${AGE_PATHS}.minutes`, '{{value0}}分'],
+  ['zh', `${AGE_PATHS}.hours`, '{{value0}}小时'],
+  ['zh', `${AGE_PATHS}.days`, '{{value0}}天'],
+  ['zh', `${AGE_PATHS}.underOneMinute`, '<1分钟'],
+  ['ja', `${AGE_PATHS}.hours`, '{{value0}}時間'],
+  ['ja', `${AGE_PATHS}.days`, '{{value0}}日'],
+  ['ja', `${AGE_PATHS}.underOneMinute`, '<1分'],
+  ['ko', `${AGE_PATHS}.minutes`, '{{value0}}분'],
+  ['ko', `${AGE_PATHS}.hours`, '{{value0}}시간'],
+  ['ko', `${AGE_PATHS}.days`, '{{value0}}일'],
+  // Native-chat turn row: elapsed time, not a recipient — "working/worked for <duration>",
+  // never the location reading ("works at/for N").
+  ['zh', `${STATUS_PATHS}.workingFor`, '已工作 {{value0}}'],
+  ['zh', `${STATUS_PATHS}.workedFor`, '工作了 {{value0}}'],
+  ['ja', `${STATUS_PATHS}.workingFor`, '{{value0}} 処理中'],
+  ['ja', `${STATUS_PATHS}.workedFor`, '{{value0}} で完了'],
+  ['ko', `${STATUS_PATHS}.workingFor`, '{{value0}} 작업 중'],
+  ['ko', `${STATUS_PATHS}.workedFor`, '{{value0}} 작업 완료'],
+  ['fr', `${STATUS_PATHS}.workingFor`, 'En cours depuis {{value0}}'],
+  ['fr', `${STATUS_PATHS}.workedFor`, 'A travaillé pendant {{value0}}'],
+  // "turn" is a conversation turn (回合 / 턴 / tour), not a road turn (转弯 / 회전 / virage).
+  ['zh', `${STATUS_PATHS}.toggleDetails`, '切换回合详情'],
+  ['ko', `${STATUS_PATHS}.toggleDetails`, '턴 세부정보 전환'],
+  ['fr', `${STATUS_PATHS}.toggleDetails`, 'Basculer les détails du tour'],
+  // Workspace-cleanup durations keep the day unit localized too.
+  ['ja', 'components.workspace.cleanup.browse.chip.idleDays', 'アイドル {{value0}}日以上'],
+  ['ko', 'components.workspace.cleanup.relativeTime.daysAgo', '{{value0}}일 전']
+]
+
+describe('relative-duration copy localization', () => {
+  it.each(cases)('%s %s', (locale, path, expected) => {
+    expect(getByPath(catalogs[locale], path), path).toBe(expected)
+  })
+})
diff --git a/src/renderer/src/lib/activity-thread-display.test.ts b/src/renderer/src/lib/activity-thread-display.test.ts
index 03d5e7883316..0f491dca0d54 100644
--- a/src/renderer/src/lib/activity-thread-display.test.ts
+++ b/src/renderer/src/lib/activity-thread-display.test.ts
@@ -203,6 +203,17 @@ describe('getActivityThreadStatusPreview', () => {
     ).toBe('Interrupted by user')
   })
 
+  it('surfaces a failed turn as failed, not as its last reply', () => {
+    expect(
+      getActivityThreadStatusPreview({
+        state: 'done',
+        lastAssistantMessage: 'Done!',
+        mainAgent: { state: 'done', outcome: 'failure', stateStartedAt: 1 },
+        prompt: 'Ship it'
+      })
+    ).toBe('Failed')
+  })
+
   it('names what a blocked approval is waiting on', () => {
     // Why: a permission request parks the row on 'waiting', and the tool fields are the
     // only thing that says what the user is being asked to approve (STA-3160).
diff --git a/src/renderer/src/lib/activity-thread-display.ts b/src/renderer/src/lib/activity-thread-display.ts
index c330edcb6f00..a4c81bc1a5dd 100644
--- a/src/renderer/src/lib/activity-thread-display.ts
+++ b/src/renderer/src/lib/activity-thread-display.ts
@@ -11,6 +11,7 @@ import {
   orchestrationLabelsMatchLiveDispatch
 } from './agent-row-primary-text'
 import { formatAgentToolPreview } from './agent-row-tool-preview'
+import { agentVerdictDisplayMark } from '../../../shared/agent-main-agent-verdict'
 
 // Why: follow-up replies ("yes", "ok proceed") are valid hook prompts but are
 // terrible scan labels for a cross-worktree agent list — treat them as non-titles.
@@ -194,13 +195,18 @@ export function getActivityThreadStatusPreview(
     | 'lastAssistantMessage'
     | 'lastCompletedAssistantMessage'
     | 'interrupted'
+    | 'mainAgent'
     | 'prompt'
   >,
   agentState?: AgentStatusState | null
 ): string {
-  if (entry.interrupted === true) {
+  const verdictMark = agentVerdictDisplayMark(entry)
+  if (verdictMark === 'interrupted') {
     return 'Interrupted by user'
   }
+  if (verdictMark === 'failed') {
+    return 'Failed'
+  }
   const state = agentState ?? entry.state
   const toolPreview = formatAgentToolPreview(entry, state)
   if (toolPreview) {
@@ -228,6 +234,7 @@ export function resolveActivityThreadStatusPreview(
     | 'lastAssistantMessage'
     | 'lastCompletedAssistantMessage'
     | 'interrupted'
+    | 'mainAgent'
     | 'prompt'
   >,
   agentState: AgentStatusState | null | undefined,
diff --git a/src/renderer/src/lib/agent-catalog.tsx b/src/renderer/src/lib/agent-catalog.tsx
index 42c9baa7f6ea..56cd2180c728 100644
--- a/src/renderer/src/lib/agent-catalog.tsx
+++ b/src/renderer/src/lib/agent-catalog.tsx
@@ -127,6 +127,20 @@ export const getAgentCatalog = createLocalizedCatalog((): AgentCatalogEntry[] =>
     faviconDomain: 'dev.meta.ai',
     homepageUrl: 'https://dev.meta.ai/docs/muse-code'
   },
+  {
+    id: 'dsh',
+    label: translate('auto.lib.agent.catalog.dsh_label', 'DeepSeek Harness'),
+    cmd: 'dsh-tui',
+    searchAliases: ['deepseek', 'dsh', 'dst', 'deepseek harness'],
+    homepageUrl: 'https://deepseek-harness.github.io/deepseek-harness/'
+  },
+  {
+    id: 'qoder',
+    label: translate('auto.lib.agent.catalog.qoder_label', 'Qoder CLI'),
+    cmd: 'qodercli',
+    faviconDomain: 'qoder.com',
+    homepageUrl: 'https://docs.qoder.com/cli/overview'
+  },
   {
     id: 'zcode',
     label: translate('auto.lib.agent.catalog.zcode_label', 'ZCode'),
@@ -242,6 +256,13 @@ export const getAgentCatalog = createLocalizedCatalog((): AgentCatalogEntry[] =>
     faviconDomain: 'codebuff.com',
     homepageUrl: 'https://www.codebuff.com/docs/help/quick-start'
   },
+  {
+    id: 'freebuff',
+    label: translate('auto.lib.agent.catalog.freebuff_label', 'Freebuff'),
+    cmd: 'freebuff',
+    faviconDomain: 'freebuff.com',
+    homepageUrl: 'https://freebuff.com/cli'
+  },
   {
     id: 'command-code',
     label: translate('auto.lib.agent.catalog.6f8056a565', 'Command Code'),
diff --git a/src/renderer/src/lib/agent-draft-paste-content.ts b/src/renderer/src/lib/agent-draft-paste-content.ts
index a76086b67904..19d5a30d275c 100644
--- a/src/renderer/src/lib/agent-draft-paste-content.ts
+++ b/src/renderer/src/lib/agent-draft-paste-content.ts
@@ -12,6 +12,7 @@ import {
 } from '@/components/terminal-pane/terminal-bracketed-paste'
 import { runTerminalPtyInputTransaction } from '@/components/terminal-pane/terminal-pty-input-transaction'
 import { sendRuntimePtyInputVerified } from '@/runtime/runtime-terminal-inspection'
+import type { TerminalInputKind } from '../../../shared/terminal-input-kind'
 
 // Why: bracketed paste markers let supported TUIs treat generated prompt text
 // as one paste instead of echoing character-by-character or triggering edits.
@@ -29,10 +30,11 @@ export async function sendAgentDraftPasteContent(
   settings: Pick<GlobalSettings, 'activeRuntimeEnvironmentId'> | null | undefined,
   ptyId: string,
   content: string,
+  inputKind: TerminalInputKind,
   writePty?: AgentDraftPtyInputWriter
 ): Promise<boolean> {
   return await runTerminalPtyInputTransaction(ptyId, () =>
-    sendAgentDraftPasteContentNow(settings, ptyId, content, writePty)
+    sendAgentDraftPasteContentNow(settings, ptyId, content, inputKind, writePty)
   )
 }
 
@@ -42,6 +44,7 @@ export async function sendAgentDraftPasteContentNow(
   settings: Pick<GlobalSettings, 'activeRuntimeEnvironmentId'> | null | undefined,
   ptyId: string,
   content: string,
+  inputKind: TerminalInputKind,
   writePty?: AgentDraftPtyInputWriter
 ): Promise<boolean> {
   if (content.length > AGENT_DRAFT_PASTE_MAX_BYTES) {
@@ -57,6 +60,7 @@ export async function sendAgentDraftPasteContentNow(
       settings,
       ptyId,
       wrapTerminalBracketedPasteText(terminalContent),
+      inputKind,
       writePty
     )
   }
@@ -71,16 +75,16 @@ export async function sendAgentDraftPasteContentNow(
   for (const chunk of iterateAgentDraftPasteContentChunks(terminalContent)) {
     let accepted = false
     try {
-      accepted = await writeAgentDraftPtyInput(settings, ptyId, chunk, writePty)
+      accepted = await writeAgentDraftPtyInput(settings, ptyId, chunk, inputKind, writePty)
     } catch {
       if (bracketedPasteOpen && chunk !== BRACKETED_PASTE_END) {
-        await closeAgentDraftBracketedPaste(settings, ptyId, writePty)
+        await closeAgentDraftBracketedPaste(settings, ptyId, inputKind, writePty)
       }
       return false
     }
     if (!accepted) {
       if (bracketedPasteOpen && chunk !== BRACKETED_PASTE_END) {
-        await closeAgentDraftBracketedPaste(settings, ptyId, writePty)
+        await closeAgentDraftBracketedPaste(settings, ptyId, inputKind, writePty)
       }
       return false
     }
@@ -197,20 +201,24 @@ async function writeAgentDraftPtyInput(
   settings: Pick<GlobalSettings, 'activeRuntimeEnvironmentId'> | null | undefined,
   ptyId: string,
   data: string,
+  inputKind: TerminalInputKind,
   writePty?: AgentDraftPtyInputWriter
 ): Promise<boolean> {
-  return writePty ? await writePty(data) : await sendRuntimePtyInputVerified(settings, ptyId, data)
+  return writePty
+    ? await writePty(data)
+    : await sendRuntimePtyInputVerified(settings, ptyId, data, inputKind)
 }
 
 async function closeAgentDraftBracketedPaste(
   settings: Pick<GlobalSettings, 'activeRuntimeEnvironmentId'> | null | undefined,
   ptyId: string,
+  inputKind: TerminalInputKind,
   writePty?: AgentDraftPtyInputWriter
 ): Promise<void> {
   try {
     // Why: once the opener reached the PTY, a failed content chunk should not
     // leave the target TUI in bracketed-paste mode.
-    await writeAgentDraftPtyInput(settings, ptyId, BRACKETED_PASTE_END, writePty)
+    await writeAgentDraftPtyInput(settings, ptyId, BRACKETED_PASTE_END, inputKind, writePty)
   } catch {
     // The original write already failed; callers only need the paste to fail closed.
   }
diff --git a/src/renderer/src/lib/agent-favicon-assets.ts b/src/renderer/src/lib/agent-favicon-assets.ts
index 6c7221efe807..b041965736ef 100644
--- a/src/renderer/src/lib/agent-favicon-assets.ts
+++ b/src/renderer/src/lib/agent-favicon-assets.ts
@@ -1,3 +1,4 @@
+import qoderUrl from '../../../shared/agent-icons/qoder.png?url'
 import type { TuiAgent } from '../../../shared/tui-agent'
 import grokUrl from '../../../shared/agent-icons/grok.png?url'
 import mimoCodeUrl from '../../../shared/agent-icons/mimo-code.png?url'
@@ -13,6 +14,7 @@ import crushUrl from '../../../shared/agent-icons/crush.png?url'
 import augUrl from '../../../shared/agent-icons/aug.png?url'
 import autohandUrl from '../../../shared/agent-icons/autohand.png?url'
 import clineUrl from '../../../shared/agent-icons/cline.png?url'
+import freebuffUrl from '../../../shared/agent-icons/freebuff.png?url'
 import codebuffUrl from '../../../shared/agent-icons/codebuff.png?url'
 import commandCodeUrl from '../../../shared/agent-icons/command-code.png?url'
 import continueUrl from '../../../shared/agent-icons/continue.png?url'
@@ -26,6 +28,7 @@ import devinUrl from '../../../shared/agent-icons/devin.png?url'
 import museUrl from '../../../shared/agent-icons/muse.png?url'
 import zcodeUrl from '../../../shared/agent-icons/zcode.png?url'
 import openclawUrl from '../../../shared/agent-icons/openclaw.png?url'
+import dshUrl from '../../../shared/agent-icons/dsh.png?url'
 
 // Why: these agents have no hand-authored SVG glyph, so previously their icons
 // loaded live from Google's favicon service. That service is unreachable in some
@@ -40,6 +43,7 @@ export const AGENT_FAVICON_ASSETS: Partial<Record<TuiAgent, string>> = {
   ante: anteUrl,
   trae: traeUrl,
   'prime-agent': primeAgentUrl,
+  qoder: qoderUrl,
   gemini: geminiUrl,
   antigravity: antigravityUrl,
   goose: gooseUrl,
@@ -50,6 +54,7 @@ export const AGENT_FAVICON_ASSETS: Partial<Record<TuiAgent, string>> = {
   autohand: autohandUrl,
   cline: clineUrl,
   codebuff: codebuffUrl,
+  freebuff: freebuffUrl,
   'command-code': commandCodeUrl,
   continue: continueUrl,
   cursor: cursorUrl,
@@ -60,6 +65,7 @@ export const AGENT_FAVICON_ASSETS: Partial<Record<TuiAgent, string>> = {
   hermes: hermesUrl,
   devin: devinUrl,
   muse: museUrl,
+  dsh: dshUrl,
   zcode: zcodeUrl,
   openclaw: openclawUrl
 }
diff --git a/src/renderer/src/lib/agent-followup-delivery.test.ts b/src/renderer/src/lib/agent-followup-delivery.test.ts
index 207c70ada367..48534cf8b06e 100644
--- a/src/renderer/src/lib/agent-followup-delivery.test.ts
+++ b/src/renderer/src/lib/agent-followup-delivery.test.ts
@@ -49,7 +49,7 @@ describe('sendFollowupPromptWhenAgentReady — interpreter-wrapped agents', () =
       })
 
       expect(delivered).toBe(true)
-      expect(sendRuntimePtyInputVerified).toHaveBeenCalledWith(null, 'pty-1', 'ship it\r')
+      expect(sendRuntimePtyInputVerified).toHaveBeenCalledWith(null, 'pty-1', 'ship it\r', 'launch')
     })
 
     it(`still refuses to type into a bare ${agent} shell foreground`, async () => {
@@ -105,6 +105,6 @@ describe('sendFollowupPromptWhenAgentReady — interpreter-wrapped agents', () =
     })
 
     expect(delivered).toBe(true)
-    expect(sendRuntimePtyInputVerified).toHaveBeenCalledWith(null, 'pty-1', 'ship it\r')
+    expect(sendRuntimePtyInputVerified).toHaveBeenCalledWith(null, 'pty-1', 'ship it\r', 'launch')
   })
 })
diff --git a/src/renderer/src/lib/agent-followup-delivery.ts b/src/renderer/src/lib/agent-followup-delivery.ts
index bdcf0b4a92fb..e520cb6df1f0 100644
--- a/src/renderer/src/lib/agent-followup-delivery.ts
+++ b/src/renderer/src/lib/agent-followup-delivery.ts
@@ -22,7 +22,7 @@ export async function sendFollowupPromptWhenAgentReady(args: {
     return false
   }
   try {
-    return await sendRuntimePtyInputVerified(settings, ptyId, `${prompt}\r`)
+    return await sendRuntimePtyInputVerified(settings, ptyId, `${prompt}\r`, 'launch')
   } catch {
     return false
   }
diff --git a/src/renderer/src/lib/agent-hibernation-pane-eligibility.ts b/src/renderer/src/lib/agent-hibernation-pane-eligibility.ts
index bc55936fd249..0971402e8726 100644
--- a/src/renderer/src/lib/agent-hibernation-pane-eligibility.ts
+++ b/src/renderer/src/lib/agent-hibernation-pane-eligibility.ts
@@ -5,6 +5,7 @@ import type { TerminalLayoutSnapshot, TerminalTab } from '../../../shared/termin
 import { parseRemoteRuntimePtyId } from '@/runtime/runtime-terminal-stream'
 import { lastInputBlocksHibernation } from './agent-hibernation-input-guard'
 import { isLiveResumeAnchorForCompletedAgent } from './live-resume-anchor-record'
+import { agentTurnEndedUncleanly } from '../../../shared/agent-main-agent-verdict'
 import type { AgentHibernationPlannerSnapshot } from './agent-hibernation-planner-snapshot'
 
 export type EligiblePane = {
@@ -89,7 +90,7 @@ export function getEligiblePane(args: {
   )
   if (
     entry.state !== 'done' ||
-    entry.interrupted === true ||
+    agentTurnEndedUncleanly(entry) ||
     Boolean(entry.subagents?.length) ||
     hasUnsettledOrUnknownDispatch(entry) ||
     (sleepingRecord && !hasOnlyLiveResumeAnchor)
diff --git a/src/renderer/src/lib/agent-hibernation-planner.test.ts b/src/renderer/src/lib/agent-hibernation-planner.test.ts
index 5be241004bbc..79aa349d5764 100644
--- a/src/renderer/src/lib/agent-hibernation-planner.test.ts
+++ b/src/renderer/src/lib/agent-hibernation-planner.test.ts
@@ -110,6 +110,21 @@ describe('agent sleep planner', () => {
     expect(
       plannedWorktrees(snapshot({ agentStatusByPaneKey: { [interrupted.paneKey]: interrupted } }))
     ).toEqual([])
+    // A failure ranks like a completion for attention, but a failed pane is never passive.
+    const failed = entry({ mainAgent: { state: 'done', outcome: 'failure', stateStartedAt: OLD } })
+    expect(
+      plannedWorktrees(snapshot({ agentStatusByPaneKey: { [failed.paneKey]: failed } }))
+    ).toEqual([])
+    // A main agent that finished while its subagents still run is live work, whatever its verdict.
+    for (const outcome of ['success', 'failure'] as const) {
+      const held = entry({
+        state: 'working',
+        mainAgent: { state: 'done', outcome, stateStartedAt: OLD }
+      })
+      expect(
+        plannedWorktrees(snapshot({ agentStatusByPaneKey: { [held.paneKey]: held } }))
+      ).toEqual([])
+    }
     const noSession = entry({ providerSession: undefined })
     expect(
       plannedWorktrees(snapshot({ agentStatusByPaneKey: { [noSession.paneKey]: noSession } }))
diff --git a/src/renderer/src/lib/agent-pane-activity-flags.ts b/src/renderer/src/lib/agent-pane-activity-flags.ts
new file mode 100644
index 000000000000..5298c840df92
--- /dev/null
+++ b/src/renderer/src/lib/agent-pane-activity-flags.ts
@@ -0,0 +1,38 @@
+import type { AgentStatusEntry } from '../../../shared/agent-status-types'
+import { agentVerdictDisplayMark } from '../../../shared/agent-main-agent-verdict'
+
+/** What fresh agent panes contribute to a container's status (worktree card, terminal tab). */
+export type AgentPaneActivityFlags = {
+  hasPermission: boolean
+  hasLiveWorking: boolean
+  hasLiveMonitoring: boolean
+  hasFailed: boolean
+  hasInterrupted: boolean
+  hasLiveDone: boolean
+}
+
+/** Fold one fresh pane's entry into its container's flags; `resolveWorktreeStatus` ranks them. */
+export function applyAgentPaneActivityFlags(
+  flags: AgentPaneActivityFlags,
+  entry: Pick<AgentStatusEntry, 'state' | 'workingMode' | 'interrupted' | 'mainAgent'>
+): void {
+  const mark = agentVerdictDisplayMark(entry)
+  if (entry.state === 'blocked' || entry.state === 'waiting') {
+    flags.hasPermission = true
+  }
+  // Why: a failed main agent outranks the live work its subagents hold, and it still counts
+  // beside a subagent's question so the failure shows once that is answered.
+  if (mark === 'failed') {
+    flags.hasFailed = true
+  } else if (mark === 'interrupted') {
+    flags.hasInterrupted = true
+  } else if (entry.state === 'working') {
+    if (entry.workingMode === 'monitoring') {
+      flags.hasLiveMonitoring = true
+    } else {
+      flags.hasLiveWorking = true
+    }
+  } else if (entry.state === 'done') {
+    flags.hasLiveDone = true
+  }
+}
diff --git a/src/renderer/src/lib/agent-paste-draft-submit-retry.test.ts b/src/renderer/src/lib/agent-paste-draft-submit-retry.test.ts
index 5b763aa5c6d7..84ad14770d1d 100644
--- a/src/renderer/src/lib/agent-paste-draft-submit-retry.test.ts
+++ b/src/renderer/src/lib/agent-paste-draft-submit-retry.test.ts
@@ -105,7 +105,12 @@ describe('post-paste submit retry Enter', () => {
 
     await expect(promise).resolves.toBe(true)
     expect(enterWrites()).toHaveLength(2)
-    expect(testState.sendRuntimePtyInputVerified).toHaveBeenLastCalledWith({}, 'pty-1', '\r')
+    expect(testState.sendRuntimePtyInputVerified).toHaveBeenLastCalledWith(
+      {},
+      'pty-1',
+      '\r',
+      'launch'
+    )
     expect(vi.getTimerCount()).toBe(0)
   })
 
@@ -143,7 +148,8 @@ describe('post-paste submit retry Enter', () => {
     const competing = sendAgentDraftPasteContent(
       {},
       'pty-1',
-      'y'.repeat(AGENT_DRAFT_PASTE_DIRECT_MAX_BYTES + 1)
+      'y'.repeat(AGENT_DRAFT_PASTE_DIRECT_MAX_BYTES + 1),
+      'driving'
     )
     await flushMicrotasks(10)
     expect(writes).toEqual([PASTED_ISSUE_URL, '\r'])
diff --git a/src/renderer/src/lib/agent-paste-draft.test.ts b/src/renderer/src/lib/agent-paste-draft.test.ts
index fdcb76cf2ede..bb07fb58504a 100644
--- a/src/renderer/src/lib/agent-paste-draft.test.ts
+++ b/src/renderer/src/lib/agent-paste-draft.test.ts
@@ -57,7 +57,9 @@ vi.mock('@/components/terminal-pane/pty-pre-handler-buffer', () => ({
 
 vi.mock('@/runtime/runtime-terminal-inspection', () => ({
   isRemoteRuntimePtyId: testState.isRemoteRuntimePtyId,
-  sendRuntimePtyInputVerified: testState.sendRuntimePtyInputVerified,
+  // Why drop the kind: this suite pins write shapes; startup-draft-input-kind.test.ts pins kinds.
+  sendRuntimePtyInputVerified: (settings: unknown, ptyId: string, data: string) =>
+    testState.sendRuntimePtyInputVerified(settings, ptyId, data),
   inspectRuntimeTerminalProcess: testState.inspectRuntimeTerminalProcess
 }))
 
@@ -726,7 +728,8 @@ describe('pasteDraftWhenAgentReady', () => {
     const competing = sendAgentDraftPasteContent(
       {},
       'pty-1',
-      'y'.repeat(AGENT_DRAFT_PASTE_DIRECT_MAX_BYTES + 1)
+      'y'.repeat(AGENT_DRAFT_PASTE_DIRECT_MAX_BYTES + 1),
+      'driving'
     )
     await flushMicrotasks(10)
     expect(writes).toEqual([PASTED_ISSUE_URL])
@@ -902,7 +905,7 @@ describe('pasteDraftWhenAgentReady', () => {
 
   it('yields during large accepted-size preflight before writing agent draft chunks', async () => {
     const content = 'x'.repeat(AGENT_DRAFT_PASTE_DIRECT_MAX_BYTES + 300 * 1024)
-    const promise = sendAgentDraftPasteContent({}, 'pty-1', content)
+    const promise = sendAgentDraftPasteContent({}, 'pty-1', content, 'driving')
 
     await flushMicrotasks(5)
     expect(testState.sendRuntimePtyInputVerified).not.toHaveBeenCalled()
@@ -915,9 +918,9 @@ describe('pasteDraftWhenAgentReady', () => {
   })
 
   it('rejects oversized agent drafts before any PTY write', async () => {
-    await expect(
-      sendAgentDraftPasteContent({}, 'pty-1', 'x'.repeat(AGENT_DRAFT_PASTE_MAX_BYTES + 1))
-    ).resolves.toBe(false)
+    const oversized = 'x'.repeat(AGENT_DRAFT_PASTE_MAX_BYTES + 1)
+    const result = sendAgentDraftPasteContent({}, 'pty-1', oversized, 'driving')
+    await expect(result).resolves.toBe(false)
 
     expect(testState.sendRuntimePtyInputVerified).not.toHaveBeenCalled()
   })
diff --git a/src/renderer/src/lib/agent-paste-draft.ts b/src/renderer/src/lib/agent-paste-draft.ts
index a260d6bee189..feca855338a2 100644
--- a/src/renderer/src/lib/agent-paste-draft.ts
+++ b/src/renderer/src/lib/agent-paste-draft.ts
@@ -1,5 +1,6 @@
 import type { GlobalSettings } from '../../../shared/global-settings-types'
 import type { TuiAgent } from '../../../shared/tui-agent'
+import type { TerminalInputKind } from '../../../shared/terminal-input-kind'
 import { TUI_AGENT_CONFIG } from '../../../shared/tui-agent-config'
 import { resolveDraftPasteReadyTimeoutMs } from '../../../shared/draft-paste-ready-timeout'
 import { useAppStore } from '@/store'
@@ -136,7 +137,9 @@ export async function pasteDraftWhenAgentReady(args: {
     ptyId,
     content,
     submit: submit === true,
-    agent
+    agent,
+    // Why launch: this delivers the prompt or draft an agent is started with.
+    inputKind: 'launch'
   })
 }
 
@@ -188,7 +191,9 @@ export async function pasteDraftToAgentPtyWhenReady(args: {
     ptyId,
     content,
     submit: submit === true,
-    agent
+    agent,
+    // Why launch: this delivers the prompt or draft an agent is started with.
+    inputKind: 'launch'
   })
 }
 
@@ -201,7 +206,8 @@ export async function submitPromptToAgentPty(args: {
     settings: getSettingsForAgentTabRuntimeOwner(args.tabId),
     ptyId: args.ptyId,
     content: args.content,
-    submit: true
+    submit: true,
+    inputKind: 'driving'
   })
 }
 
@@ -209,7 +215,7 @@ export async function sendBracketedPasteToRunningAgent(args: {
   ptyId: string
   content: string
 }): Promise<boolean> {
-  return await sendBracketedPasteToAgent({ ptyId: args.ptyId, content: args.content, submit: true })
+  return await sendBracketedPasteToAgent({ ...args, submit: true, inputKind: 'driving' })
 }
 
 async function sendBracketedPasteToAgent(args: {
@@ -218,14 +224,16 @@ async function sendBracketedPasteToAgent(args: {
   content: string
   submit: boolean
   agent?: TuiAgent
+  inputKind: TerminalInputKind
 }): Promise<boolean> {
   const { settings = useAppStore.getState().settings, ptyId, content, submit, agent } = args
+  const { inputKind } = args
   const submitRetryDelayMs = agent ? TUI_AGENT_CONFIG[agent]?.submitRetryDelayMs : undefined
   try {
     // Why: paste + Enter (+ retry Enter) must be one transaction, or a concurrent
     // paste on this PTY can slip between them and submit a half-written prompt.
     return await runTerminalPtyInputTransaction(ptyId, async () => {
-      const pasted = await sendAgentDraftPasteContentNow(settings, ptyId, content)
+      const pasted = await sendAgentDraftPasteContentNow(settings, ptyId, content, inputKind)
       if (!pasted || !submit) {
         return pasted
       }
@@ -234,14 +242,14 @@ async function sendBracketedPasteToAgent(args: {
       // Enter arrive in the same PTY write. Split the submit into the next turn so
       // the TUI processes bracketed-paste termination before handling Enter.
       await new Promise<void>((resolve) => window.setTimeout(resolve, POST_PASTE_SUBMIT_DELAY_MS))
-      const submitted = await sendRuntimePtyInputVerified(settings, ptyId, '\r')
+      const submitted = await sendRuntimePtyInputVerified(settings, ptyId, '\r', inputKind)
 
       if (submitRetryDelayMs !== undefined) {
         // Why: agents that render their composer before Enter is live silently eat
         // the first Enter; the retry is best-effort and never downgrades `submitted`.
         await new Promise<void>((resolve) => window.setTimeout(resolve, submitRetryDelayMs))
         try {
-          await sendRuntimePtyInputVerified(settings, ptyId, '\r')
+          await sendRuntimePtyInputVerified(settings, ptyId, '\r', inputKind)
         } catch {
           // Why: a rejected retry leaves the first Enter's verdict untouched.
         }
diff --git a/src/renderer/src/lib/agent-status.ts b/src/renderer/src/lib/agent-status.ts
index acf7d7cbd532..41ccc2cc7d76 100644
--- a/src/renderer/src/lib/agent-status.ts
+++ b/src/renderer/src/lib/agent-status.ts
@@ -109,6 +109,7 @@ const ICONABLE_AGENT_TYPES: Record<TuiAgent, true> = {
   pi: true,
   omp: true,
   'prime-agent': true,
+  qoder: true,
   gemini: true,
   antigravity: true,
   aider: true,
@@ -120,6 +121,7 @@ const ICONABLE_AGENT_TYPES: Record<TuiAgent, true> = {
   aug: true,
   cline: true,
   codebuff: true,
+  freebuff: true,
   'command-code': true,
   continue: true,
   cursor: true,
@@ -136,7 +138,8 @@ const ICONABLE_AGENT_TYPES: Record<TuiAgent, true> = {
   ante: true,
   trae: true,
   muse: true,
-  zcode: true
+  zcode: true,
+  dsh: true
 }
 
 // Why: return null (not a 'claude' fallback) for unknown so Codex panes don't flash the Claude icon before the hook fires.
diff --git a/src/renderer/src/lib/browser-uuid.ts b/src/renderer/src/lib/browser-uuid.ts
index 177d05f7ddb3..017bfd13f741 100644
--- a/src/renderer/src/lib/browser-uuid.ts
+++ b/src/renderer/src/lib/browser-uuid.ts
@@ -1,28 +1,3 @@
-export function createBrowserUuid(): string {
-  const cryptoApi = globalThis.crypto
-  if (typeof cryptoApi?.randomUUID === 'function') {
-    return cryptoApi.randomUUID()
-  }
-
-  const bytes = new Uint8Array(16)
-  if (typeof cryptoApi?.getRandomValues === 'function') {
-    cryptoApi.getRandomValues(bytes)
-  } else {
-    // Why: LAN web clients can run in non-secure browser contexts where
-    // randomUUID is hidden. These are local UI IDs, not auth credentials.
-    for (let index = 0; index < bytes.length; index += 1) {
-      bytes[index] = Math.floor(Math.random() * 256)
-    }
-  }
-
-  bytes[6] = (bytes[6] & 0x0f) | 0x40
-  bytes[8] = (bytes[8] & 0x3f) | 0x80
-  return bytesToUuid(bytes)
-}
-
-function bytesToUuid(bytes: Uint8Array): string {
-  const hex = Array.from(bytes, (byte) => byte.toString(16).padStart(2, '0'))
-  return `${hex.slice(0, 4).join('')}-${hex.slice(4, 6).join('')}-${hex
-    .slice(6, 8)
-    .join('')}-${hex.slice(8, 10).join('')}-${hex.slice(10, 16).join('')}`
-}
+// Renderer-facing name for the shared generator. A re-export, so renderer code keeps one
+// obvious import and src/shared keeps the single implementation.
+export { createNonSecureContextUuid as createBrowserUuid } from '../../../shared/non-secure-context-uuid'
diff --git a/src/renderer/src/lib/browser-workspace-source-resolution.test.ts b/src/renderer/src/lib/browser-workspace-source-resolution.test.ts
new file mode 100644
index 000000000000..6dd57c668cfa
--- /dev/null
+++ b/src/renderer/src/lib/browser-workspace-source-resolution.test.ts
@@ -0,0 +1,115 @@
+import { describe, expect, it } from 'vitest'
+import type { Tab, TabGroup } from '../../../shared/tab-types'
+import type { BrowserPage, BrowserWorkspace } from '../../../shared/browser-workspace-types'
+import { resolveBrowserSourceUnifiedTab } from './browser-workspace-source-resolution'
+
+const WT = 'wt-1'
+
+type ResolverState = Parameters<typeof resolveBrowserSourceUnifiedTab>[0]
+
+function wrapper(id: string, workspaceId: string, groupId = 'group-1'): Tab {
+  return {
+    id,
+    entityId: workspaceId,
+    groupId,
+    worktreeId: WT,
+    contentType: 'browser',
+    label: 'Example',
+    customLabel: null,
+    color: null,
+    sortOrder: 0,
+    createdAt: 1
+  }
+}
+
+function workspace(id: string): BrowserWorkspace {
+  return {
+    id,
+    worktreeId: WT,
+    activePageId: null,
+    pageIds: [],
+    url: 'about:blank',
+    title: '',
+    loading: false,
+    faviconUrl: null,
+    canGoBack: false,
+    canGoForward: false,
+    loadError: null,
+    createdAt: 1
+  }
+}
+
+function page(id: string, workspaceId: string): BrowserPage {
+  return {
+    id,
+    workspaceId,
+    worktreeId: WT,
+    url: 'about:blank',
+    title: '',
+    loading: false,
+    faviconUrl: null,
+    canGoBack: false,
+    canGoForward: false,
+    loadError: null,
+    createdAt: 1
+  }
+}
+
+function makeState(overrides: {
+  workspaces?: string[]
+  pages?: Record<string, string[]>
+  wrappers?: Tab[]
+  groups?: TabGroup[]
+}): ResolverState {
+  const workspaces = overrides.workspaces ?? ['ws-1']
+  const pages = overrides.pages ?? { 'ws-1': ['page-1'] }
+  const wrappers = overrides.wrappers ?? [wrapper('tab-1', 'ws-1')]
+  return {
+    browserTabsByWorktree: {
+      [WT]: workspaces.map(workspace)
+    },
+    browserPagesByWorkspace: Object.fromEntries(
+      Object.entries(pages).map(([workspaceId, ids]) => [
+        workspaceId,
+        ids.map((id) => page(id, workspaceId))
+      ])
+    ),
+    unifiedTabsByWorktree: { [WT]: wrappers },
+    groupsByWorktree: {
+      [WT]: overrides.groups ?? [
+        { id: 'group-1', worktreeId: WT, activeTabId: null, tabOrder: wrappers.map((t) => t.id) }
+      ]
+    }
+  }
+}
+
+describe('resolveBrowserSourceUnifiedTab', () => {
+  it('returns the unique live wrapper for a source page', () => {
+    expect(resolveBrowserSourceUnifiedTab(makeState({}), 'page-1', WT)?.id).toBe('tab-1')
+  })
+
+  it('stays inside the caller workspace', () => {
+    expect(resolveBrowserSourceUnifiedTab(makeState({}), 'page-1', 'wt-other')).toBeUndefined()
+  })
+
+  it('omits the anchor for ambiguous wrappers', () => {
+    const state = makeState({ wrappers: [wrapper('tab-1', 'ws-1'), wrapper('tab-2', 'ws-1')] })
+    expect(resolveBrowserSourceUnifiedTab(state, 'page-1', WT)).toBeUndefined()
+  })
+
+  it('omits the anchor when two workspaces claim the page', () => {
+    const state = makeState({
+      workspaces: ['ws-1', 'ws-2'],
+      pages: { 'ws-1': ['page-1'], 'ws-2': ['page-1'] }
+    })
+    expect(resolveBrowserSourceUnifiedTab(state, 'page-1', WT)).toBeUndefined()
+  })
+
+  it('omits the anchor for a closed page or a wrapper outside its group order', () => {
+    expect(resolveBrowserSourceUnifiedTab(makeState({}), 'closed-page', WT)).toBeUndefined()
+    const detached = makeState({
+      groups: [{ id: 'group-1', worktreeId: WT, activeTabId: null, tabOrder: [] }]
+    })
+    expect(resolveBrowserSourceUnifiedTab(detached, 'page-1', WT)).toBeUndefined()
+  })
+})
diff --git a/src/renderer/src/lib/browser-workspace-source-resolution.ts b/src/renderer/src/lib/browser-workspace-source-resolution.ts
index 9e10c6f7043d..857f6f77270f 100644
--- a/src/renderer/src/lib/browser-workspace-source-resolution.ts
+++ b/src/renderer/src/lib/browser-workspace-source-resolution.ts
@@ -1,3 +1,4 @@
+import type { Tab } from '../../../shared/tab-types'
 import type { AppState } from '../store/types'
 
 export type BrowserWorkspaceOwner = {
@@ -25,3 +26,39 @@ export function resolveBrowserWorkspaceOwner(
   }
   return null
 }
+
+/**
+ * The unified tab wrapping a source browser page. Anything but exactly one live wrapper in the
+ * caller's workspace is ambiguous, so the caller omits the source relationship.
+ */
+export function resolveBrowserSourceUnifiedTab(
+  state: Pick<
+    AppState,
+    | 'browserTabsByWorktree'
+    | 'browserPagesByWorkspace'
+    | 'unifiedTabsByWorktree'
+    | 'groupsByWorktree'
+  >,
+  sourcePageId: string,
+  worktreeId: string
+): Tab | undefined {
+  const owningWorkspaceIds = (state.browserTabsByWorktree[worktreeId] ?? [])
+    .filter((workspace) =>
+      (state.browserPagesByWorkspace[workspace.id] ?? []).some((page) => page.id === sourcePageId)
+    )
+    .map((workspace) => workspace.id)
+  if (owningWorkspaceIds.length !== 1) {
+    return undefined
+  }
+  const wrappers = (state.unifiedTabsByWorktree[worktreeId] ?? []).filter(
+    (tab) => tab.contentType === 'browser' && tab.entityId === owningWorkspaceIds[0]
+  )
+  if (wrappers.length !== 1) {
+    return undefined
+  }
+  const wrapper = wrappers[0]
+  const group = (state.groupsByWorktree[worktreeId] ?? []).find(
+    (candidate) => candidate.id === wrapper.groupId
+  )
+  return group?.tabOrder.includes(wrapper.id) ? wrapper : undefined
+}
diff --git a/src/renderer/src/lib/editor-model-registry.ts b/src/renderer/src/lib/editor-model-registry.ts
index 4a2b8da88903..b5d4c31578c0 100644
--- a/src/renderer/src/lib/editor-model-registry.ts
+++ b/src/renderer/src/lib/editor-model-registry.ts
@@ -1,13 +1,15 @@
 import type * as Monaco from 'monaco-editor'
 
+type EditorModelRegistry = Pick<typeof Monaco, 'editor' | 'Uri'>
+
 export type EditorModelRegistryBridge = {
-  get(): typeof Monaco | null
+  get(): EditorModelRegistry | null
   subscribe(listener: () => void): () => void
-  register(registry: typeof Monaco): () => void
+  register(registry: EditorModelRegistry): () => void
 }
 
 export function createEditorModelRegistry(): EditorModelRegistryBridge {
-  let registration: { registry: typeof Monaco } | null = null
+  let registration: { registry: EditorModelRegistry } | null = null
   const listeners = new Set<() => void>()
   const notify = (): void => {
     for (const listener of listeners) {
@@ -15,12 +17,12 @@ export function createEditorModelRegistry(): EditorModelRegistryBridge {
     }
   }
   return {
-    get: (): typeof Monaco | null => registration?.registry ?? null,
+    get: (): EditorModelRegistry | null => registration?.registry ?? null,
     subscribe(listener: () => void): () => void {
       listeners.add(listener)
       return () => listeners.delete(listener)
     },
-    register(registry: typeof Monaco): () => void {
+    register(registry: EditorModelRegistry): () => void {
       const next = { registry }
       registration = next
       notify()
diff --git a/src/renderer/src/lib/finished-agent-resume-resurrection.test.ts b/src/renderer/src/lib/finished-agent-resume-resurrection.test.ts
index d0132f531752..c2d5785b0084 100644
--- a/src/renderer/src/lib/finished-agent-resume-resurrection.test.ts
+++ b/src/renderer/src/lib/finished-agent-resume-resurrection.test.ts
@@ -15,7 +15,7 @@
 import { afterEach, describe, expect, it } from 'vitest'
 import { makePaneKey } from '../../../shared/stable-pane-id'
 import { useAppStore } from '@/store'
-import { isPassiveCompletedHibernationEvidence } from './sleeping-agent-pane-ownership'
+import { activationTreatsNoteAsFinished } from './sleeping-agent-pane-ownership'
 import { resumeSleepingAgentSessionsForWorktree } from './resume-sleeping-agent-session'
 
 const initialAppStoreState = useAppStore.getState()
@@ -80,7 +80,7 @@ function reportTurnFinished(interrupted = false): void {
 describe('a finished local agent', () => {
   it('keeps completed quit records resumable', () => {
     expect(
-      isPassiveCompletedHibernationEvidence({
+      activationTreatsNoteAsFinished({
         paneKey: 'quit-tab:quit-leaf',
         tabId: 'quit-tab',
         worktreeId: WORKTREE_ID,
@@ -108,7 +108,7 @@ describe('a finished local agent', () => {
     expect(record?.agent).toBe('codex')
     expect(record?.providerSession).toEqual({ key: 'session_id', id: SESSION_ID })
     expect(
-      isPassiveCompletedHibernationEvidence(record!),
+      activationTreatsNoteAsFinished(record!),
       'a finished agent must read as history, or activation restarts it'
     ).toBe(true)
   })
@@ -120,7 +120,7 @@ describe('a finished local agent', () => {
     const record = useAppStore.getState().sleepingAgentSessionsByPaneKey[PANE_KEY]
     expect(record?.state).toBe('done')
     expect(record?.interrupted).toBe(true)
-    expect(isPassiveCompletedHibernationEvidence(record!)).toBe(false)
+    expect(activationTreatsNoteAsFinished(record!)).toBe(false)
 
     useAppStore.setState({
       tabsByWorktree: { [WORKTREE_ID]: [] },
diff --git a/src/renderer/src/lib/focus-terminal-tab-surface.split-focus.test.ts b/src/renderer/src/lib/focus-terminal-tab-surface.split-focus.test.ts
new file mode 100644
index 000000000000..d3fda81fa6b0
--- /dev/null
+++ b/src/renderer/src/lib/focus-terminal-tab-surface.split-focus.test.ts
@@ -0,0 +1,47 @@
+// @vitest-environment happy-dom
+
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { focusTerminalTabSurface } from './focus-terminal-tab-surface'
+
+vi.mock('@/components/terminal-pane/terminal-ime-input-context-refresh', () => ({
+  refreshTerminalImeInputContext: vi.fn()
+}))
+
+describe('deferred split terminal focus', () => {
+  afterEach(() => {
+    document.body.replaceChildren()
+    vi.unstubAllGlobals()
+  })
+
+  it.each([null, 'left'])(
+    'preserves a pane reveal unless an explicit leaf (%s) was requested',
+    (requestedLeaf) => {
+      const frames: FrameRequestCallback[] = []
+      vi.stubGlobal('requestAnimationFrame', (callback: FrameRequestCallback) => {
+        frames.push(callback)
+        return frames.length
+      })
+      vi.stubGlobal('cancelAnimationFrame', vi.fn())
+      const tab = document.createElement('div')
+      tab.dataset.terminalTabId = 'floating-tab'
+      const inputs = ['left', 'right'].map((leafId) => {
+        const pane = document.createElement('div')
+        pane.dataset.leafId = leafId
+        const input = document.createElement('textarea')
+        input.className = 'xterm-helper-textarea'
+        pane.append(input)
+        tab.append(pane)
+        return input
+      })
+      document.body.append(tab)
+
+      focusTerminalTabSurface('floating-tab', requestedLeaf)
+      frames.shift()?.(0)
+      // The activity row focuses the right pane before the panel's deferred focus completes.
+      inputs[1].focus()
+      frames.shift()?.(0)
+
+      expect(document.activeElement).toBe(inputs[requestedLeaf ? 0 : 1])
+    }
+  )
+})
diff --git a/src/renderer/src/lib/focus-terminal-tab-surface.ts b/src/renderer/src/lib/focus-terminal-tab-surface.ts
index ef23ff051d7b..bf7dc3ed991d 100644
--- a/src/renderer/src/lib/focus-terminal-tab-surface.ts
+++ b/src/renderer/src/lib/focus-terminal-tab-surface.ts
@@ -80,7 +80,10 @@ export function focusTerminalTabSurface(
       const scopedSelector = leafId
         ? `[data-terminal-tab-id="${escapedTabId}"] [data-leaf-id="${cssAttributeString(leafId)}"]${UNCOVERED_TERMINAL_LEAF_SELECTOR} .xterm-helper-textarea`
         : `[data-terminal-tab-id="${escapedTabId}"] ${UNCOVERED_TERMINAL_LEAF_SELECTOR} .xterm-helper-textarea`
-      const scoped = document.querySelector(scopedSelector) as HTMLElement | null
+      // A pane-specific reveal may have focused a split while this tab-wide request was waiting.
+      const scoped =
+        (!leafId ? document.querySelector<HTMLElement>(`${scopedSelector}:focus`) : null) ??
+        document.querySelector<HTMLElement>(scopedSelector)
       if (scoped) {
         focusTerminalHelper(scoped, options)
         return
diff --git a/src/renderer/src/lib/language-detect.test.ts b/src/renderer/src/lib/language-detect.test.ts
index 7ed3f5c3b0ab..9493bae94853 100644
--- a/src/renderer/src/lib/language-detect.test.ts
+++ b/src/renderer/src/lib/language-detect.test.ts
@@ -20,6 +20,22 @@ describe('detectLanguage', () => {
     expect(detectLanguage('packages/app.nimble')).toBe('nim')
   })
 
+  it.each([
+    'documents/report.typ',
+    'C:\\documents\\REPORT.TYP',
+    '\\\\server\\share\\report.typ',
+    '/home/user/folder workspace/Report.TyP'
+  ])('maps Typst source %s to the typst language id', (filePath) => {
+    expect(detectLanguage(filePath)).toBe('typst')
+  })
+
+  it.each(['report.typ.bak', 'report.typx', 'documents.typ/README', 'documents.typ\\README'])(
+    'keeps non-Typst file %s on plaintext',
+    (filePath) => {
+      expect(detectLanguage(filePath)).toBe('plaintext')
+    }
+  )
+
   it('maps exact filenames from Windows paths', () => {
     expect(detectLanguage('C:\\Users\\alice\\repo\\Dockerfile')).toBe('dockerfile')
     expect(detectLanguage('C:\\Users\\alice\\repo\\CMakeLists.txt')).toBe('cmake')
@@ -38,6 +54,25 @@ describe('detectLanguage', () => {
     expect(detectLanguage('C:\\rtl\\TOP.SV')).toBe('systemverilog')
   })
 
+  it.each([
+    'report.abap',
+    'src/zcor0260.prog.abap',
+    'src/zcl_demo.clas.abap',
+    'src/zif_demo.intf.abap',
+    'C:\\repo\\src\\ZCL_DEMO.CLAS.ABAP',
+    '\\\\server\\share\\src\\ZREPORT.PROG.ABAP',
+    '/home/user/folder workspace/src/Report.AbAp'
+  ])('maps ABAP source %s to the Monaco built-in abap language id', (filePath) => {
+    expect(detectLanguage(filePath)).toBe('abap')
+  })
+
+  it.each(['src.abap/README', 'src\\abap.abap\\README', 'report.abap.bak', 'report.abapx'])(
+    'keeps non-ABAP file %s on plaintext',
+    (filePath) => {
+      expect(detectLanguage(filePath)).toBe('plaintext')
+    }
+  )
+
   it('maps .proto files to the Monaco built-in proto language id, not the alias', () => {
     expect(detectLanguage('api/v1/service.proto')).toBe('proto')
   })
@@ -77,6 +112,11 @@ describe('detectLanguage', () => {
     expect(detectLanguage('C:\\theme\\snippets\\CART.LIQUID')).toBe('liquid')
   })
 
+  it('maps .sol files to the Monaco built-in sol language id, not the solidity alias', () => {
+    expect(detectLanguage('contracts/Vault.sol')).toBe('sol')
+    expect(detectLanguage('C:\\repo\\contracts\\TOKEN.SOL')).toBe('sol')
+  })
+
   it('maps Salesforce Apex sources to the apex language id (case-insensitive)', () => {
     expect(detectLanguage('force-app/main/default/classes/AccountService.cls')).toBe('apex')
     expect(detectLanguage('force-app/main/default/triggers/AccountTrigger.trigger')).toBe('apex')
@@ -84,9 +124,57 @@ describe('detectLanguage', () => {
     expect(detectLanguage('C:\\repo\\force-app\\classes\\ACCOUNTSERVICE.CLS')).toBe('apex')
   })
 
+  it.each([
+    'templates/base.twig',
+    'templates/node--article.html.twig',
+    'C:\\theme\\templates\\PAGE.HTML.TWIG',
+    '\\\\server\\share\\templates\\PAGE.TWIG',
+    '/home/user/folder workspace/templates/Base.TwIg'
+  ])('maps Twig template %s to the Monaco built-in twig language id', (filePath) => {
+    expect(detectLanguage(filePath)).toBe('twig')
+  })
+
+  it.each(['base.twig.bak', 'base.twigx', 'templates.twig/README', 'templates.twig\\README'])(
+    'keeps non-Twig file %s on plaintext',
+    (filePath) => {
+      expect(detectLanguage(filePath)).toBe('plaintext')
+    }
+  )
+
   it('keeps .json/.jsonc on the built-in json language and unknown on plaintext', () => {
     expect(detectLanguage('config/settings.json')).toBe('json')
     expect(detectLanguage('config/tsconfig.jsonc')).toBe('json')
     expect(detectLanguage('notes/scratch.unknownext')).toBe('plaintext')
   })
+  it.each([
+    ['.env', 'ini'],
+    ['.env.local', 'ini'],
+    ['.env.development', 'ini'],
+    ['.env.production', 'ini'],
+    ['.env.functions.local', 'ini'],
+    ['.env.staging', 'ini'],
+    ['.env.test.example', 'ini'],
+    ['config/.env.development.local', 'ini'],
+    ['.ENV', 'ini'],
+    ['.ENV.STAGING', 'ini'],
+    ['C:\\repo\\.EnV.FUNCTIONS.LOCAL', 'ini'],
+    ['\\\\server\\share\\.env.test.example', 'ini'],
+    ['.env.sh', 'shell'],
+    ['.ENV.SH', 'shell'],
+    ['.env.json', 'json'],
+    ['.env.local.ts', 'typescript'],
+    ['.env/CMakeLists.txt', 'cmake'],
+    ['C:\\repo\\.env.local\\Dockerfile', 'dockerfile'],
+    ['.envrc', 'plaintext'],
+    ['.environment', 'plaintext'],
+    ['env.staging', 'plaintext'],
+    ['dev.env', 'plaintext'],
+    ['other.env.local', 'plaintext'],
+    ['..env.local', 'plaintext'],
+    ['.env.staging/readme', 'plaintext'],
+    ['C:\\repo\\.env.local\\notes', 'plaintext'],
+    ['', 'plaintext']
+  ])('detects dotenv names without overriding specific mappings: %s', (filePath, expected) => {
+    expect(detectLanguage(filePath)).toBe(expected)
+  })
 })
diff --git a/src/renderer/src/lib/language-detect.ts b/src/renderer/src/lib/language-detect.ts
index e2738b1b4048..c3d766d37100 100644
--- a/src/renderer/src/lib/language-detect.ts
+++ b/src/renderer/src/lib/language-detect.ts
@@ -1,3 +1,5 @@
+import { detectMonacoFilenameLanguage } from './monaco-filename-language'
+
 function extname(filePath: string): string {
   const lastDot = filePath.lastIndexOf('.')
   const lastSep = Math.max(filePath.lastIndexOf('/'), filePath.lastIndexOf('\\'))
@@ -42,6 +44,7 @@ const EXT_TO_LANGUAGE: Record<string, string> = {
   // Why: Monaco declares Liquid as both '.liquid' and '.html.liquid'; the final-extension
   // lookup below covers the compound form, so the single entry is enough.
   '.liquid': 'liquid',
+  '.twig': 'twig',
   '.xml': 'xml',
   '.svg': 'xml',
   '.py': 'python',
@@ -92,6 +95,8 @@ const EXT_TO_LANGUAGE: Record<string, string> = {
   '.hrl': 'erlang',
   '.hs': 'haskell',
   '.clj': 'clojure',
+  // Why: Monaco registers Solidity under the id 'sol'; 'solidity' is only an alias.
+  '.sol': 'sol',
   '.vue': 'vue',
   '.svelte': 'svelte',
   '.astro': 'astro',
@@ -102,8 +107,10 @@ const EXT_TO_LANGUAGE: Record<string, string> = {
   '.nim': 'nim',
   '.nims': 'nim',
   '.nimble': 'nim',
+  '.typ': 'typst',
   '.tf': 'hcl',
   '.hcl': 'hcl',
+  '.abap': 'abap',
   '.prisma': 'graphql',
   '.csv': 'csv',
   '.tsv': 'tsv'
@@ -126,11 +133,17 @@ export function detectLanguage(filePath: string): string {
   // Check exact filename first
   const parts = filePath.split(/[\\/]/)
   const filename = parts.at(-1)!
-  if (FILENAME_TO_LANGUAGE[filename]) {
+  if (Object.hasOwn(FILENAME_TO_LANGUAGE, filename)) {
     return FILENAME_TO_LANGUAGE[filename]
   }
 
   // Check extension
   const ext = extname(filename).toLowerCase()
-  return EXT_TO_LANGUAGE[ext] ?? 'plaintext'
+  const lowerName = filename.toLowerCase()
+  // Scoped dotenv names fall back to INI only when no specific extension matches.
+  return (
+    EXT_TO_LANGUAGE[ext] ??
+    detectMonacoFilenameLanguage(filename) ??
+    (lowerName === '.env' || lowerName.startsWith('.env.') ? 'ini' : 'plaintext')
+  )
 }
diff --git a/src/renderer/src/lib/launch-agent-background-session-remote.test.ts b/src/renderer/src/lib/launch-agent-background-session-remote.test.ts
index 11ade27d58af..ed62c67f3568 100644
--- a/src/renderer/src/lib/launch-agent-background-session-remote.test.ts
+++ b/src/renderer/src/lib/launch-agent-background-session-remote.test.ts
@@ -178,7 +178,8 @@ describe('launchAgentBackgroundSession remote runtime and SSH startup delivery',
 
       expect(mockWrite).toHaveBeenCalledWith(
         'pty-1',
-        "claude '--dangerously-skip-permissions' 'run the automation'\r"
+        "claude '--dangerously-skip-permissions' 'run the automation'\r",
+        'launch'
       )
     } finally {
       vi.useRealTimers()
@@ -214,7 +215,8 @@ describe('launchAgentBackgroundSession remote runtime and SSH startup delivery',
 
       expect(mockWrite).toHaveBeenCalledWith(
         'pty-1',
-        "codex '--dangerously-bypass-approvals-and-sandbox' 'run the automation'\r"
+        "codex '--dangerously-bypass-approvals-and-sandbox' 'run the automation'\r",
+        'launch'
       )
     } finally {
       vi.useRealTimers()
@@ -241,7 +243,8 @@ describe('launchAgentBackgroundSession remote runtime and SSH startup delivery',
 
       expect(mockWrite).toHaveBeenCalledWith(
         'pty-1',
-        "codex '--dangerously-bypass-approvals-and-sandbox'\r"
+        "codex '--dangerously-bypass-approvals-and-sandbox'\r",
+        'launch'
       )
     } finally {
       vi.useRealTimers()
@@ -262,7 +265,8 @@ describe('launchAgentBackgroundSession remote runtime and SSH startup delivery',
 
       expect(mockWrite).toHaveBeenCalledWith(
         'pty-1',
-        "codex '--dangerously-bypass-approvals-and-sandbox'\r"
+        "codex '--dangerously-bypass-approvals-and-sandbox'\r",
+        'launch'
       )
     } finally {
       vi.useRealTimers()
@@ -288,7 +292,8 @@ describe('launchAgentBackgroundSession remote runtime and SSH startup delivery',
 
       expect(mockWrite).toHaveBeenCalledWith(
         'pty-1',
-        "codex '--dangerously-bypass-approvals-and-sandbox' 'run the automation'\r"
+        "codex '--dangerously-bypass-approvals-and-sandbox' 'run the automation'\r",
+        'launch'
       )
     } finally {
       vi.useRealTimers()
@@ -312,7 +317,8 @@ describe('launchAgentBackgroundSession remote runtime and SSH startup delivery',
 
       expect(mockWrite).toHaveBeenCalledWith(
         'pty-1',
-        "codex '--dangerously-bypass-approvals-and-sandbox' 'run the automation'\r"
+        "codex '--dangerously-bypass-approvals-and-sandbox' 'run the automation'\r",
+        'launch'
       )
     } finally {
       vi.useRealTimers()
@@ -353,7 +359,8 @@ describe('launchAgentBackgroundSession remote runtime and SSH startup delivery',
 
       expect(mockWrite).toHaveBeenCalledWith(
         'pty-1',
-        "codex --prefill 'draft from override' '--dangerously-bypass-approvals-and-sandbox'\r"
+        "codex --prefill 'draft from override' '--dangerously-bypass-approvals-and-sandbox'\r",
+        'launch'
       )
     } finally {
       vi.useRealTimers()
diff --git a/src/renderer/src/lib/launch-agent-background-session.ts b/src/renderer/src/lib/launch-agent-background-session.ts
index 9ef4bcfae4a9..07c39dd082ae 100644
--- a/src/renderer/src/lib/launch-agent-background-session.ts
+++ b/src/renderer/src/lib/launch-agent-background-session.ts
@@ -118,7 +118,7 @@ export async function launchAgentBackgroundSession(
     command: sshConnectionId ? startupPlan.launchCommand : null,
     waitForShellReady:
       Boolean(sshConnectionId) && sshBackgroundLaunchWaitsForShellReady(startupPlan),
-    write: (ptyId, data) => window.api.pty.write(ptyId, data)
+    write: (ptyId, data) => window.api.pty.write(ptyId, data, 'launch')
   })
   // Route by the worktree's owner host, not the focused runtime.
   const runtimeTarget = getActiveRuntimeTarget(
diff --git a/src/renderer/src/lib/launch-structured-agent-session.ts b/src/renderer/src/lib/launch-structured-agent-session.ts
index 73d274a7bdc1..759f5c7d6146 100644
--- a/src/renderer/src/lib/launch-structured-agent-session.ts
+++ b/src/renderer/src/lib/launch-structured-agent-session.ts
@@ -21,6 +21,7 @@ import {
   resolveWebSessionVisibleTabId
 } from '@/runtime/web-session-focus-intent'
 import { LOCAL_STRUCTURED_SESSION_OWNER } from '@/runtime/local-structured-session-owner'
+import { createBrowserUuid } from '@/lib/browser-uuid'
 
 export type StructuredAgentSessionLaunchIntent = {
   sessionId: string
@@ -105,7 +106,7 @@ export function createStructuredAgentSessionLaunchIntent(
   agent: AgentSessionHandleProvider,
   resumeFrom?: StructuredAgentSessionResumeSource
 ): StructuredAgentSessionLaunchIntent {
-  const sessionId = createStructuredAgentSessionId(agent, () => crypto.randomUUID())
+  const sessionId = createStructuredAgentSessionId(agent, createBrowserUuid)
   return buildStructuredAgentSessionLaunchIntent(worktreeId, agent, sessionId, resumeFrom)
 }
 
@@ -132,7 +133,7 @@ function buildStructuredAgentSessionLaunchIntent(
       worktree: toRuntimeWorktreeSelector(worktreeId),
       agent,
       ...(resumeFrom ? { resumeFrom } : {}),
-      randomUuid: () => crypto.randomUUID()
+      randomUuid: createBrowserUuid
     }),
     ...launchSeedOptions(state, agent)
   }
diff --git a/src/renderer/src/lib/monaco-filename-language.test.ts b/src/renderer/src/lib/monaco-filename-language.test.ts
new file mode 100644
index 000000000000..013e9cc7f17a
--- /dev/null
+++ b/src/renderer/src/lib/monaco-filename-language.test.ts
@@ -0,0 +1,64 @@
+import { describe, expect, it } from 'vitest'
+import { detectLanguage } from './language-detect'
+import { detectMonacoFilenameLanguage } from './monaco-filename-language'
+import associations from './monaco-language-associations.json'
+
+describe('Monaco filename detection', () => {
+  it.each([
+    ['contracts/Vault.sol', 'sol'],
+    ['infra/main.bicep', 'bicep'],
+    ['queries/query.cypher', 'cypher'],
+    ['scripts/run.fsx', 'fsharp'],
+    ['shaders/main.wgsl', 'wgsl'],
+    ['docs/guide.rst', 'restructuredtext'],
+    ['C:\\workspace\\main.TcPOU', 'st'],
+    ['\\\\host\\share\\main.ML', 'fsharp'],
+    ['/remote/folder workspace/main.pas', 'pascal'],
+    ['templates/page.ftl', 'freemarker2'],
+    ['config/.babelrc', 'json'],
+    ['Gemfile', 'ruby'],
+    ['include/header.hxx', 'cpp'],
+    ['script.es6', 'javascript'],
+    ['script.pp', 'ruby']
+  ])('detects %s using built-in metadata', (path, language) => {
+    expect(detectLanguage(path)).toBe(language)
+  })
+
+  it('recognizes every unambiguous upstream extension and filename', () => {
+    for (const language of associations) {
+      for (const extension of language.extensions) {
+        const owners = associations.filter((entry) =>
+          entry.extensions.some((candidate) => candidate.toLowerCase() === extension.toLowerCase())
+        )
+        if (owners.length === 1) {
+          expect(detectMonacoFilenameLanguage(`sample${extension}`)).toBe(language.id)
+        }
+      }
+      for (const filename of language.filenames) {
+        expect(detectMonacoFilenameLanguage(filename)).toBe(language.id)
+      }
+    }
+  })
+
+  it.each([
+    ['file.mdx', 'markdown'],
+    ['file.tsx', 'typescript'],
+    ['file.jsonl', 'jsonl'],
+    ['file.ipynb', 'notebook'],
+    ['file.vue', 'vue'],
+    ['file.svelte', 'svelte'],
+    ['file.astro', 'astro'],
+    ['file.typ', 'typst'],
+    ['file.nim', 'nim'],
+    ['file.h', 'c'],
+    ['.env.staging', 'ini'],
+    ['file.unknown', 'plaintext'],
+    ['folder.sol/README', 'plaintext'],
+    ['folder.sol\\README', 'plaintext'],
+    ['constructor', 'plaintext'],
+    ['toString', 'plaintext'],
+    ['__proto__', 'plaintext']
+  ])('preserves Orca behavior for %s', (path, language) => {
+    expect(detectLanguage(path)).toBe(language)
+  })
+})
diff --git a/src/renderer/src/lib/monaco-filename-language.ts b/src/renderer/src/lib/monaco-filename-language.ts
new file mode 100644
index 000000000000..c8fc6d54d3d6
--- /dev/null
+++ b/src/renderer/src/lib/monaco-filename-language.ts
@@ -0,0 +1,25 @@
+import associations from './monaco-language-associations.json'
+
+// Generated metadata avoids importing Monaco during session restoration.
+const filenames = new Map<string, string>()
+const extensions = new Map<string, string>()
+// Like Monaco, later registrations win ambiguous associations such as .pp.
+for (const language of associations) {
+  for (const filename of language.filenames) {
+    filenames.set(filename.toLowerCase(), language.id)
+  }
+  for (const extension of language.extensions) {
+    extensions.set(extension.toLowerCase(), language.id)
+  }
+}
+const suffixes = [...extensions.keys()].sort((a, b) => b.length - a.length)
+
+export function detectMonacoFilenameLanguage(filename: string): string | undefined {
+  const lowerName = filename.toLowerCase()
+  const exact = filenames.get(lowerName)
+  if (exact) {
+    return exact
+  }
+  const suffix = suffixes.find((extension) => lowerName.endsWith(extension))
+  return suffix ? extensions.get(suffix) : undefined
+}
diff --git a/src/renderer/src/lib/monaco-language-associations.json b/src/renderer/src/lib/monaco-language-associations.json
new file mode 100644
index 000000000000..6effc0051406
--- /dev/null
+++ b/src/renderer/src/lib/monaco-language-associations.json
@@ -0,0 +1,470 @@
+[
+  {
+    "id": "json",
+    "extensions": [".json", ".bowerrc", ".jshintrc", ".jscsrc", ".eslintrc", ".babelrc", ".har"],
+    "filenames": []
+  },
+  {
+    "id": "abap",
+    "extensions": [".abap"],
+    "filenames": []
+  },
+  {
+    "id": "apex",
+    "extensions": [".cls"],
+    "filenames": []
+  },
+  {
+    "id": "azcli",
+    "extensions": [".azcli"],
+    "filenames": []
+  },
+  {
+    "id": "bat",
+    "extensions": [".bat", ".cmd"],
+    "filenames": []
+  },
+  {
+    "id": "bicep",
+    "extensions": [".bicep"],
+    "filenames": []
+  },
+  {
+    "id": "cameligo",
+    "extensions": [".mligo"],
+    "filenames": []
+  },
+  {
+    "id": "clojure",
+    "extensions": [".clj", ".cljs", ".cljc", ".edn"],
+    "filenames": []
+  },
+  {
+    "id": "coffeescript",
+    "extensions": [".coffee"],
+    "filenames": []
+  },
+  {
+    "id": "c",
+    "extensions": [".c", ".h"],
+    "filenames": []
+  },
+  {
+    "id": "cpp",
+    "extensions": [".cpp", ".cc", ".cxx", ".hpp", ".hh", ".hxx"],
+    "filenames": []
+  },
+  {
+    "id": "csharp",
+    "extensions": [".cs", ".csx", ".cake"],
+    "filenames": []
+  },
+  {
+    "id": "csp",
+    "extensions": [".csp"],
+    "filenames": []
+  },
+  {
+    "id": "css",
+    "extensions": [".css"],
+    "filenames": []
+  },
+  {
+    "id": "cypher",
+    "extensions": [".cypher", ".cyp"],
+    "filenames": []
+  },
+  {
+    "id": "dart",
+    "extensions": [".dart"],
+    "filenames": []
+  },
+  {
+    "id": "dockerfile",
+    "extensions": [".dockerfile"],
+    "filenames": ["Dockerfile"]
+  },
+  {
+    "id": "ecl",
+    "extensions": [".ecl"],
+    "filenames": []
+  },
+  {
+    "id": "elixir",
+    "extensions": [".ex", ".exs"],
+    "filenames": []
+  },
+  {
+    "id": "flow9",
+    "extensions": [".flow"],
+    "filenames": []
+  },
+  {
+    "id": "fsharp",
+    "extensions": [".fs", ".fsi", ".ml", ".mli", ".fsx", ".fsscript"],
+    "filenames": []
+  },
+  {
+    "id": "freemarker2",
+    "extensions": [".ftl", ".ftlh", ".ftlx"],
+    "filenames": []
+  },
+  {
+    "id": "freemarker2.tag-angle.interpolation-dollar",
+    "extensions": [],
+    "filenames": []
+  },
+  {
+    "id": "freemarker2.tag-bracket.interpolation-dollar",
+    "extensions": [],
+    "filenames": []
+  },
+  {
+    "id": "freemarker2.tag-angle.interpolation-bracket",
+    "extensions": [],
+    "filenames": []
+  },
+  {
+    "id": "freemarker2.tag-bracket.interpolation-bracket",
+    "extensions": [],
+    "filenames": []
+  },
+  {
+    "id": "freemarker2.tag-auto.interpolation-dollar",
+    "extensions": [],
+    "filenames": []
+  },
+  {
+    "id": "freemarker2.tag-auto.interpolation-bracket",
+    "extensions": [],
+    "filenames": []
+  },
+  {
+    "id": "go",
+    "extensions": [".go"],
+    "filenames": []
+  },
+  {
+    "id": "graphql",
+    "extensions": [".graphql", ".gql"],
+    "filenames": []
+  },
+  {
+    "id": "handlebars",
+    "extensions": [".handlebars", ".hbs"],
+    "filenames": []
+  },
+  {
+    "id": "hcl",
+    "extensions": [".tf", ".tfvars", ".hcl"],
+    "filenames": []
+  },
+  {
+    "id": "html",
+    "extensions": [".html", ".htm", ".shtml", ".xhtml", ".mdoc", ".jsp", ".asp", ".aspx", ".jshtm"],
+    "filenames": []
+  },
+  {
+    "id": "ini",
+    "extensions": [".ini", ".properties", ".gitconfig"],
+    "filenames": ["config", ".gitattributes", ".gitconfig", ".editorconfig"]
+  },
+  {
+    "id": "java",
+    "extensions": [".java", ".jav"],
+    "filenames": []
+  },
+  {
+    "id": "javascript",
+    "extensions": [".js", ".es6", ".jsx", ".mjs", ".cjs"],
+    "filenames": ["jakefile"]
+  },
+  {
+    "id": "julia",
+    "extensions": [".jl"],
+    "filenames": []
+  },
+  {
+    "id": "kotlin",
+    "extensions": [".kt", ".kts"],
+    "filenames": []
+  },
+  {
+    "id": "less",
+    "extensions": [".less"],
+    "filenames": []
+  },
+  {
+    "id": "lexon",
+    "extensions": [".lex"],
+    "filenames": []
+  },
+  {
+    "id": "lua",
+    "extensions": [".lua"],
+    "filenames": []
+  },
+  {
+    "id": "liquid",
+    "extensions": [".liquid", ".html.liquid"],
+    "filenames": []
+  },
+  {
+    "id": "m3",
+    "extensions": [".m3", ".i3", ".mg", ".ig"],
+    "filenames": []
+  },
+  {
+    "id": "markdown",
+    "extensions": [".md", ".markdown", ".mdown", ".mkdn", ".mkd", ".mdwn", ".mdtxt", ".mdtext"],
+    "filenames": []
+  },
+  {
+    "id": "mdx",
+    "extensions": [".mdx"],
+    "filenames": []
+  },
+  {
+    "id": "mips",
+    "extensions": [".s"],
+    "filenames": []
+  },
+  {
+    "id": "msdax",
+    "extensions": [".dax", ".msdax"],
+    "filenames": []
+  },
+  {
+    "id": "mysql",
+    "extensions": [],
+    "filenames": []
+  },
+  {
+    "id": "objective-c",
+    "extensions": [".m"],
+    "filenames": []
+  },
+  {
+    "id": "pascal",
+    "extensions": [".pas", ".p", ".pp"],
+    "filenames": []
+  },
+  {
+    "id": "pascaligo",
+    "extensions": [".ligo"],
+    "filenames": []
+  },
+  {
+    "id": "perl",
+    "extensions": [".pl", ".pm"],
+    "filenames": []
+  },
+  {
+    "id": "pgsql",
+    "extensions": [],
+    "filenames": []
+  },
+  {
+    "id": "php",
+    "extensions": [".php", ".php4", ".php5", ".phtml", ".ctp"],
+    "filenames": []
+  },
+  {
+    "id": "pla",
+    "extensions": [".pla"],
+    "filenames": []
+  },
+  {
+    "id": "postiats",
+    "extensions": [".dats", ".sats", ".hats"],
+    "filenames": []
+  },
+  {
+    "id": "powerquery",
+    "extensions": [".pq", ".pqm"],
+    "filenames": []
+  },
+  {
+    "id": "powershell",
+    "extensions": [".ps1", ".psm1", ".psd1"],
+    "filenames": []
+  },
+  {
+    "id": "proto",
+    "extensions": [".proto"],
+    "filenames": []
+  },
+  {
+    "id": "pug",
+    "extensions": [".jade", ".pug"],
+    "filenames": []
+  },
+  {
+    "id": "python",
+    "extensions": [".py", ".rpy", ".pyw", ".cpy", ".gyp", ".gypi"],
+    "filenames": []
+  },
+  {
+    "id": "qsharp",
+    "extensions": [".qs"],
+    "filenames": []
+  },
+  {
+    "id": "r",
+    "extensions": [".r", ".rhistory", ".rmd", ".rprofile", ".rt"],
+    "filenames": []
+  },
+  {
+    "id": "razor",
+    "extensions": [".cshtml"],
+    "filenames": []
+  },
+  {
+    "id": "redis",
+    "extensions": [".redis"],
+    "filenames": []
+  },
+  {
+    "id": "redshift",
+    "extensions": [],
+    "filenames": []
+  },
+  {
+    "id": "restructuredtext",
+    "extensions": [".rst"],
+    "filenames": []
+  },
+  {
+    "id": "ruby",
+    "extensions": [".rb", ".rbx", ".rjs", ".gemspec", ".pp"],
+    "filenames": ["rakefile", "Gemfile"]
+  },
+  {
+    "id": "rust",
+    "extensions": [".rs", ".rlib"],
+    "filenames": []
+  },
+  {
+    "id": "sb",
+    "extensions": [".sb"],
+    "filenames": []
+  },
+  {
+    "id": "scala",
+    "extensions": [".scala", ".sc", ".sbt"],
+    "filenames": []
+  },
+  {
+    "id": "scheme",
+    "extensions": [".scm", ".ss", ".sch", ".rkt"],
+    "filenames": []
+  },
+  {
+    "id": "scss",
+    "extensions": [".scss"],
+    "filenames": []
+  },
+  {
+    "id": "shell",
+    "extensions": [".sh", ".bash"],
+    "filenames": []
+  },
+  {
+    "id": "sol",
+    "extensions": [".sol"],
+    "filenames": []
+  },
+  {
+    "id": "aes",
+    "extensions": [".aes"],
+    "filenames": []
+  },
+  {
+    "id": "sparql",
+    "extensions": [".rq"],
+    "filenames": []
+  },
+  {
+    "id": "sql",
+    "extensions": [".sql"],
+    "filenames": []
+  },
+  {
+    "id": "st",
+    "extensions": [".st", ".iecst", ".iecplc", ".lc3lib", ".TcPOU", ".TcDUT", ".TcGVL", ".TcIO"],
+    "filenames": []
+  },
+  {
+    "id": "swift",
+    "extensions": [".swift"],
+    "filenames": []
+  },
+  {
+    "id": "systemverilog",
+    "extensions": [".sv", ".svh"],
+    "filenames": []
+  },
+  {
+    "id": "verilog",
+    "extensions": [".v", ".vh"],
+    "filenames": []
+  },
+  {
+    "id": "tcl",
+    "extensions": [".tcl"],
+    "filenames": []
+  },
+  {
+    "id": "twig",
+    "extensions": [".twig"],
+    "filenames": []
+  },
+  {
+    "id": "typescript",
+    "extensions": [".ts", ".tsx", ".cts", ".mts"],
+    "filenames": []
+  },
+  {
+    "id": "typespec",
+    "extensions": [".tsp"],
+    "filenames": []
+  },
+  {
+    "id": "vb",
+    "extensions": [".vb"],
+    "filenames": []
+  },
+  {
+    "id": "wgsl",
+    "extensions": [".wgsl"],
+    "filenames": []
+  },
+  {
+    "id": "xml",
+    "extensions": [
+      ".xml",
+      ".xsd",
+      ".dtd",
+      ".ascx",
+      ".csproj",
+      ".config",
+      ".props",
+      ".targets",
+      ".wxi",
+      ".wxl",
+      ".wxs",
+      ".xaml",
+      ".svg",
+      ".svgz",
+      ".opf",
+      ".xslt",
+      ".xsl"
+    ],
+    "filenames": []
+  },
+  {
+    "id": "yaml",
+    "extensions": [".yaml", ".yml"],
+    "filenames": []
+  }
+]
diff --git a/src/renderer/src/lib/monaco-languages/register-typst.test.ts b/src/renderer/src/lib/monaco-languages/register-typst.test.ts
new file mode 100644
index 000000000000..a3cdc96fe0aa
--- /dev/null
+++ b/src/renderer/src/lib/monaco-languages/register-typst.test.ts
@@ -0,0 +1,76 @@
+import { describe, expect, it, vi } from 'vitest'
+import {
+  TYPST_LANGUAGE_ID,
+  TYPST_TEXTMATE_SCOPE,
+  loadTypstTextMateGrammar,
+  registerTypstLanguage
+} from './register-typst'
+
+function createMonacoMock(languages: { id: string }[] = []) {
+  return {
+    languages: {
+      getLanguages: vi.fn(() => languages),
+      register: vi.fn((language: { id: string }) => languages.push(language)),
+      setLanguageConfiguration: vi.fn(),
+      registerTokensProviderFactory: vi.fn()
+    }
+  }
+}
+
+describe('registerTypstLanguage', () => {
+  it('registers Typst with its extension, TextMate scope, and editor configuration', () => {
+    const monaco = createMonacoMock()
+
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the mock exercises only the four languages.* calls this registration touches; the full Monaco module type cannot be satisfied structurally.
+    registerTypstLanguage(monaco as never)
+
+    expect(monaco.languages.register).toHaveBeenCalledWith({
+      id: TYPST_LANGUAGE_ID,
+      extensions: ['.typ'],
+      aliases: ['Typst', 'typst']
+    })
+    expect(monaco.languages.setLanguageConfiguration).toHaveBeenCalledWith(
+      TYPST_LANGUAGE_ID,
+      expect.objectContaining({
+        comments: { lineComment: '//', blockComment: ['/*', '*/'] },
+        brackets: [
+          ['{', '}'],
+          ['[', ']'],
+          ['(', ')']
+        ]
+      })
+    )
+    expect(monaco.languages.registerTokensProviderFactory).toHaveBeenCalledWith(
+      TYPST_LANGUAGE_ID,
+      expect.objectContaining({ create: expect.any(Function) })
+    )
+  })
+
+  it('does not register Typst twice', () => {
+    const monaco = createMonacoMock()
+
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: only the mocked languages API is used.
+    registerTypstLanguage(monaco as never)
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: only the mocked languages API is used.
+    registerTypstLanguage(monaco as never)
+
+    expect(monaco.languages.register).toHaveBeenCalledTimes(1)
+    expect(monaco.languages.setLanguageConfiguration).toHaveBeenCalledTimes(1)
+    expect(monaco.languages.registerTokensProviderFactory).toHaveBeenCalledTimes(1)
+  })
+})
+
+describe('loadTypstTextMateGrammar', () => {
+  it('lazily loads the vendored Typst grammar for the Typst scope', async () => {
+    const grammar = await loadTypstTextMateGrammar(TYPST_TEXTMATE_SCOPE)
+
+    expect(grammar).toMatchObject({
+      name: 'typst',
+      scopeName: TYPST_TEXTMATE_SCOPE
+    })
+  })
+
+  it('ignores unrelated TextMate scopes', async () => {
+    await expect(loadTypstTextMateGrammar('source.python')).resolves.toBeNull()
+  })
+})
diff --git a/src/renderer/src/lib/monaco-languages/register-typst.ts b/src/renderer/src/lib/monaco-languages/register-typst.ts
new file mode 100644
index 000000000000..82f83e54a038
--- /dev/null
+++ b/src/renderer/src/lib/monaco-languages/register-typst.ts
@@ -0,0 +1,56 @@
+import type * as Monaco from 'monaco-editor'
+import type { IRawGrammar } from 'vscode-textmate'
+import { registerTextMateLanguage } from './textmate-language-registration'
+
+type MonacoModule = typeof Monaco
+
+export const TYPST_LANGUAGE_ID = 'typst'
+export const TYPST_TEXTMATE_SCOPE = 'source.typst'
+
+export const typstLanguageConfiguration: Monaco.languages.LanguageConfiguration = {
+  comments: {
+    lineComment: '//',
+    blockComment: ['/*', '*/']
+  },
+  brackets: [
+    ['{', '}'],
+    ['[', ']'],
+    ['(', ')']
+  ],
+  autoClosingPairs: [
+    { open: '{', close: '}' },
+    { open: '[', close: ']' },
+    { open: '(', close: ')' },
+    { open: '"', close: '"' }
+  ],
+  surroundingPairs: [
+    { open: '{', close: '}' },
+    { open: '[', close: ']' },
+    { open: '(', close: ')' },
+    { open: '"', close: '"' }
+  ]
+}
+
+export async function loadTypstTextMateGrammar(scopeName: string): Promise<IRawGrammar | null> {
+  if (scopeName !== TYPST_TEXTMATE_SCOPE) {
+    return null
+  }
+
+  // Lazy upstream grammar; provenance and Apache-2.0 license are in typst-LICENSE.txt.
+  const grammarModule = await import('./textmate-grammars/typst.tmLanguage.json')
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: TextMate injects the $self/$base repository entries required by IRawGrammar; real tokenization tests validate this vendored JSON.
+  return grammarModule.default as unknown as IRawGrammar
+}
+
+export function registerTypstLanguage(monaco: MonacoModule): void {
+  registerTextMateLanguage(monaco, {
+    language: {
+      id: TYPST_LANGUAGE_ID,
+      extensions: ['.typ'],
+      aliases: ['Typst', 'typst']
+    },
+    configuration: typstLanguageConfiguration,
+    scopeName: TYPST_TEXTMATE_SCOPE,
+    loadGrammar: loadTypstTextMateGrammar
+  })
+}
diff --git a/src/renderer/src/lib/monaco-languages/textmate-grammars/typst-LICENSE.txt b/src/renderer/src/lib/monaco-languages/textmate-grammars/typst-LICENSE.txt
new file mode 100644
index 000000000000..5c8e11a6e699
--- /dev/null
+++ b/src/renderer/src/lib/monaco-languages/textmate-grammars/typst-LICENSE.txt
@@ -0,0 +1,183 @@
+Typst
+
+Source: https://github.com/typst/typst/blob/9f2b6e8715237cb086899a42873660fe744622e8/tools/support/typst.tmLanguage.json
+Modifications by Orca: JSON formatting; line comments have opaque bodies;
+block comments nest only block comments; math reuses string and comment rules
+and consumes escapes before recognizing its closing dollar delimiter.
+
+                              Apache License
+                        Version 2.0, January 2004
+                     http://www.apache.org/licenses/
+
+TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+1. Definitions.
+
+   "License" shall mean the terms and conditions for use, reproduction,
+   and distribution as defined by Sections 1 through 9 of this document.
+
+   "Licensor" shall mean the copyright owner or entity authorized by
+   the copyright owner that is granting the License.
+
+   "Legal Entity" shall mean the union of the acting entity and all
+   other entities that control, are controlled by, or are under common
+   control with that entity. For the purposes of this definition,
+   "control" means (i) the power, direct or indirect, to cause the
+   direction or management of such entity, whether by contract or
+   otherwise, or (ii) ownership of fifty percent (50%) or more of the
+   outstanding shares, or (iii) beneficial ownership of such entity.
+
+   "You" (or "Your") shall mean an individual or Legal Entity
+   exercising permissions granted by this License.
+
+   "Source" form shall mean the preferred form for making modifications,
+   including but not limited to software source code, documentation
+   source, and configuration files.
+
+   "Object" form shall mean any form resulting from mechanical
+   transformation or translation of a Source form, including but
+   not limited to compiled object code, generated documentation,
+   and conversions to other media types.
+
+   "Work" shall mean the work of authorship, whether in Source or
+   Object form, made available under the License, as indicated by a
+   copyright notice that is included in or attached to the work
+   (an example is provided in the Appendix below).
+
+   "Derivative Works" shall mean any work, whether in Source or Object
+   form, that is based on (or derived from) the Work and for which the
+   editorial revisions, annotations, elaborations, or other modifications
+   represent, as a whole, an original work of authorship. For the purposes
+   of this License, Derivative Works shall not include works that remain
+   separable from, or merely link (or bind by name) to the interfaces of,
+   the Work and Derivative Works thereof.
+
+   "Contribution" shall mean any work of authorship, including
+   the original version of the Work and any modifications or additions
+   to that Work or Derivative Works thereof, that is intentionally
+   submitted to Licensor for inclusion in the Work by the copyright owner
+   or by an individual or Legal Entity authorized to submit on behalf of
+   the copyright owner. For the purposes of this definition, "submitted"
+   means any form of electronic, verbal, or written communication sent
+   to the Licensor or its representatives, including but not limited to
+   communication on electronic mailing lists, source code control systems,
+   and issue tracking systems that are managed by, or on behalf of, the
+   Licensor for the purpose of discussing and improving the Work, but
+   excluding communication that is conspicuously marked or otherwise
+   designated in writing by the copyright owner as "Not a Contribution."
+
+   "Contributor" shall mean Licensor and any individual or Legal Entity
+   on behalf of whom a Contribution has been received by Licensor and
+   subsequently incorporated within the Work.
+
+2. Grant of Copyright License. Subject to the terms and conditions of
+   this License, each Contributor hereby grants to You a perpetual,
+   worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+   copyright license to reproduce, prepare Derivative Works of,
+   publicly display, publicly perform, sublicense, and distribute the
+   Work and such Derivative Works in Source or Object form.
+
+3. Grant of Patent License. Subject to the terms and conditions of
+   this License, each Contributor hereby grants to You a perpetual,
+   worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+   (except as stated in this section) patent license to make, have made,
+   use, offer to sell, sell, import, and otherwise transfer the Work,
+   where such license applies only to those patent claims licensable
+   by such Contributor that are necessarily infringed by their
+   Contribution(s) alone or by combination of their Contribution(s)
+   with the Work to which such Contribution(s) was submitted. If You
+   institute patent litigation against any entity (including a
+   cross-claim or counterclaim in a lawsuit) alleging that the Work
+   or a Contribution incorporated within the Work constitutes direct
+   or contributory patent infringement, then any patent licenses
+   granted to You under this License for that Work shall terminate
+   as of the date such litigation is filed.
+
+4. Redistribution. You may reproduce and distribute copies of the
+   Work or Derivative Works thereof in any medium, with or without
+   modifications, and in Source or Object form, provided that You
+   meet the following conditions:
+
+   (a) You must give any other recipients of the Work or
+       Derivative Works a copy of this License; and
+
+   (b) You must cause any modified files to carry prominent notices
+       stating that You changed the files; and
+
+   (c) You must retain, in the Source form of any Derivative Works
+       that You distribute, all copyright, patent, trademark, and
+       attribution notices from the Source form of the Work,
+       excluding those notices that do not pertain to any part of
+       the Derivative Works; and
+
+   (d) If the Work includes a "NOTICE" text file as part of its
+       distribution, then any Derivative Works that You distribute must
+       include a readable copy of the attribution notices contained
+       within such NOTICE file, excluding those notices that do not
+       pertain to any part of the Derivative Works, in at least one
+       of the following places: within a NOTICE text file distributed
+       as part of the Derivative Works; within the Source form or
+       documentation, if provided along with the Derivative Works; or,
+       within a display generated by the Derivative Works, if and
+       wherever such third-party notices normally appear. The contents
+       of the NOTICE file are for informational purposes only and
+       do not modify the License. You may add Your own attribution
+       notices within Derivative Works that You distribute, alongside
+       or as an addendum to the NOTICE text from the Work, provided
+       that such additional attribution notices cannot be construed
+       as modifying the License.
+
+   You may add Your own copyright statement to Your modifications and
+   may provide additional or different license terms and conditions
+   for use, reproduction, or distribution of Your modifications, or
+   for any such Derivative Works as a whole, provided Your use,
+   reproduction, and distribution of the Work otherwise complies with
+   the conditions stated in this License.
+
+5. Submission of Contributions. Unless You explicitly state otherwise,
+   any Contribution intentionally submitted for inclusion in the Work
+   by You to the Licensor shall be under the terms and conditions of
+   this License, without any additional terms or conditions.
+   Notwithstanding the above, nothing herein shall supersede or modify
+   the terms of any separate license agreement you may have executed
+   with Licensor regarding such Contributions.
+
+6. Trademarks. This License does not grant permission to use the trade
+   names, trademarks, service marks, or product names of the Licensor,
+   except as required for reasonable and customary use in describing the
+   origin of the Work and reproducing the content of the NOTICE file.
+
+7. Disclaimer of Warranty. Unless required by applicable law or
+   agreed to in writing, Licensor provides the Work (and each
+   Contributor provides its Contributions) on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+   implied, including, without limitation, any warranties or conditions
+   of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+   PARTICULAR PURPOSE. You are solely responsible for determining the
+   appropriateness of using or redistributing the Work and assume any
+   risks associated with Your exercise of permissions under this License.
+
+8. Limitation of Liability. In no event and under no legal theory,
+   whether in tort (including negligence), contract, or otherwise,
+   unless required by applicable law (such as deliberate and grossly
+   negligent acts) or agreed to in writing, shall any Contributor be
+   liable to You for damages, including any direct, indirect, special,
+   incidental, or consequential damages of any character arising as a
+   result of this License or out of the use or inability to use the
+   Work (including but not limited to damages for loss of goodwill,
+   work stoppage, computer failure or malfunction, or any and all
+   other commercial damages or losses), even if such Contributor
+   has been advised of the possibility of such damages.
+
+9. Accepting Warranty or Additional Liability. While redistributing
+   the Work or Derivative Works thereof, You may choose to offer,
+   and charge a fee for, acceptance of support, warranty, indemnity,
+   or other liability obligations and/or rights consistent with this
+   License. However, in accepting such obligations, You may act only
+   on Your own behalf and on Your sole responsibility, not on behalf
+   of any other Contributor, and only if You agree to indemnify,
+   defend, and hold each Contributor harmless for any liability
+   incurred by, or claims asserted against, such Contributor by reason
+   of your accepting any such warranty or additional liability.
+
+END OF TERMS AND CONDITIONS
diff --git a/src/renderer/src/lib/monaco-languages/textmate-grammars/typst.tmLanguage.json b/src/renderer/src/lib/monaco-languages/textmate-grammars/typst.tmLanguage.json
new file mode 100644
index 000000000000..26c14b4c4f41
--- /dev/null
+++ b/src/renderer/src/lib/monaco-languages/textmate-grammars/typst.tmLanguage.json
@@ -0,0 +1,383 @@
+{
+  "comment": "Adapted by Orca: isolate comment nesting and protect strings, escapes, and comments inside math. See typst-LICENSE.txt for pinned upstream provenance.",
+  "name": "typst",
+  "patterns": [{ "include": "#markup" }],
+  "repository": {
+    "comments": {
+      "patterns": [
+        { "include": "#block-comment" },
+        {
+          "name": "comment.line.double-slash.typst",
+          "begin": "(?<!:)//",
+          "end": "\n",
+          "beginCaptures": { "0": { "name": "punctuation.definition.comment.typst" } }
+        }
+      ]
+    },
+    "common": {
+      "patterns": [{ "include": "#comments" }]
+    },
+    "markup": {
+      "patterns": [
+        { "include": "#common" },
+        {
+          "name": "constant.character.escape.content.typst",
+          "match": "\\\\([\\\\/\\[\\]{}#*_=~`$-.]|u\\{[0-9a-zA-Z]*\\}?)"
+        },
+        {
+          "name": "punctuation.definition.linebreak.typst",
+          "match": "\\\\"
+        },
+        {
+          "name": "punctuation.definition.nonbreaking-space.typst",
+          "match": "~"
+        },
+        {
+          "name": "punctuation.definition.shy.typst",
+          "match": "-\\?"
+        },
+        {
+          "name": "punctuation.definition.em-dash.typst",
+          "match": "---"
+        },
+        {
+          "name": "punctuation.definition.en-dash.typst",
+          "match": "--"
+        },
+        {
+          "name": "punctuation.definition.ellipsis.typst",
+          "match": "\\.\\.\\."
+        },
+        {
+          "name": "constant.symbol.typst",
+          "match": ":([a-zA-Z0-9]+:)+"
+        },
+        {
+          "name": "markup.bold.typst",
+          "begin": "(^\\*|\\*$|((?<=\\W|_)\\*)|(\\*(?=\\W|_)))",
+          "end": "(^\\*|\\*$|((?<=\\W|_)\\*)|(\\*(?=\\W|_)))|\n|(?=\\])",
+          "captures": { "0": { "name": "punctuation.definition.bold.typst" } },
+          "patterns": [{ "include": "#markup" }]
+        },
+        {
+          "name": "markup.italic.typst",
+          "begin": "(^_|_$|((?<=\\W|_)_)|(_(?=\\W|_)))",
+          "end": "(^_|_$|((?<=\\W|_)_)|(_(?=\\W|_)))|\n|(?=\\])",
+          "captures": { "0": { "name": "punctuation.definition.italic.typst" } },
+          "patterns": [{ "include": "#markup" }]
+        },
+        {
+          "name": "markup.underline.link.typst",
+          "match": "https?://[0-9a-zA-Z~/%#&=',;\\.\\+\\?]*"
+        },
+        {
+          "name": "markup.raw.block.typst",
+          "begin": "`{3,}",
+          "end": "\\0",
+          "captures": { "0": { "name": "punctuation.definition.raw.typst" } }
+        },
+        {
+          "name": "markup.raw.inline.typst",
+          "begin": "`",
+          "end": "`",
+          "captures": { "0": { "name": "punctuation.definition.raw.typst" } }
+        },
+        { "include": "#math" },
+        {
+          "name": "markup.heading.typst",
+          "contentName": "entity.name.section.typst",
+          "begin": "^\\s*=+\\s+",
+          "end": "\n|(?=<)",
+          "beginCaptures": { "0": { "name": "punctuation.definition.heading.typst" } },
+          "patterns": [{ "include": "#markup" }]
+        },
+        {
+          "name": "punctuation.definition.list.unnumbered.typst",
+          "match": "^\\s*-\\s+"
+        },
+        {
+          "name": "punctuation.definition.list.numbered.typst",
+          "match": "^\\s*([0-9]*\\.|\\+)\\s+"
+        },
+        {
+          "match": "^\\s*(/)\\s+([^:]*:)",
+          "captures": {
+            "1": { "name": "punctuation.definition.list.description.typst" },
+            "2": { "name": "markup.list.term.typst" }
+          }
+        },
+        {
+          "name": "entity.other.label.typst",
+          "match": "<[[:alpha:]_][[:alnum:]_-]*>",
+          "captures": { "1": { "name": "punctuation.definition.label.typst" } }
+        },
+        {
+          "name": "entity.other.reference.typst",
+          "match": "(@)[[:alpha:]_][[:alnum:]_-]*",
+          "captures": { "1": { "name": "punctuation.definition.reference.typst" } }
+        },
+        {
+          "begin": "(#)(let|set|show|context)\\b",
+          "end": "\n|(;)|(?=])",
+          "beginCaptures": {
+            "0": { "name": "keyword.other.typst" },
+            "1": { "name": "punctuation.definition.keyword.typst" }
+          },
+          "endCaptures": { "1": { "name": "punctuation.terminator.statement.typst" } },
+          "patterns": [{ "include": "#code" }]
+        },
+        {
+          "name": "keyword.other.typst",
+          "match": "(#)(as|in)\\b",
+          "captures": { "1": { "name": "punctuation.definition.keyword.typst" } }
+        },
+        {
+          "begin": "((#)if|(?<=(}|])\\s*)else)\\b",
+          "end": "\n|(?=])|(?<=}|])",
+          "beginCaptures": {
+            "0": { "name": "keyword.control.conditional.typst" },
+            "2": { "name": "punctuation.definition.keyword.typst" }
+          },
+          "patterns": [{ "include": "#code" }]
+        },
+        {
+          "begin": "(#)(for|while)\\b",
+          "end": "\n|(?=])|(?<=}|])",
+          "beginCaptures": {
+            "0": { "name": "keyword.control.loop.typst" },
+            "1": { "name": "punctuation.definition.keyword.typst" }
+          },
+          "patterns": [{ "include": "#code" }]
+        },
+        {
+          "name": "keyword.control.loop.typst",
+          "match": "(#)(break|continue)\\b",
+          "captures": { "1": { "name": "punctuation.definition.keyword.typst" } }
+        },
+        {
+          "begin": "(#)(import|include|export)\\b",
+          "end": "\n|(;)|(?=])",
+          "beginCaptures": {
+            "0": { "name": "keyword.control.import.typst" },
+            "1": { "name": "punctuation.definition.keyword.typst" }
+          },
+          "endCaptures": { "1": { "name": "punctuation.terminator.statement.typst" } },
+          "patterns": [{ "include": "#code" }]
+        },
+        {
+          "name": "keyword.control.flow.typst",
+          "match": "(#)(return)\\b",
+          "captures": { "1": { "name": "punctuation.definition.keyword.typst" } }
+        },
+        {
+          "comment": "Function name",
+          "name": "entity.name.function.typst",
+          "match": "((#)[[:alpha:]_][[:alnum:]_-]*!?)(?=\\[|\\()",
+          "captures": { "2": { "name": "punctuation.definition.function.typst" } }
+        },
+        {
+          "comment": "Function arguments",
+          "begin": "(?<=#[[:alpha:]_][[:alnum:]_-]*!?)\\(",
+          "end": "\\)",
+          "captures": { "0": { "name": "punctuation.definition.group.typst" } },
+          "patterns": [{ "include": "#arguments" }]
+        },
+        {
+          "name": "entity.other.interpolated.typst",
+          "match": "(#)[[:alpha:]_][.[:alnum:]_-]*",
+          "captures": { "1": { "name": "punctuation.definition.variable.typst" } }
+        },
+        {
+          "name": "meta.block.content.typst",
+          "begin": "#",
+          "end": "\\s",
+          "patterns": [{ "include": "#code" }]
+        }
+      ]
+    },
+    "code": {
+      "patterns": [
+        { "include": "#common" },
+        {
+          "name": "meta.block.code.typst",
+          "begin": "{",
+          "end": "}",
+          "captures": { "0": { "name": "punctuation.definition.block.code.typst" } },
+          "patterns": [{ "include": "#code" }]
+        },
+        {
+          "name": "meta.block.content.typst",
+          "begin": "\\[",
+          "end": "\\]",
+          "captures": { "0": { "name": "punctuation.definition.block.content.typst" } },
+          "patterns": [{ "include": "#markup" }]
+        },
+        {
+          "name": "comment.line.double-slash.typst",
+          "begin": "//",
+          "end": "\n",
+          "beginCaptures": { "0": { "name": "punctuation.definition.comment.typst" } }
+        },
+        {
+          "name": "punctuation.separator.colon.typst",
+          "match": ":"
+        },
+        {
+          "name": "punctuation.separator.comma.typst",
+          "match": ","
+        },
+        {
+          "name": "keyword.operator.typst",
+          "match": "=>|\\.\\."
+        },
+        {
+          "name": "keyword.operator.relational.typst",
+          "match": "==|!=|<=|<|>=|>"
+        },
+        {
+          "name": "keyword.operator.assignment.typst",
+          "match": "\\+=|-=|\\*=|/=|="
+        },
+        {
+          "name": "keyword.operator.arithmetic.typst",
+          "match": "\\+|\\*|/|(?<![[:alpha:]_][[:alnum:]_-]*)-(?![:alnum:]_-]*[[:alpha:]_])"
+        },
+        {
+          "name": "keyword.operator.word.typst",
+          "match": "\\b(and|or|not)\\b"
+        },
+        {
+          "name": "keyword.other.typst",
+          "match": "\\b(let|as|in|set|show|context)\\b"
+        },
+        {
+          "name": "keyword.control.conditional.typst",
+          "match": "\\b(if|else)\\b"
+        },
+        {
+          "name": "keyword.control.loop.typst",
+          "match": "\\b(for|while|break|continue)\\b"
+        },
+        {
+          "name": "keyword.control.import.typst",
+          "match": "\\b(import|include|export)\\b"
+        },
+        {
+          "name": "keyword.control.flow.typst",
+          "match": "\\b(return)\\b"
+        },
+        { "include": "#constants" },
+        {
+          "comment": "Function name",
+          "name": "entity.name.function.typst",
+          "match": "\\b[[:alpha:]_][[:alnum:]_-]*!?(?=\\[|\\()"
+        },
+        {
+          "comment": "Function name",
+          "name": "entity.name.function.typst",
+          "match": "(?<=\\bshow\\s*)\\b[[:alpha:]_][[:alnum:]_-]*(?=\\s*[:.])"
+        },
+        {
+          "comment": "Function arguments",
+          "begin": "(?<=\\b[[:alpha:]_][[:alnum:]_-]*!?)\\(",
+          "end": "\\)",
+          "captures": { "0": { "name": "punctuation.definition.group.typst" } },
+          "patterns": [{ "include": "#arguments" }]
+        },
+        {
+          "name": "variable.other.typst",
+          "match": "\\b[[:alpha:]_][[:alnum:]_-]*\\b"
+        },
+        {
+          "name": "meta.group.typst",
+          "begin": "\\(",
+          "end": "\\)|(?=;)",
+          "captures": { "0": { "name": "punctuation.definition.group.typst" } },
+          "patterns": [{ "include": "#code" }]
+        }
+      ]
+    },
+    "constants": {
+      "patterns": [
+        {
+          "name": "constant.language.none.typst",
+          "match": "\\bnone\\b"
+        },
+        {
+          "name": "constant.language.auto.typst",
+          "match": "\\bauto\\b"
+        },
+        {
+          "name": "constant.language.boolean.typst",
+          "match": "\\b(true|false)\\b"
+        },
+        {
+          "name": "constant.numeric.length.typst",
+          "match": "\\b(\\d*)?\\.?\\d+([eE][+-]?\\d+)?(mm|pt|cm|in|em)\\b"
+        },
+        {
+          "name": "constant.numeric.angle.typst",
+          "match": "\\b(\\d*)?\\.?\\d+([eE][+-]?\\d+)?(rad|deg)\\b"
+        },
+        {
+          "name": "constant.numeric.percentage.typst",
+          "match": "\\b(\\d*)?\\.?\\d+([eE][+-]?\\d+)?%"
+        },
+        {
+          "name": "constant.numeric.fr.typst",
+          "match": "\\b(\\d*)?\\.?\\d+([eE][+-]?\\d+)?fr"
+        },
+        {
+          "name": "constant.numeric.integer.typst",
+          "match": "\\b(0x[0-9a-zA-Z]+|(0b|0o)?\\d+)\\b"
+        },
+        {
+          "name": "constant.numeric.float.typst",
+          "match": "\\b(\\d*)?\\.?\\d+([eE][+-]?\\d+)?\\b"
+        },
+        { "include": "#string" },
+        { "include": "#math" }
+      ]
+    },
+    "arguments": {
+      "patterns": [
+        {
+          "name": "variable.parameter.typst",
+          "match": "\\b[[:alpha:]_][[:alnum:]_-]*(?=:)"
+        },
+        { "include": "#code" }
+      ]
+    },
+    "block-comment": {
+      "name": "comment.block.typst",
+      "begin": "/\\*",
+      "end": "\\*/",
+      "captures": { "0": { "name": "punctuation.definition.comment.typst" } },
+      "patterns": [{ "include": "#block-comment" }]
+    },
+    "string": {
+      "name": "string.quoted.double.typst",
+      "begin": "\"",
+      "end": "\"",
+      "captures": { "0": { "name": "punctuation.definition.string.typst" } },
+      "patterns": [
+        {
+          "name": "constant.character.escape.string.typst",
+          "match": "\\\\([\\\\\"nrt]|u\\{?[0-9a-zA-Z]*\\}?)"
+        }
+      ]
+    },
+    "math": {
+      "name": "string.other.math.typst",
+      "begin": "\\$",
+      "end": "\\$",
+      "captures": { "0": { "name": "punctuation.definition.string.math.typst" } },
+      "patterns": [
+        { "include": "#comments" },
+        { "include": "#string" },
+        { "name": "constant.character.escape.math.typst", "match": "\\\\." }
+      ]
+    }
+  },
+  "scopeName": "source.typst"
+}
diff --git a/src/renderer/src/lib/monaco-languages/textmate-language-registration.test.ts b/src/renderer/src/lib/monaco-languages/textmate-language-registration.test.ts
index dcd7b969ba91..a5638026eef5 100644
--- a/src/renderer/src/lib/monaco-languages/textmate-language-registration.test.ts
+++ b/src/renderer/src/lib/monaco-languages/textmate-language-registration.test.ts
@@ -65,8 +65,12 @@ describe('registerTextMateLanguage', () => {
     expect(loadProviderModule).not.toHaveBeenCalled()
 
     const providerPromise = createTokensProvider()
+    expect(createTokensProvider()).toBe(providerPromise)
 
     await expect(providerPromise).resolves.toBe(provider)
+    expect(createTokensProvider()).toBe(providerPromise)
+    expect(loadProviderModule).toHaveBeenCalledTimes(1)
+    expect(createTextMateTokensProvider).toHaveBeenCalledTimes(1)
     expect(createTextMateTokensProvider).toHaveBeenCalledWith({
       scopeName: 'source.nim',
       loadGrammar
diff --git a/src/renderer/src/lib/monaco-languages/textmate-token-provider.test.ts b/src/renderer/src/lib/monaco-languages/textmate-token-provider.test.ts
index d2d40b04ba01..86b5d0c8604f 100644
--- a/src/renderer/src/lib/monaco-languages/textmate-token-provider.test.ts
+++ b/src/renderer/src/lib/monaco-languages/textmate-token-provider.test.ts
@@ -4,6 +4,7 @@ import { describe, expect, it } from 'vitest'
 import { createOnigScanner, createOnigString, loadWASM } from 'vscode-oniguruma'
 import type { IOnigLib, IRawGrammar } from 'vscode-textmate'
 import nimGrammar from './textmate-grammars/nim.tmLanguage.json'
+import { loadTypstTextMateGrammar } from './register-typst'
 import { createTextMateTokensProvider } from './textmate-token-provider'
 
 const require = createRequire(import.meta.url)
@@ -46,6 +47,107 @@ describe('createTextMateTokensProvider', () => {
     )
   })
 
+  it('tokenizes Typst markup, code, and math through the lazy grammar loader', async () => {
+    const provider = await createTextMateTokensProvider({
+      scopeName: 'source.typst',
+      loadGrammar: loadTypstTextMateGrammar,
+      loadOniguruma: loadNodeOniguruma
+    })
+    const scopesOf = (line: string) =>
+      provider.tokenize(line, provider.getInitialState()).tokens.map((token) => token.scopes)
+
+    expect(scopesOf('#let width = 12pt')).toEqual(
+      expect.arrayContaining(['keyword.other.typst', 'constant.numeric.length.typst'])
+    )
+    expect(scopesOf('#set text(font: "Inter")')).toEqual(
+      expect.arrayContaining(['entity.name.function.typst', 'string.quoted.double.typst'])
+    )
+    expect(scopesOf('// note')).toContain('comment.line.double-slash.typst')
+    expect(scopesOf('$ sum_(k=0)^n k $')).toContain('string.other.math.typst')
+  })
+
+  it.each([
+    ['```rust', 'let x = 1', '```', '#let y = 2'],
+    ['````', '```', '````', '#let y = 2']
+  ])('carries a Typst raw block until its matching fence closes (%s)', async (...lines) => {
+    const provider = await createTextMateTokensProvider({
+      scopeName: 'source.typst',
+      loadGrammar: loadTypstTextMateGrammar,
+      loadOniguruma: loadNodeOniguruma
+    })
+
+    let state = provider.getInitialState()
+    const lineScopes = lines.map((line) => {
+      const result = provider.tokenize(line, state)
+      state = result.endState
+      return result.tokens.map((token) => token.scopes)
+    })
+
+    expect(lineScopes[1]).toEqual(['markup.raw.block.typst'])
+    expect(lineScopes[3]).toContain('keyword.other.typst')
+  })
+
+  it('carries Typst math across lines and returns to code after the closing dollar', async () => {
+    const provider = await createTextMateTokensProvider({
+      scopeName: 'source.typst',
+      loadGrammar: loadTypstTextMateGrammar,
+      loadOniguruma: loadNodeOniguruma
+    })
+    const opening = provider.tokenize('$', provider.getInitialState())
+    const clone = opening.endState.clone()
+    expect(clone.equals(opening.endState)).toBe(true)
+    const body = provider.tokenize('x^2 + y^2 = z^2', clone)
+    expect(body.tokens.map((token) => token.scopes)).toEqual(['string.other.math.typst'])
+    const closing = provider.tokenize('$', body.endState)
+    const after = provider.tokenize('#let y = 2', closing.endState)
+    expect(after.tokens.map((token) => token.scopes)).toContain('keyword.other.typst')
+    expect(after.tokens.map((token) => token.scopes)).not.toContain('string.other.math.typst')
+    expect(provider.tokenize('#let y = 2', provider.getInitialState()).tokens).toEqual(after.tokens)
+  })
+
+  it.each([
+    ['// Write /* to start a block comment.'],
+    ['/* documentation: // */'],
+    ['/* outer', '/* inner */ still outer', '*/'],
+    ['$ "cost $5" + x $'],
+    ['$ x + \\$ + y $'],
+    ['$ "escaped \\" $5" + x $'],
+    ['$ x + \\\\ $'],
+    ['$', '"cost $5" + \\$ + y', '$'],
+    ['$ x /* $ ignored */ + y $'],
+    ['$', '// $ ignored', 'x + y', '$'],
+    ['#let formula = $ "cost $5" + \\$ $']
+  ])('returns to Typst code after a comment or math region (%j)', async (...lines) => {
+    const provider = await createTextMateTokensProvider({
+      scopeName: 'source.typst',
+      loadGrammar: loadTypstTextMateGrammar,
+      loadOniguruma: loadNodeOniguruma
+    })
+    let state = provider.getInitialState()
+    for (const line of lines) {
+      state = provider.tokenize(line, state).endState
+    }
+    const after = '#let after = 12pt'
+    const tokens = provider.tokenize(after, state).tokens
+    expect(tokens).toEqual(provider.tokenize(after, provider.getInitialState()).tokens)
+    expect(tokens.map((token) => token.scopes)).toEqual(
+      expect.arrayContaining(['keyword.other.typst', 'constant.numeric.length.typst'])
+    )
+  })
+
+  it('keeps nested Typst block comments active until both closers', async () => {
+    const provider = await createTextMateTokensProvider({
+      scopeName: 'source.typst',
+      loadGrammar: loadTypstTextMateGrammar,
+      loadOniguruma: loadNodeOniguruma
+    })
+    let state = provider.tokenize('/* outer /* inner', provider.getInitialState()).endState
+    state = provider.tokenize('*/ still outer', state).endState
+    expect(provider.tokenize('#let hidden = 2', state).tokens.map((token) => token.scopes)).toEqual(
+      ['comment.block.typst']
+    )
+  })
+
   it('fails clearly when a scope has no grammar', async () => {
     await expect(
       createTextMateTokensProvider({
diff --git a/src/renderer/src/lib/monaco-setup.ts b/src/renderer/src/lib/monaco-setup.ts
index c94a147839d7..5c2c69d24cba 100644
--- a/src/renderer/src/lib/monaco-setup.ts
+++ b/src/renderer/src/lib/monaco-setup.ts
@@ -13,6 +13,7 @@ import { registerJsonlLanguage } from './monaco-languages/register-jsonl'
 import { registerNimLanguage } from './monaco-languages/register-nim'
 import { registerShellMarkdownAliases } from './monaco-languages/register-shell-markdown-aliases'
 import { registerSvelteLanguage } from './monaco-languages/register-svelte'
+import { registerTypstLanguage } from './monaco-languages/register-typst'
 import { registerVueLanguage } from './monaco-languages/register-vue'
 import { installMonacoDelayerCancellationGuard } from './monaco-delayer-cancellation-guard'
 import { installMonacoDiffEditorDisposalGuard } from './monaco-diff-editor-disposal'
@@ -82,6 +83,7 @@ runMonacoSetupSteps([
   ['Svelte language registration', () => registerSvelteLanguage(monaco)],
   ['Astro language registration', () => registerAstroLanguage(monaco)],
   ['Nim language registration', () => registerNimLanguage(monaco)],
+  ['Typst language registration', () => registerTypstLanguage(monaco)],
   ['JSONL language registration', () => registerJsonlLanguage(monaco)],
   ['shell Markdown alias registration', () => registerShellMarkdownAliases(monaco)],
   ['delayer cancellation guard', installMonacoDelayerCancellationGuard],
diff --git a/src/renderer/src/lib/new-workspace.test.ts b/src/renderer/src/lib/new-workspace.test.ts
index 78d59f781f2a..d3ca4fa01e63 100644
--- a/src/renderer/src/lib/new-workspace.test.ts
+++ b/src/renderer/src/lib/new-workspace.test.ts
@@ -293,7 +293,12 @@ describe('ensureAgentStartupInTerminal prompt delivery', () => {
       }
     })
 
-    expect(mockSendRuntimePtyInputVerified).toHaveBeenCalledWith({}, 'pty-1', 'fix the spinner\r')
+    expect(mockSendRuntimePtyInputVerified).toHaveBeenCalledWith(
+      {},
+      'pty-1',
+      'fix the spinner\r',
+      'launch'
+    )
     expect(mockTrack).not.toHaveBeenCalledWith('agent_prompt_sent', expect.anything())
   })
 
diff --git a/src/renderer/src/lib/non-secure-context-crypto-stub.ts b/src/renderer/src/lib/non-secure-context-crypto-stub.ts
new file mode 100644
index 000000000000..0413be294b82
--- /dev/null
+++ b/src/renderer/src/lib/non-secure-context-crypto-stub.ts
@@ -0,0 +1,29 @@
+/**
+ * Test-only shape of `globalThis.crypto` on a plain-HTTP origin: getRandomValues
+ * survives, the secure-context-only members do not.
+ *
+ * Swapping the whole `crypto` own property is the only reversible way to do this.
+ * `randomUUID` lives on `Crypto.prototype`, so stubbing it as an own property of
+ * `globalThis.crypto` leaves nothing to restore and leaks into the rest of the file.
+ */
+
+/** The crypto object a browser exposes on a non-secure origin. */
+export function createNonSecureContextCrypto(secureCrypto: Crypto = globalThis.crypto): {
+  getRandomValues: Crypto['getRandomValues']
+} {
+  return { getRandomValues: secureCrypto.getRandomValues.bind(secureCrypto) }
+}
+
+/** Runs `body` with the non-secure crypto shape installed, restoring the real one after. */
+export async function withNonSecureContextCrypto<T>(body: () => Promise<T> | T): Promise<T> {
+  const secureCrypto = globalThis.crypto
+  Object.defineProperty(globalThis, 'crypto', {
+    configurable: true,
+    value: createNonSecureContextCrypto(secureCrypto)
+  })
+  try {
+    return await body()
+  } finally {
+    Object.defineProperty(globalThis, 'crypto', { configurable: true, value: secureCrypto })
+  }
+}
diff --git a/src/renderer/src/lib/non-secure-context-crypto.repro.test.ts b/src/renderer/src/lib/non-secure-context-crypto.repro.test.ts
index f2f1a24c5582..ce16d669f16a 100644
--- a/src/renderer/src/lib/non-secure-context-crypto.repro.test.ts
+++ b/src/renderer/src/lib/non-secure-context-crypto.repro.test.ts
@@ -3,18 +3,15 @@
  * hides crypto.randomUUID and crypto.subtle (secure-context-only). This test
  * recreates that exact global shape and drives the real call sites.
  */
-import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { createNonSecureContextCrypto } from './non-secure-context-crypto-stub'
 
 const realCrypto = globalThis.crypto
 
 beforeEach(() => {
-  // Match a non-secure browser context: getRandomValues stays, the
-  // secure-context-only members are undefined.
   Object.defineProperty(globalThis, 'crypto', {
     configurable: true,
-    value: {
-      getRandomValues: realCrypto.getRandomValues.bind(realCrypto)
-    }
+    value: createNonSecureContextCrypto(realCrypto)
   })
 })
 
@@ -24,7 +21,9 @@ afterEach(() => {
 
 describe('non-secure context (plain HTTP LAN web client)', () => {
   it('crypto.randomUUID is undefined, like the browser reports', () => {
+    // oxlint-disable-next-line no-restricted-properties -- asserting the absence this suite exists for
     expect((globalThis.crypto as Crypto).randomUUID).toBeUndefined()
+    // oxlint-disable-next-line no-restricted-properties -- asserting the absence this suite exists for
     expect(() => (globalThis.crypto as Crypto).randomUUID()).toThrow()
   })
 
@@ -45,11 +44,33 @@ describe('non-secure context (plain HTTP LAN web client)', () => {
     })()
     Object.defineProperty(globalThis, 'crypto', {
       configurable: true,
-      value: { getRandomValues: realCrypto.getRandomValues.bind(realCrypto) }
+      value: createNonSecureContextCrypto(realCrypto)
     })
     expect(await hashOrcaHookScript('echo hi')).toBe(secureHash)
   })
 
+  // Regression for #19667: the store builds this sequencer at module load, so a throw here
+  // white-screened the whole Remote Web client before anything painted.
+  it('loads the renderer agent-status authority and its store slice', async () => {
+    vi.resetModules()
+    const { rendererAgentStatusObservations } = await import('./renderer-agent-status-observations')
+    const { createAgentStatusAuthorityActions } =
+      await import('../store/slices/agent-status-authority-actions')
+    expect(typeof createAgentStatusAuthorityActions).toBe('function')
+    expect(rendererAgentStatusObservations.getAuthorityId()).toMatch(
+      /^renderer:[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/
+    )
+  })
+
+  // Naming two modules only pins today's crash. The reported stack was the whole store
+  // chunk, so evaluate the store root: any new import-time secure-context call anywhere in
+  // that graph fails here.
+  it('evaluates the whole store graph', async () => {
+    vi.resetModules()
+    const { useAppStore } = await import('@/store')
+    expect(typeof useAppStore.getState).toBe('function')
+  })
+
   it('createBrowserUuid does not throw when randomUUID is missing', async () => {
     const { createBrowserUuid } = await import('./browser-uuid')
     expect(createBrowserUuid()).toMatch(
diff --git a/src/renderer/src/lib/pane-manager/mint-stable-pane-id.ts b/src/renderer/src/lib/pane-manager/mint-stable-pane-id.ts
index 10f332f49acc..a6ca7cc2d644 100644
--- a/src/renderer/src/lib/pane-manager/mint-stable-pane-id.ts
+++ b/src/renderer/src/lib/pane-manager/mint-stable-pane-id.ts
@@ -1,25 +1,7 @@
 import type { TerminalLeafId } from '../../../../shared/stable-pane-id'
+import { createBrowserUuid } from '../browser-uuid'
 
-// Why: Electron/test runtimes can lack crypto.randomUUID. The fallback still
-// produces a UUID-shaped v4 id so pane-key validation remains deterministic.
 export function mintStablePaneId(): TerminalLeafId {
-  const cryptoApi = globalThis.crypto as Crypto | undefined
-  if (cryptoApi?.randomUUID) {
-    return cryptoApi.randomUUID() as TerminalLeafId
-  }
-  const bytes = new Uint8Array(16)
-  if (cryptoApi?.getRandomValues) {
-    cryptoApi.getRandomValues(bytes)
-  } else {
-    for (let i = 0; i < bytes.length; i += 1) {
-      bytes[i] = Math.floor(Math.random() * 256)
-    }
-  }
-  bytes[6] = (bytes[6] & 0x0f) | 0x40
-  bytes[8] = (bytes[8] & 0x3f) | 0x80
-  const hex = Array.from(bytes, (byte) => byte.toString(16).padStart(2, '0')).join('')
-  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(
-    16,
-    20
-  )}-${hex.slice(20)}` as TerminalLeafId
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: createBrowserUuid always returns a lowercase v4 UUID, the TerminalLeafId shape.
+  return createBrowserUuid() as TerminalLeafId
 }
diff --git a/src/renderer/src/lib/pane-manager/pane-overlay-focus.test.ts b/src/renderer/src/lib/pane-manager/pane-overlay-focus.test.ts
index 6b51c1ba4498..1f8d603c89f2 100644
--- a/src/renderer/src/lib/pane-manager/pane-overlay-focus.test.ts
+++ b/src/renderer/src/lib/pane-manager/pane-overlay-focus.test.ts
@@ -105,6 +105,26 @@ describe.each(['initial', 'active'] as const)('%s pane focus', (operation) => {
     expect(document.activeElement).toBe(f.textarea)
   })
 
+  it('preserves the focused list during arrow navigation', () => {
+    const f = fixture()
+    const sidebar = overlay('listbox')
+    sidebar.setAttribute('data-worktree-sidebar', '')
+    sidebar.setAttribute('data-keyboard-navigation', '')
+    focus(f)
+    expect(document.activeElement).toBe(sidebar)
+    expect(f.pane.terminal.focus).not.toHaveBeenCalled()
+  })
+
+  it('ignores a navigation marker on a list that no longer owns focus', () => {
+    const f = fixture()
+    const sidebar = overlay('listbox')
+    sidebar.setAttribute('data-worktree-sidebar', '')
+    sidebar.setAttribute('data-keyboard-navigation', '')
+    sidebar.blur()
+    focus(f)
+    expect(document.activeElement).toBe(f.textarea)
+  })
+
   it('allows focus after the overlay closes', () => {
     const f = fixture()
     overlay('menu').style.display = 'none'
diff --git a/src/renderer/src/lib/pane-manager/pane-overlay-focus.ts b/src/renderer/src/lib/pane-manager/pane-overlay-focus.ts
index 0dcf5c07ce90..bb53245df41a 100644
--- a/src/renderer/src/lib/pane-manager/pane-overlay-focus.ts
+++ b/src/renderer/src/lib/pane-manager/pane-overlay-focus.ts
@@ -6,11 +6,12 @@ export function focusPanePreservingOverlays(
 ): void {
   if (
     typeof document !== 'undefined' &&
-    hasVisibleOverlay({
-      ignoreMatches: '[role="listbox"][data-worktree-sidebar]',
-      ignoreContaining: pane.container,
-      ignoreDismissed: true
-    })
+    (document.activeElement?.matches('[data-worktree-sidebar][data-keyboard-navigation]') ||
+      hasVisibleOverlay({
+        ignoreMatches: '[role="listbox"][data-worktree-sidebar]',
+        ignoreContaining: pane.container,
+        ignoreDismissed: true
+      }))
   ) {
     return
   }
diff --git a/src/renderer/src/lib/recent-workspace-tab-rows.test.ts b/src/renderer/src/lib/recent-workspace-tab-rows.test.ts
index b0488309bf38..9babe59d9bf8 100644
--- a/src/renderer/src/lib/recent-workspace-tab-rows.test.ts
+++ b/src/renderer/src/lib/recent-workspace-tab-rows.test.ts
@@ -166,6 +166,28 @@ describe('resolveRecentWorkspaceTabStatus', () => {
     )
   })
 
+  it('surfaces a failed outcome as failed', () => {
+    const failed = entry('failed', 'done', NOW - 1_000, {
+      mainAgent: { state: 'done', outcome: 'failure', stateStartedAt: NOW - 1_000 }
+    })
+
+    expect(resolveRecentWorkspaceTabStatus(row('failed'), sources([failed]), NOW)).toBe('failed')
+  })
+
+  it('surfaces a main agent that failed while its subagent works as failed, above working', () => {
+    const held = (tabId: string, outcome: 'failure' | 'success') =>
+      entry(tabId, 'working', NOW - 1_000, {
+        mainAgent: { state: 'done', outcome, stateStartedAt: NOW - 2_000 }
+      })
+
+    expect(
+      resolveRecentWorkspaceTabStatus(row('held'), sources([held('held', 'failure')]), NOW)
+    ).toBe('failed')
+    expect(
+      resolveRecentWorkspaceTabStatus(row('held'), sources([held('held', 'success')]), NOW)
+    ).toBe('working')
+  })
+
   it('does not let a cleanly finished sibling mask an interruption', () => {
     const interrupted = entry('mixed', 'done', NOW - 1_000, {
       paneKey: `mixed:${LEAF_ID}`,
diff --git a/src/renderer/src/lib/recent-workspace-tab-rows.ts b/src/renderer/src/lib/recent-workspace-tab-rows.ts
index 2f4b172c4755..45f902139539 100644
--- a/src/renderer/src/lib/recent-workspace-tab-rows.ts
+++ b/src/renderer/src/lib/recent-workspace-tab-rows.ts
@@ -7,6 +7,7 @@ import {
   type WorktreeAttention
 } from '@/components/sidebar/smart-attention'
 import { tabHasLivePty } from './tab-has-live-pty'
+import { agentVerdictDisplayMark } from '../../../shared/agent-main-agent-verdict'
 import { isExplicitAgentStatusFresh } from './pane-agent-evidence'
 import type { WorktreeStatus } from './worktree-status'
 import type { TerminalTab } from '../../../shared/terminal-tab-types'
@@ -74,6 +75,21 @@ export function resolveRecentWorkspaceTabStatus(
   const panes = collectTabPaneInputs(row.terminalTab, row.worktreeLastActivityAt, paneSources, now)
   const attention = resolveAttention(panes, now)
   const explicit = STATUS_BY_ATTENTION_CLASS[attention.cls]
+  if (explicit === 'permission') {
+    return explicit
+  }
+  const verdicts = new Set(
+    panes.flatMap((pane) =>
+      pane.kind === 'hook' &&
+      isExplicitAgentStatusFresh(pane.entry, now, AGENT_STATUS_STALE_AFTER_MS)
+        ? [agentVerdictDisplayMark(pane.entry)]
+        : []
+    )
+  )
+  // Why: a failed main agent outranks the subagent work still holding its row live.
+  if (verdicts.has('failed')) {
+    return 'failed'
+  }
   if (explicit === 'working') {
     const hasForegroundWork = panes.some(
       (pane) =>
@@ -82,16 +98,7 @@ export function resolveRecentWorkspaceTabStatus(
     )
     return hasForegroundWork ? 'working' : 'monitoring'
   }
-  if (explicit === 'permission') {
-    return explicit
-  }
-  const hasInterrupted = panes.some(
-    (pane) =>
-      pane.kind === 'hook' &&
-      pane.entry.interrupted === true &&
-      isExplicitAgentStatusFresh(pane.entry, now, AGENT_STATUS_STALE_AFTER_MS)
-  )
-  if (hasInterrupted) {
+  if (verdicts.has('interrupted')) {
     return 'interrupted'
   }
   if (explicit === 'done') {
diff --git a/src/renderer/src/lib/resume-sleeping-agent-session.ts b/src/renderer/src/lib/resume-sleeping-agent-session.ts
index 50fb378888f9..ab2f06b40ef4 100644
--- a/src/renderer/src/lib/resume-sleeping-agent-session.ts
+++ b/src/renderer/src/lib/resume-sleeping-agent-session.ts
@@ -7,7 +7,7 @@ import { AGENT_STATUS_STALE_AFTER_MS } from '../../../shared/agent-status-types'
 import { parsePaneKey } from '../../../shared/stable-pane-id'
 import {
   getProviderSessionClaimKey,
-  isPassiveCompletedHibernationEvidence,
+  activationTreatsNoteAsFinished,
   recordPaneIsOwnedByPreservedPane,
   stablePaneHasLivePty
 } from './sleeping-agent-pane-ownership'
@@ -34,7 +34,7 @@ function clearPassiveCompletedRecordsForClaimKey(
 ): void {
   const state = useAppStore.getState()
   for (const record of records) {
-    if (record.paneKey === keepPaneKey || !isPassiveCompletedHibernationEvidence(record)) {
+    if (record.paneKey === keepPaneKey || !activationTreatsNoteAsFinished(record)) {
       continue
     }
     if (getProviderSessionClaimKey(record) === claimKey) {
@@ -50,7 +50,7 @@ function getCurrentPaneOwnedClaimKeys(records: readonly SleepingAgentSessionReco
     if (
       state.sleepingAgentSessionsByPaneKey[record.paneKey] !== record ||
       isInvalidWorktreeActivationRecord(record) ||
-      isPassiveCompletedHibernationEvidence(record)
+      activationTreatsNoteAsFinished(record)
     ) {
       continue
     }
@@ -240,7 +240,7 @@ export function resumeSleepingAgentSessionsForWorktree(
     (record) => !isInvalidWorktreeActivationRecord(record)
   )
   const activeWorktreeRecords = validWorktreeRecords.filter(
-    (record) => !isPassiveCompletedHibernationEvidence(record)
+    (record) => !activationTreatsNoteAsFinished(record)
   )
   const activeClaimKeys = new Set(activeWorktreeRecords.map(getProviderSessionClaimKey))
   const newestActiveRecordByClaimKey = getNewestActiveRecordsByClaimKey(activeWorktreeRecords)
@@ -280,7 +280,7 @@ export function resumeSleepingAgentSessionsForWorktree(
       continue
     }
     const isPaneOwned = recordPaneIsOwnedByPreservedPane(record, currentState)
-    if (isPassiveCompletedHibernationEvidence(record)) {
+    if (activationTreatsNoteAsFinished(record)) {
       // Why: completed-agent hibernation is passive history; activation should
       // only keep displayable evidence, never start new work from it.
       if (!isPaneOwned || activeClaimKeys.has(claimKey)) {
diff --git a/src/renderer/src/lib/session-write-subscriber.test.ts b/src/renderer/src/lib/session-write-subscriber.test.ts
index 2f31550c6c02..dda5c01f44c9 100644
--- a/src/renderer/src/lib/session-write-subscriber.test.ts
+++ b/src/renderer/src/lib/session-write-subscriber.test.ts
@@ -102,6 +102,27 @@ describe('createSessionWriteSubscriber', () => {
     cleanup()
   })
 
+  it('writes when the gate is already open at creation, with no store tick to wake it', () => {
+    // Why the store-write spy: every other case here opens the gate *after* creating the
+    // subscriber, so the opening setState is itself the tick that produces the first write. With
+    // the gate already open only the creation-time seed can, and equal catalogs no longer publish
+    // a tick to stand in for it.
+    useAppStore.setState({ workspaceSessionReady: true, hydrationSucceeded: true })
+
+    const persist = vi.fn<(payload: WorkspaceSessionWrite) => void>()
+    const storeTicks = vi.fn()
+    const unsubStoreTicks = useAppStore.subscribe(storeTicks)
+    const cleanup = createSessionWriteSubscriber({ store: useAppStore, persist })
+
+    vi.advanceTimersByTime(200)
+
+    expect(storeTicks).not.toHaveBeenCalled()
+    expect(persist).toHaveBeenCalledTimes(1)
+
+    unsubStoreTicks()
+    cleanup()
+  })
+
   it('re-checks the hydration gate when a pending debounce fires', () => {
     const persist = vi.fn<(payload: WorkspaceSessionWrite) => void>()
     const cleanup = createSessionWriteSubscriber({ store: useAppStore, persist })
diff --git a/src/renderer/src/lib/session-write-subscriber.ts b/src/renderer/src/lib/session-write-subscriber.ts
index 685a8e56e3f9..7e7e9cf73605 100644
--- a/src/renderer/src/lib/session-write-subscriber.ts
+++ b/src/renderer/src/lib/session-write-subscriber.ts
@@ -201,7 +201,7 @@ export function createSessionWriteSubscriber({
     return false
   }
 
-  const unsub = store.subscribe((state) => {
+  const evaluateSessionState = (state: AppState): void => {
     if (!shouldPersistWorkspaceSession(state)) {
       return
     }
@@ -255,7 +255,14 @@ export function createSessionWriteSubscriber({
       return
     }
     armFlushTimer()
-  })
+  }
+
+  // Why evaluate once here: `prev === null` is what bootstraps the first full write, so a writer
+  // created when the session gate is *already* open owed that write to whatever unrelated store
+  // tick happened to arrive next. Catalog refreshes no longer publish when nothing changed, so
+  // that incidental wake-up is not guaranteed; seed from the current state instead.
+  evaluateSessionState(store.getState())
+  const unsub = store.subscribe(evaluateSessionState)
 
   const unsubGateOpen = subscribeToPersistGateOpen?.(() => {
     if (pendingChangedFields.size === 0 || timer !== null) {
diff --git a/src/renderer/src/lib/sleeping-agent-pane-ownership.test.ts b/src/renderer/src/lib/sleeping-agent-pane-ownership.test.ts
new file mode 100644
index 000000000000..e12978572016
--- /dev/null
+++ b/src/renderer/src/lib/sleeping-agent-pane-ownership.test.ts
@@ -0,0 +1,35 @@
+import { describe, expect, it } from 'vitest'
+import type { SleepingAgentSessionRecord } from '../../../shared/agent-session-resume'
+import { activationTreatsNoteAsFinished } from './sleeping-agent-pane-ownership'
+
+function note(overrides: Partial<SleepingAgentSessionRecord> = {}): SleepingAgentSessionRecord {
+  return {
+    paneKey: 'tab-1:leaf-1',
+    worktreeId: 'wt-1',
+    agent: 'codex',
+    providerSession: { key: 'session_id', id: 'conv-1' },
+    prompt: '',
+    state: 'done',
+    capturedAt: 1,
+    updatedAt: 1,
+    ...overrides
+  }
+}
+
+describe('activationTreatsNoteAsFinished', () => {
+  it.each([
+    ['a worktree-sleep done note', true, note({ origin: 'worktree-sleep' })],
+    ['a legacy originless done note', true, note()],
+    ['a finished turn idle anchor (live done)', true, note({ origin: 'live' })],
+    [
+      'an interrupted worktree-sleep note',
+      true,
+      note({ origin: 'worktree-sleep', interrupted: true })
+    ],
+    ['an interrupted live turn', false, note({ origin: 'live', interrupted: true })],
+    ['a quit capture', false, note({ origin: 'quit' })],
+    ['a running turn (live working)', false, note({ origin: 'live', state: 'working' })]
+  ])('%s -> %s', (_label, expected, record) => {
+    expect(activationTreatsNoteAsFinished(record)).toBe(expected)
+  })
+})
diff --git a/src/renderer/src/lib/sleeping-agent-pane-ownership.ts b/src/renderer/src/lib/sleeping-agent-pane-ownership.ts
index 8dac858af02d..73294da7c6e5 100644
--- a/src/renderer/src/lib/sleeping-agent-pane-ownership.ts
+++ b/src/renderer/src/lib/sleeping-agent-pane-ownership.ts
@@ -1,5 +1,6 @@
 import type { useAppStore } from '@/store'
 import type { SleepingAgentSessionRecord } from '../../../shared/agent-session-resume'
+import { agentTurnEndedUncleanly } from '../../../shared/agent-main-agent-verdict'
 import type {
   TerminalLayoutSnapshot,
   TerminalPaneLayoutNode,
@@ -17,13 +18,12 @@ export function getProviderSessionClaimKey(record: SleepingAgentSessionRecord):
     : base
 }
 
-// Why quit is excluded: it is an explicit request to keep resumable work. A
-// live interrupted checkpoint is also active work; interrupted worktree-sleep
-// records retain their existing passive/cleanup semantics.
-export function isPassiveCompletedHibernationEvidence(record: SleepingAgentSessionRecord): boolean {
+// Why live+done counts (#16308): workspace activation must not resume a finished turn's idle anchor.
+// Quit asks to keep work resumable and a live stopped or failed turn is unfinished.
+export function activationTreatsNoteAsFinished(record: SleepingAgentSessionRecord): boolean {
   return (
     record.origin !== 'quit' &&
-    !(record.origin === 'live' && record.interrupted === true) &&
+    !(record.origin === 'live' && agentTurnEndedUncleanly(record)) &&
     record.state === 'done'
   )
 }
@@ -125,7 +125,8 @@ function paneWillConnectOnActivation(
   // never cancels it), so any preserved restorable pane cold-restores in place.
   // Gating on the visible tab forked a second live surface onto the same
   // provider session for every non-group-active agent tab. Web-mirror tabs are
-  // the exception: they never mount a local pane, so they cannot own recovery.
+  // the exception: their pane attaches the host PTY instead of cold-restoring
+  // from a note, so they cannot own recovery.
   return !isWebTerminalSurfaceTabId(tabId)
 }
 
@@ -144,7 +145,7 @@ export function recordPaneIsOwnedByPreservedPane(
     if (!tab || !hasMatchingStablePaneLayout(tabId, stable.leafId, state.terminalLayoutsByTabId)) {
       return false
     }
-    if (isPassiveCompletedHibernationEvidence(record)) {
+    if (activationTreatsNoteAsFinished(record)) {
       return true
     }
     // Why: a pane with a live PTY owns its running session regardless of which
diff --git a/src/renderer/src/lib/solidity-language-id-registration.test.ts b/src/renderer/src/lib/solidity-language-id-registration.test.ts
new file mode 100644
index 000000000000..5cfe2598837d
--- /dev/null
+++ b/src/renderer/src/lib/solidity-language-id-registration.test.ts
@@ -0,0 +1,20 @@
+import { readFileSync } from 'node:fs'
+import { createRequire } from 'node:module'
+import { describe, expect, it } from 'vitest'
+import { detectLanguage } from './language-detect'
+
+// Why: Monaco registers Solidity as id 'sol' with 'solidity' only an alias, and
+// mapping an alias silently renders plaintext. Pin against the installed package
+// so an upstream id change fails here instead of in the editor.
+describe('solidity language id', () => {
+  it('matches the id monaco-editor registers for .sol', () => {
+    const require = createRequire(import.meta.url)
+    const source = readFileSync(
+      require.resolve('monaco-editor/esm/vs/basic-languages/solidity/solidity.contribution.js'),
+      'utf8'
+    )
+    const registeredId = /id:\s*["']([^"']+)["']/.exec(source)?.[1]
+    expect(registeredId).toBeDefined()
+    expect(detectLanguage('contracts/Vault.sol')).toBe(registeredId)
+  })
+})
diff --git a/src/renderer/src/lib/startup-draft-input-kind.test.ts b/src/renderer/src/lib/startup-draft-input-kind.test.ts
new file mode 100644
index 000000000000..34c96e3073fa
--- /dev/null
+++ b/src/renderer/src/lib/startup-draft-input-kind.test.ts
@@ -0,0 +1,113 @@
+// @vitest-environment happy-dom
+// A created worktree's draft reaches its agent by one of two renderer routes: the pane's own
+// startup paste, or the draft helper that waits for the agent. Both must write it as launch input.
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { TerminalInputKind } from '../../../shared/terminal-input-kind'
+import { bindSettlePaneSerializer } from '@/components/terminal-pane/pty-connection/pane-serializer-settle'
+import type { ConnectPanePtySession } from '@/components/terminal-pane/pty-connection/connect-pane-pty-session'
+import { STARTUP_DRAFT_PASTE_QUIET_MS } from '@/components/terminal-pane/pty-connection/pty-connect-limits'
+import { pasteDraftToAgentPtyWhenReady, submitPromptToAgentPty } from './agent-paste-draft'
+
+vi.mock('@/store', () => ({
+  useAppStore: {
+    getState: () => ({ settings: {}, terminalLayoutsByTabId: {} }),
+    subscribe: () => () => {}
+  }
+}))
+
+vi.mock('./worktree-runtime-owner', () => ({
+  getSettingsForWorktreeRuntimeOwner: () => ({}),
+  getRuntimeEnvironmentIdForWorktree: () => null
+}))
+
+vi.mock('./agent-draft-readiness', () => ({
+  waitForAgentDraftInputReady: async () => true
+}))
+
+const DRAFT = 'plan the migration'
+const originalApi = window.api
+
+function stubPtyApi(): { kinds: TerminalInputKind[] } {
+  const kinds: TerminalInputKind[] = []
+  const writeAccepted = vi.fn(async (_id: string, _data: string, inputKind: TerminalInputKind) => {
+    kinds.push(inputKind)
+    return true
+  })
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: both routes reach only pty.writeAccepted.
+  window.api = { pty: { writeAccepted, write: vi.fn() } } as unknown as typeof window.api
+  return { kinds }
+}
+
+/** The pane route: the pane's transport pastes the draft once the agent's composer is ready. */
+async function paneRouteKinds(): Promise<TerminalInputKind[]> {
+  const { kinds } = stubPtyApi()
+  const transport = {
+    getPtyId: () => 'pty-1',
+    sendInput: () => true,
+    sendInputAccepted: (data: string, inputKind: TerminalInputKind) =>
+      window.api.pty.writeAccepted('pty-1', data, inputKind)
+  }
+  const pane = { id: 1 }
+  const bag: Record<string, unknown> = {
+    pane,
+    transport,
+    disposed: false,
+    connectionId: null,
+    ownsStartupDraftPaste: true,
+    shouldDeliverStartupViaTerminalPaste: false,
+    startupDraftPrompt: DRAFT,
+    recordTerminalInputForHibernation: () => {},
+    deps: { worktreeId: 'wt-1', paneTransportsRef: { current: new Map([[pane.id, transport]]) } }
+  }
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the session is an any-typed bag; the draft path reads only the fields above.
+  const session = bag as unknown as ConnectPanePtySession
+  bindSettlePaneSerializer(session)
+  session.observeStartupDraftPasteReadiness('\x1b[?2004h')
+  await vi.advanceTimersByTimeAsync(STARTUP_DRAFT_PASTE_QUIET_MS)
+  await vi.runAllTimersAsync()
+  return kinds
+}
+
+/** The helper route: the draft helper waits for the agent, then writes through the runtime. */
+async function helperRouteKinds(): Promise<TerminalInputKind[]> {
+  const { kinds } = stubPtyApi()
+  const pasted = pasteDraftToAgentPtyWhenReady({
+    tabId: 'tab-1',
+    ptyId: 'pty-1',
+    content: DRAFT,
+    agent: 'aider'
+  })
+  await vi.runAllTimersAsync()
+  await expect(pasted).resolves.toBe(true)
+  return kinds
+}
+
+describe('a created worktree’s startup draft', () => {
+  beforeEach(() => {
+    vi.useFakeTimers()
+  })
+
+  afterEach(() => {
+    vi.useRealTimers()
+    window.api = originalApi
+  })
+
+  it('writes as launch input on both renderer routes', async () => {
+    const paneKinds = await paneRouteKinds()
+    const helperKinds = await helperRouteKinds()
+
+    expect(paneKinds.length).toBeGreaterThan(0)
+    expect(new Set(paneKinds)).toEqual(new Set(['launch']))
+    expect(new Set(helperKinds)).toEqual(new Set(paneKinds))
+  })
+
+  it('differs from a prompt submitted to an agent that is already running', async () => {
+    const { kinds } = stubPtyApi()
+
+    const submitted = submitPromptToAgentPty({ tabId: 'tab-1', ptyId: 'pty-1', content: DRAFT })
+    await vi.runAllTimersAsync()
+
+    await expect(submitted).resolves.toBe(true)
+    expect(new Set(kinds)).toEqual(new Set(['driving']))
+  })
+})
diff --git a/src/renderer/src/lib/structured-agent-session-launch-options.test.ts b/src/renderer/src/lib/structured-agent-session-launch-options.test.ts
index c48ccf403e71..8fa72308538f 100644
--- a/src/renderer/src/lib/structured-agent-session-launch-options.test.ts
+++ b/src/renderer/src/lib/structured-agent-session-launch-options.test.ts
@@ -243,12 +243,16 @@ describe('picks made while a chat launches', () => {
     await settle()
     setOptionReplies[0]!.resolve({
       ok: false,
-      refusal: { code: 'agent_session_option_invalid', message: 'Model gpt-missing is unavailable' }
+      refusal: {
+        code: 'agent_session_operation_capacity',
+        message: 'Model gpt-missing is unavailable'
+      }
     })
 
+    // The picker gets the refusal as a fact; the host's diagnostic is not kept.
     await expect(pick).resolves.toEqual({
       kind: 'refused',
-      message: 'Model gpt-missing is unavailable'
+      failure: { kind: 'refused', code: 'agent_session_operation_capacity' }
     })
     await expect(launch.promptDeliveryResult).resolves.toEqual({
       delivered: true,
diff --git a/src/renderer/src/lib/structured-agent-session-launch-options.ts b/src/renderer/src/lib/structured-agent-session-launch-options.ts
index ea1f1cb18cb2..091e7543f88a 100644
--- a/src/renderer/src/lib/structured-agent-session-launch-options.ts
+++ b/src/renderer/src/lib/structured-agent-session-launch-options.ts
@@ -9,6 +9,8 @@ import {
   structuredAgentSessionPayloadFingerprint
 } from '../../../shared/structured-agent-session-mutation'
 import { callStructuredAgentSession } from '@/runtime/structured-agent-session-client'
+import { RuntimeRpcCallError } from '@/runtime/runtime-rpc-result'
+import { createBrowserUuid } from '@/lib/browser-uuid'
 import {
   StructuredAgentSessionLaunchCancelledError,
   type StructuredAgentLaunchReceipt
@@ -19,6 +21,11 @@ import {
   subscribeStructuredAgentLaunchStatus,
   type StructuredLaunchState
 } from './structured-agent-session-launch-registry'
+import {
+  agentSessionRefusalFailure,
+  agentSessionRpcErrorFailure,
+  type AgentSessionWriteFailure
+} from '../../../shared/agent-session-write-failure'
 
 /** The options a launch starts with, replaced whole so readers can compare by identity. */
 export type StructuredLaunchSelection = {
@@ -30,7 +37,7 @@ export type StructuredLaunchSelection = {
 
 export type StructuredLaunchOptionOutcome =
   | { kind: 'accepted'; options: Readonly<Record<string, string>> }
-  | { kind: 'refused'; message: string }
+  | { kind: 'refused'; failure: AgentSessionWriteFailure }
   | { kind: 'superseded' }
 
 type OptionReply = (outcome: StructuredLaunchOptionOutcome) => void
@@ -87,7 +94,7 @@ async function setLaunchOption(
     >({ kind: 'local' }, 'agentSession.setOption', {
       envelope: {
         sessionId,
-        clientOperationId: createStructuredAgentSessionOperationId(() => crypto.randomUUID()),
+        clientOperationId: createStructuredAgentSessionOperationId(createBrowserUuid),
         expectedRuntimeFence: fence,
         payloadFingerprint: structuredAgentSessionPayloadFingerprint({
           method: 'agentSession.setOption',
@@ -99,9 +106,14 @@ async function setLaunchOption(
     })
     return result.ok
       ? { kind: 'accepted', options: result.value.options ?? { [key]: value } }
-      : { kind: 'refused', message: result.refusal.message }
+      : { kind: 'refused', failure: agentSessionRefusalFailure(result.refusal) }
   } catch (error) {
-    return { kind: 'refused', message: error instanceof Error ? error.message : String(error) }
+    return {
+      kind: 'refused',
+      failure: agentSessionRpcErrorFailure(
+        error instanceof RuntimeRpcCallError ? error.code : undefined
+      )
+    }
   }
 }
 
diff --git a/src/renderer/src/lib/structured-agent-session-launch-prompt.test.ts b/src/renderer/src/lib/structured-agent-session-launch-prompt.test.ts
index b0e8d0674ffb..6945c0456454 100644
--- a/src/renderer/src/lib/structured-agent-session-launch-prompt.test.ts
+++ b/src/renderer/src/lib/structured-agent-session-launch-prompt.test.ts
@@ -1,7 +1,10 @@
 // @vitest-environment happy-dom
 
 import { beforeEach, describe, expect, it, vi } from 'vitest'
-import { enqueueStructuredAgentSessionLaunchPrompt } from '@/components/native-chat/structured-agent-session-outbox-storage'
+import {
+  enqueueStructuredAgentSessionLaunchPrompt,
+  mutateStructuredAgentSessionLaunchPrompt
+} from '@/components/native-chat/structured-agent-session-outbox-storage'
 
 const mocks = vi.hoisted(() => ({ call: vi.fn() }))
 
@@ -57,4 +60,32 @@ describe('settleStructuredAgentLaunchPrompt', () => {
     }[]
     expect(persisted).toMatchObject([{ state: 'dispatching' }])
   })
+
+  it('drops the previous attempt failure when the launch path sends the message again', async () => {
+    const stagedEntry = enqueueStructuredAgentSessionLaunchPrompt('session-1', 'review this')
+    mutateStructuredAgentSessionLaunchPrompt(
+      'session-1',
+      stagedEntry!.clientMessageId,
+      (entry) => ({
+        ...entry,
+        lastFailure: { kind: 'refused', code: 'agent_session_operation_capacity' }
+      })
+    )
+    mocks.call.mockResolvedValue({
+      ok: false,
+      refusal: { code: 'agent_session_checkpoint_stale', message: 'stale' }
+    })
+
+    await settleStructuredAgentLaunchPrompt({
+      launchResult: Promise.resolve({ sessionId: 'session-1', fence: 1 }),
+      options: { prompt: 'review this' },
+      stagedEntry
+    })
+
+    const persisted: unknown = JSON.parse(localStorage.getItem(localStorage.key(0)!) ?? '[]')
+    expect(persisted).toHaveLength(1)
+    expect(persisted).not.toContainEqual(
+      expect.objectContaining({ lastFailure: expect.anything() })
+    )
+  })
 })
diff --git a/src/renderer/src/lib/structured-agent-session-launch-prompt.ts b/src/renderer/src/lib/structured-agent-session-launch-prompt.ts
index de7f4733644f..84c8fa6e1910 100644
--- a/src/renderer/src/lib/structured-agent-session-launch-prompt.ts
+++ b/src/renderer/src/lib/structured-agent-session-launch-prompt.ts
@@ -4,15 +4,18 @@ import type {
 } from '../../../shared/agent-session-wire'
 import {
   requeueStructuredAgentSessionSendRefusal,
+  stageStructuredAgentSessionOutboxEntryForSend,
   structuredAgentSessionSendRequest,
   type StructuredAgentSessionOutboxEntry
 } from '../../../shared/structured-agent-session-outbox'
+import { agentSessionRefusalFailure } from '../../../shared/agent-session-write-failure'
 import { createStructuredAgentSessionOperationId } from '../../../shared/structured-agent-session-mutation'
 import {
   mutateStructuredAgentSessionLaunchPrompt,
   type StructuredAgentSessionLaunchPromptMutation
 } from '@/components/native-chat/structured-agent-session-outbox-storage'
 import { callStructuredAgentSession } from '@/runtime/structured-agent-session-client'
+import { createBrowserUuid } from '@/lib/browser-uuid'
 
 export type StructuredPromptDeliveryResult = {
   delivered: boolean
@@ -91,11 +94,9 @@ async function dispatchStructuredLaunchPrompt(
   receipt: LaunchReceipt
 ): Promise<boolean> {
   if (
-    !mutateEntry(entry, (current) => ({
-      ...current,
-      state: 'dispatching',
-      lastAttemptAt: Date.now()
-    }))
+    !mutateEntry(entry, (current) =>
+      stageStructuredAgentSessionOutboxEntryForSend(current, Date.now())
+    )
   ) {
     return false
   }
@@ -111,8 +112,8 @@ async function dispatchStructuredLaunchPrompt(
       mutateEntry(entry, (current) =>
         requeueStructuredAgentSessionSendRefusal(
           current,
-          result.refusal.code,
-          () => createStructuredAgentSessionOperationId(() => crypto.randomUUID()),
+          agentSessionRefusalFailure(result.refusal),
+          () => createStructuredAgentSessionOperationId(createBrowserUuid),
           entry.lastAttemptAt !== null
         )
       )
diff --git a/src/renderer/src/lib/terminal-layout-equality.ts b/src/renderer/src/lib/terminal-layout-equality.ts
index 88eca78e0d3d..b13dcc37bb9e 100644
--- a/src/renderer/src/lib/terminal-layout-equality.ts
+++ b/src/renderer/src/lib/terminal-layout-equality.ts
@@ -49,6 +49,7 @@ export function terminalLayoutEqual(
     terminalLayoutNodeEqual(a?.root, b.root) &&
     (a?.activeLeafId ?? null) === b.activeLeafId &&
     (a?.expandedLeafId ?? null) === b.expandedLeafId &&
+    (a?.chatLeafId ?? null) === (b.chatLeafId ?? null) &&
     sameStringRecord(a?.ptyIdsByLeafId, b.ptyIdsByLeafId) &&
     sameStringRecord(a?.buffersByLeafId, b.buffersByLeafId) &&
     sameStringRecord(a?.scrollbackRefsByLeafId, b.scrollbackRefsByLeafId) &&
diff --git a/src/renderer/src/lib/terminal-links-cjk.test.ts b/src/renderer/src/lib/terminal-links-cjk.test.ts
new file mode 100644
index 000000000000..d1cddfb74f3f
--- /dev/null
+++ b/src/renderer/src/lib/terminal-links-cjk.test.ts
@@ -0,0 +1,43 @@
+import { describe, expect, it } from 'vitest'
+import { extractTerminalFileLinks, resolveTerminalFileLinkText } from './terminal-links'
+
+describe('CJK terminal path names', () => {
+  for (const character of ['・', '･', '〜', '～']) {
+    it.each([
+      '/tmp/前CHAR後/a.txt',
+      'C:/tmp/前CHAR後/a.txt',
+      String.raw`C:\tmp\前CHAR後\a.txt`,
+      '//nas/base/前CHAR後/a.txt',
+      String.raw`\\nas\base\前CHAR後\a.txt`,
+      './前CHAR後/a.txt',
+      '/tmp/前CHAR後/space name/a.txt'
+    ])(`keeps ${character} in %s`, (template) => {
+      const filePath = template.replace('CHAR', character)
+      const links = extractTerminalFileLinks(filePath)
+      expect(links.map((link) => link.pathText)).toEqual([filePath])
+      expect(links[0]).toMatchObject({ startIndex: 0, endIndex: filePath.length })
+    })
+
+    it(`preserves location and normalized Windows target for ${character}`, () => {
+      expect(resolveTerminalFileLinkText(`C:\\tmp\\前${character}後\\a.txt:12:3`, '/cwd')).toEqual({
+        absolutePath: `C:/tmp/前${character}後/a.txt`,
+        line: 12,
+        column: 3
+      })
+    })
+
+    it.each([',', ';', '"', "'", '，', '。'])(`stops ${character} paths at %s`, (delimiter) => {
+      const filePath = `/tmp/前${character}後/a.txt`
+      expect(
+        extractTerminalFileLinks(`${filePath}${delimiter}次`).map((link) => link.pathText)
+      ).toEqual([filePath])
+    })
+
+    it(`keeps URI handling separate for ${character}`, () => {
+      expect(extractTerminalFileLinks(`https://example.com/前${character}後/a.txt`)).toEqual([])
+      expect(extractTerminalFileLinks(`file:///tmp/前${character}後/a.txt`)[0]?.pathText).toBe(
+        `/tmp/前${character}後/a.txt`
+      )
+    })
+  }
+})
diff --git a/src/renderer/src/lib/terminal-links.ts b/src/renderer/src/lib/terminal-links.ts
index 970c6d9208c7..bffbc9c653a0 100644
--- a/src/renderer/src/lib/terminal-links.ts
+++ b/src/renderer/src/lib/terminal-links.ts
@@ -33,8 +33,9 @@ export type ResolvedTerminalFileLink = Pick<ParsedTerminalFileLink, 'line' | 'co
 // `:line` and `:col` suffixes (e.g. `src/foo.ts:12:3`, `./bin`, `/abs/path`).
 // Why: framework route files commonly use punctuation segments like
 // `app/(shop)/products/[id]/page.tsx`; keep those links whole.
+// Keep Japanese middle dots and tildes without admitting prose delimiters.
 const LOCAL_PATH_REGEX =
-  /(?:~[\\/]|[\\/]|\.{1,2}[\\/]|[A-Za-z]:[\\/]|[\p{L}\p{N}\p{M}._-]+[\\/])[\p{L}\p{N}\p{M}._~\-/%+@\\()[\]]*(?::\d+)?(?::\d+)?/gu
+  /(?:~[\\/]|[\\/]|\.{1,2}[\\/]|[A-Za-z]:[\\/]|[\p{L}\p{N}\p{M}._-]+[\\/])[\p{L}\p{N}\p{M}._~\-/%+@\\()[\]\u30FB\uFF65\u301C\uFF5E]*(?::\d+)?(?::\d+)?/gu
 
 // Matches separator paths whose file or folder names include spaces. This runs
 // before LOCAL_PATH_REGEX so `/Users/A/Foo Bar/file.ts` is claimed as one link
diff --git a/src/renderer/src/lib/unified-tab-anchor-insertion.test.ts b/src/renderer/src/lib/unified-tab-anchor-insertion.test.ts
new file mode 100644
index 000000000000..49592599b7c0
--- /dev/null
+++ b/src/renderer/src/lib/unified-tab-anchor-insertion.test.ts
@@ -0,0 +1,106 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type { Tab, TabGroup } from '../../../shared/tab-types'
+
+type AnchorStoreState = {
+  unifiedTabsByWorktree: Record<string, Tab[]>
+  groupsByWorktree: Record<string, TabGroup[]>
+  reorderUnifiedTabs: ReturnType<typeof vi.fn>
+}
+
+const mocks = vi.hoisted(() => {
+  const state: { current: AnchorStoreState | null } = { current: null }
+  return { state }
+})
+
+vi.mock('../store', () => ({
+  useAppStore: { getState: () => mocks.state.current }
+}))
+
+import { insertUnifiedTabAfterAnchor } from './unified-tab-anchor-insertion'
+
+const WT = 'wt-1'
+
+function tab(id: string, groupId: string, isPinned = false): Tab {
+  return {
+    id,
+    entityId: id,
+    groupId,
+    worktreeId: WT,
+    contentType: 'terminal',
+    label: id,
+    customLabel: null,
+    color: null,
+    sortOrder: 0,
+    createdAt: 1,
+    isPinned
+  }
+}
+
+function seed(tabs: Tab[], groups: TabGroup[]): void {
+  mocks.state.current = {
+    unifiedTabsByWorktree: { [WT]: tabs },
+    groupsByWorktree: { [WT]: groups },
+    reorderUnifiedTabs: vi.fn()
+  }
+}
+
+describe('insertUnifiedTabAfterAnchor', () => {
+  beforeEach(() => {
+    seed([], [])
+  })
+
+  it('moves a late terminal right after its anchor', () => {
+    seed(
+      [tab('A', 'g1'), tab('B', 'g1'), tab('C', 'g1'), tab('T', 'g1')],
+      [{ id: 'g1', worktreeId: WT, activeTabId: 'A', tabOrder: ['A', 'B', 'C', 'T'] }]
+    )
+    insertUnifiedTabAfterAnchor(WT, 'T', 'A')
+    expect(mocks.state.current?.reorderUnifiedTabs).toHaveBeenCalledWith(
+      'g1',
+      ['A', 'T', 'B', 'C'],
+      {
+        recordInteraction: false
+      }
+    )
+  })
+
+  it('keeps an unpinned terminal after the pinned prefix', () => {
+    seed(
+      [tab('P1', 'g1', true), tab('P2', 'g1', true), tab('C', 'g1'), tab('T', 'g1')],
+      [{ id: 'g1', worktreeId: WT, activeTabId: 'P1', tabOrder: ['P1', 'P2', 'C', 'T'] }]
+    )
+    insertUnifiedTabAfterAnchor(WT, 'T', 'P1')
+    expect(mocks.state.current?.reorderUnifiedTabs).toHaveBeenCalledWith(
+      'g1',
+      ['P1', 'P2', 'T', 'C'],
+      {
+        recordInteraction: false
+      }
+    )
+  })
+
+  it('is a no-op for a missing anchor or tabs in different groups', () => {
+    seed(
+      [tab('A', 'g1'), tab('T', 'g2')],
+      [
+        { id: 'g1', worktreeId: WT, activeTabId: 'A', tabOrder: ['A'] },
+        { id: 'g2', worktreeId: WT, activeTabId: 'T', tabOrder: ['T'] }
+      ]
+    )
+    insertUnifiedTabAfterAnchor(WT, 'T', 'A')
+    insertUnifiedTabAfterAnchor(WT, 'T', 'missing')
+    expect(mocks.state.current?.reorderUnifiedTabs).not.toHaveBeenCalled()
+  })
+
+  it('is a no-op when a stale group order lists a tab another group owns', () => {
+    seed(
+      [tab('A', 'g1'), tab('T', 'g2')],
+      [
+        { id: 'g1', worktreeId: WT, activeTabId: 'A', tabOrder: ['A', 'T'] },
+        { id: 'g2', worktreeId: WT, activeTabId: 'T', tabOrder: ['T'] }
+      ]
+    )
+    insertUnifiedTabAfterAnchor(WT, 'T', 'A')
+    expect(mocks.state.current?.reorderUnifiedTabs).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/renderer/src/lib/unified-tab-anchor-insertion.ts b/src/renderer/src/lib/unified-tab-anchor-insertion.ts
index 2b9055b919f2..ab3bc2c68b7a 100644
--- a/src/renderer/src/lib/unified-tab-anchor-insertion.ts
+++ b/src/renderer/src/lib/unified-tab-anchor-insertion.ts
@@ -1,6 +1,7 @@
 import { useAppStore } from '../store'
+import { insertTabIdIntoOrder } from '../store/slices/tabs/tabs-tab-order'
 
-/** Move `tabId` to sit immediately after `anchorTabId`; no-op unless both share a group. */
+/** Move `tabId` to sit immediately after `anchorTabId`; no-op unless both share a live group. */
 export function insertUnifiedTabAfterAnchor(
   worktreeId: string,
   tabId: string,
@@ -10,13 +11,30 @@ export function insertUnifiedTabAfterAnchor(
     return
   }
   const state = useAppStore.getState()
+  const tabs = state.unifiedTabsByWorktree[worktreeId] ?? []
+  const tab = tabs.find((candidate) => candidate.id === tabId)
+  const anchor = tabs.find((candidate) => candidate.id === anchorTabId)
+  if (!tab || !anchor || tab.groupId !== anchor.groupId) {
+    return
+  }
   const group = (state.groupsByWorktree[worktreeId] ?? []).find(
-    (candidate) => candidate.tabOrder.includes(tabId) && candidate.tabOrder.includes(anchorTabId)
+    (candidate) => candidate.id === tab.groupId
+  )
+  if (!group?.tabOrder.includes(tabId) || !group.tabOrder.includes(anchorTabId)) {
+    return
+  }
+  const order = insertTabIdIntoOrder(
+    group.tabOrder,
+    tabs,
+    tabId,
+    tab.isPinned === true,
+    anchorTabId
   )
-  if (!group) {
+  if (
+    order.length === group.tabOrder.length &&
+    order.every((id, index) => id === group.tabOrder[index])
+  ) {
     return
   }
-  const order = group.tabOrder.filter((id) => id !== tabId)
-  order.splice(order.indexOf(anchorTabId) + 1, 0, tabId)
   state.reorderUnifiedTabs(group.id, order, { recordInteraction: false })
 }
diff --git a/src/renderer/src/lib/wake-sleeping-agents-in-background.test.ts b/src/renderer/src/lib/wake-sleeping-agents-in-background.test.ts
index 40281b4a2443..dc8dc8452b8f 100644
--- a/src/renderer/src/lib/wake-sleeping-agents-in-background.test.ts
+++ b/src/renderer/src/lib/wake-sleeping-agents-in-background.test.ts
@@ -23,7 +23,7 @@ vi.mock('./resume-sleeping-agent-session', () => ({
 // the gating, not the predicate internals.
 const isPassiveSpy = vi.fn()
 vi.mock('./sleeping-agent-pane-ownership', () => ({
-  isPassiveCompletedHibernationEvidence: (record: unknown) => isPassiveSpy(record),
+  activationTreatsNoteAsFinished: (record: unknown) => isPassiveSpy(record),
   recordPaneIsOwnedByPreservedPane: () => false,
   getProviderSessionClaimKey: (record: {
     worktreeId: string
diff --git a/src/renderer/src/lib/wake-sleeping-agents-in-background.ts b/src/renderer/src/lib/wake-sleeping-agents-in-background.ts
index df22b07f209b..4cfe88c51b82 100644
--- a/src/renderer/src/lib/wake-sleeping-agents-in-background.ts
+++ b/src/renderer/src/lib/wake-sleeping-agents-in-background.ts
@@ -9,7 +9,7 @@ import { parseLegacyNumericPaneKey, parsePaneKey } from '../../../shared/stable-
 import { resumeSleepingAgentSessionsForWorktree } from './resume-sleeping-agent-session'
 import {
   getProviderSessionClaimKey,
-  isPassiveCompletedHibernationEvidence,
+  activationTreatsNoteAsFinished,
   recordPaneIsOwnedByPreservedPane
 } from './sleeping-agent-pane-ownership'
 
@@ -89,12 +89,12 @@ function getCanonicalPassiveWakeRecords(
 ): SleepingAgentSessionRecord[] {
   const activeClaimKeys = new Set(
     records
-      .filter((record) => !isPassiveCompletedHibernationEvidence(record))
+      .filter((record) => !activationTreatsNoteAsFinished(record))
       .map(getProviderSessionClaimKey)
   )
   const recordsByClaim = new Map<string, SleepingAgentSessionRecord[]>()
   for (const record of records) {
-    if (!isPassiveCompletedHibernationEvidence(record)) {
+    if (!activationTreatsNoteAsFinished(record)) {
       continue
     }
     const claimKey = getProviderSessionClaimKey(record)
diff --git a/src/renderer/src/lib/workspace-activation-terminal-focus.test.ts b/src/renderer/src/lib/workspace-activation-terminal-focus.test.ts
index 26bbe4b1ebda..e87fc615042e 100644
--- a/src/renderer/src/lib/workspace-activation-terminal-focus.test.ts
+++ b/src/renderer/src/lib/workspace-activation-terminal-focus.test.ts
@@ -1,209 +1,235 @@
-import type * as SyncRuntimeGraphModule from '@/runtime/sync-runtime-graph'
-import { beforeEach, describe, expect, it, vi } from 'vitest'
-
-const focusTerminalTabSurfaceMock = vi.hoisted(() => vi.fn())
-const focusRuntimeTerminalSurfaceMock = vi.hoisted(() => vi.fn())
-const getStateMock = vi.hoisted(() => vi.fn())
-
-vi.mock('@/lib/focus-terminal-tab-surface', () => ({
-  focusTerminalTabSurface: focusTerminalTabSurfaceMock
-}))
-
-vi.mock('@/runtime/sync-runtime-graph', () => ({
-  focusRuntimeTerminalSurface: focusRuntimeTerminalSurfaceMock
+// @vitest-environment happy-dom
+import type { AppState } from '@/store/types'
+import { act, createElement } from 'react'
+import { createRoot } from 'react-dom/client'
+import { Dialog, DialogContent, DialogTitle } from '@/components/ui/dialog'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+globalThis.IS_REACT_ACT_ENVIRONMENT = true
+
+const mocks = vi.hoisted(() => ({
+  focus: vi.fn(),
+  getState: vi.fn(),
+  subscribe: vi.fn()
 }))
-
+vi.mock('@/runtime/sync-runtime-graph', () => ({ focusRuntimeTerminalSurface: mocks.focus }))
 vi.mock('@/store', () => ({
-  useAppStore: {
-    getState: getStateMock
-  }
+  useAppStore: { getState: mocks.getState, subscribe: mocks.subscribe }
 }))
 
 import { queueWorkspaceActivationTerminalFocus } from './workspace-activation-terminal-focus'
 
-const CHAT_VIEW_LEAF_ID = 'cccccccc-cccc-4ccc-8ccc-cccccccccccc'
-
-type FocusState = {
-  activeWorktreeId: string | null
-  activeView: string
-  activeTabType: string
-  activeTabId: string | null
-}
-
-let pendingFrame: (() => void) | null = null
-
-function setFocusState(state: FocusState): void {
-  getStateMock.mockImplementation(() => state)
-}
+let state: Pick<
+  AppState,
+  | 'activeWorktreeId'
+  | 'activeWorkspaceExecutionHostId'
+  | 'activeView'
+  | 'activeTabType'
+  | 'activeTabId'
+  | 'activeModal'
+>
+let frame: FrameRequestCallback | null
+let notifyStore: () => void
+let notifyMount: () => void
+const unsubscribe = vi.fn()
+const disconnect = vi.fn()
 
 function flushFrame(): void {
-  const frame = pendingFrame
-  pendingFrame = null
-  frame?.()
+  const callback = frame
+  frame = null
+  callback?.(0)
 }
 
-describe('queueWorkspaceActivationTerminalFocus', () => {
-  beforeEach(() => {
-    vi.clearAllMocks()
-    pendingFrame = null
-    vi.stubGlobal('requestAnimationFrame', (callback: FrameRequestCallback) => {
-      pendingFrame = () => callback(0)
-      return 1
-    })
-    focusRuntimeTerminalSurfaceMock.mockReturnValue(false)
+beforeEach(() => {
+  vi.clearAllMocks()
+  vi.useFakeTimers()
+  frame = null
+  state = {
+    activeWorktreeId: 'wt-1',
+    activeWorkspaceExecutionHostId: null,
+    activeView: 'terminal',
+    activeTabType: 'terminal',
+    activeTabId: 'tab-1',
+    activeModal: 'none'
+  }
+  mocks.getState.mockImplementation(() => state)
+  mocks.subscribe.mockImplementation((listener) => {
+    notifyStore = listener
+    return unsubscribe
   })
+  mocks.focus.mockReturnValue(false)
+  vi.stubGlobal('requestAnimationFrame', (callback: FrameRequestCallback) => {
+    frame = callback
+    return 1
+  })
+  vi.stubGlobal('cancelAnimationFrame', () => {
+    frame = null
+  })
+  vi.stubGlobal(
+    'MutationObserver',
+    class {
+      constructor(callback: () => void) {
+        notifyMount = callback
+      }
+      observe = vi.fn()
+      disconnect = disconnect
+    }
+  )
+})
+afterEach(() => {
+  document.dispatchEvent(new Event('pointerdown'))
+  document.body.replaceChildren()
+  vi.useRealTimers()
+  vi.unstubAllGlobals()
+})
 
-  it('focuses the primary tab from the activation result after the modal close frame', () => {
-    setFocusState({
-      activeWorktreeId: 'wt-1',
-      activeView: 'terminal',
-      activeTabType: 'terminal',
-      activeTabId: 'tab-1'
-    })
-
-    queueWorkspaceActivationTerminalFocus('wt-1', { primaryTabId: 'tab-1' })
-
-    expect(focusRuntimeTerminalSurfaceMock).not.toHaveBeenCalled()
+describe('workspace activation focus', () => {
+  it('focuses an existing terminal after the palette closes and cleans up', () => {
+    mocks.focus.mockReturnValue(true)
+    expect(queueWorkspaceActivationTerminalFocus('wt-1', { primaryTabId: 'tab-1' })).toBe(true)
+    expect(mocks.focus).not.toHaveBeenCalled()
     flushFrame()
-
-    expect(focusRuntimeTerminalSurfaceMock).toHaveBeenCalledWith('tab-1', null, 'wt-1')
-    expect(focusTerminalTabSurfaceMock).toHaveBeenCalledWith('tab-1')
+    expect(mocks.focus).toHaveBeenCalledWith('tab-1', null, 'wt-1')
+    expect(unsubscribe).toHaveBeenCalledOnce()
+    expect(disconnect).toHaveBeenCalledOnce()
+    expect(vi.getTimerCount()).toBe(0)
   })
 
-  it('uses the adopted active terminal tab when activation did not create one', () => {
-    setFocusState({
-      activeWorktreeId: 'wt-1',
-      activeView: 'terminal',
-      activeTabType: 'terminal',
-      activeTabId: 'tab-adopted'
-    })
-
+  it('waits for a sleeping terminal to mount instead of focusing another workspace', () => {
     queueWorkspaceActivationTerminalFocus('wt-1', { primaryTabId: null })
     flushFrame()
+    expect(mocks.focus).toHaveBeenCalledTimes(1)
+    expect(frame).toBeNull()
+    mocks.focus.mockReturnValue(true)
+    notifyMount()
+    flushFrame()
+    expect(mocks.focus).toHaveBeenLastCalledWith('tab-1', null, 'wt-1')
+    expect(unsubscribe).toHaveBeenCalledOnce()
+  })
 
-    expect(focusRuntimeTerminalSurfaceMock).toHaveBeenCalledWith('tab-adopted', null, 'wt-1')
-    expect(focusTerminalTabSurfaceMock).toHaveBeenCalledWith('tab-adopted')
+  it('claims a workspace whose terminal tab is created asynchronously', () => {
+    state.activeTabId = null
+    expect(queueWorkspaceActivationTerminalFocus('wt-1', { primaryTabId: null })).toBe(true)
+    flushFrame()
+    expect(mocks.focus).not.toHaveBeenCalled()
+    state.activeTabId = 'restored-tab'
+    notifyStore()
+    flushFrame()
+    mocks.focus.mockReturnValue(true)
+    notifyMount()
+    flushFrame()
+    expect(mocks.focus).toHaveBeenLastCalledWith('restored-tab', null, 'wt-1')
   })
 
-  it('does not fall back to DOM focus when the runtime surface handled focus', () => {
-    focusRuntimeTerminalSurfaceMock.mockReturnValue(true)
-    setFocusState({
-      activeWorktreeId: 'wt-1',
-      activeView: 'terminal',
-      activeTabType: 'terminal',
-      activeTabId: 'tab-1'
-    })
+  it.each([
+    { activeWorktreeId: 'wt-2' },
+    { activeWorkspaceExecutionHostId: 'ssh:second-host' },
+    { activeView: 'settings' },
+    { activeTabType: 'browser' },
+    { activeTabId: 'tab-2' },
+    { activeModal: 'worktree-palette' }
+  ] as const)('cancels when selection changes to %j during restoration', (change) => {
+    queueWorkspaceActivationTerminalFocus('wt-1', { primaryTabId: 'tab-1' })
+    flushFrame()
+    mocks.focus.mockClear()
+    state = { ...state, ...change }
+    notifyStore()
+    flushFrame()
+    notifyMount()
+    flushFrame()
+    expect(mocks.focus).not.toHaveBeenCalled()
+    expect(unsubscribe).toHaveBeenCalledOnce()
+  })
 
+  it('cancels on a user click while waiting', () => {
     queueWorkspaceActivationTerminalFocus('wt-1', { primaryTabId: 'tab-1' })
     flushFrame()
+    document.dispatchEvent(new Event('pointerdown'))
+    mocks.focus.mockClear()
+    notifyMount()
+    flushFrame()
+    expect(mocks.focus).not.toHaveBeenCalled()
+  })
 
-    expect(focusRuntimeTerminalSurfaceMock).toHaveBeenCalledWith('tab-1', null, 'wt-1')
-    expect(focusTerminalTabSurfaceMock).not.toHaveBeenCalled()
+  it('does not steal focus from an input claimed during restoration', () => {
+    queueWorkspaceActivationTerminalFocus('wt-1', { primaryTabId: 'tab-1' })
+    const input = document.createElement('input')
+    document.body.append(input)
+    input.focus()
+    notifyMount()
+    flushFrame()
+    expect(mocks.focus).not.toHaveBeenCalled()
+    expect(document.activeElement).toBe(input)
   })
 
-  // Why: a legacy native chat is a terminal tab whose xterm stays mounted under the chat portal.
-  // Activation must leave the caret in the composer, so neither the runtime path's xterm focus
-  // nor the DOM fallback may fire. Runs the real runtime surface, not the module mock.
-  it('leaves a chat-view terminal tab unfocused on both the runtime and DOM paths', async () => {
-    const runtime = await vi.importActual<typeof SyncRuntimeGraphModule>(
-      '@/runtime/sync-runtime-graph'
-    )
-    focusRuntimeTerminalSurfaceMock.mockImplementation(runtime.focusRuntimeTerminalSurface)
-    const focus = vi.fn()
-    const pane = {
-      id: 1,
-      leafId: CHAT_VIEW_LEAF_ID,
-      container: {
-        querySelector: (selector: string) =>
-          selector === '.native-chat-pane-shell' ? ({} as Element) : null
-      },
-      terminal: { focus }
-    }
-    const manager = {
-      getPanes: () => [pane],
-      getActivePane: () => pane,
-      getLeafId: () => CHAT_VIEW_LEAF_ID,
-      getNumericIdForLeaf: () => pane.id,
-      setActivePane: vi.fn()
-    }
-    const unregister = runtime.registerRuntimeTerminalTab({
-      tabId: 'tab-1',
-      worktreeId: 'wt-1',
-      getManager: () => manager as never,
-      getContainer: () => null,
-      getPtyIdForPane: () => null,
-      getTabWideAgentHintLeafId: () => null
-    })
+  it('retains focus through composer dialog close with a previously focused editable input', async () => {
+    const previousInput = document.createElement('input')
+    const container = document.createElement('div')
+    document.body.append(previousInput, container)
+    previousInput.focus()
+    const root = createRoot(container)
     try {
-      setFocusState({
-        activeWorktreeId: 'wt-1',
-        activeView: 'terminal',
-        activeTabType: 'terminal',
-        activeTabId: 'tab-1'
+      // The composer uses a controlled modal without a DialogTrigger or close autofocus handler.
+      await act(async () => {
+        root.render(
+          createElement(
+            Dialog,
+            { open: true },
+            createElement(
+              DialogContent,
+              { 'aria-describedby': undefined },
+              createElement(DialogTitle, null, 'New workspace'),
+              createElement('input', { 'aria-label': 'Workspace name' })
+            )
+          )
+        )
       })
-
+      expect(document.activeElement?.getAttribute('aria-label')).toBe('Workspace name')
       queueWorkspaceActivationTerminalFocus('wt-1', { primaryTabId: 'tab-1' })
+      await act(async () => root.render(null))
+      await act(async () => vi.advanceTimersByTime(0))
+      expect(previousInput.isConnected).toBe(true)
+      expect(document.activeElement).not.toBe(previousInput)
+      mocks.focus.mockReturnValue(true)
       flushFrame()
-
-      expect(focus).not.toHaveBeenCalled()
-      expect(focusTerminalTabSurfaceMock).not.toHaveBeenCalled()
+      expect(mocks.focus).toHaveBeenCalledWith('tab-1', null, 'wt-1')
     } finally {
-      unregister()
+      await act(async () => root.unmount())
     }
   })
 
-  // Why: #9939 — the return value is what stops the palette from running its whole-document
-  // fallback, which would grab the worktree the user just left, now mounted but hidden.
-  it('reports that it claimed focus for a terminal destination', () => {
-    setFocusState({
-      activeWorktreeId: 'wt-1',
-      activeView: 'terminal',
-      activeTabType: 'terminal',
-      activeTabId: 'tab-adopted'
-    })
-
-    expect(queueWorkspaceActivationTerminalFocus('wt-1', { primaryTabId: null })).toBe(true)
-  })
-
-  it('declines a destination whose restored surface is not a terminal', () => {
-    setFocusState({
-      activeWorktreeId: 'wt-1',
-      activeView: 'terminal',
-      activeTabType: 'browser',
-      activeTabId: 'tab-adopted'
-    })
-
-    expect(queueWorkspaceActivationTerminalFocus('wt-1', { primaryTabId: null })).toBe(false)
+  it('keeps the post-palette request when terminal mounting briefly takes focus', () => {
+    queueWorkspaceActivationTerminalFocus('wt-1', { primaryTabId: 'tab-1' })
+    const textarea = document.createElement('textarea')
+    textarea.className = 'xterm-helper-textarea'
+    document.body.append(textarea)
+    textarea.focus()
+    textarea.blur()
+    mocks.focus.mockReturnValue(true)
     flushFrame()
-    expect(focusRuntimeTerminalSurfaceMock).not.toHaveBeenCalled()
-    expect(focusTerminalTabSurfaceMock).not.toHaveBeenCalled()
+    expect(mocks.focus).toHaveBeenCalledWith('tab-1', null, 'wt-1')
   })
 
-  it('declines a destination that has no terminal tab yet', () => {
-    setFocusState({
-      activeWorktreeId: 'wt-1',
-      activeView: 'terminal',
-      activeTabType: 'terminal',
-      activeTabId: null
-    })
-
-    expect(queueWorkspaceActivationTerminalFocus('wt-1', { primaryTabId: null })).toBe(false)
+  it('expires a request if restoration fails', () => {
+    queueWorkspaceActivationTerminalFocus('wt-1', { primaryTabId: 'tab-1' })
+    vi.advanceTimersByTime(30_000)
+    notifyMount()
+    flushFrame()
+    expect(mocks.focus).not.toHaveBeenCalled()
+    expect(unsubscribe).toHaveBeenCalledOnce()
   })
 
-  it('does not steal focus if the user leaves the created workspace first', () => {
-    const state: FocusState = {
-      activeWorktreeId: 'wt-1',
-      activeView: 'terminal',
-      activeTabType: 'terminal',
-      activeTabId: 'tab-1'
-    }
-    setFocusState(state)
-
+  it('cancels the previous request when a new activation is declined', () => {
     queueWorkspaceActivationTerminalFocus('wt-1', { primaryTabId: 'tab-1' })
-    state.activeWorktreeId = 'wt-2'
+    state.activeTabType = 'browser'
+    expect(queueWorkspaceActivationTerminalFocus('wt-1', { primaryTabId: null })).toBe(false)
+    notifyMount()
     flushFrame()
+    expect(mocks.focus).not.toHaveBeenCalled()
+  })
 
-    expect(focusRuntimeTerminalSurfaceMock).not.toHaveBeenCalled()
-    expect(focusTerminalTabSurfaceMock).not.toHaveBeenCalled()
+  it('declines a failed activation', () => {
+    expect(queueWorkspaceActivationTerminalFocus('wt-1', false)).toBe(false)
+    expect(mocks.subscribe).not.toHaveBeenCalled()
   })
 })
diff --git a/src/renderer/src/lib/workspace-activation-terminal-focus.ts b/src/renderer/src/lib/workspace-activation-terminal-focus.ts
index 8e7bcf03a33e..7b36867461bf 100644
--- a/src/renderer/src/lib/workspace-activation-terminal-focus.ts
+++ b/src/renderer/src/lib/workspace-activation-terminal-focus.ts
@@ -1,54 +1,94 @@
+import { shouldPreserveEditableFocus } from '@/components/terminal-pane/pane-helpers'
 import { useAppStore } from '@/store'
-import { focusTerminalTabSurface } from '@/lib/focus-terminal-tab-surface'
 import { focusRuntimeTerminalSurface } from '@/runtime/sync-runtime-graph'
 import type { ActivateAndRevealResult } from '@/lib/worktree-activation'
 
-function resolveActivatedWorkspaceTerminalTabId(
-  worktreeId: string,
-  activation: ActivateAndRevealResult | false
-): string | null {
-  const state = useAppStore.getState()
-  if (activation && activation.primaryTabId) {
-    return activation.primaryTabId
-  }
-  if (
-    state.activeWorktreeId !== worktreeId ||
-    state.activeView !== 'terminal' ||
-    state.activeTabType !== 'terminal'
-  ) {
-    return null
-  }
-  return state.activeTabId
-}
+let cancelPendingFocus: (() => void) | null = null
 
-// Why: returns false when the destination's restored surface is not a terminal, so callers can
-// fall back instead of focusing an unrelated worktree's mounted-but-hidden terminal (#9939).
+// A sleeping workspace can publish its tab and mount its terminal after the palette closes.
 export function queueWorkspaceActivationTerminalFocus(
   worktreeId: string,
   activation: ActivateAndRevealResult | false
 ): boolean {
-  const tabId = resolveActivatedWorkspaceTerminalTabId(worktreeId, activation)
-  if (!tabId) {
+  cancelPendingFocus?.()
+  const initial = useAppStore.getState()
+  if (
+    !activation ||
+    initial.activeWorktreeId !== worktreeId ||
+    initial.activeView !== 'terminal' ||
+    initial.activeTabType !== 'terminal'
+  ) {
     return false
   }
-
-  requestAnimationFrame(() => {
+  let tabId = activation.primaryTabId ?? initial.activeTabId
+  const executionHostId = initial.activeWorkspaceExecutionHostId
+  const initialFocus = document.activeElement
+  const closingDialog = document.querySelector('[role="dialog"]')
+  let frameId: number | null = null
+  let finished = false
+  const cancel = (): void => {
+    if (finished) {
+      return
+    }
+    finished = true
+    if (frameId !== null) {
+      cancelAnimationFrame(frameId)
+    }
+    observer.disconnect()
+    unsubscribe()
+    clearTimeout(timeout)
+    document.removeEventListener('pointerdown', cancel, true)
+    document.removeEventListener('focusin', onFocus, true)
+    if (cancelPendingFocus === cancel) {
+      cancelPendingFocus = null
+    }
+  }
+  const attempt = (): void => {
+    frameId = null
     const state = useAppStore.getState()
     if (
       state.activeWorktreeId !== worktreeId ||
+      state.activeWorkspaceExecutionHostId !== executionHostId ||
       state.activeView !== 'terminal' ||
       state.activeTabType !== 'terminal' ||
-      state.activeTabId !== tabId
+      (tabId !== null && state.activeTabId !== tabId) ||
+      state.activeModal !== 'none'
     ) {
+      cancel()
       return
     }
-
-    // Why: creation closes a Radix dialog immediately after activation. Queue
-    // focus past that close so focus restoration cannot leave the user on the
-    // removed composer field after Cmd/Ctrl+Enter.
-    if (!focusRuntimeTerminalSurface(tabId, null, worktreeId)) {
-      focusTerminalTabSurface(tabId)
+    tabId ??= state.activeTabId
+    if (tabId && focusRuntimeTerminalSurface(tabId, null, worktreeId)) {
+      cancel()
+    }
+  }
+  const schedule = (): void => {
+    if (!finished && frameId === null) {
+      frameId = requestAnimationFrame(attempt)
     }
+  }
+  const onFocus = (): void => {
+    const active = document.activeElement
+    if (
+      active !== initialFocus &&
+      !closingDialog?.contains(active) &&
+      shouldPreserveEditableFocus(active)
+    ) {
+      cancel()
+    }
+  }
+  const observer = new MutationObserver(schedule)
+  observer.observe(document.body, {
+    childList: true,
+    subtree: true,
+    attributes: true,
+    attributeFilter: ['class', 'style', 'data-state']
   })
+  const unsubscribe = useAppStore.subscribe(schedule)
+  const timeout = setTimeout(cancel, 30_000)
+  document.addEventListener('pointerdown', cancel, true)
+  document.addEventListener('focusin', onFocus, true)
+  cancelPendingFocus = cancel
+  schedule()
   return true
 }
diff --git a/src/renderer/src/lib/workspace-browser-tab-open.test.ts b/src/renderer/src/lib/workspace-browser-tab-open.test.ts
index 5ae73fa7c128..19ae49740388 100644
--- a/src/renderer/src/lib/workspace-browser-tab-open.test.ts
+++ b/src/renderer/src/lib/workspace-browser-tab-open.test.ts
@@ -96,6 +96,7 @@ describe('openWorkspaceBrowserTab', () => {
       {
         activate: true,
         browserRuntimeEnvironmentId: null,
+        executionHostId: 'ssh:ssh-target',
         focusAddressBar: false,
         sessionProfileId: 'ssh-profile',
         targetGroupId: 'group-1',
@@ -118,6 +119,7 @@ describe('openWorkspaceBrowserTab', () => {
     await openWorkspaceBrowserTab({
       workspaceId: WORKSPACE_ID,
       url: 'https://github.com/acme/orca/pull/456',
+      afterTabId: 'source-unified-tab',
       intent: { kind: 'url' },
       focusOnCreate: false,
       selectWorktree: false
@@ -126,7 +128,7 @@ describe('openWorkspaceBrowserTab', () => {
     expect(createBrowserTab).toHaveBeenCalledWith(
       WORKSPACE_ID,
       'https://github.com/acme/orca/pull/456',
-      expect.objectContaining({ activate: false })
+      expect.objectContaining({ activate: false, afterTabId: 'source-unified-tab' })
     )
   })
 
@@ -202,6 +204,7 @@ describe('openWorkspaceBrowserTab', () => {
     await openWorkspaceBrowserTab({
       workspaceId: WORKSPACE_ID,
       url: 'https://gitlab.com/acme/orca/-/merge_requests/77',
+      afterTabId: 'source-unified-tab',
       intent: { kind: 'url' },
       focusOnCreate: false,
       selectWorktree: false
@@ -209,6 +212,7 @@ describe('openWorkspaceBrowserTab', () => {
 
     expect(mocks.createRemote).toHaveBeenCalledWith(
       expect.objectContaining({
+        clientAfterTabId: 'source-unified-tab',
         focusOnCreate: false,
         selectWorktree: false,
         url: 'https://gitlab.com/acme/orca/-/merge_requests/77'
diff --git a/src/renderer/src/lib/workspace-browser-tab-open.ts b/src/renderer/src/lib/workspace-browser-tab-open.ts
index 18149a98bbc3..5329511941e6 100644
--- a/src/renderer/src/lib/workspace-browser-tab-open.ts
+++ b/src/renderer/src/lib/workspace-browser-tab-open.ts
@@ -24,6 +24,8 @@ export type WorkspaceBrowserTabIntent = { kind: 'url' } | { kind: 'search'; engi
 export type OpenWorkspaceBrowserTabRequest = {
   workspaceId: string
   targetGroupId?: string
+  /** Client-local unified tab id of the source; a source-following open omits targetGroupId. */
+  afterTabId?: string
   url: string
   intent: WorkspaceBrowserTabIntent
   /** Keep the caller's current terminal/task surface selected while creating the tab. */
@@ -190,10 +192,12 @@ function createClientBrowserTab(
       activate: request.focusOnCreate !== false,
       browserRuntimeEnvironmentId: null,
       focusAddressBar: false,
+      executionHostId: hostId,
       sessionProfileId:
         state.defaultBrowserSessionProfileIdByHostId[hostId] ??
         state.defaultBrowserSessionProfileId,
       targetGroupId: request.targetGroupId,
+      ...(request.afterTabId ? { afterTabId: request.afterTabId } : {}),
       title: presentation.title
     })
   } catch (error) {
@@ -289,6 +293,7 @@ export async function openWorkspaceBrowserTab(
       environmentId,
       url: request.url,
       targetGroupId: request.targetGroupId,
+      ...(request.afterTabId ? { clientAfterTabId: request.afterTabId } : {}),
       // Owner-pinned links need the host tab published before client reconciliation.
       ...(expectedEnvironmentId !== null ? { waitForRegistration: true } : {}),
       ...(request.placementPreference !== undefined
diff --git a/src/renderer/src/lib/worktree-agent-activation-gate.test.ts b/src/renderer/src/lib/worktree-agent-activation-gate.test.ts
index 49d13f87f016..84b498f18f25 100644
--- a/src/renderer/src/lib/worktree-agent-activation-gate.test.ts
+++ b/src/renderer/src/lib/worktree-agent-activation-gate.test.ts
@@ -7,7 +7,10 @@ import type { TerminalLayoutSnapshot, TerminalTab } from '../../../shared/termin
 import { singlePaneLayoutSnapshot } from '@/store/slices/terminal-helpers'
 import type { TerminalSlice } from '@/store/slices/terminals'
 import { runWorktreeAgentActivationGate } from './worktree-agent-activation-gate'
-import type { LiveTerminalSurfaceOwnerIndex } from './worktree-live-terminal-surface-owners'
+import {
+  indexLiveTerminalSurfaceOwners,
+  type LiveTerminalSurfaceOwnerIndex
+} from './worktree-live-terminal-surface-owners'
 
 const WORKTREE_ID = 'repo::/worktree'
 const STALE_STRUCTURED_SESSION_ID = 'structured-session-stale'
@@ -212,7 +215,10 @@ function seedExistingSurface(
 describe('worktree agent activation gate', () => {
   it('uses immediately ready development restore inventory', async () => {
     const ptyId = `${WORKTREE_ID}@@live-pty`
-    const { deps, createTab, resume } = testDeps({ sessions: [listed(ptyId)] })
+    const { deps, createTab, resume } = testDeps({
+      sessions: [listed(ptyId)],
+      surfaceOwners: new Map([[ptyId, 'unowned']])
+    })
     const awaitReady = vi.fn(async () => true)
 
     await expect(
@@ -226,7 +232,10 @@ describe('worktree agent activation gate', () => {
 
   it('waits for packaged restore hydration before reading daemon inventory', async () => {
     const ptyId = `${WORKTREE_ID}@@live-pty`
-    const { deps, createTab, resume } = testDeps({ sessions: [listed(ptyId)] })
+    const { deps, createTab, resume } = testDeps({
+      sessions: [listed(ptyId)],
+      surfaceOwners: new Map([[ptyId, 'unowned']])
+    })
     let releaseReady!: (ready: boolean) => void
     const awaitReady = vi.fn(() => new Promise<boolean>((resolve) => (releaseReady = resolve)))
 
@@ -270,7 +279,10 @@ describe('worktree agent activation gate', () => {
 
   it('adopts a live daemon PTY before activation can resume another agent', async () => {
     const ptyId = `${WORKTREE_ID}@@live-pty`
-    const { deps, createTab, resume } = testDeps({ sessions: [listed(ptyId)] })
+    const { deps, createTab, resume } = testDeps({
+      sessions: [listed(ptyId)],
+      surfaceOwners: new Map([[ptyId, 'unowned']])
+    })
 
     await expect(runWorktreeAgentActivationGate(WORKTREE_ID, deps)).resolves.toBe('adopted')
 
@@ -285,7 +297,10 @@ describe('worktree agent activation gate', () => {
   it('adopts a daemon PTY minted for a folder workspace', async () => {
     const folderWorkspaceId = 'folder:plain-workspace'
     const ptyId = `${folderWorkspaceId}@@live-pty`
-    const { deps, createTab, resume } = testDeps({ sessions: [listed(ptyId)] })
+    const { deps, createTab, resume } = testDeps({
+      sessions: [listed(ptyId)],
+      surfaceOwners: new Map([[ptyId, 'unowned']])
+    })
 
     await expect(runWorktreeAgentActivationGate(folderWorkspaceId, deps)).resolves.toBe('adopted')
 
@@ -593,7 +608,10 @@ describe('worktree agent activation gate', () => {
     const unverifiablePtyId = `${WORKTREE_ID}@@ambiguous-agent`
     const { deps } = testDeps({
       sessions: [listed(adoptedPtyId), listed(unverifiablePtyId)],
-      surfaceOwners: new Map([[unverifiablePtyId, null]]),
+      surfaceOwners: new Map([
+        [adoptedPtyId, 'unowned'],
+        [unverifiablePtyId, null]
+      ]),
       resumeCount: 0
     })
 
@@ -653,14 +671,14 @@ describe('worktree agent activation gate', () => {
     const livePtyId = `${WORKTREE_ID}@@live-agent`
     const { deps, createTab } = testDeps({
       sessions: [listed(livePtyId)],
-      surfaceOwners: new Map()
+      surfaceOwners: new Map([[livePtyId, 'unowned']])
     })
     const store = deps.getState()
     seedExistingSurface(store, { tabId: 'tab-live', leafId: LIVE_LEAF_ID })
     // The pane mounts while the census is in flight, binding the PTY behind the sweep.
     deps.listSurfaceOwners.mockImplementation(async () => {
       store.ptyIdsByTabId['tab-live'] = [livePtyId]
-      return new Map()
+      return new Map([[livePtyId, 'unowned']])
     })
 
     await expect(runWorktreeAgentActivationGate(WORKTREE_ID, deps)).resolves.toBe('adopted')
@@ -668,6 +686,38 @@ describe('worktree agent activation gate', () => {
     expect(createTab).not.toHaveBeenCalled()
   })
 
+  it('does not adopt a predecessor after the relay restarts between activation inventories', async () => {
+    const predecessor = 'ssh:target@@pty2:old-relay:1'
+    const replacement = 'ssh:target@@pty2:new-relay:1'
+    const { deps, createTab } = testDeps({ resumeCount: 0 })
+    const store = deps.getState()
+    seedExistingSurface(store, {
+      tabId: 'tab-live',
+      leafId: LIVE_LEAF_ID,
+      boundPtyId: predecessor
+    })
+    let replyWithOldInventory!: (sessions: PtyListedSession[]) => void
+    deps.listSessions.mockImplementationOnce(
+      () =>
+        new Promise((resolve) => {
+          replyWithOldInventory = resolve
+        })
+    )
+    const activation = runWorktreeAgentActivationGate(WORKTREE_ID, deps)
+    await vi.waitFor(() => expect(deps.listSessions).toHaveBeenCalledOnce())
+
+    // Recovery rebinds the same pane before the old relay's inventory response arrives.
+    store.terminalLayoutsByTabId['tab-live']!.ptyIdsByLeafId[LIVE_LEAF_ID] = replacement
+    store.ptyIdsByTabId['tab-live'] = [replacement]
+    deps.listSurfaceOwners.mockResolvedValueOnce(indexLiveTerminalSurfaceOwners([], WORKTREE_ID))
+    replyWithOldInventory([{ ...listed(predecessor), worktreeId: WORKTREE_ID }])
+    await activation
+
+    expect(createTab).not.toHaveBeenCalled()
+    expect(store.tabsByWorktree[WORKTREE_ID]?.map((tab) => tab.id)).toEqual(['tab-live'])
+    expect(store.terminalLayoutsByTabId['tab-live']?.ptyIdsByLeafId[LIVE_LEAF_ID]).toBe(replacement)
+  })
+
   it('gives every host pane of an unmounted tab its own leaf', async () => {
     const firstPtyId = `${WORKTREE_ID}@@live-agent`
     const secondPtyId = `${WORKTREE_ID}@@live-sibling`
@@ -706,7 +756,7 @@ describe('worktree agent activation gate', () => {
     const livePtyId = `${WORKTREE_ID}@@orphan-agent`
     const { deps, createTab } = testDeps({
       sessions: [listed(livePtyId)],
-      surfaceOwners: new Map()
+      surfaceOwners: new Map([[livePtyId, 'unowned']])
     })
 
     await expect(runWorktreeAgentActivationGate(WORKTREE_ID, deps)).resolves.toBe('adopted')
diff --git a/src/renderer/src/lib/worktree-agent-live-surface-adoption.ts b/src/renderer/src/lib/worktree-agent-live-surface-adoption.ts
index 3675b7575dac..81ac509ffb7e 100644
--- a/src/renderer/src/lib/worktree-agent-live-surface-adoption.ts
+++ b/src/renderer/src/lib/worktree-agent-live-surface-adoption.ts
@@ -155,7 +155,7 @@ export async function adoptLiveWorkspacePtySurfaces(
       continue
     }
     const owner = surfaceOwners?.get(ptyId)
-    if (owner) {
+    if (owner && owner !== 'unowned') {
       if (adoptHostOwnedSurface(getState, worktreeId, owner, materializedTabIds)) {
         surfaced = true
       } else {
@@ -165,7 +165,7 @@ export async function adoptLiveWorkspacePtySurfaces(
     }
     // Why: only the execution host can prove a live PTY is unowned, and minting
     // on anything weaker forks a running agent onto a second empty surface.
-    if (!surfaceOwners || surfaceOwners.has(ptyId)) {
+    if (owner !== 'unowned') {
       declinedPtyIds.push(ptyId)
       continue
     }
diff --git a/src/renderer/src/lib/worktree-host-connection-phase.test.ts b/src/renderer/src/lib/worktree-host-connection-phase.test.ts
new file mode 100644
index 000000000000..ab7b3cdeeb7d
--- /dev/null
+++ b/src/renderer/src/lib/worktree-host-connection-phase.test.ts
@@ -0,0 +1,227 @@
+import { describe, expect, it } from 'vitest'
+import type { AppState } from '@/store/types'
+import type { SshConnectionStatus } from '../../../shared/ssh-types'
+import { selectWorktreeHostConnectionPhase } from './worktree-host-connection-phase'
+
+function makeState(overrides: Record<string, unknown>): AppState {
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the phase selector reads only the repo, worktree, runtime, and SSH fields set here.
+  return {
+    activeWorktreeId: null,
+    detectedWorktreesByRepo: {},
+    folderWorkspaces: [],
+    projectGroups: [],
+    removedSshTargetLabels: new Map(),
+    repos: [],
+    runtimeStatusByEnvironmentId: new Map(),
+    sshConnectionStates: new Map(),
+    sshStateByEnvironment: new Map(),
+    sshTargetLabels: new Map(),
+    sshTargetsHydrated: true,
+    terminalStartupRestorationReady: true,
+    worktreesByRepo: {},
+    ...overrides
+  } as unknown as AppState
+}
+
+function makeSshState(
+  status: SshConnectionStatus | null,
+  overrides: Record<string, unknown> = {}
+): AppState {
+  return makeState({
+    repos: [{ id: 'repo-ssh', connectionId: 'ssh-a' }],
+    sshConnectionStates: new Map(
+      status
+        ? [
+            [
+              'ssh-a',
+              {
+                targetId: 'ssh-a',
+                status,
+                error: null,
+                reconnectAttempt: 0,
+                connectionGeneration: 7
+              }
+            ]
+          ]
+        : []
+    ),
+    worktreesByRepo: { 'repo-ssh': [{ id: 'wt-ssh', repoId: 'repo-ssh' }] },
+    ...overrides
+  })
+}
+
+describe('selectWorktreeHostConnectionPhase', () => {
+  it('reports a local workspace, and no worktree, as local', () => {
+    const state = makeState({
+      repos: [{ id: 'repo-local' }],
+      worktreesByRepo: { 'repo-local': [{ id: 'wt-local', repoId: 'repo-local' }] }
+    })
+
+    const local = {
+      phase: 'local',
+      targetId: null,
+      environmentId: null,
+      publishedStatus: null,
+      connectedEpoch: null
+    }
+    expect(selectWorktreeHostConnectionPhase(state, 'wt-local')).toEqual(local)
+    expect(selectWorktreeHostConnectionPhase(state, null)).toEqual(local)
+  })
+
+  it('reports a runtime-owned target as local: this client never dials it', () => {
+    const state = makeState({
+      repos: [{ id: 'repo-ephemeral', connectionId: 'runtime-ssh-vm-a' }],
+      worktreesByRepo: { 'repo-ephemeral': [{ id: 'wt-ephemeral', repoId: 'repo-ephemeral' }] }
+    })
+
+    expect(selectWorktreeHostConnectionPhase(state, 'wt-ephemeral').phase).toBe('local')
+  })
+
+  it('reads an unpublished target as connecting only until startup restoration finishes', () => {
+    expect(
+      selectWorktreeHostConnectionPhase(
+        makeSshState(null, { terminalStartupRestorationReady: false }),
+        'wt-ssh'
+      )
+    ).toMatchObject({ phase: 'connecting', targetId: 'ssh-a', publishedStatus: 'disconnected' })
+    expect(selectWorktreeHostConnectionPhase(makeSshState(null), 'wt-ssh')).toMatchObject({
+      phase: 'unavailable',
+      targetId: 'ssh-a',
+      publishedStatus: 'disconnected'
+    })
+  })
+
+  it('maps published statuses; only a connected host names its connection', () => {
+    expect(selectWorktreeHostConnectionPhase(makeSshState('connecting'), 'wt-ssh')).toEqual({
+      phase: 'connecting',
+      targetId: 'ssh-a',
+      environmentId: null,
+      publishedStatus: 'connecting',
+      connectedEpoch: null
+    })
+    expect(selectWorktreeHostConnectionPhase(makeSshState('reconnecting'), 'wt-ssh').phase).toBe(
+      'connecting'
+    )
+    expect(selectWorktreeHostConnectionPhase(makeSshState('deploying-relay'), 'wt-ssh').phase).toBe(
+      'connecting'
+    )
+    expect(selectWorktreeHostConnectionPhase(makeSshState('connected'), 'wt-ssh')).toEqual({
+      phase: 'connected',
+      targetId: 'ssh-a',
+      environmentId: null,
+      publishedStatus: 'connected',
+      connectedEpoch: 'ssh-a:7'
+    })
+  })
+
+  it('reports failed and disconnected targets as unavailable once restoration is done', () => {
+    for (const status of ['reconnection-failed', 'disconnected', 'auth-failed', 'error'] as const) {
+      expect(selectWorktreeHostConnectionPhase(makeSshState(status), 'wt-ssh').phase).toBe(
+        'unavailable'
+      )
+    }
+  })
+
+  it('keeps a published failure unavailable even before restoration finishes', () => {
+    expect(
+      selectWorktreeHostConnectionPhase(
+        makeSshState('auth-failed', { terminalStartupRestorationReady: false }),
+        'wt-ssh'
+      ).phase
+    ).toBe('unavailable')
+  })
+
+  it("reads a runtime environment's nested target from that environment's SSH state", () => {
+    const state = makeState({
+      repos: [{ id: 'repo-runtime', connectionId: 'ssh-nested', executionHostId: 'runtime:env-a' }],
+      runtimeStatusByEnvironmentId: new Map([
+        ['env-a', { status: { runtimeId: 'runtime-a' }, checkedAt: 1 }]
+      ]),
+      sshStateByEnvironment: new Map([
+        [
+          'env-a',
+          {
+            connectionStates: new Map([
+              [
+                'ssh-nested',
+                {
+                  targetId: 'ssh-nested',
+                  status: 'connected',
+                  error: null,
+                  reconnectAttempt: 0,
+                  connectionGeneration: 3
+                }
+              ]
+            ]),
+            targetLabels: new Map([['ssh-nested', 'build box']]),
+            removedTargetLabels: new Map(),
+            targetsHydrated: true
+          }
+        ]
+      ]),
+      terminalStartupRestorationReady: false,
+      worktreesByRepo: {
+        'repo-runtime': [
+          {
+            id: 'wt-runtime',
+            repoId: 'repo-runtime',
+            hostId: 'runtime:env-a',
+            runtimeOwnerEnvironmentId: 'env-a'
+          }
+        ]
+      }
+    })
+
+    expect(selectWorktreeHostConnectionPhase(state, 'wt-runtime')).toEqual({
+      phase: 'connected',
+      targetId: 'ssh-nested',
+      environmentId: 'env-a',
+      publishedStatus: 'connected',
+      connectedEpoch: 'ssh-nested:3'
+    })
+  })
+
+  it('names a new connection on every reconnect', () => {
+    const connected = makeSshState('connected')
+    const reconnected = makeSshState('connected', {
+      sshConnectionStates: new Map([
+        [
+          'ssh-a',
+          {
+            targetId: 'ssh-a',
+            status: 'connected',
+            error: null,
+            reconnectAttempt: 0,
+            connectionGeneration: 8
+          }
+        ]
+      ])
+    })
+
+    expect(selectWorktreeHostConnectionPhase(reconnected, 'wt-ssh').connectedEpoch).not.toBe(
+      selectWorktreeHostConnectionPhase(connected, 'wt-ssh').connectedEpoch
+    )
+  })
+
+  it('reports a nested target whose runtime is unreachable as unverifiable, not down', () => {
+    const state = makeState({
+      repos: [{ id: 'repo-runtime', connectionId: 'ssh-nested', executionHostId: 'runtime:env-a' }],
+      worktreesByRepo: {
+        'repo-runtime': [
+          {
+            id: 'wt-runtime',
+            repoId: 'repo-runtime',
+            hostId: 'runtime:env-a',
+            runtimeOwnerEnvironmentId: 'env-a'
+          }
+        ]
+      }
+    })
+
+    expect(selectWorktreeHostConnectionPhase(state, 'wt-runtime')).toMatchObject({
+      phase: 'unverifiable',
+      targetId: 'ssh-nested',
+      publishedStatus: null
+    })
+  })
+})
diff --git a/src/renderer/src/lib/worktree-host-connection-phase.ts b/src/renderer/src/lib/worktree-host-connection-phase.ts
new file mode 100644
index 000000000000..8a0d39d4b1cf
--- /dev/null
+++ b/src/renderer/src/lib/worktree-host-connection-phase.ts
@@ -0,0 +1,119 @@
+import { useShallow } from 'zustand/react/shallow'
+import { useAppStore } from '@/store'
+import type { AppState } from '@/store/types'
+import { getConnectionIdFromState } from '@/lib/connection-context'
+import { getExplicitRuntimeEnvironmentIdForWorktree } from '@/lib/worktree-runtime-owner'
+import {
+  selectRuntimeAwareSshConnectionGeneration,
+  selectRuntimeAwareSshStatus
+} from '@/store/slices/runtime-environment-ssh'
+import { isConnectingSshStatus } from '@/ssh/ssh-connection-recoverability'
+import type { SshConnectionStatus } from '../../../shared/ssh-types'
+import { isRuntimeOwnedSshTargetId } from '../../../shared/execution-host'
+
+/**
+ * `local`: no SSH target this client dials for the worktree — a local workspace, a
+ * runtime-owned target, or an owner that has not resolved yet.
+ * `unverifiable`: the owning remote runtime is unreachable or has not published its SSH
+ * state, so this client cannot see the target — not evidence that it is down.
+ */
+export type WorktreeHostConnectionPhase =
+  | 'local'
+  | 'connecting'
+  | 'connected'
+  | 'unavailable'
+  | 'unverifiable'
+
+export type WorktreeHostConnection = {
+  phase: WorktreeHostConnectionPhase
+  targetId: string | null
+  /** The remote runtime whose mirrored SSH state owns the target; null for this client's own. */
+  environmentId: string | null
+  /**
+   * The status as published, before `phase` reads an undialed startup target as connecting.
+   * Surfaces that name the status itself (the terminal's reconnect overlay) read this; null
+   * when local or unverifiable.
+   */
+  publishedStatus: SshConnectionStatus | null
+  /** Names the live connection: null unless connected, and new on every reconnect. */
+  connectedEpoch: string | null
+}
+
+const LOCAL_HOST_CONNECTION: WorktreeHostConnection = {
+  phase: 'local',
+  targetId: null,
+  environmentId: null,
+  publishedStatus: null,
+  connectedEpoch: null
+}
+
+function derivePhase(
+  state: AppState,
+  targetId: string,
+  environmentId: string | null,
+  publishedStatus: SshConnectionStatus | null
+): WorktreeHostConnectionPhase {
+  if (publishedStatus === null) {
+    return 'unverifiable'
+  }
+  if (publishedStatus === 'connected') {
+    return 'connected'
+  }
+  if (isConnectingSshStatus(publishedStatus)) {
+    return 'connecting'
+  }
+  // Why: startup restoration dials the targets that were live at shutdown; until it publishes,
+  // a missing entry means "not dialed yet", not "disconnected". Restoration finishing (or
+  // degrading) ends this on its own.
+  if (
+    environmentId === null &&
+    !state.terminalStartupRestorationReady &&
+    !state.sshConnectionStates.has(targetId)
+  ) {
+    return 'connecting'
+  }
+  return 'unavailable'
+}
+
+/** The shared signal for a caller that already resolved the worktree's connection id. */
+export function resolveWorktreeHostConnection(
+  state: AppState,
+  worktreeId: string,
+  targetId: string | null | undefined
+): WorktreeHostConnection {
+  if (!targetId || isRuntimeOwnedSshTargetId(targetId)) {
+    return LOCAL_HOST_CONNECTION
+  }
+  const environmentId = getExplicitRuntimeEnvironmentIdForWorktree(state, worktreeId)
+  const publishedStatus = selectRuntimeAwareSshStatus(state, environmentId, targetId)
+  const generation = selectRuntimeAwareSshConnectionGeneration(state, environmentId, targetId)
+  return {
+    phase: derivePhase(state, targetId, environmentId, publishedStatus),
+    targetId,
+    environmentId,
+    publishedStatus,
+    connectedEpoch: publishedStatus === 'connected' ? `${targetId}:${generation ?? ''}` : null
+  }
+}
+
+/**
+ * The one reading of a worktree's SSH host that every pane shares, derived from the
+ * published SSH state. Panes must not re-derive status or reconnect identity themselves.
+ */
+export function selectWorktreeHostConnectionPhase(
+  state: AppState,
+  worktreeId: string | null
+): WorktreeHostConnection {
+  if (!worktreeId) {
+    return LOCAL_HOST_CONNECTION
+  }
+  return resolveWorktreeHostConnection(
+    state,
+    worktreeId,
+    getConnectionIdFromState(state, worktreeId)
+  )
+}
+
+export function useWorktreeHostConnection(worktreeId: string | null): WorktreeHostConnection {
+  return useAppStore(useShallow((state) => selectWorktreeHostConnectionPhase(state, worktreeId)))
+}
diff --git a/src/renderer/src/lib/worktree-live-terminal-surface-owners.test.ts b/src/renderer/src/lib/worktree-live-terminal-surface-owners.test.ts
index 033ff1da0345..66db1463496b 100644
--- a/src/renderer/src/lib/worktree-live-terminal-surface-owners.test.ts
+++ b/src/renderer/src/lib/worktree-live-terminal-surface-owners.test.ts
@@ -27,10 +27,12 @@ function summary(overrides: Partial<RuntimeTerminalSummary>): RuntimeTerminalSum
   }
 }
 
-function stubTerminalList(result: unknown): void {
+function stubTerminalList(result: unknown) {
+  const call = vi.fn(async () => ({ ok: true, result }))
   vi.stubGlobal('window', {
-    api: { runtime: { call: vi.fn(async () => ({ ok: true, result })) } }
+    api: { runtime: { call } }
   })
+  return call
 }
 
 afterEach(() => {
@@ -48,7 +50,7 @@ describe('live terminal surface owners', () => {
     })
   })
 
-  it('leaves an orphaned PTY absent so it stays eligible for a recovery tab', () => {
+  it('records explicit live orphan evidence for a recovery tab', () => {
     const ptyId = `${WORKTREE_ID}@@orphan`
     const owners = indexLiveTerminalSurfaceOwners(
       [
@@ -62,9 +64,43 @@ describe('live terminal surface owners', () => {
       WORKTREE_ID
     )
 
-    expect(owners.has(ptyId)).toBe(false)
+    expect(owners.get(ptyId)).toBe('unowned')
   })
 
+  it('does not authorize adoption of a disconnected orphan', () => {
+    const ptyId = `${WORKTREE_ID}@@orphan`
+    const owners = indexLiveTerminalSurfaceOwners(
+      [summary({ ptyId, orphaned: true, connected: false })],
+      WORKTREE_ID
+    )
+
+    expect(owners.get(ptyId)).toBeNull()
+  })
+
+  it('does not infer orphan ownership from a legacy synthetic surface', () => {
+    const ptyId = `${WORKTREE_ID}@@orphan`
+    const owners = indexLiveTerminalSurfaceOwners(
+      [summary({ ptyId, tabId: `pty:${ptyId}`, leafId: `pty:${ptyId}` })],
+      WORKTREE_ID
+    )
+
+    expect(owners.get(ptyId)).toBeNull()
+  })
+
+  it.each([false, true])(
+    'rejects conflicting owned and orphan rows (orphan first: %s)',
+    (orphanFirst) => {
+      const orphan = summary({ orphaned: true })
+      const owned = summary({})
+      const owners = indexLiveTerminalSurfaceOwners(
+        orphanFirst ? [orphan, owned, orphan] : [owned, orphan, owned],
+        WORKTREE_ID
+      )
+
+      expect(owners.get(owned.ptyId!)).toBeNull()
+    }
+  )
+
   it('ignores rows belonging to another workspace', () => {
     const owners = indexLiveTerminalSurfaceOwners(
       [summary({ worktreeId: 'repo::/other' })],
@@ -74,14 +110,13 @@ describe('live terminal surface owners', () => {
     expect(owners.size).toBe(0)
   })
 
-  // Dropping the host's row over path spelling would read as `unowned` and mint a duplicate.
   it('indexes a row the host spelled with an equivalent workspace path', () => {
     const owners = indexLiveTerminalSurfaceOwners(
       [summary({ worktreeId: `${WORKTREE_ID}/` })],
       WORKTREE_ID
     )
 
-    expect(owners.get(`${WORKTREE_ID}@@live-agent`)?.tabId).toBe('tab-live')
+    expect(owners.get(`${WORKTREE_ID}@@live-agent`)).toMatchObject({ tabId: 'tab-live' })
   })
 
   it('reports a PTY claimed by two panes as unverifiable rather than unowned', () => {
@@ -122,7 +157,7 @@ describe('live terminal surface owners', () => {
 
     const owners = await readWorktreeLiveTerminalSurfaceOwners(WORKTREE_ID)
 
-    expect(owners?.get(`${WORKTREE_ID}@@live-agent`)?.tabId).toBe('tab-live')
+    expect(owners?.get(`${WORKTREE_ID}@@live-agent`)).toMatchObject({ tabId: 'tab-live' })
   })
 
   it('refuses a census from a host that cannot name the scope it answered for', async () => {
@@ -142,7 +177,7 @@ describe('live terminal surface owners', () => {
   })
 
   it('indexes a complete census', async () => {
-    stubTerminalList({
+    const call = stubTerminalList({
       terminals: [summary({})],
       truncated: false,
       hostScope: { hostIds: ['local'], omittedHostIds: [] }
@@ -150,7 +185,16 @@ describe('live terminal surface owners', () => {
 
     const owners = await readWorktreeLiveTerminalSurfaceOwners(WORKTREE_ID)
 
-    expect(owners?.get(`${WORKTREE_ID}@@live-agent`)?.tabId).toBe('tab-live')
+    expect(owners?.get(`${WORKTREE_ID}@@live-agent`)).toMatchObject({ tabId: 'tab-live' })
+    expect(call).toHaveBeenCalledWith({
+      method: 'terminal.list',
+      params: {
+        worktree: `id:${WORKTREE_ID}`,
+        limit: 200,
+        requireFreshPtyLiveness: true,
+        includeVisualLayouts: false
+      }
+    })
   })
 
   it('refuses a census the host could not answer', async () => {
diff --git a/src/renderer/src/lib/worktree-live-terminal-surface-owners.ts b/src/renderer/src/lib/worktree-live-terminal-surface-owners.ts
index d42c8e5ad4fe..34aa91438f8a 100644
--- a/src/renderer/src/lib/worktree-live-terminal-surface-owners.ts
+++ b/src/renderer/src/lib/worktree-live-terminal-surface-owners.ts
@@ -20,12 +20,11 @@ export type LiveTerminalSurfaceOwner = {
  * client-created tab can leave empty, so they cannot answer "is this PTY
  * unowned?" — only the host can.
  *
- * Three verdicts, never two: an entry is the owner, a `null` entry is
- * `unverifiable` (the host named a surface this renderer cannot address, or
- * named two), and a whole-index `null` is `unverifiable` for every PTY. Absence
- * from a readable index is the only proof of `unowned`.
+ * Only `unowned` proves the host observed a live PTY with no surface. Null and
+ * missing entries are unverifiable; an earlier inventory may name a retired PTY.
  */
-export type LiveTerminalSurfaceOwnerIndex = ReadonlyMap<string, LiveTerminalSurfaceOwner | null>
+type LiveTerminalSurfaceOwnership = LiveTerminalSurfaceOwner | 'unowned' | null
+export type LiveTerminalSurfaceOwnerIndex = ReadonlyMap<string, LiveTerminalSurfaceOwnership>
 
 const OWNER_LISTING_LIMIT = 200
 
@@ -65,25 +64,25 @@ function toSurfaceOwner(terminal: RuntimeTerminalSummary): LiveTerminalSurfaceOw
 export function indexLiveTerminalSurfaceOwners(
   terminals: readonly RuntimeTerminalSummary[],
   worktreeId: string
-): Map<string, LiveTerminalSurfaceOwner | null> {
-  const owners = new Map<string, LiveTerminalSurfaceOwner | null>()
+): Map<string, LiveTerminalSurfaceOwnership> {
+  const owners = new Map<string, LiveTerminalSurfaceOwnership>()
   for (const terminal of terminals) {
-    // `orphaned` is the host's own word for "live PTY, no surface owns it".
-    // Path spelling can differ between the host's row and the renderer's id; dropping a row
-    // over that would read as `unowned` and mint the duplicate this index exists to prevent.
-    if (
-      !worktreeIdsEqual(terminal.worktreeId, worktreeId) ||
-      !terminal.ptyId ||
-      terminal.orphaned === true
-    ) {
+    if (!worktreeIdsEqual(terminal.worktreeId, worktreeId) || !terminal.ptyId) {
       continue
     }
-    const owner = toSurfaceOwner(terminal)
+    const owner =
+      terminal.orphaned === true
+        ? terminal.connected === true
+          ? 'unowned'
+          : null
+        : toSurfaceOwner(terminal)
     const recorded = owners.get(terminal.ptyId)
-    // Two surfaces claiming one PTY is the duplicate this index must not endorse.
+    const recordedPane = recorded && recorded !== 'unowned' ? recorded.paneKey : recorded
+    const ownerPane = owner && owner !== 'unowned' ? owner.paneKey : owner
+    // Conflicting ownership claims cannot authorize adoption.
     owners.set(
       terminal.ptyId,
-      owners.has(terminal.ptyId) && recorded?.paneKey !== owner?.paneKey ? null : owner
+      owners.has(terminal.ptyId) && recordedPane !== ownerPane ? null : owner
     )
   }
   return owners
@@ -104,6 +103,7 @@ export async function readWorktreeLiveTerminalSurfaceOwners(
     params: {
       worktree: toRuntimeWorktreeSelector(worktreeId),
       limit: OWNER_LISTING_LIMIT,
+      requireFreshPtyLiveness: true,
       includeVisualLayouts: false
     }
   })
diff --git a/src/renderer/src/lib/worktree-status.interrupted.test.ts b/src/renderer/src/lib/worktree-status.interrupted.test.ts
index 76536ff8c7a0..d44530c91e27 100644
--- a/src/renderer/src/lib/worktree-status.interrupted.test.ts
+++ b/src/renderer/src/lib/worktree-status.interrupted.test.ts
@@ -44,6 +44,38 @@ describe('resolveWorktreeStatus — interrupted (STA-5357)', () => {
     )
   })
 
+  it('reports a failure above live work and every outcome, below only a pending question', () => {
+    expect(resolveWorktreeStatus({ ...base, hasFailed: true })).toBe('failed')
+    expect(resolveWorktreeStatus({ ...base, hasFailed: true, hasInterrupted: true })).toBe('failed')
+    expect(resolveWorktreeStatus({ ...base, hasFailed: true, hasLiveDone: true })).toBe('failed')
+    expect(resolveWorktreeStatus({ ...base, hasFailed: true, hasLiveWorking: true })).toBe('failed')
+    expect(resolveWorktreeStatus({ ...base, hasFailed: true, hasLiveMonitoring: true })).toBe(
+      'failed'
+    )
+    expect(resolveWorktreeStatus({ ...base, hasFailed: true, hasPermission: true })).toBe(
+      'permission'
+    )
+  })
+
+  it('reports a departed agent failure below live work and above every outcome', () => {
+    expect(resolveWorktreeStatus({ ...base, hasRetainedFailed: true })).toBe('failed')
+    expect(resolveWorktreeStatus({ ...base, hasRetainedFailed: true, hasInterrupted: true })).toBe(
+      'failed'
+    )
+    expect(resolveWorktreeStatus({ ...base, hasRetainedFailed: true, hasRetainedDone: true })).toBe(
+      'failed'
+    )
+    expect(resolveWorktreeStatus({ ...base, hasRetainedFailed: true, hasLiveWorking: true })).toBe(
+      'working'
+    )
+    expect(
+      resolveWorktreeStatus({ ...base, hasRetainedFailed: true, hasLiveMonitoring: true })
+    ).toBe('monitoring')
+    expect(resolveWorktreeStatus({ ...base, hasRetainedFailed: true, hasPermission: true })).toBe(
+      'permission'
+    )
+  })
+
   it('leaves every other combination alone', () => {
     expect(resolveWorktreeStatus({ ...base, hasLiveDone: true })).toBe('done')
     expect(resolveWorktreeStatus({ ...base, hasLiveWorking: true })).toBe('working')
diff --git a/src/renderer/src/lib/worktree-status.ts b/src/renderer/src/lib/worktree-status.ts
index cbd6c3c82f31..eecff15da077 100644
--- a/src/renderer/src/lib/worktree-status.ts
+++ b/src/renderer/src/lib/worktree-status.ts
@@ -17,6 +17,7 @@ export type WorktreeStatus =
   | 'working'
   | 'monitoring'
   | 'permission'
+  | 'failed'
   | 'interrupted'
   | 'done'
   | 'inactive'
@@ -35,6 +36,7 @@ const STATUS_LABELS: Record<WorktreeStatus, string> = {
   working: 'Working',
   monitoring: 'Monitoring background tasks',
   permission: 'Needs permission',
+  failed: 'Failed',
   interrupted: 'Interrupted',
   done: 'Done',
   inactive: 'Inactive'
@@ -167,7 +169,7 @@ export function getWorktreeStatusLabel(status: WorktreeStatus): string {
  *
  * Map args are narrowed to this worktree. `hasPermission`/`hasLiveWorking`/
  * `hasLiveDone` are fresh hook entries ({blocked,waiting} / {working} / {done});
- * `hasRetainedDone` is a retained-agent snapshot scoped to this worktreeId.
+ * `hasRetainedDone`/`hasRetainedFailed` are retained-agent snapshots scoped to this worktreeId.
  */
 export function resolveWorktreeStatus(args: {
   tabs: readonly Pick<TerminalTab, 'id' | 'title' | 'launchAgent'>[]
@@ -181,9 +183,11 @@ export function resolveWorktreeStatus(args: {
   hasPermission: boolean
   hasLiveWorking: boolean
   hasLiveMonitoring?: boolean
+  hasFailed?: boolean
   hasInterrupted?: boolean
   hasLiveDone: boolean
   hasRetainedDone: boolean
+  hasRetainedFailed?: boolean
 }): WorktreeStatus {
   const heuristic = getWorktreeStatus(
     args.tabs,
@@ -204,6 +208,11 @@ export function resolveWorktreeStatus(args: {
   if (heuristic === 'permission') {
     return 'permission'
   }
+  // Why: a failure is news, so it outranks live work (a failed main agent's subagents may still
+  // run); only a pending question comes first.
+  if (args.hasFailed) {
+    return 'failed'
+  }
   // Why: restored cards get the hook snapshot before panes mount; trust the explicit working row so they stay yellow on restart.
   if (args.hasLiveWorking || heuristic === 'working') {
     return 'working'
@@ -211,7 +220,11 @@ export function resolveWorktreeStatus(args: {
   if (args.hasLiveMonitoring || heuristic === 'monitoring') {
     return 'monitoring'
   }
-  // Terminal outcomes follow live states, but an interrupted outcome must not collapse into success.
+  // Why: a departed agent's failure has no expiry, so it must not pin the card over live work.
+  if (args.hasRetainedFailed) {
+    return 'failed'
+  }
+  // A stop follows live states, but must not collapse into success.
   if (args.hasInterrupted) {
     return 'interrupted'
   }
diff --git a/src/renderer/src/runtime/agent-resume-host-authority-capability.test.ts b/src/renderer/src/runtime/agent-resume-host-authority-capability.test.ts
index f25aa9868a94..24393546a813 100644
--- a/src/renderer/src/runtime/agent-resume-host-authority-capability.test.ts
+++ b/src/renderer/src/runtime/agent-resume-host-authority-capability.test.ts
@@ -1,6 +1,8 @@
 import { describe, expect, it } from 'vitest'
 import { RESUMABLE_TUI_AGENTS } from '../../../shared/agent-session-resume'
 import {
+  AGENT_SESSION_QODER_RESUME_RUNTIME_CAPABILITY,
+  AGENT_SESSION_DSH_RESUME_RUNTIME_CAPABILITY,
   AGENT_SESSION_KIMI_RESUME_RUNTIME_CAPABILITY,
   AGENT_SESSION_MUSE_RESUME_RUNTIME_CAPABILITY,
   AGENT_SESSION_OPENCODE2_RESUME_RUNTIME_CAPABILITY,
@@ -55,6 +57,7 @@ describe('agentResumeHostAuthorityCapability', () => {
     ).toEqual({
       claude: undefined,
       codex: undefined,
+      qoder: AGENT_SESSION_QODER_RESUME_RUNTIME_CAPABILITY,
       gemini: undefined,
       antigravity: undefined,
       opencode: undefined,
@@ -69,7 +72,8 @@ describe('agentResumeHostAuthorityCapability', () => {
       copilot: undefined,
       muse: AGENT_SESSION_MUSE_RESUME_RUNTIME_CAPABILITY,
       omp: AGENT_SESSION_OMP_RESUME_PATH_RUNTIME_CAPABILITY,
-      kimi: AGENT_SESSION_KIMI_RESUME_RUNTIME_CAPABILITY
+      kimi: AGENT_SESSION_KIMI_RESUME_RUNTIME_CAPABILITY,
+      dsh: AGENT_SESSION_DSH_RESUME_RUNTIME_CAPABILITY
     })
   })
 })
diff --git a/src/renderer/src/runtime/agent-resume-host-authority-capability.ts b/src/renderer/src/runtime/agent-resume-host-authority-capability.ts
index ddc59b5ae981..efec3fe38b15 100644
--- a/src/renderer/src/runtime/agent-resume-host-authority-capability.ts
+++ b/src/renderer/src/runtime/agent-resume-host-authority-capability.ts
@@ -2,6 +2,8 @@ import type { ResumableTuiAgent } from '../../../shared/agent-session-resume'
 import type { TuiAgent } from '../../../shared/tui-agent'
 import {
   AGENT_SESSION_KIMI_RESUME_RUNTIME_CAPABILITY,
+  AGENT_SESSION_QODER_RESUME_RUNTIME_CAPABILITY,
+  AGENT_SESSION_DSH_RESUME_RUNTIME_CAPABILITY,
   AGENT_SESSION_MUSE_RESUME_RUNTIME_CAPABILITY,
   AGENT_SESSION_ZCODE_RESUME_RUNTIME_CAPABILITY,
   AGENT_SESSION_OPENCODE2_RESUME_RUNTIME_CAPABILITY,
@@ -19,6 +21,7 @@ const RESUME_HOST_AUTHORITY_CAPABILITY_BY_AGENT = {
   // These shipped inside agent-session.host-authority.v1's enum, so the generic probe covers them.
   claude: undefined,
   codex: undefined,
+  qoder: AGENT_SESSION_QODER_RESUME_RUNTIME_CAPABILITY,
   gemini: undefined,
   antigravity: undefined,
   opencode: undefined,
@@ -36,7 +39,8 @@ const RESUME_HOST_AUTHORITY_CAPABILITY_BY_AGENT = {
   muse: AGENT_SESSION_MUSE_RESUME_RUNTIME_CAPABILITY,
   zcode: AGENT_SESSION_ZCODE_RESUME_RUNTIME_CAPABILITY,
   omp: AGENT_SESSION_OMP_RESUME_PATH_RUNTIME_CAPABILITY,
-  kimi: AGENT_SESSION_KIMI_RESUME_RUNTIME_CAPABILITY
+  kimi: AGENT_SESSION_KIMI_RESUME_RUNTIME_CAPABILITY,
+  dsh: AGENT_SESSION_DSH_RESUME_RUNTIME_CAPABILITY
 } satisfies Record<ResumableTuiAgent, RuntimeCapability | undefined>
 
 export function agentResumeHostAuthorityCapability(
diff --git a/src/renderer/src/runtime/focus-runtime-terminal-surface-chat-view.test.ts b/src/renderer/src/runtime/focus-runtime-terminal-surface-chat-view.test.ts
index 39683bf2791d..a2eff98b6c6a 100644
--- a/src/renderer/src/runtime/focus-runtime-terminal-surface-chat-view.test.ts
+++ b/src/renderer/src/runtime/focus-runtime-terminal-surface-chat-view.test.ts
@@ -66,13 +66,15 @@ function registerChatViewTab(covered: boolean): {
   focus: ReturnType<typeof vi.fn>
   setActivePane: ReturnType<typeof vi.fn>
 } {
-  const focus = vi.fn()
+  const textarea = document.createElement('textarea')
+  document.body.append(textarea)
+  const focus = vi.fn(() => textarea.focus())
   const setActivePane = vi.fn()
   const pane = {
     id: PANE_ID,
     leafId: LEAF_ID,
     container: makePaneContainer(covered),
-    terminal: { focus }
+    terminal: { focus, textarea }
   }
   const manager = {
     getPanes: () => [pane],
@@ -99,6 +101,7 @@ function registerChatViewTab(covered: boolean): {
 // under the chat portal, so focusing it drags the caret out of the composer (#9939 twin).
 describe('focusRuntimeTerminalSurface on a chat-view pane', () => {
   afterEach(() => {
+    document.body.replaceChildren()
     while (unregisterCallbacks.length > 0) {
       unregisterCallbacks.pop()?.()
     }
diff --git a/src/renderer/src/runtime/focus-runtime-terminal-surface-readiness.test.ts b/src/renderer/src/runtime/focus-runtime-terminal-surface-readiness.test.ts
new file mode 100644
index 000000000000..6430ea97c1e3
--- /dev/null
+++ b/src/renderer/src/runtime/focus-runtime-terminal-surface-readiness.test.ts
@@ -0,0 +1,57 @@
+// @vitest-environment happy-dom
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import type { PaneManager } from '@/lib/pane-manager/pane-manager'
+import { focusRuntimeTerminalSurface, registerRuntimeTerminalTab } from './sync-runtime-graph'
+
+let unregister: (() => void) | undefined
+
+afterEach(() => {
+  unregister?.()
+  document.body.replaceChildren()
+})
+
+describe('terminal focus readiness', () => {
+  function register(hasPane: boolean, hasTextarea = true) {
+    const textarea = document.createElement('textarea')
+    const pane = {
+      id: 1,
+      container: document.createElement('div'),
+      terminal: {
+        textarea: hasTextarea ? textarea : undefined,
+        focus: vi.fn(() => textarea.focus())
+      }
+    }
+    const manager = {
+      getActivePane: () => (hasPane ? pane : undefined),
+      getPanes: () => (hasPane ? [pane] : [])
+    }
+    unregister = registerRuntimeTerminalTab({
+      tabId: 'restoring-tab',
+      worktreeId: 'restoring-workspace',
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: Focus reads only getActivePane/getPanes and the pane's container/terminal.
+      getManager: () => manager as unknown as PaneManager,
+      getContainer: () => null,
+      getPtyIdForPane: () => null,
+      getTabWideAgentHintLeafId: () => null
+    })
+    return textarea
+  }
+
+  it('does not report success before the active pane exists', () => {
+    register(false)
+    expect(focusRuntimeTerminalSurface('restoring-tab', null, 'restoring-workspace')).toBe(false)
+  })
+
+  it('does not report success before the terminal textarea exists', () => {
+    register(true, false)
+    expect(focusRuntimeTerminalSurface('restoring-tab', null, 'restoring-workspace')).toBe(false)
+  })
+
+  it('does not consume focus until the terminal can receive it', () => {
+    const textarea = register(true)
+    expect(focusRuntimeTerminalSurface('restoring-tab', null, 'restoring-workspace')).toBe(false)
+    document.body.append(textarea)
+    expect(focusRuntimeTerminalSurface('restoring-tab', null, 'restoring-workspace')).toBe(true)
+    expect(document.activeElement).toBe(textarea)
+  })
+})
diff --git a/src/renderer/src/runtime/runtime-terminal-inspection.test.ts b/src/renderer/src/runtime/runtime-terminal-inspection.test.ts
index 7f54f5873bc1..ded589e26b18 100644
--- a/src/renderer/src/runtime/runtime-terminal-inspection.test.ts
+++ b/src/renderer/src/runtime/runtime-terminal-inspection.test.ts
@@ -110,7 +110,12 @@ describe('runtime terminal owner routing', () => {
 
   it('sends input through the PTY owning environment instead of the active one', async () => {
     expect(
-      sendRuntimePtyInput({ activeRuntimeEnvironmentId: 'env-2' }, 'remote:env-1@@terminal-1', 'x')
+      sendRuntimePtyInput(
+        { activeRuntimeEnvironmentId: 'env-2' },
+        'remote:env-1@@terminal-1',
+        'x',
+        'driving'
+      )
     ).toBe(true)
 
     await vi.waitFor(() => {
@@ -341,7 +346,12 @@ describe('runtime terminal owner routing', () => {
     })
 
     expect(
-      sendRuntimePtyInput({ activeRuntimeEnvironmentId: 'env-2' }, 'remote:env-1@@terminal-1', 'x')
+      sendRuntimePtyInput(
+        { activeRuntimeEnvironmentId: 'env-2' },
+        'remote:env-1@@terminal-1',
+        'x',
+        'driving'
+      )
     ).toBe(true)
 
     await vi.waitFor(() => {
@@ -372,7 +382,12 @@ describe('runtime terminal owner routing', () => {
     useAppStore.setState({ lastTerminalInputAtByPaneKey: {} })
 
     expect(
-      sendRuntimePtyInput({ activeRuntimeEnvironmentId: 'env-2' }, 'remote:env-1@@terminal-1', 'x')
+      sendRuntimePtyInput(
+        { activeRuntimeEnvironmentId: 'env-2' },
+        'remote:env-1@@terminal-1',
+        'x',
+        'driving'
+      )
     ).toBe(true)
     const nextLeafId = '22222222-2222-4222-8222-222222222222'
     useAppStore.setState({
@@ -417,7 +432,12 @@ describe('runtime terminal owner routing', () => {
     })
 
     expect(
-      sendRuntimePtyInput({ activeRuntimeEnvironmentId: 'env-2' }, 'remote:env-1@@terminal-1', 'x')
+      sendRuntimePtyInput(
+        { activeRuntimeEnvironmentId: 'env-2' },
+        'remote:env-1@@terminal-1',
+        'x',
+        'driving'
+      )
     ).toBe(true)
 
     await vi.waitFor(() => {
@@ -436,7 +456,8 @@ describe('runtime terminal owner routing', () => {
       sendRuntimePtyInputVerified(
         { activeRuntimeEnvironmentId: 'env-2' },
         'remote:env-1@@terminal-stale',
-        'x'
+        'x',
+        'driving'
       )
     ).resolves.toBe(false)
   })
@@ -452,7 +473,8 @@ describe('runtime terminal owner routing', () => {
       sendRuntimePtyInputVerified(
         { activeRuntimeEnvironmentId: 'env-2' },
         'remote:env-1@@terminal-1',
-        'x'
+        'x',
+        'driving'
       )
     ).resolves.toBe(false)
 
@@ -472,17 +494,19 @@ describe('runtime terminal owner routing', () => {
     localWriteAccepted.mockResolvedValue(true)
 
     await expect(
-      sendRuntimePtyInputVerified({ activeRuntimeEnvironmentId: null }, 'local-pty', 'x')
+      sendRuntimePtyInputVerified({ activeRuntimeEnvironmentId: null }, 'local-pty', 'x', 'driving')
     ).resolves.toBe(true)
 
-    expect(localWriteAccepted).toHaveBeenCalledWith('local-pty', 'x')
+    expect(localWriteAccepted).toHaveBeenCalledWith('local-pty', 'x', 'driving')
     expect(localWrite).not.toHaveBeenCalled()
   })
 
   it('rejects oversized fire-and-forget local input before IPC writes', () => {
     const text = 'x'.repeat(TERMINAL_INPUT_MAX_BYTES + 1)
 
-    expect(sendRuntimePtyInput({ activeRuntimeEnvironmentId: null }, 'local-pty', text)).toBe(false)
+    expect(
+      sendRuntimePtyInput({ activeRuntimeEnvironmentId: null }, 'local-pty', text, 'driving')
+    ).toBe(false)
 
     expect(localWrite).not.toHaveBeenCalled()
     expect(localWriteAccepted).not.toHaveBeenCalled()
@@ -492,7 +516,12 @@ describe('runtime terminal owner routing', () => {
     const text = 'x'.repeat(TERMINAL_INPUT_MAX_BYTES + 1)
 
     expect(
-      sendRuntimePtyInput({ activeRuntimeEnvironmentId: 'env-2' }, 'remote:env-1@@terminal-1', text)
+      sendRuntimePtyInput(
+        { activeRuntimeEnvironmentId: 'env-2' },
+        'remote:env-1@@terminal-1',
+        text,
+        'driving'
+      )
     ).toBe(false)
 
     expect(runtimeTransportCall).not.toHaveBeenCalled()
@@ -504,14 +533,14 @@ describe('runtime terminal owner routing', () => {
     try {
       const text = 'x'.repeat(CLIPBOARD_TEXT_MEASURE_YIELD_CODE_UNITS + 1)
 
-      expect(sendRuntimePtyInput({ activeRuntimeEnvironmentId: null }, 'local-pty', text)).toBe(
-        true
-      )
+      expect(
+        sendRuntimePtyInput({ activeRuntimeEnvironmentId: null }, 'local-pty', text, 'driving')
+      ).toBe(true)
       expect(localWrite).not.toHaveBeenCalled()
 
       await vi.advanceTimersByTimeAsync(0)
 
-      expect(localWrite).toHaveBeenCalledWith('local-pty', text)
+      expect(localWrite).toHaveBeenCalledWith('local-pty', text, 'driving')
       expect(localWriteAccepted).not.toHaveBeenCalled()
     } finally {
       vi.useRealTimers()
@@ -523,9 +552,9 @@ describe('runtime terminal owner routing', () => {
     try {
       const text = makeByteOversizedTerminalInput()
 
-      expect(sendRuntimePtyInput({ activeRuntimeEnvironmentId: null }, 'local-pty', text)).toBe(
-        true
-      )
+      expect(
+        sendRuntimePtyInput({ activeRuntimeEnvironmentId: null }, 'local-pty', text, 'driving')
+      ).toBe(true)
 
       await vi.runAllTimersAsync()
 
@@ -540,7 +569,12 @@ describe('runtime terminal owner routing', () => {
     const text = 'x'.repeat(TERMINAL_INPUT_MAX_BYTES + 1)
 
     await expect(
-      sendRuntimePtyInputVerified({ activeRuntimeEnvironmentId: null }, 'local-pty', text)
+      sendRuntimePtyInputVerified(
+        { activeRuntimeEnvironmentId: null },
+        'local-pty',
+        text,
+        'driving'
+      )
     ).resolves.toBe(false)
 
     expect(localWriteAccepted).not.toHaveBeenCalled()
@@ -555,7 +589,8 @@ describe('runtime terminal owner routing', () => {
       const accepted = sendRuntimePtyInputVerified(
         { activeRuntimeEnvironmentId: null },
         'local-pty',
-        text
+        text,
+        'driving'
       )
 
       expect(localWriteAccepted).not.toHaveBeenCalled()
@@ -563,7 +598,7 @@ describe('runtime terminal owner routing', () => {
       await vi.advanceTimersByTimeAsync(0)
 
       await expect(accepted).resolves.toBe(true)
-      expect(localWriteAccepted).toHaveBeenCalledWith('local-pty', text)
+      expect(localWriteAccepted).toHaveBeenCalledWith('local-pty', text, 'driving')
       expect(localWrite).not.toHaveBeenCalled()
     } finally {
       vi.useRealTimers()
@@ -577,7 +612,8 @@ describe('runtime terminal owner routing', () => {
       const accepted = sendRuntimePtyInputVerified(
         { activeRuntimeEnvironmentId: null },
         'local-pty',
-        text
+        text,
+        'driving'
       )
 
       await vi.runAllTimersAsync()
@@ -612,7 +648,8 @@ describe('runtime terminal owner routing', () => {
       sendRuntimePtyInputVerified(
         { activeRuntimeEnvironmentId: 'env-2' },
         'remote:env-1@@terminal-1',
-        'x'
+        'x',
+        'driving'
       )
     ).resolves.toBe(true)
 
@@ -643,7 +680,8 @@ describe('runtime terminal owner routing', () => {
       sendRuntimePtyInputVerified(
         { activeRuntimeEnvironmentId: 'env-2' },
         'remote:env-1@@terminal-1',
-        'x'
+        'x',
+        'driving'
       )
     ).resolves.toBe(false)
 
@@ -829,10 +867,10 @@ describe('runtime terminal owner routing', () => {
     localWriteAccepted.mockResolvedValue(false)
 
     await expect(
-      sendRuntimePtyInputVerified({ activeRuntimeEnvironmentId: null }, 'local-pty', 'x')
+      sendRuntimePtyInputVerified({ activeRuntimeEnvironmentId: null }, 'local-pty', 'x', 'driving')
     ).resolves.toBe(true)
 
-    expect(localWriteAccepted).toHaveBeenCalledWith('local-pty', 'x')
-    expect(localWrite).toHaveBeenCalledWith('local-pty', 'x')
+    expect(localWriteAccepted).toHaveBeenCalledWith('local-pty', 'x', 'driving')
+    expect(localWrite).toHaveBeenCalledWith('local-pty', 'x', 'driving')
   })
 })
diff --git a/src/renderer/src/runtime/runtime-terminal-inspection.ts b/src/renderer/src/runtime/runtime-terminal-inspection.ts
index b34d75f45556..e235bb5adef0 100644
--- a/src/renderer/src/runtime/runtime-terminal-inspection.ts
+++ b/src/renderer/src/runtime/runtime-terminal-inspection.ts
@@ -20,6 +20,7 @@ export type {
   ClientOnlyUnverifiableInspection,
   ClientOnlyUnverifiableReason
 } from '../../../shared/terminal-process-inspection'
+import type { TerminalInputKind } from '../../../shared/terminal-input-kind'
 
 export type RuntimeTerminalProcessInspection = TerminalProcessInspection
 
@@ -216,7 +217,8 @@ export async function confirmRuntimeTerminalForegroundProcess(
 export function sendRuntimePtyInput(
   settings: Pick<GlobalSettings, 'activeRuntimeEnvironmentId'> | null | undefined,
   ptyId: string,
-  data: string
+  data: string,
+  inputKind: TerminalInputKind
 ): boolean {
   const tooLarge = isRuntimePtyInputTooLarge(data)
   if (tooLarge === true) {
@@ -228,19 +230,22 @@ export function sendRuntimePtyInput(
     void tooLarge
       .then((resolvedTooLarge) => {
         if (!resolvedTooLarge) {
-          sendRuntimePtyInputWithinLimit(settings, ptyId, data)
+          sendRuntimePtyInputWithinLimit(settings, ptyId, data, inputKind)
         }
       })
       .catch(() => {})
     return true
   }
-  return sendRuntimePtyInputWithinLimit(settings, ptyId, data)
+  return sendRuntimePtyInputWithinLimit(settings, ptyId, data, inputKind)
 }
 
+// Why the kind reaches only the local write: terminal.send has no launch kind, and its query-reply
+// kind is for mobile clients, so the host classifies a desktop's environment write by its bytes.
 function sendRuntimePtyInputWithinLimit(
   settings: Pick<GlobalSettings, 'activeRuntimeEnvironmentId'> | null | undefined,
   ptyId: string,
-  data: string
+  data: string,
+  inputKind: TerminalInputKind
 ): boolean {
   const ownerEnvironmentId = getRemoteRuntimePtyEnvironmentId(ptyId)
   const target = ownerEnvironmentId
@@ -248,7 +253,7 @@ function sendRuntimePtyInputWithinLimit(
     : getActiveRuntimeTarget(settings)
   const terminal = getRemoteRuntimeTerminalHandle(ptyId)
   if (target.kind !== 'environment' || !terminal) {
-    window.api.pty.write(ptyId, data)
+    window.api.pty.write(ptyId, data, inputKind)
     recordRuntimeTerminalInputForPtyId(ptyId)
     return true
   }
@@ -274,7 +279,8 @@ function sendRuntimePtyInputWithinLimit(
 export async function sendRuntimePtyInputVerified(
   settings: Pick<GlobalSettings, 'activeRuntimeEnvironmentId'> | null | undefined,
   ptyId: string,
-  data: string
+  data: string,
+  inputKind: TerminalInputKind
 ): Promise<boolean> {
   const tooLarge = isRuntimePtyInputTooLarge(data)
   if (typeof tooLarge === 'boolean' ? tooLarge : await tooLarge) {
@@ -286,9 +292,9 @@ export async function sendRuntimePtyInputVerified(
     : getActiveRuntimeTarget(settings)
   const terminal = getRemoteRuntimeTerminalHandle(ptyId)
   if (target.kind !== 'environment' || !terminal) {
-    const accepted = await window.api.pty.writeAccepted(ptyId, data)
+    const accepted = await window.api.pty.writeAccepted(ptyId, data, inputKind)
     if (!accepted) {
-      window.api.pty.write(ptyId, data)
+      window.api.pty.write(ptyId, data, inputKind)
       // Why: SSH/local fallback writes are fire-and-forget. Callers use this
       // boolean to continue UX flow, while hook telemetry confirms real turns.
       recordRuntimeTerminalInputForPtyId(ptyId)
diff --git a/src/renderer/src/runtime/structured-agent-session-accepted-send-capability.test.tsx b/src/renderer/src/runtime/structured-agent-session-accepted-send-capability.test.tsx
new file mode 100644
index 000000000000..acdfdbb03233
--- /dev/null
+++ b/src/renderer/src/runtime/structured-agent-session-accepted-send-capability.test.tsx
@@ -0,0 +1,51 @@
+// @vitest-environment happy-dom
+
+import { renderHook, waitFor } from '@testing-library/react'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { AGENT_SESSION_ACCEPTED_SEND_RUNTIME_CAPABILITY } from '../../../shared/protocol-version'
+
+const mocks = vi.hoisted(() => ({ supports: vi.fn() }))
+
+vi.mock('./runtime-rpc-client', () => ({
+  runtimeEnvironmentSupportsCapability: mocks.supports
+}))
+
+import { setLocalRuntimeCapabilitiesForTests } from './local-runtime-capabilities'
+import { useStructuredAgentSessionHostAcceptsSend } from './structured-agent-session-accepted-send-capability'
+
+afterEach(() => {
+  setLocalRuntimeCapabilitiesForTests(null)
+  vi.clearAllMocks()
+})
+
+describe('whether a host accepts a send before any agent has it', () => {
+  it('reads the local host from its advertised capabilities', () => {
+    setLocalRuntimeCapabilitiesForTests([AGENT_SESSION_ACCEPTED_SEND_RUNTIME_CAPABILITY])
+    const { result } = renderHook(() => useStructuredAgentSessionHostAcceptsSend({ kind: 'local' }))
+    expect(result.current).toBe(true)
+  })
+
+  it('treats a local host that does not advertise it as an older one', () => {
+    setLocalRuntimeCapabilitiesForTests([])
+    const { result } = renderHook(() => useStructuredAgentSessionHostAcceptsSend({ kind: 'local' }))
+    expect(result.current).toBe(false)
+  })
+
+  it('asks a remote host, and reads a failed probe as an older host', async () => {
+    mocks.supports.mockResolvedValueOnce(true).mockRejectedValueOnce(new Error('offline'))
+    const accepts = renderHook(() =>
+      useStructuredAgentSessionHostAcceptsSend({ kind: 'environment', environmentId: 'env-1' })
+    )
+    await waitFor(() => expect(accepts.result.current).toBe(true))
+    expect(mocks.supports).toHaveBeenCalledWith(
+      'env-1',
+      AGENT_SESSION_ACCEPTED_SEND_RUNTIME_CAPABILITY
+    )
+
+    const offline = renderHook(() =>
+      useStructuredAgentSessionHostAcceptsSend({ kind: 'environment', environmentId: 'env-2' })
+    )
+    await waitFor(() => expect(mocks.supports).toHaveBeenCalledTimes(2))
+    expect(offline.result.current).toBe(false)
+  })
+})
diff --git a/src/renderer/src/runtime/structured-agent-session-accepted-send-capability.ts b/src/renderer/src/runtime/structured-agent-session-accepted-send-capability.ts
new file mode 100644
index 000000000000..c6e130b8bd5f
--- /dev/null
+++ b/src/renderer/src/runtime/structured-agent-session-accepted-send-capability.ts
@@ -0,0 +1,87 @@
+import { useEffect, useLayoutEffect, useRef, useState, type RefObject } from 'react'
+import { AGENT_SESSION_ACCEPTED_SEND_RUNTIME_CAPABILITY } from '../../../shared/protocol-version'
+import type { RuntimeClientTarget } from './runtime-client-target'
+import {
+  ensureLocalRuntimeCapabilities,
+  readLocalRuntimeCapabilitiesOrUnknown
+} from './local-runtime-capabilities'
+import { runtimeEnvironmentSupportsCapability } from './runtime-rpc-client'
+
+function targetKey(target: RuntimeClientTarget): string {
+  return target.kind === 'local' ? 'local' : `environment:${target.environmentId}`
+}
+
+/**
+ * Whether the host answers a send at acceptance and never refuses one because its agent could not
+ * start. Such a host records every send before it starts anything, so nothing about a moved fence
+ * calls for a resend. False until the host has said so: an older host is handled as it always was.
+ */
+export function useStructuredAgentSessionHostAcceptsSend(target: RuntimeClientTarget): boolean {
+  const key = targetKey(target)
+  const [answer, setAnswer] = useState<{ key: string; accepts: boolean }>(() => ({
+    key,
+    accepts:
+      target.kind === 'local' &&
+      (readLocalRuntimeCapabilitiesOrUnknown()?.includes(
+        AGENT_SESSION_ACCEPTED_SEND_RUNTIME_CAPABILITY
+      ) ??
+        false)
+  }))
+  const environmentId = target.kind === 'environment' ? target.environmentId : null
+  useEffect(() => {
+    let cancelled = false
+    const probe =
+      environmentId === null
+        ? ensureLocalRuntimeCapabilities().then(
+            (capabilities) =>
+              capabilities?.includes(AGENT_SESSION_ACCEPTED_SEND_RUNTIME_CAPABILITY) ?? false
+          )
+        : runtimeEnvironmentSupportsCapability(
+            environmentId,
+            AGENT_SESSION_ACCEPTED_SEND_RUNTIME_CAPABILITY
+          )
+    void probe
+      .catch(() => false)
+      .then((accepts) => {
+        if (!cancelled) {
+          setAnswer((current) =>
+            current.key === key && current.accepts === accepts ? current : { key, accepts }
+          )
+        }
+      })
+    return () => {
+      cancelled = true
+    }
+  }, [environmentId, key])
+  return answer.key === key && answer.accepts
+}
+
+/**
+ * When an outbox treats its owner as changed: resending a send in flight under the same id,
+ * dropping that send's answer, and unblocking a refused head. An older host restarts the agent
+ * inside the send and refuses it, unrecorded, when that fails, so a new fence is its only word that
+ * another try may land. A host that accepts first records every send before it starts anything,
+ * so a moved fence means nothing there, and only a Retry or a new send goes out.
+ */
+export function useStructuredAgentSessionOutboxOwnerChange(
+  target: RuntimeClientTarget,
+  fence: number | null
+): {
+  ownerChange: number | null
+  attached: boolean
+  fenceRef: RefObject<number | null>
+  targetKey: string
+} {
+  const acceptsSend = useStructuredAgentSessionHostAcceptsSend(target)
+  // Read by effects that run on an owner change, not on every fence move.
+  const fenceRef = useRef(fence)
+  useLayoutEffect(() => {
+    fenceRef.current = fence
+  }, [fence])
+  return {
+    ownerChange: acceptsSend ? null : fence,
+    attached: fence !== null,
+    fenceRef,
+    targetKey: targetKey(target)
+  }
+}
diff --git a/src/renderer/src/runtime/structured-agent-session-client.ts b/src/renderer/src/runtime/structured-agent-session-client.ts
index 446f419d1f94..d50fed2b4c33 100644
--- a/src/renderer/src/runtime/structured-agent-session-client.ts
+++ b/src/renderer/src/runtime/structured-agent-session-client.ts
@@ -9,6 +9,7 @@ import type { AgentSessionConversationOutline } from '../../../shared/agent-sess
 import {
   AGENT_SESSION_CONVERSATION_OUTLINE_RUNTIME_CAPABILITY,
   AGENT_SESSION_PROMPT_CANCEL_RUNTIME_CAPABILITY,
+  AGENT_SESSION_QUESTION_ANSWERS_RUNTIME_CAPABILITY,
   AGENT_SESSION_REWIND_RUNTIME_CAPABILITY,
   type RuntimeCapability
 } from '../../../shared/protocol-version'
@@ -46,6 +47,15 @@ export function supportsStructuredAgentSessionPromptCancel(
   return structuredAgentSessionHostSupports(target, AGENT_SESSION_PROMPT_CANCEL_RUNTIME_CAPABILITY)
 }
 
+export function supportsStructuredAgentSessionQuestionAnswers(
+  target: RuntimeClientTarget
+): Promise<boolean> {
+  return structuredAgentSessionHostSupports(
+    target,
+    AGENT_SESSION_QUESTION_ANSWERS_RUNTIME_CAPABILITY
+  )
+}
+
 /** Null when the host predates the outline, without calling it. A failed read
  *  rejects, so the caller can retry it; the rail maps loaded messages meanwhile. */
 export async function readStructuredAgentSessionConversationOutline(
diff --git a/src/renderer/src/runtime/structured-agent-session-tab-retirement.test.ts b/src/renderer/src/runtime/structured-agent-session-tab-retirement.test.ts
index 7963b1c150ec..5c3017998c04 100644
--- a/src/renderer/src/runtime/structured-agent-session-tab-retirement.test.ts
+++ b/src/renderer/src/runtime/structured-agent-session-tab-retirement.test.ts
@@ -84,7 +84,6 @@ describe('structured agent session tab retirement', () => {
     beginStructuredAgentSessionTabClose({
       target,
       worktreeId: 'wt-1',
-      tabId: 'agent-tab-1',
       sessionId: 'session-1',
       provisional: true
     })
@@ -119,13 +118,11 @@ describe('structured agent session tab retirement', () => {
     retireStructuredAgentSessionTab({
       target,
       worktreeId: 'wt-1',
-      tabId: 'agent-tab-1',
       sessionId: 'session-1'
     })
     retireStructuredAgentSessionTab({
       target,
       worktreeId: 'wt-1',
-      tabId: 'agent-tab-1',
       sessionId: 'session-1'
     })
     expect(mocks.closeSession).toHaveBeenCalledTimes(1)
diff --git a/src/renderer/src/runtime/structured-agent-session-tab-retirement.ts b/src/renderer/src/runtime/structured-agent-session-tab-retirement.ts
index 8489aa0e6a6a..567e7459603a 100644
--- a/src/renderer/src/runtime/structured-agent-session-tab-retirement.ts
+++ b/src/renderer/src/runtime/structured-agent-session-tab-retirement.ts
@@ -19,7 +19,6 @@ function retirementKey(target: RuntimeClientTarget, worktreeId: string, sessionI
 export function retireStructuredAgentSessionTab(args: {
   target: RuntimeClientTarget
   worktreeId: string
-  tabId: string
   sessionId: string
   onError?: (error: unknown) => void
 }): void {
@@ -28,11 +27,13 @@ export function retireStructuredAgentSessionTab(args: {
   if (existing) {
     return
   }
+  const hostTabId = `agent-session:${args.sessionId}`
+  // Why: main echoes the host tab id it was asked to close, never this window's tab id.
   const closeHostTab = () =>
-    withLocalSessionTabCloseOwner(args.worktreeId, args.tabId, () =>
+    withLocalSessionTabCloseOwner(args.worktreeId, hostTabId, () =>
       callRuntimeRpc(args.target, 'session.tabs.close', {
         worktree: toRuntimeWorktreeSelector(args.worktreeId),
-        tabId: `agent-session:${args.sessionId}`,
+        tabId: hostTabId,
         reason: 'user'
       })
     )
@@ -58,7 +59,6 @@ export function retireStructuredAgentSessionTab(args: {
 export function beginStructuredAgentSessionTabClose(args: {
   target: RuntimeClientTarget
   worktreeId: string
-  tabId: string
   sessionId: string
   provisional: boolean
   onError?: (error: unknown) => void
@@ -92,7 +92,6 @@ export function suppressCancelledStructuredSessionTabs(
     retireStructuredAgentSessionTab({
       target,
       worktreeId: snapshot.worktree,
-      tabId: `agent-session:${sessionId}`,
       sessionId,
       onError
     })
diff --git a/src/renderer/src/runtime/structured-conversation-tab-replacement.test.ts b/src/renderer/src/runtime/structured-conversation-tab-replacement.test.ts
index 8f34606ef27f..c6804fb43390 100644
--- a/src/renderer/src/runtime/structured-conversation-tab-replacement.test.ts
+++ b/src/renderer/src/runtime/structured-conversation-tab-replacement.test.ts
@@ -94,10 +94,10 @@ describe('clear pane identity', () => {
         groupId: 'local-group',
         isPinned: true
       })
-      expect(next.groupsByWorktree?.[WT]?.[0]).toMatchObject({
-        activeTabId: 'local-pane'
-      })
-      expect(next.groupsByWorktree?.[WT]?.[0]?.tabOrder[0]).toBe('local-pane')
+      // An omitted groups patch means the snapshot left every group as it was.
+      const nextGroup = (next.groupsByWorktree ?? state.groupsByWorktree)[WT]?.[0]
+      expect(nextGroup).toMatchObject({ activeTabId: 'local-pane' })
+      expect(nextGroup?.tabOrder[0]).toBe('local-pane')
       expect(next.activeTabIdByWorktree?.[WT] ?? state.activeTabIdByWorktree[WT]).toBe('local-pane')
       expect(next.tabsByWorktree?.[WT] ?? []).toEqual([])
       const repeated = applyWebSessionTabsSnapshot({ ...state, ...next }, snapshot, ENV, NOW + 1, {
diff --git a/src/renderer/src/runtime/sync-runtime-graph-agent-status-projection.test.ts b/src/renderer/src/runtime/sync-runtime-graph-agent-status-projection.test.ts
index 2ac4a8bbfd76..5bd9460041ad 100644
--- a/src/renderer/src/runtime/sync-runtime-graph-agent-status-projection.test.ts
+++ b/src/renderer/src/runtime/sync-runtime-graph-agent-status-projection.test.ts
@@ -13,6 +13,10 @@ import {
 // under test so a drifted constant cannot make this reference silently disagree for a reason
 // unrelated to the change.
 const BUCKET_MS = AGENT_STATUS_SYNC_UPDATED_AT_BUCKET_MS_FOR_TESTS
+type MainAgentStatus = AppState['agentStatusByPaneKey'][string]['mainAgent']
+function mainAgentKey(mainAgent: MainAgentStatus) {
+  return mainAgent ? [mainAgent.state, mainAgent.outcome ?? null, mainAgent.stateStartedAt] : null
+}
 function referenceProjection(map: AppState['agentStatusByPaneKey']): string {
   return JSON.stringify(
     Object.entries(map)
@@ -31,14 +35,16 @@ function referenceProjection(map: AppState['agentStatusByPaneKey']): string {
           state: history.state,
           prompt: history.prompt,
           startedAt: history.startedAt,
-          interrupted: history.interrupted ?? null
+          interrupted: history.interrupted ?? null,
+          mainAgent: mainAgentKey(history.mainAgent)
         })),
         toolName: entry.toolName ?? null,
         toolInput: entry.toolInput ?? null,
         interactivePrompt: entry.interactivePrompt ?? null,
         lastAssistantMessage: entry.lastAssistantMessage ?? null,
         lastAssistantMessageIsToolOutput: entry.lastAssistantMessageIsToolOutput ?? null,
-        interrupted: entry.interrupted ?? null
+        interrupted: entry.interrupted ?? null,
+        mainAgent: mainAgentKey(entry.mainAgent)
       }))
   )
 }
@@ -145,4 +151,39 @@ describe('mobile agent-status projection equivalence', () => {
     expect([...projected].sort()).toEqual([...localeCompareOrderedEntries].sort())
     expect(projected).toHaveLength(localeCompareOrderedEntries.length)
   })
+
+  it('republishes a verdict change that leaves the interrupted flag as it was', () => {
+    resetRuntimeMobileAgentStatusProjectionCacheForTests()
+    const project = (live: 'success' | 'failure', history: 'success' | 'failure'): string =>
+      buildRuntimeMobileAgentStatusProjectionForTests({
+        'tab-0:leaf-0': makeEntry(0, {
+          state: 'done',
+          mainAgent: { state: 'done', outcome: live, stateStartedAt: 1740000000000 },
+          stateHistory: [
+            {
+              state: 'done',
+              prompt: 'p',
+              startedAt: 1,
+              mainAgent: { state: 'done', outcome: history, stateStartedAt: 1 }
+            }
+          ]
+        })
+      })
+    expect(project('failure', 'success')).not.toBe(project('success', 'success'))
+    expect(project('success', 'failure')).not.toBe(project('success', 'success'))
+  })
+
+  it('republishes a main agent failing while its subagents keep the row working', () => {
+    resetRuntimeMobileAgentStatusProjectionCacheForTests()
+    const project = (outcome?: 'failure', stateStartedAt = 1740000000000): string =>
+      buildRuntimeMobileAgentStatusProjectionForTests({
+        'tab-0:leaf-0': makeEntry(0, {
+          state: 'working',
+          mainAgent: { state: 'done', ...(outcome ? { outcome } : {}), stateStartedAt }
+        })
+      })
+    expect(project('failure')).not.toBe(project())
+    // The main agent's own clock dates the failure on mobile, so moving it republishes too.
+    expect(project('failure', 1740000001000)).not.toBe(project('failure'))
+  })
 })
diff --git a/src/renderer/src/runtime/sync-runtime-graph-projection-hot-path.test.ts b/src/renderer/src/runtime/sync-runtime-graph-projection-hot-path.test.ts
index 1a163ada0a82..0adbd768fe5a 100644
--- a/src/renderer/src/runtime/sync-runtime-graph-projection-hot-path.test.ts
+++ b/src/renderer/src/runtime/sync-runtime-graph-projection-hot-path.test.ts
@@ -35,6 +35,11 @@ const { AGENT_STATUS_SYNC_UPDATED_AT_BUCKET_MS } = await import('./sync-runtime-
 
 // ── Reference implementations: the pre-change bodies, kept verbatim ────────────────────
 
+type MainAgentStatus = AppState['agentStatusByPaneKey'][string]['mainAgent']
+function mainAgentKey(mainAgent: MainAgentStatus) {
+  return mainAgent ? [mainAgent.state, mainAgent.outcome ?? null, mainAgent.stateStartedAt] : null
+}
+
 function referenceEditorDraftsProjection(editorDrafts: AppState['editorDrafts']): string {
   return JSON.stringify(
     Object.fromEntries(
@@ -112,14 +117,16 @@ function referenceAgentStatusProjection(map: AppState['agentStatusByPaneKey']):
           state: history.state,
           prompt: history.prompt,
           startedAt: history.startedAt,
-          interrupted: history.interrupted ?? null
+          interrupted: history.interrupted ?? null,
+          mainAgent: mainAgentKey(history.mainAgent)
         })),
         toolName: entry.toolName ?? null,
         toolInput: entry.toolInput ?? null,
         interactivePrompt: entry.interactivePrompt ?? null,
         lastAssistantMessage: entry.lastAssistantMessage ?? null,
         lastAssistantMessageIsToolOutput: entry.lastAssistantMessageIsToolOutput ?? null,
-        interrupted: entry.interrupted ?? null
+        interrupted: entry.interrupted ?? null,
+        mainAgent: mainAgentKey(entry.mainAgent)
       }))
   )
 }
diff --git a/src/renderer/src/runtime/sync-runtime-graph-terminal-registration-ownership.test.ts b/src/renderer/src/runtime/sync-runtime-graph-terminal-registration-ownership.test.ts
index 97d17f3fc475..410e8dea763e 100644
--- a/src/renderer/src/runtime/sync-runtime-graph-terminal-registration-ownership.test.ts
+++ b/src/renderer/src/runtime/sync-runtime-graph-terminal-registration-ownership.test.ts
@@ -1,3 +1,4 @@
+// @vitest-environment happy-dom
 import { describe, expect, it, vi } from 'vitest'
 import {
   buildMobileSessionTabSnapshots,
@@ -77,11 +78,24 @@ describe('runtime terminal registration ownership', () => {
   })
 
   it('focuses the requested worktree when tab ids collide', () => {
-    const focusA = vi.fn()
-    const focusB = vi.fn()
+    const textareaA = document.createElement('textarea')
+    const textareaB = document.createElement('textarea')
+    document.body.append(textareaA, textareaB)
+    const focusA = vi.fn(() => textareaA.focus())
+    const focusB = vi.fn(() => textareaB.focus())
     const container = { querySelector: () => null }
-    const paneA = { id: 1, leafId: LEAF_A, container, terminal: { focus: focusA } }
-    const paneB = { id: 1, leafId: LEAF_B, container, terminal: { focus: focusB } }
+    const paneA = {
+      id: 1,
+      leafId: LEAF_A,
+      container,
+      terminal: { focus: focusA, textarea: textareaA }
+    }
+    const paneB = {
+      id: 1,
+      leafId: LEAF_B,
+      container,
+      terminal: { focus: focusB, textarea: textareaB }
+    }
     const managerA = {
       getPanes: () => [paneA],
       getActivePane: () => paneA,
@@ -113,9 +127,12 @@ describe('runtime terminal registration ownership', () => {
     try {
       expect(focusRuntimeTerminalSurface(TAB_ID, null, WORKTREE_B)).toBe(true)
       expect(focusB).toHaveBeenCalledOnce()
+      expect(document.activeElement).toBe(textareaB)
       expect(focusA).not.toHaveBeenCalled()
       expect(focusRuntimeTerminalSurface(TAB_ID)).toBe(false)
     } finally {
+      textareaA.remove()
+      textareaB.remove()
       unregisterB()
       unregisterA()
     }
diff --git a/src/renderer/src/runtime/sync-runtime-graph.ts b/src/renderer/src/runtime/sync-runtime-graph.ts
index 30504422facc..8267320e430c 100644
--- a/src/renderer/src/runtime/sync-runtime-graph.ts
+++ b/src/renderer/src/runtime/sync-runtime-graph.ts
@@ -82,8 +82,12 @@ export function focusRuntimeTerminalSurface(
     if (activePaneIsCoveredByNativeChat(manager)) {
       return true
     }
-    manager.getActivePane()?.terminal.focus()
-    return true
+    const pane = manager.getActivePane()
+    if (!pane) {
+      return false
+    }
+    pane.terminal.focus()
+    return !!pane.terminal.textarea && document.activeElement === pane.terminal.textarea
   }
   const resolution = resolveLeafIdForManager(tabId, leafId, manager)
   if (resolution.status !== 'resolved') {
diff --git a/src/renderer/src/runtime/sync-runtime-graph/agent-status-projection.ts b/src/renderer/src/runtime/sync-runtime-graph/agent-status-projection.ts
index 16c188edef5e..ba41d169e8c8 100644
--- a/src/renderer/src/runtime/sync-runtime-graph/agent-status-projection.ts
+++ b/src/renderer/src/runtime/sync-runtime-graph/agent-status-projection.ts
@@ -1,7 +1,12 @@
 import type { AppState } from '@/store/types'
+import type { AgentMainAgentStatus } from '../../../../shared/main-agent-status'
 import { AGENT_STATUS_SYNC_UPDATED_AT_BUCKET_MS, graphState } from './graph-state'
 import type { AgentStatusProjectionCacheEntry } from './types'
 
+function mainAgentKey(mainAgent: AgentMainAgentStatus | undefined) {
+  return mainAgent ? [mainAgent.state, mainAgent.outcome ?? null, mainAgent.stateStartedAt] : null
+}
+
 function serializeAgentStatusEntry(
   paneKey: string,
   entry: AppState['agentStatusByPaneKey'][string]
@@ -20,7 +25,8 @@ function serializeAgentStatusEntry(
       state: history.state,
       prompt: history.prompt,
       startedAt: history.startedAt,
-      interrupted: history.interrupted ?? null
+      interrupted: history.interrupted ?? null,
+      mainAgent: mainAgentKey(history.mainAgent)
     })),
     toolName: entry.toolName ?? null,
     toolInput: entry.toolInput ?? null,
@@ -28,7 +34,9 @@ function serializeAgentStatusEntry(
     interactivePrompt: entry.interactivePrompt ?? null,
     lastAssistantMessage: entry.lastAssistantMessage ?? null,
     lastAssistantMessageIsToolOutput: entry.lastAssistantMessageIsToolOutput ?? null,
-    interrupted: entry.interrupted ?? null
+    interrupted: entry.interrupted ?? null,
+    // A failure changes the verdict and leaves `interrupted` as it was.
+    mainAgent: mainAgentKey(entry.mainAgent)
   })
 }
 
diff --git a/src/renderer/src/runtime/sync-runtime-graph/mobile-session-terminal-tabs.ts b/src/renderer/src/runtime/sync-runtime-graph/mobile-session-terminal-tabs.ts
index ac88ad17eb65..ce3df5a71f0b 100644
--- a/src/renderer/src/runtime/sync-runtime-graph/mobile-session-terminal-tabs.ts
+++ b/src/renderer/src/runtime/sync-runtime-graph/mobile-session-terminal-tabs.ts
@@ -54,6 +54,7 @@ export function buildMobileTerminalSurfaceTabs(
     }),
     activeLeafId,
     expandedLeafId: sanitizedSavedLayout?.expandedLeafId ?? null,
+    ...(sanitizedSavedLayout?.chatLeafId ? { chatLeafId: sanitizedSavedLayout.chatLeafId } : {}),
     ...(Object.keys(savedPtyIdsByLeafId).length > 0 ? { ptyIdsByLeafId: savedPtyIdsByLeafId } : {}),
     ...(sanitizedSavedLayout?.titlesByLeafId
       ? { titlesByLeafId: sanitizedSavedLayout.titlesByLeafId }
diff --git a/src/renderer/src/runtime/web-runtime-browser-creation-context.ts b/src/renderer/src/runtime/web-runtime-browser-creation-context.ts
index d82f287b4752..279c9169afc7 100644
--- a/src/renderer/src/runtime/web-runtime-browser-creation-context.ts
+++ b/src/renderer/src/runtime/web-runtime-browser-creation-context.ts
@@ -37,6 +37,8 @@ export type CreateWebRuntimeSessionBrowserTabArgs = {
   profileId?: string | null
   targetGroupId?: string
   clientTargetGroupId?: string
+  /** Client-only unified tab id the staged row follows; never sent to the host. */
+  clientAfterTabId?: string
   clientTargetGroupCreated?: boolean
   focusOnCreate?: boolean
   /** Wait until a renderer-backed host can publish the new page in its session snapshot. */
@@ -109,6 +111,18 @@ export function createWebRuntimeBrowserCreationContext(
   }
 }
 
+/**
+ * The client group this create is steered to. With an anchor only an explicit client destination
+ * counts; a host-facing targetGroupId would otherwise freeze the row away from the source's group.
+ */
+export function resolveWebRuntimeBrowserClientTargetGroupId(
+  args: CreateWebRuntimeSessionBrowserTabArgs
+): string | undefined {
+  return args.clientAfterTabId
+    ? args.clientTargetGroupId
+    : (args.clientTargetGroupId ?? args.targetGroupId)
+}
+
 export function stageWebRuntimeBrowserCreation(context: WebRuntimeBrowserCreationContext): void {
   const { args, environmentId, intentOwner, provisionalPageId, shouldFocusOnCreate } = context
   throwIfE2eWebRuntimeBrowserCapabilityUnavailable()
@@ -125,6 +139,7 @@ export function stageWebRuntimeBrowserCreation(context: WebRuntimeBrowserCreatio
   if (context.shouldSelectWorktree) {
     selectWebRuntimeSessionBrowserWorktree(args.worktreeId, environmentId)
   }
+  const stagedTargetGroupId = resolveWebRuntimeBrowserClientTargetGroupId(args)
   // Why: everything below this point is a host round-trip; stage the tab first so the strip
   // reacts to the click instead of to the runtime.
   context.staged = stageWebRuntimeBrowserTab({
@@ -135,9 +150,8 @@ export function stageWebRuntimeBrowserCreation(context: WebRuntimeBrowserCreatio
     ...(args.url !== undefined ? { url: args.url } : {}),
     ...(args.stagedTitle !== undefined ? { title: args.stagedTitle } : {}),
     ...(args.profileId !== undefined ? { profileId: args.profileId } : {}),
-    ...((args.clientTargetGroupId ?? args.targetGroupId)
-      ? { targetGroupId: (args.clientTargetGroupId ?? args.targetGroupId) as string }
-      : {}),
+    ...(stagedTargetGroupId ? { targetGroupId: stagedTargetGroupId } : {}),
+    ...(args.clientAfterTabId ? { afterTabId: args.clientAfterTabId } : {}),
     ...(args.stagedFocusAddressBar !== undefined
       ? { focusAddressBar: args.stagedFocusAddressBar }
       : {}),
diff --git a/src/renderer/src/runtime/web-runtime-browser-creation-placement-test-rig.ts b/src/renderer/src/runtime/web-runtime-browser-creation-placement-test-rig.ts
new file mode 100644
index 000000000000..6eacef429e37
--- /dev/null
+++ b/src/renderer/src/runtime/web-runtime-browser-creation-placement-test-rig.ts
@@ -0,0 +1,244 @@
+import { vi } from 'vitest'
+import type { BrowserPage, BrowserWorkspace } from '../../../shared/browser-workspace-types'
+import type { RuntimeMobileSessionTabsResult } from '../../../shared/runtime-types'
+import type { Tab, TabGroup } from '../../../shared/tab-types'
+import type { ExecutionHostId } from '../../../shared/execution-host'
+import { useAppStore } from '../store'
+import type { AppState } from '../store/types'
+import { applyWebSessionTabsSnapshot } from './web-session-tabs-sync'
+import { ENV, NOW, WT, makeSnapshot } from './web-session-tabs-sync-test-harness'
+
+export const HOST: ExecutionHostId = `runtime:${ENV}`
+export const G1 = 'group-1'
+export const G2 = 'group-2'
+
+export type MirroredRow = { unifiedTabId: string; workspaceId: string; pageId: string }
+
+export function mirroredRow(name: string): MirroredRow {
+  return {
+    unifiedTabId: `${name}-tab`,
+    workspaceId: `${name}-workspace`,
+    pageId: `${name}-page`
+  }
+}
+
+export const SOURCE = mirroredRow('source')
+export const AFTER = mirroredRow('after')
+export const OTHER = mirroredRow('other')
+
+function workspace(row: MirroredRow): BrowserWorkspace {
+  return {
+    id: row.workspaceId,
+    worktreeId: WT,
+    activePageId: row.pageId,
+    pageIds: [row.pageId],
+    url: 'https://example.com/',
+    title: 'Example',
+    loading: false,
+    faviconUrl: null,
+    canGoBack: false,
+    canGoForward: false,
+    loadError: null,
+    createdAt: NOW
+  }
+}
+
+function page(row: MirroredRow): BrowserPage {
+  return {
+    id: row.pageId,
+    workspaceId: row.workspaceId,
+    worktreeId: WT,
+    url: 'https://example.com/',
+    title: 'Example',
+    loading: false,
+    faviconUrl: null,
+    canGoBack: false,
+    canGoForward: false,
+    loadError: null,
+    createdAt: NOW,
+    browserRuntimeEnvironmentId: ENV,
+    viewportPresetId: null
+  }
+}
+
+function unifiedTab(row: MirroredRow, groupId: string, sortOrder: number): Tab {
+  return {
+    id: row.unifiedTabId,
+    entityId: row.workspaceId,
+    groupId,
+    worktreeId: WT,
+    executionHostId: HOST,
+    contentType: 'browser',
+    label: 'Example',
+    customLabel: null,
+    color: null,
+    sortOrder,
+    createdAt: NOW,
+    lastFocusedAt: NOW - 10,
+    isPreview: false,
+    isPinned: false
+  }
+}
+
+export function runtimeStatusesFor(
+  capabilities: string[]
+): AppState['runtimeStatusByEnvironmentId'] {
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: creation reads only status.capabilities from this entry.
+  return new Map([
+    [ENV, { status: { capabilities }, checkedAt: 1 }]
+  ]) as AppState['runtimeStatusByEnvironmentId']
+}
+
+/** G1 holds SOURCE then AFTER with SOURCE active; G2 holds OTHER and is the focused group. */
+export function seedPairedWorktree(): void {
+  const rows = [SOURCE, AFTER, OTHER]
+  const groups: TabGroup[] = [
+    {
+      id: G1,
+      worktreeId: WT,
+      activeTabId: SOURCE.unifiedTabId,
+      tabOrder: [SOURCE.unifiedTabId, AFTER.unifiedTabId],
+      recentTabIds: [SOURCE.unifiedTabId]
+    },
+    {
+      id: G2,
+      worktreeId: WT,
+      activeTabId: OTHER.unifiedTabId,
+      tabOrder: [OTHER.unifiedTabId],
+      recentTabIds: [OTHER.unifiedTabId]
+    }
+  ]
+  useAppStore.setState({
+    activeWorktreeId: WT,
+    activeWorkspaceExecutionHostId: HOST,
+    runtimeStatusByEnvironmentId: runtimeStatusesFor([
+      'browser.screencast.v1',
+      'browser.tab-create-known-id.v1'
+    ]),
+    browserTabsByWorktree: { [WT]: rows.map(workspace) },
+    browserPagesByWorkspace: Object.fromEntries(rows.map((row) => [row.workspaceId, [page(row)]])),
+    remoteBrowserPageHandlesByPageId: Object.fromEntries(
+      rows.map((row) => [row.pageId, { environmentId: ENV, remotePageId: row.pageId }])
+    ),
+    unifiedTabsByWorktree: {
+      [WT]: [unifiedTab(SOURCE, G1, 0), unifiedTab(AFTER, G1, 1), unifiedTab(OTHER, G2, 0)]
+    },
+    groupsByWorktree: { [WT]: groups },
+    activeGroupIdByWorktree: { [WT]: G2 },
+    layoutByWorktree: {
+      [WT]: {
+        type: 'split',
+        direction: 'horizontal',
+        first: { type: 'leaf', groupId: G1 },
+        second: { type: 'leaf', groupId: G2 }
+      }
+    },
+    activeTabType: 'browser',
+    activeTabTypeByWorktree: { [WT]: 'browser' },
+    activeBrowserTabId: OTHER.workspaceId,
+    activeBrowserTabIdByWorktree: { [WT]: OTHER.workspaceId },
+    tabBarOrderByWorktree: {}
+  })
+}
+
+function hostBrowserTab(
+  remotePageId: string,
+  hostWorkspaceId = `host-workspace-${remotePageId}`
+): RuntimeMobileSessionTabsResult['tabs'][number] {
+  return {
+    type: 'browser',
+    id: `host-tab-${remotePageId}`,
+    title: 'Example',
+    browserWorkspaceId: hostWorkspaceId,
+    browserPageId: remotePageId,
+    url: 'https://example.com/',
+    loading: false,
+    canGoBack: false,
+    canGoForward: false,
+    isActive: false
+  }
+}
+
+/** The host's page list; each publication mirrors every page it holds. */
+export const hostPages: string[] = []
+let snapshotVersion = 1
+
+export function publishHostSnapshot(): void {
+  snapshotVersion += 1
+  const snapshot = makeSnapshot(
+    [SOURCE.pageId, AFTER.pageId, OTHER.pageId, ...hostPages].map((id) => hostBrowserTab(id)),
+    { snapshotVersion, activeTabType: 'browser', activeTabId: null }
+  )
+  useAppStore.setState((state) =>
+    applyWebSessionTabsSnapshot(state, snapshot, ENV, NOW + snapshotVersion)
+  )
+}
+
+export function resetHostPages(): void {
+  hostPages.length = 0
+  snapshotVersion = 1
+}
+
+type Deferred = {
+  params: { page?: string; targetGroupId?: string } & Record<string, unknown>
+  resolve: (browserPageId?: string) => void
+  reject: (error: Error) => void
+}
+
+/** Every browser.tabCreate waits here until the test answers it. */
+export const pendingCreates: Deferred[] = []
+
+export function installRuntimeTransport(): ReturnType<typeof vi.fn> {
+  pendingCreates.length = 0
+  const call = vi.fn(
+    (request: { method: string; params: Deferred['params'] }) =>
+      new Promise((resolve, reject) => {
+        if (request.method === 'browser.tabCreate') {
+          pendingCreates.push({
+            params: request.params,
+            resolve: (browserPageId = request.params.page) => {
+              if (browserPageId) {
+                hostPages.push(browserPageId)
+              }
+              resolve({ id: 'create', ok: true, result: { browserPageId } })
+            },
+            reject
+          })
+          return
+        }
+        resolve({ id: request.method, ok: true, result: { closed: true } })
+      })
+  )
+  vi.stubGlobal('window', {
+    api: {
+      runtimeEnvironments: {
+        call,
+        prepareBrowserClientHostPlacement: vi.fn().mockResolvedValue({ kind: 'server' })
+      }
+    }
+  })
+  return call
+}
+
+export function groupOrder(groupId: string): string[] {
+  return useAppStore.getState().groupsByWorktree[WT]?.find((g) => g.id === groupId)?.tabOrder ?? []
+}
+
+export function wrapperForRemotePage(remotePageId: string): Tab | undefined {
+  const state = useAppStore.getState()
+  const workspace = (state.browserTabsByWorktree[WT] ?? []).find((candidate) =>
+    (state.browserPagesByWorkspace[candidate.id] ?? []).some(
+      (candidatePage) =>
+        state.remoteBrowserPageHandlesByPageId[candidatePage.id]?.remotePageId === remotePageId
+    )
+  )
+  return (state.unifiedTabsByWorktree[WT] ?? []).find(
+    (tab) => tab.contentType === 'browser' && tab.entityId === workspace?.id
+  )
+}
+
+export async function flushMicrotasks(): Promise<void> {
+  for (let index = 0; index < 20; index += 1) {
+    await Promise.resolve()
+  }
+}
diff --git a/src/renderer/src/runtime/web-runtime-browser-creation-placement.test.ts b/src/renderer/src/runtime/web-runtime-browser-creation-placement.test.ts
new file mode 100644
index 000000000000..45cd7433da8f
--- /dev/null
+++ b/src/renderer/src/runtime/web-runtime-browser-creation-placement.test.ts
@@ -0,0 +1,343 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type * as SnapshotModule from './web-runtime-session-snapshot'
+import { useAppStore } from '../store'
+import { createWebRuntimeSessionBrowserTab } from './web-runtime-browser-creation'
+import { resetWebSessionBrowserPlacementsForTests } from './web-session-browser-placement'
+import { resetWebSessionTabsSyncTestState, ENV, WT } from './web-session-tabs-sync-test-harness'
+import {
+  AFTER,
+  G1,
+  G2,
+  HOST,
+  OTHER,
+  SOURCE,
+  flushMicrotasks,
+  groupOrder,
+  hostPages,
+  installRuntimeTransport,
+  pendingCreates,
+  publishHostSnapshot,
+  resetHostPages,
+  runtimeStatusesFor,
+  seedPairedWorktree,
+  wrapperForRemotePage
+} from './web-runtime-browser-creation-placement-test-rig'
+
+vi.mock('./web-runtime-session-snapshot', async (importOriginal) => ({
+  ...(await importOriginal<typeof SnapshotModule>()),
+  refreshWebRuntimeSessionTabsSnapshot: vi.fn(async () => publishHostSnapshot())
+}))
+
+function openLinkFromSource(
+  overrides: Partial<Parameters<typeof createWebRuntimeSessionBrowserTab>[0]> = {}
+): Promise<boolean> {
+  return createWebRuntimeSessionBrowserTab({
+    worktreeId: WT,
+    environmentId: ENV,
+    url: 'https://example.com/link',
+    clientAfterTabId: SOURCE.unifiedTabId,
+    focusOnCreate: false,
+    selectWorktree: false,
+    placementPreference: 'server',
+    ...overrides
+  })
+}
+
+function g1Group() {
+  return useAppStore.getState().groupsByWorktree[WT]?.find((group) => group.id === G1)
+}
+
+describe('paired browser creation placement', () => {
+  let runtimeCall: ReturnType<typeof installRuntimeTransport>
+
+  beforeEach(() => {
+    resetWebSessionTabsSyncTestState()
+    resetWebSessionBrowserPlacementsForTests()
+    resetHostPages()
+    seedPairedWorktree()
+    runtimeCall = installRuntimeTransport()
+  })
+
+  afterEach(() => {
+    vi.unstubAllGlobals()
+  })
+
+  it('stages each background link after its source before any await and keeps source, 3, 2, 1', async () => {
+    const creates = [openLinkFromSource(), openLinkFromSource(), openLinkFromSource()]
+    const staged = pendingCreates.map((create) => create.params.page ?? '')
+    // Why no await above: the rows exist off the synchronous part of each call.
+    const stagedIds = staged.map((pageId) => wrapperForRemotePage(pageId)!.id)
+    expect(groupOrder(G1)).toEqual([
+      SOURCE.unifiedTabId,
+      stagedIds[2],
+      stagedIds[1],
+      stagedIds[0],
+      AFTER.unifiedTabId
+    ])
+
+    for (const index of [2, 0, 1]) {
+      pendingCreates[index].resolve()
+      await flushMicrotasks()
+    }
+    await expect(Promise.all(creates)).resolves.toEqual([true, true, true])
+
+    expect(groupOrder(G1)).toEqual([
+      SOURCE.unifiedTabId,
+      stagedIds[2],
+      stagedIds[1],
+      stagedIds[0],
+      AFTER.unifiedTabId
+    ])
+    for (const pageId of staged) {
+      expect(wrapperForRemotePage(pageId)?.lastFocusedAt).toBeUndefined()
+    }
+    const state = useAppStore.getState()
+    expect(g1Group()).toMatchObject({
+      activeTabId: SOURCE.unifiedTabId,
+      recentTabIds: [SOURCE.unifiedTabId]
+    })
+    expect(state.activeGroupIdByWorktree[WT]).toBe(G2)
+    expect(state.activeBrowserTabIdByWorktree[WT]).toBe(OTHER.workspaceId)
+    expect(
+      state.unifiedTabsByWorktree[WT]?.find((tab) => tab.id === SOURCE.unifiedTabId)?.lastFocusedAt
+    ).toBeDefined()
+    // Repeated snapshots neither replay the anchor nor manufacture visits.
+    publishHostSnapshot()
+    expect(groupOrder(G1)[1]).toBe(stagedIds[2])
+    expect(g1Group()?.recentTabIds).toEqual([SOURCE.unifiedTabId])
+  })
+
+  it('keeps the host-facing RPC free of the client anchor', async () => {
+    void openLinkFromSource({ targetGroupId: 'host-group' })
+    expect(pendingCreates[0].params).not.toHaveProperty('clientAfterTabId')
+    expect(pendingCreates[0].params).not.toHaveProperty('afterTabId')
+    expect(pendingCreates[0].params).toMatchObject({
+      targetGroupId: 'host-group',
+      activate: false,
+      navigation: 'caller'
+    })
+    // A host-facing group never freezes the anchored staged row out of the source's group.
+    expect(groupOrder(G1)[1]).toBe(wrapperForRemotePage(pendingCreates[0].params.page!)?.id)
+    expect(wrapperForRemotePage(pendingCreates[0].params.page!)?.executionHostId).toBe(HOST)
+    pendingCreates[0].resolve()
+    await flushMicrotasks()
+    expect(runtimeCall).toHaveBeenCalledTimes(1)
+  })
+
+  it('appends Group New Browser Tab staging to the invoking group without an anchor', async () => {
+    const create = createWebRuntimeSessionBrowserTab({
+      worktreeId: WT,
+      environmentId: ENV,
+      url: 'about:blank',
+      targetGroupId: G1,
+      clientTargetGroupId: G1,
+      placementPreference: 'server'
+    })
+    const pageId = pendingCreates[0].params.page!
+    const created = wrapperForRemotePage(pageId)!.id
+    expect(groupOrder(G1)).toEqual([SOURCE.unifiedTabId, AFTER.unifiedTabId, created])
+    expect(useAppStore.getState().activeGroupIdByWorktree[WT]).toBe(G1)
+    pendingCreates[0].resolve()
+    await expect(create).resolves.toBe(true)
+    expect(groupOrder(G1)).toEqual([SOURCE.unifiedTabId, AFTER.unifiedTabId, created])
+  })
+
+  it('stages the store Group New Browser Tab command before its first await', async () => {
+    useAppStore.setState({
+      browserDefaultUrl: 'about:blank',
+      repos: [
+        {
+          id: 'repo',
+          path: '/repo',
+          displayName: 'Repo',
+          badgeColor: '#000000',
+          addedAt: 1,
+          connectionId: null,
+          executionHostId: HOST
+        }
+      ],
+      worktreesByRepo: {
+        repo: [
+          {
+            id: WT,
+            repoId: 'repo',
+            path: '/worktree',
+            head: 'abc',
+            branch: 'main',
+            isBare: false,
+            isMainWorktree: false,
+            displayName: 'Worktree',
+            comment: '',
+            linkedIssue: null,
+            linkedPR: null,
+            linkedLinearIssue: null,
+            isArchived: false,
+            isUnread: false,
+            isPinned: false,
+            sortOrder: 0,
+            lastActivityAt: 1
+          }
+        ]
+      }
+    })
+    const open = useAppStore.getState().openNewBrowserTabInActiveWorkspace(G1)
+    const order = groupOrder(G1)
+    expect(order.slice(0, 2)).toEqual([SOURCE.unifiedTabId, AFTER.unifiedTabId])
+    expect(order).toHaveLength(3)
+    const created = order[2]
+    await flushMicrotasks()
+    expect(pendingCreates[0].params).toMatchObject({ targetGroupId: G1 })
+    expect(wrapperForRemotePage(pendingCreates[0].params.page!)?.id).toBe(created)
+    pendingCreates[0].resolve()
+    await open
+    expect(groupOrder(G1)).toEqual([SOURCE.unifiedTabId, AFTER.unifiedTabId, created])
+  })
+
+  it('fills an empty group structurally without adoption recording a visit', async () => {
+    const state = useAppStore.getState()
+    useAppStore.setState({
+      groupsByWorktree: {
+        [WT]: [
+          ...state.groupsByWorktree[WT]!,
+          { id: 'group-3', worktreeId: WT, activeTabId: null, tabOrder: [], recentTabIds: [] }
+        ]
+      },
+      layoutByWorktree: {
+        [WT]: {
+          type: 'split',
+          direction: 'horizontal',
+          first: state.layoutByWorktree[WT]!,
+          second: { type: 'leaf', groupId: 'group-3' }
+        }
+      }
+    })
+    const create = createWebRuntimeSessionBrowserTab({
+      worktreeId: WT,
+      environmentId: ENV,
+      url: 'https://example.com/',
+      clientTargetGroupId: 'group-3',
+      focusOnCreate: false,
+      selectWorktree: false,
+      placementPreference: 'server'
+    })
+    const created = wrapperForRemotePage(pendingCreates[0].params.page!)!.id
+    pendingCreates[0].resolve()
+    await expect(create).resolves.toBe(true)
+    publishHostSnapshot()
+    expect(
+      useAppStore.getState().groupsByWorktree[WT]?.find((group) => group.id === 'group-3')
+    ).toMatchObject({ activeTabId: created, tabOrder: [created], recentTabIds: [] })
+    expect(useAppStore.getState().activeGroupIdByWorktree[WT]).toBe(G2)
+  })
+
+  it('keeps a staged row the user dragged elsewhere through adoption', async () => {
+    const create = openLinkFromSource()
+    const pageId = pendingCreates[0].params.page!
+    const staged = wrapperForRemotePage(pageId)!.id
+    useAppStore.getState().moveUnifiedTabToGroup(staged, G2)
+    pendingCreates[0].resolve()
+    await expect(create).resolves.toBe(true)
+    expect(groupOrder(G2)).toContain(staged)
+    expect(groupOrder(G1)).toEqual([SOURCE.unifiedTabId, AFTER.unifiedTabId])
+  })
+
+  it('does not reclaim focus after the user selects another tab mid-create', async () => {
+    const create = openLinkFromSource({ focusOnCreate: true })
+    const staged = wrapperForRemotePage(pendingCreates[0].params.page!)!.id
+    expect(g1Group()?.activeTabId).toBe(staged)
+    useAppStore.getState().activateTab(OTHER.unifiedTabId)
+    useAppStore.getState().activateTab(SOURCE.unifiedTabId)
+    pendingCreates[0].resolve()
+    await expect(create).resolves.toBe(true)
+    publishHostSnapshot()
+    expect(g1Group()?.activeTabId).toBe(SOURCE.unifiedTabId)
+    expect(useAppStore.getState().activeWorktreeId).toBe(WT)
+  })
+
+  it('stages before a deferred hosting preparation resolves', async () => {
+    let answerPreparation!: (placement: { kind: 'server' }) => void
+    const prepare = vi.fn(
+      () =>
+        new Promise<{ kind: 'server' }>((resolve) => {
+          answerPreparation = resolve
+        })
+    )
+    vi.stubGlobal('window', {
+      api: {
+        runtimeEnvironments: { call: runtimeCall, prepareBrowserClientHostPlacement: prepare }
+      }
+    })
+    const create = openLinkFromSource({ placementPreference: 'auto' })
+    const stagedRows = groupOrder(G1)
+    expect(stagedRows).toHaveLength(3)
+    useAppStore.getState().focusGroup(WT, G2)
+    await flushMicrotasks()
+    answerPreparation({ kind: 'server' })
+    await flushMicrotasks()
+    pendingCreates[0].resolve()
+    await expect(create).resolves.toBe(true)
+    expect(groupOrder(G1)).toEqual(stagedRows)
+    expect(useAppStore.getState().activeGroupIdByWorktree[WT]).toBe(G2)
+  })
+
+  it('rehomes a staged row in place when an older host answers with its own id first', async () => {
+    useAppStore.setState({
+      runtimeStatusByEnvironmentId: runtimeStatusesFor(['browser.screencast.v1'])
+    })
+    const create = openLinkFromSource()
+    const staged = groupOrder(G1)[1]
+    expect(pendingCreates[0].params.page).toBeUndefined()
+    pendingCreates[0].resolve('host-minted-page')
+    await expect(create).resolves.toBe(true)
+    expect(groupOrder(G1)).toEqual([SOURCE.unifiedTabId, staged, AFTER.unifiedTabId])
+    expect(wrapperForRemotePage('host-minted-page')?.id).toBe(staged)
+  })
+
+  it('keeps the mirrored row and discards the stage when an older host mirrors first', async () => {
+    useAppStore.setState({
+      runtimeStatusByEnvironmentId: runtimeStatusesFor(['browser.screencast.v1'])
+    })
+    const create = openLinkFromSource()
+    const staged = groupOrder(G1)[1]
+    hostPages.push('host-minted-page')
+    publishHostSnapshot()
+    hostPages.pop()
+    pendingCreates[0].resolve('host-minted-page')
+    await expect(create).resolves.toBe(true)
+    const mirrored = wrapperForRemotePage('host-minted-page')!
+    const browserRows = useAppStore
+      .getState()
+      .unifiedTabsByWorktree[WT]!.filter((tab) => tab.contentType === 'browser')
+    expect(browserRows).toHaveLength(4)
+    expect(mirrored.id).not.toBe(staged)
+    expect(groupOrder(G1)).not.toContain(staged)
+    // Compatibility limit: exact adjacency is not replayed onto the mirrored row.
+    publishHostSnapshot()
+    expect(useAppStore.getState().unifiedTabsByWorktree[WT]).toHaveLength(4)
+  })
+
+  it('falls back to ordinary adoption without adjacency when staging fails', async () => {
+    const createBrowserTab = useAppStore.getState().createBrowserTab
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+    useAppStore.setState({
+      createBrowserTab: () => {
+        throw new Error('staging refused')
+      }
+    })
+    try {
+      const create = openLinkFromSource()
+      expect(groupOrder(G1)).toEqual([SOURCE.unifiedTabId, AFTER.unifiedTabId])
+      useAppStore.setState({ createBrowserTab })
+      pendingCreates[0].resolve()
+      await expect(create).resolves.toBe(true)
+      const adopted = wrapperForRemotePage(pendingCreates[0].params.page!)
+      expect(adopted).toBeDefined()
+      expect(
+        useAppStore.getState().unifiedTabsByWorktree[WT]!.filter((tab) => tab.id === adopted!.id)
+      ).toHaveLength(1)
+      expect(groupOrder(G1).indexOf(adopted!.id)).not.toBe(1)
+    } finally {
+      warn.mockRestore()
+    }
+  })
+})
diff --git a/src/renderer/src/runtime/web-runtime-browser-creation.ts b/src/renderer/src/runtime/web-runtime-browser-creation.ts
index 99ad27d0adb5..abb119fe9159 100644
--- a/src/renderer/src/runtime/web-runtime-browser-creation.ts
+++ b/src/renderer/src/runtime/web-runtime-browser-creation.ts
@@ -16,6 +16,7 @@ import {
   completeWebRuntimeBrowserCreation,
   createWebRuntimeBrowserCreationContext,
   rehomeWebRuntimeBrowserCreation,
+  resolveWebRuntimeBrowserClientTargetGroupId,
   restageWebRuntimeBrowserCreation,
   stageWebRuntimeBrowserCreation,
   type CreateWebRuntimeSessionBrowserTabArgs
@@ -30,6 +31,7 @@ import {
 } from './web-runtime-browser-creation-e2e-fault'
 import { isWebRuntimeSessionActive } from './web-runtime-session-environment'
 import { refreshWebRuntimeSessionTabsSnapshot } from './web-runtime-session-snapshot'
+import { registerPairedBrowserTabCreator } from '../store/slices/browser/paired-browser-tab-creator'
 
 export async function createWebRuntimeSessionBrowserTab(
   args: CreateWebRuntimeSessionBrowserTabArgs
@@ -131,6 +133,11 @@ export async function createWebRuntimeSessionBrowserTab(
     if (created.browserPageId !== context.provisionalPageId) {
       rehomeWebRuntimeBrowserCreation(context, created.browserPageId)
     }
+    // Why: a staged row the user moved is judged where it renders now, not where it was requested.
+    const resolveExpectedGroupId = (): string | undefined =>
+      (context.staged
+        ? resolveStagedWebRuntimeBrowserTabGroupId(context.staged, args.worktreeId)
+        : undefined) ?? resolveWebRuntimeBrowserClientTargetGroupId(args)
     try {
       await refreshWebRuntimeSessionTabsSnapshot(environmentId, args.worktreeId, {
         expectedEnvironmentPairingRevision: context.intentOwner.pairingRevision,
@@ -145,18 +152,13 @@ export async function createWebRuntimeSessionBrowserTab(
           environmentId,
           args.worktreeId,
           created.browserPageId,
-          args.clientTargetGroupId ?? args.targetGroupId
+          resolveExpectedGroupId()
         )
       ) {
         throw error
       }
     }
-    const expectedGroupId =
-      (context.staged
-        ? resolveStagedWebRuntimeBrowserTabGroupId(context.staged, args.worktreeId)
-        : undefined) ??
-      args.clientTargetGroupId ??
-      args.targetGroupId
+    const expectedGroupId = resolveExpectedGroupId()
     let materialized = hasMaterializedWebRuntimeBrowserPage(
       useAppStore.getState(),
       environmentId,
@@ -253,3 +255,5 @@ export async function createWebRuntimeSessionBrowserTab(
     return finishWebRuntimeBrowserCreationFailure(context, failure, error)
   }
 }
+
+registerPairedBrowserTabCreator(createWebRuntimeSessionBrowserTab)
diff --git a/src/renderer/src/runtime/web-runtime-browser-tab-staging.ts b/src/renderer/src/runtime/web-runtime-browser-tab-staging.ts
index dee7bad23760..8a7259c41995 100644
--- a/src/renderer/src/runtime/web-runtime-browser-tab-staging.ts
+++ b/src/renderer/src/runtime/web-runtime-browser-tab-staging.ts
@@ -1,4 +1,5 @@
 import { useAppStore } from '../store'
+import { toRuntimeExecutionHostId } from '../../../shared/execution-host'
 
 /** Local rows minted for a browser tab whose host create RPC has not answered yet. */
 export type StagedWebRuntimeBrowserTab = {
@@ -21,6 +22,7 @@ export function stageWebRuntimeBrowserTab(args: {
   title?: string
   profileId?: string | null
   targetGroupId?: string
+  afterTabId?: string
   activate: boolean
   focusAddressBar?: boolean
   clientHosted?: boolean
@@ -31,6 +33,9 @@ export function stageWebRuntimeBrowserTab(args: {
       activate: args.activate,
       browserPageId: args.remotePageId,
       browserRuntimeEnvironmentId: args.environmentId,
+      // Why: the paired runtime owns this row; placement must not borrow the globally selected host.
+      executionHostId: toRuntimeExecutionHostId(args.environmentId),
+      ...(args.afterTabId ? { afterTabId: args.afterTabId } : {}),
       ...(args.title !== undefined ? { title: args.title } : {}),
       ...(args.profileId !== undefined && args.profileId !== null
         ? { sessionProfileId: args.profileId }
diff --git a/src/renderer/src/runtime/web-runtime-terminal-actions.ts b/src/renderer/src/runtime/web-runtime-terminal-actions.ts
index 5c4f7b607815..e12e99414927 100644
--- a/src/renderer/src/runtime/web-runtime-terminal-actions.ts
+++ b/src/renderer/src/runtime/web-runtime-terminal-actions.ts
@@ -197,6 +197,7 @@ export async function updateWebRuntimePaneLayout(args: {
   tabId: string
   root: TerminalPaneLayoutNode | null
   expandedLeafId: string | null
+  chatLeafId?: string | null
   titlesByLeafId?: Record<string, string>
 }): Promise<boolean> {
   const environmentId =
@@ -216,6 +217,7 @@ export async function updateWebRuntimePaneLayout(args: {
         tabId: hostTabId,
         root: args.root,
         expandedLeafId: args.expandedLeafId,
+        ...(args.chatLeafId !== undefined ? { chatLeafId: args.chatLeafId } : {}),
         ...(args.titlesByLeafId ? { titlesByLeafId: args.titlesByLeafId } : {})
       },
       timeoutMs: 15_000
diff --git a/src/renderer/src/runtime/web-session-client-owned-tab-placement.ts b/src/renderer/src/runtime/web-session-client-owned-tab-placement.ts
index 1df1f4df697c..564348a105d5 100644
--- a/src/renderer/src/runtime/web-session-client-owned-tab-placement.ts
+++ b/src/renderer/src/runtime/web-session-client-owned-tab-placement.ts
@@ -213,13 +213,18 @@ export function reconcileClientOwnedTabPlacement(
         : (group.activeTabId ?? tabOrder[0] ?? null))
     const validActiveTabId =
       activeTabId && tabOrder.includes(activeTabId) ? activeTabId : (tabOrder[0] ?? null)
+    const sanitizedRecent = sanitizeRecentTabIds(group.recentTabIds, tabOrder)
+    // Why: only explicit intent or a close/move successor is a visit; retaining the active tab or
+    // structurally filling an empty group must not reorder MRU.
+    const recordsVisit = validActiveTabId === intentActive || displacedActive !== null
     reconciled.push({
       ...group,
       tabOrder,
       activeTabId: validActiveTabId,
-      recentTabIds: validActiveTabId
-        ? pushRecentTabId(sanitizeRecentTabIds(group.recentTabIds, tabOrder), validActiveTabId)
-        : []
+      recentTabIds:
+        validActiveTabId && recordsVisit
+          ? pushRecentTabId(sanitizedRecent, validActiveTabId)
+          : sanitizedRecent
     })
   }
 
diff --git a/src/renderer/src/runtime/web-session-tabs-sync-browser-tabs.test.ts b/src/renderer/src/runtime/web-session-tabs-sync-browser-tabs.test.ts
index 7bdcc7f37bb1..b90b06b61067 100644
--- a/src/renderer/src/runtime/web-session-tabs-sync-browser-tabs.test.ts
+++ b/src/renderer/src/runtime/web-session-tabs-sync-browser-tabs.test.ts
@@ -493,44 +493,45 @@ describe('applyWebSessionTabsSnapshot', () => {
       groupId: previewGroupId
     })
 
+    const state = makeState({
+      groupsByWorktree: {
+        [WT]: [
+          {
+            id: editorGroupId,
+            worktreeId: WT,
+            activeTabId: 'local-editor',
+            tabOrder: ['local-editor']
+          },
+          {
+            id: previewGroupId,
+            worktreeId: WT,
+            activeTabId: null,
+            tabOrder: []
+          }
+        ]
+      },
+      layoutByWorktree: { [WT]: initialLayout },
+      unifiedTabsByWorktree: {
+        [WT]: [
+          {
+            id: 'local-editor',
+            worktreeId: WT,
+            groupId: editorGroupId,
+            contentType: 'editor',
+            entityId: 'local-file',
+            label: 'example.html',
+            sortOrder: 0,
+            createdAt: NOW,
+            isPreview: false,
+            isPinned: false,
+            customLabel: null,
+            color: null
+          }
+        ]
+      }
+    })
     const patch = applyWebSessionTabsSnapshot(
-      makeState({
-        groupsByWorktree: {
-          [WT]: [
-            {
-              id: editorGroupId,
-              worktreeId: WT,
-              activeTabId: 'local-editor',
-              tabOrder: ['local-editor']
-            },
-            {
-              id: previewGroupId,
-              worktreeId: WT,
-              activeTabId: null,
-              tabOrder: []
-            }
-          ]
-        },
-        layoutByWorktree: { [WT]: initialLayout },
-        unifiedTabsByWorktree: {
-          [WT]: [
-            {
-              id: 'local-editor',
-              worktreeId: WT,
-              groupId: editorGroupId,
-              contentType: 'editor',
-              entityId: 'local-file',
-              label: 'example.html',
-              sortOrder: 0,
-              createdAt: NOW,
-              isPreview: false,
-              isPinned: false,
-              customLabel: null,
-              color: null
-            }
-          ]
-        }
-      }),
+      state,
       makeSnapshot([], {
         activeTabType: null,
         tabGroups: [{ id: editorGroupId, activeTabId: null, tabOrder: [], recentTabIds: [] }],
@@ -538,9 +539,11 @@ describe('applyWebSessionTabsSnapshot', () => {
       }),
       ENV,
       NOW
-    ) as Partial<WebSessionTabsSyncState>
+    )
+    // An omitted groups patch means the snapshot left every group as it was.
+    const groups = patch.groupsByWorktree?.[WT] ?? state.groupsByWorktree[WT]
 
-    expect(patch.groupsByWorktree?.[WT]?.map((group) => group.id)).toContain(previewGroupId)
+    expect(groups?.map((group) => group.id)).toContain(previewGroupId)
     expect(layoutHasGroup(patch.layoutByWorktree?.[WT] ?? initialLayout, previewGroupId)).toBe(true)
   })
 
diff --git a/src/renderer/src/runtime/web-session-tabs-sync-client-owned-placement.test.ts b/src/renderer/src/runtime/web-session-tabs-sync-client-owned-placement.test.ts
index cfe0154a9322..dd076a20fb08 100644
--- a/src/renderer/src/runtime/web-session-tabs-sync-client-owned-placement.test.ts
+++ b/src/renderer/src/runtime/web-session-tabs-sync-client-owned-placement.test.ts
@@ -241,15 +241,13 @@ describe('client-owned tab placement for paired worktrees', () => {
       groupId: PREVIEW_GROUP
     })
 
-    const patch = applyWebSessionTabsSnapshot(
-      splitClientState(),
-      ambientSplitSnapshot(),
-      ENV,
-      NOW
-    ) as Partial<WebSessionTabsSyncState>
+    const state = splitClientState()
+    const patch = applyWebSessionTabsSnapshot(state, ambientSplitSnapshot(), ENV, NOW)
+    // An omitted groups patch means the snapshot left every group as it was.
+    const next = { ...state, ...patch }
 
-    expect(groupById(patch, HOST_GROUP)?.activeTabId).toBe(T2)
-    expect(groupById(patch, PREVIEW_GROUP)?.activeTabId).toBe(BROWSER_HOST_TAB)
+    expect(groupById(next, HOST_GROUP)?.activeTabId).toBe(T2)
+    expect(groupById(next, PREVIEW_GROUP)?.activeTabId).toBe(BROWSER_HOST_TAB)
   })
 
   it('keeps the client-focused group focused across repeated ambient snapshots', () => {
diff --git a/src/renderer/src/runtime/web-session-tabs-sync-remote-main-agent-verdict.test.ts b/src/renderer/src/runtime/web-session-tabs-sync-remote-main-agent-verdict.test.ts
new file mode 100644
index 000000000000..4a0f0c09070e
--- /dev/null
+++ b/src/renderer/src/runtime/web-session-tabs-sync-remote-main-agent-verdict.test.ts
@@ -0,0 +1,112 @@
+/**
+ * A paired client mirrors a host's agent rows from `session.tabs`. A main agent that fails while
+ * its subagents keep the row working changes nothing but `mainAgent`: the row's state, start and
+ * (within one host frame) update time all stay put. The mirror must still take the new row and
+ * invalidate the worktree rollup, which caches on the agent-status epoch.
+ */
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { RuntimeMobileSessionTabsResult } from '../../../shared/runtime-types'
+import type { AgentMainAgentStatus } from '../../../shared/main-agent-status'
+import { makePaneKey } from '../../../shared/stable-pane-id'
+import { toWebTerminalSurfaceTabId } from '../../../shared/terminal-surface-id'
+import { getDefaultSettings } from '../../../shared/constants'
+import { createTestStore, makeWorktree, seedStore } from '../store/slices/store-test-helpers'
+import { resetRendererOwnedAgentStatusPanesForTests } from '../components/terminal-pane/renderer-owned-agent-status-registry'
+import {
+  applyFreshWebSessionTabsSnapshot,
+  resetWebSessionTabsSnapshotFreshnessForTests
+} from './web-session-tabs-sync'
+import { selectWorktreeAgentActivitySummary } from '../components/sidebar/worktree-agent-activity-summary'
+
+// Why: web-session-tabs-sync imports the app-level store singleton; this
+// harness drives a createTestStore instance instead, like its sibling suites.
+vi.mock('../store', () => ({
+  useAppStore: {
+    setState: vi.fn(),
+    getState: vi.fn(() => ({})),
+    subscribe: vi.fn(() => () => {})
+  }
+}))
+
+const WT = 'repo1::/path/wt1'
+const ENV = 'remote-env-1'
+const T0 = 1_700_000_000_000
+const HOST_TAB_ID = 'host-tab-1'
+const LEAF_ID = '11111111-1111-4111-8111-111111111111'
+
+function hostSnapshot(snapshotVersion: number, mainAgent: AgentMainAgentStatus) {
+  const snapshot: RuntimeMobileSessionTabsResult = {
+    worktree: WT,
+    publicationEpoch: 'host-epoch-1',
+    snapshotVersion,
+    activeGroupId: 'host-group-1',
+    activeTabId: `${HOST_TAB_ID}::${LEAF_ID}`,
+    activeTabType: 'terminal',
+    tabs: [
+      {
+        type: 'terminal',
+        id: `${HOST_TAB_ID}::${LEAF_ID}`,
+        title: 'Claude Code',
+        parentTabId: HOST_TAB_ID,
+        leafId: LEAF_ID,
+        isActive: true,
+        launchAgent: 'claude',
+        status: 'ready',
+        terminal: 'terminal-1',
+        agentStatus: {
+          state: 'working',
+          prompt: 'ship it',
+          updatedAt: T0 - 1_000,
+          stateStartedAt: T0 - 5_000,
+          agentType: 'claude',
+          paneKey: makePaneKey(HOST_TAB_ID, LEAF_ID),
+          tabId: HOST_TAB_ID,
+          worktreeId: WT,
+          stateHistory: [],
+          mainAgent
+        }
+      }
+    ]
+  }
+  return snapshot
+}
+
+describe('a mirrored main agent that fails while its subagents keep the row working', () => {
+  beforeEach(() => {
+    vi.useFakeTimers()
+    vi.setSystemTime(T0)
+    resetWebSessionTabsSnapshotFreshnessForTests()
+    resetRendererOwnedAgentStatusPanesForTests()
+  })
+
+  afterEach(() => {
+    vi.useRealTimers()
+    resetRendererOwnedAgentStatusPanesForTests()
+  })
+
+  it('reaches the store and the worktree rollup', () => {
+    const store = createTestStore()
+    seedStore(store, {
+      settings: getDefaultSettings('/tmp'),
+      worktreesByRepo: { repo1: [makeWorktree({ id: WT, repoId: 'repo1', path: '/path/wt1' })] },
+      activeWorktreeId: WT
+    })
+    const apply = (snapshot: RuntimeMobileSessionTabsResult): void => {
+      store.setState(applyFreshWebSessionTabsSnapshot(store.getState(), snapshot, ENV, T0))
+    }
+
+    apply(hostSnapshot(1, { state: 'working', stateStartedAt: T0 - 5_000 }))
+    expect(selectWorktreeAgentActivitySummary(store.getState(), WT)).toMatchObject({
+      hasLiveWorking: true,
+      hasFailed: false
+    })
+
+    apply(hostSnapshot(2, { state: 'done', outcome: 'failure', stateStartedAt: T0 - 2_000 }))
+    const paneKey = makePaneKey(toWebTerminalSurfaceTabId(HOST_TAB_ID), LEAF_ID)
+    expect(store.getState().agentStatusByPaneKey[paneKey]?.mainAgent?.outcome).toBe('failure')
+    expect(selectWorktreeAgentActivitySummary(store.getState(), WT)).toMatchObject({
+      hasLiveWorking: false,
+      hasFailed: true
+    })
+  })
+})
diff --git a/src/renderer/src/runtime/web-session-tabs-sync/agent-status-patch.ts b/src/renderer/src/runtime/web-session-tabs-sync/agent-status-patch.ts
index e68958ec6bd4..e6166f809f75 100644
--- a/src/renderer/src/runtime/web-session-tabs-sync/agent-status-patch.ts
+++ b/src/renderer/src/runtime/web-session-tabs-sync/agent-status-patch.ts
@@ -3,6 +3,7 @@ import {
   type AgentStatusEntry
 } from '../../../../shared/agent-status-types'
 import { agentEntryCompletionAt } from '../../../../shared/agent-completion-time'
+import { agentMainAgentVerdict } from '../../../../shared/agent-main-agent-verdict'
 import { normalizeCompatibleAgentStatusEntryForOwner } from '../../../../shared/agent-title-owner'
 import { isWebTerminalSurfaceTabId, toWebTerminalSurfaceTabId } from '../web-runtime-session'
 import type { TerminalTab } from '../../../../shared/terminal-tab-types'
@@ -221,6 +222,9 @@ export function buildMirroredAgentStatusPatch(
       entry.state === 'done' &&
       agentEntryCompletionAt(existing) !== agentEntryCompletionAt(entry)
     const workingModeChanged = existing?.workingMode !== entry.workingMode
+    // A verdict moves no clock, including a main agent failing while its subagents keep the row working.
+    const verdictChanged =
+      !!existing && agentMainAgentVerdict(existing) !== agentMainAgentVerdict(entry)
     const entrySortRelevantChange =
       !existing ||
       existing.state !== entry.state ||
@@ -230,7 +234,7 @@ export function buildMirroredAgentStatusPatch(
       doneAttentionChanged ||
       isMirroredCommandCodeTurnBump(existing, entry)
     aggregateRelevantChange =
-      aggregateRelevantChange || entrySortRelevantChange || workingModeChanged
+      aggregateRelevantChange || entrySortRelevantChange || workingModeChanged || verdictChanged
     sortRelevantChange = sortRelevantChange || entrySortRelevantChange
   }
 
diff --git a/src/renderer/src/runtime/web-session-tabs-sync/mirrored-status-tab-retractions.test.ts b/src/renderer/src/runtime/web-session-tabs-sync/mirrored-status-tab-retractions.test.ts
index 975703fe6b54..31303c0ad869 100644
--- a/src/renderer/src/runtime/web-session-tabs-sync/mirrored-status-tab-retractions.test.ts
+++ b/src/renderer/src/runtime/web-session-tabs-sync/mirrored-status-tab-retractions.test.ts
@@ -66,8 +66,25 @@ it('does not retract a colliding tab id owned by another host', () => {
   const tabId = toWebTerminalSurfaceTabId('same-tab')
   const paneKey = makePaneKey(tabId, LEAF_ID)
   state.agentStatusByPaneKey[paneKey] = {
-    paneKey, tabId, worktreeId: 'folder:1', connectionId: 'host-b', agentType: 'omp', state: 'done', prompt: '', updatedAt: NOW, stateStartedAt: NOW, stateHistory: []
+    paneKey,
+    tabId,
+    worktreeId: 'folder:1',
+    connectionId: 'host-b',
+    agentType: 'omp',
+    state: 'done',
+    prompt: '',
+    updatedAt: NOW,
+    stateStartedAt: NOW,
+    stateHistory: []
   }
   setHostSessionTabIdMapping({ environmentId: 'host-a', worktreeId: 'folder:1', tabId }, 'same-tab')
-  expect(collectUnhydratedMirroredTabRetractions({ state, environmentId: 'host-a', worktreeId: 'folder:1', nextHostTerminalTabIds: new Set(), currentTerminalIds: new Set() })).toEqual([])
+  expect(
+    collectUnhydratedMirroredTabRetractions({
+      state,
+      environmentId: 'host-a',
+      worktreeId: 'folder:1',
+      nextHostTerminalTabIds: new Set(),
+      currentTerminalIds: new Set()
+    })
+  ).toEqual([])
 })
diff --git a/src/renderer/src/runtime/web-session-tabs-sync/mirrored-status-tab-retractions.ts b/src/renderer/src/runtime/web-session-tabs-sync/mirrored-status-tab-retractions.ts
index 1f971225a4c8..bc956b9fbfc9 100644
--- a/src/renderer/src/runtime/web-session-tabs-sync/mirrored-status-tab-retractions.ts
+++ b/src/renderer/src/runtime/web-session-tabs-sync/mirrored-status-tab-retractions.ts
@@ -36,7 +36,8 @@ export function collectUnhydratedMirroredTabRetractions(args: {
     if (
       entry?.worktreeId === args.worktreeId &&
       (entry.connectionId === args.environmentId ||
-        (args.environmentId === 'local' && (entry.connectionId === null || entry.connectionId === undefined))) &&
+        (args.environmentId === 'local' &&
+          (entry.connectionId === null || entry.connectionId === undefined))) &&
       tabId &&
       candidates.has(tabId)
     ) {
diff --git a/src/renderer/src/runtime/web-session-tabs-sync/state-equality-core.test.ts b/src/renderer/src/runtime/web-session-tabs-sync/state-equality-core.test.ts
new file mode 100644
index 000000000000..ae51553ea7bb
--- /dev/null
+++ b/src/renderer/src/runtime/web-session-tabs-sync/state-equality-core.test.ts
@@ -0,0 +1,27 @@
+import { describe, expect, it } from 'vitest'
+import type { AgentStateHistoryEntry } from '../../../../shared/agent-status-types'
+import { sameAgentStateHistory } from './state-equality-core'
+
+function doneEntry(mainAgent?: AgentStateHistoryEntry['mainAgent']): AgentStateHistoryEntry {
+  return { state: 'done', prompt: 'ship it', startedAt: 1_000, ...(mainAgent ? { mainAgent } : {}) }
+}
+
+describe('sameAgentStateHistory', () => {
+  it('sees a history verdict or main agent clock change under an unchanged flag', () => {
+    const failed = doneEntry({ state: 'done', outcome: 'failure', stateStartedAt: 900 })
+    expect(sameAgentStateHistory([failed], [{ ...failed }])).toBe(true)
+    expect(sameAgentStateHistory([doneEntry()], [failed])).toBe(false)
+    expect(
+      sameAgentStateHistory(
+        [failed],
+        [doneEntry({ state: 'done', outcome: 'success', stateStartedAt: 900 })]
+      )
+    ).toBe(false)
+    expect(
+      sameAgentStateHistory(
+        [failed],
+        [doneEntry({ state: 'done', outcome: 'failure', stateStartedAt: 950 })]
+      )
+    ).toBe(false)
+  })
+})
diff --git a/src/renderer/src/runtime/web-session-tabs-sync/state-equality-core.ts b/src/renderer/src/runtime/web-session-tabs-sync/state-equality-core.ts
index 42345db35d0a..197fb6981375 100644
--- a/src/renderer/src/runtime/web-session-tabs-sync/state-equality-core.ts
+++ b/src/renderer/src/runtime/web-session-tabs-sync/state-equality-core.ts
@@ -4,6 +4,7 @@ import {
   type AgentStatusEntry
 } from '../../../../shared/agent-status-types'
 import { agentProviderSessionsEqual } from '../../../../shared/agent-session-resume'
+import { mainAgentStatusEqual } from '../../../../shared/main-agent-status'
 import type {
   WebSessionTabsBatchContext,
   WebSessionTabsBatchRecordKey,
@@ -29,7 +30,8 @@ export function sameAgentStateHistory(
       entry.state === b[index]?.state &&
       entry.prompt === b[index]?.prompt &&
       entry.startedAt === b[index]?.startedAt &&
-      entry.interrupted === b[index]?.interrupted
+      entry.interrupted === b[index]?.interrupted &&
+      mainAgentStatusEqual(entry.mainAgent, b[index]?.mainAgent)
   )
 }
 
@@ -57,6 +59,7 @@ export function agentStatusEntryEqual(
     a.lastAssistantMessage === b.lastAssistantMessage &&
     a.lastAssistantMessageIsToolOutput === b.lastAssistantMessageIsToolOutput &&
     a.interrupted === b.interrupted &&
+    mainAgentStatusEqual(a.mainAgent, b.mainAgent) &&
     a.promptInteractionKey === b.promptInteractionKey &&
     a.restoredUnconfirmed === b.restoredUnconfirmed &&
     agentProviderSessionsEqual(a.agentType, a.providerSession, b.providerSession) &&
diff --git a/src/renderer/src/runtime/web-session-tabs-sync/tab-builders.ts b/src/renderer/src/runtime/web-session-tabs-sync/tab-builders.ts
index bc1dc6d83b17..6c5f394d9a58 100644
--- a/src/renderer/src/runtime/web-session-tabs-sync/tab-builders.ts
+++ b/src/renderer/src/runtime/web-session-tabs-sync/tab-builders.ts
@@ -56,8 +56,12 @@ export function buildBrowserUnifiedTab(
     label: tab.title,
     customLabel: null,
     color: hostTab.color !== undefined ? hostTab.color : (existingUnifiedTab?.color ?? null),
-    sortOrder: tab.createdAt,
+    // Why: adoption must not reset the staged row's placement or manufacture/drop a focus visit.
+    sortOrder: existingUnifiedTab?.sortOrder ?? tab.createdAt,
     createdAt: tab.createdAt,
+    ...(existingUnifiedTab?.lastFocusedAt !== undefined
+      ? { lastFocusedAt: existingUnifiedTab.lastFocusedAt }
+      : {}),
     isPreview: false,
     isPinned:
       hostTab.isPinned !== undefined
diff --git a/src/renderer/src/runtime/web-session-tabs-sync/terminal-surfaces.ts b/src/renderer/src/runtime/web-session-tabs-sync/terminal-surfaces.ts
index 7c76129ae9ed..8810af4b9331 100644
--- a/src/renderer/src/runtime/web-session-tabs-sync/terminal-surfaces.ts
+++ b/src/renderer/src/runtime/web-session-tabs-sync/terminal-surfaces.ts
@@ -200,6 +200,12 @@ export function chooseRemoteTerminalLayout(
       : parentLayout?.expandedLeafId && knownLeafIds.has(parentLayout.expandedLeafId)
         ? parentLayout.expandedLeafId
         : null
+  const chatLeafId =
+    parentLayout?.chatLeafId && knownLeafIds.has(parentLayout.chatLeafId)
+      ? parentLayout.chatLeafId
+      : existingLayout?.chatLeafId && knownLeafIds.has(existingLayout.chatLeafId)
+        ? existingLayout.chatLeafId
+        : undefined
   // Why retained: this rebuilds the layout from the host's picture, and the host publishes no
   // scrollback of its own — a parked remote pane's bytes live only in the client's copy. Without
   // this, ANY inventory frame landing between park and reveal drops the only copy: the rebuild is
@@ -219,6 +225,7 @@ export function chooseRemoteTerminalLayout(
     }),
     activeLeafId,
     expandedLeafId,
+    ...(chatLeafId ? { chatLeafId } : {}),
     ptyIdsByLeafId,
     // Why: surface.title is the tab/PTY label, not a pane title; restoring it as one renders a fake title bar. Only host layout titles are real pane titles.
     ...(parentLayout?.titlesByLeafId ? { titlesByLeafId: parentLayout.titlesByLeafId } : {})
diff --git a/src/renderer/src/runtime/web-session-tabs-sync/tracking-mappings.ts b/src/renderer/src/runtime/web-session-tabs-sync/tracking-mappings.ts
index 83f8633f253b..ed6ba998a1e9 100644
--- a/src/renderer/src/runtime/web-session-tabs-sync/tracking-mappings.ts
+++ b/src/renderer/src/runtime/web-session-tabs-sync/tracking-mappings.ts
@@ -73,3 +73,20 @@ export function hostSessionTabIdsByLocalTabForWorktree(
   }
   return entries
 }
+
+/** The local tab mirroring a host tab, or null when no mirrored tab claims it. */
+export function resolveLocalTabIdForHostSessionTab(args: {
+  environmentId: string
+  worktreeId: string
+  hostTabId: string
+}): string | null {
+  for (const [tabId, hostTabId] of hostSessionTabIdsByLocalTabForWorktree(
+    args.environmentId,
+    args.worktreeId
+  )) {
+    if (hostTabId === args.hostTabId) {
+      return tabId
+    }
+  }
+  return null
+}
diff --git a/src/renderer/src/startup/startup-degraded-recovery.test.ts b/src/renderer/src/startup/startup-degraded-recovery.test.ts
new file mode 100644
index 000000000000..a3f0fb44f261
--- /dev/null
+++ b/src/renderer/src/startup/startup-degraded-recovery.test.ts
@@ -0,0 +1,74 @@
+// @vitest-environment happy-dom
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+vi.mock('sonner', () => ({ toast: { error: vi.fn() } }))
+vi.mock('../components/terminal/terminal-provider-snapshot-capability', () => ({
+  collectTerminalProviderSnapshotPtyIds: () => [],
+  refreshTerminalProviderSnapshotCapabilities: async () => undefined
+}))
+vi.mock('../store', async () => {
+  const { create } = await import('zustand')
+  const useAppStore = create(() => ({
+    startupWorktreeRefreshCompleted: false,
+    terminalStartupRestorationReady: false,
+    workspaceSessionReady: false
+  }))
+  return { useAppStore }
+})
+
+import { useAppStore } from '../store'
+import { recoverFromDegradedStartup } from './startup-degraded-recovery'
+
+function recover(args: {
+  isCancelled: () => boolean
+  reconnectPersistedTerminals: () => Promise<void>
+}): Promise<void> {
+  return recoverFromDegradedStartup({
+    error: new Error('hydration failed'),
+    uiHydrated: true,
+    reconnectStarted: false,
+    hydratePersistedUI: vi.fn(),
+    abortSignal: new AbortController().signal,
+    ...args
+  })
+}
+
+describe('recoverFromDegradedStartup', () => {
+  beforeEach(() => {
+    vi.spyOn(console, 'error').mockImplementation(() => undefined)
+    useAppStore.setState({ terminalStartupRestorationReady: false, workspaceSessionReady: false })
+    Object.defineProperty(window, 'api', {
+      configurable: true,
+      value: {
+        app: {
+          awaitFirstWindowStartupServices: async () => undefined,
+          recoverLegacyWorkerTerminalsForRendererStartup: async () => undefined,
+          relaunch: vi.fn()
+        }
+      }
+    })
+  })
+
+  it('releases terminal startup restoration once the degraded reconnect succeeds', async () => {
+    await recover({
+      isCancelled: () => false,
+      reconnectPersistedTerminals: async () => {
+        useAppStore.setState({ workspaceSessionReady: true })
+      }
+    })
+
+    expect(useAppStore.getState().terminalStartupRestorationReady).toBe(true)
+  })
+
+  it('leaves the flag to the newer pass when this one was cancelled mid-reconnect', async () => {
+    let cancelled = false
+    await recover({
+      isCancelled: () => cancelled,
+      reconnectPersistedTerminals: async () => {
+        cancelled = true
+      }
+    })
+
+    expect(useAppStore.getState().terminalStartupRestorationReady).toBe(false)
+  })
+})
diff --git a/src/renderer/src/startup/startup-degraded-recovery.ts b/src/renderer/src/startup/startup-degraded-recovery.ts
index 987a74a8341e..c5570af27173 100644
--- a/src/renderer/src/startup/startup-degraded-recovery.ts
+++ b/src/renderer/src/startup/startup-degraded-recovery.ts
@@ -93,6 +93,11 @@ export async function recoverFromDegradedStartup(args: DegradedStartupRecoveryAr
     )
     await reconnectPersistedTerminals(abortSignal)
     await window.api.app.recoverLegacyWorkerTerminalsForRendererStartup()
+    // Why: reconnect set workspaceSessionReady but not this flag, which the success chain sets
+    // last; without it a degraded boot keeps every restoration reader waiting for good.
+    if (!isCancelled()) {
+      useAppStore.setState({ terminalStartupRestorationReady: true })
+    }
   } catch (reconnectErr) {
     console.error('[startup] reconnectPersistedTerminals failed in error path:', reconnectErr)
     // Why (issue #1158): the await may have run during StrictMode teardown; re-check cancellation so a cancelled pass 1 doesn't stomp pass 2's hydration.
diff --git a/src/renderer/src/store/folder-workspaces/folder-workspace-catalog-actions.ts b/src/renderer/src/store/folder-workspaces/folder-workspace-catalog-actions.ts
index a5636882ea5a..83678c50946f 100644
--- a/src/renderer/src/store/folder-workspaces/folder-workspace-catalog-actions.ts
+++ b/src/renderer/src/store/folder-workspaces/folder-workspace-catalog-actions.ts
@@ -13,6 +13,7 @@ import {
   mergeFetchedFolderWorkspaceCatalog
 } from './folder-workspace-catalog'
 import { listRuntimeEnvironmentsForAllHostLoad } from '../runtime-catalog-hosts'
+import { reuseEqualRecordMap } from '../slices/repo-identity-reconcile'
 import { getFolderWorkspaceUpdateCoordinator } from './folder-workspace-mutations'
 
 export function createFolderWorkspaceCatalogActions(
@@ -47,11 +48,12 @@ export function createFolderWorkspaceCatalogActions(
             current.folderWorkspaces,
             current.projectGroups
           )
+          if (arrayElementsUnchanged(folderWorkspaces, current.folderWorkspaces)) {
+            return current
+          }
           return {
             folderWorkspaces,
-            ...(arrayElementsUnchanged(folderWorkspaces, current.folderWorkspaces)
-              ? {}
-              : { folderWorkspacePathStatuses: {} })
+            folderWorkspacePathStatuses: {}
           }
         })
       } catch (err) {
@@ -85,11 +87,12 @@ export function createFolderWorkspaceCatalogActions(
             current.folderWorkspaces,
             current.projectGroups
           )
+          if (arrayElementsUnchanged(folderWorkspaces, current.folderWorkspaces)) {
+            return current
+          }
           return {
             folderWorkspaces,
-            ...(arrayElementsUnchanged(folderWorkspaces, current.folderWorkspaces)
-              ? {}
-              : { folderWorkspacePathStatuses: {} })
+            folderWorkspacePathStatuses: {}
           }
         })
       }
@@ -130,12 +133,22 @@ export function createFolderWorkspaceCatalogActions(
         })
       )
       if (!failed) {
-        set((s) => ({
-          restoredRuntimeHostIdByWorkspaceSessionKey: clearRestoredFolderWorkspaceSessionOwners(
+        set((s) => {
+          // Why reuseEqualRecordMap: the cleanup rebuilds the record every refresh, and
+          // reference-equality readers (live dashboard selector, popout bridge) re-run on a
+          // fresh-but-equal identity, so the equal case must keep the previous one.
+          const restoredRuntimeHostIdByWorkspaceSessionKey = reuseEqualRecordMap(
             s.restoredRuntimeHostIdByWorkspaceSessionKey,
-            s
+            clearRestoredFolderWorkspaceSessionOwners(
+              s.restoredRuntimeHostIdByWorkspaceSessionKey,
+              s
+            )
           )
-        }))
+          return restoredRuntimeHostIdByWorkspaceSessionKey ===
+            s.restoredRuntimeHostIdByWorkspaceSessionKey
+            ? s
+            : { restoredRuntimeHostIdByWorkspaceSessionKey }
+        })
       }
     }
   }
diff --git a/src/renderer/src/store/github/cache-persistence.test.ts b/src/renderer/src/store/github/cache-persistence.test.ts
new file mode 100644
index 000000000000..70f21372dabe
--- /dev/null
+++ b/src/renderer/src/store/github/cache-persistence.test.ts
@@ -0,0 +1,64 @@
+import { setImmediate } from 'node:timers/promises'
+import { afterEach, beforeEach, expect, it, vi } from 'vitest'
+import { createTestStore } from '../slices/store-test-helpers'
+import { debouncedSaveCache } from './cache-persistence'
+
+const setGitHub = vi.fn()
+
+beforeEach(() => {
+  vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout'] })
+  setGitHub.mockReset()
+  vi.stubGlobal('window', { api: { cache: { setGitHub } } })
+})
+
+afterEach(() => {
+  vi.clearAllTimers()
+  vi.useRealTimers()
+  vi.unstubAllGlobals()
+})
+
+it('releases unrelated discarded renderer state while the cache save is pending', async () => {
+  const store = createTestStore()
+  const schedule = () => {
+    const drafts = { closedFile: Buffer.alloc(8 * 1024 * 1024, 65).toString('utf8') }
+    const state = { ...store.getState(), editorDrafts: drafts }
+    debouncedSaveCache(state)
+    return { state: new WeakRef(state), drafts: new WeakRef(drafts) }
+  }
+  const discarded = schedule()
+  if (!global.gc) {
+    throw new Error('config/vitest.config.ts must pass --expose-gc')
+  }
+  for (let turn = 0; turn < 3; turn += 1) {
+    await setImmediate()
+    global.gc()
+  }
+
+  expect(setGitHub).not.toHaveBeenCalled()
+  expect(discarded.state.deref() === undefined).toBe(true)
+  expect(discarded.drafts.deref() === undefined).toBe(true)
+  vi.advanceTimersByTime(1000)
+  expect(setGitHub).toHaveBeenCalledOnce()
+})
+
+it('persists the latest requested cache maps once after the trailing second', () => {
+  const state = createTestStore().getState()
+  const first = { ...state, prCache: {}, issueCache: {} }
+  const latest = { ...state, prCache: {}, issueCache: {} }
+  debouncedSaveCache(first)
+  vi.advanceTimersByTime(999)
+  expect(setGitHub).not.toHaveBeenCalled()
+
+  debouncedSaveCache(latest)
+  vi.advanceTimersByTime(999)
+  expect(setGitHub).not.toHaveBeenCalled()
+  vi.advanceTimersByTime(1)
+  expect(setGitHub).toHaveBeenCalledOnce()
+  expect(setGitHub.mock.calls[0][0]).toEqual({
+    cache: { pr: latest.prCache, issue: latest.issueCache }
+  })
+  expect(setGitHub.mock.calls[0][0].cache.pr).toBe(latest.prCache)
+  expect(setGitHub.mock.calls[0][0].cache.issue).toBe(latest.issueCache)
+  vi.advanceTimersByTime(1000)
+  expect(setGitHub).toHaveBeenCalledOnce()
+})
diff --git a/src/renderer/src/store/github/cache-persistence.ts b/src/renderer/src/store/github/cache-persistence.ts
index 06337e94a11f..10c0c67ef135 100644
--- a/src/renderer/src/store/github/cache-persistence.ts
+++ b/src/renderer/src/store/github/cache-persistence.ts
@@ -5,12 +5,14 @@ let saveTimer: ReturnType<typeof setTimeout> | null = null
 /** Schedules the renderer's single trailing GitHub cache persistence write. */
 export function debouncedSaveCache(state: AppState): void {
   clearTimeout(saveTimer ?? undefined)
+  // Keep unrelated renderer state out of the pending timer's closure.
+  const { prCache, issueCache } = state
   saveTimer = setTimeout(() => {
     saveTimer = null
     window.api.cache.setGitHub({
       cache: {
-        pr: state.prCache,
-        issue: state.issueCache
+        pr: prCache,
+        issue: issueCache
       }
     })
   }, 1000)
diff --git a/src/renderer/src/store/github/check-actions.ts b/src/renderer/src/store/github/check-actions.ts
index d29a3720d380..51b9a891f1c8 100644
--- a/src/renderer/src/store/github/check-actions.ts
+++ b/src/renderer/src/store/github/check-actions.ts
@@ -12,7 +12,11 @@ import {
 } from './cache-identity'
 import { isFresh, withBoundedCacheEntry } from './cache-policy'
 import { debouncedSaveCache } from './cache-persistence'
-import { inflightChecksRequests } from './request-coordination'
+import {
+  inflightChecksRequests,
+  nextProviderRequestId,
+  ownsInflightRequest
+} from './request-coordination'
 import { getGitHubRepoSourceSettings, getGitHubWorkItemRequestContext } from './work-item-routing'
 
 export const createCheckActions = (
@@ -87,18 +91,26 @@ export const createCheckActions = (
       return cachedChecks
     }
 
-    const inflightRequest = inflightChecksRequests.get(inflightKey)
-    if (inflightRequest) {
-      if (
-        (options?.force && !inflightRequest.force) ||
-        (options?.noCache && !inflightRequest.noCache)
-      ) {
-        await inflightRequest.promise.catch(() => {})
-      } else {
+    let waitedForUpgrade = false
+    for (;;) {
+      const inflightRequest = inflightChecksRequests.get(inflightKey)
+      if (!inflightRequest) {
+        break
+      }
+      const weakerThanRequested =
+        (options?.force && !inflightRequest.force) || (options?.noCache && !inflightRequest.noCache)
+      if (!weakerThanRequested) {
         return inflightRequest.promise
       }
+      // Why: wait out one weaker request so peers can share the upgrade, but never twice — a steady stream of weaker callers would otherwise starve this one forever.
+      if (waitedForUpgrade) {
+        break
+      }
+      waitedForUpgrade = true
+      await inflightRequest.promise.catch(() => {})
     }
 
+    const requestId = nextProviderRequestId()
     const request = (async () => {
       try {
         const requestContext = getGitHubWorkItemRequestContext(
@@ -131,6 +143,12 @@ export const createCheckActions = (
                 noCache: Boolean(options?.force || options?.noCache),
                 sourceContext: options?.sourceContext
               })) as PRCheckDetail[])
+        // Why: the bounded upgrade wait can leave us running beside a stronger request for this
+        // key. Both bypass gh's cache here, but the later-started one holds the newer run state —
+        // let only the key's current owner write checksCache and the PR status it derives.
+        if (!ownsInflightRequest(inflightChecksRequests, inflightKey, requestId)) {
+          return checks
+        }
         set((s) => {
           const nextState: Partial<AppState> = {
             checksCache: withBoundedCacheEntry(s.checksCache, cacheKey, {
@@ -168,13 +186,16 @@ export const createCheckActions = (
           return latestCached.data
         }
         return []
-      } finally {
+      }
+    })().finally(() => {
+      if (ownsInflightRequest(inflightChecksRequests, inflightKey, requestId)) {
         inflightChecksRequests.delete(inflightKey)
       }
-    })()
+    })
 
     inflightChecksRequests.set(inflightKey, {
       promise: request,
+      requestId,
       force: Boolean(options?.force),
       noCache: Boolean(options?.force || options?.noCache)
     })
diff --git a/src/renderer/src/store/github/project-actions.ts b/src/renderer/src/store/github/project-actions.ts
index f4c5fec3100c..68fc2b0a37a5 100644
--- a/src/renderer/src/store/github/project-actions.ts
+++ b/src/renderer/src/store/github/project-actions.ts
@@ -18,6 +18,8 @@ import { withBoundedCacheEntry, WORK_ITEMS_CACHE_TTL } from './cache-policy'
 import {
   acquireProviderRequestSlot as acquireWorkItemSlot,
   inflightProjectViewRequests,
+  nextProviderRequestId,
+  ownsInflightRequest,
   releaseProviderRequestSlot as releaseWorkItemSlot
 } from './request-coordination'
 import {
@@ -57,16 +59,25 @@ export const createProjectActions = (
       }
     }
 
-    const existing = inflightProjectViewRequests.get(requestKey)
-    if (existing) {
+    let waitedForUpgrade = false
+    for (;;) {
+      const existing = inflightProjectViewRequests.get(requestKey)
+      if (!existing) {
+        break
+      }
       // Why: a forcing caller must not dedupe to a non-forcing in-flight request; wait for it to settle, then issue a fresh forced call (mirrors fetchWorkItems).
-      if (options?.force && !existing.force) {
-        await existing.promise.catch(() => {})
-      } else {
+      if (!options?.force || existing.force) {
         return existing.promise
       }
+      // Why: wait out one weaker request so peers can share the upgrade, but never twice — a steady stream of weaker callers would otherwise starve this one forever.
+      if (waitedForUpgrade) {
+        break
+      }
+      waitedForUpgrade = true
+      await existing.promise.catch(() => {})
     }
 
+    const requestId = nextProviderRequestId()
     const request = (async (): Promise<GetProjectViewTableResult> => {
       await acquireWorkItemSlot()
       try {
@@ -79,6 +90,12 @@ export const createProjectActions = (
                 { timeoutMs: 60_000 }
               )
             : await window.api.gh.getProjectViewTable(args)
+        // Why: the bounded upgrade wait can leave us running beside a stronger request for this
+        // key, so neither write below may land once it owns the key — a late non-OK reply would
+        // otherwise stamp its error over the fresher table (or over a newer error) at the known key.
+        if (!ownsInflightRequest(inflightProjectViewRequests, requestKey, requestId)) {
+          return envelope
+        }
         if (envelope.ok) {
           const table = envelope.data
           const key = projectViewCacheKey(
@@ -119,12 +136,16 @@ export const createProjectActions = (
         }
       } finally {
         releaseWorkItemSlot()
+      }
+    })().finally(() => {
+      if (ownsInflightRequest(inflightProjectViewRequests, requestKey, requestId)) {
         inflightProjectViewRequests.delete(requestKey)
       }
-    })()
+    })
 
     inflightProjectViewRequests.set(requestKey, {
       promise: request,
+      requestId,
       force: Boolean(options?.force)
     })
     return request
diff --git a/src/renderer/src/store/github/provider-request-coalescing.test.ts b/src/renderer/src/store/github/provider-request-coalescing.test.ts
new file mode 100644
index 000000000000..f012999ce65d
--- /dev/null
+++ b/src/renderer/src/store/github/provider-request-coalescing.test.ts
@@ -0,0 +1,343 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type { GitHubWorkItem, ListWorkItemsResult } from '../../../../shared/github/work-item-types'
+import type { PRCheckDetail } from '../../../../shared/github/check-types'
+import type { GitHubProjectTable } from '../../../../shared/github/project-types'
+import type { GetProjectViewTableResult } from '../../../../shared/github/project-result-types'
+import type { FetchOptions } from './cache-model'
+import { projectViewCacheKey, projectViewRequestKey } from './cache-identity'
+import { inflightProjectViewRequests } from './request-coordination'
+import {
+  createTestStore,
+  mockApi,
+  resetRemoteRuntimeMocks
+} from '../slices/github-slice-test-harness'
+
+function workItems(title: string): ListWorkItemsResult<GitHubWorkItem> {
+  return {
+    items: [
+      {
+        id: 'issue-1',
+        type: 'issue',
+        number: 1,
+        title,
+        state: 'open',
+        url: 'https://example.test/1',
+        labels: [],
+        updatedAt: '2026-09-25T00:00:00Z',
+        author: null,
+        repoId: 'repo-1'
+      }
+    ],
+    sources: { issues: null, prs: null, originCandidate: null, upstreamCandidate: null }
+  }
+}
+
+const projectViewRequest = {
+  owner: 'acme',
+  ownerType: 'organization' as const,
+  projectNumber: 1,
+  viewId: 'view-1'
+}
+const projectViewCacheKey1 = projectViewCacheKey('organization', 'acme', 1, 'view-1')
+
+function projectTable(title: string): GitHubProjectTable {
+  return {
+    project: {
+      id: 'project-1',
+      owner: 'acme',
+      ownerType: 'organization',
+      number: 1,
+      title,
+      url: 'https://github.com/orgs/acme/projects/1'
+    },
+    selectedView: {
+      id: 'view-1',
+      number: 1,
+      name: 'Table',
+      layout: 'TABLE_LAYOUT',
+      filter: '',
+      fields: [],
+      groupByFields: [],
+      sortByFields: []
+    },
+    rows: [],
+    totalCount: 0,
+    parentFieldDropped: false
+  }
+}
+
+const strongerWorkItemOptions: FetchOptions[] = [
+  { force: true },
+  { force: true, noCache: true },
+  { force: true, requireComplete: true }
+]
+
+describe('GitHub provider request upgrade coalescing', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    resetRemoteRuntimeMocks()
+  })
+
+  it.each(strongerWorkItemOptions)('coalesces twenty work-item upgrades: %j', async (options) => {
+    const store = createTestStore()
+    const weak = Promise.withResolvers<ListWorkItemsResult<GitHubWorkItem>>()
+    const fresh = Promise.withResolvers<ListWorkItemsResult<GitHubWorkItem>>()
+    mockApi.gh.listWorkItems.mockReturnValueOnce(weak.promise).mockReturnValue(fresh.promise)
+    const first = store.getState().fetchWorkItems('repo-1', '/repo', 24, '')
+    const settled = vi.fn()
+    const followers = Array.from({ length: 20 }, () =>
+      store.getState().fetchWorkItems('repo-1', '/repo', 24, '', options).then(settled)
+    )
+    weak.resolve(workItems('weak'))
+    await first
+    await vi.waitFor(() =>
+      expect(mockApi.gh.listWorkItems.mock.calls.length).toBeGreaterThanOrEqual(2)
+    )
+    expect(settled).not.toHaveBeenCalled()
+    fresh.resolve(workItems('fresh'))
+    await Promise.all(followers)
+    expect(mockApi.gh.listWorkItems).toHaveBeenCalledTimes(2)
+    expect(settled).toHaveBeenCalledTimes(20)
+    expect(settled.mock.calls.every(([rows]) => rows[0].title === 'fresh')).toBe(true)
+    expect(mockApi.gh.listWorkItems).toHaveBeenLastCalledWith({
+      repoPath: '/repo',
+      repoId: 'repo-1',
+      limit: 24,
+      query: undefined,
+      ...(options.noCache ? { noCache: true } : {})
+    })
+  })
+
+  it('never joins a weaker replacement and never waits out more than one', async () => {
+    const store = createTestStore()
+    const weak = Promise.withResolvers<ListWorkItemsResult<GitHubWorkItem>>()
+    const forced = Promise.withResolvers<ListWorkItemsResult<GitHubWorkItem>>()
+    const strict = Promise.withResolvers<ListWorkItemsResult<GitHubWorkItem>>()
+    mockApi.gh.listWorkItems
+      .mockReturnValueOnce(weak.promise)
+      .mockReturnValueOnce(forced.promise)
+      .mockReturnValue(strict.promise)
+    const first = store.getState().fetchWorkItems('repo-1', '/repo', 24, '')
+    const forcedFetch = store.getState().fetchWorkItems('repo-1', '/repo', 24, '', { force: true })
+    const strictSettled = vi.fn()
+    const strictFollowers = Array.from({ length: 20 }, () =>
+      store
+        .getState()
+        .fetchWorkItems('repo-1', '/repo', 24, '', {
+          force: true,
+          noCache: true,
+          requireComplete: true
+        })
+        .then(strictSettled)
+    )
+    weak.resolve(workItems('weak'))
+    await first
+    // Why: the strict callers must reach the bridge without waiting out the weaker
+    // replacement too — the upgrade wait is bounded, so a repeating weaker refresh
+    // can never starve them. They still share exactly one strict request.
+    await vi.waitFor(() => expect(mockApi.gh.listWorkItems).toHaveBeenCalledTimes(3))
+    expect(mockApi.gh.listWorkItems).toHaveBeenLastCalledWith(
+      expect.objectContaining({ noCache: true })
+    )
+    expect(strictSettled).not.toHaveBeenCalled()
+    strict.resolve(workItems('strict'))
+    await Promise.all(strictFollowers)
+    forced.resolve(workItems('forced'))
+    await expect(forcedFetch).resolves.toEqual(workItems('forced').items)
+    expect(mockApi.gh.listWorkItems).toHaveBeenCalledTimes(3)
+    expect(strictSettled).toHaveBeenCalledTimes(20)
+    expect(strictSettled.mock.calls.every(([rows]) => rows[0].title === 'strict')).toBe(true)
+  })
+
+  it('keeps an invalidated request from removing its replacement dedupe entry', async () => {
+    const store = createTestStore()
+    const stale = Promise.withResolvers<ListWorkItemsResult<GitHubWorkItem>>()
+    const fresh = Promise.withResolvers<ListWorkItemsResult<GitHubWorkItem>>()
+    mockApi.gh.listWorkItems.mockReturnValueOnce(stale.promise).mockReturnValue(fresh.promise)
+    const first = store.getState().fetchWorkItems('repo-1', '/repo', 24, '')
+    store.getState().evictGitHubRepoCaches('repo-1', '/repo')
+    const replacement = store.getState().fetchWorkItems('repo-1', '/repo', 24, '', { force: true })
+    stale.resolve(workItems('stale'))
+    await first
+    const joined = store.getState().fetchWorkItems('repo-1', '/repo', 24, '', { force: true })
+    fresh.resolve(workItems('fresh'))
+    await expect(Promise.all([replacement, joined])).resolves.toEqual([
+      workItems('fresh').items,
+      workItems('fresh').items
+    ])
+    expect(mockApi.gh.listWorkItems).toHaveBeenCalledTimes(2)
+  })
+
+  it('rejects partial results for every complete-result waiter and allows a later retry', async () => {
+    const store = createTestStore()
+    const weak = Promise.withResolvers<ListWorkItemsResult<GitHubWorkItem>>()
+    const partial = {
+      ...workItems('partial'),
+      errors: { issues: { type: 'network_error' as const, message: 'offline' } }
+    }
+    mockApi.gh.listWorkItems.mockReturnValueOnce(weak.promise).mockResolvedValue(partial)
+    const first = store.getState().fetchWorkItems('repo-1', '/repo', 24, '')
+    const followers = Array.from({ length: 20 }, () =>
+      store.getState().fetchWorkItems('repo-1', '/repo', 24, '', {
+        force: true,
+        requireComplete: true
+      })
+    )
+    const settled = Promise.allSettled(followers)
+    weak.resolve(workItems('weak'))
+    await first
+    expect((await settled).every((result) => result.status === 'rejected')).toBe(true)
+    expect(mockApi.gh.listWorkItems).toHaveBeenCalledTimes(2)
+    mockApi.gh.listWorkItems.mockResolvedValue(workItems('recovered'))
+    await expect(
+      store.getState().fetchWorkItems('repo-1', '/repo', 24, '', {
+        force: true,
+        requireComplete: true
+      })
+    ).resolves.toEqual(workItems('recovered').items)
+    expect(mockApi.gh.listWorkItems).toHaveBeenCalledTimes(3)
+  })
+
+  it.each([{ force: true }, { noCache: true }])(
+    'coalesces twenty check upgrades: %j',
+    async (options) => {
+      const store = createTestStore()
+      const weak = Promise.withResolvers<PRCheckDetail[]>()
+      const fresh = Promise.withResolvers<PRCheckDetail[]>()
+      mockApi.gh.prChecks.mockReturnValueOnce(weak.promise).mockReturnValue(fresh.promise)
+      const first = store.getState().fetchPRChecks('/repo', 1, 'main', 'sha')
+      const settled = vi.fn()
+      const followers = Array.from({ length: 20 }, () =>
+        store.getState().fetchPRChecks('/repo', 1, 'main', 'sha', undefined, options).then(settled)
+      )
+      weak.resolve([])
+      await first
+      await vi.waitFor(() =>
+        expect(mockApi.gh.prChecks.mock.calls.length).toBeGreaterThanOrEqual(2)
+      )
+      expect(settled).not.toHaveBeenCalled()
+      const checks: PRCheckDetail[] = [
+        { name: 'fresh', status: 'completed', conclusion: 'success', url: null }
+      ]
+      fresh.resolve(checks)
+      await Promise.all(followers)
+      expect(mockApi.gh.prChecks).toHaveBeenCalledTimes(2)
+      expect(settled).toHaveBeenCalledTimes(20)
+      expect(settled.mock.calls.every(([rows]) => rows === checks)).toBe(true)
+    }
+  )
+
+  // Why: the bounded wait lets a force-only request (which still allows gh's own cache to answer)
+  // run beside a noCache one. Whichever settles last used to win the cache unconditionally.
+  it('keeps a late weaker work-item reply from burying the stronger result', async () => {
+    const store = createTestStore()
+    const weak = Promise.withResolvers<ListWorkItemsResult<GitHubWorkItem>>()
+    const forced = Promise.withResolvers<ListWorkItemsResult<GitHubWorkItem>>()
+    const strict = Promise.withResolvers<ListWorkItemsResult<GitHubWorkItem>>()
+    mockApi.gh.listWorkItems
+      .mockReturnValueOnce(weak.promise)
+      .mockReturnValueOnce(forced.promise)
+      .mockReturnValue(strict.promise)
+    const first = store.getState().fetchWorkItems('repo-1', '/repo', 24, '')
+    const forcedFetch = store.getState().fetchWorkItems('repo-1', '/repo', 24, '', { force: true })
+    const strictFetch = store
+      .getState()
+      .fetchWorkItems('repo-1', '/repo', 24, '', { force: true, noCache: true })
+    weak.resolve(workItems('weak'))
+    await first
+    await vi.waitFor(() => expect(mockApi.gh.listWorkItems).toHaveBeenCalledTimes(3))
+
+    strict.resolve(workItems('fresh'))
+    await expect(strictFetch).resolves.toEqual(workItems('fresh').items)
+    forced.resolve(workItems('gh-cached'))
+    await expect(forcedFetch).resolves.toEqual(workItems('gh-cached').items)
+
+    expect(store.getState().getCachedWorkItems('repo-1', 24, '', '/repo')).toEqual(
+      workItems('fresh').items
+    )
+    // Why: the stale payload must not be what isFresh hands back for the rest of the TTL either.
+    await expect(store.getState().fetchWorkItems('repo-1', '/repo', 24, '')).resolves.toEqual(
+      workItems('fresh').items
+    )
+    expect(mockApi.gh.listWorkItems).toHaveBeenCalledTimes(3)
+  })
+
+  it('keeps a superseded check reply from rewinding the cached run state', async () => {
+    const store = createTestStore()
+    const plain = Promise.withResolvers<PRCheckDetail[]>()
+    const noCacheOnly = Promise.withResolvers<PRCheckDetail[]>()
+    const forcedOnly = Promise.withResolvers<PRCheckDetail[]>()
+    mockApi.gh.prChecks
+      .mockReturnValueOnce(plain.promise)
+      .mockReturnValueOnce(noCacheOnly.promise)
+      .mockReturnValue(forcedOnly.promise)
+    const first = store.getState().fetchPRChecks('/repo', 1, 'main', 'sha')
+    // Why: force and noCache are incomparable, so each waits out the plain request and the second
+    // one then breaks out of the bounded wait while the first is still in flight.
+    const noCacheFetch = store
+      .getState()
+      .fetchPRChecks('/repo', 1, 'main', 'sha', undefined, { noCache: true })
+    const forcedFetch = store
+      .getState()
+      .fetchPRChecks('/repo', 1, 'main', 'sha', undefined, { force: true })
+    plain.resolve([])
+    await first
+    await vi.waitFor(() => expect(mockApi.gh.prChecks).toHaveBeenCalledTimes(3))
+
+    const newer: PRCheckDetail[] = [
+      { name: 'build', status: 'completed', conclusion: 'success', url: null }
+    ]
+    const older: PRCheckDetail[] = [
+      { name: 'build', status: 'in_progress', conclusion: null, url: null }
+    ]
+    forcedOnly.resolve(newer)
+    await expect(forcedFetch).resolves.toEqual(newer)
+    noCacheOnly.resolve(older)
+    await expect(noCacheFetch).resolves.toEqual(older)
+
+    expect(Object.values(store.getState().checksCache).map((entry) => entry.data)).toEqual([newer])
+  })
+
+  it('keeps a superseded project failure from stamping the known view key', async () => {
+    const store = createTestStore()
+    const weak = Promise.withResolvers<GetProjectViewTableResult>()
+    const replacementWeak = Promise.withResolvers<GetProjectViewTableResult>()
+    const forcedResult = Promise.withResolvers<GetProjectViewTableResult>()
+    mockApi.gh.getProjectViewTable
+      .mockReturnValueOnce(weak.promise)
+      .mockReturnValueOnce(replacementWeak.promise)
+      .mockReturnValue(forcedResult.promise)
+
+    const first = store.getState().fetchProjectViewTable(projectViewRequest)
+    const forcedFetch = store.getState().fetchProjectViewTable(projectViewRequest, { force: true })
+    // Why: only a non-forced entry can be superseded mid-flight, and it has to appear in the
+    // microtask after the first request clears the key — before the forced waiter re-checks it.
+    const pending = inflightProjectViewRequests.get(
+      projectViewRequestKey(projectViewRequest, 'local')
+    )
+    expect(pending).toBeDefined()
+    let replacementFetch: Promise<GetProjectViewTableResult> | undefined
+    void pending?.promise.then(() => {
+      replacementFetch = store.getState().fetchProjectViewTable(projectViewRequest)
+    })
+
+    const staleError = { type: 'network_error' as const, message: 'first attempt offline' }
+    weak.resolve({ ok: false, error: staleError })
+    await first
+    await vi.waitFor(() => expect(mockApi.gh.getProjectViewTable).toHaveBeenCalledTimes(3))
+    expect(store.getState().projectViewCache[projectViewCacheKey1]).toMatchObject({
+      error: staleError
+    })
+
+    forcedResult.resolve({ ok: true, data: projectTable('forced') })
+    await expect(forcedFetch).resolves.toEqual({ ok: true, data: projectTable('forced') })
+    const error = { type: 'network_error' as const, message: 'offline' }
+    replacementWeak.resolve({ ok: false, error })
+    await expect(replacementFetch).resolves.toEqual({ ok: false, error })
+
+    expect(store.getState().projectViewCache[projectViewCacheKey1]).toMatchObject({
+      data: projectTable('forced')
+    })
+    expect(store.getState().projectViewCache[projectViewCacheKey1].error).toBeUndefined()
+  })
+})
diff --git a/src/renderer/src/store/github/pull-request-actions.ts b/src/renderer/src/store/github/pull-request-actions.ts
index c9a43e075ac7..17852c1d57f9 100644
--- a/src/renderer/src/store/github/pull-request-actions.ts
+++ b/src/renderer/src/store/github/pull-request-actions.ts
@@ -9,6 +9,7 @@ import { prCacheKey } from './cache-identity'
 import { isFresh } from './cache-policy'
 import { buildGitHubPRRefreshStateClearToken } from './pr-refresh-state'
 import { githubHostedReviewFallbackPRNumber, prLookupHintKey } from './pr-result-routing'
+import { nextLookupGeneration } from '../lookup-generation-sequence'
 import { inflightPRRequests, prRequestGenerations } from './request-coordination'
 import { settingsForGitHubRepoOwner } from './work-item-routing'
 import {
@@ -113,7 +114,7 @@ export const createPullRequestActions = (
       return inflightRequest.promise
     }
 
-    const generation = (prRequestGenerations.get(cacheKey) ?? 0) + 1
+    const generation = nextLookupGeneration()
     const requestStartedAt = Date.now()
     const requestStartedHostedReviewEntry = get().hostedReviewCache[hostedReviewCacheKey]
     const requestStartedPRRefreshState = get().prRefreshStates[cacheKey]
diff --git a/src/renderer/src/store/github/request-coordination.ts b/src/renderer/src/store/github/request-coordination.ts
index fc6f3cb0b7c5..7aecfcd2b44b 100644
--- a/src/renderer/src/store/github/request-coordination.ts
+++ b/src/renderer/src/store/github/request-coordination.ts
@@ -13,31 +13,56 @@ export type InflightPR = {
 }
 export type InflightChecks = {
   promise: Promise<PRCheckDetail[]>
+  requestId: number
   force: boolean
   noCache: boolean
 }
 export type InflightWorkItems = {
   promise: Promise<readonly GitHubWorkItem[]>
+  requestId: number
   force: boolean
   noCache: boolean
   requireComplete: boolean
 }
+export type InflightProjectView = {
+  promise: Promise<GetProjectViewTableResult>
+  requestId: number
+  force: boolean
+}
 
 export const inflightPRRequests = new Map<string, InflightPR>()
 export const inflightIssueRequests = new Map<string, Promise<IssueInfo | null>>()
 export const inflightChecksRequests = new Map<string, InflightChecks>()
 export const inflightCommentsRequests = new Map<string, Promise<PRComment[]>>()
 export const inflightWorkItemsRequests = new Map<string, InflightWorkItems>()
-export const inflightProjectViewRequests = new Map<
-  string,
-  { promise: Promise<GetProjectViewTableResult>; force: boolean }
->()
+export const inflightProjectViewRequests = new Map<string, InflightProjectView>()
 export const prRequestGenerations = new Map<string, number>()
 export const prRefreshStartedHostedReviewEntries = new Map<
   string,
   AppState['hostedReviewCache'][string] | undefined
 >()
 
+let providerRequestSequence = 0
+
+/** Stamp identifying one provider request, captured before it awaits so it can recheck ownership after. */
+export function nextProviderRequestId(): number {
+  providerRequestSequence += 1
+  return providerRequestSequence
+}
+
+/**
+ * Why: the upgrade wait is bounded, so a stronger request can run beside a weaker one for the same
+ * key. Only the request the key currently resolves to may write that key's cache — otherwise a late
+ * weaker reply overwrites the stronger request's fresher result under a brand-new `fetchedAt`.
+ */
+export function ownsInflightRequest<T extends { requestId: number }>(
+  registry: ReadonlyMap<string, T>,
+  key: string,
+  requestId: number
+): boolean {
+  return registry.get(key)?.requestId === requestId
+}
+
 export function _getGitHubPRRequestGenerationCountForTest(): number {
   return prRequestGenerations.size
 }
diff --git a/src/renderer/src/store/github/work-item-fetch-actions.ts b/src/renderer/src/store/github/work-item-fetch-actions.ts
index 722556ee0ff4..5d865741931b 100644
--- a/src/renderer/src/store/github/work-item-fetch-actions.ts
+++ b/src/renderer/src/store/github/work-item-fetch-actions.ts
@@ -13,6 +13,8 @@ import { isFresh, withBoundedCacheEntry, WORK_ITEMS_CACHE_TTL } from './cache-po
 import {
   acquireProviderRequestSlot as acquireWorkItemSlot,
   inflightWorkItemsRequests,
+  nextProviderRequestId,
+  ownsInflightRequest,
   releaseProviderRequestSlot as releaseWorkItemSlot
 } from './request-coordination'
 import { findRepoForGitHubOwner } from './repository-routing'
@@ -109,20 +111,29 @@ export const createWorkItemFetchActions = (
       options?.sourceContext
     )
     const inflightKey = workItemsInflightRequestKey(key, requestContext.target)
-    const existing = inflightWorkItemsRequests.get(inflightKey)
-    if (existing) {
+    let waitedForUpgrade = false
+    for (;;) {
+      const existing = inflightWorkItemsRequests.get(inflightKey)
+      if (!existing) {
+        break
+      }
       // Why: a forcing/noCache caller must not dedupe to a weaker in-flight fetch (noCache is stricter — it must bypass gh api's cache too).
-      if (
+      const weakerThanRequested =
         (options?.force && !existing.force) ||
         (options?.noCache && !existing.noCache) ||
         (options?.requireComplete && !existing.requireComplete)
-      ) {
-        await existing.promise.catch(() => {})
-      } else {
+      if (!weakerThanRequested) {
         return existing.promise
       }
+      // Why: wait out one weaker request so peers can share the upgrade, but never twice — a steady stream of weaker callers would otherwise starve this one forever.
+      if (waitedForUpgrade) {
+        break
+      }
+      waitedForUpgrade = true
+      await existing.promise.catch(() => {})
     }
 
+    const requestId = nextProviderRequestId()
     const request = (async () => {
       await acquireWorkItemSlot()
       try {
@@ -163,6 +174,12 @@ export const createWorkItemFetchActions = (
         if (get().workItemsInvalidationNonce !== requestInvalidationNonce) {
           return items
         }
+        // Why: a stronger request may have replaced us on this key while we were awaiting (a
+        // force-only caller still lets gh's own cache answer), so writing here would bury its
+        // fresher rows under a new fetchedAt and keep isFresh serving them for the whole TTL.
+        if (!ownsInflightRequest(inflightWorkItemsRequests, inflightKey, requestId)) {
+          return items
+        }
         // Why: TaskPage useShallow-selects cache entry refs. A new { ...entry, fetchedAt }
         // still remaps every visible row. IPC structuredClone rebuilds nested records, so
         // data === previous.data never holds — reconcile structurally, then either mutate
@@ -220,12 +237,16 @@ export const createWorkItemFetchActions = (
         throw err
       } finally {
         releaseWorkItemSlot()
+      }
+    })().finally(() => {
+      if (ownsInflightRequest(inflightWorkItemsRequests, inflightKey, requestId)) {
         inflightWorkItemsRequests.delete(inflightKey)
       }
-    })()
+    })
 
     inflightWorkItemsRequests.set(inflightKey, {
       promise: request,
+      requestId,
       force: Boolean(options?.force),
       noCache: Boolean(options?.noCache),
       requireComplete: Boolean(options?.requireComplete)
diff --git a/src/renderer/src/store/lookup-generation-sequence.ts b/src/renderer/src/store/lookup-generation-sequence.ts
new file mode 100644
index 000000000000..c253b9d01840
--- /dev/null
+++ b/src/renderer/src/store/lookup-generation-sequence.ts
@@ -0,0 +1,22 @@
+/**
+ * Id source for the generation stamps that decide which in-flight lookup owns a
+ * cache key. One counter, allocated from for the life of the process, serves
+ * every cache and every coordinator that needs such a stamp.
+ *
+ * A coordinator that drops a key's generation entry once its newest lookup
+ * settles lets a per-key counter restart at 1 while an older lookup of the same
+ * key is still out: that straggler then reads as the current owner, publishes
+ * its stale answer, and tears down the live newer lookup's ownership so the
+ * fresh answer is dropped. Ids that are never reused remove the collision.
+ *
+ * Callers only ever compare stamps for equality, never order or magnitude, so a
+ * single shared sequence is safe no matter how many caches draw from it.
+ * Deliberately has no reset: rewinding it while a lookup is out recreates the
+ * very collision this exists to prevent.
+ */
+let lookupGenerationSequence = 0
+
+export function nextLookupGeneration(): number {
+  lookupGenerationSequence += 1
+  return lookupGenerationSequence
+}
diff --git a/src/renderer/src/store/plugin-language-packs-startup.test.ts b/src/renderer/src/store/plugin-language-packs-startup.test.ts
new file mode 100644
index 000000000000..6cb5a9c57114
--- /dev/null
+++ b/src/renderer/src/store/plugin-language-packs-startup.test.ts
@@ -0,0 +1,182 @@
+// @vitest-environment happy-dom
+
+import { StrictMode } from 'react'
+import { act, cleanup, renderHook } from '@testing-library/react'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { PluginChangeEvent } from '../../../shared/plugins/plugin-change-event'
+import {
+  pluginLanguageResourceId,
+  type PluginLanguagePackRegistration
+} from '../../../shared/plugins/plugin-language-pack-artifact'
+import type * as LanguagePackModule from './plugin-language-packs'
+
+let languagePacks: typeof LanguagePackModule
+
+function pack(name: string): PluginLanguagePackRegistration {
+  const id = `plugin:${name}` as const
+  return {
+    id,
+    resourceLanguage: pluginLanguageResourceId(id),
+    pluginKey: name,
+    locale: 'en',
+    catalog: {}
+  }
+}
+
+function installBridge() {
+  const requests: ReturnType<typeof Promise.withResolvers<PluginLanguagePackRegistration[]>>[] = []
+  const listLanguagePacks = vi.fn(() => {
+    const request = Promise.withResolvers<PluginLanguagePackRegistration[]>()
+    requests.push(request)
+    return request.promise
+  })
+  const listeners: ((event: PluginChangeEvent) => void)[] = []
+  const onChanged = vi.fn((listener: (event: PluginChangeEvent) => void) => {
+    listeners.push(listener)
+    return () => {}
+  })
+  vi.stubGlobal('api', { plugins: { listLanguagePacks, onChanged } })
+  return { requests, listLanguagePacks, onChanged, listeners }
+}
+
+beforeEach(async () => {
+  vi.resetModules()
+  languagePacks = await import('./plugin-language-packs')
+})
+
+afterEach(() => {
+  cleanup()
+  vi.unstubAllGlobals()
+})
+
+describe('plugin language-pack startup ownership', () => {
+  it.each([false, true])(
+    'shares one load across mounted consumers (StrictMode: %s)',
+    async (strict) => {
+      const bridge = installBridge()
+      const wrapper = strict ? StrictMode : undefined
+      const first = renderHook(() => languagePacks.usePluginLanguagePacks(), { wrapper })
+      const second = renderHook(() => languagePacks.usePluginLanguagePacks(), { wrapper })
+      const dispatches = bridge.listLanguagePacks.mock.calls.length
+      const result = [pack('startup')]
+      await act(async () => {
+        for (const request of bridge.requests) {
+          request.resolve(result)
+        }
+        await Promise.all(bridge.requests.map((request) => request.promise))
+      })
+      expect(dispatches).toBe(1)
+      expect(bridge.onChanged).toHaveBeenCalledTimes(1)
+      expect(first.result.current).toEqual(result)
+      expect(second.result.current).toBe(first.result.current)
+    }
+  )
+
+  it.each(['resolve', 'reject'] as const)(
+    'keeps a newer refresh pending after an older request %ss',
+    async (settlement) => {
+      const bridge = installBridge()
+      const store = languagePacks.usePluginLanguagePackStore
+      const older = store.getState().fetchPacks()
+      const newer = store.getState().fetchPacks()
+      if (settlement === 'resolve') {
+        bridge.requests[0].resolve([pack('old')])
+      } else {
+        bridge.requests[0].reject(new Error('old failure'))
+      }
+      await older
+      expect(store.getState().loaded).toBe(false)
+      languagePacks.ensurePluginLanguagePacksLoaded()
+      const dispatches = bridge.listLanguagePacks.mock.calls.length
+      for (const request of bridge.requests.slice(1)) {
+        request.resolve([pack('current')])
+      }
+      await newer
+      expect(dispatches).toBe(2)
+      expect(store.getState().packs).toEqual([pack('current')])
+    }
+  )
+
+  it('allows a content-change refresh to supersede startup while ignoring unrelated changes', async () => {
+    const bridge = installBridge()
+    languagePacks.ensurePluginLanguagePacksLoaded()
+    bridge.listeners[0]({ contentPacksChanged: false })
+    expect(bridge.listLanguagePacks).toHaveBeenCalledTimes(1)
+    bridge.listeners[0]({ contentPacksChanged: true })
+    expect(bridge.listLanguagePacks).toHaveBeenCalledTimes(2)
+    bridge.requests[1].resolve([pack('changed')])
+    await bridge.requests[1].promise
+    bridge.requests[0].resolve([pack('old')])
+    await bridge.requests[0].promise
+    languagePacks.ensurePluginLanguagePacksLoaded()
+    expect(bridge.listLanguagePacks).toHaveBeenCalledTimes(2)
+    expect(languagePacks.usePluginLanguagePackStore.getState().packs).toEqual([pack('changed')])
+  })
+
+  it('keeps the shared startup request alive after the first consumer unmounts', async () => {
+    const bridge = installBridge()
+    const first = renderHook(() => languagePacks.usePluginLanguagePacks())
+    first.unmount()
+    const second = renderHook(() => languagePacks.usePluginLanguagePacks())
+    const dispatches = bridge.listLanguagePacks.mock.calls.length
+    await act(async () => {
+      for (const request of bridge.requests) {
+        request.resolve([pack('retained')])
+      }
+      await Promise.all(bridge.requests.map((request) => request.promise))
+    })
+    expect(dispatches).toBe(1)
+    expect(second.result.current).toEqual([pack('retained')])
+  })
+
+  it('retries a wedged startup request instead of joining it for the session', async () => {
+    vi.useFakeTimers()
+    try {
+      const bridge = installBridge()
+      languagePacks.ensurePluginLanguagePacksLoaded()
+      // A request that is merely slow is shared, not duplicated.
+      vi.advanceTimersByTime(9_000)
+      languagePacks.ensurePluginLanguagePacksLoaded()
+      expect(bridge.listLanguagePacks).toHaveBeenCalledTimes(1)
+      // Past the join window it is wedged, so a later consumer must be able to make progress.
+      vi.advanceTimersByTime(2_000)
+      languagePacks.ensurePluginLanguagePacksLoaded()
+      expect(bridge.listLanguagePacks).toHaveBeenCalledTimes(2)
+      bridge.requests[1].resolve([pack('recovered')])
+      await vi.waitFor(() =>
+        expect(languagePacks.usePluginLanguagePackStore.getState().loaded).toBe(true)
+      )
+      expect(languagePacks.usePluginLanguagePackStore.getState().packs).toEqual([pack('recovered')])
+    } finally {
+      vi.useRealTimers()
+    }
+  })
+
+  it('retains fail-closed loading and permits an explicit retry after rejection', async () => {
+    const bridge = installBridge()
+    const store = languagePacks.usePluginLanguagePackStore
+    const failed = store.getState().fetchPacks()
+    bridge.requests[0].reject(new Error('bridge unavailable'))
+    await failed
+    expect(store.getState().loaded).toBe(true)
+    expect(store.getState().packs).toEqual([])
+    languagePacks.ensurePluginLanguagePacksLoaded()
+    expect(bridge.listLanguagePacks).toHaveBeenCalledTimes(1)
+    const retry = store.getState().fetchPacks()
+    bridge.requests[1].resolve([pack('retry')])
+    await retry
+    expect(store.getState().packs).toEqual([pack('retry')])
+  })
+
+  it('finishes without an older bridge API and admits a later explicit refresh', async () => {
+    vi.stubGlobal('api', {})
+    languagePacks.ensurePluginLanguagePacksLoaded()
+    expect(languagePacks.usePluginLanguagePackStore.getState().loaded).toBe(true)
+    const bridge = installBridge()
+    const refresh = languagePacks.usePluginLanguagePackStore.getState().fetchPacks()
+    bridge.requests[0].resolve([pack('available')])
+    await refresh
+    expect(bridge.listLanguagePacks).toHaveBeenCalledTimes(1)
+    expect(languagePacks.usePluginLanguagePackStore.getState().packs).toEqual([pack('available')])
+  })
+})
diff --git a/src/renderer/src/store/plugin-language-packs.ts b/src/renderer/src/store/plugin-language-packs.ts
index 7c37c53c9c8f..009ab459612c 100644
--- a/src/renderer/src/store/plugin-language-packs.ts
+++ b/src/renderer/src/store/plugin-language-packs.ts
@@ -11,7 +11,17 @@ type PluginLanguagePackState = {
   fetchPacks: () => Promise<void>
 }
 
+/**
+ * Joining the startup request saves a duplicate IPC round trip, but its handler awaits plugin
+ * discovery — a wedged one must not turn `ensurePluginLanguagePacksLoaded` into a no-op for the
+ * session, which would pin every consumer on built-in translations. Past this bound the pending
+ * request is wedged rather than slow, so a later consumer starts its own (mirrors the reasoning in
+ * `src/main/git/coalesced-probe.ts`).
+ */
+const STARTUP_REQUEST_JOIN_WINDOW_MS = 10_000
+
 let requestGeneration = 0
+let latestRequestStartedAt: number | null = null
 let changeSubscriptionStarted = false
 
 export const usePluginLanguagePackStore = create<PluginLanguagePackState>()((set) => ({
@@ -19,9 +29,11 @@ export const usePluginLanguagePackStore = create<PluginLanguagePackState>()((set
   loaded: false,
   fetchPacks: async () => {
     const generation = ++requestGeneration
+    latestRequestStartedAt = Date.now()
     const api = window.api?.plugins
     if (!api?.listLanguagePacks) {
       if (generation === requestGeneration) {
+        latestRequestStartedAt = null
         set({ packs: [], loaded: true })
       }
       return
@@ -44,13 +56,20 @@ export const usePluginLanguagePackStore = create<PluginLanguagePackState>()((set
       if (generation === requestGeneration) {
         set({ packs: [], loaded: true })
       }
+    } finally {
+      if (generation === requestGeneration) {
+        latestRequestStartedAt = null
+      }
     }
   }
 }))
 
 export function ensurePluginLanguagePacksLoaded(): void {
   const state = usePluginLanguagePackStore.getState()
-  if (!state.loaded) {
+  const joinable =
+    latestRequestStartedAt !== null &&
+    Date.now() - latestRequestStartedAt < STARTUP_REQUEST_JOIN_WINDOW_MS
+  if (!state.loaded && !joinable) {
     void state.fetchPacks()
   }
   if (!changeSubscriptionStarted && window.api?.plugins?.onChanged) {
diff --git a/src/renderer/src/store/project-groups/project-group-catalog-actions.ts b/src/renderer/src/store/project-groups/project-group-catalog-actions.ts
index c7841c85e0cd..d19ac185766e 100644
--- a/src/renderer/src/store/project-groups/project-group-catalog-actions.ts
+++ b/src/renderer/src/store/project-groups/project-group-catalog-actions.ts
@@ -32,11 +32,12 @@ export function createProjectGroupCatalogActions(
             return current
           }
           const { projectGroups } = mergeFetchedProjectGroupCatalog(catalog, current.projectGroups)
+          if (arrayElementsUnchanged(projectGroups, current.projectGroups)) {
+            return current
+          }
           return {
             projectGroups,
-            ...(arrayElementsUnchanged(projectGroups, current.projectGroups)
-              ? {}
-              : { folderWorkspacePathStatuses: {} })
+            folderWorkspacePathStatuses: {}
           }
         })
       } catch (err) {
@@ -55,11 +56,12 @@ export function createProjectGroupCatalogActions(
             return s
           }
           const { projectGroups } = mergeFetchedProjectGroupCatalog(catalog, s.projectGroups)
+          if (arrayElementsUnchanged(projectGroups, s.projectGroups)) {
+            return s
+          }
           return {
             projectGroups,
-            ...(arrayElementsUnchanged(projectGroups, s.projectGroups)
-              ? {}
-              : { folderWorkspacePathStatuses: {} })
+            folderWorkspacePathStatuses: {}
           }
         })
       }
diff --git a/src/renderer/src/store/slices/agent-status-authority-actions.ts b/src/renderer/src/store/slices/agent-status-authority-actions.ts
index 7382cc020f2e..2001f6587523 100644
--- a/src/renderer/src/store/slices/agent-status-authority-actions.ts
+++ b/src/renderer/src/store/slices/agent-status-authority-actions.ts
@@ -16,6 +16,7 @@ import {
   getTabIdFromPaneKey,
   isRecentlyClosedAgentStatusTab
 } from './agent-status-pane-key-tab-binding'
+import { createBrowserUuid } from '@/lib/browser-uuid'
 
 export function createAgentStatusAuthorityActions(
   runtime: AgentStatusRuntime
@@ -31,7 +32,7 @@ export function createAgentStatusAuthorityActions(
     scheduleAgentStatusFreshness: () => freshness.schedule(),
 
     retireAgentPaneAuthority: (paneKey, options) => {
-      const retirementId = crypto.randomUUID()
+      const retirementId = createBrowserUuid()
       const ownerPaneKey = resolveAgentPaneAuthorityKey(paneKey)
       const previousRetirement = get().recentlyRetiredAgentStatusPaneKeys[ownerPaneKey]
       const retiredPaneKeys = [
diff --git a/src/renderer/src/store/slices/agent-status-drop-actions.ts b/src/renderer/src/store/slices/agent-status-drop-actions.ts
index cff59fdc3296..12d6c9b62747 100644
--- a/src/renderer/src/store/slices/agent-status-drop-actions.ts
+++ b/src/renderer/src/store/slices/agent-status-drop-actions.ts
@@ -13,6 +13,7 @@ import {
   shouldReplaceRetainedWithLive
 } from './agent-status-pane-key-tab-binding'
 import { retireAgentPaneAuthorityAliasesByOwnerTab } from './agent-pane-authority'
+import { agentTurnStoppedByUser } from '../../../../shared/agent-main-agent-verdict'
 
 function removeAcknowledgement(
   acknowledgements: Record<string, number>,
@@ -162,7 +163,7 @@ export function createAgentStatusDropActions(
         if (
           liveEntry?.state === 'done' &&
           liveEntry.agentType !== undefined &&
-          liveEntry.interrupted !== true
+          !agentTurnStoppedByUser(liveEntry)
         ) {
           retainedEvidence.set(
             paneKey,
diff --git a/src/renderer/src/store/slices/agent-status-live-entry-state-history.ts b/src/renderer/src/store/slices/agent-status-live-entry-state-history.ts
index 6976b0b990bb..d1836ca137bc 100644
--- a/src/renderer/src/store/slices/agent-status-live-entry-state-history.ts
+++ b/src/renderer/src/store/slices/agent-status-live-entry-state-history.ts
@@ -3,6 +3,7 @@ import {
   type AgentStateHistoryEntry,
   type AgentStatusEntry
 } from '../../../../shared/agent-status-types'
+import { agentVerdictFields } from '../../../../shared/agent-main-agent-verdict'
 import type { AgentStatusPayload } from './agent-status-contract'
 
 /** The history a live entry carries after this write, and when its state was first observed. A
@@ -36,7 +37,7 @@ export function resolveAgentStatusLiveEntryStateHistory(
         prompt: existing.prompt,
         startedAt: existing.stateStartedAt,
         observedAt: existing.stateObservedAt,
-        interrupted: existing.interrupted
+        ...agentVerdictFields(existing)
       }
     ]
     if (history.length > AGENT_STATE_HISTORY_MAX) {
diff --git a/src/renderer/src/store/slices/agent-status-live-facts.ts b/src/renderer/src/store/slices/agent-status-live-facts.ts
index 5762f22aeaea..4ca44e7a7ff8 100644
--- a/src/renderer/src/store/slices/agent-status-live-facts.ts
+++ b/src/renderer/src/store/slices/agent-status-live-facts.ts
@@ -16,6 +16,7 @@ import {
 } from './agent-status-pane-key-tab-binding'
 import { pruneMigrationUnsupportedEntries } from './agent-status-migration-unsupported-entries'
 import { sleepingRecordFromEntry } from './agent-status-sleeping-records'
+import { agentMainAgentVerdict } from '../../../../shared/agent-main-agent-verdict'
 
 export type AgentStatusLiveFacts = {
   existingSleepingRecord: SleepingAgentSessionRecord | undefined
@@ -95,12 +96,16 @@ export function deriveAgentStatusLiveFacts(args: AgentStatusLiveFactsArgs): Agen
       entry.lastAssistantMessageIsToolOutput !== existing.lastAssistantMessageIsToolOutput ||
       entry.orchestration !== existing.orchestration ||
       entry.subagents !== existing.subagents ||
-      entry.providerSession !== existing.providerSession ||
-      entry.interrupted !== existing.interrupted)
+      entry.providerSession !== existing.providerSession)
+  // A verdict moves no clock: a failure keeps a done's completion time, and a main agent that fails
+  // while its subagents keep the row working leaves the row's state and start as they were.
+  const verdictChanged =
+    !!existing && agentMainAgentVerdict(entry) !== agentMainAgentVerdict(existing)
   const retentionRelevantChange =
     sortRelevantChange ||
     attributionChanged ||
     existing?.workingMode !== entry.workingMode ||
+    verdictChanged ||
     doneRetentionFieldsChanged
   const existingSleepingRecord = state.sleepingAgentSessionsByPaneKey[paneKey]
   const liveRecoveryWorktreeId =
diff --git a/src/renderer/src/store/slices/agent-status-main-agent-fact.test.ts b/src/renderer/src/store/slices/agent-status-main-agent-fact.test.ts
index bd00eaa50158..8ceb45488e8d 100644
--- a/src/renderer/src/store/slices/agent-status-main-agent-fact.test.ts
+++ b/src/renderer/src/store/slices/agent-status-main-agent-fact.test.ts
@@ -51,14 +51,12 @@ describe('the main agent fact on a renderer status entry', () => {
     })
     expect(store.getState().agentStatusByPaneKey[PANE].mainAgent).toEqual(mainAgent)
 
-    store
-      .getState()
-      .setAgentStatus(PANE, {
-        state: 'done',
-        prompt: 'go',
-        agentType: 'claude',
-        observation: osc(2)
-      })
+    store.getState().setAgentStatus(PANE, {
+      state: 'done',
+      prompt: 'go',
+      agentType: 'claude',
+      observation: osc(2)
+    })
     expect(store.getState().agentStatusByPaneKey[PANE].mainAgent).toBeUndefined()
   })
 
diff --git a/src/renderer/src/store/slices/agent-status-provider-session-actions.ts b/src/renderer/src/store/slices/agent-status-provider-session-actions.ts
index 1ffe1d7cb0e8..8deddac21be8 100644
--- a/src/renderer/src/store/slices/agent-status-provider-session-actions.ts
+++ b/src/renderer/src/store/slices/agent-status-provider-session-actions.ts
@@ -21,6 +21,7 @@ import {
 import { removePaneKeys } from './agent-status-pane-keyed-records'
 import { registryEntryMatchesStatus } from './agent-status-launch-config'
 import { copyLaunchConfig } from './agent-status-sleeping-records'
+import { agentVerdictFields } from '../../../../shared/agent-main-agent-verdict'
 
 export function createAgentStatusProviderSessionActions(
   runtime: AgentStatusRuntime
@@ -113,9 +114,7 @@ export function createAgentStatusProviderSessionActions(
               ? { connectionId: existingRecord.connectionId }
               : {}),
           ...(launchConfig ? { launchConfig: copyLaunchConfig(launchConfig) } : {}),
-          ...(preservesCompletedRecoveryRecord && existingRecord.interrupted !== undefined
-            ? { interrupted: existingRecord.interrupted }
-            : {}),
+          ...(preservesCompletedRecoveryRecord ? agentVerdictFields(existingRecord) : {}),
           origin: preservesQuitOrigin ? 'quit' : 'live'
         }
         removedLiveStatus = existingStatus !== undefined
diff --git a/src/renderer/src/store/slices/agent-status-provider-session.test.ts b/src/renderer/src/store/slices/agent-status-provider-session.test.ts
index 786b45378ecc..30793ffce290 100644
--- a/src/renderer/src/store/slices/agent-status-provider-session.test.ts
+++ b/src/renderer/src/store/slices/agent-status-provider-session.test.ts
@@ -455,6 +455,61 @@ describe('recordAgentProviderSession', () => {
     })
   })
 
+  it('keeps a completed recovery record failed on a same-session update', () => {
+    const store = createTestStore()
+    store.setState({
+      tabsByWorktree: {
+        'wt-1': [makeTab({ id: 'tab-1', worktreeId: 'wt-1' })]
+      }
+    } as Partial<AppState>)
+    const providerSession = makePiCompatibleProviderSession('pi')
+
+    store
+      .getState()
+      .setAgentStatus(
+        'tab-1:leaf-1',
+        { state: 'working', prompt: 'finish the task', agentType: 'pi' },
+        'Pi',
+        { updatedAt: 20, stateStartedAt: 20 },
+        { tabId: 'tab-1', worktreeId: 'wt-1' },
+        { providerSession }
+      )
+    store.getState().setAgentStatus(
+      'tab-1:leaf-1',
+      {
+        state: 'done',
+        prompt: 'finish the task',
+        agentType: 'pi',
+        mainAgent: { state: 'done', outcome: 'failure', stateStartedAt: 30 }
+      },
+      'Pi',
+      { updatedAt: 30, stateStartedAt: 30 },
+      { tabId: 'tab-1', worktreeId: 'wt-1' },
+      { providerSession }
+    )
+    expect(store.getState().sleepingAgentSessionsByPaneKey['tab-1:leaf-1']).toMatchObject({
+      state: 'done',
+      mainAgent: { state: 'done', outcome: 'failure', stateStartedAt: 30 }
+    })
+
+    store
+      .getState()
+      .recordAgentProviderSession(
+        'tab-1:leaf-1',
+        'pi',
+        providerSession,
+        { updatedAt: 40 },
+        { tabId: 'tab-1', worktreeId: 'wt-1' }
+      )
+
+    expect(store.getState().sleepingAgentSessionsByPaneKey['tab-1:leaf-1']).toMatchObject({
+      providerSession,
+      state: 'done',
+      mainAgent: { state: 'done', outcome: 'failure', stateStartedAt: 30 },
+      origin: 'live'
+    })
+  })
+
   it('does not downgrade a quit recovery record on a same-session update', () => {
     const store = createTestStore()
     store.setState({
diff --git a/src/renderer/src/store/slices/agent-status-recovery-collection.ts b/src/renderer/src/store/slices/agent-status-recovery-collection.ts
index 689dbf861a7d..491805b5b98e 100644
--- a/src/renderer/src/store/slices/agent-status-recovery-collection.ts
+++ b/src/renderer/src/store/slices/agent-status-recovery-collection.ts
@@ -18,6 +18,7 @@ import {
   type CollectSleepingAgentSessionRecordsOptions
 } from './agent-status-sleeping-records'
 import { getLaunchConfigForEntry } from './agent-status-launch-config'
+import { agentTurnStoppedByUser } from '../../../../shared/agent-main-agent-verdict'
 import { isCompletedPiCompatibleAgentWithLiveRecoveryRecord } from '@/lib/live-resume-anchor-record'
 
 export function collectSleepingAgentSessionRecordsForWorktree(
@@ -153,7 +154,7 @@ export function collectHibernatedCompletionEvidenceForWorktree(
       !allowedPaneKeys.has(paneKey) ||
       entry.state !== 'done' ||
       agentType === undefined ||
-      entry.interrupted === true
+      agentTurnStoppedByUser(entry)
     ) {
       continue
     }
diff --git a/src/renderer/src/store/slices/agent-status-recovery-equivalence.ts b/src/renderer/src/store/slices/agent-status-recovery-equivalence.ts
index 660d104abf6f..1659e757df51 100644
--- a/src/renderer/src/store/slices/agent-status-recovery-equivalence.ts
+++ b/src/renderer/src/store/slices/agent-status-recovery-equivalence.ts
@@ -3,6 +3,7 @@ import type {
   SleepingAgentLaunchConfig
 } from '../../../../shared/agent-session-resume'
 import { agentProviderSessionsEqual } from '../../../../shared/agent-session-resume'
+import { agentMainAgentVerdict } from '../../../../shared/agent-main-agent-verdict'
 
 export function launchConfigsEqual(
   a: SleepingAgentLaunchConfig | undefined,
@@ -41,7 +42,7 @@ export function sleepingRecordsEquivalentIgnoringCaptureTime(
     existing.updatedAt === next.updatedAt &&
     existing.terminalTitle === next.terminalTitle &&
     existing.lastAssistantMessage === next.lastAssistantMessage &&
-    existing.interrupted === next.interrupted &&
+    agentMainAgentVerdict(existing) === agentMainAgentVerdict(next) &&
     existing.origin === next.origin &&
     launchConfigsEqual(existing.launchConfig, next.launchConfig)
   )
@@ -61,7 +62,7 @@ export function recoveryRecordMatches(
     existing.worktreeId === next.worktreeId &&
     existing.tabId === next.tabId &&
     existing.state === next.state &&
-    existing.interrupted === next.interrupted &&
+    agentMainAgentVerdict(existing) === agentMainAgentVerdict(next) &&
     agentProviderSessionsEqual(existing.agent, existing.providerSession, next.providerSession) &&
     launchConfigsEqual(existing.launchConfig, next.launchConfig)
   )
diff --git a/src/renderer/src/store/slices/agent-status-sleeping-records.ts b/src/renderer/src/store/slices/agent-status-sleeping-records.ts
index 6a52ac217866..3fad0d401cb7 100644
--- a/src/renderer/src/store/slices/agent-status-sleeping-records.ts
+++ b/src/renderer/src/store/slices/agent-status-sleeping-records.ts
@@ -1,5 +1,9 @@
 import type { AppState } from '../types'
-import type { AgentStatusEntry } from '../../../../shared/agent-status-types'
+import { mainAgentStatusEqual, type AgentStatusEntry } from '../../../../shared/agent-status-types'
+import {
+  agentTurnEndedUncleanly,
+  agentVerdictFields
+} from '../../../../shared/agent-main-agent-verdict'
 import {
   agentProviderSessionsEqual,
   getAgentResumeArgv,
@@ -85,7 +89,10 @@ export function sleepingRecordFromEntry(args: {
       ? { lastAssistantMessage: args.entry.lastAssistantMessage }
       : {}),
     ...(args.launchConfig ? { launchConfig: copyLaunchConfig(args.launchConfig) } : {}),
-    ...(resolveInterruptedMarker(args.entry, args.priorRecord) ? { interrupted: true } : {}),
+    ...agentVerdictFields({
+      interrupted: resolveInterruptedMarker(args.entry, args.priorRecord),
+      mainAgent: args.entry.mainAgent
+    }),
     ...(args.origin ? { origin: args.origin } : {})
   }
 }
@@ -136,7 +143,8 @@ export function refreshRetainedSleepingRecord(
     record.updatedAt === entry.updatedAt &&
     record.terminalTitle === terminalTitle &&
     record.lastAssistantMessage === lastAssistantMessage &&
-    (record.interrupted === true) === interrupted
+    (record.interrupted === true) === interrupted &&
+    mainAgentStatusEqual(record.mainAgent, entry.mainAgent)
   ) {
     return record
   }
@@ -161,6 +169,12 @@ export function refreshRetainedSleepingRecord(
   } else {
     delete next.interrupted
   }
+  // Both verdict forms move together (`agentVerdictFields`): a stale `mainAgent` outranks the flag.
+  if (entry.mainAgent) {
+    next.mainAgent = entry.mainAgent
+  } else {
+    delete next.mainAgent
+  }
   return next
 }
 
@@ -181,7 +195,7 @@ export function normalizeSleepingAgentSessionCollectOptions(
 }
 
 export function isValidCompletedAgentHibernationEntry(entry: AgentStatusEntry): boolean {
-  return entry.state === 'done' && entry.interrupted !== true
+  return entry.state === 'done' && !agentTurnEndedUncleanly(entry)
 }
 
 // Why: a finished pane is passive wake evidence, and a mobile wake background-mounts every passive
@@ -200,14 +214,18 @@ export function isDurableSleepingCapture(record: SleepingAgentSessionRecord): bo
 }
 
 // Why: manual sleep kills the pty either way, so the record carries resume identity, not the dead
-// turn's interrupt flag — and an explicitly slept workspace is never stale at wake, so a row the
+// turn's verdict — and an explicitly slept workspace is never stale at wake, so a row the
 // user is deliberately sleeping must not trip the wake-side staleness discard. `state` is preserved
 // so a done pane wakes lazily in place instead of spawning a new tab.
 export function manualSleepCaptureEntry(
   entry: AgentStatusEntry,
   capturedAt: number
 ): AgentStatusEntry {
-  return { ...entry, updatedAt: capturedAt, interrupted: false }
+  if (!entry.mainAgent) {
+    return { ...entry, updatedAt: capturedAt, interrupted: false }
+  }
+  const { outcome: _outcome, ...mainAgent } = entry.mainAgent
+  return { ...entry, updatedAt: capturedAt, interrupted: false, mainAgent }
 }
 
 export function removeSleepingRecordsReplacedByManualWorktreeSleep(
diff --git a/src/renderer/src/store/slices/agent-status-verdict-copies.test.ts b/src/renderer/src/store/slices/agent-status-verdict-copies.test.ts
new file mode 100644
index 000000000000..26bec4113b15
--- /dev/null
+++ b/src/renderer/src/store/slices/agent-status-verdict-copies.test.ts
@@ -0,0 +1,191 @@
+import { describe, expect, it } from 'vitest'
+import type { SleepingAgentSessionRecord } from '../../../../shared/agent-session-resume'
+import type { AgentStatusEntry } from '../../../../shared/agent-status-types'
+import { parseWorkspaceSession } from '../../../../shared/workspace-session-schema'
+import { buildPaneActivityEvents } from '@/components/activity/activity-pane-events'
+import { makeTab, makeWorktree } from '@/components/activity/ActivityPrototypePage-test-fixtures'
+import type { AppState } from '../types'
+import { agentMeta, agentTitle } from '@/components/activity/activity-thread-presentation'
+import { activationTreatsNoteAsFinished } from '@/lib/sleeping-agent-pane-ownership'
+import { resolveAgentStatusLiveEntryStateHistory } from './agent-status-live-entry-state-history'
+import { deriveAgentStatusLiveFacts } from './agent-status-live-facts'
+import {
+  recoveryRecordMatches,
+  sleepingRecordsEquivalentIgnoringCaptureTime
+} from './agent-status-recovery-equivalence'
+import {
+  isValidCompletedAgentHibernationEntry,
+  manualSleepCaptureEntry,
+  sleepingRecordFromEntry
+} from './agent-status-sleeping-records'
+
+// Every copy of a row's verdict carries it: history, sleep records and their equality checks.
+// A copy that kept only `interrupted` would read a failure as a clean finish.
+const PANE_KEY = 'tab-1:11111111-1111-4111-8111-111111111111'
+const FAILED_MAIN_AGENT = { state: 'done', outcome: 'failure', stateStartedAt: 2_000 } as const
+// oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: these readers touch only the three maps given; every tab lookup is answered by the tab the caller passes.
+const STATE = {
+  sleepingAgentSessionsByPaneKey: {},
+  migrationUnsupportedByPtyId: {},
+  tabsByWorktree: {}
+} as unknown as AppState
+
+function failedDone(overrides: Partial<AgentStatusEntry> = {}): AgentStatusEntry {
+  return {
+    paneKey: PANE_KEY,
+    state: 'done',
+    prompt: 'ship it',
+    updatedAt: 2_000,
+    stateStartedAt: 2_000,
+    stateHistory: [],
+    agentType: 'claude',
+    providerSession: { key: 'session_id', id: 'session-1' },
+    mainAgent: { state: 'done', outcome: 'failure', stateStartedAt: 2_000 },
+    ...overrides
+  }
+}
+
+function record(overrides: Partial<SleepingAgentSessionRecord> = {}): SleepingAgentSessionRecord {
+  return {
+    paneKey: PANE_KEY,
+    worktreeId: 'wt-1',
+    agent: 'claude',
+    providerSession: { key: 'session_id', id: 'session-1' },
+    prompt: 'ship it',
+    state: 'done',
+    capturedAt: 3_000,
+    updatedAt: 2_000,
+    origin: 'live',
+    ...overrides
+  }
+}
+
+describe('a failed done keeps its verdict in every copy', () => {
+  it('copies the verdict into history with the state it leaves', () => {
+    const { history } = resolveAgentStatusLiveEntryStateHistory(
+      failedDone(),
+      { state: 'working' },
+      3_000
+    )
+    expect(history.at(-1)).toMatchObject({
+      state: 'done',
+      mainAgent: { state: 'done', outcome: 'failure', stateStartedAt: 2_000 }
+    })
+  })
+
+  it('draws a history done as failed from its own main agent status, not the live row', () => {
+    // The main agent failed before the row settled, so its clock differs from the row's.
+    const mainAgent = { ...FAILED_MAIN_AGENT, stateStartedAt: 1_500 }
+    const entry: AgentStatusEntry = {
+      ...failedDone({ state: 'working', stateStartedAt: 3_000, mainAgent: undefined }),
+      stateHistory: resolveAgentStatusLiveEntryStateHistory(
+        failedDone({ mainAgent }),
+        { state: 'working' },
+        3_000
+      ).history
+    }
+    const events = buildPaneActivityEvents({
+      entry,
+      worktree: makeWorktree(),
+      repo: null,
+      tab: makeTab(),
+      agentType: 'claude',
+      agentAlive: true,
+      acknowledgedAt: 0,
+      clearedAt: 0,
+      liveState: null
+    })
+    const done = events.find((event) => event.state === 'done')
+    expect(done?.entry.mainAgent).toEqual(mainAgent)
+    expect(done && agentTitle(done)).toBe('Agent failed')
+    expect(done && agentMeta(done)).toBe('Claude failed')
+  })
+
+  it('records the verdict on a sleep record and never hibernates a failed pane', () => {
+    const sleeping = sleepingRecordFromEntry({
+      state: STATE,
+      entry: failedDone(),
+      worktreeId: 'wt-1',
+      tab: makeTab(),
+      capturedAt: 3_000,
+      origin: 'live'
+    })
+    expect(sleeping?.mainAgent).toEqual({
+      state: 'done',
+      outcome: 'failure',
+      stateStartedAt: 2_000
+    })
+    expect(isValidCompletedAgentHibernationEntry(failedDone())).toBe(false)
+    // A live checkpoint of a turn that failed is still work the user owns.
+    expect(activationTreatsNoteAsFinished(record({ mainAgent: FAILED_MAIN_AGENT }))).toBe(false)
+    expect(activationTreatsNoteAsFinished(record())).toBe(true)
+  })
+
+  it('keeps the main agent status through persistence, and drops only a malformed one', () => {
+    const hydrate = (sleeping: unknown) => {
+      const result = parseWorkspaceSession({
+        activeRepoId: null,
+        activeWorktreeId: null,
+        activeTabId: null,
+        tabsByWorktree: {},
+        terminalLayoutsByTabId: {},
+        sleepingAgentSessionsByPaneKey: { [PANE_KEY]: sleeping }
+      })
+      return result.ok ? result.value.sleepingAgentSessionsByPaneKey?.[PANE_KEY] : undefined
+    }
+    const sleeping = sleepingRecordFromEntry({
+      state: STATE,
+      entry: failedDone(),
+      worktreeId: 'wt-1',
+      tab: makeTab(),
+      capturedAt: 3_000,
+      origin: 'live'
+    })
+    expect(hydrate(sleeping)?.mainAgent).toEqual(FAILED_MAIN_AGENT)
+    const malformed = hydrate({ ...sleeping, mainAgent: { state: 'done', outcome: 'failure' } })
+    expect(malformed).toMatchObject({ paneKey: PANE_KEY, state: 'done', origin: 'live' })
+    expect(malformed?.mainAgent).toBeUndefined()
+  })
+
+  it('leaves the verdict behind when the user sleeps the workspace', () => {
+    expect(manualSleepCaptureEntry(failedDone(), 4_000).mainAgent).not.toHaveProperty('outcome')
+  })
+
+  // A failure keeps its completion clock, so only a verdict compare sees success -> failure.
+  it('re-retains a done whose verdict changed under an unchanged flag and clock', () => {
+    const failed = failedDone()
+    const withVerdict = (outcome: 'success' | 'failure'): AgentStatusEntry => ({
+      ...failed,
+      mainAgent: { state: 'done', outcome, stateStartedAt: 2_000 }
+    })
+    const facts = (existing: AgentStatusEntry, entry: AgentStatusEntry) =>
+      deriveAgentStatusLiveFacts({
+        state: STATE,
+        paneKey: PANE_KEY,
+        entry,
+        existing,
+        launchConfigSource: undefined,
+        retainsResumableRecoveryIdentity: false,
+        commandCodeNewTurn: false,
+        updatedAt: 2_000
+      })
+    expect(facts(withVerdict('success'), withVerdict('failure')).retentionRelevantChange).toBe(true)
+    expect(facts(withVerdict('failure'), withVerdict('failure')).retentionRelevantChange).toBe(
+      false
+    )
+    // A main agent failing while its subagents keep the row working is a verdict change too.
+    const held = (outcome: 'success' | 'failure'): AgentStatusEntry => ({
+      ...withVerdict(outcome),
+      state: 'working'
+    })
+    expect(facts(held('success'), held('failure')).retentionRelevantChange).toBe(true)
+  })
+
+  it('treats a verdict change as a different record even when interrupted did not move', () => {
+    const clean = record({ mainAgent: { ...FAILED_MAIN_AGENT, outcome: 'success' } })
+    const failed = record({ mainAgent: FAILED_MAIN_AGENT })
+    expect(sleepingRecordsEquivalentIgnoringCaptureTime(clean, failed)).toBe(false)
+    expect(recoveryRecordMatches(clean, failed)).toBe(false)
+    expect(sleepingRecordsEquivalentIgnoringCaptureTime(failed, { ...failed })).toBe(true)
+  })
+})
diff --git a/src/renderer/src/store/slices/agent-status-worktree-drop-actions.ts b/src/renderer/src/store/slices/agent-status-worktree-drop-actions.ts
index b7d88675f6ba..f8ac95b5dce0 100644
--- a/src/renderer/src/store/slices/agent-status-worktree-drop-actions.ts
+++ b/src/renderer/src/store/slices/agent-status-worktree-drop-actions.ts
@@ -9,6 +9,7 @@ import {
   shouldReplaceRetainedWithLive
 } from './agent-status-pane-key-tab-binding'
 import { removePaneKeys } from './agent-status-pane-keyed-records'
+import { agentTurnStoppedByUser } from '../../../../shared/agent-main-agent-verdict'
 
 export function createAgentStatusWorktreeDropActions(
   runtime: AgentStatusRuntime
@@ -63,7 +64,7 @@ export function createAgentStatusWorktreeDropActions(
               allowedPaneKeys.has(paneKey) &&
               entry.state === 'done' &&
               entry.agentType !== undefined &&
-              entry.interrupted !== true
+              !agentTurnStoppedByUser(entry)
             ) {
               retainedEvidence.set(
                 paneKey,
diff --git a/src/renderer/src/store/slices/browser-remote-tab-creation.test.ts b/src/renderer/src/store/slices/browser-remote-tab-creation.test.ts
index 96230bf88a4c..06fcaab8512c 100644
--- a/src/renderer/src/store/slices/browser-remote-tab-creation.test.ts
+++ b/src/renderer/src/store/slices/browser-remote-tab-creation.test.ts
@@ -12,8 +12,9 @@ const createWebRuntimeSessionBrowserTabMock = vi.hoisted(() => vi.fn())
 const runtimeEnvironmentCall = vi.fn()
 const runtimeEnvironmentTransportCall = vi.fn()
 
-vi.mock('@/runtime/web-runtime-session', () => ({
-  createWebRuntimeSessionBrowserTab: createWebRuntimeSessionBrowserTabMock
+vi.mock('@/store/slices/browser/paired-browser-tab-creator', () => ({
+  getRegisteredPairedBrowserTabCreator: () => null,
+  loadPairedBrowserTabCreator: async () => createWebRuntimeSessionBrowserTabMock
 }))
 
 const mockApi = createBrowserMockApi(runtimeEnvironmentTransportCall)
diff --git a/src/renderer/src/store/slices/browser-slice-test-harness.ts b/src/renderer/src/store/slices/browser-slice-test-harness.ts
index dd60b4cacdae..bad5a94139c1 100644
--- a/src/renderer/src/store/slices/browser-slice-test-harness.ts
+++ b/src/renderer/src/store/slices/browser-slice-test-harness.ts
@@ -49,11 +49,13 @@ export function createBrowserMockApi(runtimeEnvironmentTransportCall: Mock): Bro
 export function createTestStore() {
   return create<AppState>()(
     (...a) =>
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: a partial store; browser actions touch only the fields seeded here.
       ({
         settings: { activeRuntimeEnvironmentId: null } as AppState['settings'],
         activeWorktreeId: 'wt-1',
         browserDefaultUrl: 'about:blank',
         unifiedTabsByWorktree: {},
+        groupsByWorktree: {},
         tabBarOrderByWorktree: {},
         tabsByWorktree: {},
         openFiles: [],
diff --git a/src/renderer/src/store/slices/browser-tab-creation-placement.test.ts b/src/renderer/src/store/slices/browser-tab-creation-placement.test.ts
new file mode 100644
index 000000000000..37e44fd9cc58
--- /dev/null
+++ b/src/renderer/src/store/slices/browser-tab-creation-placement.test.ts
@@ -0,0 +1,459 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type * as AgentStatusModule from '@/lib/agent-status'
+import type { Tab, TabGroup } from '../../../../shared/tab-types'
+import type { ExecutionHostId } from '../../../../shared/execution-host'
+import type { FolderWorkspace } from '../../../../shared/folder-workspace-types'
+import { FLOATING_TERMINAL_WORKTREE_ID } from '../../../../shared/constants'
+import {
+  createTestStore,
+  makeTabGroup,
+  makeUnifiedTab,
+  makeWorktree,
+  seedStore
+} from './store-test-helpers'
+import { createStoreCascadesMockApi } from './store-cascades-test-harness'
+
+vi.mock('sonner', () => ({
+  toast: { info: vi.fn(), success: vi.fn(), error: vi.fn(), warning: vi.fn() }
+}))
+vi.mock('@/components/terminal-pane/pty-dispatcher', () => ({
+  restorePtyDataHandlersAfterFailedShutdown: vi.fn(),
+  unregisterPtyDataHandlers: vi.fn(() => [])
+}))
+vi.mock('@/lib/agent-status', async (importOriginal) => {
+  const actual = await importOriginal<typeof AgentStatusModule>()
+  return { ...actual, detectAgentStatusFromTitle: vi.fn().mockReturnValue(null) }
+})
+
+createStoreCascadesMockApi()
+
+const WT = 'repo1::/path/wt-placement'
+const G1 = 'group-1'
+const G2 = 'group-2'
+
+type Store = ReturnType<typeof createTestStore>
+
+function browserTab(id: string, groupId: string, extra: Partial<Tab> = {}): Tab {
+  return makeUnifiedTab({
+    id,
+    worktreeId: WT,
+    groupId,
+    contentType: 'browser',
+    entityId: `${id}-workspace`,
+    lastFocusedAt: 100,
+    ...extra
+  })
+}
+
+/** Unpinned A B C in G1 with B active; G2 holds X and is the focused group. */
+function seedSplit(store: Store, overrides: { tabs?: Tab[]; groups?: TabGroup[] } = {}): void {
+  seedStore(store, {
+    worktreesByRepo: { repo1: [makeWorktree({ id: WT, repoId: 'repo1' })] },
+    activeWorktreeId: WT,
+    unifiedTabsByWorktree: {
+      [WT]: overrides.tabs ?? [
+        browserTab('A', G1),
+        browserTab('B', G1),
+        browserTab('C', G1),
+        browserTab('X', G2)
+      ]
+    },
+    groupsByWorktree: {
+      [WT]: overrides.groups ?? [
+        makeTabGroup({
+          id: G1,
+          worktreeId: WT,
+          activeTabId: 'B',
+          tabOrder: ['A', 'B', 'C'],
+          recentTabIds: ['A', 'B']
+        }),
+        makeTabGroup({
+          id: G2,
+          worktreeId: WT,
+          activeTabId: 'X',
+          tabOrder: ['X'],
+          recentTabIds: ['X']
+        })
+      ]
+    },
+    activeGroupIdByWorktree: { [WT]: G2 },
+    layoutByWorktree: {
+      [WT]: {
+        type: 'split',
+        direction: 'horizontal',
+        first: { type: 'leaf', groupId: G1 },
+        second: { type: 'leaf', groupId: G2 }
+      }
+    }
+  })
+}
+
+function group(store: Store, groupId: string, worktreeId = WT): TabGroup | undefined {
+  return store.getState().groupsByWorktree[worktreeId]?.find((g) => g.id === groupId)
+}
+
+function createdUnifiedId(store: Store, workspaceId: string, worktreeId = WT): string {
+  const tab = store
+    .getState()
+    .unifiedTabsByWorktree[worktreeId]?.find((candidate) => candidate.entityId === workspaceId)
+  if (!tab) {
+    throw new Error(`no wrapper for ${workspaceId}`)
+  }
+  return tab.id
+}
+
+describe('browser tab creation placement', () => {
+  let store: Store
+
+  beforeEach(() => {
+    store = createTestStore()
+  })
+
+  it('appends Group New Browser Tab regardless of the active tab', async () => {
+    seedSplit(store)
+    await store.getState().openNewBrowserTabInActiveWorkspace(G1)
+    const n = store.getState().unifiedTabsByWorktree[WT]!.at(-1)!
+    expect(group(store, G1)?.tabOrder).toEqual(['A', 'B', 'C', n.id])
+
+    store.getState().activateTab('A')
+    await store.getState().openNewBrowserTabInActiveWorkspace(G1)
+    const m = store.getState().unifiedTabsByWorktree[WT]!.at(-1)!
+    expect(group(store, G1)?.tabOrder).toEqual(['A', 'B', 'C', n.id, m.id])
+  })
+
+  it('uses the invoking group workspace instead of the globally selected one', async () => {
+    seedSplit(store)
+    store.setState({ activeWorktreeId: 'repo1::/elsewhere' })
+    await store.getState().openNewBrowserTabInActiveWorkspace(G1)
+    expect(group(store, G1)?.tabOrder).toHaveLength(4)
+    expect(store.getState().unifiedTabsByWorktree['repo1::/elsewhere']).toBeUndefined()
+  })
+
+  it('places a duplicate directly after its source', () => {
+    seedSplit(store)
+    const workspace = store
+      .getState()
+      .createBrowserTab(WT, 'https://example.com', { afterTabId: 'B' })
+    const duplicate = createdUnifiedId(store, workspace.id)
+    expect(group(store, G1)?.tabOrder).toEqual(['A', 'B', duplicate, 'C'])
+    expect(
+      store
+        .getState()
+        .unifiedTabsByWorktree[WT]!.filter((tab) => tab.groupId === G1)
+        .map((tab) => [tab.id, tab.sortOrder])
+    ).toEqual([
+      ['A', 0],
+      ['B', 1],
+      ['C', 3],
+      [duplicate, 2]
+    ])
+  })
+
+  it('places a background link after its source without touching selection or MRU', () => {
+    seedSplit(store)
+    const before = store.getState()
+    const workspace = store
+      .getState()
+      .createBrowserTab(WT, 'https://example.com/link', { afterTabId: 'B', activate: false })
+    const link = createdUnifiedId(store, workspace.id)
+    const after = store.getState()
+
+    expect(group(store, G1)).toMatchObject({
+      tabOrder: ['A', 'B', link, 'C'],
+      activeTabId: 'B',
+      recentTabIds: ['A', 'B']
+    })
+    expect(after.activeGroupIdByWorktree[WT]).toBe(G2)
+    expect(after.activeWorktreeId).toBe(WT)
+    expect(after.activeTabType).toBe(before.activeTabType)
+    expect(after.activeBrowserTabId).toBe(before.activeBrowserTabId)
+    expect(after.unifiedTabsByWorktree[WT]!.find((tab) => tab.id === link)?.lastFocusedAt).toBe(
+      undefined
+    )
+    expect(after.unifiedTabsByWorktree[WT]!.find((tab) => tab.id === 'B')?.lastFocusedAt).toBe(100)
+  })
+
+  it('focuses the resolved group for a foreground source action in an unfocused split', () => {
+    seedSplit(store)
+    const workspace = store
+      .getState()
+      .createBrowserTab(WT, 'https://example.com', { afterTabId: 'B' })
+    const created = createdUnifiedId(store, workspace.id)
+    const state = store.getState()
+    expect(state.activeGroupIdByWorktree[WT]).toBe(G1)
+    expect(group(store, G1)).toMatchObject({ activeTabId: created })
+    expect(group(store, G1)?.recentTabIds).toEqual(['A', 'B', created])
+    expect(state.activeBrowserTabId).toBe(workspace.id)
+    expect(state.activeTabType).toBe('browser')
+  })
+
+  it('lets an explicit destination win over the anchor group', () => {
+    seedSplit(store)
+    const workspace = store
+      .getState()
+      .createBrowserTab(WT, 'https://example.com', { afterTabId: 'B', targetGroupId: G2 })
+    expect(group(store, G2)?.tabOrder).toEqual(['X', createdUnifiedId(store, workspace.id)])
+    expect(group(store, G1)?.tabOrder).toEqual(['A', 'B', 'C'])
+  })
+
+  it('treats a closed anchor as absent and appends in the active group', () => {
+    seedSplit(store)
+    const workspace = store
+      .getState()
+      .createBrowserTab(WT, 'https://example.com', { afterTabId: 'closed-tab' })
+    expect(group(store, G2)?.tabOrder).toEqual(['X', createdUnifiedId(store, workspace.id)])
+  })
+
+  it('falls back to the active group, not the first group, for an expired requested group', () => {
+    seedSplit(store)
+    const workspace = store
+      .getState()
+      .createBrowserTab(WT, 'https://example.com', { targetGroupId: 'deleted-group' })
+    expect(group(store, G2)?.tabOrder).toEqual(['X', createdUnifiedId(store, workspace.id)])
+  })
+
+  it('ignores an ambiguous anchor id', () => {
+    seedSplit(store, {
+      tabs: [browserTab('A', G1), browserTab('B', G1), browserTab('B', G2), browserTab('C', G1)]
+    })
+    const workspace = store
+      .getState()
+      .createBrowserTab(WT, 'https://example.com', { afterTabId: 'B' })
+    expect(group(store, G2)?.tabOrder).toEqual(['X', createdUnifiedId(store, workspace.id)])
+  })
+
+  it('ignores an anchor whose group order no longer contains it', () => {
+    seedSplit(store, {
+      groups: [
+        makeTabGroup({ id: G1, worktreeId: WT, activeTabId: 'A', tabOrder: ['A', 'C'] }),
+        makeTabGroup({ id: G2, worktreeId: WT, activeTabId: 'X', tabOrder: ['X'] })
+      ]
+    })
+    const workspace = store
+      .getState()
+      .createBrowserTab(WT, 'https://example.com', { afterTabId: 'B' })
+    expect(group(store, G2)?.tabOrder).toEqual(['X', createdUnifiedId(store, workspace.id)])
+  })
+
+  it('collapses duplicate order entries while inserting once', () => {
+    seedSplit(store, {
+      groups: [
+        makeTabGroup({ id: G1, worktreeId: WT, activeTabId: 'B', tabOrder: ['A', 'B', 'A', 'C'] }),
+        makeTabGroup({ id: G2, worktreeId: WT, activeTabId: 'X', tabOrder: ['X'] })
+      ]
+    })
+    const workspace = store
+      .getState()
+      .createBrowserTab(WT, 'https://example.com', { afterTabId: 'B' })
+    expect(group(store, G1)?.tabOrder).toEqual([
+      'A',
+      'B',
+      createdUnifiedId(store, workspace.id),
+      'C'
+    ])
+  })
+
+  it('keeps an unpinned tab from a pinned source after the pinned prefix', () => {
+    seedSplit(store, {
+      tabs: [
+        browserTab('P1', G1, { isPinned: true }),
+        browserTab('P2', G1, { isPinned: true }),
+        browserTab('C', G1),
+        browserTab('X', G2)
+      ],
+      groups: [
+        makeTabGroup({ id: G1, worktreeId: WT, activeTabId: 'P1', tabOrder: ['P1', 'P2', 'C'] }),
+        makeTabGroup({ id: G2, worktreeId: WT, activeTabId: 'X', tabOrder: ['X'] })
+      ]
+    })
+    const workspace = store
+      .getState()
+      .createBrowserTab(WT, 'https://example.com', { afterTabId: 'P1' })
+    expect(group(store, G1)?.tabOrder).toEqual([
+      'P1',
+      'P2',
+      createdUnifiedId(store, workspace.id),
+      'C'
+    ])
+  })
+
+  it('keeps a pinned candidate before the unpinned suffix and beside a pinned anchor', () => {
+    seedSplit(store, {
+      tabs: [
+        browserTab('P1', G1, { isPinned: true }),
+        browserTab('P2', G1, { isPinned: true }),
+        browserTab('C', G1),
+        browserTab('X', G2)
+      ],
+      groups: [
+        makeTabGroup({ id: G1, worktreeId: WT, activeTabId: 'P1', tabOrder: ['P1', 'P2', 'C'] }),
+        makeTabGroup({ id: G2, worktreeId: WT, activeTabId: 'X', tabOrder: ['X'] })
+      ]
+    })
+    const fromUnpinned = store
+      .getState()
+      .createUnifiedTab(WT, 'editor', { afterTabId: 'C', isPinned: true })
+    expect(group(store, G1)?.tabOrder).toEqual(['P1', 'P2', fromUnpinned.id, 'C'])
+    const fromPinned = store
+      .getState()
+      .createUnifiedTab(WT, 'editor', { afterTabId: 'P1', isPinned: true })
+    expect(group(store, G1)?.tabOrder).toEqual(['P1', fromPinned.id, 'P2', fromUnpinned.id, 'C'])
+    expect(fromPinned.sortOrder).toBe(1)
+  })
+
+  it('appends in the partition when preview replacement removes the anchor', () => {
+    seedSplit(store, {
+      tabs: [
+        browserTab('A', G1, { sortOrder: 0 }),
+        makeUnifiedTab({
+          id: 'P',
+          worktreeId: WT,
+          groupId: G1,
+          contentType: 'editor',
+          isPreview: true,
+          sortOrder: 1
+        }),
+        browserTab('C', G1, { sortOrder: 2 }),
+        browserTab('X', G2)
+      ],
+      groups: [
+        makeTabGroup({ id: G1, worktreeId: WT, activeTabId: 'P', tabOrder: ['A', 'P', 'C'] }),
+        makeTabGroup({ id: G2, worktreeId: WT, activeTabId: 'X', tabOrder: ['X'] })
+      ]
+    })
+    const created = store
+      .getState()
+      .createUnifiedTab(WT, 'editor', { afterTabId: 'P', isPreview: true, targetGroupId: G1 })
+    expect(group(store, G1)?.tabOrder).toEqual(['A', 'C', created.id])
+    expect(created.sortOrder).toBe(2)
+    const sortOrderById = Object.fromEntries(
+      store.getState().unifiedTabsByWorktree[WT]!.map((tab) => [tab.id, tab.sortOrder])
+    )
+    expect(sortOrderById).toMatchObject({ A: 0, C: 1, [created.id]: 2 })
+  })
+
+  it('leaves the wrapper host unset instead of stamping a substituted routing host', () => {
+    seedSplit(store)
+    // Why: no repo row and a focused runtime make the routing resolver substitute runtime:env-1.
+    store.setState({
+      activeWorktreeId: 'repo1::/elsewhere',
+      settings: { ...store.getState().settings!, activeRuntimeEnvironmentId: 'env-1' }
+    })
+    const workspace = store.getState().createBrowserTab(WT, 'https://example.com', {
+      activate: false,
+      browserRuntimeEnvironmentId: null
+    })
+    const wrapper = store
+      .getState()
+      .unifiedTabsByWorktree[WT]!.find((tab) => tab.entityId === workspace.id)
+    expect(wrapper).toBeDefined()
+    expect(wrapper?.executionHostId).toBeUndefined()
+  })
+
+  it('rejects an anchor owned by a foreign execution host', () => {
+    seedSplit(store, {
+      tabs: [browserTab('A', G1, { executionHostId: 'ssh:other' }), browserTab('X', G2)],
+      groups: [
+        makeTabGroup({ id: G1, worktreeId: WT, activeTabId: 'A', tabOrder: ['A'] }),
+        makeTabGroup({ id: G2, worktreeId: WT, activeTabId: 'X', tabOrder: ['X'] })
+      ]
+    })
+    const workspace = store.getState().createBrowserTab(WT, 'https://example.com', {
+      afterTabId: 'A',
+      executionHostId: 'runtime:env-1'
+    })
+    expect(group(store, G2)?.tabOrder).toEqual(['X', createdUnifiedId(store, workspace.id)])
+  })
+
+  it('accepts an SSH-backed anchor through the worktree runtime-owner alias', () => {
+    const sshHost: ExecutionHostId = 'ssh:target-1'
+    seedSplit(store, {
+      tabs: [browserTab('A', G1, { executionHostId: sshHost }), browserTab('C', G1)],
+      groups: [makeTabGroup({ id: G1, worktreeId: WT, activeTabId: 'A', tabOrder: ['A', 'C'] })]
+    })
+    store.setState({
+      worktreesByRepo: {
+        repo1: [
+          makeWorktree({
+            id: WT,
+            repoId: 'repo1',
+            hostId: sshHost,
+            runtimeOwnerEnvironmentId: 'env-1'
+          })
+        ]
+      }
+    })
+    const workspace = store.getState().createBrowserTab(WT, 'https://example.com', {
+      afterTabId: 'A',
+      executionHostId: 'runtime:env-1'
+    })
+    expect(group(store, G1)?.tabOrder).toEqual(['A', createdUnifiedId(store, workspace.id), 'C'])
+  })
+
+  it('places source actions in folder and floating workspaces', () => {
+    const folderWt = 'folder:folder-1'
+    const folder: FolderWorkspace = {
+      id: 'folder-1',
+      projectGroupId: 'pg',
+      name: 'Folder',
+      folderPath: '/tmp/folder',
+      executionHostId: 'local',
+      linkedTask: null,
+      comment: '',
+      isArchived: false,
+      isUnread: false,
+      isPinned: false,
+      sortOrder: 0,
+      lastActivityAt: 0,
+      createdAt: 0,
+      updatedAt: 0
+    }
+    for (const worktreeId of [folderWt, FLOATING_TERMINAL_WORKTREE_ID]) {
+      store.setState({
+        folderWorkspaces: [folder],
+        unifiedTabsByWorktree: {
+          ...store.getState().unifiedTabsByWorktree,
+          [worktreeId]: ['A', 'B'].map((id) =>
+            makeUnifiedTab({ id: `${worktreeId}-${id}`, worktreeId, groupId: `${worktreeId}-g` })
+          )
+        },
+        groupsByWorktree: {
+          ...store.getState().groupsByWorktree,
+          [worktreeId]: [
+            makeTabGroup({
+              id: `${worktreeId}-g`,
+              worktreeId,
+              activeTabId: `${worktreeId}-A`,
+              tabOrder: [`${worktreeId}-A`, `${worktreeId}-B`]
+            })
+          ]
+        }
+      })
+      const workspace = store.getState().createBrowserTab(worktreeId, 'https://example.com', {
+        afterTabId: `${worktreeId}-A`,
+        browserRuntimeEnvironmentId: null
+      })
+      expect(group(store, `${worktreeId}-g`, worktreeId)?.tabOrder).toEqual([
+        `${worktreeId}-A`,
+        createdUnifiedId(store, workspace.id, worktreeId),
+        `${worktreeId}-B`
+      ])
+    }
+  })
+
+  it('selects the first tab of an empty group structurally without recording a visit', () => {
+    seedSplit(store, {
+      groups: [
+        makeTabGroup({ id: G1, worktreeId: WT, activeTabId: null, tabOrder: [], recentTabIds: [] }),
+        makeTabGroup({ id: G2, worktreeId: WT, activeTabId: 'X', tabOrder: ['X'] })
+      ],
+      tabs: [browserTab('X', G2)]
+    })
+    const workspace = store
+      .getState()
+      .createBrowserTab(WT, 'https://example.com', { targetGroupId: G1, activate: false })
+    const created = createdUnifiedId(store, workspace.id)
+    expect(group(store, G1)).toMatchObject({ activeTabId: created, recentTabIds: [] })
+    expect(store.getState().activeGroupIdByWorktree[WT]).toBe(G2)
+  })
+})
diff --git a/src/renderer/src/store/slices/browser/browser-slice-contract.ts b/src/renderer/src/store/slices/browser/browser-slice-contract.ts
index 3f3aa6ead2bf..3cbeba14d989 100644
--- a/src/renderer/src/store/slices/browser/browser-slice-contract.ts
+++ b/src/renderer/src/store/slices/browser/browser-slice-contract.ts
@@ -39,6 +39,10 @@ export type CreateBrowserTabOptions = {
   sessionPartition?: string | null
   // Place the new tab in a specific group (e.g. "Open Preview to the Side"); defaults to the worktree's active group.
   targetGroupId?: string
+  /** Client-local unified tab id of the source; the new tab lands right after it when still live. */
+  afterTabId?: string
+  /** Verified execution host for the new wrapper; unset keeps createUnifiedTab's active-workspace fallback. */
+  executionHostId?: ExecutionHostId
   // Explicit "New Tab" focuses the address bar even with a real home URL; link-opened tabs leave it unset.
   focusAddressBar?: boolean
   browserRuntimeEnvironmentId?: string | null
diff --git a/src/renderer/src/store/slices/browser/browser-tab-actions.ts b/src/renderer/src/store/slices/browser/browser-tab-actions.ts
index 95ae0e7c7a77..2635cd326512 100644
--- a/src/renderer/src/store/slices/browser/browser-tab-actions.ts
+++ b/src/renderer/src/store/slices/browser/browser-tab-actions.ts
@@ -18,6 +18,11 @@ import {
 import { getBrowserSessionProfileHostId } from './browser-host-state'
 import { getRuntimeEnvironmentIdForWorktree } from '@/lib/worktree-runtime-owner'
 import { admitBrowserPageMount } from '@/components/browser-pane/host-guest/browser-page-mount-admission'
+import {
+  getRegisteredPairedBrowserTabCreator,
+  loadPairedBrowserTabCreator
+} from './paired-browser-tab-creator'
+import { findGroupAndWorktree } from '../tab-group-state'
 
 export function createBrowserTabActions(
   set: BrowserSliceSet,
@@ -151,19 +156,29 @@ export function createBrowserTabActions(
         (t) => t.contentType === 'browser' && t.entityId === workspaceId
       )
       if (!alreadyHasUnifiedTab) {
-        state.createUnifiedTab(worktreeId, 'browser', {
+        const shouldActivate = options?.activate ?? true
+        const created = state.createUnifiedTab(worktreeId, 'browser', {
           entityId: workspaceId,
           label: browserTab.title,
           targetGroupId: options?.targetGroupId,
-          activate: options?.activate ?? true
+          ...(options?.afterTabId ? { afterTabId: options.afterTabId } : {}),
+          // Why no routing-host default: a substituted host would disown the wrapper from its worktree.
+          ...(options?.executionHostId ? { executionHostId: options.executionHostId } : {}),
+          activate: shouldActivate
         })
+        // Why: unified creation already selected the tab and recorded the visit; only the group moves.
+        if (shouldActivate && created) {
+          get().focusGroup(worktreeId, created.groupId)
+        }
       }
       return browserTab
     },
 
     openNewBrowserTabInActiveWorkspace: async (groupId) => {
       const state = get()
-      const worktreeId = state.activeWorktreeId
+      // Why: the invoking group owns its workspace; global selection may already point elsewhere.
+      const worktreeId =
+        findGroupAndWorktree(state.groupsByWorktree, groupId)?.worktreeId ?? state.activeWorktreeId
       if (!worktreeId) {
         return
       }
@@ -179,9 +194,11 @@ export function createBrowserTabActions(
         if (!runtimeEnvironmentId) {
           throw new Error('The paired runtime browser provider is unavailable.')
         }
-        const { createWebRuntimeSessionBrowserTab } = await import('@/runtime/web-runtime-session')
+        // The registered path stages on the click; a cold runtime loads before staging.
+        const createPairedBrowserTab =
+          getRegisteredPairedBrowserTabCreator() ?? (await loadPairedBrowserTabCreator())
         try {
-          const created = await createWebRuntimeSessionBrowserTab({
+          const created = await createPairedBrowserTab({
             worktreeId,
             environmentId: runtimeEnvironmentId,
             url: defaultUrl,
@@ -230,9 +247,10 @@ export function createBrowserTabActions(
         if (!runtimeEnvironmentId) {
           return false
         }
-        const { createWebRuntimeSessionBrowserTab } = await import('@/runtime/web-runtime-session')
+        const createPairedBrowserTab =
+          getRegisteredPairedBrowserTabCreator() ?? (await loadPairedBrowserTabCreator())
         try {
-          return await createWebRuntimeSessionBrowserTab({
+          return await createPairedBrowserTab({
             worktreeId,
             environmentId: runtimeEnvironmentId,
             url,
diff --git a/src/renderer/src/store/slices/browser/paired-browser-tab-creator.ts b/src/renderer/src/store/slices/browser/paired-browser-tab-creator.ts
new file mode 100644
index 000000000000..bed32bd7f3bd
--- /dev/null
+++ b/src/renderer/src/store/slices/browser/paired-browser-tab-creator.ts
@@ -0,0 +1,21 @@
+import type { CreateWebRuntimeSessionBrowserTabArgs } from '@/runtime/web-runtime-browser-creation-context'
+
+type PairedBrowserTabCreator = (args: CreateWebRuntimeSessionBrowserTabArgs) => Promise<boolean>
+
+let registeredCreator: PairedBrowserTabCreator | null = null
+
+// Why: the runtime imports the store, so its loaded module registers a synchronous creation path.
+// Cold calls use the lazy import below and stage once it resolves.
+export function registerPairedBrowserTabCreator(create: PairedBrowserTabCreator): void {
+  registeredCreator = create
+}
+
+export function getRegisteredPairedBrowserTabCreator(): PairedBrowserTabCreator | null {
+  return registeredCreator
+}
+
+export async function loadPairedBrowserTabCreator(): Promise<PairedBrowserTabCreator> {
+  const { createWebRuntimeSessionBrowserTab } =
+    await import('@/runtime/web-runtime-browser-creation')
+  return createWebRuntimeSessionBrowserTab
+}
diff --git a/src/renderer/src/store/slices/cmd-j-create-actions.test.ts b/src/renderer/src/store/slices/cmd-j-create-actions.test.ts
index acd617a97594..15cb73f31816 100644
--- a/src/renderer/src/store/slices/cmd-j-create-actions.test.ts
+++ b/src/renderer/src/store/slices/cmd-j-create-actions.test.ts
@@ -12,10 +12,14 @@ const createWebRuntimeSessionBrowserTabMock = vi.hoisted(() => vi.fn())
 const createWebRuntimeSessionTerminalMock = vi.hoisted(() => vi.fn())
 
 vi.mock('@/runtime/web-runtime-session', () => ({
-  createWebRuntimeSessionBrowserTab: createWebRuntimeSessionBrowserTabMock,
   createWebRuntimeSessionTerminal: createWebRuntimeSessionTerminalMock
 }))
 
+vi.mock('@/store/slices/browser/paired-browser-tab-creator', () => ({
+  getRegisteredPairedBrowserTabCreator: () => null,
+  loadPairedBrowserTabCreator: async () => createWebRuntimeSessionBrowserTabMock
+}))
+
 vi.mock('@/lib/focus-terminal-tab-surface', () => ({
   focusTerminalTabSurface: vi.fn()
 }))
diff --git a/src/renderer/src/store/slices/editor/actions/editor-cursor-line.test.ts b/src/renderer/src/store/slices/editor/actions/editor-cursor-line.test.ts
new file mode 100644
index 000000000000..2a5bae3024d2
--- /dev/null
+++ b/src/renderer/src/store/slices/editor/actions/editor-cursor-line.test.ts
@@ -0,0 +1,61 @@
+import { describe, expect, it, vi } from 'vitest'
+import { createEditorStore } from '../../editor-slice-test-harness'
+
+describe('editor cursor-line store notifications', () => {
+  it('does not notify subscribers or copy accumulated lines for same-line cursor movement', () => {
+    const store = createEditorStore()
+    store.setState({
+      editorCursorLine: Object.fromEntries(
+        Array.from({ length: 250 }, (_, index) => [`file-${index}`, index + 1])
+      )
+    })
+    const before = store.getState()
+    let subscriberCalls = 0
+    const unsubscribe = store.subscribe(() => {
+      subscriberCalls += 1
+    })
+
+    for (let column = 1; column <= 2_000; column += 1) {
+      store.getState().setEditorCursorLine('file-49', 50)
+    }
+
+    unsubscribe()
+    expect(subscriberCalls).toBe(0)
+    expect(store.getState()).toBe(before)
+    expect(store.getState().editorCursorLine).toBe(before.editorCursorLine)
+  })
+
+  it('publishes exactly once for a changed line and preserves other file positions', () => {
+    const store = createEditorStore()
+    store.getState().setEditorCursorLine('local-file', 10)
+    store.getState().setEditorCursorLine('remote-file', 30)
+    const before = store.getState().editorCursorLine
+    const subscriber = vi.fn()
+    const unsubscribe = store.subscribe(subscriber)
+
+    store.getState().setEditorCursorLine('local-file', 11)
+    store.getState().setEditorCursorLine('local-file', 11)
+
+    unsubscribe()
+    expect(subscriber).toHaveBeenCalledOnce()
+    expect(before).toEqual({ 'local-file': 10, 'remote-file': 30 })
+    expect(store.getState().editorCursorLine).toEqual({ 'local-file': 11, 'remote-file': 30 })
+  })
+
+  it('records the initial position independently for each file identity', () => {
+    const store = createEditorStore()
+    const subscriber = vi.fn()
+    const unsubscribe = store.subscribe(subscriber)
+
+    store.getState().setEditorCursorLine('editor:workspace:local:file.ts', 1)
+    store.getState().setEditorCursorLine('editor:workspace:runtime-a:file.ts', 1)
+    store.getState().setEditorCursorLine('editor:workspace:runtime-a:file.ts', 1)
+
+    unsubscribe()
+    expect(subscriber).toHaveBeenCalledTimes(2)
+    expect(store.getState().editorCursorLine).toEqual({
+      'editor:workspace:local:file.ts': 1,
+      'editor:workspace:runtime-a:file.ts': 1
+    })
+  })
+})
diff --git a/src/renderer/src/store/slices/editor/actions/editor-cursor-line.ts b/src/renderer/src/store/slices/editor/actions/editor-cursor-line.ts
index 7b193b3521b0..bda6ed3c8086 100644
--- a/src/renderer/src/store/slices/editor/actions/editor-cursor-line.ts
+++ b/src/renderer/src/store/slices/editor/actions/editor-cursor-line.ts
@@ -8,8 +8,10 @@ export function createEditorCursorLine(
   return {
     editorCursorLine: {},
     setEditorCursorLine: (fileId, line) =>
-      set((s) => ({
-        editorCursorLine: { ...s.editorCursorLine, [fileId]: line }
-      }))
+      set((s) =>
+        s.editorCursorLine[fileId] === line
+          ? s
+          : { editorCursorLine: { ...s.editorCursorLine, [fileId]: line } }
+      )
   }
 }
diff --git a/src/renderer/src/store/slices/editor/actions/editor-draft-state.test.ts b/src/renderer/src/store/slices/editor/actions/editor-draft-state.test.ts
new file mode 100644
index 000000000000..1bf0ea275ac6
--- /dev/null
+++ b/src/renderer/src/store/slices/editor/actions/editor-draft-state.test.ts
@@ -0,0 +1,50 @@
+import { describe, expect, it, vi } from 'vitest'
+import { createEditorStore } from '../../editor-slice-test-harness'
+
+describe('editor draft publications', () => {
+  it.each(['', 'unsaved edit'])('does not publish an identical existing draft: %j', (content) => {
+    const store = createEditorStore()
+    store.getState().setEditorDraft('/repo/file.ts', content)
+    const before = store.getState()
+    const listener = vi.fn()
+    const unsubscribe = store.subscribe(listener)
+
+    store.getState().setEditorDraft('/repo/file.ts', content)
+
+    expect(store.getState()).toBe(before)
+    expect(listener).not.toHaveBeenCalled()
+    unsubscribe()
+  })
+
+  it('publishes a new empty draft and a changed draft exactly once each', () => {
+    const store = createEditorStore()
+    const listener = vi.fn()
+    const unsubscribe = store.subscribe(listener)
+
+    store.getState().setEditorDraft('/repo/file.ts', '')
+    expect(store.getState().editorDrafts).toEqual({ '/repo/file.ts': '' })
+    expect(listener).toHaveBeenCalledTimes(1)
+
+    listener.mockClear()
+    store.getState().setEditorDraft('/repo/file.ts', 'changed')
+    expect(store.getState().editorDrafts).toEqual({ '/repo/file.ts': 'changed' })
+    expect(listener).toHaveBeenCalledTimes(1)
+    unsubscribe()
+  })
+
+  it('scopes draft equality to the exact editor identity', () => {
+    const store = createEditorStore()
+    store.getState().setEditorDraft('local-file', 'same text')
+    const listener = vi.fn()
+    const unsubscribe = store.subscribe(listener)
+
+    store.getState().setEditorDraft('remote-file', 'same text')
+
+    expect(store.getState().editorDrafts).toEqual({
+      'local-file': 'same text',
+      'remote-file': 'same text'
+    })
+    expect(listener).toHaveBeenCalledTimes(1)
+    unsubscribe()
+  })
+})
diff --git a/src/renderer/src/store/slices/editor/actions/editor-draft-state.ts b/src/renderer/src/store/slices/editor/actions/editor-draft-state.ts
index 19501b60fe22..dc650ab750ac 100644
--- a/src/renderer/src/store/slices/editor/actions/editor-draft-state.ts
+++ b/src/renderer/src/store/slices/editor/actions/editor-draft-state.ts
@@ -34,6 +34,9 @@ export function createEditorDraftState(set: EditorSet, _get: EditorGet): EditorD
     editorDrafts: {},
     setEditorDraft: (fileId, content) =>
       set((s) => {
+        if (s.editorDrafts[fileId] === content) {
+          return s
+        }
         // Why: read-only tabs must never accrue a draft — it seeds dirty/autosave/hot-exit restore that could overwrite an agent transcript.
         const file = s.openFiles.find((f) => f.id === fileId)
         if (file?.readOnly === true) {
diff --git a/src/renderer/src/store/slices/github-pr-request-lifetime.test.ts b/src/renderer/src/store/slices/github-pr-request-lifetime.test.ts
new file mode 100644
index 000000000000..ddd964712315
--- /dev/null
+++ b/src/renderer/src/store/slices/github-pr-request-lifetime.test.ts
@@ -0,0 +1,154 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { PRRefreshOutcome } from '../../../../shared/github/pull-request-refresh-types'
+import { inflightPRRequests, prRequestGenerations } from '../github/request-coordination'
+import {
+  createTestStore,
+  makePR,
+  mockApi,
+  resetRemoteRuntimeMocks,
+  runtimeEnvironmentCall
+} from './github-slice-test-harness'
+
+beforeEach(() => {
+  vi.useFakeTimers()
+  vi.setSystemTime(1000)
+  vi.clearAllMocks()
+  resetRemoteRuntimeMocks()
+  mockApi.gh.refreshPRNow.mockReset()
+  vi.spyOn(console, 'error').mockImplementation(() => undefined)
+})
+
+afterEach(() => {
+  vi.clearAllTimers()
+  vi.useRealTimers()
+  vi.restoreAllMocks()
+})
+
+function found(number: number): PRRefreshOutcome {
+  return { kind: 'found', pr: makePR({ number }), fetchedAt: Date.now() }
+}
+
+const cases = [
+  { route: 'local', replacement: 'force', outcome: 'found' },
+  { route: 'local', replacement: 'hint', outcome: 'found' },
+  { route: 'local', replacement: 'force', outcome: 'rejected' },
+  { route: 'runtime', replacement: 'force', outcome: 'found' },
+  { route: 'runtime', replacement: 'force', outcome: 'upstream-error' },
+  { route: 'runtime', replacement: 'hint', outcome: 'no-pr' }
+] as const
+
+describe('pull-request lookup ownership after newer settlement', () => {
+  it.each(cases)(
+    'preserves $route lookup after late $outcome with $replacement replacement',
+    async ({ route, replacement, outcome }) => {
+      const store = createTestStore()
+      const pending: ReturnType<typeof Promise.withResolvers<PRRefreshOutcome>>[] = []
+      const startRequest = () => {
+        const request = Promise.withResolvers<PRRefreshOutcome>()
+        pending.push(request)
+        return request.promise
+      }
+      if (route === 'runtime') {
+        store.setState({
+          repos: [
+            {
+              id: 'runtime-repo',
+              path: '/runtime/repo',
+              displayName: 'Runtime repo',
+              badgeColor: 'blue',
+              addedAt: 1,
+              executionHostId: 'runtime:env-1'
+            }
+          ]
+        })
+        runtimeEnvironmentCall.mockImplementation(async () => ({
+          id: 'rpc',
+          ok: true,
+          result: await startRequest()
+        }))
+      } else {
+        mockApi.gh.refreshPRNow.mockImplementation(startRequest)
+      }
+      const path = route === 'runtime' ? '/runtime/repo' : '/local/repo'
+      const branch = `lifetime-${route}-${replacement}-${outcome}`
+      const options = replacement === 'hint' ? { force: true, fallbackPRNumber: 10 } : undefined
+      const first = store.getState().fetchPRForBranch(path, branch, options)
+      await vi.waitFor(() => expect(pending).toHaveLength(1))
+      vi.setSystemTime(2000)
+      const secondOptions =
+        replacement === 'hint' ? { force: true, fallbackPRNumber: 20 } : { force: true }
+      const second = store.getState().fetchPRForBranch(path, branch, secondOptions)
+      await vi.waitFor(() => expect(pending).toHaveLength(2))
+      pending[1].resolve(found(20))
+      await second
+      expect(prRequestGenerations.size).toBe(0)
+
+      vi.setSystemTime(3000)
+      const third = store.getState().fetchPRForBranch(path, branch, secondOptions)
+      await vi.waitFor(() => expect(pending).toHaveLength(3))
+      const activeBefore = [...inflightPRRequests.values()][0]
+      const key = [...inflightPRRequests.keys()][0]
+      expect(activeBefore).toBeDefined()
+      if (outcome === 'rejected') {
+        pending[0].reject(new Error('old lookup failed'))
+      } else if (outcome === 'upstream-error') {
+        pending[0].resolve({
+          kind: 'upstream-error',
+          message: 'old error',
+          errorType: 'unknown',
+          fetchedAt: 3000
+        })
+      } else if (outcome === 'no-pr') {
+        pending[0].resolve({ kind: 'no-pr', fetchedAt: 3000 })
+      } else {
+        pending[0].resolve(found(10))
+      }
+      await first
+      const activeAfter = inflightPRRequests.get(key)
+      const cachedAfterStale = store.getState().prCache[key]?.data?.number
+      const refreshStateAfter = store.getState().prRefreshStates[key]
+      vi.setSystemTime(4000)
+      const follower = store.getState().fetchPRForBranch(path, branch, secondOptions)
+      await vi.waitFor(() => expect(pending.length).toBeGreaterThanOrEqual(3))
+      await Promise.resolve()
+      const requestCount = pending.length
+      pending[2].resolve(found(30))
+      pending[3]?.resolve(found(40))
+      const results = await Promise.all([third, follower])
+
+      expect(activeAfter).toBe(activeBefore)
+      // The stale lookup asked for PR 10; only the live lookup may publish.
+      expect(cachedAfterStale).toBe(20)
+      expect(refreshStateAfter).toBeUndefined()
+      expect(requestCount).toBe(3)
+      expect(results.map((result) => result?.number)).toEqual([30, 30])
+      expect(store.getState().prCache[key]?.data?.number).toBe(30)
+      expect(inflightPRRequests.size).toBe(0)
+      expect(prRequestGenerations.size).toBe(0)
+      if (route === 'runtime') {
+        expect(mockApi.gh.refreshPRNow).not.toHaveBeenCalled()
+      } else {
+        expect(runtimeEnvironmentCall).not.toHaveBeenCalled()
+      }
+    }
+  )
+
+  it('dedupes each branch independently and removes settled generation entries', async () => {
+    const store = createTestStore()
+    const pending = Promise.withResolvers<PRRefreshOutcome>()
+    mockApi.gh.refreshPRNow.mockReturnValue(pending.promise)
+    const calls = ['one', 'two'].flatMap((branch) =>
+      Array.from({ length: 10 }, () =>
+        store.getState().fetchPRForBranch('/repo', branch, { force: true })
+      )
+    )
+    expect(mockApi.gh.refreshPRNow).toHaveBeenCalledTimes(2)
+    expect(prRequestGenerations.size).toBe(2)
+
+    pending.resolve(found(12))
+    await Promise.all(calls)
+
+    expect(inflightPRRequests.size).toBe(0)
+    expect(prRequestGenerations.size).toBe(0)
+  })
+})
diff --git a/src/renderer/src/store/slices/github-project-request-coordination.test.ts b/src/renderer/src/store/slices/github-project-request-coordination.test.ts
index 96e4632e9093..40a64f77ce75 100644
--- a/src/renderer/src/store/slices/github-project-request-coordination.test.ts
+++ b/src/renderer/src/store/slices/github-project-request-coordination.test.ts
@@ -73,7 +73,7 @@ describe('createGitHubSlice.fetchProjectViewTable coordination', () => {
     expect(mockApi.gh.getProjectViewTable).toHaveBeenCalledTimes(1)
   })
 
-  it('lets each forced waiter start after a weaker request settles', async () => {
+  it('shares one fresh request across twenty forced waiters after a weaker request', async () => {
     const store = createTestStore()
     const weak = Promise.withResolvers<GetProjectViewTableResult>()
     mockApi.gh.getProjectViewTable
@@ -81,12 +81,16 @@ describe('createGitHubSlice.fetchProjectViewTable coordination', () => {
       .mockResolvedValue({ ok: true, data: makeTable('forced') })
 
     const first = store.getState().fetchProjectViewTable(request)
-    const forcedOne = store.getState().fetchProjectViewTable(request, { force: true })
-    const forcedTwo = store.getState().fetchProjectViewTable(request, { force: true })
+    const forced = Array.from({ length: 20 }, () =>
+      store.getState().fetchProjectViewTable(request, { force: true })
+    )
     weak.resolve({ ok: true, data: makeTable('weak') })
 
-    await expect(Promise.all([first, forcedOne, forcedTwo])).resolves.toHaveLength(3)
-    expect(mockApi.gh.getProjectViewTable).toHaveBeenCalledTimes(3)
+    await expect(first).resolves.toEqual({ ok: true, data: makeTable('weak') })
+    await expect(Promise.all(forced)).resolves.toEqual(
+      Array.from({ length: 20 }, () => ({ ok: true, data: makeTable('forced') }))
+    )
+    expect(mockApi.gh.getProjectViewTable).toHaveBeenCalledTimes(2)
   })
 
   it('stamps a classified failure onto stale data only when the view key is known', async () => {
diff --git a/src/renderer/src/store/slices/hosted-review-request-lifetime.test.ts b/src/renderer/src/store/slices/hosted-review-request-lifetime.test.ts
new file mode 100644
index 000000000000..747e2fefd03e
--- /dev/null
+++ b/src/renderer/src/store/slices/hosted-review-request-lifetime.test.ts
@@ -0,0 +1,169 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { create } from 'zustand'
+import type { HostedReviewInfo } from '../../../../shared/hosted-review'
+import type { AppState } from '../types'
+import { createHostedReviewSlice } from './hosted-review'
+import {
+  _clearHostedReviewRequestGenerationsForTest,
+  hostedReviewRequestGenerations,
+  inflightHostedReviewRequests
+} from './hosted-review-request-state'
+
+const runtimeRpc = vi.hoisted(() => ({ callRuntimeRpc: vi.fn() }))
+vi.mock('@/runtime/runtime-rpc-client', () => ({
+  callRuntimeRpc: runtimeRpc.callRuntimeRpc,
+  getActiveRuntimeTarget: (settings: AppState['settings']) => {
+    const environmentId = settings?.activeRuntimeEnvironmentId
+    return environmentId ? { kind: 'environment', environmentId } : { kind: 'local' }
+  }
+}))
+
+const forBranch = vi.fn()
+type TestState = Pick<
+  AppState,
+  | 'settings'
+  | 'repos'
+  | 'prCache'
+  | 'hostedReviewCache'
+  | 'fetchHostedReviewForBranch'
+  | 'getHostedReviewCreationEligibility'
+  | 'createHostedReview'
+  | 'createStackedHostedReview'
+>
+
+function makeStore(runtime = false) {
+  return create<TestState>()((...args) => ({
+    settings: null,
+    repos: [
+      {
+        id: 'repo',
+        path: '/repo',
+        displayName: 'Repo',
+        badgeColor: 'blue',
+        addedAt: 1,
+        ...(runtime ? { executionHostId: 'runtime:env-1' } : {})
+      }
+    ],
+    prCache: {},
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: This harness provides every state field read by the hosted-review slice.
+    ...createHostedReviewSlice(...(args as Parameters<typeof createHostedReviewSlice>))
+  }))
+}
+
+function review(number: number): HostedReviewInfo {
+  return {
+    provider: 'gitlab',
+    number,
+    title: `Review ${number}`,
+    state: 'open',
+    url: `https://gitlab.com/group/project/-/merge_requests/${number}`,
+    status: 'success',
+    updatedAt: '2026-09-25T00:00:00Z',
+    mergeable: 'MERGEABLE'
+  }
+}
+
+beforeEach(() => {
+  _clearHostedReviewRequestGenerationsForTest()
+  vi.useFakeTimers()
+  vi.setSystemTime(1000)
+  forBranch.mockReset()
+  runtimeRpc.callRuntimeRpc.mockReset()
+  vi.stubGlobal('window', { api: { hostedReview: { forBranch } } })
+  vi.spyOn(console, 'error').mockImplementation(() => undefined)
+})
+
+afterEach(() => {
+  _clearHostedReviewRequestGenerationsForTest()
+  vi.useRealTimers()
+  vi.restoreAllMocks()
+  vi.unstubAllGlobals()
+})
+
+const cases = [
+  { route: 'local', replacement: 'force', outcome: 'found' },
+  { route: 'local', replacement: 'force', outcome: 'rejected' },
+  { route: 'local', replacement: 'hint', outcome: 'found' },
+  { route: 'runtime', replacement: 'force', outcome: 'found' },
+  { route: 'runtime', replacement: 'force', outcome: 'missing' },
+  { route: 'runtime', replacement: 'hint', outcome: 'rejected' }
+] as const
+
+describe('hosted review lookup ownership after newer settlement', () => {
+  it.each(cases)(
+    'preserves $route lookup after late $outcome with $replacement replacement',
+    async ({ route, replacement, outcome }) => {
+      const store = makeStore(route === 'runtime')
+      const pending: ReturnType<typeof Promise.withResolvers<HostedReviewInfo | null>>[] = []
+      const startRequest = () => {
+        const request = Promise.withResolvers<HostedReviewInfo | null>()
+        pending.push(request)
+        return request.promise
+      }
+      const dispatch = route === 'runtime' ? runtimeRpc.callRuntimeRpc : forBranch
+      dispatch.mockImplementation(startRequest)
+      const branch = `${route}-${replacement}-${outcome}`
+      const firstOptions = replacement === 'hint' ? { force: true, linkedGitLabMR: 10 } : {}
+      const first = store.getState().fetchHostedReviewForBranch('/repo', branch, firstOptions)
+      vi.setSystemTime(2000)
+      const options = replacement === 'hint' ? { force: true, linkedGitLabMR: 20 } : { force: true }
+      const second = store.getState().fetchHostedReviewForBranch('/repo', branch, options)
+      expect(pending).toHaveLength(2)
+      pending[1].resolve(review(20))
+      await second
+      expect(hostedReviewRequestGenerations.size).toBe(0)
+      vi.setSystemTime(3000)
+      const third = store.getState().fetchHostedReviewForBranch('/repo', branch, options)
+      expect(pending).toHaveLength(3)
+      const entry = [...inflightHostedReviewRequests.entries()].at(-1)
+      expect(entry).toBeDefined()
+      if (!entry) {
+        throw new Error('Expected a pending lookup')
+      }
+      const [key, owner] = entry
+      const cacheKey = [...hostedReviewRequestGenerations.keys()][0]
+      const generationBefore = hostedReviewRequestGenerations.get(cacheKey)
+      if (outcome === 'rejected') {
+        pending[0].reject(new Error('Old lookup failed'))
+      } else {
+        pending[0].resolve(outcome === 'missing' ? null : review(10))
+      }
+      await first
+      const currentOwner = inflightHostedReviewRequests.get(key)
+      const generationAfter = hostedReviewRequestGenerations.get(cacheKey)
+      const cachedBefore = store.getState().hostedReviewCache[cacheKey].data
+      const follower = store.getState().fetchHostedReviewForBranch('/repo', branch, options)
+      const requestCount = pending.length
+      pending[2].resolve(review(30))
+      pending[3]?.resolve(review(40))
+      const results = await Promise.all([third, follower])
+
+      expect(currentOwner).toBe(owner)
+      expect(generationAfter).toBe(generationBefore)
+      expect(cachedBefore?.number).toBe(20)
+      expect(requestCount).toBe(3)
+      expect(results.map((result) => result?.number)).toEqual([30, 30])
+      expect(store.getState().hostedReviewCache[cacheKey].data?.number).toBe(30)
+      expect(inflightHostedReviewRequests.size).toBe(0)
+      expect(hostedReviewRequestGenerations.size).toBe(0)
+      expect(route === 'runtime' ? forBranch : runtimeRpc.callRuntimeRpc).not.toHaveBeenCalled()
+    }
+  )
+
+  it('dedupes each branch independently and removes settled generation entries', async () => {
+    const store = makeStore()
+    const pending = Promise.withResolvers<HostedReviewInfo | null>()
+    forBranch.mockReturnValue(pending.promise)
+    const callers = ['one', 'two'].flatMap((branch) =>
+      Array.from({ length: 10 }, () =>
+        store.getState().fetchHostedReviewForBranch('/repo', branch, { force: true })
+      )
+    )
+    expect(forBranch).toHaveBeenCalledTimes(2)
+    expect(hostedReviewRequestGenerations.size).toBe(2)
+    pending.resolve(review(20))
+    await Promise.all(callers)
+    expect(inflightHostedReviewRequests.size).toBe(0)
+    expect(hostedReviewRequestGenerations.size).toBe(0)
+  })
+})
diff --git a/src/renderer/src/store/slices/hosted-review.ts b/src/renderer/src/store/slices/hosted-review.ts
index cad350d986ba..af4dff3e862b 100644
--- a/src/renderer/src/store/slices/hosted-review.ts
+++ b/src/renderer/src/store/slices/hosted-review.ts
@@ -8,6 +8,7 @@ import type {
 } from '../../../../shared/hosted-review'
 import { callRuntimeRpc, getActiveRuntimeTarget } from '@/runtime/runtime-rpc-client'
 import type { AppState } from '../types'
+import { nextLookupGeneration } from '../lookup-generation-sequence'
 import {
   getHostedReviewCacheKey,
   linkedReviewHintKey,
@@ -186,7 +187,7 @@ export const createHostedReviewSlice: StateCreator<AppState, [], [], HostedRevie
 
     const inflightRequest = inflightHostedReviewRequests.get(requestKey)
     const startRequest = (): Promise<HostedReviewInfo | null> => {
-      const generation = (requestGenerations.get(cacheKey) ?? 0) + 1
+      const generation = nextLookupGeneration()
       const requestStartedAt = Date.now()
       const requestStartedEntry = get().hostedReviewCache[cacheKey]
       requestGenerations.set(cacheKey, generation)
diff --git a/src/renderer/src/store/slices/jira-collection-read-actions.ts b/src/renderer/src/store/slices/jira-collection-read-actions.ts
index c604b92a501d..b79d358cea53 100644
--- a/src/renderer/src/store/slices/jira-collection-read-actions.ts
+++ b/src/renderer/src/store/slices/jira-collection-read-actions.ts
@@ -42,19 +42,15 @@ function handleJiraCollectionReadError(
   mutationGeneration: number,
   set: JiraSliceSet,
   get: JiraSliceGet,
-  options?: { abortable?: boolean }
+  options: { abortable?: boolean; currentRequest: boolean }
 ): JiraIssue[] {
-  if (
-    isIntegrationCredentialDecryptionError(error) &&
-    canWriteCollectionResult(scope, mutationGeneration, get)
-  ) {
+  const canWrite =
+    options.currentRequest && canWriteCollectionResult(scope, mutationGeneration, get)
+  if (isIntegrationCredentialDecryptionError(error) && canWrite) {
     if (!shouldRefreshJiraStatusAfterRead(siteId, get().jiraStatus, options)) {
       void get().checkJiraConnection()
     }
-  } else if (
-    looksLikeJiraAuthError(error) &&
-    canWriteCollectionResult(scope, mutationGeneration, get)
-  ) {
+  } else if (looksLikeJiraAuthError(error) && canWrite) {
     markJiraConnectionLost(set, scope)
   }
   if (isIntegrationCredentialDecryptionError(error) || looksLikeJiraAuthError(error)) {
@@ -74,7 +70,7 @@ export function createJiraCollectionReadActions(
         options && 'siteId' in options ? options.siteId : getSelectedJiraSiteId(get().jiraStatus)
       const cacheKey = scopedJiraCacheKey(scope, `${siteId ?? 'default'}::${jql}::${limit}`)
       const cached = get().jiraSearchCache[cacheKey]
-      if (isFreshJiraCacheEntry(cached)) {
+      if (!options?.force && isFreshJiraCacheEntry(cached)) {
         return cached.data ?? []
       }
       const inflight = inflightSearchRequests.get(cacheKey)
@@ -82,6 +78,7 @@ export function createJiraCollectionReadActions(
       const requestMutationGeneration = currentJiraMutationGeneration()
       if (
         !abortable &&
+        !options?.force &&
         inflight &&
         inflight.contextKey === scope.contextKey &&
         inflight.mutationGeneration === requestMutationGeneration
@@ -119,7 +116,10 @@ export function createJiraCollectionReadActions(
             requestMutationGeneration,
             set,
             get,
-            { abortable }
+            {
+              abortable,
+              currentRequest: abortable || inflightSearchRequests.get(cacheKey) === entry
+            }
           )
         })
         .finally(() => {
@@ -153,12 +153,13 @@ export function createJiraCollectionReadActions(
         `${siteId ?? 'default'}::list::${filter}::${limit}`
       )
       const cached = get().jiraSearchCache[cacheKey]
-      if (isFreshJiraCacheEntry(cached)) {
+      if (!options?.force && isFreshJiraCacheEntry(cached)) {
         return cached.data ?? []
       }
       const inflight = inflightListRequests.get(cacheKey)
       const requestMutationGeneration = currentJiraMutationGeneration()
       if (
+        !options?.force &&
         inflight &&
         inflight.contextKey === scope.contextKey &&
         inflight.mutationGeneration === requestMutationGeneration
@@ -189,7 +190,8 @@ export function createJiraCollectionReadActions(
             siteId,
             requestMutationGeneration,
             set,
-            get
+            get,
+            { currentRequest: inflightListRequests.get(cacheKey) === entry }
           )
         })
         .finally(() => {
diff --git a/src/renderer/src/store/slices/jira-slice-contract.ts b/src/renderer/src/store/slices/jira-slice-contract.ts
index c33a3068c7a5..0ffc9d04d365 100644
--- a/src/renderer/src/store/slices/jira-slice-contract.ts
+++ b/src/renderer/src/store/slices/jira-slice-contract.ts
@@ -16,7 +16,8 @@ export type JiraReadOptions = {
   siteId?: JiraSiteSelection | null
 }
 
-export type JiraSearchOptions = JiraReadOptions & { signal?: AbortSignal }
+export type JiraCollectionReadOptions = JiraReadOptions & { force?: boolean }
+export type JiraSearchOptions = JiraCollectionReadOptions & { signal?: AbortSignal }
 export type JiraPatchOptions = { sourceContext?: TaskSourceContext | null }
 export type JiraIssueSummaryLookupOptions = { force?: boolean; signal?: AbortSignal }
 
@@ -61,7 +62,7 @@ export type JiraSlice = {
   listJiraIssues: (
     filter?: JiraIssueFilter,
     limit?: number,
-    options?: JiraReadOptions
+    options?: JiraCollectionReadOptions
   ) => Promise<JiraIssue[]>
   patchJiraIssue: (issueKey: string, patch: Partial<JiraIssue>, options?: JiraPatchOptions) => void
 }
diff --git a/src/renderer/src/store/slices/jira.test.ts b/src/renderer/src/store/slices/jira.test.ts
index 1e6d0fc72349..48f46e2e7e35 100644
--- a/src/renderer/src/store/slices/jira.test.ts
+++ b/src/renderer/src/store/slices/jira.test.ts
@@ -10,6 +10,7 @@ import {
 import { credentialDecryptionMessage } from '../../../../shared/integration-credential-errors'
 import { getProviderRuntimeContextKey } from '@/lib/provider-runtime-context'
 import { createJiraSlice } from './jira'
+import { beginJiraMutation } from './jira-read-coordination'
 
 const jiraStatus = vi.fn()
 const jiraConnect = vi.fn()
@@ -212,6 +213,146 @@ describe('createJiraSlice runtime context', () => {
     expect(store.getState().jiraSearchCache['site-1::list::assigned::30']).toBeUndefined()
   })
 
+  it('forces fresh list and search reads while keeping ordinary cache reads', async () => {
+    const store = createTestStore()
+    store.setState({
+      jiraStatus: { connected: true, viewer: null, selectedSiteId: 'site-1' },
+      jiraSearchCache: {
+        'site-1::list::assigned::30': { data: [issue('ALP-OLD')], fetchedAt: Date.now() },
+        'site-1::project = ALP::30': { data: [issue('ALP-OLD')], fetchedAt: Date.now() }
+      }
+    })
+    jiraListIssues.mockResolvedValueOnce([issue('ALP-LIST-FRESH')])
+    jiraSearchIssues.mockResolvedValueOnce([issue('ALP-SEARCH-FRESH')])
+
+    await expect(store.getState().listJiraIssues('assigned', 30)).resolves.toMatchObject([
+      { key: 'ALP-OLD' }
+    ])
+    await expect(
+      store.getState().listJiraIssues('assigned', 30, { force: true })
+    ).resolves.toMatchObject([{ key: 'ALP-LIST-FRESH' }])
+    await expect(store.getState().searchJiraIssues('project = ALP', 30)).resolves.toMatchObject([
+      { key: 'ALP-OLD' }
+    ])
+    await expect(
+      store.getState().searchJiraIssues('project = ALP', 30, { force: true })
+    ).resolves.toMatchObject([{ key: 'ALP-SEARCH-FRESH' }])
+
+    expect(jiraListIssues).toHaveBeenCalledTimes(1)
+    expect(jiraSearchIssues).toHaveBeenCalledTimes(1)
+    expect(store.getState().jiraSearchCache['site-1::list::assigned::30']?.data).toMatchObject([
+      { key: 'ALP-LIST-FRESH' }
+    ])
+    expect(store.getState().jiraSearchCache['site-1::project = ALP::30']?.data).toMatchObject([
+      { key: 'ALP-SEARCH-FRESH' }
+    ])
+  })
+
+  it('reuses ordinary in-flight reads but force starts a fresh list and search request', async () => {
+    const store = createTestStore()
+    store.setState({ jiraStatus: { connected: true, viewer: null, selectedSiteId: 'site-1' } })
+    const listOld = deferred<JiraIssue[]>()
+    const listFresh = deferred<JiraIssue[]>()
+    const searchOld = deferred<JiraIssue[]>()
+    const searchFresh = deferred<JiraIssue[]>()
+    jiraListIssues.mockReturnValueOnce(listOld.promise).mockReturnValueOnce(listFresh.promise)
+    jiraSearchIssues.mockReturnValueOnce(searchOld.promise).mockReturnValueOnce(searchFresh.promise)
+
+    const listRequest = store.getState().listJiraIssues('assigned', 30)
+    const listReuse = store.getState().listJiraIssues('assigned', 30)
+    const searchRequest = store.getState().searchJiraIssues('project = ALP', 30)
+    const searchReuse = store.getState().searchJiraIssues('project = ALP', 30)
+    await Promise.resolve()
+    expect(jiraListIssues).toHaveBeenCalledTimes(1)
+    expect(jiraSearchIssues).toHaveBeenCalledTimes(1)
+
+    const listRefresh = store.getState().listJiraIssues('assigned', 30, { force: true })
+    const searchRefresh = store.getState().searchJiraIssues('project = ALP', 30, { force: true })
+    await Promise.resolve()
+    expect(jiraListIssues).toHaveBeenCalledTimes(2)
+    expect(jiraSearchIssues).toHaveBeenCalledTimes(2)
+
+    listFresh.resolve([issue('ALP-LIST-FRESH')])
+    searchFresh.resolve([issue('ALP-SEARCH-FRESH')])
+    await expect(listRefresh).resolves.toMatchObject([{ key: 'ALP-LIST-FRESH' }])
+    await expect(searchRefresh).resolves.toMatchObject([{ key: 'ALP-SEARCH-FRESH' }])
+    listOld.resolve([issue('ALP-LIST-LATE')])
+    searchOld.resolve([issue('ALP-SEARCH-LATE')])
+    await expect(listRequest).resolves.toMatchObject([{ key: 'ALP-LIST-LATE' }])
+    await expect(listReuse).resolves.toMatchObject([{ key: 'ALP-LIST-LATE' }])
+    await expect(searchRequest).resolves.toMatchObject([{ key: 'ALP-SEARCH-LATE' }])
+    await expect(searchReuse).resolves.toMatchObject([{ key: 'ALP-SEARCH-LATE' }])
+
+    expect(store.getState().jiraSearchCache['site-1::list::assigned::30']?.data).toMatchObject([
+      { key: 'ALP-LIST-FRESH' }
+    ])
+    expect(store.getState().jiraSearchCache['site-1::project = ALP::30']?.data).toMatchObject([
+      { key: 'ALP-SEARCH-FRESH' }
+    ])
+  })
+
+  it.each(['list', 'search'] as const)(
+    'ignores an older %s auth failure after a forced refresh succeeds',
+    async (kind) => {
+      const store = createTestStore()
+      store.setState({ jiraStatus: { connected: true, viewer: null, selectedSiteId: 'site-1' } })
+      let rejectOld: (error: Error) => void = () => {}
+      const old = new Promise<JiraIssue[]>((_resolve, reject) => {
+        rejectOld = reject
+      })
+      const service = kind === 'list' ? jiraListIssues : jiraSearchIssues
+      service.mockReturnValueOnce(old).mockResolvedValueOnce([issue('ALP-FRESH')])
+      const read = (force = false) =>
+        kind === 'list'
+          ? store.getState().listJiraIssues('assigned', 30, { force })
+          : store.getState().searchJiraIssues('project = ALP', 30, { force })
+      const previous = read()
+      await expect(read(true)).resolves.toMatchObject([{ key: 'ALP-FRESH' }])
+      rejectOld(new Error('401 Unauthorized'))
+      await expect(previous).resolves.toEqual([])
+      expect(store.getState().jiraStatus.connected).toBe(true)
+      expect(store.getState().jiraConnectionRevisions).toEqual({})
+    }
+  )
+
+  it('rejects a forced late write after the Jira mutation generation changes', async () => {
+    const store = createTestStore()
+    store.setState({ jiraStatus: { connected: true, viewer: null, selectedSiteId: 'site-1' } })
+    const pending = deferred<JiraIssue[]>()
+    jiraListIssues.mockReturnValueOnce(pending.promise)
+
+    const request = store.getState().listJiraIssues('assigned', 30, { force: true })
+    await Promise.resolve()
+    beginJiraMutation()
+    pending.resolve([issue('ALP-STALE')])
+    await expect(request).resolves.toMatchObject([{ key: 'ALP-STALE' }])
+    expect(store.getState().jiraSearchCache['site-1::list::assigned::30']).toBeUndefined()
+  })
+
+  it('does not cache a late abortable search response', async () => {
+    const store = createTestStore()
+    store.setState({ jiraStatus: { connected: true, viewer: null, selectedSiteId: 'site-1' } })
+    const pending = deferred<JiraIssue[]>()
+    let signal: AbortSignal | undefined
+    jiraSearchIssues.mockImplementationOnce(
+      (_settings: unknown, _jql: string, _limit: number, _site: string, provided: AbortSignal) => {
+        signal = provided
+        return pending.promise
+      }
+    )
+    const controller = new AbortController()
+    const request = store
+      .getState()
+      .searchJiraIssues('project = ALP', 30, { signal: controller.signal })
+    await Promise.resolve()
+    const rejection = expect(request).rejects.toMatchObject({ name: 'AbortError' })
+    controller.abort()
+    pending.resolve([issue('ALP-LATE')])
+    await rejection
+    expect(signal?.aborted).toBe(true)
+    expect(store.getState().jiraSearchCache['site-1::project = ALP::30']).toBeUndefined()
+  })
+
   it('keeps isolated status failures from mutating the focused Jira Settings state', async () => {
     const store = createTestStore()
     const focusedStatus = {
diff --git a/src/renderer/src/store/slices/repos-catalog-notifications.test.ts b/src/renderer/src/store/slices/repos-catalog-notifications.test.ts
new file mode 100644
index 000000000000..88fbd339ec3e
--- /dev/null
+++ b/src/renderer/src/store/slices/repos-catalog-notifications.test.ts
@@ -0,0 +1,229 @@
+import { afterEach, beforeEach, expect, it, vi } from 'vitest'
+import type { FolderWorkspace } from '../../../../shared/folder-workspace-types'
+import type { ProjectGroup } from '../../../../shared/project-group-types'
+import { createTestStore } from './store-test-helpers'
+
+const group: ProjectGroup = {
+  id: 'group-1',
+  name: 'Group',
+  parentPath: '/parent',
+  parentGroupId: null,
+  createdFrom: 'manual',
+  tabOrder: 0,
+  isCollapsed: false,
+  color: null,
+  createdAt: 1,
+  updatedAt: 3
+}
+const folder: FolderWorkspace = {
+  id: 'folder-1',
+  projectGroupId: group.id,
+  name: 'Folder',
+  folderPath: '/parent/folder',
+  linkedTask: null,
+  comment: '',
+  isArchived: false,
+  isUnread: false,
+  isPinned: false,
+  sortOrder: 0,
+  lastActivityAt: 1,
+  createdAt: 1,
+  updatedAt: 3
+}
+const groupsList = vi.fn<() => Promise<ProjectGroup[]>>()
+const foldersList = vi.fn<() => Promise<FolderWorkspace[]>>()
+const folderUpdate = vi.fn<Window['api']['folderWorkspaces']['update']>()
+type TestStore = ReturnType<typeof createTestStore>
+type CatalogCase = {
+  label: string
+  catalog: 'projectGroups' | 'folderWorkspaces'
+  refresh: (store: TestStore) => Promise<void>
+}
+const cases: CatalogCase[] = [
+  {
+    label: 'selected groups',
+    catalog: 'projectGroups',
+    refresh: (s) => s.getState().fetchProjectGroups()
+  },
+  {
+    label: 'all-host local groups',
+    catalog: 'projectGroups',
+    refresh: (s) => s.getState().fetchProjectGroupsForAllHosts({ remoteHosts: 'skip' })
+  },
+  {
+    label: 'selected folders',
+    catalog: 'folderWorkspaces',
+    refresh: (s) => s.getState().fetchFolderWorkspaces()
+  },
+  {
+    label: 'all-host local folders',
+    catalog: 'folderWorkspaces',
+    refresh: (s) => s.getState().fetchFolderWorkspacesForAllHosts({ remoteHosts: 'skip' })
+  }
+]
+
+beforeEach(() => {
+  groupsList.mockReset().mockImplementation(async () => structuredClone([group]))
+  foldersList.mockReset().mockImplementation(async () => structuredClone([folder]))
+  folderUpdate.mockReset()
+  vi.stubGlobal('window', {
+    api: {
+      projectGroups: { list: groupsList },
+      folderWorkspaces: { list: foldersList, update: folderUpdate },
+      runtimeEnvironments: { list: async () => [] }
+    },
+    dispatchEvent: vi.fn()
+  })
+  vi.spyOn(console, 'error').mockImplementation(() => {})
+})
+afterEach(() => {
+  vi.restoreAllMocks()
+  vi.unstubAllGlobals()
+})
+
+function seed(): TestStore {
+  const store = createTestStore()
+  store.setState({
+    projectGroups: [{ ...group, executionHostId: 'local' }],
+    folderWorkspaces: [{ ...folder, executionHostId: 'local' }],
+    folderWorkspacePathStatuses: {
+      cached: {
+        status: { path: folder.folderPath, exists: true },
+        checkedAt: 1,
+        requestSnapshot: 'snapshot'
+      }
+    }
+  })
+  return store
+}
+
+it.each(cases)('does not notify for ten equal $label refreshes', async ({ refresh, catalog }) => {
+  const store = seed()
+  const initial = store.getState()
+  const changed = vi.fn()
+  const unsubscribe = store.subscribe(changed)
+  for (let index = 0; index < 10; index += 1) {
+    await refresh(store)
+  }
+  unsubscribe()
+  expect(changed).not.toHaveBeenCalled()
+  expect(store.getState()).toBe(initial)
+  expect(store.getState()[catalog]).toBe(initial[catalog])
+  expect(store.getState().folderWorkspacePathStatuses).toBe(initial.folderWorkspacePathStatuses)
+})
+
+it.each(cases)(
+  'publishes changed $label and invalidates path statuses',
+  async ({ refresh, catalog }) => {
+    const store = seed()
+    groupsList.mockResolvedValue([{ ...group, name: 'Changed group' }])
+    foldersList.mockResolvedValue([{ ...folder, name: 'Changed folder' }])
+    const changed = vi.fn()
+    const unsubscribe = store.subscribe(changed)
+    await refresh(store)
+    unsubscribe()
+    expect(changed).toHaveBeenCalledOnce()
+    expect(store.getState()[catalog][0]?.name).toMatch(/^Changed /)
+    expect(store.getState().folderWorkspacePathStatuses).toEqual({})
+  }
+)
+
+it.each(cases)('retains state after a failed $label read', async ({ refresh }) => {
+  const store = seed()
+  const initial = store.getState()
+  groupsList.mockRejectedValue(new Error('offline'))
+  foldersList.mockRejectedValue(new Error('offline'))
+  const changed = vi.fn()
+  const unsubscribe = store.subscribe(changed)
+  await refresh(store)
+  unsubscribe()
+  expect(store.getState()).toBe(initial)
+  expect(changed).not.toHaveBeenCalled()
+})
+
+it.each(cases)(
+  'fences an older $label response after a newer no-op response',
+  async ({ refresh, catalog }) => {
+    const store = seed()
+    const initial = store.getState()
+    const olderGroups = Promise.withResolvers<ProjectGroup[]>()
+    const olderFolders = Promise.withResolvers<FolderWorkspace[]>()
+    if (catalog === 'projectGroups') {
+      groupsList.mockReturnValueOnce(olderGroups.promise)
+    } else {
+      foldersList.mockReturnValueOnce(olderFolders.promise)
+    }
+    const older = refresh(store)
+    const changed = vi.fn()
+    const unsubscribe = store.subscribe(changed)
+    await refresh(store)
+    olderGroups.resolve([{ ...group, name: 'Obsolete group' }])
+    olderFolders.resolve([{ ...folder, name: 'Obsolete folder' }])
+    await older
+    unsubscribe()
+    expect(store.getState()).toBe(initial)
+    expect(changed).not.toHaveBeenCalled()
+  }
+)
+
+it.each(cases.filter((entry) => entry.catalog === 'folderWorkspaces'))(
+  'keeps update revision fencing after an equal $label response',
+  async ({ refresh }) => {
+    const store = seed()
+    const pending = Promise.withResolvers<FolderWorkspace>()
+    folderUpdate.mockReturnValueOnce(pending.promise)
+    const update = store.getState().updateFolderWorkspace(folder.id, { isUnread: true })
+    const initial = store.getState()
+    await refresh(store)
+    expect(store.getState()).toBe(initial)
+    pending.resolve({ ...folder, isUnread: true, updatedAt: 2 })
+    await update
+    expect(store.getState().folderWorkspaces[0]?.isUnread).toBe(false)
+    expect(store.getState().folderWorkspaces[0]?.updatedAt).toBe(3)
+  }
+)
+
+it('accepts a newer update after an equal catalog response', async () => {
+  const store = seed()
+  const pending = Promise.withResolvers<FolderWorkspace>()
+  folderUpdate.mockReturnValueOnce(pending.promise)
+  const update = store.getState().updateFolderWorkspace(folder.id, { isUnread: true })
+  await store.getState().fetchFolderWorkspaces()
+  pending.resolve({ ...folder, isUnread: true, updatedAt: 4 })
+  await update
+  expect(store.getState().folderWorkspaces[0]?.isUnread).toBe(true)
+  expect(store.getState().folderWorkspaces[0]?.updatedAt).toBe(4)
+})
+
+it('still clears restored folder owners after a successful all-host refresh', async () => {
+  const store = seed()
+  store.setState({
+    restoredRuntimeHostIdByWorkspaceSessionKey: {
+      'folder:folder-1': 'runtime:retired',
+      unrelated: 'runtime:kept'
+    }
+  })
+  const changed = vi.fn()
+  const unsubscribe = store.subscribe(changed)
+  await store.getState().fetchFolderWorkspacesForAllHosts()
+  unsubscribe()
+  expect(changed).toHaveBeenCalledOnce()
+  expect(store.getState().restoredRuntimeHostIdByWorkspaceSessionKey).toEqual({
+    unrelated: 'runtime:kept'
+  })
+})
+
+it('does not publish an all-host refresh whose restored owners need no cleanup', async () => {
+  const store = seed()
+  store.setState({ restoredRuntimeHostIdByWorkspaceSessionKey: { unrelated: 'runtime:kept' } })
+  const initial = store.getState()
+  const changed = vi.fn()
+  const unsubscribe = store.subscribe(changed)
+  await store.getState().fetchFolderWorkspacesForAllHosts()
+  unsubscribe()
+  expect(changed).not.toHaveBeenCalled()
+  expect(store.getState()).toBe(initial)
+  expect(store.getState().restoredRuntimeHostIdByWorkspaceSessionKey).toBe(
+    initial.restoredRuntimeHostIdByWorkspaceSessionKey
+  )
+})
diff --git a/src/renderer/src/store/slices/runtime-environment-ssh-selectors.ts b/src/renderer/src/store/slices/runtime-environment-ssh-selectors.ts
index 7cd1942db3a1..90f092220997 100644
--- a/src/renderer/src/store/slices/runtime-environment-ssh-selectors.ts
+++ b/src/renderer/src/store/slices/runtime-environment-ssh-selectors.ts
@@ -60,6 +60,24 @@ export function selectRuntimeAwareSshError(
   return bucket.connectionStates.get(targetId)?.error ?? null
 }
 
+export function selectRuntimeAwareSshConnectionGeneration(
+  state: RuntimeAwareSshReadState,
+  environmentId: string | null,
+  targetId: string
+): number | null {
+  if (environmentId === null) {
+    return state.sshConnectionStates.get(targetId)?.connectionGeneration ?? null
+  }
+  if (!isEnvironmentReachable(state, environmentId)) {
+    return null
+  }
+  const bucket = state.sshStateByEnvironment.get(environmentId)
+  if (!bucket?.targetsHydrated) {
+    return null
+  }
+  return bucket.connectionStates.get(targetId)?.connectionGeneration ?? null
+}
+
 export function selectRuntimeAwareSshTargetLabel(
   state: RuntimeAwareSshReadState,
   environmentId: string | null,
diff --git a/src/renderer/src/store/slices/runtime-environment-ssh.ts b/src/renderer/src/store/slices/runtime-environment-ssh.ts
index 3efbf0e78053..e6b2f30db615 100644
--- a/src/renderer/src/store/slices/runtime-environment-ssh.ts
+++ b/src/renderer/src/store/slices/runtime-environment-ssh.ts
@@ -4,6 +4,7 @@ import type { SshConnectionState, SshTargetSummary } from '../../../../shared/ss
 import { sanitizeSshTargetGeneration } from '../../../../shared/ssh-target-generation'
 import { sshConnectionStatesEqual, sshTargetLabelsEqual } from './ssh-target-cleanup'
 export {
+  selectRuntimeAwareSshConnectionGeneration,
   selectRuntimeAwareSshError,
   selectRuntimeAwareSshStatus,
   selectRuntimeAwareSshTargetLabel,
diff --git a/src/renderer/src/store/slices/settings.ts b/src/renderer/src/store/slices/settings.ts
index 8189ec5e5f97..55821c106673 100644
--- a/src/renderer/src/store/slices/settings.ts
+++ b/src/renderer/src/store/slices/settings.ts
@@ -35,6 +35,7 @@ import {
 import * as ownerHydration from './settings-owner-hydration-publication'
 import { persistVisibilityAwareSettings } from './worktree-visibility-settings-write'
 import { getSettingsFocusedExecutionHostId } from '../../../../shared/execution-host'
+import { createBrowserUuid } from '@/lib/browser-uuid'
 
 export type SettingsSlice = SettingsSearchState & {
   settings: GlobalSettings | null
@@ -57,13 +58,6 @@ function normalizeRuntimeEnvironmentId(value: string | null | undefined): string
   return trimmed ? trimmed : null
 }
 
-function createOpenInApplicationId(): string {
-  return (
-    globalThis.crypto?.randomUUID?.() ??
-    `open-in-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}`
-  )
-}
-
 function normalizeSettingsUpdates(
   updates: Partial<GlobalSettings>,
   currentSettings: GlobalSettings | null
@@ -97,7 +91,7 @@ function normalizeSettingsUpdates(
   }
   if ('openInApplications' in updates) {
     sanitizedUpdates.openInApplications = normalizeOpenInApplications(updates.openInApplications, {
-      createId: createOpenInApplicationId
+      createId: createBrowserUuid
     })
   }
   if ('disabledTuiAgents' in updates) {
diff --git a/src/renderer/src/store/slices/ssh-target-cleanup.test.ts b/src/renderer/src/store/slices/ssh-target-cleanup.test.ts
index 91872ff245e2..b3b7323ce206 100644
--- a/src/renderer/src/store/slices/ssh-target-cleanup.test.ts
+++ b/src/renderer/src/store/slices/ssh-target-cleanup.test.ts
@@ -127,4 +127,17 @@ describe('SSH target cleanup tab map', () => {
     store.getState().clearRemovedSshTargetState('removed')
     expect(store.getState().tabsByWorktree).toBe(tabsByWorktree)
   })
+
+  it('clears pending split edits owned by the removed target', () => {
+    const store = createTestStore()
+    const removed = { targetId: 'removed', root: null }
+    const retained = { targetId: 'other', root: null }
+    store.setState({
+      pendingDirectSshLayoutEditsByTabId: { removedTab: removed, otherTab: retained }
+    })
+
+    const patch = buildRemovedSshTargetCleanupPatch(store.getState(), 'removed')
+
+    expect(patch?.pendingDirectSshLayoutEditsByTabId).toEqual({ otherTab: retained })
+  })
 })
diff --git a/src/renderer/src/store/slices/ssh-target-cleanup.ts b/src/renderer/src/store/slices/ssh-target-cleanup.ts
index 9cac633bedd4..859fde228f66 100644
--- a/src/renderer/src/store/slices/ssh-target-cleanup.ts
+++ b/src/renderer/src/store/slices/ssh-target-cleanup.ts
@@ -227,6 +227,14 @@ export function buildRemovedSshTargetCleanupPatch(
     targetId,
     targetTabIds
   )
+  const nextPendingLayoutEdits = Object.fromEntries(
+    Object.entries(state.pendingDirectSshLayoutEditsByTabId ?? {}).filter(
+      ([, entry]) => entry.targetId !== targetId
+    )
+  )
+  const removedPendingLayoutEdits =
+    Object.keys(nextPendingLayoutEdits).length !==
+    Object.keys(state.pendingDirectSshLayoutEditsByTabId ?? {}).length
 
   const nextDeferredTargets = state.deferredSshReconnectTargets.filter((id) => id !== targetId)
   const nextTransientClearedConnections = {
@@ -273,7 +281,8 @@ export function buildRemovedSshTargetCleanupPatch(
     removedPendingReconnect ||
     removedPaneRetries ||
     removedLiveBindings ||
-    removedRetryHistory
+    removedRetryHistory ||
+    removedPendingLayoutEdits
   if (!changed) {
     return null
   }
@@ -304,6 +313,9 @@ export function buildRemovedSshTargetCleanupPatch(
     ...(removedPendingReconnect ? { pendingReconnectPtyIdByTabId: nextPendingReconnect } : {}),
     ...(removedPaneRetries ? { directSshPaneRetryByTabId: nextPaneRetries } : {}),
     ...(removedLiveBindings ? { directSshLivePtyBindingByTabId: nextLiveBindings } : {}),
-    ...(removedRetryHistory ? { directSshPaneRetryHistoryByTabId: nextRetryHistory } : {})
+    ...(removedRetryHistory ? { directSshPaneRetryHistoryByTabId: nextRetryHistory } : {}),
+    ...(removedPendingLayoutEdits
+      ? { pendingDirectSshLayoutEditsByTabId: nextPendingLayoutEdits }
+      : {})
   }
 }
diff --git a/src/renderer/src/store/slices/ssh.ts b/src/renderer/src/store/slices/ssh.ts
index 36142d0c1c60..ddeaf415fd50 100644
--- a/src/renderer/src/store/slices/ssh.ts
+++ b/src/renderer/src/store/slices/ssh.ts
@@ -29,6 +29,9 @@ export type SshCredentialRequest = {
   targetId: string
   kind: 'passphrase' | 'password' | 'keyboard-interactive'
   detail: string
+  /** RFC 4256 echo flag for keyboard-interactive prompts: when true the
+   * server allows the typed response to be shown. */
+  echo?: boolean
 }
 
 export type SshSlice = {
diff --git a/src/renderer/src/store/slices/tabs/tabs-close-actions.ts b/src/renderer/src/store/slices/tabs/tabs-close-actions.ts
index 35a7be70ced4..b9187c8b0d8d 100644
--- a/src/renderer/src/store/slices/tabs/tabs-close-actions.ts
+++ b/src/renderer/src/store/slices/tabs/tabs-close-actions.ts
@@ -64,7 +64,6 @@ export function createTabsCloseActions(
             activeRuntimeEnvironmentId: getRuntimeEnvironmentIdForWorktree(state, worktreeId)
           }),
           worktreeId,
-          tabId: tab.id,
           sessionId: tab.entityId,
           provisional
         })
diff --git a/src/renderer/src/store/slices/tabs/tabs-create-actions.ts b/src/renderer/src/store/slices/tabs/tabs-create-actions.ts
index bc3f08558a13..2149b84cbc13 100644
--- a/src/renderer/src/store/slices/tabs/tabs-create-actions.ts
+++ b/src/renderer/src/store/slices/tabs/tabs-create-actions.ts
@@ -12,7 +12,13 @@ import {
   sanitizeRecentTabIds,
   updateGroup
 } from '../tab-group-state'
-import { canReplacePreviewContentType } from './tabs-tab-order'
+import {
+  applyTabOrderSortValues,
+  canReplacePreviewContentType,
+  insertTabIdIntoOrder
+} from './tabs-tab-order'
+import { resolveUnifiedTabCreatePlacement } from './tabs-create-placement'
+import { folderWorkspaceToWorktree } from '../../../../../shared/folder-workspace-worktree'
 
 export function createTabsCreateActions(
   set: TabsSliceSet,
@@ -23,13 +29,26 @@ export function createTabsCreateActions(
       const id = init?.id ?? createBrowserUuid()
       let created!: Tab
       set((state) => {
+        const existingTabs = state.unifiedTabsByWorktree[worktreeId] ?? []
+        const placement = resolveUnifiedTabCreatePlacement({
+          groups: state.groupsByWorktree[worktreeId] ?? [],
+          tabs: existingTabs,
+          activeGroupId: state.activeGroupIdByWorktree[worktreeId],
+          targetGroupId: init?.targetGroupId,
+          afterTabId: init?.afterTabId,
+          executionHostId: init?.executionHostId,
+          lookupWorktrees: () =>
+            [
+              ...(state.allWorktrees?.() ?? []),
+              ...(state.folderWorkspaces ?? []).map(folderWorkspaceToWorktree)
+            ].filter((worktree) => worktree.id === worktreeId)
+        })
         const { group, groupsByWorktree, activeGroupIdByWorktree } = ensureGroup(
           state.groupsByWorktree,
           state.activeGroupIdByWorktree,
           worktreeId,
-          init?.targetGroupId ?? state.activeGroupIdByWorktree[worktreeId]
+          placement.groupId
         )
-        const existingTabs = state.unifiedTabsByWorktree[worktreeId] ?? []
 
         let nextTabs = existingTabs
         let nextOrder = dedupeTabOrder(group.tabOrder)
@@ -50,6 +69,17 @@ export function createTabsCreateActions(
         const createdAt = Date.now()
         const executionHostId =
           init?.executionHostId ?? getActiveExecutionHostIdForWorktree(state, worktreeId)
+        // Why: preview replacement may have removed the anchor; the order then appends in-partition.
+        nextOrder = insertTabIdIntoOrder(
+          nextOrder,
+          nextTabs,
+          id,
+          init?.isPinned === true,
+          placement.anchorTabId
+        )
+        const insertedIndex = nextOrder.indexOf(id)
+        // Why always: preview replacement can leave a gap, so an append alone would reuse a sibling's sortOrder.
+        nextTabs = applyTabOrderSortValues(nextTabs, nextOrder)
         created = {
           id,
           entityId: init?.entityId ?? id,
@@ -67,7 +97,7 @@ export function createTabsCreateActions(
             : {}),
           customLabel: init?.customLabel ?? null,
           color: init?.color ?? null,
-          sortOrder: nextOrder.length,
+          sortOrder: insertedIndex,
           createdAt,
           // Why: creating an active tab is a focus event; Cmd+J recency reads lastFocusedAt.
           ...(shouldActivate ? { lastFocusedAt: createdAt } : {}),
@@ -75,7 +105,6 @@ export function createTabsCreateActions(
           isPinned: init?.isPinned
         }
 
-        nextOrder = dedupeTabOrder([...nextOrder, created.id])
         const nextActiveTabId = shouldActivate ? created.id : (group.activeTabId ?? created.id)
         const sanitizedRecent = sanitizeRecentTabIds(group.recentTabIds, nextOrder)
         // Why: automation-created browser tabs must paint without stealing the visible group selection from the user's current tab.
diff --git a/src/renderer/src/store/slices/tabs/tabs-create-placement.ts b/src/renderer/src/store/slices/tabs/tabs-create-placement.ts
new file mode 100644
index 000000000000..f354b30e8026
--- /dev/null
+++ b/src/renderer/src/store/slices/tabs/tabs-create-placement.ts
@@ -0,0 +1,73 @@
+import type { Tab, TabGroup } from '../../../../../shared/tab-types'
+import type { ExecutionHostId } from '../../../../../shared/execution-host'
+import type { Worktree } from '../../../../../shared/worktree/types'
+import { isExecutionHostAliasForWorktree } from '@/lib/worktree-execution-host-alias'
+
+type WorktreeHostAliases = Pick<Worktree, 'hostId' | 'runtimeOwnerEnvironmentId'>
+
+export type UnifiedTabCreatePlacementInput = {
+  groups: readonly TabGroup[]
+  tabs: readonly Tab[]
+  activeGroupId: string | undefined
+  targetGroupId?: string
+  afterTabId?: string
+  /** The caller's verified host; an anchor owned by another host is foreign. */
+  executionHostId?: ExecutionHostId
+  /** Records sharing this worktree id; host aliases only count when exactly one exists. */
+  lookupWorktrees: () => readonly WorktreeHostAliases[]
+}
+
+export type UnifiedTabCreatePlacement = {
+  /** A live group, or undefined to let ensureGroup pick its first-group/new-root fallback. */
+  groupId: string | undefined
+  anchorTabId: string | undefined
+}
+
+function isAnchorHostCompatible(
+  anchorHostId: ExecutionHostId | undefined,
+  input: UnifiedTabCreatePlacementInput
+): boolean {
+  const requestedHostId = input.executionHostId
+  if (!requestedHostId || !anchorHostId || anchorHostId === requestedHostId) {
+    return true
+  }
+  const worktrees = input.lookupWorktrees()
+  return (
+    worktrees.length === 1 &&
+    isExecutionHostAliasForWorktree(requestedHostId, worktrees[0]) &&
+    isExecutionHostAliasForWorktree(anchorHostId, worktrees[0])
+  )
+}
+
+function resolveAnchor(input: UnifiedTabCreatePlacementInput): Tab | undefined {
+  if (!input.afterTabId) {
+    return undefined
+  }
+  const matches = input.tabs.filter((tab) => tab.id === input.afterTabId)
+  if (matches.length !== 1) {
+    return undefined
+  }
+  const anchor = matches[0]
+  const group = input.groups.find((candidate) => candidate.id === anchor.groupId)
+  if (!group?.tabOrder.includes(anchor.id)) {
+    return undefined
+  }
+  return isAnchorHostCompatible(anchor.executionHostId, input) ? anchor : undefined
+}
+
+/** Resolve a new tab's destination group and the live anchor it should follow there. */
+export function resolveUnifiedTabCreatePlacement(
+  input: UnifiedTabCreatePlacementInput
+): UnifiedTabCreatePlacement {
+  const isLiveGroup = (groupId: string | undefined): groupId is string =>
+    Boolean(groupId && input.groups.some((group) => group.id === groupId))
+  const anchor = resolveAnchor(input)
+  // Why validate first: an expired requested id must fall to the active group, not ensureGroup's first group.
+  const groupId = isLiveGroup(input.targetGroupId)
+    ? input.targetGroupId
+    : (anchor?.groupId ?? (isLiveGroup(input.activeGroupId) ? input.activeGroupId : undefined))
+  return {
+    groupId,
+    anchorTabId: anchor && anchor.groupId === groupId ? anchor.id : undefined
+  }
+}
diff --git a/src/renderer/src/store/slices/tabs/tabs-slice-contract.ts b/src/renderer/src/store/slices/tabs/tabs-slice-contract.ts
index 6291588c27b2..efb2da8addae 100644
--- a/src/renderer/src/store/slices/tabs/tabs-slice-contract.ts
+++ b/src/renderer/src/store/slices/tabs/tabs-slice-contract.ts
@@ -35,6 +35,8 @@ export type TabsSlice = {
         | 'isPinned'
       > & {
         targetGroupId: string
+        /** Client-local unified tab id to insert after; an explicit targetGroupId still wins. */
+        afterTabId: string
         activate: boolean
         recordInteraction: boolean
       }
diff --git a/src/renderer/src/store/slices/tabs/tabs-tab-order.ts b/src/renderer/src/store/slices/tabs/tabs-tab-order.ts
index 236465ba6d12..b62e85fdb085 100644
--- a/src/renderer/src/store/slices/tabs/tabs-tab-order.ts
+++ b/src/renderer/src/store/slices/tabs/tabs-tab-order.ts
@@ -17,10 +17,35 @@ export function applyTabOrderSortValues(tabs: Tab[], tabOrder: string[]): Tab[]
   const orderMap = new Map(tabOrder.map((id, index) => [id, index]))
   return tabs.map((tab) => {
     const sortOrder = orderMap.get(tab.id)
-    return sortOrder === undefined ? tab : { ...tab, sortOrder }
+    return sortOrder === undefined || sortOrder === tab.sortOrder ? tab : { ...tab, sortOrder }
   })
 }
 
+/**
+ * Insert `tabId` after `anchorTabId` when both share a pin partition; otherwise at the end of the
+ * new tab's partition. Siblings keep their relative order.
+ */
+export function insertTabIdIntoOrder(
+  tabOrder: readonly string[],
+  tabs: readonly Tab[],
+  tabId: string,
+  isPinned: boolean,
+  anchorTabId?: string
+): string[] {
+  const tabById = new Map(tabs.map((tab) => [tab.id, tab]))
+  const order = dedupeTabOrder([...tabOrder]).filter((id) => id !== tabId)
+  const firstUnpinnedIndex = order.findIndex((id) => !tabById.get(id)?.isPinned)
+  const pinnedPrefixEnd = firstUnpinnedIndex === -1 ? order.length : firstUnpinnedIndex
+  const anchorIndex = anchorTabId ? order.indexOf(anchorTabId) : -1
+  const anchorIsPinned = anchorIndex !== -1 && tabById.get(order[anchorIndex])?.isPinned === true
+  let index = isPinned ? pinnedPrefixEnd : order.length
+  if (anchorIndex !== -1) {
+    index = anchorIsPinned === isPinned ? anchorIndex + 1 : pinnedPrefixEnd
+  }
+  order.splice(index, 0, tabId)
+  return order
+}
+
 export function isReplaceablePreviewContentType(contentType: Tab['contentType']): boolean {
   return (
     contentType === 'editor' ||
diff --git a/src/renderer/src/store/slices/terminal-write-identity-bailouts.test.ts b/src/renderer/src/store/slices/terminal-write-identity-bailouts.test.ts
index 14aecc47129d..e559829a29fd 100644
--- a/src/renderer/src/store/slices/terminal-write-identity-bailouts.test.ts
+++ b/src/renderer/src/store/slices/terminal-write-identity-bailouts.test.ts
@@ -14,7 +14,7 @@
  */
 import { describe, expect, it } from 'vitest'
 import type { TerminalLayoutSnapshot } from '../../../../shared/terminal-tab-types'
-import { createTestStore } from './store-test-helpers'
+import { createTestStore, makeTab, makeWorktree } from './store-test-helpers'
 
 const REPEATS = 1_000
 
@@ -151,6 +151,7 @@ describe('setTabLayout identity bailout', () => {
     const mutations: Partial<TerminalLayoutSnapshot>[] = [
       { activeLeafId: 'leaf-b' },
       { expandedLeafId: 'leaf-a' },
+      { chatLeafId: 'leaf-b' },
       { titlesByLeafId: { 'leaf-a': 'test' } },
       { ptyIdsByLeafId: { 'leaf-a': 'pty-a', 'leaf-b': 'pty-c' } },
       { buffersByLeafId: { 'leaf-a': 'scrollback' } },
@@ -224,4 +225,73 @@ describe('setTabLayout identity bailout', () => {
     unsubscribe()
     expect(wakeups).toBe(0)
   })
+
+  it('guards SSH acknowledgements by captured edit identity and target', () => {
+    const store = createTestStore()
+    const worktreeA = 'repo-a::/tmp/a'
+    const worktreeB = 'repo-b::/tmp/b'
+    store.setState({
+      repos: [
+        {
+          id: 'repo-a',
+          path: '/tmp',
+          displayName: 'Repo A',
+          badgeColor: '#000',
+          addedAt: 0,
+          connectionId: 'target-a'
+        },
+        {
+          id: 'repo-b',
+          path: '/tmp',
+          displayName: 'Repo B',
+          badgeColor: '#000',
+          addedAt: 0,
+          connectionId: 'target-b'
+        }
+      ],
+      worktreesByRepo: {
+        'repo-a': [makeWorktree({ id: worktreeA, repoId: 'repo-a', hostId: 'ssh:target-a' })],
+        'repo-b': [makeWorktree({ id: worktreeB, repoId: 'repo-b', hostId: 'ssh:target-b' })]
+      },
+      tabsByWorktree: {
+        [worktreeA]: [makeTab({ id: 'tab-a', worktreeId: worktreeA })],
+        [worktreeB]: [makeTab({ id: 'tab-b', worktreeId: worktreeB })]
+      }
+    })
+    const empty = { root: null, activeLeafId: null, expandedLeafId: null }
+
+    store.getState().setTabLayout('tab-a', {
+      ...empty,
+      root: { type: 'leaf', leafId: 'leaf-initial' },
+      activeLeafId: 'leaf-initial'
+    })
+    store.getState().setTabLayout('tab-a', empty)
+    const firstEdit = store.getState().pendingDirectSshLayoutEditsByTabId['tab-a']
+    store.getState().setTabLayout('tab-a', {
+      ...empty,
+      root: { type: 'leaf', leafId: 'leaf-a' },
+      activeLeafId: 'leaf-a'
+    })
+    const currentEdit = store.getState().pendingDirectSshLayoutEditsByTabId['tab-a']
+    expect(currentEdit).not.toBe(firstEdit)
+
+    store.getState().acknowledgeDirectSshLayoutEdits({ 'tab-a': firstEdit })
+    expect(store.getState().pendingDirectSshLayoutEditsByTabId['tab-a']).toBe(currentEdit)
+
+    store.getState().setTabLayout('tab-b', {
+      ...empty,
+      root: { type: 'leaf', leafId: 'leaf-initial-b' },
+      activeLeafId: 'leaf-initial-b'
+    })
+    store.getState().setTabLayout('tab-b', empty)
+    const targetBEdit = store.getState().pendingDirectSshLayoutEditsByTabId['tab-b']
+    store.getState().acknowledgeDirectSshLayoutEdits({ 'tab-a': currentEdit })
+    expect(store.getState().pendingDirectSshLayoutEditsByTabId['tab-a']).toBeUndefined()
+    expect(store.getState().pendingDirectSshLayoutEditsByTabId['tab-b']).toBe(targetBEdit)
+
+    store.getState().acknowledgeDirectSshLayoutEdits({
+      'tab-b': { targetId: 'target-a', root: targetBEdit.root }
+    })
+    expect(store.getState().pendingDirectSshLayoutEditsByTabId['tab-b']).toBe(targetBEdit)
+  })
 })
diff --git a/src/renderer/src/store/slices/terminals.ts b/src/renderer/src/store/slices/terminals.ts
index 36f08c497ca9..1da1c4845092 100644
--- a/src/renderer/src/store/slices/terminals.ts
+++ b/src/renderer/src/store/slices/terminals.ts
@@ -42,6 +42,7 @@ export const createTerminalSlice: StateCreator<AppState, [], [], TerminalSlice>
   expandedPaneByTabId: {},
   canExpandPaneByTabId: {},
   terminalLayoutsByTabId: {},
+  pendingDirectSshLayoutEditsByTabId: {},
   localOnlyScrollbackByTabId: {},
   pendingStartupByTabId: {},
   pendingInitialCwdByTabId: {},
diff --git a/src/renderer/src/store/slices/ui-hydration-workspace-preferences.test.ts b/src/renderer/src/store/slices/ui-hydration-workspace-preferences.test.ts
index 586dbe7c6831..815ae36b523e 100644
--- a/src/renderer/src/store/slices/ui-hydration-workspace-preferences.test.ts
+++ b/src/renderer/src/store/slices/ui-hydration-workspace-preferences.test.ts
@@ -139,7 +139,9 @@ describe('createUISlice hydratePersistedUI', () => {
       'kimi',
       'minimax',
       'antigravity',
-      'grok'
+      'grok',
+      'cursor',
+      'zcode'
     ])
     expect(setUI).toHaveBeenCalledWith({
       statusBarItems: [
@@ -149,13 +151,17 @@ describe('createUISlice hydratePersistedUI', () => {
         'kimi',
         'minimax',
         'antigravity',
-        'grok'
+        'grok',
+        'cursor',
+        'zcode'
       ],
       _portsStatusBarDefaultAdded: true,
       _kimiStatusBarDefaultAdded: true,
       _minimaxStatusBarDefaultAdded: true,
       _antigravityStatusBarDefaultAdded: true,
-      _grokStatusBarDefaultAdded: true
+      _grokStatusBarDefaultAdded: true,
+      _cursorStatusBarDefaultAdded: true,
+      _zcodeStatusBarDefaultAdded: true
     })
   })
 
@@ -171,7 +177,9 @@ describe('createUISlice hydratePersistedUI', () => {
         _kimiStatusBarDefaultAdded: true,
         _minimaxStatusBarDefaultAdded: true,
         _antigravityStatusBarDefaultAdded: true,
-        _grokStatusBarDefaultAdded: true
+        _grokStatusBarDefaultAdded: true,
+        _cursorStatusBarDefaultAdded: true,
+        _zcodeStatusBarDefaultAdded: true
       })
     )
 
diff --git a/src/renderer/src/store/slices/ui/ui-slice-hydration-actions.ts b/src/renderer/src/store/slices/ui/ui-slice-hydration-actions.ts
index 6ca8d702bd37..5961133d966b 100644
--- a/src/renderer/src/store/slices/ui/ui-slice-hydration-actions.ts
+++ b/src/renderer/src/store/slices/ui/ui-slice-hydration-actions.ts
@@ -1,6 +1,5 @@
 import type { UISlice, UISliceGet, UISliceSet } from './ui-slice-contract'
 import type { AppState } from '../../types'
-import type { PersistedUIState } from '../../../../../shared/persisted-ui-state-types'
 import { normalizeRightSidebarRoute } from '../../right-sidebar-route'
 import {
   applyManualRepoOrder,
@@ -38,7 +37,6 @@ import { normalizeStatusBarUsageMode } from '../../../../../shared/status-bar-us
 import { normalizeBrowserPageZoomLevel } from '../../../../../shared/browser-page-zoom'
 import { normalizeKagiSessionLink } from '../../../../../shared/browser-url'
 import { isReleaseChannel } from '../../../../../shared/release-channel'
-import type { StatusBarItem } from '../../../../../shared/ui-chrome-types'
 import {
   filterSetupScriptPromptDismissalsToValidRepos,
   sanitizeSetupScriptPromptDismissals
@@ -61,41 +59,13 @@ import {
   sanitizeWorkspaceCleanupDismissals,
   sanitizePersistedSidebarWidth,
   hydratedUIPartialMatchesState,
-  migrateStatusBarItems,
   clampPetSize
 } from './ui-slice-hydration-sanitizers'
 import { hydrateAgentReadState, sanitizeTaskResumeState } from './ui-slice-hydration-values'
+import { hydrateStatusBarItems } from './ui-slice-hydration-status-bar-items'
 
 const MAX_LEFT_SIDEBAR_WIDTH = 500
 const MAX_RIGHT_SIDEBAR_WIDTH = 4000
-const DEFAULT_ON_PORTS_STATUS_BAR_ITEM: StatusBarItem = 'ports'
-const DEFAULT_ON_KIMI_STATUS_BAR_ITEM: StatusBarItem = 'kimi'
-const DEFAULT_ON_MINIMAX_STATUS_BAR_ITEM: StatusBarItem = 'minimax'
-const DEFAULT_ON_ANTIGRAVITY_STATUS_BAR_ITEM: StatusBarItem = 'antigravity'
-const DEFAULT_ON_GROK_STATUS_BAR_ITEM: StatusBarItem = 'grok'
-
-function hydrateStatusBarItems(ui: PersistedUIState): StatusBarItem[] {
-  let items = migrateStatusBarItems(ui.statusBarItems)
-  const defaults = [
-    ['_portsStatusBarDefaultAdded', DEFAULT_ON_PORTS_STATUS_BAR_ITEM],
-    ['_kimiStatusBarDefaultAdded', DEFAULT_ON_KIMI_STATUS_BAR_ITEM],
-    ['_minimaxStatusBarDefaultAdded', DEFAULT_ON_MINIMAX_STATUS_BAR_ITEM],
-    ['_antigravityStatusBarDefaultAdded', DEFAULT_ON_ANTIGRAVITY_STATUS_BAR_ITEM],
-    ['_grokStatusBarDefaultAdded', DEFAULT_ON_GROK_STATUS_BAR_ITEM]
-  ] as const
-  for (const [flag, item] of defaults) {
-    if (!ui[flag] && !items.includes(item)) {
-      items = [...items, item]
-    }
-  }
-  if (typeof window !== 'undefined' && defaults.some(([flag]) => !ui[flag])) {
-    window.api.ui
-      .set({ statusBarItems: items, ...Object.fromEntries(defaults.map(([flag]) => [flag, true])) })
-      .catch(console.error)
-  }
-  return items
-}
-
 export function createUiHydrationActions(set: UISliceSet, _get: UISliceGet): Partial<UISlice> {
   return {
     hydratePersistedUI: (ui, source = 'sync') =>
diff --git a/src/renderer/src/store/slices/ui/ui-slice-hydration-status-bar-items.ts b/src/renderer/src/store/slices/ui/ui-slice-hydration-status-bar-items.ts
new file mode 100644
index 000000000000..26b6071d64dd
--- /dev/null
+++ b/src/renderer/src/store/slices/ui/ui-slice-hydration-status-bar-items.ts
@@ -0,0 +1,35 @@
+import type { PersistedUIState } from '../../../../../shared/persisted-ui-state-types'
+import type { StatusBarItem } from '../../../../../shared/ui-chrome-types'
+import { migrateStatusBarItems } from './ui-slice-hydration-sanitizers'
+
+const DEFAULT_ON_PORTS_STATUS_BAR_ITEM: StatusBarItem = 'ports'
+const DEFAULT_ON_KIMI_STATUS_BAR_ITEM: StatusBarItem = 'kimi'
+const DEFAULT_ON_MINIMAX_STATUS_BAR_ITEM: StatusBarItem = 'minimax'
+const DEFAULT_ON_ANTIGRAVITY_STATUS_BAR_ITEM: StatusBarItem = 'antigravity'
+const DEFAULT_ON_GROK_STATUS_BAR_ITEM: StatusBarItem = 'grok'
+const DEFAULT_ON_CURSOR_STATUS_BAR_ITEM: StatusBarItem = 'cursor'
+const DEFAULT_ON_ZCODE_STATUS_BAR_ITEM: StatusBarItem = 'zcode'
+
+export function hydrateStatusBarItems(ui: PersistedUIState): StatusBarItem[] {
+  let items = migrateStatusBarItems(ui.statusBarItems)
+  const defaults = [
+    ['_portsStatusBarDefaultAdded', DEFAULT_ON_PORTS_STATUS_BAR_ITEM],
+    ['_kimiStatusBarDefaultAdded', DEFAULT_ON_KIMI_STATUS_BAR_ITEM],
+    ['_minimaxStatusBarDefaultAdded', DEFAULT_ON_MINIMAX_STATUS_BAR_ITEM],
+    ['_antigravityStatusBarDefaultAdded', DEFAULT_ON_ANTIGRAVITY_STATUS_BAR_ITEM],
+    ['_grokStatusBarDefaultAdded', DEFAULT_ON_GROK_STATUS_BAR_ITEM],
+    ['_cursorStatusBarDefaultAdded', DEFAULT_ON_CURSOR_STATUS_BAR_ITEM],
+    ['_zcodeStatusBarDefaultAdded', DEFAULT_ON_ZCODE_STATUS_BAR_ITEM]
+  ] as const
+  for (const [flag, item] of defaults) {
+    if (!ui[flag] && !items.includes(item)) {
+      items = [...items, item]
+    }
+  }
+  if (typeof window !== 'undefined' && defaults.some(([flag]) => !ui[flag])) {
+    window.api.ui
+      .set({ statusBarItems: items, ...Object.fromEntries(defaults.map(([flag]) => [flag, true])) })
+      .catch(console.error)
+  }
+  return items
+}
diff --git a/src/renderer/src/store/slices/workspace-cleanup-removal-targets.ts b/src/renderer/src/store/slices/workspace-cleanup-removal-targets.ts
index 49f8814ca62b..efdd165910d3 100644
--- a/src/renderer/src/store/slices/workspace-cleanup-removal-targets.ts
+++ b/src/renderer/src/store/slices/workspace-cleanup-removal-targets.ts
@@ -34,6 +34,7 @@ import {
   hasValidWorkspaceCleanupUnverifiedConsent,
   hasWorkspaceCleanupRiskEscalated
 } from './workspace-cleanup-preflight-failures'
+import { createBrowserUuid } from '@/lib/browser-uuid'
 
 /** Distinct from every ExecutionHostId, so a hostless row cannot alias one. */
 const UNQUALIFIED_HOST_BUCKET = Symbol('unqualified-cleanup-host')
@@ -190,7 +191,7 @@ export async function preflightWorkspaceCleanupCandidates(
     const chunk = worktreeIds.slice(start, start + WORKSPACE_CLEANUP_TARGET_BATCH_LIMIT)
     const scan = await window.api.workspaceCleanup.scan({
       worktreeIds: [...chunk],
-      scanId: crypto.randomUUID(),
+      scanId: createBrowserUuid(),
       refreshActivity: true
     })
     const enriched = await enrich(scan.candidates, getState())
diff --git a/src/renderer/src/store/slices/workspace-cleanup-scan-lifecycle.ts b/src/renderer/src/store/slices/workspace-cleanup-scan-lifecycle.ts
index 72438524614a..d8e21f94cf5b 100644
--- a/src/renderer/src/store/slices/workspace-cleanup-scan-lifecycle.ts
+++ b/src/renderer/src/store/slices/workspace-cleanup-scan-lifecycle.ts
@@ -22,6 +22,7 @@ import {
   finalizeWorkspaceCleanupScan,
   isLatestWorkspaceCleanupScan
 } from './workspace-cleanup-scan-progress'
+import { createBrowserUuid } from '@/lib/browser-uuid'
 
 type SetState = (
   partial: Partial<AppState> | ((state: AppState) => Partial<AppState>),
@@ -54,7 +55,7 @@ export async function scanWorkspaceCleanup(
     ],
     // Broad scan identity belongs to this store request; caller-provided IDs
     // are reserved for focused scans and can collide across refresh variants.
-    scanId: crypto.randomUUID()
+    scanId: createBrowserUuid()
   }
   const scanKey = getWorkspaceCleanupScanKey(scanArgs)
 
diff --git a/src/renderer/src/store/slices/workspace-cleanup.ts b/src/renderer/src/store/slices/workspace-cleanup.ts
index 00c58e81b4b0..23bff42e763c 100644
--- a/src/renderer/src/store/slices/workspace-cleanup.ts
+++ b/src/renderer/src/store/slices/workspace-cleanup.ts
@@ -27,6 +27,7 @@ import {
   type WorkspaceCleanupRemoveOptions,
   type WorkspaceCleanupRemoveResult
 } from './workspace-cleanup-removal'
+import { createBrowserUuid } from '@/lib/browser-uuid'
 
 export type { WorkspaceCleanupFailure, WorkspaceCleanupRemoveOptions, WorkspaceCleanupRemoveResult }
 export { enrichWorkspaceCleanupCandidates, WORKSPACE_CLEANUP_ENRICHMENT_CONCURRENCY }
@@ -150,7 +151,7 @@ export const createWorkspaceCleanupSlice: StateCreator<AppState, [], [], Workspa
     if (existing.has(identity)) {
       return null
     }
-    const attemptId = crypto.randomUUID()
+    const attemptId = createBrowserUuid()
     existing.set(identity, attemptId)
     return attemptId
   },
diff --git a/src/renderer/src/store/slices/worktrees/teardown/remove-worktree-store-cleanup.ts b/src/renderer/src/store/slices/worktrees/teardown/remove-worktree-store-cleanup.ts
index 2a0068e3f4be..d19ab200ccf4 100644
--- a/src/renderer/src/store/slices/worktrees/teardown/remove-worktree-store-cleanup.ts
+++ b/src/renderer/src/store/slices/worktrees/teardown/remove-worktree-store-cleanup.ts
@@ -60,6 +60,7 @@ export function applyRemoveWorktreeSuccessState(
       nativeChatLaunchDraftByTabId: omitByTabId(s.nativeChatLaunchDraftByTabId),
       unverifiedPtyLossTabIds: omitByTabId(s.unverifiedPtyLossTabIds),
       terminalLayoutsByTabId: omitByTabId(s.terminalLayoutsByTabId),
+      pendingDirectSshLayoutEditsByTabId: omitByTabId(s.pendingDirectSshLayoutEditsByTabId),
       localOnlyScrollbackByTabId: omitByTabId(s.localOnlyScrollbackByTabId),
       // Why: closeTab deletes these per-tab maps but removeWorktree missed them, leaking a split pane's expand flags.
       expandedPaneByTabId: omitByTabId(s.expandedPaneByTabId),
diff --git a/src/renderer/src/store/slices/worktrees/teardown/removed-worktree-snapshot-prune.ts b/src/renderer/src/store/slices/worktrees/teardown/removed-worktree-snapshot-prune.ts
index 785ea0ffce3b..a4cec350d4ae 100644
--- a/src/renderer/src/store/slices/worktrees/teardown/removed-worktree-snapshot-prune.ts
+++ b/src/renderer/src/store/slices/worktrees/teardown/removed-worktree-snapshot-prune.ts
@@ -1,4 +1,5 @@
 import type { ExecutionHostId } from '../../../../../../shared/execution-host'
+import { createBrowserUuid } from '@/lib/browser-uuid'
 
 /**
  * Drop a removed row from the local persisted cleanup snapshots.
@@ -16,7 +17,7 @@ export async function recordRemovedWorktreeSnapshotPrune(args: {
       // Why: an unknown batch id degrades to an immediate one-off prune. The id
       // must stay bounded — main rejects batch ids over 128 chars, so it cannot
       // embed the unbounded worktreeId.
-      batchId: args.snapshotPruneBatchId ?? `single-removal:${crypto.randomUUID()}`,
+      batchId: args.snapshotPruneBatchId ?? `single-removal:${createBrowserUuid()}`,
       worktreeId: args.worktreeId,
       ...(args.hostId ? { executionHostId: args.hostId } : {})
     })
diff --git a/src/renderer/src/store/slices/worktrees/teardown/worktree-purge-state.ts b/src/renderer/src/store/slices/worktrees/teardown/worktree-purge-state.ts
index db501c284f49..de3598c9cb2d 100644
--- a/src/renderer/src/store/slices/worktrees/teardown/worktree-purge-state.ts
+++ b/src/renderer/src/store/slices/worktrees/teardown/worktree-purge-state.ts
@@ -117,6 +117,7 @@ export function buildWorktreePurgeState(
     workspaceLineageByChildKey: omitWorkspaceLineageByWorktree(s.workspaceLineageByChildKey),
     tabsByWorktree: omitByWorktree(s.tabsByWorktree),
     terminalLayoutsByTabId: omitByTabId(s.terminalLayoutsByTabId),
+    pendingDirectSshLayoutEditsByTabId: omitByTabId(s.pendingDirectSshLayoutEditsByTabId),
     localOnlyScrollbackByTabId: omitByTabId(s.localOnlyScrollbackByTabId),
     ptyIdsByTabId: omitByTabId(s.ptyIdsByTabId),
     runtimePaneTitlesByTabId: omitByTabId(s.runtimePaneTitlesByTabId),
diff --git a/src/renderer/src/store/terminals/terminal-actions.ts b/src/renderer/src/store/terminals/terminal-actions.ts
index 9720e08cacfa..d1bc838346d7 100644
--- a/src/renderer/src/store/terminals/terminal-actions.ts
+++ b/src/renderer/src/store/terminals/terminal-actions.ts
@@ -1,5 +1,5 @@
 import type { AgentAttentionUnreadReason } from '@/attention/agent-attention-contract'
-import type { TerminalState } from './terminal-state'
+import type { DirectSshLayoutEdit, TerminalState } from './terminal-state'
 import type { Tab } from '../../../../shared/tab-types'
 import type { TerminalLayoutSnapshot, TerminalTab } from '../../../../shared/terminal-tab-types'
 import type { TuiAgent } from '../../../../shared/tui-agent'
@@ -189,6 +189,7 @@ export type TerminalActions = {
   setTabPaneExpanded: (tabId: string, expanded: boolean) => void
   setTabCanExpandPane: (tabId: string, canExpand: boolean) => void
   setTabLayout: (tabId: string, layout: TerminalLayoutSnapshot | null) => void
+  acknowledgeDirectSshLayoutEdits: (uploaded: Readonly<Record<string, DirectSshLayoutEdit>>) => void
   /** Client-local park scrollback for a tab. Never uploaded; read via `resolveLeafScrollback`. */
   setTabLocalOnlyScrollback: (tabId: string, buffersByLeafId: Record<string, string> | null) => void
   syncPaneDetachPtyOwnership: (args: {
diff --git a/src/renderer/src/store/terminals/terminal-layout-state.ts b/src/renderer/src/store/terminals/terminal-layout-state.ts
index 4e33ce87fc68..455e73eb0b5f 100644
--- a/src/renderer/src/store/terminals/terminal-layout-state.ts
+++ b/src/renderer/src/store/terminals/terminal-layout-state.ts
@@ -1,5 +1,7 @@
 import { makePaneKey } from '../../../../shared/stable-pane-id'
-import { terminalLayoutEqual } from '@/lib/terminal-layout-equality'
+import { terminalLayoutEqual, terminalLayoutNodeEqual } from '@/lib/terminal-layout-equality'
+import { getConnectionIdFromState } from '@/lib/connection-owner-resolution'
+import { omitRecordKeys } from '../slices/worktrees/teardown/record-key-omission'
 import {
   normalizeTerminalLayoutPtyOwnership,
   resolveTerminalLayoutPtyOwnershipTransfers
@@ -23,6 +25,7 @@ export function createTerminalLayoutActions(
   | 'setTabPaneExpanded'
   | 'setTabCanExpandPane'
   | 'setTabLayout'
+  | 'acknowledgeDirectSshLayoutEdits'
   | 'setTabLocalOnlyScrollback'
   | 'syncPaneDetachPtyOwnership'
 > {
@@ -75,6 +78,19 @@ export function createTerminalLayoutActions(
           : { canExpandPaneByTabId: { ...s.canExpandPaneByTabId, [tabId]: canExpand } }
       )
     },
+    acknowledgeDirectSshLayoutEdits: (uploaded) => {
+      set((s) => {
+        const acknowledged = Object.keys(uploaded).filter((tabId) => {
+          const pending = s.pendingDirectSshLayoutEditsByTabId[tabId]
+          const candidate = uploaded[tabId]
+          return pending === candidate
+        })
+        const pending = omitRecordKeys(s.pendingDirectSshLayoutEditsByTabId, acknowledged)
+        return pending === s.pendingDirectSshLayoutEditsByTabId
+          ? s
+          : { pendingDirectSshLayoutEditsByTabId: pending }
+      })
+    },
     setTabLayout: (tabId, layout) => {
       let ownershipTransfers: ReturnType<typeof resolveTerminalLayoutPtyOwnershipTransfers> = []
       set((s) => {
@@ -84,7 +100,13 @@ export function createTerminalLayoutActions(
           }
           const next = { ...s.terminalLayoutsByTabId }
           delete next[tabId]
-          return { terminalLayoutsByTabId: next }
+          return {
+            terminalLayoutsByTabId: next,
+            pendingDirectSshLayoutEditsByTabId: omitRecordKeys(
+              s.pendingDirectSshLayoutEditsByTabId,
+              [tabId]
+            )
+          }
         }
         const normalized = normalizeTerminalLayoutPtyOwnership(layout)
         // Resolved before the bailout: normalization can transfer pane ownership even when the stored snapshot is untouched.
@@ -99,8 +121,23 @@ export function createTerminalLayoutActions(
         if (existing && terminalLayoutEqual(existing, normalized.snapshot)) {
           return s
         }
+        const structuralEdit = !terminalLayoutNodeEqual(existing?.root, normalized.snapshot.root)
+        const workspaceId = structuralEdit
+          ? Object.keys(s.tabsByWorktree).find((id) =>
+              s.tabsByWorktree[id].some((tab) => tab.id === tabId)
+            )
+          : undefined
+        const tracksRemoteEdit = workspaceId && getConnectionIdFromState(s, workspaceId)
         return {
-          terminalLayoutsByTabId: { ...s.terminalLayoutsByTabId, [tabId]: normalized.snapshot }
+          terminalLayoutsByTabId: { ...s.terminalLayoutsByTabId, [tabId]: normalized.snapshot },
+          ...(tracksRemoteEdit
+            ? {
+                pendingDirectSshLayoutEditsByTabId: {
+                  ...s.pendingDirectSshLayoutEditsByTabId,
+                  [tabId]: { targetId: tracksRemoteEdit, root: normalized.snapshot.root }
+                }
+              }
+            : {})
         }
       })
       transferNormalizedTerminalLayoutPtyOwnership(get(), tabId, ownershipTransfers)
diff --git a/src/renderer/src/store/terminals/terminal-state.ts b/src/renderer/src/store/terminals/terminal-state.ts
index 5a4b097f057d..d0595b8721f8 100644
--- a/src/renderer/src/store/terminals/terminal-state.ts
+++ b/src/renderer/src/store/terminals/terminal-state.ts
@@ -23,6 +23,11 @@ import type { StateCreator } from 'zustand'
 import type { AppState } from '../types'
 import type { TerminalActions } from './terminal-actions'
 
+export type DirectSshLayoutEdit = {
+  targetId: string
+  root: TerminalLayoutSnapshot['root']
+}
+
 export type TerminalState = {
   tabsByWorktree: Record<string, TerminalTab[]>
   activeTabId: string | null
@@ -44,6 +49,8 @@ export type TerminalState = {
   expandedPaneByTabId: Record<string, boolean>
   canExpandPaneByTabId: Record<string, boolean>
   terminalLayoutsByTabId: Record<string, TerminalLayoutSnapshot>
+  /** Local structural edits remain protected until the owning SSH host acknowledges them. */
+  pendingDirectSshLayoutEditsByTabId: Record<string, DirectSshLayoutEdit>
   /** Ordinary-park scrollback, tabId -> leafId -> buffer. Never uploaded to a peer; see
    *  WorkspaceSessionState.localOnlyScrollbackByTabId. Read via resolveLeafScrollbackBuffers only. */
   localOnlyScrollbackByTabId: Record<string, Record<string, string>>
diff --git a/src/renderer/src/store/terminals/terminal-surface-close-intent.ts b/src/renderer/src/store/terminals/terminal-surface-close-intent.ts
new file mode 100644
index 000000000000..0ee2d5aead42
--- /dev/null
+++ b/src/renderer/src/store/terminals/terminal-surface-close-intent.ts
@@ -0,0 +1,15 @@
+import type { TerminalSurfaceCloseTarget } from '../../../../shared/terminal-surface-close-target'
+
+/** Commits a terminal tab or split-pane close in main, which owns membership: a renderer save
+ *  cannot shrink it, so without this the close would ride on the PTY exit. */
+export function commitTerminalSurfaceClose(
+  worktreeId: string,
+  target: TerminalSurfaceCloseTarget
+): void {
+  // Why optional: an older preload can linger through an in-place renderer reload.
+  void globalThis.window?.api?.session
+    ?.closeTerminalSurface?.({ worktreeId, target })
+    ?.catch((error: unknown) => {
+      console.warn('[terminal-close] main did not commit the close', error)
+    })
+}
diff --git a/src/renderer/src/store/terminals/terminal-tab-close-intent.test.ts b/src/renderer/src/store/terminals/terminal-tab-close-intent.test.ts
new file mode 100644
index 000000000000..076de3babb68
--- /dev/null
+++ b/src/renderer/src/store/terminals/terminal-tab-close-intent.test.ts
@@ -0,0 +1,99 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+import type * as AgentStatusModule from '@/lib/agent-status'
+import {
+  TEST_REPO,
+  createTestStore,
+  makeTab,
+  makeWorktree,
+  seedStore
+} from '../slices/store-test-helpers'
+import { createStoreCascadesMockApi } from '../slices/store-cascades-test-harness'
+
+vi.mock('sonner', () => ({
+  toast: { info: vi.fn(), success: vi.fn(), error: vi.fn(), warning: vi.fn() }
+}))
+
+vi.mock('@/components/terminal-pane/pty-dispatcher', () => ({
+  restorePtyDataHandlersAfterFailedShutdown: vi.fn(),
+  unregisterPtyDataHandlers: vi.fn<() => unknown[]>(() => [])
+}))
+
+vi.mock('@/lib/agent-status', async (importOriginal) => ({
+  ...(await importOriginal<typeof AgentStatusModule>()),
+  detectAgentStatusFromTitle: vi.fn().mockReturnValue(null)
+}))
+
+const mockApi = createStoreCascadesMockApi()
+const closeTerminalSurface = vi.fn()
+Object.assign(mockApi, { session: { closeTerminalSurface } })
+
+const SSH_WORKTREE = 'remote-repo::/srv/app'
+const SSH_PTY = 'ssh:target@@pty2:1:1'
+
+function storeWithSshTab(): ReturnType<typeof createTestStore> {
+  const store = createTestStore()
+  seedStore(store, {
+    repos: [{ ...TEST_REPO, id: 'remote-repo', path: '/srv/app', connectionId: 'ssh-1' }],
+    worktreesByRepo: {
+      'remote-repo': [makeWorktree({ id: SSH_WORKTREE, repoId: 'remote-repo', path: '/srv/app' })]
+    },
+    tabsByWorktree: {
+      [SSH_WORKTREE]: [makeTab({ id: 'ssh-tab', worktreeId: SSH_WORKTREE, ptyId: SSH_PTY })]
+    },
+    ptyIdsByTabId: { 'ssh-tab': [SSH_PTY] }
+  })
+  return store
+}
+
+describe('closeTab close intent', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    closeTerminalSurface.mockResolvedValue(undefined)
+    mockApi.worktrees.updateMeta.mockResolvedValue({})
+  })
+
+  it('commits the close in main even when the SSH shutdown throws', async () => {
+    mockApi.pty.kill.mockRejectedValue(new Error('relay shutdown failed'))
+    const store = storeWithSshTab()
+
+    store.getState().closeTab('ssh-tab')
+    await Promise.resolve()
+
+    expect(mockApi.pty.kill).toHaveBeenCalledWith(SSH_PTY)
+    expect(closeTerminalSurface).toHaveBeenCalledWith({
+      worktreeId: SSH_WORKTREE,
+      target: { kind: 'tab', tabId: 'ssh-tab' }
+    })
+  })
+
+  it('removes the tab and kills it without waiting for main to write the close', async () => {
+    closeTerminalSurface.mockReturnValue(new Promise<void>(() => {}))
+    const store = storeWithSshTab()
+
+    store.getState().closeTab('ssh-tab')
+
+    expect(closeTerminalSurface).toHaveBeenCalledTimes(1)
+    expect(store.getState().tabsByWorktree[SSH_WORKTREE]).toEqual([])
+    await Promise.resolve()
+    expect(mockApi.pty.kill).toHaveBeenCalledWith(SSH_PTY)
+  })
+
+  it.each([['user'], ['cleanup']] as const)('sends the intent for a %s close', (reason) => {
+    storeWithSshTab().getState().closeTab('ssh-tab', { reason })
+
+    expect(closeTerminalSurface).toHaveBeenCalledTimes(1)
+  })
+
+  // Why: exits still retire through main's own exit handling until main decides exits itself.
+  it('sends nothing for a pty-exit close', () => {
+    storeWithSshTab().getState().closeTab('ssh-tab', { reason: 'pty-exit' })
+
+    expect(closeTerminalSurface).not.toHaveBeenCalled()
+  })
+
+  it('sends nothing when a paired host owns the close', () => {
+    storeWithSshTab().getState().closeTab('ssh-tab', { remoteCloseOwnedByHost: true })
+
+    expect(closeTerminalSurface).not.toHaveBeenCalled()
+  })
+})
diff --git a/src/renderer/src/store/terminals/terminal-tab-close.ts b/src/renderer/src/store/terminals/terminal-tab-close.ts
index b4ff87f4f105..529b19ded0b7 100644
--- a/src/renderer/src/store/terminals/terminal-tab-close.ts
+++ b/src/renderer/src/store/terminals/terminal-tab-close.ts
@@ -15,6 +15,7 @@ import {
 } from '../slices/terminal-tab-retirement'
 import type { TerminalSlice, TerminalStoreGet, TerminalStoreSet } from './terminal-state'
 import { startTerminalTabProviderRetirement } from './terminal-tab-close-providers'
+import { commitTerminalSurfaceClose } from './terminal-surface-close-intent'
 import { omitUnverifiedPtyLossTabIds } from './terminal-unverified-pty-loss'
 import { removePaneKeysByTabPrefix } from '../slices/agent-status-pane-keyed-records'
 import { omitRecordKeys } from '../slices/worktrees/teardown/record-key-omission'
@@ -220,6 +221,7 @@ export function createTerminalTabCloseActions(
           expandedPaneByTabId: nextExpanded,
           canExpandPaneByTabId: nextCanExpand,
           terminalLayoutsByTabId: nextLayouts,
+          pendingDirectSshLayoutEditsByTabId: omitByTabId(s.pendingDirectSshLayoutEditsByTabId),
           localOnlyScrollbackByTabId: nextLocalOnlyScrollback,
           pendingStartupByTabId: nextPendingStartupByTabId,
           automaticAgentResumeClaimsByTabId: nextAutomaticAgentResumeClaimsByTabId,
@@ -248,6 +250,9 @@ export function createTerminalTabCloseActions(
             : {})
         }
       })
+      if (retiresSession && closingWorktreeId && opts?.remoteCloseOwnedByHost !== true) {
+        commitTerminalSurfaceClose(closingWorktreeId, { kind: 'tab', tabId })
+      }
       // Why shared with the paired snapshot apply: every path that removes a tab owes it the same sweep, and a second copy of the list is how one path silently misses a new entry.
       sweepRetiredTerminalTabState(get(), tabId, closingWorktreeId)
       for (const tabs of Object.values(get().unifiedTabsByWorktree)) {
diff --git a/src/renderer/src/store/terminals/workspace-terminal-hydration-patch.ts b/src/renderer/src/store/terminals/workspace-terminal-hydration-patch.ts
index e2713203a41d..6f2e3d47e753 100644
--- a/src/renderer/src/store/terminals/workspace-terminal-hydration-patch.ts
+++ b/src/renderer/src/store/terminals/workspace-terminal-hydration-patch.ts
@@ -174,6 +174,11 @@ export function targetScopedWorkspaceHydrationPatch(
       hydrated.activeTabIdByWorktree,
       workspaceKeys
     ),
+    pendingDirectSshLayoutEditsByTabId: Object.fromEntries(
+      Object.entries(state.pendingDirectSshLayoutEditsByTabId ?? {}).filter(
+        ([tabId]) => !deletedTargetTabIds.has(tabId)
+      )
+    ),
     tabsByWorktree: replaceHydratedRecordKeys(
       state.tabsByWorktree,
       hydrated.tabsByWorktree,
diff --git a/src/renderer/src/web/preload-api/web-agent-accounts-api.ts b/src/renderer/src/web/preload-api/web-agent-accounts-api.ts
index 8738039de611..900757900a64 100644
--- a/src/renderer/src/web/preload-api/web-agent-accounts-api.ts
+++ b/src/renderer/src/web/preload-api/web-agent-accounts-api.ts
@@ -1,3 +1,4 @@
+import { translate } from '@/i18n/i18n'
 import type { PreloadApi } from '../../../../preload/api-types'
 
 export function createMiniMaxCredentialsApi(): NonNullable<
@@ -14,6 +15,28 @@ export function createMiniMaxCredentialsApi(): NonNullable<
   }
 }
 
+export function createCursorAccountsApi(): NonNullable<Partial<PreloadApi>['cursorAccounts']> {
+  // Why an explanation and not a bare `signedIn: false`: Cursor's session lives on
+  // the machine running Orca, and this bridge cannot read it. The host may well be
+  // signed in — its usage meter still arrives over the rate-limit snapshot — so
+  // asserting "not signed in" here would contradict the meter beside it.
+  return {
+    getStatus: () =>
+      Promise.resolve({
+        signedIn: false,
+        email: null,
+        displayName: null,
+        credentialSource: null,
+        planType: null,
+        tokenFresh: false,
+        error: translate(
+          'auto.components.web.preloadApi.cursorAccounts.hostOnly',
+          'Cursor sign-in details are only readable on the computer running Orca.'
+        )
+      })
+  }
+}
+
 export function createGrokAccountsApi(): NonNullable<Partial<PreloadApi>['grokAccounts']> {
   const unsigned = {
     signedIn: false,
diff --git a/src/renderer/src/web/preload-api/web-workspace-session-api.ts b/src/renderer/src/web/preload-api/web-workspace-session-api.ts
index 2a8abc03b616..553b065c9923 100644
--- a/src/renderer/src/web/preload-api/web-workspace-session-api.ts
+++ b/src/renderer/src/web/preload-api/web-workspace-session-api.ts
@@ -81,6 +81,8 @@ export function createWebWorkspaceSessionApi(): Partial<PreloadApi> {
           })
         )
       },
+      // Why a no-op: web closes reach the host through its session-tab and terminal close RPCs.
+      closeTerminalSurface: async () => {},
       // localStorage writes synchronously, so there is no deferred web flush.
       flush: async () => {},
       readTerminalScrollback: () => null,
diff --git a/src/renderer/src/web/web-preload-api-composition.test.ts b/src/renderer/src/web/web-preload-api-composition.test.ts
index 8bac20f50971..fc119f88258b 100644
--- a/src/renderer/src/web/web-preload-api-composition.test.ts
+++ b/src/renderer/src/web/web-preload-api-composition.test.ts
@@ -55,6 +55,7 @@ describe('web preload API composition', () => {
       'rateLimits',
       'minimaxCredentials',
       'grokAccounts',
+      'cursorAccounts',
       'codexAccounts',
       'claudeAccounts',
       'cli',
diff --git a/src/renderer/src/web/web-preload-api.ts b/src/renderer/src/web/web-preload-api.ts
index 0f6848a18272..17f77ded803c 100644
--- a/src/renderer/src/web/web-preload-api.ts
+++ b/src/renderer/src/web/web-preload-api.ts
@@ -4,6 +4,7 @@ import { createWebE2EApi } from './preload-api/web-e2e-api'
 import {
   createClaudeAccountsApi,
   createCodexAccountsApi,
+  createCursorAccountsApi,
   createGrokAccountsApi,
   createMiniMaxCredentialsApi
 } from './preload-api/web-agent-accounts-api'
@@ -107,6 +108,7 @@ function createWebPreloadApi(): Partial<PreloadApi> {
     rateLimits: createRateLimitsApi(),
     minimaxCredentials: createMiniMaxCredentialsApi(),
     grokAccounts: createGrokAccountsApi(),
+    cursorAccounts: createCursorAccountsApi(),
     codexAccounts: createCodexAccountsApi(),
     claudeAccounts: createClaudeAccountsApi(),
     cli: createCliApi(),
diff --git a/src/renderer/src/web/web-runtime-client-heartbeat.test.ts b/src/renderer/src/web/web-runtime-client-heartbeat.test.ts
index ab85698660b8..cde7022eefd7 100644
--- a/src/renderer/src/web/web-runtime-client-heartbeat.test.ts
+++ b/src/renderer/src/web/web-runtime-client-heartbeat.test.ts
@@ -6,6 +6,7 @@ import { WebRuntimeClient } from './web-runtime-client'
 // keeping its timer armed while the window is hidden.
 
 const fakeSockets: FakeWebSocket[] = []
+const clients: WebRuntimeClient[] = []
 let visibilityState: DocumentVisibilityState = 'visible'
 let nextIntervalId = 1
 const documentListeners = new Map<string, () => void>()
@@ -73,6 +74,7 @@ function makeConnectedClient(): {
     deviceToken: 'token',
     publicKeyB64: Buffer.alloc(32).toString('base64')
   })
+  clients.push(client)
   const internals = client as unknown as HeartbeatInternals
   // Override the protected time/visibility seams deterministically.
   internals.now = () => nowMs
@@ -130,6 +132,7 @@ describe('WebRuntimeClient liveness heartbeat', () => {
   })
 
   afterEach(() => {
+    clients.splice(0).forEach((client) => client.close())
     vi.unstubAllGlobals()
   })
 
diff --git a/src/shared/__fixtures__/qoder-no-account-hooks.jsonl b/src/shared/__fixtures__/qoder-no-account-hooks.jsonl
new file mode 100644
index 000000000000..0508c506368d
--- /dev/null
+++ b/src/shared/__fixtures__/qoder-no-account-hooks.jsonl
@@ -0,0 +1,6 @@
+{"session_id":"00000000-0000-4000-8000-000000000000","transcript_path":"/private/tmp/orca-qoder-probe/config/projects/-private-tmp-orca-qoder-probe-workspace/00000000-0000-4000-8000-000000000000.jsonl","cwd":"/private/tmp/orca-qoder-probe/workspace","hook_event_name":"SessionStart","permission_mode":"default","source":"startup"}
+{"session_id":"00000000-0000-4000-8000-000000000000","transcript_path":"/private/tmp/orca-qoder-probe/config/projects/-private-tmp-orca-qoder-probe-workspace/00000000-0000-4000-8000-000000000000.jsonl","cwd":"/private/tmp/orca-qoder-probe/workspace","hook_event_name":"UserPromptSubmit","permission_mode":"default","prompt":"Reply with hello.","request_set_id":"00000000-0000-4000-8000-000000000000"}
+{"session_id":"00000000-0000-4000-8000-000000000000","transcript_path":"/private/tmp/orca-qoder-probe/config/projects/-private-tmp-orca-qoder-probe-workspace/00000000-0000-4000-8000-000000000000.jsonl","cwd":"/private/tmp/orca-qoder-probe/workspace","hook_event_name":"Notification","permission_mode":"default","notification_type":"idle_prompt","message":"Qoder CLI finished responding and is awaiting input.","details":{"streamingState":"idle"}}
+{"session_id":"00000000-0000-4000-8000-000000000000","transcript_path":"/private/tmp/orca-qoder-probe/config/projects/-private-tmp-orca-qoder-probe-workspace/00000000-0000-4000-8000-000000000000.jsonl","cwd":"/private/tmp/orca-qoder-probe/workspace","hook_event_name":"SessionEnd","permission_mode":"default","reason":"other"}
+{"session_id":"00000000-0000-4000-8000-000000000000","transcript_path":"/tmp/orca-qoder-probe/config/projects/-private-tmp-orca-qoder-probe-workspace/00000000-0000-4000-8000-000000000000.jsonl","cwd":"/private/tmp/orca-qoder-probe/workspace","hook_event_name":"SessionStart","permission_mode":"default","source":"resume"}
+{"session_id":"00000000-0000-4000-8000-000000000000","transcript_path":"/private/tmp/orca-qoder-probe/config/projects/-private-tmp-orca-qoder-probe-workspace/00000000-0000-4000-8000-000000000000.jsonl","cwd":"/private/tmp/orca-qoder-probe/workspace","hook_event_name":"SessionEnd","permission_mode":"default","reason":"other"}
diff --git a/src/shared/agent-command-plan.ts b/src/shared/agent-command-plan.ts
new file mode 100644
index 000000000000..20190d0451bc
--- /dev/null
+++ b/src/shared/agent-command-plan.ts
@@ -0,0 +1,29 @@
+import { extractLeadingEnvAssignments } from './command-environment'
+import {
+  tokenizeCustomCommandTemplate,
+  type CommandTemplateBackslash
+} from './commit-message-prompt'
+
+export function planAgentBinary(
+  defaultBinary: string,
+  commandOverride: string | undefined,
+  backslash: CommandTemplateBackslash = 'escape'
+):
+  | { ok: true; binary: string; prefixArgs: string[]; env?: Record<string, string> }
+  | { ok: false; error: string } {
+  const command = commandOverride?.trim()
+  if (!command) {
+    return { ok: true, binary: defaultBinary, prefixArgs: [] }
+  }
+
+  const tokenized = tokenizeCustomCommandTemplate(command, backslash)
+  if (!tokenized.ok) {
+    return { ok: false, error: `Agent command override is invalid: ${tokenized.error}` }
+  }
+  const { env, rest } = extractLeadingEnvAssignments(tokenized.tokens)
+  const [binary, ...prefixArgs] = rest
+  if (!binary) {
+    return { ok: false, error: 'Agent command override must start with a binary name.' }
+  }
+  return { ok: true, binary, prefixArgs, ...(env ? { env } : {}) }
+}
diff --git a/src/shared/agent-completion-time.ts b/src/shared/agent-completion-time.ts
index 4b7ea78c430f..a0794139b62c 100644
--- a/src/shared/agent-completion-time.ts
+++ b/src/shared/agent-completion-time.ts
@@ -1,9 +1,10 @@
 import type { AgentStateHistoryEntry, AgentStatusEntry } from './agent-status-types'
+import { agentTurnStoppedByUser } from './agent-main-agent-verdict'
 
 /** The subset of a hook entry a completion time is derived from. */
 export type AgentCompletionSource = Pick<
   AgentStatusEntry,
-  'state' | 'stateStartedAt' | 'stateHistory' | 'interrupted' | 'sessionBoundary'
+  'state' | 'stateStartedAt' | 'stateHistory' | 'interrupted' | 'mainAgent' | 'sessionBoundary'
 >
 
 function mostRecentCompletedTurnInHistory(
@@ -13,7 +14,7 @@ function mostRecentCompletedTurnInHistory(
   for (const row of history ?? []) {
     if (
       row.state === 'done' &&
-      row.interrupted !== true &&
+      !agentTurnStoppedByUser(row) &&
       Number.isFinite(row.startedAt) &&
       row.startedAt > max
     ) {
@@ -29,11 +30,11 @@ function mostRecentCompletedTurnInHistory(
  * can't rank as freshly done while showing an age past the staleness threshold.
  *
  * A completion is only:
- *   - a non-interrupted `done` (its `stateStartedAt` — unmoved by same-state tool/prompt pings); or
+ *   - a `done` the user did not stop, failures included (its `stateStartedAt` — unmoved by same-state tool/prompt pings); or
  *   - for a session-boundary `done` (connected idle, not a turn), the real completion it displaced.
  */
 export function agentEntryCompletionAt(entry: AgentCompletionSource): number | null {
-  if (entry.state !== 'done' || entry.interrupted === true) {
+  if (entry.state !== 'done' || agentTurnStoppedByUser(entry)) {
     return null
   }
   if (entry.sessionBoundary === true) {
diff --git a/src/shared/agent-headless-command.ts b/src/shared/agent-headless-command.ts
index 3ce26e949c37..f3f67535963f 100644
--- a/src/shared/agent-headless-command.ts
+++ b/src/shared/agent-headless-command.ts
@@ -1,4 +1,6 @@
+import { isQoderHeadlessCommand } from './qoder-headless-command'
 import { isAnteHeadlessOneShotCommand } from './ante-headless-command'
+import { isDshNonInteractiveCommand } from './dsh-launch-command'
 import { isMuseHeadlessOneShotCommand } from './muse-headless-command'
 import { isZCodeHeadlessOneShotCommand } from './zcode-headless-command'
 import { isPrimeAgentHeadlessOneShotCommand } from './prime-agent-headless-command'
@@ -8,16 +10,20 @@ import type { TuiAgent } from './tui-agent'
 // Why: a table (not an if-chain) so adding an agent is one entry; Claude and Trae share
 // the same `--print` one-shot contract, Ante's `--prompt` form, Prime Agent's
 // `--mode` forms, Muse's `exec` subcommand, and ZCode's `--prompt`/`--target` forms need
-// their own matchers.
+// their own matchers. DSH's entry is wider than a one-shot: `dsh` also boots a web server
+// and JSON-RPC stdio profiles, and none of those can answer a prompt in the pane either,
+// which is what this table gates.
 const HEADLESS_ONE_SHOT_MATCHERS: Partial<
   Record<TuiAgent, (tokens: readonly string[]) => boolean>
 > = {
+  qoder: isQoderHeadlessCommand,
   claude: isPrintModeHeadlessOneShotCommand,
   trae: isPrintModeHeadlessOneShotCommand,
   'prime-agent': isPrimeAgentHeadlessOneShotCommand,
   ante: isAnteHeadlessOneShotCommand,
   muse: isMuseHeadlessOneShotCommand,
-  zcode: isZCodeHeadlessOneShotCommand
+  zcode: isZCodeHeadlessOneShotCommand,
+  dsh: isDshNonInteractiveCommand
 }
 
 export function isHeadlessOneShotAgentCommand(agent: TuiAgent, tokens: readonly string[]): boolean {
diff --git a/src/shared/agent-hook-listener-interactive-prompts.test.ts b/src/shared/agent-hook-listener-interactive-prompts.test.ts
index 214035ae5754..ec8d7722c755 100644
--- a/src/shared/agent-hook-listener-interactive-prompts.test.ts
+++ b/src/shared/agent-hook-listener-interactive-prompts.test.ts
@@ -41,32 +41,34 @@ describe('shared agent-hook-listener', () => {
     expect(event!.payload.agentType).toBe('claude')
   })
 
-  it('normalizes a BOM-prefixed Cursor hook payload to a working state', () => {
-    const event = normalizeHookPayload(
-      state,
-      'cursor',
-      {
-        paneKey: PANE_KEY,
-        payload: '\uFEFF{"hook_event_name":"beforeSubmitPrompt","prompt":"Synthetic Cursor prompt"}'
-      },
-      'production'
-    )
+  it.each([0, 1, 2, 3])(
+    'normalizes %i leading Cursor BOMs to a working state (#21421)',
+    (count) => {
+      const event = normalizeHookPayload(
+        state,
+        'cursor',
+        {
+          paneKey: PANE_KEY,
+          payload: `${'\uFEFF'.repeat(count)}{"hook_event_name":"beforeSubmitPrompt","prompt":"Synthetic Cursor prompt"}`
+        },
+        'production'
+      )
 
-    expect(event?.payload).toMatchObject({
-      agentType: 'cursor',
-      state: 'working',
-      prompt: 'Synthetic Cursor prompt'
-    })
-    expect(event?.hookEventName).toBe('beforeSubmitPrompt')
-  })
+      expect(event?.payload).toMatchObject({
+        agentType: 'cursor',
+        state: 'working',
+        prompt: 'Synthetic Cursor prompt'
+      })
+      expect(event?.hookEventName).toBe('beforeSubmitPrompt')
+    }
+  )
 
-  // Why: pins the allowance to exactly one leading U+FEFF, so nobody widens it into a trim.
-  it('still rejects a hook payload that is malformed once the BOM is removed', () => {
+  // Only contiguous leading BOMs are transport framing; misplaced BOMs remain invalid JSON.
+  it('still rejects malformed JSON after leading BOMs are removed', () => {
     const bom = '\uFEFF'
     const body = '{"hook_event_name":"beforeSubmitPrompt"}'
     for (const payload of [
-      `${bom}${bom}${body}`,
-      `${bom}not json`,
+      `${bom}${bom}not json`,
       ` ${bom}${body}`,
       `{"hook_event_name"${bom}:"beforeSubmitPrompt"}`
     ]) {
diff --git a/src/shared/agent-hook-listener-transport.test.ts b/src/shared/agent-hook-listener-transport.test.ts
index cf0a801ede1d..50a4df2860ba 100644
--- a/src/shared/agent-hook-listener-transport.test.ts
+++ b/src/shared/agent-hook-listener-transport.test.ts
@@ -11,6 +11,7 @@ import {
 } from './agent-hook-listener/endpoint-publication'
 import {
   HOOK_REQUEST_MAX_BYTES,
+  parseAgentHookJson,
   parseFormEncodedBody,
   readRequestBody
 } from './agent-hook-listener/request-body'
@@ -161,12 +162,66 @@ describe('shared agent-hook-listener', () => {
     expectRequestParserListenersReleased(req)
   })
 
-  it('strips exactly one outer JSON BOM', async () => {
+  it.each([0, 1, 2, 3])(
+    'reads %i outer BOMs with every UTF-8 byte in a separate chunk',
+    async (count) => {
+      const req = createReadableRequest({ 'content-type': 'application/json' })
+      const body = readRequestBody(req as unknown as IncomingMessage)
+      const bytes = Buffer.concat([
+        ...Array.from({ length: count }, () => Buffer.from([0xef, 0xbb, 0xbf])),
+        Buffer.from('{"text":"café 日本語 😀"}')
+      ])
+      for (const byte of bytes) {
+        req.emit('data', Buffer.from([byte]))
+      }
+      req.emit('end')
+      await expect(body).resolves.toEqual({ text: 'café 日本語 😀' })
+      expectRequestParserListenersReleased(req)
+    }
+  )
+
+  it.each(['', '\uFEFF', '\uFEFF\uFEFF'])(
+    'preserves JSON whitespace and string BOMs after prefix %j',
+    (prefix) => {
+      expect(parseAgentHookJson(`${prefix} \r\n\t{"text":"a\uFEFFb"} \t\r\n`)).toEqual({
+        text: 'a\uFEFFb'
+      })
+    }
+  )
+
+  it.each([
+    '',
+    ' ',
+    '\uFEFF',
+    '\uFEFF\uFEFF',
+    '\uFEFF\uFEFFnot json',
+    ' \uFEFF{}',
+    '\uFEFF \uFEFF{}',
+    '{\uFEFF"ok":true}',
+    '{}\uFEFF',
+    '\uFEFF\uFEFF{"ok":}'
+  ])('rejects invalid JSON %j without trimming misplaced BOMs', (body) => {
+    expect(() => parseAgentHookJson(body)).toThrow()
+  })
+
+  it('keeps an empty HTTP body as an empty envelope', async () => {
     const req = createReadableRequest({ 'content-type': 'application/json' })
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The existing request harness supplies the headers and stream events used by the reader.
     const body = readRequestBody(req as unknown as IncomingMessage)
-    req.emit('data', Buffer.concat([Buffer.from([0xef, 0xbb, 0xbf]), Buffer.from('{"ok":true}')]))
     req.emit('end')
-    await expect(body).resolves.toEqual({ ok: true })
+    await expect(body).resolves.toEqual({})
+    expectRequestParserListenersReleased(req)
+  })
+
+  it('counts BOM bytes toward the cap across incremental chunks', async () => {
+    const req = createReadableRequest({ 'content-type': 'application/json' })
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The existing request harness supplies the headers and stream events used by the reader.
+    const body = readRequestBody(req as unknown as IncomingMessage)
+    req.emit('data', Buffer.from([0xef, 0xbb, 0xbf, 0xef, 0xbb, 0xbf]))
+    req.emit('data', Buffer.from(JSON.stringify({ x: 'a'.repeat(HOOK_REQUEST_MAX_BYTES - 8) })))
+    await expect(body).rejects.toThrow('payload too large')
+    expect(req.destroy).toHaveBeenCalledTimes(1)
+    expectRequestParserListenersReleased(req)
   })
 
   it('rejects JSON beyond the nesting-depth limit', async () => {
diff --git a/src/shared/agent-hook-listener/provider-dispatch.ts b/src/shared/agent-hook-listener/provider-dispatch.ts
index d3abd287e89f..067e4552212c 100644
--- a/src/shared/agent-hook-listener/provider-dispatch.ts
+++ b/src/shared/agent-hook-listener/provider-dispatch.ts
@@ -1,3 +1,4 @@
+import { normalizeQoderEvent } from './providers/qoder-events'
 import type { ParsedAgentStatusPayload } from '../agent-status-types'
 import type { AgentHookSource } from '../agent-hook-relay'
 import { readLastCommandCodeUserPromptEntryFromTranscript } from './command-code-transcript'
@@ -23,6 +24,7 @@ import { normalizeHermesEvent } from './providers/hermes-events'
 import { normalizeDevinEvent } from './providers/devin-events'
 import { normalizeKimiEvent } from './providers/kimi-events'
 import { normalizeMuseEvent } from './providers/muse-events'
+import { normalizeDshEvent } from './providers/dsh-events'
 import { normalizeZCodeEvent } from './providers/zcode-events'
 
 export type ProviderDispatchResult = {
@@ -148,12 +150,18 @@ export function normalizeProviderEvent(input: {
     case 'devin':
       payload = normalizeDevinEvent(state, eventName, promptText, paneKey, hookPayload)
       break
+    case 'qoder':
+      payload = normalizeQoderEvent(state, eventName, promptText, paneKey, hookPayload)
+      break
     case 'kimi':
       payload = normalizeKimiEvent(state, eventName, promptText, paneKey, hookPayload)
       break
     case 'muse':
       payload = normalizeMuseEvent(state, eventName, promptText, paneKey, hookPayload)
       break
+    case 'dsh':
+      payload = normalizeDshEvent(state, eventName, promptText, paneKey, hookPayload)
+      break
     case 'zcode':
       payload = normalizeZCodeEvent(state, eventName, promptText, paneKey, hookPayload)
       break
diff --git a/src/shared/agent-hook-listener/provider-event-routing.ts b/src/shared/agent-hook-listener/provider-event-routing.ts
index f9dc1e6d5d7a..40e59a1d8201 100644
--- a/src/shared/agent-hook-listener/provider-event-routing.ts
+++ b/src/shared/agent-hook-listener/provider-event-routing.ts
@@ -25,6 +25,7 @@ import { extractHermesToolFields } from './providers/hermes-tool-fields'
 export function isNewTurnEvent(source: AgentHookSource, eventName: unknown): boolean {
   // Why: exhaustive switch so a new AgentHookSource fails typecheck here instead of falling through to false.
   switch (source) {
+    case 'qoder':
     case 'claude':
       // Why: SessionStart lands an idle row (STA-3386) and must also drop stale
       // tool/prompt caches left by the pane's previous session.
@@ -35,6 +36,10 @@ export function isNewTurnEvent(source: AgentHookSource, eventName: unknown): boo
     case 'muse':
       // Muse uses Claude-compatible lifecycle events.
       return eventName === 'UserPromptSubmit'
+    case 'dsh':
+      // Why: DSH's Claude-Code hook bridge fires SessionStart once per session before the
+      // first turn, which is the point stale tool/prompt caches from a reused pane must go.
+      return eventName === 'SessionStart' || eventName === 'UserPromptSubmit'
     case 'zcode':
       // Why: matches Codex/Claude — SessionStart lands an idle boundary row and drops stale
       // tool/prompt caches, while UserPromptSubmit is the actual turn boundary.
@@ -134,6 +139,7 @@ export function extractToolFields(
 ): ToolSnapshot {
   // Why: exhaustive switch so a new AgentHookSource fails typecheck here instead of silently routing through OpenCode's extractor.
   switch (source) {
+    case 'qoder':
     case 'claude':
     // Why: Kimi Code uses Claude's tool_name/tool_input payload fields verbatim.
     // falls through
@@ -141,6 +147,9 @@ export function extractToolFields(
     // Muse uses Claude-compatible tool fields.
     // falls through
     case 'muse':
+    // DSH's own Claude-Code hook bridge emits Claude's tool_name/tool_input verbatim.
+    // falls through
+    case 'dsh':
     // Why: ZCode's hook runner writes Claude's `tool_name`/`tool_input`/`tool_response` aliases.
     // falls through
     case 'zcode':
diff --git a/src/shared/agent-hook-listener/providers/dsh-events.test.ts b/src/shared/agent-hook-listener/providers/dsh-events.test.ts
new file mode 100644
index 000000000000..b552018845d1
--- /dev/null
+++ b/src/shared/agent-hook-listener/providers/dsh-events.test.ts
@@ -0,0 +1,122 @@
+import { beforeEach, describe, expect, it } from 'vitest'
+import { createHookListenerState, type HookListenerState } from '../listener-state'
+import { normalizeAndAccept } from '../../agent-hook-listener-test-harness'
+
+// Payload shape copied from a live run of @deepseek-ai/dsh-hooks-claude-code 0.1.5-rc.3
+// mounted through $DSH_HOME/cordis.patch.yml: `session_id`, an always-empty
+// `transcript_path`, `cwd`, `hook_event_name`, plus the per-event fields.
+const SESSION_ID = '9478e2d8-29bc-4009-ab32-657efa2bd763'
+const CHILD_SESSION_ID = 'b1c4fb80-4f12-4a6f-9a68-7c0d5f0f5a12'
+
+const base = { transcript_path: '', cwd: '/tmp/ws', session_id: SESSION_ID }
+
+function event(name: string, extra: Record<string, unknown> = {}): Record<string, unknown> {
+  return { ...base, hook_event_name: name, ...extra }
+}
+
+describe('normalizeDshEvent', () => {
+  let state: HookListenerState
+
+  beforeEach(() => {
+    state = createHookListenerState()
+  })
+
+  it('reports a prompt as working and a stop as done', () => {
+    const submitted = normalizeAndAccept(
+      state,
+      'dsh',
+      event('UserPromptSubmit', { prompt: 'fix the flaky test' })
+    )
+    expect(submitted?.payload.state).toBe('working')
+    expect(submitted?.payload.agentType).toBe('dsh')
+    expect(submitted?.payload.prompt).toBe('fix the flaky test')
+
+    const stopped = normalizeAndAccept(state, 'dsh', event('Stop', { stop_hook_active: false }))
+    expect(stopped?.payload.state).toBe('done')
+    // The prompt is carried across the turn so a finished row still names the work.
+    expect(stopped?.payload.prompt).toBe('fix the flaky test')
+  })
+
+  it('lands an idle row on SessionStart', () => {
+    const started = normalizeAndAccept(state, 'dsh', event('SessionStart', { source: 'startup' }))
+    expect(started?.payload.state).toBe('done')
+    expect(started?.payload.agentType).toBe('dsh')
+  })
+
+  it('treats an ordinary tool as working and surfaces its name', () => {
+    normalizeAndAccept(state, 'dsh', event('UserPromptSubmit', { prompt: 'read the readme' }))
+    const pre = normalizeAndAccept(
+      state,
+      'dsh',
+      event('PreToolUse', {
+        tool_name: 'read',
+        tool_input: { path: 'README.md' },
+        tool_use_id: 'call-1'
+      })
+    )
+    expect(pre?.payload.state).toBe('working')
+    expect(pre?.payload.toolName).toBe('read')
+  })
+
+  it('reports ask_user_question as waiting and its answer as working again', () => {
+    normalizeAndAccept(state, 'dsh', event('UserPromptSubmit', { prompt: 'pick a colour' }))
+    const asked = normalizeAndAccept(
+      state,
+      'dsh',
+      event('PreToolUse', {
+        tool_name: 'ask_user_question',
+        tool_input: {
+          questions: [{ header: 'Colour', question: 'Which one?', options: [{ label: 'Blue' }] }]
+        },
+        tool_use_id: 'call-2'
+      })
+    )
+    // Why this matters: DSH's bridge has no Notification/PermissionRequest event, so the
+    // ask-the-user tool is the only structured signal that a pane needs the user.
+    expect(asked?.payload.state).toBe('waiting')
+    expect(asked?.payload.interactivePrompt).toContain('Which one?')
+
+    const answered = normalizeAndAccept(
+      state,
+      'dsh',
+      event('PostToolUse', {
+        tool_name: 'ask_user_question',
+        tool_use_id: 'call-2',
+        tool_response: 'Blue'
+      })
+    )
+    expect(answered?.payload.state).toBe('working')
+  })
+
+  it('ignores subagent lifecycle events', () => {
+    normalizeAndAccept(state, 'dsh', event('UserPromptSubmit', { prompt: 'delegate this' }))
+    const done = normalizeAndAccept(state, 'dsh', event('Stop', {}))
+    expect(done?.payload.state).toBe('done')
+
+    // The bridge stamps the CHILD's session id and a constant `general-purpose` agent_type
+    // on both subagent events, so a child that outlives the lead's Stop would otherwise
+    // flip the finished pane back to working (the Muse regression in #22216).
+    for (const name of ['SubagentStart', 'SubagentStop']) {
+      expect(
+        normalizeAndAccept(state, 'dsh', {
+          ...base,
+          session_id: CHILD_SESSION_ID,
+          hook_event_name: name,
+          agent_id: 'agent-7',
+          agent_type: 'general-purpose'
+        })
+      ).toBeNull()
+    }
+  })
+
+  it('ignores events the bridge cannot send', () => {
+    // Notification and PermissionRequest are Claude-only; if one ever arrives it is not
+    // from this bridge, and guessing a state from it would be unfounded.
+    expect(
+      normalizeAndAccept(state, 'dsh', event('Notification', { message: 'waiting' }))
+    ).toBeNull()
+    expect(
+      normalizeAndAccept(state, 'dsh', event('PermissionRequest', { tool_name: 'bash' }))
+    ).toBeNull()
+  })
+})
diff --git a/src/shared/agent-hook-listener/providers/dsh-events.ts b/src/shared/agent-hook-listener/providers/dsh-events.ts
new file mode 100644
index 000000000000..670cba55c17d
--- /dev/null
+++ b/src/shared/agent-hook-listener/providers/dsh-events.ts
@@ -0,0 +1,84 @@
+import { isAskUserQuestionTool } from '../../agent-question-answered-intent'
+import {
+  normalizeAgentStatusPayload,
+  type ParsedAgentStatusPayload
+} from '../../agent-status-types'
+import type { HookListenerState } from '../listener-state'
+import {
+  resolvePrompt,
+  resolveToolState,
+  shouldIgnoreCompactContinuationUserPromptSubmit
+} from '../prompt-fields'
+import { extractToolFields, isNewTurnEvent } from '../provider-event-routing'
+import { readString } from '../tool-input-preview'
+
+/**
+ * DeepSeek Harness reaches Orca through its own `@deepseek-ai/dsh-hooks-claude-code`
+ * bridge, so the payloads are Claude-shaped (`session_id`, `tool_name`, `tool_input`,
+ * `tool_use_id`, `prompt`) and the event names are a strict subset of Claude's:
+ * SessionStart, UserPromptSubmit, PreToolUse, PostToolUse, Stop, SubagentStart and
+ * SubagentStop. There is no Notification and no PermissionRequest.
+ *
+ * That missing pair is why the waiting state is read from the tool instead: DSH asks the
+ * user through `ask_user_question` (`@deepseek-ai/dsh-tool-ask-user`), whose PreToolUse
+ * fires while the question card owns the screen and whose PostToolUse only lands once the
+ * user answers. An approval pause has no hook of its own and reads as `working`, which is
+ * the honest answer — the harness is mid-tool, not idle.
+ */
+export function normalizeDshEvent(
+  state: HookListenerState,
+  eventName: unknown,
+  promptText: string,
+  paneKey: string,
+  hookPayload: Record<string, unknown>
+): ParsedAgentStatusPayload | null {
+  if (shouldIgnoreCompactContinuationUserPromptSubmit(eventName, promptText)) {
+    return null
+  }
+
+  // Why: the bridge stamps the *child's* session id on both subagent events and labels
+  // every child `general-purpose`, so a child turn cannot be told from the lead's. Muse
+  // (#22216) showed what that costs: child hooks flip a finished pane back to working.
+  if (eventName === 'SubagentStart' || eventName === 'SubagentStop') {
+    return null
+  }
+
+  const toolName = readString(hookPayload, 'tool_name')
+
+  let stateName: 'working' | 'waiting' | 'done'
+  switch (eventName) {
+    case 'UserPromptSubmit':
+    case 'PostToolUse':
+      stateName = 'working'
+      break
+    case 'PreToolUse':
+      stateName = isAskUserQuestionTool(toolName) ? 'waiting' : 'working'
+      break
+    case 'SessionStart':
+    case 'Stop':
+      stateName = 'done'
+      break
+    default:
+      return null
+  }
+
+  const snapshot = resolveToolState(
+    state,
+    paneKey,
+    extractToolFields('dsh', eventName, hookPayload),
+    { resetOnNewTurn: isNewTurnEvent('dsh', eventName) }
+  )
+
+  return normalizeAgentStatusPayload({
+    state: stateName,
+    prompt: resolvePrompt(state, paneKey, promptText, {
+      resetOnNewTurn: isNewTurnEvent('dsh', eventName)
+    }),
+    agentType: 'dsh',
+    toolName: snapshot.toolName,
+    toolInput: snapshot.toolInput,
+    interactivePrompt: snapshot.interactivePrompt,
+    lastAssistantMessage: snapshot.lastAssistantMessage,
+    lastAssistantMessageIsToolOutput: snapshot.lastAssistantMessageIsToolOutput
+  })
+}
diff --git a/src/shared/agent-hook-listener/providers/qoder-events.ts b/src/shared/agent-hook-listener/providers/qoder-events.ts
new file mode 100644
index 000000000000..bdf2a622dbec
--- /dev/null
+++ b/src/shared/agent-hook-listener/providers/qoder-events.ts
@@ -0,0 +1,87 @@
+import { isAskUserQuestionTool } from '../../agent-question-answered-intent'
+import {
+  normalizeAgentStatusPayload,
+  type ParsedAgentStatusPayload
+} from '../../agent-status-types'
+import type { HookListenerState } from '../listener-state'
+import {
+  resolvePrompt,
+  resolveToolState,
+  shouldIgnoreCompactContinuationUserPromptSubmit
+} from '../prompt-fields'
+import { extractToolFields, isNewTurnEvent } from '../provider-event-routing'
+import { readString } from '../tool-input-preview'
+
+function readQoderState(
+  eventName: unknown,
+  payload: Record<string, unknown>
+): 'working' | 'waiting' | 'done' | null {
+  switch (eventName) {
+    case 'SessionStart':
+      // Compaction restarts the session during an active turn.
+      return ['startup', 'resume', 'clear', 'new'].includes(String(payload.source)) ? 'done' : null
+    case 'UserPromptSubmit':
+    case 'PostToolUse':
+    case 'PostToolUseFailure':
+      return 'working'
+    case 'PreToolUse':
+      return isAskUserQuestionTool(readString(payload, 'tool_name')) ? 'waiting' : 'working'
+    case 'PermissionRequest':
+      return 'waiting'
+    case 'Stop':
+    case 'StopFailure':
+    case 'SessionEnd':
+      return 'done'
+    case 'PostCompact':
+      return payload.trigger === 'manual' ? 'done' : null
+    case 'Notification':
+      if (
+        payload.notification_type === 'permission_prompt' ||
+        payload.notification_type === 'elicitation_dialog'
+      ) {
+        return 'waiting'
+      }
+      return payload.notification_type === 'idle_prompt' ? 'done' : null
+    default:
+      return null
+  }
+}
+
+export function normalizeQoderEvent(
+  state: HookListenerState,
+  eventName: unknown,
+  promptText: string,
+  paneKey: string,
+  hookPayload: Record<string, unknown>
+): ParsedAgentStatusPayload | null {
+  if (shouldIgnoreCompactContinuationUserPromptSubmit(eventName, promptText)) {
+    return null
+  }
+  const stateName = readQoderState(eventName, hookPayload)
+  if (!stateName) {
+    return null
+  }
+  const resetOnNewTurn = isNewTurnEvent('qoder', eventName)
+  const snapshot = resolveToolState(
+    state,
+    paneKey,
+    extractToolFields('qoder', eventName, hookPayload),
+    { resetOnNewTurn }
+  )
+  return normalizeAgentStatusPayload({
+    state: stateName,
+    agentType: 'qoder',
+    prompt: resolvePrompt(state, paneKey, promptText, { resetOnNewTurn }),
+    toolName: snapshot.toolName,
+    toolInput: snapshot.toolInput,
+    interactivePrompt: snapshot.interactivePrompt,
+    lastAssistantMessage: snapshot.lastAssistantMessage,
+    lastAssistantMessageIsToolOutput: snapshot.lastAssistantMessageIsToolOutput,
+    sessionBoundary: eventName === 'SessionStart' || eventName === 'PostCompact' ? true : undefined,
+    interrupted: eventName === 'Stop' && hookPayload.is_interrupt === true ? true : undefined,
+    mainAgent:
+      eventName === 'StopFailure'
+        ? { state: 'done', outcome: 'failure', stateStartedAt: Date.now() }
+        : undefined
+  })
+}
diff --git a/src/shared/agent-hook-listener/request-body.ts b/src/shared/agent-hook-listener/request-body.ts
index b453c7c1f7e3..88f012527836 100644
--- a/src/shared/agent-hook-listener/request-body.ts
+++ b/src/shared/agent-hook-listener/request-body.ts
@@ -12,10 +12,12 @@ const AGENT_HOOK_JSON_STRUCTURE_LIMITS = {
 } as const
 
 export function parseAgentHookJson(content: string): unknown {
-  // Why: Cursor on Windows writes UTF-8-with-BOM to the hook's stdin and `JSON.parse` rejects U+FEFF,
-  // so the whole event was dropped. Strip exactly one leading BOM — not a trim — to keep every other
-  // malformed payload rejected as before.
-  const normalizedContent = content.charCodeAt(0) === 0xfeff ? content.slice(1) : content
+  // Cursor on Windows can pipe duplicated BOMs before the JSON (#21421).
+  let offset = 0
+  while (offset < content.length && content.charCodeAt(offset) === 0xfeff) {
+    offset += 1
+  }
+  const normalizedContent = offset > 0 ? content.slice(offset) : content
   assertJsonTextStructureWithinLimits(normalizedContent, AGENT_HOOK_JSON_STRUCTURE_LIMITS)
   return JSON.parse(normalizedContent) as unknown
 }
diff --git a/src/shared/agent-hook-listener/source-routing.ts b/src/shared/agent-hook-listener/source-routing.ts
index e84313b0c261..2b7f0147e60a 100644
--- a/src/shared/agent-hook-listener/source-routing.ts
+++ b/src/shared/agent-hook-listener/source-routing.ts
@@ -5,6 +5,7 @@ import type { AgentHookSource } from '../agent-hook-relay'
 export const HOOK_SOURCE_BY_PATHNAME: Readonly<Record<string, AgentHookSource>> = Object.freeze({
   '/hook/claude': 'claude',
   '/hook/codex': 'codex',
+  '/hook/qoder': 'qoder',
   '/hook/gemini': 'gemini',
   '/hook/antigravity': 'antigravity',
   '/hook/amp': 'amp',
@@ -23,7 +24,8 @@ export const HOOK_SOURCE_BY_PATHNAME: Readonly<Record<string, AgentHookSource>>
   '/hook/devin': 'devin',
   '/hook/kimi': 'kimi',
   '/hook/muse': 'muse',
-  '/hook/zcode': 'zcode'
+  '/hook/zcode': 'zcode',
+  '/hook/dsh': 'dsh'
 })
 
 export function resolveHookSource(pathname: string): AgentHookSource | null {
diff --git a/src/shared/agent-hook-relay.ts b/src/shared/agent-hook-relay.ts
index cc5d21ba8f72..7e0d452a66bf 100644
--- a/src/shared/agent-hook-relay.ts
+++ b/src/shared/agent-hook-relay.ts
@@ -37,6 +37,7 @@ import type { AgentHookTarget } from './agent-hook-types'
 const AGENT_HOOK_SOURCES = [
   'claude',
   'codex',
+  'qoder',
   'gemini',
   'antigravity',
   'amp',
@@ -55,7 +56,8 @@ const AGENT_HOOK_SOURCES = [
   'devin',
   'kimi',
   'muse',
-  'zcode'
+  'zcode',
+  'dsh'
 ] as const
 
 export type AgentHookSource = (typeof AGENT_HOOK_SOURCES)[number]
diff --git a/src/shared/agent-hook-scrub-safe-env.test.ts b/src/shared/agent-hook-scrub-safe-env.test.ts
new file mode 100644
index 000000000000..42368b03b19d
--- /dev/null
+++ b/src/shared/agent-hook-scrub-safe-env.test.ts
@@ -0,0 +1,59 @@
+import { describe, expect, it } from 'vitest'
+import {
+  applyScrubSafeAgentEnvAliases,
+  ORCA_SCRUB_SAFE_LAUNCH_ENV,
+  ORCA_SCRUB_SAFE_PANE_ENV
+} from './agent-hook-scrub-safe-env'
+
+/** The rule DeepSeek Harness's shell executor applies, measured against dsh 0.1.5-rc.1. */
+function isScrubbedName(name: string): boolean {
+  return /KEY|TOKEN|SECRET|PASSWORD/.test(name)
+}
+
+describe('applyScrubSafeAgentEnvAliases', () => {
+  it('mirrors pane identity onto names a credential scrub keeps', () => {
+    const env: Record<string, string> = {
+      ORCA_PANE_KEY: 'tab-1:11111111-1111-4111-8111-111111111111',
+      ORCA_AGENT_LAUNCH_TOKEN: 'launch-abc'
+    }
+    applyScrubSafeAgentEnvAliases(env)
+    expect(env[ORCA_SCRUB_SAFE_PANE_ENV]).toBe(env.ORCA_PANE_KEY)
+    expect(env[ORCA_SCRUB_SAFE_LAUNCH_ENV]).toBe(env.ORCA_AGENT_LAUNCH_TOKEN)
+  })
+
+  it('picks alias names the scrub does not take', () => {
+    // The whole point: if an alias were itself scrubbed it would carry nothing.
+    expect(isScrubbedName(ORCA_SCRUB_SAFE_PANE_ENV)).toBe(false)
+    expect(isScrubbedName(ORCA_SCRUB_SAFE_LAUNCH_ENV)).toBe(false)
+    expect(isScrubbedName('ORCA_PANE_KEY')).toBe(true)
+    expect(isScrubbedName('ORCA_AGENT_LAUNCH_TOKEN')).toBe(true)
+  })
+
+  it('leaves the canonical names untouched', () => {
+    const env: Record<string, string> = { ORCA_PANE_KEY: 'pane', ORCA_AGENT_LAUNCH_TOKEN: 'tok' }
+    applyScrubSafeAgentEnvAliases(env)
+    expect(env.ORCA_PANE_KEY).toBe('pane')
+    expect(env.ORCA_AGENT_LAUNCH_TOKEN).toBe('tok')
+  })
+
+  it('drops a stale alias when its source is gone', () => {
+    // Why this matters: an alias inherited from a parent pane would attribute this pane's
+    // hooks to the wrong row — worse than reporting no status at all.
+    const env: Record<string, string> = {
+      [ORCA_SCRUB_SAFE_PANE_ENV]: 'inherited-pane',
+      [ORCA_SCRUB_SAFE_LAUNCH_ENV]: 'inherited-launch'
+    }
+    applyScrubSafeAgentEnvAliases(env)
+    expect(env[ORCA_SCRUB_SAFE_PANE_ENV]).toBeUndefined()
+    expect(env[ORCA_SCRUB_SAFE_LAUNCH_ENV]).toBeUndefined()
+  })
+
+  it('treats an empty source as absent', () => {
+    const env: Record<string, string> = {
+      ORCA_PANE_KEY: '',
+      [ORCA_SCRUB_SAFE_PANE_ENV]: 'stale'
+    }
+    applyScrubSafeAgentEnvAliases(env)
+    expect(env[ORCA_SCRUB_SAFE_PANE_ENV]).toBeUndefined()
+  })
+})
diff --git a/src/shared/agent-hook-scrub-safe-env.ts b/src/shared/agent-hook-scrub-safe-env.ts
new file mode 100644
index 000000000000..e83895e2a30d
--- /dev/null
+++ b/src/shared/agent-hook-scrub-safe-env.ts
@@ -0,0 +1,49 @@
+/**
+ * Scrub-safe aliases for the two pane-identity env vars whose NAMES some agent harnesses
+ * refuse to pass through to a hook process.
+ *
+ * DeepSeek Harness runs command hooks through its own shell executor, which drops every
+ * variable whose name contains `KEY`, `TOKEN`, `SECRET` or `PASSWORD` before the hook
+ * process starts. That is a reasonable credential-scrub default, and it is not something
+ * Orca can turn off — but it takes `ORCA_PANE_KEY` and `ORCA_AGENT_LAUNCH_TOKEN` with it,
+ * which are the two values a status hook needs to say *which pane* it is reporting for.
+ * Without them the hook has nothing to attribute to and exits without posting, so the pane
+ * reads as an agent Orca never hears from.
+ *
+ * Verified against `@deepseek-ai/dsh` 0.1.5-rc.1 by running a probe hook that printed its
+ * own environment: `PROBE_PLAIN`, `PROBE_AUTH`, `PROBE_CREDENTIAL`, `PROBE_HOOK_PORT` and
+ * `PROBE_PANE_ID` arrive; `PROBE_KEY`, `PROBE_TOKEN`, `PROBE_SECRET`, `PROBE_PASSWORD` and
+ * `PROBE_PANE_KEY` do not.
+ *
+ * These are aliases, never replacements: the canonical names stay exactly as they are, so
+ * every existing agent, script and test keeps reading what it reads today.
+ */
+
+/** Alias for `ORCA_PANE_KEY`. */
+export const ORCA_SCRUB_SAFE_PANE_ENV = 'ORCA_AGENT_PANE' as const
+
+/** Alias for `ORCA_AGENT_LAUNCH_TOKEN`. */
+export const ORCA_SCRUB_SAFE_LAUNCH_ENV = 'ORCA_AGENT_LAUNCH' as const
+
+const ALIASES: readonly (readonly [source: string, alias: string])[] = [
+  ['ORCA_PANE_KEY', ORCA_SCRUB_SAFE_PANE_ENV],
+  ['ORCA_AGENT_LAUNCH_TOKEN', ORCA_SCRUB_SAFE_LAUNCH_ENV]
+]
+
+/**
+ * Mirror pane identity onto its scrub-safe aliases, in place.
+ *
+ * An alias is written only when its source is present, and dropped when the source is
+ * absent — a stale alias inherited from a parent pane would attribute this pane's hooks to
+ * the wrong row, which is worse than no status at all.
+ */
+export function applyScrubSafeAgentEnvAliases(env: Record<string, string>): void {
+  for (const [source, alias] of ALIASES) {
+    const value = env[source]
+    if (value === undefined || value === '') {
+      delete env[alias]
+      continue
+    }
+    env[alias] = value
+  }
+}
diff --git a/src/shared/agent-hook-types.ts b/src/shared/agent-hook-types.ts
index a006c2cc37de..cc83527fc096 100644
--- a/src/shared/agent-hook-types.ts
+++ b/src/shared/agent-hook-types.ts
@@ -7,6 +7,7 @@ export const AGENT_HOOK_TARGETS = [
   'claude',
   'openclaude',
   'codex',
+  'qoder',
   'gemini',
   'antigravity',
   'amp',
@@ -19,7 +20,8 @@ export const AGENT_HOOK_TARGETS = [
   'devin',
   'kimi',
   'muse',
-  'zcode'
+  'zcode',
+  'dsh'
 ] as const
 export type AgentHookTarget = (typeof AGENT_HOOK_TARGETS)[number]
 
diff --git a/src/shared/agent-icons/dsh.png b/src/shared/agent-icons/dsh.png
new file mode 100644
index 000000000000..b5835f8f61fe
Binary files /dev/null and b/src/shared/agent-icons/dsh.png differ
diff --git a/src/shared/agent-icons/freebuff.png b/src/shared/agent-icons/freebuff.png
new file mode 100644
index 000000000000..acb0e0aadde1
Binary files /dev/null and b/src/shared/agent-icons/freebuff.png differ
diff --git a/src/shared/agent-icons/qoder.png b/src/shared/agent-icons/qoder.png
new file mode 100644
index 000000000000..42c952ed33a1
Binary files /dev/null and b/src/shared/agent-icons/qoder.png differ
diff --git a/src/shared/agent-kind.ts b/src/shared/agent-kind.ts
index 06fa51ab76c3..375bac1bd2e5 100644
--- a/src/shared/agent-kind.ts
+++ b/src/shared/agent-kind.ts
@@ -25,6 +25,7 @@ const TUI_AGENT_KIND_BY_AGENT = {
   pi: 'pi',
   omp: 'omp',
   'prime-agent': 'prime-agent',
+  qoder: 'qoder',
   gemini: 'gemini',
   antigravity: 'antigravity',
   aider: 'aider',
@@ -36,6 +37,7 @@ const TUI_AGENT_KIND_BY_AGENT = {
   aug: 'aug',
   cline: 'cline',
   codebuff: 'codebuff',
+  freebuff: 'freebuff',
   'command-code': 'command-code',
   continue: 'continue',
   cursor: 'cursor',
@@ -52,7 +54,8 @@ const TUI_AGENT_KIND_BY_AGENT = {
   ante: 'ante',
   trae: 'trae',
   muse: 'muse',
-  zcode: 'zcode'
+  zcode: 'zcode',
+  dsh: 'dsh'
 } satisfies Record<TuiAgent, ConcreteAgentKind>
 
 // Why: `satisfies Record<TuiAgent, …>` makes the lookup exhaustive at compile
diff --git a/src/shared/agent-launch-intent.ts b/src/shared/agent-launch-intent.ts
index 7e68340fdba3..016b759d8773 100644
--- a/src/shared/agent-launch-intent.ts
+++ b/src/shared/agent-launch-intent.ts
@@ -105,7 +105,7 @@ export type AgentLaunchOutcome =
       sessionId: string
       handle: string
       /** The host-owned id of the tab that shows this chat: the tab half of the reserved `paneKey`
-       *  when one was sent, else the one the host recorded. Identity, not placement, like the
+       *  when one was sent, else the one the host gave its tab. Identity, not placement, like the
        *  terminal arm's `paneKey`. Absent from hosts that predate it. */
       tabId?: string
     }
diff --git a/src/shared/agent-main-agent-verdict.test.ts b/src/shared/agent-main-agent-verdict.test.ts
new file mode 100644
index 000000000000..b41d44af4abd
--- /dev/null
+++ b/src/shared/agent-main-agent-verdict.test.ts
@@ -0,0 +1,124 @@
+import { describe, expect, it } from 'vitest'
+import {
+  agentMainAgentVerdict,
+  agentTurnEndedUncleanly,
+  agentTurnStoppedByUser,
+  agentVerdictDisplayMark,
+  agentVerdictFields,
+  type AgentMainAgentVerdictSource
+} from './agent-main-agent-verdict'
+import type { AgentStatusState } from './agent-status-types'
+import { AGENT_JOURNAL_TURN_OUTCOMES, type AgentJournalTurnOutcome } from './agent-turn-outcome'
+
+const STATES: AgentStatusState[] = ['working', 'blocked', 'waiting', 'done']
+const OUTCOMES: (AgentJournalTurnOutcome | undefined)[] = [
+  undefined,
+  ...AGENT_JOURNAL_TURN_OUTCOMES
+]
+
+// The rule as the plan states it: the main agent's own state decides when a row carries it; a row
+// without it (a legacy or old-host row) reads the legacy flag, which alone needs the combined `done`.
+function expected(row: AgentMainAgentVerdictSource): AgentJournalTurnOutcome | null {
+  const legacyFlag = row.state === 'done' && row.interrupted === true ? 'cancellation' : null
+  if (row.mainAgent) {
+    return row.mainAgent.state === 'done' ? (row.mainAgent.outcome ?? legacyFlag) : null
+  }
+  return legacyFlag
+}
+
+const MAIN_AGENTS: (AgentMainAgentVerdictSource['mainAgent'] | undefined)[] = [
+  undefined,
+  ...STATES.flatMap((state) =>
+    OUTCOMES.map((outcome) => ({ state, ...(outcome ? { outcome } : {}) }))
+  )
+]
+
+const PRODUCT: AgentMainAgentVerdictSource[] = STATES.flatMap((state) =>
+  MAIN_AGENTS.flatMap((mainAgent) =>
+    [undefined, false, true].map((interrupted) => ({
+      state,
+      ...(interrupted !== undefined ? { interrupted } : {}),
+      ...(mainAgent ? { mainAgent } : {})
+    }))
+  )
+)
+
+describe('agentMainAgentVerdict', () => {
+  it('decodes the one verdict over (main agent present/absent) x combined state x outcomes x flag', () => {
+    for (const row of PRODUCT) {
+      const verdict = expected(row)
+      const label = JSON.stringify(row)
+      expect(agentMainAgentVerdict(row), label).toBe(verdict)
+      expect(agentTurnEndedUncleanly(row), label).toBe(
+        verdict === 'cancellation' || verdict === 'failure'
+      )
+      expect(agentTurnStoppedByUser(row), label).toBe(verdict === 'cancellation')
+      expect(agentVerdictDisplayMark(row), label).toBe(
+        verdict === 'failure'
+          ? 'failed'
+          : verdict === 'cancellation' && row.state === 'done'
+            ? 'interrupted'
+            : null
+      )
+    }
+  })
+
+  it('reads a main agent that failed while its subagent still works as failed', () => {
+    const row = {
+      state: 'working' as const,
+      mainAgent: { state: 'done' as const, outcome: 'failure' as const }
+    }
+    expect(agentMainAgentVerdict(row)).toBe('failure')
+    expect(agentVerdictDisplayMark(row)).toBe('failed')
+  })
+
+  it('keeps a success or a stop with live subagent work reading working', () => {
+    for (const outcome of ['success', 'cancellation'] as const) {
+      const row = { state: 'working' as const, mainAgent: { state: 'done' as const, outcome } }
+      expect(agentVerdictDisplayMark(row)).toBeNull()
+    }
+  })
+
+  it('has no verdict while the main agent itself is not done, whatever the combined row says', () => {
+    const row = {
+      state: 'done' as const,
+      interrupted: true,
+      mainAgent: { state: 'working' as const }
+    }
+    expect(agentMainAgentVerdict(row)).toBeNull()
+  })
+
+  it('reads the legacy flag only on a done row, and under a done main agent with no outcome', () => {
+    expect(agentMainAgentVerdict({ state: 'working', interrupted: true })).toBeNull()
+    expect(
+      agentMainAgentVerdict({ state: 'done', interrupted: true, mainAgent: { state: 'done' } })
+    ).toBe('cancellation')
+    expect(agentMainAgentVerdict({ state: 'done', interrupted: true })).toBe('cancellation')
+  })
+
+  it('prefers the recorded verdict over the legacy flag', () => {
+    expect(
+      agentMainAgentVerdict({
+        state: 'done',
+        interrupted: true,
+        mainAgent: { state: 'done', outcome: 'failure' }
+      })
+    ).toBe('failure')
+  })
+})
+
+describe('agentVerdictFields', () => {
+  const mainAgent = { state: 'done' as const, outcome: 'failure' as const, stateStartedAt: 7 }
+
+  it('copies the whole main agent status and a true legacy flag together', () => {
+    expect(agentVerdictFields({ interrupted: true, mainAgent })).toEqual({
+      interrupted: true,
+      mainAgent
+    })
+  })
+
+  it('copies nothing a row does not carry, and never a false flag', () => {
+    expect(agentVerdictFields({ interrupted: false })).toEqual({})
+    expect(agentVerdictFields({})).toEqual({})
+  })
+})
diff --git a/src/shared/agent-main-agent-verdict.ts b/src/shared/agent-main-agent-verdict.ts
new file mode 100644
index 000000000000..f9754cf0c38d
--- /dev/null
+++ b/src/shared/agent-main-agent-verdict.ts
@@ -0,0 +1,75 @@
+import type { AgentJournalTurnOutcome } from './agent-turn-outcome'
+import type { AgentStatusState } from './agent-status-types'
+import type { AgentMainAgentStatus } from './main-agent-status'
+
+export type AgentMainAgentVerdictSource = {
+  state: AgentStatusState
+  interrupted?: boolean
+  mainAgent?: { state: AgentStatusState; outcome?: AgentJournalTurnOutcome }
+}
+
+/** The fields that carry the verdict. History entries, sleep records and `worktree ps` rows copy
+ *  them through {@link agentVerdictFields}, so no copy keeps one form and drops the other. */
+export type AgentVerdictFields = {
+  interrupted?: true
+  mainAgent?: AgentMainAgentStatus
+}
+
+/** The verdict-bearing fields to copy from a row onto another record. */
+export function agentVerdictFields(row: {
+  interrupted?: boolean
+  mainAgent?: AgentMainAgentStatus
+}): AgentVerdictFields {
+  return {
+    ...(row.interrupted === true ? { interrupted: true } : {}),
+    ...(row.mainAgent ? { mainAgent: row.mainAgent } : {})
+  }
+}
+
+/**
+ * The recorded verdict on the main agent's latest finished turn. One fact at two fidelities:
+ * `mainAgent.outcome`, and the legacy `interrupted` flag, which only ever meant a cancellation.
+ * Read from the main agent's own state, not the combined row's: a main agent that failed while its
+ * subagents still work has a verdict. Null while the main agent is not done, and when no verdict
+ * was recorded. Only the legacy flag needs the combined `done`, because a row without `mainAgent`
+ * has nothing else that says the main agent itself finished.
+ */
+export function agentMainAgentVerdict(
+  row: AgentMainAgentVerdictSource
+): AgentJournalTurnOutcome | null {
+  if (row.mainAgent && row.mainAgent.state !== 'done') {
+    return null
+  }
+  return (
+    row.mainAgent?.outcome ??
+    (row.state === 'done' && row.interrupted === true ? 'cancellation' : null)
+  )
+}
+
+/**
+ * What the verdict marks on the agent's own display. A failure outranks every combined state: it
+ * is news the user must see even while subagents still run. A stop marks only a row that is itself
+ * done, so a stopped main agent's live child work still reads working, as a clean finish does.
+ */
+export function agentVerdictDisplayMark(
+  row: AgentMainAgentVerdictSource
+): 'failed' | 'interrupted' | null {
+  const verdict = agentMainAgentVerdict(row)
+  if (verdict === 'failure') {
+    return 'failed'
+  }
+  return verdict === 'cancellation' && row.state === 'done' ? 'interrupted' : null
+}
+
+/** The turn ended without finishing its work: stopped, or failed. Clean-finish policy
+ *  (hibernation, pane ownership, the value moment) treats both alike. */
+export function agentTurnEndedUncleanly(row: AgentMainAgentVerdictSource): boolean {
+  const verdict = agentMainAgentVerdict(row)
+  return verdict === 'cancellation' || verdict === 'failure'
+}
+
+/** The user stopped the turn. Attention (completion time, Smart Sort, sticky retention) demotes
+ *  only this: a failure is news the user has not seen, so it ranks like a completion. */
+export function agentTurnStoppedByUser(row: AgentMainAgentVerdictSource): boolean {
+  return agentMainAgentVerdict(row) === 'cancellation'
+}
diff --git a/src/shared/agent-node-entrypoint-identities.ts b/src/shared/agent-node-entrypoint-identities.ts
index e71118312d01..fb4327c076f5 100644
--- a/src/shared/agent-node-entrypoint-identities.ts
+++ b/src/shared/agent-node-entrypoint-identities.ts
@@ -26,5 +26,13 @@ export const EXACT_NODE_ENTRYPOINT_IDENTITIES: readonly {
     pattern: /(?:^|\/)node_modules\/prime-agent\/dist\/bundle\/cli\.js$/,
     agent: 'prime-agent',
     processName: 'prime-agent'
+  },
+  // Why: DSH's npm shim launches a generic `lib/bin.js`, and the launcher re-execs it
+  // directly on Windows, so only the package path identifies it. The profile still decides
+  // whether the pane is the agent — `dsh web` resolves here too and is filtered after.
+  {
+    pattern: /(?:^|\/)node_modules\/@deepseek-ai\/dsh\/lib\/bin\.js$/,
+    agent: 'dsh',
+    processName: 'dsh'
   }
 ]
diff --git a/src/shared/agent-node-package-entrypoints.ts b/src/shared/agent-node-package-entrypoints.ts
new file mode 100644
index 000000000000..905d41f95f09
--- /dev/null
+++ b/src/shared/agent-node-package-entrypoints.ts
@@ -0,0 +1,16 @@
+// Node CLIs whose shim launches a script named after the agent, but generic enough that
+// the basename alone is not identity (`dsh-tui.js` could be anyone's file). The package
+// directory in the resolved path is what makes the match authoritative.
+//
+// Split out of agent-process-recognition.ts so the recognizer keeps only its logic and a
+// new agent's install path is a data edit, as in agent-node-entrypoint-identities.ts.
+export const NODE_PACKAGE_SCRIPT_ENTRYPOINTS: Record<string, readonly string[]> = {
+  codex: ['node_modules/@openai/codex/'],
+  gemini: ['node_modules/@google/gemini-cli/'],
+  // Why: ZCode's npm bin is `dist/zcode.cjs`, so a package install runs as `node …zcode.cjs`
+  // and never shows `zcode` as the foreground name (a SEA build still matches by name).
+  zcode: ['node_modules/@zcode/cli/'],
+  // Why: the `dsh-tui` launcher is installed twice — once on PATH and once inside the
+  // profile it bootstraps — and the PATH copy re-execs the profile copy by absolute path.
+  'dsh-tui': ['node_modules/@deepseek-harness-tui/dsh-tui/']
+}
diff --git a/src/shared/agent-overlay-env.ts b/src/shared/agent-overlay-env.ts
new file mode 100644
index 000000000000..91e1f85b6ab9
--- /dev/null
+++ b/src/shared/agent-overlay-env.ts
@@ -0,0 +1,27 @@
+// Why: a nested terminal can inherit prior OpenCode/Pi/OMP overlay env; restore the user's recorded source dir, else strip only Orca-owned values.
+export function restoreOrStripOverlayEnv(
+  baseEnv: Record<string, string>,
+  keys: {
+    primary: string
+    overlay: string
+    source: string
+    preserveExplicitPrimary?: boolean
+  },
+  inheritedEnv: NodeJS.ProcessEnv = process.env
+): void {
+  const sourceValue = baseEnv[keys.source] ?? inheritedEnv[keys.source]
+  const overlayValue = baseEnv[keys.overlay] ?? inheritedEnv[keys.overlay]
+  // Source-only markers from older launches still identify an inherited overlay.
+  const preservePrimary =
+    keys.preserveExplicitPrimary &&
+    Boolean(overlayValue) &&
+    baseEnv[keys.primary] !== undefined &&
+    baseEnv[keys.primary] !== overlayValue
+  if (sourceValue && !preservePrimary) {
+    baseEnv[keys.primary] = sourceValue
+  } else if (overlayValue && baseEnv[keys.primary] === overlayValue) {
+    delete baseEnv[keys.primary]
+  }
+  delete baseEnv[keys.overlay]
+  delete baseEnv[keys.source]
+}
diff --git a/src/shared/agent-process-recognition.ts b/src/shared/agent-process-recognition.ts
index a0f0faa68e7c..a8262eb4760e 100644
--- a/src/shared/agent-process-recognition.ts
+++ b/src/shared/agent-process-recognition.ts
@@ -1,5 +1,6 @@
 import { getTuiAgentDetectCommands, TUI_AGENT_CONFIG } from './tui-agent-config'
 import { EXACT_NODE_ENTRYPOINT_IDENTITIES } from './agent-node-entrypoint-identities'
+import { NODE_PACKAGE_SCRIPT_ENTRYPOINTS } from './agent-node-package-entrypoints'
 import type { AgentType } from './agent-status-types'
 import type { TuiAgent } from './tui-agent'
 import { filterHeadlessOneShotAgentCommand } from './agent-headless-command'
@@ -35,13 +36,6 @@ function normalizeProcessName(
 }
 
 const FOREGROUND_AGENT_WRAPPER_PROCESS_NAMES = new Set(['node', 'python', 'python3'])
-const NODE_PACKAGE_SCRIPT_ENTRYPOINTS: Record<string, readonly string[]> = {
-  codex: ['node_modules/@openai/codex/'],
-  gemini: ['node_modules/@google/gemini-cli/'],
-  // Why: ZCode's npm bin is `dist/zcode.cjs`, so a package install runs as `node …zcode.cjs`
-  // and never shows `zcode` as the foreground name (a SEA build still matches by name).
-  zcode: ['node_modules/@zcode/cli/']
-}
 const PYTHON_SCRIPT_ENTRYPOINT_DIRECTORIES = ['/bin/', '/scripts/', '/site-packages/']
 
 const PROCESS_TO_AGENT = new Map<string, TuiAgent>()
@@ -79,6 +73,10 @@ function agentForNormalizedProcess(normalized: string): TuiAgent | undefined {
   if (normalized.startsWith('codex-')) {
     return PROCESS_TO_AGENT.get('codex')
   }
+  // Qoder's launcher resolves to a versioned native binary.
+  if (/^qodercli-\d/.test(normalized)) {
+    return PROCESS_TO_AGENT.get('qodercli')
+  }
   if (normalized.startsWith('grok-')) {
     return PROCESS_TO_AGENT.get('grok')
   }
@@ -164,6 +162,7 @@ export function isExpectedAgentProcess(
   return (
     normalizedProcess === normalizedExpected ||
     normalizedProcess.startsWith(`${normalizedExpected}.`) ||
+    (normalizedExpected === 'qodercli' && /^qodercli-\d/.test(normalizedProcess)) ||
     (normalizedExpected === 'muse' && normalizedProcess.startsWith('muse-bin-'))
   )
 }
diff --git a/src/shared/agent-session-conversation-command.ts b/src/shared/agent-session-conversation-command.ts
index e1c038de934a..8b5ecb6ccf04 100644
--- a/src/shared/agent-session-conversation-command.ts
+++ b/src/shared/agent-session-conversation-command.ts
@@ -1,11 +1,20 @@
+import type { AgentSessionFailureFact } from './agent-session-failure'
+import type { AgentSessionFailureSentence } from './agent-session-failure-words'
+
 export type AgentSessionConversationCommand = 'clear' | 'compact'
 
 export type AgentSessionConversationCommandResult = {
   command: AgentSessionConversationCommand
   state: 'completed' | 'unknown'
   replacementSessionId?: string
-  error?: string
-}
+} &
+  /** `error`: a sentence for a person; released clients print it as it is. */
+  (
+    | { error?: string; failure?: undefined }
+    /** What failed, typed, beside its sentence, both from `agentSessionFailureWords`; `failure` is
+     *  absent from older hosts. */
+    | { error: AgentSessionFailureSentence; failure: AgentSessionFailureFact }
+  )
 
 export type AgentSessionConversationCommandRecord = AgentSessionConversationCommandResult & {
   runtimeFence?: number
diff --git a/src/shared/agent-session-conversation-outline.ts b/src/shared/agent-session-conversation-outline.ts
index bc4fa3b40ade..2b6bb846adb8 100644
--- a/src/shared/agent-session-conversation-outline.ts
+++ b/src/shared/agent-session-conversation-outline.ts
@@ -75,8 +75,8 @@ export function truncateOutlinePreview(text: string, maxChars: number): string {
 
 /** User messages that draw a transcript row, in transcript order. Projected over the
  *  whole journal, not user items alone: whether a user row survives depends on its
- *  neighbours (a harness sidecar folds into the turn before it) and its order on
- *  when it was observed. Previews are uncut; the reply bound owns length. */
+ *  neighbours (a harness sidecar folds into the turn before it), and its order is
+ *  its journal position. Previews are uncut; the reply bound owns length. */
 export function projectAgentSessionConversationOutline(
   items: readonly AgentJournalRenderItem[],
   submissions: readonly AgentJournalSubmission[]
diff --git a/src/shared/agent-session-failure-words.test.ts b/src/shared/agent-session-failure-words.test.ts
new file mode 100644
index 000000000000..859d3782cc82
--- /dev/null
+++ b/src/shared/agent-session-failure-words.test.ts
@@ -0,0 +1,227 @@
+import { describe, expect, it } from 'vitest'
+import {
+  AGENT_SESSION_ATTACHMENT_PROBLEM_REASONS,
+  AGENT_SESSION_FAILURE_KINDS,
+  isSubmissionRejectionFact,
+  readAgentSessionFailureFact,
+  type AgentSessionFailureFact,
+  type AgentSessionFailureKind,
+  type SubmissionRejectionKind
+} from './agent-session-failure'
+import {
+  agentSessionFailureSentence,
+  agentSessionFailureWords,
+  type AgentSessionFailureSurface
+} from './agent-session-failure-words'
+import {
+  classifyDispatchRejection,
+  DISPATCH_REJECTED_CANCELLED,
+  DISPATCH_REJECTED_CODEX_QUEUE_FULL,
+  DISPATCH_REJECTED_QUEUE_FULL,
+  DISPATCH_REJECTED_WRITE_FAILED
+} from './structured-agent-session-dispatch-rejection'
+
+/** What Orca's own text looks like: a code or marker, a uuid, a path, an exception. */
+const ORCA_INTERNAL = /\b[a-z]+_[a-z_]+\b|[0-9a-f]{8}-[0-9a-f]{4}-|[/\\][\w.-]+[/\\]|Error:|ENOENT/
+
+const SURFACES: readonly AgentSessionFailureSurface[] = ['row', 'rejection']
+const LEGACY_MARKER_KINDS: ReadonlySet<SubmissionRejectionKind> = new Set([
+  'cancelled',
+  'writeFailed',
+  'queueFull'
+])
+
+/** Every fact shape a kind can carry: bare, with a person or a log detail, with a refusal, and
+ *  for an attachment each reason with and without its limit. */
+function factsFor(kind: AgentSessionFailureKind): AgentSessionFailureFact[] {
+  const facts: AgentSessionFailureFact[] = [
+    { kind },
+    { kind, detail: { text: 'Context window exceeded.', audience: 'person' } },
+    {
+      kind,
+      // A log detail and a refusal ride with the fact; neither may reach the sentence.
+      detail: { text: 'Error: ENOENT /Users/me/.claude/x agent_session_conflict', audience: 'log' },
+      refusal: { code: 'agent_session_identity_required', details: { reason: 'recordMissing' } }
+    }
+  ]
+  if (kind === 'providerRetrying') {
+    facts.push({ kind, retry: { error: 'rate_limit', status: 429 } })
+    facts.push({ kind, retry: { error: 'overloaded', status: 529 } })
+    facts.push({ kind, retry: { status: 500 } })
+  }
+  if (kind === 'attachmentInvalid') {
+    for (const reason of AGENT_SESSION_ATTACHMENT_PROBLEM_REASONS) {
+      facts.push({ kind, attachment: { reason } })
+      facts.push({ kind, attachment: { reason, limit: 5 * 1024 * 1024 } })
+    }
+  }
+  return facts
+}
+
+describe('the words written beside a failure fact', () => {
+  describe.each(SURFACES)('on the %s surface', (surface) => {
+    it.each(AGENT_SESSION_FAILURE_KINDS)('for %s are one sentence a person can read', (kind) => {
+      for (const fact of factsFor(kind)) {
+        for (const [agentName, command] of [
+          ['Claude', undefined],
+          [undefined, undefined],
+          ['Codex', 'clear']
+        ] as const) {
+          const sentence = agentSessionFailureSentence(fact, surface, { agentName, command })
+          expect([fact, sentence]).toEqual([fact, expect.stringMatching(/[^.]\.$/)])
+          expect(sentence).not.toMatch(/\.\./)
+          expect(sentence).not.toMatch(ORCA_INTERNAL)
+          const context = { agentName, command, provider: 'claude' } as const
+          if (surface === 'row') {
+            expect(agentSessionFailureWords(fact, { ...context, surface }).text).toBe(sentence)
+          } else if (isSubmissionRejectionFact(fact) && !LEGACY_MARKER_KINDS.has(fact.kind)) {
+            expect(agentSessionFailureWords(fact, { ...context, surface }).reason).toBe(sentence)
+          }
+        }
+      }
+    })
+  })
+
+  it('writes the legacy markers released clients hide, byte for byte, on a rejection', () => {
+    const reason = (kind: SubmissionRejectionKind, provider?: 'claude' | 'codex') =>
+      agentSessionFailureWords({ kind }, { surface: 'rejection', provider }).reason
+    expect(reason('cancelled')).toBe(DISPATCH_REJECTED_CANCELLED)
+    expect(DISPATCH_REJECTED_CANCELLED).toBe('provider_cancelled_before_start')
+    expect(reason('queueFull', 'claude')).toBe(DISPATCH_REJECTED_QUEUE_FULL)
+    expect(DISPATCH_REJECTED_QUEUE_FULL).toBe('claude structured dispatch queue is full')
+    expect(reason('queueFull', 'codex')).toBe(DISPATCH_REJECTED_CODEX_QUEUE_FULL)
+    expect(DISPATCH_REJECTED_CODEX_QUEUE_FULL).toBe('codex structured dispatch queue is full')
+    // Bare: the error that once followed it belongs in the log.
+    expect(reason('writeFailed')).toBe(DISPATCH_REJECTED_WRITE_FAILED)
+    expect(DISPATCH_REJECTED_WRITE_FAILED).toBe('provider_write_failed')
+    // With no provider to name its marker, a full queue gets a sentence.
+    expect(reason('queueFull')).toBe(
+      'Too many messages were waiting for the agent, so this one was not sent.'
+    )
+    for (const kind of LEGACY_MARKER_KINDS) {
+      const written = agentSessionFailureWords(
+        { kind },
+        { surface: 'rejection', provider: 'codex' }
+      )
+      expect(classifyDispatchRejection({ reason: written.reason })).toMatchObject({ kind })
+    }
+  })
+
+  it('names /clear as the next step for the start a /clear needed', () => {
+    const clear = (kind: AgentSessionFailureKind) =>
+      agentSessionFailureSentence({ kind }, 'row', { agentName: 'Codex', command: 'clear' })
+    expect(clear('notSignedIn')).toBe(
+      'Codex is not signed in for the selected account. Sign in, then run /clear again.'
+    )
+    expect(clear('startFailed')).toBe("Codex couldn't start. Run /clear again.")
+    expect(clear('restartFailed')).toBe("Codex couldn't restart. Run /clear again.")
+    expect(clear('providerStartFailed')).toBe(
+      'Codex stopped before it finished starting. Run /clear again.'
+    )
+  })
+
+  it('names the agent that stopped starting, and a failed start or restart gives a next step', () => {
+    const sentence = (kind: AgentSessionFailureKind, agentName?: string) =>
+      agentSessionFailureSentence({ kind }, 'rejection', { agentName })
+    expect(sentence('providerStartFailed', 'Claude')).toBe(
+      'Claude stopped before it finished starting. Send your message to try again.'
+    )
+    expect(sentence('providerStartFailed')).toBe(
+      'The agent stopped before it finished starting. Send your message to try again.'
+    )
+    expect(sentence('startFailed', 'Codex')).toBe(
+      "Codex couldn't start. Send your message to try again."
+    )
+    expect(sentence('restartFailed')).toBe(
+      "The agent couldn't restart. Send your message to try again."
+    )
+    // Nothing to restart from: a new chat is the only step, so no retry is offered.
+    expect(
+      agentSessionFailureSentence(
+        {
+          kind: 'startFailed',
+          refusal: { code: 'agent_session_identity_required', details: { reason: 'recordMissing' } }
+        },
+        'row',
+        { agentName: 'Codex' }
+      )
+    ).toBe("Codex couldn't start. Start a new chat to continue.")
+  })
+
+  it('names the exit a row reports differently from the message it left unsent', () => {
+    expect(
+      agentSessionFailureWords({ kind: 'providerExited' }, { surface: 'row', agentName: 'Claude' })
+        .text
+    ).toBe(
+      'Claude stopped while this response was in progress. You can continue in this conversation.'
+    )
+    expect(
+      agentSessionFailureWords(
+        { kind: 'providerExited' },
+        { surface: 'rejection', agentName: 'Codex' }
+      ).reason
+    ).toBe('Codex stopped before this message was sent.')
+    expect(agentSessionFailureWords({ kind: 'providerExited' }, { surface: 'row' }).text).toBe(
+      'The agent stopped while this response was in progress. You can continue in this conversation.'
+    )
+    expect(
+      agentSessionFailureWords({ kind: 'providerExited' }, { surface: 'rejection' }).reason
+    ).toBe('The agent stopped before this message was sent.')
+  })
+
+  it('says what frees a chat a terminal agent still holds, without naming its process', () => {
+    expect(
+      agentSessionFailureSentence(
+        {
+          kind: 'restartFailed',
+          refusal: { code: 'agent_session_conflict', details: { reason: 'claimConflicted' } }
+        },
+        'row',
+        { agentName: 'Codex' }
+      )
+    ).toBe(
+      "Codex couldn't restart. This chat is still open in a terminal agent. Quit that agent to continue the chat here."
+    )
+  })
+
+  it('says which limit an attachment broke, in megabytes', () => {
+    const sentence = (attachment: AgentSessionFailureFact['attachment']) =>
+      agentSessionFailureSentence({ kind: 'attachmentInvalid', attachment }, 'rejection', {
+        agentName: 'Claude'
+      })
+    expect(sentence({ reason: 'tooLarge', limit: 5 * 1024 * 1024 })).toBe(
+      'An image on this message is larger than 5 MB, so the message was not sent.'
+    )
+    expect(sentence({ reason: 'totalTooLarge', limit: 20 * 1024 * 1024 })).toBe(
+      'The images on this message add up to more than 20 MB, so the message was not sent.'
+    )
+    expect(sentence({ reason: 'tooMany', limit: 20 })).toBe(
+      'Claude accepts at most 20 images in one message, so this message was not sent.'
+    )
+    expect(sentence(undefined)).toBe("An attachment on this message can't be sent to the agent.")
+  })
+})
+
+describe('an attachment problem as a reader meets it', () => {
+  it('keeps what it can place and drops what it cannot', () => {
+    expect(
+      readAgentSessionFailureFact({
+        kind: 'attachmentInvalid',
+        attachment: { reason: 'tooMany', limit: 20 }
+      })
+    ).toEqual({ kind: 'attachmentInvalid', attachment: { reason: 'tooMany', limit: 20 } })
+    expect(
+      readAgentSessionFailureFact({
+        kind: 'attachmentInvalid',
+        attachment: { reason: 'tooMany', limit: 'twenty' }
+      })
+    ).toEqual({ kind: 'attachmentInvalid', attachment: { reason: 'tooMany' } })
+    // A reason a newer host added reads as the generic attachment failure.
+    expect(
+      readAgentSessionFailureFact({
+        kind: 'attachmentInvalid',
+        attachment: { reason: 'futureReason' }
+      })
+    ).toEqual({ kind: 'attachmentInvalid' })
+  })
+})
diff --git a/src/shared/agent-session-failure-words.ts b/src/shared/agent-session-failure-words.ts
new file mode 100644
index 000000000000..f02d02abdea9
--- /dev/null
+++ b/src/shared/agent-session-failure-words.ts
@@ -0,0 +1,262 @@
+// The sentence a person reads beside each failure fact, and the one constructor that writes both.
+//
+// A row's `text`, a rejected message's `reason` and a conversation command's `error` are what
+// every released client prints as they are, so the host writes them here, from the fact, and
+// nowhere else: never Orca's own error text, a refusal's message, or a probe's evidence. A
+// provider's words reach the sentence only when the provider wrote them for a person. The table
+// is also the English default for a client that chooses its own copy from the fact.
+
+import {
+  isSubmissionRejectionFact,
+  type AgentSessionAttachmentProblem,
+  type AgentSessionAttachmentProblemReason,
+  type AgentSessionFailureFact,
+  type AgentSessionFailureKind,
+  type ProviderDiagnostic,
+  type SubmissionRejectionFact,
+  type SubmissionRejectionKind
+} from './agent-session-failure'
+import type { AgentSessionWireRefusalCode } from './agent-session-wire-refusals'
+import {
+  DISPATCH_REJECTED_CANCELLED,
+  DISPATCH_REJECTED_CODEX_QUEUE_FULL,
+  DISPATCH_REJECTED_QUEUE_FULL,
+  DISPATCH_REJECTED_WRITE_FAILED
+} from './structured-agent-session-dispatch-rejection'
+
+declare const failureSentence: unique symbol
+
+/** Words only `agentSessionFailureWords` makes, so no writer can put its own beside a fact. */
+export type AgentSessionFailureSentence = string & { readonly [failureSentence]: true }
+
+/** A status row that reports a failure. */
+export type AgentSessionFailureRowWords = {
+  text: AgentSessionFailureSentence
+  failure: AgentSessionFailureFact
+}
+
+/** A rejection as the host writes it: the sentence (or, for the cases released clients already
+ *  hide, the legacy marker) they print, and the fact newer ones read. */
+export type AgentJournalDispatchRejection = {
+  reason: AgentSessionFailureSentence
+  rejection: SubmissionRejectionFact
+}
+
+/** `row`: a status row, about the chat. `rejection`: a rejected message's reason, about it. */
+export type AgentSessionFailureSurface = 'row' | 'rejection'
+
+export type AgentSessionFailureWordsContext = {
+  /** The chat's agent, when the writer knows it. */
+  agentName?: string
+  /** Names the legacy queue-full marker; without it a full queue is worded as a sentence. */
+  provider?: 'claude' | 'codex'
+  /** The conversation command a failed start was for, so the next step is to run it again
+   *  rather than to send a message. */
+  command?: 'clear'
+}
+
+/**
+ * Whether a refused start leaves the chat anything to start again from. `false`: this host has
+ * nothing to restart it from — no record, or none it can run — so only a new chat continues.
+ * A new wire code does not compile until it is classified here.
+ */
+export const START_REFUSAL_RESUMABLE: Record<AgentSessionWireRefusalCode, boolean> = {
+  execution_owner_reconciling: true,
+  agent_session_conflict: true,
+  agent_session_checkpoint_stale: true,
+  agent_session_ownership_unknown: true,
+  agent_session_operation_capacity: true,
+  structured_agent_session_unsupported: false,
+  agent_session_operation_conflict: true,
+  agent_session_operation_expired: true,
+  agent_session_operation_invalid: true,
+  agent_session_operation_unknown: true,
+  agent_session_item_revision_stale: true,
+  agent_session_already_resolved: true,
+  agent_session_identity_required: false,
+  agent_session_journal_unreadable: true,
+  agent_session_owner_restart_failed: true
+}
+
+/** Sentences a refusal notice shows too, so a chat says them one way. */
+export const TERMINAL_AGENT_HOLDS_CHAT = 'This chat is still open in a terminal agent.'
+export const QUIT_TERMINAL_AGENT = 'Quit that agent to continue the chat here.'
+export const START_NEW_CHAT = 'Start a new chat to continue.'
+
+/** Person-facing provider text is quoted, but bounded so the sentence stays one. */
+const MAX_QUOTED_DETAIL_CHARS = 512
+const BYTES_PER_MB = 1024 * 1024
+
+type Sentence = (
+  context: AgentSessionFailureWordsContext,
+  fact: AgentSessionFailureFact,
+  surface: AgentSessionFailureSurface
+) => string
+
+function quotingPersonDetail(lead: string, detail: ProviderDiagnostic | undefined): string {
+  const quoted =
+    detail?.audience === 'person'
+      ? detail.text
+          .slice(0, MAX_QUOTED_DETAIL_CHARS)
+          .trim()
+          .replace(/[.\s]+$/, '')
+      : ''
+  return quoted ? `${lead}: ${quoted}.` : `${lead}.`
+}
+
+/** What to do once the start can work, for a sentence that ends in it. */
+function retryStep({ command }: AgentSessionFailureWordsContext): string {
+  return command === 'clear' ? 'run /clear again' : 'send your message again'
+}
+
+/** The next step after a start or restart that failed: the command, or the message, again. */
+function startRetry({ command }: AgentSessionFailureWordsContext): string {
+  return command === 'clear' ? ' Run /clear again.' : ' Send your message to try again.'
+}
+
+function couldNot(verb: string): Sentence {
+  return (context, fact) => {
+    const { agentName } = context
+    const failed = `${agentName ?? 'The agent'} couldn't ${verb}.`
+    // Only a terminal agent an older build recorded holds a claim; quitting it frees the chat.
+    if (fact.refusal?.details?.reason === 'claimConflicted') {
+      return `${failed} ${TERMINAL_AGENT_HOLDS_CHAT} ${QUIT_TERMINAL_AGENT}`
+    }
+    const code = fact.refusal?.code
+    return code && !START_REFUSAL_RESUMABLE[code]
+      ? `${failed} ${START_NEW_CHAT}`
+      : `${failed}${startRetry(context)}`
+  }
+}
+
+function megabytes(bytes: number): string {
+  return `${Math.round((bytes / BYTES_PER_MB) * 10) / 10} MB`
+}
+
+const NOT_SENT = 'so the message was not sent.'
+
+const ATTACHMENT_SENTENCES = {
+  empty: () => `An image on this message is empty, ${NOT_SENT}`,
+  tooLarge: (_, { limit }) =>
+    limit
+      ? `An image on this message is larger than ${megabytes(limit)}, ${NOT_SENT}`
+      : `An image on this message is too large, ${NOT_SENT}`,
+  tooMany: ({ agentName }, { limit }) =>
+    limit
+      ? `${agentName ?? 'The agent'} accepts at most ${limit} images in one message, so this message was not sent.`
+      : 'This message has too many images, so it was not sent.',
+  totalTooLarge: (_, { limit }) =>
+    limit
+      ? `The images on this message add up to more than ${megabytes(limit)}, ${NOT_SENT}`
+      : `The images on this message are too large together, ${NOT_SENT}`,
+  unsupportedType: ({ agentName }) =>
+    `${agentName ?? 'The agent'} accepts only PNG, JPEG, GIF, and WebP images, so this message was not sent.`,
+  notAFile: () => `An image on this message isn't a file, ${NOT_SENT}`,
+  noSource: () => `An image on this message has no file to send, ${NOT_SENT}`
+} satisfies Record<
+  AgentSessionAttachmentProblemReason,
+  (context: AgentSessionFailureWordsContext, problem: AgentSessionAttachmentProblem) => string
+>
+
+const FAILURE_SENTENCES = {
+  providerStartFailed: (context) =>
+    `${context.agentName ?? 'The agent'} stopped before it finished starting.${startRetry(context)}`,
+  startFailed: couldNot('start'),
+  notSignedIn: (context) =>
+    `${context.agentName ?? 'The agent'} is not signed in for the selected account. Sign in, then ${retryStep(context)}.`,
+  historyTooLarge: () =>
+    `This conversation's history is too large to restore here. ${START_NEW_CHAT}`,
+  managedAccountEnvOverride: () =>
+    'This Claude launch sets its own Anthropic sign-in variables. Remove them to use a managed Claude account.',
+  accountSwitchInProgress: () =>
+    'A Claude account switch is in progress. Try again after it finishes.',
+  managedAccountUnsupported: (context) =>
+    `While a Claude account is added in WSL, Claude chats need a Windows Claude account. Choose or add one in Claude Accounts settings, then ${retryStep(context)}.`,
+  providerExited: ({ agentName }, _, surface) =>
+    surface === 'row'
+      ? `${agentName ?? 'The agent'} stopped while this response was in progress. You can continue in this conversation.`
+      : `${agentName ?? 'The agent'} stopped before this message was sent.`,
+  restartFailed: couldNot('restart'),
+  providerRejected: (_, fact) =>
+    quotingPersonDetail('The provider did not accept this message', fact.detail),
+  attachmentInvalid: (context, fact) =>
+    fact.attachment
+      ? ATTACHMENT_SENTENCES[fact.attachment.reason](context, fact.attachment)
+      : "An attachment on this message can't be sent to the agent.",
+  attachmentUnreadable: () => `An attachment on this message couldn't be read, ${NOT_SENT}`,
+  emptyMessage: () => 'This message is empty, so it was not sent.',
+  queueFull: () => 'Too many messages were waiting for the agent, so this one was not sent.',
+  writeFailed: () => "Orca couldn't hand this message to the agent, so it was not sent.",
+  cancelled: () => 'This message was withdrawn before the agent started it.',
+  chatClosed: () => 'The chat closed before this message was sent.',
+  hostRestarted: () => 'Orca restarted before this message was sent.',
+  notDelivered: () => 'This message was not delivered. Send it again to continue.',
+  compactionFailed: (_, fact) => quotingPersonDetail('Compaction failed', fact.detail),
+  compactionUnconfirmed: () => 'Compaction completion is unconfirmed.',
+  cancelUnconfirmed: () => 'Cancellation was not confirmed.',
+  answerUnconfirmed: () => 'Your answer was recorded but the agent did not confirm it.',
+  hostFault: () => "Orca ran into a problem, so this didn't go through. Try again.",
+  hostStopped: ({ agentName }) =>
+    `${agentName ?? 'The agent'} never finished starting, so Orca stopped it.`,
+  providerRetrying: ({ agentName }, { retry }) =>
+    retry?.error === 'rate_limit' || retry?.status === 429
+      ? `${agentName ?? 'The agent'} is rate-limited and retrying.`
+      : `${agentName ?? 'The agent'} hit a temporary problem and is retrying.`
+} satisfies Record<AgentSessionFailureKind, Sentence>
+
+/** The sentence a person reads for this fact on this surface; never a marker. */
+export function agentSessionFailureSentence(
+  fact: AgentSessionFailureFact,
+  surface: AgentSessionFailureSurface,
+  context: AgentSessionFailureWordsContext = {}
+): string {
+  const sentence: Sentence = FAILURE_SENTENCES[fact.kind]
+  return sentence(context, fact, surface)
+}
+
+/** The markers released clients hide, for the rejections that had one before rows carried a fact.
+ *  A write failure is the bare marker: its error belongs in the log. */
+const LEGACY_REJECTION_MARKERS: Partial<
+  Record<SubmissionRejectionKind, (context: AgentSessionFailureWordsContext) => string | undefined>
+> = {
+  cancelled: () => DISPATCH_REJECTED_CANCELLED,
+  writeFailed: () => DISPATCH_REJECTED_WRITE_FAILED,
+  queueFull: ({ provider }) =>
+    provider === 'codex'
+      ? DISPATCH_REJECTED_CODEX_QUEUE_FULL
+      : provider === 'claude'
+        ? DISPATCH_REJECTED_QUEUE_FULL
+        : undefined
+}
+
+/** The words a status row reporting this fact records. */
+export function agentSessionFailureWords(
+  fact: AgentSessionFailureFact,
+  context: AgentSessionFailureWordsContext & { surface: 'row' }
+): AgentSessionFailureRowWords
+/** The words a message rejected for this fact records. */
+export function agentSessionFailureWords(
+  fact: SubmissionRejectionFact,
+  context: AgentSessionFailureWordsContext & { surface: 'rejection' }
+): AgentJournalDispatchRejection
+export function agentSessionFailureWords(
+  fact: AgentSessionFailureFact,
+  context: AgentSessionFailureWordsContext & { surface: AgentSessionFailureSurface }
+): AgentSessionFailureRowWords | AgentJournalDispatchRejection {
+  if (context.surface === 'row') {
+    return { text: branded(agentSessionFailureSentence(fact, 'row', context)), failure: fact }
+  }
+  // The rejection overload admits only these; a caller that got past the types is Orca's bug.
+  if (!isSubmissionRejectionFact(fact)) {
+    throw new Error(`agent session failure kind ${fact.kind} cannot reject a message`)
+  }
+  const words =
+    LEGACY_REJECTION_MARKERS[fact.kind]?.(context) ??
+    agentSessionFailureSentence(fact, 'rejection', context)
+  return { reason: branded(words), rejection: fact }
+}
+
+function branded(words: string): AgentSessionFailureSentence {
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: only `agentSessionFailureWords` calls this, with words from the table or a legacy marker for its fact.
+  return words as AgentSessionFailureSentence
+}
diff --git a/src/shared/agent-session-failure.test.ts b/src/shared/agent-session-failure.test.ts
new file mode 100644
index 000000000000..4dc12f9bfe8b
--- /dev/null
+++ b/src/shared/agent-session-failure.test.ts
@@ -0,0 +1,93 @@
+import { describe, expect, it } from 'vitest'
+import {
+  MAX_PROVIDER_DIAGNOSTIC_CHARS,
+  providerDiagnostic,
+  providerDiagnosticOf,
+  readAgentSessionFailureFact,
+  withProviderDiagnostic
+} from './agent-session-failure'
+
+describe('provider diagnostics', () => {
+  it('bounds the text and records nothing for an empty one', () => {
+    expect(providerDiagnostic('  ', 'log')).toBeUndefined()
+    expect(
+      providerDiagnostic('x'.repeat(MAX_PROVIDER_DIAGNOSTIC_CHARS + 50), 'log')?.text
+    ).toHaveLength(MAX_PROVIDER_DIAGNOSTIC_CHARS)
+  })
+
+  it('is read from the error that carries it, or from what it wraps', () => {
+    const diagnostic = { text: 'bad request', audience: 'person' as const }
+    const carried = withProviderDiagnostic(
+      new Error('codex turn/start failed: bad request'),
+      diagnostic
+    )
+    expect(providerDiagnosticOf(carried)).toEqual(diagnostic)
+    expect(providerDiagnosticOf(new Error('wrapped', { cause: carried }))).toEqual(diagnostic)
+    expect(providerDiagnosticOf(new AggregateError([new Error('other'), carried], 'both'))).toEqual(
+      diagnostic
+    )
+  })
+
+  it('ends on an aggregate error that contains itself', () => {
+    const loop = new AggregateError([], 'loop')
+    loop.errors.push(loop)
+    expect(providerDiagnosticOf(loop)).toBeUndefined()
+  })
+
+  it('is never inferred from an error that did not carry one', () => {
+    // Orca's own wording, even when it quotes something that looks like a provider message.
+    expect(
+      providerDiagnosticOf(new Error('claude stream-json exited (code 1): not signed in'))
+    ).toBe(undefined)
+    expect(providerDiagnosticOf('a string')).toBeUndefined()
+  })
+})
+
+describe('reading a failure fact', () => {
+  it('keeps what this build can place', () => {
+    expect(
+      readAgentSessionFailureFact({
+        kind: 'restartFailed',
+        refusal: { code: 'agent_session_conflict', details: { reason: 'claimConflicted' } },
+        detail: { text: 'x', audience: 'person' }
+      })
+    ).toEqual({
+      kind: 'restartFailed',
+      refusal: { code: 'agent_session_conflict', details: { reason: 'claimConflicted' } },
+      detail: { text: 'x', audience: 'person' }
+    })
+  })
+
+  it('keeps what a provider said it is retrying, and only that', () => {
+    expect(
+      readAgentSessionFailureFact({
+        kind: 'providerRetrying',
+        retry: { error: 'rate_limit', status: 429, attempt: 3 }
+      })
+    ).toEqual({ kind: 'providerRetrying', retry: { error: 'rate_limit', status: 429 } })
+    expect(
+      readAgentSessionFailureFact({ kind: 'providerRetrying', retry: { error: '', status: 'x' } })
+    ).toEqual({ kind: 'providerRetrying' })
+  })
+
+  it('reads a row an unreleased build wrote with a cause as a refusal with no details', () => {
+    expect(
+      readAgentSessionFailureFact({
+        kind: 'restartFailed',
+        refusal: { code: 'agent_session_conflict', cause: 'claimConflicted' }
+      })
+    ).toEqual({ kind: 'restartFailed', refusal: { code: 'agent_session_conflict' } })
+  })
+
+  it('drops what a newer host wrote that this build cannot place', () => {
+    expect(readAgentSessionFailureFact({ kind: 'futureKind' })).toBeUndefined()
+    expect(readAgentSessionFailureFact(undefined)).toBeUndefined()
+    expect(
+      readAgentSessionFailureFact({
+        kind: 'restartFailed',
+        refusal: { code: 'agent_session_conflict', details: { reason: 'futureReason' } },
+        detail: { text: 'x', audience: 'future' }
+      })
+    ).toEqual({ kind: 'restartFailed', refusal: { code: 'agent_session_conflict' } })
+  })
+})
diff --git a/src/shared/agent-session-failure.ts b/src/shared/agent-session-failure.ts
new file mode 100644
index 000000000000..ed8b677b359e
--- /dev/null
+++ b/src/shared/agent-session-failure.ts
@@ -0,0 +1,262 @@
+// What went wrong in a chat, typed where the host decides it, beside the sentence a person reads.
+//
+// The host writes both at once: `text`/`reason` stays a complete sentence because released clients
+// print it as it is, and this fact is what newer clients choose their copy and action from. A
+// provider's own words ride separately as `detail`, set only where Orca composed them from a
+// value the provider wrote — never recovered from a string afterwards, since by then nothing can
+// tell a provider's sentence from Orca's.
+
+import {
+  readAgentSessionRefusalReference,
+  type AgentSessionRefusalReference
+} from './agent-session-wire-refusals'
+
+/** One per situation with its own honest next step; a new one needs copy before it compiles. */
+export const AGENT_SESSION_FAILURE_KINDS = [
+  /** Only an observed exit: the provider stopped while starting. */
+  'providerStartFailed',
+  /** A start that did not land, with no one to blame: Orca's fault, a failed spawn, a close. */
+  'startFailed',
+  'notSignedIn',
+  'historyTooLarge',
+  'managedAccountEnvOverride',
+  'accountSwitchInProgress',
+  'managedAccountUnsupported',
+  'providerExited',
+  'restartFailed',
+  'providerRejected',
+  'attachmentInvalid',
+  'attachmentUnreadable',
+  'emptyMessage',
+  'queueFull',
+  'writeFailed',
+  'cancelled',
+  'chatClosed',
+  'hostRestarted',
+  'notDelivered',
+  'compactionFailed',
+  'compactionUnconfirmed',
+  'cancelUnconfirmed',
+  'answerUnconfirmed',
+  'hostFault',
+  /** Orca stopped an agent whose start never finished. */
+  'hostStopped',
+  /** The provider is retrying a request its API refused; not a failure yet. */
+  'providerRetrying'
+] as const
+export type AgentSessionFailureKind = (typeof AGENT_SESSION_FAILURE_KINDS)[number]
+
+export function isAgentSessionFailureKind(value: unknown): value is AgentSessionFailureKind {
+  return typeof value === 'string' && AGENT_SESSION_FAILURE_KINDS.some((kind) => kind === value)
+}
+
+/** Kinds only a status row reports: none is ever why a message was not sent. */
+const STATUS_ROW_ONLY_FAILURE_KINDS = [
+  'compactionFailed',
+  'compactionUnconfirmed',
+  'cancelUnconfirmed',
+  'answerUnconfirmed',
+  'providerRetrying'
+] as const satisfies readonly AgentSessionFailureKind[]
+
+/** Why a message was not sent. A new failure kind is one of these until listed above. */
+export type SubmissionRejectionKind = Exclude<
+  AgentSessionFailureKind,
+  (typeof STATUS_ROW_ONLY_FAILURE_KINDS)[number]
+>
+
+export function isSubmissionRejectionKind(value: unknown): value is SubmissionRejectionKind {
+  return (
+    isAgentSessionFailureKind(value) &&
+    !STATUS_ROW_ONLY_FAILURE_KINDS.some((statusOnly) => statusOnly === value)
+  )
+}
+
+/** `person`: written by the provider for whoever reads the chat, shown inline. `log`: a stderr
+ *  tail or exit status, shown only behind Details. */
+export type ProviderDiagnosticAudience = 'person' | 'log'
+
+export type ProviderDiagnostic = {
+  text: string
+  audience: ProviderDiagnosticAudience
+}
+
+/** Stderr can be a whole dump; the row keeps enough to act on. The same cap as the exit reason a
+ *  lease record keeps, so a diagnostic never outgrows what the record may store. */
+export const MAX_PROVIDER_DIAGNOSTIC_CHARS = 512
+
+/** Which of Orca's checks an image failed. A new one needs a sentence before it compiles. */
+export const AGENT_SESSION_ATTACHMENT_PROBLEM_REASONS = [
+  'empty',
+  'tooLarge',
+  'tooMany',
+  'totalTooLarge',
+  'unsupportedType',
+  'notAFile',
+  'noSource'
+] as const
+export type AgentSessionAttachmentProblemReason =
+  (typeof AGENT_SESSION_ATTACHMENT_PROBLEM_REASONS)[number]
+
+export type AgentSessionAttachmentProblem = {
+  reason: AgentSessionAttachmentProblemReason
+  /** The limit it broke: bytes for `tooLarge` and `totalTooLarge`, a count for `tooMany`. */
+  limit?: number
+}
+
+/** What the provider said it is retrying, in its own fields. */
+export type AgentSessionProviderRetry = {
+  /** The provider's error type, e.g. `rate_limit` or `overloaded`. */
+  error?: string
+  /** The HTTP status the request failed with. */
+  status?: number
+}
+
+export type AgentSessionFailureFact = {
+  kind: AgentSessionFailureKind
+  /** Provider-authored only; absent whenever Orca wrote the words. */
+  detail?: ProviderDiagnostic
+  /** On `restartFailed` and `startFailed`: the refusal that kept the agent from starting. */
+  refusal?: AgentSessionRefusalReference
+  /** On `attachmentInvalid`: which check the attachment failed. */
+  attachment?: AgentSessionAttachmentProblem
+  /** On `providerRetrying`: why the provider is retrying. */
+  retry?: AgentSessionProviderRetry
+}
+
+/** A fact as a row stores it: its kind may be one a newer host added, so only
+ *  `readAgentSessionFailureFact` or the rejection classifier may place it. */
+export type UnreadAgentSessionFailureFact = { kind: string }
+
+/** A fact a rejected message may carry. */
+export type SubmissionRejectionFact = AgentSessionFailureFact & { kind: SubmissionRejectionKind }
+
+export function isSubmissionRejectionFact(
+  fact: AgentSessionFailureFact
+): fact is SubmissionRejectionFact {
+  return isSubmissionRejectionKind(fact.kind)
+}
+
+/** Null for empty text, so a writer never records a detail with nothing in it. */
+export function providerDiagnostic(
+  text: string,
+  audience: ProviderDiagnosticAudience
+): ProviderDiagnostic | undefined {
+  const bounded = text.trim().slice(0, MAX_PROVIDER_DIAGNOSTIC_CHARS).trim()
+  return bounded ? { text: bounded, audience } : undefined
+}
+
+export function agentSessionFailureFact<TKind extends AgentSessionFailureKind>(
+  kind: TKind,
+  extra: {
+    detail?: ProviderDiagnostic
+    refusal?: AgentSessionRefusalReference
+    attachment?: AgentSessionAttachmentProblem
+    retry?: AgentSessionProviderRetry
+  } = {}
+): AgentSessionFailureFact & { kind: TKind } {
+  // Re-bounded here, so no writer can store more than the cap however it built the detail.
+  const detail = extra.detail
+    ? providerDiagnostic(extra.detail.text, extra.detail.audience)
+    : undefined
+  return {
+    kind,
+    ...(detail ? { detail } : {}),
+    ...(extra.refusal ? { refusal: extra.refusal } : {}),
+    ...(extra.attachment ? { attachment: extra.attachment } : {}),
+    ...(extra.retry ? { retry: extra.retry } : {})
+  }
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value)
+}
+
+export function isProviderDiagnostic(value: unknown): value is ProviderDiagnostic {
+  return (
+    isRecord(value) &&
+    typeof value.text === 'string' &&
+    (value.audience === 'person' || value.audience === 'log')
+  )
+}
+
+function readAttachmentProblem(value: unknown): AgentSessionAttachmentProblem | undefined {
+  if (!isRecord(value)) {
+    return undefined
+  }
+  const reason = AGENT_SESSION_ATTACHMENT_PROBLEM_REASONS.find((known) => known === value.reason)
+  if (!reason) {
+    return undefined
+  }
+  const limit = value.limit
+  return typeof limit === 'number' && Number.isFinite(limit) && limit > 0
+    ? { reason, limit }
+    : { reason }
+}
+
+/** A retry as a reader meets it; undefined when it names neither field. */
+export function readProviderRetry(value: unknown): AgentSessionProviderRetry | undefined {
+  if (!isRecord(value)) {
+    return undefined
+  }
+  const error =
+    typeof value.error === 'string' && value.error.trim() ? value.error.trim() : undefined
+  const status =
+    typeof value.status === 'number' && Number.isInteger(value.status) && value.status > 0
+      ? value.status
+      : undefined
+  return error || status
+    ? { ...(error ? { error } : {}), ...(status ? { status } : {}) }
+    : undefined
+}
+
+/** A fact as a reader meets it. Undefined for anything this build cannot place, including a kind a
+ *  newer host added, so the reader falls back to what it does for a row with no fact. */
+export function readAgentSessionFailureFact(value: unknown): AgentSessionFailureFact | undefined {
+  if (!isRecord(value) || !isAgentSessionFailureKind(value.kind)) {
+    return undefined
+  }
+  const refusal = readAgentSessionRefusalReference(value.refusal)
+  const attachment = readAttachmentProblem(value.attachment)
+  const retry = readProviderRetry(value.retry)
+  return agentSessionFailureFact(value.kind, {
+    ...(isProviderDiagnostic(value.detail) ? { detail: value.detail } : {}),
+    ...(refusal ? { refusal } : {}),
+    ...(attachment ? { attachment } : {}),
+    ...(retry ? { retry } : {})
+  })
+}
+
+/** The provider-authored diagnostic an error carries, set only where it was composed. Follows the
+ *  `cause` chain, since wrappers such as the acquisition errors keep the original as their cause. */
+export function providerDiagnosticOf(error: unknown): ProviderDiagnostic | undefined {
+  return providerDiagnosticWithin(error, 0)
+}
+
+// One depth bound across `cause` and aggregated errors, so an error that contains itself ends.
+function providerDiagnosticWithin(error: unknown, start: number): ProviderDiagnostic | undefined {
+  let current: unknown = error
+  for (let depth = start; depth < 6 && current instanceof Error; depth += 1) {
+    if ('providerDiagnostic' in current && isProviderDiagnostic(current.providerDiagnostic)) {
+      return current.providerDiagnostic
+    }
+    if (current instanceof AggregateError) {
+      for (const inner of current.errors) {
+        const found = providerDiagnosticWithin(inner, depth + 1)
+        if (found) {
+          return found
+        }
+      }
+    }
+    current = current.cause
+  }
+  return undefined
+}
+
+/** Attaches the provider's words to the error Orca built around them. */
+export function withProviderDiagnostic<TError extends Error>(
+  error: TError,
+  diagnostic: ProviderDiagnostic | undefined
+): TError {
+  return diagnostic ? Object.assign(error, { providerDiagnostic: diagnostic }) : error
+}
diff --git a/src/shared/agent-session-journal-position.ts b/src/shared/agent-session-journal-position.ts
new file mode 100644
index 000000000000..9e317f1ee713
--- /dev/null
+++ b/src/shared/agent-session-journal-position.ts
@@ -0,0 +1,36 @@
+// The journal's own order: the sequence of the row that created an item, then the
+// item's place among that row's writes. Time never enters it — a row recovered
+// after a crash carries the provider's earlier clock at a later sequence.
+
+import type { AgentJournalPosition, AgentJournalRenderItem } from './agent-session-journal-types'
+import type { NativeChatMessage } from './native-chat-types'
+
+type PositionedItem = Pick<AgentJournalRenderItem, 'sequence' | 'sequenceIndex'>
+
+/** What every transcript row projected from a journal item carries, so a row
+ *  that changes shape (a question once answered) keeps its identity and place. */
+export function agentJournalItemRowOrigin(
+  item: AgentJournalRenderItem
+): Pick<NativeChatMessage, 'id' | 'timestamp' | 'source' | 'journalPosition'> {
+  return {
+    id: item.itemId,
+    timestamp: item.observedAt,
+    source: 'transcript',
+    journalPosition: agentJournalItemPosition(item)
+  }
+}
+
+export function agentJournalItemPosition(item: PositionedItem): AgentJournalPosition {
+  return { sequence: item.sequence, index: item.sequenceIndex ?? 0 }
+}
+
+export function compareAgentJournalPositions(
+  a: AgentJournalPosition,
+  b: AgentJournalPosition
+): number {
+  return a.sequence - b.sequence || a.index - b.index
+}
+
+export function compareAgentJournalItems(a: PositionedItem, b: PositionedItem): number {
+  return a.sequence - b.sequence || (a.sequenceIndex ?? 0) - (b.sequenceIndex ?? 0)
+}
diff --git a/src/shared/agent-session-journal-schemas.test.ts b/src/shared/agent-session-journal-schemas.test.ts
index ec66caaa059e..594d6a04b11c 100644
--- a/src/shared/agent-session-journal-schemas.test.ts
+++ b/src/shared/agent-session-journal-schemas.test.ts
@@ -332,6 +332,57 @@ describe('optional notice metadata', () => {
   })
 })
 
+describe('typed failure facts', () => {
+  it('admits a status row and a submission with a fact, and the same rows without one', () => {
+    const failure = {
+      kind: 'providerStartFailed',
+      detail: { text: 'exit status 1', audience: 'log' }
+    }
+    expect(isAdmissibleAgentJournalItemBody({ kind: 'status', text: 'Stopped.', failure })).toBe(
+      true
+    )
+    expect(isAdmissibleAgentJournalItemBody({ kind: 'status', text: 'Stopped.' })).toBe(true)
+    const submission = {
+      clientMessageId: 'cm-1',
+      fence: 1,
+      payloadFingerprint: 'fp',
+      dispatchState: 'rejected',
+      providerItemId: null,
+      reason: 'Not sent.',
+      submittedAt: 1,
+      resolvedAt: 2
+    }
+    expect(isAdmissibleAgentJournalSubmission(submission)).toBe(true)
+    expect(isAdmissibleAgentJournalSubmission({ ...submission, rejection: failure })).toBe(true)
+  })
+
+  it("admits a refusal's details, and a row an earlier build wrote with its cause", () => {
+    const refused = (refusal: Record<string, unknown>) =>
+      isAdmissibleAgentJournalItemBody({
+        kind: 'status',
+        text: "Codex couldn't restart.",
+        failure: { kind: 'restartFailed', refusal }
+      })
+    expect(
+      refused({
+        code: 'agent_session_conflict',
+        details: { reason: 'claimConflicted', futureFact: 1 }
+      })
+    ).toBe(true)
+    expect(refused({ code: 'agent_session_conflict', cause: 'claimConflicted' })).toBe(true)
+  })
+
+  it('keeps a kind or audience a newer host writes admissible', () => {
+    expect(
+      isAdmissibleAgentJournalItemBody({
+        kind: 'status',
+        text: 'Stopped.',
+        failure: { kind: 'futureKind', detail: { text: 'x', audience: 'future' } }
+      })
+    ).toBe(true)
+  })
+})
+
 describe('optional tool annotations', () => {
   const body = { kind: 'tool-call', name: 'shell', input: null, state: 'completed' }
   it('admits old rows and rows with optional annotations without a new kind', () => {
diff --git a/src/shared/agent-session-journal-schemas.ts b/src/shared/agent-session-journal-schemas.ts
index 29271faa2b1b..d193db01846a 100644
--- a/src/shared/agent-session-journal-schemas.ts
+++ b/src/shared/agent-session-journal-schemas.ts
@@ -18,6 +18,7 @@ import { AgentSessionContextUsageSchema } from './agent-session-context-usage-sc
 import type {
   AgentJournalItemBody,
   AgentJournalMessageItem,
+  AgentJournalResolution,
   AgentJournalRenderItem,
   AgentJournalSubmission
 } from './agent-session-journal-types'
@@ -147,6 +148,15 @@ const Question = z
 const Resolution = z.object({
   state: z.string().min(1),
   selectedOptionId: z.string().nullable(),
+  answers: z
+    .array(
+      z.object({
+        questionId: z.string(),
+        optionIds: z.array(z.string()),
+        other: z.string().optional()
+      })
+    )
+    .optional(),
   resolvedBy: z.string().nullable(),
   resolvedAt: z.number().nullable()
 })
@@ -190,6 +200,14 @@ const ThreadGoalState = z.union([
   z.object({ state: z.string() }).refine((value) => !['set', 'cleared'].includes(value.state))
 ])
 
+/** Open like `state`: a kind, audience or refusal detail a newer host writes must not turn the row
+ *  malformed; the fact reader is where an unplaceable one is dropped. */
+const FailureFact = z.object({
+  kind: z.string().min(1),
+  detail: z.object({ text: z.string(), audience: z.string().min(1) }).optional(),
+  refusal: z.object({ code: z.string().min(1), details: z.looseObject({}).optional() }).optional()
+})
+
 export const AgentJournalItemBodySchema = z.discriminatedUnion('kind', [
   MessageBody,
   z.object({
@@ -242,7 +260,8 @@ export const AgentJournalItemBodySchema = z.discriminatedUnion('kind', [
       })
       .optional(),
     providerFrame: ProviderFrame.optional(),
-    threadGoal: ThreadGoalState.optional()
+    threadGoal: ThreadGoalState.optional(),
+    failure: FailureFact.optional()
   }),
   z.object({
     kind: z.literal('turn'),
@@ -280,6 +299,7 @@ export const AgentJournalRenderItemSchema = z.object({
   revision: z.number().int(),
   body: AgentJournalItemBodySchema,
   sequence: z.number().int(),
+  sequenceIndex: z.number().int().nonnegative().optional(),
   observedAt: z.number(),
   recovered: z.literal(true).optional(),
   recoveredAt: z.number().optional(),
@@ -295,9 +315,16 @@ export const AgentJournalSubmissionSchema = z.object({
   reason: z.string().nullable(),
   submittedAt: z.number(),
   resolvedAt: z.number().nullable(),
-  recovered: z.literal(true).optional()
+  recovered: z.literal(true).optional(),
+  handoverRecorded: z.literal(true).optional(),
+  handedOverAt: z.number().optional(),
+  rejection: FailureFact.optional()
 })
 
+export function isAgentJournalResolution(value: unknown): value is AgentJournalResolution {
+  return Resolution.safeParse(value).success
+}
+
 export function isAdmissibleAgentJournalItemBody(value: unknown): value is AgentJournalItemBody {
   return AgentJournalItemBodySchema.safeParse(value).success
 }
diff --git a/src/shared/agent-session-journal-types.ts b/src/shared/agent-session-journal-types.ts
index a13f3b1f676e..a17561e6b810 100644
--- a/src/shared/agent-session-journal-types.ts
+++ b/src/shared/agent-session-journal-types.ts
@@ -7,7 +7,10 @@
 // rewritten in place, so a host that cannot read a row refuses to write the
 // journal rather than skipping or compacting past it.
 
+import type { UnreadAgentSessionFailureFact } from './agent-session-failure'
+import type { AgentSessionFailureRowWords } from './agent-session-failure-words'
 import type { AgentType } from './agent-status-types'
+import type { AgentSessionQuestionAnswer } from './agent-session-question-answer'
 import type { AgentJournalTurnOutcome } from './agent-turn-outcome'
 import type { NativeChatToolMetadata } from './native-chat-tool-identity'
 import type { AgentSessionContextUsage } from './agent-session-context-usage'
@@ -128,8 +131,11 @@ export type AgentJournalResolutionState = (typeof AGENT_JOURNAL_RESOLUTION_STATE
  *  invoking the provider callback twice. */
 export type AgentJournalResolution = {
   state: AgentJournalResolutionState
-  /** Option id the winner picked; null while pending or cancelled. */
+  /** Option id the winner picked; null while pending or cancelled. For a question, the answer in the
+   *  packed form older clients read; `answers` is the same answer structured. */
   selectedOptionId: string | null
+  /** Question answers. Absent on approvals and on rows written before hosts recorded it. */
+  answers?: AgentSessionQuestionAnswer[]
   /** Opaque client identity of the resolver, for "answered on <device>". */
   resolvedBy: string | null
   resolvedAt: number | null
@@ -253,9 +259,8 @@ export type AgentJournalThreadGoalState =
   | { state: 'set'; goal: AgentJournalThreadGoal }
   | { state: 'cleared' }
 
-export type AgentJournalStatusItem = {
+type AgentJournalStatusItemFields = {
   kind: 'status'
-  text: string
   /** Optional display hints; unknown values retain the ordinary text fallback. */
   presentation?: string
   tone?: string
@@ -274,6 +279,19 @@ export type AgentJournalStatusItem = {
   threadGoal?: AgentJournalThreadGoalState
 }
 
+/** A status row that reports no failure; its text is its writer's own. */
+export type AgentJournalPlainStatusItem = AgentJournalStatusItemFields & {
+  text: string
+  failure?: undefined
+}
+
+export type AgentJournalStatusItem =
+  | AgentJournalPlainStatusItem
+  | (AgentJournalStatusItemFields &
+      /** A row that reports a failure: what failed, typed, beside the sentence older clients print,
+       *  both from `agentSessionFailureWords`. Absent on rows from older hosts. */
+      AgentSessionFailureRowWords)
+
 /** The durable record of one root turn. `running` exposes cancellation while
  *  the provider can still accept it; the item is revised to a terminal state,
  *  never tombstoned, so the endpoints survive. Timestamps are the execution
@@ -323,6 +341,13 @@ export type AgentJournalProducerLinkage = {
   attempt?: number
 }
 
+/** Where the journal placed an item: the sequence of the row that created it,
+ *  then its place among that row's writes. The timeline's only ordering key. */
+export type AgentJournalPosition = {
+  sequence: number
+  index: number
+}
+
 /** One reduced timeline entry. `sequence` orders the list; `observedAt` is the
  *  provider's own clock and may sort earlier than a later sequence when the row
  *  was recovered after a crash. */
@@ -331,6 +356,9 @@ export type AgentJournalRenderItem = AgentJournalProducerLinkage & {
   revision: number
   body: AgentJournalItemBody
   sequence: number
+  /** Place among the writes of the row at `sequence`, which one lifecycle batch
+   *  shares across every item it creates. Absent ⇒ 0, and on a host that predates it. */
+  sequenceIndex?: number
   observedAt: number
   /** Set when the row was appended by crash reconciliation rather than live. */
   recovered?: true
@@ -353,13 +381,23 @@ export type AgentJournalSubmission = {
   dispatchState: AgentJournalDispatchState
   /** Provider item identity adopted on accept; null otherwise. */
   providerItemId: string | null
-  /** Terminal reason on `rejected`. */
+  /** Terminal reason on `rejected`: a sentence a person can read, or one of the legacy markers
+   *  older clients already recognise. On `unknown`, the doubt marker. */
   reason: string | null
+  /** On `rejected`, why, typed; absent on rows from older hosts. */
+  rejection?: UnreadAgentSessionFailureFact
   submittedAt: number
   resolvedAt: number | null
   /** Set when crash reconciliation resolved the dispatch, not the provider. A live
    *  `unknown` is a send still outstanding; a recovered one outlived its writer. */
   recovered?: true
+  /** The host accepted this send to hand over later; absent on sends dispatched as they were
+   *  recorded (older hosts). With no `handedOverAt` yet, a pending one is still queued. */
+  handoverRecorded?: true
+  /** When the host handed it to the provider (its `dispatch{pending}` row). */
+  handedOverAt?: number
+  /** Host-only: the submission row's sequence, which tells which host process accepted it. */
+  acceptedSequence?: number
 }
 
 /** Durable answer to "did my send land?", keyed by client message id. Only an
diff --git a/src/shared/agent-session-lease-adjudication.test.ts b/src/shared/agent-session-lease-adjudication.test.ts
index ff1020ece749..602a263e91b7 100644
--- a/src/shared/agent-session-lease-adjudication.test.ts
+++ b/src/shared/agent-session-lease-adjudication.test.ts
@@ -91,7 +91,11 @@ describe('acquisition compare-and-swap', () => {
         handoffOperationId: null,
         probe: MATCHED
       })
-    ).toEqual({ decision: 'refused', code: 'agent_session_checkpoint_stale' })
+    ).toEqual({
+      decision: 'refused',
+      code: 'agent_session_checkpoint_stale',
+      details: { reason: 'fenceStale' }
+    })
     expect(acquire(held, MATCHED)).toEqual({ decision: 'granted', nextFence: 8 })
   })
 
@@ -108,7 +112,11 @@ describe('acquisition compare-and-swap', () => {
         handoffOperationId: null,
         probe: MATCHED
       })
-    ).toEqual({ decision: 'refused', code: 'agent_session_checkpoint_stale' })
+    ).toEqual({
+      decision: 'refused',
+      code: 'agent_session_checkpoint_stale',
+      details: { reason: 'fenceStale' }
+    })
   })
 
   it('never grants a second owner on expiry alone', () => {
@@ -116,11 +124,13 @@ describe('acquisition compare-and-swap', () => {
     const expired = lease({ leaseDeadlineAt: 1, lastRenewedAt: 1 })
     expect(acquire(expired, INDETERMINATE)).toEqual({
       decision: 'refused',
-      code: 'agent_session_ownership_unknown'
+      code: 'agent_session_ownership_unknown',
+      details: { reason: 'ownerUnproven' }
     })
     expect(acquire(expired, MATCHED)).toEqual({
       decision: 'refused',
-      code: 'agent_session_conflict'
+      code: 'agent_session_conflict',
+      details: { reason: 'ownerAlive' }
     })
     expect(acquire(expired, { outcome: 'pid-absent' })).toEqual({
       decision: 'granted',
@@ -131,24 +141,25 @@ describe('acquisition compare-and-swap', () => {
   it('refuses while unreconciled even with proof the owner is dead', () => {
     expect(acquire(lease({ unreconciled: true }), { outcome: 'pid-absent' })).toEqual({
       decision: 'refused',
-      code: 'execution_owner_reconciling'
+      code: 'execution_owner_reconciling',
+      details: { reason: 'hostReconciling' }
     })
   })
 
   it('keeps a conflicted claim conflicted regardless of proof', () => {
+    // Restart adjudication and recovery resolution are what retire it, once its owner is gone.
     expect(acquire(lease({ claimStatus: 'conflicted' }), { outcome: 'exit-observed' })).toEqual({
       decision: 'refused',
-      code: 'agent_session_conflict'
+      code: 'agent_session_conflict',
+      details: { reason: 'claimConflicted' }
     })
   })
 
-  it.each([
-    ['recovering', 'agent_session_ownership_unknown'],
-    ['manual-recovery', 'agent_session_ownership_unknown']
-  ] as const)('refuses acquisition in stage %s', (handoffStage, code) => {
-    expect(acquire(lease({ handoffStage }), { outcome: 'pid-absent' })).toEqual({
+  it('refuses acquisition in the recovering stage', () => {
+    expect(acquire(lease({ handoffStage: 'recovering' }), { outcome: 'pid-absent' })).toEqual({
       decision: 'refused',
-      code
+      code: 'agent_session_ownership_unknown',
+      details: { reason: 'ownerUnproven' }
     })
   })
 
@@ -161,7 +172,8 @@ describe('acquisition compare-and-swap', () => {
     })
     expect(acquire(mid, { outcome: 'reservation-unused' }, 'op-2')).toEqual({
       decision: 'refused',
-      code: 'agent_session_operation_conflict'
+      code: 'agent_session_operation_conflict',
+      details: { reason: 'handoffInFlight' }
     })
     expect(acquire(mid, { outcome: 'reservation-unused' }, 'op-1')).toEqual({
       decision: 'retry-reservation',
@@ -173,7 +185,8 @@ describe('acquisition compare-and-swap', () => {
     const reserved = lease({ ownerProcess: null, claimStatus: 'reserved', handoffStage: null })
     expect(acquire(reserved, INDETERMINATE)).toEqual({
       decision: 'refused',
-      code: 'agent_session_ownership_unknown'
+      code: 'agent_session_ownership_unknown',
+      details: { reason: 'ownerUnproven' }
     })
     expect(acquire(reserved, { outcome: 'reservation-unused' })).toEqual({
       decision: 'granted',
@@ -190,7 +203,7 @@ describe('restart reconciliation', () => {
         probe: MATCHED,
         observedAt: 9_000
       })
-    ).toMatchObject({ disposition: 'conflicted' })
+    ).toMatchObject({ disposition: 'recovering', stage: 'recovering' })
   })
 
   it('routes a surviving native owner to recovery instead of readopting a dead transport', () => {
@@ -218,9 +231,7 @@ describe('restart reconciliation', () => {
     })
   })
 
-  it('keeps re-asking about an unverifiable owner instead of evicting it', () => {
-    // A recorded exact identity can still be probed later; manual recovery is reserved
-    // for leases that name no process at all.
+  it('hands an unverifiable owner to recovery resolution instead of evicting it', () => {
     expect(
       adjudicateAgentSessionRestart({
         lease: lease({ leaseDeadlineAt: 1 }),
@@ -230,24 +241,21 @@ describe('restart reconciliation', () => {
     ).toEqual({ disposition: 'recovering', stage: 'recovering', reason: 'no answer' })
   })
 
-  it('keeps a pre-restart conflict conflicted while its owner cannot be proven gone', () => {
+  it('re-adjudicates a claim an older record marked conflicted by the owner it names', () => {
     expect(
       adjudicateAgentSessionRestart({
         lease: lease({ claimStatus: 'conflicted' }),
         probe: INDETERMINATE,
         observedAt: 9_000
       })
-    ).toEqual({ disposition: 'conflicted', reason: 'claim conflicted before restart' })
-  })
-
-  it('keeps a conflict conflicted when it names no process to prove anything about', () => {
+    ).toEqual({ disposition: 'recovering', stage: 'recovering', reason: 'no answer' })
     expect(
       adjudicateAgentSessionRestart({
         lease: lease({ claimStatus: 'conflicted', ownerProcess: null }),
-        probe: { outcome: 'pid-absent' },
+        probe: INDETERMINATE,
         observedAt: 9_000
       })
-    ).toEqual({ disposition: 'conflicted', reason: 'claim conflicted before restart' })
+    ).toEqual({ disposition: 'evicted', nextFence: 8, evidence: null })
   })
 
   it('frees a conflict whose named owner is proven gone', () => {
@@ -283,31 +291,28 @@ describe('restart reconciliation', () => {
     ).toEqual({ disposition: 'free', reason: 'lease has no owner and no reservation' })
   })
 
-  it('does not infer an ownerless native reservation is unused from restart alone', () => {
-    const reserved = lease({ ownerProcess: null, claimStatus: 'reserved' })
-    expect(
-      adjudicateAgentSessionRestart({ lease: reserved, probe: INDETERMINATE, observedAt: 9_000 })
-    ).toEqual({
-      disposition: 'recovering',
-      stage: 'manual-recovery',
-      reason: 'reservation with no proven process'
-    })
-  })
-
-  it('frees an ownerless reservation only when a probe proves nothing ever spawned', () => {
-    // A child can outlive the runtime that reserved it, so absence needs proof.
-    const reserved = lease({ ownerProcess: null, claimStatus: 'reserved' })
-    expect(
-      adjudicateAgentSessionRestart({
-        lease: reserved,
-        probe: { outcome: 'reservation-unused' },
-        observedAt: 9_000
+  it.each([null, 'recovering'] as const)(
+    'releases an ownerless reservation at stage %s, with evidence only when a scan proved nothing spawned',
+    (handoffStage) => {
+      // A child spawned before its identity was recorded lost its stdio with the runtime that
+      // crashed, and a token scan is the only proof there can be.
+      const reserved = lease({ ownerProcess: null, claimStatus: 'reserved', handoffStage })
+      expect(
+        adjudicateAgentSessionRestart({ lease: reserved, probe: INDETERMINATE, observedAt: 9_000 })
+      ).toEqual({ disposition: 'evicted', nextFence: 8, evidence: null })
+      expect(
+        adjudicateAgentSessionRestart({
+          lease: reserved,
+          probe: { outcome: 'reservation-unused' },
+          observedAt: 9_000
+        })
+      ).toEqual({
+        disposition: 'evicted',
+        nextFence: 8,
+        evidence: { kind: 'pid-absent', detail: 'reservation never spawned', observedAt: 9_000 }
       })
-    ).toMatchObject({ disposition: 'evicted', nextFence: 8 })
-    expect(
-      adjudicateAgentSessionRestart({ lease: reserved, probe: INDETERMINATE, observedAt: 9_000 })
-    ).toMatchObject({ disposition: 'recovering', stage: 'manual-recovery' })
-  })
+    }
+  )
 })
 
 describe('writer admission and orphan spawn tokens', () => {
diff --git a/src/shared/agent-session-lease-adjudication.ts b/src/shared/agent-session-lease-adjudication.ts
index 6c1d07820adb..bbe409a37fce 100644
--- a/src/shared/agent-session-lease-adjudication.ts
+++ b/src/shared/agent-session-lease-adjudication.ts
@@ -1,10 +1,10 @@
 /**
  * Single-writer lease adjudication.
  *
- * Every decision here fails closed: expiry alone never grants a second owner, an unverifiable
- * process counts as possibly alive, and a stage that cannot prove an owner keeps re-asking —
- * or, when it names no process at all, ends in manual recovery — rather than handing the
- * session to the other runtime. This is the opposite polarity
+ * Every decision here fails closed: expiry alone never grants a second owner, and an
+ * unverifiable process counts as possibly alive until recovery resolution concludes about it. A
+ * lease that names no process at all is released: nothing was recorded that could be holding it.
+ * This is the opposite polarity
  * from daemon adoption checks, which fail open on a missing start time — a wrong answer there
  * refuses an adoption, a wrong answer here creates two writers on one provider session.
  */
@@ -15,7 +15,10 @@ import type {
   AgentSessionHandoffStage,
   AgentSessionLease
 } from './agent-session-record'
-import type { AgentSessionOwnerVerdict } from './agent-session-wire-refusals'
+import type {
+  AgentSessionOwnerVerdict,
+  AgentSessionRefusalDetailsByCode
+} from './agent-session-wire-refusals'
 
 export type AgentSessionIdentityMatchField = 'process-start-time' | 'spawn-token'
 
@@ -44,23 +47,20 @@ export type AgentSessionAcquisitionDecision =
   | { decision: 'granted'; nextFence: number }
   /** The same acquisition operation re-entering its own reservation; no new fence, no new spawn. */
   | { decision: 'retry-reservation'; fence: number }
-  | { decision: 'refused'; code: AgentSessionLeaseRefusalCode }
+  | {
+      [C in AgentSessionLeaseRefusalCode]: {
+        decision: 'refused'
+        code: C
+        details: AgentSessionRefusalDetailsByCode[C]
+      }
+    }[AgentSessionLeaseRefusalCode]
 
 export type AgentSessionRestartAdjudication =
-  /** A journal settlement latch survives restart without changing its handoff stage. */
-  | { disposition: 'settlement-pending' }
   /** Nothing is outstanding — no owner, no reservation. Clear any latched stage; the fence stays. */
   | { disposition: 'free'; reason: string }
-  | { disposition: 'evicted'; nextFence: number; evidence: AgentSessionDeathEvidence }
+  /** `evidence` is null when nothing proved the owner gone: it was never recorded. */
+  | { disposition: 'evicted'; nextFence: number; evidence: AgentSessionDeathEvidence | null }
   | { disposition: 'recovering'; stage: AgentSessionHandoffStage; reason: string }
-  | { disposition: 'conflicted'; reason: string }
-
-export function agentSessionRestartEvictionSettlementId(
-  lease: Pick<AgentSessionLease, 'sessionId'>,
-  eviction: Extract<AgentSessionRestartAdjudication, { disposition: 'evicted' }>
-): string {
-  return `restart-eviction:${lease.sessionId}:${eviction.nextFence}`
-}
 
 export function isProvenDeadProbe(probe: AgentSessionOwnerProbe): boolean {
   return (
@@ -94,7 +94,8 @@ function deathEvidenceFor(
   return null
 }
 
-/** The store releases a lease only on proven exit or eviction; anything held or mid-handoff may run. */
+/** `exited` only for a lease released on death evidence; one recovery released without proof, like
+ *  anything held or mid-handoff, may still be running. */
 export function agentSessionLeaseOwnerVerdict(lease: AgentSessionLease): AgentSessionOwnerVerdict {
   if (agentSessionLeaseAdmitsWriter(lease)) {
     return 'live'
@@ -102,11 +103,17 @@ export function agentSessionLeaseOwnerVerdict(lease: AgentSessionLease): AgentSe
   return lease.claimStatus === 'released' &&
     lease.handoffStage === null &&
     lease.ownerProcess === null &&
-    lease.reservedSpawnToken === null
+    lease.reservedSpawnToken === null &&
+    lease.deathEvidence !== null
     ? 'exited'
     : 'unverifiable'
 }
 
+/** Nothing holds this lease: released, no handoff in flight, and reconciled since the last restart. */
+export function agentSessionLeaseIsReleased(lease: AgentSessionLease): boolean {
+  return !lease.unreconciled && lease.claimStatus === 'released' && lease.handoffStage === null
+}
+
 /** True when the recorded owner may write right now. Used by every mutating path in later parts. */
 export function agentSessionLeaseAdmitsWriter(lease: AgentSessionLease): boolean {
   return (
@@ -133,22 +140,43 @@ export function evaluateAgentSessionAcquisition(args: {
 }): AgentSessionAcquisitionDecision {
   const { lease, expectedFence, handoffOperationId, probe } = args
   if (lease.unreconciled) {
-    return { decision: 'refused', code: 'execution_owner_reconciling' }
+    return {
+      decision: 'refused',
+      code: 'execution_owner_reconciling',
+      details: { reason: 'hostReconciling' }
+    }
   }
   if (!isAgentSessionFenceCurrent(lease, expectedFence)) {
-    return { decision: 'refused', code: 'agent_session_checkpoint_stale' }
+    return {
+      decision: 'refused',
+      code: 'agent_session_checkpoint_stale',
+      details: { reason: 'fenceStale' }
+    }
   }
   if (lease.claimStatus === 'conflicted') {
-    return { decision: 'refused', code: 'agent_session_conflict' }
+    // Why: the user's own terminal agent; restart adjudication and recovery retire it once gone.
+    return {
+      decision: 'refused',
+      code: 'agent_session_conflict',
+      details: { reason: 'claimConflicted' }
+    }
   }
-  if (lease.handoffStage === 'recovering' || lease.handoffStage === 'manual-recovery') {
-    // Why: no stage expires into an owner; recovery is resolved by proof or by the user.
-    return { decision: 'refused', code: 'agent_session_ownership_unknown' }
+  if (lease.handoffStage === 'recovering') {
+    // Why: no stage expires into an owner; recovery resolution concludes about it first.
+    return {
+      decision: 'refused',
+      code: 'agent_session_ownership_unknown',
+      details: { reason: 'ownerUnproven' }
+    }
   }
   if (lease.handoffStage !== null && lease.handoffOperationId !== null) {
     if (handoffOperationId !== lease.handoffOperationId) {
       // Why: the retry key is operation id + fence + stage; a different id is a different intent.
-      return { decision: 'refused', code: 'agent_session_operation_conflict' }
+      return {
+        decision: 'refused',
+        code: 'agent_session_operation_conflict',
+        details: { reason: 'handoffInFlight' }
+      }
     }
     if (
       lease.ownerProcess === null &&
@@ -163,19 +191,24 @@ export function evaluateAgentSessionAcquisition(args: {
     if (!isProvenDeadProbe(probe)) {
       // Why: a lapsed deadline means Orca stopped hearing from the owner, not that the child
       // stopped editing files and spending tokens.
-      return {
-        decision: 'refused',
-        code: isProvenAliveProbe(probe)
-          ? 'agent_session_conflict'
-          : 'agent_session_ownership_unknown'
-      }
+      return isProvenAliveProbe(probe)
+        ? { decision: 'refused', code: 'agent_session_conflict', details: { reason: 'ownerAlive' } }
+        : {
+            decision: 'refused',
+            code: 'agent_session_ownership_unknown',
+            details: { reason: 'ownerUnproven' }
+          }
     }
     return { decision: 'granted', nextFence: nextAgentSessionFence(lease) }
   }
   if (lease.claimStatus === 'reserved' && probe.outcome !== 'reservation-unused') {
     // Why: a reservation with no proven process is not a free lease — the crash may have lost
     // the race with the spawn rather than beaten it.
-    return { decision: 'refused', code: 'agent_session_ownership_unknown' }
+    return {
+      decision: 'refused',
+      code: 'agent_session_ownership_unknown',
+      details: { reason: 'ownerUnproven' }
+    }
   }
   return { decision: 'granted', nextFence: nextAgentSessionFence(lease) }
 }
@@ -190,44 +223,25 @@ export function adjudicateAgentSessionRestart(args: {
   observedAt: number
 }): AgentSessionRestartAdjudication {
   const { lease, probe, observedAt } = args
-  if (lease.claimStatus === 'conflicted') {
-    const conflictedOwnerDeath =
-      lease.ownerProcess === null ? null : deathEvidenceFor(probe, observedAt)
-    if (conflictedOwnerDeath) {
-      // Why: the conflict names one specific process. Present-time proof that THAT process is gone
-      // leaves no claimant to protect, and a conflict with no exit is a session the user can never
-      // open again. Without such proof the conflict still outlives the process that observed it.
-      return {
-        disposition: 'evicted',
-        nextFence: nextAgentSessionFence(lease),
-        evidence: conflictedOwnerDeath
-      }
-    }
-    return { disposition: 'conflicted', reason: 'claim conflicted before restart' }
-  }
   if (lease.ownerProcess === null) {
-    if (lease.settlementRetryRequired) {
-      // A watched provider death can leave terminal rows unsettled. This latch is not owner
-      // uncertainty and must survive restart until the journal settlement is durably accepted.
-      return { disposition: 'settlement-pending' }
-    }
-    if (lease.reservedSpawnToken === null && lease.claimStatus !== 'reserved') {
+    if (lease.reservedSpawnToken === null && lease.claimStatus === 'released') {
       // Why: the spawn token is minted before the child and is the only thing a child could be
       // carrying. With no owner and no token nothing can hold this lease, so it is already free —
       // treating it as an unproven reservation is what re-latches every released record on restart.
       return { disposition: 'free', reason: 'lease has no owner and no reservation' }
     }
-    if (probe.outcome === 'reservation-unused') {
-      return {
-        disposition: 'evicted',
-        nextFence: nextAgentSessionFence(lease),
-        evidence: { kind: 'pid-absent', detail: 'reservation never spawned', observedAt }
-      }
-    }
+    // Why: a child spawned before its identity was recorded lost its stdio with the runtime that
+    // crashed, so nothing can drive it. A token scan that proves no child is the only evidence there
+    // can be; without it the lease is released anyway. A live child still carrying the token is
+    // not signalled here, and the orphan reaper, which runs once at store open, may have seen this
+    // lease still claiming it.
     return {
-      disposition: 'recovering',
-      stage: 'manual-recovery',
-      reason: 'reservation with no proven process'
+      disposition: 'evicted',
+      nextFence: nextAgentSessionFence(lease),
+      evidence:
+        probe.outcome === 'reservation-unused'
+          ? { kind: 'pid-absent', detail: 'reservation never spawned', observedAt }
+          : null
     }
   }
   if (isProvenAliveProbe(probe)) {
@@ -244,8 +258,7 @@ export function adjudicateAgentSessionRestart(args: {
     return { disposition: 'evicted', nextFence: nextAgentSessionFence(lease), evidence }
   }
   return {
-    // Why: an exact recorded identity can still be probed later, so the system keeps
-    // re-asking; only a record naming nobody (above) needs the user to decide.
+    // Why: recovery resolution, which runs next, owns the verdict on a recorded identity.
     disposition: 'recovering',
     stage: 'recovering',
     reason:
diff --git a/src/shared/agent-session-legacy-handoff-lease.test.ts b/src/shared/agent-session-legacy-handoff-lease.test.ts
index b38c411fc6d6..49a10558b818 100644
--- a/src/shared/agent-session-legacy-handoff-lease.test.ts
+++ b/src/shared/agent-session-legacy-handoff-lease.test.ts
@@ -3,6 +3,7 @@ import {
   leaseCarriesLegacyHandoffValues,
   normalizeLegacyHandoffLease,
   normalizeLegacyHandoffRecord,
+  terminalOwnerRefusalMessage,
   type PersistedAgentSessionLease
 } from './agent-session-legacy-handoff-lease'
 import type { AgentSessionClaimStatus, AgentSessionHandoffStage } from './agent-session-record'
@@ -12,12 +13,7 @@ import {
 } from './agent-session-record.test-fixture'
 
 const CLAIMS: AgentSessionClaimStatus[] = ['reserved', 'live', 'conflicted', 'released']
-const STAGES: (AgentSessionHandoffStage | null)[] = [
-  null,
-  'new-owner-proving',
-  'recovering',
-  'manual-recovery'
-]
+const STAGES: (AgentSessionHandoffStage | null)[] = [null, 'new-owner-proving', 'recovering']
 
 function persisted(overrides: Partial<PersistedAgentSessionLease>): PersistedAgentSessionLease {
   return { ...agentSessionLeaseFixture(), ...overrides }
@@ -36,7 +32,7 @@ describe('normalizing a lease the removed terminal handoff wrote', () => {
     }
   })
 
-  it.each(['preparing', 'old-owner-stopped'] as const)(
+  it.each(['preparing', 'old-owner-stopped', 'manual-recovery'] as const)(
     'maps the %s stage to recovering and keeps its operation id',
     (handoffStage) => {
       const lease = persisted({ handoffStage, handoffOperationId: 'op-handoff' })
@@ -85,3 +81,24 @@ describe('normalizing a lease the removed terminal handoff wrote', () => {
     })
   })
 })
+
+describe('the refusal for a chat a terminal agent holds', () => {
+  const owner = { hostId: 'local', pid: 4242, spawnToken: 'token' }
+
+  it('names the process only when its start time can tell it from a reused pid', () => {
+    const verifiable = agentSessionLeaseFixture({
+      claimStatus: 'conflicted',
+      ownerProcess: { ...owner, processStartTimeMs: 1_000 }
+    })
+    const reusable = agentSessionLeaseFixture({
+      claimStatus: 'conflicted',
+      ownerProcess: { ...owner, processStartTimeMs: null }
+    })
+    expect(terminalOwnerRefusalMessage(verifiable)).toBe(
+      'This chat is still open in a terminal agent (process 4242). Quit that agent to continue the chat here.'
+    )
+    expect(terminalOwnerRefusalMessage(reusable)).toBe(
+      'This chat is still open in a terminal agent. Quit that agent to continue the chat here.'
+    )
+  })
+})
diff --git a/src/shared/agent-session-legacy-handoff-lease.ts b/src/shared/agent-session-legacy-handoff-lease.ts
index af2216d0ab3a..ea4ef2909e8c 100644
--- a/src/shared/agent-session-legacy-handoff-lease.ts
+++ b/src/shared/agent-session-legacy-handoff-lease.ts
@@ -1,9 +1,10 @@
 /**
- * Lease values only the removed terminal handoff wrote.
+ * Lease values only older builds wrote.
  *
- * Records an older build persisted can still carry a terminal owner (`runtimeKind: 'tui'`) or a
- * handoff stage (`preparing`, `old-owner-stopped`). They are accepted on disk and mapped here, once,
- * at decode, so no in-memory lease holds a value nothing in this build produces.
+ * Records an older build persisted can still carry a terminal owner (`runtimeKind: 'tui'`), a
+ * handoff stage (`preparing`, `old-owner-stopped`), or the removed ownerless-reservation latch
+ * (`manual-recovery`). They are accepted on disk and mapped here, once, at decode, so no in-memory
+ * lease holds a value nothing in this build produces.
  */
 
 import type {
@@ -14,7 +15,7 @@ import type {
 } from './agent-session-record'
 
 type LegacyHandoffRuntimeKind = 'tui'
-type LegacyHandoffStage = 'preparing' | 'old-owner-stopped'
+type LegacyHandoffStage = 'preparing' | 'old-owner-stopped' | 'manual-recovery'
 
 export type PersistedAgentSessionRuntimeKind =
   | AgentSessionOwnerRuntimeKind
@@ -49,21 +50,21 @@ export function isPersistedAgentSessionHandoffStage(
   )
 }
 
+function isLegacyHandoffStage(
+  stage: PersistedAgentSessionHandoffStage | null
+): stage is LegacyHandoffStage {
+  return stage === 'preparing' || stage === 'old-owner-stopped' || stage === 'manual-recovery'
+}
+
 export function leaseCarriesLegacyHandoffValues(lease: PersistedAgentSessionLease): boolean {
-  return (
-    lease.runtimeKind === 'tui' ||
-    lease.handoffStage === 'preparing' ||
-    lease.handoffStage === 'old-owner-stopped'
-  )
+  return lease.runtimeKind === 'tui' || isLegacyHandoffStage(lease.handoffStage)
 }
 
 /** Identity for every lease this build writes. */
 export function normalizeLegacyHandoffLease(lease: PersistedAgentSessionLease): AgentSessionLease {
   const { runtimeKind, handoffStage } = lease
-  const stage =
-    handoffStage === 'preparing' || handoffStage === 'old-owner-stopped'
-      ? 'recovering'
-      : handoffStage
+  // Why: every one of these awaited proof about an owner, which is what `recovering` resolves.
+  const stage = isLegacyHandoffStage(handoffStage) ? 'recovering' : handoffStage
   if (runtimeKind === 'native') {
     return { ...lease, runtimeKind, handoffStage: stage }
   }
@@ -77,6 +78,14 @@ export function normalizeLegacyHandoffLease(lease: PersistedAgentSessionLease):
   }
 }
 
+/** A `conflicted` claim is a terminal agent an older build recorded, and only its exit frees the chat. */
+export function terminalOwnerRefusalMessage(lease: AgentSessionLease): string {
+  // Why: without a start time the pid may since belong to an unrelated process.
+  const owner = lease.ownerProcess
+  const process = owner?.processStartTimeMs != null ? ` (process ${owner.pid})` : ''
+  return `This chat is still open in a terminal agent${process}. Quit that agent to continue the chat here.`
+}
+
 /** The in-memory record, plus whether decode changed anything the store must write back. */
 export function normalizeLegacyHandoffRecord(record: PersistedAgentSessionRecord): {
   record: AgentSessionRecord
diff --git a/src/shared/agent-session-mutation-envelope.test.ts b/src/shared/agent-session-mutation-envelope.test.ts
index e929d628de54..028de74935ad 100644
--- a/src/shared/agent-session-mutation-envelope.test.ts
+++ b/src/shared/agent-session-mutation-envelope.test.ts
@@ -109,16 +109,15 @@ describe('admitAgentSessionMutation', () => {
     expect(admission.decision).toBe('replay')
   })
 
-  it('refuses a stale fence and hands back the current one', () => {
-    const admission = admitAgentSessionMutation({
-      ...base,
-      envelope: envelope({ expectedRuntimeFence: 3 }),
-      ledger: ADMIT('f'.repeat(64))
-    })
-    expect(admission).toMatchObject({
-      decision: 'refused',
-      refusal: { code: 'agent_session_checkpoint_stale', currentFence: 4 }
-    })
+  it('admits a writer whatever fence the client last saw', () => {
+    for (const expectedRuntimeFence of [3, 5, null]) {
+      const admission = admitAgentSessionMutation({
+        ...base,
+        envelope: envelope({ expectedRuntimeFence }),
+        ledger: ADMIT('f'.repeat(64))
+      })
+      expect(admission, String(expectedRuntimeFence)).toMatchObject({ decision: 'admit' })
+    }
   })
 
   it('refuses a writer while the lease is unreconciled', () => {
@@ -164,11 +163,18 @@ describe('admitAgentSessionMutation', () => {
   it('surfaces a ledger refusal verbatim', () => {
     const admission = admitAgentSessionMutation({
       ...base,
-      ledger: { decision: 'refused', code: 'agent_session_operation_expired' }
+      ledger: {
+        decision: 'refused',
+        code: 'agent_session_operation_expired',
+        details: { reason: 'operationExpired' }
+      }
     })
     expect(admission).toMatchObject({
       decision: 'refused',
-      refusal: { code: 'agent_session_operation_expired' }
+      refusal: {
+        code: 'agent_session_operation_expired',
+        details: { reason: 'operationExpired' }
+      }
     })
   })
 })
diff --git a/src/shared/agent-session-mutation-envelope.ts b/src/shared/agent-session-mutation-envelope.ts
index 83fdb65e9aee..770c184b5628 100644
--- a/src/shared/agent-session-mutation-envelope.ts
+++ b/src/shared/agent-session-mutation-envelope.ts
@@ -11,12 +11,11 @@ import type {
   AgentSessionOperationDecision,
   AgentSessionOperationRow
 } from './agent-session-operation-ledger'
-import {
-  agentSessionLeaseAdmitsWriter,
-  isAgentSessionFenceCurrent
-} from './agent-session-lease-adjudication'
+import { agentSessionLeaseAdmitsWriter } from './agent-session-lease-adjudication'
 import type { AgentSessionLease } from './agent-session-record'
+import { terminalOwnerRefusalMessage } from './agent-session-legacy-handoff-lease'
 import type { AgentSessionMutationEnvelope, AgentSessionWireRefusal } from './agent-session-wire'
+import { refuse } from './agent-session-wire-refusals'
 
 /**
  * Stable digest over the fields that define what this call DOES. Keys are
@@ -66,11 +65,11 @@ export function agentSessionFingerprintConflict(
 ): AgentSessionWireRefusal | null {
   return envelope.payloadFingerprint === hostFingerprint
     ? null
-    : {
-        code: 'agent_session_operation_conflict',
-        message:
-          'The payload does not match the fingerprint the client declared for this operation.'
-      }
+    : refuse(
+        'agent_session_operation_conflict',
+        { reason: 'fingerprintMismatch' },
+        'The payload does not match the fingerprint the client declared for this operation.'
+      )
 }
 
 export type AgentSessionMutationAdmission =
@@ -81,10 +80,11 @@ export type AgentSessionMutationAdmission =
 
 /**
  * Fixed order: fingerprint agreement, then the ledger (so a retry replays
- * before anything else can refuse it), then the lease, then the fence. Putting
- * the ledger ahead of the fence is deliberate — a retry that crossed an owner
- * change must still return its recorded answer instead of a stale-checkpoint
- * refusal the client would then resend as a second effect.
+ * before anything else can refuse it), then the lease.
+ *
+ * `expectedRuntimeFence` is not checked: each write names its own target (a
+ * turn, an item revision, an epoch) or is last-writer-wins, so an owner restart
+ * the client has not seen yet refuses nothing. Older hosts still check it.
  */
 export function admitAgentSessionMutation(input: {
   envelope: AgentSessionMutationEnvelope
@@ -93,6 +93,9 @@ export function admitAgentSessionMutation(input: {
   /** Decision from the durable ledger, evaluated under `hostFingerprint`. */
   ledger: AgentSessionOperationDecision
   lease: AgentSessionLease
+  /** A write to the conversation, not to the provider child: a send is accepted and a Stop
+   *  withdraws queued messages whoever owns the child, so the lease does not admit them. */
+  conversationWrite?: true
 }): AgentSessionMutationAdmission {
   const { envelope, lease, ledger } = input
   const mismatch = agentSessionFingerprintConflict(envelope, input.hostFingerprint)
@@ -102,32 +105,23 @@ export function admitAgentSessionMutation(input: {
   if (ledger.decision === 'refused') {
     return {
       decision: 'refused',
-      refusal: {
-        code: ledger.code,
-        message: `Operation ${envelope.clientOperationId} was refused: ${ledger.code}.`
-      }
+      refusal: refuse(
+        ledger.code,
+        ledger.details,
+        `Operation ${envelope.clientOperationId} was refused: ${ledger.code}.`
+      )
     }
   }
   if (ledger.decision === 'replay') {
     return { decision: 'replay', row: ledger.row }
   }
+  if (input.conversationWrite) {
+    return { decision: 'admit', row: ledger.row }
+  }
   const leaseRefusal = refuseUnlessWriterAdmitted(lease)
   if (leaseRefusal) {
     return { decision: 'refused', refusal: leaseRefusal }
   }
-  if (
-    envelope.expectedRuntimeFence === null ||
-    !isAgentSessionFenceCurrent(lease, envelope.expectedRuntimeFence)
-  ) {
-    return {
-      decision: 'refused',
-      refusal: {
-        code: 'agent_session_checkpoint_stale',
-        message: `Expected runtime fence ${envelope.expectedRuntimeFence ?? 'none'}; the session is at ${lease.runtimeFence}.`,
-        currentFence: lease.runtimeFence
-      }
-    }
-  }
   return { decision: 'admit', row: ledger.row }
 }
 
@@ -138,22 +132,31 @@ function refuseUnlessWriterAdmitted(lease: AgentSessionLease): AgentSessionWireR
     return null
   }
   if (lease.unreconciled) {
-    return {
-      code: 'execution_owner_reconciling',
-      message: 'This host has not yet adjudicated the session lease.'
-    }
+    return refuse(
+      'execution_owner_reconciling',
+      { reason: 'hostReconciling' },
+      'This host has not yet adjudicated the session lease.'
+    )
   }
   if (lease.handoffStage !== null) {
-    return {
-      code: 'agent_session_conflict',
-      message:
-        lease.handoffStage === 'new-owner-proving'
-          ? 'The chat is still starting.'
-          : "Orca has not yet confirmed that this chat's previous agent process stopped. Reopen the chat to check again."
+    if (lease.claimStatus === 'conflicted') {
+      return refuse(
+        'agent_session_conflict',
+        { reason: 'claimConflicted' },
+        terminalOwnerRefusalMessage(lease)
+      )
     }
+    return lease.handoffStage === 'new-owner-proving'
+      ? refuse('agent_session_conflict', { reason: 'chatStarting' }, 'The chat is still starting.')
+      : refuse(
+          'agent_session_conflict',
+          { reason: 'ownerUnproven' },
+          "Orca has not yet confirmed that this chat's previous agent process stopped. Reopen the chat to check again."
+        )
   }
-  return {
-    code: 'agent_session_ownership_unknown',
-    message: 'The session has no live owner to accept writes.'
-  }
+  return refuse(
+    'agent_session_ownership_unknown',
+    { reason: 'noLiveOwner' },
+    'The session has no live owner to accept writes.'
+  )
 }
diff --git a/src/shared/agent-session-operation-ledger.test.ts b/src/shared/agent-session-operation-ledger.test.ts
index 0710eade4614..ef10fac8f2b4 100644
--- a/src/shared/agent-session-operation-ledger.test.ts
+++ b/src/shared/agent-session-operation-ledger.test.ts
@@ -64,7 +64,8 @@ describe('operation admission', () => {
     admit(rows)
     expect(evaluate(rows, { fingerprint: 'fp-2' })).toEqual({
       decision: 'refused',
-      code: 'agent_session_operation_conflict'
+      code: 'agent_session_operation_conflict',
+      details: { reason: 'operationIdReused' }
     })
   })
 
@@ -78,14 +79,19 @@ describe('operation admission', () => {
     const rows = new Map<string, AgentSessionOperationRow>()
     expect(evaluate(rows, { operationId: 'not-an-operation-id' })).toEqual({
       decision: 'refused',
-      code: 'agent_session_operation_invalid'
+      code: 'agent_session_operation_invalid',
+      details: { reason: 'operationIdInvalid' }
     })
     // Why: a future-dated id would look new again after its own tombstone is collected.
     expect(
       evaluate(rows, {
         operationId: operationId(NOW + AGENT_SESSION_OPERATION_FUTURE_SKEW_MS + 1)
       })
-    ).toEqual({ decision: 'refused', code: 'agent_session_operation_invalid' })
+    ).toEqual({
+      decision: 'refused',
+      code: 'agent_session_operation_invalid',
+      details: { reason: 'operationIdInvalid' }
+    })
     expect(
       evaluate(rows, { operationId: operationId(NOW + AGENT_SESSION_OPERATION_FUTURE_SKEW_MS) })
         .decision
@@ -97,7 +103,8 @@ describe('operation admission', () => {
     const stale = operationId(NOW - AGENT_SESSION_MAX_NEW_OPERATION_AGE_MS - 1)
     expect(evaluate(rows, { operationId: stale })).toEqual({
       decision: 'refused',
-      code: 'agent_session_operation_expired'
+      code: 'agent_session_operation_expired',
+      details: { reason: 'operationExpired' }
     })
     expect(
       evaluate(rows, { operationId: operationId(NOW - AGENT_SESSION_MAX_NEW_OPERATION_AGE_MS) })
@@ -110,12 +117,14 @@ describe('operation admission', () => {
     admit(rows, { operationId: operationId(NOW, 'b'.repeat(32)) })
     expect(evaluate(rows, { perClientLimit: 1 })).toEqual({
       decision: 'refused',
-      code: 'agent_session_operation_capacity'
+      code: 'agent_session_operation_capacity',
+      details: { reason: 'operationCapacity' }
     })
     // A different caller is still refused once the global cap is reached.
     expect(evaluate(rows, { callerKey: 'client-2', globalLimit: 1 })).toEqual({
       decision: 'refused',
-      code: 'agent_session_operation_capacity'
+      code: 'agent_session_operation_capacity',
+      details: { reason: 'operationCapacity' }
     })
     expect(evaluate(rows, { callerKey: 'client-2', perClientLimit: 1 }).decision).toBe('admit')
   })
diff --git a/src/shared/agent-session-operation-ledger.ts b/src/shared/agent-session-operation-ledger.ts
index 765f8e511423..90caec22bb79 100644
--- a/src/shared/agent-session-operation-ledger.ts
+++ b/src/shared/agent-session-operation-ledger.ts
@@ -1,3 +1,7 @@
+import type {
+  AgentSessionAnyRefusalDetails,
+  AgentSessionRefusalDetailsByCode
+} from './agent-session-refusal-details'
 import {
   isAgentSessionRewindResult,
   type AgentSessionRewindReason,
@@ -55,7 +59,15 @@ export type AgentSessionOperationOutcome =
        */
       launch?: unknown
     }
-  | { status: 'failed'; code: string; message?: string; rewindReason?: AgentSessionRewindReason }
+  | {
+      status: 'failed'
+      code: string
+      message?: string
+      rewindReason?: AgentSessionRewindReason
+      /** Beside the code, so a replay says what the first answer did. Read back against the code,
+       *  since the code is a string here; a row written before details carries none. */
+      details?: AgentSessionAnyRefusalDetails
+    }
   /** The effect may or may not have happened; replay this answer instead of spawning again. */
   | { status: 'unknown' }
 
@@ -78,7 +90,13 @@ export type AgentSessionOperationRefusalCode =
 export type AgentSessionOperationDecision =
   | { decision: 'replay'; row: AgentSessionOperationRow }
   | { decision: 'admit'; row: AgentSessionOperationRow }
-  | { decision: 'refused'; code: AgentSessionOperationRefusalCode }
+  | {
+      [C in AgentSessionOperationRefusalCode]: {
+        decision: 'refused'
+        code: C
+        details: AgentSessionRefusalDetailsByCode[C]
+      }
+    }[AgentSessionOperationRefusalCode]
 
 /** NUL cannot occur in a caller key or operation id, so no pair can forge another pair's key. */
 const OPERATION_KEY_SEPARATOR = '\u0000'
@@ -228,19 +246,31 @@ export function evaluateAgentSessionOperation(args: {
     operationTimestamp > now + AGENT_SESSION_OPERATION_FUTURE_SKEW_MS
   ) {
     // Why: a future-dated id could look new again after its tombstone is collected.
-    return { decision: 'refused', code: 'agent_session_operation_invalid' }
+    return {
+      decision: 'refused',
+      code: 'agent_session_operation_invalid',
+      details: { reason: 'operationIdInvalid' }
+    }
   }
   const key = agentSessionOperationKey(callerKey, operationId)
   const existing = rows.get(key)
   if (existing) {
     return existing.fingerprint === fingerprint
       ? { decision: 'replay', row: existing }
-      : { decision: 'refused', code: 'agent_session_operation_conflict' }
+      : {
+          decision: 'refused',
+          code: 'agent_session_operation_conflict',
+          details: { reason: 'operationIdReused' }
+        }
   }
   if (now - operationTimestamp > AGENT_SESSION_MAX_NEW_OPERATION_AGE_MS) {
     // Why: once a tombstone could have expired, an unseen replay must never be reinterpreted as
     // permission to start another fresh agent.
-    return { decision: 'refused', code: 'agent_session_operation_expired' }
+    return {
+      decision: 'refused',
+      code: 'agent_session_operation_expired',
+      details: { reason: 'operationExpired' }
+    }
   }
   const perClientLimit = args.perClientLimit ?? AGENT_SESSION_DURABLE_OPERATION_PER_CLIENT_LIMIT
   const globalLimit = args.globalLimit ?? AGENT_SESSION_DURABLE_OPERATION_GLOBAL_LIMIT
@@ -253,19 +283,37 @@ export function evaluateAgentSessionOperation(args: {
   if (callerCount >= perClientLimit || rows.size >= globalLimit) {
     // Why: tombstones cannot be evicted early without making an old replay capable of spawning
     // again; reject new ids until retained rows age out.
-    return { decision: 'refused', code: 'agent_session_operation_capacity' }
+    return {
+      decision: 'refused',
+      code: 'agent_session_operation_capacity',
+      details: { reason: 'operationCapacity' }
+    }
   }
   return {
     decision: 'admit',
-    row: {
-      callerKey,
-      operationId,
-      fingerprint,
-      operationTimestamp,
-      recordedAt: now,
-      expiresAt: agentSessionOperationExpiry(operationTimestamp, now),
-      outcome: { status: 'pending' }
-    }
+    row: pendingAgentSessionOperationRow({ callerKey, operationId, fingerprint, now })
+  }
+}
+
+/** A `pending` row for this id, retained for the full replay window from `now`. */
+export function pendingAgentSessionOperationRow(args: {
+  callerKey: string
+  operationId: string
+  fingerprint: string
+  now: number
+}): AgentSessionOperationRow {
+  const operationTimestamp = parseAgentSessionOperationTimestamp(args.operationId)
+  if (operationTimestamp === null) {
+    throw new Error('agent_session_operation_invalid')
+  }
+  return {
+    callerKey: args.callerKey,
+    operationId: args.operationId,
+    fingerprint: args.fingerprint,
+    operationTimestamp,
+    recordedAt: args.now,
+    expiresAt: agentSessionOperationExpiry(operationTimestamp, args.now),
+    outcome: { status: 'pending' }
   }
 }
 
diff --git a/src/shared/agent-session-question-answer.ts b/src/shared/agent-session-question-answer.ts
index 072dfce200a7..08374adc3d52 100644
--- a/src/shared/agent-session-question-answer.ts
+++ b/src/shared/agent-session-question-answer.ts
@@ -1,13 +1,112 @@
-import type { AgentJournalQuestion } from './agent-session-journal-types'
+import type { AgentJournalQuestion, AgentJournalQuestionItem } from './agent-session-journal-types'
 
 const GROUP_ANSWER_PREFIX = 'question-group:'
 
+/** A single-question item has no question list; the client and host must agree on its id. */
+const SINGLE_QUESTION_ID = 'q1'
+
+/** Longest option id a host takes, which also bounds an answer packed into one. */
+export const AGENT_SESSION_RESPONSE_OPTION_ID_MAX_LENGTH = 1024
+
+/** Largest typed answer to one question, in UTF-8 bytes. */
+export const AGENT_SESSION_QUESTION_ANSWER_MAX_BYTES = 64 * 1024
+
 export type AgentSessionQuestionAnswer = {
   questionId: string
   optionIds: string[]
   other?: string
 }
 
+/** What a client chose on a prompt: a decision id for an approval, per-question answers for a question. */
+export type AgentSessionPromptResponse =
+  | { kind: 'option'; optionId: string }
+  | { kind: 'answers'; answers: AgentSessionQuestionAnswer[] }
+
+/** The questions an item asks: its grouped list, or the item itself as one question. */
+export function agentSessionPromptQuestions(
+  body: Pick<AgentJournalQuestionItem, 'question' | 'options' | 'questions' | 'freeTextQuestionId'>
+): AgentJournalQuestion[] {
+  if (body.questions) {
+    return body.questions
+  }
+  return [
+    {
+      id: body.freeTextQuestionId ?? SINGLE_QUESTION_ID,
+      question: body.question,
+      options: body.options,
+      multiSelect: false,
+      ...(body.freeTextQuestionId ? { freeTextQuestionId: body.freeTextQuestionId } : {})
+    }
+  ]
+}
+
+function encodeLegacyFreeTextAnswer(questionId: string, answer: string): string {
+  return `${encodeURIComponent(questionId)}:${encodeURIComponent(answer)}`
+}
+
+function decodeLegacyFreeTextAnswer(
+  optionId: string
+): { questionId: string; answer: string } | null {
+  const separator = optionId.indexOf(':')
+  if (separator <= 0) {
+    return null
+  }
+  try {
+    return {
+      questionId: decodeURIComponent(optionId.slice(0, separator)),
+      answer: decodeURIComponent(optionId.slice(separator + 1))
+    }
+  } catch {
+    return null
+  }
+}
+
+/**
+ * The answer packed into one option-id string, the only form older peers read: hosts that
+ * predate structured answers take it as `optionId`, and older clients render receipts from it.
+ */
+export function legacyAgentSessionSelectedOptionId(
+  body: Pick<AgentJournalQuestionItem, 'questions'>,
+  answers: readonly AgentSessionQuestionAnswer[]
+): string | null {
+  if (body.questions) {
+    return encodeAgentSessionQuestionAnswers(answers)
+  }
+  const [answer] = answers
+  if (!answer || answers.length !== 1) {
+    return null
+  }
+  const other = answer.other?.trim()
+  return (
+    answer.optionIds[0] ?? (other ? encodeLegacyFreeTextAnswer(answer.questionId, other) : null)
+  )
+}
+
+/** Reads an answer an older client packed into `optionId`. */
+export function legacyAgentSessionQuestionAnswers(
+  body: Pick<AgentJournalQuestionItem, 'question' | 'options' | 'questions' | 'freeTextQuestionId'>,
+  optionId: string
+): AgentSessionQuestionAnswer[] | null {
+  const grouped = body.questions ? decodeAgentSessionQuestionAnswers(optionId) : null
+  if (grouped) {
+    return grouped
+  }
+  const questions = agentSessionPromptQuestions(body)
+  const questionId = questions.length === 1 ? questions[0]!.id : null
+  if (!questionId) {
+    return null
+  }
+  if (body.options.some((option) => option.id === optionId)) {
+    return [{ questionId, optionIds: [optionId] }]
+  }
+  const freeText = decodeLegacyFreeTextAnswer(optionId)
+  return body.freeTextQuestionId &&
+    freeText?.questionId === body.freeTextQuestionId &&
+    freeText.answer.trim().length > 0
+    ? [{ questionId, optionIds: [], other: freeText.answer }]
+    : null
+}
+
 export function encodeAgentSessionQuestionAnswers(
   answers: readonly AgentSessionQuestionAnswer[]
 ): string {
diff --git a/src/shared/agent-session-queued-submission.ts b/src/shared/agent-session-queued-submission.ts
new file mode 100644
index 000000000000..6295897fd54e
--- /dev/null
+++ b/src/shared/agent-session-queued-submission.ts
@@ -0,0 +1,13 @@
+import type { AgentJournalSubmission } from './agent-session-journal-types'
+
+/** Accepted by the host and not yet handed to the provider: provably unwritten, so every way out
+ *  of this state is delivery or a rejection, never doubt. */
+export function isQueuedAgentJournalSubmission(
+  submission: Pick<AgentJournalSubmission, 'handoverRecorded' | 'dispatchState' | 'handedOverAt'>
+): boolean {
+  return (
+    submission.handoverRecorded === true &&
+    submission.dispatchState === 'pending' &&
+    submission.handedOverAt === undefined
+  )
+}
diff --git a/src/shared/agent-session-record.ts b/src/shared/agent-session-record.ts
index 6cfe07e70b48..2b85695a8459 100644
--- a/src/shared/agent-session-record.ts
+++ b/src/shared/agent-session-record.ts
@@ -1,6 +1,5 @@
 import { isAgentSessionRewindRecord, type AgentSessionRewindRecord } from './agent-session-rewind'
 import { isAgentSessionLaunchArgs } from './agent-session-launch-args'
-import { isAgentSessionSurfaceTabId } from './agent-session-surface-tab-id'
 import { isAgentSessionConversationName } from './agent-session-conversation-name'
 import {
   isPersistedAgentSessionHandoffStage,
@@ -61,13 +60,12 @@ export type AgentSessionLaunchArgs = string[]
  *  away at decode (agent-session-legacy-handoff-lease). */
 export type AgentSessionOwnerRuntimeKind = 'native'
 
-/** The acquisition stage. The removed terminal handoff's stages are mapped away at decode. */
-export type AgentSessionHandoffStage = 'new-owner-proving' | 'recovering' | 'manual-recovery'
+/** The acquisition stage. Stages only older builds wrote are mapped away at decode. */
+export type AgentSessionHandoffStage = 'new-owner-proving' | 'recovering'
 
 /**
  * PID-reuse-safe process identity. `spawnToken` is the only element available on every platform:
- * process start time costs a CIM query on Windows and is absent in some containers. An exact
- * identity stays in `recovering`; an ownerless, unattributable reservation uses `manual-recovery`.
+ * process start time costs a CIM query on Windows and is absent in some containers.
  */
 export type AgentSessionProcessIdentity = {
   hostId: string
@@ -79,9 +77,9 @@ export type AgentSessionProcessIdentity = {
 export type AgentSessionJournalCheckpoint = { epoch: number; sequence: number }
 
 /**
- * Mirrors the in-memory claim registry's reserved / live / conflicted states so a conflict
- * survives a restart. `released` has no registry equivalent: the registry expresses "no owner" by
- * deleting the entry, and a durable record that outlives its owner needs a name for that.
+ * `released` means no owner: a durable record that outlives its owner needs a name for that.
+ * `conflicted` is how a terminal owner an older build recorded loads: recovery waits it out and
+ * never stops it, because it is the user's own agent.
  */
 export type AgentSessionClaimStatus = 'reserved' | 'live' | 'conflicted' | 'released'
 
@@ -103,8 +101,6 @@ export type AgentSessionLease = {
   ownerProcess: AgentSessionProcessIdentity | null
   /** Reserved before any process exists, then matched against the child's environment. */
   reservedSpawnToken: string | null
-  /** Set only when acquisition failed before any spawn attempt. */
-  processlessAt?: number | null
   leaseDeadlineAt: number
   lastRenewedAt: number
   handoffOperationId: string | null
@@ -121,11 +117,8 @@ export type AgentSessionLease = {
    * so rewriting it would invalidate the record it is trying to save.
    */
   minimumNextFence?: number
+  /** Null on a released lease when nothing proved its owner gone. */
   deathEvidence: AgentSessionDeathEvidence | null
-  /** A positively observed provider exit whose terminal journal settlement still needs retry. */
-  settlementRetryRequired?: boolean
-  /** Stable lifecycle batch id used when retrying the terminal settlement. */
-  settlementRetryId?: string
 }
 
 export type AgentSessionRecord = {
@@ -142,9 +135,6 @@ export type AgentSessionRecord = {
   /** The name Orca gave this conversation, so a later acquisition need not name it again. */
   conversationName?: string
   launchArgs?: AgentSessionLaunchArgs
-  /** The id of the tab that shows this conversation on every client: host-owned and pinned once;
-   *  readers copy it, never derive it. Older records are backfilled at load with the derived id. */
-  surfaceTabId?: string
   lease: AgentSessionLease
   createdAt: number
   updatedAt: number
@@ -311,9 +301,6 @@ function isPersistedAgentSessionLease(value: unknown): value is PersistedAgentSe
     (lease.ownerProcess === null || isAgentSessionProcessIdentity(lease.ownerProcess)) &&
     (lease.reservedSpawnToken === null ||
       isBoundedString(lease.reservedSpawnToken, MAX_ID_LENGTH)) &&
-    (lease.processlessAt === undefined ||
-      lease.processlessAt === null ||
-      (Number.isSafeInteger(lease.processlessAt) && (lease.processlessAt as number) >= 0)) &&
     Number.isSafeInteger(lease.leaseDeadlineAt) &&
     Number.isSafeInteger(lease.lastRenewedAt) &&
     (lease.handoffOperationId === null ||
@@ -326,10 +313,6 @@ function isPersistedAgentSessionLease(value: unknown): value is PersistedAgentSe
       lease.claimStatus === 'conflicted' ||
       lease.claimStatus === 'released') &&
     typeof lease.unreconciled === 'boolean' &&
-    (lease.settlementRetryRequired === undefined ||
-      typeof lease.settlementRetryRequired === 'boolean') &&
-    (lease.settlementRetryId === undefined ||
-      isBoundedString(lease.settlementRetryId, MAX_ID_LENGTH)) &&
     (lease.deathEvidence === null || isAgentSessionDeathEvidence(lease.deathEvidence))
   )
 }
@@ -357,7 +340,6 @@ export function isPersistedAgentSessionRecord(
     (record.conversationName === undefined ||
       isAgentSessionConversationName(record.conversationName)) &&
     (record.launchArgs === undefined || isAgentSessionLaunchArgs(record.launchArgs)) &&
-    (record.surfaceTabId === undefined || isAgentSessionSurfaceTabId(record.surfaceTabId)) &&
     !Object.hasOwn(record, 'launchEnv') &&
     isPersistedAgentSessionLease(record.lease) &&
     record.lease.sessionId === record.sessionId &&
diff --git a/src/shared/agent-session-refusal-details.ts b/src/shared/agent-session-refusal-details.ts
new file mode 100644
index 000000000000..6080a772ee2a
--- /dev/null
+++ b/src/shared/agent-session-refusal-details.ts
@@ -0,0 +1,271 @@
+// What a refusal says beyond its code: one reason list and one set of facts per code.
+//
+// A code alone cannot say what to do: `agent_session_operation_invalid` covers a cleared
+// conversation (open the current one) and a busy command (wait). Each reason here is one situation
+// with its own honest words and next step; a reason two codes share is listed under each. There is
+// no catch-all: a site that cannot name its situation sends the code with no reason, the same as an
+// older host, and the reader falls back to what it does for the code.
+
+import type { AgentJournalResolution } from './agent-session-journal-types'
+import { isAgentJournalResolution } from './agent-session-journal-schemas'
+import { AGENT_SESSION_REWIND_REASONS, type AgentSessionRewindReason } from './agent-session-rewind'
+import type {
+  AgentSessionOwnerVerdict,
+  AgentSessionWireRefusalCode
+} from './agent-session-wire-refusals'
+
+export const AGENT_SESSION_REFUSAL_REASONS = {
+  agent_session_operation_invalid: [
+    // The request
+    'requestMalformed',
+    'operationIdInvalid',
+    'messageIdReused',
+    'operationRefusedEarlier',
+    'journalWriteFailed',
+    // The conversation's state
+    'conversationCleared',
+    /** A /clear that never committed; its replacement conversation may not exist. */
+    'clearUnconfirmed',
+    'conversationCommandUnconfirmed',
+    'conversationCommandInFlight',
+    'handoffInFlight',
+    'turnActive',
+    'promptPending',
+    'backgroundTasksRunning',
+    'messagesUnsettled',
+    'rewindRefused',
+    'rewindUnconfirmed',
+    // A prompt card or an option
+    'promptGone',
+    'optionRejected',
+    // The provider
+    'providerStarting',
+    'goalsUnsupported',
+    'providerRejected',
+    'providerStartFailed',
+    'notSignedIn',
+    'historyTooLarge',
+    /** The launch's own Anthropic sign-in variables would override the managed Claude account. */
+    'managedAccountEnvOverride',
+    'accountSwitchInProgress',
+    /** A Claude account is added in WSL and no Windows one is selected, which a chat can't run under. */
+    'managedAccountUnsupported',
+    /** The agent started, then Orca could not open the chat's conversation for it. */
+    'attachFailed'
+  ],
+  agent_session_ownership_unknown: [
+    'sessionNotAttached',
+    'noLiveOwner',
+    /** Orca cannot prove an agent process it recorded or started has exited. */
+    'ownerUnproven',
+    'claimConflicted',
+    'recordMissing',
+    'replaySuperseded',
+    'leaseMoved',
+    'spawnIdentityMismatch',
+    'notResumable',
+    'noProviderChild',
+    'conversationHeldElsewhere'
+  ],
+  agent_session_conflict: [
+    'chatStarting',
+    'ownerUnproven',
+    'claimConflicted',
+    'ownerAlive',
+    'identityMismatch',
+    'sessionExists',
+    'conversationHeldElsewhere',
+    'tabIdTaken'
+  ],
+  execution_owner_reconciling: ['hostReconciling', 'recordUnreadable'],
+  agent_session_checkpoint_stale: ['fenceStale', 'leaseMoved', 'recordMissing'],
+  agent_session_identity_required: ['recordMissing', 'transcriptNotFound', 'transcriptUnreadable'],
+  agent_session_operation_conflict: ['fingerprintMismatch', 'operationIdReused', 'handoffInFlight'],
+  agent_session_operation_expired: ['operationExpired'],
+  agent_session_operation_capacity: ['operationCapacity'],
+  agent_session_operation_unknown: [
+    'outcomeUnknown',
+    'resultLost',
+    'rewindUnconfirmed',
+    'tabUnconfirmed'
+  ],
+  agent_session_item_revision_stale: ['promptMoved'],
+  agent_session_already_resolved: ['promptAlreadyResolved'],
+  agent_session_journal_unreadable: [
+    /** SQLite reports the chat's journal damaged or not a database; no retry reads past it. */
+    'journalCorrupt',
+    /** Any other failed open, which can clear. */
+    'journalUnavailable'
+  ],
+  structured_agent_session_unsupported: [
+    'clientCapabilityMissing',
+    'hostDisabled',
+    'hostUnsupported'
+  ],
+  // Sent with no reason when starting the agent for an operation throws; older clients read it too.
+  agent_session_owner_restart_failed: []
+} as const satisfies Record<AgentSessionWireRefusalCode, readonly string[]>
+
+export type AgentSessionRefusalReason<C extends AgentSessionWireRefusalCode> =
+  (typeof AGENT_SESSION_REFUSAL_REASONS)[C][number]
+
+/** A reason under any code, for a reader that keys words on the name alone. */
+export type AgentSessionAnyRefusalReason = AgentSessionRefusalReason<AgentSessionWireRefusalCode>
+
+type RewindFacts = {
+  /** Which rewind check refused. */
+  rewindReason?: AgentSessionRewindReason
+}
+
+type PromptFacts = {
+  /** The revision the host actually holds. */
+  currentRevision?: number
+  /** The winning answer and who gave it. */
+  resolution?: AgentJournalResolution
+}
+
+type NoFacts = Record<never, never>
+
+/** The facts a code carries beside its reason. */
+type AgentSessionRefusalFactsByCode = {
+  agent_session_operation_invalid: RewindFacts
+  agent_session_operation_unknown: RewindFacts
+  agent_session_checkpoint_stale: {
+    /** So the client can retry without another round trip. */
+    currentFence?: number
+  }
+  agent_session_item_revision_stale: PromptFacts
+  agent_session_already_resolved: PromptFacts
+  agent_session_ownership_unknown: NoFacts
+  agent_session_conflict: NoFacts
+  execution_owner_reconciling: NoFacts
+  agent_session_identity_required: NoFacts
+  agent_session_operation_conflict: NoFacts
+  agent_session_operation_expired: NoFacts
+  agent_session_operation_capacity: NoFacts
+  agent_session_journal_unreadable: NoFacts
+  structured_agent_session_unsupported: NoFacts
+  agent_session_owner_restart_failed: NoFacts
+}
+
+/** A durably failed create says whether anything still runs for it, whichever code it failed
+ *  with: `exited` proves nothing does, so a new operation cannot collide with this one. */
+type AgentSessionRefusalCommonFacts = { ownerVerdict?: AgentSessionOwnerVerdict }
+
+export type AgentSessionRefusalFacts<C extends AgentSessionWireRefusalCode> =
+  AgentSessionRefusalFactsByCode[C] & AgentSessionRefusalCommonFacts
+
+/** What an emitter must name: a reason its code lists, and that code's facts. */
+export type AgentSessionRefusalDetailsByCode = {
+  [C in AgentSessionWireRefusalCode]: {
+    reason: AgentSessionRefusalReason<C>
+  } & AgentSessionRefusalFacts<C>
+}
+
+/** Details as the wire and a durable record carry them. The reason is absent where the host could
+ *  not name the situation; the whole object is absent from older hosts. */
+export type AgentSessionRefusalDetails<C extends AgentSessionWireRefusalCode> = {
+  reason?: AgentSessionRefusalReason<C>
+} & AgentSessionRefusalFacts<C>
+
+/** Details under whichever code, for a store that keeps them beside a code it reads as a string. */
+export type AgentSessionAnyRefusalDetails = AgentSessionRefusalDetails<AgentSessionWireRefusalCode>
+
+/** The loose top-level fields released clients read; the host writes them only from details. */
+export type AgentSessionLegacyRefusalFields = {
+  currentFence?: number
+  currentRevision?: number
+  resolution?: AgentJournalResolution
+  ownerVerdict?: AgentSessionOwnerVerdict
+  rewindReason?: AgentSessionRewindReason
+}
+
+const FACT_KEYS_BY_CODE: Partial<
+  Record<AgentSessionWireRefusalCode, readonly (keyof AgentSessionLegacyRefusalFields)[]>
+> = {
+  agent_session_operation_invalid: ['rewindReason'],
+  agent_session_operation_unknown: ['rewindReason'],
+  agent_session_checkpoint_stale: ['currentFence'],
+  agent_session_item_revision_stale: ['currentRevision', 'resolution'],
+  agent_session_already_resolved: ['currentRevision', 'resolution']
+}
+
+const OWNER_VERDICTS: readonly AgentSessionOwnerVerdict[] = ['live', 'unverifiable', 'exited']
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value)
+}
+
+function readFact(
+  key: keyof AgentSessionLegacyRefusalFields,
+  value: unknown
+): AgentSessionLegacyRefusalFields {
+  switch (key) {
+    case 'currentFence':
+      return Number.isSafeInteger(value) && typeof value === 'number' ? { currentFence: value } : {}
+    case 'currentRevision':
+      return Number.isSafeInteger(value) && typeof value === 'number'
+        ? { currentRevision: value }
+        : {}
+    case 'resolution':
+      return isAgentJournalResolution(value) ? { resolution: value } : {}
+    case 'ownerVerdict': {
+      const ownerVerdict = OWNER_VERDICTS.find((verdict) => verdict === value)
+      return ownerVerdict ? { ownerVerdict } : {}
+    }
+    case 'rewindReason': {
+      const rewindReason = AGENT_SESSION_REWIND_REASONS.find((reason) => reason === value)
+      return rewindReason ? { rewindReason } : {}
+    }
+  }
+}
+
+export function isAgentSessionRefusalReason<C extends AgentSessionWireRefusalCode>(
+  code: C,
+  value: unknown
+): value is AgentSessionRefusalReason<C> {
+  const reasons: readonly string[] = AGENT_SESSION_REFUSAL_REASONS[code]
+  return typeof value === 'string' && reasons.includes(value)
+}
+
+/**
+ * Details as a reader meets them: from the wire, a ledger row or a stored failure, possibly
+ * written by another build. Keeps only a reason and facts this code lists, so a reason a newer
+ * host added reads as none; undefined when nothing is left.
+ */
+export function readAgentSessionRefusalDetails<C extends AgentSessionWireRefusalCode>(
+  code: C,
+  value: unknown
+): AgentSessionRefusalDetails<C> | undefined {
+  if (!isRecord(value)) {
+    return undefined
+  }
+  const keys = [...(FACT_KEYS_BY_CODE[code] ?? []), 'ownerVerdict' as const]
+  const facts = keys.reduce<AgentSessionLegacyRefusalFields>(
+    (kept, key) => ({ ...kept, ...readFact(key, value[key]) }),
+    {}
+  )
+  const read = {
+    ...(isAgentSessionRefusalReason(code, value.reason) ? { reason: value.reason } : {}),
+    ...facts
+  }
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the reason was checked against `code`'s list and only the facts `code` lists (plus the verdict every code may carry) were kept.
+  return Object.keys(read).length > 0 ? (read as AgentSessionRefusalDetails<C>) : undefined
+}
+
+/** The loose fields released clients read, taken from details; the one place they are written. */
+export function agentSessionLegacyRefusalFields(
+  details: AgentSessionLegacyRefusalFields | undefined
+): AgentSessionLegacyRefusalFields {
+  if (!details) {
+    return {}
+  }
+  const { currentFence, currentRevision, resolution, ownerVerdict, rewindReason } = details
+  return {
+    ...(rewindReason !== undefined ? { rewindReason } : {}),
+    ...(currentFence !== undefined ? { currentFence } : {}),
+    ...(resolution !== undefined ? { resolution } : {}),
+    ...(currentRevision !== undefined ? { currentRevision } : {}),
+    ...(ownerVerdict !== undefined ? { ownerVerdict } : {})
+  }
+}
diff --git a/src/shared/agent-session-refusal-notice.test.ts b/src/shared/agent-session-refusal-notice.test.ts
new file mode 100644
index 000000000000..73652adbf1ad
--- /dev/null
+++ b/src/shared/agent-session-refusal-notice.test.ts
@@ -0,0 +1,524 @@
+import { describe, expect, it } from 'vitest'
+import {
+  AGENT_SESSION_WIRE_REFUSAL_CODES,
+  type AgentSessionWireRefusalCode
+} from './agent-session-wire-refusals'
+import {
+  agentSessionReadHistoryRefusalParts,
+  agentSessionRefusalNotice,
+  agentSessionRefusalReasonWords,
+  agentSessionWriteFailureNotice,
+  agentSessionWriteNoticeEnglish,
+  agentSessionWriteNoticeParts
+} from './agent-session-refusal-notice'
+import {
+  AGENT_SESSION_WRITE_NOTICE_COPY,
+  type AgentSessionWriteNoticeSentence
+} from './agent-session-write-notice-copy'
+import { AGENT_SESSION_REFUSAL_REASONS } from './agent-session-refusal-details'
+import { agentSessionFailureSentence } from './agent-session-failure-words'
+import {
+  agentSessionRefusalFailure,
+  agentSessionRpcErrorFailure,
+  agentSessionWriteKindForMethod,
+  type AgentSessionWriteFailure,
+  type AgentSessionWriteKind,
+  type AgentSessionWriteRefusal
+} from './agent-session-write-failure'
+import {
+  DISPATCH_REJECTED_NOT_DELIVERED,
+  DISPATCH_REJECTED_QUEUE_FULL,
+  DISPATCH_REJECTED_WRITE_FAILED
+} from './structured-agent-session-dispatch-rejection'
+import { structuredAgentSessionRejectionParts } from './structured-agent-session-send-disposition'
+
+const WRITES: AgentSessionWriteKind[] = [
+  'read-history',
+  'send',
+  'composer-send',
+  'stop',
+  'stop-task',
+  'stop-tasks',
+  'answer',
+  'option',
+  'command',
+  'goal'
+]
+const HOST_TEXT = 'Expected runtime fence 1; the session is at 3.'
+
+// A cause is named only where every host emitter of the code means it; any other code says only
+// what did not happen, because one code covers owner states or reasons the client cannot tell apart.
+const CAUSES: Partial<Record<AgentSessionWireRefusalCode, AgentSessionWriteNoticeSentence>> = {
+  // Only send preparation, when the owner it restarted for this send failed to start.
+  agent_session_owner_restart_failed: 'restartFailed',
+  // Only the ledger, when a day's retained operation ids fill a client's or the host's quota.
+  agent_session_operation_capacity: 'capacity',
+  // A replayed operation with no recorded outcome, or a send behind a rewind whose outcome is
+  // unrecorded: either way Orca cannot say what happened.
+  agent_session_operation_unknown: 'outcomeUnknown',
+  // Only the pending-prompt check.
+  agent_session_item_revision_stale: 'questionChanged',
+  agent_session_already_resolved: 'questionChanged',
+  // Send preparation, for any failed open; the code names nothing else.
+  agent_session_journal_unreadable: 'historyUnreadable',
+  // On these writes, only an older host, or the phone reading an unknown method.
+  structured_agent_session_unsupported: 'unsupported'
+}
+
+function isCause(part: unknown): boolean {
+  return typeof part === 'string' && !part.startsWith('notDone') && part !== 'tryAgainComposerSend'
+}
+
+// A newer host can send a code this client has never heard of.
+const FUTURE_CODE: AgentSessionWriteFailure = JSON.parse(
+  '{"kind":"refused","code":"agent_session_from_the_future"}'
+)
+const FAILURES: AgentSessionWriteFailure[] = [
+  ...AGENT_SESSION_WIRE_REFUSAL_CODES.map((code) => ({ kind: 'refused' as const, code })),
+  { kind: 'failed' },
+  { kind: 'unconfirmed' },
+  FUTURE_CODE
+]
+const NOT_DONE: Record<AgentSessionWriteKind, AgentSessionWriteNoticeSentence> = {
+  'read-history': 'notDoneReadHistory',
+  send: 'notDoneSend',
+  'composer-send': 'notDoneSend',
+  stop: 'notDoneStop',
+  'stop-task': 'notDoneStopTask',
+  'stop-tasks': 'notDoneStopTasks',
+  answer: 'notDoneAnswer',
+  option: 'notDoneOption',
+  command: 'notDoneCommand',
+  goal: 'notDoneGoal'
+}
+
+function codeOf(failure: AgentSessionWriteFailure): string {
+  return failure.kind === 'refused' ? failure.code : failure.kind
+}
+
+// The host may have run it: a thrown request, or a replayed id with no recorded outcome.
+function mayHaveRun(failure: AgentSessionWriteFailure): boolean {
+  return codeOf(failure) === 'unconfirmed' || codeOf(failure) === 'agent_session_operation_unknown'
+}
+
+// Where the cause sentence alone already says the write cannot take effect.
+function causeSaysNotDone(
+  failure: AgentSessionWriteFailure,
+  write: AgentSessionWriteKind
+): boolean {
+  const code = codeOf(failure)
+  return (
+    code === 'structured_agent_session_unsupported' ||
+    (write === 'read-history' && code === 'agent_session_journal_unreadable') ||
+    (write === 'answer' &&
+      (code === 'agent_session_item_revision_stale' || code === 'agent_session_already_resolved'))
+  )
+}
+
+// The phone resends under the same id. These record nothing under it (the lease refusals drop the
+// row they admitted), so a resend can go through; every other code can be refused again.
+const RESEND_CAN_WORK = new Set([
+  'failed',
+  'agent_session_checkpoint_stale',
+  'agent_session_conflict',
+  'agent_session_ownership_unknown',
+  'execution_owner_reconciling'
+])
+
+// Every (failure x write) cell of the table, checked against the rules a notice must keep.
+describe('the notice for every failure and write', () => {
+  const cells = FAILURES.flatMap((failure) =>
+    WRITES.map((write) => {
+      const parts = agentSessionWriteNoticeParts(failure, write)
+      return {
+        failure,
+        write,
+        parts,
+        english: agentSessionWriteNoticeEnglish(parts),
+        cell: `${codeOf(failure)} x ${write}`
+      }
+    })
+  )
+
+  it('says the write did not happen, once and for that write, whenever that is certain', () => {
+    for (const { failure, write, parts, cell } of cells.filter((c) => !mayHaveRun(c.failure))) {
+      const notDone = parts.filter((part) => typeof part === 'string' && part.startsWith('notDone'))
+      expect(notDone, cell).toEqual(causeSaysNotDone(failure, write) ? [] : [NOT_DONE[write]])
+    }
+  })
+
+  it('never says a write did not happen when the host may have run it', () => {
+    for (const { parts, cell } of cells.filter((c) => mayHaveRun(c.failure))) {
+      expect(parts, cell).toEqual(['outcomeUnknown'])
+    }
+  })
+
+  // The control that sent the write is how to try again; only the phone's composer has none.
+  it('says how to try again only to update Orca, or on the phone where a resend can work', () => {
+    for (const { failure, write, parts, english, cell } of cells) {
+      const phoneResend = write === 'composer-send' && RESEND_CAN_WORK.has(codeOf(failure))
+      expect(parts.includes('tryAgainComposerSend'), cell).toBe(phoneResend)
+      expect(/again/i.test(english), cell).toBe(
+        phoneResend || codeOf(failure) === 'structured_agent_session_unsupported'
+      )
+    }
+    for (const reason of [null, DISPATCH_REJECTED_WRITE_FAILED, DISPATCH_REJECTED_QUEUE_FULL]) {
+      expect(
+        agentSessionWriteNoticeEnglish(structuredAgentSessionRejectionParts(reason, 'send'))
+      ).not.toMatch(/again/i)
+    }
+  })
+
+  it('names a cause only for a code on the allowlist', () => {
+    for (const { failure, parts, cell } of cells) {
+      const cause =
+        failure.kind === 'unconfirmed'
+          ? 'outcomeUnknown'
+          : failure.kind === 'refused'
+            ? CAUSES[failure.code]
+            : undefined
+      expect(parts.filter(isCause), cell).toEqual(cause ? [cause] : [])
+    }
+  })
+
+  // Census of host emitters, one per code, that write for a log or carry a marker. One is enough
+  // to rule out showing the host's message for that code:
+  // - every code a planned write settles: "Operation <id> was already refused: <code>."
+  //   (structured-agent-session-replay-outcome.ts; the settlement stores no message)
+  // - operation_conflict / _expired / _invalid / _capacity: "Operation <id> was refused: <code>."
+  //   (agent-session-mutation-envelope.ts, the ledger)
+  // - operation_invalid, operation_unknown: `agent_session_rewind:<reason>` (structured-rewind-refusal.ts)
+  // - operation_unknown: "The outcome of operation <id> is unknown; it was not run again."
+  // - checkpoint_stale, conflict, identity_required, execution_owner_reconciling, unsupported: the
+  //   bare code thrown as the message (lease-release, reservation-admission, tab-table,
+  //   claim-identity, lease-transitions, reveal)
+  // - ownership_unknown: "The session attached without a provider child to write to." (agent-start)
+  // - item_revision_stale / already_resolved: "Item <id> has moved on." (prompt-state)
+  // - owner_restart_failed: "<agent> couldn't restart: <cause>.", where the cause is the resume's
+  //   own refusal message, including the ledger's (dead-generation-settlement, agent-start)
+  // - journal_unreadable: "The conversation could not be opened: <error>" (send preparation, before
+  //   it named a reason)
+  it('is never empty and never shows the host message', () => {
+    for (const { failure, write, parts, cell } of cells) {
+      expect(parts.length, cell).toBeGreaterThan(0)
+      expect(
+        parts.every((part) => typeof part === 'string'),
+        cell
+      ).toBe(true)
+      if (failure.kind === 'refused') {
+        expect(
+          agentSessionRefusalNotice({ code: failure.code, message: HOST_TEXT }, write),
+          cell
+        ).not.toContain('fence')
+      }
+    }
+  })
+})
+
+describe('structuredAgentSessionRejectionParts', () => {
+  it('never shows the crash-recovery marker as the reason', () => {
+    expect(structuredAgentSessionRejectionParts(DISPATCH_REJECTED_NOT_DELIVERED, 'send')).toEqual([
+      'notDoneSend'
+    ])
+  })
+})
+
+describe('agentSessionRefusalNotice', () => {
+  // The phone resends under the same operation id. Owner refusals and failed requests record
+  // nothing under it, so a resend can go through; a conflicting or expired id is refused again.
+  it.each([
+    ['agent_session_checkpoint_stale', 'Your message was not sent. Send it again.'],
+    ['execution_owner_reconciling', 'Your message was not sent. Send it again.'],
+    ['agent_session_operation_expired', 'Your message was not sent.'],
+    ['agent_session_operation_conflict', 'Your message was not sent.'],
+    ['agent_session_operation_invalid', 'Your message was not sent.'],
+    ['agent_session_owner_restart_failed', "The agent couldn't restart. Your message was not sent."]
+  ] as const)('tells the phone to send it again only where that can work: %s', (code, expected) => {
+    expect(agentSessionRefusalNotice({ code, message: HOST_TEXT }, 'composer-send')).toBe(expected)
+  })
+
+  it('says what did not happen for a failed request', () => {
+    expect(agentSessionWriteFailureNotice('composer-send')).toBe(
+      'Your message was not sent. Send it again.'
+    )
+    expect(agentSessionWriteFailureNotice('stop')).toBe("The agent wasn't stopped.")
+  })
+
+  // A request that may have run must not say it did not happen.
+  it.each(['runtime_timeout', 'runtime_error', undefined])(
+    'claims nothing about a request that threw with %s',
+    (code) => {
+      for (const write of WRITES) {
+        expect(
+          agentSessionWriteNoticeEnglish(
+            agentSessionWriteNoticeParts(agentSessionRpcErrorFailure(code), write)
+          )
+        ).toBe("Orca couldn't confirm what happened. Check the chat.")
+      }
+    }
+  )
+
+  it('says what did not happen when the host turned the request away before running it', () => {
+    expect(agentSessionRpcErrorFailure('invalid_argument')).toEqual({
+      kind: 'refused',
+      code: 'agent_session_operation_invalid'
+    })
+    expect(agentSessionRpcErrorFailure('method_not_found')).toEqual({
+      kind: 'refused',
+      code: 'structured_agent_session_unsupported'
+    })
+  })
+
+  it('says an agent could not restart without promising a retry will work', () => {
+    // The host words the cause into the chat's status row; some causes need a new chat.
+    expect(
+      agentSessionRefusalNotice(
+        {
+          code: 'agent_session_owner_restart_failed',
+          message:
+            "Claude couldn't restart: Operation 1-a was refused: agent_session_operation_expired."
+        },
+        'send'
+      )
+    ).toBe("The agent couldn't restart. Your message was not sent.")
+  })
+
+  it('names a background-task stop as that, not as stopping the agent', () => {
+    const stop = (fields: Record<string, unknown>): string =>
+      agentSessionRefusalNotice(
+        { code: 'agent_session_checkpoint_stale', message: HOST_TEXT },
+        agentSessionWriteKindForMethod('agentSession.cancel', fields)
+      )
+    expect(stop({ turnId: 't1' })).toBe("The agent wasn't stopped.")
+    expect(stop({ turnId: 'background-tasks', scope: 'background-tasks', taskId: 'b1' })).toBe(
+      "The background task wasn't stopped."
+    )
+    expect(stop({ turnId: 'background-tasks', scope: 'background-tasks' })).toBe(
+      "The background tasks weren't stopped."
+    )
+  })
+
+  it('says a Stop refused over a moved-on prompt did not stop the agent', () => {
+    const refusal = {
+      code: 'agent_session_already_resolved' as const,
+      message: 'Item q1 moved on.'
+    }
+    expect(agentSessionRefusalNotice(refusal, 'stop')).toBe(
+      "This question was already answered or has changed. The agent wasn't stopped."
+    )
+    expect(agentSessionRefusalNotice(refusal, 'answer')).toBe(
+      'This question was already answered or has changed.'
+    )
+  })
+
+  it('says only what did not happen for a code from a newer host', () => {
+    const refusal = JSON.parse('{"code":"agent_session_from_the_future","message":"internal"}')
+    expect(agentSessionRefusalNotice(refusal, 'stop')).toBe("The agent wasn't stopped.")
+  })
+})
+
+// Every (code x reason) a host can name, as a write keeps it.
+const REASONED: AgentSessionWriteRefusal[] = AGENT_SESSION_WIRE_REFUSAL_CODES.flatMap((code) =>
+  AGENT_SESSION_REFUSAL_REASONS[code].map((reason) =>
+    agentSessionRefusalFailure({ code, details: { reason } })
+  )
+)
+
+function reasonOf(failure: AgentSessionWriteRefusal): string {
+  return `${failure.code}/${failure.details?.reason}`
+}
+
+describe('the notice for every reason a host names', () => {
+  const cells = REASONED.flatMap((failure) =>
+    WRITES.map((write) => ({
+      failure,
+      write,
+      parts: agentSessionWriteNoticeParts(failure, write),
+      words: agentSessionRefusalReasonWords(failure),
+      cell: `${reasonOf(failure)} x ${write}`
+    }))
+  )
+
+  it('has words for every reason', () => {
+    for (const { words, cell } of cells) {
+      expect(words, cell).toBeDefined()
+    }
+  })
+
+  it('keeps the code words where the table says the reason means nothing more', () => {
+    for (const { failure, write, parts, words, cell } of cells) {
+      if (words && 'words' in words) {
+        expect(parts, cell).toEqual(
+          agentSessionWriteNoticeParts({ ...failure, details: undefined }, write)
+        )
+      }
+    }
+  })
+
+  // A retry is the control that sent the write; only an open that can clear says to try again.
+  it('names a step exactly where the person has one to take', () => {
+    for (const { words, cell } of cells) {
+      if (words && 'cause' in words) {
+        const retryNow = words.action === 'retry' && words.step === 'tryAgain'
+        expect(words.step !== undefined && !retryNow, cell).toBe(
+          words.action === 'wait' || words.action === 'actFirst' || words.action === 'goElsewhere'
+        )
+        expect(retryNow, cell).toBe(words.cause === 'historyUnavailable')
+      }
+    }
+  })
+
+  it('says the write did not happen, once, and never shows the host message', () => {
+    for (const { failure, write, parts, cell } of cells) {
+      const english = agentSessionWriteNoticeEnglish(parts)
+      expect(english.length, cell).toBeGreaterThan(0)
+      expect(agentSessionRefusalNotice({ ...failure, message: HOST_TEXT }, write), cell).toBe(
+        english
+      )
+      if (failure.code === 'agent_session_operation_unknown') {
+        expect(parts, cell).toEqual(['outcomeUnknown'])
+        continue
+      }
+      const notDone = parts.filter((part) => typeof part === 'string' && part.startsWith('notDone'))
+      const answeredAway = write === 'answer' && parts.includes('questionChanged')
+      const unsupported = failure.code === 'structured_agent_session_unsupported'
+      const saysNotDone =
+        write === 'read-history' && failure.code === 'agent_session_journal_unreadable'
+      expect(notDone, cell).toEqual(
+        answeredAway || unsupported || saysNotDone ? [] : [NOT_DONE[write]]
+      )
+    }
+  })
+
+  it("uses the failure's own sentence for a start that failed, and only for a message", () => {
+    const failure = agentSessionRefusalFailure({
+      code: 'agent_session_operation_invalid',
+      details: { reason: 'notSignedIn' }
+    })
+    expect(agentSessionWriteNoticeParts(failure, 'send')).toEqual([
+      'notDoneSend',
+      { text: agentSessionFailureSentence({ kind: 'notSignedIn' }, 'rejection') }
+    ])
+    // Its next step is to send the message again, which a Stop cannot do.
+    expect(agentSessionWriteNoticeParts(failure, 'stop')).toEqual(['notDoneStop'])
+  })
+
+  it.each([
+    [
+      'agent_session_operation_invalid',
+      'conversationCleared',
+      'send',
+      'This conversation has been cleared. Your message was not sent. Open the current conversation to continue.'
+    ],
+    [
+      'agent_session_operation_invalid',
+      'clearUnconfirmed',
+      'send',
+      "The last /clear didn't finish. Your message was not sent. Start a new chat to continue."
+    ],
+    [
+      'agent_session_operation_invalid',
+      'turnActive',
+      'command',
+      "The agent is still responding. The command didn't run. Wait for the agent to finish responding, or stop it."
+    ],
+    [
+      'agent_session_conflict',
+      'claimConflicted',
+      'composer-send',
+      'This chat is still open in a terminal agent. Your message was not sent. Quit that agent to continue the chat here.'
+    ],
+    [
+      'agent_session_conflict',
+      'chatStarting',
+      'stop',
+      "The agent is still starting. The agent wasn't stopped. Wait for the agent to finish starting."
+    ],
+    [
+      'agent_session_operation_invalid',
+      'promptGone',
+      'answer',
+      'This question was already answered or has changed.'
+    ],
+    [
+      'agent_session_checkpoint_stale',
+      'fenceStale',
+      'composer-send',
+      'Your message was not sent. Send it again.'
+    ]
+  ] as const)('%s / %s on %s', (code, reason, write, expected) => {
+    expect(
+      agentSessionRefusalNotice({ code, message: HOST_TEXT, details: { reason } }, write)
+    ).toBe(expected)
+  })
+})
+
+describe('a refusal from a host that names no reason this build knows', () => {
+  it.each([
+    ['an older host', undefined],
+    ['a reason a newer host added', { reason: 'fromTheFuture' }],
+    ['facts with no reason', { ownerVerdict: 'unverifiable' }]
+  ])("reads as the code's row: %s", (_label, details) => {
+    const refusal = JSON.parse(
+      JSON.stringify({ code: 'agent_session_operation_invalid', message: HOST_TEXT, details })
+    )
+    expect(agentSessionRefusalNotice(refusal, 'command')).toBe("The command didn't run.")
+  })
+})
+
+it('keeps a sentence the failure rows share word for word', () => {
+  expect(agentSessionFailureSentence({ kind: 'historyTooLarge' }, 'row')).toContain(
+    AGENT_SESSION_WRITE_NOTICE_COPY.startNewChat
+  )
+})
+
+// A failed journal open says what happened to the history, not what was asked of it.
+describe('a chat whose history the host could not open', () => {
+  const notice = (details: unknown, write: AgentSessionWriteKind): string =>
+    agentSessionRefusalNotice(
+      JSON.parse(
+        JSON.stringify({ code: 'agent_session_journal_unreadable', message: HOST_TEXT, details })
+      ),
+      write
+    )
+
+  it.each([
+    ['journalCorrupt', 'read-history', 'Unable to load this chat.'],
+    ['journalCorrupt', 'send', 'Unable to load this chat. Your message was not sent.'],
+    [
+      'journalUnavailable',
+      'read-history',
+      "Orca couldn't open this chat's history right now. Try again."
+    ],
+    [
+      'journalUnavailable',
+      'send',
+      "Orca couldn't open this chat's history right now. Your message was not sent. Try again."
+    ]
+  ] as const)('%s on %s', (reason, write, expected) => {
+    expect(notice({ reason }, write)).toBe(expected)
+  })
+
+  // Damage can't be told apart from an open that can clear, so it never says to start over.
+  it.each([
+    ['an older host', undefined],
+    ['a reason an unreleased build wrote', { reason: 'journalUnreadable' }]
+  ])('promises nothing for a refusal that names no reason: %s', (_label, details) => {
+    expect(notice(details, 'read-history')).toBe("Orca couldn't read this chat's saved history.")
+    expect(notice(details, 'send')).toBe(
+      "Orca couldn't read this chat's saved history. Your message was not sent."
+    )
+    expect(
+      agentSessionReadHistoryRefusalParts('agent_session_journal_unreadable', details)
+    ).toEqual(['historyUnreadable'])
+  })
+
+  it('says only that the history did not load for any other read refusal', () => {
+    expect(agentSessionReadHistoryRefusalParts('agent_session_ownership_unknown')).toEqual([
+      'notDoneReadHistory'
+    ])
+    expect(agentSessionReadHistoryRefusalParts('agent_session_from_the_future')).toEqual([
+      'notDoneReadHistory'
+    ])
+  })
+})
diff --git a/src/shared/agent-session-refusal-notice.ts b/src/shared/agent-session-refusal-notice.ts
new file mode 100644
index 000000000000..818031b81915
--- /dev/null
+++ b/src/shared/agent-session-refusal-notice.ts
@@ -0,0 +1,359 @@
+// The one way a chat surface puts a write that did not happen into words.
+//
+// A refusal's `message` is never shown. Every code has at least one host emitter whose message is
+// written for a log or carries a marker (the census is pinned in the test), so the refusal's
+// reason, when the host names one, and otherwise its code, pick the copy with the write. A code's
+// own row names a cause only where every emitter of the code means it; it is also the words for a
+// host too old to send a reason. A notice says how to get past a refusal only where the person has
+// a step to take; retrying is the control that sent the write, except on the phone, whose message
+// goes back to the composer, and a history that couldn't open right now says to try again.
+// Surfaces keep the fact and choose the words when they show it, so nothing saved carries copy.
+
+import type { AgentSessionFailureKind } from './agent-session-failure'
+import { agentSessionFailureSentence } from './agent-session-failure-words'
+import type { AgentSessionRefusalReason } from './agent-session-refusal-details'
+import {
+  AGENT_SESSION_WRITE_NOTICE_COPY,
+  type AgentSessionWriteNoticePart,
+  type AgentSessionWriteNoticeSentence
+} from './agent-session-write-notice-copy'
+import type {
+  AgentSessionWireRefusal,
+  AgentSessionWireRefusalCode
+} from './agent-session-wire-refusals'
+import {
+  agentSessionRefusalFailure,
+  parseAgentSessionWriteFailure,
+  type AgentSessionWriteFailure,
+  type AgentSessionWriteKind,
+  type AgentSessionWriteRefusal
+} from './agent-session-write-failure'
+
+const NOT_DONE: Record<AgentSessionWriteKind, AgentSessionWriteNoticeSentence> = {
+  'read-history': 'notDoneReadHistory',
+  send: 'notDoneSend',
+  'composer-send': 'notDoneSend',
+  stop: 'notDoneStop',
+  'stop-task': 'notDoneStopTask',
+  'stop-tasks': 'notDoneStopTasks',
+  answer: 'notDoneAnswer',
+  option: 'notDoneOption',
+  command: 'notDoneCommand',
+  goal: 'notDoneGoal'
+}
+
+/** That the write did not happen, for one that a second attempt can carry out. Only the phone says
+ *  how: its message goes back to the composer and it has no Retry control. Everywhere else the
+ *  control that sent the write is the way to try again. */
+export function agentSessionWriteNotDoneParts(
+  write: AgentSessionWriteKind
+): AgentSessionWriteNoticeSentence[] {
+  return write === 'composer-send' ? ['notDoneSend', 'tryAgainComposerSend'] : [NOT_DONE[write]]
+}
+
+/** What the person can do about a refusal with this reason. */
+export type AgentSessionRefusalAction =
+  /** Use the control that sent the write again. */
+  | 'retry'
+  /** Wait for what the notice names; its step says what. */
+  | 'wait'
+  /** Take the step the notice names first. */
+  | 'actFirst'
+  /** Continue somewhere else: the current conversation, or a new chat. */
+  | 'goElsewhere'
+  | 'checkChat'
+  | 'updateOrca'
+  /** What the write was for is over: the question it answered moved on. */
+  | 'nothingLeft'
+  /** Orca's own state or fault; nothing the person does gets past it. */
+  | 'hostFinding'
+
+export type AgentSessionRefusalReasonWords =
+  /** The code's own words are the honest ones for this reason. */
+  | { words: 'code'; action: AgentSessionRefusalAction }
+  /** What stopped the write, and the step past it where the person has one to take. */
+  | {
+      cause: AgentSessionWriteNoticeSentence
+      step?: AgentSessionWriteNoticeSentence
+      action: AgentSessionRefusalAction
+    }
+  /** A start that failed: the sentence that failure has everywhere, whose next step is a send. */
+  | { fact: AgentSessionFailureKind; action: AgentSessionRefusalAction }
+
+type AgentSessionRefusalCauseWords = Extract<AgentSessionRefusalReasonWords, { cause: unknown }>
+
+function codeWords(action: AgentSessionRefusalAction): AgentSessionRefusalReasonWords {
+  return { words: 'code', action }
+}
+
+function causeWords(
+  cause: AgentSessionWriteNoticeSentence,
+  action: AgentSessionRefusalAction,
+  step?: AgentSessionWriteNoticeSentence
+): AgentSessionRefusalReasonWords {
+  return step ? { cause, step, action } : { cause, action }
+}
+
+const AGENT_STARTING = causeWords('agentStarting', 'wait', 'waitForStart')
+const OWNER_UNPROVEN = causeWords('ownerUnproven', 'actFirst', 'reopenChat')
+// Only a terminal agent an older build recorded holds a claim; quitting it frees the chat.
+const TERMINAL_CLAIM = causeWords('terminalAgentHoldsChat', 'actFirst', 'quitTerminalAgent')
+
+// Every reason of every code, so a reason the host adds does not compile until it has words.
+// Reasons only a create, attach, hold or adopted import meets never reach a chat write; they keep
+// their code's words.
+const REASON_WORDS = {
+  agent_session_operation_invalid: {
+    requestMalformed: codeWords('hostFinding'),
+    operationIdInvalid: codeWords('hostFinding'),
+    messageIdReused: codeWords('hostFinding'),
+    // Settled under that id, so the control's retry goes out under a new one.
+    operationRefusedEarlier: codeWords('retry'),
+    journalWriteFailed: causeWords('recordFailed', 'retry'),
+    conversationCleared: causeWords(
+      'conversationCleared',
+      'goElsewhere',
+      'openCurrentConversation'
+    ),
+    // Nothing settles an unfinished /clear yet, so only a new chat continues.
+    clearUnconfirmed: causeWords('clearUnfinished', 'goElsewhere', 'startNewChat'),
+    // A /clear or /compact whose outcome the host never settled; only the host resolves it.
+    conversationCommandUnconfirmed: codeWords('hostFinding'),
+    conversationCommandInFlight: causeWords('commandRunning', 'wait', 'waitForCommand'),
+    // The chat's agent process is being replaced, which a start or restart does.
+    handoffInFlight: AGENT_STARTING,
+    turnActive: causeWords('turnActive', 'wait', 'waitForTurn'),
+    promptPending: causeWords('promptPending', 'actFirst', 'answerFirst'),
+    backgroundTasksRunning: causeWords('backgroundTasksRunning', 'wait', 'waitForBackgroundTasks'),
+    messagesUnsettled: causeWords('messagesUnsettled', 'actFirst', 'settleEarlierMessage'),
+    // No chat surface sends a rewind; a replayed one says only that it did not happen.
+    rewindRefused: codeWords('hostFinding'),
+    rewindUnconfirmed: codeWords('hostFinding'),
+    promptGone: causeWords('questionChanged', 'nothingLeft'),
+    optionRejected: causeWords('optionRejected', 'retry'),
+    providerStarting: AGENT_STARTING,
+    goalsUnsupported: causeWords('goalsUnsupported', 'hostFinding'),
+    providerRejected: causeWords('agentRefused', 'retry'),
+    providerStartFailed: { fact: 'providerStartFailed', action: 'retry' },
+    notSignedIn: { fact: 'notSignedIn', action: 'actFirst' },
+    historyTooLarge: { fact: 'historyTooLarge', action: 'goElsewhere' },
+    managedAccountEnvOverride: { fact: 'managedAccountEnvOverride', action: 'actFirst' },
+    accountSwitchInProgress: { fact: 'accountSwitchInProgress', action: 'wait' },
+    managedAccountUnsupported: { fact: 'managedAccountUnsupported', action: 'actFirst' },
+    attachFailed: codeWords('retry')
+  },
+  agent_session_ownership_unknown: {
+    sessionNotAttached: codeWords('retry'),
+    noLiveOwner: codeWords('retry'),
+    ownerUnproven: OWNER_UNPROVEN,
+    claimConflicted: TERMINAL_CLAIM,
+    recordMissing: codeWords('retry'),
+    replaySuperseded: codeWords('retry'),
+    leaseMoved: codeWords('retry'),
+    spawnIdentityMismatch: codeWords('hostFinding'),
+    notResumable: codeWords('retry'),
+    noProviderChild: codeWords('retry'),
+    conversationHeldElsewhere: codeWords('retry')
+  },
+  agent_session_conflict: {
+    chatStarting: AGENT_STARTING,
+    ownerUnproven: OWNER_UNPROVEN,
+    claimConflicted: TERMINAL_CLAIM,
+    ownerAlive: codeWords('retry'),
+    identityMismatch: codeWords('hostFinding'),
+    sessionExists: codeWords('retry'),
+    conversationHeldElsewhere: codeWords('retry'),
+    tabIdTaken: codeWords('retry')
+  },
+  execution_owner_reconciling: {
+    hostReconciling: causeWords('hostReconciling', 'wait', 'waitMoment'),
+    recordUnreadable: causeWords('recordUnreadable', 'hostFinding')
+  },
+  agent_session_checkpoint_stale: {
+    fenceStale: codeWords('retry'),
+    leaseMoved: codeWords('retry'),
+    recordMissing: codeWords('retry')
+  },
+  agent_session_identity_required: {
+    recordMissing: causeWords('chatNotFound', 'goElsewhere', 'startNewChat'),
+    transcriptNotFound: codeWords('retry'),
+    transcriptUnreadable: codeWords('hostFinding')
+  },
+  agent_session_operation_conflict: {
+    fingerprintMismatch: codeWords('hostFinding'),
+    operationIdReused: codeWords('hostFinding'),
+    handoffInFlight: codeWords('retry')
+  },
+  agent_session_operation_expired: { operationExpired: codeWords('retry') },
+  agent_session_operation_capacity: { operationCapacity: codeWords('wait') },
+  agent_session_operation_unknown: {
+    outcomeUnknown: codeWords('checkChat'),
+    resultLost: codeWords('checkChat'),
+    rewindUnconfirmed: codeWords('checkChat'),
+    tabUnconfirmed: codeWords('checkChat')
+  },
+  agent_session_item_revision_stale: { promptMoved: codeWords('nothingLeft') },
+  agent_session_already_resolved: { promptAlreadyResolved: codeWords('nothingLeft') },
+  agent_session_journal_unreadable: {
+    // No retry reads past damage, and the words name no step: it only can't load.
+    journalCorrupt: causeWords('historyUnusable', 'hostFinding'),
+    // Says its step despite 'retry': released clients and the phone often show no Retry here.
+    journalUnavailable: causeWords('historyUnavailable', 'retry', 'tryAgain')
+  },
+  // Thrown, so a client meets these only as an RPC error; the code's words stand.
+  structured_agent_session_unsupported: {
+    clientCapabilityMissing: codeWords('updateOrca'),
+    hostDisabled: codeWords('hostFinding'),
+    hostUnsupported: codeWords('updateOrca')
+  },
+  agent_session_owner_restart_failed: {}
+} satisfies {
+  [C in AgentSessionWireRefusalCode]: Record<
+    AgentSessionRefusalReason<C>,
+    AgentSessionRefusalReasonWords
+  >
+}
+
+/** The words and next step a reason gets; undefined when the refusal names none. */
+export function agentSessionRefusalReasonWords(
+  failure: AgentSessionWriteRefusal
+): AgentSessionRefusalReasonWords | undefined {
+  const reason = failure.details?.reason
+  const byReason: Partial<Record<string, AgentSessionRefusalReasonWords>> | undefined =
+    REASON_WORDS[failure.code]
+  return reason === undefined ? undefined : byReason?.[reason]
+}
+
+// Each already says the history was not read.
+const HISTORY_CAUSES: ReadonlySet<AgentSessionWriteNoticeSentence> = new Set([
+  'historyUnusable',
+  'historyUnavailable',
+  'historyUnreadable'
+])
+
+/** A cause, and that the request did not happen unless the cause already says so. */
+function causeParts(
+  cause: AgentSessionWriteNoticeSentence,
+  write: AgentSessionWriteKind
+): AgentSessionWriteNoticeSentence[] {
+  const saysNotDone =
+    (write === 'read-history' && HISTORY_CAUSES.has(cause)) ||
+    (cause === 'questionChanged' && write === 'answer')
+  return saysNotDone ? [cause] : [cause, NOT_DONE[write]]
+}
+
+function causeWordsParts(
+  words: AgentSessionRefusalCauseWords,
+  write: AgentSessionWriteKind
+): AgentSessionWriteNoticeSentence[] {
+  const said = causeParts(words.cause, write)
+  return words.step ? [...said, words.step] : said
+}
+
+/** The notice a named reason has of its own; undefined leaves the code's words. */
+function reasonParts(
+  failure: AgentSessionWriteRefusal,
+  write: AgentSessionWriteKind
+): AgentSessionWriteNoticePart[] | undefined {
+  const words = agentSessionRefusalReasonWords(failure)
+  if (!words || 'words' in words) {
+    return undefined
+  }
+  if ('fact' in words) {
+    return write === 'send' || write === 'composer-send'
+      ? [NOT_DONE[write], { text: agentSessionFailureSentence({ kind: words.fact }, 'rejection') }]
+      : undefined
+  }
+  return causeWordsParts(words, write)
+}
+
+export function agentSessionWriteNoticeParts(
+  failure: AgentSessionWriteFailure,
+  write: AgentSessionWriteKind
+): AgentSessionWriteNoticePart[] {
+  const notDone = NOT_DONE[write]
+  if (failure.kind === 'failed') {
+    return agentSessionWriteNotDoneParts(write)
+  }
+  if (failure.kind === 'unconfirmed') {
+    return ['outcomeUnknown']
+  }
+  const byReason = reasonParts(failure, write)
+  if (byReason) {
+    return byReason
+  }
+  switch (failure.code) {
+    // The cause is in the chat's own status row. Some restarts can be retried and some need a new
+    // chat, and the code does not say which.
+    case 'agent_session_owner_restart_failed':
+      return ['restartFailed', notDone]
+    // Several different owner states share these codes. Each is refused before the id is recorded,
+    // so the phone's resend under the same id can go through.
+    case 'agent_session_checkpoint_stale':
+    case 'agent_session_conflict':
+    case 'agent_session_ownership_unknown':
+    case 'execution_owner_reconciling':
+      return agentSessionWriteNotDoneParts(write)
+    // Counted across every chat and freed only as a day's requests age out, so trying again now
+    // would likely be refused again.
+    case 'agent_session_operation_capacity':
+      return ['capacity', notDone]
+    // The phone resends under the same id, which the host refuses the same way again. The rest
+    // stand for reasons the code does not name (a cleared conversation, a pending question, a
+    // provider's own rejection...), so any cause or next step could be false.
+    case 'agent_session_operation_conflict':
+    case 'agent_session_operation_expired':
+    case 'agent_session_operation_invalid':
+    case 'agent_session_identity_required':
+      return [notDone]
+    case 'agent_session_operation_unknown':
+      return ['outcomeUnknown']
+    // A Stop names the prompt it was pressed under, so it can be refused this way too.
+    case 'agent_session_item_revision_stale':
+    case 'agent_session_already_resolved':
+      return causeParts('questionChanged', write)
+    // A host that names no reason raised it for damage and for an open that can clear alike.
+    case 'agent_session_journal_unreadable':
+      return causeParts('historyUnreadable', write)
+    case 'structured_agent_session_unsupported':
+      return ['unsupported']
+  }
+  // A newer host can send a code this client has never heard of.
+  return [notDone]
+}
+
+export function agentSessionWriteNoticeEnglish(
+  parts: readonly AgentSessionWriteNoticePart[]
+): string {
+  return parts
+    .map((part) => (typeof part === 'string' ? AGENT_SESSION_WRITE_NOTICE_COPY[part] : part.text))
+    .join(' ')
+}
+
+/** English, for a surface without translations. Takes the refusal as the wire gives it; its
+ *  message is not read. */
+export function agentSessionRefusalNotice(
+  refusal: Pick<AgentSessionWireRefusal, 'code' | 'message' | 'details'>,
+  write: AgentSessionWriteKind
+): string {
+  return agentSessionWriteNoticeEnglish(
+    agentSessionWriteNoticeParts(agentSessionRefusalFailure(refusal), write)
+  )
+}
+
+/** English, for a write whose request failed without a refusal. */
+export function agentSessionWriteFailureNotice(write: AgentSessionWriteKind): string {
+  return agentSessionWriteNoticeEnglish(agentSessionWriteNoticeParts({ kind: 'failed' }, write))
+}
+
+/** The notice for a refused read of a chat's history, from the refusal's code and any details a
+ *  host sent; a code this build does not know says only that the history did not load. */
+export function agentSessionReadHistoryRefusalParts(
+  code: string,
+  details?: unknown
+): AgentSessionWriteNoticePart[] {
+  const failure = parseAgentSessionWriteFailure({ kind: 'refused', code, details })
+  return failure
+    ? agentSessionWriteNoticeParts(failure, 'read-history')
+    : agentSessionWriteNotDoneParts('read-history')
+}
diff --git a/src/shared/agent-session-refusal-retry.test.ts b/src/shared/agent-session-refusal-retry.test.ts
new file mode 100644
index 000000000000..30a9a177f8e5
--- /dev/null
+++ b/src/shared/agent-session-refusal-retry.test.ts
@@ -0,0 +1,104 @@
+import { describe, expect, it } from 'vitest'
+import type { AgentSessionOwnerVerdict } from './agent-session-wire'
+import { agentSessionOwnerVerdictAllowsFreshOperationId } from './agent-session-refusal-retry'
+import { parseAgentSessionWriteFailure } from './agent-session-write-failure'
+import {
+  admitStructuredAgentSessionOutboxEntry,
+  createStructuredAgentSessionOutboxEntry,
+  requeueStructuredAgentSessionSendRefusal
+} from './structured-agent-session-outbox'
+import { disposeStructuredAgentSessionSendResult } from './structured-agent-session-send-disposition'
+
+const entry = createStructuredAgentSessionOutboxEntry({
+  clientMessageId: 'message-1',
+  sessionId: 'session-1',
+  text: 'hello',
+  attachments: [],
+  queuedAt: 1
+})
+
+/** A refused send as a reloaded entry holds it: through the saved shape and back. */
+function storedOwnershipRefusal(ownerVerdict: AgentSessionOwnerVerdict | undefined) {
+  const failure = parseAgentSessionWriteFailure(
+    JSON.parse(
+      JSON.stringify({
+        kind: 'refused',
+        code: 'agent_session_ownership_unknown',
+        details: { reason: 'ownerUnproven', ...(ownerVerdict ? { ownerVerdict } : {}) }
+      })
+    )
+  )
+  if (failure?.kind !== 'refused') {
+    throw new Error('the saved refusal did not read back')
+  }
+  return failure
+}
+
+function retried(ownerVerdict: AgentSessionOwnerVerdict | undefined) {
+  return requeueStructuredAgentSessionSendRefusal(
+    entry,
+    storedOwnershipRefusal(ownerVerdict),
+    () => 'message-2'
+  )
+}
+
+describe("the owner's verdict decides a retry's operation id only as a floor", () => {
+  it('lets a retry use a new id once the stored verdict proves nothing runs', () => {
+    expect(agentSessionOwnerVerdictAllowsFreshOperationId('exited')).toBe(true)
+    // A new id only: nothing recorded the message, so it stays queued at the head.
+    expect(retried('exited')).toMatchObject({ clientMessageId: 'message-2', state: 'queued' })
+  })
+
+  it('keeps later sends behind the message after an exited refusal', () => {
+    const later = createStructuredAgentSessionOutboxEntry({
+      clientMessageId: 'message-3',
+      sessionId: 'session-1',
+      text: 'after',
+      attachments: [],
+      queuedAt: 2
+    })
+    const disposition = disposeStructuredAgentSessionSendResult({
+      entries: [entry, later],
+      entry,
+      blockedClientMessageId: null,
+      result: {
+        ok: false,
+        refusal: {
+          code: 'agent_session_ownership_unknown',
+          message: 'x',
+          details: { reason: 'ownerUnproven', ownerVerdict: 'exited' }
+        }
+      },
+      createOperationId: () => 'message-2'
+    })
+    expect(disposition.blockedClientMessageId).toBe('message-2')
+    expect(
+      admitStructuredAgentSessionOutboxEntry(
+        disposition.entries,
+        disposition.blockedClientMessageId
+      )
+    ).toMatchObject({ state: 'blocked', entry: { clientMessageId: 'message-2' } })
+  })
+
+  it.each<AgentSessionOwnerVerdict | undefined>(['unverifiable', 'live', undefined])(
+    'keeps the id for a stored %s verdict, whose operation may still land',
+    (stored) => {
+      expect(agentSessionOwnerVerdictAllowsFreshOperationId(stored)).toBe(false)
+      expect(retried(stored)).toMatchObject({ clientMessageId: 'message-1', state: 'queued' })
+    }
+  )
+
+  it.each<AgentSessionOwnerVerdict | undefined>(['unverifiable', 'live', undefined])(
+    'moves off a stored %s verdict only when the current lease proves the owner exited',
+    (stored) => {
+      expect(agentSessionOwnerVerdictAllowsFreshOperationId(stored, 'exited')).toBe(true)
+      expect(agentSessionOwnerVerdictAllowsFreshOperationId(stored, 'unverifiable')).toBe(false)
+      expect(agentSessionOwnerVerdictAllowsFreshOperationId(stored, 'live')).toBe(false)
+    }
+  )
+
+  it('never lowers a stored exited', () => {
+    expect(agentSessionOwnerVerdictAllowsFreshOperationId('exited', 'live')).toBe(true)
+    expect(agentSessionOwnerVerdictAllowsFreshOperationId('exited', 'unverifiable')).toBe(true)
+  })
+})
diff --git a/src/shared/agent-session-refusal-retry.ts b/src/shared/agent-session-refusal-retry.ts
index 9777cfd42d1e..093d3549729a 100644
--- a/src/shared/agent-session-refusal-retry.ts
+++ b/src/shared/agent-session-refusal-retry.ts
@@ -1,4 +1,4 @@
-import type { AgentSessionWireRefusalCode } from './agent-session-wire'
+import type { AgentSessionOwnerVerdict, AgentSessionWireRefusalCode } from './agent-session-wire'
 
 export type AgentSessionRefusalOperationState = 'settled-rejected' | 'pending-admission' | 'unknown'
 
@@ -28,3 +28,16 @@ export function agentSessionRefusalOperationState(
       return 'pending-admission'
   }
 }
+
+/**
+ * Whether a verdict lets a retry use a new operation id. A stored `exited` is final: nothing runs
+ * the refused operation, so a new id cannot collide with it. Any other stored verdict is a floor:
+ * the first operation may still land, so only a verdict re-derived from the current lease can prove
+ * `exited`, and nothing lowers a stored `exited`.
+ */
+export function agentSessionOwnerVerdictAllowsFreshOperationId(
+  stored: AgentSessionOwnerVerdict | undefined,
+  current?: AgentSessionOwnerVerdict
+): boolean {
+  return stored === 'exited' || current === 'exited'
+}
diff --git a/src/shared/agent-session-resume-marker.ts b/src/shared/agent-session-resume-marker.ts
index 2c308ec998ec..3890bd8f81d3 100644
--- a/src/shared/agent-session-resume-marker.ts
+++ b/src/shared/agent-session-resume-marker.ts
@@ -6,8 +6,9 @@
 // the stop, because that fact exists only in memory at that moment — the provider rewrites the
 // journal in its own words on reattach.
 //
-// A marker has no expiry. It ends only by the user's own actions: a newer message in that chat, a
-// successful resume, a dismissal, or closing the chat — each of which deletes it.
+// A marker has no expiry. It ends when the chat's agent is started again other than by its own
+// continuation, or by a successful resume, a dismissal, or closing the chat — each of which
+// deletes it.
 
 import { z } from 'zod'
 import { AGENT_STATUS_STATES } from './agent-status-types'
@@ -18,6 +19,7 @@ import {
   AGENT_SESSION_RESTART_ACTIVITY_MAX_TASKS
 } from './agent-session-restart-activity'
 import type { AgentSessionRestartActivity } from './agent-session-restart-activity'
+import type { AgentJournalCursor } from './agent-session-journal-types'
 
 /** Why the app went away. Recorded because an update install is a restart the user did not choose,
  *  and the surface that offers the resume says so. */
@@ -48,8 +50,9 @@ export type AgentSessionResumeMarker = {
   /** The work in flight when teardown observed it — a running turn, or a send that had not yet
    *  become one. */
   work: AgentSessionResumeWork
-  /** The user message observed at teardown; a newer one supersedes this offer before its turn opens. */
-  latestUserItemId: string | null
+  /** The user message observed at teardown. Nothing reads it; still written for one release so the
+   *  previous build, whose parser requires it, can read this marker after a downgrade. */
+  latestUserItemId?: string | null
   /** Execution host's clock at teardown. */
   recordedAt: number
   trigger: AgentSessionResumeTrigger
@@ -65,6 +68,12 @@ export type AgentSessionResumeMarker = {
   providerHandleRoot: string
   /** Stable teardown identity for continuation deduplication, not launch ancestry. */
   teardownId: string
+  /**
+   * Where the chat's journal stood when the offer was taken. A message accepted after it, or a
+   * journal on another epoch, means the chat moved on. Absent on markers from builds that did not
+   * record it.
+   */
+  journalCursor?: AgentJournalCursor
   /**
    * What the session was doing, captured at the same stop-time snapshot that decided the offer.
    * The dialog row, the status bar and the wire candidate read ONLY this; nothing re-reads the
@@ -114,11 +123,15 @@ const agentSessionRestartActivitySchema = z.object({
 const agentSessionResumeMarkerSchema = z.object({
   sessionId: markerField,
   work: agentSessionResumeWorkSchema,
-  latestUserItemId: markerField.nullable(),
+  latestUserItemId: markerField.nullable().optional(),
   recordedAt: z.number().int().nonnegative(),
   trigger: z.enum(AGENT_SESSION_RESUME_TRIGGERS),
   providerHandleRoot: markerField,
   teardownId: markerField,
+  journalCursor: z
+    .object({ epoch: markerField, sequence: z.number().int().nonnegative() })
+    .optional()
+    .catch(undefined),
   activity: agentSessionRestartActivitySchema.optional().catch(undefined)
 })
 
@@ -129,6 +142,10 @@ export function parseAgentSessionResumeMarker(value: unknown): AgentSessionResum
   if (!parsed.success) {
     return null
   }
-  const { activity, ...marker } = parsed.data
-  return activity === undefined ? marker : { ...marker, activity }
+  const { activity, journalCursor, ...marker } = parsed.data
+  return {
+    ...marker,
+    ...(journalCursor === undefined ? {} : { journalCursor }),
+    ...(activity === undefined ? {} : { activity })
+  }
 }
diff --git a/src/shared/agent-session-resume.ts b/src/shared/agent-session-resume.ts
index 89bef799a22c..4cbc240c7641 100644
--- a/src/shared/agent-session-resume.ts
+++ b/src/shared/agent-session-resume.ts
@@ -1,10 +1,12 @@
 import type { AgentHookSource } from './agent-hook-relay'
 import type { AgentStatusState } from './agent-status-types'
+import type { AgentMainAgentStatus } from './main-agent-status'
 import type { TuiAgent } from './tui-agent'
 
 export const RESUMABLE_TUI_AGENTS = [
   'claude',
   'codex',
+  'qoder',
   'gemini',
   'antigravity',
   'opencode',
@@ -19,7 +21,8 @@ export const RESUMABLE_TUI_AGENTS = [
   'copilot',
   'kimi',
   'muse',
-  'zcode'
+  'zcode',
+  'dsh'
 ] as const satisfies readonly TuiAgent[]
 
 export type ResumableTuiAgent = (typeof RESUMABLE_TUI_AGENTS)[number]
@@ -58,6 +61,9 @@ export type SleepingAgentSessionRecord = {
   terminalTitle?: string
   lastAssistantMessage?: string
   interrupted?: boolean
+  /** The main agent's own status when captured, copied with `interrupted` by `agentVerdictFields`;
+   *  read the verdict through `agentMainAgentVerdict`. */
+  mainAgent?: AgentMainAgentStatus
   connectionId?: string | null
   launchConfig?: SleepingAgentLaunchConfig
   /** How the record was captured. Worktree-sleep records (legacy records have
@@ -189,6 +195,7 @@ export function extractAgentProviderSession(
     // Native-chat agents: also capture the hook's authoritative transcript_path,
     // since recent Claude Code names the transcript file with a UUID that differs
     // from the hook session_id (so the id-based glob no longer finds it).
+    case 'qoder':
     case 'claude':
     case 'codex': {
       const id = readSessionId(payload, ['session_id'])
@@ -212,6 +219,12 @@ export function extractAgentProviderSession(
       const id = readSessionId(payload, ['session_id'])
       return id ? { key: 'session_id', id } : null
     }
+    // Why: DSH's hook bridge always sends an empty `transcript_path` (its persistence seam
+    // exposes no artifact path), so the session id alone carries the resume target.
+    case 'dsh': {
+      const id = readSessionId(payload, ['session_id'])
+      return id ? { key: 'session_id', id } : null
+    }
     case 'antigravity': {
       const id = readSessionId(payload, ['conversationId'])
       return id ? { key: 'conversation_id', id } : null
@@ -268,6 +281,8 @@ export function getAgentResumeArgv(
       return providerSession.key === 'session_id' ? ['claude', '--resume', id] : null
     case 'codex':
       return providerSession.key === 'session_id' ? ['codex', 'resume', id] : null
+    case 'qoder':
+      return providerSession.key === 'session_id' ? ['qodercli', '--resume', id] : null
     case 'gemini':
       return providerSession.key === 'session_id' ? ['gemini', '--resume', id] : null
     case 'antigravity':
@@ -314,5 +329,9 @@ export function getAgentResumeArgv(
       return providerSession.key === 'session_id' ? ['muse', 'resume', id] : null
     case 'zcode':
       return providerSession.key === 'session_id' ? ['zcode', '--resume', id] : null
+    // Why: `dsh-tui --resume <id>` re-enters the session the launcher recorded for this
+    // workspace. DSH keys sessions by workspace path, so callers must keep the cwd.
+    case 'dsh':
+      return providerSession.key === 'session_id' ? ['dsh-tui', '--resume', id] : null
   }
 }
diff --git a/src/shared/agent-session-wire-refusals.test.ts b/src/shared/agent-session-wire-refusals.test.ts
new file mode 100644
index 000000000000..af017a617e74
--- /dev/null
+++ b/src/shared/agent-session-wire-refusals.test.ts
@@ -0,0 +1,218 @@
+import { describe, expect, it } from 'vitest'
+import {
+  AGENT_SESSION_REFUSAL_REASONS,
+  readAgentSessionRefusalDetails
+} from './agent-session-refusal-details'
+import {
+  AGENT_SESSION_WIRE_REFUSAL_CODES,
+  agentSessionRefusalError,
+  agentSessionRefusalReference,
+  readAgentSessionRefusalReference,
+  refuse,
+  refuseUnclassified,
+  withAgentSessionRefusalFacts,
+  type AgentSessionWireRefusal
+} from './agent-session-wire-refusals'
+import type { AgentJournalResolution } from './agent-session-journal-types'
+
+const RESOLUTION: AgentJournalResolution = {
+  state: 'resolved',
+  selectedOptionId: 'allow',
+  resolvedBy: 'phone-1',
+  resolvedAt: 1_789_000_000_000
+}
+
+/** The refusal with its new field removed: exactly what a released client reads. */
+function asReleasedClientSeesIt(refusal: AgentSessionWireRefusal): unknown {
+  const { details: _details, ...rest } = JSON.parse(JSON.stringify(refusal))
+  return rest
+}
+
+describe('a refusal names only a reason its code lists', () => {
+  it('rejects a reason another code lists, at compile time', () => {
+    // @ts-expect-error `promptGone` is an operation_invalid reason, not a conflict one.
+    refuse('agent_session_conflict', { reason: 'promptGone' }, 'm')
+    // @ts-expect-error the thrown form is held to the same list.
+    agentSessionRefusalError('agent_session_identity_required', { reason: 'claimConflicted' })
+    // @ts-expect-error a fact another code carries is not this code's.
+    refuse('agent_session_conflict', { reason: 'ownerAlive', currentFence: 3 }, 'm')
+    // @ts-expect-error the unclassified path cannot carry a reason.
+    refuseUnclassified('agent_session_conflict', 'm', { reason: 'claimConflicted' })
+    expect(refuse('agent_session_conflict', { reason: 'ownerAlive' }, 'm').details).toEqual({
+      reason: 'ownerAlive'
+    })
+  })
+
+  it('has no catch-all reason under any code', () => {
+    for (const code of AGENT_SESSION_WIRE_REFUSAL_CODES) {
+      for (const reason of AGENT_SESSION_REFUSAL_REASONS[code]) {
+        expect([code, reason]).not.toEqual([code, expect.stringMatching(/^(other|unknown)$/i)])
+        expect(reason).not.toMatch(/fault|generic|misc/i)
+      }
+    }
+  })
+})
+
+describe('the loose fields released clients read', () => {
+  it('are copied from details by refuse, one field at a time', () => {
+    expect(
+      refuse('agent_session_checkpoint_stale', { reason: 'fenceStale', currentFence: 4 }, 'm')
+    ).toMatchObject({ currentFence: 4 })
+    expect(
+      refuse(
+        'agent_session_item_revision_stale',
+        { reason: 'promptMoved', currentRevision: 2, resolution: RESOLUTION },
+        'm'
+      )
+    ).toMatchObject({ currentRevision: 2, resolution: RESOLUTION })
+    expect(
+      refuse(
+        'agent_session_operation_invalid',
+        { reason: 'rewindRefused', rewindReason: 'busy' },
+        'm'
+      )
+    ).toMatchObject({ rewindReason: 'busy' })
+    expect(
+      refuse(
+        'agent_session_ownership_unknown',
+        { reason: 'ownerUnproven', ownerVerdict: 'exited' },
+        'm'
+      )
+    ).toMatchObject({ ownerVerdict: 'exited' })
+    expect(
+      refuseUnclassified('agent_session_checkpoint_stale', 'm', { currentFence: 9 })
+    ).toMatchObject({ currentFence: 9, details: { currentFence: 9 } })
+  })
+
+  it('gain a verdict learned after the refusal, in details and at the top level', () => {
+    const stamped = withAgentSessionRefusalFacts(
+      refuse('agent_session_operation_invalid', { reason: 'providerStartFailed' }, 'm'),
+      { ownerVerdict: 'exited' }
+    )
+    expect(stamped).toEqual({
+      code: 'agent_session_operation_invalid',
+      message: 'm',
+      details: { reason: 'providerStartFailed', ownerVerdict: 'exited' },
+      ownerVerdict: 'exited'
+    })
+    // A refusal an older row replayed, with no reason, still reaches released clients with it.
+    expect(
+      withAgentSessionRefusalFacts(refuseUnclassified('agent_session_conflict', 'm'), {
+        ownerVerdict: 'unverifiable'
+      })
+    ).toEqual({
+      code: 'agent_session_conflict',
+      message: 'm',
+      details: { ownerVerdict: 'unverifiable' },
+      ownerVerdict: 'unverifiable'
+    })
+  })
+
+  // Each expected value is the literal the host built for the same situation before details.
+  it.each([
+    [
+      'a moved prompt',
+      refuse(
+        'agent_session_item_revision_stale',
+        { reason: 'promptMoved', currentRevision: 2, resolution: RESOLUTION },
+        'Item i has moved on.'
+      ),
+      {
+        code: 'agent_session_item_revision_stale',
+        message: 'Item i has moved on.',
+        currentRevision: 2,
+        resolution: RESOLUTION
+      }
+    ],
+    [
+      'a resolved prompt',
+      refuse(
+        'agent_session_already_resolved',
+        { reason: 'promptAlreadyResolved', currentRevision: 2, resolution: RESOLUTION },
+        'Item i was already resolved.'
+      ),
+      {
+        code: 'agent_session_already_resolved',
+        message: 'Item i was already resolved.',
+        currentRevision: 2,
+        resolution: RESOLUTION
+      }
+    ],
+    [
+      'a stale fence',
+      refuse('agent_session_checkpoint_stale', { reason: 'fenceStale', currentFence: 4 }, 'm'),
+      { code: 'agent_session_checkpoint_stale', message: 'm', currentFence: 4 }
+    ],
+    [
+      'a refused rewind',
+      refuse(
+        'agent_session_operation_invalid',
+        { reason: 'rewindRefused', rewindReason: 'busy' },
+        'agent_session_rewind:busy'
+      ),
+      {
+        code: 'agent_session_operation_invalid',
+        message: 'agent_session_rewind:busy',
+        rewindReason: 'busy'
+      }
+    ],
+    [
+      'a failed create',
+      withAgentSessionRefusalFacts(
+        refuse('agent_session_operation_invalid', { reason: 'providerStartFailed' }, 'exited 1'),
+        { ownerVerdict: 'exited' }
+      ),
+      { code: 'agent_session_operation_invalid', message: 'exited 1', ownerVerdict: 'exited' }
+    ],
+    [
+      'a refusal with no facts',
+      refuse('agent_session_conflict', { reason: 'claimConflicted' }, 'm'),
+      { code: 'agent_session_conflict', message: 'm' }
+    ]
+  ] as const)('read by a released client exactly as before for %s', (_label, refusal, before) => {
+    expect(asReleasedClientSeesIt(refusal)).toEqual(before)
+  })
+})
+
+describe('a stored refusal read back', () => {
+  it('keeps what the code lists and drops the rest', () => {
+    expect(
+      readAgentSessionRefusalDetails('agent_session_checkpoint_stale', {
+        reason: 'fenceStale',
+        currentFence: 3,
+        currentRevision: 8,
+        cause: 'fenceStale'
+      })
+    ).toEqual({ reason: 'fenceStale', currentFence: 3 })
+    // A reason a newer host added reads as none, but the facts beside it still count.
+    expect(
+      readAgentSessionRefusalDetails('agent_session_checkpoint_stale', {
+        reason: 'futureReason',
+        currentFence: 3
+      })
+    ).toEqual({ currentFence: 3 })
+    expect(readAgentSessionRefusalDetails('agent_session_conflict', { reason: 'x' })).toBe(
+      undefined
+    )
+  })
+
+  it('round-trips through its reference, and reads an older shape as naming nothing', () => {
+    const refusal = refuse(
+      'agent_session_ownership_unknown',
+      { reason: 'noLiveOwner', ownerVerdict: 'live' },
+      'm'
+    )
+    const reference = agentSessionRefusalReference(refusal)
+    expect(reference).toEqual({
+      code: 'agent_session_ownership_unknown',
+      details: { reason: 'noLiveOwner', ownerVerdict: 'live' }
+    })
+    expect(readAgentSessionRefusalReference(JSON.parse(JSON.stringify(reference)))).toEqual(
+      reference
+    )
+    expect(
+      readAgentSessionRefusalReference({ code: 'agent_session_conflict', cause: 'claimConflicted' })
+    ).toEqual({ code: 'agent_session_conflict' })
+    expect(readAgentSessionRefusalReference({ code: 'agent_session_future' })).toBeUndefined()
+  })
+})
diff --git a/src/shared/agent-session-wire-refusals.ts b/src/shared/agent-session-wire-refusals.ts
index 12cd63d44904..8fd1602377b5 100644
--- a/src/shared/agent-session-wire-refusals.ts
+++ b/src/shared/agent-session-wire-refusals.ts
@@ -1,8 +1,24 @@
 // How the host declines an `agentSession.*` mutation: the closed code list, its
 // narrowing guard, and the refusal body a client reads.
 
-import type { AgentJournalResolution } from './agent-session-journal-types'
-import type { AgentSessionRewindReason } from './agent-session-rewind'
+import {
+  agentSessionLegacyRefusalFields,
+  readAgentSessionRefusalDetails,
+  type AgentSessionAnyRefusalDetails,
+  type AgentSessionLegacyRefusalFields,
+  type AgentSessionRefusalDetails,
+  type AgentSessionRefusalDetailsByCode,
+  type AgentSessionRefusalFacts
+} from './agent-session-refusal-details'
+
+export type {
+  AgentSessionAnyRefusalDetails,
+  AgentSessionAnyRefusalReason,
+  AgentSessionLegacyRefusalFields,
+  AgentSessionRefusalDetails,
+  AgentSessionRefusalDetailsByCode,
+  AgentSessionRefusalReason
+} from './agent-session-refusal-details'
 
 export const AGENT_SESSION_WIRE_REFUSAL_CODES = [
   'structured_agent_session_unsupported',
@@ -38,17 +54,140 @@ export function isAgentSessionWireRefusalCode(
 /** What the host last proved about a session's provider process; see the SSH execution boundary. */
 export type AgentSessionOwnerVerdict = 'live' | 'unverifiable' | 'exited'
 
-export type AgentSessionWireRefusal = {
-  rewindReason?: AgentSessionRewindReason
-  code: AgentSessionWireRefusalCode
+/** One variant per code, so a refusal's details can only be that code's. */
+export type AgentSessionRefusalOf<C extends AgentSessionWireRefusalCode> = {
+  [K in C]: {
+    code: K
+    /** For logs and released clients, which print it; newer clients choose words from details. */
+    message: string
+    /** Absent from older hosts. */
+    details?: AgentSessionRefusalDetails<K>
+  } & AgentSessionLegacyRefusalFields
+}[C]
+
+export type AgentSessionWireRefusal = AgentSessionRefusalOf<AgentSessionWireRefusalCode>
+
+/** A refusal named without its prose: what a durable record or an error's data keeps. */
+export type AgentSessionRefusalReference = {
+  [K in AgentSessionWireRefusalCode]: { code: K; details?: AgentSessionRefusalDetails<K> }
+}[AgentSessionWireRefusalCode]
+
+function buildRefusal(
+  code: AgentSessionWireRefusalCode,
+  details: AgentSessionAnyRefusalDetails | undefined,
   message: string
-  /** On a stale fence, so the client can retry without another round trip. */
-  currentFence?: number
-  /** On a lost compare-and-set: the winning answer and who gave it. */
-  resolution?: AgentJournalResolution
-  /** On a lost compare-and-set: the revision the host actually holds. */
-  currentRevision?: number
-  /** On a durably failed create: `exited` proves nothing runs for the session, so a new
-   *  operation cannot collide with this one. Absent (older hosts) reads as unverifiable. */
-  ownerVerdict?: AgentSessionOwnerVerdict
+): AgentSessionWireRefusal {
+  const kept = details && Object.keys(details).length > 0 ? details : undefined
+  const refusal = {
+    code,
+    message,
+    ...(kept ? { details: kept } : {}),
+    ...agentSessionLegacyRefusalFields(kept)
+  }
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: every caller passes details typed for `code` (refuse and refuseUnclassified by their signatures, the reference by its own union).
+  return refusal as AgentSessionWireRefusal
+}
+
+/** A refusal built at its emitter. The reason must be one `code` lists; the legacy top-level fields
+ *  released clients read are copied from `details` here and nowhere else. */
+export function refuse<C extends AgentSessionWireRefusalCode>(
+  code: C,
+  details: NoInfer<AgentSessionRefusalDetailsByCode[C]>,
+  message: string
+): AgentSessionWireRefusal {
+  return buildRefusal(code, details, message)
+}
+
+/**
+ * A refusal whose situation this site cannot name: the code, and whatever facts it does know, with
+ * no reason, exactly as an older host sends it. The explicit path, so no emitter reaches for a
+ * catch-all reason instead.
+ */
+export function refuseUnclassified<C extends AgentSessionWireRefusalCode>(
+  code: C,
+  message: string,
+  facts?: NoInfer<AgentSessionRefusalFacts<C>>
+): AgentSessionWireRefusal {
+  return buildRefusal(code, facts, message)
+}
+
+/** A refusal rebuilt from what a record or a decision kept of it. */
+export function agentSessionRefusalFromReference(
+  reference: AgentSessionRefusalReference,
+  message: string
+): AgentSessionWireRefusal {
+  return buildRefusal(reference.code, reference.details, message)
+}
+
+/** The same refusal with more facts: a failed create's verdict, learned after the refusal was. */
+export function withAgentSessionRefusalFacts(
+  refusal: AgentSessionWireRefusal,
+  facts: { ownerVerdict: AgentSessionOwnerVerdict }
+): AgentSessionWireRefusal {
+  return buildRefusal(refusal.code, { ...refusal.details, ...facts }, refusal.message)
+}
+
+/** The refusal reduced to what may be stored or put in an error's data. */
+export function agentSessionRefusalReference(
+  refusal: AgentSessionWireRefusal
+): AgentSessionRefusalReference {
+  return buildReference(refusal.code, refusal.details)
+}
+
+/** A reference read back from a record another build may have written; details are checked
+ *  against the code, and anything else they held (an older build's `cause`) is dropped. */
+export function readAgentSessionRefusalReference(
+  value: unknown
+): AgentSessionRefusalReference | undefined {
+  if (
+    typeof value !== 'object' ||
+    value === null ||
+    !('code' in value) ||
+    !isAgentSessionWireRefusalCode(value.code)
+  ) {
+    return undefined
+  }
+  return buildReference(
+    value.code,
+    'details' in value ? readAgentSessionRefusalDetails(value.code, value.details) : undefined
+  )
+}
+
+function buildReference(
+  code: AgentSessionWireRefusalCode,
+  details: AgentSessionAnyRefusalDetails | undefined
+): AgentSessionRefusalReference {
+  const reference = { code, ...(details ? { details } : {}) }
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: `details` is the refusal's own, or was read against `code`.
+  return reference as AgentSessionRefusalReference
+}
+
+/**
+ * A refusal raised rather than returned. Its message is the bare code, exactly as the
+ * `Error(code)` it replaces: the RPC passthrough, the restart-resume ledger and released clients
+ * all read a thrown refusal's message as its code. The details ride on `refusal` and reach the
+ * client only in the RPC error's data. Deliberately no `code` property, so no `'code' in error`
+ * passthrough meant for another subsystem can claim it.
+ */
+export class AgentSessionRefusalError extends Error {
+  readonly refusal: AgentSessionWireRefusal
+
+  constructor(refusal: AgentSessionWireRefusal, options?: { cause?: unknown }) {
+    super(refusal.code, options)
+    this.name = 'AgentSessionRefusalError'
+    this.refusal = refusal
+  }
+}
+
+/** A store or host refusal thrown under its situation; the error's message stays the code. */
+export function agentSessionRefusalError<C extends AgentSessionWireRefusalCode>(
+  code: C,
+  details: NoInfer<AgentSessionRefusalDetailsByCode[C]>,
+  message: string = code
+): AgentSessionRefusalError {
+  return new AgentSessionRefusalError(refuse(code, details, message))
+}
+
+export function isAgentSessionRefusalError(error: unknown): error is AgentSessionRefusalError {
+  return error instanceof AgentSessionRefusalError
 }
diff --git a/src/shared/agent-session-wire.ts b/src/shared/agent-session-wire.ts
index 38849ab0f05c..445582c4ad31 100644
--- a/src/shared/agent-session-wire.ts
+++ b/src/shared/agent-session-wire.ts
@@ -223,7 +223,8 @@ export type AgentSessionStatusEvent =
 // ─── Turn completion feed ───────────────────────────────────────────────────
 
 /**
- * One root turn reaching a terminal outcome, derived by the EXECUTION HOST at journal commit.
+ * The session's latest request reaching a terminal outcome — a root turn, or a send the agent or
+ * its start refused — derived by the EXECUTION HOST at journal commit.
  *
  * This is the EDGE, with turn identity; `AgentSessionStatusSummary.turnOutcome` is the STATE.
  * The summary carries the verdict only while the session is idle, as a fact about the main agent's
@@ -239,11 +240,14 @@ export type AgentSessionTurnCompletion = {
   /** Host-and-workspace scope; a bare provider turn id is not globally unique. */
   scope: AgentSessionExecutionLocation
   sessionId: string
-  /** Root turn identity from the journal turn record; no second identity is minted. */
+  /** The request's identity: the root turn's id, or for a send refused before any turn, that
+   *  send's journal item key. Neither is minted here. */
   turnId: string
   outcome: AgentJournalTurnOutcome
   /** Execution host's clock at journal commit. */
   completedAt: number
+  /** The request settled while a prompt waits on the user. Absent otherwise, and from older hosts. */
+  awaitingUser?: true
 }
 
 /**
@@ -295,9 +299,9 @@ export type AgentSessionAttachResult = {
   sessionId: string
   fence: number
   page: AgentSessionHistoryPage
-  /** Submissions the crash boundary settled as `unknown` while attaching. */
+  /** Submissions a crash boundary left `unknown` that provider history could not decide. */
   unconfirmedClientMessageIds: string[]
-  /** The host-owned id of the tab that shows this chat. Absent from hosts that predate it. */
+  /** The host-owned id of the tab showing this chat, when it has one. Absent from older hosts. */
   tabId?: string
 }
 
diff --git a/src/shared/agent-session-write-failure.test.ts b/src/shared/agent-session-write-failure.test.ts
new file mode 100644
index 000000000000..83d8faea7901
--- /dev/null
+++ b/src/shared/agent-session-write-failure.test.ts
@@ -0,0 +1,124 @@
+import { describe, expect, it } from 'vitest'
+import {
+  agentSessionRefusalFailure,
+  parseAgentSessionWriteFailure
+} from './agent-session-write-failure'
+
+const HOST_TEXT = 'Expected runtime fence 1; the session is at 3.'
+
+function saved(value: unknown): unknown {
+  return JSON.parse(JSON.stringify(value))
+}
+
+describe('parseAgentSessionWriteFailure', () => {
+  // The shape saved before refusals carried a reason; it loads as it was and reads as its code.
+  it('reads back an entry saved with the code alone, unchanged', () => {
+    expect(
+      parseAgentSessionWriteFailure(saved({ kind: 'refused', code: 'agent_session_conflict' }))
+    ).toEqual({ kind: 'refused', code: 'agent_session_conflict' })
+    expect(parseAgentSessionWriteFailure({ kind: 'failed' })).toEqual({ kind: 'failed' })
+    expect(
+      parseAgentSessionWriteFailure({
+        kind: 'refused',
+        code: 'agent_session_conflict',
+        message: HOST_TEXT
+      })
+    ).toEqual({ kind: 'refused', code: 'agent_session_conflict' })
+  })
+
+  it.each([
+    [
+      'a reason',
+      { kind: 'refused', code: 'agent_session_conflict', details: { reason: 'chatStarting' } }
+    ],
+    [
+      "a rewind's reason",
+      {
+        kind: 'refused',
+        code: 'agent_session_operation_invalid',
+        details: { reason: 'rewindRefused', rewindReason: 'busy' }
+      }
+    ],
+    [
+      "the owner's verdict",
+      {
+        kind: 'refused',
+        code: 'agent_session_ownership_unknown',
+        details: { reason: 'ownerUnproven', ownerVerdict: 'exited' }
+      }
+    ]
+  ])('keeps %s', (_label, value) => {
+    expect(parseAgentSessionWriteFailure(saved(value))).toEqual(value)
+  })
+
+  // A newer build's reason or verdict is dropped, never guessed; the code's words stand.
+  it.each([
+    [{ reason: 'fromTheFuture' }, undefined],
+    [{ reason: 'fromTheFuture', ownerVerdict: 'exited' }, { ownerVerdict: 'exited' }],
+    [{ reason: 'ownerUnproven', ownerVerdict: 'gone' }, { reason: 'ownerUnproven' }],
+    [{ reason: 'chatStarting' }, undefined]
+  ])('drops what this build cannot place: %j', (details, kept) => {
+    expect(
+      parseAgentSessionWriteFailure({
+        kind: 'refused',
+        code: 'agent_session_ownership_unknown',
+        details
+      })
+    ).toEqual({
+      kind: 'refused',
+      code: 'agent_session_ownership_unknown',
+      ...(kept ? { details: kept } : {})
+    })
+  })
+
+  it.each([
+    null,
+    'The agent was restarting.',
+    { kind: 'refused' },
+    { kind: 'refused', code: 'agent_session_from_the_future' },
+    { kind: 'something-else' }
+  ])('drops %j instead of guessing', (value) => {
+    expect(parseAgentSessionWriteFailure(value)).toBeUndefined()
+  })
+})
+
+describe('agentSessionRefusalFailure', () => {
+  // What moves with the owner, the question's answer and the host's words are never kept.
+  it('keeps only the facts that stay true after a reload', () => {
+    expect(
+      agentSessionRefusalFailure({
+        code: 'agent_session_checkpoint_stale',
+        details: { reason: 'fenceStale', currentFence: 3, ownerVerdict: 'exited' }
+      })
+    ).toEqual({
+      kind: 'refused',
+      code: 'agent_session_checkpoint_stale',
+      details: { reason: 'fenceStale' }
+    })
+    // A prompt's revision and winning answer, and a provider's diagnostic, as a host may send them.
+    const answered = JSON.parse(
+      JSON.stringify({
+        code: 'agent_session_already_resolved',
+        details: {
+          reason: 'promptAlreadyResolved',
+          currentRevision: 2,
+          resolution: { state: 'answered', selectedOptionId: 'yes', resolvedBy: 'phone' },
+          detail: { text: 'stderr', audience: 'log' }
+        }
+      })
+    )
+    expect(agentSessionRefusalFailure(answered)).toEqual({
+      kind: 'refused',
+      code: 'agent_session_already_resolved',
+      details: { reason: 'promptAlreadyResolved' }
+    })
+  })
+
+  it('keeps a code from a newer host without reading its details', () => {
+    const refusal = JSON.parse('{"code":"agent_session_from_the_future","details":{"reason":"x"}}')
+    expect(agentSessionRefusalFailure(refusal)).toEqual({
+      kind: 'refused',
+      code: 'agent_session_from_the_future'
+    })
+  })
+})
diff --git a/src/shared/agent-session-write-failure.ts b/src/shared/agent-session-write-failure.ts
new file mode 100644
index 000000000000..dd5c8f26caa2
--- /dev/null
+++ b/src/shared/agent-session-write-failure.ts
@@ -0,0 +1,152 @@
+// A chat write that did not happen, as a fact: what the person was doing, and what the host said.
+// Saved with a queued message, so it holds only what stays true after a reload; the words are
+// chosen from it when it is shown (`agent-session-refusal-notice.ts`).
+
+import {
+  readAgentSessionRefusalDetails,
+  type AgentSessionRefusalReason
+} from './agent-session-refusal-details'
+import type { AgentSessionRewindReason } from './agent-session-rewind'
+import {
+  isAgentSessionWireRefusalCode,
+  type AgentSessionOwnerVerdict,
+  type AgentSessionWireRefusal,
+  type AgentSessionWireRefusalCode
+} from './agent-session-wire-refusals'
+
+/** What the person was doing, which decides what the notice says did not happen. `send` keeps
+ *  the message behind a Retry control; `composer-send` puts it back in the composer, as the phone
+ *  does. `read-history` is opening the chat to show its history, which writes nothing. */
+export type AgentSessionWriteKind =
+  | 'read-history'
+  | 'send'
+  | 'composer-send'
+  | 'stop'
+  | 'stop-task'
+  | 'stop-tasks'
+  | 'answer'
+  | 'option'
+  | 'command'
+  | 'goal'
+
+/** The kind of write an `agentSession.*` call stands for. */
+export function agentSessionWriteKindForMethod(
+  fingerprintMethod: string,
+  fields: Record<string, unknown>
+): AgentSessionWriteKind {
+  if (fingerprintMethod === 'agentSession.send') {
+    return 'send'
+  }
+  if (fingerprintMethod === 'agentSession.cancel') {
+    // A background-task stop never asked the agent to stop.
+    if (fields.scope !== 'background-tasks') {
+      return 'stop'
+    }
+    return typeof fields.taskId === 'string' ? 'stop-task' : 'stop-tasks'
+  }
+  if (fingerprintMethod.startsWith('agentSession.respondTo')) {
+    return 'answer'
+  }
+  if (fingerprintMethod === 'agentSession.setOption') {
+    return 'option'
+  }
+  if (fingerprintMethod === 'agentSession.threadGoal') {
+    return 'goal'
+  }
+  return 'command'
+}
+
+/** What a saved refusal keeps beside its reason: facts about the refused operation that stay true
+ *  after a reload. Never the fence, revision or resolution, which move, nor any provider text. */
+type DurableRefusalFacts = {
+  agent_session_operation_invalid: { rewindReason?: AgentSessionRewindReason }
+  agent_session_operation_unknown: { rewindReason?: AgentSessionRewindReason }
+  /** A snapshot from when it was refused; see `agentSessionOwnerVerdictAllowsFreshOperationId`. */
+  agent_session_ownership_unknown: { ownerVerdict?: AgentSessionOwnerVerdict }
+}
+
+const DURABLE_FACT_KEYS: Partial<Record<AgentSessionWireRefusalCode, readonly string[]>> = {
+  agent_session_operation_invalid: ['rewindReason'],
+  agent_session_operation_unknown: ['rewindReason'],
+  agent_session_ownership_unknown: ['ownerVerdict']
+} satisfies { [C in keyof DurableRefusalFacts]: readonly (keyof DurableRefusalFacts[C])[] }
+
+export type AgentSessionWriteRefusalDetails<C extends AgentSessionWireRefusalCode> = {
+  reason?: AgentSessionRefusalReason<C>
+} & (C extends keyof DurableRefusalFacts ? DurableRefusalFacts[C] : Record<never, never>)
+
+/** A refused write: its code, and what the host said about it that outlives the reply. */
+export type AgentSessionWriteRefusal = {
+  [C in AgentSessionWireRefusalCode]: {
+    kind: 'refused'
+    code: C
+    /** Absent from older hosts and from entries saved before refusals carried a reason. */
+    details?: AgentSessionWriteRefusalDetails<C>
+  }
+}[AgentSessionWireRefusalCode]
+
+/** Why a write did not happen, or that nothing proves it did not. */
+export type AgentSessionWriteFailure =
+  | AgentSessionWriteRefusal
+  /** The request failed without a refusal before the host ran it, so nothing is known about why. */
+  | { kind: 'failed' }
+  /** The request failed where the host may already have run it (a timeout, a lost connection, an
+   *  error inside the method). */
+  | { kind: 'unconfirmed' }
+
+/** The refusal as a write keeps it. Details are read against the code, so a reason or verdict
+ *  another build added is dropped and the code's own words stand. */
+function agentSessionWriteRefusal(
+  code: AgentSessionWireRefusalCode,
+  details: unknown
+): AgentSessionWriteRefusal {
+  const durable: readonly string[] = ['reason', ...(DURABLE_FACT_KEYS[code] ?? [])]
+  const kept = Object.fromEntries(
+    Object.entries(readAgentSessionRefusalDetails(code, details) ?? {}).filter(([key]) =>
+      durable.includes(key)
+    )
+  )
+  const refusal = {
+    kind: 'refused',
+    code,
+    ...(Object.keys(kept).length > 0 ? { details: kept } : {})
+  }
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: `kept` holds only a reason and facts read against `code` and allowed for it above.
+  return refusal as AgentSessionWriteRefusal
+}
+
+export function agentSessionRefusalFailure(
+  refusal: Pick<AgentSessionWireRefusal, 'code' | 'details'>
+): AgentSessionWriteRefusal {
+  // A newer host can send a code this client has never heard of; its details mean nothing here.
+  return isAgentSessionWireRefusalCode(refusal.code)
+    ? agentSessionWriteRefusal(refusal.code, refusal.details)
+    : { kind: 'refused', code: refusal.code }
+}
+
+/** A request that threw, from the RPC error code the host answered with (undefined when none came
+ *  back). Only a host that turned it away before running the method proves the write did not
+ *  happen. */
+export function agentSessionRpcErrorFailure(code: string | undefined): AgentSessionWriteFailure {
+  if (code === 'method_not_found' || code === 'method_not_supported') {
+    return { kind: 'refused', code: 'structured_agent_session_unsupported' }
+  }
+  return code === 'invalid_argument' || code === 'unauthorized'
+    ? { kind: 'refused', code: 'agent_session_operation_invalid' }
+    : { kind: 'unconfirmed' }
+}
+
+/** A saved failure, or undefined when it is not one this build wrote. */
+export function parseAgentSessionWriteFailure(
+  value: unknown
+): AgentSessionWriteFailure | undefined {
+  if (typeof value !== 'object' || value === null || !('kind' in value)) {
+    return undefined
+  }
+  if (value.kind === 'failed') {
+    return { kind: 'failed' }
+  }
+  return value.kind === 'refused' && 'code' in value && isAgentSessionWireRefusalCode(value.code)
+    ? agentSessionWriteRefusal(value.code, 'details' in value ? value.details : undefined)
+    : undefined
+}
diff --git a/src/shared/agent-session-write-notice-copy.ts b/src/shared/agent-session-write-notice-copy.ts
new file mode 100644
index 000000000000..d0c36e27a407
--- /dev/null
+++ b/src/shared/agent-session-write-notice-copy.ts
@@ -0,0 +1,64 @@
+// The sentences a chat notice is made of, each whole so desktop can translate it on its own.
+
+import {
+  QUIT_TERMINAL_AGENT,
+  START_NEW_CHAT,
+  TERMINAL_AGENT_HOLDS_CHAT
+} from './agent-session-failure-words'
+
+/** Every sentence a notice is made of. Desktop translates each whole sentence with this as its
+ *  fallback; mobile shows it as is. */
+export const AGENT_SESSION_WRITE_NOTICE_COPY = {
+  notDoneReadHistory: "This chat's history couldn't be loaded.",
+  notDoneSend: 'Your message was not sent.',
+  tryAgainComposerSend: 'Send it again.',
+  notDoneStop: "The agent wasn't stopped.",
+  notDoneStopTask: "The background task wasn't stopped.",
+  notDoneStopTasks: "The background tasks weren't stopped.",
+  notDoneAnswer: 'Your answer was not sent.',
+  notDoneOption: "The setting wasn't changed.",
+  notDoneCommand: "The command didn't run.",
+  notDoneGoal: "The goal wasn't changed.",
+  restartFailed: "The agent couldn't restart.",
+  capacity: 'Orca has received too many requests in the last day.',
+  outcomeUnknown: "Orca couldn't confirm what happened. Check the chat.",
+  questionChanged: 'This question was already answered or has changed.',
+  historyUnreadable: "Orca couldn't read this chat's saved history.",
+  historyUnusable: 'Unable to load this chat.',
+  historyUnavailable: "Orca couldn't open this chat's history right now.",
+  unsupported: "The Orca running this chat doesn't support this. Update Orca, then try again.",
+  unreachable: "Orca couldn't reach the agent.",
+  recordFailed: "Orca couldn't record it in this chat's history.",
+  conversationCleared: 'This conversation has been cleared.',
+  openCurrentConversation: 'Open the current conversation to continue.',
+  clearUnfinished: "The last /clear didn't finish.",
+  commandRunning: 'A /compact or /clear is still running.',
+  waitForCommand: 'Wait for the /compact or /clear to finish.',
+  agentStarting: 'The agent is still starting.',
+  waitForStart: 'Wait for the agent to finish starting.',
+  turnActive: 'The agent is still responding.',
+  waitForTurn: 'Wait for the agent to finish responding, or stop it.',
+  promptPending: 'The agent is waiting for an answer to a question or approval.',
+  answerFirst: 'Answer the question or approval first.',
+  backgroundTasksRunning: 'Background tasks are still running.',
+  waitForBackgroundTasks: 'Wait for the background tasks to finish.',
+  messagesUnsettled: "A message you sent earlier hasn't been confirmed yet.",
+  settleEarlierMessage: 'Wait for your earlier message to go through, or retry it.',
+  optionRejected: "The agent didn't accept this setting.",
+  goalsUnsupported: "This agent doesn't support goals.",
+  agentRefused: 'The agent turned this down.',
+  ownerUnproven: "Orca hasn't confirmed that this chat's previous agent stopped.",
+  reopenChat: 'Reopen the chat to check again.',
+  terminalAgentHoldsChat: TERMINAL_AGENT_HOLDS_CHAT,
+  quitTerminalAgent: QUIT_TERMINAL_AGENT,
+  hostReconciling: 'Orca is still checking on this chat after restarting.',
+  waitMoment: 'Wait a moment.',
+  recordUnreadable: "Orca couldn't read this chat's saved state.",
+  chatNotFound: 'The Orca running this chat has no record of it.',
+  startNewChat: START_NEW_CHAT,
+  tryAgain: 'Try again.'
+} as const
+
+export type AgentSessionWriteNoticeSentence = keyof typeof AGENT_SESSION_WRITE_NOTICE_COPY
+/** A notice as whole sentences, each translated on its own; `text` is a provider's own words. */
+export type AgentSessionWriteNoticePart = AgentSessionWriteNoticeSentence | { text: string }
diff --git a/src/shared/agent-state-history.ts b/src/shared/agent-state-history.ts
index 4833d351c66d..105d8e549087 100644
--- a/src/shared/agent-state-history.ts
+++ b/src/shared/agent-state-history.ts
@@ -1,4 +1,5 @@
 import type { AgentStatusState } from './agent-status-types'
+import type { AgentMainAgentStatus } from './main-agent-status'
 
 /** A snapshot of a previous agent state, used to render activity blocks.
  *  Why: intentionally narrower than AgentStatusEntry — tool/assistant context is
@@ -16,6 +17,9 @@ export type AgentStateHistoryEntry = {
   /** True when this `done` was a cancellation (agent hook like Claude `is_interrupt`,
    *  or Orca's guarded fallback). Always falsy for non-`done` states so retention logic can preserve it. */
   interrupted?: boolean
+  /** The main agent's own status when this state was left, copied with `interrupted` by
+   *  `agentVerdictFields`; read the verdict through `agentMainAgentVerdict`. */
+  mainAgent?: AgentMainAgentStatus
 }
 
 /** Maximum number of history entries kept per agent to bound memory. */
diff --git a/src/shared/agent-status-observation.ts b/src/shared/agent-status-observation.ts
index b106e43fe63d..e926a582ee58 100644
--- a/src/shared/agent-status-observation.ts
+++ b/src/shared/agent-status-observation.ts
@@ -7,6 +7,8 @@
 //
 // NOTHING READS IT YET. It is stamped so consumers can be migrated one at a time.
 
+import { createNonSecureContextUuid } from './non-secure-context-uuid'
+
 /** Where the evidence for a status row came from — the ingress, not the transport.
  *  A hook event relayed over SSH is still `hook`; the relay is a carrier. */
 export const AGENT_STATUS_OBSERVATION_ORIGINS = [
@@ -195,5 +197,5 @@ export class AgentStatusObservationSequencer {
  *  authority's revision counter starts over, so its observations must not be comparable
  *  with the ones it emitted before (including any rehydrated from disk). */
 export function createAgentStatusAuthorityId(role: string): string {
-  return `${role}:${globalThis.crypto.randomUUID()}`
+  return `${role}:${createNonSecureContextUuid()}`
 }
diff --git a/src/shared/agent-status-osc-scan-budget.test.ts b/src/shared/agent-status-osc-scan-budget.test.ts
index c61e2faded10..d05200564626 100644
--- a/src/shared/agent-status-osc-scan-budget.test.ts
+++ b/src/shared/agent-status-osc-scan-budget.test.ts
@@ -17,24 +17,26 @@ function parseWithSearchBudget(data: string) {
     }
     return found
   })
-  const execSpy = vi
-    .spyOn(RegExp.prototype, 'exec')
-    .mockImplementation(function (this: RegExp, input) {
-      const from = this.global || this.sticky ? this.lastIndex : 0
-      const found = exec.call(this, input)
-      if (input === data) {
-        searchedChars += (found === null ? data.length : found.index + found[0].length) - from
-      }
-      return found
-    })
-  const charCodeAtSpy = vi
-    .spyOn(String.prototype, 'charCodeAt')
-    .mockImplementation(function (this: string, index) {
-      if (this === data) {
-        searchedChars += 1
-      }
-      return charCodeAt.call(this, index)
-    })
+  const execSpy = vi.spyOn(RegExp.prototype, 'exec').mockImplementation(function (
+    this: RegExp,
+    input
+  ) {
+    const from = this.global || this.sticky ? this.lastIndex : 0
+    const found = exec.call(this, input)
+    if (input === data) {
+      searchedChars += (found === null ? data.length : found.index + found[0].length) - from
+    }
+    return found
+  })
+  const charCodeAtSpy = vi.spyOn(String.prototype, 'charCodeAt').mockImplementation(function (
+    this: string,
+    index
+  ) {
+    if (this === data) {
+      searchedChars += 1
+    }
+    return charCodeAt.call(this, index)
+  })
   try {
     return { result: createAgentStatusOscProcessor()(data), searchedChars }
   } finally {
diff --git a/src/shared/agent-status-store-copying-oracle.test-fixture.ts b/src/shared/agent-status-store-copying-oracle.test-fixture.ts
index cec2a2556e0b..06446079c56b 100644
--- a/src/shared/agent-status-store-copying-oracle.test-fixture.ts
+++ b/src/shared/agent-status-store-copying-oracle.test-fixture.ts
@@ -83,6 +83,9 @@ export function createCopyingAgentStatusStoreOracle(epoch: string): CopyingAgent
     getAliasesForChild: (childWorkId) =>
       [...current.aliases.values()].filter((alias) => alias.childWorkId === childWorkId),
     resolveChildAliases(aliases) {
+      if (aliases.length === 0) {
+        return []
+      }
       const keys = new Set(aliases.map(serializeAgentChildWorkAliasKey))
       const matches: AgentChildWorkAliasRecord[] = []
       for (const alias of current.aliases.values()) {
diff --git a/src/shared/agent-status-store-in-place.test.ts b/src/shared/agent-status-store-in-place.test.ts
index e67da48dfdfd..efc999aef56c 100644
--- a/src/shared/agent-status-store-in-place.test.ts
+++ b/src/shared/agent-status-store-in-place.test.ts
@@ -168,9 +168,10 @@ describe('AgentStatusStore applied in place', () => {
         for (const parent of parents) {
           expect(store.getChildren(parent)).toEqual(oracle.getChildren(parent))
         }
-        for (const id of CHILD_IDS) {
-          expect(store.getAliasesForChild(id)).toEqual(oracle.getAliasesForChild(id))
-        }
+        // Keep every child-id read in CHILD_IDS order while comparing one aggregate.
+        const aliasesByChildInIdOrder = CHILD_IDS.map((id) => store.getAliasesForChild(id))
+        const oracleAliasesByChildInIdOrder = CHILD_IDS.map((id) => oracle.getAliasesForChild(id))
+        expect(aliasesByChildInIdOrder).toEqual(oracleAliasesByChildInIdOrder)
         mostAliases = Math.max(mostAliases, oracle.state().aliases.size)
         const probe = mutation.aliases ?? []
         expect(store.resolveChildAliases(probe)).toEqual(oracle.resolveChildAliases(probe))
diff --git a/src/shared/agent-status-types.ts b/src/shared/agent-status-types.ts
index dcd447e6bef5..0150ef2b7fdc 100644
--- a/src/shared/agent-status-types.ts
+++ b/src/shared/agent-status-types.ts
@@ -324,7 +324,7 @@ function normalizeSubagentsField(value: unknown): AgentSubagentSnapshot[] | unde
 
 /** A malformed `mainAgent` drops the FIELD, never the row: the combined `state` is still valid
  *  evidence, and readers fall back to it exactly as they do for a host that predates the field. */
-function normalizeMainAgentStatusField(value: unknown): AgentMainAgentStatus | undefined {
+export function normalizeMainAgentStatusField(value: unknown): AgentMainAgentStatus | undefined {
   if (typeof value !== 'object' || value === null) {
     return undefined
   }
diff --git a/src/shared/agent-title-core.ts b/src/shared/agent-title-core.ts
index 3d0bdbc0feb5..a3bc238a7e1e 100644
--- a/src/shared/agent-title-core.ts
+++ b/src/shared/agent-title-core.ts
@@ -1,3 +1,6 @@
+import { isDshTerminalTitle } from './dsh-terminal-title'
+export { DSH_WHALE, isDshTerminalTitle } from './dsh-terminal-title'
+import { isQoderTerminalTitle } from './qoder-terminal-title'
 import {
   AGY_AGENT_NAME_RE,
   DROID_AGENT_NAME_RE,
@@ -56,6 +59,13 @@ export const BRAILLE_SPINNER_RE = /[\u2800-\u28ff]/g
 export const QUARTER_CIRCLE_SPINNER_RE = /[\u25d0-\u25d3]/g
 
 function computeIsGeminiTerminalTitle(title: string): boolean {
+  // Why first: see isDshTerminalTitle — the two agents share the `✦` glyph.
+  if (isQoderTerminalTitle(title)) {
+    return false
+  }
+  if (isDshTerminalTitle(title)) {
+    return false
+  }
   // Why: Gemini OSC glyphs are stronger evidence than any cwd/session text.
   if (
     title.includes(GEMINI_PERMISSION) ||
diff --git a/src/shared/agent-title-decoration.test.ts b/src/shared/agent-title-decoration.test.ts
index a87426c83cf5..5a5666696e0b 100644
--- a/src/shared/agent-title-decoration.test.ts
+++ b/src/shared/agent-title-decoration.test.ts
@@ -5,6 +5,11 @@ import {
 } from './agent-title-decoration'
 
 describe('stripLeadingAgentTitleDecoration', () => {
+  it('strips Qoder permission decoration without stripping triangles inside a title', () => {
+    expect(stripLeadingAgentTitleDecoration('▲ Qoder CLI')).toBe('Qoder CLI')
+    expect(stripLeadingAgentTitleDecoration('deploy ▲ complete')).toBe('deploy ▲ complete')
+  })
+
   it("strips Claude's ✳ idle glyph", () => {
     expect(stripLeadingAgentTitleDecoration('✳ Claude Code')).toBe('Claude Code')
   })
diff --git a/src/shared/agent-title-decoration.ts b/src/shared/agent-title-decoration.ts
index 47a6db679e79..3ae4d0075e68 100644
--- a/src/shared/agent-title-decoration.ts
+++ b/src/shared/agent-title-decoration.ts
@@ -1,11 +1,11 @@
 // Leading status decorations that coding agents prepend to their OSC title —
-// Claude's '✳', Gemini's glyphs (✦ ⏲ ◇ ✋), braille and quarter-circle spinners,
+// Claude's '✳', Gemini's glyphs (✦ ⏲ ◇ ✋), Qoder’s ▲, braille and quarter-circle spinners,
 // and Claude's '. '/'* ' working/idle prefixes. Once the tab bar shows the
 // provider icon, this leading glyph reads as a redundant second icon, so strip
 // it from the displayed title. Scoped to titles we already know belong to an agent.
 const LEADING_AGENT_TITLE_DECORATION_RE =
   // eslint-disable-next-line no-control-regex -- intentional unicode status-glyph ranges
-  /^(?:[✳✦⏲◇✋⠀-⣿◐-◓]+|[.*]\s)\s*/
+  /^(?:[✳✦⏲◇✋▲⠀-⣿◐-◓]+|[.*]\s)\s*/
 
 export function stripLeadingAgentTitleDecorationOrEmpty(title: string): string {
   return title.replace(LEADING_AGENT_TITLE_DECORATION_RE, '').trimStart()
diff --git a/src/shared/agent-title-identity.ts b/src/shared/agent-title-identity.ts
index 949768e03b51..69d1531fb9e0 100644
--- a/src/shared/agent-title-identity.ts
+++ b/src/shared/agent-title-identity.ts
@@ -1,3 +1,4 @@
+import { isQoderTerminalTitle } from './qoder-terminal-title'
 import { getPiStateTitleBrand } from './pi-state-title-marker'
 import {
   AGY_AGENT_NAME_RE,
@@ -72,6 +73,9 @@ function computeAgentLabel(title: string): string | null {
   if (piStateBrand) {
     return piStateBrand
   }
+  if (isQoderTerminalTitle(title)) {
+    return 'Qoder CLI'
+  }
   if (isGeminiTerminalTitle(title)) {
     return 'Gemini CLI'
   }
diff --git a/src/shared/agent-title-status.ts b/src/shared/agent-title-status.ts
index a74ae15d6bf0..7cd7a2c292cd 100644
--- a/src/shared/agent-title-status.ts
+++ b/src/shared/agent-title-status.ts
@@ -1,3 +1,4 @@
+import { qoderTitleStatus } from './qoder-terminal-title'
 import {
   AGY_AGENT_NAME_RE,
   BRAILLE_SPINNER_RE,
@@ -19,6 +20,7 @@ import {
   containsQuarterCircleSpinner,
   containsLegacyAgentName,
   isClaudeManagementTitle,
+  isDshTerminalTitle,
   isGeminiTerminalTitle,
   isPiAgentTitle,
   isPiTerminalTitle
@@ -128,6 +130,10 @@ export function createAgentStatusTracker(
  * Normalize high-churn agent titles into stable display labels before storage.
  */
 export function normalizeTerminalTitle(title: string): string {
+  const qoderStatus = qoderTitleStatus(title)
+  if (qoderStatus) {
+    return `${qoderStatus === 'working' ? '✦' : qoderStatus === 'permission' ? '▲' : '◇'} Qoder CLI`
+  }
   if (!title) {
     return title
   }
@@ -180,6 +186,10 @@ function canonicalizeBrailleSpinnerFrame(title: string): string {
 }
 
 function computeAgentStatusFromTitle(title: string): AgentStatus | null {
+  const qoderStatus = qoderTitleStatus(title)
+  if (qoderStatus) {
+    return qoderStatus
+  }
   if (!title || isClaudeManagementTitle(title)) {
     return null
   }
@@ -198,14 +208,20 @@ function computeAgentStatusFromTitle(title: string): AgentStatus | null {
     return piStateStatus
   }
 
-  if (title.includes(GEMINI_PERMISSION)) {
-    return 'permission'
-  }
-  if (title.includes(GEMINI_WORKING) || title.includes(GEMINI_SILENT_WORKING)) {
-    return 'working'
-  }
-  if (title.includes(GEMINI_IDLE)) {
-    return 'idle'
+  // Why the guard: DSH-TUI prefixes its title with `✦` while it is at REST, and that is
+  // Gemini's WORKING glyph. Reading it here made a finished DSH pane report working
+  // forever. DSH's own spinner prefixes are braille, which the spinner check below
+  // already covers, and its hooks are the authority either way.
+  if (!isDshTerminalTitle(title)) {
+    if (title.includes(GEMINI_PERMISSION)) {
+      return 'permission'
+    }
+    if (title.includes(GEMINI_WORKING) || title.includes(GEMINI_SILENT_WORKING)) {
+      return 'working'
+    }
+    if (title.includes(GEMINI_IDLE)) {
+      return 'idle'
+    }
   }
 
   // Why: resolve synthetic Pi/OMP permission/idle labels before the broader
diff --git a/src/shared/agent-type-label.ts b/src/shared/agent-type-label.ts
index 24febeaafa73..a4d70a760370 100644
--- a/src/shared/agent-type-label.ts
+++ b/src/shared/agent-type-label.ts
@@ -6,6 +6,8 @@ const WELL_KNOWN_LABELS: Record<string, string> = {
   claude: 'Claude',
   openclaude: 'OpenClaude',
   codex: 'Codex',
+  qoder: 'Qoder CLI',
+  qodercli: 'Qoder CLI',
   gemini: 'Gemini',
   antigravity: 'Antigravity',
   amp: 'Amp',
@@ -27,7 +29,8 @@ const WELL_KNOWN_LABELS: Record<string, string> = {
   trae: 'Trae',
   kimi: 'Kimi',
   muse: 'Muse',
-  zcode: 'ZCode'
+  zcode: 'ZCode',
+  dsh: 'DeepSeek Harness'
 }
 
 export function formatAgentTypeLabel(agentType: AgentType | null | undefined): string {
diff --git a/src/shared/ai-vault-resume-command.ts b/src/shared/ai-vault-resume-command.ts
index fbd0658def12..cfff419c95c9 100644
--- a/src/shared/ai-vault-resume-command.ts
+++ b/src/shared/ai-vault-resume-command.ts
@@ -219,6 +219,7 @@ function buildAgentResumeInvocation(
     case 'cline':
       return `${baseCommand} --id ${sessionArg}`
     case 'claude':
+    case 'zcode':
     case 'cursor':
     case 'gemini':
     case 'grok':
diff --git a/src/shared/ai-vault-types.ts b/src/shared/ai-vault-types.ts
index b167f19c496e..c981752745d8 100644
--- a/src/shared/ai-vault-types.ts
+++ b/src/shared/ai-vault-types.ts
@@ -15,6 +15,7 @@ export const AI_VAULT_AGENTS = [
   'copilot',
   'opencode',
   'opencode2',
+  'zcode',
   'grok',
   'openclaw',
   'devin',
@@ -62,6 +63,7 @@ export const AI_VAULT_AGENT_LABELS = {
   copilot: 'GitHub Copilot',
   opencode: 'OpenCode',
   opencode2: 'OpenCode 2',
+  zcode: 'ZCode',
   grok: 'Grok',
   openclaw: 'OpenClaw',
   devin: 'Devin',
diff --git a/src/shared/browser-network-tunnel-stream-framing.test.ts b/src/shared/browser-network-tunnel-stream-framing.test.ts
index 4ca73810cdf4..c4efcbca83af 100644
--- a/src/shared/browser-network-tunnel-stream-framing.test.ts
+++ b/src/shared/browser-network-tunnel-stream-framing.test.ts
@@ -82,12 +82,14 @@ describe('browser network tunnel stream framing', () => {
     )
     const originalSet = Uint8Array.prototype.set
     let copiedBytes = 0
-    const set = vi
-      .spyOn(Uint8Array.prototype, 'set')
-      .mockImplementation(function (this: Uint8Array, source, offset) {
-        copiedBytes += source.length
-        originalSet.call(this, source, offset)
-      })
+    const set = vi.spyOn(Uint8Array.prototype, 'set').mockImplementation(function (
+      this: Uint8Array,
+      source,
+      offset
+    ) {
+      copiedBytes += source.length
+      originalSet.call(this, source, offset)
+    })
     try {
       for (const byte of encoded) {
         decoder.feed(new Uint8Array([byte]))
diff --git a/src/shared/browser-url.test.ts b/src/shared/browser-url.test.ts
index 274377668672..2f947601bdac 100644
--- a/src/shared/browser-url.test.ts
+++ b/src/shared/browser-url.test.ts
@@ -212,6 +212,44 @@ describe('browser-url helpers', () => {
     )
   })
 
+  it.each([
+    ['example.com:8443/docs?q=one#section', 'https://example.com:8443/docs?q=one#section'],
+    ['EXAMPLE.COM:443', 'https://example.com/'],
+    ['example.com:80', 'https://example.com:80/'],
+    ['app.localhost:3000', 'http://app.localhost:3000/'],
+    ['app.localhost:443', 'http://app.localhost:443/'],
+    ['app.localhost:80', 'http://app.localhost/'],
+    ['deep.app.localhost:5173/path?x=1#preview', 'http://deep.app.localhost:5173/path?x=1#preview'],
+    ['https://app.localhost:3000', 'https://app.localhost:3000/'],
+    ['http://example.com:80/docs', 'http://example.com/docs'],
+    ['example.com:65535/docs', 'https://example.com:65535/docs'],
+    ['example.com:0', 'https://example.com:0/'],
+    ['APP.LOCALHOST.:443/docs', 'http://app.localhost.:443/docs'],
+    ['[::1]:3000/docs', 'http://[::1]:3000/docs'],
+    ['https://user:pass@example.com:8443/docs', 'https://user:pass@example.com:8443/docs'],
+    [
+      'example.com:8443/path@evil.test?next=:80#part',
+      'https://example.com:8443/path@evil.test?next=:80#part'
+    ]
+  ])('navigates a domain with a port: %s', (input, expected) => {
+    expect(normalizeBrowserNavigationUrl(input, 'google')).toBe(expected)
+    expect(normalizeBrowserNavigationUrl(input)).toBe(expected)
+  })
+
+  it.each([
+    'javascript:1234',
+    'data:1234',
+    'custom:3000',
+    'example.com:65536',
+    'example.com:8443@evil.test',
+    'example.com:8443\\evil.test',
+    'example.com:-1',
+    'example.com:3.5',
+    'example.com:8443evil.test'
+  ])('does not turn an unsupported scheme or invalid port into a navigation: %s', (input) => {
+    expect(normalizeBrowserNavigationUrl(input, 'google')).toBeNull()
+  })
+
   it('builds search URLs correctly', () => {
     expect(buildSearchUrl('hello world', 'google')).toBe(
       'https://www.google.com/search?q=hello%20world'
diff --git a/src/shared/browser-url.ts b/src/shared/browser-url.ts
index eaaf8211c6db..7854a24bac65 100644
--- a/src/shared/browser-url.ts
+++ b/src/shared/browser-url.ts
@@ -64,6 +64,24 @@ function isValidDnsName(name: string): boolean {
     )
 }
 
+/** Avoids parsing a dotted host and port as a scheme; .localhost defaults to HTTP. */
+function classifySchemeLessDomainPortAddress(input: string): URL | null {
+  const match = /^([^\s/\\:@?#]+):\d+(?:[/?#].*)?$/.exec(input)
+  if (!match || !match[1].includes('.')) {
+    return null
+  }
+  try {
+    const url = new URL(`https://${input}`)
+    const hostname = normalizeCertificateHostname(url.hostname)
+    if (!isValidDnsName(hostname)) {
+      return null
+    }
+    return hostname.endsWith('.localhost') ? new URL(`http://${input}`) : url
+  } catch {
+    return null
+  }
+}
+
 function isIpv4Loopback(hostname: string): boolean {
   const octets = hostname.split('.')
   if (octets.length !== 4 || octets.some((octet) => !/^\d{1,3}$/.test(octet))) {
@@ -290,6 +308,11 @@ export function normalizeBrowserNavigationUrl(
     return absolutePathToFileUrl(trimmed)
   }
 
+  const domainPortAddress = classifySchemeLessDomainPortAddress(trimmed)
+  if (domainPortAddress) {
+    return domainPortAddress.toString()
+  }
+
   try {
     const parsed = new URL(trimmed)
     // Why: file:// is allowed so the browser pane can render local files the
diff --git a/src/shared/child-process/__fixtures__/child-process-import-allowlist.txt b/src/shared/child-process/__fixtures__/child-process-import-allowlist.txt
index 2dd034cbe5f0..7741c9907dde 100644
--- a/src/shared/child-process/__fixtures__/child-process-import-allowlist.txt
+++ b/src/shared/child-process/__fixtures__/child-process-import-allowlist.txt
@@ -52,7 +52,6 @@ src/main/browser/agent-browser-bridge-state.ts
 src/main/browser/agent-browser-bridge-types.ts
 src/main/browser/browser-route-egress-electron-launch.ts
 src/main/browser/browser-route-persisted-worker-electron-process.ts
-src/main/claude-accounts/keychain.ts
 src/main/codex-accounts/legacy-wsl-runtime-auth-drain-recovery-script-harness.ts
 src/main/codex-accounts/legacy-wsl-runtime-auth-drain-script-harness.ts
 src/main/codex-accounts/legacy-wsl-runtime-auth-drain-script-interference-shims.ts
@@ -115,6 +114,7 @@ src/main/ipc/repos/repo-clone-lifecycle.ts
 src/main/ipc/worktree-apfs-clone.ts
 src/main/ipc/wsl-watcher-process-exit.ts
 src/main/local-builds/local-build-candidate.ts
+src/main/macos-keychain/generic-password.ts
 src/main/macos-system-sleep-assertion.ts
 src/main/macos-tcc-prompt-watch.ts
 src/main/memory/collector.ts
@@ -130,7 +130,6 @@ src/main/providers/process-cwd.ts
 src/main/providers/windows-console-attached-processes.ts
 src/main/pty-descendant-termination.ts
 src/main/pty/posix-pty-foreground-group.ts
-src/main/pty/posix-pty-process-groups.ts
 src/main/pty/windows-environment-path.ts
 src/main/rate-limits/codex-fetcher.ts
 src/main/rate-limits/gemini-cli-oauth-extractor.ts
@@ -165,7 +164,6 @@ src/relay/ai-vault-service-spawn.ts
 src/relay/external-automations-handler.ts
 src/relay/fs-handler-git-fallback.ts
 src/relay/fs-handler-list-files.ts
-src/relay/fs-handler-utils.ts
 src/relay/fs-list-files-fallback-chain.ts
 src/relay/git-handler.ts
 src/relay/git-stdout-stream.ts
@@ -178,5 +176,4 @@ src/shared/ephemeral-vm-recipe-runner.ts
 src/shared/fish-binary-requirement.ts
 src/shared/process-table-snapshot-reader.ts
 src/shared/pty-slave-line-discipline-echo.ts
-src/shared/ripgrep-process-availability.ts
 src/shared/shell-process-readiness.ts
diff --git a/src/shared/child-process/__fixtures__/windows-console-visibility-allowlist.txt b/src/shared/child-process/__fixtures__/windows-console-visibility-allowlist.txt
index 828a01350bbe..6de7701b81ba 100644
--- a/src/shared/child-process/__fixtures__/windows-console-visibility-allowlist.txt
+++ b/src/shared/child-process/__fixtures__/windows-console-visibility-allowlist.txt
@@ -9,7 +9,7 @@ main/agent-hooks/managed-hook-owner-identity.ts
 main/agent-hooks/managed-hook-runtime.ts
 main/app-icon.ts
 main/automations/precheck-runner.ts
-main/claude-accounts/keychain.ts
+main/macos-keychain/generic-password.ts
 main/computer/macos-computer-use-permission-status.ts
 main/computer/macos-computer-use-permissions.ts
 main/computer/macos-native-provider-transport.ts
@@ -37,7 +37,6 @@ main/providers/macos-login-session-pty-probe.ts
 main/providers/process-cwd.ts
 main/pty-descendant-termination.ts
 main/pty/posix-pty-foreground-group.ts
-main/pty/posix-pty-process-groups.ts
 main/pty/windows-environment-path.ts
 main/rate-limits/codex-fetcher.ts
 main/runtime/tls-certificate.ts
diff --git a/src/shared/child-process/child-process-import-boundary.test.ts b/src/shared/child-process/child-process-import-boundary.test.ts
index 2ae150cc8be7..e5c1d3621126 100644
--- a/src/shared/child-process/child-process-import-boundary.test.ts
+++ b/src/shared/child-process/child-process-import-boundary.test.ts
@@ -29,7 +29,7 @@ const CHILD_PROCESS_IMPORT_ALLOWLIST: readonly string[] = readFileSync(
  * May only ever be DECREASED, and only by migrating a file off
  * `node:child_process`. Raising it is never the fix.
  */
-const DIRECT_IMPORTER_PIN = 152
+const DIRECT_IMPORTER_PIN = 149
 
 const IMPORT_PATTERN =
   /(?:from\s+['"]node:child_process['"]|from\s+['"]child_process['"]|require\(\s*['"]node:child_process['"]|require\(\s*['"]child_process['"])/
diff --git a/src/shared/child-process/windows-command-line.ts b/src/shared/child-process/windows-command-line.ts
index e3402f93c198..a7821b5a05c6 100644
--- a/src/shared/child-process/windows-command-line.ts
+++ b/src/shared/child-process/windows-command-line.ts
@@ -83,6 +83,15 @@ export function quoteWindowsCmdArgument(value: string): string {
   return quoteWindows(value, true)
 }
 
+export function validateWindowsCmdArguments(values: readonly string[]): void {
+  for (const value of values) {
+    // cmd ends a command at CR/LF regardless of quoting.
+    if (/[\r\n]/.test(value)) {
+      throw new Error('cmd.exe cannot receive an argument containing a line break')
+    }
+  }
+}
+
 /**
  * Build the argv Node should spawn to run `program` with `args` through
  * `cmd.exe`, for targets cmd must interpret (`.cmd`, `.bat`).
@@ -99,19 +108,7 @@ export function quoteWindowsCmdArgument(value: string): string {
  * outer quote pair and treat the rest verbatim.
  */
 export function buildWindowsCmdShimCommandLine(program: string, args: readonly string[]): string {
-  // Why reject rather than encode: cmd's line parser ends the command at a raw
-  // CR or LF whatever the quote state, so there is no escape for it -- quoting
-  // does not survive a line break. Encoding one anyway truncates the argument
-  // and can leave the remainder to be interpreted as a further command. Agent
-  // prompts are the motivating input here and can contain newlines, so this
-  // has to fail loudly rather than silently mangle. Recognised npm/pnpm shims
-  // no longer reach this line at all — windows-cmd-shim-resolution.ts spawns
-  // their target directly, where a newline is just another character.
-  for (const value of [program, ...args]) {
-    if (/[\r\n]/.test(value)) {
-      throw new Error('cmd.exe cannot receive an argument containing a line break')
-    }
-  }
+  validateWindowsCmdArguments([program, ...args])
   // The program path needs the same treatment as the arguments: it is just as
   // likely to contain `%USERNAME%`, and cmd expands it just the same.
   const inner = [program, ...args].map(quoteWindowsCmdArgument).join(' ')
diff --git a/src/shared/child-process/windows-console-visibility.test.ts b/src/shared/child-process/windows-console-visibility.test.ts
index 8331f18892a2..0f92d943d298 100644
--- a/src/shared/child-process/windows-console-visibility.test.ts
+++ b/src/shared/child-process/windows-console-visibility.test.ts
@@ -34,7 +34,7 @@ const ALLOWLIST: readonly string[] = readAllowlist(
  * the allowlist does not bound this: a swap (one file fixed and delisted, one
  * new file added with its entry) satisfies both membership assertions.
  */
-const UNHIDDEN_SPAWNER_PIN = 62
+const UNHIDDEN_SPAWNER_PIN = 61
 
 const CHILD_PROCESS_IMPORT =
   /from\s+['"](?:node:)?child_process['"]|require\(\s*['"](?:node:)?child_process['"]/
diff --git a/src/shared/cli-argument-boundary.ts b/src/shared/cli-argument-boundary.ts
index f4252c03e4ac..a1d02eb8ece2 100644
--- a/src/shared/cli-argument-boundary.ts
+++ b/src/shared/cli-argument-boundary.ts
@@ -9,6 +9,8 @@ export const CLI_BOOLEAN_FLAGS = new Set([
   'comments',
   'connect',
   'current',
+  'current-json',
+  'current-sqlite',
   'debug',
   'dry-run',
   'enter',
diff --git a/src/shared/command-environment.test.ts b/src/shared/command-environment.test.ts
new file mode 100644
index 000000000000..91241a36c0fe
--- /dev/null
+++ b/src/shared/command-environment.test.ts
@@ -0,0 +1,90 @@
+import { describe, expect, it } from 'vitest'
+import { extractLeadingEnvAssignments, mergeCommandEnvironment } from './command-environment'
+import { planAgentBinary, planCommitMessageGeneration } from './commit-message-plan'
+import { planCustomCommand } from './commit-message-prompt'
+
+describe('command environment assignments', () => {
+  it('parses only leading valid names and retains literal values', () => {
+    expect(extractLeadingEnvAssignments(['A=x=y', '_EMPTY=', 'agent', 'B=later'])).toEqual({
+      env: { A: 'x=y', _EMPTY: '' },
+      rest: ['agent', 'B=later']
+    })
+    for (const name of ['1BAD=x', 'BAD-NAME=x', '=empty']) {
+      expect(extractLeadingEnvAssignments([name, 'agent'])).toEqual({ rest: [name, 'agent'] })
+    }
+  })
+
+  it('uses the real binary for presets and custom commands without expanding expressions', () => {
+    expect(planAgentBinary('claude', 'FLAG=1 npx claude')).toEqual({
+      ok: true,
+      binary: 'npx',
+      prefixArgs: ['claude'],
+      env: { FLAG: '1' }
+    })
+    expect(
+      planCustomCommand('VALUE="a b=$HOME;$(echo unsafe)" agent KEY=arg {prompt}', 'hello')
+    ).toEqual({
+      ok: true,
+      binary: 'agent',
+      args: ['KEY=arg', 'hello'],
+      stdinPayload: null,
+      env: { VALUE: 'a b=$HOME;$(echo unsafe)' }
+    })
+    expect(
+      planCommitMessageGeneration(
+        { agentId: 'claude', model: 'sonnet', agentCommandOverride: 'FLAG=1 claude' },
+        'hello'
+      )
+    ).toMatchObject({ ok: true, plan: { binary: 'claude', env: { FLAG: '1' } } })
+  })
+
+  it('rejects assignment-only commands and preserves no-prefix plans', () => {
+    expect(planAgentBinary('claude', 'ONLY=env')).toMatchObject({ ok: false })
+    expect(planCustomCommand('ONLY=env', 'prompt')).toMatchObject({ ok: false })
+    expect(planCustomCommand('agent', 'prompt')).toEqual({
+      ok: true,
+      binary: 'agent',
+      args: [],
+      stdinPayload: 'prompt'
+    })
+  })
+
+  it('keeps Windows paths and empty or prototype-named values intact', () => {
+    const result = planCustomCommand(
+      'DIR="C:\\my dir" __proto__=data "C:\\bin\\agent.exe"',
+      'prompt',
+      'literal'
+    )
+    expect(result).toMatchObject({
+      ok: true,
+      binary: 'C:\\bin\\agent.exe',
+      env: { DIR: 'C:\\my dir' }
+    })
+    if (result.ok) {
+      expect(Object.getOwnPropertyDescriptor(result.env, '__proto__')?.value).toBe('data')
+    }
+  })
+
+  it('lets the last assignment override every Windows spelling without mutating the base', () => {
+    const base = { PATH: 'old', Path: 'also old', TOKEN: 'old', KEEP: 'keep', ComSpec: 'cmd.exe' }
+    const { env } = extractLeadingEnvAssignments([
+      'Path=first',
+      'PATH=second',
+      'Path=last',
+      'token=',
+      'agent'
+    ])
+    expect(mergeCommandEnvironment(base, env, 'win32')).toEqual({
+      PATH: 'last',
+      TOKEN: '',
+      KEEP: 'keep',
+      COMSPEC: 'cmd.exe'
+    })
+    expect(base.PATH).toBe('old')
+    expect(mergeCommandEnvironment({ PATH: 'old' }, { Path: 'new' }, 'linux')).toEqual({
+      PATH: 'old',
+      Path: 'new'
+    })
+    expect(mergeCommandEnvironment(undefined, undefined, 'darwin')).toBeUndefined()
+  })
+})
diff --git a/src/shared/command-environment.ts b/src/shared/command-environment.ts
new file mode 100644
index 000000000000..971e0fc61b92
--- /dev/null
+++ b/src/shared/command-environment.ts
@@ -0,0 +1,38 @@
+/** Leading assignments are data, never shell expressions. */
+export function extractLeadingEnvAssignments(tokens: string[]): {
+  env?: Record<string, string>
+  rest: string[]
+} {
+  const assignments = new Map<string, string>()
+  let index = 0
+  for (const token of tokens) {
+    if (!/^[A-Za-z_][A-Za-z0-9_]*=/.test(token)) {
+      break
+    }
+    const equals = token.indexOf('=')
+    const name = token.slice(0, equals)
+    // Preserve last-assignment order when Windows folds differently cased names.
+    assignments.delete(name)
+    assignments.set(name, token.slice(equals + 1))
+    index++
+  }
+  return {
+    ...(assignments.size ? { env: Object.fromEntries(assignments) } : {}),
+    rest: tokens.slice(index)
+  }
+}
+
+export function mergeCommandEnvironment(
+  base: Record<string, string | undefined> | undefined,
+  overrides: Record<string, string> | undefined,
+  platform: NodeJS.Platform
+): Record<string, string | undefined> | undefined {
+  if (!overrides) {
+    return base
+  }
+  const entries = [...Object.entries(base ?? process.env), ...Object.entries(overrides)]
+  // Windows keys share one spelling so guards cannot retain differently cased aliases.
+  return Object.fromEntries(
+    platform === 'win32' ? entries.map(([key, value]) => [key.toUpperCase(), value]) : entries
+  )
+}
diff --git a/src/shared/commit-message-agent-spec.test.ts b/src/shared/commit-message-agent-spec.test.ts
index fee9a9f1046a..2a6ad8c3b7c1 100644
--- a/src/shared/commit-message-agent-spec.test.ts
+++ b/src/shared/commit-message-agent-spec.test.ts
@@ -36,6 +36,7 @@ describe('COMMIT_MESSAGE_AGENT_SPECS', () => {
       'codex',
       'copilot',
       'cursor',
+      'dsh',
       'kimi',
       'muse',
       'omp',
diff --git a/src/shared/commit-message-agent-specs-secondary.ts b/src/shared/commit-message-agent-specs-secondary.ts
index 80dfe37212f4..0ad5086bec71 100644
--- a/src/shared/commit-message-agent-specs-secondary.ts
+++ b/src/shared/commit-message-agent-specs-secondary.ts
@@ -137,6 +137,27 @@ export function buildSecondaryCommitMessageAgentSpecs({
       models: [{ id: 'default', label: 'Config default' }],
       defaultModelId: 'default'
     },
+    dsh: {
+      id: 'dsh',
+      label: 'DeepSeek Harness',
+      binary: 'dsh',
+      // Why: `dsh --profile headless` runs one fresh persisted session, prints the final
+      // answer and exits — the documented one-shot entry mode. The interactive `dsh-tui`
+      // profile is deliberately not used here; Source Control AI stays one-shot.
+      // Why stdin and not argv: the prompt carries the whole diff. On argv it would sit in
+      // the process table for every user on the box, and it would eventually hit the argv
+      // limit. `-` is DSH's explicit stdin marker; measured against 0.1.5-rc.1, omitting the
+      // positional entirely is rejected ("a task is required") even when stdin is a pipe.
+      promptDelivery: 'stdin',
+      buildArgs: () => ['--profile', 'headless', '-'],
+      // Why: the launcher owns `--profile`; a second one would boot a different profile.
+      singletonOptions: [['--profile']],
+      modelSource: 'static',
+      // Why: the headless app parses no `--model`. The model comes from the profile's
+      // `llm-deepseek` row, so the only honest choice here is the configured default.
+      models: [{ id: 'default', label: 'Config default' }],
+      defaultModelId: 'default'
+    },
     copilot: {
       id: 'copilot',
       label: 'GitHub Copilot',
diff --git a/src/shared/commit-message-plan.ts b/src/shared/commit-message-plan.ts
index 83760f00ae17..1d0bf1e02de9 100644
--- a/src/shared/commit-message-plan.ts
+++ b/src/shared/commit-message-plan.ts
@@ -1,3 +1,5 @@
+import { planAgentBinary } from './agent-command-plan'
+export { planAgentBinary } from './agent-command-plan'
 import type { CommandTemplateBackslash } from './commit-message-prompt'
 import {
   getCommitMessageAgentSpec,
@@ -33,33 +35,14 @@ export type CommitMessagePlan = {
   stdinPayload: string | null
   /** Human-readable label used in error prefixes (e.g. "Claude failed: ..."). */
   label: string
+  /** Leading command assignments, applied on the execution host. */
+  env?: Record<string, string>
 }
 
 export type CommitMessagePlanResult =
   | { ok: true; plan: CommitMessagePlan }
   | { ok: false; error: string }
 
-export function planAgentBinary(
-  defaultBinary: string,
-  commandOverride: string | undefined,
-  backslash: CommandTemplateBackslash = 'escape'
-): { ok: true; binary: string; prefixArgs: string[] } | { ok: false; error: string } {
-  const command = commandOverride?.trim()
-  if (!command) {
-    return { ok: true, binary: defaultBinary, prefixArgs: [] }
-  }
-
-  const tokenized = tokenizeCustomCommandTemplate(command, backslash)
-  if (!tokenized.ok) {
-    return { ok: false, error: `Agent command override is invalid: ${tokenized.error}` }
-  }
-  const [binary, ...prefixArgs] = tokenized.tokens
-  if (!binary) {
-    return { ok: false, error: 'Agent command override must start with a binary name.' }
-  }
-  return { ok: true, binary, prefixArgs }
-}
-
 function planAdditionalAgentArgs(
   agentArgs: string | null | undefined,
   backslash: CommandTemplateBackslash = 'escape'
@@ -267,7 +250,8 @@ export function planCommitMessageGeneration(
         stdinPayload: planned.stdinPayload,
         // Why: a custom command has no friendly name, so the binary doubles
         // as the label in error prefixes ("ollama failed: ...").
-        label: planned.binary
+        label: planned.binary,
+        ...(planned.env ? { env: planned.env } : {})
       }
     }
   }
@@ -329,7 +313,8 @@ export function planCommitMessageGeneration(
       binary: command.binary,
       args: [...merged.prefixArgs, ...args],
       stdinPayload: spec.promptDelivery === 'stdin' ? prompt : null,
-      label: spec.label
+      label: spec.label,
+      ...(command.env ? { env: command.env } : {})
     }
   }
 }
diff --git a/src/shared/commit-message-prompt.ts b/src/shared/commit-message-prompt.ts
index 7fb9da76d668..ecf4cb390694 100644
--- a/src/shared/commit-message-prompt.ts
+++ b/src/shared/commit-message-prompt.ts
@@ -1,3 +1,4 @@
+import { extractLeadingEnvAssignments } from './command-environment'
 // Why: keeping the base prompt and assembly here (in shared) lets both the
 // renderer (preview/tests) and main (actual generation) reach the exact same
 // string without duplicating the wording.
@@ -265,7 +266,13 @@ export function tokenizeCustomCommandTemplate(
 }
 
 export type CustomCommandPlan =
-  | { ok: true; binary: string; args: string[]; stdinPayload: string | null }
+  | {
+      ok: true
+      binary: string
+      args: string[]
+      stdinPayload: string | null
+      env?: Record<string, string>
+    }
   | { ok: false; error: string }
 
 /**
@@ -289,7 +296,8 @@ export function planCustomCommand(
   if (tokenized.tokens.length === 0) {
     return { ok: false, error: 'Custom command is empty.' }
   }
-  const [binary, ...rest] = tokenized.tokens
+  const { env, rest: commandTokens } = extractLeadingEnvAssignments(tokenized.tokens)
+  const [binary, ...rest] = commandTokens
   if (!binary) {
     return { ok: false, error: 'Custom command must start with a binary name.' }
   }
@@ -298,14 +306,15 @@ export function planCustomCommand(
     token.includes(CUSTOM_PROMPT_PLACEHOLDER)
       ? token.split(CUSTOM_PROMPT_PLACEHOLDER).join(prompt)
       : token
-  const usesPlaceholder = tokenized.tokens.some((t) => t.includes(CUSTOM_PROMPT_PLACEHOLDER))
+  const usesPlaceholder = commandTokens.some((t) => t.includes(CUSTOM_PROMPT_PLACEHOLDER))
   if (usesPlaceholder) {
     return {
       ok: true,
       binary: substitute(binary),
       args: rest.map(substitute),
-      stdinPayload: null
+      stdinPayload: null,
+      ...(env ? { env } : {})
     }
   }
-  return { ok: true, binary, args: rest, stdinPayload: prompt }
+  return { ok: true, binary, args: rest, stdinPayload: prompt, ...(env ? { env } : {}) }
 }
diff --git a/src/shared/cursor-usage-buckets.ts b/src/shared/cursor-usage-buckets.ts
new file mode 100644
index 000000000000..a7b834f5f537
--- /dev/null
+++ b/src/shared/cursor-usage-buckets.ts
@@ -0,0 +1,18 @@
+/**
+ * Cursor bills individual plans from two pools that both reset with the monthly
+ * billing cycle, plus optional on-demand spend once the pools run out.
+ * https://cursor.com/docs/account/pricing
+ */
+export const CURSOR_MODELS_BUCKET_NAME = 'Cursor Models'
+export const CURSOR_OTHER_MODELS_BUCKET_NAME = 'Other Models'
+export const CURSOR_ON_DEMAND_BUCKET_NAME = 'On-demand'
+
+export const CURSOR_USAGE_BUCKET_NAMES = [
+  CURSOR_MODELS_BUCKET_NAME,
+  CURSOR_OTHER_MODELS_BUCKET_NAME,
+  CURSOR_ON_DEMAND_BUCKET_NAME
+] as const
+
+export function isCursorUsageBucket(name: string): boolean {
+  return CURSOR_USAGE_BUCKET_NAMES.some((bucket) => bucket === name)
+}
diff --git a/src/shared/draft-paste-ready-scanner.ts b/src/shared/draft-paste-ready-scanner.ts
index 1e586031a4ec..f7a9cb7c0c52 100644
--- a/src/shared/draft-paste-ready-scanner.ts
+++ b/src/shared/draft-paste-ready-scanner.ts
@@ -67,6 +67,16 @@ const DRAFT_PASTE_READY_SIGNALS: Record<DraftPasteReadySignal, DraftPasteReadySi
     // the main-process caller drops the draft when readiness never resolves.
     quietAnchor: DECSET_BRACKETED_PASTE
   },
+  // Why: DSH-TUI draws the same U+276F composer glyph inside the alternate screen, and
+  // animates its intro continuously behind it, so it needs grok's marker-plus-quiet shape
+  // rather than the default quiet window. Its own entry (not grok's) so the two agents'
+  // evidence — and any future divergence — stay separable.
+  'dsh-composer-prompt': {
+    markerAnchor: DECSET_ALT_SCREEN,
+    markerAnchorEnd: DECRST_ALT_SCREEN,
+    marker: GROK_COMPOSER_PROMPT,
+    quietAnchor: DECSET_BRACKETED_PASTE
+  },
   'zcode-composer-prompt': {
     markerAnchor: DECSET_ALT_SCREEN,
     markerAnchorEnd: DECRST_ALT_SCREEN,
@@ -126,6 +136,10 @@ export type DraftPasteReadyScanResult = {
  *     that keeps those launches on the pre-existing delivery path. The alt-screen
  *     anchor is revoked on `\x1b[?1049l`: leaving it hands the terminal back to
  *     the shell, so a glyph after that is the shell's prompt, not grok's composer.
+ *   - `dsh-composer-prompt`: the grok shape applied to DSH-TUI, whose composer draws the
+ *     same `❯` inside the alternate screen. The committed
+ *     `dsh-tui-ready-no-key.txt` transcript is the evidence: DECSET 2004 at byte 6,
+ *     `\x1b[?1049h` at byte 40, and the first `❯` at byte 5910.
  *   - `zcode-composer-prompt`: ready when ZCode's composer box corner (`╭`) renders
  *     after the alternate-screen switch. ZCode repaints its animated ASCII banner
  *     indefinitely — the captured transcript is still repainting 30s after the composer
diff --git a/src/shared/dsh-launch-command.test.ts b/src/shared/dsh-launch-command.test.ts
new file mode 100644
index 000000000000..6585318cc980
--- /dev/null
+++ b/src/shared/dsh-launch-command.test.ts
@@ -0,0 +1,91 @@
+import { describe, expect, it } from 'vitest'
+import { isDshNonInteractiveCommand } from './dsh-launch-command'
+import { recognizeAgentProcessFromCommandLine } from './agent-process-recognition'
+
+function tokens(commandLine: string): string[] {
+  return commandLine.split(' ')
+}
+
+describe('isDshNonInteractiveCommand', () => {
+  it.each([
+    'dsh web',
+    'dsh --profile web',
+    'dsh --profile=web --port 8080',
+    'dsh --profile headless "run the tests"',
+    'dsh --profile sdk',
+    'dsh --profile sdk-minimal',
+    'dsh --profile acp',
+    'dsh plugin --profile dsh-tui add some-plugin',
+    'dsh --profile dsh-tui --dump-config'
+  ])('rejects %s', (commandLine) => {
+    expect(isDshNonInteractiveCommand(tokens(commandLine))).toBe(true)
+  })
+
+  it.each([
+    'dsh --profile dsh-tui',
+    'dsh --profile=dsh-tui',
+    'dsh --profile dsh-tui --resume 9478e2d8-29bc-4009-ab32-657efa2bd763',
+    'dsh-tui',
+    'dsh-tui --resume',
+    'dst'
+  ])('accepts %s', (commandLine) => {
+    expect(isDshNonInteractiveCommand(tokens(commandLine))).toBe(false)
+  })
+
+  it('reads only the first --profile, so app arguments cannot retarget it', () => {
+    // `--resume web` belongs to the terminal app, not the launcher.
+    expect(isDshNonInteractiveCommand(tokens('dsh --profile dsh-tui --resume web'))).toBe(false)
+  })
+
+  it.each([
+    'dsh-tui web',
+    'dst web',
+    'dsh-tui plugin',
+    'dsh-tui --continue web',
+    'dsh-tui /home/dev/projects/web',
+    'node /usr/local/lib/node_modules/.bin/dsh-tui web',
+    'C:\\Users\\dev\\AppData\\npm\\dsh-tui.cmd web'
+  ])('keeps %s interactive: the launcher already chose the TUI profile', (commandLine) => {
+    // Everything after `dsh-tui`/`dst` is the terminal app's argv — a workspace target or a
+    // resume id — so a folder named `web` or `plugin` is a directory name, not a subcommand.
+    expect(isDshNonInteractiveCommand(tokens(commandLine))).toBe(false)
+  })
+})
+
+describe('dsh foreground process recognition', () => {
+  it.each([
+    'dsh-tui',
+    'dst',
+    '/opt/homebrew/bin/dsh --profile dsh-tui',
+    'node /usr/local/lib/node_modules/.bin/dsh-tui',
+    'node /home/dev/.dsh/profiles/dsh-tui/node_modules/@deepseek-harness-tui/dsh-tui/bin/dsh-tui.js',
+    'node /usr/local/lib/node_modules/@deepseek-ai/dsh/lib/bin.js --profile dsh-tui'
+  ])('recognizes %s as dsh', (commandLine) => {
+    expect(recognizeAgentProcessFromCommandLine(commandLine)?.agent).toBe('dsh')
+  })
+
+  it.each([
+    'dsh web',
+    'dsh --profile headless "summarize the diff"',
+    'node /usr/local/lib/node_modules/@deepseek-ai/dsh/lib/bin.js --profile acp'
+  ])('does not claim %s as an interactive agent pane', (commandLine) => {
+    expect(recognizeAgentProcessFromCommandLine(commandLine)).toBeNull()
+  })
+
+  it.each(['dsh-tui web', 'dst plugin'])(
+    'still recognizes %s as the dsh agent pane',
+    (commandLine) => {
+      expect(recognizeAgentProcessFromCommandLine(commandLine)?.agent).toBe('dsh')
+    }
+  )
+
+  it('still reports non-interactive dsh when headless one-shots are included', () => {
+    // Non-interactivity guards ask for the wider set: a `dsh web` pane is not a shell
+    // either, so callers that protect agent panes from reuse must still see it.
+    expect(
+      recognizeAgentProcessFromCommandLine('dsh --profile headless "go"', {
+        includeHeadlessOneShot: true
+      })?.agent
+    ).toBe('dsh')
+  })
+})
diff --git a/src/shared/dsh-launch-command.ts b/src/shared/dsh-launch-command.ts
new file mode 100644
index 000000000000..60100a9823b1
--- /dev/null
+++ b/src/shared/dsh-launch-command.ts
@@ -0,0 +1,115 @@
+// DeepSeek Harness ships one binary, `dsh`, and boots a *profile* with it. Only the
+// `dsh-tui` profile paints an interactive composer; `web` serves HTTP, `headless` answers
+// one task and exits, `sdk`/`sdk-minimal`/`acp` speak JSON-RPC on stdio, and `plugin` is
+// package management. All five are `dsh` in the process table, so foreground recognition
+// has to read the profile to tell an agent pane from a server or a one-shot.
+//
+// `dsh-tui` (and its `dst` alias) forward straight to `dsh --profile dsh-tui`, so they are
+// always interactive and never reach this matcher.
+
+/** Profiles that boot something other than the interactive terminal UI. */
+const NON_INTERACTIVE_PROFILES = new Set([
+  'web',
+  'headless',
+  'sdk',
+  'sdk-minimal',
+  'acp',
+  'desktop'
+])
+
+/** Bare-word subcommands the launcher accepts: `plugin` boots no profile at all, and `web`
+ *  is the documented alias for `--profile web`. Neither hosts an interactive pane. */
+const SUBCOMMANDS = new Set(['plugin', 'web'])
+
+/** Launcher flags that print a composed config and exit. */
+const DUMP_FLAGS = new Set(['--dump-config', '--dump-default-config', '--dump-config-schema'])
+
+/** Binaries that always boot `--profile dsh-tui` and forward the rest to the terminal app. */
+const TUI_LAUNCHER_NAMES = new Set(['dsh-tui', 'dst'])
+
+const PROGRAM_EXTENSION_RE = /\.(?:exe|cmd|bat|ps1|js|mjs|cjs)$/
+
+function programBasename(token: string | undefined): string {
+  const unquoted = token?.trim().replace(/^["']|["']$/g, '') ?? ''
+  const basename = unquoted.split(/[\\/]/).pop() ?? unquoted
+  return basename.toLowerCase().replace(PROGRAM_EXTENSION_RE, '')
+}
+
+function readProfileName(tokens: readonly string[], index: number): string | null {
+  const token = tokens[index]
+  if (token === undefined) {
+    return null
+  }
+  if (token.startsWith('--profile=')) {
+    return token.slice('--profile='.length)
+  }
+  return token === '--profile' ? (tokens[index + 1] ?? null) : null
+}
+
+/** Launcher flags that take a value, so the token after them is never an app argument. */
+const LAUNCHER_FLAGS_WITH_VALUE = new Set(['--profile', '--from-default-profile', '--patch'])
+
+/** Valueless launcher flags. */
+const LAUNCHER_FLAGS = new Set(['-V', '--version', '-h', '--help', ...DUMP_FLAGS])
+
+/** Splits `--profile=web` down to `--profile` so both spellings match one lookup. */
+function flagName(token: string): string {
+  return token.split('=', 1)[0]
+}
+
+function isLauncherToken(token: string): boolean {
+  return LAUNCHER_FLAGS.has(token) || LAUNCHER_FLAGS_WITH_VALUE.has(flagName(token))
+}
+
+/**
+ * Whether a `dsh` command line runs something other than the interactive agent.
+ *
+ * Only the launcher's own tokens are read. Everything after the first token the launcher
+ * does not recognize belongs to the booted app (`dsh --profile dsh-tui --resume <id>`),
+ * and a prompt or session id is free text that must never be read as a launcher flag.
+ */
+export function isDshNonInteractiveCommand(tokens: readonly string[]): boolean {
+  // Why first: `dsh-tui`/`dst` have already chosen the interactive profile, and everything
+  // after them is the TERMINAL APP's argv — a `--resume` id or a workspace target. A
+  // workspace folder named `web` or `plugin` is an ordinary directory name, and reading it
+  // as a `dsh` subcommand would mark a live agent pane non-interactive, costing it status
+  // hooks and prompt delivery. Index 1 as well as 0 because a node shim puts the launcher
+  // script path there.
+  if (
+    TUI_LAUNCHER_NAMES.has(programBasename(tokens[0])) ||
+    TUI_LAUNCHER_NAMES.has(programBasename(tokens[1]))
+  ) {
+    return false
+  }
+  let profile: string | null = null
+  let index = 1
+  // Skip the leading non-flag tokens: an interpreter invocation puts the script path here.
+  while (index < tokens.length && !isLauncherToken(tokens[index])) {
+    const token = tokens[index]
+    if (SUBCOMMANDS.has(token)) {
+      return true
+    }
+    if (!token.startsWith('-') && index > 1) {
+      // A bare word that is neither a subcommand nor a flag: the app's arguments start here.
+      return false
+    }
+    index += 1
+  }
+  for (; index < tokens.length; index += 1) {
+    const token = tokens[index]
+    if (DUMP_FLAGS.has(token)) {
+      return true
+    }
+    if (!isLauncherToken(token)) {
+      break
+    }
+    const explicitProfile = readProfileName(tokens, index)
+    if (explicitProfile !== null && profile === null) {
+      profile = explicitProfile
+    }
+    if (LAUNCHER_FLAGS_WITH_VALUE.has(token)) {
+      index += 1
+    }
+  }
+  return profile !== null && NON_INTERACTIVE_PROFILES.has(profile)
+}
diff --git a/src/shared/dsh-terminal-title.test.ts b/src/shared/dsh-terminal-title.test.ts
new file mode 100644
index 000000000000..ab28f4d56f4a
--- /dev/null
+++ b/src/shared/dsh-terminal-title.test.ts
@@ -0,0 +1,45 @@
+import { describe, expect, it } from 'vitest'
+import { detectAgentStatusFromTitle, normalizeTerminalTitle } from './agent-title-status'
+import { isDshTerminalTitle, isGeminiTerminalTitle } from './agent-title-core'
+import { getAgentLabel, resolveExplicitTerminalTitleAgentType } from './terminal-title-agent-type'
+
+// DSH-TUI titles are `<prefix> 🐋 <session title>`: `✦` at rest, `⠂`/`⠐` while a turn
+// runs. Both halves collide with an existing agent — `✦` is Gemini CLI's WORKING glyph,
+// and the braille frames are what Claude's generic heuristic claims — so the whale has to
+// outrank both. Evidence: src/main/runtime/__fixtures__/dsh-tui-ready-no-key.txt.
+const RESTING = '✦ \u{1F40B} dsh-demo-repo'
+const WORKING_FRAMES = ['⠂ \u{1F40B} fix the flaky test', '⠐ \u{1F40B} fix the flaky test']
+
+describe('a DSH-TUI terminal title', () => {
+  it('is recognized by its whale', () => {
+    expect(isDshTerminalTitle(RESTING)).toBe(true)
+    expect(isDshTerminalTitle('✦ some other agent')).toBe(false)
+  })
+
+  it('is never read as Gemini CLI', () => {
+    expect(isGeminiTerminalTitle(RESTING)).toBe(false)
+    expect(getAgentLabel(RESTING)).toBe('DeepSeek Harness')
+    expect(resolveExplicitTerminalTitleAgentType(RESTING)).toBe('dsh')
+  })
+
+  it('survives normalization instead of being rewritten to Gemini', () => {
+    expect(normalizeTerminalTitle(RESTING)).toBe(RESTING)
+  })
+
+  it('does not report working just because it carries Gemini’s working glyph', () => {
+    // The regression this guards: a finished DSH pane reported working forever, because
+    // `✦` is DSH's REST prefix and Gemini's WORKING glyph.
+    expect(detectAgentStatusFromTitle(RESTING)).toBeNull()
+  })
+
+  it('keeps its working frames out of Claude’s braille lane', () => {
+    for (const frame of WORKING_FRAMES) {
+      expect(getAgentLabel(frame)).toBe('DeepSeek Harness')
+    }
+  })
+
+  it('leaves a real Gemini title alone', () => {
+    expect(isGeminiTerminalTitle('✦ gemini')).toBe(true)
+    expect(normalizeTerminalTitle('✦ gemini')).toBe('✦ Gemini CLI')
+  })
+})
diff --git a/src/shared/dsh-terminal-title.ts b/src/shared/dsh-terminal-title.ts
new file mode 100644
index 000000000000..76662bd10d06
--- /dev/null
+++ b/src/shared/dsh-terminal-title.ts
@@ -0,0 +1,10 @@
+/** DSH-TUI titles are always `<prefix> 🐋 <session title>` (its Chat screen's
+ *  `useTerminalTitle`), and the whale is the only part no other agent emits. It has to
+ *  outrank the Gemini glyphs below: DSH's IDLE prefix is `✦`, which is Gemini's WORKING
+ *  glyph, so without this a resting DSH pane reads as a working Gemini — wrong agent,
+ *  wrong state. Evidence: src/main/runtime/__fixtures__/dsh-tui-ready-no-key.txt. */
+export const DSH_WHALE = '\u{1F40B}' // 🐋
+
+export function isDshTerminalTitle(title: string): boolean {
+  return title.includes(DSH_WHALE)
+}
diff --git a/src/shared/ephemeral-vm-recipe-output-capture.test.ts b/src/shared/ephemeral-vm-recipe-output-capture.test.ts
new file mode 100644
index 000000000000..27fe3c134664
--- /dev/null
+++ b/src/shared/ephemeral-vm-recipe-output-capture.test.ts
@@ -0,0 +1,356 @@
+import { EventEmitter } from 'node:events'
+import { PassThrough } from 'node:stream'
+import { setImmediate } from 'node:timers/promises'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import {
+  clampRecipeCaptureBytes,
+  DEFAULT_MAX_CAPTURE_BYTES,
+  runRecipeCommand
+} from './ephemeral-vm-recipe-process'
+import { GrowingByteBuffer } from './growing-byte-buffer'
+
+afterEach(() => {
+  vi.restoreAllMocks()
+  vi.useRealTimers()
+})
+
+/** The pre-ring policy: re-encode the retained tail on every chunk and trim to a character boundary. */
+function oldAppend(current: string, chunk: string, maxBytes: number): string {
+  if (maxBytes <= 0) {
+    return ''
+  }
+  const chunkBytes = Buffer.byteLength(chunk, 'utf8')
+  return chunkBytes >= maxBytes
+    ? utf8Tail(chunk, maxBytes)
+    : utf8Tail(current, maxBytes - chunkBytes) + chunk
+}
+
+function utf8Tail(value: string, maxBytes: number): string {
+  const bytes = Buffer.from(value, 'utf8')
+  if (bytes.byteLength <= maxBytes) {
+    return value
+  }
+  let start = bytes.byteLength - maxBytes
+  while (start < bytes.byteLength && (bytes[start]! & 0xc0) === 0x80) {
+    start += 1
+  }
+  return bytes.subarray(start).toString('utf8')
+}
+
+/** What the capture now retains: the last maxBytes raw bytes, minus a leading partial sequence. */
+function rawByteTail(bytes: Buffer, maxBytes: number): string {
+  let start = Math.max(0, bytes.byteLength - maxBytes)
+  while (start < bytes.byteLength && (bytes[start]! & 0xc0) === 0x80) {
+    start += 1
+  }
+  return bytes.toString('utf8', start)
+}
+
+/** Independent oracle: keep whole code points from the end until the byte limit is reached. */
+function codePointTail(text: string, maxBytes: number): string {
+  const points = Array.from(text)
+  const retained: string[] = []
+  let bytes = 0
+  while (points.length > 0) {
+    const point = points.pop()!
+    bytes += Buffer.byteLength(point, 'utf8')
+    if (bytes > maxBytes) {
+      break
+    }
+    retained.unshift(point)
+  }
+  return retained.join('')
+}
+
+function deterministicRandom(seed: number): (max: number) => number {
+  let state = seed
+  return (max: number): number => {
+    state = (Math.imul(state, 1664525) + 1013904223) >>> 0
+    return max <= 0 ? 0 : state % max
+  }
+}
+
+function fakeCommand(maxCaptureBytes?: number, signal?: AbortSignal) {
+  const child = Object.assign(new EventEmitter(), {
+    pid: undefined,
+    stdin: new PassThrough(),
+    stdout: new PassThrough(),
+    stderr: new PassThrough(),
+    kill: vi.fn<(signal?: NodeJS.Signals) => boolean>(() => true),
+    unref: vi.fn()
+  })
+  const stdoutChunks: string[] = []
+  const stderrChunks: string[] = []
+  const result = runRecipeCommand({
+    command: 'synthetic-recipe',
+    repoPath: process.cwd(),
+    context: { recipeId: 'fixture', repoPath: process.cwd() },
+    mode: 'create',
+    resultSchemaVersion: 1,
+    maxCaptureBytes,
+    signal,
+    onStdout: (chunk) => stdoutChunks.push(chunk),
+    onStderr: (chunk) => stderrChunks.push(chunk),
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: The fixture implements every child member used by runRecipeCommand.
+    spawnCommand: vi.fn(() => child) as never
+  })
+  return { child, result, stdoutChunks, stderrChunks }
+}
+
+/**
+ * Counts the bytes the capture moves, scoped to our own buffer class: a spy on Buffer itself would
+ * also see unrelated allocations in the same tick and make the budget assertions flaky.
+ */
+function countCaptureWork() {
+  const appendedValues: (Buffer | Uint8Array)[] = []
+  const counts = { appendedBytes: 0, decodedBytes: 0, decodeCalls: 0 }
+  const append = GrowingByteBuffer.prototype.appendRetainedSuffix
+  const take = GrowingByteBuffer.prototype.takeBuffer
+  vi.spyOn(GrowingByteBuffer.prototype, 'appendRetainedSuffix').mockImplementation(function (
+    this: GrowingByteBuffer,
+    bytes: Buffer | Uint8Array,
+    maxBytes: number
+  ): void {
+    appendedValues.push(bytes)
+    counts.appendedBytes += bytes.byteLength
+    append.call(this, bytes, maxBytes)
+  })
+  vi.spyOn(GrowingByteBuffer.prototype, 'takeBuffer').mockImplementation(function (
+    this: GrowingByteBuffer
+  ): Buffer {
+    const taken = take.call(this)
+    counts.decodeCalls += 1
+    counts.decodedBytes += taken.byteLength
+    return taken
+  })
+  return { appendedValues, counts }
+}
+
+describe('recipe output capture', () => {
+  it.each([0, -1, 1, 2, 3, 4, 7, 16, 255, 256, 257, 1024])(
+    'matches the old per-chunk UTF-8 tail for limit %s across varied chunk boundaries',
+    async (limit) => {
+      const random = deterministicRandom(0x19780728)
+      const alphabet = ['a', '\0', '\n', 'é', '中', '😀', '�', '́']
+      for (let sample = 0; sample < 4; sample += 1) {
+        const fixture = fakeCommand(limit)
+        let expected = ''
+        for (let index = 0; index < 80; index += 1) {
+          const chunk = Array.from(
+            { length: random(40) },
+            () => alphabet[random(alphabet.length)]
+          ).join('')
+          fixture.child.stdout.emit('data', Buffer.from(chunk, 'utf8'))
+          expected = oldAppend(expected, chunk, limit)
+        }
+        fixture.child.emit('close', 0, null)
+        await expect(fixture.result).resolves.toMatchObject({ stdout: expected, stderr: '' })
+      }
+    }
+  )
+
+  it('does not restore bytes discarded at an earlier chunk boundary', async () => {
+    const fixture = fakeCommand(5)
+    for (const chunk of ['😀', 'ab', 'c']) {
+      fixture.child.stdout.emit('data', Buffer.from(chunk, 'utf8'))
+    }
+    fixture.child.emit('close', 0, null)
+    await expect(fixture.result).resolves.toMatchObject({ stdout: 'abc' })
+  })
+
+  it.each([1, 7, 31, 255, 4097])(
+    'retains the same code-point tail for limit %s wherever byte boundaries fall',
+    async (limit) => {
+      const random = deterministicRandom(0x5eed1234 + limit)
+      let text = ''
+      for (let index = 0; index < 2000; index += 1) {
+        text += index % 29 === 0 ? 'a中😀é'.repeat(200) : ['x', '😀', '中', 'é'][index % 4]
+      }
+      const bytes = Buffer.from(text, 'utf8')
+      const fixture = fakeCommand(limit)
+      // Split mid-character on purpose: retention is over raw bytes, so the tail must not depend on it.
+      for (let cursor = 0; cursor < bytes.byteLength;) {
+        const size = Math.min(1 + random(2048), bytes.byteLength - cursor)
+        fixture.child.stdout.emit('data', bytes.subarray(cursor, cursor + size))
+        cursor += size
+      }
+      fixture.child.emit('close', 0, null)
+      const result = await fixture.result
+      expect(result.stdout).toBe(codePointTail(text, limit))
+      expect(Buffer.byteLength(result.stdout, 'utf8')).toBeLessThanOrEqual(limit)
+    }
+  )
+
+  it('preserves stream decoding, callback boundaries and independent tails', async () => {
+    const fixture = fakeCommand(9)
+    const stdoutBytes = Buffer.from('α😀中文invalid:�:end')
+    const stderrBytes = Buffer.from('stderr:\n😀!')
+    const malformed = Buffer.from([0xff, 0xe2, 0x28, 0xa1])
+    for (const byte of stdoutBytes) {
+      fixture.child.stdout.write(Buffer.from([byte]))
+    }
+    for (const byte of stderrBytes) {
+      fixture.child.stderr.write(Buffer.from([byte]))
+    }
+    fixture.child.stdout.write(malformed)
+    fixture.child.emit('close', 17, null)
+    const result = await fixture.result
+    // Callbacks still see exactly what setEncoding('utf8') produced, split character by character.
+    expect(fixture.stdoutChunks.join('')).toBe(`${stdoutBytes.toString()}��(�`)
+    expect(fixture.stderrChunks.join('')).toBe(stderrBytes.toString())
+    // The tail is now the last 9 raw bytes rather than the last 9 bytes of re-encoded replacement
+    // characters, so malformed output keeps more of what the recipe actually wrote.
+    expect(result).toEqual({
+      stdout: rawByteTail(Buffer.concat([stdoutBytes, malformed]), 9),
+      stderr: rawByteTail(stderrBytes, 9),
+      exitCode: 17,
+      signal: null
+    })
+    expect(result.stdout).toBe(':end��(�')
+  })
+
+  it('moves at most 5 MiB through the capture for 4 MiB of output', async () => {
+    const fixture = fakeCommand()
+    const chunk = Buffer.from('a'.repeat(4096))
+    const { appendedValues, counts } = countCaptureWork()
+    for (let index = 0; index < 1024; index += 1) {
+      fixture.child.stdout.emit('data', chunk)
+    }
+    fixture.child.emit('close', 0, null)
+    const result = await fixture.result
+    expect(result.stdout).toBe('a'.repeat(1024 * 1024))
+    expect(fixture.stdoutChunks).toHaveLength(1024)
+    // The pre-ring policy re-encoded the retained tail per chunk: 943,194,112 bytes for this input.
+    expect(counts.appendedBytes + counts.decodedBytes).toBeLessThanOrEqual(5 * 1024 * 1024)
+    expect(counts.appendedBytes).toBe(4 * 1024 * 1024)
+    expect(counts.decodedBytes).toBe(1024 * 1024)
+    // Nothing is encoded: the capture stores the very Buffers the stream delivered.
+    expect(appendedValues.every((value) => value === chunk)).toBe(true)
+  })
+
+  it('returns the captured tails when cancellation needs force-kill', async () => {
+    vi.useFakeTimers()
+    const controller = new AbortController()
+    const fixture = fakeCommand(6, controller.signal)
+    fixture.child.stdout.emit('data', Buffer.from('abc😀Z'))
+    fixture.child.stderr.emit('data', Buffer.from('error tail'))
+    controller.abort()
+    fixture.child.stdout.emit('data', Buffer.from('!'))
+    await vi.advanceTimersByTimeAsync(5000)
+    await expect(fixture.result).resolves.toEqual({
+      stdout: '😀Z!',
+      stderr: 'r tail',
+      exitCode: null,
+      signal: null,
+      aborted: true
+    })
+    expect(fixture.child.kill.mock.calls).toEqual([['SIGTERM'], ['SIGKILL']])
+    expect(fixture.child.unref).toHaveBeenCalledOnce()
+  })
+
+  it('preserves failures after output and synchronous spawn errors', async () => {
+    const fixture = fakeCommand(5)
+    const error = new Error('recipe failed')
+    fixture.child.stdout.emit('data', Buffer.from('earlier output'))
+    fixture.child.emit('error', error)
+    await expect(fixture.result).rejects.toBe(error)
+    fixture.child.emit('close', 1, null)
+    await expect(
+      runRecipeCommand({
+        command: 'synthetic-recipe',
+        repoPath: process.cwd(),
+        context: { recipeId: 'fixture', repoPath: process.cwd() },
+        mode: 'create',
+        resultSchemaVersion: 1,
+        spawnCommand: () => {
+          throw error
+        }
+      })
+    ).rejects.toBe(error)
+  })
+
+  it.each(['close', 'error'])(
+    'releases capture storage after %s while preserving late callbacks',
+    async (event) => {
+      if (!global.gc) {
+        throw new Error('This regression requires --expose-gc')
+      }
+      const fixture = fakeCommand(128 * 1024)
+      const allocations: WeakRef<Buffer>[] = []
+      const allocUnsafe = Buffer.allocUnsafe
+      const allocationSpy = vi.spyOn(Buffer, 'allocUnsafe').mockImplementation((size) => {
+        const bytes = allocUnsafe(size)
+        allocations.push(new WeakRef(bytes))
+        return bytes
+      })
+      for (let index = 0; index < 3; index++) {
+        fixture.child.stdout.emit('data', Buffer.from('a'.repeat(4096)))
+        fixture.child.stderr.emit('data', Buffer.from('b'.repeat(4096)))
+      }
+      allocationSpy.mockRestore()
+      if (event === 'error') {
+        fixture.child.emit('error', new Error('recipe failed'))
+        await expect(fixture.result).rejects.toThrow('recipe failed')
+      } else {
+        fixture.child.emit('close', 0, null)
+        await expect(fixture.result).resolves.toMatchObject({
+          stdout: 'a'.repeat(3 * 4096),
+          stderr: 'b'.repeat(3 * 4096)
+        })
+      }
+      for (let turn = 0; turn < 3; turn++) {
+        await setImmediate()
+        global.gc()
+      }
+      expect(allocations.length).toBeGreaterThan(0)
+      expect(allocations.filter((ref) => ref.deref() !== undefined)).toHaveLength(0)
+      const { counts } = countCaptureWork()
+      fixture.child.stdout.emit('data', Buffer.from('late stdout'))
+      fixture.child.stderr.emit('data', Buffer.from('late stderr'))
+      fixture.child.emit('close', 1, null)
+      expect(counts).toEqual({ appendedBytes: 0, decodedBytes: 0, decodeCalls: 0 })
+      expect(fixture.stdoutChunks.at(-1)).toBe('late stdout')
+      expect(fixture.stderrChunks.at(-1)).toBe('late stderr')
+    }
+  )
+
+  it('decodes once per stream when force-kill closes synchronously', async () => {
+    vi.useFakeTimers()
+    const controller = new AbortController()
+    const fixture = fakeCommand(8, controller.signal)
+    fixture.child.kill.mockImplementation((signal) => {
+      if (signal === 'SIGKILL') {
+        fixture.child.emit('close', null, 'SIGKILL')
+      }
+      return true
+    })
+    fixture.child.stdout.emit('data', Buffer.from('before😀'))
+    const { counts } = countCaptureWork()
+    controller.abort()
+    await vi.advanceTimersByTimeAsync(5000)
+    await expect(fixture.result).resolves.toEqual({
+      stdout: 'fore😀',
+      stderr: '',
+      exitCode: null,
+      signal: 'SIGKILL',
+      aborted: true
+    })
+    expect(vi.getTimerCount()).toBe(0)
+    expect(counts.decodeCalls).toBe(2)
+  })
+
+  it.each([
+    { limit: undefined, expected: DEFAULT_MAX_CAPTURE_BYTES },
+    { limit: 1024, expected: 1024 },
+    { limit: 1.5, expected: 1 },
+    { limit: 4.5, expected: 4 },
+    { limit: 0, expected: 0 },
+    { limit: -1, expected: 0 },
+    { limit: -Infinity, expected: 0 },
+    { limit: Number.NaN, expected: DEFAULT_MAX_CAPTURE_BYTES },
+    { limit: Infinity, expected: DEFAULT_MAX_CAPTURE_BYTES },
+    { limit: Number.MAX_VALUE, expected: DEFAULT_MAX_CAPTURE_BYTES }
+  ])('clamps a $limit capture limit to a bounded byte count', ({ limit, expected }) => {
+    expect(clampRecipeCaptureBytes(limit)).toBe(expected)
+  })
+})
diff --git a/src/shared/ephemeral-vm-recipe-process.ts b/src/shared/ephemeral-vm-recipe-process.ts
index 30d44ac1dbce..e943567095c0 100644
--- a/src/shared/ephemeral-vm-recipe-process.ts
+++ b/src/shared/ephemeral-vm-recipe-process.ts
@@ -1,8 +1,10 @@
 import { spawn, type ChildProcessWithoutNullStreams } from 'node:child_process'
+import { StringDecoder } from 'node:string_decoder'
 import type { EphemeralVmRecipeContext } from './ephemeral-vm-recipe-runner'
 import { admitProcessTreeKill } from './child-process/process-tree-kill-gate'
+import { GrowingByteBuffer } from './growing-byte-buffer'
 
-const DEFAULT_MAX_CAPTURE_BYTES = 1024 * 1024
+export const DEFAULT_MAX_CAPTURE_BYTES = 1024 * 1024
 const CANCEL_FORCE_KILL_DELAY_MS = 5_000
 
 export type ProcessRunResult = {
@@ -37,7 +39,7 @@ export async function runRecipeCommand(args: {
   onStderr?: (chunk: string) => void
   spawnCommand?: typeof spawn
 }): Promise<ProcessRunResult> {
-  const maxBytes = args.maxCaptureBytes ?? DEFAULT_MAX_CAPTURE_BYTES
+  const maxBytes = clampRecipeCaptureBytes(args.maxCaptureBytes)
   const spawnCommand = args.spawnCommand ?? spawn
 
   return new Promise((resolve, reject) => {
@@ -55,12 +57,12 @@ export async function runRecipeCommand(args: {
       return
     }
 
-    let stdout = ''
-    let stderr = ''
+    const stdout = new GrowingByteBuffer()
+    const stderr = new GrowingByteBuffer()
     let settled = false
     let aborted = false
     let forceKillTimer: ReturnType<typeof setTimeout> | undefined
-    const finish = (result: ProcessRunResult): void => {
+    const finish = (result: Omit<ProcessRunResult, 'stdout' | 'stderr'>): void => {
       if (settled) {
         return
       }
@@ -69,7 +71,7 @@ export async function runRecipeCommand(args: {
         clearTimeout(forceKillTimer)
       }
       args.signal?.removeEventListener('abort', abort)
-      resolve(result)
+      resolve({ stdout: takeRetainedTail(stdout), stderr: takeRetainedTail(stderr), ...result })
     }
     const fail = (error: Error): void => {
       if (settled) {
@@ -80,6 +82,8 @@ export async function runRecipeCommand(args: {
         clearTimeout(forceKillTimer)
       }
       args.signal?.removeEventListener('abort', abort)
+      stdout.clear()
+      stderr.clear()
       reject(error)
     }
     const abort = (): void => {
@@ -92,7 +96,7 @@ export async function runRecipeCommand(args: {
           return
         }
         killRecipeProcess(child, true)
-        finish({ stdout, stderr, exitCode: null, signal: null, aborted: true })
+        finish({ exitCode: null, signal: null, aborted: true })
         child.stdin.destroy()
         child.stdout.destroy()
         child.stderr.destroy()
@@ -102,21 +106,37 @@ export async function runRecipeCommand(args: {
       killRecipeProcess(child)
     }
 
-    child.stdout.setEncoding('utf8')
-    child.stderr.setEncoding('utf8')
-    child.stdout.on('data', (chunk: string) => {
-      stdout = appendBounded(stdout, chunk, maxBytes)
-      args.onStdout?.(chunk)
-    })
-    child.stderr.on('data', (chunk: string) => {
-      stderr = appendBounded(stderr, chunk, maxBytes)
-      args.onStderr?.(chunk)
-    })
+    // No setEncoding: the retained tail stays raw bytes, and a per-stream StringDecoder gives the
+    // callbacks the same character boundaries setEncoding would have (it uses the same decoder).
+    const stdoutDecoder = new StringDecoder('utf8')
+    const stderrDecoder = new StringDecoder('utf8')
+    const capture = (
+      buffer: GrowingByteBuffer,
+      decoder: StringDecoder,
+      chunk: Buffer,
+      forward: ((chunk: string) => void) | undefined
+    ): void => {
+      if (!settled) {
+        buffer.appendRetainedSuffix(chunk, maxBytes)
+      }
+      if (!forward) {
+        return
+      }
+      const decoded = decoder.write(chunk)
+      if (decoded.length > 0) {
+        forward(decoded)
+      }
+    }
+    child.stdout.on('data', (chunk: Buffer) => capture(stdout, stdoutDecoder, chunk, args.onStdout))
+    child.stderr.on('data', (chunk: Buffer) => capture(stderr, stderrDecoder, chunk, args.onStderr))
+    // setEncoding flushes its decoder at end-of-stream; keep that final replacement character.
+    child.stdout.on('end', () => flushDecoder(stdoutDecoder, args.onStdout))
+    child.stderr.on('end', () => flushDecoder(stderrDecoder, args.onStderr))
     child.on('error', (error) => {
       fail(error)
     })
     child.on('close', (exitCode, signal) => {
-      finish({ stdout, stderr, exitCode, signal, ...(aborted ? { aborted: true } : {}) })
+      finish({ exitCode, signal, ...(aborted ? { aborted: true } : {}) })
     })
 
     if (args.signal?.aborted) {
@@ -133,6 +153,38 @@ export async function runRecipeCommand(args: {
   })
 }
 
+/** No production caller overrides the cap, so odd values are clamped rather than coerced per chunk. */
+export function clampRecipeCaptureBytes(value: number | undefined): number {
+  if (value === undefined || Number.isNaN(value)) {
+    return DEFAULT_MAX_CAPTURE_BYTES
+  }
+  if (value <= 0) {
+    return 0
+  }
+  const floored = Math.floor(value)
+  return Number.isSafeInteger(floored) ? floored : DEFAULT_MAX_CAPTURE_BYTES
+}
+
+// Retention cuts on a byte boundary, so drop the partial sequence the old per-chunk trim removed.
+function takeRetainedTail(buffer: GrowingByteBuffer): string {
+  const bytes = buffer.takeBuffer()
+  let start = 0
+  while (start < bytes.byteLength && (bytes[start]! & 0xc0) === 0x80) {
+    start += 1
+  }
+  return bytes.toString('utf8', start)
+}
+
+function flushDecoder(
+  decoder: StringDecoder,
+  forward: ((chunk: string) => void) | undefined
+): void {
+  const trailing = decoder.end()
+  if (trailing.length > 0) {
+    forward?.(trailing)
+  }
+}
+
 /** Exported for the refusal-fallback test; the abort path is otherwise unreachable. */
 export function killRecipeProcess(child: ChildProcessWithoutNullStreams, force = false): void {
   const signal = force ? 'SIGKILL' : 'SIGTERM'
@@ -199,26 +251,3 @@ function buildRecipeEnv(
     ORCA_VERSION: context.orcaVersion ?? ''
   }
 }
-
-function appendBounded(current: string, chunk: string, maxBytes: number): string {
-  if (maxBytes <= 0) {
-    return ''
-  }
-  const chunkBytes = Buffer.byteLength(chunk, 'utf8')
-  if (chunkBytes >= maxBytes) {
-    return utf8Tail(chunk, maxBytes)
-  }
-  return utf8Tail(current, maxBytes - chunkBytes) + chunk
-}
-
-function utf8Tail(value: string, maxBytes: number): string {
-  const bytes = Buffer.from(value, 'utf8')
-  if (bytes.byteLength <= maxBytes) {
-    return value
-  }
-  let start = bytes.byteLength - maxBytes
-  while (start < bytes.byteLength && (bytes[start]! & 0xc0) === 0x80) {
-    start += 1
-  }
-  return bytes.subarray(start).toString('utf8')
-}
diff --git a/src/shared/feature-tips.test.ts b/src/shared/feature-tips.test.ts
index 4513f94744a2..0f77af1e5258 100644
--- a/src/shared/feature-tips.test.ts
+++ b/src/shared/feature-tips.test.ts
@@ -11,12 +11,22 @@ describe('feature tips', () => {
   it('orders new unseen tips before older unseen tips', () => {
     const tips = getOrderedUnseenFeatureTips({ seenTipIds: new Set<FeatureTipId>() })
 
-    expect(tips.map((tip) => tip.id)).toEqual(['orca-cli', 'cmd-j-palette', 'voice-dictation'])
+    expect(tips.map((tip) => tip.id)).toEqual([
+      'agent-session-search',
+      'orca-cli',
+      'cmd-j-palette',
+      'voice-dictation'
+    ])
   })
 
   it('skips tips the user has already seen', () => {
     const tips = getOrderedUnseenFeatureTips({
-      seenTipIds: new Set<FeatureTipId>(['voice-dictation', 'orca-cli', 'cmd-j-palette'])
+      seenTipIds: new Set<FeatureTipId>([
+        'voice-dictation',
+        'orca-cli',
+        'cmd-j-palette',
+        'agent-session-search'
+      ])
     })
 
     expect(tips.map((tip) => tip.id)).toEqual([])
@@ -28,7 +38,8 @@ describe('feature tips', () => {
       seenTipIds: new Set<FeatureTipId>(['cmd-j-palette']),
       completedTipIds: getCompletedFeatureTipIds({
         cliInstalled: true,
-        voiceDictationEnabled: true
+        voiceDictationEnabled: true,
+        sessionSearchTipCompleted: true
       })
     })
 
@@ -40,7 +51,8 @@ describe('feature tips', () => {
       seenTipIds: new Set<FeatureTipId>(['voice-dictation', 'cmd-j-palette']),
       completedTipIds: getCompletedFeatureTipIds({
         cliInstalled: true,
-        voiceDictationEnabled: false
+        voiceDictationEnabled: false,
+        sessionSearchTipCompleted: true
       })
     })
 
@@ -53,6 +65,7 @@ describe('feature tips', () => {
       completedTipIds: getCompletedFeatureTipIds({
         cliInstalled: false,
         voiceDictationEnabled: false,
+        sessionSearchTipCompleted: true,
         featureInteractions: {
           'voice-dictation': { firstInteractedAt: 100, interactionCount: 1 }
         }
diff --git a/src/shared/feature-tips.ts b/src/shared/feature-tips.ts
index a9712d6d4327..b77f0ce39068 100644
--- a/src/shared/feature-tips.ts
+++ b/src/shared/feature-tips.ts
@@ -4,11 +4,15 @@ import {
   type FeatureInteractionState
 } from './feature-interactions'
 
-export type FeatureTipId = 'voice-dictation' | 'orca-cli' | 'cmd-j-palette'
+export type FeatureTipId = 'voice-dictation' | 'orca-cli' | 'cmd-j-palette' | 'agent-session-search'
 
 export type FeatureTipPriority = 'new' | 'unseen'
 
-export type FeatureTipAction = 'enable-voice' | 'setup-cli' | 'learn-cmd-j-palette'
+export type FeatureTipAction =
+  | 'enable-voice'
+  | 'setup-cli'
+  | 'learn-cmd-j-palette'
+  | 'enable-session-search'
 
 export type FeatureTip = {
   id: FeatureTipId
@@ -25,10 +29,23 @@ export type FeatureTip = {
 export type CompletedFeatureTipState = {
   cliInstalled: boolean
   voiceDictationEnabled: boolean
+  /** Search is on, or this client cannot turn it on. */
+  sessionSearchTipCompleted: boolean
   featureInteractions?: FeatureInteractionState
 }
 
 export const FEATURE_TIPS = [
+  {
+    id: 'agent-session-search',
+    priority: 'new',
+    eyebrow: 'New',
+    title: 'Search every agent session',
+    description:
+      'Find any past conversation by what was said in it, then pick up where the agent left off.',
+    action: 'enable-session-search',
+    ctaLabel: 'Turn on session search',
+    completedByFeatureInteractions: []
+  },
   {
     id: 'orca-cli',
     priority: 'new',
@@ -92,6 +109,9 @@ export function getCompletedFeatureTipIds(state: CompletedFeatureTipState): Set<
   if (state.voiceDictationEnabled) {
     completedIds.add('voice-dictation')
   }
+  if (state.sessionSearchTipCompleted) {
+    completedIds.add('agent-session-search')
+  }
   for (const tip of FEATURE_TIPS) {
     if (
       tip.completedByFeatureInteractions?.some((id) =>
diff --git a/src/shared/freebuff-launch.test.ts b/src/shared/freebuff-launch.test.ts
new file mode 100644
index 000000000000..b58dc4bd0917
--- /dev/null
+++ b/src/shared/freebuff-launch.test.ts
@@ -0,0 +1,58 @@
+import { describe, expect, it } from 'vitest'
+import { buildAgentDraftLaunchPlan, buildAgentStartupPlan } from './tui-agent-startup'
+import { isExpectedAgentProcess, recognizeAgentProcess } from './agent-process-recognition'
+import { pickTuiAgent } from './tui-agent-selection'
+
+describe('Freebuff terminal launches', () => {
+  it.each(['darwin', 'linux', 'win32'] as const)(
+    'delivers task text through the interactive terminal on %s',
+    (platform) => {
+      const prompt = '--help\nFix "quoted" paths and $HOME handling'
+      const plan = buildAgentStartupPlan({
+        agent: 'freebuff',
+        prompt,
+        cmdOverrides: {},
+        platform
+      })
+      expect(plan).toMatchObject({
+        launchCommand: 'freebuff',
+        expectedProcess: 'freebuff',
+        followupPrompt: prompt
+      })
+      expect(
+        buildAgentDraftLaunchPlan({
+          agent: 'freebuff',
+          draft: prompt,
+          cmdOverrides: {},
+          platform
+        })
+      ).toBeNull()
+    }
+  )
+
+  it('uses the same launch contract on SSH hosts', () => {
+    expect(
+      buildAgentStartupPlan({
+        agent: 'freebuff',
+        prompt: 'Inspect this folder',
+        cmdOverrides: {},
+        platform: 'linux',
+        isRemote: true
+      })
+    ).toMatchObject({ launchCommand: 'freebuff', followupPrompt: 'Inspect this folder' })
+  })
+
+  it.each(['/usr/local/bin/freebuff', 'C:\\tools\\freebuff.exe'])(
+    'recognizes %s separately from Codebuff',
+    (processName) => {
+      expect(recognizeAgentProcess(processName)?.agent).toBe('freebuff')
+      expect(isExpectedAgentProcess(processName, 'codebuff')).toBe(false)
+    }
+  )
+
+  it('honors independent installation and disabled-agent preferences', () => {
+    expect(pickTuiAgent('freebuff', ['freebuff', 'codebuff'])).toBe('freebuff')
+    expect(pickTuiAgent(null, ['freebuff'])).toBe('freebuff')
+    expect(pickTuiAgent('freebuff', ['freebuff', 'codebuff'], ['freebuff'])).toBe('codebuff')
+  })
+})
diff --git a/src/shared/freebuff-screen-status.ts b/src/shared/freebuff-screen-status.ts
new file mode 100644
index 000000000000..e5f18472a7d4
--- /dev/null
+++ b/src/shared/freebuff-screen-status.ts
@@ -0,0 +1,152 @@
+import type { ParsedAgentStatusPayload } from './agent-status-types'
+import { extractLastOscTitle } from './osc-title-extraction'
+import { extractOscTitleScanTail } from './osc-title-scan-tail'
+import { advancePartialEscapeTail } from './terminal-partial-escape-tail'
+
+export function splitFreebuffScreenUpdates(data: string, pendingEscape: string): string[] {
+  const input = pendingEscape + data
+  const chunks: string[] = []
+  let start = 0
+  // oxlint-disable-next-line no-control-regex -- Terminal protocol delimiters contain ESC and BEL.
+  for (const match of input.matchAll(/\x1b\[\?2026l/g)) {
+    const end = match.index + match[0].length - pendingEscape.length
+    if (end > start) {
+      chunks.push(data.slice(start, end))
+    }
+    start = Math.max(start, end)
+  }
+  if (start < data.length) {
+    chunks.push(data.slice(start))
+  }
+  return chunks
+}
+
+function cleanBoxLine(line: string): string {
+  return line.replace(/^[│┃\s]+|[│┃\s]+$/g, '').trim()
+}
+
+/** Reads the live composer area, never status words in the conversation above it. */
+export function readFreebuffScreenStatus(
+  lines: readonly string[],
+  alternate: boolean
+): Omit<ParsedAgentStatusPayload, 'prompt' | 'agentType'> | null {
+  const text = lines.join('\n')
+  if (!alternate) {
+    if (
+      /freebuff found agent files in this repository/.test(text) &&
+      /Load and run these\? \[y\/N\]/.test(text)
+    ) {
+      return { state: 'blocked', toolInput: 'Trust repository agent files? [y/N]' }
+    }
+    return null
+  }
+  if (/Press ENTER to login\.\.\./.test(text)) {
+    return { state: 'blocked', toolInput: 'Sign in to Freebuff' }
+  }
+  const footer = lines.findLastIndex((line) => /\/model\s+to change.*Chat:/.test(line))
+  if (footer === -1) {
+    return null
+  }
+  const dialog = lines.findLastIndex((line) => /[╭─].*Some questions for you.*[─╮]/.test(line))
+  if (
+    dialog !== -1 &&
+    dialog < footer &&
+    /↑↓ navigate/.test(lines.slice(dialog, footer).join('\n'))
+  ) {
+    const body = lines.slice(dialog + 1, footer).map(cleanBoxLine)
+    const question = body.find((line) => /^[▼▶▸▾►]/.test(line))?.replace(/^[▼▶▸▾►]\s*/, '')
+    const options = body.flatMap((line) => {
+      const match = /^[○●]\s+(.+)$/.exec(line)
+      return match ? [{ label: match[1], description: '' }] : []
+    })
+    return {
+      state: 'waiting',
+      toolName: 'ask_user',
+      toolInput: question ?? 'Freebuff is waiting for an answer',
+      ...(question
+        ? { interactivePrompt: JSON.stringify({ questions: [{ question, options }] }) }
+        : {})
+    }
+  }
+  const composerTop = lines.findLastIndex(
+    (line, index) => index < footer && /^\s*╭─+╮\s*$/.test(line)
+  )
+  if (composerTop === -1 || footer - composerTop > 12) {
+    return null
+  }
+  const status = lines[composerTop - 1]?.trim() ?? ''
+  if (
+    /^(?:thinking|working|connecting|retrying)\.\.\./.test(status) ||
+    status.startsWith('high demand — in line')
+  ) {
+    return { state: 'working' }
+  }
+  if (status === '' && text.includes('Your first message starts the session.')) {
+    return { state: 'done', sessionBoundary: true }
+  }
+  if (/^(?:\d+[hms]\s*)+left\b|^unlimited\b/.test(status) && /End session/.test(status)) {
+    return { state: 'done' }
+  }
+  return null
+}
+
+/** One observation stream per execution-host terminal; recreated with its screen model. */
+export class FreebuffScreenStatusTracker {
+  private titleTail = ''
+  private frameTail = ''
+  private insideFrame = false
+  private identified: boolean
+  private prompt = ''
+  private previous: string | null = null
+  private worked = false
+
+  constructor(identified = false) {
+    this.identified = identified
+  }
+
+  observe(
+    data: string,
+    readScreen: () => { lines: readonly string[]; alternate: boolean }
+  ): ParsedAgentStatusPayload | null {
+    const titleInput = this.titleTail + data
+    this.titleTail = extractOscTitleScanTail(titleInput)
+    const title = extractLastOscTitle(titleInput)
+    if (title?.startsWith('Freebuff: ')) {
+      this.identified = true
+      this.prompt = title.slice('Freebuff: '.length)
+    }
+    const frameInput = this.frameTail + data
+    // oxlint-disable-next-line no-control-regex -- Terminal protocol delimiters contain ESC and BEL.
+    for (const match of frameInput.matchAll(/\x1b\[\?2026([hl])/g)) {
+      this.insideFrame = match[1] === 'h'
+    }
+    this.frameTail = advancePartialEscapeTail(this.frameTail, data)
+    if (!this.identified || this.insideFrame || this.frameTail.length > 0) {
+      return null
+    }
+    const { lines, alternate } = readScreen()
+    const result = readFreebuffScreenStatus(lines, alternate)
+    if (!result) {
+      return null
+    }
+    if (result.sessionBoundary) {
+      this.prompt = ''
+      this.worked = false
+    }
+    const payload: ParsedAgentStatusPayload = {
+      ...result,
+      agentType: 'freebuff',
+      prompt: this.prompt,
+      ...(result.state === 'done' && !this.worked ? { sessionBoundary: true } : {})
+    }
+    if (result.state === 'working' || result.state === 'waiting') {
+      this.worked = true
+    }
+    const signature = JSON.stringify(payload)
+    if (signature === this.previous) {
+      return null
+    }
+    this.previous = signature
+    return payload
+  }
+}
diff --git a/src/shared/freebuff-startup.test.ts b/src/shared/freebuff-startup.test.ts
new file mode 100644
index 000000000000..2d614c53d1a4
--- /dev/null
+++ b/src/shared/freebuff-startup.test.ts
@@ -0,0 +1,56 @@
+import { describe, expect, it } from 'vitest'
+import { buildAgentStartupPlan } from './tui-agent-startup'
+
+describe('Freebuff startup', () => {
+  it.each([
+    ['darwin', 'posix', false],
+    ['linux', 'posix', false],
+    ['win32', 'powershell', false],
+    ['win32', 'cmd', false],
+    ['linux', 'posix', true]
+  ] as const)('delivers prompts after launch on %s/%s (remote=%s)', (platform, shell, isRemote) => {
+    const prompt = 'Review "quoted paths"; $(echo task)\nThen explain the changes.'
+    const plan = buildAgentStartupPlan({
+      agent: 'freebuff',
+      prompt,
+      cmdOverrides: { codebuff: 'codebuff --debug' },
+      platform,
+      shell,
+      isRemote
+    })
+
+    expect(plan).toMatchObject({
+      agent: 'freebuff',
+      launchCommand: 'freebuff',
+      expectedProcess: 'freebuff',
+      followupPrompt: prompt
+    })
+  })
+
+  it('keeps Freebuff command overrides separate from Codebuff', () => {
+    const cmdOverrides = { freebuff: 'freebuff --debug' }
+    const freebuff = buildAgentStartupPlan({
+      agent: 'freebuff',
+      prompt: '',
+      allowEmptyPromptLaunch: true,
+      cmdOverrides,
+      platform: 'linux',
+      isRemote: true
+    })
+    const codebuff = buildAgentStartupPlan({
+      agent: 'codebuff',
+      prompt: '',
+      allowEmptyPromptLaunch: true,
+      cmdOverrides,
+      platform: 'linux',
+      isRemote: true
+    })
+
+    expect(freebuff).toMatchObject({
+      launchCommand: 'freebuff --debug',
+      expectedProcess: 'freebuff',
+      followupPrompt: null
+    })
+    expect(codebuff).toMatchObject({ launchCommand: 'codebuff', expectedProcess: 'codebuff' })
+  })
+})
diff --git a/src/shared/git-binary-compatibility.test.ts b/src/shared/git-binary-compatibility.test.ts
index b76814f8b83b..457dad2d4190 100644
--- a/src/shared/git-binary-compatibility.test.ts
+++ b/src/shared/git-binary-compatibility.test.ts
@@ -216,6 +216,7 @@ describeBinaryCompatibility('real Git binary compatibility', () => {
   })
 
   it('supports prepared worktree creation and finalization', async () => {
+    const head = (await runGit(['rev-parse', 'HEAD'])).stdout.trim()
     await runGit(['worktree', 'add', '--detach', '--no-checkout', 'compat-prepared', 'HEAD'])
     await runGit(['-C', 'compat-prepared', 'reset', '--hard', 'HEAD'])
     await runGit([
@@ -234,12 +235,15 @@ describeBinaryCompatibility('real Git binary compatibility', () => {
       '--no-track',
       '-b',
       'compat-prepared-final',
-      'HEAD'
+      head
     ])
 
     await expect(runGit(['-C', 'compat-final', 'branch', '--show-current'])).resolves.toMatchObject(
       { stdout: 'compat-prepared-final\n' }
     )
+    await expect(runGit(['-C', 'compat-final', 'rev-parse', 'HEAD'])).resolves.toMatchObject({
+      stdout: `${head}\n`
+    })
     await runGit(['worktree', 'unlock', 'compat-final'])
     await runGit(['worktree', 'remove', '--force', 'compat-final'])
     await runGit(['branch', '-D', 'compat-prepared-final'])
diff --git a/src/shared/git-remote-identity.test.ts b/src/shared/git-remote-identity.test.ts
index cc4fa4dff57f..a159f5d39d9d 100644
--- a/src/shared/git-remote-identity.test.ts
+++ b/src/shared/git-remote-identity.test.ts
@@ -51,6 +51,25 @@ describe('normalizeGitRemoteUrl', () => {
 })
 
 describe('deriveGitRemoteIdentity', () => {
+  it.each(['blob:none', 'blob:limit=1024', 'tree:0'])(
+    'prefers a partial-clone origin with filter %s over contributor remotes',
+    (filter) => {
+      expect(
+        deriveGitRemoteIdentity(
+          [
+            'amoaba\thttps://github.com/AmoabaKelvin/orca.git (fetch)',
+            `origin\thttps://github.com/stablyai/orca.git (fetch) [${filter}]`,
+            'origin\thttps://github.com/another/orca.git (push)'
+          ].join('\r\n')
+        )
+      ).toEqual({
+        canonicalKey: 'github.com/stablyai/orca',
+        remoteName: 'origin',
+        remoteUrl: 'https://github.com/stablyai/orca.git'
+      })
+    }
+  )
+
   it('prefers upstream, then origin, then the first named remote', () => {
     expect(
       deriveGitRemoteIdentity(
diff --git a/src/shared/git-remote-identity.ts b/src/shared/git-remote-identity.ts
index bc221157a2e5..c4c215e125da 100644
--- a/src/shared/git-remote-identity.ts
+++ b/src/shared/git-remote-identity.ts
@@ -95,10 +95,8 @@ export function parseGitRemoteVerboseOutput(stdout: string): GitRemoteEntry[] {
   const entries: GitRemoteEntry[] = []
   for (const rawLine of stdout.split(/\r?\n/)) {
     const line = rawLine.trim()
-    if (!line.endsWith('(fetch)')) {
-      continue
-    }
-    const match = /^(\S+)\s+(.+?)\s+\(fetch\)$/.exec(line)
+    // Partial clones append their object filter after the fetch marker.
+    const match = /^(\S+)\s+(.+?)\s+\(fetch\)(?:\s+\[[^\]\r\n]*\])?$/.exec(line)
     if (!match) {
       continue
     }
diff --git a/src/shared/growing-byte-buffer.test.ts b/src/shared/growing-byte-buffer.test.ts
index 731da290c053..988d63bb2ae9 100644
--- a/src/shared/growing-byte-buffer.test.ts
+++ b/src/shared/growing-byte-buffer.test.ts
@@ -65,4 +65,31 @@ describe('GrowingByteBuffer', () => {
 
     expect(buffer.toString()).toBe('345678')
   })
+
+  it('reads and writes correctly after the head offset has advanced', () => {
+    const buffer = new GrowingByteBuffer()
+    buffer.append(Buffer.from('aaa\nbbb\nccc'))
+
+    expect(buffer.takePrefixString(buffer.indexOfByte(0x0a))).toBe('aaa')
+    buffer.discardPrefix(1)
+    expect(buffer.indexOfByte(0x0a)).toBe(3)
+    expect(buffer.byteLength).toBe(7)
+    buffer.append(Buffer.from('!'))
+    expect(buffer.toString()).toBe('bbb\nccc!')
+    expect(buffer.takeBuffer()).toEqual(Buffer.from('bbb\nccc!'))
+    expect(buffer.byteLength).toBe(0)
+  })
+
+  it('keeps a bounded suffix stable across many small appends without unbounded growth', () => {
+    const buffer = new GrowingByteBuffer()
+    let expected = ''
+    for (let index = 0; index < 5_000; index += 1) {
+      const chunk = String(index % 10).repeat(3)
+      buffer.appendRetainedSuffix(Buffer.from(chunk), 64)
+      expected = (expected + chunk).slice(-64)
+    }
+
+    expect(buffer.byteLength).toBe(64)
+    expect(buffer.takeString()).toBe(expected)
+  })
 })
diff --git a/src/shared/growing-byte-buffer.ts b/src/shared/growing-byte-buffer.ts
index beba2cd02d68..bbcdab4ba309 100644
--- a/src/shared/growing-byte-buffer.ts
+++ b/src/shared/growing-byte-buffer.ts
@@ -1,5 +1,7 @@
 export class GrowingByteBuffer {
   private storage = Buffer.alloc(0)
+  // Live bytes are storage[start, start + length); the head offset keeps prefix discards O(1).
+  private start = 0
   private length = 0
 
   get byteLength(): number {
@@ -11,16 +13,13 @@ export class GrowingByteBuffer {
       return
     }
     const required = this.length + bytes.byteLength
-    if (required > this.storage.byteLength) {
-      const capacity = Math.max(required, Math.max(256, this.storage.byteLength * 2))
-      const next = Buffer.allocUnsafe(capacity)
-      this.storage.copy(next, 0, 0, this.length)
-      this.storage = next
+    if (this.start + required > this.storage.byteLength) {
+      this.reclaimHeadRoom(required)
     }
     const source = Buffer.isBuffer(bytes)
       ? bytes
       : Buffer.from(bytes.buffer, bytes.byteOffset, bytes.byteLength)
-    source.copy(this.storage, this.length)
+    source.copy(this.storage, this.start + this.length)
     this.length = required
   }
 
@@ -37,26 +36,23 @@ export class GrowingByteBuffer {
       : Buffer.from(bytes.buffer, bytes.byteOffset, bytes.byteLength)
     if (source.byteLength >= maxBytes) {
       this.storage = Buffer.from(source.subarray(source.byteLength - maxBytes))
+      this.start = 0
       this.length = maxBytes
       return
     }
-    const retainedBytes = Math.min(this.length, maxBytes - source.byteLength)
-    if (retainedBytes < this.length) {
-      this.storage.copy(this.storage, 0, this.length - retainedBytes, this.length)
-      this.length = retainedBytes
-    }
+    this.retainSuffix(maxBytes - source.byteLength)
     this.append(source)
   }
 
   indexOfByte(value: number, byteOffset = 0): number {
-    return this.storage.subarray(0, this.length).indexOf(value, byteOffset)
+    return this.storage.subarray(this.start, this.start + this.length).indexOf(value, byteOffset)
   }
 
   takePrefixString(byteLength: number, encoding: BufferEncoding = 'utf8'): string {
     if (!Number.isSafeInteger(byteLength) || byteLength < 0 || byteLength > this.length) {
       throw new RangeError('Prefix length exceeds retained bytes')
     }
-    const value = this.storage.toString(encoding, 0, byteLength)
+    const value = this.storage.toString(encoding, this.start, this.start + byteLength)
     this.discardPrefix(byteLength)
     return value
   }
@@ -65,11 +61,11 @@ export class GrowingByteBuffer {
     if (!Number.isSafeInteger(byteLength) || byteLength < 0 || byteLength > this.length) {
       throw new RangeError('Prefix length exceeds retained bytes')
     }
-    if (byteLength === 0) {
-      return
-    }
-    this.storage.copy(this.storage, 0, byteLength, this.length)
+    this.start += byteLength
     this.length -= byteLength
+    if (this.length === 0) {
+      this.start = 0
+    }
   }
 
   retainSuffix(maxBytes: number): void {
@@ -79,12 +75,15 @@ export class GrowingByteBuffer {
     if (this.length <= maxBytes) {
       return
     }
-    this.storage.copy(this.storage, 0, this.length - maxBytes, this.length)
+    this.start += this.length - maxBytes
     this.length = maxBytes
+    if (this.length === 0) {
+      this.start = 0
+    }
   }
 
   toString(encoding: BufferEncoding = 'utf8'): string {
-    return this.storage.toString(encoding, 0, this.length)
+    return this.storage.toString(encoding, this.start, this.start + this.length)
   }
 
   takeString(encoding: BufferEncoding = 'utf8'): string {
@@ -95,13 +94,27 @@ export class GrowingByteBuffer {
 
   // Returns a view over the released storage, not a copy; the buffer never writes to it again.
   takeBuffer(): Buffer {
-    const value = this.storage.subarray(0, this.length)
+    const value = this.storage.subarray(this.start, this.start + this.length)
     this.clear()
     return value
   }
 
   clear(): void {
     this.storage = Buffer.alloc(0)
+    this.start = 0
     this.length = 0
   }
+
+  private reclaimHeadRoom(required: number): void {
+    // Slide the live bytes down while they fit in half the storage; only grow when they do not.
+    if (required * 2 <= this.storage.byteLength) {
+      this.storage.copy(this.storage, 0, this.start, this.start + this.length)
+    } else {
+      const capacity = Math.max(required, Math.max(256, this.storage.byteLength * 2))
+      const next = Buffer.allocUnsafe(capacity)
+      this.storage.copy(next, 0, this.start, this.start + this.length)
+      this.storage = next
+    }
+    this.start = 0
+  }
 }
diff --git a/src/shared/host-balanced-listing-scaling.test.ts b/src/shared/host-balanced-listing-scaling.test.ts
index 0a0d2a093bf3..3d33e54da849 100644
--- a/src/shared/host-balanced-listing-scaling.test.ts
+++ b/src/shared/host-balanced-listing-scaling.test.ts
@@ -8,26 +8,26 @@ it('retires exhausted host buckets from subsequent listing rounds', () => {
   ]
   const original = Map.prototype.values
   let reads = 0
-  const spy = vi
-    .spyOn(Map.prototype, 'values')
-    .mockImplementation(function (this: Map<string, number[]>) {
-      const iterator = original.call(this)
-      if (!this.has('large-host')) {
-        return iterator
-      }
-      return iterator.map(
-        (bucket: number[]) =>
-          new Proxy(bucket, {
-            get(target, key, receiver) {
-              if (typeof key === 'string' && /^\d+$/.test(key)) {
-                reads += 1
-              }
-              // oxlint-disable-next-line anti-slop/no-reflect-get -- Proxy `get` trap: only Reflect.get forwards a raw string|symbol key with the proxy receiver.
-              return Reflect.get(target, key, receiver)
+  const spy = vi.spyOn(Map.prototype, 'values').mockImplementation(function (
+    this: Map<string, number[]>
+  ) {
+    const iterator = original.call(this)
+    if (!this.has('large-host')) {
+      return iterator
+    }
+    return iterator.map(
+      (bucket: number[]) =>
+        new Proxy(bucket, {
+          get(target, key, receiver) {
+            if (typeof key === 'string' && /^\d+$/.test(key)) {
+              reads += 1
             }
-          })
-      )
-    })
+            // oxlint-disable-next-line anti-slop/no-reflect-get -- Proxy `get` trap: only Reflect.get forwards a raw string|symbol key with the proxy receiver.
+            return Reflect.get(target, key, receiver)
+          }
+        })
+    )
+  })
   let result: typeof rows
   try {
     result = selectHostBalancedPage(rows, 2000, (row) => row.host)
diff --git a/src/shared/keybindings-keyboard-layout.test.ts b/src/shared/keybindings-keyboard-layout.test.ts
index 9c23b0b52697..282c59cbb678 100644
--- a/src/shared/keybindings-keyboard-layout.test.ts
+++ b/src/shared/keybindings-keyboard-layout.test.ts
@@ -85,10 +85,18 @@ describe('keybindings', () => {
       shift: false
     }
 
-    expect(keybindingMatchesAction('app.settings', dvorakPhysicalW, 'darwin')).toBe(true)
+    expect(
+      keybindingMatchesAction('app.settings', dvorakPhysicalW, 'darwin', {
+        'app.settings': ['Mod+Comma']
+      })
+    ).toBe(true)
     expect(keybindingMatchesAction('tab.close', dvorakPhysicalW, 'darwin')).toBe(false)
     expect(keybindingMatchesAction('tab.close', dvorakPhysicalComma, 'darwin')).toBe(true)
-    expect(keybindingMatchesAction('app.settings', dvorakPhysicalComma, 'darwin')).toBe(false)
+    expect(
+      keybindingMatchesAction('app.settings', dvorakPhysicalComma, 'darwin', {
+        'app.settings': ['Mod+Comma']
+      })
+    ).toBe(false)
     expect(keybindingFromInput(dvorakPhysicalW, 'darwin')).toEqual({
       ok: true,
       value: 'Mod+Comma'
diff --git a/src/shared/keybindings/definitions-core-1.ts b/src/shared/keybindings/definitions-core-1.ts
index fe8797c76840..fb151bc495a8 100644
--- a/src/shared/keybindings/definitions-core-1.ts
+++ b/src/shared/keybindings/definitions-core-1.ts
@@ -18,7 +18,8 @@ export const KEYBINDING_DEFINITION_CORE_1: readonly KeybindingDefinition[] = [
     group: 'Global',
     scope: 'global',
     searchKeywords: ['shortcut', 'settings', 'preferences'],
-    defaultBindings: platformBindings(['Mod+Comma']),
+    // Leave Cmd/Ctrl+, to terminal apps such as Codex unless the user opts in.
+    defaultBindings: platformBindings([]),
     conflictGroup: 'menu'
   },
   {
diff --git a/src/shared/linear/links.test.ts b/src/shared/linear/links.test.ts
index 48005d93d062..71148426e740 100644
--- a/src/shared/linear/links.test.ts
+++ b/src/shared/linear/links.test.ts
@@ -49,6 +49,18 @@ describe('linear links', () => {
     expect(parseLinearIssueInput('eng-123')).toEqual({ identifier: 'ENG-123' })
   })
 
+  it('parses Linear team keys that start with a digit', () => {
+    expect(parseLinearIssueInput('4k-12')).toEqual({ identifier: '4K-12' })
+    expect(parseLinearIssueInput('https://linear.app/acme/issue/4K-12')).toEqual({
+      identifier: '4K-12',
+      organizationUrlKey: 'acme'
+    })
+  })
+
+  it('rejects bare identifiers with no letter in the team key', () => {
+    expect(parseLinearIssueInput('2026-09')).toBeNull()
+  })
+
   it('parses Linear issue URLs with organization URL keys', () => {
     expect(parseLinearIssueInput('https://linear.app/acme/issue/eng-123/fix-auth')).toEqual({
       identifier: 'ENG-123',
@@ -139,6 +151,19 @@ describe('buildLinearIssueLinkUpdates', () => {
     expectNoUndefinedValues(result as Record<string, unknown>)
   })
 
+  it('links digit-prefixed Linear team keys from bare identifiers and URLs', () => {
+    expect(buildLinearIssueLinkUpdates('4K-12')).toEqual({
+      linkedLinearIssue: '4K-12',
+      linkedLinearIssueWorkspaceId: null,
+      linkedLinearIssueOrganizationUrlKey: null
+    })
+    expect(buildLinearIssueLinkUpdates('https://linear.app/acme/issue/4K-12')).toEqual({
+      linkedLinearIssue: '4K-12',
+      linkedLinearIssueWorkspaceId: null,
+      linkedLinearIssueOrganizationUrlKey: 'acme'
+    })
+  })
+
   it('returns null for unparseable input', () => {
     expect(buildLinearIssueLinkUpdates('not an issue')).toBeNull()
     expect(buildLinearIssueLinkUpdates('https://github.com/o/r/issues/12')).toBeNull()
diff --git a/src/shared/linear/links.ts b/src/shared/linear/links.ts
index c4b7f6b2c52d..d6c7e080a519 100644
--- a/src/shared/linear/links.ts
+++ b/src/shared/linear/links.ts
@@ -70,7 +70,7 @@ export type LinearIssueLinkUpdates = {
   linkedLinearIssueOrganizationUrlKey: string | null
 }
 
-const LINEAR_IDENTIFIER_PATTERN = /^[A-Za-z][A-Za-z0-9_]*-\d+$/
+const LINEAR_IDENTIFIER_PATTERN = /^(?=[A-Za-z0-9_]*[A-Za-z])[A-Za-z0-9][A-Za-z0-9_]*-\d+$/
 
 export function parseLinearIssueInput(input: string): ParsedLinearIssueInput | null {
   const trimmed = input.trim()
diff --git a/src/shared/main-process-ndjson-framer.ts b/src/shared/main-process-ndjson-framer.ts
index a348b9a4e39d..790f058b5c50 100644
--- a/src/shared/main-process-ndjson-framer.ts
+++ b/src/shared/main-process-ndjson-framer.ts
@@ -63,6 +63,8 @@ export function createIncrementalNdjsonFramer(
   options: IncrementalNdjsonFramerOptions = {}
 ): IncrementalNdjsonFramer {
   const maxLineBytes = Math.max(1, options.maxLineBytes ?? NDJSON_MAX_LINE_BYTES)
+  // No line can exceed an unbounded limit, so measuring segments and keeping a rejection prefix is dead work.
+  const unbounded = maxLineBytes === Number.POSITIVE_INFINITY
   const maxPendingInputBytes = Math.max(REJECTED_LINE_PREFIX_MAX_BYTES, maxLineBytes * 2)
   let lineSegments: string[] = []
   let lineBytes = 0
@@ -152,9 +154,11 @@ export function createIncrementalNdjsonFramer(
           return
         }
       } else {
-        const segmentBytes = Buffer.byteLength(segment, 'utf8')
+        const segmentBytes = unbounded ? 0 : Buffer.byteLength(segment, 'utf8')
         const nextLineBytes = lineBytes + segmentBytes
-        rememberPrefix(segment, segmentBytes)
+        if (!unbounded) {
+          rememberPrefix(segment, segmentBytes)
+        }
         if (nextLineBytes > maxLineBytes) {
           const rejected: NdjsonRejectedRecord = {
             kind: 'line-too-long',
diff --git a/src/shared/mobile-web-bundle/manifest-contract.test.ts b/src/shared/mobile-web-bundle/manifest-contract.test.ts
index c072b9de63be..089fb9c91491 100644
--- a/src/shared/mobile-web-bundle/manifest-contract.test.ts
+++ b/src/shared/mobile-web-bundle/manifest-contract.test.ts
@@ -11,6 +11,7 @@ import {
   MOBILE_WEB_BUNDLE_MAX_ROUTES,
   MOBILE_WEB_BUNDLE_MAX_TOTAL_BYTES,
   MOBILE_WEB_BUNDLE_SCHEMA_VERSION,
+  MOBILE_WEB_PAGE_VERSION,
   type MobileWebBundleAsset
 } from './manifest-contract'
 
@@ -104,6 +105,24 @@ describe('MobileWebBundleManifestSchema', () => {
   })
 })
 
+describe('the page version a manifest carries', () => {
+  it('takes a count, which is what a shell floors on', () => {
+    expect(
+      MobileWebBundleManifestSchema.safeParse(manifestOf([ENTRY], { pageVersion: 1 })).success
+    ).toBe(true)
+    for (const bad of [-1, 1.5, '1']) {
+      expect(
+        MobileWebBundleManifestSchema.safeParse(manifestOf([ENTRY], { pageVersion: bad })).success,
+        String(bad)
+      ).toBe(false)
+    }
+  })
+
+  it('is at least 1, so a manifest without one reads as older than every page that has one', () => {
+    expect(MOBILE_WEB_PAGE_VERSION).toBeGreaterThanOrEqual(1)
+  })
+})
+
 describe('the page routes a manifest declares', () => {
   function withRoutes(routes: unknown): boolean {
     return MobileWebBundleManifestSchema.safeParse(manifestOf([ENTRY], { routes })).success
diff --git a/src/shared/mobile-web-bundle/manifest-contract.ts b/src/shared/mobile-web-bundle/manifest-contract.ts
index 644c0dc1e095..e12443cb7a23 100644
--- a/src/shared/mobile-web-bundle/manifest-contract.ts
+++ b/src/shared/mobile-web-bundle/manifest-contract.ts
@@ -4,6 +4,12 @@ import { sha256 } from '../sha256'
 /** A reader that sees another value must reject rather than guess at the shape. */
 export const MOBILE_WEB_BUNDLE_SCHEMA_VERSION = 1 as const
 
+/**
+ * The page's build number, written into every manifest. A shell requires a page at least as new as
+ * its own floor and walls an older desktop; bump this when a shell stops handling an older page.
+ */
+export const MOBILE_WEB_PAGE_VERSION = 1
+
 /** The only stable-named asset, and the only one that references the content-addressed names. */
 export const MOBILE_WEB_BUNDLE_ENTRYPOINT = 'index.html'
 
@@ -259,6 +265,8 @@ export const MobileWebBundleManifestSchema = z
     desktopVersion: z.string().min(1).max(MAX_DESKTOP_VERSION_LENGTH),
     minCompatibleRuntimeProtocolVersion: z.number().int().nonnegative(),
     runtimeProtocolVersion: z.number().int().nonnegative(),
+    /** `MOBILE_WEB_PAGE_VERSION` at build time; absent from a desktop older than the field. */
+    pageVersion: z.number().int().nonnegative().optional(),
     entrypoint: z.literal(MOBILE_WEB_BUNDLE_ENTRYPOINT),
     totalBytes: z.number().int().nonnegative().max(MOBILE_WEB_BUNDLE_MAX_TOTAL_BYTES),
     assets: z.array(MobileWebBundleAssetSchema).min(1).max(MOBILE_WEB_BUNDLE_MAX_ASSETS),
diff --git a/src/shared/native-chat-ask-row.test.ts b/src/shared/native-chat-ask-row.test.ts
index f032f88c73f4..05cdcce29009 100644
--- a/src/shared/native-chat-ask-row.test.ts
+++ b/src/shared/native-chat-ask-row.test.ts
@@ -42,7 +42,7 @@ describe('native chat ask row', () => {
       nativeChatAskRunSubject([
         askCall({ questions: [{ question: 'Which branch?' }, { question: 'Proceed?' }] })
       ])
-    ).toEqual({ kind: 'count', count: 2 })
+    ).toEqual({ kind: 'questions', questions: ['Which branch?', 'Proceed?'] })
   })
 
   it('aggregates the per-question calls Codex journals for a single prompt', () => {
@@ -53,7 +53,7 @@ describe('native chat ask row', () => {
         askCall({ questions: [{ question: 'Which branch?' }] }, 'request_user_input'),
         askCall({ questions: [{ question: 'Proceed?' }] }, 'request_user_input')
       ])
-    ).toEqual({ kind: 'count', count: 2 })
+    ).toEqual({ kind: 'questions', questions: ['Which branch?', 'Proceed?'] })
   })
 
   it('decodes the JSON-string arguments Codex delivers', () => {
diff --git a/src/shared/native-chat-ask-row.ts b/src/shared/native-chat-ask-row.ts
index 4944e10e6490..11900c5c4ea3 100644
--- a/src/shared/native-chat-ask-row.ts
+++ b/src/shared/native-chat-ask-row.ts
@@ -13,12 +13,12 @@ export const NATIVE_CHAT_ASK_ROW_COPY = {
   questionCount: '{{value0}} questions'
 } as const
 
-/** What the row names after its label: the question itself, or how many were
- *  asked. One row stands for the whole prompt, so a grouped prompt may not quote
- *  just its first question as though it were the only one. */
+/** What was asked: the one question, or every question of a grouped prompt. One
+ *  row stands for the whole prompt, so a grouped prompt names its count on the
+ *  line rather than quoting its first question as though it were the only one. */
 export type NativeChatAskRowSubject =
   | { kind: 'question'; text: string }
-  | { kind: 'count'; count: number }
+  | { kind: 'questions'; questions: string[] }
 
 /** Whether this block is a question tool call, and so is drawn as the awaiting
  *  row rather than as an ordinary tool line. */
@@ -93,7 +93,7 @@ export function nativeChatAskRunSubject(
     return null
   }
   if (questions.length > 1) {
-    return { kind: 'count', count: questions.length }
+    return { kind: 'questions', questions }
   }
   const text = questions[0]
   return text ? { kind: 'question', text } : null
diff --git a/src/shared/native-chat-empty-state.ts b/src/shared/native-chat-empty-state.ts
index 2797648afd0f..3ef7b1a19025 100644
--- a/src/shared/native-chat-empty-state.ts
+++ b/src/shared/native-chat-empty-state.ts
@@ -19,6 +19,11 @@ export const NATIVE_CHAT_EMPTY_STATE_COPY = {
     title: 'Could not load conversation',
     subtitle: 'The transcript could not be read. Toggle back to the terminal to keep working.'
   },
+  // The structured chat's read reconnects on its own; the terminal-backed read does not.
+  retryingError: {
+    title: 'Could not load conversation',
+    subtitle: 'The transcript could not be read. Orca keeps trying to load it.'
+  },
   notAgent: {
     title: 'No conversation here',
     subtitle: 'This terminal is not running a recognized coding agent.'
diff --git a/src/shared/native-chat-transcript-projection.ts b/src/shared/native-chat-transcript-projection.ts
index 26b218247112..45f2488f4aa6 100644
--- a/src/shared/native-chat-transcript-projection.ts
+++ b/src/shared/native-chat-transcript-projection.ts
@@ -4,6 +4,7 @@
 // of exactly what the renderer's transcript runs, not a second reading of it.
 
 import type { NativeChatMessage } from './native-chat-types'
+import { compareAgentJournalPositions } from './agent-session-journal-position'
 import { stripNoiseMessages } from './native-chat-noise'
 import { foldToolMessages } from './native-chat-tool-fold'
 
@@ -27,11 +28,32 @@ export function compareNativeChatMessagesByTime(
   return 0
 }
 
+/** Rows the journal holds read in the journal's own order, never its clock: a
+ *  batch shares one timestamp, and a row recovered after a crash carries an
+ *  earlier one. A row not in the journal yet — a send still in the outbox — was
+ *  made after everything the journal holds, so it follows them; only such rows,
+ *  and terminal-backed transcripts, which have no journal, order by time. */
+export function compareNativeChatTranscriptMessages(
+  a: NativeChatMessage,
+  b: NativeChatMessage
+): number {
+  if (a.journalPosition && b.journalPosition) {
+    return compareAgentJournalPositions(a.journalPosition, b.journalPosition)
+  }
+  if (a.journalPosition || b.journalPosition) {
+    return a.journalPosition ? -1 : 1
+  }
+  return compareNativeChatMessagesByTime(a, b)
+}
+
 /** `compare` lets the renderer order its own tail rows (streaming, optimistic
  *  sends), which never exist on the host. */
 export function projectNativeChatTranscriptMessages(
   messages: readonly NativeChatMessage[],
-  compare: (a: NativeChatMessage, b: NativeChatMessage) => number = compareNativeChatMessagesByTime
+  compare: (
+    a: NativeChatMessage,
+    b: NativeChatMessage
+  ) => number = compareNativeChatTranscriptMessages
 ): NativeChatMessage[] {
   // Not `toSorted`: mobile's Hermes lacks it, and src/shared must stay loadable there.
   return stripNoiseMessages(foldToolMessages(Array.from(messages).sort(compare)))
diff --git a/src/shared/native-chat-turn-status.test.ts b/src/shared/native-chat-turn-status.test.ts
index 8157676a22c1..e36eaa86fd3e 100644
--- a/src/shared/native-chat-turn-status.test.ts
+++ b/src/shared/native-chat-turn-status.test.ts
@@ -32,81 +32,66 @@ describe('formatNativeChatDuration', () => {
 })
 
 describe('describeNativeChatTurnStatus', () => {
-  it('prefers the settled duration over the thinking and counting labels', () => {
-    expect(
-      describeNativeChatTurnStatus({ thinking: true, workedSeconds: 184, elapsedSeconds: 9 })
-    ).toEqual({ key: 'workedFor', duration: '3m 4s' })
-  })
-
-  it('reports thinking before the turn produces output', () => {
-    expect(
-      describeNativeChatTurnStatus({ thinking: true, workedSeconds: null, elapsedSeconds: 9 })
-    ).toEqual({ key: 'thinking', duration: null })
+  it('prefers the settled duration over the running clock', () => {
+    expect(describeNativeChatTurnStatus({ workedSeconds: 184, elapsedSeconds: 9 })).toEqual({
+      key: 'workedFor',
+      duration: '3m 4s'
+    })
   })
 
-  it('counts once the turn has output', () => {
-    expect(
-      describeNativeChatTurnStatus({ thinking: false, workedSeconds: null, elapsedSeconds: 12 })
-    ).toEqual({ key: 'workingFor', duration: '12s' })
+  it('counts from the first second of the turn', () => {
+    expect(describeNativeChatTurnStatus({ workedSeconds: null, elapsedSeconds: 0 })).toEqual({
+      key: 'workingFor',
+      duration: '0s'
+    })
   })
 })
 
 describe('describeNativeChatActiveTurnLabel', () => {
   it('lets provider activity beat both fallbacks', () => {
     expect(
-      describeNativeChatActiveTurnLabel({
-        activityText: 'Reading src/main.ts',
-        thinking: true,
-        elapsedSeconds: 12
-      })
+      describeNativeChatActiveTurnLabel({ activityText: 'Reading src/main.ts', thinking: true })
     ).toEqual({ source: 'activity', text: 'Reading src/main.ts' })
   })
 
   it('falls back to reasoning when the provider says nothing usable', () => {
-    expect(
-      describeNativeChatActiveTurnLabel({ activityText: '   ', thinking: true, elapsedSeconds: 12 })
-    ).toEqual({ source: 'status', key: 'thinking', duration: null })
-    expect(
-      describeNativeChatActiveTurnLabel({ activityText: null, thinking: true, elapsedSeconds: 12 })
-    ).toEqual({ source: 'status', key: 'thinking', duration: null })
+    expect(describeNativeChatActiveTurnLabel({ activityText: '   ', thinking: true })).toEqual({
+      source: 'status',
+      key: 'thinking'
+    })
+    expect(describeNativeChatActiveTurnLabel({ activityText: null, thinking: true })).toEqual({
+      source: 'status',
+      key: 'thinking'
+    })
   })
 
-  it('falls back to the running clock when the turn is neither talking nor reasoning', () => {
-    expect(describeNativeChatActiveTurnLabel({ thinking: false, elapsedSeconds: 184 })).toEqual({
+  // The clock belongs to the turn bar; repeating it here is two rows saying "Working for".
+  it('falls back to plain working, never the clock, when neither applies', () => {
+    expect(describeNativeChatActiveTurnLabel({ thinking: false })).toEqual({
       source: 'status',
-      key: 'workingFor',
-      duration: '3m 4s'
+      key: 'working'
     })
   })
 })
 
 describe('formatNativeChatActiveTurnLabel', () => {
-  it('renders the one live row in English for platforms without i18n', () => {
+  it('renders the live tail line in English for platforms without i18n', () => {
     expect(
-      formatNativeChatActiveTurnLabel({
-        activityText: 'Running pnpm test',
-        thinking: false,
-        elapsedSeconds: 4
-      })
+      formatNativeChatActiveTurnLabel({ activityText: 'Running pnpm test', thinking: false })
     ).toBe('Running pnpm test')
-    expect(formatNativeChatActiveTurnLabel({ thinking: true, elapsedSeconds: 4 })).toBe('Thinking')
-    expect(formatNativeChatActiveTurnLabel({ thinking: false, elapsedSeconds: 12 })).toBe(
-      'Working for 12s'
-    )
+    expect(formatNativeChatActiveTurnLabel({ thinking: true })).toBe('Thinking')
+    expect(formatNativeChatActiveTurnLabel({ thinking: false })).toBe('Working…')
   })
 })
 
 describe('formatNativeChatTurnStatusLabel', () => {
-  it('renders each state in English for platforms without i18n', () => {
-    expect(
-      formatNativeChatTurnStatusLabel({ thinking: true, workedSeconds: null, elapsedSeconds: 0 })
-    ).toBe('Thinking')
-    expect(
-      formatNativeChatTurnStatusLabel({ thinking: false, workedSeconds: null, elapsedSeconds: 12 })
-    ).toBe('Working for 12s')
-    expect(
-      formatNativeChatTurnStatusLabel({ thinking: false, workedSeconds: 184, elapsedSeconds: 0 })
-    ).toBe('Worked for 3m 4s')
+  it('renders the turn bar in English for platforms without i18n', () => {
+    expect(formatNativeChatTurnStatusLabel({ workedSeconds: null, elapsedSeconds: 12 })).toBe(
+      'Working for 12s'
+    )
+    expect(formatNativeChatTurnStatusLabel({ workedSeconds: 184, elapsedSeconds: 0 })).toBe(
+      'Worked for 3m 4s'
+    )
   })
 })
 
@@ -380,6 +365,24 @@ describe('selectNativeChatTurnStatuses', () => {
     )
     expect(completedByTurn).toEqual({})
   })
+
+  it('keeps the just-ended turn live until its local duration is stamped', () => {
+    const running = { u1: { startedAt: 1_000, workedSeconds: null } }
+    const { active } = selectNativeChatTurnStatuses(running, {
+      activeTurnKey: 'u1',
+      isWorking: false,
+      thinking: true
+    })
+    expect(active).toEqual({ startedAt: 1_000, thinking: false, workedSeconds: null })
+    // The host saying it never saw the end still wins.
+    const unverifiable = selectNativeChatTurnStatuses(running, {
+      activeTurnKey: 'u1',
+      isWorking: false,
+      thinking: false,
+      settledByTurn: new Map([['u1', null]])
+    })
+    expect(unverifiable.active).toBeNull()
+  })
 })
 
 describe('nativeChatElapsedSeconds', () => {
diff --git a/src/shared/native-chat-turn-status.ts b/src/shared/native-chat-turn-status.ts
index 9f942ad7e216..1b0613bd7163 100644
--- a/src/shared/native-chat-turn-status.ts
+++ b/src/shared/native-chat-turn-status.ts
@@ -1,10 +1,12 @@
-// Turn-status derivation and copy for the native-chat "Thinking / Working for N /
-// Worked for N" row, shared by the desktop renderer (as its i18n fallback strings)
-// and the mobile app (used directly — mobile ships English only) so the two
-// surfaces never drift. Everything here is pure; each platform owns its own clock.
+// Turn-status derivation and copy for the native-chat turn rows — the "Working for N /
+// Worked for N" bar under the user's message and the live line at the turn's tail —
+// shared by the desktop renderer (as its i18n fallback strings) and the mobile app
+// (used directly — mobile ships English only) so the two surfaces never drift.
+// Everything here is pure; each platform owns its own clock.
 
 export const NATIVE_CHAT_TURN_STATUS_COPY = {
   thinking: 'Thinking',
+  working: 'Working…',
   workingFor: 'Working for {{value0}}',
   workedFor: 'Worked for {{value0}}',
   toggleDetails: 'Toggle turn details',
@@ -26,28 +28,22 @@ export function formatNativeChatDuration(seconds: number): string {
   return `${hours}h ${minutes % 60}m ${remainingSeconds}s`
 }
 
-/** Which of the three copy keys a turn-status row renders, and its duration
- *  argument. Desktop maps this onto `translate`; mobile formats it directly. */
+/** The turn bar's copy key and duration: the running clock, then the settled one.
+ *  Desktop maps this onto `translate`; mobile formats it directly. */
 export function describeNativeChatTurnStatus({
-  thinking,
   workedSeconds,
   elapsedSeconds
 }: {
-  thinking: boolean
   workedSeconds?: number | null
   elapsedSeconds: number
-}): { key: 'thinking' | 'workingFor' | 'workedFor'; duration: string | null } {
-  if (workedSeconds != null) {
-    return { key: 'workedFor', duration: formatNativeChatDuration(workedSeconds) }
-  }
-  if (thinking) {
-    return { key: 'thinking', duration: null }
-  }
-  return { key: 'workingFor', duration: formatNativeChatDuration(elapsedSeconds) }
+}): { key: 'workingFor' | 'workedFor'; duration: string } {
+  return workedSeconds != null
+    ? { key: 'workedFor', duration: formatNativeChatDuration(workedSeconds) }
+    : { key: 'workingFor', duration: formatNativeChatDuration(elapsedSeconds) }
 }
 
-/** The two readings that label a live turn's one indicator row, carried together
- *  so a surface cannot pick up one without the other. */
+/** The two readings that label a live turn's tail line, carried together so a
+ *  surface cannot pick up one without the other. */
 export type NativeChatLiveTurnIndicator = {
   thinking: boolean
   activityText: string | null
@@ -55,52 +51,41 @@ export type NativeChatLiveTurnIndicator = {
 
 export type NativeChatActiveTurnLabel =
   | { source: 'activity'; text: string }
-  | { source: 'status'; key: 'thinking' | 'workingFor'; duration: string | null }
+  | { source: 'status'; key: 'thinking' | 'working' }
 
-/** The live turn's single indicator label. Provider activity wins because it is the
- *  only text that says what the turn is actually doing; reasoning is next; the
- *  running clock is the floor. Shared so desktop and mobile cannot disagree. */
+/** The live tail line's label. Provider activity wins because it is the only text
+ *  that says what the turn is actually doing; reasoning is next. It never carries
+ *  the clock — the turn bar owns that. Shared so desktop and mobile cannot disagree. */
 export function describeNativeChatActiveTurnLabel({
   activityText,
-  thinking,
-  elapsedSeconds
+  thinking
 }: {
   activityText?: string | null
   thinking: boolean
-  elapsedSeconds: number
 }): NativeChatActiveTurnLabel {
   const text = activityText?.trim()
   if (text) {
     return { source: 'activity', text }
   }
-  return thinking
-    ? { source: 'status', key: 'thinking', duration: null }
-    : { source: 'status', key: 'workingFor', duration: formatNativeChatDuration(elapsedSeconds) }
+  return { source: 'status', key: thinking ? 'thinking' : 'working' }
 }
 
-/** The live turn's label in English. For platforms without i18n (mobile). */
+/** The live tail line's label in English. For platforms without i18n (mobile). */
 export function formatNativeChatActiveTurnLabel(input: {
   activityText?: string | null
   thinking: boolean
-  elapsedSeconds: number
 }): string {
   const label = describeNativeChatActiveTurnLabel(input)
-  if (label.source === 'activity') {
-    return label.text
-  }
-  const copy = NATIVE_CHAT_TURN_STATUS_COPY[label.key]
-  return label.duration == null ? copy : copy.replaceAll('{{value0}}', label.duration)
+  return label.source === 'activity' ? label.text : NATIVE_CHAT_TURN_STATUS_COPY[label.key]
 }
 
-/** Resolve the turn-status label in English. For platforms without i18n (mobile). */
+/** Resolve the turn bar's label in English. For platforms without i18n (mobile). */
 export function formatNativeChatTurnStatusLabel(input: {
-  thinking: boolean
   workedSeconds?: number | null
   elapsedSeconds: number
 }): string {
   const { key, duration } = describeNativeChatTurnStatus(input)
-  const copy = NATIVE_CHAT_TURN_STATUS_COPY[key]
-  return duration == null ? copy : copy.replaceAll('{{value0}}', duration)
+  return NATIVE_CHAT_TURN_STATUS_COPY[key].replaceAll('{{value0}}', duration)
 }
 
 export type NativeChatTurnTiming = {
@@ -241,14 +226,20 @@ export function selectNativeChatTurnStatuses(
       workedSeconds: settled.workedSeconds
     }
   }
+  const activeTiming = timingByTurn[activeTurnKey]
   return {
     active: isWorking
       ? {
-          startedAt: timingByTurn[activeTurnKey]?.startedAt ?? workingStartedAt ?? null,
+          startedAt: activeTiming?.startedAt ?? workingStartedAt ?? null,
           thinking,
           workedSeconds: null
         }
-      : (completedByTurn[activeTurnKey] ?? null),
+      : (completedByTurn[activeTurnKey] ??
+        // Ended, but the local duration is stamped a pass later: stay live until then so
+        // the bar settles in place instead of blinking out. The host's null still hides it.
+        (activeTiming?.workedSeconds === null && !settledByTurn?.has(activeTurnKey)
+          ? { startedAt: activeTiming.startedAt, thinking: false, workedSeconds: null }
+          : null)),
     completedByTurn
   }
 }
diff --git a/src/shared/native-chat-types.ts b/src/shared/native-chat-types.ts
index 24bf8652fb23..f33158d9a0f8 100644
--- a/src/shared/native-chat-types.ts
+++ b/src/shared/native-chat-types.ts
@@ -10,7 +10,11 @@ import type {
   AgentSessionBackgroundTask,
   AgentSessionBackgroundTaskRunState
 } from './agent-session-background-task-wire'
-import type { AgentJournalMessageSendMode } from './agent-session-journal-types'
+import type { AgentSessionFailureFact } from './agent-session-failure'
+import type {
+  AgentJournalMessageSendMode,
+  AgentJournalPosition
+} from './agent-session-journal-types'
 import type { AgentType } from './agent-status-types'
 import type { NativeChatToolMetadata } from './native-chat-tool-identity'
 
@@ -51,6 +55,8 @@ export type NativeChatTextBlock = {
       truncated: boolean
     }
   }
+  /** On a status line that reports a failure: what failed, typed. */
+  failure?: AgentSessionFailureFact
 }
 
 /** A tool invocation by the agent. `input` is the (already-serialized) tool
@@ -199,6 +205,9 @@ export type NativeChatMessage = {
   turnId?: string
   /** How a user message was delivered when it was not an ordinary prompt. */
   sentAs?: AgentJournalMessageSendMode
+  /** Set only by the structured projection, on rows the journal holds, and ranks
+   *  them ahead of time. Terminal-backed messages never carry it, and worker reads strip it. */
+  journalPosition?: AgentJournalPosition
 }
 
 export const NATIVE_CHAT_TURN_LIFECYCLE_STATES = ['working', 'completed', 'interrupted'] as const
diff --git a/src/shared/nested-repo-telemetry.ts b/src/shared/nested-repo-telemetry.ts
index 7aea296c57aa..48ac131cebf0 100644
--- a/src/shared/nested-repo-telemetry.ts
+++ b/src/shared/nested-repo-telemetry.ts
@@ -3,6 +3,7 @@ import type {
   ProjectGroupImportMode,
   ProjectGroupImportResult
 } from './project-group-types'
+import { createNonSecureContextUuid } from './non-secure-context-uuid'
 
 export const NESTED_REPO_TELEMETRY_MAX_REPO_COUNT = 500
 
@@ -117,25 +118,8 @@ export function shouldEmitNestedRepoImportSubmitTelemetry(args: {
 }
 
 export function createNestedRepoTelemetryAttemptId(): string {
-  const cryptoApi = globalThis.crypto
-  if (typeof cryptoApi?.randomUUID === 'function') {
-    return cryptoApi.randomUUID()
-  }
-
-  const bytes = new Uint8Array(16)
-  if (typeof cryptoApi?.getRandomValues === 'function') {
-    cryptoApi.getRandomValues(bytes)
-  } else {
-    for (let i = 0; i < bytes.length; i++) {
-      bytes[i] = Math.floor(Math.random() * 256)
-    }
-  }
-
-  // Why: keep the fallback schema-compatible without deriving from any stable repo input.
-  bytes[6] = (bytes[6] & 0x0f) | 0x40
-  bytes[8] = (bytes[8] & 0x3f) | 0x80
-  const hex = Array.from(bytes, (byte) => byte.toString(16).padStart(2, '0'))
-  return `${hex.slice(0, 4).join('')}-${hex.slice(4, 6).join('')}-${hex.slice(6, 8).join('')}-${hex.slice(8, 10).join('')}-${hex.slice(10, 16).join('')}`
+  // Why a UUID: the attempt id must not derive from any stable repo input.
+  return createNonSecureContextUuid()
 }
 
 export function buildNestedRepoScanTelemetry(args: {
diff --git a/src/shared/non-secure-context-uuid.ts b/src/shared/non-secure-context-uuid.ts
new file mode 100644
index 000000000000..d9fe33e04590
--- /dev/null
+++ b/src/shared/non-secure-context-uuid.ts
@@ -0,0 +1,38 @@
+/**
+ * The one v4 UUID generator that is safe everywhere Orca's code runs.
+ *
+ * Why: browsers hide `crypto.randomUUID` outside a secure context, so a renderer served
+ * over plain HTTP (Remote Web on a LAN/Tailscale address) throws on any direct call — at
+ * module scope that white-screens the app before it paints. `getRandomValues` stays
+ * available there, and Node/Electron main satisfy the first branch, so this is
+ * runtime-agnostic rather than browser-specific.
+ */
+export function createNonSecureContextUuid(): string {
+  const cryptoApi = globalThis.crypto
+  // oxlint-disable-next-line no-restricted-properties -- the sanctioned escape hatch: the one guarded call every other site routes through.
+  if (typeof cryptoApi?.randomUUID === 'function') {
+    // oxlint-disable-next-line no-restricted-properties -- the sanctioned escape hatch (see above).
+    return cryptoApi.randomUUID()
+  }
+
+  const bytes = new Uint8Array(16)
+  if (typeof cryptoApi?.getRandomValues === 'function') {
+    cryptoApi.getRandomValues(bytes)
+  } else {
+    // Why: these are local UI and correlation ids, not auth credentials.
+    for (let index = 0; index < bytes.length; index += 1) {
+      bytes[index] = Math.floor(Math.random() * 256)
+    }
+  }
+
+  bytes[6] = (bytes[6] & 0x0f) | 0x40
+  bytes[8] = (bytes[8] & 0x3f) | 0x80
+  return bytesToUuid(bytes)
+}
+
+function bytesToUuid(bytes: Uint8Array): string {
+  const hex = Array.from(bytes, (byte) => byte.toString(16).padStart(2, '0'))
+  return `${hex.slice(0, 4).join('')}-${hex.slice(4, 6).join('')}-${hex
+    .slice(6, 8)
+    .join('')}-${hex.slice(8, 10).join('')}-${hex.slice(10, 16).join('')}`
+}
diff --git a/src/shared/notebook-kernel-types.ts b/src/shared/notebook-kernel-types.ts
index 02947ead5e7e..022a07eaafd3 100644
--- a/src/shared/notebook-kernel-types.ts
+++ b/src/shared/notebook-kernel-types.ts
@@ -4,7 +4,8 @@ export type PythonEnvironment = {
   path: string
   /** `.venv`, `python3`, … — what the kernel picker shows first. */
   name: string
-  version: string
+  /** Absent for a workspace env listed before trust, which is read from disk rather than run. */
+  version?: string
 }
 
 export type PythonEnvironments = {
diff --git a/src/shared/notification-settings-types.ts b/src/shared/notification-settings-types.ts
index 49573c04c1af..4bc22e4aac16 100644
--- a/src/shared/notification-settings-types.ts
+++ b/src/shared/notification-settings-types.ts
@@ -1,4 +1,5 @@
 import type { AgentStatusState, AgentType } from './agent-status-types'
+import type { AgentJournalTurnOutcome } from './agent-turn-outcome'
 
 export type NotificationSettings = {
   enabled: boolean
@@ -43,7 +44,8 @@ export type NotificationDispatchRequest = {
   agentToolName?: string
   agentToolInput?: string
   agentLastAssistantMessage?: string
-  agentInterrupted?: boolean
+  /** The verdict on the turn this notification reports, which picks its wording. */
+  agentTurnOutcome?: AgentJournalTurnOutcome
   /**
    * Which lane raised this, so the click handler knows how to reveal the subject. Absent means the
    * terminal lane, which is every sender that predates structured chat.
diff --git a/src/shared/opencode-launch-command.test.ts b/src/shared/opencode-launch-command.test.ts
index a422633f4bff..d9457de42e04 100644
--- a/src/shared/opencode-launch-command.test.ts
+++ b/src/shared/opencode-launch-command.test.ts
@@ -1,5 +1,5 @@
 import { describe, expect, it } from 'vitest'
-import { isOpenCode2LaunchCommand } from './opencode-launch-command'
+import { isOpenCode2LaunchCommand, selectOpenCodeHookAgent } from './opencode-launch-command'
 
 describe('isOpenCode2LaunchCommand', () => {
   it.each(['opencode2', '/usr/local/bin/opencode2', 'opencode2.exe', 'opencode2.cmd'])(
@@ -13,3 +13,19 @@ describe('isOpenCode2LaunchCommand', () => {
     expect(isOpenCode2LaunchCommand(command)).toBe(false)
   })
 })
+
+describe('OpenCode hook selection', () => {
+  it.each([
+    'opencode --session fixture',
+    '"C:\\tools\\opencode.exe" --session fixture',
+    '/usr/local/bin/opencode'
+  ])('preserves disabled v1 identity for %s', (command) => {
+    expect(selectOpenCodeHookAgent(undefined, command, (agent) => agent === 'opencode2')).toBeNull()
+  })
+  it('trusts the supplied identity for wrapped or renamed commands', () => {
+    expect(selectOpenCodeHookAgent('opencode', 'opencode2', () => true)).toBe('opencode')
+    expect(
+      selectOpenCodeHookAgent('opencode2', 'my-wrapper', (agent) => agent === 'opencode2')
+    ).toBe('opencode2')
+  })
+})
diff --git a/src/shared/opencode-launch-command.ts b/src/shared/opencode-launch-command.ts
index 44dd3038e6b9..92c4896b094c 100644
--- a/src/shared/opencode-launch-command.ts
+++ b/src/shared/opencode-launch-command.ts
@@ -1,8 +1,31 @@
 import { getCommandTokenPathBasename, getFirstCommandToken } from './command-token-scanner'
+import type { TuiAgent } from './tui-agent'
 
-export function isOpenCode2LaunchCommand(launchCommand: string | undefined): boolean {
+function openCodeCommandAgent(launchCommand: string | undefined): 'opencode' | 'opencode2' | null {
   const binary = getCommandTokenPathBasename(getFirstCommandToken(launchCommand ?? ''))
     .toLowerCase()
     .replace(/\.(?:cmd|exe|sh)$/, '')
-  return binary === 'opencode2'
+  return binary === 'opencode' || binary === 'opencode2' ? binary : null
+}
+
+export function isOpenCode2LaunchCommand(launchCommand: string | undefined): boolean {
+  return openCodeCommandAgent(launchCommand) === 'opencode2'
+}
+
+export function selectOpenCodeHookAgent(
+  launchAgent: TuiAgent | undefined,
+  launchCommand: string | undefined,
+  isEnabled: (agent: 'opencode' | 'opencode2') => boolean
+): 'opencode' | 'opencode2' | null {
+  const explicit =
+    launchAgent === 'opencode' || launchAgent === 'opencode2'
+      ? launchAgent
+      : launchAgent === undefined
+        ? openCodeCommandAgent(launchCommand)
+        : null
+  // An explicit version selects its own integration; disabling it never substitutes the other.
+  if (explicit) {
+    return isEnabled(explicit) ? explicit : null
+  }
+  return isEnabled('opencode') ? 'opencode' : isEnabled('opencode2') ? 'opencode2' : null
 }
diff --git a/src/shared/orca-session-address-test-fixture.ts b/src/shared/orca-session-address-test-fixture.ts
new file mode 100644
index 000000000000..8c41b49b8b23
--- /dev/null
+++ b/src/shared/orca-session-address-test-fixture.ts
@@ -0,0 +1,9 @@
+import { isOrcaSessionId, type OrcaSessionId } from './orca-session-address'
+
+/** A literal Orca session id for a test, checked by the same predicate production uses. */
+export function testOrcaSessionId(id: string): OrcaSessionId {
+  if (!isOrcaSessionId(id)) {
+    throw new Error(`Not an Orca session id: ${id}`)
+  }
+  return id
+}
diff --git a/src/shared/orca-session-address.test.ts b/src/shared/orca-session-address.test.ts
index 96b8a2268e5e..0d9875f936d9 100644
--- a/src/shared/orca-session-address.test.ts
+++ b/src/shared/orca-session-address.test.ts
@@ -5,8 +5,9 @@ import {
   isOrcaSessionId,
   parseOrcaSessionAddress
 } from './orca-session-address'
+import { testOrcaSessionId } from './orca-session-address-test-fixture'
 
-const SESSION_ID = '0b7e4c2a-5f1d-4e8a-9c3b-2d6f8a1e4b70'
+const SESSION_ID = testOrcaSessionId('0b7e4c2a-5f1d-4e8a-9c3b-2d6f8a1e4b70')
 const ADDRESS = `session:${SESSION_ID}`
 
 describe('Orca session address', () => {
@@ -14,7 +15,8 @@ describe('Orca session address', () => {
     expect(ORCA_SESSION_ADDRESS_PREFIX).toBe('session:')
     expect(formatOrcaSessionAddress(SESSION_ID)).toBe(ADDRESS)
     expect(parseOrcaSessionAddress(ADDRESS)).toBe(SESSION_ID)
-    expect(formatOrcaSessionAddress(parseOrcaSessionAddress(ADDRESS) ?? '')).toBe(ADDRESS)
+    const parsed = parseOrcaSessionAddress(ADDRESS)
+    expect(parsed && formatOrcaSessionAddress(parsed)).toBe(ADDRESS)
   })
 
   it('reads only the addressed spelling when parsing an address', () => {
diff --git a/src/shared/orca-session-address.ts b/src/shared/orca-session-address.ts
index f2ccd4fe00cc..339ccb01f435 100644
--- a/src/shared/orca-session-address.ts
+++ b/src/shared/orca-session-address.ts
@@ -13,24 +13,41 @@ import { isAgentSessionId } from './agent-session-record'
  */
 export const ORCA_SESSION_ADDRESS_PREFIX = 'session:'
 
+declare const orcaSessionIdBrand: unique symbol
+declare const orcaSessionAddressBrand: unique symbol
+
+/** A bare Orca session id; only `isOrcaSessionId` and `parseOrcaSessionAddress` produce one. */
+export type OrcaSessionId = string & { readonly [orcaSessionIdBrand]: true }
+/** A `session:<id>` mail address; only `formatOrcaSessionAddress` produces one. */
+export type OrcaSessionAddress = string & { readonly [orcaSessionAddressBrand]: true }
+
 // Terminal handles (`term_` from the PTY runtime, `structworker_` from structured-worker-identity)
 // share the session-id charset. A handle is never a session, so one handed over by mistake must not
 // become a durable Orca session id.
 const TERMINAL_HANDLE_PREFIXES = ['term_', 'structworker_'] as const
 
-export function isOrcaSessionId(id: string): boolean {
+export function isOrcaSessionId(id: string): id is OrcaSessionId {
   return isAgentSessionId(id) && !TERMINAL_HANDLE_PREFIXES.some((prefix) => id.startsWith(prefix))
 }
 
-export function formatOrcaSessionAddress(orcaSessionId: string): string {
-  return `${ORCA_SESSION_ADDRESS_PREFIX}${orcaSessionId}`
+export function formatOrcaSessionAddress(orcaSessionId: OrcaSessionId): OrcaSessionAddress {
+  const address = `${ORCA_SESSION_ADDRESS_PREFIX}${orcaSessionId}`
+  // Always true for a checked id; the check brands the address without a type assertion.
+  if (!isOrcaSessionAddress(address)) {
+    throw new Error(`Not an Orca session id: ${orcaSessionId}`)
+  }
+  return address
 }
 
 /** The bare Orca session id of a `session:<id>` address; anything else reads as null. */
-export function parseOrcaSessionAddress(address: string | null | undefined): string | null {
+export function parseOrcaSessionAddress(address: string | null | undefined): OrcaSessionId | null {
   if (!address?.startsWith(ORCA_SESSION_ADDRESS_PREFIX)) {
     return null
   }
   const id = address.slice(ORCA_SESSION_ADDRESS_PREFIX.length)
   return isOrcaSessionId(id) ? id : null
 }
+
+function isOrcaSessionAddress(address: string): address is OrcaSessionAddress {
+  return parseOrcaSessionAddress(address) !== null
+}
diff --git a/src/shared/orcad-agent-browser-name.ts b/src/shared/orcad-agent-browser-name.ts
new file mode 100644
index 000000000000..5cd22beaa50d
--- /dev/null
+++ b/src/shared/orcad-agent-browser-name.ts
@@ -0,0 +1,10 @@
+export function orcadAgentBrowserNativeName(
+  platformName: NodeJS.Platform,
+  architecture: string,
+  linuxLibc: 'glibc' | 'musl' = 'glibc'
+): string {
+  const ext = platformName === 'win32' ? '.exe' : ''
+  const platformToken =
+    platformName === 'linux' && linuxLibc === 'musl' ? 'linux-musl' : platformName
+  return `agent-browser-${platformToken}-${architecture}${ext}`
+}
diff --git a/src/shared/orcad-artifacts.ts b/src/shared/orcad-artifacts.ts
index 9a2598caefbf..fea71dc63c4c 100644
--- a/src/shared/orcad-artifacts.ts
+++ b/src/shared/orcad-artifacts.ts
@@ -8,6 +8,27 @@
  * Keep this file erasable-only TypeScript — build-orcad.mjs imports it directly under
  * Node's type stripping, which rejects enums, namespaces and parameter properties.
  */
+export const ORCAD_BUN_RUNTIME_FILENAME = 'bun-runtime'
+export const ORCAD_WINDOWS_BUN_RUNTIME_FILENAME = 'bun-runtime.exe'
+export const ORCAD_WINDOWS_PROCESS_TREE_FILENAME = 'windows-process-tree.node'
+
+export function orcadBunRuntimeFilename(target: string): string {
+  return target === 'win32' || target.startsWith('win32-')
+    ? ORCAD_WINDOWS_BUN_RUNTIME_FILENAME
+    : ORCAD_BUN_RUNTIME_FILENAME
+}
+
+/** Keep renamed Windows executables in a new content-addressed slot. */
+export function orcadArtifactHashPrefix(target: string): string {
+  return orcadBunRuntimeFilename(target) === ORCAD_WINDOWS_BUN_RUNTIME_FILENAME
+    ? `${ORCAD_WINDOWS_BUN_RUNTIME_FILENAME}\0`
+    : ''
+}
+export const ORCAD_BUILD_TARGET_FILENAME = '.build-target'
+export const ORCAD_PARCEL_WATCHER_ENTRY = 'node_modules/@parcel/watcher/index.js'
+export const ORCAD_PARCEL_WATCHER_NATIVE = 'node_modules/@parcel/watcher/watcher.node'
+export const ORCAD_EMOJI_SHORTCODE_DATASET =
+  'node_modules/emojibase-data/en/shortcodes/emojibase.json'
 
 export const ORCAD_VERSION = '0.1.0'
 
@@ -49,18 +70,45 @@ export const ORCAD_ARTIFACTS: readonly OrcadArtifact[] = [
   { filename: 'parcel-watcher-process-entry.js' },
   // Forked so PTYs outlive the runtime process; its absence makes every restart destructive.
   { filename: 'daemon-entry.js' },
+  { filename: 'windows-bun-pty-gate-entry.js' },
+  { filename: 'profile-state-writer-worker-entry.js' },
+  { filename: 'profile-state-backup-worker-entry.js' },
+  // Target-specific even when the JavaScript bundle is shared across packaged slots.
+  { filename: ORCAD_BUILD_TARGET_FILENAME },
+  // orcad never depends on a host runtime or host-installed native module.
+  { filename: ORCAD_BUN_RUNTIME_FILENAME },
+  { filename: ORCAD_PARCEL_WATCHER_ENTRY },
+  { filename: ORCAD_PARCEL_WATCHER_NATIVE },
+  { filename: ORCAD_EMOJI_SHORTCODE_DATASET },
   ...ORCAD_RIPGREP_ARTIFACTS.map((filename) => ({ filename })),
   ...ORCAD_RIPGREP_LICENSE_ARTIFACTS.map((filename) => ({ filename }))
 ]
 
 /** Written after the artifacts, so it is never an input to its own hash. */
 export const ORCAD_VERSION_FILENAME = '.version'
+export const ORCAD_TEMPLATE_MANIFEST_FILENAME = 'orcad-template.json'
+export const ORCAD_TEMPLATE_TARGETS_DIR = 'targets'
 
 /** Written last by the installer; its absence means a torn install. */
 export const ORCAD_INSTALL_COMPLETE_FILENAME = '.install-complete'
 
-export function orcadArtifactFilenames(): string[] {
-  return ORCAD_ARTIFACTS.filter((artifact) => !artifact.optional).map(
-    (artifact) => artifact.filename
+export function orcadArtifactFilenames(target = ''): string[] {
+  const filenames = ORCAD_ARTIFACTS.filter((artifact) => !artifact.optional).map((artifact) =>
+    artifact.filename === ORCAD_BUN_RUNTIME_FILENAME
+      ? orcadBunRuntimeFilename(target)
+      : artifact.filename
+  )
+  if (target === 'win32' || target.startsWith('win32-')) {
+    filenames.push(ORCAD_WINDOWS_PROCESS_TREE_FILENAME)
+  }
+  return filenames
+}
+
+export function orcadTemplateCommonFilenames(): string[] {
+  return orcadArtifactFilenames().filter(
+    (filename) =>
+      filename !== ORCAD_BUN_RUNTIME_FILENAME &&
+      filename !== ORCAD_BUILD_TARGET_FILENAME &&
+      filename !== ORCAD_PARCEL_WATCHER_NATIVE
   )
 }
diff --git a/src/shared/orcad-bun-runtime.ts b/src/shared/orcad-bun-runtime.ts
new file mode 100644
index 000000000000..76fc03258c86
--- /dev/null
+++ b/src/shared/orcad-bun-runtime.ts
@@ -0,0 +1,72 @@
+export const ORCAD_BUN_VERSION = '1.4.2'
+
+export const ORCAD_BUN_TARGETS = [
+  'darwin-arm64',
+  'darwin-x64',
+  'linux-arm64-glibc',
+  'linux-x64-glibc',
+  'linux-arm64-musl',
+  'linux-x64-musl',
+  'win32-arm64',
+  'win32-x64'
+] as const
+
+export type OrcadBunTarget = (typeof ORCAD_BUN_TARGETS)[number]
+
+// Managed SSH deployment supports POSIX hosts; Windows uses standalone builds.
+export const ORCAD_TEMPLATE_TARGETS = ORCAD_BUN_TARGETS.filter(
+  (target) => !target.startsWith('win32-')
+)
+
+export type OrcadBunReleaseAsset = {
+  filename: string
+  sha256: string
+  executableSha256: string
+}
+
+export const ORCAD_BUN_RELEASE_ASSETS: Record<OrcadBunTarget, OrcadBunReleaseAsset> = {
+  'darwin-arm64': {
+    filename: 'bun-darwin-aarch64.zip',
+    sha256: '90987a3a16d7db556d886ac3d551e7b6d3edf0a1cf43acaed622e8676be1d12f',
+    executableSha256: '35d20dd0263e5c950194434b925454fdfa9ba6e4467da960410fa05b08a7a5b5'
+  },
+  'darwin-x64': {
+    filename: 'bun-darwin-x64.zip',
+    sha256: '80520d7e17526308c9185d261679ac6d27798d3803a0e9f7ff9121ab8affb012',
+    executableSha256: '2fa513af22ac59e03aae640cad302e73cb1ddb0f6398501e2ddccf7dcd613596'
+  },
+  'linux-arm64-glibc': {
+    filename: 'bun-linux-aarch64.zip',
+    sha256: '54328bbc2d9c8e0c9f892c544d66c57a83b84139e34909e5ee81758f1ac8fda7',
+    executableSha256: '616f267a34278ff5ac282df37ffdfba1d7141f4f6926bca99af2cd6ef3ad32b1'
+  },
+  'linux-x64-glibc': {
+    filename: 'bun-linux-x64.zip',
+    sha256: '36368faef7527875d5ffa52e53cd48021741f2a83eb6208a8dd64068d422a913',
+    executableSha256: 'a83d263767d839e4d2649ca8e35d07159c7afc99afdc96d731ced29e056dda0c'
+  },
+  'linux-arm64-musl': {
+    filename: 'bun-linux-aarch64-musl.zip',
+    sha256: '71760b6c8ea30623b81a4907cb815d48e2ea266f2e73e751534a44a0607950df',
+    executableSha256: '1101cd0aa92ea214c2aaf4bb3761ca3c76a90aae0e6f94c07efb4e8c4f18a8fc'
+  },
+  'linux-x64-musl': {
+    filename: 'bun-linux-x64-musl.zip',
+    sha256: '4835eca59d6da70f4674f5642f6e459dcadab773695b2ed9922d131057989742',
+    executableSha256: '16b72935ffd7a503b978c186874539c92aade4e3515b70a5abf5db2581fdef7d'
+  },
+  'win32-arm64': {
+    filename: 'bun-windows-aarch64.zip',
+    sha256: 'a7a16b876a305fd1029c66dbd27007b4f6112ae896532f675878731a21e50cfd',
+    executableSha256: '3d7e98d3201c55c3bde6c069a5dfa0d34da9edc9145187c76594f685f8aa54c6'
+  },
+  'win32-x64': {
+    filename: 'bun-windows-x64.zip',
+    sha256: 'ce4c17497b2f29712a99d3d53f028de28cd42e3bacb8589599e7f000e49b6405',
+    executableSha256: '15277c59ccd6c6c20f8dc9716c2b59c1776320d606b6a8658f70be8799519ca4'
+  }
+}
+
+export function orcadBunReleaseUrl(asset: OrcadBunReleaseAsset): string {
+  return `https://github.com/oven-sh/bun/releases/download/bun-v${ORCAD_BUN_VERSION}/${asset.filename}`
+}
diff --git a/src/shared/orcad-profile-preflight.test.ts b/src/shared/orcad-profile-preflight.test.ts
new file mode 100644
index 000000000000..54dd7d819d38
--- /dev/null
+++ b/src/shared/orcad-profile-preflight.test.ts
@@ -0,0 +1,49 @@
+import { randomUUID } from 'node:crypto'
+import { describe, expect, it } from 'vitest'
+import { parseOrcadProfilePreflight } from './orcad-profile-preflight'
+
+const response = {
+  type: 'orca_profile_state_ready',
+  nonce: randomUUID(),
+  runtime: 'bun',
+  runtimeVersion: '1.4.2',
+  artifactVersion: '0.1.0+123456789abc',
+  sqliteVersion: '3.51.0',
+  revision: 1
+}
+
+function parse(value: unknown) {
+  return parseOrcadProfilePreflight(
+    JSON.stringify(value),
+    response.nonce,
+    response.runtimeVersion,
+    response.artifactVersion
+  )
+}
+
+describe('candidate profile readiness', () => {
+  it('admits an acknowledged write and backup under the expected installed runtime', () => {
+    expect(parse(response)).toEqual(response)
+  })
+
+  it.each([
+    { nonce: randomUUID() },
+    { runtime: 'node' },
+    { runtimeVersion: '1.4.0' },
+    { artifactVersion: '0.1.0+000000000000' },
+    { revision: 0 },
+    { sqliteVersion: '' }
+  ])('refuses stale or incomplete evidence: %j', (change) => {
+    expect(() => parse({ ...response, ...change })).toThrow()
+  })
+
+  it('does not choose a successful line out of contradictory output', () => {
+    expect(() =>
+      parseOrcadProfilePreflight(
+        `${JSON.stringify(response)}\n${JSON.stringify({ ...response, revision: 0 })}`,
+        response.nonce,
+        response.runtimeVersion
+      )
+    ).toThrow()
+  })
+})
diff --git a/src/shared/orcad-profile-preflight.ts b/src/shared/orcad-profile-preflight.ts
new file mode 100644
index 000000000000..2541a09ebdec
--- /dev/null
+++ b/src/shared/orcad-profile-preflight.ts
@@ -0,0 +1,38 @@
+import { z } from 'zod'
+
+export const ORCAD_PROFILE_PREFLIGHT_FLAG = '--orcad-profile-state-preflight'
+export const ORCAD_STARTUP_PREFLIGHT_FLAG = '--orcad-startup-preflight'
+export const ORCAD_PROFILE_PREFLIGHT_TIMEOUT_MS = 90_000
+// Server startup follows the disposable native/SQLite probe on every bundled launch.
+export const ORCAD_STARTUP_READINESS_TIMEOUT_MS = ORCAD_PROFILE_PREFLIGHT_TIMEOUT_MS + 90_000
+
+export const orcadProfilePreflightResponseSchema = z.object({
+  type: z.literal('orca_profile_state_ready'),
+  nonce: z.string().uuid(),
+  runtime: z.enum(['node', 'bun']),
+  runtimeVersion: z.string().min(1),
+  artifactVersion: z.string().regex(/^\d+\.\d+\.\d+\+[a-f0-9]{12}$/),
+  sqliteVersion: z.string().min(1),
+  revision: z.number().int().positive()
+})
+
+export type OrcadProfilePreflightResponse = z.infer<typeof orcadProfilePreflightResponseSchema>
+
+/** A fresh challenge prevents stale or unrelated output from admitting a candidate. */
+export function parseOrcadProfilePreflight(
+  output: string,
+  nonce: string,
+  runtimeVersion: string,
+  artifactVersion?: string
+): OrcadProfilePreflightResponse {
+  const response = orcadProfilePreflightResponseSchema.parse(JSON.parse(output.trim()))
+  if (
+    response.nonce !== nonce ||
+    response.runtime !== 'bun' ||
+    response.runtimeVersion !== runtimeVersion ||
+    (artifactVersion !== undefined && response.artifactVersion !== artifactVersion)
+  ) {
+    throw new Error('Profile preflight did not run under the expected candidate runtime')
+  }
+  return response
+}
diff --git a/src/shared/orchestration-compatibility-evidence.ts b/src/shared/orchestration-compatibility-evidence.ts
index 72c7a03c20cf..14beca112b75 100644
--- a/src/shared/orchestration-compatibility-evidence.ts
+++ b/src/shared/orchestration-compatibility-evidence.ts
@@ -26,6 +26,11 @@ export type OrchestrationCompatibilityEvidence = {
   paneKey?: string
   launchToken?: string
   host?: OrchestrationCompatibilityHostStamp
+  /**
+   * The Orca-minted agent session id from the caller's injected environment. When present it is
+   * the caller's identity: the dispatch entry resolves it, and a declared handle must name it.
+   */
+  agentSessionId?: string
 }
 
 const SECRET_KEYS = new Set([
diff --git a/src/shared/orchestration-session-caller-codes.ts b/src/shared/orchestration-session-caller-codes.ts
new file mode 100644
index 000000000000..7710ee95659f
--- /dev/null
+++ b/src/shared/orchestration-session-caller-codes.ts
@@ -0,0 +1,15 @@
+/** Refusals for an orchestration party named by its Orca agent session id; each applies no effects. */
+export const ORCHESTRATION_SESSION_CALLER_ERROR_CODES = {
+  /** The request crossed a host boundary (a paired client, SSH, or WSL); session identity is same-host only. */
+  hostBoundary: 'session_caller_host_boundary',
+  /** No Orca agent session with that id exists on this host. */
+  unknown: 'session_caller_unknown',
+  /** The id is a provider's own session id, which rotates on `/clear`; the refusal names the Orca id. */
+  providerId: 'session_caller_provider_id',
+  /** The session exists but has no live owner here: released, switching owners, or unreconciled. */
+  notLive: 'session_caller_not_live',
+  /** A request with no session id named a chat's address as its caller. */
+  chatNotDeclarable: 'session_caller_chat_not_declarable',
+  /** A Dispatch named a chat as its assignee, which a chat cannot be yet. */
+  chatNotDispatchable: 'session_chat_not_dispatchable'
+} as const
diff --git a/src/shared/persisted-ui-state-types.ts b/src/shared/persisted-ui-state-types.ts
index db5bd7ac3777..293efe942e4c 100644
--- a/src/shared/persisted-ui-state-types.ts
+++ b/src/shared/persisted-ui-state-types.ts
@@ -118,6 +118,10 @@ export type PersistedUIState = {
   _antigravityStatusBarDefaultAdded?: boolean
   /** One-shot migration flag for adding the default-on Grok status item. */
   _grokStatusBarDefaultAdded?: boolean
+  /** One-shot migration flag for adding the default-on Cursor status item. */
+  _cursorStatusBarDefaultAdded?: boolean
+  /** One-shot migration flag for adding the default-on ZCode status item. */
+  _zcodeStatusBarDefaultAdded?: boolean
   statusBarItems: StatusBarItem[]
   statusBarVisible: boolean
   /** Why: this is client-side presentation, not a provider/account or execution-host setting. */
diff --git a/src/shared/powershell-native-argument.test.ts b/src/shared/powershell-native-argument.test.ts
index 276413f4facd..b8e1feb8aa29 100644
--- a/src/shared/powershell-native-argument.test.ts
+++ b/src/shared/powershell-native-argument.test.ts
@@ -4,6 +4,9 @@ import { quotePowerShellLiteral, quotePowerShellNativeArgument } from './powersh
 describe('PowerShell native argument quoting', () => {
   it('escapes literals for PowerShell source parsing', () => {
     expect(quotePowerShellLiteral("WSL 'Preview'")).toBe("'WSL ''Preview'''")
+    expect(quotePowerShellLiteral('O\u2019Brien \u2018x\u201A\u201B')).toBe(
+      "'O\u2019\u2019Brien \u2018\u2018x\u201A\u201A\u201B\u201B'"
+    )
   })
 
   it('pre-escapes embedded quotes for Windows native argv parsing', () => {
diff --git a/src/shared/powershell-native-argument.ts b/src/shared/powershell-native-argument.ts
index 6376ab5d8423..f357a8e8fb7e 100644
--- a/src/shared/powershell-native-argument.ts
+++ b/src/shared/powershell-native-argument.ts
@@ -1,5 +1,6 @@
 export function quotePowerShellLiteral(value: string): string {
-  return `'${value.replace(/'/g, "''")}'`
+  // Why: PowerShell also ends single-quoted strings at typographic single quotes.
+  return `'${value.replace(/['\u2018\u2019\u201A\u201B]/g, '$&$&')}'`
 }
 
 export function quotePowerShellNativeArgument(value: string): string {
diff --git a/src/shared/process-table-index.test.ts b/src/shared/process-table-index.test.ts
new file mode 100644
index 000000000000..61f59ee1c993
--- /dev/null
+++ b/src/shared/process-table-index.test.ts
@@ -0,0 +1,160 @@
+import { describe, expect, it, vi } from 'vitest'
+import {
+  buildProcessTableIndex,
+  collectDescendantsFromIndex,
+  type ProcessIdentityRow
+} from './process-table-index'
+import { parseStrictProcessTableRows } from './process-table-snapshot'
+
+function boundedWalk<Row extends ProcessIdentityRow>(rows: readonly Row[], rootPid: number) {
+  const index = buildProcessTableIndex(rows)
+  const get = index.childrenByPpid.get.bind(index.childrenByPpid)
+  let lookups = 0
+  // A missing cycle guard must fail the test before it can hang or exhaust memory.
+  const spy = vi.spyOn(index.childrenByPpid, 'get').mockImplementation((pid) => {
+    if (++lookups > rows.length + 1) {
+      throw new Error('Descendant walk exceeded the row budget')
+    }
+    return get(pid)
+  })
+  try {
+    const result = collectDescendantsFromIndex(index, rootPid)
+    expect(result.some((row) => row.pid === rootPid)).toBe(false)
+    expect(new Set(result.map((row) => row.pid)).size).toBe(result.length)
+    return result
+  } finally {
+    spy.mockRestore()
+  }
+}
+
+describe('collectDescendantsFromIndex', () => {
+  it('preserves capture-order stack traversal, depth, row fields and input ownership', () => {
+    const rows = Object.freeze([
+      Object.freeze({ pid: 100, ppid: 1, command: 'shell' }),
+      Object.freeze({ pid: 200, ppid: 100, command: 'left' }),
+      Object.freeze({ pid: 201, ppid: 100, command: 'right' }),
+      Object.freeze({ pid: 300, ppid: 200, command: 'left-first' }),
+      Object.freeze({ pid: 301, ppid: 200, command: 'left-last' }),
+      Object.freeze({ pid: 400, ppid: 201, command: 'right-child' })
+    ])
+    const result = boundedWalk(rows, 100)
+    expect(result).toEqual([
+      { ...rows[2], depth: 1 },
+      { ...rows[5], depth: 2 },
+      { ...rows[1], depth: 1 },
+      { ...rows[4], depth: 2 },
+      { ...rows[3], depth: 2 }
+    ])
+    expect(result[0]).not.toBe(rows[2])
+    expect(Object.isFrozen(result[0])).toBe(false)
+  })
+
+  it('excludes a self-parented root', () => {
+    expect(
+      boundedWalk(
+        [
+          { pid: 5, ppid: 5 },
+          { pid: 6, ppid: 5 }
+        ],
+        5
+      )
+    ).toEqual([{ pid: 6, ppid: 5, depth: 1 }])
+  })
+
+  it('excludes the root from a two-node cycle with unique PIDs', () => {
+    expect(
+      boundedWalk(
+        [
+          { pid: 5, ppid: 6 },
+          { pid: 6, ppid: 5 }
+        ],
+        5
+      )
+    ).toEqual([{ pid: 6, ppid: 5, depth: 1 }])
+  })
+
+  it('terminates on a reachable two-node cycle with duplicate rows', () => {
+    const rows = [
+      { pid: 9, ppid: 1 },
+      { pid: 3, ppid: 9 },
+      { pid: 2, ppid: 3 },
+      { pid: 3, ppid: 2 }
+    ]
+    expect(boundedWalk(rows, 9)).toEqual([
+      { pid: 3, ppid: 9, depth: 1 },
+      { pid: 2, ppid: 3, depth: 2 }
+    ])
+  })
+
+  it('terminates on a reachable self-cycle', () => {
+    expect(
+      boundedWalk(
+        [
+          { pid: 2, ppid: 1 },
+          { pid: 2, ppid: 2 }
+        ],
+        1
+      )
+    ).toEqual([{ pid: 2, ppid: 1, depth: 1 }])
+  })
+
+  it('never returns a duplicate row that reuses the root PID', () => {
+    const rows = [
+      { pid: 50, ppid: 1 },
+      { pid: 60, ppid: 50 },
+      { pid: 50, ppid: 60 }
+    ]
+    expect(boundedWalk(rows, 50)).toEqual([{ pid: 60, ppid: 50, depth: 1 }])
+  })
+
+  it('ignores disconnected cycles and unrelated components', () => {
+    const rows = [
+      { pid: 2, ppid: 1 },
+      { pid: 8, ppid: 9 },
+      { pid: 9, ppid: 8 },
+      { pid: 20, ppid: 19 }
+    ]
+    expect(boundedWalk(rows, 1)).toEqual([{ pid: 2, ppid: 1, depth: 1 }])
+    expect(boundedWalk(rows, 99)).toEqual([])
+    expect(boundedWalk([], 1)).toEqual([])
+  })
+
+  it('queues each PID once, retaining the first queued duplicate', () => {
+    const rows = [
+      { pid: 2, ppid: 1, marker: 'first' },
+      { pid: 2, ppid: 1, marker: 'duplicate' },
+      { pid: 3, ppid: 1, marker: 'sibling' },
+      { pid: 2, ppid: 3, marker: 'other-parent' },
+      { pid: 4, ppid: 2, marker: 'child' }
+    ]
+    expect(boundedWalk(rows, 1)).toEqual([
+      { ...rows[2], depth: 1 },
+      { ...rows[0], depth: 1 },
+      { ...rows[4], depth: 2 }
+    ])
+    expect(buildProcessTableIndex(rows).byPid.get(2)).toBe(rows[0])
+  })
+
+  it('walks a deep valid tree without recursion or changing depth', () => {
+    const rows = Array.from({ length: 10_000 }, (_, index) => ({ pid: index + 2, ppid: index + 1 }))
+    expect(boundedWalk(rows, 1)).toEqual(rows.map((row, index) => ({ ...row, depth: index + 1 })))
+  })
+
+  it('preserves reverse capture order for a broad valid tree', () => {
+    const rows = Array.from({ length: 10_000 }, (_, index) => ({ pid: index + 2, ppid: 1 }))
+    expect(boundedWalk(rows, 1)).toEqual(rows.toReversed().map((row) => ({ ...row, depth: 1 })))
+  })
+
+  it('retains synthetic POSIX host identity fields through a cycle', () => {
+    const rows = parseStrictProcessTableRows('5 6 5 6 S pts/1 100 bash\n6 5 6 6 S+ pts/1 200 codex')
+    expect(boundedWalk(rows, 5)).toEqual([{ ...rows[1], depth: 1 }])
+  })
+
+  it('retains synthetic Windows creation markers without treating a PID as an incarnation', () => {
+    const rows = [
+      { pid: 5, ppid: 6, creationTimeMs: 100, name: 'pwsh.exe' },
+      { pid: 6, ppid: 5, creationTimeMs: 200, name: 'node.exe' }
+    ]
+    expect(boundedWalk(rows, 5)).toEqual([{ ...rows[1], depth: 1 }])
+  })
+})
diff --git a/src/shared/process-table-index.ts b/src/shared/process-table-index.ts
index dd4d29195afd..e8dc308b80bd 100644
--- a/src/shared/process-table-index.ts
+++ b/src/shared/process-table-index.ts
@@ -70,12 +70,24 @@ export function collectDescendantsFromIndex<Row extends ProcessIdentityRow>(
   rootPid: number
 ): (Row & { depth: number })[] {
   const descendants: (Row & { depth: number })[] = []
-  const stack = (index.childrenByPpid.get(rootPid) ?? []).map((row) => ({ row, depth: 1 }))
+  // PID reuse can make a process snapshot cyclic; queue each PID at most once.
+  const visited = new Set<number>([rootPid])
+  const stack: { row: Row; depth: number }[] = []
+  const pushUnvisited = (row: Row, depth: number): void => {
+    if (visited.has(row.pid)) {
+      return
+    }
+    visited.add(row.pid)
+    stack.push({ row, depth })
+  }
+  for (const child of index.childrenByPpid.get(rootPid) ?? []) {
+    pushUnvisited(child, 1)
+  }
   while (stack.length > 0) {
     const { row, depth } = stack.pop()!
     descendants.push({ ...row, depth })
     for (const child of index.childrenByPpid.get(row.pid) ?? []) {
-      stack.push({ row: child, depth: depth + 1 })
+      pushUnvisited(child, depth + 1)
     }
   }
   return descendants
diff --git a/src/shared/profile-state-recovery-command.test.ts b/src/shared/profile-state-recovery-command.test.ts
new file mode 100644
index 000000000000..8036ecac0859
--- /dev/null
+++ b/src/shared/profile-state-recovery-command.test.ts
@@ -0,0 +1,28 @@
+import { describe, expect, it } from 'vitest'
+import { profileStateRecoveryRequestSchema } from './profile-state-recovery-command'
+
+describe('offline recovery source selection', () => {
+  it.each([
+    { kind: 'current-json' },
+    { kind: 'json', revision: 1 },
+    { kind: 'sqlite', backupId: 'selected-backup' }
+  ])('accepts an explicit source: %j', (selector) => {
+    expect(
+      profileStateRecoveryRequestSchema.parse({ userDataPath: '/profile', selector }).selector
+    ).toEqual(selector)
+  })
+
+  it.each([
+    { kind: 'current-json', revision: 1 },
+    { kind: 'current-json', backupId: 'selected-backup' },
+    { kind: 'current-json', path: '../different-profile/orca-data.json' },
+    { kind: 'json', revision: null },
+    { kind: 'json', revision: 0 },
+    { kind: 'sqlite' },
+    { kind: 'json' }
+  ])('rejects ambiguous or incomplete sources: %j', (selector) => {
+    expect(
+      profileStateRecoveryRequestSchema.safeParse({ userDataPath: '/profile', selector }).success
+    ).toBe(false)
+  })
+})
diff --git a/src/shared/profile-state-recovery-command.ts b/src/shared/profile-state-recovery-command.ts
new file mode 100644
index 000000000000..a18ec4544148
--- /dev/null
+++ b/src/shared/profile-state-recovery-command.ts
@@ -0,0 +1,75 @@
+import { z } from 'zod'
+
+export const PROFILE_STATE_RECOVERY_FLAG = '--profile-state-recovery'
+export const PROFILE_STATE_RECOVERY_RESULT_PREFIX = '[profile-state-recovery] '
+/** Desktop variant: applies a startup-dialog choice, then relaunches Orca normally. */
+export const PROFILE_STATE_DESKTOP_RECOVERY_FLAG = '--profile-state-desktop-recovery'
+
+const positiveInteger = z.number().int().positive().max(Number.MAX_SAFE_INTEGER)
+const selectorSchema = z.discriminatedUnion('kind', [
+  z.object({ kind: z.literal('json'), revision: positiveInteger }).strict(),
+  z.object({ kind: z.literal('current-json') }).strict(),
+  z.object({ kind: z.literal('current-sqlite') }).strict(),
+  z.object({ kind: z.literal('sqlite'), backupId: z.string().min(1) }).strict()
+])
+
+export const profileStateRecoveryRequestSchema = z
+  .object({
+    userDataPath: z.string().min(1),
+    selector: selectorSchema
+  })
+  .strict()
+
+const exportsSchema = z.object({
+  profileId: z.string(),
+  dataFile: z.string(),
+  databaseFile: z.string(),
+  exportPaths: z.array(z.string()).readonly(),
+  backups: z
+    .array(z.object({ id: z.string(), path: z.string(), createdAtMs: positiveInteger }))
+    .readonly()
+})
+const rollbackSchema = exportsSchema.extend({
+  // Canonical JSON edited outside SQLite has no database revision.
+  revision: positiveInteger.nullable(),
+  quarantineDirectory: z.string(),
+  removedDatabaseFiles: z.array(z.string()).readonly(),
+  storage: z.enum(['json', 'sqlite']),
+  restoredPath: z.string(),
+  backupId: z.string().optional()
+})
+
+export const profileStateRecoveryResponseSchema = z.discriminatedUnion('ok', [
+  z.object({ ok: z.literal(true), result: rollbackSchema }),
+  z.object({
+    ok: z.literal(false),
+    code: z.enum(['invalid_argument', 'runtime_error']),
+    message: z.string()
+  })
+])
+
+export type ProfileStateRecoverySelector = z.infer<typeof selectorSchema>
+export type ProfileStateRecoveryRequest = z.infer<typeof profileStateRecoveryRequestSchema>
+export type ProfileStateRecoveryResponse = z.infer<typeof profileStateRecoveryResponseSchema>
+export type ProfileStateExportsResult = z.infer<typeof exportsSchema>
+export type ProfileStateRollbackResult = z.infer<typeof rollbackSchema>
+
+export class ProfileStateRecoveryCommandError extends Error {
+  constructor(
+    readonly code: 'invalid_argument' | 'runtime_error',
+    message: string
+  ) {
+    super(message)
+    this.name = 'ProfileStateRecoveryCommandError'
+  }
+}
+
+export function isProfileStateRecoveryCommandError(
+  error: unknown
+): error is Error & { code: 'invalid_argument' | 'runtime_error' } {
+  return (
+    error instanceof Error &&
+    'code' in error &&
+    (error.code === 'invalid_argument' || error.code === 'runtime_error')
+  )
+}
diff --git a/src/shared/profile-state-storage-paths.ts b/src/shared/profile-state-storage-paths.ts
new file mode 100644
index 000000000000..0dea3dbb0a51
--- /dev/null
+++ b/src/shared/profile-state-storage-paths.ts
@@ -0,0 +1,16 @@
+import { join } from 'node:path'
+
+export const PROFILE_STATE_DATABASE_FILE_NAME = 'profile-state.db'
+
+/** Pure profile-state path helpers shared by the offline CLI and main process. */
+export function profileStateDatabaseFile(profileDirectory: string): string {
+  return join(profileDirectory, PROFILE_STATE_DATABASE_FILE_NAME)
+}
+
+export function getOrcaProfileDataFile(profileId: string, userDataPath: string): string {
+  return join(userDataPath, 'profiles', profileId, 'orca-data.json')
+}
+
+export function getOrcaProfileStateDatabaseFile(profileId: string, userDataPath: string): string {
+  return profileStateDatabaseFile(join(userDataPath, 'profiles', profileId))
+}
diff --git a/src/shared/profile-state-telemetry-schema.test.ts b/src/shared/profile-state-telemetry-schema.test.ts
new file mode 100644
index 000000000000..63c9dd88ab01
--- /dev/null
+++ b/src/shared/profile-state-telemetry-schema.test.ts
@@ -0,0 +1,29 @@
+import { describe, expect, it } from 'vitest'
+import { eventSchemas } from './telemetry-events'
+
+describe('profile state authority telemetry', () => {
+  it('accepts the bounded startup selection payload', () => {
+    expect(
+      eventSchemas.profile_state_authority_selected.safeParse({
+        backend: 'sqlite',
+        classification: 'json-only',
+        authority_mode: 'sqlite-candidate',
+        runtime: 'desktop',
+        migrated: true
+      }).success
+    ).toBe(true)
+  })
+
+  it('rejects paths or other unbounded diagnostic fields', () => {
+    expect(
+      eventSchemas.profile_state_authority_selected.safeParse({
+        backend: 'sqlite',
+        classification: 'sqlite-only',
+        authority_mode: 'sqlite-established',
+        runtime: 'desktop',
+        migrated: false,
+        database_path: '/private/profile.sqlite'
+      }).success
+    ).toBe(false)
+  })
+})
diff --git a/src/shared/project-groups.ts b/src/shared/project-groups.ts
index 5b37aadce8c7..4cfa87080e21 100644
--- a/src/shared/project-groups.ts
+++ b/src/shared/project-groups.ts
@@ -1,17 +1,10 @@
 import { normalizeExecutionHostId } from './execution-host'
 import type { ProjectGroup, ProjectGroupCreatedFrom } from './project-group-types'
 import type { Repo } from './repo-types'
+import { createNonSecureContextUuid } from './non-secure-context-uuid'
 
 export const UNGROUPED_PROJECT_GROUP_KEY = 'project-group:ungrouped'
 
-function createProjectGroupId(): string {
-  const randomUUID = globalThis.crypto?.randomUUID
-  if (randomUUID) {
-    return randomUUID.call(globalThis.crypto)
-  }
-  return `project-group-${Date.now()}-${Math.random().toString(36).slice(2)}`
-}
-
 export function normalizeProjectGroupName(name: string, fallback = 'Untitled group'): string {
   const trimmed = name.trim()
   return trimmed.length > 0 ? trimmed : fallback
@@ -28,7 +21,7 @@ export function createProjectGroup(input: {
 }): ProjectGroup {
   const now = input.now ?? Date.now()
   return {
-    id: createProjectGroupId(),
+    id: createNonSecureContextUuid(),
     name: normalizeProjectGroupName(input.name),
     parentPath: input.parentPath ?? null,
     connectionId: input.connectionId ?? null,
diff --git a/src/shared/protocol-version.ts b/src/shared/protocol-version.ts
index dac7fa084bd6..5dcc8c3b52b9 100644
--- a/src/shared/protocol-version.ts
+++ b/src/shared/protocol-version.ts
@@ -165,6 +165,11 @@ export const STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY = 'agent-session.struct
 // clients skip the host's bounded best-effort settlement observation.
 export const AGENT_SESSION_PENDING_SEND_RESULT_RUNTIME_CAPABILITY =
   'agent-session.pending-send-result.v1' as const
+// Why: a send is now answered once the host accepts it, before any agent has it. A client without
+// this cannot show a message rejected after that answer, so the host holds its reply until the
+// message is handed over or rejected.
+export const AGENT_SESSION_ACCEPTED_SEND_RUNTIME_CAPABILITY =
+  'agent-session.accepted-send.v1' as const
 // Why: paired clients advertise Claude-structured support so the host can gate its agent-specific
 // journal and lifecycle surfaces independently from Codex support.
 export const CLAUDE_STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY =
@@ -211,6 +216,10 @@ export const AGENT_SESSION_BACKGROUND_TASK_STOP_CAPABILITY =
 // older host that would reject the whole cancellation instead of falling back to turn stop.
 export const AGENT_SESSION_PROMPT_CANCEL_RUNTIME_CAPABILITY =
   'agent-session.prompt-cancel.v1' as const
+// Why: agentSession.respondToQuestion has a strict schema, so clients must not send structured
+// `answers` to an older host; they fall back to the answer packed into `optionId`.
+export const AGENT_SESSION_QUESTION_ANSWERS_RUNTIME_CAPABILITY =
+  'agent-session.question-answers.v1' as const
 // Why: the host now publishes rows for work that is live inside a turn, and such
 // a row carries `stoppable: false` because no targeted stop can reach it. A
 // reader that predates the field draws a per-row Stop on every row it is given,
@@ -225,6 +234,9 @@ export const AGENT_SESSION_KIMI_RESUME_RUNTIME_CAPABILITY = 'agent-session.kimi-
 export const AGENT_SESSION_OPENCODE2_RESUME_RUNTIME_CAPABILITY =
   'agent-session.opencode2-resume.v1' as const
 export const AGENT_SESSION_MUSE_RESUME_RUNTIME_CAPABILITY = 'agent-session.muse-resume.v1' as const
+export const AGENT_SESSION_DSH_RESUME_RUNTIME_CAPABILITY = 'agent-session.dsh-resume.v1' as const
+export const AGENT_SESSION_QODER_RESUME_RUNTIME_CAPABILITY =
+  'agent-session.qoder-resume.v1' as const
 export const AGENT_SESSION_ZCODE_RESUME_RUNTIME_CAPABILITY =
   'agent-session.zcode-resume.v1' as const
 // Why: older runtimes strip mutation owner fields, so clients must fence writes before RPC.
@@ -298,6 +310,7 @@ export const NATIVE_REMOTE_RUNTIME_CLIENT_CAPABILITIES = [
 export const ELECTRON_REMOTE_RUNTIME_CLIENT_CAPABILITIES = [
   ...NATIVE_REMOTE_RUNTIME_CLIENT_CAPABILITIES,
   AGENT_SESSION_PENDING_SEND_RESULT_RUNTIME_CAPABILITY,
+  AGENT_SESSION_ACCEPTED_SEND_RUNTIME_CAPABILITY,
   BROWSER_CLIENT_HOST_RUNTIME_CAPABILITY,
   BROWSER_CLIENT_PAGE_METADATA_RUNTIME_CAPABILITY,
   // Why: only the renderer runs the retirement-proof ledger; CLI and mobile must keep full lists.
@@ -368,6 +381,9 @@ export const RUNTIME_CAPABILITIES = [
   AGENT_SESSION_KEYBOARD_RUNTIME_CAPABILITY,
   STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY,
   AGENT_SESSION_PENDING_SEND_RESULT_RUNTIME_CAPABILITY,
+  // The host side: it accepts a send before any agent has it, and a Stop with no writer before a
+  // turn starts, so a client may gate on either.
+  AGENT_SESSION_ACCEPTED_SEND_RUNTIME_CAPABILITY,
   STRUCTURED_AGENT_SESSION_HOLD_RUNTIME_CAPABILITY,
   STRUCTURED_AGENT_SESSION_REVEAL_RUNTIME_CAPABILITY,
   STRUCTURED_AGENT_SESSION_RESUME_HISTORY_RUNTIME_CAPABILITY,
@@ -377,11 +393,14 @@ export const RUNTIME_CAPABILITIES = [
   AGENT_SESSION_CONVERSATION_OUTLINE_RUNTIME_CAPABILITY,
   AGENT_SESSION_BACKGROUND_TASK_STOP_CAPABILITY,
   AGENT_SESSION_PROMPT_CANCEL_RUNTIME_CAPABILITY,
+  AGENT_SESSION_QUESTION_ANSWERS_RUNTIME_CAPABILITY,
   AGENT_SESSION_TURN_ITEM_CAPABILITY,
   AGENT_SESSION_BACKGROUND_TASK_ROW_STOP_CAPABILITY,
   AGENT_SESSION_KIMI_RESUME_RUNTIME_CAPABILITY,
   AGENT_SESSION_OPENCODE2_RESUME_RUNTIME_CAPABILITY,
   AGENT_SESSION_MUSE_RESUME_RUNTIME_CAPABILITY,
+  AGENT_SESSION_DSH_RESUME_RUNTIME_CAPABILITY,
+  AGENT_SESSION_QODER_RESUME_RUNTIME_CAPABILITY,
   AGENT_SESSION_ZCODE_RESUME_RUNTIME_CAPABILITY,
   FILE_MUTATION_OWNERSHIP_RUNTIME_CAPABILITY,
   GITHUB_MARK_PR_READY_RUNTIME_CAPABILITY,
diff --git a/src/shared/pty-liveness-verdict.ts b/src/shared/pty-liveness-verdict.ts
index 0dd650161f38..ae1632572428 100644
--- a/src/shared/pty-liveness-verdict.ts
+++ b/src/shared/pty-liveness-verdict.ts
@@ -27,6 +27,17 @@ export function describeUnconfirmedStop(reason: string): string {
   return `The PTY was not confirmed stopped: ${endSentence(reason)}`
 }
 
+/** A close's unconfirmed-stop sentence; it promises a retry only when the host recorded one. */
+export function describeUnconfirmedCloseStop(close: {
+  ptyStopReason?: string
+  pendingKillRecorded?: true
+}): string {
+  const sentence = describeUnconfirmedStop(close.ptyStopReason ?? 'its host could not be reached')
+  return close.pendingKillRecorded === true
+    ? `${sentence} The kill retries when the host reconnects.`
+    : sentence
+}
+
 /** Words a close whose PTY teardown was never confirmed, for a stop receipt. */
 export function describeUnconfirmedAgentStop(close: {
   ptyStopVerdict?: 'live' | 'unverifiable'
diff --git a/src/shared/qoder-agent.test.ts b/src/shared/qoder-agent.test.ts
new file mode 100644
index 000000000000..8db665e72094
--- /dev/null
+++ b/src/shared/qoder-agent.test.ts
@@ -0,0 +1,160 @@
+import { readFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { describe, expect, it } from 'vitest'
+import {
+  recognizeAgentProcessFromCommandLine,
+  isExpectedAgentProcess
+} from './agent-process-recognition'
+import {
+  getAgentLabel,
+  isGeminiTerminalTitle,
+  normalizeTerminalTitle,
+  detectAgentStatusFromTitle
+} from './agent-detection'
+import { buildAgentStartupPlan } from './tui-agent-startup'
+import { getAgentResumeArgv } from './agent-session-resume'
+import { createHookListenerState } from './agent-hook-listener/listener-state'
+import { normalizeAndAccept } from './agent-hook-listener-test-harness'
+
+describe('Qoder agent identity and lifecycle', () => {
+  it('recognizes the installed versioned binary on native platforms and excludes headless runs', () => {
+    for (const command of [
+      'qodercli',
+      '/home/dev/.qoder/bin/qodercli/qodercli-1.1.64',
+      'C:\\Qoder\\qodercli-1.1.64.exe'
+    ]) {
+      expect(recognizeAgentProcessFromCommandLine(command)?.agent).toBe('qoder')
+      expect(isExpectedAgentProcess(command, 'qodercli')).toBe(true)
+    }
+    expect(recognizeAgentProcessFromCommandLine('qodercli --print hello')).toBeNull()
+    for (const args of [
+      '-o json',
+      '--input-format=stream-json',
+      '--remote-control session',
+      '--acp',
+      '--delete-session 1'
+    ]) {
+      expect(recognizeAgentProcessFromCommandLine(`qodercli ${args}`)).toBeNull()
+    }
+    expect(recognizeAgentProcessFromCommandLine('qodercli --prompt-interactive hello')?.agent).toBe(
+      'qoder'
+    )
+    expect(recognizeAgentProcessFromCommandLine('qodercli-unrelated')).toBeNull()
+  })
+
+  it.each([
+    ['◇ Qoder CLI | Ready', 'idle'],
+    ['✦ Implement feature | Thinking', 'working'],
+    ['▲ Implement feature | Confirm', 'permission']
+  ] as const)('keeps %s attributed through title storage', (title, status) => {
+    const stored = normalizeTerminalTitle(title.padEnd(80))
+    expect(getAgentLabel(stored)).toBe('Qoder CLI')
+    expect(isGeminiTerminalTitle(title)).toBe(false)
+    expect(detectAgentStatusFromTitle(stored)).toBe(status)
+    expect(normalizeTerminalTitle(stored)).toBe(stored)
+  })
+
+  it('keeps upstream Gemini titles and arbitrary triangle text unchanged', () => {
+    expect(isGeminiTerminalTitle('✦  Working (project)')).toBe(true)
+    expect(getAgentLabel('deploy ▲ complete')).not.toBe('Qoder CLI')
+  })
+
+  it('tracks start, work, permission, completion and resume without becoming Claude', () => {
+    const state = createHookListenerState()
+    const session = { session_id: 'qoder-session', transcript_path: '/tmp/qoder-session.jsonl' }
+    const send = (hook_event_name: string, extra = {}) =>
+      normalizeAndAccept(state, 'qoder', { ...session, hook_event_name, ...extra })
+    const started = send('SessionStart', { source: 'startup' })
+    expect(started?.payload).toMatchObject({
+      agentType: 'qoder',
+      state: 'done',
+      sessionBoundary: true
+    })
+    expect(started?.providerSession).toMatchObject({ id: 'qoder-session' })
+    expect(send('UserPromptSubmit', { prompt: 'Fix the bug' })?.payload).toMatchObject({
+      state: 'working',
+      agentType: 'qoder',
+      prompt: 'Fix the bug'
+    })
+    expect(
+      send('PermissionRequest', { tool_name: 'Bash', tool_input: { command: 'pwd' } })?.payload
+    ).toMatchObject({ state: 'waiting', toolName: 'Bash' })
+    expect(send('PostToolUse', { tool_name: 'Bash' })?.payload.state).toBe('working')
+    expect(send('SessionStart', { source: 'compact' })).toBeNull()
+    expect(send('Stop', { last_assistant_message: 'Fixed.' })?.payload).toMatchObject({
+      state: 'done',
+      lastAssistantMessage: 'Fixed.'
+    })
+    expect(send('StopFailure', { error: 'Unavailable' })?.payload.mainAgent).toMatchObject({
+      outcome: 'failure'
+    })
+    expect(getAgentResumeArgv('qoder', { key: 'session_id', id: 'qoder-session' })).toEqual([
+      'qodercli',
+      '--resume',
+      'qoder-session'
+    ])
+  })
+})
+
+it('replays captured unauthenticated startup, prompt, idle and resume hooks', () => {
+  const state = createHookListenerState()
+  const lines = readFileSync(
+    join(__dirname, '__fixtures__', 'qoder-no-account-hooks.jsonl'),
+    'utf8'
+  )
+    .trim()
+    .split('\n')
+  const events = lines.map((line) => normalizeAndAccept(state, 'qoder', JSON.parse(line)))
+  expect(events.map((event) => event?.payload.state)).toEqual([
+    'done',
+    'working',
+    'done',
+    'done',
+    'done',
+    'done'
+  ])
+  expect(events.every((event) => event?.payload.agentType === 'qoder')).toBe(true)
+  expect(events[4]?.payload.sessionBoundary).toBe(true)
+  expect(events[4]?.providerSession?.id).toBe(events[0]?.providerSession?.id)
+})
+
+it.each(['darwin', 'linux', 'win32'] as const)(
+  'launches a Qoder prompt safely on %s',
+  (platform) => {
+    const plan = buildAgentStartupPlan({
+      agent: 'qoder',
+      prompt: "fix Bob's branch; echo $HOME",
+      cmdOverrides: {},
+      platform
+    })
+    expect(plan?.expectedProcess).toBe('qodercli')
+    expect(plan?.followupPrompt).toBeNull()
+    expect(plan?.launchCommand).toBe(
+      platform === 'win32'
+        ? "qodercli --prompt-interactive 'fix Bob''s branch; echo $HOME'"
+        : `qodercli --prompt-interactive 'fix Bob'"'"'s branch; echo $HOME'`
+    )
+  }
+)
+
+it('does not rewrite DSH titles containing a pipe as Qoder', () => {
+  const title = '✦ 🐋 refactor parser | run tests'
+  expect(normalizeTerminalTitle(title)).toBe(title)
+  expect(getAgentLabel(title)).not.toBe('Qoder CLI')
+  expect(detectAgentStatusFromTitle(title)).not.toBe('working')
+})
+
+it('settles manual compaction without interrupting automatic compaction', () => {
+  const state = createHookListenerState()
+  const send = (hook_event_name: string, extra = {}) =>
+    normalizeAndAccept(state, 'qoder', { hook_event_name, ...extra })
+  expect(send('UserPromptSubmit', { prompt: 'Refactor' })?.payload.state).toBe('working')
+  expect(send('PreCompact', { trigger: 'manual' })).toBeNull()
+  expect(send('PostCompact', { trigger: 'auto' })).toBeNull()
+  expect(send('SessionStart', { source: 'compact' })).toBeNull()
+  expect(send('PostCompact', { trigger: 'manual' })?.payload).toMatchObject({
+    state: 'done',
+    sessionBoundary: true,
+    agentType: 'qoder'
+  })
+})
diff --git a/src/shared/qoder-headless-command.ts b/src/shared/qoder-headless-command.ts
new file mode 100644
index 000000000000..6ffb16ca9b37
--- /dev/null
+++ b/src/shared/qoder-headless-command.ts
@@ -0,0 +1,31 @@
+import { isPrintModeHeadlessOneShotCommand, optionName } from './print-mode-headless-command'
+
+export function isQoderHeadlessCommand(tokens: readonly string[]): boolean {
+  if (isPrintModeHeadlessOneShotCommand(tokens)) {
+    return true
+  }
+  for (let index = 1; index < tokens.length; index += 1) {
+    const token = tokens[index]
+    if (token === '--') {
+      return false
+    }
+    const name = optionName(token)
+    const value = token.includes('=') ? token.slice(token.indexOf('=') + 1) : tokens[index + 1]
+    if (name === '-o' && (value === 'json' || value === 'stream-json')) {
+      return true
+    }
+    if (name === '--input-format' && value === 'stream-json') {
+      return true
+    }
+    if (
+      name === '--remote-control' ||
+      name === '--remote' ||
+      name === '--list-sessions' ||
+      name === '--delete-session' ||
+      name === '--acp'
+    ) {
+      return true
+    }
+  }
+  return false
+}
diff --git a/src/shared/qoder-terminal-title.ts b/src/shared/qoder-terminal-title.ts
new file mode 100644
index 000000000000..e21b9dbb0e38
--- /dev/null
+++ b/src/shared/qoder-terminal-title.ts
@@ -0,0 +1,21 @@
+import { isDshTerminalTitle } from './dsh-terminal-title'
+
+// Qoder 1.1.64: one space after the glyph, then a session title and a pipe-delimited status.
+const QODER_DYNAMIC_TITLE_RE = /^[✦◇▲] (?! ).*\s\|\s[^|]+$/
+const QODER_LABEL_RE = /^(?:[✦◇▲] )?Qoder CLI(?: CN)?(?: \(.*\))?$/
+
+export function isQoderTerminalTitle(title: string): boolean {
+  if (isDshTerminalTitle(title)) {
+    return false
+  }
+  const trimmed = title.trim()
+  return QODER_DYNAMIC_TITLE_RE.test(trimmed) || QODER_LABEL_RE.test(trimmed)
+}
+
+export function qoderTitleStatus(title: string): 'working' | 'permission' | 'idle' | null {
+  if (!isQoderTerminalTitle(title)) {
+    return null
+  }
+  const glyph = title.trimStart()[0]
+  return glyph === '✦' ? 'working' : glyph === '▲' ? 'permission' : 'idle'
+}
diff --git a/src/shared/rate-limit-state-factory.ts b/src/shared/rate-limit-state-factory.ts
index 96ae50f9b28c..494f56e4dff1 100644
--- a/src/shared/rate-limit-state-factory.ts
+++ b/src/shared/rate-limit-state-factory.ts
@@ -11,10 +11,13 @@ export function createEmptyRateLimitState(overrides: Partial<RateLimitState> = {
     antigravity: null,
     minimax: null,
     grok: null,
+    cursor: null,
+    zcode: null,
     minimaxCookieConfigured: false,
     minimaxApiKeyConfigured: false,
     opencodeGoApiKeyConfigured: false,
     grokAuthConfigured: false,
+    cursorAuthConfigured: false,
     claudeTarget: { runtime: 'host', wslDistro: null },
     codexTarget: { runtime: 'host', wslDistro: null },
     inactiveClaudeAccounts: [],
diff --git a/src/shared/rate-limit-types.test.ts b/src/shared/rate-limit-types.test.ts
index d3276b1afe45..556af5785659 100644
--- a/src/shared/rate-limit-types.test.ts
+++ b/src/shared/rate-limit-types.test.ts
@@ -16,10 +16,13 @@ describe('RateLimitState', () => {
       antigravity: null,
       minimax: null,
       grok: null,
+      cursor: null,
+      zcode: null,
       minimaxCookieConfigured: false,
       minimaxApiKeyConfigured: false,
       opencodeGoApiKeyConfigured: false,
       grokAuthConfigured: false,
+      cursorAuthConfigured: false,
       claudeTarget: { runtime: 'host', wslDistro: null },
       codexTarget: { runtime: 'host', wslDistro: null },
       inactiveClaudeAccounts: [],
@@ -30,5 +33,7 @@ describe('RateLimitState', () => {
     expect(state.minimax).toBeNull()
     expect(state.minimaxCookieConfigured).toBe(false)
     expect(state.minimaxApiKeyConfigured).toBe(false)
+    expect(state.cursor).toBeNull()
+    expect(state.cursorAuthConfigured).toBe(false)
   })
 })
diff --git a/src/shared/rate-limit-types.ts b/src/shared/rate-limit-types.ts
index dd89c9e8ec69..6b06f09d10e9 100644
--- a/src/shared/rate-limit-types.ts
+++ b/src/shared/rate-limit-types.ts
@@ -57,15 +57,17 @@ export type ProviderRateLimits = {
     | 'minimax'
     | 'grok'
     | 'antigravity'
+    | 'cursor'
+    | 'zcode'
   /** 5-hour session window, null if not available. */
   session: RateLimitWindow | null
   /** 7-day weekly window, null if not available. */
   weekly: RateLimitWindow | null
   /** Claude Fable 7-day weekly window, null if not available. */
   fableWeekly?: RateLimitWindow | null
-  /** 30-day monthly window (OpenCode Go, Grok unified billing), null if not available. */
+  /** 30-day monthly window (OpenCode Go, Grok unified billing, Cursor plan pools), null if not available. */
   monthly?: RateLimitWindow | null
-  /** Named per-model buckets (Gemini only). */
+  /** Named per-model buckets (Gemini models, Cursor plan pools). */
   buckets?: RateLimitBucket[]
   /** Available earned Codex rate-limit reset credits, if reported. */
   rateLimitResetCredits?: {
@@ -117,6 +119,17 @@ export type GrokAccountStatus = {
   error: string | null
 }
 
+export type CursorAccountStatus = {
+  signedIn: boolean
+  email: string | null
+  displayName: string | null
+  /** Which local store the session came from: the macOS Keychain, the CLI auth file, or Cursor IDE. */
+  credentialSource: 'keychain' | 'cli' | 'desktop' | null
+  planType: string | null
+  tokenFresh: boolean
+  error: string | null
+}
+
 export type RateLimitState = {
   claude: ProviderRateLimits | null
   codex: ProviderRateLimits | null
@@ -126,6 +139,8 @@ export type RateLimitState = {
   antigravity: ProviderRateLimits | null
   minimax: ProviderRateLimits | null
   grok: ProviderRateLimits | null
+  cursor: ProviderRateLimits | null
+  zcode: ProviderRateLimits | null
   /**
    * True when a MiniMax session cookie is persisted on disk. The cookie lives
    * outside GlobalSettings, so this flag is the durable signal that the
@@ -149,6 +164,12 @@ export type RateLimitState = {
   opencodeGoApiKeyConfigured: boolean
   /** True when main finds a Grok CLI session file (~/.grok/auth.json or GROK_HOME). */
   grokAuthConfigured: boolean
+  /**
+   * True when main finds a Cursor session on this machine: the macOS Keychain
+   * item cursor-agent writes, its legacy auth.json, or the Cursor IDE's own
+   * stored login. The token itself never leaves main.
+   */
+  cursorAuthConfigured: boolean
   claudeTarget: RateLimitRuntimeTarget
   codexTarget: RateLimitRuntimeTarget
   inactiveClaudeAccounts: InactiveAccountUsage[]
diff --git a/src/shared/relay-artifacts.ts b/src/shared/relay-artifacts.ts
index 73ce8c7af1b6..4e4c834f2200 100644
--- a/src/shared/relay-artifacts.ts
+++ b/src/shared/relay-artifacts.ts
@@ -47,11 +47,13 @@ export type RelayArtifact = {
 
 /** The bare Windows process-table addon; see docs/reference/windows-process-enumeration.md. */
 export const RELAY_WINDOWS_PROCESS_TREE_FILENAME = 'windows-process-tree.node'
+export const RELAY_OPENCODE_SQLITE_READER_FILENAME = 'opencode-sqlite-reader.cjs'
 
 export const RELAY_ARTIFACTS: readonly RelayArtifact[] = [
   { filename: 'relay.js' },
   { filename: 'relay-watcher.js', daemonServiceChild: true },
   { filename: 'relay-ai-vault-service.js', daemonServiceChild: true },
+  { filename: RELAY_OPENCODE_SQLITE_READER_FILENAME },
   { filename: 'managed-hook-runtime.js' },
   // Forked by the AI Vault title reader; without it a relay answers every WSL
   // title request with no title and no error.
diff --git a/src/shared/remote-runtime-subscription-frame-router.test.ts b/src/shared/remote-runtime-subscription-frame-router.test.ts
index 8563c9b0d2f8..e75ca2e8b6dd 100644
--- a/src/shared/remote-runtime-subscription-frame-router.test.ts
+++ b/src/shared/remote-runtime-subscription-frame-router.test.ts
@@ -1,6 +1,6 @@
 import { Buffer } from 'node:buffer'
 import { describe, expect, it, vi } from 'vitest'
-import { encrypt } from './e2ee-crypto'
+import { encrypt, encryptBytes } from './e2ee-crypto'
 import type { RemoteRuntimeClientError } from './remote-runtime-client-error'
 import { RemoteRuntimeSubscriptionFrameRouter } from './remote-runtime-subscription-frame-router'
 
@@ -58,3 +58,60 @@ describe('RemoteRuntimeSubscriptionFrameRouter authentication frames', () => {
     })
   })
 })
+
+function createReadyRouter(callbacks: {
+  onResponse: (response: unknown) => void
+  onBinary?: (bytes: Uint8Array) => void
+}) {
+  const fail = vi.fn<(error: RemoteRuntimeClientError) => void>()
+  const router = new RemoteRuntimeSubscriptionFrameRouter<unknown>({
+    sharedKey: SHARED_KEY,
+    serializedAuth: '{}',
+    serializedRequest: '{}',
+    requestId: 'request-1',
+    send: vi.fn(),
+    fail,
+    onAuthenticated: vi.fn(),
+    callbacks
+  })
+  router.state = 'ready'
+  return { fail, router }
+}
+
+describe('RemoteRuntimeSubscriptionFrameRouter consumer callbacks', () => {
+  it('fails the subscription instead of throwing out of the socket message handler', () => {
+    const { fail, router } = createReadyRouter({
+      onResponse: () => {
+        throw new Error('Unknown environment: env-1')
+      }
+    })
+    const response = JSON.stringify({
+      id: 'request-1',
+      ok: true,
+      result: {},
+      _meta: { runtimeId: 'r' }
+    })
+
+    expect(() => handleEncryptedAuthFrame(router, response)).not.toThrow()
+    expect(fail).toHaveBeenCalledOnce()
+    expect(fail.mock.calls[0][0]).toMatchObject({
+      code: 'runtime_error',
+      message: 'Unknown environment: env-1'
+    })
+  })
+
+  it('fails the subscription when a binary consumer throws', () => {
+    const { fail, router } = createReadyRouter({
+      onResponse: vi.fn(),
+      onBinary: () => {
+        throw new Error('consumer exploded')
+      }
+    })
+
+    expect(() =>
+      router.handleFrame(Buffer.from(encryptBytes(new Uint8Array([1, 2, 3]), SHARED_KEY)), true)
+    ).not.toThrow()
+    expect(fail).toHaveBeenCalledOnce()
+    expect(fail.mock.calls[0][0]).toMatchObject({ code: 'runtime_error' })
+  })
+})
diff --git a/src/shared/remote-runtime-subscription-frame-router.ts b/src/shared/remote-runtime-subscription-frame-router.ts
index fa8e6f3dce4b..e6f2e2e39863 100644
--- a/src/shared/remote-runtime-subscription-frame-router.ts
+++ b/src/shared/remote-runtime-subscription-frame-router.ts
@@ -116,7 +116,7 @@ export class RemoteRuntimeSubscriptionFrameRouter<TResult> {
     }
     const response = parsed.data as RuntimeRpcResponse<TResult>
     if (response.id === this.options.requestId) {
-      this.options.callbacks.onResponse(response)
+      this.deliver(() => this.options.callbacks.onResponse(response))
       return
     }
     if (this.options.resolvePendingRequest?.(response as RuntimeRpcResponse<unknown>)) {
@@ -150,6 +150,24 @@ export class RemoteRuntimeSubscriptionFrameRouter<TResult> {
       )
       return
     }
-    this.options.callbacks.onBinary?.(plaintext)
+    this.deliver(() => this.options.callbacks.onBinary?.(plaintext))
+  }
+
+  // Why: `handleFrame` runs straight off the ws 'message' emitter, so a consumer throw becomes an
+  // uncaught exception that kills the process. The request router already routes one to
+  // `finishError`; mirror that here rather than leaving the subscription path unguarded.
+  private deliver(emit: () => void): void {
+    try {
+      emit()
+    } catch (error) {
+      this.options.fail(
+        error instanceof RemoteRuntimeClientError
+          ? error
+          : new RemoteRuntimeClientError(
+              'runtime_error',
+              error instanceof Error ? error.message : String(error)
+            )
+      )
+    }
   }
 }
diff --git a/src/shared/remote-runtime-subscription-request.test.ts b/src/shared/remote-runtime-subscription-request.test.ts
index 14f904308ccb..800c0a781840 100644
--- a/src/shared/remote-runtime-subscription-request.test.ts
+++ b/src/shared/remote-runtime-subscription-request.test.ts
@@ -214,6 +214,26 @@ describe('remote runtime subscription JSON requests', () => {
       )
     }
   )
+
+  // Why: `ws.on('message')` calls the frame router directly, so before this was guarded a consumer
+  // throw here left the emitter and became main_uncaught_exception, killing the whole app.
+  it('fails the subscription instead of crashing the process when a consumer throws', async () => {
+    const server = await createServer()
+    const onError = vi.fn<(error: unknown) => void>()
+    const onClose = vi.fn<() => void>()
+    await subscribe(server.pairing, {
+      onResponse: () => {
+        throw new Error('Unknown environment: env-1')
+      },
+      onError,
+      onClose
+    })
+
+    await vi.waitFor(() => expect(onClose).toHaveBeenCalledOnce())
+    expect(onError).toHaveBeenCalledWith(
+      expect.objectContaining({ code: 'runtime_error', message: 'Unknown environment: env-1' })
+    )
+  })
 })
 
 function requireSender(subscription: RemoteRuntimeSubscription) {
diff --git a/src/shared/ripgrep-process-availability.ts b/src/shared/ripgrep-process-availability.ts
index 4c39916aed8b..6fa761cc02e9 100644
--- a/src/shared/ripgrep-process-availability.ts
+++ b/src/shared/ripgrep-process-availability.ts
@@ -1,6 +1,7 @@
 import { constants } from 'node:fs'
 import { access, stat } from 'node:fs/promises'
-import { spawn, type ChildProcess } from 'node:child_process'
+import { spawnProcess, type ChildProcessHandle } from './child-process/run-process'
+import { abortSignalReason, throwIfSignalAborted } from './abort-signal-reason'
 
 const RIPGREP_CWD_CHECK_TIMEOUT_MS = 1000
 const RIPGREP_FAILURE_PROBE_TIMEOUT_MS = 5000
@@ -36,7 +37,7 @@ export function isTransientRipgrepSpawnError(error: unknown): boolean {
 
 function ignoreRipgrepSpawnError(): void {}
 
-export function killSpawnedRipgrepProcess(child: ChildProcess): boolean {
+export function killSpawnedRipgrepProcess(child: ChildProcessHandle): boolean {
   // Why: killing a failed-spawn handle can signal the relay's own process group.
   if (Object.hasOwn(child, 'pid') && child.pid === undefined) {
     return false
@@ -45,7 +46,7 @@ export function killSpawnedRipgrepProcess(child: ChildProcess): boolean {
 }
 
 export function absorbPendingRipgrepSpawnError(
-  child: ChildProcess,
+  child: ChildProcessHandle,
   state: { errorObserved: boolean; unavailableExitObserved: boolean }
 ): void {
   if (
@@ -77,12 +78,19 @@ export async function isRipgrepSpawnCwdUsable(cwd: string): Promise<boolean> {
   }
 }
 
-function probeRipgrepVersion(command: string, env: NodeJS.ProcessEnv): Promise<boolean> {
-  return new Promise((resolve) => {
-    let child: ChildProcess
+function probeRipgrepVersion(
+  command: string,
+  env: NodeJS.ProcessEnv,
+  signal?: AbortSignal
+): Promise<boolean> {
+  if (signal?.aborted) {
+    return Promise.reject(abortSignalReason(signal))
+  }
+  return new Promise((resolve, reject) => {
+    let child: ChildProcessHandle
     try {
       // windowsHide: a probe must never flash a console window on Windows.
-      child = spawn(command, ['--version'], { env, stdio: 'ignore', windowsHide: true })
+      child = spawnProcess({ program: command, args: ['--version'], env, stdio: 'ignore' })
     } catch {
       resolve(false)
       return
@@ -91,26 +99,45 @@ function probeRipgrepVersion(command: string, env: NodeJS.ProcessEnv): Promise<b
     // Why kill on timeout: a `rg --version` that hangs -- a stalled network mount, or antivirus
     // holding a just-installed rg.exe -- would otherwise leave a live process and a ref'd handle
     // behind for the relay's lifetime, once per launch failure.
-    const settle = (available: boolean, kill = false): void => {
+    const settle = (available: boolean, kill = false, error?: Error): void => {
       if (settled) {
         return
       }
       settled = true
       clearTimeout(timeout)
+      signal?.removeEventListener('abort', onAbort)
       child.off('close', onClose)
+      child.off('error', onError)
+      // A queued spawn error or synchronous kill failure can arrive after cleanup.
+      child.once('error', ignoreRipgrepSpawnError)
       if (kill) {
-        killSpawnedRipgrepProcess(child)
+        try {
+          killSpawnedRipgrepProcess(child)
+        } catch {
+          // A refused kill must not strand the probe's settlement.
+        }
+      }
+      if (error) {
+        reject(error)
+      } else {
+        resolve(available)
       }
-      // Why leave one 'error' listener attached: a spawn error can still arrive after this
-      // settles, and an unhandled 'error' on a ChildProcess throws.
-      child.once('error', ignoreRipgrepSpawnError)
-      resolve(available)
     }
+    const onAbort = (): void => {
+      if (signal) {
+        settle(false, true, abortSignalReason(signal))
+      }
+    }
+    const onError = (): void => settle(false)
     const onClose = (code: number | null): void => settle(code === 0)
-    child.once('error', () => settle(false))
+    child.once('error', onError)
     child.once('close', onClose)
     const timeout = setTimeout(() => settle(false, true), RIPGREP_FAILURE_PROBE_TIMEOUT_MS)
     timeout.unref?.()
+    signal?.addEventListener('abort', onAbort, { once: true })
+    if (signal?.aborted) {
+      onAbort()
+    }
   })
 }
 
@@ -129,13 +156,18 @@ function probeRipgrepVersion(command: string, env: NodeJS.ProcessEnv): Promise<b
 export async function classifyRipgrepLaunchFailure(
   cwd: string,
   candidates: readonly (string | null)[],
-  env: NodeJS.ProcessEnv
+  env: NodeJS.ProcessEnv,
+  signal?: AbortSignal
 ): Promise<'cwd-unreachable' | 'ripgrep-unavailable'> {
-  if (await isRipgrepSpawnCwdUsable(cwd)) {
+  throwIfSignalAborted(signal)
+  const usable = await isRipgrepSpawnCwdUsable(cwd)
+  throwIfSignalAborted(signal)
+  if (usable) {
     return 'ripgrep-unavailable'
   }
   for (const command of new Set(candidates.filter((entry) => entry !== null))) {
-    if (await probeRipgrepVersion(command, env)) {
+    throwIfSignalAborted(signal)
+    if (await probeRipgrepVersion(command, env, signal)) {
       return 'cwd-unreachable'
     }
   }
@@ -179,7 +211,7 @@ export async function classifySynchronousRipgrepSpawnFailure(
 }
 
 export function isRipgrepUnavailableExit(
-  child: ChildProcess,
+  child: ChildProcessHandle,
   code: number | null,
   signal: NodeJS.Signals | null,
   options: { classifyNativeLauncherExit?: boolean } = {}
diff --git a/src/shared/rpc-contract/client-ui-params.ts b/src/shared/rpc-contract/client-ui-params.ts
index df84a06a256b..3a7f0388b38f 100644
--- a/src/shared/rpc-contract/client-ui-params.ts
+++ b/src/shared/rpc-contract/client-ui-params.ts
@@ -69,6 +69,8 @@ export const StatusBarItem = z.enum([
   'kimi',
   'minimax',
   'grok',
+  'cursor',
+  'zcode',
   'ssh',
   'resource-usage',
   'ports'
@@ -182,6 +184,8 @@ export const UiUpdateFields = z
     _minimaxStatusBarDefaultAdded: z.boolean().optional(),
     _antigravityStatusBarDefaultAdded: z.boolean().optional(),
     _grokStatusBarDefaultAdded: z.boolean().optional(),
+    _cursorStatusBarDefaultAdded: z.boolean().optional(),
+    _zcodeStatusBarDefaultAdded: z.boolean().optional(),
     statusBarVisible: z.boolean().optional(),
     usagePercentageDisplay: z.enum(['used', 'remaining']).optional(),
     statusBarUsageMode: z.enum(['verbose', 'compact']).optional(),
diff --git a/src/shared/rpc-contract/rpc-params-catalog.generated.ts b/src/shared/rpc-contract/rpc-params-catalog.generated.ts
index 57d90d2218a2..df05a234a883 100644
--- a/src/shared/rpc-contract/rpc-params-catalog.generated.ts
+++ b/src/shared/rpc-contract/rpc-params-catalog.generated.ts
@@ -474,6 +474,7 @@ import {
   ModelCatalogParams,
   OptionsParams,
   RespondParams,
+  RespondToQuestionParams,
   RestartResumableParams,
   RestartResumeParams,
   RewindParams,
@@ -579,7 +580,7 @@ export const RPC_PARAMS_BY_METHOD = {
   'agentSession.options': OptionsParams,
   'agentSession.release': HoldParams,
   'agentSession.respondToApproval': RespondParams,
-  'agentSession.respondToQuestion': RespondParams,
+  'agentSession.respondToQuestion': RespondToQuestionParams,
   'agentSession.restartContinue': RestartResumeParams,
   'agentSession.restartResumable': RestartResumableParams,
   'agentSession.restartResumableDismiss': RestartResumableParams,
diff --git a/src/shared/rpc-contract/session-tabs-schemas-params.ts b/src/shared/rpc-contract/session-tabs-schemas-params.ts
index d04f54434779..7947e2368913 100644
--- a/src/shared/rpc-contract/session-tabs-schemas-params.ts
+++ b/src/shared/rpc-contract/session-tabs-schemas-params.ts
@@ -117,6 +117,7 @@ export const UpdatePaneLayout = WorktreeTabSelector.extend({
     .pipe(z.string().min(1, 'Missing tab id')),
   root: z.union([z.null(), TerminalPaneLayoutNodeSchema]),
   expandedLeafId: z.string().max(128).nullable().optional(),
+  chatLeafId: z.string().max(128).nullable().optional(),
   titlesByLeafId: z.record(z.string(), z.string()).optional()
 })
 
diff --git a/src/shared/rpc-contract/structured-agent-session-params.ts b/src/shared/rpc-contract/structured-agent-session-params.ts
index 7f41bd2c4b8a..9d240ac578c5 100644
--- a/src/shared/rpc-contract/structured-agent-session-params.ts
+++ b/src/shared/rpc-contract/structured-agent-session-params.ts
@@ -2,6 +2,10 @@ import { z } from 'zod'
 import { isAgentSessionSurfaceTabId } from '../agent-session-surface-tab-id'
 import { isAgentSessionId } from '../agent-session-record'
 import { normalizeExecutionHostId } from '../execution-host'
+import {
+  AGENT_SESSION_QUESTION_ANSWER_MAX_BYTES,
+  AGENT_SESSION_RESPONSE_OPTION_ID_MAX_LENGTH
+} from '../agent-session-question-answer'
 import {
   AGENT_SESSION_ID_MAX_LENGTH,
   AGENT_SESSION_HISTORY_DIRECTIONS,
@@ -12,10 +16,14 @@ import {
 export const MAX_ID_LENGTH = AGENT_SESSION_ID_MAX_LENGTH
 
 // Four Claude questions with all four generated choices occupy 610 chars when fully percent-encoded.
-export const MAX_RESPONSE_OPTION_ID_LENGTH = 1024
+export const MAX_RESPONSE_OPTION_ID_LENGTH = AGENT_SESSION_RESPONSE_OPTION_ID_MAX_LENGTH
 
 export const MAX_PROMPT_BYTES = 256 * 1024
 
+/** Matches the journal's bounds on one grouped prompt. */
+const MAX_QUESTION_ANSWER_QUESTIONS = 4
+const MAX_QUESTION_ANSWER_OPTIONS = 64
+
 export const MAX_BLOCKS = 64
 
 export const MAX_OPTION_LABEL = 512
@@ -208,6 +216,50 @@ export const RespondParams = z
   })
   .strict()
 
+const QuestionAnswer = z
+  .object({
+    // Codex question ids are model-written and untrimmed; the host matches them exactly.
+    questionId: z
+      .string()
+      .min(1, 'Invalid question id')
+      .max(MAX_RESPONSE_OPTION_ID_LENGTH, 'Invalid question id'),
+    optionIds: z
+      .array(Identifier('Invalid option id', MAX_RESPONSE_OPTION_ID_LENGTH))
+      .max(MAX_QUESTION_ANSWER_OPTIONS),
+    // Hashed verbatim by both peers, so no trim or transform here.
+    other: z
+      .string()
+      .max(AGENT_SESSION_QUESTION_ANSWER_MAX_BYTES)
+      .refine(
+        (value) => Buffer.byteLength(value, 'utf8') <= AGENT_SESSION_QUESTION_ANSWER_MAX_BYTES,
+        'Answer is too large'
+      )
+      .optional()
+  })
+  .strict()
+
+export const RespondToQuestionParams = z
+  .object({
+    envelope: MutationEnvelope,
+    itemId: Identifier('Invalid item id'),
+    expectedRevision: z.number().int().positive(),
+    /** An answer packed into one id, from clients that predate `answers`. */
+    optionId: Identifier('Invalid option id', MAX_RESPONSE_OPTION_ID_LENGTH).optional(),
+    answers: z.array(QuestionAnswer).min(1).max(MAX_QUESTION_ANSWER_QUESTIONS).optional()
+  })
+  .strict()
+  .superRefine((value, ctx) => {
+    if ((value.optionId === undefined) === (value.answers === undefined)) {
+      ctx.addIssue({ code: 'custom', message: 'Send exactly one of an option id or answers' })
+    }
+    if (
+      value.answers !== undefined &&
+      Buffer.byteLength(JSON.stringify(value.answers), 'utf8') > MAX_PROMPT_BYTES
+    ) {
+      ctx.addIssue({ code: 'custom', message: 'Answer is too large' })
+    }
+  })
+
 export const SetOptionParams = z
   .object({
     envelope: MutationEnvelope,
diff --git a/src/shared/rpc-contract/terminal-viewport-schemas-params.ts b/src/shared/rpc-contract/terminal-viewport-schemas-params.ts
index aac38a1858ee..416ce7859e08 100644
--- a/src/shared/rpc-contract/terminal-viewport-schemas-params.ts
+++ b/src/shared/rpc-contract/terminal-viewport-schemas-params.ts
@@ -29,7 +29,9 @@ export const TerminalUnsubscribe = z.object({
     .object({
       id: requiredString('Missing client ID')
     })
-    .optional()
+    .optional(),
+  // Why: the `terminal.subscribe` frame id; addresses that exact request, so a stale unsubscribe can't end a newer stream on the same slot.
+  requestId: z.string().min(1).optional()
 })
 
 // Why: in-place update avoids an unsubscribe→resubscribe that flashed the lock banner and stranded the PTY at phone dims (docs/mobile-presence-lock.md).
diff --git a/src/shared/runtime-terminal-contracts.ts b/src/shared/runtime-terminal-contracts.ts
index 235ef1e6b798..63adc2d67f82 100644
--- a/src/shared/runtime-terminal-contracts.ts
+++ b/src/shared/runtime-terminal-contracts.ts
@@ -322,6 +322,9 @@ export type RuntimeTerminalClose = {
   ptyKilled: boolean
   ptyStopVerdict?: 'live' | 'unverifiable'
   ptyStopReason?: string
+  /** The host durably recorded a kill order it replays when the PTY's SSH host reconnects.
+   *  Older hosts never send it, so a client promises no retry without it. */
+  pendingKillRecorded?: true
 }
 
 export type RuntimeTerminalWaitCondition = 'exit' | 'tui-idle'
diff --git a/src/shared/runtime-worktree-contracts.ts b/src/shared/runtime-worktree-contracts.ts
index c56bc3a17e6f..3d95fb0a3dc9 100644
--- a/src/shared/runtime-worktree-contracts.ts
+++ b/src/shared/runtime-worktree-contracts.ts
@@ -1,4 +1,5 @@
 import type { AgentStatusState, AgentType, AgentWorkingMode } from './agent-status-types'
+import type { AgentMainAgentStatus } from './main-agent-status'
 import type { BaseRefSearchResult, Repo } from './repo-types'
 import type { CreateWorktreeResult, RemoveWorktreeResult } from './worktree/create-types'
 import type {
@@ -22,6 +23,10 @@ export type RuntimeWorktreeAgentRow = {
   toolName: string | null
   toolInput: string | null
   interrupted: boolean
+  /** The main agent's own state, verdict and clock, sent whenever the host row has one, including
+   *  while subagents hold the row `working`. Optional on the wire: old hosts never send it, and a
+   *  reader without it falls back to `interrupted`. */
+  mainAgent?: AgentMainAgentStatus
   stateStartedAt: number
   updatedAt: number
   restoredUnconfirmed?: boolean
diff --git a/src/shared/setup-agent-sequencing.test.ts b/src/shared/setup-agent-sequencing.test.ts
index 1b8d69f0aa5e..908ea149cefe 100644
--- a/src/shared/setup-agent-sequencing.test.ts
+++ b/src/shared/setup-agent-sequencing.test.ts
@@ -122,6 +122,20 @@ describe('createSequencedSetupAgentCommands', () => {
     )
   })
 
+  it('doubles typographic single quotes in native Windows gate literals', () => {
+    const commands = createSequencedSetupAgentCommands({
+      runnerScriptPath: 'C:\\O\u2019Brien\\.git\\orca\\setup-runner.cmd',
+      platform: 'windows',
+      startupCommand: 'codex',
+      nonce: 'nonce-3'
+    })
+    const decoded = Buffer.from(
+      commands.setupCommand.split('-EncodedCommand ')[1] ?? '',
+      'base64'
+    ).toString('utf16le')
+    expect(decoded).toContain("$runner = 'C:\\O\u2019\u2019Brien\\.git\\orca\\setup-runner.cmd'")
+  })
+
   it('leaves the failure and timeout messages as the only other outcomes', () => {
     const script =
       createSequencedSetupAgentCommands({
diff --git a/src/shared/setup-agent-sequencing.ts b/src/shared/setup-agent-sequencing.ts
index 367be99c2123..a865b23f8373 100644
--- a/src/shared/setup-agent-sequencing.ts
+++ b/src/shared/setup-agent-sequencing.ts
@@ -6,6 +6,8 @@ import {
   type SetupRunnerCommandShell,
   type SetupRunnerShell
 } from './setup-runner-command'
+import { createNonSecureContextUuid } from './non-secure-context-uuid'
+import { quotePowerShellLiteral } from './powershell-native-argument'
 
 const DEFAULT_WAIT_TIMEOUT_SECONDS = 2 * 60 * 60
 // Exported so the gate and its tests share one definition.
@@ -28,11 +30,7 @@ export function resolveSetupAgentSequenceLaunchCommand(
 }
 
 export function createSetupAgentSequenceNonce(): string {
-  const cryptoApi = globalThis.crypto
-  if (typeof cryptoApi?.randomUUID === 'function') {
-    return cryptoApi.randomUUID()
-  }
-  return `${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}`
+  return createNonSecureContextUuid()
 }
 
 export function createSequencedSetupAgentCommands(args: {
@@ -196,10 +194,10 @@ function buildWindowsSetupCommand(
 ): string {
   // Why: delayed expansion keeps path metacharacters as data when cmd invokes the batch runner.
   const script = [
-    `$runner = ${quotePowerShellString(runnerScriptPath)}`,
-    `$marker = ${quotePowerShellString(markerPath)}`,
+    `$runner = ${quotePowerShellLiteral(runnerScriptPath)}`,
+    `$marker = ${quotePowerShellLiteral(markerPath)}`,
     '$tmp = $marker + ".tmp"',
-    `$nonce = ${quotePowerShellString(nonce)}`,
+    `$nonce = ${quotePowerShellLiteral(nonce)}`,
     'Remove-Item -LiteralPath $marker, $tmp -Force -ErrorAction SilentlyContinue',
     '$processInfo = [System.Diagnostics.ProcessStartInfo]::new()',
     '$processInfo.FileName = $env:ComSpec',
@@ -248,13 +246,13 @@ function buildWindowsStartupCommand(
       '"session (" + $_.FullyQualifiedErrorId + "). A startup command that runs a .ps1 " + ' +
       '"may be blocked.") }',
     '$ProgressPreference = $orcaProgress',
-    `$marker = ${quotePowerShellString(markerPath)}`,
+    `$marker = ${quotePowerShellLiteral(markerPath)}`,
     'if ([string]::IsNullOrWhiteSpace($marker)) {',
     '  [Console]::Error.WriteLine("Missing setup marker path.")',
     '  exit 1',
     '}',
     '$tmp = $marker + ".tmp"',
-    `$nonce = ${quotePowerShellString(nonce)}`,
+    `$nonce = ${quotePowerShellLiteral(nonce)}`,
     `$deadline = (Get-Date).AddSeconds(${timeout})`,
     '[Console]::Error.WriteLine("Waiting for setup to finish before starting agent...")',
     'while ($true) {',
@@ -272,7 +270,7 @@ function buildWindowsStartupCommand(
     '        [Console]::Error.WriteLine("Missing sequenced startup command.")',
     '        exit 1',
     '      }',
-    `      [Console]::Error.WriteLine(${quotePowerShellString(SETUP_COMPLETE_MESSAGE)})`,
+    `      [Console]::Error.WriteLine(${quotePowerShellLiteral(SETUP_COMPLETE_MESSAGE)})`,
     '      Invoke-Expression $startup',
     '      if ($global:LASTEXITCODE -ne $null) { exit $global:LASTEXITCODE }',
     '      if (-not $?) { exit 1 }',
@@ -304,10 +302,6 @@ function quotePosixArg(value: string): string {
   return `'${value.replace(/'/g, `'\\''`)}'`
 }
 
-function quotePowerShellString(value: string): string {
-  return `'${value.replace(/'/g, "''")}'`
-}
-
 export function getSetupAgentSequenceShellForTests(
   runnerScriptPath: string,
   platform: SetupRunnerCommandPlatform
diff --git a/src/shared/setup-agent-sequencing.windows.test.ts b/src/shared/setup-agent-sequencing.windows.test.ts
index 10b1e76d9084..b27ee5ccc410 100644
--- a/src/shared/setup-agent-sequencing.windows.test.ts
+++ b/src/shared/setup-agent-sequencing.windows.test.ts
@@ -9,6 +9,7 @@ import {
   createSequencedSetupAgentCommands,
   SETUP_AGENT_SEQUENCE_STARTUP_COMMAND_ENV
 } from './setup-agent-sequencing'
+import { quotePowerShellLiteral } from './powershell-native-argument'
 
 const TEMP_DIRS: string[] = []
 const WINDOWS_PROCESS_TEST_TIMEOUT_MS = 30_000
@@ -49,14 +50,14 @@ describe.skipIf(process.platform !== 'win32')('Windows setup-agent sequencing',
         [
           'param([string]$Value)',
           '$utf8 = [System.Text.UTF8Encoding]::new($false)',
-          `[System.IO.File]::AppendAllText('${quotePowerShell(logPath)}', $Value + [Environment]::NewLine, $utf8)`
+          `[System.IO.File]::AppendAllText(${quotePowerShellLiteral(logPath)}, $Value + [Environment]::NewLine, $utf8)`
         ].join('\r\n'),
         'utf8'
       )
 
       const commands = createSequencedSetupAgentCommands({
         runnerScriptPath,
-        startupCommand: `& '${quotePowerShell(startupScriptPath)}' '${quotePowerShell(prompt)}'`,
+        startupCommand: `& ${quotePowerShellLiteral(startupScriptPath)} ${quotePowerShellLiteral(prompt)}`,
         platform: 'windows',
         nonce: 'windows-sequence',
         waitTimeoutSeconds: 2
@@ -167,10 +168,6 @@ function spawnWindowsCommand(
   })
 }
 
-function quotePowerShell(value: string): string {
-  return value.replace(/'/g, "''")
-}
-
 function waitForExit(
   child: ReturnType<typeof spawn>
 ): Promise<{ code: number | null; stderr: string }> {
diff --git a/src/shared/skills-cli-agent-keys.ts b/src/shared/skills-cli-agent-keys.ts
index a85fa9d80abe..f8d1a913172f 100644
--- a/src/shared/skills-cli-agent-keys.ts
+++ b/src/shared/skills-cli-agent-keys.ts
@@ -24,6 +24,7 @@ export const SKILLS_CLI_AGENT_KEY_BY_TUI_AGENT = {
   pi: 'pi',
   omp: null,
   'prime-agent': null,
+  qoder: 'qoder',
   gemini: 'gemini-cli',
   antigravity: 'antigravity',
   aider: null,
@@ -35,6 +36,7 @@ export const SKILLS_CLI_AGENT_KEY_BY_TUI_AGENT = {
   aug: 'augment',
   cline: 'cline',
   codebuff: null,
+  freebuff: null,
   'command-code': 'command-code',
   continue: 'continue',
   cursor: 'cursor',
@@ -52,7 +54,9 @@ export const SKILLS_CLI_AGENT_KEY_BY_TUI_AGENT = {
   // Why: Orca detects trae by `traecli`, an alias only TRAE CN ships.
   trae: 'trae-cn',
   muse: null,
-  zcode: 'zcode'
+  zcode: 'zcode',
+  // Why: DSH ships skills as Cordis plugins, not a `skills --agent` target.
+  dsh: null
 } satisfies Record<TuiAgent, string | null>
 
 /**
diff --git a/src/shared/source-control-ai-action-recipes.test.ts b/src/shared/source-control-ai-action-recipes.test.ts
index 352f9cfa337e..15e09ebe9127 100644
--- a/src/shared/source-control-ai-action-recipes.test.ts
+++ b/src/shared/source-control-ai-action-recipes.test.ts
@@ -427,7 +427,7 @@ describe('source-control AI action recipes', () => {
     ).toEqual({
       ok: false,
       error:
-        'Agent "aider" does not support Source Control AI commit messages. Supported agents: OMP, Claude, Codex, OpenCode, OpenCode 2, Pi, Amp, Cursor, Kimi, Muse, GitHub Copilot, Antigravity, or Custom command.'
+        'Agent "aider" does not support Source Control AI commit messages. Supported agents: OMP, Claude, Codex, OpenCode, OpenCode 2, Pi, Amp, Cursor, Kimi, Muse, DeepSeek Harness, GitHub Copilot, Antigravity, or Custom command.'
     })
   })
 })
diff --git a/src/shared/source-scan/call-argument-scan.ts b/src/shared/source-scan/call-argument-scan.ts
new file mode 100644
index 000000000000..59a411aa2f01
--- /dev/null
+++ b/src/shared/source-scan/call-argument-scan.ts
@@ -0,0 +1,83 @@
+import { stripComments } from './source-tree-scan'
+
+const CLOSER_BY_OPENER: Record<string, string> = { '(': ')', '[': ']', '{': '}' }
+
+/** Top-level argument texts of the call whose `(` ends at `start`; quote-aware, not a parser. */
+export function splitCallArguments(source: string, start: number): string[] {
+  const args: string[] = []
+  const closers: string[] = [')']
+  let current = ''
+  let quote: string | null = null
+  for (let index = start; index < source.length; index += 1) {
+    const char = source[index]!
+    if (quote) {
+      current += char
+      if (char === '\\') {
+        current += source[index + 1] ?? ''
+        index += 1
+      } else if (char === quote) {
+        quote = null
+      }
+      continue
+    }
+    const closer = CLOSER_BY_OPENER[char]
+    if (char === "'" || char === '"' || char === '`') {
+      quote = char
+    } else if (closer) {
+      closers.push(closer)
+    } else if (char === closers.at(-1)) {
+      closers.pop()
+      if (closers.length === 0) {
+        break
+      }
+    } else if (char === ',' && closers.length === 1) {
+      args.push(current.trim())
+      current = ''
+      continue
+    }
+    current += char
+  }
+  if (current.trim()) {
+    args.push(current.trim())
+  }
+  return args
+}
+
+export type RequiredCallArgument = {
+  /** Which positional argument must be present. */
+  index: number
+  /** The call counts only when the text before `.method(` matches, e.g. its receiver. */
+  receiver?: RegExp
+  /** When the argument is an object literal, whether it carries the required field. */
+  acceptsObjectLiteral?: (literal: string) => boolean
+}
+
+/**
+ * `line: .method(args)` for each call that leaves out a required argument. For code the compiler
+ * cannot check, such as `@ts-nocheck` files and `any`-typed receivers.
+ */
+export function findCallsMissingArgument(
+  source: string,
+  requiredByMethod: Record<string, RequiredCallArgument>
+): string[] {
+  const code = stripComments(source)
+  const callRe = new RegExp(`\\.\\s*(${Object.keys(requiredByMethod).join('|')})\\s*\\(`, 'g')
+  const missing: string[] = []
+  for (const match of code.matchAll(callRe)) {
+    const method = match[1]!
+    const required = requiredByMethod[method]!
+    const before = code.slice(0, match.index)
+    if (required.receiver && !required.receiver.test(before)) {
+      continue
+    }
+    const args = splitCallArguments(code, match.index + match[0].length)
+    const argument = args[required.index]
+    const present =
+      argument !== undefined &&
+      (!argument.startsWith('{') || (required.acceptsObjectLiteral?.(argument) ?? true))
+    if (!present) {
+      missing.push(`${before.split('\n').length}: .${method}(${args.join(', ')})`)
+    }
+  }
+  return missing
+}
diff --git a/src/shared/status-bar-defaults.ts b/src/shared/status-bar-defaults.ts
index 73d72a70ab2a..c32958ee9491 100644
--- a/src/shared/status-bar-defaults.ts
+++ b/src/shared/status-bar-defaults.ts
@@ -9,6 +9,8 @@ export const DEFAULT_STATUS_BAR_ITEMS: StatusBarItem[] = [
   'kimi',
   'minimax',
   'grok',
+  'cursor',
+  'zcode',
   'ssh',
   'resource-usage',
   'ports'
diff --git a/src/shared/structured-agent-session-dispatch-rejection.test.ts b/src/shared/structured-agent-session-dispatch-rejection.test.ts
new file mode 100644
index 000000000000..be16c8a3fbda
--- /dev/null
+++ b/src/shared/structured-agent-session-dispatch-rejection.test.ts
@@ -0,0 +1,140 @@
+import { describe, expect, it } from 'vitest'
+import {
+  AGENT_SESSION_FAILURE_KINDS,
+  agentSessionFailureFact,
+  isSubmissionRejectionKind
+} from './agent-session-failure'
+import { agentSessionFailureWords } from './agent-session-failure-words'
+import {
+  classifyDispatchRejection,
+  DISPATCH_REJECTED_CANCELLED,
+  DISPATCH_REJECTED_CODEX_QUEUE_FULL,
+  DISPATCH_REJECTED_HOST_RESTARTED,
+  DISPATCH_REJECTED_PROVIDER_CLOSED,
+  DISPATCH_REJECTED_QUEUE_FULL,
+  isWriteFailureSubmission
+} from './structured-agent-session-dispatch-rejection'
+
+describe('classifyDispatchRejection', () => {
+  it.each([
+    [DISPATCH_REJECTED_CANCELLED, 'withdrawn', null, 'cancelled'],
+    [DISPATCH_REJECTED_HOST_RESTARTED, 'undelivered', null, 'hostRestarted'],
+    [DISPATCH_REJECTED_PROVIDER_CLOSED, 'undelivered', null, 'chatClosed'],
+    ['not_delivered', 'undelivered', null, 'notDelivered'],
+    [DISPATCH_REJECTED_QUEUE_FULL, 'transport', 'failure', 'queueFull'],
+    [DISPATCH_REJECTED_CODEX_QUEUE_FULL, 'transport', 'failure', 'queueFull'],
+    ['provider_write_failed: broken pipe', 'transport', 'failure', 'writeFailed'],
+    ['provider_write_failed', 'transport', 'failure', 'writeFailed']
+  ] as const)('reads the legacy marker %j', (reason, category, verdict, kind) => {
+    expect(classifyDispatchRejection({ reason })).toEqual({ category, verdict, kind })
+  })
+
+  it('reads any other legacy reason as a sentence that failed the send', () => {
+    expect(classifyDispatchRejection({ reason: 'Claude does not support .bmp' })).toEqual({
+      category: 'content',
+      verdict: 'failure'
+    })
+    expect(classifyDispatchRejection({ reason: null })).toEqual({
+      category: 'content',
+      verdict: 'failure'
+    })
+  })
+
+  it('fails the send for every kind but a withdrawal, a restart, a close, or a lost send', () => {
+    const noOneFailed = ['cancelled', 'hostRestarted', 'chatClosed', 'notDelivered']
+    for (const kind of AGENT_SESSION_FAILURE_KINDS.filter(isSubmissionRejectionKind)) {
+      const verdict = classifyDispatchRejection({ reason: 'x', rejection: { kind } }).verdict
+      expect([kind, verdict]).toEqual([kind, noOneFailed.includes(kind) ? null : 'failure'])
+    }
+  })
+
+  it.each([
+    ['cancelled', 'withdrawn', null],
+    ['hostRestarted', 'undelivered', null],
+    ['chatClosed', 'undelivered', null],
+    ['notDelivered', 'undelivered', null],
+    // Orca stopped a start that hung: the agent failed, and the message never reached it.
+    ['hostStopped', 'undelivered', 'failure'],
+    ['writeFailed', 'transport', 'failure'],
+    ['queueFull', 'transport', 'failure']
+  ] as const)('reads the written %s rejection as %s, verdict %s', (kind, category, verdict) => {
+    const written = agentSessionFailureWords(agentSessionFailureFact(kind), {
+      surface: 'rejection',
+      provider: 'claude'
+    })
+    expect(classifyDispatchRejection(written)).toEqual({ category, verdict, kind })
+  })
+
+  it('reads a legacy not_delivered row with no fact as a send nobody failed', () => {
+    expect(classifyDispatchRejection({ reason: 'not_delivered' })).toEqual({
+      category: 'undelivered',
+      verdict: null,
+      kind: 'notDelivered'
+    })
+  })
+
+  it('reads the typed fact over the sentence beside it', () => {
+    expect(
+      classifyDispatchRejection({
+        reason: 'The provider stopped before it finished starting.',
+        rejection: { kind: 'providerStartFailed' }
+      })
+    ).toEqual({ category: 'startFailed', verdict: 'failure', kind: 'providerStartFailed' })
+    expect(
+      classifyDispatchRejection({ reason: 'Not sent.', rejection: { kind: 'queueFull' } })
+    ).toMatchObject({ category: 'transport', verdict: 'failure' })
+  })
+
+  it('writes a sentence, not a marker released clients would print, for a restart or a close', () => {
+    for (const kind of ['hostRestarted', 'chatClosed'] as const) {
+      const written = agentSessionFailureWords(agentSessionFailureFact(kind), {
+        surface: 'rejection'
+      })
+      expect(written.reason).not.toMatch(/^[a-z_]+$/)
+      expect(classifyDispatchRejection(written)).toEqual({
+        category: 'undelivered',
+        verdict: null,
+        kind
+      })
+    }
+  })
+
+  it('gives a fact it cannot place no verdict, whatever the reason beside it says', () => {
+    // A newer host's kind, a status-row kind, and a fact with no kind at all.
+    for (const rejection of [{ kind: 'futureKind' }, { kind: 'providerRetrying' }, {}]) {
+      for (const reason of [
+        DISPATCH_REJECTED_QUEUE_FULL,
+        DISPATCH_REJECTED_CANCELLED,
+        'Refused.'
+      ]) {
+        expect(classifyDispatchRejection({ reason, rejection })).toEqual({
+          category: 'undelivered',
+          verdict: null
+        })
+      }
+    }
+  })
+})
+
+describe('isWriteFailureSubmission', () => {
+  it('holds for a legacy row in any state that carries the marker', () => {
+    expect(
+      isWriteFailureSubmission({ reason: 'provider_write_failed: closed before enqueue' })
+    ).toBe(true)
+  })
+
+  it('holds for the bare marker a new host writes, as released clients already read it', () => {
+    const written = agentSessionFailureWords(agentSessionFailureFact('writeFailed'), {
+      surface: 'rejection'
+    })
+    expect(written.reason).toBe('provider_write_failed')
+    expect(isWriteFailureSubmission({ reason: written.reason })).toBe(true)
+  })
+
+  it('holds for a typed write failure and for nothing else', () => {
+    expect(isWriteFailureSubmission({ reason: 'x', rejection: { kind: 'writeFailed' } })).toBe(true)
+    expect(isWriteFailureSubmission({ reason: DISPATCH_REJECTED_QUEUE_FULL })).toBe(false)
+    expect(isWriteFailureSubmission({ reason: 'x', rejection: { kind: 'queueFull' } })).toBe(false)
+    expect(isWriteFailureSubmission({ reason: null })).toBe(false)
+  })
+})
diff --git a/src/shared/structured-agent-session-dispatch-rejection.ts b/src/shared/structured-agent-session-dispatch-rejection.ts
index 14e197325d8f..3b9ff4fb025e 100644
--- a/src/shared/structured-agent-session-dispatch-rejection.ts
+++ b/src/shared/structured-agent-session-dispatch-rejection.ts
@@ -1,23 +1,23 @@
 // Why a submission is `rejected`: the message provably did not happen.
 //
-// Two different facts reach this state, and the reason string is what tells them
-// apart. A CONTENT rejection is permanent — the provider looked at this payload
-// and refused it, and it would refuse the same payload again; its reason is the
-// provider's own explanation ("Claude messages support at most 20 images") and is
-// meant to be read. A TRANSPORT rejection is transient — the frame was never
-// handed to the provider at all, so the same text under a fresh id is a first
-// delivery and the next attempt may well succeed; its reason names an internal
-// cause and must NOT be put in front of a person.
+// The host writes each rejection twice: `reason`, a sentence (or, for the cases older clients
+// already recognise, one of the legacy markers below) that released clients print as it is, and
+// `rejection`, the typed fact newer clients read — both from `agentSessionFailureWords`.
+// `classifyDispatchRejection` is the only place a reader judges either.
 //
-// Both are `rejected` because both make the single claim that state exists to
-// make: this message did not reach the provider. Neither is ever re-delivered
-// under its own id — `rejected` is terminal in the reducer — so a retry rotates
-// the client message id, which is a new message and cannot duplicate.
-//
-// Shared rather than main-only because both sides need it: the host writes the
-// reason, and a client has to know which kind it is holding before it can decide
-// whether the string is showable.
+// Every rejection makes the one claim that state exists to make: this message did not reach the
+// provider. None is ever re-delivered under its own id — `rejected` is terminal in the reducer — so
+// a retry rotates the client message id, which is a new message and cannot duplicate.
+
+import {
+  isSubmissionRejectionKind,
+  readAgentSessionFailureFact,
+  type SubmissionRejectionKind
+} from './agent-session-failure'
+import type { AgentJournalSubmission } from './agent-session-journal-types'
 
+/** Orca could not hand the message over. Written bare: released clients hide it, and the error
+ *  that once followed it belongs in the log. Rows from older hosts carry `: <error>` after it. */
 export const DISPATCH_REJECTED_WRITE_FAILED = 'provider_write_failed'
 
 /** Local admission refused the frame before any transport was involved. Two
@@ -29,15 +29,21 @@ export const DISPATCH_REJECTED_CODEX_QUEUE_FULL = 'codex structured dispatch que
 /** The provider confirmed a queued frame was withdrawn before execution. */
 export const DISPATCH_REJECTED_CANCELLED = 'provider_cancelled_before_start'
 
-export function dispatchWriteFailureReason(error: unknown): string {
-  const detail = error instanceof Error ? error.message : String(error)
-  return `${DISPATCH_REJECTED_WRITE_FAILED}: ${detail}`
-}
+/** Legacy marker: accepted by a host process that ended before handing it to any provider.
+ *  Read only; released clients print it raw, so new rows carry a sentence. */
+export const DISPATCH_REJECTED_HOST_RESTARTED = 'host_restarted_before_delivery'
 
-/** True for the internal transport marker, false for a provider's own words. */
-export function dispatchRejectionWasTransportWriteFailure(
-  reason: string | null | undefined
-): boolean {
+/** Legacy marker: accepted, then the provider was closed before the message was handed to it.
+ *  Read only, like the one above. */
+export const DISPATCH_REJECTED_PROVIDER_CLOSED = 'provider_closed_before_delivery'
+
+/** Restart reconciliation found the send absent from a provider history it could trust. Rows
+ *  written before rows carried a fact hold it as their reason; released clients printed it. */
+export const DISPATCH_REJECTED_NOT_DELIVERED = 'not_delivered'
+
+/** True for the internal transport marker, false for a provider's own words. Legacy-reason half
+ *  of `isWriteFailureSubmission`; readers go through that or the classifier. */
+function dispatchRejectionWasTransportWriteFailure(reason: string | null | undefined): boolean {
   return (
     reason === DISPATCH_REJECTED_WRITE_FAILED ||
     reason?.startsWith(`${DISPATCH_REJECTED_WRITE_FAILED}: `) === true
@@ -45,15 +51,128 @@ export function dispatchRejectionWasTransportWriteFailure(
 }
 
 /**
- * True when the reason is ours rather than the provider's, so it must not be
- * shown verbatim. A content rejection carries the provider's own explanation and
- * is the only kind a person should read.
+ * What a rejection means for the chat, whatever wrote it:
+ * - `withdrawn`: the user's Stop took it back; nothing failed.
+ * - `undelivered`: accepted, then never handed over (Orca restarted, the chat closed, the provider
+ *   never took it or stopped first).
+ * - `startFailed`: the agent it waited on did not start.
+ * - `content`: the provider, or Orca's check of the message, refused this payload.
+ * - `transport`: Orca could not hand it over.
  */
-export function dispatchRejectionReasonIsInternal(reason: string | null | undefined): boolean {
+export type DispatchRejectionCategory =
+  | 'withdrawn'
+  | 'undelivered'
+  | 'startFailed'
+  | 'content'
+  | 'transport'
+
+export type DispatchRejectionClassification = {
+  category: DispatchRejectionCategory
+  /** `failure` when the chat reads Failed; null only when no one failed the user: a withdrawal, a
+   *  host restart, a chat close, or a send the provider never received after a restart. */
+  verdict: 'failure' | null
+  /** The situation, when the row carried one or a legacy marker names it; absent for a legacy
+   *  sentence, whose words are all a reader has, and for a fact this build cannot place. */
+  kind?: SubmissionRejectionKind
+}
+
+const KIND_CATEGORY = {
+  cancelled: 'withdrawn',
+  hostRestarted: 'undelivered',
+  chatClosed: 'undelivered',
+  notDelivered: 'undelivered',
+  providerExited: 'undelivered',
+  hostStopped: 'undelivered',
+  providerStartFailed: 'startFailed',
+  startFailed: 'startFailed',
+  notSignedIn: 'startFailed',
+  historyTooLarge: 'startFailed',
+  managedAccountEnvOverride: 'startFailed',
+  accountSwitchInProgress: 'startFailed',
+  managedAccountUnsupported: 'startFailed',
+  restartFailed: 'startFailed',
+  providerRejected: 'content',
+  attachmentInvalid: 'content',
+  attachmentUnreadable: 'content',
+  emptyMessage: 'content',
+  queueFull: 'transport',
+  writeFailed: 'transport',
+  hostFault: 'transport'
+} satisfies Record<SubmissionRejectionKind, DispatchRejectionCategory>
+
+/** Null only where no one failed the user; a new kind does not compile until it is placed here. */
+const KIND_VERDICT = {
+  cancelled: null,
+  hostRestarted: null,
+  chatClosed: null,
+  notDelivered: null,
+  providerExited: 'failure',
+  providerStartFailed: 'failure',
+  startFailed: 'failure',
+  notSignedIn: 'failure',
+  historyTooLarge: 'failure',
+  managedAccountEnvOverride: 'failure',
+  accountSwitchInProgress: 'failure',
+  managedAccountUnsupported: 'failure',
+  restartFailed: 'failure',
+  providerRejected: 'failure',
+  attachmentInvalid: 'failure',
+  attachmentUnreadable: 'failure',
+  emptyMessage: 'failure',
+  queueFull: 'failure',
+  writeFailed: 'failure',
+  hostFault: 'failure',
+  // Orca stopped a start that hung: the agent failed.
+  hostStopped: 'failure'
+} satisfies Record<SubmissionRejectionKind, 'failure' | null>
+
+/** The legacy markers, by the kind each stands for. */
+const LEGACY_MARKER_KINDS: ReadonlyMap<string, SubmissionRejectionKind> = new Map([
+  [DISPATCH_REJECTED_CANCELLED, 'cancelled'],
+  [DISPATCH_REJECTED_HOST_RESTARTED, 'hostRestarted'],
+  [DISPATCH_REJECTED_PROVIDER_CLOSED, 'chatClosed'],
+  [DISPATCH_REJECTED_QUEUE_FULL, 'queueFull'],
+  [DISPATCH_REJECTED_CODEX_QUEUE_FULL, 'queueFull'],
+  [DISPATCH_REJECTED_NOT_DELIVERED, 'notDelivered']
+])
+
+/** The kind a legacy marker stands for; undefined for any other reason, which is a sentence. */
+function legacyMarkerKind(reason: string | null): SubmissionRejectionKind | undefined {
+  if (dispatchRejectionWasTransportWriteFailure(reason)) {
+    return 'writeFailed'
+  }
+  return reason === null ? undefined : LEGACY_MARKER_KINDS.get(reason)
+}
+
+/**
+ * The one reader of why a submission was rejected. The typed fact decides when the row carries
+ * one; a fact this build cannot place says only that the message was not sent. A row with no
+ * fact, from an older host, is read by its legacy marker, and any other reason is a sentence — a
+ * provider's, or Orca's before rows were typed — which reads as a content failure.
+ */
+export function classifyDispatchRejection(
+  submission: Pick<AgentJournalSubmission, 'reason'> & { rejection?: unknown }
+): DispatchRejectionClassification {
+  const { rejection } = submission
+  const factKind = readAgentSessionFailureFact(rejection)?.kind
+  if (typeof rejection === 'object' && rejection !== null && !isSubmissionRejectionKind(factKind)) {
+    // Undelivered, not content: all a fact this build can't place proves is the message didn't happen.
+    return { category: 'undelivered', verdict: null }
+  }
+  const kind = isSubmissionRejectionKind(factKind) ? factKind : legacyMarkerKind(submission.reason)
+  if (!kind) {
+    return { category: 'content', verdict: 'failure' }
+  }
+  return { category: KIND_CATEGORY[kind], verdict: KIND_VERDICT[kind], kind }
+}
+
+/** A submission that says Orca never handed it over, in any dispatch state: journals written
+ *  before this state moved hold it as `unknown` carrying the marker. */
+export function isWriteFailureSubmission(
+  submission: Pick<AgentJournalSubmission, 'reason' | 'rejection'>
+): boolean {
   return (
-    dispatchRejectionWasTransportWriteFailure(reason) ||
-    reason === DISPATCH_REJECTED_QUEUE_FULL ||
-    reason === DISPATCH_REJECTED_CODEX_QUEUE_FULL ||
-    reason === DISPATCH_REJECTED_CANCELLED
+    readAgentSessionFailureFact(submission.rejection)?.kind === 'writeFailed' ||
+    dispatchRejectionWasTransportWriteFailure(submission.reason)
   )
 }
diff --git a/src/shared/structured-agent-session-latest-request.test.ts b/src/shared/structured-agent-session-latest-request.test.ts
new file mode 100644
index 000000000000..7cdb1b2d36af
--- /dev/null
+++ b/src/shared/structured-agent-session-latest-request.test.ts
@@ -0,0 +1,313 @@
+import { describe, expect, it } from 'vitest'
+import type {
+  AgentJournalRenderItem,
+  AgentJournalSubmission,
+  AgentJournalTurnLifecycle
+} from './agent-session-journal-types'
+import { AGENT_SESSION_FAILURE_KINDS, isSubmissionRejectionKind } from './agent-session-failure'
+import { agentJournalSubmissionKey } from './agent-session-journal-item-key'
+import {
+  classifyDispatchRejection,
+  DISPATCH_REJECTED_CANCELLED,
+  DISPATCH_REJECTED_CODEX_QUEUE_FULL,
+  DISPATCH_REJECTED_HOST_RESTARTED,
+  DISPATCH_REJECTED_NOT_DELIVERED,
+  DISPATCH_REJECTED_PROVIDER_CLOSED,
+  DISPATCH_REJECTED_QUEUE_FULL,
+  DISPATCH_REJECTED_WRITE_FAILED
+} from './structured-agent-session-dispatch-rejection'
+import {
+  hasStructuredAgentSessionRequest,
+  latestStructuredAgentSessionRequest
+} from './structured-agent-session-latest-request'
+import { projectStructuredAgentSessionStatusSummary } from './structured-agent-session-projection'
+
+const START_FAILURE = 'Claude is not signed in.'
+
+function userEntry(clientMessageId: string, sequence: number): AgentJournalRenderItem {
+  return {
+    itemId: agentJournalSubmissionKey(clientMessageId),
+    revision: 0,
+    sequence,
+    observedAt: sequence,
+    body: { kind: 'message', role: 'user', blocks: [{ type: 'text', text: clientMessageId }] }
+  }
+}
+
+function turn(
+  turnId: string,
+  sequence: number,
+  fields: Omit<AgentJournalTurnLifecycle, 'turnId'>
+): AgentJournalRenderItem {
+  return {
+    itemId: `codex:turn:${turnId}`,
+    revision: 1,
+    sequence,
+    observedAt: sequence,
+    body: { kind: 'turn', turnId, ...fields }
+  }
+}
+
+function sent(
+  clientMessageId: string,
+  fields: Partial<AgentJournalSubmission> & Pick<AgentJournalSubmission, 'dispatchState'>
+): AgentJournalSubmission {
+  return {
+    clientMessageId,
+    fence: 1,
+    payloadFingerprint: clientMessageId,
+    providerItemId: null,
+    reason: null,
+    submittedAt: 10,
+    resolvedAt: 20,
+    handoverRecorded: true,
+    ...fields
+  }
+}
+
+const rejected = (clientMessageId: string, reason: string, handedOverAt?: number) =>
+  sent(clientMessageId, {
+    dispatchState: 'rejected',
+    reason,
+    ...(handedOverAt !== undefined ? { handedOverAt } : {})
+  })
+
+type Row = {
+  name: string
+  items: AgentJournalRenderItem[]
+  submissions: AgentJournalSubmission[]
+  fence?: number
+  outcome: 'success' | 'failure' | 'cancellation' | null
+  listed: boolean
+}
+
+const ROWS: Row[] = [
+  {
+    name: 'a send the agent start refused',
+    items: [userEntry('m1', 1)],
+    submissions: [rejected('m1', START_FAILURE)],
+    outcome: 'failure',
+    listed: true
+  },
+  {
+    name: 'a send the user withdrew (no verdict)',
+    items: [userEntry('m1', 1)],
+    submissions: [rejected('m1', DISPATCH_REJECTED_CANCELLED)],
+    outcome: null,
+    listed: false
+  },
+  {
+    name: 'a send still queued when the host restarted (no verdict)',
+    items: [userEntry('m1', 1)],
+    submissions: [rejected('m1', DISPATCH_REJECTED_HOST_RESTARTED)],
+    outcome: null,
+    listed: false
+  },
+  {
+    name: 'a send still queued when the provider closed (no verdict)',
+    items: [userEntry('m1', 1)],
+    submissions: [rejected('m1', DISPATCH_REJECTED_PROVIDER_CLOSED)],
+    outcome: null,
+    listed: false
+  },
+  {
+    name: 'a send crash recovery found the provider never received (no verdict)',
+    items: [userEntry('m1', 1)],
+    submissions: [
+      sent('m1', {
+        dispatchState: 'rejected',
+        reason: DISPATCH_REJECTED_NOT_DELIVERED,
+        recovered: true
+      })
+    ],
+    outcome: null,
+    listed: false
+  },
+  {
+    name: 'a turn that succeeded, then a send crash recovery found the provider never received',
+    items: [
+      userEntry('m1', 1),
+      turn('t1', 2, { state: 'completed', outcome: 'success', completedAt: 15 }),
+      userEntry('m2', 3)
+    ],
+    submissions: [
+      sent('m1', { dispatchState: 'accepted' }),
+      sent('m2', {
+        dispatchState: 'rejected',
+        reason: DISPATCH_REJECTED_NOT_DELIVERED,
+        recovered: true
+      })
+    ],
+    outcome: 'success',
+    listed: true
+  },
+  {
+    name: 'a send crash recovery left unknown',
+    items: [userEntry('m1', 1)],
+    submissions: [sent('m1', { dispatchState: 'unknown', recovered: true })],
+    outcome: null,
+    listed: false
+  },
+  {
+    name: 'a send pending at an older fence',
+    items: [userEntry('m1', 1)],
+    submissions: [sent('m1', { dispatchState: 'pending', handedOverAt: 11, resolvedAt: null })],
+    fence: 2,
+    outcome: null,
+    listed: false
+  },
+  {
+    name: 'a turn that succeeded, then a send the start refused',
+    items: [
+      userEntry('m1', 1),
+      turn('t1', 2, { state: 'completed', outcome: 'success', completedAt: 15 }),
+      userEntry('m2', 3)
+    ],
+    submissions: [sent('m1', { dispatchState: 'accepted' }), rejected('m2', START_FAILURE)],
+    outcome: 'failure',
+    listed: true
+  },
+  {
+    name: 'a refused send, then a turn that succeeded',
+    items: [
+      userEntry('m1', 1),
+      userEntry('m2', 2),
+      turn('t2', 3, { state: 'completed', outcome: 'success', completedAt: 40 })
+    ],
+    submissions: [rejected('m1', START_FAILURE), sent('m2', { dispatchState: 'accepted' })],
+    outcome: 'success',
+    listed: true
+  },
+  {
+    name: 'a steer the provider refused inside a turn that then succeeded',
+    items: [
+      userEntry('m1', 1),
+      turn('t1', 2, { state: 'completed', outcome: 'success', completedAt: 50 }),
+      userEntry('steer', 3)
+    ],
+    submissions: [
+      sent('m1', { dispatchState: 'accepted' }),
+      rejected('steer', 'no active turn to steer', 30)
+    ],
+    outcome: 'success',
+    listed: true
+  },
+  {
+    name: 'a user message the provider journaled itself (history, an older host)',
+    items: [
+      {
+        itemId: 'codex:thread-1:turn-1:0',
+        revision: 0,
+        sequence: 1,
+        observedAt: 1,
+        body: { kind: 'message', role: 'user', blocks: [{ type: 'text', text: 'from history' }] }
+      }
+    ],
+    submissions: [],
+    outcome: null,
+    listed: true
+  },
+  {
+    name: 'a goal and nothing else yet',
+    items: [
+      {
+        itemId: 'codex:goal-entry',
+        revision: 0,
+        sequence: 1,
+        observedAt: 1,
+        body: {
+          kind: 'message',
+          role: 'user',
+          sentAs: 'goal',
+          blocks: [{ type: 'text', text: 'ship it' }]
+        }
+      }
+    ],
+    submissions: [],
+    outcome: null,
+    listed: true
+  }
+]
+
+describe('the latest request and its verdict', () => {
+  it.each(ROWS)('$name', ({ items, submissions, fence, outcome, listed }) => {
+    expect(latestStructuredAgentSessionRequest(items, submissions)?.outcome ?? null).toBe(outcome)
+    const summary = projectStructuredAgentSessionStatusSummary(items, submissions, fence)
+    expect(summary.status !== null).toBe(listed)
+    if (listed && summary.status === 'idle') {
+      expect(summary.turnOutcome ?? null).toBe(outcome)
+    }
+  })
+
+  it('dates an idle session by the refusal it reports, not by the older turn', () => {
+    const items = [
+      userEntry('m1', 1),
+      turn('t1', 2, { state: 'completed', outcome: 'success', completedAt: 15 }),
+      userEntry('m2', 3)
+    ]
+    const submissions = [sent('m1', { dispatchState: 'accepted' }), rejected('m2', START_FAILURE)]
+    expect(projectStructuredAgentSessionStatusSummary(items, submissions)).toMatchObject({
+      status: 'idle',
+      turnOutcome: 'failure',
+      statusStartedAt: 20
+    })
+  })
+})
+
+describe('the sidebar verdict agrees with the rejection classifier', () => {
+  // A sentence as the reason, so only the typed fact can make a kind read as no verdict.
+  const typed = AGENT_SESSION_FAILURE_KINDS.filter(isSubmissionRejectionKind).map((kind) => ({
+    name: `typed ${kind}`,
+    submission: sent('m1', {
+      dispatchState: 'rejected',
+      reason: 'The message was not sent.',
+      rejection: { kind }
+    })
+  }))
+  const legacy = [
+    DISPATCH_REJECTED_CANCELLED,
+    DISPATCH_REJECTED_QUEUE_FULL,
+    DISPATCH_REJECTED_CODEX_QUEUE_FULL,
+    DISPATCH_REJECTED_HOST_RESTARTED,
+    DISPATCH_REJECTED_PROVIDER_CLOSED,
+    DISPATCH_REJECTED_NOT_DELIVERED,
+    DISPATCH_REJECTED_WRITE_FAILED,
+    `${DISPATCH_REJECTED_WRITE_FAILED}: broken pipe`
+  ].map((reason) => ({ name: `legacy ${reason}`, submission: rejected('m1', reason) }))
+  const unknownKind = {
+    name: 'a kind this build cannot place',
+    submission: sent('m1', {
+      dispatchState: 'rejected',
+      reason: 'A newer host wrote this.',
+      rejection: { kind: 'someFutureKind' }
+    })
+  }
+
+  it.each([...typed, ...legacy, unknownKind])('$name', ({ submission }) => {
+    const items = [userEntry('m1', 1)]
+    const { verdict } = classifyDispatchRejection(submission)
+    expect(latestStructuredAgentSessionRequest(items, [submission])?.outcome ?? null).toBe(verdict)
+    expect(hasStructuredAgentSessionRequest(items, [submission])).toBe(verdict === 'failure')
+  })
+
+  const failedNobody = new Set([
+    'typed notDelivered',
+    'typed cancelled',
+    'typed hostRestarted',
+    'typed chatClosed',
+    `legacy ${DISPATCH_REJECTED_NOT_DELIVERED}`,
+    `legacy ${DISPATCH_REJECTED_CANCELLED}`,
+    `legacy ${DISPATCH_REJECTED_HOST_RESTARTED}`,
+    `legacy ${DISPATCH_REJECTED_PROVIDER_CLOSED}`
+  ])
+  const failedNobodyCases = [...typed, ...legacy].filter(({ name }) => failedNobody.has(name))
+  it('covers every send that failed nobody', () => {
+    expect(failedNobodyCases).toHaveLength(failedNobody.size)
+  })
+  it.each(failedNobodyCases)(
+    'gives no verdict for a send that failed nobody: $name',
+    ({ submission }) => {
+      expect(latestStructuredAgentSessionRequest([userEntry('m1', 1)], [submission])).toBeNull()
+    }
+  )
+})
diff --git a/src/shared/structured-agent-session-latest-request.ts b/src/shared/structured-agent-session-latest-request.ts
new file mode 100644
index 000000000000..9679c0c12bd7
--- /dev/null
+++ b/src/shared/structured-agent-session-latest-request.ts
@@ -0,0 +1,145 @@
+// The session's latest request and what became of it: the verdict a sidebar row reports once
+// the session is idle, and whether there is a request to list at all.
+//
+// A request is either a turn, whose record carries the provider's verdict, or a send that never
+// became one because the agent or its start refused it. A send inside a running turn (a steer)
+// is not a request of its own: the turn it joined answers for it.
+
+import type {
+  AgentJournalRenderItem,
+  AgentJournalSubmission,
+  AgentJournalTurnLifecycle,
+  AgentJournalTurnOutcome
+} from './agent-session-journal-types'
+import { agentJournalSubmissionKey } from './agent-session-journal-item-key'
+import { isRootAgentJournalItem } from './agent-session-journal-producer'
+import { readAgentJournalTurn, readAgentJournalTurnOutcome } from './agent-session-turn-record'
+import { classifyDispatchRejection } from './structured-agent-session-dispatch-rejection'
+import { isUnansweredStructuredAgentSessionDispatch } from './structured-agent-session-unanswered-dispatch'
+
+export type StructuredAgentSessionLatestRequest = {
+  kind: 'turn' | 'refused-send'
+  /** The turn's id, or the refused send's journal item key. Unique only within its kind. */
+  id: string
+  running: boolean
+  /** Null while the turn runs, and for a turn whose end carried no verdict. */
+  outcome: AgentJournalTurnOutcome | null
+  /** When it settled: the turn's end, or the refusal. Undefined while it runs. */
+  settledAt: number | undefined
+}
+
+/** Null when the journal holds no request with a verdict to give. Accepted and unanswered sends
+ *  are passed over — the session is working until their turn records — and so are sends that
+ *  failed nobody (withdrawn, or left undelivered by a restart or a close). */
+export function latestStructuredAgentSessionRequest(
+  items: readonly AgentJournalRenderItem[],
+  submissions: readonly AgentJournalSubmission[]
+): StructuredAgentSessionLatestRequest | null {
+  const rejected = rejectedSubmissionsByItem(submissions)
+  for (let index = items.length - 1; index >= 0; index -= 1) {
+    const item = items[index]
+    if (!item || !isRootAgentJournalItem(item)) {
+      continue
+    }
+    const turn = readAgentJournalTurn(item.body)
+    if (turn) {
+      const running = turn.state === 'running'
+      return {
+        kind: 'turn',
+        id: turn.turnId,
+        running,
+        outcome: readAgentJournalTurnOutcome(turn),
+        settledAt: running ? undefined : turnEndedAt(item, turn)
+      }
+    }
+    const submission = rejected.get(item.itemId)
+    if (
+      submission &&
+      classifyDispatchRejection(submission).verdict === 'failure' &&
+      !deliveredIntoRunningTurn(items, index, submission)
+    ) {
+      return {
+        kind: 'refused-send',
+        id: item.itemId,
+        running: false,
+        outcome: 'failure',
+        settledAt: submission.resolvedAt ?? undefined
+      }
+    }
+  }
+  return null
+}
+
+/** Whether the session has a request to list. A send that failed nobody and never became a turn
+ *  leaves nothing to report, so a session holding only those is not listed; a user message the
+ *  provider journaled itself (history, an older host) still is. Deliberately NOT scoped by
+ *  producer: a session whose only content came from a subagent still has content. */
+export function hasStructuredAgentSessionRequest(
+  items: readonly AgentJournalRenderItem[],
+  submissions: readonly AgentJournalSubmission[],
+  currentFence?: number | null
+): boolean {
+  const sent = new Set(
+    submissions.map((submission) => agentJournalSubmissionKey(submission.clientMessageId))
+  )
+  return (
+    items.some(
+      (item) =>
+        readAgentJournalTurn(item.body) !== null ||
+        (item.body.kind === 'message' &&
+          (item.body.role === 'assistant' || (item.body.role === 'user' && !sent.has(item.itemId))))
+    ) ||
+    submissions.some(
+      (submission) =>
+        submission.dispatchState === 'accepted' ||
+        isUnansweredStructuredAgentSessionDispatch(submission, currentFence) ||
+        (submission.dispatchState === 'rejected' &&
+          classifyDispatchRejection(submission).verdict === 'failure')
+    )
+  )
+}
+
+function rejectedSubmissionsByItem(
+  submissions: readonly AgentJournalSubmission[]
+): Map<string, AgentJournalSubmission> {
+  const rejected = new Map<string, AgentJournalSubmission>()
+  for (const submission of submissions) {
+    if (submission.dispatchState === 'rejected') {
+      rejected.set(agentJournalSubmissionKey(submission.clientMessageId), submission)
+    }
+  }
+  return rejected
+}
+
+/** A send handed over while the turn before it was still running joined that turn. Read off the
+ *  host clock, because a turn record's end revises it in place and keeps no sequence of its own.
+ *  A send never handed over reached no turn. */
+function deliveredIntoRunningTurn(
+  items: readonly AgentJournalRenderItem[],
+  index: number,
+  submission: AgentJournalSubmission
+): boolean {
+  // Older hosts dispatched a send as they recorded it.
+  const deliveredAt =
+    submission.handedOverAt ?? (submission.handoverRecorded ? undefined : submission.submittedAt)
+  if (deliveredAt === undefined) {
+    return false
+  }
+  for (let previous = index - 1; previous >= 0; previous -= 1) {
+    const item = items[previous]
+    const turn = readAgentJournalTurn(item?.body)
+    if (item && turn) {
+      const endedAt = turnEndedAt(item, turn)
+      return turn.state === 'running' || (endedAt !== undefined && endedAt > deliveredAt)
+    }
+  }
+  return false
+}
+
+/** A turn recovery settled ended when that settle was written: when the user learns it stopped. */
+function turnEndedAt(
+  item: AgentJournalRenderItem,
+  turn: AgentJournalTurnLifecycle
+): number | undefined {
+  return item.recoveredAt ?? turn.completedAt
+}
diff --git a/src/shared/structured-agent-session-message-projection.ts b/src/shared/structured-agent-session-message-projection.ts
index 6219538fbecd..334cde7cfe8c 100644
--- a/src/shared/structured-agent-session-message-projection.ts
+++ b/src/shared/structured-agent-session-message-projection.ts
@@ -1,5 +1,6 @@
 import type { AgentJournalRenderItem, AgentJournalSubmission } from './agent-session-journal-types'
 import { agentJournalSubmissionKey } from './agent-session-journal-item-key'
+import { agentJournalItemPosition } from './agent-session-journal-position'
 import type { NativeChatMessage } from './native-chat-types'
 import {
   reconcileStructuredAgentSessionOutbox,
@@ -20,18 +21,32 @@ export function projectStructuredAgentSessionMessages(
       .filter((submission) => submission.dispatchState === 'rejected')
       .map((submission) => agentJournalSubmissionKey(submission.clientMessageId))
   )
-  const visibleItems = items.filter((item) => !rejected.has(item.itemId))
+  const visibleItems: AgentJournalRenderItem[] = []
+  const refused = new Map<string, AgentJournalRenderItem>()
+  for (const item of items) {
+    if (rejected.has(item.itemId)) {
+      refused.set(item.itemId, item)
+    } else {
+      visibleItems.push(item)
+    }
+  }
   const journalled = new Set(visibleItems.map((item) => item.itemId))
   return [
     ...projectItems(visibleItems),
     ...optimistic
       .filter((entry) => !journalled.has(agentJournalSubmissionKey(entry.clientMessageId)))
-      .map((entry): NativeChatMessage => ({
-        id: agentJournalSubmissionKey(entry.clientMessageId),
-        role: 'user',
-        source: 'transcript',
-        timestamp: entry.queuedAt,
-        blocks: entry.body.blocks
-      }))
+      .map((entry): NativeChatMessage => {
+        const id = agentJournalSubmissionKey(entry.clientMessageId)
+        const recorded = refused.get(id)
+        return {
+          id,
+          role: 'user',
+          source: 'transcript',
+          timestamp: entry.queuedAt,
+          blocks: entry.body.blocks,
+          // A send the journal recorded before refusing it keeps its place there.
+          ...(recorded ? { journalPosition: agentJournalItemPosition(recorded) } : {})
+        }
+      })
   ]
 }
diff --git a/src/shared/structured-agent-session-outbox.ts b/src/shared/structured-agent-session-outbox.ts
index a336dea6fedd..4211bbb3961d 100644
--- a/src/shared/structured-agent-session-outbox.ts
+++ b/src/shared/structured-agent-session-outbox.ts
@@ -1,13 +1,25 @@
+import { readAgentSessionFailureFact, type AgentSessionFailureFact } from './agent-session-failure'
 import type { AgentJournalMessageItem, AgentJournalSubmission } from './agent-session-journal-types'
-import { agentSessionRefusalOperationState } from './agent-session-refusal-retry'
-import type {
-  AgentSessionMutationEnvelope,
-  AgentSessionWireRefusalCode
-} from './agent-session-wire'
+import {
+  parseAgentSessionWriteFailure,
+  type AgentSessionWriteFailure,
+  type AgentSessionWriteRefusal
+} from './agent-session-write-failure'
+import {
+  agentSessionOwnerVerdictAllowsFreshOperationId,
+  agentSessionRefusalOperationState
+} from './agent-session-refusal-retry'
+import type { AgentSessionMutationEnvelope } from './agent-session-wire'
 import { structuredAgentSessionPayloadFingerprint } from './structured-agent-session-mutation'
-import { DISPATCH_REJECTED_CANCELLED } from './structured-agent-session-dispatch-rejection'
+import { classifyDispatchRejection } from './structured-agent-session-dispatch-rejection'
 
-export type StructuredAgentSessionOutboxState = 'queued' | 'dispatching' | 'unconfirmed'
+/** `rejected`: the host settled the send as not delivered. The drain never sends it again on its
+ *  own and nothing queues behind it; only the user's Retry does. */
+export type StructuredAgentSessionOutboxState =
+  | 'queued'
+  | 'dispatching'
+  | 'unconfirmed'
+  | 'rejected'
 
 export type StructuredAgentSessionOutboxEntry = {
   clientMessageId: string
@@ -19,6 +31,63 @@ export type StructuredAgentSessionOutboxEntry = {
   lastAttemptAt: number | null
   retryAfterUnknownSubmittedAt: number | null
   source?: 'launch'
+  /** Why the last attempt did not go through. Lives on the message so it goes when the message
+   *  is sent again or delivered, instead of outliving it as a separate error. */
+  lastFailure?: StructuredAgentSessionAttemptFailure
+}
+
+/** A host's rejection fact as a message keeps it: never its provider detail, whose person-facing
+ *  words are already in the reason and whose log text is not kept client-side. */
+export type StructuredAgentSessionRejectionFact = Pick<
+  AgentSessionFailureFact,
+  'kind' | 'attachment'
+>
+
+/** Kept as the fact, not the words: the Retry row chooses those when it shows the entry. */
+export type StructuredAgentSessionAttemptFailure =
+  | AgentSessionWriteFailure
+  /** The host recorded the message and the provider turned it down, with the provider's reason. */
+  | { kind: 'rejected'; reason: string | null; rejection?: StructuredAgentSessionRejectionFact }
+
+/** The failure a rejected submission leaves on its message. A fact this build cannot place is
+ *  dropped, leaving the reason. */
+export function structuredAgentSessionRejectedFailure(submission: {
+  reason: string | null
+  rejection?: unknown
+}): Extract<StructuredAgentSessionAttemptFailure, { kind: 'rejected' }> {
+  const fact = readAgentSessionFailureFact(submission.rejection)
+  return {
+    kind: 'rejected',
+    reason: submission.reason,
+    ...(fact
+      ? {
+          rejection: {
+            kind: fact.kind,
+            ...(fact.attachment ? { attachment: fact.attachment } : {})
+          }
+        }
+      : {})
+  }
+}
+
+function parseStructuredAgentSessionAttemptFailure(
+  value: unknown
+): StructuredAgentSessionAttemptFailure | undefined {
+  if (
+    typeof value === 'object' &&
+    value !== null &&
+    'kind' in value &&
+    value.kind === 'rejected' &&
+    'reason' in value
+  ) {
+    return value.reason === null || typeof value.reason === 'string'
+      ? structuredAgentSessionRejectedFailure({
+          reason: value.reason,
+          rejection: 'rejection' in value ? value.rejection : undefined
+        })
+      : undefined
+  }
+  return parseAgentSessionWriteFailure(value)
 }
 
 export type StructuredAgentSessionAttachment = {
@@ -73,25 +142,41 @@ export function updateStructuredAgentSessionOutboxEntry(
   })
 }
 
+/** Staged for another attempt; the last attempt's failure no longer describes it. */
+export function stageStructuredAgentSessionOutboxEntryForSend(
+  { lastFailure: _sentAgain, ...entry }: StructuredAgentSessionOutboxEntry,
+  now: number
+): StructuredAgentSessionOutboxEntry {
+  return { ...entry, state: 'dispatching', lastAttemptAt: now }
+}
+
 export function requeueStructuredAgentSessionSendRefusal(
   entry: StructuredAgentSessionOutboxEntry,
-  code: AgentSessionWireRefusalCode,
+  refusal: AgentSessionWriteRefusal,
   createOperationId: () => string,
   retainOperationId = false
 ): StructuredAgentSessionOutboxEntry {
-  const refusalState = agentSessionRefusalOperationState(code)
+  const refusalSettled = agentSessionRefusalOperationState(refusal.code) === 'settled-rejected'
+  // An exited owner runs nothing under the old id, so a new one can't collide; the message still
+  // holds the head, since nothing recorded it.
+  const ownerExited =
+    refusal.code === 'agent_session_ownership_unknown' &&
+    agentSessionOwnerVerdictAllowsFreshOperationId(refusal.details?.ownerVerdict)
   if (
-    refusalState !== 'settled-rejected' ||
+    !(refusalSettled || ownerExited) ||
     retainOperationId ||
     entry.state === 'unconfirmed' ||
     entry.retryAfterUnknownSubmittedAt !== null
   ) {
     return { ...entry, state: 'queued' }
   }
+  // Only here may the id rotate: an earlier attempt under this id, or one whose delivery was in
+  // doubt, may have landed, so those stay queued behind the block. Only a settled refusal proves
+  // the message never landed and so releases the queue.
   return {
     ...entry,
     clientMessageId: createOperationId(),
-    state: 'queued',
+    state: refusalSettled ? 'rejected' : 'queued',
     lastAttemptAt: null,
     retryAfterUnknownSubmittedAt: null
   }
@@ -109,13 +194,28 @@ export function reconcileStructuredAgentSessionOutbox(
     }
     if (
       submission?.dispatchState === 'rejected' &&
-      submission.reason === DISPATCH_REJECTED_CANCELLED
+      classifyDispatchRejection(submission).category === 'withdrawn'
     ) {
       return []
     }
     if (submission?.dispatchState === 'pending') {
       return entry.state === 'dispatching' ? [entry] : [{ ...entry, state: 'dispatching' as const }]
     }
+    // Accepted, then not delivered — the agent never started, or its start was refused. The text
+    // and why stay here for the user's Retry, and nothing queues behind it. `unconfirmed` is how a
+    // remount reads an entry it left dispatching; the journal has since answered it.
+    if (
+      submission?.dispatchState === 'rejected' &&
+      (entry.state === 'dispatching' || entry.state === 'unconfirmed')
+    ) {
+      return [
+        {
+          ...entry,
+          state: 'rejected' as const,
+          lastFailure: structuredAgentSessionRejectedFailure(submission)
+        }
+      ]
+    }
     if (
       submission?.dispatchState === 'unknown' &&
       entry.retryAfterUnknownSubmittedAt !== -1 &&
@@ -147,6 +247,10 @@ export function admitStructuredAgentSessionOutboxEntry(
   blockedClientMessageId: string | null
 ): StructuredAgentSessionOutboxAdmission {
   for (const entry of entries) {
+    // It can no longer land, so nothing it could be reordered around; it waits for Retry.
+    if (entry.state === 'rejected') {
+      continue
+    }
     if (entry.state === 'unconfirmed' || entry.clientMessageId === blockedClientMessageId) {
       return { state: 'blocked', entry }
     }
@@ -176,10 +280,12 @@ export function parseStructuredAgentSessionOutboxEntry(
     !Array.isArray(body.blocks) ||
     !Array.isArray(entry.previewUris) ||
     !entry.previewUris.every((uri) => typeof uri === 'string') ||
-    !['queued', 'dispatching', 'unconfirmed'].includes(entry.state ?? '')
+    !['queued', 'dispatching', 'unconfirmed', 'rejected'].includes(entry.state ?? '')
   ) {
     return null
   }
+  // A malformed failure is dropped: the row then says only that the message was not sent.
+  const lastFailure = parseStructuredAgentSessionAttemptFailure(entry.lastFailure)
   return {
     clientMessageId: entry.clientMessageId,
     sessionId,
@@ -192,7 +298,8 @@ export function parseStructuredAgentSessionOutboxEntry(
       typeof entry.retryAfterUnknownSubmittedAt === 'number'
         ? entry.retryAfterUnknownSubmittedAt
         : null,
-    ...(entry.source === 'launch' ? { source: 'launch' as const } : {})
+    ...(entry.source === 'launch' ? { source: 'launch' as const } : {}),
+    ...(lastFailure ? { lastFailure } : {})
   }
 }
 
diff --git a/src/shared/structured-agent-session-owed-work.ts b/src/shared/structured-agent-session-owed-work.ts
new file mode 100644
index 000000000000..ab62b3bfce1f
--- /dev/null
+++ b/src/shared/structured-agent-session-owed-work.ts
@@ -0,0 +1,16 @@
+import type { AgentJournalRenderItem, AgentJournalSubmission } from './agent-session-journal-types'
+import { activeStructuredAgentSessionTurnId } from './structured-agent-session-live-turn'
+import { hasUnansweredStructuredAgentSessionDispatch } from './structured-agent-session-unanswered-dispatch'
+
+/** A running turn or an unanswered send: what a `working` status means, and what an `attention`
+ *  status hides beneath its pending prompt. */
+export function owesStructuredAgentSessionWork(
+  items: readonly AgentJournalRenderItem[],
+  submissions: readonly AgentJournalSubmission[],
+  currentFence?: number | null
+): boolean {
+  return (
+    activeStructuredAgentSessionTurnId(items) !== null ||
+    hasUnansweredStructuredAgentSessionDispatch(submissions, currentFence)
+  )
+}
diff --git a/src/shared/structured-agent-session-projection.test.ts b/src/shared/structured-agent-session-projection.test.ts
index 3c16614cf454..f26f409afd40 100644
--- a/src/shared/structured-agent-session-projection.test.ts
+++ b/src/shared/structured-agent-session-projection.test.ts
@@ -1,15 +1,16 @@
 import { describe, expect, it } from 'vitest'
 import { AGENT_STATUS_MAX_FIELD_LENGTH } from './agent-status-field-normalization'
+import { agentSessionFailureWords } from './agent-session-failure-words'
 import type { AgentJournalRenderItem, AgentJournalSubmission } from './agent-session-journal-types'
 import { parsePaneKey } from './stable-pane-id'
 import {
   activeStructuredAgentSessionTurnId,
-  hasPersistedStructuredAgentSessionTurn,
   hasUnansweredStructuredAgentSessionDispatch,
   projectStructuredItemToNativeChat,
   projectStructuredItemsToNativeChat,
   latestStructuredAgentSessionAssistantMessage,
   projectStructuredAgentSessionStatus,
+  projectStructuredAgentSessionStatusState,
   projectStructuredAgentSessionStatusSummary,
   structuredAgentSessionPaneKey
 } from './structured-agent-session-projection'
@@ -103,6 +104,26 @@ describe('structured agent session status projection', () => {
     })
   })
 
+  it("forwards a status row's failure fact and drops one this build cannot place", () => {
+    const words = agentSessionFailureWords(
+      {
+        kind: 'providerExited',
+        detail: { text: 'stderr tail', audience: 'log' }
+      },
+      { surface: 'row' }
+    )
+    expect(
+      projectStructuredItemToNativeChat(item('exit', 1, { kind: 'status', ...words }))?.blocks[0]
+    ).toEqual({ type: 'text', ...words })
+    const future = item('future', 2, { kind: 'status', text: 'Stopped.' })
+    // A newer host's kind reads as no fact, so the row keeps its text and nothing else.
+    Object.assign(future.body, { failure: { kind: 'futureKind' } })
+    expect(projectStructuredItemToNativeChat(future)?.blocks[0]).toEqual({
+      type: 'text',
+      text: 'Stopped.'
+    })
+  })
+
   it('projects running, attention, and completed lifecycle states', () => {
     const running = item('running', 1, {
       kind: 'status',
@@ -129,7 +150,7 @@ describe('structured agent session status projection', () => {
     expect(projectStructuredAgentSessionStatus([running, completed])).toBe('idle')
   })
 
-  it('summarizes status with the newest user prompt, and null before any persisted turn', () => {
+  it('summarizes status with the newest user prompt, and null before any request', () => {
     const running = item('running', 3, {
       kind: 'status',
       text: 'Working',
@@ -149,10 +170,16 @@ describe('structured agent session status projection', () => {
       ]
     })
 
-    expect(projectStructuredAgentSessionStatusSummary([running])).toEqual({
+    expect(projectStructuredAgentSessionStatusSummary([])).toEqual({
       status: null,
       latestPrompt: ''
     })
+    // A turn the provider opened on its own is a request, with no prompt to quote.
+    expect(projectStructuredAgentSessionStatusSummary([running])).toEqual({
+      status: 'working',
+      latestPrompt: '',
+      statusStartedAt: 3
+    })
     expect(projectStructuredAgentSessionStatusSummary([first, second, running])).toEqual({
       status: 'working',
       latestPrompt: 'second line',
@@ -235,6 +262,42 @@ describe('structured agent session status projection', () => {
     })
   })
 
+  it('still reports owed work beneath a pending prompt, which the attention status hides', () => {
+    const asked = item('asked', 1, {
+      kind: 'message',
+      role: 'user',
+      blocks: [{ type: 'text', text: 'go' }]
+    })
+    const prompt = item('prompt', 3, {
+      kind: 'approval',
+      title: 'Run command?',
+      detail: null,
+      options: [{ id: 'yes', label: 'Allow' }],
+      resolution: { state: 'pending', selectedOptionId: null, resolvedBy: null, resolvedAt: null }
+    })
+    const running = item('turn', 2, { kind: 'turn', turnId: 't1', state: 'running' })
+    const settled = item('turn', 2, {
+      kind: 'turn',
+      turnId: 't1',
+      state: 'completed',
+      outcome: 'success'
+    })
+    const accepted = [submission('m1', 'accepted')]
+    const owes = (items: AgentJournalRenderItem[], submissions = accepted) => {
+      const state = projectStructuredAgentSessionStatusState(items, submissions)
+      return [state.summary.status, state.owesWork]
+    }
+
+    expect(owes([asked, running, prompt])).toEqual(['attention', true])
+    expect(owes([asked, settled, prompt])).toEqual(['attention', false])
+    expect(owes([asked, settled, prompt], [...accepted, submission('m2', 'pending')])).toEqual([
+      'attention',
+      true
+    ])
+    expect(owes([asked, running])).toEqual(['working', true])
+    expect(owes([asked, settled])).toEqual(['idle', false])
+  })
+
   it('carries the running tool and the newest assistant prose the sidebar row shows', () => {
     const ask = item('ask', 1, {
       kind: 'message',
@@ -394,15 +457,6 @@ describe('structured agent session status projection', () => {
     expect(parsePaneKey(paneKey)).toMatchObject({ tabId: 'structured-agent-session-1' })
   })
 
-  it('requires a persisted provider conversation turn before TUI resume', () => {
-    const status = item('status', 1, { kind: 'status', text: 'Connected' })
-    const user = item('user', 2, { kind: 'message', role: 'user', blocks: [] })
-
-    expect(hasPersistedStructuredAgentSessionTurn([])).toBe(false)
-    expect(hasPersistedStructuredAgentSessionTurn([status])).toBe(false)
-    expect(hasPersistedStructuredAgentSessionTurn([status, user])).toBe(true)
-  })
-
   it('preserves provider-frame detail on the backward-compatible status line', () => {
     const projected = projectStructuredItemToNativeChat(
       item('frame', 1, {
diff --git a/src/shared/structured-agent-session-projection.ts b/src/shared/structured-agent-session-projection.ts
index 6e61603c7582..f444af0a060c 100644
--- a/src/shared/structured-agent-session-projection.ts
+++ b/src/shared/structured-agent-session-projection.ts
@@ -11,17 +11,19 @@ import {
   type AgentJournalTurnOutcome
 } from './agent-session-journal-types'
 import { isRootAgentJournalItem } from './agent-session-journal-producer'
-import { readAgentJournalTurnOutcome } from './agent-session-turn-record'
+import { structuredAgentSessionStatusBlock } from './structured-agent-session-status-block'
+import { agentJournalItemRowOrigin } from './agent-session-journal-position'
 import {
   AGENT_STATUS_TOOL_INPUT_MAX_LENGTH,
   AGENT_STATUS_TOOL_NAME_MAX_LENGTH
 } from './agent-status-types'
 import { describeToolInput } from './native-chat-tool-summary'
+import { statusStructuredAgentSessionToolCall } from './structured-agent-session-live-turn'
 import {
-  activeStructuredAgentSessionTurnId,
-  newestStructuredAgentSessionTurn,
-  statusStructuredAgentSessionToolCall
-} from './structured-agent-session-live-turn'
+  hasStructuredAgentSessionRequest,
+  latestStructuredAgentSessionRequest,
+  type StructuredAgentSessionLatestRequest
+} from './structured-agent-session-latest-request'
 import {
   isStructuredAgentSessionToolAction,
   structuredAgentSessionToolCallBlock
@@ -30,13 +32,15 @@ import {
 import type { NativeChatBlock, NativeChatMessage } from './native-chat-types'
 import { sha256 } from './sha256'
 import { structuredAgentSessionStatusStartedAt } from './structured-agent-session-status-started-at'
-import { isUnansweredStructuredAgentSessionDispatch } from './structured-agent-session-unanswered-dispatch'
+import { owesStructuredAgentSessionWork } from './structured-agent-session-owed-work'
 
-// Re-exported so the live-turn readers' existing consumers keep one import site.
+// Re-exported so the live-turn readers' and the unanswered-send rule's existing consumers keep one
+// import site.
 export {
   activeStructuredAgentSessionTurnId,
   newestStructuredAgentSessionTurn
 } from './structured-agent-session-live-turn'
+export { hasUnansweredStructuredAgentSessionDispatch } from './structured-agent-session-unanswered-dispatch'
 
 function boundedText(payload: { head: string; truncated: boolean; byteLength: number }): string {
   return payload.truncated ? `${payload.head}\n… (${payload.byteLength} bytes)` : payload.head
@@ -119,18 +123,7 @@ function itemBlocks(item: AgentJournalRenderItem): {
   if (body.kind !== 'status' || body.turnLifecycle) {
     return null
   }
-  return {
-    role: 'system',
-    blocks: [
-      {
-        type: 'text',
-        text: body.text,
-        ...(body.presentation !== undefined ? { presentation: body.presentation } : {}),
-        ...(body.tone !== undefined ? { tone: body.tone } : {}),
-        ...(body.providerFrame ? { providerFrame: body.providerFrame } : {})
-      }
-    ]
-  }
+  return { role: 'system', blocks: [structuredAgentSessionStatusBlock(body)] }
 }
 
 function isAgentJournalMessageSendMode(value: string): value is AgentJournalMessageSendMode {
@@ -168,11 +161,9 @@ export function projectStructuredItemToNativeChat(
   const sentAs = item.body.kind === 'message' ? item.body.sentAs : undefined
   const message: NativeChatMessage | null = projected
     ? {
-        id: item.itemId,
+        ...agentJournalItemRowOrigin(item),
         role: projected.role,
         blocks: projected.blocks,
-        timestamp: item.observedAt,
-        source: 'transcript',
         // A send mode this build cannot name renders as an ordinary message.
         ...(sentAs !== undefined && isAgentJournalMessageSendMode(sentAs) ? { sentAs } : {})
       }
@@ -181,39 +172,6 @@ export function projectStructuredItemToNativeChat(
   return message
 }
 
-/** Deliberately NOT scoped by producer: this is an existence test ("is this
- *  session listable at all"), not an attribution one. A session whose only
- *  content came from a subagent still has content. */
-export function hasPersistedStructuredAgentSessionTurn(
-  items: readonly AgentJournalRenderItem[]
-): boolean {
-  return items.some(
-    (item) =>
-      item.body.kind === 'message' && (item.body.role === 'user' || item.body.role === 'assistant')
-  )
-}
-
-/**
- * A send the host has journaled that the provider has neither opened a turn for nor refused.
- *
- * Codex declares `turn/started` within ~150ms, but Claude's running row can only be written once
- * the SDK echoes the user message back — a 3.4s median and 18s at p90 on real journals. Waiting
- * on that echo to call a session working leaves the whole gap reading idle in the chat and in
- * every session list, so the send itself is the evidence.
- *
- * A live `unknown` still counts because an ambiguous adapter reply does not prove the provider
- * stopped. A recovered `unknown` does not — it outlived the host generation that sent it, so
- * there is nothing still running to report.
- */
-export function hasUnansweredStructuredAgentSessionDispatch(
-  submissions: readonly AgentJournalSubmission[],
-  currentFence?: number | null
-): boolean {
-  return submissions.some((submission) =>
-    isUnansweredStructuredAgentSessionDispatch(submission, currentFence)
-  )
-}
-
 export type StructuredAgentSessionProjectedStatus = 'working' | 'attention' | 'idle'
 
 export function structuredAgentSessionTabId(sessionId: string): string {
@@ -234,10 +192,7 @@ export function projectStructuredAgentSessionStatus(
   ) {
     return 'attention'
   }
-  return activeStructuredAgentSessionTurnId(items) ||
-    hasUnansweredStructuredAgentSessionDispatch(submissions, currentFence)
-    ? 'working'
-    : 'idle'
+  return owesStructuredAgentSessionWork(items, submissions, currentFence) ? 'working' : 'idle'
 }
 
 function messageProse(blocks: readonly NativeChatBlock[]): string {
@@ -307,7 +262,8 @@ export type StructuredAgentSessionStatusProjection = {
   toolName?: string
   toolInput?: string
   lastAssistantMessage?: string
-  /** The newest settled turn's provider verdict; present only while `status` is idle. */
+  /** The latest request's verdict: its turn's, or `failure` for a send the agent or its start
+   *  refused. Present only while `status` is idle. */
   turnOutcome?: AgentJournalTurnOutcome
   statusStartedAt?: number
 }
@@ -323,13 +279,23 @@ export function projectStructuredAgentSessionStatusSummary(
   submissions: readonly AgentJournalSubmission[] = [],
   currentFence?: number | null
 ): StructuredAgentSessionStatusProjection {
-  // A first send has no journalled message until the provider replays it, so the pending
-  // dispatch is also what makes a brand-new session listable at all.
-  if (
-    !hasPersistedStructuredAgentSessionTurn(items) &&
-    !hasUnansweredStructuredAgentSessionDispatch(submissions, currentFence)
-  ) {
-    return { status: null, latestPrompt: '' }
+  return projectStructuredAgentSessionStatusState(items, submissions, currentFence).summary
+}
+
+/** The summary plus the latest request it was read from, whatever the status, so the host's
+ *  completion feed follows the same request the row reports without scanning again. */
+export function projectStructuredAgentSessionStatusState(
+  items: readonly AgentJournalRenderItem[],
+  submissions: readonly AgentJournalSubmission[] = [],
+  currentFence?: number | null
+): {
+  summary: StructuredAgentSessionStatusProjection
+  latestRequest: StructuredAgentSessionLatestRequest | null
+  /** Whether a running turn or an unanswered send is still owed, even beneath a pending prompt. */
+  owesWork: boolean
+} {
+  if (!hasStructuredAgentSessionRequest(items, submissions, currentFence)) {
+    return { summary: { status: null, latestPrompt: '' }, latestRequest: null, owesWork: false }
   }
   const status = projectStructuredAgentSessionStatus(items, submissions, currentFence)
   const statusToolCall = status === 'working' ? statusStructuredAgentSessionToolCall(items) : null
@@ -346,24 +312,29 @@ export function projectStructuredAgentSessionStatusSummary(
     latestStructuredAgentSessionAssistantMessage(items),
     AGENT_STATUS_MAX_FIELD_LENGTH
   )
-  // A verdict is a fact about a finished turn: only an idle session has one to report, and
-  // `readAgentJournalTurnOutcome` already answers null for anything it cannot place.
-  const turnOutcome =
-    status === 'idle' ? readAgentJournalTurnOutcome(newestStructuredAgentSessionTurn(items)) : null
+  const latestRequest = latestStructuredAgentSessionRequest(items, submissions)
+  // A verdict is a fact about a finished request: only an idle session has one to report.
+  const request = status === 'idle' ? latestRequest : null
+  const turnOutcome = request?.outcome
   const statusStartedAt = structuredAgentSessionStatusStartedAt(
     status,
     items,
     submissions,
-    currentFence
+    currentFence,
+    request
   )
   return {
-    status,
-    latestPrompt: normalizePromptField(latestStructuredAgentSessionPrompt(items)),
-    ...(toolName ? { toolName } : {}),
-    ...(toolInput ? { toolInput } : {}),
-    ...(lastAssistantMessage ? { lastAssistantMessage } : {}),
-    ...(turnOutcome ? { turnOutcome } : {}),
-    ...(statusStartedAt !== undefined ? { statusStartedAt } : {})
+    latestRequest,
+    owesWork: status !== 'idle' && owesStructuredAgentSessionWork(items, submissions, currentFence),
+    summary: {
+      status,
+      latestPrompt: normalizePromptField(latestStructuredAgentSessionPrompt(items)),
+      ...(toolName ? { toolName } : {}),
+      ...(toolInput ? { toolInput } : {}),
+      ...(lastAssistantMessage ? { lastAssistantMessage } : {}),
+      ...(turnOutcome ? { turnOutcome } : {}),
+      ...(statusStartedAt !== undefined ? { statusStartedAt } : {})
+    }
   }
 }
 
diff --git a/src/shared/structured-agent-session-read-refusal.ts b/src/shared/structured-agent-session-read-refusal.ts
index 18487f12be38..784f38ed2a25 100644
--- a/src/shared/structured-agent-session-read-refusal.ts
+++ b/src/shared/structured-agent-session-read-refusal.ts
@@ -1,11 +1,11 @@
 /**
  * The one refusal a structured-session READ can raise that is not a failure to read.
  *
- * `agentSession.history` and `agentSession.subscribe` both resolve the session through the host's
- * `requireSession`, which raises this code when the host holds no session object by that id. That
- * is never a transcript Orca could not read — it is a session this host has not attached YET (the
- * surface's hold is what attaches one) or one it has just closed. Both windows end on their own:
- * the first when the hold lands, the second when the chat tab retires.
+ * A current host opens a conversation for any read, so a read meets this code only once quit began.
+ * An older host resolves `agentSession.history` and `agentSession.subscribe` against the sessions it
+ * has attached, and raises it when it holds none by that id. Either way it is never a transcript
+ * Orca could not read: an older host's session is not attached YET (the surface's hold attaches
+ * one) or was just closed, and both windows end on their own.
  *
  * The genuinely latched lease — "Orca cannot prove the previous owner exited" — reaches the client
  * through the ACQUISITION path instead, so narrowing on the code costs a read no real diagnosis.
diff --git a/src/shared/structured-agent-session-reducer.test.ts b/src/shared/structured-agent-session-reducer.test.ts
index aa90749ffdf5..a374c794d7fb 100644
--- a/src/shared/structured-agent-session-reducer.test.ts
+++ b/src/shared/structured-agent-session-reducer.test.ts
@@ -54,6 +54,37 @@ function hydrationPage(
 }
 
 describe('structured agent session reducer', () => {
+  it("orders one journal write's items by their place in it, whatever order they arrive in", () => {
+    const at = (id: string, sequence: number, sequenceIndex: number): AgentJournalRenderItem => ({
+      ...item(id, sequence),
+      ...(sequenceIndex > 0 ? { sequenceIndex } : {})
+    })
+    const paged = reduceStructuredAgentSession(EMPTY_STRUCTURED_AGENT_SESSION, {
+      type: 'history-page',
+      page: hydrationPage([
+        item('before', 4),
+        at('third', 5, 2),
+        at('first', 5, 0),
+        at('second', 5, 1)
+      ])
+    })
+    expect(paged.items.map(({ itemId }) => itemId)).toEqual(['before', 'first', 'second', 'third'])
+    const live = reduceStructuredAgentSession(paged, {
+      type: 'event',
+      event: {
+        type: 'batch',
+        sessionId: 'session-a',
+        batch: {
+          cursor: { epoch: 'epoch-a', sequence: 6 },
+          items: [at('next-b', 6, 1), at('next-a', 6, 0)],
+          removedItemIds: [],
+          submissions: []
+        }
+      }
+    })
+    expect(live.items.map(({ itemId }) => itemId).slice(-2)).toEqual(['next-a', 'next-b'])
+  })
+
   it('applies an additive targeted-stop capability update without journal churn', () => {
     const backgroundTasks = {
       state: 'monitoring' as const,
diff --git a/src/shared/structured-agent-session-reducer.ts b/src/shared/structured-agent-session-reducer.ts
index 2f839f933309..e47ed5ad57b4 100644
--- a/src/shared/structured-agent-session-reducer.ts
+++ b/src/shared/structured-agent-session-reducer.ts
@@ -12,6 +12,7 @@ import type {
 } from './agent-session-wire'
 import { backgroundTaskStatesEqual } from './agent-session-background-task-state-equality'
 import { agentJournalSubmissionKey } from './agent-session-journal-item-key'
+import { compareAgentJournalItems } from './agent-session-journal-position'
 import { readAgentJournalTurn } from './agent-session-turn-record'
 
 /** The last host clock sample: `hostNow - receivedAt` is the client's skew from the host,
@@ -85,7 +86,7 @@ function replacePage(
     epoch: page.epoch,
     cursor: page.liveCursor ?? page.window.nextCursor,
     fence,
-    items: [...page.items].sort((left, right) => left.sequence - right.sequence),
+    items: [...page.items].sort(compareAgentJournalItems),
     submissions: page.submissions,
     retainedItemLimit: Math.max(MAX_RETAINED_ITEMS, page.items.length),
     hasOlder: page.hasOlder,
@@ -114,7 +115,7 @@ function mergeItems(
       byId.set(item.itemId, item)
     }
   }
-  return [...byId.values()].sort((left, right) => left.sequence - right.sequence)
+  return [...byId.values()].sort(compareAgentJournalItems)
 }
 
 /**
diff --git a/src/shared/structured-agent-session-send-disposition.test.ts b/src/shared/structured-agent-session-send-disposition.test.ts
index 66a7a9b32fa8..08fad831af2d 100644
--- a/src/shared/structured-agent-session-send-disposition.test.ts
+++ b/src/shared/structured-agent-session-send-disposition.test.ts
@@ -4,14 +4,19 @@
 // which is the whole reason it was split out.
 
 import { describe, expect, it } from 'vitest'
+import type { AgentSessionFailureFact } from './agent-session-failure'
 import type { AgentJournalSubmission } from './agent-session-journal-types'
 import type { AgentSessionMutationResult, AgentSessionSendResult } from './agent-session-wire'
 import {
-  dispatchWriteFailureReason,
   DISPATCH_REJECTED_CANCELLED,
   DISPATCH_REJECTED_QUEUE_FULL
 } from './structured-agent-session-dispatch-rejection'
-import { disposeStructuredAgentSessionSendResult } from './structured-agent-session-send-disposition'
+import { agentSessionWriteNoticeEnglish } from './agent-session-refusal-notice'
+import {
+  disposeStructuredAgentSessionSendFailure,
+  disposeStructuredAgentSessionSendResult,
+  structuredAgentSessionAttemptFailureParts
+} from './structured-agent-session-send-disposition'
 import {
   createStructuredAgentSessionOutboxEntry,
   reconcileStructuredAgentSessionOutbox,
@@ -26,7 +31,10 @@ const entry: StructuredAgentSessionOutboxEntry = createStructuredAgentSessionOut
   queuedAt: 1
 })
 
-function rejectedWith(reason: string | null): AgentSessionMutationResult<AgentSessionSendResult> {
+function rejectedWith(
+  reason: string | null,
+  extra: { rejection?: AgentSessionFailureFact; replayed?: boolean } = {}
+): AgentSessionMutationResult<AgentSessionSendResult> {
   const submission: AgentJournalSubmission = {
     clientMessageId: 'client-1',
     fence: 1,
@@ -35,25 +43,32 @@ function rejectedWith(reason: string | null): AgentSessionMutationResult<AgentSe
     providerItemId: null,
     reason,
     submittedAt: 10,
-    resolvedAt: 10
+    resolvedAt: 10,
+    ...(extra.rejection ? { rejection: extra.rejection } : {})
   }
   return {
     ok: true,
-    replayed: false,
+    replayed: extra.replayed ?? false,
     fence: 1,
     cursor: { epoch: 'epoch-1', sequence: 10 },
     value: { clientMessageId: 'client-1', submission }
-  } as AgentSessionMutationResult<AgentSessionSendResult>
+  }
 }
 
-function notice(reason: string | null): string | null {
-  return disposeStructuredAgentSessionSendResult({
+function notice(reason: string | null): string | undefined {
+  const disposition = disposeStructuredAgentSessionSendResult({
     entries: [entry],
     entry,
     blockedClientMessageId: null,
     result: rejectedWith(reason),
     createOperationId: () => 'unused'
-  }).error
+  })
+  // The reason travels with the message it explains, never as a separate error.
+  expect(disposition.error).toBeNull()
+  const failure = disposition.entries[0]?.lastFailure
+  return (
+    failure && agentSessionWriteNoticeEnglish(structuredAgentSessionAttemptFailureParts(failure))
+  )
 }
 
 describe('what a rejection shows the user', () => {
@@ -67,14 +82,11 @@ describe('what a rejection shows the user', () => {
   })
 
   it('never puts the transport marker on screen', () => {
-    const shown = notice(dispatchWriteFailureReason(new Error('broken pipe')))
+    const shown = notice('provider_write_failed: broken pipe')
     // `provider_write_failed: broken pipe` names nothing a person can act on.
     expect(shown).not.toContain('provider_write_failed')
     expect(shown).not.toContain('broken pipe')
-    // And it says the message is safe to send again, which it is: the frame never left.
-    expect(shown).toBe(
-      "Couldn't reach the agent. Your message was not sent — Retry to send it again."
-    )
+    expect(shown).toBe("Orca couldn't reach the agent. Your message was not sent.")
   })
 
   it('shows a content rejection in the provider own words', () => {
@@ -84,15 +96,56 @@ describe('what a rejection shows the user', () => {
     )
   })
 
-  it('names the cause of a start that died before it could take the message', () => {
-    // The host words this reason for the user: the child's own diagnostic, nothing internal.
-    const reason =
-      'The provider stopped before it finished starting: claude stream-json exited (code 1): claude: not signed in.'
+  it('shows the sentence a host wrote for the person reading it', () => {
+    const reason = 'The provider stopped before it finished starting.'
     expect(notice(reason)).toBe(reason)
   })
 
+  it('never puts the legacy not_delivered marker on screen', () => {
+    // Released clients printed it as it was; it is a marker, not a sentence.
+    expect(notice('not_delivered')).toBe('Your message was not sent.')
+  })
+
+  it.each([
+    ['the legacy marker alone', undefined],
+    ['the marker and its typed fact', { kind: 'cancelled' as const }]
+  ])('fails nothing for a Stop-withdrawn send, first reply or replay: %s', (_label, rejection) => {
+    for (const replayed of [false, true]) {
+      const disposition = disposeStructuredAgentSessionSendResult({
+        entries: [entry],
+        entry,
+        blockedClientMessageId: null,
+        result: rejectedWith(DISPATCH_REJECTED_CANCELLED, { rejection, replayed }),
+        createOperationId: () => 'unused'
+      })
+      expect(disposition).toEqual({
+        entries: [],
+        error: null,
+        blockedClientMessageId: null,
+        retryWithFreshClientMessageId: null
+      })
+    }
+  })
+
+  it('reads a withdrawal off the typed fact whatever the reason says', () => {
+    const result = rejectedWith('Withdrawn.', { rejection: { kind: 'cancelled' } })
+    if (!result.ok) {
+      throw new Error('expected rejected submission fixture')
+    }
+    expect(reconcileStructuredAgentSessionOutbox([entry], [result.value.submission])).toEqual([])
+    expect(
+      disposeStructuredAgentSessionSendResult({
+        entries: [entry],
+        entry,
+        blockedClientMessageId: null,
+        result,
+        createOperationId: () => 'unused'
+      }).error
+    ).toBeNull()
+  })
+
   it('claims no cause when the rejection names none', () => {
-    expect(notice(null)).toBe('Message was not sent.')
+    expect(notice(null)).toBe('Your message was not sent.')
   })
 
   it('never puts a local-capacity marker on screen either', () => {
@@ -100,7 +153,126 @@ describe('what a rejection shows the user', () => {
     // ourselves. It has no user-facing meaning, so it gets copy rather than the token.
     const shown = notice(DISPATCH_REJECTED_QUEUE_FULL)
     expect(shown).not.toContain('queue is full')
-    expect(shown).toBe('Orca could not send your message — Retry to send it again.')
+    expect(shown).toBe('Your message was not sent.')
+  })
+})
+
+describe('what a refusal shows the user', () => {
+  it('keeps the refusal as a fact on the message, without the host diagnostic', () => {
+    const disposition = disposeStructuredAgentSessionSendResult({
+      entries: [entry],
+      entry,
+      blockedClientMessageId: null,
+      result: {
+        ok: false,
+        refusal: {
+          code: 'agent_session_checkpoint_stale',
+          message: 'Expected runtime fence 1; the session is at 3.'
+        }
+      },
+      createOperationId: () => 'unused'
+    })
+
+    expect(disposition.error).toBeNull()
+    expect(disposition.blockedClientMessageId).toBe(entry.clientMessageId)
+    expect(disposition.entries).toMatchObject([
+      {
+        clientMessageId: entry.clientMessageId,
+        state: 'queued',
+        lastFailure: { kind: 'refused', code: 'agent_session_checkpoint_stale' }
+      }
+    ])
+    expect(
+      agentSessionWriteNoticeEnglish(
+        structuredAgentSessionAttemptFailureParts(disposition.entries[0]!.lastFailure!)
+      )
+    ).toBe('Your message was not sent.')
+  })
+
+  it("keeps the reason the host named, and says it on the message's Retry row", () => {
+    const disposition = disposeStructuredAgentSessionSendResult({
+      entries: [entry],
+      entry,
+      blockedClientMessageId: null,
+      result: {
+        ok: false,
+        refusal: {
+          code: 'agent_session_conflict',
+          message: 'The chat is still starting.',
+          details: { reason: 'chatStarting' }
+        }
+      },
+      createOperationId: () => 'unused'
+    })
+
+    const lastFailure = disposition.entries[0]?.lastFailure
+    expect(lastFailure).toEqual({
+      kind: 'refused',
+      code: 'agent_session_conflict',
+      details: { reason: 'chatStarting' }
+    })
+    expect(
+      agentSessionWriteNoticeEnglish(structuredAgentSessionAttemptFailureParts(lastFailure!))
+    ).toBe(
+      'The agent is still starting. Your message was not sent. Wait for the agent to finish starting.'
+    )
+  })
+
+  it("keeps a rejected message's typed fact without the provider's detail", () => {
+    const disposition = disposeStructuredAgentSessionSendResult({
+      entries: [entry],
+      entry,
+      blockedClientMessageId: null,
+      result: rejectedWith('An image on this message is empty, so the message was not sent.', {
+        rejection: {
+          kind: 'attachmentInvalid',
+          attachment: { reason: 'empty' },
+          detail: { text: 'image block 2: zero bytes', audience: 'log' }
+        }
+      }),
+      createOperationId: () => 'unused'
+    })
+
+    expect(disposition.entries[0]?.lastFailure).toEqual({
+      kind: 'rejected',
+      reason: 'An image on this message is empty, so the message was not sent.',
+      rejection: { kind: 'attachmentInvalid', attachment: { reason: 'empty' } }
+    })
+  })
+
+  it('keeps a failed request as a fact, not a transport error string', () => {
+    const disposition = disposeStructuredAgentSessionSendFailure({
+      entries: [entry],
+      entry,
+      blockedClientMessageId: null,
+      cause: new Error('socket hang up: ECONNRESET 10.0.0.2:443'),
+      isDeliveryUnknown: () => false
+    })
+
+    expect(disposition.error).toBeNull()
+    expect(disposition.entries[0]?.lastFailure).toEqual({ kind: 'failed' })
+  })
+
+  it('drops the reason once the same message is accepted', () => {
+    const refused: StructuredAgentSessionOutboxEntry = {
+      ...entry,
+      lastFailure: { kind: 'refused', code: 'agent_session_checkpoint_stale' }
+    }
+    const result = rejectedWith(null)
+    if (!result.ok) {
+      throw new Error('expected a send result')
+    }
+    result.value.submission = { ...result.value.submission, dispatchState: 'accepted' }
+    const disposition = disposeStructuredAgentSessionSendResult({
+      entries: [refused],
+      entry: refused,
+      blockedClientMessageId: null,
+      result,
+      createOperationId: () => 'unused'
+    })
+
+    expect(disposition.entries).toEqual([])
+    expect(disposition.error).toBeNull()
   })
 })
 
diff --git a/src/shared/structured-agent-session-send-disposition.ts b/src/shared/structured-agent-session-send-disposition.ts
index 16765a024714..7ffce942b6e6 100644
--- a/src/shared/structured-agent-session-send-disposition.ts
+++ b/src/shared/structured-agent-session-send-disposition.ts
@@ -7,19 +7,27 @@
 // the refs, the React state and the storage write, and nothing else decides an
 // entry's state.
 
+import type { AgentJournalSubmission } from './agent-session-journal-types'
 import type { AgentSessionMutationResult, AgentSessionSendResult } from './agent-session-wire'
 import {
-  dispatchRejectionReasonIsInternal,
-  dispatchRejectionWasTransportWriteFailure
-} from './structured-agent-session-dispatch-rejection'
+  agentSessionWriteNoticeEnglish,
+  agentSessionWriteNoticeParts,
+  agentSessionWriteNotDoneParts
+} from './agent-session-refusal-notice'
+import type { AgentSessionWriteNoticePart } from './agent-session-write-notice-copy'
+import { agentSessionRefusalFailure } from './agent-session-write-failure'
+import { classifyDispatchRejection } from './structured-agent-session-dispatch-rejection'
 import {
   classifyStructuredAgentSessionSendFailure,
   requeueStructuredAgentSessionSendRefusal,
+  structuredAgentSessionRejectedFailure,
+  type StructuredAgentSessionAttemptFailure,
   type StructuredAgentSessionOutboxEntry
 } from './structured-agent-session-outbox'
 
 export type StructuredAgentSessionSendDisposition = {
   entries: StructuredAgentSessionOutboxEntry[]
+  /** Only for an outcome with no entry left to carry it; a kept entry holds its own failure. */
   error: string | null
   /** The entry the queue is stuck on, or null when nothing blocks it. Always the
    *  next value, never "unchanged": the caller assigns it verbatim. */
@@ -36,13 +44,24 @@ type SendDispositionInput = {
 
 function replaceEntryState(
   input: SendDispositionInput,
-  state: StructuredAgentSessionOutboxEntry['state']
+  state: StructuredAgentSessionOutboxEntry['state'],
+  lastFailure?: StructuredAgentSessionAttemptFailure
 ): StructuredAgentSessionOutboxEntry[] {
   return input.entries.map((candidate) =>
-    candidate.clientMessageId === input.entry.clientMessageId ? { ...candidate, state } : candidate
+    candidate.clientMessageId === input.entry.clientMessageId
+      ? withLastFailure({ ...candidate, state }, lastFailure)
+      : candidate
   )
 }
 
+function withLastFailure(
+  entry: StructuredAgentSessionOutboxEntry,
+  lastFailure: StructuredAgentSessionAttemptFailure | undefined
+): StructuredAgentSessionOutboxEntry {
+  const { lastFailure: _previous, ...rest } = entry
+  return lastFailure === undefined ? rest : { ...rest, lastFailure }
+}
+
 function dropEntry(input: SendDispositionInput): StructuredAgentSessionOutboxEntry[] {
   return input.entries.filter(
     (candidate) => candidate.clientMessageId !== input.entry.clientMessageId
@@ -72,6 +91,18 @@ function refusedRedelivery(
   )
 }
 
+/** Whether the journal already answers a send still in flight, so its own reply adds nothing: the
+ *  host holds the message, or rejected it — a later `pending` reply must not undo that. */
+export function journalAnswersInFlightSend(
+  submissions: readonly AgentJournalSubmission[],
+  clientMessageId: string | null
+): boolean {
+  return submissions.some(
+    (submission) =>
+      submission.clientMessageId === clientMessageId && submission.dispatchState !== 'unknown'
+  )
+}
+
 /**
  * What to put on screen for a rejection.
  *
@@ -80,27 +111,45 @@ function refusedRedelivery(
  * a generic string would throw it away. A transport rejection's reason is an
  * internal marker; printing it put `provider_write_failed: broken pipe` in front of
  * users, which names nothing they can act on. That case gets copy that says what
- * happened and that the message is safe to send again — which it is, because the
- * frame provably never left, so a resend cannot duplicate.
+ * happened, and on the phone that the message can be sent again — which it can,
+ * because the frame provably never left, so a resend cannot duplicate.
  *
- * The null default claims no cause, because at that point we know none: all it
- * asserts is the one thing every rejection shares.
+ * The null default claims no cause and no next step, because at that point we know
+ * neither: all it asserts is the one thing every rejection shares.
  *
  * Exported because a client without an outbox needs the same copy: the rule about
  * which reasons a person may read is a property of the reason, not of the queue.
  */
-export function structuredAgentSessionRejectionNotice(reason: string | null): string {
+export function structuredAgentSessionRejectionNotice(
+  reason: string | null,
+  write: 'send' | 'composer-send'
+): string {
+  return agentSessionWriteNoticeEnglish(structuredAgentSessionRejectionParts(reason, write))
+}
+
+export function structuredAgentSessionRejectionParts(
+  reason: string | null,
+  write: 'send' | 'composer-send'
+): AgentSessionWriteNoticePart[] {
   if (reason === null) {
-    return 'Message was not sent.'
+    return ['notDoneSend']
   }
-  if (dispatchRejectionWasTransportWriteFailure(reason)) {
-    return "Couldn't reach the agent. Your message was not sent — Retry to send it again."
+  const rejection = classifyDispatchRejection({ reason })
+  if (rejection.kind === 'writeFailed') {
+    return ['unreachable', ...agentSessionWriteNotDoneParts(write)]
   }
-  // Any other reason we minted is an internal cause with no user-facing meaning;
-  // only a provider's own explanation is worth reading verbatim.
-  return dispatchRejectionReasonIsInternal(reason)
-    ? 'Orca could not send your message — Retry to send it again.'
-    : reason
+  // A legacy marker is an internal cause with no user-facing meaning; any other reason is a
+  // sentence written to be read — the provider's, or the host's own.
+  return rejection.kind ? agentSessionWriteNotDoneParts(write) : [{ text: reason }]
+}
+
+/** What the Retry row says about why its message did not go through. */
+export function structuredAgentSessionAttemptFailureParts(
+  failure: StructuredAgentSessionAttemptFailure
+): AgentSessionWriteNoticePart[] {
+  return failure.kind === 'rejected'
+    ? structuredAgentSessionRejectionParts(failure.reason, 'send')
+    : agentSessionWriteNoticeParts(failure, 'send')
 }
 
 export function disposeStructuredAgentSessionSendResult(
@@ -114,22 +163,31 @@ export function disposeStructuredAgentSessionSendResult(
     const refusedIndex = input.entries.findIndex(
       (candidate) => candidate.clientMessageId === input.entry.clientMessageId
     )
+    const refusal = agentSessionRefusalFailure(result.refusal)
     const entries = input.entries.map((candidate) =>
       candidate.clientMessageId === input.entry.clientMessageId
-        ? requeueStructuredAgentSessionSendRefusal(
-            candidate,
-            result.refusal.code,
-            input.createOperationId,
-            input.entry.lastAttemptAt !== null
+        ? withLastFailure(
+            requeueStructuredAgentSessionSendRefusal(
+              candidate,
+              refusal,
+              input.createOperationId,
+              input.entry.lastAttemptAt !== null
+            ),
+            refusal
           )
         : candidate
     )
+    const refused = entries[refusedIndex]
     return {
       entries,
-      error: result.refusal.message,
+      error: null,
       // Read back by index rather than from the input: a refusal can rotate the id, and the
       // refused entry is not always the head now that an admitted one no longer holds the queue.
-      blockedClientMessageId: entries[refusedIndex]?.clientMessageId ?? null,
+      // A rejected one holds nothing: it can no longer land, and it keeps its own Retry.
+      blockedClientMessageId:
+        !refused || refused.state === 'rejected'
+          ? input.blockedClientMessageId
+          : refused.clientMessageId,
       retryWithFreshClientMessageId: null
     }
   }
@@ -150,11 +208,28 @@ export function disposeStructuredAgentSessionSendResult(
       retryWithFreshClientMessageId: null
     }
   }
+  // A Stop's withdrawal failed nothing, first reply or replay: the entry leaves as the reconcile
+  // drops it, with no notice.
+  if (
+    submission.dispatchState === 'rejected' &&
+    classifyDispatchRejection(submission).category === 'withdrawn'
+  ) {
+    return {
+      entries: dropEntry(input),
+      error: null,
+      blockedClientMessageId: input.blockedClientMessageId,
+      retryWithFreshClientMessageId: null
+    }
+  }
   if (submission.dispatchState === 'rejected') {
     return {
-      entries: replaceEntryState(input, 'queued'),
-      error: structuredAgentSessionRejectionNotice(submission.reason),
-      blockedClientMessageId: input.entry.clientMessageId,
+      entries: replaceEntryState(
+        input,
+        'rejected',
+        structuredAgentSessionRejectedFailure(submission)
+      ),
+      error: null,
+      blockedClientMessageId: input.blockedClientMessageId,
       retryWithFreshClientMessageId: input.entry.clientMessageId
     }
   }
@@ -196,8 +271,11 @@ export function disposeStructuredAgentSessionSendFailure(
   const failure = classifyStructuredAgentSessionSendFailure(input.cause, input.isDeliveryUnknown)
   const deliveryUnknown = failure === 'delivery-unknown'
   return {
-    entries: replaceEntryState(input, deliveryUnknown ? 'unconfirmed' : 'queued'),
-    error: deliveryUnknown ? 'Message delivery is unconfirmed' : String(input.cause),
+    // An unconfirmed entry's Retry row already says delivery is unconfirmed.
+    entries: deliveryUnknown
+      ? replaceEntryState(input, 'unconfirmed')
+      : replaceEntryState(input, 'queued', { kind: 'failed' }),
+    error: null,
     blockedClientMessageId: deliveryUnknown
       ? input.blockedClientMessageId
       : input.entry.clientMessageId,
diff --git a/src/shared/structured-agent-session-status-block.ts b/src/shared/structured-agent-session-status-block.ts
new file mode 100644
index 000000000000..58dbbe9131c9
--- /dev/null
+++ b/src/shared/structured-agent-session-status-block.ts
@@ -0,0 +1,18 @@
+import { readAgentSessionFailureFact } from './agent-session-failure'
+import type { AgentJournalStatusItem } from './agent-session-journal-types'
+import type { NativeChatTextBlock } from './native-chat-types'
+
+/** A status row as the line a chat paints: named fields only, so a host-only key never leaks. */
+export function structuredAgentSessionStatusBlock(
+  body: AgentJournalStatusItem
+): NativeChatTextBlock {
+  const failure = readAgentSessionFailureFact(body.failure)
+  return {
+    type: 'text',
+    text: body.text,
+    ...(body.presentation !== undefined ? { presentation: body.presentation } : {}),
+    ...(body.tone !== undefined ? { tone: body.tone } : {}),
+    ...(body.providerFrame ? { providerFrame: body.providerFrame } : {}),
+    ...(failure ? { failure } : {})
+  }
+}
diff --git a/src/shared/structured-agent-session-status-started-at.ts b/src/shared/structured-agent-session-status-started-at.ts
index 54f5b44764fd..6588e82026b4 100644
--- a/src/shared/structured-agent-session-status-started-at.ts
+++ b/src/shared/structured-agent-session-status-started-at.ts
@@ -10,6 +10,7 @@ import type { AgentJournalRenderItem, AgentJournalSubmission } from './agent-ses
 import { isRootAgentJournalItem } from './agent-session-journal-producer'
 import { readAgentJournalTurn } from './agent-session-turn-record'
 import type { StructuredAgentSessionProjectedStatus } from './structured-agent-session-projection'
+import type { StructuredAgentSessionLatestRequest } from './structured-agent-session-latest-request'
 import type { AgentSessionStatusSummary } from './agent-session-wire'
 import type { AgentMainAgentStatus } from './main-agent-status'
 import type { AgentStatusState } from './agent-status-types'
@@ -20,20 +21,18 @@ export function structuredAgentSessionStatusStartedAt(
   status: StructuredAgentSessionProjectedStatus,
   items: readonly AgentJournalRenderItem[],
   submissions: readonly AgentJournalSubmission[],
-  currentFence?: number | null
+  currentFence: number | null | undefined,
+  latestRequest: Pick<StructuredAgentSessionLatestRequest, 'settledAt'> | null
 ): number | undefined {
   if (status === 'attention') {
     return oldestPendingPromptAt(items)
   }
-  const turnItem = newestTurnItem(items)
-  const turn = readAgentJournalTurn(turnItem?.body)
   if (status === 'idle') {
-    if (!turnItem || !turn || turn.state === 'running') {
-      return undefined
-    }
-    // A turn recovery settled ended when that settle was written: when the user learns it stopped.
-    return turnItem.recoveredAt ?? turn.completedAt
+    // The session went idle when the request it reports settled, not when its newest turn did.
+    return latestRequest?.settledAt
   }
+  const turnItem = newestTurnItem(items)
+  const turn = readAgentJournalTurn(turnItem?.body)
   if (turnItem && turn?.state === 'running') {
     // A mid-turn send joins the running turn; it does not restart the stretch.
     return turn.requestedAt ?? turn.startedAt ?? turnItem.observedAt
diff --git a/src/shared/structured-agent-session-unanswered-dispatch.ts b/src/shared/structured-agent-session-unanswered-dispatch.ts
index 36c70a357cb7..2ac7aa129887 100644
--- a/src/shared/structured-agent-session-unanswered-dispatch.ts
+++ b/src/shared/structured-agent-session-unanswered-dispatch.ts
@@ -1,4 +1,5 @@
 import type { AgentJournalSubmission } from './agent-session-journal-types'
+import { isQueuedAgentJournalSubmission } from './agent-session-queued-submission'
 
 /** One send the provider has neither opened a turn for nor refused; the rule is explained on
  *  `hasUnansweredStructuredAgentSessionDispatch`, which asks it of every send. */
@@ -6,6 +7,10 @@ export function isUnansweredStructuredAgentSessionDispatch(
   submission: AgentJournalSubmission,
   currentFence?: number | null
 ): boolean {
+  if (isQueuedAgentJournalSubmission(submission)) {
+    // Accepted and still owed to whichever child the host starts next, whatever the fence.
+    return true
+  }
   return (
     (currentFence == null || submission.fence >= currentFence) &&
     (submission.dispatchState === 'pending' ||
@@ -15,3 +20,24 @@ export function isUnansweredStructuredAgentSessionDispatch(
         submission.reason !== 'host_restarted_before_acknowledgement'))
   )
 }
+
+/**
+ * A send the host has journaled that the provider has neither opened a turn for nor refused.
+ *
+ * Codex declares `turn/started` within ~150ms, but Claude's running row can only be written once
+ * the SDK echoes the user message back — a 3.4s median and 18s at p90 on real journals. Waiting
+ * on that echo to call a session working leaves the whole gap reading idle in the chat and in
+ * every session list, so the send itself is the evidence.
+ *
+ * A live `unknown` still counts because an ambiguous adapter reply does not prove the provider
+ * stopped. A recovered `unknown` does not — it outlived the host generation that sent it, so
+ * there is nothing still running to report.
+ */
+export function hasUnansweredStructuredAgentSessionDispatch(
+  submissions: readonly AgentJournalSubmission[],
+  currentFence?: number | null
+): boolean {
+  return submissions.some((submission) =>
+    isUnansweredStructuredAgentSessionDispatch(submission, currentFence)
+  )
+}
diff --git a/src/shared/telemetry-agent-token-usage-schema.ts b/src/shared/telemetry-agent-token-usage-schema.ts
new file mode 100644
index 000000000000..18a3d4a08d5b
--- /dev/null
+++ b/src/shared/telemetry-agent-token-usage-schema.ts
@@ -0,0 +1,23 @@
+import { z } from 'zod'
+
+const tokenCount = z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER)
+
+export const agentTokenCountsSchema = z
+  .object({
+    input_tokens: tokenCount,
+    output_tokens: tokenCount,
+    cached_input_tokens: tokenCount,
+    cache_write_input_tokens: tokenCount
+  })
+  .strict()
+
+export const agentTokenUsageSchema = agentTokenCountsSchema
+  .extend({
+    provider: z.enum(['claude', 'codex', 'opencode']),
+    analytics_session_id: z.uuidv4(),
+    revision: z.number().int().positive().max(Number.MAX_SAFE_INTEGER)
+  })
+  .strict()
+
+export type AgentTokenCounts = z.infer<typeof agentTokenCountsSchema>
+export type AgentTokenUsage = z.infer<typeof agentTokenUsageSchema>
diff --git a/src/shared/telemetry-daemon-event-schemas.ts b/src/shared/telemetry-daemon-event-schemas.ts
index 26762e5a52e1..9632e75bd05b 100644
--- a/src/shared/telemetry-daemon-event-schemas.ts
+++ b/src/shared/telemetry-daemon-event-schemas.ts
@@ -201,6 +201,19 @@ export const settingsChangedSchema = z
   })
   .strict()
 
+// Why: profile-state cutover needs fleet-level evidence that authority selection and migration
+// agree with the rollout plan. Keep this enum-only: paths, profile IDs, and serialized state never
+// belong in telemetry.
+export const profileStateAuthoritySelectedSchema = z
+  .object({
+    backend: z.enum(['json', 'sqlite']),
+    classification: z.enum(['neither', 'json-only', 'sqlite-only', 'both']),
+    authority_mode: z.enum(['legacy', 'sqlite-candidate', 'sqlite-established']),
+    runtime: z.enum(['desktop', 'orcad']),
+    migrated: z.boolean()
+  })
+  .strict()
+
 // Managed-hook installer label from `AGENT_HOOK_TARGETS`, distinct from `AGENT_KIND_VALUES`; `claude` (not `claude-code`) is intentional.
 export const hookInstallAgentSchema = z.enum(AGENT_HOOK_TARGETS)
 export type HookInstallAgent = z.infer<typeof hookInstallAgentSchema>
diff --git a/src/shared/telemetry-event-registry.ts b/src/shared/telemetry-event-registry.ts
index 810ba8b35d13..f24e60eccd23 100644
--- a/src/shared/telemetry-event-registry.ts
+++ b/src/shared/telemetry-event-registry.ts
@@ -1,3 +1,4 @@
+import { agentTokenUsageSchema } from './telemetry-agent-token-usage-schema'
 import {
   agentErrorSchema,
   agentPromptSentSchema,
@@ -21,6 +22,7 @@ import {
   daemonPtyCwdVerdictSchema,
   daemonStartFailedSchema,
   mainThreadHangDetectedSchema,
+  profileStateAuthoritySelectedSchema,
   remoteOutboundBudgetCloseSchema,
   runtimeRpcStartFailedSchema,
   settingsChangedSchema
@@ -115,6 +117,7 @@ export const eventSchemas = {
   setup_script_prompt_shown: setupScriptPromptShownSchema,
   setup_script_prompt_action: setupScriptPromptActionSchema,
 
+  agent_token_usage: agentTokenUsageSchema,
   agent_started: agentStartedSchema,
   agent_prompt_sent: agentPromptSentSchema,
   agent_error: agentErrorSchema,
@@ -132,6 +135,7 @@ export const eventSchemas = {
   daemon_audit_eligibility: daemonAuditEligibilitySchema,
   runtime_rpc_start_failed: runtimeRpcStartFailedSchema,
   remote_outbound_budget_close: remoteOutboundBudgetCloseSchema,
+  profile_state_authority_selected: profileStateAuthoritySelectedSchema,
 
   codex_trust_grant: codexTrustGrantSchema,
 
diff --git a/src/shared/telemetry-events.ts b/src/shared/telemetry-events.ts
index c2cf9036dc0b..d1bec760ecd2 100644
--- a/src/shared/telemetry-events.ts
+++ b/src/shared/telemetry-events.ts
@@ -49,6 +49,7 @@ export {
 } from './telemetry-app-event-schemas'
 export {
   hookInstallAgentSchema,
+  profileStateAuthoritySelectedSchema,
   runtimeRpcStartErrorClassSchema
 } from './telemetry-daemon-event-schemas'
 export type { HookInstallAgent, RuntimeRpcStartErrorClass } from './telemetry-daemon-event-schemas'
diff --git a/src/shared/telemetry-property-schemas.ts b/src/shared/telemetry-property-schemas.ts
index 903af48e959c..cee76b677d64 100644
--- a/src/shared/telemetry-property-schemas.ts
+++ b/src/shared/telemetry-property-schemas.ts
@@ -19,6 +19,7 @@ export const AGENT_KIND_VALUES = [
   'pi',
   'omp',
   'prime-agent',
+  'qoder',
   'gemini',
   'antigravity',
   'aider',
@@ -30,6 +31,7 @@ export const AGENT_KIND_VALUES = [
   'aug',
   'cline',
   'codebuff',
+  'freebuff',
   'command-code',
   'continue',
   'cursor',
@@ -46,6 +48,7 @@ export const AGENT_KIND_VALUES = [
   'ante',
   'trae',
   'muse',
+  'dsh',
   'zcode',
   'other'
 ] as const
diff --git a/src/shared/terminal-input-kind.ts b/src/shared/terminal-input-kind.ts
new file mode 100644
index 000000000000..f9cef0e2a187
--- /dev/null
+++ b/src/shared/terminal-input-kind.ts
@@ -0,0 +1,8 @@
+/**
+ * Why bytes are written to a PTY. Every host write entry point takes one, so no producer inherits
+ * a transport's default.
+ * - `driving`: input that drives the run, from a person or any client, driver or agent acting on it.
+ * - `launch`: bytes Orca writes to start the run: startup commands, a create-time draft or prompt.
+ * - `query-reply`: the terminal's automatic answer to a query the running program made.
+ */
+export type TerminalInputKind = 'driving' | 'launch' | 'query-reply'
diff --git a/src/shared/terminal-kitty-keyboard-mode-tracker.test.ts b/src/shared/terminal-kitty-keyboard-mode-tracker.test.ts
index d3c6334c921a..91fab874a78b 100644
--- a/src/shared/terminal-kitty-keyboard-mode-tracker.test.ts
+++ b/src/shared/terminal-kitty-keyboard-mode-tracker.test.ts
@@ -1,5 +1,7 @@
+import { Terminal } from '@xterm/headless'
 import { describe, expect, it } from 'vitest'
 import { TerminalKittyKeyboardModeTracker } from './terminal-kitty-keyboard-mode-tracker'
+import { POST_REPLAY_REATTACH_RESET } from './terminal-mode-reset-profiles'
 
 describe('TerminalKittyKeyboardModeTracker', () => {
   it('starts inactive and ignores non-kitty sequences', () => {
@@ -68,6 +70,33 @@ describe('TerminalKittyKeyboardModeTracker', () => {
     expect(tracker.flags).toBe(0)
   })
 
+  // Why: a confirmed-shell reset lands between live chunks in both records, so they must agree.
+  it('agrees with xterm when the reattach reset interrupts a split live sequence', async () => {
+    const term = new Terminal({ allowProposedApi: true, vtExtensions: { kittyKeyboard: true } })
+    const tracker = new TerminalKittyKeyboardModeTracker()
+    const replies: string[] = []
+    term.onData((data) => replies.push(data))
+    const feed = (data: string): Promise<void> => {
+      tracker.scan(data)
+      return new Promise((resolve) => term.write(data, resolve))
+    }
+    const xtermReport = async (): Promise<string> => {
+      replies.length = 0
+      await new Promise<void>((resolve) => term.write('\x1b[?u', resolve))
+      return replies.join('')
+    }
+
+    await feed('\x1b[>5u\x1b[?1049h\x1b[>3u\x1b[>')
+    await feed(POST_REPLAY_REATTACH_RESET)
+    await feed('1u')
+    expect(tracker.flags).toBe(0)
+    expect(await xtermReport()).toBe('\x1b[?0u')
+    await feed('\x1b[?1049l')
+    expect(tracker.flags).toBe(5)
+    expect(await xtermReport()).toBe('\x1b[?5u')
+    term.dispose()
+  })
+
   it('keeps per-screen flags across alternate-screen switches', () => {
     const tracker = new TerminalKittyKeyboardModeTracker()
     tracker.scan('\x1b[>1u')
diff --git a/src/shared/terminal-kitty-keyboard-mode-tracker.ts b/src/shared/terminal-kitty-keyboard-mode-tracker.ts
index 032fc4ec991d..880d1fb5cf70 100644
--- a/src/shared/terminal-kitty-keyboard-mode-tracker.ts
+++ b/src/shared/terminal-kitty-keyboard-mode-tracker.ts
@@ -22,11 +22,12 @@ type KittyStackFrame = { flags: number; known: boolean }
  * Why a mirror instead of reading xterm's internal state: Orca defensively
  * wipes the renderer terminal's kitty flags at moments when the TUI may have
  * died (Ctrl+C interrupts, reattach resets) while the TUI is usually still
- * alive and expecting protocol-encoded input. This tracker is fed only by
- * application output, so it reflects what the *application* negotiated,
- * independent of renderer-side defensive writes. The daemon reuses it to
- * carry flags into snapshots (xterm's SerializeAddon does not serialize kitty
- * state).
+ * alive and expecting protocol-encoded input. This tracker is fed by
+ * application output, snapshot restores, and the Orca resets that also reach
+ * xterm (ConPTY agent-idle, confirmed shell), never by the renderer's other
+ * defensive xterm writes, so it reflects what the live application negotiated.
+ * The daemon reuses it to carry flags into snapshots (xterm's SerializeAddon does
+ * not serialize kitty state).
  */
 export class TerminalKittyKeyboardModeTracker {
   private scanTail = ''
diff --git a/src/shared/terminal-render-desync-evidence.ts b/src/shared/terminal-render-desync-evidence.ts
index 1621626e187a..cc0e292983ac 100644
--- a/src/shared/terminal-render-desync-evidence.ts
+++ b/src/shared/terminal-render-desync-evidence.ts
@@ -1,3 +1,7 @@
+/** The capture id becomes a directory name under userData, so main validates it before
+ *  use. Both sides import this so the renderer cannot mint an id main will reject. */
+export const TERMINAL_RENDER_DESYNC_CAPTURE_ID_PATTERN = /^[a-zA-Z0-9_-]{1,120}$/
+
 export type TerminalRenderDesyncEvidencePhase = 'corrupt' | 'healed'
 
 export type WriteTerminalRenderDesyncEvidenceArgs = {
diff --git a/src/shared/terminal-spawn-error-copy.ts b/src/shared/terminal-spawn-error-copy.ts
new file mode 100644
index 000000000000..872c3c76b64c
--- /dev/null
+++ b/src/shared/terminal-spawn-error-copy.ts
@@ -0,0 +1,25 @@
+// Host-published English copy; the renderer matches it to show a translation (#9194).
+export const PTY_ALLOCATION_HINT =
+  'Your system cannot allocate any more pty devices. Close some terminals you are not using, in Orca or another program, then try again.'
+
+export const TERMINAL_PROCESS_LIMIT_HINT =
+  'Your system cannot start another terminal process. Close unused terminals or quit unused processes, then try again.'
+
+// Older hosts still publish these multi-line forms.
+export const LEGACY_PTY_ALLOCATION_HINT = [
+  'Your system cannot allocate any more pty devices.',
+  '',
+  'Orca requires a pty device to launch a new terminal. This error is usually due to having too many terminal windows or terminal sessions open, either in Orca or another program.',
+  '',
+  'Free up some pty devices and try again.'
+].join('\n')
+
+export const LEGACY_TERMINAL_PROCESS_LIMIT_HINT = [
+  'Your system cannot start another terminal process.',
+  '',
+  'This is usually due to having too many terminal sessions or other processes running.',
+  '',
+  'Close unused terminals or quit unused processes and try again.'
+].join('\n')
+
+export const TERMINAL_SPAWN_ISSUE_REQUEST = 'If this persists, please file an issue.'
diff --git a/src/shared/terminal-surface-close-target.test.ts b/src/shared/terminal-surface-close-target.test.ts
new file mode 100644
index 000000000000..54613ca879ba
--- /dev/null
+++ b/src/shared/terminal-surface-close-target.test.ts
@@ -0,0 +1,28 @@
+import { describe, expect, it } from 'vitest'
+import { parseTerminalSurfaceCloseTarget } from './terminal-surface-close-target'
+
+describe('parseTerminalSurfaceCloseTarget', () => {
+  it('keeps a well-formed tab or pane target', () => {
+    expect(parseTerminalSurfaceCloseTarget({ kind: 'tab', tabId: 't', leafId: 'x' })).toEqual({
+      kind: 'tab',
+      tabId: 't'
+    })
+    expect(parseTerminalSurfaceCloseTarget({ kind: 'pane', tabId: 't', leafId: 'l' })).toEqual({
+      kind: 'pane',
+      tabId: 't',
+      leafId: 'l'
+    })
+  })
+
+  it.each([
+    null,
+    'tab',
+    { tabId: 't' },
+    { kind: 'tab', tabId: '' },
+    { kind: 'pane', tabId: 't' },
+    { kind: 'pane', tabId: 't', leafId: '' },
+    { kind: 'leaf', tabId: 't', leafId: 'l' }
+  ])('rejects %j', (value) => {
+    expect(parseTerminalSurfaceCloseTarget(value)).toBeNull()
+  })
+})
diff --git a/src/shared/terminal-surface-close-target.ts b/src/shared/terminal-surface-close-target.ts
new file mode 100644
index 000000000000..d2b4d5fa6d2c
--- /dev/null
+++ b/src/shared/terminal-surface-close-target.ts
@@ -0,0 +1,28 @@
+/** What an explicit terminal close removes. A pane close never stands in for its tab. */
+export type TerminalSurfaceCloseTarget =
+  | { kind: 'tab'; tabId: string }
+  | { kind: 'pane'; tabId: string; leafId: string }
+
+export type TerminalPaneCloseTarget = Extract<TerminalSurfaceCloseTarget, { kind: 'pane' }>
+
+function isNonEmptyString(value: unknown): value is string {
+  return typeof value === 'string' && value.length > 0
+}
+
+/** Validates a close target that crossed a process boundary; anything malformed is rejected. */
+export function parseTerminalSurfaceCloseTarget(value: unknown): TerminalSurfaceCloseTarget | null {
+  if (typeof value !== 'object' || value === null || !('kind' in value) || !('tabId' in value)) {
+    return null
+  }
+  const { kind, tabId } = value
+  if (!isNonEmptyString(tabId)) {
+    return null
+  }
+  if (kind === 'tab') {
+    return { kind, tabId }
+  }
+  if (kind !== 'pane' || !('leafId' in value) || !isNonEmptyString(value.leafId)) {
+    return null
+  }
+  return { kind, tabId, leafId: value.leafId }
+}
diff --git a/src/shared/terminal-tab-types.ts b/src/shared/terminal-tab-types.ts
index d99472e2fde3..9f7d9428b0a3 100644
--- a/src/shared/terminal-tab-types.ts
+++ b/src/shared/terminal-tab-types.ts
@@ -132,6 +132,8 @@ export type TerminalLayoutSnapshot = {
   root: TerminalPaneLayoutNode | null
   activeLeafId: string | null
   expandedLeafId: string | null
+  /** Stable leaf that owns the terminal tab's native chat surface. */
+  chatLeafId?: string
   /** Live PTY IDs per leaf for in-session remounts such as tab-group moves.
    *  Not used for app restart because PTYs are transient processes. */
   ptyIdsByLeafId?: Record<string, string>
diff --git a/src/shared/terminal-title-agent-type.ts b/src/shared/terminal-title-agent-type.ts
index 8e8f8b124055..045b0aeceece 100644
--- a/src/shared/terminal-title-agent-type.ts
+++ b/src/shared/terminal-title-agent-type.ts
@@ -1,10 +1,17 @@
+import { isQoderTerminalTitle } from './qoder-terminal-title'
 import {
   AGY_AGENT_NAME_RE,
   DROID_AGENT_NAME_RE,
   HERMES_AGENT_NAME_RE,
   titleHasAgentName
 } from './agent-name-token-match'
-import { containsAgentSpinnerGlyph, isCursorAgentTitle } from './agent-title-core'
+import {
+  containsAgentSpinnerGlyph,
+  isCursorAgentTitle,
+  isDshTerminalTitle
+} from './agent-title-core'
+
+export { DSH_WHALE, isDshTerminalTitle } from './agent-title-core'
 import { isOpenCodeNativeTitle } from './opencode-terminal-title'
 import {
   getPiCompatibleSyntheticAgentLabel,
@@ -34,6 +41,14 @@ export function containsBrailleSpinner(title: string): boolean {
 }
 
 export function isGeminiTerminalTitle(title: string): boolean {
+  // Why: DSH-TUI's idle prefix is `✦`, Gemini's working glyph. The whale is decisive
+  // and is checked first so a resting DSH pane never reads as a working Gemini.
+  if (isQoderTerminalTitle(title)) {
+    return false
+  }
+  if (isDshTerminalTitle(title)) {
+    return false
+  }
   // Why: Gemini OSC glyphs are stronger evidence than any cwd/session text.
   if (
     title.includes(GEMINI_PERMISSION) ||
@@ -90,6 +105,11 @@ function computeIsClaudeAgent(title: string): boolean {
   if (!title || isClaudeManagementTitle(title) || isOpenCodeNativeTitle(title)) {
     return false
   }
+  // Why: DSH's working title is `⠂ 🐋 …`/`⠐ 🐋 …`, and the braille branch below would
+  // otherwise claim every frame of it for Claude.
+  if (isDshTerminalTitle(title)) {
+    return false
+  }
   const lower = title.toLowerCase()
 
   // Why: Claude Code titles are prefixed with status indicators (✳, ". ", "* ",
@@ -150,6 +170,13 @@ function computeAgentLabel(title: string): string | null {
   ) {
     return 'Claude Code'
   }
+  // Why before Gemini: see isDshTerminalTitle — the two share the `✦` glyph.
+  if (isDshTerminalTitle(title)) {
+    return 'DeepSeek Harness'
+  }
+  if (isQoderTerminalTitle(title)) {
+    return 'Qoder CLI'
+  }
   if (isGeminiTerminalTitle(title)) {
     return 'Gemini CLI'
   }
@@ -226,9 +253,11 @@ export const getAgentLabel: (title: string) => string | null =
   memoizeTitleClassification(computeAgentLabel)
 
 const TITLE_LABEL_TO_AGENT: Partial<Record<string, TuiAgent>> = {
+  'DeepSeek Harness': 'dsh',
   'Claude Code': 'claude',
   OpenClaude: 'openclaude',
   Codex: 'codex',
+  'Qoder CLI': 'qoder',
   'Gemini CLI': 'gemini',
   'GitHub Copilot': 'copilot',
   Grok: 'grok',
diff --git a/src/shared/text-search-glob-patterns.test.ts b/src/shared/text-search-glob-patterns.test.ts
new file mode 100644
index 000000000000..0bd96723a9d1
--- /dev/null
+++ b/src/shared/text-search-glob-patterns.test.ts
@@ -0,0 +1,205 @@
+import { afterAll, beforeAll, describe, expect, it } from 'vitest'
+import { mkdtemp, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { runProcess } from './child-process/run-process'
+import { splitSearchGlobPatterns } from './text-search-glob-patterns'
+import {
+  buildGitGrepArgs,
+  buildRgArgs,
+  createAccumulator,
+  finalize,
+  ingestRgJsonLine
+} from './text-search'
+
+describe('compound search globs', () => {
+  it.each([
+    ['', []],
+    [' , *.ts,, *.md, ', ['*.ts', '*.md']],
+    ['}.ts, *.md', ['}.ts', '*.md']],
+    ['*.{ts,tsx}, *.md', ['*.{ts,tsx}', '*.md']],
+    ['{src,{lib,test}}/**, *.md', ['{src,{lib,test}}/**', '*.md']],
+    ['*[a,b].ts, *.md', ['*[a,b].ts', '*.md']],
+    ['[{},].ts, *.md', ['[{},].ts', '*.md']],
+    ['[]a,b].ts, *.md', ['[]a,b].ts', '*.md']],
+    ['[!]a,b].ts, *.md', ['[!]a,b].ts', '*.md']],
+    ['[^]a,b].ts, *.md', ['[^]a,b].ts', '*.md']],
+    ['[[:alpha:],].ts, *.md', ['[[:alpha:],].ts', '*.md']],
+    ['[a\\],b].ts, *.md', ['[a\\],b].ts', '*.md']],
+    ['foo\\,bar/**, *.ts', ['foo\\,bar/**', '*.ts']],
+    ['\\{a,b\\}, *.ts', ['\\{a', 'b\\}', '*.ts']],
+    ['\\[a,b\\], *.ts', ['\\[a', 'b\\]', '*.ts']],
+    ['src\\', ['src\\']],
+    ['*.{ts,tsx', ['*.{ts,tsx']],
+    ['[a,b', ['[a,b']]
+  ])('preserves grouped and escaped commas in %s', (input, expected) => {
+    expect(splitSearchGlobPatterns(input, 'git')).toEqual(expected)
+  })
+
+  it('scans deeply nested groups without recursion or expanding alternatives', () => {
+    const pattern = `${'{'.repeat(20_000)}a,b${'}'.repeat(20_000)}`
+    expect(splitSearchGlobPatterns(`${pattern}, *.md`)).toEqual([pattern, '*.md'])
+  })
+})
+
+describe('file search with real search engines', () => {
+  let root: string
+
+  beforeAll(async () => {
+    root = await mkdtemp(join(tmpdir(), 'orca-search-globs-'))
+    for (const file of ['a.ts', 'b.tsx', 'c.md', ',.ts']) {
+      await writeFile(join(root, file), 'needle\n')
+    }
+    const initialized = await runProcess({ program: 'git', args: ['init'], cwd: root })
+    expect(initialized.code).toBe(0)
+  })
+
+  afterAll(async () => {
+    if (root) {
+      await rm(root, { recursive: true, force: true })
+    }
+  })
+
+  it.each([
+    [{ includePattern: '*.{ts,tsx}' }, [',.ts', 'a.ts', 'b.tsx']],
+    [{ includePattern: '[a,b].ts, *.md' }, [',.ts', 'a.ts', 'c.md']],
+    [{ excludePattern: '*.{ts,tsx}' }, ['c.md']],
+    [{ includePattern: '[]a,b].ts, *.md' }, [',.ts', 'a.ts', 'c.md']],
+    [{ excludePattern: '[a,b].ts' }, ['b.tsx', 'c.md']],
+    [{ includePattern: '*.ts, *.tsx', excludePattern: '[a,b].ts' }, ['b.tsx']]
+  ])('matches files with ripgrep using %j', async (options, expected) => {
+    const { rgPath } = await import('@vscode/ripgrep-universal')
+    const result = await runProcess({
+      program: rgPath,
+      args: buildRgArgs('needle', root, options),
+      cwd: root
+    })
+    expect(result.stderr).toBe('')
+    expect(result.code).toBe(0)
+    const accumulator = createAccumulator()
+    for (const line of result.stdout.split('\n')) {
+      ingestRgJsonLine(line, root, accumulator, 100)
+    }
+    expect(
+      finalize(accumulator)
+        .files.map((file) => file.relativePath)
+        .sort()
+    ).toEqual(expected)
+  })
+
+  it.each(['*.{ts,tsx', '[a,b'])('leaves invalid %s for ripgrep to reject', async (pattern) => {
+    const { rgPath } = await import('@vscode/ripgrep-universal')
+    for (const options of [{ includePattern: pattern }, { excludePattern: pattern }]) {
+      const result = await runProcess({
+        program: rgPath,
+        args: buildRgArgs('needle', root, options),
+        cwd: root
+      })
+      expect(result.code).toBe(2)
+      expect(result.stderr).toContain('error parsing glob')
+      expect(result.stderr).toContain(pattern)
+    }
+  })
+
+  it('keeps Git brace syntax literal instead of expanding it', async () => {
+    const result = await runProcess({
+      program: 'git',
+      args: buildGitGrepArgs('needle', { includePattern: '*.{ts,tsx}' }),
+      cwd: root
+    })
+    expect(result.code).toBe(1)
+    expect(result.stdout).toBe('')
+    expect(result.stderr).toBe('')
+  })
+
+  it('preserves character classes in Git exclusions', async () => {
+    const result = await runProcess({
+      program: 'git',
+      args: buildGitGrepArgs('needle', { excludePattern: '[[:alpha:],].ts' }),
+      cwd: root
+    })
+    expect(result.code).toBe(0)
+    expect(result.stdout).toContain('b.tsx\0')
+    expect(result.stdout).toContain('c.md\0')
+    expect(result.stdout).not.toContain('a.ts\0')
+    expect(result.stdout).not.toContain(',.ts\0')
+  })
+
+  it.each(['[a,b].ts', '[[:alpha:],].ts'])(
+    'preserves %s in the Git fallback too',
+    async (includePattern) => {
+      const result = await runProcess({
+        program: 'git',
+        args: buildGitGrepArgs('needle', { includePattern }),
+        cwd: root
+      })
+      expect(result.code).toBe(0)
+      expect(result.stdout).toContain('a.ts\0')
+      expect(result.stdout).toContain(',.ts\0')
+      expect(result.stdout).not.toContain('b.tsx\0')
+      expect(result.stdout).not.toContain('c.md\0')
+    }
+  )
+})
+
+describe('engine-specific character classes', () => {
+  let root: string
+  const files = [',.ts', '[.ts', '].ts', 'a.ts', 'a,b].ts', 'b.tsx', 'c.md']
+
+  beforeAll(async () => {
+    root = await mkdtemp(join(tmpdir(), 'orca-search-class-syntax-'))
+    for (const file of files) {
+      await writeFile(join(root, file), 'needle\n')
+    }
+    expect((await runProcess({ program: 'git', args: ['init'], cwd: root })).code).toBe(0)
+  })
+
+  afterAll(async () => {
+    if (root) {
+      await rm(root, { recursive: true, force: true })
+    }
+  })
+
+  it.each([
+    ['rg', '[a\\].ts, *.md', ['a.ts', 'c.md']],
+    ['rg', '[[:].ts, *.md', ['[.ts', 'c.md']],
+    ['git', '[[:].ts, *.md', ['[.ts', 'c.md']],
+    ['git', '[a\\],b].ts, *.md', [',.ts', '].ts', 'a.ts', 'c.md']],
+    ['git', '[[:alpha:],].ts, *.md', [',.ts', 'a.ts', 'c.md']],
+    ['rg', '[[:alpha:], *.md', ['c.md']]
+  ] as const)(
+    'respects %s syntax in %s for includes and excludes',
+    async (engine, pattern, matches) => {
+      const { rgPath } = await import('@vscode/ripgrep-universal')
+      for (const exclude of [false, true]) {
+        const options = exclude ? { excludePattern: pattern } : { includePattern: pattern }
+        const result = await runProcess({
+          program: engine === 'rg' ? rgPath : 'git',
+          args:
+            engine === 'rg'
+              ? buildRgArgs('needle', root, options)
+              : buildGitGrepArgs('needle', options),
+          cwd: root
+        })
+        expect(result.code).toBe(0)
+        expect(result.stderr).toBe('')
+        let actual: string[]
+        if (engine === 'rg') {
+          const accumulator = createAccumulator()
+          for (const line of result.stdout.split('\n')) {
+            ingestRgJsonLine(line, root, accumulator, 100)
+          }
+          actual = finalize(accumulator).files.map((file) => file.relativePath)
+        } else {
+          actual = result.stdout
+            .trim()
+            .split('\n')
+            .map((line) => line.split('\0')[0])
+        }
+        const selected = new Set<string>(matches)
+        const expected = exclude ? files.filter((file) => !selected.has(file)) : [...matches]
+        expect(actual.sort()).toEqual(expected.sort())
+      }
+    }
+  )
+})
diff --git a/src/shared/text-search-glob-patterns.ts b/src/shared/text-search-glob-patterns.ts
index 5e1e9487a365..b8d511f072dd 100644
--- a/src/shared/text-search-glob-patterns.ts
+++ b/src/shared/text-search-glob-patterns.ts
@@ -1,18 +1,47 @@
-export function splitSearchGlobPatterns(patterns: string): string[] {
+/** Keeps grouped and escaped commas inside globs so search engines receive complete patterns. */
+export function splitSearchGlobPatterns(patterns: string, engine: 'rg' | 'git' = 'rg'): string[] {
   const out: string[] = []
   let current = ''
   let escaping = false
-  for (const ch of patterns) {
+  let braceDepth = 0
+  let characterClassContentStart = -1
+  let posixClassStart = -1
+  for (let index = 0; index < patterns.length; index += 1) {
+    const ch = patterns[index]
     if (escaping) {
       current += `\\${ch}`
       escaping = false
       continue
     }
-    if (ch === '\\') {
+    // Ripgrep treats backslashes literally inside classes; Git uses them as escapes.
+    if (ch === '\\' && (characterClassContentStart === -1 || engine === 'git')) {
       escaping = true
       continue
     }
-    if (ch === ',') {
+    if (characterClassContentStart !== -1) {
+      // A leading ']' (also after negation) is a member, not the end of the class.
+      if (posixClassStart !== -1) {
+        if (ch === ']') {
+          // An incomplete POSIX opener can just be literal '[' and ':' members.
+          if (patterns[index - 1] !== ':' || index <= posixClassStart + 3) {
+            characterClassContentStart = -1
+          }
+          posixClassStart = -1
+        }
+      } else if (engine === 'git' && ch === '[' && patterns[index + 1] === ':') {
+        posixClassStart = index
+      } else if (ch === ']' && index > characterClassContentStart) {
+        characterClassContentStart = -1
+      }
+    } else if (ch === '[') {
+      const next = patterns[index + 1]
+      characterClassContentStart = index + (next === '!' || next === '^' ? 2 : 1)
+    } else if (ch === '{') {
+      braceDepth += 1
+    } else if (ch === '}') {
+      braceDepth = Math.max(0, braceDepth - 1)
+    }
+    if (ch === ',' && braceDepth === 0 && characterClassContentStart === -1) {
       const trimmed = current.trim()
       if (trimmed) {
         out.push(trimmed)
diff --git a/src/shared/text-search.ts b/src/shared/text-search.ts
index 8d5972ffabdf..7bb54243c4dc 100644
--- a/src/shared/text-search.ts
+++ b/src/shared/text-search.ts
@@ -75,12 +75,12 @@ export function buildRgArgs(query: string, target: string, opts: SearchOptionsLi
     args.push('--fixed-strings')
   }
   if (opts.includePattern) {
-    for (const pat of splitSearchGlobPatterns(opts.includePattern)) {
+    for (const pat of splitSearchGlobPatterns(opts.includePattern, 'rg')) {
       args.push('--glob', pat)
     }
   }
   if (opts.excludePattern) {
-    for (const pat of splitSearchGlobPatterns(opts.excludePattern)) {
+    for (const pat of splitSearchGlobPatterns(opts.excludePattern, 'rg')) {
       args.push('--glob', `!${pat}`)
     }
   }
@@ -197,7 +197,7 @@ export function buildGitGrepArgs(query: string, opts: SearchOptionsLike): string
   let hasPathspecs = false
   let hasIncludePathspecs = false
   if (opts.includePattern) {
-    for (const pat of splitSearchGlobPatterns(opts.includePattern)) {
+    for (const pat of splitSearchGlobPatterns(opts.includePattern, 'git')) {
       const pathspecs = toGitGlobPathspecs(pat)
       gitArgs.push(...pathspecs)
       hasPathspecs ||= pathspecs.length > 0
@@ -205,7 +205,7 @@ export function buildGitGrepArgs(query: string, opts: SearchOptionsLike): string
     }
   }
   if (opts.excludePattern) {
-    for (const pat of splitSearchGlobPatterns(opts.excludePattern)) {
+    for (const pat of splitSearchGlobPatterns(opts.excludePattern, 'git')) {
       const pathspecs = toGitGlobPathspecs(pat, true)
       gitArgs.push(...pathspecs)
       hasPathspecs ||= pathspecs.length > 0
diff --git a/src/shared/tui-agent-config.ts b/src/shared/tui-agent-config.ts
index 55082bc24704..153189139681 100644
--- a/src/shared/tui-agent-config.ts
+++ b/src/shared/tui-agent-config.ts
@@ -14,6 +14,7 @@ export type DraftPasteReadySignal =
   | 'codex-composer-prompt'
   | 'render-cursor-after-bracketed-paste'
   | 'grok-composer-prompt'
+  | 'dsh-composer-prompt'
   | 'zcode-composer-prompt'
 
 export type TuiAgentDetectionRuntime = NodeJS.Platform | 'wsl'
@@ -40,7 +41,7 @@ export type TuiAgentConfig = {
   /** Claude Code follows pasted text only where the user's typed words ask, so dispatch briefs need a typed lead line. */
   pasteNeedsTypedRequest?: boolean
   /** Pre-write a trust artifact so the agent's first-launch "trust this folder?" menu doesn't consume the bracketed paste (see agent-trust-presets.ts). */
-  preflightTrust?: 'cursor' | 'copilot' | 'codex' | 'antigravity'
+  preflightTrust?: 'cursor' | 'copilot' | 'codex' | 'antigravity' | 'qoder'
   /** Agent-specific signal that the composer is ready for paste, stronger than the default quiet-render window. */
   draftPasteReadySignal?: DraftPasteReadySignal
   /** Hard deadline for the agent's composer readiness signal. */
@@ -183,6 +184,11 @@ const TUI_AGENT_CONFIG_SOURCE: Record<TuiAgent, TuiAgentConfigSource> = {
     // Why: Prime Agent embeds Pi's TUI and decodes CSI-u the same way (see pi above).
     windowsShiftEnterEncoding: 'csi-u'
   },
+  qoder: {
+    detectCmd: 'qodercli',
+    promptInjectionMode: 'flag-prompt-interactive',
+    preflightTrust: 'qoder'
+  },
   gemini: {
     detectCmd: 'gemini',
     promptInjectionMode: 'flag-prompt-interactive'
@@ -235,6 +241,10 @@ const TUI_AGENT_CONFIG_SOURCE: Record<TuiAgent, TuiAgentConfigSource> = {
     detectCmd: 'cline',
     promptInjectionMode: 'stdin-after-start'
   },
+  freebuff: {
+    detectCmd: 'freebuff',
+    promptInjectionMode: 'stdin-after-start'
+  },
   codebuff: {
     detectCmd: 'codebuff',
     promptInjectionMode: 'stdin-after-start'
@@ -322,6 +332,24 @@ const TUI_AGENT_CONFIG_SOURCE: Record<TuiAgent, TuiAgentConfigSource> = {
     // Muse 1.3 treats subcommand-shaped prompts as commands even after `--`.
     promptInjectionMode: 'stdin-after-start'
   },
+  dsh: {
+    // Why: DeepSeek Harness publishes one binary (`dsh`) that boots a profile, and only the
+    // `dsh-tui` profile paints a composer. `dsh-tui` (alias `dst`) is the launcher that
+    // selects it, so detect that and require `dsh` too — the launcher delegates to it and
+    // fails without it.
+    detectCmd: 'dsh-tui',
+    detectCmdAliases: ['dst'],
+    detectRequiredCommands: ['dsh'],
+    // Why: the launcher re-execs `dsh --profile dsh-tui`, so the pane's foreground process
+    // is `dsh`, never `dsh-tui`. Readiness and follow-up delivery key off this name.
+    expectedProcess: 'dsh',
+    // Why: the terminal app parses only `--resume`/`--continue` and a workspace target; it
+    // has no prompt flag, so the first prompt is pasted into the composer after startup.
+    promptInjectionMode: 'stdin-after-start',
+    // Why: DSH-TUI animates a whale intro continuously behind its composer, so the default
+    // quiet window never settles (the grok failure mode). See dsh-tui-ready-no-key.txt.
+    draftPasteReadySignal: 'dsh-composer-prompt'
+  },
   zcode: {
     detectCmd: 'zcode',
     // Why: ZCode's entrypoint sets `process.title = 'zcode-cli'` (its `process-name.ts`
diff --git a/src/shared/tui-agent-detection-commands.ts b/src/shared/tui-agent-detection-commands.ts
index 1d9409a090bd..dbce135b4c70 100644
--- a/src/shared/tui-agent-detection-commands.ts
+++ b/src/shared/tui-agent-detection-commands.ts
@@ -48,9 +48,11 @@ export function getTuiAgentDetectionProbeCommands(
 ): string[] {
   return [
     ...new Set(
-      commands
-        .filter((command) => !isDetectionUnsupportedInRuntime(command, runtime))
-        .flatMap((command) => [command.cmd, ...(command.requiredCommands ?? [])])
+      commands.flatMap((command) =>
+        isDetectionUnsupportedInRuntime(command, runtime)
+          ? []
+          : [command.cmd, ...(command.requiredCommands ?? [])]
+      )
     )
   ]
 }
diff --git a/src/shared/tui-agent-display-names.ts b/src/shared/tui-agent-display-names.ts
index f85a87834b28..a90daa3242f3 100644
--- a/src/shared/tui-agent-display-names.ts
+++ b/src/shared/tui-agent-display-names.ts
@@ -14,6 +14,7 @@ export const TUI_AGENT_DISPLAY_NAMES: Record<TuiAgent, string> = {
   ante: 'Ante',
   trae: 'Trae',
   muse: 'Muse',
+  dsh: 'DeepSeek Harness',
   zcode: 'ZCode',
   autohand: 'Autohand Code',
   opencode: 'OpenCode',
@@ -22,6 +23,7 @@ export const TUI_AGENT_DISPLAY_NAMES: Record<TuiAgent, string> = {
   pi: 'Pi',
   omp: 'OMP',
   'prime-agent': 'Prime Agent',
+  qoder: 'Qoder CLI',
   gemini: 'Gemini',
   antigravity: 'Antigravity',
   aider: 'Aider',
@@ -33,6 +35,7 @@ export const TUI_AGENT_DISPLAY_NAMES: Record<TuiAgent, string> = {
   aug: 'Auggie',
   cline: 'Cline',
   codebuff: 'Codebuff',
+  freebuff: 'Freebuff',
   'command-code': 'Command Code',
   continue: 'Continue',
   cursor: 'Cursor',
diff --git a/src/shared/tui-agent-permissions.ts b/src/shared/tui-agent-permissions.ts
index 6d6a6bec856b..3a9912bf0663 100644
--- a/src/shared/tui-agent-permissions.ts
+++ b/src/shared/tui-agent-permissions.ts
@@ -8,6 +8,7 @@ export const YOLO_TUI_AGENT_ARGS: Partial<Record<TuiAgent, string>> = {
   'claude-agent-teams': '--dangerously-skip-permissions',
   openclaude: '--dangerously-skip-permissions',
   codex: '--dangerously-bypass-approvals-and-sandbox',
+  qoder: '--dangerously-skip-permissions',
   gemini: '--yolo',
   antigravity: '--dangerously-skip-permissions',
   aider: '--yes-always',
diff --git a/src/shared/tui-agent-selection.ts b/src/shared/tui-agent-selection.ts
index f3eb7322fb1f..85567dcb334c 100644
--- a/src/shared/tui-agent-selection.ts
+++ b/src/shared/tui-agent-selection.ts
@@ -16,6 +16,8 @@ export const TUI_AGENT_AUTO_PICK_ORDER = [
   'ante',
   'trae',
   'muse',
+  'dsh',
+  'qoder',
   'zcode',
   'pi',
   'omp',
@@ -32,6 +34,7 @@ export const TUI_AGENT_AUTO_PICK_ORDER = [
   'autohand',
   'cline',
   'codebuff',
+  'freebuff',
   'command-code',
   'continue',
   'cursor',
diff --git a/src/shared/tui-agent-startup-shell.test.ts b/src/shared/tui-agent-startup-shell.test.ts
index 1698e86b08b1..39c46e5fbf39 100644
--- a/src/shared/tui-agent-startup-shell.test.ts
+++ b/src/shared/tui-agent-startup-shell.test.ts
@@ -65,6 +65,12 @@ describe('tokenizeStartupCommand spans (windows shells)', () => {
   })
 })
 
+describe('powershell startup argument quoting', () => {
+  it('doubles typographic single quotes, which PowerShell also treats as delimiters', () => {
+    expect(quoteStartupArg('it\u2019s', 'powershell')).toBe("'it\u2019\u2019s'")
+  })
+})
+
 describe('one Unix startup dialect', () => {
   it('clears variables with a self-contained branch, not a per-shell builtin', () => {
     // Why not `unset`/`set -e` alone, and why not a wrapper-defined helper:
diff --git a/src/shared/tui-agent-startup-shell.ts b/src/shared/tui-agent-startup-shell.ts
index 94df0f80ac54..83bfbd584d28 100644
--- a/src/shared/tui-agent-startup-shell.ts
+++ b/src/shared/tui-agent-startup-shell.ts
@@ -1,4 +1,5 @@
 import { tokenizeCustomCommandTemplate, type CommandTokenSpan } from './commit-message-prompt'
+import { quotePowerShellLiteral } from './powershell-native-argument'
 
 /**
  * `'posix'` covers every Unix shell Orca can type into, fish included — not
@@ -217,7 +218,7 @@ function quotePortableUnixArg(value: string): string {
 
 export function quoteStartupArg(value: string, shell: AgentStartupShell): string {
   if (shell === 'powershell') {
-    return `'${value.replace(/'/g, "''")}'`
+    return quotePowerShellLiteral(value)
   }
   if (shell === 'cmd') {
     return `"${value.replace(/([\^&|<>()%!"])/g, '^$1')}"`
diff --git a/src/shared/tui-agent.ts b/src/shared/tui-agent.ts
index d19fcb0b1cee..197222208887 100644
--- a/src/shared/tui-agent.ts
+++ b/src/shared/tui-agent.ts
@@ -11,6 +11,7 @@ export type TuiAgent =
   | 'mimo-code'
   | 'pi' // Pi (pi.dev)
   | 'omp' // OMP (omp.sh)
+  | 'qoder' // Qoder CLI
   | 'gemini' // Gemini CLI
   | 'antigravity' // Google Antigravity CLI
   | 'aider' // Aider
@@ -22,6 +23,7 @@ export type TuiAgent =
   | 'aug' // Augment/Auggie
   | 'cline' // Cline
   | 'codebuff' // Codebuff
+  | 'freebuff' // Freebuff
   | 'command-code' // Command Code
   | 'continue' // Continue
   | 'cursor' // Cursor
@@ -40,3 +42,4 @@ export type TuiAgent =
   | 'muse' // Muse (Meta `muse` CLI)
   | 'zcode' // ZCode (Z.ai `zcode` CLI)
   | 'prime-agent' // Prime Agent (Prime Intellect)
+  | 'dsh' // DeepSeek Harness (`dsh`, launched through its `dsh-tui` terminal profile)
diff --git a/src/shared/ui-chrome-types.ts b/src/shared/ui-chrome-types.ts
index fe6157d870be..8d55b56f3e52 100644
--- a/src/shared/ui-chrome-types.ts
+++ b/src/shared/ui-chrome-types.ts
@@ -62,6 +62,8 @@ export type StatusBarItem =
   | 'kimi'
   | 'minimax'
   | 'grok'
+  | 'cursor'
+  | 'zcode'
   | 'ssh'
   | 'resource-usage'
   | 'ports'
diff --git a/src/shared/unix-socket-path-limit.ts b/src/shared/unix-socket-path-limit.ts
new file mode 100644
index 000000000000..1d29b8daf9c7
--- /dev/null
+++ b/src/shared/unix-socket-path-limit.ts
@@ -0,0 +1,11 @@
+/**
+ * `sizeof(sun_path)` per OS, including the terminating NUL: 108 on Linux (and
+ * Windows AF_UNIX), 104 on macOS/BSD. Compare against byte length, not
+ * character count — a non-ASCII path costs more bytes than characters.
+ */
+const SUN_PATH_SIZE: Record<'linux' | 'darwin', number> = { linux: 108, darwin: 104 }
+
+/** Longest socket path, in UTF-8 bytes, that fits `sun_path` beside its NUL. */
+export function unixSocketPathByteLimit(os: 'linux' | 'darwin'): number {
+  return SUN_PATH_SIZE[os] - 1
+}
diff --git a/src/shared/uuid-v4.test.ts b/src/shared/uuid-v4.test.ts
new file mode 100644
index 000000000000..a12396acccac
--- /dev/null
+++ b/src/shared/uuid-v4.test.ts
@@ -0,0 +1,25 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { createUuidV4 } from './uuid-v4'
+
+const UUID_V4 = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/
+
+describe('createUuidV4', () => {
+  afterEach(() => vi.unstubAllGlobals())
+
+  it('uses the browser crypto fallback when randomUUID is unavailable', () => {
+    vi.stubGlobal('crypto', {
+      getRandomValues: (bytes: Uint8Array) => {
+        bytes.fill(0xab)
+        return bytes
+      }
+    })
+
+    expect(createUuidV4()).toMatch(UUID_V4)
+  })
+
+  it('still returns a UUID when Web Crypto is unavailable', () => {
+    vi.stubGlobal('crypto', undefined)
+
+    expect(createUuidV4()).toMatch(UUID_V4)
+  })
+})
diff --git a/src/shared/uuid-v4.ts b/src/shared/uuid-v4.ts
new file mode 100644
index 000000000000..2bda84ec25eb
--- /dev/null
+++ b/src/shared/uuid-v4.ts
@@ -0,0 +1 @@
+export { createNonSecureContextUuid as createUuidV4 } from './non-secure-context-uuid'
diff --git a/src/shared/window-shortcut-policy.test.ts b/src/shared/window-shortcut-policy.test.ts
index 77bc37a5cf9e..edc48f124380 100644
--- a/src/shared/window-shortcut-policy.test.ts
+++ b/src/shared/window-shortcut-policy.test.ts
@@ -40,14 +40,26 @@ describe('resolveWindowShortcutAction', () => {
     ).toEqual({ type: 'dictationKeyDown' })
   })
 
-  it('resolves the explicit window shortcut allowlist on macOS', () => {
-    expect(
-      resolveWindowShortcutAction(
-        { code: 'Comma', key: ',', meta: true, control: false, alt: false, shift: false },
-        'darwin'
-      )
-    ).toEqual({ type: 'openSettings' })
+  it.each(['darwin', 'linux', 'win32'] as const)(
+    'leaves Cmd/Ctrl+, to terminal apps on %s unless explicitly rebound',
+    (platform) => {
+      const input = {
+        code: 'Comma',
+        key: ',',
+        meta: platform === 'darwin',
+        control: platform !== 'darwin',
+        alt: false,
+        shift: false
+      }
+      expect(resolveWindowShortcutAction(input, platform)).toBeNull()
+      expect(resolveWindowShortcutAction(input, platform, { 'tab.close': ['Mod+W'] })).toBeNull()
+      expect(
+        resolveWindowShortcutAction(input, platform, { 'app.settings': ['Mod+Comma'] })
+      ).toEqual({ type: 'openSettings' })
+    }
+  )
 
+  it('resolves the explicit window shortcut allowlist on macOS', () => {
     expect(
       resolveWindowShortcutAction(
         { code: 'KeyJ', key: 'j', meta: true, control: false, alt: false, shift: false },
diff --git a/src/shared/windows-cmd-runner-delayed-launch.test.ts b/src/shared/windows-cmd-runner-delayed-launch.test.ts
index 21c5cc8befe6..af3e409484ca 100644
--- a/src/shared/windows-cmd-runner-delayed-launch.test.ts
+++ b/src/shared/windows-cmd-runner-delayed-launch.test.ts
@@ -33,4 +33,11 @@ describe('buildWindowsCmdRunnerDelayedLaunchCommand', () => {
     expect(script).toContain("$runner = 'C:\\work (x86)\\se&tup.cmd'")
     expect(script).toContain('/d /s /v:on /c ""!ORCA_SETUP_RUNNER!""')
   })
+
+  it('doubles typographic single quotes in the runner path literal', () => {
+    const script = decodePayload(
+      buildWindowsCmdRunnerDelayedLaunchCommand('C:\\O\u2019Brien\\setup.cmd')
+    )
+    expect(script).toContain("$runner = 'C:\\O\u2019\u2019Brien\\setup.cmd'")
+  })
 })
diff --git a/src/shared/windows-cmd-runner-delayed-launch.ts b/src/shared/windows-cmd-runner-delayed-launch.ts
index cdc0af3a48a4..29403b263627 100644
--- a/src/shared/windows-cmd-runner-delayed-launch.ts
+++ b/src/shared/windows-cmd-runner-delayed-launch.ts
@@ -1,4 +1,5 @@
 import { encodePowerShellCommand } from './powershell-command-encoding'
+import { quotePowerShellLiteral } from './powershell-native-argument'
 
 // Why: `cmd.exe /c "<path>"` is typed into the terminal's shell, so the path is parsed twice.
 // cmd expands %VAR% even inside quotes (no escape exists on the command line), and PowerShell
@@ -18,7 +19,7 @@ export function windowsRunnerPathNeedsCmdGuard(runnerScriptPath: string): boolea
  */
 export function buildWindowsCmdRunnerDelayedLaunchCommand(runnerScriptPath: string): string {
   const script = [
-    `$runner = ${quotePowerShellString(runnerScriptPath)}`,
+    `$runner = ${quotePowerShellLiteral(runnerScriptPath)}`,
     // Why: an empty value would silently degrade to `cmd /c ""`, which exits 0 without running setup.
     'if ([string]::IsNullOrEmpty($runner)) { exit 1 }',
     '$processInfo = [System.Diagnostics.ProcessStartInfo]::new()',
@@ -39,7 +40,3 @@ export function buildWindowsCmdRunnerDelayedLaunchCommand(runnerScriptPath: stri
   // base64 stays: this string is typed into a shell, which is the whole point of the guard above.
   return `powershell.exe -NoProfile -NonInteractive -EncodedCommand ${encodePowerShellCommand(script)}`
 }
-
-function quotePowerShellString(value: string): string {
-  return `'${value.replace(/'/g, "''")}'`
-}
diff --git a/src/shared/workspace-session-schema.ts b/src/shared/workspace-session-schema.ts
index f21389059607..54448e1e5478 100644
--- a/src/shared/workspace-session-schema.ts
+++ b/src/shared/workspace-session-schema.ts
@@ -71,6 +71,7 @@ const terminalLayoutSnapshotSchema = z.object({
   root: terminalPaneLayoutNodeSchema.nullable(),
   activeLeafId: z.string().nullable(),
   expandedLeafId: z.string().nullable(),
+  chatLeafId: z.string().optional(),
   ptyIdsByLeafId: salvagedOptional('ptyIdsByLeafId', leafStringsSchema),
   buffersByLeafId: salvagedOptional('buffersByLeafId', leafStringsSchema),
   scrollbackRefsByLeafId: salvagedOptional('scrollbackRefsByLeafId', leafStringsSchema),
diff --git a/src/shared/workspace-session-sleeping-agents.ts b/src/shared/workspace-session-sleeping-agents.ts
index 2f2ac1252bb3..624996e0dc28 100644
--- a/src/shared/workspace-session-sleeping-agents.ts
+++ b/src/shared/workspace-session-sleeping-agents.ts
@@ -5,6 +5,7 @@ import {
   RESUMABLE_TUI_AGENTS
 } from './agent-session-resume'
 import { isValidTerminalTabId } from './terminal-tab-id'
+import { normalizeMainAgentStatusField } from './agent-status-types'
 import { salvagingRecord } from './zod-salvage'
 
 const terminalTabIdSchema = z
@@ -96,6 +97,8 @@ const sleepingAgentSessionRecordSchema = z
     terminalTitle: z.string().optional(),
     lastAssistantMessage: z.string().optional(),
     interrupted: z.boolean().optional(),
+    // A malformed value drops the field, never the record.
+    mainAgent: z.unknown().transform(normalizeMainAgentStatusField).optional(),
     connectionId: z.string().nullable().optional(),
     launchConfig: sleepingAgentLaunchConfigSchema.optional(),
     origin: z.enum(['worktree-sleep', 'quit', 'live']).optional(),
diff --git a/src/shared/workspace-session-terminal-schema.test.ts b/src/shared/workspace-session-terminal-schema.test.ts
index 18a930fa4929..a01998a9512a 100644
--- a/src/shared/workspace-session-terminal-schema.test.ts
+++ b/src/shared/workspace-session-terminal-schema.test.ts
@@ -2,6 +2,28 @@ import { describe, expect, it } from 'vitest'
 import { parseWorkspaceSession } from './workspace-session-schema'
 
 describe('parseWorkspaceSession terminal fields', () => {
+  it('preserves the native chat owner leaf in a terminal layout', () => {
+    const result = parseWorkspaceSession({
+      activeRepoId: null,
+      activeWorktreeId: 'wt',
+      activeTabId: 'tab1',
+      tabsByWorktree: {},
+      terminalLayoutsByTabId: {
+        tab1: {
+          root: { type: 'leaf', leafId: 'leaf-chat' },
+          activeLeafId: 'leaf-chat',
+          expandedLeafId: null,
+          chatLeafId: 'leaf-chat'
+        }
+      }
+    })
+
+    expect(result.ok).toBe(true)
+    if (result.ok) {
+      expect(result.value.terminalLayoutsByTabId.tab1?.chatLeafId).toBe('leaf-chat')
+    }
+  })
+
   it('preserves terminal startup cwd while accepting older omitted fields', () => {
     const result = parseWorkspaceSession({
       activeRepoId: null,
diff --git a/src/shared/zip-extractor-command.ts b/src/shared/zip-extractor-command.ts
new file mode 100644
index 000000000000..1f6564e22f60
--- /dev/null
+++ b/src/shared/zip-extractor-command.ts
@@ -0,0 +1,20 @@
+import { join } from 'node:path'
+
+/** The destination must already exist; callers extract only checksum-verified archives. */
+export function getZipExtractorCommand(
+  zipPath: string,
+  extractDir: string
+): { file: string; args: string[]; label: string } {
+  if (process.platform === 'win32' && !process.env.ORCA_UNZIP_BIN) {
+    return {
+      file: join(process.env.SystemRoot || 'C:\\Windows', 'System32', 'tar.exe'),
+      args: ['-xf', zipPath, '-C', extractDir],
+      label: 'tar'
+    }
+  }
+  return {
+    file: process.env.ORCA_UNZIP_BIN || 'unzip',
+    args: ['-q', zipPath, '-d', extractDir],
+    label: 'unzip'
+  }
+}
diff --git a/tests/e2e/add-project-error-toast-stacking.spec.ts b/tests/e2e/add-project-error-toast-stacking.spec.ts
new file mode 100644
index 000000000000..e482404367a4
--- /dev/null
+++ b/tests/e2e/add-project-error-toast-stacking.spec.ts
@@ -0,0 +1,180 @@
+import path from 'node:path'
+import type { ElectronApplication, TestInfo } from '@stablyai/playwright-test'
+import { test, expect } from './helpers/orca-app'
+import { openSidebarProjectDialog } from './helpers/sidebar-project-dialog'
+import {
+  createRuntimeDesktopPairingOffer,
+  launchPairedElectronClient
+} from './helpers/paired-electron-client'
+
+test.use({
+  seedTestRepo: false,
+  testRepoPath: '',
+  orcaAppExtraEnv: { ORCA_BACKGROUND_LAUNCH: '1' }
+})
+
+async function assertHiddenIsolation(app: ElectronApplication, testInfo: TestInfo, name: string) {
+  const isolation = await app.evaluate(({ app, BrowserWindow }) => ({
+    home: app.getPath('home'),
+    expectedHome: process.env.ORCA_E2E_HOME_DIR,
+    appPath: app.getAppPath(),
+    background: process.env.ORCA_BACKGROUND_LAUNCH,
+    windows: BrowserWindow.getAllWindows().map((window) => ({
+      visible: window.isVisible(),
+      focused: window.isFocused()
+    }))
+  }))
+  expect(isolation.home).toBe(isolation.expectedHome)
+  expect(isolation.background).toBe('1')
+  expect(isolation.appPath).toContain(process.cwd())
+  expect(isolation.windows.every((window) => !window.visible && !window.focused)).toBe(true)
+  await testInfo.attach(name, { body: JSON.stringify(isolation), contentType: 'application/json' })
+  return isolation.home
+}
+
+for (const theme of ['dark', 'light'] as const) {
+  test(`invalid host project path stays readable over its dialog (${theme})`, async ({
+    electronApp,
+    orcaPage
+  }, testInfo) => {
+    const hostHome = await assertHiddenIsolation(electronApp, testInfo, 'host-isolation')
+    const offer = await createRuntimeDesktopPairingOffer(orcaPage)
+    const client = await launchPairedElectronClient(offer, testInfo, 'Disposable host', {
+      extraEnv: { ORCA_BACKGROUND_LAUNCH: '1' }
+    })
+    try {
+      await assertHiddenIsolation(client.app, testInfo, 'client-isolation')
+      const page = client.page
+      await page.evaluate(async (theme) => {
+        await window.__store?.getState().updateSettings({ theme })
+      }, theme)
+      await openSidebarProjectDialog(page)
+      const dialog = page.getByRole('dialog', { name: /Add a project/i })
+      const hostPicker = dialog.getByRole('combobox')
+      await hostPicker.click()
+      await page.locator('[cmdk-item]').filter({ hasText: 'Disposable host' }).click()
+      await dialog.getByRole('button', { name: /Browse folder|Browse host/i }).click()
+      await page
+        .getByRole('dialog', { name: /Browse host filesystem/i })
+        .getByRole('button', { name: 'Cancel', exact: true })
+        .click()
+      const pathField = page.locator('#server-project-path')
+      const missingPath = path.join(hostHome, 'missing-project')
+      await pathField.fill(missingPath)
+      await page.getByRole('button', { name: 'Add Git Project' }).click()
+      const toast = page
+        .locator('[data-sonner-toast]')
+        .filter({ hasText: 'Cannot open folder on selected runtime' })
+        .first()
+      await expect(toast).toBeVisible()
+      await expect(pathField).toHaveValue(missingPath)
+      await expect(page.getByRole('dialog', { name: /Open host project/i })).toBeVisible()
+      await page.screenshot({
+        path: testInfo.outputPath(`toast-over-dialog-${theme}.png`),
+        animations: 'disabled'
+      })
+      const layers = await toast.evaluate((element) => {
+        const overlay = document.querySelector('[data-slot="dialog-overlay"]')
+        const toaster = element.closest('[data-sonner-toaster]')
+        if (!overlay || !toaster) {
+          throw new Error('Missing modal/toast layers')
+        }
+        return {
+          toast: Number(getComputedStyle(toaster).zIndex),
+          overlay: Number(getComputedStyle(overlay).zIndex),
+          pointerEvents: getComputedStyle(element).pointerEvents
+        }
+      })
+      await testInfo.attach('layers', {
+        body: JSON.stringify(layers),
+        contentType: 'application/json'
+      })
+      expect(layers.toast, 'dialog overlay covers the project error').toBeGreaterThan(
+        layers.overlay
+      )
+      expect(layers.pointerEvents).toBe('none')
+      await pathField.click()
+      // Radix still owns pointer/focus containment; a visible toast must not steal the form.
+      await expect(
+        toast.locator('[data-close-button]').click({ trial: true, timeout: 300 })
+      ).rejects.toThrow()
+      await expect(pathField).toHaveValue(missingPath)
+      expect(await pathField.evaluate((input) => input === document.activeElement)).toBe(true)
+
+      // A real action-toast renderer, fed a synthetic notification in this disposable client only.
+      await client.app.evaluate(({ ipcMain, BrowserWindow }) => {
+        ipcMain.removeHandler('mobile:consumePendingUnpairedDeviceAuthFailure')
+        ipcMain.handle('mobile:consumePendingUnpairedDeviceAuthFailure', () => true)
+        BrowserWindow.getAllWindows()[0].webContents.send('mobile:unpairedDeviceAuthFailure')
+      })
+      const actionToast = page
+        .locator('[data-sonner-toast]')
+        .filter({ hasText: 'A device tried to connect but is not paired' })
+      const action = actionToast.getByRole('button', { name: 'Open Mobile Settings' })
+      await expect(action).toBeVisible()
+      await expect(action.click({ trial: true, timeout: 300 })).rejects.toThrow()
+      await expect(pathField).toHaveValue(missingPath)
+      expect(await pathField.evaluate((input) => input === document.activeElement)).toBe(true)
+
+      // Credential prompts deliberately use a higher tier; this visibility fix does not cross it.
+      await page.evaluate(() =>
+        window.__store?.getState().enqueueSshCredentialRequest({
+          requestId: 'toast-layer-fixture',
+          targetId: 'Simulated SSH prompt',
+          kind: 'password',
+          detail: 'Layering fixture only'
+        })
+      )
+      await expect(page.getByRole('dialog', { name: 'SSH Password' })).toBeVisible()
+      await page.screenshot({
+        path: testInfo.outputPath(`higher-modal-residual-${theme}.png`),
+        animations: 'disabled'
+      })
+      expect(
+        await page
+          .locator('[data-slot="dialog-overlay"]')
+          .evaluateAll((overlays) =>
+            Math.max(...overlays.map((overlay) => Number(getComputedStyle(overlay).zIndex)))
+          )
+      ).toBe(140)
+      await page.evaluate(() =>
+        window.__store?.getState().removeSshCredentialRequest('toast-layer-fixture')
+      )
+      await expect(pathField).toHaveValue(missingPath)
+      await page
+        .getByRole('dialog', { name: /Open host project/i })
+        .getByRole('button', { name: 'Close', exact: true })
+        .click()
+      await expect(page.locator('[data-slot="dialog-overlay"]')).toHaveCount(0)
+      const toaster = page.locator('[data-sonner-toaster]')
+      await expect(toaster).toHaveCSS('z-index', '40')
+      await toast.locator('[data-close-button]').click()
+      await expect(toast).toBeHidden()
+
+      await page.evaluate(async () => {
+        await window.__store?.getState().updateSettings({ experimentalAgentDashboardPopout: true })
+      })
+      await page.evaluate(() => window.__store?.getState().setAgentDashboardDrawerOpen(true))
+      await expect(page.locator('[data-agent-dashboard-sheet]')).toBeVisible()
+      await expect(page.locator('[data-slot="sheet-overlay"]')).toHaveCount(0)
+      await expect(toaster).toHaveCSS('z-index', '40')
+      await page.screenshot({
+        path: testInfo.outputPath(`nonmodal-drawer-${theme}.png`),
+        animations: 'disabled'
+      })
+      await page.evaluate(() => window.__store?.getState().setAgentDashboardDrawerOpen(false))
+      // Scroll-lock is also used by selects and menus and must not by itself lift notifications.
+      await page.evaluate(() => document.body.setAttribute('data-scroll-locked', '1'))
+      await expect(toaster).toHaveCSS('z-index', '40')
+      await page.evaluate(() => document.body.removeAttribute('data-scroll-locked'))
+      await action.click()
+      await expect(page.getByPlaceholder('Search settings')).toBeVisible()
+      await assertHiddenIsolation(client.app, testInfo, 'client-final-isolation')
+      await assertHiddenIsolation(electronApp, testInfo, 'host-final-isolation')
+      expect(await client.getDirectSshAttemptTargetIds()).toEqual([])
+      expect(await orcaPage.evaluate(() => window.api.repos.list())).toEqual([])
+    } finally {
+      await client.dispose()
+    }
+  })
+}
diff --git a/tests/e2e/agent-session-live-force-exit-resume.spec.ts b/tests/e2e/agent-session-live-force-exit-resume.spec.ts
index 18e984090948..b6609c29df71 100644
--- a/tests/e2e/agent-session-live-force-exit-resume.spec.ts
+++ b/tests/e2e/agent-session-live-force-exit-resume.spec.ts
@@ -1,5 +1,9 @@
+import {
+  readPersistedProfileState,
+  mutateStoppedProfileState
+} from './helpers/persisted-profile-state'
 import { execFileSync } from 'node:child_process'
-import { existsSync, readFileSync, writeFileSync } from 'node:fs'
+import { existsSync, readFileSync } from 'node:fs'
 import path from 'node:path'
 import type { ChildProcess } from 'node:child_process'
 import type { ElectronApplication } from '@stablyai/playwright-test'
@@ -16,7 +20,6 @@ import {
 import { ensureTerminalVisible, waitForActiveWorktree, waitForSessionReady } from './helpers/store'
 import { attachRepoAndOpenTerminal, createRestartSession } from './helpers/orca-restart'
 import { PROTOCOL_VERSION } from '../../src/main/daemon/types'
-import { DEFAULT_LOCAL_ORCA_PROFILE_ID } from '../../src/shared/orca-profiles'
 
 const PROVIDER_SESSION_ID = 'e2e-live-force-exit-session'
 
@@ -41,17 +44,9 @@ type PersistedData = {
   workspaceSession?: PersistedWorkspaceSession
 }
 
-function dataFilePath(userDataDir: string): string {
-  // Fresh sessions migrate the seeded legacy file, then persist only here.
-  return path.join(userDataDir, 'profiles', DEFAULT_LOCAL_ORCA_PROFILE_ID, 'orca-data.json')
-}
-
 function readPersistedData(userDataDir: string): PersistedData {
-  return JSON.parse(readFileSync(dataFilePath(userDataDir), 'utf8')) as PersistedData
-}
-
-function writePersistedData(userDataDir: string, data: PersistedData): void {
-  writeFileSync(dataFilePath(userDataDir), `${JSON.stringify(data, null, 2)}\n`, 'utf8')
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: This test owns the persisted fixture; optional fields are checked at use sites.
+  return readPersistedProfileState(userDataDir) as PersistedData
 }
 
 function daemonPidPath(userDataDir: string): string {
@@ -115,29 +110,31 @@ function killPid(pid: number): void {
 }
 
 function stripPersistedPtyOwnership(userDataDir: string): void {
-  const data = readPersistedData(userDataDir)
-  const session = data.workspaceSession
-  if (!session) {
-    throw new Error('Expected persisted workspace session')
-  }
-  for (const tabs of Object.values(session.tabsByWorktree ?? {})) {
-    for (const tab of tabs) {
-      tab.ptyId = null
+  return mutateStoppedProfileState(userDataDir, (state) => {
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: This test owns the persisted fixture; optional fields are checked at use sites.
+    const data = state as PersistedData
+    const session = data.workspaceSession
+    if (!session) {
+      throw new Error('Expected persisted workspace session')
     }
-  }
-  // Why: this models the updater/crash artifact from #6370: the UI tab and
-  // live resume record survive, but no pane has the old stable leaf key or
-  // daemon session to own resume.
-  session.terminalLayoutsByTabId = {}
-  session.activeWorktreeIdsOnShutdown = []
-  for (const record of Object.values(session.sleepingAgentSessionsByPaneKey ?? {})) {
-    if (record.providerSession?.id === PROVIDER_SESSION_ID) {
-      // Why: the e2e proof should verify Orca launches the resumed command,
-      // not depend on a developer machine having a real Codex CLI installed.
-      record.launchConfig = { agentCommand: 'echo', agentArgs: '', agentEnv: {} }
+    for (const tabs of Object.values(session.tabsByWorktree ?? {})) {
+      for (const tab of tabs) {
+        tab.ptyId = null
+      }
     }
-  }
-  writePersistedData(userDataDir, data)
+    // Why: this models the updater/crash artifact from #6370: the UI tab and
+    // live resume record survive, but no pane has the old stable leaf key or
+    // daemon session to own resume.
+    session.terminalLayoutsByTabId = {}
+    session.activeWorktreeIdsOnShutdown = []
+    for (const record of Object.values(session.sleepingAgentSessionsByPaneKey ?? {})) {
+      if (record.providerSession?.id === PROVIDER_SESSION_ID) {
+        // Why: the e2e proof should verify Orca launches the resumed command,
+        // not depend on a developer machine having a real Codex CLI installed.
+        record.launchConfig = { agentCommand: 'echo', agentArgs: '', agentEnv: {} }
+      }
+    }
+  })
 }
 
 function persistedLiveRecordExists(userDataDir: string): boolean {
diff --git a/tests/e2e/agent-session-quit-resume.spec.ts b/tests/e2e/agent-session-quit-resume.spec.ts
index 17c68f01ca78..b4a8573904fa 100644
--- a/tests/e2e/agent-session-quit-resume.spec.ts
+++ b/tests/e2e/agent-session-quit-resume.spec.ts
@@ -1,4 +1,5 @@
-import { existsSync, readFileSync, writeFileSync } from 'node:fs'
+import { mutateStoppedProfileState } from './helpers/persisted-profile-state'
+import { existsSync, readFileSync } from 'node:fs'
 import path from 'node:path'
 import type { ElectronApplication } from '@stablyai/playwright-test'
 import { test, expect } from './helpers/orca-app'
@@ -14,40 +15,35 @@ import {
 import { ensureTerminalVisible, waitForActiveWorktree, waitForSessionReady } from './helpers/store'
 import { attachRepoAndOpenTerminal, createRestartSession } from './helpers/orca-restart'
 import { PROTOCOL_VERSION } from '../../src/main/daemon/types'
-import { DEFAULT_LOCAL_ORCA_PROFILE_ID } from '../../src/shared/orca-profiles'
 
 const PROVIDER_SESSION_ID = 'e2e-quit-resume-session'
 
 function stubPersistedResumeCommand(userDataDir: string): void {
-  const dataPath = path.join(
-    userDataDir,
-    'profiles',
-    DEFAULT_LOCAL_ORCA_PROFILE_ID,
-    'orca-data.json'
-  )
-  const data = JSON.parse(readFileSync(dataPath, 'utf8')) as {
-    workspaceSession?: {
-      sleepingAgentSessionsByPaneKey?: Record<
-        string,
-        {
-          providerSession?: { id?: unknown }
-          launchConfig?: {
-            agentCommand?: string
-            agentArgs?: string
-            agentEnv?: Record<string, string>
+  return mutateStoppedProfileState(userDataDir, (state) => {
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: This test owns the persisted fixture; optional fields are checked at use sites.
+    const data = state as {
+      workspaceSession?: {
+        sleepingAgentSessionsByPaneKey?: Record<
+          string,
+          {
+            providerSession?: { id?: unknown }
+            launchConfig?: {
+              agentCommand?: string
+              agentArgs?: string
+              agentEnv?: Record<string, string>
+            }
           }
-        }
-      >
+        >
+      }
     }
-  }
-  const record = Object.values(data.workspaceSession?.sleepingAgentSessionsByPaneKey ?? {}).find(
-    (candidate) => candidate.providerSession?.id === PROVIDER_SESSION_ID
-  )
-  if (!record) {
-    throw new Error('Expected a persisted resumable agent session')
-  }
-  record.launchConfig = { agentCommand: 'echo', agentArgs: '', agentEnv: {} }
-  writeFileSync(dataPath, `${JSON.stringify(data, null, 2)}\n`, 'utf8')
+    const record = Object.values(data.workspaceSession?.sleepingAgentSessionsByPaneKey ?? {}).find(
+      (candidate) => candidate.providerSession?.id === PROVIDER_SESSION_ID
+    )
+    if (!record) {
+      throw new Error('Expected a persisted resumable agent session')
+    }
+    record.launchConfig = { agentCommand: 'echo', agentArgs: '', agentEnv: {} }
+  })
 }
 
 function readDaemonPid(userDataDir: string): number {
diff --git a/tests/e2e/agent-trust-completion.unit.test.ts b/tests/e2e/agent-trust-completion.unit.test.ts
new file mode 100644
index 000000000000..45619ea25df4
--- /dev/null
+++ b/tests/e2e/agent-trust-completion.unit.test.ts
@@ -0,0 +1,282 @@
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { AgentTrustPreset } from '../../src/main/agent-trust-presets'
+import { AGENT_TRUST_WRITE_DEADLINE_MS } from '../../src/main/agent-trust-write-deadline'
+import { runExclusivelyForCodexTrustConfig } from '../../src/main/codex/codex-trust-config-mutation-queue'
+import { preflightAgentTrust } from '../../src/renderer/src/lib/agent-trust-preflight'
+import { launchAgentSessionContinuation } from '../../src/renderer/src/lib/launch-agent-session-continuation'
+
+type TrustRequest = { preset: AgentTrustPreset; workspacePath: string; connectionId?: string }
+const fake = vi.hoisted(() => ({
+  handlers: new Map<string, (event: unknown, args: TrustRequest) => Promise<void>>(),
+  codex: vi.fn(),
+  cursor: vi.fn(),
+  copilot: vi.fn(),
+  antigravity: vi.fn(),
+  remote: vi.fn(),
+  launch: vi.fn()
+}))
+vi.mock('@/store', () => ({
+  useAppStore: { getState: () => ({ settings: {}, ensureDetectedAgents: async () => ['codex'] }) }
+}))
+vi.mock('@/lib/launch-agent-in-new-tab', () => ({ launchAgentInNewTab: fake.launch }))
+vi.mock('@/lib/agent-catalog', () => ({ getAgentLabel: () => 'Codex' }))
+vi.mock('@/lib/connection-context', () => ({ getConnectionIdFromState: () => null }))
+vi.mock('@/lib/worktree-runtime-owner', () => ({ getRuntimeEnvironmentIdForWorktree: () => null }))
+vi.mock('@/i18n/i18n', () => ({ translate: (_key: string, fallback: string) => fallback }))
+vi.mock('sonner', () => ({ toast: { error: vi.fn(), warning: vi.fn(), success: vi.fn() } }))
+vi.mock('electron', () => ({
+  ipcMain: {
+    removeHandler: (channel: string) => fake.handlers.delete(channel),
+    handle: (channel: string, handler: (event: unknown, args: TrustRequest) => Promise<void>) =>
+      fake.handlers.set(channel, handler)
+  }
+}))
+vi.mock('../../src/main/agent-trust-presets', () => ({
+  markCodexProjectTrusted: fake.codex,
+  markCursorWorkspaceTrusted: fake.cursor,
+  markCopilotFolderTrusted: fake.copilot,
+  markAntigravityWorkspaceTrusted: fake.antigravity
+}))
+vi.mock('../../src/main/remote-agent-trust-presets', () => ({
+  markRemoteAgentWorkspaceTrusted: fake.remote
+}))
+import { registerAgentTrustHandlers } from '../../src/main/ipc/agent-trust'
+
+function deferred() {
+  let resolve: () => void = () => {}
+  let reject: (reason: Error) => void = () => {}
+  const promise = new Promise<void>((yes, no) => {
+    resolve = yes
+    reject = no
+  })
+  return { promise, resolve, reject }
+}
+function invoke(args: TrustRequest): Promise<void> {
+  const handler = fake.handlers.get('agentTrust:markTrusted')
+  if (!handler) {
+    throw new Error('Trust handler missing')
+  }
+  return handler({}, args)
+}
+async function flush(): Promise<void> {
+  for (let index = 0; index < 12; index++) {
+    await Promise.resolve()
+  }
+}
+const workspacePath = join('mock', 'folder workspace')
+
+beforeEach(() => {
+  vi.resetAllMocks()
+  fake.handlers.clear()
+  registerAgentTrustHandlers()
+  vi.stubGlobal('window', { api: { agentTrust: { markTrusted: invoke } } })
+})
+afterEach(() => vi.unstubAllGlobals())
+
+describe('agent trust completion', () => {
+  it('holds the actual session-continuation launch call until the local write settles', async () => {
+    const write = deferred()
+    fake.codex.mockReturnValue(write.promise)
+    fake.launch.mockReturnValue({ surface: { kind: 'local-terminal', tabId: 'mock-tab' } })
+    const request = launchAgentSessionContinuation({
+      agent: 'codex',
+      prompt: 'mock continuation',
+      worktreeId: 'mock-workspace',
+      workspacePath,
+      launchSource: 'sidebar'
+    })
+    await flush()
+    const launchesBeforeWrite = fake.launch.mock.calls.length
+    write.resolve()
+    await expect(request).resolves.toBe(true)
+    expect(launchesBeforeWrite).toBe(0)
+    expect(fake.launch).toHaveBeenCalledTimes(1)
+  })
+
+  it('keeps renderer preflight pending behind the actual config mutation queue', async () => {
+    const blocker = deferred()
+    const key = join('mock', 'codex', 'config.toml')
+    const held = runExclusivelyForCodexTrustConfig(key, () => blocker.promise)
+    let writes = 0
+    let continuationCalls = 0
+    fake.codex.mockImplementation(() =>
+      runExclusivelyForCodexTrustConfig(key, async () => {
+        writes += 1
+      })
+    )
+    const launch = preflightAgentTrust({ agent: 'codex', workspacePath }).then(() => {
+      continuationCalls += 1
+    })
+    await flush()
+    const beforeRelease = { writes, continuationCalls }
+    blocker.resolve()
+    await held
+    await launch
+    await flush()
+    expect(beforeRelease).toEqual({ writes: 0, continuationCalls: 0 })
+    expect(writes).toBe(1)
+    expect(continuationCalls).toBe(1)
+  })
+
+  it('settles best-effort only after a queued local trust failure', async () => {
+    const write = deferred()
+    // Keep the original implementation's discarded promise from leaking into the test runner.
+    void write.promise.catch(() => {})
+    fake.codex.mockReturnValue(write.promise)
+    let settled = false
+    const request = invoke({ preset: 'codex', workspacePath }).then(() => {
+      settled = true
+    })
+    await flush()
+    const beforeFailure = settled
+    write.reject(new Error('mock EACCES'))
+    await expect(request).resolves.toBeUndefined()
+    expect(beforeFailure).toBe(false)
+    expect(settled).toBe(true)
+  })
+
+  it('contains an immediate local writer rejection', async () => {
+    fake.codex.mockRejectedValue(new Error('mock write failed'))
+    await expect(invoke({ preset: 'codex', workspacePath })).resolves.toBeUndefined()
+    await flush()
+  })
+
+  it('bounds a never-settling local write and continues untrusted', async () => {
+    vi.useFakeTimers()
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+    const write = deferred()
+    void write.promise.catch(() => {})
+    fake.codex.mockReturnValue(write.promise)
+    let settled = false
+    const request = invoke({ preset: 'codex', workspacePath }).then(() => {
+      settled = true
+    })
+    try {
+      await vi.advanceTimersByTimeAsync(AGENT_TRUST_WRITE_DEADLINE_MS - 1)
+      expect(settled).toBe(false)
+      await vi.advanceTimersByTimeAsync(2)
+      await expect(request).resolves.toBeUndefined()
+      expect(settled).toBe(true)
+      expect(warn).toHaveBeenCalledOnce()
+      expect(String(warn.mock.calls[0]?.[0])).toContain('did not settle')
+      // No leaked deadline timer keeps the handler or the process alive.
+      expect(vi.getTimerCount()).toBe(0)
+    } finally {
+      warn.mockRestore()
+      write.resolve()
+      vi.useRealTimers()
+    }
+  })
+
+  it('admits an already-complete write without waiting for any timer', async () => {
+    vi.useFakeTimers()
+    fake.codex.mockResolvedValue(undefined)
+    try {
+      // No timer is advanced: "already done" must settle on microtasks alone.
+      await expect(invoke({ preset: 'codex', workspacePath })).resolves.toBeUndefined()
+      expect(vi.getTimerCount()).toBe(0)
+    } finally {
+      vi.useRealTimers()
+    }
+  })
+
+  it('absorbs a local rejection that arrives after the deadline', async () => {
+    vi.useFakeTimers()
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+    const write = deferred()
+    fake.codex.mockReturnValue(write.promise)
+    try {
+      const request = invoke({ preset: 'codex', workspacePath })
+      await vi.advanceTimersByTimeAsync(AGENT_TRUST_WRITE_DEADLINE_MS + 1)
+      await expect(request).resolves.toBeUndefined()
+      // Unhandled here would fail the run: the abandoned write is still adopted.
+      write.reject(new Error('mock EACCES after deadline'))
+      await vi.advanceTimersByTimeAsync(1)
+    } finally {
+      warn.mockRestore()
+      vi.useRealTimers()
+    }
+  })
+
+  it('bounds a never-settling SSH trust write without a local fallback', async () => {
+    vi.useFakeTimers()
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+    const write = deferred()
+    void write.promise.catch(() => {})
+    fake.remote.mockReturnValue(write.promise)
+    try {
+      const request = invoke({ preset: 'codex', workspacePath, connectionId: 'ssh-1' })
+      await vi.advanceTimersByTimeAsync(AGENT_TRUST_WRITE_DEADLINE_MS + 1)
+      await expect(request).resolves.toBeUndefined()
+      // Loss of contact is not a verdict: nothing is written locally instead.
+      expect(fake.codex).not.toHaveBeenCalled()
+      expect(warn).toHaveBeenCalledOnce()
+    } finally {
+      warn.mockRestore()
+      write.resolve()
+      vi.useRealTimers()
+    }
+  })
+
+  it('settles two concurrent launches for the same workspace independently', async () => {
+    const first = deferred()
+    const second = deferred()
+    fake.codex.mockReturnValueOnce(first.promise).mockReturnValueOnce(second.promise)
+    const earlier = invoke({ preset: 'codex', workspacePath })
+    const later = invoke({ preset: 'codex', workspacePath })
+    first.reject(new Error('mock EACCES'))
+    await expect(earlier).resolves.toBeUndefined()
+    second.resolve()
+    await expect(later).resolves.toBeUndefined()
+    // Not deduped by design: the writer's upsert is idempotent per workspace.
+    expect(fake.codex).toHaveBeenCalledTimes(2)
+  })
+
+  it('keeps SSH trust on its remote owner and waits for its result', async () => {
+    const write = deferred()
+    fake.remote.mockReturnValue(write.promise)
+    let settled = false
+    const request = invoke({ preset: 'codex', workspacePath, connectionId: ' ssh-1 ' }).then(() => {
+      settled = true
+    })
+    await flush()
+    const beforeRemote = settled
+    write.resolve()
+    await request
+    expect(beforeRemote).toBe(false)
+    expect(fake.codex).not.toHaveBeenCalled()
+    expect(fake.remote).toHaveBeenCalledWith({
+      preset: 'codex',
+      workspacePath,
+      connectionId: 'ssh-1'
+    })
+  })
+
+  it('keeps remote failures best-effort without a local fallback', async () => {
+    fake.remote.mockRejectedValue(new Error('provider unavailable'))
+    await expect(
+      invoke({ preset: 'codex', workspacePath, connectionId: 'ssh-1' })
+    ).resolves.toBeUndefined()
+    expect(fake.codex).not.toHaveBeenCalled()
+  })
+
+  it.each(['cursor', 'copilot', 'antigravity'] as const)(
+    'keeps %s synchronous preset dispatch',
+    async (preset) => {
+      await invoke({ preset, workspacePath })
+      expect(fake[preset]).toHaveBeenCalledExactlyOnceWith(workspacePath)
+      expect(fake.codex).not.toHaveBeenCalled()
+      expect(fake.remote).not.toHaveBeenCalled()
+    }
+  )
+
+  it('skips a missing workspace and keeps synchronous failures best-effort', async () => {
+    await invoke({ preset: 'codex', workspacePath: '' })
+    expect(fake.codex).not.toHaveBeenCalled()
+    fake.codex.mockImplementation(() => {
+      throw new Error('mock path failure')
+    })
+    await expect(invoke({ preset: 'codex', workspacePath })).resolves.toBeUndefined()
+  })
+})
diff --git a/tests/e2e/browser-address-bar-narrow-toolbar.spec.ts b/tests/e2e/browser-address-bar-narrow-toolbar.spec.ts
index de24f0f4e6d5..4c75f9cdd35d 100644
--- a/tests/e2e/browser-address-bar-narrow-toolbar.spec.ts
+++ b/tests/e2e/browser-address-bar-narrow-toolbar.spec.ts
@@ -24,8 +24,8 @@ import { BROWSER_ADDRESS_BAR_MIN_INLINE_WIDTH } from '../../src/renderer/src/com
 // the middle of that band rather than a fixed window width, because how much
 // chrome flanks the pane (left sidebar, and a right sidebar that other startup
 // paths may re-open) varies between runs.
-const TARGET_TOOLBAR_WIDTH = 420
-const MIN_USABLE_TOOLBAR_WIDTH = BROWSER_ADDRESS_BAR_MIN_INLINE_WIDTH + 100
+const TARGET_TOOLBAR_WIDTH = 260
+const MIN_USABLE_TOOLBAR_WIDTH = BROWSER_ADDRESS_BAR_MIN_INLINE_WIDTH + 20
 const NARROW_WINDOW_HEIGHT = 800
 
 async function startDestinationServer(): Promise<{ url: string; close: () => Promise<void> }> {
@@ -62,6 +62,8 @@ async function setWindowWidth(electronApp: ElectronApplication, width: number):
       if (!window) {
         throw new Error('No Electron window')
       }
+      // Window minimums otherwise mask the narrow-pane state on some runners.
+      window.setMinimumSize(0, 0)
       window.setSize(size.width, size.height)
     },
     { width: Math.round(width), height: NARROW_WINDOW_HEIGHT }
@@ -118,8 +120,11 @@ async function settleToSqueezedRestingState(
         // Chrome flanking the pane is everything the toolbar didn't get.
         await setWindowWidth(electronApp, innerWidth - toolbar + TARGET_TOOLBAR_WIDTH)
         await addressBarInput(page).evaluate((node) => node.blur())
+        const measuredToolbar = await toolbarWidth(page)
         return {
-          toolbar: (await toolbarWidth(page)) > MIN_USABLE_TOOLBAR_WIDTH,
+          toolbar:
+            measuredToolbar > MIN_USABLE_TOOLBAR_WIDTH &&
+            measuredToolbar <= TARGET_TOOLBAR_WIDTH + 5,
           collapsed: (await addressBarOverlay(page).count()) === 0
         }
       },
diff --git a/tests/e2e/codex-child-approval-activity-row.unit.test.ts b/tests/e2e/codex-child-approval-activity-row.unit.test.ts
index b9210bf79e87..71bb0fddce18 100644
--- a/tests/e2e/codex-child-approval-activity-row.unit.test.ts
+++ b/tests/e2e/codex-child-approval-activity-row.unit.test.ts
@@ -143,7 +143,9 @@ async function openHost() {
     journalDir: join(root, SESSION)
   })
   const feed = new StructuredAgentSessionStatusFeed({
-    sessions: new Map([[SESSION, indexedStatusFeedSession({ journal, hasProviderChild: true })]]),
+    sessions: new Map([
+      [SESSION, indexedStatusFeedSession({ journal, child: { phase: 'ready' } })]
+    ]),
     getRecord: () => null,
     now: () => 1,
     readBackgroundTasks: () => ({ state: 'monitoring', tasks: [] })
diff --git a/tests/e2e/cross-version-wire/agent-session-resume-marker-downgrade.unit.test.ts b/tests/e2e/cross-version-wire/agent-session-resume-marker-downgrade.unit.test.ts
new file mode 100644
index 000000000000..f7f23d528aaf
--- /dev/null
+++ b/tests/e2e/cross-version-wire/agent-session-resume-marker-downgrade.unit.test.ts
@@ -0,0 +1,52 @@
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { expect, test } from 'vitest'
+import { structuredAgentSessionWorkingAtStop } from '../../../src/main/native-chat/agent-session-wire/structured-agent-session-working-at-teardown'
+import {
+  journal,
+  NOW,
+  record,
+  SESSION,
+  TEARDOWN_CURRENT,
+  turnItem
+} from '../../../src/main/native-chat/agent-session-wire/structured-agent-session-restart-resume-test-harness'
+import { AgentSessionRecoveryCapsule } from '../../../src/main/runtime/agent-session-recovery-capsule'
+import { importReleaseCheckoutModule, materializeReleaseCheckout } from './release-checkout'
+
+// A release whose marker parser still requires the chat's newest message id.
+const BASELINE_REF = 'v1.4.211'
+
+test('an older build reads the restart offer this build records at quit', async () => {
+  const directory = mkdtempSync(join(tmpdir(), 'orca-resume-marker-downgrade-'))
+  try {
+    // This build: the offer teardown takes for a chat whose turn was running.
+    const marker = structuredAgentSessionWorkingAtStop({
+      sessionId: SESSION,
+      session: { journal: journal([turnItem('turn-1', 'running')]), child: { fence: 1 } },
+      getRecord: () => record(),
+      backgroundTasks: () => undefined,
+      trigger: 'quit',
+      teardownId: TEARDOWN_CURRENT,
+      now: NOW
+    })
+    if (!marker) {
+      throw new Error('this build recorded no offer for a running turn')
+    }
+    await new AgentSessionRecoveryCapsule(directory).record([marker], NOW)
+
+    // The older build, after a downgrade, still lists it.
+    const checkout = await materializeReleaseCheckout(BASELINE_REF)
+    const baseline = await importReleaseCheckoutModule(
+      checkout,
+      'src/main/runtime/agent-session-recovery-capsule.ts'
+    )
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the pinned release exports this class with the constructor and `list` called below; a missing one fails the test.
+    const OldCapsule = baseline.AgentSessionRecoveryCapsule as new (directory: string) => {
+      list: (now: number) => Promise<{ sessionId: string }[]>
+    }
+    expect(await new OldCapsule(directory).list(NOW)).toMatchObject([{ sessionId: SESSION }])
+  } finally {
+    rmSync(directory, { recursive: true, force: true })
+  }
+})
diff --git a/tests/e2e/cross-version-wire/agent-session-unproven-release-downgrade.unit.test.ts b/tests/e2e/cross-version-wire/agent-session-unproven-release-downgrade.unit.test.ts
new file mode 100644
index 000000000000..80626f79ae31
--- /dev/null
+++ b/tests/e2e/cross-version-wire/agent-session-unproven-release-downgrade.unit.test.ts
@@ -0,0 +1,107 @@
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { expect, test } from 'vitest'
+import { resolveStructuredSessionRecovery } from '../../../src/main/native-chat/agent-session-wire/structured-agent-session-recovery-resolution'
+import { AgentSessionRecordStore } from '../../../src/main/runtime/agent-session-record-store'
+import { importReleaseCheckoutModule, materializeReleaseCheckout } from './release-checkout'
+
+// The last release before recovery released an owner it could not prove gone.
+const BASELINE_REF = 'v1.4.211'
+const SESSION = 'session-unproven'
+const NOW = 1_800_000_000_000
+const LOCATION = {
+  executionHostId: 'local',
+  wslDistro: null,
+  workspaceId: 'workspace-1',
+  workspaceKind: 'folder' as const
+}
+
+function reserveRequest(expectedFence: number | null, spawnToken: string, operation: number) {
+  return {
+    sessionId: SESSION,
+    location: LOCATION,
+    provider: 'codex' as const,
+    accountHome: { variable: 'CODEX_HOME' as const, path: '/tmp/codex' },
+    // Older builds still read the owner kind from the request.
+    runtimeKind: 'native' as const,
+    expectedFence,
+    spawnToken,
+    claimKeyId: 'key-1',
+    handoffOperationId: null,
+    probe: { outcome: 'reservation-unused' as const },
+    operation: {
+      callerKey: 'test',
+      operationId: `${NOW}-${String(operation).padStart(32, '0')}`,
+      fingerprint: 'create'
+    },
+    now: NOW
+  }
+}
+
+test('an older build loads, and starts over, a lease released with no death evidence', async () => {
+  const directory = mkdtempSync(join(tmpdir(), 'orca-unproven-release-downgrade-'))
+  try {
+    // This build: an owner whose identity can never be verified is released, with no evidence.
+    const store = await AgentSessionRecordStore.open({ directory, hostId: 'local' })
+    const reserved = await store.reserveOwner(reserveRequest(null, 'spawn-a', 1))
+    const fence = reserved.record.lease.runtimeFence
+    await store.commitProcessIdentity({
+      sessionId: SESSION,
+      fence,
+      process: { hostId: 'local', pid: 4242, processStartTimeMs: NOW, spawnToken: 'spawn-a' },
+      now: NOW
+    })
+    await store.transitionHandoff(SESSION, (record) => ({
+      ...record,
+      lease: { ...record.lease, handoffStage: 'recovering' }
+    }))
+    await expect(
+      resolveStructuredSessionRecovery(
+        {
+          store,
+          probeRecord: async () => ({ outcome: 'indeterminate', reason: 'no start time' }),
+          now: () => NOW
+        },
+        SESSION
+      )
+    ).resolves.toBe('resolved')
+    expect(store.getRecord(SESSION)?.lease).toMatchObject({
+      claimStatus: 'released',
+      handoffStage: null,
+      deathEvidence: null
+    })
+
+    // The older build reads exactly what this one wrote.
+    const checkout = await materializeReleaseCheckout(BASELINE_REF)
+    const baseline = await importReleaseCheckoutModule(
+      checkout,
+      'src/main/runtime/agent-session-record-store.ts'
+    )
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the pinned release exports this class with the open/read/reconcile/reserve members called below; a missing one fails the test.
+    const OldStore = baseline.AgentSessionRecordStore as {
+      open: (args: { directory: string; hostId: string }) => Promise<AgentSessionRecordStore>
+    }
+    const old = await OldStore.open({ directory, hostId: 'local' })
+    expect(old.isSessionUnreadable(SESSION)).toBe(false)
+    expect(old.getRecord(SESSION)?.lease).toMatchObject({
+      claimStatus: 'released',
+      handoffStage: null,
+      ownerProcess: null,
+      deathEvidence: null
+    })
+    await old.reconcileOnRestart({
+      probe: async () => ({ outcome: 'indeterminate', reason: 'no owner to probe' }),
+      now: NOW + 1
+    })
+    const released = old.getRecord(SESSION)?.lease
+    expect(released).toMatchObject({ claimStatus: 'released', handoffStage: null })
+    // And it can start a new owner over it.
+    const restarted = await old.reserveOwner(
+      reserveRequest(released?.runtimeFence ?? null, 'spawn-b', 2)
+    )
+    expect(restarted.record.lease).toMatchObject({ claimStatus: 'reserved' })
+  } finally {
+    rmSync(directory, { recursive: true, force: true })
+  }
+})
diff --git a/tests/e2e/cross-version-wire/cross-version-agent-session-wire.unit.test.ts b/tests/e2e/cross-version-wire/cross-version-agent-session-wire.unit.test.ts
index d244fba1ba68..ec7b2b9ec548 100644
--- a/tests/e2e/cross-version-wire/cross-version-agent-session-wire.unit.test.ts
+++ b/tests/e2e/cross-version-wire/cross-version-agent-session-wire.unit.test.ts
@@ -22,7 +22,9 @@ import { AgentSessionRecordStore } from '../../../src/main/runtime/agent-session
 import { RuntimeSubscriptionRegistry } from '../../../src/main/runtime/runtime-subscription-registry'
 import type { AgentSessionSubscribeEvent } from '../../../src/shared/agent-session-wire'
 import {
+  AGENT_SESSION_ACCEPTED_SEND_RUNTIME_CAPABILITY,
   AGENT_SESSION_PENDING_SEND_RESULT_RUNTIME_CAPABILITY,
+  AGENT_SESSION_QUESTION_ANSWERS_RUNTIME_CAPABILITY,
   AGENT_SESSION_REWIND_RUNTIME_CAPABILITY,
   AGENT_SESSION_CONVERSATION_OUTLINE_RUNTIME_CAPABILITY,
   AGENT_SESSION_STATUS_FEED_RUNTIME_CAPABILITY,
@@ -42,6 +44,7 @@ import {
   resetOperationIds,
   REWIND_METHOD,
   CONVERSATION_OUTLINE_METHOD,
+  envelope,
   STATUS_FEED_METHOD,
   sendParams,
   SESSION,
@@ -313,6 +316,41 @@ describe('cross-version structured agent sessions', () => {
       }
     })
 
+    it('takes structured question answers exactly where the host advertises them', async () => {
+      // A client sends `answers` only on this capability, so the two must never disagree:
+      // a strict older schema refuses the field and the answer is lost rather than degraded.
+      const method = 'agentSession.respondToQuestion'
+      const fields = {
+        itemId: 'item-1',
+        expectedRevision: 1,
+        answers: [{ questionId: 'q1', optionIds: [], other: 'Wait for the capture. '.repeat(80) }]
+      }
+      const params = { envelope: envelope({ method, fields, fence: 1 }), ...fields }
+      expect(current.capabilities).toContain(AGENT_SESSION_QUESTION_ANSWERS_RUNTIME_CAPABILITY)
+      for (const build of [current, baseline]) {
+        const advertised = build.capabilities.includes(
+          AGENT_SESSION_QUESTION_ANSWERS_RUNTIME_CAPABILITY
+        )
+        if (!build.methodNames.includes(method)) {
+          expect(advertised, `${build.label} advertises answers without the method`).toBe(false)
+          continue
+        }
+        const hostCalls = structuredHostStub(SESSION, WORKSPACE)
+        await build.installStructuredHost(installableHost(hostCalls))
+        try {
+          const replies = await callBuild(build, method, params, {
+            clientKind: 'runtime',
+            clientCapabilities: current.capabilities
+          })
+          expect(replies, `${build.label}: ${method} must answer exactly once`).toHaveLength(1)
+          expect(replies[0]?.ok, `${build.label}: ${JSON.stringify(replies[0])}`).toBe(advertised)
+          expect(hostCalls.respondToPrompt).toHaveBeenCalledTimes(advertised ? 1 : 0)
+        } finally {
+          await build.installStructuredHost(null)
+        }
+      }
+    })
+
     it(
       'executes every method a release-shaped checkout registers',
       async () => {
@@ -582,6 +620,10 @@ describe('cross-version structured agent sessions', () => {
     let store: AgentSessionRecordStore
     let runtime: unknown
 
+    /** Holds a provider start open, so a reply's timing can be read against it. */
+    let startGate: Promise<void> = Promise.resolve()
+    let starts = 0
+
     /** Phase 2 owns provider processes; the adapter is the only stub here. */
     function adapter(): StructuredAgentSessionAdapter {
       return {
@@ -589,23 +631,27 @@ describe('cross-version structured agent sessions', () => {
         // `supportsLocation`, which this fake also lacks, so the client-supplied-location gate
         // refused for the fake's silence rather than for the location.
         supportsCreate: () => true,
-        acquire: async ({ fence }) => ({
-          process: {
-            hostId: 'local',
-            pid: 4242,
-            processStartTimeMs: 1_700_000_000_000,
-            spawnToken: store.getRecord(SESSION)?.lease.reservedSpawnToken ?? 'spawn-a'
-          },
-          link: {
-            linkId: `link-${fence}`,
-            handle: { provider: 'codex', threadId: THREAD },
-            // A restarted host re-proves the thread it inherited; only the first
-            // owner of a session may claim to have created it.
-            origin: store.getRecord(SESSION)?.providerHandleChain.length ? 'resumed' : 'created',
-            mintedAtFence: fence,
-            observedAt: NOW
+        acquire: async ({ fence }) => {
+          starts += 1
+          await startGate
+          return {
+            process: {
+              hostId: 'local',
+              pid: 4242,
+              processStartTimeMs: 1_700_000_000_000,
+              spawnToken: store.getRecord(SESSION)?.lease.reservedSpawnToken ?? 'spawn-a'
+            },
+            link: {
+              linkId: `link-${fence}`,
+              handle: { provider: 'codex', threadId: THREAD },
+              // A restarted host re-proves the thread it inherited; only the first
+              // owner of a session may claim to have created it.
+              origin: store.getRecord(SESSION)?.providerHandleChain.length ? 'resumed' : 'created',
+              mintedAtFence: fence,
+              observedAt: NOW
+            }
           }
-        }),
+        },
         dispatch: async () => ({
           state: 'accepted',
           providerIdentity: { provider: 'codex', threadId: THREAD, turnId: 'turn-1', ordinal: 1 }
@@ -660,14 +706,18 @@ describe('cross-version structured agent sessions', () => {
       return reattached
     }
 
-    async function call(method: string, params: unknown): Promise<RpcReply[]> {
+    async function call(
+      method: string,
+      params: unknown,
+      clientCapabilities: readonly string[] = [STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY]
+    ): Promise<RpcReply[]> {
       return callBuild(
         current,
         method,
         params,
         {
           clientKind: 'runtime',
-          clientCapabilities: [STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY],
+          clientCapabilities,
           clientId: 'paired-device-1',
           connectionId: 'connection-1'
         },
@@ -686,6 +736,7 @@ describe('cross-version structured agent sessions', () => {
 
     beforeEach(async () => {
       resetOperationIds()
+      startGate = Promise.resolve()
       root = await mkdtemp(join(tmpdir(), 'orca-cross-version-agent-session-'))
       runtime = runtimeStub()
       await bootHost('a')
@@ -726,16 +777,71 @@ describe('cross-version structured agent sessions', () => {
       expect(batch?.cursor.sequence).toBeGreaterThan(held.sequence)
     })
 
-    it('refuses a write still fenced to the host generation that died', async () => {
+    // Every released client still sends the fence it last saw; this host names a write by its
+    // target and ignores that fence. Only the attach keeps comparing one, which `reattach` pins.
+    it('delivers a write still fenced to the host generation that died', async () => {
       const created = await answer('agentSession.create', createIntentParams())
       await bootHost('b')
       const reattached = await reattach(created.fence)
       expect(reattached.fence).toBeGreaterThan(created.fence)
 
       expect(await answer('agentSession.send', sendParams('stale', created.fence))).toMatchObject({
-        ok: false,
-        refusal: { code: 'agent_session_checkpoint_stale' }
+        ok: true,
+        fence: reattached.fence
       })
     })
+
+    // A released client answers a send's `pending` as delivered-or-refused; it has no way to show
+    // a rejection that arrives after it. So it is answered once the message is handed over, while
+    // a client that advertises accepted sends is answered at acceptance, start or no start (W9).
+    it('holds the send reply of a released client until the handover, and answers a current one at once', async () => {
+      const released = [
+        STRUCTURED_AGENT_SESSION_RUNTIME_CAPABILITY,
+        AGENT_SESSION_PENDING_SEND_RESULT_RUNTIME_CAPABILITY
+      ]
+      expect(baseline.capabilities).not.toContain(AGENT_SESSION_ACCEPTED_SEND_RUNTIME_CAPABILITY)
+      const created = await answer('agentSession.create', createIntentParams())
+      await bootHost('b')
+      let open = (): void => undefined
+      startGate = new Promise((resolve) => (open = resolve))
+
+      let answered = false
+      const releasedReply = call(
+        'agentSession.send',
+        sendParams('released', created.fence),
+        released
+      ).finally(() => (answered = true))
+      // The start that delivers it is under way, and the reply still waits for it.
+      const before = starts
+      await vi.waitFor(() => expect(starts).toBeGreaterThan(before))
+      await new Promise((resolve) => setTimeout(resolve, 20))
+      expect(answered).toBe(false)
+      open()
+      const [reply] = await releasedReply
+      // Handed over, whatever the provider has said since.
+      expect(reply).toMatchObject({
+        ok: true,
+        result: { value: { submission: { handedOverAt: expect.any(Number) } } }
+      })
+
+      const restarted = await bootHost('c')
+      startGate = new Promise((resolve) => (open = resolve))
+      const currentReply = await call('agentSession.send', sendParams('current', created.fence), [
+        ...released,
+        AGENT_SESSION_ACCEPTED_SEND_RUNTIME_CAPABILITY
+      ])
+      expect(currentReply[0]).toMatchObject({
+        ok: true,
+        result: { value: { submission: { dispatchState: 'pending', handoverRecorded: true } } }
+      })
+      open()
+      await vi.waitFor(async () =>
+        expect(
+          (await restarted.journalSnapshot(SESSION)).submissions.every(
+            (row) => row.dispatchState !== 'pending' || row.handedOverAt
+          )
+        ).toBe(true)
+      )
+    })
   })
 })
diff --git a/tests/e2e/cross-version-wire/cross-version-worktree-ps-verdict.unit.test.ts b/tests/e2e/cross-version-wire/cross-version-worktree-ps-verdict.unit.test.ts
new file mode 100644
index 000000000000..fffef650f6c9
--- /dev/null
+++ b/tests/e2e/cross-version-wire/cross-version-worktree-ps-verdict.unit.test.ts
@@ -0,0 +1,197 @@
+import { beforeAll, describe, expect, it } from 'vitest'
+import {
+  importReleaseCheckoutModule,
+  importWorkingTreeModuleCopy,
+  materializeReleaseCheckout
+} from './release-checkout'
+
+/**
+ * The verdict on a `worktree ps` agent row, paired across two builds.
+ *
+ * The host now sends `mainAgent` (the main agent's own state, verdict and clock) on each row,
+ * beside the `interrupted` flag every build reads. That is Rule 1 only if an old phone still reads
+ * a new host's row by the flag, and a new phone reads an old host's row, which has no `mainAgent`,
+ * by the same flag. Both halves run a real old build here rather than being reasoned about.
+ *
+ * The pre-change ref is pinned rather than derived: a newer baseline would carry the new reader,
+ * and every "old reader" cell would then pair the change against itself.
+ */
+const PRE_CHANGE_REF = 'v1.4.212'
+const SUITE_TIMEOUT_MS = 180_000
+// Both builds load a copy in the checkout cache, out of reach of `mobile/tsconfig.json`.
+const PHONE_ROW_READER = 'mobile/src/worktree/agent-row-display.ts'
+
+const WORKTREE_ID = 'repo::/worktree'
+const NOW = 1_000_000
+
+type HookSnapshot = Record<string, unknown>
+type AgentRow = Record<string, unknown>
+type DotState = (row: AgentRow, now: number) => string
+
+type HostRowModules = {
+  collectRuntimeWorktreeAgentSources: (args: Record<string, unknown>) => unknown
+  attachRuntimeWorktreeAgentRows: (args: Record<string, unknown>) => void
+}
+
+type Build = {
+  label: string
+  host: HostRowModules
+  agentDotState: DotState
+}
+
+function snapshot(
+  tabId: string,
+  fields: Pick<HookSnapshot, 'state'> & Partial<HookSnapshot>
+): HookSnapshot {
+  return {
+    paneKey: `${tabId}:11111111-1111-4111-8111-111111111111`,
+    tabId,
+    worktreeId: WORKTREE_ID,
+    connectionId: null,
+    prompt: 'ship it',
+    agentType: 'claude',
+    receivedAt: NOW - 1_000,
+    stateStartedAt: NOW - 600_000,
+    ...fields
+  }
+}
+
+// The three verdicts the change separates: a failure the old flag cannot express, the same
+// failure while subagents keep the row working, and a stop the old flag already carries.
+const SNAPSHOTS: HookSnapshot[] = [
+  snapshot('failed-done', {
+    state: 'done',
+    mainAgent: { state: 'done', outcome: 'failure', stateStartedAt: NOW - 600_000 }
+  }),
+  snapshot('failed-working', {
+    state: 'working',
+    mainAgent: { state: 'done', outcome: 'failure', stateStartedAt: NOW - 120_000 }
+  }),
+  snapshot('stopped', {
+    state: 'done',
+    interrupted: true,
+    mainAgent: { state: 'done', outcome: 'cancellation', stateStartedAt: NOW - 600_000 }
+  })
+]
+
+/** A host's `worktree ps` rows, JSON round-tripped as the wire carries them. */
+function publishRows(host: HostRowModules): Record<string, AgentRow> {
+  const summary: Record<string, unknown> = {
+    worktreeId: WORKTREE_ID,
+    status: 'inactive',
+    hasHostSidebarActivity: false,
+    agents: []
+  }
+  host.attachRuntimeWorktreeAgentRows({
+    summaries: new Map([[WORKTREE_ID, summary]]),
+    pathIndex: { byPath: new Map(), byRealPath: new Map() },
+    missingWorktreeIds: new Set(),
+    workingTerminalEvidenceByWorktreeId: new Map(),
+    rowSources: host.collectRuntimeWorktreeAgentSources({
+      hookSnapshots: SNAPSHOTS,
+      mirroredWorktreeIdByTabId: new Map(),
+      connectedPtyEvidence: {
+        tabIds: new Set(SNAPSHOTS.map((row) => row.tabId)),
+        paneKeys: new Set(),
+        ptyIdByTerminalHandle: new Map()
+      }
+    }),
+    orchestrationByPaneKey: null,
+    getSummary: (map: Map<string, unknown>, _paths: unknown, _missing: unknown, id: string) =>
+      map.get(id) ?? null
+  })
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: JSON.parse of the rows the host just attached, which are plain objects keyed by paneKey.
+  const rows = JSON.parse(JSON.stringify(summary.agents)) as AgentRow[]
+  return Object.fromEntries(rows.map((row) => [String(row.paneKey).split(':')[0], row]))
+}
+
+function dotStates(build: Build, rows: Record<string, AgentRow>): Record<string, string> {
+  return Object.fromEntries(
+    Object.entries(rows).map(([tabId, row]) => [tabId, build.agentDotState(row, NOW)])
+  )
+}
+
+async function loadBuild(ref: string | null): Promise<Build> {
+  if (ref === null) {
+    const [sources, rows, display] = await Promise.all([
+      import('../../../src/main/runtime/runtime-worktree-agent-sources'),
+      import('../../../src/main/runtime/runtime-worktree-agent-rows'),
+      importWorkingTreeModuleCopy(PHONE_ROW_READER)
+    ])
+    return {
+      label: 'current',
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: a dynamic import is typed by its module; this spec drives both builds through one untyped surface.
+      host: { ...sources, ...rows } as unknown as HostRowModules,
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: a dynamic import of a copy is typed unknown; this is the current phone's row reader by path.
+      agentDotState: display.agentDotState as unknown as DotState
+    }
+  }
+  const checkout = await materializeReleaseCheckout(ref)
+  const [sources, rows, display] = await Promise.all([
+    importReleaseCheckoutModule(checkout, 'src/main/runtime/runtime-worktree-agent-sources.ts'),
+    importReleaseCheckoutModule(checkout, 'src/main/runtime/runtime-worktree-agent-rows.ts'),
+    importReleaseCheckoutModule(checkout, PHONE_ROW_READER)
+  ])
+  return {
+    label: ref,
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: a dynamic import is typed unknown; these two modules are the old host's row surface by path.
+    host: { ...sources, ...rows } as unknown as HostRowModules,
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: a dynamic import is typed unknown; this is the old phone's row reader by path.
+    agentDotState: display.agentDotState as unknown as DotState
+  }
+}
+
+let oldBuild: Build
+let newBuild: Build
+let agentRowTimeAt: (row: AgentRow) => number
+
+beforeAll(async () => {
+  ;[oldBuild, newBuild] = await Promise.all([loadBuild(PRE_CHANGE_REF), loadBuild(null)])
+  const display = await importWorkingTreeModuleCopy(PHONE_ROW_READER)
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the rows are JSON the current host published, so the current reader's row type holds.
+  agentRowTimeAt = display.agentRowTimeAt as unknown as (row: AgentRow) => number
+}, SUITE_TIMEOUT_MS)
+
+describe('cross-version worktree ps verdict', () => {
+  it('pairs two real builds that disagree on the row shape', () => {
+    // Anti-vacuous-pass oracle: one module resolved twice would make every cell same-version.
+    expect(oldBuild.agentDotState).not.toBe(newBuild.agentDotState)
+    expect(Object.values(publishRows(oldBuild.host)).some((row) => 'mainAgent' in row)).toBe(false)
+    expect(Object.values(publishRows(newBuild.host)).every((row) => 'mainAgent' in row)).toBe(true)
+  })
+
+  it('an OLD phone reads a new host row by the interrupted flag it always read', () => {
+    const rows = publishRows(newBuild.host)
+    expect(rows.stopped).toMatchObject({ interrupted: true })
+    expect(dotStates(oldBuild, rows)).toEqual({
+      'failed-done': 'done',
+      'failed-working': 'working',
+      stopped: 'interrupted'
+    })
+  })
+
+  it('a NEW phone reads an old host row, which has no mainAgent, by the same flag', () => {
+    const rows = publishRows(oldBuild.host)
+    expect(dotStates(newBuild, rows)).toEqual({
+      'failed-done': 'done',
+      'failed-working': 'working',
+      stopped: 'interrupted'
+    })
+    // Without the main agent's clock the row dates itself, as it always did.
+    expect(agentRowTimeAt(rows['failed-working'])).toBe(NOW - 600_000)
+  })
+
+  it('a NEW phone reads a new host failure as failed, dated by the main agent clock', () => {
+    const rows = publishRows(newBuild.host)
+    expect(dotStates(newBuild, rows)).toEqual({
+      'failed-done': 'failed',
+      'failed-working': 'failed',
+      stopped: 'interrupted'
+    })
+    expect(rows['failed-working']).toMatchObject({
+      state: 'working',
+      mainAgent: { state: 'done', outcome: 'failure', stateStartedAt: NOW - 120_000 }
+    })
+    expect(agentRowTimeAt(rows['failed-working'])).toBe(NOW - 120_000)
+  })
+})
diff --git a/tests/e2e/cross-version-wire/release-checkout-tree.ts b/tests/e2e/cross-version-wire/release-checkout-tree.ts
index 14674bfeefd3..b5f97e78b242 100644
--- a/tests/e2e/cross-version-wire/release-checkout-tree.ts
+++ b/tests/e2e/cross-version-wire/release-checkout-tree.ts
@@ -6,7 +6,15 @@ const CHECKOUT_MAX_OUTPUT_BYTES = 1024 * 1024
 
 // Why: the wire endpoints only need the runtime RPC host, the renderer client, and
 // the shared codec. Skipping cli/relay keeps a cold CI extraction a few seconds.
-const ARCHIVE_PATHS = ['src/main', 'src/shared', 'src/preload', 'src/renderer', 'src/types']
+// The phone's `worktree ps` row reader is one self-contained file, so it rides along alone.
+const ARCHIVE_PATHS = [
+  'src/main',
+  'src/shared',
+  'src/preload',
+  'src/renderer',
+  'src/types',
+  'mobile/src/worktree/agent-row-display.ts'
+]
 
 const ALIAS_SPECIFIER =
   /(\bfrom\s*|\bimport\s*\(\s*|\brequire\s*\(\s*)(['"])@(renderer)?\/([^'"]+)\2/g
diff --git a/tests/e2e/cross-version-wire/release-checkout.ts b/tests/e2e/cross-version-wire/release-checkout.ts
index eafee3802be0..6a2d58312d3b 100644
--- a/tests/e2e/cross-version-wire/release-checkout.ts
+++ b/tests/e2e/cross-version-wire/release-checkout.ts
@@ -1,6 +1,6 @@
 import { execFileSync } from 'node:child_process'
 import { constants } from 'node:fs'
-import { access, mkdtemp, mkdir, readFile, rename, rm, writeFile } from 'node:fs/promises'
+import { access, copyFile, mkdtemp, mkdir, readFile, rename, rm, writeFile } from 'node:fs/promises'
 import { dirname, isAbsolute, join, relative, resolve, sep } from 'node:path'
 import { lock } from 'proper-lockfile'
 import {
@@ -12,7 +12,7 @@ export const REPO_ROOT = resolve(import.meta.dirname, '..', '..', '..')
 const DEFAULT_CACHE_ROOT = join(REPO_ROOT, 'tests', 'e2e', '.cross-version-checkouts')
 
 // Bump when extraction or the alias rewrite changes so cached trees are rebuilt.
-const CHECKOUT_FORMAT = 3
+const CHECKOUT_FORMAT = 4
 
 const BASELINE_REF_ENV = 'ORCA_CROSS_VERSION_BASELINE_REF'
 const STABLE_DESKTOP_RELEASE_TAG = /^v\d+\.\d+\.\d+$/
@@ -182,10 +182,10 @@ async function assertCheckoutWireSurface(root: string, ref: string): Promise<voi
   }
 }
 
-function checkoutModulePath(checkout: ReleaseCheckout, rootRelativePath: string): string {
+function checkoutModulePath(root: string, rootRelativePath: string): string {
   const fromRoot = rootRelativePath.replace(/^[/\\]+/, '')
-  const absolute = resolve(checkout.root, fromRoot)
-  const fromCheckout = relative(checkout.root, absolute)
+  const absolute = resolve(root, fromRoot)
+  const fromCheckout = relative(root, absolute)
   if (
     !fromRoot ||
     fromCheckout === '..' ||
@@ -213,7 +213,28 @@ export function importReleaseCheckoutModule(
   importModule: (specifier: string) => Promise<Record<string, unknown>> = (specifier) =>
     import(/* @vite-ignore */ specifier) as Promise<Record<string, unknown>>
 ): Promise<Record<string, unknown>> {
-  return importModule(checkoutModulePath(checkout, rootRelativePath))
+  return importModule(checkoutModulePath(checkout.root, rootRelativePath))
+}
+
+/**
+ * Import a copy of a self-contained working-tree module placed under the cache root.
+ *
+ * Why: vite transforms a file against its nearest tsconfig, and `mobile/tsconfig.json` extends
+ * Expo's, which the root-only CI lane does not install. The copy gets the root tsconfig, as the
+ * release checkout's copy does. A relative runtime import would not resolve from the copy.
+ */
+export async function importWorkingTreeModuleCopy(
+  rootRelativePath: string,
+  cacheRoot: string = DEFAULT_CACHE_ROOT
+): Promise<Record<string, unknown>> {
+  const copy = checkoutModulePath(join(cacheRoot, 'working-tree'), rootRelativePath)
+  const staged = `${copy}.${process.pid}.tmp`
+  await mkdir(dirname(copy), { recursive: true })
+  await copyFile(checkoutModulePath(REPO_ROOT, rootRelativePath), staged)
+  // Rename so a concurrent run never imports a half-written copy.
+  await rename(staged, copy)
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: a module namespace is a plain record of its exports; callers narrow each export they read.
+  return import(/* @vite-ignore */ copy) as Promise<Record<string, unknown>>
 }
 
 /**
diff --git a/tests/e2e/cross-version-wire/structured-agent-session-surface-manifest.ts b/tests/e2e/cross-version-wire/structured-agent-session-surface-manifest.ts
index d8c8b80b3293..f827d3cda5f7 100644
--- a/tests/e2e/cross-version-wire/structured-agent-session-surface-manifest.ts
+++ b/tests/e2e/cross-version-wire/structured-agent-session-surface-manifest.ts
@@ -115,7 +115,8 @@ export const STRUCTURED_CALLS: {
     hostMethod: 'revealSession',
     result: { ok: true, sessionId: SESSION, workspaceId: WORKSPACE, agent: 'codex', readable: true }
   },
-  { method: 'agentSession.hold', hostMethod: 'hold', result: { held: true } },
+  // A no-op on a host that starts an agent only for work; it still builds the host.
+  { method: 'agentSession.hold', hostMethod: null, result: { held: true } },
   // The restart-resume surface. Bare additions, not capability-negotiated: an RPC method's
   // absence is explicit (`method_not_found`), which the old-dispatcher case below asserts, so a
   // newer client learns it during negotiation instead of by being met with silence.
@@ -129,17 +130,14 @@ export const STRUCTURED_CALLS: {
     hostMethod: 'restartResumableDismiss',
     result: { dismissed: 0 }
   },
-  {
-    method: 'agentSession.restartResume',
-    hostMethod: 'restartResumeAll',
-    result: { results: [] }
-  },
+  // Reattaching alone is nothing now, so this answers that nothing was resumed.
+  { method: 'agentSession.restartResume', hostMethod: null, result: { results: [] } },
   {
     method: 'agentSession.restartContinue',
     hostMethod: 'restartContinueAll',
     result: { resumed: [], continued: [] }
   },
-  { method: 'agentSession.release', hostMethod: 'release', result: { released: true } },
+  { method: 'agentSession.release', hostMethod: null, result: { released: true } },
   {
     method: 'agentSession.history',
     hostMethod: 'history',
diff --git a/tests/e2e/daemon-running-work-probe.unit.test.ts b/tests/e2e/daemon-running-work-probe.unit.test.ts
new file mode 100644
index 000000000000..39bf29323f81
--- /dev/null
+++ b/tests/e2e/daemon-running-work-probe.unit.test.ts
@@ -0,0 +1,92 @@
+import { afterEach, expect, it, vi } from 'vitest'
+import { Session } from '../../src/main/daemon/session'
+import { inspectTerminalHostProcess } from '../../src/main/daemon/terminal-host-process-inspection'
+import type * as SnapshotReader from '../../src/shared/process-table-snapshot-reader'
+import type { ProcessTableRow } from '../../src/shared/process-table-snapshot'
+import { probePtyRunningWork } from '../../src/renderer/src/components/terminal/pty-running-work-probe'
+
+const { readSnapshot, inspectRuntime } = vi.hoisted(() => ({
+  readSnapshot: vi.fn(),
+  inspectRuntime: vi.fn()
+}))
+vi.mock('../../src/shared/process-table-snapshot-reader', async (importOriginal) => ({
+  ...(await importOriginal<typeof SnapshotReader>()),
+  getStrictProcessTableSnapshotWithAge: readSnapshot
+}))
+vi.mock('@/runtime/runtime-terminal-inspection', () => ({
+  inspectRuntimeTerminalProcess: inspectRuntime
+}))
+
+afterEach(() => vi.restoreAllMocks())
+
+it.each(['stopped', 'background', 'idle', 'unreadable'] as const)(
+  'carries daemon child evidence through the real close guard for %s work',
+  async (state) => {
+    vi.spyOn(process, 'platform', 'get').mockReturnValue('darwin')
+    const root: ProcessTableRow = {
+      pid: 100,
+      ppid: 1,
+      pgid: 100,
+      tpgid: 101,
+      tty: 'ttys001',
+      startTime: 'Thu Sep  3 16:02:01 2026',
+      stat: 'Ss',
+      command: 'login -fp user'
+    }
+    const rows = [root, { ...root, pid: 101, ppid: 100, pgid: 101, stat: 'S+', command: '-zsh' }]
+    if (state === 'background' || state === 'stopped') {
+      rows.push({
+        ...root,
+        pid: 102,
+        ppid: 101,
+        pgid: 102,
+        stat: state === 'stopped' ? 'T' : 'S',
+        command: 'vim draft.txt'
+      })
+    }
+    if (state === 'unreadable') {
+      readSnapshot.mockRejectedValue(new Error('unreadable'))
+    } else {
+      readSnapshot.mockResolvedValue({ rows, capturedAgeMs: 0 })
+    }
+    const session = new Session({
+      sessionId: 'close-guard',
+      cols: 80,
+      rows: 24,
+      scrollback: 10,
+      shellReadySupported: false,
+      subprocess: {
+        pid: 100,
+        processNameIsSpawnFile: true,
+        getForegroundProcess: () => 'zsh',
+        write() {},
+        resize() {},
+        kill() {},
+        forceKill() {},
+        signal() {},
+        dispose() {},
+        onData() {},
+        onExit() {},
+        terminateOwnedTree: () => 'unavailable'
+      }
+    })
+    try {
+      inspectRuntime.mockImplementation(() =>
+        inspectTerminalHostProcess({
+          sessionId: session.sessionId,
+          session,
+          authorityGeneration: 'owner',
+          nextObservationEpoch: () => 1
+        })
+      )
+      const [result] = await probePtyRunningWork(null, ['remote:owner:close-guard'], {
+        timeoutMs: 1000
+      })
+      expect(result.verdict).toBe(
+        state === 'idle' ? 'exited' : state === 'unreadable' ? 'unverifiable' : 'live'
+      )
+    } finally {
+      session.dispose()
+    }
+  }
+)
diff --git a/tests/e2e/diff-note-draft.spec.ts b/tests/e2e/diff-note-draft.spec.ts
new file mode 100644
index 000000000000..270971d11f98
--- /dev/null
+++ b/tests/e2e/diff-note-draft.spec.ts
@@ -0,0 +1,120 @@
+import type { Page, TestInfo } from '@stablyai/playwright-test'
+import { expect, test } from './helpers/orca-app'
+import { waitForActiveWorktree, waitForSessionReady } from './helpers/store'
+
+const DRAFT_LINE = 6
+const FOLLOWING_LINE = 'export const line07 = "draft-following-line-marker"'
+const NOTE_BODY = 'This note was added from the inline draft card.'
+
+async function attachDiffScreenshot(page: Page, testInfo: TestInfo, name: string): Promise<void> {
+  const screenshotPath = testInfo.outputPath(`${name}.png`)
+  await page.locator('.monaco-diff-editor').first().screenshot({ path: screenshotPath })
+  await testInfo.attach(name, { path: screenshotPath, contentType: 'image/png' })
+}
+
+test.describe('Diff note draft', () => {
+  test.beforeEach(async ({ orcaPage }) => {
+    await waitForSessionReady(orcaPage)
+    await waitForActiveWorktree(orcaPage)
+  })
+
+  test('opens an inline draft without overlapping code and saves it', async ({
+    orcaPage
+  }, testInfo) => {
+    await orcaPage.setViewportSize({ width: 1200, height: 800 })
+    const worktreeId = await waitForActiveWorktree(orcaPage)
+    const relativePath = await orcaPage.evaluate(async (wId) => {
+      const store = window.__store
+      if (!store) {
+        throw new Error('window.__store is not available')
+      }
+      const state = store.getState()
+      const worktree = Object.values(state.worktreesByRepo)
+        .flat()
+        .find((entry) => entry.id === wId)
+      if (!worktree) {
+        throw new Error('active worktree not found')
+      }
+      const separator = worktree.path.includes('\\') ? '\\' : '/'
+      const relative = `src${separator}diff-note-draft.ts`
+      const lines = Array.from({ length: 14 }, (_, index) => {
+        const number = String(index + 1).padStart(2, '0')
+        const value = index + 1 === 7 ? 'draft-following-line-marker' : `value-${number}`
+        return `export const line${number} = "${value}"`
+      })
+      await window.api.fs.writeFile({
+        filePath: `${worktree.path}${separator}${relative}`,
+        content: `${lines.join('\n')}\n`
+      })
+      await state.updateSettings({ diffDefaultView: 'side-by-side' })
+      state.openDiff(wId, `${worktree.path}${separator}${relative}`, relative, 'typescript', false)
+      return relative
+    }, worktreeId)
+
+    const followingLine = orcaPage
+      .locator('.modified-in-monaco-diff-editor .view-lines .view-line')
+      .filter({ hasText: FOLLOWING_LINE })
+      .first()
+    await expect(followingLine).toBeVisible({ timeout: 15_000 })
+    // Let the filesystem watcher finish its model refresh before opening a draft in that model.
+    await orcaPage.waitForTimeout(3_000)
+
+    const draftLine = orcaPage
+      .locator('.modified-in-monaco-diff-editor .view-lines .view-line')
+      .filter({ hasText: `export const line${String(DRAFT_LINE).padStart(2, '0')} = "value-06"` })
+      .first()
+    await draftLine.hover({ position: { x: 4, y: 8 } })
+    const addButton = orcaPage.locator('.orca-diff-comment-add-btn')
+    await expect(addButton).toBeVisible()
+    await addButton.click()
+
+    const draftCard = orcaPage.locator('.orca-diff-comment-draft-card')
+    const textarea = draftCard.locator('textarea')
+    await expect(draftCard).toBeVisible({ timeout: 15_000 })
+    await expect(draftCard).toContainText('Line 6')
+    await expect(draftCard).not.toContainText('You')
+    await expect
+      .poll(() => textarea.evaluate((element) => document.activeElement === element))
+      .toBe(true)
+    await expect(orcaPage.locator('.orca-diff-comment-draft-margin')).toBeVisible()
+    await expect
+      .poll(
+        async () => {
+          const [cardBox, lineBox] = await Promise.all([
+            draftCard.boundingBox(),
+            followingLine.boundingBox()
+          ])
+          return cardBox && lineBox ? lineBox.y - (cardBox.y + cardBox.height) : -1
+        },
+        { message: 'inline draft overlaps the following diff line' }
+      )
+      .toBeGreaterThanOrEqual(0)
+    await attachDiffScreenshot(orcaPage, testInfo, 'inline-diff-note-draft')
+
+    await textarea.fill(NOTE_BODY)
+    const submitButton = draftCard.locator('button').filter({ hasText: /add note/i })
+    await expect(submitButton).toBeEnabled()
+    await submitButton.click()
+    await expect(draftCard).toBeHidden()
+    const savedCard = orcaPage
+      .locator('.orca-diff-comment-card')
+      .filter({ hasText: NOTE_BODY })
+      .first()
+    await expect(savedCard).toBeVisible({ timeout: 15_000 })
+    await expect
+      .poll(
+        async () =>
+          await orcaPage.evaluate(
+            ({ wId, filePath, body }) => {
+              const comments = window.__store?.getState().getDiffComments(wId) ?? []
+              return comments.some(
+                (comment) => comment.filePath === filePath && comment.body === body
+              )
+            },
+            { wId: worktreeId, filePath: relativePath, body: NOTE_BODY }
+          )
+      )
+      .toBe(true)
+    await attachDiffScreenshot(orcaPage, testInfo, 'saved-inline-diff-note')
+  })
+})
diff --git a/tests/e2e/direct-ssh-snapshot-parking.unit.test.ts b/tests/e2e/direct-ssh-snapshot-parking.unit.test.ts
new file mode 100644
index 000000000000..7ac0ec897a7f
--- /dev/null
+++ b/tests/e2e/direct-ssh-snapshot-parking.unit.test.ts
@@ -0,0 +1,290 @@
+// @vitest-environment happy-dom
+import { act, cleanup, render } from '@testing-library/react'
+import { createElement, Fragment, useEffect } from 'react'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { exportRemoteWorkspaceSession } from '../../src/shared/remote-workspace-session-projection'
+import type {
+  RemoteWorkspaceObservedSnapshot,
+  RemoteWorkspaceSnapshot
+} from '../../src/shared/remote-workspace-types'
+import {
+  resyncStaleRemoteWorkspace,
+  _resetRemoteWorkspaceStaleResyncForTests
+} from '../../src/main/ipc/remote-workspace-stale-resync'
+import {
+  clearRemoteWorkspaceSnapshotCache,
+  rememberLocallyPatchedRemoteWorkspaceSnapshot,
+  rememberRemoteWorkspaceSnapshot
+} from '../../src/main/ipc/remote-workspace-snapshot-cache'
+import type { DirectSshAuthority, SshProviderEpoch, SshTarget } from '../../src/shared/ssh-types'
+import { useAppStore } from '@/store'
+import { makeTerminalTab, makeWorktree } from '@/store/slices/worktrees-slice-test-fixtures'
+import { buildWorkspaceSessionPayload } from '@/lib/workspace-session'
+import { applyDirectSshRemoteWorkspaceSnapshot } from '@/hooks/remote-workspace-snapshot-apply'
+import { singlePaneLayoutSnapshot } from '@/store/slices/terminal-helpers'
+import { selectColdParkedTerminalWorktrees } from '@/components/terminal-pane/terminal-hidden-view-parking'
+import {
+  canWatcherCoverParkedTerminalTab,
+  disposeAllParkedTerminalWatchers
+} from '@/components/terminal-pane/terminal-parked-tab-watchers'
+import { useTerminalTabColdParking } from '@/components/terminal-pane/use-terminal-tab-cold-parking'
+
+const { request } = vi.hoisted(() => ({ request: vi.fn() }))
+
+vi.mock('../../src/main/ipc/ssh', () => ({
+  getActiveMultiplexer: () => ({ request })
+}))
+
+vi.mock('@/components/terminal-pane/parked-terminal-byte-watcher', () => ({
+  startParkedTerminalByteWatcher: () => () => {}
+}))
+
+const START_MS = 1_000_000
+const TARGET_ID = 'ssh-parking-host'
+const TARGET: SshTarget = {
+  id: TARGET_ID,
+  label: 'SSH',
+  host: 'example.test',
+  port: 22,
+  username: 'dev'
+}
+const ptyIdFor = (tabId: string): string => `ssh:${TARGET_ID}@@${tabId}`
+const WORKTREE_ID = 'repo-ssh::/work/ssh-parking'
+const LEAF_ID = '11111111-1111-4111-8111-111111111111'
+const TABS = ['tab-a', 'tab-b'].map((id) =>
+  makeTerminalTab({ id, worktreeId: WORKTREE_ID, ptyId: ptyIdFor(id) })
+)
+const ASSIGNMENTS = new Map<string, { groupId: string; isActiveInGroup: boolean }>()
+const PORTALS: never[] = []
+const mounts = new Map<string, number>()
+const authority: DirectSshAuthority = {
+  targetId: TARGET_ID,
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: main-issued opaque tokens are stable strings; this fixture models one unchanged provider incarnation.
+  providerEpoch: 'parking-provider' as SshProviderEpoch,
+  connectionGeneration: 1
+}
+let parkedTabIds: ReadonlySet<string> = new Set()
+
+function AttachedPane({ tabId }: { tabId: string }): null {
+  useEffect(() => {
+    mounts.set(tabId, (mounts.get(tabId) ?? 0) + 1)
+    // Model transport attachment completing through the real store action.
+    const timer = setTimeout(() => {
+      useAppStore.getState().updateTabPtyId(tabId, ptyIdFor(tabId))
+    }, 1_100)
+    return () => clearTimeout(timer)
+  }, [tabId])
+  return null
+}
+
+function ParkingHost(): React.JSX.Element {
+  const tabsByWorktree = useAppStore((state) => state.tabsByWorktree)
+  const pendingStartupByTabId = useAppStore((state) => state.pendingStartupByTabId)
+  const terminalTabs = tabsByWorktree[WORKTREE_ID]
+  const parkedWorktrees = selectColdParkedTerminalWorktrees({
+    worktrees: [
+      {
+        worktreeId: WORKTREE_ID,
+        terminalTabs,
+        hiddenSinceMs: START_MS - 6 * 60_000,
+        isVisible: false,
+        shouldMeasureHiddenWorktree: false,
+        hasActivityTerminalPortal: false
+      },
+      {
+        worktreeId: 'retained-peer',
+        terminalTabs: [],
+        hiddenSinceMs: START_MS - 5 * 60_000,
+        isVisible: false,
+        shouldMeasureHiddenWorktree: false,
+        hasActivityTerminalPortal: false
+      }
+    ],
+    pendingStartupByTabId,
+    parkingEnabled: true,
+    restorePolicy: { sshParkingEnabled: true },
+    nowMs: START_MS
+  })
+  parkedTabIds = useTerminalTabColdParking({
+    worktreeId: WORKTREE_ID,
+    terminalTabs,
+    assignments: ASSIGNMENTS,
+    isWorktreeActive: false,
+    activeTerminalTabId: null,
+    coldParkTerminalPanes:
+      parkedWorktrees.has(WORKTREE_ID) &&
+      terminalTabs.every((tab) => canWatcherCoverParkedTerminalTab(WORKTREE_ID, tab)),
+    shouldMeasureHiddenWorktree: false,
+    activityTerminalPortals: PORTALS
+  })
+  return createElement(
+    Fragment,
+    null,
+    terminalTabs.map((tab) =>
+      parkedTabIds.has(tab.id) ? null : createElement(AttachedPane, { key: tab.id, tabId: tab.id })
+    )
+  )
+}
+
+function ownSnapshot(revision: number): RemoteWorkspaceSnapshot {
+  return {
+    namespace: 'workspace',
+    revision,
+    updatedAt: Date.now(),
+    schemaVersion: 1,
+    session: exportRemoteWorkspaceSession(buildWorkspaceSessionPayload(useAppStore.getState()), {
+      isTargetWorktree: (id) => id === WORKTREE_ID
+    })
+  }
+}
+
+async function applySnapshot(snapshot: RemoteWorkspaceObservedSnapshot): Promise<void> {
+  const result = await applyDirectSshRemoteWorkspaceSnapshot({
+    store: useAppStore,
+    snapshot,
+    token: {
+      authority,
+      catalogRevision: 0,
+      repoFingerprint: 'parking-repo',
+      authorityRequirement: 'required',
+      snapshotRevision: snapshot.revision,
+      outcome: 'complete'
+    },
+    arrival: snapshot.revision,
+    isArrivalCurrent: () => true,
+    isPreparationTokenCurrent: () => true,
+    waitForWorkspaceSessionReady: async () => true,
+    finalizeHydratedTerminals: () => useAppStore.getState().retryDirectSshTargetPanes(authority)
+  })
+  expect(result).toBe('applied')
+}
+
+async function deliverReadAfterOwnReply(own: RemoteWorkspaceSnapshot, read = own): Promise<void> {
+  request.mockResolvedValue(read)
+  let releaseRead: ((snapshot: RemoteWorkspaceSnapshot) => void) | undefined
+  request.mockImplementationOnce(
+    () =>
+      new Promise<RemoteWorkspaceSnapshot>((resolve) => {
+        releaseRead = resolve
+      })
+  )
+  const applies: Promise<void>[] = []
+  const errors: unknown[] = []
+  const resync = resyncStaleRemoteWorkspace(
+    TARGET,
+    (snapshot) => {
+      applies.push(applySnapshot(snapshot))
+    },
+    (error) => errors.push(error)
+  )
+  expect(request).toHaveBeenLastCalledWith('workspace.get', { namespace: expect.any(String) })
+  rememberLocallyPatchedRemoteWorkspaceSnapshot(TARGET_ID, own)
+  await act(async () => {
+    releaseRead?.(read)
+    await resync
+    await Promise.all(applies)
+  })
+  expect(errors).toEqual([])
+}
+
+describe('direct SSH snapshot delivery and parking', () => {
+  beforeEach(() => {
+    vi.useFakeTimers()
+    vi.setSystemTime(START_MS)
+    mounts.clear()
+    request.mockReset()
+    clearRemoteWorkspaceSnapshotCache()
+    _resetRemoteWorkspaceStaleResyncForTests()
+    Object.defineProperty(window, 'api', {
+      configurable: true,
+      value: {
+        pty: {
+          onData: () => () => {},
+          onReplay: () => () => {},
+          onExit: () => () => {}
+        }
+      }
+    })
+    disposeAllParkedTerminalWatchers()
+    useAppStore.setState({
+      ...useAppStore.getInitialState(),
+      workspaceSessionReady: true,
+      hydrationSucceeded: true,
+      repos: [
+        {
+          id: 'repo-ssh',
+          path: '/work',
+          displayName: 'SSH',
+          badgeColor: 'blue',
+          addedAt: 0,
+          connectionId: TARGET_ID
+        }
+      ],
+      worktreesByRepo: {
+        'repo-ssh': [
+          makeWorktree({
+            id: WORKTREE_ID,
+            repoId: 'repo-ssh',
+            path: '/work/ssh-parking',
+            hostId: `ssh:${TARGET_ID}`
+          })
+        ]
+      },
+      sshConnectionStates: new Map([
+        [TARGET_ID, { ...authority, status: 'connected', error: null, reconnectAttempt: 0 }]
+      ]),
+      tabsByWorktree: { [WORKTREE_ID]: TABS },
+      ptyIdsByTabId: Object.fromEntries(TABS.map((tab) => [tab.id, [ptyIdFor(tab.id)]])),
+      lastKnownRelayPtyIdByTabId: Object.fromEntries(TABS.map((tab) => [tab.id, ptyIdFor(tab.id)])),
+      terminalLayoutsByTabId: Object.fromEntries(
+        TABS.map((tab) => [tab.id, singlePaneLayoutSnapshot(LEAF_ID, ptyIdFor(tab.id))])
+      )
+    })
+  })
+
+  afterEach(() => {
+    cleanup()
+    disposeAllParkedTerminalWatchers()
+    useAppStore.setState(useAppStore.getInitialState(), true)
+    vi.useRealTimers()
+  })
+
+  it('keeps panes parked through pending-read own echoes while still applying a peer edit', async () => {
+    render(createElement(ParkingHost))
+    expect(parkedTabIds).toEqual(new Set(TABS.map((tab) => tab.id)))
+    expect(mounts.size).toBe(0)
+    rememberRemoteWorkspaceSnapshot(TARGET_ID, ownSnapshot(0))
+
+    // Visibility, ordering, measurement and saved PTY coverage stay unchanged throughout.
+
+    for (let revision = 1; revision <= 4; revision += 1) {
+      act(() => {
+        vi.advanceTimersByTime(2_000)
+        useAppStore.getState().updateTabTitle('tab-a', `Local title ${revision}`)
+      })
+      await deliverReadAfterOwnReply(ownSnapshot(revision))
+      expect(parkedTabIds).toEqual(new Set(TABS.map((tab) => tab.id)))
+      expect(mounts.size).toBe(0)
+    }
+
+    const own = ownSnapshot(5)
+    const peer = structuredClone(own)
+    peer.revision = 6
+    for (const tabs of Object.values(peer.session.tabsByWorktreePath)) {
+      for (const tab of tabs) {
+        if (tab.id === 'tab-a') {
+          tab.title = 'Peer title'
+        }
+      }
+    }
+    await deliverReadAfterOwnReply(own, peer)
+    expect(useAppStore.getState().tabsByWorktree[WORKTREE_ID][0].title).toBe('Peer title')
+    expect([...mounts.values()]).toEqual([1, 1])
+    expect(parkedTabIds.size).toBe(0)
+    act(() => vi.advanceTimersByTime(1_100))
+    expect(parkedTabIds).toEqual(new Set(TABS.map((tab) => tab.id)))
+    expect(useAppStore.getState().tabsByWorktree[WORKTREE_ID].map((tab) => tab.ptyId)).toEqual(
+      TABS.map((tab) => ptyIdFor(tab.id))
+    )
+  })
+})
diff --git a/tests/e2e/finished-agent-ghost-resume.spec.ts b/tests/e2e/finished-agent-ghost-resume.spec.ts
index 5d135161f086..6022edbf2016 100644
--- a/tests/e2e/finished-agent-ghost-resume.spec.ts
+++ b/tests/e2e/finished-agent-ghost-resume.spec.ts
@@ -1,3 +1,7 @@
+import {
+  readPersistedProfileState,
+  mutateStoppedProfileState
+} from './helpers/persisted-profile-state'
 /**
  * A LOCAL agent that FINISHED its turn must not be respawned when the app
  * reopens the workspace.
@@ -15,8 +19,7 @@
  *   pnpm exec playwright test tests/e2e/finished-agent-ghost-resume.spec.ts \
  *     --config tests/playwright.config.ts --project electron-headless --workers=1
  */
-import { existsSync, readFileSync, writeFileSync } from 'node:fs'
-import path from 'node:path'
+import { existsSync, readFileSync } from 'node:fs'
 import type { ElectronApplication } from '@stablyai/playwright-test'
 import { test, expect } from './helpers/orca-app'
 import { TEST_REPO_PATH_FILE } from './global-setup'
@@ -31,7 +34,6 @@ import {
 import { ensureTerminalVisible, waitForActiveWorktree, waitForSessionReady } from './helpers/store'
 import { attachRepoAndOpenTerminal, createRestartSession } from './helpers/orca-restart'
 import { createHostRendererTerminalTab } from './helpers/host-created-terminal-retention-oracle'
-import { DEFAULT_LOCAL_ORCA_PROFILE_ID } from '../../src/shared/orca-profiles'
 
 const PROVIDER_SESSION_ID = 'e2e-finished-agent-session'
 
@@ -43,13 +45,8 @@ type PersistedRecord = {
 }
 
 function readPersistedRecords(userDataDir: string): Record<string, PersistedRecord> {
-  const dataPath = path.join(
-    userDataDir,
-    'profiles',
-    DEFAULT_LOCAL_ORCA_PROFILE_ID,
-    'orca-data.json'
-  )
-  const data = JSON.parse(readFileSync(dataPath, 'utf8')) as {
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: This test owns the persisted fixture; optional fields are checked at use sites.
+  const data = readPersistedProfileState(userDataDir) as {
     workspaceSession?: { sleepingAgentSessionsByPaneKey?: Record<string, PersistedRecord> }
   }
   return data.workspaceSession?.sleepingAgentSessionsByPaneKey ?? {}
@@ -57,24 +54,20 @@ function readPersistedRecords(userDataDir: string): Record<string, PersistedReco
 
 /** Make the resume hermetic: the respawned tab echoes instead of running codex. */
 function stubPersistedResumeCommand(userDataDir: string): PersistedRecord {
-  const dataPath = path.join(
-    userDataDir,
-    'profiles',
-    DEFAULT_LOCAL_ORCA_PROFILE_ID,
-    'orca-data.json'
-  )
-  const data = JSON.parse(readFileSync(dataPath, 'utf8')) as {
-    workspaceSession?: { sleepingAgentSessionsByPaneKey?: Record<string, PersistedRecord> }
-  }
-  const record = Object.values(data.workspaceSession?.sleepingAgentSessionsByPaneKey ?? {}).find(
-    (candidate) => candidate.providerSession?.id === PROVIDER_SESSION_ID
-  )
-  if (!record) {
-    throw new Error('Expected the finished agent turn to leave a persisted record')
-  }
-  record.launchConfig = { agentCommand: 'echo', agentArgs: '', agentEnv: {} }
-  writeFileSync(dataPath, `${JSON.stringify(data, null, 2)}\n`, 'utf8')
-  return record
+  return mutateStoppedProfileState(userDataDir, (state) => {
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: This test owns the persisted fixture; optional fields are checked at use sites.
+    const data = state as {
+      workspaceSession?: { sleepingAgentSessionsByPaneKey?: Record<string, PersistedRecord> }
+    }
+    const record = Object.values(data.workspaceSession?.sleepingAgentSessionsByPaneKey ?? {}).find(
+      (candidate) => candidate.providerSession?.id === PROVIDER_SESSION_ID
+    )
+    if (!record) {
+      throw new Error('Expected the finished agent turn to leave a persisted record')
+    }
+    record.launchConfig = { agentCommand: 'echo', agentArgs: '', agentEnv: {} }
+    return record
+  })
 }
 
 test.describe.configure({ mode: 'serial' })
diff --git a/tests/e2e/global-setup-cli-artifact.unit.test.ts b/tests/e2e/global-setup-cli-artifact.unit.test.ts
new file mode 100644
index 000000000000..4c22d1a219d5
--- /dev/null
+++ b/tests/e2e/global-setup-cli-artifact.unit.test.ts
@@ -0,0 +1,85 @@
+import path from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+const fixture = vi.hoisted(() => ({
+  exec: vi.fn(),
+  exists: vi.fn(),
+  write: vi.fn()
+}))
+
+vi.mock('node:child_process', () => ({ execSync: fixture.exec }))
+vi.mock('node:fs', () => ({
+  existsSync: fixture.exists,
+  mkdirSync: vi.fn(),
+  mkdtempSync: (prefix: string) => `${prefix}fixture`,
+  realpathSync: (value: string) => value,
+  writeFileSync: fixture.write
+}))
+vi.mock('./helpers/docker-ssh-relay-image', () => ({ prepareDockerSshRelayImage: vi.fn() }))
+
+import globalSetup from './global-setup'
+
+beforeEach(() => {
+  vi.resetAllMocks()
+  fixture.exists.mockReturnValue(true)
+  for (const name of [
+    'SKIP_BUILD',
+    'ORCA_E2E_WEB_CLIENT',
+    'ORCA_E2E_SSH_LOCALHOST',
+    'ORCA_E2E_SSH_DOCKER',
+    'ORCA_E2E_NESTED_RUNTIME_SSH',
+    'ORCA_E2E_SKILL_STAGING',
+    'ORCA_E2E_TEST_REPO_PATH_FILE'
+  ]) {
+    vi.stubEnv(name, '')
+  }
+})
+
+afterEach(() => vi.unstubAllEnvs())
+
+function commands(): string[] {
+  return fixture.exec.mock.calls.map(([command]) => command)
+}
+
+describe('E2E shared CLI artifact', () => {
+  it('repairs downloaded permissions and installs the local launcher without recompiling', () => {
+    vi.stubEnv('SKIP_BUILD', '1')
+    globalSetup()
+    const prepare = commands().find((command) => command.includes('prepare:cli-output'))
+    expect(prepare).toBe('pnpm run prepare:cli-output')
+    expect(commands()).not.toContain('pnpm run build:cli')
+    expect(commands()).toContain('git init')
+    expect(fixture.exec.mock.calls.find(([command]) => command === prepare)?.[1]).toEqual({
+      cwd: process.cwd(),
+      stdio: 'inherit',
+      timeout: 120_000
+    })
+  })
+
+  it('builds a missing CLI even when the other artifacts exist', () => {
+    vi.stubEnv('SKIP_BUILD', '1')
+    fixture.exists.mockImplementation(
+      (file) => file !== path.join(process.cwd(), 'out', 'cli', 'index.js')
+    )
+    globalSetup()
+    expect(commands()).toContain('pnpm run build:cli')
+    expect(commands().some((command) => command.includes('prepare:cli-output'))).toBe(false)
+  })
+
+  it('rebuilds existing artifacts when reuse is not requested', () => {
+    globalSetup()
+    expect(commands()).toContain('npx electron-vite build --mode e2e')
+    expect(commands()).toContain('pnpm run build:cli')
+  })
+
+  it('fails setup if the downloaded CLI cannot be verified', () => {
+    vi.stubEnv('SKIP_BUILD', '1')
+    fixture.exec.mockImplementation((command) => {
+      if (command.includes('prepare:cli-output')) {
+        throw new Error('Invalid CLI artifact')
+      }
+    })
+    expect(() => globalSetup()).toThrow('Invalid CLI artifact')
+    expect(commands()).not.toContain('git init')
+  })
+})
diff --git a/tests/e2e/global-setup.ts b/tests/e2e/global-setup.ts
index cd5d9b3c4e0b..210c713159b1 100644
--- a/tests/e2e/global-setup.ts
+++ b/tests/e2e/global-setup.ts
@@ -54,6 +54,12 @@ export default function globalSetup(): void {
   }
   if (process.env.SKIP_BUILD && existsSync(outCli)) {
     console.error('[e2e] SKIP_BUILD set and out/cli/index.js exists — skipping CLI build')
+    // Artifact downloads lose executable bits; each runner still needs its local dev launcher.
+    execSync('pnpm run prepare:cli-output', {
+      cwd: root,
+      stdio: 'inherit',
+      timeout: CLI_E2E_BUILD_TIMEOUT_MS
+    })
   } else {
     console.error('[e2e] Building bundled CLI...')
     execSync('pnpm run build:cli', {
diff --git a/tests/e2e/headless-serve-desktop-activation.spec.ts b/tests/e2e/headless-serve-desktop-activation.spec.ts
index 1d4b4a0f82c3..673f548d18c8 100644
--- a/tests/e2e/headless-serve-desktop-activation.spec.ts
+++ b/tests/e2e/headless-serve-desktop-activation.spec.ts
@@ -1,3 +1,4 @@
+import { readPersistedProfileState } from './helpers/persisted-profile-state'
 import { spawn, type ChildProcess } from 'node:child_process'
 import { existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
 import os from 'node:os'
@@ -31,7 +32,6 @@ import type {
 } from '../../src/shared/runtime-types'
 import { PROTOCOL_VERSION } from '../../src/main/daemon/types'
 import { parsePaneKey } from '../../src/shared/stable-pane-id'
-import { DEFAULT_LOCAL_ORCA_PROFILE_ID } from '../../src/shared/orca-profiles'
 
 const electronPackageDir = path.join(process.cwd(), 'node_modules', 'electron')
 const electronPath = path.join(
@@ -76,12 +76,8 @@ function readPersistedPromotionBinding(
   leafId: string
 ): { tabId: string; leafId: string; ptyId: string } | null {
   try {
-    const persisted = JSON.parse(
-      readFileSync(
-        path.join(userDataDir, 'profiles', DEFAULT_LOCAL_ORCA_PROFILE_ID, 'orca-data.json'),
-        'utf8'
-      )
-    ) as {
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: This test owns the persisted fixture; optional fields are checked at use sites.
+    const persisted = readPersistedProfileState(userDataDir) as {
       workspaceSession?: {
         tabsByWorktree?: Record<string, { id?: string; ptyId?: string | null }[]>
         terminalLayoutsByTabId?: Record<string, { ptyIdsByLeafId?: Record<string, string | null> }>
diff --git a/tests/e2e/helpers/completed-worker-retirement-fixture.ts b/tests/e2e/helpers/completed-worker-retirement-fixture.ts
index d3ef3fb8195a..5ac0d8c1948e 100644
--- a/tests/e2e/helpers/completed-worker-retirement-fixture.ts
+++ b/tests/e2e/helpers/completed-worker-retirement-fixture.ts
@@ -1,3 +1,4 @@
+import { readPersistedProfileState } from './persisted-profile-state'
 import { execFileSync } from 'node:child_process'
 import {
   chmodSync,
@@ -11,7 +12,6 @@ import {
 import os from 'node:os'
 import path from 'node:path'
 import type { RuntimeClient } from '../../../src/cli/runtime-client'
-import { DEFAULT_LOCAL_ORCA_PROFILE_ID } from '../../../src/shared/orca-profiles'
 import type {
   RuntimeTerminalListResult,
   RuntimeTerminalSummary
@@ -194,16 +194,8 @@ export async function listRuntimeTerminals(
 }
 
 export function readPersistedWorkerRecoveryRecord(userDataDir: string, paneKey: string) {
-  const dataPath = path.join(
-    userDataDir,
-    'profiles',
-    DEFAULT_LOCAL_ORCA_PROFILE_ID,
-    'orca-data.json'
-  )
-  if (!existsSync(dataPath)) {
-    return null
-  }
-  const data = JSON.parse(readFileSync(dataPath, 'utf8')) as {
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: This test owns the persisted fixture; optional fields are checked at use sites.
+  const data = readPersistedProfileState(userDataDir) as {
     workspaceSession?: {
       sleepingAgentSessionsByPaneKey?: Record<
         string,
diff --git a/tests/e2e/helpers/computer-driver.ts b/tests/e2e/helpers/computer-driver.ts
index bc7e7a0acb8b..aa1c8cecb8fa 100644
--- a/tests/e2e/helpers/computer-driver.ts
+++ b/tests/e2e/helpers/computer-driver.ts
@@ -10,6 +10,7 @@ import {
   stopOrcaRuntime,
   type CliResult
 } from './computer-cli-driver'
+import { quotePowerShellLiteral } from '../../../src/shared/powershell-native-argument'
 
 const execFileAsync = promisify(execFile)
 let textEditTempDir: string | null = null
@@ -185,7 +186,7 @@ export async function ensureNotepadLaunched(): Promise<void> {
     '-NoProfile',
     '-NonInteractive',
     '-Command',
-    `Start-Process notepad.exe -ArgumentList ${powerShellSingleQuoted(filePath)}`
+    `Start-Process notepad.exe -ArgumentList ${quotePowerShellLiteral(filePath)}`
   ])
   notepadAppSelector = `pid:${await findNotepadWindowPid(filePath)}`
 }
@@ -232,7 +233,7 @@ function delay(ms: number): Promise<void> {
 async function findNotepadWindowPid(filePath: string): Promise<number> {
   const targetName = filePath.split(/[\\/]/).at(-1) ?? filePath
   const script = [
-    `$targetName = ${powerShellSingleQuoted(targetName)}`,
+    `$targetName = ${quotePowerShellLiteral(targetName)}`,
     '$deadline = (Get-Date).AddSeconds(15)',
     '$target = $null',
     'while ((Get-Date) -lt $deadline -and $null -eq $target) {',
@@ -260,10 +261,6 @@ async function findNotepadWindowPid(filePath: string): Promise<number> {
   return Number.parseInt(result.stdout.trim(), 10)
 }
 
-function powerShellSingleQuoted(value: string): string {
-  return `'${value.replaceAll("'", "''")}'`
-}
-
 function escapeAppleScript(value: string): string {
   return value.replaceAll('\\', '\\\\').replaceAll('"', '\\"')
 }
diff --git a/tests/e2e/helpers/daemon-generation-runtime-fixture.ts b/tests/e2e/helpers/daemon-generation-runtime-fixture.ts
index 88111024368d..332d21aa2712 100644
--- a/tests/e2e/helpers/daemon-generation-runtime-fixture.ts
+++ b/tests/e2e/helpers/daemon-generation-runtime-fixture.ts
@@ -1,4 +1,12 @@
-import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import {
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  rmSync,
+  symlinkSync,
+  writeFileSync
+} from 'node:fs'
 import { homedir, tmpdir } from 'node:os'
 import path from 'node:path'
 import { build } from 'esbuild'
@@ -109,6 +117,12 @@ export async function createDaemonGenerationRuntime(
   const reconnectClientEntryPath = path.join(rootDir, 'daemon-generation-reconnect-client.cjs')
   const legacyCloseClientEntryPath = path.join(rootDir, 'daemon-generation-legacy-close-client.cjs')
   const repoRoot = process.cwd()
+  // ESM imports in the bundled fixture resolve from its temp directory, not NODE_PATH.
+  symlinkSync(
+    path.join(repoRoot, 'node_modules'),
+    path.join(rootDir, 'node_modules'),
+    process.platform === 'win32' ? 'junction' : 'dir'
+  )
   await buildFixtureEntry(
     path.join(repoRoot, 'tests/e2e/fixtures/daemon-generation-entry.ts'),
     entryPath
diff --git a/tests/e2e/helpers/docker-ssh-relay-target.ts b/tests/e2e/helpers/docker-ssh-relay-target.ts
index f535b22d0737..9d96859968ee 100644
--- a/tests/e2e/helpers/docker-ssh-relay-target.ts
+++ b/tests/e2e/helpers/docker-ssh-relay-target.ts
@@ -200,6 +200,36 @@ export function blockDockerSshRelayTargetTcpForwarding(target: DockerSshRelayTar
   )
 }
 
+/**
+ * Makes the target unreachable over SSH while the container, its fixtures and `docker exec` stay
+ * up: sshd re-binds to the container's loopback, so the published port stops reaching it. Only new
+ * connections are refused; an established session lives until its client closes it. Returns once
+ * a real ssh client fails to connect, so a config that silently failed to apply surfaces here.
+ */
+export function refuseDockerSshRelayTargetConnections(target: DockerSshRelayTarget): void {
+  // Why HUP, not a restart: see blockDockerSshRelayTargetTcpForwarding — PID 1 is sshd.
+  execDockerSshRelayTargetControlCommand(
+    target,
+    "printf '%s\\n' 'ListenAddress 127.0.0.1' >> /etc/ssh/sshd_config; kill -HUP 1"
+  )
+  const deadline = Date.now() + 60_000
+  let lastProbe = ''
+  while (Date.now() < deadline) {
+    const result = spawnSync('ssh', sshArgs(target, 'true'), {
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'pipe'],
+      timeout: 15_000
+    })
+    lastProbe = result.stderr || result.stdout || `exit ${result.status}`
+    // Why the auth check: a refusal must look like a dead host, never a credential prompt.
+    if (result.status !== 0 && !/permission denied/i.test(lastProbe)) {
+      return
+    }
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 500)
+  }
+  throw new Error(`sshd kept accepting connections after ListenAddress 127.0.0.1: ${lastProbe}`)
+}
+
 export function writeDockerSshRelayTargetFile(
   target: DockerSshRelayTarget,
   filePath: string,
diff --git a/tests/e2e/helpers/electron-launch-args.ts b/tests/e2e/helpers/electron-launch-args.ts
index 6868f48b083e..e749945eddb4 100644
--- a/tests/e2e/helpers/electron-launch-args.ts
+++ b/tests/e2e/helpers/electron-launch-args.ts
@@ -1,12 +1,14 @@
 import { dirname } from 'node:path'
 
+export function getElectronIsolatedKeychainArgs(): string[] {
+  // Isolated macOS profiles must not invoke the system keychain UI.
+  return process.platform === 'darwin' ? ['--password-store=basic', '--use-mock-keychain'] : []
+}
+
 export function getOrcaElectronLaunchArgs(mainPath: string, headful: boolean): string[] {
   // Launch through package.json so app version and resource paths match a packaged app.
   const appPath = dirname(dirname(dirname(mainPath)))
-  // Isolated macOS profiles must not invoke the system keychain UI. Without
-  // these Chromium switches startup can block before the first renderer target.
-  const keychainArgs =
-    process.platform === 'darwin' ? ['--password-store=basic', '--use-mock-keychain'] : []
+  const keychainArgs = getElectronIsolatedKeychainArgs()
   if (process.platform === 'darwin') {
     // Crash tests must not block later launches on AppKit's saved-window recovery dialog.
     return [...keychainArgs, appPath, '-ApplePersistenceIgnoreState', 'YES']
diff --git a/tests/e2e/helpers/electron-launch-args.unit.test.ts b/tests/e2e/helpers/electron-launch-args.unit.test.ts
index c538d6f9a850..301548a9f4e7 100644
--- a/tests/e2e/helpers/electron-launch-args.unit.test.ts
+++ b/tests/e2e/helpers/electron-launch-args.unit.test.ts
@@ -1,10 +1,24 @@
 import { join } from 'node:path'
 import { afterEach, describe, expect, it, vi } from 'vitest'
-import { getOrcaElectronLaunchArgs } from './electron-launch-args'
+import { getElectronIsolatedKeychainArgs, getOrcaElectronLaunchArgs } from './electron-launch-args'
 
 describe('getOrcaElectronLaunchArgs', () => {
   afterEach(() => vi.unstubAllGlobals())
 
+  it.each(['darwin', 'linux', 'win32'])(
+    'isolates packaged and source test keychains on %s',
+    (platform) => {
+      vi.stubGlobal('process', { ...process, platform })
+      const args = getElectronIsolatedKeychainArgs()
+      expect(args).toEqual(
+        platform === 'darwin' ? ['--password-store=basic', '--use-mock-keychain'] : []
+      )
+      expect(getOrcaElectronLaunchArgs(join('orca', 'out', 'main', 'index.js'), false)).toEqual(
+        expect.arrayContaining(args)
+      )
+    }
+  )
+
   it.each([
     ['linux', 'true', true, true],
     ['linux', undefined, true, false],
diff --git a/tests/e2e/helpers/electron-main-evaluate-retry.ts b/tests/e2e/helpers/electron-main-evaluate-retry.ts
index 502e93152a0f..c7794c407287 100644
--- a/tests/e2e/helpers/electron-main-evaluate-retry.ts
+++ b/tests/e2e/helpers/electron-main-evaluate-retry.ts
@@ -1,13 +1,13 @@
 const MAIN_EVALUATE_ATTEMPTS = 5
 const MAIN_EVALUATE_RETRY_MS = 200
 
-/**
- * Playwright raises this message for any main-process CDP failure that is neither
- * a JS error nor a closed session, so it does not mean anything navigated — it is
- * also what a handle the main process has not finished publishing looks like.
- */
+// Startup can invalidate the CDP context or collect a pending evaluation promise.
 function isTransientMainEvaluateError(error: unknown): boolean {
-  return error instanceof Error && error.message.includes('Execution context was destroyed')
+  return (
+    error instanceof Error &&
+    (error.message.includes('Execution context was destroyed') ||
+      error.message.includes('Resulting promise was garbage collected'))
+  )
 }
 
 function waitBeforeRetry(): Promise<void> {
diff --git a/tests/e2e/helpers/electron-main-evaluate-retry.unit.test.ts b/tests/e2e/helpers/electron-main-evaluate-retry.unit.test.ts
index 7909a4d6eab3..c6735e2fd1f8 100644
--- a/tests/e2e/helpers/electron-main-evaluate-retry.unit.test.ts
+++ b/tests/e2e/helpers/electron-main-evaluate-retry.unit.test.ts
@@ -1,8 +1,10 @@
 import { describe, expect, it } from 'vitest'
 import { retryTransientMainEvaluate } from './electron-main-evaluate-retry'
 
-const transient = (): Error =>
-  new Error('Execution context was destroyed, most likely because of a navigation.')
+const transientMessages = [
+  'Execution context was destroyed, most likely because of a navigation.',
+  'electronApplication.evaluate: Resulting promise was garbage collected.'
+]
 
 describe('retryTransientMainEvaluate', () => {
   it('returns the first successful read without retrying', async () => {
@@ -16,13 +18,13 @@ describe('retryTransientMainEvaluate', () => {
     expect(calls).toBe(1)
   })
 
-  it('rides out the startup window that made the paired-client launch flaky', async () => {
+  it.each(transientMessages)('retries a transient startup failure: %s', async (message) => {
     let calls = 0
     await expect(
       retryTransientMainEvaluate(async () => {
         calls += 1
         if (calls < 3) {
-          throw transient()
+          throw new Error(message)
         }
         return '/isolated/home'
       })
@@ -41,14 +43,30 @@ describe('retryTransientMainEvaluate', () => {
     expect(calls).toBe(1)
   })
 
-  it('gives up rather than looping forever when the app never becomes evaluable', async () => {
+  it.each(transientMessages)(
+    'bounds retries when evaluation keeps failing: %s',
+    async (message) => {
+      let calls = 0
+      await expect(
+        retryTransientMainEvaluate(async () => {
+          calls += 1
+          throw new Error(message)
+        })
+      ).rejects.toThrow(message)
+      expect(calls).toBe(5)
+    }
+  )
+
+  it('does not retry a closed application', async () => {
     let calls = 0
     await expect(
       retryTransientMainEvaluate(async () => {
         calls += 1
-        throw transient()
+        throw new Error(
+          'electronApplication.evaluate: Target page, context or browser has been closed'
+        )
       })
-    ).rejects.toThrow(/Execution context was destroyed/)
-    expect(calls).toBe(5)
+    ).rejects.toThrow(/has been closed/)
+    expect(calls).toBe(1)
   })
 })
diff --git a/tests/e2e/helpers/electron-process-shutdown.ts b/tests/e2e/helpers/electron-process-shutdown.ts
index f9b642a676e9..5d78b761b966 100644
--- a/tests/e2e/helpers/electron-process-shutdown.ts
+++ b/tests/e2e/helpers/electron-process-shutdown.ts
@@ -157,11 +157,20 @@ async function forceKillProcessTree(proc: ChildProcess): Promise<void> {
  * Use `closeElectronAppForE2E` for an ordinary quit — this exists for specs that need a client to
  * vanish without unwinding its sockets or subscriptions.
  */
-export async function forceQuitElectronAppForE2E(app: ElectronApplication): Promise<void> {
+export async function forceQuitElectronAppForE2E(
+  app: ElectronApplication,
+  options: { preserveDaemons?: boolean } = {}
+): Promise<void> {
   const proc = app.process()
   const pid = proc.pid
   if (pid) {
-    if (process.platform === 'win32') {
+    if (options.preserveDaemons) {
+      // Chromium helpers hold Windows profile handles; Electron's list excludes detached daemons.
+      const appPids = await app.evaluate(({ app }) => app.getAppMetrics().map(({ pid }) => pid))
+      for (const targetPid of new Set([pid, ...appPids])) {
+        killPid(targetPid, 'SIGKILL')
+      }
+    } else if (process.platform === 'win32') {
       try {
         execFileSync('taskkill', ['/pid', String(pid), '/T', '/F'], {
           stdio: 'ignore'
@@ -178,8 +187,12 @@ export async function forceQuitElectronAppForE2E(app: ElectronApplication): Prom
   }
   await waitForExit(proc, PROCESS_EXIT_TIMEOUT_MS)
   releaseExitedProcessPipes(proc)
-  // Hands the dead app back to Playwright so worker teardown has nothing left to wait on.
-  await app.close().catch(() => undefined)
+  // Playwright close can remain pending after an external force-kill.
+  await withTimeout(
+    app.close(),
+    PROCESS_EXIT_TIMEOUT_MS,
+    'Timed out releasing killed Electron app'
+  ).catch(() => undefined)
 }
 
 export async function closeElectronAppForE2E(app: ElectronApplication): Promise<void> {
diff --git a/tests/e2e/helpers/orca-restart.ts b/tests/e2e/helpers/orca-restart.ts
index 2560fde154d8..8be4adb79f84 100644
--- a/tests/e2e/helpers/orca-restart.ts
+++ b/tests/e2e/helpers/orca-restart.ts
@@ -20,6 +20,7 @@ import { existsSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:
 import { createServer } from 'node:net'
 import os from 'node:os'
 import path from 'node:path'
+import { runProcess, type ProcessResult } from '../../../src/shared/child-process/run-process'
 import { getE2ECompletedOnboardingProfile } from './e2e-completed-onboarding-profile'
 import { getOrcaElectronLaunchArgs } from './electron-launch-args'
 import { retryTransientMainEvaluate } from './electron-main-evaluate-retry'
@@ -51,6 +52,7 @@ type RestartSession = {
   userDataDir: string
   seedCodexResumeRollout: (sessionId: string, cwd: string) => string
   launch: (options?: LaunchOptions) => Promise<LaunchedOrca>
+  launchUntilExit: (executablePath: string) => Promise<ProcessResult>
   /** Gracefully close a launch, letting beforeunload flush session state. */
   close: (app: ElectronApplication) => Promise<void>
   /** Remove the shared userDataDir after the test is done. */
@@ -190,23 +192,45 @@ export function createRestartSession(
     }
     try {
       const resolvedHome = await retryTransientMainEvaluate(() =>
-        app.evaluate(({ app }) => app.getPath('home'))
+        app.evaluate(({ app }) => {
+          // This fixture owns every launch; native relaunch leaves an unattached Playwright child.
+          app.relaunch = () => {}
+          return app.getPath('home')
+        })
       )
       assertElectronResolvedIsolatedHome(resolvedHome, homeIsolation)
+      const page = await app.firstWindow({ timeout: 120_000 })
+      await page.waitForLoadState('domcontentloaded')
+      await page.waitForFunction(() => Boolean(window.__store), null, { timeout: 30_000 })
+      return { app, page }
     } catch (error) {
       await closeElectronAppForE2E(app)
       throw error
     }
-    const page = await app.firstWindow({ timeout: 120_000 })
-    await page.waitForLoadState('domcontentloaded')
-    await page.waitForFunction(() => Boolean(window.__store), null, { timeout: 30_000 })
-    return { app, page }
   }
 
   const close = async (app: ElectronApplication): Promise<void> => {
     await closeElectronAppForE2E(app)
   }
 
+  // Startup refusals exit before a renderer exists; capture their output from process creation.
+  const launchUntilExit = async (executablePath: string): Promise<ProcessResult> => {
+    runtimeWsPort ??= await reserveRestartRuntimeWsPort()
+    return runProcess({
+      program: executablePath,
+      args: getOrcaElectronLaunchArgs(mainPath, false),
+      env: {
+        ...homeIsolation.env,
+        ORCA_BACKGROUND_LAUNCH: '1',
+        ORCA_E2E_HEADLESS: '1',
+        ORCA_E2E_RUNTIME_WS_PORT: String(runtimeWsPort)
+      },
+      timeoutMs: 30_000,
+      detached: process.platform !== 'win32',
+      terminationBarrier: true
+    })
+  }
+
   const dispose = async (): Promise<void> => {
     await cleanupE2EDaemons(userDataDir)
     if (process.env.ORCA_E2E_PRESERVE_RESTART_PROFILE === '1') {
@@ -218,7 +242,7 @@ export function createRestartSession(
     }
   }
 
-  return { userDataDir, seedCodexResumeRollout, launch, close, dispose }
+  return { userDataDir, seedCodexResumeRollout, launch, launchUntilExit, close, dispose }
 }
 
 /**
diff --git a/tests/e2e/helpers/pdf-find-fixture.ts b/tests/e2e/helpers/pdf-find-fixture.ts
new file mode 100644
index 000000000000..fb7d90d6292a
--- /dev/null
+++ b/tests/e2e/helpers/pdf-find-fixture.ts
@@ -0,0 +1,35 @@
+export function createPdfFindFixture(): Buffer {
+  const objects = [
+    '<< /Type /Catalog /Pages 2 0 R >>',
+    '<< /Type /Pages /Kids [4 0 R 6 0 R 8 0 R] /Count 3 >>',
+    '<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica >>'
+  ]
+  for (let page = 0; page < 3; page += 1) {
+    const contentId = 5 + page * 2
+    objects.push(
+      `<< /Type /Page /Parent 2 0 R /MediaBox [0 0 612 792] /Resources << /Font << /F1 3 0 R >> >> /Contents ${contentId} 0 R >>`
+    )
+    const lines = [
+      `PDF search fixture - page ${page + 1}`,
+      `needle result ${page * 2 + 1}`,
+      `needle result ${page * 2 + 2}`,
+      page === 1 ? 'Plain text without the alternate query' : 'beacon alternate query'
+    ]
+    const stream = `BT /F1 20 Tf 60 700 Td 40 TL ${lines.map((line) => `(${line}) Tj T*`).join(' ')} ET\n`
+    objects.push(`<< /Length ${Buffer.byteLength(stream)} >>\nstream\n${stream}endstream`)
+  }
+  let pdf = '%PDF-1.4\n'
+  const offsets = [0]
+  for (const [index, object] of objects.entries()) {
+    offsets.push(Buffer.byteLength(pdf))
+    pdf += `${index + 1} 0 obj\n${object}\nendobj\n`
+  }
+  const xref = Buffer.byteLength(pdf)
+  pdf += `xref\n0 ${objects.length + 1}\n0000000000 65535 f \n`
+  pdf += offsets
+    .slice(1)
+    .map((offset) => `${String(offset).padStart(10, '0')} 00000 n \n`)
+    .join('')
+  pdf += `trailer\n<< /Size ${objects.length + 1} /Root 1 0 R >>\nstartxref\n${xref}\n%%EOF\n`
+  return Buffer.from(pdf)
+}
diff --git a/tests/e2e/helpers/persisted-profile-state.ts b/tests/e2e/helpers/persisted-profile-state.ts
new file mode 100644
index 000000000000..02e00a89873d
--- /dev/null
+++ b/tests/e2e/helpers/persisted-profile-state.ts
@@ -0,0 +1,60 @@
+import { join } from 'node:path'
+import { DEFAULT_LOCAL_ORCA_PROFILE_ID } from '../../../src/shared/orca-profiles'
+import {
+  acquireProfileStateMaintenance,
+  acquireProfileStateRuntimeAdmission
+} from '../../../src/main/persistence/profile-state/profile-state-access'
+import { openProfileStateDatabaseReadOnly } from '../../../src/main/persistence/profile-state/profile-state-database'
+import { readProfileStateParsedSnapshot } from '../../../src/main/persistence/profile-state/profile-state-documents'
+import { parseProfileStateRoot } from '../../../src/main/persistence/profile-state/profile-state-document-validation'
+import { ProfileStateSqliteAuthority } from '../../../src/main/persistence/profile-state/profile-state-sqlite-authority'
+
+/** Read committed storage without consulting a retained migration JSON snapshot. */
+export function readPersistedProfileState(
+  userDataDir: string,
+  profileId = DEFAULT_LOCAL_ORCA_PROFILE_ID
+): Record<string, unknown> {
+  const admission = acquireProfileStateRuntimeAdmission(userDataDir)
+  try {
+    const opened = openProfileStateDatabaseReadOnly(
+      join(userDataDir, 'profiles', profileId, 'profile-state.db'),
+      profileId
+    )
+    try {
+      return readProfileStateParsedSnapshot(opened.db).state
+    } finally {
+      opened.db.close()
+    }
+  } finally {
+    admission.release()
+  }
+}
+
+/** Seed restart artifacts only while no runtime or other fixture writer owns the profile. */
+export function mutateStoppedProfileState<T>(
+  userDataDir: string,
+  mutate: (state: Record<string, unknown>) => T,
+  profileId = DEFAULT_LOCAL_ORCA_PROFILE_ID
+): T {
+  const maintenance = acquireProfileStateMaintenance(userDataDir)
+  const authority = new ProfileStateSqliteAuthority(
+    join(userDataDir, 'profiles', profileId, 'profile-state.db'),
+    profileId
+  )
+  try {
+    const serialized = authority.readSerializedState()
+    if (serialized === undefined) {
+      throw new Error('Expected an established profile before seeding restart state')
+    }
+    const state = parseProfileStateRoot(serialized)
+    const result = mutate(state)
+    authority.writeSerializedState(Buffer.from(JSON.stringify(state)))
+    return result
+  } finally {
+    try {
+      authority.close()
+    } finally {
+      maintenance.release()
+    }
+  }
+}
diff --git a/tests/e2e/helpers/persisted-profile-state.unit.test.ts b/tests/e2e/helpers/persisted-profile-state.unit.test.ts
new file mode 100644
index 000000000000..50588174d27b
--- /dev/null
+++ b/tests/e2e/helpers/persisted-profile-state.unit.test.ts
@@ -0,0 +1,71 @@
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, expect, it } from 'vitest'
+import { openProfileStateDatabase } from '../../../src/main/persistence/profile-state/profile-state-database'
+import { importProfileStateJson } from '../../../src/main/persistence/profile-state/profile-state-documents'
+import { acquireProfileStateRuntimeAdmission } from '../../../src/main/persistence/profile-state/profile-state-access'
+import { mutateStoppedProfileState, readPersistedProfileState } from './persisted-profile-state'
+
+const roots: string[] = []
+afterEach(() => {
+  for (const root of roots.splice(0)) {
+    rmSync(root, { recursive: true, force: true })
+  }
+})
+
+function fixture() {
+  const root = mkdtempSync(join(tmpdir(), 'orca-persisted-test-state-'))
+  roots.push(root)
+  const directory = join(root, 'profiles', 'local-default')
+  mkdirSync(directory, { recursive: true })
+  const databaseFile = join(directory, 'profile-state.db')
+  const dataFile = join(directory, 'orca-data.json')
+  const state = { settings: { sealed: 'ciphertext' }, unknown: { kept: null, output: '\ud800' } }
+  const opened = openProfileStateDatabase(databaseFile, 'local-default')
+  try {
+    importProfileStateJson(opened.db, JSON.stringify(state))
+  } finally {
+    opened.db.close()
+  }
+  writeFileSync(dataFile, '{"retained":"old migration snapshot"}')
+  return { root, databaseFile, dataFile, state }
+}
+
+it('reads committed SQLite and changes stopped fixtures without rewriting retained JSON', () => {
+  const item = fixture()
+  const before = readFileSync(item.dataFile)
+  expect(readPersistedProfileState(item.root)).toEqual(item.state)
+  const result = mutateStoppedProfileState(item.root, (state) => {
+    expect(() => acquireProfileStateRuntimeAdmission(item.root)).toThrow()
+    state.fixture = { changed: true }
+    return 'complete'
+  })
+  expect(result).toBe('complete')
+  expect(readPersistedProfileState(item.root)).toEqual({
+    ...item.state,
+    fixture: { changed: true }
+  })
+  expect(readFileSync(item.dataFile)).toEqual(before)
+})
+
+it('refuses a fixture write while a runtime is admitted and releases the refused owner', () => {
+  const item = fixture()
+  const runtime = acquireProfileStateRuntimeAdmission(item.root)
+  try {
+    expect(() => mutateStoppedProfileState(item.root, () => {})).toThrow()
+    expect(readPersistedProfileState(item.root)).toEqual(item.state)
+  } finally {
+    runtime.release()
+  }
+  expect(() => mutateStoppedProfileState(item.root, () => {})).not.toThrow()
+})
+
+it('does not create missing authority when a test points at the wrong profile', () => {
+  const item = fixture()
+  rmSync(item.databaseFile)
+  expect(() => mutateStoppedProfileState(item.root, () => {})).toThrow()
+  expect(existsSync(item.databaseFile)).toBe(false)
+  const runtime = acquireProfileStateRuntimeAdmission(item.root)
+  runtime.release()
+})
diff --git a/tests/e2e/helpers/ssh-reconnect-failure-observation.ts b/tests/e2e/helpers/ssh-reconnect-failure-observation.ts
new file mode 100644
index 000000000000..4a1dd4f9d58c
--- /dev/null
+++ b/tests/e2e/helpers/ssh-reconnect-failure-observation.ts
@@ -0,0 +1,120 @@
+import type { Page, TestInfo } from '@stablyai/playwright-test'
+import {
+  execDockerSshRelayTargetControlCommand,
+  type DockerSshRelayTarget
+} from './docker-ssh-relay-target'
+import { getTerminalContent, readPaneIdentitySnapshot } from './terminal-pane-identity'
+
+export async function attachSshReconnectFailureObservation(
+  page: Page,
+  testInfo: TestInfo,
+  target: DockerSshRelayTarget | null,
+  targetId: string | null,
+  originalPtyId: string | null
+): Promise<void> {
+  const observations: Record<string, unknown> = { originalPtyId, targetId }
+  const observe = async (name: string, read: () => unknown): Promise<void> => {
+    let timer: ReturnType<typeof setTimeout> | undefined
+    try {
+      observations[name] = await Promise.race([
+        Promise.resolve().then(read),
+        new Promise((_, reject) => {
+          timer = setTimeout(() => reject(new Error('Observation timed out')), 5_000)
+        })
+      ])
+    } catch (error) {
+      observations[name] = { error: String(error) }
+    } finally {
+      clearTimeout(timer)
+    }
+  }
+  await Promise.all([
+    observe('paneIdentity', () => readPaneIdentitySnapshot(page)),
+    observe('renderedContent', () => getTerminalContent(page, 8000)),
+    observe('renderer', () =>
+      page.evaluate((targetId) => {
+        const state = window.__store?.getState()
+        const worktreeId = state?.activeWorktreeId
+        return {
+          authority: targetId ? state?.sshConnectionStates.get(targetId) : null,
+          worktreeId,
+          activeTabId: state?.activeTabId,
+          tabs: worktreeId
+            ? state?.tabsByWorktree[worktreeId]?.map(({ id, title }) => ({ id, title }))
+            : null,
+          panes: [...(window.__paneManagers?.entries() ?? [])].map(([tabId, manager]) => ({
+            tabId,
+            diagnostics: manager.getRenderingDiagnostics()
+          }))
+        }
+      }, targetId)
+    ),
+    observe('pty', () =>
+      page.evaluate(async (originalPtyId) => {
+        const ids = new Set<string>(originalPtyId ? [originalPtyId] : [])
+        for (const manager of window.__paneManagers?.values() ?? []) {
+          for (const pane of manager.getPanes()) {
+            const id = pane.container.dataset.ptyId
+            if (id) {
+              ids.add(id)
+            }
+          }
+        }
+        const read = async (request: Promise<unknown>): Promise<unknown> => {
+          let timer: ReturnType<typeof setTimeout> | undefined
+          try {
+            return await Promise.race([
+              request,
+              new Promise((_, reject) => {
+                timer = setTimeout(() => reject(new Error('PTY observation timed out')), 3_000)
+              })
+            ])
+          } catch (error) {
+            return { error: String(error) }
+          } finally {
+            clearTimeout(timer)
+          }
+        }
+        const [delivery, processes] = await Promise.all([
+          read(window.api.pty.getRendererDeliveryDebugSnapshot()),
+          Promise.all(
+            [...ids].map(async (id) => {
+              const [process, buffer] = await Promise.all([
+                read(window.api.pty.inspectProcess(id, { scanChildProcesses: true })),
+                read(
+                  window.api.pty.getMainBufferSnapshot(id, { scrollbackRows: 40 }).then((buffer) =>
+                    buffer
+                      ? {
+                          source: buffer.source,
+                          seq: buffer.seq,
+                          alternateScreen: buffer.alternateScreen,
+                          cols: buffer.cols,
+                          rows: buffer.rows,
+                          data: buffer.data.slice(-8000),
+                          scrollbackAnsi: buffer.scrollbackAnsi?.slice(-8000)
+                        }
+                      : null
+                  )
+                )
+              ])
+              return { id, process, buffer }
+            })
+          )
+        ])
+        return { delivery, processes }
+      }, originalPtyId)
+    )
+  ])
+  if (target) {
+    await observe('remoteProcesses', () =>
+      execDockerSshRelayTargetControlCommand(
+        target,
+        'ps -eo pid,ppid,pgid,sid,tpgid,stat,comm,args'
+      )
+    )
+  }
+  await testInfo.attach('ssh-reconnect-failure.json', {
+    body: JSON.stringify(observations, null, 2),
+    contentType: 'application/json'
+  })
+}
diff --git a/tests/e2e/helpers/terminal-restart-persistence.ts b/tests/e2e/helpers/terminal-restart-persistence.ts
new file mode 100644
index 000000000000..46ba4efda9fb
--- /dev/null
+++ b/tests/e2e/helpers/terminal-restart-persistence.ts
@@ -0,0 +1,186 @@
+import { readFileSync, existsSync } from 'node:fs'
+import type { ElectronApplication, Page } from '@stablyai/playwright-test'
+import { test, expect } from './orca-app'
+import { TEST_REPO_PATH_FILE } from '../global-setup'
+import { attachRepoAndOpenTerminal } from './orca-restart'
+import { discoverActivePtyId, waitForActiveTerminalManager, waitForPaneCount } from './terminal'
+import {
+  waitForSessionReady,
+  waitForActiveWorktree,
+  getActiveWorktreeId,
+  getActiveTabId,
+  ensureTerminalVisible
+} from './store'
+
+const REQUIRE_WINDOWS_TERMINAL_RESTART_E2E =
+  process.env.ORCA_REQUIRE_WINDOWS_TERMINAL_RESTART_E2E === '1'
+const MISSING_SEEDED_REPO_MESSAGE = 'Global setup did not produce a seeded test repo'
+
+export function seededRepoPathOrSkip(): string {
+  const repoPath = existsSync(TEST_REPO_PATH_FILE)
+    ? readFileSync(TEST_REPO_PATH_FILE, 'utf-8').trim()
+    : ''
+  const unavailable = !repoPath || !existsSync(repoPath)
+  if (unavailable && REQUIRE_WINDOWS_TERMINAL_RESTART_E2E) {
+    throw new Error('Required Windows restart E2E seeded repo is unavailable')
+  }
+  test.skip(unavailable, MISSING_SEEDED_REPO_MESSAGE)
+  return repoPath
+}
+
+/**
+ * Shared bootstrap for a *first* launch: attach the seeded test repo,
+ * activate its worktree, ensure a terminal is mounted, and return the
+ * PTY id we can drive with `execInTerminal`.
+ *
+ * Why: every test in this file needs the exact same starting state on the
+ * first launch. Inlining it would obscure the thing each test is actually
+ * asserting about the *second* launch.
+ */
+export async function bootstrapFirstLaunch(
+  page: Page,
+  repoPath: string
+): Promise<{ worktreeId: string; ptyId: string }> {
+  const worktreeId = await attachRepoAndOpenTerminal(page, repoPath)
+  await waitForSessionReady(page)
+  await waitForActiveWorktree(page)
+  await ensureTerminalVisible(page)
+
+  const hasPaneManager = await waitForActiveTerminalManager(page, 30_000)
+    .then(() => true)
+    .catch(() => false)
+  if (!hasPaneManager && REQUIRE_WINDOWS_TERMINAL_RESTART_E2E) {
+    throw new Error('Required Windows restart E2E TerminalPane manager did not mount')
+  }
+  test.skip(
+    !hasPaneManager,
+    'Electron automation in this environment never mounts the TerminalPane manager, so restart-persistence assertions would only fail on harness setup.'
+  )
+  await waitForPaneCount(page, 1, 30_000)
+
+  const ptyId = await discoverActivePtyId(page)
+  return { worktreeId, ptyId }
+}
+
+/**
+ * Shared bootstrap for a *second* launch: just wait for the session to
+ * restore, and confirm the previously-active worktree is the active one
+ * again so downstream assertions operate against the right worktree.
+ */
+export async function bootstrapRestoredLaunch(
+  page: Page,
+  expectedWorktreeId: string
+): Promise<void> {
+  await waitForSessionReady(page)
+  await expect
+    .poll(async () => getActiveWorktreeId(page), { timeout: 10_000 })
+    .toBe(expectedWorktreeId)
+  await ensureTerminalVisible(page)
+  // Why: the PaneManager remounts asynchronously after session hydration. The
+  // restored terminal surface is what we're about to assert against, so make
+  // sure it exists before any content/layout assertion races.
+  await waitForActiveTerminalManager(page, 30_000)
+  await waitForPaneCount(page, 1, 30_000)
+}
+
+export async function setPaneTitleFromTerminalMenu(page: Page, title: string): Promise<void> {
+  const modifiers: ('Alt' | 'Control' | 'Meta' | 'Shift')[] =
+    process.platform === 'win32' ? ['Control'] : []
+  await page
+    .locator('.xterm:visible')
+    .first()
+    .click({ button: 'right', position: { x: 40, y: 40 }, modifiers })
+  await page.getByText('Set Title…', { exact: true }).click()
+  const titleInput = page.locator('.pane-title-input').first()
+  await expect(titleInput).toBeVisible()
+  await titleInput.fill(title)
+  await titleInput.press('Enter')
+}
+
+export async function getTabCustomTitle(
+  page: Page,
+  worktreeId: string,
+  tabId: string
+): Promise<string | null> {
+  return page.evaluate(
+    ({ targetWorktreeId, targetTabId }) => {
+      const state = window.__store!.getState()
+      const tab = (state.tabsByWorktree[targetWorktreeId] ?? []).find(
+        (entry) => entry.id === targetTabId
+      )
+      return tab?.customTitle ?? null
+    },
+    { targetWorktreeId: worktreeId, targetTabId: tabId }
+  )
+}
+
+export async function readTerminalActiveLine(page: Page): Promise<string | null> {
+  const tabId = await getActiveTabId(page)
+  if (!tabId) {
+    return null
+  }
+  return page.evaluate((tabId) => {
+    const manager = window.__paneManagers?.get(tabId)
+    const pane = manager?.getActivePane?.() ?? manager?.getPanes?.()[0] ?? null
+    const buffer = pane?.terminal?.buffer.active
+    if (!buffer) {
+      return null
+    }
+    const cursorLine = buffer.baseY + buffer.cursorY
+    return buffer.getLine(cursorLine)?.translateToString(true) ?? null
+  }, tabId)
+}
+
+export async function waitForTerminalActiveLine(page: Page, expectedText: string): Promise<string> {
+  await expect
+    .poll(async () => (await readTerminalActiveLine(page))?.includes(expectedText), {
+      timeout: 15_000,
+      message: `Terminal cursor line did not contain "${expectedText}"`
+    })
+    .toBe(true)
+
+  const activeLine = await readTerminalActiveLine(page)
+  if (activeLine === null) {
+    throw new Error('Terminal cursor line disappeared after settling')
+  }
+  return activeLine
+}
+
+export async function waitForElectronProcessExit(app: ElectronApplication): Promise<void> {
+  const process = app.process()
+  if (process.exitCode !== null || process.signalCode !== null) {
+    return
+  }
+  await new Promise<void>((resolve, reject) => {
+    const timeout = setTimeout(() => {
+      process.off('exit', onExit)
+      reject(new Error('Electron profile-switch relaunch did not exit'))
+    }, 15_000)
+    const onExit = (): void => {
+      clearTimeout(timeout)
+      process.off('exit', onExit)
+      resolve()
+    }
+    process.once('exit', onExit)
+  })
+}
+
+export async function expectSavedLayoutToContainTitle(
+  page: Page,
+  tabId: string,
+  title: string
+): Promise<void> {
+  await expect
+    .poll(
+      () =>
+        page.evaluate(
+          ({ targetTabId, title }) => {
+            const layout = window.__store!.getState().terminalLayoutsByTabId[targetTabId]
+            return Object.values(layout?.titlesByLeafId ?? {}).includes(title)
+          },
+          { targetTabId: tabId, title }
+        ),
+      { timeout: 3_000 }
+    )
+    .toBe(true)
+}
diff --git a/tests/e2e/local-ssh-browser-routing.spec.ts b/tests/e2e/local-ssh-browser-routing.spec.ts
index e2f5249c93c0..427d6ebd6d14 100644
--- a/tests/e2e/local-ssh-browser-routing.spec.ts
+++ b/tests/e2e/local-ssh-browser-routing.spec.ts
@@ -6,6 +6,7 @@ import { waitForSessionReady } from './helpers/store'
 import {
   blockDockerSshRelayTargetTcpForwarding,
   cleanupDockerSshRelayTarget,
+  refuseDockerSshRelayTargetConnections,
   startDockerSshRelayTarget,
   type DockerSshRelayTarget
 } from './helpers/docker-ssh-relay-target'
@@ -88,6 +89,17 @@ async function readSshState(page: Page, targetId: string): Promise<SshState> {
   }, targetId)
 }
 
+/**
+ * The status the panes read. Main's `ssh:getState` drops a target's entry on disconnect and on a
+ * failed connect, so only the renderer store still holds a settled failure verdict.
+ */
+async function readRendererSshStatus(page: Page, targetId: string): Promise<string | null> {
+  return page.evaluate(
+    (targetId) => window.__store?.getState().sshConnectionStates.get(targetId)?.status ?? null,
+    targetId
+  )
+}
+
 /**
  * `ssh:connect` short-circuits for a still-live session, so an advancing generation here is proof
  * the `kill -9` actually landed rather than an artifact of asking for a reconnect.
@@ -570,6 +582,9 @@ test('holds the mount and offers a working local escape hatch when the SSH host
     const worktreeId = remote.worktreeId
 
     await installBrowserPaneMountCensus(orcaPage)
+    // Why: the workspace's terminal redials a disconnected host, and a redial that connects
+    // rightly recovers the route; only a host that stays unreachable can hold the card.
+    refuseDockerSshRelayTargetConnections(target)
     await orcaPage.evaluate(
       async (targetId) => window.api.ssh.disconnect({ targetId }),
       remote.targetId
@@ -620,6 +635,17 @@ test('holds the mount and offers a working local escape hatch when the SSH host
     ).toHaveCount(0)
 
     // (d) The escape hatch, proven by an origin only this device can reach.
+    await expect
+      .poll(() => readRendererSshStatus(orcaPage, remote.targetId), {
+        timeout: 180_000,
+        message: 'the redial of an unreachable host must settle as a failure, not an auth prompt'
+      })
+      .toMatch(/^(disconnected|error|reconnection-failed)$/)
+    await expect(strandedPane.getByText(SSH_UNAVAILABLE_TITLE)).toBeVisible()
+    expect(
+      (await readSshState(orcaPage, remote.targetId)).status,
+      'a host that reconnected would make this escape hatch vacuous'
+    ).not.toBe('connected')
     await strandedPane.getByRole('button', { name: BROWSE_LOCALLY_LABEL }).click()
     await expect
       .poll(
diff --git a/tests/e2e/markdown-callout-source-fidelity.spec.ts b/tests/e2e/markdown-callout-source-fidelity.spec.ts
new file mode 100644
index 000000000000..82fdf9c26ced
--- /dev/null
+++ b/tests/e2e/markdown-callout-source-fidelity.spec.ts
@@ -0,0 +1,95 @@
+import { readFileSync } from 'node:fs'
+import { test, expect } from './helpers/orca-app'
+import { waitForActiveWorktree, waitForSessionReady } from './helpers/store'
+import {
+  cleanupMarkdownFixture,
+  closeActiveEditorTab,
+  createMarkdownFixture,
+  getActiveWorktreeContext,
+  openMarkdownFixture,
+  waitForRichMarkdownEditor
+} from './helpers/markdown-editor-fixture'
+
+const ARTICLE = [
+  '---',
+  'title: Turing-Test',
+  'draft: true',
+  '---',
+  '',
+  '# Der Turing-Test',
+  '',
+  'First paragraph with user_name_field and feature~2.',
+  '',
+  '> [!wissenswert] Das Original war ein Ratespiel',
+  '> In Turings Aufsatz heißt der Test "Imitation Game".',
+  '',
+  'Second paragraph with a literal * and an unmatched `.',
+  '',
+  '> [!zeitstrahl] 75 Jahre Imitation Game',
+  '> - 1950 · Alan Turing veröffentlicht seinen Aufsatz.',
+  '> - 1980 · John Searle widerspricht.',
+  '',
+  'Third paragraph to edit.',
+  '',
+  '> [!NOTE]',
+  '> Keep this callout unchanged.',
+  '',
+  '> [!selbsttest]',
+  '> - Was bedeutet Intelligenz?',
+  ''
+].join('\n')
+
+for (const large of [false, true]) {
+  test(`keeps callout source byte-for-byte across edits, save and reopen (${large ? 'large' : 'article'})`, async ({
+    orcaPage
+  }, testInfo) => {
+    await waitForSessionReady(orcaPage)
+    await waitForActiveWorktree(orcaPage)
+    const context = await getActiveWorktreeContext(orcaPage)
+    const source = ARTICLE + (large ? `\n${'Unchanged user_name prose. '.repeat(2_100)}\n` : '')
+    const filePath = await createMarkdownFixture(
+      context,
+      'callout-fidelity',
+      'article',
+      testInfo.workerIndex,
+      source
+    )
+    try {
+      await openMarkdownFixture(orcaPage, context, filePath)
+      const editor = await waitForRichMarkdownEditor(orcaPage)
+      await expect(editor).toContainText('[!wissenswert]')
+      let expected = source
+      for (const prefix of ['First paragraph', 'Second paragraph', 'Third paragraph']) {
+        const paragraph = editor.locator('p').filter({ hasText: prefix }).first()
+        await paragraph.click()
+        await paragraph.evaluate((element) => {
+          const range = document.createRange()
+          range.selectNodeContents(element)
+          range.collapse(true)
+          const selection = window.getSelection()!
+          selection.removeAllRanges()
+          selection.addRange(range)
+        })
+        await orcaPage.keyboard.insertText('Edited ')
+        expected = expected.replace(prefix, `Edited ${prefix}`)
+        await orcaPage.keyboard.press('ControlOrMeta+S')
+        await expect.poll(() => readFileSync(filePath, 'utf8')).toBe(expected)
+      }
+      await testInfo.attach('saved-source', { body: expected, contentType: 'text/markdown' })
+      await closeActiveEditorTab(orcaPage, filePath)
+      await openMarkdownFixture(orcaPage, context, filePath)
+      const reopened = await waitForRichMarkdownEditor(orcaPage)
+      await expect(reopened).toContainText('Edited First paragraph')
+      await expect(reopened).toContainText('Edited Third paragraph')
+      await expect(reopened.locator('blockquote')).toHaveCount(4)
+      await expect(reopened).toContainText('[!zeitstrahl]')
+      await testInfo.attach('reopened-article', {
+        body: await orcaPage.screenshot({ path: testInfo.outputPath('reopened-article.png') }),
+        contentType: 'image/png'
+      })
+      expect(readFileSync(filePath, 'utf8')).toBe(expected)
+    } finally {
+      await cleanupMarkdownFixture(filePath)
+    }
+  })
+}
diff --git a/tests/e2e/native-chat-history-prepend-anchor.spec.ts b/tests/e2e/native-chat-history-prepend-anchor.spec.ts
index d299cadae6e9..236d30c4475c 100644
--- a/tests/e2e/native-chat-history-prepend-anchor.spec.ts
+++ b/tests/e2e/native-chat-history-prepend-anchor.spec.ts
@@ -138,6 +138,13 @@ test.describe('Native chat transcript anchoring', () => {
         sessionId,
         transcriptPath
       })
+      // Exercise the supported manual paging fallback while the reader stays mid-transcript.
+      await orcaPage.evaluate(() => {
+        Object.defineProperty(window, 'IntersectionObserver', {
+          value: undefined,
+          configurable: true
+        })
+      })
       await toggleTerminalTabToChatView(orcaPage, {
         tabId,
         worktreeId: descriptor.worktreeId
diff --git a/tests/e2e/native-chat-message-rail.spec.ts b/tests/e2e/native-chat-message-rail.spec.ts
index 25ca0a4745bc..16d01060224e 100644
--- a/tests/e2e/native-chat-message-rail.spec.ts
+++ b/tests/e2e/native-chat-message-rail.spec.ts
@@ -143,7 +143,7 @@ test.describe('Native chat message rail', () => {
 
     // Activating the hover preview transfers focus into the prompt picker.
     await rail.press('Enter')
-    await expect(panel.getByRole('button').first()).toBeFocused()
+    await expect(panel.locator('button[data-current="true"]')).toBeFocused()
     await panel.getByRole('button', { name: 'Question 5:', exact: false }).click()
     await expect(panel).not.toBeVisible()
     const target = transcriptWindow.locator('[data-index="10"]')
diff --git a/tests/e2e/orchestration-legacy-worker-missing-terminal-recovery.spec.ts b/tests/e2e/orchestration-legacy-worker-missing-terminal-recovery.spec.ts
index 73527afa50dc..28d8f5565df5 100644
--- a/tests/e2e/orchestration-legacy-worker-missing-terminal-recovery.spec.ts
+++ b/tests/e2e/orchestration-legacy-worker-missing-terminal-recovery.spec.ts
@@ -1,3 +1,4 @@
+import { readPersistedProfileState } from './helpers/persisted-profile-state'
 import { chmodSync, existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
 import os from 'node:os'
 import path from 'node:path'
@@ -17,7 +18,6 @@ import { DaemonClient } from '../../src/main/daemon/client'
 import { getDaemonSocketPath, getDaemonTokenPath } from '../../src/main/daemon/daemon-spawner'
 import Database from '../../src/main/sqlite/sync-database'
 import { LEGACY_CONTRACT_VERSION } from '../../src/main/runtime/orchestration/db'
-import { DEFAULT_LOCAL_ORCA_PROFILE_ID } from '../../src/shared/orca-profiles'
 import type { RuntimeTerminalListResult, RuntimeTerminalRead } from '../../src/shared/runtime-types'
 import {
   buildFakeAgentCommandOverride,
@@ -144,12 +144,9 @@ async function detachedDaemonSessionExists(userDataDir: string, ptyId: string):
   }
 }
 
-function persistedDataPath(userDataDir: string): string {
-  return path.join(userDataDir, 'profiles', DEFAULT_LOCAL_ORCA_PROFILE_ID, 'orca-data.json')
-}
-
 function hasPersistedResumeRecord(userDataDir: string, paneKey: string): boolean {
-  const data = JSON.parse(readFileSync(persistedDataPath(userDataDir), 'utf8')) as {
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: This test owns the persisted fixture; optional fields are checked at use sites.
+  const data = readPersistedProfileState(userDataDir) as {
     workspaceSession?: {
       sleepingAgentSessionsByPaneKey?: Record<string, { providerSession?: { id?: unknown } }>
     }
diff --git a/tests/e2e/orchestration-legacy-worker-restart-recovery.spec.ts b/tests/e2e/orchestration-legacy-worker-restart-recovery.spec.ts
index 68c508eca629..a7090c0fd924 100644
--- a/tests/e2e/orchestration-legacy-worker-restart-recovery.spec.ts
+++ b/tests/e2e/orchestration-legacy-worker-restart-recovery.spec.ts
@@ -1,3 +1,7 @@
+import {
+  readPersistedProfileState,
+  mutateStoppedProfileState
+} from './helpers/persisted-profile-state'
 import { chmodSync, existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
 import os from 'node:os'
 import path from 'node:path'
@@ -21,7 +25,6 @@ import {
   LEGACY_CONTRACT_VERSION,
   LEGACY_RUN_ID
 } from '../../src/main/runtime/orchestration/db'
-import { DEFAULT_LOCAL_ORCA_PROFILE_ID } from '../../src/shared/orca-profiles'
 import type { RuntimeTerminalListResult, RuntimeTerminalRead } from '../../src/shared/runtime-types'
 import { listAllOrchestrationRuns } from './orchestration-run-pages'
 import {
@@ -231,12 +234,9 @@ function isProcessAlive(pid: number): boolean {
   }
 }
 
-function persistedDataPath(userDataDir: string): string {
-  return path.join(userDataDir, 'profiles', DEFAULT_LOCAL_ORCA_PROFILE_ID, 'orca-data.json')
-}
-
 function readPersistedData(userDataDir: string): PersistedData {
-  return JSON.parse(readFileSync(persistedDataPath(userDataDir), 'utf8')) as PersistedData
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: This test owns the persisted fixture; optional fields are checked at use sites.
+  return readPersistedProfileState(userDataDir) as PersistedData
 }
 
 function hasPersistedResumeRecord(userDataDir: string, paneKey: string): boolean {
@@ -273,42 +273,44 @@ function stripLegacyWorkerRendererBinding(
     workerPaneKey: string
   }
 ): void {
-  const data = readPersistedData(userDataDir)
-  const session = data.workspaceSession
-  if (!session) {
-    throw new Error('Expected a persisted workspace session')
-  }
-  const sleeping = session.sleepingAgentSessionsByPaneKey?.[input.workerPaneKey]
-  if (sleeping?.providerSession?.id !== PROVIDER_SESSION_ID) {
-    throw new Error('Expected the legacy worker resume record before removing its tab binding')
-  }
-  session.tabsByWorktree = {
-    ...session.tabsByWorktree,
-    [input.worktreeId]: (session.tabsByWorktree?.[input.worktreeId] ?? []).filter(
-      (tab) => tab.id !== input.workerTabId
-    )
-  }
-  delete session.terminalLayoutsByTabId?.[input.workerTabId]
-  if (session.unifiedTabs?.[input.worktreeId]) {
-    session.unifiedTabs[input.worktreeId] = session.unifiedTabs[input.worktreeId].filter(
-      (tab) => tab.id !== input.workerTabId && tab.entityId !== input.workerTabId
-    )
-  }
-  for (const group of session.tabGroups?.[input.worktreeId] ?? []) {
-    group.tabOrder = group.tabOrder.filter((tabId) => tabId !== input.workerTabId)
-    group.recentTabIds = group.recentTabIds?.filter((tabId) => tabId !== input.workerTabId)
-    if (group.activeTabId === input.workerTabId) {
-      group.activeTabId = input.coordinatorTabId
+  return mutateStoppedProfileState(userDataDir, (state) => {
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: This test owns the persisted fixture; optional fields are checked at use sites.
+    const data = state as PersistedData
+    const session = data.workspaceSession
+    if (!session) {
+      throw new Error('Expected a persisted workspace session')
     }
-  }
-  session.activeTabId = input.coordinatorTabId
-  session.activeTabIdByWorktree = {
-    ...session.activeTabIdByWorktree,
-    [input.worktreeId]: input.coordinatorTabId
-  }
-  delete session.terminalPtyIncarnationsByPaneKey?.[input.workerPaneKey]
-  delete session.terminalSurfaceTombstonesByPaneKey?.[input.workerPaneKey]
-  writeFileSync(persistedDataPath(userDataDir), `${JSON.stringify(data, null, 2)}\n`, 'utf8')
+    const sleeping = session.sleepingAgentSessionsByPaneKey?.[input.workerPaneKey]
+    if (sleeping?.providerSession?.id !== PROVIDER_SESSION_ID) {
+      throw new Error('Expected the legacy worker resume record before removing its tab binding')
+    }
+    session.tabsByWorktree = {
+      ...session.tabsByWorktree,
+      [input.worktreeId]: (session.tabsByWorktree?.[input.worktreeId] ?? []).filter(
+        (tab) => tab.id !== input.workerTabId
+      )
+    }
+    delete session.terminalLayoutsByTabId?.[input.workerTabId]
+    if (session.unifiedTabs?.[input.worktreeId]) {
+      session.unifiedTabs[input.worktreeId] = session.unifiedTabs[input.worktreeId].filter(
+        (tab) => tab.id !== input.workerTabId && tab.entityId !== input.workerTabId
+      )
+    }
+    for (const group of session.tabGroups?.[input.worktreeId] ?? []) {
+      group.tabOrder = group.tabOrder.filter((tabId) => tabId !== input.workerTabId)
+      group.recentTabIds = group.recentTabIds?.filter((tabId) => tabId !== input.workerTabId)
+      if (group.activeTabId === input.workerTabId) {
+        group.activeTabId = input.coordinatorTabId
+      }
+    }
+    session.activeTabId = input.coordinatorTabId
+    session.activeTabIdByWorktree = {
+      ...session.activeTabIdByWorktree,
+      [input.worktreeId]: input.coordinatorTabId
+    }
+    delete session.terminalPtyIncarnationsByPaneKey?.[input.workerPaneKey]
+    delete session.terminalSurfaceTombstonesByPaneKey?.[input.workerPaneKey]
+  })
 }
 
 function assertDispatchRemainsCurrent(
diff --git a/tests/e2e/paired-client-hosted-browser-ghost-close.spec.ts b/tests/e2e/paired-client-hosted-browser-ghost-close.spec.ts
index b9cd2b35dc7d..bc6514a39041 100644
--- a/tests/e2e/paired-client-hosted-browser-ghost-close.spec.ts
+++ b/tests/e2e/paired-client-hosted-browser-ghost-close.spec.ts
@@ -1,4 +1,5 @@
-import { readdirSync, readFileSync, writeFileSync } from 'node:fs'
+import { readdirSync, existsSync } from 'node:fs'
+import { mutateStoppedProfileState } from './helpers/persisted-profile-state'
 import path from 'node:path'
 import { expect, test } from './helpers/orca-app'
 import { launchHeadlessPairedRuntimeHost } from './helpers/headless-paired-runtime-host'
@@ -35,61 +36,44 @@ const RECONNECT_GRACE_OVERSHOOT_MS = 20_000
  * nothing on the host answers for.
  */
 function forgetPersistedClientHostedPages(userDataDir: string): number {
-  return listOrcaDataFiles(userDataDir).reduce(
-    (total, dataFile) => total + forgetPersistedClientHostedPagesIn(dataFile),
-    0
-  )
-}
-
-/**
- * Every orca-data.json under a user-data dir.
- *
- * The live one is `profiles/<id>/orca-data.json`; the root file is only the harness's onboarding
- * seed, which the first boot migrates from. Reading the seed alone made the strip a no-op that
- * looked exactly like a runtime that had persisted nothing.
- */
-function listOrcaDataFiles(userDataDir: string): string[] {
   const profilesDir = path.join(userDataDir, 'profiles')
-  let profileFiles: string[] = []
-  try {
-    profileFiles = readdirSync(profilesDir, { withFileTypes: true })
-      .filter((entry) => entry.isDirectory())
-      .map((entry) => path.join(profilesDir, entry.name, 'orca-data.json'))
-  } catch {
-    // No profile directory yet; only the harness seed exists.
-  }
-  return [path.join(userDataDir, 'orca-data.json'), ...profileFiles].filter((file) => {
-    try {
-      readFileSync(file, 'utf8')
-      return true
-    } catch {
-      return false
-    }
-  })
-}
-
-function forgetPersistedClientHostedPagesIn(dataFile: string): number {
-  const state = JSON.parse(readFileSync(dataFile, 'utf8')) as {
-    workspaceSession?: { clientHostedBrowserPagesByWorktree?: Record<string, unknown[]> }
-    workspaceSessionsByHostId?: Record<
-      string,
-      { clientHostedBrowserPagesByWorktree?: Record<string, unknown[]> }
-    >
-  }
-  let forgotten = 0
-  for (const session of [
-    state.workspaceSession,
-    ...Object.values(state.workspaceSessionsByHostId ?? {})
-  ]) {
-    const rows = session?.clientHostedBrowserPagesByWorktree
-    if (!rows) {
-      continue
-    }
-    forgotten += Object.values(rows).reduce((total, list) => total + list.length, 0)
-    delete session.clientHostedBrowserPagesByWorktree
-  }
-  writeFileSync(dataFile, `${JSON.stringify(state, null, 2)}\n`)
-  return forgotten
+  return readdirSync(profilesDir, { withFileTypes: true })
+    .filter(
+      (entry) =>
+        entry.isDirectory() && existsSync(path.join(profilesDir, entry.name, 'profile-state.db'))
+    )
+    .reduce(
+      (total, entry) =>
+        total +
+        mutateStoppedProfileState(
+          userDataDir,
+          (raw) => {
+            // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: This test owns the persisted fixture; optional fields are checked at use sites.
+            const state = raw as {
+              workspaceSession?: { clientHostedBrowserPagesByWorktree?: Record<string, unknown[]> }
+              workspaceSessionsByHostId?: Record<
+                string,
+                { clientHostedBrowserPagesByWorktree?: Record<string, unknown[]> }
+              >
+            }
+            let forgotten = 0
+            for (const session of [
+              state.workspaceSession,
+              ...Object.values(state.workspaceSessionsByHostId ?? {})
+            ]) {
+              const rows = session?.clientHostedBrowserPagesByWorktree
+              if (!rows) {
+                continue
+              }
+              forgotten += Object.values(rows).reduce((count, list) => count + list.length, 0)
+              delete session.clientHostedBrowserPagesByWorktree
+            }
+            return forgotten
+          },
+          entry.name
+        ),
+      0
+    )
 }
 
 /**
diff --git a/tests/e2e/paired-remote-terminal-parked-scrollback-restart.spec.ts b/tests/e2e/paired-remote-terminal-parked-scrollback-restart.spec.ts
index 5d83bef49f46..608c31111af2 100644
--- a/tests/e2e/paired-remote-terminal-parked-scrollback-restart.spec.ts
+++ b/tests/e2e/paired-remote-terminal-parked-scrollback-restart.spec.ts
@@ -21,18 +21,18 @@
  *     the remote host's partition never received the capture (#21295). This is the test that fails
  *     with the fix reverted.
  *
- * The on-disk reader walks the local `workspaceSession` AND every `workspaceSessionsByHostId`
+ * The SQLite reader walks the local `workspaceSession` AND every `workspaceSessionsByHostId`
  * partition, and names the partition each reading came from — the issue's original "onDisk: 0" was a
  * reader that inspected only the local blob while the capture sat in the runtime partition, a
- * reading that could not contradict itself. An empty list means no session file at all (a deleted
- * profile), distinguished from an empty buffer.
+ * reading that could not contradict itself. A missing database fails the read; an empty list means
+ * no session partitions were persisted, distinguished from an empty buffer.
  *
  * Run:
  *   pnpm exec playwright test \
  *     tests/e2e/paired-remote-terminal-parked-scrollback-restart.spec.ts \
  *     --config tests/playwright.config.ts --project electron-headless --workers=1
  */
-import { globSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs'
 import { randomUUID } from 'node:crypto'
 import os from 'node:os'
 import path from 'node:path'
@@ -49,10 +49,12 @@ import {
   callEnvironment,
   createPairedHostTerminal,
   openPairedClientTab,
-  waitForPairedPaneMarker
+  waitForPairedPaneMarker,
+  type PairedHostTerminal
 } from './helpers/paired-host-terminal'
 import { focusActiveTerminalInput } from './helpers/terminal'
 import { waitForTabParked } from './helpers/terminal-hidden-parking'
+import { readPersistedProfileState } from './helpers/persisted-profile-state'
 
 const PARK_DELAY_MS = 2_000
 const PAINT_BUDGET_MS = 30_000
@@ -137,31 +139,21 @@ function stringRecord(value: unknown): Record<string, string> | undefined {
   )
 }
 
-/** Walks the local `workspaceSession` and every `workspaceSessionsByHostId` partition. An empty
- *  list means no session file was found at all — a reader problem, not an empty buffer. */
+/** Read committed session partitions without consulting the retained compatibility export. */
 function readOnDiskPartitions(userDataDir: string, webTabId: string): OnDiskPartitionReading[] {
+  const state = readPersistedProfileState(userDataDir)
   const readings: OnDiskPartitionReading[] = []
-  for (const file of globSync(path.join(userDataDir, '**', 'orca-data.json'))) {
-    try {
-      const parsed: unknown = JSON.parse(readFileSync(file, 'utf8'))
-      if (!isRecord(parsed)) {
-        continue
-      }
-      const local = readSessionPartition('local', parsed.workspaceSession, webTabId)
-      if (local) {
-        readings.push(local)
-      }
-      const partitions = isRecord(parsed.workspaceSessionsByHostId)
-        ? parsed.workspaceSessionsByHostId
-        : {}
-      for (const [hostId, session] of Object.entries(partitions)) {
-        const reading = readSessionPartition(hostId, session, webTabId)
-        if (reading) {
-          readings.push(reading)
-        }
-      }
-    } catch {
-      // A partially written profile is itself a datapoint; keep scanning the rest.
+  const local = readSessionPartition('local', state.workspaceSession, webTabId)
+  if (local) {
+    readings.push(local)
+  }
+  const partitions = isRecord(state.workspaceSessionsByHostId)
+    ? state.workspaceSessionsByHostId
+    : {}
+  for (const [hostId, session] of Object.entries(partitions)) {
+    const reading = readSessionPartition(hostId, session, webTabId)
+    if (reading) {
+      readings.push(reading)
     }
   }
   return readings
@@ -258,7 +250,7 @@ async function parkRemoteTerminalWithToken(
     fixtureCommand()
   )
   createdTerminals.push(target.terminal)
-  const decoys = []
+  const decoys: PairedHostTerminal[] = []
   for (let index = 0; index < 2; index += 1) {
     const decoy = await createPairedHostTerminal(
       client.page,
@@ -428,7 +420,7 @@ test.describe('host retains nothing', () => {
       expect({
         tokenBeforePark: parked.tokenBeforePark,
         capturedAtPark: parked.storeAtPark > 0,
-        // Distinguishes a deleted profile (no partitions) from an empty buffer.
+        // Distinguishes missing session partitions from an empty buffer.
         profileSurvived: onDiskAfterQuit.length > 0,
         runtimePartitionHoldsCapture: runtimePartitionBufferLength(onDiskAfterQuit) > 0,
         localPartitionDidNotKeepCapture: localPartitionBufferLength(onDiskAfterQuit) <= 0
diff --git a/tests/e2e/paired-remote-terminal-serve-restart-binding.spec.ts b/tests/e2e/paired-remote-terminal-serve-restart-binding.spec.ts
index b9d2242de223..7047f8a6dcb2 100644
--- a/tests/e2e/paired-remote-terminal-serve-restart-binding.spec.ts
+++ b/tests/e2e/paired-remote-terminal-serve-restart-binding.spec.ts
@@ -8,11 +8,13 @@
  *     tests/e2e/paired-remote-terminal-serve-restart-binding.spec.ts \
  *     --config tests/playwright.config.ts --project electron-headless --workers=1
  */
-import { readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { existsSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
 import path from 'node:path'
 import type { ElectronApplication, Page } from '@stablyai/playwright-test'
 import { getHistorySessionDirName } from '../../src/main/daemon/history-paths'
 import { LOG_HEADER_BYTES } from '../../src/main/daemon/terminal-history-log'
+import { profileStateDatabaseFile } from '../../src/main/persistence/profile-state/profile-state-database'
+import { ProfileStateSqliteAuthority } from '../../src/main/persistence/profile-state/profile-state-sqlite-authority'
 import { DEFAULT_LOCAL_ORCA_PROFILE_ID } from '../../src/shared/orca-profiles'
 import type { RuntimeMobileSessionTabsResult } from '../../src/shared/runtime-types'
 import { toRemoteRuntimePtyId } from '../../src/shared/remote-runtime-pty-id'
@@ -87,6 +89,80 @@ test.afterAll(() => {
   rmSync(scratch, { recursive: true, force: true })
 })
 
+test('SQLite candidate retains a remote automation run across serve restart', async ({
+  testRepoPath
+}) => {
+  test.setTimeout(240_000)
+
+  const host = await launchHeadlessPairedRuntimeHost({ pinnedServePort: true })
+  try {
+    const added = await host.client.call<{ repo: { id: string } }>('repo.add', {
+      path: testRepoPath,
+      kind: 'git'
+    })
+    const automation = await host.client.call<{ automation: { id: string } }>('automation.create', {
+      agentId: 'codex',
+      name: `remote-sqlite-restart-${Date.now()}`,
+      prompt: 'Retain this remote automation run through a SQLite-only serve restart.',
+      repo: `id:${added.result.repo.id}`,
+      runContext: {
+        kind: 'workspace-run',
+        projectId: added.result.repo.id,
+        hostId: 'runtime:missing',
+        projectHostSetupId: `missing-${Date.now()}`,
+        repoId: added.result.repo.id,
+        path: testRepoPath
+      },
+      workspaceMode: 'new_per_run',
+      reuseSession: false,
+      timezone: 'UTC',
+      rrule: 'FREQ=DAILY;BYHOUR=9;BYMINUTE=0',
+      dtstart: Date.now(),
+      enabled: false,
+      missedRunGraceMinutes: 720
+    })
+    const run = await host.client.call<{ run: { id: string; status: string } }>(
+      'automation.runNow',
+      { id: automation.result.automation.id }
+    )
+    expect(['dispatching', 'dispatched']).toContain(run.result.run.status)
+
+    const beforeRestart = await host.client.call<{ runs: { id: string }[] }>('automation.runs', {
+      automationId: automation.result.automation.id
+    })
+    expect(beforeRestart.result.runs.some((entry) => entry.id === run.result.run.id)).toBe(true)
+
+    const profileDirectory = path.join(host.userDataDir, 'profiles', DEFAULT_LOCAL_ORCA_PROFILE_ID)
+    const profileJsonPath = path.join(profileDirectory, 'orca-data.json')
+    const rootJsonPath = path.join(host.userDataDir, 'orca-data.json')
+    const databasePath = profileStateDatabaseFile(profileDirectory)
+    expect(existsSync(databasePath)).toBe(true)
+    await host.restartServeProcess({
+      betweenProcesses: () => {
+        rmSync(profileJsonPath, { force: true })
+        rmSync(rootJsonPath, { force: true })
+      }
+    })
+    expect(existsSync(profileJsonPath)).toBe(false)
+    expect(existsSync(rootJsonPath)).toBe(false)
+
+    const afterRestartDefinitions = await host.client.call<{
+      automations: { id: string }[]
+    }>('automation.list')
+    expect(
+      afterRestartDefinitions.result.automations.some(
+        (entry) => entry.id === automation.result.automation.id
+      )
+    ).toBe(true)
+    const afterRestart = await host.client.call<{ runs: { id: string }[] }>('automation.runs', {
+      automationId: automation.result.automation.id
+    })
+    expect(afterRestart.result.runs.some((entry) => entry.id === run.result.run.id)).toBe(true)
+  } finally {
+    await host.dispose()
+  }
+})
+
 type HostSurface = {
   leafId: string
   parentTabId: string
@@ -125,14 +201,35 @@ function removePersistedTerminalBinding(
   terminal: Pick<MirroredTerminal, 'leafId' | 'parentTabId' | 'ptyId'>
 ): void {
   const dataPath = persistedDataPath(userDataDir)
-  const data = JSON.parse(readFileSync(dataPath, 'utf8')) as PersistedData
-  const bindings =
-    data.workspaceSession?.terminalLayoutsByTabId?.[terminal.parentTabId]?.ptyIdsByLeafId
-  if (bindings?.[terminal.leafId] !== terminal.ptyId) {
-    throw new Error('Expected the live terminal binding before removing it from persisted state')
+  const authority = new ProfileStateSqliteAuthority(
+    profileStateDatabaseFile(path.dirname(dataPath)),
+    DEFAULT_LOCAL_ORCA_PROFILE_ID
+  )
+  try {
+    const serialized = authority.readSerializedState()
+    if (!serialized) {
+      throw new Error('Expected established SQLite state before removing terminal binding')
+    }
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the SQLite authority validates the complete storage snapshot before returning it.
+    const session = JSON.parse(serialized) as PersistedData
+    const layout = session.workspaceSession?.terminalLayoutsByTabId?.[terminal.parentTabId]
+    const bindings = layout?.ptyIdsByLeafId
+    if (!layout || !bindings || bindings[terminal.leafId] !== terminal.ptyId) {
+      throw new Error('Expected the live terminal binding before removing it from SQLite state')
+    }
+    const nextBindings = { ...bindings }
+    delete nextBindings[terminal.leafId]
+    session.workspaceSession = {
+      ...session.workspaceSession,
+      terminalLayoutsByTabId: {
+        ...session.workspaceSession?.terminalLayoutsByTabId,
+        [terminal.parentTabId]: { ...layout, ptyIdsByLeafId: nextBindings }
+      }
+    }
+    authority.writeSerializedState(Buffer.from(JSON.stringify(session)))
+  } finally {
+    authority.close?.()
   }
-  delete bindings[terminal.leafId]
-  writeFileSync(dataPath, `${JSON.stringify(data, null, 2)}\n`, 'utf8')
 }
 
 function readHistoryLogEvidence(outputLogPath: string, marker: string): HistoryLogEvidence {
diff --git a/tests/e2e/pdf-find-counter.spec.ts b/tests/e2e/pdf-find-counter.spec.ts
new file mode 100644
index 000000000000..7a8d4b13b049
--- /dev/null
+++ b/tests/e2e/pdf-find-counter.spec.ts
@@ -0,0 +1,168 @@
+import { writeFileSync, rmSync, mkdtempSync } from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import { expect, test } from './helpers/orca-app'
+import { createPdfFindFixture } from './helpers/pdf-find-fixture'
+import { pressShortcut } from './helpers/shortcuts'
+
+test('PDF counter follows navigation, new queries, and reopening', async ({
+  orcaPage,
+  electronApp,
+  seededRepoPath,
+  registerPostElectronShutdownCleanup
+}, testInfo) => {
+  const filePath = path.join(seededRepoPath, 'pdf-find-fixture.pdf')
+  writeFileSync(filePath, createPdfFindFixture())
+  registerPostElectronShutdownCleanup(async () => rmSync(filePath, { force: true }))
+  await orcaPage.evaluate((filePath) => {
+    const state = window.__store?.getState()
+    if (!state?.activeWorktreeId) {
+      throw new Error('Missing fixture worktree')
+    }
+    state.openFile({
+      filePath,
+      relativePath: 'pdf-find-fixture.pdf',
+      worktreeId: state.activeWorktreeId,
+      language: 'plaintext',
+      mode: 'edit'
+    })
+  }, filePath)
+  await expect(orcaPage.locator('.pdfViewer .page')).toHaveCount(3)
+  await expect(orcaPage.locator('.pdfViewer .page').first().locator('.textLayer')).toContainText(
+    'needle result 1'
+  )
+  await pressShortcut(orcaPage, 'f')
+  const input = orcaPage.getByPlaceholder('Find in page...')
+  const bar = input.locator('..')
+  const selected = orcaPage.locator('.pdfViewer .highlight.selected')
+  const observations: object[] = []
+  const capture = async (name: string, counter: string, selectedText?: string): Promise<void> => {
+    if (selectedText) {
+      await expect(selected).toHaveCount(1)
+      await expect(selected.locator('..')).toHaveText(selectedText)
+    }
+    await expect.soft(bar).toContainText(counter, { timeout: 1000 })
+    observations.push({
+      name,
+      expected: counter,
+      actual: await bar.innerText(),
+      selected: await selected.locator('..').allTextContents()
+    })
+    await orcaPage.screenshot({ path: testInfo.outputPath(`${name}.png`) })
+  }
+  await input.fill('needle')
+  await capture('initial', '1 of 6', 'needle result 1')
+  await bar.getByTitle('Next match', { exact: true }).click()
+  await capture('next', '2 of 6', 'needle result 2')
+  await input.press('Enter')
+  await capture('enter', '3 of 6', 'needle result 3')
+  await input.press('Shift+Enter')
+  await capture('shift-enter', '2 of 6', 'needle result 2')
+  await bar.getByTitle('Previous match', { exact: true }).click()
+  await capture('previous', '1 of 6', 'needle result 1')
+  await bar.getByTitle('Previous match', { exact: true }).click()
+  await capture('wrap-previous', '6 of 6', 'needle result 6')
+  await input.press('Enter')
+  await capture('wrap-next', '1 of 6', 'needle result 1')
+  await input.fill('beacon')
+  await capture('query-change', '1 of 2', 'beacon alternate query')
+  await input.fill('absentword')
+  await expect(selected).toHaveCount(0)
+  await capture('no-results', 'No matches')
+  await input.fill('needle')
+  await capture('query-restored', '1 of 6', 'needle result 1')
+  await input.fill('beacon')
+  await input.fill('absentword')
+  await input.fill('needle')
+  // The final query is unchanged; let PDF.js's 250ms debounce finish before stepping.
+  await orcaPage.waitForTimeout(350)
+  await capture('rapid-query', '1 of 6', 'needle result 1')
+  await bar.getByTitle('Next match', { exact: true }).click()
+  await capture('before-close', '2 of 6', 'needle result 2')
+  await input.press('Escape')
+  await expect(input).toHaveCount(0)
+  await expect(selected).toHaveCount(0)
+  await pressShortcut(orcaPage, 'f')
+  await capture('reopened', '1 of 6', 'needle result 1')
+  await input.press('Enter')
+  await capture('reopened-enter', '2 of 6', 'needle result 2')
+  const windows = await electronApp.evaluate(({ BrowserWindow, app }) => ({
+    appPath: app.getAppPath(),
+    windows: BrowserWindow.getAllWindows().map((window) => ({
+      visible: window.isVisible(),
+      focused: window.isFocused()
+    }))
+  }))
+  expect(windows.windows.every((window) => !window.focused)).toBe(true)
+  const headful =
+    process.env.ORCA_E2E_FORCE_HEADFUL === '1' || testInfo.project.metadata.orcaHeadful === true
+  if (process.env.ORCA_BACKGROUND_LAUNCH === '1' || !headful) {
+    expect(windows.windows.every((window) => !window.visible)).toBe(true)
+  }
+  writeFileSync(
+    testInfo.outputPath('observations.json'),
+    JSON.stringify({ windows, observations }, null, 2)
+  )
+})
+
+test.describe('PDF in a folder workspace', () => {
+  test.use({ seedTestRepo: false })
+
+  test('finds and navigates a PDF without a Git repository', async ({
+    orcaPage,
+    registerPostElectronShutdownCleanup
+  }, testInfo) => {
+    const folderPath = mkdtempSync(path.join(os.tmpdir(), 'orca-pdf-folder-'))
+    const filePath = path.join(folderPath, 'pdf-find-fixture.pdf')
+    writeFileSync(filePath, createPdfFindFixture())
+    registerPostElectronShutdownCleanup(async () =>
+      rmSync(folderPath, { recursive: true, force: true })
+    )
+    await orcaPage.evaluate(
+      async ({ folderPath, filePath }) => {
+        const state = window.__store?.getState()
+        if (!state) {
+          throw new Error('Missing fixture store')
+        }
+        const group = await window.api.projectGroups.create({
+          name: 'PDF fixture',
+          parentPath: folderPath,
+          createdFrom: 'folder-scan'
+        })
+        await state.fetchProjectGroups()
+        const folder = await state.createFolderWorkspace({
+          projectGroupId: group.id,
+          name: 'PDF documents',
+          folderPath
+        })
+        if (!folder) {
+          throw new Error('Missing fixture folder')
+        }
+        const worktreeId = `folder:${folder.id}`
+        state.setActiveWorktree(worktreeId)
+        state.openFile({
+          filePath,
+          relativePath: 'pdf-find-fixture.pdf',
+          worktreeId,
+          language: 'plaintext',
+          mode: 'edit'
+        })
+      },
+      { folderPath, filePath }
+    )
+    await expect(orcaPage.locator('.pdfViewer .page')).toHaveCount(3)
+    await expect(orcaPage.locator('.pdfViewer .page').first().locator('.textLayer')).toContainText(
+      'needle result 1'
+    )
+    await pressShortcut(orcaPage, 'f')
+    const input = orcaPage.getByPlaceholder('Find in page...')
+    await input.fill('needle')
+    await expect(input.locator('..')).toContainText('1 of 6')
+    const selected = orcaPage.locator('.pdfViewer .highlight.selected').locator('..')
+    await expect(selected).toHaveText('needle result 1')
+    await input.press('Enter')
+    await expect(input.locator('..')).toContainText('2 of 6')
+    await expect(selected).toHaveText('needle result 2')
+    await orcaPage.screenshot({ path: testInfo.outputPath('folder-next.png') })
+  })
+})
diff --git a/tests/e2e/persisted-session-production-upgrade.spec.ts b/tests/e2e/persisted-session-production-upgrade.spec.ts
index 3f63366b25f7..cff20197a0e1 100644
--- a/tests/e2e/persisted-session-production-upgrade.spec.ts
+++ b/tests/e2e/persisted-session-production-upgrade.spec.ts
@@ -1,12 +1,29 @@
-import { existsSync, readFileSync, writeFileSync } from 'node:fs'
+import { existsSync, readFileSync, readdirSync, writeFileSync } from 'node:fs'
 import path from 'node:path'
-import type { ElectronApplication, Page } from '@stablyai/playwright-test'
+import {
+  _electron as electron,
+  type ElectronApplication,
+  type Page,
+  type TestInfo
+} from '@stablyai/playwright-test'
 import { DEFAULT_LOCAL_ORCA_PROFILE_ID } from '../../src/shared/orca-profiles'
 import { PTY_SESSION_ID_SEPARATOR } from '../../src/shared/pty-session-id-format'
-import { test, expect } from './helpers/orca-app'
+import { forwardElectronProcessLogs, test, expect } from './helpers/orca-app'
 import { TEST_REPO_PATH_FILE } from './global-setup'
 import { attachRepoAndOpenTerminal, createRestartSession } from './helpers/orca-restart'
+import { cleanupE2EDaemons, closeElectronAppForE2E } from './helpers/electron-process-shutdown'
+import { getElectronIsolatedKeychainArgs } from './helpers/electron-launch-args'
+import {
+  areSameHomePath,
+  assertElectronResolvedIsolatedHome,
+  createElectronHomeIsolation
+} from './helpers/electron-home-isolation'
 import { ensureTerminalVisible, waitForSessionReady } from './helpers/store'
+import { openProfileStateDatabaseReadOnly } from '../../src/main/persistence/profile-state/profile-state-database'
+import { readProfileStateSnapshot } from '../../src/main/persistence/profile-state/profile-state-documents'
+import { ProfileStateSqliteAuthority } from '../../src/main/persistence/profile-state/profile-state-sqlite-authority'
+import { acquireProfileStateMaintenance } from '../../src/main/persistence/profile-state/profile-state-access'
+import { restoreProfileStateJsonExport } from '../../src/main/persistence/profile-state/legacy-json/profile-state-recovery'
 import {
   discoverActivePtyId,
   execInTerminal,
@@ -26,6 +43,7 @@ const FIXTURE_PATH = path.join(
 )
 // This fixture captures a legacy production schema boundary; the test runs the current build.
 const RESTORED_TITLE = 'Production agent session'
+const PACKAGED_OLD_EXECUTABLE_ENV = 'ORCA_PROFILE_STATE_PACKAGED_OLD_EXECUTABLE'
 
 type FixtureSession = {
   _fixtureProvenance?: unknown
@@ -75,6 +93,125 @@ function installProductionSessionFixture(
   writeFileSync(profilePath, `${JSON.stringify(profile, null, 2)}\n`)
 }
 
+function materializeLegacyProfileJson(userDataDir: string): void {
+  const profileDirectory = path.join(userDataDir, 'profiles', DEFAULT_LOCAL_ORCA_PROFILE_ID)
+  const databasePath = path.join(profileDirectory, 'profile-state.db')
+  const dataPath = path.join(profileDirectory, 'orca-data.json')
+  const opened = openProfileStateDatabaseReadOnly(databasePath, DEFAULT_LOCAL_ORCA_PROFILE_ID)
+  try {
+    writeFileSync(dataPath, `${readProfileStateSnapshot(opened.db).json}\n`)
+  } finally {
+    opened.db.close()
+  }
+}
+
+function publishLegacyCompatibilitySnapshot(userDataDir: string): string {
+  const profileDirectory = path.join(userDataDir, 'profiles', DEFAULT_LOCAL_ORCA_PROFILE_ID)
+  const dataPath = path.join(profileDirectory, 'orca-data.json')
+  const databasePath = path.join(profileDirectory, 'profile-state.db')
+  const authority = new ProfileStateSqliteAuthority(databasePath, DEFAULT_LOCAL_ORCA_PROFILE_ID)
+  try {
+    authority.readSerializedState()
+    const revision = authority.writeJsonCompatibilityExport(dataPath)
+    if (revision === undefined) {
+      throw new Error('Expected the candidate profile to have a persisted revision')
+    }
+    return dataPath
+  } finally {
+    authority.close()
+  }
+}
+
+function restoreLegacyProfileJson(userDataDir: string): void {
+  const profileDirectory = path.join(userDataDir, 'profiles', DEFAULT_LOCAL_ORCA_PROFILE_ID)
+  const databasePath = path.join(profileDirectory, 'profile-state.db')
+  const dataFile = path.join(profileDirectory, 'orca-data.json')
+  const maintenance = acquireProfileStateMaintenance(userDataDir)
+  try {
+    restoreProfileStateJsonExport({
+      maintenance,
+      databasePath,
+      dataFile,
+      exportPath: dataFile,
+      profileId: DEFAULT_LOCAL_ORCA_PROFILE_ID
+    })
+  } finally {
+    maintenance.release()
+  }
+}
+
+async function launchPackagedOldProfile(args: {
+  executablePath: string
+  userDataDir: string
+  testInfo: TestInfo
+}): Promise<{ app: ElectronApplication; page: Page }> {
+  const { ELECTRON_RUN_AS_NODE: _unused, ...cleanEnv } = process.env
+  void _unused
+  const homeIsolation = createElectronHomeIsolation({
+    inheritedEnv: cleanEnv,
+    launchEnv: {},
+    extraEnv: {},
+    userDataDir: args.userDataDir
+  })
+  const app = await electron.launch({
+    executablePath: args.executablePath,
+    args: [...getElectronIsolatedKeychainArgs(), `--user-data-dir=${args.userDataDir}`],
+    env: {
+      ...homeIsolation.env,
+      NODE_ENV: 'production',
+      ORCA_BACKGROUND_LAUNCH: '1',
+      ORCA_E2E_HEADLESS: '1',
+      ORCA_BYPASS_SINGLE_INSTANCE_LOCK: '1'
+    }
+  })
+  forwardElectronProcessLogs(app, args.testInfo)
+  try {
+    assertElectronResolvedIsolatedHome(
+      await app.evaluate(({ app: electronApp }) => electronApp.getPath('home')),
+      homeIsolation
+    )
+    const resolvedUserDataDir = await app.evaluate(({ app: electronApp }) =>
+      electronApp.getPath('userData')
+    )
+    if (!areSameHomePath(resolvedUserDataDir, args.userDataDir)) {
+      throw new Error('Packaged old build escaped the disposable user-data boundary')
+    }
+    await app.firstWindow({ timeout: 120_000 })
+    let apiPage: Page | undefined
+    await expect
+      .poll(
+        async () => {
+          for (const candidate of app.windows()) {
+            const hasSettingsApi = await Promise.race([
+              candidate.evaluate(() => Boolean(window.api?.settings?.get)).catch(() => false),
+              new Promise<boolean>((resolve) => {
+                const timeout = setTimeout(() => resolve(false), 2_000)
+                timeout.unref?.()
+              })
+            ])
+            if (hasSettingsApi) {
+              apiPage = candidate
+              return true
+            }
+          }
+          return false
+        },
+        // Older packaged builds can spend longer in their first-run renderer bootstrap
+        // while the candidate daemon from the same test worker is shutting down.
+        { timeout: 120_000 }
+      )
+      .toBe(true)
+    if (!apiPage) {
+      throw new Error('Packaged old build did not expose its renderer API')
+    }
+    await apiPage.waitForLoadState('domcontentloaded')
+    return { app, page: apiPage }
+  } catch (error) {
+    await closeElectronAppForE2E(app).catch(() => {})
+    throw error
+  }
+}
+
 async function expectProductionSessionRestored(
   page: Page,
   expected: { marker: string; ptyId: string; repoId: string; worktreeId: string }
@@ -147,7 +284,11 @@ test('upgrades a legacy daemon session and keeps it stable after relaunch', asyn
 
     await session.close(oldApp)
     oldApp = null
+    // Recreate a pre-cutover profile while retaining its live terminal identity.
+    materializeLegacyProfileJson(session.userDataDir)
     installProductionSessionFixture(session.userDataDir, repoId, worktreeId, ptyId)
+    await cleanupE2EDaemons(session.userDataDir)
+    restoreLegacyProfileJson(session.userDataDir)
 
     const currentLaunch = await session.launch()
     currentApp = currentLaunch.app
@@ -169,3 +310,288 @@ test('upgrades a legacy daemon session and keeps it stable after relaunch', asyn
     await session.dispose()
   }
 })
+
+// oxlint-disable-next-line no-empty-pattern -- This mixed-version test owns its Electron launches.
+test('restores a JSON compatibility snapshot and migrates it on normal restart', async ({}, testInfo) => {
+  test.setTimeout(240_000)
+
+  const session = createRestartSession(testInfo)
+  let candidateApp: ElectronApplication | null = null
+  let reupgradedApp: ElectronApplication | null = null
+  try {
+    const candidateLaunch = await session.launch()
+    candidateApp = candidateLaunch.app
+    await waitForSessionReady(candidateLaunch.page)
+    const marker = 17
+    await candidateLaunch.page.evaluate(async (terminalFontSize) => {
+      const updateSettings = window.__store?.getState().updateSettingsOrThrow
+      if (!updateSettings) {
+        throw new Error('Candidate renderer did not expose settings persistence')
+      }
+      await updateSettings({ terminalFontSize })
+    }, marker)
+    await expect
+      .poll(
+        () =>
+          candidateLaunch.page.evaluate(
+            () => window.__store?.getState().settings?.terminalFontSize
+          ),
+        { timeout: 15_000 }
+      )
+      .toBe(marker)
+
+    const profileDirectory = path.join(
+      session.userDataDir,
+      'profiles',
+      DEFAULT_LOCAL_ORCA_PROFILE_ID
+    )
+    const databasePath = path.join(profileDirectory, 'profile-state.db')
+    await session.close(candidateApp)
+    candidateApp = null
+    const dataPath = publishLegacyCompatibilitySnapshot(session.userDataDir)
+    expect(existsSync(databasePath)).toBe(true)
+    expect(existsSync(dataPath)).toBe(true)
+
+    // Restore the exported JSON, then exercise normal first migration again.
+    await cleanupE2EDaemons(session.userDataDir)
+    restoreLegacyProfileJson(session.userDataDir)
+    expect(existsSync(databasePath)).toBe(false)
+    expect(JSON.parse(readFileSync(dataPath, 'utf8')).settings.terminalFontSize).toBe(marker)
+    const reupgradedLaunch = await session.launch()
+    reupgradedApp = reupgradedLaunch.app
+    await waitForSessionReady(reupgradedLaunch.page)
+    await expect
+      .poll(
+        () =>
+          reupgradedLaunch.page.evaluate(
+            () => window.__store?.getState().settings?.terminalFontSize
+          ),
+        { timeout: 15_000 }
+      )
+      .toBe(marker)
+    expect(existsSync(databasePath)).toBe(true)
+  } finally {
+    for (const app of [reupgradedApp, candidateApp]) {
+      if (app) {
+        await session.close(app).catch(() => {})
+      }
+    }
+    await session.dispose()
+  }
+})
+
+test('real packaged old build reads compatibility JSON before candidate re-import', async ({
+  browserName: _browserName
+}, testInfo) => {
+  test.setTimeout(300_000)
+  const executablePath = process.env[PACKAGED_OLD_EXECUTABLE_ENV]
+  test.skip(
+    !executablePath || !existsSync(executablePath),
+    `${PACKAGED_OLD_EXECUTABLE_ENV} must point at an older packaged Orca executable`
+  )
+
+  const session = createRestartSession(testInfo)
+  let candidateApp: ElectronApplication | null = null
+  let oldApp: ElectronApplication | null = null
+  let reupgradedApp: ElectronApplication | null = null
+  try {
+    const candidateLaunch = await session.launch()
+    candidateApp = candidateLaunch.app
+    const marker = 19
+    await candidateLaunch.page.evaluate(async (terminalFontSize) => {
+      const updateSettings = window.__store?.getState().updateSettingsOrThrow
+      if (!updateSettings) {
+        throw new Error('Candidate renderer did not expose settings persistence')
+      }
+      await updateSettings({ terminalFontSize })
+    }, marker)
+    await expect
+      .poll(() =>
+        candidateLaunch.page.evaluate(() => window.__store?.getState().settings?.terminalFontSize)
+      )
+      .toBe(marker)
+    await session.close(candidateApp)
+    candidateApp = null
+
+    const databasePath = path.join(
+      session.userDataDir,
+      'profiles',
+      DEFAULT_LOCAL_ORCA_PROFILE_ID,
+      'profile-state.db'
+    )
+    const compatibilityPath = publishLegacyCompatibilitySnapshot(session.userDataDir)
+    expect(existsSync(databasePath)).toBe(true)
+    expect(existsSync(compatibilityPath)).toBe(true)
+    await cleanupE2EDaemons(session.userDataDir)
+    // A pre-migration build reads the canonical JSON restored by rollback.
+    restoreLegacyProfileJson(session.userDataDir)
+
+    const oldLaunch = await launchPackagedOldProfile({
+      executablePath: executablePath!,
+      userDataDir: session.userDataDir,
+      testInfo
+    })
+    oldApp = oldLaunch.app
+    await expect
+      .poll(() => oldLaunch.page.evaluate(() => window.api.settings.get()))
+      .toMatchObject({
+        terminalFontSize: marker
+      })
+    await closeElectronAppForE2E(oldApp)
+    oldApp = null
+
+    const reupgradedLaunch = await session.launch()
+    reupgradedApp = reupgradedLaunch.app
+    await expect
+      .poll(
+        () =>
+          reupgradedLaunch.page.evaluate(
+            () => window.__store?.getState().settings?.terminalFontSize
+          ),
+        { timeout: 30_000 }
+      )
+      .toBe(marker)
+    expect(existsSync(databasePath)).toBe(true)
+  } finally {
+    for (const app of [reupgradedApp, oldApp, candidateApp]) {
+      if (app) {
+        await closeElectronAppForE2E(app).catch(() => {})
+      }
+    }
+    await session.dispose()
+  }
+})
+
+test('fails closed when a packaged old build mutates live SQLite compatibility JSON', async ({
+  browserName: _browserName
+}, testInfo) => {
+  test.setTimeout(300_000)
+  const executablePath = process.env[PACKAGED_OLD_EXECUTABLE_ENV]
+  test.skip(
+    !executablePath || !existsSync(executablePath),
+    `${PACKAGED_OLD_EXECUTABLE_ENV} must point at an older packaged Orca executable`
+  )
+
+  const session = createRestartSession(testInfo)
+  let candidateApp: ElectronApplication | null = null
+  let oldApp: ElectronApplication | null = null
+  try {
+    const candidateLaunch = await session.launch()
+    candidateApp = candidateLaunch.app
+    const candidateExecutable = await candidateApp.evaluate(() => process.execPath)
+    await waitForSessionReady(candidateLaunch.page)
+    await candidateLaunch.page.evaluate(async () => {
+      const updateSettings = window.__store?.getState().updateSettingsOrThrow
+      if (!updateSettings) {
+        throw new Error('Candidate renderer did not expose settings persistence')
+      }
+      await updateSettings({ terminalFontSize: 19 })
+    })
+    await expect
+      .poll(() =>
+        candidateLaunch.page.evaluate(() => window.__store?.getState().settings?.terminalFontSize)
+      )
+      .toBe(19)
+    await session.close(candidateApp)
+    candidateApp = null
+
+    const profileDirectory = path.join(
+      session.userDataDir,
+      'profiles',
+      DEFAULT_LOCAL_ORCA_PROFILE_ID
+    )
+    const databasePath = path.join(profileDirectory, 'profile-state.db')
+    const compatibilityPath = publishLegacyCompatibilitySnapshot(session.userDataDir)
+    expect(existsSync(databasePath)).toBe(true)
+    expect(existsSync(compatibilityPath)).toBe(true)
+
+    const oldLaunch = await launchPackagedOldProfile({
+      executablePath: executablePath!,
+      userDataDir: session.userDataDir,
+      testInfo
+    })
+    oldApp = oldLaunch.app
+    await expect
+      .poll(() => oldLaunch.page.evaluate(() => window.api.settings.get()))
+      .toMatchObject({ terminalFontSize: 19 })
+    await oldLaunch.page.evaluate(async () => {
+      await window.api.settings.set({ terminalFontSize: 23 })
+    })
+    await expect
+      .poll(() => oldLaunch.page.evaluate(() => window.api.settings.get()))
+      .toMatchObject({ terminalFontSize: 23 })
+    await closeElectronAppForE2E(oldApp)
+    oldApp = null
+
+    const mutatedJson = JSON.parse(readFileSync(compatibilityPath, 'utf8'))
+    expect(mutatedJson).toMatchObject({ settings: { terminalFontSize: 23 } })
+    expect(existsSync(databasePath)).toBe(true)
+
+    const refused = await session.launchUntilExit(candidateExecutable)
+    expect(refused, refused.stderr).toMatchObject({ code: 1, signal: null, timedOut: false })
+    expect(refused.stderr).toContain(
+      'both JSON and SQLite storage without a matching acceptance marker'
+    )
+    expect(existsSync(databasePath)).toBe(true)
+    const opened = openProfileStateDatabaseReadOnly(databasePath, DEFAULT_LOCAL_ORCA_PROFILE_ID)
+    try {
+      expect(JSON.parse(readProfileStateSnapshot(opened.db).json)).toMatchObject({
+        settings: { terminalFontSize: 19 }
+      })
+    } finally {
+      opened.db.close()
+    }
+  } finally {
+    for (const app of [oldApp, candidateApp]) {
+      if (app) {
+        await closeElectronAppForE2E(app).catch(() => {})
+      }
+    }
+    await session.dispose()
+  }
+})
+
+// oxlint-disable-next-line no-empty-pattern -- This recovery test owns its Electron launches.
+test('fails closed on a corrupt established SQLite profile and retains recovery evidence', async ({}, testInfo) => {
+  test.setTimeout(180_000)
+
+  const session = createRestartSession(testInfo)
+  let app: ElectronApplication | null = null
+  try {
+    const initialLaunch = await session.launch()
+    app = initialLaunch.app
+    const candidateExecutable = await app.evaluate(() => process.execPath)
+    await waitForSessionReady(initialLaunch.page)
+    await session.close(app)
+    app = null
+
+    const profileDirectory = path.join(
+      session.userDataDir,
+      'profiles',
+      DEFAULT_LOCAL_ORCA_PROFILE_ID
+    )
+    const dataFile = path.join(profileDirectory, 'orca-data.json')
+    const databaseFile = path.join(profileDirectory, 'profile-state.db')
+    const retainedExports = readdirSync(profileDirectory).filter((name) =>
+      /^orca-data\.json\.sqlite-export\.\d+\.json$/.test(name)
+    )
+    expect(retainedExports.length).toBeGreaterThan(0)
+    const jsonBeforeCorruption = readFileSync(dataFile)
+
+    writeFileSync(databaseFile, 'corrupt profile-state database')
+    const refused = await session.launchUntilExit(candidateExecutable)
+    expect(refused, refused.stderr).toMatchObject({ code: 1, signal: null, timedOut: false })
+    expect(refused.stderr).toContain('cannot safely open the active profile')
+    expect(readFileSync(dataFile)).toEqual(jsonBeforeCorruption)
+    expect(
+      readdirSync(profileDirectory).filter((name) =>
+        /^orca-data\.json\.sqlite-export\.\d+\.json$/.test(name)
+      )
+    ).toEqual(retainedExports)
+  } finally {
+    if (app) {
+      await session.close(app).catch(() => {})
+    }
+    await session.dispose()
+  }
+})
diff --git a/tests/e2e/plugin-startup-budget.spec.ts b/tests/e2e/plugin-startup-budget.spec.ts
index 8f03d03d3e73..369a0c6e24e0 100644
--- a/tests/e2e/plugin-startup-budget.spec.ts
+++ b/tests/e2e/plugin-startup-budget.spec.ts
@@ -126,27 +126,28 @@ function median(values: readonly number[]): number {
 // oxlint-disable-next-line no-empty-pattern -- Playwright passes fixtures before testInfo.
 test('keeps real Electron launch stable with 20 approved inert plugins', async ({}, testInfo) => {
   test.setTimeout(240_000)
-  const session = createRestartSession(testInfo, { ORCA_STARTUP_DIAGNOSTICS: '1' })
   const baseline: StartupSample[] = []
   const populated: StartupSample[] = []
-  let markerPaths: string[] = []
-  try {
-    for (let sample = 0; sample < SAMPLE_COUNT; sample += 1) {
-      seedPlugins(session.userDataDir, 0)
-      baseline.push(await launchSample(session, 0, testInfo))
-      markerPaths = seedPlugins(session.userDataDir, PLUGIN_COUNT)
-      populated.push(await launchSample(session, PLUGIN_COUNT, testInfo))
+  for (let sample = 0; sample < SAMPLE_COUNT; sample += 1) {
+    for (const count of [0, PLUGIN_COUNT]) {
+      // Seed each profile before its first migration into authoritative SQLite state.
+      const session = createRestartSession(testInfo, { ORCA_STARTUP_DIAGNOSTICS: '1' })
+      try {
+        const markerPaths = seedPlugins(session.userDataDir, count)
+        const samples = count === 0 ? baseline : populated
+        samples.push(await launchSample(session, count, testInfo))
+        expect(markerPaths.every((markerPath) => !existsSync(markerPath))).toBe(true)
+      } finally {
+        await session.dispose()
+      }
     }
-
-    // The isolated 20-sample unit gate owns the ≤50 ms P95. This app-level
-    // complement measures the user-visible launch delta because background
-    // discovery completion overlaps unrelated main-process startup work.
-    expect(populated.every((sample) => Number.isFinite(sample.pluginDurationMs))).toBe(true)
-    expect(median(populated.map((sample) => sample.readyToShowMs))).toBeLessThanOrEqual(
-      median(baseline.map((sample) => sample.readyToShowMs)) + 50
-    )
-    expect(markerPaths.every((markerPath) => !existsSync(markerPath))).toBe(true)
-  } finally {
-    await session.dispose()
   }
+
+  // The isolated 20-sample unit gate owns the ≤50 ms P95. This app-level
+  // complement measures the user-visible launch delta because background
+  // discovery completion overlaps unrelated main-process startup work.
+  expect(populated.every((sample) => Number.isFinite(sample.pluginDurationMs))).toBe(true)
+  expect(median(populated.map((sample) => sample.readyToShowMs))).toBeLessThanOrEqual(
+    median(baseline.map((sample) => sample.readyToShowMs)) + 50
+  )
 })
diff --git a/tests/e2e/profile-state-automatic-backup-recovery.spec.ts b/tests/e2e/profile-state-automatic-backup-recovery.spec.ts
new file mode 100644
index 000000000000..d3eb3a815e91
--- /dev/null
+++ b/tests/e2e/profile-state-automatic-backup-recovery.spec.ts
@@ -0,0 +1,222 @@
+import { existsSync, readFileSync, realpathSync, rmSync, statSync, writeFileSync } from 'node:fs'
+import path from 'node:path'
+import type { ElectronApplication } from '@stablyai/playwright-test'
+import { DEFAULT_LOCAL_ORCA_PROFILE_ID } from '../../src/shared/orca-profiles'
+import { runProcess } from '../../src/shared/child-process/run-process'
+import { openProfileStateDatabaseReadOnly } from '../../src/main/persistence/profile-state/profile-state-database'
+import { readProfileStateSnapshot } from '../../src/main/persistence/profile-state/profile-state-documents'
+import { profileStateDatabaseBackups } from '../../src/main/persistence/profile-state/profile-state-backup-path'
+import { test, expect } from './helpers/orca-app'
+import { createRestartSession } from './helpers/orca-restart'
+import { getE2ECompletedOnboardingProfile } from './helpers/e2e-completed-onboarding-profile'
+import { createElectronHomeIsolation } from './helpers/electron-home-isolation'
+import { cleanupE2EDaemons } from './helpers/electron-process-shutdown'
+import { waitForSessionReady } from './helpers/store'
+
+function readSnapshot(databasePath: string) {
+  const opened = openProfileStateDatabaseReadOnly(databasePath, DEFAULT_LOCAL_ORCA_PROFILE_ID)
+  try {
+    return readProfileStateSnapshot(opened.db)
+  } finally {
+    opened.db.close()
+  }
+}
+
+function rollbackProfileBackup(userDataDir: string, backupId: string, executable?: string) {
+  const cliIsolation = createElectronHomeIsolation({
+    inheritedEnv: process.env,
+    launchEnv: { ORCA_USER_DATA_PATH: userDataDir, ORCA_BACKGROUND_LAUNCH: '1' },
+    extraEnv: {
+      ...(executable
+        ? { ORCA_APP_EXECUTABLE: executable, ORCA_APP_EXECUTABLE_NEEDS_APP_ROOT: '1' }
+        : {}),
+      // Raw development Electron needs the same sandbox opt-out as Playwright.
+      ...(process.platform === 'linux' ? { ELECTRON_DISABLE_SANDBOX: '1' } : {})
+    },
+    userDataDir
+  })
+  return runProcess({
+    program: process.execPath,
+    args: [
+      path.join(process.cwd(), 'out', 'cli', 'index.js'),
+      'profile',
+      'state',
+      'rollback',
+      '--backup',
+      backupId,
+      '--json'
+    ],
+    env: cliIsolation.env,
+    timeoutMs: 30_000,
+    maxOutputBytes: 64 * 1024
+  })
+}
+
+for (const recoveryRuntime of ['node', 'electron'] as const) {
+  // oxlint-disable-next-line no-empty-pattern -- This test owns both hidden Electron launches.
+  test(`restores an automatic SQLite backup through the ${recoveryRuntime} CLI after primary corruption`, async ({}, testInfo) => {
+    test.setTimeout(180_000)
+    const session = createRestartSession(testInfo, { ORCA_BACKGROUND_LAUNCH: '1' })
+    const rootJson = path.join(session.userDataDir, 'orca-data.json')
+    const profileDirectory = path.join(
+      session.userDataDir,
+      'profiles',
+      DEFAULT_LOCAL_ORCA_PROFILE_ID
+    )
+    const databasePath = path.join(profileDirectory, 'profile-state.db')
+    const dataFile = path.join(profileDirectory, 'orca-data.json')
+    const marker = `automatic-backup-${Date.now()}`
+    const recoveryMarker = {
+      marker,
+      // Exercise native cloning in the Electron recovery process on macOS.
+      payload: recoveryRuntime === 'electron' ? 'retained recovery data'.repeat(450_000) : ''
+    }
+    const seed = getE2ECompletedOnboardingProfile()
+    writeFileSync(
+      rootJson,
+      JSON.stringify({
+        ...seed,
+        settings: { ...seed.settings, terminalFontSize: 19, theme: 'light' },
+        backupRecoveryMarker: recoveryMarker
+      })
+    )
+    let firstApp: ElectronApplication | null = null
+    let restoredApp: ElectronApplication | null = null
+    try {
+      const first = await session.launch()
+      firstApp = first.app
+      await waitForSessionReady(first.page)
+      expect(
+        await first.app.evaluate(({ BrowserWindow }) =>
+          BrowserWindow.getAllWindows().every((window) => !window.isVisible())
+        )
+      ).toBe(true)
+      await first.page.evaluate(async () => {
+        const update = window.__store?.getState().updateSettingsOrThrow
+        if (!update) {
+          throw new Error('Renderer settings persistence is unavailable')
+        }
+        await update({ theme: 'dark' })
+      })
+
+      // Only normal app writes create this recovery point; the test never calls a snapshot writer.
+      await expect
+        .poll(() => profileStateDatabaseBackups(databasePath).length, { timeout: 30_000 })
+        .toBeGreaterThan(0)
+      const backup = profileStateDatabaseBackups(databasePath)[0]
+      const chosen = readSnapshot(backup.path)
+      expect(JSON.parse(chosen.json)).toMatchObject({
+        settings: { terminalFontSize: 19 },
+        backupRecoveryMarker: recoveryMarker
+      })
+      if (recoveryRuntime === 'electron') {
+        expect(statSync(backup.path).size).toBeGreaterThan(8 * 1024 * 1024)
+      }
+      const backupBytes = readFileSync(backup.path)
+      await first.page.evaluate(async () => {
+        const update = window.__store?.getState().updateSettingsOrThrow
+        if (!update) {
+          throw new Error('Renderer settings persistence is unavailable')
+        }
+        await update({ terminalFontSize: 23 })
+      })
+      await expect
+        .poll(() => JSON.parse(readSnapshot(databasePath).json).settings.terminalFontSize)
+        .toBe(23)
+      expect(readFileSync(backup.path).equals(backupBytes)).toBe(true)
+      const beforeRefusal = readSnapshot(databasePath)
+      const recoveryExecutable =
+        recoveryRuntime === 'electron'
+          ? await first.app.evaluate(() => process.execPath)
+          : undefined
+      const refused = await rollbackProfileBackup(
+        session.userDataDir,
+        backup.id,
+        recoveryExecutable
+      )
+      expect(refused.code).toBe(1)
+      expect(refused.stdout + refused.stderr).toContain(
+        recoveryRuntime === 'electron' ? 'Stop Orca' : 'in use'
+      )
+      expect(readSnapshot(databasePath)).toEqual(beforeRefusal)
+      expect(readFileSync(backup.path).equals(backupBytes)).toBe(true)
+      await session.close(firstApp)
+      firstApp = null
+      await cleanupE2EDaemons(session.userDataDir)
+
+      for (const file of [dataFile, rootJson, `${databasePath}-wal`, `${databasePath}-shm`]) {
+        rmSync(file, { force: true })
+      }
+      // Preserve both large artifacts so quarantine exercises batched recovery copies.
+      const corruptPrimary = readFileSync(databasePath)
+      corruptPrimary.write('deliberately corrupt SQLite primary')
+      writeFileSync(databasePath, corruptPrimary)
+      if (recoveryRuntime === 'electron') {
+        expect(corruptPrimary.length).toBeGreaterThan(8 * 1024 * 1024)
+      }
+      expect(() => readSnapshot(databasePath)).toThrow()
+      const restored = await rollbackProfileBackup(
+        session.userDataDir,
+        backup.id,
+        recoveryExecutable
+      )
+      expect(restored.code, restored.stderr || restored.stdout).toBe(0)
+      const recovered = JSON.parse(restored.stdout)
+      expect(recovered).toMatchObject({
+        ok: true,
+        result: {
+          storage: 'sqlite',
+          backupId: backup.id,
+          revision: chosen.revision,
+          profileId: DEFAULT_LOCAL_ORCA_PROFILE_ID,
+          restoredPath: recoveryRuntime === 'electron' ? realpathSync(databasePath) : databasePath
+        }
+      })
+      expect(readSnapshot(databasePath)).toEqual(chosen)
+      const quarantineDirectory: unknown = recovered.result.quarantineDirectory
+      if (typeof quarantineDirectory !== 'string') {
+        throw new Error('Recovery did not report its quarantine directory')
+      }
+      expect(
+        readFileSync(path.join(quarantineDirectory, 'profile-state.db')).equals(corruptPrimary)
+      ).toBe(true)
+      expect(
+        readFileSync(path.join(quarantineDirectory, path.basename(backup.path))).equals(backupBytes)
+      ).toBe(true)
+      expect(readFileSync(backup.path).equals(backupBytes)).toBe(true)
+      expect(existsSync(dataFile)).toBe(false)
+
+      const relaunched = await session.launch()
+      restoredApp = relaunched.app
+      await waitForSessionReady(relaunched.page)
+      await expect
+        .poll(() =>
+          relaunched.page.evaluate(() => window.__store?.getState().settings?.terminalFontSize)
+        )
+        .toBe(19)
+      await expect(relaunched.page.locator('html')).toHaveClass(
+        JSON.parse(chosen.json).settings.theme === 'dark' ? /\bdark\b/ : /\blight\b/
+      )
+      expect(JSON.parse(readSnapshot(databasePath).json).backupRecoveryMarker).toEqual(
+        recoveryMarker
+      )
+      expect(
+        await relaunched.app.evaluate(({ BrowserWindow }) =>
+          BrowserWindow.getAllWindows().every((window) => !window.isVisible())
+        )
+      ).toBe(true)
+      expect(existsSync(dataFile)).toBe(false)
+    } finally {
+      try {
+        if (restoredApp) {
+          await session.close(restoredApp)
+        }
+        if (firstApp) {
+          await session.close(firstApp)
+        }
+      } finally {
+        await session.dispose()
+      }
+    }
+  })
+}
diff --git a/tests/e2e/profile-state-terminal-restart-persistence.spec.ts b/tests/e2e/profile-state-terminal-restart-persistence.spec.ts
new file mode 100644
index 000000000000..656692e9f681
--- /dev/null
+++ b/tests/e2e/profile-state-terminal-restart-persistence.spec.ts
@@ -0,0 +1,591 @@
+/** Candidate SQLite terminal restart/profile journeys. */
+
+import { readFileSync, existsSync, rmSync } from 'node:fs'
+import path from 'node:path'
+import type { ElectronApplication } from '@stablyai/playwright-test'
+import { getRepoIdFromWorktreeId } from '../../src/shared/worktree/id'
+import { test, expect } from './helpers/orca-app'
+import { forceQuitElectronAppForE2E } from './helpers/electron-process-shutdown'
+import { attachRepoAndOpenTerminal, createRestartSession } from './helpers/orca-restart'
+import { execInTerminal, waitForTerminalOutput, waitForActivePanePtyId } from './helpers/terminal'
+import {
+  waitForSessionReady,
+  waitForActiveWorktree,
+  getActiveWorktreeId,
+  getWorktreeTabs
+} from './helpers/store'
+import {
+  seededRepoPathOrSkip,
+  bootstrapFirstLaunch,
+  bootstrapRestoredLaunch,
+  waitForElectronProcessExit
+} from './helpers/terminal-restart-persistence'
+
+test.describe.configure({ mode: 'serial' })
+
+test.describe('SQLite candidate terminal restart persistence', () => {
+  test('SQLite survives restart after legacy JSON is removed', async (// oxlint-disable-next-line no-empty-pattern -- Playwright's second fixture arg is testInfo; the first must be an object destructure to opt out of the default fixture set.
+  {}, testInfo) => {
+    const repoPath = seededRepoPathOrSkip()
+
+    const session = createRestartSession(testInfo)
+    let firstApp: ElectronApplication | null = null
+    let secondApp: ElectronApplication | null = null
+
+    try {
+      const firstLaunch = await session.launch()
+      firstApp = firstLaunch.app
+      const { worktreeId, ptyId } = await bootstrapFirstLaunch(firstLaunch.page, repoPath)
+
+      const automationName = `sqlite-candidate-restart-${Date.now()}`
+      const automationPrompt = 'Persist this candidate automation across an SQLite-only restart.'
+      const automationLifecycle = await firstLaunch.page.evaluate(
+        async ({ name, prompt }) => {
+          const isRecord = (value: unknown): value is Record<string, unknown> =>
+            typeof value === 'object' && value !== null && !Array.isArray(value)
+          const repo = window.__store?.getState().repos[0]
+          if (!repo) {
+            throw new Error('SQLite candidate E2E did not find a seeded repository')
+          }
+          const response = await window.api.runtime.call({
+            method: 'automation.create',
+            params: {
+              agentId: 'codex',
+              name,
+              prompt,
+              repo: `id:${repo.id}`,
+              // Keep a full run context in the persisted definition so `runNow`
+              // exercises the same runtime RPC and normalized automationRuns
+              // path used by real scheduled work.
+              runContext: {
+                kind: 'workspace-run',
+                projectId: repo.id,
+                hostId: 'runtime:missing',
+                projectHostSetupId: `missing-${Date.now()}`,
+                repoId: repo.id,
+                path: repo.path
+              },
+              workspaceMode: 'new_per_run',
+              reuseSession: false,
+              timezone: 'UTC',
+              rrule: 'FREQ=DAILY;BYHOUR=9;BYMINUTE=0',
+              dtstart: Date.now(),
+              enabled: false,
+              missedRunGraceMinutes: 720
+            }
+          })
+          if (!response.ok) {
+            throw new Error(`${response.error.code}: ${response.error.message}`)
+          }
+          const createResult = isRecord(response.result) ? response.result : null
+          const automation =
+            createResult && isRecord(createResult.automation) ? createResult.automation : null
+          if (!automation || typeof automation.id !== 'string') {
+            throw new Error('automation.create returned an invalid automation')
+          }
+          const runResponse = await window.api.runtime.call({
+            method: 'automation.runNow',
+            params: { id: automation.id }
+          })
+          if (!runResponse.ok) {
+            throw new Error(`${runResponse.error.code}: ${runResponse.error.message}`)
+          }
+          const runResult = isRecord(runResponse.result) ? runResponse.result : null
+          const run = runResult && isRecord(runResult.run) ? runResult.run : null
+          if (!run || typeof run.id !== 'string' || typeof run.status !== 'string') {
+            throw new Error('automation.runNow returned an invalid run')
+          }
+          return {
+            automationId: automation.id,
+            runId: run.id,
+            runStatus: run.status
+          }
+        },
+        { name: automationName, prompt: automationPrompt }
+      )
+      expect(automationLifecycle.runStatus).toBe('dispatching')
+
+      const profileIndex: unknown = JSON.parse(
+        readFileSync(path.join(session.userDataDir, 'orca-profile-index.json'), 'utf8')
+      )
+      if (
+        typeof profileIndex !== 'object' ||
+        profileIndex === null ||
+        Array.isArray(profileIndex) ||
+        !('activeProfileId' in profileIndex) ||
+        typeof profileIndex.activeProfileId !== 'string'
+      ) {
+        throw new Error('SQLite cutover E2E did not find an active profile id')
+      }
+      const profileDirectory = path.join(
+        session.userDataDir,
+        'profiles',
+        profileIndex.activeProfileId
+      )
+      const legacyProfileState = path.join(profileDirectory, 'orca-data.json')
+      const legacyRootState = path.join(session.userDataDir, 'orca-data.json')
+      const databasePath = path.join(profileDirectory, 'profile-state.db')
+      expect(existsSync(databasePath)).toBe(true)
+      expect(existsSync(legacyProfileState)).toBe(true)
+
+      await session.close(firstApp)
+      firstApp = null
+      expect(JSON.parse(readFileSync(legacyProfileState, 'utf8'))).toMatchObject({
+        automations: expect.arrayContaining([
+          expect.objectContaining({ id: automationLifecycle.automationId, name: automationName })
+        ])
+      })
+      // Prove the next launch has only the SQLite authority available.
+      rmSync(legacyProfileState, { force: true })
+      rmSync(legacyRootState, { force: true })
+      expect(existsSync(legacyProfileState)).toBe(false)
+      expect(existsSync(legacyRootState)).toBe(false)
+
+      const secondLaunch = await session.launch()
+      secondApp = secondLaunch.app
+      await bootstrapRestoredLaunch(secondLaunch.page, worktreeId)
+      expect(existsSync(legacyProfileState)).toBe(false)
+      expect(existsSync(legacyRootState)).toBe(false)
+      // The daemon survives the clean Electron restart, so a SQLite-only launch
+      // must reattach the same PTY binding instead of silently spawning a new shell.
+      await expect
+        .poll(() => waitForActivePanePtyId(secondLaunch.page), { timeout: 15_000 })
+        .toBe(ptyId)
+      const ptyMarker = `SQLITE_PTY_REATTACHED_${Date.now()}`
+      await execInTerminal(secondLaunch.page, ptyId, `echo ${ptyMarker}`)
+      await waitForTerminalOutput(secondLaunch.page, ptyMarker)
+      await expect
+        .poll(
+          async () =>
+            await secondLaunch.page.evaluate(
+              async ({ name, prompt }) => {
+                const response = await window.api.runtime.call({ method: 'automation.list' })
+                if (!response.ok) {
+                  return false
+                }
+                if (
+                  typeof response.result !== 'object' ||
+                  response.result === null ||
+                  !('automations' in response.result) ||
+                  !Array.isArray(response.result.automations)
+                ) {
+                  return false
+                }
+                return response.result.automations.some((automation) => {
+                  if (typeof automation !== 'object' || automation === null) {
+                    return false
+                  }
+                  return (
+                    'name' in automation &&
+                    'prompt' in automation &&
+                    automation.name === name &&
+                    automation.prompt === prompt
+                  )
+                })
+              },
+              { name: automationName, prompt: automationPrompt }
+            ),
+          { timeout: 10_000 }
+        )
+        .toBe(true)
+      await expect
+        .poll(
+          async () =>
+            await secondLaunch.page.evaluate(async ({ automationId, runId }) => {
+              const response = await window.api.runtime.call({
+                method: 'automation.runs',
+                params: { automationId }
+              })
+              if (
+                !response.ok ||
+                typeof response.result !== 'object' ||
+                response.result === null ||
+                !('runs' in response.result) ||
+                !Array.isArray(response.result.runs)
+              ) {
+                return false
+              }
+              return response.result.runs.some(
+                (run) => typeof run === 'object' && run !== null && 'id' in run && run.id === runId
+              )
+            }, automationLifecycle),
+          { timeout: 10_000 }
+        )
+        .toBe(true)
+      await expect
+        .poll(async () => (await getWorktreeTabs(secondLaunch.page, worktreeId)).length, {
+          timeout: 10_000
+        })
+        .toBeGreaterThanOrEqual(1)
+    } finally {
+      if (secondApp) {
+        await session.close(secondApp)
+      }
+      if (firstApp) {
+        await session.close(firstApp)
+      }
+      await session.dispose()
+    }
+  })
+
+  test('SQLite profile switch keeps independent profiles isolated', async (// oxlint-disable-next-line no-empty-pattern -- Playwright's second fixture arg is testInfo; the first must be an object destructure to opt out of the default fixture set.
+  {}, testInfo) => {
+    const repoPath = seededRepoPathOrSkip()
+
+    const session = createRestartSession(testInfo)
+    let firstApp: ElectronApplication | null = null
+    let secondApp: ElectronApplication | null = null
+    let thirdApp: ElectronApplication | null = null
+
+    try {
+      const firstLaunch = await session.launch()
+      firstApp = firstLaunch.app
+      const defaultWorktreeId = await attachRepoAndOpenTerminal(firstLaunch.page, repoPath)
+      await waitForSessionReady(firstLaunch.page)
+      const defaultProfileId = await firstLaunch.page.evaluate(async () => {
+        const profiles = await window.api.orcaProfiles.list()
+        return profiles.activeProfileId
+      })
+      const targetProfileId = await firstLaunch.page.evaluate(async () => {
+        const created = await window.api.orcaProfiles.createLocal({
+          name: `SQLite switch target ${Date.now()}`
+        })
+        return created.profile.id
+      })
+
+      const defaultProfileDirectory = path.join(session.userDataDir, 'profiles', defaultProfileId)
+      const defaultJson = path.join(defaultProfileDirectory, 'orca-data.json')
+      const rootJson = path.join(session.userDataDir, 'orca-data.json')
+      const defaultDatabase = path.join(defaultProfileDirectory, 'profile-state.db')
+      expect(existsSync(defaultDatabase)).toBe(true)
+
+      // The target switch must flush and publish the index before relaunching.
+      await expect(
+        firstLaunch.page.evaluate(
+          (profileId) => window.api.orcaProfiles.switchProfile({ profileId }),
+          targetProfileId
+        )
+      ).resolves.toEqual({ status: 'relaunching' })
+      await waitForElectronProcessExit(firstApp)
+      firstApp = null
+
+      const secondLaunch = await session.launch()
+      secondApp = secondLaunch.app
+      await waitForSessionReady(secondLaunch.page)
+      const targetList = await secondLaunch.page.evaluate(() => window.api.orcaProfiles.list())
+      expect(targetList.activeProfileId).toBe(targetProfileId)
+      const targetProfileDirectory = path.join(session.userDataDir, 'profiles', targetProfileId)
+      const targetDatabase = path.join(targetProfileDirectory, 'profile-state.db')
+      const targetJson = path.join(targetProfileDirectory, 'orca-data.json')
+      expect(existsSync(targetDatabase)).toBe(true)
+
+      // Seed an independent target-profile document before switching back.
+      await attachRepoAndOpenTerminal(secondLaunch.page, repoPath)
+      await waitForSessionReady(secondLaunch.page)
+
+      await expect(
+        secondLaunch.page.evaluate(
+          (profileId) => window.api.orcaProfiles.switchProfile({ profileId }),
+          defaultProfileId
+        )
+      ).resolves.toEqual({ status: 'relaunching' })
+      await waitForElectronProcessExit(secondApp)
+      secondApp = null
+
+      // Clean maintenance refreshes compatibility JSON before releasing the profile.
+      expect(existsSync(targetJson)).toBe(true)
+      for (const legacyPath of [targetJson, defaultJson, rootJson]) {
+        rmSync(legacyPath, { force: true })
+      }
+      const thirdLaunch = await session.launch()
+      thirdApp = thirdLaunch.app
+      await waitForSessionReady(thirdLaunch.page)
+      const finalList = await thirdLaunch.page.evaluate(() => window.api.orcaProfiles.list())
+      expect(finalList.activeProfileId).toBe(defaultProfileId)
+      expect(existsSync(defaultDatabase)).toBe(true)
+      expect(existsSync(targetDatabase)).toBe(true)
+      expect(existsSync(defaultJson)).toBe(false)
+      expect(existsSync(targetJson)).toBe(false)
+      await waitForActiveWorktree(thirdLaunch.page)
+      await expect
+        .poll(() => getActiveWorktreeId(thirdLaunch.page), { timeout: 10_000 })
+        .toBe(defaultWorktreeId)
+    } finally {
+      if (thirdApp) {
+        await session.close(thirdApp)
+      }
+      if (secondApp) {
+        await session.close(secondApp)
+      }
+      if (firstApp) {
+        await session.close(firstApp)
+      }
+      await session.dispose()
+    }
+  })
+
+  test('SQLite moves a project across JSON-free profiles', async (// oxlint-disable-next-line no-empty-pattern -- Playwright's second fixture arg is testInfo; the first must be an object destructure to opt out of the default fixture set.
+  {}, testInfo) => {
+    const repoPath = seededRepoPathOrSkip()
+
+    const session = createRestartSession(testInfo)
+    let firstApp: ElectronApplication | null = null
+    let secondApp: ElectronApplication | null = null
+    let thirdApp: ElectronApplication | null = null
+
+    try {
+      const firstLaunch = await session.launch()
+      firstApp = firstLaunch.app
+      const worktreeId = await attachRepoAndOpenTerminal(firstLaunch.page, repoPath)
+      await waitForSessionReady(firstLaunch.page)
+      const profileState = await firstLaunch.page.evaluate(async (repoId) => {
+        const profiles = await window.api.orcaProfiles.list()
+        const repo = window.__store?.getState().repos.find((entry) => entry.id === repoId)
+        if (!repo) {
+          throw new Error('SQLite profile move E2E did not find the seeded repository')
+        }
+        const target = await window.api.orcaProfiles.createLocal({
+          name: `SQLite move target ${Date.now()}`
+        })
+        return {
+          sourceProfileId: profiles.activeProfileId,
+          targetProfileId: target.profile.id,
+          repoId: repo.id
+        }
+      }, getRepoIdFromWorktreeId(worktreeId))
+
+      const sourceDirectory = path.join(
+        session.userDataDir,
+        'profiles',
+        profileState.sourceProfileId
+      )
+      const targetDirectory = path.join(
+        session.userDataDir,
+        'profiles',
+        profileState.targetProfileId
+      )
+      const sourceDatabase = path.join(sourceDirectory, 'profile-state.db')
+      const targetDatabase = path.join(targetDirectory, 'profile-state.db')
+      const sourceJson = path.join(sourceDirectory, 'orca-data.json')
+      const targetJson = path.join(targetDirectory, 'orca-data.json')
+      const rootJson = path.join(session.userDataDir, 'orca-data.json')
+      expect(existsSync(sourceDatabase)).toBe(true)
+
+      // Visit the target once so candidate startup establishes its own database before the move.
+      await expect(
+        firstLaunch.page.evaluate(
+          (profileId) => window.api.orcaProfiles.switchProfile({ profileId }),
+          profileState.targetProfileId
+        )
+      ).resolves.toEqual({ status: 'relaunching' })
+      await waitForElectronProcessExit(firstApp)
+      firstApp = null
+
+      const secondLaunch = await session.launch()
+      secondApp = secondLaunch.app
+      await waitForSessionReady(secondLaunch.page)
+      expect(await secondLaunch.page.evaluate(() => window.api.orcaProfiles.list())).toMatchObject({
+        activeProfileId: profileState.targetProfileId
+      })
+      expect(existsSync(targetDatabase)).toBe(true)
+
+      await expect(
+        secondLaunch.page.evaluate(
+          (profileId) => window.api.orcaProfiles.switchProfile({ profileId }),
+          profileState.sourceProfileId
+        )
+      ).resolves.toEqual({ status: 'relaunching' })
+      await waitForElectronProcessExit(secondApp)
+      secondApp = null
+
+      const thirdLaunch = await session.launch()
+      thirdApp = thirdLaunch.app
+      await waitForSessionReady(thirdLaunch.page)
+      const moveResult = await thirdLaunch.page.evaluate(
+        (args) => window.api.orcaProfiles.transferProject(args),
+        {
+          sourceProfileId: profileState.sourceProfileId,
+          targetProfileId: profileState.targetProfileId,
+          repoId: profileState.repoId,
+          mode: 'move' as const
+        }
+      )
+      expect(moveResult).toMatchObject({
+        status: 'transferred',
+        mode: 'move',
+        willRelaunch: true
+      })
+      await waitForElectronProcessExit(thirdApp)
+      thirdApp = null
+
+      // The move commits both SQLite participants before relaunch. Remove every JSON mirror to
+      // prove the target and source are both reopened from their databases alone.
+      for (const legacyPath of [sourceJson, targetJson, rootJson]) {
+        rmSync(legacyPath, { force: true })
+      }
+      expect(existsSync(sourceJson)).toBe(false)
+      expect(existsSync(targetJson)).toBe(false)
+
+      const targetLaunch = await session.launch()
+      secondApp = targetLaunch.app
+      await waitForSessionReady(targetLaunch.page)
+      expect(await targetLaunch.page.evaluate(() => window.api.orcaProfiles.list())).toMatchObject({
+        activeProfileId: profileState.targetProfileId
+      })
+      expect(
+        await targetLaunch.page.evaluate(
+          (repoId) => window.__store?.getState().repos.some((repo) => repo.id === repoId),
+          profileState.repoId
+        )
+      ).toBe(true)
+      expect(existsSync(targetDatabase)).toBe(true)
+
+      await expect(
+        targetLaunch.page.evaluate(
+          (profileId) => window.api.orcaProfiles.switchProfile({ profileId }),
+          profileState.sourceProfileId
+        )
+      ).resolves.toEqual({ status: 'relaunching' })
+      await waitForElectronProcessExit(secondApp)
+      secondApp = null
+
+      // Switching away refreshes the target export; remove it before the SQL-only source launch.
+      rmSync(targetJson, { force: true })
+      const sourceLaunch = await session.launch()
+      thirdApp = sourceLaunch.app
+      await waitForSessionReady(sourceLaunch.page)
+      expect(await sourceLaunch.page.evaluate(() => window.api.orcaProfiles.list())).toMatchObject({
+        activeProfileId: profileState.sourceProfileId
+      })
+      expect(
+        await sourceLaunch.page.evaluate(
+          (repoId) => window.__store?.getState().repos.some((repo) => repo.id === repoId),
+          profileState.repoId
+        )
+      ).toBe(false)
+      expect(existsSync(sourceDatabase)).toBe(true)
+      expect(existsSync(sourceJson)).toBe(false)
+      expect(existsSync(targetJson)).toBe(false)
+    } finally {
+      if (thirdApp) {
+        await session.close(thirdApp)
+      }
+      if (secondApp) {
+        await session.close(secondApp)
+      }
+      if (firstApp) {
+        await session.close(firstApp)
+      }
+      await session.dispose()
+    }
+  })
+
+  test('SQLite survives abrupt process termination after legacy JSON is removed', async (// oxlint-disable-next-line no-empty-pattern -- Playwright's second fixture arg is testInfo; the first must be an object destructure to opt out of the default fixture set.
+  {}, testInfo) => {
+    const repoPath = seededRepoPathOrSkip()
+
+    const session = createRestartSession(testInfo)
+    const stderr: string[] = []
+    const launchOptions = {
+      onStderr: (chunk: string): void => {
+        stderr.push(chunk)
+      }
+    }
+    let firstApp: ElectronApplication | null = null
+    let secondApp: ElectronApplication | null = null
+
+    try {
+      const firstLaunch = await session.launch(launchOptions)
+      firstApp = firstLaunch.app
+      const { worktreeId, ptyId } = await bootstrapFirstLaunch(firstLaunch.page, repoPath)
+
+      const profileIndex: unknown = JSON.parse(
+        readFileSync(path.join(session.userDataDir, 'orca-profile-index.json'), 'utf8')
+      )
+      if (
+        typeof profileIndex !== 'object' ||
+        profileIndex === null ||
+        Array.isArray(profileIndex) ||
+        !('activeProfileId' in profileIndex) ||
+        typeof profileIndex.activeProfileId !== 'string'
+      ) {
+        throw new Error('SQLite crash E2E did not find an active profile id')
+      }
+      const profileDirectory = path.join(
+        session.userDataDir,
+        'profiles',
+        profileIndex.activeProfileId
+      )
+      const legacyProfileState = path.join(profileDirectory, 'orca-data.json')
+      const legacyRootState = path.join(session.userDataDir, 'orca-data.json')
+      const databasePath = path.join(profileDirectory, 'profile-state.db')
+      expect(existsSync(databasePath)).toBe(true)
+
+      // Remove both JSON mirrors before the kill. Any state recovered by the next
+      // launch must therefore come from SQLite, including the terminal topology.
+      rmSync(legacyProfileState, { force: true })
+      rmSync(legacyRootState, { force: true })
+      expect(existsSync(legacyProfileState)).toBe(false)
+      expect(existsSync(legacyRootState)).toBe(false)
+
+      const mainPid = await firstApp.evaluate(() => process.pid)
+      await forceQuitElectronAppForE2E(firstApp, { preserveDaemons: true })
+      // Windows Playwright exposes a cmd wrapper; verify the actual Electron process exited.
+      await expect
+        .poll(() => {
+          try {
+            process.kill(mainPid, 0)
+            return false
+          } catch (error) {
+            if (error instanceof Error && 'code' in error && error.code === 'ESRCH') {
+              return true
+            }
+            throw error
+          }
+        })
+        .toBe(true)
+      firstApp = null
+      for (const suffix of ['', '-wal', '-shm']) {
+        const filename = `profile-state.db${suffix}`
+        const filePath = path.join(profileDirectory, filename)
+        if (existsSync(filePath)) {
+          await testInfo.attach(filename, {
+            body: readFileSync(filePath),
+            contentType: 'application/octet-stream'
+          })
+        }
+      }
+
+      const secondLaunch = await session.launch(launchOptions)
+      secondApp = secondLaunch.app
+      await bootstrapRestoredLaunch(secondLaunch.page, worktreeId)
+      expect(existsSync(legacyProfileState)).toBe(false)
+      expect(existsSync(legacyRootState)).toBe(false)
+      // The daemon survives the Electron crash, so a SQLite-only restart must
+      // reattach the same PTY binding instead of silently spawning a new shell.
+      await expect
+        .poll(() => waitForActivePanePtyId(secondLaunch.page), { timeout: 15_000 })
+        .toBe(ptyId)
+      const ptyMarker = `SQLITE_PTY_REATTACHED_AFTER_KILL_${Date.now()}`
+      await execInTerminal(secondLaunch.page, ptyId, `echo ${ptyMarker}`)
+      await waitForTerminalOutput(secondLaunch.page, ptyMarker)
+      await expect
+        .poll(async () => (await getWorktreeTabs(secondLaunch.page, worktreeId)).length, {
+          timeout: 10_000
+        })
+        .toBeGreaterThanOrEqual(1)
+    } finally {
+      if (secondApp) {
+        await session.close(secondApp)
+      }
+      if (firstApp) {
+        await session.close(firstApp)
+      }
+      await session.dispose()
+      await testInfo.attach('restart-stderr', {
+        body: stderr.join(''),
+        contentType: 'text/plain'
+      })
+    }
+  })
+})
diff --git a/tests/e2e/remote-terminal-tab-retirement.unit.test.ts b/tests/e2e/remote-terminal-tab-retirement.unit.test.ts
index 45ac2f8b0a00..4d5ee50a1d70 100644
--- a/tests/e2e/remote-terminal-tab-retirement.unit.test.ts
+++ b/tests/e2e/remote-terminal-tab-retirement.unit.test.ts
@@ -10,6 +10,7 @@ import {
   type WebSessionTabsSyncState
 } from '../../src/renderer/src/runtime/web-session-tabs-sync'
 import { OrcaRuntimeService } from '../../src/main/runtime/orca-runtime'
+import { withDurableRuntimeStore } from '../../src/main/runtime/runtime-durable-store-fixture'
 
 vi.mock('../../src/renderer/src/store', () => ({
   useAppStore: { setState: vi.fn() }
@@ -129,13 +130,16 @@ describe('remote terminal tab retirement publication', () => {
   it('removes a permanent host exit from simultaneous viewers without stale resurrection', async () => {
     let session = makePersistedSession()
     const flushOrThrow = vi.fn()
-    const runtime = new OrcaRuntimeService({
-      getWorkspaceSession: () => session,
-      setWorkspaceSession: (next) => {
-        session = next
-      },
-      flushOrThrow
-    } as never)
+    const runtime = new OrcaRuntimeService(
+      // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: This retirement fixture implements the Store session and durability operations used by the runtime.
+      withDurableRuntimeStore({
+        getWorkspaceSession: () => session,
+        setWorkspaceSession: (next) => {
+          session = next
+        },
+        flushOrThrow
+      }) as never
+    )
     runtime.attachWindow(1)
     const staleLiveSnapshot = makeHostSnapshot()
     runtime.syncWindowGraph(1, {
@@ -177,7 +181,7 @@ describe('remote terminal tab retirement publication', () => {
 
     const publications: (typeof livePublication)[] = []
     const unsubscribe = runtime.onMobileSessionTabsChanged((event) => publications.push(event))
-    runtime.onPtyExit(PTY_ID, 0, INCARNATION_ID)
+    await runtime.onPtyExit(PTY_ID, 0, INCARNATION_ID)
     const retiredPublication = publications.at(-1)
     expect(retiredPublication).toBeDefined()
     if (!retiredPublication) {
diff --git a/tests/e2e/settled-worker-tab-survives-restart.spec.ts b/tests/e2e/settled-worker-tab-survives-restart.spec.ts
index db3b03409dd6..695abfa0325a 100644
--- a/tests/e2e/settled-worker-tab-survives-restart.spec.ts
+++ b/tests/e2e/settled-worker-tab-survives-restart.spec.ts
@@ -1,8 +1,9 @@
+import { parseWorkspaceSession } from '../../src/shared/workspace-session-schema'
+import { readPersistedProfileState } from './helpers/persisted-profile-state'
 import { existsSync, readFileSync } from 'node:fs'
 import path from 'node:path'
 import { DaemonClient } from '../../src/main/daemon/client'
 import { getDaemonSocketPath, getDaemonTokenPath } from '../../src/main/daemon/daemon-spawner'
-import { DEFAULT_LOCAL_ORCA_PROFILE_ID } from '../../src/shared/orca-profiles'
 import type { ElectronApplication, Page } from '@stablyai/playwright-test'
 import { test, expect } from './helpers/orca-app'
 import { TEST_REPO_PATH_FILE } from './global-setup'
@@ -71,6 +72,8 @@ async function findSecondaryWorktree(
 }
 
 async function backgroundMountTab(page: Page, worktreeId: string, tabId: string): Promise<void> {
+  // The synthetic event bypasses the production queue, so its Terminal listener must be mounted.
+  await waitForActiveTerminalManager(page)
   await page.evaluate(
     ({ tabId, worktreeId }) => {
       window.dispatchEvent(
@@ -87,21 +90,20 @@ async function backgroundMountTab(page: Page, worktreeId: string, tabId: string)
 }
 
 function readPersistedSession(userDataDir: string) {
-  return JSON.parse(
-    readFileSync(
-      path.join(userDataDir, 'profiles', DEFAULT_LOCAL_ORCA_PROFILE_ID, 'orca-data.json'),
-      'utf8'
-    )
-  ).workspaceSession
+  const parsed = parseWorkspaceSession(readPersistedProfileState(userDataDir).workspaceSession)
+  if (!parsed.ok) {
+    throw new Error(`Invalid persisted workspace session: ${parsed.error}`)
+  }
+  return parsed.value
 }
 
 function expectNoPersistedWorkerFence(userDataDir: string, paneKey: string): void {
-  const persisted = readPersistedSession(userDataDir)
+  const persisted = readPersistedProfileState(userDataDir).workspaceSession
   // Keep the baseline running through reveal even when it still writes the withdrawn policy.
   expect
-    .soft(persisted.sleepingAgentSessionsByPaneKey?.[paneKey] ?? {})
-    .not.toHaveProperty('automaticResumeBlockedBy')
-  expect.soft(persisted.legacyWorkerResumeFencesByPaneKey ?? {}).not.toHaveProperty(paneKey)
+    .soft(persisted)
+    .not.toHaveProperty(['sleepingAgentSessionsByPaneKey', paneKey, 'automaticResumeBlockedBy'])
+  expect.soft(persisted).not.toHaveProperty(['legacyWorkerResumeFencesByPaneKey', paneKey])
 }
 
 // A restored worker must attach through main so revealing it never fabricates a missing PTY.
@@ -479,7 +481,7 @@ for (const daemonSessionGone of [false, true]) {
       const paneKeys = await second.page.evaluate((tabId) => {
         const layout = window.__store?.getState().terminalLayoutsByTabId[tabId]
         const leaves: string[] = []
-        const visit = (node: NonNullable<typeof layout>['root']) => {
+        const visit = (node: NonNullable<NonNullable<typeof layout>['root']>) => {
           if (node.type === 'leaf') {
             leaves.push(`${tabId}:${node.leafId}`)
           } else {
@@ -514,7 +516,7 @@ for (const daemonSessionGone of [false, true]) {
       expect(persisted.terminalLayoutsByTabId[workerTabId]).toBeDefined()
       if (!daemonSessionGone) {
         expect(
-          Object.values(persisted.terminalLayoutsByTabId[workerTabId].ptyIdsByLeafId)
+          Object.values(persisted.terminalLayoutsByTabId[workerTabId].ptyIdsByLeafId ?? {})
         ).toContain(workerPtyId)
       }
     } finally {
diff --git a/tests/e2e/ssh-docker-reconnect-pane-restore.spec.ts b/tests/e2e/ssh-docker-reconnect-pane-restore.spec.ts
index a7a2261de685..27be0b9ad1b0 100644
--- a/tests/e2e/ssh-docker-reconnect-pane-restore.spec.ts
+++ b/tests/e2e/ssh-docker-reconnect-pane-restore.spec.ts
@@ -18,6 +18,7 @@ import {
   reconnectDockerSshRelayTarget
 } from './helpers/docker-ssh-relay-connection'
 import { openTerminalTabInActiveGroup } from './helpers/terminal-tab-open'
+import { attachSshReconnectFailureObservation } from './helpers/ssh-reconnect-failure-observation'
 
 const RUN_DOCKER_SSH = process.env.ORCA_E2E_SSH_DOCKER === '1'
 
@@ -63,6 +64,8 @@ test.describe('SSH reconnect pane restore', () => {
   }, testInfo) => {
     test.slow()
     let target: DockerSshRelayTarget | null = null
+    let targetId: string | null = null
+    let originalPtyId: string | null = null
     try {
       target = startDockerSshRelayTarget(testInfo)
       // The fixture image's shell emits no OSC 0, so without this every tab keeps its placeholder
@@ -71,9 +74,11 @@ test.describe('SSH reconnect pane restore', () => {
       await waitForSessionReady(orcaPage)
       await waitForActiveWorktree(orcaPage)
       const remote = await connectDockerSshRelayTarget(orcaPage, target)
+      targetId = remote.targetId
       await ensureTerminalVisible(orcaPage, 45_000)
       await waitForActiveTerminalManager(orcaPage, 60_000)
       const ptyId = await waitForActivePanePtyId(orcaPage, 60_000)
+      originalPtyId = ptyId
 
       // A marker rather than a prompt: a prompt reappears on its own after a reconnect, so it cannot
       // distinguish restored scrollback from a fresh shell. This string only exists if the pane kept
@@ -108,13 +113,15 @@ test.describe('SSH reconnect pane restore', () => {
       await execInTerminal(orcaPage, ptyId, 'top -b -n 1 > /dev/null; top')
       await waitForTerminalOutput(orcaPage, 'load average', 30_000, 8000)
 
-      await reconnectDockerSshRelayTarget(orcaPage, remote.targetId)
-      await waitForActiveTerminalManager(orcaPage, 60_000)
-      await waitForActivePanePtyId(orcaPage, 60_000)
+      for (let reconnect = 0; reconnect < 3; reconnect += 1) {
+        await reconnectDockerSshRelayTarget(orcaPage, remote.targetId)
+        await waitForActiveTerminalManager(orcaPage, 60_000)
+        await waitForActivePanePtyId(orcaPage, 60_000)
 
-      await waitForTerminalOutput(orcaPage, 'load average', 60_000, 8000)
-      const tuiContent = await getTerminalContent(orcaPage, 8000)
-      expect(tuiContent).toContain('PID')
+        await waitForTerminalOutput(orcaPage, 'load average', 60_000, 8000)
+        const tuiContent = await getTerminalContent(orcaPage, 8000)
+        expect(tuiContent).toContain('PID')
+      }
 
       // REGRESSION 2: opening a tab AFTER a reconnect. The prepaint could still fire on this mount
       // and write over the new shell, leaving a pane with no prompt and a generic tab title.
@@ -152,6 +159,17 @@ test.describe('SSH reconnect pane restore', () => {
           { timeout: 60_000, message: 'New tab kept its placeholder title' }
         )
         .not.toMatch(/^Terminal \d+$/)
+    } catch (error) {
+      await attachSshReconnectFailureObservation(
+        orcaPage,
+        testInfo,
+        target,
+        targetId,
+        originalPtyId
+      ).catch((diagnosticError) =>
+        console.warn('SSH reconnect diagnostics failed', diagnosticError)
+      )
+      throw error
     } finally {
       if (target) {
         cleanupDockerSshRelayTarget(target)
diff --git a/tests/e2e/ssh-docker-resource-accumulation.spec.ts b/tests/e2e/ssh-docker-resource-accumulation.spec.ts
index f028ef0d2ab0..bb4a35201836 100644
--- a/tests/e2e/ssh-docker-resource-accumulation.spec.ts
+++ b/tests/e2e/ssh-docker-resource-accumulation.spec.ts
@@ -71,17 +71,22 @@ const DESCRIBE_MASTER_FD_HOLDERS = [
   'done'
 ].join('\n')
 
+function readRelayFdCount(target: DockerSshRelayTarget, relayPid: number): number {
+  const raw = execDockerSshRelayTargetCommand(
+    target,
+    `set -o pipefail\nls /proc/${relayPid}/fd | wc -l`
+  )
+  return Number(raw.trim())
+}
+
 function sampleRemoteResources(target: DockerSshRelayTarget): RemoteResourceSample {
   const groups = readDockerSshRelayProcessSnapshots(target)
   // Why: fd growth is only meaningful against the relay that owns the PTYs, so read
   // the table of every relay group and sum, rather than assuming a single relay.
-  const relayFdCount = groups.reduce((total, group) => {
-    const raw = execDockerSshRelayTargetCommand(
-      target,
-      `ls /proc/${group.relayPid}/fd 2>/dev/null | wc -l`
-    )
-    return total + Number(raw.trim() || '0')
-  }, 0)
+  const relayFdCount = groups.reduce(
+    (total, group) => total + readRelayFdCount(target, group.relayPid),
+    0
+  )
   const ptsCount = Number(
     execDockerSshRelayTargetCommand(target, 'ls /dev/pts | grep -c "^[0-9]" || true').trim() || '0'
   )
@@ -192,7 +197,36 @@ test.describe('Docker SSH relay resource accumulation', () => {
       // Why: the interesting failure is monotonic growth across cycles, not the
       // absolute count, so compare the last cycle against the first.
       expect(last.ptsCount).toBeLessThanOrEqual(first.ptsCount)
-      expect(last.relayFdCount).toBeLessThanOrEqual(first.relayFdCount + 4)
+      let settledFdCount = last.relayFdCount
+      if (settledFdCount > first.relayFdCount + 4) {
+        const groups = readDockerSshRelayProcessSnapshots(target)
+        expect(groups).toHaveLength(1)
+        const relayPid = groups[0]!.relayPid
+        const diagnostics = execDockerSshRelayTargetCommand(
+          target,
+          [`ls -l /proc/${relayPid}/fd || true`, 'ps -eo pid,ppid,stat,tty,args'].join('\n')
+        )
+        console.log(`[resource-accumulation] over-budget relay fds\n${diagnostics}`)
+        await testInfo.attach('relay-fd-over-budget', {
+          body: diagnostics,
+          contentType: 'text/plain'
+        })
+        // Background inventory reads can overlap this sample; allow 10s for their FDs to close.
+        await expect
+          .poll(
+            () => {
+              expect(
+                readDockerSshRelayProcessSnapshots(captured).map((group) => group.relayPid)
+              ).toEqual([relayPid])
+              settledFdCount = readRelayFdCount(captured, relayPid)
+              console.log(`[resource-accumulation] settling relay fds ${settledFdCount}`)
+              return settledFdCount
+            },
+            { timeout: 10_000, intervals: [100, 250, 500] }
+          )
+          .toBeLessThanOrEqual(first.relayFdCount + 4)
+      }
+      expect(settledFdCount).toBeLessThanOrEqual(first.relayFdCount + 4)
       expect(last.nodeProcessCount).toBeLessThanOrEqual(first.nodeProcessCount)
       expect(last.leakedMasterFdCount).toBeLessThanOrEqual(first.leakedMasterFdCount)
     } finally {
diff --git a/tests/e2e/ssh-docker-transport-drop-recovery.spec.ts b/tests/e2e/ssh-docker-transport-drop-recovery.spec.ts
index 83a7ae66f652..7939320d666a 100644
--- a/tests/e2e/ssh-docker-transport-drop-recovery.spec.ts
+++ b/tests/e2e/ssh-docker-transport-drop-recovery.spec.ts
@@ -1,8 +1,6 @@
-import path from 'node:path'
-import { readFileSync } from 'node:fs'
+import { readPersistedProfileState } from './helpers/persisted-profile-state'
 import type { ElectronApplication } from '@playwright/test'
 import { test, expect } from './helpers/orca-app'
-import { DEFAULT_LOCAL_ORCA_PROFILE_ID } from '../../src/shared/orca-profiles'
 import { sshRemotePtyLeaseAllowsReattach, type SshRemotePtyLease } from '../../src/shared/ssh-types'
 import { toRelaySshPtyId } from '../../src/shared/ssh-pty-id'
 import { ensureTerminalVisible, waitForActiveWorktree, waitForSessionReady } from './helpers/store'
@@ -60,13 +58,8 @@ const RUN_DOCKER_SSH = process.env.ORCA_E2E_SSH_DOCKER === '1'
  * drift from the fan-out it exists to bound.
  */
 function readSshLeases(userDataDir: string, targetId: string): SshRemotePtyLease[] {
-  const dataPath = path.join(
-    userDataDir,
-    'profiles',
-    DEFAULT_LOCAL_ORCA_PROFILE_ID,
-    'orca-data.json'
-  )
-  const parsed = JSON.parse(readFileSync(dataPath, 'utf8')) as {
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: This test owns the persisted fixture; optional fields are checked at use sites.
+  const parsed = readPersistedProfileState(userDataDir) as {
     sshRemotePtyLeases?: SshRemotePtyLease[]
   }
   return (parsed.sshRemotePtyLeases ?? []).filter((lease) => lease.targetId === targetId)
diff --git a/tests/e2e/structured-chat-owner-status-activation.unit.test.ts b/tests/e2e/structured-chat-owner-status-activation.unit.test.ts
new file mode 100644
index 000000000000..3d8858b3658b
--- /dev/null
+++ b/tests/e2e/structured-chat-owner-status-activation.unit.test.ts
@@ -0,0 +1,154 @@
+// A chat whose agent is not running still owns its conversation. Released desktop clients gate
+// worktree activation on the host's owner answer, so a chat at rest that answered anything but
+// `native` blocked the gate, which then skips adopting and resuming the worktree's paneless agents.
+// This drives the real host's answer through the desktop's activation gate for the two ways a chat
+// comes to rest.
+
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it, vi, type Mock } from 'vitest'
+import type { StructuredAgentSessionAdapter } from '../../src/main/native-chat/agent-session-wire/structured-agent-session-adapter'
+import { StructuredAgentSessionHost } from '../../src/main/native-chat/agent-session-wire/structured-agent-session-host'
+import {
+  HOST_TEST_NOW as NOW,
+  HOST_TEST_SESSION as SESSION,
+  HOST_TEST_THREAD as THREAD,
+  hostTestAttachParams,
+  resetHostTestOperationIds
+} from '../../src/main/native-chat/agent-session-wire/structured-agent-session-host-test-data'
+import { STRUCTURED_AGENT_SESSION_IDLE_MS } from '../../src/main/native-chat/agent-session-wire/structured-agent-session-idle-sweep'
+import { AgentSessionRecordStore } from '../../src/main/runtime/agent-session-record-store'
+import { useAppStore } from '../../src/renderer/src/store'
+import { runWorktreeAgentActivationGate } from '../../src/renderer/src/lib/worktree-agent-activation-gate'
+import { readWorktreeStructuredActivationInventory } from '../../src/renderer/src/lib/worktree-agent-structured-inventory'
+import type { RuntimeMobileSessionTabsResult } from '../../src/shared/runtime-types'
+
+const WORKTREE = 'repo-1::/workspace/repo'
+
+let root: string
+let clock: number
+let store: AgentSessionRecordStore
+let host: StructuredAgentSessionHost
+let closeSession: Mock<NonNullable<StructuredAgentSessionAdapter['closeSession']>>
+
+function openHost(): void {
+  host = new StructuredAgentSessionHost({
+    store,
+    adapter: {
+      acquire: async ({ fence, spawnToken }) => ({
+        process: { hostId: 'local', pid: 4242, processStartTimeMs: 1_700_000_000_000, spawnToken },
+        link: {
+          linkId: `link-${fence}`,
+          handle: { provider: 'codex', threadId: THREAD },
+          origin: store.getRecord(SESSION)?.providerHandleChain.length ? 'resumed' : 'created',
+          mintedAtFence: fence,
+          observedAt: NOW
+        }
+      }),
+      closeSession,
+      releaseAcquisition: async () => true,
+      dispatch: async () => ({ state: 'rejected', reason: 'unused' }),
+      cancelTurn: async () => ({ cancelled: false }),
+      answerPrompt: async () => undefined,
+      setOption: async () => undefined
+    },
+    journalRoot: root,
+    claimKeyId: 'key-1',
+    mintSpawnToken: () => 'spawn-a',
+    idleSweep: { intervalMs: 5 },
+    probeOwner: async () => ({ outcome: 'pid-absent' }),
+    now: () => clock
+  })
+}
+
+/** The desktop's runtime bridge, answering the two reads the gate makes from the real host. */
+function serveDesktopRuntime(): void {
+  const tabs: RuntimeMobileSessionTabsResult = {
+    worktree: WORKTREE,
+    publicationEpoch: 'owner-status-test',
+    snapshotVersion: 1,
+    activeGroupId: null,
+    activeTabId: null,
+    activeTabType: null,
+    tabs: [
+      {
+        type: 'agent-session',
+        id: `structured-agent-session-${SESSION}`,
+        title: 'Codex Chat',
+        sessionId: SESSION,
+        agent: 'codex',
+        isActive: false
+      }
+    ]
+  }
+  const call = async ({ method, params }: { method: string; params: { sessionId?: string } }) => {
+    if (method === 'session.tabs.list') {
+      return { ok: true, result: tabs }
+    }
+    if (method === 'agentSession.handoffStatus') {
+      try {
+        return { ok: true, result: host.handoffStatus(params.sessionId ?? '') }
+      } catch (error) {
+        return { ok: false, error: { code: String(error), message: String(error) } }
+      }
+    }
+    throw new Error(`Unexpected runtime method: ${method}`)
+  }
+  vi.stubGlobal('window', { api: { runtime: { call } } })
+}
+
+function activate(): ReturnType<typeof runWorktreeAgentActivationGate> {
+  return runWorktreeAgentActivationGate(WORKTREE, {
+    getState: () => useAppStore.getState(),
+    listSessions: async () => [],
+    listSurfaceOwners: async () => null,
+    hasStructuredSession: readWorktreeStructuredActivationInventory,
+    resume: () => 0
+  })
+}
+
+beforeEach(async () => {
+  root = await mkdtemp(join(tmpdir(), 'orca-owner-status-'))
+  clock = NOW
+  resetHostTestOperationIds()
+  closeSession = vi.fn(async () => true)
+  store = await AgentSessionRecordStore.open({ directory: join(root, 'store'), hostId: 'local' })
+  openHost()
+  expect(await host.attach({ callerKey: 'client-1' }, hostTestAttachParams(null))).toMatchObject({
+    ok: true
+  })
+  serveDesktopRuntime()
+})
+
+afterEach(async () => {
+  vi.unstubAllGlobals()
+  await host.flushAllStreamedEvents()
+  await rm(root, { recursive: true, force: true })
+})
+
+describe('a chat at rest keeps its worktree activatable', () => {
+  it('after the idle sweep stopped its agent and closed the conversation', async () => {
+    clock += STRUCTURED_AGENT_SESSION_IDLE_MS + 1
+    await vi.waitFor(() => expect(host.hasSession(SESSION)).toBe(false))
+    expect(closeSession).toHaveBeenCalledWith(SESSION)
+
+    expect(host.handoffStatus(SESSION)).toMatchObject({ owner: 'native' })
+    expect(await activate()).toBe('structured')
+  })
+
+  it('after an app restart restored it for reading', async () => {
+    await host.flushAllStreamedEvents()
+    store = await AgentSessionRecordStore.open({ directory: join(root, 'store'), hostId: 'local' })
+    openHost()
+    await host.restoreReadableSessions()
+    expect(host.hasSession(SESSION)).toBe(true)
+    expect(store.getRecord(SESSION)?.lease).toMatchObject({
+      claimStatus: 'released',
+      ownerProcess: null
+    })
+
+    expect(host.handoffStatus(SESSION)).toMatchObject({ owner: 'native' })
+    expect(await activate()).toBe('structured')
+  })
+})
diff --git a/tests/e2e/structured-session-reopened-tab-close.unit.test.ts b/tests/e2e/structured-session-reopened-tab-close.unit.test.ts
new file mode 100644
index 000000000000..35547145c32f
--- /dev/null
+++ b/tests/e2e/structured-session-reopened-tab-close.unit.test.ts
@@ -0,0 +1,231 @@
+// @vitest-environment happy-dom
+
+/**
+ * After /clear the current chat keeps the tab id derived from its first session, so reopening that
+ * first session from history lands in a suffixed tab. Closing or focusing the reopened tab from
+ * main must reach that tab, not the current chat. Runs the real main close/focus path against the
+ * real window store, mirror and IPC bridges; only the process boundary is stubbed.
+ */
+
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { RuntimeMobileSessionTabsResult } from '../../src/shared/runtime-types'
+import type * as RuntimeRpcClient from '../../src/renderer/src/runtime/runtime-rpc-client'
+import { OrcaRuntimeService } from '../../src/main/runtime/orca-runtime'
+import { setStructuredAgentSessionHost } from '../../src/main/native-chat/agent-session-wire/structured-agent-session-registry'
+import { useAppStore } from '../../src/renderer/src/store'
+import { applyStructuredSessionTabSnapshots } from '../../src/renderer/src/runtime/local-structured-session-tabs-sync/snapshot-apply'
+import { resetLocalStructuredSessionVersionForTests } from '../../src/renderer/src/runtime/local-structured-session-tabs-sync'
+import { resetWebSessionTabsSnapshotFreshnessForTests } from '../../src/renderer/src/runtime/web-session-tabs-sync'
+import { registerSessionTabIpcBridge } from '../../src/renderer/src/hooks/ipc-events/session-tab-ipc-bridge'
+import { registerTerminalUiRoutingIpcBridge } from '../../src/renderer/src/hooks/ipc-events/terminal-ui-routing-ipc-bridge'
+
+const WORKTREE = 'repo-1::/tmp/wt-reopen'
+const CURRENT_SESSION = 'clear-x'
+const REOPENED_SESSION = 'session-s'
+const CURRENT_TAB = `structured-agent-session-${REOPENED_SESSION}`
+const REOPENED_TAB = `${CURRENT_TAB}:history-1`
+
+type CloseRequest = { requestId: string; tabId: string; worktreeId: string; expiresAt?: number }
+type Listener<T> = (payload: T) => void
+
+type ProcessBoundary = {
+  runtime: Pick<OrcaRuntimeService, 'closeMobileSessionTab'> | null
+  rendererSessionCloses: string[]
+}
+
+const bridge = vi.hoisted((): ProcessBoundary => ({
+  runtime: null,
+  rendererSessionCloses: []
+}))
+
+vi.mock('../../src/renderer/src/runtime/runtime-rpc-client', async (importOriginal) => {
+  const actual = await importOriginal<typeof RuntimeRpcClient>()
+  return {
+    ...actual,
+    callRuntimeRpc: async (
+      _target: unknown,
+      method: string,
+      params: { worktree: string; tabId: string; reason?: 'user' }
+    ) => {
+      if (method !== 'session.tabs.close') {
+        throw new Error(`unexpected rpc ${method}`)
+      }
+      return bridge.runtime!.closeMobileSessionTab(params.worktree, params.tabId, {
+        reason: params.reason
+      })
+    }
+  }
+})
+
+vi.mock('../../src/renderer/src/runtime/structured-agent-session-close', () => ({
+  closeStructuredAgentSession: async (_target: unknown, sessionId: string) => {
+    bridge.rendererSessionCloses.push(sessionId)
+    return 'closed'
+  }
+}))
+
+async function setup() {
+  const listeners: {
+    closeSessionTab?: Listener<{ tabId: string; worktreeId: string }>
+    closeRequest?: Listener<CloseRequest>
+    focusEditorTab?: Listener<{ tabId: string; worktreeId: string; userInitiated?: boolean }>
+  } = {}
+  const pendingResponses = new Map<string, (error?: string) => void>()
+  const register =
+    <T>(assign: (listener: Listener<T>) => void) =>
+    (listener: Listener<T>) => {
+      assign(listener)
+      return () => {}
+    }
+  const noop = () => () => {}
+  vi.stubGlobal('api', {
+    ui: {
+      onCloseSessionTab: register((l) => (listeners.closeSessionTab = l)),
+      onSessionTabCloseRequest: register((l) => (listeners.closeRequest = l)),
+      onFocusEditorTab: register((l) => (listeners.focusEditorTab = l)),
+      onMoveSessionTab: noop,
+      onSplitTerminal: noop,
+      onRenameTerminal: noop,
+      onFocusTerminal: noop,
+      respondSessionTabClose: ({ requestId, error }: { requestId: string; error?: string }) =>
+        pendingResponses.get(requestId)?.(error)
+    }
+  })
+  registerSessionTabIpcBridge([])
+  registerTerminalUiRoutingIpcBridge([])
+
+  const hostSessionCloses: string[] = []
+  const closeResponses: (string | undefined)[] = []
+  const runtime = new OrcaRuntimeService()
+  bridge.runtime = runtime
+  let nextRequest = 0
+  runtime.setNotifier(
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the chat close and focus paths call only these two notifier members.
+    {
+      // Same contract as the window relay: a request the renderer answers with an optional error.
+      closeSessionTab: (tabId: string, worktreeId: string) =>
+        new Promise<void>((resolve, reject) => {
+          const requestId = `close-${++nextRequest}`
+          pendingResponses.set(requestId, (error) => {
+            closeResponses.push(error)
+            return error ? reject(new Error(error)) : resolve()
+          })
+          listeners.closeRequest!({ requestId, tabId, worktreeId })
+        }),
+      focusEditorTab: (tabId: string, worktreeId: string) =>
+        listeners.focusEditorTab!({ tabId, worktreeId })
+    } as never
+  )
+  // No durable store, PTYs or workspace session on disk: the host tab list below is the whole state.
+  Object.assign(runtime, {
+    hasPersistedStructuredAgentSessionStore: () => true,
+    getKnownWorkspaceSessionWorktreeIds: () => new Set(),
+    hydrateHeadlessMobileSessionTabsFromWorkspaceSession: () => new Set(),
+    refreshMobileSessionPtyRecords: async () => new Set(),
+    ensureStructuredAgentSessionHost: async () => undefined
+  })
+  setStructuredAgentSessionHost(
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: restore and tab close call only these host members.
+    {
+      reconcileRestartLeases: async () => undefined,
+      restoreReadableSessions: async () => undefined,
+      close: async (sessionId: string) => {
+        hostSessionCloses.push(sessionId)
+      },
+      setSessionTabVisibility: async () => undefined,
+      listSessionTabs: () => [
+        { sessionId: CURRENT_SESSION, workspaceId: WORKTREE, agent: 'claude' },
+        { sessionId: REOPENED_SESSION, workspaceId: WORKTREE, agent: 'claude' }
+      ]
+    } as never
+  )
+  await runtime.restoreStructuredAgentSessionTabs()
+  const hostSnapshot: RuntimeMobileSessionTabsResult = await runtime.listMobileSessionTabs(
+    `id:${WORKTREE}`
+  )
+
+  // The current chat after /clear: first session's tab id, new session's entity.
+  useAppStore.setState({ activeWorktreeId: WORKTREE })
+  useAppStore.getState().createUnifiedTab(WORKTREE, 'agent-session', {
+    id: CURRENT_TAB,
+    entityId: CURRENT_SESSION,
+    label: 'Claude Chat'
+  })
+  applyStructuredSessionTabSnapshots([hostSnapshot])
+
+  const agentTabs = () =>
+    (useAppStore.getState().unifiedTabsByWorktree[WORKTREE] ?? [])
+      .filter((tab) => tab.contentType === 'agent-session')
+      .map((tab) => ({ id: tab.id, entityId: tab.entityId }))
+  return { runtime, agentTabs, hostSessionCloses, closeResponses }
+}
+
+const initialStoreState = useAppStore.getState()
+
+beforeEach(() => {
+  bridge.rendererSessionCloses = []
+})
+
+afterEach(() => {
+  setStructuredAgentSessionHost(null)
+  bridge.runtime = null
+  useAppStore.setState(initialStoreState, true)
+  resetLocalStructuredSessionVersionForTests()
+  resetWebSessionTabsSnapshotFreshnessForTests()
+  vi.unstubAllGlobals()
+})
+
+describe('closing a chat reopened from history after /clear', () => {
+  it('mirrors the reopened session into a suffixed tab beside the current chat', async () => {
+    const { agentTabs } = await setup()
+
+    expect(agentTabs()).toEqual(
+      expect.arrayContaining([
+        { id: CURRENT_TAB, entityId: CURRENT_SESSION },
+        { id: REOPENED_TAB, entityId: REOPENED_SESSION }
+      ])
+    )
+  })
+
+  it('closes only the reopened tab when the user closes it on the desktop', async () => {
+    const { agentTabs, hostSessionCloses, closeResponses } = await setup()
+
+    useAppStore.getState().closeUnifiedTab(REOPENED_TAB)
+
+    await vi.waitFor(() => expect(hostSessionCloses).toEqual([REOPENED_SESSION]))
+    // Let any stray echo reach the window before asserting the current chat survived.
+    await new Promise((resolve) => setTimeout(resolve, 0))
+    expect(agentTabs()).toEqual([{ id: CURRENT_TAB, entityId: CURRENT_SESSION }])
+    expect(bridge.rendererSessionCloses).toEqual([REOPENED_SESSION])
+    expect(hostSessionCloses).toEqual([REOPENED_SESSION])
+    // The window already removed the tab, so main's relay is acknowledged, not reported missing.
+    expect(closeResponses).toEqual([undefined])
+  })
+
+  it('closes only the reopened tab when a phone closes it through the runtime', async () => {
+    const { runtime, agentTabs, hostSessionCloses } = await setup()
+
+    await runtime.closeMobileSessionTab(`id:${WORKTREE}`, `agent-session:${REOPENED_SESSION}`, {
+      reason: 'user'
+    })
+
+    await vi.waitFor(() =>
+      expect(agentTabs()).toEqual([{ id: CURRENT_TAB, entityId: CURRENT_SESSION }])
+    )
+    expect(bridge.rendererSessionCloses).not.toContain(CURRENT_SESSION)
+    expect(hostSessionCloses).not.toContain(CURRENT_SESSION)
+  })
+
+  it('focuses the reopened tab when a phone activates it through the runtime', async () => {
+    const { runtime } = await setup()
+    useAppStore.getState().activateTab(CURRENT_TAB, { worktreeId: WORKTREE })
+
+    await runtime.activateMobileSessionTab(`id:${WORKTREE}`, `agent-session:${REOPENED_SESSION}`)
+
+    const state = useAppStore.getState()
+    const group = state.groupsByWorktree[WORKTREE]?.find((candidate) =>
+      candidate.tabOrder.includes(REOPENED_TAB)
+    )
+    expect(group?.activeTabId).toBe(REOPENED_TAB)
+  })
+})
diff --git a/tests/e2e/terminal-binding-crash-hydration.unit.test.ts b/tests/e2e/terminal-binding-crash-hydration.unit.test.ts
new file mode 100644
index 000000000000..ec83a396e38e
--- /dev/null
+++ b/tests/e2e/terminal-binding-crash-hydration.unit.test.ts
@@ -0,0 +1,101 @@
+import '../../src/renderer/src/store/slices/terminal-hydration-store-test-bootstrap'
+import { describe, expect, it, vi } from 'vitest'
+import { applyPtyBinding } from '../../src/main/persistence/loading-store/pty-binding-session-update'
+import { getDefaultWorkspaceSession } from '../../src/shared/constants'
+import { folderWorkspaceKey } from '../../src/shared/workspace-scope'
+import type { WorkspaceSessionState } from '../../src/shared/workspace-session-state-types'
+import { reconcileHydratedWorkspaceTabModels } from '../../src/renderer/src/app-shell/reconcile-hydrated-workspace-tab-models'
+import {
+  createTestStore,
+  makeTab,
+  makeWorktree,
+  TEST_REPO
+} from '../../src/renderer/src/store/slices/store-test-helpers'
+
+vi.mock('sonner', () => ({ toast: { info: vi.fn(), success: vi.fn(), error: vi.fn() } }))
+vi.mock('@/runtime/sync-runtime-graph', () => ({ scheduleRuntimeGraphSync: vi.fn() }))
+vi.mock('@/components/terminal-pane/pty-transport', () => ({
+  registerEagerPtyBuffer: vi.fn(),
+  ensurePtyDispatcher: vi.fn()
+}))
+
+const TAB_ID = 'crash-survivor'
+const LEAF_ID = '11111111-1111-4111-8111-111111111111'
+const INCARNATION_ID = '22222222-2222-4222-8222-222222222222'
+const FOLDER_KEY = folderWorkspaceKey('crash-folder')
+
+describe.each(['repo1::/repo1', FOLDER_KEY])('binding crash hydration for %s', (worktreeId) => {
+  it.each([false, true])(
+    'restores the acknowledged terminal before a renderer snapshot (existing row: %s)',
+    async (existingRow) => {
+      const ptyId = `${worktreeId}@@surviving-pty`
+      const persisted: WorkspaceSessionState = {
+        ...getDefaultWorkspaceSession(),
+        activeWorktreeId: worktreeId,
+        activeTabId: TAB_ID,
+        activeTabIdByWorktree: { [worktreeId]: TAB_ID },
+        activeWorktreeIdsOnShutdown: [],
+        unifiedTabs: {},
+        tabGroups: {},
+        tabGroupLayouts: {},
+        ...(existingRow
+          ? { tabsByWorktree: { [worktreeId]: [makeTab({ id: TAB_ID, worktreeId, ptyId: null })] } }
+          : {})
+      }
+      applyPtyBinding(
+        { worktreeId, tabId: TAB_ID, leafId: LEAF_ID, ptyId, incarnationId: INCARNATION_ID },
+        persisted,
+        worktreeId,
+        `${TAB_ID}:${LEAF_ID}`
+      )
+
+      // A crash leaves only the binding transaction; no renderer snapshot can fill its gaps.
+      const restoredSession = structuredClone(persisted)
+      const store = createTestStore()
+      store.setState({
+        repos: [TEST_REPO],
+        worktreesByRepo: {
+          repo1: [makeWorktree({ id: 'repo1::/repo1', repoId: 'repo1', path: '/repo1' })]
+        }
+      })
+      const options = { additionalValidWorkspaceKeys: [FOLDER_KEY] }
+      store.getState().hydrateWorkspaceSession(restoredSession, options)
+      store.getState().hydrateTabsSession(restoredSession, options)
+      reconcileHydratedWorkspaceTabModels(
+        restoredSession,
+        store.getState().reconcileWorktreeTabModels
+      )
+
+      const beforeReconnect = store.getState()
+      expect(beforeReconnect.tabsByWorktree[worktreeId]?.map((tab) => tab.id)).toEqual([TAB_ID])
+      expect(beforeReconnect.pendingReconnectPtyIdByTabId[TAB_ID]).toBe(ptyId)
+      expect(beforeReconnect.unifiedTabsByWorktree[worktreeId]).toEqual([
+        expect.objectContaining({ id: TAB_ID, entityId: TAB_ID, contentType: 'terminal' })
+      ])
+      expect(beforeReconnect.groupsByWorktree[worktreeId]).toEqual([
+        expect.objectContaining({ activeTabId: TAB_ID, tabOrder: [TAB_ID] })
+      ])
+      expect(beforeReconnect.layoutByWorktree[worktreeId]).toEqual({
+        type: 'leaf',
+        groupId: beforeReconnect.groupsByWorktree[worktreeId][0].id
+      })
+      expect(beforeReconnect.terminalLayoutsByTabId[TAB_ID]).toMatchObject({
+        root: { type: 'leaf', leafId: LEAF_ID },
+        activeLeafId: LEAF_ID,
+        ptyIdsByLeafId: { [LEAF_ID]: ptyId }
+      })
+      expect(restoredSession.terminalPtyIncarnationsByPaneKey?.[`${TAB_ID}:${LEAF_ID}`]).toBe(
+        INCARNATION_ID
+      )
+
+      await store.getState().reconnectPersistedTerminals()
+
+      expect(store.getState().workspaceSessionReady).toBe(true)
+      expect(store.getState().activeTabId).toBe(TAB_ID)
+      expect(store.getState().tabsByWorktree[worktreeId]).toEqual([
+        expect.objectContaining({ id: TAB_ID, ptyId })
+      ])
+      expect(store.getState().ptyIdsByTabId[TAB_ID]).toEqual([ptyId])
+    }
+  )
+})
diff --git a/tests/e2e/terminal-codex-cursor-jitter-repro.spec.ts b/tests/e2e/terminal-codex-cursor-jitter-repro.spec.ts
index be3ce0f5003f..ad8de6ecd8eb 100644
--- a/tests/e2e/terminal-codex-cursor-jitter-repro.spec.ts
+++ b/tests/e2e/terminal-codex-cursor-jitter-repro.spec.ts
@@ -5,6 +5,7 @@ import { test, expect } from './helpers/orca-app'
 import { ensureTerminalVisible, waitForActiveWorktree, waitForSessionReady } from './helpers/store'
 import { waitForActiveTerminalManager } from './helpers/terminal'
 import { analyzeRasterCursorCells, type RasterCursorCell } from './terminal-cursor-raster-probe'
+import { quotePowerShellLiteral } from '../../src/shared/powershell-native-argument'
 
 type ShellCase = {
   label: string
@@ -168,10 +169,6 @@ function isUnexpectedVisibleCursorFrame(frame: ScreenSnapshot): boolean {
   return !isInputCursorRow(frame, frame.marker.cellY)
 }
 
-function quotePowerShellSingleQuoted(value: string): string {
-  return `'${value.replaceAll("'", "''")}'`
-}
-
 async function createShellTab(
   page: Page,
   shellOverride: ShellCase['shellOverride']
@@ -251,7 +248,7 @@ async function prepareCodexTerminal(
 
   const launchCommand =
     shellCase.shellOverride === 'powershell.exe'
-      ? `Set-Location -LiteralPath ${quotePowerShellSingleQuoted(process.cwd())}; ${shellCase.codexCommand}`
+      ? `Set-Location -LiteralPath ${quotePowerShellLiteral(process.cwd())}; ${shellCase.codexCommand}`
       : shellCase.codexCommand
   await page.keyboard.insertText(launchCommand)
   await page.keyboard.press('Enter')
diff --git a/tests/e2e/terminal-column-desync-repro.spec.ts b/tests/e2e/terminal-column-desync-repro.spec.ts
index 4d3869f3a01d..c09478ef0a16 100644
--- a/tests/e2e/terminal-column-desync-repro.spec.ts
+++ b/tests/e2e/terminal-column-desync-repro.spec.ts
@@ -111,7 +111,9 @@ async function closeRightSidebarAndFeatureTips(page: Page): Promise<void> {
     if (!store) {
       return
     }
-    store.getState().markFeatureTipsSeen(['orca-cli', 'cmd-j-palette', 'voice-dictation'])
+    store
+      .getState()
+      .markFeatureTipsSeen(['orca-cli', 'cmd-j-palette', 'voice-dictation', 'agent-session-search'])
     if (store.getState().rightSidebarOpen) {
       store.getState().setRightSidebarOpen(false)
     }
diff --git a/tests/e2e/terminal-duplicate-pty-renderer-reveal.spec.ts b/tests/e2e/terminal-duplicate-pty-renderer-reveal.spec.ts
index 2eec7356f65a..48a0f7a118c0 100644
--- a/tests/e2e/terminal-duplicate-pty-renderer-reveal.spec.ts
+++ b/tests/e2e/terminal-duplicate-pty-renderer-reveal.spec.ts
@@ -1,9 +1,8 @@
+import { mutateStoppedProfileState } from './helpers/persisted-profile-state'
 import { randomUUID } from 'node:crypto'
-import { existsSync, readFileSync, writeFileSync } from 'node:fs'
-import path from 'node:path'
+import { existsSync, readFileSync } from 'node:fs'
 import type { ElectronApplication, Page } from '@stablyai/playwright-test'
 import type { TerminalLayoutSnapshot } from '../../src/shared/terminal-tab-types'
-import { DEFAULT_LOCAL_ORCA_PROFILE_ID } from '../../src/shared/orca-profiles'
 import { test, expect } from './helpers/orca-app'
 import {
   findMarkerFrame,
@@ -59,39 +58,36 @@ setInterval(() => {
 `.trim()
 }
 
-function persistedDataPath(userDataDir: string): string {
-  return path.join(userDataDir, 'profiles', DEFAULT_LOCAL_ORCA_PROFILE_ID, 'orca-data.json')
-}
-
 function seedDuplicatePtyOwnership(userDataDir: string): void {
-  const dataPath = persistedDataPath(userDataDir)
-  const data = JSON.parse(readFileSync(dataPath, 'utf8')) as PersistedData
-  const session = data.workspaceSession
-  const tabId = session?.activeTabId
-  const layout = tabId ? session?.terminalLayoutsByTabId?.[tabId] : undefined
-  const retainedLeafId = layout?.activeLeafId
-  const ptyId = retainedLeafId ? layout?.ptyIdsByLeafId?.[retainedLeafId] : undefined
-  if (!session?.terminalLayoutsByTabId || !tabId || !layout || !retainedLeafId || !ptyId) {
-    throw new Error('Persisted terminal ownership was unavailable for duplicate-layout seeding')
-  }
+  return mutateStoppedProfileState(userDataDir, (state) => {
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: This test owns the persisted fixture; optional fields are checked at use sites.
+    const data = state as PersistedData
+    const session = data.workspaceSession
+    const tabId = session?.activeTabId
+    const layout = tabId ? session?.terminalLayoutsByTabId?.[tabId] : undefined
+    const retainedLeafId = layout?.activeLeafId
+    const ptyId = retainedLeafId ? layout?.ptyIdsByLeafId?.[retainedLeafId] : undefined
+    if (!session?.terminalLayoutsByTabId || !tabId || !layout || !retainedLeafId || !ptyId) {
+      throw new Error('Persisted terminal ownership was unavailable for duplicate-layout seeding')
+    }
 
-  const duplicateLeafId = randomUUID()
-  session.terminalLayoutsByTabId[tabId] = {
-    ...layout,
-    root: {
-      type: 'split',
-      direction: 'vertical',
-      first: { type: 'leaf', leafId: retainedLeafId },
-      second: { type: 'leaf', leafId: duplicateLeafId }
-    },
-    activeLeafId: retainedLeafId,
-    expandedLeafId: null,
-    ptyIdsByLeafId: {
-      [retainedLeafId]: ptyId,
-      [duplicateLeafId]: ptyId
+    const duplicateLeafId = randomUUID()
+    session.terminalLayoutsByTabId[tabId] = {
+      ...layout,
+      root: {
+        type: 'split',
+        direction: 'vertical',
+        first: { type: 'leaf', leafId: retainedLeafId },
+        second: { type: 'leaf', leafId: duplicateLeafId }
+      },
+      activeLeafId: retainedLeafId,
+      expandedLeafId: null,
+      ptyIdsByLeafId: {
+        [retainedLeafId]: ptyId,
+        [duplicateLeafId]: ptyId
+      }
     }
-  }
-  writeFileSync(dataPath, `${JSON.stringify(data, null, 2)}\n`)
+  })
 }
 
 async function waitForRestoredTerminal(page: Page, worktreeId: string): Promise<string> {
diff --git a/tests/e2e/terminal-hidden-view-parking.spec.ts b/tests/e2e/terminal-hidden-view-parking.spec.ts
index 6cf877c62573..f050a0e4280d 100644
--- a/tests/e2e/terminal-hidden-view-parking.spec.ts
+++ b/tests/e2e/terminal-hidden-view-parking.spec.ts
@@ -20,7 +20,7 @@ import {
 } from './helpers/terminal'
 import { parkHiddenTabBehindDecoy, waitForTabParked } from './helpers/terminal-hidden-parking'
 import { waitForPtyShellEcho } from './terminal-pty-readiness'
-import { TERMINAL_TAB_PARK_FLIP_BURST_WINDOW_MS } from '../../src/renderer/src/components/terminal-pane/terminal-park-verdict-flip-telemetry'
+import { TERMINAL_TAB_PARK_FLIP_WINDOW_MS } from '../../src/renderer/src/components/terminal-pane/terminal-park-verdict-flip-telemetry'
 
 // Why: the parking wiring registers this handle (dev/exposeStore builds only)
 // so tests can detect that hidden-view parking is compiled in and which delay
@@ -43,7 +43,7 @@ test.use({
 
 const PARKED_FRAME_SCRIPT_DELAY_MS = 750
 const PARKED_FRAME_COUNT = 25
-const PARK_VERDICT_BURST_SETTLE_MS = TERMINAL_TAB_PARK_FLIP_BURST_WINDOW_MS * 4
+const PARK_VERDICT_WINDOW_SETTLE_MS = Math.ceil(TERMINAL_TAB_PARK_FLIP_WINDOW_MS / 5)
 
 function parkedTuiFrame(runId: string, frame: number): string {
   const progress = `${'█'.repeat((frame % 8) + 1)}${'░'.repeat(8 - ((frame % 8) + 1))}`
@@ -478,7 +478,7 @@ test.describe('Terminal hidden view parking', () => {
     orcaPage,
     testRepoPath
   }, testInfo: TestInfo) => {
-    test.setTimeout(180_000)
+    test.setTimeout(420_000)
     await waitForSessionReady(orcaPage)
     const setup = await setUpParkableTabA(orcaPage)
     const { worktreeId, tabAId, tabAPtyId } = setup
@@ -542,8 +542,8 @@ test.describe('Terminal hidden view parking', () => {
       const mismatches: string[] = []
       for (let cycle = 1; cycle < CYCLES; cycle++) {
         // Why: each cycle intentionally flips this tab's rendered verdict twice.
-        // Let the production anti-churn burst window lapse before the next one.
-        await orcaPage.waitForTimeout(PARK_VERDICT_BURST_SETTLE_MS)
+        // Keep each tab below the 12-flip sustained-churn pin in a 60s window.
+        await orcaPage.waitForTimeout(PARK_VERDICT_WINDOW_SETTLE_MS)
         const rows = await runOneParkRevealCycle(cycle)
         if (JSON.stringify(rows) !== JSON.stringify(referenceRows)) {
           mismatches.push(
diff --git a/tests/e2e/terminal-long-table-scroll-restore.spec.ts b/tests/e2e/terminal-long-table-scroll-restore.spec.ts
index 6452207980fa..5aeaabb8ba50 100644
--- a/tests/e2e/terminal-long-table-scroll-restore.spec.ts
+++ b/tests/e2e/terminal-long-table-scroll-restore.spec.ts
@@ -270,7 +270,9 @@ async function readTerminalBoxTableWrapDiagnostics(page: Page): Promise<{
 async function closeFeatureTips(page: Page): Promise<void> {
   await page.evaluate(() => {
     const store = window.__store
-    store?.getState().markFeatureTipsSeen(['orca-cli', 'cmd-j-palette', 'voice-dictation'])
+    store
+      ?.getState()
+      .markFeatureTipsSeen(['orca-cli', 'cmd-j-palette', 'voice-dictation', 'agent-session-search'])
     if (store?.getState().activeModal === 'feature-tips') {
       store.getState().closeModal()
     }
@@ -347,7 +349,12 @@ test.describe('Terminal long table scroll restore repro', () => {
     await orcaPage.evaluate(() => {
       window.__store
         ?.getState()
-        .markFeatureTipsSeen(['orca-cli', 'cmd-j-palette', 'voice-dictation'])
+        .markFeatureTipsSeen([
+          'orca-cli',
+          'cmd-j-palette',
+          'voice-dictation',
+          'agent-session-search'
+        ])
     })
     const firstWorktreeId = await waitForActiveWorktree(orcaPage)
     const secondWorktreeId = (await getAllWorktreeIds(orcaPage)).find(
@@ -409,7 +416,12 @@ test.describe('Terminal long table scroll restore repro', () => {
     await orcaPage.evaluate(() => {
       window.__store
         ?.getState()
-        .markFeatureTipsSeen(['orca-cli', 'cmd-j-palette', 'voice-dictation'])
+        .markFeatureTipsSeen([
+          'orca-cli',
+          'cmd-j-palette',
+          'voice-dictation',
+          'agent-session-search'
+        ])
     })
     const firstWorktreeId = await waitForActiveWorktree(orcaPage)
     const secondWorktreeId = (await getAllWorktreeIds(orcaPage)).find(
@@ -482,7 +494,12 @@ test.describe('Terminal long table scroll restore repro', () => {
     await orcaPage.evaluate(() => {
       window.__store
         ?.getState()
-        .markFeatureTipsSeen(['orca-cli', 'cmd-j-palette', 'voice-dictation'])
+        .markFeatureTipsSeen([
+          'orca-cli',
+          'cmd-j-palette',
+          'voice-dictation',
+          'agent-session-search'
+        ])
     })
     const firstWorktreeId = await waitForActiveWorktree(orcaPage)
     const secondWorktreeId = (await getAllWorktreeIds(orcaPage)).find(
diff --git a/tests/e2e/terminal-node-command.ts b/tests/e2e/terminal-node-command.ts
index 140316497a54..c85dd8136983 100644
--- a/tests/e2e/terminal-node-command.ts
+++ b/tests/e2e/terminal-node-command.ts
@@ -1,13 +1,11 @@
+import { quotePowerShellLiteral } from '../../src/shared/powershell-native-argument'
+
 function quotePosixShellArg(value: string): string {
   return `'${value.replaceAll("'", "'\\''")}'`
 }
 
-function quotePowerShellArg(value: string): string {
-  return `'${value.replaceAll("'", "''")}'`
-}
-
 function quoteTerminalArg(value: string): string {
-  return process.platform === 'win32' ? quotePowerShellArg(value) : quotePosixShellArg(value)
+  return process.platform === 'win32' ? quotePowerShellLiteral(value) : quotePosixShellArg(value)
 }
 
 export function nodeTerminalCommand(args: readonly string[]): string {
diff --git a/tests/e2e/terminal-option-composed-ascii.spec.ts b/tests/e2e/terminal-option-composed-ascii.spec.ts
index 93fe9a74b00d..8aec5f4471cb 100644
--- a/tests/e2e/terminal-option-composed-ascii.spec.ts
+++ b/tests/e2e/terminal-option-composed-ascii.spec.ts
@@ -120,30 +120,32 @@ async function pressOptionComposedKey(
   }, press)
 }
 
-async function armKittyKeyboardFromPty(page: Page, ptyId: string): Promise<void> {
+async function armKittyKeyboardFromPty(page: Page, ptyId: string, flags: number): Promise<void> {
   // Why: this is the byte a real kitty-protocol TUI pushes at startup; routing it
   // through the PTY exercises the same output-scanning mirror the policy reads.
-  await execInTerminal(page, ptyId, `printf '\\033[>1u'`)
+  // `cat` stays in the foreground: flags left armed at exit are grounded by the host.
+  await execInTerminal(page, ptyId, `printf '\\033[>${flags}u'; cat`)
   await expect
     .poll(async () => getPaneKittyKeyboardFlags(page), {
       timeout: 15_000,
       message: 'the pane never mirrored the application kitty keyboard flags'
     })
-    .toBeGreaterThan(0)
+    .toBe(flags)
 }
 
 async function setUpPane(
   page: Page,
-  app: ElectronApplication
-): Promise<{ ptyId: string; joinedWrites: () => Promise<string> }> {
+  app: ElectronApplication,
+  kittyFlags = 1
+): Promise<{ joinedWrites: () => Promise<string> }> {
   await waitForSessionReady(page)
   await waitForActiveWorktree(page)
   await ensureTerminalVisible(page)
   await waitForActiveTerminalManager(page)
   const ptyId = await waitForActivePanePtyId(page)
   await installMainProcessPtyWriteSpy(app)
-  await armKittyKeyboardFromPty(page, ptyId)
-  return { ptyId, joinedWrites: async () => (await getPtyWrites(app)).join('') }
+  await armKittyKeyboardFromPty(page, ptyId, kittyFlags)
+  return { joinedWrites: async () => (await getPtyWrites(app)).join('') }
 }
 
 test.describe('Option-composed text in a kitty-keyboard pane', () => {
@@ -239,9 +241,7 @@ test.describe('Option-composed text in a kitty-keyboard pane', () => {
     orcaPage,
     electronApp
   }) => {
-    const { ptyId, joinedWrites } = await setUpPane(orcaPage, electronApp)
-    await execInTerminal(orcaPage, ptyId, `printf '\\033[<u\\033[>5u'`)
-    await expect.poll(() => getPaneKittyKeyboardFlags(orcaPage)).toBe(5)
+    const { joinedWrites } = await setUpPane(orcaPage, electronApp, 5)
     await setMacOptionAsAlt(orcaPage, 'false')
     await clearPtyWriteLog(electronApp)
     const letters = [
@@ -278,9 +278,7 @@ test.describe('Option-composed text in a kitty-keyboard pane', () => {
     orcaPage,
     electronApp
   }) => {
-    const { ptyId, joinedWrites } = await setUpPane(orcaPage, electronApp)
-    await execInTerminal(orcaPage, ptyId, `printf '\\033[<u\\033[>29u'`)
-    await expect.poll(() => getPaneKittyKeyboardFlags(orcaPage)).toBe(29)
+    const { joinedWrites } = await setUpPane(orcaPage, electronApp, 29)
     await setMacOptionAsAlt(orcaPage, 'false')
     await clearPtyWriteLog(electronApp)
     await pressOptionComposedKey(orcaPage, { key: 'ą', code: 'KeyA' })
@@ -291,9 +289,7 @@ test.describe('Option-composed text in a kitty-keyboard pane', () => {
     orcaPage,
     electronApp
   }, testInfo) => {
-    const { ptyId, joinedWrites } = await setUpPane(orcaPage, electronApp)
-    await execInTerminal(orcaPage, ptyId, `printf '\\033[<u\\033[>5u'; cat`)
-    await expect.poll(() => getPaneKittyKeyboardFlags(orcaPage)).toBe(5)
+    const { joinedWrites } = await setUpPane(orcaPage, electronApp, 5)
     await setMacOptionAsAlt(orcaPage, 'false')
     await clearPtyWriteLog(electronApp)
     const cdp = await orcaPage.context().newCDPSession(orcaPage)
diff --git a/tests/e2e/terminal-pinned-viewport-streaming-switch.spec.ts b/tests/e2e/terminal-pinned-viewport-streaming-switch.spec.ts
index 23672bf7dd7a..d526441b457e 100644
--- a/tests/e2e/terminal-pinned-viewport-streaming-switch.spec.ts
+++ b/tests/e2e/terminal-pinned-viewport-streaming-switch.spec.ts
@@ -51,7 +51,9 @@ for (let tick = 0; tick < 800; tick += 1) {
 async function closeFeatureTips(page: Page): Promise<void> {
   await page.evaluate(() => {
     const store = window.__store
-    store?.getState().markFeatureTipsSeen(['orca-cli', 'cmd-j-palette', 'voice-dictation'])
+    store
+      ?.getState()
+      .markFeatureTipsSeen(['orca-cli', 'cmd-j-palette', 'voice-dictation', 'agent-session-search'])
     if (store?.getState().activeModal === 'feature-tips') {
       store.getState().closeModal()
     }
diff --git a/tests/e2e/terminal-pinned-viewport-worktree-switch.spec.ts b/tests/e2e/terminal-pinned-viewport-worktree-switch.spec.ts
index bef0852dbff0..84f215665d3b 100644
--- a/tests/e2e/terminal-pinned-viewport-worktree-switch.spec.ts
+++ b/tests/e2e/terminal-pinned-viewport-worktree-switch.spec.ts
@@ -39,7 +39,9 @@ await writeStdout('PINNED_VIEWPORT_SWITCH_${runId}_DONE\\n')
 async function closeFeatureTips(page: Page): Promise<void> {
   await page.evaluate(() => {
     const store = window.__store
-    store?.getState().markFeatureTipsSeen(['orca-cli', 'cmd-j-palette', 'voice-dictation'])
+    store
+      ?.getState()
+      .markFeatureTipsSeen(['orca-cli', 'cmd-j-palette', 'voice-dictation', 'agent-session-search'])
     if (store?.getState().activeModal === 'feature-tips') {
       store.getState().closeModal()
     }
diff --git a/tests/e2e/terminal-raw-emoji-table-scroll-restore.spec.ts b/tests/e2e/terminal-raw-emoji-table-scroll-restore.spec.ts
index 3f4d4f17daeb..9835de0566f6 100644
--- a/tests/e2e/terminal-raw-emoji-table-scroll-restore.spec.ts
+++ b/tests/e2e/terminal-raw-emoji-table-scroll-restore.spec.ts
@@ -422,7 +422,9 @@ async function readTerminalRenderDiagnostics(page: Page): Promise<{
 async function closeFeatureTips(page: Page): Promise<void> {
   await page.evaluate(() => {
     const store = window.__store
-    store?.getState().markFeatureTipsSeen(['orca-cli', 'cmd-j-palette', 'voice-dictation'])
+    store
+      ?.getState()
+      .markFeatureTipsSeen(['orca-cli', 'cmd-j-palette', 'voice-dictation', 'agent-session-search'])
     if (store?.getState().activeModal === 'feature-tips') {
       store.getState().closeModal()
     }
diff --git a/tests/e2e/terminal-restart-persistence.spec.ts b/tests/e2e/terminal-restart-persistence.spec.ts
index b9cbd6a00b6e..95bc5a4dd5de 100644
--- a/tests/e2e/terminal-restart-persistence.spec.ts
+++ b/tests/e2e/terminal-restart-persistence.spec.ts
@@ -24,187 +24,33 @@
  *   - Crash/SIGKILL recovery — that is covered by daemon history checkpoints.
  */
 
-import { readFileSync, existsSync } from 'node:fs'
-import type { ElectronApplication, Page } from '@stablyai/playwright-test'
+import type { ElectronApplication } from '@stablyai/playwright-test'
 import { test, expect } from './helpers/orca-app'
-import { TEST_REPO_PATH_FILE } from './global-setup'
 import {
-  discoverActivePtyId,
   execInTerminal,
-  waitForActiveTerminalManager,
   waitForTerminalOutput,
   waitForPaneCount,
   getTerminalContent,
   splitActiveTerminalPane
 } from './helpers/terminal'
-import {
-  waitForSessionReady,
-  waitForActiveWorktree,
-  getActiveWorktreeId,
-  getActiveTabId,
-  getWorktreeTabs,
-  ensureTerminalVisible
-} from './helpers/store'
-import { attachRepoAndOpenTerminal, createRestartSession } from './helpers/orca-restart'
+import { getActiveTabId, getWorktreeTabs } from './helpers/store'
+import { createRestartSession } from './helpers/orca-restart'
 import { PTY_SESSION_ID_SEPARATOR } from '../../src/shared/pty-session-id-format'
-
-const REQUIRE_WINDOWS_TERMINAL_RESTART_E2E =
-  process.env.ORCA_REQUIRE_WINDOWS_TERMINAL_RESTART_E2E === '1'
-const MISSING_SEEDED_REPO_MESSAGE = 'Global setup did not produce a seeded test repo'
-
-// Why: each test in this file does a full quit→relaunch cycle, which spawns
-// two Electron instances back-to-back. Running in serial keeps the isolated
-// userDataDirs from competing for the same Electron cache lock on cold start
-// and keeps the failure mode interpretable when something goes wrong.
+import {
+  seededRepoPathOrSkip,
+  bootstrapFirstLaunch,
+  bootstrapRestoredLaunch,
+  waitForTerminalActiveLine,
+  readTerminalActiveLine,
+  setPaneTitleFromTerminalMenu,
+  getTabCustomTitle,
+  expectSavedLayoutToContainTitle
+} from './helpers/terminal-restart-persistence'
+
+// Each test performs a full quit/relaunch cycle; serialize them to avoid
+// competing Electron cache locks and to keep failures interpretable.
 test.describe.configure({ mode: 'serial' })
 
-function seededRepoPathOrSkip(): string {
-  const repoPath = existsSync(TEST_REPO_PATH_FILE)
-    ? readFileSync(TEST_REPO_PATH_FILE, 'utf-8').trim()
-    : ''
-  const unavailable = !repoPath || !existsSync(repoPath)
-  if (unavailable && REQUIRE_WINDOWS_TERMINAL_RESTART_E2E) {
-    throw new Error('Required Windows restart E2E seeded repo is unavailable')
-  }
-  test.skip(unavailable, MISSING_SEEDED_REPO_MESSAGE)
-  return repoPath
-}
-
-/**
- * Shared bootstrap for a *first* launch: attach the seeded test repo,
- * activate its worktree, ensure a terminal is mounted, and return the
- * PTY id we can drive with `execInTerminal`.
- *
- * Why: every test in this file needs the exact same starting state on the
- * first launch. Inlining it would obscure the thing each test is actually
- * asserting about the *second* launch.
- */
-async function bootstrapFirstLaunch(
-  page: Page,
-  repoPath: string
-): Promise<{ worktreeId: string; ptyId: string }> {
-  const worktreeId = await attachRepoAndOpenTerminal(page, repoPath)
-  await waitForSessionReady(page)
-  await waitForActiveWorktree(page)
-  await ensureTerminalVisible(page)
-
-  const hasPaneManager = await waitForActiveTerminalManager(page, 30_000)
-    .then(() => true)
-    .catch(() => false)
-  if (!hasPaneManager && REQUIRE_WINDOWS_TERMINAL_RESTART_E2E) {
-    throw new Error('Required Windows restart E2E TerminalPane manager did not mount')
-  }
-  test.skip(
-    !hasPaneManager,
-    'Electron automation in this environment never mounts the TerminalPane manager, so restart-persistence assertions would only fail on harness setup.'
-  )
-  await waitForPaneCount(page, 1, 30_000)
-
-  const ptyId = await discoverActivePtyId(page)
-  return { worktreeId, ptyId }
-}
-
-/**
- * Shared bootstrap for a *second* launch: just wait for the session to
- * restore, and confirm the previously-active worktree is the active one
- * again so downstream assertions operate against the right worktree.
- */
-async function bootstrapRestoredLaunch(page: Page, expectedWorktreeId: string): Promise<void> {
-  await waitForSessionReady(page)
-  await expect
-    .poll(async () => getActiveWorktreeId(page), { timeout: 10_000 })
-    .toBe(expectedWorktreeId)
-  await ensureTerminalVisible(page)
-  // Why: the PaneManager remounts asynchronously after session hydration. The
-  // restored terminal surface is what we're about to assert against, so make
-  // sure it exists before any content/layout assertion races.
-  await waitForActiveTerminalManager(page, 30_000)
-  await waitForPaneCount(page, 1, 30_000)
-}
-
-async function setPaneTitleFromTerminalMenu(page: Page, title: string): Promise<void> {
-  const modifiers: ('Alt' | 'Control' | 'Meta' | 'Shift')[] =
-    process.platform === 'win32' ? ['Control'] : []
-  await page
-    .locator('.xterm:visible')
-    .first()
-    .click({ button: 'right', position: { x: 40, y: 40 }, modifiers })
-  await page.getByText('Set Title…', { exact: true }).click()
-  const titleInput = page.locator('.pane-title-input').first()
-  await expect(titleInput).toBeVisible()
-  await titleInput.fill(title)
-  await titleInput.press('Enter')
-}
-
-async function getTabCustomTitle(
-  page: Page,
-  worktreeId: string,
-  tabId: string
-): Promise<string | null> {
-  return page.evaluate(
-    ({ targetWorktreeId, targetTabId }) => {
-      const state = window.__store!.getState()
-      const tab = (state.tabsByWorktree[targetWorktreeId] ?? []).find(
-        (entry) => entry.id === targetTabId
-      )
-      return tab?.customTitle ?? null
-    },
-    { targetWorktreeId: worktreeId, targetTabId: tabId }
-  )
-}
-
-async function readTerminalActiveLine(page: Page): Promise<string | null> {
-  const tabId = await getActiveTabId(page)
-  if (!tabId) {
-    return null
-  }
-  return page.evaluate((tabId) => {
-    const manager = window.__paneManagers?.get(tabId)
-    const pane = manager?.getActivePane?.() ?? manager?.getPanes?.()[0] ?? null
-    const buffer = pane?.terminal?.buffer.active
-    if (!buffer) {
-      return null
-    }
-    const cursorLine = buffer.baseY + buffer.cursorY
-    return buffer.getLine(cursorLine)?.translateToString(true) ?? null
-  }, tabId)
-}
-
-async function waitForTerminalActiveLine(page: Page, expectedText: string): Promise<string> {
-  await expect
-    .poll(async () => (await readTerminalActiveLine(page))?.includes(expectedText), {
-      timeout: 15_000,
-      message: `Terminal cursor line did not contain "${expectedText}"`
-    })
-    .toBe(true)
-
-  const activeLine = await readTerminalActiveLine(page)
-  if (activeLine === null) {
-    throw new Error('Terminal cursor line disappeared after settling')
-  }
-  return activeLine
-}
-
-async function expectSavedLayoutToContainTitle(
-  page: Page,
-  tabId: string,
-  title: string
-): Promise<void> {
-  await expect
-    .poll(
-      () =>
-        page.evaluate(
-          ({ targetTabId, title }) => {
-            const layout = window.__store!.getState().terminalLayoutsByTabId[targetTabId]
-            return Object.values(layout?.titlesByLeafId ?? {}).includes(title)
-          },
-          { targetTabId: tabId, title }
-        ),
-      { timeout: 3_000 }
-    )
-    .toBe(true)
-}
-
 test.describe('Terminal restart persistence', () => {
   test('scrollback survives clean quit and relaunch', async (// oxlint-disable-next-line no-empty-pattern -- Playwright's second fixture arg is testInfo; the first must be an object destructure to opt out of the default fixture set.
   {}, testInfo) => {
diff --git a/tests/e2e/terminal-reveal-stale-pty-resize-repro.spec.ts b/tests/e2e/terminal-reveal-stale-pty-resize-repro.spec.ts
index f2a40b73e67f..c38ad465bbb7 100644
--- a/tests/e2e/terminal-reveal-stale-pty-resize-repro.spec.ts
+++ b/tests/e2e/terminal-reveal-stale-pty-resize-repro.spec.ts
@@ -132,7 +132,9 @@ async function closeRightSidebarAndFeatureTips(page: Page): Promise<void> {
     if (!store) {
       return
     }
-    store.getState().markFeatureTipsSeen(['orca-cli', 'cmd-j-palette', 'voice-dictation'])
+    store
+      .getState()
+      .markFeatureTipsSeen(['orca-cli', 'cmd-j-palette', 'voice-dictation', 'agent-session-search'])
     if (store.getState().rightSidebarOpen) {
       store.getState().setRightSidebarOpen(false)
     }
diff --git a/tests/e2e/terminal-shortcuts.spec.ts b/tests/e2e/terminal-shortcuts.spec.ts
index 85524ec08f7a..c70ab00567b0 100644
--- a/tests/e2e/terminal-shortcuts.spec.ts
+++ b/tests/e2e/terminal-shortcuts.spec.ts
@@ -481,14 +481,12 @@ test.describe('Terminal Shortcuts', () => {
 
     // Why: exercise the production PTY-output tracker, not xterm's renderer-
     // local flag state, so the test covers the bytes the shortcut policy sees.
-    await execInTerminal(orcaPage, ptyId, "printf '\\033[>1u'")
+    // The command disarms its own flags: ones left armed at exit are grounded by the host.
+    await execInTerminal(orcaPage, ptyId, "printf '\\033[>1u'; read -r _; printf '\\033[<u'")
     await expect.poll(() => getKittyKeyboardFlags(orcaPage)).toBe(1)
     await pressAndExpectWrite(orcaPage, electronApp, 'Shift+Enter', '\x1b[13;2u')
 
-    // Clear the shell's unconsumed CSI-u line before resetting flags in a settled
-    // command; otherwise its line editor can swallow the reset bytes.
-    await sendToTerminal(orcaPage, ptyId, '\x15\x03')
-    await execInTerminal(orcaPage, ptyId, "printf '\\033[=0u'")
+    await sendToTerminal(orcaPage, ptyId, '\r')
     await expect.poll(() => getKittyKeyboardFlags(orcaPage)).toBe(0)
     await pressAndExpectWrite(orcaPage, electronApp, 'Shift+Enter', '\x1b\r')
   })
@@ -557,7 +555,10 @@ test.describe('Terminal Shortcuts', () => {
     electronApp
   }) => {
     await installMainProcessPtyWriteSpy(electronApp)
-    await waitForActivePanePtyId(orcaPage)
+    const ptyId = await waitForActivePanePtyId(orcaPage)
+    // SIGINT during shell startup kills the shell, so interrupt only a ready prompt.
+    await execInTerminal(orcaPage, ptyId, 'echo "CTRL_C_""READY"')
+    await waitForTerminalOutput(orcaPage, 'CTRL_C_READY')
     await enableKittyKeyboardReporting(orcaPage, 31)
     await clearPtyWriteLog(electronApp)
     await focusActiveTerminalInput(orcaPage)
diff --git a/tests/e2e/terminal-streaming-refocus-viewport.spec.ts b/tests/e2e/terminal-streaming-refocus-viewport.spec.ts
index 8376a3188a05..91d87d7afb2b 100644
--- a/tests/e2e/terminal-streaming-refocus-viewport.spec.ts
+++ b/tests/e2e/terminal-streaming-refocus-viewport.spec.ts
@@ -26,7 +26,9 @@ type RevealFrame = {
 async function closeFeatureTips(page: Page): Promise<void> {
   await page.evaluate(() => {
     const store = window.__store
-    store?.getState().markFeatureTipsSeen(['orca-cli', 'cmd-j-palette', 'voice-dictation'])
+    store
+      ?.getState()
+      .markFeatureTipsSeen(['orca-cli', 'cmd-j-palette', 'voice-dictation', 'agent-session-search'])
     if (store?.getState().activeModal === 'feature-tips') {
       store.getState().closeModal()
     }
diff --git a/tests/e2e/workspace-session-corrupt-tab-salvage.spec.ts b/tests/e2e/workspace-session-corrupt-tab-salvage.spec.ts
index 50c3d153101c..26ce06e0da8e 100644
--- a/tests/e2e/workspace-session-corrupt-tab-salvage.spec.ts
+++ b/tests/e2e/workspace-session-corrupt-tab-salvage.spec.ts
@@ -1,7 +1,9 @@
-import { existsSync, readFileSync, writeFileSync } from 'node:fs'
-import path from 'node:path'
+import {
+  readPersistedProfileState,
+  mutateStoppedProfileState
+} from './helpers/persisted-profile-state'
+import { existsSync, readFileSync } from 'node:fs'
 import type { ElectronApplication, Page } from '@stablyai/playwright-test'
-import { DEFAULT_LOCAL_ORCA_PROFILE_ID } from '../../src/shared/orca-profiles'
 import { test, expect } from './helpers/orca-app'
 import { attachRepoAndOpenTerminal, createRestartSession } from './helpers/orca-restart'
 import { ensureTerminalVisible, getActiveWorktreeId, waitForSessionReady } from './helpers/store'
@@ -18,34 +20,32 @@ type PersistedData = {
   }
 }
 
-function persistedDataPath(userDataDir: string): string {
-  return path.join(userDataDir, 'profiles', DEFAULT_LOCAL_ORCA_PROFILE_ID, 'orca-data.json')
-}
-
 function injectTruncatedTab(userDataDir: string, worktreeId: string, startupCwd: string): void {
-  const dataPath = persistedDataPath(userDataDir)
-  const data = JSON.parse(readFileSync(dataPath, 'utf8')) as PersistedData
-  const tabs = data.workspaceSession?.tabsByWorktree?.[worktreeId]
-  if (!tabs) {
-    throw new Error('Persisted terminal tabs were unavailable for corruption seeding')
-  }
-  tabs.push({
-    id: CORRUPT_TAB_ID,
-    ptyId: null,
-    worktreeId,
-    title: 'Truncated terminal',
-    sortOrder: 999,
-    generation: 3,
-    startupCwd
+  return mutateStoppedProfileState(userDataDir, (state) => {
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: This test owns the persisted fixture; optional fields are checked at use sites.
+    const data = state as PersistedData
+    const tabs = data.workspaceSession?.tabsByWorktree?.[worktreeId]
+    if (!tabs) {
+      throw new Error('Persisted terminal tabs were unavailable for corruption seeding')
+    }
+    tabs.push({
+      id: CORRUPT_TAB_ID,
+      ptyId: null,
+      worktreeId,
+      title: 'Truncated terminal',
+      sortOrder: 999,
+      generation: 3,
+      startupCwd
+    })
   })
-  writeFileSync(dataPath, `${JSON.stringify(data, null, 2)}\n`)
 }
 
 function persistedSessionEvidence(
   userDataDir: string,
   worktreeId: string
 ): { corruptLegacyTabPresent: boolean; unifiedTabIds: string[] } {
-  const data = JSON.parse(readFileSync(persistedDataPath(userDataDir), 'utf8')) as PersistedData
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: This test owns the persisted fixture; optional fields are checked at use sites.
+  const data = readPersistedProfileState(userDataDir) as PersistedData
   const legacyTabs = data.workspaceSession?.tabsByWorktree?.[worktreeId] ?? []
   const unifiedTabs = data.workspaceSession?.unifiedTabs?.[worktreeId] ?? []
   return {
diff --git a/tests/e2e/worktree-jump-sleep-focus.spec.ts b/tests/e2e/worktree-jump-sleep-focus.spec.ts
new file mode 100644
index 000000000000..eacdea6b8927
--- /dev/null
+++ b/tests/e2e/worktree-jump-sleep-focus.spec.ts
@@ -0,0 +1,68 @@
+import { test, expect } from './helpers/orca-app'
+import {
+  ensureTerminalVisible,
+  getAllWorktreeIds,
+  switchToWorktree,
+  waitForActiveWorktree,
+  waitForSessionReady
+} from './helpers/store'
+import {
+  waitForActivePanePtyId,
+  waitForActiveTerminalManager,
+  waitForTerminalOutput
+} from './helpers/terminal'
+
+test('Cmd+J focuses the terminal after waking a sleeping workspace', async ({
+  orcaPage
+}, testInfo) => {
+  await waitForSessionReady(orcaPage)
+  const source = await waitForActiveWorktree(orcaPage)
+  const target = (await getAllWorktreeIds(orcaPage)).find((id) => id !== source)
+  if (!target) {
+    throw new Error('Expected a second seeded workspace')
+  }
+  await switchToWorktree(orcaPage, target)
+  await ensureTerminalVisible(orcaPage)
+  await waitForActiveTerminalManager(orcaPage)
+  await waitForActivePanePtyId(orcaPage)
+  const targetName = await orcaPage.evaluate((id) => {
+    const state = window.__store!.getState()
+    const worktree = state.getKnownWorktreeById(id)
+    if (!worktree) {
+      throw new Error('Missing target workspace')
+    }
+    return worktree.branch.replace(/^refs\/heads\//, '')
+  }, target)
+  await switchToWorktree(orcaPage, source)
+  await orcaPage.evaluate(async (id) => {
+    await window.__store!.getState().shutdownWorktreeTerminals(id, { keepIdentifiers: true })
+  }, target)
+  await orcaPage.evaluate(() => {
+    const listSessions = window.api.pty.listSessions
+    window.api.pty.listSessions = async (...args) => {
+      await new Promise((resolve) => setTimeout(resolve, 100))
+      return listSessions(...args)
+    }
+  })
+  // Native menu accelerators require OS focus; open the same palette in the hidden renderer.
+  await orcaPage.evaluate(() => window.__store!.getState().openModal('worktree-palette'))
+  const dialog = orcaPage.getByRole('dialog', { name: 'Jump to...' })
+  await expect(dialog).toBeVisible()
+  await dialog.getByRole('combobox').fill(targetName)
+  await expect(dialog.locator('[cmdk-item][data-selected="true"]')).toContainText(targetName)
+  const cdp = await orcaPage.context().newCDPSession(orcaPage)
+  await cdp.send('Emulation.setCPUThrottlingRate', { rate: 8 })
+  await orcaPage.keyboard.press('Enter')
+  await expect(dialog).toBeHidden()
+  await waitForActiveTerminalManager(orcaPage)
+  await waitForActivePanePtyId(orcaPage)
+  const terminal = orcaPage.locator('[data-terminal-tab-id]:visible .xterm-helper-textarea').first()
+  await orcaPage.screenshot({ path: testInfo.outputPath('wake-focus.png') })
+  await expect(terminal).toBeFocused()
+  await cdp.send('Emulation.setCPUThrottlingRate', { rate: 1 })
+  await cdp.detach()
+  await orcaPage.keyboard.type('echo WAKE_KEYBOARD_OK')
+  await orcaPage.keyboard.press('Enter')
+  await waitForTerminalOutput(orcaPage, 'WAKE_KEYBOARD_OK')
+  await orcaPage.screenshot({ path: testInfo.outputPath('wake-typing.png') })
+})
diff --git a/tests/e2e/worktree-scroll-to-current.spec.ts b/tests/e2e/worktree-scroll-to-current.spec.ts
index 07f9f87d05c5..cdb39420ef05 100644
--- a/tests/e2e/worktree-scroll-to-current.spec.ts
+++ b/tests/e2e/worktree-scroll-to-current.spec.ts
@@ -40,7 +40,7 @@ test.describe('Reveal active workspace button', () => {
   // (not a scenario real users hit). Reveal-into-view is covered robustly by
   // the "outside the virtualized window" test below.
 
-  test('clears sidebar filters before revealing a hidden current workspace', async ({
+  test('adjusts sidebar filters before revealing a hidden current workspace', async ({
     orcaPage,
     testRepoPath
   }, testInfo) => {
@@ -94,6 +94,13 @@ test.describe('Reveal active workspace button', () => {
     if (!targetId) {
       throw new Error('Seeded secondary worktree is missing')
     }
+    const targetRepoId = await orcaPage.evaluate(
+      (repoPath) => window.__store!.getState().repos.find((repo) => repo.path === repoPath)?.id,
+      testRepoPath
+    )
+    if (!targetRepoId) {
+      throw new Error('Seeded repository is missing')
+    }
 
     const targetRows = orcaPage.locator(
       `[data-worktree-sidebar] [data-worktree-id=${JSON.stringify(targetId)}]`
@@ -132,7 +139,7 @@ test.describe('Reveal active workspace button', () => {
     await revealButton.click()
     await orcaPage
       .getByRole('dialog', { name: 'Reveal hidden workspace?' })
-      .getByRole('button', { name: 'Clear filters and reveal' })
+      .getByRole('button', { name: 'Adjust filters and reveal' })
       .click()
 
     await expect(targetRow).toBeVisible()
@@ -149,10 +156,11 @@ test.describe('Reveal active workspace button', () => {
           }),
         {
           timeout: 10_000,
-          message: 'Reveal button should clear repo filters that hide the current workspace'
+          message:
+            'Reveal button should preserve selected repos while revealing the current workspace'
         }
       )
-      .toEqual([])
+      .toEqual([filterRepoId, targetRepoId])
   })
 
   test('reveals the current workspace when it starts outside the virtualized window', async ({
diff --git a/tests/tools/omp-source-control-runtime-smoke.mjs b/tests/tools/omp-source-control-runtime-smoke.mjs
index 8dce4a547754..9e806320270f 100644
--- a/tests/tools/omp-source-control-runtime-smoke.mjs
+++ b/tests/tools/omp-source-control-runtime-smoke.mjs
@@ -4,7 +4,9 @@ import { join, resolve } from 'node:path'
 import { getCommitMessageAgentSpec } from '../../src/shared/commit-message-agent-spec.ts'
 const reference = process.argv[2]
 assert.ok(reference, 'Pass the read-only source checkout path')
-const { parseArgs } = await import(pathToFileURL(join(resolve(reference), 'packages/coding-agent/src/cli/args.ts')).href)
+const { parseArgs } = await import(
+  pathToFileURL(join(resolve(reference), 'packages/coding-agent/src/cli/args.ts')).href
+)
 const spec = getCommitMessageAgentSpec('omp')
 assert.ok(spec)
 for (const model of ['default', 'provider/model']) {
@@ -20,4 +22,12 @@ for (const model of ['default', 'provider/model']) {
   assert.equal(parsed.model, model === 'default' ? undefined : model)
   assert.deepEqual(parsed.messages, [])
 }
-console.log(JSON.stringify({ actualArgumentParser: true, promptDelivery: spec.promptDelivery, configDefault: true, explicitModel: true, modelCalls: 0 }))
+console.log(
+  JSON.stringify({
+    actualArgumentParser: true,
+    promptDelivery: spec.promptDelivery,
+    configDefault: true,
+    explicitModel: true,
+    modelCalls: 0
+  })
+)
diff --git a/tests/tools/win-update-e2e/app-driver.mjs b/tests/tools/win-update-e2e/app-driver.mjs
index 33f59121f879..62165bfdcd1a 100644
--- a/tests/tools/win-update-e2e/app-driver.mjs
+++ b/tests/tools/win-update-e2e/app-driver.mjs
@@ -20,6 +20,7 @@ import { execFileSync } from 'node:child_process'
 import { mkdirSync, realpathSync, writeFileSync } from 'node:fs'
 import path from 'node:path'
 import { seedFreshProfile } from './onboarding-profile.mjs'
+import { isPidAlive } from './daemon-processes.mjs'
 
 const NEW_TAB_BUTTON = { role: 'button', name: 'New tab' }
 const NEW_TERMINAL_ITEM = /New Terminal/i
@@ -237,7 +238,7 @@ export async function waitForTerminalReady(page, timeoutMs = 60_000, terminalTab
  *     workspace (which would mask a broken restore).
  */
 export async function ensureTerminal(page, { allowCreate = true, timeoutMs = 60_000 } = {}) {
-  // Why: the agent-CLI feature-wall modal can already be up at first interaction
+  // Why: a feature-tip modal can already be up at first interaction
   // (it renders off an async capability check that races app launch). Use the
   // Escape-free dismissal so we never inject a keypress into a restored terminal.
   await dismissKnownOverlays(page)
@@ -295,14 +296,20 @@ async function createWorkspaceFromSeededRepo(page, timeoutMs) {
 }
 
 const OVERLAY_DISMISS_LABELS = ['Got it', 'Dismiss setup scripts', 'Dismiss tip', 'Dismiss update']
-const CLI_FEATURE_TIP_TITLE = 'Let agents drive Orca with the Orca CLI'
+const FEATURE_TIP_DIALOG_TITLES = [
+  'Let agents drive Orca with the Orca CLI',
+  'Search every agent session'
+]
 
 async function dismissKnownOverlays(page) {
   let acted = false
-  const cliFeatureTip = page.getByRole('dialog', { name: CLI_FEATURE_TIP_TITLE }).first()
-  if (await cliFeatureTip.isVisible().catch(() => false)) {
+  for (const name of FEATURE_TIP_DIALOG_TITLES) {
+    const featureTip = page.getByRole('dialog', { name }).first()
+    if (!(await featureTip.isVisible().catch(() => false))) {
+      continue
+    }
     // Why: a global "Close" role also matches the Windows/Linux title-bar button.
-    const dialogClose = cliFeatureTip.locator('[data-slot="dialog-close"]').first()
+    const dialogClose = featureTip.locator('[data-slot="dialog-close"]').first()
     if (await dialogClose.isVisible().catch(() => false)) {
       const clicked = await dialogClose
         .click({ timeout: 3_000 })
@@ -484,30 +491,84 @@ export async function readTerminalTextBestEffort(page) {
   })
 }
 
-/**
- * Close the app gracefully; force-kill its process tree on timeout. Mirrors
- * tests/e2e/helpers/electron-process-shutdown.ts so the daemon (detached) is
- * left alive exactly as a normal quit would.
- */
-export async function closeApp(app, timeoutMs = 10_000) {
+const appShutdownProcesses = {
+  isPidAlive,
+  killTree(pid) {
+    execFileSync('taskkill', ['/pid', String(pid), '/T', '/F'], { stdio: 'ignore' })
+  }
+}
+
+/** Cleanup may kill the tree; survival proofs must disable that fallback. */
+export async function closeApp(
+  app,
+  timeoutMs = 10_000,
+  { allowForceKill = true, processes = appShutdownProcesses } = {}
+) {
   // A partially-created session (launch failed before assignment) passes undefined.
   if (!app) {
     return
   }
-  const mainPid = await resolveElectronMainPid(app)
+  const mainPid = await resolveElectronMainPid(app, { allowLauncherFallback: allowForceKill })
+  const launcher = app.process()
+  let closeStatus = 'not-started'
   let closeTimeout
   try {
+    if (!allowForceKill && mainPid === null) {
+      throw new Error('Cannot verify graceful close without the authoritative Electron PID')
+    }
+    closeStatus = 'pending'
+    const closePromise = app.close().then(
+      () => {
+        closeStatus = 'resolved'
+      },
+      (error) => {
+        closeStatus = 'rejected'
+        throw error
+      }
+    )
     await Promise.race([
-      app.close(),
+      closePromise,
       new Promise((_, reject) => {
         closeTimeout = setTimeout(() => reject(new Error('close timeout')), timeoutMs)
         closeTimeout.unref?.()
       })
     ])
-  } catch {
+    if (!allowForceKill && processes.isPidAlive(mainPid)) {
+      throw new Error('Playwright close resolved while the authoritative Electron PID remains live')
+    }
+  } catch (error) {
+    if (!allowForceKill) {
+      const evidence = {
+        closeStatus,
+        error: error instanceof Error ? error.message : String(error),
+        main: readClosePidEvidence(mainPid, processes),
+        launcher: {
+          ...readClosePidEvidence(launcher?.pid, processes),
+          exitCode: launcher?.exitCode ?? null,
+          signalCode: launcher?.signalCode ?? null,
+          stdio:
+            launcher?.stdio.map((pipe, fd) => ({
+              fd,
+              destroyed: pipe?.destroyed ?? null,
+              readableEnded: pipe?.readableEnded ?? null
+            })) ?? []
+        }
+      }
+      // A surviving daemon can keep the launcher's pipes open after both app processes exit.
+      if (
+        closeStatus === 'pending' &&
+        evidence.main.state === 'exited' &&
+        evidence.launcher.state === 'exited'
+      ) {
+        console.log(`[win-update-e2e] close-verified-by-pids: ${JSON.stringify(evidence)}`)
+        return
+      }
+      console.error(`[win-update-e2e] strict-close-failed: ${JSON.stringify(evidence)}`)
+      throw error
+    }
     if (mainPid) {
       try {
-        execFileSync('taskkill', ['/pid', String(mainPid), '/T', '/F'], { stdio: 'ignore' })
+        processes.killTree(mainPid)
       } catch {
         /* already gone */
       }
@@ -518,3 +579,18 @@ export async function closeApp(app, timeoutMs = 10_000) {
     clearTimeout(closeTimeout)
   }
 }
+
+function readClosePidEvidence(pid, processes) {
+  if (!Number.isInteger(pid) || pid <= 0) {
+    return { pid: pid ?? null, state: 'unverifiable', error: 'PID unavailable' }
+  }
+  try {
+    return { pid, state: processes.isPidAlive(pid) ? 'live' : 'exited' }
+  } catch (error) {
+    return {
+      pid,
+      state: 'unverifiable',
+      error: error instanceof Error ? error.message : String(error)
+    }
+  }
+}
diff --git a/tests/tools/win-update-e2e/app-driver.test.mjs b/tests/tools/win-update-e2e/app-driver.test.mjs
index ac0347662574..14eda7caf17f 100644
--- a/tests/tools/win-update-e2e/app-driver.test.mjs
+++ b/tests/tools/win-update-e2e/app-driver.test.mjs
@@ -10,46 +10,51 @@ function hiddenButton() {
   }
 }
 
+const FEATURE_TIP_TITLES = ['Let agents drive Orca with the Orca CLI', 'Search every agent session']
+
 describe('dismissOverlays', () => {
-  it('dismisses a dialog without clicking the desktop window Close button', async () => {
-    const dialogClose = {
-      first: vi.fn(),
-      isVisible: vi.fn().mockResolvedValue(true),
-      click: vi.fn().mockResolvedValue(undefined)
-    }
-    dialogClose.first.mockReturnValue(dialogClose)
-    const windowClose = {
-      first: vi.fn(),
-      isVisible: vi.fn().mockResolvedValue(true),
-      click: vi.fn().mockRejectedValue(new Error('window closed'))
-    }
-    windowClose.first.mockReturnValue(windowClose)
-    const featureTipDialog = {
-      first: vi.fn(),
-      isVisible: vi.fn().mockResolvedValue(true),
-      locator: vi.fn().mockReturnValue(dialogClose)
-    }
-    featureTipDialog.first.mockReturnValue(featureTipDialog)
+  it.each(FEATURE_TIP_TITLES)(
+    'dismisses %s without clicking the desktop window Close button',
+    async (title) => {
+      const dialogClose = {
+        first: vi.fn(),
+        isVisible: vi.fn().mockResolvedValue(true),
+        click: vi.fn().mockResolvedValue(undefined)
+      }
+      dialogClose.first.mockReturnValue(dialogClose)
+      const windowClose = {
+        first: vi.fn(),
+        isVisible: vi.fn().mockResolvedValue(true),
+        click: vi.fn().mockRejectedValue(new Error('window closed'))
+      }
+      windowClose.first.mockReturnValue(windowClose)
+      const featureTipDialog = {
+        first: vi.fn(),
+        isVisible: vi.fn().mockResolvedValue(true),
+        locator: vi.fn().mockReturnValue(dialogClose)
+      }
+      featureTipDialog.first.mockReturnValue(featureTipDialog)
 
-    const page = {
-      getByRole: vi.fn((role, { name }) => {
-        if (role === 'dialog') {
-          return featureTipDialog
-        }
-        return name === 'Close' ? windowClose : hiddenButton()
-      }),
-      keyboard: { press: vi.fn().mockResolvedValue(undefined) },
-      waitForTimeout: vi.fn().mockResolvedValue(undefined)
-    }
+      const page = {
+        getByRole: vi.fn((role, { name }) => {
+          if (role === 'dialog') {
+            return name === title ? featureTipDialog : hiddenButton()
+          }
+          return name === 'Close' ? windowClose : hiddenButton()
+        }),
+        keyboard: { press: vi.fn().mockResolvedValue(undefined) },
+        waitForTimeout: vi.fn().mockResolvedValue(undefined)
+      }
 
-    await dismissOverlays(page, 1)
+      await dismissOverlays(page, 1)
 
-    expect(dialogClose.click).toHaveBeenCalledOnce()
-    expect(windowClose.click).not.toHaveBeenCalled()
-    expect(page.getByRole).toHaveBeenCalledWith('dialog', {
-      name: 'Let agents drive Orca with the Orca CLI'
-    })
-  })
+      expect(dialogClose.click).toHaveBeenCalledOnce()
+      expect(windowClose.click).not.toHaveBeenCalled()
+      expect(page.getByRole).toHaveBeenCalledWith('dialog', {
+        name: title
+      })
+    }
+  )
 
   it('keeps overlay retries within the caller timeout budget', async () => {
     vi.useFakeTimers()
@@ -145,44 +150,64 @@ describe('dismissOverlays', () => {
     }
   })
 
-  it('dismisses the CLI tip without sending Escape into an already-restored terminal', async () => {
-    const dialogClose = {
-      first: vi.fn(),
-      isVisible: vi.fn().mockResolvedValue(true),
-      click: vi.fn().mockResolvedValue(undefined)
-    }
-    dialogClose.first.mockReturnValue(dialogClose)
-    const featureTipDialog = {
-      first: vi.fn(),
-      isVisible: vi.fn().mockResolvedValue(true),
-      locator: vi.fn().mockReturnValue(dialogClose)
+  it.each(FEATURE_TIP_TITLES)(
+    'dismisses %s without sending Escape into an already-restored terminal',
+    async (title) => {
+      const dialogClose = {
+        first: vi.fn(),
+        isVisible: vi.fn().mockResolvedValue(true),
+        click: vi.fn().mockResolvedValue(undefined)
+      }
+      dialogClose.first.mockReturnValue(dialogClose)
+      const featureTipDialog = {
+        first: vi.fn(),
+        isVisible: vi.fn().mockResolvedValue(true),
+        locator: vi.fn().mockReturnValue(dialogClose)
+      }
+      featureTipDialog.first.mockReturnValue(featureTipDialog)
+      const xterm = {
+        first: vi.fn(),
+        waitFor: vi.fn().mockResolvedValue(undefined)
+      }
+      xterm.first.mockReturnValue(xterm)
+      const terminalSurface = {
+        first: vi.fn(),
+        isVisible: vi.fn().mockResolvedValue(true),
+        waitFor: vi.fn().mockResolvedValue(undefined),
+        locator: vi.fn().mockReturnValue(xterm)
+      }
+      terminalSurface.first.mockReturnValue(terminalSurface)
+      const page = {
+        locator: vi.fn().mockReturnValue(terminalSurface),
+        getByRole: vi.fn((role, { name }) =>
+          role === 'dialog' && name === title ? featureTipDialog : hiddenButton()
+        ),
+        keyboard: { press: vi.fn().mockResolvedValue(undefined) }
+      }
+
+      await ensureTerminal(page, { allowCreate: false })
+
+      expect(dialogClose.click).toHaveBeenCalledOnce()
+      expect(page.keyboard.press).not.toHaveBeenCalled()
     }
-    featureTipDialog.first.mockReturnValue(featureTipDialog)
-    const xterm = {
+  )
+
+  it('dismisses a late session-search tip without dismissing or reopening the composer', async () => {
+    let tipVisible = false
+    const tipClose = {
       first: vi.fn(),
-      waitFor: vi.fn().mockResolvedValue(undefined)
+      isVisible: vi.fn(async () => tipVisible),
+      click: vi.fn(async () => {
+        tipVisible = false
+      })
     }
-    xterm.first.mockReturnValue(xterm)
-    const terminalSurface = {
+    tipClose.first.mockReturnValue(tipClose)
+    const sessionSearchTip = {
       first: vi.fn(),
-      isVisible: vi.fn().mockResolvedValue(true),
-      waitFor: vi.fn().mockResolvedValue(undefined),
-      locator: vi.fn().mockReturnValue(xterm)
-    }
-    terminalSurface.first.mockReturnValue(terminalSurface)
-    const page = {
-      locator: vi.fn().mockReturnValue(terminalSurface),
-      getByRole: vi.fn((role) => (role === 'dialog' ? featureTipDialog : hiddenButton())),
-      keyboard: { press: vi.fn().mockResolvedValue(undefined) }
+      isVisible: vi.fn(async () => tipVisible),
+      locator: vi.fn().mockReturnValue(tipClose)
     }
-
-    await ensureTerminal(page, { allowCreate: false })
-
-    expect(dialogClose.click).toHaveBeenCalledOnce()
-    expect(page.keyboard.press).not.toHaveBeenCalled()
-  })
-
-  it('submits within the composer without dismissing and reopening it', async () => {
+    sessionSearchTip.first.mockReturnValue(sessionSearchTip)
     const newWorkspace = {
       first: vi.fn(),
       click: vi.fn().mockResolvedValue(undefined)
@@ -192,8 +217,13 @@ describe('dismissOverlays', () => {
       last: vi.fn(),
       click: vi
         .fn()
-        .mockRejectedValueOnce(new Error('submit was briefly intercepted'))
-        .mockResolvedValueOnce(undefined)
+        .mockImplementationOnce(async () => {
+          tipVisible = true
+          throw new Error('session-search tip intercepted submission')
+        })
+        .mockImplementationOnce(async () => {
+          expect(tipVisible).toBe(false)
+        })
     }
     createWorktree.last.mockReturnValue(createWorktree)
     const composer = {
@@ -226,6 +256,9 @@ describe('dismissOverlays', () => {
       ),
       getByRole: vi.fn((role, { name }) => {
         if (role === 'dialog') {
+          if (name === 'Search every agent session') {
+            return sessionSearchTip
+          }
           return name === 'Create worktree' ? composer : hiddenButton()
         }
         return name === 'New workspace' ? newWorkspace : hiddenButton()
@@ -238,6 +271,9 @@ describe('dismissOverlays', () => {
 
     expect(composer.getByRole).toHaveBeenCalledWith('button', { name: /^Create worktree/ })
     expect(unintendedDialogClose.click).not.toHaveBeenCalled()
+    expect(tipClose.click).toHaveBeenCalledOnce()
+    expect(page.keyboard.press).not.toHaveBeenCalled()
+    expect(newWorkspace.click).toHaveBeenCalledOnce()
     expect(createWorktree.click).toHaveBeenCalledTimes(2)
   })
 
diff --git a/tests/tools/win-update-e2e/app-shutdown.test.mjs b/tests/tools/win-update-e2e/app-shutdown.test.mjs
new file mode 100644
index 000000000000..bad1ab8e6f6d
--- /dev/null
+++ b/tests/tools/win-update-e2e/app-shutdown.test.mjs
@@ -0,0 +1,119 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { closeApp } from './app-driver.mjs'
+
+const processes = {
+  isPidAlive: vi.fn().mockReturnValue(true),
+  killTree: vi.fn()
+}
+const strictCloseOptions = { allowForceKill: false, processes }
+
+afterEach(() => {
+  vi.useRealTimers()
+  vi.clearAllMocks()
+  processes.isPidAlive.mockReturnValue(true)
+})
+
+describe('update-survival shutdown', () => {
+  it('keeps the force-kill fallback enabled for best-effort cleanup', async () => {
+    const app = {
+      evaluate: vi.fn().mockResolvedValue(123),
+      process: () => ({ pid: 124, stdio: [] }),
+      close: vi.fn().mockRejectedValue(new Error('quit rejected'))
+    }
+
+    await closeApp(app, 45_000, { processes })
+
+    expect(processes.killTree).toHaveBeenCalledExactlyOnceWith(123)
+  })
+
+  it('fails before installation instead of killing the daemon tree after a rejected close', async () => {
+    const failure = new Error('quit rejected')
+    const app = {
+      evaluate: vi.fn().mockResolvedValue(123),
+      process: () => ({ pid: 124, stdio: [] }),
+      close: vi.fn().mockRejectedValue(failure)
+    }
+
+    await expect(closeApp(app, 45_000, strictCloseOptions)).rejects.toBe(failure)
+    expect(processes.killTree).not.toHaveBeenCalled()
+  })
+
+  it('allows normal teardown past ten seconds and still rejects a wedged quit without a tree kill', async () => {
+    vi.useFakeTimers()
+    const app = {
+      evaluate: vi.fn().mockResolvedValue(123),
+      process: () => ({ pid: 124, stdio: [] }),
+      close: vi.fn(() => new Promise(() => {}))
+    }
+    const closed = closeApp(app, 45_000, strictCloseOptions)
+    const rejected = expect(closed).rejects.toThrow('close timeout')
+
+    await vi.advanceTimersByTimeAsync(30_000)
+    expect(vi.getTimerCount()).toBe(1)
+    expect(processes.killTree).not.toHaveBeenCalled()
+    await vi.advanceTimersByTimeAsync(15_000)
+    await rejected
+    expect(processes.killTree).not.toHaveBeenCalled()
+    expect(vi.getTimerCount()).toBe(0)
+  })
+
+  it('rejects a resolved close while the authoritative main remains live', async () => {
+    const app = {
+      evaluate: vi.fn().mockResolvedValue(123),
+      process: () => ({ pid: 124, stdio: [] }),
+      close: vi.fn().mockResolvedValue(undefined)
+    }
+
+    await expect(closeApp(app, 45_000, strictCloseOptions)).rejects.toThrow(
+      'authoritative Electron PID remains live'
+    )
+    expect(processes.isPidAlive).toHaveBeenCalledWith(123)
+    expect(processes.killTree).not.toHaveBeenCalled()
+  })
+
+  it('accepts verified main and launcher exit while inherited pipes keep close pending', async () => {
+    vi.useFakeTimers()
+    processes.isPidAlive.mockReturnValue(false)
+    const app = {
+      evaluate: vi.fn().mockResolvedValue(123),
+      process: () => ({ pid: 124, exitCode: 0, stdio: [{ readableEnded: false }] }),
+      close: vi.fn(() => new Promise(() => {}))
+    }
+    const closed = expect(closeApp(app, 45_000, strictCloseOptions)).resolves.toBeUndefined()
+
+    await vi.advanceTimersByTimeAsync(45_000)
+    await closed
+    expect(processes.isPidAlive).toHaveBeenCalledWith(123)
+    expect(processes.isPidAlive).toHaveBeenCalledWith(124)
+    expect(processes.killTree).not.toHaveBeenCalled()
+    expect(vi.getTimerCount()).toBe(0)
+  })
+
+  it.each(['live', 'unverifiable'])(
+    'rejects a %s launcher even when the main exited',
+    async (state) => {
+      vi.useFakeTimers()
+      processes.isPidAlive.mockImplementation((pid) => {
+        if (pid === 123) {
+          return false
+        }
+        if (state === 'unverifiable') {
+          throw new Error('process query failed')
+        }
+        return true
+      })
+      const app = {
+        evaluate: vi.fn().mockResolvedValue(123),
+        process: () => ({ pid: 124, stdio: [] }),
+        close: vi.fn(() => new Promise(() => {}))
+      }
+      const closed = expect(closeApp(app, 45_000, strictCloseOptions)).rejects.toThrow(
+        'close timeout'
+      )
+
+      await vi.advanceTimersByTimeAsync(45_000)
+      await closed
+      expect(processes.killTree).not.toHaveBeenCalled()
+    }
+  )
+})
diff --git a/tests/tools/win-update-e2e/run.mjs b/tests/tools/win-update-e2e/run.mjs
index 7c8d8cde6c5b..fc0ec4b36a63 100644
--- a/tests/tools/win-update-e2e/run.mjs
+++ b/tests/tools/win-update-e2e/run.mjs
@@ -220,9 +220,19 @@ async function runProof(ctx, args) {
   const preScrollback = await readTerminalTextBestEffort(session.page)
 
   // Close app normally; the detached daemon must remain alive.
-  await closeApp(session.app)
+  // Allow renderer acknowledgement and teardown; a tree kill invalidates survival evidence.
+  await closeApp(session.app, 45_000, { allowForceKill: false })
   const daemonAliveAfterClose = preDaemon.pid != null && isPidAlive(preDaemon.pid)
   log('daemon', `alive after app close: ${daemonAliveAfterClose}`)
+  log('marker', `alive after graceful app close: ${isPidAlive(created.markerPid)}`)
+  await delay(60_000)
+  log(
+    'pre-install-control',
+    JSON.stringify({
+      daemonAlive: preDaemon.pid != null && isPidAlive(preDaemon.pid),
+      markerAlive: isPidAlive(created.markerPid)
+    })
+  )
 
   // --- Start the console-window watch through the whole update + soak ---
   const watchDuration = 120 + opts.soakSeconds
@@ -241,6 +251,15 @@ async function runProof(ctx, args) {
   // uninstalls THAT and never scan-discovers the developer's real install.
   ctx.installedExePath = updated.exePath
   log('update', `installed ${updated.exePath} (version ${updated.version})`)
+  log(
+    'post-install-before-relaunch',
+    JSON.stringify({
+      daemonPid: preDaemon.pid,
+      daemonAlive: preDaemon.pid == null ? null : isPidAlive(preDaemon.pid),
+      markerPid: created.markerPid,
+      markerAlive: created.markerPid == null ? null : isPidAlive(created.markerPid)
+    })
+  )
 
   // --- Relaunch and gather post-update evidence ---
   session = await launchInstalledApp({ exePath: updated.exePath, userDataDir })
diff --git a/tests/tools/win-update-e2e/trace-installer-branches.mjs b/tests/tools/win-update-e2e/trace-installer-branches.mjs
new file mode 100644
index 000000000000..78dc59b64f8e
--- /dev/null
+++ b/tests/tools/win-update-e2e/trace-installer-branches.mjs
@@ -0,0 +1,115 @@
+import { readFileSync, writeFileSync } from 'node:fs'
+import { createRequire } from 'node:module'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const require = createRequire(import.meta.url)
+const builderRequire = createRequire(require.resolve('electron-builder/package.json'))
+const builderRoot = path.dirname(builderRequire.resolve('app-builder-lib/package.json'))
+const processChecks = path.join(
+  builderRoot,
+  'templates/nsis/include/allowOnlyOneInstallerInstance.nsh'
+)
+const hooks = fileURLToPath(
+  new URL('../../../config/nsis/orca-installer-hooks.nsh', import.meta.url)
+)
+const capabilityCheck = fileURLToPath(
+  new URL('../../../config/nsis/orca-process-check.nsh', import.meta.url)
+)
+
+// CI-only patch: the installer and its embedded uninstaller share these macros.
+const traceMacro = `
+!macro ORCA_E2E_TRACE TEXT
+  Push $R8
+  Push $R9
+  StrCpy $R8 0
+  \${if} \${Errors}
+    StrCpy $R8 1
+  \${endIf}
+  ClearErrors
+  ReadEnvStr $R9 ORCA_E2E_NSIS_TRACE
+  \${if} $R9 != ""
+    FileOpen $R9 "$R9" a
+    \${ifNot} \${Errors}
+      FileSeek $R9 0 END
+      FileWrite $R9 "$EXEPATH | $CMDLINE | dir=$INSTDIR | \${TEXT}$\\r$\\n"
+      FileClose $R9
+    \${endIf}
+  \${endIf}
+  ClearErrors
+  \${if} $R8 == 1
+    SetErrors
+  \${endIf}
+  Pop $R9
+  Pop $R8
+!macroend
+`
+
+function replaceOnce(source, anchor, replacement) {
+  if (source.split(anchor).length !== 2) {
+    throw new Error(`Expected one NSIS trace anchor: ${anchor}`)
+  }
+  return source.replace(anchor, () => replacement)
+}
+
+function insertAfter(source, anchor, insertion) {
+  return replaceOnce(source, anchor, `${anchor}\n${insertion}`)
+}
+
+let checks = readFileSync(processChecks, 'utf8').replaceAll('\r\n', '\n')
+checks = traceMacro + checks
+checks = insertAfter(
+  checks,
+  '!macro FIND_PROCESS _FILE _RETURN',
+  '  !insertmacro ORCA_E2E_TRACE "find image=${_FILE} branch=$IsPowerShellAvailable"'
+)
+checks = insertAfter(
+  checks,
+  '!macro KILL_PROCESS _FILE _FORCE',
+  '  !insertmacro ORCA_E2E_TRACE "kill image=${_FILE} force=${_FORCE} branch=$IsPowerShellAvailable"'
+)
+checks = replaceOnce(
+  checks,
+  '  Pop $0\n!macroend ',
+  '  Pop $0\n  !insertmacro ORCA_E2E_TRACE "kill-result=$0"\n!macroend '
+)
+const findCall = '!insertmacro FIND_PROCESS "${APP_EXECUTABLE_FILENAME}" $R0'
+if (checks.split(findCall).length !== 4) {
+  throw new Error('Expected three find-process calls')
+}
+checks = checks.replaceAll(
+  findCall,
+  () => `${findCall}\n    !insertmacro ORCA_E2E_TRACE "find-result=$R0"`
+)
+let uninstall = readFileSync(hooks, 'utf8').replaceAll('\r\n', '\n')
+uninstall = insertAfter(
+  uninstall,
+  '!macro customUnInstall',
+  '  !insertmacro ORCA_E2E_TRACE "custom-uninstall entered"'
+)
+uninstall = insertAfter(
+  uninstall,
+  '  ${ifNot} ${isUpdated}',
+  '    !insertmacro ORCA_E2E_TRACE "genuine-uninstall daemon sweep"'
+)
+let capability = readFileSync(capabilityCheck, 'utf8').replaceAll('\r\n', '\n')
+capability = insertAfter(
+  capability,
+  '  Pop $0',
+  '  !insertmacro ORCA_E2E_TRACE "capability=$0 powershell=$PowerShellPath"'
+)
+capability = replaceOnce(
+  capability,
+  '  !insertmacro _CHECK_APP_RUNNING',
+  '  !insertmacro ORCA_E2E_TRACE "selected-branch=$IsPowerShellAvailable (0=path,1=image)"\n  !insertmacro _CHECK_APP_RUNNING'
+)
+
+if (!process.argv.includes('--check')) {
+  if (process.env.GITHUB_ACTIONS !== 'true' || process.platform !== 'win32') {
+    throw new Error('Installer tracing may only patch a disposable Windows CI checkout')
+  }
+  writeFileSync(processChecks, checks)
+  writeFileSync(hooks, uninstall)
+  writeFileSync(capabilityCheck, capability)
+}
+console.log('Validated installer/uninstaller branch-trace anchors')